diff --git a/.build/entrypoint.sh b/.build/entrypoint.sh
new file mode 100644
index 00000000000..16d61c041cd
--- /dev/null
+++ b/.build/entrypoint.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$GOARCH" ]] && fail "A GOARCH has not been defined"
+[[ -z "$GITHUB_TOKEN" ]] && fail "A GITHUB_TOKEN has not been defined"
+
+host_arch="$(dpkg --print-architecture)"
+host_arch="${host_arch##*-}"
+if [[ "$host_arch" != "$GOARCH" ]]; then
+  # We're building for a different architecture than our target host OS so
+  # we have to tell the Go compiler to use the correct C cross-compiler for
+  # our target instead of relying on the host C compiler.
+  #
+  # https://packages.ubuntu.com/search?suite=noble&section=all&arch=any&keywords=linux-gnu-gcc&searchon=contents
+  case "$GOARCH" in
+    amd64)
+      export CC=x86_64-linux-gnu-gcc
+      ;;
+    arm64)
+      export CC=aarch64-linux-gnu-gcc
+      ;;
+    s390x)
+      export CC=s390x-linux-gnu-gcc
+      ;;
+    *)
+      fail "Building for $GOARCH has not been implemented"
+      ;;
+  esac
+fi
+
+# Install our tools if necessary
+if ! ./tools.sh check-external; then
+  ./tools.sh install-external
+fi
+
+# Assume that /build is where we've mounted the vault repo.
+git config --global --add safe.directory /build
+git config --global url."https://${GITHUB_TOKEN}@github.com".insteadOf "https://github.com"
+
+# Exec our command
+cd build || exit 1
+exec "$@"
diff --git a/.build/go.sh b/.build/go.sh
new file mode 100644
index 00000000000..758ba0d7a18
--- /dev/null
+++ b/.build/go.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+set -e
+
+host_arch="$(dpkg --print-architecture)"
+host_arch="${host_arch##*-}"
+curl -L "https://go.dev/dl/go${GO_VERSION}.linux-${host_arch}.tar.gz" | tar -C /opt -zxv
diff --git a/.build/system.sh b/.build/system.sh
new file mode 100644
index 00000000000..6a9aa79b396
--- /dev/null
+++ b/.build/system.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+export DEBIAN_FRONTEND=noninteractive
+
+install() {
+  apt-get install -y "$@"
+}
+
+# Install our cross building tools
+# https://packages.ubuntu.com/search?suite=noble&section=all&arch=any&keywords=crossbuild-essential&searchon=names
+
+apt-get update
+apt-get install -y --no-install-recommends build-essential \
+  gcc-s390x-linux-gnu \
+  crossbuild-essential-s390x \
+  ca-certificates \
+  curl \
+  git
+
+host_arch="$(dpkg --print-architecture)"
+host_arch="${host_arch##*-}"
+case "$host_arch" in
+  amd64)
+    install crossbuild-essential-arm64 gcc-aarch64-linux-gnu
+    ;;
+  arm64)
+    install gcc-x86-64-linux-gnu
+    ;;
+  *)
+    echo "Building on $host_arch has not been implemented" 1>&2
+    exit 1
+    ;;
+esac
+
+# Clean up after ourselves for a minimal image
+apt-get clean
+rm -rf /var/lib/apt/lists/*
diff --git a/.copywrite.hcl b/.copywrite.hcl
index de148843b44..b4001d8315f 100644
--- a/.copywrite.hcl
+++ b/.copywrite.hcl
@@ -1,8 +1,9 @@
 schema_version = 1
 
 project {
-  license        = "BUSL-1.1"
-  copyright_year = 2024
+  license          = "BUSL-1.1"
+  copyright_year   = 2025
+  copyright_holder = "IBM Corp."
 
   # (OPTIONAL) A list of globs that should not have copyright/license headers.
   # Supports doublestar glob patterns for more flexibility in defining which
@@ -12,5 +13,8 @@ project {
     "ui/node_modules/**",
     "enos/modules/k8s_deploy_vault/raft-config.hcl",
     "plugins/database/postgresql/scram/**",
+    "enos/.enos/**",
+    "enos/k8s/.enos/**",
+    "enos/.terraform/**",
   ]
 }
diff --git a/.github/.secret_scanning.yml b/.github/.secret_scanning.yml
index 47005963047..7255c0ca923 100644
--- a/.github/.secret_scanning.yml
+++ b/.github/.secret_scanning.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 paths-ignore:
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 00000000000..46132393c86
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,109 @@
+# Each line is a file pattern followed by one or more owners. Being an owner
+# means those groups or individuals will be added as reviewers to PRs affecting
+# those areas of the code.
+#
+# More on CODEOWNERS files: https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
+# Default CODEOWNER primarily for contact purposes
+* @hashicorp/vault
+
+# Select Auth engines are owned by Ecosystem
+/builtin/credential/aws/      @hashicorp/vault-ecosystem
+/builtin/credential/github/   @hashicorp/vault-ecosystem
+/builtin/credential/ldap/     @hashicorp/vault-ecosystem
+/builtin/credential/okta/     @hashicorp/vault-ecosystem
+
+# Secrets engines (pki, ssh, totp and transit omitted)
+/builtin/logical/aws/         @hashicorp/vault-ecosystem
+/builtin/logical/cassandra/   @hashicorp/vault-ecosystem
+/builtin/logical/consul/      @hashicorp/vault-ecosystem
+/builtin/logical/database/    @hashicorp/vault-ecosystem
+/builtin/logical/mongodb/     @hashicorp/vault-ecosystem
+/builtin/logical/mssql/       @hashicorp/vault-ecosystem
+/builtin/logical/mysql/       @hashicorp/vault-ecosystem
+/builtin/logical/nomad/       @hashicorp/vault-ecosystem
+/builtin/logical/postgresql/  @hashicorp/vault-ecosystem
+/builtin/logical/rabbitmq/    @hashicorp/vault-ecosystem
+
+# Identity Integrations (OIDC, tokens)
+/vault/identity_store_oidc*   @hashicorp/vault-ecosystem
+
+/plugins/                     @hashicorp/vault-ecosystem
+/vault/plugin_catalog.go      @hashicorp/vault-ecosystem
+
+# Content on developer.hashicorp.com
+
+# Web presence gets notified of, and can approve changes to web tooling, but not content.
+
+/website/               @hashicorp/web-presence
+/website/data/
+/website/public/
+/website/content/
+
+# Education gets notified of, and can approve changes to web content.
+
+/website/data/          @hashicorp/vault-education-approvers
+/website/public/        @hashicorp/vault-education-approvers
+/website/content/       @hashicorp/vault-education-approvers
+/website/templates/     @hashicorp/vault-education-approvers
+/website/redirects.js   @hashicorp/vault-education-approvers
+
+# Plugin docs
+/website/content/docs/plugins/              @hashicorp/vault-ecosystem @hashicorp/vault-education-approvers
+/website/content/docs/upgrading/plugins.mdx @hashicorp/vault-ecosystem @hashicorp/vault-education-approvers
+
+/ui/  @hashicorp/vault-ui
+# UI code related to Vault's JWT/OIDC auth method and OIDC provider.
+# Changes to these files often require coordination with backend code,
+# so stewards of the backend code are added below for notification.
+/ui/app/components/auth/form/oidc-jwt.ts @hashicorp/vault-ui @hashicorp/vault-ecosystem
+/ui/app/components/auth/form/saml.ts     @hashicorp/vault-ui @hashicorp/vault-ecosystem
+/ui/app/routes/vault/cluster/oidc-*.js   @hashicorp/vault-ui @hashicorp/vault-ecosystem
+
+# Release config; service account is required for automation tooling.
+/.release/                     @hashicorp/github-secure-vault-core @hashicorp/team-vault-quality
+/.github/workflows/build.yml   @hashicorp/github-secure-vault-core @hashicorp/team-vault-quality
+
+# Quality engineering
+/.github/  @hashicorp/team-vault-quality
+/enos/     @hashicorp/team-vault-quality
+
+# Cryptosec
+/api/auth/cert/                                      @hashicorp/vault-crypto
+/builtin/logical/pki/                                @hashicorp/vault-crypto
+/builtin/logical/pkiext/                             @hashicorp/vault-crypto
+/website/content/docs/secrets/pki/                   @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/pki/                @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/pki.mdx             @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/builtin/credential/cert/                            @hashicorp/vault-crypto
+/website/content/docs/auth/cert.mdx                  @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/auth/cert.mdx              @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/builtin/logical/ssh/                                @hashicorp/vault-crypto
+/website/content/docs/secrets/ssh/                   @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/ssh.mdx             @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/builtin/logical/transit/                            @hashicorp/vault-crypto
+/website/content/docs/secrets/transit/               @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/transit.mdx         @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/helper/random/                                      @hashicorp/vault-crypto
+/sdk/helper/certutil/                                @hashicorp/vault-crypto
+/sdk/helper/cryptoutil/                              @hashicorp/vault-crypto
+/sdk/helper/kdf/                                     @hashicorp/vault-crypto
+/sdk/helper/keysutil/                                @hashicorp/vault-crypto
+/sdk/helper/ocsp/                                    @hashicorp/vault-crypto
+/sdk/helper/salt/                                    @hashicorp/vault-crypto
+/sdk/helper/tlsutil/                                 @hashicorp/vault-crypto
+/shamir/                                             @hashicorp/vault-crypto
+/vault/barrier*                                      @hashicorp/vault-crypto
+/vault/managed_key*                                  @hashicorp/vault-crypto
+/vault/seal*                                         @hashicorp/vault-crypto
+/vault/seal/                                         @hashicorp/vault-crypto
+/website/content/docs/configuration/seal/            @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/enterprise/sealwrap.mdx        @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/system/sealwrap-rewrap.mdx @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/secrets/transform/             @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/transform.mdx       @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/secrets/kmip-profiles.mdx      @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/secrets/kmip.mdx               @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/api-docs/secret/kmip.mdx            @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/enterprise/fips/               @hashicorp/vault-crypto @hashicorp/vault-education-approvers
+/website/content/docs/platform/k8s                   @hashicorp/vault-ecosystem @hashicorp/vault-education-approvers
+/website/content/                                    @hashicorp/vault-customer-engineering @hashicorp/vault-education-approvers
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index d313527dcd8..b74b0e29cac 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 contact_links:
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
deleted file mode 100644
index 281951c170b..00000000000
--- a/.github/actionlint.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-self-hosted-runner:
-  # Labels of self-hosted runner in array of string
-  labels:
-    - small
-    - medium
-    - large
-    - ondemand
-    - disk_gb=64
-    - os=linux
-    - type=m5.2xlarge
-    - type=c6a.xlarge
-    - type=c6a.4xlarge
-    - ubuntu-20.04
-    - custom-linux-small-vault-latest
-    - custom-linux-medium-vault-latest
-    - custom-linux-xl-vault-latest
diff --git a/.github/actionlint.yml b/.github/actionlint.yml
new file mode 100644
index 00000000000..42c6e432a78
--- /dev/null
+++ b/.github/actionlint.yml
@@ -0,0 +1,20 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+self-hosted-runner:
+  # Labels of self-hosted runner in array of string
+  labels:
+    - small
+    - medium
+    - large
+    - xlarge
+    - ondemand
+    - disk_gb=64
+    - os=linux
+    - os=ubuntu-arm
+    - type=m5.2xlarge
+    - type=c6a.xlarge
+    - type=c6g.2xlarge
+    - type=c6a.4xlarge
+    - ubuntu-latest-x64
+    - custom-linux-xl-vault-latest
diff --git a/.github/actions/build-vault/action.yml b/.github/actions/build-vault/action.yml
index a4ae210bbbb..bc2859a905c 100644
--- a/.github/actions/build-vault/action.yml
+++ b/.github/actions/build-vault/action.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 ---
@@ -11,59 +11,44 @@ description: |
 
 inputs:
   github-token:
-    type: string
     description: An elevated Github token to access private Go modules if necessary.
     default: ""
   cgo-enabled:
-    type: number
     description: Enable or disable CGO during the build.
-    default: 0
+    default: "0"
   create-docker-container:
-    type: boolean
     description: Package the binary into a Docker/AWS container.
-    default: true
+    default: "true"
   create-redhat-container:
-    type: boolean
     description: Package the binary into a Redhat container.
-    default: false
+    default: "false"
   create-packages:
-    type: boolean
     description: Package the binaries into deb and rpm formats.
-    default: true
+    default: "true"
   goos:
-    type: string
     description: The Go GOOS value environment variable to set during the build.
   goarch:
-    type: string
     description: The Go GOARCH value environment variable to set during the build.
   goarm:
-    type: string
     description: The Go GOARM value environment variable to set during the build.
     default: ""
   goexperiment:
-    type: string
     description: Which Go experiments to enable.
     default: ""
   go-tags:
-    type: string
     description: A comma separated list of tags to pass to the Go compiler during build.
     default: ""
   package-name:
-    type: string
     description: The name to use for the linux packages.
     default: ${{ github.event.repository.name }}
   vault-binary-name:
-    type: string
     description: The name of the vault binary.
     default: vault
   vault-edition:
-    type: string
     description: The edition of vault to build.
   vault-version:
-    type: string
     description: The version metadata to inject into the build via the linker.
   web-ui-cache-key:
-    type: string
     description: The cache key for restoring the pre-built web UI artifact.
 
 outputs:
@@ -74,24 +59,17 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Ensure zstd is available for actions/cache
-      # actions/cache restores based on cache key and "cache version", the former is unique to the
-      # build job or web UI, the latter is a hash which is based on the runner OS, the paths being
-      # cached, and the program used to compress it. Most of our workflows will use zstd to compress
-      # the cached artifact so we have to have it around for our machines to get both a version match
-      # and to decompress it. Most runners include zstd by default but there are exception like
-      # our Ubuntu 20.04 compatibility runners which do not.
-      shell: bash
-      run: which zstd || (sudo apt update && sudo apt install -y zstd)
-    - uses: ./.github/actions/set-up-go
+    - id: set-up-go
+      uses: ./.github/actions/set-up-go
       with:
         github-token: ${{ inputs.github-token }}
+    - uses: ./.github/actions/install-tools # sets env.VAULT_TOOLS_PATH
     - if: inputs.vault-edition != 'ce'
       name: Configure Git
       shell: bash
       run: git config --global url."https://${{ inputs.github-token }}:@github.com".insteadOf "https://github.com"
     - name: Restore UI from cache
-      uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         # Restore the UI asset from the UI build workflow. Never use a partial restore key.
         enableCrossOsArchive: true
@@ -111,19 +89,39 @@ runs:
         if [[ '${{ inputs.vault-edition }}' =~ 'ce' ]]; then
           build_step_name='Vault ${{ inputs.goos }} ${{ inputs.goarch }} v${{ inputs.vault-version }}'
           package_version='${{ inputs.vault-version }}'
+          linux_package_license='BUSL-1.1'
         else
           build_step_name='Vault ${{ inputs.goos }} ${{ inputs.goarch }} v${{ inputs.vault-version }}+${{ inputs.vault-edition }}'
           package_version='${{ inputs.vault-version }}+ent' # this should always be +ent here regardless of enterprise edition
+          linux_package_license='IPLA'
         fi
+        # Generate a builder cache key that considers anything that might change
+        # our build container, including:
+        # - The Go version we're building with
+        # - External Go build tooling as defined in tools/tools.sh
+        # - The Dockerfile or .build directory
+        # - The build-vault Github action
+        docker_sha=$(git ls-tree HEAD Dockerfile --object-only --abbrev=5)
+        build_sha=$(git ls-tree HEAD .build --object-only --abbrev=5)
+        tools_sha=$(git ls-tree HEAD tools/tools.sh --object-only --abbrev=5)
+        github_sha=$(git ls-tree HEAD .github/actions/build-vault --object-only --abbrev=5)
         {
           echo "artifact-basename=$(make ci-get-artifact-basename)"
           echo "binary-path=dist/${{ inputs.vault-binary-name }}"
           echo "build-step-name=${build_step_name}"
+          echo "vault-builder-cache-key=${docker_sha}-${build_sha}-${tools_sha}-${github_sha}-$(cat .go-version)"
           echo "package-version=${package_version}"
+          echo "linux_package_license=${linux_package_license}"
         } | tee -a "$GITHUB_OUTPUT"
-    - name: ${{ steps.metadata.outputs.build-step-name }}
+    - if: inputs.vault-edition != 'ce'
+      id: build-vault-select-license
+      uses: hashicorp-forge/actions-pao-tool/select-license@6997f7457c338e008506005cc370e7b02f7fb421 # v1.0.3
+      with:
+        arch: ${{ matrix.goarch }}
+    - if: inputs.cgo-enabled == '0'
+      name: ${{ steps.metadata.outputs.build-step-name }}
       env:
-        CGO_ENABLED: ${{ inputs.cgo-enabled }}
+        CGO_ENABLED: 0
         GO_TAGS: ${{ inputs.go-tags }}
         GOARCH: ${{ inputs.goarch }}
         GOARM: ${{ inputs.goarm }}
@@ -134,22 +132,99 @@ runs:
         VERSION_METADATA: ${{ inputs.vault-edition != 'ce' && inputs.vault-edition || '' }}
       shell: bash
       run: make ci-build
+    - if: inputs.cgo-enabled == '1'
+      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      with:
+        driver-opts: network=host # So we can run our own little registry
+    - if: inputs.cgo-enabled == '1'
+      shell: bash
+      run: docker run -d -p 5000:5000 --restart always --name registry registry:2
+    - name: Build CGO builder image
+      if: inputs.cgo-enabled == '1'
+      id: build-push-action-attempt-1
+      continue-on-error: true # we will retry this if it fails
+      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+      env:
+        DOCKER_BUILD_SUMMARY: false
+      with:
+        context: .
+        build-args: |
+          GO_VERSION=${{ steps.set-up-go.outputs.go-version }}
+        # Only build a container for the host OS since the same container
+        # handles cross building.
+        platforms: linux/amd64
+        push: true
+        target: builder
+        tags: localhost:5000/vault-builder:${{ steps.metadata.outputs.vault-builder-cache-key }}
+        # Upload the resulting minimal image to actions cache. This could
+        # be a problem if the resulting images are too big.
+        cache-from: type=gha,scope=vault-builder-${{ steps.metadata.outputs.vault-builder-cache-key }}
+        cache-to: type=gha,mode=min,scope=vault-builder-${{ steps.metadata.outputs.vault-builder-cache-key }}
+        github-token: ${{ inputs.github-token }}
+    - name: Build CGO builder image
+      id: build-push-action-attempt-2
+      continue-on-error: false
+      if: inputs.cgo-enabled == '1' && steps.build-push-action-attempt-1.outcome != 'success'
+      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+      env:
+        DOCKER_BUILD_SUMMARY: false
+      with:
+        context: .
+        build-args: |
+          GO_VERSION=${{ steps.set-up-go.outputs.go-version }}
+        # Only build a container for the host OS since the same container
+        # handles cross building.
+        platforms: linux/amd64
+        push: true
+        target: builder
+        tags: localhost:5000/vault-builder:${{ steps.metadata.outputs.vault-builder-cache-key }}
+        # Upload the resulting minimal image to actions cache. This could
+        # be a problem if the resulting images are too big.
+        cache-from: type=gha,scope=vault-builder-${{ steps.metadata.outputs.vault-builder-cache-key }}
+        cache-to: type=gha,mode=min,scope=vault-builder-${{ steps.metadata.outputs.vault-builder-cache-key }}
+        github-token: ${{ inputs.github-token }}
+    - if: inputs.cgo-enabled == '1'
+      name: ${{ steps.metadata.outputs.build-step-name }}
+      shell: bash
+      run: |
+        mkdir -p dist
+        mkdir -p out
+        docker run \
+          -v $(pwd):/build \
+          -v ${VAULT_TOOLS_PATH}:/opt/tools/bin \
+          -v $(go env GOMODCACHE):/go-mod-cache \
+            --env GITHUB_TOKEN='${{ inputs.github-token }}' \
+            --env CGO_ENABLED=1 \
+            --env GO_TAGS='${{ inputs.go-tags }}' \
+            --env GOARCH='${{ inputs.goarch }}' \
+            --env GOARM='${{ inputs.goarm }}' \
+            --env GOEXPERIMENT='${{ inputs.goexperiment }}' \
+            --env GOMODCACHE=/go-mod-cache \
+            --env GOOS='${{ inputs.goos }}' \
+            --env VERSION='${{ inputs.version }}' \
+            --env VERSION_METADATA='${{ inputs.vault-edition != 'ce' && inputs.vault-edition || '' }}' \
+              localhost:5000/vault-builder:${{ steps.metadata.outputs.vault-builder-cache-key }} \
+                make ci-build
     - if: inputs.vault-edition != 'ce'
       shell: bash
-      run: make ci-prepare-legal
+      run: make ci-prepare-ent-legal
+      env:
+        LICENSE_DIR: "${{ steps.build-vault-select-license.outputs.license-path }}/Softcopy"
+    - if: inputs.vault-edition == 'ce'
+      shell: bash
+      run: make ci-prepare-ce-legal
     - name: Bundle Vault
       env:
         BUNDLE_PATH: out/${{ steps.metadata.outputs.artifact-basename }}.zip
       shell: bash
       run: make ci-bundle
-    # Use actions/upload-artifact @3.x until https://hashicorp.atlassian.net/browse/HREL-99 is resolved
-    - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ steps.metadata.outputs.artifact-basename }}.zip
         path: out/${{ steps.metadata.outputs.artifact-basename }}.zip
         if-no-files-found: error
     - if: inputs.create-packages == 'true'
-      uses: hashicorp/actions-packaging-linux@v1
+      uses: hashicorp/actions-packaging-linux@33f7d23b14f24e6a7b7d9948cb7f5caca2045ee3
       with:
         name: ${{ inputs.package-name }}
         description: Vault is a tool for secrets management, encryption as a service, and privileged access management.
@@ -157,7 +232,7 @@ runs:
         version: ${{ steps.metadata.outputs.package-version }}
         maintainer: HashiCorp
         homepage: https://github.com/hashicorp/vault
-        license: BUSL-1.1
+        license: ${{ steps.metadata.outputs.linux_package_license }}
         binary: ${{ steps.metadata.outputs.binary-path }}
         deb_depends: openssl
         rpm_depends: openssl
@@ -175,15 +250,13 @@ runs:
           echo "deb-files=$(basename out/*.deb)"
         } | tee -a "$GITHUB_OUTPUT"
     - if: inputs.create-packages == 'true'
-      # Use actions/upload-artifact @3.x until https://hashicorp.atlassian.net/browse/HREL-99 is resolved
-      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ steps.package-files.outputs.rpm-files }}
         path: out/${{ steps.package-files.outputs.rpm-files }}
         if-no-files-found: error
     - if: inputs.create-packages == 'true'
-      # Use actions/upload-artifact @3.x until https://hashicorp.atlassian.net/browse/HREL-99 is resolved
-      uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ steps.package-files.outputs.deb-files }}
         path: out/${{ steps.package-files.outputs.deb-files }}
diff --git a/.github/actions/changed-files/action.yml b/.github/actions/changed-files/action.yml
index cde4feee0c2..a555b43b491 100644
--- a/.github/actions/changed-files/action.yml
+++ b/.github/actions/changed-files/action.yml
@@ -1,73 +1,46 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 ---
-name: Determine what files changed between two git referecnes.
+name: Determine what files have changed on either a pull request or commit.
 description: |
-  Determine what files have changed between two git references. If the github.event_type is
-  pull_request we'll compare the github.base_ref (merge target) and pull request head SHA.
-  For other event types we'll gather the changed files from the most recent commit. This allows
-  us to support PR and merge workflows.
+  Determine what files have changed on either a pull request or commit.
+  Writes the list of files to
+
+inputs:
+  github-token:
+    description: A preferred Github token to access private modules if necessary.
 
 outputs:
-  app-changed:
-    description: Whether or not the vault Go app was modified.
-    value: ${{ steps.changed-files.outputs.app-changed }}
-  docs-changed:
-    description: Whether or not the documentation was modified.
-    value: ${{ steps.changed-files.outputs.docs-changed }}
-  ui-changed:
-    description: Whether or not the web UI was modified.
-    value: ${{ steps.changed-files.outputs.ui-changed }}
-  files:
-    description: All of the file names that changed.
-    value: ${{ steps.changed-files.outputs.files }}
+  changed-files:
+    description: All of the files that changed.
+    value: ${{ steps.changed-files.outputs.changed-files }}
 
 runs:
   using: composite
   steps:
-    - id: ref
+    - id: changed-files-set-up-pipeline
+      name: Set up the pipeline tool
+      uses: ./.github/actions/set-up-pipeline
+      with:
+        github-token: ${{ inputs.github-token || github.token }}
+    - id: changed-files
+      name: Determine the changed files
       shell: bash
-      name: ref
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token || github.token }}
       run: |
-        # Determine our desired checkout ref.
-        #
-        # * If the trigger event is pull_request we will default to a magical merge SHA that Github
-        #   creates. This SHA is the product of what merging our PR into the merge target branch at
-        #   at the point in time when we created the PR. When you push a change to a PR branch
-        #   Github updates this branch if it can. When you rebase a PR it updates this branch.
-        #
-        # * If the trigger event is pull_request and a `checkout-head` tag is present or the
-        #   checkout-head input is set, we'll use HEAD of the PR branch instead of the magical
-        #   merge SHA.
-        #
-        # * If the trigger event is a push (merge) then we'll get the latest commit that was pushed.
-        #
-        # * For anything any other event type we'll default to whatever is default in Github.
+        # Get a list of changed files and write the "changed-files" output to $GITHUB_OUTPUT
         if [ '${{ github.event_name }}' = 'pull_request' ]; then
-          checkout_ref='${{ github.event.pull_request.head.sha }}'
-        elif [ '${{ github.event_name }}' = 'push' ]; then
-          # Our checkout ref for any other event type should default to the github ref.
-          checkout_ref='${{ github.event.after && github.event.after || github.event.push.after }}'
+          pipeline github list changed-files \
+            --owner hashicorp \
+            --repo '${{ github.event.pull_request.head.repo.name }}' \
+            --pr '${{ github.event.pull_request.number }}' \
+            --github-output
         else
-          checkout_ref='${{ github.ref }}'
+          pipeline github list changed-files \
+            --owner hashicorp \
+            --repo '${{ github.event.repository.name }}' \
+            --commit '${{ github.event.after && github.event.after || github.event.push.after && github.event.push.after || github.sha }}' \
+            --github-output
         fi
-        echo "ref=${checkout_ref}" | tee -a "$GITHUB_OUTPUT"
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      with:
-        repository: ${{ github.repository }}
-        path: "changed-files"
-        # The fetch-depth could probably be optimized at some point. It's currently set to zero to
-        # ensure that we have a successfull diff, regardless of how many commits might be present
-        # present between the two references we're comparing. It would be nice to change this
-        # depending on the number of commits by using the push.commits and/or pull_request.commits
-        # payload fields, however, they have different behavior and limitations. For now we'll do
-        # the slow but sure thing of getting the whole repository.
-        fetch-depth: 0
-        ref: ${{ steps.ref.outputs.ref }}
-    - id: changed-files
-      name: changed-files
-      # This script writes output values to $GITHUB_OUTPUT and STDOUT
-      shell: bash
-      run: ./.github/scripts/changed-files.sh ${{ github.event_name }} ${{ github.ref_name }} ${{ github.base_ref }}
-      working-directory: changed-files
diff --git a/.github/actions/checkout/action.yml b/.github/actions/checkout/action.yml
index 35cc1fd4cee..791f2d2fb3b 100644
--- a/.github/actions/checkout/action.yml
+++ b/.github/actions/checkout/action.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 ---
@@ -70,7 +70,7 @@ runs:
           echo "ref=${checkout_ref}"
           echo "depth=${fetch_depth}"
         } | tee -a "$GITHUB_OUTPUT"
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         path: ${{ inputs.path }}
         fetch-depth: ${{ steps.ref.outputs.depth }}
diff --git a/.github/actions/containerize/action.yml b/.github/actions/containerize/action.yml
index 91c67c9dfbc..a61dcdb8c27 100644
--- a/.github/actions/containerize/action.yml
+++ b/.github/actions/containerize/action.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 ---
@@ -10,31 +10,24 @@ description: |
 
 inputs:
   docker:
-    type: boolean
     description: |
       Package the binary into a Docker container suitable for the Docker and AWS registries. We'll
       automatically determine the correct tags and target depending on the vault edition.
-    default: true
+    default: 'true'
   goarch:
-    type: string
     description: The Go GOARCH value environment variable to set during the build.
   goos:
-    type: string
     description: The Go GOOS value environment variable to set during the build.
   redhat:
-    type: boolean
     description: Package the binary into a UBI container suitable for the Redhat Quay registry.
-    default: false
+    default: 'false'
   vault-binary-path:
-    type: string
     description: The path to the vault binary.
     default: dist/vault
   vault-edition:
-    type: string
     description: The edition of vault to build.
     default: ce
   vault-version:
-    type: string
     description: The vault version.
 
 outputs:
@@ -45,40 +38,78 @@ outputs:
 runs:
   using: composite
   steps:
+    - if: inputs.vault-edition != 'ce' && (inputs.docker == 'true' || inputs.redhat == 'true')
+      uses: hashicorp-forge/actions-pao-tool/select-license@6997f7457c338e008506005cc370e7b02f7fb421 # v1.0.3
+      id: build-vault-select-license
+      with:
+        arch: ${{ matrix.goarch }}
     - id: vars
       shell: bash
       run: |
-        if [[ '${{ inputs.vault-edition }}' =~ 'ce' ]]; then
-          # CE containers
-          container_version='${{ inputs.vault-version }}'
-          docker_container_tags='docker.io/hashicorp/vault:${{ inputs.vault-version }} public.ecr.aws/hashicorp/vault:${{ inputs.vault-version }}'
-          docker_container_target='default'
-          redhat_container_tags='quay.io/redhat-isv-containers/5f89bb5e0b94cf64cfeb500a:${{ inputs.vault-version }}-ubi'
-          redhat_container_target='ubi'
-        else
-          # Ent containers
-          container_version='${{ inputs.vault-version }}+${{ inputs.vault-edition }}'
-
-          if [[ '${{ inputs.vault-edition }}' =~ 'fips' ]]; then
-            # Ent FIPS 140-2 containers
-            docker_container_tags='docker.io/hashicorp/vault-enterprise-fips:${{ inputs.vault-version }}-${{ inputs.vault-edition }} public.ecr.aws/hashicorp/vault-enterprise-fips:${{ inputs.vault-version }}-${{ inputs.vault-edition }}'
-            docker_container_target='ubi-fips'
-            redhat_container_tags='quay.io/redhat-isv-containers/6283f645d02c6b16d9caeb8e:${{ inputs.vault-version }}-${{ inputs.vault-edition }}-ubi'
-            redhat_container_target='ubi-fips'
-          else
-            # All other Ent containers
+        case '${{ inputs.vault-edition }}' in
+          "ce")
+            container_version='${{ inputs.vault-version }}'
+            docker_container_tags='docker.io/hashicorp/vault:${{ inputs.vault-version }} public.ecr.aws/hashicorp/vault:${{ inputs.vault-version }}'
+            docker_container_target='default'
+            redhat_container_tags='quay.io/redhat-isv-containers/5f89bb5e0b94cf64cfeb500a:${{ inputs.vault-version }}-ubi'
+            redhat_container_target='ubi'
+            license_source='LICENSE'
+            license_dest='/usr/share/doc/vault/LICENSE.txt'
+          ;;
+          "ent")
+            container_version='${{ inputs.vault-version }}+${{ inputs.vault-edition }}'
             docker_container_tags='docker.io/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition}} public.ecr.aws/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition }}'
             docker_container_target='default'
             redhat_container_tags='quay.io/redhat-isv-containers/5f89bb9242e382c85087dce2:${{ inputs.vault-version }}-${{ inputs.vault-edition }}-ubi'
             redhat_container_target='ubi'
-          fi
-        fi
+            license_source='${{ steps.build-vault-select-license.outputs.license-path }}/Softcopy'
+            license_dest='/usr/share/doc/vault/Softcopy/'
+          ;;
+          "ent.hsm")
+            container_version='${{ inputs.vault-version }}+${{ inputs.vault-edition }}'
+            docker_container_tags='docker.io/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition}} public.ecr.aws/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition }}'
+            docker_container_target='ubi-hsm'
+            redhat_container_tags='quay.io/redhat-isv-containers/5f89bb9242e382c85087dce2:${{ inputs.vault-version }}-${{ inputs.vault-edition }}-ubi'
+            redhat_container_target='ubi-hsm'
+            license_source='${{ steps.build-vault-select-license.outputs.license-path }}/Softcopy'
+            license_dest='/usr/share/doc/vault/Softcopy/'
+          ;;
+          "ent.hsm.fips1403")
+            container_version='${{ inputs.vault-version }}+${{ inputs.vault-edition }}'
+            docker_container_tags='docker.io/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition}} public.ecr.aws/hashicorp/vault-enterprise:${{ inputs.vault-version }}-${{ inputs.vault-edition }}'
+            docker_container_target='ubi-hsm-fips'
+            redhat_container_tags='quay.io/redhat-isv-containers/5f89bb9242e382c85087dce2:${{ inputs.vault-version }}-${{ inputs.vault-edition }}-ubi'
+            redhat_container_target='ubi-hsm-fips'
+            license_source='${{ steps.build-vault-select-license.outputs.license-path }}/Softcopy'
+            license_dest='/usr/share/doc/vault/Softcopy/'
+          ;;
+          "ent.fips1403")
+            # NOTE: For compatibility we still publish the ent.fips1403 containers to different
+            # namespaces. All ent, ent.hsm, and ent.hsm.fips1403 containers are released in the
+            # enterprise namespaces. After we've updated the upstream docker action to support
+            # multiple tags we can start to tag images with both namespaces, publish to both, and
+            # eventually sunset the fips1403 specific namespaces.
+            container_version='${{ inputs.vault-version }}+${{ inputs.vault-edition }}'
+            docker_container_tags='docker.io/hashicorp/vault-enterprise-fips:${{ inputs.vault-version }}-${{ inputs.vault-edition }} public.ecr.aws/hashicorp/vault-enterprise-fips:${{ inputs.vault-version }}-${{ inputs.vault-edition }}'
+            docker_container_target='ubi-fips'
+            redhat_container_tags='quay.io/redhat-isv-containers/6283f645d02c6b16d9caeb8e:${{ inputs.vault-version }}-${{ inputs.vault-edition }}-ubi'
+            redhat_container_target='ubi-fips'
+            license_source='${{ steps.build-vault-select-license.outputs.license-path }}/Softcopy'
+            license_dest='/usr/share/doc/vault/Softcopy/'
+          ;;
+          *)
+            echo "Cannot generate container tags for unknown vault edition: ${{ inputs.vault-edition }}" 2>&1
+            exit 1
+          ;;
+        esac
         {
           echo "container-version=${container_version}"
           echo "docker-container-tags=${docker_container_tags}"
           echo "docker-container-target=${docker_container_target}"
           echo "redhat-container-tags=${redhat_container_tags}"
           echo "redhat-container-target=${redhat_container_target}"
+          echo "license_source=${license_source}"
+          echo "license_dest=${license_dest}"
           echo "revision=$(make ci-get-revision)"
         } | tee -a "$GITHUB_OUTPUT"
     - if: inputs.docker == 'true' || inputs.redhat == 'true'
@@ -90,20 +121,28 @@ runs:
         [[ ! -d "$dest_dir" ]] && mkdir -p "$dest_dir"
         [[ ! -f "$dest_path" ]] && cp ${{ inputs.vault-binary-path }} "${dest_path}"
     - if: inputs.docker == 'true'
-      uses: hashicorp/actions-docker-build@v1
+      uses: hashicorp/actions-docker-build@ryan/VAULT-34830-allow-repo-configuration
       with:
         arch: ${{ inputs.goarch }}
         do_zip_extract_step: 'false' # Don't download and extract an already present binary
-        target: ${{ steps.vars.outputs.docker-container-target }}
-        tags: ${{ steps.vars.outputs.docker-container-tags }}
+        extra_build_args: |
+          LICENSE_SOURCE=${{ steps.vars.outputs.license_source }}
+          LICENSE_DEST=${{ steps.vars.outputs.license_dest }}
+        repo_name: ${{ inputs.vault-edition == 'ce' && 'vault' || 'vault-enterprise' }}
         revision: ${{ steps.vars.outputs.revision }}
+        tags: ${{ steps.vars.outputs.docker-container-tags }}
+        target: ${{ steps.vars.outputs.docker-container-target }}
         version: ${{ steps.vars.outputs.container-version }}
     - if: inputs.redhat == 'true'
-      uses: hashicorp/actions-docker-build@v1
+      uses: hashicorp/actions-docker-build@ryan/VAULT-34830-allow-repo-configuration
       with:
         arch: ${{ inputs.goarch }}
         do_zip_extract_step: 'false' # Don't download and extract an already present binary
+        extra_build_args: |
+          LICENSE_SOURCE=${{ steps.vars.outputs.license_source }}
+          LICENSE_DEST=${{ steps.vars.outputs.license_dest }}
         redhat_tag: ${{ steps.vars.outputs.redhat-container-tags }}
-        target: ${{ steps.vars.outputs.redhat-container-target }}
+        repo_name: ${{ inputs.vault-edition == 'ce' && 'vault' || 'vault-enterprise' }}
         revision: ${{ steps.vars.outputs.revision }}
+        target: ${{ steps.vars.outputs.redhat-container-target }}
         version: ${{ steps.vars.outputs.container-version }}
diff --git a/.github/actions/create-dynamic-config/action.yml b/.github/actions/create-dynamic-config/action.yml
new file mode 100644
index 00000000000..aff1cb2501b
--- /dev/null
+++ b/.github/actions/create-dynamic-config/action.yml
@@ -0,0 +1,59 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+name: Create dynamic pipeline configuration
+description: Create dynamic test configuration by restoring existing valid config or creating new config
+
+inputs:
+  github-token:
+    description: An elevated Github token to access private HashiCorp modules.
+  vault-edition:
+    description: The vault edition to use when generating the dynamic config
+  vault-version:
+    description: The vault version to use when generating the dynamic config
+
+runs:
+  using: composite
+  steps:
+    - name: dyn-cfg-metadata
+      id: dyn-cfg-metadata
+      shell: bash
+      run: |
+        # Since the dynamic config is created by a specific version of the
+        # pipeline tool, we always need to factor it into our cache key.
+        # If the pipeline changes we always want to make sure we are using
+        # dynamic config from the latest version.
+        #
+        # We use a weekly date in the cache key so that we regenerate the
+        # configuration on at least a weekly basis
+        #
+        # If/when Github decides to purge our tiny config file cache we'll also
+        # recreate it as necessary.
+        #
+        # Uses GITHUB_ENV instead of GITHUB_OUTPUT because composite actions are broken,
+        # see: https://github.com/actions/cache/issues/803#issuecomment-1793565071
+        {
+          echo "DYNAMIC_CONFIG_KEY=${{ inputs.vault-version }}-$(date +%Y-%m-%U)-$(git ls-tree HEAD tools/pipeline --object-only --abbrev=8)"
+          echo "DYNAMIC_CONFIG_PATH=enos/enos-dynamic-config.hcl"
+        } | tee -a "$GITHUB_ENV"
+    - name: Try to restore dynamic config from cache
+      id: dyn-cfg-cache
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ env.DYNAMIC_CONFIG_PATH }}
+        key: dyn-cfg-${{ env.DYNAMIC_CONFIG_KEY }}
+    - if: steps.dyn-cfg-cache.outputs.cache-hit != 'true'
+      id: dyn-cfg-set-up-pipeline
+      # If we can't restore it from config then set up pipeline and generate it
+      name: Set up the pipeline tool
+      uses: ./.github/actions/set-up-pipeline
+      with:
+        github-token: ${{ inputs.github-token }}
+    - if: steps.dyn-cfg-cache.outputs.cache-hit != 'true'
+      id: dyn-cfg-generate
+      name: Create dynamic configuration
+      shell: bash
+      run: |
+        # Make sure that any branch specific dynamic config has been generated
+        pipeline generate enos-dynamic-config -d ./enos --file enos-dynamic-config.hcl -v ${{ inputs.vault-version }} -e ${{ inputs.vault-edition }} -n 3 --log debug
diff --git a/.github/actions/install-external-tools/action.yml b/.github/actions/install-external-tools/action.yml
deleted file mode 100644
index e41fddad278..00000000000
--- a/.github/actions/install-external-tools/action.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
----
-name: Install external tools for CI
-description: Install external tools CI
-
-# When possible, prefer installing pre-built external tools for speed. This allows us to avoid
-# downloading modules and compiling external tools on CI runners.
-
-runs:
-  using: composite
-  steps:
-    - uses: ./.github/actions/set-up-buf
-      with:
-        version: v1.25.0 # This should match the version in tools/tool.sh
-    - uses: ./.github/actions/set-up-gofumpt
-    - uses: ./.github/actions/set-up-gosimports
-    - uses: ./.github/actions/set-up-gotestsum
-    - uses: ./.github/actions/set-up-misspell
-    - uses: ./.github/actions/set-up-staticcheck
-      # We assume that the Go toolchain will be managed by the caller workflow so we don't set one
-      # up here.
-    - run: go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
-      shell: bash
-    - run: go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
-      shell: bash
-    - run: go install github.com/favadi/protoc-go-inject-tag@latest
-      shell: bash
-    - run: go install golang.org/x/tools/cmd/goimports@latest
-      shell: bash
-    - run: go install github.com/golangci/revgrep/cmd/revgrep@latest
-      shell: bash
diff --git a/.github/actions/install-tools/action.yml b/.github/actions/install-tools/action.yml
new file mode 100644
index 00000000000..5aa4b970547
--- /dev/null
+++ b/.github/actions/install-tools/action.yml
@@ -0,0 +1,89 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+name: Install all of the developer tools
+description: |
+  Install all of the developer tools that are defined in tools/tools.sh. When
+  possible we'll restore the tools from prior build that was cached. On a cache
+  miss we'll rebuild the tools. After the tools are restored the `cache-path`
+  will be added to the GITHUB_PATH.
+
+inputs:
+  no-restore:
+    description: Whether or not to restore the Go module cache on a cache hit
+    default: "false"
+  no-save:
+    description: Whether or not to create a Go module cache on cache miss
+    default: "false"
+  destination:
+    description: "Where to install the tools (default: $HOME/bin/vault-tools)"
+    default: "$HOME/bin/vault-tools"
+
+runs:
+  using: composite
+  steps:
+    - id: metadata
+      shell: bash
+      run: |
+        # Create the tool cache directory if it doesn't exist and add it to the
+        # GITHUB_PATH to make them available to other actions.
+        mkdir -p "${{ inputs.destination }}"
+        destination="$(readlink -f "${{ inputs.destination }}")"
+        echo "${destination}" >> "$GITHUB_PATH"
+
+        # actions/cache restore has some surprising relative pathing behavior we
+        # need to deal with. When it restores something it does it relative to
+        # the check working directory. Since that can be different depending on
+        # our self-hosted vs Github hosted runners, i.e.
+        #   /home/runner/actions-runner/_work vs. /home/runner/work
+        # we need to factor in the absolute path of our working directory in our
+        # cache key. If we don't then caches created on one runner type will be
+        # incompatible on the other.
+        #
+        # See: https://github.com/actions/cache/issues/1127
+        wd_hash=$(realpath . | sha256sum | head -c 7)
+
+        # Caches automatically prevent cross distro but not cross arch. We'll
+        # include the os and arch in the key to make it easy to grok which cache
+        # is for which platform.
+        os="$(echo "$RUNNER_OS" | tr '[:upper:]' '[:lower:]')"
+        arch="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
+        if [ "${arch}" = "x64" ]; then
+          arch="amd64"
+        fi
+
+        # Hash the tools directory so that we update our cache automatically
+        # if a dep caches.
+        tools_hash=$(git ls-tree HEAD tools --object-only | head -c 7)
+
+        # Build the unique cache key
+        cache_key="tools-${os}-${arch}-${wd_hash}-${tools_hash}"
+
+        # Use GITHUB_ENV instead of GITHUB_OUTPUT because composite actions are
+        # broken if you embed them into another composite actions.
+        #
+        # See: https://github.com/actions/cache/issues/803#issuecomment-1793565071
+        {
+          echo "VAULT_TOOLS_PATH=${destination}"
+          echo "VAULT_TOOLS_CACHE_KEY=${cache_key}"
+        } | tee -a "$GITHUB_ENV"
+    - id: cache-tools
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        lookup-only: ${{ inputs.no-restore }}
+        path: ${{ env.VAULT_TOOLS_PATH }}
+        key: ${{ env.VAULT_TOOLS_CACHE_KEY }}
+    - if: steps.cache-tools.outputs.cache-hit != 'true' && inputs.no-save != 'true'
+      name: Install tools
+      shell: bash
+      env:
+        GOPRIVATE: github.com/hashicorp/*
+        # `go install` to our vault tool cache
+        GOBIN: ${{ env.VAULT_TOOLS_PATH }}
+        # Don't use the global mod cache because we don't want to pollute it
+        # with tool modules.
+        GOMODCACHE: /home/runner/.cache/vault-tool-mod-cache
+      run: |
+        make tools
+        du -h -d 1 ${{ env.VAULT_TOOLS_PATH }}
diff --git a/.github/actions/metadata/action.yml b/.github/actions/metadata/action.yml
index 53eff3d62c9..62e7ee2e318 100644
--- a/.github/actions/metadata/action.yml
+++ b/.github/actions/metadata/action.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 ---
@@ -11,6 +11,8 @@ description: |
   to maintain compatibility in both execution contexts.
 
 inputs:
+  github-token:
+    description: An elevated Github token to use for searching labels
   vault-version:
     description: |
       The version of vault from hashicorp/action-set-product-version. If set we'll utilize this
@@ -22,9 +24,6 @@ outputs:
   compute-build:
     description: A JSON encoded "runs-on" for App build worfkflows.
     value: ${{ steps.workflow-metadata.outputs.compute-build }}
-  compute-build-compat:
-    description: A JSON encoded "runs-on" for App build workflows that need an older glibc to link against.
-    value: ${{ steps.workflow-metadata.outputs.compute-build-compat }}
   compute-build-ui:
     description: A JSON encoded "runs-on" for web UI build workflows.
     value: ${{ steps.workflow-metadata.outputs.compute-build-ui }}
@@ -40,12 +39,18 @@ outputs:
   go-tags:
     description: The minimal set of Go tags required to build the correct edition of Vault.
     value: ${{ steps.workflow-metadata.outputs.go-tags }}
+  is-ce-in-enterprise:
+    description: Whether or not the workflow is running CE Vault in the context of Vault Enterprise.
+    value: ${{ steps.workflow-metadata.outputs.is-ce-in-enterprise }}
   is-draft:
     description: Whether or not the workflow is executing in the context of a pull request draft.
     value: ${{ steps.workflow-metadata.outputs.is-draft }}
-  is-enterprise:
-    description: Whether or not the workflow is executing in the context of Vault enterprise.
-    value: ${{ steps.workflow-metadata.outputs.is-enterprise }}
+  is-ent-branch:
+    description: Whether or not the workflow is executing in the context of Vault Enterprise.
+    value: ${{ steps.workflow-metadata.outputs.is-ent-branch }}
+  is-ent-repo:
+    description: Whether or not the workflow is executing in the context of hashicorp/vault-enterprise
+    value: ${{ steps.workflow-metadata.outputs.is-ent-repo }}
   is-fork:
     description: Whether or not the workflow is being triggered on a pull request that is a fork.
     value: ${{ steps.workflow-metadata.outputs.is-fork }}
@@ -97,25 +102,44 @@ runs:
       name: workflow-metadata
       shell: bash
       env:
-        GH_TOKEN: ${{ github.token }}
+        GH_TOKEN: ${{ inputs.github-token || github.token }}
       run: |
         if [ '${{ github.event_name }}' = 'pull_request' ]; then
           is_draft='${{ github.event.pull_request.draft }}'
 
-          # Determine our labels. If our event type is pull_request this is rather straight forward. If
-          # our even_type is push (merge) we'll need to look up the pull request associated with the
-          # commit and get the labels. This will return the label names as an array.
-          labels=$(jq -rc <<< '${{ toJSON(github.event.pull_request.labels.*.name) }}')
+          # Determine our pull request labels. We specifically look them up via the pulls API
+          # because the github.event.pull_request.labels.*.name context is very inflexible.
+          # This allows people to add labels after inital pull request and/or to re-run this
+          # workflow to reload them.
+          labels=$(gh api "/repos/${{ github.repository }}/issues/${{ github.event.number }}/labels" | jq -erc '. | map(.name)')
         else
+          # We can assume we're being triggered for a 'push' (a merge)
           is_draft='false'
 
-          # Look up the labels for the pull request that is associated with the last commit. If
-          # there are none set it as a JSON encoded empty array.
-          if pr_number=$(gh api "/repos/${{ github.repository }}/commits/${{ github.ref }}/pulls" | jq -erc '.[0].number'); then
-            if ! labels=$(gh api "/repos/${{ github.repository }}/issues/${pr_number}/labels" | jq -erc '. | map(.name)'); then
-              labels='[]'
-            fi
-          else
+          # Look up the pull request labels for the PR that is associated with
+          # the commit. If there are none set it as a JSON encoded empty array.
+          repo=$(printf ${{ github.repository }} | cut -d "/" -f2)
+          if ! labels=$(gh api graphql -F repo="$repo" -F sha="${{ steps.vault-metadata.outputs.vault-revision }}" -f query='
+            query($repo: String!, $sha: String!){
+              repository(name: $repo, owner: "hashicorp") {
+                commit: object(expression: $sha) {
+                  ... on Commit {
+                    associatedPullRequests(first:1){
+                      edges{
+                        node{
+                          labels(first: 10) {
+                            nodes {
+                              name
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }' | jq -erc '.data.repository.commit.associatedPullRequests.edges[0].node.labels.nodes | map(.name)');
+          then
             labels='[]'
           fi
         fi
@@ -127,30 +151,47 @@ runs:
           echo "workflow-trigger=${{ github.event_name }}"
         } | tee -a "$GITHUB_OUTPUT"
 
-        # Set CE and Ent specific workflow metadata
-        is_enterprise='${{ contains(github.repository, 'vault-enterprise') }}'
-        if [ "$is_enterprise" = 'true' ]; then
-          {
-            echo 'compute-build=["self-hosted","ondemand","os=linux","disk_gb=64","type=c6a.4xlarge"]'
-            echo 'compute-build-compat=["self-hosted","ubuntu-20.04"]' # for older glibc compatibility, m6a.4xlarge
-            echo 'compute-build-ui=["self-hosted","ondemand","os=linux", "disk_gb=64", "type=c6a.2xlarge"]'
-            echo 'compute-test-go=["self-hosted","ondemand","os=linux","disk_gb=64","type=c6a.2xlarge"]'
-            echo 'compute-test-ui=["self-hosted","ondemand","os=linux","type=m6a.2xlarge"]'
-            echo 'compute-small=["self-hosted","linux","small"]'
-            echo 'go-tags=ent,enterprise'
-            echo 'is-enterprise=true'
-            echo 'vault-version-metadata=${{ inputs.vault-version }}+ent'
-          } | tee -a "$GITHUB_OUTPUT"
+        # Set CE, Ent, and CE in Ent specific workflow metadata
+        is_enterprise_repo='${{ contains(github.repository, 'vault-enterprise') }}'
+        if [ "$is_enterprise_repo" = 'true' ]; then
+          base_ref='${{ github.event.pull_request.base.ref || github.event.base_ref || github.ref_name || github.event.branch || github.ref }}'
+          is_ent_repo='true'
+          is_ce_in_enterprise=$([[ $base_ref == ce/* ]] && echo "true" || echo "false")
+          if [ "$is_ce_in_enterprise" = 'true' ]; then
+            is_enterprise="false"
+            go_tags=''
+            version_metadata='${{ inputs.vault-version }}'
+          else
+            is_enterprise='true'
+            go_tags='ent,enterprise'
+            version_metadata='${{ inputs.vault-version }}+ent'
+          fi
+          compute_build='["self-hosted","ondemand","os=linux","disk_gb=64","type=c6a.4xlarge"]'
+          compute_build_ui='["self-hosted","ondemand","os=linux", "disk_gb=64", "type=c6a.2xlarge"]'
+          compute_test_go='["self-hosted","ondemand","os=linux","disk_gb=64","type=c6a.2xlarge"]'
+          compute_test_ui='["self-hosted","ondemand","os=linux","type=m6a.2xlarge"]'
+          compute_small='["self-hosted","linux","small"]'
         else
-          {
-            echo 'compute-build="custom-linux-medium-vault-latest"'
-            echo 'compute-build-compat="custom-linux-medium-vault-latest"'
-            echo 'compute-build-ui="custom-linux-xl-vault-latest"'
-            echo 'compute-test-go="custom-linux-medium-vault-latest"'
-            echo 'compute-test-ui="custom-linux-medium-vault-latest"'
-            echo 'compute-small="ubuntu-latest"'
-            echo 'go-tags='
-            echo 'is-enterprise=false'
-            echo 'vault-version-metadata=${{ inputs.vault-version }}'
-          } | tee -a "$GITHUB_OUTPUT"
+          compute_build='"custom-linux-medium-vault-latest"'
+          compute_build_ui='"custom-linux-xl-vault-latest"'
+          compute_test_go='"custom-linux-medium-vault-latest"'
+          compute_test_ui='"custom-linux-medium-vault-latest"'
+          compute_small='"ubuntu-latest"'
+          go_tags=''
+          is_ce_in_enterprise='false'
+          is_ent_branch='false'
+          is_ent_repo='false'
+          version_metadata='${{ inputs.vault-version }}'
         fi
+        {
+          echo "compute-build=${compute_build}"
+          echo "compute-build-ui=${compute_test_ui}"
+          echo "compute-test-go=${compute_test_go}"
+          echo "compute-test-ui=${compute_test_ui}"
+          echo "compute-small=${compute_small}"
+          echo "go-tags=${go_tags}"
+          echo "is-ce-in-enterprise=${is_ce_in_enterprise}"
+          echo "is-ent-branch=${is_enterprise}"
+          echo "is-ent-repo=${is_ent_repo}"
+          echo "vault-version-metadata=${version_metadata}"
+        } | tee -a "$GITHUB_OUTPUT"
diff --git a/.github/actions/run-apupgrade-tests/action.yml b/.github/actions/run-apupgrade-tests/action.yml
new file mode 100644
index 00000000000..2818739a66c
--- /dev/null
+++ b/.github/actions/run-apupgrade-tests/action.yml
@@ -0,0 +1,120 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+name: Run Autopilot upgrade tests
+description: |
+  This action runs the Autopilot upgrade tests on Vault Enterprise.
+  It downloads the needed Vault Enterprise source version binaries from the releases page, checks out the specified ref
+  from the Vault Enterprise repository, builds the target version binary of Vault for Autopilot upgrade testing,
+  and runs the Autopilot upgrade tool with the specified source versions.
+inputs:
+  checkout-ref:
+    required: true
+    description: |
+      The branch, tag, or SHA to checkout from the Vault Enterprise repository, e.g. 'refs/heads/main'.
+      The target version binary of Vault for Autopilot upgrade testing will be built from this checkout.
+  github-token:
+    required: true
+    description: |
+      The GitHub token to use for checking out the needed repositories.
+  source-versions:
+    required: true
+    description: |
+      The source versions of Vault for Autopilot upgrade testing as a comma-separated string,
+      e.g. '1.16.9+ent,1.17.7+ent,1.18.0+ent'.
+
+runs:
+  using: composite
+  steps:
+    - name: Authenticate to Vault
+      id: vault-auth
+      shell: bash
+      run: vault-auth
+    - name: Fetch Secrets
+      id: secrets
+      uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
+      with:
+        url: ${{ steps.vault-auth.outputs.addr }}
+        caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+        token: ${{ steps.vault-auth.outputs.token }}
+        secrets: |
+          kv/data/github/${{ github.repository }}/github-token username-and-token | github-token;
+          kv/data/github/${{ github.repository }}/license license_1 | VAULT_LICENSE_CI;
+          kv/data/github/${{ github.repository }}/license license_2 | VAULT_LICENSE_2;
+    - name: Setup Git configuration (private)
+      id: setup-git-private
+      if: github.repository == 'hashicorp/vault-enterprise'
+      shell: bash
+      run: |
+        git config --global url."https://${{ steps.secrets.outputs.github-token }}@github.com".insteadOf https://github.com
+    - name: Check out the .release/versions.hcl file from Vault Enterprise repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        ref: ${{ inputs.checkout-ref }}
+    - uses: ./.github/actions/set-up-go
+      with:
+        github-token: ${{ inputs.github-token }}
+    - name: Build external tools
+      uses: ./.github/actions/install-tools
+    - name: Checkout VCM repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        repository: hashicorp/vcm
+        ref: 1fcab6591e3bdc81d2921ca77441bfcf913c6a57
+        token: ${{ inputs.github-token }}
+        path: vcm
+    - name: Checkout Vault tools repository to get the Autopilot upgrade tool
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        repository: hashicorp/vault-tools
+        token: ${{ inputs.github-token }}
+        path: vault-tools
+    - name: Install needed Vault versions
+      env:
+        GOPATH: /home/runner/go
+      shell: bash
+      run: |
+        # Split the matched versions into an array
+        IFS=',' read -r -a versions <<< "${{ inputs.source-versions }}"
+
+        for version in "${versions[@]}"; do
+          echo "Installing Vault version $version"
+          "${GITHUB_WORKSPACE}/vault-tools/vvm/vvm" install-ent "${version}"
+        done
+    - name: Build dev binary for binary tests
+      env:
+        GOPATH: /home/runner/go
+        GOPRIVATE: github.com/hashicorp/*
+      shell: bash
+      run: |
+        cd "${GITHUB_WORKSPACE}" || exit 1
+        time make prep dev
+
+        # Save the binary we just build under the current Vault version number to VVM
+        # for apupgrade to use as a target version
+        current_version=$(cat version/VERSION)
+        "${GITHUB_WORKSPACE}/vault-tools/vvm/vvm" save "${current_version}"
+        echo "VAULT_TARGET_VERSION=${current_version}" >> "${GITHUB_ENV}"
+    - name: Build VCM
+      shell: bash
+      run: |
+        cd "${GITHUB_WORKSPACE}/vcm" || exit 1
+        make
+    - name: Build Autopilot upgrade tool
+      shell: bash
+      run: |
+        cd "${GITHUB_WORKSPACE}/vault-tools/apupgrade" || exit 1
+        go build -o apupgrade .
+    - name: Run Autopilot upgrade tool
+      shell: bash
+      run: |
+        # Write the license to a file for VCM to use
+        echo "${{ steps.secrets.outputs.VAULT_LICENSE_CI }}" > "${GITHUB_WORKSPACE}/license.hclic"
+        export VAULT_LICENSE_PATH="${GITHUB_WORKSPACE}/license.hclic"
+
+        # Unset VAULT_ADDR to avoid any conflicts with VCM and apupgrade
+        unset VAULT_ADDR
+
+        echo "Running Autopilot upgrade tool with source versions: ${{ inputs.source-versions }} and target version: ${{ env.VAULT_TARGET_VERSION }}"
+        "${GITHUB_WORKSPACE}/vault-tools/apupgrade/apupgrade" -versions "${{ inputs.source-versions }},${VAULT_TARGET_VERSION}" -use-vvm
diff --git a/.github/actions/set-up-buf/action.yml b/.github/actions/set-up-buf/action.yml
deleted file mode 100644
index a9cd3656a10..00000000000
--- a/.github/actions/set-up-buf/action.yml
+++ /dev/null
@@ -1,66 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
----
-name: Set up buf from Github releases
-description: Set up buf from Github releases
-
-inputs:
-  destination:
-    description: "Where to install the buf binary (default: $HOME/bin/buf)"
-    type: boolean
-    default: "$HOME/bin/buf"
-  version:
-    description: "The version to install (default: latest)"
-    type: string
-    default: Latest
-
-outputs:
-  destination:
-    description: Where the installed buf binary is
-    value: ${{ steps.install.outputs.destination }}
-  destination-dir:
-    description: The directory where the installed buf binary is
-    value: ${{ steps.install.outputs.destination-dir }}
-  version:
-    description: The installed version of buf
-    value: ${{ steps.install.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    - id: install
-      shell: bash
-      env:
-        GH_TOKEN: ${{ github.token }}
-      run: |
-        VERSION=$(gh release list -R bufbuild/buf --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -f1)
-
-        mkdir -p $(dirname ${{ inputs.destination }})
-        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
-        DESTINATION_DIR="$(dirname "$DESTINATION")"
-        echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
-
-        {
-          echo "destination=$DESTINATION"
-          echo "destination-dir=$DESTINATION_DIR"
-          echo "version=$VERSION"
-        } | tee -a "$GITHUB_OUTPUT"
-
-        ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
-        OS="$RUNNER_OS"
-        if [ "$ARCH" = "x64" ]; then
-          export ARCH="x86_64"
-        fi
-        if [ "$ARCH" = "arm64" ] && [ "$OS" = "Linux" ]; then
-          export ARCH="aarch64"
-        fi
-        if [ "$OS" = "macOS" ]; then
-          export OS="Darwin"
-        fi
-
-        mkdir -p tmp
-        gh release download "$VERSION" -p "buf-${OS}-${ARCH}.tar.gz" -O tmp/buf.tgz -R bufbuild/buf
-        pushd tmp && tar -xvf buf.tgz && popd
-        mv tmp/buf/bin/buf "$DESTINATION"
-        rm -rf tmp
diff --git a/.github/actions/set-up-go/action.yml b/.github/actions/set-up-go/action.yml
index 74a46f06f9d..881bf821a17 100644
--- a/.github/actions/set-up-go/action.yml
+++ b/.github/actions/set-up-go/action.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 ---
@@ -8,14 +8,14 @@ description: Set up Go with a shared module cache.
 inputs:
   github-token:
     description: An elevated Github token to access private modules if necessary.
-    type: string
   no-restore:
     description: Whether or not to restore the Go module cache on a cache hit
-    type: boolean
-    default: false
+    default: "false"
+  no-save:
+    description: Whether or not to create a Go module cache on cache miss
+    default: "false"
   go-version:
     description: "Override .go-version"
-    type: string
     default: ""
 
 outputs:
@@ -40,19 +40,30 @@ runs:
         else
           echo "go-version=${{ inputs.go-version }}" | tee -a "$GITHUB_OUTPUT"
         fi
-    - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+    - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
       with:
         go-version: ${{ steps.go-version.outputs.go-version }}
         cache: false # We use our own caching strategy
     - id: metadata
       shell: bash
       run: |
+        # Cache restore have some surprising relative pathing behavior we need
+        # to deal with. When actions/cache restores something it does it
+        # realtive to the check working directory. Since that can be different
+        # depending on our self-hosted vs Github hosted runners
+        #   /home/runner/actions-runner/_work vs. /home/runner/work
+        # we need to factor in the absolute path of our working directory in our
+        # cache key. If we don't then cache restores will be incompatible on one
+        # or the other runner.
+        #
+        # See: https://github.com/actions/cache/issues/1127
+        wd_hash=$(realpath . | sha256sum | head -c 8)
         {
-          echo "cache-path=$(go env GOMODCACHE)"
-          echo "cache-key=go-modules-${{ hashFiles('**/go.sum') }}"
+          echo "cache-path=$(go env GOMODCACHE)/cache"
+          echo "cache-key=go-modules-${wd_hash}-${{ hashFiles('**/go.sum') }}"
         } | tee -a "$GITHUB_OUTPUT"
     - id: cache-modules
-      uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         enableCrossOsArchive: true
         lookup-only: ${{ inputs.no-restore }}
@@ -71,7 +82,7 @@ runs:
         # keeps cache upload time, download time, and storage size to a minimum.
         path: ${{ steps.metadata.outputs.cache-path }}
         key: ${{ steps.metadata.outputs.cache-key }}
-    - if: steps.cache-modules.outputs.cache-hit != 'true'
+    - if: steps.cache-modules.outputs.cache-hit != 'true' && inputs.no-save != 'true'
       name: Download go modules
       shell: bash
       env:
diff --git a/.github/actions/set-up-gofumpt/action.yml b/.github/actions/set-up-gofumpt/action.yml
deleted file mode 100644
index d763656fc49..00000000000
--- a/.github/actions/set-up-gofumpt/action.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
----
-name: Set up gofumpt from Github releases
-description: Set up gofumpt from Github releases
-
-inputs:
-  destination:
-    description: "Where to install the gofumpt binary (default: $HOME/bin/gofumpt)"
-    type: boolean
-    default: "$HOME/bin/gofumpt"
-  version:
-    description: "The version to install (default: latest)"
-    type: string
-    default: Latest
-
-outputs:
-  destination:
-    description: Where the installed gofumpt binary is
-    value: ${{ steps.install.outputs.destination }}
-  destination-dir:
-    description: The directory where the installed gofumpt binary is
-    value: ${{ steps.install.outputs.destination-dir }}
-  version:
-    description: The installed version of gofumpt
-    value: ${{ steps.install.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    - id: install
-      shell: bash
-      env:
-        GH_TOKEN: ${{ github.token }}
-      run: |
-        VERSION=$(gh release list -R mvdan/gofumpt --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -f1)
-
-        mkdir -p $(dirname ${{ inputs.destination }})
-        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
-        DESTINATION_DIR="$(dirname "$DESTINATION")"
-        echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
-
-        {
-          echo "destination=$DESTINATION"
-          echo "destination-dir=$DESTINATION_DIR"
-          echo "version=$VERSION"
-        } | tee -a "$GITHUB_OUTPUT"
-
-        ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
-        OS="$(echo "$RUNNER_OS" | tr '[:upper:]' '[:lower:]')"
-        if [ "$ARCH" = "x64" ]; then
-          export ARCH="amd64"
-        fi
-        if [ "$OS" = "macos" ]; then
-          export OS="darwin"
-        fi
-
-        gh release download "$VERSION" -p "gofumpt_*_${OS}_${ARCH}" -O gofumpt -R mvdan/gofumpt
-        chmod +x gofumpt
-        mv gofumpt "$DESTINATION"
diff --git a/.github/actions/set-up-gosimports/action.yml b/.github/actions/set-up-gosimports/action.yml
deleted file mode 100644
index 97602498b38..00000000000
--- a/.github/actions/set-up-gosimports/action.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
----
-name: Set up gosimports from Github releases
-description: Set up gosimports from Github releases
-
-inputs:
-  destination:
-    description: "Where to install the gosimports binary (default: $HOME/bin/gosimports)"
-    type: boolean
-    default: "$HOME/bin/gosimports"
-  version:
-    description: "The version to install (default: latest)"
-    type: string
-    default: Latest
-
-outputs:
-  destination:
-    description: Where the installed gosimports binary is
-    value: ${{ steps.install.outputs.destination }}
-  destination-dir:
-    description: The directory where the installed gosimports binary is
-    value: ${{ steps.install.outputs.destination-dir }}
-  version:
-    description: The installed version of gosimports
-    value: ${{ steps.install.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    - id: install
-      shell: bash
-      env:
-        GH_TOKEN: ${{ github.token }}
-      run: |
-        VERSION=$(gh release list -R rinchsan/gosimports --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -f1)
-
-        mkdir -p $(dirname ${{ inputs.destination }})
-        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
-        DESTINATION_DIR="$(dirname "$DESTINATION")"
-        echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
-
-        {
-          echo "destination=$DESTINATION"
-          echo "version=$VERSION"
-          echo "destination-dir=$DESTINATION_DIR"
-        } | tee -a "$GITHUB_OUTPUT"
-
-        ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
-        OS="$(echo "$RUNNER_OS" | tr '[:upper:]' '[:lower:]')"
-        if [ "$ARCH" = "x64" ]; then
-          export ARCH="amd64"
-        fi
-        if [ "$OS" = "macos" ]; then
-          export OS="darwin"
-        fi
-
-        mkdir -p tmp
-        gh release download "$VERSION" -p "gosimports_*_${OS}_${ARCH}.tar.gz" -O tmp/gosimports.tgz -R rinchsan/gosimports
-        pushd tmp && tar -xvf gosimports.tgz && popd
-        mv tmp/gosimports "$DESTINATION"
-        rm -rf tmp
diff --git a/.github/actions/set-up-gotestsum/action.yml b/.github/actions/set-up-gotestsum/action.yml
deleted file mode 100644
index 9d0147313ae..00000000000
--- a/.github/actions/set-up-gotestsum/action.yml
+++ /dev/null
@@ -1,60 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
----
-name: Set up gotestsum from Github releases
-description: Set up gotestsum from Github releases
-
-inputs:
-  destination:
-    description: "Where to install the gotestsum binary (default: $HOME/bin/gotestsum)"
-    type: boolean
-    default: "$HOME/bin/gotestsum"
-  version:
-    description: "The version to install (default: latest)"
-    type: string
-    default: Latest
-
-outputs:
-  destination:
-    description: Where the installed gotestsum binary is
-    value: ${{ steps.install.outputs.destination }}
-  destination-dir:
-    description: The directory where the installed gotestsum binary is
-    value: ${{ steps.install.outputs.destination-dir }}
-  version:
-    description: The installed version of gotestsum
-    value: ${{ steps.install.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    - id: install
-      shell: bash
-      env:
-        GH_TOKEN: ${{ github.token }}
-      run: |
-        VERSION=$(gh release list -R gotestyourself/gotestsum --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -f1)
-
-        mkdir -p $(dirname ${{ inputs.destination }})
-        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
-        DESTINATION_DIR="$(dirname "$DESTINATION")"
-        echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
-
-        {
-          echo "destination=$DESTINATION"
-          echo "destination-dir=$DESTINATION_DIR"
-          echo "version=$VERSION"
-        } | tee -a "$GITHUB_OUTPUT"
-
-        OS="$(echo "$RUNNER_OS" | tr '[:upper:]' '[:lower:]')"
-        ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
-        if [ "$ARCH" = "x64" ]; then
-          export ARCH="amd64"
-        fi
-
-        mkdir -p tmp
-        gh release download "$VERSION" -p "*${OS}_${ARCH}.tar.gz" -O tmp/gotestsum.tgz -R gotestyourself/gotestsum
-        pushd tmp && tar -xvf gotestsum.tgz && popd
-        mv tmp/gotestsum "$DESTINATION"
-        rm -rf tmp
diff --git a/.github/actions/set-up-misspell/action.yml b/.github/actions/set-up-misspell/action.yml
deleted file mode 100644
index 8f5d99fa5d0..00000000000
--- a/.github/actions/set-up-misspell/action.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
----
-name: Set up misspell from Github releases
-description: Set up misspell from Github releases
-
-inputs:
-  destination:
-    description: "Where to install the misspell binary (default: $HOME/bin/misspell)"
-    type: boolean
-    default: "$HOME/bin/misspell"
-  version:
-    description: "The version to install (default: latest)"
-    type: string
-    default: Latest
-
-outputs:
-  destination:
-    description: Where the installed misspell binary is
-    value: ${{ steps.install.outputs.destination }}
-  destination-dir:
-    description: The directory where the installed misspell binary is
-    value: ${{ steps.install.outputs.destination-dir }}
-  version:
-    description: The installed version of misspell
-    value: ${{ steps.install.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    - id: install
-      shell: bash
-      env:
-        GH_TOKEN: ${{ github.token }}
-      run: |
-        VERSION=$(gh release list -R golangci/misspell --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -f1)
-
-        mkdir -p $(dirname ${{ inputs.destination }})
-        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
-        DESTINATION_DIR="$(dirname "$DESTINATION")"
-        echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
-
-        {
-          echo "destination=$DESTINATION"
-          echo "version=$VERSION"
-          echo "destination-dir=$DESTINATION_DIR"
-        } | tee -a "$GITHUB_OUTPUT"
-
-        ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
-        OS="$(echo "$RUNNER_OS" | tr '[:upper:]' '[:lower:]')"
-        if [ "$ARCH" = "x64" ]; then
-          export ARCH="64bit"
-        fi
-        if [ "$OS" = "macos" ]; then
-          export OS="mac"
-        fi
-
-        mkdir -p tmp
-        gh release download "$VERSION" -p "misspell_*_${OS}_${ARCH}.tar.gz" -O tmp/misspell.tgz -R golangci/misspell
-        pushd tmp && tar -xvf misspell.tgz && popd
-        mv tmp/misspell "$DESTINATION"
-        rm -rf tmp
diff --git a/.github/actions/set-up-pipeline/action.yml b/.github/actions/set-up-pipeline/action.yml
new file mode 100644
index 00000000000..1d1a3d95c4b
--- /dev/null
+++ b/.github/actions/set-up-pipeline/action.yml
@@ -0,0 +1,48 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+name: Install the pipeline tool
+description: Install the pipeline tool
+
+inputs:
+  github-token:
+    description: An elevated Github token to access private HashiCorp modules.
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/set-up-go
+      with:
+        github-token: ${{ inputs.github-token || github.token }}
+        no-restore: true # Don't download vault's modules for pipeline
+        no-save: true # Don't attempt to save modules either
+    - name: pipeline-metadata
+      id: pipeline-metadata
+      shell: bash
+      # Uses GITHUB_ENV instead of GITHUB_OUTPUT because composite actions are broken,
+      # see: https://github.com/actions/cache/issues/803#issuecomment-1793565071
+      run: |
+        gobin=$(go env GOBIN)
+        if [[ -z "$gobin" ]]; then
+          gobin="$(go env GOPATH)/bin"
+        fi
+        {
+          echo "PIPELINE_HASH=$(git ls-tree HEAD tools/pipeline --object-only)"
+          echo "PIPELINE_PATH=$gobin/pipeline"
+        } | tee -a "$GITHUB_ENV"
+    - name: Try to restore pipeline from cache
+      id: pipeline-cache
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ env.PIPELINE_PATH }}
+        key: pipeline-${{ env.PIPELINE_HASH }}
+    - if: steps.pipeline-cache.outputs.cache-hit != 'true'
+      id: pipeline-build
+      name: Build pipeline
+      shell: bash
+      env:
+        GOPRIVATE: github.com/hashicorp/*
+      run: |
+        git config --global url."https://${{ inputs.github-token }}@github.com".insteadOf https://github.com
+        make tools-pipeline
diff --git a/.github/actions/set-up-staticcheck/action.yml b/.github/actions/set-up-staticcheck/action.yml
deleted file mode 100644
index cce079618fe..00000000000
--- a/.github/actions/set-up-staticcheck/action.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
----
-name: Set up staticcheck from Github releases
-description: Set up staticcheck from Github releases
-
-inputs:
-  destination:
-    description: "Where to install the staticcheck binary (default: $HOME/bin/staticcheck)"
-    type: boolean
-    default: "$HOME/bin/staticcheck"
-  version:
-    description: "The version to install (default: latest)"
-    type: string
-    default: Latest
-
-outputs:
-  destination:
-    description: Where the installed staticcheck binary is
-    value: ${{ steps.install.outputs.destination }}
-  destination-dir:
-    description: The directory where the installed staticcheck binary is
-    value: ${{ steps.install.outputs.destination-dir }}
-  version:
-    description: The installed version of staticcheck
-    value: ${{ steps.install.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    - id: install
-      shell: bash
-      env:
-        GH_TOKEN: ${{ github.token }}
-      run: |
-        VERSION=$(gh release list -R dominikh/go-tools --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -d " " -f2)
-
-        mkdir -p $(dirname ${{ inputs.destination }})
-        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
-        DESTINATION_DIR="$(dirname "$DESTINATION")"
-        echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
-
-        {
-          echo "destination=$DESTINATION"
-          echo "destination-dir=$DESTINATION_DIR"
-          echo "version=$VERSION"
-        } | tee -a "$GITHUB_OUTPUT"
-
-        ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
-        OS="$(echo "$RUNNER_OS" | tr '[:upper:]' '[:lower:]')"
-        if [ "$ARCH" = "x64" ]; then
-          export ARCH="amd64"
-        fi
-        if [ "$OS" = "macos" ]; then
-          export OS="darwin"
-        fi
-
-        mkdir -p tmp
-        gh release download "$VERSION" -p "staticcheck_${OS}_${ARCH}.tar.gz" -O tmp/staticcheck.tgz -R dominikh/go-tools
-        pushd tmp && tar -xvf staticcheck.tgz && popd
-        mv tmp/staticcheck/staticcheck "$DESTINATION"
-        rm -rf tmp
diff --git a/.github/docs/pull_request_template.md b/.github/docs/pull_request_template.md
new file mode 100644
index 00000000000..6b9d11b9a10
--- /dev/null
+++ b/.github/docs/pull_request_template.md
@@ -0,0 +1,8 @@
+### Description
+Why is this docs change needed?
+
+### TODO
+- [ ] Preview the changes you made either locally or in the Vercel deployment
+  and make sure it looks correct.
+- [ ] If you've added a new link to the sidebar navigation, make sure it's
+  sorted correctly.
diff --git a/.github/instructions/generic/ember_general.instructions.md b/.github/instructions/generic/ember_general.instructions.md
new file mode 100644
index 00000000000..d7b209f6385
--- /dev/null
+++ b/.github/instructions/generic/ember_general.instructions.md
@@ -0,0 +1,88 @@
+---
+applyTo: "vault/ui/**/*"
+description: "HashiCorp Ember.js UI general guidelines - project context, build structure, and cross-cutting concerns"
+---
+
+# HashiCorp Ember.js UI General Guidelines
+
+This document provides general coding standards and project context for HashiCorp Ember.js UI applications. This serves as the central reference for project structure, framework information, and cross-cutting concerns.
+
+> **Related Documents**: See domain-specific guidelines in `ember_javascript.instructions.md`, `ember_hbs.instructions.md`, `ember_styles.instructions.md`, and `ember_tests.instructions.md`.
+
+## Project Context
+HashiCorp Ember.js UI applications provide web-based interfaces for HashiCorp's infrastructure tools and cloud platforms. These applications serve enterprise-grade interfaces used by DevOps teams, platform engineers, security professionals, and system administrators to manage infrastructure, security policies, and operational workflows.
+
+Applications use modern Ember Octane patterns, Handlebars templates, and SCSS for styling with the HashiCorp Design System components.
+
+## Repository Structure
+- `ui/app/components/` - Reusable UI components and their templates
+- `ui/app/models/` - Ember Data models representing API entities
+- `ui/app/routes/` - Route handlers for URL endpoints and data loading logic
+- `ui/app/templates/` - Page-level Handlebars templates 
+- `ui/app/services/` - Ember services for shared functionality and state management
+- `ui/app/helpers/` - Template helper functions for data formatting and logic
+- `ui/tests/` - Integration, unit, and acceptance tests
+- `ui/app/styles/` - SCSS stylesheets and component-specific styles
+- `ui/config/` - Ember CLI configuration and environment settings
+- `ui/mirage/` - Mock server configuration for development and testing
+
+## Framework and Tools
+- **Frontend Framework**: Ember.js 4.x with Ember Octane patterns and decorators
+- **Data Layer**: Ember Data for API communication with backend services
+- **Templating**: Handlebars templates with Ember's component architecture
+- **Styling**: SCSS with HashiCorp Design System (HDS) components and Bulma CSS framework
+- **Build System**: Ember CLI with Webpack for bundling and asset management
+- **Development**: ESLint for code linting, Prettier for code formatting
+
+## File Naming Conventions
+- **Component Structure**: Components should have matching JavaScript/TypeScript and `.hbs` files in the same directory
+- **Directory Organization**: Organize new components in logical subdirectories by feature or domain
+
+## Build and Deployment Structure
+- **Development Build**: `ember serve` creates development server with live reload
+- **Production Build**: `ember build --environment=production` generates optimized assets in `dist/`
+- **Asset Output**: Built files are typically served by the application's backend server or embedded in the main binary
+- **Integration**: UI is often compiled and integrated into the main application during release builds
+- **Testing**: `ember test` runs the full test suite with QUnit in headless Chrome
+
+---
+
+# Changelog Guidelines
+
+For files in the `changelog/` directory:
+- **Enterprise features**: Use `ui (enterprise): descriptive text`  
+- **Community features**: Use `ui: descriptive text`
+- Always indicate enterprise-only features in the description
+
+```javascript
+// Changelog entries
+"ui (enterprise): Add advanced policy filtering"  // enterprise features
+"ui: Fix configuration list pagination"           // community features
+```
+
+---
+
+# Dependency Management
+
+## package.json Guidelines
+- Pin exact versions for critical dependencies or use tilde (`~`) for patch updates only
+- **WARNING**: Avoid caret (`^`) operator which allows minor version updates that may introduce breaking changes
+- Use tilde (`~`) for regular dependencies, exact versions for security-critical packages
+- Dependencies in `resolutions` block MUST be pinned (no `~` or `^`)
+- Keep `package.json` changes minimal and focused on the specific feature or fix
+- Always commit lock files (`yarn.lock`, `package-lock.json`) with dependency changes
+- Ensure package.json changes are independent of other code changes (except lock files)
+- **Reminder**: Consider coordinating dependency changes with backend teams when the UI is embedded in application binaries
+
+Example dependency specification:
+```json
+{
+  "dependencies": {
+    "lodash": "4.17.21",        // exact version for critical packages
+    "express": "~4.18.0"        // tilde for patch updates only
+  },
+  "resolutions": {
+    "minimist": "1.2.6"         // always exact for security fixes
+  }
+}
+```
diff --git a/.github/instructions/generic/ember_hbs.instructions.md b/.github/instructions/generic/ember_hbs.instructions.md
new file mode 100644
index 00000000000..da67c4a51f5
--- /dev/null
+++ b/.github/instructions/generic/ember_hbs.instructions.md
@@ -0,0 +1,113 @@
+---
+applyTo: "vault/ui/**/*.hbs"
+description: "HashiCorp Ember.js UI Handlebars template coding standards"
+---
+
+# HashiCorp Ember.js Handlebars Template Guidelines
+
+This document provides Handlebars template coding standards for HashiCorp Ember.js UI applications.
+
+> **Note**: For general project context, framework information, and repository structure, see `ember_general.instructions.md`.
+
+## Template Best Practices
+- Check truthiness of arrays directly instead of using `.length` property
+- Use string interpolation `"prefix/{{value}}"` instead of `{{concat}}` helper  
+- Remove unnecessary quotes around dynamic component arguments
+- Use `Hds::Link::Inline` for external documentation links instead of `<button>` elements
+- Make `selected` attributes dynamic rather than static values - warn if static values are used
+- Refactor conditionals to wrap content rather than entire elements when possible
+- Avoid inline `style` attributes and `{{style ...}}` helpers - define CSS classes in `.scss` files instead
+- Place `data-test-*` selectors as the last attribute on elements
+- Remove quotes around dynamic data attributes: `data-test-id={{value}}` not `data-test-id="{{value}}"`
+
+Examples:
+```handlebars
+{{!-- Good: direct array check --}}
+{{#if this.model.allowed_roles}}
+
+{{!-- Bad: unnecessary .length check --}}
+{{#if (gt this.model.allowed_roles.length 0)}}
+
+{{!-- Good: string interpolation --}}
+@secret="role/{{@model.id}}"
+
+{{!-- Bad: concat helper --}}
+@secret={{concat "role/" @model.id}}
+
+{{!-- Good: conditional content, not element --}}
+<PH.Title>{{if this.version.isEnterprise "Enterprise" "Community"}} features</PH.Title>
+
+{{!-- Bad: conditional wrapping entire element --}}
+{{#if this.version.isEnterprise}}
+  <PH.Title>Enterprise features</PH.Title>
+{{else}}
+  <PH.Title>Community features</PH.Title>
+{{/if}}
+
+{{!-- Good: CSS classes instead of inline styles --}}
+<Hds::Button @text="Save" class="custom-button" data-test-save />
+
+{{!-- Bad: inline style attribute --}}
+<Hds::Button @text="Save" style="margin-top: 10px;" data-test-save />
+
+{{!-- Bad: style helper --}}
+<Hds::Button @text="Save" style={{style margin-top="10px"}} data-test-save />
+
+{{!-- Good: data-test selector at the end --}}
+<Hds::Button @text="Save" @icon="loading" disabled={{this.isLoading}} data-test-save />
+
+{{!-- Bad: data-test selector not at the end --}}
+<Hds::Button data-test-save @text="Save" @icon="loading" disabled={{this.isLoading}} />
+
+{{!-- Good: no quotes around dynamic values --}}
+<div data-test-namespace-link={{option.label}}>
+
+{{!-- Bad: unnecessary quotes --}}
+<div data-test-namespace-link="{{option.label}}">
+```
+
+---
+
+# Content and Terminology
+
+## Title and Heading Case Rules
+- **USE SENTENCE CASE**: All HTML headings (`<h1>`, `<h2>`, `<h3>`, etc.) should use sentence case (only first letter capitalized)
+- **NO TITLE CASE**: Avoid title case where every major word is capitalized
+- **Component arguments**: Use sentence case for `@title`, `@label`, and similar text properties
+- End descriptive text with proper punctuation
+- Follow proper grammar rules including ending sentences with periods
+- Use consistent terminology for product-specific features and components
+
+Examples:
+```handlebars
+{{!-- CORRECT: Sentence case in HTML headings --}}
+<h2 class="title is-4">Quick actions</h2>
+<h3 class="title is-marginless is-6">Configuration settings</h3>
+<h1>Authentication methods</h1>
+
+{{!-- INCORRECT: Title case in HTML headings --}}
+<h2 class="title is-4">Quick Actions</h2>
+<h3 class="title is-marginless is-6">Configuration Settings</h3>
+<h1>Authentication Methods</h1>
+```
+
+```javascript
+// CORRECT: Sentence case in component arguments
+@title="Upload user's profile"
+@label="Configuration path"
+@placeholder="Enter mount path"
+
+// INCORRECT: Title case or inconsistent casing
+@title="Upload User's Profile"
+@label="Configuration Path"
+@placeholder="Enter Mount Path"
+```
+
+```handlebars
+{{!-- CORRECT: Sentence case in data-test attributes when they contain readable text --}}
+data-test-card-subtitle="configuration-settings"
+
+{{!-- Component usage with proper casing --}}
+<Hds::Button @text="Create configuration" />
+<Hds::Alert @message="Operation completed successfully" />
+```
diff --git a/.github/instructions/generic/ember_js.instructions.md b/.github/instructions/generic/ember_js.instructions.md
new file mode 100644
index 00000000000..b7279219ad6
--- /dev/null
+++ b/.github/instructions/generic/ember_js.instructions.md
@@ -0,0 +1,100 @@
+---
+applyTo: "vault/ui/**/*.{js,ts}"
+description: "HashiCorp Ember.js UI JavaScript and TypeScript coding standards"
+---
+
+# HashiCorp Ember.js JavaScript & TypeScript Guidelines
+
+This document provides JavaScript and TypeScript coding standards for HashiCorp Ember.js UI applications.
+
+> **Note**: For general project context, framework information, and repository structure, see `ember_general.instructions.md`.
+
+## Documentation Standards
+- Include JSDoc comments for all public functions, classes, and modules
+- Use `/** @module ModuleName */` for modules and `/** description */` for functions
+- Document function parameters, return types, and any side effects
+- Keep comments concise and focused on the "why" rather than the "what"
+- **Required**: Add documentation for all new files (components, helpers, services)
+
+## Code Quality Standards
+- Remove all unused imports, variables, and functions before committing
+- Place comments directly above the code they describe, not inline or below
+- Update comments when code changes to maintain accuracy
+
+## TypeScript Guidelines
+- **File Naming**: All new files should use `.ts` extension instead of `.js`
+- **Migration Strategy**: When modifying existing `.js` files, evaluate the effort required to convert to `.ts` and prioritize conversion if time permits
+- Use explicit types instead of `any` - prefer `unknown` for truly dynamic content
+- Define interfaces for object shapes and function signatures
+- Use type guards and discriminated unions for runtime type checking
+- Enable strict mode in TypeScript configuration
+
+## Modern Ember Patterns
+- Replace `Route.extend`, `Model.extend`, or `Component.extend` with native JavaScript classes
+- Use Ember Octane conventions: tracked properties, decorators, and native class syntax
+- Create reusable components rather than one-off implementations
+- Co-locate component templates (`.hbs`) with their TypeScript files (`.ts` preferred over `.js`)
+- Prioritize reusability and maintainability when creating components - avoid overly complex or one-off implementations
+
+## Asynchronous Programming
+- Use `async`/`await` with proper error handling in `try`/`catch` blocks
+- Only use `@task` from ember-concurrency when you need specific features like cancellation or `task.isRunning` state management
+- Avoid `setTimeout` in favor of `requestAnimationFrame` for UI updates or proper async patterns for delays
+- **Warning**: `setTimeout` is prone to testing issues and event loop management problems
+- Handle promise rejections explicitly rather than relying on global handlers
+
+## Date and Time Handling  
+- **WARNING**: Avoid `new Date()` as it uses the browser's timezone
+- Use `Date.UTC()` constructor instead of `new Date()` for consistent timezone handling
+- Use UTC methods like `getUTCFullYear()`, `getUTCMonth()` for date manipulation to ensure dates are calculated consistently
+- Consider using a date library like `date-fns` for complex date operations
+
+## Error Handling and Logging
+- Use Ember's `assert` for runtime checks instead of `console.error`
+- Avoid `console.error` in production code - use proper logging libraries or framework-specific methods
+- Create meaningful error messages that include context about what failed
+- Use structured logging with consistent log levels (debug, info, warn, error)
+
+---
+
+# Component Development (JavaScript/TypeScript)
+
+## Component Architecture
+- Use `@tracked` only for internal component state that changes over time
+- Never use `@tracked` on component arguments (properties passed from parent components)
+- Component class names must match their file names exactly
+- Place `.hbs` templates in the same directory as their `.ts` files (or `.js` for legacy files) within `ui/app/components/`
+- Organize new components in logical subdirectories by feature or domain
+
+Examples:
+```javascript
+// Good: tracked for internal state
+@tracked isExpanded = false;
+
+// Bad: tracked on argument
+@tracked @secret; // @secret is an argument, not internal state
+```
+
+---
+
+# Model Definitions
+
+## Ember Data Models
+- Use single-line syntax for `@attr` declarations with simple options
+- Avoid extra blank lines between consecutive single-line `@attr` declarations
+- Group related attributes together logically
+
+Example:
+```javascript
+// Good: compact single-line format
+@attr('string', { label: 'Client ID' }) clientId;
+@attr('string', { label: 'Client Secret' }) clientSecret;
+@attr('boolean', { defaultValue: false }) isEnabled;
+
+// Bad: unnecessary multi-line for simple attributes
+@attr('string', {
+  label: 'Client ID',
+}) clientId;
+
+@attr('string', { label: 'Client Secret' }) clientSecret;
+```
diff --git a/.github/instructions/generic/ember_styles.instructions.md b/.github/instructions/generic/ember_styles.instructions.md
new file mode 100644
index 00000000000..b8b2888c050
--- /dev/null
+++ b/.github/instructions/generic/ember_styles.instructions.md
@@ -0,0 +1,36 @@
+---
+applyTo: "vault/ui/**/*.scss"
+description: "HashiCorp Ember.js UI SCSS styling coding standards"
+---
+
+# HashiCorp Ember.js SCSS Styling Guidelines
+
+This document provides SCSS styling coding standards for HashiCorp Ember.js UI applications.
+
+> **Note**: For general project context, framework information, and repository structure, see `ember_general.instructions.md`.
+
+## CSS Best Practices
+- Avoid `z-index` - manage stacking order through DOM structure instead
+- Avoid `!important` - use more specific selectors for overrides
+
+Examples:
+```scss
+// Good: specific selector for overrides
+.namespace-picker .button {
+  color: red;
+}
+
+// Bad: using !important
+.button {
+  color: red !important;
+}
+
+// Bad: using z-index for stacking
+.modal {
+  position: absolute;
+  z-index: 10;
+}
+
+// Good: manage stacking through DOM order in template
+// Place modal element after background overlay in template
+```
diff --git a/.github/instructions/generic/ember_tests.instructions.md b/.github/instructions/generic/ember_tests.instructions.md
new file mode 100644
index 00000000000..86a6bb525d9
--- /dev/null
+++ b/.github/instructions/generic/ember_tests.instructions.md
@@ -0,0 +1,225 @@
+---
+applyTo: "vault/ui/tests/**/*.{js,ts}"
+description: "HashiCorp Ember.js testing standards and best practices"
+---
+
+# HashiCorp Ember.js Testing Standards
+
+This document provides testing standards and best practices for HashiCorp Ember.js UI applications.
+
+> **Note**: For general project context, framework information, and repository structure, see `ember_general.instructions.md`.
+
+## Testing Framework and Tools
+- **Testing Framework**: QUnit for unit, integration, and acceptance tests
+- **Mock Server**: Ember CLI Mirage for API mocking and test data
+- **Test Runners**: Ember CLI test runner with headless Chrome
+
+## Test Directory Structure
+- `ui/tests/integration/` - Component integration tests
+- `ui/tests/unit/` - Service, helper, and model unit tests  
+- `ui/tests/acceptance/` - End-to-end user workflow tests
+- `ui/mirage/` - Mock server configuration for development and testing
+- `ui/tests/helpers/` - Custom test helper functions and utilities
+
+---
+
+# Testing Standards
+
+## Test Quality
+- Use `assert.true()` or `assert.false()` instead of `assert.ok()` for boolean checks
+- Provide descriptive assertion messages that explain what is being verified
+- Use `data-test-*` selectors for DOM interactions to decouple from styling
+- Place `this.server` setup at the top of test blocks when using ember-cli-mirage
+- Interact with elements directly rather than using Page Object patterns
+
+Example test assertions:
+```javascript
+// Good: specific assertion with descriptive message
+assert.true(component.isVisible, 'Component should be visible after clicking toggle');
+
+// Bad: vague assertion without context
+assert.ok(component.isVisible);
+```
+
+## Asynchronous Testing
+- Use Ember's `run.later` instead of `setTimeout` in tests for better runloop control
+- Handle async operations with proper waiting patterns in tests
+- Ensure test isolation by resetting state between tests
+
+## Mirage Server Setup
+- **Use `setupMirage(hooks)`** to automatically manage server lifecycle - no manual shutdown required
+- Place `this.server` setup at the top of test blocks when using ember-cli-mirage
+- Configure mock data that reflects realistic API responses
+- Use mirage factories for generating test data consistently
+- Reset server state between tests to ensure test isolation
+
+**Recommended approach** - use `setupMirage()`:
+```javascript
+import { setupMirage } from 'ember-cli-mirage/test-support';
+
+module('Integration | Component | my-component', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks); // Automatically handles server setup and shutdown
+
+  hooks.beforeEach(function () {
+    this.server.create('model', { id: 1, name: 'Test Item' });
+  });
+});
+```
+
+> **Note**: Avoid manual server setup and shutdown. Use `setupMirage(hooks)` instead to prevent memory leaks and reduce boilerplate code.
+
+## DOM Testing Best Practices
+- Use `data-test-*` selectors for DOM interactions to decouple from styling
+- Test user interactions through realistic user flows
+- Verify state changes after user actions
+- Test error states and edge cases
+- Ensure accessibility features work correctly
+
+Example DOM testing:
+```javascript
+// Good: using data-test selectors
+await click('[data-test-submit-button]');
+assert.true(find('[data-test-success-message]'), 'Success message should appear after submission');
+
+// Bad: using CSS classes for testing
+await click('.btn-submit');
+assert.ok(find('.alert-success'));
+```
+
+## Test Organization
+- **Use modules primarily for shared test setup and context**, not just organizational grouping
+- Nest modules only when tests benefit from the same `beforeEach` context or setup logic
+- Avoid excessive nesting that can make test structure confusing to navigate
+- Use descriptive test names that explain the scenario being tested
+- Include both positive and negative test cases
+- Test error handling and edge cases
+- Keep tests focused on a single behavior or outcome
+
+**Good module usage** - shared setup benefits multiple tests:
+```javascript
+module('Integration | Component | secret-form', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  module('with authentication', function (hooks) {
+    hooks.beforeEach(function () {
+      // Shared setup that multiple tests need
+      this.server.create('user', { authenticated: true });
+      this.store = this.owner.lookup('service:store');
+      this.currentUser = this.store.createRecord('user', { id: 1 });
+    });
+
+    test('shows user-specific options when authenticated', function (assert) {
+      // Test that benefits from the shared authentication setup
+    });
+
+    test('allows advanced actions when authenticated', function (assert) {
+      // Another test that needs the same authentication context
+    });
+  });
+
+  module('without authentication', function (hooks) {
+    hooks.beforeEach(function () {
+      // Different shared setup for unauthenticated state
+      this.server.create('user', { authenticated: false });
+    });
+
+    test('hides sensitive options when not authenticated', function (assert) {
+      // Test that benefits from unauthenticated setup
+    });
+  });
+});
+```
+
+**Avoid** - unnecessary nesting for organization only:
+```javascript
+// Don't do this - no shared setup benefit
+module('Integration | Component | secret-form', function (hooks) {
+  module('input validation', function (hooks) {
+    test('validates required fields', function (assert) { /* ... */ });
+    test('validates field format', function (assert) { /* ... */ });
+  });
+
+  module('form submission', function (hooks) {
+    test('submits valid data', function (assert) { /* ... */ });
+    test('handles submission errors', function (assert) { /* ... */ });
+  });
+});
+```
+
+Example test structure:
+```javascript
+module('Integration | Component | secret-form', function (hooks) {
+  setupRenderingTest(hooks);
+
+  test('it displays validation error when secret name is empty', async function (assert) {
+    await render(hbs`<SecretForm @onSubmit={{this.handleSubmit}} />`);
+    
+    await click('[data-test-submit-button]');
+    
+    assert.true(
+      find('[data-test-name-error]').textContent.includes('Secret name is required'),
+      'Should display validation error for empty secret name'
+    );
+  });
+
+  test('it calls onSubmit with form data when valid', async function (assert) {
+    let submittedData;
+    this.handleSubmit = (data) => { submittedData = data; };
+
+    await render(hbs`<SecretForm @onSubmit={{this.handleSubmit}} />`);
+    
+    await fillIn('[data-test-secret-name]', 'my-secret');
+    await fillIn('[data-test-secret-value]', 'secret-value');
+    await click('[data-test-submit-button]');
+    
+    assert.deepEqual(submittedData, {
+      name: 'my-secret',
+      value: 'secret-value'
+    }, 'Should submit form data with correct values');
+  });
+});
+```
+
+---
+
+# Debugging Tests
+
+## Debugging Tips
+When debugging Ember templates in tests:
+- Use `{{debugger}}` inside templates to inspect values in the browser console
+- In the console during debugging:
+  - Use `get('property.name')` to inspect nested properties
+  - Use `context` to explore the current template context
+- Add console.log statements in test code to track execution flow
+- Use browser developer tools to inspect DOM state during test execution
+
+Example debugging usage:
+```handlebars
+{{#each this.items as |item|}}
+  {{debugger}}
+{{/each}}
+```
+
+```javascript
+test('debugging example', async function (assert) {
+  await render(hbs`<MyComponent @data={{this.testData}} />`);
+  
+  // Pause execution to inspect DOM
+  debugger;
+  
+  console.log('Component state:', this.element.querySelector('[data-test-component]'));
+  
+  await click('[data-test-button]');
+  
+  // Inspect state after interaction
+  debugger;
+});
+```
+
+## Test Isolation
+- Reset component state between tests
+- Clear any global state or services
+- Ensure tests don't depend on execution order
+- Use hooks for setup and teardown consistently
diff --git a/.github/instructions/generic/golang.instructions.md b/.github/instructions/generic/golang.instructions.md
new file mode 100644
index 00000000000..509baf84974
--- /dev/null
+++ b/.github/instructions/generic/golang.instructions.md
@@ -0,0 +1,158 @@
+---
+applyTo: "**/*.go"
+description: "Practical guidance for Golang programming"
+---
+
+# Go Programming Instructions
+
+## Code Style and Formatting
+- Use `gofmt` and `goimports` to format all Go code automatically
+- Follow standard Go naming conventions:
+  - camelCase for unexported identifiers
+  - PascalCase for exported identifiers
+  - Use MixedCaps or mixedCaps rather than underscores for multiword names
+  - Words in names that are initialisms or acronyms (e.g. “URL” or “NATO”) have a consistent case. For example, “URL” should appear as “URL” or “url” (as in “urlPony”, or “URLPony”), never as “Url”. As an example: ServeHTTP not ServeHttp. For identifiers with multiple initialized “words”, use for example “xmlHTTPRequest” or “XMLHTTPRequest”.
+- Keep line length reasonable (Go has no strict limit, but wrap long lines)
+- Use meaningful variable and function names
+
+## Package Organization
+- Use lowercase, single-word package names, no hyphens or underscores
+- Keep packages focused and cohesive
+- Place main packages in `cmd/` directory for applications, unless the repository will only ever contain one executable, in which case a `main.go` at the root of the repository is ok
+- Package name should be the base name of its source directory
+
+## Naming Conventions
+### Package Names
+- Use short, concise, evocative names
+- Prefer brevity since everyone using your package will type the name
+- Examples: `bufio.Reader` not `bufio.BufReader`, `ring.New` not `ring.NewRing`
+
+### Interface Names
+- One-method interfaces use method name + "-er" suffix: `Reader`, `Writer`, `Formatter`
+- Honor canonical method signatures: `Read`, `Write`, `Close`, `String`
+
+### Getters and Setters
+- Prefer exporting fields over adding getters and setters where possible
+- When required, don't use "Get" prefix for getters. For example, if the field name is `owner`, the getter should be `Owner()`, and the setter `SetOwner()`
+
+## Functions and Methods
+- Use multiple return values to improve error handling
+- Only use named result parameters if multiple parameters are of the same type
+- Use defer for cleanup operations (closing files, unlocking mutexes)
+  - Defer executes in LIFO order
+  - Arguments to deferred functions are evaluated when defer executes
+
+## Control Structures
+- Use initialization statement in if/switch when appropriate:
+  ```go
+  if err := file.Chmod(0o664); err != nil {
+      return err
+  }
+  ```
+- Use switch statements instead of repeated if statements for validation:
+  ```go
+  // Good:
+  switch {
+  case x < 0: return fmt.Errorf("negative value")
+  case x > 10: return fmt.Errorf("value too large")
+  }
+  
+  // Bad:
+  if x < 0 { return fmt.Errorf("negative value") }
+  if x > 10 { return fmt.Errorf("value too large") }
+  ```
+- Omit unnecessary else statements when if ends with return/break/continue
+- Use type switches for interface type checking
+- Use range for iteration over arrays, slices, strings, maps, channels
+   ```go
+   for i, v := range slice { /* ... */ }  // Good
+   for i := 0; i < len(slice); i++ { /* ... */ }  // Bad
+   ```
+
+## Error Handling and Design
+- Always handle errors explicitly
+- Use descriptive error messages that include context
+- Wrap errors with additional context when appropriate
+- Return errors as the last return value
+- Check error returns - they're provided for a reason
+- Use the "comma ok" idiom for optional error checking:
+  ```go
+  if value, ok := someOperation(); !ok {
+      // handle error case
+  }
+  ```
+- Implement the error interface, `Is(error) bool` and `As(any) bool` for custom error types
+- Provide detailed error context including operation and file paths
+- Use panic only for truly exceptional cases or programming errors
+- Use recover to handle panics gracefully in server applications
+- Design errors to be useful when printed far from their origin
+
+## Data Structures
+- Prefer zero-value-useful types in your designs
+- Prefer slices over arrays for most use cases
+  - Understand slice sharing and capacity
+  - Use `append()` built-in for growing slices
+  - Use copy() for copying slice elements
+- Maps
+  - Use "comma ok" idiom to test for presence: `value, ok := m[key]`
+  - Use `delete(m, key)` to remove entries safely
+
+## Interfaces and Composition
+- Design small, focused interfaces (often single-method)
+- Accept interfaces, return concrete types
+- Use empty interface `interface{}` or `any` sparingly
+- Prefer composition over large interfaces
+- Use type assertions and type switches for interface conversions
+- Embed types to promote methods and satisfy interfaces
+  - Use embedding for has-a relationships, not is-a
+  - Understand method promotion and shadowing rules
+
+## Concurrency
+- Don't communicate by sharing memory; share memory by communicating
+- Use channels for goroutine communication and synchronization
+- Use goroutines for concurrent execution: `go functionCall()`
+- Use buffered channels as semaphores for limiting concurrency
+- Use select for non-blocking channel operations
+- Prefer structured concurrency patterns over ad-hoc goroutine creation
+- Unbuffered channels provide synchronization
+- Buffered channels can improve performance and provide semaphore behavior
+- Close channels to signal completion to range loops
+
+## Documentation
+- Write clear godoc comments for exported functions and types
+- Start comments with the name of the item being documented
+- Use complete sentences in documentation
+- Provide examples in documentation when helpful
+- Document any unusual behavior or requirements
+
+## Best Practices
+- Keep functions small and focused
+- Use context for cancellation and timeouts
+- Avoid global variables when possible
+- Use the blank identifier `_` to discard unused values
+- Make zero values useful in your type designs
+- Use init() functions for package initialization
+- Initialize complex data with composite literals
+- Profile before optimizing
+- Use build constraints for platform-specific code
+- Understand escape analysis and stack vs heap allocation
+- Use sync.Pool for frequently allocated objects
+
+## Common Idioms
+- Use `fmt.Stringer` interface for custom string representations
+- Implement `io.Reader` and `io.Writer` interfaces when appropriate
+- Use functional options pattern for configuration
+- Use builder pattern for complex object construction
+- Prefer early returns to reduce nesting
+- Initialize complex data with composite literals
+
+### Type Embedding
+- Embed types to promote methods and satisfy interfaces
+- Use embedding for has-a relationships, not is-a
+- Understand method promotion and shadowing rules
+
+### Performance
+- Understand escape analysis and stack vs heap allocation
+- Use sync.Pool for frequently allocated objects
+- Profile before optimizing
+- Use build constraints for platform-specific code
diff --git a/.github/instructions/generic/golang_tests.instructions.md b/.github/instructions/generic/golang_tests.instructions.md
new file mode 100644
index 00000000000..d6ad859697b
--- /dev/null
+++ b/.github/instructions/generic/golang_tests.instructions.md
@@ -0,0 +1,29 @@
+---
+applyTo: "**/*_test.go"
+description: "Practical guidance for writing tests in Go"
+---
+
+# Golang Testing Guidelines
+*Practical guidance for writing tests in Go*
+
+## General Guidelines
+- Write unit tests for all public functions
+- Use table-driven tests when appropriate
+- Follow naming convention: `Test_FunctionName`
+- Use `t.Parallel()` for faster test execution and to encourage writing tests that don't share state
+
+## Tools
+- Use testify/assert and testify/require for consistent assertions
+
+## Test Structure
+- Use t.Helper() to mark helper functions
+- Use subtests for organizing related test cases with t.Run()
+
+## Integration Tests 
+- Use testcontainers to spin up dependencies like postgres or redis
+
+## Black box testing 
+- The test should be in feature_test package to be the first client of the feature package
+
+## End-to-End Testing (Future Enhancement)
+<!-- TODO: Add guidance for end-to-end testing with enos and cloud-first testing in Vault Cloud -->
diff --git a/.github/instructions/generic/testing.instructions.md b/.github/instructions/generic/testing.instructions.md
new file mode 100644
index 00000000000..9f570c7aa17
--- /dev/null
+++ b/.github/instructions/generic/testing.instructions.md
@@ -0,0 +1,45 @@
+---
+applyTo: "**/*_test.go,**/*_spec.rb"
+description: "Practical guidance for writing tests across languages"
+---
+
+# Philosophy & Principles
+
+## Testing: 
+- Test coverage is not a metric to optimize for
+- Test behavior and not implementation detail
+- Write tests that are robust to refactoring the code under test
+
+###  Value of a test
+- Test is code that needs to be maintained
+- If a test is not valuable, delete it
+
+###  Tests are documentation
+- Use the given-when-then pattern to communicate each test case
+- Test names should express intent 
+
+## Test Design & Quality 
+*How to design reliable, maintainable tests*
+
+### Test Isolation 
+- A unit test should only fail for one reason
+- Do not share state between tests
+- Cleanup resources after the test
+- If files are needed, use a temp directory (in Go, prefer `t.TempDir()` for automatic cleanup)
+
+### Test Stability
+- Do not use sleeping in a test
+
+### Test Structure
+- Consider parametrized tests where it makes sense
+
+### Mocks
+- Preferably do not use mocks
+- If you use mocks, assert the mock expectations
+
+## Supporting Code Quality
+*Making the code under test more testable*
+
+### Code under test
+- If the code relies on magic numbers or constants: Extract them
+- Consider introducing interfaces
diff --git a/.github/instructions/index.md b/.github/instructions/index.md
new file mode 100644
index 00000000000..2f3b6d57fac
--- /dev/null
+++ b/.github/instructions/index.md
@@ -0,0 +1,16 @@
+# Instructions 
+
+## Generic
+The generic folder contains instructions that can simply be copied into your teams repo for reuse. They are generic problem solving rules. 
+
+- golang_test.instructions.md
+Best practice for writing tests in Golang
+
+## Specific
+The specific folder contains instructions that are not intended for reuse. 
+
+config.instructions.md
+Guidance for the pkg/config package in the terraform-enterprise repository, providing additional context, such as the requirement to consider backwards compatability. 
+
+style.instructions.md 
+Guidance for writing documentation. Used in the web-unified-docs-internal repo. 
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 00000000000..393c30633fb
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,16 @@
+### Description
+What does this PR do?
+
+### TODO only if you're a HashiCorp employee
+- [ ] **Backport Labels:** If this fix needs to be backported, use the appropriate `backport/` label that matches the desired release branch.
+    - [ ] **LTS**: If this fixes a critical security vulnerability or [severity 1](https://www.hashicorp.com/customer-success/enterprise-support) bug, it will also need to be backported to the current [LTS versions](https://developer.hashicorp.com/vault/docs/enterprise/lts#why-is-there-a-risk-to-updating-to-a-non-lts-vault-enterprise-version) of Vault. To ensure this, use **all** available enterprise labels.
+- [ ] **Jira:** If this change has an associated Jira, it's referenced either in the PR description, commit message, or branch name.
+- [ ] **RFC:** If this change has an associated RFC, please link it in the description.
+
+### PCI review checklist
+<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
+- [ ] I have documented a clear reason for, and description of, the change I am making.
+- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
+- [ ] If applicable, I've documented the impact of any changes to security controls.
+
+Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.
diff --git a/.github/scripts/changed-files.sh b/.github/scripts/changed-files.sh
deleted file mode 100755
index f44c6fc26b9..00000000000
--- a/.github/scripts/changed-files.sh
+++ /dev/null
@@ -1,70 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-# Determine what files have changed between two git references.
-#
-# * For pull_request event_type's we'll the merge target (base_ref) with the pull requests reference,
-#   (ref_name) which is usually a branch name.
-# * For other event types (push, workflow_call) we don't have a base_ref target to merge into, so
-#   instead we'll compare the last commit.
-#
-# Write the resulting metadata to STDOUT and $GITHUB_OUTPUT if it's defined.
-
-event_type=$1 # GH event type (pull_request, push, workflow_call)
-ref_name=$2 # branch reference that triggered the workflow
-base_ref=$3 # PR branch base ref
-
-if [[ "$event_type" == "pull_request" ]]; then
-  git fetch --no-tags --prune origin "$base_ref"
-  head_commit="HEAD"
-  base_commit="origin/$base_ref"
-else
-  git fetch --no-tags --prune origin "$ref_name"
-  head_commit=$(git log "origin/$ref_name" --oneline | head -1 | awk '{print $1}')
-  base_commit=$(git log "origin/$ref_name" --oneline | head -2 | awk 'NR==2 {print $1}')
-fi
-
-docs_changed=false
-ui_changed=false
-app_changed=false
-
-if ! files="$(git diff "${base_commit}...${head_commit}" --name-only)"; then
-  echo "failed to get changed files from git"
-  exit 1
-fi
-
-for file in $(awk -F "/" '{ print $1}' <<< "$files" | uniq); do
-  if [[ "$file" == "changelog" ]]; then
-    continue
-  fi
-
-  if [[ "$file" == "website" ]]; then
-    docs_changed=true
-    continue
-  fi
-
-  if [[ "$file" == "ui" ]]; then
-    ui_changed=true
-    continue
-  fi
-
-  # Anything that isn't either a changelog, ui, or docs change we'll consider an app change.
-  app_changed=true
-done
-
-echo "app-changed=${app_changed}"
-echo "docs-changed=${docs_changed}"
-echo "ui-changed=${ui_changed}"
-echo "files='${files}'"
-[ -n "$GITHUB_OUTPUT" ] && {
-  echo "app-changed=${app_changed}"
-  echo "docs-changed=${docs_changed}"
-  echo "ui-changed=${ui_changed}"
-  # Use a random delimiter for multiline strings.
-  # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings
-  delimiter="$(openssl rand -hex 8)"
-  echo "files<<${delimiter}"
-  echo "${files}"
-  echo "${delimiter}"
-} >> "$GITHUB_OUTPUT"
diff --git a/.github/scripts/gh-comment.sh b/.github/scripts/gh-comment.sh
index 111ed97e030..bc8aefcb223 100644
--- a/.github/scripts/gh-comment.sh
+++ b/.github/scripts/gh-comment.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
diff --git a/.github/scripts/install-cob.sh b/.github/scripts/install-cob.sh
new file mode 100644
index 00000000000..224c2c8b13f
--- /dev/null
+++ b/.github/scripts/install-cob.sh
@@ -0,0 +1,409 @@
+#!/bin/sh
+set -e
+# Code generated by godownloader on 2020-01-12T16:31:14Z. DO NOT EDIT.
+#
+
+usage() {
+  this=$1
+  cat <<EOF
+$this: download go binaries for knqyf263/cob
+
+Usage: $this [-b] bindir [-d] [tag]
+  -b sets bindir or installation directory, Defaults to ./bin
+  -d turns on debug logging
+   [tag] is a tag from
+   https://github.com/knqyf263/cob/releases
+   If tag is missing, then the latest will be used.
+
+ Generated by godownloader
+  https://github.com/goreleaser/godownloader
+
+EOF
+  exit 2
+}
+
+parse_args() {
+  #BINDIR is ./bin unless set be ENV
+  # over-ridden by flag below
+
+  BINDIR=${BINDIR:-./bin}
+  while getopts "b:dh?x" arg; do
+    case "$arg" in
+      b) BINDIR="$OPTARG" ;;
+      d) log_set_priority 10 ;;
+      h | \?) usage "$0" ;;
+      x) set -x ;;
+    esac
+  done
+  shift $((OPTIND - 1))
+  TAG=$1
+}
+# this function wraps all the destructive operations
+# if a curl|bash cuts off the end of the script due to
+# network, either nothing will happen or will syntax error
+# out preventing half-done work
+execute() {
+  tmpdir=$(mktemp -d)
+  log_debug "downloading files into ${tmpdir}"
+  http_download "${tmpdir}/${TARBALL}" "${TARBALL_URL}"
+  http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
+  hash_sha256_verify "${tmpdir}/${TARBALL}" "${tmpdir}/${CHECKSUM}"
+  srcdir="${tmpdir}"
+  (cd "${tmpdir}" && untar "${TARBALL}")
+  test ! -d "${BINDIR}" && install -d "${BINDIR}"
+  for binexe in $BINARIES; do
+    if [ "$OS" = "windows" ]; then
+      binexe="${binexe}.exe"
+    fi
+    install "${srcdir}/${binexe}" "${BINDIR}/"
+    log_info "installed ${BINDIR}/${binexe}"
+  done
+  rm -rf "${tmpdir}"
+}
+get_binaries() {
+  case "$PLATFORM" in
+    darwin/386) BINARIES="cob" ;;
+    darwin/amd64) BINARIES="cob" ;;
+    darwin/arm64) BINARIES="cob" ;;
+    darwin/armv7) BINARIES="cob" ;;
+    freebsd/386) BINARIES="cob" ;;
+    freebsd/amd64) BINARIES="cob" ;;
+    freebsd/arm64) BINARIES="cob" ;;
+    freebsd/armv7) BINARIES="cob" ;;
+    linux/386) BINARIES="cob" ;;
+    linux/amd64) BINARIES="cob" ;;
+    linux/arm64) BINARIES="cob" ;;
+    linux/armv7) BINARIES="cob" ;;
+    openbsd/386) BINARIES="cob" ;;
+    openbsd/amd64) BINARIES="cob" ;;
+    openbsd/arm64) BINARIES="cob" ;;
+    openbsd/armv7) BINARIES="cob" ;;
+    *)
+      log_crit "platform $PLATFORM is not supported.  Make sure this script is up-to-date and file request at https://github.com/${PREFIX}/issues/new"
+      exit 1
+      ;;
+  esac
+}
+tag_to_version() {
+  if [ -z "${TAG}" ]; then
+    log_info "checking GitHub for latest tag"
+  else
+    log_info "checking GitHub for tag '${TAG}'"
+  fi
+  REALTAG=$(github_release "$OWNER/$REPO" "${TAG}") && true
+  if test -z "$REALTAG"; then
+    log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${PREFIX}/releases for details"
+    exit 1
+  fi
+  # if version starts with 'v', remove it
+  TAG="$REALTAG"
+  VERSION=${TAG#v}
+}
+adjust_format() {
+  # change format (tar.gz or zip) based on OS
+  true
+}
+adjust_os() {
+  # adjust archive name based on OS
+  case ${OS} in
+    386) OS=32bit ;;
+    amd64) OS=64bit ;;
+    arm) OS=ARM ;;
+    arm64) OS=ARM64 ;;
+    darwin) OS=macOS ;;
+    dragonfly) OS=DragonFlyBSD ;;
+    freebsd) OS=FreeBSD ;;
+    linux) OS=Linux ;;
+    netbsd) OS=NetBSD ;;
+    openbsd) OS=OpenBSD ;;
+  esac
+  true
+}
+adjust_arch() {
+  # adjust archive name based on ARCH
+  case ${ARCH} in
+    386) ARCH=32bit ;;
+    amd64) ARCH=64bit ;;
+    arm) ARCH=ARM ;;
+    arm64) ARCH=ARM64 ;;
+    darwin) ARCH=macOS ;;
+    dragonfly) ARCH=DragonFlyBSD ;;
+    freebsd) ARCH=FreeBSD ;;
+    linux) ARCH=Linux ;;
+    netbsd) ARCH=NetBSD ;;
+    openbsd) ARCH=OpenBSD ;;
+  esac
+  true
+}
+
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+https://github.com/client9/shlib - portable posix shell functions
+Public domain - http://unlicense.org
+https://github.com/client9/shlib/blob/master/LICENSE.md
+but credit (and pull requests) appreciated.
+------------------------------------------------------------------------
+EOF
+is_command() {
+  command -v "$1" >/dev/null
+}
+echoerr() {
+  echo "$@" 1>&2
+}
+log_prefix() {
+  echo "$0"
+}
+_logp=6
+log_set_priority() {
+  _logp="$1"
+}
+log_priority() {
+  if test -z "$1"; then
+    echo "$_logp"
+    return
+  fi
+  [ "$1" -le "$_logp" ]
+}
+log_tag() {
+  case $1 in
+    0) echo "emerg" ;;
+    1) echo "alert" ;;
+    2) echo "crit" ;;
+    3) echo "err" ;;
+    4) echo "warning" ;;
+    5) echo "notice" ;;
+    6) echo "info" ;;
+    7) echo "debug" ;;
+    *) echo "$1" ;;
+  esac
+}
+log_debug() {
+  log_priority 7 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
+}
+log_info() {
+  log_priority 6 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
+}
+log_err() {
+  log_priority 3 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
+}
+log_crit() {
+  log_priority 2 || return 0
+  echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
+}
+uname_os() {
+  os=$(uname -s | tr '[:upper:]' '[:lower:]')
+  case "$os" in
+    cygwin_nt*) os="windows" ;;
+    mingw*) os="windows" ;;
+    msys_nt*) os="windows" ;;
+  esac
+  echo "$os"
+}
+uname_arch() {
+  arch=$(uname -m)
+  case $arch in
+    x86_64) arch="amd64" ;;
+    x86) arch="386" ;;
+    i686) arch="386" ;;
+    i386) arch="386" ;;
+    aarch64) arch="arm64" ;;
+    armv5*) arch="armv5" ;;
+    armv6*) arch="armv6" ;;
+    armv7*) arch="armv7" ;;
+  esac
+  echo ${arch}
+}
+uname_os_check() {
+  os=$(uname_os)
+  case "$os" in
+    darwin) return 0 ;;
+    dragonfly) return 0 ;;
+    freebsd) return 0 ;;
+    linux) return 0 ;;
+    android) return 0 ;;
+    nacl) return 0 ;;
+    netbsd) return 0 ;;
+    openbsd) return 0 ;;
+    plan9) return 0 ;;
+    solaris) return 0 ;;
+    windows) return 0 ;;
+  esac
+  log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
+  return 1
+}
+uname_arch_check() {
+  arch=$(uname_arch)
+  case "$arch" in
+    386) return 0 ;;
+    amd64) return 0 ;;
+    arm64) return 0 ;;
+    armv5) return 0 ;;
+    armv6) return 0 ;;
+    armv7) return 0 ;;
+    ppc64) return 0 ;;
+    ppc64le) return 0 ;;
+    mips) return 0 ;;
+    mipsle) return 0 ;;
+    mips64) return 0 ;;
+    mips64le) return 0 ;;
+    s390x) return 0 ;;
+    amd64p32) return 0 ;;
+  esac
+  log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value.  Please file bug report at https://github.com/client9/shlib"
+  return 1
+}
+untar() {
+  tarball=$1
+  case "${tarball}" in
+    *.tar.gz | *.tgz) tar --no-same-owner -xzf "${tarball}" ;;
+    *.tar) tar --no-same-owner -xf "${tarball}" ;;
+    *.zip) unzip "${tarball}" ;;
+    *)
+      log_err "untar unknown archive format for ${tarball}"
+      return 1
+      ;;
+  esac
+}
+http_download_curl() {
+  local_file=$1
+  source_url=$2
+  header=$3
+  if [ -z "$header" ]; then
+    code=$(curl -w '%{http_code}' -sL -o "$local_file" "$source_url")
+  else
+    code=$(curl -w '%{http_code}' -sL -H "$header" -o "$local_file" "$source_url")
+  fi
+  if [ "$code" != "200" ]; then
+    log_debug "http_download_curl received HTTP status $code"
+    return 1
+  fi
+  return 0
+}
+http_download_wget() {
+  local_file=$1
+  source_url=$2
+  header=$3
+  if [ -z "$header" ]; then
+    wget -q -O "$local_file" "$source_url"
+  else
+    wget -q --header "$header" -O "$local_file" "$source_url"
+  fi
+}
+http_download() {
+  log_debug "http_download $2"
+  if is_command curl; then
+    http_download_curl "$@"
+    return
+  elif is_command wget; then
+    http_download_wget "$@"
+    return
+  fi
+  log_crit "http_download unable to find wget or curl"
+  return 1
+}
+http_copy() {
+  tmp=$(mktemp)
+  http_download "${tmp}" "$1" "$2" || return 1
+  body=$(cat "$tmp")
+  rm -f "${tmp}"
+  echo "$body"
+}
+github_release() {
+  owner_repo=$1
+  version=$2
+  test -z "$version" && version="latest"
+  giturl="https://github.com/${owner_repo}/releases/${version}"
+  json=$(http_copy "$giturl" "Accept:application/json")
+  test -z "$json" && return 1
+  version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
+  test -z "$version" && return 1
+  echo "$version"
+}
+hash_sha256() {
+  TARGET=${1:-/dev/stdin}
+  if is_command gsha256sum; then
+    hash=$(gsha256sum "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command sha256sum; then
+    hash=$(sha256sum "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command shasum; then
+    hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
+    echo "$hash" | cut -d ' ' -f 1
+  elif is_command openssl; then
+    hash=$(openssl -dst openssl dgst -sha256 "$TARGET") || return 1
+    echo "$hash" | cut -d ' ' -f a
+  else
+    log_crit "hash_sha256 unable to find command to compute sha-256 hash"
+    return 1
+  fi
+}
+hash_sha256_verify() {
+  TARGET=$1
+  checksums=$2
+  if [ -z "$checksums" ]; then
+    log_err "hash_sha256_verify checksum file not specified in arg2"
+    return 1
+  fi
+  BASENAME=${TARGET##*/}
+  want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1)
+  if [ -z "$want" ]; then
+    log_err "hash_sha256_verify unable to find checksum for '${TARGET}' in '${checksums}'"
+    return 1
+  fi
+  got=$(hash_sha256 "$TARGET")
+  if [ "$want" != "$got" ]; then
+    log_err "hash_sha256_verify checksum for '$TARGET' did not verify ${want} vs $got"
+    return 1
+  fi
+}
+cat /dev/null <<EOF
+------------------------------------------------------------------------
+End of functions from https://github.com/client9/shlib
+------------------------------------------------------------------------
+EOF
+
+PROJECT_NAME="cob"
+OWNER=knqyf263
+REPO="cob"
+BINARY=cob
+FORMAT=tar.gz
+OS=$(uname_os)
+ARCH=$(uname_arch)
+PREFIX="$OWNER/$REPO"
+
+# use in logging routines
+log_prefix() {
+	echo "$PREFIX"
+}
+PLATFORM="${OS}/${ARCH}"
+GITHUB_DOWNLOAD=https://github.com/${OWNER}/${REPO}/releases/download
+
+uname_os_check "$OS"
+uname_arch_check "$ARCH"
+
+parse_args "$@"
+
+get_binaries
+
+tag_to_version
+
+adjust_format
+
+adjust_os
+
+adjust_arch
+
+log_info "found version: ${VERSION} for ${TAG}/${OS}/${ARCH}"
+
+NAME=${PROJECT_NAME}_${VERSION}_${OS}-${ARCH}
+TARBALL=${NAME}.${FORMAT}
+TARBALL_URL=${GITHUB_DOWNLOAD}/${TAG}/${TARBALL}
+CHECKSUM=${PROJECT_NAME}_${VERSION}_checksums.txt
+CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
+
+
+execute
\ No newline at end of file
diff --git a/.github/scripts/report-build-status.sh b/.github/scripts/report-build-status.sh
index 8b92534a2c9..929fe99d40c 100755
--- a/.github/scripts/report-build-status.sh
+++ b/.github/scripts/report-build-status.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
diff --git a/.github/scripts/report-ci-status.sh b/.github/scripts/report-ci-status.sh
index 39a9ca7aee8..20158f4f198 100755
--- a/.github/scripts/report-ci-status.sh
+++ b/.github/scripts/report-ci-status.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
diff --git a/.github/scripts/retry-command.sh b/.github/scripts/retry-command.sh
new file mode 100755
index 00000000000..084879cb87d
--- /dev/null
+++ b/.github/scripts/retry-command.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+set -uo pipefail
+
+tries=5
+count=0
+
+until "$@"
+do
+  if [ $count -eq $tries ]; then
+    echo "tried $count times, exiting"
+    exit 1
+  fi
+  ((count++))
+  echo "trying again, attempt $count"
+  sleep $count
+done
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 488ce6b770d..9126f4b0139 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -12,11 +12,9 @@ concurrency:
 
 jobs:
   actionlint:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - name: "Check workflow files"
-        uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:93834930f56ca380be3e9a3377670d7aa5921be251b9c774891a39b3629b83b8
-        with:
-          # milestoned and demilestoned work (https://github.com/github/docs/issues/23909) but they aren't listed in the github documentation, so actionlint complains about them 
-          args: "-ignore=\"invalid activity type \\\"demilestoned\\\" for \\\"pull_request\\\" Webhook event\" -ignore=\"invalid activity type \\\"milestoned\\\" for \\\"pull_request\\\" Webhook event\""
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: "Run actionlint"
+        run: |
+          docker run --rm -v "$(pwd):/repo" --workdir /repo docker.mirror.hashicorp.services/rhysd/actionlint@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9 -color -verbose
diff --git a/.github/workflows/add-hashicorp-contributed-label.yml b/.github/workflows/add-hashicorp-contributed-label.yml
index 379b8cc9c8c..c6d2a96f99a 100644
--- a/.github/workflows/add-hashicorp-contributed-label.yml
+++ b/.github/workflows/add-hashicorp-contributed-label.yml
@@ -17,10 +17,13 @@ jobs:
   add-hashicorp-contributed-label:
     # Only run if this is NOT coming from a fork of hashicorp/vault (if this is not true, it's community contributed)
     if: ${{ github.repository == 'hashicorp/vault' && (github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name) }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     steps:
+      # gh pr edit needs a .git directory so we'll do a shallow checkout
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: "Add label to PR"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR: ${{ github.event.pull_request.html_url }}
-        run: gh pr edit "$PR" --add-label 'hashicorp-contributed-pr'
+        run: |
+          gh pr edit "$PR" --add-label 'hashicorp-contributed-pr'
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
deleted file mode 100644
index f78464a8c8b..00000000000
--- a/.github/workflows/backport.yml
+++ /dev/null
@@ -1,23 +0,0 @@
----
-name: Backport Assistant Runner (for OSS & ENT)
-
-on:
-  pull_request_target:
-    types:
-      - closed
-      - labeled
-
-jobs:
-  backport-targeted-release-branch:
-    if: github.event.pull_request.merged
-    runs-on: ubuntu-latest
-    container: hashicorpdev/backport-assistant:0.3.3
-    steps:
-      - name: Backport changes to targeted release branch
-        run: |
-          backport-assistant backport -merge-method=squash -gh-automerge 
-        env:
-          BACKPORT_LABEL_REGEXP: "backport/(?P<target>\\d+\\.\\d+\\.[+\\w]+)"
-          BACKPORT_TARGET_TEMPLATE: "release/{{.target}}"
-          BACKPORT_MERGE_COMMIT: true
-          GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
diff --git a/.github/workflows/benchmark-prevent-performance-degradations.yml b/.github/workflows/benchmark-prevent-performance-degradations.yml
new file mode 100644
index 00000000000..a526b095a40
--- /dev/null
+++ b/.github/workflows/benchmark-prevent-performance-degradations.yml
@@ -0,0 +1,56 @@
+name: Bench
+
+on:
+  # This has been disabled due to excessive flakiness. The GHA is left here for easier re-implementation in case
+  # we wanted to iterate on this in the future, or if we find benchmark tests that are more stable.
+  # To re-enable, uncomment the pull request section and delete the workflow_dispatch line.
+  workflow_dispatch:
+  #  pull_request:
+  #    types: [opened, synchronize, reopened, ready_for_review]
+  #    branches:
+  #      - main
+
+jobs:
+  bench:
+    name: Bench
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
+    steps:
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          fetch-tags: false
+      - uses: ./.github/actions/metadata
+        id: metadata
+      - if: steps.metadata.outputs.is-ent-repo == 'true'
+        id: vault-auth
+        name: Vault Authenticate
+        run: vault-auth
+      - if: steps.metadata.outputs.is-ent-repo == 'true'
+        id: vault-secrets
+        name: Fetch Vault Secrets
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
+        with:
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+            kv/data/github/${{ github.repository }}/github-token token | ELEVATED_GITHUB_TOKEN;
+      - id: github-token
+        run: |
+          {
+            echo 'elevated=${{ steps.metadata.outputs.is-ent-repo != 'true' && secrets.ELEVATED_GITHUB_TOKEN || steps.vault-secrets.outputs.ELEVATED_GITHUB_TOKEN }}'
+          } | tee -a "$GITHUB_OUTPUT"
+      - name: Set up go
+        uses: ./.github/actions/set-up-go
+        with:
+          github-token: ${{ steps.github-token.outputs.elevated }}
+      - name: Configure Git
+        run: git config --global url."https://${{ steps.github-token.outputs.elevated }}:@github.com".insteadOf "https://github.com"
+      - name: Install cob
+        run: sh -s -- -b /usr/local/bin -d v0.0.8 < ./.github/scripts/install-cob.sh
+      - name: Run Benchmark
+        run: |
+          cob --base ${{ github.event.pull_request.base.sha }} \
+            -threshold 0.1 \
+            -bench-args "test -bench . -benchtime 3s -benchmem -v ./vault/bench ${{ steps.metadata.outputs.is-ent-branch == 'true' && '-tags testonly,enterprise' || '-tags testonly'  }}"
diff --git a/.github/workflows/build-artifacts-ce.yml b/.github/workflows/build-artifacts-ce.yml
index 8b235904604..99b75b42cf4 100644
--- a/.github/workflows/build-artifacts-ce.yml
+++ b/.github/workflows/build-artifacts-ce.yml
@@ -9,36 +9,39 @@ on:
     inputs:
       build-all:
         type: boolean
+        description: Build all extended artifacts
         default: false
       build-date:
         type: string
+        description: The date associated with the revision SHA
         required: true
       checkout-ref:
         type: string
+        description: The repo Git SHA to checkout
         default: ""
       compute-build:
         type: string # JSON encoded to support passing arrays
         description: A JSON encoded "runs-on" for build worfkflows
         required: true
-      compute-build-compat:
-        type: string # JSON encoded to support passing arrays
-        description: A JSON encoded "runs-on" for build workflows that need older glibc
-        required: true
       compute-small:
         type: string # JSON encoded to support passing arrays
         description: A JSON encoded "runs-on" for non-resource-intensive workflows
         required: true
       vault-revision:
         type: string
+        description: The revision SHA of vault
         required: true
       vault-version:
         type: string
+        description: The version of vault
         required: true
       vault-version-package:
         type: string
+        description: Whether or not to package the binary as Debian and RPM packages
         required: true
       web-ui-cache-key:
         type: string
+        description: The UI asset cache key
         required: true
   workflow_call:
     inputs:
@@ -55,10 +58,6 @@ on:
         type: string # JSON encoded to support passing arrays
         description: A JSON encoded "runs-on" for build worfkflows
         required: true
-      compute-build-compat:
-        type: string # JSON encoded to support passing arrays
-        description: A JSON encoded "runs-on" for build workflows that need older glibc
-        required: true
       compute-small:
         type: string # JSON encoded to support passing arrays
         description: A JSON encoded "runs-on" for non-resource-intensive workflows
@@ -93,12 +92,12 @@ jobs:
             redhat: true
           - goos: linux
             goarch: arm64
-            redhat: false
+            redhat: true
       fail-fast: true
     runs-on: ${{ fromJSON(inputs.compute-build) }}
     name: (${{ matrix.goos }}, ${{ matrix.goarch }})
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.checkout-ref }}
       - uses: ./.github/actions/build-vault
@@ -111,6 +110,7 @@ jobs:
           goarch: ${{ matrix.goarch }}
           goos: ${{ matrix.goos }}
           go-tags: ui
+          package-name: vault
           vault-binary-name: vault
           vault-edition: ce
           vault-version: ${{ inputs.vault-version }}
@@ -119,7 +119,26 @@ jobs:
       # Outputs are strings so we need to encode our collection outputs as JSON.
       testable-containers: |
         [
-          { "artifact": "${{ github.event.repository.name }}_default_linux_amd64_${{ inputs.vault-version }}_${{ inputs.vault-revision }}.docker.tar" }
+          {
+            "sample": "ce_default_linux_amd64_ent_docker",
+            "artifact": "vault_default_linux_amd64_${{ inputs.vault-version }}_${{ inputs.vault-revision }}.docker.tar",
+            "edition": "ce"
+          },
+          {
+            "sample": "ce_default_linux_arm64_ce_docker",
+            "artifact": "vault_default_linux_arm64_${{ inputs.vault-version }}_${{ inputs.vault-revision }}.docker.tar",
+            "edition": "ce"
+          },
+          {
+            "sample": "ce_ubi_linux_amd64_ce_redhat",
+            "artifact": "vault_ubi_linux_amd64_${{ inputs.vault-version}}_${{ inputs.vault-revision }}.docker.redhat.tar",
+            "edition": "ce"
+          },
+          {
+            "sample": "ce_ubi_linux_arm64_ce_redhat",
+            "artifact": "vault_ubi_linux_arm64_${{ inputs.vault-version}}_${{ inputs.vault-revision }}.docker.redhat.tar",
+            "edition": "ce"
+          }
         ]
       testable-packages: |
         [
@@ -200,7 +219,7 @@ jobs:
     name: (${{ matrix.goos }}, ${{ matrix.goarch }}${{ matrix.goarm && ' ' || '' }}${{ matrix.goarm }})
     runs-on: ${{ fromJSON(inputs.compute-build) }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.checkout-ref }}
       - uses: ./.github/actions/build-vault
@@ -228,7 +247,7 @@ jobs:
       - core
       - extended
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.checkout-ref }}
       - name: Determine status
diff --git a/.github/workflows/build-artifacts-ent.yml b/.github/workflows/build-artifacts-ent.yml
new file mode 100644
index 00000000000..f5df288f266
--- /dev/null
+++ b/.github/workflows/build-artifacts-ent.yml
@@ -0,0 +1,47 @@
+name: ent
+
+# This is a CE shim to allow the build.yml workflow to compile on CE.
+
+on:
+  workflow_call:
+    inputs:
+      build-all:
+        type: boolean
+        default: false
+      build-date:
+        type: string
+        required: true
+      checkout-ref:
+        type: string
+        default: ""
+      compute-build:
+        type: string # JSON encoded to support passing arrays
+        description: A JSON encoded "runs-on" for build worfkflows
+        required: true
+      compute-small:
+        type: string # JSON encoded to support passing arrays
+        description: A JSON encoded "runs-on" for non-resource-intensive workflows
+        required: true
+      vault-revision:
+        type: string
+        required: true
+      vault-version:
+        type: string
+        required: true
+      vault-version-package:
+        type: string
+        required: true
+      web-ui-cache-key:
+        type: string
+        required: true
+    outputs:
+      testable-containers:
+        value: '"[]"'
+      testable-packages:
+        value: '"[]"'
+
+jobs:
+  shim:
+    runs-on: ubuntu-latest
+    steps:
+      - run: exit 0
diff --git a/.github/workflows/build-hcp-image.yml b/.github/workflows/build-hcp-image.yml
new file mode 100644
index 00000000000..1dc4b4a606a
--- /dev/null
+++ b/.github/workflows/build-hcp-image.yml
@@ -0,0 +1,24 @@
+name: build-hcp-image
+
+on:
+  workflow_call:
+    inputs:
+      pull-request:
+        type: number
+      create-azure-image:
+        type: boolean
+      create-aws-image:
+        type: boolean
+      hcp-environment:
+        type: string
+    outputs:
+      artifact:
+        value: shim
+      image:
+        value: shim
+
+jobs:
+  create-image:
+    runs-on: ubuntu-latest
+    steps:
+      - run: exit 0
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1747163473a..c6497971c48 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,6 +62,7 @@ on:
     branches:
       - main
       - release/**
+      - ce/**
   schedule:
     - cron: '05 02 * * *' # * is a special character in YAML so you have to quote this string
 
@@ -82,21 +83,20 @@ jobs:
       github.event_name == 'push' ||
       github.event_name == 'schedule' ||
       (github.event_name == 'pull_request' && github.event.pull_request.draft == false)
-    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","small"]') }}
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
+    permissions: write-all # vault-auth
     outputs:
-      app-changed: ${{ steps.changed-files.outputs.app-changed }}
       build-date: ${{ steps.metadata.outputs.vault-build-date }}
+      changed-files: ${{ steps.changed-files.outputs.changed-files }}
       checkout-ref: ${{ steps.checkout.outputs.ref }}
       compute-build: ${{ steps.metadata.outputs.compute-build }}
-      compute-build-compat: ${{ steps.metadata.outputs.compute-build-compat }}
       compute-build-ui: ${{ steps.metadata.outputs.compute-build-ui }}
       compute-small: ${{ steps.metadata.outputs.compute-small }}
-      docs-changed: ${{ steps.changed-files.outputs.docs-changed }}
       is-draft: ${{ steps.metadata.outputs.is-draft }}
-      is-enterprise: ${{ steps.metadata.outputs.is-enterprise }}
+      is-ent-branch: ${{ steps.metadata.outputs.is-ent-branch }}
+      is-ent-repo: ${{ steps.metadata.outputs.is-ent-repo }}
       is-fork: ${{ steps.metadata.outputs.is-fork }}
       labels: ${{ steps.metadata.outputs.labels }}
-      ui-changed: ${{ steps.changed-files.outputs.ui-changed }}
       vault-binary-name: ${{ steps.metadata.outputs.vault-binary-name }}
       vault-revision: ${{ steps.metadata.outputs.vault-revision }}
       vault-version: ${{ steps.metadata.outputs.vault-version }}
@@ -104,14 +104,12 @@ jobs:
       vault-version-package: ${{ steps.metadata.outputs.vault-version-package }}
       workflow-trigger: ${{ steps.metadata.outputs.workflow-trigger }}
     steps:
-      # Run the changed-files action to determine what Git reference we should check out
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: ./.github/actions/changed-files
-        id: changed-files
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      # Make sure we check out correct ref based on PR labels and such
       - uses: ./.github/actions/checkout
-        id: checkout # Make sure we check out correct ref after checking changed files
+        id: checkout
       # Get the vault version metadata
-      - uses: hashicorp/actions-set-product-version@v1
+      - uses: hashicorp/actions-set-product-version@2ec1b51402b3070bccf7ca95306afbd039e574ff # v2.0.1
         id: set-product-version
         with:
           checkout: false # don't override the reference we've checked out
@@ -120,12 +118,56 @@ jobs:
         id: metadata
         with:
           vault-version: ${{ steps.set-product-version.outputs.product-version }}
+      # Get the elevated github token
+      - if: steps.metadata.outputs.is-ent-repo == 'true'
+        id: vault-auth
+        name: Vault Authenticate
+        run: vault-auth
+      - if: steps.metadata.outputs.is-ent-repo == 'true'
+        id: vault-secrets
+        name: Fetch Vault Secrets
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
+        with:
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+            kv/data/github/${{ github.repository }}/github-token token | ELEVATED_GITHUB_TOKEN;
+      # Determine the changed files
+      - uses: ./.github/actions/changed-files
+        id: changed-files
+        with:
+          github-token: ${{ steps.metadata.outputs.is-ent-repo != 'true' && secrets.ELEVATED_GITHUB_TOKEN || steps.vault-secrets.outputs.ELEVATED_GITHUB_TOKEN }}
+      # Ensure that we have not changed any enterprise files on pull requests against ce/* branches.
+      # We do this here because we have the information, there's absolutely no reason to go
+      # further until we've resolved the issue, and we want to fail a required workflow if this
+      # issue is present.
+      - if: |
+          steps.metadata.outputs.is-ent-repo == 'true' &&
+          steps.metadata.outputs.workflow-trigger == 'pull_request' &&
+          startsWith(github.event.pull_request.base.ref, 'ce/') &&
+          contains(fromJSON(steps.changed-files.outputs.changed-files).groups, 'enterprise')
+        name: Ensure that we have not changed any enterprise files on pull requests against ce/* branches.
+        run: |
+          echo "The pull request has changed files that are in enterprise groups!"
+          echo "If you believe this to be in error you will want to update the changed files checks in tools/pipeline/internal/pkg/changed"
+          echo "on our enterprise branches and backport them to ce/* before continuing with this pull request."
+          echo "See the 'changed-files' step above for a list of changed files and their associated metadata groups."
+          exit 1
+      # Make sure all required Go modules are cached at this point. We don't want all of the Go
+      # tests and build jobs to download modules and race to upload them to the cache.
       - uses: ./.github/actions/set-up-go
-        # Make sure all required Go modules are cached at this point. We don't want all of the Go
-        # tests and build jobs to download modules and race to upload them to the cache.
         name: Ensure Go modules are cached
         with:
-          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          github-token: ${{ steps.metadata.outputs.is-ent-repo != 'true' && secrets.ELEVATED_GITHUB_TOKEN || steps.vault-secrets.outputs.ELEVATED_GITHUB_TOKEN }}
+          # Don't download them on a cache hit during setup, just make sure they're cached before
+          # subsequent workflows are run.
+          no-restore: true
+      # Make sure all required vault tools are cached at this point. We don't want all of the Go
+      # tests and build jobs to build the tools and race to upload them to the cache.
+      - uses: ./.github/actions/install-tools
+        name: Ensure Vault tools are cached
+        with:
           # Don't download them on a cache hit during setup, just make sure they're cached before
           # subsequent workflows are run.
           no-restore: true
@@ -142,6 +184,7 @@ jobs:
     #     a merge
     #   * The workflow was triggered by a pull request, the pull request is not a draft, and the UI
     #     or app changed.
+    #   * Our pipeline or test scenarios changed.
     if: |
       needs.setup.outputs.workflow-trigger == 'push' ||
       needs.setup.outputs.workflow-trigger == 'schedule' ||
@@ -150,8 +193,11 @@ jobs:
         needs.setup.outputs.workflow-trigger == 'pull_request' &&
         needs.setup.outputs.is-draft == 'false' &&
         (
-          needs.setup.outputs.ui-changed == 'true' ||
-          needs.setup.outputs.app-changed == 'true'
+          contains(fromJSON(needs.setup.outputs.changed-files).groups, 'ui') ||
+          contains(fromJSON(needs.setup.outputs.changed-files).groups, 'gotoolchain') ||
+          contains(fromJSON(needs.setup.outputs.changed-files).groups, 'pipeline') ||
+          contains(fromJSON(needs.setup.outputs.changed-files).groups, 'enos') ||
+          contains(fromJSON(needs.setup.outputs.changed-files).groups, 'app')
         )
       )
     needs: setup
@@ -159,7 +205,7 @@ jobs:
     outputs:
       cache-key: ui-${{ steps.ui-hash.outputs.ui-hash }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ needs.setup.outputs.checkout-ref }}
       - name: Get UI hash
@@ -167,7 +213,7 @@ jobs:
         run: echo "ui-hash=$(git ls-tree HEAD ui --object-only)" | tee -a "$GITHUB_OUTPUT"
       - name: Set up UI asset cache
         id: cache-ui-assets
-        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           enableCrossOsArchive: true
           lookup-only: true
@@ -177,7 +223,7 @@ jobs:
           key: ui-${{ steps.ui-hash.outputs.ui-hash }}
       - if: steps.cache-ui-assets.outputs.cache-hit != 'true'
         name: Set up node and yarn
-        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: ui/package.json
           cache: yarn
@@ -186,35 +232,63 @@ jobs:
         name: Build UI
         run: make ci-build-ui
 
-  artifacts:
-    # Artifacts is where we'll build the various Vault binaries and package them into their respective
-    # Zip bundles, RPM and Deb packages, and container images. After we've packaged them we upload
-    # them to the Github Actions artifacts storage and execute our Enos test scenarios. If the
-    # workflow is triggered by a push to main CRT will take these artifacts from Github and perform
-    # all of the necessary notarizing and signing before uploading them to Artifactory.
-    #
-    #   # Trigger the setup workflow if any of the following conditions are true:
-    #
-    #   * The workflow was triggered by on schedule to test building all artifacts.
-    #   * The Go app was changed.
-    #   * The build/all label is present on a pull request or push.
+  # Artifacts is where we'll build the various Vault binaries and package them into their respective
+  # Zip bundles, RPM and Deb packages, and container images. After we've packaged them we upload
+  # them to the Github Actions artifacts storage and execute our Enos test scenarios. If the
+  # workflow is triggered by a push to main CRT will take these artifacts from Github and perform
+  # all of the necessary notarizing and signing before uploading them to Artifactory.
+  #
+  #   # Trigger the setup workflow if any of the following conditions are true:
+  #
+  #   * The workflow was triggered by on schedule to test building all artifacts.
+  #   * The Go app was changed.
+  #   * Our pipeline or test scenarios changed.
+  #   * The build/all label is present on a pull request or push.
+  artifacts-ce:
     if: |
-      needs.setup.outputs.workflow-trigger == 'schedule' ||
-      needs.setup.outputs.app-changed == 'true' ||
-      contains(fromJSON(needs.setup.outputs.labels), 'build/all')
+      needs.setup.outputs.is-ent-branch != 'true' && (
+        needs.setup.outputs.workflow-trigger == 'schedule' ||
+        contains(fromJSON(needs.setup.outputs.changed-files).groups, 'app') ||
+        contains(fromJSON(needs.setup.outputs.changed-files).groups, 'gotoolchain') ||
+        contains(fromJSON(needs.setup.outputs.changed-files).groups, 'pipeline') ||
+        contains(fromJSON(needs.setup.outputs.changed-files).groups, 'enos') ||
+        contains(fromJSON(needs.setup.outputs.labels), 'build/all')
+      )
+    needs:
+      - setup
+      - ui # Don't build and test artifacts unless the UI build was triggered.
+    uses: ./.github/workflows/build-artifacts-ce.yml
+    with:
+      build-all: ${{contains(fromJSON(needs.setup.outputs.labels), 'build/all') || needs.setup.outputs.workflow-trigger == 'schedule' || contains(fromJSON(needs.setup.outputs.changed-files).groups, 'gotoolchain')}}
+      build-date: ${{ needs.setup.outputs.build-date }}
+      checkout-ref: ${{ needs.setup.outputs.checkout-ref }}
+      compute-build: ${{ needs.setup.outputs.compute-build }}
+      compute-small: ${{ needs.setup.outputs.compute-small }}
+      vault-revision: ${{ needs.setup.outputs.vault-revision }}
+      vault-version: ${{ needs.setup.outputs.vault-version }}
+      vault-version-package: ${{ needs.setup.outputs.vault-version-package }}
+      web-ui-cache-key: ${{ needs.ui.outputs.cache-key }}
+    secrets: inherit
+
+  artifacts-ent:
+    if: |
+      needs.setup.outputs.is-ent-branch == 'true' && (
+        needs.setup.outputs.workflow-trigger == 'schedule' ||
+        contains(fromJSON(needs.setup.outputs.changed-files).groups, 'app') ||
+        contains(fromJSON(needs.setup.outputs.changed-files).groups, 'gotoolchain') ||
+        contains(fromJSON(needs.setup.outputs.changed-files).groups, 'pipeline') ||
+        contains(fromJSON(needs.setup.outputs.changed-files).groups, 'enos') ||
+        contains(fromJSON(needs.setup.outputs.labels), 'build/all')
+      )
     needs:
       - setup
       - ui # Don't build and test artifacts unless the UI build was triggered.
-    # The following is the only line that should be different between CE and Ent.
-    uses: ./.github/workflows/build-artifacts-ce.yml # Make sure we use the correct workflow.
+    uses: ./.github/workflows/build-artifacts-ent.yml
     with:
-      # The inputs defined here must be supported in both the build-artifacts-ce and
-      # build-artifacts-ent workflows. The implementations should seek to keep a compatible interface.
-      build-all: ${{ contains(fromJSON(needs.setup.outputs.labels), 'build/all') || needs.setup.outputs.workflow-trigger == 'schedule' }}
+      build-all: ${{contains(fromJSON(needs.setup.outputs.labels), 'build/all') || needs.setup.outputs.workflow-trigger == 'schedule' || contains(fromJSON(needs.setup.outputs.changed-files).groups, 'gotoolchain')}}
       build-date: ${{ needs.setup.outputs.build-date }}
       checkout-ref: ${{ needs.setup.outputs.checkout-ref }}
       compute-build: ${{ needs.setup.outputs.compute-build }}
-      compute-build-compat: ${{ needs.setup.outputs.compute-build-compat }}
       compute-small: ${{ needs.setup.outputs.compute-small }}
       vault-revision: ${{ needs.setup.outputs.vault-revision }}
       vault-version: ${{ needs.setup.outputs.vault-version }}
@@ -222,22 +296,45 @@ jobs:
       web-ui-cache-key: ${{ needs.ui.outputs.cache-key }}
     secrets: inherit
 
+  hcp-image:
+    if: |
+      needs.setup.outputs.is-ent-branch == 'true' &&
+      needs.setup.outputs.workflow-trigger == 'pull_request' &&
+      (
+        contains(fromJSON(needs.setup.outputs.labels), 'hcp/build-image') ||
+        contains(fromJSON(needs.setup.outputs.labels), 'hcp/test')
+      )
+    needs:
+      - setup
+      - artifacts-ent
+    uses: ./.github/workflows/build-hcp-image.yml
+    with:
+      pull-request: ${{ github.event.pull_request.number }}
+      create-aws-image: true
+      create-azure-image: false
+      hcp-environment: int
+
   test:
     # Test all of the testable artifacts if our repo isn't a fork. We don't test when the PR is
     # created from a fork because secrets are not passed in and they are required.
-    if: ${{ needs.setup.outputs.is-fork == 'false' }}
+    if: |
+      always() &&
+      needs.setup.outputs.is-fork == 'false' &&
+      ( needs.artifacts-ce.result == 'success' || needs.artifacts-ent.result == 'success' )
     name: test ${{ matrix.artifact }}
     needs:
       - setup
       - ui
-      - artifacts
+      - artifacts-ce
+      - artifacts-ent
     uses: ./.github/workflows/test-run-enos-scenario-matrix.yml
     strategy:
       fail-fast: false
       matrix:
-        include: ${{ fromJSON(needs.artifacts.outputs.testable-packages) }}
+        include: ${{ needs.setup.outputs.is-ent-branch == 'true' && fromJSON(needs.artifacts-ent.outputs.testable-packages) || fromJSON(needs.artifacts-ce.outputs.testable-packages) }}
     with:
       build-artifact-name: ${{ matrix.artifact }}
+      runs-on: ${{ github.repository == 'hashicorp/vault' && '"ubuntu-latest"' || '["self-hosted","ubuntu-latest-x64"]' }}
       sample-max: 1
       sample-name: ${{ matrix.sample }}
       ssh-key-name: ${{ github.event.repository.name }}-ci-ssh-key
@@ -249,24 +346,47 @@ jobs:
   test-containers:
     # Test all of the testable containers if our repo isn't a fork. We don't test when the PR is
     # created from a fork because secrets are not passed in and they are required (for now).
-    if: ${{ needs.setup.outputs.is-fork == 'false' }}
+    if: |
+      always() &&
+      needs.setup.outputs.is-fork == 'false' &&
+      ( needs.artifacts-ce.result == 'success' || needs.artifacts-ent.result == 'success' )
     name: test ${{ matrix.artifact }}
     needs:
       - setup
       - ui
-      - artifacts
-    uses: ./.github/workflows/enos-run-k8s.yml
+      - artifacts-ce
+      - artifacts-ent
+    uses: ./.github/workflows/test-run-enos-scenario-containers.yml
     strategy:
       fail-fast: false
       matrix:
-        include: ${{ fromJSON(needs.artifacts.outputs.testable-containers) }}
+        include: ${{ needs.setup.outputs.is-ent-branch == 'true' && fromJSON(needs.artifacts-ent.outputs.testable-containers) || fromJSON(needs.artifacts-ce.outputs.testable-containers) }}
     with:
-      artifact-build-date: ${{ needs.setup.outputs.build-date }}
-      artifact-name: ${{ matrix.artifact }}
-      artifact-revision: ${{ needs.setup.outputs.vault-revision }}
-      artifact-version: ${{ needs.setup.outputs.vault-version-metadata }}
+      build-artifact-name: ${{ matrix.artifact }}
+      sample-max: 1
+      sample-name: ${{ matrix.sample }}
+      vault-edition: ${{ matrix.edition }}
+      vault-revision: ${{ needs.setup.outputs.vault-revision }}
+      vault-version: ${{ needs.setup.outputs.vault-version-metadata }}
     secrets: inherit
 
+  test-hcp-image:
+    # Test our custom HCP image if our image build was successful and we've
+    # been configured with the correct label.
+    if: |
+      needs.setup.outputs.is-ent-branch == 'true' &&
+      needs.setup.outputs.workflow-trigger == 'pull_request' &&
+      needs.artifacts-ent.result == 'success' &&
+      needs.hcp-image.result == 'success' &&
+      contains(fromJSON(needs.setup.outputs.labels), 'hcp/test')
+    needs:
+      - setup
+      - artifacts-ent
+      - hcp-image
+    uses: ./.github/workflows/test-run-enos-scenario-cloud.yml
+    with:
+      product-version: ${{ fromJSON(needs.hcp-image.outputs.image).product_version }}
+
   completed-successfully:
     # build/completed-successfully is the only build workflow that must pass in order to merge
     # a pull request. This workflow is used to determine the overall status of all the prior
@@ -282,16 +402,32 @@ jobs:
         github.event_name == 'schedule' ||
         (github.event_name == 'pull_request' && github.event.pull_request.draft == false)
       )
-    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","small"]') }}
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     permissions: write-all # Ensure we have id-token:write access for vault-auth.
     needs:
       - setup
       - ui
-      - artifacts
+      - artifacts-ce
+      - artifacts-ent
+      - hcp-image
       - test
       - test-containers
+      - test-hcp-image
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - id: disallow-merge-on-ce
+        if: |
+          needs.setup.outputs.workflow-trigger == 'pull_request' &&
+          github.repository == 'hashicorp/vault' &&
+          ! contains(fromJSON(needs.setup.outputs.labels), 'build/all') &&
+          ( github.event.pull_request.base.ref == 'main' || startsWith(github.event.pull_request.base.ref, 'release/') )
+        run: |
+          echo '::error::Merging into main and release/* branches in hashicorp/vault is disallowed. Use the copy-external-contributor workflow to copy and merge the change via hashicorp/vault-enterprise'
+          {
+            echo "result=failed"
+            echo "results=failed"
+          } | tee -a "$GITHUB_OUTPUT"
+          exit 1
       - id: status
         name: Determine status
         run: |
@@ -305,27 +441,30 @@ jobs:
             echo "result=${result}"
             echo "results=${results}"
           } | tee -a "$GITHUB_OUTPUT"
-      - if: needs.setup.outputs.is-enterprise == 'true'
+      - if: needs.setup.outputs.is-ent-repo == 'true'
         id: vault-auth
         name: Vault Authenticate
         run: vault-auth
-      - if: needs.setup.outputs.is-enterprise == 'true'
+      - if: needs.setup.outputs.is-ent-repo == 'true'
         id: secrets
         name: Fetch Vault Secrets
-        uses: hashicorp/vault-action@9f522b85981b491eab9a52c144d15aedbd0bf371 # v2.8.0
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
         with:
           url: ${{ steps.vault-auth.outputs.addr }}
           caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
           token: ${{ steps.vault-auth.outputs.token }}
           secrets: |
-            kv/data/github/${{ github.repository }}/github_actions_notifications_bot token | SLACK_BOT_TOKEN;
-      - id: slackbot-token
+            kv/data/github/${{ github.repository }}/slack feed-vault-ci-official-webhook-url | slack-webhook-url;
+      - id: slackbot-webhook-url
         run:
-          echo "slackbot-token=${{ needs.setup.outputs.is-enterprise != 'true' && secrets.SLACK_BOT_TOKEN || steps.secrets.outputs.SLACK_BOT_TOKEN }}" >> "$GITHUB_OUTPUT"
-      - if: needs.setup.outputs.workflow-trigger == 'pull_request'
+          echo "slackbot-webhook-url=${{ needs.setup.outputs.is-ent-repo != 'true' && secrets.FEED_VAULT_CI_OFFICIAL_WEBHOOK_URL || steps.secrets.outputs.slackbot-webhook-url }}" >> "$GITHUB_OUTPUT"
+      - if: |
+          needs.setup.outputs.workflow-trigger == 'pull_request' &&
+          github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name &&
+          (github.repository == 'hashicorp/vault' || github.repository == 'hashicorp/vault-enterprise')
         name: Create or update a build status comment on the pull request
         env:
-          ARTIFACTS: ${{ needs.artifacts.result }}
+          ARTIFACTS: ${{ needs.setup.outputs.is-ent-branch == 'true' && needs.artifacts-ent.result || needs.artifacts-ce.result }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO: ${{ github.event.repository.name }}
@@ -339,58 +478,54 @@ jobs:
           always() &&
           steps.status.outputs.result != 'success' &&
           (github.ref_name == 'main' || startsWith(github.ref_name, 'release/'))
-        uses: slackapi/slack-github-action@6c661ce58804a1a20f6dc5fbee7f0381b469e001 # v1.25.0
-        # We intentionally aren't using the following here since it's from an internal repo
-        # uses: hashicorp/cloud-gha-slack-notifier@730a033037b8e603adf99ebd3085f0fdfe75e2f4 #v1
-        env:
-          SLACK_BOT_TOKEN: ${{ steps.slackbot-token.outputs.slackbot-token }}
+        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
         with:
-          channel-id: "C05AABYEA9Y" # Notify #feed-vault-ci-official
-          # channel-id: "C05Q4D5V89W" # Notify #test-vault-ci-slack-integration
+          errors: true # exit with an error if the payload is invalid
+          retries: rapid # retry if we're being rated limited
+          webhook: ${{ steps.slackbot-webhook-url.outputs.slackbot-webhook-url }}
+          webhook-type: incoming-webhook
           payload: |
-            {
-              "text": "${{ github.repository }} build failures on ${{ github.ref_name }}",
-              "blocks": [
-                {
-                  "type": "header",
-                  "text": {
-                    "type": "plain_text",
-                    "text": ":rotating_light: ${{ github.repository }} build failures on ${{ github.ref_name }} :rotating_light:",
-                    "emoji": true
-                  }
-                },
-                {
-                  "type": "divider"
-                },
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "${{ needs.setup.result != 'failure' && ':white_check_mark:' || ':x:' }} Setup\n${{ needs.ui.result != 'failure' && ':white_check_mark:' || ':x:' }} Build UI\n${{ needs.artifacts.result != 'failure' && ':white_check_mark:' || ':x:' }} Build Vault Artifacts\n${{ needs.test.result != 'failure' && ':white_check_mark:' || ':x:' }} Enos package test scenarios\n${{ needs.test-containers.result != 'failure' && ':white_check_mark:' || ':x:' }} Enos container test scenarios"
-                  },
-                  "accessory": {
-                    "type": "button",
-                    "text": {
-                      "type": "plain_text",
-                      "text": "View Failing Workflow",
-                      "emoji": true
-                    },
-                    "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-                  }
-                }
-              ]
-            }
-      - uses: hashicorp/actions-generate-metadata@v1
+            text: ${{ needs.setup.outputs.is-ent-branch == 'true' && 'vault-enterprise' || 'vault' }} build failures on ${{ github.ref_name }}
+            blocks:
+              - type: header
+                text:
+                  type: plain_text
+                  text: :rotating_light: ${{ needs.setup.outputs.is-ent-branch == 'true' && 'vault-enterprise' || 'vault' }} build failures on ${{ github.ref_name }} :rotating_light:
+                  emoji: true
+              - type: divider
+              - type: section
+                text:
+                  type: mrkdwn
+                  text: |
+                    ${{ needs.setup.result != 'failure' && ':white_check_mark:' || ':x:' }} Setup
+                    ${{ needs.ui.result != 'failure' && ':white_check_mark:' || ':x:' }} Build UI
+                    ${{ (needs.artifacts-ent.result != 'failure' && needs.artifacts-ce.result != 'failure') && ':white_check_mark:' || ':x:' }} Build Vault Artifacts
+                    ${{ needs.test.result != 'failure' && ':white_check_mark:' || ':x:' }} Enos package test scenarios
+                    ${{ needs.test-containers.result != 'failure' && ':white_check_mark:' || ':x:' }} Enos container test scenarios
+                accessory:
+                  type: button
+                  text:
+                    type: plain_text
+                    text: View Failing Workflow
+                    emoji: true
+                  url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+      - uses: hashicorp/actions-generate-metadata@f1d852525201cb7bbbf031dd2e985fb4c22307fc # v1.1.3
+        # create build metadata if we successfully created artifacts
+        if: needs.artifacts-ent.result == 'success' || needs.artifacts-ce.result == 'success'
         id: generate-metadata-file
         with:
           version: ${{ needs.setup.outputs.vault-version-metadata }}
           product: ${{ needs.setup.outputs.vault-binary-name }}
-      # Use actions/upload-artifact @3.x until https://hashicorp.atlassian.net/browse/HREL-99 is resolved
-      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: steps.generate-metadata-file.outcome == 'success' # upload our metadata if we created it
         with:
           name: metadata.json
           path: ${{ steps.generate-metadata-file.outputs.filepath }}
           if-no-files-found: error
+      - if: needs.setup.outputs.is-ent-branch == 'true' && needs.artifacts-ent.result == 'success'
+        id: generate-pao-metadata
+        uses: hashicorp-forge/actions-pao-tool/collect@6997f7457c338e008506005cc370e7b02f7fb421 # v1.0.3
       - if: always() && steps.status.outputs.result != 'success'
         name: Check for failed status
         run: |
diff --git a/.github/workflows/changelog-checker.yml b/.github/workflows/changelog-checker.yml
index feb8c861da1..f42e6db51a9 100644
--- a/.github/workflows/changelog-checker.yml
+++ b/.github/workflows/changelog-checker.yml
@@ -15,20 +15,21 @@ jobs:
   changelog-check:
     # If there  a `pr/no-changelog` label we ignore this check
     if: "!contains(github.event.pull_request.labels.*.name, 'pr/no-changelog')"
-    runs-on: ubuntu-latest
-
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0 # by default the checkout action doesn't checkout all branches
+      - uses: ./.github/actions/metadata
+        id: metadata
       - name: Check for changelog entry in diff
         run: |
           # Check if there is a diff in the changelog directory.
           #
           # Try to identify the expected changelog file name based on PR
           # number. This won't work for Go version updates though.
-          if [ ${{ github.event.repository.name }} == "vault-enterprise" ]; then
+          if [[ '${{ steps.metadata.outputs.is-ent-branch }}' == 'true' ]]; then
             expected_changelog_file=changelog/_${{ github.event.pull_request.number }}.txt
           else
             expected_changelog_file=changelog/${{ github.event.pull_request.number }}.txt
@@ -48,8 +49,8 @@ jobs:
               echo "Not found."
               echo ""
               echo "Did not find a changelog entry named ${expected_changelog_file}"
-              echo "If your changelog file is correct, skip this check with the 'pr/no-changelog' label"
-              echo "Reference - https://github.com/hashicorp/vault/pull/10363 and https://github.com/hashicorp/vault/pull/11894"
+              echo "If your changelog file is correct, or this change does not need a changelog, skip this check with the 'pr/no-changelog' label"
+              echo "Reference - https://github.com/hashicorp/vault/blob/main/CONTRIBUTING.md#changelog-entries"
               exit 1
             fi
 
@@ -76,6 +77,12 @@ jobs:
           elif grep -q ':fix$' "$changelog_files"; then
             echo "Found invalid type (fix) in changelog - did you mean bug?"
             exit 1
+          elif grep -q ':feature$' "$changelog_files"; then
+            if ! grep -q '^\*\*' "$changelog_files"; then
+              echo "Feature changelogs must be formatted like the following:"
+              echo "**Feature Name**: Feature description"
+              exit 1
+            fi
           elif ! grep -q '```release-note:' "$changelog_files"; then
             # People often make changelog files like ```changelog:, which is incorrect.
             echo "Changelog file did not contain 'release-note' heading - check formatting."
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5bf355a4aad..d03968cda39 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,11 +5,16 @@ on:
     # for our needs, since we're skipping stuff on PRs in draft mode.By adding the ready_for_review
     # type, when a draft pr is marked ready, we run everything, including the stuff we'd have
     # skipped up until now.
-    types: [opened, synchronize, reopened, ready_for_review]
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
   push:
     branches:
       - main
       - release/**
+      - ce/**
   workflow_dispatch:
 
 concurrency:
@@ -18,37 +23,140 @@ concurrency:
 
 jobs:
   setup:
-    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","small"]') }}
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
+    permissions: write-all # vault-auth
     outputs:
-      app-changed: ${{ steps.changed-files.outputs.app-changed }}
+      changed-files: ${{ steps.changed-files.outputs.changed-files }}
       checkout-ref: ${{ steps.checkout.outputs.ref }}
       compute-small: ${{ steps.metadata.outputs.compute-small }}
       compute-test-go: ${{ steps.metadata.outputs.compute-test-go }}
       compute-test-ui: ${{ steps.metadata.outputs.compute-test-ui }}
       go-tags: ${{ steps.metadata.outputs.go-tags }}
       is-draft: ${{ steps.metadata.outputs.is-draft }}
-      is-enterprise: ${{ steps.metadata.outputs.is-enterprise }}
+      is-ent-branch: ${{ steps.metadata.outputs.is-ent-branch }}
+      is-ent-repo: ${{ steps.metadata.outputs.is-ent-repo }}
       is-fork: ${{ steps.metadata.outputs.is-fork }}
       labels: ${{ steps.metadata.outputs.labels }}
-      ui-changed: ${{ steps.changed-files.outputs.ui-changed }}
       workflow-trigger: ${{ steps.metadata.outputs.workflow-trigger }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: ./.github/actions/changed-files
-        id: changed-files
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      # Make sure we check out correct ref based on PR labels and such
       - uses: ./.github/actions/checkout
-        id: checkout # make sure we check out correct ref after checking changed files
+        id: checkout
       - uses: ./.github/actions/metadata
         id: metadata
+      # Get the elevated github token
+      - if: steps.metadata.outputs.is-ent-repo == 'true'
+        id: vault-auth
+        name: Vault Authenticate
+        run: vault-auth
+      - if: steps.metadata.outputs.is-ent-repo == 'true'
+        id: vault-secrets
+        name: Fetch Vault Secrets
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
+        with:
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+            kv/data/github/${{ github.repository }}/github-token token | ELEVATED_GITHUB_TOKEN;
+      # Determine the changed files
+      - uses: ./.github/actions/changed-files
+        id: changed-files
+        with:
+          github-token: ${{ steps.metadata.outputs.is-ent-repo != 'true' && secrets.ELEVATED_GITHUB_TOKEN || steps.vault-secrets.outputs.ELEVATED_GITHUB_TOKEN }}
       - name: Ensure Go modules are cached
         uses: ./.github/actions/set-up-go
         with:
-          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          github-token: ${{ steps.metadata.outputs.is-ent-repo != 'true' && secrets.ELEVATED_GITHUB_TOKEN || steps.vault-secrets.outputs.ELEVATED_GITHUB_TOKEN }}
           no-restore: true # don't download them on a cache hit
+      # Make sure all required vault tools are cached at this point. We don't want all of the Go
+      # tests and build jobs to build the tools and race to upload them to the cache.
+      - uses: ./.github/actions/install-tools
+        name: Ensure Vault tools are cached
+        with:
+          # Don't download them on a cache hit during setup, just make sure they're cached before
+          # subsequent workflows are run.
+          no-restore: true
+
+  test-autopilot-upgrade:
+    name: Run Autopilot upgrade tool
+    # Run the Autopilot upgrade tests if:
+    # - The Autopilot code has changed.
+    # - We're in the context of the vault enterprise repository and enterprise branch.
+    # - The workflow was triggered by a push to main or a PR targeting main.
+    #
+    # The reason for the main branch restriction, is that the logic for automatically determining the source versions
+    # to test depends on the .release/versions.hcl file, which might not be up-to-date nor exist outside of main.
+    # If you'd like to run the autopilot tests for a specific git checkout or set of source versions,
+    # you can manually trigger the workflow, see the .github/workflows/run-apupgrade-tests-ent.yml file in the ENT repo.
+    if: |
+      contains(fromJSON(needs.setup.outputs.changed-files).groups, 'autopilot') &&
+      needs.setup.outputs.is-ent-branch == 'true' &&
+      (github.base_ref == 'main' || github.ref == 'refs/heads/main')
+    needs: setup
+    permissions:
+      id-token: write
+      contents: read
+    runs-on: ${{ fromJSON(needs.setup.outputs.compute-small) }}
+    steps:
+      - name: Check out the .release/versions.hcl file from Vault Enterprise repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ needs.setup.outputs.checkout-ref }}
+          sparse-checkout: |
+            .release/versions.hcl
+            .github
+      - name: Get Vault versions to test
+        id: get-versions
+        env:
+          GH_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+        run: |
+          # Change to the Vault Enterprise repository directory or exit if it fails
+          cd "${GITHUB_WORKSPACE}" || exit 1
+
+          # Extract active major versions from the versions.hcl file, which is used for managing active release branches
+          active_major_versions=$(grep -Eo 'version\s+"[0-9]+\.[0-9]+\.x"' .release/versions.hcl | sed -E 's/version\s+"([0-9]+\.[0-9]+)\.x"/\1/')
+          active_major_versions=$(sort <<< "${active_major_versions}")
+
+          # List releases from the GitHub repository, process them with sed, and sort them in reverse order
+          releases=$(gh -R hashicorp/vault-enterprise release list --exclude-drafts --exclude-pre-releases --json=name --jq '.[].name' | \
+            sed -E 's/^v([0-9]+\.[0-9]+\.[0-9]+(\-rc[0-9]+)?)\+ent$/\1/' | \
+            sort -r)
+
+          # Initialize a variable to collect matched versions
+          matched_versions=""
+
+          # Read each version from the active major versions and match it against the newest release available
+          while IFS= read -r version; do
+            match=$(grep -m 1 "^${version}" <<< "${releases}" || true)
+            if [ -n "${match}" ]; then
+              if [ -n "${matched_versions}" ]; then
+                matched_versions+=","
+              fi
+              # Append the matched version to the variable, adding the +ent suffix, which is used for Vault Enterprise releases
+              matched_versions+="${match}+ent"
+            fi
+          done <<< "${active_major_versions}"
+
+          # Export the matched versions as a comma-separated string to an environment variable
+          echo "VAULT_SOURCE_VERSIONS=${matched_versions}" >> "${GITHUB_ENV}"
+      - name: Run Autopilot upgrade tests
+        uses: ./.github/actions/run-apupgrade-tests
+        env:
+          GOPATH: /home/runner/go
+          GOPRIVATE: github.com/hashicorp/*
+        with:
+          checkout-ref: ${{ needs.setup.outputs.checkout-ref }}
+          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          source-versions: ${{ env.VAULT_SOURCE_VERSIONS }}
 
   test-go:
     # Run Go tests if the vault app changed
-    if: needs.setup.outputs.app-changed == 'true'
+    if: |
+      contains(fromJSON(needs.setup.outputs.changed-files).groups, 'app') ||
+      contains(fromJSON(needs.setup.outputs.changed-files).groups, 'gotoolchain') ||
+      contains(fromJSON(needs.setup.outputs.changed-files).groups, 'pipeline')
     name: Run Go tests
     needs: setup
     uses: ./.github/workflows/test-go.yml
@@ -62,13 +170,15 @@ jobs:
       name: standard
       runs-on: ${{ needs.setup.outputs.compute-test-go }}
       runs-on-small: ${{ needs.setup.outputs.compute-small }}
-      test-timing-cache-key: go-test-timing-standard
+      test-timing-cache-key: go-test-timing-standard-${{ needs.setup.outputs.is-ent-branch && 'ent' || 'ce' }}
       total-runners: 16
     secrets: inherit
 
   test-go-testonly:
     # Run Go tests tagged with "testonly" if the vault app changed
-    if: needs.setup.outputs.app-changed == 'true'
+    if: |
+      contains(fromJSON(needs.setup.outputs.changed-files).groups, 'app') ||
+      contains(fromJSON(needs.setup.outputs.changed-files).groups, 'gotoolchain')
     name: Run Go tests tagged with testonly
     needs: setup
     uses: ./.github/workflows/test-go.yml
@@ -80,14 +190,20 @@ jobs:
       runs-on: ${{ needs.setup.outputs.compute-test-go }}
       runs-on-small: ${{ needs.setup.outputs.compute-small }}
       testonly: true
-      test-timing-cache-enabled: false
+      test-timing-cache-restore: false
+      test-timing-cache-save: false
       total-runners: 2 # test runners cannot be less than 2
     secrets: inherit
 
   test-go-race:
     # Run Go test with the data race detector enabled if the vault app changed and we're out of
     # drafts mode.
-    if: needs.setup.outputs.app-changed == 'true' && needs.setup.outputs.is-draft == 'false'
+    if: |
+      needs.setup.outputs.is-draft == 'false' &&
+        (
+          contains(fromJSON(needs.setup.outputs.changed-files).groups, 'app') ||
+          contains(fromJSON(needs.setup.outputs.changed-files).groups, 'gotoolchain')
+        )
     name: Run Go tests with data race detection
     needs: setup
     uses: ./.github/workflows/test-go.yml
@@ -103,7 +219,7 @@ jobs:
       go-tags: ${{ needs.setup.outputs.go-tags }}
       runs-on: ${{ needs.setup.outputs.compute-test-go }}
       runs-on-small: ${{ needs.setup.outputs.compute-small }}
-      test-timing-cache-key: go-test-timing-race
+      test-timing-cache-key: go-test-timing-race-${{ needs.setup.outputs.is-ent-branch && 'ent' || 'ce' }}
       total-runners: 16
     secrets: inherit
 
@@ -112,9 +228,11 @@ jobs:
     # Run the Go tests with fips if the vault app changed, we're in the context vault enterprise
     # and our trigger is a merge to main or releases/* or if the 'fips' label is present on a PR.
     if: |
-      needs.setup.outputs.app-changed == 'true' &&
-      needs.setup.outputs.is-enterprise == 'true' &&
-      (needs.setup.outputs.workflow-trigger == 'push' || contains(needs.setup.outputs.labels, 'fips'))
+      contains(fromJSON(needs.setup.outputs.changed-files).groups, 'app') &&
+      needs.setup.outputs.is-ent-branch == 'true' &&
+        (
+          needs.setup.outputs.workflow-trigger == 'push' || contains(needs.setup.outputs.labels, 'fips')
+        )
     needs: setup
     uses: ./.github/workflows/test-go.yml
     with:
@@ -125,7 +243,7 @@ jobs:
         }
       name: fips
       go-arch: amd64
-      go-tags: '${{ needs.setup.outputs.go-tags }},deadlock,cgo,fips,fips_140_2'
+      go-tags: '${{ needs.setup.outputs.go-tags }},deadlock,cgo,fips,fips_140_3'
       runs-on: ${{ needs.setup.outputs.compute-test-go }}
       runs-on-small: ${{ needs.setup.outputs.compute-small }}
       test-timing-cache-key: go-test-timing-fips
@@ -137,16 +255,16 @@ jobs:
     # Run the UI tests if our UI has changed, or a 'ui' label is present, or our workflow trigger
     # was triggered by a merge to main or releases/*.
     if: |
-      needs.setup.outputs.ui-changed == 'true' ||
+      contains(fromJSON(needs.setup.outputs.changed-files).groups, 'ui') ||
       needs.setup.outputs.workflow-trigger == 'push' ||
-      contains(github.event.pull_request.labels.*.name, 'ui')
+      contains(needs.setup.outputs.labels, 'ui')
     needs: setup
     permissions:
       id-token: write
       contents: read
     runs-on: ${{ fromJSON(needs.setup.outputs.compute-test-ui) }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         name: status
         with:
           ref: ${{ needs.setup.outputs.checkout-ref }}
@@ -154,30 +272,39 @@ jobs:
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       # Setup node.js without caching to allow running npm install -g yarn (next step)
-      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: './ui/package.json'
       - run: npm install -g yarn
       # Setup node.js with caching using the yarn.lock file
-      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: './ui/package.json'
           cache: yarn
           cache-dependency-path: ui/yarn.lock
-      - uses: browser-actions/setup-chrome@52f10de5479c69bcbbab2eab094c9d373148005e # v1.4.0
+      - uses: browser-actions/setup-chrome@b94431e051d1c52dcbe9a7092a4f10f827795416 # v2.1.0
+        with:
+          # Temporarily pin our Chrome version while we sort out a broken test on latest
+          chrome-version: 1314712
       - name: ui-dependencies
         working-directory: ./ui
         run: |
           yarn install --frozen-lockfile
           npm rebuild node-sass
-      - if: needs.setup.outputs.is-enterprise == 'true'
+      - if: needs.setup.outputs.is-ent-repo != 'true'
+        name: Rebuild font cache on Github hosted runner
+        # Fix `Fontconfig error: No writable cache directories` error on Github hosted runners
+        # This seems to have been introduced with this runner image: https://github.com/actions/runner-images/releases/tag/ubuntu22%2F20240818.1
+        # Hopefully this will resolve itself at some point with a newer image and we can remove it
+        run: fc-cache -f -v
+      - if: needs.setup.outputs.is-ent-repo == 'true'
         id: vault-auth
         name: Authenticate to Vault
         run: vault-auth
-      - if: needs.setup.outputs.is-enterprise == 'true'
+      - if: needs.setup.outputs.is-ent-repo == 'true'
         id: secrets
         name: Fetch secrets
-        uses: hashicorp/vault-action@9f522b85981b491eab9a52c144d15aedbd0bf371 # v2.8.0
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
         with:
           url: ${{ steps.vault-auth.outputs.addr }}
           caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
@@ -185,9 +312,11 @@ jobs:
           secrets: |
             kv/data/github/hashicorp/vault-enterprise/github-token username-and-token | PRIVATE_REPO_GITHUB_TOKEN;
             kv/data/github/hashicorp/vault-enterprise/license license_1 | VAULT_LICENSE;
-      - if: needs.setup.outputs.is-enterprise == 'true'
+            kv/data/github/${{ github.repository }}/datadog-ci DATADOG_API_KEY;
+      - if: needs.setup.outputs.is-ent-repo == 'true'
         name: Set up Git
         run: git config --global url."https://${{ steps.secrets.outputs.PRIVATE_REPO_GITHUB_TOKEN }}@github.com".insteadOf https://github.com
+      - uses: ./.github/actions/install-tools
       - name: build-go-dev
         run: |
           rm -rf ./pkg
@@ -201,14 +330,40 @@ jobs:
           # Run Ember tests
           cd ui
           mkdir -p test-results/qunit
-          yarn ${{ needs.setup.outputs.is-enterprise == 'true' && 'test' || 'test:oss' }}
+          yarn ${{ needs.setup.outputs.is-ent-branch == 'true' && 'test' || 'test:oss' }}
       - if: always()
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: test-results-ui
           path: ui/test-results
+      - name: Prepare datadog-ci
+        if: (github.repository == 'hashicorp/vault' || github.repository == 'hashicorp/vault-enterprise') && (success() || failure())
+        continue-on-error: true
+        run: |
+          if type datadog-ci > /dev/null 2>&1; then
+            exit 0
+          fi
+          # Curl does not always exit 1 if things go wrong. To determine if this is successful
+          # we'll silence all non-error output and check the results to determine success.
+          if ! out="$(curl -sSL --fail https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-x64 --output /usr/local/bin/datadog-ci 2>&1)"; then
+            printf "failed to download datadog-ci: %s" "$out"
+          fi
+          if [[ -n "$out" ]]; then
+            printf "failed to download datadog-ci: %s" "$out"
+          fi
+          chmod +x /usr/local/bin/datadog-ci
+      - name: Upload test results to DataDog
+        if: success() || failure()
+        continue-on-error: true
+        env:
+          DD_ENV: ci
+        run: |
+          if [[ ${{ github.repository }} == 'hashicorp/vault' ]]; then
+            export DATADOG_API_KEY=${{ secrets.DATADOG_API_KEY }}
+          fi
+          datadog-ci junit upload --service "$GITHUB_REPOSITORY" 'ui/test-results/qunit/results.xml'
       - if: always()
-        uses: test-summary/action@fee35d7df20790255fe6aa92cf0f6d28092ecf2f # v2.2
+        uses: test-summary/action@31493c76ec9e7aa675f1585d3ed6f1da69269a86 # v2.4
         with:
           paths: "ui/test-results/qunit/results.xml"
           show: "fail"
@@ -216,16 +371,17 @@ jobs:
   tests-completed:
     needs:
       - setup
+      - test-autopilot-upgrade
       - test-go
       - test-go-testonly
       - test-go-race
       - test-go-fips
       - test-ui
     if: always()
-    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","linux","small"]') }}
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     permissions: write-all # Ensure we have id-token:write access for vault-auth.
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       # Determine the overall status of our required test jobs.
       - name: Determine status
         id: status
@@ -260,23 +416,23 @@ jobs:
             echo "result=${result}"
             echo "results<<EOFRESULTS"$'\n'"${results}"$'\n'EOFRESULTS
           } | tee -a "$GITHUB_OUTPUT"
-      - if: needs.setup.outputs.is-enterprise == 'true'
+      - if: needs.setup.outputs.is-ent-repo == 'true'
         id: vault-auth
         name: Vault Authenticate
         run: vault-auth
-      - if: needs.setup.outputs.is-enterprise == 'true'
+      - if: needs.setup.outputs.is-ent-repo == 'true'
         id: secrets
         name: Fetch Vault Secrets
-        uses: hashicorp/vault-action@9f522b85981b491eab9a52c144d15aedbd0bf371 # v2.8.0
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
         with:
           url: ${{ steps.vault-auth.outputs.addr }}
           caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
           token: ${{ steps.vault-auth.outputs.token }}
           secrets: |
-            kv/data/github/${{ github.repository }}/github_actions_notifications_bot token | SLACK_BOT_TOKEN;
-      - id: slackbot-token
+            kv/data/github/${{ github.repository }}/slack feed-vault-ci-official-webhook-url | slackbot-webhook-url;
+      - id: slackbot-webhook-url
         run:
-          echo "slackbot-token=${{ needs.setup.outputs.is-enterprise != 'true' && secrets.SLACK_BOT_TOKEN || steps.secrets.outputs.SLACK_BOT_TOKEN }}" >> "$GITHUB_OUTPUT"
+          echo "slackbot-webhook-url=${{ needs.setup.outputs.is-ent-repo != 'true' && secrets.FEED_VAULT_CI_OFFICIAL_WEBHOOK_URL || steps.secrets.outputs.slackbot-webhook-url }}" >> "$GITHUB_OUTPUT"
       - if: |
           always() &&
           needs.setup.outputs.workflow-trigger == 'push' &&
@@ -288,52 +444,42 @@ jobs:
             needs.test-ui.result == 'failure'
           )
         name: Notify build failures in Slack
-        uses: slackapi/slack-github-action@6c661ce58804a1a20f6dc5fbee7f0381b469e001 # v1.25.0
-        # We intentionally aren't using the following here since it's from an internal repo
-        # uses: hashicorp/cloud-gha-slack-notifier@730a033037b8e603adf99ebd3085f0fdfe75e2f4 #v1
-        env:
-          SLACK_BOT_TOKEN: ${{ steps.slackbot-token.outputs.slackbot-token }}
+        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
         with:
-          channel-id: "C05AABYEA9Y" # sent to #feed-vault-ci-official, use "C05Q4D5V89W"/test-vault-ci-slack-integration for testing
+          errors: true # exit with an error if the payload is invalid
+          retries: rapid # retry if we're being rated limited
+          webhook: ${{ steps.slackbot-webhook-url.outputs.slackbot-webhook-url }}
+          webhook-type: incoming-webhook
           payload: |
-            {
-              "text": "CE test failures on ${{ github.ref_name }}",
-              "text": "${{ github.repository }} build failures on ${{ github.ref_name }}",
-              "blocks": [
-                {
-                  "type": "header",
-                  "text": {
-                    "type": "plain_text",
-                    "text": ":rotating_light: ${{ github.repository }} test failures on ${{ github.ref_name }} :rotating_light:",
-                    "emoji": true
-                  }
-                },
-                {
-                  "type": "divider"
-                },
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "${{ needs.test-go.result != 'failure' && ':white_check_mark:' || ':x:' }} Go tests\n${{ needs.test-go-race.result != 'failure' && ':white_check_mark:' || ':x:' }} Go race tests\n\t\t${{ needs.test-go-race.outputs.data-race-result != 'success' && ':x:' || ':white_check_mark:' }} Data races detected\n${{ needs.test-go-testonly.result != 'failure' && ':white_check_mark:' || ':x:' }} Go testonly tests\n${{ needs.test-ui.result != 'failure' && ':white_check_mark:' || ':x:' }} UI tests"
-                  },
-                  "accessory": {
-                    "type": "button",
-                    "text": {
-                      "type": "plain_text",
-                      "text": "View Failing Workflow",
-                      "emoji": true
-                    },
-                    "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-                  }
-                }
-              ]
-            }
+            text: ${{ needs.setup.outputs.is-ent-branch == 'true' && 'vault-enterprise' || 'vault' }} test failures on ${{ github.ref_name }}
+            blocks:
+              - type: header
+                text:
+                  type: plain_text
+                  text: :rotating_light: ${{ needs.setup.outputs.is-ent-branch == 'true' && 'vault-enterprise' || 'vault' }} test failures on ${{ github.ref_name }} :rotating_light:
+                  emoji: true
+              - type: divider
+              - type: section
+                text:
+                  type: mrkdwn
+                  text: |
+                    ${{ needs.test-go.result != 'failure' && ':white_check_mark:' || ':x:' }} Go tests
+                    ${{ needs.test-go-race.result != 'failure' && ':white_check_mark:' || ':x:' }} Go race tests
+                        ${{ needs.test-go-race.outputs.data-race-result != 'success' && ':x: Data race detected' || ':white_check_mark: No race detected' }}
+                    ${{ needs.test-go-testonly.result != 'failure' && ':white_check_mark:' || ':x:' }} Go testonly tests
+                    ${{ needs.test-ui.result != 'failure' && ':white_check_mark:' || ':x:' }} UI tests"
+                accessory:
+                  type: button
+                  text:
+                    type: plain_text
+                    text: View Failing Workflow
+                    emoji: true
+                  url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
       # Only create the PR summary if it's a pull request and it is not a fork as we need access
       # to secrets.
       - if: ${{ needs.setup.outputs.is-fork == 'false' }}
         name: Download failure summaries
-        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           pattern: failure-summary-*.md
           path: failure-summaries
diff --git a/.github/workflows/code-checker.yml b/.github/workflows/code-checker.yml
index 13c234c76e8..2913c4a8e44 100644
--- a/.github/workflows/code-checker.yml
+++ b/.github/workflows/code-checker.yml
@@ -15,44 +15,50 @@ concurrency:
 jobs:
   setup:
     name: Setup
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Ensure Go modules are cached
         uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
           no-restore: true # don't download them on a cache hit
+      - uses: ./.github/actions/install-tools
+        name: Ensure Vault tools are cached
+        with:
+          no-restore: true # don't download them on a cache hit
 
   deprecations:
     name: Deprecated functions
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     needs: setup
     if: github.base_ref == 'main'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
-      - uses: ./.github/actions/install-external-tools # for staticcheck
+      - uses: ./.github/actions/install-tools # for staticcheck
+      - run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
       - run: make ci-deprecations
         name: Check deprecations
 
   codechecker:
     name: Code checks
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     needs: setup
     if: github.base_ref == 'main'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
-      - uses: ./.github/actions/install-external-tools # for buf
+      - uses: ./.github/actions/install-tools # for buf
+      - run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
         # Note: if there is a function we want to ignore the nilnil check for,
         # You can add 'ignore-nil-nil-function-check' somewhere in the
         # godoc for the function.
@@ -63,27 +69,29 @@ jobs:
 
   generate-delta:
     name: Protobuf generate delta
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     needs: setup
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
-      - uses: ./.github/actions/install-external-tools # for buf and protoc-*
+      - uses: ./.github/actions/install-tools # for buf and protoc-*
+      - run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
       - name: Check generate delta
         run: make prep check-proto-delta
 
   format:
     name: Format
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     needs: setup
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: ./.github/actions/install-external-tools # for buf and gofumpt
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      - uses: ./.github/actions/install-tools # for buf and gofumpt
+      - run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
       - name: Go format
         run: make prep check-go-fmt
       - name: Protobuf format
@@ -93,10 +101,10 @@ jobs:
 
   semgrep:
     name: Semgrep
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     container:
       image: returntocorp/semgrep@sha256:cfad18cfb6536aa48ad5a71017207a10320b4e17e3b2bd7b7de27b42dc9651e7 #v1.58
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Run Semgrep Rules
         run: semgrep ci --include '*.go' --config 'tools/semgrep/ci'
diff --git a/.github/workflows/copy-external-contributor-pull-request-ce.yml b/.github/workflows/copy-external-contributor-pull-request-ce.yml
new file mode 100644
index 00000000000..c3cc8affb4a
--- /dev/null
+++ b/.github/workflows/copy-external-contributor-pull-request-ce.yml
@@ -0,0 +1,65 @@
+name: copy-external-contributor-pull-request-ce
+
+# NOTE: Don't ever set up concurrency groups. We never want this workflow to
+# be cancelled.
+
+on:
+  pull_request:
+    types:
+      # We only need to trigger this on opened as it will have a manual
+      # deployment approval that is good for 30 days. If we exhaust that there
+      # are two courses of action:
+      #   * Close and re-open the PR and it will trigger it again.
+      #   * Manually run this workflow from the actions UI and provide the
+      #     pull request number
+      - opened
+      - reopened
+  workflow_dispatch:
+    inputs:
+      number:
+        type: string
+        description: The pull request number to copy to enterprise
+        required: true
+
+jobs:
+  copy:
+    name: Copy community contributed pull request to Vault Enterprise
+    # Only run this on pull requests that originate from a fork (community
+    # contributed) or has intentionally been dispatched.
+    if: |
+      github.repository == 'hashicorp/vault' &&
+      github.event_name == 'workflow_dispatch' ||
+      github.event.pull_request.head.repo.fork
+    # Use the community-pull-request environment so that we invoke the deployment
+    # protection rules. In this case those rules require someone in
+    # @hashicorp/github-secure-vault-core to approve the workflow.
+    # When approved we'll initiate the copy job in vault-enterprise.
+    environment: community-pull-request
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - id: set-up-pipeline
+        name: Set up the pipeline tool
+        uses: ./.github/actions/set-up-pipeline
+        with:
+          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      - id: check-cla
+        # Make sure that the license/cla status has successfully run for the PR.
+        # We never want to copy any code to Vault Enterprise unless the CLA
+        # has been run.
+        run: |
+          pipeline github check commit-status \
+            --pr '${{ github.event.number || inputs.number }}' \
+            --context license/cla \
+            --creator hashicorp-cla-app[bot] \
+            --state success
+      - id: payload
+        run: |
+          echo 'payload={"number":"${{ github.event.number || inputs.number }}"}' | tee -a "$GITHUB_OUTPUT"
+      - name: Trigger backport for Enterprise
+        uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0
+        with:
+          token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          repository: hashicorp/vault-enterprise
+          event-type: copy-community-pull-request
+          client-payload: ${{ steps.payload.outputs.payload }}
diff --git a/.github/workflows/copywrite.yml b/.github/workflows/copywrite.yml
index 40212435e64..66247bc6f27 100644
--- a/.github/workflows/copywrite.yml
+++ b/.github/workflows/copywrite.yml
@@ -7,18 +7,20 @@ on:
     branches:
       - main
       - release/**
+      - ce/**
+
+permissions:
+  contents: read
 
 jobs:
   copywrite:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: hashicorp/setup-copywrite@867a1a2a064a0626db322392806428f7dc59cb3e # v1.1.2
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: hashicorp/setup-copywrite@32638da2d4e81d56a0764aa1547882fc4d209636 # v1.1.3
         name: Setup Copywrite
         with:
           version: v0.16.4
           archive-checksum: c299f830e6eef7e126a3c6ef99ac6f43a3c132d830c769e0d36fa347fa1af254
       - name: Check Header Compliance
         run: make ci-copywriteheaders
-permissions:
-  contents: read
diff --git a/.github/workflows/do-not-merge-checker.yml b/.github/workflows/do-not-merge-checker.yml
new file mode 100644
index 00000000000..c3d05d48ff2
--- /dev/null
+++ b/.github/workflows/do-not-merge-checker.yml
@@ -0,0 +1,23 @@
+# This workflow fails if a 'do-not-merge' label is applied to the PR.
+name: Check do-not-merge
+
+on:
+  pull_request:
+    types: [reopened, labeled, unlabeled]
+    # Runs on PRs to main and release branches
+    branches:
+      - main
+      - release/**
+      - ce/**
+
+jobs:
+  # checks that a do-not-merge label is not present for a PR
+  do-not-merge-check:
+    # If there is a `do-not-merge` label we ignore this check
+    if: ${{ contains(github.event.pull_request.labels.*.name, 'do-not-merge') }}
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
+    steps:
+      - name: Fail if do-not-merge label is applied
+        run: |
+          echo "Cannot merge with do-not-merge label applied."
+          exit 1
diff --git a/.github/workflows/enos-lint.yml b/.github/workflows/enos-lint.yml
index c074e929ce2..3deb928933a 100644
--- a/.github/workflows/enos-lint.yml
+++ b/.github/workflows/enos-lint.yml
@@ -12,20 +12,20 @@ jobs:
     # as we need secrets to install enos.
     if: "! github.event.pull_request.head.repo.fork"
     name: metadata
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     outputs:
       runs-on: ${{ steps.metadata.outputs.runs-on }}
       version: ${{ steps.metadata.outputs.version }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - id: set-product-version
-        uses: hashicorp/actions-set-product-version@v1
+        uses: hashicorp/actions-set-product-version@2ec1b51402b3070bccf7ca95306afbd039e574ff # v2.0.1
       - id: metadata
         run: |
           echo "version=${{ steps.set-product-version.outputs.product-version }}" >> "$GITHUB_OUTPUT"
           github_repository="${{ github.repository }}"
           if [ "${github_repository##*/}" == "vault-enterprise" ] ; then
-            echo 'runs-on=["self-hosted","ondemand","linux","type=c6a.4xlarge"]' >> "$GITHUB_OUTPUT"
+            echo 'runs-on=["self-hosted","ubuntu-latest-x64","type=c6a.4xlarge"]' >> "$GITHUB_OUTPUT"
           else
             echo 'runs-on="custom-linux-xl-vault-latest"' >> "$GITHUB_OUTPUT"
           fi
@@ -33,17 +33,17 @@ jobs:
   lint:
     needs: metadata
     runs-on: ${{ fromJSON(needs.metadata.outputs.runs-on) }}
-    env:
-      GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
-      ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: hashicorp/setup-terraform@v3
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: ./.github/actions/set-up-go
         with:
-          terraform_wrapper: false
-      - uses: hashicorp/action-setup-enos@v1
+          no-restore: true
+          no-save: true
+      - uses: ./.github/actions/install-tools
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
         with:
-          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          terraform_wrapper: false
+      - uses: hashicorp/action-setup-enos@39a8f388434bea5eeba6649b99aa9949a55a1150 # v1.38
       - name: Ensure shellcheck is available for linting
         run: which shellcheck || (sudo apt update && sudo apt install -y shellcheck)
       - name: lint
diff --git a/.github/workflows/enos-release-testing-oss.yml b/.github/workflows/enos-release-testing-oss.yml
index e939d01c103..4cd9db68665 100644
--- a/.github/workflows/enos-release-testing-oss.yml
+++ b/.github/workflows/enos-release-testing-oss.yml
@@ -15,7 +15,7 @@ jobs:
       vault-version: ${{ github.event.client_payload.payload.version }}
       vault-version-package: ${{ steps.get-metadata.outputs.vault-version-package }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           # Check out the repository at the same Git SHA that was used to create
           # the artifacts to get the correct metadata.
@@ -64,9 +64,9 @@ jobs:
     secrets: inherit
 
   save-metadata:
-    runs-on: linux
+    runs-on: ubuntu-latest
     if: always()
     needs: test
     steps:
       - name: Persist metadata
-        uses: hashicorp/actions-persist-metadata@v1
+        uses: hashicorp/actions-persist-metadata@4c07d5de3e4b78122d6e180657992d6e359d5ea1 # v3
diff --git a/.github/workflows/enos-run-k8s.yml b/.github/workflows/enos-run-k8s.yml
deleted file mode 100644
index 3a8d3348357..00000000000
--- a/.github/workflows/enos-run-k8s.yml
+++ /dev/null
@@ -1,114 +0,0 @@
----
-name: enos-k8s
-
-on:
-  workflow_call:
-    inputs:
-      artifact-build-date:
-        required: false
-        type: string
-      artifact-name:
-        required: true
-        type: string
-      artifact-revision:
-        required: true
-        type: string
-      artifact-version:
-        required: true
-        type: string
-
-env:
-  ARTIFACT_BUILD_DATE: ${{ inputs.artifact-build-date }}
-  ARTIFACT_NAME: ${{ inputs.artifact-name }}
-  ARTIFACT_REVISION: ${{ inputs.artifact-revision }}
-  ARTIFACT_VERSION: ${{ inputs.artifact-version }}
-
-jobs:
-  enos:
-    name: Integration
-    runs-on: ubuntu-latest
-    env:
-      GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - name: Set up Terraform
-        uses: hashicorp/setup-terraform@v3
-        with:
-          # the Terraform wrapper will break Terraform execution in Enos because
-          # it changes the output to text when we expect it to be JSON.
-          terraform_wrapper: false
-      - name: Set up Enos
-        uses: hashicorp/action-setup-enos@v1
-        with:
-          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
-      - name: Download Docker Image
-        id: download
-        # Use actions/download-artifact @3.x until https://hashicorp.atlassian.net/browse/HREL-99 is resolved
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
-        with:
-          name: ${{ inputs.artifact-name }}
-          path: ./enos/support/downloads
-      - name: Prepare for scenario execution
-        env:
-          IS_ENT: ${{ contains(env.ARTIFACT_NAME, 'vault-enterprise' ) }}
-        run: |
-          mkdir -p ./enos/support/terraform-plugin-cache
-          if [ "$IS_ENT" == true ]; then
-            echo "${{ secrets.VAULT_LICENSE }}" > ./enos/support/vault.hclic || true
-            echo "edition=ent" >> "$GITHUB_ENV"
-            echo "edition set to 'ent'"
-            echo "image_repo=hashicorp/vault-enterprise" >> "$GITHUB_ENV"
-            echo "image repo set to 'hashicorp/vault-enterprise'"
-          else
-            echo "edition=ce" >> "$GITHUB_ENV"
-            echo "edition set to 'ce'"
-            echo "image_repo=hashicorp/vault" >> "$GITHUB_ENV"
-            echo "image repo set to 'hashicorp/vault'"
-          fi
-      - name: Run Enos scenario
-        id: run
-        # Continue once and retry to handle occasional blips when creating
-        # infrastructure.
-        continue-on-error: true
-        env:
-          ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
-          ENOS_VAR_terraform_plugin_cache_dir: ../support/terraform-plugin-cache
-          ENOS_VAR_vault_build_date: ${{ env.ARTIFACT_BUILD_DATE }}
-          ENOS_VAR_vault_product_version: ${{ env.ARTIFACT_VERSION }}
-          ENOS_VAR_vault_product_revision: ${{ env.ARTIFACT_REVISION }}
-          ENOS_VAR_vault_docker_image_archive: ${{steps.download.outputs.download-path}}/${{ env.ARTIFACT_NAME }}
-          ENOS_VAR_vault_image_repository: ${{ env.image_repo }}
-        run: |
-          enos scenario run --timeout 10m0s --chdir ./enos/k8s edition:${{ env.edition }}
-      - name: Retry Enos scenario
-        id: run_retry
-        if: steps.run.outcome == 'failure'
-        env:
-          ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
-          ENOS_VAR_terraform_plugin_cache_dir: ../support/terraform-plugin-cache
-          ENOS_VAR_vault_build_date: ${{ env.ARTIFACT_BUILD_DATE }}
-          ENOS_VAR_vault_product_version: ${{ env.ARTIFACT_VERSION }}
-          ENOS_VAR_vault_product_revision: ${{ env.ARTIFACT_REVISION }}
-          ENOS_VAR_vault_docker_image_archive: ${{steps.download.outputs.download-path}}/${{ env.ARTIFACT_NAME }}
-          ENOS_VAR_vault_image_repository: ${{ env.image_repo }}
-        run: |
-          enos scenario run --timeout 10m0s --chdir ./enos/k8s edition:${{ env.edition }}
-      - name: Destroy Enos scenario
-        if: ${{ always() }}
-        env:
-          ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
-          ENOS_VAR_terraform_plugin_cache_dir: ./support/terraform-plugin-cache
-          ENOS_VAR_vault_build_date: ${{ env.ARTIFACT_BUILD_DATE }}
-          ENOS_VAR_vault_product_version: ${{ env.ARTIFACT_VERSION }}
-          ENOS_VAR_vault_product_revision: ${{ env.ARTIFACT_REVISION }}
-          ENOS_VAR_vault_docker_image_archive: ${{steps.download.outputs.download-path}}
-          ENOS_VAR_vault_image_repository: ${{ env.image_repo }}
-        run: |
-          enos scenario destroy --timeout 10m0s --chdir ./enos/k8s edition:${{ env.edition }}
-      - name: Cleanup Enos runtime directories
-        if: ${{ always() }}
-        run: |
-          rm -rf /tmp/enos*
-          rm -rf ./enos/support
-          rm -rf ./enos/k8s/.enos
diff --git a/.github/workflows/milestone-checker.yml b/.github/workflows/milestone-checker.yml
index 294b5857649..ef06d3f181c 100644
--- a/.github/workflows/milestone-checker.yml
+++ b/.github/workflows/milestone-checker.yml
@@ -5,12 +5,13 @@ name: Check Milestone
 
 on:
   pull_request:
-    # milestoned and demilestoned work (https://github.com/github/docs/issues/23909) but they aren't listed in the github documentation 
+    # milestoned and demilestoned work (https://github.com/github/docs/issues/23909) but they aren't listed in the github documentation
     types: [opened, synchronize, labeled, unlabeled, milestoned, demilestoned]
     # Runs on PRs to main and release branches
     branches:
       - main
       - release/**
+      - ce/**
 
 jobs:
   # checks that a milestone entry is present for a PR
@@ -19,7 +20,7 @@ jobs:
     if: ${{ ((github.repository == 'hashicorp/vault' || github.repository == 'hashicorp/vault-enterprise')
       && (github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name))
       && (!contains(github.event.pull_request.labels.*.name, 'pr/no-milestone')) }}
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     steps:
       - name: Check milestone
         run: ${{ github.event.pull_request.milestone != null }}
diff --git a/.github/workflows/oss.yml b/.github/workflows/oss.yml
index 2e8ba0fabe5..6e47790ebd8 100644
--- a/.github/workflows/oss.yml
+++ b/.github/workflows/oss.yml
@@ -19,9 +19,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - if: github.event.pull_request != null
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - if: github.event.pull_request != null
-        uses: dorny/paths-filter@0bc4621a3135347011ad047f9ecf449bf72ce2bd # v3.0.0
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: changes
         with:
           # derived from CODEOWNERS
@@ -68,7 +68,7 @@ jobs:
       - if: github.event.pull_request != null && steps.changes.outputs.ui == 'true'
         run: echo "PROJECT=171" >> "$GITHUB_ENV"
 
-      - uses: actions/add-to-project@31b3f3ccdc584546fc445612dec3f38ff5edb41c # v0.5.0
+      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
         with:
           project-url: https://github.com/orgs/hashicorp/projects/${{ env.PROJECT }}
           github-token: ${{ secrets.TRIAGE_GITHUB_TOKEN }}
diff --git a/.github/workflows/plugin-update-check.yml b/.github/workflows/plugin-update-check.yml
index 6fd8479eb90..b16e9c41619 100644
--- a/.github/workflows/plugin-update-check.yml
+++ b/.github/workflows/plugin-update-check.yml
@@ -15,7 +15,7 @@ on:
 
 jobs:
   plugin-update-check:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     env:
       PLUGIN_REPO: "${{inputs.repo}}"
       PLUGIN_BRANCH: "${{inputs.plugin_branch}}"
@@ -23,13 +23,13 @@ jobs:
       RUN_ID: "${{github.run_id}}"
     steps:
       - run: echo "Branch $PLUGIN_BRANCH of $PLUGIN_REPO"
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           # We don't use the default token so that checks are executed on the resulting PR
           # https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow
           token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
 
-      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           cache: false # save cache space for vault builds: https://github.com/hashicorp/vault/pull/21764
           go-version-file: .go-version
@@ -67,13 +67,13 @@ jobs:
             --head "$VAULT_BRANCH" \
             --title "[DO NOT MERGE]: $PLUGIN_REPO Automated plugin update check" \
             --body "Updates $PLUGIN_REPO to verify vault CI. Full log: https://github.com/hashicorp/vault/actions/runs/$RUN_ID"
-
-            echo "vault_pr_num=$(gh pr list --head "$VAULT_BRANCH" --json number -q '.[0].number')" >> "$GITHUB_OUTPUT"
-            echo "vault_pr_url=$(gh pr list --head "$VAULT_BRANCH" --json url -q '.[0].url')" >> "$GITHUB_OUTPUT"
           else
             echo "Pull request already exists, won't create a new one."
           fi
 
+          echo "vault_pr_num=$(gh pr list --head "$VAULT_BRANCH" --json number -q '.[0].number')" >> "$GITHUB_OUTPUT"
+          echo "vault_pr_url=$(gh pr list --head "$VAULT_BRANCH" --json url -q '.[0].url')" >> "$GITHUB_OUTPUT"
+
       - name: Add labels to Vault CI check PR
         if: steps.changes.outputs.count > 0
         env:
diff --git a/.github/workflows/plugin-update.yml b/.github/workflows/plugin-update.yml
index 18c7ef57ae2..8bbedb5937f 100644
--- a/.github/workflows/plugin-update.yml
+++ b/.github/workflows/plugin-update.yml
@@ -8,34 +8,72 @@ on:
         description: 'Full name of the plugin, e.g., vault-plugin-auth-kubernetes'
         required: true
         type: string
+      branch:
+        description: 'Git branch name to use'
+        required: true
+        type: string
+      base-branch:
+        description: 'Base git branch to use'
+        required: true
+        type: string
       version:
         description: 'Version of the plugin with *NO* "v", e.g., 1.2.3'
         required: true
         type: string
+      ent-only:
+        description: Whether or not the plugin is enterprise only
+        required: true
+        type: boolean
+      reviewer:
+        description: 'Reviewer to tag on the PR'
+        required: false
+        type: string
 
 jobs:
   plugin-update:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     env:
-      VAULT_BRANCH: "update/${{ inputs.plugin }}/v${{ inputs.version }}"
+      GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      GOPRIVATE: github.com/hashicorp/*
+      VAULT_BRANCH: ${{ inputs.branch }}
+      REVIEWER: ${{ inputs.reviewer || github.actor }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           # We don't use the default token so that checks are executed on the resulting PR
           # https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow
           token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          ref: ${{ inputs.base-branch }}
+
+      - uses: ./.github/actions/metadata
+        id: metadata
 
-      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+      - uses: ./.github/actions/set-up-go
         with:
-          cache: false # save cache space for vault builds: https://github.com/hashicorp/vault/pull/21764
-          go-version-file: .go-version
+          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          no-restore: true
+          no-save: true
 
-      - name: update plugin
+      - id: configure-git
+        name: Configure git
+        run: |
+          git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"
+          git config user.name hc-github-team-secure-vault-ecosystem
+          git config user.email hc-github-team-secure-vault-ecosystem@users.noreply.github.com
+
+      - if: inputs.ent-only != 'true'
+        name: Update plugin
         run: |
           go get "github.com/hashicorp/${{ inputs.plugin }}@v${{ inputs.version }}"
           go mod tidy
 
-      - name: detect changes
+      - if: inputs.ent-only == 'true'
+        name: Update Enterprise-only plugin
+        run: |
+          (cd vault_ent && go get "github.com/hashicorp/${{ inputs.plugin }}@v${{ inputs.version }}" && go mod tidy)
+          go mod tidy
+
+      - name: Detect changes
         run: |
           count=$(git status --porcelain=v1 2>/dev/null | wc -l)
           if [ "$count" -eq 0 ]; then
@@ -43,18 +81,14 @@ jobs:
             exit 1
           fi
 
-      - name: commit/push
+      - name: Commit and push
         run: |
-          git config user.name hc-github-team-secure-vault-ecosystem
-          git config user.email hc-github-team-secure-vault-ecosystem@users.noreply.github.com
-          git add go.mod go.sum
-          git commit -m "Automated dependency upgrades"
-          git push -f origin ${{ github.ref_name }}:"$VAULT_BRANCH"
+          git add ./\*go.mod ./\*go.sum
+          git commit -m "Update ${{ inputs.plugin }} to v${{ inputs.version }}"
+          git push -f origin ${{ inputs.base-branch }}:"$VAULT_BRANCH"
 
       - name: Open pull request if needed
         id: pr
-        env:
-          GITHUB_TOKEN: ${{secrets.ELEVATED_GITHUB_TOKEN}}
         # Only open a PR if the branch is not attached to an existing one
         run: |
           PR=$(gh pr list --head "$VAULT_BRANCH" --json number -q '.[0].number')
@@ -62,9 +96,11 @@ jobs:
           if [ -z "$PR" ]; then
             gh pr create \
             --head "$VAULT_BRANCH" \
-            --reviewer "${{ github.actor }}" \
+            --base "${{ inputs.base-branch }}" \
+            --reviewer "$REVIEWER" \
+            --assignee "$REVIEWER" \
             --title "Update ${{ inputs.plugin }} to v${{ inputs.version }}" \
-            --body "This PR was generated by a GitHub Action. Full log: https://github.com/hashicorp/vault/actions/runs/${{ github.run_id }}"
+            --body "This PR was generated by a GitHub Action. Full log: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
 
             echo "vault_pr_num=$(gh pr list --head "$VAULT_BRANCH" --json number -q '.[0].number')" >> "$GITHUB_OUTPUT"
             echo "vault_pr_url=$(gh pr list --head "$VAULT_BRANCH" --json url -q '.[0].url')" >> "$GITHUB_OUTPUT"
@@ -85,13 +121,21 @@ jobs:
           PLUGIN_SERVICE=$(echo "$PLUGIN" | cut -d- -f 4-)
           echo "::debug::plugin service: $PLUGIN_SERVICE"
 
+          # changelog filename is the PR number with a .txt extension
+          # if the repo is vault-enterprise, the filename should start with an underscore
+          CHANGELOG_FILENAME="${{ steps.pr.outputs.vault_pr_num }}.txt"
+          if [[ '${{ steps.metadata.outputs.is-ent-branch }}' == 'true' ]]; then
+            CHANGELOG_FILENAME="_${{ steps.pr.outputs.vault_pr_num }}.txt"
+          fi
+          echo "::debug::changelog filename: $CHANGELOG_FILENAME"
+
           echo "\`\`\`release-note:change
-          ${PLUGIN_TYPE}/${PLUGIN_SERVICE}: Update plugin to v${{ inputs.version }}
-          \`\`\`" > "changelog/${{ steps.pr.outputs.vault_pr_num }}.txt"
+          ${PLUGIN_TYPE}/${PLUGIN_SERVICE}: Update plugin to [v${{ inputs.version }}](https://github.com/hashicorp/${{ inputs.plugin }}/releases/tag/v${{ inputs.version }})
+          \`\`\`" > "changelog/$CHANGELOG_FILENAME"
 
           git add changelog/
           git commit -m "Add changelog"
-          git push origin ${{ github.ref_name }}:"$VAULT_BRANCH"
+          git push origin ${{ inputs.base-branch }}:"$VAULT_BRANCH"
 
       - name: Add labels to Vault PR
         if: steps.pr.outputs.vault_pr_num != ''
@@ -102,5 +146,4 @@ jobs:
         continue-on-error: true
         run: |
           gh pr edit "${{ steps.pr.outputs.vault_pr_num }}" \
-            --add-label "dependencies" \
-            --repo hashicorp/vault
+            --add-label "dependencies"
diff --git a/.github/workflows/remove-labels.yml b/.github/workflows/remove-labels.yml
index 014b6752af7..e9bbeb5cb53 100644
--- a/.github/workflows/remove-labels.yml
+++ b/.github/workflows/remove-labels.yml
@@ -10,10 +10,10 @@ jobs:
 
   RemoveWaitingLabelFromClosedIssueOrPR:
     if: github.event.action == 'closed'
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     steps:
       - name: Remove triaging labels from closed issues and PRs
         uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
         with:
           labels: |
-            waiting-for-response
\ No newline at end of file
+            waiting-for-response
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 68cbac0b40d..1ed2a384d57 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -15,78 +15,53 @@ on:
 
 jobs:
   scan:
-    runs-on: ${{ fromJSON(vars.RUNNER_XL) }}
-    # The first check ensures this doesn't run on community-contributed PRs, who
-    # won't have the permissions to run this job.
-    if: ${{ (github.repository != 'hashicorp/vault' || (github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name))
-          && (github.actor != 'dependabot[bot]') && ( github.actor != 'hc-github-team-secure-vault-core') }}
-    
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ondemand","os=linux","type=c6a.4xlarge"]') }}
+    # The first check ensures this doesn't run on community-contributed PRs, who won't have the
+    # permissions to run this job.
+    if: |
+      ! github.event.pull_request.head.repo.fork &&
+      github.actor != 'dependabot[bot]' &&
+      github.actor != 'hc-github-team-secure-vault-core'
     steps:
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Set up Go
-      uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
       with:
         cache: false # save cache space for vault builds: https://github.com/hashicorp/vault/pull/21764
         go-version-file: .go-version
 
     - name: Set up Python
-      uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
       with:
         python-version: 3.x
 
-    - name: Clone Security Scanner repo
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - name: Set up Security Scanner
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         repository: hashicorp/security-scanner
-        token: ${{ secrets.HASHIBOT_PRODSEC_GITHUB_TOKEN }}
+        token: ${{ secrets.PRODSEC_SCANNER_READ_ONLY }}
         path: security-scanner
         ref: main
 
-    - name: Install dependencies
+    - name: Install Security Scanner Semgrep Plugin Dependency
       shell: bash
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
-        mkdir "$HOME/.bin"
-        cd "$GITHUB_WORKSPACE/security-scanner/pkg/sdk/examples/scan-plugin-semgrep"
-        go build -o scan-plugin-semgrep .
-        mv scan-plugin-semgrep "$HOME/.bin"
-
-        cd "$GITHUB_WORKSPACE/security-scanner/pkg/sdk/examples/scan-plugin-codeql"
-        go build -o scan-plugin-codeql .
-        mv scan-plugin-codeql "$HOME/.bin"
-
-        # Semgrep
         python3 -m pip install semgrep==1.45.0
 
-        # CodeQL
-        LATEST=$(gh release list --repo https://github.com/github/codeql-action | cut -f 3 | sort --version-sort | tail -n1)
-        gh release download --repo https://github.com/github/codeql-action --pattern codeql-bundle-linux64.tar.gz "$LATEST"
-        tar xf codeql-bundle-linux64.tar.gz -C "$HOME/.bin"
-
-        # Add to PATH
-        echo "$HOME/.bin" >> "$GITHUB_PATH"
-        echo "$HOME/.bin/codeql" >> "$GITHUB_PATH"
-
     - name: Scan
       id: scan
       uses: ./security-scanner
-      # env:
-        # Note: this _should_ work, but causes some issues with Semgrep.
-        # Instead, rely on filtering in the SARIF Output step.
-        #SEMGREP_BASELINE_REF: ${{ github.base_ref }}
       with:
         repository: "$PWD"
-        cache-build: true
-        cache-go-modules: false
+        plugins: "codeql semgrep"
 
-    - name: SARIF Output
+    - name: Read SARIF
       shell: bash
       run: |
-        cat results.sarif
+        cat ${{ steps.scan.outputs.sarif-file-path }}
 
-    - name: Upload SARIF file
-      uses: github/codeql-action/upload-sarif@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # codeql-bundle-v2.16.1
+    - name: Upload SARIF 
+      uses: github/codeql-action/upload-sarif@3096afedf9873361b2b2f65e1445b13272c83eb8  # TSCCR: could not find entry for github/codeql-action/upload-sarif
       with:
-        sarif_file: results.sarif
+        sarif_file: ${{ steps.scan.outputs.sarif-file-path }}
diff --git a/.github/workflows/stable-website.yaml b/.github/workflows/stable-website.yaml
deleted file mode 100644
index 55357686906..00000000000
--- a/.github/workflows/stable-website.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-on:
-  pull_request:
-    types:
-      - closed
-
-# cancel existing runs of the same workflow on the same ref
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  stable_website_cherry_pick:
-    if: github.event.pull_request.merged && contains(github.event.pull_request.labels.*.name, 'docs-cherrypick')
-    runs-on: ubuntu-latest
-    name: Cherry pick to stable-website branch
-    steps:
-    - name: Checkout
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      with:
-        ref: stable-website
-    - run: |
-        git fetch --no-tags --prune origin main
-        git config --local user.email "action@github.com"
-        git config --local user.name "GitHub Action"
-        git cherry-pick ${{ github.sha }}
-        git push origin stable-website
diff --git a/.github/workflows/test-ci-bootstrap.yml b/.github/workflows/test-ci-bootstrap.yml
index 9268dd93190..654d4fbe5d4 100644
--- a/.github/workflows/test-ci-bootstrap.yml
+++ b/.github/workflows/test-ci-bootstrap.yml
@@ -22,21 +22,24 @@ on:
 
 jobs:
   bootstrap-ci:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
+    permissions: write-all
     env:
       TF_WORKSPACE: "${{ github.event.repository.name }}-ci-enos-bootstrap"
       TF_VAR_repository: ${{ github.event.repository.name }}
       TF_VAR_aws_ssh_public_key: ${{ secrets.SSH_KEY_PUBLIC_CI }}
       TF_TOKEN_app_terraform_io: ${{ secrets.TF_API_TOKEN }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Set up Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        with:
+          terraform_wrapper: false
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI_09042025 }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI_09042025 }}
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_ARN_CI }}
           role-skip-session-tagging: true
@@ -44,7 +47,7 @@ jobs:
       - name: Init Terraform
         id: tf_init
         run: |
-          terraform -chdir=enos/ci/bootstrap init
+          terraform -chdir=enos/ci/bootstrap init -input=false
       - name: Plan Terraform
         id: tf_plan
         run: |
diff --git a/.github/workflows/test-ci-cleanup.yml b/.github/workflows/test-ci-cleanup.yml
index 5f24d39601a..95dc7bcc3a0 100644
--- a/.github/workflows/test-ci-cleanup.yml
+++ b/.github/workflows/test-ci-cleanup.yml
@@ -1,4 +1,5 @@
 name: test-ci-cleanup
+
 on:
   schedule:
     # * is a special character in YAML so you have to quote this string
@@ -6,15 +7,17 @@ on:
 
 jobs:
   setup:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
+    permissions: write-all
     outputs:
       regions: ${{steps.setup.outputs.regions}}
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+        id: aws-configure
+        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI_09042025 }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI_09042025 }}
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_ARN_CI }}
           role-skip-session-tagging: true
@@ -26,9 +29,9 @@ jobs:
 
   aws-nuke:
     needs: setup
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     container:
-      image: rebuy/aws-nuke
+      image: ghcr.io/ekristen/aws-nuke:v3.51.0 # https://github.com/ekristen/aws-nuke/pkgs/container/aws-nuke
       options:
          --user root
          -t
@@ -36,49 +39,56 @@ jobs:
         AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID }}
         AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY }}
         TIME_LIMIT: "72h"
-    timeout-minutes: 60
+    timeout-minutes: 120
     steps:
       - name: Configure AWS credentials
         id: aws-configure
-        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI_09042025 }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI_09042025 }}
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_ARN_CI }}
           role-skip-session-tagging: true
           role-duration-seconds: 3600
           mask-aws-account-id: false
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - name: Get AWS Account ID
+        id: aws-info
+        run: |
+          AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
+          echo "aws-account-id=$AWS_ACCOUNT_ID" | tee -a "$GITHUB_OUTPUT"
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Configure
         run: |
           cp enos/ci/aws-nuke.yml .
-          sed -i "s/ACCOUNT_NUM/${{ steps.aws-configure.outputs.aws-account-id }}/g" aws-nuke.yml
+          sed -i "s/ACCOUNT_NUM/${{ steps.aws-info.outputs.aws-account-id }}/g" aws-nuke.yml
           sed -i "s/TIME_LIMIT/${TIME_LIMIT}/g" aws-nuke.yml
       # We don't care if cleanup succeeds or fails, because dependencies be dependenceies,
       # we'll fail on actually actionable things in the quota steep afterwards.
       - name: Clean up abandoned resources
         # Filter STDERR because it's super noisy about things we don't have access to
+        # Remove --no-dry-run to do dry run
         run: |
-          aws-nuke -c aws-nuke.yml -q --no-dry-run --force 2>/tmp/aws-nuke-error.log || true
+          aws-nuke run -c aws-nuke.yml -q --no-dry-run --force 2>/tmp/aws-nuke-error.log | grep -v "level=error" || true
 
   check-quotas:
     needs: [ setup, aws-nuke ]
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     container:
       image: jantman/awslimitchecker
       env:
-        AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID_CI }}
-        AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY_CI }}
+        AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID_CI_09042025 }}
+        AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY_CI_09042025 }}
     strategy:
       matrix:
         region: ${{ fromJSON(needs.setup.outputs.regions) }}
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+        id: aws-configure
+        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI_09042025 }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI_09042025 }}
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_ARN_CI }}
           role-skip-session-tagging: true
diff --git a/.github/workflows/test-enos-scenario-ui.yml b/.github/workflows/test-enos-scenario-ui.yml
index a81dbd5cab7..f5d3500ae0e 100644
--- a/.github/workflows/test-enos-scenario-ui.yml
+++ b/.github/workflows/test-enos-scenario-ui.yml
@@ -35,23 +35,29 @@ on:
 jobs:
   get-metadata:
     name: Get metadata
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     outputs:
-      runs-on: ${{ steps.get-metadata.outputs.runs-on }}
-      vault_edition: ${{ steps.get-metadata.outputs.vault_edition }}
+      is-ent-branch: ${{ steps.metadata.outputs.is-ent-branch }}
+      is-ent-repo: ${{ steps.metadata.outputs.is-ent-repo }}
+      runs-on: ${{ steps.get-outputs.outputs.runs-on }}
+      vault_edition: ${{ steps.get-outputs.outputs.vault_edition }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - id: get-metadata
-        env:
-          IS_ENT: ${{ startsWith(github.event.repository.name, 'vault-enterprise' ) }}
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: ./.github/actions/metadata
+        id: metadata
+      - id: get-outputs
         run: |
-          if [ "$IS_ENT" == true ]; then
-            echo "detected vault_edition=ent"
+          if [[ '${{ steps.metadata.outputs.is-ent-repo }}' == 'true' ]]; then
             echo "runs-on=['self-hosted', 'ondemand', 'os=linux', 'type=m5d.4xlarge']" >> "$GITHUB_OUTPUT"
-            echo "vault_edition=ent" >> "$GITHUB_OUTPUT"
           else
-            echo "detected vault_edition=oss"
             echo "runs-on=\"custom-linux-xl-vault-latest\"" >> "$GITHUB_OUTPUT"
+          fi
+
+          if [[ '${{ steps.metadata.outputs.is-ent-branch }}' == 'true' ]]; then
+            echo "detected vault_edition=ent"
+            echo "vault_edition=ent" >> "$GITHUB_OUTPUT"
+          else
+            echo "detected vault_edition=ce"
             echo "vault_edition=oss" >> "$GITHUB_OUTPUT"
           fi
 
@@ -59,6 +65,7 @@ jobs:
     name: Run UI Tests
     needs: get-metadata
     runs-on: ${{ fromJSON(needs.get-metadata.outputs.runs-on) }}
+    permissions: write-all
     timeout-minutes: 90
     env:
       GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
@@ -66,27 +73,26 @@ jobs:
       ENOS_VAR_aws_region: us-east-1
       ENOS_VAR_aws_ssh_keypair_name: ${{ github.event.repository.name }}-ci-ssh-key
       ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
-      ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
       ENOS_VAR_terraform_plugin_cache_dir: ./support/terraform-plugin-cache
       ENOS_VAR_vault_license_path: ./support/vault.hclic
       GOPRIVATE: github.com/hashicorp
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
-      - uses: hashicorp/action-setup-enos@v1
+      - uses: hashicorp/action-setup-enos@39a8f388434bea5eeba6649b99aa9949a55a1150 # v1.38
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       - name: Set Up Git
         run: git config --global url."https://${{ secrets.elevated_github_token }}:@github.com".insteadOf "https://github.com"
       - name: Set Up Node
-        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version-file: './ui/package.json'
       - name: Set Up Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
         with:
           cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
           terraform_wrapper: false
@@ -96,7 +102,7 @@ jobs:
           echo "${{ secrets.SSH_KEY_PRIVATE_CI }}" > ./enos/support/private_key.pem
           chmod 600 ./enos/support/private_key.pem
       - name: Set Up Vault Enterprise License
-        if: contains(github.event.repository.name, 'ent')
+        if: ${{ needs.get-metadata.outputs.is-ent-branch == 'true' }}
         run: echo "${{ secrets.VAULT_LICENSE }}" > ./enos/support/vault.hclic || true
       - name: Check Chrome Installed
         id: chrome-check
@@ -108,15 +114,15 @@ jobs:
           sudo apt install -y libnss3-dev libgdk-pixbuf2.0-dev libgtk-3-dev libxss-dev libasound2
       - name: Install Chrome
         if: steps.chrome-check.outputs.chrome-version == 'not-installed'
-        uses: browser-actions/setup-chrome@52f10de5479c69bcbbab2eab094c9d373148005e # v1.4.0
+        uses: browser-actions/setup-chrome@b94431e051d1c52dcbe9a7092a4f10f827795416 # v2.1.0
       - name: Installed Chrome Version
         run: |
           echo "Installed Chrome Version = [$(chrome --version 2> /dev/null || google-chrome --version 2> /dev/null || google-chrome-stable --version 2> /dev/null)]"
       - name: Configure AWS credentials from Test account
-        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI }}
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI_09042025 }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI_09042025 }}
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_ARN_CI }}
           role-skip-session-tagging: true
diff --git a/.github/workflows/test-go.yml b/.github/workflows/test-go.yml
index 8446150eeb6..87a1ac20d36 100644
--- a/.github/workflows/test-go.yml
+++ b/.github/workflows/test-go.yml
@@ -49,6 +49,11 @@ on:
         required: false
         default: 20
         type: number
+      go-test-timeout:
+        description: The timeout parameter for Go tests
+        required: false
+        default: 50m
+        type: string
       timeout-minutes:
         description: The maximum number of minutes that this workflow should run
         required: false
@@ -59,15 +64,20 @@ on:
         required: false
         default: false
         type: boolean
-      test-timing-cache-enabled:
-        description: Cache the gotestsum test timing data.
+      test-timing-cache-restore:
+        description: Restore the gotestsum test timing data from cache.
+        required: false
+        default: true
+        type: boolean
+      test-timing-cache-save:
+        description: Upload the gotestsum test timing data to cache.
         required: false
         default: true
         type: boolean
       test-timing-cache-key:
         description: The cache key to use for gotestsum test timing data.
         required: false
-        default: go-test-reports
+        default: go-test-timing-
         type: string
       checkout-ref:
         description: The ref to use for checkout.
@@ -86,32 +96,30 @@ env: ${{ fromJSON(inputs.env-vars) }}
 
 jobs:
   test-matrix:
-    permissions:
-      id-token: write  # Note: this permission is explicitly required for Vault auth
-      contents: read
+    permissions: write-all # vault-auth
     runs-on: ${{ fromJSON(inputs.runs-on-small) }}
     outputs:
-      go-test-dir: ${{ steps.metadata.outputs.go-test-dir }}
+      is-ent-branch: ${{ steps.global-metadata.outputs.is-ent-branch }}
+      is-ent-repo: ${{ steps.global-metadata.outputs.is-ent-repo }}
+      go-test-dir: ${{ steps.local-metadata.outputs.go-test-dir }}
       matrix: ${{ steps.build.outputs.matrix }}
       matrix_ids: ${{ steps.build.outputs.matrix_ids }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.checkout-ref }}
-      - uses: ./.github/actions/set-up-go
-        with:
-          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
-      - id: metadata
-        name: Set up metadata
+      - uses: ./.github/actions/metadata
+        id: global-metadata
+      - id: local-metadata
         run: echo "go-test-dir=test-results/go-test" | tee -a "$GITHUB_OUTPUT"
-      - name: Authenticate to Vault
+      - if: steps.global-metadata.outputs.is-ent-repo == 'true'
+        name: Authenticate to Vault
         id: vault-auth
-        if: github.repository == 'hashicorp/vault-enterprise'
         run: vault-auth
-      - name: Fetch Secrets
+      - if: steps.global-metadata.outputs.is-ent-repo == 'true'
+        name: Fetch Secrets
         id: secrets
-        if: github.repository == 'hashicorp/vault-enterprise'
-        uses: hashicorp/vault-action@9f522b85981b491eab9a52c144d15aedbd0bf371 # v2.8.0
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
         with:
           url: ${{ steps.vault-auth.outputs.addr }}
           caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
@@ -121,36 +129,40 @@ jobs:
             kv/data/github/${{ github.repository }}/github-token username-and-token | github-token;
             kv/data/github/${{ github.repository }}/license license_1 | VAULT_LICENSE_CI;
             kv/data/github/${{ github.repository }}/license license_2 | VAULT_LICENSE_2;
-      - id: setup-git-private
+      - if: steps.global-metadata.outputs.is-ent-repo == 'true'
         name: Setup Git configuration (private)
-        if: github.repository == 'hashicorp/vault-enterprise'
+        id: setup-git-private
         run: |
           git config --global url."https://${{ steps.secrets.outputs.github-token }}@github.com".insteadOf https://github.com
-      - id: setup-git-public
+      - if: steps.global-metadata.outputs.is-ent-repo != 'true'
         name: Setup Git configuration (public)
-        if: github.repository != 'hashicorp/vault-enterprise'
+        id: setup-git-public
         run: |
           git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
-      - uses: ./.github/actions/set-up-gotestsum
-      - run: mkdir -p ${{ steps.metadata.outputs.go-test-dir }}
-      - uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
-        if: inputs.test-timing-cache-enabled
+      - uses: ./.github/actions/set-up-go
+        with:
+          github-token: ${{ steps.global-metadata.outputs.is-ent-repo == 'true' && steps.secrets.outputs.github-token || secrets.ELEVATED_GITHUB_TOKEN }}
+      - uses: ./.github/actions/install-tools # for gotestsum
+      - run: mkdir -p ${{ steps.local-metadata.outputs.go-test-dir }}
+      - if: inputs.test-timing-cache-restore || inputs.test-timing-cache-save
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
-          path: ${{ steps.metadata.outputs.go-test-dir }}
+          path: ${{ steps.local-metadata.outputs.go-test-dir }}
           key: ${{ inputs.test-timing-cache-key }}-${{ github.run_number }}
           restore-keys: |
             ${{ inputs.test-timing-cache-key }}-
+            go-test-timing-
       - name: Sanitize timing files
         id: sanitize-timing-files
         run: |
           # Prune invalid timing files
-          find '${{ steps.metadata.outputs.go-test-dir }}' -mindepth 1 -type f -name "*.json" -exec sh -c '
+          find '${{ steps.local-metadata.outputs.go-test-dir }}' -mindepth 1 -type f -name "*.json" -exec sh -c '
             file="$1";
             jq . "$file" || rm "$file"
           ' shell {} \; > /dev/null 2>&1
-      - name: Build matrix excluding binary, integration, and testonly tests
+      - if: ${{ !inputs.testonly }}
+        name: Build matrix excluding binary, integration, and testonly tests
         id: build-non-binary
-        if: ${{ !inputs.testonly }}
         env:
           GOPRIVATE: github.com/hashicorp/*
         run: |
@@ -158,10 +170,10 @@ jobs:
           (
             make all-packages | grep -v "_binary" | grep -v "vault/integ" | grep -v "testonly" | gotestsum tool ci-matrix --debug \
               --partitions "${{ inputs.total-runners }}" \
-              --timing-files '${{ steps.metadata.outputs.go-test-dir }}/*.json' > matrix.json
+              --timing-files '${{ steps.local-metadata.outputs.go-test-dir }}/*.json' > matrix.json
           )
-      - name: Build matrix for tests tagged with testonly
-        if: ${{ inputs.testonly }}
+      - if: ${{ inputs.testonly }}
+        name: Build matrix for tests tagged with testonly
         env:
           GOPRIVATE: github.com/hashicorp/*
         run: |
@@ -173,12 +185,12 @@ jobs:
           (
             go list -tags=testonly ./vault/external_tests/{kv,token,*replication-perf*,*testonly*} ./command/*testonly* ./vault/ | gotestsum tool ci-matrix --debug \
               --partitions "${{ inputs.total-runners }}" \
-              --timing-files '${{ steps.metadata.outputs.go-test-dir }}/*.json' > matrix.json
+              --timing-files '${{ steps.local-metadata.outputs.go-test-dir }}/*.json' > matrix.json
           )
           # disable glob expansion
           shopt -u nullglob
-      - name: Capture list of binary tests
-        if: inputs.binary-tests
+      - if: inputs.binary-tests
+        name: Capture list of binary tests
         id: list-binary-tests
         run: |
           LIST="$(make all-packages | grep "_binary" | xargs)"
@@ -230,7 +242,7 @@ jobs:
       go-test-results-download-pattern: ${{ steps.metadata.outputs.go-test-results-download-pattern }}
       data-race-log-download-pattern: ${{ steps.metadata.outputs.data-race-log-download-pattern }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.checkout-ref }}
       - uses: ./.github/actions/set-up-go
@@ -243,24 +255,26 @@ jobs:
           # Example comments assume:
           #   - needs.test-matrix.outputs.go-test-dir == test-results/go-test
           #   - inputs.name == testonly
+          #   - inputs.checkout-ref == main
           #   - matrix.id == 1
-          name='${{ inputs.name }}-${{ matrix.id }}'                                    # testonly-1
+          ref="$(tr / - <<< "${{ inputs.checkout-ref }}")"                              # main, but removes special characters from refs with /
+          name="${{ inputs.name }}-${ref}-${{ matrix.id }}"                             # testonly-main-1
           go_test_dir='${{ needs.test-matrix.outputs.go-test-dir }}'                    # test-results/go-test
           test_results_dir="$(dirname "$go_test_dir")"                                  # test-results
           go_test_dir_absolute="$(pwd)/${go_test_dir}"                                  # /home/runner/work/vault/vault/test-results/go-test
           go_test_log_dir="${go_test_dir}/logs"                                         # test-results/go-test/logs
           go_test_log_dir_absolute="${go_test_dir_absolute}/logs"                       # /home/runner/work/vault/vault/test-results/go-test/logs
-          go_test_log_archive_name="test-logs-${name}.tar"                              # test-logs-testonly-1.tar
-          go_test_results_upload_key="${test_results_dir}-${name}"                      # test-results/go-test-testonly-1
-          go_test_results_download_pattern="${test_results_dir}-${{ inputs.name }}-*"   # test-results/go-test-testonly-*
+          go_test_log_archive_name="test-logs-${name}.tar"                              # test-logs-testonly-main-1.tar
+          go_test_results_upload_key="${test_results_dir}-${name}"                      # test-results/go-test-testonly-main-1
+          go_test_results_download_pattern="${test_results_dir}-${{ inputs.name }}-*"   # test-results/go-test-testonly-main-*
           gotestsum_results_prefix="results"                                            # results
-          gotestsum_junitfile=${go_test_dir}/${gotestsum_results_prefix}-${name}.xml    # test-results/go-test/results-testonly-1.xml
-          gotestsum_jsonfile=${go_test_dir}/${gotestsum_results_prefix}-${name}.json    # test-results/go-test/results-testonly-1.json
-          gotestsum_timing_events=failure-summary-${name}.json                          # failure-summary-testonly-1.json
-          failure_summary_file_name="failure-summary-${name}.md"                        # failure-summary-testonly-1.md
+          gotestsum_junitfile=${go_test_dir}/${gotestsum_results_prefix}-${name}.xml    # test-results/go-test/results-testonly-main-1.xml
+          gotestsum_jsonfile=${go_test_dir}/${gotestsum_results_prefix}-${name}.json    # test-results/go-test/results-testonly-main-1.json
+          gotestsum_timing_events=failure-summary-${name}.json                          # failure-summary-testonly-main-1.json
+          failure_summary_file_name="failure-summary-${name}.md"                        # failure-summary-testonly-main-1.md
           data_race_log_file="data-race.log"                                            # data-race.log
-          data_race_log_download_pattern="data-race-${{ inputs.name }}*.log"            # data-race-testonly-*.log
-          data_race_log_upload_key="data-race-${name}.log"                              # data-race-testonly-1.log
+          data_race_log_download_pattern="data-race-${{ inputs.name }}*.log"            # data-race-testonly-main-*.log
+          data_race_log_upload_key="data-race-${name}.log"                              # data-race-testonly-main-1.log
           {
             echo "name=${name}"
             echo "failure-summary-file-name=${failure_summary_file_name}"
@@ -278,14 +292,14 @@ jobs:
             echo "gotestsum-results-prefix=${gotestsum_results_prefix}"
             echo "gotestsum-timing-events=${gotestsum_timing_events}"
           } | tee -a "$GITHUB_OUTPUT"
-      - name: Authenticate to Vault
+      - if: needs.test-matrix.outputs.is-ent-repo == 'true'
+        name: Authenticate to Vault
         id: vault-auth
-        if: github.repository == 'hashicorp/vault-enterprise'
         run: vault-auth
-      - name: Fetch Secrets
+      - if: needs.test-matrix.outputs.is-ent-repo == 'true'
+        name: Fetch Secrets
         id: secrets
-        if: github.repository == 'hashicorp/vault-enterprise'
-        uses: hashicorp/vault-action@9f522b85981b491eab9a52c144d15aedbd0bf371 # v2.8.0
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
         with:
           url: ${{ steps.vault-auth.outputs.addr }}
           caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
@@ -295,26 +309,35 @@ jobs:
             kv/data/github/${{ github.repository }}/github-token username-and-token | github-token;
             kv/data/github/${{ github.repository }}/license license_1 | VAULT_LICENSE_CI;
             kv/data/github/${{ github.repository }}/license license_2 | VAULT_LICENSE_2;
-      - id: setup-git-private
+      - if: needs.test-matrix.outputs.is-ent-repo == 'true'
+        id: setup-git-private
         name: Setup Git configuration (private)
-        if: github.repository == 'hashicorp/vault-enterprise'
         run: |
           git config --global url."https://${{ steps.secrets.outputs.github-token }}@github.com".insteadOf https://github.com
-      - id: setup-git-public
+      - if: needs.test-matrix.outputs.is-ent-repo != 'true'
+        id: setup-git-public
         name: Setup Git configuration (public)
-        if: github.repository != 'hashicorp/vault-enterprise'
         run: |
           git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
-      - uses: ./.github/actions/install-external-tools
+      - uses: ./.github/actions/install-tools
+      - if: inputs.binary-tests && matrix.id == inputs.total-runners && needs.test-matrix.outputs.is-ent-branch == 'true'
+        name: Build Vault HSM binary for tests
+        env:
+          GOPRIVATE: github.com/hashicorp/*
+        run: |
+          set -exo pipefail
+          time make prep enthsmdev
+          # The subsequent build of vault will blow away the bin folder
+          mv bin/vault vault-hsm-binary
       - if: inputs.binary-tests && matrix.id == inputs.total-runners
         name: Build dev binary for binary tests
         # The dev mode binary has to exist for binary tests that are dispatched on the last runner.
         env:
           GOPRIVATE: github.com/hashicorp/*
         run: time make prep dev
-      - name: Install gVisor
+      - if: needs.test-matrix.outputs.is-ent-repo != 'true'
         # Enterprise repo runners do not allow sudo, so can't install gVisor there yet.
-        if: github.repository != 'hashicorp/vault-enterprise'
+        name: Install gVisor
         run: |
           (
             set -e
@@ -341,30 +364,6 @@ jobs:
           }
           EOF
           sudo systemctl reload docker
-      - name: Install rootless Docker
-        # Enterprise repo runners do not allow sudo, so can't system packages there yet.
-        if: github.repository != 'hashicorp/vault-enterprise'
-        run: |
-          sudo apt-get install -y uidmap dbus-user-session
-          export FORCE_ROOTLESS_INSTALL=1
-          curl -fsSL https://get.docker.com/rootless | sh
-          mkdir -p ~/.config/docker/
-          tee ~/.config/docker/daemon.json  <<EOF
-          {
-            "runtimes": {
-              "runsc": {
-                "path": "/usr/local/bin/runsc",
-                "runtimeArgs": [
-                  "--host-uds=create",
-                  "--ignore-cgroups"
-                ]
-              }
-            }
-          }
-          EOF
-          systemctl --user restart docker
-          # Ensure the original rootful Docker install is still the default.
-          docker context use default
       - id: run-go-tests
         name: Run Go tests
         timeout-minutes: ${{ fromJSON(env.TIMEOUT_IN_MINUTES) }}
@@ -400,6 +399,11 @@ jobs:
           # parallelism.  The default if -p isn't specified is to use NumCPUs, which seems fine for regular tests.
           package_parallelism=""
 
+          if [ -f vault-hsm-binary ]; then
+            VAULT_HSM_BINARY="$(pwd)/vault-hsm-binary"
+            export VAULT_HSM_BINARY
+          fi
+
           if [ -f bin/vault ]; then
             VAULT_BINARY="$(pwd)/bin/vault"
             export VAULT_BINARY
@@ -407,15 +411,10 @@ jobs:
             package_parallelism="-p 2"
           fi
 
-          # On a release branch, add a flag to rerun failed tests
-          # shellcheck disable=SC2193 # can get false positive for this comparision
-          if [[  "${{ github.base_ref }}" == release/* ]] || [[  -z "${{ github.base_ref }}" && "${{ github.ref_name }}" == release/* ]]
-          then
-            # TODO remove this extra condition once 1.15 is about to released GA
-            if [[  "${{ github.base_ref }}" != release/1.15* ]] || [[  -z "${{ github.base_ref }}" && "${{ github.ref_name }}" != release/1.15* ]]
-            then
+          # If running Go tests on the enterprise repo, add a flag to rerun failed tests.
+          # This is to address the issues with flaky tests affecting the reliability of CI.
+          if [[  "${{github.repository}}" == 'hashicorp/vault-enterprise' ]]; then
               RERUN_FAILS="--rerun-fails"
-            fi
           fi
 
           VAULT_TEST_LOG_DIR='${{ steps.metadata.outputs.go-test-log-dir-absolute }}'
@@ -432,11 +431,11 @@ jobs:
               -- \
               $package_parallelism \
               -tags "${{ inputs.go-tags }}" \
-              -timeout=${{ env.TIMEOUT_IN_MINUTES }}m \
+              -timeout=${{ inputs.go-test-timeout }} \
               -parallel=${{ inputs.go-test-parallelism }} \
               ${{ inputs.extra-flags }} \
-      - name: Prepare datadog-ci
-        if: (github.repository == 'hashicorp/vault' || github.repository == 'hashicorp/vault-enterprise') && (success() || failure())
+      - if: (github.repository == 'hashicorp/vault' || github.repository == 'hashicorp/vault-enterprise') && (success() || failure())
+        name: Prepare datadog-ci
         continue-on-error: true
         run: |
           if type datadog-ci > /dev/null 2>&1; then
@@ -451,7 +450,8 @@ jobs:
             printf "failed to download datadog-ci: %s" "$out"
           fi
           chmod +x /usr/local/bin/datadog-ci
-      - name: Upload test results to DataDog
+      - if: success() || failure()
+        name: Upload test results to DataDog
         continue-on-error: true
         env:
           DD_ENV: ci
@@ -460,24 +460,23 @@ jobs:
             export DATADOG_API_KEY=${{ secrets.DATADOG_API_KEY }}
           fi
           datadog-ci junit upload --service "$GITHUB_REPOSITORY" '${{ steps.metadata.outputs.gotestsum-junitfile }}'
-        if: success() || failure()
-      - name: Archive test logs
-        if: always()
+      - if: success() || failure()
+        name: Archive test logs
         id: archive-test-logs
         # actions/upload-artifact will compress the artifact for us. We create a tarball to preserve
         # permissions and to support file names with special characters.
         run: |
           tar -cvf '${{ steps.metadata.outputs.go-test-log-archive-name }}' -C "${{ steps.metadata.outputs.go-test-log-dir }}" .
-      - name: Upload test logs archives
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+      - if: success() || failure()
+        name: Upload test logs archives
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ steps.metadata.outputs.go-test-log-archive-name }}
           path: ${{ steps.metadata.outputs.go-test-log-archive-name }}
           retention-days: 7
-        if: success() || failure()
-      - name: Upload test results
-        if: success() || failure()
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+      - if: success() || failure()
+        name: Upload test results
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ steps.metadata.outputs.go-test-results-upload-key }}
           path: |
@@ -485,8 +484,8 @@ jobs:
             ${{ steps.metadata.outputs.go-test-dir }}/${{ steps.metadata.outputs.gotestsum-results-prefix}}*.xml
           # We cache relevant timing data with actions/cache later so we can let the file expire quickly
           retention-days: 1
-      - name: Check for data race failures
-        if: success() || failure()
+      - if: success() || failure()
+        name: Check for data race failures
         id: data-race-check
         working-directory: ${{ needs.test-matrix.outputs.go-test-dir }}
         run: |
@@ -513,11 +512,9 @@ jobs:
             result="failure"
           fi
           echo "data-race-result=${result}" | tee -a "$GITHUB_OUTPUT"
-      - name: Upload data race detector failure log
-        if: |
-          (success() || failure()) &&
-          steps.data-race-check.outputs.data-race-result == 'failure'
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+      - if: (success() || failure()) && steps.data-race-check.outputs.data-race-result == 'failure'
+        name: Upload data race detector failure log
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ steps.metadata.outputs.data-race-log-upload-key }}
           path: ${{ steps.metadata.outputs.go-test-dir }}/${{ steps.metadata.outputs.data-race-log-file }}
@@ -527,9 +524,9 @@ jobs:
           if-no-files-found: error # Make sure we always upload the data race logs if it failed
       # GitHub Actions doesn't expose the job ID or the URL to the job execution,
       # so we have to fetch it from the API
-      - name: Fetch job logs URL
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        if: success() || failure()
+      - if: success() || failure()
+        name: Fetch job logs URL
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         continue-on-error: true
         with:
           retries: 3
@@ -576,8 +573,8 @@ jobs:
               console.log("Error: " + error);
               return
             }
-      - name: Prepare failure summary
-        if: success() || failure()
+      - if: success() || failure()
+        name: Prepare failure summary
         continue-on-error: true
         run: |
           # This jq query filters out successful tests, leaving only the failures.
@@ -589,9 +586,9 @@ jobs:
           | "| ${{inputs.name}} | \(.Package) | \(.Test // "-") | \(.Elapsed) | ${{ matrix.id }} | [view test results :scroll:](${{ env.GH_JOB_URL }}) |"' \
           '${{ steps.metadata.outputs.gotestsum-timing-events }}' \
           >> '${{ steps.metadata.outputs.failure-summary-file-name }}'
-      - name: Upload failure summary
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
-        if: success() || failure()
+      - if: success() || failure()
+        name: Upload failure summary
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ steps.metadata.outputs.failure-summary-file-name }}
           path: ${{ steps.metadata.outputs.failure-summary-file-name }}
@@ -608,7 +605,7 @@ jobs:
       data-race-output: ${{ steps.status.outputs.data-race-output }}
       data-race-result: ${{ steps.status.outputs.data-race-result }}
     steps:
-      - uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
+      - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           pattern: ${{ needs.test-go.outputs.data-race-log-download-pattern }}
           path: data-race-logs
@@ -649,20 +646,21 @@ jobs:
             echo "test-go-results=${test_go_results}"
           } | tee -a "$GITHUB_OUTPUT"
       # Aggregate, prune, and cache our timing data
-      - if: ${{ ! cancelled() && needs.test-go.result == 'success' && inputs.test-timing-cache-enabled }}
-        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+      - if: ${{ ! cancelled() && needs.test-go.result == 'success' && inputs.test-timing-cache-save }}
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ needs.test-matrix.outputs.go-test-dir }}
           key: ${{ inputs.test-timing-cache-key }}-${{ github.run_number }}
           restore-keys: |
             ${{ inputs.test-timing-cache-key }}-
-      - if: ${{ ! cancelled() && needs.test-go.result == 'success' && inputs.test-timing-cache-enabled }}
-        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
+            go-test-timing-
+      - if: ${{ ! cancelled() && needs.test-go.result == 'success' && inputs.test-timing-cache-save }}
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           path: ${{ needs.test-matrix.outputs.go-test-dir }}
           pattern: ${{ needs.test-go.outputs.go-test-results-download-pattern }}
           merge-multiple: true
-      - if: ${{ ! cancelled() && needs.test-go.result == 'success' && inputs.test-timing-cache-enabled }}
+      - if: ${{ ! cancelled() && needs.test-go.result == 'success' && inputs.test-timing-cache-save }}
         name: Prune any invalid timing files
         run: |
           ls -lhR '${{ needs.test-matrix.outputs.go-test-dir }}'
diff --git a/.github/workflows/test-run-acc-tests-for-path.yml b/.github/workflows/test-run-acc-tests-for-path.yml
index 8ab606dd481..ba157a4df40 100644
--- a/.github/workflows/test-run-acc-tests-for-path.yml
+++ b/.github/workflows/test-run-acc-tests-for-path.yml
@@ -18,14 +18,14 @@ env:
 
 jobs:
   go-test:
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       - run: go test -v ./${{ inputs.path }}/... 2>&1 | tee ${{ inputs.name }}.txt
-      - uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ inputs.name }}-output
           path: ${{ inputs.name }}.txt
diff --git a/.github/workflows/test-run-enos-scenario-cloud.yml b/.github/workflows/test-run-enos-scenario-cloud.yml
new file mode 100644
index 00000000000..22e2b192dad
--- /dev/null
+++ b/.github/workflows/test-run-enos-scenario-cloud.yml
@@ -0,0 +1,14 @@
+---
+name: enos-cloud
+
+on:
+  workflow_call:
+    inputs:
+      product-version:
+        type: string
+
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+      - run: exit 0
diff --git a/.github/workflows/test-run-enos-scenario-containers.yml b/.github/workflows/test-run-enos-scenario-containers.yml
new file mode 100644
index 00000000000..de242a16a74
--- /dev/null
+++ b/.github/workflows/test-run-enos-scenario-containers.yml
@@ -0,0 +1,143 @@
+---
+name: enos-containers
+
+on:
+  # Only trigger this working using workflow_call. This workflow requires many
+  # secrets that must be inherited from the caller workflow.
+  workflow_call:
+    inputs:
+      # The name of the artifact that we're going to use for testing. This should
+      # match exactly to build artifacts uploaded to Github and Artifactory.
+      build-artifact-name:
+        required: true
+        type: string
+      # The maximum number of scenarios to include in the test sample.
+      sample-max:
+        default: 1
+        type: number
+      # The name of the enos scenario sample that defines compatible scenarios we can
+      # can test with.
+      sample-name:
+        required: true
+        type: string
+      vault-edition:
+        required: false
+        type: string
+        default: ce
+      # The Git commit SHA used as the revision when building vault
+      vault-revision:
+        required: true
+        type: string
+      vault-version:
+        required: true
+        type: string
+
+jobs:
+  metadata:
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
+    outputs:
+      build-date: ${{ steps.metadata.outputs.build-date }}
+      is-ent-repo: ${{ steps.global-metadata.outputs.is-ent-repo }}
+      sample: ${{ steps.metadata.outputs.sample }}
+      vault-version: ${{ steps.metadata.outputs.vault-version }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ inputs.vault-revision }}
+      - uses: hashicorp/action-setup-enos@39a8f388434bea5eeba6649b99aa9949a55a1150 # v1.38
+        with:
+          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      - uses: ./.github/actions/metadata
+        id: global-metadata
+      - id: metadata
+        run: |
+          build_date=$(make ci-get-date)
+          sample_seed=$(date +%s)
+          if ! sample=$(enos scenario sample observe "${{ inputs.sample-name }}" --chdir ./enos/k8s --min 1 --max "${{ inputs.sample-max }}" --seed "${sample_seed}" --format json | jq -c ".observation.elements"); then
+            echo "failed to do sample observation: $sample" 2>&1
+            exit 1
+          fi
+          if [[ "${{ inputs.vault-edition }}" == "ce" ]]; then
+            vault_version="${{ inputs.vault-version }}"
+          else
+            # shellcheck disable=2001
+            vault_version="$(sed 's/+ent/+${{ inputs.vault-edition }}/g' <<< '${{ inputs.vault-version }}')"
+          fi
+          {
+            echo "build-date=${build_date}"
+            echo "vault-version=${vault_version}"
+            echo "sample=${sample}"
+            echo "sample-seed=${sample_seed}" # This isn't used outside of here but is nice to know for duplicating observations
+          } | tee -a "$GITHUB_OUTPUT"
+
+  run:
+    needs: metadata
+    name: run ${{ matrix.scenario.id.filter }}
+    runs-on: ${{ fromJSON(needs.metadata.outputs.is-ent-repo == 'true' && (contains(inputs.build-artifact-name, 'arm64') && '["self-hosted","ondemand","os=ubuntu-arm","type=c6g.xlarge"]' || '["self-hosted","ubuntu-latest-x64"]') || (contains(inputs.build-artifact-name, 'arm64') && '"ubuntu-22.04-arm"' || '"ubuntu-latest"')) }}
+    strategy:
+      fail-fast: false # don't fail as that can skip required cleanup steps for jobs
+      matrix:
+        include: ${{ fromJSON(needs.metadata.outputs.sample) }}
+    env:
+      GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        with:
+          # the Terraform wrapper will break Terraform execution in Enos because
+          # it changes the output to text when we expect it to be JSON.
+          terraform_wrapper: false
+      - uses: hashicorp/action-setup-enos@39a8f388434bea5eeba6649b99aa9949a55a1150 # v1.38
+        with:
+          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      - name: Download Docker Image
+        id: download
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: ${{ inputs.build-artifact-name }}
+          path: ./enos/support/downloads
+      - if: inputs.vault-edition != 'ce'
+        name: Configure license
+        run: |
+          echo "${{ secrets.VAULT_LICENSE }}" > ./enos/support/vault.hclic || true
+      - name: Run Enos scenario
+        id: run
+        # Continue once and retry to handle occasional blips when creating
+        # infrastructure.
+        continue-on-error: true
+        env:
+          ENOS_VAR_terraform_plugin_cache_dir: ../support/terraform-plugin-cache
+          ENOS_VAR_vault_build_date: ${{ needs.metadata.outputs.build-date }}
+          ENOS_VAR_vault_version: ${{ needs.metadata.outputs.vault-version }}
+          ENOS_VAR_vault_revision: ${{ inputs.vault-revision }}
+          ENOS_VAR_container_image_archive: ${{steps.download.outputs.download-path}}/${{ inputs.build-artifact-name }}
+        run: |
+          mkdir -p ./enos/support/terraform-plugin-cache
+          enos scenario run --timeout 10m0s --chdir ./enos/k8s ${{ matrix.scenario.id.filter }}
+      - name: Retry Enos scenario
+        id: run_retry
+        if: steps.run.outcome == 'failure'
+        env:
+          ENOS_VAR_terraform_plugin_cache_dir: ../support/terraform-plugin-cache
+          ENOS_VAR_vault_build_date: ${{ needs.metadata.outputs.build-date }}
+          ENOS_VAR_vault_version: ${{ needs.metadata.outputs.vault-version }}
+          ENOS_VAR_vault_revision: ${{ inputs.vault-revision }}
+          ENOS_VAR_container_image_archive: ${{steps.download.outputs.download-path}}/${{ inputs.build-artifact-name }}
+        run: |
+          enos scenario run --timeout 10m0s --chdir ./enos/k8s ${{ matrix.scenario.id.filter }}
+      - name: Destroy Enos scenario
+        if: ${{ always() }}
+        env:
+          ENOS_VAR_terraform_plugin_cache_dir: ../support/terraform-plugin-cache
+          ENOS_VAR_vault_build_date: ${{ needs.metadata.outputs.build-date }}
+          ENOS_VAR_vault_version: ${{ needs.metadata.outputs.vault-version }}
+          ENOS_VAR_vault_revision: ${{ inputs.vault-revision }}
+          ENOS_VAR_container_image_archive: ${{steps.download.outputs.download-path}}/${{ inputs.build-artifact-name }}
+        run: |
+          enos scenario destroy --timeout 10m0s --grpc-listen http://localhost --chdir ./enos/k8s ${{ matrix.scenario.id.filter }}
+      - name: Cleanup Enos runtime directories
+        if: ${{ always() }}
+        run: |
+          rm -rf /tmp/enos*
+          rm -rf ./enos/support
+          rm -rf ./enos/k8s/.enos
diff --git a/.github/workflows/test-run-enos-scenario-matrix.yml b/.github/workflows/test-run-enos-scenario-matrix.yml
index b7f291d135d..d22aed2886d 100644
--- a/.github/workflows/test-run-enos-scenario-matrix.yml
+++ b/.github/workflows/test-run-enos-scenario-matrix.yml
@@ -44,22 +44,48 @@ on:
 jobs:
   metadata:
     runs-on: ${{ fromJSON(inputs.runs-on) }}
+    permissions:
+      id-token: write # vault-auth
+      contents: read
     outputs:
       build-date: ${{ steps.metadata.outputs.build-date }}
+      is-ent-repo: ${{ steps.metadata.outputs.is-ent-repo }}
       sample: ${{ steps.metadata.outputs.sample }}
       vault-version: ${{ steps.metadata.outputs.vault-version }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.vault-revision }}
-      - uses: hashicorp/action-setup-enos@v1
+      - if: inputs.vault-edition != 'ce'
+        id: vault-auth
+        name: Vault Authenticate
+        run: vault-auth
+      - if: inputs.vault-edition != 'ce'
+        id: vault-secrets
+        name: Fetch Vault Secrets
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
         with:
-          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+            kv/data/github/${{ github.repository }}/github-token token | ELEVATED_GITHUB_TOKEN;
+      - uses: hashicorp/action-setup-enos@39a8f388434bea5eeba6649b99aa9949a55a1150 # v1.38
+        with:
+          github-token: ${{ github.repository == 'hashicorp/vault' && secrets.ELEVATED_GITHUB_TOKEN || steps.vault-secrets.outputs.ELEVATED_GITHUB_TOKEN }}
+      - uses: ./.github/actions/create-dynamic-config
+        with:
+          github-token: ${{ github.repository == 'hashicorp/vault' && secrets.ELEVATED_GITHUB_TOKEN || steps.vault-secrets.outputs.ELEVATED_GITHUB_TOKEN }}
+          vault-version: ${{ inputs.vault-version }}
+          vault-edition: ${{ inputs.vault-edition }}
       - id: metadata
         run: |
           build_date=$(make ci-get-date)
-          sample_seed=$(date +%s%N)
-          sample=$(enos scenario sample observe "${{ inputs.sample-name }}" --chdir ./enos --min 1 --max "${{ inputs.sample-max }}" --seed "${sample_seed}" --format json | jq -c ".observation.elements")
+          sample_seed=$(date +%s)
+          if ! sample=$(enos scenario sample observe "${{ inputs.sample-name }}" --chdir ./enos --min 1 --max "${{ inputs.sample-max }}" --seed "${sample_seed}" --format json | jq -c ".observation.elements"); then
+            echo "failed to do sample observation: $sample" 2>&1
+            exit 1
+          fi
           if [[ "${{ inputs.vault-edition }}" == "ce" ]]; then
             vault_version="${{ inputs.vault-version }}"
           else
@@ -68,9 +94,10 @@ jobs:
           fi
           {
             echo "build-date=${build_date}"
-            echo "vault-version=${vault_version}"
+            echo 'is-ent-repo=${{ github.repository == 'hashicorp/vault-enterprise' }}'
             echo "sample=${sample}"
             echo "sample-seed=${sample_seed}" # This isn't used outside of here but is nice to know for duplicating observations
+            echo "vault-version=${vault_version}"
           } | tee -a "$GITHUB_OUTPUT"
 
   # Run the Enos test scenario(s)
@@ -82,70 +109,156 @@ jobs:
       matrix:
         include: ${{ fromJSON(needs.metadata.outputs.sample) }}
     runs-on: ${{ fromJSON(inputs.runs-on) }}
-    env:
-      GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
-      # Pass in enos variables
-      ENOS_VAR_aws_region: ${{ matrix.attributes.aws_region }}
-      ENOS_VAR_aws_ssh_keypair_name: ${{ inputs.ssh-key-name }}
-      ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
-      ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
-      ENOS_VAR_artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
-      ENOS_VAR_artifactory_token: ${{ secrets.ARTIFACTORY_TOKEN }}
-      ENOS_VAR_terraform_plugin_cache_dir: ./support/terraform-plugin-cache
-      ENOS_VAR_vault_artifact_path: ./support/downloads/${{ inputs.build-artifact-name }}
-      ENOS_VAR_vault_build_date: ${{ needs.metadata.outputs.build-date }}
-      ENOS_VAR_vault_product_version: ${{ needs.metadata.outputs.vault-version }}
-      ENOS_VAR_vault_revision: ${{ inputs.vault-revision }}
-      ENOS_VAR_vault_license_path: ./support/vault.hclic
-      ENOS_DEBUG_DATA_ROOT_DIR: /tmp/enos-debug-data
+    permissions:
+      id-token: write # vault-auth
+      contents: read
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           ref: ${{ inputs.vault-revision }}
-      - uses: hashicorp/setup-terraform@v3
+      - if: needs.metadata.outputs.is-ent-repo == 'true'
+        id: vault-auth
+        name: Vault Authenticate
+        run: vault-auth
+      - if: needs.metadata.outputs.is-ent-repo == 'true'
+        id: vault-secrets
+        name: Fetch Vault Secrets
+        uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
+        with:
+          url: ${{ steps.vault-auth.outputs.addr }}
+          caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+          token: ${{ steps.vault-auth.outputs.token }}
+          secrets: |
+            kv/data/github/${{ github.repository }}/artifactory bearer-token | ARTIFACTORY_BEARER_TOKEN;
+            kv/data/github/${{ github.repository }}/aws access-key-id_09042025 | AWS_ACCESS_KEY_ID_CI_09042025;
+            kv/data/github/${{ github.repository }}/aws secret-access-key_09042025 | AWS_SECRET_ACCESS_KEY_CI_09042025;
+            kv/data/github/${{ github.repository }}/aws role-arn | AWS_ROLE_ARN_CI;
+            kv/data/github/${{ github.repository }}/consul license | CONSUL_LICENSE;
+            kv/data/github/${{ github.repository }}/vault-radar license | RADAR_LICENSE;
+            kv/data/github/${{ github.repository }}/slack feed-vault-enos-failures-webhook-url | SLACK_WEBHOOK_URL;
+            kv/data/github/${{ github.repository }}/enos ssh-key | SSH_KEY_PRIVATE_CI;
+            kv/data/github/${{ github.repository }}/license license_1 | VAULT_LICENSE;
+            kv/data/github/${{ github.repository }}/github-token token | ELEVATED_GITHUB_TOKEN;
+      - id: secrets
+        run: |
+          if [[ "${{ needs.metadata.outputs.is-ent-repo }}" != 'true' ]]; then
+            {
+              echo 'artifactory-token=${{ secrets.ARTIFACTORY_BEARER_TOKEN }}'
+              echo 'aws-access-key-id=${{ secrets.AWS_ACCESS_KEY_ID_CI_09042025 }}'
+              echo 'aws-secret-access-key=${{ secrets.AWS_SECRET_ACCESS_KEY_CI_09042025 }}'
+              echo 'aws-role-arn=${{ secrets.AWS_ROLE_ARN_CI }}'
+              echo 'consul-license=${{ secrets.CONSUL_LICENSE }}'
+              echo 'github-token=${{ secrets.ELEVATED_GITHUB_TOKEN }}'
+              echo 'radar-license=${{ secrets.RADAR_LICENSE }}'
+              echo 'slack-webhook-url=${{ secrets.FEED_VAULT_ENOS_FAILURES_WEBHOOK_URL }}'
+              echo 'ssh-key<<EOFSSHKEYCE'
+              echo "${{ secrets.SSH_KEY_PRIVATE_CI }}"
+              echo EOFSSHKEYCE
+              echo 'vault-license=${{ secrets.VAULT_LICENSE }}'
+           } | tee -a "$GITHUB_OUTPUT"
+          else
+            {
+              echo 'artifactory-token=${{ steps.vault-secrets.outputs.ARTIFACTORY_BEARER_TOKEN }}'
+              echo 'aws-access-key-id=${{ steps.vault-secrets.outputs.AWS_ACCESS_KEY_ID_CI_09042025 }}'
+              echo 'aws-secret-access-key=${{ steps.vault-secrets.outputs.AWS_SECRET_ACCESS_KEY_CI_09042025 }}'
+              echo 'aws-role-arn=${{ steps.vault-secrets.outputs.AWS_ROLE_ARN_CI }}'
+              echo 'consul-license=${{ steps.vault-secrets.outputs.CONSUL_LICENSE }}'
+              echo 'github-token=${{ steps.vault-secrets.outputs.ELEVATED_GITHUB_TOKEN }}'
+              echo 'radar-license=${{ steps.vault-secrets.outputs.RADAR_LICENSE }}'
+              echo 'slack-webhook-url=${{ steps.vault-secrets.outputs.SLACK_WEBHOOK_URL }}'
+              echo 'ssh-key<<EOFSSHKEYENT'
+              echo "${{ steps.vault-secrets.outputs.SSH_KEY_PRIVATE_CI }}"
+              echo EOFSSHKEYENT
+              echo 'vault-license=${{ steps.vault-secrets.outputs.VAULT_LICENSE }}'
+            } | tee -a "$GITHUB_OUTPUT"
+          fi
+      - id: env
+        run: |
+          # Configure input environment variables.
+          {
+            echo 'GITHUB_TOKEN=${{ steps.secrets.outputs.github-token }}'
+            echo 'ENOS_DEBUG_DATA_ROOT_DIR=/tmp/enos-debug-data'
+            echo 'ENOS_VAR_artifactory_token=${{ steps.secrets.outputs.artifactory-token }}'
+            echo 'ENOS_VAR_aws_region=${{ matrix.attributes.aws_region }}'
+            echo 'ENOS_VAR_aws_ssh_keypair_name=${{ inputs.ssh-key-name }}'
+            echo 'ENOS_VAR_aws_ssh_private_key_path=./support/private_key.pem'
+            echo 'ENOS_VAR_consul_license_path=./support/consul.hclic'
+            echo 'ENOS_VAR_distro_version_amzn=${{ matrix.attributes.distro_version_amzn }}'
+            echo 'ENOS_VAR_distro_version_leap=${{ matrix.attributes.distro_version_leap }}'
+            echo 'ENOS_VAR_distro_version_rhel=${{ matrix.attributes.distro_version_rhel }}'
+            echo 'ENOS_VAR_distro_version_sles=${{ matrix.attributes.distro_version_sles }}'
+            echo 'ENOS_VAR_distro_version_ubuntu=${{ matrix.attributes.distro_version_ubuntu }}'
+            echo 'ENOS_VAR_terraform_plugin_cache_dir=./support/terraform-plugin-cache'
+            echo 'ENOS_VAR_vault_artifact_path=./support/downloads/${{ inputs.build-artifact-name }}'
+            echo 'ENOS_VAR_vault_build_date=${{ needs.metadata.outputs.build-date }}'
+            echo 'ENOS_VAR_vault_license_path=./support/vault.hclic'
+            echo 'ENOS_VAR_vault_product_version=${{ needs.metadata.outputs.vault-version }}'
+            echo 'ENOS_VAR_vault_radar_license_path=./support/vault-radar.hclic'
+            echo 'ENOS_VAR_vault_revision=${{ inputs.vault-revision }}'
+            echo 'ENOS_VAR_vault_upgrade_initial_version=${{ matrix.attributes.upgrade_initial_version }}'
+            echo 'ENOS_VAR_verify_aws_secrets_engine=false'
+            echo 'ENOS_VAR_verify_kmip_secrets_engine=true'
+            echo 'ENOS_VAR_verify_ldap_secrets_engine=false'
+            echo 'ENOS_VAR_verify_log_secrets=true'
+          } | tee -a "$GITHUB_ENV"
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
         with:
           # the Terraform wrapper will break Terraform execution in Enos because
           # it changes the output to text when we expect it to be JSON.
           terraform_wrapper: false
-      - uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI }}
+          aws-access-key-id: ${{ steps.secrets.outputs.aws-access-key-id }}
+          aws-secret-access-key: ${{ steps.secrets.outputs.aws-secret-access-key }}
           aws-region: ${{ matrix.attributes.aws_region }}
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN_CI }}
+          role-to-assume: ${{ steps.secrets.outputs.aws-role-arn }}
           role-skip-session-tagging: true
           role-duration-seconds: 3600
-      - uses: hashicorp/action-setup-enos@v1
+      - uses: hashicorp/action-setup-enos@39a8f388434bea5eeba6649b99aa9949a55a1150 # v1.38
         with:
-          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          github-token: ${{ steps.secrets.outputs.github-token }}
+      - uses: ./.github/actions/create-dynamic-config
+        with:
+          github-token: ${{ steps.secrets.outputs.github-token }}
+          vault-version: ${{ inputs.vault-version }}
+          vault-edition: ${{ inputs.vault-edition }}
       - name: Prepare scenario dependencies
         id: prepare_scenario
         run: |
           mkdir -p "./enos/support/terraform-plugin-cache"
-          echo "${{ secrets.SSH_KEY_PRIVATE_CI }}" > "./enos/support/private_key.pem"
+          echo "${{ steps.secrets.outputs.ssh-key }}" > "./enos/support/private_key.pem"
           chmod 600 "./enos/support/private_key.pem"
+          sha256sum "./enos/support/private_key.pem"
+          du -h "./enos/support/private_key.pem"
           echo "debug_data_artifact_name=enos-debug-data_$(echo "${{ matrix.scenario }}" | sed -e 's/ /_/g' | sed -e 's/:/=/g')" >> "$GITHUB_OUTPUT"
       - if: contains(inputs.sample-name, 'build')
-        # Use actions/download-artifact @3.x until https://hashicorp.atlassian.net/browse/HREL-99 is resolved
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: ${{ inputs.build-artifact-name }}
           path: ./enos/support/downloads
       - if: contains(inputs.sample-name, 'ent')
         name: Configure Vault license
-        run: echo "${{ secrets.VAULT_LICENSE }}" > ./enos/support/vault.hclic || true
+        run: echo "${{ steps.secrets.outputs.vault-license }}" > ./enos/support/vault.hclic || true
+      - if: contains(matrix.scenario.id.filter, 'consul_edition:ent')
+        name: Configure Consul license
+        run: |
+          echo "${{ steps.secrets.outputs.consul-license }}" > ./enos/support/consul.hclic || true
+      - name: Configure Vault Radar license
+        run: |
+          echo "${{ steps.secrets.outputs.radar-license }}" > ./enos/support/vault-radar.hclic || true
       - id: launch
         name: enos scenario launch ${{ matrix.scenario.id.filter }}
         # Continue once and retry to handle occasional blips when creating infrastructure.
         continue-on-error: true
-        run: enos scenario launch --timeout 60m0s --chdir ./enos ${{ matrix.scenario.id.filter }}
+        run: enos scenario launch --timeout 45m0s --chdir ./enos ${{ matrix.scenario.id.filter }}
       - if: steps.launch.outcome == 'failure'
         id: launch_retry
         name: Retry enos scenario launch ${{ matrix.scenario.id.filter }}
-        run: enos scenario launch --timeout 60m0s --chdir ./enos ${{ matrix.scenario.id.filter }}
+        run: enos scenario launch --timeout 45m0s --chdir ./enos ${{ matrix.scenario.id.filter }}
       - name: Upload Debug Data
         if: failure()
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           # The name of the artifact is the same as the matrix scenario name with the spaces replaced with underscores and colons replaced by equals.
           name: ${{ steps.prepare_scenario.outputs.debug_data_artifact_name }}
@@ -156,12 +269,12 @@ jobs:
         id: destroy
         name: enos scenario destroy ${{ matrix.scenario.id.filter }}
         continue-on-error: true
-        run: enos scenario destroy --timeout 60m0s --chdir ./enos ${{ matrix.scenario.id.filter }}
+        run: enos scenario destroy --timeout 10m0s --chdir ./enos ${{ matrix.scenario.id.filter }}
       - if: steps.destroy.outcome == 'failure'
         id: destroy_retry
         name: Retry enos scenario destroy ${{ matrix.scenario.id.filter }}
         continue-on-error: true
-        run: enos scenario destroy --timeout 60m0s --chdir ./enos ${{ matrix.scenario.id.filter }}
+        run: enos scenario destroy --timeout 10m0s --chdir ./enos ${{ matrix.scenario.id.filter }}
       - name: Clean up Enos runtime directories
         id: cleanup
         if: ${{ always() }}
@@ -175,29 +288,29 @@ jobs:
       # https://api.slack.com/apps/A05E31CH1LG/incoming-webhooks
       - if: ${{ always() && ! cancelled() }}
         name: Notify launch failed
-        uses: hashicorp/actions-slack-status@v1
+        uses: hashicorp/actions-slack-status@1a3f63b30bd476aee1f3bd6f9d8f2aacc4f14d81 # v2.0.1
         with:
           failure-message: "enos scenario launch ${{ matrix.scenario.id.filter}} failed. \nTriggering event: `${{ github.event_name }}` \nActor: `${{ github.actor }}`"
           status: ${{ steps.launch.outcome }}
-          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+          slack-webhook-url: ${{ steps.secrets.outputs.slack-webhook-url }}
       - if: ${{ always() && ! cancelled() }}
         name: Notify retry launch failed
-        uses: hashicorp/actions-slack-status@v1
+        uses: hashicorp/actions-slack-status@1a3f63b30bd476aee1f3bd6f9d8f2aacc4f14d81 # v2.0.1
         with:
           failure-message: "retry enos scenario launch ${{ matrix.scenario.id.filter}} failed. \nTriggering event: `${{ github.event_name }}` \nActor: `${{ github.actor }}`"
           status: ${{ steps.launch_retry.outcome }}
-          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+          slack-webhook-url: ${{ steps.secrets.outputs.slack-webhook-url }}
       - if: ${{ always() && ! cancelled() }}
         name: Notify destroy failed
-        uses: hashicorp/actions-slack-status@v1
+        uses: hashicorp/actions-slack-status@1a3f63b30bd476aee1f3bd6f9d8f2aacc4f14d81 # v2.0.1
         with:
           failure-message: "enos scenario destroy ${{ matrix.scenario.id.filter}} failed. \nTriggering event: `${{ github.event_name }}` \nActor: `${{ github.actor }}`"
           status: ${{ steps.destroy.outcome }}
-          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+          slack-webhook-url: ${{ steps.secrets.outputs.slack-webhook-url }}
       - if: ${{ always() && ! cancelled() }}
         name: Notify retry destroy failed
-        uses: hashicorp/actions-slack-status@v1
+        uses: hashicorp/actions-slack-status@1a3f63b30bd476aee1f3bd6f9d8f2aacc4f14d81 # v2.0.1
         with:
           failure-message: "retry enos scenario destroy ${{ matrix.scenario.id.filter}} failed. \nTriggering event: `${{ github.event_name }}` \nActor: `${{ github.actor }}`"
           status: ${{ steps.destroy_retry.outcome }}
-          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+          slack-webhook-url: ${{ steps.secrets.outputs.slack-webhook-url }}
diff --git a/.github/workflows/test-run-enos-scenario.yml b/.github/workflows/test-run-enos-scenario.yml
new file mode 100644
index 00000000000..096e649a110
--- /dev/null
+++ b/.github/workflows/test-run-enos-scenario.yml
@@ -0,0 +1,131 @@
+# Reusable workflow called by interactive scenario tests in GHA
+name: Test run Vault Enos scenario
+
+on:
+  workflow_call:
+    inputs:
+      artifact-source:
+        type: string
+        description: "The artifact source to test artifactory or local (use local for current branch)"
+        required: true
+      artifact-type:
+        type: string
+        description: "The Vault artifact type to test"
+        required: true
+      distro:
+        type: string
+        description: "Linux distribution that Vault replication will be tested on"
+        required: true
+      product-version:
+        type: string
+        description: "Vault version to test (vault_product_version)"
+        required: false
+      scenario:
+        type: string
+        description: "Enos test scenario to run"
+        required: true
+      ssh-key-name:
+        type: string
+        default: ${{ github.event.repository.name }}-ci-ssh-key
+      vault-revision:
+        type: string
+        description: "The git SHA of the Vault release (vault_revision)"
+        required: false
+
+jobs:
+  enos-run-vault-interactive-test:
+    name:  Enos run Vault interactive test
+    runs-on: ${{ github.repository == 'hashicorp/vault' && 'ubuntu-latest' || fromJSON('["self-hosted","ubuntu-latest-x64"]') }}
+    permissions: write-all
+    timeout-minutes: 120
+    env:
+      GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      # Pass in enos variables
+      ENOS_VAR_aws_ssh_keypair_name: ${{ inputs.ssh-key-name }}
+      ENOS_VAR_vault_log_level: trace
+      ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
+      ENOS_VAR_tfc_api_token: ${{ secrets.TF_API_TOKEN }}
+      ENOS_VAR_artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
+      ENOS_VAR_artifactory_token: ${{ secrets.ARTIFACTORY_TOKEN }}
+      ENOS_VAR_terraform_plugin_cache_dir: ./support/terraform-plugin-cache
+      ENOS_VAR_vault_license_path: ./support/vault.hclic
+      ENOS_DEBUG_DATA_ROOT_DIR: /tmp/enos-debug-data
+      VAULT_METADATA: ent
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Set product version and revision
+        # If the Vault version and revision are not provided as workflow inputs, incase of
+        # testing local artifact, the environment variables ENOS_VAR_vault_product_version
+        # and ENOS_VAR_vault_revision are set using the current branch
+        id: set-version-sha
+        run: |
+          [[ -n "${{ inputs.product-version }}" ]] && echo "ENOS_VAR_vault_product_version=${{ inputs.product-version }}" >> "$GITHUB_ENV" || echo "ENOS_VAR_vault_product_version=$(make ci-get-version)" >> "$GITHUB_ENV"
+          [[ -n "${{ inputs.vault-revision }}" ]] && echo "ENOS_VAR_vault_revision=${{ inputs.vault-revision }}" >> "$GITHUB_ENV" || echo "ENOS_VAR_vault_revision=$(make ci-get-revision)" >> "$GITHUB_ENV"
+      - uses: ./.github/actions/set-up-go
+        with:
+          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      - name: Configure Git
+        run: git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN }}:@github.com".insteadOf "https://github.com"
+      - name: Set up node
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: 14
+          cache-dependency-path: ui/yarn.lock
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
+        with:
+          # the Terraform wrapper will break Terraform execution in Enos because
+          # it changes the output to text when we expect it to be JSON.
+          terraform_wrapper: false
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI_09042025 }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI_09042025 }}
+          aws-region: 'us-west-1'
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN_CI }}
+          role-skip-session-tagging: true
+          role-duration-seconds: 3600
+      - uses: hashicorp/action-setup-enos@39a8f388434bea5eeba6649b99aa9949a55a1150 # v1.38
+        with:
+          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      - name: Prepare scenario dependencies
+        id: scenario-deps
+        run: |
+          mkdir -p ./enos/support/terraform-plugin-cache
+          mkdir -p /tmp/enos-scenario-logs
+          echo logsdir="/tmp/enos-scenario-logs" >> "$GITHUB_OUTPUT"
+          echo "${{ secrets.SSH_KEY_PRIVATE_CI }}" > ./enos/support/private_key.pem
+          chmod 600 ./enos/support/private_key.pem
+      - name: Setup Vault Enterprise License
+        id: license
+        run: echo "${{ secrets.VAULT_LICENSE }}" > ./enos/support/vault.hclic
+      - name: Run Enos scenario
+        id: run
+        run: enos scenario run --timeout 60m0s --chdir ./enos ${{ inputs.scenario }}
+      - name: Collect logs when scenario fails
+        id: collect_logs
+        if: ${{ always() }}
+        run: |
+          bash -x ./scripts/gha_enos_logs.sh "${{ steps.scenario-deps.outputs.logsdir }}" "${{ inputs.scenario }}" "${{ inputs.distro }}" "${{ inputs.artifact-type }}" 2>/dev/null
+          find "${{ steps.scenario-deps.outputs.logsdir }}" -maxdepth 0 -empty -exec rmdir {} \;
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: ${{ always() }}
+        with:
+          name: enos-scenario-logs
+          path: ${{ steps.scenario-deps.outputs.logsdir }}
+          retention-days: 1
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: ${{ always() }}
+        with:
+          name: enos-debug-data-logs
+          path: ${{ env.ENOS_DEBUG_DATA_ROOT_DIR }}
+          retention-days: 1
+      - name: Ensure scenario has been destroyed
+        if: ${{ always() }}
+        run: enos scenario destroy --timeout 60m0s --grpc-listen http://localhost --chdir ./enos ${{ inputs.scenario }}
+      - name: Clean up Enos runtime directories
+        if: ${{ always() }}
+        run: |
+          rm -rf /tmp/enos*
+          rm -rf ./enos/support
+          rm -rf ./enos/.enos
diff --git a/.gitignore b/.gitignore
index 95e675edf57..fc59cf7fa8f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -55,9 +55,9 @@ Vagrantfile
 !.release/ci.hcl
 !.release/security-scan.hcl
 !.release/linux/package/etc/vault.d/vault.hcl
-!command/agent/config/test-fixtures/*.hcl
-!command/server/test-fixtures/**/*.hcl
 !enos/**/*.hcl
+!**/test-fixtures/**/*.hcl
+!**/testdata/*.hcl
 
 # Enos
 .enos
@@ -133,4 +133,6 @@ website/components/node_modules
 tools/godoctests/.bin
 tools/gonilnilfunctions/.bin
 tools/codechecker/.bin
-.ci-bootstrap
\ No newline at end of file
+tools/pipeline/.bin
+tools/pipeline/pipeline
+.ci-bootstrap
diff --git a/.go-version b/.go-version
index 8819d012cee..61b813d5e63 100644
--- a/.go-version
+++ b/.go-version
@@ -1 +1 @@
-1.21.7
+1.25.2
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 00000000000..f7cf71fd37e
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,39 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: MPL-2.0
+
+version: "2"
+linters:
+  enable:
+    - depguard
+  settings:
+    depguard:
+      rules:
+        main:
+          list-mode: lax
+          files:
+            - ./sdk/**
+          allow:
+            - github.com/hashicorp/go-metrics/compat
+          deny:
+            - pkg: github.com/hashicorp/go-metrics
+              desc: not allowed, use github.com/hashicorp/go-metrics/compat instead
+            - pkg: github.com/armon/go-metrics
+              desc: not allowed, use github.com/hashicorp/go-metrics/compat instead
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/.release/ci.hcl b/.release/ci.hcl
index 69ddf9e4a71..57340bc52a5 100644
--- a/.release/ci.hcl
+++ b/.release/ci.hcl
@@ -1,12 +1,12 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-schema = "1"
+schema = "2"
 
 project "vault" {
   team = "vault"
   slack {
-    notification_channel = "C03RXFX5M4L" // #feed-vault-releases
+    notification_channel = "C09LD1XT5MX" // #feed-vault-releases
   }
   github {
     organization = "hashicorp"
@@ -63,8 +63,8 @@ event "enos-release-testing-oss" {
 ## after the verify event stanza.
 
 event "trigger-staging" {
-// This event is dispatched by the bob trigger-promotion command
-// and is required - do not delete.
+  // This event is dispatched by the bob trigger-promotion command
+  // and is required - do not delete.
 }
 
 event "promote-staging" {
@@ -81,22 +81,9 @@ event "promote-staging" {
   }
 }
 
-event "promote-staging-docker" {
-  depends = ["promote-staging"]
-  action "promote-staging-docker" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "promote-staging-docker"
-  }
-
-  notification {
-    on = "always"
-  }
-}
-
 event "trigger-production" {
-// This event is dispatched by the bob trigger-promotion command
-// and is required - do not delete.
+  // This event is dispatched by the bob trigger-promotion command
+  // and is required - do not delete.
 }
 
 event "promote-production" {
@@ -107,45 +94,10 @@ event "promote-production" {
     workflow = "promote-production"
   }
 
-  notification {
-    on = "always"
-  }
-}
-
-event "promote-production-docker" {
-  depends = ["promote-production"]
-  action "promote-production-docker" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "promote-production-docker"
-  }
-
-  notification {
-    on = "always"
-  }
-}
-
-event "promote-production-packaging" {
-  depends = ["promote-production-docker"]
-  action "promote-production-packaging" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "promote-production-packaging"
-  }
-
-  notification {
-    on = "always"
-  }
-}
-
-# The post-publish-website event should not be merged into the enterprise repo.
-# It is for OSS use only.
-event "post-publish-website" {
-  depends = ["promote-production-packaging"]
-  action "post-publish-website" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "post-publish-website"
+  promotion-events {
+    update-ironbank = true
+    bump-version-patch = true
+    post-publish-website = true
   }
 
   notification {
@@ -153,28 +105,6 @@ event "post-publish-website" {
   }
 }
 
-event "bump-version" {
-  depends = ["post-publish-website"]
-  action "bump-version" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "bump-version"
-  }
-}
-
-event "update-ironbank" {
-  depends = ["bump-version"]
-  action "update-ironbank" {
-    organization = "hashicorp"
-    repository = "crt-workflows-common"
-    workflow = "update-ironbank"
-  }
-
-  notification {
-    on = "fail"
-  }
-}
-
 event "crt-generate-sbom" {
   depends = ["promote-production"]
   action "crt-generate-sbom" {
@@ -182,6 +112,7 @@ event "crt-generate-sbom" {
 	repository = "security-generate-release-sbom"
 	workflow = "crt-generate-sbom"
   }
+
   notification {
 	on = "fail"
   }
diff --git a/.release/docker/docker-entrypoint.sh b/.release/docker/docker-entrypoint.sh
index a3b581697c3..b43a9fcedda 100755
--- a/.release/docker/docker-entrypoint.sh
+++ b/.release/docker/docker-entrypoint.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/dumb-init /bin/sh
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
diff --git a/.release/docker/ubi-docker-entrypoint.sh b/.release/docker/ubi-docker-entrypoint.sh
index dda1260bb8b..8794416225f 100755
--- a/.release/docker/ubi-docker-entrypoint.sh
+++ b/.release/docker/ubi-docker-entrypoint.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
diff --git a/.release/linux/package/etc/vault.d/vault.hcl b/.release/linux/package/etc/vault.d/vault.hcl
index 18ff8b4bbce..32776e340c2 100644
--- a/.release/linux/package/etc/vault.d/vault.hcl
+++ b/.release/linux/package/etc/vault.d/vault.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 # Full configuration options can be found at https://developer.hashicorp.com/vault/docs/configuration
diff --git a/.release/linux/postinst b/.release/linux/postinst
index 2a08b7a152c..fbb0dee2920 100644
--- a/.release/linux/postinst
+++ b/.release/linux/postinst
@@ -41,7 +41,22 @@ fi
 
 if [[ $(vault version) == *+ent* ]]; then
 echo "
-The following shall apply unless your organization has a separately signed Enterprise License Agreement or Evaluation Agreement governing your use of the software:
-Software in this repository is subject to the license terms located in the software, copies of which are also available at https://eula.hashicorp.com/ClickThruELA-Global.pdf or https://www.hashicorp.com/terms-of-evaluation as applicable. Please read the license terms prior to using the software. Your installation and use of the software constitutes your acceptance of these terms. If you do not accept the terms, do not use the software.
+Agreement
+
+The following shall apply unless your organization has a separately signed 
+agreement governing your use of the software made available here:
+
+The software is subject to the license terms or community license (i.e. Mozilla
+Public License 2.0 or Business Source License), as applicable, located in the 
+download package for the software, the IBM International Program License 
+Agreement, the IBM International License Agreement for Evaluation of Programs 
+(for evaluation uses), or the IBM International License Agreement for Early 
+Release of Programs (alpha and beta releases), and the applicable License 
+Information, copies of which are also available at https://www.ibm.com/terms. 
+In the event of a conflict between the license file in the download package and
+the noted IBM licenses above, the relevant IBM terms will apply. Please refer 
+to the license terms prior to using the software. Your installation and use of
+the software constitute your acceptance of those terms. If you do not accept 
+the terms, do not use the software.
 "
 fi
diff --git a/.release/release-metadata.hcl b/.release/release-metadata.hcl
index 8d480ad4a73..d569b0f12fd 100644
--- a/.release/release-metadata.hcl
+++ b/.release/release-metadata.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 url_docker_registry_dockerhub = "https://hub.docker.com/r/hashicorp/vault"
diff --git a/.release/security-scan.hcl b/.release/security-scan.hcl
index 3917c269cd4..c80ea968d28 100644
--- a/.release/security-scan.hcl
+++ b/.release/security-scan.hcl
@@ -1,16 +1,37 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-container {
-	dependencies = true
-	alpine_secdb = true
-	secrets      = true
+binary {
+  go_stdlib  = true // Scan the Go standard library used to build the binary.
+  go_modules = true // Scan the Go modules included in the binary.
+  osv        = true // Use the OSV vulnerability database.
+  oss_index  = true // And use OSS Index vulnerability database.
+
+  triage {
+    suppress {
+      vulnerabilities = [
+        "GO-2022-0635", // github.com/aws/aws-sdk-go@v1.x
+      ]
+    }
+  }
 }
 
-binary {
-	secrets      = false
-	go_modules   = false
-	osv          = true
-	oss_index    = true
-	nvd          = false
+container {
+  dependencies = true // Scan any installed packages for vulnerabilities.
+  osv          = true // Use the OSV vulnerability database.
+
+  secrets {
+    all = true
+  }
+
+  triage {
+    suppress {
+      vulnerabilities = [
+        // We can't do anything about these two CVEs until a new Alpine container with busybox 1.38 is available.
+        "CVE-2025-46394",
+        "CVE-2024-58251",
+        "GO-2022-0635", // github.com/aws/aws-sdk-go@v1.x
+      ]
+    }
+  }
 }
diff --git a/.release/versions.hcl b/.release/versions.hcl
new file mode 100644
index 00000000000..76b2ec0e406
--- /dev/null
+++ b/.release/versions.hcl
@@ -0,0 +1,33 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# This manifest file describes active branches and is consumed by various
+# pipeline tooling. It ought to be considered the source of truth regarding
+# which branches are currently active, whether the Ent version is considered
+# LTS, and whether or not a branch's CE counterpart is active. Main is always
+# assumed to be active but any version not present will be assumed inactive.
+
+schema = 1
+active_versions {
+  version "1.21.x" {
+    ce_active = true
+  }
+
+  version "1.20.x" {
+    ce_active = true
+  }
+
+  version "1.19.x" {
+    ce_active = false
+    lts       = true
+  }
+
+  version "1.18.x" {
+    ce_active = false
+  }
+
+  version "1.16.x" {
+    ce_active = false
+    lts       = true
+  }
+}
diff --git a/.yamllint b/.yamllint
index fe62ee82d71..e12dc256ecd 100644
--- a/.yamllint
+++ b/.yamllint
@@ -7,4 +7,4 @@ rules:
   comments-indentation: disable
   line-length: disable
   commas:
-  	max-spaces-after: -1
+    max-spaces-after: -1
diff --git a/CHANGELOG-v1.10-v1.15.md b/CHANGELOG-v1.10-v1.15.md
new file mode 100644
index 00000000000..998b6837781
--- /dev/null
+++ b/CHANGELOG-v1.10-v1.15.md
@@ -0,0 +1,3822 @@
+## 1.15.16 Enterprise
+### October 09, 2024
+
+SECURITY:
+
+* secrets/identity: A privileged Vault operator with write permissions to the root namespace's identity endpoint could escalate their privileges to Vault's root policy (CVE-2024-9180) [HCSEC-2024-21](https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565)
+
+IMPROVEMENTS:
+
+* core: log at level ERROR rather than INFO when all seals are unhealthy. [[GH-28564](https://github.com/hashicorp/vault/pull/28564)]
+
+BUG FIXES:
+
+* auth/cert: When using ocsp_ca_certificates, an error was produced though extra certs validation succeeded. [[GH-28597](https://github.com/hashicorp/vault/pull/28597)]
+* auth/token: Fix token TTL calculation so that it uses `max_lease_ttl` tune value for tokens created via `auth/token/create`. [[GH-28498](https://github.com/hashicorp/vault/pull/28498)]
+
+## 1.15.15 Enterprise
+### September 25, 2024
+
+SECURITY:
+* secrets/ssh: require `valid_principals` to contain a value or `default_user` be set by default to guard against potentially insecure configurations. `allow_empty_principals` can be used for backwards compatibility [HCSEC-2024-20](https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/7025
+
+CHANGES:
+
+* core: Bump Go version to 1.22.7.
+* secrets/ssh: Add a flag, `allow_empty_principals` to allow keys or certs to apply to any user/principal. [[GH-28466](https://github.com/hashicorp/vault/pull/28466)]
+
+BUG FIXES:
+
+* secret/aws: Fixed potential panic after step-down and the queue has not repopulated. [[GH-28330](https://github.com/hashicorp/vault/pull/28330)]
+* auth/cert: During certificate validation, OCSP requests are debug logged even if Vault's log level is above DEBUG. [[GH-28450](https://github.com/hashicorp/vault/pull/28450)]
+* auth/cert: ocsp_ca_certificates field was not honored when validating OCSP responses signed by a CA that did not issue the certificate. [[GH-28309](https://github.com/hashicorp/vault/pull/28309)]
+* auth: Updated error handling for missing login credentials in AppRole and UserPass auth methods to return a 400 error instead of a 500 error. [[GH-28441](https://github.com/hashicorp/vault/pull/28441)]
+* core: Fixed an issue where maximum request duration timeout was not being added to all requests containing strings sys/monitor and sys/events. With this change, timeout is now added to all requests except monitor and events endpoint. [[GH-28230](https://github.com/hashicorp/vault/pull/28230)]
+
+## 1.15.14 Enterprise
+### August 29, 2024
+
+CHANGES:
+
+* activity (enterprise): filter all fields in client count responses by the request namespace [[GH-27790](https://github.com/hashicorp/vault/pull/27790)]
+* core: Bump Go version to 1.22.6
+
+IMPROVEMENTS:
+
+* activity log: Changes how new client counts in the current month are estimated, in order to return more
+visibly sensible totals. [[GH-27547](https://github.com/hashicorp/vault/pull/27547)]
+* activity: `/sys/internal/counters/activity` will now include a warning if the specified usage period contains estimated client counts. [[GH-28068](https://github.com/hashicorp/vault/pull/28068)]
+* cli: `vault operator usage` will now include a warning if the specified usage period contains estimated client counts. [[GH-28068](https://github.com/hashicorp/vault/pull/28068)]
+* core/activity: Ensure client count queries that include the current month return consistent results by sorting the clients before performing estimation [[GH-28062](https://github.com/hashicorp/vault/pull/28062)]
+
+BUG FIXES:
+
+* activity: The sys/internal/counters/activity endpoint will return current month data when the end_date parameter is set to a future date. [[GH-28042](https://github.com/hashicorp/vault/pull/28042)]
+* command: The `vault secrets move` and `vault auth move` command will no longer attempt to write to storage on performance standby nodes. [[GH-28059](https://github.com/hashicorp/vault/pull/28059)]
+* core (enterprise): Fix deletion of MFA login-enforcement configurations on standby nodes
+
+## 1.15.13 Enterprise
+### August 07, 2024
+
+CHANGES:
+
+* auth/cf: Update plugin to v0.18.0 [[GH-27724](https://github.com/hashicorp/vault/pull/27724)]
+
+IMPROVEMENTS:
+
+* audit: Ensure that any underyling errors from audit devices are logged even if we consider auditing to be a success. [[GH-27809](https://github.com/hashicorp/vault/pull/27809)]
+* auth/cert: Cache full list of role trust information separately to avoid
+eviction, and avoid duplicate loading during multiple simultaneous logins on
+the same role. [[GH-27902](https://github.com/hashicorp/vault/pull/27902)]
+
+BUG FIXES:
+
+* auth/cert: Use subject's serial number, not issuer's within error message text in OCSP request errors [[GH-27696](https://github.com/hashicorp/vault/pull/27696)]
+* core (enterprise): Fix 500 errors that occurred querying `sys/internal/ui/mounts` for a mount prefixed by a namespace path when path filters are configured. [[GH-27939](https://github.com/hashicorp/vault/pull/27939)]
+* raft/autopilot: Fixed panic that may occur during shutdown [[GH-27726](https://github.com/hashicorp/vault/pull/27726)]
+* secrets/identity (enterprise): Fix a bug that can cause DR promotion to fail in rare cases where a PR secondary has inconsistent alias information in storage.
+* ui: Fix cursor jump on KVv2 json editor that would occur after pressing ENTER. [[GH-27569](https://github.com/hashicorp/vault/pull/27569)]
+* ui: fix issue where enabling then disabling "Tidy ACME" in PKI results in failed API call. [[GH-27742](https://github.com/hashicorp/vault/pull/27742)]
+* ui: fix namespace picker not working when in small screen where the sidebar is collapsed by default. [[GH-27728](https://github.com/hashicorp/vault/pull/27728)]
+
+
+## 1.15.12 Enterprise
+### July 10, 2024
+
+CHANGES:
+
+* core: Bump Go version to 1.22.5.
+* auth/jwt: Revert [GH-295](https://github.com/hashicorp/vault-plugin-auth-jwt/pull/295) which changed the way JWT `aud` claims were validated.
+
+BUG FIXES:
+
+* core (enterprise): Fix HTTP redirects in namespaces to use the correct path and (in the case of event subscriptions) the correct URI scheme. [[GH-27660](https://github.com/hashicorp/vault/pull/27660)]
+* core/config: fix issue when using `proxy_protocol_behavior` with `deny_unauthorized`, 
+which causes the Vault TCP listener to close after receiving an untrusted upstream proxy connection. [[GH-27589](https://github.com/hashicorp/vault/pull/27589)]
+* core: Fixed an issue with performance standbys not being able to handle rotate root requests. [[GH-27631](https://github.com/hashicorp/vault/pull/27631)]
+* ui: Display an error and force a timeout when TOTP passcode is incorrect [[GH-27574](https://github.com/hashicorp/vault/pull/27574)]
+* ui: Ensure token expired banner displays when batch token expires [[GH-27479](https://github.com/hashicorp/vault/pull/27479)]
+
+## 1.15.11 Enterprise
+### June 26, 2024
+
+BUG FIXES:
+
+* cli/debug: Fix resource leak in CLI debug command. [[GH-26167](https://github.com/hashicorp/vault/pull/26167)]
+* helper/pkcs7: Fix parsing certain messages containing only certificates [[GH-27435](https://github.com/hashicorp/vault/pull/27435)]
+* replication (enterprise): fix cache invalidation issue leading to namespace custom metadata not being shown correctly on performance secondaries
+* storage/raft (enterprise): Fix issue with namespace cache not getting cleared on snapshot restore, resulting in namespaces not found in the snapshot being inaccurately represented by API responses. [[GH-27474](https://github.com/hashicorp/vault/pull/27474)]
+
+## 1.15.10 Enterprise
+### June 12, 2024
+
+CHANGES:
+
+* core: Bump Go version to 1.22.4.
+
+IMPROVEMENTS:
+
+* ui: Allow users to wrap inputted data again instead of resetting form [[GH-27289](https://github.com/hashicorp/vault/pull/27289)]
+* ui: Update language in Transit secret engine to reflect that not all keys are for encyryption [[GH-27346](https://github.com/hashicorp/vault/pull/27346)]
+
+BUG FIXES:
+
+* secrets/transform (enterprise): Fix a bug preventing the use of alternate schemas on PostgreSQL token stores.
+* storage/raft (enterprise): Fix a regression introduced in 1.15.8 that causes
+autopilot to fail to discover new server versions and so not trigger an upgrade. [[GH-27277](https://github.com/hashicorp/vault/pull/27277)]
+* ui: Do not show resultant-ACL banner when ancestor namespace grants wildcard access. [[GH-27263](https://github.com/hashicorp/vault/pull/27263)]
+* ui: Fix a bug where disabling TTL on the AWS credential form would still send TTL value [[GH-27366](https://github.com/hashicorp/vault/pull/27366)]
+
+## 1.15.9 Enterprise
+### May 30, 2024
+
+CHANGES:
+* auth/jwt: Update plugin to v0.17.3 [[GH-27063](https://github.com/hashicorp/vault/pull/27063)]
+* core: Bump Go version to 1.22.2.
+
+IMPROVEMENTS:
+* secrets/pki (enterprise): Disable warnings about unknown parameters to the various CIEPS endpoints
+* website/docs: Add note about eventual consietency with the MongoDB Atlas database secrets engine [[GH-24152](https://github.com/hashicorp/vault/pull/24152)]
+
+BUG FIXES:
+* activity (enterprise): fix read-only storage error on upgrades
+* core: Address a data race updating a seal's last seen healthy time attribute [[GH-27014](https://github.com/hashicorp/vault/pull/27014)]
+* pki: Fix error in cross-signing using ed25519 keys [[GH-27093](https://github.com/hashicorp/vault/pull/27093)]
+* replication (enterprise): fix "given mount path is not in the same namespace as the request" error that can occur when enabling replication for the first time on a secondary cluster
+* secrets/transit: Use 'hash_algorithm' parameter if present in HMAC verify requests. Otherwise fall back to deprecated 'algorithm' parameter. [[GH-27211](https://github.com/hashicorp/vault/pull/27211)]
+* ui: Fix KVv2 cursor jumping inside json editor after initial input. [[GH-27120](https://github.com/hashicorp/vault/pull/27120)]
+
+## 1.15.8 Enterprise
+### April 24, 2024
+
+SECURITY:
+
+* core (enterprise): fix bug where http headers were displayed in the audit log of a performance standby node [HCSEC-2024-10](https://discuss.hashicorp.com/t/hcsec-2024-10-vault-enterprise-leaks-sensitive-http-request-headers-in-audit-log-when-deployed-with-a-performance-standby-node) 
+
+CHANGES:
+
+* core: Bump Go version to 1.21.9.
+* ui: Update dependencies including D3 libraries [[GH-26346](https://github.com/hashicorp/vault/pull/26346)]
+
+IMPROVEMENTS:
+
+* activity (enterprise): Change minimum retention window in activity log to 48 months
+* core: make the best effort timeout for encryption count tracking persistence configurable via an environment variable. [[GH-25636](https://github.com/hashicorp/vault/pull/25636)]
+* license utilization reporting (enterprise): Add retention months to license utilization reports.
+* sdk/decompression: DecompressWithCanary will now chunk the decompression in memory to prevent loading it all at once. [[GH-26464](https://github.com/hashicorp/vault/pull/26464)]
+* ui: show banner instead of permission denied error when batch token is expired [[GH-26396](https://github.com/hashicorp/vault/pull/26396)]
+
+BUG FIXES:
+
+* core (enterprise): fix bug where raft followers disagree with the seal type after returning to one seal from two. [[GH-26523](https://github.com/hashicorp/vault/pull/26523)]
+* secrets/pki: fixed validation bug which rejected ldap schemed URLs in crl_distribution_points. [[GH-26477](https://github.com/hashicorp/vault/pull/26477)]
+* storage/raft (enterprise): Fix a bug where autopilot automated upgrades could fail due to using the wrong upgrade version
+* ui: fixed a bug where the replication pages did not update display when navigating between DR and performance [[GH-26325](https://github.com/hashicorp/vault/pull/26325)]
+
+## 1.15.7 Enterprise
+### March 28, 2024
+
+SECURITY:
+
+* auth/cert: validate OCSP response was signed by the expected issuer and serial number matched request (CVE-2024-2660) [[GH-26091](https://github.com/hashicorp/vault/pull/26091), [HSEC-2024-07](https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573)]
+
+IMPROVEMENTS:
+
+* auth/cert: Allow validation with OCSP responses with no NextUpdate time [[GH-25912](https://github.com/hashicorp/vault/pull/25912)]
+* core (enterprise): Avoid seal rewrapping in some specific unnecessary cases.
+* core (enterprise): persist seal rewrap status, so rewrap status API is consistent on secondary nodes.
+* ui: remove leading slash from KV version 2 secret paths [[GH-25874](https://github.com/hashicorp/vault/pull/25874)]
+
+BUG FIXES:
+
+* audit: Operator changes to configured audit headers (via `/sys/config/auditing`) 
+will now force invalidation and be reloaded from storage when data is replicated 
+to other nodes.
+* auth/cert: Address an issue in which OCSP query responses were not cached [[GH-25986](https://github.com/hashicorp/vault/pull/25986)]
+* auth/cert: Allow cert auth login attempts if ocsp_fail_open is true and OCSP servers are unreachable [[GH-25982](https://github.com/hashicorp/vault/pull/25982)]
+* cli: fixes plugin register CLI failure to error when plugin image doesn't exist [[GH-24990](https://github.com/hashicorp/vault/pull/24990)]
+* core (enterprise): fix issue where the Seal HA rewrap system may remain running when an active node steps down.
+* core/login: Fixed a potential deadlock when a login fails and user lockout is enabled. [[GH-25697](https://github.com/hashicorp/vault/pull/25697)]
+* replication (enterprise): fixed data integrity issue with the processing of identity aliases causing duplicates to occur in rare cases
+* ui: Fix kubernetes auth method roles tab [[GH-25999](https://github.com/hashicorp/vault/pull/25999)]
+* ui: call resultant-acl without namespace header when user mounted at root namespace [[GH-25766](https://github.com/hashicorp/vault/pull/25766)]
+
+## 1.15.6
+### February 29, 2024
+
+SECURITY:
+
+* auth/cert: compare public keys of trusted non-CA certificates with incoming
+client certificates to prevent trusting certs with the same serial number
+but not the same public/private key (CVE-2024-2048). [[GH-25649](https://github.com/hashicorp/vault/pull/25649), [HSEC-2024-05](https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382)]
+
+CHANGES:
+
+* core: Bump Go version to 1.21.7.
+* secrets/openldap: Update plugin to v0.12.1 [[GH-25524](https://github.com/hashicorp/vault/pull/25524)]
+
+FEATURES:
+
+* **Manual License Utilization Reporting**: Added manual license
+utilization reporting, which allows users to create manual exports of product-license [metering
+data] to report to Hashicorp.
+
+IMPROVEMENTS:
+
+* auth/cert: Cache trusted certs to reduce memory usage and improve performance of logins. [[GH-25421](https://github.com/hashicorp/vault/pull/25421)]
+* ui: Add `deletion_allowed` param to transformations and include `tokenization` as a type option [[GH-25436](https://github.com/hashicorp/vault/pull/25436)]
+* ui: redirect back to current route after reauthentication when token expires [[GH-25335](https://github.com/hashicorp/vault/pull/25335)]
+* ui: remove unnecessary OpenAPI calls for unmanaged auth methods [[GH-25364](https://github.com/hashicorp/vault/pull/25364)]
+
+BUG FIXES:
+
+* agent: Fix issue where Vault Agent was unable to render KVv2 secrets with delete_version_after set. [[GH-25387](https://github.com/hashicorp/vault/pull/25387)]
+* audit: Handle a potential panic while formatting audit entries for an audit log [[GH-25605](https://github.com/hashicorp/vault/pull/25605)]
+* core (enterprise): Fix a deadlock that can occur on performance secondary clusters when there are many mounts and a mount is deleted or filtered [[GH-25448](https://github.com/hashicorp/vault/pull/25448)]
+* core (enterprise): Fix a panic that can occur if only one seal exists but is unhealthy on the non-first restart of Vault.
+* core/quotas: Deleting a namespace that contains a rate limit quota no longer breaks replication [[GH-25439](https://github.com/hashicorp/vault/pull/25439)]
+* openapi: Fixing response fields for rekey operations [[GH-25509](https://github.com/hashicorp/vault/pull/25509)]
+* secrets/transit: When provided an invalid input with hash_algorithm=none, a lock was not released properly before reporting an error leading to deadlocks on a subsequent key configuration update. [[GH-25336](https://github.com/hashicorp/vault/pull/25336)]
+* storage/file: Fixing spuriously deleting storage keys ending with .temp [[GH-25395](https://github.com/hashicorp/vault/pull/25395)]
+* transform (enterprise): guard against a panic looking up a token in exportable mode with barrier storage.
+* ui: Do not disable JSON display toggle for KV version 2 secrets [[GH-25235](https://github.com/hashicorp/vault/pull/25235)]
+* ui: Do not show resultant-acl banner on namespaces a user has access to [[GH-25256](https://github.com/hashicorp/vault/pull/25256)]
+* ui: Fix copy button not working on masked input when value is not a string [[GH-25269](https://github.com/hashicorp/vault/pull/25269)]
+* ui: Update the KV secret data when you change the version you're viewing of a nested secret. [[GH-25152](https://github.com/hashicorp/vault/pull/25152)]
+
+## 1.15.5
+### January 31, 2024
+
+SECURITY:
+
+* audit: Fix bug where use of 'log_raw' option could result in other devices logging raw audit data [[GH-24968](https://github.com/hashicorp/vault/pull/24968)] [[HCSEC-2024-01](https://discuss.hashicorp.com/t/hcsec-2024-01-vault-may-expose-sensitive-information-when-configuring-an-audit-log-device/62311)]
+
+CHANGES:
+
+* core: Bump Go version to 1.21.5.
+* database/snowflake: Update plugin to v0.9.1 [[GH-25020](https://github.com/hashicorp/vault/pull/25020)]
+* secrets/ad: Update plugin to v0.16.2 [[GH-25058](https://github.com/hashicorp/vault/pull/25058)]
+* secrets/openldap: Update plugin to v0.11.3 [[GH-25040](https://github.com/hashicorp/vault/pull/25040)]
+
+IMPROVEMENTS:
+
+* command/server: display logs on startup immediately if disable-gated-logs flag is set [[GH-24280](https://github.com/hashicorp/vault/pull/24280)]
+* core/activity: Include secret_syncs in activity log responses [[GH-24710](https://github.com/hashicorp/vault/pull/24710)]
+* oidc/provider: Adds `code_challenge_methods_supported` to OpenID Connect Metadata [[GH-24979](https://github.com/hashicorp/vault/pull/24979)]
+* storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [[GH-24010](https://github.com/hashicorp/vault/pull/24010)]
+* sys (enterprise): Adds the chroot_namespace field to this sys/internal/ui/resultant-acl endpoint, which exposes the value of the chroot namespace from the
+listener config.
+* ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [[GH-18513](https://github.com/hashicorp/vault/pull/18513)]
+
+BUG FIXES:
+
+* audit/socket: Provide socket based audit backends with 'prefix' configuration option when supplied. [[GH-25004](https://github.com/hashicorp/vault/pull/25004)]
+* auth/saml (enterprise): Fixes support for Microsoft Entra ID enterprise applications
+* core (enterprise): fix a potential deadlock if an error is received twice from underlying storage for the same key
+* core: upgrade github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 to 
+support azure workload identities. [[GH-24954](https://github.com/hashicorp/vault/pull/24954)]
+* helper/pkcs7: Fix slice out-of-bounds panic [[GH-24891](https://github.com/hashicorp/vault/pull/24891)]
+* kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
+* plugins: fix panic when registering containerized plugin with a custom runtime on a perf standby
+* ui: Allows users to dismiss the resultant-acl banner. [[GH-25106](https://github.com/hashicorp/vault/pull/25106)]
+* ui: Correctly handle redirects from pre 1.15.0 Kv v2 edit, create, and show urls. [[GH-24339](https://github.com/hashicorp/vault/pull/24339)]
+* ui: Fixed minor bugs with database secrets engine [[GH-24947](https://github.com/hashicorp/vault/pull/24947)]
+* ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [[GH-24697](https://github.com/hashicorp/vault/pull/24697)]
+* ui: Fixes policy input toolbar scrolling by default [[GH-23297](https://github.com/hashicorp/vault/pull/23297)]
+* ui: The UI can now be used to create or update database roles by operator without permission on the database connection. [[GH-24660](https://github.com/hashicorp/vault/pull/24660)]
+* ui: fix KV v2 details view defaulting to JSON view when secret value includes `{` [[GH-24513](https://github.com/hashicorp/vault/pull/24513)]
+* ui: fix incorrectly calculated capabilities on PKI issuer endpoints [[GH-24686](https://github.com/hashicorp/vault/pull/24686)]
+* ui: fix issue where kv v2 capabilities checks were not passing in the full secret path if secret was inside a directory. [[GH-24404](https://github.com/hashicorp/vault/pull/24404)]
+* ui: fix navigation items shown to user when chroot_namespace configured [[GH-24492](https://github.com/hashicorp/vault/pull/24492)]
+  
+## 1.15.4
+### December 06, 2023
+
+SECURITY:
+
+* core: Fixes an issue present in both Vault and Vault Enterprise since Vault 1.12.0, where Vault is vulnerable to a denial of service through memory exhaustion of the host when handling large HTTP requests from a client. (see [CVE-2023-6337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6337) & [HCSEC-2023-34](https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741))
+
+CHANGES:
+
+* identity (enterprise): POST requests to the `/identity/entity/merge` endpoint
+are now always forwarded from standbys to the active node. [[GH-24325](https://github.com/hashicorp/vault/pull/24325)]
+
+BUG FIXES:
+
+* agent/logging: Agent should now honor correct -log-format and -log-file settings in logs generated by the consul-template library. [[GH-24252](https://github.com/hashicorp/vault/pull/24252)]
+* api: Fix deadlock on calls to sys/leader with a namespace configured
+on the request. [[GH-24256](https://github.com/hashicorp/vault/pull/24256)]
+* core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [[GH-24336](https://github.com/hashicorp/vault/pull/24336)]
+* ui: Correctly handle directory redirects from pre 1.15.0 Kv v2 list view urls. [[GH-24281](https://github.com/hashicorp/vault/pull/24281)]
+* ui: Fix payload sent when disabling replication [[GH-24292](https://github.com/hashicorp/vault/pull/24292)]
+* ui: When Kv v2 secret is an object, fix so details view defaults to readOnly JSON editor. [[GH-24290](https://github.com/hashicorp/vault/pull/24290)]
+
+## 1.15.3
+### November 30, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.21.4.
+
+IMPROVEMENTS:
+
+* core (enterprise): Speed up unseal when using namespaces
+* core: update sys/seal-status (and CLI vault status) to report the type of
+the seal when unsealed, as well as the type of the recovery seal if an
+auto-seal. [[GH-23022](https://github.com/hashicorp/vault/pull/23022)]
+* secrets/pki: do not check TLS validity on ACME requests redirected to https [[GH-22521](https://github.com/hashicorp/vault/pull/22521)]
+* ui: Sort list view of entities and aliases alphabetically using the item name [[GH-24103](https://github.com/hashicorp/vault/pull/24103)]
+* ui: capabilities-self is always called in the user's root namespace [[GH-24168](https://github.com/hashicorp/vault/pull/24168)]
+
+BUG FIXES:
+
+* activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
+* auth/cert: Handle errors related to expired OCSP server responses [[GH-24193](https://github.com/hashicorp/vault/pull/24193)]
+* core (Enterprise): Treat multiple disabled HA seals as a migration to Shamir.
+* core/audit: Audit logging a Vault response will now use a 5 second context timeout, separate from the original request. [[GH-24238](https://github.com/hashicorp/vault/pull/24238)]
+* core/config: Use correct HCL config value when configuring `log_requests_level`. [[GH-24059](https://github.com/hashicorp/vault/pull/24059)]
+* core/quotas: Close rate-limit blocked client purge goroutines when sealing [[GH-24108](https://github.com/hashicorp/vault/pull/24108)]
+* core: Fix an error that resulted in the wrong seal type being returned by sys/seal-status while
+Vault is in seal migration mode. [[GH-24165](https://github.com/hashicorp/vault/pull/24165)]
+* replication (enterprise): disallow configuring paths filter for a mount path that does not exist
+* secrets-sync (enterprise): Fix panic when setting usage_gauge_period to none
+* secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [[GH-24192](https://github.com/hashicorp/vault/pull/24192)]
+* secrets/transit: Fix a panic when attempting to export a public RSA key [[GH-24054](https://github.com/hashicorp/vault/pull/24054)]
+* ui: Fix JSON editor in KV V2 unable to handle pasted values [[GH-24224](https://github.com/hashicorp/vault/pull/24224)]
+* ui: Fix error when tuning token auth configuration within namespace [[GH-24147](https://github.com/hashicorp/vault/pull/24147)]
+* ui: show error from API when seal fails [[GH-23921](https://github.com/hashicorp/vault/pull/23921)]
+
+## 1.15.2
+### November 09, 2023
+
+SECURITY:
+* core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [[HSEC-2023-33](https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926)]
+
+CHANGES:
+
+* auth/approle: Normalized error response messages when invalid credentials are provided [[GH-23786](https://github.com/hashicorp/vault/pull/23786)]
+* secrets/mongodbatlas: Update plugin to v0.10.2 [[GH-23849](https://github.com/hashicorp/vault/pull/23849)]
+
+FEATURES:
+
+* cli/snapshot: Add CLI tool to inspect Vault snapshots [[GH-23457](https://github.com/hashicorp/vault/pull/23457)]
+
+IMPROVEMENTS:
+
+* api (enterprise): Enable the sys/license/features from any namespace
+* storage/etcd: etcd should only return keys when calling List() [[GH-23872](https://github.com/hashicorp/vault/pull/23872)]
+* ui: Update flat, shell-quote and swagger-ui-dist packages. Remove swagger-ui styling overrides. [[GH-23700](https://github.com/hashicorp/vault/pull/23700)]
+* ui: Update sidebar Secrets engine to title case. [[GH-23964](https://github.com/hashicorp/vault/pull/23964)]
+
+BUG FIXES:
+
+* api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
+on the request. [[GH-23861](https://github.com/hashicorp/vault/pull/23861)]
+* core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
+* core/activity: Fixes segments fragment loss due to exceeding entry record size limit [[GH-23781](https://github.com/hashicorp/vault/pull/23781)]
+* core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [[GH-23802](https://github.com/hashicorp/vault/pull/23802)]
+* core: Revert PR causing memory consumption bug [[GH-23986](https://github.com/hashicorp/vault/pull/23986)]
+* core: Skip unnecessary deriving of policies during Login MFA Check. [[GH-23894](https://github.com/hashicorp/vault/pull/23894)]
+* core: fix bug where deadlock detection was always on for expiration and quotas. 
+These can now be configured individually with `detect_deadlocks`. [[GH-23902](https://github.com/hashicorp/vault/pull/23902)]
+* core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [[GH-23874](https://github.com/hashicorp/vault/pull/23874)]
+* expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [[GH-24027](https://github.com/hashicorp/vault/pull/24027)]
+* ui: fix broken GUI when accessing from listener with chroot_namespace defined [[GH-23942](https://github.com/hashicorp/vault/pull/23942)]
+
+## 1.15.1
+### October 25, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.21.3.
+
+IMPROVEMENTS:
+
+* api/plugins: add `tls-server-name` arg for plugin registration [[GH-23549](https://github.com/hashicorp/vault/pull/23549)]
+* auto-auth/azure: Support setting the `authenticate_from_environment` variable to "true" and "false" string literals, too. [[GH-22996](https://github.com/hashicorp/vault/pull/22996)]
+* secrets-sync (enterprise): Added telemetry on number of destinations and associations per type.
+* ui: Adds a warning when whitespace is detected in a key of a KV secret [[GH-23702](https://github.com/hashicorp/vault/pull/23702)]
+* ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [[GH-23747](https://github.com/hashicorp/vault/pull/23747)]
+* ui: Surface warning banner if UI has stopped auto-refreshing token [[GH-23143](https://github.com/hashicorp/vault/pull/23143)]
+* ui: show banner when resultant-acl check fails due to permissions or wrong namespace. [[GH-23503](https://github.com/hashicorp/vault/pull/23503)]
+
+BUG FIXES:
+
+* Seal HA (enterprise/beta): Fix rejection of a seal configuration change
+from two to one auto seal due to persistence of the previous seal type being
+"multiseal". [[GH-23573](https://github.com/hashicorp/vault/pull/23573)]
+* audit: Fix bug reopening 'file' audit devices on SIGHUP. [[GH-23598](https://github.com/hashicorp/vault/pull/23598)]
+* auth/aws: Fixes a panic that can occur in IAM-based login when a [client config](https://developer.hashicorp.com/vault/api-docs/auth/aws#configure-client) does not exist. [[GH-23555](https://github.com/hashicorp/vault/pull/23555)]
+* command/server: Fix bug with sigusr2 where pprof files were not closed correctly [[GH-23636](https://github.com/hashicorp/vault/pull/23636)]
+* events: Ignore sending context to give more time for events to send [[GH-23500](https://github.com/hashicorp/vault/pull/23500)]
+* expiration: Prevent large lease loads from delaying state changes, e.g. becoming active or standby. [[GH-23282](https://github.com/hashicorp/vault/pull/23282)]
+* kmip (enterprise): Improve handling of failures due to storage replication issues.
+* kmip (enterprise): Return a structure in the response for query function Query Server Information.
+* mongo-db: allow non-admin database for root credential rotation [[GH-23240](https://github.com/hashicorp/vault/pull/23240)]
+* replication (enterprise): Fix a bug where undo logs would only get enabled on the initial node in a cluster.
+* replication (enterprise): Fix a missing unlock when changing replication state
+* secrets-sync (enterprise): Fixed issue where we could sync a deleted secret
+* secrets/aws: update credential rotation deadline when static role rotation period is updated [[GH-23528](https://github.com/hashicorp/vault/pull/23528)]
+* secrets/consul: Fix revocations when Vault has an access token using specific namespace and admin partition policies [[GH-23010](https://github.com/hashicorp/vault/pull/23010)]
+* secrets/pki: Stop processing in-flight ACME verifications when an active node steps down [[GH-23278](https://github.com/hashicorp/vault/pull/23278)]
+* secrets/transit (enterprise): Address an issue using sign/verify operations with managed keys returning an error about it not containing a private key
+* secrets/transit (enterprise): Address panic when using GCP,AWS,Azure managed keys for encryption operations. At this time all encryption operations for the cloud providers have been disabled, only signing operations are supported.
+* secrets/transit (enterprise): Apply hashing arguments and defaults to managed key sign/verify operations
+* secrets/transit: Do not allow auto rotation on managed_key key types [[GH-23723](https://github.com/hashicorp/vault/pull/23723)]
+* storage/consul: fix a bug where an active node in a specific sort of network
+partition could continue to write data to Consul after a new leader is elected
+potentially causing data loss or corruption for keys with many concurrent
+writers. For Enterprise clusters this could cause corruption of the merkle trees
+leading to failure to complete merkle sync without a full re-index. [[GH-23013](https://github.com/hashicorp/vault/pull/23013)]
+* ui: Assumes version 1 for kv engines when options are null because no version is specified [[GH-23585](https://github.com/hashicorp/vault/pull/23585)]
+* ui: Decode the connection url for display on the connection details page [[GH-23695](https://github.com/hashicorp/vault/pull/23695)]
+* ui: Fix AWS secret engine to allow empty policy_document field. [[GH-23470](https://github.com/hashicorp/vault/pull/23470)]
+* ui: Fix bug where auth items were not listed when within a namespace. [[GH-23446](https://github.com/hashicorp/vault/pull/23446)]
+* ui: Fix regression that broke the oktaNumberChallenge on the ui. [[GH-23565](https://github.com/hashicorp/vault/pull/23565)]
+* ui: Fix the copy token button in the sidebar navigation window when in a collapsed state. [[GH-23331](https://github.com/hashicorp/vault/pull/23331)]
+* ui: Fixes issue where you could not share the list view URL from the KV v2 secrets engine. [[GH-23620](https://github.com/hashicorp/vault/pull/23620)]
+* ui: Fixes issue with sidebar navigation links disappearing when navigating to policies when a user is not authorized [[GH-23516](https://github.com/hashicorp/vault/pull/23516)]
+* ui: Fixes issues displaying accurate TLS state in dashboard configuration details [[GH-23726](https://github.com/hashicorp/vault/pull/23726)]
+
+## 1.15.0
+### September 27, 2023
+
+SECURITY:
+
+* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. This vulnerability, CVE-2023-4680, is fixed in Vault 1.14.3, 1.13.7, and 1.12.11. [[GH-22852](https://github.com/hashicorp/vault/pull/22852), [HSEC-2023-28](https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249)]
+* sentinel (enterprise): Sentinel RGP policies allowed for cross-namespace denial-of-service. This vulnerability, CVE-2023-3775, is fixed in Vault Enterprise 1.15.0, 1.14.4, and 1.13.8.[[HSEC-2023-29](https://discuss.hashicorp.com/t/hcsec-2023-29-vault-enterprise-s-sentinel-rgp-policies-allowed-for-cross-namespace-denial-of-service/58653)]
+
+CHANGES:
+
+* auth/alicloud: Update plugin to v0.16.0 [[GH-22646](https://github.com/hashicorp/vault/pull/22646)]
+* auth/azure: Update plugin to v0.16.0 [[GH-22277](https://github.com/hashicorp/vault/pull/22277)]
+* auth/azure: Update plugin to v0.16.1 [[GH-22795](https://github.com/hashicorp/vault/pull/22795)]
+* auth/azure: Update plugin to v0.16.2 [[GH-23060](https://github.com/hashicorp/vault/pull/23060)]
+* auth/cf: Update plugin to v0.15.1 [[GH-22758](https://github.com/hashicorp/vault/pull/22758)]
+* auth/gcp: Update plugin to v0.16.1 [[GH-22612](https://github.com/hashicorp/vault/pull/22612)]
+* auth/jwt: Update plugin to v0.17.0 [[GH-22678](https://github.com/hashicorp/vault/pull/22678)]
+* auth/kerberos: Update plugin to v0.10.1 [[GH-22797](https://github.com/hashicorp/vault/pull/22797)]
+* auth/kubernetes: Update plugin to v0.17.0 [[GH-22709](https://github.com/hashicorp/vault/pull/22709)]
+* auth/kubernetes: Update plugin to v0.17.1 [[GH-22879](https://github.com/hashicorp/vault/pull/22879)]
+* auth/ldap: Normalize HTTP response codes when invalid credentials are provided [[GH-21282](https://github.com/hashicorp/vault/pull/21282)]
+* auth/oci: Update plugin to v0.14.2 [[GH-22805](https://github.com/hashicorp/vault/pull/22805)]
+* core (enterprise): Ensure Role Governing Policies are only applied down the namespace hierarchy
+* core/namespace (enterprise): Introduce the concept of high-privilege namespace (administrative namespace),
+which will have access to some system backend paths that were previously only accessible in the root namespace. [[GH-21215](https://github.com/hashicorp/vault/pull/21215)]
+* core: Bump Go version to 1.21.1.
+* database/couchbase: Update plugin to v0.9.3 [[GH-22854](https://github.com/hashicorp/vault/pull/22854)]
+* database/couchbase: Update plugin to v0.9.4 [[GH-22871](https://github.com/hashicorp/vault/pull/22871)]
+* database/elasticsearch: Update plugin to v0.13.3 [[GH-22696](https://github.com/hashicorp/vault/pull/22696)]
+* database/mongodbatlas: Update plugin to v0.10.1 [[GH-22655](https://github.com/hashicorp/vault/pull/22655)]
+* database/redis-elasticache: Update plugin to v0.2.2 [[GH-22584](https://github.com/hashicorp/vault/pull/22584)]
+* database/redis-elasticache: Update plugin to v0.2.3 [[GH-22598](https://github.com/hashicorp/vault/pull/22598)]
+* database/redis: Update plugin to v0.2.2 [[GH-22654](https://github.com/hashicorp/vault/pull/22654)]
+* database/snowflake: Update plugin to v0.9.0 [[GH-22516](https://github.com/hashicorp/vault/pull/22516)]
+* events: Log level for processing an event dropped from info to debug. [[GH-22997](https://github.com/hashicorp/vault/pull/22997)]
+* events: `data_path` will include full data path of secret, including name. [[GH-22487](https://github.com/hashicorp/vault/pull/22487)]
+* replication (enterprise): Switch to non-deprecated gRPC field for resolver target host
+* sdk/logical/events: `EventSender` interface method is now `SendEvent` instead of `Send`. [[GH-22487](https://github.com/hashicorp/vault/pull/22487)]
+* secrets/ad: Update plugin to v0.16.1 [[GH-22856](https://github.com/hashicorp/vault/pull/22856)]
+* secrets/alicloud: Update plugin to v0.15.1 [[GH-22533](https://github.com/hashicorp/vault/pull/22533)]
+* secrets/azure: Update plugin to v0.16.2 [[GH-22799](https://github.com/hashicorp/vault/pull/22799)]
+* secrets/azure: Update plugin to v0.16.3 [[GH-22824](https://github.com/hashicorp/vault/pull/22824)]
+* secrets/gcp: Update plugin to v0.17.0 [[GH-22746](https://github.com/hashicorp/vault/pull/22746)]
+* secrets/gcpkms: Update plugin to v0.15.1 [[GH-22757](https://github.com/hashicorp/vault/pull/22757)]
+* secrets/keymgmt: Update plugin to v0.9.3
+* secrets/kubernetes: Update plugin to v0.6.0 [[GH-22823](https://github.com/hashicorp/vault/pull/22823)]
+* secrets/kv: Update plugin to v0.16.1 [[GH-22716](https://github.com/hashicorp/vault/pull/22716)]
+* secrets/mongodbatlas: Update plugin to v0.10.1 [[GH-22748](https://github.com/hashicorp/vault/pull/22748)]
+* secrets/openldap: Update plugin to v0.11.2 [[GH-22734](https://github.com/hashicorp/vault/pull/22734)]
+* secrets/terraform: Update plugin to v0.7.3 [[GH-22907](https://github.com/hashicorp/vault/pull/22907)]
+* secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
+* storage/aerospike: Aerospike storage shouldn't be used on 32-bit architectures and is now unsupported on them. [[GH-20825](https://github.com/hashicorp/vault/pull/20825)]
+* telemetry: Replace `vault.rollback.attempt.{MOUNT_POINT}` and `vault.route.rollback.{MOUNT_POINT}` metrics with `vault.rollback.attempt` and `vault.route.rollback metrics` by default. Added a telemetry configuration `add_mount_point_rollback_metrics` which, when set to true, causes vault to emit the metrics with mount points in their names. [[GH-22400](https://github.com/hashicorp/vault/pull/22400)]
+
+FEATURES:
+
+* **Certificate Issuance External Policy Service (CIEPS) (enterprise)**: Allow highly-customizable operator control of certificate validation and generation through the PKI Secrets Engine.
+* **Copyable KV v2 paths in UI**: KV v2 secret paths are copyable for use in CLI commands or API calls [[GH-22551](https://github.com/hashicorp/vault/pull/22551)]
+* **Dashboard UI**: Dashboard is now available in the UI as the new landing page. [[GH-21057](https://github.com/hashicorp/vault/pull/21057)]
+* **Database Static Role Advanced TTL Management**: Adds the ability to rotate
+* **Event System**: Add subscribe capability and subscribe_event_types to policies for events. [[GH-22474](https://github.com/hashicorp/vault/pull/22474)]
+static roles on a defined schedule. [[GH-22484](https://github.com/hashicorp/vault/pull/22484)]
+* **GCP IAM Support**: Adds support for IAM-based authentication to MySQL and PostgreSQL backends using Google Cloud SQL. [[GH-22445](https://github.com/hashicorp/vault/pull/22445)]
+* **Improved KV V2 UI**: Updated and restructured secret engine for KV (version 2 only) [[GH-22559](https://github.com/hashicorp/vault/pull/22559)]
+* **Merkle Tree Corruption Detection (enterprise)**: Add a new endpoint to check merkle tree corruption.
+* **Plugin Containers**: Vault supports registering, managing, and running plugins inside a container on Linux. [[GH-22712](https://github.com/hashicorp/vault/pull/22712)]
+* **SAML Auth Method (enterprise)**: Enable users to authenticate with Vault using their identity in a SAML Identity Provider.
+* **Seal High Availability Beta (enterprise)**: operators can try out configuring more than one automatic seal for resilience against seal provider outages.  Not for production use at this time.
+* **Secrets Sync (enterprise)**: Add the ability to synchronize KVv2 secret with external secrets manager solutions.
+* **UI LDAP secrets engine**: Add LDAP secrets engine to the UI. [[GH-20790](https://github.com/hashicorp/vault/pull/20790)]
+
+IMPROVEMENTS:
+
+* Bump github.com/hashicorp/go-plugin version v1.4.9 -> v1.4.10 [[GH-20966](https://github.com/hashicorp/vault/pull/20966)]
+* api: add support for cloning a Client's tls.Config. [[GH-21424](https://github.com/hashicorp/vault/pull/21424)]
+* api: adding a new api sys method for replication status [[GH-20995](https://github.com/hashicorp/vault/pull/20995)]
+* audit: add core audit events experiment [[GH-21628](https://github.com/hashicorp/vault/pull/21628)]
+* auth/aws: Added support for signed GET requests for authenticating to vault using the aws iam method. [[GH-10961](https://github.com/hashicorp/vault/pull/10961)]
+* auth/azure: Add support for azure workload identity authentication (see issue
+#18257). Update go-kms-wrapping dependency to include [PR
+#155](https://github.com/hashicorp/go-kms-wrapping/pull/155) [[GH-22994](https://github.com/hashicorp/vault/pull/22994)]
+* auth/azure: Added Azure API configurable retry options [[GH-23059](https://github.com/hashicorp/vault/pull/23059)]
+* auth/cert: Adds support for requiring hexadecimal-encoded non-string certificate extension values [[GH-21830](https://github.com/hashicorp/vault/pull/21830)]
+* auth/ldap: improved login speed by adding concurrency to LDAP token group searches [[GH-22659](https://github.com/hashicorp/vault/pull/22659)]
+* auto-auth/azure: Added Azure Workload Identity Federation support to auto-auth (for Vault Agent and Vault Proxy). [[GH-22264](https://github.com/hashicorp/vault/pull/22264)]
+* auto-auth: added support for LDAP auto-auth [[GH-21641](https://github.com/hashicorp/vault/pull/21641)]
+* aws/auth: Adds a new config field `use_sts_region_from_client` which allows for using dynamic regional sts endpoints based on Authorization header when using IAM-based authentication. [[GH-21960](https://github.com/hashicorp/vault/pull/21960)]
+* command/server: add `-dev-tls-san` flag to configure subject alternative names for the certificate generated when using `-dev-tls`. [[GH-22657](https://github.com/hashicorp/vault/pull/22657)]
+* core (ent) : Add field that allows lease-count namespace quotas to be inherited by child namespaces.
+* core : Add field that allows rate-limit namespace quotas to be inherited by child namespaces. [[GH-22452](https://github.com/hashicorp/vault/pull/22452)]
+* core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
+* core/quotas: Add configuration to allow skipping of expensive role calculations [[GH-22651](https://github.com/hashicorp/vault/pull/22651)]
+* core: Add a new periodic metric to track the number of available policies, `vault.policy.configured.count`. [[GH-21010](https://github.com/hashicorp/vault/pull/21010)]
+* core: Fix OpenAPI representation and `-output-policy` recognition of some non-standard sudo paths [[GH-21772](https://github.com/hashicorp/vault/pull/21772)]
+* core: Fix regexes for `sys/raw/` and `sys/leases/lookup/` to match prevailing conventions [[GH-21760](https://github.com/hashicorp/vault/pull/21760)]
+* core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [[GH-22235](https://github.com/hashicorp/vault/pull/22235)]
+* core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [[GH-22567](https://github.com/hashicorp/vault/pull/22567)]
+* core: add a listener configuration "chroot_namespace" that forces requests to use a namespace hierarchy [[GH-22304](https://github.com/hashicorp/vault/pull/22304)]
+* core: add a listener configuration "chroot_namespace" that forces requests to use a namespace hierarchy
+* core: remove unnecessary *BarrierView field from backendEntry struct [[GH-20933](https://github.com/hashicorp/vault/pull/20933)]
+* core: use Go stdlib functionalities instead of explicit byte/string conversions [[GH-21854](https://github.com/hashicorp/vault/pull/21854)]
+* eventbus: updated go-eventlogger library to allow removal of nodes referenced by pipelines (used for subscriptions) [[GH-21623](https://github.com/hashicorp/vault/pull/21623)]
+* events: Allow subscriptions to multiple namespaces [[GH-22540](https://github.com/hashicorp/vault/pull/22540)]
+* events: Enabled by default [[GH-22815](https://github.com/hashicorp/vault/pull/22815)]
+* events: WebSocket subscriptions add support for boolean filter expressions [[GH-22835](https://github.com/hashicorp/vault/pull/22835)]
+* framework: Make it an error for `CreateOperation` to be defined without an `ExistenceCheck`, thereby fixing misleading `x-vault-createSupported` in OpenAPI [[GH-18492](https://github.com/hashicorp/vault/pull/18492)]
+* kmip (enterprise): Add namespace lock and unlock support [[GH-21925](https://github.com/hashicorp/vault/pull/21925)]
+* openapi: Better mount points for kv-v1 and kv-v2 in openapi.json [[GH-21563](https://github.com/hashicorp/vault/pull/21563)]
+* openapi: Fix generated types for duration strings [[GH-20841](https://github.com/hashicorp/vault/pull/20841)]
+* openapi: Fix generation of correct fields in some rarer cases [[GH-21942](https://github.com/hashicorp/vault/pull/21942)]
+* openapi: Fix response definitions for list operations [[GH-21934](https://github.com/hashicorp/vault/pull/21934)]
+* openapi: List operations are now given first-class representation in the OpenAPI document, rather than sometimes being overlaid with a read operation at the same path [[GH-21723](https://github.com/hashicorp/vault/pull/21723)]
+* plugins: Containerized plugins can be configured to still work when running with systemd's PrivateTmp=true setting. [[GH-23215](https://github.com/hashicorp/vault/pull/23215)]
+* replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
+* replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
+* sdk/framework: Adds replication state helper for backends to check for read-only storage [[GH-21743](https://github.com/hashicorp/vault/pull/21743)]
+* secrets/database: Improves error logging for static role rotations by including the database and role names. [[GH-22253](https://github.com/hashicorp/vault/pull/22253)]
+* secrets/db: Remove the `service_account_json` parameter when reading DB connection details [[GH-23256](https://github.com/hashicorp/vault/pull/23256)]
+* secrets/pki: Add a parameter to allow ExtKeyUsage field usage from a role within ACME. [[GH-21702](https://github.com/hashicorp/vault/pull/21702)]
+* secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
+* secrets/transit: Add support to create CSRs from keys in transit engine and import/export x509 certificates [[GH-21081](https://github.com/hashicorp/vault/pull/21081)]
+* storage/dynamodb: Added three permit pool metrics for the DynamoDB backend, `pending_permits`, `active_permits`, and `pool_size`. [[GH-21742](https://github.com/hashicorp/vault/pull/21742)]
+* storage/etcd: Make etcd parameter MaxCallSendMsgSize configurable [[GH-12666](https://github.com/hashicorp/vault/pull/12666)]
+* storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [[GH-22040](https://github.com/hashicorp/vault/pull/22040)]
+* sys/metrics (enterprise): Adds a gauge metric that tracks whether enterprise builtin secret plugins are enabled. [[GH-21681](https://github.com/hashicorp/vault/pull/21681)]
+* ui: Add API Explorer link to Sidebar, under Tools. [[GH-21578](https://github.com/hashicorp/vault/pull/21578)]
+* ui: Add pagination to PKI roles, keys, issuers, and certificates list pages [[GH-23193](https://github.com/hashicorp/vault/pull/23193)]
+* ui: Added allowed_domains_template field for CA type role in SSH engine [[GH-23119](https://github.com/hashicorp/vault/pull/23119)]
+* ui: Adds mount configuration details to Kubernetes secrets engine configuration view [[GH-22926](https://github.com/hashicorp/vault/pull/22926)]
+* ui: Adds tidy_revoked_certs to PKI tidy status page [[GH-23232](https://github.com/hashicorp/vault/pull/23232)]
+* ui: Adds warning before downloading KV v2 secret values [[GH-23260](https://github.com/hashicorp/vault/pull/23260)]
+* ui: Display minus icon for empty MaskedInput value. Show MaskedInput for KV secrets without values [[GH-22039](https://github.com/hashicorp/vault/pull/22039)]
+* ui: JSON diff view available in "Create New Version" form for KV v2 [[GH-22593](https://github.com/hashicorp/vault/pull/22593)]
+* ui: KV View Secret card will link to list view if input ends in "/" [[GH-22502](https://github.com/hashicorp/vault/pull/22502)]
+* ui: Move access to  KV V2 version diff view to toolbar in Version History [[GH-23200](https://github.com/hashicorp/vault/pull/23200)]
+* ui: Update pki mount configuration details to match the new mount configuration details pattern [[GH-23166](https://github.com/hashicorp/vault/pull/23166)]
+* ui: add example modal to policy form [[GH-21583](https://github.com/hashicorp/vault/pull/21583)]
+* ui: adds allowed_user_ids field to create role form and user_ids to generate certificates form in pki [[GH-22191](https://github.com/hashicorp/vault/pull/22191)]
+* ui: display CertificateCard instead of MaskedInput for certificates in PKI [[GH-22160](https://github.com/hashicorp/vault/pull/22160)]
+* ui: enables create and update KV secret workflow when control group present [[GH-22471](https://github.com/hashicorp/vault/pull/22471)]
+* ui: implement hashicorp design system [alert](https://helios.hashicorp.design/components/alert) component [[GH-21375](https://github.com/hashicorp/vault/pull/21375)]
+* ui: update detail views that render ttl durations to display full unit instead of letter (i.e. 'days' instead of 'd') [[GH-20697](https://github.com/hashicorp/vault/pull/20697)]
+* ui: update unseal and DR operation token flow components [[GH-21871](https://github.com/hashicorp/vault/pull/21871)]
+* ui: upgrade Ember to 4.12 [[GH-22122](https://github.com/hashicorp/vault/pull/22122)]
+
+DEPRECATIONS:
+
+* auth/centrify: Centrify plugin is deprecated as of 1.15, slated for removal in 1.17 [[GH-23050](https://github.com/hashicorp/vault/pull/23050)]
+
+BUG FIXES:
+
+* activity (enterprise): Fix misattribution of entities to no or child namespace auth methods [[GH-18809](https://github.com/hashicorp/vault/pull/18809)]
+* agent: Environment variable VAULT_CACERT_BYTES now works for Vault Agent templates. [[GH-22322](https://github.com/hashicorp/vault/pull/22322)]
+* agent: Fix "generate-config" command documentation URL [[GH-21466](https://github.com/hashicorp/vault/pull/21466)]
+* api/client: Fix deadlock in client.CloneWithHeaders when used alongside other client methods. [[GH-22410](https://github.com/hashicorp/vault/pull/22410)]
+* api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [[GH-22523](https://github.com/hashicorp/vault/pull/22523)]
+* audit: Prevent panic due to nil pointer receiver for audit header formatting. [[GH-22694](https://github.com/hashicorp/vault/pull/22694)]
+* auth/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21800](https://github.com/hashicorp/vault/pull/21800)]
+* auth/token, sys: Fix path-help being unavailable for some list-only endpoints [[GH-18571](https://github.com/hashicorp/vault/pull/18571)]
+* auth/token: Fix parsing of `auth/token/create` fields to avoid incorrect warnings about ignored parameters [[GH-18556](https://github.com/hashicorp/vault/pull/18556)]
+* awsutil: Update awsutil to v0.2.3 to fix a regression where Vault no longer
+respects `AWS_ROLE_ARN`, `AWS_WEB_IDENTITY_TOKEN_FILE`, and `AWS_ROLE_SESSION_NAME`. [[GH-21951](https://github.com/hashicorp/vault/pull/21951)]
+* cli: Avoid printing "Success" message when `-field` flag is provided during a `vault write`. [[GH-21546](https://github.com/hashicorp/vault/pull/21546)]
+* cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to `table`. [[GH-22818](https://github.com/hashicorp/vault/pull/22818)]
+* core (enterprise): Fix sentinel policy check logic so that sentinel
+policies are not used when Sentinel feature isn't licensed.
+* core (enterprise): Remove MFA Configuration for namespace when deleting namespace
+* core/managed-keys (enterprise): Allow certain symmetric PKCS#11 managed key mechanisms (AES CBC with and without padding) to operate without an HMAC.
+* core/metrics: vault.raft_storage.bolt.write.time should be a counter not a summary [[GH-22468](https://github.com/hashicorp/vault/pull/22468)]
+* core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
+Also fix a related potential deadlock. [[GH-21110](https://github.com/hashicorp/vault/pull/21110)]
+* core/quotas: Only perform ResolveRoleOperation for role-based quotas and lease creation. [[GH-22597](https://github.com/hashicorp/vault/pull/22597)]
+* core/quotas: Reduce overhead for role calculation when using cloud auth methods. [[GH-22583](https://github.com/hashicorp/vault/pull/22583)]
+* core:  Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [[GH-22137](https://github.com/hashicorp/vault/pull/22137)]
+* core: All subloggers now reflect configured log level on reload. [[GH-22038](https://github.com/hashicorp/vault/pull/22038)]
+* core: Fix bug where background thread to update locked user entries runs on DR secondaries. [[GH-22355](https://github.com/hashicorp/vault/pull/22355)]
+* core: Fix readonly errors that could occur while loading mounts/auths during unseal [[GH-22362](https://github.com/hashicorp/vault/pull/22362)]
+* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-21470](https://github.com/hashicorp/vault/pull/21470)]
+* core: Fixed issue with some durations not being properly parsed to include days. [[GH-21357](https://github.com/hashicorp/vault/pull/21357)]
+* core: Fixes list password policy to include those with names containing / characters. [[GH-23155](https://github.com/hashicorp/vault/pull/23155)]
+* core: fix race when updating a mount's route entry tainted status and incoming requests [[GH-21640](https://github.com/hashicorp/vault/pull/21640)]
+* events: Ensure subscription resources are cleaned up on close. [[GH-23042](https://github.com/hashicorp/vault/pull/23042)]
+* expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [[GH-22374](https://github.com/hashicorp/vault/pull/22374)]
+* identity/mfa: Fixes to OpenAPI representation and returned error codes for `identity/mfa/method/*` APIs [[GH-20879](https://github.com/hashicorp/vault/pull/20879)]
+* identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [[GH-20965](https://github.com/hashicorp/vault/pull/20965)]
+* license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [[GH-22363](https://github.com/hashicorp/vault/pull/22363)]
+* openapi: Fix response schema for PKI Issue requests [[GH-21449](https://github.com/hashicorp/vault/pull/21449)]
+* openapi: Fix schema definitions for PKI EAB APIs [[GH-21458](https://github.com/hashicorp/vault/pull/21458)]
+* plugins: Containerized plugins can be run with mlock enabled. [[GH-23215](https://github.com/hashicorp/vault/pull/23215)]
+* plugins: Fix instance where Vault could fail to kill broken/unresponsive plugins. [[GH-22914](https://github.com/hashicorp/vault/pull/22914)]
+* plugins: Fix instance where broken/unresponsive plugins could cause Vault to hang. [[GH-22914](https://github.com/hashicorp/vault/pull/22914)]
+* plugins: Runtime catalog returns 404 instead of 500 when reading a runtime that does not exist [[GH-23171](https://github.com/hashicorp/vault/pull/23171)]
+* plugins: `vault plugin runtime list` can successfully list plugin runtimes with GET [[GH-23171](https://github.com/hashicorp/vault/pull/23171)]
+* raft/autopilot: Add dr-token flag for raft autopilot cli commands [[GH-21165](https://github.com/hashicorp/vault/pull/21165)]
+* replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
+* replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
+* replication (enterprise): Fix panic when update-primary was called on demoted clusters using update_primary_addrs
+* replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
+* replication (enterprise): Sort cluster addresses returned by echo requests, so that primary-addrs only gets persisted when the
+set of addrs changes.
+* replication (enterprise): update primary cluster address after DR failover
+* sdk/ldaputil: Properly escape user filters when using UPN domains
+sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [[GH-22249](https://github.com/hashicorp/vault/pull/22249)]
+* secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21631](https://github.com/hashicorp/vault/pull/21631)]
+* secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [[GH-22330](https://github.com/hashicorp/vault/pull/22330)]
+* secrets/pki: Fix bug with ACME tidy, 'unable to determine acme base folder path'. [[GH-21870](https://github.com/hashicorp/vault/pull/21870)]
+* secrets/pki: Fix preserving acme_account_safety_buffer on config/auto-tidy. [[GH-21870](https://github.com/hashicorp/vault/pull/21870)]
+* secrets/pki: Fix removal of issuers to clean up unreferenced CRLs. [[GH-23007](https://github.com/hashicorp/vault/pull/23007)]
+* secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error: `no managed key found with uuid`. [[GH-21316](https://github.com/hashicorp/vault/pull/21316)]
+* secrets/pki: allowed_domains are now compared in a case-insensitive manner if they use glob patterns [[GH-22126](https://github.com/hashicorp/vault/pull/22126)]
+* secrets/transform (enterprise): Batch items with repeated tokens in the tokenization decode api will now contain the decoded_value element
+* secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
+* secrets/transform (enterprise): Fix nil panic when encoding a tokenization transformation on a non-active node
+* secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
+* secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
+* secrets/transit: fix panic when providing non-PEM formatted public key for import [[GH-22753](https://github.com/hashicorp/vault/pull/22753)]
+* serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [[GH-21642](https://github.com/hashicorp/vault/pull/21642)]
+* storage/consul: Consul service registration tags are now case-sensitive. [[GH-6483](https://github.com/hashicorp/vault/pull/6483)]
+* storage/raft: Fix race where new follower joining can get pruned by dead server cleanup. [[GH-20986](https://github.com/hashicorp/vault/pull/20986)]
+* ui (enterprise): Fix error message when generating SSH credential with control group [[GH-23025](https://github.com/hashicorp/vault/pull/23025)]
+* ui: Adds missing values to details view after generating PKI certificate [[GH-21635](https://github.com/hashicorp/vault/pull/21635)]
+* ui: Fix blank page or ghost secret when canceling KV secret create [[GH-22541](https://github.com/hashicorp/vault/pull/22541)]
+* ui: Fix display for "Last Vault Rotation" timestamp for static database roles which was not rendering or copyable [[GH-22519](https://github.com/hashicorp/vault/pull/22519)]
+* ui: Fix styling for username input when editing a user [[GH-21771](https://github.com/hashicorp/vault/pull/21771)]
+* ui: Fix styling for viewing certificate in kubernetes configuration [[GH-21968](https://github.com/hashicorp/vault/pull/21968)]
+* ui: Fix the issue where confirm delete dropdown is being cut off [[GH-23066](https://github.com/hashicorp/vault/pull/23066)]
+* ui: Fixed an issue where editing an SSH role would clear `default_critical_options` and `default_extension` if left unchanged. [[GH-21739](https://github.com/hashicorp/vault/pull/21739)]
+* ui: Fixed secrets, leases, and policies filter dropping focus after a single character [[GH-21767](https://github.com/hashicorp/vault/pull/21767)]
+* ui: Fixes filter and search bug in secrets engines [[GH-23123](https://github.com/hashicorp/vault/pull/23123)]
+* ui: Fixes form field label tooltip alignment [[GH-22832](https://github.com/hashicorp/vault/pull/22832)]
+* ui: Fixes issue with certain navigational links incorrectly displaying in child namespaces [[GH-21562](https://github.com/hashicorp/vault/pull/21562)]
+* ui: Fixes login screen display issue with Safari browser [[GH-21582](https://github.com/hashicorp/vault/pull/21582)]
+* ui: Fixes problem displaying certificates issued with unsupported signature algorithms (i.e. ed25519) [[GH-21926](https://github.com/hashicorp/vault/pull/21926)]
+* ui: Fixes styling of private key input when configuring an SSH key [[GH-21531](https://github.com/hashicorp/vault/pull/21531)]
+* ui: Surface DOMException error when browser settings prevent localStorage. [[GH-21503](https://github.com/hashicorp/vault/pull/21503)]
+* ui: correct doctype for index.html [[GH-22153](https://github.com/hashicorp/vault/pull/22153)]
+* ui: don't exclude features present on license [[GH-22855](https://github.com/hashicorp/vault/pull/22855)]
+* ui: fixes `max_versions` default for secret metadata unintentionally overriding kv engine defaults [[GH-22394](https://github.com/hashicorp/vault/pull/22394)]
+* ui: fixes long namespace names overflow in the sidebar
+* ui: fixes model defaults overwriting input value when user tries to clear form input [[GH-22458](https://github.com/hashicorp/vault/pull/22458)]
+* ui: fixes text readability issue in revoke token confirmation dialog [[GH-22390](https://github.com/hashicorp/vault/pull/22390)]
+
+## 1.14.13 Enterprise
+### May 30, 2024
+CHANGES:
+* auth/jwt: Update plugin to v0.16.1 [[GH-27122](https://github.com/hashicorp/vault/pull/27122)]
+* core: Bump Go version to 1.22.2.
+
+IMPROVEMENTS:
+* website/docs: Add note about eventual consietency with the MongoDB Atlas database secrets engine [[GH-24152](https://github.com/hashicorp/vault/pull/24152)]
+
+BUG FIXES:
+* activity (enterprise): fix read-only storage error on upgrades
+* pki: Fix error in cross-signing using ed25519 keys [[GH-27093](https://github.com/hashicorp/vault/pull/27093)]
+* replication (enterprise): fix "given mount path is not in the same namespace as the request" error that can occur when enabling replication for the first time on a secondary cluster
+* secrets/transit: Use 'hash_algorithm' parameter if present in HMAC verify requests. Otherwise fall back to deprecated 'algorithm' parameter. [[GH-27211](https://github.com/hashicorp/vault/pull/27211)]
+
+## 1.14.12 Enterprise
+### April 24, 2024
+
+CHANGES:
+
+* core: Bump Go version to 1.21.9.
+* ui: Update dependencies including D3 libraries [[GH-26346](https://github.com/hashicorp/vault/pull/26346)]
+
+IMPROVEMENTS:
+
+* activity (enterprise): Change minimum retention window in activity log to 48 months
+* core: make the best effort timeout for encryption count tracking persistence configurable via an environment variable. [[GH-25636](https://github.com/hashicorp/vault/pull/25636)]
+* license utilization reporting (enterprise): Add retention months to license utilization reports.
+* sdk/decompression: DecompressWithCanary will now chunk the decompression in memory to prevent loading it all at once. [[GH-26464](https://github.com/hashicorp/vault/pull/26464)]
+* ui: show banner instead of permission denied error when batch token is expired [[GH-26396](https://github.com/hashicorp/vault/pull/26396)]
+
+BUG FIXES:
+
+* secrets/pki: fixed validation bug which rejected ldap schemed URLs in crl_distribution_points. [[GH-26477](https://github.com/hashicorp/vault/pull/26477)]
+* storage/raft (enterprise): Fix a bug where autopilot automated upgrades could fail due to using the wrong upgrade version
+
+## 1.14.11 Enterprise
+### March 28, 2024
+
+SECURITY:
+
+* auth/cert: validate OCSP response was signed by the expected issuer and serial number matched request (CVE-2024-2660) [[GH-26091](https://github.com/hashicorp/vault/pull/26091), [HSEC-2024-07](https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573)]
+
+CHANGES:
+
+* core: Bump Go version to 1.21.8.
+
+IMPROVEMENTS:
+
+* auth/cert: Allow validation with OCSP responses with no NextUpdate time [[GH-25912](https://github.com/hashicorp/vault/pull/25912)]
+* openapi: Fix generated types for duration strings [[GH-20841](https://github.com/hashicorp/vault/pull/20841)]
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20221104090112-13395acd02c5
+
+BUG FIXES:
+
+* auth/cert: Address an issue in which OCSP query responses were not cached [[GH-25986](https://github.com/hashicorp/vault/pull/25986)]
+* auth/cert: Allow cert auth login attempts if ocsp_fail_open is true and OCSP servers are unreachable [[GH-25982](https://github.com/hashicorp/vault/pull/25982)]
+* core/login: Fixed a potential deadlock when a login fails and user lockout is enabled. [[GH-25697](https://github.com/hashicorp/vault/pull/25697)]
+* openapi: Fixing response fields for rekey operations [[GH-25509](https://github.com/hashicorp/vault/pull/25509)]
+* ui: Fix kubernetes auth method roles tab [[GH-25999](https://github.com/hashicorp/vault/pull/25999)]
+
+## 1.14.10
+### February 29, 2024
+
+SECURITY:
+
+* auth/cert: compare public keys of trusted non-CA certificates with incoming
+client certificates to prevent trusting certs with the same serial number
+but not the same public/private key (CVE-2024-2048). [[GH-25649](https://github.com/hashicorp/vault/pull/25649), [HSEC-2024-05](https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382)]
+
+CHANGES:
+
+* core: Bump Go version to 1.20.14.
+
+FEATURES:
+
+* **Manual License Utilization Reporting**: Added manual license
+utilization reporting, which allows users to create manual exports of product-license [metering
+data] to report to Hashicorp.
+
+IMPROVEMENTS:
+
+* auth/cert: Cache trusted certs to reduce memory usage and improve performance of logins. [[GH-25421](https://github.com/hashicorp/vault/pull/25421)]
+* ui: redirect back to current route after reauthentication when token expires [[GH-25335](https://github.com/hashicorp/vault/pull/25335)]
+* ui: remove unnecessary OpenAPI calls for unmanaged auth methods [[GH-25364](https://github.com/hashicorp/vault/pull/25364)]
+
+BUG FIXES:
+
+* core (enterprise): Fix a deadlock that can occur on performance secondary clusters when there are many mounts and a mount is deleted or filtered [[GH-25448](https://github.com/hashicorp/vault/pull/25448)]
+* core/quotas: Deleting a namespace that contains a rate limit quota no longer breaks replication [[GH-25439](https://github.com/hashicorp/vault/pull/25439)]
+* secrets/transform (enterprise): guard against a panic looking up a token in exportable mode with barrier storage.
+* secrets/transit: When provided an invalid input with hash_algorithm=none, a lock was not released properly before reporting an error leading to deadlocks on a subsequent key configuration update. [[GH-25336](https://github.com/hashicorp/vault/pull/25336)]
+* storage/file: Fixing spuriously deleting storage keys ending with .temp [[GH-25395](https://github.com/hashicorp/vault/pull/25395)]
+
+## 1.14.9
+### January 31, 2024
+
+CHANGES:
+
+* core: Bump Go version to 1.20.12.
+* database/snowflake: Update plugin to v0.9.2 [[GH-25057](https://github.com/hashicorp/vault/pull/25057)]
+
+IMPROVEMENTS:
+
+* command/server: display logs on startup immediately if disable-gated-logs flag is set [[GH-24280](https://github.com/hashicorp/vault/pull/24280)]
+* oidc/provider: Adds `code_challenge_methods_supported` to OpenID Connect Metadata [[GH-24979](https://github.com/hashicorp/vault/pull/24979)]
+* storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [[GH-24010](https://github.com/hashicorp/vault/pull/24010)]
+* ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [[GH-18513](https://github.com/hashicorp/vault/pull/18513)]
+
+BUG FIXES:
+
+* helper/pkcs7: Fix slice out-of-bounds panic [[GH-24891](https://github.com/hashicorp/vault/pull/24891)]
+* kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
+* ui: Fixed minor bugs with database secrets engine [[GH-24947](https://github.com/hashicorp/vault/pull/24947)]
+* ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [[GH-24697](https://github.com/hashicorp/vault/pull/24697)]
+* ui: The UI can now be used to create or update database roles by operator without permission on the database connection. [[GH-24660](https://github.com/hashicorp/vault/pull/24660)]
+* ui: fix incorrectly calculated capabilities on PKI issuer endpoints [[GH-24686](https://github.com/hashicorp/vault/pull/24686)]
+
+## 1.14.8
+### December 06, 2023
+
+SECURITY:
+
+* core: Fixes an issue present in both Vault and Vault Enterprise since Vault 1.12.0, where Vault is vulnerable to a denial of service through memory exhaustion of the host when handling large HTTP requests from a client. (see [CVE-2023-6337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6337) & [HCSEC-2023-34](https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741))
+
+CHANGES:
+
+* identity (enterprise): POST requests to the `/identity/entity/merge` endpoint
+are now always forwarded from standbys to the active node. [[GH-24325](https://github.com/hashicorp/vault/pull/24325)]
+
+BUG FIXES:
+
+* agent/logging: Agent should now honor correct -log-format and -log-file settings in logs generated by the consul-template library. [[GH-24252](https://github.com/hashicorp/vault/pull/24252)]
+* api: Fix deadlock on calls to sys/leader with a namespace configured
+on the request. [[GH-24256](https://github.com/hashicorp/vault/pull/24256)]
+* core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [[GH-24336](https://github.com/hashicorp/vault/pull/24336)]
+* ui: Fix payload sent when disabling replication [[GH-24292](https://github.com/hashicorp/vault/pull/24292)]
+
+## 1.14.7
+### November 30, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.20.11.
+
+IMPROVEMENTS:
+
+* core (enterprise): Speed up unseal when using namespaces
+* secrets/pki: do not check TLS validity on ACME requests redirected to https [[GH-22521](https://github.com/hashicorp/vault/pull/22521)]
+* ui: Sort list view of entities and aliases alphabetically using the item name [[GH-24103](https://github.com/hashicorp/vault/pull/24103)]
+* ui: Update flat, shell-quote and swagger-ui-dist packages. Remove swagger-ui styling overrides. [[GH-23700](https://github.com/hashicorp/vault/pull/23700)]
+
+BUG FIXES:
+
+* activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
+* auth/cert: Handle errors related to expired OCSP server responses [[GH-24193](https://github.com/hashicorp/vault/pull/24193)]
+* core/config: Use correct HCL config value when configuring `log_requests_level`. [[GH-24058](https://github.com/hashicorp/vault/pull/24058)]
+* core/quotas: Close rate-limit blocked client purge goroutines when sealing [[GH-24108](https://github.com/hashicorp/vault/pull/24108)]
+* replication (enterprise): disallow configuring paths filter for a mount path that does not exist
+* secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [[GH-24192](https://github.com/hashicorp/vault/pull/24192)]
+* secrets/transit: Fix a panic when attempting to export a public RSA key [[GH-24054](https://github.com/hashicorp/vault/pull/24054)]
+* ui: Fix error when tuning token auth configuration within namespace [[GH-24147](https://github.com/hashicorp/vault/pull/24147)]
+
+## 1.14.6
+### November 09, 2023
+
+SECURITY:
+* core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [[HSEC-2023-33](https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926)]
+
+CHANGES:
+
+* auth/approle: Normalized error response messages when invalid credentials are provided [[GH-23786](https://github.com/hashicorp/vault/pull/23786)]
+* secrets/mongodbatlas: Update plugin to v0.10.2 [[GH-23849](https://github.com/hashicorp/vault/pull/23849)]
+
+FEATURES:
+
+* cli/snapshot: Add CLI tool to inspect Vault snapshots [[GH-23457](https://github.com/hashicorp/vault/pull/23457)]
+
+IMPROVEMENTS:
+
+* storage/etcd: etcd should only return keys when calling List() [[GH-23872](https://github.com/hashicorp/vault/pull/23872)]
+
+BUG FIXES:
+
+* api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
+on the request. [[GH-23861](https://github.com/hashicorp/vault/pull/23861)]
+* core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
+* core/activity: Fixes segments fragment loss due to exceeding entry record size limit [[GH-23781](https://github.com/hashicorp/vault/pull/23781)]
+* core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [[GH-23802](https://github.com/hashicorp/vault/pull/23802)]
+* core: Revert PR causing memory consumption bug [[GH-23986](https://github.com/hashicorp/vault/pull/23986)]
+* core: Skip unnecessary deriving of policies during Login MFA Check. [[GH-23894](https://github.com/hashicorp/vault/pull/23894)]
+* core: fix bug where deadlock detection was always on for expiration and quotas. 
+These can now be configured individually with `detect_deadlocks`. [[GH-23902](https://github.com/hashicorp/vault/pull/23902)]
+* core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [[GH-23874](https://github.com/hashicorp/vault/pull/23874)]
+* expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [[GH-24027](https://github.com/hashicorp/vault/pull/24027)]
+
+## 1.14.5
+### October 25, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.20.10.
+* replication (enterprise): Switch to non-deprecated gRPC field for resolver target host
+
+IMPROVEMENTS:
+
+* api/plugins: add `tls-server-name` arg for plugin registration [[GH-23549](https://github.com/hashicorp/vault/pull/23549)]
+* core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [[GH-22567](https://github.com/hashicorp/vault/pull/22567)]
+* ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [[GH-23747](https://github.com/hashicorp/vault/pull/23747)]
+
+BUG FIXES:
+
+* command/server: Fix bug with sigusr2 where pprof files were not closed correctly [[GH-23636](https://github.com/hashicorp/vault/pull/23636)]
+* events: Ignore sending context to give more time for events to send [[GH-23500](https://github.com/hashicorp/vault/pull/23500)]
+* expiration: Prevent large lease loads from delaying state changes, e.g. becoming active or standby. [[GH-23282](https://github.com/hashicorp/vault/pull/23282)]
+* kmip (enterprise): Improve handling of failures due to storage replication issues.
+* kmip (enterprise): Return a structure in the response for query function Query Server Information.
+* mongo-db: allow non-admin database for root credential rotation [[GH-23240](https://github.com/hashicorp/vault/pull/23240)]
+* replication (enterprise): Fix a bug where undo logs would only get enabled on the initial node in a cluster.
+* replication (enterprise): Fix a missing unlock when changing replication state
+* secrets/consul: Fix revocations when Vault has an access token using specific namespace and admin partition policies [[GH-23010](https://github.com/hashicorp/vault/pull/23010)]
+* secrets/pki: Stop processing in-flight ACME verifications when an active node steps down [[GH-23278](https://github.com/hashicorp/vault/pull/23278)]
+* secrets/transit (enterprise): Address an issue using sign/verify operations with managed keys returning an error about it not containing a private key
+* secrets/transit (enterprise): Address panic when using GCP,AWS,Azure managed keys for encryption operations. At this time all encryption operations for the cloud providers have been disabled, only signing operations are supported.
+* secrets/transit (enterprise): Apply hashing arguments and defaults to managed key sign/verify operations
+* secrets/transit: Do not allow auto rotation on managed_key key types [[GH-23723](https://github.com/hashicorp/vault/pull/23723)]
+* storage/consul: fix a bug where an active node in a specific sort of network
+partition could continue to write data to Consul after a new leader is elected
+potentially causing data loss or corruption for keys with many concurrent
+writers. For Enterprise clusters this could cause corruption of the merkle trees
+leading to failure to complete merkle sync without a full re-index. [[GH-23013](https://github.com/hashicorp/vault/pull/23013)]
+* ui: Decode the connection url for display on the connection details page [[GH-23695](https://github.com/hashicorp/vault/pull/23695)]
+* ui: Fix AWS secret engine to allow empty policy_document field. [[GH-23470](https://github.com/hashicorp/vault/pull/23470)]
+* ui: Fix the copy token button in the sidebar navigation window when in a collapsed state. [[GH-23331](https://github.com/hashicorp/vault/pull/23331)]
+* ui: Fixes issue with sidebar navigation links disappearing when navigating to policies when a user is not authorized [[GH-23516](https://github.com/hashicorp/vault/pull/23516)]
+
+## 1.14.4
+### September 27, 2023
+
+SECURITY:
+
+* sentinel (enterprise): Sentinel RGP policies allowed for cross-namespace denial-of-service. This vulnerability, CVE-2023-3775, is fixed in Vault Enterprise 1.15.0, 1.14.4, and 1.13.8. [[HSEC-2023-29](https://discuss.hashicorp.com/t/hcsec-2023-29-vault-enterprise-s-sentinel-rgp-policies-allowed-for-cross-namespace-denial-of-service/58653)]
+
+CHANGES:
+
+* core (enterprise): Ensure Role Governing Policies are only applied down the namespace hierarchy
+
+IMPROVEMENTS:
+
+* ui: Add pagination to PKI roles, keys, issuers, and certificates list pages [[GH-23193](https://github.com/hashicorp/vault/pull/23193)]
+* ui: Added allowed_domains_template field for CA type role in SSH engine [[GH-23119](https://github.com/hashicorp/vault/pull/23119)]
+* ui: Adds tidy_revoked_certs to PKI tidy status page [[GH-23232](https://github.com/hashicorp/vault/pull/23232)]
+* ui: Adds warning before downloading KV v2 secret values [[GH-23260](https://github.com/hashicorp/vault/pull/23260)]
+
+BUG FIXES:
+
+* core: Fixes list password policy to include those with names containing / characters. [[GH-23155](https://github.com/hashicorp/vault/pull/23155)]
+* secrets/pki: Fix removal of issuers to clean up unreferenced CRLs. [[GH-23007](https://github.com/hashicorp/vault/pull/23007)]
+* ui (enterprise): Fix error message when generating SSH credential with control group [[GH-23025](https://github.com/hashicorp/vault/pull/23025)]
+* ui: Fix the issue where confirm delete dropdown is being cut off [[GH-23066](https://github.com/hashicorp/vault/pull/23066)]
+* ui: Fixes filter and search bug in secrets engines [[GH-23123](https://github.com/hashicorp/vault/pull/23123)]
+* ui: don't exclude features present on license [[GH-22855](https://github.com/hashicorp/vault/pull/22855)]
+
+## 1.14.3
+### September 13, 2023
+
+SECURITY:
+
+* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. This vulnerability, CVE-2023-4680, is fixed in Vault 1.14.3, 1.13.7, and 1.12.11. [[GH-22852](https://github.com/hashicorp/vault/pull/22852), [HSEC-2023-28](https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249)]
+
+CHANGES:
+
+* core: Bump Go version to 1.20.8.
+
+FEATURES:
+
+* ** Merkle Tree Corruption Detection (enterprise) **: Add a new endpoint to check merkle tree corruption.
+
+IMPROVEMENTS:
+
+* auth/ldap: improved login speed by adding concurrency to LDAP token group searches [[GH-22659](https://github.com/hashicorp/vault/pull/22659)]
+* core/quotas: Add configuration to allow skipping of expensive role calculations [[GH-22651](https://github.com/hashicorp/vault/pull/22651)]
+* kmip (enterprise): reduce latency of KMIP operation handling
+
+BUG FIXES:
+
+* cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to `table`. [[GH-22818](https://github.com/hashicorp/vault/pull/22818)]
+* core/quotas: Only perform ResolveRoleOperation for role-based quotas and lease creation. [[GH-22597](https://github.com/hashicorp/vault/pull/22597)]
+* core/quotas: Reduce overhead for role calculation when using cloud auth methods. [[GH-22583](https://github.com/hashicorp/vault/pull/22583)]
+* core/seal: add a workaround for potential connection [[hangs](https://github.com/Azure/azure-sdk-for-go/issues/21346)] in Azure autoseals. [[GH-22760](https://github.com/hashicorp/vault/pull/22760)]
+* core: All subloggers now reflect configured log level on reload. [[GH-22038](https://github.com/hashicorp/vault/pull/22038)]
+* kmip (enterprise): fix date handling error with some re-key operations
+* raft/autopilot: Add dr-token flag for raft autopilot cli commands [[GH-21165](https://github.com/hashicorp/vault/pull/21165)]
+* replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
+* secrets/transit: fix panic when providing non-PEM formatted public key for import [[GH-22753](https://github.com/hashicorp/vault/pull/22753)]
+* ui: fixes long namespace names overflow in the sidebar
+
+## 1.14.2
+### August 30, 2023
+
+CHANGES:
+
+* auth/azure: Update plugin to v0.16.0 [[GH-22277](https://github.com/hashicorp/vault/pull/22277)]
+* core: Bump Go version to 1.20.7.
+* database/snowflake: Update plugin to v0.9.0 [[GH-22516](https://github.com/hashicorp/vault/pull/22516)]
+
+IMPROVEMENTS:
+
+* auto-auth/azure: Added Azure Workload Identity Federation support to auto-auth (for Vault Agent and Vault Proxy). [[GH-22264](https://github.com/hashicorp/vault/pull/22264)]
+* core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [[GH-22235](https://github.com/hashicorp/vault/pull/22235)]
+* kmip (enterprise): Add namespace lock and unlock support [[GH-21925](https://github.com/hashicorp/vault/pull/21925)]
+* replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
+* secrets/database: Improves error logging for static role rotations by including the database and role names. [[GH-22253](https://github.com/hashicorp/vault/pull/22253)]
+* storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [[GH-22040](https://github.com/hashicorp/vault/pull/22040)]
+* ui: KV View Secret card will link to list view if input ends in "/" [[GH-22502](https://github.com/hashicorp/vault/pull/22502)]
+* ui: adds allowed_user_ids field to create role form and user_ids to generate certificates form in pki [[GH-22191](https://github.com/hashicorp/vault/pull/22191)]
+* ui: enables create and update KV secret workflow when control group present [[GH-22471](https://github.com/hashicorp/vault/pull/22471)]
+* website/docs: Fix link formatting in Vault lambda extension docs [[GH-22396](https://github.com/hashicorp/vault/pull/22396)]
+
+BUG FIXES:
+
+* activity (enterprise): Fix misattribution of entities to no or child namespace auth methods [[GH-18809](https://github.com/hashicorp/vault/pull/18809)]
+* agent: Environment variable VAULT_CACERT_BYTES now works for Vault Agent templates. [[GH-22322](https://github.com/hashicorp/vault/pull/22322)]
+* api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [[GH-22523](https://github.com/hashicorp/vault/pull/22523)]
+* core (enterprise): Remove MFA Configuration for namespace when deleting namespace
+* core/metrics: vault.raft_storage.bolt.write.time should be a counter not a summary [[GH-22468](https://github.com/hashicorp/vault/pull/22468)]
+* core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
+Also fix a related potential deadlock. [[GH-21110](https://github.com/hashicorp/vault/pull/21110)]
+* core:  Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [[GH-22137](https://github.com/hashicorp/vault/pull/22137)]
+* core: Fix bug where background thread to update locked user entries runs on DR secondaries. [[GH-22355](https://github.com/hashicorp/vault/pull/22355)]
+* core: Fix readonly errors that could occur while loading mounts/auths during unseal [[GH-22362](https://github.com/hashicorp/vault/pull/22362)]
+* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-21470](https://github.com/hashicorp/vault/pull/21470)]
+* expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [[GH-22374](https://github.com/hashicorp/vault/pull/22374)]
+* license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [[GH-22363](https://github.com/hashicorp/vault/pull/22363)]
+* replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
+* replication (enterprise): Fix panic when update-primary was called on demoted clusters using update_primary_addrs
+* replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
+* sdk/ldaputil: Properly escape user filters when using UPN domains
+sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [[GH-22249](https://github.com/hashicorp/vault/pull/22249)]
+* secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [[GH-22330](https://github.com/hashicorp/vault/pull/22330)]
+* secrets/transform (enterprise): Batch items with repeated tokens in the tokenization decode api will now contain the decoded_value element
+* secrets/transform (enterprise): Fix nil panic when encoding a tokenization transformation on a non-active node
+* secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
+* storage/raft: Fix race where new follower joining can get pruned by dead server cleanup. [[GH-20986](https://github.com/hashicorp/vault/pull/20986)]
+* ui: Fix blank page or ghost secret when canceling KV secret create [[GH-22541](https://github.com/hashicorp/vault/pull/22541)]
+* ui: fixes `max_versions` default for secret metadata unintentionally overriding kv engine defaults [[GH-22394](https://github.com/hashicorp/vault/pull/22394)]
+* ui: fixes model defaults overwriting input value when user tries to clear form input [[GH-22458](https://github.com/hashicorp/vault/pull/22458)]
+* ui: fixes text readability issue in revoke token confirmation dialog [[GH-22390](https://github.com/hashicorp/vault/pull/22390)]
+
+## 1.14.1
+### July 25, 2023
+
+SECURITY
+
+* auth/ldap: Normalize HTTP response codes when invalid credentials are provided to prevent user enumeration. This vulnerability, CVE-2023-3462, is fixed in Vault 1.14.1 and 1.13.5. [[GH-21282](https://github.com/hashicorp/vault/pull/21282), [HSEC-2023-24](https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714)]
+* core/namespace (enterprise): An unhandled error in Vault Enterprise’s namespace creation may cause the Vault process to crash, potentially resulting in denial of service. This vulnerability, CVE-2023-3774, is fixed in Vault Enterprise 1.14.1, 1.13.5, and 1.12.9. [[HSEC_2023-23](https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617)]
+
+CHANGES:
+
+* core/namespace (enterprise): Introduce the concept of high-privilege namespace (administrative namespace),
+which will have access to some system backend paths that were previously only accessible in the root namespace. [[GH-21215](https://github.com/hashicorp/vault/pull/21215)]
+* secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
+* storage/aerospike: Aerospike storage shouldn't be used on 32-bit architectures and is now unsupported on them. [[GH-20825](https://github.com/hashicorp/vault/pull/20825)]
+
+IMPROVEMENTS:
+
+* core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
+* eventbus: updated go-eventlogger library to allow removal of nodes referenced by pipelines (used for subscriptions) [[GH-21623](https://github.com/hashicorp/vault/pull/21623)]
+* openapi: Better mount points for kv-v1 and kv-v2 in openapi.json [[GH-21563](https://github.com/hashicorp/vault/pull/21563)]
+* replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
+* secrets/pki: Add a parameter to allow ExtKeyUsage field usage from a role within ACME. [[GH-21702](https://github.com/hashicorp/vault/pull/21702)]
+* secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
+* sys/metrics (enterprise): Adds a gauge metric that tracks whether enterprise builtin secret plugins are enabled. [[GH-21681](https://github.com/hashicorp/vault/pull/21681)]
+
+BUG FIXES:
+
+* agent: Fix "generate-config" command documentation URL [[GH-21466](https://github.com/hashicorp/vault/pull/21466)]
+* auth/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21800](https://github.com/hashicorp/vault/pull/21800)]
+* auth/token, sys: Fix path-help being unavailable for some list-only endpoints [[GH-18571](https://github.com/hashicorp/vault/pull/18571)]
+* auth/token: Fix parsing of `auth/token/create` fields to avoid incorrect warnings about ignored parameters [[GH-18556](https://github.com/hashicorp/vault/pull/18556)]
+* awsutil: Update awsutil to v0.2.3 to fix a regression where Vault no longer
+respects `AWS_ROLE_ARN`, `AWS_WEB_IDENTITY_TOKEN_FILE`, and `AWS_ROLE_SESSION_NAME`. [[GH-21951](https://github.com/hashicorp/vault/pull/21951)]
+* core/managed-keys (enterprise): Allow certain symmetric PKCS#11 managed key mechanisms (AES CBC with and without padding) to operate without an HMAC.
+* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-24170](https://github.com/hashicorp/vault/pull/24170)]
+* core: Fixed issue with some durations not being properly parsed to include days. [[GH-21357](https://github.com/hashicorp/vault/pull/21357)]
+* identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [[GH-20965](https://github.com/hashicorp/vault/pull/20965)]
+* openapi: Fix response schema for PKI Issue requests [[GH-21449](https://github.com/hashicorp/vault/pull/21449)]
+* openapi: Fix schema definitions for PKI EAB APIs [[GH-21458](https://github.com/hashicorp/vault/pull/21458)]
+* replication (enterprise): update primary cluster address after DR failover
+* secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21631](https://github.com/hashicorp/vault/pull/21631)]
+* secrets/pki: Fix bug with ACME tidy, 'unable to determine acme base folder path'. [[GH-21870](https://github.com/hashicorp/vault/pull/21870)]
+* secrets/pki: Fix preserving acme_account_safety_buffer on config/auto-tidy. [[GH-21870](https://github.com/hashicorp/vault/pull/21870)]
+* secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error: `no managed key found with uuid`. [[GH-21316](https://github.com/hashicorp/vault/pull/21316)]
+* secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
+* secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
+* serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [[GH-21642](https://github.com/hashicorp/vault/pull/21642)]
+* ui: Adds missing values to details view after generating PKI certificate [[GH-21635](https://github.com/hashicorp/vault/pull/21635)]
+* ui: Fixed an issue where editing an SSH role would clear `default_critical_options` and `default_extension` if left unchanged. [[GH-21739](https://github.com/hashicorp/vault/pull/21739)]
+* ui: Fixed secrets, leases, and policies filter dropping focus after a single character [[GH-21767](https://github.com/hashicorp/vault/pull/21767)]
+* ui: Fixes issue with certain navigational links incorrectly displaying in child namespaces [[GH-21562](https://github.com/hashicorp/vault/pull/21562)]
+* ui: Fixes login screen display issue with Safari browser [[GH-21582](https://github.com/hashicorp/vault/pull/21582)]
+* ui: Fixes problem displaying certificates issued with unsupported signature algorithms (i.e. ed25519) [[GH-21926](https://github.com/hashicorp/vault/pull/21926)]
+* ui: Fixes styling of private key input when configuring an SSH key [[GH-21531](https://github.com/hashicorp/vault/pull/21531)]
+* ui: Surface DOMException error when browser settings prevent localStorage. [[GH-21503](https://github.com/hashicorp/vault/pull/21503)]
+
+## 1.14.0
+### June 21, 2023
+
+SECURITY:
+
+* ui: key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. [[HSEC-2023-17](https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814)]
+
+BREAKING CHANGES:
+
+* secrets/pki: Maintaining running count of certificates will be turned off by default.
+To re-enable keeping these metrics available on the tidy status endpoint, enable
+maintain_stored_certificate_counts on tidy-config, to also publish them to the
+metrics consumer, enable publish_stored_certificate_count_metrics . [[GH-18186](https://github.com/hashicorp/vault/pull/18186)]
+
+CHANGES:
+
+* auth/alicloud: Updated plugin from v0.14.0 to v0.15.0 [[GH-20758](https://github.com/hashicorp/vault/pull/20758)]
+* auth/azure: Updated plugin from v0.13.0 to v0.15.0 [[GH-20816](https://github.com/hashicorp/vault/pull/20816)]
+* auth/centrify: Updated plugin from v0.14.0 to v0.15.1 [[GH-20745](https://github.com/hashicorp/vault/pull/20745)]
+* auth/gcp: Updated plugin from v0.15.0 to v0.16.0 [[GH-20725](https://github.com/hashicorp/vault/pull/20725)]
+* auth/jwt: Updated plugin from v0.15.0 to v0.16.0 [[GH-20799](https://github.com/hashicorp/vault/pull/20799)]
+* auth/kubernetes: Update plugin to v0.16.0 [[GH-20802](https://github.com/hashicorp/vault/pull/20802)]
+* core: Bump Go version to 1.20.5.
+* core: Remove feature toggle for SSCTs, i.e. the env var VAULT_DISABLE_SERVER_SIDE_CONSISTENT_TOKENS. [[GH-20834](https://github.com/hashicorp/vault/pull/20834)]
+* core: Revert #19676 (VAULT_GRPC_MIN_CONNECT_TIMEOUT env var) as we decided it was unnecessary. [[GH-20826](https://github.com/hashicorp/vault/pull/20826)]
+* database/couchbase: Updated plugin from v0.9.0 to v0.9.2 [[GH-20764](https://github.com/hashicorp/vault/pull/20764)]
+* database/redis-elasticache: Updated plugin from v0.2.0 to v0.2.1 [[GH-20751](https://github.com/hashicorp/vault/pull/20751)]
+* replication (enterprise): Add a new parameter for the update-primary API call
+that allows for setting of the primary cluster addresses directly, instead of
+via a token.
+* secrets/ad: Updated plugin from v0.10.1-0.20230329210417-0b2cdb26cf5d to v0.16.0 [[GH-20750](https://github.com/hashicorp/vault/pull/20750)]
+* secrets/alicloud: Updated plugin from v0.5.4-beta1.0.20230330124709-3fcfc5914a22 to v0.15.0 [[GH-20787](https://github.com/hashicorp/vault/pull/20787)]
+* secrets/aure: Updated plugin from v0.15.0 to v0.16.0 [[GH-20777](https://github.com/hashicorp/vault/pull/20777)]
+* secrets/database/mongodbatlas: Updated plugin from v0.9.0 to v0.10.0 [[GH-20882](https://github.com/hashicorp/vault/pull/20882)]
+* secrets/database/snowflake: Updated plugin from v0.7.0 to v0.8.0 [[GH-20807](https://github.com/hashicorp/vault/pull/20807)]
+* secrets/gcp: Updated plugin from v0.15.0 to v0.16.0 [[GH-20818](https://github.com/hashicorp/vault/pull/20818)]
+* secrets/keymgmt: Updated plugin to v0.9.1
+* secrets/kubernetes: Update plugin to v0.5.0 [[GH-20802](https://github.com/hashicorp/vault/pull/20802)]
+* secrets/mongodbatlas: Updated plugin from v0.9.1 to v0.10.0 [[GH-20742](https://github.com/hashicorp/vault/pull/20742)]
+* secrets/pki: Allow issuance of root CAs without AIA, when templated AIA information includes issuer_id. [[GH-21209](https://github.com/hashicorp/vault/pull/21209)]
+* secrets/pki: Warning when issuing leafs from CSRs with basic constraints. In the future, issuance of non-CA leaf certs from CSRs with asserted IsCA Basic Constraints will be prohibited. [[GH-20654](https://github.com/hashicorp/vault/pull/20654)]
+
+FEATURES:
+
+* **AWS Static Roles**: The AWS Secrets Engine can manage static roles configured by users. [[GH-20536](https://github.com/hashicorp/vault/pull/20536)]
+* **Automated License Utilization Reporting**: Added automated license
+utilization reporting, which sends minimal product-license [metering
+data](https://developer.hashicorp.com/vault/docs/enterprise/license/utilization-reporting)
+to HashiCorp without requiring you to manually collect and report them.
+* **Environment Variables through Vault Agent**: Introducing a new process-supervisor mode for Vault Agent which allows injecting secrets as environment variables into a child process using a new `env_template` configuration stanza. The process-supervisor configuration can be generated with a new `vault agent generate-config` helper tool. [[GH-20530](https://github.com/hashicorp/vault/pull/20530)]
+* **MongoDB Atlas Database Secrets**: Adds support for client certificate credentials [[GH-20425](https://github.com/hashicorp/vault/pull/20425)]
+* **MongoDB Atlas Database Secrets**: Adds support for generating X.509 certificates on dynamic roles for user authentication [[GH-20882](https://github.com/hashicorp/vault/pull/20882)]
+* **NEW PKI Workflow in UI**: Completes generally available rollout of new PKI UI that provides smoother mount configuration and a more guided user experience [[GH-pki-ui-improvements](https://github.com/hashicorp/vault/pull/pki-ui-improvements)]
+* **Secrets/Auth Plugin Multiplexing**: The plugin will be multiplexed when run
+as an external plugin by vault versions that support secrets/auth plugin
+multiplexing (> 1.12) [[GH-19215](https://github.com/hashicorp/vault/pull/19215)]
+* **Sidebar Navigation in UI**: A new sidebar navigation panel has been added in the UI to replace the top navigation bar. [[GH-19296](https://github.com/hashicorp/vault/pull/19296)]
+* **Vault PKI ACME Server**: Support for the ACME certificate lifecycle management protocol has been added to the Vault PKI Plugin. This allows standard ACME clients, such as the EFF's certbot and the CNCF's k8s cert-manager, to request certificates from a Vault server with no knowledge of Vault APIs or authentication mechanisms. For public-facing Vault instances, we recommend requiring External Account Bindings (EAB) to limit the ability to request certificates to only authenticated clients. [[GH-20752](https://github.com/hashicorp/vault/pull/20752)]
+* **Vault Proxy**: Introduced Vault Proxy, a new subcommand of the Vault binary that can be invoked using `vault proxy -config=config.hcl`. It currently has the same feature set as Vault Agent's API proxy, but the two may diverge in the future. We plan to deprecate the API proxy functionality of Vault Agent in a future release. [[GH-20548](https://github.com/hashicorp/vault/pull/20548)]
+* **OCI Auto-Auth**: Add OCI (Oracle Cloud Infrastructure) auto-auth method [[GH-19260](https://github.com/hashicorp/vault/pull/19260)]
+
+IMPROVEMENTS:
+
+* * api: Add Config.TLSConfig method to fetch the TLS configuration from a client config. [[GH-20265](https://github.com/hashicorp/vault/pull/20265)]
+* * physical/etcd: Upgrade etcd3 client to v3.5.7 [[GH-20261](https://github.com/hashicorp/vault/pull/20261)]
+* activitylog: EntityRecord protobufs now contain a ClientType field for
+distinguishing client sources. [[GH-20626](https://github.com/hashicorp/vault/pull/20626)]
+* agent: Add integration tests for agent running in process supervisor mode [[GH-20741](https://github.com/hashicorp/vault/pull/20741)]
+* agent: Add logic to validate env_template entries in configuration [[GH-20569](https://github.com/hashicorp/vault/pull/20569)]
+* agent: Added `reload` option to cert auth configuration in case of external renewals of local x509 key-pairs. [[GH-19002](https://github.com/hashicorp/vault/pull/19002)]
+* agent: JWT auto-auth has a new config option, `remove_jwt_follows_symlinks` (default: false), that, if set to true will now remove the JWT, instead of the symlink to the JWT, if a symlink to a JWT has been provided in the `path` option, and the `remove_jwt_after_reading` config option is set to true (default). [[GH-18863](https://github.com/hashicorp/vault/pull/18863)]
+* agent: Vault Agent now reports its name and version as part of the User-Agent header in all requests issued. [[GH-19776](https://github.com/hashicorp/vault/pull/19776)]
+* agent: initial implementation of a process runner for injecting secrets via environment variables via vault agent [[GH-20628](https://github.com/hashicorp/vault/pull/20628)]
+* api: GET ... /sys/internal/counters/activity?current_billing_period=true now
+results in a response which contains the full billing period [[GH-20694](https://github.com/hashicorp/vault/pull/20694)]
+* api: `/sys/internal/counters/config` endpoint now contains read-only
+`minimum_retention_months`. [[GH-20150](https://github.com/hashicorp/vault/pull/20150)]
+* api: `/sys/internal/counters/config` endpoint now contains read-only
+`reporting_enabled` and `billing_start_timestamp` fields. [[GH-20086](https://github.com/hashicorp/vault/pull/20086)]
+* api: property based testing for LifetimeWatcher sleep duration calculation [[GH-17919](https://github.com/hashicorp/vault/pull/17919)]
+* audit: add plugin metadata, including plugin name, type, version, sha256, and whether plugin is external, to audit logging [[GH-19814](https://github.com/hashicorp/vault/pull/19814)]
+* audit: forwarded requests can now contain host metadata on the node it was sent 'from' or a flag to indicate that it was forwarded.
+* auth/cert: Better return OCSP validation errors during login to the caller. [[GH-20234](https://github.com/hashicorp/vault/pull/20234)]
+* auth/kerberos: Enable plugin multiplexing
+auth/kerberos: Upgrade plugin dependencies [[GH-20771](https://github.com/hashicorp/vault/pull/20771)]
+* auth/ldap: allow configuration of alias dereferencing in LDAP search [[GH-18230](https://github.com/hashicorp/vault/pull/18230)]
+* auth/ldap: allow providing the LDAP password via an env var when authenticating via the CLI [[GH-18225](https://github.com/hashicorp/vault/pull/18225)]
+* auth/oidc: Adds support for group membership parsing when using IBM ISAM as an OIDC provider. [[GH-19247](https://github.com/hashicorp/vault/pull/19247)]
+* build: Prefer GOBIN when set over GOPATH/bin when building the binary [[GH-19862](https://github.com/hashicorp/vault/pull/19862)]
+* cli: Add walkSecretsTree helper function, which recursively walks secrets rooted at the given path [[GH-20464](https://github.com/hashicorp/vault/pull/20464)]
+* cli: Improve addPrefixToKVPath helper [[GH-20488](https://github.com/hashicorp/vault/pull/20488)]
+* command/server (enterprise): -dev-three-node now creates perf standbys instead of regular standbys. [[GH-20629](https://github.com/hashicorp/vault/pull/20629)]
+* command/server: Add support for dumping pprof files to the filesystem via SIGUSR2 when
+`VAULT_PPROF_WRITE_TO_FILE=true` is set on the server. [[GH-20609](https://github.com/hashicorp/vault/pull/20609)]
+* command/server: New -dev-cluster-json writes a file describing the dev cluster in -dev and -dev-three-node modes, plus -dev-three-node now enables unauthenticated metrics and pprof requests. [[GH-20224](https://github.com/hashicorp/vault/pull/20224)]
+* core (enterprise): add configuration for license reporting [[GH-19891](https://github.com/hashicorp/vault/pull/19891)]
+* core (enterprise): license updates trigger a reload of reporting and the activity log [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
+* core (enterprise): support reloading configuration for automated reporting via SIGHUP [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
+* core (enterprise): vault server command now allows for opt-out of automated
+reporting via the `OPTOUT_LICENSE_REPORTING` environment variable. [[GH-3939](https://github.com/hashicorp/vault/pull/3939)]
+* core, secrets/pki, audit: Update dependency go-jose to v3 due to v2 deprecation. [[GH-20559](https://github.com/hashicorp/vault/pull/20559)]
+* core/activity: error when attempting to update retention configuration below the minimum [[GH-20078](https://github.com/hashicorp/vault/pull/20078)]
+* core/activity: refactor the activity log's generation of precomputed queries [[GH-20073](https://github.com/hashicorp/vault/pull/20073)]
+* core: Add possibility to decode a generated encoded root token via the rest API [[GH-20595](https://github.com/hashicorp/vault/pull/20595)]
+* core: include namespace path in granting_policies block of audit log
+* core: include reason for ErrReadOnly on PBPWF writing failures
+* core: report intermediate error messages during request forwarding [[GH-20643](https://github.com/hashicorp/vault/pull/20643)]
+* core:provide more descriptive error message when calling enterprise feature paths in open-source [[GH-18870](https://github.com/hashicorp/vault/pull/18870)]
+* database/elasticsearch: Upgrade plugin dependencies [[GH-20767](https://github.com/hashicorp/vault/pull/20767)]
+* database/mongodb: upgrade mongo driver to 1.11 [[GH-19954](https://github.com/hashicorp/vault/pull/19954)]
+* database/redis: Upgrade plugin dependencies [[GH-20763](https://github.com/hashicorp/vault/pull/20763)]
+* http: Support responding to HEAD operation from plugins [[GH-19520](https://github.com/hashicorp/vault/pull/19520)]
+* openapi: Add openapi response definitions to /sys defined endpoints. [[GH-18633](https://github.com/hashicorp/vault/pull/18633)]
+* openapi: Add openapi response definitions to pki/config_*.go [[GH-18376](https://github.com/hashicorp/vault/pull/18376)]
+* openapi: Add openapi response definitions to vault/logical_system_paths.go defined endpoints. [[GH-18515](https://github.com/hashicorp/vault/pull/18515)]
+* openapi: Consistently stop Vault server on exit in gen_openapi.sh [[GH-19252](https://github.com/hashicorp/vault/pull/19252)]
+* openapi: Improve operationId/request/response naming strategy [[GH-19319](https://github.com/hashicorp/vault/pull/19319)]
+* openapi: add openapi response definitions to /sys/internal endpoints [[GH-18542](https://github.com/hashicorp/vault/pull/18542)]
+* openapi: add openapi response definitions to /sys/rotate endpoints [[GH-18624](https://github.com/hashicorp/vault/pull/18624)]
+* openapi: add openapi response definitions to /sys/seal endpoints [[GH-18625](https://github.com/hashicorp/vault/pull/18625)]
+* openapi: add openapi response definitions to /sys/tool endpoints [[GH-18626](https://github.com/hashicorp/vault/pull/18626)]
+* openapi: add openapi response definitions to /sys/version-history, /sys/leader, /sys/ha-status, /sys/host-info, /sys/in-flight-req [[GH-18628](https://github.com/hashicorp/vault/pull/18628)]
+* openapi: add openapi response definitions to /sys/wrapping endpoints [[GH-18627](https://github.com/hashicorp/vault/pull/18627)]
+* openapi: add openapi response defintions to /sys/auth endpoints [[GH-18465](https://github.com/hashicorp/vault/pull/18465)]
+* openapi: add openapi response defintions to /sys/capabilities endpoints [[GH-18468](https://github.com/hashicorp/vault/pull/18468)]
+* openapi: add openapi response defintions to /sys/config and /sys/generate-root endpoints [[GH-18472](https://github.com/hashicorp/vault/pull/18472)]
+* openapi: added ability to validate response structures against openapi schema for test clusters [[GH-19043](https://github.com/hashicorp/vault/pull/19043)]
+* sdk/framework: Fix non-deterministic ordering of 'required' fields in OpenAPI spec [[GH-20881](https://github.com/hashicorp/vault/pull/20881)]
+* sdk: Add new docker-based cluster testing framework to the sdk. [[GH-20247](https://github.com/hashicorp/vault/pull/20247)]
+* secrets/ad: upgrades dependencies [[GH-19829](https://github.com/hashicorp/vault/pull/19829)]
+* secrets/alicloud: upgrades dependencies [[GH-19846](https://github.com/hashicorp/vault/pull/19846)]
+* secrets/consul: Improve error message when ACL bootstrapping fails. [[GH-20891](https://github.com/hashicorp/vault/pull/20891)]
+* secrets/database: Adds error message requiring password on root crednetial rotation. [[GH-19103](https://github.com/hashicorp/vault/pull/19103)]
+* secrets/gcpkms: Enable plugin multiplexing
+secrets/gcpkms: Upgrade plugin dependencies [[GH-20784](https://github.com/hashicorp/vault/pull/20784)]
+* secrets/mongodbatlas: upgrades dependencies [[GH-19861](https://github.com/hashicorp/vault/pull/19861)]
+* secrets/openldap: upgrades dependencies [[GH-19993](https://github.com/hashicorp/vault/pull/19993)]
+* secrets/pki: Add missing fields to tidy-status, include new last_auto_tidy_finished field. [[GH-20442](https://github.com/hashicorp/vault/pull/20442)]
+* secrets/pki: Add warning when issuer lacks KeyUsage during CRL rebuilds; expose in logs and on rotation. [[GH-20253](https://github.com/hashicorp/vault/pull/20253)]
+* secrets/pki: Allow determining existing issuers and keys on import. [[GH-20441](https://github.com/hashicorp/vault/pull/20441)]
+* secrets/pki: Include CA serial number, key UUID on issuers list endpoint. [[GH-20276](https://github.com/hashicorp/vault/pull/20276)]
+* secrets/pki: Limit ACME issued certificates NotAfter TTL to a maximum of 90 days [[GH-20981](https://github.com/hashicorp/vault/pull/20981)]
+* secrets/pki: Support TLS-ALPN-01 challenge type in ACME for DNS certificate identifiers. [[GH-20943](https://github.com/hashicorp/vault/pull/20943)]
+* secrets/pki: add subject key identifier to read key response [[GH-20642](https://github.com/hashicorp/vault/pull/20642)]
+* secrets/postgresql: Add configuration to scram-sha-256 encrypt passwords on Vault before sending them to PostgreSQL [[GH-19616](https://github.com/hashicorp/vault/pull/19616)]
+* secrets/terraform: upgrades dependencies [[GH-19798](https://github.com/hashicorp/vault/pull/19798)]
+* secrets/transit: Add support to import public keys in transit engine and allow encryption and verification of signed data [[GH-17934](https://github.com/hashicorp/vault/pull/17934)]
+* secrets/transit: Allow importing RSA-PSS OID (1.2.840.113549.1.1.10) private keys via BYOK. [[GH-19519](https://github.com/hashicorp/vault/pull/19519)]
+* secrets/transit: Respond to writes with updated key policy, cache configuration. [[GH-20652](https://github.com/hashicorp/vault/pull/20652)]
+* secrets/transit: Support BYOK-encrypted export of keys to securely allow synchronizing specific keys and version across clusters. [[GH-20736](https://github.com/hashicorp/vault/pull/20736)]
+* ui: Add download button for each secret value in KV v2 [[GH-20431](https://github.com/hashicorp/vault/pull/20431)]
+* ui: Add filtering by auth type and auth name to the Authentication Method list view. [[GH-20747](https://github.com/hashicorp/vault/pull/20747)]
+* ui: Add filtering by engine type and engine name to the Secret Engine list view. [[GH-20481](https://github.com/hashicorp/vault/pull/20481)]
+* ui: Adds whitespace warning to secrets engine and auth method path inputs [[GH-19913](https://github.com/hashicorp/vault/pull/19913)]
+* ui: Remove the Bulma CSS framework. [[GH-19878](https://github.com/hashicorp/vault/pull/19878)]
+* ui: Update Web CLI with examples and a new `kv-get` command for reading kv v2 data and metadata [[GH-20590](https://github.com/hashicorp/vault/pull/20590)]
+* ui: Updates UI javascript dependencies [[GH-19901](https://github.com/hashicorp/vault/pull/19901)]
+* ui: add allowed_managed_keys field to secret engine mount options [[GH-19791](https://github.com/hashicorp/vault/pull/19791)]
+* ui: adds warning for commas in stringArray inputs and updates tooltip help text to remove references to comma separation [[GH-20163](https://github.com/hashicorp/vault/pull/20163)]
+* ui: updates clients configuration edit form state based on census reporting configuration [[GH-20125](https://github.com/hashicorp/vault/pull/20125)]
+* website/docs: Add rotate root documentation for azure secrets engine [[GH-19187](https://github.com/hashicorp/vault/pull/19187)]
+* website/docs: fix database static-user sample payload [[GH-19170](https://github.com/hashicorp/vault/pull/19170)]
+
+BUG FIXES:
+
+* agent: Fix agent generate-config to accept -namespace, VAULT_NAMESPACE, and other client-modifying flags. [[GH-21297](https://github.com/hashicorp/vault/pull/21297)]
+* agent: Fix bug with 'cache' stanza validation [[GH-20934](https://github.com/hashicorp/vault/pull/20934)]
+* api: Addressed a couple of issues that arose as edge cases for the -output-policy flag. Specifically around properly handling list commands, distinguishing kv V1/V2, and correctly recognizing protected paths. [[GH-19160](https://github.com/hashicorp/vault/pull/19160)]
+* api: Properly Handle nil identity_policies in Secret Data [[GH-20636](https://github.com/hashicorp/vault/pull/20636)]
+* auth/ldap: Set default value for `max_page_size` properly [[GH-20453](https://github.com/hashicorp/vault/pull/20453)]
+* auth/token: Fix cubbyhole and revocation for legacy service tokens [[GH-19416](https://github.com/hashicorp/vault/pull/19416)]
+* cli/kv: add -mount flag to kv list [[GH-19378](https://github.com/hashicorp/vault/pull/19378)]
+* core (enterprise): Don't delete backend stored data that appears to be filterable
+on this secondary if we don't have a corresponding mount entry.
+* core (enterprise): Fix intermittent issue with token entries sometimes not being found when using a newly created token in a request to a secondary, even when SSCT `new_token` forwarding is set. When this occurred, this would result in the following error to the client: `error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue`.
+* core (enterprise): Fix log shipper buffer size overflow issue for 32 bit architecture.
+* core (enterprise): Fix logshipper buffer size to default to DefaultBufferSize only when reported system memory is zero.
+* core (enterprise): Fix panic when using invalid accessor for control-group request
+* core (enterprise): Fix perf standby WAL streaming silently failures when replication setup happens at a bad time.
+* core (enterprise): Fix read on perf standbys failing with 412 after leadership change, unseal, restores or restarts when no writes occur
+* core (enterprise): Remove MFA Enforcment configuration for namespace when deleting namespace
+* core/ssct (enterprise): Fixed race condition where a newly promoted DR may revert `sscGenCounter`
+resulting in 412 errors.
+* core: Change where we evaluate filtered paths as part of mount operations; this is part of an enterprise bugfix that will
+have its own changelog entry.  Fix wrong lock used in ListAuths link meta interface implementation. [[GH-21260](https://github.com/hashicorp/vault/pull/21260)]
+* core: Do not cache seal configuration to fix a bug that resulted in sporadic auto unseal failures. [[GH-21223](https://github.com/hashicorp/vault/pull/21223)]
+* core: Don't exit just because we think there's a potential deadlock. [[GH-21342](https://github.com/hashicorp/vault/pull/21342)]
+* core: Fix Forwarded Writer construction to correctly find active nodes, allowing PKI cross-cluster functionality to succeed on existing mounts.
+* core: Fix panic in sealed nodes using raft storage trying to emit raft metrics [[GH-21249](https://github.com/hashicorp/vault/pull/21249)]
+* core: Fix writes to readonly storage on performance standbys when user lockout feature is enabled. [[GH-20783](https://github.com/hashicorp/vault/pull/20783)]
+* identity: Fixes duplicate groups creation with the same name but unique IDs. [[GH-20964](https://github.com/hashicorp/vault/pull/20964)]
+* license (enterprise): Fix bug where license would update even if the license didn't change.
+* openapi: Small fixes for OpenAPI display attributes. Changed "log-in" to "login" [[GH-20285](https://github.com/hashicorp/vault/pull/20285)]
+* plugin/reload:  Fix a possible data race with rollback manager and plugin reload [[GH-19468](https://github.com/hashicorp/vault/pull/19468)]
+* replication (enterprise): Fix a caching issue when replicating filtered data to
+a performance secondary. This resulted in the data being set to nil in the cache
+and a "invalid value" error being returned from the API.
+* replication (enterprise): Fix a race condition with invalid tokens during WAL streaming that was causing Secondary clusters to be unable to connect to a Primary.
+* replication (enterprise): Fix a race condition with update-primary that could result in data loss after a DR failover
+* replication (enterprise): Fix bug where reloading external plugin on a secondary would
+break replication.
+* replication (enterprise): Fix path filters deleting data right after it's written by backend Initialize funcs
+* replication (enterprise): Fix regression causing token creation against a role
+with a new entity alias to be incorrectly forwarded from perf standbys. [[GH-21100](https://github.com/hashicorp/vault/pull/21100)]
+* replication (enterprise): Fix replication status for Primary clusters showing its primary cluster's information (in case of DR) in secondaries field when known_secondaries field is nil
+* replication (enterprise): fix bug where secondary grpc connections would timeout when connecting to a primary host that no longer exists.
+* sdk/backend: prevent panic when computing the zero value for a `TypeInt64` schema field. [[GH-18729](https://github.com/hashicorp/vault/pull/18729)]
+* secrets/pki: Support setting both maintain_stored_certificate_counts=false and publish_stored_certificate_count_metrics=false explicitly in tidy config. [[GH-20664](https://github.com/hashicorp/vault/pull/20664)]
+* secrets/transform (enterprise): Address SQL connection leak when cleaning expired tokens
+* secrets/transform (enterprise): Fix a caching bug affecting secondary nodes after a tokenization key rotation
+* secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
+* secrets/transform: Added importing of keys and key versions into the Transform secrets engine using the command 'vault transform import' and 'vault transform import-version'. [[GH-20668](https://github.com/hashicorp/vault/pull/20668)]
+* secrets/transit: Fix export of HMAC-only key, correctly exporting the key used for sign operations. For consumers of the previously incorrect key, use the plaintext export to retrieve these incorrect keys and import them as new versions.
+* secrets/transit: Fix bug related to shorter dedicated HMAC key sizing.
+* sdk/helper/keysutil: New HMAC type policies will have HMACKey equal to Key and be copied over on import. [[GH-20864](https://github.com/hashicorp/vault/pull/20864)]
+* shamir: change mul and div implementations to be constant-time [[GH-19495](https://github.com/hashicorp/vault/pull/19495)]
+* ui (enterprise): Fix cancel button from transform engine role creation page [[GH-19135](https://github.com/hashicorp/vault/pull/19135)]
+* ui: Fix secret render when path includes %. Resolves #11616. [[GH-20430](https://github.com/hashicorp/vault/pull/20430)]
+* ui: Fixes issue unsealing cluster for seal types other than shamir [[GH-20897](https://github.com/hashicorp/vault/pull/20897)]
+* ui: fixes auto_rotate_period ttl input for transit keys [[GH-20731](https://github.com/hashicorp/vault/pull/20731)]
+* ui: fixes bug in kmip role form that caused `operation_all` to persist after deselecting all operation checkboxes [[GH-19139](https://github.com/hashicorp/vault/pull/19139)]
+* ui: fixes key_bits and signature_bits reverting to default values when editing a pki role [[GH-20907](https://github.com/hashicorp/vault/pull/20907)]
+* ui: wait for wanted message event during OIDC callback instead of using the first message event [[GH-18521](https://github.com/hashicorp/vault/pull/18521)]
+
+## 1.13.13
+### January 31, 2024
+
+CHANGES:
+
+* core: Bump Go version to 1.20.12.
+* database/snowflake: Update plugin to v0.7.4 [[GH-25059](https://github.com/hashicorp/vault/pull/25059)]
+
+IMPROVEMENTS:
+
+* command/server: display logs on startup immediately if disable-gated-logs flag is set [[GH-24280](https://github.com/hashicorp/vault/pull/24280)]
+* storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [[GH-24010](https://github.com/hashicorp/vault/pull/24010)]
+* ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [[GH-18513](https://github.com/hashicorp/vault/pull/18513)]
+
+BUG FIXES:
+
+* helper/pkcs7: Fix slice out-of-bounds panic [[GH-24891](https://github.com/hashicorp/vault/pull/24891)]
+* kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
+* ui: Fixed minor bugs with database secrets engine [[GH-24947](https://github.com/hashicorp/vault/pull/24947)]
+* ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [[GH-24697](https://github.com/hashicorp/vault/pull/24697)]
+* ui: fix incorrectly calculated capabilities on PKI issuer endpoints [[GH-24686](https://github.com/hashicorp/vault/pull/24686)]
+  
+## 1.13.12
+### December 06, 2023
+
+SECURITY:
+
+* core: Fixes an issue present in both Vault and Vault Enterprise since Vault 1.12.0, where Vault is vulnerable to a denial of service through memory exhaustion of the host when handling large HTTP requests from a client. (see [CVE-2023-6337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6337) & [HCSEC-2023-34](https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741))
+
+CHANGES:
+
+* identity (enterprise): POST requests to the `/identity/entity/merge` endpoint
+are now always forwarded from standbys to the active node. [[GH-24325](https://github.com/hashicorp/vault/pull/24325)]
+
+BUG FIXES:
+
+* api: Fix deadlock on calls to sys/leader with a namespace configured
+on the request. [[GH-24256](https://github.com/hashicorp/vault/pull/24256)]
+* core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [[GH-24336](https://github.com/hashicorp/vault/pull/24336)]
+* ui: Fix payload sent when disabling replication [[GH-24292](https://github.com/hashicorp/vault/pull/24292)]
+
+## 1.13.11
+### November 30, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.20.11.
+
+IMPROVEMENTS:
+
+* core (enterprise): Speed up unseal when using namespaces
+* ui: Sort list view of entities and aliases alphabetically using the item name [[GH-24103](https://github.com/hashicorp/vault/pull/24103)]
+
+BUG FIXES:
+
+* activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
+* auth/cert: Handle errors related to expired OCSP server responses [[GH-24193](https://github.com/hashicorp/vault/pull/24193)]
+* core/config: Use correct HCL config value when configuring `log_requests_level`. [[GH-24057](https://github.com/hashicorp/vault/pull/24057)]
+* core/quotas: Close rate-limit blocked client purge goroutines when sealing [[GH-24108](https://github.com/hashicorp/vault/pull/24108)]
+* replication (enterprise): disallow configuring paths filter for a mount path that does not exist
+* secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [[GH-24192](https://github.com/hashicorp/vault/pull/24192)]
+* ui: Fix error when tuning token auth configuration within namespace [[GH-24147](https://github.com/hashicorp/vault/pull/24147)]
+
+## 1.13.10
+### November 09, 2023
+
+SECURITY:
+* core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [[HSEC-2023-33](https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926)]
+
+CHANGES:
+
+* auth/approle: Normalized error response messages when invalid credentials are provided [[GH-23786](https://github.com/hashicorp/vault/pull/23786)]
+* secrets/mongodbatlas: Update plugin to v0.9.2 [[GH-23849](https://github.com/hashicorp/vault/pull/23849)]
+
+FEATURES:
+
+* cli/snapshot: Add CLI tool to inspect Vault snapshots [[GH-23457](https://github.com/hashicorp/vault/pull/23457)]
+
+IMPROVEMENTS:
+
+* storage/etcd: etcd should only return keys when calling List() [[GH-23872](https://github.com/hashicorp/vault/pull/23872)]
+
+BUG FIXES:
+
+* api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
+on the request. [[GH-23861](https://github.com/hashicorp/vault/pull/23861)]
+* core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
+* core/activity: Fixes segments fragment loss due to exceeding entry record size limit [[GH-23781](https://github.com/hashicorp/vault/pull/23781)]
+* core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [[GH-23802](https://github.com/hashicorp/vault/pull/23802)]
+* core: Revert PR causing memory consumption bug [[GH-23986](https://github.com/hashicorp/vault/pull/23986)]
+* core: Skip unnecessary deriving of policies during Login MFA Check. [[GH-23894](https://github.com/hashicorp/vault/pull/23894)]
+* core: fix bug where deadlock detection was always on for expiration and quotas. 
+These can now be configured individually with `detect_deadlocks`. [[GH-23902](https://github.com/hashicorp/vault/pull/23902)]
+* core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [[GH-23874](https://github.com/hashicorp/vault/pull/23874)]
+* expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [[GH-24027](https://github.com/hashicorp/vault/pull/24027)]
+
+## 1.13.9
+### October 25, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.20.10.
+* replication (enterprise): Switch to non-deprecated gRPC field for resolver target host
+
+IMPROVEMENTS:
+
+* api/plugins: add `tls-server-name` arg for plugin registration [[GH-23549](https://github.com/hashicorp/vault/pull/23549)]
+* core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [[GH-22567](https://github.com/hashicorp/vault/pull/22567)]
+
+BUG FIXES:
+
+* command/server: Fix bug with sigusr2 where pprof files were not closed correctly [[GH-23636](https://github.com/hashicorp/vault/pull/23636)]
+* events: Ignore sending context to give more time for events to send [[GH-23500](https://github.com/hashicorp/vault/pull/23500)]
+* expiration: Prevent large lease loads from delaying state changes, e.g. becoming active or standby. [[GH-23282](https://github.com/hashicorp/vault/pull/23282)]
+* kmip (enterprise): Improve handling of failures due to storage replication issues.
+* kmip (enterprise): Return a structure in the response for query function Query Server Information.
+* mongo-db: allow non-admin database for root credential rotation [[GH-23240](https://github.com/hashicorp/vault/pull/23240)]
+* replication (enterprise): Fix a bug where undo logs would only get enabled on the initial node in a cluster.
+* replication (enterprise): Fix a missing unlock when changing replication state
+* secrets/transit (enterprise): Address an issue using sign/verify operations with managed keys returning an error about it not containing a private key
+* secrets/transit (enterprise): Address panic when using GCP,AWS,Azure managed keys for encryption operations. At this time all encryption operations for the cloud providers have been disabled, only signing operations are supported.
+* secrets/transit (enterprise): Apply hashing arguments and defaults to managed key sign/verify operations
+* secrets/transit: Do not allow auto rotation on managed_key key types [[GH-23723](https://github.com/hashicorp/vault/pull/23723)]
+
+## 1.13.8
+### September 27, 2023
+
+SECURITY:
+
+* sentinel (enterprise): Sentinel RGP policies allowed for cross-namespace denial-of-service. This vulnerability, CVE-2023-3775, is fixed in Vault Enterprise 1.15.0, 1.14.4, and 1.13.8. [[HSEC-2023-29](https://discuss.hashicorp.com/t/hcsec-2023-29-vault-enterprise-s-sentinel-rgp-policies-allowed-for-cross-namespace-denial-of-service/58653)]
+
+CHANGES:
+
+* core (enterprise): Ensure Role Governing Policies are only applied down the namespace hierarchy
+
+IMPROVEMENTS:
+
+* ui: Added allowed_domains_template field for CA type role in SSH engine [[GH-23119](https://github.com/hashicorp/vault/pull/23119)]
+
+BUG FIXES:
+
+* core: Fixes list password policy to include those with names containing / characters. [[GH-23155](https://github.com/hashicorp/vault/pull/23155)]
+* secrets/pki: Fix removal of issuers to clean up unreferenced CRLs. [[GH-23007](https://github.com/hashicorp/vault/pull/23007)]
+* ui (enterprise): Fix error message when generating SSH credential with control group [[GH-23025](https://github.com/hashicorp/vault/pull/23025)]
+* ui: Fixes old pki's filter and search roles page bug [[GH-22810](https://github.com/hashicorp/vault/pull/22810)]
+* ui: don't exclude features present on license [[GH-22855](https://github.com/hashicorp/vault/pull/22855)]
+  
+## 1.13.7
+### September 13, 2023
+
+SECURITY:
+
+* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. This vulnerability, CVE-2023-4680, is fixed in Vault 1.14.3, 1.13.7, and 1.12.11. [[GH-22852](https://github.com/hashicorp/vault/pull/22852), [HSEC-2023-28](https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249)]
+
+CHANGES:
+
+* core: Bump Go version to 1.20.8.
+* database/snowflake: Update plugin to v0.7.3 [[GH-22591](https://github.com/hashicorp/vault/pull/22591)]
+
+FEATURES:
+
+* ** Merkle Tree Corruption Detection (enterprise) **: Add a new endpoint to check merkle tree corruption.
+
+IMPROVEMENTS:
+
+* auth/ldap: improved login speed by adding concurrency to LDAP token group searches [[GH-22659](https://github.com/hashicorp/vault/pull/22659)]
+* core/quotas: Add configuration to allow skipping of expensive role calculations [[GH-22651](https://github.com/hashicorp/vault/pull/22651)]
+* kmip (enterprise): reduce latency of KMIP operation handling
+
+BUG FIXES:
+
+* cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to `table`. [[GH-22818](https://github.com/hashicorp/vault/pull/22818)]
+* core/quotas: Only perform ResolveRoleOperation for role-based quotas and lease creation. [[GH-22597](https://github.com/hashicorp/vault/pull/22597)]
+* core/quotas: Reduce overhead for role calculation when using cloud auth methods. [[GH-22583](https://github.com/hashicorp/vault/pull/22583)]
+* core/seal: add a workaround for potential connection [[hangs](https://github.com/Azure/azure-sdk-for-go/issues/21346)] in Azure autoseals. [[GH-22760](https://github.com/hashicorp/vault/pull/22760)]
+* core: All subloggers now reflect configured log level on reload. [[GH-22038](https://github.com/hashicorp/vault/pull/22038)]
+* kmip (enterprise): fix date handling error with some re-key operations
+* raft/autopilot: Add dr-token flag for raft autopilot cli commands [[GH-21165](https://github.com/hashicorp/vault/pull/21165)]
+* replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
+
+## 1.13.6
+### August 30, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.20.7.
+
+IMPROVEMENTS:
+
+* core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [[GH-22235](https://github.com/hashicorp/vault/pull/22235)]
+* replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
+* secrets/database: Improves error logging for static role rotations by including the database and role names. [[GH-22253](https://github.com/hashicorp/vault/pull/22253)]
+* storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [[GH-22040](https://github.com/hashicorp/vault/pull/22040)]
+* ui: KV View Secret card will link to list view if input ends in "/" [[GH-22502](https://github.com/hashicorp/vault/pull/22502)]
+* ui: enables create and update KV secret workflow when control group present [[GH-22471](https://github.com/hashicorp/vault/pull/22471)]
+
+BUG FIXES:
+
+* activity (enterprise): Fix misattribution of entities to no or child namespace auth methods [[GH-18809](https://github.com/hashicorp/vault/pull/18809)]
+* api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [[GH-22523](https://github.com/hashicorp/vault/pull/22523)]
+* core (enterprise): Remove MFA Configuration for namespace when deleting namespace
+* core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
+Also fix a related potential deadlock. [[GH-21110](https://github.com/hashicorp/vault/pull/21110)]
+* core:  Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [[GH-22137](https://github.com/hashicorp/vault/pull/22137)]
+* core: Fix bug where background thread to update locked user entries runs on DR secondaries. [[GH-22355](https://github.com/hashicorp/vault/pull/22355)]
+* core: Fix readonly errors that could occur while loading mounts/auths during unseal [[GH-22362](https://github.com/hashicorp/vault/pull/22362)]
+* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-21470](https://github.com/hashicorp/vault/pull/21470)]
+* expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [[GH-22374](https://github.com/hashicorp/vault/pull/22374)]
+* license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [[GH-22363](https://github.com/hashicorp/vault/pull/22363)]
+* replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
+* replication (enterprise): Fix panic when update-primary was called on demoted clusters using update_primary_addrs
+* replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
+* sdk/ldaputil: Properly escape user filters when using UPN domains
+sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [[GH-22249](https://github.com/hashicorp/vault/pull/22249)]
+* secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [[GH-22331](https://github.com/hashicorp/vault/pull/22331)]
+* secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
+* ui: Fix blank page or ghost secret when canceling KV secret create [[GH-22541](https://github.com/hashicorp/vault/pull/22541)]
+* ui: fixes `max_versions` default for secret metadata unintentionally overriding kv engine defaults [[GH-22394](https://github.com/hashicorp/vault/pull/22394)]
+* ui: fixes model defaults overwriting input value when user tries to clear form input [[GH-22458](https://github.com/hashicorp/vault/pull/22458)]
+
+## 1.13.5
+### July 25, 2023
+
+SECURITY:
+
+* auth/ldap: Normalize HTTP response codes when invalid credentials are provided to prevent user enumeration. This vulnerability, CVE-2023-3462, is fixed in Vault 1.14.1 and 1.13.5. [[GH-21282](https://github.com/hashicorp/vault/pull/21282), [HSEC-2023-24](https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714)]
+* core/namespace (enterprise): An unhandled error in Vault Enterprise’s namespace creation may cause the Vault process to crash, potentially resulting in denial of service. This vulnerability, CVE-2023-3774, is fixed in Vault Enterprise 1.14.1, 1.13.5, and 1.12.9. [[HSEC_2023-23](https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617)]
+
+CHANGES:
+
+* core/namespace (enterprise): Introduce the concept of high-privilege namespace (administrative namespace),
+which will have access to some system backend paths that were previously only accessible in the root namespace. [[GH-21215](https://github.com/hashicorp/vault/pull/21215)]
+* secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
+
+IMPROVEMENTS:
+
+* core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
+* core: Add a new periodic metric to track the number of available policies, `vault.policy.configured.count`. [[GH-21010](https://github.com/hashicorp/vault/pull/21010)]
+* replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
+* secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
+* sys/metrics (enterprise): Adds a gauge metric that tracks whether enterprise builtin secret plugins are enabled. [[GH-21681](https://github.com/hashicorp/vault/pull/21681)]
+
+BUG FIXES:
+
+* auth/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21799](https://github.com/hashicorp/vault/pull/21799)]
+* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-24170](https://github.com/hashicorp/vault/pull/24170)]
+* identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [[GH-20965](https://github.com/hashicorp/vault/pull/20965)]
+* replication (enterprise): update primary cluster address after DR failover
+* secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21632](https://github.com/hashicorp/vault/pull/21632)]
+* secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error: `no managed key found with uuid`. [[GH-21316](https://github.com/hashicorp/vault/pull/21316)]
+* secrets/pki: Support setting both maintain_stored_certificate_counts=false and publish_stored_certificate_count_metrics=false explicitly in tidy config. [[GH-20664](https://github.com/hashicorp/vault/pull/20664)]
+* secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
+* secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
+* serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [[GH-21642](https://github.com/hashicorp/vault/pull/21642)]
+* ui: Fixed an issue where editing an SSH role would clear `default_critical_options` and `default_extension` if left unchanged. [[GH-21739](https://github.com/hashicorp/vault/pull/21739)]
+* ui: Surface DOMException error when browser settings prevent localStorage. [[GH-21503](https://github.com/hashicorp/vault/pull/21503)]
+
+## 1.13.4
+### June 21, 2023
+BREAKING CHANGES:
+
+* secrets/pki: Maintaining running count of certificates will be turned off by default.
+To re-enable keeping these metrics available on the tidy status endpoint, enable
+maintain_stored_certificate_counts on tidy-config, to also publish them to the
+metrics consumer, enable publish_stored_certificate_count_metrics . [[GH-18186](https://github.com/hashicorp/vault/pull/18186)]
+
+CHANGES:
+
+* core: Bump Go version to 1.20.5.
+
+FEATURES:
+
+* **Automated License Utilization Reporting**: Added automated license
+utilization reporting, which sends minimal product-license [metering
+data](https://developer.hashicorp.com/vault/docs/enterprise/license/utilization-reporting)
+to HashiCorp without requiring you to manually collect and report them.
+* core (enterprise): Add background worker for automatic reporting of billing
+information. [[GH-19625](https://github.com/hashicorp/vault/pull/19625)]
+
+IMPROVEMENTS:
+
+* api: GET ... /sys/internal/counters/activity?current_billing_period=true now
+results in a response which contains the full billing period [[GH-20694](https://github.com/hashicorp/vault/pull/20694)]
+* api: `/sys/internal/counters/config` endpoint now contains read-only
+`minimum_retention_months`. [[GH-20150](https://github.com/hashicorp/vault/pull/20150)]
+* api: `/sys/internal/counters/config` endpoint now contains read-only
+`reporting_enabled` and `billing_start_timestamp` fields. [[GH-20086](https://github.com/hashicorp/vault/pull/20086)]
+* core (enterprise): add configuration for license reporting [[GH-19891](https://github.com/hashicorp/vault/pull/19891)]
+* core (enterprise): license updates trigger a reload of reporting and the activity log [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
+* core (enterprise): support reloading configuration for automated reporting via SIGHUP [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
+* core (enterprise): vault server command now allows for opt-out of automated
+reporting via the `OPTOUT_LICENSE_REPORTING` environment variable. [[GH-3939](https://github.com/hashicorp/vault/pull/3939)]
+* core/activity: error when attempting to update retention configuration below the minimum [[GH-20078](https://github.com/hashicorp/vault/pull/20078)]
+* core/activity: refactor the activity log's generation of precomputed queries [[GH-20073](https://github.com/hashicorp/vault/pull/20073)]
+* ui: updates clients configuration edit form state based on census reporting configuration [[GH-20125](https://github.com/hashicorp/vault/pull/20125)]
+
+BUG FIXES:
+
+* agent: Fix bug with 'cache' stanza validation [[GH-20934](https://github.com/hashicorp/vault/pull/20934)]
+* core (enterprise): Don't delete backend stored data that appears to be filterable
+on this secondary if we don't have a corresponding mount entry.
+* core: Change where we evaluate filtered paths as part of mount operations; this is part of an enterprise bugfix that will
+have its own changelog entry.  Fix wrong lock used in ListAuths link meta interface implementation. [[GH-21260](https://github.com/hashicorp/vault/pull/21260)]
+* core: Do not cache seal configuration to fix a bug that resulted in sporadic auto unseal failures. [[GH-21223](https://github.com/hashicorp/vault/pull/21223)]
+* core: Don't exit just because we think there's a potential deadlock. [[GH-21342](https://github.com/hashicorp/vault/pull/21342)]
+* core: Fix panic in sealed nodes using raft storage trying to emit raft metrics [[GH-21249](https://github.com/hashicorp/vault/pull/21249)]
+* identity: Fixes duplicate groups creation with the same name but unique IDs. [[GH-20964](https://github.com/hashicorp/vault/pull/20964)]
+* replication (enterprise): Fix a race condition with update-primary that could result in data loss after a DR failover
+* replication (enterprise): Fix path filters deleting data right after it's written by backend Initialize funcs
+* replication (enterprise): Fix regression causing token creation against a role
+with a new entity alias to be incorrectly forwarded from perf standbys. [[GH-21100](https://github.com/hashicorp/vault/pull/21100)]
+* storage/raft: Fix race where new follower joining can get pruned by dead server cleanup. [[GH-20986](https://github.com/hashicorp/vault/pull/20986)]
+
+## 1.13.3
+### June 08, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.20.4.
+* core: Revert #19676 (VAULT_GRPC_MIN_CONNECT_TIMEOUT env var) as we decided it was unnecessary. [[GH-20826](https://github.com/hashicorp/vault/pull/20826)]
+* replication (enterprise): Add a new parameter for the update-primary API call
+that allows for setting of the primary cluster addresses directly, instead of
+via a token.
+* storage/aerospike: Aerospike storage shouldn't be used on 32-bit architectures and is now unsupported on them. [[GH-20825](https://github.com/hashicorp/vault/pull/20825)]
+
+IMPROVEMENTS:
+
+* Add debug symbols back to builds to fix Dynatrace support [[GH-20519](https://github.com/hashicorp/vault/pull/20519)]
+* audit: add a `mount_point` field to audit requests and response entries [[GH-20411](https://github.com/hashicorp/vault/pull/20411)]
+* autopilot: Update version to v0.2.0 to add better support for respecting min quorum [[GH-19472](https://github.com/hashicorp/vault/pull/19472)]
+* command/server: Add support for dumping pprof files to the filesystem via SIGUSR2 when
+`VAULT_PPROF_WRITE_TO_FILE=true` is set on the server. [[GH-20609](https://github.com/hashicorp/vault/pull/20609)]
+* core: Add possibility to decode a generated encoded root token via the rest API [[GH-20595](https://github.com/hashicorp/vault/pull/20595)]
+* core: include namespace path in granting_policies block of audit log
+* core: report intermediate error messages during request forwarding [[GH-20643](https://github.com/hashicorp/vault/pull/20643)]
+* openapi: Fix generated types for duration strings [[GH-20841](https://github.com/hashicorp/vault/pull/20841)]
+* sdk/framework: Fix non-deterministic ordering of 'required' fields in OpenAPI spec [[GH-20881](https://github.com/hashicorp/vault/pull/20881)]
+* secrets/pki: add subject key identifier to read key response [[GH-20642](https://github.com/hashicorp/vault/pull/20642)]
+
+BUG FIXES:
+
+* api: Properly Handle nil identity_policies in Secret Data [[GH-20636](https://github.com/hashicorp/vault/pull/20636)]
+* auth/ldap: Set default value for `max_page_size` properly [[GH-20453](https://github.com/hashicorp/vault/pull/20453)]
+* cli: CLI should take days as a unit of time for ttl like flags [[GH-20477](https://github.com/hashicorp/vault/pull/20477)]
+* cli: disable printing flags warnings messages for the ssh command [[GH-20502](https://github.com/hashicorp/vault/pull/20502)]
+* command/server: fixes panic in Vault server command when running in recovery mode [[GH-20418](https://github.com/hashicorp/vault/pull/20418)]
+* core (enterprise): Fix log shipper buffer size overflow issue for 32 bit architecture.
+* core (enterprise): Fix logshipper buffer size to default to DefaultBufferSize only when reported system memory is zero.
+* core (enterprise): Remove MFA Enforcment configuration for namespace when deleting namespace
+* core/identity: Allow updates of only the custom-metadata for entity alias. [[GH-20368](https://github.com/hashicorp/vault/pull/20368)]
+* core: Fix Forwarded Writer construction to correctly find active nodes, allowing PKI cross-cluster functionality to succeed on existing mounts.
+* core: Fix writes to readonly storage on performance standbys when user lockout feature is enabled. [[GH-20783](https://github.com/hashicorp/vault/pull/20783)]
+* core: prevent panic on login after namespace is deleted that had mfa enforcement [[GH-20375](https://github.com/hashicorp/vault/pull/20375)]
+* replication (enterprise): Fix a race condition with invalid tokens during WAL streaming that was causing Secondary clusters to be unable to connect to a Primary.
+* replication (enterprise): fix bug where secondary grpc connections would timeout when connecting to a primary host that no longer exists.
+* secrets/pki: Include per-issuer enable_aia_url_templating in issuer read endpoint. [[GH-20354](https://github.com/hashicorp/vault/pull/20354)]
+* secrets/transform (enterprise): Fix a caching bug affecting secondary nodes after a tokenization key rotation
+* secrets/transform: Added importing of keys and key versions into the Transform secrets engine using the command 'vault transform import' and 'vault transform import-version'. [[GH-20668](https://github.com/hashicorp/vault/pull/20668)]
+* secrets/transit: Fix export of HMAC-only key, correctly exporting the key used for sign operations. For consumers of the previously incorrect key, use the plaintext export to retrieve these incorrect keys and import them as new versions.
+secrets/transit: Fix bug related to shorter dedicated HMAC key sizing.
+sdk/helper/keysutil: New HMAC type policies will have HMACKey equal to Key and be copied over on import. [[GH-20864](https://github.com/hashicorp/vault/pull/20864)]
+* ui: Fixes issue unsealing cluster for seal types other than shamir [[GH-20897](https://github.com/hashicorp/vault/pull/20897)]
+* ui: fixes issue creating mfa login enforcement from method enforcements tab [[GH-20603](https://github.com/hashicorp/vault/pull/20603)]
+* ui: fixes key_bits and signature_bits reverting to default values when editing a pki role [[GH-20907](https://github.com/hashicorp/vault/pull/20907)]
+
+## 1.13.2
+### April 26, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.20.3.
+
+SECURITY:
+
+* core/seal: Fix handling of HMACing of seal-wrapped storage entries from HSMs using CKM_AES_CBC or CKM_AES_CBC_PAD which may have allowed an attacker to conduct a padding oracle attack. This vulnerability, CVE-2023-2197, affects Vault from 1.13.0 up to 1.13.1 and was fixed in 1.13.2. [[HCSEC-2023-14](https://discuss.hashicorp.com/t/hcsec-2023-14-vault-enterprise-vulnerable-to-padding-oracle-attacks-when-using-a-cbc-based-encryption-mechanism-with-a-hsm/53322)]
+
+IMPROVEMENTS:
+
+* Add debug symbols back to builds to fix Dynatrace support [[GH-20294](https://github.com/hashicorp/vault/pull/20294)]
+* cli/namespace: Add detailed flag to output additional namespace information
+such as namespace IDs and custom metadata. [[GH-20243](https://github.com/hashicorp/vault/pull/20243)]
+* core/activity: add an endpoint to write test activity log data, guarded by a build flag [[GH-20019](https://github.com/hashicorp/vault/pull/20019)]
+* core: Add a `raft` sub-field to the `storage` and `ha_storage` details provided by the
+`/sys/config/state/sanitized` endpoint in order to include the `max_entry_size`. [[GH-20044](https://github.com/hashicorp/vault/pull/20044)]
+* core: include reason for ErrReadOnly on PBPWF writing failures
+* sdk/ldaputil: added `connection_timeout` to tune connection timeout duration
+for all LDAP plugins. [[GH-20144](https://github.com/hashicorp/vault/pull/20144)]
+* secrets/pki: Decrease size and improve compatibility of OCSP responses by removing issuer certificate. [[GH-20201](https://github.com/hashicorp/vault/pull/20201)]
+* sys/wrapping: Add example how to unwrap without authentication in Vault [[GH-20109](https://github.com/hashicorp/vault/pull/20109)]
+* ui: Allows license-banners to be dismissed. Saves preferences in localStorage. [[GH-19116](https://github.com/hashicorp/vault/pull/19116)]
+
+BUG FIXES:
+
+* auth/ldap: Add max_page_size configurable to LDAP configuration [[GH-19032](https://github.com/hashicorp/vault/pull/19032)]
+* command/server: Fix incorrect paths in generated config for `-dev-tls` flag on Windows [[GH-20257](https://github.com/hashicorp/vault/pull/20257)]
+* core (enterprise): Fix intermittent issue with token entries sometimes not being found when using a newly created token in a request to a secondary, even when SSCT `new_token` forwarding is set. When this occurred, this would result in the following error to the client: `error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue`.
+* core (enterprise): Fix read on perf standbys failing with 412 after leadership change, unseal, restores or restarts when no writes occur
+* core/ssct (enterprise): Fixed race condition where a newly promoted DR may revert `sscGenCounter`
+resulting in 412 errors.
+* core: Fix regression breaking non-raft clusters whose nodes share the same cluster_addr/api_addr. [[GH-19721](https://github.com/hashicorp/vault/pull/19721)]
+* helper/random: Fix race condition in string generator helper [[GH-19875](https://github.com/hashicorp/vault/pull/19875)]
+* kmip (enterprise): Fix a problem decrypting with keys that have no Process Start Date attribute.
+* pki: Fix automatically turning off CRL signing on upgrade to Vault >= 1.12, if CA Key Usage disallows it [[GH-20220](https://github.com/hashicorp/vault/pull/20220)]
+* replication (enterprise): Fix a caching issue when replicating filtered data to
+a performance secondary. This resulted in the data being set to nil in the cache
+and a "invalid value" error being returned from the API.
+* replication (enterprise): Fix replication status for Primary clusters showing its primary cluster's information (in case of DR) in secondaries field when known_secondaries field is nil
+* sdk/helper/ocsp: Workaround bug in Go's ocsp.ParseResponse(...), causing validation to fail with embedded CA certificates.
+auth/cert: Fix OCSP validation against Vault's PKI engine. [[GH-20181](https://github.com/hashicorp/vault/pull/20181)]
+* secrets/aws: Revert changes that removed the lease on STS credentials, while leaving the new ttl field in place. [[GH-20034](https://github.com/hashicorp/vault/pull/20034)]
+* secrets/pki: Ensure cross-cluster delta WAL write failure only logs to avoid unattended forwarding. [[GH-20057](https://github.com/hashicorp/vault/pull/20057)]
+* secrets/pki: Fix building of unified delta CRLs and recovery during unified delta WAL write failures. [[GH-20058](https://github.com/hashicorp/vault/pull/20058)]
+* secrets/pki: Fix patching of leaf_not_after_behavior on issuers. [[GH-20341](https://github.com/hashicorp/vault/pull/20341)]
+* secrets/transform (enterprise): Address SQL connection leak when cleaning expired tokens
+* ui: Fix OIDC provider logo showing when domain doesn't match [[GH-20263](https://github.com/hashicorp/vault/pull/20263)]
+* ui: Fix bad link to namespace when namespace name includes `.` [[GH-19799](https://github.com/hashicorp/vault/pull/19799)]
+* ui: fixes browser console formatting for help command output [[GH-20064](https://github.com/hashicorp/vault/pull/20064)]
+* ui: fixes remaining doc links to include /vault in path [[GH-20070](https://github.com/hashicorp/vault/pull/20070)]
+* ui: remove use of htmlSafe except when first sanitized [[GH-20235](https://github.com/hashicorp/vault/pull/20235)]
+* website/docs: Fix Kubernetes Auth Code Example to use the correct whitespace in import. [[GH-20216](https://github.com/hashicorp/vault/pull/20216)]
+
+## 1.13.1
+### March 29, 2023
+
+SECURITY:
+
+* storage/mssql: When using Vault’s community-supported Microsoft SQL (MSSQL) database storage backend, a privileged attacker with the ability to write arbitrary data to Vault’s configuration may be able to perform arbitrary SQL commands on the underlying database server through Vault. This vulnerability, CVE-2023-0620, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-12](https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080)]
+* secrets/pki: Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. This vulnerability, CVE-2023-0665, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-11](https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079)]
+* core: HashiCorp Vault’s implementation of Shamir’s secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. This vulnerability, CVE-2023-25000, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-10](https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078)]
+
+IMPROVEMENTS:
+
+* auth/github: Allow for an optional Github auth token environment variable to make authenticated requests when fetching org id
+website/docs: Add docs for `VAULT_AUTH_CONFIG_GITHUB_TOKEN` environment variable when writing Github config [[GH-19244](https://github.com/hashicorp/vault/pull/19244)]
+* core: Allow overriding gRPC connect timeout via VAULT_GRPC_MIN_CONNECT_TIMEOUT. This is an env var rather than a config setting because we don't expect this to ever be needed.  It's being added as a last-ditch
+option in case all else fails for some replication issues we may not have fully reproduced. [[GH-19676](https://github.com/hashicorp/vault/pull/19676)]
+* core: validate name identifiers in mssql physical storage backend prior use [[GH-19591](https://github.com/hashicorp/vault/pull/19591)]
+* database/elasticsearch: Update error messages resulting from Elasticsearch API errors [[GH-19545](https://github.com/hashicorp/vault/pull/19545)]
+* events: Suppress log warnings triggered when events are sent but the events system is not enabled. [[GH-19593](https://github.com/hashicorp/vault/pull/19593)]
+
+BUG FIXES:
+
+* agent: Fix panic when SIGHUP is issued to Agent while it has a non-TLS listener. [[GH-19483](https://github.com/hashicorp/vault/pull/19483)]
+* core (enterprise): Attempt to reconnect to a PKCS#11 HSM if we retrieve a CKR_FUNCTION_FAILED error.
+* core: Fixed issue with remounting mounts that have a non-trailing space in the 'to' or 'from' paths. [[GH-19585](https://github.com/hashicorp/vault/pull/19585)]
+* kmip (enterprise): Do not require attribute Cryptographic Usage Mask when registering Secret Data managed objects.
+* kmip (enterprise): Fix a problem forwarding some requests to the active node.
+* openapi: Fix logic for labeling unauthenticated/sudo paths. [[GH-19600](https://github.com/hashicorp/vault/pull/19600)]
+* secrets/ldap: Invalidates WAL entry for static role if `password_policy` has changed. [[GH-19640](https://github.com/hashicorp/vault/pull/19640)]
+* secrets/pki: Fix PKI revocation request forwarding from standby nodes due to an error wrapping bug [[GH-19624](https://github.com/hashicorp/vault/pull/19624)]
+* secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
+* ui: Fixes crypto.randomUUID error in unsecure contexts from third party ember-data library [[GH-19428](https://github.com/hashicorp/vault/pull/19428)]
+* ui: fixes SSH engine config deletion [[GH-19448](https://github.com/hashicorp/vault/pull/19448)]
+* ui: fixes issue navigating back a level using the breadcrumb from secret metadata view [[GH-19703](https://github.com/hashicorp/vault/pull/19703)]
+* ui: fixes oidc tabs in auth form submitting with the root's default_role value after a namespace has been inputted [[GH-19541](https://github.com/hashicorp/vault/pull/19541)]
+* ui: pass encodeBase64 param to HMAC transit-key-actions. [[GH-19429](https://github.com/hashicorp/vault/pull/19429)]
+* ui: use URLSearchParams interface to capture namespace param from SSOs (ex. ADFS) with decoded state param in callback url [[GH-19460](https://github.com/hashicorp/vault/pull/19460)]
+
+## 1.13.0
+### March 01, 2023
+
+SECURITY:
+
+* secrets/ssh: removal of the deprecated dynamic keys mode. **When any remaining dynamic key leases expire**, an error stating `secret is unsupported by this backend` will be thrown by the lease manager. [[GH-18874](https://github.com/hashicorp/vault/pull/18874)]
+* auth/approle: When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999 has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above. [[HSEC-2023-07](https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305)]
+
+CHANGES:
+
+* auth/alicloud: require the `role` field on login [[GH-19005](https://github.com/hashicorp/vault/pull/19005)]
+* auth/approle: Add maximum length of 4096 for approle role_names, as this value results in HMAC calculation [[GH-17768](https://github.com/hashicorp/vault/pull/17768)]
+* auth: Returns invalid credentials for ldap, userpass and approle when wrong credentials are provided for existent users.
+This will only be used internally for implementing user lockout. [[GH-17104](https://github.com/hashicorp/vault/pull/17104)]
+* core: Bump Go version to 1.20.1.
+* core: Vault version has been moved out of sdk and into main vault module.
+Plugins using sdk/useragent.String must instead use sdk/useragent.PluginString. [[GH-14229](https://github.com/hashicorp/vault/pull/14229)]
+* logging: Removed legacy environment variable for log format ('LOGXI_FORMAT'), should use 'VAULT_LOG_FORMAT' instead [[GH-17822](https://github.com/hashicorp/vault/pull/17822)]
+* plugins: Mounts can no longer be pinned to a specific _builtin_ version. Mounts previously pinned to a specific builtin version will now automatically upgrade to the latest builtin version, and may now be overridden if an unversioned plugin of the same name and type is registered. Mounts using plugin versions without `builtin` in their metadata remain unaffected. [[GH-18051](https://github.com/hashicorp/vault/pull/18051)]
+* plugins: `GET /database/config/:name` endpoint now returns an additional `plugin_version` field in the response data. [[GH-16982](https://github.com/hashicorp/vault/pull/16982)]
+* plugins: `GET /sys/auth/:path/tune` and `GET /sys/mounts/:path/tune` endpoints may now return an additional `plugin_version` field in the response data if set. [[GH-17167](https://github.com/hashicorp/vault/pull/17167)]
+* plugins: `GET` for `/sys/auth`, `/sys/auth/:path`, `/sys/mounts`, and `/sys/mounts/:path` paths now return additional `plugin_version`, `running_plugin_version` and `running_sha256` fields in the response data for each mount. [[GH-17167](https://github.com/hashicorp/vault/pull/17167)]
+* sdk: Remove version package, make useragent.String versionless. [[GH-19068](https://github.com/hashicorp/vault/pull/19068)]
+* secrets/aws: do not create leases for non-renewable/non-revocable STS credentials to reduce storage calls [[GH-15869](https://github.com/hashicorp/vault/pull/15869)]
+* secrets/gcpkms: Updated plugin from v0.13.0 to v0.14.0 [[GH-19063](https://github.com/hashicorp/vault/pull/19063)]
+* sys/internal/inspect: Turns of this endpoint by default. A SIGHUP can now be used to reload the configs and turns this endpoint on.
+* ui: Upgrade Ember to version 4.4.0 [[GH-17086](https://github.com/hashicorp/vault/pull/17086)]
+
+FEATURES:
+
+* **User lockout**: Ignore repeated bad credentials from the same user for a configured period of time. Enabled by default.
+* **Azure Auth Managed Identities**: Allow any Azure resource that supports managed identities to authenticate with Vault [[GH-19077](https://github.com/hashicorp/vault/pull/19077)]
+* **Azure Auth Rotate Root**: Add support for rotate root in Azure Auth engine [[GH-19077](https://github.com/hashicorp/vault/pull/19077)]
+* **Event System (Alpha)**: Vault has a new opt-in experimental event system. Not yet suitable for production use. Events are currently only generated on writes to the KV secrets engine, but external plugins can also be updated to start generating events. [[GH-19194](https://github.com/hashicorp/vault/pull/19194)]
+* **GCP Secrets Impersonated Account Support**: Add support for GCP service account impersonation, allowing callers to generate a GCP access token without requiring Vault to store or retrieve a GCP service account key for each role. [[GH-19018](https://github.com/hashicorp/vault/pull/19018)]
+* **Kubernetes Secrets Engine UI**: Kubernetes is now available in the UI as a supported secrets engine. [[GH-17893](https://github.com/hashicorp/vault/pull/17893)]
+* **New PKI UI**: Add beta support for new and improved PKI UI [[GH-18842](https://github.com/hashicorp/vault/pull/18842)]
+* **PKI Cross-Cluster Revocations**: Revocation information can now be
+synchronized across primary and performance replica clusters offering
+a unified CRL/OCSP view of revocations across cluster boundaries. [[GH-19196](https://github.com/hashicorp/vault/pull/19196)]
+* **Server UDS Listener**: Adding listener to Vault server to serve http request via unix domain socket [[GH-18227](https://github.com/hashicorp/vault/pull/18227)]
+* **Transit managed keys**: The transit secrets engine now supports configuring and using managed keys
+* **User Lockout**: Adds support to configure the user-lockout behaviour for failed logins to prevent
+brute force attacks for userpass, approle and ldap auth methods. [[GH-19230](https://github.com/hashicorp/vault/pull/19230)]
+* **VMSS Flex Authentication**: Adds support for Virtual Machine Scale Set Flex Authentication [[GH-19077](https://github.com/hashicorp/vault/pull/19077)]
+* **Namespaces (enterprise)**: Added the ability to allow access to secrets and more to be shared across namespaces that do not share a namespace hierarchy. Using the new `sys/config/group-policy-application` API, policies can be configured to apply outside of namespace hierarchy, allowing this kind of cross-namespace sharing.
+* **OpenAPI-based Go & .NET Client Libraries (Beta)**: We have now made available two new [[OpenAPI-based Go](https://github.com/hashicorp/vault-client-go/)] & [[OpenAPI-based .NET](https://github.com/hashicorp/vault-client-dotnet/)] Client libraries (beta). You can use them to perform various secret management operations easily from your applications.
+
+IMPROVEMENTS:
+
+* **Redis ElastiCache DB Engine**: Renamed configuration parameters for disambiguation; old parameters still supported for compatibility. [[GH-18752](https://github.com/hashicorp/vault/pull/18752)]
+* Bump github.com/hashicorp/go-plugin version from 1.4.5 to 1.4.8 [[GH-19100](https://github.com/hashicorp/vault/pull/19100)]
+* Reduced binary size [[GH-17678](https://github.com/hashicorp/vault/pull/17678)]
+* agent/config: Allow config directories to be specified with -config, and allow multiple -configs to be supplied. [[GH-18403](https://github.com/hashicorp/vault/pull/18403)]
+* agent: Add note in logs when starting Vault Agent indicating if the version differs to the Vault Server. [[GH-18684](https://github.com/hashicorp/vault/pull/18684)]
+* agent: Added `token_file` auto-auth configuration to allow using a pre-existing token for Vault Agent. [[GH-18740](https://github.com/hashicorp/vault/pull/18740)]
+* agent: Agent listeners can now be to be the `metrics_only` role, serving only metrics, as part of the listener's new top level `role` option. [[GH-18101](https://github.com/hashicorp/vault/pull/18101)]
+* agent: Configured Vault Agent listeners now listen without the need for caching to be configured. [[GH-18137](https://github.com/hashicorp/vault/pull/18137)]
+* agent: allows some parts of config to be reloaded without requiring a restart. [[GH-18638](https://github.com/hashicorp/vault/pull/18638)]
+* agent: fix incorrectly used loop variables in parallel tests and when finalizing seals [[GH-16872](https://github.com/hashicorp/vault/pull/16872)]
+* api: Remove dependency on sdk module. [[GH-18962](https://github.com/hashicorp/vault/pull/18962)]
+* api: Support VAULT_DISABLE_REDIRECTS environment variable (and --disable-redirects flag) to disable default client behavior and prevent the client following any redirection responses. [[GH-17352](https://github.com/hashicorp/vault/pull/17352)]
+* audit: Add `elide_list_responses` option, providing a countermeasure for a common source of oversized audit log entries [[GH-18128](https://github.com/hashicorp/vault/pull/18128)]
+* audit: Include stack trace when audit logging recovers from a panic. [[GH-18121](https://github.com/hashicorp/vault/pull/18121)]
+* auth/alicloud: upgrades dependencies [[GH-18021](https://github.com/hashicorp/vault/pull/18021)]
+* auth/azure: Adds support for authentication with Managed Service Identity (MSI) from a
+Virtual Machine Scale Set (VMSS) in flexible orchestration mode. [[GH-17540](https://github.com/hashicorp/vault/pull/17540)]
+* auth/azure: upgrades dependencies [[GH-17857](https://github.com/hashicorp/vault/pull/17857)]
+* auth/cert: Add configurable support for validating client certs with OCSP. [[GH-17093](https://github.com/hashicorp/vault/pull/17093)]
+* auth/cert: Support listing provisioned CRLs within the mount. [[GH-18043](https://github.com/hashicorp/vault/pull/18043)]
+* auth/cf: Remove incorrect usage of CreateOperation from path_config [[GH-19098](https://github.com/hashicorp/vault/pull/19098)]
+* auth/gcp: Upgrades dependencies [[GH-17858](https://github.com/hashicorp/vault/pull/17858)]
+* auth/oidc: Adds `abort_on_error` parameter to CLI login command to help in non-interactive contexts [[GH-19076](https://github.com/hashicorp/vault/pull/19076)]
+* auth/oidc: Adds ability to set Google Workspace domain for groups search [[GH-19076](https://github.com/hashicorp/vault/pull/19076)]
+* auth/token (enterprise): Allow batch token creation in perfStandby nodes
+* auth: Allow naming login MFA methods and using those names instead of IDs in satisfying MFA requirement for requests.
+Make passcode arguments consistent across login MFA method types. [[GH-18610](https://github.com/hashicorp/vault/pull/18610)]
+* auth: Provide an IP address of the requests from Vault to a Duo challenge after successful authentication. [[GH-18811](https://github.com/hashicorp/vault/pull/18811)]
+* autopilot: Update version to v.0.2.0 to add better support for respecting min quorum
+* cli/kv: improve kv CLI to remove data or custom metadata using kv patch [[GH-18067](https://github.com/hashicorp/vault/pull/18067)]
+* cli/pki: Add List-Intermediates functionality to pki client. [[GH-18463](https://github.com/hashicorp/vault/pull/18463)]
+* cli/pki: Add health-check subcommand to evaluate the health of a PKI instance. [[GH-17750](https://github.com/hashicorp/vault/pull/17750)]
+* cli/pki: Add pki issue command, which creates a CSR, has a vault mount sign it, then reimports it. [[GH-18467](https://github.com/hashicorp/vault/pull/18467)]
+* cli/pki: Added "Reissue" command which allows extracting fields from an existing certificate to create a new certificate. [[GH-18499](https://github.com/hashicorp/vault/pull/18499)]
+* cli/pki: Change the pki health-check --list default config output to JSON so it's a usable configuration file [[GH-19269](https://github.com/hashicorp/vault/pull/19269)]
+* cli: Add support for creating requests to existing non-KVv2 PATCH-capable endpoints. [[GH-17650](https://github.com/hashicorp/vault/pull/17650)]
+* cli: Add transit import key helper commands for BYOK to Transit/Transform. [[GH-18887](https://github.com/hashicorp/vault/pull/18887)]
+* cli: Support the -format=raw option, to read non-JSON Vault endpoints and original response bodies. [[GH-14945](https://github.com/hashicorp/vault/pull/14945)]
+* cli: updated `vault operator rekey` prompts to describe recovery keys when `-target=recovery` [[GH-18892](https://github.com/hashicorp/vault/pull/18892)]
+* client/pki: Add a new command verify-sign which checks the relationship between two certificates. [[GH-18437](https://github.com/hashicorp/vault/pull/18437)]
+* command/server: Environment variable keys are now logged at startup. [[GH-18125](https://github.com/hashicorp/vault/pull/18125)]
+* core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
+* core/identity: Add machine-readable output to body of response upon alias clash during entity merge [[GH-17459](https://github.com/hashicorp/vault/pull/17459)]
+* core/server: Added an environment variable to write goroutine stacktraces to a
+temporary file for SIGUSR2 signals. [[GH-17929](https://github.com/hashicorp/vault/pull/17929)]
+* core: Add RPCs to read and update userFailedLoginInfo map
+* core: Add experiments system and `events.alpha1` experiment. [[GH-18682](https://github.com/hashicorp/vault/pull/18682)]
+* core: Add read support to `sys/loggers` and `sys/loggers/:name` endpoints [[GH-17979](https://github.com/hashicorp/vault/pull/17979)]
+* core: Add user lockout field to config and configuring this for auth mount using auth tune to prevent brute forcing in auth methods [[GH-17338](https://github.com/hashicorp/vault/pull/17338)]
+* core: Add vault.core.locked_users telemetry metric to emit information about total number of locked users. [[GH-18718](https://github.com/hashicorp/vault/pull/18718)]
+* core: Added sys/locked-users endpoint to list locked users. Changed api endpoint from
+sys/lockedusers/[mount_accessor]/unlock/[alias_identifier] to sys/locked-users/[mount_accessor]/unlock/[alias_identifier]. [[GH-18675](https://github.com/hashicorp/vault/pull/18675)]
+* core: Added sys/lockedusers/[mount_accessor]/unlock/[alias_identifier] endpoint to unlock an user
+with given mount_accessor and alias_identifier if locked [[GH-18279](https://github.com/hashicorp/vault/pull/18279)]
+* core: Added warning to /sys/seal-status and vault status command if potentially dangerous behaviour overrides are being used. [[GH-17855](https://github.com/hashicorp/vault/pull/17855)]
+* core: Implemented background thread to update locked user entries every 15 minutes to prevent brute forcing in auth methods. [[GH-18673](https://github.com/hashicorp/vault/pull/18673)]
+* core: License location is no longer cache exempt, meaning sys/health will not contribute as greatly to storage load when using consul as a storage backend. [[GH-17265](https://github.com/hashicorp/vault/pull/17265)]
+* core: Update protoc from 3.21.5 to 3.21.7 [[GH-17499](https://github.com/hashicorp/vault/pull/17499)]
+* core: add `detect_deadlocks` config to optionally detect core state deadlocks [[GH-18604](https://github.com/hashicorp/vault/pull/18604)]
+* core: added changes for user lockout workflow. [[GH-17951](https://github.com/hashicorp/vault/pull/17951)]
+* core: parallelize backend initialization to improve startup time for large numbers of mounts. [[GH-18244](https://github.com/hashicorp/vault/pull/18244)]
+* database/postgres: Support multiline strings for revocation statements. [[GH-18632](https://github.com/hashicorp/vault/pull/18632)]
+* database/redis-elasticache: changed config argument names for disambiguation [[GH-19044](https://github.com/hashicorp/vault/pull/19044)]
+* database/snowflake: Allow parallel requests to Snowflake [[GH-17593](https://github.com/hashicorp/vault/pull/17593)]
+* hcp/connectivity: Add foundational OSS support for opt-in secure communication between self-managed Vault nodes and [HashiCorp Cloud Platform](https://cloud.hashicorp.com) [[GH-18228](https://github.com/hashicorp/vault/pull/18228)]
+* hcp/connectivity: Include HCP organization, project, and resource ID in server startup logs [[GH-18315](https://github.com/hashicorp/vault/pull/18315)]
+* hcp/connectivity: Only update SCADA session metadata if status changes [[GH-18585](https://github.com/hashicorp/vault/pull/18585)]
+* hcp/status: Add cluster-level status information [[GH-18351](https://github.com/hashicorp/vault/pull/18351)]
+* hcp/status: Expand node-level status information [[GH-18302](https://github.com/hashicorp/vault/pull/18302)]
+* logging: Vault Agent supports logging to a specified file path via environment variable, CLI or config [[GH-17841](https://github.com/hashicorp/vault/pull/17841)]
+* logging: Vault agent and server commands support log file and log rotation. [[GH-18031](https://github.com/hashicorp/vault/pull/18031)]
+* migration: allow parallelization of key migration for `vault operator migrate` in order to speed up a migration. [[GH-18817](https://github.com/hashicorp/vault/pull/18817)]
+* namespaces (enterprise): Add new API, `sys/config/group-policy-application`, to allow group policies to be configurable
+to apply to a group in `any` namespace. The default, `within_namespace_hierarchy`, is the current behaviour.
+* openapi: Add default values to thing_mount_path parameters [[GH-18935](https://github.com/hashicorp/vault/pull/18935)]
+* openapi: Add logic to generate openapi response structures [[GH-18192](https://github.com/hashicorp/vault/pull/18192)]
+* openapi: Add openapi response definitions to approle/path_login.go & approle/path_tidy_user_id.go [[GH-18772](https://github.com/hashicorp/vault/pull/18772)]
+* openapi: Add openapi response definitions to approle/path_role.go [[GH-18198](https://github.com/hashicorp/vault/pull/18198)]
+* openapi: Change gen_openapi.sh to generate schema with generic mount paths [[GH-18934](https://github.com/hashicorp/vault/pull/18934)]
+* openapi: Mark request body objects as required [[GH-17909](https://github.com/hashicorp/vault/pull/17909)]
+* openapi: add openapi response defintions to /sys/audit endpoints [[GH-18456](https://github.com/hashicorp/vault/pull/18456)]
+* openapi: generic_mount_paths: Move implementation fully into server, rather than partially in plugin framework; recognize all 4 singleton mounts (auth/token, cubbyhole, identity, system) rather than just 2; change parameter from `{mountPath}` to `{<type>_mount_path}` [[GH-18663](https://github.com/hashicorp/vault/pull/18663)]
+* plugins: Add plugin version information to key plugin lifecycle log lines. [[GH-17430](https://github.com/hashicorp/vault/pull/17430)]
+* plugins: Allow selecting builtin plugins by their reported semantic version of the form `vX.Y.Z+builtin` or `vX.Y.Z+builtin.vault`. [[GH-17289](https://github.com/hashicorp/vault/pull/17289)]
+* plugins: Let Vault unseal and mount deprecated builtin plugins in a
+deactivated state if this is not the first unseal after an upgrade. [[GH-17879](https://github.com/hashicorp/vault/pull/17879)]
+* plugins: Mark app-id auth method Removed and remove the plugin code. [[GH-18039](https://github.com/hashicorp/vault/pull/18039)]
+* plugins: Mark logical database plugins Removed and remove the plugin code. [[GH-18039](https://github.com/hashicorp/vault/pull/18039)]
+* sdk/ldap: Added support for paging when searching for groups using group filters [[GH-17640](https://github.com/hashicorp/vault/pull/17640)]
+* sdk: Add response schema validation method framework/FieldData.ValidateStrict and two test helpers (ValidateResponse, ValidateResponseData) [[GH-18635](https://github.com/hashicorp/vault/pull/18635)]
+* sdk: Adding FindResponseSchema test helper to assist with response schema validation in tests [[GH-18636](https://github.com/hashicorp/vault/pull/18636)]
+* secrets/aws: Update dependencies [[PR-17747](https://github.com/hashicorp/vault/pull/17747)] [[GH-17747](https://github.com/hashicorp/vault/pull/17747)]
+* secrets/azure: Adds ability to persist an application for the lifetime of a role. [[GH-19096](https://github.com/hashicorp/vault/pull/19096)]
+* secrets/azure: upgrades dependencies [[GH-17964](https://github.com/hashicorp/vault/pull/17964)]
+* secrets/db/mysql: Add `tls_server_name` and `tls_skip_verify` parameters [[GH-18799](https://github.com/hashicorp/vault/pull/18799)]
+* secrets/gcp: Upgrades dependencies [[GH-17871](https://github.com/hashicorp/vault/pull/17871)]
+* secrets/kubernetes: Add /check endpoint to determine if environment variables are set [[GH-18](https://github.com/hashicorp/vault-plugin-secrets-kubernetes/pull/18)] [[GH-18587](https://github.com/hashicorp/vault/pull/18587)]
+* secrets/kubernetes: add /check endpoint to determine if environment variables are set [[GH-19084](https://github.com/hashicorp/vault/pull/19084)]
+* secrets/kv: Emit events on write if events system enabled [[GH-19145](https://github.com/hashicorp/vault/pull/19145)]
+* secrets/kv: make upgrade synchronous when no keys to upgrade [[GH-19056](https://github.com/hashicorp/vault/pull/19056)]
+* secrets/kv: new KVv2 mounts and KVv1 mounts without any keys will upgrade synchronously, allowing for instant use [[GH-17406](https://github.com/hashicorp/vault/pull/17406)]
+* secrets/pki: Add a new API that returns the serial numbers of revoked certificates on the local cluster [[GH-17779](https://github.com/hashicorp/vault/pull/17779)]
+* secrets/pki: Add support to specify signature bits when generating CSRs through intermediate/generate apis [[GH-17388](https://github.com/hashicorp/vault/pull/17388)]
+* secrets/pki: Added a new API that allows external actors to craft a CRL through JSON parameters [[GH-18040](https://github.com/hashicorp/vault/pull/18040)]
+* secrets/pki: Allow UserID Field (https://www.rfc-editor.org/rfc/rfc1274#section-9.3.1) to be set on Certificates when
+allowed by role [[GH-18397](https://github.com/hashicorp/vault/pull/18397)]
+* secrets/pki: Allow issuer creation, import to change default issuer via `default_follows_latest_issuer`. [[GH-17824](https://github.com/hashicorp/vault/pull/17824)]
+* secrets/pki: Allow templating performance replication cluster- and issuer-specific AIA URLs. [[GH-18199](https://github.com/hashicorp/vault/pull/18199)]
+* secrets/pki: Allow tidying of expired issuer certificates. [[GH-17823](https://github.com/hashicorp/vault/pull/17823)]
+* secrets/pki: Allow tidying of the legacy ca_bundle, improving startup on post-migrated, seal-wrapped PKI mounts. [[GH-18645](https://github.com/hashicorp/vault/pull/18645)]
+* secrets/pki: Respond with written data to `config/auto-tidy`, `config/crl`, and `roles/:role`. [[GH-18222](https://github.com/hashicorp/vault/pull/18222)]
+* secrets/pki: Return issuer_id and issuer_name on /issuer/:issuer_ref/json endpoint. [[GH-18482](https://github.com/hashicorp/vault/pull/18482)]
+* secrets/pki: Return new fields revocation_time_rfc3339 and issuer_id to existing certificate serial lookup api if it is revoked [[GH-17774](https://github.com/hashicorp/vault/pull/17774)]
+* secrets/ssh: Allow removing SSH host keys from the dynamic keys feature. [[GH-18939](https://github.com/hashicorp/vault/pull/18939)]
+* secrets/ssh: Evaluate ssh validprincipals user template before splitting [[GH-16622](https://github.com/hashicorp/vault/pull/16622)]
+* secrets/transit: Add an optional reference field to batch operation items
+which is repeated on batch responses to help more easily correlate inputs with outputs. [[GH-18243](https://github.com/hashicorp/vault/pull/18243)]
+* secrets/transit: Add associated_data parameter for additional authenticated data in AEAD ciphers [[GH-17638](https://github.com/hashicorp/vault/pull/17638)]
+* secrets/transit: Add support for PKCSv1_5_NoOID RSA signatures [[GH-17636](https://github.com/hashicorp/vault/pull/17636)]
+* secrets/transit: Allow configuring whether upsert of keys is allowed. [[GH-18272](https://github.com/hashicorp/vault/pull/18272)]
+* storage/raft: Add `retry_join_as_non_voter` config option. [[GH-18030](https://github.com/hashicorp/vault/pull/18030)]
+* storage/raft: add additional raft metrics relating to applied index and heartbeating; also ensure OSS standbys emit periodic metrics. [[GH-12166](https://github.com/hashicorp/vault/pull/12166)]
+* sys/internal/inspect: Creates an endpoint to look to inspect internal subsystems. [[GH-17789](https://github.com/hashicorp/vault/pull/17789)]
+* sys/internal/inspect: Creates an endpoint to look to inspect internal subsystems.
+* ui: Add algorithm-signer as a SSH Secrets Engine UI field [[GH-10299](https://github.com/hashicorp/vault/pull/10299)]
+* ui: Add inline policy creation when creating an identity entity or group [[GH-17749](https://github.com/hashicorp/vault/pull/17749)]
+* ui: Added JWT authentication warning message about blocked pop-up windows and web browser settings. [[GH-18787](https://github.com/hashicorp/vault/pull/18787)]
+* ui: Enable typescript for future development [[GH-17927](https://github.com/hashicorp/vault/pull/17927)]
+* ui: Prepends "passcode=" if not provided in user input for duo totp mfa method authentication [[GH-18342](https://github.com/hashicorp/vault/pull/18342)]
+* ui: Update language on database role to "Connection name" [[GH-18261](https://github.com/hashicorp/vault/issues/18261)] [[GH-18350](https://github.com/hashicorp/vault/pull/18350)]
+* ui: adds allowed_response_headers as param for secret engine mount config [[GH-19216](https://github.com/hashicorp/vault/pull/19216)]
+* ui: consolidate all <a> tag usage [[GH-17866](https://github.com/hashicorp/vault/pull/17866)]
+* ui: mfa: use proper request id generation [[GH-17835](https://github.com/hashicorp/vault/pull/17835)]
+* ui: remove wizard [[GH-19220](https://github.com/hashicorp/vault/pull/19220)]
+* ui: update DocLink component to use new host url: developer.hashicorp.com [[GH-18374](https://github.com/hashicorp/vault/pull/18374)]
+* ui: update TTL picker for consistency [[GH-18114](https://github.com/hashicorp/vault/pull/18114)]
+* ui: use the combined activity log (partial + historic) API for client count dashboard and remove use of monthly endpoint [[GH-17575](https://github.com/hashicorp/vault/pull/17575)]
+* vault/diagnose: Upgrade `go.opentelemetry.io/otel`, `go.opentelemetry.io/otel/sdk`, `go.opentelemetry.io/otel/trace` to v1.11.2 [[GH-18589](https://github.com/hashicorp/vault/pull/18589)]
+
+DEPRECATIONS:
+
+* secrets/ad: Marks the Active Directory (AD) secrets engine as deprecated. [[GH-19334](https://github.com/hashicorp/vault/pull/19334)]
+
+BUG FIXES:
+
+* api: Remove timeout logic from ReadRaw functions and add ReadRawWithContext [[GH-18708](https://github.com/hashicorp/vault/pull/18708)]
+* auth/alicloud: fix regression in vault login command that caused login to fail [[GH-19005](https://github.com/hashicorp/vault/pull/19005)]
+* auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [[GH-19186](https://github.com/hashicorp/vault/pull/19186)]
+* auth/approle: Fix `token_bound_cidrs` validation when using /32 blocks for role and secret ID [[GH-18145](https://github.com/hashicorp/vault/pull/18145)]
+* auth/cert: Address a race condition accessing the loaded crls without a lock [[GH-18945](https://github.com/hashicorp/vault/pull/18945)]
+* auth/kubernetes: Ensure a consistent TLS configuration for all k8s API requests [[#173](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/173)] [[GH-18716](https://github.com/hashicorp/vault/pull/18716)]
+* auth/kubernetes: fixes and dep updates for the auth-kubernetes plugin (see plugin changelog for details) [[GH-19094](https://github.com/hashicorp/vault/pull/19094)]
+* auth/okta: fix a panic for AuthRenew in Okta [[GH-18011](https://github.com/hashicorp/vault/pull/18011)]
+* auth: Deduplicate policies prior to ACL generation [[GH-17914](https://github.com/hashicorp/vault/pull/17914)]
+* cli/kv: skip formatting of nil secrets for patch and put with field parameter set [[GH-18163](https://github.com/hashicorp/vault/pull/18163)]
+* cli/pki: Decode integer values properly in health-check configuration file [[GH-19265](https://github.com/hashicorp/vault/pull/19265)]
+* cli/pki: Fix path for role health-check warning messages [[GH-19274](https://github.com/hashicorp/vault/pull/19274)]
+* cli/pki: Properly report permission issues within health-check mount tune checks [[GH-19276](https://github.com/hashicorp/vault/pull/19276)]
+* cli/transit: Fix import, import-version command invocation [[GH-19373](https://github.com/hashicorp/vault/pull/19373)]
+* cli: Fix issue preventing kv commands from executing properly when the mount path provided by `-mount` flag and secret key path are the same. [[GH-17679](https://github.com/hashicorp/vault/pull/17679)]
+* cli: Fix vault read handling to return raw data as secret.Data when there is no top-level data object from api response. [[GH-17913](https://github.com/hashicorp/vault/pull/17913)]
+* cli: Remove empty table heading for `vault secrets list -detailed` output. [[GH-17577](https://github.com/hashicorp/vault/pull/17577)]
+* command/namespace: Fix vault cli namespace patch examples in help text. [[GH-18143](https://github.com/hashicorp/vault/pull/18143)]
+* core (enterprise): Fix missing quotation mark in error message
+* core (enterprise): Fix panic that could occur with SSCT alongside invoking external plugins for revocation.
+* core (enterprise): Fix panic when using invalid accessor for control-group request
+* core (enterprise): Fix perf standby WAL streaming silently failures when replication setup happens at a bad time.
+* core (enterprise): Supported storage check in `vault server` command will no longer prevent startup. Instead, a warning will be logged if configured to use storage backend other than `raft` or `consul`.
+* core/activity: add namespace breakdown for new clients when date range spans multiple months, including the current month. [[GH-18766](https://github.com/hashicorp/vault/pull/18766)]
+* core/activity: de-duplicate namespaces when historical and current month data are mixed [[GH-18452](https://github.com/hashicorp/vault/pull/18452)]
+* core/activity: fix the end_date returned from the activity log endpoint when partial counts are computed [[GH-17856](https://github.com/hashicorp/vault/pull/17856)]
+* core/activity: include mount counts when de-duplicating current and historical month data [[GH-18598](https://github.com/hashicorp/vault/pull/18598)]
+* core/activity: report mount paths (rather than mount accessors) in current month activity log counts and include deleted mount paths in precomputed queries. [[GH-18916](https://github.com/hashicorp/vault/pull/18916)]
+* core/activity: return partial month counts when querying a historical date range and no historical data exists. [[GH-17935](https://github.com/hashicorp/vault/pull/17935)]
+* core/auth: Return a 403 instead of a 500 for wrapping requests when token is not provided [[GH-18859](https://github.com/hashicorp/vault/pull/18859)]
+* core/managed-keys (enterprise): Limit verification checks to mounts in a key's namespace
+* core/managed-keys (enterprise): Return better error messages when encountering key creation failures
+* core/managed-keys (enterprise): Switch to using hash length as PSS Salt length within the test/sign api for better PKCS#11 compatibility
+* core/quotas (enterprise): Fix a lock contention issue that could occur and cause Vault to become unresponsive when creating, changing, or deleting lease count quotas.
+* core/quotas (enterprise): Fix a potential deadlock that could occur when using lease count quotas.
+* core/quotas: Fix issue with improper application of default rate limit quota exempt paths [[GH-18273](https://github.com/hashicorp/vault/pull/18273)]
+* core/seal: Fix regression handling of the key_id parameter in seal configuration HCL. [[GH-17612](https://github.com/hashicorp/vault/pull/17612)]
+* core: Fix panic caused in Vault Agent when rendering certificate templates [[GH-17419](https://github.com/hashicorp/vault/pull/17419)]
+* core: Fix potential deadlock if barrier ciphertext is less than 4 bytes. [[GH-17944](https://github.com/hashicorp/vault/pull/17944)]
+* core: Fix spurious `permission denied` for all HelpOperations on sudo-protected paths [[GH-18568](https://github.com/hashicorp/vault/pull/18568)]
+* core: Fix vault operator init command to show the right curl string with -output-curl-string and right policy hcl with -output-policy [[GH-17514](https://github.com/hashicorp/vault/pull/17514)]
+* core: Fixes spurious warnings being emitted relating to "unknown or unsupported fields" for JSON config [[GH-17660](https://github.com/hashicorp/vault/pull/17660)]
+* core: Linux packages now have vendor label and set the default label to HashiCorp.
+This fix is implemented for any future releases, but will not be updated for historical releases.
+* core: Prevent panics in `sys/leases/lookup`, `sys/leases/revoke`, and `sys/leases/renew` endpoints if provided `lease_id` is null [[GH-18951](https://github.com/hashicorp/vault/pull/18951)]
+* core: Refactor lock grabbing code to simplify stateLock deadlock investigations [[GH-17187](https://github.com/hashicorp/vault/pull/17187)]
+* core: fix GPG encryption to support subkeys. [[GH-16224](https://github.com/hashicorp/vault/pull/16224)]
+* core: fix a start up race condition where performance standbys could go into a
+mount loop if default policies are not yet synced from the active node. [[GH-17801](https://github.com/hashicorp/vault/pull/17801)]
+* core: fix bug where context cancellations weren't forwarded to active node from performance standbys.
+* core: fix race when using SystemView.ReplicationState outside of a request context [[GH-17186](https://github.com/hashicorp/vault/pull/17186)]
+* core: prevent memory leak when using control group factors in a policy [[GH-17532](https://github.com/hashicorp/vault/pull/17532)]
+* core: prevent panic during mfa after enforcement's namespace is deleted [[GH-17562](https://github.com/hashicorp/vault/pull/17562)]
+* core: prevent panic in login mfa enforcement delete after enforcement's namespace is deleted [[GH-18923](https://github.com/hashicorp/vault/pull/18923)]
+* core: trying to unseal with the wrong key now returns HTTP 400 [[GH-17836](https://github.com/hashicorp/vault/pull/17836)]
+* credential/cert: adds error message if no tls connection is found during the AliasLookahead operation [[GH-17904](https://github.com/hashicorp/vault/pull/17904)]
+* database/mongodb: Fix writeConcern set to be applied to any query made on the database [[GH-18546](https://github.com/hashicorp/vault/pull/18546)]
+* expiration: Prevent panics on perf standbys when an irrevocable lease gets deleted. [[GH-18401](https://github.com/hashicorp/vault/pull/18401)]
+* kmip (enterprise): Fix a problem with some multi-part MAC Verify operations.
+* kmip (enterprise): Only require data to be full blocks on encrypt/decrypt operations using CBC and ECB block cipher modes.
+* license (enterprise): Fix bug where license would update even if the license didn't change.
+* licensing (enterprise): update autoloaded license cache after reload
+* login: Store token in tokenhelper for interactive login MFA [[GH-17040](https://github.com/hashicorp/vault/pull/17040)]
+* openapi: Fix many incorrect details in generated API spec, by using better techniques to parse path regexps [[GH-18554](https://github.com/hashicorp/vault/pull/18554)]
+* openapi: fix gen_openapi.sh script to correctly load vault plugins [[GH-17752](https://github.com/hashicorp/vault/pull/17752)]
+* plugins/kv: KV v2 returns 404 instead of 500 for request paths that incorrectly include a trailing slash. [[GH-17339](https://github.com/hashicorp/vault/pull/17339)]
+* plugins: Allow running external plugins which override deprecated builtins. [[GH-17879](https://github.com/hashicorp/vault/pull/17879)]
+* plugins: Corrected the path to check permissions on when the registered plugin name does not match the plugin binary's filename. [[GH-17340](https://github.com/hashicorp/vault/pull/17340)]
+* plugins: Listing all plugins while audit logging is enabled will no longer result in an internal server error. [[GH-18173](https://github.com/hashicorp/vault/pull/18173)]
+* plugins: Only report deprecation status for builtin plugins. [[GH-17816](https://github.com/hashicorp/vault/pull/17816)]
+* plugins: Skip loading but still mount data associated with missing plugins on unseal. [[GH-18189](https://github.com/hashicorp/vault/pull/18189)]
+* plugins: Vault upgrades will no longer fail if a mount has been created using an explicit builtin plugin version. [[GH-18051](https://github.com/hashicorp/vault/pull/18051)]
+* replication (enterprise): Fix bug where reloading external plugin on a secondary would
+break replication.
+* sdk: Don't panic if system view or storage methods called during plugin setup. [[GH-18210](https://github.com/hashicorp/vault/pull/18210)]
+* secret/pki: fix bug with initial legacy bundle migration (from < 1.11 into 1.11+) and missing issuers from ca_chain [[GH-17772](https://github.com/hashicorp/vault/pull/17772)]
+* secrets/ad: Fix bug where updates to config would fail if password isn't provided [[GH-19061](https://github.com/hashicorp/vault/pull/19061)]
+* secrets/gcp: fix issue where IAM bindings were not preserved during policy update [[GH-19018](https://github.com/hashicorp/vault/pull/19018)]
+* secrets/mongodb-atlas: Fix a bug that did not allow WAL rollback to handle partial failures when creating API keys [[GH-19111](https://github.com/hashicorp/vault/pull/19111)]
+* secrets/pki: Address nil panic when an empty POST request is sent to the OCSP handler [[GH-18184](https://github.com/hashicorp/vault/pull/18184)]
+* secrets/pki: Allow patching issuer to set an empty issuer name. [[GH-18466](https://github.com/hashicorp/vault/pull/18466)]
+* secrets/pki: Do not read revoked certificates from backend when CRL is disabled [[GH-17385](https://github.com/hashicorp/vault/pull/17385)]
+* secrets/pki: Fix upgrade of missing expiry, delta_rebuild_interval by setting them to the default. [[GH-17693](https://github.com/hashicorp/vault/pull/17693)]
+* secrets/pki: Fixes duplicate otherName in certificates created by the sign-verbatim endpoint. [[GH-16700](https://github.com/hashicorp/vault/pull/16700)]
+* secrets/pki: OCSP GET request parameter was not being URL unescaped before processing. [[GH-18938](https://github.com/hashicorp/vault/pull/18938)]
+* secrets/pki: Respond to tidy-status, tidy-cancel on PR Secondary clusters. [[GH-17497](https://github.com/hashicorp/vault/pull/17497)]
+* secrets/pki: Revert fix for PR [18938](https://github.com/hashicorp/vault/pull/18938) [[GH-19037](https://github.com/hashicorp/vault/pull/19037)]
+* secrets/pki: consistently use UTC for CA's notAfter exceeded error message [[GH-18984](https://github.com/hashicorp/vault/pull/18984)]
+* secrets/pki: fix race between tidy's cert counting and tidy status reporting. [[GH-18899](https://github.com/hashicorp/vault/pull/18899)]
+* secrets/transit: Do not warn about unrecognized parameter 'batch_input' [[GH-18299](https://github.com/hashicorp/vault/pull/18299)]
+* secrets/transit: Honor `partial_success_response_code` on decryption failures. [[GH-18310](https://github.com/hashicorp/vault/pull/18310)]
+* server/config:  Use file.Stat when checking file permissions when VAULT_ENABLE_FILE_PERMISSIONS_CHECK is enabled [[GH-19311](https://github.com/hashicorp/vault/pull/19311)]
+* storage/raft (enterprise): An already joined node can rejoin by wiping storage
+and re-issueing a join request, but in doing so could transiently become a
+non-voter.  In some scenarios this resulted in loss of quorum. [[GH-18263](https://github.com/hashicorp/vault/pull/18263)]
+* storage/raft: Don't panic on unknown raft ops [[GH-17732](https://github.com/hashicorp/vault/pull/17732)]
+* storage/raft: Fix race with follower heartbeat tracker during teardown. [[GH-18704](https://github.com/hashicorp/vault/pull/18704)]
+* ui/keymgmt: Sets the defaultValue for type when creating a key. [[GH-17407](https://github.com/hashicorp/vault/pull/17407)]
+* ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [[GH-19071](https://github.com/hashicorp/vault/pull/19071)]
+* ui: Fixes issue with not being able to download raft snapshot via service worker [[GH-17769](https://github.com/hashicorp/vault/pull/17769)]
+* ui: Fixes oidc/jwt login issue with alternate mount path and jwt login via mount path tab [[GH-17661](https://github.com/hashicorp/vault/pull/17661)]
+* ui: Remove `default` and add `default-service` and `default-batch` to UI token_type for auth mount and tuning. [[GH-19290](https://github.com/hashicorp/vault/pull/19290)]
+* ui: Remove default value of 30 to TtlPicker2 if no value is passed in. [[GH-17376](https://github.com/hashicorp/vault/pull/17376)]
+* ui: allow selection of "default" for ssh algorithm_signer in web interface [[GH-17894](https://github.com/hashicorp/vault/pull/17894)]
+* ui: cleanup unsaved auth method ember data record when navigating away from mount backend form [[GH-18651](https://github.com/hashicorp/vault/pull/18651)]
+* ui: fix entity policies list link to policy show page [[GH-17950](https://github.com/hashicorp/vault/pull/17950)]
+* ui: fixes query parameters not passed in api explorer test requests [[GH-18743](https://github.com/hashicorp/vault/pull/18743)]
+* ui: fixes reliance on secure context (https) by removing methods using the Crypto interface [[GH-19403](https://github.com/hashicorp/vault/pull/19403)]
+* ui: show Get credentials button for static roles detail page when a user has the proper permissions. [[GH-19190](https://github.com/hashicorp/vault/pull/19190)]
+
+## 1.12.11
+### September 13, 2023
+
+SECURITY:
+
+* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [[GH-22852](https://github.com/hashicorp/vault/pull/22852)]
+
+IMPROVEMENTS:
+
+* auth/ldap: improved login speed by adding concurrency to LDAP token group searches [[GH-22659](https://github.com/hashicorp/vault/pull/22659)]
+* kmip (enterprise): reduce latency of KMIP operation handling
+
+BUG FIXES:
+
+* cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to `table`. [[GH-22818](https://github.com/hashicorp/vault/pull/22818)]
+* core/quotas: Reduce overhead for role calculation when using cloud auth methods. [[GH-22583](https://github.com/hashicorp/vault/pull/22583)]
+* core/seal: add a workaround for potential connection [[hangs](https://github.com/Azure/azure-sdk-for-go/issues/21346)] in Azure autoseals. [[GH-22760](https://github.com/hashicorp/vault/pull/22760)]
+* raft/autopilot: Add dr-token flag for raft autopilot cli commands [[GH-21165](https://github.com/hashicorp/vault/pull/21165)]
+* replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
+
+## 1.12.10
+### August 30, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.19.12.
+
+IMPROVEMENTS:
+
+* core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [[GH-22235](https://github.com/hashicorp/vault/pull/22235)]
+* replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
+* storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [[GH-22040](https://github.com/hashicorp/vault/pull/22040)]
+* ui: enables create and update KV secret workflow when control group present [[GH-22471](https://github.com/hashicorp/vault/pull/22471)]
+
+BUG FIXES:
+
+* api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [[GH-22523](https://github.com/hashicorp/vault/pull/22523)]
+* core (enterprise): Remove MFA Configuration for namespace when deleting namespace
+* core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
+Also fix a related potential deadlock. [[GH-21110](https://github.com/hashicorp/vault/pull/21110)]
+* core:  Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [[GH-22137](https://github.com/hashicorp/vault/pull/22137)]
+* core: Fix readonly errors that could occur while loading mounts/auths during unseal [[GH-22362](https://github.com/hashicorp/vault/pull/22362)]
+* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-21470](https://github.com/hashicorp/vault/pull/21470)]
+* expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [[GH-22374](https://github.com/hashicorp/vault/pull/22374)]
+* license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [[GH-22363](https://github.com/hashicorp/vault/pull/22363)]
+* replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
+* replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
+* sdk/ldaputil: Properly escape user filters when using UPN domains
+sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [[GH-22249](https://github.com/hashicorp/vault/pull/22249)]
+* secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [[GH-22332](https://github.com/hashicorp/vault/pull/22332)]
+* secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
+* ui: Fix blank page or ghost secret when canceling KV secret create [[GH-22541](https://github.com/hashicorp/vault/pull/22541)]
+* ui: fixes `max_versions` default for secret metadata unintentionally overriding kv engine defaults [[GH-22394](https://github.com/hashicorp/vault/pull/22394)]
+
+## 1.12.9
+### July 25, 2023
+
+SECURITY:
+
+* core/namespace (enterprise): An unhandled error in Vault Enterprise’s namespace creation may cause the Vault process to crash, potentially resulting in denial of service. This vulnerability, CVE-2023-3774, is fixed in Vault Enterprise 1.14.1, 1.13.5, and 1.12.9. [[HSEC_2023-23](https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617)]
+
+CHANGES:
+
+* secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
+
+IMPROVEMENTS:
+
+* core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
+* replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
+* secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
+
+BUG FIXES:
+
+* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-24170](https://github.com/hashicorp/vault/pull/24170)]
+* identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [[GH-20965](https://github.com/hashicorp/vault/pull/20965)]
+* replication (enterprise): update primary cluster address after DR failover
+* secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21633](https://github.com/hashicorp/vault/pull/21633)]
+* secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error: `no managed key found with uuid`. [[GH-21316](https://github.com/hashicorp/vault/pull/21316)]
+* secrets/pki: Support setting both maintain_stored_certificate_counts=false and publish_stored_certificate_count_metrics=false explicitly in tidy config. [[GH-20664](https://github.com/hashicorp/vault/pull/20664)]
+* secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
+* secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
+* serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [[GH-21642](https://github.com/hashicorp/vault/pull/21642)]
+* ui: Fixed an issue where editing an SSH role would clear `default_critical_options` and `default_extension` if left unchanged. [[GH-21739](https://github.com/hashicorp/vault/pull/21739)]
+
+## 1.12.8
+### June 21, 2023
+BREAKING CHANGES:
+
+* secrets/pki: Maintaining running count of certificates will be turned off by default.
+To re-enable keeping these metrics available on the tidy status endpoint, enable
+maintain_stored_certificate_counts on tidy-config, to also publish them to the
+metrics consumer, enable publish_stored_certificate_count_metrics . [[GH-18186](https://github.com/hashicorp/vault/pull/18186)]
+
+CHANGES:
+
+* core: Bump Go version to 1.19.10.
+
+FEATURES:
+
+* **Automated License Utilization Reporting**: Added automated license
+utilization reporting, which sends minimal product-license [metering
+data](https://developer.hashicorp.com/vault/docs/enterprise/license/utilization-reporting)
+to HashiCorp without requiring you to manually collect and report them.
+* core (enterprise): Add background worker for automatic reporting of billing
+information. [[GH-19625](https://github.com/hashicorp/vault/pull/19625)]
+
+IMPROVEMENTS:
+
+* api: GET ... /sys/internal/counters/activity?current_billing_period=true now
+results in a response which contains the full billing period [[GH-20694](https://github.com/hashicorp/vault/pull/20694)]
+* api: `/sys/internal/counters/config` endpoint now contains read-only
+`minimum_retention_months`. [[GH-20150](https://github.com/hashicorp/vault/pull/20150)]
+* api: `/sys/internal/counters/config` endpoint now contains read-only
+`reporting_enabled` and `billing_start_timestamp` fields. [[GH-20086](https://github.com/hashicorp/vault/pull/20086)]
+* core (enterprise): add configuration for license reporting [[GH-19891](https://github.com/hashicorp/vault/pull/19891)]
+* core (enterprise): license updates trigger a reload of reporting and the activity log [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
+* core (enterprise): support reloading configuration for automated reporting via SIGHUP [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
+* core (enterprise): vault server command now allows for opt-out of automated
+reporting via the `OPTOUT_LICENSE_REPORTING` environment variable. [[GH-3939](https://github.com/hashicorp/vault/pull/3939)]
+* core/activity: error when attempting to update retention configuration below the minimum [[GH-20078](https://github.com/hashicorp/vault/pull/20078)]
+* core/activity: refactor the activity log's generation of precomputed queries [[GH-20073](https://github.com/hashicorp/vault/pull/20073)]
+* ui: updates clients configuration edit form state based on census reporting configuration [[GH-20125](https://github.com/hashicorp/vault/pull/20125)]
+
+BUG FIXES:
+
+* core (enterprise): Don't delete backend stored data that appears to be filterable
+on this secondary if we don't have a corresponding mount entry.
+* core/activity: add namespace breakdown for new clients when date range spans multiple months, including the current month. [[GH-18766](https://github.com/hashicorp/vault/pull/18766)]
+* core/activity: de-duplicate namespaces when historical and current month data are mixed [[GH-18452](https://github.com/hashicorp/vault/pull/18452)]
+* core/activity: fix the end_date returned from the activity log endpoint when partial counts are computed [[GH-17856](https://github.com/hashicorp/vault/pull/17856)]
+* core/activity: include mount counts when de-duplicating current and historical month data [[GH-18598](https://github.com/hashicorp/vault/pull/18598)]
+* core/activity: report mount paths (rather than mount accessors) in current month activity log counts and include deleted mount paths in precomputed queries. [[GH-18916](https://github.com/hashicorp/vault/pull/18916)]
+* core/activity: return partial month counts when querying a historical date range and no historical data exists. [[GH-17935](https://github.com/hashicorp/vault/pull/17935)]
+* core: Change where we evaluate filtered paths as part of mount operations; this is part of an enterprise bugfix that will
+have its own changelog entry.  Fix wrong lock used in ListAuths link meta interface implementation. [[GH-21260](https://github.com/hashicorp/vault/pull/21260)]
+* core: Do not cache seal configuration to fix a bug that resulted in sporadic auto unseal failures. [[GH-21223](https://github.com/hashicorp/vault/pull/21223)]
+* core: Don't exit just because we think there's a potential deadlock. [[GH-21342](https://github.com/hashicorp/vault/pull/21342)]
+* core: Fix panic in sealed nodes using raft storage trying to emit raft metrics [[GH-21249](https://github.com/hashicorp/vault/pull/21249)]
+* identity: Fixes duplicate groups creation with the same name but unique IDs. [[GH-20964](https://github.com/hashicorp/vault/pull/20964)]
+* replication (enterprise): Fix a race condition with update-primary that could result in data loss after a DR failover
+* replication (enterprise): Fix path filters deleting data right after it's written by backend Initialize funcs
+* storage/raft: Fix race where new follower joining can get pruned by dead server cleanup. [[GH-20986](https://github.com/hashicorp/vault/pull/20986)]
+
+## 1.12.7
+### June 08, 2023
+
+SECURITY:
+
+* ui: key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. [[HSEC-2023-17](https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814)]
+
+CHANGES:
+
+* core: Bump Go version to 1.19.9.
+* core: Revert #19676 (VAULT_GRPC_MIN_CONNECT_TIMEOUT env var) as we decided it was unnecessary. [[GH-20826](https://github.com/hashicorp/vault/pull/20826)]
+
+IMPROVEMENTS:
+
+* audit: add a `mount_point` field to audit requests and response entries [[GH-20411](https://github.com/hashicorp/vault/pull/20411)]
+* command/server: Add support for dumping pprof files to the filesystem via SIGUSR2 when
+`VAULT_PPROF_WRITE_TO_FILE=true` is set on the server. [[GH-20609](https://github.com/hashicorp/vault/pull/20609)]
+* core: include namespace path in granting_policies block of audit log
+* openapi: Fix generated types for duration strings [[GH-20841](https://github.com/hashicorp/vault/pull/20841)]
+* sdk/framework: Fix non-deterministic ordering of 'required' fields in OpenAPI spec [[GH-20881](https://github.com/hashicorp/vault/pull/20881)]
+* secrets/pki: add subject key identifier to read key response [[GH-20642](https://github.com/hashicorp/vault/pull/20642)]
+* ui: update TTL picker for consistency [[GH-18114](https://github.com/hashicorp/vault/pull/18114)]
+
+BUG FIXES:
+
+* api: Properly Handle nil identity_policies in Secret Data [[GH-20636](https://github.com/hashicorp/vault/pull/20636)]
+* auth/ldap: Set default value for `max_page_size` properly [[GH-20453](https://github.com/hashicorp/vault/pull/20453)]
+* cli: CLI should take days as a unit of time for ttl like flags [[GH-20477](https://github.com/hashicorp/vault/pull/20477)]
+* cli: disable printing flags warnings messages for the ssh command [[GH-20502](https://github.com/hashicorp/vault/pull/20502)]
+* core (enterprise): Fix log shipper buffer size overflow issue for 32 bit architecture.
+* core (enterprise): Fix logshipper buffer size to default to DefaultBufferSize only when reported system memory is zero.
+* core (enterprise): Remove MFA Enforcment configuration for namespace when deleting namespace
+* core: prevent panic on login after namespace is deleted that had mfa enforcement [[GH-20375](https://github.com/hashicorp/vault/pull/20375)]
+* replication (enterprise): Fix a race condition with invalid tokens during WAL streaming that was causing Secondary clusters to be unable to connect to a Primary.
+* replication (enterprise): fix bug where secondary grpc connections would timeout when connecting to a primary host that no longer exists.
+* secrets/transform (enterprise): Fix a caching bug affecting secondary nodes after a tokenization key rotation
+* secrets/transit: Fix export of HMAC-only key, correctly exporting the key used for sign operations. For consumers of the previously incorrect key, use the plaintext export to retrieve these incorrect keys and import them as new versions.
+secrets/transit: Fix bug related to shorter dedicated HMAC key sizing.
+sdk/helper/keysutil: New HMAC type policies will have HMACKey equal to Key and be copied over on import. [[GH-20864](https://github.com/hashicorp/vault/pull/20864)]
+* ui: Fixes issue unsealing cluster for seal types other than shamir [[GH-20897](https://github.com/hashicorp/vault/pull/20897)]
+
+## 1.12.6
+### April 26, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.19.8.
+
+IMPROVEMENTS:
+
+* cli/namespace: Add detailed flag to output additional namespace information
+such as namespace IDs and custom metadata. [[GH-20243](https://github.com/hashicorp/vault/pull/20243)]
+* core/activity: add an endpoint to write test activity log data, guarded by a build flag [[GH-20019](https://github.com/hashicorp/vault/pull/20019)]
+* core: Add a `raft` sub-field to the `storage` and `ha_storage` details provided by the
+`/sys/config/state/sanitized` endpoint in order to include the `max_entry_size`. [[GH-20044](https://github.com/hashicorp/vault/pull/20044)]
+* sdk/ldaputil: added `connection_timeout` to tune connection timeout duration
+for all LDAP plugins. [[GH-20144](https://github.com/hashicorp/vault/pull/20144)]
+* secrets/pki: Decrease size and improve compatibility of OCSP responses by removing issuer certificate. [[GH-20201](https://github.com/hashicorp/vault/pull/20201)]
+
+BUG FIXES:
+
+* auth/ldap: Add max_page_size configurable to LDAP configuration [[GH-19032](https://github.com/hashicorp/vault/pull/19032)]
+* command/server: Fix incorrect paths in generated config for `-dev-tls` flag on Windows [[GH-20257](https://github.com/hashicorp/vault/pull/20257)]
+* core (enterprise): Fix intermittent issue with token entries sometimes not being found when using a newly created token in a request to a secondary, even when SSCT `new_token` forwarding is set. When this occurred, this would result in the following error to the client: `error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue`.
+* core (enterprise): Fix read on perf standbys failing with 412 after leadership change, unseal, restores or restarts when no writes occur
+* core/ssct (enterprise): Fixed race condition where a newly promoted DR may revert `sscGenCounter`
+resulting in 412 errors.
+* core: Fix regression breaking non-raft clusters whose nodes share the same cluster_addr/api_addr. [[GH-19721](https://github.com/hashicorp/vault/pull/19721)]
+* helper/random: Fix race condition in string generator helper [[GH-19875](https://github.com/hashicorp/vault/pull/19875)]
+* kmip (enterprise): Fix a problem decrypting with keys that have no Process Start Date attribute.
+* openapi: Fix many incorrect details in generated API spec, by using better techniques to parse path regexps [[GH-18554](https://github.com/hashicorp/vault/pull/18554)]
+* pki: Fix automatically turning off CRL signing on upgrade to Vault >= 1.12, if CA Key Usage disallows it [[GH-20220](https://github.com/hashicorp/vault/pull/20220)]
+* replication (enterprise): Fix a caching issue when replicating filtered data to
+a performance secondary. This resulted in the data being set to nil in the cache
+and a "invalid value" error being returned from the API.
+* replication (enterprise): Fix replication status for Primary clusters showing its primary cluster's information (in case of DR) in secondaries field when known_secondaries field is nil
+* secrets/pki: Fix patching of leaf_not_after_behavior on issuers. [[GH-20341](https://github.com/hashicorp/vault/pull/20341)]
+* secrets/transform (enterprise): Address SQL connection leak when cleaning expired tokens
+* ui: Fix OIDC provider logo showing when domain doesn't match [[GH-20263](https://github.com/hashicorp/vault/pull/20263)]
+* ui: Fix bad link to namespace when namespace name includes `.` [[GH-19799](https://github.com/hashicorp/vault/pull/19799)]
+* ui: fixes browser console formatting for help command output [[GH-20064](https://github.com/hashicorp/vault/pull/20064)]
+* ui: remove use of htmlSafe except when first sanitized [[GH-20235](https://github.com/hashicorp/vault/pull/20235)]
+
+## 1.12.5
+### March 29, 2023
+
+SECURITY:
+
+* storage/mssql: When using Vault’s community-supported Microsoft SQL (MSSQL) database storage backend, a privileged attacker with the ability to write arbitrary data to Vault’s configuration may be able to perform arbitrary SQL commands on the underlying database server through Vault. This vulnerability, CVE-2023-0620, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-12](https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080)]
+* secrets/pki: Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. This vulnerability, CVE-2023-0665, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-11](https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079)]
+* core: HashiCorp Vault’s implementation of Shamir’s secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. This vulnerability, CVE-2023-25000, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-10](https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078)]
+
+IMPROVEMENTS:
+
+* auth/github: Allow for an optional Github auth token environment variable to make authenticated requests when fetching org id
+website/docs: Add docs for `VAULT_AUTH_CONFIG_GITHUB_TOKEN` environment variable when writing Github config [[GH-19244](https://github.com/hashicorp/vault/pull/19244)]
+* core: Allow overriding gRPC connect timeout via VAULT_GRPC_MIN_CONNECT_TIMEOUT. This is an env var rather than a config setting because we don't expect this to ever be needed.  It's being added as a last-ditch
+option in case all else fails for some replication issues we may not have fully reproduced. [[GH-19676](https://github.com/hashicorp/vault/pull/19676)]
+* core: validate name identifiers in mssql physical storage backend prior use [[GH-19591](https://github.com/hashicorp/vault/pull/19591)]
+
+BUG FIXES:
+
+* cli: Fix vault read handling to return raw data as secret.Data when there is no top-level data object from api response. [[GH-17913](https://github.com/hashicorp/vault/pull/17913)]
+* core (enterprise): Attempt to reconnect to a PKCS#11 HSM if we retrieve a CKR_FUNCTION_FAILED error.
+* core: Fixed issue with remounting mounts that have a non-trailing space in the 'to' or 'from' paths. [[GH-19585](https://github.com/hashicorp/vault/pull/19585)]
+* kmip (enterprise): Do not require attribute Cryptographic Usage Mask when registering Secret Data managed objects.
+* kmip (enterprise): Fix a problem forwarding some requests to the active node.
+* openapi: Fix logic for labeling unauthenticated/sudo paths. [[GH-19600](https://github.com/hashicorp/vault/pull/19600)]
+* secrets/ldap: Invalidates WAL entry for static role if `password_policy` has changed. [[GH-19641](https://github.com/hashicorp/vault/pull/19641)]
+* secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
+* ui: fixes issue navigating back a level using the breadcrumb from secret metadata view [[GH-19703](https://github.com/hashicorp/vault/pull/19703)]
+* ui: pass encodeBase64 param to HMAC transit-key-actions. [[GH-19429](https://github.com/hashicorp/vault/pull/19429)]
+* ui: use URLSearchParams interface to capture namespace param from SSOs (ex. ADFS) with decoded state param in callback url [[GH-19460](https://github.com/hashicorp/vault/pull/19460)]
+
+## 1.12.4
+### March 01, 2023
+
+SECURITY:
+* auth/approle: When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999 has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above. [[HSEC-2023-07](https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305)]
+
+CHANGES:
+
+* core: Bump Go version to 1.19.6.
+
+IMPROVEMENTS:
+
+* secrets/database: Adds error message requiring password on root crednetial rotation. [[GH-19103](https://github.com/hashicorp/vault/pull/19103)]
+* ui: remove wizard [[GH-19220](https://github.com/hashicorp/vault/pull/19220)]
+
+BUG FIXES:
+
+* auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [[GH-19186](https://github.com/hashicorp/vault/pull/19186)]
+* core (enterprise): Fix panic when using invalid accessor for control-group request
+* core (enterprise): Fix perf standby WAL streaming silently failures when replication setup happens at a bad time.
+* core: Prevent panics in `sys/leases/lookup`, `sys/leases/revoke`, and `sys/leases/renew` endpoints if provided `lease_id` is null [[GH-18951](https://github.com/hashicorp/vault/pull/18951)]
+* license (enterprise): Fix bug where license would update even if the license didn't change.
+* replication (enterprise): Fix bug where reloading external plugin on a secondary would
+break replication.
+* secrets/ad: Fix bug where config couldn't be updated unless binddn/bindpass were included in the update. [[GH-18207](https://github.com/hashicorp/vault/pull/18207)]
+* secrets/pki: Revert fix for PR [18938](https://github.com/hashicorp/vault/pull/18938) [[GH-19037](https://github.com/hashicorp/vault/pull/19037)]
+* server/config:  Use file.Stat when checking file permissions when VAULT_ENABLE_FILE_PERMISSIONS_CHECK is enabled [[GH-19311](https://github.com/hashicorp/vault/pull/19311)]
+* ui (enterprise): Fix cancel button from transform engine role creation page [[GH-19135](https://github.com/hashicorp/vault/pull/19135)]
+* ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [[GH-19071](https://github.com/hashicorp/vault/pull/19071)]
+* ui: fixes reliance on secure context (https) by removing methods using the Crypto interface [[GH-19410](https://github.com/hashicorp/vault/pull/19410)]
+* ui: show Get credentials button for static roles detail page when a user has the proper permissions. [[GH-19190](https://github.com/hashicorp/vault/pull/19190)]
+
+## 1.12.3
+### February 6, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.19.4.
+
+IMPROVEMENTS:
+
+* audit: Include stack trace when audit logging recovers from a panic. [[GH-18121](https://github.com/hashicorp/vault/pull/18121)]
+* command/server: Environment variable keys are now logged at startup. [[GH-18125](https://github.com/hashicorp/vault/pull/18125)]
+* core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
+* core: Add read support to `sys/loggers` and `sys/loggers/:name` endpoints [[GH-17979](https://github.com/hashicorp/vault/pull/17979)]
+* plugins: Let Vault unseal and mount deprecated builtin plugins in a
+deactivated state if this is not the first unseal after an upgrade. [[GH-17879](https://github.com/hashicorp/vault/pull/17879)]
+* secrets/db/mysql: Add `tls_server_name` and `tls_skip_verify` parameters [[GH-18799](https://github.com/hashicorp/vault/pull/18799)]
+* secrets/kv: new KVv2 mounts and KVv1 mounts without any keys will upgrade synchronously, allowing for instant use [[GH-17406](https://github.com/hashicorp/vault/pull/17406)]
+* storage/raft: add additional raft metrics relating to applied index and heartbeating; also ensure OSS standbys emit periodic metrics. [[GH-12166](https://github.com/hashicorp/vault/pull/12166)]
+* ui: Added JWT authentication warning message about blocked pop-up windows and web browser settings. [[GH-18787](https://github.com/hashicorp/vault/pull/18787)]
+* ui: Prepends "passcode=" if not provided in user input for duo totp mfa method authentication [[GH-18342](https://github.com/hashicorp/vault/pull/18342)]
+* ui: Update language on database role to "Connection name" [[GH-18261](https://github.com/hashicorp/vault/issues/18261)] [[GH-18350](https://github.com/hashicorp/vault/pull/18350)]
+
+BUG FIXES:
+
+* auth/approle: Fix `token_bound_cidrs` validation when using /32 blocks for role and secret ID [[GH-18145](https://github.com/hashicorp/vault/pull/18145)]
+* auth/cert: Address a race condition accessing the loaded crls without a lock [[GH-18945](https://github.com/hashicorp/vault/pull/18945)]
+* auth/kubernetes: Ensure a consistent TLS configuration for all k8s API requests [[#173](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/173)] [[GH-18716](https://github.com/hashicorp/vault/pull/18716)]
+* cli/kv: skip formatting of nil secrets for patch and put with field parameter set [[GH-18163](https://github.com/hashicorp/vault/pull/18163)]
+* command/namespace: Fix vault cli namespace patch examples in help text. [[GH-18143](https://github.com/hashicorp/vault/pull/18143)]
+* core (enterprise): Fix a race condition resulting in login errors to PKCS#11 modules under high concurrency.
+* core/managed-keys (enterprise): Limit verification checks to mounts in a key's namespace
+* core/quotas (enterprise): Fix a potential deadlock that could occur when using lease count quotas.
+* core/quotas: Fix issue with improper application of default rate limit quota exempt paths [[GH-18273](https://github.com/hashicorp/vault/pull/18273)]
+* core/seal: Fix regression handling of the key_id parameter in seal configuration HCL. [[GH-17612](https://github.com/hashicorp/vault/pull/17612)]
+* core: fix bug where context cancellations weren't forwarded to active node from performance standbys.
+* core: prevent panic in login mfa enforcement delete after enforcement's namespace is deleted [[GH-18923](https://github.com/hashicorp/vault/pull/18923)]
+* database/mongodb: Fix writeConcern set to be applied to any query made on the database [[GH-18546](https://github.com/hashicorp/vault/pull/18546)]
+* expiration: Prevent panics on perf standbys when an irrevocable lease gets deleted. [[GH-18401](https://github.com/hashicorp/vault/pull/18401)]
+* kmip (enterprise): Fix Destroy operation response that omitted Unique Identifier on some batched responses.
+* kmip (enterprise): Fix Locate operation response incompatibility with clients using KMIP versions prior to 1.3.
+* kmip (enterprise): Fix Query operation response that omitted streaming capability and supported profiles.
+* licensing (enterprise): update autoloaded license cache after reload
+* plugins: Allow running external plugins which override deprecated builtins. [[GH-17879](https://github.com/hashicorp/vault/pull/17879)]
+* plugins: Listing all plugins while audit logging is enabled will no longer result in an internal server error. [[GH-18173](https://github.com/hashicorp/vault/pull/18173)]
+* plugins: Skip loading but still mount data associated with missing plugins on unseal. [[GH-18189](https://github.com/hashicorp/vault/pull/18189)]
+* sdk: Don't panic if system view or storage methods called during plugin setup. [[GH-18210](https://github.com/hashicorp/vault/pull/18210)]
+* secrets/pki: Address nil panic when an empty POST request is sent to the OCSP handler [[GH-18184](https://github.com/hashicorp/vault/pull/18184)]
+* secrets/pki: Allow patching issuer to set an empty issuer name. [[GH-18466](https://github.com/hashicorp/vault/pull/18466)]
+* secrets/pki: OCSP GET request parameter was not being URL unescaped before processing. [[GH-18938](https://github.com/hashicorp/vault/pull/18938)]
+* secrets/pki: fix race between tidy's cert counting and tidy status reporting. [[GH-18899](https://github.com/hashicorp/vault/pull/18899)]
+* secrets/transit: Do not warn about unrecognized parameter 'batch_input' [[GH-18299](https://github.com/hashicorp/vault/pull/18299)]
+* secrets/transit: Honor `partial_success_response_code` on decryption failures. [[GH-18310](https://github.com/hashicorp/vault/pull/18310)]
+* storage/raft (enterprise): An already joined node can rejoin by wiping storage
+and re-issueing a join request, but in doing so could transiently become a
+non-voter.  In some scenarios this resulted in loss of quorum. [[GH-18263](https://github.com/hashicorp/vault/pull/18263)]
+* storage/raft: Don't panic on unknown raft ops [[GH-17732](https://github.com/hashicorp/vault/pull/17732)]
+* ui: cleanup unsaved auth method ember data record when navigating away from mount backend form [[GH-18651](https://github.com/hashicorp/vault/pull/18651)]
+* ui: fixes query parameters not passed in api explorer test requests [[GH-18743](https://github.com/hashicorp/vault/pull/18743)]
+## 1.12.2
+### November 30, 2022
+
+CHANGES:
+
+* core: Bump Go version to 1.19.3.
+* plugins: Mounts can no longer be pinned to a specific _builtin_ version. Mounts previously pinned to a specific builtin version will now automatically upgrade to the latest builtin version, and may now be overridden if an unversioned plugin of the same name and type is registered. Mounts using plugin versions without `builtin` in their metadata remain unaffected. [[GH-18051](https://github.com/hashicorp/vault/pull/18051)]
+
+IMPROVEMENTS:
+
+* secrets/pki: Allow issuer creation, import to change default issuer via `default_follows_latest_issuer`. [[GH-17824](https://github.com/hashicorp/vault/pull/17824)]
+* storage/raft: Add `retry_join_as_non_voter` config option. [[GH-18030](https://github.com/hashicorp/vault/pull/18030)]
+
+BUG FIXES:
+
+* auth/okta: fix a panic for AuthRenew in Okta [[GH-18011](https://github.com/hashicorp/vault/pull/18011)]
+* auth: Deduplicate policies prior to ACL generation [[GH-17914](https://github.com/hashicorp/vault/pull/17914)]
+* cli: Fix issue preventing kv commands from executing properly when the mount path provided by `-mount` flag and secret key path are the same. [[GH-17679](https://github.com/hashicorp/vault/pull/17679)]
+* core (enterprise): Supported storage check in `vault server` command will no longer prevent startup. Instead, a warning will be logged if configured to use storage backend other than `raft` or `consul`.
+* core/quotas (enterprise): Fix a lock contention issue that could occur and cause Vault to become unresponsive when creating, changing, or deleting lease count quotas.
+* core: Fix potential deadlock if barrier ciphertext is less than 4 bytes. [[GH-17944](https://github.com/hashicorp/vault/pull/17944)]
+* core: fix a start up race condition where performance standbys could go into a
+  mount loop if default policies are not yet synced from the active node. [[GH-17801](https://github.com/hashicorp/vault/pull/17801)]
+* plugins: Only report deprecation status for builtin plugins. [[GH-17816](https://github.com/hashicorp/vault/pull/17816)]
+* plugins: Vault upgrades will no longer fail if a mount has been created using an explicit builtin plugin version. [[GH-18051](https://github.com/hashicorp/vault/pull/18051)]
+* secret/pki: fix bug with initial legacy bundle migration (from < 1.11 into 1.11+) and missing issuers from ca_chain [[GH-17772](https://github.com/hashicorp/vault/pull/17772)]
+* secrets/azure: add WAL to clean up role assignments if errors occur [[GH-18086](https://github.com/hashicorp/vault/pull/18086)]
+* secrets/gcp: Fixes duplicate service account key for rotate root on standby or secondary [[GH-18111](https://github.com/hashicorp/vault/pull/18111)]
+* secrets/pki: Fix upgrade of missing expiry, delta_rebuild_interval by setting them to the default. [[GH-17693](https://github.com/hashicorp/vault/pull/17693)]
+* ui: Fixes issue with not being able to download raft snapshot via service worker [[GH-17769](https://github.com/hashicorp/vault/pull/17769)]
+* ui: fix entity policies list link to policy show page [[GH-17950](https://github.com/hashicorp/vault/pull/17950)]
+
+## 1.12.1
+### November 2, 2022
+
+IMPROVEMENTS:
+
+* api: Support VAULT_DISABLE_REDIRECTS environment variable (and --disable-redirects flag) to disable default client behavior and prevent the client following any redirection responses. [[GH-17352](https://github.com/hashicorp/vault/pull/17352)]
+* database/snowflake: Allow parallel requests to Snowflake [[GH-17593](https://github.com/hashicorp/vault/pull/17593)]
+* plugins: Add plugin version information to key plugin lifecycle log lines. [[GH-17430](https://github.com/hashicorp/vault/pull/17430)]
+* sdk/ldap: Added support for paging when searching for groups using group filters [[GH-17640](https://github.com/hashicorp/vault/pull/17640)]
+
+BUG FIXES:
+
+* cli: Remove empty table heading for `vault secrets list -detailed` output. [[GH-17577](https://github.com/hashicorp/vault/pull/17577)]
+* core/managed-keys (enterprise): Return better error messages when encountering key creation failures
+* core/managed-keys (enterprise): Switch to using hash length as PSS Salt length within the test/sign api for better PKCS#11 compatibility
+* core: Fix panic caused in Vault Agent when rendering certificate templates [[GH-17419](https://github.com/hashicorp/vault/pull/17419)]
+* core: Fixes spurious warnings being emitted relating to "unknown or unsupported fields" for JSON config [[GH-17660](https://github.com/hashicorp/vault/pull/17660)]
+* core: prevent memory leak when using control group factors in a policy [[GH-17532](https://github.com/hashicorp/vault/pull/17532)]
+* core: prevent panic during mfa after enforcement's namespace is deleted [[GH-17562](https://github.com/hashicorp/vault/pull/17562)]
+* kmip (enterprise): Fix a problem in the handling of attributes that caused Import operations to fail.
+* kmip (enterprise): Fix selection of Cryptographic Parameters for Encrypt/Decrypt operations.
+* login: Store token in tokenhelper for interactive login MFA [[GH-17040](https://github.com/hashicorp/vault/pull/17040)]
+* secrets/pki: Respond to tidy-status, tidy-cancel on PR Secondary clusters. [[GH-17497](https://github.com/hashicorp/vault/pull/17497)]
+* ui: Fixes oidc/jwt login issue with alternate mount path and jwt login via mount path tab [[GH-17661](https://github.com/hashicorp/vault/pull/17661)]
+
+## 1.12.0
+### October 13, 2022
+
+SECURITY:
+
+* secrets/pki: Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s CA into memory on startup, resulting in the revocation list not being checked, if the CRL has not yet been retrieved. This vulnerability, CVE-2022-41316, is fixed in Vault 1.12.0, 1.11.4, 1.10.7, and 1.9.10. [[HSEC-2022-24](https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483)]
+
+CHANGES:
+
+* api: Exclusively use `GET /sys/plugins/catalog` endpoint for listing plugins, and add `details` field to list responses. [[GH-17347](https://github.com/hashicorp/vault/pull/17347)]
+* auth: `GET /sys/auth/:name` endpoint now returns an additional `deprecation_status` field in the response data for builtins. [[GH-16849](https://github.com/hashicorp/vault/pull/16849)]
+* auth: `GET /sys/auth` endpoint now returns an additional `deprecation_status` field in the response data for builtins. [[GH-16849](https://github.com/hashicorp/vault/pull/16849)]
+* auth: `POST /sys/auth/:type` endpoint response contains a warning for `Deprecated` auth methods. [[GH-17058](https://github.com/hashicorp/vault/pull/17058)]
+* auth: `auth enable` returns an error and `POST /sys/auth/:type` endpoint reports an error for `Pending Removal` auth methods. [[GH-17005](https://github.com/hashicorp/vault/pull/17005)]
+* core/entities: Fixed stranding of aliases upon entity merge, and require explicit selection of which aliases should be kept when some must be deleted [[GH-16539](https://github.com/hashicorp/vault/pull/16539)]
+* core: Bump Go version to 1.19.2.
+* core: Validate input parameters for vault operator init command. Vault 1.12 CLI version is needed to run operator init now. [[GH-16379](https://github.com/hashicorp/vault/pull/16379)]
+* identity: a request to `/identity/group` that includes `member_group_ids` that contains a cycle will now be responded to with a 400 rather than 500 [[GH-15912](https://github.com/hashicorp/vault/pull/15912)]
+* licensing (enterprise): Terminated licenses will no longer result in shutdown. Instead, upgrades will not be allowed if the license expiration time is before the build date of the binary.
+* plugins: Add plugin version to auth register, list, and mount table [[GH-16856](https://github.com/hashicorp/vault/pull/16856)]
+* plugins: `GET /sys/plugins/catalog/:type/:name` endpoint contains deprecation status for builtin plugins. [[GH-17077](https://github.com/hashicorp/vault/pull/17077)]
+* plugins: `GET /sys/plugins/catalog/:type/:name` endpoint now returns an additional `version` field in the response data. [[GH-16688](https://github.com/hashicorp/vault/pull/16688)]
+* plugins: `GET /sys/plugins/catalog/` endpoint contains deprecation status in `detailed` list. [[GH-17077](https://github.com/hashicorp/vault/pull/17077)]
+* plugins: `GET /sys/plugins/catalog` endpoint now returns an additional `detailed` field in the response data with a list of additional plugin metadata. [[GH-16688](https://github.com/hashicorp/vault/pull/16688)]
+* plugins: `plugin info` displays deprecation status for builtin plugins. [[GH-17077](https://github.com/hashicorp/vault/pull/17077)]
+* plugins: `plugin list` now accepts a `-detailed` flag, which display deprecation status and version info. [[GH-17077](https://github.com/hashicorp/vault/pull/17077)]
+* secrets/azure: Removed deprecated AAD graph API support from the secrets engine. [[GH-17180](https://github.com/hashicorp/vault/pull/17180)]
+* secrets: All database-specific (standalone DB) secrets engines are now marked `Pending Removal`. [[GH-17038](https://github.com/hashicorp/vault/pull/17038)]
+* secrets: `GET /sys/mounts/:name` endpoint now returns an additional `deprecation_status` field in the response data for builtins. [[GH-16849](https://github.com/hashicorp/vault/pull/16849)]
+* secrets: `GET /sys/mounts` endpoint now returns an additional `deprecation_status` field in the response data for builtins. [[GH-16849](https://github.com/hashicorp/vault/pull/16849)]
+* secrets: `POST /sys/mounts/:type` endpoint response contains a warning for `Deprecated` secrets engines. [[GH-17058](https://github.com/hashicorp/vault/pull/17058)]
+* secrets: `secrets enable` returns an error and `POST /sys/mount/:type` endpoint reports an error for `Pending Removal` secrets engines. [[GH-17005](https://github.com/hashicorp/vault/pull/17005)]
+
+FEATURES:
+
+* **GCP Cloud KMS support for managed keys**: Managed keys now support using GCP Cloud KMS keys
+* **LDAP Secrets Engine**: Adds the `ldap` secrets engine with service account check-out functionality for all supported schemas. [[GH-17152](https://github.com/hashicorp/vault/pull/17152)]
+* **OCSP Responder**: PKI mounts now have an OCSP responder that implements a subset of RFC6960, answering single serial number OCSP requests for a specific cluster's revoked certificates in a mount. [[GH-16723](https://github.com/hashicorp/vault/pull/16723)]
+* **Redis DB Engine**: Adding the new Redis database engine that supports the generation of static and dynamic user roles and root credential rotation on a stand alone Redis server. [[GH-17070](https://github.com/hashicorp/vault/pull/17070)]
+* **Redis ElastiCache DB Plugin**: Added Redis ElastiCache as a built-in plugin. [[GH-17075](https://github.com/hashicorp/vault/pull/17075)]
+* **Secrets/auth plugin multiplexing**: manage multiple plugin configurations with a single plugin process [[GH-14946](https://github.com/hashicorp/vault/pull/14946)]
+* **Transform Key Import (BYOK)**: The transform secrets engine now supports importing keys for tokenization and FPE transformations
+* HCP (enterprise): Adding foundational support for self-managed vault nodes to securely communicate with [HashiCorp Cloud Platform](https://cloud.hashicorp.com) as an opt-in feature
+* ui: UI support for Okta Number Challenge. [[GH-15998](https://github.com/hashicorp/vault/pull/15998)]
+* **Plugin Versioning**: Vault supports registering, managing, and running plugins with semantic versions specified.
+
+IMPROVEMENTS:
+
+* core/managed-keys (enterprise): Allow operators to specify PSS signatures and/or hash algorithm for the test/sign api
+* activity (enterprise): Added new clients unit tests to test accuracy of estimates
+* agent/auto-auth: Add `exit_on_err` which when set to true, will cause Agent to exit if any errors are encountered during authentication. [[GH-17091](https://github.com/hashicorp/vault/pull/17091)]
+* agent: Added `disable_idle_connections` configuration to disable leaving idle connections open in auto-auth, caching and templating. [[GH-15986](https://github.com/hashicorp/vault/pull/15986)]
+* agent: Added `disable_keep_alives` configuration to disable keep alives in auto-auth, caching and templating. [[GH-16479](https://github.com/hashicorp/vault/pull/16479)]
+* agent: JWT auto auth now supports a `remove_jwt_after_reading` config option which defaults to true. [[GH-11969](https://github.com/hashicorp/vault/pull/11969)]
+* agent: Send notifications to systemd on start and stop. [[GH-9802](https://github.com/hashicorp/vault/pull/9802)]
+* api/mfa: Add namespace path to the MFA read/list endpoint [[GH-16911](https://github.com/hashicorp/vault/pull/16911)]
+* api: Add a sentinel error for missing KV secrets [[GH-16699](https://github.com/hashicorp/vault/pull/16699)]
+* auth/alicloud: Enables AliCloud roles to be compatible with Vault's role based quotas. [[GH-17251](https://github.com/hashicorp/vault/pull/17251)]
+* auth/approle: SecretIDs can now be generated with an per-request specified TTL and num_uses.
+When either the ttl and num_uses fields are not specified, the role's configuration is used. [[GH-14474](https://github.com/hashicorp/vault/pull/14474)]
+* auth/aws: PKCS7 signatures will now use SHA256 by default in prep for Go 1.18 [[GH-16455](https://github.com/hashicorp/vault/pull/16455)]
+* auth/azure: Enables Azure roles to be compatible with Vault's role based quotas. [[GH-17194](https://github.com/hashicorp/vault/pull/17194)]
+* auth/cert: Add metadata to identity-alias [[GH-14751](https://github.com/hashicorp/vault/pull/14751)]
+* auth/cert: Operators can now specify a CRL distribution point URL, in which case the cert auth engine will fetch and use the CRL from that location rather than needing to push CRLs directly to auth/cert. [[GH-17136](https://github.com/hashicorp/vault/pull/17136)]
+* auth/cf: Enables CF roles to be compatible with Vault's role based quotas. [[GH-17196](https://github.com/hashicorp/vault/pull/17196)]
+* auth/gcp: Add support for GCE regional instance groups [[GH-16435](https://github.com/hashicorp/vault/pull/16435)]
+* auth/gcp: Updates dependencies: `google.golang.org/api@v0.83.0`, `github.com/hashicorp/go-gcp-common@v0.8.0`. [[GH-17160](https://github.com/hashicorp/vault/pull/17160)]
+* auth/jwt: Adds support for Microsoft US Gov L4 to the Azure provider for groups fetching. [[GH-16525](https://github.com/hashicorp/vault/pull/16525)]
+* auth/jwt: Improves detection of Windows Subsystem for Linux (WSL) for CLI-based logins. [[GH-16525](https://github.com/hashicorp/vault/pull/16525)]
+* auth/kerberos: add `add_group_aliases` config to include LDAP groups in Vault group aliases [[GH-16890](https://github.com/hashicorp/vault/pull/16890)]
+* auth/kerberos: add `remove_instance_name` parameter to the login CLI and the Kerberos config in Vault. This removes any instance names found in the keytab service principal name. [[GH-16594](https://github.com/hashicorp/vault/pull/16594)]
+* auth/kubernetes: Role resolution for K8S Auth [[GH-156](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/156)] [[GH-17161](https://github.com/hashicorp/vault/pull/17161)]
+* auth/oci: Add support for role resolution. [[GH-17212](https://github.com/hashicorp/vault/pull/17212)]
+* auth/oidc: Adds support for group membership parsing when using SecureAuth as an OIDC provider. [[GH-16274](https://github.com/hashicorp/vault/pull/16274)]
+* cli: CLI commands will print a warning if flags will be ignored because they are passed after positional arguments. [[GH-16441](https://github.com/hashicorp/vault/pull/16441)]
+* cli: `auth` and `secrets` list `-detailed` commands now show Deprecation Status for builtin plugins. [[GH-16849](https://github.com/hashicorp/vault/pull/16849)]
+* cli: `vault plugin list` now has a `details` field in JSON format, and version and type information in table format. [[GH-17347](https://github.com/hashicorp/vault/pull/17347)]
+* command/audit: Improve missing type error message [[GH-16409](https://github.com/hashicorp/vault/pull/16409)]
+* command/server: add `-dev-tls` and `-dev-tls-cert-dir` subcommands to create a Vault dev server with generated certificates and private key. [[GH-16421](https://github.com/hashicorp/vault/pull/16421)]
+* command: Fix shell completion for KV v2 mounts [[GH-16553](https://github.com/hashicorp/vault/pull/16553)]
+* core (enterprise): Add HTTP PATCH support for namespaces with an associated `namespace patch` CLI command
+* core (enterprise): Add check to `vault server` command to ensure configured storage backend is supported.
+* core (enterprise): Add custom metadata support for namespaces
+* core/activity: generate hyperloglogs containing clientIds for each month during precomputation [[GH-16146](https://github.com/hashicorp/vault/pull/16146)]
+* core/activity: refactor activity log api to reuse partial api functions in activity endpoint when current month is specified [[GH-16162](https://github.com/hashicorp/vault/pull/16162)]
+* core/activity: use monthly hyperloglogs to calculate new clients approximation for current month [[GH-16184](https://github.com/hashicorp/vault/pull/16184)]
+* core/quotas (enterprise): Added ability to add path suffixes for lease-count resource quotas
+* core/quotas (enterprise): Added ability to add role information for lease-count resource quotas, to limit login requests on auth mounts made using that role
+* core/quotas: Added ability to add path suffixes for rate-limit resource quotas [[GH-15989](https://github.com/hashicorp/vault/pull/15989)]
+* core/quotas: Added ability to add role information for rate-limit resource quotas, to limit login requests on auth mounts made using that role [[GH-16115](https://github.com/hashicorp/vault/pull/16115)]
+* core: Activity log goroutine management improvements to allow tests to be more deterministic. [[GH-17028](https://github.com/hashicorp/vault/pull/17028)]
+* core: Add `sys/loggers` and `sys/loggers/:name` endpoints to provide ability to modify logging verbosity [[GH-16111](https://github.com/hashicorp/vault/pull/16111)]
+* core: Handle and log deprecated builtin mounts. Introduces `VAULT_ALLOW_PENDING_REMOVAL_MOUNTS` to override shutdown and error when attempting to mount `Pending Removal` builtin plugins. [[GH-17005](https://github.com/hashicorp/vault/pull/17005)]
+* core: Limit activity log client count usage by namespaces [[GH-16000](https://github.com/hashicorp/vault/pull/16000)]
+* core: Upgrade github.com/hashicorp/raft [[GH-16609](https://github.com/hashicorp/vault/pull/16609)]
+* core: remove gox [[GH-16353](https://github.com/hashicorp/vault/pull/16353)]
+* docs: Clarify the behaviour of local mounts in the context of DR replication [[GH-16218](https://github.com/hashicorp/vault/pull/16218)]
+* identity/oidc: Adds support for detailed listing of clients and providers. [[GH-16567](https://github.com/hashicorp/vault/pull/16567)]
+* identity/oidc: Adds the `client_secret_post` token endpoint authentication method. [[GH-16598](https://github.com/hashicorp/vault/pull/16598)]
+* identity/oidc: allows filtering the list providers response by an allowed_client_id [[GH-16181](https://github.com/hashicorp/vault/pull/16181)]
+* identity: Prevent possibility of data races on entity creation. [[GH-16487](https://github.com/hashicorp/vault/pull/16487)]
+* physical/postgresql: pass context to queries to propagate timeouts and cancellations on requests. [[GH-15866](https://github.com/hashicorp/vault/pull/15866)]
+* plugins/multiplexing: Added multiplexing support to database plugins if run as external plugins [[GH-16995](https://github.com/hashicorp/vault/pull/16995)]
+* plugins: Add Deprecation Status method to builtinregistry. [[GH-16846](https://github.com/hashicorp/vault/pull/16846)]
+* plugins: Added environment variable flag to opt-out specific plugins from multiplexing [[GH-16972](https://github.com/hashicorp/vault/pull/16972)]
+* plugins: Adding version to plugin GRPC interface [[GH-17088](https://github.com/hashicorp/vault/pull/17088)]
+* plugins: Plugin catalog supports registering and managing plugins with semantic version information. [[GH-16688](https://github.com/hashicorp/vault/pull/16688)]
+* replication (enterprise): Fix race in merkle sync that can prevent streaming by returning key value matching provided hash if found in log shipper buffer.
+* secret/nomad: allow reading CA and client auth certificate from /nomad/config/access [[GH-15809](https://github.com/hashicorp/vault/pull/15809)]
+* secret/pki: Add RSA PSS signature support for issuing certificates, signing CRLs [[GH-16519](https://github.com/hashicorp/vault/pull/16519)]
+* secret/pki: Add signature_bits to sign-intermediate, sign-verbatim endpoints [[GH-16124](https://github.com/hashicorp/vault/pull/16124)]
+* secret/pki: Allow issuing certificates with non-domain, non-email Common Names from roles, sign-verbatim, and as issuers (`cn_validations`). [[GH-15996](https://github.com/hashicorp/vault/pull/15996)]
+* secret/pki: Allow specifying SKID for cross-signed issuance from older Vault versions. [[GH-16494](https://github.com/hashicorp/vault/pull/16494)]
+* secret/transit: Allow importing Ed25519 keys from PKCS#8 with inner RFC 5915 ECPrivateKey blobs (NSS-wrapped keys). [[GH-15742](https://github.com/hashicorp/vault/pull/15742)]
+* secrets/ad: set config default length only if password_policy is missing [[GH-16140](https://github.com/hashicorp/vault/pull/16140)]
+* secrets/azure: Adds option to permanently delete AzureAD objects created by Vault. [[GH-17045](https://github.com/hashicorp/vault/pull/17045)]
+* secrets/database/hana: Add ability to customize dynamic usernames [[GH-16631](https://github.com/hashicorp/vault/pull/16631)]
+* secrets/database/snowflake: Add multiplexing support [[GH-17159](https://github.com/hashicorp/vault/pull/17159)]
+* secrets/gcp: Updates dependencies: `google.golang.org/api@v0.83.0`, `github.com/hashicorp/go-gcp-common@v0.8.0`. [[GH-17174](https://github.com/hashicorp/vault/pull/17174)]
+* secrets/gcpkms: Update dependencies: google.golang.org/api@v0.83.0. [[GH-17199](https://github.com/hashicorp/vault/pull/17199)]
+* secrets/kubernetes: upgrade to v0.2.0 [[GH-17164](https://github.com/hashicorp/vault/pull/17164)]
+* secrets/pki/tidy: Add another pair of metrics counting certificates not deleted by the tidy operation. [[GH-16702](https://github.com/hashicorp/vault/pull/16702)]
+* secrets/pki: Add a new flag to issue/sign APIs which can filter out root CAs from the returned ca_chain field [[GH-16935](https://github.com/hashicorp/vault/pull/16935)]
+* secrets/pki: Add a warning to any successful response when the requested TTL is overwritten by MaxTTL [[GH-17073](https://github.com/hashicorp/vault/pull/17073)]
+* secrets/pki: Add ability to cancel tidy operations, control tidy resource usage. [[GH-16958](https://github.com/hashicorp/vault/pull/16958)]
+* secrets/pki: Add ability to periodically rebuild CRL before expiry [[GH-16762](https://github.com/hashicorp/vault/pull/16762)]
+* secrets/pki: Add ability to periodically run tidy operations to remove expired certificates. [[GH-16900](https://github.com/hashicorp/vault/pull/16900)]
+* secrets/pki: Add support for per-issuer Authority Information Access (AIA) URLs [[GH-16563](https://github.com/hashicorp/vault/pull/16563)]
+* secrets/pki: Add support to specify signature bits when generating CSRs through intermediate/generate apis [[GH-17388](https://github.com/hashicorp/vault/pull/17388)]
+* secrets/pki: Added gauge metrics "secrets.pki.total_revoked_certificates_stored" and "secrets.pki.total_certificates_stored" to track the number of certificates in storage. [[GH-16676](https://github.com/hashicorp/vault/pull/16676)]
+* secrets/pki: Allow revocation of certificates with explicitly provided certificate (bring your own certificate / BYOC). [[GH-16564](https://github.com/hashicorp/vault/pull/16564)]
+* secrets/pki: Allow revocation via proving possession of certificate's private key [[GH-16566](https://github.com/hashicorp/vault/pull/16566)]
+* secrets/pki: Allow tidy to associate revoked certs with their issuers for OCSP performance [[GH-16871](https://github.com/hashicorp/vault/pull/16871)]
+* secrets/pki: Honor If-Modified-Since header on CA, CRL fetch; requires passthrough_request_headers modification on the mount point. [[GH-16249](https://github.com/hashicorp/vault/pull/16249)]
+* secrets/pki: Improve stability of association of revoked cert with its parent issuer; when an issuer loses crl-signing usage, do not place certs on default issuer's CRL. [[GH-16874](https://github.com/hashicorp/vault/pull/16874)]
+* secrets/pki: Support generating delta CRLs for up-to-date CRLs when auto-building is enabled. [[GH-16773](https://github.com/hashicorp/vault/pull/16773)]
+* secrets/ssh: Add allowed_domains_template to allow templating of allowed_domains. [[GH-16056](https://github.com/hashicorp/vault/pull/16056)]
+* secrets/ssh: Allow additional text along with a template definition in defaultExtension value fields. [[GH-16018](https://github.com/hashicorp/vault/pull/16018)]
+* secrets/ssh: Allow the use of Identity templates in the `default_user` field [[GH-16351](https://github.com/hashicorp/vault/pull/16351)]
+* secrets/transit: Add a dedicated HMAC key type, which can be used with key import. [[GH-16668](https://github.com/hashicorp/vault/pull/16668)]
+* secrets/transit: Added a parameter to encrypt/decrypt batch operations to allow the caller to override the HTTP response code in case of partial user-input failures. [[GH-17118](https://github.com/hashicorp/vault/pull/17118)]
+* secrets/transit: Allow configuring the possible salt lengths for RSA PSS signatures. [[GH-16549](https://github.com/hashicorp/vault/pull/16549)]
+* ssh: Addition of an endpoint `ssh/issue/:role` to allow the creation of signed key pairs [[GH-15561](https://github.com/hashicorp/vault/pull/15561)]
+* storage/cassandra: tuning parameters for clustered environments `connection_timeout`, `initial_connection_timeout`, `simple_retry_policy_retries`. [[GH-10467](https://github.com/hashicorp/vault/pull/10467)]
+* storage/gcs: Add documentation explaining how to configure the gcs backend using environment variables instead of options in the configuration stanza [[GH-14455](https://github.com/hashicorp/vault/pull/14455)]
+* ui: Changed the tokenBoundCidrs tooltip content to clarify that comma separated values are not accepted in this field. [[GH-15852](https://github.com/hashicorp/vault/pull/15852)]
+* ui: Prevents requests to /sys/internal/ui/resultant-acl endpoint when unauthenticated [[GH-17139](https://github.com/hashicorp/vault/pull/17139)]
+* ui: Removed deprecated version of core-js 2.6.11 [[GH-15898](https://github.com/hashicorp/vault/pull/15898)]
+* ui: Renamed labels under Tools for wrap, lookup, rewrap and unwrap with description. [[GH-16489](https://github.com/hashicorp/vault/pull/16489)]
+* ui: Replaces non-inclusive terms [[GH-17116](https://github.com/hashicorp/vault/pull/17116)]
+* ui: redirect_to param forwards from auth route when authenticated [[GH-16821](https://github.com/hashicorp/vault/pull/16821)]
+* website/docs: API generate-recovery-token documentation. [[GH-16213](https://github.com/hashicorp/vault/pull/16213)]
+* website/docs: Add documentation around the expensiveness of making lots of lease count quotas in a short period [[GH-16950](https://github.com/hashicorp/vault/pull/16950)]
+* website/docs: Removes mentions of unauthenticated from internal ui resultant-acl doc [[GH-17139](https://github.com/hashicorp/vault/pull/17139)]
+* website/docs: Update replication docs to mention Integrated Storage [[GH-16063](https://github.com/hashicorp/vault/pull/16063)]
+* website/docs: changed to echo for all string examples instead of (<<<) here-string. [[GH-9081](https://github.com/hashicorp/vault/pull/9081)]
+
+BUG FIXES:
+
+* agent/template: Fix parsing error for the exec stanza [[GH-16231](https://github.com/hashicorp/vault/pull/16231)]
+* agent: Agent will now respect `max_retries` retry configuration even when caching is set. [[GH-16970](https://github.com/hashicorp/vault/pull/16970)]
+* agent: Update consul-template for pkiCert bug fixes [[GH-16087](https://github.com/hashicorp/vault/pull/16087)]
+* api/sys/internal/specs/openapi: support a new "dynamic" query parameter to generate generic mountpaths [[GH-15835](https://github.com/hashicorp/vault/pull/15835)]
+* api: Fixed erroneous warnings of unrecognized parameters when unwrapping data. [[GH-16794](https://github.com/hashicorp/vault/pull/16794)]
+* api: Fixed issue with internal/ui/mounts and internal/ui/mounts/(?P<path>.+) endpoints where it was not properly handling /auth/ [[GH-15552](https://github.com/hashicorp/vault/pull/15552)]
+* api: properly handle switching to/from unix domain socket when changing client address [[GH-11904](https://github.com/hashicorp/vault/pull/11904)]
+* auth/cert: Vault does not initially load the CRLs in cert auth unless the read/write CRL endpoint is hit. [[GH-17138](https://github.com/hashicorp/vault/pull/17138)]
+* auth/kerberos: Maintain headers set by the client [[GH-16636](https://github.com/hashicorp/vault/pull/16636)]
+* auth/kubernetes: Restore support for JWT signature algorithm ES384 [[GH-160](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/160)] [[GH-17161](https://github.com/hashicorp/vault/pull/17161)]
+* auth/token: Fix ignored parameter warnings for valid parameters on token create [[GH-16938](https://github.com/hashicorp/vault/pull/16938)]
+* command/debug: fix bug where monitor was not honoring configured duration [[GH-16834](https://github.com/hashicorp/vault/pull/16834)]
+* core (enterprise): Fix bug where wrapping token lookup does not work within namespaces. [[GH-15583](https://github.com/hashicorp/vault/pull/15583)]
+* core (enterprise): Fix creation of duplicate entities via alias metadata changes on local auth mounts.
+* core/auth: Return a 403 instead of a 500 for a malformed SSCT [[GH-16112](https://github.com/hashicorp/vault/pull/16112)]
+* core/identity: Replicate member_entity_ids and policies in identity/group across nodes identically [[GH-16088](https://github.com/hashicorp/vault/pull/16088)]
+* core/license (enterprise): Always remove stored license and allow unseal to complete when license cleanup fails
+* core/managed-keys (enterprise): fix panic when having `cache_disable` true
+* core/quotas (enterprise): Fixed issue with improper counting of leases if lease count quota created after leases
+* core/quotas: Added globbing functionality on the end of path suffix quota paths [[GH-16386](https://github.com/hashicorp/vault/pull/16386)]
+* core/quotas: Fix goroutine leak caused by the seal process not fully cleaning up Rate Limit Quotas. [[GH-17281](https://github.com/hashicorp/vault/pull/17281)]
+* core/replication (enterprise): Don't flush merkle tree pages to disk after losing active duty
+* core/seal: Fix possible keyring truncation when using the file backend. [[GH-15946](https://github.com/hashicorp/vault/pull/15946)]
+* core: Fix panic when the plugin catalog returns neither a plugin nor an error. [[GH-17204](https://github.com/hashicorp/vault/pull/17204)]
+* core: Fixes parsing boolean values for ha_storage backends in config [[GH-15900](https://github.com/hashicorp/vault/pull/15900)]
+* core: Increase the allowed concurrent gRPC streams over the cluster port. [[GH-16327](https://github.com/hashicorp/vault/pull/16327)]
+* core: Prevent two or more DR failovers from invalidating SSCT tokens generated on the previous primaries. [[GH-16956](https://github.com/hashicorp/vault/pull/16956)]
+* database: Invalidate queue should cancel context first to avoid deadlock [[GH-15933](https://github.com/hashicorp/vault/pull/15933)]
+* debug: Fix panic when capturing debug bundle on Windows [[GH-14399](https://github.com/hashicorp/vault/pull/14399)]
+* debug: Remove extra empty lines from vault.log when debug command is run [[GH-16714](https://github.com/hashicorp/vault/pull/16714)]
+* identity (enterprise): Fix a data race when creating an entity for a local alias.
+* identity/oidc: Adds `claims_supported` to discovery document. [[GH-16992](https://github.com/hashicorp/vault/pull/16992)]
+* identity/oidc: Change the `state` parameter of the Authorization Endpoint to optional. [[GH-16599](https://github.com/hashicorp/vault/pull/16599)]
+* identity/oidc: Detect invalid `redirect_uri` values sooner in validation of the Authorization Endpoint. [[GH-16601](https://github.com/hashicorp/vault/pull/16601)]
+* identity/oidc: Fixes validation of the `request` and `request_uri` parameters. [[GH-16600](https://github.com/hashicorp/vault/pull/16600)]
+* openapi: Fixed issue where information about /auth/token endpoints was not present with explicit policy permissions [[GH-15552](https://github.com/hashicorp/vault/pull/15552)]
+* plugin/multiplexing: Fix panic when id doesn't exist in connection map [[GH-16094](https://github.com/hashicorp/vault/pull/16094)]
+* plugin/secrets/auth: Fix a bug with aliased backends such as aws-ec2 or generic [[GH-16673](https://github.com/hashicorp/vault/pull/16673)]
+* plugins: Corrected the path to check permissions on when the registered plugin name does not match the plugin binary's filename. [[GH-17340](https://github.com/hashicorp/vault/pull/17340)]
+* quotas/lease-count: Fix lease-count quotas on mounts not properly being enforced when the lease generating request is a read [[GH-15735](https://github.com/hashicorp/vault/pull/15735)]
+* replication (enterprise): Fix data race in SaveCheckpoint()
+* replication (enterprise): Fix data race in saveCheckpoint.
+* replication (enterprise): Fix possible data race during merkle diff/sync
+* secret/pki: Do not fail validation with a legacy key_bits default value and key_type=any when signing CSRs [[GH-16246](https://github.com/hashicorp/vault/pull/16246)]
+* secrets/database: Fix a bug where the secret engine would queue up a lot of WAL deletes during startup. [[GH-16686](https://github.com/hashicorp/vault/pull/16686)]
+* secrets/gcp: Fixes duplicate static account key creation from performance secondary clusters. [[GH-16534](https://github.com/hashicorp/vault/pull/16534)]
+* secrets/kv: Fix `kv get` issue preventing the ability to read a secret when providing a leading slash [[GH-16443](https://github.com/hashicorp/vault/pull/16443)]
+* secrets/pki: Allow import of issuers without CRLSign KeyUsage; prohibit setting crl-signing usage on such issuers [[GH-16865](https://github.com/hashicorp/vault/pull/16865)]
+* secrets/pki: Do not ignore provided signature bits value when signing intermediate and leaf certificates with a managed key [[GH-17328](https://github.com/hashicorp/vault/pull/17328)]
+* secrets/pki: Do not read revoked certificates from backend when CRL is disabled [[GH-17385](https://github.com/hashicorp/vault/pull/17385)]
+* secrets/pki: Fix migration to properly handle mounts that contain only keys, no certificates [[GH-16813](https://github.com/hashicorp/vault/pull/16813)]
+* secrets/pki: Ignore EC PARAMETER PEM blocks during issuer import (/config/ca, /issuers/import/*, and /intermediate/set-signed) [[GH-16721](https://github.com/hashicorp/vault/pull/16721)]
+* secrets/pki: LIST issuers endpoint is now unauthenticated. [[GH-16830](https://github.com/hashicorp/vault/pull/16830)]
+* secrets/transform (enterprise): Fix an issue loading tokenization transform configuration after a specific sequence of reconfigurations.
+* secrets/transform (enterprise): Fix persistence problem with tokenization store credentials.
+* storage/raft (enterprise): Fix some storage-modifying RPCs used by perf standbys that weren't returning the resulting WAL state.
+* storage/raft (enterprise): Prevent unauthenticated voter status change with rejoin [[GH-16324](https://github.com/hashicorp/vault/pull/16324)]
+* storage/raft: Fix retry_join initialization failure [[GH-16550](https://github.com/hashicorp/vault/pull/16550)]
+* storage/raft: Nodes no longer get demoted to nonvoter if we don't know their version due to missing heartbeats. [[GH-17019](https://github.com/hashicorp/vault/pull/17019)]
+* ui/keymgmt: Sets the defaultValue for type when creating a key. [[GH-17407](https://github.com/hashicorp/vault/pull/17407)]
+* ui: Fix OIDC callback to accept namespace flag in different formats [[GH-16886](https://github.com/hashicorp/vault/pull/16886)]
+* ui: Fix info tooltip submitting form [[GH-16659](https://github.com/hashicorp/vault/pull/16659)]
+* ui: Fix issue logging in with JWT auth method [[GH-16466](https://github.com/hashicorp/vault/pull/16466)]
+* ui: Fix lease force revoke action [[GH-16930](https://github.com/hashicorp/vault/pull/16930)]
+* ui: Fix naming of permitted_dns_domains form parameter on CA creation (root generation and sign intermediate). [[GH-16739](https://github.com/hashicorp/vault/pull/16739)]
+* ui: Fixed bug where red spellcheck underline appears in sensitive/secret kv values when it should not appear [[GH-15681](https://github.com/hashicorp/vault/pull/15681)]
+* ui: Fixes secret version and status menu links transitioning to auth screen [[GH-16983](https://github.com/hashicorp/vault/pull/16983)]
+* ui: OIDC login type uses localStorage instead of sessionStorage [[GH-16170](https://github.com/hashicorp/vault/pull/16170)]
+* vault: Fix a bug where duplicate policies could be added to an identity group. [[GH-15638](https://github.com/hashicorp/vault/pull/15638)]
+
+## 1.11.12
+### June 21, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.19.10.
+* licensing (enterprise): Terminated licenses will no longer result in shutdown. Instead, upgrades
+will not be allowed if the license termination time is before the build date of the binary.
+
+FEATURES:
+
+* **Automated License Utilization Reporting**: Added automated license
+utilization reporting, which sends minimal product-license [metering
+data](https://developer.hashicorp.com/vault/docs/enterprise/license/utilization-reporting)
+to HashiCorp without requiring you to manually collect and report them.
+* core (enterprise): Add background worker for automatic reporting of billing
+information. [[GH-19625](https://github.com/hashicorp/vault/pull/19625)]
+
+IMPROVEMENTS:
+
+* api: GET ... /sys/internal/counters/activity?current_billing_period=true now
+results in a response which contains the full billing period [[GH-20694](https://github.com/hashicorp/vault/pull/20694)]
+* api: `/sys/internal/counters/config` endpoint now contains read-only
+`minimum_retention_months`. [[GH-20150](https://github.com/hashicorp/vault/pull/20150)]
+* api: `/sys/internal/counters/config` endpoint now contains read-only
+`reporting_enabled` and `billing_start_timestamp` fields. [[GH-20086](https://github.com/hashicorp/vault/pull/20086)]
+* core (enterprise): add configuration for license reporting [[GH-19891](https://github.com/hashicorp/vault/pull/19891)]
+* core (enterprise): license updates trigger a reload of reporting and the activity log [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
+* core (enterprise): support reloading configuration for automated reporting via SIGHUP [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
+* core (enterprise): vault server command now allows for opt-out of automated
+reporting via the `OPTOUT_LICENSE_REPORTING` environment variable. [[GH-3939](https://github.com/hashicorp/vault/pull/3939)]
+* core/activity: error when attempting to update retention configuration below the minimum [[GH-20078](https://github.com/hashicorp/vault/pull/20078)]
+* core/activity: generate hyperloglogs containing clientIds for each month during precomputation [[GH-16146](https://github.com/hashicorp/vault/pull/16146)]
+* core/activity: refactor activity log api to reuse partial api functions in activity endpoint when current month is specified [[GH-16162](https://github.com/hashicorp/vault/pull/16162)]
+* core/activity: refactor the activity log's generation of precomputed queries [[GH-20073](https://github.com/hashicorp/vault/pull/20073)]
+* core/activity: use monthly hyperloglogs to calculate new clients approximation for current month [[GH-16184](https://github.com/hashicorp/vault/pull/16184)]
+* core: Activity log goroutine management improvements to allow tests to be more deterministic. [[GH-17028](https://github.com/hashicorp/vault/pull/17028)]
+* core: Limit activity log client count usage by namespaces [[GH-16000](https://github.com/hashicorp/vault/pull/16000)]
+* storage/raft: add additional raft metrics relating to applied index and heartbeating; also ensure OSS standbys emit periodic metrics. [[GH-12166](https://github.com/hashicorp/vault/pull/12166)]
+* ui: updates clients configuration edit form state based on census reporting configuration [[GH-20125](https://github.com/hashicorp/vault/pull/20125)]
+
+BUG FIXES:
+
+* core/activity: add namespace breakdown for new clients when date range spans multiple months, including the current month. [[GH-18766](https://github.com/hashicorp/vault/pull/18766)]
+* core/activity: de-duplicate namespaces when historical and current month data are mixed [[GH-18452](https://github.com/hashicorp/vault/pull/18452)]
+* core/activity: fix the end_date returned from the activity log endpoint when partial counts are computed [[GH-17856](https://github.com/hashicorp/vault/pull/17856)]
+* core/activity: include mount counts when de-duplicating current and historical month data [[GH-18598](https://github.com/hashicorp/vault/pull/18598)]
+* core/activity: report mount paths (rather than mount accessors) in current month activity log counts and include deleted mount paths in precomputed queries. [[GH-18916](https://github.com/hashicorp/vault/pull/18916)]
+* core/activity: return partial month counts when querying a historical date range and no historical data exists. [[GH-17935](https://github.com/hashicorp/vault/pull/17935)]
+* core: Change where we evaluate filtered paths as part of mount operations; this is part of an enterprise bugfix that will
+have its own changelog entry. [[GH-21260](https://github.com/hashicorp/vault/pull/21260)]
+* core: Do not cache seal configuration to fix a bug that resulted in sporadic auto unseal failures. [[GH-21223](https://github.com/hashicorp/vault/pull/21223)]
+* core: Don't exit just because we think there's a potential deadlock. [[GH-21342](https://github.com/hashicorp/vault/pull/21342)]
+* core: Fix panic in sealed nodes using raft storage trying to emit raft metrics [[GH-21249](https://github.com/hashicorp/vault/pull/21249)]
+* identity: Fixes duplicate groups creation with the same name but unique IDs. [[GH-20964](https://github.com/hashicorp/vault/pull/20964)]
+* replication (enterprise): Fix a race condition with update-primary that could result in data loss after a DR failover
+* replication (enterprise): Fix path filters deleting data right after it's written by backend Initialize funcs
+
+## 1.11.11
+### June 08, 2023
+
+SECURITY:
+
+* ui: key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. [[HSEC-2023-17](https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814)]
+
+CHANGES:
+
+* core: Bump Go version to 1.19.9.
+* core: Revert #19676 (VAULT_GRPC_MIN_CONNECT_TIMEOUT env var) as we decided it was unnecessary. [[GH-20826](https://github.com/hashicorp/vault/pull/20826)]
+
+IMPROVEMENTS:
+
+* command/server: Add support for dumping pprof files to the filesystem via SIGUSR2 when
+`VAULT_PPROF_WRITE_TO_FILE=true` is set on the server. [[GH-20609](https://github.com/hashicorp/vault/pull/20609)]
+* secrets/pki: add subject key identifier to read key response [[GH-20642](https://github.com/hashicorp/vault/pull/20642)]
+* ui: update TTL picker for consistency [[GH-18114](https://github.com/hashicorp/vault/pull/18114)]
+
+BUG FIXES:
+
+* api: Properly Handle nil identity_policies in Secret Data [[GH-20636](https://github.com/hashicorp/vault/pull/20636)]
+* auth/ldap: Set default value for `max_page_size` properly [[GH-20453](https://github.com/hashicorp/vault/pull/20453)]
+* cli: CLI should take days as a unit of time for ttl like flags [[GH-20477](https://github.com/hashicorp/vault/pull/20477)]
+* core (enterprise): Fix log shipper buffer size overflow issue for 32 bit architecture.
+* core (enterprise): Fix logshipper buffer size to default to DefaultBufferSize only when reported system memory is zero.
+* core (enterprise): Remove MFA Enforcment configuration for namespace when deleting namespace
+* core: prevent panic on login after namespace is deleted that had mfa enforcement [[GH-20375](https://github.com/hashicorp/vault/pull/20375)]
+* replication (enterprise): Fix a race condition with invalid tokens during WAL streaming that was causing Secondary clusters to be unable to connect to a Primary.
+* replication (enterprise): fix bug where secondary grpc connections would timeout when connecting to a primary host that no longer exists.
+* secrets/transform (enterprise): Fix a caching bug affecting secondary nodes after a tokenization key rotation
+
+## 1.11.10
+### April 26, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.19.8.
+
+IMPROVEMENTS:
+
+* cli/namespace: Add detailed flag to output additional namespace information
+such as namespace IDs and custom metadata. [[GH-20243](https://github.com/hashicorp/vault/pull/20243)]
+* core/activity: add an endpoint to write test activity log data, guarded by a build flag [[GH-20019](https://github.com/hashicorp/vault/pull/20019)]
+* core: Add a `raft` sub-field to the `storage` and `ha_storage` details provided by the
+`/sys/config/state/sanitized` endpoint in order to include the `max_entry_size`. [[GH-20044](https://github.com/hashicorp/vault/pull/20044)]
+* sdk/ldaputil: added `connection_timeout` to tune connection timeout duration
+for all LDAP plugins. [[GH-20144](https://github.com/hashicorp/vault/pull/20144)]
+
+BUG FIXES:
+
+* auth/ldap: Add max_page_size configurable to LDAP configuration [[GH-19032](https://github.com/hashicorp/vault/pull/19032)]
+* core (enterprise): Fix intermittent issue with token entries sometimes not being found when using a newly created token in a request to a secondary, even when SSCT `new_token` forwarding is set. When this occurred, this would result in the following error to the client: `error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue`.
+* core (enterprise): Fix read on perf standbys failing with 412 after leadership change, unseal, restores or restarts when no writes occur
+* core/ssct (enterprise): Fixed race condition where a newly promoted DR may revert `sscGenCounter`
+resulting in 412 errors.
+* core: Fix regression breaking non-raft clusters whose nodes share the same cluster_addr/api_addr. [[GH-19721](https://github.com/hashicorp/vault/pull/19721)]
+* helper/random: Fix race condition in string generator helper [[GH-19875](https://github.com/hashicorp/vault/pull/19875)]
+* openapi: Fix many incorrect details in generated API spec, by using better techniques to parse path regexps [[GH-18554](https://github.com/hashicorp/vault/pull/18554)]
+* replication (enterprise): Fix replication status for Primary clusters showing its primary cluster's information (in case of DR) in secondaries field when known_secondaries field is nil
+* secrets/pki: Fix patching of leaf_not_after_behavior on issuers. [[GH-20341](https://github.com/hashicorp/vault/pull/20341)]
+* secrets/transform (enterprise): Address SQL connection leak when cleaning expired tokens
+* ui: Fix OIDC provider logo showing when domain doesn't match [[GH-20263](https://github.com/hashicorp/vault/pull/20263)]
+* ui: Fix bad link to namespace when namespace name includes `.` [[GH-19799](https://github.com/hashicorp/vault/pull/19799)]
+* ui: fixes browser console formatting for help command output [[GH-20064](https://github.com/hashicorp/vault/pull/20064)]
+* ui: remove use of htmlSafe except when first sanitized [[GH-20235](https://github.com/hashicorp/vault/pull/20235)]
+
+## 1.11.9
+### March 29, 2023
+
+SECURITY:
+
+* storage/mssql: When using Vault’s community-supported Microsoft SQL (MSSQL) database storage backend, a privileged attacker with the ability to write arbitrary data to Vault’s configuration may be able to perform arbitrary SQL commands on the underlying database server through Vault. This vulnerability, CVE-2023-0620, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-12](https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080)]
+* secrets/pki: Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. This vulnerability, CVE-2023-0665, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-11](https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079)]
+* core: HashiCorp Vault’s implementation of Shamir’s secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. This vulnerability, CVE-2023-25000, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-10](https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078)]
+
+IMPROVEMENTS:
+
+* auth/github: Allow for an optional Github auth token environment variable to make authenticated requests when fetching org id
+website/docs: Add docs for `VAULT_AUTH_CONFIG_GITHUB_TOKEN` environment variable when writing Github config [[GH-19244](https://github.com/hashicorp/vault/pull/19244)]
+* core: Allow overriding gRPC connect timeout via VAULT_GRPC_MIN_CONNECT_TIMEOUT. This is an env var rather than a config setting because we don't expect this to ever be needed.  It's being added as a last-ditch
+option in case all else fails for some replication issues we may not have fully reproduced. [[GH-19676](https://github.com/hashicorp/vault/pull/19676)]
+* core: validate name identifiers in mssql physical storage backend prior use [[GH-19591](https://github.com/hashicorp/vault/pull/19591)]
+
+BUG FIXES:
+
+* auth/kubernetes: Ensure a consistent TLS configuration for all k8s API requests [[#190](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/190)] [[GH-19720](https://github.com/hashicorp/vault/pull/19720)]
+* cli: Fix vault read handling to return raw data as secret.Data when there is no top-level data object from api response. [[GH-17913](https://github.com/hashicorp/vault/pull/17913)]
+* core (enterprise): Attempt to reconnect to a PKCS#11 HSM if we retrieve a CKR_FUNCTION_FAILED error.
+* core: Fixed issue with remounting mounts that have a non-trailing space in the 'to' or 'from' paths. [[GH-19585](https://github.com/hashicorp/vault/pull/19585)]
+* openapi: Fix logic for labeling unauthenticated/sudo paths. [[GH-19600](https://github.com/hashicorp/vault/pull/19600)]
+* secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
+* ui: fixes issue navigating back a level using the breadcrumb from secret metadata view [[GH-19703](https://github.com/hashicorp/vault/pull/19703)]
+* ui: pass encodeBase64 param to HMAC transit-key-actions. [[GH-19429](https://github.com/hashicorp/vault/pull/19429)]
+* ui: use URLSearchParams interface to capture namespace param from SSOs (ex. ADFS) with decoded state param in callback url [[GH-19460](https://github.com/hashicorp/vault/pull/19460)]
+
+## 1.11.8
+### March 01, 2023
+
+SECURITY:
+
+* auth/approle: When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999 has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above. [[HSEC-2023-07](https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305)]
+
+CHANGES:
+
+* core: Bump Go version to 1.19.6.
+
+IMPROVEMENTS:
+
+* secrets/database: Adds error message requiring password on root crednetial rotation. [[GH-19103](https://github.com/hashicorp/vault/pull/19103)]
+
+BUG FIXES:
+
+* auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [[GH-19186](https://github.com/hashicorp/vault/pull/19186)]
+* core (enterprise): Fix panic when using invalid accessor for control-group request
+* core (enterprise): Fix perf standby WAL streaming silently failures when replication setup happens at a bad time.
+* core: Prevent panics in `sys/leases/lookup`, `sys/leases/revoke`, and `sys/leases/renew` endpoints if provided `lease_id` is null [[GH-18951](https://github.com/hashicorp/vault/pull/18951)]
+* license (enterprise): Fix bug where license would update even if the license didn't change.
+* replication (enterprise): Fix bug where reloading external plugin on a secondary would
+break replication.
+* secrets/ad: Fix bug where config couldn't be updated unless binddn/bindpass were included in the update. [[GH-18208](https://github.com/hashicorp/vault/pull/18208)]
+* ui (enterprise): Fix cancel button from transform engine role creation page [[GH-19135](https://github.com/hashicorp/vault/pull/19135)]
+* ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [[GH-19071](https://github.com/hashicorp/vault/pull/19071)]
+* ui: show Get credentials button for static roles detail page when a user has the proper permissions. [[GH-19190](https://github.com/hashicorp/vault/pull/19190)]
+
+## 1.11.7
+### February 6, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.19.4.
+
+IMPROVEMENTS:
+
+* command/server: Environment variable keys are now logged at startup. [[GH-18125](https://github.com/hashicorp/vault/pull/18125)]
+* core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
+* secrets/db/mysql: Add `tls_server_name` and `tls_skip_verify` parameters [[GH-18799](https://github.com/hashicorp/vault/pull/18799)]
+* ui: Prepends "passcode=" if not provided in user input for duo totp mfa method authentication [[GH-18342](https://github.com/hashicorp/vault/pull/18342)]
+* ui: Update language on database role to "Connection name" [[GH-18261](https://github.com/hashicorp/vault/issues/18261)] [[GH-18350](https://github.com/hashicorp/vault/pull/18350)]
+
+BUG FIXES:
+
+* auth/approle: Fix `token_bound_cidrs` validation when using /32 blocks for role and secret ID [[GH-18145](https://github.com/hashicorp/vault/pull/18145)]
+* cli/kv: skip formatting of nil secrets for patch and put with field parameter set [[GH-18163](https://github.com/hashicorp/vault/pull/18163)]
+* core (enterprise): Fix a race condition resulting in login errors to PKCS#11 modules under high concurrency.
+* core/managed-keys (enterprise): Limit verification checks to mounts in a key's namespace
+* core/quotas (enterprise): Fix a potential deadlock that could occur when using lease count quotas.
+* core/quotas: Fix issue with improper application of default rate limit quota exempt paths [[GH-18273](https://github.com/hashicorp/vault/pull/18273)]
+* core: fix bug where context cancellations weren't forwarded to active node from performance standbys.
+* core: prevent panic in login mfa enforcement delete after enforcement's namespace is deleted [[GH-18923](https://github.com/hashicorp/vault/pull/18923)]
+* database/mongodb: Fix writeConcern set to be applied to any query made on the database [[GH-18546](https://github.com/hashicorp/vault/pull/18546)]
+* identity (enterprise): Fix a data race when creating an entity for a local alias.
+* kmip (enterprise): Fix Destroy operation response that omitted Unique Identifier on some batched responses.
+* kmip (enterprise): Fix Locate operation response incompatibility with clients using KMIP versions prior to 1.3.
+* kmip (enterprise): Fix Query operation response that omitted streaming capability and supported profiles.
+* licensing (enterprise): update autoloaded license cache after reload
+* secrets/pki: Allow patching issuer to set an empty issuer name. [[GH-18466](https://github.com/hashicorp/vault/pull/18466)]
+* secrets/transit: Do not warn about unrecognized parameter 'batch_input' [[GH-18299](https://github.com/hashicorp/vault/pull/18299)]
+* storage/raft (enterprise): An already joined node can rejoin by wiping storage
+and re-issueing a join request, but in doing so could transiently become a
+non-voter.  In some scenarios this resulted in loss of quorum. [[GH-18263](https://github.com/hashicorp/vault/pull/18263)]
+* storage/raft (enterprise): Fix some storage-modifying RPCs used by perf standbys that weren't returning the resulting WAL state.
+* storage/raft: Don't panic on unknown raft ops [[GH-17732](https://github.com/hashicorp/vault/pull/17732)]
+* ui: fixes query parameters not passed in api explorer test requests [[GH-18743](https://github.com/hashicorp/vault/pull/18743)]
+
+## 1.11.6
+### November 30, 2022
+
+IMPROVEMENTS:
+
+* secrets/pki: Allow issuer creation, import to change default issuer via `default_follows_latest_issuer`. [[GH-17824](https://github.com/hashicorp/vault/pull/17824)]
+
+BUG FIXES:
+
+* auth/okta: fix a panic for AuthRenew in Okta [[GH-18011](https://github.com/hashicorp/vault/pull/18011)]
+* auth: Deduplicate policies prior to ACL generation [[GH-17914](https://github.com/hashicorp/vault/pull/17914)]
+* cli: Fix issue preventing kv commands from executing properly when the mount path provided by `-mount` flag and secret key path are the same. [[GH-17679](https://github.com/hashicorp/vault/pull/17679)]
+* core/quotas (enterprise): Fix a lock contention issue that could occur and cause Vault to become unresponsive when creating, changing, or deleting lease count quotas.
+* core: Fix potential deadlock if barrier ciphertext is less than 4 bytes. [[GH-17944](https://github.com/hashicorp/vault/pull/17944)]
+* core: fix a start up race condition where performance standbys could go into a
+  mount loop if default policies are not yet synced from the active node. [[GH-17801](https://github.com/hashicorp/vault/pull/17801)]
+* secret/pki: fix bug with initial legacy bundle migration (from < 1.11 into 1.11+) and missing issuers from ca_chain [[GH-17772](https://github.com/hashicorp/vault/pull/17772)]
+* secrets/azure: add WAL to clean up role assignments if errors occur [[GH-18085](https://github.com/hashicorp/vault/pull/18085)]
+* secrets/gcp: Fixes duplicate service account key for rotate root on standby or secondary [[GH-18110](https://github.com/hashicorp/vault/pull/18110)]
+* ui: Fixes issue with not being able to download raft snapshot via service worker [[GH-17769](https://github.com/hashicorp/vault/pull/17769)]
+* ui: fix entity policies list link to policy show page [[GH-17950](https://github.com/hashicorp/vault/pull/17950)]
+
+## 1.11.5
+### November 2, 2022
+
+IMPROVEMENTS:
+
+* database/snowflake: Allow parallel requests to Snowflake [[GH-17594](https://github.com/hashicorp/vault/pull/17594)]
+* sdk/ldap: Added support for paging when searching for groups using group filters [[GH-17640](https://github.com/hashicorp/vault/pull/17640)]
+
+BUG FIXES:
+
+* core/managed-keys (enterprise): Return better error messages when encountering key creation failures
+* core/managed-keys (enterprise): fix panic when having `cache_disable` true
+* core: prevent memory leak when using control group factors in a policy [[GH-17532](https://github.com/hashicorp/vault/pull/17532)]
+* core: prevent panic during mfa after enforcement's namespace is deleted [[GH-17562](https://github.com/hashicorp/vault/pull/17562)]
+* kmip (enterprise): Fix a problem in the handling of attributes that caused Import operations to fail.
+* login: Store token in tokenhelper for interactive login MFA [[GH-17040](https://github.com/hashicorp/vault/pull/17040)]
+* secrets/pki: Do not ignore provided signature bits value when signing intermediate and leaf certificates with a managed key [[GH-17328](https://github.com/hashicorp/vault/pull/17328)]
+* secrets/pki: Do not read revoked certificates from backend when CRL is disabled [[GH-17384](https://github.com/hashicorp/vault/pull/17384)]
+* secrets/pki: Respond to tidy-status, tidy-cancel on PR Secondary clusters. [[GH-17497](https://github.com/hashicorp/vault/pull/17497)]
+* ui/keymgmt: Sets the defaultValue for type when creating a key. [[GH-17407](https://github.com/hashicorp/vault/pull/17407)]
+* ui: Fixes oidc/jwt login issue with alternate mount path and jwt login via mount path tab [[GH-17661](https://github.com/hashicorp/vault/pull/17661)]
+
+## 1.11.4
+### September 30, 2022
+
+SECURITY:
+
+* secrets/pki: Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s CA into memory on startup, resulting in the revocation list not being checked, if the CRL has not yet been retrieved. This vulnerability, CVE-2022-41316, is fixed in Vault 1.12.0, 1.11.4, 1.10.7, and 1.9.10. [[HSEC-2022-24](https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483)]
+
+IMPROVEMENTS:
+
+* agent/auto-auth: Add `exit_on_err` which when set to true, will cause Agent to exit if any errors are encountered during authentication. [[GH-17091](https://github.com/hashicorp/vault/pull/17091)]
+* agent: Send notifications to systemd on start and stop. [[GH-9802](https://github.com/hashicorp/vault/pull/9802)]
+
+BUG FIXES:
+
+* auth/cert: Vault does not initially load the CRLs in cert auth unless the read/write CRL endpoint is hit. [[GH-17138](https://github.com/hashicorp/vault/pull/17138)]
+* auth/kubernetes: Restore support for JWT signature algorithm ES384 [[GH-160](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/160)] [[GH-17162](https://github.com/hashicorp/vault/pull/17162)]
+* auth/token: Fix ignored parameter warnings for valid parameters on token create [[GH-16938](https://github.com/hashicorp/vault/pull/16938)]
+* core/quotas: Fix goroutine leak caused by the seal process not fully cleaning up Rate Limit Quotas. [[GH-17281](https://github.com/hashicorp/vault/pull/17281)]
+* core: Prevent two or more DR failovers from invalidating SSCT tokens generated on the previous primaries. [[GH-16956](https://github.com/hashicorp/vault/pull/16956)]
+* identity/oidc: Adds `claims_supported` to discovery document. [[GH-16992](https://github.com/hashicorp/vault/pull/16992)]
+* replication (enterprise): Fix data race in SaveCheckpoint()
+* secrets/transform (enterprise): Fix an issue loading tokenization transform configuration after a specific sequence of reconfigurations.
+* secrets/transform (enterprise): Fix persistence problem with tokenization store credentials.
+* ui: Fixes secret version and status menu links transitioning to auth screen [[GH-16983](https://github.com/hashicorp/vault/pull/16983)]
+* ui: Fixes secret version and status menu links transitioning to auth screen [[GH-16983](https://github.com/hashicorp/vault/pull/16983)]
+
+## 1.11.3
+### August 31, 2022
+
+SECURITY:
+
+* core: When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. This vulnerability, CVE-2022-40186, is fixed in 1.11.3, 1.10.6, and 1.9.9. [[HSEC-2022-18](https://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550)]
+
+CHANGES:
+
+* core: Bump Go version to 1.17.13.
+
+IMPROVEMENTS:
+
+* auth/kerberos: add `add_group_aliases` config to include LDAP groups in Vault group aliases [[GH-16890](https://github.com/hashicorp/vault/pull/16890)]
+* auth/kerberos: add `remove_instance_name` parameter to the login CLI and the
+Kerberos config in Vault. This removes any instance names found in the keytab
+service principal name. [[GH-16594](https://github.com/hashicorp/vault/pull/16594)]
+* identity/oidc: Adds the `client_secret_post` token endpoint authentication method. [[GH-16598](https://github.com/hashicorp/vault/pull/16598)]
+* storage/gcs: Add documentation explaining how to configure the gcs backend using environment variables instead of options in the configuration stanza [[GH-14455](https://github.com/hashicorp/vault/pull/14455)]
+
+BUG FIXES:
+
+* api: Fixed erroneous warnings of unrecognized parameters when unwrapping data. [[GH-16794](https://github.com/hashicorp/vault/pull/16794)]
+* auth/gcp: Fixes the ability to reset the configuration's credentials to use application default credentials. [[GH-16523](https://github.com/hashicorp/vault/pull/16523)]
+* auth/kerberos: Maintain headers set by the client [[GH-16636](https://github.com/hashicorp/vault/pull/16636)]
+* command/debug: fix bug where monitor was not honoring configured duration [[GH-16834](https://github.com/hashicorp/vault/pull/16834)]
+* core/license (enterprise): Always remove stored license and allow unseal to complete when license cleanup fails
+* database/elasticsearch: Fixes a bug in boolean parsing for initialize [[GH-16526](https://github.com/hashicorp/vault/pull/16526)]
+* identity/oidc: Change the `state` parameter of the Authorization Endpoint to optional. [[GH-16599](https://github.com/hashicorp/vault/pull/16599)]
+* identity/oidc: Detect invalid `redirect_uri` values sooner in validation of the
+Authorization Endpoint. [[GH-16601](https://github.com/hashicorp/vault/pull/16601)]
+* identity/oidc: Fixes validation of the `request` and `request_uri` parameters. [[GH-16600](https://github.com/hashicorp/vault/pull/16600)]
+* plugin/secrets/auth: Fix a bug with aliased backends such as aws-ec2 or generic [[GH-16673](https://github.com/hashicorp/vault/pull/16673)]
+* secrets/database: Fix a bug where the secret engine would queue up a lot of WAL deletes during startup. [[GH-16686](https://github.com/hashicorp/vault/pull/16686)]
+* secrets/gcp: Fixes duplicate static account key creation from performance secondary clusters. [[GH-16534](https://github.com/hashicorp/vault/pull/16534)]
+* secrets/pki: Fix migration to properly handle mounts that contain only keys, no certificates [[GH-16813](https://github.com/hashicorp/vault/pull/16813)]
+* secrets/pki: Ignore EC PARAMETER PEM blocks during issuer import (/config/ca, /issuers/import/*, and /intermediate/set-signed) [[GH-16721](https://github.com/hashicorp/vault/pull/16721)]
+* secrets/pki: LIST issuers endpoint is now unauthenticated. [[GH-16830](https://github.com/hashicorp/vault/pull/16830)]
+* storage/raft: Fix retry_join initialization failure [[GH-16550](https://github.com/hashicorp/vault/pull/16550)]
+* ui: Fix OIDC callback to accept namespace flag in different formats [[GH-16886](https://github.com/hashicorp/vault/pull/16886)]
+* ui: Fix info tooltip submitting form [[GH-16659](https://github.com/hashicorp/vault/pull/16659)]
+* ui: Fix naming of permitted_dns_domains form parameter on CA creation (root generation and sign intermediate). [[GH-16739](https://github.com/hashicorp/vault/pull/16739)]
+
+SECURITY:
+
+* identity/entity: When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. [[HCSEC-2022-18](https://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550)]
+
+## 1.11.2
+### August 2, 2022
+
+IMPROVEMENTS:
+
+* agent: Added `disable_keep_alives` configuration to disable keep alives in auto-auth, caching and templating. [[GH-16479](https://github.com/hashicorp/vault/pull/16479)]
+
+BUG FIXES:
+
+* core/auth: Return a 403 instead of a 500 for a malformed SSCT [[GH-16112](https://github.com/hashicorp/vault/pull/16112)]
+* core: Increase the allowed concurrent gRPC streams over the cluster port. [[GH-16327](https://github.com/hashicorp/vault/pull/16327)]
+* secrets/kv: Fix `kv get` issue preventing the ability to read a secret when providing a leading slash [[GH-16443](https://github.com/hashicorp/vault/pull/16443)]
+* ui: Fix issue logging in with JWT auth method [[GH-16466](https://github.com/hashicorp/vault/pull/16466)]
+
+## 1.11.1
+### July 21, 2022
+
+SECURITY:
+
+* storage/raft: Vault Enterprise (“Vault”) clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. This vulnerability, CVE-2022-36129, was fixed in Vault 1.9.8, 1.10.5, and 1.11.1. [[HSEC-2022-15](https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420)]
+
+CHANGES:
+
+* core: Bump Go version to 1.17.12.
+
+IMPROVEMENTS:
+
+* agent: Added `disable_idle_connections` configuration to disable leaving idle connections open in auto-auth, caching and templating. [[GH-15986](https://github.com/hashicorp/vault/pull/15986)]
+* core: Add `sys/loggers` and `sys/loggers/:name` endpoints to provide ability to modify logging verbosity [[GH-16111](https://github.com/hashicorp/vault/pull/16111)]
+* secrets/ssh: Allow additional text along with a template definition in defaultExtension value fields. [[GH-16018](https://github.com/hashicorp/vault/pull/16018)]
+
+BUG FIXES:
+
+* agent/template: Fix parsing error for the exec stanza [[GH-16231](https://github.com/hashicorp/vault/pull/16231)]
+* agent: Update consul-template for pkiCert bug fixes [[GH-16087](https://github.com/hashicorp/vault/pull/16087)]
+* core/identity: Replicate member_entity_ids and policies in identity/group across nodes identically [[GH-16088](https://github.com/hashicorp/vault/pull/16088)]
+* core/replication (enterprise): Don't flush merkle tree pages to disk after losing active duty
+* core/seal: Fix possible keyring truncation when using the file backend. [[GH-15946](https://github.com/hashicorp/vault/pull/15946)]
+* kmip (enterprise): Return SecretData as supported Object Type.
+* plugin/multiplexing: Fix panic when id doesn't exist in connection map [[GH-16094](https://github.com/hashicorp/vault/pull/16094)]
+* secret/pki: Do not fail validation with a legacy key_bits default value and key_type=any when signing CSRs [[GH-16246](https://github.com/hashicorp/vault/pull/16246)]
+* storage/raft (enterprise): Prevent unauthenticated voter status change with rejoin [[GH-16324](https://github.com/hashicorp/vault/pull/16324)]
+* transform (enterprise): Fix a bug in the handling of nested or unmatched capture groups in FPE transformations.
+* ui: OIDC login type uses localStorage instead of sessionStorage [[GH-16170](https://github.com/hashicorp/vault/pull/16170)]
+
+SECURITY:
+
+* storage/raft (enterprise): Vault Enterprise (“Vault”) clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. This vulnerability, CVE-2022-36129, was fixed in Vault 1.9.8, 1.10.5, and 1.11.1. [[HCSEC-2022-15](https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420)]
+
+## 1.11.0
+### June 20, 2022
+
+CHANGES:
+
+* auth/aws: Add RoleSession to DisplayName when using assumeRole for authentication [[GH-14954](https://github.com/hashicorp/vault/pull/14954)]
+* auth/kubernetes: If `kubernetes_ca_cert` is unset, and there is no pod-local CA available, an error will be surfaced when writing config instead of waiting for login. [[GH-15584](https://github.com/hashicorp/vault/pull/15584)]
+* auth: Remove support for legacy MFA
+(https://www.vaultproject.io/docs/v1.10.x/auth/mfa) [[GH-14869](https://github.com/hashicorp/vault/pull/14869)]
+* core/fips: Disable and warn about entropy augmentation in FIPS 140-2 Inside mode [[GH-15858](https://github.com/hashicorp/vault/pull/15858)]
+* core: A request that fails path validation due to relative path check will now be responded to with a 400 rather than 500. [[GH-14328](https://github.com/hashicorp/vault/pull/14328)]
+* core: Bump Go version to 1.17.11. [[GH-go-ver-1110](https://github.com/hashicorp/vault/pull/go-ver-1110)]
+* database & storage: Change underlying driver library from [lib/pq](https://github.com/lib/pq) to [pgx](https://github.com/jackc/pgx). This change affects Redshift & Postgres database secrets engines, and CockroachDB & Postgres storage engines [[GH-15343](https://github.com/hashicorp/vault/pull/15343)]
+* licensing (enterprise): Remove support for stored licenses and associated `sys/license` and `sys/license/signed`
+endpoints in favor of [autoloaded licenses](https://www.vaultproject.io/docs/enterprise/license/autoloading).
+* replication (enterprise): The `/sys/replication/performance/primary/mount-filter` endpoint has been removed. Please use [Paths Filter](https://www.vaultproject.io/api-docs/system/replication/replication-performance#create-paths-filter) instead.
+* secret/pki: Remove unused signature_bits parameter from intermediate CSR generation; this parameter doesn't control the final certificate's signature algorithm selection as that is up to the signing CA [[GH-15478](https://github.com/hashicorp/vault/pull/15478)]
+* secrets/kubernetes: Split `additional_metadata` into `extra_annotations` and `extra_labels` parameters [[GH-15655](https://github.com/hashicorp/vault/pull/15655)]
+* secrets/pki: A new aliased api path (/pki/issuer/:issuer_ref/sign-self-issued)
+providing the same functionality as the existing API(/pki/root/sign-self-issued)
+does not require sudo capabilities but the latter still requires it in an
+effort to maintain backwards compatibility. [[GH-15211](https://github.com/hashicorp/vault/pull/15211)]
+* secrets/pki: Err on unknown role during sign-verbatim. [[GH-15543](https://github.com/hashicorp/vault/pull/15543)]
+* secrets/pki: Existing CRL API (/pki/crl) now returns an X.509 v2 CRL instead
+of a v1 CRL. [[GH-15100](https://github.com/hashicorp/vault/pull/15100)]
+* secrets/pki: The `ca_chain` response field within issuing (/pki/issue/:role)
+and signing APIs will now include the root CA certificate if the mount is
+aware of it. [[GH-15155](https://github.com/hashicorp/vault/pull/15155)]
+* secrets/pki: existing Delete Root API (pki/root) will now delete all issuers
+and keys within the mount path. [[GH-15004](https://github.com/hashicorp/vault/pull/15004)]
+* secrets/pki: existing Generate Root (pki/root/generate/:type),
+Set Signed Intermediate (/pki/intermediate/set-signed) APIs will
+add new issuers/keys to a mount instead of warning that an existing CA exists [[GH-14975](https://github.com/hashicorp/vault/pull/14975)]
+* secrets/pki: the signed CA certificate from the sign-intermediate api will now appear within the ca_chain
+response field along with the issuer's ca chain. [[GH-15524](https://github.com/hashicorp/vault/pull/15524)]
+* ui: Upgrade Ember to version 3.28 [[GH-14763](https://github.com/hashicorp/vault/pull/14763)]
+
+FEATURES:
+
+* **Autopilot Improvements (Enterprise)**: Autopilot on Vault Enterprise now supports automated upgrades and redundancy zones when using integrated storage.
+* **KeyMgmt UI**: Add UI support for managing the Key Management Secrets Engine [[GH-15523](https://github.com/hashicorp/vault/pull/15523)]
+* **Kubernetes Secrets Engine**: This new secrets engine generates Kubernetes service account tokens, service accounts, role bindings, and roles dynamically. [[GH-15551](https://github.com/hashicorp/vault/pull/15551)]
+* **Non-Disruptive Intermediate/Root Certificate Rotation**: This allows
+import, generation and configuration of any number of keys and/or issuers
+within a PKI mount, providing operators the ability to rotate certificates
+in place without affecting existing client configurations. [[GH-15277](https://github.com/hashicorp/vault/pull/15277)]
+* **Print minimum required policy for any command**: The global CLI flag `-output-policy` can now be used with any command to print out the minimum required policy HCL for that operation, including whether the given path requires the "sudo" capability. [[GH-14899](https://github.com/hashicorp/vault/pull/14899)]
+* **Snowflake Database Plugin**: Adds ability to manage RSA key pair credentials for dynamic and static Snowflake users. [[GH-15376](https://github.com/hashicorp/vault/pull/15376)]
+* **Transit BYOK**: Allow import of externally-generated keys into the Transit secrets engine. [[GH-15414](https://github.com/hashicorp/vault/pull/15414)]
+* nomad: Bootstrap Nomad ACL system if no token is provided [[GH-12451](https://github.com/hashicorp/vault/pull/12451)]
+* storage/dynamodb: Added `AWS_DYNAMODB_REGION` environment variable. [[GH-15054](https://github.com/hashicorp/vault/pull/15054)]
+
+IMPROVEMENTS:
+
+* activity: return nil response months in activity log API when no month data exists [[GH-15420](https://github.com/hashicorp/vault/pull/15420)]
+* agent/auto-auth: Add `min_backoff` to the method stanza for configuring initial backoff duration. [[GH-15204](https://github.com/hashicorp/vault/pull/15204)]
+* agent: Update consul-template to v0.29.0 [[GH-15293](https://github.com/hashicorp/vault/pull/15293)]
+* agent: Upgrade hashicorp/consul-template version for sprig template functions and improved writeTo function [[GH-15092](https://github.com/hashicorp/vault/pull/15092)]
+* api/monitor: Add log_format option to allow for logs to be emitted in JSON format [[GH-15536](https://github.com/hashicorp/vault/pull/15536)]
+* api: Add ability to pass certificate as PEM bytes to api.Client. [[GH-14753](https://github.com/hashicorp/vault/pull/14753)]
+* api: Add context-aware functions to vault/api for each API wrapper function. [[GH-14388](https://github.com/hashicorp/vault/pull/14388)]
+* api: Added MFALogin() for handling MFA flow when using login helpers. [[GH-14900](https://github.com/hashicorp/vault/pull/14900)]
+* api: If the parameters supplied over the API payload are ignored due to not
+being what the endpoints were expecting, or if the parameters supplied get
+replaced by the values in the endpoint's path itself, warnings will be added to
+the non-empty responses listing all the ignored and replaced parameters. [[GH-14962](https://github.com/hashicorp/vault/pull/14962)]
+* api: KV helper methods to simplify the common use case of reading and writing KV secrets [[GH-15305](https://github.com/hashicorp/vault/pull/15305)]
+* api: Provide a helper method WithNamespace to create a cloned client with a new NS [[GH-14963](https://github.com/hashicorp/vault/pull/14963)]
+* api: Support VAULT_PROXY_ADDR environment variable to allow overriding the Vault client's HTTP proxy. [[GH-15377](https://github.com/hashicorp/vault/pull/15377)]
+* api: Use the context passed to the api/auth Login helpers. [[GH-14775](https://github.com/hashicorp/vault/pull/14775)]
+* api: make ListPlugins parse only known plugin types [[GH-15434](https://github.com/hashicorp/vault/pull/15434)]
+* audit: Add a policy_results block into the audit log that contains the set of
+policies that granted this request access. [[GH-15457](https://github.com/hashicorp/vault/pull/15457)]
+* audit: Include mount_accessor in audit request and response logs [[GH-15342](https://github.com/hashicorp/vault/pull/15342)]
+* audit: added entity_created boolean to audit log, set when login operations create an entity [[GH-15487](https://github.com/hashicorp/vault/pull/15487)]
+* auth/aws: Add rsa2048 signature type to API [[GH-15719](https://github.com/hashicorp/vault/pull/15719)]
+* auth/gcp: Enable the Google service endpoints used by the underlying client to be customized [[GH-15592](https://github.com/hashicorp/vault/pull/15592)]
+* auth/gcp: Vault CLI now infers the service account email when running on Google Cloud [[GH-15592](https://github.com/hashicorp/vault/pull/15592)]
+* auth/jwt: Adds ability to use JSON pointer syntax for the `user_claim` value. [[GH-15593](https://github.com/hashicorp/vault/pull/15593)]
+* auth/okta: Add support for Google provider TOTP type in the Okta auth method [[GH-14985](https://github.com/hashicorp/vault/pull/14985)]
+* auth/okta: Add support for performing [the number
+challenge](https://help.okta.com/en-us/Content/Topics/Mobile/ov-admin-config.htm?cshid=csh-okta-verify-number-challenge-v1#enable-number-challenge)
+during an Okta Verify push challenge [[GH-15361](https://github.com/hashicorp/vault/pull/15361)]
+* auth: Globally scoped Login MFA method Get/List endpoints [[GH-15248](https://github.com/hashicorp/vault/pull/15248)]
+* auth: enforce a rate limit for TOTP passcode validation attempts [[GH-14864](https://github.com/hashicorp/vault/pull/14864)]
+* auth: forward cached MFA auth response to the leader using RPC instead of forwarding all login requests [[GH-15469](https://github.com/hashicorp/vault/pull/15469)]
+* cli/debug: added support for retrieving metrics from DR clusters if `unauthenticated_metrics_access` is enabled [[GH-15316](https://github.com/hashicorp/vault/pull/15316)]
+* cli/vault: warn when policy name contains upper-case letter [[GH-14670](https://github.com/hashicorp/vault/pull/14670)]
+* cli: Alternative flag-based syntax for KV to mitigate confusion from automatically appended /data [[GH-14807](https://github.com/hashicorp/vault/pull/14807)]
+* cockroachdb: add high-availability support [[GH-12965](https://github.com/hashicorp/vault/pull/12965)]
+* command/debug: Add log_format flag to allow for logs to be emitted in JSON format [[GH-15536](https://github.com/hashicorp/vault/pull/15536)]
+* command: Support optional '-log-level' flag to be passed to 'operator migrate' command (defaults to info). Also support VAULT_LOG_LEVEL env var. [[GH-15405](https://github.com/hashicorp/vault/pull/15405)]
+* command: Support the optional '-detailed' flag to be passed to 'vault list' command to show ListResponseWithInfo data. Also supports the VAULT_DETAILED env var. [[GH-15417](https://github.com/hashicorp/vault/pull/15417)]
+* core (enterprise): Include `termination_time` in `sys/license/status` response
+* core (enterprise): Include termination time in `license inspect` command output
+* core,transit: Allow callers to choose random byte source including entropy augmentation sources for the sys/tools/random and transit/random endpoints. [[GH-15213](https://github.com/hashicorp/vault/pull/15213)]
+* core/activity: Order month data in ascending order of timestamps [[GH-15259](https://github.com/hashicorp/vault/pull/15259)]
+* core/activity: allow client counts to be precomputed and queried on non-contiguous chunks of data [[GH-15352](https://github.com/hashicorp/vault/pull/15352)]
+* core/managed-keys (enterprise): Allow configuring the number of parallel operations to PKCS#11 managed keys.
+* core: Add an export API for historical activity log data [[GH-15586](https://github.com/hashicorp/vault/pull/15586)]
+* core: Add new DB methods that do not prepare statements. [[GH-15166](https://github.com/hashicorp/vault/pull/15166)]
+* core: check uid and permissions of config dir, config file, plugin dir and plugin binaries [[GH-14817](https://github.com/hashicorp/vault/pull/14817)]
+* core: Fix some identity data races found by Go race detector (no known impact yet). [[GH-15123](https://github.com/hashicorp/vault/pull/15123)]
+* core: Include build date in `sys/seal-status` and `sys/version-history` endpoints. [[GH-14957](https://github.com/hashicorp/vault/pull/14957)]
+* core: Upgrade github.org/x/crypto/ssh [[GH-15125](https://github.com/hashicorp/vault/pull/15125)]
+* kmip (enterprise): Implement operations Query, Import, Encrypt and Decrypt. Improve operations Locate, Add Attribute, Get Attributes and Get Attribute List to handle most supported attributes.
+* mfa/okta: migrate to use official Okta SDK [[GH-15355](https://github.com/hashicorp/vault/pull/15355)]
+* sdk: Change OpenAPI code generator to extract request objects into /components/schemas and reference them by name. [[GH-14217](https://github.com/hashicorp/vault/pull/14217)]
+* secrets/consul: Add support for Consul node-identities and service-identities [[GH-15295](https://github.com/hashicorp/vault/pull/15295)]
+* secrets/consul: Vault is now able to automatically bootstrap the Consul ACL system. [[GH-10751](https://github.com/hashicorp/vault/pull/10751)]
+* secrets/database/elasticsearch: Use the new /_security base API path instead of /_xpack/security when managing elasticsearch. [[GH-15614](https://github.com/hashicorp/vault/pull/15614)]
+* secrets/pki: Add not_before_duration to root CA generation, intermediate CA signing paths. [[GH-14178](https://github.com/hashicorp/vault/pull/14178)]
+* secrets/pki: Add support for CPS URLs and User Notice to Policy Information [[GH-15751](https://github.com/hashicorp/vault/pull/15751)]
+* secrets/pki: Allow operators to control the issuing certificate behavior when
+the requested TTL is beyond the NotAfter value of the signing certificate [[GH-15152](https://github.com/hashicorp/vault/pull/15152)]
+* secrets/pki: Always return CRLs, URLs configurations, even if using the default value. [[GH-15470](https://github.com/hashicorp/vault/pull/15470)]
+* secrets/pki: Enable Patch Functionality for Roles and Issuers (API only) [[GH-15510](https://github.com/hashicorp/vault/pull/15510)]
+* secrets/pki: Have pki/sign-verbatim use the not_before_duration field defined in the role [[GH-15429](https://github.com/hashicorp/vault/pull/15429)]
+* secrets/pki: Warn on empty Subject field during issuer generation (root/generate and root/sign-intermediate). [[GH-15494](https://github.com/hashicorp/vault/pull/15494)]
+* secrets/pki: Warn on missing AIA access information when generating issuers (config/urls). [[GH-15509](https://github.com/hashicorp/vault/pull/15509)]
+* secrets/pki: Warn when `generate_lease` and `no_store` are both set to `true` on requests. [[GH-14292](https://github.com/hashicorp/vault/pull/14292)]
+* secrets/ssh: Add connection timeout of 1 minute for outbound SSH connection in deprecated Dynamic SSH Keys mode. [[GH-15440](https://github.com/hashicorp/vault/pull/15440)]
+* secrets/ssh: Support for `add_before_duration` in SSH [[GH-15250](https://github.com/hashicorp/vault/pull/15250)]
+* sentinel (enterprise): Upgrade sentinel to [v0.18.5](https://docs.hashicorp.com/sentinel/changelog#0-18-5-january-14-2022) to avoid potential naming collisions in the remote installer
+* storage/raft: Use larger timeouts at startup to reduce likelihood of inducing elections. [[GH-15042](https://github.com/hashicorp/vault/pull/15042)]
+* ui: Allow namespace param to be parsed from state queryParam [[GH-15378](https://github.com/hashicorp/vault/pull/15378)]
+* ui: Default auto-rotation period in transit is 30 days [[GH-15474](https://github.com/hashicorp/vault/pull/15474)]
+* ui: Parse schema refs from OpenAPI [[GH-14508](https://github.com/hashicorp/vault/pull/14508)]
+* ui: Remove stored license references [[GH-15513](https://github.com/hashicorp/vault/pull/15513)]
+* ui: Remove storybook. [[GH-15074](https://github.com/hashicorp/vault/pull/15074)]
+* ui: Replaces the IvyCodemirror wrapper with a custom ember modifier. [[GH-14659](https://github.com/hashicorp/vault/pull/14659)]
+* website/docs: Add usage documentation for Kubernetes Secrets Engine [[GH-15527](https://github.com/hashicorp/vault/pull/15527)]
+* website/docs: added a link to an Enigma secret plugin. [[GH-14389](https://github.com/hashicorp/vault/pull/14389)]
+
+DEPRECATIONS:
+
+* docs: Document removal of X.509 certificates with signatures who use SHA-1 in Vault 1.12 [[GH-15581](https://github.com/hashicorp/vault/pull/15581)]
+* secrets/consul: Deprecate old parameters "token_type" and "policy" [[GH-15550](https://github.com/hashicorp/vault/pull/15550)]
+* secrets/consul: Deprecate parameter "policies" in favor of "consul_policies" for consistency [[GH-15400](https://github.com/hashicorp/vault/pull/15400)]
+
+BUG FIXES:
+
+* Fixed panic when adding or modifying a Duo MFA Method in Enterprise
+* agent: Fix log level mismatch between ERR and ERROR [[GH-14424](https://github.com/hashicorp/vault/pull/14424)]
+* agent: Redact auto auth token from renew endpoints [[GH-15380](https://github.com/hashicorp/vault/pull/15380)]
+* api/sys/raft: Update RaftSnapshotRestore to use net/http client allowing bodies larger than allocated memory to be streamed [[GH-14269](https://github.com/hashicorp/vault/pull/14269)]
+* api: Fixes bug where OutputCurlString field was unintentionally being copied over during client cloning [[GH-14968](https://github.com/hashicorp/vault/pull/14968)]
+* api: Respect increment value in grace period calculations in LifetimeWatcher [[GH-14836](https://github.com/hashicorp/vault/pull/14836)]
+* auth/approle: Add maximum length for input values that result in SHA56 HMAC calculation [[GH-14746](https://github.com/hashicorp/vault/pull/14746)]
+* auth/kubernetes: Fix error code when using the wrong service account [[GH-15584](https://github.com/hashicorp/vault/pull/15584)]
+* auth/ldap: The logic for setting the entity alias when `username_as_alias` is set
+has been fixed. The previous behavior would make a request to the LDAP server to
+get `user_attr` before discarding it and using the username instead. This would
+make it impossible for a user to connect if this attribute was missing or had
+multiple values, even though it would not be used anyway. This has been fixed
+and the username is now used without making superfluous LDAP searches. [[GH-15525](https://github.com/hashicorp/vault/pull/15525)]
+* auth: Fixed erroneous success message when using vault login in case of two-phase MFA [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
+* auth: Fixed erroneous token information being displayed when using vault login in case of two-phase MFA [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
+* auth: Fixed two-phase MFA information missing from table format when using vault login [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
+* auth: Prevent deleting a valid MFA method ID using the endpoint for a different MFA method type [[GH-15482](https://github.com/hashicorp/vault/pull/15482)]
+* auth: forward requests subject to login MFA from perfStandby to Active node [[GH-15009](https://github.com/hashicorp/vault/pull/15009)]
+* auth: load login MFA configuration upon restart [[GH-15261](https://github.com/hashicorp/vault/pull/15261)]
+* cassandra: Update gocql Cassandra client to fix "no hosts available in the pool" error [[GH-14973](https://github.com/hashicorp/vault/pull/14973)]
+* cli: Fix panic caused by parsing key=value fields whose value is a single backslash [[GH-14523](https://github.com/hashicorp/vault/pull/14523)]
+* cli: kv get command now honors trailing spaces to retrieve secrets [[GH-15188](https://github.com/hashicorp/vault/pull/15188)]
+* command: do not report listener and storage types as key not found warnings [[GH-15383](https://github.com/hashicorp/vault/pull/15383)]
+* core (enterprise): Allow local alias create RPCs to persist alias metadata
+* core (enterprise): Fix overcounting of lease count quota usage at startup.
+* core (enterprise): Fix some races in merkle index flushing code found in testing
+* core (enterprise): Handle additional edge cases reinitializing PKCS#11 libraries after login errors.
+* core/config: Only ask the system about network interfaces when address configs contain a template having the format: {{ ... }} [[GH-15224](https://github.com/hashicorp/vault/pull/15224)]
+* core/managed-keys (enterprise): Allow PKCS#11 managed keys to use 0 as a slot number
+* core/metrics: Fix incorrect table size metric for local mounts [[GH-14755](https://github.com/hashicorp/vault/pull/14755)]
+* core: Fix double counting for "route" metrics [[GH-12763](https://github.com/hashicorp/vault/pull/12763)]
+* core: Fix panic caused by parsing JSON integers for fields defined as comma-delimited integers [[GH-15072](https://github.com/hashicorp/vault/pull/15072)]
+* core: Fix panic caused by parsing JSON integers for fields defined as comma-delimited strings [[GH-14522](https://github.com/hashicorp/vault/pull/14522)]
+* core: Fix panic caused by parsing policies with empty slice values. [[GH-14501](https://github.com/hashicorp/vault/pull/14501)]
+* core: Fix panic for help request URL paths without /v1/ prefix [[GH-14704](https://github.com/hashicorp/vault/pull/14704)]
+* core: Limit SSCT WAL checks on perf standbys to raft backends only [[GH-15879](https://github.com/hashicorp/vault/pull/15879)]
+* core: Prevent changing file permissions of audit logs when mode 0000 is used. [[GH-15759](https://github.com/hashicorp/vault/pull/15759)]
+* core: Prevent metrics generation from causing deadlocks. [[GH-15693](https://github.com/hashicorp/vault/pull/15693)]
+* core: fixed systemd reloading notification [[GH-15041](https://github.com/hashicorp/vault/pull/15041)]
+* core: fixing excessive unix file permissions [[GH-14791](https://github.com/hashicorp/vault/pull/14791)]
+* core: fixing excessive unix file permissions on dir, files and archive created by vault debug command [[GH-14846](https://github.com/hashicorp/vault/pull/14846)]
+* core: pre-calculate namespace specific paths when tainting a route during postUnseal [[GH-15067](https://github.com/hashicorp/vault/pull/15067)]
+* core: renaming the environment variable VAULT_DISABLE_FILE_PERMISSIONS_CHECK to VAULT_ENABLE_FILE_PERMISSIONS_CHECK and adjusting the logic [[GH-15452](https://github.com/hashicorp/vault/pull/15452)]
+* core: report unused or redundant keys in server configuration [[GH-14752](https://github.com/hashicorp/vault/pull/14752)]
+* core: time.After() used in a select statement can lead to memory leak [[GH-14814](https://github.com/hashicorp/vault/pull/14814)]
+* identity: deduplicate policies when creating/updating identity groups [[GH-15055](https://github.com/hashicorp/vault/pull/15055)]
+* mfa/okta: disable client side rate limiting causing delays in push notifications [[GH-15369](https://github.com/hashicorp/vault/pull/15369)]
+* plugin: Fix a bug where plugin reload would falsely report success in certain scenarios. [[GH-15579](https://github.com/hashicorp/vault/pull/15579)]
+* raft: fix Raft TLS key rotation panic that occurs if active key is more than 24 hours old [[GH-15156](https://github.com/hashicorp/vault/pull/15156)]
+* raft: Ensure initialMmapSize is set to 0 on Windows [[GH-14977](https://github.com/hashicorp/vault/pull/14977)]
+* replication (enterprise): fix panic due to missing entity during invalidation of local aliases. [[GH-14622](https://github.com/hashicorp/vault/pull/14622)]
+* sdk/cidrutil: Only check if cidr contains remote address for IP addresses [[GH-14487](https://github.com/hashicorp/vault/pull/14487)]
+* sdk: Fix OpenApi spec generator to properly convert TypeInt64 to OAS supported int64 [[GH-15104](https://github.com/hashicorp/vault/pull/15104)]
+* sdk: Fix OpenApi spec generator to remove duplicate sha_256 parameter [[GH-15163](https://github.com/hashicorp/vault/pull/15163)]
+* secrets/database: Ensure that a `connection_url` password is redacted in all cases. [[GH-14744](https://github.com/hashicorp/vault/pull/14744)]
+* secrets/kv: Fix issue preventing the ability to reset the `delete_version_after` key metadata field to 0s via HTTP `PATCH`. [[GH-15792](https://github.com/hashicorp/vault/pull/15792)]
+* secrets/pki: CRLs on performance secondary clusters are now automatically
+rebuilt upon changes to the list of issuers. [[GH-15179](https://github.com/hashicorp/vault/pull/15179)]
+* secrets/pki: Fix handling of "any" key type with default zero signature bits value. [[GH-14875](https://github.com/hashicorp/vault/pull/14875)]
+* secrets/pki: Fixed bug where larger SHA-2 hashes were truncated with shorter ECDSA CA certificates [[GH-14943](https://github.com/hashicorp/vault/pull/14943)]
+* secrets/ssh: Convert role field not_before_duration to seconds before returning it [[GH-15559](https://github.com/hashicorp/vault/pull/15559)]
+* storage/raft (enterprise):  Auto-snapshot configuration now forbids slashes in file prefixes for all types, and "/" in path prefix for local storage type.  Strip leading prefix in path prefix for AWS.  Improve error handling/reporting.
+* storage/raft: Forward autopilot state requests on perf standbys to active node. [[GH-15493](https://github.com/hashicorp/vault/pull/15493)]
+* storage/raft: joining a node to a cluster now ignores any VAULT_NAMESPACE environment variable set on the server process [[GH-15519](https://github.com/hashicorp/vault/pull/15519)]
+* ui: Fix Generated Token's Policies helpText to clarify that comma separated values are not accepted in this field. [[GH-15046](https://github.com/hashicorp/vault/pull/15046)]
+* ui: Fix KV secret showing in the edit form after a user creates a new version but doesn't have read capabilities [[GH-14794](https://github.com/hashicorp/vault/pull/14794)]
+* ui: Fix inconsistent behavior in client count calendar widget [[GH-15789](https://github.com/hashicorp/vault/pull/15789)]
+* ui: Fix issue where metadata tab is hidden even though policy grants access [[GH-15824](https://github.com/hashicorp/vault/pull/15824)]
+* ui: Fix issue with KV not recomputing model when you changed versions. [[GH-14941](https://github.com/hashicorp/vault/pull/14941)]
+* ui: Fixed client count timezone for start and end months [[GH-15167](https://github.com/hashicorp/vault/pull/15167)]
+* ui: Fixed unsupported revocation statements field for DB roles [[GH-15573](https://github.com/hashicorp/vault/pull/15573)]
+* ui: Fixes edit auth method capabilities issue [[GH-14966](https://github.com/hashicorp/vault/pull/14966)]
+* ui: Fixes issue logging in with OIDC from a listed auth mounts tab [[GH-14916](https://github.com/hashicorp/vault/pull/14916)]
+* ui: Revert using localStorage in favor of sessionStorage [[GH-15769](https://github.com/hashicorp/vault/pull/15769)]
+* ui: Updated `leasId` to `leaseId` in the "Copy Credentials" section of "Generate AWS Credentials" [[GH-15685](https://github.com/hashicorp/vault/pull/15685)]
+* ui: fix firefox inability to recognize file format of client count csv export [[GH-15364](https://github.com/hashicorp/vault/pull/15364)]
+* ui: fix form validations ignoring default values and disabling submit button [[GH-15560](https://github.com/hashicorp/vault/pull/15560)]
+* ui: fix search-select component showing blank selections when editing group member entity [[GH-15058](https://github.com/hashicorp/vault/pull/15058)]
+* ui: masked values no longer give away length or location of special characters [[GH-15025](https://github.com/hashicorp/vault/pull/15025)]
+
+## 1.10.11
+### March 01, 2023
+
+SECURITY:
+
+* auth/approle: When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999 has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above. [[HSEC-2023-07](https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305)]
+
+CHANGES:
+
+* core: Bump Go version to 1.19.6.
+
+IMPROVEMENTS:
+
+* secrets/database: Adds error message requiring password on root crednetial rotation. [[GH-19103](https://github.com/hashicorp/vault/pull/19103)]
+
+BUG FIXES:
+
+* auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [[GH-19186](https://github.com/hashicorp/vault/pull/19186)]
+* core (enterprise): Fix panic when using invalid accessor for control-group request
+* core: Prevent panics in `sys/leases/lookup`, `sys/leases/revoke`, and `sys/leases/renew` endpoints if provided `lease_id` is null [[GH-18951](https://github.com/hashicorp/vault/pull/18951)]
+* replication (enterprise): Fix bug where reloading external plugin on a secondary would
+break replication.
+* secrets/ad: Fix bug where config couldn't be updated unless binddn/bindpass were included in the update. [[GH-18209](https://github.com/hashicorp/vault/pull/18209)]
+* ui (enterprise): Fix cancel button from transform engine role creation page [[GH-19135](https://github.com/hashicorp/vault/pull/19135)]
+* ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [[GH-19071](https://github.com/hashicorp/vault/pull/19071)]
+
+## 1.10.10
+### February 6, 2023
+
+CHANGES:
+
+* core: Bump Go version to 1.19.4.
+
+IMPROVEMENTS:
+
+* command/server: Environment variable keys are now logged at startup. [[GH-18125](https://github.com/hashicorp/vault/pull/18125)]
+* core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
+* secrets/db/mysql: Add `tls_server_name` and `tls_skip_verify` parameters [[GH-18799](https://github.com/hashicorp/vault/pull/18799)]
+* ui: Prepends "passcode=" if not provided in user input for duo totp mfa method authentication [[GH-18342](https://github.com/hashicorp/vault/pull/18342)]
+* ui: Update language on database role to "Connection name" [[GH-18261](https://github.com/hashicorp/vault/issues/18261)] [[GH-18350](https://github.com/hashicorp/vault/pull/18350)]
+
+BUG FIXES:
+
+* auth/approle: Fix `token_bound_cidrs` validation when using /32 blocks for role and secret ID [[GH-18145](https://github.com/hashicorp/vault/pull/18145)]
+* auth/token: Fix ignored parameter warnings for valid parameters on token create [[GH-16938](https://github.com/hashicorp/vault/pull/16938)]
+* cli/kv: skip formatting of nil secrets for patch and put with field parameter set [[GH-18163](https://github.com/hashicorp/vault/pull/18163)]
+* core (enterprise): Fix a race condition resulting in login errors to PKCS#11 modules under high concurrency.
+* core/managed-keys (enterprise): Limit verification checks to mounts in a key's namespace
+* core/quotas (enterprise): Fix a potential deadlock that could occur when using lease count quotas.
+* core/quotas: Fix issue with improper application of default rate limit quota exempt paths [[GH-18273](https://github.com/hashicorp/vault/pull/18273)]
+* core: fix bug where context cancellations weren't forwarded to active node from performance standbys.
+* core: prevent panic in login mfa enforcement delete after enforcement's namespace is deleted [[GH-18923](https://github.com/hashicorp/vault/pull/18923)]
+* database/mongodb: Fix writeConcern set to be applied to any query made on the database [[GH-18546](https://github.com/hashicorp/vault/pull/18546)]
+* identity (enterprise): Fix a data race when creating an entity for a local alias.
+* kmip (enterprise): Fix Destroy operation response that omitted Unique Identifier on some batched responses.
+* kmip (enterprise): Fix Locate operation response incompatibility with clients using KMIP versions prior to 1.3.
+* licensing (enterprise): update autoloaded license cache after reload
+* storage/raft (enterprise): Fix some storage-modifying RPCs used by perf standbys that weren't returning the resulting WAL state.
+* ui: fixes query parameters not passed in api explorer test requests [[GH-18743](https://github.com/hashicorp/vault/pull/18743)]
+
+## 1.10.9
+### November 30, 2022
+
+BUG FIXES:
+
+* auth: Deduplicate policies prior to ACL generation [[GH-17914](https://github.com/hashicorp/vault/pull/17914)]
+* core/quotas (enterprise): Fix a lock contention issue that could occur and cause Vault to become unresponsive when creating, changing, or deleting lease count quotas.
+* core: Fix potential deadlock if barrier ciphertext is less than 4 bytes. [[GH-17944](https://github.com/hashicorp/vault/pull/17944)]
+* core: fix a start up race condition where performance standbys could go into a
+  mount loop if default policies are not yet synced from the active node. [[GH-17801](https://github.com/hashicorp/vault/pull/17801)]
+* secrets/azure: add WAL to clean up role assignments if errors occur [[GH-18084](https://github.com/hashicorp/vault/pull/18084)]
+* secrets/gcp: Fixes duplicate service account key for rotate root on standby or secondary [[GH-18109](https://github.com/hashicorp/vault/pull/18109)]
+* ui: fix entity policies list link to policy show page [[GH-17950](https://github.com/hashicorp/vault/pull/17950)]
+
+## 1.10.8
+### November 2, 2022
+
+BUG FIXES:
+
+* core/managed-keys (enterprise): Return better error messages when encountering key creation failures
+* core/managed-keys (enterprise): fix panic when having `cache_disable` true
+* core: prevent memory leak when using control group factors in a policy [[GH-17532](https://github.com/hashicorp/vault/pull/17532)]
+* core: prevent panic during mfa after enforcement's namespace is deleted [[GH-17562](https://github.com/hashicorp/vault/pull/17562)]
+* login: Store token in tokenhelper for interactive login MFA [[GH-17040](https://github.com/hashicorp/vault/pull/17040)]
+* secrets/pki: Do not ignore provided signature bits value when signing intermediate and leaf certificates with a managed key [[GH-17328](https://github.com/hashicorp/vault/pull/17328)]
+* secrets/pki: Respond to tidy-status, tidy-cancel on PR Secondary clusters. [[GH-17497](https://github.com/hashicorp/vault/pull/17497)]
+* ui: Fixes oidc/jwt login issue with alternate mount path and jwt login via mount path tab [[GH-17661](https://github.com/hashicorp/vault/pull/17661)]
+
+## 1.10.7
+### September 30, 2022
+
+SECURITY:
+
+* secrets/pki: Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s CA into memory on startup, resulting in the revocation list not being checked, if the CRL has not yet been retrieved. This vulnerability, CVE-2022-41316, is fixed in Vault 1.12.0, 1.11.4, 1.10.7, and 1.9.10. [[HSEC-2022-24](https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483)]
+
+BUG FIXES:
+
+* auth/cert: Vault does not initially load the CRLs in cert auth unless the read/write CRL endpoint is hit. [[GH-17138](https://github.com/hashicorp/vault/pull/17138)]
+* core/quotas: Fix goroutine leak caused by the seal process not fully cleaning up Rate Limit Quotas. [[GH-17281](https://github.com/hashicorp/vault/pull/17281)]
+* core: Prevent two or more DR failovers from invalidating SSCT tokens generated on the previous primaries. [[GH-16956](https://github.com/hashicorp/vault/pull/16956)]
+* identity/oidc: Adds `claims_supported` to discovery document. [[GH-16992](https://github.com/hashicorp/vault/pull/16992)]
+* replication (enterprise): Fix data race in SaveCheckpoint()
+* secrets/transform (enterprise): Fix an issue loading tokenization transform configuration after a specific sequence of reconfigurations.
+* secrets/transform (enterprise): Fix persistence problem with tokenization store credentials.
+* ui: Fix lease force revoke action [[GH-16930](https://github.com/hashicorp/vault/pull/16930)]
+
+## 1.10.6
+### August 31, 2022
+
+SECURITY:
+
+* core: When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. This vulnerability, CVE-2022-40186, is fixed in 1.11.3, 1.10.6, and 1.9.9. [[HSEC-2022-18](https://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550)]
+
+CHANGES:
+
+* core: Bump Go version to 1.17.13.
+
+IMPROVEMENTS:
+
+* identity/oidc: Adds the `client_secret_post` token endpoint authentication method. [[GH-16598](https://github.com/hashicorp/vault/pull/16598)]
+
+BUG FIXES:
+
+* auth/gcp: Fixes the ability to reset the configuration's credentials to use application default credentials. [[GH-16524](https://github.com/hashicorp/vault/pull/16524)]
+* command/debug: fix bug where monitor was not honoring configured duration [[GH-16834](https://github.com/hashicorp/vault/pull/16834)]
+* core/auth: Return a 403 instead of a 500 for a malformed SSCT [[GH-16112](https://github.com/hashicorp/vault/pull/16112)]
+* core: Increase the allowed concurrent gRPC streams over the cluster port. [[GH-16327](https://github.com/hashicorp/vault/pull/16327)]
+* database: Invalidate queue should cancel context first to avoid deadlock [[GH-15933](https://github.com/hashicorp/vault/pull/15933)]
+* identity/oidc: Change the `state` parameter of the Authorization Endpoint to optional. [[GH-16599](https://github.com/hashicorp/vault/pull/16599)]
+* identity/oidc: Detect invalid `redirect_uri` values sooner in validation of the
+Authorization Endpoint. [[GH-16601](https://github.com/hashicorp/vault/pull/16601)]
+* identity/oidc: Fixes validation of the `request` and `request_uri` parameters. [[GH-16600](https://github.com/hashicorp/vault/pull/16600)]
+* secrets/database: Fix a bug where the secret engine would queue up a lot of WAL deletes during startup. [[GH-16686](https://github.com/hashicorp/vault/pull/16686)]
+* secrets/gcp: Fixes duplicate static account key creation from performance secondary clusters. [[GH-16534](https://github.com/hashicorp/vault/pull/16534)]
+* storage/raft: Fix retry_join initialization failure [[GH-16550](https://github.com/hashicorp/vault/pull/16550)]
+* ui: Fix OIDC callback to accept namespace flag in different formats [[GH-16886](https://github.com/hashicorp/vault/pull/16886)]
+* ui: Fix issue logging in with JWT auth method [[GH-16466](https://github.com/hashicorp/vault/pull/16466)]
+* ui: Fix naming of permitted_dns_domains form parameter on CA creation (root generation and sign intermediate). [[GH-16739](https://github.com/hashicorp/vault/pull/16739)]
+
+SECURITY:
+
+* identity/entity: When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. [[HCSEC-2022-18](https://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550)]
+
+## 1.10.5
+### July 21, 2022
+
+SECURITY:
+
+* storage/raft: Vault Enterprise (“Vault”) clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. This vulnerability, CVE-2022-36129, was fixed in Vault 1.9.8, 1.10.5, and 1.11.1. [[HSEC-2022-15](https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420)]
+
+CHANGES:
+
+* core/fips: Disable and warn about entropy augmentation in FIPS 140-2 Inside mode [[GH-15858](https://github.com/hashicorp/vault/pull/15858)]
+* core: Bump Go version to 1.17.12.
+
+IMPROVEMENTS:
+
+* core: Add `sys/loggers` and `sys/loggers/:name` endpoints to provide ability to modify logging verbosity [[GH-16111](https://github.com/hashicorp/vault/pull/16111)]
+* secrets/ssh: Allow additional text along with a template definition in defaultExtension value fields. [[GH-16018](https://github.com/hashicorp/vault/pull/16018)]
+
+BUG FIXES:
+
+* agent/template: Fix parsing error for the exec stanza [[GH-16231](https://github.com/hashicorp/vault/pull/16231)]
+* core/identity: Replicate member_entity_ids and policies in identity/group across nodes identically [[GH-16088](https://github.com/hashicorp/vault/pull/16088)]
+* core/replication (enterprise): Don't flush merkle tree pages to disk after losing active duty
+* core/seal: Fix possible keyring truncation when using the file backend. [[GH-15946](https://github.com/hashicorp/vault/pull/15946)]
+* core: Limit SSCT WAL checks on perf standbys to raft backends only [[GH-15879](https://github.com/hashicorp/vault/pull/15879)]
+* plugin/multiplexing: Fix panic when id doesn't exist in connection map [[GH-16094](https://github.com/hashicorp/vault/pull/16094)]
+* secret/pki: Do not fail validation with a legacy key_bits default value and key_type=any when signing CSRs [[GH-16246](https://github.com/hashicorp/vault/pull/16246)]
+* storage/raft (enterprise): Prevent unauthenticated voter status with rejoin [[GH-16324](https://github.com/hashicorp/vault/pull/16324)]
+* transform (enterprise): Fix a bug in the handling of nested or unmatched capture groups in FPE transformations.
+* ui: Fix issue where metadata tab is hidden even though policy grants access [[GH-15824](https://github.com/hashicorp/vault/pull/15824)]
+* ui: Revert using localStorage in favor of sessionStorage [[GH-16169](https://github.com/hashicorp/vault/pull/16169)]
+* ui: Updated `leasId` to `leaseId` in the "Copy Credentials" section of "Generate AWS Credentials" [[GH-15685](https://github.com/hashicorp/vault/pull/15685)]
+
+## 1.10.4
+### June 10, 2022
+
+CHANGES:
+
+* core: Bump Go version to 1.17.11. [[GH-go-ver-1104](https://github.com/hashicorp/vault/pull/go-ver-1104)]
+
+IMPROVEMENTS:
+
+* api/monitor: Add log_format option to allow for logs to be emitted in JSON format [[GH-15536](https://github.com/hashicorp/vault/pull/15536)]
+* auth: Globally scoped Login MFA method Get/List endpoints [[GH-15248](https://github.com/hashicorp/vault/pull/15248)]
+* auth: forward cached MFA auth response to the leader using RPC instead of forwarding all login requests [[GH-15469](https://github.com/hashicorp/vault/pull/15469)]
+* cli/debug: added support for retrieving metrics from DR clusters if `unauthenticated_metrics_access` is enabled [[GH-15316](https://github.com/hashicorp/vault/pull/15316)]
+* command/debug: Add log_format flag to allow for logs to be emitted in JSON format [[GH-15536](https://github.com/hashicorp/vault/pull/15536)]
+* core: Fix some identity data races found by Go race detector (no known impact yet). [[GH-15123](https://github.com/hashicorp/vault/pull/15123)]
+* storage/raft: Use larger timeouts at startup to reduce likelihood of inducing elections. [[GH-15042](https://github.com/hashicorp/vault/pull/15042)]
+* ui: Allow namespace param to be parsed from state queryParam [[GH-15378](https://github.com/hashicorp/vault/pull/15378)]
+
+BUG FIXES:
+
+* agent: Redact auto auth token from renew endpoints [[GH-15380](https://github.com/hashicorp/vault/pull/15380)]
+* auth/kubernetes: Fix error code when using the wrong service account [[GH-15585](https://github.com/hashicorp/vault/pull/15585)]
+* auth/ldap: The logic for setting the entity alias when `username_as_alias` is set
+has been fixed. The previous behavior would make a request to the LDAP server to
+get `user_attr` before discarding it and using the username instead. This would
+make it impossible for a user to connect if this attribute was missing or had
+multiple values, even though it would not be used anyway. This has been fixed
+and the username is now used without making superfluous LDAP searches. [[GH-15525](https://github.com/hashicorp/vault/pull/15525)]
+* auth: Fixed erroneous success message when using vault login in case of two-phase MFA [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
+* auth: Fixed erroneous token information being displayed when using vault login in case of two-phase MFA [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
+* auth: Fixed two-phase MFA information missing from table format when using vault login [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
+* auth: Prevent deleting a valid MFA method ID using the endpoint for a different MFA method type [[GH-15482](https://github.com/hashicorp/vault/pull/15482)]
+* core (enterprise): Fix overcounting of lease count quota usage at startup.
+* core: Prevent changing file permissions of audit logs when mode 0000 is used. [[GH-15759](https://github.com/hashicorp/vault/pull/15759)]
+* core: Prevent metrics generation from causing deadlocks. [[GH-15693](https://github.com/hashicorp/vault/pull/15693)]
+* core: fixed systemd reloading notification [[GH-15041](https://github.com/hashicorp/vault/pull/15041)]
+* mfa/okta: disable client side rate limiting causing delays in push notifications [[GH-15369](https://github.com/hashicorp/vault/pull/15369)]
+* storage/raft (enterprise):  Auto-snapshot configuration now forbids slashes in file prefixes for all types, and "/" in path prefix for local storage type.  Strip leading prefix in path prefix for AWS.  Improve error handling/reporting.
+* transform (enterprise): Fix non-overridable column default value causing tokenization tokens to expire prematurely when using the MySQL storage backend.
+* ui: Fix inconsistent behavior in client count calendar widget [[GH-15789](https://github.com/hashicorp/vault/pull/15789)]
+* ui: Fixed client count timezone for start and end months [[GH-15167](https://github.com/hashicorp/vault/pull/15167)]
+* ui: fix firefox inability to recognize file format of client count csv export [[GH-15364](https://github.com/hashicorp/vault/pull/15364)]
+
+## 1.10.3
+### May 11, 2022
+
+SECURITY:
+* auth: A vulnerability was identified in Vault and Vault Enterprise (“Vault”) from 1.10.0 to 1.10.2 where MFA may not be enforced on user logins after a server restart. This vulnerability, CVE-2022-30689, was fixed in Vault 1.10.3.
+
+BUG FIXES:
+
+* auth: load login MFA configuration upon restart [[GH-15261](https://github.com/hashicorp/vault/pull/15261)]
+* core/config: Only ask the system about network interfaces when address configs contain a template having the format: {{ ... }} [[GH-15224](https://github.com/hashicorp/vault/pull/15224)]
+* core: pre-calculate namespace specific paths when tainting a route during postUnseal [[GH-15067](https://github.com/hashicorp/vault/pull/15067)]
+
+## 1.10.2
+### April 29, 2022
+
+BUG FIXES:
+
+* raft: fix Raft TLS key rotation panic that occurs if active key is more than 24 hours old [[GH-15156](https://github.com/hashicorp/vault/pull/15156)]
+* sdk: Fix OpenApi spec generator to properly convert TypeInt64 to OAS supported int64 [[GH-15104](https://github.com/hashicorp/vault/pull/15104)]
+
+## 1.10.1
+### April 22, 2022
+
+CHANGES:
+
+* core: A request that fails path validation due to relative path check will now be responded to with a 400 rather than 500. [[GH-14328](https://github.com/hashicorp/vault/pull/14328)]
+* core: Bump Go version to 1.17.9. [[GH-15044](https://github.com/hashicorp/vault/pull/15044)]
+
+IMPROVEMENTS:
+
+* agent: Upgrade hashicorp/consul-template version for sprig template functions and improved writeTo function [[GH-15092](https://github.com/hashicorp/vault/pull/15092)]
+* auth: enforce a rate limit for TOTP passcode validation attempts [[GH-14864](https://github.com/hashicorp/vault/pull/14864)]
+* cli/vault: warn when policy name contains upper-case letter [[GH-14670](https://github.com/hashicorp/vault/pull/14670)]
+* cockroachdb: add high-availability support [[GH-12965](https://github.com/hashicorp/vault/pull/12965)]
+* sentinel (enterprise): Upgrade sentinel to [v0.18.5](https://docs.hashicorp.com/sentinel/changelog#0-18-5-january-14-2022) to avoid potential naming collisions in the remote installer
+
+BUG FIXES:
+
+* Fixed panic when adding or modifying a Duo MFA Method in Enterprise
+* agent: Fix log level mismatch between ERR and ERROR [[GH-14424](https://github.com/hashicorp/vault/pull/14424)]
+* api/sys/raft: Update RaftSnapshotRestore to use net/http client allowing bodies larger than allocated memory to be streamed [[GH-14269](https://github.com/hashicorp/vault/pull/14269)]
+* api: Respect increment value in grace period calculations in LifetimeWatcher [[GH-14836](https://github.com/hashicorp/vault/pull/14836)]
+* auth/approle: Add maximum length for input values that result in SHA56 HMAC calculation [[GH-14746](https://github.com/hashicorp/vault/pull/14746)]
+* auth: forward requests subject to login MFA from perfStandby to Active node [[GH-15009](https://github.com/hashicorp/vault/pull/15009)]
+* cassandra: Update gocql Cassandra client to fix "no hosts available in the pool" error [[GH-14973](https://github.com/hashicorp/vault/pull/14973)]
+* cli: Fix panic caused by parsing key=value fields whose value is a single backslash [[GH-14523](https://github.com/hashicorp/vault/pull/14523)]
+* core (enterprise): Allow local alias create RPCs to persist alias metadata [[GH-changelog:_2747](https://github.com/hashicorp/vault/pull/changelog:_2747)]
+* core/managed-keys (enterprise): Allow PKCS#11 managed keys to use 0 as a slot number
+* core/metrics: Fix incorrect table size metric for local mounts [[GH-14755](https://github.com/hashicorp/vault/pull/14755)]
+* core: Fix panic caused by parsing JSON integers for fields defined as comma-delimited integers [[GH-15072](https://github.com/hashicorp/vault/pull/15072)]
+* core: Fix panic caused by parsing JSON integers for fields defined as comma-delimited strings [[GH-14522](https://github.com/hashicorp/vault/pull/14522)]
+* core: Fix panic caused by parsing policies with empty slice values. [[GH-14501](https://github.com/hashicorp/vault/pull/14501)]
+* core: Fix panic for help request URL paths without /v1/ prefix [[GH-14704](https://github.com/hashicorp/vault/pull/14704)]
+* core: fixing excessive unix file permissions [[GH-14791](https://github.com/hashicorp/vault/pull/14791)]
+* core: fixing excessive unix file permissions on dir, files and archive created by vault debug command [[GH-14846](https://github.com/hashicorp/vault/pull/14846)]
+* core: report unused or redundant keys in server configuration [[GH-14752](https://github.com/hashicorp/vault/pull/14752)]
+* core: time.After() used in a select statement can lead to memory leak [[GH-14814](https://github.com/hashicorp/vault/pull/14814)]
+* raft: Ensure initialMmapSize is set to 0 on Windows [[GH-14977](https://github.com/hashicorp/vault/pull/14977)]
+* replication (enterprise): fix panic due to missing entity during invalidation of local aliases. [[GH-14622](https://github.com/hashicorp/vault/pull/14622)]
+* secrets/database: Ensure that a `connection_url` password is redacted in all cases. [[GH-14744](https://github.com/hashicorp/vault/pull/14744)]
+* secrets/pki: Fix handling of "any" key type with default zero signature bits value. [[GH-14875](https://github.com/hashicorp/vault/pull/14875)]
+* secrets/pki: Fixed bug where larger SHA-2 hashes were truncated with shorter ECDSA CA certificates [[GH-14943](https://github.com/hashicorp/vault/pull/14943)]
+* ui: Fix Generated Token's Policies helpText to clarify that comma separated values are not excepted in this field. [[GH-15046](https://github.com/hashicorp/vault/pull/15046)]
+* ui: Fixes edit auth method capabilities issue [[GH-14966](https://github.com/hashicorp/vault/pull/14966)]
+* ui: Fixes issue logging in with OIDC from a listed auth mounts tab [[GH-14916](https://github.com/hashicorp/vault/pull/14916)]
+* ui: fix search-select component showing blank selections when editing group member entity [[GH-15058](https://github.com/hashicorp/vault/pull/15058)]
+* ui: masked values no longer give away length or location of special characters [[GH-15025](https://github.com/hashicorp/vault/pull/15025)]
+
+## 1.10.0
+### March 23, 2022
+
+CHANGES:
+
+* core (enterprise): requests with newly generated tokens to perf standbys which are lagging behind the active node return http 412 instead of 400/403/50x.
+* core: Changes the unit of `default_lease_ttl` and `max_lease_ttl` values returned by
+the `/sys/config/state/sanitized` endpoint from nanoseconds to seconds. [[GH-14206](https://github.com/hashicorp/vault/pull/14206)]
+* core: Bump Go version to 1.17.7. [[GH-14232](https://github.com/hashicorp/vault/pull/14232)]
+* plugin/database: The return value from `POST /database/config/:name` has been updated to "204 No Content" [[GH-14033](https://github.com/hashicorp/vault/pull/14033)]
+* secrets/azure: Changes the configuration parameter `use_microsoft_graph_api` to use the Microsoft
+Graph API by default. [[GH-14130](https://github.com/hashicorp/vault/pull/14130)]
+* storage/etcd: Remove support for v2. [[GH-14193](https://github.com/hashicorp/vault/pull/14193)]
+* ui: Upgrade Ember to version 3.24 [[GH-13443](https://github.com/hashicorp/vault/pull/13443)]
+
+FEATURES:
+
+* **Database plugin multiplexing**: manage multiple database connections with a single plugin process [[GH-14033](https://github.com/hashicorp/vault/pull/14033)]
+* **Login MFA**: Single and two phase MFA is now available when authenticating to Vault. [[GH-14025](https://github.com/hashicorp/vault/pull/14025)]
+* **Mount Migration**: Vault supports moving secrets and auth mounts both within and across namespaces.
+* **Postgres in the UI**: Postgres DB is now supported by the UI [[GH-12945](https://github.com/hashicorp/vault/pull/12945)]
+* **Report in-flight requests**: Adding a trace capability to show in-flight requests, and a new gauge metric to show the total number of in-flight requests [[GH-13024](https://github.com/hashicorp/vault/pull/13024)]
+* **Server Side Consistent Tokens**: Service tokens have been updated to be longer (a minimum of 95 bytes) and token prefixes for all token types are updated from s., b., and r. to hvs., hvb., and hvr. for service, batch, and recovery tokens respectively. Vault clusters with integrated storage will now have read-after-write consistency by default. [[GH-14109](https://github.com/hashicorp/vault/pull/14109)]
+* **Transit SHA-3 Support**: Add support for SHA-3 in the Transit backend. [[GH-13367](https://github.com/hashicorp/vault/pull/13367)]
+* **Transit Time-Based Key Autorotation**: Add support for automatic, time-based key rotation to transit secrets engine, including in the UI. [[GH-13691](https://github.com/hashicorp/vault/pull/13691)]
+* **UI Client Count Improvements**: Restructures client count dashboard, making use of billing start date to improve accuracy. Adds mount-level distribution and filtering. [[GH-client-counts](https://github.com/hashicorp/vault/pull/client-counts)]
+* **Agent Telemetry**: The Vault Agent can now collect and return telemetry information at the `/agent/v1/metrics` endpoint.
+
+IMPROVEMENTS:
+
+* agent: Adds ability to configure specific user-assigned managed identities for Azure auto-auth. [[GH-14214](https://github.com/hashicorp/vault/pull/14214)]
+* agent: The `agent/v1/quit` endpoint can now be used to stop the Vault Agent remotely [[GH-14223](https://github.com/hashicorp/vault/pull/14223)]
+* api: Allow cloning `api.Client` tokens via `api.Config.CloneToken` or `api.Client.SetCloneToken()`. [[GH-13515](https://github.com/hashicorp/vault/pull/13515)]
+* api: Define constants for X-Vault-Forward and X-Vault-Inconsistent headers [[GH-14067](https://github.com/hashicorp/vault/pull/14067)]
+* api: Implements Login method in Go client libraries for GCP and Azure auth methods [[GH-13022](https://github.com/hashicorp/vault/pull/13022)]
+* api: Implements Login method in Go client libraries for LDAP auth methods [[GH-13841](https://github.com/hashicorp/vault/pull/13841)]
+* api: Trim newline character from wrapping token in logical.Unwrap from the api package [[GH-13044](https://github.com/hashicorp/vault/pull/13044)]
+* api: add api method for modifying raft autopilot configuration [[GH-12428](https://github.com/hashicorp/vault/pull/12428)]
+* api: respect WithWrappingToken() option during AppRole login authentication when used with secret ID specified from environment or from string [[GH-13241](https://github.com/hashicorp/vault/pull/13241)]
+* audit: The audit logs now contain the port used by the client [[GH-12790](https://github.com/hashicorp/vault/pull/12790)]
+* auth/aws: Enable region detection in the CLI by specifying the region as `auto` [[GH-14051](https://github.com/hashicorp/vault/pull/14051)]
+* auth/cert: Add certificate extensions as metadata [[GH-13348](https://github.com/hashicorp/vault/pull/13348)]
+* auth/jwt: The Authorization Code flow makes use of the Proof Key for Code Exchange (PKCE) extension. [[GH-13365](https://github.com/hashicorp/vault/pull/13365)]
+* auth/kubernetes: Added support for dynamically reloading short-lived tokens for better Kubernetes 1.21+ compatibility [[GH-13595](https://github.com/hashicorp/vault/pull/13595)]
+* auth/ldap: Add a response warning and server log whenever the config is accessed
+if `userfilter` doesn't consider `userattr` [[GH-14095](https://github.com/hashicorp/vault/pull/14095)]
+* auth/ldap: Add username to alias metadata [[GH-13669](https://github.com/hashicorp/vault/pull/13669)]
+* auth/ldap: Add username_as_alias configurable to change how aliases are named [[GH-14324](https://github.com/hashicorp/vault/pull/14324)]
+* auth/okta: Update [okta-sdk-golang](https://github.com/okta/okta-sdk-golang) dependency to version v2.9.1 for improved request backoff handling [[GH-13439](https://github.com/hashicorp/vault/pull/13439)]
+* auth/token: The `auth/token/revoke-accessor` endpoint is now idempotent and will
+not error out if the token has already been revoked. [[GH-13661](https://github.com/hashicorp/vault/pull/13661)]
+* auth: reading `sys/auth/:path` now returns the configuration for the auth engine mounted at the given path [[GH-12793](https://github.com/hashicorp/vault/pull/12793)]
+* cli: interactive CLI for login mfa [[GH-14131](https://github.com/hashicorp/vault/pull/14131)]
+* command (enterprise): "vault license get" now uses non-deprecated endpoint /sys/license/status
+* core/ha: Add new mechanism for keeping track of peers talking to active node, and new 'operator members' command to view them. [[GH-13292](https://github.com/hashicorp/vault/pull/13292)]
+* core/identity: Support updating an alias' `custom_metadata` to be empty. [[GH-13395](https://github.com/hashicorp/vault/pull/13395)]
+* core/pki: Support Y10K value in notAfter field to be compliant with IEEE 802.1AR-2018 standard [[GH-12795](https://github.com/hashicorp/vault/pull/12795)]
+* core/pki: Support Y10K value in notAfter field when signing non-CA certificates [[GH-13736](https://github.com/hashicorp/vault/pull/13736)]
+* core: Add duration and start_time to completed requests log entries [[GH-13682](https://github.com/hashicorp/vault/pull/13682)]
+* core: Add support to list password policies at `sys/policies/password` [[GH-12787](https://github.com/hashicorp/vault/pull/12787)]
+* core: Add support to list version history via API at `sys/version-history` and via CLI with `vault version-history` [[GH-13766](https://github.com/hashicorp/vault/pull/13766)]
+* core: Fixes code scanning alerts [[GH-13667](https://github.com/hashicorp/vault/pull/13667)]
+* core: Periodically test the health of connectivity to auto-seal backends [[GH-13078](https://github.com/hashicorp/vault/pull/13078)]
+* core: Reading `sys/mounts/:path` now returns the configuration for the secret engine at the given path [[GH-12792](https://github.com/hashicorp/vault/pull/12792)]
+* core: Replace "master key" terminology with "root key" [[GH-13324](https://github.com/hashicorp/vault/pull/13324)]
+* core: Small changes to ensure goroutines terminate in tests [[GH-14197](https://github.com/hashicorp/vault/pull/14197)]
+* core: Systemd unit file included with the Linux packages now sets the service type to notify. [[GH-14385](https://github.com/hashicorp/vault/pull/14385)]
+* core: Update github.com/prometheus/client_golang to fix security vulnerability CVE-2022-21698. [[GH-14190](https://github.com/hashicorp/vault/pull/14190)]
+* core: Vault now supports the PROXY protocol v2. Support for UNKNOWN connections
+has also been added to the PROXY protocol v1. [[GH-13540](https://github.com/hashicorp/vault/pull/13540)]
+* http (enterprise): Serve /sys/license/status endpoint within namespaces
+* identity/oidc: Adds a default OIDC provider [[GH-14119](https://github.com/hashicorp/vault/pull/14119)]
+* identity/oidc: Adds a default key for OIDC clients [[GH-14119](https://github.com/hashicorp/vault/pull/14119)]
+* identity/oidc: Adds an `allow_all` assignment that permits all entities to authenticate via an OIDC client [[GH-14119](https://github.com/hashicorp/vault/pull/14119)]
+* identity/oidc: Adds proof key for code exchange (PKCE) support to OIDC providers. [[GH-13917](https://github.com/hashicorp/vault/pull/13917)]
+* sdk: Add helper for decoding root tokens [[GH-10505](https://github.com/hashicorp/vault/pull/10505)]
+* secrets/azure: Adds support for rotate-root. [#70](https://github.com/hashicorp/vault-plugin-secrets-azure/pull/70) [[GH-13034](https://github.com/hashicorp/vault/pull/13034)]
+* secrets/consul: Add support for consul enterprise namespaces and admin partitions. [[GH-13850](https://github.com/hashicorp/vault/pull/13850)]
+* secrets/consul: Add support for consul roles. [[GH-14014](https://github.com/hashicorp/vault/pull/14014)]
+* secrets/database/influxdb: Switch/upgrade to the `influxdb1-client` module [[GH-12262](https://github.com/hashicorp/vault/pull/12262)]
+* secrets/database: Add database configuration parameter 'disable_escaping' for username and password when connecting to a database. [[GH-13414](https://github.com/hashicorp/vault/pull/13414)]
+* secrets/kv: add full secret path output to table-formatted responses [[GH-14301](https://github.com/hashicorp/vault/pull/14301)]
+* secrets/kv: add patch support for KVv2 key metadata [[GH-13215](https://github.com/hashicorp/vault/pull/13215)]
+* secrets/kv: add subkeys endpoint to retrieve a secret's stucture without its values [[GH-13893](https://github.com/hashicorp/vault/pull/13893)]
+* secrets/pki: Add ability to fetch individual certificate as DER or PEM [[GH-10948](https://github.com/hashicorp/vault/pull/10948)]
+* secrets/pki: Add count and duration metrics to PKI issue and revoke calls. [[GH-13889](https://github.com/hashicorp/vault/pull/13889)]
+* secrets/pki: Add error handling for error types other than UserError or InternalError [[GH-14195](https://github.com/hashicorp/vault/pull/14195)]
+* secrets/pki: Allow URI SAN templates in allowed_uri_sans when allowed_uri_sans_template is set to true. [[GH-10249](https://github.com/hashicorp/vault/pull/10249)]
+* secrets/pki: Allow other_sans in sign-intermediate and sign-verbatim [[GH-13958](https://github.com/hashicorp/vault/pull/13958)]
+* secrets/pki: Calculate the Subject Key Identifier as suggested in [RFC 5280, Section 4.2.1.2](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2). [[GH-11218](https://github.com/hashicorp/vault/pull/11218)]
+* secrets/pki: Restrict issuance of wildcard certificates via role parameter (`allow_wildcard_certificates`) [[GH-14238](https://github.com/hashicorp/vault/pull/14238)]
+* secrets/pki: Return complete chain (in `ca_chain` field) on calls to `pki/cert/ca_chain` [[GH-13935](https://github.com/hashicorp/vault/pull/13935)]
+* secrets/pki: Use application/pem-certificate-chain for PEM certificates, application/x-pem-file for PEM CRLs [[GH-13927](https://github.com/hashicorp/vault/pull/13927)]
+* secrets/pki: select appropriate signature algorithm for ECDSA signature on certificates. [[GH-11216](https://github.com/hashicorp/vault/pull/11216)]
+* secrets/ssh: Add support for generating non-RSA SSH CAs [[GH-14008](https://github.com/hashicorp/vault/pull/14008)]
+* secrets/ssh: Allow specifying multiple approved key lengths for a single algorithm [[GH-13991](https://github.com/hashicorp/vault/pull/13991)]
+* secrets/ssh: Use secure default for algorithm signer (rsa-sha2-256) with RSA SSH CA keys on new roles [[GH-14006](https://github.com/hashicorp/vault/pull/14006)]
+* secrets/transit: Don't abort transit encrypt or decrypt batches on single item failure. [[GH-13111](https://github.com/hashicorp/vault/pull/13111)]
+* storage/aerospike: Upgrade `aerospike-client-go` to v5.6.0. [[GH-12165](https://github.com/hashicorp/vault/pull/12165)]
+* storage/raft: Set InitialMmapSize to 100GB on 64bit architectures [[GH-13178](https://github.com/hashicorp/vault/pull/13178)]
+* storage/raft: When using retry_join stanzas, join against all of them in parallel. [[GH-13606](https://github.com/hashicorp/vault/pull/13606)]
+* sys/raw: Enhance sys/raw to read and write values that cannot be encoded in json. [[GH-13537](https://github.com/hashicorp/vault/pull/13537)]
+* ui: Add support for ECDSA and Ed25519 certificate views [[GH-13894](https://github.com/hashicorp/vault/pull/13894)]
+* ui: Add version diff view for KV V2 [[GH-13000](https://github.com/hashicorp/vault/pull/13000)]
+* ui: Added client side paging for namespace list view [[GH-13195](https://github.com/hashicorp/vault/pull/13195)]
+* ui: Adds flight icons to UI [[GH-12976](https://github.com/hashicorp/vault/pull/12976)]
+* ui: Adds multi-factor authentication support [[GH-14049](https://github.com/hashicorp/vault/pull/14049)]
+* ui: Allow static role credential rotation in Database secrets engines [[GH-14268](https://github.com/hashicorp/vault/pull/14268)]
+* ui: Display badge for all versions in secrets engine header [[GH-13015](https://github.com/hashicorp/vault/pull/13015)]
+* ui: Swap browser localStorage in favor of sessionStorage [[GH-14054](https://github.com/hashicorp/vault/pull/14054)]
+* ui: The integrated web terminal now accepts both `-f` and `--force` as aliases
+for `-force` for the `write` command. [[GH-13683](https://github.com/hashicorp/vault/pull/13683)]
+* ui: Transform advanced templating with encode/decode format support [[GH-13908](https://github.com/hashicorp/vault/pull/13908)]
+* ui: Updates ember blueprints to glimmer components [[GH-13149](https://github.com/hashicorp/vault/pull/13149)]
+* ui: customizes empty state messages for transit and transform [[GH-13090](https://github.com/hashicorp/vault/pull/13090)]
+
+BUG FIXES:
+
+* Fixed bug where auth method only considers system-identity when multiple identities are available. [#50](https://github.com/hashicorp/vault-plugin-auth-azure/pull/50) [[GH-14138](https://github.com/hashicorp/vault/pull/14138)]
+* activity log (enterprise): allow partial monthly client count to be accessed from namespaces [[GH-13086](https://github.com/hashicorp/vault/pull/13086)]
+* agent: Fixes bug where vault agent is unaware of the namespace in the config when wrapping token
+* api/client: Fixes an issue where the `replicateStateStore` was being set to `nil` upon consecutive calls to `client.SetReadYourWrites(true)`. [[GH-13486](https://github.com/hashicorp/vault/pull/13486)]
+* auth/approle: Fix regression where unset cidrlist is returned as nil instead of zero-length array. [[GH-13235](https://github.com/hashicorp/vault/pull/13235)]
+* auth/approle: Fix wrapping of nil errors in `login` endpoint [[GH-14107](https://github.com/hashicorp/vault/pull/14107)]
+* auth/github: Use the Organization ID instead of the Organization name to verify the org membership. [[GH-13332](https://github.com/hashicorp/vault/pull/13332)]
+* auth/kubernetes: Properly handle the migration of role storage entries containing an empty `alias_name_source` [[GH-13925](https://github.com/hashicorp/vault/pull/13925)]
+* auth/kubernetes: ensure valid entity alias names created for projected volume tokens [[GH-14144](https://github.com/hashicorp/vault/pull/14144)]
+* auth/oidc: Fixes OIDC auth from the Vault UI when using the implicit flow and `form_post` response mode. [[GH-13492](https://github.com/hashicorp/vault/pull/13492)]
+* cli: Fix using kv patch with older server versions that don't support HTTP PATCH. [[GH-13615](https://github.com/hashicorp/vault/pull/13615)]
+* core (enterprise): Fix a data race in logshipper.
+* core (enterprise): Workaround AWS CloudHSM v5 SDK issue not allowing read-only sessions
+* core/api: Fix overwriting of request headers when using JSONMergePatch. [[GH-14222](https://github.com/hashicorp/vault/pull/14222)]
+* core/identity: Address a data race condition between local updates to aliases and invalidations [[GH-13093](https://github.com/hashicorp/vault/pull/13093)]
+* core/identity: Address a data race condition between local updates to aliases and invalidations [[GH-13476](https://github.com/hashicorp/vault/pull/13476)]
+* core/token: Fix null token panic from 'v1/auth/token/' endpoints and return proper error response. [[GH-13233](https://github.com/hashicorp/vault/pull/13233)]
+* core/token: Fix null token_type panic resulting from 'v1/auth/token/roles/{role_name}' endpoint [[GH-13236](https://github.com/hashicorp/vault/pull/13236)]
+* core: Fix warnings logged on perf standbys re stored versions [[GH-13042](https://github.com/hashicorp/vault/pull/13042)]
+* core: `-output-curl-string` now properly sets cURL options for client and CA
+certificates. [[GH-13660](https://github.com/hashicorp/vault/pull/13660)]
+* core: add support for go-sockaddr templates in the top-level cluster_addr field [[GH-13678](https://github.com/hashicorp/vault/pull/13678)]
+* core: authentication to "login" endpoint for non-existent mount path returns permission denied with status code 403 [[GH-13162](https://github.com/hashicorp/vault/pull/13162)]
+* core: revert some unintentionally downgraded dependencies from 1.9.0-rc1 [[GH-13168](https://github.com/hashicorp/vault/pull/13168)]
+* ha (enterprise): Prevents performance standby nodes from serving and caching stale data immediately after performance standby election completes
+* http (enterprise): Always forward internal/counters endpoints from perf standbys to active node
+* http:Fix /sys/monitor endpoint returning streaming not supported [[GH-13200](https://github.com/hashicorp/vault/pull/13200)]
+* identity/oidc: Adds support for port-agnostic validation of loopback IP redirect URIs. [[GH-13871](https://github.com/hashicorp/vault/pull/13871)]
+* identity/oidc: Check for a nil signing key on rotation to prevent panics. [[GH-13716](https://github.com/hashicorp/vault/pull/13716)]
+* identity/oidc: Fixes inherited group membership when evaluating client assignments [[GH-14013](https://github.com/hashicorp/vault/pull/14013)]
+* identity/oidc: Fixes potential write to readonly storage on performance secondary clusters during key rotation [[GH-14426](https://github.com/hashicorp/vault/pull/14426)]
+* identity/oidc: Make the `nonce` parameter optional for the Authorization Endpoint of OIDC providers. [[GH-13231](https://github.com/hashicorp/vault/pull/13231)]
+* identity/token: Fixes a bug where duplicate public keys could appear in the .well-known JWKS [[GH-14543](https://github.com/hashicorp/vault/pull/14543)]
+* identity: Fix possible nil pointer dereference. [[GH-13318](https://github.com/hashicorp/vault/pull/13318)]
+* identity: Fix regression preventing startup when aliases were created pre-1.9. [[GH-13169](https://github.com/hashicorp/vault/pull/13169)]
+* identity: Fixes a panic in the OIDC key rotation due to a missing nil check. [[GH-13298](https://github.com/hashicorp/vault/pull/13298)]
+* kmip (enterprise): Fix locate by name operations fail to find key after a rekey operation.
+* licensing (enterprise): Revert accidental inclusion of the TDE feature from the `prem` build.
+* metrics/autosnapshots (enterprise) : Fix bug that could cause
+vault.autosnapshots.save.errors to not be incremented when there is an
+autosnapshot save error.
+* physical/mysql: Create table with wider `vault_key` column when initializing database tables. [[GH-14231](https://github.com/hashicorp/vault/pull/14231)]
+* plugin/couchbase: Fix an issue in which the locking patterns did not allow parallel requests. [[GH-13033](https://github.com/hashicorp/vault/pull/13033)]
+* replication (enterprise): When using encrypted secondary tokens, only clear the
+private key after a successful connection to the primary cluster
+* sdk/framework: Generate proper OpenAPI specs for path patterns that use an alternation as the root. [[GH-13487](https://github.com/hashicorp/vault/pull/13487)]
+* sdk/helper/ldaputil: properly escape a trailing escape character to prevent panics. [[GH-13452](https://github.com/hashicorp/vault/pull/13452)]
+* sdk/queue: move lock before length check to prevent panics. [[GH-13146](https://github.com/hashicorp/vault/pull/13146)]
+* sdk: Fixes OpenAPI to distinguish between paths that can do only List, or both List and Read. [[GH-13643](https://github.com/hashicorp/vault/pull/13643)]
+* secrets/azure: Fixed bug where Azure environment did not change Graph URL [[GH-13973](https://github.com/hashicorp/vault/pull/13973)]
+* secrets/azure: Fixes service principal generation when assigning roles that have [DataActions](https://docs.microsoft.com/en-us/azure/role-based-access-control/role-definitions#dataactions). [[GH-13277](https://github.com/hashicorp/vault/pull/13277)]
+* secrets/azure: Fixes the [rotate root](https://www.vaultproject.io/api-docs/secret/azure#rotate-root)
+operation for upgraded configurations with a `root_password_ttl` of zero. [[GH-14130](https://github.com/hashicorp/vault/pull/14130)]
+* secrets/database/cassandra: change connect_timeout to 5s as documentation says [[GH-12443](https://github.com/hashicorp/vault/pull/12443)]
+* secrets/database/mssql: Accept a boolean for `contained_db`, rather than just a string. [[GH-13469](https://github.com/hashicorp/vault/pull/13469)]
+* secrets/gcp: Fixed bug where error was not reported for invalid bindings [[GH-13974](https://github.com/hashicorp/vault/pull/13974)]
+* secrets/gcp: Fixes role bindings for BigQuery dataset resources. [[GH-13548](https://github.com/hashicorp/vault/pull/13548)]
+* secrets/openldap: Fix panic from nil logger in backend [[GH-14171](https://github.com/hashicorp/vault/pull/14171)]
+* secrets/pki: Default value for key_bits changed to 0, enabling key_type=ec key generation with default value [[GH-13080](https://github.com/hashicorp/vault/pull/13080)]
+* secrets/pki: Fix issuance of wildcard certificates matching glob patterns [[GH-14235](https://github.com/hashicorp/vault/pull/14235)]
+* secrets/pki: Fix regression causing performance secondaries to forward certificate generation to the primary. [[GH-13759](https://github.com/hashicorp/vault/pull/13759)]
+* secrets/pki: Fix regression causing performance secondaries to forward certificate generation to the primary. [[GH-2456](https://github.com/hashicorp/vault/pull/2456)]
+* secrets/pki: Fixes around NIST P-curve signature hash length, default value for signature_bits changed to 0. [[GH-12872](https://github.com/hashicorp/vault/pull/12872)]
+* secrets/pki: Recognize ed25519 when requesting a response in PKCS8 format [[GH-13257](https://github.com/hashicorp/vault/pull/13257)]
+* secrets/pki: Skip signature bits validation for ed25519 curve key type [[GH-13254](https://github.com/hashicorp/vault/pull/13254)]
+* secrets/transit: Ensure that Vault does not panic for invalid nonce size when we aren't in convergent encryption mode. [[GH-13690](https://github.com/hashicorp/vault/pull/13690)]
+* secrets/transit: Return an error if any required parameter is missing. [[GH-14074](https://github.com/hashicorp/vault/pull/14074)]
+* storage/raft: Fix a panic when trying to store a key > 32KB in a transaction. [[GH-13286](https://github.com/hashicorp/vault/pull/13286)]
+* storage/raft: Fix a panic when trying to write a key > 32KB [[GH-13282](https://github.com/hashicorp/vault/pull/13282)]
+* storage/raft: Fix issues allowing invalid nodes to become leadership candidates. [[GH-13703](https://github.com/hashicorp/vault/pull/13703)]
+* storage/raft: Fix regression in 1.9.0-rc1 that changed how time is represented in Raft logs; this prevented using a raft db created pre-1.9. [[GH-13165](https://github.com/hashicorp/vault/pull/13165)]
+* storage/raft: On linux, use map_populate for bolt files to improve startup time. [[GH-13573](https://github.com/hashicorp/vault/pull/13573)]
+* storage/raft: Units for bolt metrics now given in milliseconds instead of nanoseconds [[GH-13749](https://github.com/hashicorp/vault/pull/13749)]
+* ui: Adds pagination to auth methods list view [[GH-13054](https://github.com/hashicorp/vault/pull/13054)]
+* ui: Do not show verify connection value on database connection config page [[GH-13152](https://github.com/hashicorp/vault/pull/13152)]
+* ui: Fix client count current month data not showing unless monthly history data exists [[GH-13396](https://github.com/hashicorp/vault/pull/13396)]
+* ui: Fix default TTL display and set on database role [[GH-14224](https://github.com/hashicorp/vault/pull/14224)]
+* ui: Fix incorrect validity message on transit secrets engine [[GH-14233](https://github.com/hashicorp/vault/pull/14233)]
+* ui: Fix issue where UI incorrectly handled API errors when mounting backends [[GH-14551](https://github.com/hashicorp/vault/pull/14551)]
+* ui: Fix kv engine access bug [[GH-13872](https://github.com/hashicorp/vault/pull/13872)]
+* ui: Fixes breadcrumb bug for secrets navigation [[GH-13604](https://github.com/hashicorp/vault/pull/13604)]
+* ui: Fixes caching issue on kv new version create [[GH-14489](https://github.com/hashicorp/vault/pull/14489)]
+* ui: Fixes displaying empty masked values in PKI engine [[GH-14400](https://github.com/hashicorp/vault/pull/14400)]
+* ui: Fixes horizontal bar chart hover issue when filtering namespaces and mounts [[GH-14493](https://github.com/hashicorp/vault/pull/14493)]
+* ui: Fixes issue logging out with wrapped token query parameter [[GH-14329](https://github.com/hashicorp/vault/pull/14329)]
+* ui: Fixes issue removing raft storage peer via cli not reflected in UI until refresh [[GH-13098](https://github.com/hashicorp/vault/pull/13098)]
+* ui: Fixes issue restoring raft storage snapshot [[GH-13107](https://github.com/hashicorp/vault/pull/13107)]
+* ui: Fixes issue saving KMIP role correctly [[GH-13585](https://github.com/hashicorp/vault/pull/13585)]
+* ui: Fixes issue with OIDC auth workflow when using MetaMask Chrome extension [[GH-13133](https://github.com/hashicorp/vault/pull/13133)]
+* ui: Fixes issue with SearchSelect component not holding focus [[GH-13590](https://github.com/hashicorp/vault/pull/13590)]
+* ui: Fixes issue with automate secret deletion value not displaying initially if set in secret metadata edit view [[GH-13177](https://github.com/hashicorp/vault/pull/13177)]
+* ui: Fixes issue with correct auth method not selected when logging out from OIDC or JWT methods [[GH-14545](https://github.com/hashicorp/vault/pull/14545)]
+* ui: Fixes issue with placeholder not displaying for automatically deleted secrets when deletion time has passed [[GH-13166](https://github.com/hashicorp/vault/pull/13166)]
+* ui: Fixes issue with the number of PGP Key inputs not matching the key shares number in the initialization form on change [[GH-13038](https://github.com/hashicorp/vault/pull/13038)]
+* ui: Fixes long secret key names overlapping masked values [[GH-13032](https://github.com/hashicorp/vault/pull/13032)]
+* ui: Fixes node-forge error when parsing EC (elliptical curve) certs [[GH-13238](https://github.com/hashicorp/vault/pull/13238)]
+* ui: Redirects to managed namespace if incorrect namespace in URL param [[GH-14422](https://github.com/hashicorp/vault/pull/14422)]
+* ui: Removes ability to tune token_type for token auth methods [[GH-12904](https://github.com/hashicorp/vault/pull/12904)]
+* ui: trigger token renewal if inactive and half of TTL has passed [[GH-13950](https://github.com/hashicorp/vault/pull/13950)]
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2625d29e797..5a5719bcf0b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3845 +1,3303 @@
 ## Previous versions
+- [v1.10.0 - v1.15.16](CHANGELOG-v1.10-v1.15.md)
 - [v1.0.0 - v1.9.10](CHANGELOG-pre-v1.10.md)
 - [v0.11.6 and earlier](CHANGELOG-v0.md)
 
-## 1.16.0-rc2
-### February 21, 2024
+## 1.21.0
+### October 22, 2025
 
 SECURITY:
 
-* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [[GH-22852](https://github.com/hashicorp/vault/pull/22852)]
+* auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
+* auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled.
+* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3.
+* core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27.
+* ui: disable scarf analytics for ui builds
 
 CHANGES:
 
-* Upgrade grpc to v1.58.3 [[GH-23703](https://github.com/hashicorp/vault/pull/23703)]
-* Upgrade x/net to v0.17.0 [[GH-23703](https://github.com/hashicorp/vault/pull/23703)]
-* api: add the `enterprise` parameter to the `/sys/health` endpoint [[GH-24270](https://github.com/hashicorp/vault/pull/24270)]
-* auth/alicloud: Update plugin to v0.17.0 [[GH-25217](https://github.com/hashicorp/vault/pull/25217)]
-* auth/approle: Normalized error response messages when invalid credentials are provided [[GH-23786](https://github.com/hashicorp/vault/pull/23786)]
-* auth/azure: Update plugin to v0.17.0 [[GH-25258](https://github.com/hashicorp/vault/pull/25258)]
-* auth/cf: Update plugin to v0.16.0 [[GH-25196](https://github.com/hashicorp/vault/pull/25196)]
-* auth/gcp: Update plugin to v0.16.2 [[GH-25233](https://github.com/hashicorp/vault/pull/25233)]
-* auth/jwt: Update plugin to v0.20.0 [[GH-25326](https://github.com/hashicorp/vault/pull/25326)]
-* auth/kerberos: Update plugin to v0.11.0 [[GH-25232](https://github.com/hashicorp/vault/pull/25232)]
-* auth/kubernetes: Update plugin to v0.18.0 [[GH-25207](https://github.com/hashicorp/vault/pull/25207)]
-* auth/oci: Update plugin to v0.15.1 [[GH-25245](https://github.com/hashicorp/vault/pull/25245)]
-* cli: Using `vault plugin reload` with `-plugin` in the root namespace will now reload the plugin across all namespaces instead of just the root namespace. [[GH-24878](https://github.com/hashicorp/vault/pull/24878)]
-* cli: `vault plugin info` and `vault plugin deregister` now require 2 positional arguments instead of accepting either 1 or 2. [[GH-24250](https://github.com/hashicorp/vault/pull/24250)]
-* core: Bump Go version to 1.21.5.
-* database/couchbase: Update plugin to v0.10.1 [[GH-25275](https://github.com/hashicorp/vault/pull/25275)]
-* database/elasticsearch: Update plugin to v0.14.0 [[GH-25263](https://github.com/hashicorp/vault/pull/25263)]
-* database/mongodbatlas: Update plugin to v0.11.0 [[GH-25264](https://github.com/hashicorp/vault/pull/25264)]
-* database/redis-elasticache: Update plugin to v0.3.0 [[GH-25296](https://github.com/hashicorp/vault/pull/25296)]
-* database/redis: Update plugin to v0.2.3 [[GH-25289](https://github.com/hashicorp/vault/pull/25289)]
-* database/snowflake: Update plugin to v0.10.0 [[GH-25143](https://github.com/hashicorp/vault/pull/25143)]
-* events: Source URL is now `vault://{vault node}` [[GH-24201](https://github.com/hashicorp/vault/pull/24201)]
-* identity (enterprise): POST requests to the `/identity/entity/merge` endpoint
-are now always forwarded from standbys to the active node. [[GH-24325](https://github.com/hashicorp/vault/pull/24325)]
-* plugins/database: Reading connection config at `database/config/:name` will now return a computed `running_plugin_version` field if a non-builtin version is running. [[GH-25105](https://github.com/hashicorp/vault/pull/25105)]
-* plugins: Add a warning to the response from sys/plugins/reload/backend if no plugins were reloaded. [[GH-24512](https://github.com/hashicorp/vault/pull/24512)]
-* plugins: By default, environment variables provided during plugin registration will now take precedence over system environment variables. Use the environment variable `VAULT_PLUGIN_USE_LEGACY_ENV_LAYERING=true` to opt out and keep higher preference for system environment variables. When this flag is set, Vault will check during unseal for conflicts and print warnings for any plugins with environment variables that conflict with system environment variables. [[GH-25128](https://github.com/hashicorp/vault/pull/25128)]
-* plugins: `/sys/plugins/runtimes/catalog` response will always include a list of "runtimes" in the response, even if empty. [[GH-24864](https://github.com/hashicorp/vault/pull/24864)]
-* sdk: Upgrade dependent packages by sdk. This includes github.com/docker/docker to v24.0.7+incompatible,
-google.golang.org/grpc to  v1.57.2 and golang.org/x/net to v0.17.0. [[GH-23913](https://github.com/hashicorp/vault/pull/23913)]
-* secrets/ad: Update plugin to v0.17.0 [[GH-25187](https://github.com/hashicorp/vault/pull/25187)]
-* secrets/alicloud: Update plugin to v0.16.0 [[GH-25257](https://github.com/hashicorp/vault/pull/25257)]
-* secrets/azure: Update plugin to v0.17.0 [[GH-25189](https://github.com/hashicorp/vault/pull/25189)]
-* secrets/gcp: Update plugin to v0.18.0 [[GH-25173](https://github.com/hashicorp/vault/pull/25173)]
-* secrets/gcpkms: Update plugin to v0.16.0 [[GH-25231](https://github.com/hashicorp/vault/pull/25231)]
-* secrets/keymgmt: Update plugin to v0.10.0
-* secrets/kubernetes: Update plugin to v0.7.0 [[GH-25204](https://github.com/hashicorp/vault/pull/25204)]
-* secrets/kv: Update plugin to v0.17.0 [[GH-25277](https://github.com/hashicorp/vault/pull/25277)]
-* secrets/mongodbatlas: Update plugin to v0.11.0 [[GH-25253](https://github.com/hashicorp/vault/pull/25253)]
-* secrets/openldap: Update plugin to v0.11.3 [[GH-25040](https://github.com/hashicorp/vault/pull/25040)]
-* secrets/openldap: Update plugin to v0.12.0 [[GH-25251](https://github.com/hashicorp/vault/pull/25251)]
-* secrets/openldap: Update plugin to v0.12.1 [[GH-25524](https://github.com/hashicorp/vault/pull/25524)]
-* secrets/terraform: Update plugin to v0.7.5 [[GH-25288](https://github.com/hashicorp/vault/pull/25288)]
-* telemetry: Seal wrap encrypt/decrypt metrics now differentiate between seals using a metrics label of seal name rather than separate metric names. [[GH-23837](https://github.com/hashicorp/vault/pull/23837)]
-* ui: Update icons to use Flight icons where available. [[GH-24823](https://github.com/hashicorp/vault/pull/24823)]
-* ui: add subnav for replication items [[GH-24283](https://github.com/hashicorp/vault/pull/24283)]
+* Secrets Recovery (enterprise): Deprecate the `recover_snapshot_id` query parameter to pass the snapshot ID for recover operations, in favor of a `X-Vault-Recover-Snapshot-Id` header. Vault will still accept the query parameter for backward compatibility. Also support setting the HTTP method to `RECOVER` for recover operations, in addition to `POST` and `PUT`.
+* activity: Renamed `timestamp` in export API response to `token_creation_time`.
+* auth/alicloud: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-alicloud/releases/tag/v0.22.0)
+* auth/azure: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-azure/releases/tag/v0.22.0)
+* auth/cf: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-cf/releases/tag/v0.22.0)
+* auth/gcp: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-gcp/releases/tag/v0.22.0)
+* auth/jwt: Update plugin to [v0.25.0](https://github.com/hashicorp/vault-plugin-auth-jwt/releases/tag/v0.25.0)
+* auth/kerberos: Update plugin to [v0.16.0](https://github.com/hashicorp/vault-plugin-auth-kerberos/releases/tag/v0.16.0)
+* auth/kubernetes: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-auth-kubernetes/releases/tag/v0.23.0)
+* auth/oci: Update plugin to [v0.20.0](https://github.com/hashicorp/vault-plugin-auth-oci/releases/tag/v0.20.0)
+* auth/saml: Update plugin to [v0.7.0](https://github.com/hashicorp/vault-plugin-auth-saml/releases/tag/v0.7.0)
+* core: Updates post-install script to print updated license information
+* database/couchbase: Update plugin to [v0.15.0](https://github.com/hashicorp/vault-plugin-database-couchbase/releases/tag/v0.15.0)
+* database/elasticsearch: Update plugin to [v0.19.0](https://github.com/hashicorp/vault-plugin-database-elasticsearch/releases/tag/v0.19.0)
+* database/mongodbatlas: Update plugin to [v0.16.0](https://github.com/hashicorp/vault-plugin-database-mongodbatlas/releases/tag/v0.16.0)
+* database/redis-elasticache: Update plugin to [v0.8.0](https://github.com/hashicorp/vault-plugin-database-redis-elasticache/releases/tag/v0.8.0)
+* database/redis: Update plugin to [v0.7.0](https://github.com/hashicorp/vault-plugin-database-redis/releases/tag/v0.7.0)
+* database/snowflake: Update plugin to [v0.15.0](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.15.0)
+* http: Add JSON configurable limits to HTTP handling for JSON payloads: `max_json_depth`, `max_json_string_value_length`, `max_json_object_entry_count`, `max_json_array_element_count`.
+* http: Evaluate rate limit quotas before checking JSON limits during request handling.
+* policies: change list comparison to allowed_parameters and denied_parameters from "exact match" to "contains all"
+* sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible
+* secrets/alicloud: Update plugin to [v0.21.0](https://github.com/hashicorp/vault-plugin-secrets-alicloud/releases/tag/v0.21.0)
+* secrets/azure: Update azure enterprise secrets plugin to include static roles.
+* secrets/azure: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-secrets-azure/releases/tag/v0.23.0)
+* secrets/gcp: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-secrets-gcp/releases/tag/v0.23.0)
+* secrets/kubernetes: Update plugin to [v0.12.0](https://github.com/hashicorp/vault-plugin-secrets-kubernetes/releases/tag/v0.12.0)
+* secrets/kv: Update plugin to [v0.25.0](https://github.com/hashicorp/vault-plugin-secrets-kv/releases/tag/v0.25.0)
+* secrets/mongodbatlas: Update plugin to [v0.16.0](https://github.com/hashicorp/vault-plugin-secrets-mongodbatlas/releases/tag/v0.16.0)
+* secrets/openldap: Update plugin to [v0.17.0](https://github.com/hashicorp/vault-plugin-secrets-openldap/releases/tag/v0.17.0)
+* secrets/terraform: Update plugin to [v0.13.0](https://github.com/hashicorp/vault-plugin-secrets-terraform/releases/tag/v0.13.0)
+* ui/client-counts: removes tabs for each client count type and adds split view for counts per type in overview stacked bar chart
+* ui: Add client count attribution for the full billing period to the client counts overview table
+* ui: Remove namespace context filter for activity in client count dashboard
 
 FEATURES:
 
-* **Audit Filtering**: Audit devices support expression-based filter rules (powered by go-bexpr) to determine which entries are written to the audit log. [[GH-24558](https://github.com/hashicorp/vault/pull/24558)]
-* **Custom Messages**: Introduces custom messages settings, allowing users to view, and operators to configure system-wide messages. [[GH-23945](https://github.com/hashicorp/vault/pull/23945)]
-* **Database Event Notifications**: The database plugin now emits event notifications. [[GH-24718](https://github.com/hashicorp/vault/pull/24718)]
-* **Default Lease Count Quota**: Apply a new global default lease count quota of 300k leases for all
-new installs of Vault. [[GH-24382](https://github.com/hashicorp/vault/pull/24382)]
-* **Manual License Utilization Reporting**: Added manual license
-utilization reporting, which allows users to create manual exports of product-license [metering
-data] to report to Hashicorp.
-* **Plugin Identity Tokens**: Adds secret-less configuration of AWS secret engine using web identity federation. [[GH-24987](https://github.com/hashicorp/vault/pull/24987)]
-* **Plugin Workload Identity**: Vault can generate identity tokens for plugins to use in workload identity federation auth flows. [[GH-25219](https://github.com/hashicorp/vault/pull/25219)]
-* **Quotas in Privileged Namespaces**: Enable creation/update/deletion of quotas from the privileged namespace [[GH-24040](https://github.com/hashicorp/vault/pull/24040)]
-* **Quotas in Privileged Namespaces**: Enable creation/update/deletion of quotas from the privileged namespace
-* **Reload seal configuration on SIGHUP**: Seal configuration is reloaded on SIGHUP so that seal configuration can
-be changed without shutting down vault [[GH-23571](https://github.com/hashicorp/vault/pull/23571)]
-* **Request Limiter**: Add adaptive concurrency limits to write-based HTTP
-methods and special-case `pki/issue` requests to prevent overloading the Vault
-server. [[GH-25093](https://github.com/hashicorp/vault/pull/25093)]
-* **Rotate Root for LDAP auth**: Rotate root operations are now supported for the LDAP auth engine. [[GH-24099](https://github.com/hashicorp/vault/pull/24099)]
-* **Seal High Availability (enterprise)**: Operators can configure more than one automatic seal for resilience against seal provider outages.
-* **Secrets Sync UI (enterprise)**: Adds secret syncing for KV v2 secrets to external destinations using the UI. [[GH-23667](https://github.com/hashicorp/vault/pull/23667)]
-* **Vault PKI EST Server (Enterprise/Beta)**: Beta support for the PKI Enrollment over Secure Transport (EST) certificate management protocol has been added to the Vault PKI Plugin. This allows standard EST clients to request certificates from a Vault server with no knowledge of Vault APIs.
-* **Vault Proxy Static Secret Caching**: Adds support for static secret (KVv1 and KVv2) caching to Vault Proxy. [[GH-23621](https://github.com/hashicorp/vault/pull/23621)]
-* **raft-wal**: Add experimental support for raft-wal, a new backend engine for integrated storage. [[GH-21460](https://github.com/hashicorp/vault/pull/21460)]
-* **secrets-import (enterprise)**: Support importing secrets from external sources into KVv2
-* **secrets/aws**: Support issuing an STS Session Token directly from the root credential. [[GH-23690](https://github.com/hashicorp/vault/pull/23690)]
-* **cli/snapshot**: Add CLI tool to inspect Vault snapshots [[GH-23457](https://github.com/hashicorp/vault/pull/23457)]
-* **cli**: introduce new command group hcp which groups subcommands for authentication of users or machines to HCP using
-either provided arguments or retrieved HCP token through browser login. [[GH-23897](https://github.com/hashicorp/vault/pull/23897)]
-* **config/listener**: allow per-listener configuration setting to disable replication status endpoints. [[GH-23547](https://github.com/hashicorp/vault/pull/23547)]
-* **config/listener**: allow per-listener configuration settings to redact sensitive parts of response to unauthenticated endpoints. [[GH-23534](https://github.com/hashicorp/vault/pull/23534)]
-* **core**: add sys/internal/ui/version endpoint [[GH-23740](https://github.com/hashicorp/vault/pull/23740)]
-* **sys (enterprise)**: Enable sys/config/group-application-policy in privileged namespace
+* **AES-CBC in Transit** (Enterprise): Add support for encryption and decryption with AES-CBC in the Transit Secrets Engine.
+* **KV v2 Version Attribution**: Vault now includes attribution metadata for
+versioned KV secrets. This allows lookup of attribution information for each
+version of KV v2 secrets from CLI and API.
+* **Login MFA TOTP Self-Enrollment (Enterprise)**: Simplify creation of login MFA TOTP credentials for users, allowing them to self-enroll MFA TOTP using a QR code (TOTP secret) generated during login. The new functionality is configurable on the TOTP login MFA method configuration screen and via the `enable_self_enrollment` parameter in the API.
+* **Plugin Downloads**: Support automatically downloading official HashiCorp secret and auth plugins from releases.hashicorp.com (beta)
+* **Post-Quantum Cryptography Support**: Experimental support for PQC signatures with ML-DSA in Transit.
+* **Post-Quantum Cryptography Support**: Experimental support for PQC signatures with SLH-DSA in Transit.
+* **SPIFFE Authentication Plugin (enterprise)**: Add support to authenticate to Vault using JWT and x509 based SPIFFE IDs.
+* **SSH Key Signing Improvements ** (Enterprise): Add support for using managed keys to sign SSH keys in the SSH secrets engine.
+* **Secret Recovery from Snapshot (enterprise)**: Adds a framework to load an integrated storage snapshot into Vault and read, list, and recover KV v1 and cubbyhole secrets from the snapshot.
+* **UI Client List Explorer (Enterprise)**: Adds ability to view and filter client IDs and metadata by namespace, mount path, or mount type for a billing period.
+* **UI Secrets Recovery (Enterprise)**: Allows end users to recover single KV v1 secrets, Cubbyhole secrets, or Database static roles from a loaded snapshot if the secrets were changed or deleted in error. Automatic snapshot configurations can now automatically load the snapshot to Vault itself, making it available for recovery. Snapshot management permissions are separated from recovery permissions so that recovery operations can be delegated but controlled.
+* **UI: Secret Engine Tune Support**: Add support for updating secret engine mount configuration via the Tune endpoint
+* **Vault PKI SCEP Server (Enterprise)**: Support for the Simple Certificate Enrollment Protocol (SCEP) has been added to the Vault PKI Plugin. This allows standard SCEP clients to request certificates from a Vault server with no knowledge of Vault APIs.
 
 IMPROVEMENTS:
 
-* .release/linux: add LimitCORE=0 to vault.service [[GH-23272](https://github.com/hashicorp/vault/pull/23272)]
-* agent/template: Added max_connections_per_host to limit total number of connections per Vault host. [[GH-24548](https://github.com/hashicorp/vault/pull/24548)]
-* agent: Added new namespace top level configuration parameter, which can be used to make requests made by Agent to go to that namespace. [[GH-24667](https://github.com/hashicorp/vault/pull/24667)]
-* agent: allow users to specify files for child process stdout/stderr [[GH-22812](https://github.com/hashicorp/vault/pull/22812)]
-* api (enterprise): Enable the sys/license/features from any namespace
-* api/plugins: add `tls-server-name` arg for plugin registration [[GH-23549](https://github.com/hashicorp/vault/pull/23549)]
-* api: added new API field to Vault responses, `mount_type`, returning mount information (e.g. `kv` for KVV1/KVV2) for mount when appropriate. [[GH-23047](https://github.com/hashicorp/vault/pull/23047)]
-* api: sys/health and sys/ha-status now expose information about how long
-the last heartbeat took, and the estimated clock skew between standby and
-active node based on that heartbeat duration. [[GH-24343](https://github.com/hashicorp/vault/pull/24343)]
-* auth/cert: Cache trusted certs to reduce memory usage and improve performance of logins. [[GH-25421](https://github.com/hashicorp/vault/pull/25421)]
-* auth/ldap: introduce cap/ldap.Client for LDAP authentication
-auth/ldap: deprecates `connection_timeout` in favor of `request_timeout` for timeouts
-sdk/ldaputil: deprecates Client in favor of cap/ldap.Client [[GH-22185](https://github.com/hashicorp/vault/pull/22185)]
-* auth/saml: Update plugin to v0.2.0
-* auto-auth/azure: Support setting the `authenticate_from_environment` variable to "true" and "false" string literals, too. [[GH-22996](https://github.com/hashicorp/vault/pull/22996)]
-* cli: Improved error messages for `vault plugin` sub-commands. [[GH-24250](https://github.com/hashicorp/vault/pull/24250)]
-* cli: adds plugin identity token to enable and tune commands for secret engines and auth methods [[GH-24980](https://github.com/hashicorp/vault/pull/24980)]
-* command/server: display logs on startup immediately if disable-gated-logs flag is set [[GH-24280](https://github.com/hashicorp/vault/pull/24280)]
-* command/token-capabilities: allow using accessor when listing token capabilities on a path [[GH-24479](https://github.com/hashicorp/vault/pull/24479)]
-* core (enterprise): Avoid seal rewrapping in some specific unnecessary cases.
-* core (enterprise): Improve seal unwrap performance when in degraded mode with one or more unhealthy seals. [[GH-25171](https://github.com/hashicorp/vault/pull/25171)]
-* core (enterprise): Speed up unseal when using namespaces
-* core/activity: Include secret_syncs in activity log responses [[GH-24710](https://github.com/hashicorp/vault/pull/24710)]
-* core/cli: Warning related to VAULT_ADDR & -address not set with CLI requests. [[GH-17076](https://github.com/hashicorp/vault/pull/17076)]
-* core: Added new `plugin_tmpdir` config option for containerized plugins, in addition to the existing `VAULT_PLUGIN_TMPDIR` environment variable. [[GH-24978](https://github.com/hashicorp/vault/pull/24978)]
-* core: update sys/seal-status (and CLI vault status) to report the type of
-the seal when unsealed, as well as the type of the recovery seal if an
-auto-seal. [[GH-23022](https://github.com/hashicorp/vault/pull/23022)]
-* events: Add support for event subscription plugins, including SQS [[GH-24352](https://github.com/hashicorp/vault/pull/24352)]
-* identity/tokens: adds plugin issuer with openid-configuration and keys APIs [[GH-24898](https://github.com/hashicorp/vault/pull/24898)]
-* limits: Add a listener configuration option `disable_request_limiter` to allow
-disabling the request limiter per-listener. [[GH-25098](https://github.com/hashicorp/vault/pull/25098)]
-* limits: Introduce a reloadable opt-in configuration for the Request Limiter. [[GH-25095](https://github.com/hashicorp/vault/pull/25095)]
-* oidc/provider: Adds `code_challenge_methods_supported` to OpenID Connect Metadata [[GH-24979](https://github.com/hashicorp/vault/pull/24979)]
-* plugins: Add new pin version APIs to enforce all plugins of a specific type and name to run the same version. [[GH-25105](https://github.com/hashicorp/vault/pull/25105)]
-* plugins: Containerized plugins can be run fully rootless with the runsc runtime. [[GH-24236](https://github.com/hashicorp/vault/pull/24236)]
-* plugins: New API `sys/plugins/reload/:type/:name` available in the root namespace for reloading a specific plugin across all namespaces. [[GH-24878](https://github.com/hashicorp/vault/pull/24878)]
-* proxy: Added new namespace top level configuration parameter, and prepend_configured_namespace API Proxy configuration parameter, which can be used to make requests made to Proxy get proxied to that namespace. [[GH-24667](https://github.com/hashicorp/vault/pull/24667)]
-* replication (enterprise): Add last_upstream_remote_wal metric to telemetry and stop emitting last_remote_wal on standby nodes
-* replication (enterprise): Add re-index status metric to telemetry
-* replication: Add re-index status metric to telemetry [[GH-23160](https://github.com/hashicorp/vault/pull/23160)]
-* sdk/plugin: Fix an issue where external plugins were not reporting logs below INFO level [[GH-23771](https://github.com/hashicorp/vault/pull/23771)]
-* sdk: Add identity token helpers to consistently apply new plugin WIF fields across integrations. [[GH-24925](https://github.com/hashicorp/vault/pull/24925)]
-* sdk: adds new method to system view to allow plugins to request identity tokens [[GH-24929](https://github.com/hashicorp/vault/pull/24929)]
-* secrets-sync (enterprise): Add ability to turn the sync system on and off
-* secrets-sync (enterprise): Add reconciliation loop
-* secrets-sync (enterprise): Added PATCH request on the sync destinations API
-* secrets-sync (enterprise): Added delete request to reset global config to factory defaults
-* secrets-sync (enterprise): Added field to define custom tags to add on synced secrets
-* secrets-sync (enterprise): Added telemetry on number of destinations and associations per type.
-* secrets-sync (enterprise): Adds ability to set target GCP project ID to sync secrets with
-* secrets-sync (enterprise): Adjusted associations list responses to be more CLI-friendly
-* secrets-sync (enterprise): Adjusted destination list responses to be more CLI-friendly & added endpoint to list destinations by type.
-* secrets-sync (enterprise): Clean up membdb tests
-* secrets-sync (enterprise): Support AWS IAM assume role and external ID
-* secrets-sync (enterprise): Support custom GitHub apps
-* secrets-sync (enterprise): Support custom templating of external secret names
-* secrets-sync (enterprise): Support granular secrets syncing
-* secrets-sync (enterprise): add purge field to the destination delete endpoint
-* secrets/database: Add new reload/:plugin_name API to reload database plugins by name for a specific mount. [[GH-24472](https://github.com/hashicorp/vault/pull/24472)]
-* secrets/database: Support reloading named database plugins using the sys/plugins/reload/backend API endpoint. [[GH-24512](https://github.com/hashicorp/vault/pull/24512)]
-* secrets/pki: do not check TLS validity on ACME requests redirected to https [[GH-22521](https://github.com/hashicorp/vault/pull/22521)]
-* storage/etcd: etcd should only return keys when calling List() [[GH-23872](https://github.com/hashicorp/vault/pull/23872)]
-* storage/raft (enterprise): Replication WAL batches may now contain up to 4096
-entries rather than being limited to 62 like Consul is. Performance testing
-shows improvements in throughput and latency under some write-heavy workloads.
-* storage/raft: Add support for larger transactions when using raft storage. [[GH-24991](https://github.com/hashicorp/vault/pull/24991)]
-* storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [[GH-24010](https://github.com/hashicorp/vault/pull/24010)]
-* sys (enterprise): Adds the chroot_namespace field to this sys/internal/ui/resultant-acl endpoint, which exposes the value of the chroot namespace from the
-listener config.
-* sys: adds configuration of the key used to sign plugin identity tokens during mount enable and tune [[GH-24962](https://github.com/hashicorp/vault/pull/24962)]
-* ui: Add `deletion_allowed` param to transformations and include `tokenization` as a type option [[GH-25436](https://github.com/hashicorp/vault/pull/25436)]
-* ui: Add warning message to the namespace picker warning users about the behavior when logging in with a root token. [[GH-23277](https://github.com/hashicorp/vault/pull/23277)]
-* ui: Adds a warning when whitespace is detected in a key of a KV secret [[GH-23702](https://github.com/hashicorp/vault/pull/23702)]
-* ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [[GH-23747](https://github.com/hashicorp/vault/pull/23747)]
-* ui: Allow users in userpass auth mount to update their own password [[GH-23797](https://github.com/hashicorp/vault/pull/23797)]
-* ui: Implement Helios Design System Breadcrumbs [[GH-24387](https://github.com/hashicorp/vault/pull/24387)]
-* ui: Implement Helios Design System copy button component making copy buttons accessible [[GH-22333](https://github.com/hashicorp/vault/pull/22333)]
-* ui: Implement Helios Design System footer component [[GH-24191](https://github.com/hashicorp/vault/pull/24191)]
-* ui: Implement Helios Design System pagination component [[GH-23169](https://github.com/hashicorp/vault/pull/23169)]
-* ui: Increase base font-size from 14px to 16px and update use of rem vs pixels for size variables [[GH-23994](https://github.com/hashicorp/vault/pull/23994)]
-* ui: Makes modals accessible by implementing Helios Design System modal component [[GH-23382](https://github.com/hashicorp/vault/pull/23382)]
-* ui: Replace inline confirm alert inside a popup-menu dropdown with confirm alert modal [[GH-21520](https://github.com/hashicorp/vault/pull/21520)]
-* ui: Separates out client counts dashboard to overview and entity/non-entity tabs [[GH-24752](https://github.com/hashicorp/vault/pull/24752)]
-* ui: Sort list view of entities and aliases alphabetically using the item name [[GH-24103](https://github.com/hashicorp/vault/pull/24103)]
-* ui: Surface warning banner if UI has stopped auto-refreshing token [[GH-23143](https://github.com/hashicorp/vault/pull/23143)]
-* ui: Update AlertInline component to use Helios Design System Alert component [[GH-24299](https://github.com/hashicorp/vault/pull/24299)]
-* ui: Update flat, shell-quote and swagger-ui-dist packages. Remove swagger-ui styling overrides. [[GH-23700](https://github.com/hashicorp/vault/pull/23700)]
-* ui: Update mount backend form to use selectable cards [[GH-14998](https://github.com/hashicorp/vault/pull/14998)]
-* ui: Update sidebar Secrets engine to title case. [[GH-23964](https://github.com/hashicorp/vault/pull/23964)]
-* ui: Use Hds::Dropdown component to replace list view popup menus [[GH-25321](https://github.com/hashicorp/vault/pull/25321)]
-* ui: add error message when copy action fails [[GH-25479](https://github.com/hashicorp/vault/pull/25479)]
-* ui: capabilities-self is always called in the user's root namespace [[GH-24168](https://github.com/hashicorp/vault/pull/24168)]
-* ui: improve accessibility - color contrast, labels, and automatic testing [[GH-24476](https://github.com/hashicorp/vault/pull/24476)]
-* ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [[GH-18513](https://github.com/hashicorp/vault/pull/18513)]
-* ui: obscure JSON values when KV v2 secret has nested objects [[GH-24530](https://github.com/hashicorp/vault/pull/24530)]
-* ui: redirect back to current route after reauthentication when token expires [[GH-25335](https://github.com/hashicorp/vault/pull/25335)]
-* ui: remove unnecessary OpenAPI calls for unmanaged auth methods [[GH-25364](https://github.com/hashicorp/vault/pull/25364)]
-* ui: show banner when resultant-acl check fails due to permissions or wrong namespace. [[GH-23503](https://github.com/hashicorp/vault/pull/23503)]
-* website/docs: Update references to Key Value secrets engine from 'K/V' to 'KV' [[GH-24529](https://github.com/hashicorp/vault/pull/24529)]
-* website/docs: fix inaccuracies with unauthenticated_in_flight_requests_access parameter [[GH-23287](https://github.com/hashicorp/vault/pull/23287)]
+* ui/activity: Updates running total stats to be displayed via a donut chart.
+* Plugin Downloads (enterprise): add CLI `-download` option for plugin register (beta)
+* Raft: Auto-join will now allow you to enforce IPv4 on networks that allow IPv6 and dual-stack enablement, which is on by default in certain regions.
+* Secrets Recovery (enterprise): Support recovering items from a snapshot to a new path in the live cluster. By calling the `vault recover` command with a `-from` flag, users can specify the path of the item in the snapshot.
+* Secrets Sync (enterprise): add `enterprise_url` field to enable support for self-hosted GitHub Enterprise Server instances.
+* activity (enterprise): Add a cumulative namespace client count API at `sys/internal/counters/activity/cumulative`. For each namespace in the response it returns the sum of its own client counts and that of all its child namespaces.
+* activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) response now includes a new timestamp that denotes the first time the client was used within the specified query period.
+* api (sys/utilization-report): Added namespace filter and more granularity for secret sync data in the response.
+* api: Add new logical client request interfaces for read, write, delete, list operations.
+* audit: Add additional verifications to the target of file audit sinks.
+* auth/approle (enterprise): Add ability to specify custom alias metadata via new role creation parameter `alias_metadata`.
+* auth/aws (enterprise): Add ability to specify custom alias metadata via new role creation parameter `alias_metadata`.
+* auth/cert (enterprise): Add ability to specify custom alias metadata via new CA certificate role creation parameter `alias_metadata`.
+* auth/cert: Add allowed_organizations support
+* auth/cert: Support RFC 9440 colon-wrapped Base64 certificates in `x_forwarded_for_client_cert_header`, to fix TLS certificate auth errors with Google Cloud Application Load Balancer.
+* auth/cert: test non-CA cert equality on login matching instead of individual fields.
+* auth/github (enterprise): Add ability to specify custom alias metadata via new configuration parameter `alias_metadata`.
+* auth/ldap (enterprise): Add ability to specify custom alias metadata via new role configuration parameter `alias_metadata`.
+* auth/ldap: Introduces an option to connect to an alternative LDAP URL for root credential rotation, in cases where it differs from the configured LDAP URL.
+* auth/ldap: add explicit logging to rotations in ldap
+* auth/okta (enterprise): Add ability to specify custom alias metadata via new role configuration parameter `alias_metadata`.
+* auth/radius (enterprise): Add ability to specify custom alias metadata via new role configuration parameter `alias_metadata`.
+* auth/scep (enterprise): Add ability to specify custom alias metadata via new role creation parameter `alias_metadata`.
+* auth/userpass (enterprise): Add ability to specify custom alias metadata via new user creation parameter `alias_metadata`.
+* cli (enterprise): Add a `-force` flag to `vault operator raft snapshot unload` command to force deletion of a loaded snapshot.
+* core (enterprise): Allow setting of an entropy source on password generation
+policies, and with it the selection of "seal" to use entropy augmentation.
+* core (enterprise): add ability to get time remaining until rotation from rotation manager
+* core (enterprise): add support for new pki-only license feature
+* core (enterprise): improve rotation manager logging to include specific lines for rotation success and failure
+* core/metrics: Reading and listing from a snapshot are now tracked via the `vault.route.read-snapshot.{mount_point}` and `vault.route.list-snapshot.{mount_point}` metrics.
+* core/snapshot-load (enterprise): Add a `force` query parameter to the `DELETE sys/storage/raft/snapshot-load/{snapshot_id}` endpoint to allow for forced deletion of snapshots. This is useful when the snapshot is in a state that prevents normal deletion, such as being in the process of loading.
+* license utilization reporting (enterprise): Add metrics for the number of issued PKI certificates.
+* openapi: Add OpenAPI support for secret recovery operations.
+* openapi: Add openapi response definitions to `sys/internal/counters/activity/*` endpoints.
+* plugins: Clarify usage of sha256, command, and version for plugin registration of binary or artifact with API and CLI. Introduce new RegisterPluginDetailed and RegisterPluginWtihContextDetailed functions to API client to propagate response along with error, and mark RegisterPlugin and RegisterPluginWithContext as deprecated.
+* proxy/cache (enterprise): Vault Proxy will now use vault_index on events to be able to update cached static secrets from performance secondaries without needing to be forwarded. This will take precedence over attempting to forward the request to the primary.
+* sdk: add stub code for retrieving rotation schedule information
+* secrets/database (enterprise): Add support for reading, listing, and recovering static roles from a loaded snapshot. Also add support for reading static credentials from a loaded snapshot.
+* secrets/database: Add PSC support for GCP CloudSQL MySQL and Postgresql
+* secrets/database: Add PrivateIP support for MySQL
+* secrets/database: Add root rotation support for Snowflake database secrets engines using key-pair credentials.
+* secrets/database: log password rotation success (info) and failure (error). Some relevant log lines have been updated to include "path" fields.
+* secrets/kmip (enterprise): Update various third party dependencies.
+* secrets/pki (enterprise): add integrations/guardium configuration endpoint.
+* secrets/pki (enterprise): add new batch/certs endpoint to allow multiple certificates to be fetched at once.
+* secrets/pki (enterprise): enable separately-configured logging for SCEP-enrollment.
+* secrets/pki: Add the digest OID when logging SCEP digest mismatch errors.
+* secrets/ssh: Add support for recovering the SSH plugin CA from a loaded snapshot (enterprise only).
+* secrets/transform (enterprise): Update various third party dependencies.
+* secrets/transit: add logging on both success and failure of key rotation
+* storage/raft (enterprise): Add `autoload_enabled` option to raft automated snapshot configurations. When enabled, this option will automatically load raft snapshots into Vault, which can then be used for recovery operations.
+* sys (enterprise): Add sys/billing/certificates API endpoint to retrieve the number of issued PKI certificates.
+* ui/activity (enterprise): Add clarifying text to explain the "Initial Usage" column will only have timestamps for clients initially used after upgrading to version 1.21
+* ui/activity (enterprise): Reduce requests to the activity export API by only fetching new data when the dashboard initially loads or is manually refreshed.
+* ui/activity (enterprise): Support filtering months dropdown by ISO timestamp or display value.
+* ui/activity: Adds filtering by month to the Client Count dashboard to link client counts to specific client IDs from the export API
+* ui/auth: the role field on the OIDC login form now auto-fills from the `role` URL query string parameter
+* ui/auth: the role field on the SAML login form now auto-fills from the `role` URL query string parameter
+* ui/secrets: Display the plugin version on the secret engine list view. Move KV's version to a tooltip that appears when hovering over the engine's name.
+* ui/secrets: Updated filters on secret engines list to sort by path, engine type and version
+* ui: Add `namespace_path`, `mount_path` and `mount_type` filters to attribution table
+* ui: Enhanced secret engine selection dynamically displays all available plugins from the plugin catalog.
+* ui: Format multiline API error messages to render as bulleted lists.
+* ui: Use the Helios Design System Code Block component for all readonly code editors and use its Code Editor component for all other code editors
+
+DEPRECATIONS:
+
+* core: disallow usage of duplicate attributes in HCL configuration files and policy definitions, which were already deprecated. For now those errors can be suppressed back to warnings by setting the environment variable VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES.
+
+BUG FIXES:
+
+* activity (enterprise): Fix `development_cluster` setting being overwritten on performance secondaries upon cluster reload.
+* activity (enterprise): sys/internal/counters/activity outputs the correct mount type when called from a non root namespace
+* agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same.
+* auth/approle (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+* auth/aws (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+* auth/cert (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+* auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load.
+* auth/github (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+* auth/ldap (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+* auth/okta (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+* auth/radius (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+* auth/scep (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+* auth/scep (enterprise): enforce the token_bound_cidrs role parameter within SCEP roles
+* auth/spiffe: Address an issue updating a role with overlapping workload_id_pattern values it previously contained.
+* auth/userpass (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+* auth: fixed panic when supplying integer as a lease_id in renewal.
+* auth: update alias lookahead to respect username case for LDAP and username/password
+* auto-reporting (enterprise): Clarify debug logs to accurately reflect when automated license utilization reporting is enabled or disabled, especially since manual reporting is always initialized.
+* core (enterprise): Avoid duplicate seal rewrapping, and ensure that cluster secondaries rewrap after a seal migration.
+* core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration
+* core/activitylog (enterprise): Fix nil panic when trying reload census manager before activity log is setup.
+* core/metrics: Add service name prefix for core HA metrics to avoid duplicate, zero-value metrics.
+* core/seal (enterprise): Fix a bug that caused the seal rewrap process to abort in the presence of partially sealed entries.
+* core/seal: When Seal-HA is enabled, make it an error to persist the barrier keyring when not all seals are healthy.  This prevents the possibility of failing to unseal when a different subset of seals are healthy than were healthy at last write.
+* core: Fixed issue where under certain circumstances the rotation manager would spawn goroutines indefinitely.
+* core: Role based quotas now work for cert auth
+* core: interpret all new rotation manager rotation_schedules as UTC to avoid inadvertent use of tz-local
+* core: resultant-acl now merges segment-wildcard (`+`) paths with existing prefix rules in `glob_paths`, so clients receive a complete view of glob-style permissions. This unblocks UI sidebar navigation checks and namespace access banners.
+* default-auth: Fix bug where listing default-auth configurations caused panic during auditing.
+* gcs: fix failed locking due to updated library error checks
+* identity/mfa: revert cache entry change from #31217 and document cache entry values
+* kmip (enterprise): Fix a panic that can happen when a KMIP client makes a request before the Vault server has finished unsealing.
+* mongodb: fix mongodb connection issue when using TLS client + username/password authentication
+* plugins: Fix panics that can occur when a plugin audits a request or response before the Vault server has finished unsealing.
+* product usage reporting (enterprise): Clarify debug logs to accurately reflect when anonymous product usage reporting is enabled or disabled, especially since manual reporting is always initialized.
+* raft (enterprise): auto-join will now work in regions that do not support dual-stack
+* raft/autopilot: Fixes an issue with enterprise redundancy zones where, if the leader was in a redundancy zone and that leader becomes unavailable, the node would become an unzoned voter. This can artificially inflate the required number of nodes for quorum, leading to a situation where the cluster cannot recover if another leader subsequently becomes unavailable. Vault will now keep an unavailable node in its last known redundancy zone as a non-voter.
+* replication (enterprise): Fix bug where group updates fail when processed on a standby node in a PR secondary cluster.
+* replication (enterprise): Fix bug with mount invalidations consuming excessive memory.
+* secrets-sync (enterprise): GCP locational KMS keys are no longer incorrectly removed when the location name is all lowercase.
+* secrets-sync (enterprise): Unsyncing secret-key granularity associations will no longer give a misleading error about a failed unsync operation that did indeed succeed.
+* secrets/azure: Ensure proper installation of the Azure enterprise secrets plugin.
+* secrets/database/postgresql: Support for multiline statements in the `rotation_statements` field.
+* secrets/database: respect the escaping/disable_escaping state when using self-managed static roles
+* secrets/transit: Fix error when using ed25519 keys that were imported with derivation enabled
+* sentinel (enterprise): Fix a Sentinel bug, where the soft-mandatory policy override would not work in overriding request denial. Now, Vault correctly allows requests when the policy override flag is set. Previously, requests were denied even if an override was explicitly set. Error messaging for denied requests is now clearer and more actionable.
+* sys/mounts: enable unsetting allowed_response_headers
+* ui (enterprise): Fixes login form so input renders correctly when token is a preferred login method for a namespace.
+* ui: Fix DR secondary view from not loading/transitioning.
+* ui: Fix kv v2 overview page from erroring if a user does not have access to the /subkeys endpoint and the policy check fails.
+* ui: Fix page loading error when users navigate away from identity entities and groups list views.
+* ui: Fix regression in 1.20.0 to properly set namespace context for capabilities checks
+* ui: Fix selecting multiple namespaces in the namespace picker when the path contains matching nodes
+* ui: Fixes UI login settings list page which was not rendering rules with an underscore in the name.
+* ui: Include user's root namespace in the namespace picker if it's a namespace other than the actual root ("")
+* ui: Revert camelizing of parameters returned from `sys/internal/ui/mounts` so mount paths match serve value
+
+## 1.20.5 Enterprise
+### October 22, 2025
+
+SECURITY:
+
+* auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
+* ui: disable scarf analytics for ui builds
+
+CHANGES:
+
+* core: Bump Go version to 1.24.9.
+* http: Evaluate rate limit quotas before checking JSON limits during request handling.
+
+IMPROVEMENTS:
+
+* core/metrics: Reading and listing from a snapshot are now tracked via the `vault.route.read-snapshot.{mount_point}` and `vault.route.list-snapshot.{mount_point}` metrics.
+* secrets/database: Add root rotation support for Snowflake database secrets engines using key-pair credentials.
 
 BUG FIXES:
 
-* Seal HA (enterprise/beta): Fix rejection of a seal configuration change
-from two to one auto seal due to persistence of the previous seal type being
-"multiseal". [[GH-23573](https://github.com/hashicorp/vault/pull/23573)]
-* activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
-* agent/logging: Agent should now honor correct -log-format and -log-file settings in logs generated by the consul-template library. [[GH-24252](https://github.com/hashicorp/vault/pull/24252)]
-* agent: Fix issue where Vault Agent was unable to render KVv2 secrets with delete_version_after set. [[GH-25387](https://github.com/hashicorp/vault/pull/25387)]
-* agent: Fixed incorrect parsing of boolean environment variables for configuration. [[GH-24790](https://github.com/hashicorp/vault/pull/24790)]
-* api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
-on the request. [[GH-23861](https://github.com/hashicorp/vault/pull/23861)]
-* api: Fix deadlock on calls to sys/leader with a namespace configured
-on the request. [[GH-24256](https://github.com/hashicorp/vault/pull/24256)]
-* api: sys/leader ActiveTime field no longer gets reset when we do an internal state change that doesn't change our active status. [[GH-24549](https://github.com/hashicorp/vault/pull/24549)]
-* audit/socket: Provide socket based audit backends with 'prefix' configuration option when supplied. [[GH-25004](https://github.com/hashicorp/vault/pull/25004)]
-* audit: Fix bug reopening 'file' audit devices on SIGHUP. [[GH-23598](https://github.com/hashicorp/vault/pull/23598)]
-* audit: Fix bug where use of 'log_raw' option could result in other devices logging raw audit data [[GH-24968](https://github.com/hashicorp/vault/pull/24968)]
-* audit: Resolve potential race condition when auditing entries which use SSCT. [[GH-25443](https://github.com/hashicorp/vault/pull/25443)]
-* auth/aws: Fixes a panic that can occur in IAM-based login when a [client config](https://developer.hashicorp.com/vault/api-docs/auth/aws#configure-client) does not exist. [[GH-23555](https://github.com/hashicorp/vault/pull/23555)]
-* auth/cert: Handle errors related to expired OCSP server responses [[GH-24193](https://github.com/hashicorp/vault/pull/24193)]
-* auth/saml (enterprise): Fixes support for Microsoft Entra ID enterprise applications
-* cap/ldap: Downgrade go-ldap client from v3.4.5 to v3.4.4 due to race condition found [[GH-23103](https://github.com/hashicorp/vault/pull/23103)]
-* cassandra: Update Cassandra to set consistency prior to calling CreateSession, ensuring consistency setting is correct when opening connection. [[GH-24649](https://github.com/hashicorp/vault/pull/24649)]
-* cli/kv: Undelete now properly handles KV-V2 mount paths that are more than one layer deep. [[GH-19811](https://github.com/hashicorp/vault/pull/19811)]
-* cli: fixes plugin register CLI failure to error when plugin image doesn't exist [[GH-24990](https://github.com/hashicorp/vault/pull/24990)]
-* command/server: Fix bug with sigusr2 where pprof files were not closed correctly [[GH-23636](https://github.com/hashicorp/vault/pull/23636)]
-* core (Enterprise): Treat multiple disabled HA seals as a migration to Shamir.
-* core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
-* core (enterprise): Fix a panic that can occur if only one seal exists but is unhealthy on the non-first restart of Vault.
-* core (enterprise): fix a potential deadlock if an error is received twice from underlying storage for the same key
-* core/activity: Fixes segments fragment loss due to exceeding entry record size limit [[GH-23781](https://github.com/hashicorp/vault/pull/23781)]
-* core/audit: Audit logging a Vault response will now use a 5 second context timeout, separate from the original request. [[GH-24238](https://github.com/hashicorp/vault/pull/24238)]
-* core/config: Use correct HCL config value when configuring `log_requests_level`. [[GH-24056](https://github.com/hashicorp/vault/pull/24056)]
-* core/ha: fix panic that can occur when an HA cluster contains an active node with version >=1.12.0 and another node with version <1.10 [[GH-24441](https://github.com/hashicorp/vault/pull/24441)]
-* core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [[GH-23802](https://github.com/hashicorp/vault/pull/23802)]
-* core/quotas: Close rate-limit blocked client purge goroutines when sealing [[GH-24108](https://github.com/hashicorp/vault/pull/24108)]
-* core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [[GH-24336](https://github.com/hashicorp/vault/pull/24336)]
-* core: Fix an error that resulted in the wrong seal type being returned by sys/seal-status while
-Vault is in seal migration mode. [[GH-24165](https://github.com/hashicorp/vault/pull/24165)]
-* core: Skip unnecessary deriving of policies during Login MFA Check. [[GH-23894](https://github.com/hashicorp/vault/pull/23894)]
-* core: fix bug where deadlock detection was always on for expiration and quotas. 
-These can now be configured individually with `detect_deadlocks`. [[GH-23902](https://github.com/hashicorp/vault/pull/23902)]
-* core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [[GH-23874](https://github.com/hashicorp/vault/pull/23874)]
-* core: fix rare panic due to a race condition with metrics collection during seal [[GH-23906](https://github.com/hashicorp/vault/pull/23906)]
-* core: upgrade github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 to 
-support azure workload identities. [[GH-24954](https://github.com/hashicorp/vault/pull/24954)]
-* eventlogger: Update library to v0.2.7 to address race condition [[GH-24305](https://github.com/hashicorp/vault/pull/24305)]
-* events: Ignore sending context to give more time for events to send [[GH-23500](https://github.com/hashicorp/vault/pull/23500)]
-* expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [[GH-24027](https://github.com/hashicorp/vault/pull/24027)]
-* expiration: Prevent large lease loads from delaying state changes, e.g. becoming active or standby. [[GH-23282](https://github.com/hashicorp/vault/pull/23282)]
-* fairshare: fix a race condition in JobManager.GetWorkerCounts [[GH-24616](https://github.com/hashicorp/vault/pull/24616)]
-* helper/pkcs7: Fix slice out-of-bounds panic [[GH-24891](https://github.com/hashicorp/vault/pull/24891)]
-* http: Include PATCH in the list of allowed CORS methods [[GH-24373](https://github.com/hashicorp/vault/pull/24373)]
-* kmip (enterprise): Improve handling of failures due to storage replication issues.
-* kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
-* kmip (enterprise): Return a structure in the response for query function Query Server Information.
-* ldaputil: Disable tests for ARM64 [[GH-23118](https://github.com/hashicorp/vault/pull/23118)]
-* mongo-db: allow non-admin database for root credential rotation [[GH-23240](https://github.com/hashicorp/vault/pull/23240)]
-* plugins: Fix panic when querying plugin runtimes from a performance secondary follower node.
-* proxy: Fixed incorrect parsing of boolean environment variables for configuration. [[GH-24790](https://github.com/hashicorp/vault/pull/24790)]
-* replication (enterprise): Fix a bug where undo logs would only get enabled on the initial node in a cluster.
-* replication (enterprise): Fix a missing unlock when changing replication state
-* replication (enterprise): disallow configuring paths filter for a mount path that does not exist
-* sdk: Return error when failure occurs setting up node 0 in NewDockerCluster, instead of ignoring it. [[GH-24136](https://github.com/hashicorp/vault/pull/24136)]
-* secrets-sync (enterprise): Allow unsyncing secrets from an unmounted secrets engine
-* secrets-sync (enterprise): Fix panic when setting usage_gauge_period to none
-* secrets-sync (enterprise): Fixed issue where we could sync a deleted secret
-* secrets-sync (enterprise): Unsync secret when metadata is deleted
-* secrets/aws: fix requeueing of rotation entry in cases where rotation fails [[GH-23673](https://github.com/hashicorp/vault/pull/23673)]
-* secrets/aws: update credential rotation deadline when static role rotation period is updated [[GH-23528](https://github.com/hashicorp/vault/pull/23528)]
-* secrets/consul: Fix revocations when Vault has an access token using specific namespace and admin partition policies [[GH-23010](https://github.com/hashicorp/vault/pull/23010)]
-* secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [[GH-24192](https://github.com/hashicorp/vault/pull/24192)]
-* secrets/pki: Stop processing in-flight ACME verifications when an active node steps down [[GH-23278](https://github.com/hashicorp/vault/pull/23278)]
-* secrets/transit (enterprise): Address an issue using sign/verify operations with managed keys returning an error about it not containing a private key
-* secrets/transit (enterprise): Address panic when using GCP,AWS,Azure managed keys for encryption operations. At this time all encryption operations for the cloud providers have been disabled, only signing operations are supported.
-* secrets/transit (enterprise): Apply hashing arguments and defaults to managed key sign/verify operations
-* secrets/transit: Do not allow auto rotation on managed_key key types [[GH-23723](https://github.com/hashicorp/vault/pull/23723)]
-* secrets/transit: Fix a panic when attempting to export a public RSA key [[GH-24054](https://github.com/hashicorp/vault/pull/24054)]
-* secrets/transit: When provided an invalid input with hash_algorithm=none, a lock was not released properly before reporting an error leading to deadlocks on a subsequent key configuration update. [[GH-25336](https://github.com/hashicorp/vault/pull/25336)]
-* storage/consul: fix a bug where an active node in a specific sort of network
-partition could continue to write data to Consul after a new leader is elected
-potentially causing data loss or corruption for keys with many concurrent
-writers. For Enterprise clusters this could cause corruption of the merkle trees
-leading to failure to complete merkle sync without a full re-index. [[GH-23013](https://github.com/hashicorp/vault/pull/23013)]
-* storage/file: Fixing spuriously deleting storage keys ending with .temp [[GH-25395](https://github.com/hashicorp/vault/pull/25395)]
-* storage/raft: Fix a race whereby a new leader may present inconsistent node data to Autopilot. [[GH-24246](https://github.com/hashicorp/vault/pull/24246)]
-* transform (enterprise): guard against a panic looking up a token in exportable mode with barrier storage.
-* ui: Allows users to dismiss the resultant-acl banner. [[GH-25106](https://github.com/hashicorp/vault/pull/25106)]
-* ui: Allows users to search within KV v2 directories from the Dashboard's quick action card. [[GH-25001](https://github.com/hashicorp/vault/pull/25001)]
-* ui: Assumes version 1 for kv engines when options are null because no version is specified [[GH-23585](https://github.com/hashicorp/vault/pull/23585)]
-* ui: Correctly handle directory redirects from pre 1.15.0 Kv v2 list view urls. [[GH-24281](https://github.com/hashicorp/vault/pull/24281)]
-* ui: Correctly handle redirects from pre 1.15.0 Kv v2 edit, create, and show urls. [[GH-24339](https://github.com/hashicorp/vault/pull/24339)]
-* ui: Decode the connection url for display on the connection details page [[GH-23695](https://github.com/hashicorp/vault/pull/23695)]
-* ui: Do not disable JSON display toggle for KV version 2 secrets [[GH-25235](https://github.com/hashicorp/vault/pull/25235)]
-* ui: Do not show resultant-acl banner on namespaces a user has access to [[GH-25256](https://github.com/hashicorp/vault/pull/25256)]
-* ui: Fix AWS secret engine to allow empty policy_document field. [[GH-23470](https://github.com/hashicorp/vault/pull/23470)]
-* ui: Fix JSON editor in KV V2 unable to handle pasted values [[GH-24224](https://github.com/hashicorp/vault/pull/24224)]
-* ui: Fix PKI ca_chain display so value can be copied to clipboard [[GH-25399](https://github.com/hashicorp/vault/pull/25399)]
-* ui: Fix bug where a change on OpenAPI added a double forward slash on some LIST endpoints. [[GH-23446](https://github.com/hashicorp/vault/pull/23446)]
-* ui: Fix copy button not working on masked input when value is not a string [[GH-25269](https://github.com/hashicorp/vault/pull/25269)]
-* ui: Fix error when tuning token auth configuration within namespace [[GH-24147](https://github.com/hashicorp/vault/pull/24147)]
-* ui: Fix inconsistent empty state action link styles [[GH-25209](https://github.com/hashicorp/vault/pull/25209)]
-* ui: Fix payload sent when disabling replication [[GH-24292](https://github.com/hashicorp/vault/pull/24292)]
-* ui: Fix regression that broke the oktaNumberChallenge on the ui. [[GH-23565](https://github.com/hashicorp/vault/pull/23565)]
-* ui: Fix the copy token button in the sidebar navigation window when in a collapsed state. [[GH-23331](https://github.com/hashicorp/vault/pull/23331)]
-* ui: Fixed minor bugs with database secrets engine [[GH-24947](https://github.com/hashicorp/vault/pull/24947)]
-* ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [[GH-24697](https://github.com/hashicorp/vault/pull/24697)]
-* ui: Fixes issue where you could not share the list view URL from the KV v2 secrets engine. [[GH-23620](https://github.com/hashicorp/vault/pull/23620)]
-* ui: Fixes issue with sidebar navigation links disappearing when navigating to policies when a user is not authorized [[GH-23516](https://github.com/hashicorp/vault/pull/23516)]
-* ui: Fixes issues displaying accurate TLS state in dashboard configuration details [[GH-23726](https://github.com/hashicorp/vault/pull/23726)]
-* ui: Fixes policy input toolbar scrolling by default [[GH-23297](https://github.com/hashicorp/vault/pull/23297)]
-* ui: The UI can now be used to create or update database roles by operator without permission on the database connection. [[GH-24660](https://github.com/hashicorp/vault/pull/24660)]
-* ui: Update the KV secret data when you change the version you're viewing of a nested secret. [[GH-25152](https://github.com/hashicorp/vault/pull/25152)]
-* ui: Updates OIDC/JWT login error handling to surface all role related errors [[GH-23908](https://github.com/hashicorp/vault/pull/23908)]
-* ui: Upgrade HDS version to fix sidebar navigation issues when it collapses in smaller viewports. [[GH-23580](https://github.com/hashicorp/vault/pull/23580)]
-* ui: When Kv v2 secret is an object, fix so details view defaults to readOnly JSON editor. [[GH-24290](https://github.com/hashicorp/vault/pull/24290)]
-* ui: fix KV v2 details view defaulting to JSON view when secret value includes `{` [[GH-24513](https://github.com/hashicorp/vault/pull/24513)]
-* ui: fix broken GUI when accessing from listener with chroot_namespace defined [[GH-23942](https://github.com/hashicorp/vault/pull/23942)]
-* ui: fix incorrectly calculated capabilities on PKI issuer endpoints [[GH-24686](https://github.com/hashicorp/vault/pull/24686)]
-* ui: fix issue where kv v2 capabilities checks were not passing in the full secret path if secret was inside a directory. [[GH-24404](https://github.com/hashicorp/vault/pull/24404)]
-* ui: fix navigation items shown to user when chroot_namespace configured [[GH-24492](https://github.com/hashicorp/vault/pull/24492)]
-* ui: show error from API when seal fails [[GH-23921](https://github.com/hashicorp/vault/pull/23921)]
+* activity (enterprise): sys/internal/counters/activity outputs the correct mount type when called from a non root namespace
+* auth: fixed panic when suppling integer as a lease_id in renewal.
+* core (enterprise): Avoid duplicate seal rewrapping, and ensure that cluster secondaries rewrap after a seal migration.
+* core: interpret all new rotation manager rotation_schedules as UTC to avoid inadvertent use of tz-local
+* core: resultant-acl now merges segment-wildcard (`+`) paths with existing prefix rules in `glob_paths`, so clients receive a complete view of glob-style permissions. This unblocks UI sidebar navigation checks and namespace access banners.
+* secrets/database: respect the escaping/disable_escaping state when using self-managed static roles
+* sentinel (enterprise): Fix a Sentinel bug, where the soft-mandatory policy override would not work in overriding request denial. Now, Vault correctly allows requests when the policy override flag is set. Previously, requests were denied even if an override was explicitly set. Error messaging for denied requests is now clearer and more actionable.
+* ui (enterprise): Fixes login form so input renders correctly when token is a preferred login method for a namespace.
 
-## 1.15.5
-### January 31, 2024
+## 1.20.4
+### September 24, 2025
 
 SECURITY:
 
-* audit: Fix bug where use of 'log_raw' option could result in other devices logging raw audit data [[GH-24968](https://github.com/hashicorp/vault/pull/24968)] [[HCSEC-2024-01](https://discuss.hashicorp.com/t/hcsec-2024-01-vault-may-expose-sensitive-information-when-configuring-an-audit-log-device/62311)]
+* core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27. ([ce4b4264](https://github.com/hashicorp/vault/commit/ce4b42642403f30370dde0a39e9a04991c387291))
 
 CHANGES:
 
-* core: Bump Go version to 1.21.5.
-* database/snowflake: Update plugin to v0.9.1 [[GH-25020](https://github.com/hashicorp/vault/pull/25020)]
-* secrets/ad: Update plugin to v0.16.2 [[GH-25058](https://github.com/hashicorp/vault/pull/25058)]
-* secrets/openldap: Update plugin to v0.11.3 [[GH-25040](https://github.com/hashicorp/vault/pull/25040)]
+* database/snowflake: Update plugin to [v0.14.2](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.14.2) ([9f06df77](https://github.com/hashicorp/vault/commit/9f06df77b48024350fbc67b7d9a7eaaa5d0022fa))
 
 IMPROVEMENTS:
 
-* command/server: display logs on startup immediately if disable-gated-logs flag is set [[GH-24280](https://github.com/hashicorp/vault/pull/24280)]
-* core/activity: Include secret_syncs in activity log responses [[GH-24710](https://github.com/hashicorp/vault/pull/24710)]
-* oidc/provider: Adds `code_challenge_methods_supported` to OpenID Connect Metadata [[GH-24979](https://github.com/hashicorp/vault/pull/24979)]
-* storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [[GH-24010](https://github.com/hashicorp/vault/pull/24010)]
-* sys (enterprise): Adds the chroot_namespace field to this sys/internal/ui/resultant-acl endpoint, which exposes the value of the chroot namespace from the
-listener config.
-* ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [[GH-18513](https://github.com/hashicorp/vault/pull/18513)]
+* Raft: Auto-join will now allow you to enforce IPv4 on networks that allow IPv6 and dual-stack enablement, which is on by default in certain regions. ([1fd38796](https://github.com/hashicorp/vault/commit/1fd38796639ed861fc2fa1b58f138caad8fc0950))
+* auth/cert: Support RFC 9440 colon-wrapped Base64 certificates in `x_forwarded_for_client_cert_header`, to fix TLS certificate auth errors with Google Cloud Application Load Balancer. [[GH-31501](https://github.com/hashicorp/vault/pull/31501)]
+* secrets/database (enterprise): Add support for reading, listing, and recovering static roles from a loaded snapshot. Also add support for reading static credentials from a loaded snapshot. ([24cd1aa5](https://github.com/hashicorp/vault/commit/24cd1aa5961bfbed396251aebd3490dcfc7a106f))
+* secrets/ssh: Add support for recovering the SSH plugin CA from a loaded snapshot (enterprise only). ([0087af9d](https://github.com/hashicorp/vault/commit/0087af9da59692351e7a3c3f5269af9de082a52e))
 
 BUG FIXES:
 
-* audit/socket: Provide socket based audit backends with 'prefix' configuration option when supplied. [[GH-25004](https://github.com/hashicorp/vault/pull/25004)]
-* auth/saml (enterprise): Fixes support for Microsoft Entra ID enterprise applications
-* core (enterprise): fix a potential deadlock if an error is received twice from underlying storage for the same key
-* core: upgrade github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 to 
-support azure workload identities. [[GH-24954](https://github.com/hashicorp/vault/pull/24954)]
-* helper/pkcs7: Fix slice out-of-bounds panic [[GH-24891](https://github.com/hashicorp/vault/pull/24891)]
-* kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
-* plugins: fix panic when registering containerized plugin with a custom runtime on a perf standby
-* ui: Allows users to dismiss the resultant-acl banner. [[GH-25106](https://github.com/hashicorp/vault/pull/25106)]
-* ui: Correctly handle redirects from pre 1.15.0 Kv v2 edit, create, and show urls. [[GH-24339](https://github.com/hashicorp/vault/pull/24339)]
-* ui: Fixed minor bugs with database secrets engine [[GH-24947](https://github.com/hashicorp/vault/pull/24947)]
-* ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [[GH-24697](https://github.com/hashicorp/vault/pull/24697)]
-* ui: Fixes policy input toolbar scrolling by default [[GH-23297](https://github.com/hashicorp/vault/pull/23297)]
-* ui: The UI can now be used to create or update database roles by operator without permission on the database connection. [[GH-24660](https://github.com/hashicorp/vault/pull/24660)]
-* ui: fix KV v2 details view defaulting to JSON view when secret value includes `{` [[GH-24513](https://github.com/hashicorp/vault/pull/24513)]
-* ui: fix incorrectly calculated capabilities on PKI issuer endpoints [[GH-24686](https://github.com/hashicorp/vault/pull/24686)]
-* ui: fix issue where kv v2 capabilities checks were not passing in the full secret path if secret was inside a directory. [[GH-24404](https://github.com/hashicorp/vault/pull/24404)]
-* ui: fix navigation items shown to user when chroot_namespace configured [[GH-24492](https://github.com/hashicorp/vault/pull/24492)]
-  
-## 1.15.4
-### December 06, 2023
+* auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load. [[GH-31438](https://github.com/hashicorp/vault/pull/31438)]
+* core: Role based quotas now work for cert auth ([fc775dea](https://github.com/hashicorp/vault/commit/fc775deacee3ab2dd956b8ab7ab64847601c1685))
+* sys/mounts: enable unsetting allowed_response_headers [[GH-31555](https://github.com/hashicorp/vault/pull/31555)]
+* ui: Fix page loading error when users navigate away from identity entities and groups list views. ([81170963](https://github.com/hashicorp/vault/commit/8117096364d5fbb541124a6e057cd11b24eaa6f3))
+
+
+## 1.20.3
+### August 28, 2025
+
+FEATURES:
+
+* **IBM RACF Static Role Password Phrase Management (Enterprise)**: Add support for static role password phrase management to the LDAP secrets engine. (https://github.com/hashicorp/vault-plugin-secrets-openldap/pull/184)
 
 SECURITY:
 
-* core: Fixes an issue present in both Vault and Vault Enterprise since Vault 1.12.0, where Vault is vulnerable to a denial of service through memory exhaustion of the host when handling large HTTP requests from a client. (see [CVE-2023-6337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6337) & [HCSEC-2023-34](https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741))
+* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3. ([8b3a9ce1](https://github.com/hashicorp/vault/commit/8b3a9ce1f651932559a129a7889243d24127cee2))
 
 CHANGES:
 
-* identity (enterprise): POST requests to the `/identity/entity/merge` endpoint
-are now always forwarded from standbys to the active node. [[GH-24325](https://github.com/hashicorp/vault/pull/24325)]
+* core: Bump Go version to 1.24.6. ([ce56e14e](https://github.com/hashicorp/vault/commit/ce56e14e7466ae80e05d11a83c8f41db0f4653be))
+* http: Add JSON configurable limits to HTTP handling for JSON payloads: `max_json_depth`, `max_json_string_value_length`, `max_json_object_entry_count`, `max_json_array_element_count`. [[GH-31069](https://github.com/hashicorp/vault/pull/31069)]
+* sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible ([8f172169](https://github.com/hashicorp/vault/commit/8f1721697bba123117f4f98dae4154ef9fe614e5))
+* secrets/openldap (enterprise): update plugin to v0.16.1
 
-BUG FIXES:
+IMPROVEMENTS:
 
-* agent/logging: Agent should now honor correct -log-format and -log-file settings in logs generated by the consul-template library. [[GH-24252](https://github.com/hashicorp/vault/pull/24252)]
-* api: Fix deadlock on calls to sys/leader with a namespace configured
-on the request. [[GH-24256](https://github.com/hashicorp/vault/pull/24256)]
-* core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [[GH-24336](https://github.com/hashicorp/vault/pull/24336)]
-* ui: Correctly handle directory redirects from pre 1.15.0 Kv v2 list view urls. [[GH-24281](https://github.com/hashicorp/vault/pull/24281)]
-* ui: Fix payload sent when disabling replication [[GH-24292](https://github.com/hashicorp/vault/pull/24292)]
-* ui: When Kv v2 secret is an object, fix so details view defaults to readOnly JSON editor. [[GH-24290](https://github.com/hashicorp/vault/pull/24290)]
+* auth/ldap: add explicit logging to rotations in ldap [[GH-31401](https://github.com/hashicorp/vault/pull/31401)]
+* core (enterprise): improve rotation manager logging to include specific lines for rotation success and failure
+* secrets/database: log password rotation success (info) and failure (error). Some relevant log lines have been updated to include "path" fields. [[GH-31402](https://github.com/hashicorp/vault/pull/31402)]
+* secrets/transit: add logging on both success and failure of key rotation [[GH-31420](https://github.com/hashicorp/vault/pull/31420)]
+* ui: Use the Helios Design System Code Block component for all readonly code editors and use its Code Editor component for all other code editors [[GH-30188](https://github.com/hashicorp/vault/pull/30188)]
 
-## 1.15.3
-### November 30, 2023
+BUG FIXES:
 
-CHANGES:
+* core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration
+* core/metrics: Add service name prefix for core HA metrics to avoid duplicate, zero-value metrics. ([91e5f443](https://github.com/hashicorp/vault/commit/91e5f44315fb52c37b54e8b0eece1b4390665cc3))
+* core/seal: When Seal-HA is enabled, make it an error to persist the barrier
+keyring when not all seals are healthy.  This prevents the possibility of
+failing to unseal when a different subset of seals are healthy than were
+healthy at last write. ([bbe64227](https://github.com/hashicorp/vault/commit/bbe64227c586cb34f73d9ae8025398f24aa7e12d))
+* raft (enterprise): auto-join will now work in regions that do not support dual-stack ([c66baf5e](https://github.com/hashicorp/vault/commit/c66baf5ee1ee9320daa6af5528cb2f250f2a0f3a))
+* raft/autopilot: Fixes an issue with enterprise redundancy zones where, if the leader was in a redundancy zone and that leader becomes unavailable, the node would become an unzoned voter. This can artificially inflate the required number of nodes for quorum, leading to a situation where the cluster cannot recover if another leader subsequently becomes unavailable. Vault will now keep an unavailable node in its last known redundancy zone as a non-voter. [[GH-31443](https://github.com/hashicorp/vault/pull/31443)]
+* replication (enterprise): Fix bug where group updates fail when processed on a
+standby node in a PR secondary cluster.
+* secrets-sync (enterprise): GCP locational KMS keys are no longer incorrectly removed when the location name is all lowercase.
+* secrets/database/postgresql: Support for multiline statements in the `rotation_statements` field. [[GH-31442](https://github.com/hashicorp/vault/pull/31442)]
+* ui: Fix DR secondary view from not loading/transitioning. [[GH-31478](https://github.com/hashicorp/vault/pull/31478)]
 
-* core: Bump Go version to 1.21.4.
+## 1.20.2
+### August 06, 2025
 
-IMPROVEMENTS:
+SECURITY:
 
-* core (enterprise): Speed up unseal when using namespaces
-* core: update sys/seal-status (and CLI vault status) to report the type of
-the seal when unsealed, as well as the type of the recovery seal if an
-auto-seal. [[GH-23022](https://github.com/hashicorp/vault/pull/23022)]
-* secrets/pki: do not check TLS validity on ACME requests redirected to https [[GH-22521](https://github.com/hashicorp/vault/pull/22521)]
-* ui: Sort list view of entities and aliases alphabetically using the item name [[GH-24103](https://github.com/hashicorp/vault/pull/24103)]
-* ui: capabilities-self is always called in the user's root namespace [[GH-24168](https://github.com/hashicorp/vault/pull/24168)]
+* auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled [[GH-31427](https://github.com/hashicorp/vault/pull/31427),[HCSEC-2025-20](https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092)].
 
 BUG FIXES:
 
-* activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
-* auth/cert: Handle errors related to expired OCSP server responses [[GH-24193](https://github.com/hashicorp/vault/pull/24193)]
-* core (Enterprise): Treat multiple disabled HA seals as a migration to Shamir.
-* core/audit: Audit logging a Vault response will now use a 5 second context timeout, separate from the original request. [[GH-24238](https://github.com/hashicorp/vault/pull/24238)]
-* core/config: Use correct HCL config value when configuring `log_requests_level`. [[GH-24059](https://github.com/hashicorp/vault/pull/24059)]
-* core/quotas: Close rate-limit blocked client purge goroutines when sealing [[GH-24108](https://github.com/hashicorp/vault/pull/24108)]
-* core: Fix an error that resulted in the wrong seal type being returned by sys/seal-status while
-Vault is in seal migration mode. [[GH-24165](https://github.com/hashicorp/vault/pull/24165)]
-* replication (enterprise): disallow configuring paths filter for a mount path that does not exist
-* secrets-sync (enterprise): Fix panic when setting usage_gauge_period to none
-* secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [[GH-24192](https://github.com/hashicorp/vault/pull/24192)]
-* secrets/transit: Fix a panic when attempting to export a public RSA key [[GH-24054](https://github.com/hashicorp/vault/pull/24054)]
-* ui: Fix JSON editor in KV V2 unable to handle pasted values [[GH-24224](https://github.com/hashicorp/vault/pull/24224)]
-* ui: Fix error when tuning token auth configuration within namespace [[GH-24147](https://github.com/hashicorp/vault/pull/24147)]
-* ui: show error from API when seal fails [[GH-23921](https://github.com/hashicorp/vault/pull/23921)]
+* agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same. [[GH-31392](https://github.com/hashicorp/vault/pull/31392)]
+* identity/mfa: revert cache entry change from #31217 and document cache entry values [[GH-31421](https://github.com/hashicorp/vault/pull/31421)]
+
+## 1.20.1
+### July 25, 2025
+
+SECURITY:
+
+* audit: **breaking change** privileged vault operator may execute code on the underlying host (CVE-2025-6000). Vault will not unseal if the only configured file audit device has executable permissions (e.g., 0777, 0755). See recent [breaking change](https://developer.hashicorp.com/vault/docs/updates/important-changes#breaking-changes) docs for more details. [[GH-31211](https://github.com/hashicorp/vault/pull/31211),[HCSEC-2025-14](https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033)]
+* auth/userpass: timing side-channel in vault's userpass auth method (CVE-2025-6011)[HCSEC-2025-15](https://discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034)
+* core/login: vault userpass and ldap user lockout bypass (CVE-2025-6004). update alias lookahead to respect username case for LDAP and username/password. [[GH-31352](https://github.com/hashicorp/vault/pull/31352),[HCSEC-2025-16](https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035)]
+* secrets/totp: vault totp secrets engine code reuse (CVE-2025-6014) [[GH-31246](https://github.com/hashicorp/vault/pull/31246),[HCSEC-2025-17](https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036)]
+* auth/cert: vault certificate auth method did not validate common name for non-ca certificates (CVE-2025-6037). test non-CA cert equality on login matching instead of individual fields. [[GH-31210](https://github.com/hashicorp/vault/pull/31210),[HCSEC-2025-18](https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037)]
+* core/mfa: vault login mfa bypass of rate limiting and totp token reuse (CVE-2025-6015) [[GH-31217](https://github.com/hashicorp/vault/pull/31297),[HCSEC-2025-19](https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038)]
+
+FEATURES:
+
+* **Post-Quantum Cryptography Support**: Experimental support for PQC signatures with SLH-DSA in Transit.
+
+IMPROVEMENTS:
 
-## 1.15.2
-### November 09, 2023
+* Plugin Downloads (enterprise): add CLI `-download` option for plugin register (beta)
+* openapi: Add OpenAPI support for secret recovery operations. [[GH-31331](https://github.com/hashicorp/vault/pull/31331)]
+* plugins: Clarify usage of sha256, command, and version for plugin registration of binary or artifact with API and CLI. Introduce new RegisterPluginDetailed and RegisterPluginWtihContextDetailed functions to API client to propagate response along with error, and mark RegisterPlugin and RegisterPluginWithContext as deprecated. [[GH-30811](https://github.com/hashicorp/vault/pull/30811)]
+* secrets/pki (enterprise): enable separately-configured logging for SCEP-enrollment.
+* secrets/pki: Add the digest OID when logging SCEP digest mismatch errors. [[GH-31232](https://github.com/hashicorp/vault/pull/31232)]
+
+BUG FIXES:
+
+* activity (enterprise): Fix `development_cluster` setting being overwritten on performance secondaries upon cluster reload. [[GH-31223](https://github.com/hashicorp/vault/pull/31223)]
+* auth/scep (enterprise): enforce the token_bound_cidrs role parameter within SCEP roles
+* auto-reporting (enterprise): Clarify debug logs to accurately reflect when automated license utilization reporting is enabled or disabled, especially since manual reporting is always initialized.
+* core/seal (enterprise): Fix a bug that caused the seal rewrap process to abort in the presence of partially sealed entries.
+* kmip (enterprise): Fix a panic that can happen when a KMIP client makes a request before the Vault server has finished unsealing. [[GH-31266](https://github.com/hashicorp/vault/pull/31266)]
+* plugins: Fix panics that can occur when a plugin audits a request or response before the Vault server has finished unsealing. [[GH-31266](https://github.com/hashicorp/vault/pull/31266)]
+* product usage reporting (enterprise): Clarify debug logs to accurately reflect when anonymous product usage reporting is enabled or disabled, especially since manual reporting is always initialized.
+* replication (enterprise): Fix bug with mount invalidations consuming excessive memory.
+* secrets-sync (enterprise): Unsyncing secret-key granularity associations will no longer give a misleading error about a failed unsync operation that did indeed succeed.
+* secrets/gcp: Update to vault-plugin-secrets-gcp@v0.22.1 to address more eventual consistency issues [[GH-31350](https://github.com/hashicorp/vault/pull/31350)]
+* ui: Fix capability checks for api resources with underscores to properly hide actions and dropdown items a user cannot perform [[GH-31271](https://github.com/hashicorp/vault/pull/31271)]
+* ui: Fix kv v2 overview page from erroring if a user does not have access to the /subkeys endpoint and the policy check fails. [[GH-31136](https://github.com/hashicorp/vault/pull/31136)]
+* ui: Fix mutation of unwrapped data when keys contain underscores [[GH-31287](https://github.com/hashicorp/vault/pull/31287)]
+* ui: Fix regression in 1.20.0 to properly set namespace context for capabilities checks [[GH-31276](https://github.com/hashicorp/vault/pull/31276)]
+* ui: Fix selecting multiple namespaces in the namespace picker when the path contains matching nodes [[GH-31326](https://github.com/hashicorp/vault/pull/31326)]
+* ui: Fixes UI login settings list page which was not rendering rules with an underscore in the name. [[GH-31150](https://github.com/hashicorp/vault/pull/31150)]
+* ui: Include user's root namespace in the namespace picker if it's a namespace other than the actual root ("") [[GH-31300](https://github.com/hashicorp/vault/pull/31300)]
+* ui: Revert camelizing of parameters returned from `sys/internal/ui/mounts` so mount paths match serve value [[GH-31094](https://github.com/hashicorp/vault/pull/31094)]
+
+## 1.20.0
+### June 25, 2025
 
 SECURITY:
-* core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [[HSEC-2023-33](https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926)]
+
+* core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes. [[GH-30794](https://github.com/hashicorp/vault/pull/30794)],[[HCSEC-2025-11](https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570)]
+* core/identity: vault root namespace operator may elevate privileges (CVE-2025-5999). Fix string contains check in Identity APIs to be case-insensitive. [[GH-31045](https://github.com/hashicorp/vault/pull/31045),[HCSEC-2025-13](https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032)]
 
 CHANGES:
 
-* auth/approle: Normalized error response messages when invalid credentials are provided [[GH-23786](https://github.com/hashicorp/vault/pull/23786)]
-* secrets/mongodbatlas: Update plugin to v0.10.2 [[GH-23849](https://github.com/hashicorp/vault/pull/23849)]
+* UI: remove outdated and unneeded js string extensions [[GH-29834](https://github.com/hashicorp/vault/pull/29834)]
+* activity (enterprise): The sys/internal/counters/activity endpoint will return actual values for new clients in the current month.
+* activity (enterprise): provided values for `start_time` and `end_time` in `sys/internal/counters/activity` are aligned to the corresponding billing period.
+* activity: provided value for `end_time` in `sys/internal/counters/activity` is now capped at the end of the last completed month. [[GH-30164](https://github.com/hashicorp/vault/pull/30164)]
+* api: Update the default API client to check for the `Retry-After` header and, if it exists, wait for the specified duration before retrying the request. [[GH-30887](https://github.com/hashicorp/vault/pull/30887)]
+* auth/alicloud: Update plugin to v0.21.0 [[GH-30810](https://github.com/hashicorp/vault/pull/30810)]
+* auth/azure: Update plugin to v0.20.2. Login requires `resource_group_name`, `vm_name`, and `vmss_name` to match token claims [[GH-30052](https://github.com/hashicorp/vault/pull/30052)]
+* auth/azure: Update plugin to v0.20.3 [[GH-30082](https://github.com/hashicorp/vault/pull/30082)]
+* auth/azure: Update plugin to v0.20.4 [[GH-30543](https://github.com/hashicorp/vault/pull/30543)]
+* auth/azure: Update plugin to v0.21.0 [[GH-30872](https://github.com/hashicorp/vault/pull/30872)]
+* auth/azure: Update plugin to v0.21.1 [[GH-31010](https://github.com/hashicorp/vault/pull/31010)]
+* auth/cf: Update plugin to v0.20.1 [[GH-30583](https://github.com/hashicorp/vault/pull/30583)]
+* auth/cf: Update plugin to v0.21.0 [[GH-30842](https://github.com/hashicorp/vault/pull/30842)]
+* auth/gcp: Update plugin to v0.20.2 [[GH-30081](https://github.com/hashicorp/vault/pull/30081)]
+* auth/jwt: Update plugin to v0.23.2 [[GH-30431](https://github.com/hashicorp/vault/pull/30431)]
+* auth/jwt: Update plugin to v0.24.1 [[GH-30876](https://github.com/hashicorp/vault/pull/30876)]
+* auth/kerberos: Update plugin to v0.15.0 [[GH-30845](https://github.com/hashicorp/vault/pull/30845)]
+* auth/kubernetes: Update plugin to v0.22.1 [[GH-30910](https://github.com/hashicorp/vault/pull/30910)]
+* auth/oci: Update plugin to v0.19.0 [[GH-30841](https://github.com/hashicorp/vault/pull/30841)]
+* auth/saml: Update plugin to v0.6.0
+* core: Bump Go version to 1.24.4.
+* core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [[GH-29774](https://github.com/hashicorp/vault/pull/29774)]
+* database/couchbase: Update plugin to v0.14.0 [[GH-30836](https://github.com/hashicorp/vault/pull/30836)]
+* database/elasticsearch: Update plugin to v0.18.0 [[GH-30796](https://github.com/hashicorp/vault/pull/30796)]
+* database/mongodbatlas: Update plugin to v0.15.0 [[GH-30856](https://github.com/hashicorp/vault/pull/30856)]
+* database/redis-elasticache: Update plugin to v0.7.0 [[GH-30785](https://github.com/hashicorp/vault/pull/30785)]
+* database/redis: Update plugin to v0.6.0 [[GH-30797](https://github.com/hashicorp/vault/pull/30797)]
+* database/snowflake: Update plugin to v0.14.0 [[GH-30748](https://github.com/hashicorp/vault/pull/30748)]
+* database/snowflake: Update plugin to v0.14.1 [[GH-30868](https://github.com/hashicorp/vault/pull/30868)]
+* logical/system: add ent stub for plugin catalog handling [[GH-30890](https://github.com/hashicorp/vault/pull/30890)]
+* quotas/rate-limit: Round up the `Retry-After` value to the nearest second when calculating the retry delay. [[GH-30887](https://github.com/hashicorp/vault/pull/30887)]
+* secrets/ad: Update plugin to v0.21.0 [[GH-30819](https://github.com/hashicorp/vault/pull/30819)]
+* secrets/alicloud: Update plugin to v0.20.0 [[GH-30809](https://github.com/hashicorp/vault/pull/30809)]
+* secrets/azure: Update plugin to v0.21.2 [[GH-30037](https://github.com/hashicorp/vault/pull/30037)]
+* secrets/azure: Update plugin to v0.21.3 [[GH-30083](https://github.com/hashicorp/vault/pull/30083)]
+* secrets/azure: Update plugin to v0.22.0 [[GH-30832](https://github.com/hashicorp/vault/pull/30832)]
+* secrets/gcp: Update plugin to v0.21.2 [[GH-29970](https://github.com/hashicorp/vault/pull/29970)]
+* secrets/gcp: Update plugin to v0.21.3 [[GH-30080](https://github.com/hashicorp/vault/pull/30080)]
+* secrets/gcp: Update plugin to v0.22.0 [[GH-30846](https://github.com/hashicorp/vault/pull/30846)]
+* secrets/gcpkms: Update plugin to v0.21.0 [[GH-30835](https://github.com/hashicorp/vault/pull/30835)]
+* secrets/kubernetes: Update plugin to v0.11.0 [[GH-30855](https://github.com/hashicorp/vault/pull/30855)]
+* secrets/kv: Update plugin to v0.24.0 [[GH-30826](https://github.com/hashicorp/vault/pull/30826)]
+* secrets/mongodbatlas: Update plugin to v0.15.0 [[GH-30860](https://github.com/hashicorp/vault/pull/30860)]
+* secrets/openldap: Update plugin to v0.15.2 [[GH-30079](https://github.com/hashicorp/vault/pull/30079)]
+* secrets/openldap: Update plugin to v0.15.4 [[GH-30279](https://github.com/hashicorp/vault/pull/30279)]
+* secrets/openldap: Update plugin to v0.16.0 [[GH-30844](https://github.com/hashicorp/vault/pull/30844)]
+* secrets/terraform: Update plugin to v0.12.0 [[GH-30905](https://github.com/hashicorp/vault/pull/30905)]
+* server: disable_mlock configuration option is now required for integrated storage and no longer has a default. If you are using the default value with integrated storage, you must now explicitly set disable_mlock to true or false or Vault server will fail to start. [[GH-29974](https://github.com/hashicorp/vault/pull/29974)]
+* ui/activity: Replaces mount and namespace attribution charts with a table to allow sorting 
+client count data by `namespace`, `mount_path`, `mount_type` or number of clients for 
+a selected month. [[GH-30678](https://github.com/hashicorp/vault/pull/30678)]
+* ui: Client count side nav link 'Vault Usage Metrics' renamed to 'Client Usage' [[GH-30765](https://github.com/hashicorp/vault/pull/30765)]
+* ui: Client counting "running total" charts now reflect new clients only [[GH-30506](https://github.com/hashicorp/vault/pull/30506)]
+* ui: Removed `FormError` component (not used) [[GH-34699](https://github.com/hashicorp/vault/pull/34699)]
+* ui: Selecting a different method in the login form no longer updates the `/vault/auth?with=` query parameter [[GH-30500](https://github.com/hashicorp/vault/pull/30500)]
+* ui: `/vault/auth?with=` query parameter now exclusively refers to the auth mount path and renders a simplified form [[GH-30500](https://github.com/hashicorp/vault/pull/30500)]
 
 FEATURES:
 
-* cli/snapshot: Add CLI tool to inspect Vault snapshots [[GH-23457](https://github.com/hashicorp/vault/pull/23457)]
+* **Auto Irrevocable Lease Removal (Enterprise)**: Add the Vault Enterprise configuration param, `remove_irrevocable_lease_after`. When set to a non-zero value, this will automatically delete irrevocable leases after the configured duration exceeds the lease's expire time. The minimum duration allowed for this field is two days. [[GH-30703](https://github.com/hashicorp/vault/pull/30703)]
+* **Development Cluster Configuration (Enterprise)**: Added `development_cluster` as a field to Vault's utilization reports.
+The field is configurable via HCL and indicates whether the cluster is being used in a development environment, defaults to false if not set. [[GH-30659](https://github.com/hashicorp/vault/pull/30659)]
+* **Entity-based and collective rate limit quotas (Enterprise)**: Add new `group_by` field to the rate limit quota API to support different grouping modes.
+* **Login form customization (Enterprise)**: Adds support to choose a default and/or backup auth methods for the web UI login form to streamline the web UI login experience. [[GH-30700](https://github.com/hashicorp/vault/pull/30700)]
+* **Plugin Downloads**: Support automatically downloading official HashiCorp secret and auth plugins from releases.hashicorp.com (beta)
+* **SSH Key Signing Improvements (Enterprise)**: Add support for using managed keys to sign SSH keys in the SSH secrets engine.
+* **Secret Recovery from Snapshot (Enterprise)**: Adds a framework to load an integrated storage 
+snapshot into Vault and read, list, and recover KV v1 and cubbyhole secrets from the snapshot. [[GH-30739](https://github.com/hashicorp/vault/pull/30739)]
+* **UI Secrets Engines**: TOTP secrets engine is now supported. [[GH-29751](https://github.com/hashicorp/vault/pull/29751)]
+* **UI Telemetry**: Add Posthog for UI telemetry tracking on Vault Dedicated managed clusters [[GH-30425](https://github.com/hashicorp/vault/pull/30425)]
+* **Vault Namespace Picker**: Updating the Vault Namespace Picker to enable search functionality, allow direct navigation to nested namespaces and improve accessibility. [[GH-30490](https://github.com/hashicorp/vault/pull/30490)]
+* **Vault PKI SCEP Server (Enterprise)**: Support for the Simple Certificate Enrollment Protocol (SCEP) has been added to the Vault PKI Plugin. This allows standard SCEP clients to request certificates from a Vault server with no knowledge of Vault APIs.
 
 IMPROVEMENTS:
 
-* api (enterprise): Enable the sys/license/features from any namespace
-* storage/etcd: etcd should only return keys when calling List() [[GH-23872](https://github.com/hashicorp/vault/pull/23872)]
-* ui: Update flat, shell-quote and swagger-ui-dist packages. Remove swagger-ui styling overrides. [[GH-23700](https://github.com/hashicorp/vault/pull/23700)]
-* ui: Update sidebar Secrets engine to title case. [[GH-23964](https://github.com/hashicorp/vault/pull/23964)]
+* activity (enterprise): Added vault.client.billing_period.activity telemetry metric to emit information about the total number of distinct clients used in the current billing period.
+* activity: mount_type was added to the API response of sys/internal/counters/activity [[GH-30071](https://github.com/hashicorp/vault/pull/30071)]
+* activity: mount_type was added to the API response of sys/internal/counters/activity
+* api (enterprise): Added a new API, `/sys/utilization-report`, giving a snapshot overview of Vault's utilization at a high level.
+* api/client: Add Cert auth method support. This allows the client to authenticate using a client certificate. [[GH-29546](https://github.com/hashicorp/vault/pull/29546)]
+* core (enterprise): Updated code and documentation to support FIPS 140-3 compliant algorithms.
+* core (enterprise): allow a root token to relock a namespace locked by the Namespace API Lock feature.
+* core (enterprise): report errors from the underlying seal when getting entropy.
+* core (enterprise): update to FIPS 140-3 cryptographic module in the FIPS builds.
+* core/metrics: added a new telemetry metric, `vault.core.response_status_code`, with two labels, `code`, and `type`, detailing the status codes of all responses to requests that Vault handles. [[GH-30354](https://github.com/hashicorp/vault/pull/30354)]
+* core: Improve memory use of path management for namespaces, auth methods, and secrets engines. Now Vault should handle larger numbers of namespaces and multiple instances of the same secrets engine or auth method more efficiently. [[GH-31022](https://github.com/hashicorp/vault/pull/31022)]
+* core: Updated code and documentation to support FIPS 140-3 compliant algorithms. [[GH-30576](https://github.com/hashicorp/vault/pull/30576)]
+* core: support for X25519MLKEM768 (post quantum key agreement) in the Go TLS stack. [[GH-30603](https://github.com/hashicorp/vault/pull/30603)]
+* events: Add `vault_index` to an event's metadata if the metadata contains `modified=true`, to support client consistency controls when reading from Vault in response to an event where storage was modified. [[GH-30725](https://github.com/hashicorp/vault/pull/30725)]
+* physical/postgres: Adds support to authenticate with the PostgreSQL Backend server with cloud based identities (AWS IAM, Azure MSI and GCP IAM) [[GH-30681](https://github.com/hashicorp/vault/pull/30681)]
+* plugins: Support registration of CE plugins with extracted artifact directory. [[GH-30673](https://github.com/hashicorp/vault/pull/30673)]
+* secrets/aws: Add LIST endpoint to the AWS secrets engine static roles. [[GH-29842](https://github.com/hashicorp/vault/pull/29842)]
+* secrets/pki: Add Delta (Freshest) CRL support to AIA information (both mount-level and issuer configured) [[GH-30319](https://github.com/hashicorp/vault/pull/30319)]
+* secrets/transit (enterprise): enable the use of 192-bit keys for AES CMAC
+* storage/mysql: Added support for getting mysql backend username and password from the environment variables `VAULT_MYSQL_USERNAME` and `VAULT_MYSQL_PASSWORD`. [[GH-30136](https://github.com/hashicorp/vault/pull/30136)]
+* storage/raft: Upgrade hashicorp/raft library to v1.7.3 which includes additional logging on the leader when opening and sending a snapshot to a follower. [[GH-29976](https://github.com/hashicorp/vault/pull/29976)]
+* transit: Exclude the partial wrapping key path from the transit/keys LIST operation. [[GH-30728](https://github.com/hashicorp/vault/pull/30728)]
+* ui (enterprise): Replace date selector in client count usage page with fixed start and end dates that align with billing periods in order to return more relevant client counting data. [[GH-30349](https://github.com/hashicorp/vault/pull/30349)]
+* ui/database: Adding input field for setting skip static role password rotation for database connection config, updating static role skip field to use toggle button [[GH-29820](https://github.com/hashicorp/vault/pull/29820)]
+* ui/database: Adding password input field for creating a static role [[GH-30275](https://github.com/hashicorp/vault/pull/30275)]
+* ui/database: Adding warning modal pop up when creating a static role that will be rotated immediately [[GH-30119](https://github.com/hashicorp/vault/pull/30119)]
+* ui/database: Glimmerizing and adding validations to role create [[GH-29754](https://github.com/hashicorp/vault/pull/29754)]
+* ui/database: Updating toggle buttons for skip_rotation_import to reverse polarity of values that get displayed versus whats sent to api [[GH-30055](https://github.com/hashicorp/vault/pull/30055)]
+* ui: Add 'Refresh list' button to the namespace list page. [[GH-30692](https://github.com/hashicorp/vault/pull/30692)]
+* ui: Enable search for a namespace on the namespace list page. [[GH-30680](https://github.com/hashicorp/vault/pull/30680)]
+* ui: Hide "Other" tab when mounts are configured with `listing_visibility="unauth"`; all methods can be accessed via the "Sign in with other methods" link [[GH-30500](https://github.com/hashicorp/vault/pull/30500)]
+* ui: Improve accessibility of login form to meet a11y standards [[GH-30500](https://github.com/hashicorp/vault/pull/30500)]
+* ui: Replaces all instances of the deprecated event.keyCode with event.key [[GH-30493](https://github.com/hashicorp/vault/pull/30493)]
+* ui: Update date selector in client count usage page to disable current month selection for Vault clusters without a license. [[GH-30488](https://github.com/hashicorp/vault/pull/30488)]
+* ui: Use Hds::CodeBlock component to replace readonly JsonEditor instances [[GH-29720](https://github.com/hashicorp/vault/pull/29720)]
+* ui: adds key value pair string inputs as optional form for wrap tool [[GH-29677](https://github.com/hashicorp/vault/pull/29677)]
+* ui: remove ember-svg-jar dependency [[GH-30181](https://github.com/hashicorp/vault/pull/30181)]
 
-BUG FIXES:
+DEPRECATIONS:
 
-* api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
-on the request. [[GH-23861](https://github.com/hashicorp/vault/pull/23861)]
-* core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
-* core/activity: Fixes segments fragment loss due to exceeding entry record size limit [[GH-23781](https://github.com/hashicorp/vault/pull/23781)]
-* core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [[GH-23802](https://github.com/hashicorp/vault/pull/23802)]
-* core: Revert PR causing memory consumption bug [[GH-23986](https://github.com/hashicorp/vault/pull/23986)]
-* core: Skip unnecessary deriving of policies during Login MFA Check. [[GH-23894](https://github.com/hashicorp/vault/pull/23894)]
-* core: fix bug where deadlock detection was always on for expiration and quotas. 
-These can now be configured individually with `detect_deadlocks`. [[GH-23902](https://github.com/hashicorp/vault/pull/23902)]
-* core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [[GH-23874](https://github.com/hashicorp/vault/pull/23874)]
-* expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [[GH-24027](https://github.com/hashicorp/vault/pull/24027)]
-* ui: fix broken GUI when accessing from listener with chroot_namespace defined [[GH-23942](https://github.com/hashicorp/vault/pull/23942)]
+* api: Deprecated the `/sys/internal/counters/tokens` endpoint. Attempting to call this endpoint will return a 403 "unsupported path" exception. [[GH-30561](https://github.com/hashicorp/vault/pull/30561)]
+* core: deprecate duplicate attributes in HCL configuration files and policy definitions [[GH-30386](https://github.com/hashicorp/vault/pull/30386)]
+
+BUG FIXES:
+
+* api/tokenhelper: Exec token_helper without a shell [[GH-29653](https://github.com/hashicorp/vault/pull/29653)]
+* auth/aws: fix a panic when a performance standby node attempts to write/update config. [[GH-30039](https://github.com/hashicorp/vault/pull/30039)]
+* auth/ldap: Fix a bug that does not properly delete users and groups by first converting their names to lowercase when case senstivity option is off. [[GH-29922](https://github.com/hashicorp/vault/pull/29922)]
+* auth/ldap: fix a panic when a performance standby node attempts to write/update config. [[GH-30039](https://github.com/hashicorp/vault/pull/30039)]
+* aws/secrets: Prevent vault from rejecting secret role configurations where no regions or endpoints are set [[GH-29996](https://github.com/hashicorp/vault/pull/29996)]
+* core (enterprise): add nil check before attempting to use Rotation Manager operations.
+* core (enterprise): fix a bug where plugin automated root rotations would stop after seal/unseal operations
+* core (enterprise): fix issue with errors being swallowed on failed HSM logins. 
+core/managed-keys (enterprise): fix RSA encryption/decryption with OAEP on managed keys.
+* core: Fix a bug that prevents certain loggers from writing to a log file. [[GH-29917](https://github.com/hashicorp/vault/pull/29917)]
+* core: Omit automatic version control information of the main module from compiled Vault binaries [[GH-30926](https://github.com/hashicorp/vault/pull/30926)]
+* database: Prevent static roles created in versions prior to 1.15.0 from rotating on backend restart. [[GH-30320](https://github.com/hashicorp/vault/pull/30320)]
+* database: no longer incorrectly add an "unrecognized parameters" warning for certain SQL database secrets config operations when another warning is returned [[GH-30327](https://github.com/hashicorp/vault/pull/30327)]
+* identity: Fix non-deterministic merge behavior when two entities have
+conflicting local aliases. [[GH-30390](https://github.com/hashicorp/vault/pull/30390)]
+* identity: reintroduce RPC functionality for group creates, allowing performance standbys to handle external group changes during login and token renewal [[GH-30069](https://github.com/hashicorp/vault/pull/30069)]
+* plugins (enterprise): Fix an issue where Enterprise plugins can't run on a standby node
+when it becomes active because standby nodes don't extract the artifact when the plugin
+is registered. Remove extracting from Vault and require the operator to place
+the extracted artifact in the plugin directory before registration.
+* plugins (enterprise): Fix plugin registration with artifact when a binary for the same plugin is already present in the plugin directory.
+* plugins: plugin registration should honor the `plugin_tmpdir` config [[GH-29978](https://github.com/hashicorp/vault/pull/29978)]
+* plugins: plugin registration should honor the `plugin_tmpdir` config
+* raft/retry_join: Fix decoding `auto_join` configurations that include escape characters [[GH-29874](https://github.com/hashicorp/vault/pull/29874)]
+* secrets/aws: fix a bug where environment and shared credential providers were overriding the WIF configuration [[GH-29982](https://github.com/hashicorp/vault/pull/29982)]
+* secrets/aws: fix a case where GovCloud wasn't taken into account; fix a case where the region setting wasn't respected [[GH-30312](https://github.com/hashicorp/vault/pull/30312)]
+* secrets/aws: fix a panic when a performance standby node attempts to write/update config. [[GH-30039](https://github.com/hashicorp/vault/pull/30039)]
+* secrets/database: Fix a bug where a global database plugin reload exits if any of the database connections are not available [[GH-29519](https://github.com/hashicorp/vault/pull/29519)]
+* secrets/database: Treat all rotation_schedule values as UTC to ensure consistent behavior. [[GH-30606](https://github.com/hashicorp/vault/pull/30606)]
+* secrets/db: fix a panic when a performance standby node attempts to write/update config. [[GH-30039](https://github.com/hashicorp/vault/pull/30039)]
+* secrets/openldap: Prevent static role rotation on upgrade when `NextVaultRotation` is nil.
+Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing `NextVaultRotation` value. 
+Now sets it to either `LastVaultRotation + RotationPeriod` or `now + RotationPeriod`. [[GH-30265](https://github.com/hashicorp/vault/pull/30265)]
+* secrets/pki (enterprise): Address a parsing bug that rejected CMPv2 requests containing a validity field.
+* secrets/pki: Fix a bug that prevents enabling automatic tidying of the CMPv2 nonce store. [[GH-29852](https://github.com/hashicorp/vault/pull/29852)]
+* secrets/pki: fix a bug where key_usage was ignored when generating root certificates, and signing certain
+intermediate certificates. [[GH-30034](https://github.com/hashicorp/vault/pull/30034)]
+* secrets/transit (enterprise): ensure verify endpoint always returns valid field in batch_results with CMAC
+* secrets/transit (enterprise): fixed encryption/decryption with RSA against PKCS#11 managed keys
+* secrets/transit: ensure verify endpoint always returns valid field in batch_results with HMAC [[GH-30852](https://github.com/hashicorp/vault/pull/30852)]
+* secrets/transit: fix a panic when rotating on a managed key returns an error [[GH-30214](https://github.com/hashicorp/vault/pull/30214)]
+* ui/database: Added input field for setting 'skip_import_rotation' when creating a static role [[GH-29633](https://github.com/hashicorp/vault/pull/29633)]
+* ui/kmip: Fixes KMIP credentials view and displays `private_key` after generating [[GH-30778](https://github.com/hashicorp/vault/pull/30778)]
+* ui: Automatically refresh namespace list inside the namespace picker after creating or deleting a namespace in the UI. [[GH-30737](https://github.com/hashicorp/vault/pull/30737)]
+* ui: Fix broken link to Hashicorp Vault developer site in the Web REPL help. [[GH-30670](https://github.com/hashicorp/vault/pull/30670)]
+* ui: Fix initial setting of form toggle inputs for parameters nested within the `config` block [[GH-30960](https://github.com/hashicorp/vault/pull/30960)]
+* ui: Fix refresh namespace list after deleting a namespace. [[GH-30680](https://github.com/hashicorp/vault/pull/30680)]
+* ui: MFA methods now display the namespace path instead of the namespace id. [[GH-29588](https://github.com/hashicorp/vault/pull/29588)]
+* ui: Redirect users authenticating with Vault as an OIDC provider to log in again when token expires. [[GH-30838](https://github.com/hashicorp/vault/pull/30838)]
+
+## 1.19.11 Enterprise
+### October 22, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY:
 
-## 1.15.1
-### October 25, 2023
+* auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
+* ui: disable scarf analytics for ui builds
 
 CHANGES:
 
-* core: Bump Go version to 1.21.3.
+* auth/alicloud: Update plugin to [v0.20.1](https://github.com/hashicorp/vault-plugin-auth-alicloud/releases/tag/v0.20.1)
+* core: Bump Go version to 1.24.9.
+* http: Evaluate rate limit quotas before checking JSON limits during request handling.
 
 IMPROVEMENTS:
 
-* api/plugins: add `tls-server-name` arg for plugin registration [[GH-23549](https://github.com/hashicorp/vault/pull/23549)]
-* auto-auth/azure: Support setting the `authenticate_from_environment` variable to "true" and "false" string literals, too. [[GH-22996](https://github.com/hashicorp/vault/pull/22996)]
-* secrets-sync (enterprise): Added telemetry on number of destinations and associations per type.
-* ui: Adds a warning when whitespace is detected in a key of a KV secret [[GH-23702](https://github.com/hashicorp/vault/pull/23702)]
-* ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [[GH-23747](https://github.com/hashicorp/vault/pull/23747)]
-* ui: Surface warning banner if UI has stopped auto-refreshing token [[GH-23143](https://github.com/hashicorp/vault/pull/23143)]
-* ui: show banner when resultant-acl check fails due to permissions or wrong namespace. [[GH-23503](https://github.com/hashicorp/vault/pull/23503)]
+* secrets/database: Add root rotation support for Snowflake database secrets engines using key-pair credentials.
 
 BUG FIXES:
 
-* Seal HA (enterprise/beta): Fix rejection of a seal configuration change
-from two to one auto seal due to persistence of the previous seal type being
-"multiseal". [[GH-23573](https://github.com/hashicorp/vault/pull/23573)]
-* audit: Fix bug reopening 'file' audit devices on SIGHUP. [[GH-23598](https://github.com/hashicorp/vault/pull/23598)]
-* auth/aws: Fixes a panic that can occur in IAM-based login when a [client config](https://developer.hashicorp.com/vault/api-docs/auth/aws#configure-client) does not exist. [[GH-23555](https://github.com/hashicorp/vault/pull/23555)]
-* command/server: Fix bug with sigusr2 where pprof files were not closed correctly [[GH-23636](https://github.com/hashicorp/vault/pull/23636)]
-* events: Ignore sending context to give more time for events to send [[GH-23500](https://github.com/hashicorp/vault/pull/23500)]
-* expiration: Prevent large lease loads from delaying state changes, e.g. becoming active or standby. [[GH-23282](https://github.com/hashicorp/vault/pull/23282)]
-* kmip (enterprise): Improve handling of failures due to storage replication issues.
-* kmip (enterprise): Return a structure in the response for query function Query Server Information.
-* mongo-db: allow non-admin database for root credential rotation [[GH-23240](https://github.com/hashicorp/vault/pull/23240)]
-* replication (enterprise): Fix a bug where undo logs would only get enabled on the initial node in a cluster.
-* replication (enterprise): Fix a missing unlock when changing replication state
-* secrets-sync (enterprise): Fixed issue where we could sync a deleted secret
-* secrets/aws: update credential rotation deadline when static role rotation period is updated [[GH-23528](https://github.com/hashicorp/vault/pull/23528)]
-* secrets/consul: Fix revocations when Vault has an access token using specific namespace and admin partition policies [[GH-23010](https://github.com/hashicorp/vault/pull/23010)]
-* secrets/pki: Stop processing in-flight ACME verifications when an active node steps down [[GH-23278](https://github.com/hashicorp/vault/pull/23278)]
-* secrets/transit (enterprise): Address an issue using sign/verify operations with managed keys returning an error about it not containing a private key
-* secrets/transit (enterprise): Address panic when using GCP,AWS,Azure managed keys for encryption operations. At this time all encryption operations for the cloud providers have been disabled, only signing operations are supported.
-* secrets/transit (enterprise): Apply hashing arguments and defaults to managed key sign/verify operations
-* secrets/transit: Do not allow auto rotation on managed_key key types [[GH-23723](https://github.com/hashicorp/vault/pull/23723)]
-* storage/consul: fix a bug where an active node in a specific sort of network
-partition could continue to write data to Consul after a new leader is elected
-potentially causing data loss or corruption for keys with many concurrent
-writers. For Enterprise clusters this could cause corruption of the merkle trees
-leading to failure to complete merkle sync without a full re-index. [[GH-23013](https://github.com/hashicorp/vault/pull/23013)]
-* ui: Assumes version 1 for kv engines when options are null because no version is specified [[GH-23585](https://github.com/hashicorp/vault/pull/23585)]
-* ui: Decode the connection url for display on the connection details page [[GH-23695](https://github.com/hashicorp/vault/pull/23695)]
-* ui: Fix AWS secret engine to allow empty policy_document field. [[GH-23470](https://github.com/hashicorp/vault/pull/23470)]
-* ui: Fix bug where auth items were not listed when within a namespace. [[GH-23446](https://github.com/hashicorp/vault/pull/23446)]
-* ui: Fix regression that broke the oktaNumberChallenge on the ui. [[GH-23565](https://github.com/hashicorp/vault/pull/23565)]
-* ui: Fix the copy token button in the sidebar navigation window when in a collapsed state. [[GH-23331](https://github.com/hashicorp/vault/pull/23331)]
-* ui: Fixes issue where you could not share the list view URL from the KV v2 secrets engine. [[GH-23620](https://github.com/hashicorp/vault/pull/23620)]
-* ui: Fixes issue with sidebar navigation links disappearing when navigating to policies when a user is not authorized [[GH-23516](https://github.com/hashicorp/vault/pull/23516)]
-* ui: Fixes issues displaying accurate TLS state in dashboard configuration details [[GH-23726](https://github.com/hashicorp/vault/pull/23726)]
+* auth: fixed panic when suppling integer as a lease_id in renewal.
+* core (enterprise): Avoid duplicate seal rewrapping, and ensure that cluster secondaries rewrap after a seal migration.
+* core: interpret all new rotation manager rotation_schedules as UTC to avoid inadvertent use of tz-local
+* core: resultant-acl now merges segment-wildcard (`+`) paths with existing prefix rules in `glob_paths`, so clients receive a complete view of glob-style permissions. This unblocks UI sidebar navigation checks and namespace access banners.
+* secrets/database: respect the escaping/disable_escaping state when using self-managed static roles
 
-## 1.15.0
-### September 27, 2023
+## 1.19.10 Enterprise
+### September 24, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 SECURITY:
 
-* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. This vulnerability, CVE-2023-4680, is fixed in Vault 1.14.3, 1.13.7, and 1.12.11. [[GH-22852](https://github.com/hashicorp/vault/pull/22852), [HSEC-2023-28](https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249)]
-* sentinel (enterprise): Sentinel RGP policies allowed for cross-namespace denial-of-service. This vulnerability, CVE-2023-3775, is fixed in Vault Enterprise 1.15.0, 1.14.4, and 1.13.8.[[HSEC-2023-29](https://discuss.hashicorp.com/t/hcsec-2023-29-vault-enterprise-s-sentinel-rgp-policies-allowed-for-cross-namespace-denial-of-service/58653)]
+* core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27.
 
 CHANGES:
 
-* auth/alicloud: Update plugin to v0.16.0 [[GH-22646](https://github.com/hashicorp/vault/pull/22646)]
-* auth/azure: Update plugin to v0.16.0 [[GH-22277](https://github.com/hashicorp/vault/pull/22277)]
-* auth/azure: Update plugin to v0.16.1 [[GH-22795](https://github.com/hashicorp/vault/pull/22795)]
-* auth/azure: Update plugin to v0.16.2 [[GH-23060](https://github.com/hashicorp/vault/pull/23060)]
-* auth/cf: Update plugin to v0.15.1 [[GH-22758](https://github.com/hashicorp/vault/pull/22758)]
-* auth/gcp: Update plugin to v0.16.1 [[GH-22612](https://github.com/hashicorp/vault/pull/22612)]
-* auth/jwt: Update plugin to v0.17.0 [[GH-22678](https://github.com/hashicorp/vault/pull/22678)]
-* auth/kerberos: Update plugin to v0.10.1 [[GH-22797](https://github.com/hashicorp/vault/pull/22797)]
-* auth/kubernetes: Update plugin to v0.17.0 [[GH-22709](https://github.com/hashicorp/vault/pull/22709)]
-* auth/kubernetes: Update plugin to v0.17.1 [[GH-22879](https://github.com/hashicorp/vault/pull/22879)]
-* auth/ldap: Normalize HTTP response codes when invalid credentials are provided [[GH-21282](https://github.com/hashicorp/vault/pull/21282)]
-* auth/oci: Update plugin to v0.14.2 [[GH-22805](https://github.com/hashicorp/vault/pull/22805)]
-* core (enterprise): Ensure Role Governing Policies are only applied down the namespace hierarchy
-* core/namespace (enterprise): Introduce the concept of high-privilege namespace (administrative namespace),
-which will have access to some system backend paths that were previously only accessible in the root namespace. [[GH-21215](https://github.com/hashicorp/vault/pull/21215)]
-* core: Bump Go version to 1.21.1.
-* database/couchbase: Update plugin to v0.9.3 [[GH-22854](https://github.com/hashicorp/vault/pull/22854)]
-* database/couchbase: Update plugin to v0.9.4 [[GH-22871](https://github.com/hashicorp/vault/pull/22871)]
-* database/elasticsearch: Update plugin to v0.13.3 [[GH-22696](https://github.com/hashicorp/vault/pull/22696)]
-* database/mongodbatlas: Update plugin to v0.10.1 [[GH-22655](https://github.com/hashicorp/vault/pull/22655)]
-* database/redis-elasticache: Update plugin to v0.2.2 [[GH-22584](https://github.com/hashicorp/vault/pull/22584)]
-* database/redis-elasticache: Update plugin to v0.2.3 [[GH-22598](https://github.com/hashicorp/vault/pull/22598)]
-* database/redis: Update plugin to v0.2.2 [[GH-22654](https://github.com/hashicorp/vault/pull/22654)]
-* database/snowflake: Update plugin to v0.9.0 [[GH-22516](https://github.com/hashicorp/vault/pull/22516)]
-* events: Log level for processing an event dropped from info to debug. [[GH-22997](https://github.com/hashicorp/vault/pull/22997)]
-* events: `data_path` will include full data path of secret, including name. [[GH-22487](https://github.com/hashicorp/vault/pull/22487)]
-* replication (enterprise): Switch to non-deprecated gRPC field for resolver target host
-* sdk/logical/events: `EventSender` interface method is now `SendEvent` instead of `Send`. [[GH-22487](https://github.com/hashicorp/vault/pull/22487)]
-* secrets/ad: Update plugin to v0.16.1 [[GH-22856](https://github.com/hashicorp/vault/pull/22856)]
-* secrets/alicloud: Update plugin to v0.15.1 [[GH-22533](https://github.com/hashicorp/vault/pull/22533)]
-* secrets/azure: Update plugin to v0.16.2 [[GH-22799](https://github.com/hashicorp/vault/pull/22799)]
-* secrets/azure: Update plugin to v0.16.3 [[GH-22824](https://github.com/hashicorp/vault/pull/22824)]
-* secrets/gcp: Update plugin to v0.17.0 [[GH-22746](https://github.com/hashicorp/vault/pull/22746)]
-* secrets/gcpkms: Update plugin to v0.15.1 [[GH-22757](https://github.com/hashicorp/vault/pull/22757)]
-* secrets/keymgmt: Update plugin to v0.9.3
-* secrets/kubernetes: Update plugin to v0.6.0 [[GH-22823](https://github.com/hashicorp/vault/pull/22823)]
-* secrets/kv: Update plugin to v0.16.1 [[GH-22716](https://github.com/hashicorp/vault/pull/22716)]
-* secrets/mongodbatlas: Update plugin to v0.10.1 [[GH-22748](https://github.com/hashicorp/vault/pull/22748)]
-* secrets/openldap: Update plugin to v0.11.2 [[GH-22734](https://github.com/hashicorp/vault/pull/22734)]
-* secrets/terraform: Update plugin to v0.7.3 [[GH-22907](https://github.com/hashicorp/vault/pull/22907)]
-* secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
-* storage/aerospike: Aerospike storage shouldn't be used on 32-bit architectures and is now unsupported on them. [[GH-20825](https://github.com/hashicorp/vault/pull/20825)]
-* telemetry: Replace `vault.rollback.attempt.{MOUNT_POINT}` and `vault.route.rollback.{MOUNT_POINT}` metrics with `vault.rollback.attempt` and `vault.route.rollback metrics` by default. Added a telemetry configuration `add_mount_point_rollback_metrics` which, when set to true, causes vault to emit the metrics with mount points in their names. [[GH-22400](https://github.com/hashicorp/vault/pull/22400)]
+* core: Updates post-install script to print updated license information
+* database/snowflake: Update plugin to [v0.13.3](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.13.3)
 
-FEATURES:
+IMPROVEMENTS:
 
-* **Certificate Issuance External Policy Service (CIEPS) (enterprise)**: Allow highly-customizable operator control of certificate validation and generation through the PKI Secrets Engine.
-* **Copyable KV v2 paths in UI**: KV v2 secret paths are copyable for use in CLI commands or API calls [[GH-22551](https://github.com/hashicorp/vault/pull/22551)]
-* **Dashboard UI**: Dashboard is now available in the UI as the new landing page. [[GH-21057](https://github.com/hashicorp/vault/pull/21057)]
-* **Database Static Role Advanced TTL Management**: Adds the ability to rotate
-* **Event System**: Add subscribe capability and subscribe_event_types to policies for events. [[GH-22474](https://github.com/hashicorp/vault/pull/22474)]
-static roles on a defined schedule. [[GH-22484](https://github.com/hashicorp/vault/pull/22484)]
-* **GCP IAM Support**: Adds support for IAM-based authentication to MySQL and PostgreSQL backends using Google Cloud SQL. [[GH-22445](https://github.com/hashicorp/vault/pull/22445)]
-* **Improved KV V2 UI**: Updated and restructured secret engine for KV (version 2 only) [[GH-22559](https://github.com/hashicorp/vault/pull/22559)]
-* **Merkle Tree Corruption Detection (enterprise)**: Add a new endpoint to check merkle tree corruption.
-* **Plugin Containers**: Vault supports registering, managing, and running plugins inside a container on Linux. [[GH-22712](https://github.com/hashicorp/vault/pull/22712)]
-* **SAML Auth Method (enterprise)**: Enable users to authenticate with Vault using their identity in a SAML Identity Provider.
-* **Seal High Availability Beta (enterprise)**: operators can try out configuring more than one automatic seal for resilience against seal provider outages.  Not for production use at this time.
-* **Secrets Sync (enterprise)**: Add the ability to synchronize KVv2 secret with external secrets manager solutions.
-* **UI LDAP secrets engine**: Add LDAP secrets engine to the UI. [[GH-20790](https://github.com/hashicorp/vault/pull/20790)]
+* Raft: Auto-join will now allow you to enforce IPv4 on networks that allow IPv6 and dual-stack enablement, which is on by default in certain regions.
+* auth/cert: Support RFC 9440 colon-wrapped Base64 certificates in `x_forwarded_for_client_cert_header`, to fix TLS certificate auth errors with Google Cloud Application Load Balancer.
 
-IMPROVEMENTS:
+BUG FIXES:
 
-* Bump github.com/hashicorp/go-plugin version v1.4.9 -> v1.4.10 [[GH-20966](https://github.com/hashicorp/vault/pull/20966)]
-* api: add support for cloning a Client's tls.Config. [[GH-21424](https://github.com/hashicorp/vault/pull/21424)]
-* api: adding a new api sys method for replication status [[GH-20995](https://github.com/hashicorp/vault/pull/20995)]
-* audit: add core audit events experiment [[GH-21628](https://github.com/hashicorp/vault/pull/21628)]
-* auth/aws: Added support for signed GET requests for authenticating to vault using the aws iam method. [[GH-10961](https://github.com/hashicorp/vault/pull/10961)]
-* auth/azure: Add support for azure workload identity authentication (see issue
-#18257). Update go-kms-wrapping dependency to include [PR
-#155](https://github.com/hashicorp/go-kms-wrapping/pull/155) [[GH-22994](https://github.com/hashicorp/vault/pull/22994)]
-* auth/azure: Added Azure API configurable retry options [[GH-23059](https://github.com/hashicorp/vault/pull/23059)]
-* auth/cert: Adds support for requiring hexadecimal-encoded non-string certificate extension values [[GH-21830](https://github.com/hashicorp/vault/pull/21830)]
-* auth/ldap: improved login speed by adding concurrency to LDAP token group searches [[GH-22659](https://github.com/hashicorp/vault/pull/22659)]
-* auto-auth/azure: Added Azure Workload Identity Federation support to auto-auth (for Vault Agent and Vault Proxy). [[GH-22264](https://github.com/hashicorp/vault/pull/22264)]
-* auto-auth: added support for LDAP auto-auth [[GH-21641](https://github.com/hashicorp/vault/pull/21641)]
-* aws/auth: Adds a new config field `use_sts_region_from_client` which allows for using dynamic regional sts endpoints based on Authorization header when using IAM-based authentication. [[GH-21960](https://github.com/hashicorp/vault/pull/21960)]
-* command/server: add `-dev-tls-san` flag to configure subject alternative names for the certificate generated when using `-dev-tls`. [[GH-22657](https://github.com/hashicorp/vault/pull/22657)]
-* core (ent) : Add field that allows lease-count namespace quotas to be inherited by child namespaces.
-* core : Add field that allows rate-limit namespace quotas to be inherited by child namespaces. [[GH-22452](https://github.com/hashicorp/vault/pull/22452)]
-* core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
-* core/quotas: Add configuration to allow skipping of expensive role calculations [[GH-22651](https://github.com/hashicorp/vault/pull/22651)]
-* core: Add a new periodic metric to track the number of available policies, `vault.policy.configured.count`. [[GH-21010](https://github.com/hashicorp/vault/pull/21010)]
-* core: Fix OpenAPI representation and `-output-policy` recognition of some non-standard sudo paths [[GH-21772](https://github.com/hashicorp/vault/pull/21772)]
-* core: Fix regexes for `sys/raw/` and `sys/leases/lookup/` to match prevailing conventions [[GH-21760](https://github.com/hashicorp/vault/pull/21760)]
-* core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [[GH-22235](https://github.com/hashicorp/vault/pull/22235)]
-* core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [[GH-22567](https://github.com/hashicorp/vault/pull/22567)]
-* core: add a listener configuration "chroot_namespace" that forces requests to use a namespace hierarchy [[GH-22304](https://github.com/hashicorp/vault/pull/22304)]
-* core: add a listener configuration "chroot_namespace" that forces requests to use a namespace hierarchy
-* core: remove unnecessary *BarrierView field from backendEntry struct [[GH-20933](https://github.com/hashicorp/vault/pull/20933)]
-* core: use Go stdlib functionalities instead of explicit byte/string conversions [[GH-21854](https://github.com/hashicorp/vault/pull/21854)]
-* eventbus: updated go-eventlogger library to allow removal of nodes referenced by pipelines (used for subscriptions) [[GH-21623](https://github.com/hashicorp/vault/pull/21623)]
-* events: Allow subscriptions to multiple namespaces [[GH-22540](https://github.com/hashicorp/vault/pull/22540)]
-* events: Enabled by default [[GH-22815](https://github.com/hashicorp/vault/pull/22815)]
-* events: WebSocket subscriptions add support for boolean filter expressions [[GH-22835](https://github.com/hashicorp/vault/pull/22835)]
-* framework: Make it an error for `CreateOperation` to be defined without an `ExistenceCheck`, thereby fixing misleading `x-vault-createSupported` in OpenAPI [[GH-18492](https://github.com/hashicorp/vault/pull/18492)]
-* kmip (enterprise): Add namespace lock and unlock support [[GH-21925](https://github.com/hashicorp/vault/pull/21925)]
-* openapi: Better mount points for kv-v1 and kv-v2 in openapi.json [[GH-21563](https://github.com/hashicorp/vault/pull/21563)]
-* openapi: Fix generated types for duration strings [[GH-20841](https://github.com/hashicorp/vault/pull/20841)]
-* openapi: Fix generation of correct fields in some rarer cases [[GH-21942](https://github.com/hashicorp/vault/pull/21942)]
-* openapi: Fix response definitions for list operations [[GH-21934](https://github.com/hashicorp/vault/pull/21934)]
-* openapi: List operations are now given first-class representation in the OpenAPI document, rather than sometimes being overlaid with a read operation at the same path [[GH-21723](https://github.com/hashicorp/vault/pull/21723)]
-* plugins: Containerized plugins can be configured to still work when running with systemd's PrivateTmp=true setting. [[GH-23215](https://github.com/hashicorp/vault/pull/23215)]
-* replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
-* replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
-* sdk/framework: Adds replication state helper for backends to check for read-only storage [[GH-21743](https://github.com/hashicorp/vault/pull/21743)]
-* secrets/database: Improves error logging for static role rotations by including the database and role names. [[GH-22253](https://github.com/hashicorp/vault/pull/22253)]
-* secrets/db: Remove the `service_account_json` parameter when reading DB connection details [[GH-23256](https://github.com/hashicorp/vault/pull/23256)]
-* secrets/pki: Add a parameter to allow ExtKeyUsage field usage from a role within ACME. [[GH-21702](https://github.com/hashicorp/vault/pull/21702)]
-* secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
-* secrets/transit: Add support to create CSRs from keys in transit engine and import/export x509 certificates [[GH-21081](https://github.com/hashicorp/vault/pull/21081)]
-* storage/dynamodb: Added three permit pool metrics for the DynamoDB backend, `pending_permits`, `active_permits`, and `pool_size`. [[GH-21742](https://github.com/hashicorp/vault/pull/21742)]
-* storage/etcd: Make etcd parameter MaxCallSendMsgSize configurable [[GH-12666](https://github.com/hashicorp/vault/pull/12666)]
-* storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [[GH-22040](https://github.com/hashicorp/vault/pull/22040)]
-* sys/metrics (enterprise): Adds a gauge metric that tracks whether enterprise builtin secret plugins are enabled. [[GH-21681](https://github.com/hashicorp/vault/pull/21681)]
-* ui: Add API Explorer link to Sidebar, under Tools. [[GH-21578](https://github.com/hashicorp/vault/pull/21578)]
-* ui: Add pagination to PKI roles, keys, issuers, and certificates list pages [[GH-23193](https://github.com/hashicorp/vault/pull/23193)]
-* ui: Added allowed_domains_template field for CA type role in SSH engine [[GH-23119](https://github.com/hashicorp/vault/pull/23119)]
-* ui: Adds mount configuration details to Kubernetes secrets engine configuration view [[GH-22926](https://github.com/hashicorp/vault/pull/22926)]
-* ui: Adds tidy_revoked_certs to PKI tidy status page [[GH-23232](https://github.com/hashicorp/vault/pull/23232)]
-* ui: Adds warning before downloading KV v2 secret values [[GH-23260](https://github.com/hashicorp/vault/pull/23260)]
-* ui: Display minus icon for empty MaskedInput value. Show MaskedInput for KV secrets without values [[GH-22039](https://github.com/hashicorp/vault/pull/22039)]
-* ui: JSON diff view available in "Create New Version" form for KV v2 [[GH-22593](https://github.com/hashicorp/vault/pull/22593)]
-* ui: KV View Secret card will link to list view if input ends in "/" [[GH-22502](https://github.com/hashicorp/vault/pull/22502)]
-* ui: Move access to  KV V2 version diff view to toolbar in Version History [[GH-23200](https://github.com/hashicorp/vault/pull/23200)]
-* ui: Update pki mount configuration details to match the new mount configuration details pattern [[GH-23166](https://github.com/hashicorp/vault/pull/23166)]
-* ui: add example modal to policy form [[GH-21583](https://github.com/hashicorp/vault/pull/21583)]
-* ui: adds allowed_user_ids field to create role form and user_ids to generate certificates form in pki [[GH-22191](https://github.com/hashicorp/vault/pull/22191)]
-* ui: display CertificateCard instead of MaskedInput for certificates in PKI [[GH-22160](https://github.com/hashicorp/vault/pull/22160)]
-* ui: enables create and update KV secret workflow when control group present [[GH-22471](https://github.com/hashicorp/vault/pull/22471)]
-* ui: implement hashicorp design system [alert](https://helios.hashicorp.design/components/alert) component [[GH-21375](https://github.com/hashicorp/vault/pull/21375)]
-* ui: update detail views that render ttl durations to display full unit instead of letter (i.e. 'days' instead of 'd') [[GH-20697](https://github.com/hashicorp/vault/pull/20697)]
-* ui: update unseal and DR operation token flow components [[GH-21871](https://github.com/hashicorp/vault/pull/21871)]
-* ui: upgrade Ember to 4.12 [[GH-22122](https://github.com/hashicorp/vault/pull/22122)]
+* auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load.
+* core: Fixed issue where under certain circumstances the rotation manager would spawn goroutines indefinitely.
+* core: Role based quotas now work for cert auth
+* secrets/transit: Fix error when using ed25519 keys that were imported with derivation enabled
+* sys/mounts: enable unsetting allowed_response_headers
 
-DEPRECATIONS:
+## 1.19.9 Enterprise
+### August 28, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+FEATURES:
+
+* **IBM RACF Static Role Password Phrase Management**: Add support for static role password phrase management to the LDAP secrets engine. (https://github.com/hashicorp/vault-plugin-secrets-openldap/pull/184)
+
+SECURITY:
 
-* auth/centrify: Centrify plugin is deprecated as of 1.15, slated for removal in 1.17 [[GH-23050](https://github.com/hashicorp/vault/pull/23050)]
-
-BUG FIXES:
-
-* activity (enterprise): Fix misattribution of entities to no or child namespace auth methods [[GH-18809](https://github.com/hashicorp/vault/pull/18809)]
-* agent: Environment variable VAULT_CACERT_BYTES now works for Vault Agent templates. [[GH-22322](https://github.com/hashicorp/vault/pull/22322)]
-* agent: Fix "generate-config" command documentation URL [[GH-21466](https://github.com/hashicorp/vault/pull/21466)]
-* api/client: Fix deadlock in client.CloneWithHeaders when used alongside other client methods. [[GH-22410](https://github.com/hashicorp/vault/pull/22410)]
-* api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [[GH-22523](https://github.com/hashicorp/vault/pull/22523)]
-* audit: Prevent panic due to nil pointer receiver for audit header formatting. [[GH-22694](https://github.com/hashicorp/vault/pull/22694)]
-* auth/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21800](https://github.com/hashicorp/vault/pull/21800)]
-* auth/token, sys: Fix path-help being unavailable for some list-only endpoints [[GH-18571](https://github.com/hashicorp/vault/pull/18571)]
-* auth/token: Fix parsing of `auth/token/create` fields to avoid incorrect warnings about ignored parameters [[GH-18556](https://github.com/hashicorp/vault/pull/18556)]
-* awsutil: Update awsutil to v0.2.3 to fix a regression where Vault no longer
-respects `AWS_ROLE_ARN`, `AWS_WEB_IDENTITY_TOKEN_FILE`, and `AWS_ROLE_SESSION_NAME`. [[GH-21951](https://github.com/hashicorp/vault/pull/21951)]
-* cli: Avoid printing "Success" message when `-field` flag is provided during a `vault write`. [[GH-21546](https://github.com/hashicorp/vault/pull/21546)]
-* cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to `table`. [[GH-22818](https://github.com/hashicorp/vault/pull/22818)]
-* core (enterprise): Fix sentinel policy check logic so that sentinel
-policies are not used when Sentinel feature isn't licensed.
-* core (enterprise): Remove MFA Configuration for namespace when deleting namespace
-* core/managed-keys (enterprise): Allow certain symmetric PKCS#11 managed key mechanisms (AES CBC with and without padding) to operate without an HMAC.
-* core/metrics: vault.raft_storage.bolt.write.time should be a counter not a summary [[GH-22468](https://github.com/hashicorp/vault/pull/22468)]
-* core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
-Also fix a related potential deadlock. [[GH-21110](https://github.com/hashicorp/vault/pull/21110)]
-* core/quotas: Only perform ResolveRoleOperation for role-based quotas and lease creation. [[GH-22597](https://github.com/hashicorp/vault/pull/22597)]
-* core/quotas: Reduce overhead for role calculation when using cloud auth methods. [[GH-22583](https://github.com/hashicorp/vault/pull/22583)]
-* core:  Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [[GH-22137](https://github.com/hashicorp/vault/pull/22137)]
-* core: All subloggers now reflect configured log level on reload. [[GH-22038](https://github.com/hashicorp/vault/pull/22038)]
-* core: Fix bug where background thread to update locked user entries runs on DR secondaries. [[GH-22355](https://github.com/hashicorp/vault/pull/22355)]
-* core: Fix readonly errors that could occur while loading mounts/auths during unseal [[GH-22362](https://github.com/hashicorp/vault/pull/22362)]
-* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-21470](https://github.com/hashicorp/vault/pull/21470)]
-* core: Fixed issue with some durations not being properly parsed to include days. [[GH-21357](https://github.com/hashicorp/vault/pull/21357)]
-* core: Fixes list password policy to include those with names containing / characters. [[GH-23155](https://github.com/hashicorp/vault/pull/23155)]
-* core: fix race when updating a mount's route entry tainted status and incoming requests [[GH-21640](https://github.com/hashicorp/vault/pull/21640)]
-* events: Ensure subscription resources are cleaned up on close. [[GH-23042](https://github.com/hashicorp/vault/pull/23042)]
-* expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [[GH-22374](https://github.com/hashicorp/vault/pull/22374)]
-* identity/mfa: Fixes to OpenAPI representation and returned error codes for `identity/mfa/method/*` APIs [[GH-20879](https://github.com/hashicorp/vault/pull/20879)]
-* identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [[GH-20965](https://github.com/hashicorp/vault/pull/20965)]
-* license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [[GH-22363](https://github.com/hashicorp/vault/pull/22363)]
-* openapi: Fix response schema for PKI Issue requests [[GH-21449](https://github.com/hashicorp/vault/pull/21449)]
-* openapi: Fix schema definitions for PKI EAB APIs [[GH-21458](https://github.com/hashicorp/vault/pull/21458)]
-* plugins: Containerized plugins can be run with mlock enabled. [[GH-23215](https://github.com/hashicorp/vault/pull/23215)]
-* plugins: Fix instance where Vault could fail to kill broken/unresponsive plugins. [[GH-22914](https://github.com/hashicorp/vault/pull/22914)]
-* plugins: Fix instance where broken/unresponsive plugins could cause Vault to hang. [[GH-22914](https://github.com/hashicorp/vault/pull/22914)]
-* plugins: Runtime catalog returns 404 instead of 500 when reading a runtime that does not exist [[GH-23171](https://github.com/hashicorp/vault/pull/23171)]
-* plugins: `vault plugin runtime list` can successfully list plugin runtimes with GET [[GH-23171](https://github.com/hashicorp/vault/pull/23171)]
-* raft/autopilot: Add dr-token flag for raft autopilot cli commands [[GH-21165](https://github.com/hashicorp/vault/pull/21165)]
-* replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
-* replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
-* replication (enterprise): Fix panic when update-primary was called on demoted clusters using update_primary_addrs
-* replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
-* replication (enterprise): Sort cluster addresses returned by echo requests, so that primary-addrs only gets persisted when the
-set of addrs changes.
-* replication (enterprise): update primary cluster address after DR failover
-* sdk/ldaputil: Properly escape user filters when using UPN domains
-sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [[GH-22249](https://github.com/hashicorp/vault/pull/22249)]
-* secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21631](https://github.com/hashicorp/vault/pull/21631)]
-* secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [[GH-22330](https://github.com/hashicorp/vault/pull/22330)]
-* secrets/pki: Fix bug with ACME tidy, 'unable to determine acme base folder path'. [[GH-21870](https://github.com/hashicorp/vault/pull/21870)]
-* secrets/pki: Fix preserving acme_account_safety_buffer on config/auto-tidy. [[GH-21870](https://github.com/hashicorp/vault/pull/21870)]
-* secrets/pki: Fix removal of issuers to clean up unreferenced CRLs. [[GH-23007](https://github.com/hashicorp/vault/pull/23007)]
-* secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error: `no managed key found with uuid`. [[GH-21316](https://github.com/hashicorp/vault/pull/21316)]
-* secrets/pki: allowed_domains are now compared in a case-insensitive manner if they use glob patterns [[GH-22126](https://github.com/hashicorp/vault/pull/22126)]
-* secrets/transform (enterprise): Batch items with repeated tokens in the tokenization decode api will now contain the decoded_value element
-* secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
-* secrets/transform (enterprise): Fix nil panic when encoding a tokenization transformation on a non-active node
-* secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
-* secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
-* secrets/transit: fix panic when providing non-PEM formatted public key for import [[GH-22753](https://github.com/hashicorp/vault/pull/22753)]
-* serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [[GH-21642](https://github.com/hashicorp/vault/pull/21642)]
-* storage/consul: Consul service registration tags are now case-sensitive. [[GH-6483](https://github.com/hashicorp/vault/pull/6483)]
-* storage/raft: Fix race where new follower joining can get pruned by dead server cleanup. [[GH-20986](https://github.com/hashicorp/vault/pull/20986)]
-* ui (enterprise): Fix error message when generating SSH credential with control group [[GH-23025](https://github.com/hashicorp/vault/pull/23025)]
-* ui: Adds missing values to details view after generating PKI certificate [[GH-21635](https://github.com/hashicorp/vault/pull/21635)]
-* ui: Fix blank page or ghost secret when canceling KV secret create [[GH-22541](https://github.com/hashicorp/vault/pull/22541)]
-* ui: Fix display for "Last Vault Rotation" timestamp for static database roles which was not rendering or copyable [[GH-22519](https://github.com/hashicorp/vault/pull/22519)]
-* ui: Fix styling for username input when editing a user [[GH-21771](https://github.com/hashicorp/vault/pull/21771)]
-* ui: Fix styling for viewing certificate in kubernetes configuration [[GH-21968](https://github.com/hashicorp/vault/pull/21968)]
-* ui: Fix the issue where confirm delete dropdown is being cut off [[GH-23066](https://github.com/hashicorp/vault/pull/23066)]
-* ui: Fixed an issue where editing an SSH role would clear `default_critical_options` and `default_extension` if left unchanged. [[GH-21739](https://github.com/hashicorp/vault/pull/21739)]
-* ui: Fixed secrets, leases, and policies filter dropping focus after a single character [[GH-21767](https://github.com/hashicorp/vault/pull/21767)]
-* ui: Fixes filter and search bug in secrets engines [[GH-23123](https://github.com/hashicorp/vault/pull/23123)]
-* ui: Fixes form field label tooltip alignment [[GH-22832](https://github.com/hashicorp/vault/pull/22832)]
-* ui: Fixes issue with certain navigational links incorrectly displaying in child namespaces [[GH-21562](https://github.com/hashicorp/vault/pull/21562)]
-* ui: Fixes login screen display issue with Safari browser [[GH-21582](https://github.com/hashicorp/vault/pull/21582)]
-* ui: Fixes problem displaying certificates issued with unsupported signature algorithms (i.e. ed25519) [[GH-21926](https://github.com/hashicorp/vault/pull/21926)]
-* ui: Fixes styling of private key input when configuring an SSH key [[GH-21531](https://github.com/hashicorp/vault/pull/21531)]
-* ui: Surface DOMException error when browser settings prevent localStorage. [[GH-21503](https://github.com/hashicorp/vault/pull/21503)]
-* ui: correct doctype for index.html [[GH-22153](https://github.com/hashicorp/vault/pull/22153)]
-* ui: don't exclude features present on license [[GH-22855](https://github.com/hashicorp/vault/pull/22855)]
-* ui: fixes `max_versions` default for secret metadata unintentionally overriding kv engine defaults [[GH-22394](https://github.com/hashicorp/vault/pull/22394)]
-* ui: fixes long namespace names overflow in the sidebar
-* ui: fixes model defaults overwriting input value when user tries to clear form input [[GH-22458](https://github.com/hashicorp/vault/pull/22458)]
-* ui: fixes text readability issue in revoke token confirmation dialog [[GH-22390](https://github.com/hashicorp/vault/pull/22390)]
-
-## 1.14.9
-### January 31, 2024
+* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3.
 
 CHANGES:
 
-* core: Bump Go version to 1.20.12.
-* database/snowflake: Update plugin to v0.9.2 [[GH-25057](https://github.com/hashicorp/vault/pull/25057)]
+* core: Bump Go version to 1.24.6.
+* http: Add JSON configurable limits to HTTP handling for JSON payloads: `max_json_depth`, `max_json_string_value_length`, `max_json_object_entry_count`, `max_json_array_element_count`.
+* sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible
+* secrets/openldap: update plugin to v0.15.5
 
 IMPROVEMENTS:
 
-* command/server: display logs on startup immediately if disable-gated-logs flag is set [[GH-24280](https://github.com/hashicorp/vault/pull/24280)]
-* oidc/provider: Adds `code_challenge_methods_supported` to OpenID Connect Metadata [[GH-24979](https://github.com/hashicorp/vault/pull/24979)]
-* storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [[GH-24010](https://github.com/hashicorp/vault/pull/24010)]
-* ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [[GH-18513](https://github.com/hashicorp/vault/pull/18513)]
+* auth/ldap: add explicit logging to rotations in ldap
+* core (enterprise): improve rotation manager logging to include specific lines for rotation success and failure
+* secrets/database: log password rotation success (info) and failure (error). Some relevant log lines have been updated to include "path" fields.
+* secrets/transit: add logging on both success and failure of key rotation
+* ui: Use the Helios Design System Code Block component for all readonly code editors and use its Code Editor component for all other code editors
 
 BUG FIXES:
 
-* helper/pkcs7: Fix slice out-of-bounds panic [[GH-24891](https://github.com/hashicorp/vault/pull/24891)]
-* kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
-* ui: Fixed minor bugs with database secrets engine [[GH-24947](https://github.com/hashicorp/vault/pull/24947)]
-* ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [[GH-24697](https://github.com/hashicorp/vault/pull/24697)]
-* ui: The UI can now be used to create or update database roles by operator without permission on the database connection. [[GH-24660](https://github.com/hashicorp/vault/pull/24660)]
-* ui: fix incorrectly calculated capabilities on PKI issuer endpoints [[GH-24686](https://github.com/hashicorp/vault/pull/24686)]
+* core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration
+* core/metrics: Add service name prefix for core HA metrics to avoid duplicate, zero-value metrics.
+* core/seal: When Seal-HA is enabled, make it an error to persist the barrier
+keyring when not all seals are healthy.  This prevents the possibility of
+failing to unseal when a different subset of seals are healthy than were
+healthy at last write.
+* raft (enterprise): auto-join will now work in regions that do not support dual-stack
+* raft/autopilot: Fixes an issue with enterprise redundancy zones where, if the leader was in a redundancy zone and that leader becomes unavailable, the node would become an unzoned voter. This can artificially inflate the required number of nodes for quorum, leading to a situation where the cluster cannot recover if another leader subsequently becomes unavailable. Vault will now keep an unavailable node in its last known redundancy zone as a non-voter.
+* replication (enterprise): Fix bug where group updates fail when processed on a
+standby node in a PR secondary cluster.
+* secrets-sync (enterprise): GCP locational KMS keys are no longer incorrectly removed when the location name is all lowercase.
+* secrets/database/postgresql: Support for multiline statements in the `rotation_statements` field.
 
-## 1.14.8
-### December 06, 2023
+## 1.19.8 Enterprise
+### August 06, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 SECURITY:
 
-* core: Fixes an issue present in both Vault and Vault Enterprise since Vault 1.12.0, where Vault is vulnerable to a denial of service through memory exhaustion of the host when handling large HTTP requests from a client. (see [CVE-2023-6337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6337) & [HCSEC-2023-34](https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741))
+* auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled [[GH-31427](https://github.com/hashicorp/vault/pull/31427),[HCSEC-2025-20](https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092)].
 
-CHANGES:
+BUG FIXES:
 
-* identity (enterprise): POST requests to the `/identity/entity/merge` endpoint
-are now always forwarded from standbys to the active node. [[GH-24325](https://github.com/hashicorp/vault/pull/24325)]
+* agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same. [[GH-31392](https://github.com/hashicorp/vault/pull/31392)]
+* identity/mfa: revert cache entry change from #31217 and document cache entry values [[GH-31421](https://github.com/hashicorp/vault/pull/31421)]
+
+## 1.19.7 Enterprise
+### July 25, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY: 
+
+* audit: **breaking change** privileged vault operator may execute code on the underlying host (CVE-2025-6000). Vault will not unseal if the only configured file audit device has executable permissions (e.g., 0777, 0755). See recent [breaking change](https://developer.hashicorp.com/vault/docs/updates/important-changes#breaking-changes) docs for more details. [[GH-31211](https://github.com/hashicorp/vault/pull/31211),[HCSEC-2025-14](https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033)]
+* auth/userpass: timing side-channel in vault's userpass auth method (CVE-2025-6011)[HCSEC-2025-15](https://discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034)
+* core/login: vault userpass and ldap user lockout bypass (CVE-2025-6004). update alias lookahead to respect username case for LDAP and username/password. [[GH-31352](https://github.com/hashicorp/vault/pull/31352),[HCSEC-2025-16](https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035)]
+* secrets/totp: vault totp secrets engine code reuse (CVE-2025-6014) [[GH-31246](https://github.com/hashicorp/vault/pull/31246),[HCSEC-2025-17](https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036)]
+* auth/cert: vault certificate auth method did not validate common name for non-ca certificates (CVE-2025-6037). test non-CA cert equality on login matching instead of individual fields. [[GH-31210](https://github.com/hashicorp/vault/pull/31210),[HCSEC-2025-18](https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037)]
+* core/mfa: vault login mfa bypass of rate limiting and totp token reuse (CVE-2025-6015) [[GH-31217](https://github.com/hashicorp/vault/pull/31297),[HCSEC-2025-19](https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038)]
 
 BUG FIXES:
 
-* agent/logging: Agent should now honor correct -log-format and -log-file settings in logs generated by the consul-template library. [[GH-24252](https://github.com/hashicorp/vault/pull/24252)]
-* api: Fix deadlock on calls to sys/leader with a namespace configured
-on the request. [[GH-24256](https://github.com/hashicorp/vault/pull/24256)]
-* core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [[GH-24336](https://github.com/hashicorp/vault/pull/24336)]
-* ui: Fix payload sent when disabling replication [[GH-24292](https://github.com/hashicorp/vault/pull/24292)]
+* auto-reporting (enterprise): Clarify debug logs to accurately reflect when automated license utilization reporting is enabled or disabled, especially since manual reporting is always initialized.
+* core/seal (enterprise): Fix a bug that caused the seal rewrap process to abort in the presence of partially sealed entries.
+* kmip (enterprise): Fix a panic that can happen when a KMIP client makes a request before the Vault server has finished unsealing. [[GH-31266](https://github.com/hashicorp/vault/pull/31266)]
+* plugins: Fix panics that can occur when a plugin audits a request or response before the Vault server has finished unsealing. [[GH-31266](https://github.com/hashicorp/vault/pull/31266)]
+* product usage reporting (enterprise): Clarify debug logs to accurately reflect when anonymous product usage reporting is enabled or disabled, especially since manual reporting is always initialized.
+* replication (enterprise): Fix bug with mount invalidations consuming excessive memory.
+* secrets-sync (enterprise): Unsyncing secret-key granularity associations will no longer give a misleading error about a failed unsync operation that did indeed succeed.
+* secrets/gcp: Update to vault-plugin-secrets-gcp@v0.21.4 to address more eventual consistency issues
+
+## 1.19.6 Enterprise
+### June 25, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY:
 
-## 1.14.7
-### November 30, 2023
+* core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes. [[GH-30794](https://github.com/hashicorp/vault/pull/30794)],[[HCSEC-2025-11](https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570)]
+* core/identity: vault root namespace operator may elevate privileges (CVE-2025-5999). Fix string contains check in Identity APIs to be case-insensitive. [[GH-31045](https://github.com/hashicorp/vault/pull/31045),[HCSEC-2025-13](https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032)]
 
 CHANGES:
 
-* core: Bump Go version to 1.20.11.
+* api: Update the default API client to check for the `Retry-After` header and, if it exists, wait for the specified duration before retrying the request. [[GH-30887](https://github.com/hashicorp/vault/pull/30887)]
+* auth/azure: Update plugin to v0.20.5
+* core: Bump Go version to 1.24.4.
+* quotas/rate-limit: Round up the `Retry-After` value to the nearest second when calculating the retry delay. [[GH-30887](https://github.com/hashicorp/vault/pull/30887)]
+* secrets/azure: Update plugin to v0.21.4 [[GH-30833](https://github.com/hashicorp/vault/pull/30833)]
+* secrets/database: Update vault-plugin-database-snowflake to v0.13.2 [[GH-30867](https://github.com/hashicorp/vault/pull/30867)]
 
 IMPROVEMENTS:
 
-* core (enterprise): Speed up unseal when using namespaces
-* secrets/pki: do not check TLS validity on ACME requests redirected to https [[GH-22521](https://github.com/hashicorp/vault/pull/22521)]
-* ui: Sort list view of entities and aliases alphabetically using the item name [[GH-24103](https://github.com/hashicorp/vault/pull/24103)]
-* ui: Update flat, shell-quote and swagger-ui-dist packages. Remove swagger-ui styling overrides. [[GH-23700](https://github.com/hashicorp/vault/pull/23700)]
+* core: Improve memory use of path management for namespaces, auth methods, and secrets engines. Now Vault should handle larger numbers of namespaces and multiple instances of the same secrets engine or auth method more efficiently. [[GH-31022](https://github.com/hashicorp/vault/pull/31022)]
 
-BUG FIXES:
+DEPRECATIONS:
 
-* activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
-* auth/cert: Handle errors related to expired OCSP server responses [[GH-24193](https://github.com/hashicorp/vault/pull/24193)]
-* core/config: Use correct HCL config value when configuring `log_requests_level`. [[GH-24058](https://github.com/hashicorp/vault/pull/24058)]
-* core/quotas: Close rate-limit blocked client purge goroutines when sealing [[GH-24108](https://github.com/hashicorp/vault/pull/24108)]
-* replication (enterprise): disallow configuring paths filter for a mount path that does not exist
-* secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [[GH-24192](https://github.com/hashicorp/vault/pull/24192)]
-* secrets/transit: Fix a panic when attempting to export a public RSA key [[GH-24054](https://github.com/hashicorp/vault/pull/24054)]
-* ui: Fix error when tuning token auth configuration within namespace [[GH-24147](https://github.com/hashicorp/vault/pull/24147)]
+* core: deprecate duplicate attributes in HCL configuration files and policy definitions [[GH-30386](https://github.com/hashicorp/vault/pull/30386)]
 
-## 1.14.6
-### November 09, 2023
+BUG FIXES:
 
-SECURITY:
-* core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [[HSEC-2023-33](https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926)]
+* core: Omit automatic version control information of the main module from compiled Vault binaries [[GH-30926](https://github.com/hashicorp/vault/pull/30926)]
+* secrets/database: Treat all rotation_schedule values as UTC to ensure consistent behavior. [[GH-30606](https://github.com/hashicorp/vault/pull/30606)]
+* secrets/transit (enterprise): ensure verify endpoint always returns valid field in batch_results with CMAC
+* secrets/transit: ensure verify endpoint always returns valid field in batch_results with HMAC [[GH-30852](https://github.com/hashicorp/vault/pull/30852)]
+* ui/kmip: Fixes KMIP credentials view and displays `private_key` after generating [[GH-30778](https://github.com/hashicorp/vault/pull/30778)]
+* ui: Redirect users authenticating with Vault as an OIDC provider to log in again when token expires. [[GH-30838](https://github.com/hashicorp/vault/pull/30838)]
 
-CHANGES:
+## 1.19.5
+### May 30, 2025
 
-* auth/approle: Normalized error response messages when invalid credentials are provided [[GH-23786](https://github.com/hashicorp/vault/pull/23786)]
-* secrets/mongodbatlas: Update plugin to v0.10.2 [[GH-23849](https://github.com/hashicorp/vault/pull/23849)]
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
-FEATURES:
+CHANGES:
 
-* cli/snapshot: Add CLI tool to inspect Vault snapshots [[GH-23457](https://github.com/hashicorp/vault/pull/23457)]
+* database/snowflake: Update plugin to v0.13.1 [[GH-30775](https://github.com/hashicorp/vault/pull/30775)]
 
 IMPROVEMENTS:
 
-* storage/etcd: etcd should only return keys when calling List() [[GH-23872](https://github.com/hashicorp/vault/pull/23872)]
+* plugins: Support registration of CE plugins with extracted artifact directory. [[GH-30673](https://github.com/hashicorp/vault/pull/30673)]
 
 BUG FIXES:
 
-* api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
-on the request. [[GH-23861](https://github.com/hashicorp/vault/pull/23861)]
-* core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
-* core/activity: Fixes segments fragment loss due to exceeding entry record size limit [[GH-23781](https://github.com/hashicorp/vault/pull/23781)]
-* core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [[GH-23802](https://github.com/hashicorp/vault/pull/23802)]
-* core: Revert PR causing memory consumption bug [[GH-23986](https://github.com/hashicorp/vault/pull/23986)]
-* core: Skip unnecessary deriving of policies during Login MFA Check. [[GH-23894](https://github.com/hashicorp/vault/pull/23894)]
-* core: fix bug where deadlock detection was always on for expiration and quotas. 
-These can now be configured individually with `detect_deadlocks`. [[GH-23902](https://github.com/hashicorp/vault/pull/23902)]
-* core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [[GH-23874](https://github.com/hashicorp/vault/pull/23874)]
-* expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [[GH-24027](https://github.com/hashicorp/vault/pull/24027)]
+* ui: Fix broken link to Hashicorp Vault developer site in the Web REPL help. [[GH-30670](https://github.com/hashicorp/vault/pull/30670)]
 
-## 1.14.5
-### October 25, 2023
+## 1.19.4
+### May 16, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 CHANGES:
 
-* core: Bump Go version to 1.20.10.
-* replication (enterprise): Switch to non-deprecated gRPC field for resolver target host
+* Update vault-plugin-auth-cf to v0.20.1 [[GH-30586](https://github.com/hashicorp/vault/pull/30586)]
+* auth/azure: Update plugin to v0.20.4 [[GH-30543](https://github.com/hashicorp/vault/pull/30543)]
+* core: Bump Go version to 1.24.3.
 
 IMPROVEMENTS:
 
-* api/plugins: add `tls-server-name` arg for plugin registration [[GH-23549](https://github.com/hashicorp/vault/pull/23549)]
-* core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [[GH-22567](https://github.com/hashicorp/vault/pull/22567)]
-* ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [[GH-23747](https://github.com/hashicorp/vault/pull/23747)]
+* Namespaces (enterprise): allow a root token to relock a namespace
+* core (enterprise): update to FIPS 140-3 cryptographic module in the FIPS builds.
+* core: Updated code and documentation to support FIPS 140-3 compliant algorithms. [[GH-30576](https://github.com/hashicorp/vault/pull/30576)]
+* core: support for X25519MLKEM768 (post quantum key agreement) in the Go TLS stack. [[GH-30603](https://github.com/hashicorp/vault/pull/30603)]
+* ui: Replaces all instances of the deprecated event.keyCode with event.key [[GH-30493](https://github.com/hashicorp/vault/pull/30493)]
 
 BUG FIXES:
 
-* command/server: Fix bug with sigusr2 where pprof files were not closed correctly [[GH-23636](https://github.com/hashicorp/vault/pull/23636)]
-* events: Ignore sending context to give more time for events to send [[GH-23500](https://github.com/hashicorp/vault/pull/23500)]
-* expiration: Prevent large lease loads from delaying state changes, e.g. becoming active or standby. [[GH-23282](https://github.com/hashicorp/vault/pull/23282)]
-* kmip (enterprise): Improve handling of failures due to storage replication issues.
-* kmip (enterprise): Return a structure in the response for query function Query Server Information.
-* mongo-db: allow non-admin database for root credential rotation [[GH-23240](https://github.com/hashicorp/vault/pull/23240)]
-* replication (enterprise): Fix a bug where undo logs would only get enabled on the initial node in a cluster.
-* replication (enterprise): Fix a missing unlock when changing replication state
-* secrets/consul: Fix revocations when Vault has an access token using specific namespace and admin partition policies [[GH-23010](https://github.com/hashicorp/vault/pull/23010)]
-* secrets/pki: Stop processing in-flight ACME verifications when an active node steps down [[GH-23278](https://github.com/hashicorp/vault/pull/23278)]
-* secrets/transit (enterprise): Address an issue using sign/verify operations with managed keys returning an error about it not containing a private key
-* secrets/transit (enterprise): Address panic when using GCP,AWS,Azure managed keys for encryption operations. At this time all encryption operations for the cloud providers have been disabled, only signing operations are supported.
-* secrets/transit (enterprise): Apply hashing arguments and defaults to managed key sign/verify operations
-* secrets/transit: Do not allow auto rotation on managed_key key types [[GH-23723](https://github.com/hashicorp/vault/pull/23723)]
-* storage/consul: fix a bug where an active node in a specific sort of network
-partition could continue to write data to Consul after a new leader is elected
-potentially causing data loss or corruption for keys with many concurrent
-writers. For Enterprise clusters this could cause corruption of the merkle trees
-leading to failure to complete merkle sync without a full re-index. [[GH-23013](https://github.com/hashicorp/vault/pull/23013)]
-* ui: Decode the connection url for display on the connection details page [[GH-23695](https://github.com/hashicorp/vault/pull/23695)]
-* ui: Fix AWS secret engine to allow empty policy_document field. [[GH-23470](https://github.com/hashicorp/vault/pull/23470)]
-* ui: Fix the copy token button in the sidebar navigation window when in a collapsed state. [[GH-23331](https://github.com/hashicorp/vault/pull/23331)]
-* ui: Fixes issue with sidebar navigation links disappearing when navigating to policies when a user is not authorized [[GH-23516](https://github.com/hashicorp/vault/pull/23516)]
+* core (enterprise): fix a bug where plugin automated root rotations would stop after seal/unseal operations
+* plugins (enterprise): Fix an issue where Enterprise plugins can't run on a standby node
+when it becomes active because standby nodes don't extract the artifact when the plugin
+is registered. Remove extracting from Vault and require the operator to place
+the extracted artifact in the plugin directory before registration.
 
-## 1.14.4
-### September 27, 2023
+## 1.19.3
+### April 30, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 SECURITY:
 
-* sentinel (enterprise): Sentinel RGP policies allowed for cross-namespace denial-of-service. This vulnerability, CVE-2023-3775, is fixed in Vault Enterprise 1.15.0, 1.14.4, and 1.13.8. [[HSEC-2023-29](https://discuss.hashicorp.com/t/hcsec-2023-29-vault-enterprise-s-sentinel-rgp-policies-allowed-for-cross-namespace-denial-of-service/58653)]
+* core: vault may expose sensitive information in error logs when processing malformed data with the kv v2 plugin[[GH-30388](https://github.com/hashicorp/vault/pull/30388), [HCSEC-2025-09](https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717)]
 
 CHANGES:
 
-* core (enterprise): Ensure Role Governing Policies are only applied down the namespace hierarchy
-
-IMPROVEMENTS:
-
-* ui: Add pagination to PKI roles, keys, issuers, and certificates list pages [[GH-23193](https://github.com/hashicorp/vault/pull/23193)]
-* ui: Added allowed_domains_template field for CA type role in SSH engine [[GH-23119](https://github.com/hashicorp/vault/pull/23119)]
-* ui: Adds tidy_revoked_certs to PKI tidy status page [[GH-23232](https://github.com/hashicorp/vault/pull/23232)]
-* ui: Adds warning before downloading KV v2 secret values [[GH-23260](https://github.com/hashicorp/vault/pull/23260)]
+* auth/jwt: Update plugin to v0.23.2 [[GH-30434](https://github.com/hashicorp/vault/pull/30434)]
 
 BUG FIXES:
 
-* core: Fixes list password policy to include those with names containing / characters. [[GH-23155](https://github.com/hashicorp/vault/pull/23155)]
-* secrets/pki: Fix removal of issuers to clean up unreferenced CRLs. [[GH-23007](https://github.com/hashicorp/vault/pull/23007)]
-* ui (enterprise): Fix error message when generating SSH credential with control group [[GH-23025](https://github.com/hashicorp/vault/pull/23025)]
-* ui: Fix the issue where confirm delete dropdown is being cut off [[GH-23066](https://github.com/hashicorp/vault/pull/23066)]
-* ui: Fixes filter and search bug in secrets engines [[GH-23123](https://github.com/hashicorp/vault/pull/23123)]
-* ui: don't exclude features present on license [[GH-22855](https://github.com/hashicorp/vault/pull/22855)]
+* core (enterprise): fix issue with errors being swallowed on failed HSM logins.
+* database: Prevent static roles created in versions prior to 1.15.0 from rotating on backend restart. [[GH-30320](https://github.com/hashicorp/vault/pull/30320)]
+* database: no longer incorrectly add an "unrecognized parameters" warning for certain SQL database secrets config operations when another warning is returned [[GH-30327](https://github.com/hashicorp/vault/pull/30327)]
+* identity: Fix non-deterministic merge behavior when two entities have conflicting local aliases. [[GH-30390](https://github.com/hashicorp/vault/pull/30390)]
+* plugins: plugin registration should honor the `plugin_tmpdir` config [[GH-29978](https://github.com/hashicorp/vault/pull/29978)]
+* secrets/aws: fix a case where GovCloud wasn't taken into account; fix a case where the region setting wasn't respected [[GH-30312](https://github.com/hashicorp/vault/pull/30312)]
 
-## 1.14.3
-### September 13, 2023
+## 1.19.2
+### April 18, 2025
 
-SECURITY:
-
-* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. This vulnerability, CVE-2023-4680, is fixed in Vault 1.14.3, 1.13.7, and 1.12.11. [[GH-22852](https://github.com/hashicorp/vault/pull/22852), [HSEC-2023-28](https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249)]
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 CHANGES:
 
-* core: Bump Go version to 1.20.8.
-
-FEATURES:
+* core: Bump Go version to 1.23.7
+* core: Bump Go version to 1.23.8
+* secrets/openldap: Update plugin to v0.15.4 [[GH-30279](https://github.com/hashicorp/vault/pull/30279)]
 
-* ** Merkle Tree Corruption Detection (enterprise) **: Add a new endpoint to check merkle tree corruption.
+BUG FIXES:
 
-IMPROVEMENTS:
+* secrets/openldap: Prevent static role rotation on upgrade when `NextVaultRotation` is nil. Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing `NextVaultRotation` value. Now sets it to either `LastVaultRotation + RotationPeriod` or `now + RotationPeriod`. [[GH-30265](https://github.com/hashicorp/vault/pull/30265)]
+* secrets/pki (enterprise): Address a parsing bug that rejected CMPv2 requests containing a validity field.
+* secrets/pki: fix a bug where key_usage was ignored when generating root certificates, and signing certain intermediate certificates. [[GH-30034](https://github.com/hashicorp/vault/pull/30034)]
+* secrets/transit: fix a panic when rotating on a managed key returns an error [[GH-30214](https://github.com/hashicorp/vault/pull/30214)]
 
-* auth/ldap: improved login speed by adding concurrency to LDAP token group searches [[GH-22659](https://github.com/hashicorp/vault/pull/22659)]
-* core/quotas: Add configuration to allow skipping of expensive role calculations [[GH-22651](https://github.com/hashicorp/vault/pull/22651)]
-* kmip (enterprise): reduce latency of KMIP operation handling
+## 1.19.1
+### April 4, 2025
 
-BUG FIXES:
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
-* cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to `table`. [[GH-22818](https://github.com/hashicorp/vault/pull/22818)]
-* core/quotas: Only perform ResolveRoleOperation for role-based quotas and lease creation. [[GH-22597](https://github.com/hashicorp/vault/pull/22597)]
-* core/quotas: Reduce overhead for role calculation when using cloud auth methods. [[GH-22583](https://github.com/hashicorp/vault/pull/22583)]
-* core/seal: add a workaround for potential connection [[hangs](https://github.com/Azure/azure-sdk-for-go/issues/21346)] in Azure autoseals. [[GH-22760](https://github.com/hashicorp/vault/pull/22760)]
-* core: All subloggers now reflect configured log level on reload. [[GH-22038](https://github.com/hashicorp/vault/pull/22038)]
-* kmip (enterprise): fix date handling error with some re-key operations
-* raft/autopilot: Add dr-token flag for raft autopilot cli commands [[GH-21165](https://github.com/hashicorp/vault/pull/21165)]
-* replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
-* secrets/transit: fix panic when providing non-PEM formatted public key for import [[GH-22753](https://github.com/hashicorp/vault/pull/22753)]
-* ui: fixes long namespace names overflow in the sidebar
+SECURITY:
 
-## 1.14.2
-### August 30, 2023
+* auth/azure: Update plugin to v0.20.2. Login requires `resource_group_name`, `vm_name`, and `vmss_name` to match token claims [[HCSEC-2025-07](https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716) [GH-30052](https://github.com/hashicorp/vault/pull/30052)].
 
 CHANGES:
 
-* auth/azure: Update plugin to v0.16.0 [[GH-22277](https://github.com/hashicorp/vault/pull/22277)]
-* core: Bump Go version to 1.20.7.
-* database/snowflake: Update plugin to v0.9.0 [[GH-22516](https://github.com/hashicorp/vault/pull/22516)]
+* UI: remove outdated and unneeded js string extensions [[GH-29834](https://github.com/hashicorp/vault/pull/29834)]
+* auth/azure: Update plugin to v0.20.3 [[GH-30082](https://github.com/hashicorp/vault/pull/30082)]
+* auth/gcp: Update plugin to v0.20.2 [[GH-30081](https://github.com/hashicorp/vault/pull/30081)]
+* core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [[GH-29774](https://github.com/hashicorp/vault/pull/29774)]
+* secrets/azure: Update plugin to v0.21.2 [[GH-30037](https://github.com/hashicorp/vault/pull/30037)]
+* secrets/azure: Update plugin to v0.21.3 [[GH-30083](https://github.com/hashicorp/vault/pull/30083)]
+* secrets/gcp: Update plugin to v0.21.2 [[GH-29970](https://github.com/hashicorp/vault/pull/29970)]
+* secrets/gcp: Update plugin to v0.21.3 [[GH-30080](https://github.com/hashicorp/vault/pull/30080)]
+* secrets/openldap: Update plugin to v0.15.2 [[GH-30079](https://github.com/hashicorp/vault/pull/30079)]
 
 IMPROVEMENTS:
 
-* auto-auth/azure: Added Azure Workload Identity Federation support to auto-auth (for Vault Agent and Vault Proxy). [[GH-22264](https://github.com/hashicorp/vault/pull/22264)]
-* core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [[GH-22235](https://github.com/hashicorp/vault/pull/22235)]
-* kmip (enterprise): Add namespace lock and unlock support [[GH-21925](https://github.com/hashicorp/vault/pull/21925)]
-* replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
-* secrets/database: Improves error logging for static role rotations by including the database and role names. [[GH-22253](https://github.com/hashicorp/vault/pull/22253)]
-* storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [[GH-22040](https://github.com/hashicorp/vault/pull/22040)]
-* ui: KV View Secret card will link to list view if input ends in "/" [[GH-22502](https://github.com/hashicorp/vault/pull/22502)]
-* ui: adds allowed_user_ids field to create role form and user_ids to generate certificates form in pki [[GH-22191](https://github.com/hashicorp/vault/pull/22191)]
-* ui: enables create and update KV secret workflow when control group present [[GH-22471](https://github.com/hashicorp/vault/pull/22471)]
-* website/docs: Fix link formatting in Vault lambda extension docs [[GH-22396](https://github.com/hashicorp/vault/pull/22396)]
-
-BUG FIXES:
-
-* activity (enterprise): Fix misattribution of entities to no or child namespace auth methods [[GH-18809](https://github.com/hashicorp/vault/pull/18809)]
-* agent: Environment variable VAULT_CACERT_BYTES now works for Vault Agent templates. [[GH-22322](https://github.com/hashicorp/vault/pull/22322)]
-* api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [[GH-22523](https://github.com/hashicorp/vault/pull/22523)]
-* core (enterprise): Remove MFA Configuration for namespace when deleting namespace
-* core/metrics: vault.raft_storage.bolt.write.time should be a counter not a summary [[GH-22468](https://github.com/hashicorp/vault/pull/22468)]
-* core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
-Also fix a related potential deadlock. [[GH-21110](https://github.com/hashicorp/vault/pull/21110)]
-* core:  Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [[GH-22137](https://github.com/hashicorp/vault/pull/22137)]
-* core: Fix bug where background thread to update locked user entries runs on DR secondaries. [[GH-22355](https://github.com/hashicorp/vault/pull/22355)]
-* core: Fix readonly errors that could occur while loading mounts/auths during unseal [[GH-22362](https://github.com/hashicorp/vault/pull/22362)]
-* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-21470](https://github.com/hashicorp/vault/pull/21470)]
-* expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [[GH-22374](https://github.com/hashicorp/vault/pull/22374)]
-* license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [[GH-22363](https://github.com/hashicorp/vault/pull/22363)]
-* replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
-* replication (enterprise): Fix panic when update-primary was called on demoted clusters using update_primary_addrs
-* replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
-* sdk/ldaputil: Properly escape user filters when using UPN domains
-sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [[GH-22249](https://github.com/hashicorp/vault/pull/22249)]
-* secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [[GH-22330](https://github.com/hashicorp/vault/pull/22330)]
-* secrets/transform (enterprise): Batch items with repeated tokens in the tokenization decode api will now contain the decoded_value element
-* secrets/transform (enterprise): Fix nil panic when encoding a tokenization transformation on a non-active node
-* secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
-* storage/raft: Fix race where new follower joining can get pruned by dead server cleanup. [[GH-20986](https://github.com/hashicorp/vault/pull/20986)]
-* ui: Fix blank page or ghost secret when canceling KV secret create [[GH-22541](https://github.com/hashicorp/vault/pull/22541)]
-* ui: fixes `max_versions` default for secret metadata unintentionally overriding kv engine defaults [[GH-22394](https://github.com/hashicorp/vault/pull/22394)]
-* ui: fixes model defaults overwriting input value when user tries to clear form input [[GH-22458](https://github.com/hashicorp/vault/pull/22458)]
-* ui: fixes text readability issue in revoke token confirmation dialog [[GH-22390](https://github.com/hashicorp/vault/pull/22390)]
-
-## 1.14.1
-### July 25, 2023
-
-SECURITY
-
-* auth/ldap: Normalize HTTP response codes when invalid credentials are provided to prevent user enumeration. This vulnerability, CVE-2023-3462, is fixed in Vault 1.14.1 and 1.13.5. [[GH-21282](https://github.com/hashicorp/vault/pull/21282), [HSEC-2023-24](https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714)]
-* core/namespace (enterprise): An unhandled error in Vault Enterprise’s namespace creation may cause the Vault process to crash, potentially resulting in denial of service. This vulnerability, CVE-2023-3774, is fixed in Vault Enterprise 1.14.1, 1.13.5, and 1.12.9. [[HSEC_2023-23](https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617)]
+* activity: mount_type was added to the API response of sys/internal/counters/activity [[GH-30071](https://github.com/hashicorp/vault/pull/30071)]
+* core (enterprise): report errors from the underlying seal when getting entropy.
+* storage/raft: Upgrade hashicorp/raft library to v1.7.3 which includes additional logging on the leader when opening and sending a snapshot to a follower. [[GH-29976](https://github.com/hashicorp/vault/pull/29976)]
 
-CHANGES:
+BUG FIXES:
 
-* core/namespace (enterprise): Introduce the concept of high-privilege namespace (administrative namespace),
-which will have access to some system backend paths that were previously only accessible in the root namespace. [[GH-21215](https://github.com/hashicorp/vault/pull/21215)]
-* secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
-* storage/aerospike: Aerospike storage shouldn't be used on 32-bit architectures and is now unsupported on them. [[GH-20825](https://github.com/hashicorp/vault/pull/20825)]
+* auth/aws: fix a panic when a performance standby node attempts to write/update config. [[GH-30039](https://github.com/hashicorp/vault/pull/30039)]
+* auth/ldap: Fix a bug that does not properly delete users and groups by first converting their names to lowercase when case senstivity option is off. [[GH-29922](https://github.com/hashicorp/vault/pull/29922)]
+* auth/ldap: fix a panic when a performance standby node attempts to write/update config. [[GH-30039](https://github.com/hashicorp/vault/pull/30039)]
+* aws/secrets: Prevent vault from rejecting secret role configurations where no regions or endpoints are set [[GH-29996](https://github.com/hashicorp/vault/pull/29996)]
+* core (enterprise): add nil check before attempting to use Rotation Manager operations.
+* core: Fix a bug that prevents certain loggers from writing to a log file. [[GH-29917](https://github.com/hashicorp/vault/pull/29917)]
+* core/raft: Fix decoding `auto_join` configurations that include escape characters. [[GH-29874](https://github.com/hashicorp/vault/pull/29874)]
+* identity: reintroduce RPC functionality for group creates, allowing performance standbys to handle external group changes during login and token renewal [[GH-30069](https://github.com/hashicorp/vault/pull/30069)]
+* plugins (enterprise): Fix plugin registration with artifact when a binary for the same plugin is already present in the plugin directory.
+* secrets/aws: fix a bug where environment and shared credential providers were overriding the WIF configuration [[GH-29982](https://github.com/hashicorp/vault/pull/29982)]
+* secrets/aws: fix a panic when a performance standby node attempts to write/update config. [[GH-30039](https://github.com/hashicorp/vault/pull/30039)]
+* secrets/db: fix a panic when a performance standby node attempts to write/update config. [[GH-30039](https://github.com/hashicorp/vault/pull/30039)]
+* secrets/pki: Fix a bug that prevents enabling automatic tidying of the CMPv2 nonce store. [[GH-29852](https://github.com/hashicorp/vault/pull/29852)]
 
-IMPROVEMENTS:
+## 1.19.0
+### March 5, 2025
 
-* core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
-* eventbus: updated go-eventlogger library to allow removal of nodes referenced by pipelines (used for subscriptions) [[GH-21623](https://github.com/hashicorp/vault/pull/21623)]
-* openapi: Better mount points for kv-v1 and kv-v2 in openapi.json [[GH-21563](https://github.com/hashicorp/vault/pull/21563)]
-* replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
-* secrets/pki: Add a parameter to allow ExtKeyUsage field usage from a role within ACME. [[GH-21702](https://github.com/hashicorp/vault/pull/21702)]
-* secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
-* sys/metrics (enterprise): Adds a gauge metric that tracks whether enterprise builtin secret plugins are enabled. [[GH-21681](https://github.com/hashicorp/vault/pull/21681)]
-
-BUG FIXES:
-
-* agent: Fix "generate-config" command documentation URL [[GH-21466](https://github.com/hashicorp/vault/pull/21466)]
-* auth/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21800](https://github.com/hashicorp/vault/pull/21800)]
-* auth/token, sys: Fix path-help being unavailable for some list-only endpoints [[GH-18571](https://github.com/hashicorp/vault/pull/18571)]
-* auth/token: Fix parsing of `auth/token/create` fields to avoid incorrect warnings about ignored parameters [[GH-18556](https://github.com/hashicorp/vault/pull/18556)]
-* awsutil: Update awsutil to v0.2.3 to fix a regression where Vault no longer
-respects `AWS_ROLE_ARN`, `AWS_WEB_IDENTITY_TOKEN_FILE`, and `AWS_ROLE_SESSION_NAME`. [[GH-21951](https://github.com/hashicorp/vault/pull/21951)]
-* core/managed-keys (enterprise): Allow certain symmetric PKCS#11 managed key mechanisms (AES CBC with and without padding) to operate without an HMAC.
-* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-24170](https://github.com/hashicorp/vault/pull/24170)]
-* core: Fixed issue with some durations not being properly parsed to include days. [[GH-21357](https://github.com/hashicorp/vault/pull/21357)]
-* identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [[GH-20965](https://github.com/hashicorp/vault/pull/20965)]
-* openapi: Fix response schema for PKI Issue requests [[GH-21449](https://github.com/hashicorp/vault/pull/21449)]
-* openapi: Fix schema definitions for PKI EAB APIs [[GH-21458](https://github.com/hashicorp/vault/pull/21458)]
-* replication (enterprise): update primary cluster address after DR failover
-* secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21631](https://github.com/hashicorp/vault/pull/21631)]
-* secrets/pki: Fix bug with ACME tidy, 'unable to determine acme base folder path'. [[GH-21870](https://github.com/hashicorp/vault/pull/21870)]
-* secrets/pki: Fix preserving acme_account_safety_buffer on config/auto-tidy. [[GH-21870](https://github.com/hashicorp/vault/pull/21870)]
-* secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error: `no managed key found with uuid`. [[GH-21316](https://github.com/hashicorp/vault/pull/21316)]
-* secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
-* secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
-* serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [[GH-21642](https://github.com/hashicorp/vault/pull/21642)]
-* ui: Adds missing values to details view after generating PKI certificate [[GH-21635](https://github.com/hashicorp/vault/pull/21635)]
-* ui: Fixed an issue where editing an SSH role would clear `default_critical_options` and `default_extension` if left unchanged. [[GH-21739](https://github.com/hashicorp/vault/pull/21739)]
-* ui: Fixed secrets, leases, and policies filter dropping focus after a single character [[GH-21767](https://github.com/hashicorp/vault/pull/21767)]
-* ui: Fixes issue with certain navigational links incorrectly displaying in child namespaces [[GH-21562](https://github.com/hashicorp/vault/pull/21562)]
-* ui: Fixes login screen display issue with Safari browser [[GH-21582](https://github.com/hashicorp/vault/pull/21582)]
-* ui: Fixes problem displaying certificates issued with unsupported signature algorithms (i.e. ed25519) [[GH-21926](https://github.com/hashicorp/vault/pull/21926)]
-* ui: Fixes styling of private key input when configuring an SSH key [[GH-21531](https://github.com/hashicorp/vault/pull/21531)]
-* ui: Surface DOMException error when browser settings prevent localStorage. [[GH-21503](https://github.com/hashicorp/vault/pull/21503)]
-
-## 1.14.0
-### June 21, 2023
+**Enterprise LTS:** Vault Enterprise 1.19 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 SECURITY:
 
-* ui: key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. [[HSEC-2023-17](https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814)]
-
-BREAKING CHANGES:
-
-* secrets/pki: Maintaining running count of certificates will be turned off by default.
-To re-enable keeping these metrics available on the tidy status endpoint, enable
-maintain_stored_certificate_counts on tidy-config, to also publish them to the
-metrics consumer, enable publish_stored_certificate_count_metrics . [[GH-18186](https://github.com/hashicorp/vault/pull/18186)]
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241115202008-166203013d8e
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.2.0
 
 CHANGES:
 
-* auth/alicloud: Updated plugin from v0.14.0 to v0.15.0 [[GH-20758](https://github.com/hashicorp/vault/pull/20758)]
-* auth/azure: Updated plugin from v0.13.0 to v0.15.0 [[GH-20816](https://github.com/hashicorp/vault/pull/20816)]
-* auth/centrify: Updated plugin from v0.14.0 to v0.15.1 [[GH-20745](https://github.com/hashicorp/vault/pull/20745)]
-* auth/gcp: Updated plugin from v0.15.0 to v0.16.0 [[GH-20725](https://github.com/hashicorp/vault/pull/20725)]
-* auth/jwt: Updated plugin from v0.15.0 to v0.16.0 [[GH-20799](https://github.com/hashicorp/vault/pull/20799)]
-* auth/kubernetes: Update plugin to v0.16.0 [[GH-20802](https://github.com/hashicorp/vault/pull/20802)]
-* core: Bump Go version to 1.20.5.
-* core: Remove feature toggle for SSCTs, i.e. the env var VAULT_DISABLE_SERVER_SIDE_CONSISTENT_TOKENS. [[GH-20834](https://github.com/hashicorp/vault/pull/20834)]
-* core: Revert #19676 (VAULT_GRPC_MIN_CONNECT_TIMEOUT env var) as we decided it was unnecessary. [[GH-20826](https://github.com/hashicorp/vault/pull/20826)]
-* database/couchbase: Updated plugin from v0.9.0 to v0.9.2 [[GH-20764](https://github.com/hashicorp/vault/pull/20764)]
-* database/redis-elasticache: Updated plugin from v0.2.0 to v0.2.1 [[GH-20751](https://github.com/hashicorp/vault/pull/20751)]
-* replication (enterprise): Add a new parameter for the update-primary API call
-that allows for setting of the primary cluster addresses directly, instead of
-via a token.
-* secrets/ad: Updated plugin from v0.10.1-0.20230329210417-0b2cdb26cf5d to v0.16.0 [[GH-20750](https://github.com/hashicorp/vault/pull/20750)]
-* secrets/alicloud: Updated plugin from v0.5.4-beta1.0.20230330124709-3fcfc5914a22 to v0.15.0 [[GH-20787](https://github.com/hashicorp/vault/pull/20787)]
-* secrets/aure: Updated plugin from v0.15.0 to v0.16.0 [[GH-20777](https://github.com/hashicorp/vault/pull/20777)]
-* secrets/database/mongodbatlas: Updated plugin from v0.9.0 to v0.10.0 [[GH-20882](https://github.com/hashicorp/vault/pull/20882)]
-* secrets/database/snowflake: Updated plugin from v0.7.0 to v0.8.0 [[GH-20807](https://github.com/hashicorp/vault/pull/20807)]
-* secrets/gcp: Updated plugin from v0.15.0 to v0.16.0 [[GH-20818](https://github.com/hashicorp/vault/pull/20818)]
-* secrets/keymgmt: Updated plugin to v0.9.1
-* secrets/kubernetes: Update plugin to v0.5.0 [[GH-20802](https://github.com/hashicorp/vault/pull/20802)]
-* secrets/mongodbatlas: Updated plugin from v0.9.1 to v0.10.0 [[GH-20742](https://github.com/hashicorp/vault/pull/20742)]
-* secrets/pki: Allow issuance of root CAs without AIA, when templated AIA information includes issuer_id. [[GH-21209](https://github.com/hashicorp/vault/pull/21209)]
-* secrets/pki: Warning when issuing leafs from CSRs with basic constraints. In the future, issuance of non-CA leaf certs from CSRs with asserted IsCA Basic Constraints will be prohibited. [[GH-20654](https://github.com/hashicorp/vault/pull/20654)]
+* agent/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [[GH-29517](https://github.com/hashicorp/vault/pull/29517)]
+* api: Add to sys/health whether the node has been removed from the HA cluster. If the node has been removed, return code 530 by default or the value of the `removedcode` query parameter. [[GH-28991](https://github.com/hashicorp/vault/pull/28991)]
+* api: Add to sys/health whether the standby node has been able to successfully send heartbeats to the active node and the time in milliseconds since the last heartbeat. If the standby has been unable to send a heartbeat, return code 474 by default or the value of the `haunhealthycode` query parameter. [[GH-28991](https://github.com/hashicorp/vault/pull/28991)]
+* auth/alicloud: Update plugin to v0.20.0 [[GH-29613](https://github.com/hashicorp/vault/pull/29613)]
+* auth/azure: Update plugin to v0.19.1 [[GH-28712](https://github.com/hashicorp/vault/pull/28712)]
+* auth/azure: Update plugin to v0.19.2 [[GH-28848](https://github.com/hashicorp/vault/pull/28848)]
+* auth/azure: Update plugin to v0.20.0 [[GH-29606](https://github.com/hashicorp/vault/pull/29606)]
+* auth/azure: Update plugin to v0.20.1 [[GH-29728](https://github.com/hashicorp/vault/pull/29728)]
+* auth/cf: Update plugin to v0.19.1 [[GH-29295](https://github.com/hashicorp/vault/pull/29295)]
+* auth/cf: Update plugin to v0.20.0 [[GH-29528](https://github.com/hashicorp/vault/pull/29528)]
+* auth/gcp: Update plugin to v0.20.0 [[GH-29591](https://github.com/hashicorp/vault/pull/29591)]
+* auth/gcp: Update plugin to v0.20.1 [[GH-29736](https://github.com/hashicorp/vault/pull/29736)]
+* auth/jwt: Update plugin to v0.23.0 [[GH-29553](https://github.com/hashicorp/vault/pull/29553)]
+* auth/kerberos: Update plugin to v0.14.0 [[GH-29617](https://github.com/hashicorp/vault/pull/29617)]
+* auth/kubernetes: Update plugin to v0.21.0 [[GH-29619](https://github.com/hashicorp/vault/pull/29619)]
+* auth/ldap: An error will now be returned on login if the number of entries returned from the user DN LDAP search is more than one. [[GH-29302](https://github.com/hashicorp/vault/pull/29302)]
+* auth/ldap: No longer return authentication warnings to client. [[GH-29134](https://github.com/hashicorp/vault/pull/29134)]
+* auth/oci: Update plugin to v0.18.0 [[GH-29620](https://github.com/hashicorp/vault/pull/29620)]
+* core (enterprise): Add tracking of performance standbys by their HA node ID so that RPC connections can be more easily cleaned up when nodes are removed. [[GH-29303](https://github.com/hashicorp/vault/pull/29303)]
+* core/ha (enterprise): Failed attempts to become a performance standby node are now using an exponential backoff instead of a
+10 second delay in between retries. The backoff starts at 2s and increases by a factor of two until reaching
+the maximum of 16s. This should make unsealing of the node faster in some cases.
+* core/raft: Return an error on sys/storage/raft/join if a node that has been removed from raft cluster attempts to re-join when it still has existing raft data on disk. [[GH-29090](https://github.com/hashicorp/vault/pull/29090)]
+* core: Bump Go version to 1.23.6.
+* database/couchbase: Update plugin to v0.13.0 [[GH-29543](https://github.com/hashicorp/vault/pull/29543)]
+* database/elasticsearch: Update plugin to v0.17.0 [[GH-29542](https://github.com/hashicorp/vault/pull/29542)]
+* database/mongodbatlas: Update plugin to v0.14.0 [[GH-29584](https://github.com/hashicorp/vault/pull/29584)]
+* database/redis-elasticache: Update plugin to v0.6.0 [[GH-29594](https://github.com/hashicorp/vault/pull/29594)]
+* database/redis: Update plugin to v0.5.0 [[GH-29597](https://github.com/hashicorp/vault/pull/29597)]
+* database/snowflake: Update plugin to v0.13.0 [[GH-29554](https://github.com/hashicorp/vault/pull/29554)]
+* kmip (enterprise): RSA key generation now enforces key sizes of 2048 or higher
+* login (enterprise): Return a 500 error during logins when performance standby nodes make failed gRPC requests to the active node. [[GH-28807](https://github.com/hashicorp/vault/pull/28807)]
+* proxy/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [[GH-29517](https://github.com/hashicorp/vault/pull/29517)]
+* raft/autopilot (enterprise): Alongside the CE autopilot update, update raft-autopilot-enterprise library to v0.3.0 and add enterprise-specific regression testing.
+* sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.1, which also bumps github.com/docker/docker to v27.2.1+incompatible [[GH-28456](https://github.com/hashicorp/vault/pull/28456)]
+* secrets/ad: Update plugin to v0.20.1 [[GH-29648](https://github.com/hashicorp/vault/pull/29648)]
+* secrets/alicloud: Update plugin to v0.19.0 [[GH-29512](https://github.com/hashicorp/vault/pull/29512)]
+* secrets/aws: The AWS Secrets engine now persists entries to storage between writes. This enables users
+to not have to pass every required field on each write and to make individual updates as necessary.
+Note: in order to zero out a value that is previously configured, users must now explicitly set the
+field to its zero value on an update. [[GH-29497](https://github.com/hashicorp/vault/pull/29497)]
+* secrets/azure: Update plugin to v0.20.1 [[GH-28699](https://github.com/hashicorp/vault/pull/28699)]
+* secrets/azure: Update plugin to v0.21.0 [[GH-29639](https://github.com/hashicorp/vault/pull/29639)]
+* secrets/azure: Update plugin to v0.21.1 [[GH-29729](https://github.com/hashicorp/vault/pull/29729)]
+* secrets/gcp: Update plugin to v0.21.0 [[GH-29598](https://github.com/hashicorp/vault/pull/29598)]
+* secrets/gcp: Update plugin to v0.21.1 [[GH-29747](https://github.com/hashicorp/vault/pull/29747)]
+* secrets/gcpkms: Update plugin to v0.20.0 [[GH-29612](https://github.com/hashicorp/vault/pull/29612)]
+* secrets/kubernetes: Update plugin to v0.10.0 [[GH-29592](https://github.com/hashicorp/vault/pull/29592)]
+* secrets/kv: Update plugin to v0.21.0 [[GH-29614](https://github.com/hashicorp/vault/pull/29614)]
+* secrets/mongodbatlas: Update plugin to v0.14.0 [[GH-29583](https://github.com/hashicorp/vault/pull/29583)]
+* secrets/openldap: Update plugin to v0.14.1 [[GH-28479](https://github.com/hashicorp/vault/pull/28479)]
+* secrets/openldap: Update plugin to v0.14.2 [[GH-28704](https://github.com/hashicorp/vault/pull/28704)]
+* secrets/openldap: Update plugin to v0.14.3 [[GH-28780](https://github.com/hashicorp/vault/pull/28780)]
+* secrets/openldap: Update plugin to v0.14.5 [[GH-29551](https://github.com/hashicorp/vault/pull/29551)]
+* secrets/openldap: Update plugin to v0.15.0 [[GH-29605](https://github.com/hashicorp/vault/pull/29605)]
+* secrets/openldap: Update plugin to v0.15.1 [[GH-29727](https://github.com/hashicorp/vault/pull/29727)]
+* secrets/pki: Enforce the issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates. For more information see [PKI considerations](https://developer.hashicorp.com/vault/docs/secrets/pki/considerations#issuer-constraints-enforcement) [[GH-29045](https://github.com/hashicorp/vault/pull/29045)]
+* secrets/terraform: Update plugin to v0.11.0 [[GH-29541](https://github.com/hashicorp/vault/pull/29541)]
+* server/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4. [[GH-29228](https://github.com/hashicorp/vault/pull/29228)]
+* storage/raft: Do not allow nodes that have been removed from the raft cluster configuration to respond to requests. Shutdown and seal raft nodes when they are removed. [[GH-28875](https://github.com/hashicorp/vault/pull/28875)]
+* ui: Partially reverts #20431 and removes ability to download unencrypted kv v2 secret data [[GH-29290](https://github.com/hashicorp/vault/pull/29290)]
+* ui: Upgrade Ember data to v5.3.2 (and minor upgrade of ember-cli, ember-source to v5.8.0) [[GH-28798](https://github.com/hashicorp/vault/pull/28798)]
 
 FEATURES:
 
-* **AWS Static Roles**: The AWS Secrets Engine can manage static roles configured by users. [[GH-20536](https://github.com/hashicorp/vault/pull/20536)]
-* **Automated License Utilization Reporting**: Added automated license
-utilization reporting, which sends minimal product-license [metering
-data](https://developer.hashicorp.com/vault/docs/enterprise/license/utilization-reporting)
-to HashiCorp without requiring you to manually collect and report them.
-* **Environment Variables through Vault Agent**: Introducing a new process-supervisor mode for Vault Agent which allows injecting secrets as environment variables into a child process using a new `env_template` configuration stanza. The process-supervisor configuration can be generated with a new `vault agent generate-config` helper tool. [[GH-20530](https://github.com/hashicorp/vault/pull/20530)]
-* **MongoDB Atlas Database Secrets**: Adds support for client certificate credentials [[GH-20425](https://github.com/hashicorp/vault/pull/20425)]
-* **MongoDB Atlas Database Secrets**: Adds support for generating X.509 certificates on dynamic roles for user authentication [[GH-20882](https://github.com/hashicorp/vault/pull/20882)]
-* **NEW PKI Workflow in UI**: Completes generally available rollout of new PKI UI that provides smoother mount configuration and a more guided user experience [[GH-pki-ui-improvements](https://github.com/hashicorp/vault/pull/pki-ui-improvements)]
-* **Secrets/Auth Plugin Multiplexing**: The plugin will be multiplexed when run
-as an external plugin by vault versions that support secrets/auth plugin
-multiplexing (> 1.12) [[GH-19215](https://github.com/hashicorp/vault/pull/19215)]
-* **Sidebar Navigation in UI**: A new sidebar navigation panel has been added in the UI to replace the top navigation bar. [[GH-19296](https://github.com/hashicorp/vault/pull/19296)]
-* **Vault PKI ACME Server**: Support for the ACME certificate lifecycle management protocol has been added to the Vault PKI Plugin. This allows standard ACME clients, such as the EFF's certbot and the CNCF's k8s cert-manager, to request certificates from a Vault server with no knowledge of Vault APIs or authentication mechanisms. For public-facing Vault instances, we recommend requiring External Account Bindings (EAB) to limit the ability to request certificates to only authenticated clients. [[GH-20752](https://github.com/hashicorp/vault/pull/20752)]
-* **Vault Proxy**: Introduced Vault Proxy, a new subcommand of the Vault binary that can be invoked using `vault proxy -config=config.hcl`. It currently has the same feature set as Vault Agent's API proxy, but the two may diverge in the future. We plan to deprecate the API proxy functionality of Vault Agent in a future release. [[GH-20548](https://github.com/hashicorp/vault/pull/20548)]
-* **OCI Auto-Auth**: Add OCI (Oracle Cloud Infrastructure) auto-auth method [[GH-19260](https://github.com/hashicorp/vault/pull/19260)]
+* **AWS Secrets Cross-Account Management Support** (enterprise): Add support for cross-account management of static roles in AWS secrets engine.
+* **Automated Root Rotation**: A schedule or ttl can be defined for automated rotation of the root credential. [[GH-29535](https://github.com/hashicorp/vault/pull/29535)]
+* **Automated Root Rotation**: Adds Automated Root Rotation capabilities to the AWS Auth and AWS Secrets
+plugins. This allows plugin users to automate their root credential rotations based on configurable
+schedules/periods via the Rotation Manager. Note: Enterprise only. [[GH-29497](https://github.com/hashicorp/vault/pull/29497)]
+* **Automated Root Rotation**: Adds Automated Root Rotation capabilities to the DB Secrets plugin.
+This allows plugin users to automate their root credential rotations based on configurable
+schedules/periods via the Rotation Manager. Note: Enterprise only. [[GH-29557](https://github.com/hashicorp/vault/pull/29557)]
+* **Automated Root Rotation**: Adds Automated Root Rotation capabilities to the GCP Auth plugin.
+This allows plugin users to automate their root credential rotations based on configurable
+schedules/periods via the Rotation Manager. Note: Enterprise only. [[GH-29591](https://github.com/hashicorp/vault/pull/29591)]
+* **Automated Root Rotation**: Adds Automated Root Rotation capabilities to the GCP Secrets plugin.
+This allows plugin users to automate their root credential rotations based on configurable
+schedules/periods via the Rotation Manager. Note: Enterprise only. [[GH-29598](https://github.com/hashicorp/vault/pull/29598)]
+* **Identity De-duplication**: Vault can now automatically resolve duplicate
+Entities and Groups by renaming them. This feature is disabled by default and
+can be enabled through the `force_identity_deduplication` activation flag. [[GH-29356](https://github.com/hashicorp/vault/pull/29356)]
+* **Plugins**: Allow Enterprise plugins to run externally on Vault Enterprise only.
+* **Post-Quantum Cryptography Support**: Experimental support for PQC signatures with ML-DSA in Transit.
+* **Product Usage Reporting**: Added product usage reporting, which collects anonymous, numerical, non-sensitive data about Vault feature usage, and adds it to the existing utilization reports. [[GH-28858](https://github.com/hashicorp/vault/pull/28858)]
+* **Rotation Manager**: Add Rotation Manager to Vault Enterprise Core. The Rotation Manager enables
+plugin users to automate their root credential rotations based on configurable schedules/periods.
+* **Skip auto import rotation of static roles (enterprise)**: The Database secrets engine now allows skipping the automatic rotation of static roles during import.
+* **Transit Ed25519ph and Ed25519ctx support (Enterprise)**: Support for signing and verifying Ed25519ph and Ed25519ctx signatures types.
 
 IMPROVEMENTS:
 
-* * api: Add Config.TLSConfig method to fetch the TLS configuration from a client config. [[GH-20265](https://github.com/hashicorp/vault/pull/20265)]
-* * physical/etcd: Upgrade etcd3 client to v3.5.7 [[GH-20261](https://github.com/hashicorp/vault/pull/20261)]
-* activitylog: EntityRecord protobufs now contain a ClientType field for
-distinguishing client sources. [[GH-20626](https://github.com/hashicorp/vault/pull/20626)]
-* agent: Add integration tests for agent running in process supervisor mode [[GH-20741](https://github.com/hashicorp/vault/pull/20741)]
-* agent: Add logic to validate env_template entries in configuration [[GH-20569](https://github.com/hashicorp/vault/pull/20569)]
-* agent: Added `reload` option to cert auth configuration in case of external renewals of local x509 key-pairs. [[GH-19002](https://github.com/hashicorp/vault/pull/19002)]
-* agent: JWT auto-auth has a new config option, `remove_jwt_follows_symlinks` (default: false), that, if set to true will now remove the JWT, instead of the symlink to the JWT, if a symlink to a JWT has been provided in the `path` option, and the `remove_jwt_after_reading` config option is set to true (default). [[GH-18863](https://github.com/hashicorp/vault/pull/18863)]
-* agent: Vault Agent now reports its name and version as part of the User-Agent header in all requests issued. [[GH-19776](https://github.com/hashicorp/vault/pull/19776)]
-* agent: initial implementation of a process runner for injecting secrets via environment variables via vault agent [[GH-20628](https://github.com/hashicorp/vault/pull/20628)]
-* api: GET ... /sys/internal/counters/activity?current_billing_period=true now
-results in a response which contains the full billing period [[GH-20694](https://github.com/hashicorp/vault/pull/20694)]
-* api: `/sys/internal/counters/config` endpoint now contains read-only
-`minimum_retention_months`. [[GH-20150](https://github.com/hashicorp/vault/pull/20150)]
-* api: `/sys/internal/counters/config` endpoint now contains read-only
-`reporting_enabled` and `billing_start_timestamp` fields. [[GH-20086](https://github.com/hashicorp/vault/pull/20086)]
-* api: property based testing for LifetimeWatcher sleep duration calculation [[GH-17919](https://github.com/hashicorp/vault/pull/17919)]
-* audit: add plugin metadata, including plugin name, type, version, sha256, and whether plugin is external, to audit logging [[GH-19814](https://github.com/hashicorp/vault/pull/19814)]
-* audit: forwarded requests can now contain host metadata on the node it was sent 'from' or a flag to indicate that it was forwarded.
-* auth/cert: Better return OCSP validation errors during login to the caller. [[GH-20234](https://github.com/hashicorp/vault/pull/20234)]
-* auth/kerberos: Enable plugin multiplexing
-auth/kerberos: Upgrade plugin dependencies [[GH-20771](https://github.com/hashicorp/vault/pull/20771)]
-* auth/ldap: allow configuration of alias dereferencing in LDAP search [[GH-18230](https://github.com/hashicorp/vault/pull/18230)]
-* auth/ldap: allow providing the LDAP password via an env var when authenticating via the CLI [[GH-18225](https://github.com/hashicorp/vault/pull/18225)]
-* auth/oidc: Adds support for group membership parsing when using IBM ISAM as an OIDC provider. [[GH-19247](https://github.com/hashicorp/vault/pull/19247)]
-* build: Prefer GOBIN when set over GOPATH/bin when building the binary [[GH-19862](https://github.com/hashicorp/vault/pull/19862)]
-* cli: Add walkSecretsTree helper function, which recursively walks secrets rooted at the given path [[GH-20464](https://github.com/hashicorp/vault/pull/20464)]
-* cli: Improve addPrefixToKVPath helper [[GH-20488](https://github.com/hashicorp/vault/pull/20488)]
-* command/server (enterprise): -dev-three-node now creates perf standbys instead of regular standbys. [[GH-20629](https://github.com/hashicorp/vault/pull/20629)]
-* command/server: Add support for dumping pprof files to the filesystem via SIGUSR2 when
-`VAULT_PPROF_WRITE_TO_FILE=true` is set on the server. [[GH-20609](https://github.com/hashicorp/vault/pull/20609)]
-* command/server: New -dev-cluster-json writes a file describing the dev cluster in -dev and -dev-three-node modes, plus -dev-three-node now enables unauthenticated metrics and pprof requests. [[GH-20224](https://github.com/hashicorp/vault/pull/20224)]
-* core (enterprise): add configuration for license reporting [[GH-19891](https://github.com/hashicorp/vault/pull/19891)]
-* core (enterprise): license updates trigger a reload of reporting and the activity log [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
-* core (enterprise): support reloading configuration for automated reporting via SIGHUP [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
-* core (enterprise): vault server command now allows for opt-out of automated
-reporting via the `OPTOUT_LICENSE_REPORTING` environment variable. [[GH-3939](https://github.com/hashicorp/vault/pull/3939)]
-* core, secrets/pki, audit: Update dependency go-jose to v3 due to v2 deprecation. [[GH-20559](https://github.com/hashicorp/vault/pull/20559)]
-* core/activity: error when attempting to update retention configuration below the minimum [[GH-20078](https://github.com/hashicorp/vault/pull/20078)]
-* core/activity: refactor the activity log's generation of precomputed queries [[GH-20073](https://github.com/hashicorp/vault/pull/20073)]
-* core: Add possibility to decode a generated encoded root token via the rest API [[GH-20595](https://github.com/hashicorp/vault/pull/20595)]
-* core: include namespace path in granting_policies block of audit log
-* core: include reason for ErrReadOnly on PBPWF writing failures
-* core: report intermediate error messages during request forwarding [[GH-20643](https://github.com/hashicorp/vault/pull/20643)]
-* core:provide more descriptive error message when calling enterprise feature paths in open-source [[GH-18870](https://github.com/hashicorp/vault/pull/18870)]
-* database/elasticsearch: Upgrade plugin dependencies [[GH-20767](https://github.com/hashicorp/vault/pull/20767)]
-* database/mongodb: upgrade mongo driver to 1.11 [[GH-19954](https://github.com/hashicorp/vault/pull/19954)]
-* database/redis: Upgrade plugin dependencies [[GH-20763](https://github.com/hashicorp/vault/pull/20763)]
-* http: Support responding to HEAD operation from plugins [[GH-19520](https://github.com/hashicorp/vault/pull/19520)]
-* openapi: Add openapi response definitions to /sys defined endpoints. [[GH-18633](https://github.com/hashicorp/vault/pull/18633)]
-* openapi: Add openapi response definitions to pki/config_*.go [[GH-18376](https://github.com/hashicorp/vault/pull/18376)]
-* openapi: Add openapi response definitions to vault/logical_system_paths.go defined endpoints. [[GH-18515](https://github.com/hashicorp/vault/pull/18515)]
-* openapi: Consistently stop Vault server on exit in gen_openapi.sh [[GH-19252](https://github.com/hashicorp/vault/pull/19252)]
-* openapi: Improve operationId/request/response naming strategy [[GH-19319](https://github.com/hashicorp/vault/pull/19319)]
-* openapi: add openapi response definitions to /sys/internal endpoints [[GH-18542](https://github.com/hashicorp/vault/pull/18542)]
-* openapi: add openapi response definitions to /sys/rotate endpoints [[GH-18624](https://github.com/hashicorp/vault/pull/18624)]
-* openapi: add openapi response definitions to /sys/seal endpoints [[GH-18625](https://github.com/hashicorp/vault/pull/18625)]
-* openapi: add openapi response definitions to /sys/tool endpoints [[GH-18626](https://github.com/hashicorp/vault/pull/18626)]
-* openapi: add openapi response definitions to /sys/version-history, /sys/leader, /sys/ha-status, /sys/host-info, /sys/in-flight-req [[GH-18628](https://github.com/hashicorp/vault/pull/18628)]
-* openapi: add openapi response definitions to /sys/wrapping endpoints [[GH-18627](https://github.com/hashicorp/vault/pull/18627)]
-* openapi: add openapi response defintions to /sys/auth endpoints [[GH-18465](https://github.com/hashicorp/vault/pull/18465)]
-* openapi: add openapi response defintions to /sys/capabilities endpoints [[GH-18468](https://github.com/hashicorp/vault/pull/18468)]
-* openapi: add openapi response defintions to /sys/config and /sys/generate-root endpoints [[GH-18472](https://github.com/hashicorp/vault/pull/18472)]
-* openapi: added ability to validate response structures against openapi schema for test clusters [[GH-19043](https://github.com/hashicorp/vault/pull/19043)]
-* sdk/framework: Fix non-deterministic ordering of 'required' fields in OpenAPI spec [[GH-20881](https://github.com/hashicorp/vault/pull/20881)]
-* sdk: Add new docker-based cluster testing framework to the sdk. [[GH-20247](https://github.com/hashicorp/vault/pull/20247)]
-* secrets/ad: upgrades dependencies [[GH-19829](https://github.com/hashicorp/vault/pull/19829)]
-* secrets/alicloud: upgrades dependencies [[GH-19846](https://github.com/hashicorp/vault/pull/19846)]
-* secrets/consul: Improve error message when ACL bootstrapping fails. [[GH-20891](https://github.com/hashicorp/vault/pull/20891)]
-* secrets/database: Adds error message requiring password on root crednetial rotation. [[GH-19103](https://github.com/hashicorp/vault/pull/19103)]
-* secrets/gcpkms: Enable plugin multiplexing
-secrets/gcpkms: Upgrade plugin dependencies [[GH-20784](https://github.com/hashicorp/vault/pull/20784)]
-* secrets/mongodbatlas: upgrades dependencies [[GH-19861](https://github.com/hashicorp/vault/pull/19861)]
-* secrets/openldap: upgrades dependencies [[GH-19993](https://github.com/hashicorp/vault/pull/19993)]
-* secrets/pki: Add missing fields to tidy-status, include new last_auto_tidy_finished field. [[GH-20442](https://github.com/hashicorp/vault/pull/20442)]
-* secrets/pki: Add warning when issuer lacks KeyUsage during CRL rebuilds; expose in logs and on rotation. [[GH-20253](https://github.com/hashicorp/vault/pull/20253)]
-* secrets/pki: Allow determining existing issuers and keys on import. [[GH-20441](https://github.com/hashicorp/vault/pull/20441)]
-* secrets/pki: Include CA serial number, key UUID on issuers list endpoint. [[GH-20276](https://github.com/hashicorp/vault/pull/20276)]
-* secrets/pki: Limit ACME issued certificates NotAfter TTL to a maximum of 90 days [[GH-20981](https://github.com/hashicorp/vault/pull/20981)]
-* secrets/pki: Support TLS-ALPN-01 challenge type in ACME for DNS certificate identifiers. [[GH-20943](https://github.com/hashicorp/vault/pull/20943)]
-* secrets/pki: add subject key identifier to read key response [[GH-20642](https://github.com/hashicorp/vault/pull/20642)]
-* secrets/postgresql: Add configuration to scram-sha-256 encrypt passwords on Vault before sending them to PostgreSQL [[GH-19616](https://github.com/hashicorp/vault/pull/19616)]
-* secrets/terraform: upgrades dependencies [[GH-19798](https://github.com/hashicorp/vault/pull/19798)]
-* secrets/transit: Add support to import public keys in transit engine and allow encryption and verification of signed data [[GH-17934](https://github.com/hashicorp/vault/pull/17934)]
-* secrets/transit: Allow importing RSA-PSS OID (1.2.840.113549.1.1.10) private keys via BYOK. [[GH-19519](https://github.com/hashicorp/vault/pull/19519)]
-* secrets/transit: Respond to writes with updated key policy, cache configuration. [[GH-20652](https://github.com/hashicorp/vault/pull/20652)]
-* secrets/transit: Support BYOK-encrypted export of keys to securely allow synchronizing specific keys and version across clusters. [[GH-20736](https://github.com/hashicorp/vault/pull/20736)]
-* ui: Add download button for each secret value in KV v2 [[GH-20431](https://github.com/hashicorp/vault/pull/20431)]
-* ui: Add filtering by auth type and auth name to the Authentication Method list view. [[GH-20747](https://github.com/hashicorp/vault/pull/20747)]
-* ui: Add filtering by engine type and engine name to the Secret Engine list view. [[GH-20481](https://github.com/hashicorp/vault/pull/20481)]
-* ui: Adds whitespace warning to secrets engine and auth method path inputs [[GH-19913](https://github.com/hashicorp/vault/pull/19913)]
-* ui: Remove the Bulma CSS framework. [[GH-19878](https://github.com/hashicorp/vault/pull/19878)]
-* ui: Update Web CLI with examples and a new `kv-get` command for reading kv v2 data and metadata [[GH-20590](https://github.com/hashicorp/vault/pull/20590)]
-* ui: Updates UI javascript dependencies [[GH-19901](https://github.com/hashicorp/vault/pull/19901)]
-* ui: add allowed_managed_keys field to secret engine mount options [[GH-19791](https://github.com/hashicorp/vault/pull/19791)]
-* ui: adds warning for commas in stringArray inputs and updates tooltip help text to remove references to comma separation [[GH-20163](https://github.com/hashicorp/vault/pull/20163)]
-* ui: updates clients configuration edit form state based on census reporting configuration [[GH-20125](https://github.com/hashicorp/vault/pull/20125)]
-* website/docs: Add rotate root documentation for azure secrets engine [[GH-19187](https://github.com/hashicorp/vault/pull/19187)]
-* website/docs: fix database static-user sample payload [[GH-19170](https://github.com/hashicorp/vault/pull/19170)]
-
-BUG FIXES:
-
-* agent: Fix agent generate-config to accept -namespace, VAULT_NAMESPACE, and other client-modifying flags. [[GH-21297](https://github.com/hashicorp/vault/pull/21297)]
-* agent: Fix bug with 'cache' stanza validation [[GH-20934](https://github.com/hashicorp/vault/pull/20934)]
-* api: Addressed a couple of issues that arose as edge cases for the -output-policy flag. Specifically around properly handling list commands, distinguishing kv V1/V2, and correctly recognizing protected paths. [[GH-19160](https://github.com/hashicorp/vault/pull/19160)]
-* api: Properly Handle nil identity_policies in Secret Data [[GH-20636](https://github.com/hashicorp/vault/pull/20636)]
-* auth/ldap: Set default value for `max_page_size` properly [[GH-20453](https://github.com/hashicorp/vault/pull/20453)]
-* auth/token: Fix cubbyhole and revocation for legacy service tokens [[GH-19416](https://github.com/hashicorp/vault/pull/19416)]
-* cli/kv: add -mount flag to kv list [[GH-19378](https://github.com/hashicorp/vault/pull/19378)]
-* core (enterprise): Don't delete backend stored data that appears to be filterable
-on this secondary if we don't have a corresponding mount entry.
-* core (enterprise): Fix intermittent issue with token entries sometimes not being found when using a newly created token in a request to a secondary, even when SSCT `new_token` forwarding is set. When this occurred, this would result in the following error to the client: `error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue`.
-* core (enterprise): Fix log shipper buffer size overflow issue for 32 bit architecture.
-* core (enterprise): Fix logshipper buffer size to default to DefaultBufferSize only when reported system memory is zero.
-* core (enterprise): Fix panic when using invalid accessor for control-group request
-* core (enterprise): Fix perf standby WAL streaming silently failures when replication setup happens at a bad time.
-* core (enterprise): Fix read on perf standbys failing with 412 after leadership change, unseal, restores or restarts when no writes occur
-* core (enterprise): Remove MFA Enforcment configuration for namespace when deleting namespace
-* core/ssct (enterprise): Fixed race condition where a newly promoted DR may revert `sscGenCounter`
-resulting in 412 errors.
-* core: Change where we evaluate filtered paths as part of mount operations; this is part of an enterprise bugfix that will
-have its own changelog entry.  Fix wrong lock used in ListAuths link meta interface implementation. [[GH-21260](https://github.com/hashicorp/vault/pull/21260)]
-* core: Do not cache seal configuration to fix a bug that resulted in sporadic auto unseal failures. [[GH-21223](https://github.com/hashicorp/vault/pull/21223)]
-* core: Don't exit just because we think there's a potential deadlock. [[GH-21342](https://github.com/hashicorp/vault/pull/21342)]
-* core: Fix Forwarded Writer construction to correctly find active nodes, allowing PKI cross-cluster functionality to succeed on existing mounts.
-* core: Fix panic in sealed nodes using raft storage trying to emit raft metrics [[GH-21249](https://github.com/hashicorp/vault/pull/21249)]
-* core: Fix writes to readonly storage on performance standbys when user lockout feature is enabled. [[GH-20783](https://github.com/hashicorp/vault/pull/20783)]
-* identity: Fixes duplicate groups creation with the same name but unique IDs. [[GH-20964](https://github.com/hashicorp/vault/pull/20964)]
-* license (enterprise): Fix bug where license would update even if the license didn't change.
-* openapi: Small fixes for OpenAPI display attributes. Changed "log-in" to "login" [[GH-20285](https://github.com/hashicorp/vault/pull/20285)]
-* plugin/reload:  Fix a possible data race with rollback manager and plugin reload [[GH-19468](https://github.com/hashicorp/vault/pull/19468)]
-* replication (enterprise): Fix a caching issue when replicating filtered data to
-a performance secondary. This resulted in the data being set to nil in the cache
-and a "invalid value" error being returned from the API.
-* replication (enterprise): Fix a race condition with invalid tokens during WAL streaming that was causing Secondary clusters to be unable to connect to a Primary.
-* replication (enterprise): Fix a race condition with update-primary that could result in data loss after a DR failover
-* replication (enterprise): Fix bug where reloading external plugin on a secondary would
-break replication.
-* replication (enterprise): Fix path filters deleting data right after it's written by backend Initialize funcs
-* replication (enterprise): Fix regression causing token creation against a role
-with a new entity alias to be incorrectly forwarded from perf standbys. [[GH-21100](https://github.com/hashicorp/vault/pull/21100)]
-* replication (enterprise): Fix replication status for Primary clusters showing its primary cluster's information (in case of DR) in secondaries field when known_secondaries field is nil
-* replication (enterprise): fix bug where secondary grpc connections would timeout when connecting to a primary host that no longer exists.
-* sdk/backend: prevent panic when computing the zero value for a `TypeInt64` schema field. [[GH-18729](https://github.com/hashicorp/vault/pull/18729)]
-* secrets/pki: Support setting both maintain_stored_certificate_counts=false and publish_stored_certificate_count_metrics=false explicitly in tidy config. [[GH-20664](https://github.com/hashicorp/vault/pull/20664)]
-* secrets/transform (enterprise): Address SQL connection leak when cleaning expired tokens
-* secrets/transform (enterprise): Fix a caching bug affecting secondary nodes after a tokenization key rotation
-* secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
-* secrets/transform: Added importing of keys and key versions into the Transform secrets engine using the command 'vault transform import' and 'vault transform import-version'. [[GH-20668](https://github.com/hashicorp/vault/pull/20668)]
-* secrets/transit: Fix export of HMAC-only key, correctly exporting the key used for sign operations. For consumers of the previously incorrect key, use the plaintext export to retrieve these incorrect keys and import them as new versions.
-* secrets/transit: Fix bug related to shorter dedicated HMAC key sizing.
-* sdk/helper/keysutil: New HMAC type policies will have HMACKey equal to Key and be copied over on import. [[GH-20864](https://github.com/hashicorp/vault/pull/20864)]
-* shamir: change mul and div implementations to be constant-time [[GH-19495](https://github.com/hashicorp/vault/pull/19495)]
-* ui (enterprise): Fix cancel button from transform engine role creation page [[GH-19135](https://github.com/hashicorp/vault/pull/19135)]
-* ui: Fix secret render when path includes %. Resolves #11616. [[GH-20430](https://github.com/hashicorp/vault/pull/20430)]
-* ui: Fixes issue unsealing cluster for seal types other than shamir [[GH-20897](https://github.com/hashicorp/vault/pull/20897)]
-* ui: fixes auto_rotate_period ttl input for transit keys [[GH-20731](https://github.com/hashicorp/vault/pull/20731)]
-* ui: fixes bug in kmip role form that caused `operation_all` to persist after deselecting all operation checkboxes [[GH-19139](https://github.com/hashicorp/vault/pull/19139)]
-* ui: fixes key_bits and signature_bits reverting to default values when editing a pki role [[GH-20907](https://github.com/hashicorp/vault/pull/20907)]
-* ui: wait for wanted message event during OIDC callback instead of using the first message event [[GH-18521](https://github.com/hashicorp/vault/pull/18521)]
-
-## 1.13.13
-### January 31, 2024
+* CLI: adds an optional flag (--fail-if-not-fulfilled) to the renew command, which lets the renew command fail on unfulfillable requests and allows command chaining to allow further executions. [[GH-29060](https://github.com/hashicorp/vault/pull/29060)]
+* audit: Audit logs will contain User-Agent headers when they are present in the incoming request. They are not
+HMAC'ed by default but can be configured to be via the `/sys/config/auditing/request-headers/user-agent` endpoint. [[GH-28596](https://github.com/hashicorp/vault/pull/28596)]
+* auth/approle: seal wrap approle secrets if seal wrap is enabled. [[GH-28703](https://github.com/hashicorp/vault/pull/28703)]
+* auth/cert: Add new configuration option `enable_metadata_on_failures` to add client cert metadata on login failures to audit log and response [[GH-29044](https://github.com/hashicorp/vault/pull/29044)]
+* auth/ldap: Adds an option to enable sAMAccountname logins when upndomain is set. [[GH-29118](https://github.com/hashicorp/vault/pull/29118)]
+* auth/okta: update to okta sdk v5 from v2. Transitively updates go-jose dependency to >=3.0.3 to resolve GO-2024-2631. See https://github.com/okta/okta-sdk-golang/blob/master/MIGRATING.md for details on changes. [[GH-28121](https://github.com/hashicorp/vault/pull/28121)]
+* auto-auth/cert: support watching changes on certificate/key files and notifying the auth handler when `enable_reauth_on_new_credentials` is enabled. [[GH-28126](https://github.com/hashicorp/vault/pull/28126)]
+* auto-auth: support new config option `enable_reauth_on_new_credentials`, supporting re-authentication when receiving new credential on certain auto-auth types [[GH-28126](https://github.com/hashicorp/vault/pull/28126)]
+* command/server: Add support for dumping pprof files during startup using CLI option `pprof-dump-dir` [[GH-27033](https://github.com/hashicorp/vault/pull/27033)]
+* core/identity: Improve performance of loading entities when unsealing by batching updates, caching local alias storage reads, and doing more work in parallel. [[GH-29326](https://github.com/hashicorp/vault/pull/29326)]
+* core: Add `removed_from_cluster` field to sys/seal-status and vault status output to indicate whether the node has been removed from the HA cluster. [[GH-28938](https://github.com/hashicorp/vault/pull/28938)]
+* core: Add a mount tuneable that trims trailing slashes of request paths during POST.  Needed to support CMPv2 in PKI. [[GH-28752](https://github.com/hashicorp/vault/pull/28752)]
+* core: Add activation flags. A mechanism for users to opt in to new functionality at a convenient time. Previously used only in Enterprise for SecretSync, activation flags are now available in CE for future features to use. [[GH-29237](https://github.com/hashicorp/vault/pull/29237)]
+* core: Added new `enable_post_unseal_trace` and `post_unseal_trace_directory` config options to generate Go traces during the post-unseal step for debug purposes. [[GH-28895](https://github.com/hashicorp/vault/pull/28895)]
+* core: Config reloading on SIGHUP now includes some Raft settings, which are now also present in `/sys/config/state/sanitized` output. [[GH-29485](https://github.com/hashicorp/vault/pull/29485)]
+* core: add support for reading certain sensitive seal wrap and managed key (enterprise) configuration values from the environment or files. [[GH-29402](https://github.com/hashicorp/vault/pull/29402)]
+* events (enterprise): Send events downstream to a performance standby node only when there is a subscriber on the standby node with a filter matching the events. [[GH-29618](https://github.com/hashicorp/vault/pull/29618)]
+* events (enterprise): Send events downstream to performance standby nodes in a cluster, removing the need to redirect client event subscriptions to the active node. [[GH-29470](https://github.com/hashicorp/vault/pull/29470)]
+* events (enterprise): Use the `path` event metadata field when authorizing a client's `subscribe` capability for consuming an event, instead of requiring `data_path` to be present in the event metadata.
+* identity: Added reporting in Vault logs during unseal to help identify any
+duplicate identify resources in storage. [[GH-29325](https://github.com/hashicorp/vault/pull/29325)]
+* physical/dynamodb: Allow Vault to modify its DynamoDB table and use per-per-request billing mode. [[GH-29371](https://github.com/hashicorp/vault/pull/29371)]
+* raft/autopilot: We've updated the autopilot reconciliation logic (by updating the raft-autopilot dependency to v0.3.0) to avoid artificially increasing the quorum in presence of an unhealthy node. Now autopilot will start the reconciliation process by attempting to demote a failed voter node before any promotions, fixing the issue where Vault would initially increase quorum when faced with a failure of a voter node. In certain configurations, especially when using Vault Enterprise Redundancy Zones and losing a voter then a non-voter in quick succession, this would lead to a loss of quorum and cluster failure. [[GH-29306](https://github.com/hashicorp/vault/pull/29306)]
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241003195753-88fef418d705
+* sdk/helper: utitilize a randomly seeded cryptographic determinstic random bit generator for
+RSA key generation when using slow random sources, speeding key generation
+considerably. [[GH-29020](https://github.com/hashicorp/vault/pull/29020)]
+* sdk: Add Vault build date to system view plugin environment response [[GH-29082](https://github.com/hashicorp/vault/pull/29082)]
+* sdk: Add helpers and CE stubs for plugins to communicate with Rotation Manager (Enterprise). [[GH-29273](https://github.com/hashicorp/vault/pull/29273)]
+* secret/pki: Introduce a new value `always_enforce_err` within `leaf_not_after_behavior` to force the error in all circumstances such as CA issuance and ACME requests if requested TTL values are beyond the issuer's NotAfter. [[GH-28907](https://github.com/hashicorp/vault/pull/28907)]
+* secrets(pki): Error if attempt to set a manual chain on an issuer that can't issue any certificate. [[GH-29473](https://github.com/hashicorp/vault/pull/29473)]
+* secrets-sync (enterprise): No longer attempt to unsync a random UUID secret name in GCP upon destination creation.
+* secrets-sync (enterprise): add support for user-managed encryption keys in GCP secrets sync destinations.
+* secrets/aws: add fallback endpoint and region parameters to sts configuration [[GH-29051](https://github.com/hashicorp/vault/pull/29051)]
+* secrets/pki (enterprise): Add issuer configuration fields which allow disabling specific validations on certificate chains.
+* secrets/pki: Add ACME error types to errors encountered during challenge validation. [[GH-28678](https://github.com/hashicorp/vault/pull/28678)]
+* secrets/pki: Add `serial_number_source` option to PKI roles to control the source for the subject serial number. [[GH-29369](https://github.com/hashicorp/vault/pull/29369)]
+* secrets/pki: Add a CRL entry limit to prevent runaway revocations from overloading Vault, reconfigurable with max_crl_entries on the CRL config. [[GH-28654](https://github.com/hashicorp/vault/pull/28654)]
+* secrets/pki: Add a new set of APIs that allow listing ACME account key ids, retrieving ACME account information along with the associated order and certificate information and updating an ACME account's status [[GH-29173](https://github.com/hashicorp/vault/pull/29173)]
+* secrets/pki: Add a warning when issuers are updated with validations that cause the issuer to be non-functional.
+* secrets/pki: Add necessary validation configuration fields to CMPv2 to enable customers with different clients.
+* secrets/pki: Complete the set of name constraints parameters by adding permitted_email_addresses, permitted_ip_ranges, permitted_uri_domains, excluded_dns_domains, excluded_email_addresses, excluded_ip_ranges, and excluded_uri_domains; this makes it possible for the name constraints extension to be fully specified when creating root and intermediate CA certificates. [[GH-29245](https://github.com/hashicorp/vault/pull/29245)]
+* secrets/transit: Add support for RSA padding scheme pkcs1v15 for encryption [[GH-25486](https://github.com/hashicorp/vault/pull/25486)]
+* storage/dynamodb: Pass context to AWS SDK calls [[GH-27927](https://github.com/hashicorp/vault/pull/27927)]
+* storage/s3: Pass context to AWS SDK calls [[GH-27927](https://github.com/hashicorp/vault/pull/27927)]
+* ui (enterprise): Allow WIF configuration on the Azure secrets engine. [[GH-29047](https://github.com/hashicorp/vault/pull/29047)]
+* ui (enterprise): Allow WIF configuration on the GCP secrets engine. [[GH-29423](https://github.com/hashicorp/vault/pull/29423)]
+* ui: Add button to copy secret path in kv v1 and v2 secrets engines [[GH-28629](https://github.com/hashicorp/vault/pull/28629)]
+* ui: Add identity_token_key to mount view for the GCP and Azure Secret engines. [[GH-28822](https://github.com/hashicorp/vault/pull/28822)]
+* ui: Add support for the name constraints extension to be fully specified when creating root and intermediate CA certificates. [[GH-29263](https://github.com/hashicorp/vault/pull/29263)]
+* ui: Adds ability to edit, create, and view the Azure secrets engine configuration. [[GH-29047](https://github.com/hashicorp/vault/pull/29047)]
+* ui: Adds ability to edit, create, and view the GCP secrets engine configuration. [[GH-29423](https://github.com/hashicorp/vault/pull/29423)]
+* ui: Adds copy button to identity entity, alias and mfa method IDs [[GH-28742](https://github.com/hashicorp/vault/pull/28742)]
+* ui: Adds navigation for LDAP hierarchical libraries [[GH-29293](https://github.com/hashicorp/vault/pull/29293)]
+* ui: Adds navigation for LDAP hierarchical roles [[GH-28824](https://github.com/hashicorp/vault/pull/28824)]
+* ui: Adds params to postgresql database to improve editing a connection in the web browser. [[GH-29200](https://github.com/hashicorp/vault/pull/29200)]
+* ui: Application static breadcrumbs should be formatted in title case. [[GH-29206](https://github.com/hashicorp/vault/pull/29206)]
+* ui: Replace KVv2 json secret details view with Hds::CodeBlock component allowing users to search the full secret height. [[GH-28808](https://github.com/hashicorp/vault/pull/28808)]
+* website/docs: changed outdated reference to consul-helm repository to consul-k8s repository. [[GH-28825](https://github.com/hashicorp/vault/pull/28825)]
+
+BUG FIXES:
+
+* UI: Fix missing Client Count card when running as a Vault Dedicated cluster [[GH-29241](https://github.com/hashicorp/vault/pull/29241)]
+* activity: Include activity records from clients created by deleted or disabled auth mounts in Export API response. [[GH-29376](https://github.com/hashicorp/vault/pull/29376)]
+* activity: Show activity records from clients created in deleted namespaces when activity log is queried from admin namespace. [[GH-29432](https://github.com/hashicorp/vault/pull/29432)]
+* agent: Fix chown error running agent on Windows with an auto-auth file sinks. [[GH-28748](https://github.com/hashicorp/vault/pull/28748)]
+* agent: Fixed an issue where giving the agent multiple config files could cause the merged config to be incorrect
+when `template_config` is set in one of the config files. [[GH-29680](https://github.com/hashicorp/vault/pull/29680)]
+* audit: Fixing TestAudit_enableAudit_fallback_two test failure.
+* audit: Prevent users from enabling multiple audit devices of file type with the same file_path to write to. [[GH-28751](https://github.com/hashicorp/vault/pull/28751)]
+* auth/ldap: Fixed an issue where debug level logging was not emitted. [[GH-28881](https://github.com/hashicorp/vault/pull/28881)]
+* auth/radius: Fixed an issue where usernames with upper case characters where not honored [[GH-28884](https://github.com/hashicorp/vault/pull/28884)]
+* autosnapshots (enterprise): Fix an issue where snapshot size metrics were not reported for cloud-based storage.
+* cli: Fixed a CLI precedence issue where -agent-address didn't override VAULT_AGENT_ADDR as it should [[GH-28574](https://github.com/hashicorp/vault/pull/28574)]
+* core/api: Added missing LICENSE files to API sub-modules to ensure Go module tooling recognizes MPL-2.0 license. [[GH-27920](https://github.com/hashicorp/vault/pull/27920)]
+* core/managed-keys (enterprise): Allow mechanism numbers above 32 bits in PKCS#11 managed keys.
+* core/metrics: Fix unlocked mounts read for usage reporting. [[GH-29091](https://github.com/hashicorp/vault/pull/29091)]
+* core/seal (enterprise): Fix bug that caused seal generation information to be replicated, which prevented disaster recovery and performance replication clusters from using their own seal high-availability configuration.
+* core/seal (enterprise): Fix problem with nodes unable to join Raft clusters with Seal High Availability enabled. [[GH-29117](https://github.com/hashicorp/vault/pull/29117)]
+* core/seal: Azure seals required client_secret, preventing use of managed service identities and user assigned identities. [[GH-29499](https://github.com/hashicorp/vault/pull/29499)]
+* core/seal: Fix an issue that could cause reading from sys/seal-backend-status to return stale information. [[GH-28631](https://github.com/hashicorp/vault/pull/28631)]
+* core: Fix Azure authentication for seal/managed keys to work for both federated workload identity and managed user identities.  Fixes regression for federated workload identities. [[GH-29792](https://github.com/hashicorp/vault/pull/29792)]
+* core: Fix an issue where duplicate identity aliases in storage could be merged
+inconsistently during different unseal events or on different servers. [[GH-28867](https://github.com/hashicorp/vault/pull/28867)]
+* core: Fix bug when if failing to persist the barrier keyring to track encryption counts, the number of outstanding encryptions remains added to the count, overcounting encryptions. [[GH-29506](https://github.com/hashicorp/vault/pull/29506)]
+* core: Fixed panic seen when performing help requests without /v1/ in the URL. [[GH-28669](https://github.com/hashicorp/vault/pull/28669)]
+* core: Improved an internal helper function that sanitizes paths by adding a check for leading backslashes
+in addition to the existing check for leading slashes. [[GH-28878](https://github.com/hashicorp/vault/pull/28878)]
+* core: Prevent integer overflows of the barrier key counter on key rotation requests [[GH-29176](https://github.com/hashicorp/vault/pull/29176)]
+* core: fix bug in seal unwrapper that caused high storage latency in Vault CE. For every storage read request, the
+seal unwrapper was performing the read twice, and would also issue an unnecessary storage write. [[GH-29050](https://github.com/hashicorp/vault/pull/29050)]
+* core: fix issue when attempting to re-bootstrap HA when using Raft as HA but not storage [[GH-18615](https://github.com/hashicorp/vault/pull/18615)]
+* database/mssql: Fix a bug where contained databases would silently fail root rotation if a custom root rotation statement was not provided. [[GH-29399](https://github.com/hashicorp/vault/pull/29399)]
+* database: Fix a bug where static role passwords are erroneously rotated across backend restarts when using skip import rotation. [[GH-29537](https://github.com/hashicorp/vault/pull/29537)]
+* export API: Normalize the start_date parameter to the start of the month as is done in the sys/counters API to keep the results returned from both of the API's consistent. [[GH-29562](https://github.com/hashicorp/vault/pull/29562)]
+* identity/oidc (enterprise): Fix delays in rotation and invalidation of OIDC keys when there are too many namespaces.
+The Cache-Control header returned by the identity/oidc/.well-known/keys endpoint now depends only on the named keys for
+the queried namespace. [[GH-29312](https://github.com/hashicorp/vault/pull/29312)]
+* kmip (enterprise): Use the default KMIP port for IPv6 addresses missing a port, for the listen_addrs configuration field, in order to match the existing IPv4 behavior
+* namespaces (enterprise): Fix issue where namespace patch requests to a performance secondary would not patch the namespace's metadata.
+* plugins: Fix a bug that causes zombie dbus-daemon processes on certain systems. [[GH-29334](https://github.com/hashicorp/vault/pull/29334)]
+* proxy: Fix chown error running proxy on Windows with an auto-auth file sink. [[GH-28748](https://github.com/hashicorp/vault/pull/28748)]
+* sdk/database: Fix a bug where slow database connections can cause goroutines to be blocked. [[GH-29097](https://github.com/hashicorp/vault/pull/29097)]
+* secret/aws: Fixed potential panic after step-down and the queue has not repopulated. [[GH-28330](https://github.com/hashicorp/vault/pull/28330)]
+* secret/db: Update static role rotation to generate a new password after 2 failed attempts.
+Unblocks customers that were stuck in a failing loop when attempting to rotate static role passwords. [[GH-28989](https://github.com/hashicorp/vault/pull/28989)]
+* secret/pki: Fix a bug that prevents PKI issuer field enable_aia_url_templating
+to be set to false. [[GH-28832](https://github.com/hashicorp/vault/pull/28832)]
+* secrets-sync (enterprise): Add new parameters for destination configs to specify allowlists for IP's and ports.
+* secrets-sync (enterprise): Fixed issue where secret-key granularity destinations could sometimes cause a panic when loading a sync status.
+* secrets/aws: Add sts_region parameter to root config for STS API calls. [[GH-22726](https://github.com/hashicorp/vault/pull/22726)]
+* secrets/aws: Fix issue with static credentials not rotating after restart or leadership change. [[GH-28775](https://github.com/hashicorp/vault/pull/28775)]
+* secrets/database: Fix a bug where a global database plugin reload exits if any of the database connections are not available [[GH-29519](https://github.com/hashicorp/vault/pull/29519)]
+* secrets/openldap: Update static role rotation to generate a new password after 2 failed attempts.
+Unblocks customers that were stuck in a failing loop when attempting to rotate static role passwords. [[GH-29131](https://github.com/hashicorp/vault/pull/29131)]
+* secrets/pki: Address issue with ACME HTTP-01 challenges failing for IPv6 IPs due to improperly formatted URLs [[GH-28718](https://github.com/hashicorp/vault/pull/28718)]
+* secrets/pki: Fix a bug that prevented the full CA chain to be used when enforcing name constraints. [[GH-29255](https://github.com/hashicorp/vault/pull/29255)]
+* secrets/pki: fixes issue #28749 requiring all chains to be single line of authority. [[GH-29342](https://github.com/hashicorp/vault/pull/29342)]
+* secrets/ssh: Return the flag `allow_empty_principals` in the read role api when key_type is "ca" [[GH-28901](https://github.com/hashicorp/vault/pull/28901)]
+* secrets/transform (enterprise): Fix nil panic when accessing a partially setup database store.
+* secrets/transit: Fix a race in which responses from the key update api could contain results from another subsequent update [[GH-28839](https://github.com/hashicorp/vault/pull/28839)]
+* sentinel (enterprise): No longer report inaccurate log messages for when failing an advisory policy.
+* ui (enterprise): Fixes login to web UI when MFA is enabled for SAML auth methods [[GH-28873](https://github.com/hashicorp/vault/pull/28873)]
+* ui (enterprise): Fixes token renewal to ensure capability checks are performed in the relevant namespace, resolving 'Not authorized' errors for resources that users have permission to access. [[GH-29416](https://github.com/hashicorp/vault/pull/29416)]
+* ui/database: Fixes 'cannot update static username' error when updating static role's rotation period [[GH-29498](https://github.com/hashicorp/vault/pull/29498)]
+* ui: Allow users to search the full json object within the json code-editor edit/create view. [[GH-28808](https://github.com/hashicorp/vault/pull/28808)]
+* ui: Decode `connection_url` to fix database connection updates (i.e. editing connection config, deleting roles) failing when urls include template variables. [[GH-29114](https://github.com/hashicorp/vault/pull/29114)]
+* ui: Fixes login to web UI when MFA is enabled for OIDC (i.e. azure, auth0) and Okta auth methods [[GH-28873](https://github.com/hashicorp/vault/pull/28873)]
+* ui: Fixes navigation for quick actions in LDAP roles' popup menu [[GH-29293](https://github.com/hashicorp/vault/pull/29293)]
+* ui: Fixes rendering issues of LDAP dynamic and static roles with the same name [[GH-28824](https://github.com/hashicorp/vault/pull/28824)]
+* ui: Fixes text overflow on Secrets engines and Auth Engines list views for long names & descriptions [[GH-29430](https://github.com/hashicorp/vault/pull/29430)]
+* ui: MFA methods now display the namespace path instead of the namespace id. [[GH-29588](https://github.com/hashicorp/vault/pull/29588)]
+* ui: No longer running decodeURIComponent on KVv2 list view allowing percent encoded data-octets in path name. [[GH-28698](https://github.com/hashicorp/vault/pull/28698)]
+* vault/diagnose: Fix time to expiration reporting within the TLS verification to not be a month off. [[GH-29128](https://github.com/hashicorp/vault/pull/29128)]
+
+## 1.18.15 Enterprise
+### September 24, 2025
+
+SECURITY:
+
+* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3.
+* core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27.
 
 CHANGES:
 
-* core: Bump Go version to 1.20.12.
-* database/snowflake: Update plugin to v0.7.4 [[GH-25059](https://github.com/hashicorp/vault/pull/25059)]
+* core: Bump Go version to 1.24.7.
+* core: Updates post-install script to print updated license information
+* database/snowflake: Update plugin to [v0.12.3](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.12.3)
+* sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible
 
 IMPROVEMENTS:
 
-* command/server: display logs on startup immediately if disable-gated-logs flag is set [[GH-24280](https://github.com/hashicorp/vault/pull/24280)]
-* storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [[GH-24010](https://github.com/hashicorp/vault/pull/24010)]
-* ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [[GH-18513](https://github.com/hashicorp/vault/pull/18513)]
+* Raft: Auto-join will now allow you to enforce IPv4 on networks that allow IPv6 and dual-stack enablement, which is on by default in certain regions.
+* auth/cert: Support RFC 9440 colon-wrapped Base64 certificates in `x_forwarded_for_client_cert_header`, to fix TLS certificate auth errors with Google Cloud Application Load Balancer.
+* core (enterprise): Updated code to support FIPS 140-3 compliant algorithms.
 
 BUG FIXES:
 
-* helper/pkcs7: Fix slice out-of-bounds panic [[GH-24891](https://github.com/hashicorp/vault/pull/24891)]
-* kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
-* ui: Fixed minor bugs with database secrets engine [[GH-24947](https://github.com/hashicorp/vault/pull/24947)]
-* ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [[GH-24697](https://github.com/hashicorp/vault/pull/24697)]
-* ui: fix incorrectly calculated capabilities on PKI issuer endpoints [[GH-24686](https://github.com/hashicorp/vault/pull/24686)]
-  
-## 1.13.12
-### December 06, 2023
+* auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load.
+* secrets/transit: Fix error when using ed25519 keys that were imported with derivation enabled
+* sys/mounts: enable unsetting allowed_response_headers
 
-SECURITY:
+## 1.18.14 Enterprise
+### August 28, 2025
+
+FEATURES:
 
-* core: Fixes an issue present in both Vault and Vault Enterprise since Vault 1.12.0, where Vault is vulnerable to a denial of service through memory exhaustion of the host when handling large HTTP requests from a client. (see [CVE-2023-6337](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6337) & [HCSEC-2023-34](https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741))
+* **IBM RACF Static Role Password Phrase Management**: Add support for static role password phrase management to the LDAP secrets engine. (https://github.com/hashicorp/vault-plugin-secrets-openldap/pull/184)
 
 CHANGES:
 
-* identity (enterprise): POST requests to the `/identity/entity/merge` endpoint
-are now always forwarded from standbys to the active node. [[GH-24325](https://github.com/hashicorp/vault/pull/24325)]
+* core: Bump Go version to 1.23.12.
+* http: Add JSON configurable limits to HTTP handling for JSON payloads: `max_json_depth`, `max_json_string_value_length`, `max_json_object_entry_count`, `max_json_array_element_count`.
+* secrets/openldap: update plugin to v0.14.7
 
 BUG FIXES:
 
-* api: Fix deadlock on calls to sys/leader with a namespace configured
-on the request. [[GH-24256](https://github.com/hashicorp/vault/pull/24256)]
-* core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [[GH-24336](https://github.com/hashicorp/vault/pull/24336)]
-* ui: Fix payload sent when disabling replication [[GH-24292](https://github.com/hashicorp/vault/pull/24292)]
-
-## 1.13.11
-### November 30, 2023
-
-CHANGES:
+* core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration
+* core/metrics: Add service name prefix for core HA metrics to avoid duplicate, zero-value metrics.
+* core/seal: When Seal-HA is enabled, make it an error to persist the barrier
+keyring when not all seals are healthy.  This prevents the possibility of
+failing to unseal when a different subset of seals are healthy than were
+healthy at last write.
+* raft/autopilot: Fixes an issue with enterprise redundancy zones where, if the leader was in a redundancy zone and that leader becomes unavailable, the node would become an unzoned voter. This can artificially inflate the required number of nodes for quorum, leading to a situation where the cluster cannot recover if another leader subsequently becomes unavailable. Vault will now keep an unavailable node in its last known redundancy zone as a non-voter.
+* secrets/database/postgresql: Support for multiline statements in the `rotation_statements` field.
 
-* core: Bump Go version to 1.20.11.
+## 1.18.13 Enterprise
+### August 06, 2025
 
-IMPROVEMENTS:
+SECURITY:
 
-* core (enterprise): Speed up unseal when using namespaces
-* ui: Sort list view of entities and aliases alphabetically using the item name [[GH-24103](https://github.com/hashicorp/vault/pull/24103)]
+* auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled [[GH-31427](https://github.com/hashicorp/vault/pull/31427),[HCSEC-2025-20](https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092)].
 
 BUG FIXES:
 
-* activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
-* auth/cert: Handle errors related to expired OCSP server responses [[GH-24193](https://github.com/hashicorp/vault/pull/24193)]
-* core/config: Use correct HCL config value when configuring `log_requests_level`. [[GH-24057](https://github.com/hashicorp/vault/pull/24057)]
-* core/quotas: Close rate-limit blocked client purge goroutines when sealing [[GH-24108](https://github.com/hashicorp/vault/pull/24108)]
-* replication (enterprise): disallow configuring paths filter for a mount path that does not exist
-* secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [[GH-24192](https://github.com/hashicorp/vault/pull/24192)]
-* ui: Fix error when tuning token auth configuration within namespace [[GH-24147](https://github.com/hashicorp/vault/pull/24147)]
+* identity/mfa: revert cache entry change from #31217 and document cache entry values [[GH-31421](https://github.com/hashicorp/vault/pull/31421)]
 
-## 1.13.10
-### November 09, 2023
+## 1.18.12 Enterprise
+### July 25, 2025
 
 SECURITY:
-* core: inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. This vulnerability, CVE-2023-5954, was introduced in Vault 1.15.0, 1.14.3, and 1.13.7, and is fixed in Vault 1.15.2, 1.14.6, and 1.13.10. [[HSEC-2023-33](https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926)]
 
-CHANGES:
+* audit: **breaking change** privileged vault operator may execute code on the underlying host (CVE-2025-6000). Vault will not unseal if the only configured file audit device has executable permissions (e.g., 0777, 0755). See recent [breaking change](https://developer.hashicorp.com/vault/docs/updates/important-changes#breaking-changes) docs for more details. [[GH-31211](https://github.com/hashicorp/vault/pull/31211),[HCSEC-2025-14](https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033)]
+* auth/userpass: timing side-channel in vault's userpass auth method (CVE-2025-6011)[HCSEC-2025-15](https://discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034)
+* core/login: vault userpass and ldap user lockout bypass (CVE-2025-6004). update alias lookahead to respect username case for LDAP and username/password. [[GH-31352](https://github.com/hashicorp/vault/pull/31352),[HCSEC-2025-16](https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035)]
+* secrets/totp: vault totp secrets engine code reuse (CVE-2025-6014) [[GH-31246](https://github.com/hashicorp/vault/pull/31246),[HCSEC-2025-17](https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036)]
+* auth/cert: vault certificate auth method did not validate common name for non-ca certificates (CVE-2025-6037). test non-CA cert equality on login matching instead of individual fields. [[GH-31210](https://github.com/hashicorp/vault/pull/31210),[HCSEC-2025-18](https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037)]
+* core/mfa: vault login mfa bypass of rate limiting and totp token reuse (CVE-2025-6015) [[GH-31217](https://github.com/hashicorp/vault/pull/31297),[HCSEC-2025-19](https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038)]
 
-* auth/approle: Normalized error response messages when invalid credentials are provided [[GH-23786](https://github.com/hashicorp/vault/pull/23786)]
-* secrets/mongodbatlas: Update plugin to v0.9.2 [[GH-23849](https://github.com/hashicorp/vault/pull/23849)]
+BUG FIXES:
 
-FEATURES:
+* core/seal (enterprise): Fix a bug that caused the seal rewrap process to abort in the presence of partially sealed entries.
+* kmip (enterprise): Fix a panic that can happen when a KMIP client makes a request before the Vault server has finished unsealing. [[GH-31266](https://github.com/hashicorp/vault/pull/31266)]
+* plugins: Fix panics that can occur when a plugin audits a request or response before the Vault server has finished unsealing. [[GH-31266](https://github.com/hashicorp/vault/pull/31266)]
+* replication (enterprise): Fix bug with mount invalidations consuming excessive memory.
+* secrets-sync (enterprise): Unsyncing secret-key granularity associations will no longer give a misleading error about a failed unsync operation that did indeed succeed.
 
-* cli/snapshot: Add CLI tool to inspect Vault snapshots [[GH-23457](https://github.com/hashicorp/vault/pull/23457)]
+## 1.18.11 Enterprise
+### June 25, 2025
 
-IMPROVEMENTS:
+SECURITY:
 
-* storage/etcd: etcd should only return keys when calling List() [[GH-23872](https://github.com/hashicorp/vault/pull/23872)]
+* core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes. [[GH-30794](https://github.com/hashicorp/vault/pull/30794)],[[HCSEC-2025-11](https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570)]
+* core/identity: vault root namespace operator may elevate privileges (CVE-2025-5999). Fix string contains check in Identity APIs to be case-insensitive. [[GH-31045](https://github.com/hashicorp/vault/pull/31045),[HCSEC-2025-13](https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032)]
+
+CHANGES:
+
+* api: Update the default API client to check for the `Retry-After` header and, if it exists, wait for the specified duration before retrying the request. [[GH-30887](https://github.com/hashicorp/vault/pull/30887)]
+* auth/azure: Update plugin to v0.19.5
+* core: Bump Go version to 1.23.10.
+* quotas/rate-limit: Round up the `Retry-After` value to the nearest second when calculating the retry delay. [[GH-30887](https://github.com/hashicorp/vault/pull/30887)]
+* secrets/azure: Update plugin to v0.20.3
+* secrets/database: Update vault-plugin-database-snowflake to v0.12.2
 
 BUG FIXES:
 
-* api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
-on the request. [[GH-23861](https://github.com/hashicorp/vault/pull/23861)]
-* core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
-* core/activity: Fixes segments fragment loss due to exceeding entry record size limit [[GH-23781](https://github.com/hashicorp/vault/pull/23781)]
-* core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [[GH-23802](https://github.com/hashicorp/vault/pull/23802)]
-* core: Revert PR causing memory consumption bug [[GH-23986](https://github.com/hashicorp/vault/pull/23986)]
-* core: Skip unnecessary deriving of policies during Login MFA Check. [[GH-23894](https://github.com/hashicorp/vault/pull/23894)]
-* core: fix bug where deadlock detection was always on for expiration and quotas. 
-These can now be configured individually with `detect_deadlocks`. [[GH-23902](https://github.com/hashicorp/vault/pull/23902)]
-* core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [[GH-23874](https://github.com/hashicorp/vault/pull/23874)]
-* expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [[GH-24027](https://github.com/hashicorp/vault/pull/24027)]
+* secrets/database: Treat all rotation_schedule values as UTC to ensure consistent behavior. [[GH-30606](https://github.com/hashicorp/vault/pull/30606)]
+* secrets/transit (enterprise): ensure verify endpoint always returns valid field in batch_results with CMAC
+* secrets/transit: ensure verify endpoint always returns valid field in batch_results with HMAC [[GH-30852](https://github.com/hashicorp/vault/pull/30852)]
+* ui: Redirect users authenticating with Vault as an OIDC provider to log in again when token expires. [[GH-30838](https://github.com/hashicorp/vault/pull/30838)]
 
-## 1.13.9
-### October 25, 2023
+## 1.18.10 Enterprise
+### May 30, 2025
 
 CHANGES:
 
-* core: Bump Go version to 1.20.10.
-* replication (enterprise): Switch to non-deprecated gRPC field for resolver target host
+* Update vault-plugin-auth-cf to v0.19.2
+* auth/azure: Upgrade plugin to v0.19.4
+* database/snowflake: Update plugin to v0.12.1
 
 IMPROVEMENTS:
 
-* api/plugins: add `tls-server-name` arg for plugin registration [[GH-23549](https://github.com/hashicorp/vault/pull/23549)]
-* core: Use a worker pool for the rollback manager. Add new metrics for the rollback manager to track the queued tasks. [[GH-22567](https://github.com/hashicorp/vault/pull/22567)]
+* ui: Replaces all instances of the deprecated event.keyCode with event.key [[GH-30493](https://github.com/hashicorp/vault/pull/30493)]
 
 BUG FIXES:
 
-* command/server: Fix bug with sigusr2 where pprof files were not closed correctly [[GH-23636](https://github.com/hashicorp/vault/pull/23636)]
-* events: Ignore sending context to give more time for events to send [[GH-23500](https://github.com/hashicorp/vault/pull/23500)]
-* expiration: Prevent large lease loads from delaying state changes, e.g. becoming active or standby. [[GH-23282](https://github.com/hashicorp/vault/pull/23282)]
-* kmip (enterprise): Improve handling of failures due to storage replication issues.
-* kmip (enterprise): Return a structure in the response for query function Query Server Information.
-* mongo-db: allow non-admin database for root credential rotation [[GH-23240](https://github.com/hashicorp/vault/pull/23240)]
-* replication (enterprise): Fix a bug where undo logs would only get enabled on the initial node in a cluster.
-* replication (enterprise): Fix a missing unlock when changing replication state
-* secrets/transit (enterprise): Address an issue using sign/verify operations with managed keys returning an error about it not containing a private key
-* secrets/transit (enterprise): Address panic when using GCP,AWS,Azure managed keys for encryption operations. At this time all encryption operations for the cloud providers have been disabled, only signing operations are supported.
-* secrets/transit (enterprise): Apply hashing arguments and defaults to managed key sign/verify operations
-* secrets/transit: Do not allow auto rotation on managed_key key types [[GH-23723](https://github.com/hashicorp/vault/pull/23723)]
-
-## 1.13.6
-### August 30, 2023
+* plugins (enterprise): Fix an issue where Enterprise plugins can't run on a standby node
+when it becomes active because standby nodes don't extract the artifact when the plugin
+is registered. Remove extracting from Vault and require the operator to place
+the extracted artifact in the plugin directory before registration.
 
-CHANGES:
+## 1.18.9 Enterprise
+### April 30, 2025
 
-* core: Bump Go version to 1.20.7.
+SECURITY:
 
-IMPROVEMENTS:
+* core: vault may expose sensitive information in error logs when processing malformed data with the kv v2 plugin[[GH-30388](https://github.com/hashicorp/vault/pull/30388), [HCSEC-2025-09](https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717)]
 
-* core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [[GH-22235](https://github.com/hashicorp/vault/pull/22235)]
-* replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
-* secrets/database: Improves error logging for static role rotations by including the database and role names. [[GH-22253](https://github.com/hashicorp/vault/pull/22253)]
-* storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [[GH-22040](https://github.com/hashicorp/vault/pull/22040)]
-* ui: KV View Secret card will link to list view if input ends in "/" [[GH-22502](https://github.com/hashicorp/vault/pull/22502)]
-* ui: enables create and update KV secret workflow when control group present [[GH-22471](https://github.com/hashicorp/vault/pull/22471)]
-
-BUG FIXES:
-
-* activity (enterprise): Fix misattribution of entities to no or child namespace auth methods [[GH-18809](https://github.com/hashicorp/vault/pull/18809)]
-* api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [[GH-22523](https://github.com/hashicorp/vault/pull/22523)]
-* core (enterprise): Remove MFA Configuration for namespace when deleting namespace
-* core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
-Also fix a related potential deadlock. [[GH-21110](https://github.com/hashicorp/vault/pull/21110)]
-* core:  Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [[GH-22137](https://github.com/hashicorp/vault/pull/22137)]
-* core: Fix bug where background thread to update locked user entries runs on DR secondaries. [[GH-22355](https://github.com/hashicorp/vault/pull/22355)]
-* core: Fix readonly errors that could occur while loading mounts/auths during unseal [[GH-22362](https://github.com/hashicorp/vault/pull/22362)]
-* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-21470](https://github.com/hashicorp/vault/pull/21470)]
-* expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [[GH-22374](https://github.com/hashicorp/vault/pull/22374)]
-* license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [[GH-22363](https://github.com/hashicorp/vault/pull/22363)]
-* replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
-* replication (enterprise): Fix panic when update-primary was called on demoted clusters using update_primary_addrs
-* replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
-* sdk/ldaputil: Properly escape user filters when using UPN domains
-sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [[GH-22249](https://github.com/hashicorp/vault/pull/22249)]
-* secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [[GH-22331](https://github.com/hashicorp/vault/pull/22331)]
-* secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
-* ui: Fix blank page or ghost secret when canceling KV secret create [[GH-22541](https://github.com/hashicorp/vault/pull/22541)]
-* ui: fixes `max_versions` default for secret metadata unintentionally overriding kv engine defaults [[GH-22394](https://github.com/hashicorp/vault/pull/22394)]
-* ui: fixes model defaults overwriting input value when user tries to clear form input [[GH-22458](https://github.com/hashicorp/vault/pull/22458)]
-
-## 1.13.8
-### September 27, 2023
+BUG FIXES:
 
-SECURITY:
+* core (enterprise): fix issue with errors being swallowed on failed HSM logins.
+* database: Prevent static roles created in versions prior to 1.15.0 from rotating on backend restart. [[GH-30320](https://github.com/hashicorp/vault/pull/30320)]
+* database: no longer incorrectly add an "unrecognized parameters" warning for certain SQL database secrets config operations when another warning is returned [[GH-30327](https://github.com/hashicorp/vault/pull/30327)]
 
-* sentinel (enterprise): Sentinel RGP policies allowed for cross-namespace denial-of-service. This vulnerability, CVE-2023-3775, is fixed in Vault Enterprise 1.15.0, 1.14.4, and 1.13.8. [[HSEC-2023-29](https://discuss.hashicorp.com/t/hcsec-2023-29-vault-enterprise-s-sentinel-rgp-policies-allowed-for-cross-namespace-denial-of-service/58653)]
+## 1.18.8 Enterprise
+### April 18, 2025
 
 CHANGES:
 
-* core (enterprise): Ensure Role Governing Policies are only applied down the namespace hierarchy
-
-IMPROVEMENTS:
-
-* ui: Added allowed_domains_template field for CA type role in SSH engine [[GH-23119](https://github.com/hashicorp/vault/pull/23119)]
+* core: Bump Go version to 1.23.7
+* core: Bump Go version to 1.23.8
 
 BUG FIXES:
 
-* core: Fixes list password policy to include those with names containing / characters. [[GH-23155](https://github.com/hashicorp/vault/pull/23155)]
-* secrets/pki: Fix removal of issuers to clean up unreferenced CRLs. [[GH-23007](https://github.com/hashicorp/vault/pull/23007)]
-* ui (enterprise): Fix error message when generating SSH credential with control group [[GH-23025](https://github.com/hashicorp/vault/pull/23025)]
-* ui: Fixes old pki's filter and search roles page bug [[GH-22810](https://github.com/hashicorp/vault/pull/22810)]
-* ui: don't exclude features present on license [[GH-22855](https://github.com/hashicorp/vault/pull/22855)]
-  
-## 1.13.7
-### September 13, 2023
+* secrets/openldap: Prevent static role rotation on upgrade when `NextVaultRotation` is nil. Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing `NextVaultRotation` value. Now sets it to either `LastVaultRotation + RotationPeriod` or `now + RotationPeriod`. [[GH-30265](https://github.com/hashicorp/vault/pull/30265)]
+* secrets/pki (enterprise): Address a parsing bug that rejected CMPv2 requests containing a validity field.
+* secrets/pki: fix a bug where key_usage was ignored when generating root certificates, and signing certain intermediate certificates. [[GH-30034](https://github.com/hashicorp/vault/pull/30034)]
+* secrets/transit: fix a panic when rotating on a managed key returns an error [[GH-30214](https://github.com/hashicorp/vault/pull/30214)]
+
+## 1.18.7 Enterprise
+### April 4, 2025
 
 SECURITY:
 
-* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. This vulnerability, CVE-2023-4680, is fixed in Vault 1.14.3, 1.13.7, and 1.12.11. [[GH-22852](https://github.com/hashicorp/vault/pull/22852), [HSEC-2023-28](https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249)]
+* auth/azure: Update plugin to v0.19.3. Login requires `resource_group_name`, `vm_name`, and `vmss_name` to match token claims [[HCSEC-2025-07](https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716)].
 
 CHANGES:
 
-* core: Bump Go version to 1.20.8.
-* database/snowflake: Update plugin to v0.7.3 [[GH-22591](https://github.com/hashicorp/vault/pull/22591)]
-
-FEATURES:
-
-* ** Merkle Tree Corruption Detection (enterprise) **: Add a new endpoint to check merkle tree corruption.
+* core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [[GH-29774](https://github.com/hashicorp/vault/pull/29774)]
 
 IMPROVEMENTS:
 
-* auth/ldap: improved login speed by adding concurrency to LDAP token group searches [[GH-22659](https://github.com/hashicorp/vault/pull/22659)]
-* core/quotas: Add configuration to allow skipping of expensive role calculations [[GH-22651](https://github.com/hashicorp/vault/pull/22651)]
-* kmip (enterprise): reduce latency of KMIP operation handling
+* core (enterprise): report errors from the underlying seal when getting entropy.
+* storage/raft: Upgrade hashicorp/raft library to v1.7.3 which includes additional logging on the leader when opening and sending a snapshot to a follower. [[GH-29976](https://github.com/hashicorp/vault/pull/29976)]
 
 BUG FIXES:
 
-* cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to `table`. [[GH-22818](https://github.com/hashicorp/vault/pull/22818)]
-* core/quotas: Only perform ResolveRoleOperation for role-based quotas and lease creation. [[GH-22597](https://github.com/hashicorp/vault/pull/22597)]
-* core/quotas: Reduce overhead for role calculation when using cloud auth methods. [[GH-22583](https://github.com/hashicorp/vault/pull/22583)]
-* core/seal: add a workaround for potential connection [[hangs](https://github.com/Azure/azure-sdk-for-go/issues/21346)] in Azure autoseals. [[GH-22760](https://github.com/hashicorp/vault/pull/22760)]
-* core: All subloggers now reflect configured log level on reload. [[GH-22038](https://github.com/hashicorp/vault/pull/22038)]
-* kmip (enterprise): fix date handling error with some re-key operations
-* raft/autopilot: Add dr-token flag for raft autopilot cli commands [[GH-21165](https://github.com/hashicorp/vault/pull/21165)]
-* replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
+* auth/ldap: Fix a bug that does not properly delete users and groups by first converting their names to lowercase when case senstivity option is off. [[GH-29922](https://github.com/hashicorp/vault/pull/29922)]
+* core: Fix Azure authentication for seal/managed keys to work for both federated workload identity and managed user identities.  Fixes regression for federated workload identities. [[GH-29792](https://github.com/hashicorp/vault/pull/29792)]
+* core: Fix a bug that prevents certain loggers from writing to a log file. [[GH-29917](https://github.com/hashicorp/vault/pull/29917)]
+* plugins (enterprise): Fix plugin registration with artifact when a binary for the same plugin is already present in the plugin directory.
+* plugins: plugin registration should honor the `plugin_tmpdir` config [[GH-29978](https://github.com/hashicorp/vault/pull/29978)]
+* secrets/azure: Upgrade plugin to v0.20.2 which reverts role name changes to no longer be a GUID.
+* secrets/pki: Fix a bug that prevents enabling automatic tidying of the CMPv2 nonce store. [[GH-29852](https://github.com/hashicorp/vault/pull/29852)]
 
-## 1.13.6
-### August 30, 2023
+## 1.18.6 Enterprise
+### March 5, 2025
 
-CHANGES:
+IMPROVEMENTS:
 
-* core: Bump Go version to 1.20.7.
+* secrets/pki: Add necessary validation configuration fields to CMPv2 to enable customers with different clients.
 
-IMPROVEMENTS:
+BUG FIXES:
+
+* agent: Fixed an issue where giving the agent multiple config files could cause the merged config to be incorrect
+when `template_config` is set in one of the config files. [[GH-29680](https://github.com/hashicorp/vault/pull/29680)]
+* secrets/database: Fix a bug where a global database plugin reload exits if any of the database connections are not available [[GH-29519](https://github.com/hashicorp/vault/pull/29519)]
+* core: Fix Azure authentication for seal/managed keys to work for both federated workload identity and managed user identities.  Fixes regression for federated workload identities. [[GH-29792](https://github.com/hashicorp/vault/pull/29792)]
 
-* core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [[GH-22235](https://github.com/hashicorp/vault/pull/22235)]
-* replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
-* secrets/database: Improves error logging for static role rotations by including the database and role names. [[GH-22253](https://github.com/hashicorp/vault/pull/22253)]
-* storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [[GH-22040](https://github.com/hashicorp/vault/pull/22040)]
-* ui: KV View Secret card will link to list view if input ends in "/" [[GH-22502](https://github.com/hashicorp/vault/pull/22502)]
-* ui: enables create and update KV secret workflow when control group present [[GH-22471](https://github.com/hashicorp/vault/pull/22471)]
-
-BUG FIXES:
-
-* activity (enterprise): Fix misattribution of entities to no or child namespace auth methods [[GH-18809](https://github.com/hashicorp/vault/pull/18809)]
-* api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [[GH-22523](https://github.com/hashicorp/vault/pull/22523)]
-* core (enterprise): Remove MFA Configuration for namespace when deleting namespace
-* core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
-Also fix a related potential deadlock. [[GH-21110](https://github.com/hashicorp/vault/pull/21110)]
-* core:  Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [[GH-22137](https://github.com/hashicorp/vault/pull/22137)]
-* core: Fix bug where background thread to update locked user entries runs on DR secondaries. [[GH-22355](https://github.com/hashicorp/vault/pull/22355)]
-* core: Fix readonly errors that could occur while loading mounts/auths during unseal [[GH-22362](https://github.com/hashicorp/vault/pull/22362)]
-* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-21470](https://github.com/hashicorp/vault/pull/21470)]
-* expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [[GH-22374](https://github.com/hashicorp/vault/pull/22374)]
-* license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [[GH-22363](https://github.com/hashicorp/vault/pull/22363)]
-* replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
-* replication (enterprise): Fix panic when update-primary was called on demoted clusters using update_primary_addrs
-* replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
-* sdk/ldaputil: Properly escape user filters when using UPN domains
-sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [[GH-22249](https://github.com/hashicorp/vault/pull/22249)]
-* secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [[GH-22331](https://github.com/hashicorp/vault/pull/22331)]
-* secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
-* ui: Fix blank page or ghost secret when canceling KV secret create [[GH-22541](https://github.com/hashicorp/vault/pull/22541)]
-* ui: fixes `max_versions` default for secret metadata unintentionally overriding kv engine defaults [[GH-22394](https://github.com/hashicorp/vault/pull/22394)]
-* ui: fixes model defaults overwriting input value when user tries to clear form input [[GH-22458](https://github.com/hashicorp/vault/pull/22458)]
-
-## 1.13.5
-### July 25, 2023
+## 1.18.5
+### February 25, 2025
 
 SECURITY:
 
-* auth/ldap: Normalize HTTP response codes when invalid credentials are provided to prevent user enumeration. This vulnerability, CVE-2023-3462, is fixed in Vault 1.14.1 and 1.13.5. [[GH-21282](https://github.com/hashicorp/vault/pull/21282), [HSEC-2023-24](https://discuss.hashicorp.com/t/hcsec-2023-24-vaults-ldap-auth-method-allows-for-user-enumeration/56714)]
-* core/namespace (enterprise): An unhandled error in Vault Enterprise’s namespace creation may cause the Vault process to crash, potentially resulting in denial of service. This vulnerability, CVE-2023-3774, is fixed in Vault Enterprise 1.14.1, 1.13.5, and 1.12.9. [[HSEC_2023-23](https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617)]
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.2.0
 
 CHANGES:
 
-* core/namespace (enterprise): Introduce the concept of high-privilege namespace (administrative namespace),
-which will have access to some system backend paths that were previously only accessible in the root namespace. [[GH-21215](https://github.com/hashicorp/vault/pull/21215)]
-* secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
+* core: Bump Go version to 1.23.6
+* raft/autopilot (enterprise): Alongside the CE autopilot update, update raft-autopilot-enterprise library to v0.3.0 and add enterprise-specific regression testing.
+* secrets/openldap: Update plugin to v0.14.5 [[GH-29551](https://github.com/hashicorp/vault/pull/29551)]
+
+FEATURES:
+
+* **Plugins**: Allow Enterprise plugins to run externally on Vault Enterprise only.
 
 IMPROVEMENTS:
 
-* core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
-* core: Add a new periodic metric to track the number of available policies, `vault.policy.configured.count`. [[GH-21010](https://github.com/hashicorp/vault/pull/21010)]
-* replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
-* secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
-* sys/metrics (enterprise): Adds a gauge metric that tracks whether enterprise builtin secret plugins are enabled. [[GH-21681](https://github.com/hashicorp/vault/pull/21681)]
+* raft/autopilot: We've updated the autopilot reconciliation logic (by updating the raft-autopilot dependency to v0.3.0) to avoid artificially increasing the quorum in presence of an unhealthy node. Now autopilot will start the reconciliation process by attempting to demote a failed voter node before any promotions, fixing the issue where Vault would initially increase quorum when faced with a failure of a voter node. In certain configurations, especially when using Vault Enterprise Redundancy Zones and losing a voter then a non-voter in quick succession, this would lead to a loss of quorum and cluster failure. [[GH-29306](https://github.com/hashicorp/vault/pull/29306)]
+* ui: Application static breadcrumbs should be formatted in title case. [[GH-29206](https://github.com/hashicorp/vault/pull/29206)]
 
 BUG FIXES:
 
-* auth/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21799](https://github.com/hashicorp/vault/pull/21799)]
-* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-24170](https://github.com/hashicorp/vault/pull/24170)]
-* identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [[GH-20965](https://github.com/hashicorp/vault/pull/20965)]
-* replication (enterprise): update primary cluster address after DR failover
-* secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21632](https://github.com/hashicorp/vault/pull/21632)]
-* secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error: `no managed key found with uuid`. [[GH-21316](https://github.com/hashicorp/vault/pull/21316)]
-* secrets/pki: Support setting both maintain_stored_certificate_counts=false and publish_stored_certificate_count_metrics=false explicitly in tidy config. [[GH-20664](https://github.com/hashicorp/vault/pull/20664)]
-* secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
-* secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
-* serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [[GH-21642](https://github.com/hashicorp/vault/pull/21642)]
-* ui: Fixed an issue where editing an SSH role would clear `default_critical_options` and `default_extension` if left unchanged. [[GH-21739](https://github.com/hashicorp/vault/pull/21739)]
-* ui: Surface DOMException error when browser settings prevent localStorage. [[GH-21503](https://github.com/hashicorp/vault/pull/21503)]
-
-## 1.13.4
-### June 21, 2023
-BREAKING CHANGES:
+* activity: Show activity records from clients created in deleted namespaces when activity log is queried from admin namespace. [[GH-29432](https://github.com/hashicorp/vault/pull/29432)]
+* core/managed-keys (enterprise): Allow mechanism numbers above 32 bits in PKCS#11 managed keys.
+* core: Fix bug when if failing to persist the barrier keyring to track encryption counts, the number of outstanding encryptions remains added to the count, overcounting encryptions. [[GH-29506](https://github.com/hashicorp/vault/pull/29506)]
+* database: Fix a bug where static role passwords are erroneously rotated across backend restarts when using skip import rotation. [[GH-29537](https://github.com/hashicorp/vault/pull/29537)]
+* export API: Normalize the start_date parameter to the start of the month as is done in the sys/counters API to keep the results returned from both of the API's consistent. [[GH-29562](https://github.com/hashicorp/vault/pull/29562)]
+* identity/oidc (enterprise): Fix delays in rotation and invalidation of OIDC keys when there are too many namespaces.
+The Cache-Control header returned by the identity/oidc/.well-known/keys endpoint now depends only on the named keys for
+the queried namespace. [[GH-29312](https://github.com/hashicorp/vault/pull/29312)]
+* secrets-sync (enterprise): Add new parameters for destination configs to specify allowlists for IP's and ports.
+* secrets/pki: fixes issue #28749 requiring all chains to be single line of authority. [[GH-29342](https://github.com/hashicorp/vault/pull/29342)]
+* ui (enterprise): Fixes token renewal to ensure capability checks are performed in the relevant namespace, resolving 'Not authorized' errors for resources that users have permission to access. [[GH-29416](https://github.com/hashicorp/vault/pull/29416)]
+* ui/database: Fixes 'cannot update static username' error when updating static role's rotation period [[GH-29498](https://github.com/hashicorp/vault/pull/29498)]
+* ui: Fixes text overflow on Secrets engines and Auth Engines list views for long names & descriptions [[GH-29430](https://github.com/hashicorp/vault/pull/29430)]
+* ui: MFA methods now display the namespace path instead of the namespace id. [[GH-29588](https://github.com/hashicorp/vault/pull/29588)]
 
-* secrets/pki: Maintaining running count of certificates will be turned off by default.
-To re-enable keeping these metrics available on the tidy status endpoint, enable
-maintain_stored_certificate_counts on tidy-config, to also publish them to the
-metrics consumer, enable publish_stored_certificate_count_metrics . [[GH-18186](https://github.com/hashicorp/vault/pull/18186)]
+## 1.18.4
+### January 30, 2025
 
 CHANGES:
 
-* core: Bump Go version to 1.20.5.
-
-FEATURES:
-
-* **Automated License Utilization Reporting**: Added automated license
-utilization reporting, which sends minimal product-license [metering
-data](https://developer.hashicorp.com/vault/docs/enterprise/license/utilization-reporting)
-to HashiCorp without requiring you to manually collect and report them.
-* core (enterprise): Add background worker for automatic reporting of billing
-information. [[GH-19625](https://github.com/hashicorp/vault/pull/19625)]
+* auth/cf: Update plugin to v0.19.1 [[GH-29295](https://github.com/hashicorp/vault/pull/29295)]
+* sdk: Updated golang and dependency versions to be consistent across core, API, SDK to address [[GO-2024-3333](https://pkg.go.dev/vuln/GO-2024-3333)] and ensure version consistency [[GH-29422](https://github.com/hashicorp/vault/pull/29422)]
 
 IMPROVEMENTS:
 
-* api: GET ... /sys/internal/counters/activity?current_billing_period=true now
-results in a response which contains the full billing period [[GH-20694](https://github.com/hashicorp/vault/pull/20694)]
-* api: `/sys/internal/counters/config` endpoint now contains read-only
-`minimum_retention_months`. [[GH-20150](https://github.com/hashicorp/vault/pull/20150)]
-* api: `/sys/internal/counters/config` endpoint now contains read-only
-`reporting_enabled` and `billing_start_timestamp` fields. [[GH-20086](https://github.com/hashicorp/vault/pull/20086)]
-* core (enterprise): add configuration for license reporting [[GH-19891](https://github.com/hashicorp/vault/pull/19891)]
-* core (enterprise): license updates trigger a reload of reporting and the activity log [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
-* core (enterprise): support reloading configuration for automated reporting via SIGHUP [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
-* core (enterprise): vault server command now allows for opt-out of automated
-reporting via the `OPTOUT_LICENSE_REPORTING` environment variable. [[GH-3939](https://github.com/hashicorp/vault/pull/3939)]
-* core/activity: error when attempting to update retention configuration below the minimum [[GH-20078](https://github.com/hashicorp/vault/pull/20078)]
-* core/activity: refactor the activity log's generation of precomputed queries [[GH-20073](https://github.com/hashicorp/vault/pull/20073)]
-* ui: updates clients configuration edit form state based on census reporting configuration [[GH-20125](https://github.com/hashicorp/vault/pull/20125)]
-
-BUG FIXES:
-
-* agent: Fix bug with 'cache' stanza validation [[GH-20934](https://github.com/hashicorp/vault/pull/20934)]
-* core (enterprise): Don't delete backend stored data that appears to be filterable
-on this secondary if we don't have a corresponding mount entry.
-* core: Change where we evaluate filtered paths as part of mount operations; this is part of an enterprise bugfix that will
-have its own changelog entry.  Fix wrong lock used in ListAuths link meta interface implementation. [[GH-21260](https://github.com/hashicorp/vault/pull/21260)]
-* core: Do not cache seal configuration to fix a bug that resulted in sporadic auto unseal failures. [[GH-21223](https://github.com/hashicorp/vault/pull/21223)]
-* core: Don't exit just because we think there's a potential deadlock. [[GH-21342](https://github.com/hashicorp/vault/pull/21342)]
-* core: Fix panic in sealed nodes using raft storage trying to emit raft metrics [[GH-21249](https://github.com/hashicorp/vault/pull/21249)]
-* identity: Fixes duplicate groups creation with the same name but unique IDs. [[GH-20964](https://github.com/hashicorp/vault/pull/20964)]
-* replication (enterprise): Fix a race condition with update-primary that could result in data loss after a DR failover
-* replication (enterprise): Fix path filters deleting data right after it's written by backend Initialize funcs
-* replication (enterprise): Fix regression causing token creation against a role
-with a new entity alias to be incorrectly forwarded from perf standbys. [[GH-21100](https://github.com/hashicorp/vault/pull/21100)]
-* storage/raft: Fix race where new follower joining can get pruned by dead server cleanup. [[GH-20986](https://github.com/hashicorp/vault/pull/20986)]
-
-## 1.13.3
-### June 08, 2023
+* plugins (enterprise): The Database secrets engine now allows skipping the automatic rotation of static roles during import.
+* events (enterprise): Use the `path` event metadata field when authorizing a client's `subscribe` capability for consuming an event, instead of requiring `data_path` to be present in the event metadata.
+* ui: Adds navigation for LDAP hierarchical libraries [[GH-29293](https://github.com/hashicorp/vault/pull/29293)]
+* ui: Adds params to postgresql database to improve editing a connection in the web browser. [[GH-29200](https://github.com/hashicorp/vault/pull/29200)]
 
-CHANGES:
+BUG FIXES:
 
-* core: Bump Go version to 1.20.4.
-* core: Revert #19676 (VAULT_GRPC_MIN_CONNECT_TIMEOUT env var) as we decided it was unnecessary. [[GH-20826](https://github.com/hashicorp/vault/pull/20826)]
-* replication (enterprise): Add a new parameter for the update-primary API call
-that allows for setting of the primary cluster addresses directly, instead of
-via a token.
-* storage/aerospike: Aerospike storage shouldn't be used on 32-bit architectures and is now unsupported on them. [[GH-20825](https://github.com/hashicorp/vault/pull/20825)]
+* activity: Include activity records from clients created by deleted or disabled auth mounts in Export API response. [[GH-29376](https://github.com/hashicorp/vault/pull/29376)]
+* core: Prevent integer overflows of the barrier key counter on key rotation requests [[GH-29176](https://github.com/hashicorp/vault/pull/29176)]
+* database/mssql: Fix a bug where contained databases would silently fail root rotation if a custom root rotation statement was not provided. [[GH-29399](https://github.com/hashicorp/vault/pull/29399)]
+* plugins: Fix a bug that causes zombie dbus-daemon processes on certain systems. [[GH-29334](https://github.com/hashicorp/vault/pull/29334)]
+* sdk/database: Fix a bug where slow database connections can cause goroutines to be blocked. [[GH-29097](https://github.com/hashicorp/vault/pull/29097)]
+* secrets/pki: Fix a bug that prevented the full CA chain to be used when enforcing name constraints. [[GH-29255](https://github.com/hashicorp/vault/pull/29255)]
+* sentinel (enterprise): No longer report inaccurate log messages for when failing an advisory policy.
+* ui (enterprise): Fixes login to web UI when MFA is enabled for SAML auth methods [[GH-28873](https://github.com/hashicorp/vault/pull/28873)]
+* ui: Fixes login to web UI when MFA is enabled for OIDC (i.e. azure, auth0) and Okta auth methods [[GH-28873](https://github.com/hashicorp/vault/pull/28873)]
+* ui: Fixes navigation for quick actions in LDAP roles' popup menu [[GH-29293](https://github.com/hashicorp/vault/pull/29293)]
 
-IMPROVEMENTS:
 
-* Add debug symbols back to builds to fix Dynatrace support [[GH-20519](https://github.com/hashicorp/vault/pull/20519)]
-* audit: add a `mount_point` field to audit requests and response entries [[GH-20411](https://github.com/hashicorp/vault/pull/20411)]
-* autopilot: Update version to v0.2.0 to add better support for respecting min quorum [[GH-19472](https://github.com/hashicorp/vault/pull/19472)]
-* command/server: Add support for dumping pprof files to the filesystem via SIGUSR2 when
-`VAULT_PPROF_WRITE_TO_FILE=true` is set on the server. [[GH-20609](https://github.com/hashicorp/vault/pull/20609)]
-* core: Add possibility to decode a generated encoded root token via the rest API [[GH-20595](https://github.com/hashicorp/vault/pull/20595)]
-* core: include namespace path in granting_policies block of audit log
-* core: report intermediate error messages during request forwarding [[GH-20643](https://github.com/hashicorp/vault/pull/20643)]
-* openapi: Fix generated types for duration strings [[GH-20841](https://github.com/hashicorp/vault/pull/20841)]
-* sdk/framework: Fix non-deterministic ordering of 'required' fields in OpenAPI spec [[GH-20881](https://github.com/hashicorp/vault/pull/20881)]
-* secrets/pki: add subject key identifier to read key response [[GH-20642](https://github.com/hashicorp/vault/pull/20642)]
-
-BUG FIXES:
-
-* api: Properly Handle nil identity_policies in Secret Data [[GH-20636](https://github.com/hashicorp/vault/pull/20636)]
-* auth/ldap: Set default value for `max_page_size` properly [[GH-20453](https://github.com/hashicorp/vault/pull/20453)]
-* cli: CLI should take days as a unit of time for ttl like flags [[GH-20477](https://github.com/hashicorp/vault/pull/20477)]
-* cli: disable printing flags warnings messages for the ssh command [[GH-20502](https://github.com/hashicorp/vault/pull/20502)]
-* command/server: fixes panic in Vault server command when running in recovery mode [[GH-20418](https://github.com/hashicorp/vault/pull/20418)]
-* core (enterprise): Fix log shipper buffer size overflow issue for 32 bit architecture.
-* core (enterprise): Fix logshipper buffer size to default to DefaultBufferSize only when reported system memory is zero.
-* core (enterprise): Remove MFA Enforcment configuration for namespace when deleting namespace
-* core/identity: Allow updates of only the custom-metadata for entity alias. [[GH-20368](https://github.com/hashicorp/vault/pull/20368)]
-* core: Fix Forwarded Writer construction to correctly find active nodes, allowing PKI cross-cluster functionality to succeed on existing mounts.
-* core: Fix writes to readonly storage on performance standbys when user lockout feature is enabled. [[GH-20783](https://github.com/hashicorp/vault/pull/20783)]
-* core: prevent panic on login after namespace is deleted that had mfa enforcement [[GH-20375](https://github.com/hashicorp/vault/pull/20375)]
-* replication (enterprise): Fix a race condition with invalid tokens during WAL streaming that was causing Secondary clusters to be unable to connect to a Primary.
-* replication (enterprise): fix bug where secondary grpc connections would timeout when connecting to a primary host that no longer exists.
-* secrets/pki: Include per-issuer enable_aia_url_templating in issuer read endpoint. [[GH-20354](https://github.com/hashicorp/vault/pull/20354)]
-* secrets/transform (enterprise): Fix a caching bug affecting secondary nodes after a tokenization key rotation
-* secrets/transform: Added importing of keys and key versions into the Transform secrets engine using the command 'vault transform import' and 'vault transform import-version'. [[GH-20668](https://github.com/hashicorp/vault/pull/20668)]
-* secrets/transit: Fix export of HMAC-only key, correctly exporting the key used for sign operations. For consumers of the previously incorrect key, use the plaintext export to retrieve these incorrect keys and import them as new versions.
-secrets/transit: Fix bug related to shorter dedicated HMAC key sizing.
-sdk/helper/keysutil: New HMAC type policies will have HMACKey equal to Key and be copied over on import. [[GH-20864](https://github.com/hashicorp/vault/pull/20864)]
-* ui: Fixes issue unsealing cluster for seal types other than shamir [[GH-20897](https://github.com/hashicorp/vault/pull/20897)]
-* ui: fixes issue creating mfa login enforcement from method enforcements tab [[GH-20603](https://github.com/hashicorp/vault/pull/20603)]
-* ui: fixes key_bits and signature_bits reverting to default values when editing a pki role [[GH-20907](https://github.com/hashicorp/vault/pull/20907)]
-
-## 1.13.2
-### April 26, 2023
+## 1.18.3
+### December 18, 2024
 
 CHANGES:
 
-* core: Bump Go version to 1.20.3.
-
-SECURITY:
-
-* core/seal: Fix handling of HMACing of seal-wrapped storage entries from HSMs using CKM_AES_CBC or CKM_AES_CBC_PAD which may have allowed an attacker to conduct a padding oracle attack. This vulnerability, CVE-2023-2197, affects Vault from 1.13.0 up to 1.13.1 and was fixed in 1.13.2. [[HCSEC-2023-14](https://discuss.hashicorp.com/t/hcsec-2023-14-vault-enterprise-vulnerable-to-padding-oracle-attacks-when-using-a-cbc-based-encryption-mechanism-with-a-hsm/53322)]
+* secrets/openldap: Update plugin to v0.14.4 [[GH-29131](https://github.com/hashicorp/vault/pull/29131)]
+* secrets/pki: Enforce the issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates. For more information see [PKI considerations](https://developer.hashicorp.com/vault/docs/secrets/pki/considerations#issuer-constraints-enforcement) [[GH-29045](https://github.com/hashicorp/vault/pull/29045)]
 
 IMPROVEMENTS:
 
-* Add debug symbols back to builds to fix Dynatrace support [[GH-20294](https://github.com/hashicorp/vault/pull/20294)]
-* cli/namespace: Add detailed flag to output additional namespace information
-such as namespace IDs and custom metadata. [[GH-20243](https://github.com/hashicorp/vault/pull/20243)]
-* core/activity: add an endpoint to write test activity log data, guarded by a build flag [[GH-20019](https://github.com/hashicorp/vault/pull/20019)]
-* core: Add a `raft` sub-field to the `storage` and `ha_storage` details provided by the
-`/sys/config/state/sanitized` endpoint in order to include the `max_entry_size`. [[GH-20044](https://github.com/hashicorp/vault/pull/20044)]
-* core: include reason for ErrReadOnly on PBPWF writing failures
-* sdk/ldaputil: added `connection_timeout` to tune connection timeout duration
-for all LDAP plugins. [[GH-20144](https://github.com/hashicorp/vault/pull/20144)]
-* secrets/pki: Decrease size and improve compatibility of OCSP responses by removing issuer certificate. [[GH-20201](https://github.com/hashicorp/vault/pull/20201)]
-* sys/wrapping: Add example how to unwrap without authentication in Vault [[GH-20109](https://github.com/hashicorp/vault/pull/20109)]
-* ui: Allows license-banners to be dismissed. Saves preferences in localStorage. [[GH-19116](https://github.com/hashicorp/vault/pull/19116)]
-
-BUG FIXES:
-
-* auth/ldap: Add max_page_size configurable to LDAP configuration [[GH-19032](https://github.com/hashicorp/vault/pull/19032)]
-* command/server: Fix incorrect paths in generated config for `-dev-tls` flag on Windows [[GH-20257](https://github.com/hashicorp/vault/pull/20257)]
-* core (enterprise): Fix intermittent issue with token entries sometimes not being found when using a newly created token in a request to a secondary, even when SSCT `new_token` forwarding is set. When this occurred, this would result in the following error to the client: `error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue`.
-* core (enterprise): Fix read on perf standbys failing with 412 after leadership change, unseal, restores or restarts when no writes occur
-* core/ssct (enterprise): Fixed race condition where a newly promoted DR may revert `sscGenCounter`
-resulting in 412 errors.
-* core: Fix regression breaking non-raft clusters whose nodes share the same cluster_addr/api_addr. [[GH-19721](https://github.com/hashicorp/vault/pull/19721)]
-* helper/random: Fix race condition in string generator helper [[GH-19875](https://github.com/hashicorp/vault/pull/19875)]
-* kmip (enterprise): Fix a problem decrypting with keys that have no Process Start Date attribute.
-* pki: Fix automatically turning off CRL signing on upgrade to Vault >= 1.12, if CA Key Usage disallows it [[GH-20220](https://github.com/hashicorp/vault/pull/20220)]
-* replication (enterprise): Fix a caching issue when replicating filtered data to
-a performance secondary. This resulted in the data being set to nil in the cache
-and a "invalid value" error being returned from the API.
-* replication (enterprise): Fix replication status for Primary clusters showing its primary cluster's information (in case of DR) in secondaries field when known_secondaries field is nil
-* sdk/helper/ocsp: Workaround bug in Go's ocsp.ParseResponse(...), causing validation to fail with embedded CA certificates.
-auth/cert: Fix OCSP validation against Vault's PKI engine. [[GH-20181](https://github.com/hashicorp/vault/pull/20181)]
-* secrets/aws: Revert changes that removed the lease on STS credentials, while leaving the new ttl field in place. [[GH-20034](https://github.com/hashicorp/vault/pull/20034)]
-* secrets/pki: Ensure cross-cluster delta WAL write failure only logs to avoid unattended forwarding. [[GH-20057](https://github.com/hashicorp/vault/pull/20057)]
-* secrets/pki: Fix building of unified delta CRLs and recovery during unified delta WAL write failures. [[GH-20058](https://github.com/hashicorp/vault/pull/20058)]
-* secrets/pki: Fix patching of leaf_not_after_behavior on issuers. [[GH-20341](https://github.com/hashicorp/vault/pull/20341)]
-* secrets/transform (enterprise): Address SQL connection leak when cleaning expired tokens
-* ui: Fix OIDC provider logo showing when domain doesn't match [[GH-20263](https://github.com/hashicorp/vault/pull/20263)]
-* ui: Fix bad link to namespace when namespace name includes `.` [[GH-19799](https://github.com/hashicorp/vault/pull/19799)]
-* ui: fixes browser console formatting for help command output [[GH-20064](https://github.com/hashicorp/vault/pull/20064)]
-* ui: fixes remaining doc links to include /vault in path [[GH-20070](https://github.com/hashicorp/vault/pull/20070)]
-* ui: remove use of htmlSafe except when first sanitized [[GH-20235](https://github.com/hashicorp/vault/pull/20235)]
-* website/docs: Fix Kubernetes Auth Code Example to use the correct whitespace in import. [[GH-20216](https://github.com/hashicorp/vault/pull/20216)]
-
-## 1.13.1
-### March 29, 2023
-
-SECURITY:
+* auth/okta: update to okta sdk v5 from v2. Transitively updates go-jose dependency to >=3.0.3 to resolve GO-2024-2631. See https://github.com/okta/okta-sdk-golang/blob/master/MIGRATING.md for details on changes. [[GH-28121](https://github.com/hashicorp/vault/pull/28121)]
+* core: Added new `enable_post_unseal_trace` and `post_unseal_trace_directory` config options to generate Go traces during the post-unseal step for debug purposes. [[GH-28895](https://github.com/hashicorp/vault/pull/28895)]
+* sdk: Add Vault build date to system view plugin environment response [[GH-29082](https://github.com/hashicorp/vault/pull/29082)]
+* ui: Replace KVv2 json secret details view with Hds::CodeBlock component allowing users to search the full secret height. [[GH-28808](https://github.com/hashicorp/vault/pull/28808)]
 
-* storage/mssql: When using Vault’s community-supported Microsoft SQL (MSSQL) database storage backend, a privileged attacker with the ability to write arbitrary data to Vault’s configuration may be able to perform arbitrary SQL commands on the underlying database server through Vault. This vulnerability, CVE-2023-0620, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-12](https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080)]
-* secrets/pki: Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. This vulnerability, CVE-2023-0665, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-11](https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079)]
-* core: HashiCorp Vault’s implementation of Shamir’s secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. This vulnerability, CVE-2023-25000, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-10](https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078)]
+BUG FIXES:
 
-IMPROVEMENTS:
+* autosnapshots (enterprise): Fix an issue where snapshot size metrics were not reported for cloud-based storage.
+* core/metrics: Fix unlocked mounts read for usage reporting. [[GH-29091](https://github.com/hashicorp/vault/pull/29091)]
+* core/seal (enterprise): Fix problem with nodes unable to join Raft clusters with Seal High Availability enabled. [[GH-29117](https://github.com/hashicorp/vault/pull/29117)]
+* core: fix bug in seal unwrapper that caused high storage latency in Vault CE. For every storage read request, the
+seal unwrapper was performing the read twice, and would also issue an unnecessary storage write. [[GH-29050](https://github.com/hashicorp/vault/pull/29050)]
+* secret/db: Update static role rotation to generate a new password after 2 failed attempts. [[GH-28989](https://github.com/hashicorp/vault/pull/28989)]
+* ui: Allow users to search the full json object within the json code-editor edit/create view. [[GH-28808](https://github.com/hashicorp/vault/pull/28808)]
+* ui: Decode `connection_url` to fix database connection updates (i.e. editing connection config, deleting roles) failing when urls include template variables. [[GH-29114](https://github.com/hashicorp/vault/pull/29114)]
+* ui: Fix Swagger explorer bug where requests with path params were not working. [[GH-28670](https://github.com/hashicorp/vault/issues/28670)]
+* vault/diagnose: Fix time to expiration reporting within the TLS verification to not be a month off. [[GH-29128](https://github.com/hashicorp/vault/pull/29128)]
 
-* auth/github: Allow for an optional Github auth token environment variable to make authenticated requests when fetching org id
-website/docs: Add docs for `VAULT_AUTH_CONFIG_GITHUB_TOKEN` environment variable when writing Github config [[GH-19244](https://github.com/hashicorp/vault/pull/19244)]
-* core: Allow overriding gRPC connect timeout via VAULT_GRPC_MIN_CONNECT_TIMEOUT. This is an env var rather than a config setting because we don't expect this to ever be needed.  It's being added as a last-ditch
-option in case all else fails for some replication issues we may not have fully reproduced. [[GH-19676](https://github.com/hashicorp/vault/pull/19676)]
-* core: validate name identifiers in mssql physical storage backend prior use [[GH-19591](https://github.com/hashicorp/vault/pull/19591)]
-* database/elasticsearch: Update error messages resulting from Elasticsearch API errors [[GH-19545](https://github.com/hashicorp/vault/pull/19545)]
-* events: Suppress log warnings triggered when events are sent but the events system is not enabled. [[GH-19593](https://github.com/hashicorp/vault/pull/19593)]
-
-BUG FIXES:
-
-* agent: Fix panic when SIGHUP is issued to Agent while it has a non-TLS listener. [[GH-19483](https://github.com/hashicorp/vault/pull/19483)]
-* core (enterprise): Attempt to reconnect to a PKCS#11 HSM if we retrieve a CKR_FUNCTION_FAILED error.
-* core: Fixed issue with remounting mounts that have a non-trailing space in the 'to' or 'from' paths. [[GH-19585](https://github.com/hashicorp/vault/pull/19585)]
-* kmip (enterprise): Do not require attribute Cryptographic Usage Mask when registering Secret Data managed objects.
-* kmip (enterprise): Fix a problem forwarding some requests to the active node.
-* openapi: Fix logic for labeling unauthenticated/sudo paths. [[GH-19600](https://github.com/hashicorp/vault/pull/19600)]
-* secrets/ldap: Invalidates WAL entry for static role if `password_policy` has changed. [[GH-19640](https://github.com/hashicorp/vault/pull/19640)]
-* secrets/pki: Fix PKI revocation request forwarding from standby nodes due to an error wrapping bug [[GH-19624](https://github.com/hashicorp/vault/pull/19624)]
-* secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
-* ui: Fixes crypto.randomUUID error in unsecure contexts from third party ember-data library [[GH-19428](https://github.com/hashicorp/vault/pull/19428)]
-* ui: fixes SSH engine config deletion [[GH-19448](https://github.com/hashicorp/vault/pull/19448)]
-* ui: fixes issue navigating back a level using the breadcrumb from secret metadata view [[GH-19703](https://github.com/hashicorp/vault/pull/19703)]
-* ui: fixes oidc tabs in auth form submitting with the root's default_role value after a namespace has been inputted [[GH-19541](https://github.com/hashicorp/vault/pull/19541)]
-* ui: pass encodeBase64 param to HMAC transit-key-actions. [[GH-19429](https://github.com/hashicorp/vault/pull/19429)]
-* ui: use URLSearchParams interface to capture namespace param from SSOs (ex. ADFS) with decoded state param in callback url [[GH-19460](https://github.com/hashicorp/vault/pull/19460)]
-
-## 1.13.0
-### March 01, 2023
+## 1.18.2
+### November 21, 2024
 
 SECURITY:
 
-* secrets/ssh: removal of the deprecated dynamic keys mode. **When any remaining dynamic key leases expire**, an error stating `secret is unsupported by this backend` will be thrown by the lease manager. [[GH-18874](https://github.com/hashicorp/vault/pull/18874)]
-* auth/approle: When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999 has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above. [[HSEC-2023-07](https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305)]
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241115202008-166203013d8e
 
 CHANGES:
 
-* auth/alicloud: require the `role` field on login [[GH-19005](https://github.com/hashicorp/vault/pull/19005)]
-* auth/approle: Add maximum length of 4096 for approle role_names, as this value results in HMAC calculation [[GH-17768](https://github.com/hashicorp/vault/pull/17768)]
-* auth: Returns invalid credentials for ldap, userpass and approle when wrong credentials are provided for existent users.
-This will only be used internally for implementing user lockout. [[GH-17104](https://github.com/hashicorp/vault/pull/17104)]
-* core: Bump Go version to 1.20.1.
-* core: Vault version has been moved out of sdk and into main vault module.
-Plugins using sdk/useragent.String must instead use sdk/useragent.PluginString. [[GH-14229](https://github.com/hashicorp/vault/pull/14229)]
-* logging: Removed legacy environment variable for log format ('LOGXI_FORMAT'), should use 'VAULT_LOG_FORMAT' instead [[GH-17822](https://github.com/hashicorp/vault/pull/17822)]
-* plugins: Mounts can no longer be pinned to a specific _builtin_ version. Mounts previously pinned to a specific builtin version will now automatically upgrade to the latest builtin version, and may now be overridden if an unversioned plugin of the same name and type is registered. Mounts using plugin versions without `builtin` in their metadata remain unaffected. [[GH-18051](https://github.com/hashicorp/vault/pull/18051)]
-* plugins: `GET /database/config/:name` endpoint now returns an additional `plugin_version` field in the response data. [[GH-16982](https://github.com/hashicorp/vault/pull/16982)]
-* plugins: `GET /sys/auth/:path/tune` and `GET /sys/mounts/:path/tune` endpoints may now return an additional `plugin_version` field in the response data if set. [[GH-17167](https://github.com/hashicorp/vault/pull/17167)]
-* plugins: `GET` for `/sys/auth`, `/sys/auth/:path`, `/sys/mounts`, and `/sys/mounts/:path` paths now return additional `plugin_version`, `running_plugin_version` and `running_sha256` fields in the response data for each mount. [[GH-17167](https://github.com/hashicorp/vault/pull/17167)]
-* sdk: Remove version package, make useragent.String versionless. [[GH-19068](https://github.com/hashicorp/vault/pull/19068)]
-* secrets/aws: do not create leases for non-renewable/non-revocable STS credentials to reduce storage calls [[GH-15869](https://github.com/hashicorp/vault/pull/15869)]
-* secrets/gcpkms: Updated plugin from v0.13.0 to v0.14.0 [[GH-19063](https://github.com/hashicorp/vault/pull/19063)]
-* sys/internal/inspect: Turns of this endpoint by default. A SIGHUP can now be used to reload the configs and turns this endpoint on.
-* ui: Upgrade Ember to version 4.4.0 [[GH-17086](https://github.com/hashicorp/vault/pull/17086)]
+* auth/azure: Update plugin to v0.19.2 [[GH-28848](https://github.com/hashicorp/vault/pull/28848)]
+* core/ha (enterprise): Failed attempts to become a performance standby node are now using an exponential backoff instead of a
+10 second delay in between retries. The backoff starts at 2s and increases by a factor of two until reaching
+the maximum of 16s. This should make unsealing of the node faster in some cases.
+* login (enterprise): Return a 500 error during logins when performance standby nodes make failed gRPC requests to the active node. [[GH-28807](https://github.com/hashicorp/vault/pull/28807)]
 
 FEATURES:
 
-* **User lockout**: Ignore repeated bad credentials from the same user for a configured period of time. Enabled by default.
-* **Azure Auth Managed Identities**: Allow any Azure resource that supports managed identities to authenticate with Vault [[GH-19077](https://github.com/hashicorp/vault/pull/19077)]
-* **Azure Auth Rotate Root**: Add support for rotate root in Azure Auth engine [[GH-19077](https://github.com/hashicorp/vault/pull/19077)]
-* **Event System (Alpha)**: Vault has a new opt-in experimental event system. Not yet suitable for production use. Events are currently only generated on writes to the KV secrets engine, but external plugins can also be updated to start generating events. [[GH-19194](https://github.com/hashicorp/vault/pull/19194)]
-* **GCP Secrets Impersonated Account Support**: Add support for GCP service account impersonation, allowing callers to generate a GCP access token without requiring Vault to store or retrieve a GCP service account key for each role. [[GH-19018](https://github.com/hashicorp/vault/pull/19018)]
-* **Kubernetes Secrets Engine UI**: Kubernetes is now available in the UI as a supported secrets engine. [[GH-17893](https://github.com/hashicorp/vault/pull/17893)]
-* **New PKI UI**: Add beta support for new and improved PKI UI [[GH-18842](https://github.com/hashicorp/vault/pull/18842)]
-* **PKI Cross-Cluster Revocations**: Revocation information can now be
-synchronized across primary and performance replica clusters offering
-a unified CRL/OCSP view of revocations across cluster boundaries. [[GH-19196](https://github.com/hashicorp/vault/pull/19196)]
-* **Server UDS Listener**: Adding listener to Vault server to serve http request via unix domain socket [[GH-18227](https://github.com/hashicorp/vault/pull/18227)]
-* **Transit managed keys**: The transit secrets engine now supports configuring and using managed keys
-* **User Lockout**: Adds support to configure the user-lockout behaviour for failed logins to prevent
-brute force attacks for userpass, approle and ldap auth methods. [[GH-19230](https://github.com/hashicorp/vault/pull/19230)]
-* **VMSS Flex Authentication**: Adds support for Virtual Machine Scale Set Flex Authentication [[GH-19077](https://github.com/hashicorp/vault/pull/19077)]
-* **Namespaces (enterprise)**: Added the ability to allow access to secrets and more to be shared across namespaces that do not share a namespace hierarchy. Using the new `sys/config/group-policy-application` API, policies can be configured to apply outside of namespace hierarchy, allowing this kind of cross-namespace sharing.
-* **OpenAPI-based Go & .NET Client Libraries (Beta)**: We have now made available two new [[OpenAPI-based Go](https://github.com/hashicorp/vault-client-go/)] & [[OpenAPI-based .NET](https://github.com/hashicorp/vault-client-dotnet/)] Client libraries (beta). You can use them to perform various secret management operations easily from your applications.
-
-IMPROVEMENTS:
-
-* **Redis ElastiCache DB Engine**: Renamed configuration parameters for disambiguation; old parameters still supported for compatibility. [[GH-18752](https://github.com/hashicorp/vault/pull/18752)]
-* Bump github.com/hashicorp/go-plugin version from 1.4.5 to 1.4.8 [[GH-19100](https://github.com/hashicorp/vault/pull/19100)]
-* Reduced binary size [[GH-17678](https://github.com/hashicorp/vault/pull/17678)]
-* agent/config: Allow config directories to be specified with -config, and allow multiple -configs to be supplied. [[GH-18403](https://github.com/hashicorp/vault/pull/18403)]
-* agent: Add note in logs when starting Vault Agent indicating if the version differs to the Vault Server. [[GH-18684](https://github.com/hashicorp/vault/pull/18684)]
-* agent: Added `token_file` auto-auth configuration to allow using a pre-existing token for Vault Agent. [[GH-18740](https://github.com/hashicorp/vault/pull/18740)]
-* agent: Agent listeners can now be to be the `metrics_only` role, serving only metrics, as part of the listener's new top level `role` option. [[GH-18101](https://github.com/hashicorp/vault/pull/18101)]
-* agent: Configured Vault Agent listeners now listen without the need for caching to be configured. [[GH-18137](https://github.com/hashicorp/vault/pull/18137)]
-* agent: allows some parts of config to be reloaded without requiring a restart. [[GH-18638](https://github.com/hashicorp/vault/pull/18638)]
-* agent: fix incorrectly used loop variables in parallel tests and when finalizing seals [[GH-16872](https://github.com/hashicorp/vault/pull/16872)]
-* api: Remove dependency on sdk module. [[GH-18962](https://github.com/hashicorp/vault/pull/18962)]
-* api: Support VAULT_DISABLE_REDIRECTS environment variable (and --disable-redirects flag) to disable default client behavior and prevent the client following any redirection responses. [[GH-17352](https://github.com/hashicorp/vault/pull/17352)]
-* audit: Add `elide_list_responses` option, providing a countermeasure for a common source of oversized audit log entries [[GH-18128](https://github.com/hashicorp/vault/pull/18128)]
-* audit: Include stack trace when audit logging recovers from a panic. [[GH-18121](https://github.com/hashicorp/vault/pull/18121)]
-* auth/alicloud: upgrades dependencies [[GH-18021](https://github.com/hashicorp/vault/pull/18021)]
-* auth/azure: Adds support for authentication with Managed Service Identity (MSI) from a
-Virtual Machine Scale Set (VMSS) in flexible orchestration mode. [[GH-17540](https://github.com/hashicorp/vault/pull/17540)]
-* auth/azure: upgrades dependencies [[GH-17857](https://github.com/hashicorp/vault/pull/17857)]
-* auth/cert: Add configurable support for validating client certs with OCSP. [[GH-17093](https://github.com/hashicorp/vault/pull/17093)]
-* auth/cert: Support listing provisioned CRLs within the mount. [[GH-18043](https://github.com/hashicorp/vault/pull/18043)]
-* auth/cf: Remove incorrect usage of CreateOperation from path_config [[GH-19098](https://github.com/hashicorp/vault/pull/19098)]
-* auth/gcp: Upgrades dependencies [[GH-17858](https://github.com/hashicorp/vault/pull/17858)]
-* auth/oidc: Adds `abort_on_error` parameter to CLI login command to help in non-interactive contexts [[GH-19076](https://github.com/hashicorp/vault/pull/19076)]
-* auth/oidc: Adds ability to set Google Workspace domain for groups search [[GH-19076](https://github.com/hashicorp/vault/pull/19076)]
-* auth/token (enterprise): Allow batch token creation in perfStandby nodes
-* auth: Allow naming login MFA methods and using those names instead of IDs in satisfying MFA requirement for requests.
-Make passcode arguments consistent across login MFA method types. [[GH-18610](https://github.com/hashicorp/vault/pull/18610)]
-* auth: Provide an IP address of the requests from Vault to a Duo challenge after successful authentication. [[GH-18811](https://github.com/hashicorp/vault/pull/18811)]
-* autopilot: Update version to v.0.2.0 to add better support for respecting min quorum
-* cli/kv: improve kv CLI to remove data or custom metadata using kv patch [[GH-18067](https://github.com/hashicorp/vault/pull/18067)]
-* cli/pki: Add List-Intermediates functionality to pki client. [[GH-18463](https://github.com/hashicorp/vault/pull/18463)]
-* cli/pki: Add health-check subcommand to evaluate the health of a PKI instance. [[GH-17750](https://github.com/hashicorp/vault/pull/17750)]
-* cli/pki: Add pki issue command, which creates a CSR, has a vault mount sign it, then reimports it. [[GH-18467](https://github.com/hashicorp/vault/pull/18467)]
-* cli/pki: Added "Reissue" command which allows extracting fields from an existing certificate to create a new certificate. [[GH-18499](https://github.com/hashicorp/vault/pull/18499)]
-* cli/pki: Change the pki health-check --list default config output to JSON so it's a usable configuration file [[GH-19269](https://github.com/hashicorp/vault/pull/19269)]
-* cli: Add support for creating requests to existing non-KVv2 PATCH-capable endpoints. [[GH-17650](https://github.com/hashicorp/vault/pull/17650)]
-* cli: Add transit import key helper commands for BYOK to Transit/Transform. [[GH-18887](https://github.com/hashicorp/vault/pull/18887)]
-* cli: Support the -format=raw option, to read non-JSON Vault endpoints and original response bodies. [[GH-14945](https://github.com/hashicorp/vault/pull/14945)]
-* cli: updated `vault operator rekey` prompts to describe recovery keys when `-target=recovery` [[GH-18892](https://github.com/hashicorp/vault/pull/18892)]
-* client/pki: Add a new command verify-sign which checks the relationship between two certificates. [[GH-18437](https://github.com/hashicorp/vault/pull/18437)]
-* command/server: Environment variable keys are now logged at startup. [[GH-18125](https://github.com/hashicorp/vault/pull/18125)]
-* core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
-* core/identity: Add machine-readable output to body of response upon alias clash during entity merge [[GH-17459](https://github.com/hashicorp/vault/pull/17459)]
-* core/server: Added an environment variable to write goroutine stacktraces to a
-temporary file for SIGUSR2 signals. [[GH-17929](https://github.com/hashicorp/vault/pull/17929)]
-* core: Add RPCs to read and update userFailedLoginInfo map
-* core: Add experiments system and `events.alpha1` experiment. [[GH-18682](https://github.com/hashicorp/vault/pull/18682)]
-* core: Add read support to `sys/loggers` and `sys/loggers/:name` endpoints [[GH-17979](https://github.com/hashicorp/vault/pull/17979)]
-* core: Add user lockout field to config and configuring this for auth mount using auth tune to prevent brute forcing in auth methods [[GH-17338](https://github.com/hashicorp/vault/pull/17338)]
-* core: Add vault.core.locked_users telemetry metric to emit information about total number of locked users. [[GH-18718](https://github.com/hashicorp/vault/pull/18718)]
-* core: Added sys/locked-users endpoint to list locked users. Changed api endpoint from
-sys/lockedusers/[mount_accessor]/unlock/[alias_identifier] to sys/locked-users/[mount_accessor]/unlock/[alias_identifier]. [[GH-18675](https://github.com/hashicorp/vault/pull/18675)]
-* core: Added sys/lockedusers/[mount_accessor]/unlock/[alias_identifier] endpoint to unlock an user
-with given mount_accessor and alias_identifier if locked [[GH-18279](https://github.com/hashicorp/vault/pull/18279)]
-* core: Added warning to /sys/seal-status and vault status command if potentially dangerous behaviour overrides are being used. [[GH-17855](https://github.com/hashicorp/vault/pull/17855)]
-* core: Implemented background thread to update locked user entries every 15 minutes to prevent brute forcing in auth methods. [[GH-18673](https://github.com/hashicorp/vault/pull/18673)]
-* core: License location is no longer cache exempt, meaning sys/health will not contribute as greatly to storage load when using consul as a storage backend. [[GH-17265](https://github.com/hashicorp/vault/pull/17265)]
-* core: Update protoc from 3.21.5 to 3.21.7 [[GH-17499](https://github.com/hashicorp/vault/pull/17499)]
-* core: add `detect_deadlocks` config to optionally detect core state deadlocks [[GH-18604](https://github.com/hashicorp/vault/pull/18604)]
-* core: added changes for user lockout workflow. [[GH-17951](https://github.com/hashicorp/vault/pull/17951)]
-* core: parallelize backend initialization to improve startup time for large numbers of mounts. [[GH-18244](https://github.com/hashicorp/vault/pull/18244)]
-* database/postgres: Support multiline strings for revocation statements. [[GH-18632](https://github.com/hashicorp/vault/pull/18632)]
-* database/redis-elasticache: changed config argument names for disambiguation [[GH-19044](https://github.com/hashicorp/vault/pull/19044)]
-* database/snowflake: Allow parallel requests to Snowflake [[GH-17593](https://github.com/hashicorp/vault/pull/17593)]
-* hcp/connectivity: Add foundational OSS support for opt-in secure communication between self-managed Vault nodes and [HashiCorp Cloud Platform](https://cloud.hashicorp.com) [[GH-18228](https://github.com/hashicorp/vault/pull/18228)]
-* hcp/connectivity: Include HCP organization, project, and resource ID in server startup logs [[GH-18315](https://github.com/hashicorp/vault/pull/18315)]
-* hcp/connectivity: Only update SCADA session metadata if status changes [[GH-18585](https://github.com/hashicorp/vault/pull/18585)]
-* hcp/status: Add cluster-level status information [[GH-18351](https://github.com/hashicorp/vault/pull/18351)]
-* hcp/status: Expand node-level status information [[GH-18302](https://github.com/hashicorp/vault/pull/18302)]
-* logging: Vault Agent supports logging to a specified file path via environment variable, CLI or config [[GH-17841](https://github.com/hashicorp/vault/pull/17841)]
-* logging: Vault agent and server commands support log file and log rotation. [[GH-18031](https://github.com/hashicorp/vault/pull/18031)]
-* migration: allow parallelization of key migration for `vault operator migrate` in order to speed up a migration. [[GH-18817](https://github.com/hashicorp/vault/pull/18817)]
-* namespaces (enterprise): Add new API, `sys/config/group-policy-application`, to allow group policies to be configurable
-to apply to a group in `any` namespace. The default, `within_namespace_hierarchy`, is the current behaviour.
-* openapi: Add default values to thing_mount_path parameters [[GH-18935](https://github.com/hashicorp/vault/pull/18935)]
-* openapi: Add logic to generate openapi response structures [[GH-18192](https://github.com/hashicorp/vault/pull/18192)]
-* openapi: Add openapi response definitions to approle/path_login.go & approle/path_tidy_user_id.go [[GH-18772](https://github.com/hashicorp/vault/pull/18772)]
-* openapi: Add openapi response definitions to approle/path_role.go [[GH-18198](https://github.com/hashicorp/vault/pull/18198)]
-* openapi: Change gen_openapi.sh to generate schema with generic mount paths [[GH-18934](https://github.com/hashicorp/vault/pull/18934)]
-* openapi: Mark request body objects as required [[GH-17909](https://github.com/hashicorp/vault/pull/17909)]
-* openapi: add openapi response defintions to /sys/audit endpoints [[GH-18456](https://github.com/hashicorp/vault/pull/18456)]
-* openapi: generic_mount_paths: Move implementation fully into server, rather than partially in plugin framework; recognize all 4 singleton mounts (auth/token, cubbyhole, identity, system) rather than just 2; change parameter from `{mountPath}` to `{<type>_mount_path}` [[GH-18663](https://github.com/hashicorp/vault/pull/18663)]
-* plugins: Add plugin version information to key plugin lifecycle log lines. [[GH-17430](https://github.com/hashicorp/vault/pull/17430)]
-* plugins: Allow selecting builtin plugins by their reported semantic version of the form `vX.Y.Z+builtin` or `vX.Y.Z+builtin.vault`. [[GH-17289](https://github.com/hashicorp/vault/pull/17289)]
-* plugins: Let Vault unseal and mount deprecated builtin plugins in a
-deactivated state if this is not the first unseal after an upgrade. [[GH-17879](https://github.com/hashicorp/vault/pull/17879)]
-* plugins: Mark app-id auth method Removed and remove the plugin code. [[GH-18039](https://github.com/hashicorp/vault/pull/18039)]
-* plugins: Mark logical database plugins Removed and remove the plugin code. [[GH-18039](https://github.com/hashicorp/vault/pull/18039)]
-* sdk/ldap: Added support for paging when searching for groups using group filters [[GH-17640](https://github.com/hashicorp/vault/pull/17640)]
-* sdk: Add response schema validation method framework/FieldData.ValidateStrict and two test helpers (ValidateResponse, ValidateResponseData) [[GH-18635](https://github.com/hashicorp/vault/pull/18635)]
-* sdk: Adding FindResponseSchema test helper to assist with response schema validation in tests [[GH-18636](https://github.com/hashicorp/vault/pull/18636)]
-* secrets/aws: Update dependencies [[PR-17747](https://github.com/hashicorp/vault/pull/17747)] [[GH-17747](https://github.com/hashicorp/vault/pull/17747)]
-* secrets/azure: Adds ability to persist an application for the lifetime of a role. [[GH-19096](https://github.com/hashicorp/vault/pull/19096)]
-* secrets/azure: upgrades dependencies [[GH-17964](https://github.com/hashicorp/vault/pull/17964)]
-* secrets/db/mysql: Add `tls_server_name` and `tls_skip_verify` parameters [[GH-18799](https://github.com/hashicorp/vault/pull/18799)]
-* secrets/gcp: Upgrades dependencies [[GH-17871](https://github.com/hashicorp/vault/pull/17871)]
-* secrets/kubernetes: Add /check endpoint to determine if environment variables are set [[GH-18](https://github.com/hashicorp/vault-plugin-secrets-kubernetes/pull/18)] [[GH-18587](https://github.com/hashicorp/vault/pull/18587)]
-* secrets/kubernetes: add /check endpoint to determine if environment variables are set [[GH-19084](https://github.com/hashicorp/vault/pull/19084)]
-* secrets/kv: Emit events on write if events system enabled [[GH-19145](https://github.com/hashicorp/vault/pull/19145)]
-* secrets/kv: make upgrade synchronous when no keys to upgrade [[GH-19056](https://github.com/hashicorp/vault/pull/19056)]
-* secrets/kv: new KVv2 mounts and KVv1 mounts without any keys will upgrade synchronously, allowing for instant use [[GH-17406](https://github.com/hashicorp/vault/pull/17406)]
-* secrets/pki: Add a new API that returns the serial numbers of revoked certificates on the local cluster [[GH-17779](https://github.com/hashicorp/vault/pull/17779)]
-* secrets/pki: Add support to specify signature bits when generating CSRs through intermediate/generate apis [[GH-17388](https://github.com/hashicorp/vault/pull/17388)]
-* secrets/pki: Added a new API that allows external actors to craft a CRL through JSON parameters [[GH-18040](https://github.com/hashicorp/vault/pull/18040)]
-* secrets/pki: Allow UserID Field (https://www.rfc-editor.org/rfc/rfc1274#section-9.3.1) to be set on Certificates when
-allowed by role [[GH-18397](https://github.com/hashicorp/vault/pull/18397)]
-* secrets/pki: Allow issuer creation, import to change default issuer via `default_follows_latest_issuer`. [[GH-17824](https://github.com/hashicorp/vault/pull/17824)]
-* secrets/pki: Allow templating performance replication cluster- and issuer-specific AIA URLs. [[GH-18199](https://github.com/hashicorp/vault/pull/18199)]
-* secrets/pki: Allow tidying of expired issuer certificates. [[GH-17823](https://github.com/hashicorp/vault/pull/17823)]
-* secrets/pki: Allow tidying of the legacy ca_bundle, improving startup on post-migrated, seal-wrapped PKI mounts. [[GH-18645](https://github.com/hashicorp/vault/pull/18645)]
-* secrets/pki: Respond with written data to `config/auto-tidy`, `config/crl`, and `roles/:role`. [[GH-18222](https://github.com/hashicorp/vault/pull/18222)]
-* secrets/pki: Return issuer_id and issuer_name on /issuer/:issuer_ref/json endpoint. [[GH-18482](https://github.com/hashicorp/vault/pull/18482)]
-* secrets/pki: Return new fields revocation_time_rfc3339 and issuer_id to existing certificate serial lookup api if it is revoked [[GH-17774](https://github.com/hashicorp/vault/pull/17774)]
-* secrets/ssh: Allow removing SSH host keys from the dynamic keys feature. [[GH-18939](https://github.com/hashicorp/vault/pull/18939)]
-* secrets/ssh: Evaluate ssh validprincipals user template before splitting [[GH-16622](https://github.com/hashicorp/vault/pull/16622)]
-* secrets/transit: Add an optional reference field to batch operation items
-which is repeated on batch responses to help more easily correlate inputs with outputs. [[GH-18243](https://github.com/hashicorp/vault/pull/18243)]
-* secrets/transit: Add associated_data parameter for additional authenticated data in AEAD ciphers [[GH-17638](https://github.com/hashicorp/vault/pull/17638)]
-* secrets/transit: Add support for PKCSv1_5_NoOID RSA signatures [[GH-17636](https://github.com/hashicorp/vault/pull/17636)]
-* secrets/transit: Allow configuring whether upsert of keys is allowed. [[GH-18272](https://github.com/hashicorp/vault/pull/18272)]
-* storage/raft: Add `retry_join_as_non_voter` config option. [[GH-18030](https://github.com/hashicorp/vault/pull/18030)]
-* storage/raft: add additional raft metrics relating to applied index and heartbeating; also ensure OSS standbys emit periodic metrics. [[GH-12166](https://github.com/hashicorp/vault/pull/12166)]
-* sys/internal/inspect: Creates an endpoint to look to inspect internal subsystems. [[GH-17789](https://github.com/hashicorp/vault/pull/17789)]
-* sys/internal/inspect: Creates an endpoint to look to inspect internal subsystems.
-* ui: Add algorithm-signer as a SSH Secrets Engine UI field [[GH-10299](https://github.com/hashicorp/vault/pull/10299)]
-* ui: Add inline policy creation when creating an identity entity or group [[GH-17749](https://github.com/hashicorp/vault/pull/17749)]
-* ui: Added JWT authentication warning message about blocked pop-up windows and web browser settings. [[GH-18787](https://github.com/hashicorp/vault/pull/18787)]
-* ui: Enable typescript for future development [[GH-17927](https://github.com/hashicorp/vault/pull/17927)]
-* ui: Prepends "passcode=" if not provided in user input for duo totp mfa method authentication [[GH-18342](https://github.com/hashicorp/vault/pull/18342)]
-* ui: Update language on database role to "Connection name" [[GH-18261](https://github.com/hashicorp/vault/issues/18261)] [[GH-18350](https://github.com/hashicorp/vault/pull/18350)]
-* ui: adds allowed_response_headers as param for secret engine mount config [[GH-19216](https://github.com/hashicorp/vault/pull/19216)]
-* ui: consolidate all <a> tag usage [[GH-17866](https://github.com/hashicorp/vault/pull/17866)]
-* ui: mfa: use proper request id generation [[GH-17835](https://github.com/hashicorp/vault/pull/17835)]
-* ui: remove wizard [[GH-19220](https://github.com/hashicorp/vault/pull/19220)]
-* ui: update DocLink component to use new host url: developer.hashicorp.com [[GH-18374](https://github.com/hashicorp/vault/pull/18374)]
-* ui: update TTL picker for consistency [[GH-18114](https://github.com/hashicorp/vault/pull/18114)]
-* ui: use the combined activity log (partial + historic) API for client count dashboard and remove use of monthly endpoint [[GH-17575](https://github.com/hashicorp/vault/pull/17575)]
-* vault/diagnose: Upgrade `go.opentelemetry.io/otel`, `go.opentelemetry.io/otel/sdk`, `go.opentelemetry.io/otel/trace` to v1.11.2 [[GH-18589](https://github.com/hashicorp/vault/pull/18589)]
-
-DEPRECATIONS:
-
-* secrets/ad: Marks the Active Directory (AD) secrets engine as deprecated. [[GH-19334](https://github.com/hashicorp/vault/pull/19334)]
-
-BUG FIXES:
-
-* api: Remove timeout logic from ReadRaw functions and add ReadRawWithContext [[GH-18708](https://github.com/hashicorp/vault/pull/18708)]
-* auth/alicloud: fix regression in vault login command that caused login to fail [[GH-19005](https://github.com/hashicorp/vault/pull/19005)]
-* auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [[GH-19186](https://github.com/hashicorp/vault/pull/19186)]
-* auth/approle: Fix `token_bound_cidrs` validation when using /32 blocks for role and secret ID [[GH-18145](https://github.com/hashicorp/vault/pull/18145)]
-* auth/cert: Address a race condition accessing the loaded crls without a lock [[GH-18945](https://github.com/hashicorp/vault/pull/18945)]
-* auth/kubernetes: Ensure a consistent TLS configuration for all k8s API requests [[#173](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/173)] [[GH-18716](https://github.com/hashicorp/vault/pull/18716)]
-* auth/kubernetes: fixes and dep updates for the auth-kubernetes plugin (see plugin changelog for details) [[GH-19094](https://github.com/hashicorp/vault/pull/19094)]
-* auth/okta: fix a panic for AuthRenew in Okta [[GH-18011](https://github.com/hashicorp/vault/pull/18011)]
-* auth: Deduplicate policies prior to ACL generation [[GH-17914](https://github.com/hashicorp/vault/pull/17914)]
-* cli/kv: skip formatting of nil secrets for patch and put with field parameter set [[GH-18163](https://github.com/hashicorp/vault/pull/18163)]
-* cli/pki: Decode integer values properly in health-check configuration file [[GH-19265](https://github.com/hashicorp/vault/pull/19265)]
-* cli/pki: Fix path for role health-check warning messages [[GH-19274](https://github.com/hashicorp/vault/pull/19274)]
-* cli/pki: Properly report permission issues within health-check mount tune checks [[GH-19276](https://github.com/hashicorp/vault/pull/19276)]
-* cli/transit: Fix import, import-version command invocation [[GH-19373](https://github.com/hashicorp/vault/pull/19373)]
-* cli: Fix issue preventing kv commands from executing properly when the mount path provided by `-mount` flag and secret key path are the same. [[GH-17679](https://github.com/hashicorp/vault/pull/17679)]
-* cli: Fix vault read handling to return raw data as secret.Data when there is no top-level data object from api response. [[GH-17913](https://github.com/hashicorp/vault/pull/17913)]
-* cli: Remove empty table heading for `vault secrets list -detailed` output. [[GH-17577](https://github.com/hashicorp/vault/pull/17577)]
-* command/namespace: Fix vault cli namespace patch examples in help text. [[GH-18143](https://github.com/hashicorp/vault/pull/18143)]
-* core (enterprise): Fix missing quotation mark in error message
-* core (enterprise): Fix panic that could occur with SSCT alongside invoking external plugins for revocation.
-* core (enterprise): Fix panic when using invalid accessor for control-group request
-* core (enterprise): Fix perf standby WAL streaming silently failures when replication setup happens at a bad time.
-* core (enterprise): Supported storage check in `vault server` command will no longer prevent startup. Instead, a warning will be logged if configured to use storage backend other than `raft` or `consul`.
-* core/activity: add namespace breakdown for new clients when date range spans multiple months, including the current month. [[GH-18766](https://github.com/hashicorp/vault/pull/18766)]
-* core/activity: de-duplicate namespaces when historical and current month data are mixed [[GH-18452](https://github.com/hashicorp/vault/pull/18452)]
-* core/activity: fix the end_date returned from the activity log endpoint when partial counts are computed [[GH-17856](https://github.com/hashicorp/vault/pull/17856)]
-* core/activity: include mount counts when de-duplicating current and historical month data [[GH-18598](https://github.com/hashicorp/vault/pull/18598)]
-* core/activity: report mount paths (rather than mount accessors) in current month activity log counts and include deleted mount paths in precomputed queries. [[GH-18916](https://github.com/hashicorp/vault/pull/18916)]
-* core/activity: return partial month counts when querying a historical date range and no historical data exists. [[GH-17935](https://github.com/hashicorp/vault/pull/17935)]
-* core/auth: Return a 403 instead of a 500 for wrapping requests when token is not provided [[GH-18859](https://github.com/hashicorp/vault/pull/18859)]
-* core/managed-keys (enterprise): Limit verification checks to mounts in a key's namespace
-* core/managed-keys (enterprise): Return better error messages when encountering key creation failures
-* core/managed-keys (enterprise): Switch to using hash length as PSS Salt length within the test/sign api for better PKCS#11 compatibility
-* core/quotas (enterprise): Fix a lock contention issue that could occur and cause Vault to become unresponsive when creating, changing, or deleting lease count quotas.
-* core/quotas (enterprise): Fix a potential deadlock that could occur when using lease count quotas.
-* core/quotas: Fix issue with improper application of default rate limit quota exempt paths [[GH-18273](https://github.com/hashicorp/vault/pull/18273)]
-* core/seal: Fix regression handling of the key_id parameter in seal configuration HCL. [[GH-17612](https://github.com/hashicorp/vault/pull/17612)]
-* core: Fix panic caused in Vault Agent when rendering certificate templates [[GH-17419](https://github.com/hashicorp/vault/pull/17419)]
-* core: Fix potential deadlock if barrier ciphertext is less than 4 bytes. [[GH-17944](https://github.com/hashicorp/vault/pull/17944)]
-* core: Fix spurious `permission denied` for all HelpOperations on sudo-protected paths [[GH-18568](https://github.com/hashicorp/vault/pull/18568)]
-* core: Fix vault operator init command to show the right curl string with -output-curl-string and right policy hcl with -output-policy [[GH-17514](https://github.com/hashicorp/vault/pull/17514)]
-* core: Fixes spurious warnings being emitted relating to "unknown or unsupported fields" for JSON config [[GH-17660](https://github.com/hashicorp/vault/pull/17660)]
-* core: Linux packages now have vendor label and set the default label to HashiCorp.
-This fix is implemented for any future releases, but will not be updated for historical releases.
-* core: Prevent panics in `sys/leases/lookup`, `sys/leases/revoke`, and `sys/leases/renew` endpoints if provided `lease_id` is null [[GH-18951](https://github.com/hashicorp/vault/pull/18951)]
-* core: Refactor lock grabbing code to simplify stateLock deadlock investigations [[GH-17187](https://github.com/hashicorp/vault/pull/17187)]
-* core: fix GPG encryption to support subkeys. [[GH-16224](https://github.com/hashicorp/vault/pull/16224)]
-* core: fix a start up race condition where performance standbys could go into a
-mount loop if default policies are not yet synced from the active node. [[GH-17801](https://github.com/hashicorp/vault/pull/17801)]
-* core: fix bug where context cancellations weren't forwarded to active node from performance standbys.
-* core: fix race when using SystemView.ReplicationState outside of a request context [[GH-17186](https://github.com/hashicorp/vault/pull/17186)]
-* core: prevent memory leak when using control group factors in a policy [[GH-17532](https://github.com/hashicorp/vault/pull/17532)]
-* core: prevent panic during mfa after enforcement's namespace is deleted [[GH-17562](https://github.com/hashicorp/vault/pull/17562)]
-* core: prevent panic in login mfa enforcement delete after enforcement's namespace is deleted [[GH-18923](https://github.com/hashicorp/vault/pull/18923)]
-* core: trying to unseal with the wrong key now returns HTTP 400 [[GH-17836](https://github.com/hashicorp/vault/pull/17836)]
-* credential/cert: adds error message if no tls connection is found during the AliasLookahead operation [[GH-17904](https://github.com/hashicorp/vault/pull/17904)]
-* database/mongodb: Fix writeConcern set to be applied to any query made on the database [[GH-18546](https://github.com/hashicorp/vault/pull/18546)]
-* expiration: Prevent panics on perf standbys when an irrevocable lease gets deleted. [[GH-18401](https://github.com/hashicorp/vault/pull/18401)]
-* kmip (enterprise): Fix a problem with some multi-part MAC Verify operations.
-* kmip (enterprise): Only require data to be full blocks on encrypt/decrypt operations using CBC and ECB block cipher modes.
-* license (enterprise): Fix bug where license would update even if the license didn't change.
-* licensing (enterprise): update autoloaded license cache after reload
-* login: Store token in tokenhelper for interactive login MFA [[GH-17040](https://github.com/hashicorp/vault/pull/17040)]
-* openapi: Fix many incorrect details in generated API spec, by using better techniques to parse path regexps [[GH-18554](https://github.com/hashicorp/vault/pull/18554)]
-* openapi: fix gen_openapi.sh script to correctly load vault plugins [[GH-17752](https://github.com/hashicorp/vault/pull/17752)]
-* plugins/kv: KV v2 returns 404 instead of 500 for request paths that incorrectly include a trailing slash. [[GH-17339](https://github.com/hashicorp/vault/pull/17339)]
-* plugins: Allow running external plugins which override deprecated builtins. [[GH-17879](https://github.com/hashicorp/vault/pull/17879)]
-* plugins: Corrected the path to check permissions on when the registered plugin name does not match the plugin binary's filename. [[GH-17340](https://github.com/hashicorp/vault/pull/17340)]
-* plugins: Listing all plugins while audit logging is enabled will no longer result in an internal server error. [[GH-18173](https://github.com/hashicorp/vault/pull/18173)]
-* plugins: Only report deprecation status for builtin plugins. [[GH-17816](https://github.com/hashicorp/vault/pull/17816)]
-* plugins: Skip loading but still mount data associated with missing plugins on unseal. [[GH-18189](https://github.com/hashicorp/vault/pull/18189)]
-* plugins: Vault upgrades will no longer fail if a mount has been created using an explicit builtin plugin version. [[GH-18051](https://github.com/hashicorp/vault/pull/18051)]
-* replication (enterprise): Fix bug where reloading external plugin on a secondary would
-break replication.
-* sdk: Don't panic if system view or storage methods called during plugin setup. [[GH-18210](https://github.com/hashicorp/vault/pull/18210)]
-* secret/pki: fix bug with initial legacy bundle migration (from < 1.11 into 1.11+) and missing issuers from ca_chain [[GH-17772](https://github.com/hashicorp/vault/pull/17772)]
-* secrets/ad: Fix bug where updates to config would fail if password isn't provided [[GH-19061](https://github.com/hashicorp/vault/pull/19061)]
-* secrets/gcp: fix issue where IAM bindings were not preserved during policy update [[GH-19018](https://github.com/hashicorp/vault/pull/19018)]
-* secrets/mongodb-atlas: Fix a bug that did not allow WAL rollback to handle partial failures when creating API keys [[GH-19111](https://github.com/hashicorp/vault/pull/19111)]
-* secrets/pki: Address nil panic when an empty POST request is sent to the OCSP handler [[GH-18184](https://github.com/hashicorp/vault/pull/18184)]
-* secrets/pki: Allow patching issuer to set an empty issuer name. [[GH-18466](https://github.com/hashicorp/vault/pull/18466)]
-* secrets/pki: Do not read revoked certificates from backend when CRL is disabled [[GH-17385](https://github.com/hashicorp/vault/pull/17385)]
-* secrets/pki: Fix upgrade of missing expiry, delta_rebuild_interval by setting them to the default. [[GH-17693](https://github.com/hashicorp/vault/pull/17693)]
-* secrets/pki: Fixes duplicate otherName in certificates created by the sign-verbatim endpoint. [[GH-16700](https://github.com/hashicorp/vault/pull/16700)]
-* secrets/pki: OCSP GET request parameter was not being URL unescaped before processing. [[GH-18938](https://github.com/hashicorp/vault/pull/18938)]
-* secrets/pki: Respond to tidy-status, tidy-cancel on PR Secondary clusters. [[GH-17497](https://github.com/hashicorp/vault/pull/17497)]
-* secrets/pki: Revert fix for PR [18938](https://github.com/hashicorp/vault/pull/18938) [[GH-19037](https://github.com/hashicorp/vault/pull/19037)]
-* secrets/pki: consistently use UTC for CA's notAfter exceeded error message [[GH-18984](https://github.com/hashicorp/vault/pull/18984)]
-* secrets/pki: fix race between tidy's cert counting and tidy status reporting. [[GH-18899](https://github.com/hashicorp/vault/pull/18899)]
-* secrets/transit: Do not warn about unrecognized parameter 'batch_input' [[GH-18299](https://github.com/hashicorp/vault/pull/18299)]
-* secrets/transit: Honor `partial_success_response_code` on decryption failures. [[GH-18310](https://github.com/hashicorp/vault/pull/18310)]
-* server/config:  Use file.Stat when checking file permissions when VAULT_ENABLE_FILE_PERMISSIONS_CHECK is enabled [[GH-19311](https://github.com/hashicorp/vault/pull/19311)]
-* storage/raft (enterprise): An already joined node can rejoin by wiping storage
-and re-issueing a join request, but in doing so could transiently become a
-non-voter.  In some scenarios this resulted in loss of quorum. [[GH-18263](https://github.com/hashicorp/vault/pull/18263)]
-* storage/raft: Don't panic on unknown raft ops [[GH-17732](https://github.com/hashicorp/vault/pull/17732)]
-* storage/raft: Fix race with follower heartbeat tracker during teardown. [[GH-18704](https://github.com/hashicorp/vault/pull/18704)]
-* ui/keymgmt: Sets the defaultValue for type when creating a key. [[GH-17407](https://github.com/hashicorp/vault/pull/17407)]
-* ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [[GH-19071](https://github.com/hashicorp/vault/pull/19071)]
-* ui: Fixes issue with not being able to download raft snapshot via service worker [[GH-17769](https://github.com/hashicorp/vault/pull/17769)]
-* ui: Fixes oidc/jwt login issue with alternate mount path and jwt login via mount path tab [[GH-17661](https://github.com/hashicorp/vault/pull/17661)]
-* ui: Remove `default` and add `default-service` and `default-batch` to UI token_type for auth mount and tuning. [[GH-19290](https://github.com/hashicorp/vault/pull/19290)]
-* ui: Remove default value of 30 to TtlPicker2 if no value is passed in. [[GH-17376](https://github.com/hashicorp/vault/pull/17376)]
-* ui: allow selection of "default" for ssh algorithm_signer in web interface [[GH-17894](https://github.com/hashicorp/vault/pull/17894)]
-* ui: cleanup unsaved auth method ember data record when navigating away from mount backend form [[GH-18651](https://github.com/hashicorp/vault/pull/18651)]
-* ui: fix entity policies list link to policy show page [[GH-17950](https://github.com/hashicorp/vault/pull/17950)]
-* ui: fixes query parameters not passed in api explorer test requests [[GH-18743](https://github.com/hashicorp/vault/pull/18743)]
-* ui: fixes reliance on secure context (https) by removing methods using the Crypto interface [[GH-19403](https://github.com/hashicorp/vault/pull/19403)]
-* ui: show Get credentials button for static roles detail page when a user has the proper permissions. [[GH-19190](https://github.com/hashicorp/vault/pull/19190)]
-
-## 1.12.11
-### September 13, 2023
-
-SECURITY:
-
-* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption. [[GH-22852](https://github.com/hashicorp/vault/pull/22852)]
+* **Product Usage Reporting**: Added product usage reporting, which collects anonymous, numerical, non-sensitive data about Vault secrets usage, and adds it to the existing utilization reports. See the [[docs](https://developer.hashicorp.com/vault/docs/enterprise/license/product-usage-reporting)] for more info [[GH-28858](https://github.com/hashicorp/vault/pull/28858)]
 
 IMPROVEMENTS:
 
-* auth/ldap: improved login speed by adding concurrency to LDAP token group searches [[GH-22659](https://github.com/hashicorp/vault/pull/22659)]
-* kmip (enterprise): reduce latency of KMIP operation handling
+* secret/pki: Introduce a new value `always_enforce_err` within `leaf_not_after_behavior` to force the error in all circumstances such as CA issuance and ACME requests if requested TTL values are beyond the issuer's NotAfter. [[GH-28907](https://github.com/hashicorp/vault/pull/28907)]
+* secrets-sync (enterprise): No longer attempt to unsync a random UUID secret name in GCP upon destination creation.
+* ui: Adds navigation for LDAP hierarchical roles [[GH-28824](https://github.com/hashicorp/vault/pull/28824)]
+* website/docs: changed outdated reference to consul-helm repository to consul-k8s repository. [[GH-28825](https://github.com/hashicorp/vault/pull/28825)]
 
 BUG FIXES:
 
-* cli: Fix the CLI failing to return wrapping information for KV PUT and PATCH operations when format is set to `table`. [[GH-22818](https://github.com/hashicorp/vault/pull/22818)]
-* core/quotas: Reduce overhead for role calculation when using cloud auth methods. [[GH-22583](https://github.com/hashicorp/vault/pull/22583)]
-* core/seal: add a workaround for potential connection [[hangs](https://github.com/Azure/azure-sdk-for-go/issues/21346)] in Azure autoseals. [[GH-22760](https://github.com/hashicorp/vault/pull/22760)]
-* raft/autopilot: Add dr-token flag for raft autopilot cli commands [[GH-21165](https://github.com/hashicorp/vault/pull/21165)]
-* replication (enterprise): Fix discovery of bad primary cluster addresses to be more reliable
+* auth/ldap: Fixed an issue where debug level logging was not emitted. [[GH-28881](https://github.com/hashicorp/vault/pull/28881)]
+* core: Improved an internal helper function that sanitizes paths by adding a check for leading backslashes 
+in addition to the existing check for leading slashes. [[GH-28878](https://github.com/hashicorp/vault/pull/28878)]
+* secret/pki: Fix a bug that prevents PKI issuer field enable_aia_url_templating
+to be set to false. [[GH-28832](https://github.com/hashicorp/vault/pull/28832)]
+* secrets-sync (enterprise): Fixed issue where secret-key granularity destinations could sometimes cause a panic when loading a sync status.
+* secrets/aws: Fix issue with static credentials not rotating after restart or leadership change. [[GH-28775](https://github.com/hashicorp/vault/pull/28775)]
+* secrets/ssh: Return the flag `allow_empty_principals` in the read role api when key_type is "ca" [[GH-28901](https://github.com/hashicorp/vault/pull/28901)]
+* secrets/transform (enterprise): Fix nil panic when accessing a partially setup database store.
+* secrets/transit: Fix a race in which responses from the key update api could contain results from another subsequent update [[GH-28839](https://github.com/hashicorp/vault/pull/28839)]
+* ui: Fixes rendering issues of LDAP dynamic and static roles with the same name [[GH-28824](https://github.com/hashicorp/vault/pull/28824)]
 
-## 1.12.10
-### August 30, 2023
-
-CHANGES:
-
-* core: Bump Go version to 1.19.12.
-
-IMPROVEMENTS:
-
-* core: Log rollback manager failures during unmount, remount to prevent replication failures on secondary clusters. [[GH-22235](https://github.com/hashicorp/vault/pull/22235)]
-* replication (enterprise): Make reindex less disruptive by allowing writes during the flush phase.
-* storage/raft: Cap the minimum dead_server_last_contact_threshold to 1m. [[GH-22040](https://github.com/hashicorp/vault/pull/22040)]
-* ui: enables create and update KV secret workflow when control group present [[GH-22471](https://github.com/hashicorp/vault/pull/22471)]
-
-BUG FIXES:
-
-* api: Fix breakage with UNIX domain socket addresses introduced by newest Go versions as a security fix. [[GH-22523](https://github.com/hashicorp/vault/pull/22523)]
-* core (enterprise): Remove MFA Configuration for namespace when deleting namespace
-* core/quotas (enterprise): Fix a case where we were applying login roles to lease count quotas in a non-login context.
-Also fix a related potential deadlock. [[GH-21110](https://github.com/hashicorp/vault/pull/21110)]
-* core:  Remove "expiration manager is nil on tokenstore" error log for unauth requests on DR secondary as they do not have expiration manager. [[GH-22137](https://github.com/hashicorp/vault/pull/22137)]
-* core: Fix readonly errors that could occur while loading mounts/auths during unseal [[GH-22362](https://github.com/hashicorp/vault/pull/22362)]
-* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-21470](https://github.com/hashicorp/vault/pull/21470)]
-* expiration: Fix a deadlock that could occur when a revocation failure happens while restoring leases on startup. [[GH-22374](https://github.com/hashicorp/vault/pull/22374)]
-* license: Add autoloaded license path to the cache exempt list. This is to ensure the license changes on the active node is observed on the perfStandby node. [[GH-22363](https://github.com/hashicorp/vault/pull/22363)]
-* replication (enterprise): Fix bug sync invalidate CoreReplicatedClusterInfoPath
-* replication (enterprise): Fixing a bug by which the atomicity of a merkle diff result could be affected. This means it could be a source of a merkle-diff & sync process failing to switch into stream-wal mode afterwards.
-* sdk/ldaputil: Properly escape user filters when using UPN domains
-sdk/ldaputil: use EscapeLDAPValue implementation from cap/ldap [[GH-22249](https://github.com/hashicorp/vault/pull/22249)]
-* secrets/ldap: Fix bug causing schema and password_policy to be overwritten in config. [[GH-22332](https://github.com/hashicorp/vault/pull/22332)]
-* secrets/transform (enterprise): Tidy operations will be re-scheduled at a minimum of every minute, not a maximum of every minute
-* ui: Fix blank page or ghost secret when canceling KV secret create [[GH-22541](https://github.com/hashicorp/vault/pull/22541)]
-* ui: fixes `max_versions` default for secret metadata unintentionally overriding kv engine defaults [[GH-22394](https://github.com/hashicorp/vault/pull/22394)]
-
-## 1.12.9
-### July 25, 2023
+## 1.18.1
+### October 30, 2024
 
 SECURITY:
-
-* core/namespace (enterprise): An unhandled error in Vault Enterprise’s namespace creation may cause the Vault process to crash, potentially resulting in denial of service. This vulnerability, CVE-2023-3774, is fixed in Vault Enterprise 1.14.1, 1.13.5, and 1.12.9. [[HSEC_2023-23](https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617)]
+* core/raft: Add raft join limits [[GH-28790](https://github.com/hashicorp/vault/pull/28790), [HCSEC-2024-26](https://discuss.hashicorp.com/t/hcsec-2024-26-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-processing-raft-cluster-join-requests)]
 
 CHANGES:
 
-* secrets/transform (enterprise): Enforce a transformation role's max_ttl setting on encode requests, a warning will be returned if max_ttl was applied.
+* auth/azure: Update plugin to v0.19.1 [[GH-28712](https://github.com/hashicorp/vault/pull/28712)]
+* secrets/azure: Update plugin to v0.20.1 [[GH-28699](https://github.com/hashicorp/vault/pull/28699)]
+* secrets/openldap: Update plugin to v0.14.1 [[GH-28479](https://github.com/hashicorp/vault/pull/28479)]
+* secrets/openldap: Update plugin to v0.14.2 [[GH-28704](https://github.com/hashicorp/vault/pull/28704)]
+* secrets/openldap: Update plugin to v0.14.3 [[GH-28780](https://github.com/hashicorp/vault/pull/28780)]
 
 IMPROVEMENTS:
 
-* core/fips: Add RPM, DEB packages of FIPS 140-2 and HSM+FIPS 140-2 Vault Enterprise.
-* replication (enterprise): Avoid logging warning if request is forwarded from a performance standby and not a performance secondary
-* secrets/transform (enterprise): Switch to pgx PostgreSQL driver for better timeout handling
+* core: Add a mount tuneable that trims trailing slashes of request paths during POST.  Needed to support CMPv2 in PKI. [[GH-28752](https://github.com/hashicorp/vault/pull/28752)]
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241003195753-88fef418d705
+* ui: Add button to copy secret path in kv v1 and v2 secrets engines [[GH-28629](https://github.com/hashicorp/vault/pull/28629)]
+* ui: Adds copy button to identity entity, alias and mfa method IDs [[GH-28742](https://github.com/hashicorp/vault/pull/28742)]
 
 BUG FIXES:
 
-* core: Fixed an instance where incorrect route entries would get tainted. We now pre-calculate namespace specific paths to avoid this. [[GH-24170](https://github.com/hashicorp/vault/pull/24170)]
-* identity: Remove caseSensitivityKey to prevent errors while loading groups which could result in missing groups in memDB when duplicates are found. [[GH-20965](https://github.com/hashicorp/vault/pull/20965)]
-* replication (enterprise): update primary cluster address after DR failover
-* secrets/azure: Fix intermittent 401s by preventing performance secondary clusters from rotating root credentials. [[GH-21633](https://github.com/hashicorp/vault/pull/21633)]
-* secrets/pki: Prevent deleted issuers from reappearing when migrating from a version 1 bundle to a version 2 bundle (versions including 1.13.0, 1.12.2, and 1.11.6); when managed keys were removed but referenced in the Vault 1.10 legacy CA bundle, this the error: `no managed key found with uuid`. [[GH-21316](https://github.com/hashicorp/vault/pull/21316)]
-* secrets/pki: Support setting both maintain_stored_certificate_counts=false and publish_stored_certificate_count_metrics=false explicitly in tidy config. [[GH-20664](https://github.com/hashicorp/vault/pull/20664)]
-* secrets/transform (enterprise): Fix nil panic when deleting a template with tokenization transformations present
-* secrets/transform (enterprise): Grab shared locks for various read operations, only escalating to write locks if work is required
-* serviceregistration: Fix bug where multiple nodes in a secondary cluster could be labelled active after updating the cluster's primary [[GH-21642](https://github.com/hashicorp/vault/pull/21642)]
-* ui: Fixed an issue where editing an SSH role would clear `default_critical_options` and `default_extension` if left unchanged. [[GH-21739](https://github.com/hashicorp/vault/pull/21739)]
+* agent: Fix chown error running agent on Windows with an auto-auth file sinks. [[GH-28748](https://github.com/hashicorp/vault/pull/28748)]
+* audit: Prevent users from enabling multiple audit devices of file type with the same file_path to write to. [[GH-28751](https://github.com/hashicorp/vault/pull/28751)]
+* cli: Fixed a CLI precedence issue where -agent-address didn't override VAULT_AGENT_ADDR as it should [[GH-28574](https://github.com/hashicorp/vault/pull/28574)]
+* core/seal (enterprise): Fix bug that caused seal generation information to be replicated, which prevented disaster recovery and performance replication clusters from using their own seal high-availability configuration.
+* core/seal: Fix an issue that could cause reading from sys/seal-backend-status to return stale information. [[GH-28631](https://github.com/hashicorp/vault/pull/28631)]
+* core: Fixed panic seen when performing help requests without /v1/ in the URL. [[GH-28669](https://github.com/hashicorp/vault/pull/28669)]
+* kmip (enterprise): Use the default KMIP port for IPv6 addresses missing a port, for the listen_addrs configuration field, in order to match the existing IPv4 behavior
+* namespaces (enterprise): Fix issue where namespace patch requests to a performance secondary would not patch the namespace's metadata.
+* proxy: Fix chown error running proxy on Windows with an auto-auth file sink. [[GH-28748](https://github.com/hashicorp/vault/pull/28748)]
+* secrets/pki: Address issue with ACME HTTP-01 challenges failing for IPv6 IPs due to improperly formatted URLs [[GH-28718](https://github.com/hashicorp/vault/pull/28718)]
+* ui: No longer running decodeURIComponent on KVv2 list view allowing percent encoded data-octets in path name. [[GH-28698](https://github.com/hashicorp/vault/pull/28698)]
+  
+## 1.18.0 
+## October 9, 2024
 
-## 1.12.8
-### June 21, 2023
-BREAKING CHANGES:
+SECURITY:
 
-* secrets/pki: Maintaining running count of certificates will be turned off by default.
-To re-enable keeping these metrics available on the tidy status endpoint, enable
-maintain_stored_certificate_counts on tidy-config, to also publish them to the
-metrics consumer, enable publish_stored_certificate_count_metrics . [[GH-18186](https://github.com/hashicorp/vault/pull/18186)]
+* secrets/identity: A privileged Vault operator with write permissions to the root namespace's identity endpoint could escalate their privileges to Vault's root policy (CVE-2024-9180) [HCSEC-2024-21](https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565)
 
 CHANGES:
 
-* core: Bump Go version to 1.19.10.
+* activity (enterprise): filter all fields in client count responses by the request namespace [[GH-27790](https://github.com/hashicorp/vault/pull/27790)]
+* activity (enterprise): remove deprecated fields distinct_entities and non_entity_tokens [[GH-27830](https://github.com/hashicorp/vault/pull/27830)]
+* activity log: Deprecated the field "default_report_months". Instead, the billing start time will be used to determine the start time
+when querying the activity log endpoints. [[GH-27350](https://github.com/hashicorp/vault/pull/27350)]
+* activity log: Deprecates the current_billing_period field for /sys/internal/counters/activity. The default start time
+will automatically be set the billing period start date. [[GH-27426](https://github.com/hashicorp/vault/pull/27426)]
+* activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) now requires the `sudo` ACL capability. [[GH-27846](https://github.com/hashicorp/vault/pull/27846)]
+* activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) now responds with a status of 204 instead 400 when no data exists within the time range specified by `start_time` and `end_time`. [[GH-28064](https://github.com/hashicorp/vault/pull/28064)]
+* activity: The startTime will be set to the start of the current billing period by default.
+The endTime will be set to the end of the current month. This applies to /sys/internal/counters/activity,
+/sys/internal/counters/activity/export, and the vault operator usage command that utilizes /sys/internal/counters/activity. [[GH-27379](https://github.com/hashicorp/vault/pull/27379)]
+* api: Update backoff/v3 to backoff/v4.3.0 [[GH-26868](https://github.com/hashicorp/vault/pull/26868)]
+* auth/alicloud: Update plugin to v0.19.0 [[GH-28263](https://github.com/hashicorp/vault/pull/28263)]
+* auth/azure: Update plugin to v0.19.0 [[GH-28294](https://github.com/hashicorp/vault/pull/28294)]
+* auth/cf: Update plugin to v0.18.0 [[GH-27724](https://github.com/hashicorp/vault/pull/27724)]
+* auth/cf: Update plugin to v0.19.0 [[GH-28266](https://github.com/hashicorp/vault/pull/28266)]
+* auth/gcp: Update plugin to v0.19.0 [[GH-28366](https://github.com/hashicorp/vault/pull/28366)]
+* auth/jwt: Update plugin to v0.21.0 [[GH-27498](https://github.com/hashicorp/vault/pull/27498)]
+* auth/jwt: Update plugin to v0.22.0 [[GH-28349](https://github.com/hashicorp/vault/pull/28349)]
+* auth/kerberos: Update plugin to v0.13.0 [[GH-28264](https://github.com/hashicorp/vault/pull/28264)]
+* auth/kubernetes: Update plugin to v0.20.0 [[GH-28289](https://github.com/hashicorp/vault/pull/28289)]
+* auth/oci: Update plugin to v0.17.0 [[GH-28307](https://github.com/hashicorp/vault/pull/28307)]
+* cli: The undocumented `-dev-three-node` and `-dev-four-cluster` CLI options have been removed. [[GH-27578](https://github.com/hashicorp/vault/pull/27578)]
+* consul-template: updated to version 0.39.1 [[GH-27799](https://github.com/hashicorp/vault/pull/27799)]
+* core(enterprise): Updated the following two control group related errors responses to respond with response code 400 instead of 500: `control group: could not find token`, and `control group: token is not a valid control group token`.
+* core: Bump Go version to 1.22.7
+* database/couchbase: Update plugin to v0.12.0 [[GH-28327](https://github.com/hashicorp/vault/pull/28327)]
+* database/elasticsearch: Update plugin to v0.16.0 [[GH-28277](https://github.com/hashicorp/vault/pull/28277)]
+* database/mongodbatlas: Update plugin to v0.13.0 [[GH-28268](https://github.com/hashicorp/vault/pull/28268)]
+* database/redis-elasticache: Update plugin to v0.5.0 [[GH-28293](https://github.com/hashicorp/vault/pull/28293)]
+* database/redis: Update plugin to v0.4.0 [[GH-28404](https://github.com/hashicorp/vault/pull/28404)]
+* database/snowflake: Update plugin to v0.12.0 [[GH-28275](https://github.com/hashicorp/vault/pull/28275)]
+* sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.0, which also bumps github.com/docker/docker to v26.1.5+incompatible [[GH-28269](https://github.com/hashicorp/vault/pull/28269)]
+* secrets/ad: Update plugin to v0.19.0 [[GH-28361](https://github.com/hashicorp/vault/pull/28361)]
+* secrets/alicloud: Update plugin to v0.18.0 [[GH-28271](https://github.com/hashicorp/vault/pull/28271)]
+* secrets/azure: Update plugin to v0.19.2 [[GH-27652](https://github.com/hashicorp/vault/pull/27652)]
+* secrets/azure: Update plugin to v0.20.0 [[GH-28267](https://github.com/hashicorp/vault/pull/28267)]
+* secrets/gcp: Update plugin to v0.20.0 [[GH-28324](https://github.com/hashicorp/vault/pull/28324)]
+* secrets/gcpkms: Update plugin to v0.18.0 [[GH-28300](https://github.com/hashicorp/vault/pull/28300)]
+* secrets/gcpkms: Update plugin to v0.19.0 [[GH-28360](https://github.com/hashicorp/vault/pull/28360)]
+* secrets/kubernetes: Update plugin to v0.9.0 [[GH-28287](https://github.com/hashicorp/vault/pull/28287)]
+* secrets/kv: Update plugin to v0.20.0 [[GH-28334](https://github.com/hashicorp/vault/pull/28334)]
+* secrets/mongodbatlas: Update plugin to v0.13.0 [[GH-28348](https://github.com/hashicorp/vault/pull/28348)]
+* secrets/openldap: Update plugin to v0.14.0 [[GH-28325](https://github.com/hashicorp/vault/pull/28325)]
+* secrets/ssh: Add a flag, `allow_empty_principals` to allow keys or certs to apply to any user/principal. [[GH-28466](https://github.com/hashicorp/vault/pull/28466)]
+* secrets/terraform: Update plugin to v0.10.0 [[GH-28312](https://github.com/hashicorp/vault/pull/28312)]
+* secrets/terraform: Update plugin to v0.9.0 [[GH-28016](https://github.com/hashicorp/vault/pull/28016)]
+* ui: Uses the internal/counters/activity/export endpoint for client count export data. [[GH-27455](https://github.com/hashicorp/vault/pull/27455)]
 
 FEATURES:
 
-* **Automated License Utilization Reporting**: Added automated license
-utilization reporting, which sends minimal product-license [metering
-data](https://developer.hashicorp.com/vault/docs/enterprise/license/utilization-reporting)
-to HashiCorp without requiring you to manually collect and report them.
-* core (enterprise): Add background worker for automatic reporting of billing
-information. [[GH-19625](https://github.com/hashicorp/vault/pull/19625)]
+* **AWS secrets engine STS session tags support**: Adds support for setting STS
+session tags when generating temporary credentials using the AWS secrets
+engine. [[GH-27620](https://github.com/hashicorp/vault/pull/27620)]
+* **Adaptive Overload Protection (enterprise)**: Enables Adaptive Overload Protection
+for write requests as a GA feature (enabled by default) for Integrated Storage.
+* **Audit Entry Exclusion (enterprise)**: Audit devices support excluding fields from entries being written to them, with expression-based rules (powered by go-bexpr) to determine when the specific fields are excluded.
+* **Workload Identity Federation UI for AWS (enterprise)**: Add WIF fields to AWS secrets engine. [[GH-28148](https://github.com/hashicorp/vault/pull/28148)]
+* **KV v2 Patch/Subkey (enterprise)**: Adds GUI support to read the subkeys of a KV v2 secret and patch (partially update) secret data. [[GH-28212](https://github.com/hashicorp/vault/pull/28212)]
+* **Self-Managed Static Roles**: Self-Managed Static Roles are now supported for the Postgres SQL database engine. Requires Vault Enterprise. [[GH-28199](https://github.com/hashicorp/vault/pull/28199)]
+* **Vault Minimal Version**: Add the ability to build a minimal version of Vault
+with only core features using the BUILD_MINIMAL environment variable. [[GH-27394](https://github.com/hashicorp/vault/pull/27394)]
+* **Vault PKI 3GPP CMPv2 Server (Enterprise)**: Support for the PKI 3GPP CMPv2 certificate management protocol has been added to the Vault PKI Plugin. This allows standard CMPv2 clients to request certificates from a Vault server with no knowledge of Vault APIs.
 
 IMPROVEMENTS:
 
-* api: GET ... /sys/internal/counters/activity?current_billing_period=true now
-results in a response which contains the full billing period [[GH-20694](https://github.com/hashicorp/vault/pull/20694)]
-* api: `/sys/internal/counters/config` endpoint now contains read-only
-`minimum_retention_months`. [[GH-20150](https://github.com/hashicorp/vault/pull/20150)]
-* api: `/sys/internal/counters/config` endpoint now contains read-only
-`reporting_enabled` and `billing_start_timestamp` fields. [[GH-20086](https://github.com/hashicorp/vault/pull/20086)]
-* core (enterprise): add configuration for license reporting [[GH-19891](https://github.com/hashicorp/vault/pull/19891)]
-* core (enterprise): license updates trigger a reload of reporting and the activity log [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
-* core (enterprise): support reloading configuration for automated reporting via SIGHUP [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
-* core (enterprise): vault server command now allows for opt-out of automated
-reporting via the `OPTOUT_LICENSE_REPORTING` environment variable. [[GH-3939](https://github.com/hashicorp/vault/pull/3939)]
-* core/activity: error when attempting to update retention configuration below the minimum [[GH-20078](https://github.com/hashicorp/vault/pull/20078)]
-* core/activity: refactor the activity log's generation of precomputed queries [[GH-20073](https://github.com/hashicorp/vault/pull/20073)]
-* ui: updates clients configuration edit form state based on census reporting configuration [[GH-20125](https://github.com/hashicorp/vault/pull/20125)]
-
-BUG FIXES:
-
-* core (enterprise): Don't delete backend stored data that appears to be filterable
-on this secondary if we don't have a corresponding mount entry.
-* core/activity: add namespace breakdown for new clients when date range spans multiple months, including the current month. [[GH-18766](https://github.com/hashicorp/vault/pull/18766)]
-* core/activity: de-duplicate namespaces when historical and current month data are mixed [[GH-18452](https://github.com/hashicorp/vault/pull/18452)]
-* core/activity: fix the end_date returned from the activity log endpoint when partial counts are computed [[GH-17856](https://github.com/hashicorp/vault/pull/17856)]
-* core/activity: include mount counts when de-duplicating current and historical month data [[GH-18598](https://github.com/hashicorp/vault/pull/18598)]
-* core/activity: report mount paths (rather than mount accessors) in current month activity log counts and include deleted mount paths in precomputed queries. [[GH-18916](https://github.com/hashicorp/vault/pull/18916)]
-* core/activity: return partial month counts when querying a historical date range and no historical data exists. [[GH-17935](https://github.com/hashicorp/vault/pull/17935)]
-* core: Change where we evaluate filtered paths as part of mount operations; this is part of an enterprise bugfix that will
-have its own changelog entry.  Fix wrong lock used in ListAuths link meta interface implementation. [[GH-21260](https://github.com/hashicorp/vault/pull/21260)]
-* core: Do not cache seal configuration to fix a bug that resulted in sporadic auto unseal failures. [[GH-21223](https://github.com/hashicorp/vault/pull/21223)]
-* core: Don't exit just because we think there's a potential deadlock. [[GH-21342](https://github.com/hashicorp/vault/pull/21342)]
-* core: Fix panic in sealed nodes using raft storage trying to emit raft metrics [[GH-21249](https://github.com/hashicorp/vault/pull/21249)]
-* identity: Fixes duplicate groups creation with the same name but unique IDs. [[GH-20964](https://github.com/hashicorp/vault/pull/20964)]
-* replication (enterprise): Fix a race condition with update-primary that could result in data loss after a DR failover
-* replication (enterprise): Fix path filters deleting data right after it's written by backend Initialize funcs
-* storage/raft: Fix race where new follower joining can get pruned by dead server cleanup. [[GH-20986](https://github.com/hashicorp/vault/pull/20986)]
-
-## 1.12.7
-### June 08, 2023
+* activity log: Changes how new client counts in the current month are estimated, in order to return more
+visibly sensible totals. [[GH-27547](https://github.com/hashicorp/vault/pull/27547)]
+* activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) can now be called in non-root namespaces. Resulting records will be filtered to include the requested namespace (via `X-Vault-Namespace` header or within the path) and all child namespaces. [[GH-27846](https://github.com/hashicorp/vault/pull/27846)]
+* activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) now includes identity metadata about entity clients. [[GH-28064](https://github.com/hashicorp/vault/pull/28064)]
+* activity: `/sys/internal/counters/activity` will now include a warning if the specified usage period contains estimated client counts. [[GH-28068](https://github.com/hashicorp/vault/pull/28068)]
+* agent/sink: Allow configuration of the user and group ID of the file sink. [[GH-27123](https://github.com/hashicorp/vault/pull/27123)]
+* agent: Add metric (vault.agent.authenticated) that is set to 1 when vault agent has a valid token and zero if it does not. [[GH-26570](https://github.com/hashicorp/vault/pull/26570)]
+* agent: Add the ability to dump pprof to the filesystem using SIGUSR2 [[GH-27510](https://github.com/hashicorp/vault/pull/27510)]
+* audit: Adds TRACE logging to log request/response under certain circumstances, and further improvements to the audit subsystem. [[GH-28056](https://github.com/hashicorp/vault/pull/28056)]
+* audit: Ensure that any underyling errors from audit devices are logged even if we consider auditing to be a success. [[GH-27809](https://github.com/hashicorp/vault/pull/27809)]
+* audit: Internal implementation changes to the audit subsystem which improve performance. [[GH-27952](https://github.com/hashicorp/vault/pull/27952)]
+* audit: Internal implementation changes to the audit subsystem which improve relability. [[GH-28286](https://github.com/hashicorp/vault/pull/28286)]
+* audit: sinks (file, socket, syslog) will attempt to log errors to the server operational
+log before returning (if there are errors to log, and the context is done). [[GH-27859](https://github.com/hashicorp/vault/pull/27859)]
+* auth/cert: Cache full list of role trust information separately to avoid
+eviction, and avoid duplicate loading during multiple simultaneous logins on
+the same role. [[GH-27902](https://github.com/hashicorp/vault/pull/27902)]
+* cli: Add a `--dev-no-kv` flag to prevent auto mounting a key-value secret backend when running a dev server [[GH-16974](https://github.com/hashicorp/vault/pull/16974)]
+* cli: Allow vault CLI HTTP headers to be specified using the JSON-encoded VAULT_HEADERS environment variable [[GH-21993](https://github.com/hashicorp/vault/pull/21993)]
+* cli: `vault operator usage` will now include a warning if the specified usage period contains estimated client counts. [[GH-28068](https://github.com/hashicorp/vault/pull/28068)]
+* core/activity: Ensure client count queries that include the current month return consistent results by sorting the clients before performing estimation [[GH-28062](https://github.com/hashicorp/vault/pull/28062)]
+* core/cli: Example 'help' pages for vault read / write docs improved. [[GH-19064](https://github.com/hashicorp/vault/pull/19064)]
+* core/identity: allow identity backend to be tuned using standard secrets backend tuning parameters. [[GH-14723](https://github.com/hashicorp/vault/pull/14723)]
+* core/metrics: ensure core HA metrics are always output to Prometheus. [[GH-27966](https://github.com/hashicorp/vault/pull/27966)]
+* core: log at level ERROR rather than INFO when all seals are unhealthy. [[GH-28564](https://github.com/hashicorp/vault/pull/28564)]
+* core: make authLock and mountsLock in Core configurable via the detect_deadlocks configuration parameter. [[GH-27633](https://github.com/hashicorp/vault/pull/27633)]
+* database/postgres: Add new fields to the plugin's config endpoint for client certificate authentication. [[GH-28024](https://github.com/hashicorp/vault/pull/28024)]
+* db/cassandra: Add `disable_host_initial_lookup` option to backend, allowing the disabling of initial host lookup. [[GH-9733](https://github.com/hashicorp/vault/pull/9733)]
+* identity: alias metadata is now returned when listing entity aliases [[GH-26073](https://github.com/hashicorp/vault/pull/26073)]
+* license utilization reporting (enterprise): Auto-roll billing start date. [[GH-27656](https://github.com/hashicorp/vault/pull/27656)]
+* physical/raft: Log when the MAP_POPULATE mmap flag gets disabled before opening the database. [[GH-28526](https://github.com/hashicorp/vault/pull/28526)]
+* proxy/sink: Allow configuration of the user and group ID of the file sink. [[GH-27123](https://github.com/hashicorp/vault/pull/27123)]
+* proxy: Add the ability to dump pprof to the filesystem using SIGUSR2 [[GH-27510](https://github.com/hashicorp/vault/pull/27510)]
+* raft-snapshot (enterprise): add support for managed identity credentials for azure snapshots
+* raft/autopilot: Persist Raft server versions so autopilot always knows the versions of all servers in the cluster. Include server versions in the Raft bootstrap challenge answer so autopilot immediately knows the versions of new nodes. [[GH-28186](https://github.com/hashicorp/vault/pull/28186)]
+* sdk/helper: Allow setting environment variables when using NewTestDockerCluster [[GH-27457](https://github.com/hashicorp/vault/pull/27457)]
+* secrets-sync (enterprise): add support for specifying the replication regions for secret storage within GCP Secret Manager destinations
+* secrets-sync (enterprise): add support for syncing secrets to github environments within repositories
+* secrets-sync (enterprise): add support for syncing secrets to github organizations (beta)
+* secrets/database/hana: Update HANA db client to v1.10.1 [[GH-27950](https://github.com/hashicorp/vault/pull/27950)]
+* secrets/database: Add support for GCP CloudSQL private IP's. [[GH-26828](https://github.com/hashicorp/vault/pull/26828)]
+* secrets/pki: Key Usage can now be set on intermediate and root CAs, and CSRs generated by the PKI secret's engine. [[GH-28237](https://github.com/hashicorp/vault/pull/28237)]
+* secrets/pki: Track the last time auto-tidy ran to address auto-tidy not running if the auto-tidy interval is longer than scheduled Vault restarts. [[GH-28488](https://github.com/hashicorp/vault/pull/28488)]
+* serviceregistration: Added support for Consul ServiceMeta tags from config file from the new `service_meta` config field. [[GH-11084](https://github.com/hashicorp/vault/pull/11084)]
+* storage/azure: Updated metadata endpoint to `GetMSIEndpoint`, which supports more than just the metadata service. [[GH-10624](https://github.com/hashicorp/vault/pull/10624)]
+* storage/dynamodb: Speed up list and delete of large directories by only requesting keys from DynamoDB [[GH-21159](https://github.com/hashicorp/vault/pull/21159)]
+* storage/etcd: Update etcd3 client to v3.5.13 to allow use of TLSv1.3. [[GH-26660](https://github.com/hashicorp/vault/pull/26660)]
+* storage/raft: Bump raft to v1.7.0 which includes pre-vote. This should make clusters more stable during network partitions. [[GH-27605](https://github.com/hashicorp/vault/pull/27605)]
+* storage/raft: Improve autopilot logging on startup to show config values clearly and avoid spurious logs [[GH-27464](https://github.com/hashicorp/vault/pull/27464)]
+* ui/secrets-sync: Hide Secrets Sync from the sidebar nav if user does not have access to the feature. [[GH-27262](https://github.com/hashicorp/vault/pull/27262)]
+* ui: AWS credentials form sets credential_type from backing role [[GH-27405](https://github.com/hashicorp/vault/pull/27405)]
+* ui: Creates separate section for updating sensitive creds for Secrets sync create/edit view. [[GH-27538](https://github.com/hashicorp/vault/pull/27538)]
+* ui: For AWS and SSH secret engines hide mount configuration details in toggle and display configuration details or cta. [[GH-27831](https://github.com/hashicorp/vault/pull/27831)]
+* ui: Mask obfuscated fields when creating/editing a Secrets sync destination. [[GH-27348](https://github.com/hashicorp/vault/pull/27348)]
+* ui: Move secret-engine configuration create/edit from routing `vault/settings/secrets/configure/<backend>` to  `vault/secrets/<backend>/configuration/edit` [[GH-27918](https://github.com/hashicorp/vault/pull/27918)]
+* ui: Remove deprecated `current_billing_period` from dashboard activity log request [[GH-27559](https://github.com/hashicorp/vault/pull/27559)]
+* ui: Update the client count dashboard to use API namespace filtering and other UX improvements [[GH-28036](https://github.com/hashicorp/vault/pull/28036)]
+* ui: remove initial start/end parameters on the activity call for client counts dashboard. [[GH-27816](https://github.com/hashicorp/vault/pull/27816)]
+* ui: simplify the date range editing experience in the client counts dashboard. [[GH-27796](https://github.com/hashicorp/vault/pull/27796)]
+* website/docs: Added API documentation for Azure Secrets Engine delete role [[GH-27883](https://github.com/hashicorp/vault/pull/27883)]
+* website/docs: corrected invalid json in sample payload for azure secrets engine create/update role [[GH-28076](https://github.com/hashicorp/vault/pull/28076)]
+
+BUG FIXES:
+
+* activity: The sys/internal/counters/activity endpoint will return current month data when the end_date parameter is set to a future date. [[GH-28042](https://github.com/hashicorp/vault/pull/28042)]
+* agent: Fixed an issue causing excessive CPU usage during normal operation [[GH-27518](https://github.com/hashicorp/vault/pull/27518)]
+* auth/appid, auth/cert, auth/github, auth/ldap, auth/okta, auth/radius, auth/userpass: fixed an issue with policy name normalization that would prevent a token associated with a policy containing an uppercase character to be renewed. [[GH-16484](https://github.com/hashicorp/vault/pull/16484)]
+* auth/aws: fixes an issue where not supplying an external id was interpreted as an empty external id [[GH-27858](https://github.com/hashicorp/vault/pull/27858)]
+* auth/cert: During certificate validation, OCSP requests are debug logged even if Vault's log level is above DEBUG. [[GH-28450](https://github.com/hashicorp/vault/pull/28450)]
+* auth/cert: Merge error messages returned in login failures and include error when present [[GH-27202](https://github.com/hashicorp/vault/pull/27202)]
+* auth/cert: Use subject's serial number, not issuer's within error message text in OCSP request errors [[GH-27696](https://github.com/hashicorp/vault/pull/27696)]
+* auth/cert: When using ocsp_ca_certificates, an error was produced though extra certs validation succeeded. [[GH-28597](https://github.com/hashicorp/vault/pull/28597)]
+* auth/cert: ocsp_ca_certificates field was not honored when validating OCSP responses signed by a CA that did not issue the certificate. [[GH-28309](https://github.com/hashicorp/vault/pull/28309)]
+* auth/token: Fix token TTL calculation so that it uses `max_lease_ttl` tune value for tokens created via `auth/token/create`. [[GH-28498](https://github.com/hashicorp/vault/pull/28498)]
+* auth/token: fixes an edge case bug that "identity_policies" is nil and causes cli vault login error [[GH-17007](https://github.com/hashicorp/vault/pull/17007)]
+* auth: Updated error handling for missing login credentials in AppRole and UserPass auth methods to return a 400 error instead of a 500 error. [[GH-28441](https://github.com/hashicorp/vault/pull/28441)]
+* cli: Fixed an erroneous warning appearing about `-address` not being set when it is. [[GH-27265](https://github.com/hashicorp/vault/pull/27265)]
+* cli: Fixed issue with `vault hcp connect` where HCP resources with uppercase letters were inaccessible when entering the correct project name. [[GH-27694](https://github.com/hashicorp/vault/pull/27694)]
+* command: The `vault secrets move` and `vault auth move` command will no longer attempt to write to storage on performance standby nodes. [[GH-28059](https://github.com/hashicorp/vault/pull/28059)]
+* config: Vault TCP listener config now correctly supports the documented proxy_protocol_behavior
+setting of 'deny_unauthorized' [[GH-27459](https://github.com/hashicorp/vault/pull/27459)]
+* core (enterprise): Fix 500 errors that occurred querying `sys/internal/ui/mounts` for a mount prefixed by a namespace path when path filters are configured. [[GH-27939](https://github.com/hashicorp/vault/pull/27939)]
+* core (enterprise): Fix HTTP redirects in namespaces to use the correct path and (in the case of event subscriptions) the correct URI scheme. [[GH-27660](https://github.com/hashicorp/vault/pull/27660)]
+* core (enterprise): Fix deletion of MFA login-enforcement configurations on standby nodes
+* core/audit: Audit logging a Vault request/response checks if the existing context
+is cancelled and will now use a new context with a 5 second timeout.
+If the existing context is cancelled a new context, will be used. [[GH-27531](https://github.com/hashicorp/vault/pull/27531)]
+* core/config: fix issue when using `proxy_protocol_behavior` with `deny_unauthorized`,
+which causes the Vault TCP listener to close after receiving an untrusted upstream proxy connection. [[GH-27589](https://github.com/hashicorp/vault/pull/27589)]
+* core/identity: Fixed an issue where deleted/reassigned entity-aliases were not removed from in-memory database. [[GH-27750](https://github.com/hashicorp/vault/pull/27750)]
+* core/seal (enterprise): Fix bug that caused seal generation information to be replicated, which prevented disaster recovery and performance replication clusters from using their own seal high-availability configuration.
+* core: Fixed an issue where maximum request duration timeout was not being added to all requests containing strings sys/monitor and sys/events. With this change, timeout is now added to all requests except monitor and events endpoint. [[GH-28230](https://github.com/hashicorp/vault/pull/28230)]
+* core: Fixed an issue with performance standbys not being able to handle rotate root requests. [[GH-27631](https://github.com/hashicorp/vault/pull/27631)]
+* database/postgresql: Fix potential error revoking privileges in postgresql database secrets engine when a schema contains special characters [[GH-28519](https://github.com/hashicorp/vault/pull/28519)]
+* databases: fix issue where local timezone was getting lost when using a rotation schedule cron [[GH-28509](https://github.com/hashicorp/vault/pull/28509)]
+* helper/pkcs7: Fix parsing certain messages containing only certificates [[GH-27435](https://github.com/hashicorp/vault/pull/27435)]
+* identity/oidc: prevent JWKS from being generated by multiple concurrent requests [[GH-27929](https://github.com/hashicorp/vault/pull/27929)]
+* licensing (enterprise): fixed issue where billing start date might not be correctly updated on performance standbys
+* proxy/cache (enterprise): Fixed a data race that could occur while tracking capabilities in Proxy's static secret cache. [[GH-28494](https://github.com/hashicorp/vault/pull/28494)]
+* proxy/cache (enterprise): Fixed an issue where Proxy with static secret caching enabled would not correctly handle requests to older secret versions for KVv2 secrets. Proxy's static secret cache now properly handles all requests relating to older versions for KVv2 secrets. [[GH-28207](https://github.com/hashicorp/vault/pull/28207)]
+* proxy/cache (enterprise): Fixed an issue where Proxy would not correctly update KV secrets when talking to a perf standby. Proxy will now attempt to forward requests to update secrets triggered by events to the active node. Note that this requires `allow_forwarding_via_header` to be configured on the cluster. [[GH-27891](https://github.com/hashicorp/vault/pull/27891)]
+* proxy/cache (enterprise): Fixed an issue where cached static secrets could fail to update if the secrets belonged to a non-root namespace. [[GH-27730](https://github.com/hashicorp/vault/pull/27730)]
+* proxy: Fixed an issue causing excessive CPU usage during normal operation [[GH-27518](https://github.com/hashicorp/vault/pull/27518)]
+* raft/autopilot: Fixed panic that may occur during shutdown [[GH-27726](https://github.com/hashicorp/vault/pull/27726)]
+* replication (enterprise): fix cache invalidation issue leading to namespace custom metadata not being shown correctly on performance secondaries
+* secrets-sync (enterprise): Destination set/remove operations will no longer be blocked as "purge in progress" after a purge job ended in failure.
+* secrets-sync (enterprise): Fix KV secret access sometimes being denied, due to a double forward-slash (`//`) in the mount path, when the token should otherwise have access.
+* secrets-sync (enterprise): Normalize custom_tag keys and values for recoverable invalid characters.
+* secrets-sync (enterprise): Normalize secret key names before storing the external_name in a secret association.
+* secrets-sync (enterprise): Patching github sync destination credentials will properly update and save the new credentials.
+* secrets-sync (enterprise): Properly remove tags from secrets in AWS when they are removed from the source association
+* secrets-sync (enterprise): Return an error immediately on destination creation when providing invalid custom_tags based on destination type.
+* secrets-sync (enterprise): Return more accurate error code for invalid connection details
+* secrets-sync (enterprise): Secondary nodes in a cluster now properly check activation-flags values.
+* secrets-sync (enterprise): Skip invalid GitHub repository names when creating destinations
+* secrets-sync (enterprise): Validate corresponding GitHub app parameters `app_name` and `installation_id` are set
+* secrets/database: Skip connection verification on reading existing DB connection configuration [[GH-28139](https://github.com/hashicorp/vault/pull/28139)]
+* secrets/identity (enterprise): Fix a bug that can cause DR promotion to fail in rare cases where a PR secondary has inconsistent alias information in storage.
+* secrets/pki: fix lack of serial number to a certificate read resulting in a server side error. [[GH-27681](https://github.com/hashicorp/vault/pull/27681)]
+* secrets/transit (enterprise): Fix an issue that caused input data be returned as part of generated CMAC values.
+* storage/azure: Fix invalid account name initialization bug [[GH-27563](https://github.com/hashicorp/vault/pull/27563)]
+* storage/raft (enterprise): Fix issue with namespace cache not getting cleared on snapshot restore, resulting in namespaces not found in the snapshot being inaccurately represented by API responses. [[GH-27474](https://github.com/hashicorp/vault/pull/27474)]
+* storage/raft: Fix auto_join not working with mDNS provider. [[GH-25080](https://github.com/hashicorp/vault/pull/25080)]
+* sys: Fix a bug where mounts of external plugins that were registered before Vault v1.0.0 could not be tuned to
+use versioned plugins. [[GH-27881](https://github.com/hashicorp/vault/pull/27881)]
+* ui: Allow creation of session_token type roles for AWS secret backend [[GH-27424](https://github.com/hashicorp/vault/pull/27424)]
+* ui: Display an error and force a timeout when TOTP passcode is incorrect [[GH-27574](https://github.com/hashicorp/vault/pull/27574)]
+* ui: Ensure token expired banner displays when batch token expires [[GH-27479](https://github.com/hashicorp/vault/pull/27479)]
+* ui: Fix UI improperly checking capabilities for enabling performance and dr replication [[GH-28371](https://github.com/hashicorp/vault/pull/28371)]
+* ui: Fix cursor jump on KVv2 json editor that would occur after pressing ENTER. [[GH-27569](https://github.com/hashicorp/vault/pull/27569)]
+* ui: fix `default_role` input missing from oidc auth method configuration form [[GH-28539](https://github.com/hashicorp/vault/pull/28539)]
+* ui: fix issue where enabling then disabling "Tidy ACME" in PKI results in failed API call. [[GH-27742](https://github.com/hashicorp/vault/pull/27742)]
+* ui: fix namespace picker not working when in small screen where the sidebar is collapsed by default. [[GH-27728](https://github.com/hashicorp/vault/pull/27728)]
+* ui: fixes renew-self being called right after login for non-renewable tokens [[GH-28204](https://github.com/hashicorp/vault/pull/28204)]
+* ui: fixes toast (flash) alert message saying "created" when deleting a kv v2 secret [[GH-28093](https://github.com/hashicorp/vault/pull/28093)]
+
+## 1.17.18 Enterprise
+### June 25, 2025
 
 SECURITY:
 
-* ui: key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. [[HSEC-2023-17](https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814)]
+* core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes. [[GH-30794](https://github.com/hashicorp/vault/pull/30794)],[[HCSEC-2025-11](https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570)]
+* core/identity: vault root namespace operator may elevate privileges (CVE-2025-5999). Fix string contains check in Identity APIs to be case-insensitive. [[GH-31045](https://github.com/hashicorp/vault/pull/31045),[HCSEC-2025-13](https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032)]
 
 CHANGES:
 
-* core: Bump Go version to 1.19.9.
-* core: Revert #19676 (VAULT_GRPC_MIN_CONNECT_TIMEOUT env var) as we decided it was unnecessary. [[GH-20826](https://github.com/hashicorp/vault/pull/20826)]
-
-IMPROVEMENTS:
-
-* audit: add a `mount_point` field to audit requests and response entries [[GH-20411](https://github.com/hashicorp/vault/pull/20411)]
-* command/server: Add support for dumping pprof files to the filesystem via SIGUSR2 when
-`VAULT_PPROF_WRITE_TO_FILE=true` is set on the server. [[GH-20609](https://github.com/hashicorp/vault/pull/20609)]
-* core: include namespace path in granting_policies block of audit log
-* openapi: Fix generated types for duration strings [[GH-20841](https://github.com/hashicorp/vault/pull/20841)]
-* sdk/framework: Fix non-deterministic ordering of 'required' fields in OpenAPI spec [[GH-20881](https://github.com/hashicorp/vault/pull/20881)]
-* secrets/pki: add subject key identifier to read key response [[GH-20642](https://github.com/hashicorp/vault/pull/20642)]
-* ui: update TTL picker for consistency [[GH-18114](https://github.com/hashicorp/vault/pull/18114)]
-
-BUG FIXES:
-
-* api: Properly Handle nil identity_policies in Secret Data [[GH-20636](https://github.com/hashicorp/vault/pull/20636)]
-* auth/ldap: Set default value for `max_page_size` properly [[GH-20453](https://github.com/hashicorp/vault/pull/20453)]
-* cli: CLI should take days as a unit of time for ttl like flags [[GH-20477](https://github.com/hashicorp/vault/pull/20477)]
-* cli: disable printing flags warnings messages for the ssh command [[GH-20502](https://github.com/hashicorp/vault/pull/20502)]
-* core (enterprise): Fix log shipper buffer size overflow issue for 32 bit architecture.
-* core (enterprise): Fix logshipper buffer size to default to DefaultBufferSize only when reported system memory is zero.
-* core (enterprise): Remove MFA Enforcment configuration for namespace when deleting namespace
-* core: prevent panic on login after namespace is deleted that had mfa enforcement [[GH-20375](https://github.com/hashicorp/vault/pull/20375)]
-* replication (enterprise): Fix a race condition with invalid tokens during WAL streaming that was causing Secondary clusters to be unable to connect to a Primary.
-* replication (enterprise): fix bug where secondary grpc connections would timeout when connecting to a primary host that no longer exists.
-* secrets/transform (enterprise): Fix a caching bug affecting secondary nodes after a tokenization key rotation
-* secrets/transit: Fix export of HMAC-only key, correctly exporting the key used for sign operations. For consumers of the previously incorrect key, use the plaintext export to retrieve these incorrect keys and import them as new versions.
-secrets/transit: Fix bug related to shorter dedicated HMAC key sizing.
-sdk/helper/keysutil: New HMAC type policies will have HMACKey equal to Key and be copied over on import. [[GH-20864](https://github.com/hashicorp/vault/pull/20864)]
-* ui: Fixes issue unsealing cluster for seal types other than shamir [[GH-20897](https://github.com/hashicorp/vault/pull/20897)]
-
-## 1.12.6
-### April 26, 2023
+* api: Update the default API client to check for the `Retry-After` header and, if it exists, wait for the specified duration before retrying the request. [[GH-30887](https://github.com/hashicorp/vault/pull/30887)]
+* auth/azure: Update plugin to v0.18.4
+* core: Bump Go version to 1.23.10
+* quotas/rate-limit: Round up the `Retry-After` value to the nearest second when calculating the retry delay. [[GH-30887](https://github.com/hashicorp/vault/pull/30887)]
+* secrets/azure: Update plugin to v0.19.4
+* secrets/database: Update vault-plugin-database-snowflake to v0.11.2
 
-CHANGES:
+BUG FIXES:
 
-* core: Bump Go version to 1.19.8.
+* secrets/database: Treat all rotation_schedule values as UTC to ensure consistent behavior. [[GH-30606](https://github.com/hashicorp/vault/pull/30606)]
+* secrets/transit (enterprise): ensure verify endpoint always returns valid field in batch_results with CMAC
+* secrets/transit: ensure verify endpoint always returns valid field in batch_results with HMAC [[GH-30852](https://github.com/hashicorp/vault/pull/30852)]
+* ui: Redirect users authenticating with Vault as an OIDC provider to log in again when token expires. [[GH-30838](https://github.com/hashicorp/vault/pull/30838)]
 
-IMPROVEMENTS:
 
-* cli/namespace: Add detailed flag to output additional namespace information
-such as namespace IDs and custom metadata. [[GH-20243](https://github.com/hashicorp/vault/pull/20243)]
-* core/activity: add an endpoint to write test activity log data, guarded by a build flag [[GH-20019](https://github.com/hashicorp/vault/pull/20019)]
-* core: Add a `raft` sub-field to the `storage` and `ha_storage` details provided by the
-`/sys/config/state/sanitized` endpoint in order to include the `max_entry_size`. [[GH-20044](https://github.com/hashicorp/vault/pull/20044)]
-* sdk/ldaputil: added `connection_timeout` to tune connection timeout duration
-for all LDAP plugins. [[GH-20144](https://github.com/hashicorp/vault/pull/20144)]
-* secrets/pki: Decrease size and improve compatibility of OCSP responses by removing issuer certificate. [[GH-20201](https://github.com/hashicorp/vault/pull/20201)]
-
-BUG FIXES:
-
-* auth/ldap: Add max_page_size configurable to LDAP configuration [[GH-19032](https://github.com/hashicorp/vault/pull/19032)]
-* command/server: Fix incorrect paths in generated config for `-dev-tls` flag on Windows [[GH-20257](https://github.com/hashicorp/vault/pull/20257)]
-* core (enterprise): Fix intermittent issue with token entries sometimes not being found when using a newly created token in a request to a secondary, even when SSCT `new_token` forwarding is set. When this occurred, this would result in the following error to the client: `error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue`.
-* core (enterprise): Fix read on perf standbys failing with 412 after leadership change, unseal, restores or restarts when no writes occur
-* core/ssct (enterprise): Fixed race condition where a newly promoted DR may revert `sscGenCounter`
-resulting in 412 errors.
-* core: Fix regression breaking non-raft clusters whose nodes share the same cluster_addr/api_addr. [[GH-19721](https://github.com/hashicorp/vault/pull/19721)]
-* helper/random: Fix race condition in string generator helper [[GH-19875](https://github.com/hashicorp/vault/pull/19875)]
-* kmip (enterprise): Fix a problem decrypting with keys that have no Process Start Date attribute.
-* openapi: Fix many incorrect details in generated API spec, by using better techniques to parse path regexps [[GH-18554](https://github.com/hashicorp/vault/pull/18554)]
-* pki: Fix automatically turning off CRL signing on upgrade to Vault >= 1.12, if CA Key Usage disallows it [[GH-20220](https://github.com/hashicorp/vault/pull/20220)]
-* replication (enterprise): Fix a caching issue when replicating filtered data to
-a performance secondary. This resulted in the data being set to nil in the cache
-and a "invalid value" error being returned from the API.
-* replication (enterprise): Fix replication status for Primary clusters showing its primary cluster's information (in case of DR) in secondaries field when known_secondaries field is nil
-* secrets/pki: Fix patching of leaf_not_after_behavior on issuers. [[GH-20341](https://github.com/hashicorp/vault/pull/20341)]
-* secrets/transform (enterprise): Address SQL connection leak when cleaning expired tokens
-* ui: Fix OIDC provider logo showing when domain doesn't match [[GH-20263](https://github.com/hashicorp/vault/pull/20263)]
-* ui: Fix bad link to namespace when namespace name includes `.` [[GH-19799](https://github.com/hashicorp/vault/pull/19799)]
-* ui: fixes browser console formatting for help command output [[GH-20064](https://github.com/hashicorp/vault/pull/20064)]
-* ui: remove use of htmlSafe except when first sanitized [[GH-20235](https://github.com/hashicorp/vault/pull/20235)]
-
-## 1.12.5
-### March 29, 2023
+## 1.17.17 Enterprise
+### May 30, 2025
 
-SECURITY:
+CHANGES:
 
-* storage/mssql: When using Vault’s community-supported Microsoft SQL (MSSQL) database storage backend, a privileged attacker with the ability to write arbitrary data to Vault’s configuration may be able to perform arbitrary SQL commands on the underlying database server through Vault. This vulnerability, CVE-2023-0620, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-12](https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080)]
-* secrets/pki: Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. This vulnerability, CVE-2023-0665, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-11](https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079)]
-* core: HashiCorp Vault’s implementation of Shamir’s secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. This vulnerability, CVE-2023-25000, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-10](https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078)]
+* Update vault-plugin-auth-cf to v0.18.2
+* auth/azure: Upgrade plugin to v0.18.3
+* database/snowflake: Update plugin to v0.11.1
 
 IMPROVEMENTS:
 
-* auth/github: Allow for an optional Github auth token environment variable to make authenticated requests when fetching org id
-website/docs: Add docs for `VAULT_AUTH_CONFIG_GITHUB_TOKEN` environment variable when writing Github config [[GH-19244](https://github.com/hashicorp/vault/pull/19244)]
-* core: Allow overriding gRPC connect timeout via VAULT_GRPC_MIN_CONNECT_TIMEOUT. This is an env var rather than a config setting because we don't expect this to ever be needed.  It's being added as a last-ditch
-option in case all else fails for some replication issues we may not have fully reproduced. [[GH-19676](https://github.com/hashicorp/vault/pull/19676)]
-* core: validate name identifiers in mssql physical storage backend prior use [[GH-19591](https://github.com/hashicorp/vault/pull/19591)]
+* ui: Replaces all instances of the deprecated event.keyCode with event.key [[GH-30493](https://github.com/hashicorp/vault/pull/30493)]
 
 BUG FIXES:
 
-* cli: Fix vault read handling to return raw data as secret.Data when there is no top-level data object from api response. [[GH-17913](https://github.com/hashicorp/vault/pull/17913)]
-* core (enterprise): Attempt to reconnect to a PKCS#11 HSM if we retrieve a CKR_FUNCTION_FAILED error.
-* core: Fixed issue with remounting mounts that have a non-trailing space in the 'to' or 'from' paths. [[GH-19585](https://github.com/hashicorp/vault/pull/19585)]
-* kmip (enterprise): Do not require attribute Cryptographic Usage Mask when registering Secret Data managed objects.
-* kmip (enterprise): Fix a problem forwarding some requests to the active node.
-* openapi: Fix logic for labeling unauthenticated/sudo paths. [[GH-19600](https://github.com/hashicorp/vault/pull/19600)]
-* secrets/ldap: Invalidates WAL entry for static role if `password_policy` has changed. [[GH-19641](https://github.com/hashicorp/vault/pull/19641)]
-* secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
-* ui: fixes issue navigating back a level using the breadcrumb from secret metadata view [[GH-19703](https://github.com/hashicorp/vault/pull/19703)]
-* ui: pass encodeBase64 param to HMAC transit-key-actions. [[GH-19429](https://github.com/hashicorp/vault/pull/19429)]
-* ui: use URLSearchParams interface to capture namespace param from SSOs (ex. ADFS) with decoded state param in callback url [[GH-19460](https://github.com/hashicorp/vault/pull/19460)]
+* plugins (enterprise): Fix an issue where Enterprise plugins can't run on a standby node
+when it becomes active because standby nodes don't extract the artifact when the plugin
+is registered. Remove extracting from Vault and require the operator to place
+the extracted artifact in the plugin directory before registration.
 
-## 1.12.4
-### March 01, 2023
+## 1.17.16 Enterprise
+### April 30, 2025
 
 SECURITY:
-* auth/approle: When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999 has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above. [[HSEC-2023-07](https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305)]
 
-CHANGES:
+* core: vault may expose sensitive information in error logs when processing malformed data with the kv v2 plugin[[GH-30388](https://github.com/hashicorp/vault/pull/30388), [HCSEC-2025-09](https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717)]
 
-* core: Bump Go version to 1.19.6.
+BUG FIXES:
 
-IMPROVEMENTS:
+* core (enterprise): fix issue with errors being swallowed on failed HSM logins.
+* database: Prevent static roles created in versions prior to 1.15.0 from rotating on backend restart. [[GH-30320](https://github.com/hashicorp/vault/pull/30320)]
+* database: no longer incorrectly add an "unrecognized parameters" warning for certain SQL database secrets config operations when another warning is returned [[GH-30327](https://github.com/hashicorp/vault/pull/30327)]
 
-* secrets/database: Adds error message requiring password on root crednetial rotation. [[GH-19103](https://github.com/hashicorp/vault/pull/19103)]
-* ui: remove wizard [[GH-19220](https://github.com/hashicorp/vault/pull/19220)]
+## 1.17.15 Enterprise
+### April 18, 2025
 
-BUG FIXES:
+CHANGES:
 
-* auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [[GH-19186](https://github.com/hashicorp/vault/pull/19186)]
-* core (enterprise): Fix panic when using invalid accessor for control-group request
-* core (enterprise): Fix perf standby WAL streaming silently failures when replication setup happens at a bad time.
-* core: Prevent panics in `sys/leases/lookup`, `sys/leases/revoke`, and `sys/leases/renew` endpoints if provided `lease_id` is null [[GH-18951](https://github.com/hashicorp/vault/pull/18951)]
-* license (enterprise): Fix bug where license would update even if the license didn't change.
-* replication (enterprise): Fix bug where reloading external plugin on a secondary would
-break replication.
-* secrets/ad: Fix bug where config couldn't be updated unless binddn/bindpass were included in the update. [[GH-18207](https://github.com/hashicorp/vault/pull/18207)]
-* secrets/pki: Revert fix for PR [18938](https://github.com/hashicorp/vault/pull/18938) [[GH-19037](https://github.com/hashicorp/vault/pull/19037)]
-* server/config:  Use file.Stat when checking file permissions when VAULT_ENABLE_FILE_PERMISSIONS_CHECK is enabled [[GH-19311](https://github.com/hashicorp/vault/pull/19311)]
-* ui (enterprise): Fix cancel button from transform engine role creation page [[GH-19135](https://github.com/hashicorp/vault/pull/19135)]
-* ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [[GH-19071](https://github.com/hashicorp/vault/pull/19071)]
-* ui: fixes reliance on secure context (https) by removing methods using the Crypto interface [[GH-19410](https://github.com/hashicorp/vault/pull/19410)]
-* ui: show Get credentials button for static roles detail page when a user has the proper permissions. [[GH-19190](https://github.com/hashicorp/vault/pull/19190)]
+* core: Bump Go version to 1.23.7
+* core: Bump Go version to 1.23.8
 
-## 1.12.3
-### February 6, 2023
+BUG FIXES:
 
-CHANGES:
+* secrets/openldap: Prevent static role rotation on upgrade when `NextVaultRotation` is nil. Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing `NextVaultRotation` value. Now sets it to either `LastVaultRotation + RotationPeriod` or `now + RotationPeriod`. [[GH-30265](https://github.com/hashicorp/vault/pull/30265)]
+* secrets/transit: fix a panic when rotating on a managed key returns an error [[GH-30214](https://github.com/hashicorp/vault/pull/30214)]
 
-* core: Bump Go version to 1.19.4.
+## 1.17.14 Enterprise
+### April 04, 2025
 
-IMPROVEMENTS:
+SECURITY:
 
-* audit: Include stack trace when audit logging recovers from a panic. [[GH-18121](https://github.com/hashicorp/vault/pull/18121)]
-* command/server: Environment variable keys are now logged at startup. [[GH-18125](https://github.com/hashicorp/vault/pull/18125)]
-* core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
-* core: Add read support to `sys/loggers` and `sys/loggers/:name` endpoints [[GH-17979](https://github.com/hashicorp/vault/pull/17979)]
-* plugins: Let Vault unseal and mount deprecated builtin plugins in a
-deactivated state if this is not the first unseal after an upgrade. [[GH-17879](https://github.com/hashicorp/vault/pull/17879)]
-* secrets/db/mysql: Add `tls_server_name` and `tls_skip_verify` parameters [[GH-18799](https://github.com/hashicorp/vault/pull/18799)]
-* secrets/kv: new KVv2 mounts and KVv1 mounts without any keys will upgrade synchronously, allowing for instant use [[GH-17406](https://github.com/hashicorp/vault/pull/17406)]
-* storage/raft: add additional raft metrics relating to applied index and heartbeating; also ensure OSS standbys emit periodic metrics. [[GH-12166](https://github.com/hashicorp/vault/pull/12166)]
-* ui: Added JWT authentication warning message about blocked pop-up windows and web browser settings. [[GH-18787](https://github.com/hashicorp/vault/pull/18787)]
-* ui: Prepends "passcode=" if not provided in user input for duo totp mfa method authentication [[GH-18342](https://github.com/hashicorp/vault/pull/18342)]
-* ui: Update language on database role to "Connection name" [[GH-18261](https://github.com/hashicorp/vault/issues/18261)] [[GH-18350](https://github.com/hashicorp/vault/pull/18350)]
-
-BUG FIXES:
-
-* auth/approle: Fix `token_bound_cidrs` validation when using /32 blocks for role and secret ID [[GH-18145](https://github.com/hashicorp/vault/pull/18145)]
-* auth/cert: Address a race condition accessing the loaded crls without a lock [[GH-18945](https://github.com/hashicorp/vault/pull/18945)]
-* auth/kubernetes: Ensure a consistent TLS configuration for all k8s API requests [[#173](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/173)] [[GH-18716](https://github.com/hashicorp/vault/pull/18716)]
-* cli/kv: skip formatting of nil secrets for patch and put with field parameter set [[GH-18163](https://github.com/hashicorp/vault/pull/18163)]
-* command/namespace: Fix vault cli namespace patch examples in help text. [[GH-18143](https://github.com/hashicorp/vault/pull/18143)]
-* core (enterprise): Fix a race condition resulting in login errors to PKCS#11 modules under high concurrency.
-* core/managed-keys (enterprise): Limit verification checks to mounts in a key's namespace
-* core/quotas (enterprise): Fix a potential deadlock that could occur when using lease count quotas.
-* core/quotas: Fix issue with improper application of default rate limit quota exempt paths [[GH-18273](https://github.com/hashicorp/vault/pull/18273)]
-* core/seal: Fix regression handling of the key_id parameter in seal configuration HCL. [[GH-17612](https://github.com/hashicorp/vault/pull/17612)]
-* core: fix bug where context cancellations weren't forwarded to active node from performance standbys.
-* core: prevent panic in login mfa enforcement delete after enforcement's namespace is deleted [[GH-18923](https://github.com/hashicorp/vault/pull/18923)]
-* database/mongodb: Fix writeConcern set to be applied to any query made on the database [[GH-18546](https://github.com/hashicorp/vault/pull/18546)]
-* expiration: Prevent panics on perf standbys when an irrevocable lease gets deleted. [[GH-18401](https://github.com/hashicorp/vault/pull/18401)]
-* kmip (enterprise): Fix Destroy operation response that omitted Unique Identifier on some batched responses.
-* kmip (enterprise): Fix Locate operation response incompatibility with clients using KMIP versions prior to 1.3.
-* kmip (enterprise): Fix Query operation response that omitted streaming capability and supported profiles.
-* licensing (enterprise): update autoloaded license cache after reload
-* plugins: Allow running external plugins which override deprecated builtins. [[GH-17879](https://github.com/hashicorp/vault/pull/17879)]
-* plugins: Listing all plugins while audit logging is enabled will no longer result in an internal server error. [[GH-18173](https://github.com/hashicorp/vault/pull/18173)]
-* plugins: Skip loading but still mount data associated with missing plugins on unseal. [[GH-18189](https://github.com/hashicorp/vault/pull/18189)]
-* sdk: Don't panic if system view or storage methods called during plugin setup. [[GH-18210](https://github.com/hashicorp/vault/pull/18210)]
-* secrets/pki: Address nil panic when an empty POST request is sent to the OCSP handler [[GH-18184](https://github.com/hashicorp/vault/pull/18184)]
-* secrets/pki: Allow patching issuer to set an empty issuer name. [[GH-18466](https://github.com/hashicorp/vault/pull/18466)]
-* secrets/pki: OCSP GET request parameter was not being URL unescaped before processing. [[GH-18938](https://github.com/hashicorp/vault/pull/18938)]
-* secrets/pki: fix race between tidy's cert counting and tidy status reporting. [[GH-18899](https://github.com/hashicorp/vault/pull/18899)]
-* secrets/transit: Do not warn about unrecognized parameter 'batch_input' [[GH-18299](https://github.com/hashicorp/vault/pull/18299)]
-* secrets/transit: Honor `partial_success_response_code` on decryption failures. [[GH-18310](https://github.com/hashicorp/vault/pull/18310)]
-* storage/raft (enterprise): An already joined node can rejoin by wiping storage
-and re-issueing a join request, but in doing so could transiently become a
-non-voter.  In some scenarios this resulted in loss of quorum. [[GH-18263](https://github.com/hashicorp/vault/pull/18263)]
-* storage/raft: Don't panic on unknown raft ops [[GH-17732](https://github.com/hashicorp/vault/pull/17732)]
-* ui: cleanup unsaved auth method ember data record when navigating away from mount backend form [[GH-18651](https://github.com/hashicorp/vault/pull/18651)]
-* ui: fixes query parameters not passed in api explorer test requests [[GH-18743](https://github.com/hashicorp/vault/pull/18743)]
-## 1.12.2
-### November 30, 2022
+* auth/azure: Update plugin to v0.18.2. Login requires `resource_group_name`, `vm_name`, and `vmss_name` to match token claims [[HCSEC-2025-07](https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716)].
 
 CHANGES:
 
-* core: Bump Go version to 1.19.3.
-* plugins: Mounts can no longer be pinned to a specific _builtin_ version. Mounts previously pinned to a specific builtin version will now automatically upgrade to the latest builtin version, and may now be overridden if an unversioned plugin of the same name and type is registered. Mounts using plugin versions without `builtin` in their metadata remain unaffected. [[GH-18051](https://github.com/hashicorp/vault/pull/18051)]
+* core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [[GH-29774](https://github.com/hashicorp/vault/pull/29774)]
 
 IMPROVEMENTS:
 
-* secrets/pki: Allow issuer creation, import to change default issuer via `default_follows_latest_issuer`. [[GH-17824](https://github.com/hashicorp/vault/pull/17824)]
-* storage/raft: Add `retry_join_as_non_voter` config option. [[GH-18030](https://github.com/hashicorp/vault/pull/18030)]
+* core (enterprise): report errors from the underlying seal when getting entropy.
 
 BUG FIXES:
 
-* auth/okta: fix a panic for AuthRenew in Okta [[GH-18011](https://github.com/hashicorp/vault/pull/18011)]
-* auth: Deduplicate policies prior to ACL generation [[GH-17914](https://github.com/hashicorp/vault/pull/17914)]
-* cli: Fix issue preventing kv commands from executing properly when the mount path provided by `-mount` flag and secret key path are the same. [[GH-17679](https://github.com/hashicorp/vault/pull/17679)]
-* core (enterprise): Supported storage check in `vault server` command will no longer prevent startup. Instead, a warning will be logged if configured to use storage backend other than `raft` or `consul`.
-* core/quotas (enterprise): Fix a lock contention issue that could occur and cause Vault to become unresponsive when creating, changing, or deleting lease count quotas.
-* core: Fix potential deadlock if barrier ciphertext is less than 4 bytes. [[GH-17944](https://github.com/hashicorp/vault/pull/17944)]
-* core: fix a start up race condition where performance standbys could go into a
-  mount loop if default policies are not yet synced from the active node. [[GH-17801](https://github.com/hashicorp/vault/pull/17801)]
-* plugins: Only report deprecation status for builtin plugins. [[GH-17816](https://github.com/hashicorp/vault/pull/17816)]
-* plugins: Vault upgrades will no longer fail if a mount has been created using an explicit builtin plugin version. [[GH-18051](https://github.com/hashicorp/vault/pull/18051)]
-* secret/pki: fix bug with initial legacy bundle migration (from < 1.11 into 1.11+) and missing issuers from ca_chain [[GH-17772](https://github.com/hashicorp/vault/pull/17772)]
-* secrets/azure: add WAL to clean up role assignments if errors occur [[GH-18086](https://github.com/hashicorp/vault/pull/18086)]
-* secrets/gcp: Fixes duplicate service account key for rotate root on standby or secondary [[GH-18111](https://github.com/hashicorp/vault/pull/18111)]
-* secrets/pki: Fix upgrade of missing expiry, delta_rebuild_interval by setting them to the default. [[GH-17693](https://github.com/hashicorp/vault/pull/17693)]
-* ui: Fixes issue with not being able to download raft snapshot via service worker [[GH-17769](https://github.com/hashicorp/vault/pull/17769)]
-* ui: fix entity policies list link to policy show page [[GH-17950](https://github.com/hashicorp/vault/pull/17950)]
-
-## 1.12.1
-### November 2, 2022
-
-IMPROVEMENTS:
+* auth/ldap: Fix a bug that does not properly delete users and groups by first converting their names to lowercase when case senstivity option is off. [[GH-29922](https://github.com/hashicorp/vault/pull/29922)]
+* core: Fix Azure authentication for seal/managed keys to work for both federated workload identity and managed user identities.  Fixes regression for federated workload identities. [[GH-29792](https://github.com/hashicorp/vault/pull/29792)]
+* core: Fix a bug that prevents certain loggers from writing to a log file. [[GH-29917](https://github.com/hashicorp/vault/pull/29917)]
+* export API: Normalize the start_date parameter to the start of the month as is done in the sys/counters API to keep the results returned from both of the API's consistent. [[GH-29562](https://github.com/hashicorp/vault/pull/29562)]
+* plugins (enterprise): Fix plugin registration with artifact when a binary for the same plugin is already present in the plugin directory.
+* plugins: plugin registration should honor the `plugin_tmpdir` config [[GH-29978](https://github.com/hashicorp/vault/pull/29978)]
+* secrets/azure: Upgrade plugin to v0.19.3 which reverts role name changes to no longer be a GUID.
+* secrets/database: Fix a bug where a global database plugin reload exits if any of the database connections are not available [[GH-29519](https://github.com/hashicorp/vault/pull/29519)]
 
-* api: Support VAULT_DISABLE_REDIRECTS environment variable (and --disable-redirects flag) to disable default client behavior and prevent the client following any redirection responses. [[GH-17352](https://github.com/hashicorp/vault/pull/17352)]
-* database/snowflake: Allow parallel requests to Snowflake [[GH-17593](https://github.com/hashicorp/vault/pull/17593)]
-* plugins: Add plugin version information to key plugin lifecycle log lines. [[GH-17430](https://github.com/hashicorp/vault/pull/17430)]
-* sdk/ldap: Added support for paging when searching for groups using group filters [[GH-17640](https://github.com/hashicorp/vault/pull/17640)]
+## 1.17.13 Enterprise
+### March 5, 2025
 
 BUG FIXES:
 
-* cli: Remove empty table heading for `vault secrets list -detailed` output. [[GH-17577](https://github.com/hashicorp/vault/pull/17577)]
-* core/managed-keys (enterprise): Return better error messages when encountering key creation failures
-* core/managed-keys (enterprise): Switch to using hash length as PSS Salt length within the test/sign api for better PKCS#11 compatibility
-* core: Fix panic caused in Vault Agent when rendering certificate templates [[GH-17419](https://github.com/hashicorp/vault/pull/17419)]
-* core: Fixes spurious warnings being emitted relating to "unknown or unsupported fields" for JSON config [[GH-17660](https://github.com/hashicorp/vault/pull/17660)]
-* core: prevent memory leak when using control group factors in a policy [[GH-17532](https://github.com/hashicorp/vault/pull/17532)]
-* core: prevent panic during mfa after enforcement's namespace is deleted [[GH-17562](https://github.com/hashicorp/vault/pull/17562)]
-* kmip (enterprise): Fix a problem in the handling of attributes that caused Import operations to fail.
-* kmip (enterprise): Fix selection of Cryptographic Parameters for Encrypt/Decrypt operations.
-* login: Store token in tokenhelper for interactive login MFA [[GH-17040](https://github.com/hashicorp/vault/pull/17040)]
-* secrets/pki: Respond to tidy-status, tidy-cancel on PR Secondary clusters. [[GH-17497](https://github.com/hashicorp/vault/pull/17497)]
-* ui: Fixes oidc/jwt login issue with alternate mount path and jwt login via mount path tab [[GH-17661](https://github.com/hashicorp/vault/pull/17661)]
+* agent: Fixed an issue where giving the agent multiple config files could cause the merged config to be incorrect
+when `template_config` is set in one of the config files. [[GH-29680](https://github.com/hashicorp/vault/pull/29680)]
+* ui: MFA methods now display the namespace path instead of the namespace id. [[GH-29588](https://github.com/hashicorp/vault/pull/29588)]
+* core: Fix Azure authentication for seal/managed keys to work for both federated workload identity and managed user identities.  Fixes regression for federated workload identities. [[GH-29792](https://github.com/hashicorp/vault/pull/29792)]
 
-## 1.12.0
-### October 13, 2022
+## 1.17.12 Enterprise
+### February 25, 2025
 
 SECURITY:
 
-* secrets/pki: Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s CA into memory on startup, resulting in the revocation list not being checked, if the CRL has not yet been retrieved. This vulnerability, CVE-2022-41316, is fixed in Vault 1.12.0, 1.11.4, 1.10.7, and 1.9.10. [[HSEC-2022-24](https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483)]
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.2.0
 
 CHANGES:
 
-* api: Exclusively use `GET /sys/plugins/catalog` endpoint for listing plugins, and add `details` field to list responses. [[GH-17347](https://github.com/hashicorp/vault/pull/17347)]
-* auth: `GET /sys/auth/:name` endpoint now returns an additional `deprecation_status` field in the response data for builtins. [[GH-16849](https://github.com/hashicorp/vault/pull/16849)]
-* auth: `GET /sys/auth` endpoint now returns an additional `deprecation_status` field in the response data for builtins. [[GH-16849](https://github.com/hashicorp/vault/pull/16849)]
-* auth: `POST /sys/auth/:type` endpoint response contains a warning for `Deprecated` auth methods. [[GH-17058](https://github.com/hashicorp/vault/pull/17058)]
-* auth: `auth enable` returns an error and `POST /sys/auth/:type` endpoint reports an error for `Pending Removal` auth methods. [[GH-17005](https://github.com/hashicorp/vault/pull/17005)]
-* core/entities: Fixed stranding of aliases upon entity merge, and require explicit selection of which aliases should be kept when some must be deleted [[GH-16539](https://github.com/hashicorp/vault/pull/16539)]
-* core: Bump Go version to 1.19.2.
-* core: Validate input parameters for vault operator init command. Vault 1.12 CLI version is needed to run operator init now. [[GH-16379](https://github.com/hashicorp/vault/pull/16379)]
-* identity: a request to `/identity/group` that includes `member_group_ids` that contains a cycle will now be responded to with a 400 rather than 500 [[GH-15912](https://github.com/hashicorp/vault/pull/15912)]
-* licensing (enterprise): Terminated licenses will no longer result in shutdown. Instead, upgrades will not be allowed if the license expiration time is before the build date of the binary.
-* plugins: Add plugin version to auth register, list, and mount table [[GH-16856](https://github.com/hashicorp/vault/pull/16856)]
-* plugins: `GET /sys/plugins/catalog/:type/:name` endpoint contains deprecation status for builtin plugins. [[GH-17077](https://github.com/hashicorp/vault/pull/17077)]
-* plugins: `GET /sys/plugins/catalog/:type/:name` endpoint now returns an additional `version` field in the response data. [[GH-16688](https://github.com/hashicorp/vault/pull/16688)]
-* plugins: `GET /sys/plugins/catalog/` endpoint contains deprecation status in `detailed` list. [[GH-17077](https://github.com/hashicorp/vault/pull/17077)]
-* plugins: `GET /sys/plugins/catalog` endpoint now returns an additional `detailed` field in the response data with a list of additional plugin metadata. [[GH-16688](https://github.com/hashicorp/vault/pull/16688)]
-* plugins: `plugin info` displays deprecation status for builtin plugins. [[GH-17077](https://github.com/hashicorp/vault/pull/17077)]
-* plugins: `plugin list` now accepts a `-detailed` flag, which display deprecation status and version info. [[GH-17077](https://github.com/hashicorp/vault/pull/17077)]
-* secrets/azure: Removed deprecated AAD graph API support from the secrets engine. [[GH-17180](https://github.com/hashicorp/vault/pull/17180)]
-* secrets: All database-specific (standalone DB) secrets engines are now marked `Pending Removal`. [[GH-17038](https://github.com/hashicorp/vault/pull/17038)]
-* secrets: `GET /sys/mounts/:name` endpoint now returns an additional `deprecation_status` field in the response data for builtins. [[GH-16849](https://github.com/hashicorp/vault/pull/16849)]
-* secrets: `GET /sys/mounts` endpoint now returns an additional `deprecation_status` field in the response data for builtins. [[GH-16849](https://github.com/hashicorp/vault/pull/16849)]
-* secrets: `POST /sys/mounts/:type` endpoint response contains a warning for `Deprecated` secrets engines. [[GH-17058](https://github.com/hashicorp/vault/pull/17058)]
-* secrets: `secrets enable` returns an error and `POST /sys/mount/:type` endpoint reports an error for `Pending Removal` secrets engines. [[GH-17005](https://github.com/hashicorp/vault/pull/17005)]
+* core: Bump Go version to 1.23.6
+* raft/autopilot (enterprise): Alongside the CE autopilot update, update raft-autopilot-enterprise library to v0.3.0 and add enterprise-specific regression testing.
+* secrets/openldap: Update plugin to v0.13.5
 
 FEATURES:
 
-* **GCP Cloud KMS support for managed keys**: Managed keys now support using GCP Cloud KMS keys
-* **LDAP Secrets Engine**: Adds the `ldap` secrets engine with service account check-out functionality for all supported schemas. [[GH-17152](https://github.com/hashicorp/vault/pull/17152)]
-* **OCSP Responder**: PKI mounts now have an OCSP responder that implements a subset of RFC6960, answering single serial number OCSP requests for a specific cluster's revoked certificates in a mount. [[GH-16723](https://github.com/hashicorp/vault/pull/16723)]
-* **Redis DB Engine**: Adding the new Redis database engine that supports the generation of static and dynamic user roles and root credential rotation on a stand alone Redis server. [[GH-17070](https://github.com/hashicorp/vault/pull/17070)]
-* **Redis ElastiCache DB Plugin**: Added Redis ElastiCache as a built-in plugin. [[GH-17075](https://github.com/hashicorp/vault/pull/17075)]
-* **Secrets/auth plugin multiplexing**: manage multiple plugin configurations with a single plugin process [[GH-14946](https://github.com/hashicorp/vault/pull/14946)]
-* **Transform Key Import (BYOK)**: The transform secrets engine now supports importing keys for tokenization and FPE transformations
-* HCP (enterprise): Adding foundational support for self-managed vault nodes to securely communicate with [HashiCorp Cloud Platform](https://cloud.hashicorp.com) as an opt-in feature
-* ui: UI support for Okta Number Challenge. [[GH-15998](https://github.com/hashicorp/vault/pull/15998)]
-* **Plugin Versioning**: Vault supports registering, managing, and running plugins with semantic versions specified.
+* **Plugins**: Allow Enterprise plugins to run externally on Vault Enterprise only.
 
 IMPROVEMENTS:
 
-* core/managed-keys (enterprise): Allow operators to specify PSS signatures and/or hash algorithm for the test/sign api
-* activity (enterprise): Added new clients unit tests to test accuracy of estimates
-* agent/auto-auth: Add `exit_on_err` which when set to true, will cause Agent to exit if any errors are encountered during authentication. [[GH-17091](https://github.com/hashicorp/vault/pull/17091)]
-* agent: Added `disable_idle_connections` configuration to disable leaving idle connections open in auto-auth, caching and templating. [[GH-15986](https://github.com/hashicorp/vault/pull/15986)]
-* agent: Added `disable_keep_alives` configuration to disable keep alives in auto-auth, caching and templating. [[GH-16479](https://github.com/hashicorp/vault/pull/16479)]
-* agent: JWT auto auth now supports a `remove_jwt_after_reading` config option which defaults to true. [[GH-11969](https://github.com/hashicorp/vault/pull/11969)]
-* agent: Send notifications to systemd on start and stop. [[GH-9802](https://github.com/hashicorp/vault/pull/9802)]
-* api/mfa: Add namespace path to the MFA read/list endpoint [[GH-16911](https://github.com/hashicorp/vault/pull/16911)]
-* api: Add a sentinel error for missing KV secrets [[GH-16699](https://github.com/hashicorp/vault/pull/16699)]
-* auth/alicloud: Enables AliCloud roles to be compatible with Vault's role based quotas. [[GH-17251](https://github.com/hashicorp/vault/pull/17251)]
-* auth/approle: SecretIDs can now be generated with an per-request specified TTL and num_uses.
-When either the ttl and num_uses fields are not specified, the role's configuration is used. [[GH-14474](https://github.com/hashicorp/vault/pull/14474)]
-* auth/aws: PKCS7 signatures will now use SHA256 by default in prep for Go 1.18 [[GH-16455](https://github.com/hashicorp/vault/pull/16455)]
-* auth/azure: Enables Azure roles to be compatible with Vault's role based quotas. [[GH-17194](https://github.com/hashicorp/vault/pull/17194)]
-* auth/cert: Add metadata to identity-alias [[GH-14751](https://github.com/hashicorp/vault/pull/14751)]
-* auth/cert: Operators can now specify a CRL distribution point URL, in which case the cert auth engine will fetch and use the CRL from that location rather than needing to push CRLs directly to auth/cert. [[GH-17136](https://github.com/hashicorp/vault/pull/17136)]
-* auth/cf: Enables CF roles to be compatible with Vault's role based quotas. [[GH-17196](https://github.com/hashicorp/vault/pull/17196)]
-* auth/gcp: Add support for GCE regional instance groups [[GH-16435](https://github.com/hashicorp/vault/pull/16435)]
-* auth/gcp: Updates dependencies: `google.golang.org/api@v0.83.0`, `github.com/hashicorp/go-gcp-common@v0.8.0`. [[GH-17160](https://github.com/hashicorp/vault/pull/17160)]
-* auth/jwt: Adds support for Microsoft US Gov L4 to the Azure provider for groups fetching. [[GH-16525](https://github.com/hashicorp/vault/pull/16525)]
-* auth/jwt: Improves detection of Windows Subsystem for Linux (WSL) for CLI-based logins. [[GH-16525](https://github.com/hashicorp/vault/pull/16525)]
-* auth/kerberos: add `add_group_aliases` config to include LDAP groups in Vault group aliases [[GH-16890](https://github.com/hashicorp/vault/pull/16890)]
-* auth/kerberos: add `remove_instance_name` parameter to the login CLI and the Kerberos config in Vault. This removes any instance names found in the keytab service principal name. [[GH-16594](https://github.com/hashicorp/vault/pull/16594)]
-* auth/kubernetes: Role resolution for K8S Auth [[GH-156](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/156)] [[GH-17161](https://github.com/hashicorp/vault/pull/17161)]
-* auth/oci: Add support for role resolution. [[GH-17212](https://github.com/hashicorp/vault/pull/17212)]
-* auth/oidc: Adds support for group membership parsing when using SecureAuth as an OIDC provider. [[GH-16274](https://github.com/hashicorp/vault/pull/16274)]
-* cli: CLI commands will print a warning if flags will be ignored because they are passed after positional arguments. [[GH-16441](https://github.com/hashicorp/vault/pull/16441)]
-* cli: `auth` and `secrets` list `-detailed` commands now show Deprecation Status for builtin plugins. [[GH-16849](https://github.com/hashicorp/vault/pull/16849)]
-* cli: `vault plugin list` now has a `details` field in JSON format, and version and type information in table format. [[GH-17347](https://github.com/hashicorp/vault/pull/17347)]
-* command/audit: Improve missing type error message [[GH-16409](https://github.com/hashicorp/vault/pull/16409)]
-* command/server: add `-dev-tls` and `-dev-tls-cert-dir` subcommands to create a Vault dev server with generated certificates and private key. [[GH-16421](https://github.com/hashicorp/vault/pull/16421)]
-* command: Fix shell completion for KV v2 mounts [[GH-16553](https://github.com/hashicorp/vault/pull/16553)]
-* core (enterprise): Add HTTP PATCH support for namespaces with an associated `namespace patch` CLI command
-* core (enterprise): Add check to `vault server` command to ensure configured storage backend is supported.
-* core (enterprise): Add custom metadata support for namespaces
-* core/activity: generate hyperloglogs containing clientIds for each month during precomputation [[GH-16146](https://github.com/hashicorp/vault/pull/16146)]
-* core/activity: refactor activity log api to reuse partial api functions in activity endpoint when current month is specified [[GH-16162](https://github.com/hashicorp/vault/pull/16162)]
-* core/activity: use monthly hyperloglogs to calculate new clients approximation for current month [[GH-16184](https://github.com/hashicorp/vault/pull/16184)]
-* core/quotas (enterprise): Added ability to add path suffixes for lease-count resource quotas
-* core/quotas (enterprise): Added ability to add role information for lease-count resource quotas, to limit login requests on auth mounts made using that role
-* core/quotas: Added ability to add path suffixes for rate-limit resource quotas [[GH-15989](https://github.com/hashicorp/vault/pull/15989)]
-* core/quotas: Added ability to add role information for rate-limit resource quotas, to limit login requests on auth mounts made using that role [[GH-16115](https://github.com/hashicorp/vault/pull/16115)]
-* core: Activity log goroutine management improvements to allow tests to be more deterministic. [[GH-17028](https://github.com/hashicorp/vault/pull/17028)]
-* core: Add `sys/loggers` and `sys/loggers/:name` endpoints to provide ability to modify logging verbosity [[GH-16111](https://github.com/hashicorp/vault/pull/16111)]
-* core: Handle and log deprecated builtin mounts. Introduces `VAULT_ALLOW_PENDING_REMOVAL_MOUNTS` to override shutdown and error when attempting to mount `Pending Removal` builtin plugins. [[GH-17005](https://github.com/hashicorp/vault/pull/17005)]
-* core: Limit activity log client count usage by namespaces [[GH-16000](https://github.com/hashicorp/vault/pull/16000)]
-* core: Upgrade github.com/hashicorp/raft [[GH-16609](https://github.com/hashicorp/vault/pull/16609)]
-* core: remove gox [[GH-16353](https://github.com/hashicorp/vault/pull/16353)]
-* docs: Clarify the behaviour of local mounts in the context of DR replication [[GH-16218](https://github.com/hashicorp/vault/pull/16218)]
-* identity/oidc: Adds support for detailed listing of clients and providers. [[GH-16567](https://github.com/hashicorp/vault/pull/16567)]
-* identity/oidc: Adds the `client_secret_post` token endpoint authentication method. [[GH-16598](https://github.com/hashicorp/vault/pull/16598)]
-* identity/oidc: allows filtering the list providers response by an allowed_client_id [[GH-16181](https://github.com/hashicorp/vault/pull/16181)]
-* identity: Prevent possibility of data races on entity creation. [[GH-16487](https://github.com/hashicorp/vault/pull/16487)]
-* physical/postgresql: pass context to queries to propagate timeouts and cancellations on requests. [[GH-15866](https://github.com/hashicorp/vault/pull/15866)]
-* plugins/multiplexing: Added multiplexing support to database plugins if run as external plugins [[GH-16995](https://github.com/hashicorp/vault/pull/16995)]
-* plugins: Add Deprecation Status method to builtinregistry. [[GH-16846](https://github.com/hashicorp/vault/pull/16846)]
-* plugins: Added environment variable flag to opt-out specific plugins from multiplexing [[GH-16972](https://github.com/hashicorp/vault/pull/16972)]
-* plugins: Adding version to plugin GRPC interface [[GH-17088](https://github.com/hashicorp/vault/pull/17088)]
-* plugins: Plugin catalog supports registering and managing plugins with semantic version information. [[GH-16688](https://github.com/hashicorp/vault/pull/16688)]
-* replication (enterprise): Fix race in merkle sync that can prevent streaming by returning key value matching provided hash if found in log shipper buffer.
-* secret/nomad: allow reading CA and client auth certificate from /nomad/config/access [[GH-15809](https://github.com/hashicorp/vault/pull/15809)]
-* secret/pki: Add RSA PSS signature support for issuing certificates, signing CRLs [[GH-16519](https://github.com/hashicorp/vault/pull/16519)]
-* secret/pki: Add signature_bits to sign-intermediate, sign-verbatim endpoints [[GH-16124](https://github.com/hashicorp/vault/pull/16124)]
-* secret/pki: Allow issuing certificates with non-domain, non-email Common Names from roles, sign-verbatim, and as issuers (`cn_validations`). [[GH-15996](https://github.com/hashicorp/vault/pull/15996)]
-* secret/pki: Allow specifying SKID for cross-signed issuance from older Vault versions. [[GH-16494](https://github.com/hashicorp/vault/pull/16494)]
-* secret/transit: Allow importing Ed25519 keys from PKCS#8 with inner RFC 5915 ECPrivateKey blobs (NSS-wrapped keys). [[GH-15742](https://github.com/hashicorp/vault/pull/15742)]
-* secrets/ad: set config default length only if password_policy is missing [[GH-16140](https://github.com/hashicorp/vault/pull/16140)]
-* secrets/azure: Adds option to permanently delete AzureAD objects created by Vault. [[GH-17045](https://github.com/hashicorp/vault/pull/17045)]
-* secrets/database/hana: Add ability to customize dynamic usernames [[GH-16631](https://github.com/hashicorp/vault/pull/16631)]
-* secrets/database/snowflake: Add multiplexing support [[GH-17159](https://github.com/hashicorp/vault/pull/17159)]
-* secrets/gcp: Updates dependencies: `google.golang.org/api@v0.83.0`, `github.com/hashicorp/go-gcp-common@v0.8.0`. [[GH-17174](https://github.com/hashicorp/vault/pull/17174)]
-* secrets/gcpkms: Update dependencies: google.golang.org/api@v0.83.0. [[GH-17199](https://github.com/hashicorp/vault/pull/17199)]
-* secrets/kubernetes: upgrade to v0.2.0 [[GH-17164](https://github.com/hashicorp/vault/pull/17164)]
-* secrets/pki/tidy: Add another pair of metrics counting certificates not deleted by the tidy operation. [[GH-16702](https://github.com/hashicorp/vault/pull/16702)]
-* secrets/pki: Add a new flag to issue/sign APIs which can filter out root CAs from the returned ca_chain field [[GH-16935](https://github.com/hashicorp/vault/pull/16935)]
-* secrets/pki: Add a warning to any successful response when the requested TTL is overwritten by MaxTTL [[GH-17073](https://github.com/hashicorp/vault/pull/17073)]
-* secrets/pki: Add ability to cancel tidy operations, control tidy resource usage. [[GH-16958](https://github.com/hashicorp/vault/pull/16958)]
-* secrets/pki: Add ability to periodically rebuild CRL before expiry [[GH-16762](https://github.com/hashicorp/vault/pull/16762)]
-* secrets/pki: Add ability to periodically run tidy operations to remove expired certificates. [[GH-16900](https://github.com/hashicorp/vault/pull/16900)]
-* secrets/pki: Add support for per-issuer Authority Information Access (AIA) URLs [[GH-16563](https://github.com/hashicorp/vault/pull/16563)]
-* secrets/pki: Add support to specify signature bits when generating CSRs through intermediate/generate apis [[GH-17388](https://github.com/hashicorp/vault/pull/17388)]
-* secrets/pki: Added gauge metrics "secrets.pki.total_revoked_certificates_stored" and "secrets.pki.total_certificates_stored" to track the number of certificates in storage. [[GH-16676](https://github.com/hashicorp/vault/pull/16676)]
-* secrets/pki: Allow revocation of certificates with explicitly provided certificate (bring your own certificate / BYOC). [[GH-16564](https://github.com/hashicorp/vault/pull/16564)]
-* secrets/pki: Allow revocation via proving possession of certificate's private key [[GH-16566](https://github.com/hashicorp/vault/pull/16566)]
-* secrets/pki: Allow tidy to associate revoked certs with their issuers for OCSP performance [[GH-16871](https://github.com/hashicorp/vault/pull/16871)]
-* secrets/pki: Honor If-Modified-Since header on CA, CRL fetch; requires passthrough_request_headers modification on the mount point. [[GH-16249](https://github.com/hashicorp/vault/pull/16249)]
-* secrets/pki: Improve stability of association of revoked cert with its parent issuer; when an issuer loses crl-signing usage, do not place certs on default issuer's CRL. [[GH-16874](https://github.com/hashicorp/vault/pull/16874)]
-* secrets/pki: Support generating delta CRLs for up-to-date CRLs when auto-building is enabled. [[GH-16773](https://github.com/hashicorp/vault/pull/16773)]
-* secrets/ssh: Add allowed_domains_template to allow templating of allowed_domains. [[GH-16056](https://github.com/hashicorp/vault/pull/16056)]
-* secrets/ssh: Allow additional text along with a template definition in defaultExtension value fields. [[GH-16018](https://github.com/hashicorp/vault/pull/16018)]
-* secrets/ssh: Allow the use of Identity templates in the `default_user` field [[GH-16351](https://github.com/hashicorp/vault/pull/16351)]
-* secrets/transit: Add a dedicated HMAC key type, which can be used with key import. [[GH-16668](https://github.com/hashicorp/vault/pull/16668)]
-* secrets/transit: Added a parameter to encrypt/decrypt batch operations to allow the caller to override the HTTP response code in case of partial user-input failures. [[GH-17118](https://github.com/hashicorp/vault/pull/17118)]
-* secrets/transit: Allow configuring the possible salt lengths for RSA PSS signatures. [[GH-16549](https://github.com/hashicorp/vault/pull/16549)]
-* ssh: Addition of an endpoint `ssh/issue/:role` to allow the creation of signed key pairs [[GH-15561](https://github.com/hashicorp/vault/pull/15561)]
-* storage/cassandra: tuning parameters for clustered environments `connection_timeout`, `initial_connection_timeout`, `simple_retry_policy_retries`. [[GH-10467](https://github.com/hashicorp/vault/pull/10467)]
-* storage/gcs: Add documentation explaining how to configure the gcs backend using environment variables instead of options in the configuration stanza [[GH-14455](https://github.com/hashicorp/vault/pull/14455)]
-* ui: Changed the tokenBoundCidrs tooltip content to clarify that comma separated values are not accepted in this field. [[GH-15852](https://github.com/hashicorp/vault/pull/15852)]
-* ui: Prevents requests to /sys/internal/ui/resultant-acl endpoint when unauthenticated [[GH-17139](https://github.com/hashicorp/vault/pull/17139)]
-* ui: Removed deprecated version of core-js 2.6.11 [[GH-15898](https://github.com/hashicorp/vault/pull/15898)]
-* ui: Renamed labels under Tools for wrap, lookup, rewrap and unwrap with description. [[GH-16489](https://github.com/hashicorp/vault/pull/16489)]
-* ui: Replaces non-inclusive terms [[GH-17116](https://github.com/hashicorp/vault/pull/17116)]
-* ui: redirect_to param forwards from auth route when authenticated [[GH-16821](https://github.com/hashicorp/vault/pull/16821)]
-* website/docs: API generate-recovery-token documentation. [[GH-16213](https://github.com/hashicorp/vault/pull/16213)]
-* website/docs: Add documentation around the expensiveness of making lots of lease count quotas in a short period [[GH-16950](https://github.com/hashicorp/vault/pull/16950)]
-* website/docs: Removes mentions of unauthenticated from internal ui resultant-acl doc [[GH-17139](https://github.com/hashicorp/vault/pull/17139)]
-* website/docs: Update replication docs to mention Integrated Storage [[GH-16063](https://github.com/hashicorp/vault/pull/16063)]
-* website/docs: changed to echo for all string examples instead of (<<<) here-string. [[GH-9081](https://github.com/hashicorp/vault/pull/9081)]
-
-BUG FIXES:
-
-* agent/template: Fix parsing error for the exec stanza [[GH-16231](https://github.com/hashicorp/vault/pull/16231)]
-* agent: Agent will now respect `max_retries` retry configuration even when caching is set. [[GH-16970](https://github.com/hashicorp/vault/pull/16970)]
-* agent: Update consul-template for pkiCert bug fixes [[GH-16087](https://github.com/hashicorp/vault/pull/16087)]
-* api/sys/internal/specs/openapi: support a new "dynamic" query parameter to generate generic mountpaths [[GH-15835](https://github.com/hashicorp/vault/pull/15835)]
-* api: Fixed erroneous warnings of unrecognized parameters when unwrapping data. [[GH-16794](https://github.com/hashicorp/vault/pull/16794)]
-* api: Fixed issue with internal/ui/mounts and internal/ui/mounts/(?P<path>.+) endpoints where it was not properly handling /auth/ [[GH-15552](https://github.com/hashicorp/vault/pull/15552)]
-* api: properly handle switching to/from unix domain socket when changing client address [[GH-11904](https://github.com/hashicorp/vault/pull/11904)]
-* auth/cert: Vault does not initially load the CRLs in cert auth unless the read/write CRL endpoint is hit. [[GH-17138](https://github.com/hashicorp/vault/pull/17138)]
-* auth/kerberos: Maintain headers set by the client [[GH-16636](https://github.com/hashicorp/vault/pull/16636)]
-* auth/kubernetes: Restore support for JWT signature algorithm ES384 [[GH-160](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/160)] [[GH-17161](https://github.com/hashicorp/vault/pull/17161)]
-* auth/token: Fix ignored parameter warnings for valid parameters on token create [[GH-16938](https://github.com/hashicorp/vault/pull/16938)]
-* command/debug: fix bug where monitor was not honoring configured duration [[GH-16834](https://github.com/hashicorp/vault/pull/16834)]
-* core (enterprise): Fix bug where wrapping token lookup does not work within namespaces. [[GH-15583](https://github.com/hashicorp/vault/pull/15583)]
-* core (enterprise): Fix creation of duplicate entities via alias metadata changes on local auth mounts.
-* core/auth: Return a 403 instead of a 500 for a malformed SSCT [[GH-16112](https://github.com/hashicorp/vault/pull/16112)]
-* core/identity: Replicate member_entity_ids and policies in identity/group across nodes identically [[GH-16088](https://github.com/hashicorp/vault/pull/16088)]
-* core/license (enterprise): Always remove stored license and allow unseal to complete when license cleanup fails
-* core/managed-keys (enterprise): fix panic when having `cache_disable` true
-* core/quotas (enterprise): Fixed issue with improper counting of leases if lease count quota created after leases
-* core/quotas: Added globbing functionality on the end of path suffix quota paths [[GH-16386](https://github.com/hashicorp/vault/pull/16386)]
-* core/quotas: Fix goroutine leak caused by the seal process not fully cleaning up Rate Limit Quotas. [[GH-17281](https://github.com/hashicorp/vault/pull/17281)]
-* core/replication (enterprise): Don't flush merkle tree pages to disk after losing active duty
-* core/seal: Fix possible keyring truncation when using the file backend. [[GH-15946](https://github.com/hashicorp/vault/pull/15946)]
-* core: Fix panic when the plugin catalog returns neither a plugin nor an error. [[GH-17204](https://github.com/hashicorp/vault/pull/17204)]
-* core: Fixes parsing boolean values for ha_storage backends in config [[GH-15900](https://github.com/hashicorp/vault/pull/15900)]
-* core: Increase the allowed concurrent gRPC streams over the cluster port. [[GH-16327](https://github.com/hashicorp/vault/pull/16327)]
-* core: Prevent two or more DR failovers from invalidating SSCT tokens generated on the previous primaries. [[GH-16956](https://github.com/hashicorp/vault/pull/16956)]
-* database: Invalidate queue should cancel context first to avoid deadlock [[GH-15933](https://github.com/hashicorp/vault/pull/15933)]
-* debug: Fix panic when capturing debug bundle on Windows [[GH-14399](https://github.com/hashicorp/vault/pull/14399)]
-* debug: Remove extra empty lines from vault.log when debug command is run [[GH-16714](https://github.com/hashicorp/vault/pull/16714)]
-* identity (enterprise): Fix a data race when creating an entity for a local alias.
-* identity/oidc: Adds `claims_supported` to discovery document. [[GH-16992](https://github.com/hashicorp/vault/pull/16992)]
-* identity/oidc: Change the `state` parameter of the Authorization Endpoint to optional. [[GH-16599](https://github.com/hashicorp/vault/pull/16599)]
-* identity/oidc: Detect invalid `redirect_uri` values sooner in validation of the Authorization Endpoint. [[GH-16601](https://github.com/hashicorp/vault/pull/16601)]
-* identity/oidc: Fixes validation of the `request` and `request_uri` parameters. [[GH-16600](https://github.com/hashicorp/vault/pull/16600)]
-* openapi: Fixed issue where information about /auth/token endpoints was not present with explicit policy permissions [[GH-15552](https://github.com/hashicorp/vault/pull/15552)]
-* plugin/multiplexing: Fix panic when id doesn't exist in connection map [[GH-16094](https://github.com/hashicorp/vault/pull/16094)]
-* plugin/secrets/auth: Fix a bug with aliased backends such as aws-ec2 or generic [[GH-16673](https://github.com/hashicorp/vault/pull/16673)]
-* plugins: Corrected the path to check permissions on when the registered plugin name does not match the plugin binary's filename. [[GH-17340](https://github.com/hashicorp/vault/pull/17340)]
-* quotas/lease-count: Fix lease-count quotas on mounts not properly being enforced when the lease generating request is a read [[GH-15735](https://github.com/hashicorp/vault/pull/15735)]
-* replication (enterprise): Fix data race in SaveCheckpoint()
-* replication (enterprise): Fix data race in saveCheckpoint.
-* replication (enterprise): Fix possible data race during merkle diff/sync
-* secret/pki: Do not fail validation with a legacy key_bits default value and key_type=any when signing CSRs [[GH-16246](https://github.com/hashicorp/vault/pull/16246)]
-* secrets/database: Fix a bug where the secret engine would queue up a lot of WAL deletes during startup. [[GH-16686](https://github.com/hashicorp/vault/pull/16686)]
-* secrets/gcp: Fixes duplicate static account key creation from performance secondary clusters. [[GH-16534](https://github.com/hashicorp/vault/pull/16534)]
-* secrets/kv: Fix `kv get` issue preventing the ability to read a secret when providing a leading slash [[GH-16443](https://github.com/hashicorp/vault/pull/16443)]
-* secrets/pki: Allow import of issuers without CRLSign KeyUsage; prohibit setting crl-signing usage on such issuers [[GH-16865](https://github.com/hashicorp/vault/pull/16865)]
-* secrets/pki: Do not ignore provided signature bits value when signing intermediate and leaf certificates with a managed key [[GH-17328](https://github.com/hashicorp/vault/pull/17328)]
-* secrets/pki: Do not read revoked certificates from backend when CRL is disabled [[GH-17385](https://github.com/hashicorp/vault/pull/17385)]
-* secrets/pki: Fix migration to properly handle mounts that contain only keys, no certificates [[GH-16813](https://github.com/hashicorp/vault/pull/16813)]
-* secrets/pki: Ignore EC PARAMETER PEM blocks during issuer import (/config/ca, /issuers/import/*, and /intermediate/set-signed) [[GH-16721](https://github.com/hashicorp/vault/pull/16721)]
-* secrets/pki: LIST issuers endpoint is now unauthenticated. [[GH-16830](https://github.com/hashicorp/vault/pull/16830)]
-* secrets/transform (enterprise): Fix an issue loading tokenization transform configuration after a specific sequence of reconfigurations.
-* secrets/transform (enterprise): Fix persistence problem with tokenization store credentials.
-* storage/raft (enterprise): Fix some storage-modifying RPCs used by perf standbys that weren't returning the resulting WAL state.
-* storage/raft (enterprise): Prevent unauthenticated voter status change with rejoin [[GH-16324](https://github.com/hashicorp/vault/pull/16324)]
-* storage/raft: Fix retry_join initialization failure [[GH-16550](https://github.com/hashicorp/vault/pull/16550)]
-* storage/raft: Nodes no longer get demoted to nonvoter if we don't know their version due to missing heartbeats. [[GH-17019](https://github.com/hashicorp/vault/pull/17019)]
-* ui/keymgmt: Sets the defaultValue for type when creating a key. [[GH-17407](https://github.com/hashicorp/vault/pull/17407)]
-* ui: Fix OIDC callback to accept namespace flag in different formats [[GH-16886](https://github.com/hashicorp/vault/pull/16886)]
-* ui: Fix info tooltip submitting form [[GH-16659](https://github.com/hashicorp/vault/pull/16659)]
-* ui: Fix issue logging in with JWT auth method [[GH-16466](https://github.com/hashicorp/vault/pull/16466)]
-* ui: Fix lease force revoke action [[GH-16930](https://github.com/hashicorp/vault/pull/16930)]
-* ui: Fix naming of permitted_dns_domains form parameter on CA creation (root generation and sign intermediate). [[GH-16739](https://github.com/hashicorp/vault/pull/16739)]
-* ui: Fixed bug where red spellcheck underline appears in sensitive/secret kv values when it should not appear [[GH-15681](https://github.com/hashicorp/vault/pull/15681)]
-* ui: Fixes secret version and status menu links transitioning to auth screen [[GH-16983](https://github.com/hashicorp/vault/pull/16983)]
-* ui: OIDC login type uses localStorage instead of sessionStorage [[GH-16170](https://github.com/hashicorp/vault/pull/16170)]
-* vault: Fix a bug where duplicate policies could be added to an identity group. [[GH-15638](https://github.com/hashicorp/vault/pull/15638)]
-
-## 1.11.12
-### June 21, 2023
+* raft/autopilot: We've updated the autopilot reconciliation logic (by updating the raft-autopilot dependency to v0.3.0) to avoid artificially increasing the quorum in presence of an unhealthy node. Now autopilot will start the reconciliation process by attempting to demote a failed voter node before any promotions, fixing the issue where Vault would initially increase quorum when faced with a failure of a voter node. In certain configurations, especially when using Vault Enterprise Redundancy Zones and losing a voter then a non-voter in quick succession, this would lead to a loss of quorum and cluster failure. [[GH-29306](https://github.com/hashicorp/vault/pull/29306)]
+* ui: Application static breadcrumbs should be formatted in title case. [[GH-29206](https://github.com/hashicorp/vault/pull/29206)]
 
-CHANGES:
+BUG FIXES:
 
-* core: Bump Go version to 1.19.10.
-* licensing (enterprise): Terminated licenses will no longer result in shutdown. Instead, upgrades
-will not be allowed if the license termination time is before the build date of the binary.
+* activity: Show activity records from clients created in deleted namespaces when activity log is queried from admin namespace. [[GH-29432](https://github.com/hashicorp/vault/pull/29432)]
+* core/managed-keys (enterprise): Allow mechanism numbers above 32 bits in PKCS#11 managed keys.
+* core: Fix bug when if failing to persist the barrier keyring to track encryption counts, the number of outstanding encryptions remains added to the count, overcounting encryptions. [[GH-29506](https://github.com/hashicorp/vault/pull/29506)]
+* identity/oidc (enterprise): Fix delays in rotation and invalidation of OIDC keys when there are too many namespaces.
+The Cache-Control header returned by the identity/oidc/.well-known/keys endpoint now depends only on the named keys for
+the queried namespace. [[GH-29312](https://github.com/hashicorp/vault/pull/29312)]
+* secrets-sync (enterprise): Add new parameters for destination configs to specify allowlists for IP's and ports.
+* secrets/pki: fixes issue #28749 requiring all chains to be single line of authority. [[GH-29342](https://github.com/hashicorp/vault/pull/29342)]
+* ui (enterprise): Fixes token renewal to ensure capability checks are performed in the relevant namespace, resolving 'Not authorized' errors for resources that users have permission to access. [[GH-29416](https://github.com/hashicorp/vault/pull/29416)]
+* ui/database: Fixes 'cannot update static username' error when updating static role's rotation period [[GH-29498](https://github.com/hashicorp/vault/pull/29498)]
+* ui: Fixes text overflow on Secrets engines and Auth Engines list views for long names & descriptions [[GH-29430](https://github.com/hashicorp/vault/pull/29430)]
 
-FEATURES:
+## 1.17.11 Enterprise
+### January 30, 2025
 
-* **Automated License Utilization Reporting**: Added automated license
-utilization reporting, which sends minimal product-license [metering
-data](https://developer.hashicorp.com/vault/docs/enterprise/license/utilization-reporting)
-to HashiCorp without requiring you to manually collect and report them.
-* core (enterprise): Add background worker for automatic reporting of billing
-information. [[GH-19625](https://github.com/hashicorp/vault/pull/19625)]
+CHANGES:
+
+* auth/cf: Update plugin to v0.19.1 [[GH-29295](https://github.com/hashicorp/vault/pull/29295)]
+* sdk: Updated golang and dependency versions to be consistent across core, API, SDK to address [[GO-2024-3333](https://pkg.go.dev/vuln/GO-2024-3333)] and ensure version consistency [[GH-29422](https://github.com/hashicorp/vault/pull/29422)]
 
 IMPROVEMENTS:
 
-* api: GET ... /sys/internal/counters/activity?current_billing_period=true now
-results in a response which contains the full billing period [[GH-20694](https://github.com/hashicorp/vault/pull/20694)]
-* api: `/sys/internal/counters/config` endpoint now contains read-only
-`minimum_retention_months`. [[GH-20150](https://github.com/hashicorp/vault/pull/20150)]
-* api: `/sys/internal/counters/config` endpoint now contains read-only
-`reporting_enabled` and `billing_start_timestamp` fields. [[GH-20086](https://github.com/hashicorp/vault/pull/20086)]
-* core (enterprise): add configuration for license reporting [[GH-19891](https://github.com/hashicorp/vault/pull/19891)]
-* core (enterprise): license updates trigger a reload of reporting and the activity log [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
-* core (enterprise): support reloading configuration for automated reporting via SIGHUP [[GH-20680](https://github.com/hashicorp/vault/pull/20680)]
-* core (enterprise): vault server command now allows for opt-out of automated
-reporting via the `OPTOUT_LICENSE_REPORTING` environment variable. [[GH-3939](https://github.com/hashicorp/vault/pull/3939)]
-* core/activity: error when attempting to update retention configuration below the minimum [[GH-20078](https://github.com/hashicorp/vault/pull/20078)]
-* core/activity: generate hyperloglogs containing clientIds for each month during precomputation [[GH-16146](https://github.com/hashicorp/vault/pull/16146)]
-* core/activity: refactor activity log api to reuse partial api functions in activity endpoint when current month is specified [[GH-16162](https://github.com/hashicorp/vault/pull/16162)]
-* core/activity: refactor the activity log's generation of precomputed queries [[GH-20073](https://github.com/hashicorp/vault/pull/20073)]
-* core/activity: use monthly hyperloglogs to calculate new clients approximation for current month [[GH-16184](https://github.com/hashicorp/vault/pull/16184)]
-* core: Activity log goroutine management improvements to allow tests to be more deterministic. [[GH-17028](https://github.com/hashicorp/vault/pull/17028)]
-* core: Limit activity log client count usage by namespaces [[GH-16000](https://github.com/hashicorp/vault/pull/16000)]
-* storage/raft: add additional raft metrics relating to applied index and heartbeating; also ensure OSS standbys emit periodic metrics. [[GH-12166](https://github.com/hashicorp/vault/pull/12166)]
-* ui: updates clients configuration edit form state based on census reporting configuration [[GH-20125](https://github.com/hashicorp/vault/pull/20125)]
-
-BUG FIXES:
-
-* core/activity: add namespace breakdown for new clients when date range spans multiple months, including the current month. [[GH-18766](https://github.com/hashicorp/vault/pull/18766)]
-* core/activity: de-duplicate namespaces when historical and current month data are mixed [[GH-18452](https://github.com/hashicorp/vault/pull/18452)]
-* core/activity: fix the end_date returned from the activity log endpoint when partial counts are computed [[GH-17856](https://github.com/hashicorp/vault/pull/17856)]
-* core/activity: include mount counts when de-duplicating current and historical month data [[GH-18598](https://github.com/hashicorp/vault/pull/18598)]
-* core/activity: report mount paths (rather than mount accessors) in current month activity log counts and include deleted mount paths in precomputed queries. [[GH-18916](https://github.com/hashicorp/vault/pull/18916)]
-* core/activity: return partial month counts when querying a historical date range and no historical data exists. [[GH-17935](https://github.com/hashicorp/vault/pull/17935)]
-* core: Change where we evaluate filtered paths as part of mount operations; this is part of an enterprise bugfix that will
-have its own changelog entry. [[GH-21260](https://github.com/hashicorp/vault/pull/21260)]
-* core: Do not cache seal configuration to fix a bug that resulted in sporadic auto unseal failures. [[GH-21223](https://github.com/hashicorp/vault/pull/21223)]
-* core: Don't exit just because we think there's a potential deadlock. [[GH-21342](https://github.com/hashicorp/vault/pull/21342)]
-* core: Fix panic in sealed nodes using raft storage trying to emit raft metrics [[GH-21249](https://github.com/hashicorp/vault/pull/21249)]
-* identity: Fixes duplicate groups creation with the same name but unique IDs. [[GH-20964](https://github.com/hashicorp/vault/pull/20964)]
-* replication (enterprise): Fix a race condition with update-primary that could result in data loss after a DR failover
-* replication (enterprise): Fix path filters deleting data right after it's written by backend Initialize funcs
-
-## 1.11.11
-### June 08, 2023
+* plugins (enterprise): The Database secrets engine now allows skipping the automatic rotation of static roles during import.
+* events (enterprise): Use the `path` event metadata field when authorizing a client's `subscribe` capability for consuming an event, instead of requiring `data_path` to be present in the event metadata.
+* ui: Adds navigation for LDAP hierarchical libraries [[GH-29293](https://github.com/hashicorp/vault/pull/29293)]
+* ui: Adds params to postgresql database to improve editing a connection in the web browser. [[GH-29200](https://github.com/hashicorp/vault/pull/29200)]
 
-SECURITY:
+BUG FIXES:
 
-* ui: key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11. [[HSEC-2023-17](https://discuss.hashicorp.com/t/hcsec-2023-17-vault-s-kv-diff-viewer-allowed-html-injection/54814)]
+* activity: Include activity records from clients created by deleted or disabled auth mounts in Export API response. [[GH-29376](https://github.com/hashicorp/vault/pull/29376)]
+* core: Prevent integer overflows of the barrier key counter on key rotation requests [[GH-29176](https://github.com/hashicorp/vault/pull/29176)]
+* database/mssql: Fix a bug where contained databases would silently fail root rotation if a custom root rotation statement was not provided. [[GH-29399](https://github.com/hashicorp/vault/pull/29399)]
+* plugins: Fix a bug that causes zombie dbus-daemon processes on certain systems. [[GH-29334](https://github.com/hashicorp/vault/pull/29334)]
+* sdk/database: Fix a bug where slow database connections can cause goroutines to be blocked. [[GH-29097](https://github.com/hashicorp/vault/pull/29097)]
+* secrets/pki: Fix a bug that prevented the full CA chain to be used when enforcing name constraints. [[GH-29255](https://github.com/hashicorp/vault/pull/29255)]
+* sentinel (enterprise): No longer report inaccurate log messages for when failing an advisory policy.
+* ui (enterprise): Fixes login to web UI when MFA is enabled for SAML auth methods [[GH-28873](https://github.com/hashicorp/vault/pull/28873)]
+* ui: Fixes login to web UI when MFA is enabled for OIDC (i.e. azure, auth0) and Okta auth methods [[GH-28873](https://github.com/hashicorp/vault/pull/28873)]
+* ui: Fixes navigation for quick actions in LDAP roles' popup menu [[GH-29293](https://github.com/hashicorp/vault/pull/29293)]
+
+## 1.17.10 Enterprise
+### December 18, 2024
 
 CHANGES:
 
-* core: Bump Go version to 1.19.9.
-* core: Revert #19676 (VAULT_GRPC_MIN_CONNECT_TIMEOUT env var) as we decided it was unnecessary. [[GH-20826](https://github.com/hashicorp/vault/pull/20826)]
+* secrets/pki: Enforce the issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates. For more information see [PKI considerations](https://developer.hashicorp.com/vault/docs/secrets/pki/considerations#issuer-constraints-enforcement) [[GH-29045](https://github.com/hashicorp/vault/pull/29045)]
 
 IMPROVEMENTS:
 
-* command/server: Add support for dumping pprof files to the filesystem via SIGUSR2 when
-`VAULT_PPROF_WRITE_TO_FILE=true` is set on the server. [[GH-20609](https://github.com/hashicorp/vault/pull/20609)]
-* secrets/pki: add subject key identifier to read key response [[GH-20642](https://github.com/hashicorp/vault/pull/20642)]
-* ui: update TTL picker for consistency [[GH-18114](https://github.com/hashicorp/vault/pull/18114)]
+* auth/okta: update to okta sdk v5 from v2. Transitively updates go-jose dependency to >=3.0.3 to resolve GO-2024-2631. See https://github.com/okta/okta-sdk-golang/blob/master/MIGRATING.md for details on changes. [[GH-28121](https://github.com/hashicorp/vault/pull/28121)]
+* core: Added new `enable_post_unseal_trace` and `post_unseal_trace_directory` config options to generate Go traces during the post-unseal step for debug purposes. [[GH-28895](https://github.com/hashicorp/vault/pull/28895)]
+* sdk: Add Vault build date to system view plugin environment response [[GH-29082](https://github.com/hashicorp/vault/pull/29082)]
+* ui: Replace KVv2 json secret details view with Hds::CodeBlock component allowing users to search the full secret height. [[GH-28808](https://github.com/hashicorp/vault/pull/28808)]
 
 BUG FIXES:
 
-* api: Properly Handle nil identity_policies in Secret Data [[GH-20636](https://github.com/hashicorp/vault/pull/20636)]
-* auth/ldap: Set default value for `max_page_size` properly [[GH-20453](https://github.com/hashicorp/vault/pull/20453)]
-* cli: CLI should take days as a unit of time for ttl like flags [[GH-20477](https://github.com/hashicorp/vault/pull/20477)]
-* core (enterprise): Fix log shipper buffer size overflow issue for 32 bit architecture.
-* core (enterprise): Fix logshipper buffer size to default to DefaultBufferSize only when reported system memory is zero.
-* core (enterprise): Remove MFA Enforcment configuration for namespace when deleting namespace
-* core: prevent panic on login after namespace is deleted that had mfa enforcement [[GH-20375](https://github.com/hashicorp/vault/pull/20375)]
-* replication (enterprise): Fix a race condition with invalid tokens during WAL streaming that was causing Secondary clusters to be unable to connect to a Primary.
-* replication (enterprise): fix bug where secondary grpc connections would timeout when connecting to a primary host that no longer exists.
-* secrets/transform (enterprise): Fix a caching bug affecting secondary nodes after a tokenization key rotation
+* auth/ldap: Fixed an issue where debug level logging was not emitted. [[GH-28881](https://github.com/hashicorp/vault/pull/28881)]
+* autosnapshots (enterprise): Fix an issue where snapshot size metrics were not reported for cloud-based storage.
+* core/metrics: Fix unlocked mounts read for usage reporting. [[GH-29091](https://github.com/hashicorp/vault/pull/29091)]
+* core/seal (enterprise): Fix decryption of the raft bootstrap challenge when using seal high availability. [[GH-29117](https://github.com/hashicorp/vault/pull/29117)]
+* secret/db: Update static role rotation to generate a new password after 2 failed attempts. [[GH-28989](https://github.com/hashicorp/vault/pull/28989)]
+* ui: Allow users to search the full json object within the json code-editor edit/create view. [[GH-28808](https://github.com/hashicorp/vault/pull/28808)]
+* ui: Decode `connection_url` to fix database connection updates (i.e. editing connection config, deleting roles) failing when urls include template variables. [[GH-29114](https://github.com/hashicorp/vault/pull/29114)]
+* ui: Fix Swagger explorer bug where requests with path params were not working. [[GH-28670](https://github.com/hashicorp/vault/issues/28670)]
+* vault/diagnose: Fix time to expiration reporting within the TLS verification to not be a month off. [[GH-29128](https://github.com/hashicorp/vault/pull/29128)]
 
-## 1.11.10
-### April 26, 2023
+## 1.17.9 Enterprise
+### November 21, 2024
 
-CHANGES:
+SECURITY:
 
-* core: Bump Go version to 1.19.8.
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241115202008-166203013d8e
 
-IMPROVEMENTS:
+CHANGES:
 
-* cli/namespace: Add detailed flag to output additional namespace information
-such as namespace IDs and custom metadata. [[GH-20243](https://github.com/hashicorp/vault/pull/20243)]
-* core/activity: add an endpoint to write test activity log data, guarded by a build flag [[GH-20019](https://github.com/hashicorp/vault/pull/20019)]
-* core: Add a `raft` sub-field to the `storage` and `ha_storage` details provided by the
-`/sys/config/state/sanitized` endpoint in order to include the `max_entry_size`. [[GH-20044](https://github.com/hashicorp/vault/pull/20044)]
-* sdk/ldaputil: added `connection_timeout` to tune connection timeout duration
-for all LDAP plugins. [[GH-20144](https://github.com/hashicorp/vault/pull/20144)]
-
-BUG FIXES:
-
-* auth/ldap: Add max_page_size configurable to LDAP configuration [[GH-19032](https://github.com/hashicorp/vault/pull/19032)]
-* core (enterprise): Fix intermittent issue with token entries sometimes not being found when using a newly created token in a request to a secondary, even when SSCT `new_token` forwarding is set. When this occurred, this would result in the following error to the client: `error performing token check: no lease entry found for token that ought to have one, possible eventual consistency issue`.
-* core (enterprise): Fix read on perf standbys failing with 412 after leadership change, unseal, restores or restarts when no writes occur
-* core/ssct (enterprise): Fixed race condition where a newly promoted DR may revert `sscGenCounter`
-resulting in 412 errors.
-* core: Fix regression breaking non-raft clusters whose nodes share the same cluster_addr/api_addr. [[GH-19721](https://github.com/hashicorp/vault/pull/19721)]
-* helper/random: Fix race condition in string generator helper [[GH-19875](https://github.com/hashicorp/vault/pull/19875)]
-* openapi: Fix many incorrect details in generated API spec, by using better techniques to parse path regexps [[GH-18554](https://github.com/hashicorp/vault/pull/18554)]
-* replication (enterprise): Fix replication status for Primary clusters showing its primary cluster's information (in case of DR) in secondaries field when known_secondaries field is nil
-* secrets/pki: Fix patching of leaf_not_after_behavior on issuers. [[GH-20341](https://github.com/hashicorp/vault/pull/20341)]
-* secrets/transform (enterprise): Address SQL connection leak when cleaning expired tokens
-* ui: Fix OIDC provider logo showing when domain doesn't match [[GH-20263](https://github.com/hashicorp/vault/pull/20263)]
-* ui: Fix bad link to namespace when namespace name includes `.` [[GH-19799](https://github.com/hashicorp/vault/pull/19799)]
-* ui: fixes browser console formatting for help command output [[GH-20064](https://github.com/hashicorp/vault/pull/20064)]
-* ui: remove use of htmlSafe except when first sanitized [[GH-20235](https://github.com/hashicorp/vault/pull/20235)]
-
-## 1.11.9
-### March 29, 2023
+* activity log: Deprecated the field "default_report_months". Instead, the billing start time will be used to determine the start time
+when querying the activity log endpoints. [[GH-27350](https://github.com/hashicorp/vault/pull/27350)]
+* core/ha (enterprise): Failed attempts to become a performance standby node are now using an exponential backoff instead of a
+10 second delay in between retries. The backoff starts at 2s and increases by a factor of two until reaching
+the maximum of 16s. This should make unsealing of the node faster in some cases.
+* login (enterprise): Return a 500 error during logins when performance standby nodes make failed gRPC requests to the active node. [[GH-28807](https://github.com/hashicorp/vault/pull/28807)]
 
-SECURITY:
+FEATURES:
 
-* storage/mssql: When using Vault’s community-supported Microsoft SQL (MSSQL) database storage backend, a privileged attacker with the ability to write arbitrary data to Vault’s configuration may be able to perform arbitrary SQL commands on the underlying database server through Vault. This vulnerability, CVE-2023-0620, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-12](https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080)]
-* secrets/pki: Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. This vulnerability, CVE-2023-0665, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-11](https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079)]
-* core: HashiCorp Vault’s implementation of Shamir’s secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. This vulnerability, CVE-2023-25000, is fixed in Vault 1.13.1, 1.12.5, and 1.11.9. [[HCSEC-2023-10](https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078)]
+* **Product Usage Reporting**: Added product usage reporting, which collects anonymous, numerical, non-sensitive data about Vault secrets usage, and adds it to the existing utilization reports. See the [[docs](https://developer.hashicorp.com/vault/docs/enterprise/license/product-usage-reporting)] for more info [[GH-28858](https://github.com/hashicorp/vault/pull/28858)]
 
 IMPROVEMENTS:
 
-* auth/github: Allow for an optional Github auth token environment variable to make authenticated requests when fetching org id
-website/docs: Add docs for `VAULT_AUTH_CONFIG_GITHUB_TOKEN` environment variable when writing Github config [[GH-19244](https://github.com/hashicorp/vault/pull/19244)]
-* core: Allow overriding gRPC connect timeout via VAULT_GRPC_MIN_CONNECT_TIMEOUT. This is an env var rather than a config setting because we don't expect this to ever be needed.  It's being added as a last-ditch
-option in case all else fails for some replication issues we may not have fully reproduced. [[GH-19676](https://github.com/hashicorp/vault/pull/19676)]
-* core: validate name identifiers in mssql physical storage backend prior use [[GH-19591](https://github.com/hashicorp/vault/pull/19591)]
+* secrets-sync (enterprise): No longer attempt to unsync a random UUID secret name in GCP upon destination creation.
+* ui: Adds navigation for LDAP hierarchical roles [[GH-28824](https://github.com/hashicorp/vault/pull/28824)]
 
 BUG FIXES:
 
-* auth/kubernetes: Ensure a consistent TLS configuration for all k8s API requests [[#190](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/190)] [[GH-19720](https://github.com/hashicorp/vault/pull/19720)]
-* cli: Fix vault read handling to return raw data as secret.Data when there is no top-level data object from api response. [[GH-17913](https://github.com/hashicorp/vault/pull/17913)]
-* core (enterprise): Attempt to reconnect to a PKCS#11 HSM if we retrieve a CKR_FUNCTION_FAILED error.
-* core: Fixed issue with remounting mounts that have a non-trailing space in the 'to' or 'from' paths. [[GH-19585](https://github.com/hashicorp/vault/pull/19585)]
-* openapi: Fix logic for labeling unauthenticated/sudo paths. [[GH-19600](https://github.com/hashicorp/vault/pull/19600)]
-* secrets/transform (enterprise): Fix persistence problem with rotated tokenization key versions
-* ui: fixes issue navigating back a level using the breadcrumb from secret metadata view [[GH-19703](https://github.com/hashicorp/vault/pull/19703)]
-* ui: pass encodeBase64 param to HMAC transit-key-actions. [[GH-19429](https://github.com/hashicorp/vault/pull/19429)]
-* ui: use URLSearchParams interface to capture namespace param from SSOs (ex. ADFS) with decoded state param in callback url [[GH-19460](https://github.com/hashicorp/vault/pull/19460)]
+* core: Improved an internal helper function that sanitizes paths by adding a check for leading backslashes 
+in addition to the existing check for leading slashes. [[GH-28878](https://github.com/hashicorp/vault/pull/28878)]
+* secret/pki: Fix a bug that prevents PKI issuer field enable_aia_url_templating
+to be set to false. [[GH-28832](https://github.com/hashicorp/vault/pull/28832)]
+* secrets-sync (enterprise): Fixed issue where secret-key granularity destinations could sometimes cause a panic when loading a sync status.
+* secrets/aws: Fix issue with static credentials not rotating after restart or leadership change. [[GH-28775](https://github.com/hashicorp/vault/pull/28775)]
+* secrets/ssh: Return the flag `allow_empty_principals` in the read role api when key_type is "ca" [[GH-28901](https://github.com/hashicorp/vault/pull/28901)]
+* secrets/transform (enterprise): Fix nil panic when accessing a partially setup database store.
+* secrets/transit: Fix a race in which responses from the key update api could contain results from another subsequent update [[GH-28839](https://github.com/hashicorp/vault/pull/28839)]
+* ui: Fixes rendering issues of LDAP dynamic and static roles with the same name [[GH-28824](https://github.com/hashicorp/vault/pull/28824)]
 
-## 1.11.8
-### March 01, 2023
+## 1.17.8 Enterprise
+### October 30, 2024
 
 SECURITY:
-
-* auth/approle: When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999 has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above. [[HSEC-2023-07](https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305)]
+* core/raft: Add raft join limits [[GH-28790](https://github.com/hashicorp/vault/pull/28790), [HCSEC-2024-26](https://discuss.hashicorp.com/t/hcsec-2024-26-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-processing-raft-cluster-join-requests)]
 
 CHANGES:
 
-* core: Bump Go version to 1.19.6.
+* auth/azure: Update plugin to v0.18.1
+* secrets/openldap: update plugin to v0.13.2
 
 IMPROVEMENTS:
 
-* secrets/database: Adds error message requiring password on root crednetial rotation. [[GH-19103](https://github.com/hashicorp/vault/pull/19103)]
+* ui: Add button to copy secret path in kv v1 and v2 secrets engines [[GH-28629](https://github.com/hashicorp/vault/pull/28629)]
+* ui: Adds copy button to identity entity, alias and mfa method IDs [[GH-28742](https://github.com/hashicorp/vault/pull/28742)]
 
 BUG FIXES:
 
-* auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [[GH-19186](https://github.com/hashicorp/vault/pull/19186)]
-* core (enterprise): Fix panic when using invalid accessor for control-group request
-* core (enterprise): Fix perf standby WAL streaming silently failures when replication setup happens at a bad time.
-* core: Prevent panics in `sys/leases/lookup`, `sys/leases/revoke`, and `sys/leases/renew` endpoints if provided `lease_id` is null [[GH-18951](https://github.com/hashicorp/vault/pull/18951)]
-* license (enterprise): Fix bug where license would update even if the license didn't change.
-* replication (enterprise): Fix bug where reloading external plugin on a secondary would
-break replication.
-* secrets/ad: Fix bug where config couldn't be updated unless binddn/bindpass were included in the update. [[GH-18208](https://github.com/hashicorp/vault/pull/18208)]
-* ui (enterprise): Fix cancel button from transform engine role creation page [[GH-19135](https://github.com/hashicorp/vault/pull/19135)]
-* ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [[GH-19071](https://github.com/hashicorp/vault/pull/19071)]
-* ui: show Get credentials button for static roles detail page when a user has the proper permissions. [[GH-19190](https://github.com/hashicorp/vault/pull/19190)]
+* audit: Prevent users from enabling multiple audit devices of file type with the same file_path to write to. [[GH-28751](https://github.com/hashicorp/vault/pull/28751)]
+* core/seal (enterprise): Fix bug that caused seal generation information to be replicated, which prevented disaster recovery and performance replication clusters from using their own seal high-availability configuration.
+* core/seal: Fix an issue that could cause reading from sys/seal-backend-status to return stale information. [[GH-28631](https://github.com/hashicorp/vault/pull/28631)]
+* core: Fixed panic seen when performing help requests without /v1/ in the URL. [[GH-28669](https://github.com/hashicorp/vault/pull/28669)]
+* namespaces (enterprise): Fix issue where namespace patch requests to a performance secondary would not patch the namespace's metadata.
+* secrets/pki: Address issue with ACME HTTP-01 challenges failing for IPv6 IPs due to improperly formatted URLs [[GH-28718](https://github.com/hashicorp/vault/pull/28718)]
+* ui: No longer running decodeURIComponent on KVv2 list view allowing percent encoded data-octets in path name. [[GH-28698](https://github.com/hashicorp/vault/pull/28698)]
 
-## 1.11.7
-### February 6, 2023
+## 1.17.7 Enterprise
+### October 09, 2024
 
-CHANGES:
+SECURITY:
 
-* core: Bump Go version to 1.19.4.
+* secrets/identity: A privileged Vault operator with write permissions to the root namespace's identity endpoint could escalate their privileges to Vault's root policy (CVE-2024-9180) [HCSEC-2024-21](https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565)
 
 IMPROVEMENTS:
 
-* command/server: Environment variable keys are now logged at startup. [[GH-18125](https://github.com/hashicorp/vault/pull/18125)]
-* core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
-* secrets/db/mysql: Add `tls_server_name` and `tls_skip_verify` parameters [[GH-18799](https://github.com/hashicorp/vault/pull/18799)]
-* ui: Prepends "passcode=" if not provided in user input for duo totp mfa method authentication [[GH-18342](https://github.com/hashicorp/vault/pull/18342)]
-* ui: Update language on database role to "Connection name" [[GH-18261](https://github.com/hashicorp/vault/issues/18261)] [[GH-18350](https://github.com/hashicorp/vault/pull/18350)]
-
-BUG FIXES:
-
-* auth/approle: Fix `token_bound_cidrs` validation when using /32 blocks for role and secret ID [[GH-18145](https://github.com/hashicorp/vault/pull/18145)]
-* cli/kv: skip formatting of nil secrets for patch and put with field parameter set [[GH-18163](https://github.com/hashicorp/vault/pull/18163)]
-* core (enterprise): Fix a race condition resulting in login errors to PKCS#11 modules under high concurrency.
-* core/managed-keys (enterprise): Limit verification checks to mounts in a key's namespace
-* core/quotas (enterprise): Fix a potential deadlock that could occur when using lease count quotas.
-* core/quotas: Fix issue with improper application of default rate limit quota exempt paths [[GH-18273](https://github.com/hashicorp/vault/pull/18273)]
-* core: fix bug where context cancellations weren't forwarded to active node from performance standbys.
-* core: prevent panic in login mfa enforcement delete after enforcement's namespace is deleted [[GH-18923](https://github.com/hashicorp/vault/pull/18923)]
-* database/mongodb: Fix writeConcern set to be applied to any query made on the database [[GH-18546](https://github.com/hashicorp/vault/pull/18546)]
-* identity (enterprise): Fix a data race when creating an entity for a local alias.
-* kmip (enterprise): Fix Destroy operation response that omitted Unique Identifier on some batched responses.
-* kmip (enterprise): Fix Locate operation response incompatibility with clients using KMIP versions prior to 1.3.
-* kmip (enterprise): Fix Query operation response that omitted streaming capability and supported profiles.
-* licensing (enterprise): update autoloaded license cache after reload
-* secrets/pki: Allow patching issuer to set an empty issuer name. [[GH-18466](https://github.com/hashicorp/vault/pull/18466)]
-* secrets/transit: Do not warn about unrecognized parameter 'batch_input' [[GH-18299](https://github.com/hashicorp/vault/pull/18299)]
-* storage/raft (enterprise): An already joined node can rejoin by wiping storage
-and re-issueing a join request, but in doing so could transiently become a
-non-voter.  In some scenarios this resulted in loss of quorum. [[GH-18263](https://github.com/hashicorp/vault/pull/18263)]
-* storage/raft (enterprise): Fix some storage-modifying RPCs used by perf standbys that weren't returning the resulting WAL state.
-* storage/raft: Don't panic on unknown raft ops [[GH-17732](https://github.com/hashicorp/vault/pull/17732)]
-* ui: fixes query parameters not passed in api explorer test requests [[GH-18743](https://github.com/hashicorp/vault/pull/18743)]
-
-## 1.11.6
-### November 30, 2022
+* core: log at level ERROR rather than INFO when all seals are unhealthy. [[GH-28564](https://github.com/hashicorp/vault/pull/28564)]
+* physical/raft: Log when the MAP_POPULATE mmap flag gets disabled before opening the database. [[GH-28526](https://github.com/hashicorp/vault/pull/28526)]
+* secrets/pki: Track the last time auto-tidy ran to address auto-tidy not running if the auto-tidy interval is longer than scheduled Vault restarts. [[GH-28488](https://github.com/hashicorp/vault/pull/28488)]
+
+BUG FIXES:
+
+* auth/cert: When using ocsp_ca_certificates, an error was produced though extra certs validation succeeded. [[GH-28597](https://github.com/hashicorp/vault/pull/28597)]
+* auth/token: Fix token TTL calculation so that it uses `max_lease_ttl` tune value for tokens created via `auth/token/create`. [[GH-28498](https://github.com/hashicorp/vault/pull/28498)]
+* databases: fix issue where local timezone was getting lost when using a rotation schedule cron [[GH-28509](https://github.com/hashicorp/vault/pull/28509)]
+* secrets-sync (enterprise): Fix KV secret access sometimes being denied, due to a double forward-slash (`//`) in the mount path, when the token should otherwise have access.
+
+## 1.17.6
+### September 25, 2024
+
+SECURITY:
+* secrets/ssh: require `valid_principals` to contain a value or `default_user` be set by default to guard against potentially insecure configurations. `allow_empty_principals` can be used for backwards compatibility [HCSEC-2024-20](https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251)
+
+CHANGES:
+
+* core: Bump Go version to 1.22.7
+* secrets/ldap: Update vault-plugin-secrets-openldap to v0.13.1 [[GH-28478](https://github.com/hashicorp/vault/pull/28478)]
+* secrets/ssh: Add a flag, `allow_empty_principals` to allow keys or certs to apply to any user/principal. [[GH-28466](https://github.com/hashicorp/vault/pull/28466)]
 
 IMPROVEMENTS:
 
-* secrets/pki: Allow issuer creation, import to change default issuer via `default_follows_latest_issuer`. [[GH-17824](https://github.com/hashicorp/vault/pull/17824)]
+* audit: Internal implementation changes to the audit subsystem which improve relability. [[GH-28286](https://github.com/hashicorp/vault/pull/28286)]
+* ui: Remove deprecated `current_billing_period` from dashboard activity log request [[GH-27559](https://github.com/hashicorp/vault/pull/27559)]
 
 BUG FIXES:
 
-* auth/okta: fix a panic for AuthRenew in Okta [[GH-18011](https://github.com/hashicorp/vault/pull/18011)]
-* auth: Deduplicate policies prior to ACL generation [[GH-17914](https://github.com/hashicorp/vault/pull/17914)]
-* cli: Fix issue preventing kv commands from executing properly when the mount path provided by `-mount` flag and secret key path are the same. [[GH-17679](https://github.com/hashicorp/vault/pull/17679)]
-* core/quotas (enterprise): Fix a lock contention issue that could occur and cause Vault to become unresponsive when creating, changing, or deleting lease count quotas.
-* core: Fix potential deadlock if barrier ciphertext is less than 4 bytes. [[GH-17944](https://github.com/hashicorp/vault/pull/17944)]
-* core: fix a start up race condition where performance standbys could go into a
-  mount loop if default policies are not yet synced from the active node. [[GH-17801](https://github.com/hashicorp/vault/pull/17801)]
-* secret/pki: fix bug with initial legacy bundle migration (from < 1.11 into 1.11+) and missing issuers from ca_chain [[GH-17772](https://github.com/hashicorp/vault/pull/17772)]
-* secrets/azure: add WAL to clean up role assignments if errors occur [[GH-18085](https://github.com/hashicorp/vault/pull/18085)]
-* secrets/gcp: Fixes duplicate service account key for rotate root on standby or secondary [[GH-18110](https://github.com/hashicorp/vault/pull/18110)]
-* ui: Fixes issue with not being able to download raft snapshot via service worker [[GH-17769](https://github.com/hashicorp/vault/pull/17769)]
-* ui: fix entity policies list link to policy show page [[GH-17950](https://github.com/hashicorp/vault/pull/17950)]
+* secret/aws: Fixed potential panic after step-down and the queue has not repopulated. [[GH-28330](https://github.com/hashicorp/vault/pull/28330)]
+* auth/cert: During certificate validation, OCSP requests are debug logged even if Vault's log level is above DEBUG. [[GH-28450](https://github.com/hashicorp/vault/pull/28450)]
+* auth/cert: ocsp_ca_certificates field was not honored when validating OCSP responses signed by a CA that did not issue the certificate. [[GH-28309](https://github.com/hashicorp/vault/pull/28309)]
+* auth: Updated error handling for missing login credentials in AppRole and UserPass auth methods to return a 400 error instead of a 500 error. [[GH-28441](https://github.com/hashicorp/vault/pull/28441)]
+* core: Fixed an issue where maximum request duration timeout was not being added to all requests containing strings sys/monitor and sys/events. With this change, timeout is now added to all requests except monitor and events endpoint. [[GH-28230](https://github.com/hashicorp/vault/pull/28230)]
+* proxy/cache (enterprise): Fixed a data race that could occur while tracking capabilities in Proxy's static secret cache. [[GH-28494](https://github.com/hashicorp/vault/pull/28494)]
+* secrets-sync (enterprise): Secondary nodes in a cluster now properly check activation-flags values.
+* secrets-sync (enterprise): Validate corresponding GitHub app parameters `app_name` and `installation_id` are set
 
-## 1.11.5
-### November 2, 2022
+## 1.17.5 
+## August 30, 2024 
 
-IMPROVEMENTS:
+SECURITY: 
 
-* database/snowflake: Allow parallel requests to Snowflake [[GH-17594](https://github.com/hashicorp/vault/pull/17594)]
-* sdk/ldap: Added support for paging when searching for groups using group filters [[GH-17640](https://github.com/hashicorp/vault/pull/17640)]
+core/audit: fix regression where client tokens and token accessors were being
+displayed in the audit log in plaintext [HCSEC-2024-18](https://discuss.hashicorp.com/t/hcsec-2024-18-vault-leaks-client-token-and-token-accessor-in-audit-devices)
 
 BUG FIXES:
 
-* core/managed-keys (enterprise): Return better error messages when encountering key creation failures
-* core/managed-keys (enterprise): fix panic when having `cache_disable` true
-* core: prevent memory leak when using control group factors in a policy [[GH-17532](https://github.com/hashicorp/vault/pull/17532)]
-* core: prevent panic during mfa after enforcement's namespace is deleted [[GH-17562](https://github.com/hashicorp/vault/pull/17562)]
-* kmip (enterprise): Fix a problem in the handling of attributes that caused Import operations to fail.
-* login: Store token in tokenhelper for interactive login MFA [[GH-17040](https://github.com/hashicorp/vault/pull/17040)]
-* secrets/pki: Do not ignore provided signature bits value when signing intermediate and leaf certificates with a managed key [[GH-17328](https://github.com/hashicorp/vault/pull/17328)]
-* secrets/pki: Do not read revoked certificates from backend when CRL is disabled [[GH-17384](https://github.com/hashicorp/vault/pull/17384)]
-* secrets/pki: Respond to tidy-status, tidy-cancel on PR Secondary clusters. [[GH-17497](https://github.com/hashicorp/vault/pull/17497)]
-* ui/keymgmt: Sets the defaultValue for type when creating a key. [[GH-17407](https://github.com/hashicorp/vault/pull/17407)]
-* ui: Fixes oidc/jwt login issue with alternate mount path and jwt login via mount path tab [[GH-17661](https://github.com/hashicorp/vault/pull/17661)]
+* proxy/cache (enterprise): Fixed an issue where Proxy with static secret caching enabled would not correctly handle requests to older secret versions for KVv2 secrets. Proxy's static secret cache now properly handles all requests relating to older versions for KVv2 secrets. [[GH-28207](https://github.com/hashicorp/vault/pull/28207)]
+* ui: fixes renew-self being called right after login for non-renewable tokens [[GH-28204](https://github.com/hashicorp/vault/pull/28204)]
 
-## 1.11.4
-### September 30, 2022
+## 1.17.4
+### August 29, 2024
 
-SECURITY:
+CHANGES:
 
-* secrets/pki: Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s CA into memory on startup, resulting in the revocation list not being checked, if the CRL has not yet been retrieved. This vulnerability, CVE-2022-41316, is fixed in Vault 1.12.0, 1.11.4, 1.10.7, and 1.9.10. [[HSEC-2022-24](https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483)]
+* activity (enterprise): filter all fields in client count responses by the request namespace [[GH-27790](https://github.com/hashicorp/vault/pull/27790)]
+* core: Bump Go version to 1.22.6
+* secrets/terraform: Update plugin to v0.9.0 [[GH-28016](https://github.com/hashicorp/vault/pull/28016)]
 
 IMPROVEMENTS:
 
-* agent/auto-auth: Add `exit_on_err` which when set to true, will cause Agent to exit if any errors are encountered during authentication. [[GH-17091](https://github.com/hashicorp/vault/pull/17091)]
-* agent: Send notifications to systemd on start and stop. [[GH-9802](https://github.com/hashicorp/vault/pull/9802)]
+* activity log: Changes how new client counts in the current month are estimated, in order to return more
+visibly sensible totals. [[GH-27547](https://github.com/hashicorp/vault/pull/27547)]
+* activity: `/sys/internal/counters/activity` will now include a warning if the specified usage period contains estimated client counts. [[GH-28068](https://github.com/hashicorp/vault/pull/28068)]
+* audit: Adds TRACE logging to log request/response under certain circumstances, and further improvements to the audit subsystem. [[GH-28056](https://github.com/hashicorp/vault/pull/28056)]
+* cli: `vault operator usage` will now include a warning if the specified usage period contains estimated client counts. [[GH-28068](https://github.com/hashicorp/vault/pull/28068)]
+* core/activity: Ensure client count queries that include the current month return consistent results by sorting the clients before performing estimation [[GH-28062](https://github.com/hashicorp/vault/pull/28062)]
+* raft-snapshot (enterprise): add support for managed identity credentials for azure snapshots
 
 BUG FIXES:
 
-* auth/cert: Vault does not initially load the CRLs in cert auth unless the read/write CRL endpoint is hit. [[GH-17138](https://github.com/hashicorp/vault/pull/17138)]
-* auth/kubernetes: Restore support for JWT signature algorithm ES384 [[GH-160](https://github.com/hashicorp/vault-plugin-auth-kubernetes/pull/160)] [[GH-17162](https://github.com/hashicorp/vault/pull/17162)]
-* auth/token: Fix ignored parameter warnings for valid parameters on token create [[GH-16938](https://github.com/hashicorp/vault/pull/16938)]
-* core/quotas: Fix goroutine leak caused by the seal process not fully cleaning up Rate Limit Quotas. [[GH-17281](https://github.com/hashicorp/vault/pull/17281)]
-* core: Prevent two or more DR failovers from invalidating SSCT tokens generated on the previous primaries. [[GH-16956](https://github.com/hashicorp/vault/pull/16956)]
-* identity/oidc: Adds `claims_supported` to discovery document. [[GH-16992](https://github.com/hashicorp/vault/pull/16992)]
-* replication (enterprise): Fix data race in SaveCheckpoint()
-* secrets/transform (enterprise): Fix an issue loading tokenization transform configuration after a specific sequence of reconfigurations.
-* secrets/transform (enterprise): Fix persistence problem with tokenization store credentials.
-* ui: Fixes secret version and status menu links transitioning to auth screen [[GH-16983](https://github.com/hashicorp/vault/pull/16983)]
-* ui: Fixes secret version and status menu links transitioning to auth screen [[GH-16983](https://github.com/hashicorp/vault/pull/16983)]
-
-## 1.11.3
-### August 31, 2022
-
-SECURITY:
+* activity: The sys/internal/counters/activity endpoint will return current month data when the end_date parameter is set to a future date. [[GH-28042](https://github.com/hashicorp/vault/pull/28042)]
+* auth/aws: fixes an issue where not supplying an external id was interpreted as an empty external id [[GH-27858](https://github.com/hashicorp/vault/pull/27858)]
+* command: The `vault secrets move` and `vault auth move` command will no longer attempt to write to storage on performance standby nodes. [[GH-28059](https://github.com/hashicorp/vault/pull/28059)]
+* core (enterprise): Fix deletion of MFA login-enforcement configurations on standby nodes
+* secrets/database: Skip connection verification on reading existing DB connection configuration [[GH-28139](https://github.com/hashicorp/vault/pull/28139)]
+* ui: fixes toast (flash) alert message saying "created" when deleting a kv v2 secret [[GH-28093](https://github.com/hashicorp/vault/pull/28093)]
 
-* core: When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. This vulnerability, CVE-2022-40186, is fixed in 1.11.3, 1.10.6, and 1.9.9. [[HSEC-2022-18](https://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550)]
+## 1.17.3
+### August 07, 2024
 
 CHANGES:
 
-* core: Bump Go version to 1.17.13.
+* auth/cf: Update plugin to v0.18.0 [[GH-27724](https://github.com/hashicorp/vault/pull/27724)]
 
 IMPROVEMENTS:
 
-* auth/kerberos: add `add_group_aliases` config to include LDAP groups in Vault group aliases [[GH-16890](https://github.com/hashicorp/vault/pull/16890)]
-* auth/kerberos: add `remove_instance_name` parameter to the login CLI and the
-Kerberos config in Vault. This removes any instance names found in the keytab
-service principal name. [[GH-16594](https://github.com/hashicorp/vault/pull/16594)]
-* identity/oidc: Adds the `client_secret_post` token endpoint authentication method. [[GH-16598](https://github.com/hashicorp/vault/pull/16598)]
-* storage/gcs: Add documentation explaining how to configure the gcs backend using environment variables instead of options in the configuration stanza [[GH-14455](https://github.com/hashicorp/vault/pull/14455)]
-
-BUG FIXES:
-
-* api: Fixed erroneous warnings of unrecognized parameters when unwrapping data. [[GH-16794](https://github.com/hashicorp/vault/pull/16794)]
-* auth/gcp: Fixes the ability to reset the configuration's credentials to use application default credentials. [[GH-16523](https://github.com/hashicorp/vault/pull/16523)]
-* auth/kerberos: Maintain headers set by the client [[GH-16636](https://github.com/hashicorp/vault/pull/16636)]
-* command/debug: fix bug where monitor was not honoring configured duration [[GH-16834](https://github.com/hashicorp/vault/pull/16834)]
-* core/license (enterprise): Always remove stored license and allow unseal to complete when license cleanup fails
-* database/elasticsearch: Fixes a bug in boolean parsing for initialize [[GH-16526](https://github.com/hashicorp/vault/pull/16526)]
-* identity/oidc: Change the `state` parameter of the Authorization Endpoint to optional. [[GH-16599](https://github.com/hashicorp/vault/pull/16599)]
-* identity/oidc: Detect invalid `redirect_uri` values sooner in validation of the
-Authorization Endpoint. [[GH-16601](https://github.com/hashicorp/vault/pull/16601)]
-* identity/oidc: Fixes validation of the `request` and `request_uri` parameters. [[GH-16600](https://github.com/hashicorp/vault/pull/16600)]
-* plugin/secrets/auth: Fix a bug with aliased backends such as aws-ec2 or generic [[GH-16673](https://github.com/hashicorp/vault/pull/16673)]
-* secrets/database: Fix a bug where the secret engine would queue up a lot of WAL deletes during startup. [[GH-16686](https://github.com/hashicorp/vault/pull/16686)]
-* secrets/gcp: Fixes duplicate static account key creation from performance secondary clusters. [[GH-16534](https://github.com/hashicorp/vault/pull/16534)]
-* secrets/pki: Fix migration to properly handle mounts that contain only keys, no certificates [[GH-16813](https://github.com/hashicorp/vault/pull/16813)]
-* secrets/pki: Ignore EC PARAMETER PEM blocks during issuer import (/config/ca, /issuers/import/*, and /intermediate/set-signed) [[GH-16721](https://github.com/hashicorp/vault/pull/16721)]
-* secrets/pki: LIST issuers endpoint is now unauthenticated. [[GH-16830](https://github.com/hashicorp/vault/pull/16830)]
-* storage/raft: Fix retry_join initialization failure [[GH-16550](https://github.com/hashicorp/vault/pull/16550)]
-* ui: Fix OIDC callback to accept namespace flag in different formats [[GH-16886](https://github.com/hashicorp/vault/pull/16886)]
-* ui: Fix info tooltip submitting form [[GH-16659](https://github.com/hashicorp/vault/pull/16659)]
-* ui: Fix naming of permitted_dns_domains form parameter on CA creation (root generation and sign intermediate). [[GH-16739](https://github.com/hashicorp/vault/pull/16739)]
-
-SECURITY:
+* audit: Ensure that any underyling errors from audit devices are logged even if we consider auditing to be a success. [[GH-27809](https://github.com/hashicorp/vault/pull/27809)]
+* audit: Internal implementation changes to the audit subsystem which improve performance. [[GH-27952](https://github.com/hashicorp/vault/pull/27952)]
+* audit: sinks (file, socket, syslog) will attempt to log errors to the server operational 
+log before returning (if there are errors to log, and the context is done). [[GH-27859](https://github.com/hashicorp/vault/pull/27859)]
+* auth/cert: Cache full list of role trust information separately to avoid
+eviction, and avoid duplicate loading during multiple simultaneous logins on
+the same role. [[GH-27902](https://github.com/hashicorp/vault/pull/27902)]
+* license utilization reporting (enterprise): Auto-roll billing start date. [[GH-27656](https://github.com/hashicorp/vault/pull/27656)]
+* website/docs: Added API documentation for Azure Secrets Engine delete role [[GH-27883](https://github.com/hashicorp/vault/pull/27883)]
+
+BUG FIXES:
+
+* auth/cert: Use subject's serial number, not issuer's within error message text in OCSP request errors [[GH-27696](https://github.com/hashicorp/vault/pull/27696)]
+* core (enterprise): Fix 500 errors that occurred querying `sys/internal/ui/mounts` for a mount prefixed by a namespace path when path filters are configured. [[GH-27939](https://github.com/hashicorp/vault/pull/27939)]
+* core/identity: Fixed an issue where deleted/reassigned entity-aliases were not removed from in-memory database. [[GH-27750](https://github.com/hashicorp/vault/pull/27750)]
+* proxy/cache (enterprise): Fixed an issue where Proxy would not correctly update KV secrets when talking to a perf standby. Proxy will now attempt to forward requests to update secrets triggered by events to the active node. Note that this requires `allow_forwarding_via_header` to be configured on the cluster. [[GH-27891](https://github.com/hashicorp/vault/pull/27891)]
+* proxy/cache (enterprise): Fixed an issue where cached static secrets could fail to update if the secrets belonged to a non-root namespace. [[GH-27730](https://github.com/hashicorp/vault/pull/27730)]
+* raft/autopilot: Fixed panic that may occur during shutdown [[GH-27726](https://github.com/hashicorp/vault/pull/27726)]
+* secrets-sync (enterprise): Destination set/remove operations will no longer be blocked as "purge in progress" after a purge job ended in failure.
+* secrets-sync (enterprise): Normalize custom_tag keys and values for recoverable invalid characters.
+* secrets-sync (enterprise): Normalize secret key names before storing the external_name in a secret association.
+* secrets-sync (enterprise): Patching github sync destination credentials will properly update and save the new credentials.
+* secrets-sync (enterprise): Return an error immediately on destination creation when providing invalid custom_tags based on destination type.
+* secrets/identity (enterprise): Fix a bug that can cause DR promotion to fail in rare cases where a PR secondary has inconsistent alias information in storage.
+* sys: Fix a bug where mounts of external plugins that were registered before Vault v1.0.0 could not be tuned to
+use versioned plugins. [[GH-27881](https://github.com/hashicorp/vault/pull/27881)]
+* ui: Fix cursor jump on KVv2 json editor that would occur after pressing ENTER. [[GH-27569](https://github.com/hashicorp/vault/pull/27569)]
+* ui: fix issue where enabling then disabling "Tidy ACME" in PKI results in failed API call. [[GH-27742](https://github.com/hashicorp/vault/pull/27742)]
+* ui: fix namespace picker not working when in small screen where the sidebar is collapsed by default. [[GH-27728](https://github.com/hashicorp/vault/pull/27728)]
+
+
+## 1.17.2
+### July 10, 2024
 
-* identity/entity: When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. [[HCSEC-2022-18](https://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550)]
+CHANGES:
 
-## 1.11.2
-### August 2, 2022
+* core: Bump Go version to 1.22.5
+* secrets/azure: Update plugin to v0.19.2 [[GH-27652](https://github.com/hashicorp/vault/pull/27652)]
 
-IMPROVEMENTS:
+FEATURES:
 
-* agent: Added `disable_keep_alives` configuration to disable keep alives in auto-auth, caching and templating. [[GH-16479](https://github.com/hashicorp/vault/pull/16479)]
+* **AWS secrets engine STS session tags support**: Adds support for setting STS
+session tags when generating temporary credentials using the AWS secrets
+engine. [[GH-27620](https://github.com/hashicorp/vault/pull/27620)]
 
 BUG FIXES:
 
-* core/auth: Return a 403 instead of a 500 for a malformed SSCT [[GH-16112](https://github.com/hashicorp/vault/pull/16112)]
-* core: Increase the allowed concurrent gRPC streams over the cluster port. [[GH-16327](https://github.com/hashicorp/vault/pull/16327)]
-* secrets/kv: Fix `kv get` issue preventing the ability to read a secret when providing a leading slash [[GH-16443](https://github.com/hashicorp/vault/pull/16443)]
-* ui: Fix issue logging in with JWT auth method [[GH-16466](https://github.com/hashicorp/vault/pull/16466)]
-
-## 1.11.1
-### July 21, 2022
-
-SECURITY:
+* cli: Fixed issue with `vault hcp connect` where HCP resources with uppercase letters were inaccessible when entering the correct project name. [[GH-27694](https://github.com/hashicorp/vault/pull/27694)]
+* core (enterprise): Fix HTTP redirects in namespaces to use the correct path and (in the case of event subscriptions) the correct URI scheme. [[GH-27660](https://github.com/hashicorp/vault/pull/27660)]
+* core/config: fix issue when using `proxy_protocol_behavior` with `deny_unauthorized`, 
+which causes the Vault TCP listener to close after receiving an untrusted upstream proxy connection. [[GH-27589](https://github.com/hashicorp/vault/pull/27589)]
+* core: Fixed an issue with performance standbys not being able to handle rotate root requests. [[GH-27631](https://github.com/hashicorp/vault/pull/27631)]
+* secrets/transit (enterprise): Fix an issue that caused input data be returned as part of generated CMAC values.
+* ui: Display an error and force a timeout when TOTP passcode is incorrect [[GH-27574](https://github.com/hashicorp/vault/pull/27574)]
+* ui: Ensure token expired banner displays when batch token expires [[GH-27479](https://github.com/hashicorp/vault/pull/27479)]
 
-* storage/raft: Vault Enterprise (“Vault”) clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. This vulnerability, CVE-2022-36129, was fixed in Vault 1.9.8, 1.10.5, and 1.11.1. [[HSEC-2022-15](https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420)]
+## 1.17.1
+### June 26, 2024
 
 CHANGES:
 
-* core: Bump Go version to 1.17.12.
+* auth/jwt: Update plugin to v0.21.0 [[GH-27498](https://github.com/hashicorp/vault/pull/27498)]
 
 IMPROVEMENTS:
 
-* agent: Added `disable_idle_connections` configuration to disable leaving idle connections open in auto-auth, caching and templating. [[GH-15986](https://github.com/hashicorp/vault/pull/15986)]
-* core: Add `sys/loggers` and `sys/loggers/:name` endpoints to provide ability to modify logging verbosity [[GH-16111](https://github.com/hashicorp/vault/pull/16111)]
-* secrets/ssh: Allow additional text along with a template definition in defaultExtension value fields. [[GH-16018](https://github.com/hashicorp/vault/pull/16018)]
+* storage/raft: Improve autopilot logging on startup to show config values clearly and avoid spurious logs [[GH-27464](https://github.com/hashicorp/vault/pull/27464)]
+* ui/secrets-sync: Hide Secrets Sync from the sidebar nav if user does not have access to the feature. [[GH-27262](https://github.com/hashicorp/vault/pull/27262)]
 
 BUG FIXES:
 
-* agent/template: Fix parsing error for the exec stanza [[GH-16231](https://github.com/hashicorp/vault/pull/16231)]
-* agent: Update consul-template for pkiCert bug fixes [[GH-16087](https://github.com/hashicorp/vault/pull/16087)]
-* core/identity: Replicate member_entity_ids and policies in identity/group across nodes identically [[GH-16088](https://github.com/hashicorp/vault/pull/16088)]
-* core/replication (enterprise): Don't flush merkle tree pages to disk after losing active duty
-* core/seal: Fix possible keyring truncation when using the file backend. [[GH-15946](https://github.com/hashicorp/vault/pull/15946)]
-* kmip (enterprise): Return SecretData as supported Object Type.
-* plugin/multiplexing: Fix panic when id doesn't exist in connection map [[GH-16094](https://github.com/hashicorp/vault/pull/16094)]
-* secret/pki: Do not fail validation with a legacy key_bits default value and key_type=any when signing CSRs [[GH-16246](https://github.com/hashicorp/vault/pull/16246)]
-* storage/raft (enterprise): Prevent unauthenticated voter status change with rejoin [[GH-16324](https://github.com/hashicorp/vault/pull/16324)]
-* transform (enterprise): Fix a bug in the handling of nested or unmatched capture groups in FPE transformations.
-* ui: OIDC login type uses localStorage instead of sessionStorage [[GH-16170](https://github.com/hashicorp/vault/pull/16170)]
+* agent: Fixed an issue causing excessive CPU usage during normal operation [[GH-27518](https://github.com/hashicorp/vault/pull/27518)]
+* config: Vault TCP listener config now correctly supports the documented proxy_protocol_behavior 
+setting of 'deny_unauthorized' [[GH-27459](https://github.com/hashicorp/vault/pull/27459)]
+* core/audit: Audit logging a Vault request/response checks if the existing context 
+is cancelled and will now use a new context with a 5 second timeout.
+If the existing context is cancelled a new context, will be used. [[GH-27531](https://github.com/hashicorp/vault/pull/27531)]
+* helper/pkcs7: Fix parsing certain messages containing only certificates [[GH-27435](https://github.com/hashicorp/vault/pull/27435)]
+* proxy: Fixed an issue causing excessive CPU usage during normal operation [[GH-27518](https://github.com/hashicorp/vault/pull/27518)]
+* replication (enterprise): fix cache invalidation issue leading to namespace custom metadata not being shown correctly on performance secondaries
+* secrets-sync (enterprise): Properly remove tags from secrets in AWS when they are removed from the source association
+* secrets-sync (enterprise): Return more accurate error code for invalid connection details
+* secrets-sync (enterprise): Skip invalid GitHub repository names when creating destinations
+* storage/azure: Fix invalid account name initialization bug [[GH-27563](https://github.com/hashicorp/vault/pull/27563)]
+* storage/raft (enterprise): Fix issue with namespace cache not getting cleared on snapshot restore, resulting in namespaces not found in the snapshot being inaccurately represented by API responses. [[GH-27474](https://github.com/hashicorp/vault/pull/27474)]
+* ui: Allow creation of session_token type roles for AWS secret backend [[GH-27424](https://github.com/hashicorp/vault/pull/27424)]
 
-SECURITY:
+## 1.17.0
+### June 12, 2024
 
-* storage/raft (enterprise): Vault Enterprise (“Vault”) clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. This vulnerability, CVE-2022-36129, was fixed in Vault 1.9.8, 1.10.5, and 1.11.1. [[HCSEC-2022-15](https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420)]
+SECURITY:
 
-## 1.11.0
-### June 20, 2022
+* auth/jwt: Update plugin to v0.20.3 that resolves a security issue with validing JWTs [[GH-26890](https://github.com/hashicorp/vault/pull/26890), [HCSEC-2024-11](https://discuss.hashicorp.com/t/hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims/67770)]
 
 CHANGES:
 
-* auth/aws: Add RoleSession to DisplayName when using assumeRole for authentication [[GH-14954](https://github.com/hashicorp/vault/pull/14954)]
-* auth/kubernetes: If `kubernetes_ca_cert` is unset, and there is no pod-local CA available, an error will be surfaced when writing config instead of waiting for login. [[GH-15584](https://github.com/hashicorp/vault/pull/15584)]
-* auth: Remove support for legacy MFA
-(https://www.vaultproject.io/docs/v1.10.x/auth/mfa) [[GH-14869](https://github.com/hashicorp/vault/pull/14869)]
-* core/fips: Disable and warn about entropy augmentation in FIPS 140-2 Inside mode [[GH-15858](https://github.com/hashicorp/vault/pull/15858)]
-* core: A request that fails path validation due to relative path check will now be responded to with a 400 rather than 500. [[GH-14328](https://github.com/hashicorp/vault/pull/14328)]
-* core: Bump Go version to 1.17.11. [[GH-go-ver-1110](https://github.com/hashicorp/vault/pull/go-ver-1110)]
-* database & storage: Change underlying driver library from [lib/pq](https://github.com/lib/pq) to [pgx](https://github.com/jackc/pgx). This change affects Redshift & Postgres database secrets engines, and CockroachDB & Postgres storage engines [[GH-15343](https://github.com/hashicorp/vault/pull/15343)]
-* licensing (enterprise): Remove support for stored licenses and associated `sys/license` and `sys/license/signed`
-endpoints in favor of [autoloaded licenses](https://www.vaultproject.io/docs/enterprise/license/autoloading).
-* replication (enterprise): The `/sys/replication/performance/primary/mount-filter` endpoint has been removed. Please use [Paths Filter](https://www.vaultproject.io/api-docs/system/replication/replication-performance#create-paths-filter) instead.
-* secret/pki: Remove unused signature_bits parameter from intermediate CSR generation; this parameter doesn't control the final certificate's signature algorithm selection as that is up to the signing CA [[GH-15478](https://github.com/hashicorp/vault/pull/15478)]
-* secrets/kubernetes: Split `additional_metadata` into `extra_annotations` and `extra_labels` parameters [[GH-15655](https://github.com/hashicorp/vault/pull/15655)]
-* secrets/pki: A new aliased api path (/pki/issuer/:issuer_ref/sign-self-issued)
-providing the same functionality as the existing API(/pki/root/sign-self-issued)
-does not require sudo capabilities but the latter still requires it in an
-effort to maintain backwards compatibility. [[GH-15211](https://github.com/hashicorp/vault/pull/15211)]
-* secrets/pki: Err on unknown role during sign-verbatim. [[GH-15543](https://github.com/hashicorp/vault/pull/15543)]
-* secrets/pki: Existing CRL API (/pki/crl) now returns an X.509 v2 CRL instead
-of a v1 CRL. [[GH-15100](https://github.com/hashicorp/vault/pull/15100)]
-* secrets/pki: The `ca_chain` response field within issuing (/pki/issue/:role)
-and signing APIs will now include the root CA certificate if the mount is
-aware of it. [[GH-15155](https://github.com/hashicorp/vault/pull/15155)]
-* secrets/pki: existing Delete Root API (pki/root) will now delete all issuers
-and keys within the mount path. [[GH-15004](https://github.com/hashicorp/vault/pull/15004)]
-* secrets/pki: existing Generate Root (pki/root/generate/:type),
-Set Signed Intermediate (/pki/intermediate/set-signed) APIs will
-add new issuers/keys to a mount instead of warning that an existing CA exists [[GH-14975](https://github.com/hashicorp/vault/pull/14975)]
-* secrets/pki: the signed CA certificate from the sign-intermediate api will now appear within the ca_chain
-response field along with the issuer's ca chain. [[GH-15524](https://github.com/hashicorp/vault/pull/15524)]
-* ui: Upgrade Ember to version 3.28 [[GH-14763](https://github.com/hashicorp/vault/pull/14763)]
+* api: Upgrade from github.com/go-jose/go-jose/v3 v3.0.3 to github.com/go-jose/go-jose/v4 v4.0.1. [[GH-26527](https://github.com/hashicorp/vault/pull/26527)]
+* audit: breaking change - Vault now allows audit logs to contain 'correlation-id' and 'x-correlation-id' headers when they 
+are present in the incoming request. By default they are not HMAC'ed (but can be configured to HMAC by Vault Operators). [[GH-26777](https://github.com/hashicorp/vault/pull/26777)]
+* auth/alicloud: Update plugin to v0.18.0 [[GH-27133](https://github.com/hashicorp/vault/pull/27133)]
+* auth/azure: Update plugin to v0.18.0 [[GH-27146](https://github.com/hashicorp/vault/pull/27146)]
+* auth/centrify: Remove the deprecated Centrify auth method plugin [[GH-27130](https://github.com/hashicorp/vault/pull/27130)]
+* auth/cf: Update plugin to v0.17.0 [[GH-27161](https://github.com/hashicorp/vault/pull/27161)]
+* auth/gcp: Update plugin to v0.18.0 [[GH-27140](https://github.com/hashicorp/vault/pull/27140)]
+* auth/jwt: Update plugin to v0.20.2 [[GH-26291](https://github.com/hashicorp/vault/pull/26291)]
+* auth/kerberos: Update plugin to v0.12.0 [[GH-27177](https://github.com/hashicorp/vault/pull/27177)]
+* auth/kubernetes: Update plugin to v0.19.0 [[GH-27186](https://github.com/hashicorp/vault/pull/27186)]
+* auth/oci: Update plugin to v0.16.0 [[GH-27142](https://github.com/hashicorp/vault/pull/27142)]
+* core (enterprise): Seal High Availability (HA) must be enabled by `enable_multiseal` in configuration.
+* core/identity: improve performance for secondary nodes receiving identity related updates through replication [[GH-27184](https://github.com/hashicorp/vault/pull/27184)]
+* core: Bump Go version to 1.22.4
+* core: return an additional "invalid token" error message in 403 response when the provided request token is expired,
+exceeded the number of uses, or is a bogus value [[GH-25953](https://github.com/hashicorp/vault/pull/25953)]
+* database/couchbase: Update plugin to v0.11.0 [[GH-27145](https://github.com/hashicorp/vault/pull/27145)]
+* database/elasticsearch: Update plugin to v0.15.0 [[GH-27136](https://github.com/hashicorp/vault/pull/27136)]
+* database/mongodbatlas: Update plugin to v0.12.0 [[GH-27143](https://github.com/hashicorp/vault/pull/27143)]
+* database/redis-elasticache: Update plugin to v0.4.0 [[GH-27139](https://github.com/hashicorp/vault/pull/27139)]
+* database/redis: Update plugin to v0.3.0 [[GH-27117](https://github.com/hashicorp/vault/pull/27117)]
+* database/snowflake: Update plugin to v0.11.0 [[GH-27132](https://github.com/hashicorp/vault/pull/27132)]
+* sdk: String templates now have a maximum size of 100,000 characters. [[GH-26110](https://github.com/hashicorp/vault/pull/26110)]
+* secrets/ad: Update plugin to v0.18.0 [[GH-27172](https://github.com/hashicorp/vault/pull/27172)]
+* secrets/alicloud: Update plugin to v0.17.0 [[GH-27134](https://github.com/hashicorp/vault/pull/27134)]
+* secrets/azure: Update plugin to v0.17.1 [[GH-26528](https://github.com/hashicorp/vault/pull/26528)]
+* secrets/azure: Update plugin to v0.19.0 [[GH-27141](https://github.com/hashicorp/vault/pull/27141)]
+* secrets/gcp: Update plugin to v0.19.0 [[GH-27164](https://github.com/hashicorp/vault/pull/27164)]
+* secrets/gcpkms: Update plugin to v0.17.0 [[GH-27163](https://github.com/hashicorp/vault/pull/27163)]
+* secrets/keymgmt (enterprise): Removed `namespace` label on the `vault.kmse.key.count` metric.
+* secrets/kmip (enterprise): Update plugin to v0.15.0
+* secrets/kubernetes: Update plugin to v0.8.0 [[GH-27187](https://github.com/hashicorp/vault/pull/27187)]
+* secrets/kv: Update plugin to v0.18.0 [[GH-26877](https://github.com/hashicorp/vault/pull/26877)]
+* secrets/kv: Update plugin to v0.19.0 [[GH-27159](https://github.com/hashicorp/vault/pull/27159)]
+* secrets/mongodbatlas: Update plugin to v0.12.0 [[GH-27149](https://github.com/hashicorp/vault/pull/27149)]
+* secrets/openldap: Update plugin to v0.13.0 [[GH-27137](https://github.com/hashicorp/vault/pull/27137)]
+* secrets/pki: sign-intermediate API will truncate notAfter if calculated to go beyond the signing issuer's notAfter. Previously the notAfter was permitted to go beyond leading to invalid chains. [[GH-26796](https://github.com/hashicorp/vault/pull/26796)]
+* secrets/terraform: Update plugin to v0.8.0 [[GH-27147](https://github.com/hashicorp/vault/pull/27147)]
+* ui/kubernetes: Update the roles filter-input to use explicit search. [[GH-27178](https://github.com/hashicorp/vault/pull/27178)]
+* ui: Update dependencies including D3 libraries [[GH-26346](https://github.com/hashicorp/vault/pull/26346)]
+* ui: Upgrade Ember data from 4.11.3 to 4.12.4 [[GH-25272](https://github.com/hashicorp/vault/pull/25272)]
+* ui: Upgrade Ember to version 5.4 [[GH-26708](https://github.com/hashicorp/vault/pull/26708)]
+* ui: deleting a nested secret will no longer redirect you to the nearest path segment [[GH-26845](https://github.com/hashicorp/vault/pull/26845)]
+* ui: flash messages render on right side of page [[GH-25459](https://github.com/hashicorp/vault/pull/25459)]
 
 FEATURES:
 
-* **Autopilot Improvements (Enterprise)**: Autopilot on Vault Enterprise now supports automated upgrades and redundancy zones when using integrated storage.
-* **KeyMgmt UI**: Add UI support for managing the Key Management Secrets Engine [[GH-15523](https://github.com/hashicorp/vault/pull/15523)]
-* **Kubernetes Secrets Engine**: This new secrets engine generates Kubernetes service account tokens, service accounts, role bindings, and roles dynamically. [[GH-15551](https://github.com/hashicorp/vault/pull/15551)]
-* **Non-Disruptive Intermediate/Root Certificate Rotation**: This allows
-import, generation and configuration of any number of keys and/or issuers
-within a PKI mount, providing operators the ability to rotate certificates
-in place without affecting existing client configurations. [[GH-15277](https://github.com/hashicorp/vault/pull/15277)]
-* **Print minimum required policy for any command**: The global CLI flag `-output-policy` can now be used with any command to print out the minimum required policy HCL for that operation, including whether the given path requires the "sudo" capability. [[GH-14899](https://github.com/hashicorp/vault/pull/14899)]
-* **Snowflake Database Plugin**: Adds ability to manage RSA key pair credentials for dynamic and static Snowflake users. [[GH-15376](https://github.com/hashicorp/vault/pull/15376)]
-* **Transit BYOK**: Allow import of externally-generated keys into the Transit secrets engine. [[GH-15414](https://github.com/hashicorp/vault/pull/15414)]
-* nomad: Bootstrap Nomad ACL system if no token is provided [[GH-12451](https://github.com/hashicorp/vault/pull/12451)]
-* storage/dynamodb: Added `AWS_DYNAMODB_REGION` environment variable. [[GH-15054](https://github.com/hashicorp/vault/pull/15054)]
+* **PKI Certificate Metadata (enterprise)**:  Add Certificate Metadata Functionality to Record and Return Client Information about a Certificate.
+* **Adaptive Overload Protection (enterprise)**: Adds Adaptive Overload Protection
+for write requests as a Beta feature (disabled by default). This automatically
+prevents overloads caused by too many write requests while maintaining optimal
+throughput for the hardware configuration and workload.
+* **LDAP Secrets engine hierarchical path support**: Hierarchical path handling is now supported for role and set APIs. [[GH-27203](https://github.com/hashicorp/vault/pull/27203)]
+* **Plugin Identity Tokens**: Adds secret-less configuration of AWS auth engine using web identity federation. [[GH-26507](https://github.com/hashicorp/vault/pull/26507)]
+* **Plugin Workload Identity** (enterprise): Vault can generate identity tokens for plugins to use in workload identity federation auth flows.
+* **Transit AES-CMAC (enterprise)**: Added support to create and verify AES backed cipher-based message authentication codes
 
 IMPROVEMENTS:
 
-* activity: return nil response months in activity log API when no month data exists [[GH-15420](https://github.com/hashicorp/vault/pull/15420)]
-* agent/auto-auth: Add `min_backoff` to the method stanza for configuring initial backoff duration. [[GH-15204](https://github.com/hashicorp/vault/pull/15204)]
-* agent: Update consul-template to v0.29.0 [[GH-15293](https://github.com/hashicorp/vault/pull/15293)]
-* agent: Upgrade hashicorp/consul-template version for sprig template functions and improved writeTo function [[GH-15092](https://github.com/hashicorp/vault/pull/15092)]
-* api/monitor: Add log_format option to allow for logs to be emitted in JSON format [[GH-15536](https://github.com/hashicorp/vault/pull/15536)]
-* api: Add ability to pass certificate as PEM bytes to api.Client. [[GH-14753](https://github.com/hashicorp/vault/pull/14753)]
-* api: Add context-aware functions to vault/api for each API wrapper function. [[GH-14388](https://github.com/hashicorp/vault/pull/14388)]
-* api: Added MFALogin() for handling MFA flow when using login helpers. [[GH-14900](https://github.com/hashicorp/vault/pull/14900)]
-* api: If the parameters supplied over the API payload are ignored due to not
-being what the endpoints were expecting, or if the parameters supplied get
-replaced by the values in the endpoint's path itself, warnings will be added to
-the non-empty responses listing all the ignored and replaced parameters. [[GH-14962](https://github.com/hashicorp/vault/pull/14962)]
-* api: KV helper methods to simplify the common use case of reading and writing KV secrets [[GH-15305](https://github.com/hashicorp/vault/pull/15305)]
-* api: Provide a helper method WithNamespace to create a cloned client with a new NS [[GH-14963](https://github.com/hashicorp/vault/pull/14963)]
-* api: Support VAULT_PROXY_ADDR environment variable to allow overriding the Vault client's HTTP proxy. [[GH-15377](https://github.com/hashicorp/vault/pull/15377)]
-* api: Use the context passed to the api/auth Login helpers. [[GH-14775](https://github.com/hashicorp/vault/pull/14775)]
-* api: make ListPlugins parse only known plugin types [[GH-15434](https://github.com/hashicorp/vault/pull/15434)]
-* audit: Add a policy_results block into the audit log that contains the set of
-policies that granted this request access. [[GH-15457](https://github.com/hashicorp/vault/pull/15457)]
-* audit: Include mount_accessor in audit request and response logs [[GH-15342](https://github.com/hashicorp/vault/pull/15342)]
-* audit: added entity_created boolean to audit log, set when login operations create an entity [[GH-15487](https://github.com/hashicorp/vault/pull/15487)]
-* auth/aws: Add rsa2048 signature type to API [[GH-15719](https://github.com/hashicorp/vault/pull/15719)]
-* auth/gcp: Enable the Google service endpoints used by the underlying client to be customized [[GH-15592](https://github.com/hashicorp/vault/pull/15592)]
-* auth/gcp: Vault CLI now infers the service account email when running on Google Cloud [[GH-15592](https://github.com/hashicorp/vault/pull/15592)]
-* auth/jwt: Adds ability to use JSON pointer syntax for the `user_claim` value. [[GH-15593](https://github.com/hashicorp/vault/pull/15593)]
-* auth/okta: Add support for Google provider TOTP type in the Okta auth method [[GH-14985](https://github.com/hashicorp/vault/pull/14985)]
-* auth/okta: Add support for performing [the number
-challenge](https://help.okta.com/en-us/Content/Topics/Mobile/ov-admin-config.htm?cshid=csh-okta-verify-number-challenge-v1#enable-number-challenge)
-during an Okta Verify push challenge [[GH-15361](https://github.com/hashicorp/vault/pull/15361)]
-* auth: Globally scoped Login MFA method Get/List endpoints [[GH-15248](https://github.com/hashicorp/vault/pull/15248)]
-* auth: enforce a rate limit for TOTP passcode validation attempts [[GH-14864](https://github.com/hashicorp/vault/pull/14864)]
-* auth: forward cached MFA auth response to the leader using RPC instead of forwarding all login requests [[GH-15469](https://github.com/hashicorp/vault/pull/15469)]
-* cli/debug: added support for retrieving metrics from DR clusters if `unauthenticated_metrics_access` is enabled [[GH-15316](https://github.com/hashicorp/vault/pull/15316)]
-* cli/vault: warn when policy name contains upper-case letter [[GH-14670](https://github.com/hashicorp/vault/pull/14670)]
-* cli: Alternative flag-based syntax for KV to mitigate confusion from automatically appended /data [[GH-14807](https://github.com/hashicorp/vault/pull/14807)]
-* cockroachdb: add high-availability support [[GH-12965](https://github.com/hashicorp/vault/pull/12965)]
-* command/debug: Add log_format flag to allow for logs to be emitted in JSON format [[GH-15536](https://github.com/hashicorp/vault/pull/15536)]
-* command: Support optional '-log-level' flag to be passed to 'operator migrate' command (defaults to info). Also support VAULT_LOG_LEVEL env var. [[GH-15405](https://github.com/hashicorp/vault/pull/15405)]
-* command: Support the optional '-detailed' flag to be passed to 'vault list' command to show ListResponseWithInfo data. Also supports the VAULT_DETAILED env var. [[GH-15417](https://github.com/hashicorp/vault/pull/15417)]
-* core (enterprise): Include `termination_time` in `sys/license/status` response
-* core (enterprise): Include termination time in `license inspect` command output
-* core,transit: Allow callers to choose random byte source including entropy augmentation sources for the sys/tools/random and transit/random endpoints. [[GH-15213](https://github.com/hashicorp/vault/pull/15213)]
-* core/activity: Order month data in ascending order of timestamps [[GH-15259](https://github.com/hashicorp/vault/pull/15259)]
-* core/activity: allow client counts to be precomputed and queried on non-contiguous chunks of data [[GH-15352](https://github.com/hashicorp/vault/pull/15352)]
-* core/managed-keys (enterprise): Allow configuring the number of parallel operations to PKCS#11 managed keys.
-* core: Add an export API for historical activity log data [[GH-15586](https://github.com/hashicorp/vault/pull/15586)]
-* core: Add new DB methods that do not prepare statements. [[GH-15166](https://github.com/hashicorp/vault/pull/15166)]
-* core: check uid and permissions of config dir, config file, plugin dir and plugin binaries [[GH-14817](https://github.com/hashicorp/vault/pull/14817)]
-* core: Fix some identity data races found by Go race detector (no known impact yet). [[GH-15123](https://github.com/hashicorp/vault/pull/15123)]
-* core: Include build date in `sys/seal-status` and `sys/version-history` endpoints. [[GH-14957](https://github.com/hashicorp/vault/pull/14957)]
-* core: Upgrade github.org/x/crypto/ssh [[GH-15125](https://github.com/hashicorp/vault/pull/15125)]
-* kmip (enterprise): Implement operations Query, Import, Encrypt and Decrypt. Improve operations Locate, Add Attribute, Get Attributes and Get Attribute List to handle most supported attributes.
-* mfa/okta: migrate to use official Okta SDK [[GH-15355](https://github.com/hashicorp/vault/pull/15355)]
-* sdk: Change OpenAPI code generator to extract request objects into /components/schemas and reference them by name. [[GH-14217](https://github.com/hashicorp/vault/pull/14217)]
-* secrets/consul: Add support for Consul node-identities and service-identities [[GH-15295](https://github.com/hashicorp/vault/pull/15295)]
-* secrets/consul: Vault is now able to automatically bootstrap the Consul ACL system. [[GH-10751](https://github.com/hashicorp/vault/pull/10751)]
-* secrets/database/elasticsearch: Use the new /_security base API path instead of /_xpack/security when managing elasticsearch. [[GH-15614](https://github.com/hashicorp/vault/pull/15614)]
-* secrets/pki: Add not_before_duration to root CA generation, intermediate CA signing paths. [[GH-14178](https://github.com/hashicorp/vault/pull/14178)]
-* secrets/pki: Add support for CPS URLs and User Notice to Policy Information [[GH-15751](https://github.com/hashicorp/vault/pull/15751)]
-* secrets/pki: Allow operators to control the issuing certificate behavior when
-the requested TTL is beyond the NotAfter value of the signing certificate [[GH-15152](https://github.com/hashicorp/vault/pull/15152)]
-* secrets/pki: Always return CRLs, URLs configurations, even if using the default value. [[GH-15470](https://github.com/hashicorp/vault/pull/15470)]
-* secrets/pki: Enable Patch Functionality for Roles and Issuers (API only) [[GH-15510](https://github.com/hashicorp/vault/pull/15510)]
-* secrets/pki: Have pki/sign-verbatim use the not_before_duration field defined in the role [[GH-15429](https://github.com/hashicorp/vault/pull/15429)]
-* secrets/pki: Warn on empty Subject field during issuer generation (root/generate and root/sign-intermediate). [[GH-15494](https://github.com/hashicorp/vault/pull/15494)]
-* secrets/pki: Warn on missing AIA access information when generating issuers (config/urls). [[GH-15509](https://github.com/hashicorp/vault/pull/15509)]
-* secrets/pki: Warn when `generate_lease` and `no_store` are both set to `true` on requests. [[GH-14292](https://github.com/hashicorp/vault/pull/14292)]
-* secrets/ssh: Add connection timeout of 1 minute for outbound SSH connection in deprecated Dynamic SSH Keys mode. [[GH-15440](https://github.com/hashicorp/vault/pull/15440)]
-* secrets/ssh: Support for `add_before_duration` in SSH [[GH-15250](https://github.com/hashicorp/vault/pull/15250)]
-* sentinel (enterprise): Upgrade sentinel to [v0.18.5](https://docs.hashicorp.com/sentinel/changelog#0-18-5-january-14-2022) to avoid potential naming collisions in the remote installer
-* storage/raft: Use larger timeouts at startup to reduce likelihood of inducing elections. [[GH-15042](https://github.com/hashicorp/vault/pull/15042)]
-* ui: Allow namespace param to be parsed from state queryParam [[GH-15378](https://github.com/hashicorp/vault/pull/15378)]
-* ui: Default auto-rotation period in transit is 30 days [[GH-15474](https://github.com/hashicorp/vault/pull/15474)]
-* ui: Parse schema refs from OpenAPI [[GH-14508](https://github.com/hashicorp/vault/pull/14508)]
-* ui: Remove stored license references [[GH-15513](https://github.com/hashicorp/vault/pull/15513)]
-* ui: Remove storybook. [[GH-15074](https://github.com/hashicorp/vault/pull/15074)]
-* ui: Replaces the IvyCodemirror wrapper with a custom ember modifier. [[GH-14659](https://github.com/hashicorp/vault/pull/14659)]
-* website/docs: Add usage documentation for Kubernetes Secrets Engine [[GH-15527](https://github.com/hashicorp/vault/pull/15527)]
-* website/docs: added a link to an Enigma secret plugin. [[GH-14389](https://github.com/hashicorp/vault/pull/14389)]
+* activity (enterprise): Change minimum retention window in activity log to 48 months
+* agent: Added a new config option, `lease_renewal_threshold`, that controls the refresh rate of non-renewable leases in Agent's template engine. [[GH-25212](https://github.com/hashicorp/vault/pull/25212)]
+* agent: Agent will re-trigger auto auth if token used for rendering templates has been revoked, has exceeded the number of uses, or is a bogus value. [[GH-26172](https://github.com/hashicorp/vault/pull/26172)]
+* api: Move CLI token helper functions to importable packages in `api` module. [[GH-25744](https://github.com/hashicorp/vault/pull/25744)]
+* audit: timestamps across multiple audit devices for an audit entry will now match. [[GH-26088](https://github.com/hashicorp/vault/pull/26088)]
+* auth/aws: Add inferred_hostname metadata for IAM AWS authentication method. [[GH-25418](https://github.com/hashicorp/vault/pull/25418)]
+* auth/aws: add canonical ARN as entity alias option [[GH-22460](https://github.com/hashicorp/vault/pull/22460)]
+* auth/aws: add support for external_ids in AWS assume-role [[GH-26628](https://github.com/hashicorp/vault/pull/26628)]
+* auth/cert: Adds support for TLS certificate authenticaion through a reverse proxy that terminates the SSL connection [[GH-17272](https://github.com/hashicorp/vault/pull/17272)]
+* cli: Add events subscriptions commands
+* command/server: Removed environment variable requirement to generate pprof 
+files using SIGUSR2. Added CPU profile support. [[GH-25391](https://github.com/hashicorp/vault/pull/25391)]
+* core (enterprise): persist seal rewrap status, so rewrap status API is consistent on secondary nodes.
+* core/activity: Include ACME client metrics to precomputed queries [[GH-26519](https://github.com/hashicorp/vault/pull/26519)]
+* core/activity: Include ACME clients in activity log responses [[GH-26020](https://github.com/hashicorp/vault/pull/26020)]
+* core/activity: Include ACME clients in vault operator usage response [[GH-26525](https://github.com/hashicorp/vault/pull/26525)]
+* core/config: reload service registration configuration on SIGHUP [[GH-17598](https://github.com/hashicorp/vault/pull/17598)]
+* core: add deadlock detection in barrier and sealwrap
+* license utilization reporting (enterprise): Add retention months to license utilization reports.
+* proxy/cache (enterprise): Support new configuration parameter for static secret caching, `static_secret_token_capability_refresh_behavior`, to control the behavior when the capability refresh request receives an error from Vault.
+* proxy: Proxy will re-trigger auto auth if the token used for requests has been revoked, has exceeded the number of uses,
+or is an otherwise invalid value. [[GH-26307](https://github.com/hashicorp/vault/pull/26307)]
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20221104090112-13395acd02c5
+* replication (enterprise): Add replication heartbeat metric to telemetry
+* replication (enterprise): Periodically write current time on the primary to storage, use that downstream to measure replication lag in time, expose that in health and replication status endpoints. [[GH-26406](https://github.com/hashicorp/vault/pull/26406)]
+* sdk/decompression: DecompressWithCanary will now chunk the decompression in memory to prevent loading it all at once. [[GH-26464](https://github.com/hashicorp/vault/pull/26464)]
+* sdk/helper/testcluster: add some new helpers, improve some error messages. [[GH-25329](https://github.com/hashicorp/vault/pull/25329)]
+* sdk/helper/testhelpers: add namespace helpers [[GH-25270](https://github.com/hashicorp/vault/pull/25270)]
+* secrets-sync (enterprise): Added global config path to the administrative namespace.
+* secrets/pki (enterprise): Disable warnings about unknown parameters to the various CIEPS endpoints
+* secrets/pki: Add a new ACME configuration parameter that allows increasing the maximum TTL for ACME leaf certificates [[GH-26797](https://github.com/hashicorp/vault/pull/26797)]
+* secrets/transform (enterprise): Add delete by token and delete by plaintext operations to Tokenization.
+* storage/azure: Perform validation on Azure account name and container name [[GH-26135](https://github.com/hashicorp/vault/pull/26135)]
+* storage/raft (enterprise): add support for separate entry size limit for mount
+and namespace table paths in storage to allow increased mount table size without
+allowing other user storage entries to become larger. [[GH-25992](https://github.com/hashicorp/vault/pull/25992)]
+* storage/raft: panic on unknown Raft operations [[GH-25991](https://github.com/hashicorp/vault/pull/25991)]
+* ui (enterprise): Allow HVD users to access Secrets Sync. [[GH-26841](https://github.com/hashicorp/vault/pull/26841)]
+* ui (enterprise): Update dashboard to make activity log query using the same start time as the metrics overview [[GH-26729](https://github.com/hashicorp/vault/pull/26729)]
+* ui (enterprise): Update filters on the custom messages list view. [[GH-26653](https://github.com/hashicorp/vault/pull/26653)]
+* ui: Allow users to wrap inputted data again instead of resetting form [[GH-27289](https://github.com/hashicorp/vault/pull/27289)]
+* ui: Display ACME clients on a separate page in the UI. [[GH-26020](https://github.com/hashicorp/vault/pull/26020)]
+* ui: Hide dashboard client count card if user does not have permission to view clients. [[GH-26848](https://github.com/hashicorp/vault/pull/26848)]
+* ui: Show computed values from `sys/internal/ui/mounts` endpoint for auth mount configuration view [[GH-26663](https://github.com/hashicorp/vault/pull/26663)]
+* ui: Update PGP display and show error for Generate Operation Token flow with PGP [[GH-26993](https://github.com/hashicorp/vault/pull/26993)]
+* ui: Update language in Transit secret engine to reflect that not all keys are for encyryption [[GH-27346](https://github.com/hashicorp/vault/pull/27346)]
+* ui: Update userpass user form to allow setting `password_hash` field. [[GH-26577](https://github.com/hashicorp/vault/pull/26577)]
+* ui: fixes cases where inputs did not have associated labels [[GH-26263](https://github.com/hashicorp/vault/pull/26263)]
+* ui: show banner instead of permission denied error when batch token is expired [[GH-26396](https://github.com/hashicorp/vault/pull/26396)]
+* website/docs: Add note about eventual consietency with the MongoDB Atlas database secrets engine [[GH-24152](https://github.com/hashicorp/vault/pull/24152)]
 
 DEPRECATIONS:
 
-* docs: Document removal of X.509 certificates with signatures who use SHA-1 in Vault 1.12 [[GH-15581](https://github.com/hashicorp/vault/pull/15581)]
-* secrets/consul: Deprecate old parameters "token_type" and "policy" [[GH-15550](https://github.com/hashicorp/vault/pull/15550)]
-* secrets/consul: Deprecate parameter "policies" in favor of "consul_policies" for consistency [[GH-15400](https://github.com/hashicorp/vault/pull/15400)]
-
-BUG FIXES:
-
-* Fixed panic when adding or modifying a Duo MFA Method in Enterprise
-* agent: Fix log level mismatch between ERR and ERROR [[GH-14424](https://github.com/hashicorp/vault/pull/14424)]
-* agent: Redact auto auth token from renew endpoints [[GH-15380](https://github.com/hashicorp/vault/pull/15380)]
-* api/sys/raft: Update RaftSnapshotRestore to use net/http client allowing bodies larger than allocated memory to be streamed [[GH-14269](https://github.com/hashicorp/vault/pull/14269)]
-* api: Fixes bug where OutputCurlString field was unintentionally being copied over during client cloning [[GH-14968](https://github.com/hashicorp/vault/pull/14968)]
-* api: Respect increment value in grace period calculations in LifetimeWatcher [[GH-14836](https://github.com/hashicorp/vault/pull/14836)]
-* auth/approle: Add maximum length for input values that result in SHA56 HMAC calculation [[GH-14746](https://github.com/hashicorp/vault/pull/14746)]
-* auth/kubernetes: Fix error code when using the wrong service account [[GH-15584](https://github.com/hashicorp/vault/pull/15584)]
-* auth/ldap: The logic for setting the entity alias when `username_as_alias` is set
-has been fixed. The previous behavior would make a request to the LDAP server to
-get `user_attr` before discarding it and using the username instead. This would
-make it impossible for a user to connect if this attribute was missing or had
-multiple values, even though it would not be used anyway. This has been fixed
-and the username is now used without making superfluous LDAP searches. [[GH-15525](https://github.com/hashicorp/vault/pull/15525)]
-* auth: Fixed erroneous success message when using vault login in case of two-phase MFA [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
-* auth: Fixed erroneous token information being displayed when using vault login in case of two-phase MFA [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
-* auth: Fixed two-phase MFA information missing from table format when using vault login [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
-* auth: Prevent deleting a valid MFA method ID using the endpoint for a different MFA method type [[GH-15482](https://github.com/hashicorp/vault/pull/15482)]
-* auth: forward requests subject to login MFA from perfStandby to Active node [[GH-15009](https://github.com/hashicorp/vault/pull/15009)]
-* auth: load login MFA configuration upon restart [[GH-15261](https://github.com/hashicorp/vault/pull/15261)]
-* cassandra: Update gocql Cassandra client to fix "no hosts available in the pool" error [[GH-14973](https://github.com/hashicorp/vault/pull/14973)]
-* cli: Fix panic caused by parsing key=value fields whose value is a single backslash [[GH-14523](https://github.com/hashicorp/vault/pull/14523)]
-* cli: kv get command now honors trailing spaces to retrieve secrets [[GH-15188](https://github.com/hashicorp/vault/pull/15188)]
-* command: do not report listener and storage types as key not found warnings [[GH-15383](https://github.com/hashicorp/vault/pull/15383)]
-* core (enterprise): Allow local alias create RPCs to persist alias metadata
-* core (enterprise): Fix overcounting of lease count quota usage at startup.
-* core (enterprise): Fix some races in merkle index flushing code found in testing
-* core (enterprise): Handle additional edge cases reinitializing PKCS#11 libraries after login errors.
-* core/config: Only ask the system about network interfaces when address configs contain a template having the format: {{ ... }} [[GH-15224](https://github.com/hashicorp/vault/pull/15224)]
-* core/managed-keys (enterprise): Allow PKCS#11 managed keys to use 0 as a slot number
-* core/metrics: Fix incorrect table size metric for local mounts [[GH-14755](https://github.com/hashicorp/vault/pull/14755)]
-* core: Fix double counting for "route" metrics [[GH-12763](https://github.com/hashicorp/vault/pull/12763)]
-* core: Fix panic caused by parsing JSON integers for fields defined as comma-delimited integers [[GH-15072](https://github.com/hashicorp/vault/pull/15072)]
-* core: Fix panic caused by parsing JSON integers for fields defined as comma-delimited strings [[GH-14522](https://github.com/hashicorp/vault/pull/14522)]
-* core: Fix panic caused by parsing policies with empty slice values. [[GH-14501](https://github.com/hashicorp/vault/pull/14501)]
-* core: Fix panic for help request URL paths without /v1/ prefix [[GH-14704](https://github.com/hashicorp/vault/pull/14704)]
-* core: Limit SSCT WAL checks on perf standbys to raft backends only [[GH-15879](https://github.com/hashicorp/vault/pull/15879)]
-* core: Prevent changing file permissions of audit logs when mode 0000 is used. [[GH-15759](https://github.com/hashicorp/vault/pull/15759)]
-* core: Prevent metrics generation from causing deadlocks. [[GH-15693](https://github.com/hashicorp/vault/pull/15693)]
-* core: fixed systemd reloading notification [[GH-15041](https://github.com/hashicorp/vault/pull/15041)]
-* core: fixing excessive unix file permissions [[GH-14791](https://github.com/hashicorp/vault/pull/14791)]
-* core: fixing excessive unix file permissions on dir, files and archive created by vault debug command [[GH-14846](https://github.com/hashicorp/vault/pull/14846)]
-* core: pre-calculate namespace specific paths when tainting a route during postUnseal [[GH-15067](https://github.com/hashicorp/vault/pull/15067)]
-* core: renaming the environment variable VAULT_DISABLE_FILE_PERMISSIONS_CHECK to VAULT_ENABLE_FILE_PERMISSIONS_CHECK and adjusting the logic [[GH-15452](https://github.com/hashicorp/vault/pull/15452)]
-* core: report unused or redundant keys in server configuration [[GH-14752](https://github.com/hashicorp/vault/pull/14752)]
-* core: time.After() used in a select statement can lead to memory leak [[GH-14814](https://github.com/hashicorp/vault/pull/14814)]
-* identity: deduplicate policies when creating/updating identity groups [[GH-15055](https://github.com/hashicorp/vault/pull/15055)]
-* mfa/okta: disable client side rate limiting causing delays in push notifications [[GH-15369](https://github.com/hashicorp/vault/pull/15369)]
-* plugin: Fix a bug where plugin reload would falsely report success in certain scenarios. [[GH-15579](https://github.com/hashicorp/vault/pull/15579)]
-* raft: fix Raft TLS key rotation panic that occurs if active key is more than 24 hours old [[GH-15156](https://github.com/hashicorp/vault/pull/15156)]
-* raft: Ensure initialMmapSize is set to 0 on Windows [[GH-14977](https://github.com/hashicorp/vault/pull/14977)]
-* replication (enterprise): fix panic due to missing entity during invalidation of local aliases. [[GH-14622](https://github.com/hashicorp/vault/pull/14622)]
-* sdk/cidrutil: Only check if cidr contains remote address for IP addresses [[GH-14487](https://github.com/hashicorp/vault/pull/14487)]
-* sdk: Fix OpenApi spec generator to properly convert TypeInt64 to OAS supported int64 [[GH-15104](https://github.com/hashicorp/vault/pull/15104)]
-* sdk: Fix OpenApi spec generator to remove duplicate sha_256 parameter [[GH-15163](https://github.com/hashicorp/vault/pull/15163)]
-* secrets/database: Ensure that a `connection_url` password is redacted in all cases. [[GH-14744](https://github.com/hashicorp/vault/pull/14744)]
-* secrets/kv: Fix issue preventing the ability to reset the `delete_version_after` key metadata field to 0s via HTTP `PATCH`. [[GH-15792](https://github.com/hashicorp/vault/pull/15792)]
-* secrets/pki: CRLs on performance secondary clusters are now automatically
-rebuilt upon changes to the list of issuers. [[GH-15179](https://github.com/hashicorp/vault/pull/15179)]
-* secrets/pki: Fix handling of "any" key type with default zero signature bits value. [[GH-14875](https://github.com/hashicorp/vault/pull/14875)]
-* secrets/pki: Fixed bug where larger SHA-2 hashes were truncated with shorter ECDSA CA certificates [[GH-14943](https://github.com/hashicorp/vault/pull/14943)]
-* secrets/ssh: Convert role field not_before_duration to seconds before returning it [[GH-15559](https://github.com/hashicorp/vault/pull/15559)]
-* storage/raft (enterprise):  Auto-snapshot configuration now forbids slashes in file prefixes for all types, and "/" in path prefix for local storage type.  Strip leading prefix in path prefix for AWS.  Improve error handling/reporting.
-* storage/raft: Forward autopilot state requests on perf standbys to active node. [[GH-15493](https://github.com/hashicorp/vault/pull/15493)]
-* storage/raft: joining a node to a cluster now ignores any VAULT_NAMESPACE environment variable set on the server process [[GH-15519](https://github.com/hashicorp/vault/pull/15519)]
-* ui: Fix Generated Token's Policies helpText to clarify that comma separated values are not accepted in this field. [[GH-15046](https://github.com/hashicorp/vault/pull/15046)]
-* ui: Fix KV secret showing in the edit form after a user creates a new version but doesn't have read capabilities [[GH-14794](https://github.com/hashicorp/vault/pull/14794)]
-* ui: Fix inconsistent behavior in client count calendar widget [[GH-15789](https://github.com/hashicorp/vault/pull/15789)]
-* ui: Fix issue where metadata tab is hidden even though policy grants access [[GH-15824](https://github.com/hashicorp/vault/pull/15824)]
-* ui: Fix issue with KV not recomputing model when you changed versions. [[GH-14941](https://github.com/hashicorp/vault/pull/14941)]
-* ui: Fixed client count timezone for start and end months [[GH-15167](https://github.com/hashicorp/vault/pull/15167)]
-* ui: Fixed unsupported revocation statements field for DB roles [[GH-15573](https://github.com/hashicorp/vault/pull/15573)]
-* ui: Fixes edit auth method capabilities issue [[GH-14966](https://github.com/hashicorp/vault/pull/14966)]
-* ui: Fixes issue logging in with OIDC from a listed auth mounts tab [[GH-14916](https://github.com/hashicorp/vault/pull/14916)]
-* ui: Revert using localStorage in favor of sessionStorage [[GH-15769](https://github.com/hashicorp/vault/pull/15769)]
-* ui: Updated `leasId` to `leaseId` in the "Copy Credentials" section of "Generate AWS Credentials" [[GH-15685](https://github.com/hashicorp/vault/pull/15685)]
-* ui: fix firefox inability to recognize file format of client count csv export [[GH-15364](https://github.com/hashicorp/vault/pull/15364)]
-* ui: fix form validations ignoring default values and disabling submit button [[GH-15560](https://github.com/hashicorp/vault/pull/15560)]
-* ui: fix search-select component showing blank selections when editing group member entity [[GH-15058](https://github.com/hashicorp/vault/pull/15058)]
-* ui: masked values no longer give away length or location of special characters [[GH-15025](https://github.com/hashicorp/vault/pull/15025)]
-
-## 1.10.11
-### March 01, 2023
+* Request Limiter Beta(enterprise): This Beta feature added in 1.16 has been
+superseded by Adaptive Overload Protection and will be removed.
+* secrets/azure: Deprecate field "password_policy" as we are not able to set it anymore with the new MS Graph API. [[GH-25637](https://github.com/hashicorp/vault/pull/25637)]
+
+BUG FIXES:
+
+* activity (enterprise): fix read-only storage error on upgrades
+* agent: Correctly constructs kv-v2 secret paths in nested namespaces. [[GH-26863](https://github.com/hashicorp/vault/pull/26863)]
+* agent: Fixes a high Vault load issue, by restarting the Conusl template server after backing off instead of immediately. [[GH-25497](https://github.com/hashicorp/vault/pull/25497)]
+* agent: `vault.namespace` no longer gets incorrectly overridden by `auto_auth.namespace`, if set [[GH-26427](https://github.com/hashicorp/vault/pull/26427)]
+* api: fixed a bug where LifetimeWatcher routines weren't respecting exponential backoff in the presence of unexpected errors [[GH-26383](https://github.com/hashicorp/vault/pull/26383)]
+* audit: Operator changes to configured audit headers (via `/sys/config/auditing`) 
+will now force invalidation and be reloaded from storage when data is replicated 
+to other nodes.
+* auth/ldap: Fix login error for group search anonymous bind. [[GH-26200](https://github.com/hashicorp/vault/pull/26200)]
+* auth/ldap: Fix login error missing entity alias attribute value. [[GH-26200](https://github.com/hashicorp/vault/pull/26200)]
+* auto-auth: Addressed issue where having no permissions to renew a renewable token caused auto-auth to attempt to renew constantly with no backoff [[GH-26844](https://github.com/hashicorp/vault/pull/26844)]
+* cli/debug: Fix resource leak in CLI debug command. [[GH-26167](https://github.com/hashicorp/vault/pull/26167)]
+* cli: fixed a bug where the Vault CLI would error out if 
+HOME was not set. [[GH-26243](https://github.com/hashicorp/vault/pull/26243)]
+* core (enterprise): Fix 403s returned when forwarding invalid token to active node from secondary.
+* core (enterprise): Fix an issue that prevented the seal re-wrap status from reporting that a re-wrap is in progress for up to a second.
+* core (enterprise): fix bug where raft followers disagree with the seal type after returning to one seal from two. [[GH-26523](https://github.com/hashicorp/vault/pull/26523)]
+* core (enterprise): fix issue where the Seal HA rewrap system may remain running when an active node steps down.
+* core/audit: Audit logging a Vault request/response will now use a minimum 5 second context timeout. 
+If the existing context deadline occurs later than 5s in the future, it will be used, otherwise a 
+new context, separate from the original will be used. [[GH-26616](https://github.com/hashicorp/vault/pull/26616)]
+* core/metrics: store cluster name in unencrypted storage to prevent blank cluster name [[GH-26878](https://github.com/hashicorp/vault/pull/26878)]
+* core/namespace (enterprise): Privileged namespace paths provided in the `administrative_namespace_path` config will now be canonicalized.
+* core/seal: During a seal reload through SIGHUP, only write updated seal barrier on an active node [[GH-26381](https://github.com/hashicorp/vault/pull/26381)]
+* core/seal: allow overriding of VAULT_GCPCKMS_SEAL_KEY_RING and VAULT_GCPCKMS_SEAL_CRYPTO_KEY environment keys in seal-ha
+* core: Add missing field delegated_auth_accessors to GET /sys/mounts/:path API response [[GH-26876](https://github.com/hashicorp/vault/pull/26876)]
+* core: Address a data race updating a seal's last seen healthy time attribute [[GH-27014](https://github.com/hashicorp/vault/pull/27014)]
+* core: Fix `redact_version` listener parameter being ignored for some OpenAPI related endpoints. [[GH-26607](https://github.com/hashicorp/vault/pull/26607)]
+* core: Only reload seal configuration when enable_multiseal is set to true. [[GH-26166](https://github.com/hashicorp/vault/pull/26166)]
+* core: when listener configuration `chroot_namespace` is active, Vault will no longer report that the configuration is invalid when Vault is sealed
+* events (enterprise): Fix bug preventing subscribing and receiving events within a namepace.
+* events (enterprise): Terminate WebSocket connection when token is revoked.
+* openapi: Fixing approle reponse duration types [[GH-25510](https://github.com/hashicorp/vault/pull/25510)]
+* openapi: added the missing migrate parameter for the unseal endpoint in vault/logical_system_paths.go [[GH-25550](https://github.com/hashicorp/vault/pull/25550)]
+* pki: Fix error in cross-signing using ed25519 keys [[GH-27093](https://github.com/hashicorp/vault/pull/27093)]
+* plugin/wif: fix a bug where the namespace was not set for external plugins using workload identity federation [[GH-26384](https://github.com/hashicorp/vault/pull/26384)]
+* replication (enterprise): fix "given mount path is not in the same namespace as the request" error that can occur when enabling replication for the first time on a secondary cluster
+* replication (enterprise): fixed data integrity issue with the processing of identity aliases causing duplicates to occur in rare cases
+* router: Fix missing lock in MatchingSystemView. [[GH-25191](https://github.com/hashicorp/vault/pull/25191)]
+* secret/database: Fixed race condition where database mounts may leak connections [[GH-26147](https://github.com/hashicorp/vault/pull/26147)]
+* secrets-sync (enterprise): Fixed an issue with syncing to target projects in GCP
+* secrets/azure: Update vault-plugin-secrets-azure to 0.17.2 to include a bug fix for azure role creation [[GH-26896](https://github.com/hashicorp/vault/pull/26896)]
+* secrets/pki (enterprise): cert_role parameter within authenticators.cert EST configuration handler could not be set
+* secrets/pki: fixed validation bug which rejected ldap schemed URLs in crl_distribution_points. [[GH-26477](https://github.com/hashicorp/vault/pull/26477)]
+* secrets/transform (enterprise): Fix a bug preventing the use of alternate schemas on PostgreSQL token stores.
+* secrets/transit: Use 'hash_algorithm' parameter if present in HMAC verify requests. Otherwise fall back to deprecated 'algorithm' parameter. [[GH-27211](https://github.com/hashicorp/vault/pull/27211)]
+* storage/raft (enterprise): Fix a bug where autopilot automated upgrades could fail due to using the wrong upgrade version
+* storage/raft (enterprise): Fix a regression introduced in 1.15.8 that causes
+autopilot to fail to discover new server versions and so not trigger an upgrade. [[GH-27277](https://github.com/hashicorp/vault/pull/27277)]
+* storage/raft: prevent writes from impeding leader transfers, e.g. during automated upgrades [[GH-25390](https://github.com/hashicorp/vault/pull/25390)]
+* transform (enterprise): guard against a panic looking up a token in exportable mode with barrier storage.
+* ui: Do not show resultant-ACL banner when ancestor namespace grants wildcard access. [[GH-27263](https://github.com/hashicorp/vault/pull/27263)]
+* ui: Fix KVv2 cursor jumping inside json editor after initial input. [[GH-27120](https://github.com/hashicorp/vault/pull/27120)]
+* ui: Fix KVv2 json editor to allow null values. [[GH-27094](https://github.com/hashicorp/vault/pull/27094)]
+* ui: Fix a bug where disabling TTL on the AWS credential form would still send TTL value [[GH-27366](https://github.com/hashicorp/vault/pull/27366)]
+* ui: Fix broken help link in console for the web command. [[GH-26858](https://github.com/hashicorp/vault/pull/26858)]
+* ui: Fix configuration link from Secret Engine list view for Ember engines. [[GH-27131](https://github.com/hashicorp/vault/pull/27131)]
+* ui: Fix link to v2 generic secrets engine from secrets list page. [[GH-27019](https://github.com/hashicorp/vault/pull/27019)]
+* ui: Prevent perpetual loading screen when Vault needs initialization [[GH-26985](https://github.com/hashicorp/vault/pull/26985)]
+* ui: Refresh model within a namespace on the Secrets Sync overview page. [[GH-26790](https://github.com/hashicorp/vault/pull/26790)]
+* ui: Remove possibility of returning an undefined timezone from date-format helper [[GH-26693](https://github.com/hashicorp/vault/pull/26693)]
+* ui: Resolved accessibility issues with Web REPL. Associated label and help text with input, added a conditional to show the console/ui-panel only when toggled open, added keyboard focus trap. [[GH-26872](https://github.com/hashicorp/vault/pull/26872)]
+* ui: fix issue where a month without new clients breaks the client count dashboard [[GH-27352](https://github.com/hashicorp/vault/pull/27352)]
+* ui: fixed a bug where the replication pages did not update display when navigating between DR and performance [[GH-26325](https://github.com/hashicorp/vault/pull/26325)]
+* ui: fixes undefined start time in filename for downloaded client count attribution csv [[GH-26485](https://github.com/hashicorp/vault/pull/26485)]
+
+## 1.16.27 Enterprise
+### October 23, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 SECURITY:
 
-* auth/approle: When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the /auth/approle/role/:role_name/secret-id-accessor/destroy endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999 has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above. [[HSEC-2023-07](https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305)]
+* auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
+* ui: disable scarf analytics for ui builds
 
 CHANGES:
 
-* core: Bump Go version to 1.19.6.
+* core: Bump Go version to 1.24.9.
+* http: Evaluate rate limit quotas before checking JSON limits during request handling.
 
 IMPROVEMENTS:
 
-* secrets/database: Adds error message requiring password on root crednetial rotation. [[GH-19103](https://github.com/hashicorp/vault/pull/19103)]
+* secrets/database: Add root rotation support for Snowflake database secrets engines using key-pair credentials.
 
 BUG FIXES:
 
-* auth/approle: Add nil check for the secret ID entry when deleting via secret id accessor preventing cross role secret id deletion [[GH-19186](https://github.com/hashicorp/vault/pull/19186)]
-* core (enterprise): Fix panic when using invalid accessor for control-group request
-* core: Prevent panics in `sys/leases/lookup`, `sys/leases/revoke`, and `sys/leases/renew` endpoints if provided `lease_id` is null [[GH-18951](https://github.com/hashicorp/vault/pull/18951)]
-* replication (enterprise): Fix bug where reloading external plugin on a secondary would
-break replication.
-* secrets/ad: Fix bug where config couldn't be updated unless binddn/bindpass were included in the update. [[GH-18209](https://github.com/hashicorp/vault/pull/18209)]
-* ui (enterprise): Fix cancel button from transform engine role creation page [[GH-19135](https://github.com/hashicorp/vault/pull/19135)]
-* ui: Fix bug where logging in via OIDC fails if browser is in fullscreen mode [[GH-19071](https://github.com/hashicorp/vault/pull/19071)]
+* core (enterprise): Avoid duplicate seal rewrapping, and ensure that cluster secondaries rewrap after a seal migration.
 
-## 1.10.10
-### February 6, 2023
+## 1.16.26 Enterprise
+### September 24, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY:
+
+* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3.
+* core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27.
 
 CHANGES:
 
-* core: Bump Go version to 1.19.4.
+* core: Bump Go version to 1.24.7.
+* core: Updates post-install script to print updated license information
+* database/snowflake: Update plugin to [v0.10.4](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.10.4)
+* sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible
 
 IMPROVEMENTS:
 
-* command/server: Environment variable keys are now logged at startup. [[GH-18125](https://github.com/hashicorp/vault/pull/18125)]
-* core/fips: use upstream toolchain for FIPS 140-2 compliance again; this will appear as X=boringcrypto on the Go version in Vault server logs.
-* secrets/db/mysql: Add `tls_server_name` and `tls_skip_verify` parameters [[GH-18799](https://github.com/hashicorp/vault/pull/18799)]
-* ui: Prepends "passcode=" if not provided in user input for duo totp mfa method authentication [[GH-18342](https://github.com/hashicorp/vault/pull/18342)]
-* ui: Update language on database role to "Connection name" [[GH-18261](https://github.com/hashicorp/vault/issues/18261)] [[GH-18350](https://github.com/hashicorp/vault/pull/18350)]
+* core (enterprise): Updated code to support FIPS 140-3 compliant algorithms.
 
 BUG FIXES:
 
-* auth/approle: Fix `token_bound_cidrs` validation when using /32 blocks for role and secret ID [[GH-18145](https://github.com/hashicorp/vault/pull/18145)]
-* auth/token: Fix ignored parameter warnings for valid parameters on token create [[GH-16938](https://github.com/hashicorp/vault/pull/16938)]
-* cli/kv: skip formatting of nil secrets for patch and put with field parameter set [[GH-18163](https://github.com/hashicorp/vault/pull/18163)]
-* core (enterprise): Fix a race condition resulting in login errors to PKCS#11 modules under high concurrency.
-* core/managed-keys (enterprise): Limit verification checks to mounts in a key's namespace
-* core/quotas (enterprise): Fix a potential deadlock that could occur when using lease count quotas.
-* core/quotas: Fix issue with improper application of default rate limit quota exempt paths [[GH-18273](https://github.com/hashicorp/vault/pull/18273)]
-* core: fix bug where context cancellations weren't forwarded to active node from performance standbys.
-* core: prevent panic in login mfa enforcement delete after enforcement's namespace is deleted [[GH-18923](https://github.com/hashicorp/vault/pull/18923)]
-* database/mongodb: Fix writeConcern set to be applied to any query made on the database [[GH-18546](https://github.com/hashicorp/vault/pull/18546)]
-* identity (enterprise): Fix a data race when creating an entity for a local alias.
-* kmip (enterprise): Fix Destroy operation response that omitted Unique Identifier on some batched responses.
-* kmip (enterprise): Fix Locate operation response incompatibility with clients using KMIP versions prior to 1.3.
-* licensing (enterprise): update autoloaded license cache after reload
-* storage/raft (enterprise): Fix some storage-modifying RPCs used by perf standbys that weren't returning the resulting WAL state.
-* ui: fixes query parameters not passed in api explorer test requests [[GH-18743](https://github.com/hashicorp/vault/pull/18743)]
+* auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load.
+* secrets/transit: Fix error when using ed25519 keys that were imported with derivation enabled
+* sys/mounts: enable unsetting allowed_response_headers
+
+
+## 1.16.25 Enterprise
+### August 28, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+CHANGES:
 
-## 1.10.9
-### November 30, 2022
+* core: Bump Go version to 1.23.12
+* http: Add JSON configurable limits to HTTP handling for JSON payloads: `max_json_depth`, `max_json_string_value_length`, `max_json_object_entry_count`, `max_json_array_element_count`.
 
 BUG FIXES:
 
-* auth: Deduplicate policies prior to ACL generation [[GH-17914](https://github.com/hashicorp/vault/pull/17914)]
-* core/quotas (enterprise): Fix a lock contention issue that could occur and cause Vault to become unresponsive when creating, changing, or deleting lease count quotas.
-* core: Fix potential deadlock if barrier ciphertext is less than 4 bytes. [[GH-17944](https://github.com/hashicorp/vault/pull/17944)]
-* core: fix a start up race condition where performance standbys could go into a
-  mount loop if default policies are not yet synced from the active node. [[GH-17801](https://github.com/hashicorp/vault/pull/17801)]
-* secrets/azure: add WAL to clean up role assignments if errors occur [[GH-18084](https://github.com/hashicorp/vault/pull/18084)]
-* secrets/gcp: Fixes duplicate service account key for rotate root on standby or secondary [[GH-18109](https://github.com/hashicorp/vault/pull/18109)]
-* ui: fix entity policies list link to policy show page [[GH-17950](https://github.com/hashicorp/vault/pull/17950)]
+* core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration
+* core/seal: When Seal-HA is enabled, make it an error to persist the barrier
+keyring when not all seals are healthy.  This prevents the possibility of
+failing to unseal when a different subset of seals are healthy than were
+healthy at last write.
+
+## 1.16.24 Enterprise
+### August 06, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY:
 
-## 1.10.8
-### November 2, 2022
+* auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled [[GH-31427](https://github.com/hashicorp/vault/pull/31427),[HCSEC-2025-20](https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092)].
 
 BUG FIXES:
 
-* core/managed-keys (enterprise): Return better error messages when encountering key creation failures
-* core/managed-keys (enterprise): fix panic when having `cache_disable` true
-* core: prevent memory leak when using control group factors in a policy [[GH-17532](https://github.com/hashicorp/vault/pull/17532)]
-* core: prevent panic during mfa after enforcement's namespace is deleted [[GH-17562](https://github.com/hashicorp/vault/pull/17562)]
-* login: Store token in tokenhelper for interactive login MFA [[GH-17040](https://github.com/hashicorp/vault/pull/17040)]
-* secrets/pki: Do not ignore provided signature bits value when signing intermediate and leaf certificates with a managed key [[GH-17328](https://github.com/hashicorp/vault/pull/17328)]
-* secrets/pki: Respond to tidy-status, tidy-cancel on PR Secondary clusters. [[GH-17497](https://github.com/hashicorp/vault/pull/17497)]
-* ui: Fixes oidc/jwt login issue with alternate mount path and jwt login via mount path tab [[GH-17661](https://github.com/hashicorp/vault/pull/17661)]
+* identity/mfa: revert cache entry change from #31217 and document cache entry values [[GH-31421](https://github.com/hashicorp/vault/pull/31421)]
+
+## 1.16.23 Enterprise
+### July 25, 2025
 
-## 1.10.7
-### September 30, 2022
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 SECURITY:
 
-* secrets/pki: Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s CA into memory on startup, resulting in the revocation list not being checked, if the CRL has not yet been retrieved. This vulnerability, CVE-2022-41316, is fixed in Vault 1.12.0, 1.11.4, 1.10.7, and 1.9.10. [[HSEC-2022-24](https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483)]
+* audit: **breaking change** privileged vault operator may execute code on the underlying host (CVE-2025-6000). Vault will not unseal if the only configured file audit device has executable permissions (e.g., 0777, 0755). See recent [breaking change](https://developer.hashicorp.com/vault/docs/updates/important-changes#breaking-changes) docs for more details. [[GH-31211](https://github.com/hashicorp/vault/pull/31211),[HCSEC-2025-14](https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033)]
+* auth/userpass: timing side-channel in vault's userpass auth method (CVE-2025-6011)[HCSEC-2025-15](https://discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034)
+* core/login: vault userpass and ldap user lockout bypass (CVE-2025-6004). update alias lookahead to respect username case for LDAP and username/password. [[GH-31352](https://github.com/hashicorp/vault/pull/31352),[HCSEC-2025-16](https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035)]
+* secrets/totp: vault totp secrets engine code reuse (CVE-2025-6014) [[GH-31246](https://github.com/hashicorp/vault/pull/31246),[HCSEC-2025-17](https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036)]
+* auth/cert: vault certificate auth method did not validate common name for non-ca certificates (CVE-2025-6037). test non-CA cert equality on login matching instead of individual fields. [[GH-31210](https://github.com/hashicorp/vault/pull/31210),[HCSEC-2025-18](https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037)]
+* core/mfa: vault login mfa bypass of rate limiting and totp token reuse (CVE-2025-6015) [[GH-31217](https://github.com/hashicorp/vault/pull/31297),[HCSEC-2025-19](https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038)]
 
 BUG FIXES:
 
-* auth/cert: Vault does not initially load the CRLs in cert auth unless the read/write CRL endpoint is hit. [[GH-17138](https://github.com/hashicorp/vault/pull/17138)]
-* core/quotas: Fix goroutine leak caused by the seal process not fully cleaning up Rate Limit Quotas. [[GH-17281](https://github.com/hashicorp/vault/pull/17281)]
-* core: Prevent two or more DR failovers from invalidating SSCT tokens generated on the previous primaries. [[GH-16956](https://github.com/hashicorp/vault/pull/16956)]
-* identity/oidc: Adds `claims_supported` to discovery document. [[GH-16992](https://github.com/hashicorp/vault/pull/16992)]
-* replication (enterprise): Fix data race in SaveCheckpoint()
-* secrets/transform (enterprise): Fix an issue loading tokenization transform configuration after a specific sequence of reconfigurations.
-* secrets/transform (enterprise): Fix persistence problem with tokenization store credentials.
-* ui: Fix lease force revoke action [[GH-16930](https://github.com/hashicorp/vault/pull/16930)]
+* core/seal (enterprise): Fix a bug that caused the seal rewrap process to abort in the presence of partially sealed entries.
+* kmip (enterprise): Fix a panic that can happen when a KMIP client makes a request before the Vault server has finished unsealing. [[GH-31266](https://github.com/hashicorp/vault/pull/31266)]
+* plugins: Fix panics that can occur when a plugin audits a request or response before the Vault server has finished unsealing. [[GH-31266](https://github.com/hashicorp/vault/pull/31266)]
+* secrets-sync (enterprise): Unsyncing secret-key granularity associations will no longer give a misleading error about a failed unsync operation that did indeed succeed.
 
-## 1.10.6
-### August 31, 2022
+## 1.16.22 Enterprise
+### June 25, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 SECURITY:
 
-* core: When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. This vulnerability, CVE-2022-40186, is fixed in 1.11.3, 1.10.6, and 1.9.9. [[HSEC-2022-18](https://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550)]
+* core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes. [[GH-30794](https://github.com/hashicorp/vault/pull/30794)],[[HCSEC-2025-11](https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570)]
+* core/identity: vault root namespace operator may elevate privileges (CVE-2025-5999). Fix string contains check in Identity APIs to be case-insensitive. [[GH-31045](https://github.com/hashicorp/vault/pull/31045),[HCSEC-2025-13](https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032)]
 
 CHANGES:
 
-* core: Bump Go version to 1.17.13.
+* auth/azure: Update plugin to v0.17.5
+* core: Bump Go version to 1.23.10
+* secrets/azure: Update plugin to v0.17.5
+* secrets/database: Update vault-plugin-database-snowflake to v0.10.3
 
-IMPROVEMENTS:
+BUG FIXES:
 
-* identity/oidc: Adds the `client_secret_post` token endpoint authentication method. [[GH-16598](https://github.com/hashicorp/vault/pull/16598)]
+* secrets/database: Treat all rotation_schedule values as UTC to ensure consistent behavior. [[GH-30606](https://github.com/hashicorp/vault/pull/30606)]
 
-BUG FIXES:
+## 1.16.21 Enterprise
+### May 30, 2025
 
-* auth/gcp: Fixes the ability to reset the configuration's credentials to use application default credentials. [[GH-16524](https://github.com/hashicorp/vault/pull/16524)]
-* command/debug: fix bug where monitor was not honoring configured duration [[GH-16834](https://github.com/hashicorp/vault/pull/16834)]
-* core/auth: Return a 403 instead of a 500 for a malformed SSCT [[GH-16112](https://github.com/hashicorp/vault/pull/16112)]
-* core: Increase the allowed concurrent gRPC streams over the cluster port. [[GH-16327](https://github.com/hashicorp/vault/pull/16327)]
-* database: Invalidate queue should cancel context first to avoid deadlock [[GH-15933](https://github.com/hashicorp/vault/pull/15933)]
-* identity/oidc: Change the `state` parameter of the Authorization Endpoint to optional. [[GH-16599](https://github.com/hashicorp/vault/pull/16599)]
-* identity/oidc: Detect invalid `redirect_uri` values sooner in validation of the
-Authorization Endpoint. [[GH-16601](https://github.com/hashicorp/vault/pull/16601)]
-* identity/oidc: Fixes validation of the `request` and `request_uri` parameters. [[GH-16600](https://github.com/hashicorp/vault/pull/16600)]
-* secrets/database: Fix a bug where the secret engine would queue up a lot of WAL deletes during startup. [[GH-16686](https://github.com/hashicorp/vault/pull/16686)]
-* secrets/gcp: Fixes duplicate static account key creation from performance secondary clusters. [[GH-16534](https://github.com/hashicorp/vault/pull/16534)]
-* storage/raft: Fix retry_join initialization failure [[GH-16550](https://github.com/hashicorp/vault/pull/16550)]
-* ui: Fix OIDC callback to accept namespace flag in different formats [[GH-16886](https://github.com/hashicorp/vault/pull/16886)]
-* ui: Fix issue logging in with JWT auth method [[GH-16466](https://github.com/hashicorp/vault/pull/16466)]
-* ui: Fix naming of permitted_dns_domains form parameter on CA creation (root generation and sign intermediate). [[GH-16739](https://github.com/hashicorp/vault/pull/16739)]
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
-SECURITY:
 
-* identity/entity: When entity aliases mapped to a single entity share the same alias name, but have different mount accessors, Vault can leak metadata between the aliases. This metadata leak may result in unexpected access if templated policies are using alias metadata for path names. [[HCSEC-2022-18](https://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550)]
+CHANGES:
 
-## 1.10.5
-### July 21, 2022
+* Update vault-plugin-auth-cf to v0.18.2
+* auth/azure: Upgrade plugin to v0.17.4
+* database/snowflake: Update plugin to v0.10.2
 
-SECURITY:
+BUG FIXES:
 
-* storage/raft: Vault Enterprise (“Vault”) clusters using Integrated Storage expose an unauthenticated API endpoint that could be abused to override the voter status of a node within a Vault HA cluster, introducing potential for future data loss or catastrophic failure. This vulnerability, CVE-2022-36129, was fixed in Vault 1.9.8, 1.10.5, and 1.11.1. [[HSEC-2022-15](https://discuss.hashicorp.com/t/hcsec-2022-15-vault-enterprise-does-not-verify-existing-voter-status-when-joining-an-integrated-storage-ha-node/42420)]
+* plugins (enterprise): Fix an issue where Enterprise plugins can't run on a standby node
+when it becomes active because standby nodes don't extract the artifact when the plugin
+is registered. Remove extracting from Vault and require the operator to place
+the extracted artifact in the plugin directory before registration.
 
-CHANGES:
+## 1.16.20 Enterprise
+### April 30, 2025
 
-* core/fips: Disable and warn about entropy augmentation in FIPS 140-2 Inside mode [[GH-15858](https://github.com/hashicorp/vault/pull/15858)]
-* core: Bump Go version to 1.17.12.
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
-IMPROVEMENTS:
+SECURITY:
 
-* core: Add `sys/loggers` and `sys/loggers/:name` endpoints to provide ability to modify logging verbosity [[GH-16111](https://github.com/hashicorp/vault/pull/16111)]
-* secrets/ssh: Allow additional text along with a template definition in defaultExtension value fields. [[GH-16018](https://github.com/hashicorp/vault/pull/16018)]
+* core: vault may expose sensitive information in error logs when processing malformed data with the kv v2 plugin[[GH-30388](https://github.com/hashicorp/vault/pull/30388), [HCSEC-2025-09](https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717)]
 
 BUG FIXES:
 
-* agent/template: Fix parsing error for the exec stanza [[GH-16231](https://github.com/hashicorp/vault/pull/16231)]
-* core/identity: Replicate member_entity_ids and policies in identity/group across nodes identically [[GH-16088](https://github.com/hashicorp/vault/pull/16088)]
-* core/replication (enterprise): Don't flush merkle tree pages to disk after losing active duty
-* core/seal: Fix possible keyring truncation when using the file backend. [[GH-15946](https://github.com/hashicorp/vault/pull/15946)]
-* core: Limit SSCT WAL checks on perf standbys to raft backends only [[GH-15879](https://github.com/hashicorp/vault/pull/15879)]
-* plugin/multiplexing: Fix panic when id doesn't exist in connection map [[GH-16094](https://github.com/hashicorp/vault/pull/16094)]
-* secret/pki: Do not fail validation with a legacy key_bits default value and key_type=any when signing CSRs [[GH-16246](https://github.com/hashicorp/vault/pull/16246)]
-* storage/raft (enterprise): Prevent unauthenticated voter status with rejoin [[GH-16324](https://github.com/hashicorp/vault/pull/16324)]
-* transform (enterprise): Fix a bug in the handling of nested or unmatched capture groups in FPE transformations.
-* ui: Fix issue where metadata tab is hidden even though policy grants access [[GH-15824](https://github.com/hashicorp/vault/pull/15824)]
-* ui: Revert using localStorage in favor of sessionStorage [[GH-16169](https://github.com/hashicorp/vault/pull/16169)]
-* ui: Updated `leasId` to `leaseId` in the "Copy Credentials" section of "Generate AWS Credentials" [[GH-15685](https://github.com/hashicorp/vault/pull/15685)]
+* core (enterprise): fix issue with errors being swallowed on failed HSM logins.
+* database: Prevent static roles created in versions prior to 1.15.0 from rotating on backend restart. [[GH-30320](https://github.com/hashicorp/vault/pull/30320)]
+* database: no longer incorrectly add an "unrecognized parameters" warning for certain SQL database secrets config operations when another warning is returned [[GH-30327](https://github.com/hashicorp/vault/pull/30327)]
+
+## 1.16.19 Enterprise
+### April 18, 2025
 
-## 1.10.4
-### June 10, 2022
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 CHANGES:
 
-* core: Bump Go version to 1.17.11. [[GH-go-ver-1104](https://github.com/hashicorp/vault/pull/go-ver-1104)]
+* core: Bump Go version to 1.23.7
+* core: Bump Go version to 1.23.8
 
-IMPROVEMENTS:
+BUG FIXES:
 
-* api/monitor: Add log_format option to allow for logs to be emitted in JSON format [[GH-15536](https://github.com/hashicorp/vault/pull/15536)]
-* auth: Globally scoped Login MFA method Get/List endpoints [[GH-15248](https://github.com/hashicorp/vault/pull/15248)]
-* auth: forward cached MFA auth response to the leader using RPC instead of forwarding all login requests [[GH-15469](https://github.com/hashicorp/vault/pull/15469)]
-* cli/debug: added support for retrieving metrics from DR clusters if `unauthenticated_metrics_access` is enabled [[GH-15316](https://github.com/hashicorp/vault/pull/15316)]
-* command/debug: Add log_format flag to allow for logs to be emitted in JSON format [[GH-15536](https://github.com/hashicorp/vault/pull/15536)]
-* core: Fix some identity data races found by Go race detector (no known impact yet). [[GH-15123](https://github.com/hashicorp/vault/pull/15123)]
-* storage/raft: Use larger timeouts at startup to reduce likelihood of inducing elections. [[GH-15042](https://github.com/hashicorp/vault/pull/15042)]
-* ui: Allow namespace param to be parsed from state queryParam [[GH-15378](https://github.com/hashicorp/vault/pull/15378)]
-
-BUG FIXES:
-
-* agent: Redact auto auth token from renew endpoints [[GH-15380](https://github.com/hashicorp/vault/pull/15380)]
-* auth/kubernetes: Fix error code when using the wrong service account [[GH-15585](https://github.com/hashicorp/vault/pull/15585)]
-* auth/ldap: The logic for setting the entity alias when `username_as_alias` is set
-has been fixed. The previous behavior would make a request to the LDAP server to
-get `user_attr` before discarding it and using the username instead. This would
-make it impossible for a user to connect if this attribute was missing or had
-multiple values, even though it would not be used anyway. This has been fixed
-and the username is now used without making superfluous LDAP searches. [[GH-15525](https://github.com/hashicorp/vault/pull/15525)]
-* auth: Fixed erroneous success message when using vault login in case of two-phase MFA [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
-* auth: Fixed erroneous token information being displayed when using vault login in case of two-phase MFA [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
-* auth: Fixed two-phase MFA information missing from table format when using vault login [[GH-15428](https://github.com/hashicorp/vault/pull/15428)]
-* auth: Prevent deleting a valid MFA method ID using the endpoint for a different MFA method type [[GH-15482](https://github.com/hashicorp/vault/pull/15482)]
-* core (enterprise): Fix overcounting of lease count quota usage at startup.
-* core: Prevent changing file permissions of audit logs when mode 0000 is used. [[GH-15759](https://github.com/hashicorp/vault/pull/15759)]
-* core: Prevent metrics generation from causing deadlocks. [[GH-15693](https://github.com/hashicorp/vault/pull/15693)]
-* core: fixed systemd reloading notification [[GH-15041](https://github.com/hashicorp/vault/pull/15041)]
-* mfa/okta: disable client side rate limiting causing delays in push notifications [[GH-15369](https://github.com/hashicorp/vault/pull/15369)]
-* storage/raft (enterprise):  Auto-snapshot configuration now forbids slashes in file prefixes for all types, and "/" in path prefix for local storage type.  Strip leading prefix in path prefix for AWS.  Improve error handling/reporting.
-* transform (enterprise): Fix non-overridable column default value causing tokenization tokens to expire prematurely when using the MySQL storage backend.
-* ui: Fix inconsistent behavior in client count calendar widget [[GH-15789](https://github.com/hashicorp/vault/pull/15789)]
-* ui: Fixed client count timezone for start and end months [[GH-15167](https://github.com/hashicorp/vault/pull/15167)]
-* ui: fix firefox inability to recognize file format of client count csv export [[GH-15364](https://github.com/hashicorp/vault/pull/15364)]
-
-## 1.10.3
-### May 11, 2022
+* secrets/openldap: Prevent static role rotation on upgrade when `NextVaultRotation` is nil. Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing `NextVaultRotation` value. Now sets it to either `LastVaultRotation + RotationPeriod` or `now + RotationPeriod`. [[GH-30265](https://github.com/hashicorp/vault/pull/30265)]
+* secrets/transit: fix a panic when rotating on a managed key returns an error [[GH-30214](https://github.com/hashicorp/vault/pull/30214)]
+
+## 1.16.18 Enterprise
+### April 4, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
 
 SECURITY:
-* auth: A vulnerability was identified in Vault and Vault Enterprise (“Vault”) from 1.10.0 to 1.10.2 where MFA may not be enforced on user logins after a server restart. This vulnerability, CVE-2022-30689, was fixed in Vault 1.10.3.
 
-BUG FIXES:
+* auth/azure: Update plugin to v0.17.3. Login requires `resource_group_name`, `vm_name`, and `vmss_name` to match token claims [[HCSEC-2025-07](https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716)].
 
-* auth: load login MFA configuration upon restart [[GH-15261](https://github.com/hashicorp/vault/pull/15261)]
-* core/config: Only ask the system about network interfaces when address configs contain a template having the format: {{ ... }} [[GH-15224](https://github.com/hashicorp/vault/pull/15224)]
-* core: pre-calculate namespace specific paths when tainting a route during postUnseal [[GH-15067](https://github.com/hashicorp/vault/pull/15067)]
+IMPROVEMENTS:
 
-## 1.10.2
-### April 29, 2022
+* core (enterprise): report errors from the underlying seal when getting entropy.
 
 BUG FIXES:
 
-* raft: fix Raft TLS key rotation panic that occurs if active key is more than 24 hours old [[GH-15156](https://github.com/hashicorp/vault/pull/15156)]
-* sdk: Fix OpenApi spec generator to properly convert TypeInt64 to OAS supported int64 [[GH-15104](https://github.com/hashicorp/vault/pull/15104)]
+* auth/ldap: Fix a bug that does not properly delete users and groups by first converting their names to lowercase when case senstivity option is off. [[GH-29922](https://github.com/hashicorp/vault/pull/29922)]
+* core: Fix Azure authentication for seal/managed keys to work for both federated workload identity and managed user identities.  Fixes regression for federated workload identities. [[GH-29792](https://github.com/hashicorp/vault/pull/29792)]
+* core: Fix a bug that prevents certain loggers from writing to a log file. [[GH-29917](https://github.com/hashicorp/vault/pull/29917)]
+* export API: Normalize the start_date parameter to the start of the month as is done in the sys/counters API to keep the results returned from both of the API's consistent. [[GH-29562](https://github.com/hashicorp/vault/pull/29562)]
+* plugins (enterprise): Fix plugin registration with artifact when a binary for the same plugin is already present in the plugin directory.
+* plugins: plugin registration should honor the `plugin_tmpdir` config [[GH-29978](https://github.com/hashicorp/vault/pull/29978)]
+* secrets/azure: Upgrade plugin to v0.17.4 which reverts role name changes to no longer be a GUID.
+* secrets/database: Fix a bug where a global database plugin reload exits if any of the database connections are not available [[GH-29519](https://github.com/hashicorp/vault/pull/29519)]
 
-## 1.10.1
-### April 22, 2022
+## 1.16.17 Enterprise
+### March 5, 2025
 
-CHANGES:
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+BUG FIXES:
 
-* core: A request that fails path validation due to relative path check will now be responded to with a 400 rather than 500. [[GH-14328](https://github.com/hashicorp/vault/pull/14328)]
-* core: Bump Go version to 1.17.9. [[GH-15044](https://github.com/hashicorp/vault/pull/15044)]
+* core: Fix Azure authentication for seal/managed keys to work for both federated workload identity and managed user identities.  Fixes regression for federated workload identities. [[GH-29792](https://github.com/hashicorp/vault/pull/29792)]
 
-IMPROVEMENTS:
+## 1.16.16 Enterprise
+### February 25, 2025
 
-* agent: Upgrade hashicorp/consul-template version for sprig template functions and improved writeTo function [[GH-15092](https://github.com/hashicorp/vault/pull/15092)]
-* auth: enforce a rate limit for TOTP passcode validation attempts [[GH-14864](https://github.com/hashicorp/vault/pull/14864)]
-* cli/vault: warn when policy name contains upper-case letter [[GH-14670](https://github.com/hashicorp/vault/pull/14670)]
-* cockroachdb: add high-availability support [[GH-12965](https://github.com/hashicorp/vault/pull/12965)]
-* sentinel (enterprise): Upgrade sentinel to [v0.18.5](https://docs.hashicorp.com/sentinel/changelog#0-18-5-january-14-2022) to avoid potential naming collisions in the remote installer
-
-BUG FIXES:
-
-* Fixed panic when adding or modifying a Duo MFA Method in Enterprise
-* agent: Fix log level mismatch between ERR and ERROR [[GH-14424](https://github.com/hashicorp/vault/pull/14424)]
-* api/sys/raft: Update RaftSnapshotRestore to use net/http client allowing bodies larger than allocated memory to be streamed [[GH-14269](https://github.com/hashicorp/vault/pull/14269)]
-* api: Respect increment value in grace period calculations in LifetimeWatcher [[GH-14836](https://github.com/hashicorp/vault/pull/14836)]
-* auth/approle: Add maximum length for input values that result in SHA56 HMAC calculation [[GH-14746](https://github.com/hashicorp/vault/pull/14746)]
-* auth: forward requests subject to login MFA from perfStandby to Active node [[GH-15009](https://github.com/hashicorp/vault/pull/15009)]
-* cassandra: Update gocql Cassandra client to fix "no hosts available in the pool" error [[GH-14973](https://github.com/hashicorp/vault/pull/14973)]
-* cli: Fix panic caused by parsing key=value fields whose value is a single backslash [[GH-14523](https://github.com/hashicorp/vault/pull/14523)]
-* core (enterprise): Allow local alias create RPCs to persist alias metadata [[GH-changelog:_2747](https://github.com/hashicorp/vault/pull/changelog:_2747)]
-* core/managed-keys (enterprise): Allow PKCS#11 managed keys to use 0 as a slot number
-* core/metrics: Fix incorrect table size metric for local mounts [[GH-14755](https://github.com/hashicorp/vault/pull/14755)]
-* core: Fix panic caused by parsing JSON integers for fields defined as comma-delimited integers [[GH-15072](https://github.com/hashicorp/vault/pull/15072)]
-* core: Fix panic caused by parsing JSON integers for fields defined as comma-delimited strings [[GH-14522](https://github.com/hashicorp/vault/pull/14522)]
-* core: Fix panic caused by parsing policies with empty slice values. [[GH-14501](https://github.com/hashicorp/vault/pull/14501)]
-* core: Fix panic for help request URL paths without /v1/ prefix [[GH-14704](https://github.com/hashicorp/vault/pull/14704)]
-* core: fixing excessive unix file permissions [[GH-14791](https://github.com/hashicorp/vault/pull/14791)]
-* core: fixing excessive unix file permissions on dir, files and archive created by vault debug command [[GH-14846](https://github.com/hashicorp/vault/pull/14846)]
-* core: report unused or redundant keys in server configuration [[GH-14752](https://github.com/hashicorp/vault/pull/14752)]
-* core: time.After() used in a select statement can lead to memory leak [[GH-14814](https://github.com/hashicorp/vault/pull/14814)]
-* raft: Ensure initialMmapSize is set to 0 on Windows [[GH-14977](https://github.com/hashicorp/vault/pull/14977)]
-* replication (enterprise): fix panic due to missing entity during invalidation of local aliases. [[GH-14622](https://github.com/hashicorp/vault/pull/14622)]
-* secrets/database: Ensure that a `connection_url` password is redacted in all cases. [[GH-14744](https://github.com/hashicorp/vault/pull/14744)]
-* secrets/pki: Fix handling of "any" key type with default zero signature bits value. [[GH-14875](https://github.com/hashicorp/vault/pull/14875)]
-* secrets/pki: Fixed bug where larger SHA-2 hashes were truncated with shorter ECDSA CA certificates [[GH-14943](https://github.com/hashicorp/vault/pull/14943)]
-* ui: Fix Generated Token's Policies helpText to clarify that comma separated values are not excepted in this field. [[GH-15046](https://github.com/hashicorp/vault/pull/15046)]
-* ui: Fixes edit auth method capabilities issue [[GH-14966](https://github.com/hashicorp/vault/pull/14966)]
-* ui: Fixes issue logging in with OIDC from a listed auth mounts tab [[GH-14916](https://github.com/hashicorp/vault/pull/14916)]
-* ui: fix search-select component showing blank selections when editing group member entity [[GH-15058](https://github.com/hashicorp/vault/pull/15058)]
-* ui: masked values no longer give away length or location of special characters [[GH-15025](https://github.com/hashicorp/vault/pull/15025)]
-
-## 1.10.0
-### March 23, 2022
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY:
+
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.2.0
 
 CHANGES:
 
-* core (enterprise): requests with newly generated tokens to perf standbys which are lagging behind the active node return http 412 instead of 400/403/50x.
-* core: Changes the unit of `default_lease_ttl` and `max_lease_ttl` values returned by
-the `/sys/config/state/sanitized` endpoint from nanoseconds to seconds. [[GH-14206](https://github.com/hashicorp/vault/pull/14206)]
-* core: Bump Go version to 1.17.7. [[GH-14232](https://github.com/hashicorp/vault/pull/14232)]
-* plugin/database: The return value from `POST /database/config/:name` has been updated to "204 No Content" [[GH-14033](https://github.com/hashicorp/vault/pull/14033)]
-* secrets/azure: Changes the configuration parameter `use_microsoft_graph_api` to use the Microsoft
-Graph API by default. [[GH-14130](https://github.com/hashicorp/vault/pull/14130)]
-* storage/etcd: Remove support for v2. [[GH-14193](https://github.com/hashicorp/vault/pull/14193)]
-* ui: Upgrade Ember to version 3.24 [[GH-13443](https://github.com/hashicorp/vault/pull/13443)]
+* build: Drop `netbsd/386` and `netbsd/arm` builds as downstream modules no longer support them.
+* core: Bump Go version to 1.23.6.
+* raft/autopilot (enterprise): Alongside the CE autopilot update, update raft-autopilot-enterprise library to v0.3.0 and add enterprise-specific regression testing.
+* secrets/openldap: Update plugin to v0.12.4
 
 FEATURES:
 
-* **Database plugin multiplexing**: manage multiple database connections with a single plugin process [[GH-14033](https://github.com/hashicorp/vault/pull/14033)]
-* **Login MFA**: Single and two phase MFA is now available when authenticating to Vault. [[GH-14025](https://github.com/hashicorp/vault/pull/14025)]
-* **Mount Migration**: Vault supports moving secrets and auth mounts both within and across namespaces.
-* **Postgres in the UI**: Postgres DB is now supported by the UI [[GH-12945](https://github.com/hashicorp/vault/pull/12945)]
-* **Report in-flight requests**: Adding a trace capability to show in-flight requests, and a new gauge metric to show the total number of in-flight requests [[GH-13024](https://github.com/hashicorp/vault/pull/13024)]
-* **Server Side Consistent Tokens**: Service tokens have been updated to be longer (a minimum of 95 bytes) and token prefixes for all token types are updated from s., b., and r. to hvs., hvb., and hvr. for service, batch, and recovery tokens respectively. Vault clusters with integrated storage will now have read-after-write consistency by default. [[GH-14109](https://github.com/hashicorp/vault/pull/14109)]
-* **Transit SHA-3 Support**: Add support for SHA-3 in the Transit backend. [[GH-13367](https://github.com/hashicorp/vault/pull/13367)]
-* **Transit Time-Based Key Autorotation**: Add support for automatic, time-based key rotation to transit secrets engine, including in the UI. [[GH-13691](https://github.com/hashicorp/vault/pull/13691)]
-* **UI Client Count Improvements**: Restructures client count dashboard, making use of billing start date to improve accuracy. Adds mount-level distribution and filtering. [[GH-client-counts](https://github.com/hashicorp/vault/pull/client-counts)]
-* **Agent Telemetry**: The Vault Agent can now collect and return telemetry information at the `/agent/v1/metrics` endpoint.
+* **Plugins**: Allow Enterprise plugins to run externally on Vault Enterprise only.
 
 IMPROVEMENTS:
 
-* agent: Adds ability to configure specific user-assigned managed identities for Azure auto-auth. [[GH-14214](https://github.com/hashicorp/vault/pull/14214)]
-* agent: The `agent/v1/quit` endpoint can now be used to stop the Vault Agent remotely [[GH-14223](https://github.com/hashicorp/vault/pull/14223)]
-* api: Allow cloning `api.Client` tokens via `api.Config.CloneToken` or `api.Client.SetCloneToken()`. [[GH-13515](https://github.com/hashicorp/vault/pull/13515)]
-* api: Define constants for X-Vault-Forward and X-Vault-Inconsistent headers [[GH-14067](https://github.com/hashicorp/vault/pull/14067)]
-* api: Implements Login method in Go client libraries for GCP and Azure auth methods [[GH-13022](https://github.com/hashicorp/vault/pull/13022)]
-* api: Implements Login method in Go client libraries for LDAP auth methods [[GH-13841](https://github.com/hashicorp/vault/pull/13841)]
-* api: Trim newline character from wrapping token in logical.Unwrap from the api package [[GH-13044](https://github.com/hashicorp/vault/pull/13044)]
-* api: add api method for modifying raft autopilot configuration [[GH-12428](https://github.com/hashicorp/vault/pull/12428)]
-* api: respect WithWrappingToken() option during AppRole login authentication when used with secret ID specified from environment or from string [[GH-13241](https://github.com/hashicorp/vault/pull/13241)]
-* audit: The audit logs now contain the port used by the client [[GH-12790](https://github.com/hashicorp/vault/pull/12790)]
-* auth/aws: Enable region detection in the CLI by specifying the region as `auto` [[GH-14051](https://github.com/hashicorp/vault/pull/14051)]
-* auth/cert: Add certificate extensions as metadata [[GH-13348](https://github.com/hashicorp/vault/pull/13348)]
-* auth/jwt: The Authorization Code flow makes use of the Proof Key for Code Exchange (PKCE) extension. [[GH-13365](https://github.com/hashicorp/vault/pull/13365)]
-* auth/kubernetes: Added support for dynamically reloading short-lived tokens for better Kubernetes 1.21+ compatibility [[GH-13595](https://github.com/hashicorp/vault/pull/13595)]
-* auth/ldap: Add a response warning and server log whenever the config is accessed
-if `userfilter` doesn't consider `userattr` [[GH-14095](https://github.com/hashicorp/vault/pull/14095)]
-* auth/ldap: Add username to alias metadata [[GH-13669](https://github.com/hashicorp/vault/pull/13669)]
-* auth/ldap: Add username_as_alias configurable to change how aliases are named [[GH-14324](https://github.com/hashicorp/vault/pull/14324)]
-* auth/okta: Update [okta-sdk-golang](https://github.com/okta/okta-sdk-golang) dependency to version v2.9.1 for improved request backoff handling [[GH-13439](https://github.com/hashicorp/vault/pull/13439)]
-* auth/token: The `auth/token/revoke-accessor` endpoint is now idempotent and will
-not error out if the token has already been revoked. [[GH-13661](https://github.com/hashicorp/vault/pull/13661)]
-* auth: reading `sys/auth/:path` now returns the configuration for the auth engine mounted at the given path [[GH-12793](https://github.com/hashicorp/vault/pull/12793)]
-* cli: interactive CLI for login mfa [[GH-14131](https://github.com/hashicorp/vault/pull/14131)]
-* command (enterprise): "vault license get" now uses non-deprecated endpoint /sys/license/status
-* core/ha: Add new mechanism for keeping track of peers talking to active node, and new 'operator members' command to view them. [[GH-13292](https://github.com/hashicorp/vault/pull/13292)]
-* core/identity: Support updating an alias' `custom_metadata` to be empty. [[GH-13395](https://github.com/hashicorp/vault/pull/13395)]
-* core/pki: Support Y10K value in notAfter field to be compliant with IEEE 802.1AR-2018 standard [[GH-12795](https://github.com/hashicorp/vault/pull/12795)]
-* core/pki: Support Y10K value in notAfter field when signing non-CA certificates [[GH-13736](https://github.com/hashicorp/vault/pull/13736)]
-* core: Add duration and start_time to completed requests log entries [[GH-13682](https://github.com/hashicorp/vault/pull/13682)]
-* core: Add support to list password policies at `sys/policies/password` [[GH-12787](https://github.com/hashicorp/vault/pull/12787)]
-* core: Add support to list version history via API at `sys/version-history` and via CLI with `vault version-history` [[GH-13766](https://github.com/hashicorp/vault/pull/13766)]
-* core: Fixes code scanning alerts [[GH-13667](https://github.com/hashicorp/vault/pull/13667)]
-* core: Periodically test the health of connectivity to auto-seal backends [[GH-13078](https://github.com/hashicorp/vault/pull/13078)]
-* core: Reading `sys/mounts/:path` now returns the configuration for the secret engine at the given path [[GH-12792](https://github.com/hashicorp/vault/pull/12792)]
-* core: Replace "master key" terminology with "root key" [[GH-13324](https://github.com/hashicorp/vault/pull/13324)]
-* core: Small changes to ensure goroutines terminate in tests [[GH-14197](https://github.com/hashicorp/vault/pull/14197)]
-* core: Systemd unit file included with the Linux packages now sets the service type to notify. [[GH-14385](https://github.com/hashicorp/vault/pull/14385)]
-* core: Update github.com/prometheus/client_golang to fix security vulnerability CVE-2022-21698. [[GH-14190](https://github.com/hashicorp/vault/pull/14190)]
-* core: Vault now supports the PROXY protocol v2. Support for UNKNOWN connections
-has also been added to the PROXY protocol v1. [[GH-13540](https://github.com/hashicorp/vault/pull/13540)]
-* http (enterprise): Serve /sys/license/status endpoint within namespaces
-* identity/oidc: Adds a default OIDC provider [[GH-14119](https://github.com/hashicorp/vault/pull/14119)]
-* identity/oidc: Adds a default key for OIDC clients [[GH-14119](https://github.com/hashicorp/vault/pull/14119)]
-* identity/oidc: Adds an `allow_all` assignment that permits all entities to authenticate via an OIDC client [[GH-14119](https://github.com/hashicorp/vault/pull/14119)]
-* identity/oidc: Adds proof key for code exchange (PKCE) support to OIDC providers. [[GH-13917](https://github.com/hashicorp/vault/pull/13917)]
-* sdk: Add helper for decoding root tokens [[GH-10505](https://github.com/hashicorp/vault/pull/10505)]
-* secrets/azure: Adds support for rotate-root. [#70](https://github.com/hashicorp/vault-plugin-secrets-azure/pull/70) [[GH-13034](https://github.com/hashicorp/vault/pull/13034)]
-* secrets/consul: Add support for consul enterprise namespaces and admin partitions. [[GH-13850](https://github.com/hashicorp/vault/pull/13850)]
-* secrets/consul: Add support for consul roles. [[GH-14014](https://github.com/hashicorp/vault/pull/14014)]
-* secrets/database/influxdb: Switch/upgrade to the `influxdb1-client` module [[GH-12262](https://github.com/hashicorp/vault/pull/12262)]
-* secrets/database: Add database configuration parameter 'disable_escaping' for username and password when connecting to a database. [[GH-13414](https://github.com/hashicorp/vault/pull/13414)]
-* secrets/kv: add full secret path output to table-formatted responses [[GH-14301](https://github.com/hashicorp/vault/pull/14301)]
-* secrets/kv: add patch support for KVv2 key metadata [[GH-13215](https://github.com/hashicorp/vault/pull/13215)]
-* secrets/kv: add subkeys endpoint to retrieve a secret's stucture without its values [[GH-13893](https://github.com/hashicorp/vault/pull/13893)]
-* secrets/pki: Add ability to fetch individual certificate as DER or PEM [[GH-10948](https://github.com/hashicorp/vault/pull/10948)]
-* secrets/pki: Add count and duration metrics to PKI issue and revoke calls. [[GH-13889](https://github.com/hashicorp/vault/pull/13889)]
-* secrets/pki: Add error handling for error types other than UserError or InternalError [[GH-14195](https://github.com/hashicorp/vault/pull/14195)]
-* secrets/pki: Allow URI SAN templates in allowed_uri_sans when allowed_uri_sans_template is set to true. [[GH-10249](https://github.com/hashicorp/vault/pull/10249)]
-* secrets/pki: Allow other_sans in sign-intermediate and sign-verbatim [[GH-13958](https://github.com/hashicorp/vault/pull/13958)]
-* secrets/pki: Calculate the Subject Key Identifier as suggested in [RFC 5280, Section 4.2.1.2](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.2). [[GH-11218](https://github.com/hashicorp/vault/pull/11218)]
-* secrets/pki: Restrict issuance of wildcard certificates via role parameter (`allow_wildcard_certificates`) [[GH-14238](https://github.com/hashicorp/vault/pull/14238)]
-* secrets/pki: Return complete chain (in `ca_chain` field) on calls to `pki/cert/ca_chain` [[GH-13935](https://github.com/hashicorp/vault/pull/13935)]
-* secrets/pki: Use application/pem-certificate-chain for PEM certificates, application/x-pem-file for PEM CRLs [[GH-13927](https://github.com/hashicorp/vault/pull/13927)]
-* secrets/pki: select appropriate signature algorithm for ECDSA signature on certificates. [[GH-11216](https://github.com/hashicorp/vault/pull/11216)]
-* secrets/ssh: Add support for generating non-RSA SSH CAs [[GH-14008](https://github.com/hashicorp/vault/pull/14008)]
-* secrets/ssh: Allow specifying multiple approved key lengths for a single algorithm [[GH-13991](https://github.com/hashicorp/vault/pull/13991)]
-* secrets/ssh: Use secure default for algorithm signer (rsa-sha2-256) with RSA SSH CA keys on new roles [[GH-14006](https://github.com/hashicorp/vault/pull/14006)]
-* secrets/transit: Don't abort transit encrypt or decrypt batches on single item failure. [[GH-13111](https://github.com/hashicorp/vault/pull/13111)]
-* storage/aerospike: Upgrade `aerospike-client-go` to v5.6.0. [[GH-12165](https://github.com/hashicorp/vault/pull/12165)]
-* storage/raft: Set InitialMmapSize to 100GB on 64bit architectures [[GH-13178](https://github.com/hashicorp/vault/pull/13178)]
-* storage/raft: When using retry_join stanzas, join against all of them in parallel. [[GH-13606](https://github.com/hashicorp/vault/pull/13606)]
-* sys/raw: Enhance sys/raw to read and write values that cannot be encoded in json. [[GH-13537](https://github.com/hashicorp/vault/pull/13537)]
-* ui: Add support for ECDSA and Ed25519 certificate views [[GH-13894](https://github.com/hashicorp/vault/pull/13894)]
-* ui: Add version diff view for KV V2 [[GH-13000](https://github.com/hashicorp/vault/pull/13000)]
-* ui: Added client side paging for namespace list view [[GH-13195](https://github.com/hashicorp/vault/pull/13195)]
-* ui: Adds flight icons to UI [[GH-12976](https://github.com/hashicorp/vault/pull/12976)]
-* ui: Adds multi-factor authentication support [[GH-14049](https://github.com/hashicorp/vault/pull/14049)]
-* ui: Allow static role credential rotation in Database secrets engines [[GH-14268](https://github.com/hashicorp/vault/pull/14268)]
-* ui: Display badge for all versions in secrets engine header [[GH-13015](https://github.com/hashicorp/vault/pull/13015)]
-* ui: Swap browser localStorage in favor of sessionStorage [[GH-14054](https://github.com/hashicorp/vault/pull/14054)]
-* ui: The integrated web terminal now accepts both `-f` and `--force` as aliases
-for `-force` for the `write` command. [[GH-13683](https://github.com/hashicorp/vault/pull/13683)]
-* ui: Transform advanced templating with encode/decode format support [[GH-13908](https://github.com/hashicorp/vault/pull/13908)]
-* ui: Updates ember blueprints to glimmer components [[GH-13149](https://github.com/hashicorp/vault/pull/13149)]
-* ui: customizes empty state messages for transit and transform [[GH-13090](https://github.com/hashicorp/vault/pull/13090)]
-
-BUG FIXES:
-
-* Fixed bug where auth method only considers system-identity when multiple identities are available. [#50](https://github.com/hashicorp/vault-plugin-auth-azure/pull/50) [[GH-14138](https://github.com/hashicorp/vault/pull/14138)]
-* activity log (enterprise): allow partial monthly client count to be accessed from namespaces [[GH-13086](https://github.com/hashicorp/vault/pull/13086)]
-* agent: Fixes bug where vault agent is unaware of the namespace in the config when wrapping token
-* api/client: Fixes an issue where the `replicateStateStore` was being set to `nil` upon consecutive calls to `client.SetReadYourWrites(true)`. [[GH-13486](https://github.com/hashicorp/vault/pull/13486)]
-* auth/approle: Fix regression where unset cidrlist is returned as nil instead of zero-length array. [[GH-13235](https://github.com/hashicorp/vault/pull/13235)]
-* auth/approle: Fix wrapping of nil errors in `login` endpoint [[GH-14107](https://github.com/hashicorp/vault/pull/14107)]
-* auth/github: Use the Organization ID instead of the Organization name to verify the org membership. [[GH-13332](https://github.com/hashicorp/vault/pull/13332)]
-* auth/kubernetes: Properly handle the migration of role storage entries containing an empty `alias_name_source` [[GH-13925](https://github.com/hashicorp/vault/pull/13925)]
-* auth/kubernetes: ensure valid entity alias names created for projected volume tokens [[GH-14144](https://github.com/hashicorp/vault/pull/14144)]
-* auth/oidc: Fixes OIDC auth from the Vault UI when using the implicit flow and `form_post` response mode. [[GH-13492](https://github.com/hashicorp/vault/pull/13492)]
-* cli: Fix using kv patch with older server versions that don't support HTTP PATCH. [[GH-13615](https://github.com/hashicorp/vault/pull/13615)]
-* core (enterprise): Fix a data race in logshipper.
-* core (enterprise): Workaround AWS CloudHSM v5 SDK issue not allowing read-only sessions
-* core/api: Fix overwriting of request headers when using JSONMergePatch. [[GH-14222](https://github.com/hashicorp/vault/pull/14222)]
-* core/identity: Address a data race condition between local updates to aliases and invalidations [[GH-13093](https://github.com/hashicorp/vault/pull/13093)]
-* core/identity: Address a data race condition between local updates to aliases and invalidations [[GH-13476](https://github.com/hashicorp/vault/pull/13476)]
-* core/token: Fix null token panic from 'v1/auth/token/' endpoints and return proper error response. [[GH-13233](https://github.com/hashicorp/vault/pull/13233)]
-* core/token: Fix null token_type panic resulting from 'v1/auth/token/roles/{role_name}' endpoint [[GH-13236](https://github.com/hashicorp/vault/pull/13236)]
-* core: Fix warnings logged on perf standbys re stored versions [[GH-13042](https://github.com/hashicorp/vault/pull/13042)]
-* core: `-output-curl-string` now properly sets cURL options for client and CA
-certificates. [[GH-13660](https://github.com/hashicorp/vault/pull/13660)]
-* core: add support for go-sockaddr templates in the top-level cluster_addr field [[GH-13678](https://github.com/hashicorp/vault/pull/13678)]
-* core: authentication to "login" endpoint for non-existent mount path returns permission denied with status code 403 [[GH-13162](https://github.com/hashicorp/vault/pull/13162)]
-* core: revert some unintentionally downgraded dependencies from 1.9.0-rc1 [[GH-13168](https://github.com/hashicorp/vault/pull/13168)]
-* ha (enterprise): Prevents performance standby nodes from serving and caching stale data immediately after performance standby election completes
-* http (enterprise): Always forward internal/counters endpoints from perf standbys to active node
-* http:Fix /sys/monitor endpoint returning streaming not supported [[GH-13200](https://github.com/hashicorp/vault/pull/13200)]
-* identity/oidc: Adds support for port-agnostic validation of loopback IP redirect URIs. [[GH-13871](https://github.com/hashicorp/vault/pull/13871)]
-* identity/oidc: Check for a nil signing key on rotation to prevent panics. [[GH-13716](https://github.com/hashicorp/vault/pull/13716)]
-* identity/oidc: Fixes inherited group membership when evaluating client assignments [[GH-14013](https://github.com/hashicorp/vault/pull/14013)]
-* identity/oidc: Fixes potential write to readonly storage on performance secondary clusters during key rotation [[GH-14426](https://github.com/hashicorp/vault/pull/14426)]
-* identity/oidc: Make the `nonce` parameter optional for the Authorization Endpoint of OIDC providers. [[GH-13231](https://github.com/hashicorp/vault/pull/13231)]
-* identity/token: Fixes a bug where duplicate public keys could appear in the .well-known JWKS [[GH-14543](https://github.com/hashicorp/vault/pull/14543)]
-* identity: Fix possible nil pointer dereference. [[GH-13318](https://github.com/hashicorp/vault/pull/13318)]
-* identity: Fix regression preventing startup when aliases were created pre-1.9. [[GH-13169](https://github.com/hashicorp/vault/pull/13169)]
-* identity: Fixes a panic in the OIDC key rotation due to a missing nil check. [[GH-13298](https://github.com/hashicorp/vault/pull/13298)]
-* kmip (enterprise): Fix locate by name operations fail to find key after a rekey operation.
-* licensing (enterprise): Revert accidental inclusion of the TDE feature from the `prem` build.
-* metrics/autosnapshots (enterprise) : Fix bug that could cause
-vault.autosnapshots.save.errors to not be incremented when there is an
-autosnapshot save error.
-* physical/mysql: Create table with wider `vault_key` column when initializing database tables. [[GH-14231](https://github.com/hashicorp/vault/pull/14231)]
-* plugin/couchbase: Fix an issue in which the locking patterns did not allow parallel requests. [[GH-13033](https://github.com/hashicorp/vault/pull/13033)]
-* replication (enterprise): When using encrypted secondary tokens, only clear the
-private key after a successful connection to the primary cluster
-* sdk/framework: Generate proper OpenAPI specs for path patterns that use an alternation as the root. [[GH-13487](https://github.com/hashicorp/vault/pull/13487)]
-* sdk/helper/ldaputil: properly escape a trailing escape character to prevent panics. [[GH-13452](https://github.com/hashicorp/vault/pull/13452)]
-* sdk/queue: move lock before length check to prevent panics. [[GH-13146](https://github.com/hashicorp/vault/pull/13146)]
-* sdk: Fixes OpenAPI to distinguish between paths that can do only List, or both List and Read. [[GH-13643](https://github.com/hashicorp/vault/pull/13643)]
-* secrets/azure: Fixed bug where Azure environment did not change Graph URL [[GH-13973](https://github.com/hashicorp/vault/pull/13973)]
-* secrets/azure: Fixes service principal generation when assigning roles that have [DataActions](https://docs.microsoft.com/en-us/azure/role-based-access-control/role-definitions#dataactions). [[GH-13277](https://github.com/hashicorp/vault/pull/13277)]
-* secrets/azure: Fixes the [rotate root](https://www.vaultproject.io/api-docs/secret/azure#rotate-root)
-operation for upgraded configurations with a `root_password_ttl` of zero. [[GH-14130](https://github.com/hashicorp/vault/pull/14130)]
-* secrets/database/cassandra: change connect_timeout to 5s as documentation says [[GH-12443](https://github.com/hashicorp/vault/pull/12443)]
-* secrets/database/mssql: Accept a boolean for `contained_db`, rather than just a string. [[GH-13469](https://github.com/hashicorp/vault/pull/13469)]
-* secrets/gcp: Fixed bug where error was not reported for invalid bindings [[GH-13974](https://github.com/hashicorp/vault/pull/13974)]
-* secrets/gcp: Fixes role bindings for BigQuery dataset resources. [[GH-13548](https://github.com/hashicorp/vault/pull/13548)]
-* secrets/openldap: Fix panic from nil logger in backend [[GH-14171](https://github.com/hashicorp/vault/pull/14171)]
-* secrets/pki: Default value for key_bits changed to 0, enabling key_type=ec key generation with default value [[GH-13080](https://github.com/hashicorp/vault/pull/13080)]
-* secrets/pki: Fix issuance of wildcard certificates matching glob patterns [[GH-14235](https://github.com/hashicorp/vault/pull/14235)]
-* secrets/pki: Fix regression causing performance secondaries to forward certificate generation to the primary. [[GH-13759](https://github.com/hashicorp/vault/pull/13759)]
-* secrets/pki: Fix regression causing performance secondaries to forward certificate generation to the primary. [[GH-2456](https://github.com/hashicorp/vault/pull/2456)]
-* secrets/pki: Fixes around NIST P-curve signature hash length, default value for signature_bits changed to 0. [[GH-12872](https://github.com/hashicorp/vault/pull/12872)]
-* secrets/pki: Recognize ed25519 when requesting a response in PKCS8 format [[GH-13257](https://github.com/hashicorp/vault/pull/13257)]
-* secrets/pki: Skip signature bits validation for ed25519 curve key type [[GH-13254](https://github.com/hashicorp/vault/pull/13254)]
-* secrets/transit: Ensure that Vault does not panic for invalid nonce size when we aren't in convergent encryption mode. [[GH-13690](https://github.com/hashicorp/vault/pull/13690)]
-* secrets/transit: Return an error if any required parameter is missing. [[GH-14074](https://github.com/hashicorp/vault/pull/14074)]
-* storage/raft: Fix a panic when trying to store a key > 32KB in a transaction. [[GH-13286](https://github.com/hashicorp/vault/pull/13286)]
-* storage/raft: Fix a panic when trying to write a key > 32KB [[GH-13282](https://github.com/hashicorp/vault/pull/13282)]
-* storage/raft: Fix issues allowing invalid nodes to become leadership candidates. [[GH-13703](https://github.com/hashicorp/vault/pull/13703)]
-* storage/raft: Fix regression in 1.9.0-rc1 that changed how time is represented in Raft logs; this prevented using a raft db created pre-1.9. [[GH-13165](https://github.com/hashicorp/vault/pull/13165)]
-* storage/raft: On linux, use map_populate for bolt files to improve startup time. [[GH-13573](https://github.com/hashicorp/vault/pull/13573)]
-* storage/raft: Units for bolt metrics now given in milliseconds instead of nanoseconds [[GH-13749](https://github.com/hashicorp/vault/pull/13749)]
-* ui: Adds pagination to auth methods list view [[GH-13054](https://github.com/hashicorp/vault/pull/13054)]
-* ui: Do not show verify connection value on database connection config page [[GH-13152](https://github.com/hashicorp/vault/pull/13152)]
-* ui: Fix client count current month data not showing unless monthly history data exists [[GH-13396](https://github.com/hashicorp/vault/pull/13396)]
-* ui: Fix default TTL display and set on database role [[GH-14224](https://github.com/hashicorp/vault/pull/14224)]
-* ui: Fix incorrect validity message on transit secrets engine [[GH-14233](https://github.com/hashicorp/vault/pull/14233)]
-* ui: Fix issue where UI incorrectly handled API errors when mounting backends [[GH-14551](https://github.com/hashicorp/vault/pull/14551)]
-* ui: Fix kv engine access bug [[GH-13872](https://github.com/hashicorp/vault/pull/13872)]
-* ui: Fixes breadcrumb bug for secrets navigation [[GH-13604](https://github.com/hashicorp/vault/pull/13604)]
-* ui: Fixes caching issue on kv new version create [[GH-14489](https://github.com/hashicorp/vault/pull/14489)]
-* ui: Fixes displaying empty masked values in PKI engine [[GH-14400](https://github.com/hashicorp/vault/pull/14400)]
-* ui: Fixes horizontal bar chart hover issue when filtering namespaces and mounts [[GH-14493](https://github.com/hashicorp/vault/pull/14493)]
-* ui: Fixes issue logging out with wrapped token query parameter [[GH-14329](https://github.com/hashicorp/vault/pull/14329)]
-* ui: Fixes issue removing raft storage peer via cli not reflected in UI until refresh [[GH-13098](https://github.com/hashicorp/vault/pull/13098)]
-* ui: Fixes issue restoring raft storage snapshot [[GH-13107](https://github.com/hashicorp/vault/pull/13107)]
-* ui: Fixes issue saving KMIP role correctly [[GH-13585](https://github.com/hashicorp/vault/pull/13585)]
-* ui: Fixes issue with OIDC auth workflow when using MetaMask Chrome extension [[GH-13133](https://github.com/hashicorp/vault/pull/13133)]
-* ui: Fixes issue with SearchSelect component not holding focus [[GH-13590](https://github.com/hashicorp/vault/pull/13590)]
-* ui: Fixes issue with automate secret deletion value not displaying initially if set in secret metadata edit view [[GH-13177](https://github.com/hashicorp/vault/pull/13177)]
-* ui: Fixes issue with correct auth method not selected when logging out from OIDC or JWT methods [[GH-14545](https://github.com/hashicorp/vault/pull/14545)]
-* ui: Fixes issue with placeholder not displaying for automatically deleted secrets when deletion time has passed [[GH-13166](https://github.com/hashicorp/vault/pull/13166)]
-* ui: Fixes issue with the number of PGP Key inputs not matching the key shares number in the initialization form on change [[GH-13038](https://github.com/hashicorp/vault/pull/13038)]
-* ui: Fixes long secret key names overlapping masked values [[GH-13032](https://github.com/hashicorp/vault/pull/13032)]
-* ui: Fixes node-forge error when parsing EC (elliptical curve) certs [[GH-13238](https://github.com/hashicorp/vault/pull/13238)]
-* ui: Redirects to managed namespace if incorrect namespace in URL param [[GH-14422](https://github.com/hashicorp/vault/pull/14422)]
-* ui: Removes ability to tune token_type for token auth methods [[GH-12904](https://github.com/hashicorp/vault/pull/12904)]
-* ui: trigger token renewal if inactive and half of TTL has passed [[GH-13950](https://github.com/hashicorp/vault/pull/13950)]
+* raft/autopilot: We've updated the autopilot reconciliation logic (by updating the raft-autopilot dependency to v0.3.0) to avoid artificially increasing the quorum in presence of an unhealthy node. Now autopilot will start the reconciliation process by attempting to demote a failed voter node before any promotions, fixing the issue where Vault would initially increase quorum when faced with a failure of a voter node. In certain configurations, especially when using Vault Enterprise Redundancy Zones and losing a voter then a non-voter in quick succession, this would lead to a loss of quorum and cluster failure. [[GH-29306](https://github.com/hashicorp/vault/pull/29306)]
+
+BUG FIXES:
+
+* activity: Show activity records from clients created in deleted namespaces when activity log is queried from admin namespace. [[GH-29432](https://github.com/hashicorp/vault/pull/29432)]
+* core/managed-keys (enterprise): Allow mechanism numbers above 32 bits in PKCS#11 managed keys.
+* core: Fix bug when if failing to persist the barrier keyring to track encryption counts, the number of outstanding encryptions remains added to the count, overcounting encryptions. [[GH-29506](https://github.com/hashicorp/vault/pull/29506)]
+* secrets-sync (enterprise): Add new parameters for destination configs to specify allowlists for IP's and ports.
+* secrets/pki: fixes issue #28749 requiring all chains to be single line of authority. [[GH-29342](https://github.com/hashicorp/vault/pull/29342)]
+* ui/database: Fixes 'cannot update static username' error when updating static role's rotation period [[GH-29498](https://github.com/hashicorp/vault/pull/29498)]
+
+## 1.16.15 Enterprise
+### January 30, 2025
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+CHANGES:
+
+* auth/cf: Update plugin to v0.19.1 [[GH-29295](https://github.com/hashicorp/vault/pull/29295)]
+* sdk: Updated golang and dependency versions to be consistent across core, API, SDK to address [[GO-2024-3333](https://pkg.go.dev/vuln/GO-2024-3333)] and ensure version consistency [[GH-29422](https://github.com/hashicorp/vault/pull/29422)]
+
+IMPROVEMENTS:
+
+* plugins (enterprise): The Database secrets engine now allows skipping the automatic rotation of static roles during import.
+* events (enterprise): Use the `path` event metadata field when authorizing a client's `subscribe` capability for consuming an event, instead of requiring `data_path` to be present in the event metadata.
+* ui: Adds navigation for LDAP hierarchical libraries [[GH-29293](https://github.com/hashicorp/vault/pull/29293)]
+* ui: Adds params to postgresql database to improve editing a connection in the web browser. [[GH-29200](https://github.com/hashicorp/vault/pull/29200)]
+
+BUG FIXES:
+
+* activity: Include activity records from clients created by deleted or disabled auth mounts in Export API response. [[GH-29376](https://github.com/hashicorp/vault/pull/29376)]
+* core: Prevent integer overflows of the barrier key counter on key rotation requests [[GH-29176](https://github.com/hashicorp/vault/pull/29176)]
+* database/mssql: Fix a bug where contained databases would silently fail root rotation if a custom root rotation statement was not provided. [[GH-29399](https://github.com/hashicorp/vault/pull/29399)]
+* plugins: Fix a bug that causes zombie dbus-daemon processes on certain systems. [[GH-29334](https://github.com/hashicorp/vault/pull/29334)]
+* sdk/database: Fix a bug where slow database connections can cause goroutines to be blocked. [[GH-29097](https://github.com/hashicorp/vault/pull/29097)]
+* secrets/pki: Fix a bug that prevented the full CA chain to be used when enforcing name constraints. [[GH-29255](https://github.com/hashicorp/vault/pull/29255)]
+* sentinel (enterprise): No longer report inaccurate log messages for when failing an advisory policy.
+* ui (enterprise): Fixes login to web UI when MFA is enabled for SAML auth methods [[GH-28873](https://github.com/hashicorp/vault/pull/28873)]
+* ui: Fixes login to web UI when MFA is enabled for OIDC (i.e. azure, auth0) and Okta auth methods [[GH-28873](https://github.com/hashicorp/vault/pull/28873)]
+* ui: Fixes navigation for quick actions in LDAP roles' popup menu [[GH-29293](https://github.com/hashicorp/vault/pull/29293)]
+
+
+## 1.16.14 Enterprise
+### December 18, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+CHANGES:
+
+* secrets/pki: Enforce the issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates. For more information see [PKI considerations](https://developer.hashicorp.com/vault/docs/secrets/pki/considerations#issuer-constraints-enforcement) [[GH-29045](https://github.com/hashicorp/vault/pull/29045)]
+
+IMPROVEMENTS:
+
+* auth/okta: update to okta sdk v5 from v2. Transitively updates go-jose dependency to >=3.0.3 to resolve GO-2024-2631. See https://github.com/okta/okta-sdk-golang/blob/master/MIGRATING.md for details on changes. [[GH-28121](https://github.com/hashicorp/vault/pull/28121)]
+* core: Added new `enable_post_unseal_trace` and `post_unseal_trace_directory` config options to generate Go traces during the post-unseal step for debug purposes. [[GH-28895](https://github.com/hashicorp/vault/pull/28895)]
+* sdk: Add Vault build date to system view plugin environment response [[GH-29082](https://github.com/hashicorp/vault/pull/29082)]
+* ui: Replace KVv2 json secret details view with Hds::CodeBlock component allowing users to search the full secret height. [[GH-28808](https://github.com/hashicorp/vault/pull/28808)]
+
+BUG FIXES:
+
+* autosnapshots (enterprise): Fix an issue where snapshot size metrics were not reported for cloud-based storage.
+* core/metrics: Fix unlocked mounts read for usage reporting. [[GH-29091](https://github.com/hashicorp/vault/pull/29091)]
+* core/seal (enterprise): Fix decryption of the raft bootstrap challenge when using seal high availability. [[GH-29117](https://github.com/hashicorp/vault/pull/29117)]
+* secret/db: Update static role rotation to generate a new password after 2 failed attempts. [[GH-28989](https://github.com/hashicorp/vault/pull/28989)]
+* ui: Allow users to search the full json object within the json code-editor edit/create view. [[GH-28808](https://github.com/hashicorp/vault/pull/28808)]
+* ui: Decode `connection_url` to fix database connection updates (i.e. editing connection config, deleting roles) failing when urls include template variables. [[GH-29114](https://github.com/hashicorp/vault/pull/29114)]
+* vault/diagnose: Fix time to expiration reporting within the TLS verification to not be a month off. [[GH-29128](https://github.com/hashicorp/vault/pull/29128)]
+
+## 1.16.13 Enterprise
+### November 21, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY:
+
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241115202008-166203013d8e
+
+CHANGES:
+
+* activity log: Deprecated the field "default_report_months". Instead, the billing start time will be used to determine the start time
+when querying the activity log endpoints. [[GH-27350](https://github.com/hashicorp/vault/pull/27350)]
+* core/ha (enterprise): Failed attempts to become a performance standby node are now using an exponential backoff instead of a
+10 second delay in between retries. The backoff starts at 2s and increases by a factor of two until reaching
+the maximum of 16s. This should make unsealing of the node faster in some cases.
+* login (enterprise): Return a 500 error during logins when performance standby nodes make failed gRPC requests to the active node. [[GH-28807](https://github.com/hashicorp/vault/pull/28807)]
+
+FEATURES:
+
+* **Product Usage Reporting**: Added product usage reporting, which collects anonymous, numerical, non-sensitive data about Vault secrets usage, and adds it to the existing utilization reports. See the [[docs](https://developer.hashicorp.com/vault/docs/enterprise/license/product-usage-reporting)] for more info [[GH-28858](https://github.com/hashicorp/vault/pull/28858)]
+
+IMPROVEMENTS:
+
+* raft-snapshot (enterprise): add support for managed identity credentials for azure snapshots
+* secrets-sync (enterprise): No longer attempt to unsync a random UUID secret name in GCP upon destination creation.
+
+BUG FIXES:
+
+* auth/ldap: Fixed an issue where debug level logging was not emitted. [[GH-28881](https://github.com/hashicorp/vault/pull/28881)]
+* core: Improved an internal helper function that sanitizes paths by adding a check for leading backslashes 
+in addition to the existing check for leading slashes. [[GH-28878](https://github.com/hashicorp/vault/pull/28878)]
+* secret/pki: Fix a bug that prevents PKI issuer field enable_aia_url_templating
+to be set to false. [[GH-28832](https://github.com/hashicorp/vault/pull/28832)]
+* secrets-sync (enterprise): Fixed issue where secret-key granularity destinations could sometimes cause a panic when loading a sync status.
+* secrets/aws: Fix issue with static credentials not rotating after restart or leadership change. [[GH-28775](https://github.com/hashicorp/vault/pull/28775)]
+* secrets/ssh: Return the flag `allow_empty_principals` in the read role api when key_type is "ca" [[GH-28901](https://github.com/hashicorp/vault/pull/28901)]
+* secrets/transform (enterprise): Fix nil panic when accessing a partially setup database store.
+* secrets/transit: Fix a race in which responses from the key update api could contain results from another subsequent update [[GH-28839](https://github.com/hashicorp/vault/pull/28839)]
+
+## 1.16.12 Enterprise
+### October 30, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY:
+* core/raft: Add raft join limits [[GH-28790](https://github.com/hashicorp/vault/pull/28790), [HCSEC-2024-26](https://discuss.hashicorp.com/t/hcsec-2024-26-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-processing-raft-cluster-join-requests)]
+CHANGES:
+
+* auth/azure: Update plugin to v0.17.1
+* secrets/openldap: Update plugin to v0.12.2
+
+IMPROVEMENTS:
+
+* ui: Add button to copy secret path in kv v1 and v2 secrets engines [[GH-28629](https://github.com/hashicorp/vault/pull/28629)]
+* ui: Adds copy button to identity entity, alias and mfa method IDs [[GH-28742](https://github.com/hashicorp/vault/pull/28742)]
+
+BUG FIXES:
+
+* core/seal (enterprise): Fix bug that caused seal generation information to be replicated, which prevented disaster recovery and performance replication clusters from using their own seal high-availability configuration.
+* core/seal: Fix an issue that could cause reading from sys/seal-backend-status to return stale information. [[GH-28631](https://github.com/hashicorp/vault/pull/28631)]
+* core: Fixed panic seen when performing help requests without /v1/ in the URL. [[GH-28669](https://github.com/hashicorp/vault/pull/28669)]
+* namespaces (enterprise): Fix issue where namespace patch requests to a performance secondary would not patch the namespace's metadata.
+* secrets/pki: Address issue with ACME HTTP-01 challenges failing for IPv6 IPs due to improperly formatted URLs [[GH-28718](https://github.com/hashicorp/vault/pull/28718)]
+* ui: No longer running decodeURIComponent on KVv2 list view allowing percent encoded data-octets in path name. [[GH-28698](https://github.com/hashicorp/vault/pull/28698)]
+  
+## 1.16.11 Enterprise
+### October 09, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY:
+
+* secrets/identity: A privileged Vault operator with write permissions to the root namespace's identity endpoint could escalate their privileges to Vault's root policy (CVE-2024-9180) [HCSEC-2024-21](https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565)
+
+IMPROVEMENTS:
+
+* core: log at level ERROR rather than INFO when all seals are unhealthy. [[GH-28564](https://github.com/hashicorp/vault/pull/28564)]
+* physical/raft: Log when the MAP_POPULATE mmap flag gets disabled before opening the database. [[GH-28526](https://github.com/hashicorp/vault/pull/28526)]
+
+BUG FIXES:
+
+* auth/cert: When using ocsp_ca_certificates, an error was produced though extra certs validation succeeded. [[GH-28597](https://github.com/hashicorp/vault/pull/28597)]
+* auth/token: Fix token TTL calculation so that it uses `max_lease_ttl` tune value for tokens created via `auth/token/create`. [[GH-28498](https://github.com/hashicorp/vault/pull/28498)]
+* databases: fix issue where local timezone was getting lost when using a rotation schedule cron [[GH-28509](https://github.com/hashicorp/vault/pull/28509)]
+* secrets-sync (enterprise): Fix KV secret access sometimes being denied, due to a double forward-slash (`//`) in the mount path, when the token should otherwise have access.
+
+## 1.16.10 Enterprise
+### September 25, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY:
+* secrets/ssh: require `valid_principals` to contain a value or `default_user` be set by default to guard against potentially insecure configurations. `allow_empty_principals` can be used for backwards compatibility [HCSEC-2024-20](https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/7025
+
+CHANGES:
+
+* core: Bump Go version to 1.22.7.
+* secrets/ssh: Add a flag, `allow_empty_principals` to allow keys or certs to apply to any user/principal. [[GH-28466](https://github.com/hashicorp/vault/pull/28466)]
+
+IMPROVEMENTS:
+
+* audit: Internal implementation changes to the audit subsystem which improve relability. [[GH-28286](https://github.com/hashicorp/vault/pull/28286)]
+* ui: Remove deprecated `current_billing_period` from dashboard activity log request [[GH-27559](https://github.com/hashicorp/vault/pull/27559)]
+
+BUG FIXES:
+
+* secret/aws: Fixed potential panic after step-down and the queue has not repopulated. [[GH-28330](https://github.com/hashicorp/vault/pull/28330)]
+* auth/cert: During certificate validation, OCSP requests are debug logged even if Vault's log level is above DEBUG. [[GH-28450](https://github.com/hashicorp/vault/pull/28450)]
+* auth/cert: ocsp_ca_certificates field was not honored when validating OCSP responses signed by a CA that did not issue the certificate. [[GH-28309](https://github.com/hashicorp/vault/pull/28309)]
+* auth: Updated error handling for missing login credentials in AppRole and UserPass auth methods to return a 400 error instead of a 500 error. [[GH-28441](https://github.com/hashicorp/vault/pull/28441)]
+* core: Fixed an issue where maximum request duration timeout was not being added to all requests containing strings sys/monitor and sys/events. With this change, timeout is now added to all requests except monitor and events endpoint. [[GH-28230](https://github.com/hashicorp/vault/pull/28230)]
+* proxy/cache (enterprise): Fixed a data race that could occur while tracking capabilities in Proxy's static secret cache. [[GH-28494](https://github.com/hashicorp/vault/pull/28494)]
+* secrets-sync (enterprise): Validate corresponding GitHub app parameters `app_name` and `installation_id` are set
+
+## 1.16.9 Enterprise
+### August 30, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY: 
+
+core/audit: fix regression where client tokens and token accessors were being
+displayed in the audit log in plaintext [HCSEC-2024-18](https://discuss.hashicorp.com/t/hcsec-2024-18-vault-leaks-client-token-and-token-accessor-in-audit-devices)
+
+BUG FIXES:
+
+* proxy/cache (enterprise): Fixed an issue where Proxy with static secret caching enabled would not correctly handle requests to older secret versions for KVv2 secrets. Proxy's static secret cache now properly handles all requests relating to older versions for KVv2 secrets. [[GH-28207](https://github.com/hashicorp/vault/pull/28207)]
+## 1.16.8 Enterprise
+### August 29, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+CHANGES:
+
+* activity (enterprise): filter all fields in client count responses by the request namespace [[GH-27790](https://github.com/hashicorp/vault/pull/27790)]
+* core: Bump Go version to 1.22.6
+
+IMPROVEMENTS:
+
+* activity log: Changes how new client counts in the current month are estimated, in order to return more
+visibly sensible totals. [[GH-27547](https://github.com/hashicorp/vault/pull/27547)]
+* activity: `/sys/internal/counters/activity` will now include a warning if the specified usage period contains estimated client counts. [[GH-28068](https://github.com/hashicorp/vault/pull/28068)]
+* audit: Adds TRACE logging to log request/response under certain circumstances, and further improvements to the audit subsystem. [[GH-28056](https://github.com/hashicorp/vault/pull/28056)]
+* cli: `vault operator usage` will now include a warning if the specified usage period contains estimated client counts. [[GH-28068](https://github.com/hashicorp/vault/pull/28068)]
+* core/activity: Ensure client count queries that include the current month return consistent results by sorting the clients before performing estimation [[GH-28062](https://github.com/hashicorp/vault/pull/28062)]
+
+BUG FIXES:
+
+* activity: The sys/internal/counters/activity endpoint will return current month data when the end_date parameter is set to a future date. [[GH-28042](https://github.com/hashicorp/vault/pull/28042)]
+* command: The `vault secrets move` and `vault auth move` command will no longer attempt to write to storage on performance standby nodes. [[GH-28059](https://github.com/hashicorp/vault/pull/28059)]
+* core (enterprise): Fix deletion of MFA login-enforcement configurations on standby nodes
+* secrets/database: Skip connection verification on reading existing DB connection configuration [[GH-28139](https://github.com/hashicorp/vault/pull/28139)]
+* ui: fixes toast (flash) alert message saying "created" when deleting a kv v2 secret [[GH-28093](https://github.com/hashicorp/vault/pull/28093)]
+
+## 1.16.7 Enterprise
+### August 07, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+CHANGES:
+
+* auth/cf: Update plugin to v0.18.0 [[GH-27724](https://github.com/hashicorp/vault/pull/27724)]
+
+IMPROVEMENTS:
+
+* audit: Ensure that any underyling errors from audit devices are logged even if we consider auditing to be a success. [[GH-27809](https://github.com/hashicorp/vault/pull/27809)]
+* audit: Internal implementation changes to the audit subsystem which improve performance. [[GH-27952](https://github.com/hashicorp/vault/pull/27952)]
+* audit: sinks (file, socket, syslog) will attempt to log errors to the server operational 
+log before returning (if there are errors to log, and the context is done). [[GH-27859](https://github.com/hashicorp/vault/pull/27859)]
+* auth/cert: Cache full list of role trust information separately to avoid
+eviction, and avoid duplicate loading during multiple simultaneous logins on
+the same role. [[GH-27902](https://github.com/hashicorp/vault/pull/27902)]
+* license utilization reporting (enterprise): Auto-roll billing start date. [[GH-27656](https://github.com/hashicorp/vault/pull/27656)]
+
+BUG FIXES:
+
+* auth/cert: Use subject's serial number, not issuer's within error message text in OCSP request errors [[GH-27696](https://github.com/hashicorp/vault/pull/27696)]
+* cli: Fixed issue with `vault hcp connect` where HCP resources with uppercase letters were inaccessible when entering the correct project name. [[GH-27694](https://github.com/hashicorp/vault/pull/27694)]
+* core (enterprise): Fix 500 errors that occurred querying `sys/internal/ui/mounts` for a mount prefixed by a namespace path when path filters are configured. [[GH-27939](https://github.com/hashicorp/vault/pull/27939)]
+* core/identity: Fixed an issue where deleted/reassigned entity-aliases were not removed from in-memory database. [[GH-27750](https://github.com/hashicorp/vault/pull/27750)]
+* proxy/cache (enterprise): Fixed an issue where Proxy would not correctly update KV secrets when talking to a perf standby. Proxy will now attempt to forward requests to update secrets triggered by events to the active node. Note that this requires `allow_forwarding_via_header` to be configured on the cluster. [[GH-27891](https://github.com/hashicorp/vault/pull/27891)]
+* raft/autopilot: Fixed panic that may occur during shutdown [[GH-27726](https://github.com/hashicorp/vault/pull/27726)]
+* secrets-sync (enterprise): Destination set/remove operations will no longer be blocked as "purge in progress" after a purge job ended in failure.
+* secrets-sync (enterprise): Normalize custom_tag keys and values for recoverable invalid characters.
+* secrets-sync (enterprise): Normalize secret key names before storing the external_name in a secret association.
+* secrets-sync (enterprise): Patching github sync destination credentials will properly update and save the new credentials.
+* secrets-sync (enterprise): Return an error immediately on destination creation when providing invalid custom_tags based on destination type.
+* secrets/identity (enterprise): Fix a bug that can cause DR promotion to fail in rare cases where a PR secondary has inconsistent alias information in storage.
+* sys: Fix a bug where mounts of external plugins that were registered before Vault v1.0.0 could not be tuned to
+use versioned plugins. [[GH-27881](https://github.com/hashicorp/vault/pull/27881)]
+* ui: Fix cursor jump on KVv2 json editor that would occur after pressing ENTER. [[GH-27569](https://github.com/hashicorp/vault/pull/27569)]
+* ui: fix issue where enabling then disabling "Tidy ACME" in PKI results in failed API call. [[GH-27742](https://github.com/hashicorp/vault/pull/27742)]
+* ui: fix namespace picker not working when in small screen where the sidebar is collapsed by default. [[GH-27728](https://github.com/hashicorp/vault/pull/27728)]
+
+
+## 1.16.6 Enterprise
+### July 10, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+CHANGES:
+
+* core: Bump Go version to 1.22.5.
+* auth/jwt: Revert [GH-295](https://github.com/hashicorp/vault-plugin-auth-jwt/pull/295) which changed the way JWT `aud` claims were validated.
+
+BUG FIXES:
+
+* agent: Correctly constructs kv-v2 secret paths in nested namespaces. [[GH-26863](https://github.com/hashicorp/vault/pull/26863)]
+* core (enterprise): Fix HTTP redirects in namespaces to use the correct path and (in the case of event subscriptions) the correct URI scheme. [[GH-27660](https://github.com/hashicorp/vault/pull/27660)]
+* core/config: fix issue when using `proxy_protocol_behavior` with `deny_unauthorized`, 
+which causes the Vault TCP listener to close after receiving an untrusted upstream proxy connection. [[GH-27589](https://github.com/hashicorp/vault/pull/27589)]
+* core: Fixed an issue with performance standbys not being able to handle rotate root requests. [[GH-27631](https://github.com/hashicorp/vault/pull/27631)]
+* ui: Display an error and force a timeout when TOTP passcode is incorrect [[GH-27574](https://github.com/hashicorp/vault/pull/27574)]
+* ui: Ensure token expired banner displays when batch token expires [[GH-27479](https://github.com/hashicorp/vault/pull/27479)]
+  
+## 1.16.5 Enterprise
+### June 26, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+BUG FIXES:
+
+* cli/debug: Fix resource leak in CLI debug command. [[GH-26167](https://github.com/hashicorp/vault/pull/26167)]
+* config: Vault TCP listener config now correctly supports the documented proxy_protocol_behavior 
+setting of 'deny_unauthorized' [[GH-27459](https://github.com/hashicorp/vault/pull/27459)]
+* core/audit: Audit logging a Vault request/response checks if the existing context 
+is cancelled and will now use a new context with a 5 second timeout.
+If the existing context is cancelled a new context, will be used. [[GH-27531](https://github.com/hashicorp/vault/pull/27531)]
+* helper/pkcs7: Fix parsing certain messages containing only certificates [[GH-27435](https://github.com/hashicorp/vault/pull/27435)]
+* replication (enterprise): fix cache invalidation issue leading to namespace custom metadata not being shown correctly on performance secondaries
+* secrets-sync (enterprise): Properly remove tags from secrets in AWS when they are removed from the source association
+* secrets-sync (enterprise): Return more accurate error code for invalid connection details
+* secrets-sync (enterprise): Skip invalid GitHub repository names when creating destinations
+* storage/raft (enterprise): Fix issue with namespace cache not getting cleared on snapshot restore, resulting in namespaces not found in the snapshot being inaccurately represented by API responses. [[GH-27474](https://github.com/hashicorp/vault/pull/27474)]
+* ui: Allow creation of session_token type roles for AWS secret backend [[GH-27424](https://github.com/hashicorp/vault/pull/27424)]
+
+## 1.16.4 Enterprise 
+### June 12, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+CHANGES:
+
+* core: Bump Go version to 1.22.4.
+* ui/kubernetes: Update the roles filter-input to use explicit search. [[GH-27178](https://github.com/hashicorp/vault/pull/27178)]
+
+IMPROVEMENTS:
+
+* ui: Allow users to wrap inputted data again instead of resetting form [[GH-27289](https://github.com/hashicorp/vault/pull/27289)]
+* ui: Update language in Transit secret engine to reflect that not all keys are for encyryption [[GH-27346](https://github.com/hashicorp/vault/pull/27346)]
+
+BUG FIXES:
+
+* secrets/transform (enterprise): Fix a bug preventing the use of alternate schemas on PostgreSQL token stores.
+* storage/raft (enterprise): Fix a regression introduced in 1.15.8 that causes
+autopilot to fail to discover new server versions and so not trigger an upgrade. [[GH-27277](https://github.com/hashicorp/vault/pull/27277)]
+* ui: Do not show resultant-ACL banner when ancestor namespace grants wildcard access. [[GH-27263](https://github.com/hashicorp/vault/pull/27263)]
+* ui: Fix a bug where disabling TTL on the AWS credential form would still send TTL value [[GH-27366](https://github.com/hashicorp/vault/pull/27366)]
+* ui: fix issue where a month with total clients but no new clients breaks the client count dashboard [[GH-5962](https://github.com/hashicorp/vault/pull/5962)]
+
+## 1.16.3 
+### May 30, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+SECURITY:
+
+* auth/jwt: Update plugin to v0.20.3 that resolves a security issue with validing JWTs [[GH-26890](https://github.com/hashicorp/vault/pull/26890), [HCSEC-2024-11](https://discuss.hashicorp.com/t/hcsec-2024-11-vault-incorrectly-validated-json-web-tokens-jwt-audience-claims/67770)]
+
+CHANGES:
+
+* core/identity: improve performance for secondary nodes receiving identity related updates through replication [[GH-27184](https://github.com/hashicorp/vault/pull/27184)]
+* core: Bump Go version to 1.22.2.
+
+IMPROVEMENTS:
+
+* secrets/pki (enterprise): Disable warnings about unknown parameters to the various CIEPS endpoints
+* ui: Update PGP display and show error for Generate Operation Token flow with PGP [[GH-26993](https://github.com/hashicorp/vault/pull/26993)]
+
+BUG FIXES:
+
+* activity (enterprise): fix read-only storage error on upgrades
+* auto-auth: Addressed issue where having no permissions to renew a renewable token caused auto-auth to attempt to renew constantly with no backoff [[GH-26844](https://github.com/hashicorp/vault/pull/26844)]
+* core (enterprise): Fix an issue that prevented the seal re-wrap status from reporting that a re-wrap is in progress for up to a second.
+* core/audit: Audit logging a Vault request/response will now use a minimum 5 second context timeout. 
+If the existing context deadline occurs later than 5s in the future, it will be used, otherwise a new context, separate from the original will be used. [[GH-26616](https://github.com/hashicorp/vault/pull/26616)]
+* core: Add missing field delegated_auth_accessors to GET /sys/mounts/:path API response [[GH-26876](https://github.com/hashicorp/vault/pull/26876)]
+* core: Address a data race updating a seal's last seen healthy time attribute [[GH-27014](https://github.com/hashicorp/vault/pull/27014)]
+* core: Fix `redact_version` listener parameter being ignored for some OpenAPI related endpoints. [[GH-26607](https://github.com/hashicorp/vault/pull/26607)]
+* events (enterprise): Fix bug preventing subscribing and receiving events within a namepace.
+* pki: Fix error in cross-signing using ed25519 keys [[GH-27093](https://github.com/hashicorp/vault/pull/27093)]
+* replication (enterprise): fix "given mount path is not in the same namespace as the request" error that can occur when enabling replication for the first time on a secondary cluster
+* secrets-sync (enterprise): Secondary nodes in a cluster now properly check activation-flags values.
+* secrets/azure: Update vault-plugin-secrets-azure to 0.17.2 to include a bug fix for azure role creation [[GH-26896](https://github.com/hashicorp/vault/pull/26896)]
+* secrets/pki (enterprise): cert_role parameter within authenticators.cert EST configuration handler could not be set
+* secrets/transit: Use 'hash_algorithm' parameter if present in HMAC verify requests. Otherwise fall back to deprecated 'algorithm' parameter. [[GH-27211](https://github.com/hashicorp/vault/pull/27211)]
+* ui: Fix KVv2 cursor jumping inside json editor after initial input. [[GH-27120](https://github.com/hashicorp/vault/pull/27120)]
+* ui: Fix KVv2 json editor to allow null values. [[GH-27094](https://github.com/hashicorp/vault/pull/27094)]
+* ui: Fix broken help link in console for the web command. [[GH-26858](https://github.com/hashicorp/vault/pull/26858)]
+* ui: Fix link to v2 generic secrets engine from secrets list page. [[GH-27019](https://github.com/hashicorp/vault/pull/27019)]
+* ui: Prevent perpetual loading screen when Vault needs initialization [[GH-26985](https://github.com/hashicorp/vault/pull/26985)]
+* ui: Refresh model within a namespace on the Secrets Sync overview page. [[GH-26790](https://github.com/hashicorp/vault/pull/26790)]
+
+## 1.16.2
+### April 24, 2024
+
+**Enterprise LTS:** Vault Enterprise 1.16 is a [Long-Term Support (LTS)](https://developer.hashicorp.com/vault/docs/enterprise/lts) release.
+
+CHANGES:
+
+* auth/jwt: Update plugin to v0.20.2 [[GH-26291](https://github.com/hashicorp/vault/pull/26291)]
+* core: Bump Go version to 1.21.9.
+* secrets/azure: Update plugin to v0.17.1 [[GH-26528](https://github.com/hashicorp/vault/pull/26528)]
+* ui: Update dependencies including D3 libraries [[GH-26346](https://github.com/hashicorp/vault/pull/26346)]
+
+IMPROVEMENTS:
+
+* activity (enterprise): Change minimum retention window in activity log to 48 months
+* audit: timestamps across multiple audit devices for an audit entry will now match. [[GH-26088](https://github.com/hashicorp/vault/pull/26088)]
+* license utilization reporting (enterprise): Add retention months to license utilization reports.
+* sdk/decompression: DecompressWithCanary will now chunk the decompression in memory to prevent loading it all at once. [[GH-26464](https://github.com/hashicorp/vault/pull/26464)]
+* ui: fixes cases where inputs did not have associated labels [[GH-26263](https://github.com/hashicorp/vault/pull/26263)]
+* ui: show banner instead of permission denied error when batch token is expired [[GH-26396](https://github.com/hashicorp/vault/pull/26396)]
+
+BUG FIXES:
+
+* agent: `vault.namespace` no longer gets incorrectly overridden by `auto_auth.namespace`, if set [[GH-26427](https://github.com/hashicorp/vault/pull/26427)]
+* api: fixed a bug where LifetimeWatcher routines weren't respecting exponential backoff in the presence of unexpected errors [[GH-26383](https://github.com/hashicorp/vault/pull/26383)]
+* core (enterprise): fix bug where raft followers disagree with the seal type after returning to one seal from two. [[GH-26523](https://github.com/hashicorp/vault/pull/26523)]
+* core/seal: During a seal reload through SIGHUP, only write updated seal barrier on an active node [[GH-26381](https://github.com/hashicorp/vault/pull/26381)]
+* core/seal: allow overriding of VAULT_GCPCKMS_SEAL_KEY_RING and VAULT_GCPCKMS_SEAL_CRYPTO_KEY environment keys in seal-ha
+* events (enterprise): Terminate WebSocket connection when token is revoked.
+* secrets/pki: fixed validation bug which rejected ldap schemed URLs in crl_distribution_points. [[GH-26477](https://github.com/hashicorp/vault/pull/26477)]
+* storage/raft (enterprise): Fix a bug where autopilot automated upgrades could fail due to using the wrong upgrade version
+* ui: fixed a bug where the replication pages did not update display when navigating between DR and performance [[GH-26325](https://github.com/hashicorp/vault/pull/26325)]
+* ui: fixes undefined start time in filename for downloaded client count attribution csv [[GH-26485](https://github.com/hashicorp/vault/pull/26485)]
+
+## 1.16.1 
+### April 04, 2024
+
+**Please note that Vault 1.16.1 is the first Enterprise release of the Vault Enterprise 1.16 series.**
+
+BUG FIXES:
+
+* auth/ldap: Fix login error for group search anonymous bind. [[GH-26200](https://github.com/hashicorp/vault/pull/26200)]
+* auth/ldap: Fix login error missing entity alias attribute value. [[GH-26200](https://github.com/hashicorp/vault/pull/26200)]
+* cli: fixed a bug where the Vault CLI would error out if HOME was not set. [[GH-26243](https://github.com/hashicorp/vault/pull/26243)]
+* core: Only reload seal configuration when enable_multiseal is set to true. [[GH-26166](https://github.com/hashicorp/vault/pull/26166)]
+* secret/database: Fixed race condition where database mounts may leak connections [[GH-26147](https://github.com/hashicorp/vault/pull/26147)]
+
+## 1.16.0
+### March 26, 2024
+
+SECURITY:
+
+* auth/cert: compare public keys of trusted non-CA certificates with incoming
+client certificates to prevent trusting certs with the same serial number
+but not the same public/private key (CVE-2024-2048). [[GH-25649](https://github.com/hashicorp/vault/pull/25649), [HSEC-2024-05](https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382)]
+* auth/cert: validate OCSP response was signed by the expected issuer and serial number matched request (CVE-2024-2660) [[GH-26091](https://github.com/hashicorp/vault/pull/26091), [HSEC-2024-07](https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573)]
+* secrets/transit: fix a regression that was honoring nonces provided in non-convergent modes during encryption (CVE-2023-4680) [[GH-22852](https://github.com/hashicorp/vault/pull/22852), [HSEC-2023-28](https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249)]
+
+CHANGES:
+
+* Upgrade grpc to v1.58.3 [[GH-23703](https://github.com/hashicorp/vault/pull/23703)]
+* Upgrade x/net to v0.17.0 [[GH-23703](https://github.com/hashicorp/vault/pull/23703)]
+* api: add the `enterprise` parameter to the `/sys/health` endpoint [[GH-24270](https://github.com/hashicorp/vault/pull/24270)]
+* auth/alicloud: Update plugin to v0.16.1 [[GH-25014](https://github.com/hashicorp/vault/pull/25014)]
+* auth/alicloud: Update plugin to v0.17.0 [[GH-25217](https://github.com/hashicorp/vault/pull/25217)]
+* auth/approle: Normalized error response messages when invalid credentials are provided [[GH-23786](https://github.com/hashicorp/vault/pull/23786)]
+* auth/azure: Update plugin to v0.16.1 [[GH-22795](https://github.com/hashicorp/vault/pull/22795)]
+* auth/azure: Update plugin to v0.17.0 [[GH-25258](https://github.com/hashicorp/vault/pull/25258)]
+* auth/cf: Update plugin to v0.16.0 [[GH-25196](https://github.com/hashicorp/vault/pull/25196)]
+* auth/gcp: Update plugin to v0.16.2 [[GH-25233](https://github.com/hashicorp/vault/pull/25233)]
+* auth/jwt: Update plugin to v0.19.0 [[GH-24972](https://github.com/hashicorp/vault/pull/24972)]
+* auth/jwt: Update plugin to v0.20.0 [[GH-25326](https://github.com/hashicorp/vault/pull/25326)]
+* auth/jwt: Update plugin to v0.20.1 [[GH-25937](https://github.com/hashicorp/vault/pull/25937)]
+* auth/kerberos: Update plugin to v0.10.1 [[GH-22797](https://github.com/hashicorp/vault/pull/22797)]
+* auth/kerberos: Update plugin to v0.11.0 [[GH-25232](https://github.com/hashicorp/vault/pull/25232)]
+* auth/kubernetes: Update plugin to v0.18.0 [[GH-25207](https://github.com/hashicorp/vault/pull/25207)]
+* auth/oci: Update plugin to v0.14.1 [[GH-22774](https://github.com/hashicorp/vault/pull/22774)]
+* auth/oci: Update plugin to v0.15.1 [[GH-25245](https://github.com/hashicorp/vault/pull/25245)]
+* cli: Using `vault plugin reload` with `-plugin` in the root namespace will now reload the plugin across all namespaces instead of just the root namespace. [[GH-24878](https://github.com/hashicorp/vault/pull/24878)]
+* cli: `vault plugin info` and `vault plugin deregister` now require 2 positional arguments instead of accepting either 1 or 2. [[GH-24250](https://github.com/hashicorp/vault/pull/24250)]
+* core (enterprise): Seal High Availability (HA) must be enabled by `enable_multiseal` in configuration.
+* core: Bump Go version to 1.21.8.
+* database/couchbase: Update plugin to v0.10.1 [[GH-25275](https://github.com/hashicorp/vault/pull/25275)]
+* database/elasticsearch: Update plugin to v0.14.0 [[GH-25263](https://github.com/hashicorp/vault/pull/25263)]
+* database/mongodbatlas: Update plugin to v0.11.0 [[GH-25264](https://github.com/hashicorp/vault/pull/25264)]
+* database/redis-elasticache: Update plugin to v0.3.0 [[GH-25296](https://github.com/hashicorp/vault/pull/25296)]
+* database/redis: Update plugin to v0.2.3 [[GH-25289](https://github.com/hashicorp/vault/pull/25289)]
+* database/snowflake: Update plugin to v0.10.0 [[GH-25143](https://github.com/hashicorp/vault/pull/25143)]
+* database/snowflake: Update plugin to v0.9.1 [[GH-25020](https://github.com/hashicorp/vault/pull/25020)]
+* events: Remove event noficiations websocket endpoint in non-Enterprise [[GH-25640](https://github.com/hashicorp/vault/pull/25640)]
+* events: Source URL is now `vault://{vault node}` [[GH-24201](https://github.com/hashicorp/vault/pull/24201)]
+* identity (enterprise): POST requests to the `/identity/entity/merge` endpoint
+are now always forwarded from standbys to the active node. [[GH-24325](https://github.com/hashicorp/vault/pull/24325)]
+* plugins/database: Reading connection config at `database/config/:name` will now return a computed `running_plugin_version` field if a non-builtin version is running. [[GH-25105](https://github.com/hashicorp/vault/pull/25105)]
+* plugins: Add a warning to the response from sys/plugins/reload/backend if no plugins were reloaded. [[GH-24512](https://github.com/hashicorp/vault/pull/24512)]
+* plugins: By default, environment variables provided during plugin registration will now take precedence over system environment variables.
+Use the environment variable `VAULT_PLUGIN_USE_LEGACY_ENV_LAYERING=true` to opt out and keep higher preference for system environment
+variables. When this flag is set, Vault will check during unseal for conflicts and print warnings for any plugins with environment
+variables that conflict with system environment variables. [[GH-25128](https://github.com/hashicorp/vault/pull/25128)]
+* plugins: `/sys/plugins/runtimes/catalog` response will always include a list of "runtimes" in the response, even if empty. [[GH-24864](https://github.com/hashicorp/vault/pull/24864)]
+* sdk: Upgrade dependent packages by sdk.
+This includes github.com/docker/docker to v24.0.7+incompatible,
+google.golang.org/grpc to  v1.57.2 and golang.org/x/net to v0.17.0. [[GH-23913](https://github.com/hashicorp/vault/pull/23913)]
+* secrets/ad: Update plugin to v0.16.2 [[GH-25058](https://github.com/hashicorp/vault/pull/25058)]
+* secrets/ad: Update plugin to v0.17.0 [[GH-25187](https://github.com/hashicorp/vault/pull/25187)]
+* secrets/alicloud: Update plugin to v0.16.0 [[GH-25257](https://github.com/hashicorp/vault/pull/25257)]
+* secrets/azure: Update plugin to v0.17.0 [[GH-25189](https://github.com/hashicorp/vault/pull/25189)]
+* secrets/gcp: Update plugin to v0.18.0 [[GH-25173](https://github.com/hashicorp/vault/pull/25173)]
+* secrets/gcpkms: Update plugin to v0.16.0 [[GH-25231](https://github.com/hashicorp/vault/pull/25231)]
+* secrets/keymgmt: Update plugin to v0.10.0
+* secrets/kubernetes: Update plugin to v0.7.0 [[GH-25204](https://github.com/hashicorp/vault/pull/25204)]
+* secrets/kv: Update plugin to v0.16.2 [[GH-22790](https://github.com/hashicorp/vault/pull/22790)]
+* secrets/kv: Update plugin to v0.17.0 [[GH-25277](https://github.com/hashicorp/vault/pull/25277)]
+* secrets/mongodbatlas: Update plugin to v0.10.2 [[GH-23849](https://github.com/hashicorp/vault/pull/23849)]
+* secrets/mongodbatlas: Update plugin to v0.11.0 [[GH-25253](https://github.com/hashicorp/vault/pull/25253)]
+* secrets/openldap: Update plugin to v0.11.3 [[GH-25040](https://github.com/hashicorp/vault/pull/25040)]
+* secrets/openldap: Update plugin to v0.12.0 [[GH-25251](https://github.com/hashicorp/vault/pull/25251)]
+* secrets/openldap: Update plugin to v0.12.1 [[GH-25524](https://github.com/hashicorp/vault/pull/25524)]
+* secrets/terraform: Update plugin to v0.7.5 [[GH-25288](https://github.com/hashicorp/vault/pull/25288)]
+* telemetry: Seal wrap encrypt/decrypt metrics now differentiate between seals using a metrics label of seal name rather than separate metric names. [[GH-23837](https://github.com/hashicorp/vault/pull/23837)]
+* ui: Update icons to use Flight icons where available. [[GH-24823](https://github.com/hashicorp/vault/pull/24823)]
+* ui: add subnav for replication items [[GH-24283](https://github.com/hashicorp/vault/pull/24283)]
+
+FEATURES:
+
+* **Add Snapshot Inspector Tool**: Add CLI tool to inspect Vault snapshots [[GH-23457](https://github.com/hashicorp/vault/pull/23457)]
+* **Audit Filtering (enterprise)**: Audit devices support expression-based filter rules (powered by go-bexpr) to determine which entries are written to the audit log. [[GH-24558](https://github.com/hashicorp/vault/pull/24558)]
+* **Controlled Access to Unauthenticated Endpoints (enterprise)**: Gives admins more control over how unauthenticated endpoints in Vault can be accessed and in some cases what information they return. [[GH-23547](https://github.com/hashicorp/vault/pull/23547)] [[GH-23534](https://github.com/hashicorp/vault/pull/23534)] [[GH-23740](https://github.com/hashicorp/vault/pull/23740)]
+* **Custom messages (enterprise)**: Introduces custom messages settings, allowing users to view, and operators to configure system-wide messages.
+* **Database Event Notifications**: The database plugin now emits event notifications. [[GH-24718](https://github.com/hashicorp/vault/pull/24718)]
+* **Default Lease Count Quota (enterprise)**: Apply a new global default lease count quota of 300k leases for all
+new installs of Vault. [[GH-24382](https://github.com/hashicorp/vault/pull/24382)]
+* **Experimental Raft-WAL Option**: Reduces risk of infinite snapshot loops for follower nodes in large-scale Integrated Storage deployments. [[GH-21460](https://github.com/hashicorp/vault/pull/21460)]
+* **Manual License Utilization Reporting**: Added manual license
+utilization reporting, which allows users to create manual exports of product-license [metering
+data] to report to Hashicorp.
+* **Plugin Identity Tokens**: Adds secret-less configuration of AWS secret engine using web identity federation. [[GH-24987](https://github.com/hashicorp/vault/pull/24987)]
+* **Plugin Workload Identity** (enterprise): Vault can generate identity tokens for plugins to use in workload identity federation auth flows.
+* **Quotas in Privileged Namespaces**: Enable creation/update/deletion of quotas from the privileged namespace
+* **Reload seal configuration on SIGHUP**: Seal configuration is reloaded on SIGHUP so that seal configuration can
+be changed without shutting down vault [[GH-23571](https://github.com/hashicorp/vault/pull/23571)]
+* **Request Limiter (enterprise)**: Add adaptive concurrency limits to
+write-based HTTP methods and special-case `pki/issue` requests to prevent
+overloading the Vault server. [[GH-25093](https://github.com/hashicorp/vault/pull/25093)]
+* **Rotate Root for LDAP auth**: Rotate root operations are now supported for the LDAP auth engine. [[GH-24099](https://github.com/hashicorp/vault/pull/24099)]
+* **Seal High Availability (enterprise)**: Operators can configure more than one automatic seal for resilience against seal provider outages.
+* **Secrets Sync UI (enterprise)**: Adds secret syncing for KV v2 secrets to external destinations using the UI. [[GH-23667](https://github.com/hashicorp/vault/pull/23667)]
+* **Vault PKI EST Server (Enterprise/Beta)**: Beta support for the PKI Enrollment over Secure Transport (EST) certificate management protocol has been added to the Vault PKI Plugin. This allows standard EST clients to request certificates from a Vault server with no knowledge of Vault APIs.
+* **Vault Proxy Static Secret Caching (enterprise)**: Adds support for static secret (KVv1 and KVv2) caching to Vault Proxy. [[GH-23621](https://github.com/hashicorp/vault/pull/23621)]
+* **secrets-import (enterprise)**: Support importing secrets from external sources into KVv2
+* **secrets/aws**: Support issuing an STS Session Token directly from the root credential. [[GH-23690](https://github.com/hashicorp/vault/pull/23690)]
+
+IMPROVEMENTS:
+
+* .release/linux: add LimitCORE=0 to vault.service [[GH-23272](https://github.com/hashicorp/vault/pull/23272)]
+* agent/template: Added max_connections_per_host to limit total number of connections per Vault host. [[GH-24548](https://github.com/hashicorp/vault/pull/24548)]
+* agent: Added new namespace top level configuration parameter, which can be used to make requests made by Agent to go to that namespace. [[GH-24667](https://github.com/hashicorp/vault/pull/24667)]
+* agent: allow users to specify files for child process stdout/stderr [[GH-22812](https://github.com/hashicorp/vault/pull/22812)]
+* api (enterprise): Enable the sys/license/features from any namespace
+* api/plugins: add `tls-server-name` arg for plugin registration [[GH-23549](https://github.com/hashicorp/vault/pull/23549)]
+* api: Add wrapper functions for GET /sys/mounts/:path and GET /sys/auth/:path [[GH-25499](https://github.com/hashicorp/vault/pull/25499)]
+* api: Do not require sudo for API wrapper functions GetAuth and GetAuthWithContext [[GH-25968](https://github.com/hashicorp/vault/pull/25968)]
+* api: added new API field to Vault responses, `mount_type`, returning mount information (e.g. `kv` for KVV1/KVV2) for mount when appropriate. [[GH-23047](https://github.com/hashicorp/vault/pull/23047)]
+* api: sys/health and sys/ha-status now expose information about how long
+the last heartbeat took, and the estimated clock skew between standby and
+active node based on that heartbeat duration. [[GH-24343](https://github.com/hashicorp/vault/pull/24343)]
+* auth/cert: Allow validation with OCSP responses with no NextUpdate time [[GH-25912](https://github.com/hashicorp/vault/pull/25912)]
+* auth/cert: Cache trusted certs to reduce memory usage and improve performance of logins. [[GH-25421](https://github.com/hashicorp/vault/pull/25421)]
+* auth/ldap: introduce cap/ldap.Client for LDAP authentication
+auth/ldap: deprecates `connection_timeout` in favor of `request_timeout` for timeouts
+sdk/ldaputil: deprecates Client in favor of cap/ldap.Client [[GH-22185](https://github.com/hashicorp/vault/pull/22185)]
+* auth/saml: Update plugin to v0.2.0
+* auto-auth/azure: Support setting the `authenticate_from_environment` variable to "true" and "false" string literals, too. [[GH-22996](https://github.com/hashicorp/vault/pull/22996)]
+* cli: introduce new command group hcp which groups subcommands for authentication of users or machines to HCP using
+either provided arguments or retrieved HCP token through browser login. [[GH-23897](https://github.com/hashicorp/vault/pull/23897)]
+* cli: Improved error messages for `vault plugin` sub-commands. [[GH-24250](https://github.com/hashicorp/vault/pull/24250)]
+* cli: adds plugin identity token to enable and tune commands for secret engines and auth methods [[GH-24980](https://github.com/hashicorp/vault/pull/24980)]
+* cli: include secret syncs counts in the `vault operator usage` command output [[GH-25751](https://github.com/hashicorp/vault/pull/25751)]
+* command/server: display logs on startup immediately if disable-gated-logs flag is set [[GH-24280](https://github.com/hashicorp/vault/pull/24280)]
+* command/token-capabilities: allow using accessor when listing token capabilities on a path [[GH-24479](https://github.com/hashicorp/vault/pull/24479)]
+* core (enterprise): Avoid seal rewrapping in some specific unnecessary cases.
+* core (enterprise): Improve seal unwrap performance when in degraded mode with one or more unhealthy seals. [[GH-25171](https://github.com/hashicorp/vault/pull/25171)]
+* core (enterprise): Speed up unseal when using namespaces
+* core (enterprise): persist seal rewrap status, so rewrap status API is consistent on secondary nodes.
+* core/activity: Include secret_syncs in activity log responses [[GH-24710](https://github.com/hashicorp/vault/pull/24710)]
+* core/cli: Warning related to VAULT_ADDR & -address not set with CLI requests. [[GH-17076](https://github.com/hashicorp/vault/pull/17076)]
+* core/metrics: add metrics for secret sync client count [[GH-25713](https://github.com/hashicorp/vault/pull/25713)]
+* core: Added new `plugin_tmpdir` config option for containerized plugins, in addition to the existing `VAULT_PLUGIN_TMPDIR` environment variable. [[GH-24978](https://github.com/hashicorp/vault/pull/24978)]
+* core: make the best effort timeout for encryption count tracking persistence configurable via an environment variable. [[GH-25636](https://github.com/hashicorp/vault/pull/25636)]
+* core: update sys/seal-status (and CLI vault status) to report the type of
+the seal when unsealed, as well as the type of the recovery seal if an
+auto-seal. [[GH-23022](https://github.com/hashicorp/vault/pull/23022)]
+* events: Add support for event subscription plugins, including SQS [[GH-24352](https://github.com/hashicorp/vault/pull/24352)]
+* identity/tokens: adds plugin issuer with openid-configuration and keys APIs [[GH-24898](https://github.com/hashicorp/vault/pull/24898)]
+* limits: Add a listener configuration option `disable_request_limiter` to allow
+disabling the request limiter per-listener. [[GH-25098](https://github.com/hashicorp/vault/pull/25098)]
+* limits: Introduce a reloadable opt-in configuration for the Request Limiter. [[GH-25095](https://github.com/hashicorp/vault/pull/25095)]
+* oidc/provider: Adds `code_challenge_methods_supported` to OpenID Connect Metadata [[GH-24979](https://github.com/hashicorp/vault/pull/24979)]
+* plugins: Add new pin version APIs to enforce all plugins of a specific type and name to run the same version. [[GH-25105](https://github.com/hashicorp/vault/pull/25105)]
+* plugins: Containerized plugins can be run fully rootless with the runsc runtime. [[GH-24236](https://github.com/hashicorp/vault/pull/24236)]
+* plugins: New API `sys/plugins/reload/:type/:name` available in the root namespace for reloading a specific plugin across all namespaces. [[GH-24878](https://github.com/hashicorp/vault/pull/24878)]
+* proxy: Added new namespace top level configuration parameter, and prepend_configured_namespace API Proxy configuration parameter, which can be used to make requests made to Proxy get proxied to that namespace. [[GH-24667](https://github.com/hashicorp/vault/pull/24667)]
+* raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20221104090112-13395acd02c5
+* replication (enterprise): Add last_upstream_remote_wal metric to telemetry and stop emitting last_remote_wal on standby nodes
+* replication (enterprise): Add re-index status metric to telemetry
+* replication: Add re-index status metric to telemetry [[GH-23160](https://github.com/hashicorp/vault/pull/23160)]
+* sdk/plugin: Fix an issue where external plugins were not reporting logs below INFO level [[GH-23771](https://github.com/hashicorp/vault/pull/23771)]
+* sdk: Add identity token helpers to consistently apply new plugin WIF fields across integrations. [[GH-24925](https://github.com/hashicorp/vault/pull/24925)]
+* sdk: adds new method to system view to allow plugins to request identity tokens [[GH-24929](https://github.com/hashicorp/vault/pull/24929)]
+* secrets-sync (enterprise): Add ability to turn the sync system on and off
+* secrets-sync (enterprise): Add reconciliation loop
+* secrets-sync (enterprise): Added PATCH request on the sync destinations API
+* secrets-sync (enterprise): Added delete request to reset global config to factory defaults
+* secrets-sync (enterprise): Added field to define custom tags to add on synced secrets
+* secrets-sync (enterprise): Added global config path to the administrative namespace.
+* secrets-sync (enterprise): Added telemetry on number of destinations and associations per type.
+* secrets-sync (enterprise): Adds ability to set target GCP project ID to sync secrets with
+* secrets-sync (enterprise): Adjusted associations list responses to be more CLI-friendly
+* secrets-sync (enterprise): Adjusted destination list responses to be more CLI-friendly & added endpoint to list destinations by type.
+* secrets-sync (enterprise): Clean up membdb tests
+* secrets-sync (enterprise): Support AWS IAM assume role and external ID
+* secrets-sync (enterprise): Support custom GitHub apps
+* secrets-sync (enterprise): Support custom templating of external secret names
+* secrets-sync (enterprise): Support granular secrets syncing
+* secrets-sync (enterprise): add purge field to the destination delete endpoint
+* secrets/database: Add new reload/:plugin_name API to reload database plugins by name for a specific mount. [[GH-24472](https://github.com/hashicorp/vault/pull/24472)]
+* secrets/database: Support reloading named database plugins using the sys/plugins/reload/backend API endpoint. [[GH-24512](https://github.com/hashicorp/vault/pull/24512)]
+* secrets/pki: do not check TLS validity on ACME requests redirected to https [[GH-22521](https://github.com/hashicorp/vault/pull/22521)]
+* storage/etcd: etcd should only return keys when calling List() [[GH-23872](https://github.com/hashicorp/vault/pull/23872)]
+* storage/raft (enterprise): Replication WAL batches may now contain up to 4096
+entries rather than being limited to 62 like Consul is. Performance testing
+shows improvements in throughput and latency under some write-heavy workloads.
+* storage/raft: Add support for larger transactions when using raft storage. [[GH-24991](https://github.com/hashicorp/vault/pull/24991)]
+* storage/raft: Upgrade to bbolt 1.3.8, along with an extra patch to reduce time scanning large freelist maps. [[GH-24010](https://github.com/hashicorp/vault/pull/24010)]
+* sys (enterprise): Enable sys/config/group-application-policy in privileged namespace
+* sys (enterprise): Adds the chroot_namespace field to this sys/internal/ui/resultant-acl endpoint, which exposes the value of the chroot namespace from the
+listener config.
+* sys: adds configuration of the key used to sign plugin identity tokens during mount enable and tune [[GH-24962](https://github.com/hashicorp/vault/pull/24962)]
+* ui: Add `deletion_allowed` param to transformations and include `tokenization` as a type option [[GH-25436](https://github.com/hashicorp/vault/pull/25436)]
+* ui: Add warning message to the namespace picker warning users about the behavior when logging in with a root token. [[GH-23277](https://github.com/hashicorp/vault/pull/23277)]
+* ui: Adds a warning when whitespace is detected in a key of a KV secret [[GH-23702](https://github.com/hashicorp/vault/pull/23702)]
+* ui: Adds allowed_response_headers, plugin_version and user_lockout_config params to auth method configuration [[GH-25646](https://github.com/hashicorp/vault/pull/25646)]
+* ui: Adds toggle to KV secrets engine value download modal to optionally stringify value in downloaded file [[GH-23747](https://github.com/hashicorp/vault/pull/23747)]
+* ui: Allow users in userpass auth mount to update their own password [[GH-23797](https://github.com/hashicorp/vault/pull/23797)]
+* ui: Implement Helios Design System Breadcrumbs [[GH-24387](https://github.com/hashicorp/vault/pull/24387)]
+* ui: Implement Helios Design System copy button component making copy buttons accessible [[GH-22333](https://github.com/hashicorp/vault/pull/22333)]
+* ui: Implement Helios Design System footer component [[GH-24191](https://github.com/hashicorp/vault/pull/24191)]
+* ui: Implement Helios Design System pagination component [[GH-23169](https://github.com/hashicorp/vault/pull/23169)]
+* ui: Increase base font-size from 14px to 16px and update use of rem vs pixels for size variables [[GH-23994](https://github.com/hashicorp/vault/pull/23994)]
+* ui: Makes modals accessible by implementing Helios Design System modal component [[GH-23382](https://github.com/hashicorp/vault/pull/23382)]
+* ui: Replace inline confirm alert inside a popup-menu dropdown with confirm alert modal [[GH-21520](https://github.com/hashicorp/vault/pull/21520)]
+* ui: Separates out client counts dashboard to overview and entity/non-entity tabs [[GH-24752](https://github.com/hashicorp/vault/pull/24752)]
+* ui: Sort list view of entities and aliases alphabetically using the item name [[GH-24103](https://github.com/hashicorp/vault/pull/24103)]
+* ui: Surface warning banner if UI has stopped auto-refreshing token [[GH-23143](https://github.com/hashicorp/vault/pull/23143)]
+* ui: Update AlertInline component to use Helios Design System Alert component [[GH-24299](https://github.com/hashicorp/vault/pull/24299)]
+* ui: Update flat, shell-quote and swagger-ui-dist packages. Remove swagger-ui styling overrides. [[GH-23700](https://github.com/hashicorp/vault/pull/23700)]
+* ui: Update mount backend form to use selectable cards [[GH-14998](https://github.com/hashicorp/vault/pull/14998)]
+* ui: Update sidebar Secrets engine to title case. [[GH-23964](https://github.com/hashicorp/vault/pull/23964)]
+* ui: Use Hds::Dropdown component to replace list view popup menus [[GH-25321](https://github.com/hashicorp/vault/pull/25321)]
+* ui: add error message when copy action fails [[GH-25479](https://github.com/hashicorp/vault/pull/25479)]
+* ui: add granularity param to sync destinations [[GH-25500](https://github.com/hashicorp/vault/pull/25500)]
+* ui: capabilities-self is always called in the user's root namespace [[GH-24168](https://github.com/hashicorp/vault/pull/24168)]
+* ui: improve accessibility - color contrast, labels, and automatic testing [[GH-24476](https://github.com/hashicorp/vault/pull/24476)]
+* ui: latest version of chrome does not automatically redirect back to the app after authentication unless triggered by the user, hence added a link to redirect back to the app. [[GH-18513](https://github.com/hashicorp/vault/pull/18513)]
+* ui: obscure JSON values when KV v2 secret has nested objects [[GH-24530](https://github.com/hashicorp/vault/pull/24530)]
+* ui: redirect back to current route after reauthentication when token expires [[GH-25335](https://github.com/hashicorp/vault/pull/25335)]
+* ui: remove leading slash from KV version 2 secret paths [[GH-25874](https://github.com/hashicorp/vault/pull/25874)]
+* ui: remove unnecessary OpenAPI calls for unmanaged auth methods [[GH-25364](https://github.com/hashicorp/vault/pull/25364)]
+* ui: replace popup menu on list items (namespaces, auth items, KMIP, K8S, LDAP) [[GH-25588](https://github.com/hashicorp/vault/pull/25588)]
+* ui: show banner when resultant-acl check fails due to permissions or wrong namespace. [[GH-23503](https://github.com/hashicorp/vault/pull/23503)]
+* website/docs: Update references to Key Value secrets engine from 'K/V' to 'KV' [[GH-24529](https://github.com/hashicorp/vault/pull/24529)]
+* website/docs: fix inaccuracies with unauthenticated_in_flight_requests_access parameter [[GH-23287](https://github.com/hashicorp/vault/pull/23287)]
+
+BUG FIXES:
+
+* Seal HA (enterprise/beta): Fix rejection of a seal configuration change
+from two to one auto seal due to persistence of the previous seal type being
+"multiseal". [[GH-23573](https://github.com/hashicorp/vault/pull/23573)]
+* activity log (enterprise): De-duplicate client count estimates for license utilization reporting.
+* agent/logging: Agent should now honor correct -log-format and -log-file settings in logs generated by the consul-template library. [[GH-24252](https://github.com/hashicorp/vault/pull/24252)]
+* agent: Fix issue where Vault Agent was unable to render KVv2 secrets with delete_version_after set. [[GH-25387](https://github.com/hashicorp/vault/pull/25387)]
+* agent: Fixed incorrect parsing of boolean environment variables for configuration. [[GH-24790](https://github.com/hashicorp/vault/pull/24790)]
+* api/seal-status: Fix deadlock on calls to sys/seal-status with a namespace configured
+on the request. [[GH-23861](https://github.com/hashicorp/vault/pull/23861)]
+* api: Fix deadlock on calls to sys/leader with a namespace configured
+on the request. [[GH-24256](https://github.com/hashicorp/vault/pull/24256)]
+* api: sys/leader ActiveTime field no longer gets reset when we do an internal state change that doesn't change our active status. [[GH-24549](https://github.com/hashicorp/vault/pull/24549)]
+* audit/socket: Provide socket based audit backends with 'prefix' configuration option when supplied. [[GH-25004](https://github.com/hashicorp/vault/pull/25004)]
+* audit: Fix bug reopening 'file' audit devices on SIGHUP. [[GH-23598](https://github.com/hashicorp/vault/pull/23598)]
+* audit: Fix bug where use of 'log_raw' option could result in other devices logging raw audit data [[GH-24968](https://github.com/hashicorp/vault/pull/24968)]
+* audit: Handle a potential panic while formatting audit entries for an audit log [[GH-25605](https://github.com/hashicorp/vault/pull/25605)]
+* audit: Operator changes to configured audit headers (via `/sys/config/auditing`)
+will now force invalidation and be reloaded from storage when data is replicated
+to other nodes.
+* audit: Resolve potential race condition when auditing entries which use SSCT. [[GH-25443](https://github.com/hashicorp/vault/pull/25443)]
+* auth/aws: Fixes a panic that can occur in IAM-based login when a [client config](https://developer.hashicorp.com/vault/api-docs/auth/aws#configure-client) does not exist. [[GH-23555](https://github.com/hashicorp/vault/pull/23555)]
+* auth/cert: Address an issue in which OCSP query responses were not cached [[GH-25986](https://github.com/hashicorp/vault/pull/25986)]
+* auth/cert: Allow cert auth login attempts if ocsp_fail_open is true and OCSP servers are unreachable [[GH-25982](https://github.com/hashicorp/vault/pull/25982)]
+* auth/cert: Handle errors related to expired OCSP server responses [[GH-24193](https://github.com/hashicorp/vault/pull/24193)]
+* auth/saml (enterprise): Fixes support for Microsoft Entra ID enterprise applications
+* cap/ldap: Downgrade go-ldap client from v3.4.5 to v3.4.4 due to race condition found [[GH-23103](https://github.com/hashicorp/vault/pull/23103)]
+* cassandra: Update Cassandra to set consistency prior to calling CreateSession, ensuring consistency setting is correct when opening connection. [[GH-24649](https://github.com/hashicorp/vault/pull/24649)]
+* cli/kv: Undelete now properly handles KV-V2 mount paths that are more than one layer deep. [[GH-19811](https://github.com/hashicorp/vault/pull/19811)]
+* cli: fixes plugin register CLI failure to error when plugin image doesn't exist [[GH-24990](https://github.com/hashicorp/vault/pull/24990)]
+* command/server: Fix bug with sigusr2 where pprof files were not closed correctly [[GH-23636](https://github.com/hashicorp/vault/pull/23636)]
+* core (Enterprise): Treat multiple disabled HA seals as a migration to Shamir.
+* core (enterprise): Do not return an internal error when token policy type lookup fails, log it instead and continue.
+* core (enterprise): Fix a deadlock that can occur on performance secondary clusters when there are many mounts and a mount is deleted or filtered [[GH-25448](https://github.com/hashicorp/vault/pull/25448)]
+* core (enterprise): Fix a panic that can occur if only one seal exists but is unhealthy on the non-first restart of Vault.
+* core (enterprise): fix a potential deadlock if an error is received twice from underlying storage for the same key
+* core (enterprise): fix issue where the Seal HA rewrap system may remain running when an active node steps down.
+* core/activity: Fixes segments fragment loss due to exceeding entry record size limit [[GH-23781](https://github.com/hashicorp/vault/pull/23781)]
+* core/audit: Audit logging a Vault response will now use a 5 second context timeout, separate from the original request. [[GH-24238](https://github.com/hashicorp/vault/pull/24238)]
+* core/config: Use correct HCL config value when configuring `log_requests_level`. [[GH-24056](https://github.com/hashicorp/vault/pull/24056)]
+* core/ha: fix panic that can occur when an HA cluster contains an active node with version >=1.12.0 and another node with version <1.10 [[GH-24441](https://github.com/hashicorp/vault/pull/24441)]
+* core/login: Fixed a potential deadlock when a login fails and user lockout is enabled. [[GH-25697](https://github.com/hashicorp/vault/pull/25697)]
+* core/mounts: Fix reading an "auth" mount using "sys/internal/ui/mounts/" when filter paths are enforced returns 500 error code from the secondary [[GH-23802](https://github.com/hashicorp/vault/pull/23802)]
+* core/quotas: Close rate-limit blocked client purge goroutines when sealing [[GH-24108](https://github.com/hashicorp/vault/pull/24108)]
+* core/quotas: Deleting a namespace that contains a rate limit quota no longer breaks replication [[GH-25439](https://github.com/hashicorp/vault/pull/25439)]
+* core: Fix a timeout initializing Vault by only using a short timeout persisting barrier keyring encryption counts. [[GH-24336](https://github.com/hashicorp/vault/pull/24336)]
+* core: Fix an error that resulted in the wrong seal type being returned by sys/seal-status while
+Vault is in seal migration mode. [[GH-24165](https://github.com/hashicorp/vault/pull/24165)]
+* core: Skip unnecessary deriving of policies during Login MFA Check. [[GH-23894](https://github.com/hashicorp/vault/pull/23894)]
+* core: fix bug where deadlock detection was always on for expiration and quotas.
+These can now be configured individually with `detect_deadlocks`. [[GH-23902](https://github.com/hashicorp/vault/pull/23902)]
+* core: fix policies with wildcards not matching list operations due to the policy path not having a trailing slash [[GH-23874](https://github.com/hashicorp/vault/pull/23874)]
+* core: fix rare panic due to a race condition with metrics collection during seal [[GH-23906](https://github.com/hashicorp/vault/pull/23906)]
+* core: upgrade github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 to
+support azure workload identities. [[GH-24954](https://github.com/hashicorp/vault/pull/24954)]
+* eventlogger: Update library to v0.2.7 to address race condition [[GH-24305](https://github.com/hashicorp/vault/pull/24305)]
+* events: Ignore sending context to give more time for events to send [[GH-23500](https://github.com/hashicorp/vault/pull/23500)]
+* expiration: Fix fatal error "concurrent map iteration and map write" when collecting metrics from leases. [[GH-24027](https://github.com/hashicorp/vault/pull/24027)]
+* expiration: Prevent large lease loads from delaying state changes, e.g. becoming active or standby. [[GH-23282](https://github.com/hashicorp/vault/pull/23282)]
+* fairshare: fix a race condition in JobManager.GetWorkerCounts [[GH-24616](https://github.com/hashicorp/vault/pull/24616)]
+* helper/pkcs7: Fix slice out-of-bounds panic [[GH-24891](https://github.com/hashicorp/vault/pull/24891)]
+* http: Include PATCH in the list of allowed CORS methods [[GH-24373](https://github.com/hashicorp/vault/pull/24373)]
+* kmip (enterprise): Improve handling of failures due to storage replication issues.
+* kmip (enterprise): Only return a Server Correlation Value to clients using KMIP version 1.4.
+* kmip (enterprise): Return a structure in the response for query function Query Server Information.
+* ldaputil: Disable tests for ARM64 [[GH-23118](https://github.com/hashicorp/vault/pull/23118)]
+* mongo-db: allow non-admin database for root credential rotation [[GH-23240](https://github.com/hashicorp/vault/pull/23240)]
+* openapi: Fixing response fields for rekey operations [[GH-25509](https://github.com/hashicorp/vault/pull/25509)]
+* plugins: Fix panic when querying plugin runtimes from a performance secondary follower node.
+* proxy: Fixed incorrect parsing of boolean environment variables for configuration. [[GH-24790](https://github.com/hashicorp/vault/pull/24790)]
+* replication (enterprise): Fix a bug where undo logs would only get enabled on the initial node in a cluster.
+* replication (enterprise): Fix a missing unlock when changing replication state
+* replication (enterprise): disallow configuring paths filter for a mount path that does not exist
+* replication (enterprise): fixed data integrity issue with the processing of identity aliases causing duplicates to occur in rare cases
+* sdk: Return error when failure occurs setting up node 0 in NewDockerCluster, instead of ignoring it. [[GH-24136](https://github.com/hashicorp/vault/pull/24136)]
+* secrets-sync (enterprise): Allow unsyncing secrets from an unmounted secrets engine
+* secrets-sync (enterprise): Fix panic when setting usage_gauge_period to none
+* secrets-sync (enterprise): Fixed an issue with syncing to target projects in GCP
+* secrets-sync (enterprise): Fixed issue where we could sync a deleted secret
+* secrets-sync (enterprise): Unsync secret when metadata is deleted
+* secrets/aws: fix requeueing of rotation entry in cases where rotation fails [[GH-23673](https://github.com/hashicorp/vault/pull/23673)]
+* secrets/aws: update credential rotation deadline when static role rotation period is updated [[GH-23528](https://github.com/hashicorp/vault/pull/23528)]
+* secrets/consul: Fix revocations when Vault has an access token using specific namespace and admin partition policies [[GH-23010](https://github.com/hashicorp/vault/pull/23010)]
+* secrets/pki: Do not set nextUpdate field in OCSP responses when ocsp_expiry is 0 [[GH-24192](https://github.com/hashicorp/vault/pull/24192)]
+* secrets/pki: Stop processing in-flight ACME verifications when an active node steps down [[GH-23278](https://github.com/hashicorp/vault/pull/23278)]
+* secrets/transit (enterprise): Address an issue using sign/verify operations with managed keys returning an error about it not containing a private key
+* secrets/transit (enterprise): Address panic when using GCP,AWS,Azure managed keys for encryption operations. At this time all encryption operations for the cloud providers have been disabled, only signing operations are supported.
+* secrets/transit (enterprise): Apply hashing arguments and defaults to managed key sign/verify operations
+* secrets/transit: Do not allow auto rotation on managed_key key types [[GH-23723](https://github.com/hashicorp/vault/pull/23723)]
+* secrets/transit: Fix a panic when attempting to export a public RSA key [[GH-24054](https://github.com/hashicorp/vault/pull/24054)]
+* secrets/transit: When provided an invalid input with hash_algorithm=none, a lock was not released properly before reporting an error leading to deadlocks on a subsequent key configuration update. [[GH-25336](https://github.com/hashicorp/vault/pull/25336)]
+* storage/consul: fix a bug where an active node in a specific sort of network
+partition could continue to write data to Consul after a new leader is elected
+potentially causing data loss or corruption for keys with many concurrent
+writers. For Enterprise clusters this could cause corruption of the merkle trees
+leading to failure to complete merkle sync without a full re-index. [[GH-23013](https://github.com/hashicorp/vault/pull/23013)]
+* storage/file: Fixing spuriously deleting storage keys ending with .temp [[GH-25395](https://github.com/hashicorp/vault/pull/25395)]
+* storage/raft: Fix a race whereby a new leader may present inconsistent node data to Autopilot. [[GH-24246](https://github.com/hashicorp/vault/pull/24246)]
+* transform (enterprise): guard against a panic looking up a token in exportable mode with barrier storage.
+* ui: Allows users to dismiss the resultant-acl banner. [[GH-25106](https://github.com/hashicorp/vault/pull/25106)]
+* ui: Allows users to search within KV v2 directories from the Dashboard's quick action card. [[GH-25001](https://github.com/hashicorp/vault/pull/25001)]
+* ui: Assumes version 1 for kv engines when options are null because no version is specified [[GH-23585](https://github.com/hashicorp/vault/pull/23585)]
+* ui: Correctly handle directory redirects from pre 1.15.0 Kv v2 list view urls. [[GH-24281](https://github.com/hashicorp/vault/pull/24281)]
+* ui: Correctly handle redirects from pre 1.15.0 Kv v2 edit, create, and show urls. [[GH-24339](https://github.com/hashicorp/vault/pull/24339)]
+* ui: Decode the connection url for display on the connection details page [[GH-23695](https://github.com/hashicorp/vault/pull/23695)]
+* ui: Do not disable JSON display toggle for KV version 2 secrets [[GH-25235](https://github.com/hashicorp/vault/pull/25235)]
+* ui: Do not show resultant-acl banner on namespaces a user has access to [[GH-25256](https://github.com/hashicorp/vault/pull/25256)]
+* ui: Fix AWS secret engine to allow empty policy_document field. [[GH-23470](https://github.com/hashicorp/vault/pull/23470)]
+* ui: Fix JSON editor in KV V2 unable to handle pasted values [[GH-24224](https://github.com/hashicorp/vault/pull/24224)]
+* ui: Fix PKI ca_chain display so value can be copied to clipboard [[GH-25399](https://github.com/hashicorp/vault/pull/25399)]
+* ui: Fix bug where a change on OpenAPI added a double forward slash on some LIST endpoints. [[GH-23446](https://github.com/hashicorp/vault/pull/23446)]
+* ui: Fix copy button not working on masked input when value is not a string [[GH-25269](https://github.com/hashicorp/vault/pull/25269)]
+* ui: Fix error when tuning token auth configuration within namespace [[GH-24147](https://github.com/hashicorp/vault/pull/24147)]
+* ui: Fix inconsistent empty state action link styles [[GH-25209](https://github.com/hashicorp/vault/pull/25209)]
+* ui: Fix kubernetes auth method roles tab [[GH-25999](https://github.com/hashicorp/vault/pull/25999)]
+* ui: Fix payload sent when disabling replication [[GH-24292](https://github.com/hashicorp/vault/pull/24292)]
+* ui: Fix regression that broke the oktaNumberChallenge on the ui. [[GH-23565](https://github.com/hashicorp/vault/pull/23565)]
+* ui: Fix the copy token button in the sidebar navigation window when in a collapsed state. [[GH-23331](https://github.com/hashicorp/vault/pull/23331)]
+* ui: Fixed minor bugs with database secrets engine [[GH-24947](https://github.com/hashicorp/vault/pull/24947)]
+* ui: Fixes input for jwks_ca_pem when configuring a JWT auth method [[GH-24697](https://github.com/hashicorp/vault/pull/24697)]
+* ui: Fixes issue where you could not share the list view URL from the KV v2 secrets engine. [[GH-23620](https://github.com/hashicorp/vault/pull/23620)]
+* ui: Fixes issue with no active tab when viewing transit encryption key [[GH-25614](https://github.com/hashicorp/vault/pull/25614)]
+* ui: Fixes issue with sidebar navigation links disappearing when navigating to policies when a user is not authorized [[GH-23516](https://github.com/hashicorp/vault/pull/23516)]
+* ui: Fixes issues displaying accurate TLS state in dashboard configuration details [[GH-23726](https://github.com/hashicorp/vault/pull/23726)]
+* ui: Fixes policy input toolbar scrolling by default [[GH-23297](https://github.com/hashicorp/vault/pull/23297)]
+* ui: The UI can now be used to create or update database roles by operator without permission on the database connection. [[GH-24660](https://github.com/hashicorp/vault/pull/24660)]
+* ui: Update the KV secret data when you change the version you're viewing of a nested secret. [[GH-25152](https://github.com/hashicorp/vault/pull/25152)]
+* ui: Updates OIDC/JWT login error handling to surface all role related errors [[GH-23908](https://github.com/hashicorp/vault/pull/23908)]
+* ui: Upgrade HDS version to fix sidebar navigation issues when it collapses in smaller viewports. [[GH-23580](https://github.com/hashicorp/vault/pull/23580)]
+* ui: When Kv v2 secret is an object, fix so details view defaults to readOnly JSON editor. [[GH-24290](https://github.com/hashicorp/vault/pull/24290)]
+* ui: call resultant-acl without namespace header when user mounted at root namespace [[GH-25766](https://github.com/hashicorp/vault/pull/25766)]
+* ui: fix KV v2 details view defaulting to JSON view when secret value includes `{` [[GH-24513](https://github.com/hashicorp/vault/pull/24513)]
+* ui: fix broken GUI when accessing from listener with chroot_namespace defined [[GH-23942](https://github.com/hashicorp/vault/pull/23942)]
+* ui: fix incorrectly calculated capabilities on PKI issuer endpoints [[GH-24686](https://github.com/hashicorp/vault/pull/24686)]
+* ui: fix issue where kv v2 capabilities checks were not passing in the full secret path if secret was inside a directory. [[GH-24404](https://github.com/hashicorp/vault/pull/24404)]
+* ui: fix navigation items shown to user when chroot_namespace configured [[GH-24492](https://github.com/hashicorp/vault/pull/24492)]
+* ui: remove user_lockout_config settings for unsupported methods [[GH-25867](https://github.com/hashicorp/vault/pull/25867)]
+* ui: show error from API when seal fails [[GH-23921](https://github.com/hashicorp/vault/pull/23921)]
diff --git a/CODEOWNERS b/CODEOWNERS
deleted file mode 100644
index 2332eea289c..00000000000
--- a/CODEOWNERS
+++ /dev/null
@@ -1,87 +0,0 @@
-# Each line is a file pattern followed by one or more owners. Being an owner
-# means those groups or individuals will be added as reviewers to PRs affecting
-# those areas of the code.
-#
-# More on CODEOWNERS files: https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
-
-# Select Auth engines are owned by Ecosystem
-/builtin/credential/aws/      @hashicorp/vault-ecosystem-applications
-/builtin/credential/github/   @hashicorp/vault-ecosystem-applications
-/builtin/credential/ldap/     @hashicorp/vault-ecosystem-applications
-/builtin/credential/okta/     @hashicorp/vault-ecosystem-applications
-
-# Secrets engines (pki, ssh, totp and transit omitted)
-/builtin/logical/aws/         @hashicorp/vault-ecosystem-applications
-/builtin/logical/cassandra/   @hashicorp/vault-ecosystem-applications
-/builtin/logical/consul/      @hashicorp/vault-ecosystem-applications
-/builtin/logical/database/    @hashicorp/vault-ecosystem-applications
-/builtin/logical/mongodb/     @hashicorp/vault-ecosystem-applications
-/builtin/logical/mssql/       @hashicorp/vault-ecosystem-applications
-/builtin/logical/mysql/       @hashicorp/vault-ecosystem-applications
-/builtin/logical/nomad/       @hashicorp/vault-ecosystem-applications
-/builtin/logical/postgresql/  @hashicorp/vault-ecosystem-applications
-/builtin/logical/rabbitmq/    @hashicorp/vault-ecosystem-applications
-
-# Identity Integrations (OIDC, tokens)
-/vault/identity_store_oidc*   @hashicorp/vault-ecosystem-applications
-
-/plugins/                     @hashicorp/vault-ecosystem
-/vault/plugin_catalog.go      @hashicorp/vault-ecosystem
-
-/website/content/ @hashicorp/vault-education-approvers
-/website/content/docs/plugin-portal.mdx   @acahn @hashicorp/vault-education-approvers
-
-# Plugin docs
-/website/content/docs/plugins/              @hashicorp/vault-ecosystem @hashicorp/vault-education-approvers
-/website/content/docs/upgrading/plugins.mdx @hashicorp/vault-ecosystem @hashicorp/vault-education-approvers
-
-# UI code related to Vault's JWT/OIDC auth method and OIDC provider.
-# Changes to these files often require coordination with backend code,
-# so stewards of the backend code are added below for notification.
-/ui/app/components/auth-jwt.js         @hashicorp/vault-ecosystem-applications
-/ui/app/routes/vault/cluster/oidc-*.js @hashicorp/vault-ecosystem-applications
-
-# Release config; service account is required for automation tooling.
-/.release/                     @hashicorp/github-secure-vault-core @hashicorp/quality-team
-/.github/workflows/build.yml   @hashicorp/github-secure-vault-core @hashicorp/quality-team
-
-# Quality engineering
-/.github/  @hashicorp/quality-team
-/enos/     @hashicorp/quality-team
-
-# Cryptosec
-/builtin/logical/pki/                                @hashicorp/vault-crypto
-/builtin/logical/pkiext/                             @hashicorp/vault-crypto
-/website/content/docs/secrets/pki/                   @hashicorp/vault-crypto
-/website/content/api-docs/secret/pki.mdx             @hashicorp/vault-crypto
-/builtin/credential/cert/                            @hashicorp/vault-crypto
-/website/content/docs/auth/cert.mdx                  @hashicorp/vault-crypto
-/website/content/api-docs/auth/cert.mdx              @hashicorp/vault-crypto
-/builtin/logical/ssh/                                @hashicorp/vault-crypto
-/website/content/docs/secrets/ssh/                   @hashicorp/vault-crypto
-/website/content/api-docs/secret/ssh.mdx             @hashicorp/vault-crypto
-/builtin/logical/transit/                            @hashicorp/vault-crypto
-/website/content/docs/secrets/transit/               @hashicorp/vault-crypto
-/website/content/api-docs/secret/transit.mdx         @hashicorp/vault-crypto
-/helper/random/                                      @hashicorp/vault-crypto
-/sdk/helper/certutil/                                @hashicorp/vault-crypto
-/sdk/helper/cryptoutil/                              @hashicorp/vault-crypto
-/sdk/helper/kdf/                                     @hashicorp/vault-crypto
-/sdk/helper/keysutil/                                @hashicorp/vault-crypto
-/sdk/helper/ocsp/                                    @hashicorp/vault-crypto
-/sdk/helper/salt/                                    @hashicorp/vault-crypto
-/sdk/helper/tlsutil/                                 @hashicorp/vault-crypto
-/shamir/                                             @hashicorp/vault-crypto
-/vault/barrier*                                      @hashicorp/vault-crypto
-/vault/managed_key*                                  @hashicorp/vault-crypto
-/vault/seal*                                         @hashicorp/vault-crypto
-/vault/seal/                                         @hashicorp/vault-crypto
-/website/content/docs/configuration/seal/            @hashicorp/vault-crypto
-/website/content/docs/enterprise/sealwrap.mdx        @hashicorp/vault-crypto
-/website/content/api-docs/system/sealwrap-rewrap.mdx @hashicorp/vault-crypto
-/website/content/docs/secrets/transform/             @hashicorp/vault-crypto
-/website/content/api-docs/secret/transform.mdx       @hashicorp/vault-crypto
-/website/content/docs/secrets/kmip-profiles.mdx      @hashicorp/vault-crypto
-/website/content/docs/secrets/kmip.mdx               @hashicorp/vault-crypto
-/website/content/api-docs/secret/kmip.mdx            @hashicorp/vault-crypto
-/website/content/docs/enterprise/fips/               @hashicorp/vault-crypto
diff --git a/Dockerfile b/Dockerfile
index 3799f778dd2..fcdfe334f98 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 ## DOCKERHUB DOCKERFILE ##
-FROM alpine:3.18 as default
+FROM alpine:3 AS default
 
 ARG BIN_NAME
 # NAME and PRODUCT_VERSION are the name of the software in releases.hashicorp.com
@@ -12,6 +12,10 @@ ARG PRODUCT_VERSION
 ARG PRODUCT_REVISION
 # TARGETARCH and TARGETOS are set automatically when --platform is provided.
 ARG TARGETOS TARGETARCH
+# LICENSE_SOURCE is the path to IBM license documents, which may be architecture-specific.
+ARG LICENSE_SOURCE
+# LICENSE_DEST is the path where license files are installed in the container
+ARG LICENSE_DEST
 
 # Additional metadata labels used by container registries, platforms
 # and certification scanners.
@@ -24,7 +28,8 @@ LABEL name="Vault" \
       summary="Vault is a tool for securely accessing secrets." \
       description="Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log."
 
-COPY LICENSE /licenses/mozilla.txt
+# Copy the license file as per Legal requirement
+COPY ${LICENSE_SOURCE} ${LICENSE_DEST}
 
 # Set ARGs as ENV so that they can be used in ENTRYPOINT/CMD
 ENV NAME=$NAME
@@ -74,15 +79,20 @@ CMD ["server", "-dev"]
 
 
 ## UBI DOCKERFILE ##
-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.9 as ubi
+FROM registry.access.redhat.com/ubi8/ubi-minimal AS ubi
 
 ARG BIN_NAME
-# PRODUCT_VERSION is the version built dist/$TARGETOS/$TARGETARCH/$BIN_NAME,
-# which we COPY in later. Example: PRODUCT_VERSION=1.2.3.
+# NAME and PRODUCT_VERSION are the name of the software in releases.hashicorp.com
+# and the version to download. Example: NAME=vault PRODUCT_VERSION=1.2.3.
+ARG NAME=vault
 ARG PRODUCT_VERSION
 ARG PRODUCT_REVISION
 # TARGETARCH and TARGETOS are set automatically when --platform is provided.
 ARG TARGETOS TARGETARCH
+# LICENSE_SOURCE is the path to IBM license documents, which may be architecture-specific.
+ARG LICENSE_SOURCE
+# LICENSE_DEST is the path where license files are installed in the container
+ARG LICENSE_DEST
 
 # Additional metadata labels used by container registries, platforms
 # and certification scanners.
@@ -95,17 +105,22 @@ LABEL name="Vault" \
       summary="Vault is a tool for securely accessing secrets." \
       description="Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log."
 
-COPY LICENSE /licenses/mozilla.txt
-
 # Set ARGs as ENV so that they can be used in ENTRYPOINT/CMD
 ENV NAME=$NAME
 ENV VERSION=$VERSION
 
+# Copy the license file as per Legal requirement
+COPY ${LICENSE_SOURCE} ${LICENSE_DEST}/
+
+# We must have a copy of the license in this directory to comply with the HasLicense Redhat requirement
+# Note the trailing slash on the first argument -- plain files meet the requirement but directories do not.
+COPY ${LICENSE_SOURCE}/ /licenses/
+
 # Set up certificates, our base tools, and Vault. Unlike the other version of
 # this (https://github.com/hashicorp/docker-vault/blob/master/ubi/Dockerfile),
 # we copy in the Vault binary from CRT.
 RUN set -eux; \
-    microdnf install -y ca-certificates gnupg openssl libcap tzdata procps shadow-utils util-linux
+    microdnf install -y ca-certificates gnupg openssl libcap tzdata procps shadow-utils util-linux tar
 
 # Create a non-root user to run the software.
 RUN groupadd --gid 1000 vault && \
@@ -121,7 +136,7 @@ COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /bin/
 # storage backend, if desired; the server will be started with /vault/config as
 # the configuration directory so you can add additional config files in that
 # location.
-ENV HOME /home/vault
+ENV HOME=/home/vault
 RUN mkdir -p /vault/logs && \
     mkdir -p /vault/file && \
     mkdir -p /vault/config && \
@@ -156,3 +171,59 @@ USER vault
 # # By default you'll get a single-node development server that stores everything
 # # in RAM and bootstraps itself. Don't use this configuration for production.
 CMD ["server", "-dev"]
+
+FROM ubi AS ubi-fips
+
+FROM ubi AS ubi-hsm
+
+FROM ubi AS ubi-hsm-fips
+
+## Builder:
+#
+#  A build container used to build the Vault binary. We use focal because the
+#  version of glibc is old enough for all of our supported distros for editions
+#  that require CGO. This container is used in CI to build all binaries that
+#  require CGO.
+#
+#  To run it locally, first build the builder container:
+#    docker build -t builder --build-arg GO_VERSION=$(cat .go-version) .
+#
+#  Then build Vault using the builder container:
+#    docker run -it -v $(pwd):/build -v GITHUB_TOKEN=$GITHUB_TOKEN --env GO_TAGS='ui enterprise cgo hsm venthsm' --env GOARCH=s390x --env GOOS=linux --env VERSION=1.20.0-beta1 --env VERSION_METADATA=ent.hsm --env CGO_ENABLED=1 builder make ci-build
+#
+#  You can also share your local Go modules with the container to avoid downloading
+#  them every time:
+#    docker run -it -v $(pwd):/build -v $(go env GOMODCACHE):/go-mod-cache --env GITHUB_TOKEN=$GITHUB_TOKEN --env GO_TAGS='ui enterprise cgo hsm venthsm' --env GOARCH=s390x --env GOOS=linux --env VERSION=1.20.0-beta1 --env VERSION_METADATA=ent.hsm --env GOMODCACHE=/go-mod-cache --env CGO_ENABLED=1 builder make ci-build
+#
+#  If you have a linux machine you can also share the tools
+#    GOBIN="$(go env GOPATH)/bin" make tools
+#    docker run -it -v $(pwd):/build -v $(go env GOMODCACHE):/go-mod-cache -v "$(go env GOPATH)/bin":/opt/tools/bin --env GITHUB_TOKEN=$GITHUB_TOKEN --env GO_TAGS='ui enterprise cgo hsm venthsm' --env GOARCH=s390x --env GOOS=linux --env VERSION=1.20.0-beta1 --env VERSION_METADATA=ent.hsm --env GOMODCACHE=/go-mod-cache --env CGO_ENABLED=1 builder make ci-build
+FROM ubuntu:focal AS builder
+
+# Pass in the GO_VERSION as a build-arg
+ARG GO_VERSION
+
+# Set our environment
+ENV PATH="/root/go/bin:/opt/go/bin:/opt/tools/bin:$PATH"
+ENV GOPRIVATE='github.com/hashicorp/*'
+
+# Install the necessary system tooling to cross compile vault for our various
+# CGO targets. Do this separately from branch specific Go and build toolchains
+# so our various builder image layers can share cache.
+COPY .build/system.sh .
+RUN chmod +x system.sh && ./system.sh && rm -rf system.sh
+
+# Install the correct Go toolchain
+COPY .build/go.sh .
+RUN chmod +x go.sh && ./go.sh && rm -rf go.sh
+
+# Install the vault tools installer. It might be required during build if the
+# pre-build tools are not mounted into the container.
+COPY tools/tools.sh .
+RUN chmod +x tools.sh
+
+# Run the build
+COPY .build/entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/META.d/_summary.yaml b/META.d/_summary.yaml
index c1da2a666c7..6ce0569ec5b 100644
--- a/META.d/_summary.yaml
+++ b/META.d/_summary.yaml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 ---
diff --git a/Makefile b/Makefile
index 8416a3cd8cb..ecda8de311e 100644
--- a/Makefile
+++ b/Makefile
@@ -22,6 +22,12 @@ ifneq ($(FDB_ENABLED), )
 	BUILD_TAGS+=foundationdb
 endif
 
+# Set BUILD_MINIMAL to a non-empty value to build a minimal version of Vault with only core features.
+BUILD_MINIMAL ?=
+ifneq ($(strip $(BUILD_MINIMAL)),)
+	BUILD_TAGS+=minimal
+endif
+
 default: dev
 
 # bin generates the releasable binaries for Vault
@@ -40,6 +46,12 @@ dev-dynamic: BUILD_TAGS+=testonly
 dev-dynamic: prep
 	@CGO_ENABLED=1 BUILD_TAGS='$(BUILD_TAGS)' VAULT_DEV_BUILD=1 sh -c "'$(CURDIR)/scripts/build.sh'"
 
+# quickdev creates binaries for testing Vault locally like dev, but skips
+# the prep step.
+quickdev: BUILD_TAGS+=testonly
+quickdev:
+	@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' VAULT_DEV_BUILD=1 sh -c "'$(CURDIR)/scripts/build.sh'"
+
 # *-mem variants will enable memory profiling which will write snapshots of heap usage
 # to $TMP/vaultprof every 5 minutes. These can be analyzed using `$ go tool pprof <profile_file>`.
 # Note that any build can have profiling added via: `$ BUILD_TAGS=memprofiler make ...`
@@ -158,7 +170,7 @@ protolint: prep check-tools-external
 # now run as a pre-commit hook (and there's little value in
 # making every build run the formatter), we've removed that
 # dependency.
-prep: check-go-version
+prep: check-go-version clean
 	@echo "==> Running go generate..."
 	@GOARCH= GOOS= $(GO_CMD) generate $(MAIN_PACKAGES)
 	@GOARCH= GOOS= cd api && $(GO_CMD) generate $(API_PACKAGES)
@@ -174,7 +186,7 @@ hooks:
 
 # bootstrap the build by generating any necessary code and downloading additional tools that may
 # be used by devs.
-bootstrap: prep tools
+bootstrap: tools prep
 
 # Note: if you have plugins in GOPATH you can update all of them via something like:
 # for i in $(ls | grep vault-plugin-); do cd $i; git remote update; git reset --hard origin/master; dep ensure -update; git add .; git commit; git push; cd ..; done
@@ -215,8 +227,8 @@ proto: check-tools-external
 	buf generate
 
 	# No additional sed expressions should be added to this list. Going forward
-	# we should just use the variable names choosen by protobuf. These are left
-	# here for backwards compatability, namely for SDK compilation.
+	# we should just use the variable names chosen by protobuf. These are left
+	# here for backwards compatibility, namely for SDK compilation.
 	$(SED) -i -e 's/Id/ID/' -e 's/SPDX-License-IDentifier/SPDX-License-Identifier/' vault/request_forwarding_service.pb.go
 	$(SED) -i -e 's/Idp/IDP/' -e 's/Url/URL/' -e 's/Id/ID/' -e 's/IDentity/Identity/' -e 's/EntityId/EntityID/' -e 's/Api/API/' -e 's/Qr/QR/' -e 's/Totp/TOTP/' -e 's/Mfa/MFA/' -e 's/Pingid/PingID/' -e 's/namespaceId/namespaceID/' -e 's/Ttl/TTL/' -e 's/BoundCidrs/BoundCIDRs/' -e 's/SPDX-License-IDentifier/SPDX-License-Identifier/' helper/identity/types.pb.go helper/identity/mfa/types.pb.go helper/storagepacker/types.pb.go sdk/plugin/pb/backend.pb.go sdk/logical/identity.pb.go vault/activity/activity_log.pb.go
 
@@ -291,6 +303,10 @@ check-tools-external:
 check-tools-internal:
 	@$(CURDIR)/tools/tools.sh check-internal
 
+.PHONY: check-tools-pipeline
+check-tools-pipeline:
+	@$(CURDIR)/tools/tools.sh check-pipeline
+
 check-vault-in-path:
 	@VAULT_BIN=$$(command -v vault) || { echo "vault command not found"; exit 1; }; \
 		[ -x "$$VAULT_BIN" ] || { echo "$$VAULT_BIN not executable"; exit 1; }; \
@@ -308,6 +324,10 @@ tools-external:
 tools-internal:
 	@$(CURDIR)/tools/tools.sh install-internal
 
+.PHONY: tools-pipeline
+tools-pipeline:
+	@$(CURDIR)/tools/tools.sh install-pipeline
+
 mysql-database-plugin:
 	@CGO_ENABLED=0 $(GO_CMD) build -o bin/mysql-database-plugin ./plugins/database/mysql/mysql-database-plugin
 
@@ -362,17 +382,13 @@ ci-get-revision:
 ci-get-version-package:
 	@$(CURDIR)/scripts/ci-helper.sh version-package
 
-.PHONY: ci-install-external-tools
-ci-install-external-tools:
-	@$(CURDIR)/scripts/ci-helper.sh install-external-tools
+.PHONY: ci-prepare-ent-legal
+ci-prepare-ent-legal:
+	@$(CURDIR)/scripts/ci-helper.sh prepare-ent-legal
 
-.PHONY: ci-prepare-legal
-ci-prepare-legal:
-	@$(CURDIR)/scripts/ci-helper.sh prepare-legal
-
-.PHONY: ci-update-external-tool-modules
-ci-update-external-tool-modules:
-	@$(CURDIR)/scripts/ci-helper.sh update-external-tool-modules
+.PHONY: ci-prepare-ce-legal
+ci-prepare-ce-legal:
+	@$(CURDIR)/scripts/ci-helper.sh prepare-ce-legal
 
 .PHONY: ci-copywriteheaders
 ci-copywriteheaders:
@@ -389,3 +405,7 @@ ci-copywriteheaders:
 .PHONY: all-packages
 all-packages:
 	@echo $(ALL_PACKAGES) | tr ' ' '\n'
+
+.PHONY: clean
+clean:
+	@echo "==> Cleaning..."
diff --git a/README.md b/README.md
index 109570940e0..4879ad2f82f 100644
--- a/README.md
+++ b/README.md
@@ -6,12 +6,13 @@
 
 ----
 
--	Website: https://www.vaultproject.io
--	Announcement list: [Google Groups](https://groups.google.com/group/hashicorp-announce)
--	Discussion forum: [Discuss](https://discuss.hashicorp.com/c/vault)
+- Website: [developer.hashicorp.com/vault](https://developer.hashicorp.com/vault)
+- Announcement list: [Google Groups](https://groups.google.com/group/hashicorp-announce)
+- Discussion forum: [Discuss](https://discuss.hashicorp.com/c/vault)
 - Documentation: [https://developer.hashicorp.com/vault/docs](https://developer.hashicorp.com/vault/docs)
 - Tutorials: [https://developer.hashicorp.com/vault/tutorials](https://developer.hashicorp.com/vault/tutorials)
-- Certification Exam: [https://developer.hashicorp.com/certifications/security-automation](https://developer.hashicorp.com/certifications/security-automation)
+- Certification exam: [https://developer.hashicorp.com/certifications/security-automation](https://developer.hashicorp.com/certifications/security-automation)
+- Documentation source: [https://github.com/hashicorp/web-unified-docs](https://github.com/hashicorp/web-unified-docs)
 
 <img width="300" alt="Vault Logo" src="https://github.com/hashicorp/vault/blob/f22d202cde2018f9455dec755118a9b84586e082/Vault_PrimaryLogo_Black.png">
 
@@ -21,8 +22,7 @@ A modern system requires access to a multitude of secrets: database credentials,
 
 The key features of Vault are:
 
-* **Secure Secret Storage**: Arbitrary key/value secrets can be stored
-  in Vault. Vault encrypts these secrets prior to writing them to persistent
+* **Secure Secret Storage**: Vault can store arbitrary key/value pairs. Vault encrypts data before writing it to persistent
   storage, so gaining access to the raw storage isn't enough to access
   your secrets. Vault can write to disk, [Consul](https://www.consul.io),
   and more.
@@ -39,8 +39,8 @@ The key features of Vault are:
   developers to store encrypted data in a location such as a SQL database without
   having to design their own encryption methods.
 
-* **Leasing and Renewal**: All secrets in Vault have a _lease_ associated
-  with them. At the end of the lease, Vault will automatically revoke that
+* **Leasing and Renewal**: Vault associates a **lease** with each secret.
+  At the end of the lease, Vault automatically revokes the
   secret. Clients are able to renew leases via built-in renew APIs.
 
 * **Revocation**: Vault has built-in support for secret revocation. Vault
@@ -73,9 +73,12 @@ If you wish to work on Vault itself or any of its built-in systems, you'll
 first need [Go](https://www.golang.org) installed on your machine.
 
 For local dev first make sure Go is properly installed, including setting up a
-[GOPATH](https://golang.org/doc/code.html#GOPATH). Ensure that `$GOPATH/bin` is in
-your path as some distributions bundle the old version of build tools. Next, clone this
-repository. Vault uses [Go Modules](https://github.com/golang/go/wiki/Modules),
+[GOPATH](https://golang.org/doc/code.html#GOPATH), then setting the 
+[GOBIN](https://pkg.go.dev/cmd/go#hdr-Environment_variables) variable to `$GOPATH/bin`. 
+Ensure that `$GOPATH/bin` is in your path as some distributions bundle the old version 
+of build tools. 
+
+Next, clone this repository. Vault uses [Go Modules](https://github.com/golang/go/wiki/Modules),
 so it is recommended that you clone the repository ***outside*** of the GOPATH.
 You can then download any required build tools by bootstrapping your environment:
 
@@ -121,6 +124,15 @@ $ make test TEST=./vault
 ...
 ```
 
+### Troubleshooting
+
+If you encounter an error like `could not read Username for 'https://github.com'` you may need to adjust your git config like so:
+
+```sh
+$ git config --global --add url."git@github.com:".insteadOf "https://github.com/"
+```
+
+
 ### Importing Vault
 
 This repository publishes two libraries that may be imported by other projects:
diff --git a/api/LICENSE b/api/LICENSE
index f4f97ee5853..a32743a27b0 100644
--- a/api/LICENSE
+++ b/api/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2015 HashiCorp, Inc.
+Copyright IBM Corp. 2016, 2025
 
 Mozilla Public License, version 2.0
 
diff --git a/api/api_test.go b/api/api_test.go
index 8bf69e0de97..91b1109ad6a 100644
--- a/api/api_test.go
+++ b/api/api_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/auth.go b/api/auth.go
index c1ef7a77989..7cd9d757419 100644
--- a/api/auth.go
+++ b/api/auth.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/auth/approle/LICENSE b/api/auth/approle/LICENSE
new file mode 100644
index 00000000000..a32743a27b0
--- /dev/null
+++ b/api/auth/approle/LICENSE
@@ -0,0 +1,365 @@
+Copyright IBM Corp. 2016, 2025
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.
+
diff --git a/api/auth/approle/approle.go b/api/auth/approle/approle.go
index 10d26b610f4..8d765bac9b6 100644
--- a/api/auth/approle/approle.go
+++ b/api/auth/approle/approle.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package approle
diff --git a/api/auth/approle/approle_test.go b/api/auth/approle/approle_test.go
index cdfb4e285e7..b958bd11cd5 100644
--- a/api/auth/approle/approle_test.go
+++ b/api/auth/approle/approle_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package approle
diff --git a/api/auth/approle/go.mod b/api/auth/approle/go.mod
index 0c52b494351..3aa5a18397d 100644
--- a/api/auth/approle/go.mod
+++ b/api/auth/approle/go.mod
@@ -1,5 +1,28 @@
 module github.com/hashicorp/vault/api/auth/approle
 
-go 1.16
+go 1.23.0
 
-require github.com/hashicorp/vault/api v1.12.0
+toolchain go1.23.7
+
+require github.com/hashicorp/vault/api v1.22.0
+
+require (
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+)
diff --git a/api/auth/approle/go.sum b/api/auth/approle/go.sum
index 8645312630e..7f368024a69 100644
--- a/api/auth/approle/go.sum
+++ b/api/auth/approle/go.sum
@@ -1,137 +1,59 @@
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
-github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
-github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
-github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.16.2 h1:K4ev2ib4LdQETX5cSZBG0DVLk1jwGqSPXBjdah3veNs=
-github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnP3V9oNE4hmsM=
-github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/vault/api v1.12.0 h1:meCpJSesvzQyao8FCOgk2fGdoADAnbDu2WPJN1lDLJ4=
-github.com/hashicorp/vault/api v1.12.0/go.mod h1:si+lJCYO7oGkIoNPAN8j3azBLTn9SjMGS+jFaHd1Cck=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6 h1:6Su7aK7lXmJ/U79bYtBjLNaha4Fs1Rg9plHpcH+vvnE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
+github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/api/auth/aws/LICENSE b/api/auth/aws/LICENSE
new file mode 100644
index 00000000000..a32743a27b0
--- /dev/null
+++ b/api/auth/aws/LICENSE
@@ -0,0 +1,365 @@
+Copyright IBM Corp. 2016, 2025
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.
+
diff --git a/api/auth/aws/aws.go b/api/auth/aws/aws.go
index df873828e13..52f88e23c18 100644
--- a/api/auth/aws/aws.go
+++ b/api/auth/aws/aws.go
@@ -1,20 +1,24 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package aws
 
 import (
 	"context"
+	"crypto/sha256"
 	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
 	"fmt"
-	"os"
+	"io"
+	"net/http"
 	"strings"
+	"time"
 
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/ec2metadata"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/api"
 )
@@ -32,7 +36,7 @@ type AWSAuth struct {
 	signatureType          string
 	region                 string
 	iamServerIDHeaderValue string
-	creds                  *credentials.Credentials
+	creds                  aws.CredentialsProvider
 	nonce                  string
 }
 
@@ -95,102 +99,82 @@ func (a *AWSAuth) Login(ctx context.Context, client *api.Client) (*api.Secret, e
 	loginData := make(map[string]interface{})
 	switch a.authType {
 	case ec2Type:
-		sess, err := session.NewSession()
+		cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(a.region))
 		if err != nil {
-			return nil, fmt.Errorf("error creating session to probe EC2 metadata: %w", err)
+			return nil, fmt.Errorf("error loading AWS config: %w", err)
 		}
-		metadataSvc := ec2metadata.New(sess)
-		if !metadataSvc.Available() {
-			return nil, fmt.Errorf("metadata service not available")
+		metadataSvc := imds.NewFromConfig(cfg)
+
+		var path string
+		switch a.signatureType {
+		case pkcs7Type:
+			path = "/instance-identity/pkcs7"
+		case identityType:
+			path = "/instance-identity/document"
+		case rsa2048Type:
+			path = "/instance-identity/rsa2048"
+		default:
+			return nil, fmt.Errorf("unknown signature type: %s", a.signatureType)
 		}
 
-		if a.signatureType == pkcs7Type {
-			// fetch PKCS #7 signature
-			resp, err := metadataSvc.GetDynamicData("/instance-identity/pkcs7")
-			if err != nil {
-				return nil, fmt.Errorf("unable to get PKCS 7 data from metadata service: %w", err)
-			}
-			pkcs7 := strings.TrimSpace(resp)
-			loginData["pkcs7"] = pkcs7
-		} else if a.signatureType == identityType {
-			// fetch signature from identity document
-			doc, err := metadataSvc.GetDynamicData("/instance-identity/document")
-			if err != nil {
-				return nil, fmt.Errorf("error requesting instance identity doc: %w", err)
-			}
-			loginData["identity"] = base64.StdEncoding.EncodeToString([]byte(doc))
-
-			signature, err := metadataSvc.GetDynamicData("/instance-identity/signature")
-			if err != nil {
-				return nil, fmt.Errorf("error requesting signature: %w", err)
-			}
-			loginData["signature"] = signature
-		} else if a.signatureType == rsa2048Type {
-			// fetch RSA 2048 signature, which is also a PKCS#7 signature
-			resp, err := metadataSvc.GetDynamicData("/instance-identity/rsa2048")
-			if err != nil {
-				return nil, fmt.Errorf("unable to get PKCS 7 data from metadata service: %w", err)
-			}
-			pkcs7 := strings.TrimSpace(resp)
-			loginData["pkcs7"] = pkcs7
-		} else {
-			return nil, fmt.Errorf("unknown signature type: %s", a.signatureType)
+		resp, err := metadataSvc.GetDynamicData(ctx, &imds.GetDynamicDataInput{Path: path})
+		if err != nil {
+			return nil, fmt.Errorf("unable to get identity data: %w", err)
+		}
+		defer resp.Content.Close()
+		body, err := io.ReadAll(resp.Content)
+		if err != nil {
+			return nil, fmt.Errorf("error reading identity data: %w", err)
 		}
+		pkcs7 := strings.TrimSpace(string(body))
+		loginData["pkcs7"] = pkcs7
 
-		// Add the reauthentication value, if we have one
 		if a.nonce == "" {
-			uid, err := uuid.GenerateUUID()
+			uuid, err := uuid.GenerateUUID()
 			if err != nil {
-				return nil, fmt.Errorf("error generating uuid for reauthentication value: %w", err)
+				return nil, fmt.Errorf("error generating uuid: %w", err)
 			}
-			a.nonce = uid
+			a.nonce = uuid
 		}
 		loginData["nonce"] = a.nonce
 	case iamType:
-		logger := hclog.Default()
 		if a.creds == nil {
-			credsConfig := awsutil.CredentialsConfig{
-				AccessKey:    os.Getenv("AWS_ACCESS_KEY_ID"),
-				SecretKey:    os.Getenv("AWS_SECRET_ACCESS_KEY"),
-				SessionToken: os.Getenv("AWS_SESSION_TOKEN"),
-				Logger:       logger,
-			}
-
-			// the env vars above will take precedence if they are set, as
-			// they will be added to the ChainProvider stack first
-			var hasCredsFile bool
-			credsFilePath := os.Getenv("AWS_SHARED_CREDENTIALS_FILE")
-			if credsFilePath != "" {
-				hasCredsFile = true
-				credsConfig.Filename = credsFilePath
-			}
-
-			creds, err := credsConfig.GenerateCredentialChain(awsutil.WithSharedCredentials(hasCredsFile))
+			cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(a.region))
 			if err != nil {
-				return nil, err
-			}
-			if creds == nil {
-				return nil, fmt.Errorf("could not compile valid credential providers from static config, environment, shared, or instance metadata")
+				return nil, fmt.Errorf("unable to load AWS config: %w", err)
 			}
+			a.creds = cfg.Credentials
+		}
 
-			_, err = creds.Get()
-			if err != nil {
-				return nil, fmt.Errorf("failed to retrieve credentials from credential chain: %w", err)
-			}
+		credsVal, err := a.creds.Retrieve(ctx)
+		if err != nil {
+			return nil, fmt.Errorf("failed to retrieve credentials: %w", err)
+		}
 
-			a.creds = creds
+		const iamBody = "Action=GetCallerIdentity&Version=2011-06-15"
+		req, err := http.NewRequest("POST", "https://sts.amazonaws.com/", strings.NewReader(iamBody))
+		if err != nil {
+			return nil, fmt.Errorf("failed to construct STS request: %w", err)
 		}
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
-		data, err := awsutil.GenerateLoginData(a.creds, a.iamServerIDHeaderValue, a.region, logger)
+		hash := sha256.Sum256([]byte(iamBody))
+		payloadHash := hex.EncodeToString(hash[:])
+
+		signer := v4.NewSigner()
+		err = signer.SignHTTP(ctx, credsVal, req, payloadHash, "sts", a.region, time.Now().UTC())
 		if err != nil {
-			return nil, fmt.Errorf("unable to generate login data for AWS auth endpoint: %w", err)
+			return nil, fmt.Errorf("failed to sign STS request: %w", err)
 		}
-		loginData = data
+
+		headersData, _ := json.Marshal(req.Header)
+
+		loginData["iam_http_request_method"] = "POST"
+		loginData["iam_request_url"] = base64.StdEncoding.EncodeToString([]byte(req.URL.String()))
+		loginData["iam_request_body"] = base64.StdEncoding.EncodeToString([]byte(iamBody))
+		loginData["iam_request_headers"] = base64.StdEncoding.EncodeToString(headersData)
 	}
 
-	// Add role if we have one. If not, Vault will infer the role name based
-	// on the IAM friendly name (iam auth type) or EC2 instance's
-	// AMI ID (ec2 auth type).
 	if a.roleName != "" {
 		loginData["role"] = a.roleName
 	}
diff --git a/api/auth/aws/go.mod b/api/auth/aws/go.mod
index a4fe80a7bdc..9a051e522b1 100644
--- a/api/auth/aws/go.mod
+++ b/api/auth/aws/go.mod
@@ -1,11 +1,44 @@
 module github.com/hashicorp/vault/api/auth/aws
 
-go 1.16
+go 1.23.0
+
+toolchain go1.23.7
 
 require (
-	github.com/aws/aws-sdk-go v1.49.22
-	github.com/hashicorp/go-hclog v0.16.2
-	github.com/hashicorp/go-secure-stdlib/awsutil v0.1.6
+	github.com/aws/aws-sdk-go-v2 v1.26.1
+	github.com/aws/aws-sdk-go-v2/config v1.26.1
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10
 	github.com/hashicorp/go-uuid v1.0.2
-	github.com/hashicorp/vault/api v1.12.0
+	github.com/hashicorp/vault/api v1.22.0
+)
+
+require (
+	github.com/aws/aws-sdk-go-v2/credentials v1.16.12 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.18.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.26.5 // indirect
+	github.com/aws/smithy-go v1.20.2 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
 )
diff --git a/api/auth/aws/go.sum b/api/auth/aws/go.sum
index 96afd5f25d0..d7a32adf27c 100644
--- a/api/auth/aws/go.sum
+++ b/api/auth/aws/go.sum
@@ -1,167 +1,89 @@
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/aws/aws-sdk-go v1.30.27/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
-github.com/aws/aws-sdk-go v1.49.22 h1:r01+cQJ3cORQI1PJxG8af0jzrZpUOL9L+/3kU2x1geU=
-github.com/aws/aws-sdk-go v1.49.22/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
-github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/aws/aws-sdk-go-v2 v1.26.1 h1:5554eUqIYVWpU0YmeeYZ0wU64H2VLBs8TlhRB2L+EkA=
+github.com/aws/aws-sdk-go-v2 v1.26.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
+github.com/aws/aws-sdk-go-v2/config v1.26.1 h1:z6DqMxclFGL3Zfo+4Q0rLnAZ6yVkzCRxhRMsiRQnD1o=
+github.com/aws/aws-sdk-go-v2/config v1.26.1/go.mod h1:ZB+CuKHRbb5v5F0oJtGdhFTelmrxd4iWO1lf0rQwSAg=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.12 h1:v/WgB8NxprNvr5inKIiVVrXPuuTegM+K8nncFkr1usU=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.12/go.mod h1:X21k0FjEJe+/pauud82HYiQbEr9jRKY3kXEIQ4hXeTQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10 h1:w98BT5w+ao1/r5sUuiH6JkVzjowOKeOJRHERyy1vh58=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10/go.mod h1:K2WGI7vUvkIv1HoNbfBA1bvIZ+9kL3YVmWxeKuLQsiw=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9 h1:v+HbZaCGmOwnTTVS86Fleq0vPzOd7tnJGbFhP0stNLs=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9/go.mod h1:Xjqy+Nyj7VDLBtCMkQYOw1QYfAEZCVLrfI0ezve8wd4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9 h1:N94sVhRACtXyVcjXxrwK1SKFIJrA9pOJ5yu2eSHnmls=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9/go.mod h1:hqamLz7g1/4EJP+GH5NBhcUMLjW+gKLQabgyz6/7WAU=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 h1:GrSw8s0Gs/5zZ0SX+gX4zQjRnRsMJDJ2sLur1gRBhEM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 h1:/b31bi3YVNlkzkBrm9LfpaKoaYZUxIAj4sHfOTmLfqw=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4/go.mod h1:2aGXHFmbInwgP9ZfpmdIfOELL79zhdNYNmReK8qDfdQ=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9 h1:Nf2sHxjMJR8CSImIVCONRi4g0Su3J+TSTbS7G0pUeMU=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9/go.mod h1:idky4TER38YIjr2cADF1/ugFMKvZV7p//pVeV5LZbF0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.5 h1:ldSFWz9tEHAwHNmjx2Cvy1MjP5/L9kNoR0skc6wyOOM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.5/go.mod h1:CaFfXLYL376jgbP7VKC96uFcU8Rlavak0UlAwk1Dlhc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5 h1:2k9KmFawS63euAkY4/ixVNsYYwrwnd5fIvgEKkfZFNM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.5/go.mod h1:W+nd4wWDVkSUIox9bacmkBP5NMFQeTJ/xqNabpzSR38=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.5 h1:5UYvv8JUvllZsRnfrcMQ+hJ9jNICmcgKPAO1CER25Wg=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.5/go.mod h1:XX5gh4CB7wAs4KhcF46G6C8a2i7eupU19dcAAE+EydU=
+github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
+github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
-github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
-github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
-github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.16.2 h1:K4ev2ib4LdQETX5cSZBG0DVLk1jwGqSPXBjdah3veNs=
-github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnP3V9oNE4hmsM=
-github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/awsutil v0.1.6 h1:W9WN8p6moV1fjKLkeqEgkAMu5rauy9QeYDAmIaPuuiA=
-github.com/hashicorp/go-secure-stdlib/awsutil v0.1.6/go.mod h1:MpCPSPGLDILGb4JMm94/mMi3YysIqsXzGCzkEZjcjXg=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/vault/api v1.12.0 h1:meCpJSesvzQyao8FCOgk2fGdoADAnbDu2WPJN1lDLJ4=
-github.com/hashicorp/vault/api v1.12.0/go.mod h1:si+lJCYO7oGkIoNPAN8j3azBLTn9SjMGS+jFaHd1Cck=
-github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
-github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
-github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6 h1:6Su7aK7lXmJ/U79bYtBjLNaha4Fs1Rg9plHpcH+vvnE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
+github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/api/auth/azure/LICENSE b/api/auth/azure/LICENSE
new file mode 100644
index 00000000000..a32743a27b0
--- /dev/null
+++ b/api/auth/azure/LICENSE
@@ -0,0 +1,365 @@
+Copyright IBM Corp. 2016, 2025
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.
+
diff --git a/api/auth/azure/azure.go b/api/auth/azure/azure.go
index b6821957011..c43526d4190 100644
--- a/api/auth/azure/azure.go
+++ b/api/auth/azure/azure.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package azure
@@ -7,7 +7,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
 	"time"
@@ -175,7 +175,7 @@ func (a *AzureAuth) getJWT() (string, error) {
 	}
 	defer resp.Body.Close()
 
-	responseBytes, err := ioutil.ReadAll(resp.Body)
+	responseBytes, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return "", fmt.Errorf("error reading response body from Azure token endpoint: %w", err)
 	}
@@ -222,7 +222,7 @@ func getMetadata() (metadataJSON, error) {
 	}
 	defer resp.Body.Close()
 
-	responseBytes, err := ioutil.ReadAll(resp.Body)
+	responseBytes, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return metadataJSON{}, fmt.Errorf("error reading response body from metadata endpoint: %w", err)
 	}
diff --git a/api/auth/azure/go.mod b/api/auth/azure/go.mod
index 5fc1e6716e1..9d431c04ac1 100644
--- a/api/auth/azure/go.mod
+++ b/api/auth/azure/go.mod
@@ -1,5 +1,28 @@
 module github.com/hashicorp/vault/api/auth/azure
 
-go 1.16
+go 1.23.0
 
-require github.com/hashicorp/vault/api v1.12.0
+toolchain go1.23.7
+
+require github.com/hashicorp/vault/api v1.22.0
+
+require (
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+)
diff --git a/api/auth/azure/go.sum b/api/auth/azure/go.sum
index 8645312630e..7f368024a69 100644
--- a/api/auth/azure/go.sum
+++ b/api/auth/azure/go.sum
@@ -1,137 +1,59 @@
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
-github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
-github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
-github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.16.2 h1:K4ev2ib4LdQETX5cSZBG0DVLk1jwGqSPXBjdah3veNs=
-github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnP3V9oNE4hmsM=
-github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/vault/api v1.12.0 h1:meCpJSesvzQyao8FCOgk2fGdoADAnbDu2WPJN1lDLJ4=
-github.com/hashicorp/vault/api v1.12.0/go.mod h1:si+lJCYO7oGkIoNPAN8j3azBLTn9SjMGS+jFaHd1Cck=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6 h1:6Su7aK7lXmJ/U79bYtBjLNaha4Fs1Rg9plHpcH+vvnE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
+github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/api/auth/cert/cert.go b/api/auth/cert/cert.go
new file mode 100644
index 00000000000..4715a58c9d3
--- /dev/null
+++ b/api/auth/cert/cert.go
@@ -0,0 +1,152 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package cert
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/vault/api"
+)
+
+const defaultMountPath = "cert"
+
+type CertAuth struct {
+	role      string
+	mountPath string
+}
+
+var _ api.AuthMethod = (*CertAuth)(nil)
+
+type LoginOption func(a *CertAuth) error
+
+// NewCertAuth initializes a new Cert auth method interface to be
+// passed as a parameter to the client.Auth().Login method. The client and other
+// TLS configuration should be set up on the passed in client, you can use
+// the NewCertAuthClient function to set up the client with the proper TLS client attributes.
+//
+// Supported options: WithRole, WithMountPath
+func NewCertAuth(opts ...LoginOption) (*CertAuth, error) {
+	a := &CertAuth{}
+
+	// Loop through each option
+	for _, opt := range opts {
+		// Call the option giving the instantiated
+		// *CertAuth as the argument
+		err := opt(a)
+		if err != nil {
+			return nil, fmt.Errorf("error with login option: %w", err)
+		}
+	}
+
+	if a.mountPath == "" {
+		a.mountPath = defaultMountPath
+	}
+
+	// return the modified auth struct instance
+	return a, nil
+}
+
+// Login sets up the required request body for the Cert auth method's /login
+// endpoint, and performs a write to it. We assume the passed in client has the
+// proper TLS client certificates set up.
+func (a *CertAuth) Login(ctx context.Context, client *api.Client) (*api.Secret, error) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+
+	if client == nil {
+		return nil, fmt.Errorf("client is required for login with the associated client certs initialized")
+	}
+
+	loginData := make(map[string]interface{})
+	if a.role != "" {
+		loginData["name"] = a.role
+	}
+
+	certAuthPath := fmt.Sprintf("auth/%s/login", a.mountPath)
+	resp, err := client.Logical().WriteWithContext(ctx, certAuthPath, loginData)
+	if err != nil {
+		return nil, fmt.Errorf("unable to log in with cert auth: %w", err)
+	}
+
+	return resp, nil
+}
+
+// WithRole specifies the role to use for the login request.
+func WithRole(roleName string) LoginOption {
+	return func(a *CertAuth) error {
+		a.role = roleName
+		return nil
+	}
+}
+
+// WithMountPath specifies the mount path to use for the login request.
+func WithMountPath(mountPath string) LoginOption {
+	return func(a *CertAuth) error {
+		a.mountPath = mountPath
+		return nil
+	}
+}
+
+// NewDefaultCertAuthClient initializes a new client with a default configuration
+// with the provided address and TLS configuration. The TLSConfig must have the ClientCert and ClientKey
+// fields set.
+func NewDefaultCertAuthClient(address string, tlsConfig *api.TLSConfig) (*api.Client, error) {
+	if tlsConfig == nil {
+		return nil, errors.New("tls config is required for cert auth client")
+	}
+
+	if tlsConfig.ClientCert == "" || tlsConfig.ClientKey == "" {
+		return nil, errors.New("client cert and key are required for cert auth client")
+	}
+
+	if len(address) == 0 {
+		return nil, errors.New("address is required for cert auth client")
+	}
+
+	cfg := api.DefaultConfig()
+	cfg.Address = address
+	err := cfg.ConfigureTLS(tlsConfig)
+	if err != nil {
+		return nil, fmt.Errorf("failed configuring TLS on client config: %w", err)
+	}
+
+	client, err := api.NewClient(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create client: %v", err)
+	}
+
+	return client, nil
+}
+
+// NewCertAuthClient initializes a new client based on the passed in client
+// with the provided TLS configuration. The TLSConfig must have the ClientCert and ClientKey
+// fields set.
+func NewCertAuthClient(c *api.Client, config *api.TLSConfig) (*api.Client, error) {
+	if c == nil {
+		return nil, errors.New("base client is required for cert auth client")
+	}
+	if config == nil {
+		return nil, errors.New("tls config is required for cert auth client")
+	}
+
+	if config.ClientCert == "" || config.ClientKey == "" {
+		return nil, errors.New("client cert and key are required for cert auth client")
+	}
+
+	conf := c.CloneConfig()
+	err := conf.ConfigureTLS(config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to configure TLS on client: %w", err)
+	}
+
+	client, err := api.NewClient(conf)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create client: %v", err)
+	}
+
+	return client, nil
+}
diff --git a/api/auth/cert/cert_test.go b/api/auth/cert/cert_test.go
new file mode 100644
index 00000000000..00f17d00683
--- /dev/null
+++ b/api/auth/cert/cert_test.go
@@ -0,0 +1,406 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package cert
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"math/big"
+	mathrand "math/rand"
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"regexp"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/go-rootcerts"
+	"github.com/hashicorp/vault/api"
+)
+
+var extractMountRe = regexp.MustCompile(`^/v1/auth/([a-z]+)/login$`)
+
+// TestLogin tests the login method of the CertAuth struct with the various overrides we support,
+// the values the client uses to call the server with influence the returned client token so
+// the test can validate we sent what we expected to.
+func TestLogin(t *testing.T) {
+	certs := createCertificates(t)
+
+	// build up a server that will influence the returned token based on the request
+	ln := runTestServer(t, certs, func(w http.ResponseWriter, r *http.Request) {
+		// Make sure we have a client certificate
+		if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
+			w.WriteHeader(http.StatusBadRequest)
+			_, _ = w.Write([]byte("missing peer certificate"))
+			return
+		}
+
+		// Make sure we get the expected client certificate
+		if r.TLS.PeerCertificates[0].SerialNumber.Cmp(certs.parsedClientCert.SerialNumber) != 0 {
+			w.WriteHeader(http.StatusBadRequest)
+			_, _ = w.Write([]byte("incorrect peer certificate provided"))
+			return
+		}
+
+		// Extract the mount path from the URL we were called with
+		var mount string
+		if matches := extractMountRe.FindStringSubmatch(r.URL.Path); len(matches) == 2 {
+			mount = matches[1]
+		}
+
+		// Parse out the role name from the request body if provided
+		rawBody, err := io.ReadAll(r.Body)
+		if err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte("failed reading body: " + err.Error()))
+			return
+		}
+		defer r.Body.Close()
+
+		data := make(map[string]interface{})
+		if err = json.Unmarshal(rawBody, &data); err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte("failed parsing body: " + err.Error()))
+			return
+		}
+
+		roleName := "none"
+		if role, ok := data["name"].(string); ok {
+			roleName = role
+		}
+
+		// Build up our token that includes the mount of our cert auth and the role name
+		token := fmt.Sprintf("%s-%s-token", mount, roleName)
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(fmt.Sprintf(`{"auth": {"client_token": "%s"}}`, token)))
+	})
+	url := fmt.Sprintf("https://%s", ln.Addr())
+	defaultAuthClient, err := NewDefaultCertAuthClient(url, &api.TLSConfig{
+		CACert:     certs.caCert,
+		ClientCert: certs.clientCert,
+		ClientKey:  certs.clientKey,
+	})
+	if err != nil {
+		t.Fatalf("failed to create default CertAuth: %v", err)
+	}
+
+	defConfig := api.DefaultConfig()
+	defConfig.Address = url
+	baseClient, err := api.NewClient(defConfig)
+	if err != nil {
+		t.Fatalf("failed to create CertAuth client based on base client: %v", err)
+	}
+
+	basedOnClient, err := NewCertAuthClient(baseClient, &api.TLSConfig{
+		CACert:     certs.caCert,
+		ClientCert: certs.clientCert,
+		ClientKey:  certs.clientKey,
+	})
+	if err != nil {
+		t.Fatalf("failed to create CertAuth based on another client: %v", err)
+	}
+
+	tests := []struct {
+		name          string
+		opts          []LoginOption
+		expectedToken string
+	}{
+		{"default", []LoginOption{}, "cert-none-token"},
+		{"with mount path", []LoginOption{WithMountPath("mycert")}, "mycert-none-token"},
+		{"with role", []LoginOption{WithRole("myrole")}, "cert-myrole-token"},
+		{"with mount and role", []LoginOption{WithMountPath("mycert"), WithRole("myrole")}, "mycert-myrole-token"},
+	}
+	for name, certAuthClient := range map[string]*api.Client{"default": defaultAuthClient, "based-on-client": basedOnClient} {
+		for _, test := range tests {
+			t.Run(fmt.Sprintf("%s-%s", name, test.name), func(t *testing.T) {
+				auth, err := NewCertAuth(test.opts...)
+				if err != nil {
+					t.Fatalf("failed to create CertAuth: %v", err)
+				}
+
+				secret, err := auth.Login(context.Background(), certAuthClient)
+				if err != nil {
+					t.Fatalf("failed to login: %v", err)
+				}
+
+				if secret == nil || secret.Auth == nil || secret.Auth.ClientToken != test.expectedToken {
+					t.Fatalf("unexpected response: %v", secret)
+				}
+			})
+		}
+	}
+}
+
+// TestNewDefaultCertAuthClient tests the NewDefaultCertAuthClient function validates inputs properly
+func TestNewDefaultCertAuthClient(t *testing.T) {
+	certs := createCertificates(t)
+	addr := "https://127.0.0.1:8200"
+	tlsConfig := &api.TLSConfig{
+		CAPath:     certs.caCert,
+		ClientCert: certs.clientCert,
+		ClientKey:  certs.clientKey,
+	}
+	type args struct {
+		address   string
+		tlsConfig *api.TLSConfig
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{"missing address", args{"", tlsConfig}, true},
+		{"missing config", args{addr, nil}, true},
+		{"missing client cert", args{addr, &api.TLSConfig{}}, true},
+		{"ok", args{addr, tlsConfig}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := NewDefaultCertAuthClient(tt.args.address, tt.args.tlsConfig)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("NewDefaultCertAuthClient() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !tt.wantErr {
+				if got == nil {
+					t.Errorf("NewDefaultCertAuthClient() returned nil client")
+					return
+				}
+				if got.Address() != tt.args.address {
+					t.Errorf("NewDefaultCertAuthClient() returned client with address %s, expected %s", got.Address(), tt.args.address)
+				}
+
+				// The Login test will validate that our TLS config was passed in properly.
+			}
+		})
+	}
+}
+
+// TestNewCertAuthClient tests the NewCertAuthClient function validates inputs properly
+func TestNewCertAuthClient(t *testing.T) {
+	certs := createCertificates(t)
+	addr := "https://127.0.0.1:8200"
+	tlsConfig := &api.TLSConfig{
+		CAPath:     certs.caCert,
+		ClientCert: certs.clientCert,
+		ClientKey:  certs.clientKey,
+	}
+	defConfig := api.DefaultConfig()
+	defConfig.Address = addr
+	client, err := api.NewClient(defConfig)
+	if err != nil {
+		t.Fatalf("failed to create CertAuth: %v", err)
+	}
+
+	type args struct {
+		client    *api.Client
+		tlsConfig *api.TLSConfig
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{"missing address", args{nil, tlsConfig}, true},
+		{"missing config", args{client, nil}, true},
+		{"missing client cert", args{client, &api.TLSConfig{}}, true},
+		{"ok", args{client, tlsConfig}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := NewCertAuthClient(tt.args.client, tt.args.tlsConfig)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("NewDefaultCertAuthClient() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !tt.wantErr {
+				if got == nil {
+					t.Errorf("NewDefaultCertAuthClient() returned nil client")
+					return
+				}
+				if got.Address() != addr {
+					t.Errorf("NewDefaultCertAuthClient() returned client with address %s, expected %s", got.Address(), addr)
+				}
+
+				// The Login test will validate that our TLS config was passed in properly.
+			}
+		})
+	}
+}
+
+func runTestServer(t *testing.T, cert testCerts, fn http.HandlerFunc) net.Listener {
+	certPool, err := rootcerts.LoadCACerts(&rootcerts.Config{
+		CAPath: cert.caCert,
+	})
+	if err != nil {
+		t.Fatalf("failed to load CA certs: %v", err)
+	}
+
+	tlsConfig := &tls.Config{
+		ClientAuth: tls.RequireAndVerifyClientCert,
+		ClientCAs:  certPool,
+		RootCAs:    certPool,
+	}
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("failed to create listener: %v", err)
+	}
+
+	sv := &http.Server{
+		TLSConfig: tlsConfig,
+		Handler:   fn,
+	}
+
+	t.Cleanup(func() {
+		_ = sv.Close()
+		_ = ln.Close()
+	})
+
+	go func() {
+		_ = sv.ServeTLS(ln, cert.serverCert, cert.serverKey)
+	}()
+
+	return ln
+}
+
+type testCerts struct {
+	caCert           string
+	caKey            string
+	serverCert       string
+	serverKey        string
+	clientCert       string
+	clientKey        string
+	parsedClientCert *x509.Certificate
+}
+
+func createCertificates(t *testing.T) testCerts {
+	tempDir := t.TempDir()
+
+	caCertTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "localhost",
+		},
+		DNSNames:              []string{"localhost"},
+		IPAddresses:           []net.IP{net.ParseIP("127.0.0.1")},
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		SerialNumber:          big.NewInt(mathrand.Int63()),
+		NotBefore:             time.Now().Add(-30 * time.Second),
+		NotAfter:              time.Now().Add(262980 * time.Hour),
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+	}
+	caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	caBytes, err := x509.CreateCertificate(rand.Reader, caCertTemplate, caCertTemplate, caKey.Public(), caKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	caCert, err := x509.ParseCertificate(caBytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	caCertPEMBlock := &pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: caBytes,
+	}
+	caCertFile := filepath.Join(tempDir, "ca_cert.pem")
+	err = os.WriteFile(caCertFile, pem.EncodeToMemory(caCertPEMBlock), 0o755)
+	if err != nil {
+		t.Fatal(err)
+	}
+	marshaledCAKey, err := x509.MarshalECPrivateKey(caKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	caKeyPEMBlock := &pem.Block{
+		Type:  "EC PRIVATE KEY",
+		Bytes: marshaledCAKey,
+	}
+	caKeyFile := filepath.Join(tempDir, "ca_key.pem")
+	err = os.WriteFile(caKeyFile, pem.EncodeToMemory(caKeyPEMBlock), 0o755)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	createCertificate := func(prefix string) *x509.Certificate {
+		key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		template := &x509.Certificate{
+			Subject: pkix.Name{
+				CommonName: "example.com",
+			},
+			EmailAddresses: []string{"valid@example.com"},
+			IPAddresses:    []net.IP{net.ParseIP("127.0.0.1")},
+			ExtKeyUsage: []x509.ExtKeyUsage{
+				x509.ExtKeyUsageServerAuth,
+				x509.ExtKeyUsageClientAuth,
+			},
+			KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageKeyAgreement,
+			SerialNumber: big.NewInt(mathrand.Int63()),
+			NotBefore:    time.Now().Add(-30 * time.Second),
+			NotAfter:     time.Now().Add(262980 * time.Hour),
+		}
+		certBytes, err := x509.CreateCertificate(rand.Reader, template, caCert, key.Public(), caKey)
+		if err != nil {
+			t.Fatal(err)
+		}
+		certPEMBlock := &pem.Block{
+			Type:  "CERTIFICATE",
+			Bytes: certBytes,
+		}
+		err = os.WriteFile(filepath.Join(tempDir, prefix+"_cert.pem"), pem.EncodeToMemory(certPEMBlock), 0o755)
+		if err != nil {
+			t.Fatal(err)
+		}
+		marshaledKey, err := x509.MarshalECPrivateKey(key)
+		if err != nil {
+			t.Fatal(err)
+		}
+		keyPEMBlock := &pem.Block{
+			Type:  "EC PRIVATE KEY",
+			Bytes: marshaledKey,
+		}
+		err = os.WriteFile(filepath.Join(tempDir, prefix+"_key.pem"), pem.EncodeToMemory(keyPEMBlock), 0o755)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		parsedCert, err := x509.ParseCertificate(certBytes)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return parsedCert
+	}
+
+	clientCert := createCertificate("client")
+	createCertificate("server")
+
+	filepath.Join(tempDir, "client_cert.pem")
+
+	return testCerts{
+		caCert:           caCertFile,
+		caKey:            caKeyFile,
+		serverCert:       filepath.Join(tempDir, "server_cert.pem"),
+		serverKey:        filepath.Join(tempDir, "server_key.pem"),
+		clientCert:       filepath.Join(tempDir, "client_cert.pem"),
+		clientKey:        filepath.Join(tempDir, "client_key.pem"),
+		parsedClientCert: clientCert,
+	}
+}
diff --git a/api/auth/cert/go.mod b/api/auth/cert/go.mod
new file mode 100644
index 00000000000..a3c787fd44e
--- /dev/null
+++ b/api/auth/cert/go.mod
@@ -0,0 +1,30 @@
+module github.com/hashicorp/vault/api/auth/cert
+
+go 1.23.0
+
+toolchain go1.23.7
+
+require (
+	github.com/hashicorp/go-rootcerts v1.0.2
+	github.com/hashicorp/vault/api v1.22.0
+)
+
+require (
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+)
diff --git a/api/auth/cert/go.sum b/api/auth/cert/go.sum
new file mode 100644
index 00000000000..7f368024a69
--- /dev/null
+++ b/api/auth/cert/go.sum
@@ -0,0 +1,59 @@
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
+github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
+github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
+github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
+github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/api/auth/gcp/LICENSE b/api/auth/gcp/LICENSE
new file mode 100644
index 00000000000..a32743a27b0
--- /dev/null
+++ b/api/auth/gcp/LICENSE
@@ -0,0 +1,365 @@
+Copyright IBM Corp. 2016, 2025
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.
+
diff --git a/api/auth/gcp/gcp.go b/api/auth/gcp/gcp.go
index 2d6ef842a4b..ce6e47ad08e 100644
--- a/api/auth/gcp/gcp.go
+++ b/api/auth/gcp/gcp.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package gcp
@@ -7,7 +7,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
 	"time"
@@ -181,7 +181,7 @@ func (a *GCPAuth) getJWTFromMetadataService(vaultAddress string) (string, error)
 	defer resp.Body.Close()
 
 	// get jwt from response
-	body, err := ioutil.ReadAll(resp.Body)
+	body, err := io.ReadAll(resp.Body)
 	jwt := string(body)
 	if err != nil {
 		return "", fmt.Errorf("error reading response from metadata service: %w", err)
diff --git a/api/auth/gcp/go.mod b/api/auth/gcp/go.mod
index 977ebec0a42..3f53fc0096b 100644
--- a/api/auth/gcp/go.mod
+++ b/api/auth/gcp/go.mod
@@ -1,11 +1,55 @@
 module github.com/hashicorp/vault/api/auth/gcp
 
-go 1.16
+go 1.23.0
+
+toolchain go1.23.7
+
+require (
+	cloud.google.com/go/compute/metadata v0.7.0
+	cloud.google.com/go/iam v1.5.2
+	github.com/hashicorp/vault/api v1.22.0
+	google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2
+)
 
 require (
-	cloud.google.com/go/compute/metadata v0.2.3
-	cloud.google.com/go/iam v0.13.0
-	github.com/hashicorp/vault/api v1.12.0
-	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1
-	google.golang.org/grpc v1.56.3 // indirect
+	cloud.google.com/go/auth v0.16.2 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.2 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel v1.36.0 // indirect
+	go.opentelemetry.io/otel/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	google.golang.org/api v0.242.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/grpc v1.73.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
 )
diff --git a/api/auth/gcp/go.sum b/api/auth/gcp/go.sum
index 2a077286114..89cb8786582 100644
--- a/api/auth/gcp/go.sum
+++ b/api/auth/gcp/go.sum
@@ -1,1615 +1,118 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
-cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
-cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
-cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
-cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
-cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY=
-cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM=
-cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY=
-cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aDQ=
-cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
-cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
-cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
-cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
-cloud.google.com/go v0.100.1/go.mod h1:fs4QogzfH5n2pBXBP9vRiU+eCny7lD2vmFZy79Iuw1U=
-cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
-cloud.google.com/go v0.102.0/go.mod h1:oWcCzKlqJ5zgHQt9YsaeTY9KzIvjyy0ArmiBUgpQ+nc=
-cloud.google.com/go v0.102.1/go.mod h1:XZ77E9qnTEnrgEOvr4xzfdX5TRo7fB4T2F4O6+34hIU=
-cloud.google.com/go v0.104.0/go.mod h1:OO6xxXdJyvuJPcEPBLN9BJPD+jep5G1+2U5B5gkRYtA=
-cloud.google.com/go v0.105.0/go.mod h1:PrLgOJNe5nfE9UMxKxgXj4mD3voiP+YQ6gdt6KMFOKM=
-cloud.google.com/go v0.107.0/go.mod h1:wpc2eNrD7hXUTy8EKS10jkxpZBjASrORK7goS+3YX2I=
-cloud.google.com/go v0.110.0 h1:Zc8gqp3+a9/Eyph2KDmcGaPtbKRIoqq4YTlL4NMD0Ys=
-cloud.google.com/go v0.110.0/go.mod h1:SJnCLqQ0FCFGSZMUNUf84MV3Aia54kn7pi8st7tMzaY=
-cloud.google.com/go/accessapproval v1.4.0/go.mod h1:zybIuC3KpDOvotz59lFe5qxRZx6C75OtwbisN56xYB4=
-cloud.google.com/go/accessapproval v1.5.0/go.mod h1:HFy3tuiGvMdcd/u+Cu5b9NkO1pEICJ46IR82PoUdplw=
-cloud.google.com/go/accessapproval v1.6.0/go.mod h1:R0EiYnwV5fsRFiKZkPHr6mwyk2wxUJ30nL4j2pcFY2E=
-cloud.google.com/go/accesscontextmanager v1.3.0/go.mod h1:TgCBehyr5gNMz7ZaH9xubp+CE8dkrszb4oK9CWyvD4o=
-cloud.google.com/go/accesscontextmanager v1.4.0/go.mod h1:/Kjh7BBu/Gh83sv+K60vN9QE5NJcd80sU33vIe2IFPE=
-cloud.google.com/go/accesscontextmanager v1.6.0/go.mod h1:8XCvZWfYw3K/ji0iVnp+6pu7huxoQTLmxAbVjbloTtM=
-cloud.google.com/go/accesscontextmanager v1.7.0/go.mod h1:CEGLewx8dwa33aDAZQujl7Dx+uYhS0eay198wB/VumQ=
-cloud.google.com/go/aiplatform v1.22.0/go.mod h1:ig5Nct50bZlzV6NvKaTwmplLLddFx0YReh9WfTO5jKw=
-cloud.google.com/go/aiplatform v1.24.0/go.mod h1:67UUvRBKG6GTayHKV8DBv2RtR1t93YRu5B1P3x99mYY=
-cloud.google.com/go/aiplatform v1.27.0/go.mod h1:Bvxqtl40l0WImSb04d0hXFU7gDOiq9jQmorivIiWcKg=
-cloud.google.com/go/aiplatform v1.35.0/go.mod h1:7MFT/vCaOyZT/4IIFfxH4ErVg/4ku6lKv3w0+tFTgXQ=
-cloud.google.com/go/aiplatform v1.36.1/go.mod h1:WTm12vJRPARNvJ+v6P52RDHCNe4AhvjcIZ/9/RRHy/k=
-cloud.google.com/go/aiplatform v1.37.0/go.mod h1:IU2Cv29Lv9oCn/9LkFiiuKfwrRTq+QQMbW+hPCxJGZw=
-cloud.google.com/go/analytics v0.11.0/go.mod h1:DjEWCu41bVbYcKyvlws9Er60YE4a//bK6mnhWvQeFNI=
-cloud.google.com/go/analytics v0.12.0/go.mod h1:gkfj9h6XRf9+TS4bmuhPEShsh3hH8PAZzm/41OOhQd4=
-cloud.google.com/go/analytics v0.17.0/go.mod h1:WXFa3WSym4IZ+JiKmavYdJwGG/CvpqiqczmL59bTD9M=
-cloud.google.com/go/analytics v0.18.0/go.mod h1:ZkeHGQlcIPkw0R/GW+boWHhCOR43xz9RN/jn7WcqfIE=
-cloud.google.com/go/analytics v0.19.0/go.mod h1:k8liqf5/HCnOUkbawNtrWWc+UAzyDlW89doe8TtoDsE=
-cloud.google.com/go/apigateway v1.3.0/go.mod h1:89Z8Bhpmxu6AmUxuVRg/ECRGReEdiP3vQtk4Z1J9rJk=
-cloud.google.com/go/apigateway v1.4.0/go.mod h1:pHVY9MKGaH9PQ3pJ4YLzoj6U5FUDeDFBllIz7WmzJoc=
-cloud.google.com/go/apigateway v1.5.0/go.mod h1:GpnZR3Q4rR7LVu5951qfXPJCHquZt02jf7xQx7kpqN8=
-cloud.google.com/go/apigeeconnect v1.3.0/go.mod h1:G/AwXFAKo0gIXkPTVfZDd2qA1TxBXJ3MgMRBQkIi9jc=
-cloud.google.com/go/apigeeconnect v1.4.0/go.mod h1:kV4NwOKqjvt2JYR0AoIWo2QGfoRtn/pkS3QlHp0Ni04=
-cloud.google.com/go/apigeeconnect v1.5.0/go.mod h1:KFaCqvBRU6idyhSNyn3vlHXc8VMDJdRmwDF6JyFRqZ8=
-cloud.google.com/go/apigeeregistry v0.4.0/go.mod h1:EUG4PGcsZvxOXAdyEghIdXwAEi/4MEaoqLMLDMIwKXY=
-cloud.google.com/go/apigeeregistry v0.5.0/go.mod h1:YR5+s0BVNZfVOUkMa5pAR2xGd0A473vA5M7j247o1wM=
-cloud.google.com/go/apigeeregistry v0.6.0/go.mod h1:BFNzW7yQVLZ3yj0TKcwzb8n25CFBri51GVGOEUcgQsc=
-cloud.google.com/go/apikeys v0.4.0/go.mod h1:XATS/yqZbaBK0HOssf+ALHp8jAlNHUgyfprvNcBIszU=
-cloud.google.com/go/apikeys v0.5.0/go.mod h1:5aQfwY4D+ewMMWScd3hm2en3hCj+BROlyrt3ytS7KLI=
-cloud.google.com/go/apikeys v0.6.0/go.mod h1:kbpXu5upyiAlGkKrJgQl8A0rKNNJ7dQ377pdroRSSi8=
-cloud.google.com/go/appengine v1.4.0/go.mod h1:CS2NhuBuDXM9f+qscZ6V86m1MIIqPj3WC/UoEuR1Sno=
-cloud.google.com/go/appengine v1.5.0/go.mod h1:TfasSozdkFI0zeoxW3PTBLiNqRmzraodCWatWI9Dmak=
-cloud.google.com/go/appengine v1.6.0/go.mod h1:hg6i0J/BD2cKmDJbaFSYHFyZkgBEfQrDg/X0V5fJn84=
-cloud.google.com/go/appengine v1.7.0/go.mod h1:eZqpbHFCqRGa2aCdope7eC0SWLV1j0neb/QnMJVWx6A=
-cloud.google.com/go/appengine v1.7.1/go.mod h1:IHLToyb/3fKutRysUlFO0BPt5j7RiQ45nrzEJmKTo6E=
-cloud.google.com/go/area120 v0.5.0/go.mod h1:DE/n4mp+iqVyvxHN41Vf1CR602GiHQjFPusMFW6bGR4=
-cloud.google.com/go/area120 v0.6.0/go.mod h1:39yFJqWVgm0UZqWTOdqkLhjoC7uFfgXRC8g/ZegeAh0=
-cloud.google.com/go/area120 v0.7.0/go.mod h1:a3+8EUD1SX5RUcCs3MY5YasiO1z6yLiNLRiFrykbynY=
-cloud.google.com/go/area120 v0.7.1/go.mod h1:j84i4E1RboTWjKtZVWXPqvK5VHQFJRF2c1Nm69pWm9k=
-cloud.google.com/go/artifactregistry v1.6.0/go.mod h1:IYt0oBPSAGYj/kprzsBjZ/4LnG/zOcHyFHjWPCi6SAQ=
-cloud.google.com/go/artifactregistry v1.7.0/go.mod h1:mqTOFOnGZx8EtSqK/ZWcsm/4U8B77rbcLP6ruDU2Ixk=
-cloud.google.com/go/artifactregistry v1.8.0/go.mod h1:w3GQXkJX8hiKN0v+at4b0qotwijQbYUqF2GWkZzAhC0=
-cloud.google.com/go/artifactregistry v1.9.0/go.mod h1:2K2RqvA2CYvAeARHRkLDhMDJ3OXy26h3XW+3/Jh2uYc=
-cloud.google.com/go/artifactregistry v1.11.1/go.mod h1:lLYghw+Itq9SONbCa1YWBoWs1nOucMH0pwXN1rOBZFI=
-cloud.google.com/go/artifactregistry v1.11.2/go.mod h1:nLZns771ZGAwVLzTX/7Al6R9ehma4WUEhZGWV6CeQNQ=
-cloud.google.com/go/artifactregistry v1.12.0/go.mod h1:o6P3MIvtzTOnmvGagO9v/rOjjA0HmhJ+/6KAXrmYDCI=
-cloud.google.com/go/artifactregistry v1.13.0/go.mod h1:uy/LNfoOIivepGhooAUpL1i30Hgee3Cu0l4VTWHUC08=
-cloud.google.com/go/asset v1.5.0/go.mod h1:5mfs8UvcM5wHhqtSv8J1CtxxaQq3AdBxxQi2jGW/K4o=
-cloud.google.com/go/asset v1.7.0/go.mod h1:YbENsRK4+xTiL+Ofoj5Ckf+O17kJtgp3Y3nn4uzZz5s=
-cloud.google.com/go/asset v1.8.0/go.mod h1:mUNGKhiqIdbr8X7KNayoYvyc4HbbFO9URsjbytpUaW0=
-cloud.google.com/go/asset v1.9.0/go.mod h1:83MOE6jEJBMqFKadM9NLRcs80Gdw76qGuHn8m3h8oHQ=
-cloud.google.com/go/asset v1.10.0/go.mod h1:pLz7uokL80qKhzKr4xXGvBQXnzHn5evJAEAtZiIb0wY=
-cloud.google.com/go/asset v1.11.1/go.mod h1:fSwLhbRvC9p9CXQHJ3BgFeQNM4c9x10lqlrdEUYXlJo=
-cloud.google.com/go/asset v1.12.0/go.mod h1:h9/sFOa4eDIyKmH6QMpm4eUK3pDojWnUhTgJlk762Hg=
-cloud.google.com/go/asset v1.13.0/go.mod h1:WQAMyYek/b7NBpYq/K4KJWcRqzoalEsxz/t/dTk4THw=
-cloud.google.com/go/assuredworkloads v1.5.0/go.mod h1:n8HOZ6pff6re5KYfBXcFvSViQjDwxFkAkmUFffJRbbY=
-cloud.google.com/go/assuredworkloads v1.6.0/go.mod h1:yo2YOk37Yc89Rsd5QMVECvjaMKymF9OP+QXWlKXUkXw=
-cloud.google.com/go/assuredworkloads v1.7.0/go.mod h1:z/736/oNmtGAyU47reJgGN+KVoYoxeLBoj4XkKYscNI=
-cloud.google.com/go/assuredworkloads v1.8.0/go.mod h1:AsX2cqyNCOvEQC8RMPnoc0yEarXQk6WEKkxYfL6kGIo=
-cloud.google.com/go/assuredworkloads v1.9.0/go.mod h1:kFuI1P78bplYtT77Tb1hi0FMxM0vVpRC7VVoJC3ZoT0=
-cloud.google.com/go/assuredworkloads v1.10.0/go.mod h1:kwdUQuXcedVdsIaKgKTp9t0UJkE5+PAVNhdQm4ZVq2E=
-cloud.google.com/go/automl v1.5.0/go.mod h1:34EjfoFGMZ5sgJ9EoLsRtdPSNZLcfflJR39VbVNS2M0=
-cloud.google.com/go/automl v1.6.0/go.mod h1:ugf8a6Fx+zP0D59WLhqgTDsQI9w07o64uf/Is3Nh5p8=
-cloud.google.com/go/automl v1.7.0/go.mod h1:RL9MYCCsJEOmt0Wf3z9uzG0a7adTT1fe+aObgSpkCt8=
-cloud.google.com/go/automl v1.8.0/go.mod h1:xWx7G/aPEe/NP+qzYXktoBSDfjO+vnKMGgsApGJJquM=
-cloud.google.com/go/automl v1.12.0/go.mod h1:tWDcHDp86aMIuHmyvjuKeeHEGq76lD7ZqfGLN6B0NuU=
-cloud.google.com/go/baremetalsolution v0.3.0/go.mod h1:XOrocE+pvK1xFfleEnShBlNAXf+j5blPPxrhjKgnIFc=
-cloud.google.com/go/baremetalsolution v0.4.0/go.mod h1:BymplhAadOO/eBa7KewQ0Ppg4A4Wplbn+PsFKRLo0uI=
-cloud.google.com/go/baremetalsolution v0.5.0/go.mod h1:dXGxEkmR9BMwxhzBhV0AioD0ULBmuLZI8CdwalUxuss=
-cloud.google.com/go/batch v0.3.0/go.mod h1:TR18ZoAekj1GuirsUsR1ZTKN3FC/4UDnScjT8NXImFE=
-cloud.google.com/go/batch v0.4.0/go.mod h1:WZkHnP43R/QCGQsZ+0JyG4i79ranE2u8xvjq/9+STPE=
-cloud.google.com/go/batch v0.7.0/go.mod h1:vLZN95s6teRUqRQ4s3RLDsH8PvboqBK+rn1oevL159g=
-cloud.google.com/go/beyondcorp v0.2.0/go.mod h1:TB7Bd+EEtcw9PCPQhCJtJGjk/7TC6ckmnSFS+xwTfm4=
-cloud.google.com/go/beyondcorp v0.3.0/go.mod h1:E5U5lcrcXMsCuoDNyGrpyTm/hn7ne941Jz2vmksAxW8=
-cloud.google.com/go/beyondcorp v0.4.0/go.mod h1:3ApA0mbhHx6YImmuubf5pyW8srKnCEPON32/5hj+RmM=
-cloud.google.com/go/beyondcorp v0.5.0/go.mod h1:uFqj9X+dSfrheVp7ssLTaRHd2EHqSL4QZmH4e8WXGGU=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/bigquery v1.42.0/go.mod h1:8dRTJxhtG+vwBKzE5OseQn/hiydoQN3EedCaOdYmxRA=
-cloud.google.com/go/bigquery v1.43.0/go.mod h1:ZMQcXHsl+xmU1z36G2jNGZmKp9zNY5BUua5wDgmNCfw=
-cloud.google.com/go/bigquery v1.44.0/go.mod h1:0Y33VqXTEsbamHJvJHdFmtqHvMIY28aK1+dFsvaChGc=
-cloud.google.com/go/bigquery v1.47.0/go.mod h1:sA9XOgy0A8vQK9+MWhEQTY6Tix87M/ZurWFIxmF9I/E=
-cloud.google.com/go/bigquery v1.48.0/go.mod h1:QAwSz+ipNgfL5jxiaK7weyOhzdoAy1zFm0Nf1fysJac=
-cloud.google.com/go/bigquery v1.49.0/go.mod h1:Sv8hMmTFFYBlt/ftw2uN6dFdQPzBlREY9yBh7Oy7/4Q=
-cloud.google.com/go/bigquery v1.50.0/go.mod h1:YrleYEh2pSEbgTBZYMJ5SuSr0ML3ypjRB1zgf7pvQLU=
-cloud.google.com/go/billing v1.4.0/go.mod h1:g9IdKBEFlItS8bTtlrZdVLWSSdSyFUZKXNS02zKMOZY=
-cloud.google.com/go/billing v1.5.0/go.mod h1:mztb1tBc3QekhjSgmpf/CV4LzWXLzCArwpLmP2Gm88s=
-cloud.google.com/go/billing v1.6.0/go.mod h1:WoXzguj+BeHXPbKfNWkqVtDdzORazmCjraY+vrxcyvI=
-cloud.google.com/go/billing v1.7.0/go.mod h1:q457N3Hbj9lYwwRbnlD7vUpyjq6u5U1RAOArInEiD5Y=
-cloud.google.com/go/billing v1.12.0/go.mod h1:yKrZio/eu+okO/2McZEbch17O5CB5NpZhhXG6Z766ss=
-cloud.google.com/go/billing v1.13.0/go.mod h1:7kB2W9Xf98hP9Sr12KfECgfGclsH3CQR0R08tnRlRbc=
-cloud.google.com/go/binaryauthorization v1.1.0/go.mod h1:xwnoWu3Y84jbuHa0zd526MJYmtnVXn0syOjaJgy4+dM=
-cloud.google.com/go/binaryauthorization v1.2.0/go.mod h1:86WKkJHtRcv5ViNABtYMhhNWRrD1Vpi//uKEy7aYEfI=
-cloud.google.com/go/binaryauthorization v1.3.0/go.mod h1:lRZbKgjDIIQvzYQS1p99A7/U1JqvqeZg0wiI5tp6tg0=
-cloud.google.com/go/binaryauthorization v1.4.0/go.mod h1:tsSPQrBd77VLplV70GUhBf/Zm3FsKmgSqgm4UmiDItk=
-cloud.google.com/go/binaryauthorization v1.5.0/go.mod h1:OSe4OU1nN/VswXKRBmciKpo9LulY41gch5c68htf3/Q=
-cloud.google.com/go/certificatemanager v1.3.0/go.mod h1:n6twGDvcUBFu9uBgt4eYvvf3sQ6My8jADcOVwHmzadg=
-cloud.google.com/go/certificatemanager v1.4.0/go.mod h1:vowpercVFyqs8ABSmrdV+GiFf2H/ch3KyudYQEMM590=
-cloud.google.com/go/certificatemanager v1.6.0/go.mod h1:3Hh64rCKjRAX8dXgRAyOcY5vQ/fE1sh8o+Mdd6KPgY8=
-cloud.google.com/go/channel v1.8.0/go.mod h1:W5SwCXDJsq/rg3tn3oG0LOxpAo6IMxNa09ngphpSlnk=
-cloud.google.com/go/channel v1.9.0/go.mod h1:jcu05W0my9Vx4mt3/rEHpfxc9eKi9XwsdDL8yBMbKUk=
-cloud.google.com/go/channel v1.11.0/go.mod h1:IdtI0uWGqhEeatSB62VOoJ8FSUhJ9/+iGkJVqp74CGE=
-cloud.google.com/go/channel v1.12.0/go.mod h1:VkxCGKASi4Cq7TbXxlaBezonAYpp1GCnKMY6tnMQnLU=
-cloud.google.com/go/cloudbuild v1.3.0/go.mod h1:WequR4ULxlqvMsjDEEEFnOG5ZSRSgWOywXYDb1vPE6U=
-cloud.google.com/go/cloudbuild v1.4.0/go.mod h1:5Qwa40LHiOXmz3386FrjrYM93rM/hdRr7b53sySrTqA=
-cloud.google.com/go/cloudbuild v1.6.0/go.mod h1:UIbc/w9QCbH12xX+ezUsgblrWv+Cv4Tw83GiSMHOn9M=
-cloud.google.com/go/cloudbuild v1.7.0/go.mod h1:zb5tWh2XI6lR9zQmsm1VRA+7OCuve5d8S+zJUul8KTg=
-cloud.google.com/go/cloudbuild v1.9.0/go.mod h1:qK1d7s4QlO0VwfYn5YuClDGg2hfmLZEb4wQGAbIgL1s=
-cloud.google.com/go/clouddms v1.3.0/go.mod h1:oK6XsCDdW4Ib3jCCBugx+gVjevp2TMXFtgxvPSee3OM=
-cloud.google.com/go/clouddms v1.4.0/go.mod h1:Eh7sUGCC+aKry14O1NRljhjyrr0NFC0G2cjwX0cByRk=
-cloud.google.com/go/clouddms v1.5.0/go.mod h1:QSxQnhikCLUw13iAbffF2CZxAER3xDGNHjsTAkQJcQA=
-cloud.google.com/go/cloudtasks v1.5.0/go.mod h1:fD92REy1x5woxkKEkLdvavGnPJGEn8Uic9nWuLzqCpY=
-cloud.google.com/go/cloudtasks v1.6.0/go.mod h1:C6Io+sxuke9/KNRkbQpihnW93SWDU3uXt92nu85HkYI=
-cloud.google.com/go/cloudtasks v1.7.0/go.mod h1:ImsfdYWwlWNJbdgPIIGJWC+gemEGTBK/SunNQQNCAb4=
-cloud.google.com/go/cloudtasks v1.8.0/go.mod h1:gQXUIwCSOI4yPVK7DgTVFiiP0ZW/eQkydWzwVMdHxrI=
-cloud.google.com/go/cloudtasks v1.9.0/go.mod h1:w+EyLsVkLWHcOaqNEyvcKAsWp9p29dL6uL9Nst1cI7Y=
-cloud.google.com/go/cloudtasks v1.10.0/go.mod h1:NDSoTLkZ3+vExFEWu2UJV1arUyzVDAiZtdWcsUyNwBs=
-cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
-cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJWM7YD99wM=
-cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
-cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz/FMzPu0s=
-cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
-cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
-cloud.google.com/go/compute v1.10.0/go.mod h1:ER5CLbMxl90o2jtNbGSbtfOpQKR0t15FOtRsugnLrlU=
-cloud.google.com/go/compute v1.12.0/go.mod h1:e8yNOBcBONZU1vJKCvCoDw/4JQsA0dpM4x/6PIIOocU=
-cloud.google.com/go/compute v1.12.1/go.mod h1:e8yNOBcBONZU1vJKCvCoDw/4JQsA0dpM4x/6PIIOocU=
-cloud.google.com/go/compute v1.13.0/go.mod h1:5aPTS0cUNMIc1CE546K+Th6weJUNQErARyZtRXDJ8GE=
-cloud.google.com/go/compute v1.14.0/go.mod h1:YfLtxrj9sU4Yxv+sXzZkyPjEyPBZfXHUvjxega5vAdo=
-cloud.google.com/go/compute v1.15.1/go.mod h1:bjjoF/NtFUrkD/urWfdHaKuOPDR5nWIs63rR+SXhcpA=
-cloud.google.com/go/compute v1.18.0/go.mod h1:1X7yHxec2Ga+Ss6jPyjxRxpu2uu7PLgsOVXvgU0yacs=
-cloud.google.com/go/compute v1.19.0/go.mod h1:rikpw2y+UMidAe9tISo04EHNOIf42RLYF/q8Bs93scU=
-cloud.google.com/go/compute v1.19.1 h1:am86mquDUgjGNWxiGn+5PGLbmgiWXlE/yNWpIpNvuXY=
-cloud.google.com/go/compute v1.19.1/go.mod h1:6ylj3a05WF8leseCdIf77NK0g1ey+nj5IKd5/kvShxE=
-cloud.google.com/go/compute/metadata v0.1.0/go.mod h1:Z1VN+bulIf6bt4P/C37K4DyZYZEXYonfTBHHFPO/4UU=
-cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
-cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/contactcenterinsights v1.3.0/go.mod h1:Eu2oemoePuEFc/xKFPjbTuPSj0fYJcPls9TFlPNnHHY=
-cloud.google.com/go/contactcenterinsights v1.4.0/go.mod h1:L2YzkGbPsv+vMQMCADxJoT9YiTTnSEd6fEvCeHTYVck=
-cloud.google.com/go/contactcenterinsights v1.6.0/go.mod h1:IIDlT6CLcDoyv79kDv8iWxMSTZhLxSCofVV5W6YFM/w=
-cloud.google.com/go/container v1.6.0/go.mod h1:Xazp7GjJSeUYo688S+6J5V+n/t+G5sKBTFkKNudGRxg=
-cloud.google.com/go/container v1.7.0/go.mod h1:Dp5AHtmothHGX3DwwIHPgq45Y8KmNsgN3amoYfxVkLo=
-cloud.google.com/go/container v1.13.1/go.mod h1:6wgbMPeQRw9rSnKBCAJXnds3Pzj03C4JHamr8asWKy4=
-cloud.google.com/go/container v1.14.0/go.mod h1:3AoJMPhHfLDxLvrlVWaK57IXzaPnLaZq63WX59aQBfM=
-cloud.google.com/go/container v1.15.0/go.mod h1:ft+9S0WGjAyjDggg5S06DXj+fHJICWg8L7isCQe9pQA=
-cloud.google.com/go/containeranalysis v0.5.1/go.mod h1:1D92jd8gRR/c0fGMlymRgxWD3Qw9C1ff6/T7mLgVL8I=
-cloud.google.com/go/containeranalysis v0.6.0/go.mod h1:HEJoiEIu+lEXM+k7+qLCci0h33lX3ZqoYFdmPcoO7s4=
-cloud.google.com/go/containeranalysis v0.7.0/go.mod h1:9aUL+/vZ55P2CXfuZjS4UjQ9AgXoSw8Ts6lemfmxBxI=
-cloud.google.com/go/containeranalysis v0.9.0/go.mod h1:orbOANbwk5Ejoom+s+DUCTTJ7IBdBQJDcSylAx/on9s=
-cloud.google.com/go/datacatalog v1.3.0/go.mod h1:g9svFY6tuR+j+hrTw3J2dNcmI0dzmSiyOzm8kpLq0a0=
-cloud.google.com/go/datacatalog v1.5.0/go.mod h1:M7GPLNQeLfWqeIm3iuiruhPzkt65+Bx8dAKvScX8jvs=
-cloud.google.com/go/datacatalog v1.6.0/go.mod h1:+aEyF8JKg+uXcIdAmmaMUmZ3q1b/lKLtXCmXdnc0lbc=
-cloud.google.com/go/datacatalog v1.7.0/go.mod h1:9mEl4AuDYWw81UGc41HonIHH7/sn52H0/tc8f8ZbZIE=
-cloud.google.com/go/datacatalog v1.8.0/go.mod h1:KYuoVOv9BM8EYz/4eMFxrr4DUKhGIOXxZoKYF5wdISM=
-cloud.google.com/go/datacatalog v1.8.1/go.mod h1:RJ58z4rMp3gvETA465Vg+ag8BGgBdnRPEMMSTr5Uv+M=
-cloud.google.com/go/datacatalog v1.12.0/go.mod h1:CWae8rFkfp6LzLumKOnmVh4+Zle4A3NXLzVJ1d1mRm0=
-cloud.google.com/go/datacatalog v1.13.0/go.mod h1:E4Rj9a5ZtAxcQJlEBTLgMTphfP11/lNaAshpoBgemX8=
-cloud.google.com/go/dataflow v0.6.0/go.mod h1:9QwV89cGoxjjSR9/r7eFDqqjtvbKxAK2BaYU6PVk9UM=
-cloud.google.com/go/dataflow v0.7.0/go.mod h1:PX526vb4ijFMesO1o202EaUmouZKBpjHsTlCtB4parQ=
-cloud.google.com/go/dataflow v0.8.0/go.mod h1:Rcf5YgTKPtQyYz8bLYhFoIV/vP39eL7fWNcSOyFfLJE=
-cloud.google.com/go/dataform v0.3.0/go.mod h1:cj8uNliRlHpa6L3yVhDOBrUXH+BPAO1+KFMQQNSThKo=
-cloud.google.com/go/dataform v0.4.0/go.mod h1:fwV6Y4Ty2yIFL89huYlEkwUPtS7YZinZbzzj5S9FzCE=
-cloud.google.com/go/dataform v0.5.0/go.mod h1:GFUYRe8IBa2hcomWplodVmUx/iTL0FrsauObOM3Ipr0=
-cloud.google.com/go/dataform v0.6.0/go.mod h1:QPflImQy33e29VuapFdf19oPbE4aYTJxr31OAPV+ulA=
-cloud.google.com/go/dataform v0.7.0/go.mod h1:7NulqnVozfHvWUBpMDfKMUESr+85aJsC/2O0o3jWPDE=
-cloud.google.com/go/datafusion v1.4.0/go.mod h1:1Zb6VN+W6ALo85cXnM1IKiPw+yQMKMhB9TsTSRDo/38=
-cloud.google.com/go/datafusion v1.5.0/go.mod h1:Kz+l1FGHB0J+4XF2fud96WMmRiq/wj8N9u007vyXZ2w=
-cloud.google.com/go/datafusion v1.6.0/go.mod h1:WBsMF8F1RhSXvVM8rCV3AeyWVxcC2xY6vith3iw3S+8=
-cloud.google.com/go/datalabeling v0.5.0/go.mod h1:TGcJ0G2NzcsXSE/97yWjIZO0bXj0KbVlINXMG9ud42I=
-cloud.google.com/go/datalabeling v0.6.0/go.mod h1:WqdISuk/+WIGeMkpw/1q7bK/tFEZxsrFJOJdY2bXvTQ=
-cloud.google.com/go/datalabeling v0.7.0/go.mod h1:WPQb1y08RJbmpM3ww0CSUAGweL0SxByuW2E+FU+wXcM=
-cloud.google.com/go/dataplex v1.3.0/go.mod h1:hQuRtDg+fCiFgC8j0zV222HvzFQdRd+SVX8gdmFcZzA=
-cloud.google.com/go/dataplex v1.4.0/go.mod h1:X51GfLXEMVJ6UN47ESVqvlsRplbLhcsAt0kZCCKsU0A=
-cloud.google.com/go/dataplex v1.5.2/go.mod h1:cVMgQHsmfRoI5KFYq4JtIBEUbYwc3c7tXmIDhRmNNVQ=
-cloud.google.com/go/dataplex v1.6.0/go.mod h1:bMsomC/aEJOSpHXdFKFGQ1b0TDPIeL28nJObeO1ppRs=
-cloud.google.com/go/dataproc v1.7.0/go.mod h1:CKAlMjII9H90RXaMpSxQ8EU6dQx6iAYNPcYPOkSbi8s=
-cloud.google.com/go/dataproc v1.8.0/go.mod h1:5OW+zNAH0pMpw14JVrPONsxMQYMBqJuzORhIBfBn9uI=
-cloud.google.com/go/dataproc v1.12.0/go.mod h1:zrF3aX0uV3ikkMz6z4uBbIKyhRITnxvr4i3IjKsKrw4=
-cloud.google.com/go/dataqna v0.5.0/go.mod h1:90Hyk596ft3zUQ8NkFfvICSIfHFh1Bc7C4cK3vbhkeo=
-cloud.google.com/go/dataqna v0.6.0/go.mod h1:1lqNpM7rqNLVgWBJyk5NF6Uen2PHym0jtVJonplVsDA=
-cloud.google.com/go/dataqna v0.7.0/go.mod h1:Lx9OcIIeqCrw1a6KdO3/5KMP1wAmTc0slZWwP12Qq3c=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/datastore v1.10.0/go.mod h1:PC5UzAmDEkAmkfaknstTYbNpgE49HAgW2J1gcgUfmdM=
-cloud.google.com/go/datastore v1.11.0/go.mod h1:TvGxBIHCS50u8jzG+AW/ppf87v1of8nwzFNgEZU1D3c=
-cloud.google.com/go/datastream v1.2.0/go.mod h1:i/uTP8/fZwgATHS/XFu0TcNUhuA0twZxxQ3EyCUQMwo=
-cloud.google.com/go/datastream v1.3.0/go.mod h1:cqlOX8xlyYF/uxhiKn6Hbv6WjwPPuI9W2M9SAXwaLLQ=
-cloud.google.com/go/datastream v1.4.0/go.mod h1:h9dpzScPhDTs5noEMQVWP8Wx8AFBRyS0s8KWPx/9r0g=
-cloud.google.com/go/datastream v1.5.0/go.mod h1:6TZMMNPwjUqZHBKPQ1wwXpb0d5VDVPl2/XoS5yi88q4=
-cloud.google.com/go/datastream v1.6.0/go.mod h1:6LQSuswqLa7S4rPAOZFVjHIG3wJIjZcZrw8JDEDJuIs=
-cloud.google.com/go/datastream v1.7.0/go.mod h1:uxVRMm2elUSPuh65IbZpzJNMbuzkcvu5CjMqVIUHrww=
-cloud.google.com/go/deploy v1.4.0/go.mod h1:5Xghikd4VrmMLNaF6FiRFDlHb59VM59YoDQnOUdsH/c=
-cloud.google.com/go/deploy v1.5.0/go.mod h1:ffgdD0B89tToyW/U/D2eL0jN2+IEV/3EMuXHA0l4r+s=
-cloud.google.com/go/deploy v1.6.0/go.mod h1:f9PTHehG/DjCom3QH0cntOVRm93uGBDt2vKzAPwpXQI=
-cloud.google.com/go/deploy v1.8.0/go.mod h1:z3myEJnA/2wnB4sgjqdMfgxCA0EqC3RBTNcVPs93mtQ=
-cloud.google.com/go/dialogflow v1.15.0/go.mod h1:HbHDWs33WOGJgn6rfzBW1Kv807BE3O1+xGbn59zZWI4=
-cloud.google.com/go/dialogflow v1.16.1/go.mod h1:po6LlzGfK+smoSmTBnbkIZY2w8ffjz/RcGSS+sh1el0=
-cloud.google.com/go/dialogflow v1.17.0/go.mod h1:YNP09C/kXA1aZdBgC/VtXX74G/TKn7XVCcVumTflA+8=
-cloud.google.com/go/dialogflow v1.18.0/go.mod h1:trO7Zu5YdyEuR+BhSNOqJezyFQ3aUzz0njv7sMx/iek=
-cloud.google.com/go/dialogflow v1.19.0/go.mod h1:JVmlG1TwykZDtxtTXujec4tQ+D8SBFMoosgy+6Gn0s0=
-cloud.google.com/go/dialogflow v1.29.0/go.mod h1:b+2bzMe+k1s9V+F2jbJwpHPzrnIyHihAdRFMtn2WXuM=
-cloud.google.com/go/dialogflow v1.31.0/go.mod h1:cuoUccuL1Z+HADhyIA7dci3N5zUssgpBJmCzI6fNRB4=
-cloud.google.com/go/dialogflow v1.32.0/go.mod h1:jG9TRJl8CKrDhMEcvfcfFkkpp8ZhgPz3sBGmAUYJ2qE=
-cloud.google.com/go/dlp v1.6.0/go.mod h1:9eyB2xIhpU0sVwUixfBubDoRwP+GjeUoxxeueZmqvmM=
-cloud.google.com/go/dlp v1.7.0/go.mod h1:68ak9vCiMBjbasxeVD17hVPxDEck+ExiHavX8kiHG+Q=
-cloud.google.com/go/dlp v1.9.0/go.mod h1:qdgmqgTyReTz5/YNSSuueR8pl7hO0o9bQ39ZhtgkWp4=
-cloud.google.com/go/documentai v1.7.0/go.mod h1:lJvftZB5NRiFSX4moiye1SMxHx0Bc3x1+p9e/RfXYiU=
-cloud.google.com/go/documentai v1.8.0/go.mod h1:xGHNEB7CtsnySCNrCFdCyyMz44RhFEEX2Q7UD0c5IhU=
-cloud.google.com/go/documentai v1.9.0/go.mod h1:FS5485S8R00U10GhgBC0aNGrJxBP8ZVpEeJ7PQDZd6k=
-cloud.google.com/go/documentai v1.10.0/go.mod h1:vod47hKQIPeCfN2QS/jULIvQTugbmdc0ZvxxfQY1bg4=
-cloud.google.com/go/documentai v1.16.0/go.mod h1:o0o0DLTEZ+YnJZ+J4wNfTxmDVyrkzFvttBXXtYRMHkM=
-cloud.google.com/go/documentai v1.18.0/go.mod h1:F6CK6iUH8J81FehpskRmhLq/3VlwQvb7TvwOceQ2tbs=
-cloud.google.com/go/domains v0.6.0/go.mod h1:T9Rz3GasrpYk6mEGHh4rymIhjlnIuB4ofT1wTxDeT4Y=
-cloud.google.com/go/domains v0.7.0/go.mod h1:PtZeqS1xjnXuRPKE/88Iru/LdfoRyEHYA9nFQf4UKpg=
-cloud.google.com/go/domains v0.8.0/go.mod h1:M9i3MMDzGFXsydri9/vW+EWz9sWb4I6WyHqdlAk0idE=
-cloud.google.com/go/edgecontainer v0.1.0/go.mod h1:WgkZ9tp10bFxqO8BLPqv2LlfmQF1X8lZqwW4r1BTajk=
-cloud.google.com/go/edgecontainer v0.2.0/go.mod h1:RTmLijy+lGpQ7BXuTDa4C4ssxyXT34NIuHIgKuP4s5w=
-cloud.google.com/go/edgecontainer v0.3.0/go.mod h1:FLDpP4nykgwwIfcLt6zInhprzw0lEi2P1fjO6Ie0qbc=
-cloud.google.com/go/edgecontainer v1.0.0/go.mod h1:cttArqZpBB2q58W/upSG++ooo6EsblxDIolxa3jSjbY=
-cloud.google.com/go/errorreporting v0.3.0/go.mod h1:xsP2yaAp+OAW4OIm60An2bbLpqIhKXdWR/tawvl7QzU=
-cloud.google.com/go/essentialcontacts v1.3.0/go.mod h1:r+OnHa5jfj90qIfZDO/VztSFqbQan7HV75p8sA+mdGI=
-cloud.google.com/go/essentialcontacts v1.4.0/go.mod h1:8tRldvHYsmnBCHdFpvU+GL75oWiBKl80BiqlFh9tp+8=
-cloud.google.com/go/essentialcontacts v1.5.0/go.mod h1:ay29Z4zODTuwliK7SnX8E86aUF2CTzdNtvv42niCX0M=
-cloud.google.com/go/eventarc v1.7.0/go.mod h1:6ctpF3zTnaQCxUjHUdcfgcA1A2T309+omHZth7gDfmc=
-cloud.google.com/go/eventarc v1.8.0/go.mod h1:imbzxkyAU4ubfsaKYdQg04WS1NvncblHEup4kvF+4gw=
-cloud.google.com/go/eventarc v1.10.0/go.mod h1:u3R35tmZ9HvswGRBnF48IlYgYeBcPUCjkr4BTdem2Kw=
-cloud.google.com/go/eventarc v1.11.0/go.mod h1:PyUjsUKPWoRBCHeOxZd/lbOOjahV41icXyUY5kSTvVY=
-cloud.google.com/go/filestore v1.3.0/go.mod h1:+qbvHGvXU1HaKX2nD0WEPo92TP/8AQuCVEBXNY9z0+w=
-cloud.google.com/go/filestore v1.4.0/go.mod h1:PaG5oDfo9r224f8OYXURtAsY+Fbyq/bLYoINEK8XQAI=
-cloud.google.com/go/filestore v1.5.0/go.mod h1:FqBXDWBp4YLHqRnVGveOkHDf8svj9r5+mUDLupOWEDs=
-cloud.google.com/go/filestore v1.6.0/go.mod h1:di5unNuss/qfZTw2U9nhFqo8/ZDSc466dre85Kydllg=
-cloud.google.com/go/firestore v1.9.0/go.mod h1:HMkjKHNTtRyZNiMzu7YAsLr9K3X2udY2AMwDaMEQiiE=
-cloud.google.com/go/functions v1.6.0/go.mod h1:3H1UA3qiIPRWD7PeZKLvHZ9SaQhR26XIJcC0A5GbvAk=
-cloud.google.com/go/functions v1.7.0/go.mod h1:+d+QBcWM+RsrgZfV9xo6KfA1GlzJfxcfZcRPEhDDfzg=
-cloud.google.com/go/functions v1.8.0/go.mod h1:RTZ4/HsQjIqIYP9a9YPbU+QFoQsAlYgrwOXJWHn1POY=
-cloud.google.com/go/functions v1.9.0/go.mod h1:Y+Dz8yGguzO3PpIjhLTbnqV1CWmgQ5UwtlpzoyquQ08=
-cloud.google.com/go/functions v1.10.0/go.mod h1:0D3hEOe3DbEvCXtYOZHQZmD+SzYsi1YbI7dGvHfldXw=
-cloud.google.com/go/functions v1.12.0/go.mod h1:AXWGrF3e2C/5ehvwYo/GH6O5s09tOPksiKhz+hH8WkA=
-cloud.google.com/go/functions v1.13.0/go.mod h1:EU4O007sQm6Ef/PwRsI8N2umygGqPBS/IZQKBQBcJ3c=
-cloud.google.com/go/gaming v1.5.0/go.mod h1:ol7rGcxP/qHTRQE/RO4bxkXq+Fix0j6D4LFPzYTIrDM=
-cloud.google.com/go/gaming v1.6.0/go.mod h1:YMU1GEvA39Qt3zWGyAVA9bpYz/yAhTvaQ1t2sK4KPUA=
-cloud.google.com/go/gaming v1.7.0/go.mod h1:LrB8U7MHdGgFG851iHAfqUdLcKBdQ55hzXy9xBJz0+w=
-cloud.google.com/go/gaming v1.8.0/go.mod h1:xAqjS8b7jAVW0KFYeRUxngo9My3f33kFmua++Pi+ggM=
-cloud.google.com/go/gaming v1.9.0/go.mod h1:Fc7kEmCObylSWLO334NcO+O9QMDyz+TKC4v1D7X+Bc0=
-cloud.google.com/go/gkebackup v0.2.0/go.mod h1:XKvv/4LfG829/B8B7xRkk8zRrOEbKtEam6yNfuQNH60=
-cloud.google.com/go/gkebackup v0.3.0/go.mod h1:n/E671i1aOQvUxT541aTkCwExO/bTer2HDlj4TsBRAo=
-cloud.google.com/go/gkebackup v0.4.0/go.mod h1:byAyBGUwYGEEww7xsbnUTBHIYcOPy/PgUWUtOeRm9Vg=
-cloud.google.com/go/gkeconnect v0.5.0/go.mod h1:c5lsNAg5EwAy7fkqX/+goqFsU1Da/jQFqArp+wGNr/o=
-cloud.google.com/go/gkeconnect v0.6.0/go.mod h1:Mln67KyU/sHJEBY8kFZ0xTeyPtzbq9StAVvEULYK16A=
-cloud.google.com/go/gkeconnect v0.7.0/go.mod h1:SNfmVqPkaEi3bF/B3CNZOAYPYdg7sU+obZ+QTky2Myw=
-cloud.google.com/go/gkehub v0.9.0/go.mod h1:WYHN6WG8w9bXU0hqNxt8rm5uxnk8IH+lPY9J2TV7BK0=
-cloud.google.com/go/gkehub v0.10.0/go.mod h1:UIPwxI0DsrpsVoWpLB0stwKCP+WFVG9+y977wO+hBH0=
-cloud.google.com/go/gkehub v0.11.0/go.mod h1:JOWHlmN+GHyIbuWQPl47/C2RFhnFKH38jH9Ascu3n0E=
-cloud.google.com/go/gkehub v0.12.0/go.mod h1:djiIwwzTTBrF5NaXCGv3mf7klpEMcST17VBTVVDcuaw=
-cloud.google.com/go/gkemulticloud v0.3.0/go.mod h1:7orzy7O0S+5kq95e4Hpn7RysVA7dPs8W/GgfUtsPbrA=
-cloud.google.com/go/gkemulticloud v0.4.0/go.mod h1:E9gxVBnseLWCk24ch+P9+B2CoDFJZTyIgLKSalC7tuI=
-cloud.google.com/go/gkemulticloud v0.5.0/go.mod h1:W0JDkiyi3Tqh0TJr//y19wyb1yf8llHVto2Htf2Ja3Y=
-cloud.google.com/go/grafeas v0.2.0/go.mod h1:KhxgtF2hb0P191HlY5besjYm6MqTSTj3LSI+M+ByZHc=
-cloud.google.com/go/gsuiteaddons v1.3.0/go.mod h1:EUNK/J1lZEZO8yPtykKxLXI6JSVN2rg9bN8SXOa0bgM=
-cloud.google.com/go/gsuiteaddons v1.4.0/go.mod h1:rZK5I8hht7u7HxFQcFei0+AtfS9uSushomRlg+3ua1o=
-cloud.google.com/go/gsuiteaddons v1.5.0/go.mod h1:TFCClYLd64Eaa12sFVmUyG62tk4mdIsI7pAnSXRkcFo=
-cloud.google.com/go/iam v0.1.0/go.mod h1:vcUNEa0pEm0qRVpmWepWaFMIAI8/hjB9mO8rNCJtF6c=
-cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
-cloud.google.com/go/iam v0.5.0/go.mod h1:wPU9Vt0P4UmCux7mqtRu6jcpPAb74cP1fh50J3QpkUc=
-cloud.google.com/go/iam v0.6.0/go.mod h1:+1AH33ueBne5MzYccyMHtEKqLE4/kJOibtffMHDMFMc=
-cloud.google.com/go/iam v0.7.0/go.mod h1:H5Br8wRaDGNc8XP3keLc4unfUUZeyH3Sfl9XpQEYOeg=
-cloud.google.com/go/iam v0.8.0/go.mod h1:lga0/y3iH6CX7sYqypWJ33hf7kkfXJag67naqGESjkE=
-cloud.google.com/go/iam v0.11.0/go.mod h1:9PiLDanza5D+oWFZiH1uG+RnRCfEGKoyl6yo4cgWZGY=
-cloud.google.com/go/iam v0.12.0/go.mod h1:knyHGviacl11zrtZUoDuYpDgLjvr28sLQaG0YB2GYAY=
-cloud.google.com/go/iam v0.13.0 h1:+CmB+K0J/33d0zSQ9SlFWUeCCEn5XJA0ZMZ3pHE9u8k=
-cloud.google.com/go/iam v0.13.0/go.mod h1:ljOg+rcNfzZ5d6f1nAUJ8ZIxOaZUVoS14bKCtaLZ/D0=
-cloud.google.com/go/iap v1.4.0/go.mod h1:RGFwRJdihTINIe4wZ2iCP0zF/qu18ZwyKxrhMhygBEc=
-cloud.google.com/go/iap v1.5.0/go.mod h1:UH/CGgKd4KyohZL5Pt0jSKE4m3FR51qg6FKQ/z/Ix9A=
-cloud.google.com/go/iap v1.6.0/go.mod h1:NSuvI9C/j7UdjGjIde7t7HBz+QTwBcapPE07+sSRcLk=
-cloud.google.com/go/iap v1.7.0/go.mod h1:beqQx56T9O1G1yNPph+spKpNibDlYIiIixiqsQXxLIo=
-cloud.google.com/go/iap v1.7.1/go.mod h1:WapEwPc7ZxGt2jFGB/C/bm+hP0Y6NXzOYGjpPnmMS74=
-cloud.google.com/go/ids v1.1.0/go.mod h1:WIuwCaYVOzHIj2OhN9HAwvW+DBdmUAdcWlFxRl+KubM=
-cloud.google.com/go/ids v1.2.0/go.mod h1:5WXvp4n25S0rA/mQWAg1YEEBBq6/s+7ml1RDCW1IrcY=
-cloud.google.com/go/ids v1.3.0/go.mod h1:JBdTYwANikFKaDP6LtW5JAi4gubs57SVNQjemdt6xV4=
-cloud.google.com/go/iot v1.3.0/go.mod h1:r7RGh2B61+B8oz0AGE+J72AhA0G7tdXItODWsaA2oLs=
-cloud.google.com/go/iot v1.4.0/go.mod h1:dIDxPOn0UvNDUMD8Ger7FIaTuvMkj+aGk94RPP0iV+g=
-cloud.google.com/go/iot v1.5.0/go.mod h1:mpz5259PDl3XJthEmh9+ap0affn/MqNSP4My77Qql9o=
-cloud.google.com/go/iot v1.6.0/go.mod h1:IqdAsmE2cTYYNO1Fvjfzo9po179rAtJeVGUvkLN3rLE=
-cloud.google.com/go/kms v1.4.0/go.mod h1:fajBHndQ+6ubNw6Ss2sSd+SWvjL26RNo/dr7uxsnnOA=
-cloud.google.com/go/kms v1.5.0/go.mod h1:QJS2YY0eJGBg3mnDfuaCyLauWwBJiHRboYxJ++1xJNg=
-cloud.google.com/go/kms v1.6.0/go.mod h1:Jjy850yySiasBUDi6KFUwUv2n1+o7QZFyuUJg6OgjA0=
-cloud.google.com/go/kms v1.8.0/go.mod h1:4xFEhYFqvW+4VMELtZyxomGSYtSQKzM178ylFW4jMAg=
-cloud.google.com/go/kms v1.9.0/go.mod h1:qb1tPTgfF9RQP8e1wq4cLFErVuTJv7UsSC915J8dh3w=
-cloud.google.com/go/kms v1.10.0/go.mod h1:ng3KTUtQQU9bPX3+QGLsflZIHlkbn8amFAMY63m8d24=
-cloud.google.com/go/kms v1.10.1/go.mod h1:rIWk/TryCkR59GMC3YtHtXeLzd634lBbKenvyySAyYI=
-cloud.google.com/go/language v1.4.0/go.mod h1:F9dRpNFQmJbkaop6g0JhSBXCNlO90e1KWx5iDdxbWic=
-cloud.google.com/go/language v1.6.0/go.mod h1:6dJ8t3B+lUYfStgls25GusK04NLh3eDLQnWM3mdEbhI=
-cloud.google.com/go/language v1.7.0/go.mod h1:DJ6dYN/W+SQOjF8e1hLQXMF21AkH2w9wiPzPCJa2MIE=
-cloud.google.com/go/language v1.8.0/go.mod h1:qYPVHf7SPoNNiCL2Dr0FfEFNil1qi3pQEyygwpgVKB8=
-cloud.google.com/go/language v1.9.0/go.mod h1:Ns15WooPM5Ad/5no/0n81yUetis74g3zrbeJBE+ptUY=
-cloud.google.com/go/lifesciences v0.5.0/go.mod h1:3oIKy8ycWGPUyZDR/8RNnTOYevhaMLqh5vLUXs9zvT8=
-cloud.google.com/go/lifesciences v0.6.0/go.mod h1:ddj6tSX/7BOnhxCSd3ZcETvtNr8NZ6t/iPhY2Tyfu08=
-cloud.google.com/go/lifesciences v0.8.0/go.mod h1:lFxiEOMqII6XggGbOnKiyZ7IBwoIqA84ClvoezaA/bo=
-cloud.google.com/go/logging v1.6.1/go.mod h1:5ZO0mHHbvm8gEmeEUHrmDlTDSu5imF6MUP9OfilNXBw=
-cloud.google.com/go/logging v1.7.0/go.mod h1:3xjP2CjkM3ZkO73aj4ASA5wRPGGCRrPIAeNqVNkzY8M=
-cloud.google.com/go/longrunning v0.1.1/go.mod h1:UUFxuDWkv22EuY93jjmDMFT5GPQKeFVJBIF6QlTqdsE=
-cloud.google.com/go/longrunning v0.3.0/go.mod h1:qth9Y41RRSUE69rDcOn6DdK3HfQfsUI0YSmW3iIlLJc=
-cloud.google.com/go/longrunning v0.4.1 h1:v+yFJOfKC3yZdY6ZUI933pIYdhyhV8S3NpWrXWmg7jM=
-cloud.google.com/go/longrunning v0.4.1/go.mod h1:4iWDqhBZ70CvZ6BfETbvam3T8FMvLK+eFj0E6AaRQTo=
-cloud.google.com/go/managedidentities v1.3.0/go.mod h1:UzlW3cBOiPrzucO5qWkNkh0w33KFtBJU281hacNvsdE=
-cloud.google.com/go/managedidentities v1.4.0/go.mod h1:NWSBYbEMgqmbZsLIyKvxrYbtqOsxY1ZrGM+9RgDqInM=
-cloud.google.com/go/managedidentities v1.5.0/go.mod h1:+dWcZ0JlUmpuxpIDfyP5pP5y0bLdRwOS4Lp7gMni/LA=
-cloud.google.com/go/maps v0.1.0/go.mod h1:BQM97WGyfw9FWEmQMpZ5T6cpovXXSd1cGmFma94eubI=
-cloud.google.com/go/maps v0.6.0/go.mod h1:o6DAMMfb+aINHz/p/jbcY+mYeXBoZoxTfdSQ8VAJaCw=
-cloud.google.com/go/maps v0.7.0/go.mod h1:3GnvVl3cqeSvgMcpRlQidXsPYuDGQ8naBis7MVzpXsY=
-cloud.google.com/go/mediatranslation v0.5.0/go.mod h1:jGPUhGTybqsPQn91pNXw0xVHfuJ3leR1wj37oU3y1f4=
-cloud.google.com/go/mediatranslation v0.6.0/go.mod h1:hHdBCTYNigsBxshbznuIMFNe5QXEowAuNmmC7h8pu5w=
-cloud.google.com/go/mediatranslation v0.7.0/go.mod h1:LCnB/gZr90ONOIQLgSXagp8XUW1ODs2UmUMvcgMfI2I=
-cloud.google.com/go/memcache v1.4.0/go.mod h1:rTOfiGZtJX1AaFUrOgsMHX5kAzaTQ8azHiuDoTPzNsE=
-cloud.google.com/go/memcache v1.5.0/go.mod h1:dk3fCK7dVo0cUU2c36jKb4VqKPS22BTkf81Xq617aWM=
-cloud.google.com/go/memcache v1.6.0/go.mod h1:XS5xB0eQZdHtTuTF9Hf8eJkKtR3pVRCcvJwtm68T3rA=
-cloud.google.com/go/memcache v1.7.0/go.mod h1:ywMKfjWhNtkQTxrWxCkCFkoPjLHPW6A7WOTVI8xy3LY=
-cloud.google.com/go/memcache v1.9.0/go.mod h1:8oEyzXCu+zo9RzlEaEjHl4KkgjlNDaXbCQeQWlzNFJM=
-cloud.google.com/go/metastore v1.5.0/go.mod h1:2ZNrDcQwghfdtCwJ33nM0+GrBGlVuh8rakL3vdPY3XY=
-cloud.google.com/go/metastore v1.6.0/go.mod h1:6cyQTls8CWXzk45G55x57DVQ9gWg7RiH65+YgPsNh9s=
-cloud.google.com/go/metastore v1.7.0/go.mod h1:s45D0B4IlsINu87/AsWiEVYbLaIMeUSoxlKKDqBGFS8=
-cloud.google.com/go/metastore v1.8.0/go.mod h1:zHiMc4ZUpBiM7twCIFQmJ9JMEkDSyZS9U12uf7wHqSI=
-cloud.google.com/go/metastore v1.10.0/go.mod h1:fPEnH3g4JJAk+gMRnrAnoqyv2lpUCqJPWOodSaf45Eo=
-cloud.google.com/go/monitoring v1.7.0/go.mod h1:HpYse6kkGo//7p6sT0wsIC6IBDET0RhIsnmlA53dvEk=
-cloud.google.com/go/monitoring v1.8.0/go.mod h1:E7PtoMJ1kQXWxPjB6mv2fhC5/15jInuulFdYYtlcvT4=
-cloud.google.com/go/monitoring v1.12.0/go.mod h1:yx8Jj2fZNEkL/GYZyTLS4ZtZEZN8WtDEiEqG4kLK50w=
-cloud.google.com/go/monitoring v1.13.0/go.mod h1:k2yMBAB1H9JT/QETjNkgdCGD9bPF712XiLTVr+cBrpw=
-cloud.google.com/go/networkconnectivity v1.4.0/go.mod h1:nOl7YL8odKyAOtzNX73/M5/mGZgqqMeryi6UPZTk/rA=
-cloud.google.com/go/networkconnectivity v1.5.0/go.mod h1:3GzqJx7uhtlM3kln0+x5wyFvuVH1pIBJjhCpjzSt75o=
-cloud.google.com/go/networkconnectivity v1.6.0/go.mod h1:OJOoEXW+0LAxHh89nXd64uGG+FbQoeH8DtxCHVOMlaM=
-cloud.google.com/go/networkconnectivity v1.7.0/go.mod h1:RMuSbkdbPwNMQjB5HBWD5MpTBnNm39iAVpC3TmsExt8=
-cloud.google.com/go/networkconnectivity v1.10.0/go.mod h1:UP4O4sWXJG13AqrTdQCD9TnLGEbtNRqjuaaA7bNjF5E=
-cloud.google.com/go/networkconnectivity v1.11.0/go.mod h1:iWmDD4QF16VCDLXUqvyspJjIEtBR/4zq5hwnY2X3scM=
-cloud.google.com/go/networkmanagement v1.4.0/go.mod h1:Q9mdLLRn60AsOrPc8rs8iNV6OHXaGcDdsIQe1ohekq8=
-cloud.google.com/go/networkmanagement v1.5.0/go.mod h1:ZnOeZ/evzUdUsnvRt792H0uYEnHQEMaz+REhhzJRcf4=
-cloud.google.com/go/networkmanagement v1.6.0/go.mod h1:5pKPqyXjB/sgtvB5xqOemumoQNB7y95Q7S+4rjSOPYY=
-cloud.google.com/go/networksecurity v0.5.0/go.mod h1:xS6fOCoqpVC5zx15Z/MqkfDwH4+m/61A3ODiDV1xmiQ=
-cloud.google.com/go/networksecurity v0.6.0/go.mod h1:Q5fjhTr9WMI5mbpRYEbiexTzROf7ZbDzvzCrNl14nyU=
-cloud.google.com/go/networksecurity v0.7.0/go.mod h1:mAnzoxx/8TBSyXEeESMy9OOYwo1v+gZ5eMRnsT5bC8k=
-cloud.google.com/go/networksecurity v0.8.0/go.mod h1:B78DkqsxFG5zRSVuwYFRZ9Xz8IcQ5iECsNrPn74hKHU=
-cloud.google.com/go/notebooks v1.2.0/go.mod h1:9+wtppMfVPUeJ8fIWPOq1UnATHISkGXGqTkxeieQ6UY=
-cloud.google.com/go/notebooks v1.3.0/go.mod h1:bFR5lj07DtCPC7YAAJ//vHskFBxA5JzYlH68kXVdk34=
-cloud.google.com/go/notebooks v1.4.0/go.mod h1:4QPMngcwmgb6uw7Po99B2xv5ufVoIQ7nOGDyL4P8AgA=
-cloud.google.com/go/notebooks v1.5.0/go.mod h1:q8mwhnP9aR8Hpfnrc5iN5IBhrXUy8S2vuYs+kBJ/gu0=
-cloud.google.com/go/notebooks v1.7.0/go.mod h1:PVlaDGfJgj1fl1S3dUwhFMXFgfYGhYQt2164xOMONmE=
-cloud.google.com/go/notebooks v1.8.0/go.mod h1:Lq6dYKOYOWUCTvw5t2q1gp1lAp0zxAxRycayS0iJcqQ=
-cloud.google.com/go/optimization v1.1.0/go.mod h1:5po+wfvX5AQlPznyVEZjGJTMr4+CAkJf2XSTQOOl9l4=
-cloud.google.com/go/optimization v1.2.0/go.mod h1:Lr7SOHdRDENsh+WXVmQhQTrzdu9ybg0NecjHidBq6xs=
-cloud.google.com/go/optimization v1.3.1/go.mod h1:IvUSefKiwd1a5p0RgHDbWCIbDFgKuEdB+fPPuP0IDLI=
-cloud.google.com/go/orchestration v1.3.0/go.mod h1:Sj5tq/JpWiB//X/q3Ngwdl5K7B7Y0KZ7bfv0wL6fqVA=
-cloud.google.com/go/orchestration v1.4.0/go.mod h1:6W5NLFWs2TlniBphAViZEVhrXRSMgUGDfW7vrWKvsBk=
-cloud.google.com/go/orchestration v1.6.0/go.mod h1:M62Bevp7pkxStDfFfTuCOaXgaaqRAga1yKyoMtEoWPQ=
-cloud.google.com/go/orgpolicy v1.4.0/go.mod h1:xrSLIV4RePWmP9P3tBl8S93lTmlAxjm06NSm2UTmKvE=
-cloud.google.com/go/orgpolicy v1.5.0/go.mod h1:hZEc5q3wzwXJaKrsx5+Ewg0u1LxJ51nNFlext7Tanwc=
-cloud.google.com/go/orgpolicy v1.10.0/go.mod h1:w1fo8b7rRqlXlIJbVhOMPrwVljyuW5mqssvBtU18ONc=
-cloud.google.com/go/osconfig v1.7.0/go.mod h1:oVHeCeZELfJP7XLxcBGTMBvRO+1nQ5tFG9VQTmYS2Fs=
-cloud.google.com/go/osconfig v1.8.0/go.mod h1:EQqZLu5w5XA7eKizepumcvWx+m8mJUhEwiPqWiZeEdg=
-cloud.google.com/go/osconfig v1.9.0/go.mod h1:Yx+IeIZJ3bdWmzbQU4fxNl8xsZ4amB+dygAwFPlvnNo=
-cloud.google.com/go/osconfig v1.10.0/go.mod h1:uMhCzqC5I8zfD9zDEAfvgVhDS8oIjySWh+l4WK6GnWw=
-cloud.google.com/go/osconfig v1.11.0/go.mod h1:aDICxrur2ogRd9zY5ytBLV89KEgT2MKB2L/n6x1ooPw=
-cloud.google.com/go/oslogin v1.4.0/go.mod h1:YdgMXWRaElXz/lDk1Na6Fh5orF7gvmJ0FGLIs9LId4E=
-cloud.google.com/go/oslogin v1.5.0/go.mod h1:D260Qj11W2qx/HVF29zBg+0fd6YCSjSqLUkY/qEenQU=
-cloud.google.com/go/oslogin v1.6.0/go.mod h1:zOJ1O3+dTU8WPlGEkFSh7qeHPPSoxrcMbbK1Nm2iX70=
-cloud.google.com/go/oslogin v1.7.0/go.mod h1:e04SN0xO1UNJ1M5GP0vzVBFicIe4O53FOfcixIqTyXo=
-cloud.google.com/go/oslogin v1.9.0/go.mod h1:HNavntnH8nzrn8JCTT5fj18FuJLFJc4NaZJtBnQtKFs=
-cloud.google.com/go/phishingprotection v0.5.0/go.mod h1:Y3HZknsK9bc9dMi+oE8Bim0lczMU6hrX0UpADuMefr0=
-cloud.google.com/go/phishingprotection v0.6.0/go.mod h1:9Y3LBLgy0kDTcYET8ZH3bq/7qni15yVUoAxiFxnlSUA=
-cloud.google.com/go/phishingprotection v0.7.0/go.mod h1:8qJI4QKHoda/sb/7/YmMQ2omRLSLYSu9bU0EKCNI+Lk=
-cloud.google.com/go/policytroubleshooter v1.3.0/go.mod h1:qy0+VwANja+kKrjlQuOzmlvscn4RNsAc0e15GGqfMxg=
-cloud.google.com/go/policytroubleshooter v1.4.0/go.mod h1:DZT4BcRw3QoO8ota9xw/LKtPa8lKeCByYeKTIf/vxdE=
-cloud.google.com/go/policytroubleshooter v1.5.0/go.mod h1:Rz1WfV+1oIpPdN2VvvuboLVRsB1Hclg3CKQ53j9l8vw=
-cloud.google.com/go/policytroubleshooter v1.6.0/go.mod h1:zYqaPTsmfvpjm5ULxAyD/lINQxJ0DDsnWOP/GZ7xzBc=
-cloud.google.com/go/privatecatalog v0.5.0/go.mod h1:XgosMUvvPyxDjAVNDYxJ7wBW8//hLDDYmnsNcMGq1K0=
-cloud.google.com/go/privatecatalog v0.6.0/go.mod h1:i/fbkZR0hLN29eEWiiwue8Pb+GforiEIBnV9yrRUOKI=
-cloud.google.com/go/privatecatalog v0.7.0/go.mod h1:2s5ssIFO69F5csTXcwBP7NPFTZvps26xGzvQ2PQaBYg=
-cloud.google.com/go/privatecatalog v0.8.0/go.mod h1:nQ6pfaegeDAq/Q5lrfCQzQLhubPiZhSaNhIgfJlnIXs=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/pubsub v1.26.0/go.mod h1:QgBH3U/jdJy/ftjPhTkyXNj543Tin1pRYcdcPRnFIRI=
-cloud.google.com/go/pubsub v1.27.1/go.mod h1:hQN39ymbV9geqBnfQq6Xf63yNhUAhv9CZhzp5O6qsW0=
-cloud.google.com/go/pubsub v1.28.0/go.mod h1:vuXFpwaVoIPQMGXqRyUQigu/AX1S3IWugR9xznmcXX8=
-cloud.google.com/go/pubsub v1.30.0/go.mod h1:qWi1OPS0B+b5L+Sg6Gmc9zD1Y+HaM0MdUr7LsupY1P4=
-cloud.google.com/go/pubsublite v1.5.0/go.mod h1:xapqNQ1CuLfGi23Yda/9l4bBCKz/wC3KIJ5gKcxveZg=
-cloud.google.com/go/pubsublite v1.6.0/go.mod h1:1eFCS0U11xlOuMFV/0iBqw3zP12kddMeCbj/F3FSj9k=
-cloud.google.com/go/pubsublite v1.7.0/go.mod h1:8hVMwRXfDfvGm3fahVbtDbiLePT3gpoiJYJY+vxWxVM=
-cloud.google.com/go/recaptchaenterprise v1.3.1/go.mod h1:OdD+q+y4XGeAlxRaMn1Y7/GveP6zmq76byL6tjPE7d4=
-cloud.google.com/go/recaptchaenterprise/v2 v2.1.0/go.mod h1:w9yVqajwroDNTfGuhmOjPDN//rZGySaf6PtFVcSCa7o=
-cloud.google.com/go/recaptchaenterprise/v2 v2.2.0/go.mod h1:/Zu5jisWGeERrd5HnlS3EUGb/D335f9k51B/FVil0jk=
-cloud.google.com/go/recaptchaenterprise/v2 v2.3.0/go.mod h1:O9LwGCjrhGHBQET5CA7dd5NwwNQUErSgEDit1DLNTdo=
-cloud.google.com/go/recaptchaenterprise/v2 v2.4.0/go.mod h1:Am3LHfOuBstrLrNCBrlI5sbwx9LBg3te2N6hGvHn2mE=
-cloud.google.com/go/recaptchaenterprise/v2 v2.5.0/go.mod h1:O8LzcHXN3rz0j+LBC91jrwI3R+1ZSZEWrfL7XHgNo9U=
-cloud.google.com/go/recaptchaenterprise/v2 v2.6.0/go.mod h1:RPauz9jeLtB3JVzg6nCbe12qNoaa8pXc4d/YukAmcnA=
-cloud.google.com/go/recaptchaenterprise/v2 v2.7.0/go.mod h1:19wVj/fs5RtYtynAPJdDTb69oW0vNHYDBTbB4NvMD9c=
-cloud.google.com/go/recommendationengine v0.5.0/go.mod h1:E5756pJcVFeVgaQv3WNpImkFP8a+RptV6dDLGPILjvg=
-cloud.google.com/go/recommendationengine v0.6.0/go.mod h1:08mq2umu9oIqc7tDy8sx+MNJdLG0fUi3vaSVbztHgJ4=
-cloud.google.com/go/recommendationengine v0.7.0/go.mod h1:1reUcE3GIu6MeBz/h5xZJqNLuuVjNg1lmWMPyjatzac=
-cloud.google.com/go/recommender v1.5.0/go.mod h1:jdoeiBIVrJe9gQjwd759ecLJbxCDED4A6p+mqoqDvTg=
-cloud.google.com/go/recommender v1.6.0/go.mod h1:+yETpm25mcoiECKh9DEScGzIRyDKpZ0cEhWGo+8bo+c=
-cloud.google.com/go/recommender v1.7.0/go.mod h1:XLHs/W+T8olwlGOgfQenXBTbIseGclClff6lhFVe9Bs=
-cloud.google.com/go/recommender v1.8.0/go.mod h1:PkjXrTT05BFKwxaUxQmtIlrtj0kph108r02ZZQ5FE70=
-cloud.google.com/go/recommender v1.9.0/go.mod h1:PnSsnZY7q+VL1uax2JWkt/UegHssxjUVVCrX52CuEmQ=
-cloud.google.com/go/redis v1.7.0/go.mod h1:V3x5Jq1jzUcg+UNsRvdmsfuFnit1cfe3Z/PGyq/lm4Y=
-cloud.google.com/go/redis v1.8.0/go.mod h1:Fm2szCDavWzBk2cDKxrkmWBqoCiL1+Ctwq7EyqBCA/A=
-cloud.google.com/go/redis v1.9.0/go.mod h1:HMYQuajvb2D0LvMgZmLDZW8V5aOC/WxstZHiy4g8OiA=
-cloud.google.com/go/redis v1.10.0/go.mod h1:ThJf3mMBQtW18JzGgh41/Wld6vnDDc/F/F35UolRZPM=
-cloud.google.com/go/redis v1.11.0/go.mod h1:/X6eicana+BWcUda5PpwZC48o37SiFVTFSs0fWAJ7uQ=
-cloud.google.com/go/resourcemanager v1.3.0/go.mod h1:bAtrTjZQFJkiWTPDb1WBjzvc6/kifjj4QBYuKCCoqKA=
-cloud.google.com/go/resourcemanager v1.4.0/go.mod h1:MwxuzkumyTX7/a3n37gmsT3py7LIXwrShilPh3P1tR0=
-cloud.google.com/go/resourcemanager v1.5.0/go.mod h1:eQoXNAiAvCf5PXxWxXjhKQoTMaUSNrEfg+6qdf/wots=
-cloud.google.com/go/resourcemanager v1.6.0/go.mod h1:YcpXGRs8fDzcUl1Xw8uOVmI8JEadvhRIkoXXUNVYcVo=
-cloud.google.com/go/resourcemanager v1.7.0/go.mod h1:HlD3m6+bwhzj9XCouqmeiGuni95NTrExfhoSrkC/3EI=
-cloud.google.com/go/resourcesettings v1.3.0/go.mod h1:lzew8VfESA5DQ8gdlHwMrqZs1S9V87v3oCnKCWoOuQU=
-cloud.google.com/go/resourcesettings v1.4.0/go.mod h1:ldiH9IJpcrlC3VSuCGvjR5of/ezRrOxFtpJoJo5SmXg=
-cloud.google.com/go/resourcesettings v1.5.0/go.mod h1:+xJF7QSG6undsQDfsCJyqWXyBwUoJLhetkRMDRnIoXA=
-cloud.google.com/go/retail v1.8.0/go.mod h1:QblKS8waDmNUhghY2TI9O3JLlFk8jybHeV4BF19FrE4=
-cloud.google.com/go/retail v1.9.0/go.mod h1:g6jb6mKuCS1QKnH/dpu7isX253absFl6iE92nHwlBUY=
-cloud.google.com/go/retail v1.10.0/go.mod h1:2gDk9HsL4HMS4oZwz6daui2/jmKvqShXKQuB2RZ+cCc=
-cloud.google.com/go/retail v1.11.0/go.mod h1:MBLk1NaWPmh6iVFSz9MeKG/Psyd7TAgm6y/9L2B4x9Y=
-cloud.google.com/go/retail v1.12.0/go.mod h1:UMkelN/0Z8XvKymXFbD4EhFJlYKRx1FGhQkVPU5kF14=
-cloud.google.com/go/run v0.2.0/go.mod h1:CNtKsTA1sDcnqqIFR3Pb5Tq0usWxJJvsWOCPldRU3Do=
-cloud.google.com/go/run v0.3.0/go.mod h1:TuyY1+taHxTjrD0ZFk2iAR+xyOXEA0ztb7U3UNA0zBo=
-cloud.google.com/go/run v0.8.0/go.mod h1:VniEnuBwqjigv0A7ONfQUaEItaiCRVujlMqerPPiktM=
-cloud.google.com/go/run v0.9.0/go.mod h1:Wwu+/vvg8Y+JUApMwEDfVfhetv30hCG4ZwDR/IXl2Qg=
-cloud.google.com/go/scheduler v1.4.0/go.mod h1:drcJBmxF3aqZJRhmkHQ9b3uSSpQoltBPGPxGAWROx6s=
-cloud.google.com/go/scheduler v1.5.0/go.mod h1:ri073ym49NW3AfT6DZi21vLZrG07GXr5p3H1KxN5QlI=
-cloud.google.com/go/scheduler v1.6.0/go.mod h1:SgeKVM7MIwPn3BqtcBntpLyrIJftQISRrYB5ZtT+KOk=
-cloud.google.com/go/scheduler v1.7.0/go.mod h1:jyCiBqWW956uBjjPMMuX09n3x37mtyPJegEWKxRsn44=
-cloud.google.com/go/scheduler v1.8.0/go.mod h1:TCET+Y5Gp1YgHT8py4nlg2Sew8nUHMqcpousDgXJVQc=
-cloud.google.com/go/scheduler v1.9.0/go.mod h1:yexg5t+KSmqu+njTIh3b7oYPheFtBWGcbVUYF1GGMIc=
-cloud.google.com/go/secretmanager v1.6.0/go.mod h1:awVa/OXF6IiyaU1wQ34inzQNc4ISIDIrId8qE5QGgKA=
-cloud.google.com/go/secretmanager v1.8.0/go.mod h1:hnVgi/bN5MYHd3Gt0SPuTPPp5ENina1/LxM+2W9U9J4=
-cloud.google.com/go/secretmanager v1.9.0/go.mod h1:b71qH2l1yHmWQHt9LC80akm86mX8AL6X1MA01dW8ht4=
-cloud.google.com/go/secretmanager v1.10.0/go.mod h1:MfnrdvKMPNra9aZtQFvBcvRU54hbPD8/HayQdlUgJpU=
-cloud.google.com/go/security v1.5.0/go.mod h1:lgxGdyOKKjHL4YG3/YwIL2zLqMFCKs0UbQwgyZmfJl4=
-cloud.google.com/go/security v1.7.0/go.mod h1:mZklORHl6Bg7CNnnjLH//0UlAlaXqiG7Lb9PsPXLfD0=
-cloud.google.com/go/security v1.8.0/go.mod h1:hAQOwgmaHhztFhiQ41CjDODdWP0+AE1B3sX4OFlq+GU=
-cloud.google.com/go/security v1.9.0/go.mod h1:6Ta1bO8LXI89nZnmnsZGp9lVoVWXqsVbIq/t9dzI+2Q=
-cloud.google.com/go/security v1.10.0/go.mod h1:QtOMZByJVlibUT2h9afNDWRZ1G96gVywH8T5GUSb9IA=
-cloud.google.com/go/security v1.12.0/go.mod h1:rV6EhrpbNHrrxqlvW0BWAIawFWq3X90SduMJdFwtLB8=
-cloud.google.com/go/security v1.13.0/go.mod h1:Q1Nvxl1PAgmeW0y3HTt54JYIvUdtcpYKVfIB8AOMZ+0=
-cloud.google.com/go/securitycenter v1.13.0/go.mod h1:cv5qNAqjY84FCN6Y9z28WlkKXyWsgLO832YiWwkCWcU=
-cloud.google.com/go/securitycenter v1.14.0/go.mod h1:gZLAhtyKv85n52XYWt6RmeBdydyxfPeTrpToDPw4Auc=
-cloud.google.com/go/securitycenter v1.15.0/go.mod h1:PeKJ0t8MoFmmXLXWm41JidyzI3PJjd8sXWaVqg43WWk=
-cloud.google.com/go/securitycenter v1.16.0/go.mod h1:Q9GMaLQFUD+5ZTabrbujNWLtSLZIZF7SAR0wWECrjdk=
-cloud.google.com/go/securitycenter v1.18.1/go.mod h1:0/25gAzCM/9OL9vVx4ChPeM/+DlfGQJDwBy/UC8AKK0=
-cloud.google.com/go/securitycenter v1.19.0/go.mod h1:LVLmSg8ZkkyaNy4u7HCIshAngSQ8EcIRREP3xBnyfag=
-cloud.google.com/go/servicecontrol v1.4.0/go.mod h1:o0hUSJ1TXJAmi/7fLJAedOovnujSEvjKCAFNXPQ1RaU=
-cloud.google.com/go/servicecontrol v1.5.0/go.mod h1:qM0CnXHhyqKVuiZnGKrIurvVImCs8gmqWsDoqe9sU1s=
-cloud.google.com/go/servicecontrol v1.10.0/go.mod h1:pQvyvSRh7YzUF2efw7H87V92mxU8FnFDawMClGCNuAA=
-cloud.google.com/go/servicecontrol v1.11.0/go.mod h1:kFmTzYzTUIuZs0ycVqRHNaNhgR+UMUpw9n02l/pY+mc=
-cloud.google.com/go/servicecontrol v1.11.1/go.mod h1:aSnNNlwEFBY+PWGQ2DoM0JJ/QUXqV5/ZD9DOLB7SnUk=
-cloud.google.com/go/servicedirectory v1.4.0/go.mod h1:gH1MUaZCgtP7qQiI+F+A+OpeKF/HQWgtAddhTbhL2bs=
-cloud.google.com/go/servicedirectory v1.5.0/go.mod h1:QMKFL0NUySbpZJ1UZs3oFAmdvVxhhxB6eJ/Vlp73dfg=
-cloud.google.com/go/servicedirectory v1.6.0/go.mod h1:pUlbnWsLH9c13yGkxCmfumWEPjsRs1RlmJ4pqiNjVL4=
-cloud.google.com/go/servicedirectory v1.7.0/go.mod h1:5p/U5oyvgYGYejufvxhgwjL8UVXjkuw7q5XcG10wx1U=
-cloud.google.com/go/servicedirectory v1.8.0/go.mod h1:srXodfhY1GFIPvltunswqXpVxFPpZjf8nkKQT7XcXaY=
-cloud.google.com/go/servicedirectory v1.9.0/go.mod h1:29je5JjiygNYlmsGz8k6o+OZ8vd4f//bQLtvzkPPT/s=
-cloud.google.com/go/servicemanagement v1.4.0/go.mod h1:d8t8MDbezI7Z2R1O/wu8oTggo3BI2GKYbdG4y/SJTco=
-cloud.google.com/go/servicemanagement v1.5.0/go.mod h1:XGaCRe57kfqu4+lRxaFEAuqmjzF0r+gWHjWqKqBvKFo=
-cloud.google.com/go/servicemanagement v1.6.0/go.mod h1:aWns7EeeCOtGEX4OvZUWCCJONRZeFKiptqKf1D0l/Jc=
-cloud.google.com/go/servicemanagement v1.8.0/go.mod h1:MSS2TDlIEQD/fzsSGfCdJItQveu9NXnUniTrq/L8LK4=
-cloud.google.com/go/serviceusage v1.3.0/go.mod h1:Hya1cozXM4SeSKTAgGXgj97GlqUvF5JaoXacR1JTP/E=
-cloud.google.com/go/serviceusage v1.4.0/go.mod h1:SB4yxXSaYVuUBYUml6qklyONXNLt83U0Rb+CXyhjEeU=
-cloud.google.com/go/serviceusage v1.5.0/go.mod h1:w8U1JvqUqwJNPEOTQjrMHkw3IaIFLoLsPLvsE3xueec=
-cloud.google.com/go/serviceusage v1.6.0/go.mod h1:R5wwQcbOWsyuOfbP9tGdAnCAc6B9DRwPG1xtWMDeuPA=
-cloud.google.com/go/shell v1.3.0/go.mod h1:VZ9HmRjZBsjLGXusm7K5Q5lzzByZmJHf1d0IWHEN5X4=
-cloud.google.com/go/shell v1.4.0/go.mod h1:HDxPzZf3GkDdhExzD/gs8Grqk+dmYcEjGShZgYa9URw=
-cloud.google.com/go/shell v1.6.0/go.mod h1:oHO8QACS90luWgxP3N9iZVuEiSF84zNyLytb+qE2f9A=
-cloud.google.com/go/spanner v1.41.0/go.mod h1:MLYDBJR/dY4Wt7ZaMIQ7rXOTLjYrmxLE/5ve9vFfWos=
-cloud.google.com/go/spanner v1.44.0/go.mod h1:G8XIgYdOK+Fbcpbs7p2fiprDw4CaZX63whnSMLVBxjk=
-cloud.google.com/go/spanner v1.45.0/go.mod h1:FIws5LowYz8YAE1J8fOS7DJup8ff7xJeetWEo5REA2M=
-cloud.google.com/go/speech v1.6.0/go.mod h1:79tcr4FHCimOp56lwC01xnt/WPJZc4v3gzyT7FoBkCM=
-cloud.google.com/go/speech v1.7.0/go.mod h1:KptqL+BAQIhMsj1kOP2la5DSEEerPDuOP/2mmkhHhZQ=
-cloud.google.com/go/speech v1.8.0/go.mod h1:9bYIl1/tjsAnMgKGHKmBZzXKEkGgtU+MpdDPTE9f7y0=
-cloud.google.com/go/speech v1.9.0/go.mod h1:xQ0jTcmnRFFM2RfX/U+rk6FQNUF6DQlydUSyoooSpco=
-cloud.google.com/go/speech v1.14.1/go.mod h1:gEosVRPJ9waG7zqqnsHpYTOoAS4KouMRLDFMekpJ0J0=
-cloud.google.com/go/speech v1.15.0/go.mod h1:y6oH7GhqCaZANH7+Oe0BhgIogsNInLlz542tg3VqeYI=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
-cloud.google.com/go/storage v1.22.1/go.mod h1:S8N1cAStu7BOeFfE8KAQzmyyLkK8p/vmRq6kuBTW58Y=
-cloud.google.com/go/storage v1.23.0/go.mod h1:vOEEDNFnciUMhBeT6hsJIn3ieU5cFRmzeLgDvXzfIXc=
-cloud.google.com/go/storage v1.27.0/go.mod h1:x9DOL8TK/ygDUMieqwfhdpQryTeEkhGKMi80i/iqR2s=
-cloud.google.com/go/storage v1.28.1/go.mod h1:Qnisd4CqDdo6BGs2AD5LLnEsmSQ80wQ5ogcBBKhU86Y=
-cloud.google.com/go/storage v1.29.0/go.mod h1:4puEjyTKnku6gfKoTfNOU/W+a9JyuVNxjpS5GBrB8h4=
-cloud.google.com/go/storagetransfer v1.5.0/go.mod h1:dxNzUopWy7RQevYFHewchb29POFv3/AaBgnhqzqiK0w=
-cloud.google.com/go/storagetransfer v1.6.0/go.mod h1:y77xm4CQV/ZhFZH75PLEXY0ROiS7Gh6pSKrM8dJyg6I=
-cloud.google.com/go/storagetransfer v1.7.0/go.mod h1:8Giuj1QNb1kfLAiWM1bN6dHzfdlDAVC9rv9abHot2W4=
-cloud.google.com/go/storagetransfer v1.8.0/go.mod h1:JpegsHHU1eXg7lMHkvf+KE5XDJ7EQu0GwNJbbVGanEw=
-cloud.google.com/go/talent v1.1.0/go.mod h1:Vl4pt9jiHKvOgF9KoZo6Kob9oV4lwd/ZD5Cto54zDRw=
-cloud.google.com/go/talent v1.2.0/go.mod h1:MoNF9bhFQbiJ6eFD3uSsg0uBALw4n4gaCaEjBw9zo8g=
-cloud.google.com/go/talent v1.3.0/go.mod h1:CmcxwJ/PKfRgd1pBjQgU6W3YBwiewmUzQYH5HHmSCmM=
-cloud.google.com/go/talent v1.4.0/go.mod h1:ezFtAgVuRf8jRsvyE6EwmbTK5LKciD4KVnHuDEFmOOA=
-cloud.google.com/go/talent v1.5.0/go.mod h1:G+ODMj9bsasAEJkQSzO2uHQWXHHXUomArjWQQYkqK6c=
-cloud.google.com/go/texttospeech v1.4.0/go.mod h1:FX8HQHA6sEpJ7rCMSfXuzBcysDAuWusNNNvN9FELDd8=
-cloud.google.com/go/texttospeech v1.5.0/go.mod h1:oKPLhR4n4ZdQqWKURdwxMy0uiTS1xU161C8W57Wkea4=
-cloud.google.com/go/texttospeech v1.6.0/go.mod h1:YmwmFT8pj1aBblQOI3TfKmwibnsfvhIBzPXcW4EBovc=
-cloud.google.com/go/tpu v1.3.0/go.mod h1:aJIManG0o20tfDQlRIej44FcwGGl/cD0oiRyMKG19IQ=
-cloud.google.com/go/tpu v1.4.0/go.mod h1:mjZaX8p0VBgllCzF6wcU2ovUXN9TONFLd7iz227X2Xg=
-cloud.google.com/go/tpu v1.5.0/go.mod h1:8zVo1rYDFuW2l4yZVY0R0fb/v44xLh3llq7RuV61fPM=
-cloud.google.com/go/trace v1.3.0/go.mod h1:FFUE83d9Ca57C+K8rDl/Ih8LwOzWIV1krKgxg6N0G28=
-cloud.google.com/go/trace v1.4.0/go.mod h1:UG0v8UBqzusp+z63o7FK74SdFE+AXpCLdFb1rshXG+Y=
-cloud.google.com/go/trace v1.8.0/go.mod h1:zH7vcsbAhklH8hWFig58HvxcxyQbaIqMarMg9hn5ECA=
-cloud.google.com/go/trace v1.9.0/go.mod h1:lOQqpE5IaWY0Ixg7/r2SjixMuc6lfTFeO4QGM4dQWOk=
-cloud.google.com/go/translate v1.3.0/go.mod h1:gzMUwRjvOqj5i69y/LYLd8RrNQk+hOmIXTi9+nb3Djs=
-cloud.google.com/go/translate v1.4.0/go.mod h1:06Dn/ppvLD6WvA5Rhdp029IX2Mi3Mn7fpMRLPvXT5Wg=
-cloud.google.com/go/translate v1.5.0/go.mod h1:29YDSYveqqpA1CQFD7NQuP49xymq17RXNaUDdc0mNu0=
-cloud.google.com/go/translate v1.6.0/go.mod h1:lMGRudH1pu7I3n3PETiOB2507gf3HnfLV8qlkHZEyos=
-cloud.google.com/go/translate v1.7.0/go.mod h1:lMGRudH1pu7I3n3PETiOB2507gf3HnfLV8qlkHZEyos=
-cloud.google.com/go/video v1.8.0/go.mod h1:sTzKFc0bUSByE8Yoh8X0mn8bMymItVGPfTuUBUyRgxk=
-cloud.google.com/go/video v1.9.0/go.mod h1:0RhNKFRF5v92f8dQt0yhaHrEuH95m068JYOvLZYnJSw=
-cloud.google.com/go/video v1.12.0/go.mod h1:MLQew95eTuaNDEGriQdcYn0dTwf9oWiA4uYebxM5kdg=
-cloud.google.com/go/video v1.13.0/go.mod h1:ulzkYlYgCp15N2AokzKjy7MQ9ejuynOJdf1tR5lGthk=
-cloud.google.com/go/video v1.14.0/go.mod h1:SkgaXwT+lIIAKqWAJfktHT/RbgjSuY6DobxEp0C5yTQ=
-cloud.google.com/go/video v1.15.0/go.mod h1:SkgaXwT+lIIAKqWAJfktHT/RbgjSuY6DobxEp0C5yTQ=
-cloud.google.com/go/videointelligence v1.6.0/go.mod h1:w0DIDlVRKtwPCn/C4iwZIJdvC69yInhW0cfi+p546uU=
-cloud.google.com/go/videointelligence v1.7.0/go.mod h1:k8pI/1wAhjznARtVT9U1llUaFNPh7muw8QyOUpavru4=
-cloud.google.com/go/videointelligence v1.8.0/go.mod h1:dIcCn4gVDdS7yte/w+koiXn5dWVplOZkE+xwG9FgK+M=
-cloud.google.com/go/videointelligence v1.9.0/go.mod h1:29lVRMPDYHikk3v8EdPSaL8Ku+eMzDljjuvRs105XoU=
-cloud.google.com/go/videointelligence v1.10.0/go.mod h1:LHZngX1liVtUhZvi2uNS0VQuOzNi2TkY1OakiuoUOjU=
-cloud.google.com/go/vision v1.2.0/go.mod h1:SmNwgObm5DpFBme2xpyOyasvBc1aPdjvMk2bBk0tKD0=
-cloud.google.com/go/vision/v2 v2.2.0/go.mod h1:uCdV4PpN1S0jyCyq8sIM42v2Y6zOLkZs+4R9LrGYwFo=
-cloud.google.com/go/vision/v2 v2.3.0/go.mod h1:UO61abBx9QRMFkNBbf1D8B1LXdS2cGiiCRx0vSpZoUo=
-cloud.google.com/go/vision/v2 v2.4.0/go.mod h1:VtI579ll9RpVTrdKdkMzckdnwMyX2JILb+MhPqRbPsY=
-cloud.google.com/go/vision/v2 v2.5.0/go.mod h1:MmaezXOOE+IWa+cS7OhRRLK2cNv1ZL98zhqFFZaaH2E=
-cloud.google.com/go/vision/v2 v2.6.0/go.mod h1:158Hes0MvOS9Z/bDMSFpjwsUrZ5fPrdwuyyvKSGAGMY=
-cloud.google.com/go/vision/v2 v2.7.0/go.mod h1:H89VysHy21avemp6xcf9b9JvZHVehWbET0uT/bcuY/0=
-cloud.google.com/go/vmmigration v1.2.0/go.mod h1:IRf0o7myyWFSmVR1ItrBSFLFD/rJkfDCUTO4vLlJvsE=
-cloud.google.com/go/vmmigration v1.3.0/go.mod h1:oGJ6ZgGPQOFdjHuocGcLqX4lc98YQ7Ygq8YQwHh9A7g=
-cloud.google.com/go/vmmigration v1.5.0/go.mod h1:E4YQ8q7/4W9gobHjQg4JJSgXXSgY21nA5r8swQV+Xxc=
-cloud.google.com/go/vmmigration v1.6.0/go.mod h1:bopQ/g4z+8qXzichC7GW1w2MjbErL54rk3/C843CjfY=
-cloud.google.com/go/vmwareengine v0.1.0/go.mod h1:RsdNEf/8UDvKllXhMz5J40XxDrNJNN4sagiox+OI208=
-cloud.google.com/go/vmwareengine v0.2.2/go.mod h1:sKdctNJxb3KLZkE/6Oui94iw/xs9PRNC2wnNLXsHvH8=
-cloud.google.com/go/vmwareengine v0.3.0/go.mod h1:wvoyMvNWdIzxMYSpH/R7y2h5h3WFkx6d+1TIsP39WGY=
-cloud.google.com/go/vpcaccess v1.4.0/go.mod h1:aQHVbTWDYUR1EbTApSVvMq1EnT57ppDmQzZ3imqIk4w=
-cloud.google.com/go/vpcaccess v1.5.0/go.mod h1:drmg4HLk9NkZpGfCmZ3Tz0Bwnm2+DKqViEpeEpOq0m8=
-cloud.google.com/go/vpcaccess v1.6.0/go.mod h1:wX2ILaNhe7TlVa4vC5xce1bCnqE3AeH27RV31lnmZes=
-cloud.google.com/go/webrisk v1.4.0/go.mod h1:Hn8X6Zr+ziE2aNd8SliSDWpEnSS1u4R9+xXZmFiHmGE=
-cloud.google.com/go/webrisk v1.5.0/go.mod h1:iPG6fr52Tv7sGk0H6qUFzmL3HHZev1htXuWDEEsqMTg=
-cloud.google.com/go/webrisk v1.6.0/go.mod h1:65sW9V9rOosnc9ZY7A7jsy1zoHS5W9IAXv6dGqhMQMc=
-cloud.google.com/go/webrisk v1.7.0/go.mod h1:mVMHgEYH0r337nmt1JyLthzMr6YxwN1aAIEc2fTcq7A=
-cloud.google.com/go/webrisk v1.8.0/go.mod h1:oJPDuamzHXgUc+b8SiHRcVInZQuybnvEW72PqTc7sSg=
-cloud.google.com/go/websecurityscanner v1.3.0/go.mod h1:uImdKm2wyeXQevQJXeh8Uun/Ym1VqworNDlBXQevGMo=
-cloud.google.com/go/websecurityscanner v1.4.0/go.mod h1:ebit/Fp0a+FWu5j4JOmJEV8S8CzdTkAS77oDsiSqYWQ=
-cloud.google.com/go/websecurityscanner v1.5.0/go.mod h1:Y6xdCPy81yi0SQnDY1xdNTNpfY1oAgXUlcfN3B3eSng=
-cloud.google.com/go/workflows v1.6.0/go.mod h1:6t9F5h/unJz41YqfBmqSASJSXccBLtD1Vwf+KmJENM0=
-cloud.google.com/go/workflows v1.7.0/go.mod h1:JhSrZuVZWuiDfKEFxU0/F1PQjmpnpcoISEXH2bcHC3M=
-cloud.google.com/go/workflows v1.8.0/go.mod h1:ysGhmEajwZxGn1OhGOGKsTXc5PyxOc0vfKf5Af+to4M=
-cloud.google.com/go/workflows v1.9.0/go.mod h1:ZGkj1aFIOd9c8Gerkjjq7OW7I5+l6cSvT3ujaO/WwSA=
-cloud.google.com/go/workflows v1.10.0/go.mod h1:fZ8LmRmZQWacon9UCX1r/g/DfAXx5VcPALq2CxzdePw=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
-git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ajstarks/deck v0.0.0-20200831202436-30c9fc6549a9/go.mod h1:JynElWSGnm/4RlzPXRlREEwqTHAN3T56Bv2ITsFT3gY=
-github.com/ajstarks/deck/generate v0.0.0-20210309230005-c3f852c02e19/go.mod h1:T13YZdzov6OU0A1+RfKZiZN9ca6VeKdBdyDV+BY97Tk=
-github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw=
-github.com/ajstarks/svgo v0.0.0-20211024235047-1546f124cd8b/go.mod h1:1KcenG0jGWcpt8ov532z81sp/kMMUG485J2InIOyADM=
-github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/apache/arrow/go/v10 v10.0.1/go.mod h1:YvhnlEePVnBS4+0z3fhPfUy7W1Ikj0Ih0vcRo/gZ1M0=
-github.com/apache/arrow/go/v11 v11.0.0/go.mod h1:Eg5OsL5H+e299f7u5ssuXsuHQVEGC4xei5aX110hRiI=
-github.com/apache/thrift v0.16.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
-github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20220314180256-7f1daf1720fc/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+cloud.google.com/go/auth v0.16.2 h1:QvBAGFPLrDeoiNjyfVunhQ10HKNYuOwZ5noee0M5df4=
+cloud.google.com/go/auth v0.16.2/go.mod h1:sRBas2Y1fB1vZTdurouM0AzuYQBMZinrUYL8EufhtEA=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
+cloud.google.com/go/compute/metadata v0.7.0 h1:PBWF+iiAerVNe8UCHxdOt6eHLVc3ydFeOCw78U8ytSU=
+cloud.google.com/go/compute/metadata v0.7.0/go.mod h1:j5MvL9PprKL39t166CoB1uVHfQMs4tFQZZcKwksXUjo=
+cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
+cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
-github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
-github.com/envoyproxy/go-control-plane v0.10.3/go.mod h1:fJJn/j26vwOu972OllsvAgJJM//w9BV6Fxbg2LuVd34=
-github.com/envoyproxy/go-control-plane v0.11.1-0.20230524094728-9239064ad72f/go.mod h1:sfYdkwUW4BA3PbKjySwjJy+O4Pu0h62rlqCMHNk+K+Q=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v0.6.7/go.mod h1:dyJXwwfPK2VSqiB9Klm1J6romD608Ba7Hij42vrOBCo=
-github.com/envoyproxy/protoc-gen-validate v0.9.1/go.mod h1:OKNgG7TCp5pF4d6XftA0++PMirau2/yoOwVac3AbF2w=
-github.com/envoyproxy/protoc-gen-validate v0.10.1/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
-github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
-github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-fonts/dejavu v0.1.0/go.mod h1:4Wt4I4OU2Nq9asgDCteaAaWZOV24E+0/Pwo0gppep4g=
-github.com/go-fonts/latin-modern v0.2.0/go.mod h1:rQVLdDMK+mK1xscDwsqM5J8U2jrRa3T0ecnM9pNujks=
-github.com/go-fonts/liberation v0.1.1/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2HYqyqAO9z7GY=
-github.com/go-fonts/liberation v0.2.0/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2HYqyqAO9z7GY=
-github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmnUIzUY=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
-github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
-github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U=
-github.com/go-latex/latex v0.0.0-20210823091927-c0d11ff05a81/go.mod h1:SX0U8uGpxhq9o2S/CELCSUxEWWAuoCUcVCQWv7G2OCk=
-github.com/go-pdf/fpdf v0.5.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M=
-github.com/go-pdf/fpdf v0.6.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
-github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
-github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
-github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e h1:1r7pUrabqp18hOBcwBwiTsbnFeTZHV9eER/QT5JVZxY=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
-github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
-github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
-github.com/googleapis/enterprise-certificate-proxy v0.1.0/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
-github.com/googleapis/enterprise-certificate-proxy v0.2.0/go.mod h1:8C0jb7/mgJe/9KK8Lm7X9ctZC2t60YyIpYEI16jx0Qg=
-github.com/googleapis/enterprise-certificate-proxy v0.2.1/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
-github.com/googleapis/enterprise-certificate-proxy v0.2.3 h1:yk9/cqRKtT9wXZSsRH9aurXEpJX+U6FLtpYTdC3R06k=
-github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
-github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
-github.com/googleapis/gax-go/v2 v2.2.0/go.mod h1:as02EH8zWkzwUoLbBaFeQ+arQaj/OthfcblKl4IGNaM=
-github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99EXz9pXxye9YM=
-github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c=
-github.com/googleapis/gax-go/v2 v2.5.1/go.mod h1:h6B0KMMFNtI2ddbGJn3T3ZbwkeT6yqEF02fYlzkUCyo=
-github.com/googleapis/gax-go/v2 v2.6.0/go.mod h1:1mjbznJAPHFpesgE5ucqfYEscaz5kMdcIDwU/6+DDoY=
-github.com/googleapis/gax-go/v2 v2.7.0/go.mod h1:TEop28CZZQ2y+c0VxMUmu1lV+fQx57QpBWsYpwqHJx8=
-github.com/googleapis/gax-go/v2 v2.7.1 h1:gF4c0zjUP2H/s/hEGyLA3I0fA2ZWjzYiONAD6cvPr8A=
-github.com/googleapis/gax-go/v2 v2.7.1/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38/qKbhSAKP6QI=
-github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
-github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4=
+github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
+github.com/googleapis/gax-go/v2 v2.14.2 h1:eBLnkZ9635krYIPD+ag1USrOAI0Nr0QYF3+/3GqO0k0=
+github.com/googleapis/gax-go/v2 v2.14.2/go.mod h1:ON64QhlJkhVtSqp4v1uaK92VyZ2gmvDQsweuyLV+8+w=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.16.2 h1:K4ev2ib4LdQETX5cSZBG0DVLk1jwGqSPXBjdah3veNs=
-github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnP3V9oNE4hmsM=
-github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/vault/api v1.12.0 h1:meCpJSesvzQyao8FCOgk2fGdoADAnbDu2WPJN1lDLJ4=
-github.com/hashicorp/vault/api v1.12.0/go.mod h1:si+lJCYO7oGkIoNPAN8j3azBLTn9SjMGS+jFaHd1Cck=
-github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/jung-kurt/gofpdf v1.0.0/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
-github.com/jung-kurt/gofpdf v1.0.3-0.20190309125859-24315acbbda5/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
-github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE=
-github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
-github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
-github.com/lyft/protoc-gen-star v0.6.1/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
-github.com/lyft/protoc-gen-star/v2 v2.0.1/go.mod h1:RcCdONR2ScXaYnQC5tUzxzlpA3WVYF7/opLeUgcQs/o=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6 h1:6Su7aK7lXmJ/U79bYtBjLNaha4Fs1Rg9plHpcH+vvnE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-sqlite3 v1.14.14/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8/go.mod h1:mC1jAcsrzbxHt8iiaC+zU4b1ylILSosueou12R++wfY=
-github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
+github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2dXMnm1mY=
-github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
-github.com/phpdave11/gofpdi v1.0.13/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
-github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
-github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
-github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w=
-github.com/ruudk/golang-pdf417 v0.0.0-20201230142125-a7e3863a1245/go.mod h1:pQAZKsJ8yyVxGRWYNEm9oFB8ieLgKFnamEyDmSA0BRk=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
-github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
-github.com/spf13/afero v1.9.2/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
-github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
-go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
-go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191002040644-a1355ae1e2c3/go.mod h1:NOZ3BPKG0ec/BKJQgnvsSFpcKLM5xXVWnvZS97DWHgE=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
-golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20190910094157-69e4b8554b2a/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20200119044424-58c23975cae1/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20200430140353-33d19683fad8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20200618115811-c13761719519/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20201208152932-35266b937fa6/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20210216034530-4410531fe030/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20210607152325-775e3b0c77b9/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
-golang.org/x/image v0.0.0-20210628002857-a66eb6448b8d/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
-golang.org/x/image v0.0.0-20211028202545-6944b10bf410/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
-golang.org/x/image v0.0.0-20220302094943-723b81ca9867/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220617184016-355a448f1bc9/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.0.0-20221014081412-f15817d10f9b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
-golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
-golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
-golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
-golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
-golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g=
-golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220819030929-7fc1605a5dde/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210304124612-50617c2ba197/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210816183151-1e6c022a8912/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220624220833-87e55d714810/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220829200755-d48e67d00261/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
-golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190206041539-40960b6deb8e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190927191325-030b2cf1153e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201124115921-2c860bdd6e78/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-gonum.org/v1/gonum v0.0.0-20180816165407-929014505bf4/go.mod h1:Y+Yx5eoAFn32cQvJDxZx5Dpnq+c3wtXuadVZAcxbbBo=
-gonum.org/v1/gonum v0.8.2/go.mod h1:oe/vMfY3deqTw+1EZJhuvEW2iwGF1bW9wwu7XCu0+v0=
-gonum.org/v1/gonum v0.9.3/go.mod h1:TZumC3NeyVQskjXqmyWt4S3bINhy7B4eYwW69EbyX+0=
-gonum.org/v1/gonum v0.11.0/go.mod h1:fSG4YDCxxUZQJ7rKsQrj0gMOg00Il0Z96/qMA4bVQhA=
-gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
-gonum.org/v1/plot v0.0.0-20190515093506-e2840ee46a6b/go.mod h1:Wt8AAjI+ypCyYX3nZBvf6cAIx93T+c/OS2HFAYskSZc=
-gonum.org/v1/plot v0.9.0/go.mod h1:3Pcqqmp6RHvJI72kgb8fThyUnav364FOsdDo2aGW5lY=
-gonum.org/v1/plot v0.10.1/go.mod h1:VZW5OlhkL1mysU9vaqNHnsy86inf6Ot+jB3r+BczCEo=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
-google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
-google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
-google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo=
-google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4=
-google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
-google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
-google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
-google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI=
-google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
-google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo=
-google.golang.org/api v0.67.0/go.mod h1:ShHKP8E60yPsKNw/w8w+VYaj9H6buA5UqDp8dhbQZ6g=
-google.golang.org/api v0.70.0/go.mod h1:Bs4ZM2HGifEvXwd50TtW70ovgJffJYw2oRCOFU/SkfA=
-google.golang.org/api v0.71.0/go.mod h1:4PyU6e6JogV1f9eA4voyrTY2batOLdgZ5qZ5HOCc4j8=
-google.golang.org/api v0.74.0/go.mod h1:ZpfMZOVRMywNyvJFeqL9HRWBgAuRfSjJFpe9QtRRyDs=
-google.golang.org/api v0.75.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69ljA=
-google.golang.org/api v0.77.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69ljA=
-google.golang.org/api v0.78.0/go.mod h1:1Sg78yoMLOhlQTeF+ARBoytAcH1NNyyl390YMy6rKmw=
-google.golang.org/api v0.80.0/go.mod h1:xY3nI94gbvBrE0J6NHXhxOmW97HG7Khjkku6AFB3Hyg=
-google.golang.org/api v0.84.0/go.mod h1:NTsGnUFJMYROtiquksZHBWtHfeMC7iYthki7Eq3pa8o=
-google.golang.org/api v0.85.0/go.mod h1:AqZf8Ep9uZ2pyTvgL+x0D3Zt0eoT9b5E8fmzfu6FO2g=
-google.golang.org/api v0.90.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw=
-google.golang.org/api v0.93.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw=
-google.golang.org/api v0.95.0/go.mod h1:eADj+UBuxkh5zlrSntJghuNeg8HwQ1w5lTKkuqaETEI=
-google.golang.org/api v0.96.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
-google.golang.org/api v0.97.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
-google.golang.org/api v0.98.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
-google.golang.org/api v0.99.0/go.mod h1:1YOf74vkVndF7pG6hIHuINsM7eWwpVTAfNMNiL91A08=
-google.golang.org/api v0.100.0/go.mod h1:ZE3Z2+ZOr87Rx7dqFsdRQkRBk36kDtp/h+QpHbB7a70=
-google.golang.org/api v0.102.0/go.mod h1:3VFl6/fzoA+qNuS1N1/VfXY4LjoXN/wzeIp7TweWwGo=
-google.golang.org/api v0.103.0/go.mod h1:hGtW6nK1AC+d9si/UBhw8Xli+QMOf6xyNAyJw4qU9w0=
-google.golang.org/api v0.106.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/O9MY=
-google.golang.org/api v0.107.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/O9MY=
-google.golang.org/api v0.108.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/O9MY=
-google.golang.org/api v0.110.0/go.mod h1:7FC4Vvx1Mooxh8C5HWjzZHcavuS2f6pmJpZx60ca7iI=
-google.golang.org/api v0.111.0/go.mod h1:qtFHvU9mhgTJegR31csQ+rwxyUTHOKFqCKWp1J0fdw0=
-google.golang.org/api v0.114.0 h1:1xQPji6cO2E2vLiI+C/XiFAnsn1WV3mjaEwGLhi3grE=
-google.golang.org/api v0.114.0/go.mod h1:ifYI2ZsFK6/uGddGfAD5BMxlnkBqCmqHSDUVi45N5Yg=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210329143202-679c6ae281ee/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
-google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
-google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
-google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
-google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w=
-google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210903162649-d08c68adba83/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220126215142-9970aeb2e350/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220207164111-0872dc986b00/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220222213610-43724f9ea8cf/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220304144024-325a89244dc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220310185008-1973136f34c6/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220324131243-acbaeb5b85eb/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
-google.golang.org/genproto v0.0.0-20220329172620-7be39ac1afc7/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220407144326-9054f6ed7bac/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220413183235-5e96e2839df9/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220414192740-2d67ff6cf2b4/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220429170224-98d788798c3e/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220518221133-4f43b3371335/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220523171625-347a074981d8/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220608133413-ed9918b62aac/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220617124728-180714bec0ad/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220628213854-d9e0b6570c03/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220722212130-b98a9ff5e252/go.mod h1:GkXuJDJ6aQ7lnJcRF+SJVgFdQhypqgl3LB1C9vabdRE=
-google.golang.org/genproto v0.0.0-20220801145646-83ce21fca29f/go.mod h1:iHe1svFLAZg9VWz891+QbRMwUv9O/1Ww+/mngYeThbc=
-google.golang.org/genproto v0.0.0-20220815135757-37a418bb8959/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
-google.golang.org/genproto v0.0.0-20220817144833-d7fd3f11b9b1/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
-google.golang.org/genproto v0.0.0-20220822174746-9e6da59bd2fc/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
-google.golang.org/genproto v0.0.0-20220829144015-23454907ede3/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
-google.golang.org/genproto v0.0.0-20220829175752-36a9c930ecbf/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
-google.golang.org/genproto v0.0.0-20220913154956-18f8339a66a5/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo=
-google.golang.org/genproto v0.0.0-20220914142337-ca0e39ece12f/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo=
-google.golang.org/genproto v0.0.0-20220915135415-7fd63a7952de/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo=
-google.golang.org/genproto v0.0.0-20220916172020-2692e8806bfa/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo=
-google.golang.org/genproto v0.0.0-20220919141832-68c03719ef51/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo=
-google.golang.org/genproto v0.0.0-20220920201722-2b89144ce006/go.mod h1:ht8XFiar2npT/g4vkk7O0WYS1sHOHbdujxbEp7CJWbw=
-google.golang.org/genproto v0.0.0-20220926165614-551eb538f295/go.mod h1:woMGP53BroOrRY3xTxlbr8Y3eB/nzAvvFM83q7kG2OI=
-google.golang.org/genproto v0.0.0-20220926220553-6981cbe3cfce/go.mod h1:woMGP53BroOrRY3xTxlbr8Y3eB/nzAvvFM83q7kG2OI=
-google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e/go.mod h1:3526vdqwhZAwq4wsRUaVG555sVgsNmIjRtO7t/JH29U=
-google.golang.org/genproto v0.0.0-20221014173430-6e2ab493f96b/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
-google.golang.org/genproto v0.0.0-20221014213838-99cd37c6964a/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
-google.golang.org/genproto v0.0.0-20221024153911-1573dae28c9c/go.mod h1:9qHF0xnpdSfF6knlcsnpzUu5y+rpwgbvsyGAZPBMg4s=
-google.golang.org/genproto v0.0.0-20221024183307-1bc688fe9f3e/go.mod h1:9qHF0xnpdSfF6knlcsnpzUu5y+rpwgbvsyGAZPBMg4s=
-google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c/go.mod h1:CGI5F/G+E5bKwmfYo09AXuVN4dD894kIKUFmVbP2/Fo=
-google.golang.org/genproto v0.0.0-20221109142239-94d6d90a7d66/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221114212237-e4508ebdbee1/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221117204609-8f9c96812029/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221201164419-0e50fba7f41c/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221201204527-e3fa12d562f3/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221202195650-67e5cbc046fd/go.mod h1:cTsE614GARnxrLsqKREzmNYJACSWWpAWdNMwnD7c2BE=
-google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230112194545-e10362b5ecf9/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230113154510-dbe35b8444a5/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230123190316-2c411cf9d197/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230124163310-31e0e69b6fc2/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230127162408-596548ed4efa/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230209215440-0dfe4f8abfcc/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230216225411-c8e22ba71e44/go.mod h1:8B0gmkoRebU8ukX6HP+4wrVQUY1+6PkQ44BSyIlflHA=
-google.golang.org/genproto v0.0.0-20230222225845-10f96fb3dbec/go.mod h1:3Dl5ZL0q0isWJt+FVcfpQyirqemEuLAK/iFvg1UP1Hw=
-google.golang.org/genproto v0.0.0-20230223222841-637eb2293923/go.mod h1:3Dl5ZL0q0isWJt+FVcfpQyirqemEuLAK/iFvg1UP1Hw=
-google.golang.org/genproto v0.0.0-20230303212802-e74f57abe488/go.mod h1:TvhZT5f700eVlTNwND1xoEZQeWTB2RY/65kplwl/bFA=
-google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s=
-google.golang.org/genproto v0.0.0-20230320184635-7606e756e683/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s=
-google.golang.org/genproto v0.0.0-20230323212658-478b75c54725/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
-google.golang.org/genproto v0.0.0-20230330154414-c0448cd141ea/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
-google.golang.org/genproto v0.0.0-20230331144136-dcfb400f0633/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
-google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
-google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
-google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
-google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
-google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc v1.50.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc v1.51.0/go.mod h1:wgNDFcnuBGmxLKI/qn4T+m5BtEBYXJPvibbUPsAIPww=
-google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
-google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
-google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
-google.golang.org/grpc v1.56.3 h1:8I4C0Yq1EjstUzUJzpcRVbuYA2mODtEmpWiQoN/b2nc=
-google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
-google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
+go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
+go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
+go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
+go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
+go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
+go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis=
+go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
+go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
+go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+google.golang.org/api v0.242.0 h1:7Lnb1nfnpvbkCiZek6IXKdJ0MFuAZNAJKQfA1ws62xg=
+google.golang.org/api v0.242.0/go.mod h1:cOVEm2TpdAGHL2z+UwyS+kmlGr3bVWQQ6sYEqkKje50=
+google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 h1:1tXaIXCracvtsRxSBsYDiSBN0cuJvM7QYW+MrpIRY78=
+google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2/go.mod h1:49MsLSx0oWMOZqcpB3uL8ZOkAh1+TndpJ8ONoCBWiZk=
+google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2 h1:vPV0tzlsK6EzEDHNNH5sa7Hs9bd7iXR7B1tSiPepkV0=
+google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2/go.mod h1:pKLAc5OolXC3ViWGI62vvC0n10CpwAtRcTNCFwTKBEw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/grpc v1.73.0 h1:VIWSmpI2MegBtTuFt5/JWy2oXxtjJ/e89Z70ImfD2ok=
+google.golang.org/grpc v1.73.0/go.mod h1:50sbHOUqWoCQGI8V2HQLJM0B+LMlIUjNSZmow7EVBQc=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.1.3/go.mod h1:NgwopIslSNH47DimFoV78dnkksY2EFtX0ajyb3K/las=
-lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
-lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
-modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
-modernc.org/cc/v3 v3.36.2/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
-modernc.org/cc/v3 v3.36.3/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
-modernc.org/ccgo/v3 v3.0.0-20220428102840-41399a37e894/go.mod h1:eI31LL8EwEBKPpNpA4bU1/i+sKOwOrQy8D87zWUcRZc=
-modernc.org/ccgo/v3 v3.0.0-20220430103911-bc99d88307be/go.mod h1:bwdAnOoaIt8Ax9YdWGjxWsdkPcZyRPHqrOvJxaKAKGw=
-modernc.org/ccgo/v3 v3.16.4/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
-modernc.org/ccgo/v3 v3.16.6/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
-modernc.org/ccgo/v3 v3.16.8/go.mod h1:zNjwkizS+fIFDrDjIAgBSCLkWbJuHF+ar3QRn+Z9aws=
-modernc.org/ccgo/v3 v3.16.9/go.mod h1:zNMzC9A9xeNUepy6KuZBbugn3c0Mc9TeiJO4lgvkJDo=
-modernc.org/ccorpus v1.11.6/go.mod h1:2gEUTrWqdpH2pXsmTM1ZkjeSrUWDpjMu2T6m29L/ErQ=
-modernc.org/httpfs v1.0.6/go.mod h1:7dosgurJGp0sPaRanU53W4xZYKh14wfzX420oZADeHM=
-modernc.org/libc v0.0.0-20220428101251-2d5f3daf273b/go.mod h1:p7Mg4+koNjc8jkqwcoFBJx7tXkpj00G77X7A72jXPXA=
-modernc.org/libc v1.16.0/go.mod h1:N4LD6DBE9cf+Dzf9buBlzVJndKr/iJHG97vGLHYnb5A=
-modernc.org/libc v1.16.1/go.mod h1:JjJE0eu4yeK7tab2n4S1w8tlWd9MxXLRzheaRnAKymU=
-modernc.org/libc v1.16.17/go.mod h1:hYIV5VZczAmGZAnG15Vdngn5HSF5cSkbvfz2B7GRuVU=
-modernc.org/libc v1.16.19/go.mod h1:p7Mg4+koNjc8jkqwcoFBJx7tXkpj00G77X7A72jXPXA=
-modernc.org/libc v1.17.0/go.mod h1:XsgLldpP4aWlPlsjqKRdHPqCxCjISdHfM/yeWC5GyW0=
-modernc.org/libc v1.17.1/go.mod h1:FZ23b+8LjxZs7XtFMbSzL/EhPxNbfZbErxEHc7cbD9s=
-modernc.org/mathutil v1.2.2/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/mathutil v1.4.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/mathutil v1.5.0/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/memory v1.1.1/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
-modernc.org/memory v1.2.0/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
-modernc.org/memory v1.2.1/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
-modernc.org/opt v0.1.1/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sqlite v1.18.1/go.mod h1:6ho+Gow7oX5V+OiOQ6Tr4xeqbx13UZ6t+Fw9IRUG4d4=
-modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
-modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
-modernc.org/tcl v1.13.1/go.mod h1:XOLfOwzhkljL4itZkK6T72ckMgvj0BDsnKNdZVUOecw=
-modernc.org/token v1.0.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-modernc.org/z v1.5.1/go.mod h1:eWFB510QWW5Th9YGZT81s+LwvaAs3Q2yr4sP0rmLkv8=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/api/auth/kubernetes/LICENSE b/api/auth/kubernetes/LICENSE
new file mode 100644
index 00000000000..a32743a27b0
--- /dev/null
+++ b/api/auth/kubernetes/LICENSE
@@ -0,0 +1,365 @@
+Copyright IBM Corp. 2016, 2025
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.
+
diff --git a/api/auth/kubernetes/go.mod b/api/auth/kubernetes/go.mod
index 62f1d365586..c6bb3b62ddf 100644
--- a/api/auth/kubernetes/go.mod
+++ b/api/auth/kubernetes/go.mod
@@ -1,5 +1,28 @@
 module github.com/hashicorp/vault/api/auth/kubernetes
 
-go 1.16
+go 1.23.0
 
-require github.com/hashicorp/vault/api v1.12.0
+toolchain go1.23.7
+
+require github.com/hashicorp/vault/api v1.22.0
+
+require (
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+)
diff --git a/api/auth/kubernetes/go.sum b/api/auth/kubernetes/go.sum
index 8645312630e..7f368024a69 100644
--- a/api/auth/kubernetes/go.sum
+++ b/api/auth/kubernetes/go.sum
@@ -1,137 +1,59 @@
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
-github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
-github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
-github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.16.2 h1:K4ev2ib4LdQETX5cSZBG0DVLk1jwGqSPXBjdah3veNs=
-github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnP3V9oNE4hmsM=
-github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/vault/api v1.12.0 h1:meCpJSesvzQyao8FCOgk2fGdoADAnbDu2WPJN1lDLJ4=
-github.com/hashicorp/vault/api v1.12.0/go.mod h1:si+lJCYO7oGkIoNPAN8j3azBLTn9SjMGS+jFaHd1Cck=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6 h1:6Su7aK7lXmJ/U79bYtBjLNaha4Fs1Rg9plHpcH+vvnE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
+github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/api/auth/kubernetes/kubernetes.go b/api/auth/kubernetes/kubernetes.go
index f0e38c17a2b..5643b50517a 100644
--- a/api/auth/kubernetes/kubernetes.go
+++ b/api/auth/kubernetes/kubernetes.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package kubernetes
diff --git a/api/auth/ldap/LICENSE b/api/auth/ldap/LICENSE
new file mode 100644
index 00000000000..a32743a27b0
--- /dev/null
+++ b/api/auth/ldap/LICENSE
@@ -0,0 +1,365 @@
+Copyright IBM Corp. 2016, 2025
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.
+
diff --git a/api/auth/ldap/go.mod b/api/auth/ldap/go.mod
index 72326b0d416..6afd4cf4f96 100644
--- a/api/auth/ldap/go.mod
+++ b/api/auth/ldap/go.mod
@@ -1,5 +1,28 @@
 module github.com/hashicorp/vault/api/auth/ldap
 
-go 1.16
+go 1.23.0
 
-require github.com/hashicorp/vault/api v1.12.0
+toolchain go1.23.7
+
+require github.com/hashicorp/vault/api v1.22.0
+
+require (
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+)
diff --git a/api/auth/ldap/go.sum b/api/auth/ldap/go.sum
index 8645312630e..7f368024a69 100644
--- a/api/auth/ldap/go.sum
+++ b/api/auth/ldap/go.sum
@@ -1,137 +1,59 @@
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
-github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
-github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
-github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.16.2 h1:K4ev2ib4LdQETX5cSZBG0DVLk1jwGqSPXBjdah3veNs=
-github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnP3V9oNE4hmsM=
-github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/vault/api v1.12.0 h1:meCpJSesvzQyao8FCOgk2fGdoADAnbDu2WPJN1lDLJ4=
-github.com/hashicorp/vault/api v1.12.0/go.mod h1:si+lJCYO7oGkIoNPAN8j3azBLTn9SjMGS+jFaHd1Cck=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6 h1:6Su7aK7lXmJ/U79bYtBjLNaha4Fs1Rg9plHpcH+vvnE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
+github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/api/auth/ldap/ldap.go b/api/auth/ldap/ldap.go
index fdf1a38dd0c..6bbf0706308 100644
--- a/api/auth/ldap/ldap.go
+++ b/api/auth/ldap/ldap.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package ldap
diff --git a/api/auth/ldap/ldap_test.go b/api/auth/ldap/ldap_test.go
index abdccb03583..d1d1f2afdb4 100644
--- a/api/auth/ldap/ldap_test.go
+++ b/api/auth/ldap/ldap_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package ldap
diff --git a/api/auth/userpass/LICENSE b/api/auth/userpass/LICENSE
new file mode 100644
index 00000000000..a32743a27b0
--- /dev/null
+++ b/api/auth/userpass/LICENSE
@@ -0,0 +1,365 @@
+Copyright IBM Corp. 2016, 2025
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.
+
diff --git a/api/auth/userpass/go.mod b/api/auth/userpass/go.mod
index e764c5e3121..1d3852e5b6f 100644
--- a/api/auth/userpass/go.mod
+++ b/api/auth/userpass/go.mod
@@ -1,5 +1,28 @@
 module github.com/hashicorp/vault/api/auth/userpass
 
-go 1.16
+go 1.23.0
 
-require github.com/hashicorp/vault/api v1.12.0
+toolchain go1.23.7
+
+require github.com/hashicorp/vault/api v1.22.0
+
+require (
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+)
diff --git a/api/auth/userpass/go.sum b/api/auth/userpass/go.sum
index 8645312630e..7f368024a69 100644
--- a/api/auth/userpass/go.sum
+++ b/api/auth/userpass/go.sum
@@ -1,137 +1,59 @@
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
-github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
-github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
-github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.16.2 h1:K4ev2ib4LdQETX5cSZBG0DVLk1jwGqSPXBjdah3veNs=
-github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnP3V9oNE4hmsM=
-github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/vault/api v1.12.0 h1:meCpJSesvzQyao8FCOgk2fGdoADAnbDu2WPJN1lDLJ4=
-github.com/hashicorp/vault/api v1.12.0/go.mod h1:si+lJCYO7oGkIoNPAN8j3azBLTn9SjMGS+jFaHd1Cck=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6 h1:6Su7aK7lXmJ/U79bYtBjLNaha4Fs1Rg9plHpcH+vvnE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
+github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/api/auth/userpass/userpass.go b/api/auth/userpass/userpass.go
index 3e8942953d3..81beddf9c11 100644
--- a/api/auth/userpass/userpass.go
+++ b/api/auth/userpass/userpass.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package userpass
diff --git a/api/auth/userpass/userpass_test.go b/api/auth/userpass/userpass_test.go
index 4fe68d8d4ef..745b51e6c80 100644
--- a/api/auth/userpass/userpass_test.go
+++ b/api/auth/userpass/userpass_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package userpass
diff --git a/api/auth_test.go b/api/auth_test.go
index ca69630cce5..847b766c676 100644
--- a/api/auth_test.go
+++ b/api/auth_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/auth_token.go b/api/auth_token.go
index 1980be06ef5..359c8ac29dd 100644
--- a/api/auth_token.go
+++ b/api/auth_token.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/cliconfig/config.go b/api/cliconfig/config.go
new file mode 100644
index 00000000000..f00b5344b71
--- /dev/null
+++ b/api/cliconfig/config.go
@@ -0,0 +1,101 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package cliconfig
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/hcl"
+	"github.com/hashicorp/hcl/hcl/ast"
+	"github.com/mitchellh/go-homedir"
+)
+
+const (
+	// defaultConfigPath is the default path to the configuration file
+	defaultConfigPath = "~/.vault"
+
+	// configPathEnv is the environment variable that can be used to
+	// override where the Vault configuration is.
+	configPathEnv = "VAULT_CONFIG_PATH"
+)
+
+// Config is the CLI configuration for Vault that can be specified via
+// a `$HOME/.vault` file which is HCL-formatted (therefore HCL or JSON).
+type defaultConfig struct {
+	// TokenHelper is the executable/command that is executed for storing
+	// and retrieving the authentication token for the Vault CLI. If this
+	// is not specified, then vault's internal token store will be used, which
+	// stores the token on disk unencrypted.
+	TokenHelper string `hcl:"token_helper"`
+}
+
+// loadConfig reads the configuration from the given path. If path is
+// empty, then the default path will be used, or the environment variable
+// if set.
+func loadConfig(path string) (config *defaultConfig, duplicate bool, err error) {
+	if path == "" {
+		path = defaultConfigPath
+	}
+	if v := os.Getenv(configPathEnv); v != "" {
+		path = v
+	}
+
+	// NOTE: requires HOME env var to be set
+	path, err = homedir.Expand(path)
+	if err != nil {
+		return nil, false, fmt.Errorf("error expanding config path %q: %w", path, err)
+	}
+
+	contents, err := os.ReadFile(path)
+	if err != nil && !os.IsNotExist(err) {
+		return nil, false, err
+	}
+
+	conf, duplicate, err := parseConfig(string(contents))
+	if err != nil {
+		return nil, duplicate, fmt.Errorf("error parsing config file at %q: %w; ensure that the file is valid; Ansible Vault is known to conflict with it", path, err)
+	}
+
+	return conf, duplicate, nil
+}
+
+// parseConfig parses the given configuration as a string.
+func parseConfig(contents string) (config *defaultConfig, duplicate bool, err error) {
+	// TODO (HCL_DUP_KEYS_DEPRECATION): on removal stage change this to a simple hcl.Parse, effectively treating
+	// duplicate keys as an error. Also get rid of all of these "duplicate" named return values
+	root, duplicate, err := parseAndCheckForDuplicateHclAttributes(contents)
+	if err != nil {
+		return nil, duplicate, err
+	}
+
+	// Top-level item should be the object list
+	list, ok := root.Node.(*ast.ObjectList)
+	if !ok {
+		return nil, duplicate, fmt.Errorf("failed to parse config; does not contain a root object")
+	}
+
+	valid := map[string]struct{}{
+		"token_helper": {},
+	}
+
+	var validationErrors error
+	for _, item := range list.Items {
+		key := item.Keys[0].Token.Value().(string)
+		if _, ok := valid[key]; !ok {
+			validationErrors = multierror.Append(validationErrors, fmt.Errorf("invalid key %q on line %d", key, item.Assign.Line))
+		}
+	}
+
+	if validationErrors != nil {
+		return nil, duplicate, validationErrors
+	}
+
+	var c defaultConfig
+	if err := hcl.DecodeObject(&c, list); err != nil {
+		return nil, duplicate, err
+	}
+	return &c, duplicate, nil
+}
diff --git a/api/cliconfig/config_test.go b/api/cliconfig/config_test.go
new file mode 100644
index 00000000000..9e5d3a65c3c
--- /dev/null
+++ b/api/cliconfig/config_test.go
@@ -0,0 +1,103 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package cliconfig
+
+import (
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestLoadConfig(t *testing.T) {
+	config, duplicate, err := loadConfig(filepath.Join("testdata", "config.hcl"))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	expected := &defaultConfig{
+		TokenHelper: "foo",
+	}
+	if !reflect.DeepEqual(expected, config) {
+		t.Fatalf("bad: %#v", config)
+	}
+
+	if duplicate {
+		t.Fatal("expected no duplicate")
+	}
+}
+
+func TestLoadConfig_noExist(t *testing.T) {
+	config, duplicate, err := loadConfig("nope/not-once/.never")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if config.TokenHelper != "" {
+		t.Errorf("expected %q to be %q", config.TokenHelper, "")
+	}
+
+	if duplicate {
+		t.Fatal("expected no duplicate")
+	}
+}
+
+func TestParseConfig_badKeys(t *testing.T) {
+	_, duplicate, err := parseConfig(`
+token_helper = "/token"
+nope = "true"
+`)
+	if err == nil {
+		t.Fatal("expected error")
+	}
+
+	if !strings.Contains(err.Error(), `invalid key "nope" on line 3`) {
+		t.Errorf("bad error: %s", err.Error())
+	}
+
+	if duplicate {
+		t.Fatal("expected no duplicate")
+	}
+}
+
+// TestParseConfig_HclDuplicateKey tests the parsing of HCL files with duplicate keys.
+// TODO (HCL_DUP_KEYS_DEPRECATION): on full removal change this test to ensure that duplicate attributes cannot be parsed
+// under any circumstances.
+func TestParseConfig_HclDuplicateKey(t *testing.T) {
+	t.Run("fail parsing without env var", func(t *testing.T) {
+		_, _, err := parseConfig(`
+token_helper = "/token"
+token_helper = "/token"
+`)
+		if err == nil {
+			t.Fatal("expected error")
+		}
+	})
+
+	t.Run("fail parsing with env var set to false", func(t *testing.T) {
+		t.Setenv(allowHclDuplicatesEnvVar, "false")
+		_, _, err := parseConfig(`
+token_helper = "/token"
+token_helper = "/token"
+`)
+		if err == nil {
+			t.Fatal("expected error")
+		}
+	})
+
+	t.Run("succeed parsing with env var set to true", func(t *testing.T) {
+		t.Setenv(allowHclDuplicatesEnvVar, "true")
+		_, duplicate, err := parseConfig(`
+token_helper = "/token"
+token_helper = "/token"
+`)
+		if err != nil {
+			t.Fatal("expected no error")
+		}
+
+		if !duplicate {
+			t.Fatal("expected duplicate")
+		}
+	})
+}
diff --git a/api/cliconfig/hcl_dup_attr_deprecation.go b/api/cliconfig/hcl_dup_attr_deprecation.go
new file mode 100644
index 00000000000..adaa969e275
--- /dev/null
+++ b/api/cliconfig/hcl_dup_attr_deprecation.go
@@ -0,0 +1,47 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package cliconfig
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/hashicorp/hcl"
+	"github.com/hashicorp/hcl/hcl/ast"
+	hclParser "github.com/hashicorp/hcl/hcl/parser"
+)
+
+// allowHclDuplicatesEnvVar is an environment variable that allows Vault to revert back to accepting HCL files with
+// duplicate attributes. It's temporary until we finish the deprecation process, at which point this will be removed
+const allowHclDuplicatesEnvVar = "VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES"
+
+// parseAndCheckForDuplicateHclAttributes parses the input JSON/HCL file and if it is HCL it also checks
+// for duplicate keys in the HCL file, allowing callers to handle the issue accordingly. It now only accepts duplicate
+// // keys if the environment variable VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES is set to true. In a future
+// // release we'll remove this function entirely and there will be no way to parse HCL files with duplicate keys.
+// // TODO (HCL_DUP_KEYS_DEPRECATION): remove once not used anymore
+func parseAndCheckForDuplicateHclAttributes(input string) (res *ast.File, duplicate bool, err error) {
+	res, err = hcl.Parse(input)
+	if err != nil && strings.Contains(err.Error(), "Each argument can only be defined once") {
+		allowHclDuplicatesRaw := os.Getenv(allowHclDuplicatesEnvVar)
+		if allowHclDuplicatesRaw == "" {
+			// default is to not allow duplicates
+			return nil, false, err
+		}
+		allowHclDuplicates, envParseErr := strconv.ParseBool(allowHclDuplicatesRaw)
+		if envParseErr != nil {
+			return nil, false, fmt.Errorf("error parsing %q environment variable: %w", allowHclDuplicatesEnvVar, err)
+		}
+		if !allowHclDuplicates {
+			return nil, false, err
+		}
+
+		// if allowed by the environment variable, parse again without failing on duplicate attributes
+		duplicate = true
+		res, err = hclParser.ParseDontErrorOnDuplicateKeys([]byte(input))
+	}
+	return res, duplicate, err
+}
diff --git a/api/cliconfig/testdata/config.hcl b/api/cliconfig/testdata/config.hcl
new file mode 100644
index 00000000000..5371b6dffa3
--- /dev/null
+++ b/api/cliconfig/testdata/config.hcl
@@ -0,0 +1,4 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: MPL-2.0
+
+token_helper = "foo"
diff --git a/api/cliconfig/util.go b/api/cliconfig/util.go
new file mode 100644
index 00000000000..715212bc982
--- /dev/null
+++ b/api/cliconfig/util.go
@@ -0,0 +1,36 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package cliconfig
+
+import (
+	"github.com/hashicorp/vault/api/tokenhelper"
+)
+
+// DefaultTokenHelper returns the token helper that is configured for Vault.
+// This helper should only be used for non-server CLI commands.
+func DefaultTokenHelper() (tokenhelper.TokenHelper, error) {
+	config, _, err := DefaultTokenHelperCheckDuplicates()
+	return config, err
+}
+
+// TODO (HCL_DUP_KEYS_DEPRECATION): eventually make this consider duplicates an error. Ideally we should remove it but
+// maybe we can't since it's become part of the API pkg.
+func DefaultTokenHelperCheckDuplicates() (helper tokenhelper.TokenHelper, duplicate bool, err error) {
+	config, duplicate, err := loadConfig("")
+	if err != nil {
+		return nil, duplicate, err
+	}
+
+	path := config.TokenHelper
+	if path == "" {
+		helper, err = tokenhelper.NewInternalTokenHelper()
+		return helper, duplicate, err
+	}
+
+	path, err = tokenhelper.ExternalTokenHelperPath(path)
+	if err != nil {
+		return nil, duplicate, err
+	}
+	return &tokenhelper.ExternalTokenHelper{BinaryPath: path}, duplicate, nil
+}
diff --git a/api/client.go b/api/client.go
index 52c991b1e2f..c99366a3056 100644
--- a/api/client.go
+++ b/api/client.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -10,6 +10,7 @@ import (
 	"crypto/tls"
 	"encoding/base64"
 	"encoding/hex"
+	"encoding/json"
 	"fmt"
 	"net"
 	"net/http"
@@ -41,6 +42,7 @@ const (
 	EnvVaultClientCert       = "VAULT_CLIENT_CERT"
 	EnvVaultClientKey        = "VAULT_CLIENT_KEY"
 	EnvVaultClientTimeout    = "VAULT_CLIENT_TIMEOUT"
+	EnvVaultHeaders          = "VAULT_HEADERS"
 	EnvVaultSRVLookup        = "VAULT_SRV_LOOKUP"
 	EnvVaultSkipVerify       = "VAULT_SKIP_VERIFY"
 	EnvVaultNamespace        = "VAULT_NAMESPACE"
@@ -68,6 +70,9 @@ const (
 	// SSRF protection.
 	RequestHeaderName = "X-Vault-Request"
 
+	SnapshotHeaderName          = "X-Vault-Recover-Snapshot-Id"
+	RecoverSourcePathHeaderName = "X-Vault-Recover-Source-Path"
+
 	TLSErrorString = "This error usually means that the server is running with TLS disabled\n" +
 		"but the client is configured to use TLS. Please either enable TLS\n" +
 		"on the server or run the client with -address set to an address\n" +
@@ -256,7 +261,7 @@ func DefaultConfig() *Config {
 		MinRetryWait: time.Millisecond * 1000,
 		MaxRetryWait: time.Millisecond * 1500,
 		MaxRetries:   2,
-		Backoff:      retryablehttp.LinearJitterBackoff,
+		Backoff:      retryablehttp.RateLimitLinearJitterBackoff,
 	}
 
 	transport := config.HttpClient.Transport.(*http.Transport)
@@ -665,6 +670,30 @@ func NewClient(c *Config) (*Client, error) {
 		client.setNamespace(namespace)
 	}
 
+	if envHeaders := os.Getenv(EnvVaultHeaders); envHeaders != "" {
+		var result map[string]any
+		err := json.Unmarshal([]byte(envHeaders), &result)
+		if err != nil {
+			return nil, fmt.Errorf("could not unmarshal environment-supplied headers")
+		}
+		var forbiddenHeaders []string
+		for key, value := range result {
+			if strings.HasPrefix(key, "X-Vault-") {
+				forbiddenHeaders = append(forbiddenHeaders, key)
+				continue
+			}
+
+			value, ok := value.(string)
+			if !ok {
+				return nil, fmt.Errorf("environment-supplied headers include non-string values")
+			}
+			client.AddHeader(key, value)
+		}
+		if len(forbiddenHeaders) > 0 {
+			return nil, fmt.Errorf("failed to setup Headers[%s]: Header starting by 'X-Vault-' are for internal usage only", strings.Join(forbiddenHeaders, ", "))
+		}
+	}
+
 	return client, nil
 }
 
@@ -705,7 +734,7 @@ func (c *Client) SetAddress(addr string) error {
 
 	parsedAddr, err := c.config.ParseAddress(addr)
 	if err != nil {
-		return errwrap.Wrapf("failed to set address: {{err}}", err)
+		return fmt.Errorf("failed to set address: %w", err)
 	}
 
 	c.addr = parsedAddr
@@ -1441,6 +1470,12 @@ START:
 	}
 
 	if outputCurlString {
+		// Note that although we're building this up here and returning it as an error object, the Error()
+		// interface method on it only gets called in a context where the actual string returned from that
+		// method is irrelevant, because it gets swallowed by an error buffer that's never output to the user.
+		// That's on purpose, not a bug, because in this case, OutputStringError is not really an _error_, per se.
+		// It's just a way of aborting the control flow so that requests don't actually execute, and instead,
+		// we can detect what's happened back in the CLI machinery and show the actual curl string to the user.
 		LastOutputStringError = &OutputStringError{
 			Request:       req,
 			TLSSkipVerify: c.config.HttpClient.Transport.(*http.Transport).TLSClientConfig.InsecureSkipVerify,
diff --git a/api/client_test.go b/api/client_test.go
index f89d5315278..2cfdaf189e9 100644
--- a/api/client_test.go
+++ b/api/client_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"context"
 	"crypto/tls"
-	"crypto/x509"
 	"encoding/base64"
 	"fmt"
 	"io"
@@ -330,7 +329,7 @@ func TestDefaulRetryPolicy(t *testing.T) {
 		},
 		"don't retry connection failures": {
 			err: &url.Error{
-				Err: x509.UnknownAuthorityError{},
+				Err: &tls.CertificateVerificationError{},
 			},
 		},
 		"don't retry on 200": {
@@ -375,6 +374,61 @@ func TestDefaulRetryPolicy(t *testing.T) {
 	}
 }
 
+func TestClientEnvHeaders(t *testing.T) {
+	oldHeaders := os.Getenv(EnvVaultHeaders)
+
+	defer func() {
+		os.Setenv(EnvVaultHeaders, oldHeaders)
+	}()
+
+	cases := []struct {
+		Input string
+		Valid bool
+	}{
+		{
+			"{}",
+			true,
+		},
+		{
+			"{\"foo\": \"bar\"}",
+			true,
+		},
+		{
+			"{\"foo\": 1}", // Values must be strings
+			false,
+		},
+		{
+			"{\"X-Vault-Foo\": \"bar\"}", // X-Vault-* not allowed
+			false,
+		},
+	}
+
+	for _, tc := range cases {
+		os.Setenv(EnvVaultHeaders, tc.Input)
+		config := DefaultConfig()
+		config.ReadEnvironment()
+		_, err := NewClient(config)
+		if err != nil {
+			if tc.Valid {
+				t.Fatalf("unexpected error reading headers from environment: %v", err)
+			}
+		} else {
+			if !tc.Valid {
+				t.Fatal("no error reading headers from environment when error was expected")
+			}
+		}
+	}
+
+	os.Setenv(EnvVaultHeaders, "{\"foo\": \"bar\"}")
+	config := DefaultConfig()
+	config.ReadEnvironment()
+	cli, _ := NewClient(config)
+
+	if !reflect.DeepEqual(cli.Headers().Values("foo"), []string{"bar"}) {
+		t.Error("Environment-supplied headers not set in CLI client")
+	}
+}
+
 func TestClientEnvSettings(t *testing.T) {
 	cwd, _ := os.Getwd()
 
diff --git a/api/go.mod b/api/go.mod
index 74b526cacae..6a72cf61978 100644
--- a/api/go.mod
+++ b/api/go.mod
@@ -5,39 +5,41 @@ module github.com/hashicorp/vault/api
 // automatically track the Go version used to build Vault itself.  Many projects import
 // the api module and we don't want to impose a newer version on them any more than we
 // have to.
-go 1.19
+go 1.23.0
+
+toolchain go1.23.7
 
 require (
-	github.com/cenkalti/backoff/v3 v3.0.0
-	github.com/go-jose/go-jose/v3 v3.0.1
-	github.com/go-test/deep v1.0.2
+	github.com/cenkalti/backoff/v4 v4.3.0
+	github.com/go-jose/go-jose/v4 v4.1.1
+	github.com/go-test/deep v1.1.1
 	github.com/hashicorp/errwrap v1.1.0
 	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-hclog v0.16.2
+	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-retryablehttp v0.6.6
+	github.com/hashicorp/go-retryablehttp v0.7.8
 	github.com/hashicorp/go-rootcerts v1.0.2
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2
-	github.com/hashicorp/hcl v1.0.0
+	github.com/hashicorp/hcl v1.0.1-vault-7
+	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/stretchr/testify v1.8.4
-	golang.org/x/net v0.17.0
-	golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1
+	github.com/natefinch/atomic v1.0.1
+	github.com/stretchr/testify v1.10.0
+	golang.org/x/net v0.42.0
+	golang.org/x/time v0.12.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/fatih/color v1.7.0 // indirect
-	github.com/google/go-cmp v0.5.7 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
-	github.com/mattn/go-colorable v0.1.6 // indirect
-	github.com/mattn/go-isatty v0.0.12 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	golang.org/x/crypto v0.17.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/api/go.sum b/api/go.sum
index 13cac579c03..46acd78d294 100644
--- a/api/go.sum
+++ b/api/go.sum
@@ -1,96 +1,75 @@
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/cenkalti/backoff/v3 v3.0.0 h1:ske+9nBpD9qZsTBoF41nW5L+AIuFBKMeze18XQ3eG1c=
-github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
-github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
-github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7 h1:81/ik6ipDQS2aGcBfIN5dHDB36BwrStyeAQquSYCV4o=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
+github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.16.2 h1:K4ev2ib4LdQETX5cSZBG0DVLk1jwGqSPXBjdah3veNs=
-github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnP3V9oNE4hmsM=
-github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6 h1:6Su7aK7lXmJ/U79bYtBjLNaha4Fs1Rg9plHpcH+vvnE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
-github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/natefinch/atomic v1.0.1 h1:ZPYKxkqQOx3KZ+RsbnP/YsgvxWQPGxjC0oBt2AhwV0A=
+github.com/natefinch/atomic v1.0.1/go.mod h1:N/D/ELrljoqDyT3rZrsUmtsuzvHkeB/wWjHV22AZRbM=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/api/hcl_dup_attr_deprecation.go b/api/hcl_dup_attr_deprecation.go
new file mode 100644
index 00000000000..8d00fa3deb7
--- /dev/null
+++ b/api/hcl_dup_attr_deprecation.go
@@ -0,0 +1,47 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package api
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/hashicorp/hcl"
+	"github.com/hashicorp/hcl/hcl/ast"
+	hclParser "github.com/hashicorp/hcl/hcl/parser"
+)
+
+// allowHclDuplicatesEnvVar is an environment variable that allows Vault to revert back to accepting HCL files with
+// duplicate attributes. It's temporary until we finish the deprecation process, at which point this will be removed
+const allowHclDuplicatesEnvVar = "VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES"
+
+// parseAndCheckForDuplicateHclAttributes parses the input JSON/HCL file and if it is HCL it also checks
+// for duplicate keys in the HCL file, allowing callers to handle the issue accordingly. It now only accepts duplicate
+// keys if the environment variable VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES is set to true. In a future
+// release we'll remove this function entirely and there will be no way to parse HCL files with duplicate keys.
+// TODO (HCL_DUP_KEYS_DEPRECATION): remove once not used anymore
+func parseAndCheckForDuplicateHclAttributes(input string) (res *ast.File, duplicate bool, err error) {
+	res, err = hcl.Parse(input)
+	if err != nil && strings.Contains(err.Error(), "Each argument can only be defined once") {
+		allowHclDuplicatesRaw := os.Getenv(allowHclDuplicatesEnvVar)
+		if allowHclDuplicatesRaw == "" {
+			// default is to not allow duplicates
+			return nil, false, err
+		}
+		allowHclDuplicates, envParseErr := strconv.ParseBool(allowHclDuplicatesRaw)
+		if envParseErr != nil {
+			return nil, false, fmt.Errorf("error parsing %q environment variable: %w", allowHclDuplicatesEnvVar, err)
+		}
+		if !allowHclDuplicates {
+			return nil, false, err
+		}
+
+		// if allowed by the environment variable, parse again without failing on duplicate attributes
+		duplicate = true
+		res, err = hclParser.ParseDontErrorOnDuplicateKeys([]byte(input))
+	}
+	return res, duplicate, err
+}
diff --git a/api/help.go b/api/help.go
index c119f6c3c95..1edbcefa457 100644
--- a/api/help.go
+++ b/api/help.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/kv.go b/api/kv.go
index 72039325469..2b555a99605 100644
--- a/api/kv.go
+++ b/api/kv.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/kv_test.go b/api/kv_test.go
index 36d769feaa6..dc913ce9a2a 100644
--- a/api/kv_test.go
+++ b/api/kv_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/kv_v1.go b/api/kv_v1.go
index a914e03576e..923f7abf9c7 100644
--- a/api/kv_v1.go
+++ b/api/kv_v1.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/kv_v2.go b/api/kv_v2.go
index 72c29eaa426..e764fa22091 100644
--- a/api/kv_v2.go
+++ b/api/kv_v2.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/lifetime_watcher.go b/api/lifetime_watcher.go
index 5c060e5a150..2f000e12cbc 100644
--- a/api/lifetime_watcher.go
+++ b/api/lifetime_watcher.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -6,10 +6,11 @@ package api
 import (
 	"errors"
 	"math/rand"
+	"strings"
 	"sync"
 	"time"
 
-	"github.com/cenkalti/backoff/v3"
+	"github.com/cenkalti/backoff/v4"
 )
 
 var (
@@ -31,6 +32,7 @@ var (
 	DefaultRenewerRenewBuffer = 5
 )
 
+//go:generate enumer -type=RenewBehavior -trimprefix=RenewBehavior
 type RenewBehavior uint
 
 const (
@@ -288,12 +290,18 @@ func (r *LifetimeWatcher) doRenewWithOptions(tokenMode bool, nonRenewable bool,
 		switch {
 		case nonRenewable || r.renewBehavior == RenewBehaviorRenewDisabled:
 			// Can't or won't renew, just keep the same expiration so we exit
-			// when it's reauthentication time
+			// when it's re-authentication time
 			remainingLeaseDuration = fallbackLeaseDuration
 
 		default:
 			// Renew the token
 			renewal, err = renew(credString, r.increment)
+			if err != nil && strings.Contains(err.Error(), "permission denied") {
+				// We can't renew since the token doesn't have permission to. Fall back
+				// to the code path for non-renewable tokens.
+				nonRenewable = true
+				continue
+			}
 			if err != nil || renewal == nil || (tokenMode && renewal.Auth == nil) {
 				if r.renewBehavior == RenewBehaviorErrorOnErrors {
 					if err != nil {
@@ -349,8 +357,11 @@ func (r *LifetimeWatcher) doRenewWithOptions(tokenMode bool, nonRenewable bool,
 
 		if errorBackoff == nil {
 			sleepDuration = r.calculateSleepDuration(remainingLeaseDuration, priorDuration)
-		} else if errorBackoff.NextBackOff() == backoff.Stop {
-			return err
+		} else {
+			sleepDuration = errorBackoff.NextBackOff()
+			if sleepDuration == backoff.Stop {
+				return err
+			}
 		}
 
 		// remainingLeaseDuration becomes the priorDuration for the next loop
diff --git a/api/logical.go b/api/logical.go
index 068e9068f38..1f208e3f2d5 100644
--- a/api/logical.go
+++ b/api/logical.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -7,8 +7,10 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"net/http"
 	"net/url"
 	"os"
@@ -64,11 +66,25 @@ func (c *Logical) ReadWithData(path string, data map[string][]string) (*Secret,
 	return c.ReadWithDataWithContext(context.Background(), path, data)
 }
 
+// ReadFromSnapshot reads the data at the given Vault path from a previously
+// loaded snapshot. The snapshotID parameter is the ID of the loaded snapshot
+func (c *Logical) ReadFromSnapshot(path string, snapshotID string) (*Secret, error) {
+	return c.ReadWithData(path, map[string][]string{"read_snapshot_id": {snapshotID}})
+}
+
 func (c *Logical) ReadWithDataWithContext(ctx context.Context, path string, data map[string][]string) (*Secret, error) {
 	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
 	defer cancelFunc()
 
-	resp, err := c.readRawWithDataWithContext(ctx, path, data)
+	resp, err := c.readRawWithDataWithContext(ctx, path, data, nil)
+	return c.ParseRawResponseAndCloseBody(resp, err)
+}
+
+// ReadWithRequest returns a Secret for the given LogicalReadRequest. This is a
+// more flexible version of ReadWithContext, which allows for passing extra
+// headers to the Vault server.
+func (c *Logical) ReadWithRequest(ctx context.Context, req LogicalReadRequest) (*Secret, error) {
+	resp, err := c.readRawWithDataWithContext(ctx, req.Path(), req.Values(), req.Headers())
 	return c.ParseRawResponseAndCloseBody(resp, err)
 }
 
@@ -104,6 +120,10 @@ func (c *Logical) ReadRawWithData(path string, data map[string][]string) (*Respo
 	return c.ReadRawWithDataWithContext(context.Background(), path, data)
 }
 
+func (c *Logical) ReadRawFromSnapshot(path string, snapshotID string) (*Response, error) {
+	return c.ReadRawWithDataWithContext(context.Background(), path, map[string][]string{"read_snapshot_id": {snapshotID}})
+}
+
 // ReadRawWithDataWithContext attempts to read the value stored at the given
 // Vault path (without '/v1/' prefix) and returns a raw *http.Response. The 'data'
 // map is added as query parameters to the request.
@@ -112,7 +132,7 @@ func (c *Logical) ReadRawWithData(path string, data map[string][]string) (*Respo
 // request timeout; if a timeout is desired, please set it through
 // context.WithTimeout or context.WithDeadline.
 func (c *Logical) ReadRawWithDataWithContext(ctx context.Context, path string, data map[string][]string) (*Response, error) {
-	return c.readRawWithDataWithContext(ctx, path, data)
+	return c.readRawWithDataWithContext(ctx, path, data, nil)
 }
 
 func (c *Logical) ParseRawResponseAndCloseBody(resp *Response, err error) (*Secret, error) {
@@ -140,35 +160,40 @@ func (c *Logical) ParseRawResponseAndCloseBody(resp *Response, err error) (*Secr
 	return ParseSecret(resp.Body)
 }
 
-func (c *Logical) readRawWithDataWithContext(ctx context.Context, path string, data map[string][]string) (*Response, error) {
+func (c *Logical) readRawWithDataWithContext(ctx context.Context, path string, values url.Values, extraHeaders http.Header) (*Response, error) {
 	r := c.c.NewRequest(http.MethodGet, "/v1/"+path)
 
-	var values url.Values
-	for k, v := range data {
-		if values == nil {
-			values = make(url.Values)
-		}
-		for _, val := range v {
-			values.Add(k, val)
-		}
+	if err := c.addExtraHeaders(r, extraHeaders); err != nil {
+		return nil, err
 	}
 
 	if values != nil {
-		r.Params = values
+		r.Params = maps.Clone(values)
 	}
 
 	return c.c.RawRequestWithContext(ctx, r)
 }
 
+// ListFromSnapshot lists from the Vault path using a previously loaded
+// snapshot. The snapshotID parameter is the ID of the loaded snapshot
+func (c *Logical) ListFromSnapshot(path string, snapshotID string) (*Secret, error) {
+	r := c.c.NewRequest("LIST", "/v1/"+path)
+	r.Params.Set("read_snapshot_id", snapshotID)
+	return c.list(context.Background(), r)
+}
+
 func (c *Logical) List(path string) (*Secret, error) {
 	return c.ListWithContext(context.Background(), path)
 }
 
 func (c *Logical) ListWithContext(ctx context.Context, path string) (*Secret, error) {
+	return c.list(ctx, c.c.NewRequest("LIST", "/v1/"+path))
+}
+
+func (c *Logical) list(ctx context.Context, r *Request) (*Secret, error) {
 	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
 	defer cancelFunc()
 
-	r := c.c.NewRequest("LIST", "/v1/"+path)
 	// Set this for broader compatibility, but we use LIST above to be able to
 	// handle the wrapping lookup function
 	r.Method = http.MethodGet
@@ -223,6 +248,74 @@ func (c *Logical) WriteRawWithContext(ctx context.Context, path string, data []b
 	return c.writeRaw(ctx, r)
 }
 
+// WriteWithRequest returns a Secret for the given LogicalRequest. This is a
+// more flexible version of WriteWithContext, which allows for passing extra
+// headers to the Vault server.
+func (c *Logical) WriteWithRequest(ctx context.Context, req LogicalWriteRequest) (*Secret, error) {
+	r := c.c.NewRequest(http.MethodPut, "/v1/"+req.Path())
+	if err := c.addExtraHeaders(r, req.Headers()); err != nil {
+		return nil, err
+	}
+
+	if err := r.SetJSONBody(req.Data()); err != nil {
+		return nil, err
+	}
+
+	return c.write(ctx, req.Path(), r)
+}
+
+// addExtraHeaders adds the given headers to the request, but only if they are
+// not already set in the request. If a header is already set in the request, it
+// returns an error for each header that is already set.
+func (c *Logical) addExtraHeaders(r *Request, headers http.Header) error {
+	var errs error
+
+	if r == nil {
+		return fmt.Errorf("cannot add extra headers to nil request")
+	}
+
+	if len(headers) == 0 {
+		return nil
+	}
+
+	if r.Headers == nil {
+		r.Headers = headers
+		return nil
+	}
+
+	curHeaders := r.Headers.Clone()
+	for k, v := range headers {
+		ck := http.CanonicalHeaderKey(k)
+		if curVal := curHeaders.Get(ck); curVal != "" {
+			errs = errors.Join(errs, fmt.Errorf("cannot set extra header %q, it is reserved", ck))
+			continue
+		}
+		curHeaders[ck] = v
+	}
+	if errs != nil {
+		return fmt.Errorf("cannot add extra headers: %w", errs)
+	}
+
+	r.Headers = curHeaders
+	return nil
+}
+
+// Recover recovers the data at the given Vault path from a loaded snapshot.
+// The snapshotID parameter is the ID of the loaded snapshot
+func (c *Logical) Recover(ctx context.Context, path string, snapshotID string) (*Secret, error) {
+	return c.RecoverFromPath(ctx, path, snapshotID, "")
+}
+
+func (c *Logical) RecoverFromPath(ctx context.Context, newPath string, snapshotID string, originalPath string) (*Secret, error) {
+	r := c.c.NewRequest(http.MethodPut, "/v1/"+newPath)
+	r.Params.Set("recover_snapshot_id", snapshotID)
+	r.Headers.Set(SnapshotHeaderName, snapshotID)
+	if originalPath != "" && originalPath != newPath {
+		r.Headers.Set(RecoverSourcePathHeaderName, originalPath)
+	}
+	return c.write(ctx, originalPath, r)
+}
+
 func (c *Logical) JSONMergePatch(ctx context.Context, path string, data map[string]interface{}) (*Secret, error) {
 	r := c.c.NewRequest(http.MethodPatch, "/v1/"+path)
 	r.Headers.Set("Content-Type", "application/merge-patch+json")
@@ -292,24 +385,33 @@ func (c *Logical) DeleteWithData(path string, data map[string][]string) (*Secret
 	return c.DeleteWithDataWithContext(context.Background(), path, data)
 }
 
+// DeleteWithRequest returns a Secret for the given LogicalDeleteRequest. This is a
+// more flexible version of DeleteWithContext, which allows for passing extra
+// headers to the Vault server.
+func (c *Logical) DeleteWithRequest(ctx context.Context, req LogicalDeleteRequest) (*Secret, error) {
+	return c.DeleteWithDataWithContext(ctx, req.Path(), req.Values())
+}
+
 func (c *Logical) DeleteWithDataWithContext(ctx context.Context, path string, data map[string][]string) (*Secret, error) {
+	return c.deleteWithDataWithContext(ctx, path, data)
+}
+
+func (c *Logical) deleteWithDataWithContext(ctx context.Context, path string, data map[string][]string) (*Secret, error) {
+	return c.delete(ctx, NewDeleteRequest(path, data, nil))
+}
+
+func (c *Logical) delete(ctx context.Context, req LogicalDeleteRequest) (*Secret, error) {
 	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
 	defer cancelFunc()
 
-	r := c.c.NewRequest(http.MethodDelete, "/v1/"+path)
+	r := c.c.NewRequest(http.MethodDelete, "/v1/"+req.Path())
 
-	var values url.Values
-	for k, v := range data {
-		if values == nil {
-			values = make(url.Values)
-		}
-		for _, val := range v {
-			values.Add(k, val)
-		}
+	if values := req.Values(); values != nil {
+		r.Params = values
 	}
 
-	if values != nil {
-		r.Params = values
+	if err := c.addExtraHeaders(r, req.Headers()); err != nil {
+		return nil, err
 	}
 
 	resp, err := c.c.rawRequestWithContext(ctx, r)
diff --git a/api/logical_requests.go b/api/logical_requests.go
new file mode 100644
index 00000000000..fb8f722deee
--- /dev/null
+++ b/api/logical_requests.go
@@ -0,0 +1,119 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package api
+
+import (
+	"maps"
+	"net/http"
+	"net/url"
+)
+
+var _ LogicalRequest = (*defaultLogicalRequest)(nil)
+
+// NewLogicalReadRequest creates a new LogicalReadRequest with the given path,
+// values, and headers.
+func NewLogicalReadRequest(path string, values url.Values, headers http.Header) LogicalReadRequest {
+	return newLogicalRequest(path, values, nil, headers)
+}
+
+// NewLogicalWriteRequest creates a new LogicalWriteRequest with the given path,
+// data, and headers.
+func NewLogicalWriteRequest(path string, data map[string]interface{}, headers http.Header) LogicalWriteRequest {
+	return newLogicalRequest(path, nil, data, headers)
+}
+
+// NewDeleteRequest creates a new LogicalDeleteRequest with the given path and values.
+func NewDeleteRequest(path string, values url.Values, headers http.Header) LogicalDeleteRequest {
+	return newLogicalRequest(path, values, nil, headers)
+}
+
+// newLogicalRequest creates a new LogicalRequest with the given path, values,
+// data, and headers.
+func newLogicalRequest(path string, values url.Values, data map[string]interface{}, headers http.Header) LogicalRequest {
+	return &defaultLogicalRequest{
+		path:    path,
+		values:  values,
+		data:    data,
+		headers: headers,
+	}
+}
+
+// BaseLogicalRequest is the interface for requests to Vault's logical backend
+// that do not include data or values.
+type BaseLogicalRequest interface {
+	// Path returns the path to write to in Vault, without the "/v1/" prefix.
+	Path() string
+	// Headers returns the headers to be included in the request to Vault. All
+	// headers are additive, and must not collide with any of the reserved headers.
+	Headers() http.Header
+}
+
+// LogicalRequest is the interface for requests to Vault's logical backend.
+type LogicalRequest interface {
+	BaseLogicalRequest
+	// Values returns the query parameters to be used in the request.
+	// Values are only used in read and delete requests.
+	Values() url.Values
+	// Data returns the data to be written to the path. It is marshaled to JSON.
+	// Data is only used in write requests.
+	Data() map[string]interface{}
+}
+
+// LogicalWriteRequest is the interface for requests that write data to Vault's
+// logical backend.
+type LogicalWriteRequest interface {
+	BaseLogicalRequest
+	Data() map[string]interface{}
+}
+
+// LogicalReadRequest is the interface for requests that read data from Vault's
+// logical backend.
+type LogicalReadRequest interface {
+	BaseLogicalRequest
+	Values() url.Values
+}
+
+// LogicalDeleteRequest is the interface for requests that delete data from Vault's
+// logical backend. It is semantically similar the same as a read request,
+type LogicalDeleteRequest interface {
+	BaseLogicalRequest
+	Values() url.Values
+}
+
+// defaultLogicalRequest is the default implementation of LogicalRequest.
+type defaultLogicalRequest struct {
+	path    string
+	values  url.Values
+	headers http.Header
+	data    map[string]interface{}
+}
+
+// Path returns the path to write to in Vault, without the "/v1/" prefix.
+func (r *defaultLogicalRequest) Path() string {
+	return r.path
+}
+
+// Headers returns a copy of the headers to be included in the request to Vault.
+func (r *defaultLogicalRequest) Headers() http.Header {
+	if r.headers == nil {
+		return nil
+	}
+	return maps.Clone(r.headers)
+}
+
+// Data returns a copy of the data to be written to the path.
+func (r *defaultLogicalRequest) Data() map[string]interface{} {
+	if r.data == nil {
+		return nil
+	}
+	return maps.Clone(r.data)
+}
+
+// Values returns a copy of the query parameters to be used in the request.
+func (r *defaultLogicalRequest) Values() url.Values {
+	if r.values == nil {
+		return nil
+	}
+	return maps.Clone(r.values)
+}
diff --git a/api/logical_requests_test.go b/api/logical_requests_test.go
new file mode 100644
index 00000000000..aa5b101f2bd
--- /dev/null
+++ b/api/logical_requests_test.go
@@ -0,0 +1,219 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package api
+
+import (
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_newLogicalRequest(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		path    string
+		values  url.Values
+		data    map[string]interface{}
+		headers http.Header
+		want    LogicalRequest
+	}{
+		{
+			name:    "read request",
+			path:    "sys/health",
+			values:  url.Values{"standbyok": []string{"true"}},
+			data:    nil,
+			headers: http.Header{"X-Read-Request": []string{"true"}},
+			want: &defaultLogicalRequest{
+				path:    "sys/health",
+				values:  url.Values{"standbyok": []string{"true"}},
+				headers: http.Header{"X-Read-Request": []string{"true"}},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, newLogicalRequest(tt.path, tt.values, tt.data, tt.headers), "newLogicalRequest(%v, %v, %v, %v)", tt.path, tt.values, tt.data, tt.headers)
+		})
+	}
+}
+
+func Test_defaultLogicalRequest(t *testing.T) {
+	t.Parallel()
+
+	type want struct {
+		path    string
+		headers http.Header
+		values  url.Values
+		data    map[string]interface{}
+	}
+
+	tests := []struct {
+		name    string
+		want    want
+		request *defaultLogicalRequest
+	}{
+		{
+			name: "all",
+			want: want{
+				path:    "sys/health",
+				values:  url.Values{"standbyok": []string{"true"}},
+				data:    map[string]interface{}{"key": "value"},
+				headers: http.Header{"X-Read-Request": []string{"true"}},
+			},
+			request: &defaultLogicalRequest{
+				path:    "sys/health",
+				values:  url.Values{"standbyok": []string{"true"}},
+				data:    map[string]interface{}{"key": "value"},
+				headers: http.Header{"X-Read-Request": []string{"true"}},
+			},
+		},
+		{
+			name:    "empty",
+			want:    want{},
+			request: &defaultLogicalRequest{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := tt.request
+			assert.Equalf(t, tt.want.path, r.Path(), "Path()")
+
+			gotData := r.Data()
+			if assert.Equalf(t, tt.want.data, gotData, "Data()") {
+				if tt.want.data != nil {
+					gotData["other"] = "value" // Ensure that Data() returns a copy
+					assert.NotEqualf(t, gotData, r.Data(), "Data() should return a copy")
+				}
+			}
+
+			gotHeaders := r.Headers()
+			if assert.Equalf(t, tt.want.headers, gotHeaders, "Headers()") {
+				if tt.want.headers != nil {
+					gotHeaders["X-other"] = []string{"false"} // Ensure that Headers() returns a copy
+					assert.NotEqualf(t, gotHeaders, r.Headers(), "Headers() should return a copy")
+				}
+			}
+
+			gotValues := r.Values()
+			if assert.Equalf(t, tt.want.values, gotValues, "Values()") {
+				if gotValues != nil {
+					gotValues.Add("other", "value") // Ensure that Values() returns a copy
+					assert.NotEqualf(t, gotValues, r.Values(), "Values() should return a copy")
+				}
+			}
+		})
+	}
+}
+
+func TestNewLogicalReadRequest(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		path    string
+		values  url.Values
+		headers http.Header
+		want    LogicalReadRequest
+	}{
+		{
+			name: "basic read request",
+			path: "sys/health",
+			want: &defaultLogicalRequest{
+				path: "sys/health",
+			},
+		},
+		{
+			name:   "read request with values",
+			path:   "sys/health",
+			values: url.Values{"standbyok": []string{"true"}},
+			want: &defaultLogicalRequest{
+				path:   "sys/health",
+				values: url.Values{"standbyok": []string{"true"}},
+			},
+		},
+		{
+			name:    "read request with headers",
+			path:    "sys/health",
+			headers: http.Header{"X-Read-Request": []string{"true"}},
+			want: &defaultLogicalRequest{
+				path:    "sys/health",
+				headers: http.Header{"X-Read-Request": []string{"true"}},
+			},
+		},
+		{
+			name:    "read request with values and headers",
+			path:    "sys/health",
+			headers: http.Header{"X-Read-Request": []string{"true"}},
+			values:  url.Values{"standbyok": []string{"true"}},
+			want: &defaultLogicalRequest{
+				path:    "sys/health",
+				headers: http.Header{"X-Read-Request": []string{"true"}},
+				values:  url.Values{"standbyok": []string{"true"}},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, NewLogicalReadRequest(tt.path, tt.values, tt.headers), "NewLogicalReadRequest(%v, %v, %v)", tt.path, tt.values, tt.headers)
+		})
+	}
+}
+
+func TestNewLogicalWriteRequest(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		path    string
+		data    map[string]interface{}
+		headers http.Header
+		want    LogicalWriteRequest
+	}{
+		{
+			name: "basic read request",
+			path: "sys/health",
+			want: &defaultLogicalRequest{
+				path: "sys/health",
+			},
+		},
+		{
+			name: "read request with data",
+			path: "sys/health",
+			data: map[string]interface{}{"key": "value"},
+			want: &defaultLogicalRequest{
+				path: "sys/health",
+				data: map[string]interface{}{"key": "value"},
+			},
+		},
+		{
+			name:    "read request with headers",
+			path:    "sys/health",
+			headers: http.Header{"X-Read-Request": []string{"true"}},
+			want: &defaultLogicalRequest{
+				path:    "sys/health",
+				headers: http.Header{"X-Read-Request": []string{"true"}},
+			},
+		},
+		{
+			name:    "read request with data and headers",
+			path:    "sys/health",
+			headers: http.Header{"X-Read-Request": []string{"true"}},
+			data:    map[string]interface{}{"key": "value"},
+			want: &defaultLogicalRequest{
+				path:    "sys/health",
+				headers: http.Header{"X-Read-Request": []string{"true"}},
+				data:    map[string]interface{}{"key": "value"},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, NewLogicalWriteRequest(tt.path, tt.data, tt.headers), "NewLogicalWriteRequest(%v, %v, %v)", tt.path, tt.data, tt.headers)
+		})
+	}
+}
diff --git a/api/logical_test.go b/api/logical_test.go
new file mode 100644
index 00000000000..21a62adf057
--- /dev/null
+++ b/api/logical_test.go
@@ -0,0 +1,113 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package api
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestLogical_addExtraHeaders(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name        string
+		r           *Request
+		headers     http.Header
+		wantHeaders http.Header
+		wantErr     assert.ErrorAssertionFunc
+	}{
+		{
+			name: "nil headers",
+			r: &Request{
+				Headers: http.Header{
+					"X-Other-Header": []string{"other-value"},
+				},
+			},
+			headers: nil,
+			wantHeaders: http.Header{
+				"X-Other-Header": []string{"other-value"},
+			},
+			wantErr: assert.NoError,
+		},
+		{
+			name: "empty headers",
+			r: &Request{
+				Headers: http.Header{
+					"X-Other-Header": []string{"other-value"},
+				},
+			},
+			headers: http.Header{},
+			wantHeaders: http.Header{
+				"X-Other-Header": []string{"other-value"},
+			},
+			wantErr: assert.NoError,
+		},
+		{
+			name:    "no headers",
+			r:       &Request{},
+			wantErr: assert.NoError,
+		},
+		{
+			name: "nil request",
+			headers: http.Header{
+				"X-Extra-Header": []string{"real-value"},
+			},
+			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
+				return assert.ErrorContains(t, err, "nil request", i...)
+			},
+		},
+		{
+			name: "extra headers",
+			r: &Request{
+				Headers: http.Header{
+					"X-Other-Header": []string{"other-value"},
+				},
+			},
+			headers: http.Header{
+				"X-Extra-Header": []string{"real-value"},
+			},
+			wantHeaders: http.Header{
+				"X-Extra-Header": []string{"real-value"},
+				"X-Other-Header": []string{"other-value"},
+			},
+			wantErr: assert.NoError,
+		},
+		{
+			name: "reserved header",
+			r: &Request{
+				Headers: http.Header{
+					"X-Reserved-Header": []string{"reserved-value"},
+				},
+			},
+			headers: http.Header{
+				"x-rESERved-hEAder": []string{"other-value"},
+			},
+			wantHeaders: http.Header{
+				"X-Reserved-Header": []string{"reserved-value"},
+			},
+			wantErr: func(t assert.TestingT, err error, i ...interface{}) bool {
+				return assert.ErrorContains(t, err,
+					fmt.Sprintf("cannot set extra header %q, it is reserved", "X-Reserved-Header"), i...)
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := &Logical{}
+			tt.wantErr(t, c.addExtraHeaders(tt.r, tt.headers), fmt.Sprintf("addExtraHeaders(%v, %v)", tt.r, tt.headers))
+			if tt.r == nil {
+				if tt.wantHeaders != nil {
+					require.Fail(t, "invalid test case: nil request with headers", "addExtraHeaders(%v, %v)", tt.r, tt.headers)
+				}
+				return
+			}
+			assert.Equalf(t, tt.wantHeaders, tt.r.Headers, "Headers after addExtraHeaders(%v, %v)", tt.r, tt.headers)
+		})
+	}
+}
diff --git a/api/output_policy.go b/api/output_policy.go
index c3ec522891b..2815105569a 100644
--- a/api/output_policy.go
+++ b/api/output_policy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/output_policy_test.go b/api/output_policy_test.go
index 2092e2ba2a0..f746474b14e 100644
--- a/api/output_policy_test.go
+++ b/api/output_policy_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/output_string.go b/api/output_string.go
index d7777712d20..77c7f437e09 100644
--- a/api/output_string.go
+++ b/api/output_string.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -8,7 +8,7 @@ import (
 	"net/http"
 	"strings"
 
-	retryablehttp "github.com/hashicorp/go-retryablehttp"
+	"github.com/hashicorp/go-retryablehttp"
 )
 
 const (
@@ -25,6 +25,10 @@ type OutputStringError struct {
 	finalCurlString            string
 }
 
+// Error is here so that we can return this struct as an error from client.rawRequestWithContext(). Note that
+// the ErrOutputStringRequest constant is never actually used and is completely irrelevant to how this all functions.
+// We could've just as easily returned an empty string. What matters is the machinery that happens before then where
+// the curl string is built. So yes, this is confusing, but yes, this is also on purpose, and it is not incorrect.
 func (d *OutputStringError) Error() string {
 	if d.finalCurlString == "" {
 		cs, err := d.buildCurlString()
diff --git a/api/plugin_helpers.go b/api/plugin_helpers.go
index 5d2593668b4..bedebf2405a 100644
--- a/api/plugin_helpers.go
+++ b/api/plugin_helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -13,7 +13,8 @@ import (
 	"net/url"
 	"os"
 
-	"github.com/go-jose/go-jose/v3/jwt"
+	jose "github.com/go-jose/go-jose/v4"
+	"github.com/go-jose/go-jose/v4/jwt"
 	"github.com/hashicorp/errwrap"
 )
 
@@ -40,6 +41,11 @@ const (
 	// PluginUnwrapTokenEnv is the ENV name used to pass unwrap tokens to the
 	// plugin.
 	PluginUnwrapTokenEnv = "VAULT_UNWRAP_TOKEN"
+
+	// CubbyHoleJWTSignatureAlgorithm is the signature algorithm used for
+	// the unwrap token that Vault passes to a plugin when auto-mTLS is
+	// not enabled.
+	CubbyHoleJWTSignatureAlgorithm = jose.ES512
 )
 
 // PluginAPIClientMeta is a helper that plugins can use to configure TLS connections
@@ -102,7 +108,7 @@ func VaultPluginTLSProviderContext(ctx context.Context, apiTLSConfig *TLSConfig)
 	return func() (*tls.Config, error) {
 		unwrapToken := os.Getenv(PluginUnwrapTokenEnv)
 
-		parsedJWT, err := jwt.ParseSigned(unwrapToken)
+		parsedJWT, err := jwt.ParseSigned(unwrapToken, []jose.SignatureAlgorithm{CubbyHoleJWTSignatureAlgorithm})
 		if err != nil {
 			return nil, errwrap.Wrapf("error parsing wrapping token: {{err}}", err)
 		}
diff --git a/api/plugin_runtime_types.go b/api/plugin_runtime_types.go
index d3acd0d002c..35122194c5c 100644
--- a/api/plugin_runtime_types.go
+++ b/api/plugin_runtime_types.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -9,11 +9,9 @@ package api
 
 import "fmt"
 
-var PluginRuntimeTypes = []PluginRuntimeType{
-	PluginRuntimeTypeUnsupported,
-	PluginRuntimeTypeContainer,
-}
+var PluginRuntimeTypes = _PluginRuntimeTypeValues
 
+//go:generate enumer -type=PluginRuntimeType -trimprefix=PluginRuntimeType -transform=snake
 type PluginRuntimeType uint32
 
 // This is a list of PluginRuntimeTypes used by Vault.
@@ -22,20 +20,11 @@ const (
 	PluginRuntimeTypeContainer
 )
 
-func (r PluginRuntimeType) String() string {
-	switch r {
-	case PluginRuntimeTypeContainer:
-		return "container"
-	default:
-		return "unsupported"
-	}
-}
-
+// ParsePluginRuntimeType is a wrapper around PluginRuntimeTypeString kept for backwards compatibility.
 func ParsePluginRuntimeType(PluginRuntimeType string) (PluginRuntimeType, error) {
-	switch PluginRuntimeType {
-	case "container":
-		return PluginRuntimeTypeContainer, nil
-	default:
+	t, err := PluginRuntimeTypeString(PluginRuntimeType)
+	if err != nil {
 		return PluginRuntimeTypeUnsupported, fmt.Errorf("%q is not a supported plugin runtime type", PluginRuntimeType)
 	}
+	return t, nil
 }
diff --git a/api/plugin_types.go b/api/plugin_types.go
index c8f69ae404f..ef9664a8aad 100644
--- a/api/plugin_types.go
+++ b/api/plugin_types.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/plugin_types_test.go b/api/plugin_types_test.go
index 0b6085379b4..332c2050365 100644
--- a/api/plugin_types_test.go
+++ b/api/plugin_types_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/pluginruntimetype_enumer.go b/api/pluginruntimetype_enumer.go
new file mode 100644
index 00000000000..663f440ff44
--- /dev/null
+++ b/api/pluginruntimetype_enumer.go
@@ -0,0 +1,49 @@
+// Code generated by "enumer -type=PluginRuntimeType -trimprefix=PluginRuntimeType -transform=snake"; DO NOT EDIT.
+
+package api
+
+import (
+	"fmt"
+)
+
+const _PluginRuntimeTypeName = "unsupportedcontainer"
+
+var _PluginRuntimeTypeIndex = [...]uint8{0, 11, 20}
+
+func (i PluginRuntimeType) String() string {
+	if i >= PluginRuntimeType(len(_PluginRuntimeTypeIndex)-1) {
+		return fmt.Sprintf("PluginRuntimeType(%d)", i)
+	}
+	return _PluginRuntimeTypeName[_PluginRuntimeTypeIndex[i]:_PluginRuntimeTypeIndex[i+1]]
+}
+
+var _PluginRuntimeTypeValues = []PluginRuntimeType{0, 1}
+
+var _PluginRuntimeTypeNameToValueMap = map[string]PluginRuntimeType{
+	_PluginRuntimeTypeName[0:11]:  0,
+	_PluginRuntimeTypeName[11:20]: 1,
+}
+
+// PluginRuntimeTypeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func PluginRuntimeTypeString(s string) (PluginRuntimeType, error) {
+	if val, ok := _PluginRuntimeTypeNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to PluginRuntimeType values", s)
+}
+
+// PluginRuntimeTypeValues returns all values of the enum
+func PluginRuntimeTypeValues() []PluginRuntimeType {
+	return _PluginRuntimeTypeValues
+}
+
+// IsAPluginRuntimeType returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i PluginRuntimeType) IsAPluginRuntimeType() bool {
+	for _, v := range _PluginRuntimeTypeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/api/renewbehavior_enumer.go b/api/renewbehavior_enumer.go
new file mode 100644
index 00000000000..9b272e3e0ce
--- /dev/null
+++ b/api/renewbehavior_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=RenewBehavior -trimprefix=RenewBehavior"; DO NOT EDIT.
+
+package api
+
+import (
+	"fmt"
+)
+
+const _RenewBehaviorName = "IgnoreErrorsRenewDisabledErrorOnErrors"
+
+var _RenewBehaviorIndex = [...]uint8{0, 12, 25, 38}
+
+func (i RenewBehavior) String() string {
+	if i >= RenewBehavior(len(_RenewBehaviorIndex)-1) {
+		return fmt.Sprintf("RenewBehavior(%d)", i)
+	}
+	return _RenewBehaviorName[_RenewBehaviorIndex[i]:_RenewBehaviorIndex[i+1]]
+}
+
+var _RenewBehaviorValues = []RenewBehavior{0, 1, 2}
+
+var _RenewBehaviorNameToValueMap = map[string]RenewBehavior{
+	_RenewBehaviorName[0:12]:  0,
+	_RenewBehaviorName[12:25]: 1,
+	_RenewBehaviorName[25:38]: 2,
+}
+
+// RenewBehaviorString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func RenewBehaviorString(s string) (RenewBehavior, error) {
+	if val, ok := _RenewBehaviorNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to RenewBehavior values", s)
+}
+
+// RenewBehaviorValues returns all values of the enum
+func RenewBehaviorValues() []RenewBehavior {
+	return _RenewBehaviorValues
+}
+
+// IsARenewBehavior returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i RenewBehavior) IsARenewBehavior() bool {
+	for _, v := range _RenewBehaviorValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/api/renewer_test.go b/api/renewer_test.go
index 7ba16e66eca..230022b56af 100644
--- a/api/renewer_test.go
+++ b/api/renewer_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -177,6 +177,20 @@ func TestLifetimeWatcher(t *testing.T) {
 			expectError:   nil,
 			expectRenewal: true,
 		},
+		{
+			maxTestTime:          time.Second,
+			name:                 "permission_denied_error",
+			leaseDurationSeconds: 60,
+			incrementSeconds:     10,
+			// This should cause the lifetime watcher to behave just
+			// like a non-renewable secret, i.e. wait until its lifetime
+			// then be done.
+			renew: func(_ string, _ int) (*Secret, error) {
+				return nil, fmt.Errorf("permission denied")
+			},
+			expectError:   nil,
+			expectRenewal: false,
+		},
 	}
 
 	for _, tc := range cases {
@@ -204,7 +218,9 @@ func TestLifetimeWatcher(t *testing.T) {
 			for {
 				select {
 				case <-time.After(tc.maxTestTime):
-					t.Fatalf("renewal didn't happen")
+					if tc.expectRenewal || tc.expectError != nil {
+						t.Fatalf("expected error or renewal, and neither happened")
+					}
 				case r := <-v.RenewCh():
 					if !tc.expectRenewal {
 						t.Fatal("expected no renewals")
diff --git a/api/replication_status.go b/api/replication_status.go
index 9bc02d53935..5dead7fe7ec 100644
--- a/api/replication_status.go
+++ b/api/replication_status.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -19,13 +19,14 @@ const (
 )
 
 type ClusterInfo struct {
-	APIAddr                     string `json:"api_address,omitempty" mapstructure:"api_address"`
-	ClusterAddress              string `json:"cluster_address,omitempty" mapstructure:"cluster_address"`
-	ConnectionStatus            string `json:"connection_status,omitempty" mapstructure:"connection_status"`
-	LastHeartBeat               string `json:"last_heartbeat,omitempty" mapstructure:"last_heartbeat"`
-	LastHeartBeatDurationMillis string `json:"last_heartbeat_duration_ms,omitempty" mapstructure:"last_heartbeat_duration_ms"`
-	ClockSkewMillis             string `json:"clock_skew_ms,omitempty" mapstructure:"clock_skew_ms"`
-	NodeID                      string `json:"node_id,omitempty" mapstructure:"node_id"`
+	APIAddr                           string `json:"api_address,omitempty" mapstructure:"api_address"`
+	ClusterAddress                    string `json:"cluster_address,omitempty" mapstructure:"cluster_address"`
+	ConnectionStatus                  string `json:"connection_status,omitempty" mapstructure:"connection_status"`
+	LastHeartBeat                     string `json:"last_heartbeat,omitempty" mapstructure:"last_heartbeat"`
+	LastHeartBeatDurationMillis       string `json:"last_heartbeat_duration_ms,omitempty" mapstructure:"last_heartbeat_duration_ms"`
+	ClockSkewMillis                   string `json:"clock_skew_ms,omitempty" mapstructure:"clock_skew_ms"`
+	NodeID                            string `json:"node_id,omitempty" mapstructure:"node_id"`
+	ReplicationPrimaryCanaryAgeMillis string `json:"replication_primary_canary_age_ms,omitempty" mapstructure:"replication_primary_canary_age_ms"`
 }
 
 type ReplicationStatusGenericResponse struct {
diff --git a/api/request.go b/api/request.go
index a2d912c64dc..2baad56bf22 100644
--- a/api/request.go
+++ b/api/request.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"encoding/json"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 
@@ -77,13 +76,13 @@ func (r *Request) ToHTTP() (*http.Request, error) {
 		// No body
 
 	case r.BodyBytes != nil:
-		req.Request.Body = ioutil.NopCloser(bytes.NewReader(r.BodyBytes))
+		req.Request.Body = io.NopCloser(bytes.NewReader(r.BodyBytes))
 
 	default:
 		if c, ok := r.Body.(io.ReadCloser); ok {
 			req.Request.Body = c
 		} else {
-			req.Request.Body = ioutil.NopCloser(r.Body)
+			req.Request.Body = io.NopCloser(r.Body)
 		}
 	}
 
diff --git a/api/request_test.go b/api/request_test.go
index ac21b801987..c1224e2db7d 100644
--- a/api/request_test.go
+++ b/api/request_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/response.go b/api/response.go
index 2842c125514..c3d03c9edb2 100644
--- a/api/response.go
+++ b/api/response.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -8,7 +8,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 )
 
@@ -44,7 +43,7 @@ func (r *Response) Error() error {
 	}
 
 	r.Body.Close()
-	r.Body = ioutil.NopCloser(bodyBuf)
+	r.Body = io.NopCloser(bodyBuf)
 	ns := r.Header.Get(NamespaceHeaderName)
 
 	// Build up the error object
diff --git a/api/secret.go b/api/secret.go
index d37bf3cf06b..0ca9afd0979 100644
--- a/api/secret.go
+++ b/api/secret.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -6,6 +6,7 @@ package api
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"reflect"
@@ -159,6 +160,10 @@ TOKEN_DONE:
 			goto DONE
 		}
 
+		if s.Data["identity_policies"] == nil {
+			goto DONE
+		}
+
 		sList, ok := s.Data["identity_policies"].([]string)
 		if ok {
 			identityPolicies = sList
@@ -293,6 +298,11 @@ type MFAMethodID struct {
 	ID           string `json:"id,omitempty"`
 	UsesPasscode bool   `json:"uses_passcode,omitempty"`
 	Name         string `json:"name,omitempty"`
+	// SelfEnrollmentEnabled indicates whether the user does not yet have an MFA
+	// secret for this method and self-enrollment is enabled for it. Clients (like the UI) can use
+	// this to determine whether to offer the user a way to generate an MFA secret
+	// for this method.
+	SelfEnrollmentEnabled bool `json:"self_enrollment_enabled,omitempty"`
 }
 
 type MFAConstraintAny struct {
@@ -376,7 +386,7 @@ func ParseSecret(r io.Reader) (*Secret, error) {
 			if err := json.Unmarshal(errBytes, &errStrArray); err != nil {
 				return nil, err
 			}
-			return nil, fmt.Errorf(strings.Join(errStrArray, " "))
+			return nil, errors.New(strings.Join(errStrArray, " "))
 		}
 
 		// if any raw data is present in resp.Body, add it to secret
diff --git a/api/secret_test.go b/api/secret_test.go
index 9fa20e1a9cf..23d7c45258d 100644
--- a/api/secret_test.go
+++ b/api/secret_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/ssh.go b/api/ssh.go
index 28510eecc23..8ff032d9859 100644
--- a/api/ssh.go
+++ b/api/ssh.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/ssh_agent.go b/api/ssh_agent.go
index e61503772fa..f6207d119bc 100644
--- a/api/ssh_agent.go
+++ b/api/ssh_agent.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -150,7 +150,9 @@ func LoadSSHHelperConfig(path string) (*SSHHelperConfig, error) {
 // ParseSSHHelperConfig parses the given contents as a string for the SSHHelper
 // configuration.
 func ParseSSHHelperConfig(contents string) (*SSHHelperConfig, error) {
-	root, err := hcl.Parse(string(contents))
+	// TODO (HCL_DUP_KEYS_DEPRECATION): replace with simple call to hcl.Parse once deprecation of duplicate attributes
+	// is over, for now just ignore duplicates
+	root, _, err := parseAndCheckForDuplicateHclAttributes(contents)
 	if err != nil {
 		return nil, errwrap.Wrapf("error parsing config: {{err}}", err)
 	}
diff --git a/api/ssh_agent_test.go b/api/ssh_agent_test.go
index 38117e42a70..104bc313149 100644
--- a/api/ssh_agent_test.go
+++ b/api/ssh_agent_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -8,8 +8,33 @@ import (
 	"net/http"
 	"strings"
 	"testing"
+
+	"github.com/stretchr/testify/require"
 )
 
+// TestSSH_CanLoadDuplicateKeys verifies that during the deprecation process of duplicate HCL attributes this function
+// will still allow them.
+// TODO (HCL_DUP_KEYS_DEPRECATION): on full removal change this test to ensure that duplicate attributes cannot be parsed
+// under any circumstances.
+func TestSSH_CanLoadDuplicateKeys(t *testing.T) {
+	t.Run("fail parsing without env var", func(t *testing.T) {
+		_, err := LoadSSHHelperConfig("./test-fixtures/agent_config_duplicate_keys.hcl")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "Each argument can only be defined once")
+	})
+	t.Run("fail parsing with env var set to false", func(t *testing.T) {
+		t.Setenv(allowHclDuplicatesEnvVar, "false")
+		_, err := LoadSSHHelperConfig("./test-fixtures/agent_config_duplicate_keys.hcl")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "Each argument can only be defined once")
+	})
+	t.Run("succeed parsing with env var set to true", func(t *testing.T) {
+		t.Setenv(allowHclDuplicatesEnvVar, "true")
+		_, err := LoadSSHHelperConfig("./test-fixtures/agent_config_duplicate_keys.hcl")
+		require.NoError(t, err)
+	})
+}
+
 func TestSSH_CreateTLSClient(t *testing.T) {
 	// load the default configuration
 	config, err := LoadSSHHelperConfig("./test-fixtures/agent_config.hcl")
diff --git a/api/sudo_paths.go b/api/sudo_paths.go
index 24beb4bb1f2..5aa7239fadf 100644
--- a/api/sudo_paths.go
+++ b/api/sudo_paths.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -28,6 +28,7 @@ var sudoPaths = map[string]*regexp.Regexp{
 	"/sys/config/ui/headers":                        regexp.MustCompile(`^/sys/config/ui/headers/?$`),
 	"/sys/config/ui/headers/{header}":               regexp.MustCompile(`^/sys/config/ui/headers/.+$`),
 	"/sys/internal/inspect/router/{tag}":            regexp.MustCompile(`^/sys/internal/inspect/router/.+$`),
+	"/sys/internal/counters/activity/export":        regexp.MustCompile(`^/sys/internal/counters/activity/export$`),
 	"/sys/leases":                                   regexp.MustCompile(`^/sys/leases$`),
 	// This entry is a bit wrong... sys/leases/lookup does NOT require sudo. But sys/leases/lookup/ with a trailing
 	// slash DOES require sudo. But the part of the Vault CLI that uses this logic doesn't pass operation-appropriate
@@ -55,6 +56,7 @@ var sudoPaths = map[string]*regexp.Regexp{
 	"/sys/replication/reindex":                             regexp.MustCompile(`^/sys/replication/reindex$`),
 	"/sys/storage/raft/snapshot-auto/config":               regexp.MustCompile(`^/sys/storage/raft/snapshot-auto/config/?$`),
 	"/sys/storage/raft/snapshot-auto/config/{name}":        regexp.MustCompile(`^/sys/storage/raft/snapshot-auto/config/[^/]+$`),
+	"/sys/reporting/scan":                                  regexp.MustCompile(`^/sys/reporting/scan$`),
 }
 
 func SudoPaths() map[string]*regexp.Regexp {
diff --git a/api/sudo_paths_test.go b/api/sudo_paths_test.go
index b23af7067fc..2c387927402 100644
--- a/api/sudo_paths_test.go
+++ b/api/sudo_paths_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys.go b/api/sys.go
index 81ebb3a2509..fde171fc515 100644
--- a/api/sys.go
+++ b/api/sys.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_audit.go b/api/sys_audit.go
index 2244087aad5..1349af0d2b5 100644
--- a/api/sys_audit.go
+++ b/api/sys_audit.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_auth.go b/api/sys_auth.go
index 8337ae8c022..a35bbe17fbe 100644
--- a/api/sys_auth.go
+++ b/api/sys_auth.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -20,7 +20,9 @@ func (c *Sys) GetAuthWithContext(ctx context.Context, path string) (*AuthMount,
 	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
 	defer cancelFunc()
 
-	r := c.c.NewRequest(http.MethodGet, fmt.Sprintf("/v1/sys/auth/%s", path))
+	// use `sys/mounts/auth/:path` so we don't require sudo permissions
+	// historically, `sys/auth` doesn't require sudo, so we don't require it here either
+	r := c.c.NewRequest(http.MethodGet, fmt.Sprintf("/v1/sys/mounts/auth/%s", path))
 
 	resp, err := c.c.rawRequestWithContext(ctx, r)
 	if err != nil {
diff --git a/api/sys_capabilities.go b/api/sys_capabilities.go
index d57b7571175..b0088a241c1 100644
--- a/api/sys_capabilities.go
+++ b/api/sys_capabilities.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_config_cors.go b/api/sys_config_cors.go
index e80aa9d8b41..6edf02e35d4 100644
--- a/api/sys_config_cors.go
+++ b/api/sys_config_cors.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_generate_root.go b/api/sys_generate_root.go
index da4ad2f9b73..2a5c5c6b15b 100644
--- a/api/sys_generate_root.go
+++ b/api/sys_generate_root.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_hastatus.go b/api/sys_hastatus.go
index 58a73b89cbb..ec029e9b6ab 100644
--- a/api/sys_hastatus.go
+++ b/api/sys_hastatus.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -35,14 +35,15 @@ type HAStatusResponse struct {
 }
 
 type HANode struct {
-	Hostname           string     `json:"hostname"`
-	APIAddress         string     `json:"api_address"`
-	ClusterAddress     string     `json:"cluster_address"`
-	ActiveNode         bool       `json:"active_node"`
-	LastEcho           *time.Time `json:"last_echo"`
-	EchoDurationMillis int64      `json:"echo_duration_ms"`
-	ClockSkewMillis    int64      `json:"clock_skew_ms"`
-	Version            string     `json:"version"`
-	UpgradeVersion     string     `json:"upgrade_version,omitempty"`
-	RedundancyZone     string     `json:"redundancy_zone,omitempty"`
+	Hostname                          string     `json:"hostname"`
+	APIAddress                        string     `json:"api_address"`
+	ClusterAddress                    string     `json:"cluster_address"`
+	ActiveNode                        bool       `json:"active_node"`
+	LastEcho                          *time.Time `json:"last_echo"`
+	EchoDurationMillis                int64      `json:"echo_duration_ms"`
+	ClockSkewMillis                   int64      `json:"clock_skew_ms"`
+	Version                           string     `json:"version"`
+	UpgradeVersion                    string     `json:"upgrade_version,omitempty"`
+	RedundancyZone                    string     `json:"redundancy_zone,omitempty"`
+	ReplicationPrimaryCanaryAgeMillis int64      `json:"replication_primary_canary_age_ms"`
 }
diff --git a/api/sys_health.go b/api/sys_health.go
index 0dc849885ff..db19754d2df 100644
--- a/api/sys_health.go
+++ b/api/sys_health.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -25,6 +25,8 @@ func (c *Sys) HealthWithContext(ctx context.Context) (*HealthResponse, error) {
 	r.Params.Add("standbycode", "299")
 	r.Params.Add("drsecondarycode", "299")
 	r.Params.Add("performancestandbycode", "299")
+	r.Params.Add("removedcode", "299")
+	r.Params.Add("haunhealthycode", "299")
 
 	resp, err := c.c.rawRequestWithContext(ctx, r)
 	if err != nil {
@@ -38,18 +40,22 @@ func (c *Sys) HealthWithContext(ctx context.Context) (*HealthResponse, error) {
 }
 
 type HealthResponse struct {
-	Initialized                bool   `json:"initialized"`
-	Sealed                     bool   `json:"sealed"`
-	Standby                    bool   `json:"standby"`
-	PerformanceStandby         bool   `json:"performance_standby"`
-	ReplicationPerformanceMode string `json:"replication_performance_mode"`
-	ReplicationDRMode          string `json:"replication_dr_mode"`
-	ServerTimeUTC              int64  `json:"server_time_utc"`
-	Version                    string `json:"version"`
-	ClusterName                string `json:"cluster_name,omitempty"`
-	ClusterID                  string `json:"cluster_id,omitempty"`
-	LastWAL                    uint64 `json:"last_wal,omitempty"`
-	Enterprise                 bool   `json:"enterprise"`
-	EchoDurationMillis         int64  `json:"echo_duration_ms"`
-	ClockSkewMillis            int64  `json:"clock_skew_ms"`
+	Initialized                          bool   `json:"initialized"`
+	Sealed                               bool   `json:"sealed"`
+	Standby                              bool   `json:"standby"`
+	PerformanceStandby                   bool   `json:"performance_standby"`
+	ReplicationPerformanceMode           string `json:"replication_performance_mode"`
+	ReplicationDRMode                    string `json:"replication_dr_mode"`
+	ServerTimeUTC                        int64  `json:"server_time_utc"`
+	Version                              string `json:"version"`
+	ClusterName                          string `json:"cluster_name,omitempty"`
+	ClusterID                            string `json:"cluster_id,omitempty"`
+	LastWAL                              uint64 `json:"last_wal,omitempty"`
+	Enterprise                           bool   `json:"enterprise"`
+	EchoDurationMillis                   int64  `json:"echo_duration_ms"`
+	ClockSkewMillis                      int64  `json:"clock_skew_ms"`
+	ReplicationPrimaryCanaryAgeMillis    int64  `json:"replication_primary_canary_age_ms"`
+	RemovedFromCluster                   *bool  `json:"removed_from_cluster,omitempty"`
+	HAConnectionHealthy                  *bool  `json:"ha_connection_healthy,omitempty"`
+	LastRequestForwardingHeartbeatMillis int64  `json:"last_request_forwarding_heartbeat_ms,omitempty"`
 }
diff --git a/api/sys_init.go b/api/sys_init.go
index 13fa9480697..a6c8681e2dc 100644
--- a/api/sys_init.go
+++ b/api/sys_init.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_leader.go b/api/sys_leader.go
index 868914d3b13..34be750d36c 100644
--- a/api/sys_leader.go
+++ b/api/sys_leader.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_leases.go b/api/sys_leases.go
index c46f07e64b4..d06323de4b1 100644
--- a/api/sys_leases.go
+++ b/api/sys_leases.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_mfa.go b/api/sys_mfa.go
index 2be66958464..ccf9d9ebd8d 100644
--- a/api/sys_mfa.go
+++ b/api/sys_mfa.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_monitor.go b/api/sys_monitor.go
index 15a8a13d175..d4815d6ea00 100644
--- a/api/sys_monitor.go
+++ b/api/sys_monitor.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_mounts.go b/api/sys_mounts.go
index 64529986af6..e10ad12575d 100644
--- a/api/sys_mounts.go
+++ b/api/sys_mounts.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -222,11 +222,47 @@ func (c *Sys) RemountStatusWithContext(ctx context.Context, migrationID string)
 	return &result, err
 }
 
+// TuneMountConfigInput is a pointer-only version of MountConfigInput.  This allows proper update calls where only
+// Values provided by the user are changed, but values can be changed to an empty (but non-nil) value.
+type TuneMountConfigInput struct {
+	Options                    *map[string]string          `json:"options,omitempty" mapstructure:"options"`
+	DefaultLeaseTTL            *string                     `json:"default_lease_ttl,omitempty" mapstructure:"default_lease_ttl"`
+	Description                *string                     `json:"description,omitempty" mapstructure:"description"`
+	MaxLeaseTTL                *string                     `json:"max_lease_ttl,omitempty" mapstructure:"max_lease_ttl"`
+	ForceNoCache               *bool                       `json:"force_no_cache,omitempty" mapstructure:"force_no_cache"`
+	AuditNonHMACRequestKeys    *[]string                   `json:"audit_non_hmac_request_keys,omitempty" mapstructure:"audit_non_hmac_request_keys"`
+	AuditNonHMACResponseKeys   *[]string                   `json:"audit_non_hmac_response_keys,omitempty" mapstructure:"audit_non_hmac_response_keys"`
+	ListingVisibility          *string                     `json:"listing_visibility,omitempty" mapstructure:"listing_visibility"`
+	PassthroughRequestHeaders  *[]string                   `json:"passthrough_request_headers,omitempty" mapstructure:"passthrough_request_headers"`
+	AllowedResponseHeaders     *[]string                   `json:"allowed_response_headers,omitempty" mapstructure:"allowed_response_headers"`
+	TokenType                  *string                     `json:"token_type,omitempty" mapstructure:"token_type"`
+	AllowedManagedKeys         *[]string                   `json:"allowed_managed_keys,omitempty" mapstructure:"allowed_managed_keys"`
+	PluginVersion              *string                     `json:"plugin_version,omitempty"`
+	UserLockoutConfig          *TuneUserLockoutConfigInput `json:"user_lockout_config,omitempty"`
+	DelegatedAuthAccessors     *[]string                   `json:"delegated_auth_accessors,omitempty" mapstructure:"delegated_auth_accessors"`
+	IdentityTokenKey           *string                     `json:"identity_token_key,omitempty" mapstructure:"identity_token_key"`
+	TrimRequestTrailingSlashes *bool                       `json:"trim_request_trailing_slashes,omitempty" mapstructure:"trim_request_trailing_slashes"`
+	// Deprecated: This field will always be blank for newer server responses.
+	PluginName *string `json:"plugin_name,omitempty" mapstructure:"plugin_name"`
+}
+
+type TuneUserLockoutConfigInput struct {
+	LockoutThreshold            *string `json:"lockout_threshold,omitempty" structs:"lockout_threshold" mapstructure:"lockout_threshold"`
+	LockoutDuration             *string `json:"lockout_duration,omitempty" structs:"lockout_duration" mapstructure:"lockout_duration"`
+	LockoutCounterResetDuration *string `json:"lockout_counter_reset_duration,omitempty" structs:"lockout_counter_reset_duration" mapstructure:"lockout_counter_reset_duration"`
+	DisableLockout              *bool   `json:"lockout_disable,omitempty" structs:"lockout_disable" mapstructure:"lockout_disable"`
+}
+
+func (c *Sys) TuneMountAllowNil(path string, config TuneMountConfigInput) error {
+	return c.TuneMountAllowNilWithContext(context.Background(), path, config)
+}
+
+// Deprecated: newer functionality should use TuneMountAllowNil instead so that parameters can be set to the nil value
 func (c *Sys) TuneMount(path string, config MountConfigInput) error {
 	return c.TuneMountWithContext(context.Background(), path, config)
 }
 
-func (c *Sys) TuneMountWithContext(ctx context.Context, path string, config MountConfigInput) error {
+func (c *Sys) TuneMountAllowNilWithContext(ctx context.Context, path string, config TuneMountConfigInput) error {
 	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
 	defer cancelFunc()
 
@@ -242,6 +278,83 @@ func (c *Sys) TuneMountWithContext(ctx context.Context, path string, config Moun
 	return err
 }
 
+// Deprecated: newer functionality should use TuneMountAllowNilWithContext instead, so that configuration can be set to
+// a nil value.
+func (c *Sys) TuneMountWithContext(ctx context.Context, path string, config MountConfigInput) error {
+	tuneConfig := TuneMountConfigInput{}
+
+	tuneConfig.Options = &config.Options                 // Not omitted if empty
+	tuneConfig.DefaultLeaseTTL = &config.DefaultLeaseTTL // Not omitted if empty
+	tuneConfig.Description = config.Description          // Already a pointer value
+	tuneConfig.MaxLeaseTTL = &config.MaxLeaseTTL         // Not omitted if empty
+	tuneConfig.ForceNoCache = &config.ForceNoCache       // Not omitted if empty
+
+	if len(config.AuditNonHMACRequestKeys) != 0 { // Because omitempty in the JSON
+		tuneConfig.AuditNonHMACRequestKeys = &config.AuditNonHMACRequestKeys
+	}
+
+	if len(config.AuditNonHMACResponseKeys) != 0 { // Because omitempty in the JSON
+		tuneConfig.AuditNonHMACResponseKeys = &config.AuditNonHMACResponseKeys
+	}
+
+	if config.ListingVisibility != "" { // Because omitempty in the JSON
+		tuneConfig.ListingVisibility = &config.ListingVisibility
+	}
+
+	if len(config.PassthroughRequestHeaders) != 0 { // Because omitempty in the JSON
+		tuneConfig.PassthroughRequestHeaders = &config.PassthroughRequestHeaders
+	}
+
+	if len(config.AllowedResponseHeaders) != 0 { // Because omitempty in the JSON
+		tuneConfig.AllowedResponseHeaders = &config.AllowedResponseHeaders
+	}
+
+	if config.TokenType != "" { // Because omitempty in the JSON
+		tuneConfig.TokenType = &config.TokenType
+	}
+
+	if len(config.AllowedManagedKeys) != 0 { // Because omitempty in the JSON
+		tuneConfig.AllowedManagedKeys = &config.AllowedManagedKeys
+	}
+
+	if config.PluginVersion != "" { // Because omitempty in the JSON
+		tuneConfig.PluginVersion = &config.PluginVersion
+	}
+
+	if config.UserLockoutConfig != nil {
+		userLockoutConfig := TuneUserLockoutConfigInput{}
+		if config.UserLockoutConfig.LockoutDuration != "" {
+			userLockoutConfig.LockoutDuration = &config.UserLockoutConfig.LockoutDuration
+		}
+		if config.UserLockoutConfig.LockoutCounterResetDuration != "" {
+			userLockoutConfig.LockoutCounterResetDuration = &config.UserLockoutConfig.LockoutCounterResetDuration
+		}
+		if config.UserLockoutConfig.LockoutThreshold != "" {
+			userLockoutConfig.LockoutThreshold = &config.UserLockoutConfig.LockoutThreshold
+		}
+		if config.UserLockoutConfig.DisableLockout != nil {
+			userLockoutConfig.DisableLockout = config.UserLockoutConfig.DisableLockout
+		}
+		tuneConfig.UserLockoutConfig = &userLockoutConfig
+	}
+
+	if len(config.DelegatedAuthAccessors) != 0 { // Because omitempty in the JSON
+		tuneConfig.DelegatedAuthAccessors = &config.DelegatedAuthAccessors
+	}
+
+	if config.IdentityTokenKey != "" { // Because omitempty in the JSON
+		tuneConfig.IdentityTokenKey = &config.IdentityTokenKey
+	}
+
+	tuneConfig.TrimRequestTrailingSlashes = config.TrimRequestTrailingSlashes // Already a pointer despite being omitempty
+
+	if config.PluginName != "" { // Because omitempty in the JSON
+		tuneConfig.PluginName = &config.PluginName
+	}
+
+	return c.TuneMountAllowNilWithContext(ctx, path, tuneConfig)
+}
+
 func (c *Sys) MountConfig(path string) (*MountConfigOutput, error) {
 	return c.MountConfigWithContext(context.Background(), path)
 }
@@ -290,23 +403,23 @@ type MountInput struct {
 }
 
 type MountConfigInput struct {
-	Options                   map[string]string       `json:"options" mapstructure:"options"`
-	DefaultLeaseTTL           string                  `json:"default_lease_ttl" mapstructure:"default_lease_ttl"`
-	Description               *string                 `json:"description,omitempty" mapstructure:"description"`
-	MaxLeaseTTL               string                  `json:"max_lease_ttl" mapstructure:"max_lease_ttl"`
-	ForceNoCache              bool                    `json:"force_no_cache" mapstructure:"force_no_cache"`
-	AuditNonHMACRequestKeys   []string                `json:"audit_non_hmac_request_keys,omitempty" mapstructure:"audit_non_hmac_request_keys"`
-	AuditNonHMACResponseKeys  []string                `json:"audit_non_hmac_response_keys,omitempty" mapstructure:"audit_non_hmac_response_keys"`
-	ListingVisibility         string                  `json:"listing_visibility,omitempty" mapstructure:"listing_visibility"`
-	PassthroughRequestHeaders []string                `json:"passthrough_request_headers,omitempty" mapstructure:"passthrough_request_headers"`
-	AllowedResponseHeaders    []string                `json:"allowed_response_headers,omitempty" mapstructure:"allowed_response_headers"`
-	TokenType                 string                  `json:"token_type,omitempty" mapstructure:"token_type"`
-	AllowedManagedKeys        []string                `json:"allowed_managed_keys,omitempty" mapstructure:"allowed_managed_keys"`
-	PluginVersion             string                  `json:"plugin_version,omitempty"`
-	UserLockoutConfig         *UserLockoutConfigInput `json:"user_lockout_config,omitempty"`
-	DelegatedAuthAccessors    []string                `json:"delegated_auth_accessors,omitempty" mapstructure:"delegated_auth_accessors"`
-	IdentityTokenKey          string                  `json:"identity_token_key,omitempty" mapstructure:"identity_token_key"`
-
+	Options                    map[string]string       `json:"options" mapstructure:"options"`
+	DefaultLeaseTTL            string                  `json:"default_lease_ttl" mapstructure:"default_lease_ttl"`
+	Description                *string                 `json:"description,omitempty" mapstructure:"description"`
+	MaxLeaseTTL                string                  `json:"max_lease_ttl" mapstructure:"max_lease_ttl"`
+	ForceNoCache               bool                    `json:"force_no_cache" mapstructure:"force_no_cache"`
+	AuditNonHMACRequestKeys    []string                `json:"audit_non_hmac_request_keys,omitempty" mapstructure:"audit_non_hmac_request_keys"`
+	AuditNonHMACResponseKeys   []string                `json:"audit_non_hmac_response_keys,omitempty" mapstructure:"audit_non_hmac_response_keys"`
+	ListingVisibility          string                  `json:"listing_visibility,omitempty" mapstructure:"listing_visibility"`
+	PassthroughRequestHeaders  []string                `json:"passthrough_request_headers,omitempty" mapstructure:"passthrough_request_headers"`
+	AllowedResponseHeaders     []string                `json:"allowed_response_headers,omitempty" mapstructure:"allowed_response_headers"`
+	TokenType                  string                  `json:"token_type,omitempty" mapstructure:"token_type"`
+	AllowedManagedKeys         []string                `json:"allowed_managed_keys,omitempty" mapstructure:"allowed_managed_keys"`
+	PluginVersion              string                  `json:"plugin_version,omitempty"`
+	UserLockoutConfig          *UserLockoutConfigInput `json:"user_lockout_config,omitempty"`
+	DelegatedAuthAccessors     []string                `json:"delegated_auth_accessors,omitempty" mapstructure:"delegated_auth_accessors"`
+	IdentityTokenKey           string                  `json:"identity_token_key,omitempty" mapstructure:"identity_token_key"`
+	TrimRequestTrailingSlashes *bool                   `json:"trim_request_trailing_slashes,omitempty" mapstructure:"trim_request_trailing_slashes"`
 	// Deprecated: This field will always be blank for newer server responses.
 	PluginName string `json:"plugin_name,omitempty" mapstructure:"plugin_name"`
 }
@@ -328,19 +441,20 @@ type MountOutput struct {
 }
 
 type MountConfigOutput struct {
-	DefaultLeaseTTL           int                      `json:"default_lease_ttl" mapstructure:"default_lease_ttl"`
-	MaxLeaseTTL               int                      `json:"max_lease_ttl" mapstructure:"max_lease_ttl"`
-	ForceNoCache              bool                     `json:"force_no_cache" mapstructure:"force_no_cache"`
-	AuditNonHMACRequestKeys   []string                 `json:"audit_non_hmac_request_keys,omitempty" mapstructure:"audit_non_hmac_request_keys"`
-	AuditNonHMACResponseKeys  []string                 `json:"audit_non_hmac_response_keys,omitempty" mapstructure:"audit_non_hmac_response_keys"`
-	ListingVisibility         string                   `json:"listing_visibility,omitempty" mapstructure:"listing_visibility"`
-	PassthroughRequestHeaders []string                 `json:"passthrough_request_headers,omitempty" mapstructure:"passthrough_request_headers"`
-	AllowedResponseHeaders    []string                 `json:"allowed_response_headers,omitempty" mapstructure:"allowed_response_headers"`
-	TokenType                 string                   `json:"token_type,omitempty" mapstructure:"token_type"`
-	AllowedManagedKeys        []string                 `json:"allowed_managed_keys,omitempty" mapstructure:"allowed_managed_keys"`
-	UserLockoutConfig         *UserLockoutConfigOutput `json:"user_lockout_config,omitempty"`
-	DelegatedAuthAccessors    []string                 `json:"delegated_auth_accessors,omitempty" mapstructure:"delegated_auth_accessors"`
-	IdentityTokenKey          string                   `json:"identity_token_key,omitempty" mapstructure:"identity_token_key"`
+	DefaultLeaseTTL            int                      `json:"default_lease_ttl" mapstructure:"default_lease_ttl"`
+	MaxLeaseTTL                int                      `json:"max_lease_ttl" mapstructure:"max_lease_ttl"`
+	ForceNoCache               bool                     `json:"force_no_cache" mapstructure:"force_no_cache"`
+	AuditNonHMACRequestKeys    []string                 `json:"audit_non_hmac_request_keys,omitempty" mapstructure:"audit_non_hmac_request_keys"`
+	AuditNonHMACResponseKeys   []string                 `json:"audit_non_hmac_response_keys,omitempty" mapstructure:"audit_non_hmac_response_keys"`
+	ListingVisibility          string                   `json:"listing_visibility,omitempty" mapstructure:"listing_visibility"`
+	PassthroughRequestHeaders  []string                 `json:"passthrough_request_headers,omitempty" mapstructure:"passthrough_request_headers"`
+	AllowedResponseHeaders     []string                 `json:"allowed_response_headers,omitempty" mapstructure:"allowed_response_headers"`
+	TokenType                  string                   `json:"token_type,omitempty" mapstructure:"token_type"`
+	AllowedManagedKeys         []string                 `json:"allowed_managed_keys,omitempty" mapstructure:"allowed_managed_keys"`
+	UserLockoutConfig          *UserLockoutConfigOutput `json:"user_lockout_config,omitempty"`
+	DelegatedAuthAccessors     []string                 `json:"delegated_auth_accessors,omitempty" mapstructure:"delegated_auth_accessors"`
+	IdentityTokenKey           string                   `json:"identity_token_key,omitempty" mapstructure:"identity_token_key"`
+	TrimRequestTrailingSlashes bool                     `json:"trim_request_trailing_slashes,omitempty" mapstructure:"trim_request_trailing_slashes"`
 
 	// Deprecated: This field will always be blank for newer server responses.
 	PluginName string `json:"plugin_name,omitempty" mapstructure:"plugin_name"`
diff --git a/api/sys_mounts_test.go b/api/sys_mounts_test.go
index a810c6268a1..cefd5807b0d 100644
--- a/api/sys_mounts_test.go
+++ b/api/sys_mounts_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -6,6 +6,8 @@ package api
 import (
 	"net/http"
 	"net/http/httptest"
+	"reflect"
+	"strings"
 	"testing"
 )
 
@@ -150,3 +152,54 @@ const listMountsResponse = `{
     }
   }
 }`
+
+// TestMountUpdateConfigStructFields ensures that the type MountConfigInput (the struct used to setup a new mount) has
+// all the same fields as type TuneMountConfigInput (the struct used to tune an existing mount):
+func TestMountUpdateConfigStructFields(t *testing.T) {
+	tuneStruct := TuneMountConfigInput{}
+	initialStruct := MountConfigInput{}
+
+	tuneReflect := reflect.ValueOf(tuneStruct).Type()
+	initialReflect := reflect.ValueOf(initialStruct).Type()
+
+	for i := 0; i < tuneReflect.NumField(); i++ {
+		tuneField := tuneReflect.Field(i)
+		foundMatch := false
+		// Now Find the field in initial Reflect
+		for j := 0; j < initialReflect.NumField(); j++ {
+			initialField := initialReflect.Field(j)
+			if tuneField.Name == initialField.Name {
+				jsonTuneFieldTag := tuneField.Tag.Get("json")
+				jsonTuneFieldName := strings.Split(jsonTuneFieldTag, ",")[0]
+				jsonInitialFieldTag := tuneField.Tag.Get("json")
+				jsonInitialFieldName := strings.Split(jsonInitialFieldTag, ",")[0]
+				if jsonTuneFieldName != jsonInitialFieldName {
+					t.Fatalf("TuneMountConfigInput and MountConfigInput struct fields %v do not have same json names: %v, %v", tuneField.Name, jsonTuneFieldName, jsonInitialFieldName)
+				}
+				foundMatch = true
+				break
+			}
+		}
+		if !foundMatch {
+			t.Fatalf("Field %s in TuneMountConfigInput not found in MountConfigInput", tuneField.Name)
+		}
+	}
+
+	if tuneReflect.NumField() != initialReflect.NumField() {
+		for i := 0; i < initialReflect.NumField(); i++ {
+			initialField := initialReflect.Field(i)
+			foundMatch := false
+			for j := 0; j < tuneReflect.NumField(); j++ {
+				tuneField := tuneReflect.Field(j)
+				if tuneField.Name == initialField.Name {
+					foundMatch = true
+					break
+				}
+			}
+			if !foundMatch {
+				t.Fatalf("Field %s in MountConfigInput not found in TuneMountConfigInput", initialField.Name)
+			}
+		}
+		t.Fatalf("Different number of TuneMountConfigInput fields found in MountConfigInput")
+	}
+}
diff --git a/api/sys_plugins.go b/api/sys_plugins.go
index 9d424d009ec..3ad581de91c 100644
--- a/api/sys_plugins.go
+++ b/api/sys_plugins.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/mitchellh/mapstructure"
@@ -215,14 +216,24 @@ type RegisterPluginInput struct {
 	// Env specifies a list of key=value pairs to add to the plugin's environment
 	// variables.
 	Env []string `json:"env,omitempty"`
+
+	// Download the plugin when set to true. This is only applicable for external plugins.
+	Download bool `json:"download,omitempty"`
+}
+
+// RegisterPluginResponse is the response from the RegisterPluginDetailed call.
+type RegisterPluginResponse struct {
+	Warnings []string `json:"warnings"`
 }
 
 // RegisterPlugin wraps RegisterPluginWithContext using context.Background.
+// Deprecated: Use RegisterPluginDetailed instead.
 func (c *Sys) RegisterPlugin(i *RegisterPluginInput) error {
 	return c.RegisterPluginWithContext(context.Background(), i)
 }
 
 // RegisterPluginWithContext registers the plugin with the given information.
+// Deprecated: Use RegisterPluginWithContextDetailed instead.
 func (c *Sys) RegisterPluginWithContext(ctx context.Context, i *RegisterPluginInput) error {
 	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
 	defer cancelFunc()
@@ -241,6 +252,58 @@ func (c *Sys) RegisterPluginWithContext(ctx context.Context, i *RegisterPluginIn
 	return err
 }
 
+// RegisterPluginDetailed wraps RegisterPluginWtihContextDetailed using context.Background.
+func (c *Sys) RegisterPluginDetailed(i *RegisterPluginInput) (*RegisterPluginResponse, error) {
+	return c.RegisterPluginWithContextDetailed(context.Background(), i)
+}
+
+// RegisterPluginWithContextDetailed registers the plugin with the given information.
+func (c *Sys) RegisterPluginWithContextDetailed(ctx context.Context, i *RegisterPluginInput) (*RegisterPluginResponse, error) {
+	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
+	defer cancelFunc()
+
+	path := catalogPathByType(i.Type, i.Name)
+	req := c.c.NewRequest(http.MethodPut, path)
+
+	if err := req.SetJSONBody(i); err != nil {
+		return nil, err
+	}
+
+	resp, err := c.c.rawRequestWithContext(ctx, req)
+	if resp != nil {
+		defer resp.Body.Close()
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	var registerResp RegisterPluginResponse
+	if resp != nil && resp.StatusCode != http.StatusNoContent {
+		if err := resp.DecodeJSON(&registerResp); err != nil {
+			return nil, err
+		}
+	}
+
+	// Filter out the `Endpoint replaced the value of these parameters with the values captured from the endpoint's path: [type]`
+	// warning because it is expected behavior from this function, as we set the type parameter in both the path and request body,
+	// and the warning informs us the path parameter takes precedence. However, this warning is not relevant for an end user so we
+	// omit it before returning to any client.
+	// TODO: This can likely be removed once https://hashicorp.atlassian.net/browse/VAULT-36722 is addressed.
+	var filteredWarnings []string
+	if len(registerResp.Warnings) > 0 {
+		filteredWarnings = make([]string, 0, len(registerResp.Warnings))
+	}
+
+	for _, warning := range registerResp.Warnings {
+		if !strings.Contains(warning, "Endpoint replaced the value of these parameters with the values captured from the endpoint's path") {
+			filteredWarnings = append(filteredWarnings, warning)
+		}
+	}
+	registerResp.Warnings = filteredWarnings
+
+	return &registerResp, err
+}
+
 // DeregisterPluginInput is used as input to the DeregisterPlugin function.
 type DeregisterPluginInput struct {
 	// Name is the name of the plugin. Required.
diff --git a/api/sys_plugins_runtimes.go b/api/sys_plugins_runtimes.go
index b56a899f650..9676cf64717 100644
--- a/api/sys_plugins_runtimes.go
+++ b/api/sys_plugins_runtimes.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_plugins_runtimes_test.go b/api/sys_plugins_runtimes_test.go
index 6c3486a31a0..aff11437145 100644
--- a/api/sys_plugins_runtimes_test.go
+++ b/api/sys_plugins_runtimes_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_plugins_test.go b/api/sys_plugins_test.go
index 8ba8fc57141..e173c02f4ed 100644
--- a/api/sys_plugins_test.go
+++ b/api/sys_plugins_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -24,12 +24,15 @@ func TestRegisterPlugin(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = client.Sys().RegisterPluginWithContext(context.Background(), &RegisterPluginInput{
+	resp, err := client.Sys().RegisterPluginWithContextDetailed(context.Background(), &RegisterPluginInput{
 		Version: "v1.0.0",
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
+	if len(resp.Warnings) > 0 {
+		t.Errorf("expected no warnings, got: %v", resp.Warnings)
+	}
 }
 
 func TestListPlugins(t *testing.T) {
diff --git a/api/sys_policy.go b/api/sys_policy.go
index 9ddffe4ec7c..2d5f2b50be3 100644
--- a/api/sys_policy.go
+++ b/api/sys_policy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_raft.go b/api/sys_raft.go
index 4b9487c61d5..42a82e01d1a 100644
--- a/api/sys_raft.go
+++ b/api/sys_raft.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -9,9 +9,11 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"io/ioutil"
 	"net/http"
+	"net/url"
 	"sync"
 	"time"
 
@@ -100,6 +102,23 @@ type AutopilotState struct {
 	OptimisticFailureTolerance int                         `mapstructure:"optimistic_failure_tolerance,omitempty"`
 }
 
+func (a *AutopilotState) String() string {
+	var result string
+	result += fmt.Sprintf("Healthy: %t. FailureTolerance: %d. Leader: %s. OptimisticFailureTolerance: %d\n", a.Healthy, a.FailureTolerance, a.Leader, a.OptimisticFailureTolerance)
+	for _, s := range a.Servers {
+		result += fmt.Sprintf("Server: %s\n", s)
+	}
+	result += fmt.Sprintf("Voters: %v\n", a.Voters)
+	result += fmt.Sprintf("NonVoters: %v\n", a.NonVoters)
+
+	for name, zone := range a.RedundancyZones {
+		result += fmt.Sprintf("RedundancyZone %s: %s\n", name, &zone)
+	}
+
+	result += fmt.Sprintf("Upgrade: %s", a.Upgrade)
+	return result
+}
+
 // AutopilotServer represents the server blocks in the response of the raft
 // autopilot state API.
 type AutopilotServer struct {
@@ -119,12 +138,21 @@ type AutopilotServer struct {
 	NodeType       string `mapstructure:"node_type,omitempty"`
 }
 
+func (a *AutopilotServer) String() string {
+	return fmt.Sprintf("ID: %s. Name: %s. Address: %s. NodeStatus: %s. LastContact: %s. LastTerm: %d. LastIndex: %d. Healthy: %t. StableSince: %s. Status: %s. Version: %s. UpgradeVersion: %s. RedundancyZone: %s. NodeType: %s",
+		a.ID, a.Name, a.Address, a.NodeStatus, a.LastContact, a.LastTerm, a.LastIndex, a.Healthy, a.StableSince, a.Status, a.Version, a.UpgradeVersion, a.RedundancyZone, a.NodeType)
+}
+
 type AutopilotZone struct {
 	Servers          []string `mapstructure:"servers,omitempty"`
 	Voters           []string `mapstructure:"voters,omitempty"`
 	FailureTolerance int      `mapstructure:"failure_tolerance,omitempty"`
 }
 
+func (a *AutopilotZone) String() string {
+	return fmt.Sprintf("Servers: %v. Voters: %v. FailureTolerance: %d", a.Servers, a.Voters, a.FailureTolerance)
+}
+
 type AutopilotUpgrade struct {
 	Status                    string                                  `mapstructure:"status"`
 	TargetVersion             string                                  `mapstructure:"target_version,omitempty"`
@@ -137,6 +165,17 @@ type AutopilotUpgrade struct {
 	RedundancyZones           map[string]AutopilotZoneUpgradeVersions `mapstructure:"redundancy_zones,omitempty"`
 }
 
+func (a *AutopilotUpgrade) String() string {
+	result := fmt.Sprintf("Status: %s. TargetVersion: %s. TargetVersionVoters: %v. TargetVersionNonVoters: %v. TargetVersionReadReplicas: %v. OtherVersionVoters: %v. OtherVersionNonVoters: %v. OtherVersionReadReplicas: %v",
+		a.Status, a.TargetVersion, a.TargetVersionVoters, a.TargetVersionNonVoters, a.TargetVersionReadReplicas, a.OtherVersionVoters, a.OtherVersionNonVoters, a.OtherVersionReadReplicas)
+
+	for name, zone := range a.RedundancyZones {
+		result += fmt.Sprintf("Redundancy Zone %s: %s", name, zone)
+	}
+
+	return result
+}
+
 type AutopilotZoneUpgradeVersions struct {
 	TargetVersionVoters    []string `mapstructure:"target_version_voters,omitempty"`
 	TargetVersionNonVoters []string `mapstructure:"target_version_non_voters,omitempty"`
@@ -144,6 +183,11 @@ type AutopilotZoneUpgradeVersions struct {
 	OtherVersionNonVoters  []string `mapstructure:"other_version_non_voters,omitempty"`
 }
 
+func (a *AutopilotZoneUpgradeVersions) String() string {
+	return fmt.Sprintf("TargetVersionVoters: %v. TargetVersionNonVoters: %v. OtherVersionVoters: %v. OtherVersionNonVoters: %v",
+		a.TargetVersionVoters, a.TargetVersionNonVoters, a.OtherVersionVoters, a.OtherVersionNonVoters)
+}
+
 // RaftJoin wraps RaftJoinWithContext using context.Background.
 func (c *Sys) RaftJoin(opts *RaftJoinRequest) (*RaftJoinResponse, error) {
 	return c.RaftJoinWithContext(context.Background(), opts)
@@ -221,7 +265,7 @@ func (c *Sys) RaftSnapshotWithContext(ctx context.Context, snapWriter io.Writer)
 				continue
 			}
 			var b []byte
-			b, err = ioutil.ReadAll(t)
+			b, err = io.ReadAll(t)
 			if err != nil || len(b) == 0 {
 				return
 			}
@@ -400,3 +444,92 @@ func (c *Sys) PutRaftAutopilotConfigurationWithContext(ctx context.Context, opts
 
 	return nil
 }
+
+// RaftLoadLocalSnapshot wraps RaftLoadLocalSnapshotWithContext using context.Background.
+func (c *Sys) RaftLoadLocalSnapshot(snapReader io.Reader) (*Secret, error) {
+	return c.RaftLoadLocalSnapshotWithContext(context.Background(), snapReader)
+}
+
+// RaftLoadLocalSnapshotWithContext loads a snapshot into the raft cluster.
+// It accepts a reader that reads the snapshot file data.
+func (c *Sys) RaftLoadLocalSnapshotWithContext(ctx context.Context, snapReader io.Reader) (*Secret, error) {
+	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
+	defer cancelFunc()
+
+	r := c.c.NewRequest(http.MethodPost, "/v1/sys/storage/raft/snapshot-load")
+	r.Body = snapReader
+
+	resp, err := c.c.rawRequestWithContext(ctx, r)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	return ParseSecret(resp.Body)
+}
+
+// RaftLoadCloudSnapshot wraps RaftLoadCloudSnapshotWithContext using context.Background.
+func (c *Sys) RaftLoadCloudSnapshot(name string, url *url.URL) (*Secret, error) {
+	return c.RaftLoadCloudSnapshotWithContext(context.Background(), name, url)
+}
+
+// RaftLoadCloudSnapshotWithContext loads a snapshot from cloud storage into the raft cluster.
+// It accepts a name for the cloud auto snapshot configuration and a URL to the snapshot location in cloud storage.
+func (c *Sys) RaftLoadCloudSnapshotWithContext(ctx context.Context, name string, url *url.URL) (*Secret, error) {
+	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
+	defer cancelFunc()
+
+	r := c.c.NewRequest(http.MethodPost, "/v1/sys/storage/raft/snapshot-auto/snapshot-load/"+name)
+	if err := r.SetJSONBody(map[string]interface{}{
+		"url": url.String(),
+	}); err != nil {
+		return nil, err
+	}
+
+	resp, err := c.c.rawRequestWithContext(ctx, r)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	return ParseSecret(resp.Body)
+}
+
+// RaftUnloadSnapshot wraps RaftUnloadSnapshotWithContext using context.Background.
+func (c *Sys) RaftUnloadSnapshot(snapID string) (*Secret, error) {
+	return c.RaftUnloadSnapshotWithContext(context.Background(), snapID)
+}
+
+// RaftUnloadSnapshotWithContext unloads a snapshot from the raft cluster.
+// It accepts a snapshot ID to identify the snapshot to be unloaded.
+func (c *Sys) RaftUnloadSnapshotWithContext(ctx context.Context, snapID string) (*Secret, error) {
+	return c.raftUnloadSnapshotWithContext(ctx, snapID, false)
+}
+
+// RaftForceUnloadSnapshot wraps RaftForceUnloadSnapshotWithContext using context.Background.
+func (c *Sys) RaftForceUnloadSnapshot(snapID string) (*Secret, error) {
+	return c.RaftForceUnloadSnapshotWithContext(context.Background(), snapID)
+}
+
+// RaftForceUnloadSnapshotWithContext forcefully unloads the given snapshot
+func (c *Sys) RaftForceUnloadSnapshotWithContext(ctx context.Context, snapID string) (*Secret, error) {
+	return c.raftUnloadSnapshotWithContext(ctx, snapID, true)
+}
+
+func (c *Sys) raftUnloadSnapshotWithContext(ctx context.Context, snapID string, force bool) (*Secret, error) {
+	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
+	defer cancelFunc()
+
+	r := c.c.NewRequest(http.MethodDelete, "/v1/sys/storage/raft/snapshot-load/"+snapID)
+	if force {
+		r.Params.Set("force", "true")
+	}
+
+	resp, err := c.c.rawRequestWithContext(ctx, r)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	return ParseSecret(resp.Body)
+}
diff --git a/api/sys_rekey.go b/api/sys_rekey.go
index 573201751c7..085db357ba1 100644
--- a/api/sys_rekey.go
+++ b/api/sys_rekey.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -147,11 +147,29 @@ func (c *Sys) RekeyCancel() error {
 	return c.RekeyCancelWithContext(context.Background())
 }
 
+func (c *Sys) RekeyCancelWithNonce(nonce string) error {
+	return c.RekeyCancelWithContextWithNonce(context.Background(), nonce)
+}
+
 func (c *Sys) RekeyCancelWithContext(ctx context.Context) error {
+	return c.RekeyCancelWithContextWithNonce(ctx, "")
+}
+
+func (c *Sys) RekeyCancelWithContextWithNonce(ctx context.Context, nonce string) error {
 	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
 	defer cancelFunc()
 
 	r := c.c.NewRequest(http.MethodDelete, "/v1/sys/rekey/init")
+	if nonce != "" {
+		body := map[string]interface{}{
+			"nonce": nonce,
+		}
+
+		if err := r.SetJSONBody(body); err != nil {
+			return err
+		}
+
+	}
 
 	resp, err := c.c.rawRequestWithContext(ctx, r)
 	if err == nil {
@@ -164,12 +182,28 @@ func (c *Sys) RekeyRecoveryKeyCancel() error {
 	return c.RekeyRecoveryKeyCancelWithContext(context.Background())
 }
 
+func (c *Sys) RekeyRecoveryKeyCancelWithNonce(nonce string) error {
+	return c.RekeyRecoveryKeyCancelWithContextWithNonce(context.Background(), nonce)
+}
+
 func (c *Sys) RekeyRecoveryKeyCancelWithContext(ctx context.Context) error {
+	return c.RekeyCancelWithContextWithNonce(ctx, "")
+}
+
+func (c *Sys) RekeyRecoveryKeyCancelWithContextWithNonce(ctx context.Context, nonce string) error {
 	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
 	defer cancelFunc()
-
 	r := c.c.NewRequest(http.MethodDelete, "/v1/sys/rekey-recovery-key/init")
 
+	if nonce != "" {
+		body := map[string]interface{}{
+			"nonce": nonce,
+		}
+
+		if err := r.SetJSONBody(body); err != nil {
+			return err
+		}
+	}
 	resp, err := c.c.rawRequestWithContext(ctx, r)
 	if err == nil {
 		defer resp.Body.Close()
diff --git a/api/sys_reporting_scan.go b/api/sys_reporting_scan.go
new file mode 100644
index 00000000000..0f2b967c153
--- /dev/null
+++ b/api/sys_reporting_scan.go
@@ -0,0 +1,49 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package api
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	"github.com/mitchellh/mapstructure"
+)
+
+func (c *Sys) ReportingScan() (*ReportingScanOutput, error) {
+	return c.ReportingScanWithContext(context.Background())
+}
+
+func (c *Sys) ReportingScanWithContext(ctx context.Context) (*ReportingScanOutput, error) {
+	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
+	defer cancelFunc()
+
+	r := c.c.NewRequest(http.MethodPost, "/v1/sys/reporting/scan")
+
+	resp, err := c.c.rawRequestWithContext(ctx, r)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	secret, err := ParseSecret(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	if secret == nil || secret.Data == nil {
+		return nil, errors.New("data from server response is empty")
+	}
+
+	var result ReportingScanOutput
+	err = mapstructure.Decode(secret.Data, &result)
+	if err != nil {
+		return nil, err
+	}
+
+	return &result, err
+}
+
+type ReportingScanOutput struct {
+	Timestamp string `json:"timestamp" structs:"timestamp" mapstructure:"timestamp"`
+}
diff --git a/api/sys_rotate.go b/api/sys_rotate.go
index 295d989f9e2..92818e21962 100644
--- a/api/sys_rotate.go
+++ b/api/sys_rotate.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_seal.go b/api/sys_seal.go
index 62002496c36..07d236b77e3 100644
--- a/api/sys_seal.go
+++ b/api/sys_seal.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
@@ -96,24 +96,25 @@ func sealStatusRequestWithContext(ctx context.Context, c *Sys, r *Request) (*Sea
 }
 
 type SealStatusResponse struct {
-	Type              string   `json:"type"`
-	Initialized       bool     `json:"initialized"`
-	Sealed            bool     `json:"sealed"`
-	T                 int      `json:"t"`
-	N                 int      `json:"n"`
-	Progress          int      `json:"progress"`
-	Nonce             string   `json:"nonce"`
-	Version           string   `json:"version"`
-	BuildDate         string   `json:"build_date"`
-	Migration         bool     `json:"migration"`
-	ClusterName       string   `json:"cluster_name,omitempty"`
-	ClusterID         string   `json:"cluster_id,omitempty"`
-	RecoverySeal      bool     `json:"recovery_seal"`
-	RecoverySealType  string   `json:"recovery_seal_type,omitempty"`
-	StorageType       string   `json:"storage_type,omitempty"`
-	HCPLinkStatus     string   `json:"hcp_link_status,omitempty"`
-	HCPLinkResourceID string   `json:"hcp_link_resource_ID,omitempty"`
-	Warnings          []string `json:"warnings,omitempty"`
+	Type               string   `json:"type"`
+	Initialized        bool     `json:"initialized"`
+	Sealed             bool     `json:"sealed"`
+	T                  int      `json:"t"`
+	N                  int      `json:"n"`
+	Progress           int      `json:"progress"`
+	Nonce              string   `json:"nonce"`
+	Version            string   `json:"version"`
+	BuildDate          string   `json:"build_date"`
+	Migration          bool     `json:"migration"`
+	ClusterName        string   `json:"cluster_name,omitempty"`
+	ClusterID          string   `json:"cluster_id,omitempty"`
+	RecoverySeal       bool     `json:"recovery_seal"`
+	RecoverySealType   string   `json:"recovery_seal_type,omitempty"`
+	StorageType        string   `json:"storage_type,omitempty"`
+	HCPLinkStatus      string   `json:"hcp_link_status,omitempty"`
+	HCPLinkResourceID  string   `json:"hcp_link_resource_ID,omitempty"`
+	RemovedFromCluster *bool    `json:"removed_from_cluster,omitempty"`
+	Warnings           []string `json:"warnings,omitempty"`
 }
 
 type UnsealOpts struct {
diff --git a/api/sys_stepdown.go b/api/sys_stepdown.go
index c55ed1e666d..bfca3bf6a30 100644
--- a/api/sys_stepdown.go
+++ b/api/sys_stepdown.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_ui_custom_message.go b/api/sys_ui_custom_message.go
index a129efea763..6c1fdedd280 100644
--- a/api/sys_ui_custom_message.go
+++ b/api/sys_ui_custom_message.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_ui_custom_message_test.go b/api/sys_ui_custom_message_test.go
index 0082ad55d77..bd942b7ccb5 100644
--- a/api/sys_ui_custom_message_test.go
+++ b/api/sys_ui_custom_message_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package api
diff --git a/api/sys_utilization_report.go b/api/sys_utilization_report.go
new file mode 100644
index 00000000000..ccfd3919d40
--- /dev/null
+++ b/api/sys_utilization_report.go
@@ -0,0 +1,101 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package api
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	"github.com/mitchellh/mapstructure"
+)
+
+func (c *Sys) UtilizationReport() (*UtilizationReportOutput, error) {
+	return c.UtilizationReportWithContext(context.Background(), "")
+}
+
+func (c *Sys) UtilizationReportWithNamespace(nsPath string) (*UtilizationReportOutput, error) {
+	return c.UtilizationReportWithContext(context.Background(), nsPath)
+}
+
+func (c *Sys) UtilizationReportWithContext(ctx context.Context, nsPath string) (*UtilizationReportOutput, error) {
+	ctx, cancelFunc := c.c.withConfiguredTimeout(ctx)
+	defer cancelFunc()
+
+	r := c.c.NewRequest(http.MethodGet, "/v1/sys/utilization-report")
+
+	if nsPath != "" {
+		r.Params.Add("namespace", nsPath)
+	}
+
+	resp, err := c.c.rawRequestWithContext(ctx, r)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	secret, err := ParseSecret(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	if secret == nil || secret.Data == nil {
+		return nil, errors.New("data from server response is empty")
+	}
+
+	var result UtilizationReportOutput
+	err = mapstructure.Decode(secret.Data, &result)
+	if err != nil {
+		return nil, err
+	}
+
+	return &result, err
+}
+
+type UtilizationReportOutput struct {
+	Namespaces int `json:"namespaces,omitempty" structs:"namespaces" mapstructure:"namespaces"`
+
+	KVV1Secrets int `json:"kvv1_secrets,omitempty" structs:"kvv1_secrets" mapstructure:"kvv1_secrets"`
+	KVV2Secrets int `json:"kvv2_secrets,omitempty" structs:"kvv2_secrets" mapstructure:"kvv2_secrets"`
+
+	AuthMethods   map[string]int `json:"auth_methods,omitempty" structs:"auth_methods" mapstructure:"auth_methods"`
+	SecretEngines map[string]int `json:"secret_engines,omitempty" structs:"secret_engines" mapstructure:"secret_engines"`
+
+	LeasesByAuthMethod map[string]int `json:"leases_by_auth_method,omitempty" structs:"leases_by_auth_method" mapstructure:"leases_by_auth_method"`
+
+	ReplicationStatus *UtilizationReportReplicationStatusInformation `json:"replication_status,omitempty" structs:"replication_status" mapstructure:"replication_status"`
+
+	PKI *UtilizationReportPKIInformation `json:"pki,omitempty" structs:"pki" mapstructure:"pki"`
+
+	SecretSync *UtilizationReportSecretSyncInformation `json:"secret_sync,omitempty" structs:"secret_sync" mapstructure:"secret_sync"`
+
+	LeaseCountQuotas *UtilizationReportLeaseCountQuotaInformation `json:"lease_count_quotas,omitempty" structs:"lease_count_quotas" mapstructure:"lease_count_quotas"`
+}
+
+type UtilizationReportReplicationStatusInformation struct {
+	DRPrimary bool   `json:"dr_primary,omitempty" structs:"dr_primary" mapstructure:"dr_primary"`
+	DRState   string `json:"dr_state,omitempty" structs:"dr_state" mapstructure:"dr_state"`
+	PRPrimary bool   `json:"pr_primary,omitempty" structs:"pr_primary" mapstructure:"pr_primary"`
+	PRState   string `json:"pr_state,omitempty" structs:"pr_state" mapstructure:"pr_state"`
+}
+
+type UtilizationReportPKIInformation struct {
+	TotalRoles   int `json:"total_roles,omitempty" structs:"total_roles" mapstructure:"total_roles"`
+	TotalIssuers int `json:"total_issuers,omitempty" structs:"total_issuers" mapstructure:"total_issuers"`
+}
+
+type UtilizationReportSecretSyncInformation struct {
+	TotalSources      int `json:"total_sources,omitempty" structs:"total_sources" mapstructure:"total_sources"`
+	TotalDestinations int `json:"total_destinations,omitempty" structs:"total_destinations" mapstructure:"total_destinations"`
+}
+
+type UtilizationReportLeaseCountQuotaInformation struct {
+	TotalLeaseCountQuotas            int                                                `json:"total_lease_count_quotas,omitempty" structs:"total_lease_count_quotas" mapstructure:"total_lease_count_quotas"`
+	GlobalLeaseCountQuotaInformation *UtilizationReportGlobalLeaseCountQuotaInformation `json:"global_lease_count_quota,omitempty" structs:"global_lease_count_quota" mapstructure:"global_lease_count_quota"`
+}
+
+type UtilizationReportGlobalLeaseCountQuotaInformation struct {
+	Name     string `json:"name,omitempty" structs:"name" mapstructure:"name"`
+	Capacity int    `json:"capacity,omitempty" structs:"capacity" mapstructure:"capacity"`
+	Count    int    `json:"count,omitempty" structs:"count" mapstructure:"count"`
+}
diff --git a/api/test-fixtures/agent_config.hcl b/api/test-fixtures/agent_config.hcl
index 38d8026057f..d1862b2d30d 100644
--- a/api/test-fixtures/agent_config.hcl
+++ b/api/test-fixtures/agent_config.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: MPL-2.0
 
 vault_addr="http://127.0.0.1:8200"
diff --git a/api/test-fixtures/agent_config_duplicate_keys.hcl b/api/test-fixtures/agent_config_duplicate_keys.hcl
new file mode 100644
index 00000000000..e84639d616e
--- /dev/null
+++ b/api/test-fixtures/agent_config_duplicate_keys.hcl
@@ -0,0 +1,6 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: MPL-2.0
+
+vault_addr="http://127.0.0.1:8200"
+vault_addr="http://127.0.0.1:8201"
+ssh_mount_point="ssh"
\ No newline at end of file
diff --git a/command/token/helper.go b/api/tokenhelper/helper.go
similarity index 82%
rename from command/token/helper.go
rename to api/tokenhelper/helper.go
index a4bf1fa0f86..d30241fcd2a 100644
--- a/command/token/helper.go
+++ b/api/tokenhelper/helper.go
@@ -1,7 +1,7 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
 
-package token
+package tokenhelper
 
 // TokenHelper is an interface that contains basic operations that must be
 // implemented by a token helper
diff --git a/command/token/helper_external.go b/api/tokenhelper/helper_external.go
similarity index 79%
rename from command/token/helper_external.go
rename to api/tokenhelper/helper_external.go
index 26e7f44ee8e..ef4defef998 100644
--- a/command/token/helper_external.go
+++ b/api/tokenhelper/helper_external.go
@@ -1,7 +1,7 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
 
-package token
+package tokenhelper
 
 import (
 	"bytes"
@@ -9,7 +9,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"runtime"
 	"strings"
 )
 
@@ -40,14 +39,14 @@ func ExternalTokenHelperPath(path string) (string, error) {
 	return path, nil
 }
 
-var _ TokenHelper = (*ExternalTokenHelper)(nil)
+var _ TokenHelper = new(ExternalTokenHelper)
 
 // ExternalTokenHelper should only be used in a dev mode. For all other cases,
 // InternalTokenHelper should be used.
 // ExternalTokenHelper is the struct that has all the logic for storing and retrieving
 // tokens from the token helper. The API for the helpers is simple: the
-// BinaryPath is executed within a shell with environment Env. The last argument
-// appended will be the operation, which is:
+// BinaryPath is executed directly with arguments Args and environment Env.
+// The last argument appended to Args will be the operation, which is:
 //
 //   - "get" - Read the value of the token and write it to stdout.
 //   - "store" - Store the value of the token which is on stdin. Output
@@ -58,6 +57,7 @@ var _ TokenHelper = (*ExternalTokenHelper)(nil)
 // exit code then the stderr will be made part of the error value.
 type ExternalTokenHelper struct {
 	BinaryPath string
+	Args       []string
 	Env        []string
 }
 
@@ -109,28 +109,13 @@ func (h *ExternalTokenHelper) Path() string {
 }
 
 func (h *ExternalTokenHelper) cmd(op string) (*exec.Cmd, error) {
-	script := strings.ReplaceAll(h.BinaryPath, "\\", "\\\\") + " " + op
-	cmd, err := ExecScript(script)
-	if err != nil {
-		return nil, err
-	}
-	cmd.Env = h.Env
-	return cmd, nil
-}
+	binPath := strings.ReplaceAll(h.BinaryPath, "\\", "\\\\")
 
-// ExecScript returns a command to execute a script
-func ExecScript(script string) (*exec.Cmd, error) {
-	var shell, flag string
-	if runtime.GOOS == "windows" {
-		shell = "cmd"
-		flag = "/C"
-	} else {
-		shell = "/bin/sh"
-		flag = "-c"
-	}
-	if other := os.Getenv("SHELL"); other != "" {
-		shell = other
-	}
-	cmd := exec.Command(shell, flag, script)
+	args := make([]string, len(h.Args))
+	copy(args, h.Args)
+	args = append(args, op)
+
+	cmd := exec.Command(binPath, args...)
+	cmd.Env = h.Env
 	return cmd, nil
 }
diff --git a/command/token/helper_external_test.go b/api/tokenhelper/helper_external_test.go
similarity index 80%
rename from command/token/helper_external_test.go
rename to api/tokenhelper/helper_external_test.go
index d7b03236022..d22b2ddd78a 100644
--- a/command/token/helper_external_test.go
+++ b/api/tokenhelper/helper_external_test.go
@@ -1,15 +1,13 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
 
-package token
+package tokenhelper
 
 import (
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"runtime"
-	"strings"
 	"testing"
 )
 
@@ -54,26 +52,18 @@ func TestExternalTokenHelperPath(t *testing.T) {
 }
 
 func TestExternalTokenHelper(t *testing.T) {
-	Test(t, testExternalTokenHelper(t))
+	test(t, testExternalTokenHelper())
 }
 
-func testExternalTokenHelper(t *testing.T) *ExternalTokenHelper {
-	return &ExternalTokenHelper{BinaryPath: helperPath("helper"), Env: helperEnv()}
-}
-
-func helperPath(s ...string) string {
-	cs := []string{"-test.run=TestExternalTokenHelperProcess", "--"}
-	cs = append(cs, s...)
-	return fmt.Sprintf(
-		"%s %s",
-		os.Args[0],
-		strings.Join(cs, " "))
+func testExternalTokenHelper() *ExternalTokenHelper {
+	args := []string{"-test.run=TestExternalTokenHelperProcess", "--", "helper"}
+	return &ExternalTokenHelper{BinaryPath: os.Args[0], Args: args, Env: helperEnv()}
 }
 
 func helperEnv() []string {
 	var env []string
 
-	tf, err := ioutil.TempFile("", "vault")
+	tf, err := os.CreateTemp("", "vault")
 	if err != nil {
 		panic(err)
 	}
diff --git a/command/token/helper_internal.go b/api/tokenhelper/helper_internal.go
similarity index 96%
rename from command/token/helper_internal.go
rename to api/tokenhelper/helper_internal.go
index 866ff1880e1..e6cc537eaf2 100644
--- a/command/token/helper_internal.go
+++ b/api/tokenhelper/helper_internal.go
@@ -1,7 +1,7 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
 
-package token
+package tokenhelper
 
 import (
 	"bytes"
diff --git a/command/token/helper_internal_test.go b/api/tokenhelper/helper_internal_test.go
similarity index 87%
rename from command/token/helper_internal_test.go
rename to api/tokenhelper/helper_internal_test.go
index 10a7a0cc974..c471858932b 100644
--- a/command/token/helper_internal_test.go
+++ b/api/tokenhelper/helper_internal_test.go
@@ -1,10 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
 
-package token
+package tokenhelper
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -17,11 +16,11 @@ func TestCommand(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	Test(t, helper)
+	test(t, helper)
 }
 
 func TestInternalHelperFilePerms(t *testing.T) {
-	tmpDir, err := ioutil.TempDir("", t.Name())
+	tmpDir, err := os.MkdirTemp("", t.Name())
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/api/tokenhelper/testing.go b/api/tokenhelper/testing.go
new file mode 100644
index 00000000000..cd836e9d0f0
--- /dev/null
+++ b/api/tokenhelper/testing.go
@@ -0,0 +1,38 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package tokenhelper
+
+import (
+	"testing"
+)
+
+// test is a public function that can be used in other tests to
+// test that a helper is functioning properly.
+func test(t *testing.T, h TokenHelper) {
+	if err := h.Store("foo"); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	v, err := h.Get()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if v != "foo" {
+		t.Fatalf("bad: %#v", v)
+	}
+
+	if err := h.Erase(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	v, err = h.Get()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if v != "" {
+		t.Fatalf("bad: %#v", v)
+	}
+}
diff --git a/audit/backend.go b/audit/backend.go
new file mode 100644
index 00000000000..46a9327989c
--- /dev/null
+++ b/audit/backend.go
@@ -0,0 +1,269 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"sync/atomic"
+
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/helper/constants"
+	"github.com/hashicorp/vault/internal/observability/event"
+	"github.com/hashicorp/vault/sdk/helper/salt"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+const (
+	optionElideListResponses = "elide_list_responses"
+	optionExclude            = "exclude"
+	optionFallback           = "fallback"
+	optionFilter             = "filter"
+	optionFormat             = "format"
+	optionHMACAccessor       = "hmac_accessor"
+	optionLogRaw             = "log_raw"
+	OptionPrefix             = "prefix"
+
+	TypeFile   = "file"
+	TypeSocket = "socket"
+	TypeSyslog = "syslog"
+)
+
+var _ Backend = (*backend)(nil)
+
+// Factory is the factory function to create an audit backend.
+type Factory func(*BackendConfig, HeaderFormatter) (Backend, error)
+
+// Backend interface must be implemented for an audit
+// mechanism to be made available. Audit backends can be enabled to
+// sink information to different backends such as logs, file, databases,
+// or other external services.
+type Backend interface {
+	// Salter interface must be implemented by anything implementing Backend.
+	Salter
+
+	// The PipelineReader interface allows backends to surface information about their
+	// nodes for node and pipeline registration.
+	event.PipelineReader
+
+	// IsFallback can be used to determine if this audit backend device is intended to
+	// be used as a fallback to catch all events that are not written when only using
+	// filtered pipelines.
+	IsFallback() bool
+
+	// LogTestMessage is used to check an audit backend before adding it
+	// permanently. It should attempt to synchronously log the given test
+	// message, WITHOUT using the normal Salt (which would require a storage
+	// operation on creation).
+	LogTestMessage(context.Context, *logical.LogInput) error
+
+	// Reload is called on SIGHUP for supporting backends.
+	Reload() error
+
+	// Invalidate is called for path invalidation
+	Invalidate(context.Context)
+}
+
+// Salter is an interface that provides a way to obtain a Salt for hashing.
+type Salter interface {
+	// Salt returns a non-nil salt or an error.
+	Salt(context.Context) (*salt.Salt, error)
+}
+
+// backend represents an audit backend's shared fields across supported devices (file, socket, syslog).
+// NOTE: Use newBackend to initialize the backend.
+// e.g. within NewFileBackend, NewSocketBackend, NewSyslogBackend.
+type backend struct {
+	*backendEnt
+	name       string
+	nodeIDList []eventlogger.NodeID
+	nodeMap    map[eventlogger.NodeID]eventlogger.Node
+	salt       *atomic.Value
+	saltConfig *salt.Config
+	saltMutex  sync.RWMutex
+	saltView   logical.Storage
+}
+
+// newBackend will create the common backend which should be used by supported audit
+// backend types (file, socket, syslog) to which they can create and add their sink.
+// It handles basic validation of config and creates required pipelines nodes that
+// precede the sink node.
+func newBackend(headersConfig HeaderFormatter, conf *BackendConfig) (*backend, error) {
+	b := &backend{
+		backendEnt: newBackendEnt(conf.Config),
+		name:       conf.MountPath,
+		saltConfig: conf.SaltConfig,
+		saltView:   conf.SaltView,
+		salt:       new(atomic.Value),
+		nodeIDList: []eventlogger.NodeID{},
+		nodeMap:    make(map[eventlogger.NodeID]eventlogger.Node),
+	}
+	// Ensure we are working with the right type by explicitly storing a nil of the right type.
+	b.salt.Store((*salt.Salt)(nil))
+
+	if err := b.configureFilterNode(conf.Config[optionFilter]); err != nil {
+		return nil, err
+	}
+
+	cfg, err := newFormatterConfig(headersConfig, conf.Config)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := b.configureFormatterNode(conf.MountPath, cfg, conf.Logger); err != nil {
+		return nil, err
+	}
+
+	return b, nil
+}
+
+// configureFormatterNode is used to configure a formatter node and associated ID on the Backend.
+func (b *backend) configureFormatterNode(name string, formatConfig formatterConfig, logger hclog.Logger) error {
+	formatterNodeID, err := event.GenerateNodeID()
+	if err != nil {
+		return fmt.Errorf("error generating random NodeID for formatter node: %w: %w", ErrInternal, err)
+	}
+
+	formatterNode, err := newEntryFormatter(name, formatConfig, b, logger)
+	if err != nil {
+		return fmt.Errorf("error creating formatter: %w", err)
+	}
+
+	b.nodeIDList = append(b.nodeIDList, formatterNodeID)
+	b.nodeMap[formatterNodeID] = formatterNode
+
+	return nil
+}
+
+// wrapMetrics takes a sink node and augments it by wrapping it with metrics nodes.
+// Metrics can be used to measure time and count.
+func (b *backend) wrapMetrics(name string, id eventlogger.NodeID, n eventlogger.Node) error {
+	if n.Type() != eventlogger.NodeTypeSink {
+		return fmt.Errorf("unable to wrap node with metrics. %q is not a sink node: %w", name, ErrInvalidParameter)
+	}
+
+	// Wrap the sink node with metrics middleware
+	sinkMetricTimer, err := newSinkMetricTimer(name, n)
+	if err != nil {
+		return fmt.Errorf("unable to add timing metrics to sink for path %q: %w", name, err)
+	}
+
+	sinkMetricCounter, err := event.NewMetricsCounter(name, sinkMetricTimer, b.getMetricLabeler())
+	if err != nil {
+		return fmt.Errorf("unable to add counting metrics to sink for path %q: %w", name, err)
+	}
+
+	b.nodeIDList = append(b.nodeIDList, id)
+	b.nodeMap[id] = sinkMetricCounter
+
+	return nil
+}
+
+// Salt is used to provide a salt for HMAC'ing data. If the salt is not currently
+// loaded from storage, then loading will be attempted to create a new salt, which
+// will then be stored and returned on subsequent calls.
+// NOTE: If invalidation occurs the salt will likely be cleared, forcing reload
+// from storage.
+func (b *backend) Salt(ctx context.Context) (*salt.Salt, error) {
+	s := b.salt.Load().(*salt.Salt)
+	if s != nil {
+		return s, nil
+	}
+
+	b.saltMutex.Lock()
+	defer b.saltMutex.Unlock()
+
+	s = b.salt.Load().(*salt.Salt)
+	if s != nil {
+		return s, nil
+	}
+
+	newSalt, err := salt.NewSalt(ctx, b.saltView, b.saltConfig)
+	if err != nil {
+		b.salt.Store((*salt.Salt)(nil))
+		return nil, err
+	}
+
+	b.salt.Store(newSalt)
+	return newSalt, nil
+}
+
+// EventType returns the event type for the backend.
+func (b *backend) EventType() eventlogger.EventType {
+	return event.AuditType.AsEventType()
+}
+
+// HasFiltering determines if the first node for the pipeline is an eventlogger.NodeTypeFilter.
+func (b *backend) HasFiltering() bool {
+	if b.nodeMap == nil {
+		return false
+	}
+
+	return len(b.nodeIDList) > 0 && b.nodeMap[b.nodeIDList[0]].Type() == eventlogger.NodeTypeFilter
+}
+
+// Name for this backend, this must correspond to the mount path for the audit device.
+func (b *backend) Name() string {
+	return b.name
+}
+
+// NodeIDs returns the IDs of the nodes, in the order they are required.
+func (b *backend) NodeIDs() []eventlogger.NodeID {
+	return b.nodeIDList
+}
+
+// Nodes returns the nodes which should be used by the event framework to process audit entries.
+func (b *backend) Nodes() map[eventlogger.NodeID]eventlogger.Node {
+	return b.nodeMap
+}
+
+func (b *backend) LogTestMessage(ctx context.Context, input *logical.LogInput) error {
+	if len(b.nodeIDList) > 0 {
+		return processManual(ctx, input, b.nodeIDList, b.nodeMap)
+	}
+
+	return nil
+}
+
+func (b *backend) Reload() error {
+	for _, n := range b.nodeMap {
+		if n.Type() == eventlogger.NodeTypeSink {
+			return n.Reopen()
+		}
+	}
+
+	return nil
+}
+
+func (b *backend) Invalidate(_ context.Context) {
+	b.saltMutex.Lock()
+	defer b.saltMutex.Unlock()
+	b.salt.Store((*salt.Salt)(nil))
+}
+
+// HasInvalidOptions is used to determine if a non-Enterprise version of Vault
+// is being used when supplying options that contain options exclusive to Enterprise.
+func HasInvalidOptions(options map[string]string) bool {
+	return !constants.IsEnterprise && hasEnterpriseAuditOptions(options)
+}
+
+// hasValidEnterpriseAuditOptions is used to check if any of the options supplied
+// are only for use in the Enterprise version of Vault.
+func hasEnterpriseAuditOptions(options map[string]string) bool {
+	enterpriseAuditOptions := []string{
+		optionExclude,
+		optionFallback,
+		optionFilter,
+	}
+
+	for _, o := range enterpriseAuditOptions {
+		if _, ok := options[o]; ok {
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/audit/backend_ce.go b/audit/backend_ce.go
new file mode 100644
index 00000000000..d643eb90dfc
--- /dev/null
+++ b/audit/backend_ce.go
@@ -0,0 +1,27 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package audit
+
+import "github.com/hashicorp/vault/internal/observability/event"
+
+type backendEnt struct{}
+
+func newBackendEnt(_ map[string]string) *backendEnt {
+	return &backendEnt{}
+}
+
+func (b *backendEnt) IsFallback() bool {
+	return false
+}
+
+// configureFilterNode is a no-op as filters are an Enterprise-only feature.
+func (b *backend) configureFilterNode(_ string) error {
+	return nil
+}
+
+func (b *backend) getMetricLabeler() event.Labeler {
+	return &metricLabelerAuditSink{}
+}
diff --git a/audit/backend_ce_test.go b/audit/backend_ce_test.go
new file mode 100644
index 00000000000..42856e2a1fd
--- /dev/null
+++ b/audit/backend_ce_test.go
@@ -0,0 +1,59 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package audit
+
+import (
+	"testing"
+
+	"github.com/hashicorp/eventlogger"
+	"github.com/stretchr/testify/require"
+)
+
+// TestBackend_configureFilterNode ensures that configureFilterNode handles various
+// filter values as expected. Empty (including whitespace) strings should return
+// no error but skip configuration of the node.
+// NOTE: Audit filtering is an Enterprise feature and behaves differently in the
+// community edition of Vault.
+func TestBackend_configureFilterNode(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		filter string
+	}{
+		"happy": {
+			filter: "operation == \"update\"",
+		},
+		"empty": {
+			filter: "",
+		},
+		"spacey": {
+			filter: "    ",
+		},
+		"bad": {
+			filter: "___qwerty",
+		},
+		"unsupported-field": {
+			filter: "foo == bar",
+		},
+	}
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			b := &backend{
+				nodeIDList: []eventlogger.NodeID{},
+				nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
+			}
+
+			err := b.configureFilterNode(tc.filter)
+			require.NoError(t, err)
+			require.Len(t, b.nodeIDList, 0)
+			require.Len(t, b.nodeMap, 0)
+		})
+	}
+}
diff --git a/audit/backend_config.go b/audit/backend_config.go
new file mode 100644
index 00000000000..ade411c1423
--- /dev/null
+++ b/audit/backend_config.go
@@ -0,0 +1,63 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/sdk/helper/salt"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// BackendConfig contains configuration parameters used in the factory func to
+// instantiate audit backends
+type BackendConfig struct {
+	// The view to store the salt
+	SaltView logical.Storage
+
+	// The salt config that should be used for any secret obfuscation
+	SaltConfig *salt.Config
+
+	// Config is the opaque user configuration provided when mounting
+	Config map[string]string
+
+	// MountPath is the path where this Backend is mounted
+	MountPath string
+
+	// Logger is used to emit log messages usually captured in the server logs.
+	Logger hclog.Logger
+}
+
+// Validate ensures that we have the required configuration to create audit backends.
+func (c *BackendConfig) Validate() error {
+	if c.SaltConfig == nil {
+		return fmt.Errorf("nil salt config: %w", ErrInvalidParameter)
+	}
+
+	if c.SaltView == nil {
+		return fmt.Errorf("nil salt view: %w", ErrInvalidParameter)
+	}
+
+	if c.Logger == nil || reflect.ValueOf(c.Logger).IsNil() {
+		return fmt.Errorf("nil logger: %w", ErrInvalidParameter)
+	}
+
+	if c.Config == nil {
+		return fmt.Errorf("config cannot be nil: %w", ErrInvalidParameter)
+	}
+
+	if strings.TrimSpace(c.MountPath) == "" {
+		return fmt.Errorf("mount path cannot be empty: %w", ErrExternalOptions)
+	}
+
+	// Validate actual config specific to Vault version (Enterprise/CE).
+	if err := c.validate(); err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/audit/backend_config_ce.go b/audit/backend_config_ce.go
new file mode 100644
index 00000000000..0f3bb96abaf
--- /dev/null
+++ b/audit/backend_config_ce.go
@@ -0,0 +1,18 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package audit
+
+import "fmt"
+
+// validate ensures that this if we're not running Vault Enterprise, we cannot
+// supply Enterprise-only audit configuration options.
+func (c *BackendConfig) validate() error {
+	if HasInvalidOptions(c.Config) {
+		return fmt.Errorf("enterprise-only options supplied: %w", ErrExternalOptions)
+	}
+
+	return nil
+}
diff --git a/audit/backend_file.go b/audit/backend_file.go
new file mode 100644
index 00000000000..91e4e20c100
--- /dev/null
+++ b/audit/backend_file.go
@@ -0,0 +1,164 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/vault/internal/observability/event"
+)
+
+const (
+	stdout  = "stdout"
+	discard = "discard"
+
+	optionFilePath = "file_path"
+	optionMode     = "mode"
+)
+
+var _ Backend = (*fileBackend)(nil)
+
+type fileBackend struct {
+	*backend
+}
+
+// NewFileBackend provides a wrapper to support the expectation elsewhere in Vault that
+// all audit backends can be created via a factory that returns an interface (Backend).
+func NewFileBackend(conf *BackendConfig, headersConfig HeaderFormatter) (be Backend, err error) {
+	be, err = newFileBackend(conf, headersConfig)
+	return
+}
+
+// newFileBackend creates a backend and configures all nodes including a file sink.
+func newFileBackend(conf *BackendConfig, headersConfig HeaderFormatter) (*fileBackend, error) {
+	if headersConfig == nil || reflect.ValueOf(headersConfig).IsNil() {
+		return nil, fmt.Errorf("nil header formatter: %w", ErrInvalidParameter)
+	}
+	if conf == nil {
+		return nil, fmt.Errorf("nil config: %w", ErrInvalidParameter)
+	}
+	if err := conf.Validate(); err != nil {
+		return nil, err
+	}
+
+	// Get file path from config or fall back to the old option ('path') for compatibility
+	// (see commit bac4fe0799a372ba1245db642f3f6cd1f1d02669).
+	var filePath string
+	if p, ok := conf.Config[optionFilePath]; ok {
+		filePath = p
+	} else if p, ok = conf.Config["path"]; ok {
+		filePath = p
+	} else {
+		return nil, fmt.Errorf("%q is required: %w", optionFilePath, ErrExternalOptions)
+	}
+
+	bec, err := newBackend(headersConfig, conf)
+	if err != nil {
+		return nil, err
+	}
+	b := &fileBackend{backend: bec}
+
+	// normalize file path if configured for stdout
+	if strings.EqualFold(filePath, stdout) {
+		filePath = stdout
+	}
+	if strings.EqualFold(filePath, discard) {
+		filePath = discard
+	}
+
+	// Configure the sink.
+	cfg, err := newFormatterConfig(headersConfig, conf.Config)
+	if err != nil {
+		return nil, err
+	}
+
+	sinkOpts := []event.Option{event.WithLogger(conf.Logger)}
+	if mode, ok := conf.Config[optionMode]; ok {
+		if strings.TrimSpace(mode) != "" {
+			m, err := strconv.ParseUint(mode, 8, 32)
+			if err != nil {
+				return nil, fmt.Errorf("invalid mode: %s", mode)
+			}
+			if m&0o111 != 0 {
+				return nil, fmt.Errorf("file mode may not be executable: %s", mode)
+			}
+		}
+		sinkOpts = append(sinkOpts, event.WithFileMode(mode))
+	}
+
+	err = b.configureSinkNode(conf.MountPath, filePath, cfg.requiredFormat, sinkOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return b, nil
+}
+
+// configureSinkNode is used internally by fileBackend to create and configure the
+// sink node on the backend.
+func (b *fileBackend) configureSinkNode(name string, filePath string, format format, opt ...event.Option) error {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return fmt.Errorf("name is required: %w", ErrExternalOptions)
+	}
+
+	filePath = strings.TrimSpace(filePath)
+	if filePath == "" {
+		return fmt.Errorf("file path is required: %w", ErrExternalOptions)
+	}
+
+	sinkNodeID, err := event.GenerateNodeID()
+	if err != nil {
+		return fmt.Errorf("error generating random NodeID for sink node: %w: %w", ErrInternal, err)
+	}
+
+	// normalize file path if configured for stdout or discard
+	if strings.EqualFold(filePath, stdout) {
+		filePath = stdout
+	} else if strings.EqualFold(filePath, discard) {
+		filePath = discard
+	}
+
+	var sinkNode eventlogger.Node
+	var sinkName string
+
+	switch filePath {
+	case stdout:
+		sinkName = stdout
+		sinkNode, err = event.NewStdoutSinkNode(format.String())
+	case discard:
+		sinkName = discard
+		sinkNode = event.NewNoopSink()
+	default:
+		// The NewFileSink function attempts to open the file and will return an error if it can't.
+		sinkName = name
+		sinkNode, err = event.NewFileSink(filePath, format.String(), opt...)
+	}
+	if err != nil {
+		return fmt.Errorf("file sink creation failed for path %q: %w", filePath, err)
+	}
+
+	// Wrap the sink node with metrics middleware
+	err = b.wrapMetrics(sinkName, sinkNodeID, sinkNode)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Reload will trigger the reload action on the sink node for this backend.
+func (b *fileBackend) Reload() error {
+	for _, n := range b.nodeMap {
+		if n.Type() == eventlogger.NodeTypeSink {
+			return n.Reopen()
+		}
+	}
+
+	return nil
+}
diff --git a/audit/backend_file_ce_test.go b/audit/backend_file_ce_test.go
new file mode 100644
index 00000000000..797b3c18841
--- /dev/null
+++ b/audit/backend_file_ce_test.go
@@ -0,0 +1,147 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package audit
+
+import (
+	"testing"
+
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/sdk/helper/salt"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+)
+
+// TestFileBackend_newFileBackend_fallback ensures that we get the correct errors
+// in CE when we try to enable a fileBackend with enterprise options like fallback
+// and filter.
+func TestFileBackend_newFileBackend_fallback(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		backendConfig        *BackendConfig
+		isErrorExpected      bool
+		expectedErrorMessage string
+	}{
+		"non-fallback-device-with-filter": {
+			backendConfig: &BackendConfig{
+				MountPath:  "discard",
+				SaltConfig: &salt.Config{},
+				SaltView:   &logical.InmemStorage{},
+				Logger:     hclog.NewNullLogger(),
+				Config: map[string]string{
+					"fallback":  "false",
+					"file_path": discard,
+					"filter":    "mount_type == kv",
+				},
+			},
+			isErrorExpected:      true,
+			expectedErrorMessage: "enterprise-only options supplied: invalid configuration",
+		},
+		"fallback-device-with-filter": {
+			backendConfig: &BackendConfig{
+				MountPath:  "discard",
+				SaltConfig: &salt.Config{},
+				SaltView:   &logical.InmemStorage{},
+				Logger:     hclog.NewNullLogger(),
+				Config: map[string]string{
+					"fallback":  "true",
+					"file_path": discard,
+					"filter":    "mount_type == kv",
+				},
+			},
+			isErrorExpected:      true,
+			expectedErrorMessage: "enterprise-only options supplied: invalid configuration",
+		},
+	}
+
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			be, err := newFileBackend(tc.backendConfig, &noopHeaderFormatter{})
+
+			if tc.isErrorExpected {
+				require.Error(t, err)
+				require.EqualError(t, err, tc.expectedErrorMessage)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, be)
+			}
+		})
+	}
+}
+
+// TestFileBackend_newFileBackend_FilterFormatterSink ensures that when configuring
+// a backend in community edition we cannot configure a filter node.
+// We can verify that we have formatter and sink nodes added to the backend.
+// The order of calls influences the slice of IDs on the Backend.
+func TestFileBackend_newFileBackend_FilterFormatterSink(t *testing.T) {
+	t.Parallel()
+
+	cfg := map[string]string{
+		"file_path": "/tmp/foo",
+		"mode":      "0666",
+		"format":    "json",
+		"filter":    "mount_type == \"kv\"",
+	}
+
+	backendConfig := &BackendConfig{
+		SaltView:   &logical.InmemStorage{},
+		SaltConfig: &salt.Config{},
+		Config:     cfg,
+		MountPath:  "bar",
+		Logger:     hclog.NewNullLogger(),
+	}
+
+	b, err := newFileBackend(backendConfig, &noopHeaderFormatter{})
+	require.Error(t, err)
+	require.EqualError(t, err, "enterprise-only options supplied: invalid configuration")
+
+	// Try without filter option
+	delete(cfg, "filter")
+	b, err = newFileBackend(backendConfig, &noopHeaderFormatter{})
+	require.NoError(t, err)
+
+	require.Len(t, b.nodeIDList, 2)
+	require.Len(t, b.nodeMap, 2)
+
+	id := b.nodeIDList[0]
+	node := b.nodeMap[id]
+	require.Equal(t, eventlogger.NodeTypeFormatter, node.Type())
+
+	id = b.nodeIDList[1]
+	node = b.nodeMap[id]
+	require.Equal(t, eventlogger.NodeTypeSink, node.Type())
+}
+
+// TestBackend_IsFallback ensures that no CE audit device can be a fallback.
+func TestBackend_IsFallback(t *testing.T) {
+	t.Parallel()
+
+	cfg := &BackendConfig{
+		MountPath:  "discard",
+		SaltConfig: &salt.Config{},
+		SaltView:   &logical.InmemStorage{},
+		Logger:     hclog.NewNullLogger(),
+		Config: map[string]string{
+			"fallback":  "true",
+			"file_path": discard,
+		},
+	}
+
+	be, err := newFileBackend(cfg, &noopHeaderFormatter{})
+	require.Error(t, err)
+	require.EqualError(t, err, "enterprise-only options supplied: invalid configuration")
+
+	// Remove the option and try again
+	delete(cfg.Config, "fallback")
+
+	be, err = newFileBackend(cfg, &noopHeaderFormatter{})
+	require.NoError(t, err)
+	require.NotNil(t, be)
+	require.Equal(t, false, be.IsFallback())
+}
diff --git a/audit/backend_file_test.go b/audit/backend_file_test.go
new file mode 100644
index 00000000000..9ca79a6c32c
--- /dev/null
+++ b/audit/backend_file_test.go
@@ -0,0 +1,299 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/internal/observability/event"
+	"github.com/hashicorp/vault/sdk/helper/salt"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+)
+
+// TestAuditFile_fileModeNew verifies that the backend Factory correctly sets
+// the file mode when the mode argument is set.
+func TestAuditFile_fileModeNew(t *testing.T) {
+	t.Parallel()
+
+	modeStr := "0666"
+	mode, err := strconv.ParseUint(modeStr, 8, 32)
+	require.NoError(t, err)
+
+	file := filepath.Join(t.TempDir(), "auditTest.txt")
+
+	backendConfig := &BackendConfig{
+		Config: map[string]string{
+			"path": file,
+			"mode": modeStr,
+		},
+		MountPath:  "foo/bar",
+		SaltConfig: &salt.Config{},
+		SaltView:   &logical.InmemStorage{},
+		Logger:     hclog.NewNullLogger(),
+	}
+	_, err = newFileBackend(backendConfig, &noopHeaderFormatter{})
+	require.NoError(t, err)
+
+	info, err := os.Stat(file)
+	require.NoErrorf(t, err, "cannot retrieve file mode from `Stat`")
+	require.Equalf(t, os.FileMode(mode), info.Mode(), "File mode does not match.")
+}
+
+// TestAuditFile_fileModeExisting verifies that the backend Factory correctly sets
+// the mode on an existing file.
+func TestAuditFile_fileModeExisting(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	f, err := os.CreateTemp(dir, "auditTest.log")
+	require.NoErrorf(t, err, "Failure to create test file.")
+
+	err = os.Chmod(f.Name(), 0o666)
+	require.NoErrorf(t, err, "Failure to chmod temp file for testing.")
+
+	err = f.Close()
+	require.NoErrorf(t, err, "Failure to close temp file for test.")
+
+	backendConfig := &BackendConfig{
+		Config: map[string]string{
+			"path": f.Name(),
+		},
+		MountPath:  "foo/bar",
+		SaltConfig: &salt.Config{},
+		SaltView:   &logical.InmemStorage{},
+		Logger:     hclog.NewNullLogger(),
+	}
+
+	_, err = newFileBackend(backendConfig, &noopHeaderFormatter{})
+	require.NoError(t, err)
+
+	info, err := os.Stat(f.Name())
+	require.NoErrorf(t, err, "cannot retrieve file mode from `Stat`")
+	require.Equalf(t, os.FileMode(0o600), info.Mode(), "File mode does not match.")
+}
+
+// TestAuditFile_fileMode0000 verifies that setting the audit file mode to
+// "0000" prevents Vault from modifying the permissions of the file.
+func TestAuditFile_fileMode0000(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	f, err := os.CreateTemp(dir, "auditTest.log")
+	require.NoErrorf(t, err, "Failure to create test file.")
+
+	err = os.Chmod(f.Name(), 0o777)
+	require.NoErrorf(t, err, "Failure to chmod temp file for testing.")
+
+	err = f.Close()
+	require.NoErrorf(t, err, "Failure to close temp file for test.")
+
+	backendConfig := &BackendConfig{
+		Config: map[string]string{
+			"path": f.Name(),
+			"mode": "0000",
+		},
+		MountPath:  "foo/bar",
+		SaltConfig: &salt.Config{},
+		SaltView:   &logical.InmemStorage{},
+		Logger:     hclog.NewNullLogger(),
+	}
+
+	_, err = newFileBackend(backendConfig, &noopHeaderFormatter{})
+	require.NoError(t, err)
+
+	info, err := os.Stat(f.Name())
+	require.NoErrorf(t, err, "cannot retrieve file mode from `Stat`. The error is %v", err)
+	require.Equalf(t, os.FileMode(0o777), info.Mode(), "File mode does not match.")
+}
+
+// TestAuditFile_EventLogger_fileModeNew verifies that the Factory function
+// correctly sets the file mode when the useEventLogger argument is set to
+// true.
+func TestAuditFile_EventLogger_fileModeNew(t *testing.T) {
+	modeStr := "0666"
+	mode, err := strconv.ParseUint(modeStr, 8, 32)
+	require.NoError(t, err)
+
+	file := filepath.Join(t.TempDir(), "auditTest.txt")
+
+	backendConfig := &BackendConfig{
+		Config: map[string]string{
+			"file_path": file,
+			"mode":      modeStr,
+		},
+		MountPath:  "foo/bar",
+		SaltConfig: &salt.Config{},
+		SaltView:   &logical.InmemStorage{},
+		Logger:     hclog.NewNullLogger(),
+	}
+
+	_, err = newFileBackend(backendConfig, &noopHeaderFormatter{})
+	require.NoError(t, err)
+
+	info, err := os.Stat(file)
+	require.NoError(t, err)
+	require.Equalf(t, os.FileMode(mode), info.Mode(), "File mode does not match.")
+
+	for _, modeStr := range []string{"0667", "0676", "0766", "0677", "0776", "0777"} {
+		mode, err = strconv.ParseUint(modeStr, 8, 32)
+		require.NoError(t, err)
+
+		// Test that executable audit files are disallowed
+		backendConfig.Config["mode"] = modeStr
+		_, err = newFileBackend(backendConfig, &noopHeaderFormatter{})
+		require.Error(t, err)
+	}
+}
+
+// TestFileBackend_newFileBackend ensures that we can correctly configure the sink
+// node on the Backend, and any incorrect parameters result in the relevant errors.
+func TestFileBackend_newFileBackend(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		mountPath      string
+		filePath       string
+		mode           string
+		format         string
+		wantErr        bool
+		expectedErrMsg string
+		expectedName   string
+	}{
+		"name-empty": {
+			mountPath:      "",
+			format:         "json",
+			wantErr:        true,
+			expectedErrMsg: "mount path cannot be empty: invalid configuration",
+		},
+		"name-whitespace": {
+			mountPath:      "   ",
+			format:         "json",
+			wantErr:        true,
+			expectedErrMsg: "mount path cannot be empty: invalid configuration",
+		},
+		"filePath-empty": {
+			mountPath:      "foo",
+			filePath:       "",
+			format:         "json",
+			wantErr:        true,
+			expectedErrMsg: "file path is required: invalid configuration",
+		},
+		"filePath-whitespace": {
+			mountPath:      "foo",
+			filePath:       "   ",
+			format:         "json",
+			wantErr:        true,
+			expectedErrMsg: "file path is required: invalid configuration",
+		},
+		"filePath-stdout-lower": {
+			mountPath:    "foo",
+			expectedName: "stdout",
+			filePath:     "stdout",
+			format:       "json",
+		},
+		"filePath-stdout-upper": {
+			mountPath:    "foo",
+			expectedName: "stdout",
+			filePath:     "STDOUT",
+			format:       "json",
+		},
+		"filePath-stdout-mixed": {
+			mountPath:    "foo",
+			expectedName: "stdout",
+			filePath:     "StdOut",
+			format:       "json",
+		},
+		"filePath-discard-lower": {
+			mountPath:    "foo",
+			expectedName: "discard",
+			filePath:     "discard",
+			format:       "json",
+		},
+		"filePath-discard-upper": {
+			mountPath:    "foo",
+			expectedName: "discard",
+			filePath:     "DISCARD",
+			format:       "json",
+		},
+		"filePath-discard-mixed": {
+			mountPath:    "foo",
+			expectedName: "discard",
+			filePath:     "DisCArd",
+			format:       "json",
+		},
+		"format-empty": {
+			mountPath:      "foo",
+			filePath:       "/tmp/",
+			format:         "",
+			wantErr:        true,
+			expectedErrMsg: "unsupported \"format\": invalid configuration",
+		},
+		"format-whitespace": {
+			mountPath:      "foo",
+			filePath:       "/tmp/",
+			format:         "   ",
+			wantErr:        true,
+			expectedErrMsg: "unsupported \"format\": invalid configuration",
+		},
+		"filePath-weird-with-mode-zero": {
+			mountPath:      "foo",
+			filePath:       "/tmp/qwerty",
+			format:         "json",
+			mode:           "0",
+			wantErr:        true,
+			expectedErrMsg: "file sink creation failed for path \"/tmp/qwerty\": unable to determine existing file mode: stat /tmp/qwerty: no such file or directory",
+		},
+		"happy": {
+			mountPath:    "foo",
+			filePath:     "/tmp/log",
+			mode:         "",
+			format:       "json",
+			wantErr:      false,
+			expectedName: "foo",
+		},
+	}
+
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := &BackendConfig{
+				SaltView:   &logical.InmemStorage{},
+				SaltConfig: &salt.Config{},
+				Logger:     hclog.NewNullLogger(),
+				Config: map[string]string{
+					"file_path": tc.filePath,
+					"mode":      tc.mode,
+					"format":    tc.format,
+				},
+				MountPath: tc.mountPath,
+			}
+			b, err := newFileBackend(cfg, &noopHeaderFormatter{})
+
+			if tc.wantErr {
+				require.Error(t, err)
+				require.EqualError(t, err, tc.expectedErrMsg)
+				require.Nil(t, b)
+			} else {
+				require.NoError(t, err)
+				require.Len(t, b.nodeIDList, 2) // Expect formatter + the sink
+				require.Len(t, b.nodeMap, 2)
+				id := b.nodeIDList[1]
+				node := b.nodeMap[id]
+				require.Equal(t, eventlogger.NodeTypeSink, node.Type())
+				mc, ok := node.(*event.MetricsCounter)
+				require.True(t, ok)
+				require.Equal(t, tc.expectedName, mc.Name)
+			}
+		})
+	}
+}
diff --git a/audit/backend_noop.go b/audit/backend_noop.go
new file mode 100644
index 00000000000..b3518707c8a
--- /dev/null
+++ b/audit/backend_noop.go
@@ -0,0 +1,358 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
+	"github.com/hashicorp/vault/internal/observability/event"
+	"github.com/hashicorp/vault/sdk/helper/salt"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+var (
+	_ Backend          = (*NoopAudit)(nil)
+	_ eventlogger.Node = (*noopWrapper)(nil)
+)
+
+// noopWrapper is designed to wrap a formatter node in order to allow access to
+// bytes formatted, headers formatted and parts of the logical.LogInput.
+// Some older tests relied on being able to query this information so while those
+// tests stick around we should look after them.
+type noopWrapper struct {
+	format  string
+	node    eventlogger.Node
+	backend *NoopAudit
+}
+
+// SetListener provides a callback func to the NoopAudit which can be invoked
+// during processing of the Event.
+//
+// Deprecated: SetListener should not be used in new tests.
+func (n *NoopAudit) SetListener(listener func(event *Event)) {
+	n.listener = listener
+}
+
+// NoopAudit only exists to allow legacy tests to continue working.
+//
+// Deprecated: NoopAudit should not be used in new tests.
+type NoopAudit struct {
+	Config *BackendConfig
+
+	ReqErr         error
+	ReqAuth        []*logical.Auth
+	Req            []*logical.Request
+	ReqHeaders     []map[string][]string
+	ReqNonHMACKeys []string
+	ReqErrs        []error
+
+	RespErr            error
+	RespAuth           []*logical.Auth
+	RespReq            []*logical.Request
+	Resp               []*logical.Response
+	RespNonHMACKeys    [][]string
+	RespReqNonHMACKeys [][]string
+	RespErrs           []error
+	records            [][]byte
+	l                  sync.RWMutex
+	salt               *salt.Salt
+	saltMutex          sync.RWMutex
+
+	nodeIDList []eventlogger.NodeID
+	nodeMap    map[eventlogger.NodeID]eventlogger.Node
+
+	listener func(event *Event)
+}
+
+// noopHeaderFormatter can be used within no-op audit devices to do nothing when
+// it comes to only allow configured headers to appear in the result.
+// Whatever is passed in will be returned (nil becomes an empty map) in lowercase.
+type noopHeaderFormatter struct{}
+
+// ApplyConfig implements the relevant interface to make noopHeaderFormatter an HeaderFormatter.
+func (f *noopHeaderFormatter) ApplyConfig(_ context.Context, headers map[string][]string, _ Salter) (result map[string][]string, retErr error) {
+	if len(headers) < 1 {
+		return map[string][]string{}, nil
+	}
+
+	// Make a copy of the incoming headers with everything lower so we can
+	// case-insensitively compare
+	lowerHeaders := make(map[string][]string, len(headers))
+	for k, v := range headers {
+		lowerHeaders[strings.ToLower(k)] = v
+	}
+
+	return lowerHeaders, nil
+}
+
+// NewNoopAudit should be used to create a NoopAudit as it handles creation of a
+// predictable salt and wraps eventlogger nodes so information can be retrieved on
+// what they've seen or formatted.
+//
+// Deprecated: NewNoopAudit only exists to allow legacy tests to continue working.
+func NewNoopAudit(config *BackendConfig) (*NoopAudit, error) {
+	view := &logical.InmemStorage{}
+
+	// Create the salt with a known key for predictable hmac values.
+	se := &logical.StorageEntry{Key: "salt", Value: []byte("foo")}
+	err := view.Put(context.Background(), se)
+	if err != nil {
+		return nil, err
+	}
+
+	// Override the salt related config settings.
+	backendConfig := &BackendConfig{
+		SaltView: view,
+		SaltConfig: &salt.Config{
+			HMAC:     sha256.New,
+			HMACType: "hmac-sha256",
+		},
+		Config:    config.Config,
+		MountPath: config.MountPath,
+	}
+
+	noopBackend := &NoopAudit{
+		Config:     backendConfig,
+		nodeIDList: make([]eventlogger.NodeID, 2),
+		nodeMap:    make(map[eventlogger.NodeID]eventlogger.Node, 2),
+	}
+
+	cfg, err := newFormatterConfig(&noopHeaderFormatter{}, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	formatterNodeID, err := event.GenerateNodeID()
+	if err != nil {
+		return nil, fmt.Errorf("error generating random NodeID for formatter node: %w", err)
+	}
+
+	formatterNode, err := newEntryFormatter(config.MountPath, cfg, noopBackend, config.Logger)
+	if err != nil {
+		return nil, fmt.Errorf("error creating formatter: %w", err)
+	}
+
+	// Wrap the formatting node, so we can get any bytes that were formatted etc.
+	wrappedFormatter := &noopWrapper{format: "json", node: formatterNode, backend: noopBackend}
+
+	noopBackend.nodeIDList[0] = formatterNodeID
+	noopBackend.nodeMap[formatterNodeID] = wrappedFormatter
+
+	sinkNode := event.NewNoopSink()
+	sinkNodeID, err := event.GenerateNodeID()
+	if err != nil {
+		return nil, fmt.Errorf("error generating random NodeID for sink node: %w", err)
+	}
+
+	noopBackend.nodeIDList[1] = sinkNodeID
+	noopBackend.nodeMap[sinkNodeID] = sinkNode
+
+	return noopBackend, nil
+}
+
+// NoopAuditFactory should be used when the test needs a way to access bytes that
+// have been formatted by the pipeline during audit requests.
+// The records parameter will be repointed to the one used within the pipeline.
+//
+// Deprecated: NoopAuditFactory only exists to allow legacy tests to continue working.
+func NoopAuditFactory(records **[][]byte) Factory {
+	return func(config *BackendConfig, _ HeaderFormatter) (Backend, error) {
+		n, err := NewNoopAudit(config)
+		if err != nil {
+			return nil, err
+		}
+		if records != nil {
+			*records = &n.records
+		}
+
+		return n, nil
+	}
+}
+
+// Process handles the contortions required by older test code to ensure behavior.
+// It will attempt to do some pre/post processing of the logical.LogInput that should
+// form part of the event's payload data, as well as capturing the resulting headers
+// that were formatted and track the overall bytes that a formatted event uses when
+// it's ready to head down the pipeline to the sink node (a noop for us).
+func (n *noopWrapper) Process(ctx context.Context, e *eventlogger.Event) (*eventlogger.Event, error) {
+	n.backend.l.Lock()
+	defer n.backend.l.Unlock()
+
+	var err error
+
+	// We're expecting audit events since this is an audit device.
+	a, ok := e.Payload.(*Event)
+	if !ok {
+		return nil, errors.New("cannot parse payload as an audit event")
+	}
+
+	if n.backend.listener != nil {
+		n.backend.listener(a)
+	}
+
+	in := a.Data
+
+	// Depending on the type of the audit event (request or response) we need to
+	// track different things.
+	switch a.Subtype {
+	case RequestType:
+		n.backend.ReqAuth = append(n.backend.ReqAuth, in.Auth)
+		n.backend.Req = append(n.backend.Req, in.Request)
+		n.backend.ReqNonHMACKeys = in.NonHMACReqDataKeys
+		n.backend.ReqErrs = append(n.backend.ReqErrs, in.OuterErr)
+
+		if n.backend.ReqErr != nil {
+			return nil, n.backend.ReqErr
+		}
+	case ResponseType:
+		n.backend.RespAuth = append(n.backend.RespAuth, in.Auth)
+		n.backend.RespReq = append(n.backend.RespReq, in.Request)
+		n.backend.Resp = append(n.backend.Resp, in.Response)
+		n.backend.RespErrs = append(n.backend.RespErrs, in.OuterErr)
+
+		if in.Response != nil {
+			n.backend.RespNonHMACKeys = append(n.backend.RespNonHMACKeys, in.NonHMACRespDataKeys)
+			n.backend.RespReqNonHMACKeys = append(n.backend.RespReqNonHMACKeys, in.NonHMACReqDataKeys)
+		}
+
+		if n.backend.RespErr != nil {
+			return nil, n.backend.RespErr
+		}
+	default:
+		return nil, fmt.Errorf("unknown audit event type: %q", a.Subtype)
+	}
+
+	// Once we've taken note of the relevant properties of the event, we get the
+	// underlying (wrapped) node to process it as normal.
+	e, err = n.node.Process(ctx, e)
+	if err != nil {
+		return nil, fmt.Errorf("error processing wrapped node: %w", err)
+	}
+
+	// Once processing has been carried out, the underlying node (a formatter node)
+	// should contain the output ready for the sink node. We'll get that in order
+	// to track how many bytes we formatted.
+	b, ok := e.Format(n.format)
+	if ok {
+		n.backend.records = append(n.backend.records, b)
+	}
+
+	// Finally, the last bit of post-processing is to make sure that we track the
+	// formatted headers that would have made it to the logs via the sink node.
+	// They only appear in requests.
+	if a.Subtype == RequestType {
+		reqEntry := &entry{}
+		err = json.Unmarshal(b, &reqEntry)
+		if err != nil {
+			return nil, fmt.Errorf("unable to parse formatted audit entry data: %w", err)
+		}
+
+		n.backend.ReqHeaders = append(n.backend.ReqHeaders, reqEntry.Request.Headers)
+	}
+
+	// Return the event and no error in order to let the pipeline continue on.
+	return e, nil
+}
+
+func (n *noopWrapper) Reopen() error {
+	return n.node.Reopen()
+}
+
+func (n *noopWrapper) Type() eventlogger.NodeType {
+	return n.node.Type()
+}
+
+// LogTestMessage will manually crank the handle on the nodes associated with this backend.
+func (n *NoopAudit) LogTestMessage(ctx context.Context, in *logical.LogInput) error {
+	if len(n.nodeIDList) > 0 {
+		return processManual(ctx, in, n.nodeIDList, n.nodeMap)
+	}
+
+	return nil
+}
+
+func (n *NoopAudit) Salt(ctx context.Context) (*salt.Salt, error) {
+	n.saltMutex.RLock()
+	if n.salt != nil {
+		defer n.saltMutex.RUnlock()
+		return n.salt, nil
+	}
+	n.saltMutex.RUnlock()
+	n.saltMutex.Lock()
+	defer n.saltMutex.Unlock()
+	if n.salt != nil {
+		return n.salt, nil
+	}
+	s, err := salt.NewSalt(ctx, n.Config.SaltView, n.Config.SaltConfig)
+	if err != nil {
+		return nil, err
+	}
+	n.salt = s
+	return s, nil
+}
+
+func (n *NoopAudit) GetHash(ctx context.Context, data string) (string, error) {
+	s, err := n.Salt(ctx)
+	if err != nil {
+		return "", err
+	}
+	return s.GetIdentifiedHMAC(data), nil
+}
+
+func (n *NoopAudit) Reload() error {
+	return nil
+}
+
+func (n *NoopAudit) Invalidate(_ context.Context) {
+	n.saltMutex.Lock()
+	defer n.saltMutex.Unlock()
+	n.salt = nil
+}
+
+func (n *NoopAudit) EventType() eventlogger.EventType {
+	return event.AuditType.AsEventType()
+}
+
+func (n *NoopAudit) HasFiltering() bool {
+	return false
+}
+
+func (n *NoopAudit) Name() string {
+	return n.Config.MountPath
+}
+
+func (n *NoopAudit) Nodes() map[eventlogger.NodeID]eventlogger.Node {
+	return n.nodeMap
+}
+
+func (n *NoopAudit) NodeIDs() []eventlogger.NodeID {
+	return n.nodeIDList
+}
+
+func (n *NoopAudit) IsFallback() bool {
+	return false
+}
+
+// Deprecated: TestNoopAudit only exists to allow legacy tests to continue working.
+func TestNoopAudit(t *testing.T, path string, config map[string]string) *NoopAudit {
+	cfg := &BackendConfig{
+		Config:    config,
+		MountPath: path,
+		Logger:    corehelpers.NewTestLogger(t),
+	}
+	n, err := NewNoopAudit(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return n
+}
diff --git a/audit/backend_socket.go b/audit/backend_socket.go
new file mode 100644
index 00000000000..add7da94064
--- /dev/null
+++ b/audit/backend_socket.go
@@ -0,0 +1,126 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/vault/internal/observability/event"
+)
+
+const (
+	optionAddress      = "address"
+	optionSocketType   = "socket_type"
+	optionWriteTimeout = "write_timeout"
+)
+
+var _ Backend = (*socketBackend)(nil)
+
+type socketBackend struct {
+	*backend
+}
+
+// NewSocketBackend provides a means to create socket backend audit devices that
+// satisfy the Factory pattern expected elsewhere in Vault.
+func NewSocketBackend(conf *BackendConfig, headersConfig HeaderFormatter) (be Backend, err error) {
+	be, err = newSocketBackend(conf, headersConfig)
+	return
+}
+
+// newSocketBackend creates a backend and configures all nodes including a socket sink.
+func newSocketBackend(conf *BackendConfig, headersConfig HeaderFormatter) (*socketBackend, error) {
+	if headersConfig == nil || reflect.ValueOf(headersConfig).IsNil() {
+		return nil, fmt.Errorf("nil header formatter: %w", ErrInvalidParameter)
+	}
+	if conf == nil {
+		return nil, fmt.Errorf("nil config: %w", ErrInvalidParameter)
+	}
+	if err := conf.Validate(); err != nil {
+		return nil, err
+	}
+
+	bec, err := newBackend(headersConfig, conf)
+	if err != nil {
+		return nil, err
+	}
+
+	address, ok := conf.Config[optionAddress]
+	if !ok {
+		return nil, fmt.Errorf("%q is required: %w", optionAddress, ErrExternalOptions)
+	}
+	address = strings.TrimSpace(address)
+	if address == "" {
+		return nil, fmt.Errorf("%q cannot be empty: %w", optionAddress, ErrExternalOptions)
+	}
+
+	socketType, ok := conf.Config[optionSocketType]
+	if !ok {
+		socketType = "tcp"
+	}
+
+	writeDeadline, ok := conf.Config[optionWriteTimeout]
+	if !ok {
+		writeDeadline = "2s"
+	}
+
+	sinkOpts := []event.Option{
+		event.WithSocketType(socketType),
+		event.WithMaxDuration(writeDeadline),
+		event.WithLogger(conf.Logger),
+	}
+
+	err = event.ValidateOptions(sinkOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	b := &socketBackend{backend: bec}
+
+	// Configure the sink.
+	cfg, err := newFormatterConfig(headersConfig, conf.Config)
+	if err != nil {
+		return nil, err
+	}
+
+	err = b.configureSinkNode(conf.MountPath, address, cfg.requiredFormat, sinkOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return b, nil
+}
+
+func (b *socketBackend) configureSinkNode(name string, address string, format format, opts ...event.Option) error {
+	sinkNodeID, err := event.GenerateNodeID()
+	if err != nil {
+		return fmt.Errorf("error generating random NodeID for sink node: %w", err)
+	}
+
+	n, err := event.NewSocketSink(address, format.String(), opts...)
+	if err != nil {
+		return err
+	}
+
+	// Wrap the sink node with metrics middleware
+	err = b.wrapMetrics(name, sinkNodeID, n)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Reload will trigger the reload action on the sink node for this backend.
+func (b *socketBackend) Reload() error {
+	for _, n := range b.nodeMap {
+		if n.Type() == eventlogger.NodeTypeSink {
+			return n.Reopen()
+		}
+	}
+
+	return nil
+}
diff --git a/audit/backend_socket_test.go b/audit/backend_socket_test.go
new file mode 100644
index 00000000000..799e67d2f8a
--- /dev/null
+++ b/audit/backend_socket_test.go
@@ -0,0 +1,136 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"testing"
+
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/internal/observability/event"
+	"github.com/hashicorp/vault/sdk/helper/salt"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSocketBackend_newSocketBackend ensures that we can correctly configure the sink
+// node on the Backend, and any incorrect parameters result in the relevant errors.
+func TestSocketBackend_newSocketBackend(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		mountPath      string
+		address        string
+		socketType     string
+		writeDuration  string
+		format         string
+		wantErr        bool
+		expectedErrMsg string
+		expectedName   string
+	}{
+		"name-empty": {
+			mountPath:      "",
+			address:        "wss://foo",
+			format:         "json",
+			wantErr:        true,
+			expectedErrMsg: "mount path cannot be empty: invalid configuration",
+		},
+		"name-whitespace": {
+			mountPath:      "   ",
+			address:        "wss://foo",
+			format:         "json",
+			wantErr:        true,
+			expectedErrMsg: "mount path cannot be empty: invalid configuration",
+		},
+		"address-empty": {
+			mountPath:      "foo",
+			address:        "",
+			format:         "json",
+			wantErr:        true,
+			expectedErrMsg: "\"address\" cannot be empty: invalid configuration",
+		},
+		"address-whitespace": {
+			mountPath:      "foo",
+			address:        "   ",
+			format:         "json",
+			wantErr:        true,
+			expectedErrMsg: "\"address\" cannot be empty: invalid configuration",
+		},
+		"format-empty": {
+			mountPath:      "foo",
+			address:        "wss://foo",
+			format:         "",
+			wantErr:        true,
+			expectedErrMsg: "unsupported \"format\": invalid configuration",
+		},
+		"format-whitespace": {
+			mountPath:      "foo",
+			address:        "wss://foo",
+			format:         "   ",
+			wantErr:        true,
+			expectedErrMsg: "unsupported \"format\": invalid configuration",
+		},
+		"write-duration-valid": {
+			mountPath:     "foo",
+			address:       "wss://foo",
+			writeDuration: "5s",
+			format:        "json",
+			wantErr:       false,
+			expectedName:  "foo",
+		},
+		"write-duration-not-valid": {
+			mountPath:      "foo",
+			address:        "wss://foo",
+			writeDuration:  "qwerty",
+			format:         "json",
+			wantErr:        true,
+			expectedErrMsg: "unable to parse max duration: invalid parameter: time: invalid duration \"qwerty\"",
+		},
+		"happy": {
+			mountPath:    "foo",
+			address:      "wss://foo",
+			format:       "json",
+			wantErr:      false,
+			expectedName: "foo",
+		},
+	}
+
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := &BackendConfig{
+				SaltView:   &logical.InmemStorage{},
+				SaltConfig: &salt.Config{},
+				Logger:     hclog.NewNullLogger(),
+				Config: map[string]string{
+					"address":       tc.address,
+					"format":        tc.format,
+					"write_timeout": tc.writeDuration,
+					"socket":        tc.socketType,
+				},
+				MountPath: tc.mountPath,
+			}
+			b, err := newSocketBackend(cfg, &noopHeaderFormatter{})
+
+			if tc.wantErr {
+				require.Error(t, err)
+				require.EqualError(t, err, tc.expectedErrMsg)
+				require.Nil(t, b)
+			} else {
+				require.NoError(t, err)
+				require.Len(t, b.nodeIDList, 2) // formatter + sink
+				require.Len(t, b.nodeMap, 2)
+				id := b.nodeIDList[1] // sink is 2nd
+				node := b.nodeMap[id]
+				require.Equal(t, eventlogger.NodeTypeSink, node.Type())
+				mc, ok := node.(*event.MetricsCounter)
+				require.True(t, ok)
+				require.Equal(t, tc.expectedName, mc.Name)
+			}
+		})
+	}
+}
diff --git a/audit/backend_syslog.go b/audit/backend_syslog.go
new file mode 100644
index 00000000000..e8462da4e4a
--- /dev/null
+++ b/audit/backend_syslog.go
@@ -0,0 +1,109 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/hashicorp/vault/internal/observability/event"
+)
+
+const (
+	optionFacility = "facility"
+	optionTag      = "tag"
+)
+
+var _ Backend = (*syslogBackend)(nil)
+
+type syslogBackend struct {
+	*backend
+}
+
+// NewSyslogBackend provides a wrapper to support the expectation elsewhere in Vault that
+// all audit backends can be created via a factory that returns an interface (Backend).
+func NewSyslogBackend(conf *BackendConfig, headersConfig HeaderFormatter) (be Backend, err error) {
+	be, err = newSyslogBackend(conf, headersConfig)
+	return
+}
+
+// newSyslogBackend creates a backend and configures all nodes including a socket sink.
+func newSyslogBackend(conf *BackendConfig, headersConfig HeaderFormatter) (*syslogBackend, error) {
+	if headersConfig == nil || reflect.ValueOf(headersConfig).IsNil() {
+		return nil, fmt.Errorf("nil header formatter: %w", ErrInvalidParameter)
+	}
+	if conf == nil {
+		return nil, fmt.Errorf("nil config: %w", ErrInvalidParameter)
+	}
+	if err := conf.Validate(); err != nil {
+		return nil, err
+	}
+
+	bec, err := newBackend(headersConfig, conf)
+	if err != nil {
+		return nil, err
+	}
+
+	// Get facility or default to AUTH
+	facility, ok := conf.Config[optionFacility]
+	if !ok {
+		facility = "AUTH"
+	}
+
+	// Get tag or default to 'vault'
+	tag, ok := conf.Config[optionTag]
+	if !ok {
+		tag = "vault"
+	}
+
+	sinkOpts := []event.Option{
+		event.WithFacility(facility),
+		event.WithTag(tag),
+		event.WithLogger(conf.Logger),
+	}
+
+	err = event.ValidateOptions(sinkOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	b := &syslogBackend{backend: bec}
+
+	// Configure the sink.
+	cfg, err := newFormatterConfig(headersConfig, conf.Config)
+	if err != nil {
+		return nil, err
+	}
+
+	err = b.configureSinkNode(conf.MountPath, cfg.requiredFormat, sinkOpts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return b, nil
+}
+
+func (b *syslogBackend) configureSinkNode(name string, format format, opts ...event.Option) error {
+	sinkNodeID, err := event.GenerateNodeID()
+	if err != nil {
+		return fmt.Errorf("error generating random NodeID for sink node: %w: %w", ErrInternal, err)
+	}
+
+	n, err := event.NewSyslogSink(format.String(), opts...)
+	if err != nil {
+		return fmt.Errorf("error creating syslog sink node: %w", err)
+	}
+
+	err = b.wrapMetrics(name, sinkNodeID, n)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Reload will trigger the reload action on the sink node for this backend.
+func (b *syslogBackend) Reload() error {
+	return nil
+}
diff --git a/audit/backend_syslog_test.go b/audit/backend_syslog_test.go
new file mode 100644
index 00000000000..229434b59f8
--- /dev/null
+++ b/audit/backend_syslog_test.go
@@ -0,0 +1,119 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"testing"
+
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/internal/observability/event"
+	"github.com/hashicorp/vault/sdk/helper/salt"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSyslogBackend_newSyslogBackend tests the ways we can try to create a new
+// SyslogBackend both good and bad.
+func TestSyslogBackend_newSyslogBackend(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		mountPath      string
+		format         string
+		tag            string
+		facility       string
+		wantErr        bool
+		expectedErrMsg string
+		expectedName   string
+	}{
+		"name-empty": {
+			mountPath:      "",
+			wantErr:        true,
+			expectedErrMsg: "mount path cannot be empty: invalid configuration",
+		},
+		"name-whitespace": {
+			mountPath:      "   ",
+			wantErr:        true,
+			expectedErrMsg: "mount path cannot be empty: invalid configuration",
+		},
+		"format-empty": {
+			mountPath:      "foo",
+			format:         "",
+			wantErr:        true,
+			expectedErrMsg: "unsupported \"format\": invalid configuration",
+		},
+		"format-whitespace": {
+			mountPath:      "foo",
+			format:         "   ",
+			wantErr:        true,
+			expectedErrMsg: "unsupported \"format\": invalid configuration",
+		},
+		"happy": {
+			mountPath:    "foo",
+			format:       "json",
+			wantErr:      false,
+			expectedName: "foo",
+		},
+		"happy-tag": {
+			mountPath:    "foo",
+			format:       "json",
+			tag:          "beep",
+			wantErr:      false,
+			expectedName: "foo",
+		},
+		"happy-facility": {
+			mountPath:    "foo",
+			format:       "json",
+			facility:     "daemon",
+			wantErr:      false,
+			expectedName: "foo",
+		},
+		"happy-all": {
+			mountPath:    "foo",
+			format:       "json",
+			tag:          "beep",
+			facility:     "daemon",
+			wantErr:      false,
+			expectedName: "foo",
+		},
+	}
+
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := &BackendConfig{
+				SaltView:   &logical.InmemStorage{},
+				SaltConfig: &salt.Config{},
+				Logger:     hclog.NewNullLogger(),
+				Config: map[string]string{
+					"tag":      tc.tag,
+					"facility": tc.facility,
+					"format":   tc.format,
+				},
+				MountPath: tc.mountPath,
+			}
+			b, err := newSyslogBackend(cfg, &noopHeaderFormatter{})
+
+			if tc.wantErr {
+				require.Error(t, err)
+				require.EqualError(t, err, tc.expectedErrMsg)
+				require.Nil(t, b)
+			} else {
+				require.NoError(t, err)
+				require.Len(t, b.nodeIDList, 2)
+				require.Len(t, b.nodeMap, 2)
+				id := b.nodeIDList[1]
+				node := b.nodeMap[id]
+				require.Equal(t, eventlogger.NodeTypeSink, node.Type())
+				mc, ok := node.(*event.MetricsCounter)
+				require.True(t, ok)
+				require.Equal(t, tc.expectedName, mc.Name)
+			}
+		})
+	}
+}
diff --git a/audit/backend_test.go b/audit/backend_test.go
new file mode 100644
index 00000000000..0e87ac87b04
--- /dev/null
+++ b/audit/backend_test.go
@@ -0,0 +1,272 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"testing"
+
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/helper/constants"
+	"github.com/stretchr/testify/require"
+)
+
+// TestBackend_newFormatterConfig ensures that all the configuration values are
+// parsed correctly when trying to create a new formatterConfig via newFormatterConfig.
+func TestBackend_newFormatterConfig(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		config          map[string]string
+		want            formatterConfig
+		wantErr         bool
+		expectedMessage string
+	}{
+		"happy-path-json": {
+			config: map[string]string{
+				"format":               jsonFormat.String(),
+				"hmac_accessor":        "true",
+				"log_raw":              "true",
+				"elide_list_responses": "true",
+			},
+			want: formatterConfig{
+				raw:                true,
+				hmacAccessor:       true,
+				elideListResponses: true,
+				requiredFormat:     "json",
+			}, wantErr: false,
+		},
+		"happy-path-jsonx": {
+			config: map[string]string{
+				"format":               jsonxFormat.String(),
+				"hmac_accessor":        "true",
+				"log_raw":              "true",
+				"elide_list_responses": "true",
+			},
+			want: formatterConfig{
+				raw:                true,
+				hmacAccessor:       true,
+				elideListResponses: true,
+				requiredFormat:     "jsonx",
+			},
+			wantErr: false,
+		},
+		"invalid-format": {
+			config: map[string]string{
+				"format":               " squiggly ",
+				"hmac_accessor":        "true",
+				"log_raw":              "true",
+				"elide_list_responses": "true",
+			},
+			want:            formatterConfig{},
+			wantErr:         true,
+			expectedMessage: "unsupported \"format\": invalid configuration",
+		},
+		"invalid-hmac-accessor": {
+			config: map[string]string{
+				"format":        jsonFormat.String(),
+				"hmac_accessor": "maybe",
+			},
+			want:            formatterConfig{},
+			wantErr:         true,
+			expectedMessage: "unable to parse \"hmac_accessor\": invalid configuration",
+		},
+		"invalid-log-raw": {
+			config: map[string]string{
+				"format":        jsonFormat.String(),
+				"hmac_accessor": "true",
+				"log_raw":       "maybe",
+			},
+			want:            formatterConfig{},
+			wantErr:         true,
+			expectedMessage: "unable to parse \"log_raw\": invalid configuration",
+		},
+		"invalid-elide-bool": {
+			config: map[string]string{
+				"format":               jsonFormat.String(),
+				"hmac_accessor":        "true",
+				"log_raw":              "true",
+				"elide_list_responses": "maybe",
+			},
+			want:            formatterConfig{},
+			wantErr:         true,
+			expectedMessage: "unable to parse \"elide_list_responses\": invalid configuration",
+		},
+		"prefix": {
+			config: map[string]string{
+				"format": jsonFormat.String(),
+				"prefix": "foo",
+			},
+			want: formatterConfig{
+				requiredFormat: jsonFormat,
+				prefix:         "foo",
+				hmacAccessor:   true,
+			},
+		},
+	}
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := newFormatterConfig(&noopHeaderFormatter{}, tc.config)
+			if tc.wantErr {
+				require.Error(t, err)
+				require.EqualError(t, err, tc.expectedMessage)
+			} else {
+				require.NoError(t, err)
+			}
+			require.Equal(t, tc.want.requiredFormat, got.requiredFormat)
+			require.Equal(t, tc.want.raw, got.raw)
+			require.Equal(t, tc.want.elideListResponses, got.elideListResponses)
+			require.Equal(t, tc.want.hmacAccessor, got.hmacAccessor)
+			require.Equal(t, tc.want.omitTime, got.omitTime)
+			require.Equal(t, tc.want.prefix, got.prefix)
+		})
+	}
+}
+
+// TestBackend_configureFormatterNode ensures that configureFormatterNode
+// populates the nodeIDList and nodeMap on backend when given valid config.
+func TestBackend_configureFormatterNode(t *testing.T) {
+	t.Parallel()
+
+	b, err := newBackend(&noopHeaderFormatter{}, &BackendConfig{
+		MountPath: "foo",
+		Logger:    hclog.NewNullLogger(),
+	})
+	require.NoError(t, err)
+
+	require.Len(t, b.nodeIDList, 1)
+	require.Len(t, b.nodeMap, 1)
+	id := b.nodeIDList[0]
+	node := b.nodeMap[id]
+	require.Equal(t, eventlogger.NodeTypeFormatter, node.Type())
+}
+
+// TestBackend_hasEnterpriseAuditOptions checks that the existence of any Enterprise
+// only options in the options which can be supplied to enable an audit device can
+// be flagged.
+func TestBackend_hasEnterpriseAuditOptions(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		input    map[string]string
+		expected bool
+	}{
+		"nil": {
+			expected: false,
+		},
+		"empty": {
+			input:    make(map[string]string),
+			expected: false,
+		},
+		"non-ent-opts": {
+			input: map[string]string{
+				"log_raw": "true",
+			},
+			expected: false,
+		},
+		"ent-opt-filter": {
+			input: map[string]string{
+				"filter": "mount_type == kv",
+			},
+			expected: true,
+		},
+		"ent-opt-fallback": {
+			input: map[string]string{
+				"fallback": "true",
+			},
+			expected: true,
+		},
+		"ent-opt-filter-and-fallback": {
+			input: map[string]string{
+				"filter":   "mount_type == kv",
+				"fallback": "true",
+			},
+			expected: true,
+		},
+		"ent-opt-exclude": {
+			input: map[string]string{
+				"exclude": `{
+					"condition": "\"/request/mount_type\" == transit",
+					"fields": [ "/request/data", "/response/data" ]
+				}`,
+			},
+			expected: true,
+		},
+	}
+
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, tc.expected, hasEnterpriseAuditOptions(tc.input))
+		})
+	}
+}
+
+// TestBackend_hasInvalidAuditOptions tests that depending on whether we are running
+// an Enterprise or non-Enterprise version of Vault, the options supplied to enable
+// an audit device may or may not be valid.
+// NOTE: In the non-Enterprise version of Vault supplying audit options such as
+// 'filter' or 'fallback' is not allowed.
+func TestBackend_hasInvalidAuditOptions(t *testing.T) {
+	tests := map[string]struct {
+		input    map[string]string
+		expected bool
+	}{
+		"non-ent-opts": {
+			input: map[string]string{
+				"log_raw": "true",
+			},
+			expected: false,
+		},
+		"ent-opt": {
+			input: map[string]string{
+				"filter": "mount_type == kv",
+			},
+			expected: !constants.IsEnterprise,
+		},
+		"ent-opt-filter": {
+			input: map[string]string{
+				"filter": "mount_type == kv",
+			},
+			expected: !constants.IsEnterprise,
+		},
+		"ent-opt-fallback": {
+			input: map[string]string{
+				"fallback": "true",
+			},
+			expected: !constants.IsEnterprise,
+		},
+		"ent-opt-filter-and-fallback": {
+			input: map[string]string{
+				"filter":   "mount_type == kv",
+				"fallback": "true",
+			},
+			expected: !constants.IsEnterprise,
+		},
+		"ent-opt-exclude": {
+			input: map[string]string{
+				"exclude": `{
+					"condition": "\"/request/mount_type\" == transit",
+					"fields": [ "/request/data", "/response/data" ]
+				}`,
+			},
+			expected: !constants.IsEnterprise,
+		},
+	}
+
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, tc.expected, HasInvalidOptions(tc.input))
+		})
+	}
+}
diff --git a/audit/broker.go b/audit/broker.go
new file mode 100644
index 00000000000..d76b06a9a19
--- /dev/null
+++ b/audit/broker.go
@@ -0,0 +1,447 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/armon/go-metrics"
+	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/go-hclog"
+	nshelper "github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/internal/observability/event"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+const (
+	// timeout is the duration which should be used for context related timeouts.
+	timeout = 10 * time.Second
+)
+
+var (
+	_ Registrar = (*Broker)(nil)
+	_ Auditor   = (*Broker)(nil)
+)
+
+// Registrar interface describes a means to register and deregister audit devices.
+type Registrar interface {
+	Register(backend Backend, local bool) error
+	Deregister(ctx context.Context, name string) error
+	IsRegistered(name string) bool
+	IsLocal(name string) (bool, error)
+}
+
+// Auditor interface describes methods which can be used to perform auditing.
+type Auditor interface {
+	LogRequest(ctx context.Context, input *logical.LogInput) error
+	LogResponse(ctx context.Context, input *logical.LogInput) error
+	GetHash(ctx context.Context, name string, input string) (string, error)
+	Invalidate(ctx context.Context, key string)
+}
+
+// backendEntry composes a backend with additional settings.
+type backendEntry struct {
+	// backend is the underlying audit backend.
+	backend Backend
+
+	// local indicates whether this audit backend should be local to the Vault cluster.
+	local bool
+}
+
+// Broker represents an audit broker which performs actions such as registering/de-registering
+// backends and logging audit entries for a request or response.
+// NOTE: NewBroker should be used to initialize the Broker struct.
+type Broker struct {
+	*brokerEnt
+
+	sync.RWMutex
+
+	logger hclog.Logger
+
+	// backends is the map of audit device name to {thing}
+	backends map[string]backendEntry
+
+	// broker is used to register pipelines for audit devices.
+	broker *eventlogger.Broker
+}
+
+// NewBroker initializes a broker, which can be used to perform audit logging.
+func NewBroker(logger hclog.Logger) (*Broker, error) {
+	if logger == nil || reflect.ValueOf(logger).IsNil() {
+		return nil, fmt.Errorf("cannot create a new audit broker with nil logger: %w", ErrInvalidParameter)
+	}
+
+	eventBroker, err := eventlogger.NewBroker()
+	if err != nil {
+		return nil, fmt.Errorf("error creating event broker for audit events: %w", err)
+	}
+
+	ent, err := newBrokerEnt()
+	if err != nil {
+		return nil, fmt.Errorf("error creating audit broker extensions: %w", err)
+	}
+
+	return &Broker{
+		backends:  make(map[string]backendEntry),
+		broker:    eventBroker,
+		brokerEnt: ent,
+		logger:    logger,
+	}, nil
+}
+
+// hasAuditPipelines can be used as a shorthand to check if a broker has any
+// registered pipelines that are for the audit event type.
+func hasAuditPipelines(broker *eventlogger.Broker) bool {
+	return broker.IsAnyPipelineRegistered(event.AuditType.AsEventType())
+}
+
+// isRegistered is used to check if a given audit backend is registered.
+// This method should be used within the broker to prevent locking issues.
+func (b *Broker) isRegistered(backend Backend) error {
+	if b.isRegisteredByName(backend.Name()) {
+		return fmt.Errorf("backend already registered '%s': %w", backend.Name(), ErrExternalOptions)
+	}
+
+	if err := b.validateRegistrationRequest(backend); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// isRegisteredByName returns a boolean to indicate whether an audit backend is
+// registered with the broker.
+func (b *Broker) isRegisteredByName(name string) bool {
+	_, ok := b.backends[name]
+	return ok
+}
+
+// register can be used to register a normal audit device, it will also calculate
+// and configure the success threshold required for sinks.
+// NOTE: register assumes that the backend which is being registered has not yet
+// been added to the broker's backends.
+func (b *Broker) register(backend Backend) error {
+	err := registerNodesAndPipeline(b.broker, backend)
+	if err != nil {
+		return fmt.Errorf("audit pipeline registration error: %w", err)
+	}
+
+	threshold := 0
+	if !backend.HasFiltering() {
+		threshold = 1
+	} else {
+		threshold = b.requiredSuccessThresholdSinks()
+	}
+
+	// Update the success threshold now that the pipeline is registered.
+	err = b.broker.SetSuccessThresholdSinks(event.AuditType.AsEventType(), threshold)
+	if err != nil {
+		return fmt.Errorf("unable to configure sink success threshold (%d): %w", threshold, err)
+	}
+
+	return nil
+}
+
+// deregister can be used to deregister an audit device, it will also configure
+// the success threshold required for sinks.
+// NOTE: deregister assumes that the backend which is being deregistered has already
+// been removed from the broker's backends.
+func (b *Broker) deregister(ctx context.Context, name string) error {
+	threshold := b.requiredSuccessThresholdSinks()
+
+	err := b.broker.SetSuccessThresholdSinks(event.AuditType.AsEventType(), threshold)
+	if err != nil {
+		return fmt.Errorf("unable to reconfigure sink success threshold (%d): %w", threshold, err)
+	}
+
+	// The first return value, a bool, indicates whether
+	// RemovePipelineAndNodes encountered the error while evaluating
+	// pre-conditions (false) or once it started removing the pipeline and
+	// the nodes (true). This code doesn't care either way.
+	_, err = b.broker.RemovePipelineAndNodes(ctx, event.AuditType.AsEventType(), eventlogger.PipelineID(name))
+	if err != nil {
+		return fmt.Errorf("unable to remove pipeline and nodes: %w", err)
+	}
+
+	return nil
+}
+
+// registerNodesAndPipeline registers eventlogger nodes and a pipeline with the
+// backend's name, on the specified eventlogger.Broker using the Backend to supply them.
+func registerNodesAndPipeline(broker *eventlogger.Broker, b Backend) error {
+	for id, node := range b.Nodes() {
+		err := broker.RegisterNode(id, node)
+		if err != nil {
+			return fmt.Errorf("unable to register nodes for %q: %w", b.Name(), err)
+		}
+	}
+
+	pipeline := eventlogger.Pipeline{
+		PipelineID: eventlogger.PipelineID(b.Name()),
+		EventType:  b.EventType(),
+		NodeIDs:    b.NodeIDs(),
+	}
+
+	err := broker.RegisterPipeline(pipeline)
+	if err != nil {
+		return fmt.Errorf("unable to register pipeline for %q: %w", b.Name(), err)
+	}
+
+	return nil
+}
+
+func (b *Broker) Register(backend Backend, local bool) error {
+	b.Lock()
+	defer b.Unlock()
+
+	if backend == nil || reflect.ValueOf(backend).IsNil() {
+		return fmt.Errorf("backend cannot be nil: %w", ErrInvalidParameter)
+	}
+
+	// If the backend is already registered, we cannot re-register it.
+	err := b.isRegistered(backend)
+	if err != nil {
+		return err
+	}
+
+	if err := b.handlePipelineRegistration(backend); err != nil {
+		return err
+	}
+
+	b.backends[backend.Name()] = backendEntry{
+		backend: backend,
+		local:   local,
+	}
+
+	return nil
+}
+
+func (b *Broker) Deregister(ctx context.Context, name string) error {
+	b.Lock()
+	defer b.Unlock()
+
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return fmt.Errorf("name is required: %w", ErrInvalidParameter)
+	}
+
+	// If the backend isn't actually registered, then there's nothing to do.
+	// We don't return any error so that Deregister can be idempotent.
+	if !b.isRegisteredByName(name) {
+		return nil
+	}
+
+	// Remove the Backend from the map first, so that if an error occurs while
+	// removing the pipeline and nodes, we can quickly exit this method with
+	// the error.
+	delete(b.backends, name)
+
+	if err := b.handlePipelineDeregistration(ctx, name); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// LogRequest is used to ensure all the audit backends have an opportunity to
+// log the given request and that *at least one* succeeds.
+func (b *Broker) LogRequest(ctx context.Context, in *logical.LogInput) (retErr error) {
+	b.RLock()
+	defer b.RUnlock()
+
+	// If no backends are registered then we have no devices to log the request.
+	if len(b.backends) < 1 {
+		return nil
+	}
+
+	defer metrics.MeasureSince([]string{"audit", "log_request"}, time.Now())
+	defer func() {
+		metricVal := float32(0.0)
+		if retErr != nil {
+			metricVal = 1.0
+		}
+		metrics.IncrCounter([]string{"audit", "log_request_failure"}, metricVal)
+	}()
+
+	e, err := newEvent(RequestType)
+	if err != nil {
+		return err
+	}
+
+	e.Data = in
+
+	// Get a context to use for auditing.
+	auditContext, auditCancel, err := getAuditContext(ctx)
+	if err != nil {
+		return err
+	}
+	defer auditCancel()
+
+	var status eventlogger.Status
+	if hasAuditPipelines(b.broker) {
+		status, err = b.broker.Send(auditContext, event.AuditType.AsEventType(), e)
+		if err != nil {
+			return errors.Join(append([]error{err}, status.Warnings...)...)
+		}
+	}
+
+	// Audit event ended up in at least 1 sink.
+	if len(status.CompleteSinks()) > 0 {
+		// We should log warnings to the operational logs regardless of whether
+		// we consider the overall auditing attempt to be successful.
+		if len(status.Warnings) > 0 {
+			b.logger.Error("log request underlying pipeline error(s)", "error", errors.Join(status.Warnings...))
+		}
+
+		return nil
+	}
+
+	// There were errors from inside the pipeline and we didn't write to a sink.
+	if len(status.Warnings) > 0 {
+		return fmt.Errorf("error during audit pipeline processing: %w", errors.Join(status.Warnings...))
+	}
+
+	// Handle any additional audit that is required (Enterprise/CE dependant).
+	err = b.handleAdditionalAudit(auditContext, e)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// LogResponse is used to ensure all the audit backends have an opportunity to
+// log the given response and that *at least one* succeeds.
+func (b *Broker) LogResponse(ctx context.Context, in *logical.LogInput) (retErr error) {
+	b.RLock()
+	defer b.RUnlock()
+
+	// If no backends are registered then we have no devices to send audit entries to.
+	if len(b.backends) < 1 {
+		return nil
+	}
+
+	defer metrics.MeasureSince([]string{"audit", "log_response"}, time.Now())
+	defer func() {
+		metricVal := float32(0.0)
+		if retErr != nil {
+			metricVal = 1.0
+		}
+		metrics.IncrCounter([]string{"audit", "log_response_failure"}, metricVal)
+	}()
+
+	e, err := newEvent(ResponseType)
+	if err != nil {
+		return err
+	}
+
+	e.Data = in
+
+	// Get a context to use for auditing.
+	auditContext, auditCancel, err := getAuditContext(ctx)
+	if err != nil {
+		return err
+	}
+	defer auditCancel()
+
+	var status eventlogger.Status
+	if hasAuditPipelines(b.broker) {
+		status, err = b.broker.Send(auditContext, event.AuditType.AsEventType(), e)
+		if err != nil {
+			return errors.Join(append([]error{err}, status.Warnings...)...)
+		}
+	}
+
+	// Audit event ended up in at least 1 sink.
+	if len(status.CompleteSinks()) > 0 {
+		// We should log warnings to the operational logs regardless of whether
+		// we consider the overall auditing attempt to be successful.
+		if len(status.Warnings) > 0 {
+			b.logger.Error("log response underlying pipeline error(s)", "error", errors.Join(status.Warnings...))
+		}
+
+		return nil
+	}
+
+	// There were errors from inside the pipeline and we didn't write to a sink.
+	if len(status.Warnings) > 0 {
+		return fmt.Errorf("error during audit pipeline processing: %w", errors.Join(status.Warnings...))
+	}
+
+	// Handle any additional audit that is required (Enterprise/CE dependant).
+	err = b.handleAdditionalAudit(auditContext, e)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (b *Broker) Invalidate(ctx context.Context, _ string) {
+	// For now, we ignore the key as this would only apply to salts.
+	// We just sort of brute force it on each one.
+	b.Lock()
+	defer b.Unlock()
+
+	for _, be := range b.backends {
+		be.backend.Invalidate(ctx)
+	}
+}
+
+// IsLocal is used to check if a given audit backend is registered
+func (b *Broker) IsLocal(name string) (bool, error) {
+	b.RLock()
+	defer b.RUnlock()
+
+	be, ok := b.backends[name]
+	if ok {
+		return be.local, nil
+	}
+
+	return false, fmt.Errorf("unknown audit backend %q", name)
+}
+
+// GetHash returns a hash using the salt of the given backend
+func (b *Broker) GetHash(ctx context.Context, name string, input string) (string, error) {
+	b.RLock()
+	defer b.RUnlock()
+
+	be, ok := b.backends[name]
+	if !ok {
+		return "", fmt.Errorf("unknown audit backend %q", name)
+	}
+
+	return hashString(ctx, be.backend, input)
+}
+
+// IsRegistered is used to check if a given audit backend is registered.
+func (b *Broker) IsRegistered(name string) bool {
+	b.RLock()
+	defer b.RUnlock()
+
+	return b.isRegisteredByName(name)
+}
+
+// getAuditContext extracts the namespace from the specified context and returns
+// a new context and cancelation function, completely detached from the original
+// with a timeout.
+// NOTE: When error is nil, the context.CancelFunc returned from this function
+// should be deferred immediately by the caller to prevent resource leaks.
+func getAuditContext(ctx context.Context) (context.Context, context.CancelFunc, error) {
+	ns, err := nshelper.FromContext(ctx)
+	if err != nil {
+		return nil, nil, fmt.Errorf("namespace missing from context: %w", err)
+	}
+
+	tempContext := nshelper.ContextWithNamespace(context.Background(), ns)
+	auditContext, auditCancel := context.WithTimeout(tempContext, timeout)
+
+	return auditContext, auditCancel, nil
+}
diff --git a/audit/broker_ce.go b/audit/broker_ce.go
new file mode 100644
index 00000000000..5afc69810e3
--- /dev/null
+++ b/audit/broker_ce.go
@@ -0,0 +1,49 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package audit
+
+import (
+	"context"
+	"fmt"
+)
+
+// brokerEnt provides extensions to the broker behavior, but not in the community edition.
+type brokerEnt struct{}
+
+func newBrokerEnt() (*brokerEnt, error) {
+	return &brokerEnt{}, nil
+}
+
+func (b *Broker) validateRegistrationRequest(_ Backend) error {
+	return nil
+}
+
+func (b *Broker) handlePipelineRegistration(backend Backend) error {
+	err := b.register(backend)
+	if err != nil {
+		return fmt.Errorf("unable to register device for %q: %w", backend.Name(), err)
+	}
+
+	return nil
+}
+
+func (b *Broker) handlePipelineDeregistration(ctx context.Context, name string) error {
+	return b.deregister(ctx, name)
+}
+
+// requiredSuccessThresholdSinks is the value that should be used as the success
+// threshold in the eventlogger broker.
+func (b *Broker) requiredSuccessThresholdSinks() int {
+	if len(b.backends) > 0 {
+		return 1
+	}
+
+	return 0
+}
+
+func (b *brokerEnt) handleAdditionalAudit(_ context.Context, _ *Event) error {
+	return nil
+}
diff --git a/audit/broker_test.go b/audit/broker_test.go
new file mode 100644
index 00000000000..1e558a97df9
--- /dev/null
+++ b/audit/broker_test.go
@@ -0,0 +1,209 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"context"
+	"crypto/sha256"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/go-hclog"
+	nshelper "github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
+	"github.com/hashicorp/vault/sdk/helper/salt"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+)
+
+// testAuditBackend will create an audit.Backend (which expects to use the eventlogger).
+// NOTE: this will create the backend, it does not care whether Enterprise only options are in place.
+func testAuditBackend(t *testing.T, path string, config map[string]string) Backend {
+	t.Helper()
+
+	headersCfg := &HeadersConfig{
+		headerSettings: make(map[string]*headerSettings),
+		view:           nil,
+	}
+
+	view := &logical.InmemStorage{}
+	se := &logical.StorageEntry{Key: "salt", Value: []byte("juan")}
+	err := view.Put(context.Background(), se)
+	require.NoError(t, err)
+
+	cfg := &BackendConfig{
+		SaltView: view,
+		SaltConfig: &salt.Config{
+			HMAC:     sha256.New,
+			HMACType: "hmac-sha256",
+		},
+		Logger:    corehelpers.NewTestLogger(t),
+		Config:    config,
+		MountPath: path,
+	}
+
+	be, err := NewSyslogBackend(cfg, headersCfg)
+	require.NoError(t, err)
+	require.NotNil(t, be)
+
+	return be
+}
+
+// TestAuditBroker_Deregister_Multiple ensures that we can call deregister multiple
+// times without issue if is no matching backend registered.
+func TestAuditBroker_Deregister_Multiple(t *testing.T) {
+	t.Parallel()
+
+	l := corehelpers.NewTestLogger(t)
+	a, err := NewBroker(l)
+	require.NoError(t, err)
+	require.NotNil(t, a)
+
+	err = a.Deregister(context.Background(), "foo")
+	require.NoError(t, err)
+
+	err = a.Deregister(context.Background(), "foo2")
+	require.NoError(t, err)
+}
+
+// TestAuditBroker_Register_MultipleFails checks for failure when we try to
+// re-register an audit backend.
+func TestAuditBroker_Register_MultipleFails(t *testing.T) {
+	t.Parallel()
+
+	l := corehelpers.NewTestLogger(t)
+	a, err := NewBroker(l)
+	require.NoError(t, err)
+	require.NotNil(t, a)
+
+	path := "b2-no-filter"
+	noFilterBackend := testAuditBackend(t, path, map[string]string{})
+
+	err = a.Register(noFilterBackend, false)
+	require.NoError(t, err)
+
+	err = a.Register(noFilterBackend, false)
+	require.Error(t, err)
+	require.EqualError(t, err, "backend already registered 'b2-no-filter': invalid configuration")
+}
+
+// BenchmarkAuditBroker_File_Request_DevNull Attempts to register a single `file`
+// audit device on the broker, which points at /dev/null.
+// It will then attempt to benchmark how long it takes Vault to complete logging
+// a request, this really only shows us how Vault can handle lots of calls to the
+// broker to trigger the eventlogger pipelines that audit devices are configured as.
+// Since we aren't writing anything to file or doing any I/O.
+// This test used to live in the file package for the file backend, but once the
+// move to eventlogger was complete, there wasn't a way to create a file backend
+// and manually just write to the underlying file itself, the old code used to do
+// formatting and writing all together, but we've split this up with eventlogger
+// with different nodes in a pipeline (think 1 audit device:1 pipeline) each
+// handling a responsibility, for example:
+// filter nodes filter events, so you can select which ones make it to your audit log
+// formatter nodes format the events (to JSON/JSONX and perform HMACing etc)
+// sink nodes handle sending the formatted data to a file, syslog or socket.
+func BenchmarkAuditBroker_File_Request_DevNull(b *testing.B) {
+	backendConfig := &BackendConfig{
+		Config: map[string]string{
+			"path": "/dev/null",
+		},
+		MountPath:  "test",
+		SaltConfig: &salt.Config{},
+		SaltView:   &logical.InmemStorage{},
+		Logger:     hclog.NewNullLogger(),
+	}
+
+	sink, err := NewFileBackend(backendConfig, nil)
+	require.NoError(b, err)
+
+	broker, err := NewBroker(nil)
+	require.NoError(b, err)
+
+	err = broker.Register(sink, false)
+	require.NoError(b, err)
+
+	in := &logical.LogInput{
+		Auth: &logical.Auth{
+			ClientToken:     "foo",
+			Accessor:        "bar",
+			EntityID:        "foobarentity",
+			DisplayName:     "testtoken",
+			NoDefaultPolicy: true,
+			Policies:        []string{"root"},
+			TokenType:       logical.TokenTypeService,
+		},
+		Request: &logical.Request{
+			Operation: logical.UpdateOperation,
+			Path:      "/foo",
+			Connection: &logical.Connection{
+				RemoteAddr: "127.0.0.1",
+			},
+			WrapInfo: &logical.RequestWrapInfo{
+				TTL: 60 * time.Second,
+			},
+			Headers: map[string][]string{
+				"foo": {"bar"},
+			},
+		},
+	}
+
+	ctx := nshelper.RootContext(context.Background())
+	b.ResetTimer()
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			if err := broker.LogRequest(ctx, in); err != nil {
+				panic(err)
+			}
+		}
+	})
+}
+
+// TestBroker_getAuditContext_NoNamespace checks that we get the right error when
+// trying to get an audit context with no namespace.
+func TestBroker_getAuditContext_NoNamespace(t *testing.T) {
+	t.Parallel()
+
+	_, _, err := getAuditContext(context.Background())
+	require.Error(t, err)
+	require.EqualError(t, err, "namespace missing from context: no namespace")
+}
+
+// TestBroker_getAuditContext checks that we get a context back which isn't linked
+// to the original context, and contains our namespace.
+func TestBroker_getAuditContext(t *testing.T) {
+	t.Parallel()
+
+	// context with namespace
+	ns := &nshelper.Namespace{
+		ID:   "foo",
+		Path: "foo/",
+	}
+
+	// Create a context with a namespace.
+	originalContext, originalCancel := context.WithCancel(context.Background())
+	t.Cleanup(originalCancel)
+	nsContext := nshelper.ContextWithNamespace(originalContext, ns)
+
+	// Get the audit context
+	auditContext, auditCancel, err := getAuditContext(nsContext)
+	t.Cleanup(auditCancel)
+
+	require.NoError(t, err)
+	require.NotNil(t, auditContext)
+	require.NotNil(t, auditCancel)
+
+	// Ensure the namespace is there too.
+	val, err := nshelper.FromContext(auditContext)
+	require.NoError(t, err)
+	require.Equal(t, ns, val)
+
+	// Now cancel the original context and ensure it is done but audit context isn't.
+	originalCancel()
+	require.NotNil(t, originalContext.Err())
+	require.Nil(t, auditContext.Err())
+
+	// Now cancel the audit context and ensure that it is done.
+	auditCancel()
+	require.NotNil(t, auditContext.Err())
+}
diff --git a/audit/entry_filter.go b/audit/entry_filter.go
index 4b726153563..8ee78154c8b 100644
--- a/audit/entry_filter.go
+++ b/audit/entry_filter.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -10,33 +10,30 @@ import (
 
 	"github.com/hashicorp/eventlogger"
 	"github.com/hashicorp/go-bexpr"
-	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/internal/observability/event"
+	nshelper "github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
-var _ eventlogger.Node = (*EntryFilter)(nil)
+var _ eventlogger.Node = (*entryFilter)(nil)
 
-// EntryFilter should be used to filter audit requests and responses which should
+// entryFilter should be used to filter audit requests and responses which should
 // make it to a sink.
-type EntryFilter struct {
+type entryFilter struct {
 	// the evaluator for the bexpr expression that should be applied by the node.
 	evaluator *bexpr.Evaluator
 }
 
-// NewEntryFilter should be used to create an EntryFilter node.
+// newEntryFilter should be used to create an entryFilter node.
 // The filter supplied should be in bexpr format and reference fields from logical.LogInputBexpr.
-func NewEntryFilter(filter string) (*EntryFilter, error) {
-	const op = "audit.NewEntryFilter"
-
+func newEntryFilter(filter string) (*entryFilter, error) {
 	filter = strings.TrimSpace(filter)
 	if filter == "" {
-		return nil, fmt.Errorf("%s: cannot create new audit filter with empty filter expression: %w", op, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("cannot create new audit filter with empty filter expression: %w", ErrExternalOptions)
 	}
 
 	eval, err := bexpr.CreateEvaluator(filter)
 	if err != nil {
-		return nil, fmt.Errorf("%s: cannot create new audit filter: %w", op, err)
+		return nil, fmt.Errorf("cannot create new audit filter: %w: %w", ErrExternalOptions, err)
 	}
 
 	// Validate the filter by attempting to evaluate it with an empty input.
@@ -45,27 +42,25 @@ func NewEntryFilter(filter string) (*EntryFilter, error) {
 	li := logical.LogInputBexpr{}
 	_, err = eval.Evaluate(li)
 	if err != nil {
-		return nil, fmt.Errorf("%s: filter references an unsupported field: %s", op, filter)
+		return nil, fmt.Errorf("filter references an unsupported field: %s: %w", filter, ErrExternalOptions)
 	}
 
-	return &EntryFilter{evaluator: eval}, nil
+	return &entryFilter{evaluator: eval}, nil
 }
 
 // Reopen is a no-op for the filter node.
-func (*EntryFilter) Reopen() error {
+func (*entryFilter) Reopen() error {
 	return nil
 }
 
 // Type describes the type of this node (filter).
-func (*EntryFilter) Type() eventlogger.NodeType {
+func (*entryFilter) Type() eventlogger.NodeType {
 	return eventlogger.NodeTypeFilter
 }
 
 // Process will attempt to parse the incoming event data and decide whether it
 // should be filtered or remain in the pipeline and passed to the next node.
-func (f *EntryFilter) Process(ctx context.Context, e *eventlogger.Event) (*eventlogger.Event, error) {
-	const op = "audit.(EntryFilter).Process"
-
+func (f *entryFilter) Process(ctx context.Context, e *eventlogger.Event) (*eventlogger.Event, error) {
 	select {
 	case <-ctx.Done():
 		return nil, ctx.Err()
@@ -73,12 +68,12 @@ func (f *EntryFilter) Process(ctx context.Context, e *eventlogger.Event) (*event
 	}
 
 	if e == nil {
-		return nil, fmt.Errorf("%s: event is nil: %w", op, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("event is nil: %w", ErrInvalidParameter)
 	}
 
-	a, ok := e.Payload.(*AuditEvent)
+	a, ok := e.Payload.(*Event)
 	if !ok {
-		return nil, fmt.Errorf("%s: cannot parse event payload: %w", op, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("cannot parse event payload: %w", ErrInvalidParameter)
 	}
 
 	// If we don't have data to process, then we're done.
@@ -86,16 +81,16 @@ func (f *EntryFilter) Process(ctx context.Context, e *eventlogger.Event) (*event
 		return nil, nil
 	}
 
-	ns, err := namespace.FromContext(ctx)
+	ns, err := nshelper.FromContext(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("%s: cannot obtain namespace: %w", op, err)
+		return nil, fmt.Errorf("cannot obtain namespace: %w", err)
 	}
 
 	datum := a.Data.BexprDatum(ns.Path)
 
 	result, err := f.evaluator.Evaluate(datum)
 	if err != nil {
-		return nil, fmt.Errorf("%s: unable to evaluate filter: %w", op, err)
+		return nil, fmt.Errorf("unable to evaluate filter: %w", err)
 	}
 
 	if result {
diff --git a/audit/entry_filter_test.go b/audit/entry_filter_test.go
index 569e37ee7c3..8ff7a765333 100644
--- a/audit/entry_filter_test.go
+++ b/audit/entry_filter_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -9,13 +9,13 @@ import (
 	"time"
 
 	"github.com/hashicorp/eventlogger"
-	"github.com/hashicorp/vault/helper/namespace"
+	nshelper "github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/internal/observability/event"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/stretchr/testify/require"
 )
 
-// TestEntryFilter_NewEntryFilter tests that we can create EntryFilter types correctly.
+// TestEntryFilter_NewEntryFilter tests that we can create entryFilter types correctly.
 func TestEntryFilter_NewEntryFilter(t *testing.T) {
 	t.Parallel()
 
@@ -27,22 +27,22 @@ func TestEntryFilter_NewEntryFilter(t *testing.T) {
 		"empty-filter": {
 			Filter:               "",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEntryFilter: cannot create new audit filter with empty filter expression: invalid parameter",
+			ExpectedErrorMessage: "cannot create new audit filter with empty filter expression: invalid configuration",
 		},
 		"spacey-filter": {
 			Filter:               "    ",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEntryFilter: cannot create new audit filter with empty filter expression: invalid parameter",
+			ExpectedErrorMessage: "cannot create new audit filter with empty filter expression: invalid configuration",
 		},
 		"bad-filter": {
 			Filter:               "____",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEntryFilter: cannot create new audit filter",
+			ExpectedErrorMessage: "cannot create new audit filter",
 		},
 		"unsupported-field-filter": {
 			Filter:               "foo == bar",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEntryFilter: filter references an unsupported field: foo == bar",
+			ExpectedErrorMessage: "filter references an unsupported field: foo == bar",
 		},
 		"good-filter-operation": {
 			Filter:          "operation == create",
@@ -72,7 +72,7 @@ func TestEntryFilter_NewEntryFilter(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			f, err := NewEntryFilter(tc.Filter)
+			f, err := newEntryFilter(tc.Filter)
 			switch {
 			case tc.IsErrorExpected:
 				require.Error(t, err)
@@ -90,7 +90,7 @@ func TestEntryFilter_NewEntryFilter(t *testing.T) {
 func TestEntryFilter_Reopen(t *testing.T) {
 	t.Parallel()
 
-	f := &EntryFilter{}
+	f := &entryFilter{}
 	res := f.Reopen()
 	require.Nil(t, res)
 }
@@ -99,7 +99,7 @@ func TestEntryFilter_Reopen(t *testing.T) {
 func TestEntryFilter_Type(t *testing.T) {
 	t.Parallel()
 
-	f := &EntryFilter{}
+	f := &entryFilter{}
 	require.Equal(t, eventlogger.NodeTypeFilter, f.Type())
 }
 
@@ -113,16 +113,16 @@ func TestEntryFilter_Process_ContextDone(t *testing.T) {
 	// Explicitly cancel the context
 	cancel()
 
-	l, err := NewEntryFilter("operation == foo")
+	l, err := newEntryFilter("operation == foo")
 	require.NoError(t, err)
 
 	// Fake audit event
-	a, err := NewEvent(RequestType)
+	a, err := newEvent(RequestType)
 	require.NoError(t, err)
 
 	// Fake event logger event
 	e := &eventlogger.Event{
-		Type:      eventlogger.EventType(event.AuditType.String()),
+		Type:      event.AuditType.AsEventType(),
 		CreatedAt: time.Now(),
 		Formatted: make(map[string][]byte),
 		Payload:   a,
@@ -142,11 +142,11 @@ func TestEntryFilter_Process_ContextDone(t *testing.T) {
 func TestEntryFilter_Process_NilEvent(t *testing.T) {
 	t.Parallel()
 
-	l, err := NewEntryFilter("operation == foo")
+	l, err := newEntryFilter("operation == foo")
 	require.NoError(t, err)
 	e, err := l.Process(context.Background(), nil)
 	require.Error(t, err)
-	require.EqualError(t, err, "audit.(EntryFilter).Process: event is nil: invalid parameter")
+	require.EqualError(t, err, "event is nil: invalid internal parameter")
 
 	// Ensure that the pipeline won't continue.
 	require.Nil(t, e)
@@ -158,11 +158,11 @@ func TestEntryFilter_Process_NilEvent(t *testing.T) {
 func TestEntryFilter_Process_BadPayload(t *testing.T) {
 	t.Parallel()
 
-	l, err := NewEntryFilter("operation == foo")
+	l, err := newEntryFilter("operation == foo")
 	require.NoError(t, err)
 
 	e := &eventlogger.Event{
-		Type:      eventlogger.EventType(event.AuditType.String()),
+		Type:      event.AuditType.AsEventType(),
 		CreatedAt: time.Now(),
 		Formatted: make(map[string][]byte),
 		Payload:   nil,
@@ -170,7 +170,7 @@ func TestEntryFilter_Process_BadPayload(t *testing.T) {
 
 	e2, err := l.Process(context.Background(), e)
 	require.Error(t, err)
-	require.EqualError(t, err, "audit.(EntryFilter).Process: cannot parse event payload: invalid parameter")
+	require.EqualError(t, err, "cannot parse event payload: invalid internal parameter")
 
 	// Ensure that the pipeline won't continue.
 	require.Nil(t, e2)
@@ -181,17 +181,17 @@ func TestEntryFilter_Process_BadPayload(t *testing.T) {
 func TestEntryFilter_Process_NoAuditDataInPayload(t *testing.T) {
 	t.Parallel()
 
-	l, err := NewEntryFilter("operation == foo")
+	l, err := newEntryFilter("operation == foo")
 	require.NoError(t, err)
 
-	a, err := NewEvent(RequestType)
+	a, err := newEvent(RequestType)
 	require.NoError(t, err)
 
 	// Ensure audit data is nil
 	a.Data = nil
 
 	e := &eventlogger.Event{
-		Type:      eventlogger.EventType(event.AuditType.String()),
+		Type:      event.AuditType.AsEventType(),
 		CreatedAt: time.Now(),
 		Formatted: make(map[string][]byte),
 		Payload:   a,
@@ -209,10 +209,10 @@ func TestEntryFilter_Process_NoAuditDataInPayload(t *testing.T) {
 func TestEntryFilter_Process_FilterSuccess(t *testing.T) {
 	t.Parallel()
 
-	l, err := NewEntryFilter("mount_type == juan")
+	l, err := newEntryFilter("mount_type == juan")
 	require.NoError(t, err)
 
-	a, err := NewEvent(RequestType)
+	a, err := newEvent(RequestType)
 	require.NoError(t, err)
 
 	a.Data = &logical.LogInput{
@@ -223,13 +223,13 @@ func TestEntryFilter_Process_FilterSuccess(t *testing.T) {
 	}
 
 	e := &eventlogger.Event{
-		Type:      eventlogger.EventType(event.AuditType.String()),
+		Type:      event.AuditType.AsEventType(),
 		CreatedAt: time.Now(),
 		Formatted: make(map[string][]byte),
 		Payload:   a,
 	}
 
-	ctx := namespace.ContextWithNamespace(context.Background(), namespace.RootNamespace)
+	ctx := nshelper.ContextWithNamespace(context.Background(), nshelper.RootNamespace)
 
 	e2, err := l.Process(ctx, e)
 
@@ -242,10 +242,10 @@ func TestEntryFilter_Process_FilterSuccess(t *testing.T) {
 func TestEntryFilter_Process_FilterFail(t *testing.T) {
 	t.Parallel()
 
-	l, err := NewEntryFilter("mount_type == john and operation == create and namespace == root")
+	l, err := newEntryFilter("mount_type == john and operation == create and namespace == root")
 	require.NoError(t, err)
 
-	a, err := NewEvent(RequestType)
+	a, err := newEvent(RequestType)
 	require.NoError(t, err)
 
 	a.Data = &logical.LogInput{
@@ -256,13 +256,13 @@ func TestEntryFilter_Process_FilterFail(t *testing.T) {
 	}
 
 	e := &eventlogger.Event{
-		Type:      eventlogger.EventType(event.AuditType.String()),
+		Type:      event.AuditType.AsEventType(),
 		CreatedAt: time.Now(),
 		Formatted: make(map[string][]byte),
 		Payload:   a,
 	}
 
-	ctx := namespace.ContextWithNamespace(context.Background(), namespace.RootNamespace)
+	ctx := nshelper.ContextWithNamespace(context.Background(), nshelper.RootNamespace)
 
 	e2, err := l.Process(ctx, e)
 
diff --git a/audit/entry_formatter.go b/audit/entry_formatter.go
index 96ec7762baf..9771452154d 100644
--- a/audit/entry_formatter.go
+++ b/audit/entry_formatter.go
@@ -1,11 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
 
 import (
 	"context"
-	"crypto/tls"
 	"errors"
 	"fmt"
 	"reflect"
@@ -16,100 +15,91 @@ import (
 	"github.com/go-jose/go-jose/v3/jwt"
 	"github.com/hashicorp/eventlogger"
 	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/go-multierror"
-	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/internal/observability/event"
+	nshelper "github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/salt"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/jefferai/jsonx"
+	"github.com/mitchellh/copystructure"
 )
 
-var (
-	_ Formatter        = (*EntryFormatter)(nil)
-	_ eventlogger.Node = (*EntryFormatter)(nil)
-)
+var _ eventlogger.Node = (*entryFormatter)(nil)
 
-// EntryFormatter should be used to format audit requests and responses.
-type EntryFormatter struct {
-	config          FormatterConfig
-	salter          Salter
-	logger          hclog.Logger
-	headerFormatter HeaderFormatter
-	name            string
-	prefix          string
+// timeProvider offers a way to supply a pre-configured time.
+type timeProvider interface {
+	// formatTime provides the pre-configured time in a particular format.
+	formattedTime() string
 }
 
-// NewEntryFormatter should be used to create an EntryFormatter.
-// Accepted options: WithHeaderFormatter, WithPrefix.
-func NewEntryFormatter(name string, config FormatterConfig, salter Salter, logger hclog.Logger, opt ...Option) (*EntryFormatter, error) {
-	const op = "audit.NewEntryFormatter"
+// nonPersistentSalt is used for obtaining a salt that is not persisted.
+type nonPersistentSalt struct{}
+
+// entryFormatter should be used to format audit requests and responses.
+// NOTE: Use newEntryFormatter to initialize the entryFormatter struct.
+type entryFormatter struct {
+	config formatterConfig
+	salter Salter
+	logger hclog.Logger
+	name   string
+}
 
+// newEntryFormatter should be used to create an entryFormatter.
+func newEntryFormatter(name string, config formatterConfig, salter Salter, logger hclog.Logger) (*entryFormatter, error) {
 	name = strings.TrimSpace(name)
 	if name == "" {
-		return nil, fmt.Errorf("%s: name is required: %w", op, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("name is required: %w", ErrInvalidParameter)
 	}
 
 	if salter == nil {
-		return nil, fmt.Errorf("%s: cannot create a new audit formatter with nil salter: %w", op, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("cannot create a new audit formatter with nil salter: %w", ErrInvalidParameter)
 	}
 
 	if logger == nil || reflect.ValueOf(logger).IsNil() {
-		return nil, fmt.Errorf("%s: cannot create a new audit formatter with nil logger: %w", op, event.ErrInvalidParameter)
-	}
-
-	// We need to ensure that the format isn't just some default empty string.
-	if err := config.RequiredFormat.validate(); err != nil {
-		return nil, fmt.Errorf("%s: format not valid: %w", op, err)
-	}
-
-	opts, err := getOpts(opt...)
-	if err != nil {
-		return nil, fmt.Errorf("%s: error applying options: %w", op, err)
+		return nil, fmt.Errorf("cannot create a new audit formatter with nil logger: %w", ErrInvalidParameter)
 	}
 
-	return &EntryFormatter{
-		config:          config,
-		salter:          salter,
-		logger:          logger,
-		headerFormatter: opts.withHeaderFormatter,
-		name:            name,
-		prefix:          opts.withPrefix,
+	return &entryFormatter{
+		config: config,
+		salter: salter,
+		logger: logger,
+		name:   name,
 	}, nil
 }
 
 // Reopen is a no-op for the formatter node.
-func (*EntryFormatter) Reopen() error {
+func (*entryFormatter) Reopen() error {
 	return nil
 }
 
 // Type describes the type of this node (formatter).
-func (*EntryFormatter) Type() eventlogger.NodeType {
+func (*entryFormatter) Type() eventlogger.NodeType {
 	return eventlogger.NodeTypeFormatter
 }
 
 // Process will attempt to parse the incoming event data into a corresponding
-// audit Request/Response which is serialized to JSON/JSONx and stored within the event.
-func (f *EntryFormatter) Process(ctx context.Context, e *eventlogger.Event) (_ *eventlogger.Event, retErr error) {
-	const op = "audit.(EntryFormatter).Process"
-
+// audit request/response which is serialized to JSON/JSONx and stored within the event.
+func (f *entryFormatter) Process(ctx context.Context, e *eventlogger.Event) (_ *eventlogger.Event, retErr error) {
+	// Return early if the context was cancelled, eventlogger will not carry on
+	// asking nodes to process, so any sink node in the pipeline won't be called.
 	select {
 	case <-ctx.Done():
 		return nil, ctx.Err()
 	default:
 	}
 
+	// Perform validation on the event, then retrieve the underlying AuditEvent
+	// and LogInput (from the AuditEvent Data).
 	if e == nil {
-		return nil, fmt.Errorf("%s: event is nil: %w", op, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("event is nil: %w", ErrInvalidParameter)
 	}
 
-	a, ok := e.Payload.(*AuditEvent)
+	a, ok := e.Payload.(*Event)
 	if !ok {
-		return nil, fmt.Errorf("%s: cannot parse event payload: %w", op, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("cannot parse event payload: %w", ErrInvalidParameter)
 	}
 
 	if a.Data == nil {
-		return nil, fmt.Errorf("%s: cannot audit event (%s) with no data: %w", op, a.Subtype, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("cannot audit a '%s' event with no data: %w", a.Subtype, ErrInvalidParameter)
 	}
 
 	// Handle panics
@@ -119,78 +109,53 @@ func (f *EntryFormatter) Process(ctx context.Context, e *eventlogger.Event) (_ *
 			return
 		}
 
+		path := "unknown"
+		if a.Data.Request != nil {
+			path = a.Data.Request.Path
+		}
+
 		f.logger.Error("panic during logging",
-			"request_path", a.Data.Request.Path,
+			"request_path", path,
 			"audit_device_path", f.name,
 			"error", r,
 			"stacktrace", string(debug.Stack()))
 
 		// Ensure that we add this error onto any pre-existing error that was being returned.
-		retErr = multierror.Append(retErr, fmt.Errorf("%s: panic generating audit log: %q", op, f.name)).ErrorOrNil()
+		retErr = errors.Join(retErr, fmt.Errorf("panic generating audit log: %q", f.name))
 	}()
 
-	// Take a copy of the event data before we modify anything.
-	data, err := a.Data.Clone()
+	// Using 'any' to make exclusion easier, the JSON encoder doesn't care about types.
+	var entry any
+	var err error
+	entry, err = f.createEntry(ctx, a)
 	if err != nil {
-		return nil, fmt.Errorf("%s: unable to copy audit event data: %w", op, err)
-	}
-
-	var headers map[string][]string
-	if data.Request != nil && data.Request.Headers != nil {
-		headers = data.Request.Headers
+		return nil, err
 	}
 
-	if f.headerFormatter != nil {
-		adjustedHeaders, err := f.headerFormatter.ApplyConfig(ctx, headers, f.salter)
+	// If this pipeline has been configured with (Enterprise-only) exclusions then
+	// attempt to exclude the fields from the audit entry.
+	if f.shouldExclude() {
+		m, err := f.excludeFields(entry)
 		if err != nil {
-			return nil, fmt.Errorf("%s: unable to transform headers for auditing: %w", op, err)
+			return nil, fmt.Errorf("unable to exclude %s audit data from %q: %w", a.Subtype, f.name, err)
 		}
 
-		data.Request.Headers = adjustedHeaders
+		entry = m
 	}
 
-	// If the request contains a Server-Side Consistency Token (SSCT), and we
-	// have an auth response, overwrite the existing client token with the SSCT,
-	// so that the SSCT appears in the audit log for this entry.
-	if data.Request != nil && data.Request.InboundSSCToken != "" && data.Auth != nil {
-		data.Auth.ClientToken = data.Request.InboundSSCToken
-	}
-
-	var result []byte
-
-	switch a.Subtype {
-	case RequestType:
-		entry, err := f.FormatRequest(ctx, data)
-		if err != nil {
-			return nil, fmt.Errorf("%s: unable to parse request from audit event: %w", op, err)
-		}
-
-		result, err = jsonutil.EncodeJSON(entry)
-		if err != nil {
-			return nil, fmt.Errorf("%s: unable to format request: %w", op, err)
-		}
-	case ResponseType:
-		entry, err := f.FormatResponse(ctx, data)
-		if err != nil {
-			return nil, fmt.Errorf("%s: unable to parse response from audit event: %w", op, err)
-		}
-
-		result, err = jsonutil.EncodeJSON(entry)
-		if err != nil {
-			return nil, fmt.Errorf("%s: unable to format response: %w", op, err)
-		}
-	default:
-		return nil, fmt.Errorf("%s: unknown audit event subtype: %q", op, a.Subtype)
+	result, err := jsonutil.EncodeJSON(entry)
+	if err != nil {
+		return nil, fmt.Errorf("unable to format %s: %w", a.Subtype, err)
 	}
 
-	if f.config.RequiredFormat == JSONxFormat {
+	if f.config.requiredFormat == jsonxFormat {
 		var err error
 		result, err = jsonx.EncodeJSONBytes(result)
 		if err != nil {
-			return nil, fmt.Errorf("%s: unable to encode JSONx using JSON data: %w", op, err)
+			return nil, fmt.Errorf("unable to encode JSONx using JSON data: %w", err)
 		}
 		if result == nil {
-			return nil, fmt.Errorf("%s: encoded JSONx was nil: %w", op, err)
+			return nil, fmt.Errorf("encoded JSONx was nil: %w", err)
 		}
 	}
 
@@ -198,143 +163,137 @@ func (f *EntryFormatter) Process(ctx context.Context, e *eventlogger.Event) (_ *
 	// don't support a prefix just sitting there.
 	// However, this would be a breaking change to how Vault currently works to
 	// include the prefix as part of the JSON object or XML document.
-	if f.prefix != "" {
-		result = append([]byte(f.prefix), result...)
-	}
-
-	// Copy some properties from the event (and audit event) and store the
-	// format for the next (sink) node to Process.
-	a2 := &AuditEvent{
-		ID:        a.ID,
-		Version:   a.Version,
-		Subtype:   a.Subtype,
-		Timestamp: a.Timestamp,
-		Data:      data, // Use the cloned data here rather than a pointer to the original.
+	if f.config.prefix != "" {
+		result = append([]byte(f.config.prefix), result...)
 	}
 
+	// Create a new event, so we can store our formatted data without conflict.
 	e2 := &eventlogger.Event{
 		Type:      e.Type,
 		CreatedAt: e.CreatedAt,
 		Formatted: make(map[string][]byte), // we are about to set this ourselves.
-		Payload:   a2,
+		Payload:   a,
 	}
 
-	e2.FormattedAs(f.config.RequiredFormat.String(), result)
+	e2.FormattedAs(f.config.requiredFormat.String(), result)
 
 	return e2, nil
 }
 
-// FormatRequest attempts to format the specified logical.LogInput into a RequestEntry.
-func (f *EntryFormatter) FormatRequest(ctx context.Context, in *logical.LogInput) (*RequestEntry, error) {
-	switch {
-	case in == nil || in.Request == nil:
-		return nil, errors.New("request to request-audit a nil request")
-	case f.salter == nil:
-		return nil, errors.New("salt func not configured")
+// remoteAddr safely gets the remote address avoiding a nil pointer.
+func remoteAddr(req *logical.Request) string {
+	if req != nil && req.Connection != nil {
+		return req.Connection.RemoteAddr
 	}
+	return ""
+}
 
-	// Set these to the input values at first
-	auth := in.Auth
-	req := in.Request
-	var connState *tls.ConnectionState
-	if auth == nil {
-		auth = new(logical.Auth)
+// remotePort safely gets the remote port avoiding a nil pointer.
+func remotePort(req *logical.Request) int {
+	if req != nil && req.Connection != nil {
+		return req.Connection.RemotePort
 	}
+	return 0
+}
 
-	if in.Request.Connection != nil && in.Request.Connection.ConnState != nil {
-		connState = in.Request.Connection.ConnState
+// clientCertSerialNumber attempts the retrieve the serial number of the peer
+// certificate from the specified tls.ConnectionState.
+func clientCertSerialNumber(req *logical.Request) string {
+	if req == nil || req.Connection == nil {
+		return ""
 	}
 
-	if !f.config.Raw {
-		var err error
-		auth, err = HashAuth(ctx, f.salter, auth, f.config.HMACAccessor)
-		if err != nil {
-			return nil, err
-		}
+	connState := req.Connection.ConnState
 
-		req, err = HashRequest(ctx, f.salter, req, f.config.HMACAccessor, in.NonHMACReqDataKeys)
-		if err != nil {
-			return nil, err
-		}
+	if connState == nil || len(connState.VerifiedChains) == 0 || len(connState.VerifiedChains[0]) == 0 {
+		return ""
 	}
 
-	var errString string
-	if in.OuterErr != nil {
-		errString = in.OuterErr.Error()
+	return connState.VerifiedChains[0][0].SerialNumber.String()
+}
+
+// parseVaultTokenFromJWT returns a string iff the token was a JWT, and we could
+// extract the original token ID from inside
+func parseVaultTokenFromJWT(token string) *string {
+	if strings.Count(token, ".") != 2 {
+		return nil
 	}
 
-	ns, err := namespace.FromContext(ctx)
+	parsedJWT, err := jwt.ParseSigned(token)
 	if err != nil {
-		return nil, err
+		return nil
 	}
 
-	reqType := in.Type
-	if reqType == "" {
-		reqType = "request"
-	}
-	reqEntry := &RequestEntry{
-		Type:          reqType,
-		Error:         errString,
-		ForwardedFrom: req.ForwardedFrom,
-		Auth: &Auth{
-			ClientToken:               auth.ClientToken,
-			Accessor:                  auth.Accessor,
-			DisplayName:               auth.DisplayName,
-			Policies:                  auth.Policies,
-			TokenPolicies:             auth.TokenPolicies,
-			IdentityPolicies:          auth.IdentityPolicies,
-			ExternalNamespacePolicies: auth.ExternalNamespacePolicies,
-			NoDefaultPolicy:           auth.NoDefaultPolicy,
-			Metadata:                  auth.Metadata,
-			EntityID:                  auth.EntityID,
-			RemainingUses:             req.ClientTokenRemainingUses,
-			TokenType:                 auth.TokenType.String(),
-			TokenTTL:                  int64(auth.TTL.Seconds()),
-		},
+	var claims jwt.Claims
+	if err = parsedJWT.UnsafeClaimsWithoutVerification(&claims); err != nil {
+		return nil
+	}
 
-		Request: &Request{
-			ID:                    req.ID,
-			ClientID:              req.ClientID,
-			ClientToken:           req.ClientToken,
-			ClientTokenAccessor:   req.ClientTokenAccessor,
-			Operation:             req.Operation,
-			MountPoint:            req.MountPoint,
-			MountType:             req.MountType,
-			MountAccessor:         req.MountAccessor,
-			MountRunningVersion:   req.MountRunningVersion(),
-			MountRunningSha256:    req.MountRunningSha256(),
-			MountIsExternalPlugin: req.MountIsExternalPlugin(),
-			MountClass:            req.MountClass(),
-			Namespace: &Namespace{
-				ID:   ns.ID,
-				Path: ns.Path,
-			},
-			Path:                          req.Path,
-			Data:                          req.Data,
-			PolicyOverride:                req.PolicyOverride,
-			RemoteAddr:                    getRemoteAddr(req),
-			RemotePort:                    getRemotePort(req),
-			ReplicationCluster:            req.ReplicationCluster,
-			Headers:                       req.Headers,
-			ClientCertificateSerialNumber: getClientCertificateSerialNumber(connState),
-		},
+	return &claims.ID
+}
+
+// newTemporaryEntryFormatter creates a cloned entryFormatter instance with a non-persistent Salter.
+func newTemporaryEntryFormatter(n *entryFormatter) *entryFormatter {
+	return &entryFormatter{
+		salter: &nonPersistentSalt{},
+		config: n.config,
 	}
+}
 
-	if req.HTTPRequest != nil && req.HTTPRequest.RequestURI != req.Path {
-		reqEntry.Request.RequestURI = req.HTTPRequest.RequestURI
+// Salt returns a new salt with default configuration and no storage usage, and no error.
+func (s *nonPersistentSalt) Salt(_ context.Context) (*salt.Salt, error) {
+	return salt.NewNonpersistentSalt(), nil
+}
+
+// clone can be used to deep clone the specified type.
+func clone[V any](s V) (V, error) {
+	s2, err := copystructure.Copy(s)
+
+	return s2.(V), err
+}
+
+// newAuth takes a logical.Auth and the number of remaining client token uses
+// (which should be supplied from the logical.Request's client token), and creates
+// an audit auth.
+// tokenRemainingUses should be the client token remaining uses to include in auth.
+// This usually can be found in logical.Request.ClientTokenRemainingUses.
+// NOTE: supplying a nil value for auth will result in a nil return value and
+// (nil) error. The caller should check the return value before attempting to use it.
+// ignore-nil-nil-function-check.
+func newAuth(input *logical.Auth, tokenRemainingUses int) (*auth, error) {
+	if input == nil {
+		return nil, nil
 	}
 
-	if !auth.IssueTime.IsZero() {
-		reqEntry.Auth.TokenIssueTime = auth.IssueTime.Format(time.RFC3339)
+	extNSPolicies, err := clone(input.ExternalNamespacePolicies)
+	if err != nil {
+		return nil, fmt.Errorf("unable to clone logical auth: external namespace policies: %w", err)
 	}
 
-	if auth.PolicyResults != nil {
-		reqEntry.Auth.PolicyResults = &PolicyResults{
-			Allowed: auth.PolicyResults.Allowed,
+	identityPolicies, err := clone(input.IdentityPolicies)
+	if err != nil {
+		return nil, fmt.Errorf("unable to clone logical auth: identity policies: %w", err)
+	}
+
+	metadata, err := clone(input.Metadata)
+	if err != nil {
+		return nil, fmt.Errorf("unable to clone logical auth: metadata: %w", err)
+	}
+
+	policies, err := clone(input.Policies)
+	if err != nil {
+		return nil, fmt.Errorf("unable to clone logical auth: policies: %w", err)
+	}
+
+	var polRes *policyResults
+	if input.PolicyResults != nil {
+		polRes = &policyResults{
+			Allowed:          input.PolicyResults.Allowed,
+			GrantingPolicies: make([]policyInfo, len(input.PolicyResults.GrantingPolicies)),
 		}
 
-		for _, p := range auth.PolicyResults.GrantingPolicies {
-			reqEntry.Auth.PolicyResults.GrantingPolicies = append(reqEntry.Auth.PolicyResults.GrantingPolicies, PolicyInfo{
+		for _, p := range input.PolicyResults.GrantingPolicies {
+			polRes.GrantingPolicies = append(polRes.GrantingPolicies, policyInfo{
 				Name:          p.Name,
 				NamespaceId:   p.NamespaceId,
 				NamespacePath: p.NamespacePath,
@@ -343,126 +302,179 @@ func (f *EntryFormatter) FormatRequest(ctx context.Context, in *logical.LogInput
 		}
 	}
 
-	if req.WrapInfo != nil {
-		reqEntry.Request.WrapTTL = int(req.WrapInfo.TTL / time.Second)
-	}
+	tokenPolicies, err := clone(input.TokenPolicies)
+	if err != nil {
+		return nil, fmt.Errorf("unable to clone logical auth: token policies: %w", err)
+	}
+
+	var tokenIssueTime string
+	if !input.IssueTime.IsZero() {
+		tokenIssueTime = input.IssueTime.Format(time.RFC3339)
+	}
+
+	return &auth{
+		Accessor:                  input.Accessor,
+		ClientToken:               input.ClientToken,
+		DisplayName:               input.DisplayName,
+		EntityCreated:             input.EntityCreated,
+		EntityID:                  input.EntityID,
+		ExternalNamespacePolicies: extNSPolicies,
+		IdentityPolicies:          identityPolicies,
+		Metadata:                  metadata,
+		NoDefaultPolicy:           input.NoDefaultPolicy,
+		NumUses:                   input.NumUses,
+		Policies:                  policies,
+		PolicyResults:             polRes,
+		RemainingUses:             tokenRemainingUses,
+		TokenPolicies:             tokenPolicies,
+		TokenIssueTime:            tokenIssueTime,
+		TokenTTL:                  int64(input.TTL.Seconds()),
+		TokenType:                 input.TokenType.String(),
+	}, nil
+}
 
-	if !f.config.OmitTime {
-		reqEntry.Time = time.Now().UTC().Format(time.RFC3339Nano)
+// newRequest takes a logical.Request and namespace.Namespace, transforms and
+// aggregates them into an audit request.
+func newRequest(req *logical.Request, ns *nshelper.Namespace) (*request, error) {
+	if req == nil {
+		return nil, fmt.Errorf("request cannot be nil")
 	}
 
-	return reqEntry, nil
-}
+	remoteAddr := remoteAddr(req)
+	remotePort := remotePort(req)
+	clientCertSerial := clientCertSerialNumber(req)
 
-// FormatResponse attempts to format the specified logical.LogInput into a ResponseEntry.
-func (f *EntryFormatter) FormatResponse(ctx context.Context, in *logical.LogInput) (*ResponseEntry, error) {
-	switch {
-	case f == nil:
-		return nil, errors.New("formatter is nil")
-	case in == nil || in.Request == nil:
-		return nil, errors.New("request to response-audit a nil request")
-	case f.salter == nil:
-		return nil, errors.New("salt func not configured")
+	data, err := clone(req.Data)
+	if err != nil {
+		return nil, fmt.Errorf("unable to clone logical request: data: %w", err)
 	}
 
-	// Set these to the input values at first
-	auth, req, resp := in.Auth, in.Request, in.Response
-	if auth == nil {
-		auth = new(logical.Auth)
+	headers, err := clone(req.Headers)
+	if err != nil {
+		return nil, fmt.Errorf("unable to clone logical request: headers: %w", err)
 	}
+
+	var reqURI string
+	if req.HTTPRequest != nil && req.HTTPRequest.RequestURI != req.Path {
+		reqURI = req.HTTPRequest.RequestURI
+	}
+	var wrapTTL int
+	if req.WrapInfo != nil {
+		wrapTTL = int(req.WrapInfo.TTL / time.Second)
+	}
+
+	return &request{
+		ClientCertificateSerialNumber: clientCertSerial,
+		ClientID:                      req.ClientID,
+		ClientToken:                   req.ClientToken,
+		ClientTokenAccessor:           req.ClientTokenAccessor,
+		Data:                          data,
+		Headers:                       headers,
+		ID:                            req.ID,
+		MountAccessor:                 req.MountAccessor,
+		MountClass:                    req.MountClass(),
+		MountIsExternalPlugin:         req.MountIsExternalPlugin(),
+		MountPoint:                    req.MountPoint,
+		MountRunningSha256:            req.MountRunningSha256(),
+		MountRunningVersion:           req.MountRunningVersion(),
+		MountType:                     req.MountType,
+		Namespace: &namespace{
+			ID:   ns.ID,
+			Path: ns.Path,
+		},
+		Operation:          req.Operation,
+		Path:               req.Path,
+		PolicyOverride:     req.PolicyOverride,
+		RemoteAddr:         remoteAddr,
+		RemotePort:         remotePort,
+		ReplicationCluster: req.ReplicationCluster,
+		RequestURI:         reqURI,
+		WrapTTL:            wrapTTL,
+	}, nil
+}
+
+// newResponse takes a logical.Response and logical.Request, transforms and
+// aggregates them into an audit response.
+// isElisionRequired is used to indicate that response 'Data' should be elided.
+// NOTE: supplying a nil value for response will result in a nil return value and
+// (nil) error. The caller should check the return value before attempting to use it.
+// ignore-nil-nil-function-check.
+func newResponse(resp *logical.Response, req *logical.Request, isElisionRequired bool) (*response, error) {
 	if resp == nil {
-		resp = new(logical.Response)
+		return nil, nil
+	}
+
+	if req == nil {
+		// Request should never be nil, even for a response.
+		return nil, fmt.Errorf("request cannot be nil")
 	}
-	var connState *tls.ConnectionState
 
-	if in.Request.Connection != nil && in.Request.Connection.ConnState != nil {
-		connState = in.Request.Connection.ConnState
+	auth, err := newAuth(resp.Auth, req.ClientTokenRemainingUses)
+	if err != nil {
+		return nil, fmt.Errorf("unable to convert logical auth response: %w", err)
 	}
 
-	elideListResponseData := f.config.ElideListResponses && req.Operation == logical.ListOperation
+	var data map[string]any
+	if resp.Data != nil {
+		data = make(map[string]any, len(resp.Data))
 
-	var respData map[string]interface{}
-	if f.config.Raw {
-		// In the non-raw case, elision of list response data occurs inside HashResponse, to avoid redundant deep
-		// copies and hashing of data only to elide it later. In the raw case, we need to do it here.
-		if elideListResponseData && resp.Data != nil {
-			// Copy the data map before making changes, but we only need to go one level deep in this case
-			respData = make(map[string]interface{}, len(resp.Data))
+		if isElisionRequired {
+			// Performs the actual elision (ideally for list operations) of response data,
+			// once surrounding code has determined it should apply to a particular request.
+			// If the value for a key should not be elided, then it will be cloned.
 			for k, v := range resp.Data {
-				respData[k] = v
+				isCloneRequired := true
+				switch k {
+				case "keys":
+					if vSlice, ok := v.([]string); ok {
+						data[k] = len(vSlice)
+						isCloneRequired = false
+					}
+				case "key_info":
+					if vMap, ok := v.(map[string]any); ok {
+						data[k] = len(vMap)
+						isCloneRequired = false
+					}
+				}
+
+				// Clone values if they weren't legitimate keys or key_info.
+				if isCloneRequired {
+					v2, err := clone(v)
+					if err != nil {
+						return nil, fmt.Errorf("unable to clone response data while eliding: %w", err)
+					}
+					data[k] = v2
+				}
 			}
-
-			doElideListResponseData(respData)
 		} else {
-			respData = resp.Data
-		}
-	} else {
-		var err error
-		auth, err = HashAuth(ctx, f.salter, auth, f.config.HMACAccessor)
-		if err != nil {
-			return nil, err
-		}
-
-		req, err = HashRequest(ctx, f.salter, req, f.config.HMACAccessor, in.NonHMACReqDataKeys)
-		if err != nil {
-			return nil, err
-		}
-
-		resp, err = HashResponse(ctx, f.salter, resp, f.config.HMACAccessor, in.NonHMACRespDataKeys, elideListResponseData)
-		if err != nil {
-			return nil, err
+			// Deep clone all values, no shortcuts here.
+			data, err = clone(resp.Data)
+			if err != nil {
+				return nil, fmt.Errorf("unable to clone response data: %w", err)
+			}
 		}
-
-		respData = resp.Data
-	}
-
-	var errString string
-	if in.OuterErr != nil {
-		errString = in.OuterErr.Error()
 	}
 
-	ns, err := namespace.FromContext(ctx)
+	headers, err := clone(resp.Headers)
 	if err != nil {
-		return nil, err
-	}
-
-	var respAuth *Auth
-	if resp.Auth != nil {
-		respAuth = &Auth{
-			ClientToken:               resp.Auth.ClientToken,
-			Accessor:                  resp.Auth.Accessor,
-			DisplayName:               resp.Auth.DisplayName,
-			Policies:                  resp.Auth.Policies,
-			TokenPolicies:             resp.Auth.TokenPolicies,
-			IdentityPolicies:          resp.Auth.IdentityPolicies,
-			ExternalNamespacePolicies: resp.Auth.ExternalNamespacePolicies,
-			NoDefaultPolicy:           resp.Auth.NoDefaultPolicy,
-			Metadata:                  resp.Auth.Metadata,
-			NumUses:                   resp.Auth.NumUses,
-			EntityID:                  resp.Auth.EntityID,
-			TokenType:                 resp.Auth.TokenType.String(),
-			TokenTTL:                  int64(resp.Auth.TTL.Seconds()),
-		}
-		if !resp.Auth.IssueTime.IsZero() {
-			respAuth.TokenIssueTime = resp.Auth.IssueTime.Format(time.RFC3339)
-		}
+		return nil, fmt.Errorf("unable to clone logical response: headers: %w", err)
 	}
 
-	var respSecret *Secret
+	var s *secret
 	if resp.Secret != nil {
-		respSecret = &Secret{
-			LeaseID: resp.Secret.LeaseID,
-		}
+		s = &secret{LeaseID: resp.Secret.LeaseID}
 	}
 
-	var respWrapInfo *ResponseWrapInfo
+	var wrapInfo *responseWrapInfo
 	if resp.WrapInfo != nil {
 		token := resp.WrapInfo.Token
 		if jwtToken := parseVaultTokenFromJWT(token); jwtToken != nil {
 			token = *jwtToken
 		}
-		respWrapInfo = &ResponseWrapInfo{
-			TTL:             int(resp.WrapInfo.TTL / time.Second),
+
+		ttl := int(resp.WrapInfo.TTL / time.Second)
+		wrapInfo = &responseWrapInfo{
+			TTL:             ttl,
 			Token:           token,
 			Accessor:        resp.WrapInfo.Accessor,
 			CreationTime:    resp.WrapInfo.CreationTime.UTC().Format(time.RFC3339Nano),
@@ -471,204 +483,134 @@ func (f *EntryFormatter) FormatResponse(ctx context.Context, in *logical.LogInpu
 		}
 	}
 
-	respType := in.Type
-	if respType == "" {
-		respType = "response"
-	}
-	respEntry := &ResponseEntry{
-		Type:      respType,
-		Error:     errString,
-		Forwarded: req.ForwardedFrom != "",
-		Auth: &Auth{
-			ClientToken:               auth.ClientToken,
-			Accessor:                  auth.Accessor,
-			DisplayName:               auth.DisplayName,
-			Policies:                  auth.Policies,
-			TokenPolicies:             auth.TokenPolicies,
-			IdentityPolicies:          auth.IdentityPolicies,
-			ExternalNamespacePolicies: auth.ExternalNamespacePolicies,
-			NoDefaultPolicy:           auth.NoDefaultPolicy,
-			Metadata:                  auth.Metadata,
-			RemainingUses:             req.ClientTokenRemainingUses,
-			EntityID:                  auth.EntityID,
-			EntityCreated:             auth.EntityCreated,
-			TokenType:                 auth.TokenType.String(),
-			TokenTTL:                  int64(auth.TTL.Seconds()),
-		},
-
-		Request: &Request{
-			ID:                    req.ID,
-			ClientToken:           req.ClientToken,
-			ClientTokenAccessor:   req.ClientTokenAccessor,
-			ClientID:              req.ClientID,
-			Operation:             req.Operation,
-			MountPoint:            req.MountPoint,
-			MountType:             req.MountType,
-			MountAccessor:         req.MountAccessor,
-			MountRunningVersion:   req.MountRunningVersion(),
-			MountRunningSha256:    req.MountRunningSha256(),
-			MountIsExternalPlugin: req.MountIsExternalPlugin(),
-			MountClass:            req.MountClass(),
-			Namespace: &Namespace{
-				ID:   ns.ID,
-				Path: ns.Path,
-			},
-			Path:                          req.Path,
-			Data:                          req.Data,
-			PolicyOverride:                req.PolicyOverride,
-			RemoteAddr:                    getRemoteAddr(req),
-			RemotePort:                    getRemotePort(req),
-			ClientCertificateSerialNumber: getClientCertificateSerialNumber(connState),
-			ReplicationCluster:            req.ReplicationCluster,
-			Headers:                       req.Headers,
-		},
+	warnings, err := clone(resp.Warnings)
+	if err != nil {
+		return nil, fmt.Errorf("unable to clone logical response: warnings: %w", err)
+	}
+
+	return &response{
+		Auth:                  auth,
+		Data:                  data,
+		Headers:               headers,
+		MountAccessor:         req.MountAccessor,
+		MountClass:            req.MountClass(),
+		MountIsExternalPlugin: req.MountIsExternalPlugin(),
+		MountPoint:            req.MountPoint,
+		MountRunningSha256:    req.MountRunningSha256(),
+		MountRunningVersion:   req.MountRunningVersion(),
+		MountType:             req.MountType,
+		Redirect:              resp.Redirect,
+		Secret:                s,
+		WrapInfo:              wrapInfo,
+		Warnings:              warnings,
+	}, nil
+}
 
-		Response: &Response{
-			MountPoint:            req.MountPoint,
-			MountType:             req.MountType,
-			MountAccessor:         req.MountAccessor,
-			MountRunningVersion:   req.MountRunningVersion(),
-			MountRunningSha256:    req.MountRunningSha256(),
-			MountIsExternalPlugin: req.MountIsExternalPlugin(),
-			MountClass:            req.MountClass(),
-			Auth:                  respAuth,
-			Secret:                respSecret,
-			Data:                  respData,
-			Warnings:              resp.Warnings,
-			Redirect:              resp.Redirect,
-			WrapInfo:              respWrapInfo,
-			Headers:               resp.Headers,
-		},
-	}
+// createEntry takes the AuditEvent and builds an audit entry.
+// The entry will be HMAC'd and elided where required.
+func (f *entryFormatter) createEntry(ctx context.Context, a *Event) (*entry, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
 
-	if req.HTTPRequest != nil && req.HTTPRequest.RequestURI != req.Path {
-		respEntry.Request.RequestURI = req.HTTPRequest.RequestURI
 	}
 
-	if auth.PolicyResults != nil {
-		respEntry.Auth.PolicyResults = &PolicyResults{
-			Allowed: auth.PolicyResults.Allowed,
-		}
+	data := a.Data
 
-		for _, p := range auth.PolicyResults.GrantingPolicies {
-			respEntry.Auth.PolicyResults.GrantingPolicies = append(respEntry.Auth.PolicyResults.GrantingPolicies, PolicyInfo{
-				Name:          p.Name,
-				NamespaceId:   p.NamespaceId,
-				NamespacePath: p.NamespacePath,
-				Type:          p.Type,
-			})
-		}
+	if data.Request == nil {
+		// Request should never be nil, even for a response.
+		return nil, fmt.Errorf("unable to parse request from '%s' audit event: request cannot be nil", a.Subtype)
 	}
 
-	if !auth.IssueTime.IsZero() {
-		respEntry.Auth.TokenIssueTime = auth.IssueTime.Format(time.RFC3339)
-	}
-	if req.WrapInfo != nil {
-		respEntry.Request.WrapTTL = int(req.WrapInfo.TTL / time.Second)
+	ns, err := nshelper.FromContext(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("unable to retrieve namespace from context: %w", err)
 	}
 
-	if !f.config.OmitTime {
-		respEntry.Time = time.Now().UTC().Format(time.RFC3339Nano)
+	auth, err := newAuth(data.Auth, data.Request.ClientTokenRemainingUses)
+	if err != nil {
+		return nil, fmt.Errorf("cannot convert auth: %w", err)
 	}
 
-	return respEntry, nil
-}
-
-// NewFormatterConfig should be used to create a FormatterConfig.
-// Accepted options: WithElision, WithHMACAccessor, WithOmitTime, WithRaw, WithFormat.
-func NewFormatterConfig(opt ...Option) (FormatterConfig, error) {
-	const op = "audit.NewFormatterConfig"
-
-	opts, err := getOpts(opt...)
+	req, err := newRequest(data.Request, ns)
 	if err != nil {
-		return FormatterConfig{}, fmt.Errorf("%s: error applying options: %w", op, err)
+		return nil, fmt.Errorf("cannot convert request: %w", err)
 	}
 
-	return FormatterConfig{
-		ElideListResponses: opts.withElision,
-		HMACAccessor:       opts.withHMACAccessor,
-		OmitTime:           opts.withOmitTime,
-		Raw:                opts.withRaw,
-		RequiredFormat:     opts.withFormat,
-	}, nil
-}
-
-// getRemoteAddr safely gets the remote address avoiding a nil pointer
-func getRemoteAddr(req *logical.Request) string {
-	if req != nil && req.Connection != nil {
-		return req.Connection.RemoteAddr
+	var resp *response
+	if a.Subtype == ResponseType {
+		shouldElide := f.config.elideListResponses && req.Operation == logical.ListOperation
+		resp, err = newResponse(data.Response, data.Request, shouldElide)
+		if err != nil {
+			return nil, fmt.Errorf("cannot convert response: %w", err)
+		}
 	}
-	return ""
-}
 
-// getRemotePort safely gets the remote port avoiding a nil pointer
-func getRemotePort(req *logical.Request) int {
-	if req != nil && req.Connection != nil {
-		return req.Connection.RemotePort
+	var outerErr string
+	if data.OuterErr != nil {
+		outerErr = data.OuterErr.Error()
 	}
-	return 0
-}
 
-// getClientCertificateSerialNumber attempts the retrieve the serial number of
-// the peer certificate from the specified tls.ConnectionState.
-func getClientCertificateSerialNumber(connState *tls.ConnectionState) string {
-	if connState == nil || len(connState.VerifiedChains) == 0 || len(connState.VerifiedChains[0]) == 0 {
-		return ""
+	entryType := data.Type
+	if entryType == "" {
+		entryType = a.Subtype.String()
 	}
 
-	return connState.VerifiedChains[0][0].SerialNumber.String()
-}
+	entry := &entry{
+		Auth:          auth,
+		Error:         outerErr,
+		Forwarded:     false,
+		ForwardedFrom: data.Request.ForwardedFrom,
+		Request:       req,
+		Response:      resp,
+		Type:          entryType,
+	}
 
-// parseVaultTokenFromJWT returns a string iff the token was a JWT, and we could
-// extract the original token ID from inside
-func parseVaultTokenFromJWT(token string) *string {
-	if strings.Count(token, ".") != 2 {
-		return nil
+	if !f.config.omitTime {
+		// Use the time provider to supply the time for this entry.
+		entry.Time = a.timeProvider().formattedTime()
 	}
 
-	parsedJWT, err := jwt.ParseSigned(token)
-	if err != nil {
-		return nil
+	// If the request is present in the input data, apply header configuration
+	// regardless. We shouldn't be in a situation where the header formatter isn't
+	// present as it's required.
+	if entry.Request != nil {
+		// Ensure that any headers in the request, are formatted as required, and are
+		// only present if they have been configured to appear in the audit log.
+		// e.g. via: /sys/config/auditing/request-headers/:name
+		entry.Request.Headers, err = f.config.headerFormatter.ApplyConfig(ctx, entry.Request.Headers, f.salter)
+		if err != nil {
+			return nil, fmt.Errorf("unable to transform headers for auditing: %w", err)
+		}
 	}
 
-	var claims jwt.Claims
-	if err = parsedJWT.UnsafeClaimsWithoutVerification(&claims); err != nil {
-		return nil
+	// If the request contains a Server-Side Consistency Token (SSCT), and we
+	// have an auth response, overwrite the existing client token with the SSCT,
+	// so that the SSCT appears in the audit log for this entry.
+	if data.Request != nil && data.Request.InboundSSCToken != "" && entry.Auth != nil {
+		entry.Auth.ClientToken = data.Request.InboundSSCToken
 	}
 
-	return &claims.ID
-}
+	// Hash the entry if we aren't expecting raw output.
+	if !f.config.raw {
+		// Requests and responses have auth and request.
+		err = hashAuth(ctx, f.salter, entry.Auth, f.config.hmacAccessor)
+		if err != nil {
+			return nil, err
+		}
 
-// doElideListResponseData performs the actual elision of list operation response data, once surrounding code has
-// determined it should apply to a particular request. The data map that is passed in must be a copy that is safe to
-// modify in place, but need not be a full recursive deep copy, as only top-level keys are changed.
-//
-// See the documentation of the controlling option in FormatterConfig for more information on the purpose.
-func doElideListResponseData(data map[string]interface{}) {
-	for k, v := range data {
-		if k == "keys" {
-			if vSlice, ok := v.([]string); ok {
-				data[k] = len(vSlice)
-			}
-		} else if k == "key_info" {
-			if vMap, ok := v.(map[string]interface{}); ok {
-				data[k] = len(vMap)
-			}
+		err = hashRequest(ctx, f.salter, entry.Request, f.config.hmacAccessor, data.NonHMACReqDataKeys)
+		if err != nil {
+			return nil, err
 		}
-	}
-}
 
-// newTemporaryEntryFormatter creates a cloned EntryFormatter instance with a non-persistent Salter.
-func newTemporaryEntryFormatter(n *EntryFormatter) *EntryFormatter {
-	return &EntryFormatter{
-		salter:          &nonPersistentSalt{},
-		headerFormatter: n.headerFormatter,
-		config:          n.config,
-		prefix:          n.prefix,
+		if a.Subtype == ResponseType {
+			if err = hashResponse(ctx, f.salter, entry.Response, f.config.hmacAccessor, data.NonHMACRespDataKeys); err != nil {
+				return nil, err
+			}
+		}
 	}
-}
 
-// Salt returns a new salt with default configuration and no storage usage, and no error.
-func (s *nonPersistentSalt) Salt(_ context.Context) (*salt.Salt, error) {
-	return salt.NewNonpersistentSalt(), nil
+	return entry, nil
 }
diff --git a/audit/entry_formatter_ce.go b/audit/entry_formatter_ce.go
new file mode 100644
index 00000000000..e005deaf867
--- /dev/null
+++ b/audit/entry_formatter_ce.go
@@ -0,0 +1,18 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package audit
+
+import (
+	"errors"
+)
+
+func (f *entryFormatter) shouldExclude() bool {
+	return false
+}
+
+func (f *entryFormatter) excludeFields(entry any) (map[string]any, error) {
+	return nil, errors.New("enterprise-only feature: audit exclusion")
+}
diff --git a/audit/entry_formatter_ce_test.go b/audit/entry_formatter_ce_test.go
new file mode 100644
index 00000000000..0f74af68753
--- /dev/null
+++ b/audit/entry_formatter_ce_test.go
@@ -0,0 +1,37 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package audit
+
+import (
+	"testing"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/stretchr/testify/require"
+)
+
+// TestEntryFormatter_excludeFields tests that we can exclude data based on the
+// pre-configured conditions/fields of the EntryFormatter. It covers some scenarios
+// where we expect errors due to invalid input, which is unlikely to happen in reality.
+func TestEntryFormatter_excludeFields(t *testing.T) {
+	// Create the formatter node.
+	cfg, err := newFormatterConfig(&testHeaderFormatter{}, nil)
+	require.NoError(t, err)
+	ss := newStaticSalt(t)
+
+	// We intentionally create the EntryFormatter manually, as we wouldn't be
+	// able to set exclusions via NewEntryFormatter WithExclusions option.
+	formatter := &entryFormatter{
+		config: cfg,
+		salter: ss,
+		logger: hclog.NewNullLogger(),
+		name:   "juan",
+	}
+
+	res, err := formatter.excludeFields(nil)
+	require.Error(t, err)
+	require.EqualError(t, err, "enterprise-only feature: audit exclusion")
+	require.Nil(t, res)
+}
diff --git a/audit/entry_formatter_config.go b/audit/entry_formatter_config.go
new file mode 100644
index 00000000000..69317da925b
--- /dev/null
+++ b/audit/entry_formatter_config.go
@@ -0,0 +1,121 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"fmt"
+	"reflect"
+	"strconv"
+)
+
+// formatterConfig is used to provide basic configuration to a formatter.
+// Use newFormatterConfig to initialize the formatterConfig struct.
+type formatterConfig struct {
+	formatterConfigEnt
+
+	raw          bool
+	hmacAccessor bool
+
+	// Vault lacks pagination in its APIs. As a result, certain list operations can return **very** large responses.
+	// The user's chosen audit sinks may experience difficulty consuming audit records that swell to tens of megabytes
+	// of JSON. The responses of list operations are typically not very interesting, as they are mostly lists of keys,
+	// or, even when they include a "key_info" field, are not returning confidential information. They become even less
+	// interesting once HMAC-ed by the audit system.
+	//
+	// Some example Vault "list" operations that are prone to becoming very large in an active Vault installation are:
+	//   auth/token/accessors/
+	//   identity/entity/id/
+	//   identity/entity-alias/id/
+	//   pki/certs/
+	//
+	// This option exists to provide such users with the option to have response data elided from audit logs, only when
+	// the operation type is "list". For added safety, the elision only applies to the "keys" and "key_info" fields
+	// within the response data - these are conventionally the only fields present in a list response - see
+	// logical.ListResponse, and logical.ListResponseWithInfo. However, other fields are technically possible if a
+	// plugin author writes unusual code, and these will be preserved in the audit log even with this option enabled.
+	// The elision replaces the values of the "keys" and "key_info" fields with an integer count of the number of
+	// entries. This allows even the elided audit logs to still be useful for answering questions like
+	// "Was any data returned?" or "How many records were listed?".
+	elideListResponses bool
+
+	// This should only ever be used in a testing context
+	omitTime bool
+
+	// The required/target format for the event (supported: jsonFormat and jsonxFormat).
+	requiredFormat format
+
+	// headerFormatter specifies the formatter used for headers that existing in any incoming audit request.
+	headerFormatter HeaderFormatter
+
+	// prefix specifies a prefix that should be prepended to any formatted request or response before serialization.
+	prefix string
+}
+
+// newFormatterConfig creates the configuration required by a formatter node using the config map supplied to the factory.
+func newFormatterConfig(headerFormatter HeaderFormatter, config map[string]string) (formatterConfig, error) {
+	if headerFormatter == nil || reflect.ValueOf(headerFormatter).IsNil() {
+		return formatterConfig{}, fmt.Errorf("header formatter is required: %w", ErrInvalidParameter)
+	}
+
+	var opt []option
+
+	if format, ok := config[optionFormat]; ok {
+		if !isValidFormat(format) {
+			return formatterConfig{}, fmt.Errorf("unsupported %q: %w", optionFormat, ErrExternalOptions)
+		}
+
+		opt = append(opt, withFormat(format))
+	}
+
+	// Check if hashing of accessor is disabled
+	if hmacAccessorRaw, ok := config[optionHMACAccessor]; ok {
+		v, err := strconv.ParseBool(hmacAccessorRaw)
+		if err != nil {
+			return formatterConfig{}, fmt.Errorf("unable to parse %q: %w", optionHMACAccessor, ErrExternalOptions)
+		}
+		opt = append(opt, withHMACAccessor(v))
+	}
+
+	// Check if raw logging is enabled
+	if raw, ok := config[optionLogRaw]; ok {
+		v, err := strconv.ParseBool(raw)
+		if err != nil {
+			return formatterConfig{}, fmt.Errorf("unable to parse %q: %w", optionLogRaw, ErrExternalOptions)
+		}
+		opt = append(opt, withRaw(v))
+	}
+
+	if elideListResponsesRaw, ok := config[optionElideListResponses]; ok {
+		v, err := strconv.ParseBool(elideListResponsesRaw)
+		if err != nil {
+			return formatterConfig{}, fmt.Errorf("unable to parse %q: %w", optionElideListResponses, ErrExternalOptions)
+		}
+		opt = append(opt, withElision(v))
+	}
+
+	if prefix, ok := config[OptionPrefix]; ok {
+		opt = append(opt, withPrefix(prefix))
+	}
+
+	opts, err := getOpts(opt...)
+	if err != nil {
+		return formatterConfig{}, err
+	}
+
+	fmtCfgEnt, err := newFormatterConfigEnt(config)
+	if err != nil {
+		return formatterConfig{}, err
+	}
+
+	return formatterConfig{
+		formatterConfigEnt: fmtCfgEnt,
+		headerFormatter:    headerFormatter,
+		elideListResponses: opts.withElision,
+		hmacAccessor:       opts.withHMACAccessor,
+		omitTime:           opts.withOmitTime, // This must be set in code after creation.
+		prefix:             opts.withPrefix,
+		raw:                opts.withRaw,
+		requiredFormat:     opts.withFormat,
+	}, nil
+}
diff --git a/audit/entry_formatter_config_ce.go b/audit/entry_formatter_config_ce.go
new file mode 100644
index 00000000000..317e9148794
--- /dev/null
+++ b/audit/entry_formatter_config_ce.go
@@ -0,0 +1,16 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package audit
+
+// formatterConfigEnt provides extensions to a formatterConfig which behave differently
+// for Enterprise and community edition.
+// NOTE: Use newFormatterConfigEnt to initialize the formatterConfigEnt struct.
+type formatterConfigEnt struct{}
+
+// newFormatterConfigEnt should be used to create formatterConfigEnt.
+func newFormatterConfigEnt(config map[string]string) (formatterConfigEnt, error) {
+	return formatterConfigEnt{}, nil
+}
diff --git a/audit/entry_formatter_test.go b/audit/entry_formatter_test.go
index 9b5dc1ccacb..73f63a67edd 100644
--- a/audit/entry_formatter_test.go
+++ b/audit/entry_formatter_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -15,7 +15,8 @@ import (
 	"github.com/hashicorp/eventlogger"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-sockaddr"
-	"github.com/hashicorp/vault/helper/namespace"
+	nshelper "github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/internal/observability/event"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/salt"
@@ -59,7 +60,34 @@ const testFormatJSONReqBasicStrFmt = `
 }
 `
 
-// TestNewEntryFormatter ensures we can create new EntryFormatter structs.
+// testHeaderFormatter is a stub to prevent the need to import the vault package
+// to bring in vault.HeadersConfig for testing.
+type testHeaderFormatter struct {
+	shouldReturnEmpty bool
+}
+
+// ApplyConfig satisfies the HeaderFormatter interface for testing.
+// It will either return the headers it was supplied or empty headers depending
+// on how it is configured.
+// ignore-nil-nil-function-check.
+func (f *testHeaderFormatter) ApplyConfig(_ context.Context, headers map[string][]string, salter Salter) (result map[string][]string, retErr error) {
+	if f.shouldReturnEmpty {
+		return make(map[string][]string), nil
+	}
+
+	return headers, nil
+}
+
+// testTimeProvider is just a test struct used to imitate an AuditEvent's ability
+// to provide a formatted time.
+type testTimeProvider struct{}
+
+// formattedTime always returns the same value for 22nd March 2024 at 10:00:05 (and 10 nanos).
+func (p *testTimeProvider) formattedTime() string {
+	return time.Date(2024, time.March, 22, 10, 0o0, 5, 10, time.UTC).UTC().Format(time.RFC3339Nano)
+}
+
+// TestNewEntryFormatter ensures we can create new entryFormatter structs.
 func TestNewEntryFormatter(t *testing.T) {
 	t.Parallel()
 
@@ -67,7 +95,7 @@ func TestNewEntryFormatter(t *testing.T) {
 		Name                 string
 		UseStaticSalt        bool
 		Logger               hclog.Logger
-		Options              []Option // Only supports WithPrefix
+		Options              map[string]string
 		IsErrorExpected      bool
 		ExpectedErrorMessage string
 		ExpectedFormat       format
@@ -76,85 +104,85 @@ func TestNewEntryFormatter(t *testing.T) {
 		"empty-name": {
 			Name:                 "",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEntryFormatter: name is required: invalid parameter",
+			ExpectedErrorMessage: "name is required: invalid internal parameter",
 		},
 		"spacey-name": {
 			Name:                 "   ",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEntryFormatter: name is required: invalid parameter",
+			ExpectedErrorMessage: "name is required: invalid internal parameter",
 		},
 		"nil-salter": {
 			Name:                 "juan",
 			UseStaticSalt:        false,
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEntryFormatter: cannot create a new audit formatter with nil salter: invalid parameter",
+			ExpectedErrorMessage: "cannot create a new audit formatter with nil salter: invalid internal parameter",
 		},
 		"nil-logger": {
 			Name:                 "juan",
 			UseStaticSalt:        true,
 			Logger:               nil,
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEntryFormatter: cannot create a new audit formatter with nil logger: invalid parameter",
+			ExpectedErrorMessage: "cannot create a new audit formatter with nil logger: invalid internal parameter",
 		},
 		"static-salter": {
 			Name:            "juan",
 			UseStaticSalt:   true,
 			Logger:          hclog.NewNullLogger(),
 			IsErrorExpected: false,
-			Options: []Option{
-				WithFormat(JSONFormat.String()),
+			Options: map[string]string{
+				"format": "json",
 			},
-			ExpectedFormat: JSONFormat,
+			ExpectedFormat: jsonFormat,
 		},
 		"default": {
 			Name:            "juan",
 			UseStaticSalt:   true,
 			Logger:          hclog.NewNullLogger(),
 			IsErrorExpected: false,
-			ExpectedFormat:  JSONFormat,
+			ExpectedFormat:  jsonFormat,
 		},
 		"config-json": {
 			Name:          "juan",
 			UseStaticSalt: true,
 			Logger:        hclog.NewNullLogger(),
-			Options: []Option{
-				WithFormat(JSONFormat.String()),
+			Options: map[string]string{
+				"format": "json",
 			},
 			IsErrorExpected: false,
-			ExpectedFormat:  JSONFormat,
+			ExpectedFormat:  jsonFormat,
 		},
 		"config-jsonx": {
 			Name:          "juan",
 			UseStaticSalt: true,
 			Logger:        hclog.NewNullLogger(),
-			Options: []Option{
-				WithFormat(JSONxFormat.String()),
+			Options: map[string]string{
+				"format": "jsonx",
 			},
 			IsErrorExpected: false,
-			ExpectedFormat:  JSONxFormat,
+			ExpectedFormat:  jsonxFormat,
 		},
 		"config-json-prefix": {
 			Name:          "juan",
 			UseStaticSalt: true,
 			Logger:        hclog.NewNullLogger(),
-			Options: []Option{
-				WithPrefix("foo"),
-				WithFormat(JSONFormat.String()),
+			Options: map[string]string{
+				"prefix": "foo",
+				"format": "json",
 			},
 			IsErrorExpected: false,
-			ExpectedFormat:  JSONFormat,
+			ExpectedFormat:  jsonFormat,
 			ExpectedPrefix:  "foo",
 		},
 		"config-jsonx-prefix": {
 			Name:          "juan",
 			UseStaticSalt: true,
 			Logger:        hclog.NewNullLogger(),
-			Options: []Option{
-				WithPrefix("foo"),
-				WithFormat(JSONxFormat.String()),
+			Options: map[string]string{
+				"prefix": "foo",
+				"format": "jsonx",
 			},
 			IsErrorExpected: false,
-			ExpectedFormat:  JSONxFormat,
+			ExpectedFormat:  jsonxFormat,
 			ExpectedPrefix:  "foo",
 		},
 	}
@@ -169,9 +197,9 @@ func TestNewEntryFormatter(t *testing.T) {
 				ss = newStaticSalt(t)
 			}
 
-			cfg, err := NewFormatterConfig(tc.Options...)
+			cfg, err := newFormatterConfig(&testHeaderFormatter{}, tc.Options)
 			require.NoError(t, err)
-			f, err := NewEntryFormatter(tc.Name, cfg, ss, tc.Logger, tc.Options...)
+			f, err := newEntryFormatter(tc.Name, cfg, ss, tc.Logger)
 
 			switch {
 			case tc.IsErrorExpected:
@@ -181,8 +209,8 @@ func TestNewEntryFormatter(t *testing.T) {
 			default:
 				require.NoError(t, err)
 				require.NotNil(t, f)
-				require.Equal(t, tc.ExpectedFormat, f.config.RequiredFormat)
-				require.Equal(t, tc.ExpectedPrefix, f.prefix)
+				require.Equal(t, tc.ExpectedFormat, f.config.requiredFormat)
+				require.Equal(t, tc.ExpectedPrefix, f.config.prefix)
 			}
 		})
 	}
@@ -193,10 +221,10 @@ func TestEntryFormatter_Reopen(t *testing.T) {
 	t.Parallel()
 
 	ss := newStaticSalt(t)
-	cfg, err := NewFormatterConfig()
+	cfg, err := newFormatterConfig(&testHeaderFormatter{}, nil)
 	require.NoError(t, err)
 
-	f, err := NewEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
+	f, err := newEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
 	require.NoError(t, err)
 	require.NotNil(t, f)
 	require.NoError(t, f.Reopen())
@@ -207,17 +235,17 @@ func TestEntryFormatter_Type(t *testing.T) {
 	t.Parallel()
 
 	ss := newStaticSalt(t)
-	cfg, err := NewFormatterConfig()
+	cfg, err := newFormatterConfig(&testHeaderFormatter{}, nil)
 	require.NoError(t, err)
 
-	f, err := NewEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
+	f, err := newEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
 	require.NoError(t, err)
 	require.NotNil(t, f)
 	require.Equal(t, eventlogger.NodeTypeFormatter, f.Type())
 }
 
 // TestEntryFormatter_Process attempts to run the Process method to convert the
-// logical.LogInput within an audit event to JSON and JSONx (RequestEntry or ResponseEntry).
+// logical.LogInput within an audit event to JSON and JSONx (entry),
 func TestEntryFormatter_Process(t *testing.T) {
 	t.Parallel()
 
@@ -231,115 +259,134 @@ func TestEntryFormatter_Process(t *testing.T) {
 	}{
 		"json-request-no-data": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: cannot audit event (AuditRequest) with no data: invalid parameter",
+			ExpectedErrorMessage: "cannot audit a 'request' event with no data: invalid internal parameter",
 			Subtype:              RequestType,
-			RequiredFormat:       JSONFormat,
+			RequiredFormat:       jsonFormat,
 			Data:                 nil,
 		},
 		"json-response-no-data": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: cannot audit event (AuditResponse) with no data: invalid parameter",
+			ExpectedErrorMessage: "cannot audit a 'response' event with no data: invalid internal parameter",
 			Subtype:              ResponseType,
-			RequiredFormat:       JSONFormat,
+			RequiredFormat:       jsonFormat,
 			Data:                 nil,
 		},
 		"json-request-basic-input": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: unable to parse request from audit event: request to request-audit a nil request",
+			ExpectedErrorMessage: "unable to parse request from 'request' audit event: request cannot be nil",
 			Subtype:              RequestType,
-			RequiredFormat:       JSONFormat,
+			RequiredFormat:       jsonFormat,
 			Data:                 &logical.LogInput{Type: "magic"},
+			RootNamespace:        true,
 		},
 		"json-response-basic-input": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: unable to parse response from audit event: request to response-audit a nil request",
+			ExpectedErrorMessage: "unable to parse request from 'response' audit event: request cannot be nil",
 			Subtype:              ResponseType,
-			RequiredFormat:       JSONFormat,
+			RequiredFormat:       jsonFormat,
 			Data:                 &logical.LogInput{Type: "magic"},
 		},
 		"json-request-basic-input-and-request-no-ns": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: unable to parse request from audit event: no namespace",
+			ExpectedErrorMessage: "unable to retrieve namespace from context: no namespace",
 			Subtype:              RequestType,
-			RequiredFormat:       JSONFormat,
+			RequiredFormat:       jsonFormat,
 			Data:                 &logical.LogInput{Request: &logical.Request{ID: "123"}},
 		},
 		"json-response-basic-input-and-request-no-ns": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: unable to parse response from audit event: no namespace",
+			ExpectedErrorMessage: "unable to retrieve namespace from context: no namespace",
 			Subtype:              ResponseType,
-			RequiredFormat:       JSONFormat,
+			RequiredFormat:       jsonFormat,
 			Data:                 &logical.LogInput{Request: &logical.Request{ID: "123"}},
 		},
 		"json-request-basic-input-and-request-with-ns": {
 			IsErrorExpected: false,
 			Subtype:         RequestType,
-			RequiredFormat:  JSONFormat,
+			RequiredFormat:  jsonFormat,
 			Data:            &logical.LogInput{Request: &logical.Request{ID: "123"}},
 			RootNamespace:   true,
 		},
 		"json-response-basic-input-and-request-with-ns": {
 			IsErrorExpected: false,
 			Subtype:         ResponseType,
-			RequiredFormat:  JSONFormat,
-			Data:            &logical.LogInput{Request: &logical.Request{ID: "123"}},
-			RootNamespace:   true,
+			RequiredFormat:  jsonFormat,
+			Data: &logical.LogInput{
+				Request:  &logical.Request{ID: "123"},
+				Response: &logical.Response{},
+			},
+			RootNamespace: true,
 		},
 		"jsonx-request-no-data": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: cannot audit event (AuditRequest) with no data: invalid parameter",
+			ExpectedErrorMessage: "cannot audit a 'request' event with no data: invalid internal parameter",
 			Subtype:              RequestType,
-			RequiredFormat:       JSONxFormat,
+			RequiredFormat:       jsonxFormat,
 			Data:                 nil,
 		},
 		"jsonx-response-no-data": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: cannot audit event (AuditResponse) with no data: invalid parameter",
+			ExpectedErrorMessage: "cannot audit a 'response' event with no data: invalid internal parameter",
 			Subtype:              ResponseType,
-			RequiredFormat:       JSONxFormat,
+			RequiredFormat:       jsonxFormat,
 			Data:                 nil,
 		},
 		"jsonx-request-basic-input": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: unable to parse request from audit event: request to request-audit a nil request",
+			ExpectedErrorMessage: "unable to parse request from 'request' audit event: request cannot be nil",
 			Subtype:              RequestType,
-			RequiredFormat:       JSONxFormat,
+			RequiredFormat:       jsonxFormat,
 			Data:                 &logical.LogInput{Type: "magic"},
+			RootNamespace:        true,
 		},
 		"jsonx-response-basic-input": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: unable to parse response from audit event: request to response-audit a nil request",
+			ExpectedErrorMessage: "unable to parse request from 'response' audit event: request cannot be nil",
 			Subtype:              ResponseType,
-			RequiredFormat:       JSONxFormat,
+			RequiredFormat:       jsonxFormat,
 			Data:                 &logical.LogInput{Type: "magic"},
+			RootNamespace:        true,
 		},
 		"jsonx-request-basic-input-and-request-no-ns": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: unable to parse request from audit event: no namespace",
+			ExpectedErrorMessage: "unable to retrieve namespace from context: no namespace",
 			Subtype:              RequestType,
-			RequiredFormat:       JSONxFormat,
+			RequiredFormat:       jsonxFormat,
 			Data:                 &logical.LogInput{Request: &logical.Request{ID: "123"}},
 		},
 		"jsonx-response-basic-input-and-request-no-ns": {
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(EntryFormatter).Process: unable to parse response from audit event: no namespace",
+			ExpectedErrorMessage: "unable to retrieve namespace from context: no namespace",
 			Subtype:              ResponseType,
-			RequiredFormat:       JSONxFormat,
+			RequiredFormat:       jsonxFormat,
 			Data:                 &logical.LogInput{Request: &logical.Request{ID: "123"}},
 		},
 		"jsonx-request-basic-input-and-request-with-ns": {
 			IsErrorExpected: false,
 			Subtype:         RequestType,
-			RequiredFormat:  JSONxFormat,
+			RequiredFormat:  jsonxFormat,
 			Data:            &logical.LogInput{Request: &logical.Request{ID: "123"}},
 			RootNamespace:   true,
 		},
 		"jsonx-response-basic-input-and-request-with-ns": {
 			IsErrorExpected: false,
 			Subtype:         ResponseType,
-			RequiredFormat:  JSONxFormat,
-			Data:            &logical.LogInput{Request: &logical.Request{ID: "123"}},
-			RootNamespace:   true,
+			RequiredFormat:  jsonxFormat,
+			Data: &logical.LogInput{
+				Request:  &logical.Request{ID: "123"},
+				Response: &logical.Response{},
+			},
+			RootNamespace: true,
+		},
+		"no-request": {
+			IsErrorExpected:      true,
+			ExpectedErrorMessage: "unable to parse request from 'response' audit event: request cannot be nil",
+			Subtype:              ResponseType,
+			RequiredFormat:       jsonxFormat,
+			Data: &logical.LogInput{
+				Auth: &logical.Auth{},
+			},
+			RootNamespace: true,
 		},
 	}
 
@@ -352,17 +399,17 @@ func TestEntryFormatter_Process(t *testing.T) {
 			require.NotNil(t, e)
 
 			ss := newStaticSalt(t)
-			cfg, err := NewFormatterConfig(WithFormat(tc.RequiredFormat.String()))
+			cfg, err := newFormatterConfig(&testHeaderFormatter{}, map[string]string{"format": tc.RequiredFormat.String()})
 			require.NoError(t, err)
 
-			f, err := NewEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
+			f, err := newEntryFormatter("juan", cfg, ss, corehelpers.NewTestLogger(t))
 			require.NoError(t, err)
 			require.NotNil(t, f)
 
 			var ctx context.Context
 			switch {
 			case tc.RootNamespace:
-				ctx = namespace.RootContext(context.Background())
+				ctx = nshelper.RootContext(context.Background())
 			default:
 				ctx = context.Background()
 			}
@@ -385,7 +432,7 @@ func TestEntryFormatter_Process(t *testing.T) {
 	}
 }
 
-// BenchmarkAuditFileSink_Process benchmarks the EntryFormatter and then event.FileSink calling Process.
+// BenchmarkAuditFileSink_Process benchmarks the entryFormatter and then event.FileSink calling Process.
 // This should replicate the original benchmark testing which used to perform both of these roles together.
 func BenchmarkAuditFileSink_Process(b *testing.B) {
 	// Base input
@@ -414,18 +461,18 @@ func BenchmarkAuditFileSink_Process(b *testing.B) {
 		},
 	}
 
-	ctx := namespace.RootContext(context.Background())
+	ctx := nshelper.RootContext(context.Background())
 
 	// Create the formatter node.
-	cfg, err := NewFormatterConfig()
+	cfg, err := newFormatterConfig(&testHeaderFormatter{}, nil)
 	require.NoError(b, err)
 	ss := newStaticSalt(b)
-	formatter, err := NewEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
+	formatter, err := newEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
 	require.NoError(b, err)
 	require.NotNil(b, formatter)
 
 	// Create the sink node.
-	sink, err := event.NewFileSink("/dev/null", JSONFormat.String())
+	sink, err := event.NewFileSink("/dev/null", jsonFormat.String())
 	require.NoError(b, err)
 	require.NotNil(b, sink)
 
@@ -448,13 +495,14 @@ func BenchmarkAuditFileSink_Process(b *testing.B) {
 	})
 }
 
-// TestEntryFormatter_FormatRequest exercises EntryFormatter.FormatRequest with
-// varying inputs.
-func TestEntryFormatter_FormatRequest(t *testing.T) {
+// TestEntryFormatter_Process_Request exercises entryFormatter process an event
+// with varying inputs.
+func TestEntryFormatter_Process_Request(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
 		Input                *logical.LogInput
+		ShouldOmitTime       bool
 		IsErrorExpected      bool
 		ExpectedErrorMessage string
 		RootNamespace        bool
@@ -462,17 +510,17 @@ func TestEntryFormatter_FormatRequest(t *testing.T) {
 		"nil": {
 			Input:                nil,
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "request to request-audit a nil request",
+			ExpectedErrorMessage: "cannot audit a 'request' event with no data: invalid internal parameter",
 		},
 		"basic-input": {
 			Input:                &logical.LogInput{},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "request to request-audit a nil request",
+			ExpectedErrorMessage: "unable to parse request from 'request' audit event: request cannot be nil",
 		},
 		"input-and-request-no-ns": {
 			Input:                &logical.LogInput{Request: &logical.Request{ID: "123"}},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "no namespace",
+			ExpectedErrorMessage: "unable to retrieve namespace from context: no namespace",
 			RootNamespace:        false,
 		},
 		"input-and-request-with-ns": {
@@ -480,6 +528,11 @@ func TestEntryFormatter_FormatRequest(t *testing.T) {
 			IsErrorExpected: false,
 			RootNamespace:   true,
 		},
+		"omit-time": {
+			Input:          &logical.LogInput{Request: &logical.Request{ID: "123"}},
+			ShouldOmitTime: true,
+			RootNamespace:  true,
+		},
 	}
 
 	for name, tc := range tests {
@@ -489,41 +542,70 @@ func TestEntryFormatter_FormatRequest(t *testing.T) {
 			t.Parallel()
 
 			ss := newStaticSalt(t)
-			cfg, err := NewFormatterConfig()
+			cfg, err := newFormatterConfig(&testHeaderFormatter{}, nil)
+			cfg.omitTime = tc.ShouldOmitTime
 			require.NoError(t, err)
-			f, err := NewEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
+			f, err := newEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
 			require.NoError(t, err)
 
 			var ctx context.Context
 			switch {
 			case tc.RootNamespace:
-				ctx = namespace.RootContext(context.Background())
+				ctx = nshelper.RootContext(context.Background())
 			default:
 				ctx = context.Background()
 			}
 
-			entry, err := f.FormatRequest(ctx, tc.Input)
+			auditEvent, err := newEvent(RequestType)
+			auditEvent.setTimeProvider(&testTimeProvider{})
+			require.NoError(t, err)
+			auditEvent.Data = tc.Input
+
+			e := &eventlogger.Event{
+				Type:      event.AuditType.AsEventType(),
+				CreatedAt: time.Now(),
+				Formatted: make(map[string][]byte),
+				Payload:   auditEvent,
+			}
 
+			e2, err := f.Process(ctx, e)
 			switch {
 			case tc.IsErrorExpected:
 				require.Error(t, err)
 				require.EqualError(t, err, tc.ExpectedErrorMessage)
-				require.Nil(t, entry)
+				require.Nil(t, e2)
+			case tc.ShouldOmitTime:
+				require.NoError(t, err)
+				require.NotNil(t, e2)
+				b, ok := e2.Format(jsonFormat.String())
+				require.True(t, ok)
+				var entry *entry
+				err = json.Unmarshal(b, &entry)
+				require.NoError(t, err)
+				require.Zero(t, entry.Time)
 			default:
 				require.NoError(t, err)
-				require.NotNil(t, entry)
+				require.NotNil(t, e2)
+				b, ok := e2.Format(jsonFormat.String())
+				require.True(t, ok)
+				var entry *entry
+				err = json.Unmarshal(b, &entry)
+				require.NoError(t, err)
+				require.NotZero(t, entry.Time)
+				require.Equal(t, "2024-03-22T10:00:05.00000001Z", entry.Time)
 			}
 		})
 	}
 }
 
-// TestEntryFormatter_FormatResponse exercises EntryFormatter.FormatResponse with
-// varying inputs.
-func TestEntryFormatter_FormatResponse(t *testing.T) {
+// TestEntryFormatter_Process_ResponseType exercises entryFormatter
+// with varying inputs also checking if the time can be omitted.
+func TestEntryFormatter_Process_ResponseType(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
 		Input                *logical.LogInput
+		ShouldOmitTime       bool
 		IsErrorExpected      bool
 		ExpectedErrorMessage string
 		RootNamespace        bool
@@ -531,21 +613,33 @@ func TestEntryFormatter_FormatResponse(t *testing.T) {
 		"nil": {
 			Input:                nil,
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "request to response-audit a nil request",
+			ExpectedErrorMessage: "cannot audit a 'response' event with no data: invalid internal parameter",
 		},
 		"basic-input": {
 			Input:                &logical.LogInput{},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "request to response-audit a nil request",
+			ExpectedErrorMessage: "unable to parse request from 'response' audit event: request cannot be nil",
 		},
 		"input-and-request-no-ns": {
 			Input:                &logical.LogInput{Request: &logical.Request{ID: "123"}},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "no namespace",
+			ExpectedErrorMessage: "unable to retrieve namespace from context: no namespace",
 			RootNamespace:        false,
 		},
 		"input-and-request-with-ns": {
-			Input:           &logical.LogInput{Request: &logical.Request{ID: "123"}},
+			Input: &logical.LogInput{
+				Request:  &logical.Request{ID: "123"},
+				Response: &logical.Response{},
+			},
+			IsErrorExpected: false,
+			RootNamespace:   true,
+		},
+		"omit-time": {
+			Input: &logical.LogInput{
+				Request:  &logical.Request{ID: "123"},
+				Response: &logical.Response{},
+			},
+			ShouldOmitTime:  true,
 			IsErrorExpected: false,
 			RootNamespace:   true,
 		},
@@ -558,29 +652,58 @@ func TestEntryFormatter_FormatResponse(t *testing.T) {
 			t.Parallel()
 
 			ss := newStaticSalt(t)
-			cfg, err := NewFormatterConfig()
+			cfg, err := newFormatterConfig(&testHeaderFormatter{}, nil)
+			cfg.omitTime = tc.ShouldOmitTime
 			require.NoError(t, err)
-			f, err := NewEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
+			f, err := newEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
 			require.NoError(t, err)
 
 			var ctx context.Context
 			switch {
 			case tc.RootNamespace:
-				ctx = namespace.RootContext(context.Background())
+				ctx = nshelper.RootContext(context.Background())
 			default:
 				ctx = context.Background()
 			}
 
-			entry, err := f.FormatResponse(ctx, tc.Input)
+			auditEvent, err := newEvent(ResponseType)
+			auditEvent.setTimeProvider(&testTimeProvider{})
+			require.NoError(t, err)
+			auditEvent.Data = tc.Input
+
+			e := &eventlogger.Event{
+				Type:      event.AuditType.AsEventType(),
+				CreatedAt: time.Now(),
+				Formatted: make(map[string][]byte),
+				Payload:   auditEvent,
+			}
+
+			e2, err := f.Process(ctx, e)
 
 			switch {
 			case tc.IsErrorExpected:
 				require.Error(t, err)
 				require.EqualError(t, err, tc.ExpectedErrorMessage)
-				require.Nil(t, entry)
+				require.Nil(t, e2)
+			case tc.ShouldOmitTime:
+				require.NoError(t, err)
+				require.NotNil(t, e2)
+				b, ok := e2.Format(jsonFormat.String())
+				require.True(t, ok)
+				var entry *entry
+				err = json.Unmarshal(b, &entry)
+				require.NoError(t, err)
+				require.Zero(t, entry.Time)
 			default:
 				require.NoError(t, err)
-				require.NotNil(t, entry)
+				require.NotNil(t, e2)
+				b, ok := e2.Format(jsonFormat.String())
+				require.True(t, ok)
+				var entry *entry
+				err = json.Unmarshal(b, &entry)
+				require.NoError(t, err)
+				require.NotZero(t, entry.Time)
+				require.Equal(t, "2024-03-22T10:00:05.00000001Z", entry.Time)
 			}
 		})
 	}
@@ -668,9 +791,12 @@ func TestEntryFormatter_Process_JSON(t *testing.T) {
 	}
 
 	for name, tc := range cases {
-		cfg, err := NewFormatterConfig(WithHMACAccessor(false))
+		cfg, err := newFormatterConfig(&testHeaderFormatter{}, map[string]string{
+			"hmac_accessor": "false",
+			"prefix":        tc.Prefix,
+		})
 		require.NoError(t, err)
-		formatter, err := NewEntryFormatter("juan", cfg, ss, hclog.NewNullLogger(), WithPrefix(tc.Prefix))
+		formatter, err := newEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
 		require.NoError(t, err)
 
 		in := &logical.LogInput{
@@ -681,21 +807,21 @@ func TestEntryFormatter_Process_JSON(t *testing.T) {
 
 		// Create an audit event and more generic eventlogger.event to allow us
 		// to process (format).
-		auditEvent, err := NewEvent(RequestType)
+		auditEvent, err := newEvent(RequestType)
 		require.NoError(t, err)
 		auditEvent.Data = in
 
 		e := &eventlogger.Event{
-			Type:      eventlogger.EventType(event.AuditType.String()),
+			Type:      event.AuditType.AsEventType(),
 			CreatedAt: time.Now(),
 			Formatted: make(map[string][]byte),
 			Payload:   auditEvent,
 		}
 
-		e2, err := formatter.Process(namespace.RootContext(nil), e)
+		e2, err := formatter.Process(nshelper.RootContext(nil), e)
 		require.NoErrorf(t, err, "bad: %s\nerr: %s", name, err)
 
-		jsonBytes, ok := e2.Format(JSONFormat.String())
+		jsonBytes, ok := e2.Format(jsonFormat.String())
 		require.True(t, ok)
 		require.Positive(t, len(jsonBytes))
 
@@ -703,14 +829,14 @@ func TestEntryFormatter_Process_JSON(t *testing.T) {
 			t.Fatalf("no prefix: %s \n log: %s\nprefix: %s", name, expectedResultStr, tc.Prefix)
 		}
 
-		expectedJSON := new(RequestEntry)
+		expectedJSON := new(entry)
 
 		if err := jsonutil.DecodeJSON([]byte(expectedResultStr), &expectedJSON); err != nil {
 			t.Fatalf("bad json: %s", err)
 		}
-		expectedJSON.Request.Namespace = &Namespace{ID: "root"}
+		expectedJSON.Request.Namespace = &namespace{ID: "root"}
 
-		actualJSON := new(RequestEntry)
+		actualJSON := new(entry)
 		if err := jsonutil.DecodeJSON(jsonBytes[len(tc.Prefix):], &actualJSON); err != nil {
 			t.Fatalf("bad json: %s", err)
 		}
@@ -825,13 +951,16 @@ func TestEntryFormatter_Process_JSONx(t *testing.T) {
 	}
 
 	for name, tc := range cases {
-		cfg, err := NewFormatterConfig(
-			WithOmitTime(true),
-			WithHMACAccessor(false),
-			WithFormat(JSONxFormat.String()),
-		)
+		cfg, err := newFormatterConfig(
+			&testHeaderFormatter{},
+			map[string]string{
+				"format":        "jsonx",
+				"hmac_accessor": "false",
+				"prefix":        tc.Prefix,
+			})
+		cfg.omitTime = true
 		require.NoError(t, err)
-		formatter, err := NewEntryFormatter("juan", cfg, tempStaticSalt, hclog.NewNullLogger(), WithPrefix(tc.Prefix))
+		formatter, err := newEntryFormatter("juan", cfg, tempStaticSalt, hclog.NewNullLogger())
 		require.NoError(t, err)
 		require.NotNil(t, formatter)
 
@@ -843,21 +972,21 @@ func TestEntryFormatter_Process_JSONx(t *testing.T) {
 
 		// Create an audit event and more generic eventlogger.event to allow us
 		// to process (format).
-		auditEvent, err := NewEvent(RequestType)
+		auditEvent, err := newEvent(RequestType)
 		require.NoError(t, err)
 		auditEvent.Data = in
 
 		e := &eventlogger.Event{
-			Type:      eventlogger.EventType(event.AuditType.String()),
+			Type:      event.AuditType.AsEventType(),
 			CreatedAt: time.Now(),
 			Formatted: make(map[string][]byte),
 			Payload:   auditEvent,
 		}
 
-		e2, err := formatter.Process(namespace.RootContext(nil), e)
+		e2, err := formatter.Process(nshelper.RootContext(nil), e)
 		require.NoErrorf(t, err, "bad: %s\nerr: %s", name, err)
 
-		jsonxBytes, ok := e2.Format(JSONxFormat.String())
+		jsonxBytes, ok := e2.Format(jsonxFormat.String())
 		require.True(t, ok)
 		require.Positive(t, len(jsonxBytes))
 
@@ -873,9 +1002,9 @@ func TestEntryFormatter_Process_JSONx(t *testing.T) {
 	}
 }
 
-// TestEntryFormatter_FormatResponse_ElideListResponses ensures that we correctly
-// elide data in responses to LIST operations.
-func TestEntryFormatter_FormatResponse_ElideListResponses(t *testing.T) {
+// TestEntryFormatter_ElideListResponses ensures that we correctly elide data in
+// responses to LIST operations.
+func TestEntryFormatter_ElideListResponses(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
@@ -942,12 +1071,12 @@ func TestEntryFormatter_FormatResponse_ElideListResponses(t *testing.T) {
 	oneInterestingTestCase := tests["Enhanced list (has key_info)"]
 
 	ss := newStaticSalt(t)
-	ctx := namespace.RootContext(context.Background())
-	var formatter *EntryFormatter
+	ctx := nshelper.RootContext(context.Background())
+	var formatter *entryFormatter
 	var err error
 
-	format := func(t *testing.T, config FormatterConfig, operation logical.Operation, inputData map[string]any) *ResponseEntry {
-		formatter, err = NewEntryFormatter("juan", config, ss, hclog.NewNullLogger())
+	format := func(t *testing.T, config formatterConfig, operation logical.Operation, inputData map[string]any) *entry {
+		formatter, err = newEntryFormatter("juan", config, ss, hclog.NewNullLogger())
 		require.NoError(t, err)
 		require.NotNil(t, formatter)
 
@@ -956,14 +1085,19 @@ func TestEntryFormatter_FormatResponse_ElideListResponses(t *testing.T) {
 			Response: &logical.Response{Data: inputData},
 		}
 
-		resp, err := formatter.FormatResponse(ctx, in)
+		auditEvent, err := newEvent(ResponseType)
+		require.NoError(t, err)
+		auditEvent.Data = in
+
+		entry, err := formatter.createEntry(ctx, auditEvent)
 		require.NoError(t, err)
+		require.NotNil(t, entry)
 
-		return resp
+		return entry
 	}
 
 	t.Run("Default case", func(t *testing.T) {
-		config, err := NewFormatterConfig(WithElision(true))
+		config, err := newFormatterConfig(&testHeaderFormatter{}, map[string]string{"elide_list_responses": "true"})
 		require.NoError(t, err)
 		for name, tc := range tests {
 			name := name
@@ -976,23 +1110,31 @@ func TestEntryFormatter_FormatResponse_ElideListResponses(t *testing.T) {
 	})
 
 	t.Run("When Operation is not list, eliding does not happen", func(t *testing.T) {
-		config, err := NewFormatterConfig(WithElision(true))
+		config, err := newFormatterConfig(&testHeaderFormatter{}, map[string]string{"elide_list_responses": "true"})
 		require.NoError(t, err)
 		tc := oneInterestingTestCase
 		entry := format(t, config, logical.ReadOperation, tc.inputData)
-		assert.Equal(t, formatter.hashExpectedValueForComparison(tc.inputData), entry.Response.Data)
+		hashedExpected := formatter.hashExpectedValueForComparison(tc.inputData)
+		assert.Equal(t, hashedExpected, entry.Response.Data)
 	})
 
-	t.Run("When ElideListResponses is false, eliding does not happen", func(t *testing.T) {
-		config, err := NewFormatterConfig(WithElision(false), WithFormat(JSONFormat.String()))
+	t.Run("When elideListResponses is false, eliding does not happen", func(t *testing.T) {
+		config, err := newFormatterConfig(&testHeaderFormatter{}, map[string]string{
+			"elide_list_responses": "false",
+			"format":               "json",
+		})
 		require.NoError(t, err)
 		tc := oneInterestingTestCase
 		entry := format(t, config, logical.ListOperation, tc.inputData)
 		assert.Equal(t, formatter.hashExpectedValueForComparison(tc.inputData), entry.Response.Data)
 	})
 
-	t.Run("When Raw is true, eliding still happens", func(t *testing.T) {
-		config, err := NewFormatterConfig(WithElision(true), WithRaw(true), WithFormat(JSONFormat.String()))
+	t.Run("When raw is true, eliding still happens", func(t *testing.T) {
+		config, err := newFormatterConfig(&testHeaderFormatter{}, map[string]string{
+			"elide_list_responses": "true",
+			"format":               "json",
+			"log_raw":              "true",
+		})
 		require.NoError(t, err)
 		tc := oneInterestingTestCase
 		entry := format(t, config, logical.ListOperation, tc.inputData)
@@ -1001,15 +1143,15 @@ func TestEntryFormatter_FormatResponse_ElideListResponses(t *testing.T) {
 }
 
 // TestEntryFormatter_Process_NoMutation tests that the event returned by an
-// EntryFormatter.Process method is not the same as the one that it accepted.
+// entryFormatter.Process method is not the same as the one that it accepted.
 func TestEntryFormatter_Process_NoMutation(t *testing.T) {
 	t.Parallel()
 
 	// Create the formatter node.
-	cfg, err := NewFormatterConfig()
+	cfg, err := newFormatterConfig(&testHeaderFormatter{}, nil)
 	require.NoError(t, err)
 	ss := newStaticSalt(t)
-	formatter, err := NewEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
+	formatter, err := newEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
 	require.NoError(t, err)
 	require.NotNil(t, formatter)
 
@@ -1040,36 +1182,25 @@ func TestEntryFormatter_Process_NoMutation(t *testing.T) {
 
 	e := fakeEvent(t, RequestType, in)
 
-	e2, err := formatter.Process(namespace.RootContext(nil), e)
+	e2, err := formatter.Process(nshelper.RootContext(nil), e)
 	require.NoError(t, err)
 	require.NotNil(t, e2)
 
 	// Ensure the pointers are different.
 	require.NotEqual(t, e2, e)
-
-	// Do the same for the audit event in the payload.
-	a, ok := e.Payload.(*AuditEvent)
-	require.True(t, ok)
-	require.NotNil(t, a)
-
-	a2, ok := e2.Payload.(*AuditEvent)
-	require.True(t, ok)
-	require.NotNil(t, a2)
-
-	require.NotEqual(t, a2, a)
 }
 
-// TestEntryFormatter_Process_Panic tries to send data into the EntryFormatter
+// TestEntryFormatter_Process_Panic tries to send data into the entryFormatter
 // which will currently cause a panic when a response is formatted due to the
 // underlying hashing that is done with reflectwalk.
 func TestEntryFormatter_Process_Panic(t *testing.T) {
 	t.Parallel()
 
 	// Create the formatter node.
-	cfg, err := NewFormatterConfig()
+	cfg, err := newFormatterConfig(&testHeaderFormatter{}, nil)
 	require.NoError(t, err)
 	ss := newStaticSalt(t)
-	formatter, err := NewEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
+	formatter, err := newEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
 	require.NoError(t, err)
 	require.NotNil(t, formatter)
 
@@ -1103,6 +1234,7 @@ func TestEntryFormatter_Process_Panic(t *testing.T) {
 			Data: map[string]interface{}{},
 		},
 		Response: &logical.Response{
+			Auth: &logical.Auth{},
 			Data: map[string]any{
 				"token_bound_cidrs": []*sockaddr.SockAddrMarshaler{
 					{SockAddr: badAddr},
@@ -1113,15 +1245,62 @@ func TestEntryFormatter_Process_Panic(t *testing.T) {
 
 	e := fakeEvent(t, ResponseType, in)
 
-	e2, err := formatter.Process(namespace.RootContext(nil), e)
+	e2, err := formatter.Process(nshelper.RootContext(nil), e)
 	require.Error(t, err)
-	require.Contains(t, err.Error(), "audit.(EntryFormatter).Process: panic generating audit log: \"juan\"")
+	require.Contains(t, err.Error(), "panic generating audit log: \"juan\"")
 	require.Nil(t, e2)
 }
 
+// TestEntryFormatter_NewFormatterConfig_NilHeaderFormatter ensures we cannot
+// create a formatterConfig using NewFormatterConfig if we supply a nil formatter.
+func TestEntryFormatter_NewFormatterConfig_NilHeaderFormatter(t *testing.T) {
+	_, err := newFormatterConfig(nil, nil)
+	require.Error(t, err)
+}
+
+// TestEntryFormatter_Process_NeverLeaksHeaders ensures that if we never accidentally
+// leak headers if applying them means we don't have any. This is more like a sense
+// check to ensure the returned event doesn't somehow end up with the headers 'back'.
+func TestEntryFormatter_Process_NeverLeaksHeaders(t *testing.T) {
+	t.Parallel()
+
+	// Create the formatter node.
+	cfg, err := newFormatterConfig(&testHeaderFormatter{shouldReturnEmpty: true}, nil)
+	require.NoError(t, err)
+	ss := newStaticSalt(t)
+	formatter, err := newEntryFormatter("juan", cfg, ss, hclog.NewNullLogger())
+	require.NoError(t, err)
+	require.NotNil(t, formatter)
+
+	// Set up the input and verify we have a single foo:bar header.
+	var input *logical.LogInput
+	err = json.Unmarshal([]byte(testFormatJSONReqBasicStrFmt), &input)
+	require.NoError(t, err)
+	require.NotNil(t, input)
+	require.ElementsMatch(t, input.Request.Headers["foo"], []string{"bar"})
+
+	e := fakeEvent(t, RequestType, input)
+
+	// Process the node.
+	ctx := nshelper.RootContext(context.Background())
+	e2, err := formatter.Process(ctx, e)
+	require.NoError(t, err)
+	require.NotNil(t, e2)
+
+	// Now check we can retrieve the formatted JSON.
+	jsonFormatted, b2 := e2.Format(jsonFormat.String())
+	require.True(t, b2)
+	require.NotNil(t, jsonFormatted)
+	var input2 *logical.LogInput
+	err = json.Unmarshal(jsonFormatted, &input2)
+	require.NoError(t, err)
+	require.NotNil(t, input2)
+	require.Len(t, input2.Request.Headers, 0)
+}
+
 // hashExpectedValueForComparison replicates enough of the audit HMAC process on a piece of expected data in a test,
 // so that we can use assert.Equal to compare the expected and output values.
-func (f *EntryFormatter) hashExpectedValueForComparison(input map[string]any) map[string]any {
+func (f *entryFormatter) hashExpectedValueForComparison(input map[string]any) map[string]any {
 	// Copy input before modifying, since we may re-use the same data in another test
 	copied, err := copystructure.Copy(input)
 	if err != nil {
@@ -1149,9 +1328,9 @@ func fakeEvent(tb testing.TB, subtype subtype, input *logical.LogInput) *eventlo
 
 	date := time.Date(2023, time.July, 11, 15, 49, 10, 0o0, time.Local)
 
-	auditEvent, err := NewEvent(subtype,
-		WithID("123"),
-		WithNow(date),
+	auditEvent, err := newEvent(subtype,
+		withID("123"),
+		withNow(date),
 	)
 	require.NoError(tb, err)
 	require.NotNil(tb, auditEvent)
@@ -1161,6 +1340,7 @@ func fakeEvent(tb testing.TB, subtype subtype, input *logical.LogInput) *eventlo
 	require.Equal(tb, date, auditEvent.Timestamp)
 
 	auditEvent.Data = input
+	auditEvent.setTimeProvider(&testTimeProvider{})
 
 	e := &eventlogger.Event{
 		Type:      eventlogger.EventType(event.AuditType),
diff --git a/audit/errors.go b/audit/errors.go
new file mode 100644
index 00000000000..515b6270acf
--- /dev/null
+++ b/audit/errors.go
@@ -0,0 +1,34 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import "errors"
+
+var (
+	// ErrInternal should be used to represent an unexpected error that occurred
+	// within the audit system.
+	ErrInternal = errors.New("audit system internal error")
+
+	// ErrInvalidParameter should be used to represent an error in which the
+	// internal audit system is receiving invalid parameters from other parts of
+	// Vault which should have already been validated.
+	ErrInvalidParameter = errors.New("invalid internal parameter")
+
+	// ErrExternalOptions should be used to represent an error related to
+	// invalid configuration provided to Vault (i.e. by the Vault Operator).
+	ErrExternalOptions = errors.New("invalid configuration")
+)
+
+// ConvertToExternalError handles converting an audit related error that was generated
+// in Vault and should appear as-is in the server logs, to an error that can be
+// returned to calling clients (via the API/CLI).
+func ConvertToExternalError(err error) error {
+	// If the error is an internal error, the contents will have been logged, and
+	// we should probably shield the caller from the details.
+	if errors.Is(err, ErrInternal) {
+		return ErrInternal
+	}
+
+	return err
+}
diff --git a/audit/errors_test.go b/audit/errors_test.go
new file mode 100644
index 00000000000..c980d288420
--- /dev/null
+++ b/audit/errors_test.go
@@ -0,0 +1,26 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestErrors_ConvertToExternalError is used to check that we 'mute' errors which
+// have an internal error in their tree.
+func TestErrors_ConvertToExternalError(t *testing.T) {
+	t.Parallel()
+
+	err := fmt.Errorf("wrap this error: %w", ErrInternal)
+	res := ConvertToExternalError(err)
+	require.EqualError(t, res, "audit system internal error")
+
+	err = fmt.Errorf("test: %w", errors.New("this is just an error"))
+	res = ConvertToExternalError(err)
+	require.Equal(t, "test: this is just an error", res.Error())
+}
diff --git a/audit/event.go b/audit/event.go
index 8802ea4f5cd..e2ad698eb34 100644
--- a/audit/event.go
+++ b/audit/event.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/hashicorp/vault/internal/observability/event"
@@ -22,17 +23,37 @@ const (
 
 // Audit formats.
 const (
-	JSONFormat  format = "json"
-	JSONxFormat format = "jsonx"
+	jsonFormat  format = "json"
+	jsonxFormat format = "jsonx"
 )
 
-// AuditEvent is the audit event.
-type AuditEvent struct {
+// Check AuditEvent implements the timeProvider at compile time.
+var _ timeProvider = (*Event)(nil)
+
+// Event is the audit event.
+type Event struct {
 	ID        string            `json:"id"`
 	Version   string            `json:"version"`
 	Subtype   subtype           `json:"subtype"` // the subtype of the audit event.
 	Timestamp time.Time         `json:"timestamp"`
 	Data      *logical.LogInput `json:"data"`
+	prov      timeProvider
+}
+
+// setTimeProvider can be used to set a specific time provider which is used when
+// creating an entry.
+// NOTE: This is primarily used for testing to supply a known time value.
+func (a *Event) setTimeProvider(t timeProvider) {
+	a.prov = t
+}
+
+// timeProvider returns a configured time provider, or the default if not set.
+func (a *Event) timeProvider() timeProvider {
+	if a.prov == nil {
+		return a
+	}
+
+	return a.prov
 }
 
 // format defines types of format audit events support.
@@ -41,16 +62,14 @@ type format string
 // subtype defines the type of audit event.
 type subtype string
 
-// NewEvent should be used to create an audit event. The subtype field is needed
+// newEvent should be used to create an audit event. The subtype field is needed
 // for audit events. It will generate an ID if no ID is supplied. Supported
-// options: WithID, WithNow.
-func NewEvent(s subtype, opt ...Option) (*AuditEvent, error) {
-	const op = "audit.NewEvent"
-
+// options: withID, withNow.
+func newEvent(s subtype, opt ...option) (*Event, error) {
 	// Get the default options
 	opts, err := getOpts(opt...)
 	if err != nil {
-		return nil, fmt.Errorf("%s: error applying options: %w", op, err)
+		return nil, err
 	}
 
 	if opts.withID == "" {
@@ -58,11 +77,11 @@ func NewEvent(s subtype, opt ...Option) (*AuditEvent, error) {
 
 		opts.withID, err = event.NewID(string(event.AuditType))
 		if err != nil {
-			return nil, fmt.Errorf("%s: error creating ID for event: %w", op, err)
+			return nil, fmt.Errorf("error creating ID for event: %w", err)
 		}
 	}
 
-	audit := &AuditEvent{
+	audit := &Event{
 		ID:        opts.withID,
 		Timestamp: opts.withNow,
 		Version:   version,
@@ -70,34 +89,32 @@ func NewEvent(s subtype, opt ...Option) (*AuditEvent, error) {
 	}
 
 	if err := audit.validate(); err != nil {
-		return nil, fmt.Errorf("%s: %w", op, err)
+		return nil, err
 	}
 	return audit, nil
 }
 
 // validate attempts to ensure the audit event in its present state is valid.
-func (a *AuditEvent) validate() error {
-	const op = "audit.(AuditEvent).validate"
-
+func (a *Event) validate() error {
 	if a == nil {
-		return fmt.Errorf("%s: event is nil: %w", op, event.ErrInvalidParameter)
+		return fmt.Errorf("event is nil: %w", ErrInvalidParameter)
 	}
 
 	if a.ID == "" {
-		return fmt.Errorf("%s: missing ID: %w", op, event.ErrInvalidParameter)
+		return fmt.Errorf("missing ID: %w", ErrInvalidParameter)
 	}
 
 	if a.Version != version {
-		return fmt.Errorf("%s: event version unsupported: %w", op, event.ErrInvalidParameter)
+		return fmt.Errorf("event version unsupported: %w", ErrInvalidParameter)
 	}
 
 	if a.Timestamp.IsZero() {
-		return fmt.Errorf("%s: event timestamp cannot be the zero time instant: %w", op, event.ErrInvalidParameter)
+		return fmt.Errorf("event timestamp cannot be the zero time instant: %w", ErrInvalidParameter)
 	}
 
 	err := a.Subtype.validate()
 	if err != nil {
-		return fmt.Errorf("%s: %w", op, err)
+		return err
 	}
 
 	return nil
@@ -105,23 +122,21 @@ func (a *AuditEvent) validate() error {
 
 // validate ensures that subtype is one of the set of allowed event subtypes.
 func (t subtype) validate() error {
-	const op = "audit.(subtype).validate"
 	switch t {
 	case RequestType, ResponseType:
 		return nil
 	default:
-		return fmt.Errorf("%s: '%s' is not a valid event subtype: %w", op, t, event.ErrInvalidParameter)
+		return fmt.Errorf("invalid event subtype %q: %w", t, ErrInvalidParameter)
 	}
 }
 
 // validate ensures that format is one of the set of allowed event formats.
 func (f format) validate() error {
-	const op = "audit.(format).validate"
 	switch f {
-	case JSONFormat, JSONxFormat:
+	case jsonFormat, jsonxFormat:
 		return nil
 	default:
-		return fmt.Errorf("%s: '%s' is not a valid format: %w", op, f, event.ErrInvalidParameter)
+		return fmt.Errorf("invalid format %q: %w", f, ErrInvalidParameter)
 	}
 }
 
@@ -140,5 +155,30 @@ func (t subtype) MetricTag() string {
 		return "log_response"
 	}
 
+	return t.String()
+}
+
+// String returns the subtype as a human-readable string.
+func (t subtype) String() string {
+	switch t {
+	case RequestType:
+		return "request"
+	case ResponseType:
+		return "response"
+	}
+
 	return string(t)
 }
+
+// formattedTime returns the UTC time the AuditEvent was created in the RFC3339Nano
+// format (which removes trailing zeros from the seconds field).
+func (a *Event) formattedTime() string {
+	return a.Timestamp.UTC().Format(time.RFC3339Nano)
+}
+
+// isValidFormat provides a means to validate whether the supplied format is valid.
+// Examples of valid formats are JSON and JSONx.
+func isValidFormat(v string) bool {
+	err := format(strings.TrimSpace(strings.ToLower(v))).validate()
+	return err == nil
+}
diff --git a/audit/event_test.go b/audit/event_test.go
index 66bdf424c7f..31254bc66f5 100644
--- a/audit/event_test.go
+++ b/audit/event_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -15,7 +15,7 @@ func TestAuditEvent_new(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
-		Options              []Option
+		Options              []option
 		Subtype              subtype
 		Format               format
 		IsErrorExpected      bool
@@ -31,49 +31,49 @@ func TestAuditEvent_new(t *testing.T) {
 			Subtype:              subtype(""),
 			Format:               format(""),
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEvent: audit.(AuditEvent).validate: audit.(subtype).validate: '' is not a valid event subtype: invalid parameter",
+			ExpectedErrorMessage: "invalid event subtype \"\": invalid internal parameter",
 		},
-		"empty-Option": {
-			Options:              []Option{},
+		"empty-option": {
+			Options:              []option{},
 			Subtype:              subtype(""),
 			Format:               format(""),
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEvent: audit.(AuditEvent).validate: audit.(subtype).validate: '' is not a valid event subtype: invalid parameter",
+			ExpectedErrorMessage: "invalid event subtype \"\": invalid internal parameter",
 		},
 		"bad-id": {
-			Options:              []Option{WithID("")},
+			Options:              []option{withID("")},
 			Subtype:              ResponseType,
-			Format:               JSONFormat,
+			Format:               jsonFormat,
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.NewEvent: error applying options: id cannot be empty",
+			ExpectedErrorMessage: "id cannot be empty",
 		},
 		"good": {
-			Options: []Option{
-				WithID("audit_123"),
-				WithFormat(string(JSONFormat)),
-				WithSubtype(string(ResponseType)),
-				WithNow(time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local)),
+			Options: []option{
+				withID("audit_123"),
+				withFormat(string(jsonFormat)),
+				withSubtype(string(ResponseType)),
+				withNow(time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local)),
 			},
 			Subtype:           RequestType,
-			Format:            JSONxFormat,
+			Format:            jsonxFormat,
 			IsErrorExpected:   false,
 			ExpectedID:        "audit_123",
 			ExpectedTimestamp: time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local),
 			ExpectedSubtype:   RequestType,
-			ExpectedFormat:    JSONxFormat,
+			ExpectedFormat:    jsonxFormat,
 		},
 		"good-no-time": {
-			Options: []Option{
-				WithID("audit_123"),
-				WithFormat(string(JSONFormat)),
-				WithSubtype(string(ResponseType)),
+			Options: []option{
+				withID("audit_123"),
+				withFormat(string(jsonFormat)),
+				withSubtype(string(ResponseType)),
 			},
 			Subtype:         RequestType,
-			Format:          JSONxFormat,
+			Format:          jsonxFormat,
 			IsErrorExpected: false,
 			ExpectedID:      "audit_123",
 			ExpectedSubtype: RequestType,
-			ExpectedFormat:  JSONxFormat,
+			ExpectedFormat:  jsonxFormat,
 			IsNowExpected:   true,
 		},
 	}
@@ -84,7 +84,7 @@ func TestAuditEvent_new(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			audit, err := NewEvent(tc.Subtype, tc.Options...)
+			audit, err := newEvent(tc.Subtype, tc.Options...)
 			switch {
 			case tc.IsErrorExpected:
 				require.Error(t, err)
@@ -112,22 +112,22 @@ func TestAuditEvent_Validate(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
-		Value                *AuditEvent
+		Value                *Event
 		IsErrorExpected      bool
 		ExpectedErrorMessage string
 	}{
 		"nil": {
 			Value:                nil,
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(AuditEvent).validate: event is nil: invalid parameter",
+			ExpectedErrorMessage: "event is nil: invalid internal parameter",
 		},
 		"default": {
-			Value:                &AuditEvent{},
+			Value:                &Event{},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(AuditEvent).validate: missing ID: invalid parameter",
+			ExpectedErrorMessage: "missing ID: invalid internal parameter",
 		},
 		"id-empty": {
-			Value: &AuditEvent{
+			Value: &Event{
 				ID:        "",
 				Version:   version,
 				Subtype:   RequestType,
@@ -135,10 +135,10 @@ func TestAuditEvent_Validate(t *testing.T) {
 				Data:      nil,
 			},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(AuditEvent).validate: missing ID: invalid parameter",
+			ExpectedErrorMessage: "missing ID: invalid internal parameter",
 		},
 		"version-fiddled": {
-			Value: &AuditEvent{
+			Value: &Event{
 				ID:        "audit_123",
 				Version:   "magic-v2",
 				Subtype:   RequestType,
@@ -146,10 +146,10 @@ func TestAuditEvent_Validate(t *testing.T) {
 				Data:      nil,
 			},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(AuditEvent).validate: event version unsupported: invalid parameter",
+			ExpectedErrorMessage: "event version unsupported: invalid internal parameter",
 		},
 		"subtype-fiddled": {
-			Value: &AuditEvent{
+			Value: &Event{
 				ID:        "audit_123",
 				Version:   version,
 				Subtype:   subtype("moon"),
@@ -157,10 +157,10 @@ func TestAuditEvent_Validate(t *testing.T) {
 				Data:      nil,
 			},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(AuditEvent).validate: audit.(subtype).validate: 'moon' is not a valid event subtype: invalid parameter",
+			ExpectedErrorMessage: "invalid event subtype \"moon\": invalid internal parameter",
 		},
 		"default-time": {
-			Value: &AuditEvent{
+			Value: &Event{
 				ID:        "audit_123",
 				Version:   version,
 				Subtype:   ResponseType,
@@ -168,10 +168,10 @@ func TestAuditEvent_Validate(t *testing.T) {
 				Data:      nil,
 			},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(AuditEvent).validate: event timestamp cannot be the zero time instant: invalid parameter",
+			ExpectedErrorMessage: "event timestamp cannot be the zero time instant: invalid internal parameter",
 		},
 		"valid": {
-			Value: &AuditEvent{
+			Value: &Event{
 				ID:        "audit_123",
 				Version:   version,
 				Subtype:   ResponseType,
@@ -212,12 +212,12 @@ func TestAuditEvent_Validate_Subtype(t *testing.T) {
 		"empty": {
 			Value:                "",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(subtype).validate: '' is not a valid event subtype: invalid parameter",
+			ExpectedErrorMessage: "invalid event subtype \"\": invalid internal parameter",
 		},
 		"unsupported": {
 			Value:                "foo",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(subtype).validate: 'foo' is not a valid event subtype: invalid parameter",
+			ExpectedErrorMessage: "invalid event subtype \"foo\": invalid internal parameter",
 		},
 		"request": {
 			Value:           "AuditRequest",
@@ -259,12 +259,12 @@ func TestAuditEvent_Validate_Format(t *testing.T) {
 		"empty": {
 			Value:                "",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(format).validate: '' is not a valid format: invalid parameter",
+			ExpectedErrorMessage: "invalid format \"\": invalid internal parameter",
 		},
 		"unsupported": {
 			Value:                "foo",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(format).validate: 'foo' is not a valid format: invalid parameter",
+			ExpectedErrorMessage: "invalid format \"foo\": invalid internal parameter",
 		},
 		"json": {
 			Value:           "json",
@@ -332,3 +332,115 @@ func TestAuditEvent_Subtype_MetricTag(t *testing.T) {
 		})
 	}
 }
+
+// TestAuditEvent_Subtype_String is used to ensure that we get the string value
+// we expect for a subtype when it is used with the Stringer interface.
+// e.g. an AuditRequest subtype is 'request'
+func TestAuditEvent_Subtype_String(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		input          string
+		expectedOutput string
+	}{
+		"request": {
+			input:          "AuditRequest",
+			expectedOutput: "request",
+		},
+		"response": {
+			input:          "AuditResponse",
+			expectedOutput: "response",
+		},
+		"non-validated": {
+			input:          "juan",
+			expectedOutput: "juan",
+		},
+	}
+
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			st := subtype(tc.input)
+			require.Equal(t, tc.expectedOutput, st.String())
+		})
+	}
+}
+
+// TestAuditEvent_formattedTime is used to check the output from the formattedTime
+// method returns the correct format.
+func TestAuditEvent_formattedTime(t *testing.T) {
+	theTime := time.Date(2024, time.March, 22, 10, 0o0, 5, 10, time.UTC)
+	a, err := newEvent(ResponseType, withNow(theTime))
+	require.NoError(t, err)
+	require.NotNil(t, a)
+	require.Equal(t, "2024-03-22T10:00:05.00000001Z", a.formattedTime())
+}
+
+// TestEvent_IsValidFormat ensures that we can correctly determine valid and
+// invalid formats.
+func TestEvent_IsValidFormat(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		input    string
+		expected bool
+	}{
+		"empty": {
+			input:    "",
+			expected: false,
+		},
+		"whitespace": {
+			input:    "     ",
+			expected: false,
+		},
+		"invalid-test": {
+			input:    "test",
+			expected: false,
+		},
+		"valid-json": {
+			input:    "json",
+			expected: true,
+		},
+		"upper-json": {
+			input:    "JSON",
+			expected: true,
+		},
+		"mixed-json": {
+			input:    "Json",
+			expected: true,
+		},
+		"spacey-json": {
+			input:    "  json  ",
+			expected: true,
+		},
+		"valid-jsonx": {
+			input:    "jsonx",
+			expected: true,
+		},
+		"upper-jsonx": {
+			input:    "JSONX",
+			expected: true,
+		},
+		"mixed-jsonx": {
+			input:    "JsonX",
+			expected: true,
+		},
+		"spacey-jsonx": {
+			input:    "  jsonx  ",
+			expected: true,
+		},
+	}
+
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			res := isValidFormat(tc.input)
+			require.Equal(t, tc.expected, res)
+		})
+	}
+}
diff --git a/audit/hashstructure.go b/audit/hashstructure.go
index d49c02865c1..f36ab45be4a 100644
--- a/audit/hashstructure.go
+++ b/audit/hashstructure.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -11,14 +11,12 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-secure-stdlib/strutil"
-	"github.com/hashicorp/vault/sdk/helper/wrapping"
 	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/mitchellh/copystructure"
 	"github.com/mitchellh/reflectwalk"
 )
 
-// HashString hashes the given opaque string and returns it
-func HashString(ctx context.Context, salter Salter, data string) (string, error) {
+// hashString uses the Salter to hash the supplied opaque string and returns it.
+func hashString(ctx context.Context, salter Salter, data string) (string, error) {
 	salt, err := salter.Salt(ctx)
 	if err != nil {
 		return "", err
@@ -27,79 +25,68 @@ func HashString(ctx context.Context, salter Salter, data string) (string, error)
 	return salt.GetIdentifiedHMAC(data), nil
 }
 
-// HashAuth returns a hashed copy of the logical.Auth input.
-func HashAuth(ctx context.Context, salter Salter, in *logical.Auth, HMACAccessor bool) (*logical.Auth, error) {
-	if in == nil {
-		return nil, nil
+// hashAuth uses the Salter to hash the supplied auth (modifying it).
+// hmacAccessor is used to indicate whether the accessor should also be HMAC'd
+// when present.
+func hashAuth(ctx context.Context, salter Salter, auth *auth, hmacAccessor bool) error {
+	if auth == nil {
+		return nil
 	}
 
 	salt, err := salter.Salt(ctx)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	fn := salt.GetIdentifiedHMAC
-	auth := *in
 
 	if auth.ClientToken != "" {
 		auth.ClientToken = fn(auth.ClientToken)
 	}
-	if HMACAccessor && auth.Accessor != "" {
+	if hmacAccessor && auth.Accessor != "" {
 		auth.Accessor = fn(auth.Accessor)
 	}
-	return &auth, nil
+
+	return nil
 }
 
-// HashRequest returns a hashed copy of the logical.Request input.
-func HashRequest(ctx context.Context, salter Salter, in *logical.Request, HMACAccessor bool, nonHMACDataKeys []string) (*logical.Request, error) {
-	if in == nil {
-		return nil, nil
+// hashRequest uses the Salter to hash the supplied request (modifying it).
+// nonHMACDataKeys is used when hashing any 'Data' field within the request which
+// prevents those specific keys from HMAC'd.
+// hmacAccessor is used to indicate whether some accessors should also be HMAC'd
+// when present.
+// nonHMACDataKeys is used when hashing any 'Data' field within the request which
+// prevents those specific keys from HMAC'd.
+func hashRequest(ctx context.Context, salter Salter, req *request, hmacAccessor bool, nonHMACDataKeys []string) error {
+	if req == nil {
+		return nil
 	}
 
 	salt, err := salter.Salt(ctx)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	fn := salt.GetIdentifiedHMAC
-	req := *in
-
-	if req.Auth != nil {
-		cp, err := copystructure.Copy(req.Auth)
-		if err != nil {
-			return nil, err
-		}
-
-		req.Auth, err = HashAuth(ctx, salter, cp.(*logical.Auth), HMACAccessor)
-		if err != nil {
-			return nil, err
-		}
-	}
 
 	if req.ClientToken != "" {
 		req.ClientToken = fn(req.ClientToken)
 	}
-	if HMACAccessor && req.ClientTokenAccessor != "" {
+	if hmacAccessor && req.ClientTokenAccessor != "" {
 		req.ClientTokenAccessor = fn(req.ClientTokenAccessor)
 	}
 
 	if req.Data != nil {
-		copy, err := copystructure.Copy(req.Data)
+		err = hashMap(fn, req.Data, nonHMACDataKeys)
 		if err != nil {
-			return nil, err
+			return err
 		}
-
-		err = hashMap(fn, copy.(map[string]interface{}), nonHMACDataKeys)
-		if err != nil {
-			return nil, err
-		}
-		req.Data = copy.(map[string]interface{})
 	}
 
-	return &req, nil
+	return nil
 }
 
-func hashMap(hashFunc HashCallback, data map[string]interface{}, nonHMACDataKeys []string) error {
+func hashMap(hashFunc hashCallback, data map[string]interface{}, nonHMACDataKeys []string) error {
 	for k, v := range data {
 		if o, ok := v.(logical.OptMarshaler); ok {
 			marshaled, err := o.MarshalJSONWithOptions(&logical.MarshalOptions{
@@ -112,104 +99,87 @@ func hashMap(hashFunc HashCallback, data map[string]interface{}, nonHMACDataKeys
 		}
 	}
 
-	return HashStructure(data, hashFunc, nonHMACDataKeys)
+	return hashStructure(data, hashFunc, nonHMACDataKeys)
 }
 
-// HashResponse returns a hashed copy of the logical.Request input.
-func HashResponse(ctx context.Context, salter Salter, in *logical.Response, HMACAccessor bool, nonHMACDataKeys []string, elideListResponseData bool) (*logical.Response, error) {
-	if in == nil {
-		return nil, nil
+// hashResponse uses the Salter to hash the supplied response (modifying it).
+// hmacAccessor is used to indicate whether some accessors should also be HMAC'd
+// when present.
+// nonHMACDataKeys is used when hashing any 'Data' field within the response which
+// prevents those specific keys from HMAC'd.
+// See: /vault/docs/audit#eliding-list-response-bodies
+func hashResponse(ctx context.Context, salter Salter, resp *response, hmacAccessor bool, nonHMACDataKeys []string) error {
+	if resp == nil {
+		return nil
 	}
 
 	salt, err := salter.Salt(ctx)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	fn := salt.GetIdentifiedHMAC
-	resp := *in
-
-	if resp.Auth != nil {
-		cp, err := copystructure.Copy(resp.Auth)
-		if err != nil {
-			return nil, err
-		}
 
-		resp.Auth, err = HashAuth(ctx, salter, cp.(*logical.Auth), HMACAccessor)
-		if err != nil {
-			return nil, err
-		}
+	err = hashAuth(ctx, salter, resp.Auth, hmacAccessor)
+	if err != nil {
+		return err
 	}
 
 	if resp.Data != nil {
-		copy, err := copystructure.Copy(resp.Data)
-		if err != nil {
-			return nil, err
+		if b, ok := resp.Data[logical.HTTPRawBody].([]byte); ok {
+			resp.Data[logical.HTTPRawBody] = string(b)
 		}
 
-		mapCopy := copy.(map[string]interface{})
-		if b, ok := mapCopy[logical.HTTPRawBody].([]byte); ok {
-			mapCopy[logical.HTTPRawBody] = string(b)
-		}
-
-		// Processing list response data elision takes place at this point in the code for performance reasons:
-		// - take advantage of the deep copy of resp.Data that was going to be done anyway for hashing
-		// - but elide data before potentially spending time hashing it
-		if elideListResponseData {
-			doElideListResponseData(mapCopy)
-		}
-
-		err = hashMap(fn, mapCopy, nonHMACDataKeys)
+		err = hashMap(fn, resp.Data, nonHMACDataKeys)
 		if err != nil {
-			return nil, err
+			return err
 		}
-		resp.Data = mapCopy
 	}
 
 	if resp.WrapInfo != nil {
 		var err error
-		resp.WrapInfo, err = hashWrapInfo(fn, resp.WrapInfo, HMACAccessor)
+		err = hashWrapInfo(fn, resp.WrapInfo, hmacAccessor)
 		if err != nil {
-			return nil, err
+			return err
 		}
 	}
 
-	return &resp, nil
+	return nil
 }
 
-// hashWrapInfo returns a hashed copy of the wrapping.ResponseWrapInfo input.
-func hashWrapInfo(hashFunc HashCallback, in *wrapping.ResponseWrapInfo, HMACAccessor bool) (*wrapping.ResponseWrapInfo, error) {
-	if in == nil {
-		return nil, nil
+// hashWrapInfo uses the supplied hashing function to hash responseWrapInfo (modifying it).
+// hmacAccessor is used to indicate whether some accessors should also be HMAC'd
+// when present.
+func hashWrapInfo(hashFunc hashCallback, wrapInfo *responseWrapInfo, hmacAccessor bool) error {
+	if wrapInfo == nil {
+		return nil
 	}
 
-	wrapinfo := *in
-
-	wrapinfo.Token = hashFunc(wrapinfo.Token)
+	wrapInfo.Token = hashFunc(wrapInfo.Token)
 
-	if HMACAccessor {
-		wrapinfo.Accessor = hashFunc(wrapinfo.Accessor)
+	if hmacAccessor {
+		wrapInfo.Accessor = hashFunc(wrapInfo.Accessor)
 
-		if wrapinfo.WrappedAccessor != "" {
-			wrapinfo.WrappedAccessor = hashFunc(wrapinfo.WrappedAccessor)
+		if wrapInfo.WrappedAccessor != "" {
+			wrapInfo.WrappedAccessor = hashFunc(wrapInfo.WrappedAccessor)
 		}
 	}
 
-	return &wrapinfo, nil
+	return nil
 }
 
-// HashStructure takes an interface and hashes all the values within
+// hashStructure takes an interface and hashes all the values within
 // the structure. Only _values_ are hashed: keys of objects are not.
 //
-// For the HashCallback, see the built-in HashCallbacks below.
-func HashStructure(s interface{}, cb HashCallback, ignoredKeys []string) error {
+// For the hashCallback, see the built-in HashCallbacks below.
+func hashStructure(s interface{}, cb hashCallback, ignoredKeys []string) error {
 	walker := &hashWalker{Callback: cb, IgnoredKeys: ignoredKeys}
 	return reflectwalk.Walk(s, walker)
 }
 
-// HashCallback is the callback called for HashStructure to hash
+// hashCallback is the callback called for hashStructure to hash
 // a value.
-type HashCallback func(string) string
+type hashCallback func(string) string
 
 // hashWalker implements interfaces for the reflectwalk package
 // (github.com/mitchellh/reflectwalk) that can be used to automatically
@@ -218,21 +188,27 @@ type hashWalker struct {
 	// Callback is the function to call with the primitive that is
 	// to be hashed. If there is an error, walking will be halted
 	// immediately and the error returned.
-	Callback HashCallback
-	// IgnoreKeys are the keys that wont have the HashCallback applied
+	Callback hashCallback
+
+	// IgnoreKeys are the keys that won't have the hashCallback applied
 	IgnoredKeys []string
+
 	// MapElem appends the key itself (not the reflect.Value) to key.
 	// The last element in key is the most recently entered map key.
 	// Since Exit pops the last element of key, only nesting to another
 	// structure increases the size of this slice.
-	key       []string
+	key []string
+
 	lastValue reflect.Value
+
 	// Enter appends to loc and exit pops loc. The last element of loc is thus
 	// the current location.
 	loc []reflectwalk.Location
+
 	// Map and Slice append to cs, Exit pops the last element off cs.
 	// The last element in cs is the most recently entered map or slice.
 	cs []reflect.Value
+
 	// MapElem and SliceElem append to csKey. The last element in csKey is the
 	// most recently entered map key or slice index. Since Exit pops the last
 	// element of csKey, only nesting to another structure increases the size of
diff --git a/audit/hashstructure_test.go b/audit/hashstructure_test.go
index f437b3e14c1..5901599253f 100644
--- a/audit/hashstructure_test.go
+++ b/audit/hashstructure_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -7,17 +7,17 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/json"
-	"fmt"
 	"reflect"
 	"testing"
 	"time"
 
-	"github.com/go-test/deep"
+	nshelper "github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/salt"
 	"github.com/hashicorp/vault/sdk/helper/wrapping"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/mitchellh/copystructure"
+	"github.com/stretchr/testify/require"
 )
 
 func TestCopy_auth(t *testing.T) {
@@ -97,18 +97,21 @@ func TestCopy_response(t *testing.T) {
 	}
 }
 
-// TestSalter is a structure that implements the Salter interface in a trivial
+// testSalter is a structure that implements the Salter interface in a trivial
 // manner.
-type TestSalter struct{}
+type testSalter struct{}
 
 // Salt returns a salt.Salt pointer based on dummy data stored in an in-memory
 // storage instance.
-func (*TestSalter) Salt(ctx context.Context) (*salt.Salt, error) {
+func (*testSalter) Salt(ctx context.Context) (*salt.Salt, error) {
 	inmemStorage := &logical.InmemStorage{}
-	inmemStorage.Put(context.Background(), &logical.StorageEntry{
+	err := inmemStorage.Put(context.Background(), &logical.StorageEntry{
 		Key:   "salt",
 		Value: []byte("foo"),
 	})
+	if err != nil {
+		return nil, err
+	}
 
 	return salt.NewSalt(context.Background(), inmemStorage, &salt.Config{
 		HMAC:     sha256.New,
@@ -117,62 +120,74 @@ func (*TestSalter) Salt(ctx context.Context) (*salt.Salt, error) {
 }
 
 func TestHashString(t *testing.T) {
-	salter := &TestSalter{}
+	salter := &testSalter{}
 
-	out, err := HashString(context.Background(), salter, "foo")
+	out, err := hashString(context.Background(), salter, "foo")
 	if err != nil {
 		t.Fatalf("Error instantiating salt: %s", err)
 	}
 	if out != "hmac-sha256:08ba357e274f528065766c770a639abf6809b39ccfd37c2a3157c7f51954da0a" {
-		t.Fatalf("err: HashString output did not match expected")
+		t.Fatalf("err: hashString output did not match expected")
 	}
 }
 
 func TestHashAuth(t *testing.T) {
-	cases := []struct {
+	cases := map[string]struct {
 		Input        *logical.Auth
-		Output       *logical.Auth
+		Output       *auth
 		HMACAccessor bool
 	}{
-		{
-			&logical.Auth{ClientToken: "foo"},
-			&logical.Auth{ClientToken: "hmac-sha256:08ba357e274f528065766c770a639abf6809b39ccfd37c2a3157c7f51954da0a"},
-			false,
-		},
-		{
+		"no-accessor-hmac": {
 			&logical.Auth{
+				ClientToken: "foo",
+				Accessor:    "very-accessible",
 				LeaseOptions: logical.LeaseOptions{
 					TTL: 1 * time.Hour,
 				},
-
-				ClientToken: "foo",
+				TokenType: logical.TokenTypeService,
 			},
+			&auth{
+				ClientToken:   "hmac-sha256:08ba357e274f528065766c770a639abf6809b39ccfd37c2a3157c7f51954da0a",
+				Accessor:      "very-accessible",
+				TokenTTL:      3600,
+				TokenType:     "service",
+				RemainingUses: 5,
+			},
+			false,
+		},
+		"accessor-hmac": {
 			&logical.Auth{
+				Accessor:    "very-accessible",
+				ClientToken: "foo",
 				LeaseOptions: logical.LeaseOptions{
 					TTL: 1 * time.Hour,
 				},
-
-				ClientToken: "hmac-sha256:08ba357e274f528065766c770a639abf6809b39ccfd37c2a3157c7f51954da0a",
+				TokenType: logical.TokenTypeBatch,
 			},
-			false,
+			&auth{
+				ClientToken:   "hmac-sha256:08ba357e274f528065766c770a639abf6809b39ccfd37c2a3157c7f51954da0a",
+				Accessor:      "hmac-sha256:5d6d7c8da5b699ace193ea453bbf77082a8aaca42a474436509487d646a7c0af",
+				TokenTTL:      3600,
+				TokenType:     "batch",
+				RemainingUses: 5,
+			},
+			true,
 		},
 	}
 
 	inmemStorage := &logical.InmemStorage{}
-	inmemStorage.Put(context.Background(), &logical.StorageEntry{
+	err := inmemStorage.Put(context.Background(), &logical.StorageEntry{
 		Key:   "salt",
 		Value: []byte("foo"),
 	})
-	salter := &TestSalter{}
+	require.NoError(t, err)
+	salter := &testSalter{}
 	for _, tc := range cases {
-		input := fmt.Sprintf("%#v", tc.Input)
-		out, err := HashAuth(context.Background(), salter, tc.Input, tc.HMACAccessor)
-		if err != nil {
-			t.Fatalf("err: %s\n\n%s", err, input)
-		}
-		if !reflect.DeepEqual(out, tc.Output) {
-			t.Fatalf("bad:\nInput:\n%s\nOutput:\n%#v\nExpected output:\n%#v", input, out, tc.Output)
-		}
+		auditAuth, err := newAuth(tc.Input, 5)
+		require.NoError(t, err)
+		err = hashAuth(context.Background(), salter, auditAuth, tc.HMACAccessor)
+		require.NoError(t, err)
+		require.Equal(t, tc.Output, auditAuth)
 	}
 }
 
@@ -190,7 +205,7 @@ var _ logical.OptMarshaler = &testOptMarshaler{}
 func TestHashRequest(t *testing.T) {
 	cases := []struct {
 		Input           *logical.Request
-		Output          *logical.Request
+		Output          *request
 		NonHMACDataKeys []string
 		HMACAccessor    bool
 	}{
@@ -203,13 +218,17 @@ func TestHashRequest(t *testing.T) {
 					"om":               &testOptMarshaler{S: "bar", I: 1},
 				},
 			},
-			&logical.Request{
+			&request{
 				Data: map[string]interface{}{
 					"foo":              "hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317",
 					"baz":              "foobar",
 					"private_key_type": "hmac-sha256:995230dca56fffd310ff591aa404aab52b2abb41703c787cfa829eceb4595bf1",
 					"om":               json.RawMessage(`{"S":"hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317","I":1}`),
 				},
+				Namespace: &namespace{
+					ID:   nshelper.RootNamespace.ID,
+					Path: nshelper.RootNamespace.Path,
+				},
 			},
 			[]string{"baz"},
 			false,
@@ -217,86 +236,108 @@ func TestHashRequest(t *testing.T) {
 	}
 
 	inmemStorage := &logical.InmemStorage{}
-	inmemStorage.Put(context.Background(), &logical.StorageEntry{
+	err := inmemStorage.Put(context.Background(), &logical.StorageEntry{
 		Key:   "salt",
 		Value: []byte("foo"),
 	})
-	salter := &TestSalter{}
+	require.NoError(t, err)
+	salter := &testSalter{}
 	for _, tc := range cases {
-		input := fmt.Sprintf("%#v", tc.Input)
-		out, err := HashRequest(context.Background(), salter, tc.Input, tc.HMACAccessor, tc.NonHMACDataKeys)
-		if err != nil {
-			t.Fatalf("err: %s\n\n%s", err, input)
-		}
-		if diff := deep.Equal(out, tc.Output); len(diff) > 0 {
-			t.Fatalf("bad:\nInput:\n%s\nDiff:\n%#v", input, diff)
-		}
+		auditReq, err := newRequest(tc.Input, nshelper.RootNamespace)
+		require.NoError(t, err)
+		err = hashRequest(context.Background(), salter, auditReq, tc.HMACAccessor, tc.NonHMACDataKeys)
+		require.NoError(t, err)
+		require.Equal(t, tc.Output, auditReq)
 	}
 }
 
 func TestHashResponse(t *testing.T) {
 	now := time.Now()
 
-	cases := []struct {
-		Input           *logical.Response
-		Output          *logical.Response
-		NonHMACDataKeys []string
-		HMACAccessor    bool
-	}{
-		{
-			&logical.Response{
-				Data: map[string]interface{}{
-					"foo": "bar",
-					"baz": "foobar",
-					// Responses can contain time values, so test that with
-					// a known fixed value.
-					"bar": now,
-					"om":  &testOptMarshaler{S: "bar", I: 1},
-				},
-				WrapInfo: &wrapping.ResponseWrapInfo{
-					TTL:             60,
-					Token:           "bar",
-					Accessor:        "flimflam",
-					CreationTime:    now,
-					WrappedAccessor: "bar",
-				},
+	resp := &logical.Response{
+		Data: map[string]interface{}{
+			"foo": "bar",
+			"baz": "foobar",
+			// Responses can contain time values, so test that with a known fixed value.
+			"bar": now,
+			"om":  &testOptMarshaler{S: "bar", I: 1},
+		},
+		WrapInfo: &wrapping.ResponseWrapInfo{
+			TTL:             1 * time.Minute,
+			Token:           "bar",
+			Accessor:        "flimflam",
+			CreationTime:    now,
+			WrappedAccessor: "bar",
+		},
+		Auth: &logical.Auth{
+			ClientToken: "hvs.QWERTY-T1q5lEjIWux1Tjx-VGqAYJdd4FZtbp1wpD5Ym9pGh4KHGh2cy5TSjRndGoxaU44NzNscm5MSlRLQXZ0ZGg",
+			Accessor:    "ABClk9ZNLGOCuTrOEIAooJG3",
+			TokenType:   logical.TokenTypeService,
+		},
+		Secret: &logical.Secret{
+			LeaseOptions: logical.LeaseOptions{
+				TTL:       3,
+				MaxTTL:    5,
+				Renewable: false,
+				Increment: 1,
+				IssueTime: now,
 			},
-			&logical.Response{
-				Data: map[string]interface{}{
-					"foo": "hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317",
-					"baz": "foobar",
-					"bar": now.Format(time.RFC3339Nano),
-					"om":  json.RawMessage(`{"S":"hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317","I":1}`),
-				},
-				WrapInfo: &wrapping.ResponseWrapInfo{
-					TTL:             60,
-					Token:           "hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317",
-					Accessor:        "hmac-sha256:7c9c6fe666d0af73b3ebcfbfabe6885015558213208e6635ba104047b22f6390",
-					CreationTime:    now,
-					WrappedAccessor: "hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317",
-				},
+			InternalData: map[string]any{
+				"foo": "bar",
 			},
-			[]string{"baz"},
-			true,
+			LeaseID: "abc",
+		},
+	}
+
+	req := &logical.Request{MountPoint: "/foo/bar"}
+	req.SetMountClass("kv")
+	req.SetMountIsExternalPlugin(true)
+	req.SetMountRunningVersion("123")
+	req.SetMountRunningSha256("256-256!")
+
+	nonHMACDataKeys := []string{"baz"}
+
+	expected := &response{
+		Auth: &auth{
+			Accessor:    "hmac-sha256:253184715b2d5a6c3a2fc7afe0d2294085f5e886a1275ca735646a6f23be2587",
+			ClientToken: "hmac-sha256:2ce541100a8bcd687e8ec7712c8bb4c975a8d8599c02d98945e63ecd413bf0f3",
+			TokenType:   "service",
+		},
+		Data: map[string]interface{}{
+			"foo": "hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317",
+			"baz": "foobar",
+			"bar": now.Format(time.RFC3339Nano),
+			"om":  json.RawMessage(`{"S":"hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317","I":1}`),
+		},
+		WrapInfo: &responseWrapInfo{
+			TTL:             60,
+			Token:           "hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317",
+			Accessor:        "hmac-sha256:7c9c6fe666d0af73b3ebcfbfabe6885015558213208e6635ba104047b22f6390",
+			CreationTime:    now.UTC().Format(time.RFC3339Nano),
+			WrappedAccessor: "hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317",
+		},
+		MountClass:            "kv",
+		MountIsExternalPlugin: true,
+		MountPoint:            "/foo/bar",
+		MountRunningVersion:   "123",
+		MountRunningSha256:    "256-256!",
+		Secret: &secret{
+			LeaseID: "abc",
 		},
 	}
 
 	inmemStorage := &logical.InmemStorage{}
-	inmemStorage.Put(context.Background(), &logical.StorageEntry{
+	err := inmemStorage.Put(context.Background(), &logical.StorageEntry{
 		Key:   "salt",
 		Value: []byte("foo"),
 	})
-	salter := &TestSalter{}
-	for _, tc := range cases {
-		input := fmt.Sprintf("%#v", tc.Input)
-		out, err := HashResponse(context.Background(), salter, tc.Input, tc.HMACAccessor, tc.NonHMACDataKeys, false)
-		if err != nil {
-			t.Fatalf("err: %s\n\n%s", err, input)
-		}
-		if diff := deep.Equal(out, tc.Output); len(diff) > 0 {
-			t.Fatalf("bad:\nInput:\n%s\nDiff:\n%#v", input, diff)
-		}
-	}
+	require.NoError(t, err)
+	salter := &testSalter{}
+	auditResp, err := newResponse(resp, req, false)
+	require.NoError(t, err)
+	err = hashResponse(context.Background(), salter, auditResp, true, nonHMACDataKeys)
+	require.NoError(t, err)
+	require.Equal(t, expected, auditResp)
 }
 
 func TestHashWalker(t *testing.T) {
@@ -326,7 +367,7 @@ func TestHashWalker(t *testing.T) {
 	}
 
 	for _, tc := range cases {
-		err := HashStructure(tc.Input, func(string) string {
+		err := hashStructure(tc.Input, func(string) string {
 			return replaceText
 		}, nil)
 		if err != nil {
@@ -380,7 +421,7 @@ func TestHashWalker_TimeStructs(t *testing.T) {
 	}
 
 	for _, tc := range cases {
-		err := HashStructure(tc.Input, func(s string) string {
+		err := hashStructure(tc.Input, func(s string) string {
 			return s + replaceText
 		}, nil)
 		if err != nil {
diff --git a/audit/headers.go b/audit/headers.go
new file mode 100644
index 00000000000..1072c39bdeb
--- /dev/null
+++ b/audit/headers.go
@@ -0,0 +1,265 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// N.B.: While we could use textproto to get the canonical mime header, HTTP/2
+// requires all headers to be converted to lower case, so we just do that.
+
+const (
+	// auditedHeadersEntry is the key used in storage to store and retrieve the header config
+	auditedHeadersEntry = "audited-headers"
+
+	// AuditedHeadersSubPath is the path used to create a sub view within storage.
+	AuditedHeadersSubPath = "audited-headers-config/"
+)
+
+type durableStorer interface {
+	Get(ctx context.Context, key string) (*logical.StorageEntry, error)
+	Put(ctx context.Context, entry *logical.StorageEntry) error
+}
+
+// HeaderFormatter is an interface defining the methods of the
+// vault.HeadersConfig structure needed in this package.
+type HeaderFormatter interface {
+	// ApplyConfig returns a map of header values that consists of the
+	// intersection of the provided set of header values with a configured
+	// set of headers and will hash headers that have been configured as such.
+	ApplyConfig(context.Context, map[string][]string, Salter) (map[string][]string, error)
+}
+
+// AuditedHeadersKey returns the key at which audit header configuration is stored.
+func AuditedHeadersKey() string {
+	return AuditedHeadersSubPath + auditedHeadersEntry
+}
+
+type headerSettings struct {
+	// HMAC is used to indicate whether the value of the header should be HMAC'd.
+	HMAC bool `json:"hmac"`
+}
+
+// HeadersConfig is used by the Audit Broker to write only approved
+// headers to the audit logs. It uses a BarrierView to persist the settings.
+type HeadersConfig struct {
+	// headerSettings stores the current headers that should be audited, and their settings.
+	headerSettings map[string]*headerSettings
+
+	// view is the barrier view which should be used to access underlying audit header config data.
+	view durableStorer
+
+	sync.RWMutex
+}
+
+// NewHeadersConfig should be used to create HeadersConfig.
+func NewHeadersConfig(view durableStorer) (*HeadersConfig, error) {
+	if view == nil {
+		return nil, fmt.Errorf("barrier view cannot be nil")
+	}
+
+	// This should be the only place where the HeadersConfig struct is initialized.
+	// Store the view so that we can reload headers when we 'Invalidate'.
+	return &HeadersConfig{
+		view:           view,
+		headerSettings: make(map[string]*headerSettings),
+	}, nil
+}
+
+// Header attempts to retrieve a copy of the settings associated with the specified header.
+// The second boolean return parameter indicates whether the header existed in configuration,
+// it should be checked as when 'false' the returned settings will have the default values.
+func (a *HeadersConfig) Header(name string) (headerSettings, bool) {
+	a.RLock()
+	defer a.RUnlock()
+
+	var s headerSettings
+	v, ok := a.headerSettings[strings.ToLower(name)]
+
+	if ok {
+		s.HMAC = v.HMAC
+	}
+
+	return s, ok
+}
+
+// Headers returns all existing headers along with a copy of their current settings.
+func (a *HeadersConfig) Headers() map[string]headerSettings {
+	a.RLock()
+	defer a.RUnlock()
+
+	// We know how many entries the map should have.
+	headers := make(map[string]headerSettings, len(a.headerSettings))
+
+	// Clone the headers
+	for name, setting := range a.headerSettings {
+		headers[name] = headerSettings{HMAC: setting.HMAC}
+	}
+
+	return headers
+}
+
+// Add adds or overwrites a header in the config and updates the barrier view
+// NOTE: Add will acquire a write lock in order to update the underlying headers.
+func (a *HeadersConfig) Add(ctx context.Context, header string, hmac bool) error {
+	if header == "" {
+		return fmt.Errorf("header value cannot be empty")
+	}
+
+	// Grab a write lock
+	a.Lock()
+	defer a.Unlock()
+
+	if a.headerSettings == nil {
+		a.headerSettings = make(map[string]*headerSettings, 1)
+	}
+
+	a.headerSettings[strings.ToLower(header)] = &headerSettings{hmac}
+	entry, err := logical.StorageEntryJSON(auditedHeadersEntry, a.headerSettings)
+	if err != nil {
+		return fmt.Errorf("failed to persist audited headers config: %w", err)
+	}
+
+	if err := a.view.Put(ctx, entry); err != nil {
+		return fmt.Errorf("failed to persist audited headers config: %w", err)
+	}
+
+	return nil
+}
+
+// Remove deletes a header out of the header config and updates the barrier view
+// NOTE: Remove will acquire a write lock in order to update the underlying headers.
+func (a *HeadersConfig) Remove(ctx context.Context, header string) error {
+	if header == "" {
+		return fmt.Errorf("header value cannot be empty")
+	}
+
+	// Grab a write lock
+	a.Lock()
+	defer a.Unlock()
+
+	// Nothing to delete
+	if len(a.headerSettings) == 0 {
+		return nil
+	}
+
+	delete(a.headerSettings, strings.ToLower(header))
+	entry, err := logical.StorageEntryJSON(auditedHeadersEntry, a.headerSettings)
+	if err != nil {
+		return fmt.Errorf("failed to persist audited headers config: %w", err)
+	}
+
+	if err := a.view.Put(ctx, entry); err != nil {
+		return fmt.Errorf("failed to persist audited headers config: %w", err)
+	}
+
+	return nil
+}
+
+// DefaultHeaders can be used to retrieve the set of default headers that will be
+// added to HeadersConfig in order to allow them to appear in audit logs in a raw
+// format. If the Vault Operator adds their own setting for any of the defaults,
+// their setting will be honored.
+func (a *HeadersConfig) DefaultHeaders() map[string]*headerSettings {
+	// Support deprecated 'x-' prefix (https://datatracker.ietf.org/doc/html/rfc6648)
+	const correlationID = "correlation-id"
+	xCorrelationID := fmt.Sprintf("x-%s", correlationID)
+
+	return map[string]*headerSettings{
+		correlationID:  {},
+		xCorrelationID: {},
+		"user-agent":   {},
+	}
+}
+
+// Invalidate attempts to refresh the allowed audit headers and their settings.
+// NOTE: Invalidate will acquire a write lock in order to update the underlying headers.
+func (a *HeadersConfig) Invalidate(ctx context.Context) error {
+	a.Lock()
+	defer a.Unlock()
+
+	// Get the actual headers entries, e.g. sys/audited-headers-config/audited-headers
+	out, err := a.view.Get(ctx, auditedHeadersEntry)
+	if err != nil {
+		return fmt.Errorf("failed to read config: %w", err)
+	}
+
+	// If we cannot update the stored 'new' headers, we will clear the existing
+	// ones as part of invalidation.
+	headers := make(map[string]*headerSettings)
+	if out != nil {
+		err = out.DecodeJSON(&headers)
+		if err != nil {
+			return fmt.Errorf("failed to parse config: %w", err)
+		}
+	}
+
+	// Ensure that we are able to case-sensitively access the headers;
+	// necessary for the upgrade case
+	lowerHeaders := make(map[string]*headerSettings, len(headers))
+	for k, v := range headers {
+		lowerHeaders[strings.ToLower(k)] = v
+	}
+
+	// Ensure that we have default headers configured to appear in the audit log.
+	// Add them if they're missing.
+	for header, setting := range a.DefaultHeaders() {
+		if _, ok := lowerHeaders[header]; !ok {
+			lowerHeaders[header] = setting
+		}
+	}
+
+	a.headerSettings = lowerHeaders
+	return nil
+}
+
+// ApplyConfig returns a map of approved headers and their values, either HMAC'd or plaintext.
+// If the supplied headers are empty or nil, an empty set of headers will be returned.
+func (a *HeadersConfig) ApplyConfig(ctx context.Context, headers map[string][]string, salter Salter) (result map[string][]string, retErr error) {
+	// Return early if we don't have headers.
+	if len(headers) < 1 {
+		return map[string][]string{}, nil
+	}
+
+	// Grab a read lock
+	a.RLock()
+	defer a.RUnlock()
+
+	// Make a copy of the incoming headers with everything lower so we can
+	// case-insensitively compare
+	lowerHeaders := make(map[string][]string, len(headers))
+	for k, v := range headers {
+		lowerHeaders[strings.ToLower(k)] = v
+	}
+
+	result = make(map[string][]string, len(a.headerSettings))
+	for key, settings := range a.headerSettings {
+		if val, ok := lowerHeaders[key]; ok {
+			// copy the header values so we don't overwrite them
+			hVals := make([]string, len(val))
+			copy(hVals, val)
+
+			// Optionally hmac the values
+			if settings.HMAC {
+				for i, el := range hVals {
+					hVal, err := hashString(ctx, salter, el)
+					if err != nil {
+						return nil, err
+					}
+					hVals[i] = hVal
+				}
+			}
+
+			result[key] = hVals
+		}
+	}
+
+	return result, nil
+}
diff --git a/audit/headers_test.go b/audit/headers_test.go
new file mode 100644
index 00000000000..70a25673a70
--- /dev/null
+++ b/audit/headers_test.go
@@ -0,0 +1,654 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/vault/sdk/helper/salt"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+// mockStorage is a struct that is used to mock barrier storage.
+type mockStorage struct {
+	mock.Mock
+	v map[string][]byte
+}
+
+// List implements List from BarrierStorage interface.
+// ignore-nil-nil-function-check.
+func (m *mockStorage) List(_ context.Context, _ string) ([]string, error) {
+	return nil, nil
+}
+
+// Get implements Get from BarrierStorage interface.
+// ignore-nil-nil-function-check.
+func (m *mockStorage) Get(_ context.Context, key string) (*logical.StorageEntry, error) {
+	b, ok := m.v[key]
+	if !ok {
+		return nil, nil
+	}
+
+	var entry *logical.StorageEntry
+	err := json.Unmarshal(b, &entry)
+
+	return entry, err
+}
+
+// Put implements Put from BarrierStorage interface.
+func (m *mockStorage) Put(_ context.Context, entry *logical.StorageEntry) error {
+	b, err := json.Marshal(entry)
+	if err != nil {
+		return err
+	}
+
+	m.v[entry.Key] = b
+
+	return nil
+}
+
+// Delete implements Delete from BarrierStorage interface.
+func (m *mockStorage) Delete(_ context.Context, _ string) error {
+	return nil
+}
+
+func newMockStorage(t *testing.T) *mockStorage {
+	t.Helper()
+
+	return &mockStorage{
+		Mock: mock.Mock{},
+		v:    make(map[string][]byte),
+	}
+}
+
+func mockAuditedHeadersConfig(t *testing.T) *HeadersConfig {
+	return &HeadersConfig{
+		headerSettings: make(map[string]*headerSettings),
+		view:           newMockStorage(t),
+	}
+}
+
+func TestAuditedHeadersConfig_CRUD(t *testing.T) {
+	t.Parallel()
+
+	conf := mockAuditedHeadersConfig(t)
+
+	testAddHeaders(t, conf)
+	testRemoveHeaders(t, conf)
+}
+
+func testAddHeaders(t *testing.T, conf *HeadersConfig) {
+	t.Helper()
+
+	err := conf.Add(context.Background(), "X-Test-Header", false)
+	if err != nil {
+		t.Fatalf("Error when adding header to config: %s", err)
+	}
+
+	settings, ok := conf.headerSettings["x-test-header"]
+	if !ok {
+		t.Fatal("Expected header to be found in config")
+	}
+
+	if settings.HMAC {
+		t.Fatal("Expected HMAC to be set to false, got true")
+	}
+
+	out, err := conf.view.Get(context.Background(), auditedHeadersEntry)
+	if err != nil {
+		t.Fatalf("Could not retrieve headers entry from config: %s", err)
+	}
+	if out == nil {
+		t.Fatal("nil value")
+	}
+
+	headers := make(map[string]*headerSettings)
+	err = out.DecodeJSON(&headers)
+	if err != nil {
+		t.Fatalf("Error decoding header view: %s", err)
+	}
+
+	expected := map[string]*headerSettings{
+		"x-test-header": {
+			HMAC: false,
+		},
+	}
+
+	if !reflect.DeepEqual(headers, expected) {
+		t.Fatalf("Expected config didn't match actual. Expected: %#v, Got: %#v", expected, headers)
+	}
+
+	err = conf.Add(context.Background(), "X-Vault-Header", true)
+	if err != nil {
+		t.Fatalf("Error when adding header to config: %s", err)
+	}
+
+	settings, ok = conf.headerSettings["x-vault-header"]
+	if !ok {
+		t.Fatal("Expected header to be found in config")
+	}
+
+	if !settings.HMAC {
+		t.Fatal("Expected HMAC to be set to true, got false")
+	}
+
+	out, err = conf.view.Get(context.Background(), auditedHeadersEntry)
+	if err != nil {
+		t.Fatalf("Could not retrieve headers entry from config: %s", err)
+	}
+	if out == nil {
+		t.Fatal("nil value")
+	}
+
+	headers = make(map[string]*headerSettings)
+	err = out.DecodeJSON(&headers)
+	if err != nil {
+		t.Fatalf("Error decoding header view: %s", err)
+	}
+
+	expected["x-vault-header"] = &headerSettings{
+		HMAC: true,
+	}
+
+	if !reflect.DeepEqual(headers, expected) {
+		t.Fatalf("Expected config didn't match actual. Expected: %#v, Got: %#v", expected, headers)
+	}
+}
+
+func testRemoveHeaders(t *testing.T, conf *HeadersConfig) {
+	t.Helper()
+
+	err := conf.Remove(context.Background(), "X-Test-Header")
+	if err != nil {
+		t.Fatalf("Error when adding header to config: %s", err)
+	}
+
+	_, ok := conf.headerSettings["x-Test-HeAder"]
+	if ok {
+		t.Fatal("Expected header to not be found in config")
+	}
+
+	out, err := conf.view.Get(context.Background(), auditedHeadersEntry)
+	if err != nil {
+		t.Fatalf("Could not retrieve headers entry from config: %s", err)
+	}
+	if out == nil {
+		t.Fatal("nil value")
+	}
+
+	headers := make(map[string]*headerSettings)
+	err = out.DecodeJSON(&headers)
+	if err != nil {
+		t.Fatalf("Error decoding header view: %s", err)
+	}
+
+	expected := map[string]*headerSettings{
+		"x-vault-header": {
+			HMAC: true,
+		},
+	}
+
+	if !reflect.DeepEqual(headers, expected) {
+		t.Fatalf("Expected config didn't match actual. Expected: %#v, Got: %#v", expected, headers)
+	}
+
+	err = conf.Remove(context.Background(), "x-VaulT-Header")
+	if err != nil {
+		t.Fatalf("Error when adding header to config: %s", err)
+	}
+
+	_, ok = conf.headerSettings["x-vault-header"]
+	if ok {
+		t.Fatal("Expected header to not be found in config")
+	}
+
+	out, err = conf.view.Get(context.Background(), auditedHeadersEntry)
+	if err != nil {
+		t.Fatalf("Could not retrieve headers entry from config: %s", err)
+	}
+	if out == nil {
+		t.Fatal("nil value")
+	}
+
+	headers = make(map[string]*headerSettings)
+	err = out.DecodeJSON(&headers)
+	if err != nil {
+		t.Fatalf("Error decoding header view: %s", err)
+	}
+
+	expected = make(map[string]*headerSettings)
+
+	if !reflect.DeepEqual(headers, expected) {
+		t.Fatalf("Expected config didn't match actual. Expected: %#v, Got: %#v", expected, headers)
+	}
+}
+
+func TestAuditedHeadersConfig_ApplyConfig(t *testing.T) {
+	t.Parallel()
+
+	conf := mockAuditedHeadersConfig(t)
+
+	err := conf.Add(context.Background(), "X-TesT-Header", false)
+	require.NoError(t, err)
+	err = conf.Add(context.Background(), "X-Vault-HeAdEr", true)
+	require.NoError(t, err)
+
+	reqHeaders := map[string][]string{
+		"X-Test-Header":  {"foo"},
+		"X-Vault-Header": {"bar", "bar"},
+		"Content-Type":   {"json"},
+	}
+
+	salter := &testSalter{}
+
+	result, err := conf.ApplyConfig(context.Background(), reqHeaders, salter)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	const hmacPrefix = "hmac-sha256:"
+
+	expected := map[string][]string{
+		"x-test-header":  {"foo"},
+		"x-vault-header": {hmacPrefix, hmacPrefix},
+	}
+
+	if len(expected) != len(result) {
+		t.Fatalf("Expected headers count did not match actual count: Expected count %d\n Got %d\n", len(expected), len(result))
+	}
+
+	for resultKey, resultValues := range result {
+		expectedValues := expected[resultKey]
+
+		if len(expectedValues) != len(resultValues) {
+			t.Fatalf("Expected header values count did not match actual values count: Expected count: %d\n Got %d\n", len(expectedValues), len(resultValues))
+		}
+
+		for i, e := range expectedValues {
+			if e == hmacPrefix {
+				if !strings.HasPrefix(resultValues[i], e) {
+					t.Fatalf("Expected headers did not match actual: Expected %#v...\n Got %#v\n", e, resultValues[i])
+				}
+			} else {
+				if e != resultValues[i] {
+					t.Fatalf("Expected headers did not match actual: Expected %#v\n Got %#v\n", e, resultValues[i])
+				}
+			}
+		}
+	}
+
+	// Make sure we didn't edit the reqHeaders map
+	reqHeadersCopy := map[string][]string{
+		"X-Test-Header":  {"foo"},
+		"X-Vault-Header": {"bar", "bar"},
+		"Content-Type":   {"json"},
+	}
+
+	if !reflect.DeepEqual(reqHeaders, reqHeadersCopy) {
+		t.Fatalf("Req headers were changed, expected %#v\n got %#v", reqHeadersCopy, reqHeaders)
+	}
+}
+
+// TestAuditedHeadersConfig_ApplyConfig_NoHeaders tests the case where there are
+// no headers in the request.
+func TestAuditedHeadersConfig_ApplyConfig_NoRequestHeaders(t *testing.T) {
+	t.Parallel()
+
+	conf := mockAuditedHeadersConfig(t)
+
+	err := conf.Add(context.Background(), "X-TesT-Header", false)
+	require.NoError(t, err)
+	err = conf.Add(context.Background(), "X-Vault-HeAdEr", true)
+	require.NoError(t, err)
+
+	salter := &testSalter{}
+
+	// Test sending in nil headers first.
+	result, err := conf.ApplyConfig(context.Background(), nil, salter)
+	require.NoError(t, err)
+	require.NotNil(t, result)
+
+	result, err = conf.ApplyConfig(context.Background(), map[string][]string{}, salter)
+	require.NoError(t, err)
+	require.NotNil(t, result)
+	require.Len(t, result, 0)
+}
+
+func TestAuditedHeadersConfig_ApplyConfig_NoConfiguredHeaders(t *testing.T) {
+	t.Parallel()
+
+	conf := mockAuditedHeadersConfig(t)
+
+	reqHeaders := map[string][]string{
+		"X-Test-Header":  {"foo"},
+		"X-Vault-Header": {"bar", "bar"},
+		"Content-Type":   {"json"},
+	}
+
+	salter := &testSalter{}
+
+	result, err := conf.ApplyConfig(context.Background(), reqHeaders, salter)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(result) != 0 {
+		t.Fatalf("Expected no headers but actually got: %d\n", len(result))
+	}
+
+	// Make sure we didn't edit the reqHeaders map
+	reqHeadersCopy := map[string][]string{
+		"X-Test-Header":  {"foo"},
+		"X-Vault-Header": {"bar", "bar"},
+		"Content-Type":   {"json"},
+	}
+
+	if !reflect.DeepEqual(reqHeaders, reqHeadersCopy) {
+		t.Fatalf("Req headers were changed, expected %#v\n got %#v", reqHeadersCopy, reqHeaders)
+	}
+}
+
+// FailingSalter is an implementation of the Salter interface where the Salt
+// method always returns an error.
+type FailingSalter struct{}
+
+// Salt always returns an error.
+func (s *FailingSalter) Salt(context.Context) (*salt.Salt, error) {
+	return nil, errors.New("testing error")
+}
+
+// TestAuditedHeadersConfig_ApplyConfig_HashStringError tests the case where
+// an error is returned from hashString instead of a map of headers.
+func TestAuditedHeadersConfig_ApplyConfig_HashStringError(t *testing.T) {
+	t.Parallel()
+
+	conf := mockAuditedHeadersConfig(t)
+
+	err := conf.Add(context.Background(), "X-TesT-Header", false)
+	require.NoError(t, err)
+	err = conf.Add(context.Background(), "X-Vault-HeAdEr", true)
+	require.NoError(t, err)
+
+	reqHeaders := map[string][]string{
+		"X-Test-Header":  {"foo"},
+		"X-Vault-Header": {"bar", "bar"},
+		"Content-Type":   {"json"},
+	}
+
+	salter := &FailingSalter{}
+
+	_, err = conf.ApplyConfig(context.Background(), reqHeaders, salter)
+	if err == nil {
+		t.Fatal("expected error from ApplyConfig")
+	}
+}
+
+func BenchmarkAuditedHeaderConfig_ApplyConfig(b *testing.B) {
+	conf := &HeadersConfig{
+		headerSettings: make(map[string]*headerSettings),
+		view:           nil,
+	}
+
+	conf.headerSettings = map[string]*headerSettings{
+		"X-Test-Header":  {false},
+		"X-Vault-Header": {true},
+	}
+
+	reqHeaders := map[string][]string{
+		"X-Test-Header":  {"foo"},
+		"X-Vault-Header": {"bar", "bar"},
+		"Content-Type":   {"json"},
+	}
+
+	salter := &testSalter{}
+
+	// Reset the timer since we did a lot above
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := conf.ApplyConfig(context.Background(), reqHeaders, salter)
+		require.NoError(b, err)
+	}
+}
+
+// TestAuditedHeaders_auditedHeadersKey is used to check the key we use to handle
+// invalidation doesn't change when we weren't expecting it to.
+func TestAuditedHeaders_auditedHeadersKey(t *testing.T) {
+	t.Parallel()
+
+	require.Equal(t, "audited-headers-config/audited-headers", AuditedHeadersKey())
+}
+
+// TestAuditedHeaders_NewAuditedHeadersConfig checks supplying incorrect params to
+// the constructor for HeadersConfig returns an error.
+func TestAuditedHeaders_NewAuditedHeadersConfig(t *testing.T) {
+	t.Parallel()
+
+	ac, err := NewHeadersConfig(nil)
+	require.Error(t, err)
+	require.Nil(t, ac)
+
+	ac, err = NewHeadersConfig(newMockStorage(t))
+	require.NoError(t, err)
+	require.NotNil(t, ac)
+}
+
+// TestAuditedHeaders_invalidate ensures that we can update the headers on HeadersConfig
+// when we invalidate, and load the updated headers from the view/storage.
+func TestAuditedHeaders_invalidate(t *testing.T) {
+	t.Parallel()
+
+	view := newMockStorage(t)
+	ahc, err := NewHeadersConfig(view)
+	require.NoError(t, err)
+	require.Len(t, ahc.headerSettings, 0)
+
+	// Store some data using the view.
+	fakeHeaders1 := map[string]*headerSettings{"x-magic-header": {}}
+	fakeBytes1, err := json.Marshal(fakeHeaders1)
+	require.NoError(t, err)
+	err = view.Put(context.Background(), &logical.StorageEntry{Key: auditedHeadersEntry, Value: fakeBytes1})
+	require.NoError(t, err)
+
+	// Invalidate and check we now see the header we stored
+	err = ahc.Invalidate(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, len(ahc.DefaultHeaders())+1, len(ahc.headerSettings)) // (defaults + 1).
+	_, ok := ahc.headerSettings["x-magic-header"]
+	require.True(t, ok)
+
+	// Do it again with more headers and random casing.
+	fakeHeaders2 := map[string]*headerSettings{
+		"x-magic-header":           {},
+		"x-even-MORE-magic-header": {},
+	}
+	fakeBytes2, err := json.Marshal(fakeHeaders2)
+	require.NoError(t, err)
+	err = view.Put(context.Background(), &logical.StorageEntry{Key: auditedHeadersEntry, Value: fakeBytes2})
+	require.NoError(t, err)
+
+	// Invalidate and check we now see the header we stored
+	err = ahc.Invalidate(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, len(ahc.DefaultHeaders())+2, len(ahc.headerSettings)) // (defaults + 2 new headers)
+	_, ok = ahc.headerSettings["x-magic-header"]
+	require.True(t, ok)
+	_, ok = ahc.headerSettings["x-even-more-magic-header"]
+	require.True(t, ok)
+}
+
+// TestAuditedHeaders_invalidate_nil_view ensures that we invalidate the headers
+// correctly (clear them) when we get nil for the storage entry from the view.
+func TestAuditedHeaders_invalidate_nil_view(t *testing.T) {
+	t.Parallel()
+
+	view := newMockStorage(t)
+	ahc, err := NewHeadersConfig(view)
+	require.NoError(t, err)
+	require.Len(t, ahc.headerSettings, 0)
+
+	// Store some data using the view.
+	fakeHeaders1 := map[string]*headerSettings{"x-magic-header": {}}
+	fakeBytes1, err := json.Marshal(fakeHeaders1)
+	require.NoError(t, err)
+	err = view.Put(context.Background(), &logical.StorageEntry{Key: auditedHeadersEntry, Value: fakeBytes1})
+	require.NoError(t, err)
+
+	// Invalidate and check we now see the header we stored
+	err = ahc.Invalidate(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, len(ahc.DefaultHeaders())+1, len(ahc.headerSettings)) // defaults + 1
+	_, ok := ahc.headerSettings["x-magic-header"]
+	require.True(t, ok)
+
+	// Swap out the view with a mock that returns nil when we try to invalidate.
+	// This should mean we end up just clearing the headers (no errors).
+	mockStorageBarrier := newMockStorage(t)
+	mockStorageBarrier.On("Get", mock.Anything, mock.Anything).Return(nil, nil)
+	ahc.view = mockStorageBarrier
+	// ahc.view = NewBarrierView(mockStorageBarrier, AuditedHeadersSubPath)
+
+	// Invalidate should clear out the existing headers without error
+	err = ahc.Invalidate(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, len(ahc.DefaultHeaders()), len(ahc.headerSettings)) // defaults
+}
+
+// TestAuditedHeaders_invalidate_bad_data ensures that we correctly error if the
+// underlying data cannot be parsed as expected.
+func TestAuditedHeaders_invalidate_bad_data(t *testing.T) {
+	t.Parallel()
+
+	view := newMockStorage(t)
+	ahc, err := NewHeadersConfig(view)
+	require.NoError(t, err)
+	require.Len(t, ahc.headerSettings, 0)
+
+	// Store some bad data using the view.
+	badBytes, err := json.Marshal("i am bad")
+	require.NoError(t, err)
+	err = view.Put(context.Background(), &logical.StorageEntry{Key: auditedHeadersEntry, Value: badBytes})
+	require.NoError(t, err)
+
+	// Invalidate should
+	err = ahc.Invalidate(context.Background())
+	require.Error(t, err)
+	require.ErrorContains(t, err, "failed to parse config")
+}
+
+// TestAuditedHeaders_header checks we can return a copy of settings associated with
+// an existing header, and we also know when a header wasn't found.
+func TestAuditedHeaders_header(t *testing.T) {
+	t.Parallel()
+
+	view := newMockStorage(t)
+	ahc, err := NewHeadersConfig(view)
+	require.NoError(t, err)
+	require.Len(t, ahc.headerSettings, 0)
+
+	err = ahc.Add(context.Background(), "juan", true)
+	require.NoError(t, err)
+	require.Len(t, ahc.headerSettings, 1)
+
+	s, ok := ahc.Header("juan")
+	require.True(t, ok)
+	require.Equal(t, true, s.HMAC)
+
+	s, ok = ahc.Header("x-magic-token")
+	require.False(t, ok)
+}
+
+// TestAuditedHeaders_headers checks we are able to return a copy of the existing
+// configured headers.
+func TestAuditedHeaders_headers(t *testing.T) {
+	t.Parallel()
+
+	view := newMockStorage(t)
+	ahc, err := NewHeadersConfig(view)
+	require.NoError(t, err)
+	require.Len(t, ahc.headerSettings, 0)
+
+	err = ahc.Add(context.Background(), "juan", true)
+	require.NoError(t, err)
+	err = ahc.Add(context.Background(), "john", false)
+	require.NoError(t, err)
+	require.Len(t, ahc.headerSettings, 2)
+
+	s := ahc.Headers()
+	require.Len(t, s, 2)
+	require.Equal(t, true, s["juan"].HMAC)
+	require.Equal(t, false, s["john"].HMAC)
+}
+
+// TestAuditedHeaders_invalidate_defaults checks that we ensure any 'default' headers
+// are present after invalidation, and if they were loaded from storage then they
+// do not get overwritten with our defaults.
+func TestAuditedHeaders_invalidate_defaults(t *testing.T) {
+	t.Parallel()
+
+	view := newMockStorage(t)
+	ahc, err := NewHeadersConfig(view)
+	require.NoError(t, err)
+	require.Len(t, ahc.headerSettings, 0)
+
+	// Store some data using the view.
+	fakeHeaders1 := map[string]*headerSettings{"x-magic-header": {}}
+	fakeBytes1, err := json.Marshal(fakeHeaders1)
+	require.NoError(t, err)
+	err = view.Put(context.Background(), &logical.StorageEntry{Key: auditedHeadersEntry, Value: fakeBytes1})
+	require.NoError(t, err)
+
+	// Invalidate and check we now see the header we stored
+	err = ahc.Invalidate(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, len(ahc.DefaultHeaders())+1, len(ahc.headerSettings)) // (defaults + 1 new header)
+	_, ok := ahc.headerSettings["x-magic-header"]
+	require.True(t, ok)
+
+	s, ok := ahc.headerSettings["x-correlation-id"]
+	require.True(t, ok)
+	require.False(t, s.HMAC)
+
+	s, ok = ahc.headerSettings["user-agent"]
+	require.True(t, ok)
+	require.False(t, s.HMAC)
+
+	// Add correlation ID and user-agent specifically with HMAC and make sure it doesn't get blasted away.
+	fakeHeaders1 = map[string]*headerSettings{
+		"x-magic-header": {},
+		"X-Correlation-ID": {
+			HMAC: true,
+		},
+		"User-Agent": {
+			HMAC: true,
+		},
+	}
+
+	fakeBytes1, err = json.Marshal(fakeHeaders1)
+
+	require.NoError(t, err)
+	err = view.Put(context.Background(), &logical.StorageEntry{Key: auditedHeadersEntry, Value: fakeBytes1})
+	require.NoError(t, err)
+
+	// Invalidate and check we now see the header we stored
+	err = ahc.Invalidate(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, len(ahc.DefaultHeaders())+1, len(ahc.headerSettings)) // (defaults + 1 new header, 1 is also a default)
+	_, ok = ahc.headerSettings["x-magic-header"]
+	require.True(t, ok)
+
+	s, ok = ahc.headerSettings["x-correlation-id"]
+	require.True(t, ok)
+	require.True(t, s.HMAC)
+
+	s, ok = ahc.headerSettings["user-agent"]
+	require.True(t, ok)
+	require.True(t, s.HMAC)
+}
diff --git a/audit/nodes.go b/audit/nodes.go
index 624777e7251..335e3d9299c 100644
--- a/audit/nodes.go
+++ b/audit/nodes.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -14,14 +14,14 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
-// ProcessManual will attempt to create an (audit) event with the specified data
+// processManual will attempt to create an (audit) event with the specified data
 // and manually iterate over the supplied nodes calling Process on each until the
 // event is nil (which indicates the pipeline has completed).
 // Order of IDs in the NodeID slice determines the order they are processed.
 // (Audit) Event will be of RequestType (as opposed to ResponseType).
 // The last node must be a filter node (eventlogger.NodeTypeFilter) or
 // sink node (eventlogger.NodeTypeSink).
-func ProcessManual(ctx context.Context, data *logical.LogInput, ids []eventlogger.NodeID, nodes map[eventlogger.NodeID]eventlogger.Node) error {
+func processManual(ctx context.Context, data *logical.LogInput, ids []eventlogger.NodeID, nodes map[eventlogger.NodeID]eventlogger.Node) error {
 	switch {
 	case data == nil:
 		return errors.New("data cannot be nil")
@@ -34,7 +34,7 @@ func ProcessManual(ctx context.Context, data *logical.LogInput, ids []eventlogge
 	}
 
 	// Create an audit event.
-	a, err := NewEvent(RequestType)
+	a, err := newEvent(RequestType)
 	if err != nil {
 		return err
 	}
@@ -44,7 +44,7 @@ func ProcessManual(ctx context.Context, data *logical.LogInput, ids []eventlogge
 
 	// Create an eventlogger event with the audit event as the payload.
 	e := &eventlogger.Event{
-		Type:      eventlogger.EventType(event.AuditType.String()),
+		Type:      event.AuditType.AsEventType(),
 		CreatedAt: time.Now(),
 		Formatted: make(map[string][]byte),
 		Payload:   a,
@@ -71,7 +71,7 @@ func ProcessManual(ctx context.Context, data *logical.LogInput, ids []eventlogge
 		switch node.Type() {
 		case eventlogger.NodeTypeFormatter:
 			// Use a temporary formatter node  which doesn't persist its salt anywhere.
-			if formatNode, ok := node.(*EntryFormatter); ok && formatNode != nil {
+			if formatNode, ok := node.(*entryFormatter); ok && formatNode != nil {
 				e, err = newTemporaryEntryFormatter(formatNode).Process(ctx, e)
 			}
 		default:
diff --git a/audit/nodes_test.go b/audit/nodes_test.go
index 17d2f78addc..7687adbcb48 100644
--- a/audit/nodes_test.go
+++ b/audit/nodes_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -9,13 +9,13 @@ import (
 
 	"github.com/hashicorp/eventlogger"
 	"github.com/hashicorp/go-uuid"
-	"github.com/hashicorp/vault/helper/namespace"
+	nshelper "github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/internal/observability/event"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/stretchr/testify/require"
 )
 
-// TestProcessManual_NilData tests ProcessManual when nil data is supplied.
+// TestProcessManual_NilData tests processManual when nil data is supplied.
 func TestProcessManual_NilData(t *testing.T) {
 	t.Parallel()
 
@@ -32,12 +32,12 @@ func TestProcessManual_NilData(t *testing.T) {
 	ids = append(ids, sinkId)
 	nodes[sinkId] = sinkNode
 
-	err := ProcessManual(namespace.RootContext(context.Background()), nil, ids, nodes)
+	err := processManual(nshelper.RootContext(context.Background()), nil, ids, nodes)
 	require.Error(t, err)
 	require.EqualError(t, err, "data cannot be nil")
 }
 
-// TestProcessManual_BadIDs tests ProcessManual when different bad values are
+// TestProcessManual_BadIDs tests processManual when different bad values are
 // supplied for the ID parameter.
 func TestProcessManual_BadIDs(t *testing.T) {
 	t.Parallel()
@@ -76,14 +76,14 @@ func TestProcessManual_BadIDs(t *testing.T) {
 			require.NoError(t, err)
 			data := newData(requestId)
 
-			err = ProcessManual(namespace.RootContext(context.Background()), data, tc.IDs, nodes)
+			err = processManual(nshelper.RootContext(context.Background()), data, tc.IDs, nodes)
 			require.Error(t, err)
 			require.EqualError(t, err, tc.ExpectedErrorMessage)
 		})
 	}
 }
 
-// TestProcessManual_NoNodes tests ProcessManual when no nodes are supplied.
+// TestProcessManual_NoNodes tests processManual when no nodes are supplied.
 func TestProcessManual_NoNodes(t *testing.T) {
 	t.Parallel()
 
@@ -103,12 +103,12 @@ func TestProcessManual_NoNodes(t *testing.T) {
 	require.NoError(t, err)
 	data := newData(requestId)
 
-	err = ProcessManual(namespace.RootContext(context.Background()), data, ids, nodes)
+	err = processManual(nshelper.RootContext(context.Background()), data, ids, nodes)
 	require.Error(t, err)
 	require.EqualError(t, err, "nodes are required")
 }
 
-// TestProcessManual_IdNodeMismatch tests ProcessManual when IDs don't match with
+// TestProcessManual_IdNodeMismatch tests processManual when IDs don't match with
 // the nodes in the supplied map.
 func TestProcessManual_IdNodeMismatch(t *testing.T) {
 	t.Parallel()
@@ -130,12 +130,12 @@ func TestProcessManual_IdNodeMismatch(t *testing.T) {
 	require.NoError(t, err)
 	data := newData(requestId)
 
-	err = ProcessManual(namespace.RootContext(context.Background()), data, ids, nodes)
+	err = processManual(nshelper.RootContext(context.Background()), data, ids, nodes)
 	require.Error(t, err)
 	require.ErrorContains(t, err, "node not found: ")
 }
 
-// TestProcessManual_NotEnoughNodes tests ProcessManual when there is only one
+// TestProcessManual_NotEnoughNodes tests processManual when there is only one
 // node provided.
 func TestProcessManual_NotEnoughNodes(t *testing.T) {
 	t.Parallel()
@@ -153,12 +153,12 @@ func TestProcessManual_NotEnoughNodes(t *testing.T) {
 	require.NoError(t, err)
 	data := newData(requestId)
 
-	err = ProcessManual(namespace.RootContext(context.Background()), data, ids, nodes)
+	err = processManual(nshelper.RootContext(context.Background()), data, ids, nodes)
 	require.Error(t, err)
 	require.EqualError(t, err, "minimum of 2 ids are required")
 }
 
-// TestProcessManual_LastNodeNotSink tests ProcessManual when the last node is
+// TestProcessManual_LastNodeNotSink tests processManual when the last node is
 // not a Sink node.
 func TestProcessManual_LastNodeNotSink(t *testing.T) {
 	t.Parallel()
@@ -181,7 +181,7 @@ func TestProcessManual_LastNodeNotSink(t *testing.T) {
 	require.NoError(t, err)
 	data := newData(requestId)
 
-	err = ProcessManual(namespace.RootContext(context.Background()), data, ids, nodes)
+	err = processManual(nshelper.RootContext(context.Background()), data, ids, nodes)
 	require.Error(t, err)
 	require.EqualError(t, err, "last node must be a filter or sink")
 }
@@ -210,7 +210,7 @@ func TestProcessManualEndWithSink(t *testing.T) {
 	require.NoError(t, err)
 	data := newData(requestId)
 
-	err = ProcessManual(namespace.RootContext(context.Background()), data, ids, nodes)
+	err = processManual(nshelper.RootContext(context.Background()), data, ids, nodes)
 	require.NoError(t, err)
 }
 
@@ -243,7 +243,7 @@ func TestProcessManual_EndWithFilter(t *testing.T) {
 	require.NoError(t, err)
 	data := newData(requestId)
 
-	err = ProcessManual(namespace.RootContext(context.Background()), data, ids, nodes)
+	err = processManual(nshelper.RootContext(context.Background()), data, ids, nodes)
 	require.NoError(t, err)
 }
 
diff --git a/audit/options.go b/audit/options.go
index 109b721e980..84e86b56781 100644
--- a/audit/options.go
+++ b/audit/options.go
@@ -1,45 +1,43 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
 
 import (
 	"errors"
-	"reflect"
 	"strings"
 	"time"
 )
 
-// Option is how options are passed as arguments.
-type Option func(*options) error
+// option is how options are passed as arguments.
+type option func(*options) error
 
 // options are used to represent configuration for a audit related nodes.
 type options struct {
-	withID              string
-	withNow             time.Time
-	withSubtype         subtype
-	withFormat          format
-	withPrefix          string
-	withRaw             bool
-	withElision         bool
-	withOmitTime        bool
-	withHMACAccessor    bool
-	withHeaderFormatter HeaderFormatter
+	withID           string
+	withNow          time.Time
+	withSubtype      subtype
+	withFormat       format
+	withPrefix       string
+	withRaw          bool
+	withElision      bool
+	withOmitTime     bool
+	withHMACAccessor bool
 }
 
 // getDefaultOptions returns options with their default values.
 func getDefaultOptions() options {
 	return options{
 		withNow:          time.Now(),
-		withFormat:       JSONFormat,
+		withFormat:       jsonFormat,
 		withHMACAccessor: true,
 	}
 }
 
-// getOpts applies each supplied Option and returns the fully configured options.
-// Each Option is applied in the order it appears in the argument list, so it is
-// possible to supply the same Option numerous times and the 'last write wins'.
-func getOpts(opt ...Option) (options, error) {
+// getOpts applies each supplied option and returns the fully configured options.
+// Each option is applied in the order it appears in the argument list, so it is
+// possible to supply the same option numerous times and the 'last write wins'.
+func getOpts(opt ...option) (options, error) {
 	opts := getDefaultOptions()
 	for _, o := range opt {
 		if o == nil {
@@ -52,8 +50,8 @@ func getOpts(opt ...Option) (options, error) {
 	return opts, nil
 }
 
-// WithID provides an optional ID.
-func WithID(id string) Option {
+// withID provides an optional ID.
+func withID(id string) option {
 	return func(o *options) error {
 		var err error
 
@@ -69,8 +67,8 @@ func WithID(id string) Option {
 	}
 }
 
-// WithNow provides an Option to represent 'now'.
-func WithNow(now time.Time) Option {
+// withNow provides an option to represent 'now'.
+func withNow(now time.Time) option {
 	return func(o *options) error {
 		var err error
 
@@ -85,8 +83,8 @@ func WithNow(now time.Time) Option {
 	}
 }
 
-// WithSubtype provides an Option to represent the event subtype.
-func WithSubtype(s string) Option {
+// withSubtype provides an option to represent the event subtype.
+func withSubtype(s string) option {
 	return func(o *options) error {
 		s := strings.TrimSpace(s)
 		if s == "" {
@@ -103,10 +101,10 @@ func WithSubtype(s string) Option {
 	}
 }
 
-// WithFormat provides an Option to represent event format.
-func WithFormat(f string) Option {
+// withFormat provides an option to represent event format.
+func withFormat(f string) option {
 	return func(o *options) error {
-		f := strings.TrimSpace(f)
+		f := strings.TrimSpace(strings.ToLower(f))
 		if f == "" {
 			// Return early, we won't attempt to apply this option if its empty.
 			return nil
@@ -123,8 +121,8 @@ func WithFormat(f string) Option {
 	}
 }
 
-// WithPrefix provides an Option to represent a prefix for a file sink.
-func WithPrefix(prefix string) Option {
+// withPrefix provides an option to represent a prefix for a file sink.
+func withPrefix(prefix string) option {
 	return func(o *options) error {
 		o.withPrefix = prefix
 
@@ -132,46 +130,34 @@ func WithPrefix(prefix string) Option {
 	}
 }
 
-// WithRaw provides an Option to represent whether 'raw' is required.
-func WithRaw(r bool) Option {
+// withRaw provides an option to represent whether 'raw' is required.
+func withRaw(r bool) option {
 	return func(o *options) error {
 		o.withRaw = r
 		return nil
 	}
 }
 
-// WithElision provides an Option to represent whether elision (...) is required.
-func WithElision(e bool) Option {
+// withElision provides an option to represent whether elision (...) is required.
+func withElision(e bool) option {
 	return func(o *options) error {
 		o.withElision = e
 		return nil
 	}
 }
 
-// WithOmitTime provides an Option to represent whether to omit time.
-func WithOmitTime(t bool) Option {
+// withOmitTime provides an option to represent whether to omit time.
+func withOmitTime(t bool) option {
 	return func(o *options) error {
 		o.withOmitTime = t
 		return nil
 	}
 }
 
-// WithHMACAccessor provides an Option to represent whether an HMAC accessor is applicable.
-func WithHMACAccessor(h bool) Option {
+// withHMACAccessor provides an option to represent whether an HMAC accessor is applicable.
+func withHMACAccessor(h bool) option {
 	return func(o *options) error {
 		o.withHMACAccessor = h
 		return nil
 	}
 }
-
-// WithHeaderFormatter provides an Option to supply a HeaderFormatter.
-// If the HeaderFormatter interface supplied is nil (type or value), the option will not be applied.
-func WithHeaderFormatter(f HeaderFormatter) Option {
-	return func(o *options) error {
-		if f != nil && !reflect.ValueOf(f).IsNil() {
-			o.withHeaderFormatter = f
-		}
-
-		return nil
-	}
-}
diff --git a/audit/options_test.go b/audit/options_test.go
index 3bbe05f8e68..8a05db6b9cf 100644
--- a/audit/options_test.go
+++ b/audit/options_test.go
@@ -1,18 +1,17 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
 
 import (
-	"context"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/require"
 )
 
-// TestOptions_WithFormat exercises WithFormat Option to ensure it performs as expected.
-func TestOptions_WithFormat(t *testing.T) {
+// TestOptions_withFormat exercises withFormat option to ensure it performs as expected.
+func TestOptions_withFormat(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
@@ -34,17 +33,17 @@ func TestOptions_WithFormat(t *testing.T) {
 		"invalid-test": {
 			Value:                "test",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "audit.(format).validate: 'test' is not a valid format: invalid parameter",
+			ExpectedErrorMessage: "invalid format \"test\": invalid internal parameter",
 		},
 		"valid-json": {
 			Value:           "json",
 			IsErrorExpected: false,
-			ExpectedValue:   JSONFormat,
+			ExpectedValue:   jsonFormat,
 		},
 		"valid-jsonx": {
 			Value:           "jsonx",
 			IsErrorExpected: false,
-			ExpectedValue:   JSONxFormat,
+			ExpectedValue:   jsonxFormat,
 		},
 	}
 
@@ -54,7 +53,7 @@ func TestOptions_WithFormat(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 			opts := &options{}
-			applyOption := WithFormat(tc.Value)
+			applyOption := withFormat(tc.Value)
 			err := applyOption(opts)
 			switch {
 			case tc.IsErrorExpected:
@@ -68,8 +67,8 @@ func TestOptions_WithFormat(t *testing.T) {
 	}
 }
 
-// TestOptions_WithSubtype exercises WithSubtype Option to ensure it performs as expected.
-func TestOptions_WithSubtype(t *testing.T) {
+// TestOptions_withSubtype exercises withSubtype option to ensure it performs as expected.
+func TestOptions_withSubtype(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
@@ -101,7 +100,7 @@ func TestOptions_WithSubtype(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 			opts := &options{}
-			applyOption := WithSubtype(tc.Value)
+			applyOption := withSubtype(tc.Value)
 			err := applyOption(opts)
 			switch {
 			case tc.IsErrorExpected:
@@ -115,8 +114,8 @@ func TestOptions_WithSubtype(t *testing.T) {
 	}
 }
 
-// TestOptions_WithNow exercises WithNow Option to ensure it performs as expected.
-func TestOptions_WithNow(t *testing.T) {
+// TestOptions_withNow exercises withNow option to ensure it performs as expected.
+func TestOptions_withNow(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
@@ -144,7 +143,7 @@ func TestOptions_WithNow(t *testing.T) {
 			t.Parallel()
 
 			opts := &options{}
-			applyOption := WithNow(tc.Value)
+			applyOption := withNow(tc.Value)
 			err := applyOption(opts)
 			switch {
 			case tc.IsErrorExpected:
@@ -158,8 +157,8 @@ func TestOptions_WithNow(t *testing.T) {
 	}
 }
 
-// TestOptions_WithID exercises WithID Option to ensure it performs as expected.
-func TestOptions_WithID(t *testing.T) {
+// TestOptions_withID exercises withID option to ensure it performs as expected.
+func TestOptions_withID(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
@@ -191,7 +190,7 @@ func TestOptions_WithID(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 			opts := &options{}
-			applyOption := WithID(tc.Value)
+			applyOption := withID(tc.Value)
 			err := applyOption(opts)
 			switch {
 			case tc.IsErrorExpected:
@@ -205,8 +204,8 @@ func TestOptions_WithID(t *testing.T) {
 	}
 }
 
-// TestOptions_WithPrefix exercises WithPrefix Option to ensure it performs as expected.
-func TestOptions_WithPrefix(t *testing.T) {
+// TestOptions_withPrefix exercises withPrefix option to ensure it performs as expected.
+func TestOptions_withPrefix(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
@@ -238,7 +237,7 @@ func TestOptions_WithPrefix(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 			opts := &options{}
-			applyOption := WithPrefix(tc.Value)
+			applyOption := withPrefix(tc.Value)
 			err := applyOption(opts)
 			switch {
 			case tc.IsErrorExpected:
@@ -252,8 +251,8 @@ func TestOptions_WithPrefix(t *testing.T) {
 	}
 }
 
-// TestOptions_WithRaw exercises WithRaw Option to ensure it performs as expected.
-func TestOptions_WithRaw(t *testing.T) {
+// TestOptions_withRaw exercises withRaw option to ensure it performs as expected.
+func TestOptions_withRaw(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
@@ -276,7 +275,7 @@ func TestOptions_WithRaw(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 			opts := &options{}
-			applyOption := WithRaw(tc.Value)
+			applyOption := withRaw(tc.Value)
 			err := applyOption(opts)
 			require.NoError(t, err)
 			require.Equal(t, tc.ExpectedValue, opts.withRaw)
@@ -284,8 +283,8 @@ func TestOptions_WithRaw(t *testing.T) {
 	}
 }
 
-// TestOptions_WithElision exercises WithElision Option to ensure it performs as expected.
-func TestOptions_WithElision(t *testing.T) {
+// TestOptions_withElision exercises withElision option to ensure it performs as expected.
+func TestOptions_withElision(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
@@ -308,7 +307,7 @@ func TestOptions_WithElision(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 			opts := &options{}
-			applyOption := WithElision(tc.Value)
+			applyOption := withElision(tc.Value)
 			err := applyOption(opts)
 			require.NoError(t, err)
 			require.Equal(t, tc.ExpectedValue, opts.withElision)
@@ -316,8 +315,8 @@ func TestOptions_WithElision(t *testing.T) {
 	}
 }
 
-// TestOptions_WithHMACAccessor exercises WithHMACAccessor Option to ensure it performs as expected.
-func TestOptions_WithHMACAccessor(t *testing.T) {
+// TestOptions_withHMACAccessor exercises withHMACAccessor option to ensure it performs as expected.
+func TestOptions_withHMACAccessor(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
@@ -340,7 +339,7 @@ func TestOptions_WithHMACAccessor(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 			opts := &options{}
-			applyOption := WithHMACAccessor(tc.Value)
+			applyOption := withHMACAccessor(tc.Value)
 			err := applyOption(opts)
 			require.NoError(t, err)
 			require.Equal(t, tc.ExpectedValue, opts.withHMACAccessor)
@@ -348,8 +347,8 @@ func TestOptions_WithHMACAccessor(t *testing.T) {
 	}
 }
 
-// TestOptions_WithOmitTime exercises WithOmitTime Option to ensure it performs as expected.
-func TestOptions_WithOmitTime(t *testing.T) {
+// TestOptions_withOmitTime exercises withOmitTime option to ensure it performs as expected.
+func TestOptions_withOmitTime(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
@@ -372,7 +371,7 @@ func TestOptions_WithOmitTime(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 			opts := &options{}
-			applyOption := WithOmitTime(tc.Value)
+			applyOption := withOmitTime(tc.Value)
 			err := applyOption(opts)
 			require.NoError(t, err)
 			require.Equal(t, tc.ExpectedValue, opts.withOmitTime)
@@ -380,47 +379,6 @@ func TestOptions_WithOmitTime(t *testing.T) {
 	}
 }
 
-// TestOptions_WithHeaderFormatter exercises the WithHeaderFormatter Option to
-// ensure it applies the option as expected under various circumstances.
-func TestOptions_WithHeaderFormatter(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		Value                    HeaderFormatter
-		ExpectedValue            HeaderFormatter
-		ShouldLeaveUninitialized bool
-	}{
-		"nil": {
-			Value:         nil,
-			ExpectedValue: nil,
-		},
-		"unassigned-interface": {
-			ShouldLeaveUninitialized: true,
-		},
-		"happy-path": {
-			Value:         &testHeaderFormatter{},
-			ExpectedValue: &testHeaderFormatter{},
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-			opts := &options{}
-			var f HeaderFormatter
-			if !tc.ShouldLeaveUninitialized {
-				f = tc.Value
-			}
-			applyOption := WithHeaderFormatter(f)
-			err := applyOption(opts)
-			require.NoError(t, err)
-			require.Equal(t, tc.ExpectedValue, opts.withHeaderFormatter)
-		})
-	}
-}
-
 // TestOptions_Default exercises getDefaultOptions to assert the default values.
 func TestOptions_Default(t *testing.T) {
 	t.Parallel()
@@ -431,12 +389,12 @@ func TestOptions_Default(t *testing.T) {
 	require.False(t, opts.withNow.IsZero())
 }
 
-// TestOptions_Opts exercises GetOpts with various Option values.
+// TestOptions_Opts exercises GetOpts with various option values.
 func TestOptions_Opts(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
-		opts                 []Option
+		opts                 []option
 		IsErrorExpected      bool
 		ExpectedErrorMessage string
 		ExpectedID           string
@@ -449,73 +407,73 @@ func TestOptions_Opts(t *testing.T) {
 			opts:            nil,
 			IsErrorExpected: false,
 			IsNowExpected:   true,
-			ExpectedFormat:  JSONFormat,
+			ExpectedFormat:  jsonFormat,
 		},
 		"empty-options": {
-			opts:            []Option{},
+			opts:            []option{},
 			IsErrorExpected: false,
 			IsNowExpected:   true,
-			ExpectedFormat:  JSONFormat,
+			ExpectedFormat:  jsonFormat,
 		},
 		"with-multiple-valid-id": {
-			opts: []Option{
-				WithID("qwerty"),
-				WithID("juan"),
+			opts: []option{
+				withID("qwerty"),
+				withID("juan"),
 			},
 			IsErrorExpected: false,
 			ExpectedID:      "juan",
 			IsNowExpected:   true,
-			ExpectedFormat:  JSONFormat,
+			ExpectedFormat:  jsonFormat,
 		},
 		"with-multiple-valid-subtype": {
-			opts: []Option{
-				WithSubtype("AuditRequest"),
-				WithSubtype("AuditResponse"),
+			opts: []option{
+				withSubtype("AuditRequest"),
+				withSubtype("AuditResponse"),
 			},
 			IsErrorExpected: false,
 			ExpectedSubtype: ResponseType,
 			IsNowExpected:   true,
-			ExpectedFormat:  JSONFormat,
+			ExpectedFormat:  jsonFormat,
 		},
 		"with-multiple-valid-format": {
-			opts: []Option{
-				WithFormat("json"),
-				WithFormat("jsonx"),
+			opts: []option{
+				withFormat("json"),
+				withFormat("jsonx"),
 			},
 			IsErrorExpected: false,
-			ExpectedFormat:  JSONxFormat,
+			ExpectedFormat:  jsonxFormat,
 			IsNowExpected:   true,
 		},
 		"with-multiple-valid-now": {
-			opts: []Option{
-				WithNow(time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local)),
-				WithNow(time.Date(2023, time.July, 4, 13, 3, 0, 0, time.Local)),
+			opts: []option{
+				withNow(time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local)),
+				withNow(time.Date(2023, time.July, 4, 13, 3, 0, 0, time.Local)),
 			},
 			IsErrorExpected: false,
 			ExpectedNow:     time.Date(2023, time.July, 4, 13, 3, 0, 0, time.Local),
 			IsNowExpected:   false,
-			ExpectedFormat:  JSONFormat,
+			ExpectedFormat:  jsonFormat,
 		},
 		"with-multiple-valid-then-invalid-now": {
-			opts: []Option{
-				WithNow(time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local)),
-				WithNow(time.Time{}),
+			opts: []option{
+				withNow(time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local)),
+				withNow(time.Time{}),
 			},
 			IsErrorExpected:      true,
 			ExpectedErrorMessage: "cannot specify 'now' to be the zero time instant",
-			ExpectedFormat:       JSONFormat,
+			ExpectedFormat:       jsonFormat,
 		},
 		"with-multiple-valid-options": {
-			opts: []Option{
-				WithID("qwerty"),
-				WithSubtype("AuditRequest"),
-				WithFormat("json"),
-				WithNow(time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local)),
+			opts: []option{
+				withID("qwerty"),
+				withSubtype("AuditRequest"),
+				withFormat("json"),
+				withNow(time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local)),
 			},
 			IsErrorExpected: false,
 			ExpectedID:      "qwerty",
 			ExpectedSubtype: RequestType,
-			ExpectedFormat:  JSONFormat,
+			ExpectedFormat:  jsonFormat,
 			ExpectedNow:     time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local),
 		},
 	}
@@ -549,12 +507,3 @@ func TestOptions_Opts(t *testing.T) {
 		})
 	}
 }
-
-// testHeaderFormatter is a stub to prevent the need to import the vault package
-// to bring in vault.AuditedHeadersConfig for testing.
-type testHeaderFormatter struct{}
-
-// ApplyConfig satisfied the HeaderFormatter interface for testing.
-func (f *testHeaderFormatter) ApplyConfig(ctx context.Context, headers map[string][]string, salter Salter) (result map[string][]string, retErr error) {
-	return nil, nil
-}
diff --git a/audit/sink_metric_labeler.go b/audit/sink_metric_labeler.go
index 1c74a827f74..ac221aad587 100644
--- a/audit/sink_metric_labeler.go
+++ b/audit/sink_metric_labeler.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -8,50 +8,25 @@ import (
 	"github.com/hashicorp/vault/internal/observability/event"
 )
 
-var (
-	_ event.Labeler = (*MetricLabelerAuditSink)(nil)
-	_ event.Labeler = (*MetricLabelerAuditFallback)(nil)
-)
+var _ event.Labeler = (*metricLabelerAuditSink)(nil)
 
 var (
-	metricLabelAuditSinkSuccess     = []string{"audit", "sink", "success"}
-	metricLabelAuditSinkFailure     = []string{"audit", "sink", "failure"}
-	metricLabelAuditFallbackSuccess = []string{"audit", "fallback", "success"}
-	metricLabelAuditFallbackMiss    = []string{"audit", "fallback", "miss"}
+	metricLabelAuditSinkSuccess = []string{"audit", "sink", "success"}
+	metricLabelAuditSinkFailure = []string{"audit", "sink", "failure"}
 )
 
-// MetricLabelerAuditSink can be used to provide labels for the success or failure
+// metricLabelerAuditSink can be used to provide labels for the success or failure
 // of a sink node used for a normal audit device.
-type MetricLabelerAuditSink struct{}
-
-// MetricLabelerAuditFallback can be used to provide labels for the success or failure
-// of a sink node used for an audit fallback device.
-type MetricLabelerAuditFallback struct{}
+type metricLabelerAuditSink struct{}
 
 // Labels provides the success and failure labels for an audit sink, based on the error supplied.
 // Success: 'vault.audit.sink.success'
 // Failure: 'vault.audit.sink.failure'
-func (m MetricLabelerAuditSink) Labels(_ *eventlogger.Event, err error) []string {
+func (m metricLabelerAuditSink) Labels(_ *eventlogger.Event, err error) []string {
 	if err != nil {
+		// NOTE: a cancelled context would still result in an error.
 		return metricLabelAuditSinkFailure
 	}
 
 	return metricLabelAuditSinkSuccess
 }
-
-// Labels provides the success and failures labels for an audit fallback sink, based on the error supplied.
-// Success: 'vault.audit.fallback.success'
-// Failure: 'vault.audit.sink.failure'
-func (m MetricLabelerAuditFallback) Labels(_ *eventlogger.Event, err error) []string {
-	if err != nil {
-		return metricLabelAuditSinkFailure
-	}
-
-	return metricLabelAuditFallbackSuccess
-}
-
-// MetricLabelsFallbackMiss returns the labels which indicate an audit entry was missed.
-// 'vault.audit.fallback.miss'
-func MetricLabelsFallbackMiss() []string {
-	return metricLabelAuditFallbackMiss
-}
diff --git a/audit/sink_metric_labeler_test.go b/audit/sink_metric_labeler_test.go
index 44f60a6d014..b42ed10308e 100644
--- a/audit/sink_metric_labeler_test.go
+++ b/audit/sink_metric_labeler_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -35,39 +35,7 @@ func TestMetricLabelerAuditSink_Label(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			m := &MetricLabelerAuditSink{}
-			result := m.Labels(nil, tc.err)
-			assert.Equal(t, tc.expected, result)
-		})
-	}
-}
-
-// TestMetricLabelerAuditFallback_Label ensures we always get the right label based
-// on the input value of the error for fallback devices.
-func TestMetricLabelerAuditFallback_Label(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		err      error
-		expected []string
-	}{
-		"nil": {
-			err:      nil,
-			expected: []string{"audit", "fallback", "success"},
-		},
-		"error": {
-			err:      errors.New("I am an error"),
-			expected: []string{"audit", "sink", "failure"},
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			m := &MetricLabelerAuditFallback{}
+			m := &metricLabelerAuditSink{}
 			result := m.Labels(nil, tc.err)
 			assert.Equal(t, tc.expected, result)
 		})
diff --git a/audit/sink_metric_timer.go b/audit/sink_metric_timer.go
index 4bfbda71c45..81210d27949 100644
--- a/audit/sink_metric_timer.go
+++ b/audit/sink_metric_timer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -11,42 +11,39 @@ import (
 
 	"github.com/armon/go-metrics"
 	"github.com/hashicorp/eventlogger"
-	"github.com/hashicorp/vault/internal/observability/event"
 )
 
-var _ eventlogger.Node = (*SinkMetricTimer)(nil)
+var _ eventlogger.Node = (*sinkMetricTimer)(nil)
 
-// SinkMetricTimer is a wrapper for any kind of eventlogger.NodeTypeSink node that
+// sinkMetricTimer is a wrapper for any kind of eventlogger.NodeTypeSink node that
 // processes events containing an AuditEvent payload.
 // It decorates the implemented eventlogger.Node Process method in order to emit
 // timing metrics for the duration between the creation time of the event and the
 // time the node completes processing.
-type SinkMetricTimer struct {
-	Name string
-	Sink eventlogger.Node
+type sinkMetricTimer struct {
+	name string
+	sink eventlogger.Node
 }
 
-// NewSinkMetricTimer should be used to create the SinkMetricTimer.
+// newSinkMetricTimer should be used to create the sinkMetricTimer.
 // It expects that an eventlogger.NodeTypeSink should be supplied as the sink.
-func NewSinkMetricTimer(name string, sink eventlogger.Node) (*SinkMetricTimer, error) {
-	const op = "audit.NewSinkMetricTimer"
-
+func newSinkMetricTimer(name string, sink eventlogger.Node) (*sinkMetricTimer, error) {
 	name = strings.TrimSpace(name)
 	if name == "" {
-		return nil, fmt.Errorf("%s: name is required: %w", op, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("name is required: %w", ErrInvalidParameter)
 	}
 
 	if sink == nil || reflect.ValueOf(sink).IsNil() {
-		return nil, fmt.Errorf("%s: sink node is required: %w", op, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("sink node is required: %w", ErrInvalidParameter)
 	}
 
 	if sink.Type() != eventlogger.NodeTypeSink {
-		return nil, fmt.Errorf("%s: sink node must be of type 'sink': %w", op, event.ErrInvalidParameter)
+		return nil, fmt.Errorf("sink node must be of type 'sink': %w", ErrInvalidParameter)
 	}
 
-	return &SinkMetricTimer{
-		Name: name,
-		Sink: sink,
+	return &sinkMetricTimer{
+		name: name,
+		sink: sink,
 	}, nil
 }
 
@@ -57,23 +54,23 @@ func NewSinkMetricTimer(name string, sink eventlogger.Node) (*SinkMetricTimer, e
 // Examples:
 // 'vault.audit.{DEVICE}.log_request'
 // 'vault.audit.{DEVICE}.log_response'
-func (s *SinkMetricTimer) Process(ctx context.Context, e *eventlogger.Event) (*eventlogger.Event, error) {
+func (s *sinkMetricTimer) Process(ctx context.Context, e *eventlogger.Event) (*eventlogger.Event, error) {
 	defer func() {
-		auditEvent, ok := e.Payload.(*AuditEvent)
+		auditEvent, ok := e.Payload.(*Event)
 		if ok {
-			metrics.MeasureSince([]string{"audit", s.Name, auditEvent.Subtype.MetricTag()}, e.CreatedAt)
+			metrics.MeasureSince([]string{"audit", s.name, auditEvent.Subtype.MetricTag()}, e.CreatedAt)
 		}
 	}()
 
-	return s.Sink.Process(ctx, e)
+	return s.sink.Process(ctx, e)
 }
 
 // Reopen wraps the Reopen method of this underlying sink (eventlogger.Node).
-func (s *SinkMetricTimer) Reopen() error {
-	return s.Sink.Reopen()
+func (s *sinkMetricTimer) Reopen() error {
+	return s.sink.Reopen()
 }
 
 // Type wraps the Type method of this underlying sink (eventlogger.Node).
-func (s *SinkMetricTimer) Type() eventlogger.NodeType {
-	return s.Sink.Type()
+func (s *sinkMetricTimer) Type() eventlogger.NodeType {
+	return s.sink.Type()
 }
diff --git a/audit/sink_metric_timer_test.go b/audit/sink_metric_timer_test.go
index 7d4ef073172..0330c4c60f2 100644
--- a/audit/sink_metric_timer_test.go
+++ b/audit/sink_metric_timer_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
@@ -12,7 +12,7 @@ import (
 )
 
 // TestNewSinkMetricTimer ensures that parameters are checked correctly and errors
-// reported as expected when attempting to create a SinkMetricTimer.
+// reported as expected when attempting to create a sinkMetricTimer.
 func TestNewSinkMetricTimer(t *testing.T) {
 	t.Parallel()
 
@@ -30,19 +30,19 @@ func TestNewSinkMetricTimer(t *testing.T) {
 		"no-name": {
 			name:                 "",
 			isErrorExpected:      true,
-			expectedErrorMessage: "audit.NewSinkMetricTimer: name is required: invalid parameter",
+			expectedErrorMessage: "name is required: invalid internal parameter",
 		},
 		"no-node": {
 			name:                 "foo",
 			node:                 nil,
 			isErrorExpected:      true,
-			expectedErrorMessage: "audit.NewSinkMetricTimer: sink node is required: invalid parameter",
+			expectedErrorMessage: "sink node is required: invalid internal parameter",
 		},
 		"bad-node": {
 			name:                 "foo",
-			node:                 &EntryFormatter{},
+			node:                 &entryFormatter{},
 			isErrorExpected:      true,
-			expectedErrorMessage: "audit.NewSinkMetricTimer: sink node must be of type 'sink': invalid parameter",
+			expectedErrorMessage: "sink node must be of type 'sink': invalid internal parameter",
 		},
 	}
 
@@ -52,7 +52,7 @@ func TestNewSinkMetricTimer(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			m, err := NewSinkMetricTimer(tc.name, tc.node)
+			m, err := newSinkMetricTimer(tc.name, tc.node)
 
 			switch {
 			case tc.isErrorExpected:
diff --git a/audit/types.go b/audit/types.go
index 5c64fe38618..cd775022cc6 100644
--- a/audit/types.go
+++ b/audit/types.go
@@ -1,241 +1,114 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package audit
 
 import (
-	"context"
-
-	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/vault/internal/observability/event"
-	"github.com/hashicorp/vault/sdk/helper/salt"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
-// Salter is an interface that provides a way to obtain a Salt for hashing.
-type Salter interface {
-	// Salt returns a non-nil salt or an error.
-	Salt(context.Context) (*salt.Salt, error)
-}
-
-// Formatter is an interface that is responsible for formatting a request/response into some format.
-// It is recommended that you pass data through Hash prior to formatting it.
-type Formatter interface {
-	// FormatRequest formats the logical.LogInput into an RequestEntry.
-	FormatRequest(context.Context, *logical.LogInput) (*RequestEntry, error)
-	// FormatResponse formats the logical.LogInput into an ResponseEntry.
-	FormatResponse(context.Context, *logical.LogInput) (*ResponseEntry, error)
-}
-
-// HeaderFormatter is an interface defining the methods of the
-// vault.AuditedHeadersConfig structure needed in this package.
-type HeaderFormatter interface {
-	// ApplyConfig returns a map of header values that consists of the
-	// intersection of the provided set of header values with a configured
-	// set of headers and will hash headers that have been configured as such.
-	ApplyConfig(context.Context, map[string][]string, Salter) (map[string][]string, error)
-}
-
-// FormatterConfig is used to provide basic configuration to a formatter.
-// Use NewFormatterConfig to initialize the FormatterConfig struct.
-type FormatterConfig struct {
-	Raw          bool
-	HMACAccessor bool
-
-	// Vault lacks pagination in its APIs. As a result, certain list operations can return **very** large responses.
-	// The user's chosen audit sinks may experience difficulty consuming audit records that swell to tens of megabytes
-	// of JSON. The responses of list operations are typically not very interesting, as they are mostly lists of keys,
-	// or, even when they include a "key_info" field, are not returning confidential information. They become even less
-	// interesting once HMAC-ed by the audit system.
-	//
-	// Some example Vault "list" operations that are prone to becoming very large in an active Vault installation are:
-	//   auth/token/accessors/
-	//   identity/entity/id/
-	//   identity/entity-alias/id/
-	//   pki/certs/
-	//
-	// This option exists to provide such users with the option to have response data elided from audit logs, only when
-	// the operation type is "list". For added safety, the elision only applies to the "keys" and "key_info" fields
-	// within the response data - these are conventionally the only fields present in a list response - see
-	// logical.ListResponse, and logical.ListResponseWithInfo. However, other fields are technically possible if a
-	// plugin author writes unusual code, and these will be preserved in the audit log even with this option enabled.
-	// The elision replaces the values of the "keys" and "key_info" fields with an integer count of the number of
-	// entries. This allows even the elided audit logs to still be useful for answering questions like
-	// "Was any data returned?" or "How many records were listed?".
-	ElideListResponses bool
-
-	// This should only ever be used in a testing context
-	OmitTime bool
-
-	// The required/target format for the event (supported: JSONFormat and JSONxFormat).
-	RequiredFormat format
-}
-
-// RequestEntry is the structure of a request audit log entry.
-type RequestEntry struct {
-	Time          string   `json:"time,omitempty"`
-	Type          string   `json:"type,omitempty"`
-	Auth          *Auth    `json:"auth,omitempty"`
-	Request       *Request `json:"request,omitempty"`
-	Error         string   `json:"error,omitempty"`
-	ForwardedFrom string   `json:"forwarded_from,omitempty"` // Populated in Enterprise when a request is forwarded
+// entry represents an audit entry.
+// It could be an entry for a request or response.
+type entry struct {
+	Auth          *auth     `json:"auth,omitempty"`
+	Error         string    `json:"error,omitempty"`
+	Forwarded     bool      `json:"forwarded,omitempty"`
+	ForwardedFrom string    `json:"forwarded_from,omitempty"` // Populated in Enterprise when a request is forwarded
+	Request       *request  `json:"request,omitempty"`
+	Response      *response `json:"response,omitempty"`
+	Time          string    `json:"time,omitempty"`
+	Type          string    `json:"type,omitempty"`
 }
 
-// ResponseEntry is the structure of a response audit log entry.
-type ResponseEntry struct {
-	Time      string    `json:"time,omitempty"`
-	Type      string    `json:"type,omitempty"`
-	Auth      *Auth     `json:"auth,omitempty"`
-	Request   *Request  `json:"request,omitempty"`
-	Response  *Response `json:"response,omitempty"`
-	Error     string    `json:"error,omitempty"`
-	Forwarded bool      `json:"forwarded,omitempty"`
-}
-
-type Request struct {
-	ID                            string                 `json:"id,omitempty"`
+type request struct {
+	ClientCertificateSerialNumber string                 `json:"client_certificate_serial_number,omitempty"`
 	ClientID                      string                 `json:"client_id,omitempty"`
-	ReplicationCluster            string                 `json:"replication_cluster,omitempty"`
-	Operation                     logical.Operation      `json:"operation,omitempty"`
-	MountPoint                    string                 `json:"mount_point,omitempty"`
-	MountType                     string                 `json:"mount_type,omitempty"`
+	ClientToken                   string                 `json:"client_token,omitempty"`
+	ClientTokenAccessor           string                 `json:"client_token_accessor,omitempty"`
+	Data                          map[string]interface{} `json:"data,omitempty"`
+	Headers                       map[string][]string    `json:"headers,omitempty"`
+	ID                            string                 `json:"id,omitempty"`
 	MountAccessor                 string                 `json:"mount_accessor,omitempty"`
-	MountRunningVersion           string                 `json:"mount_running_version,omitempty"`
-	MountRunningSha256            string                 `json:"mount_running_sha256,omitempty"`
 	MountClass                    string                 `json:"mount_class,omitempty"`
 	MountIsExternalPlugin         bool                   `json:"mount_is_external_plugin,omitempty"`
-	ClientToken                   string                 `json:"client_token,omitempty"`
-	ClientTokenAccessor           string                 `json:"client_token_accessor,omitempty"`
-	Namespace                     *Namespace             `json:"namespace,omitempty"`
+	MountPoint                    string                 `json:"mount_point,omitempty"`
+	MountRunningSha256            string                 `json:"mount_running_sha256,omitempty"`
+	MountRunningVersion           string                 `json:"mount_running_version,omitempty"`
+	MountType                     string                 `json:"mount_type,omitempty"`
+	Namespace                     *namespace             `json:"namespace,omitempty"`
+	Operation                     logical.Operation      `json:"operation,omitempty"`
 	Path                          string                 `json:"path,omitempty"`
-	Data                          map[string]interface{} `json:"data,omitempty"`
 	PolicyOverride                bool                   `json:"policy_override,omitempty"`
 	RemoteAddr                    string                 `json:"remote_address,omitempty"`
 	RemotePort                    int                    `json:"remote_port,omitempty"`
-	WrapTTL                       int                    `json:"wrap_ttl,omitempty"`
-	Headers                       map[string][]string    `json:"headers,omitempty"`
-	ClientCertificateSerialNumber string                 `json:"client_certificate_serial_number,omitempty"`
+	ReplicationCluster            string                 `json:"replication_cluster,omitempty"`
 	RequestURI                    string                 `json:"request_uri,omitempty"`
+	WrapTTL                       int                    `json:"wrap_ttl,omitempty"`
 }
 
-type Response struct {
-	Auth                  *Auth                  `json:"auth,omitempty"`
-	MountPoint            string                 `json:"mount_point,omitempty"`
-	MountType             string                 `json:"mount_type,omitempty"`
+type response struct {
+	Auth                  *auth                  `json:"auth,omitempty"`
+	Data                  map[string]interface{} `json:"data,omitempty"`
+	Headers               map[string][]string    `json:"headers,omitempty"`
 	MountAccessor         string                 `json:"mount_accessor,omitempty"`
-	MountRunningVersion   string                 `json:"mount_running_plugin_version,omitempty"`
-	MountRunningSha256    string                 `json:"mount_running_sha256,omitempty"`
 	MountClass            string                 `json:"mount_class,omitempty"`
 	MountIsExternalPlugin bool                   `json:"mount_is_external_plugin,omitempty"`
-	Secret                *Secret                `json:"secret,omitempty"`
-	Data                  map[string]interface{} `json:"data,omitempty"`
-	Warnings              []string               `json:"warnings,omitempty"`
+	MountPoint            string                 `json:"mount_point,omitempty"`
+	MountRunningSha256    string                 `json:"mount_running_sha256,omitempty"`
+	MountRunningVersion   string                 `json:"mount_running_plugin_version,omitempty"`
+	MountType             string                 `json:"mount_type,omitempty"`
 	Redirect              string                 `json:"redirect,omitempty"`
-	WrapInfo              *ResponseWrapInfo      `json:"wrap_info,omitempty"`
-	Headers               map[string][]string    `json:"headers,omitempty"`
+	Secret                *secret                `json:"secret,omitempty"`
+	WrapInfo              *responseWrapInfo      `json:"wrap_info,omitempty"`
+	Warnings              []string               `json:"warnings,omitempty"`
 }
 
-type Auth struct {
-	ClientToken               string              `json:"client_token,omitempty"`
+type auth struct {
 	Accessor                  string              `json:"accessor,omitempty"`
+	ClientToken               string              `json:"client_token,omitempty"`
 	DisplayName               string              `json:"display_name,omitempty"`
-	Policies                  []string            `json:"policies,omitempty"`
-	TokenPolicies             []string            `json:"token_policies,omitempty"`
-	IdentityPolicies          []string            `json:"identity_policies,omitempty"`
+	EntityCreated             bool                `json:"entity_created,omitempty"`
+	EntityID                  string              `json:"entity_id,omitempty"`
 	ExternalNamespacePolicies map[string][]string `json:"external_namespace_policies,omitempty"`
-	NoDefaultPolicy           bool                `json:"no_default_policy,omitempty"`
-	PolicyResults             *PolicyResults      `json:"policy_results,omitempty"`
+	IdentityPolicies          []string            `json:"identity_policies,omitempty"`
 	Metadata                  map[string]string   `json:"metadata,omitempty"`
+	NoDefaultPolicy           bool                `json:"no_default_policy,omitempty"`
 	NumUses                   int                 `json:"num_uses,omitempty"`
+	Policies                  []string            `json:"policies,omitempty"`
+	PolicyResults             *policyResults      `json:"policy_results,omitempty"`
 	RemainingUses             int                 `json:"remaining_uses,omitempty"`
-	EntityID                  string              `json:"entity_id,omitempty"`
-	EntityCreated             bool                `json:"entity_created,omitempty"`
-	TokenType                 string              `json:"token_type,omitempty"`
-	TokenTTL                  int64               `json:"token_ttl,omitempty"`
+	TokenPolicies             []string            `json:"token_policies,omitempty"`
 	TokenIssueTime            string              `json:"token_issue_time,omitempty"`
+	TokenTTL                  int64               `json:"token_ttl,omitempty"`
+	TokenType                 string              `json:"token_type,omitempty"`
 }
 
-type PolicyResults struct {
+type policyResults struct {
 	Allowed          bool         `json:"allowed"`
-	GrantingPolicies []PolicyInfo `json:"granting_policies,omitempty"`
+	GrantingPolicies []policyInfo `json:"granting_policies,omitempty"`
 }
 
-type PolicyInfo struct {
+type policyInfo struct {
 	Name          string `json:"name,omitempty"`
 	NamespaceId   string `json:"namespace_id,omitempty"`
 	NamespacePath string `json:"namespace_path,omitempty"`
 	Type          string `json:"type"`
 }
 
-type Secret struct {
+type secret struct {
 	LeaseID string `json:"lease_id,omitempty"`
 }
 
-type ResponseWrapInfo struct {
-	TTL             int    `json:"ttl,omitempty"`
-	Token           string `json:"token,omitempty"`
+type responseWrapInfo struct {
 	Accessor        string `json:"accessor,omitempty"`
-	CreationTime    string `json:"creation_time,omitempty"`
 	CreationPath    string `json:"creation_path,omitempty"`
+	CreationTime    string `json:"creation_time,omitempty"`
+	Token           string `json:"token,omitempty"`
+	TTL             int    `json:"ttl,omitempty"`
 	WrappedAccessor string `json:"wrapped_accessor,omitempty"`
 }
 
-type Namespace struct {
+type namespace struct {
 	ID   string `json:"id,omitempty"`
 	Path string `json:"path,omitempty"`
 }
-
-// nonPersistentSalt is used for obtaining a salt that is not persisted.
-type nonPersistentSalt struct{}
-
-// Backend interface must be implemented for an audit
-// mechanism to be made available. Audit backends can be enabled to
-// sink information to different backends such as logs, file, databases,
-// or other external services.
-type Backend interface {
-	// Salter interface must be implemented by anything implementing Backend.
-	Salter
-
-	// The PipelineReader interface allows backends to surface information about their
-	// nodes for node and pipeline registration.
-	event.PipelineReader
-
-	// IsFallback can be used to determine if this audit backend device is intended to
-	// be used as a fallback to catch all events that are not written when only using
-	// filtered pipelines.
-	IsFallback() bool
-
-	// LogTestMessage is used to check an audit backend before adding it
-	// permanently. It should attempt to synchronously log the given test
-	// message, WITHOUT using the normal Salt (which would require a storage
-	// operation on creation, which is currently disallowed.)
-	LogTestMessage(context.Context, *logical.LogInput) error
-
-	// Reload is called on SIGHUP for supporting backends.
-	Reload(context.Context) error
-
-	// Invalidate is called for path invalidation
-	Invalidate(context.Context)
-}
-
-// BackendConfig contains configuration parameters used in the factory func to
-// instantiate audit backends
-type BackendConfig struct {
-	// The view to store the salt
-	SaltView logical.Storage
-
-	// The salt config that should be used for any secret obfuscation
-	SaltConfig *salt.Config
-
-	// Config is the opaque user configuration provided when mounting
-	Config map[string]string
-
-	// MountPath is the path where this Backend is mounted
-	MountPath string
-
-	// Logger is used to emit log messages usually captured in the server logs.
-	Logger hclog.Logger
-}
-
-// Factory is the factory function to create an audit backend.
-type Factory func(context.Context, *BackendConfig, HeaderFormatter) (Backend, error)
diff --git a/buf.gen.yaml b/buf.gen.yaml
index bc2e940659e..383e62db306 100644
--- a/buf.gen.yaml
+++ b/buf.gen.yaml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 version: v1
diff --git a/buf.yaml b/buf.yaml
index bbaf0d4e367..8e99ba8e95f 100644
--- a/buf.yaml
+++ b/buf.yaml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 version: v1
@@ -31,6 +31,7 @@ lint:
       - vault/hcp_link/proto/node_status/status.proto
       - vault/replication_services_ent.proto
     PACKAGE_DIRECTORY_MATCH:
+      - builtin/logical/pki/metadata.proto
       - enthelpers/merkle/types_ent.proto
       - enthelpers/wal/types_ent.proto
       - helper/forwarding/types.proto
@@ -40,12 +41,16 @@ lint:
       - physical/raft/types.proto
       - sdk/database/dbplugin/database.proto
       - sdk/database/dbplugin/v5/proto/database.proto
+      - sdk/database/dbplugin/v5/proto/database_ent.proto
+      - sdk/helper/envelopeencryption/envelope_encryption_ent.proto
       - sdk/helper/pluginutil/multiplexing.proto
       - sdk/logical/event.proto
       - sdk/logical/identity.proto
+      - sdk/logical/observation.proto
       - sdk/logical/plugin.proto
       - sdk/logical/version.proto
       - sdk/plugin/pb/backend.proto
+      - sdk/plugin/pb/system_view_service_ent.proto
       - vault/activity/activity_log.proto
       - sdk/helper/clientcountutil/generation/generate_data.proto
       - vault/hcp_link/proto/link_control/link_control.proto
@@ -63,6 +68,7 @@ lint:
       - vault/replication_services_ent.proto
       - vault/request_forwarding_service.proto
     PACKAGE_VERSION_SUFFIX:
+      - builtin/logical/pki/metadata.proto
       - enthelpers/merkle/types_ent.proto
       - enthelpers/wal/types_ent.proto
       - helper/forwarding/types.proto
@@ -71,12 +77,15 @@ lint:
       - helper/storagepacker/types.proto
       - physical/raft/types.proto
       - sdk/database/dbplugin/database.proto
+      - sdk/helper/envelopeencryption/envelope_encryption_ent.proto
       - sdk/helper/pluginutil/multiplexing.proto
       - sdk/logical/event.proto
       - sdk/logical/identity.proto
+      - sdk/logical/observation.proto
       - sdk/logical/plugin.proto
       - sdk/logical/version.proto
       - sdk/plugin/pb/backend.proto
+      - sdk/plugin/pb/system_view_service_ent.proto
       - vault/activity/activity_log.proto
       - sdk/helper/clientcountutil/generation/generate_data.proto
       - vault/hcp_link/proto/link_control/link_control.proto
@@ -90,20 +99,25 @@ lint:
     RPC_REQUEST_RESPONSE_UNIQUE:
       - sdk/database/dbplugin/database.proto
       - sdk/database/dbplugin/v5/proto/database.proto
+      - sdk/database/dbplugin/v5/proto/database_ent.proto
       - sdk/plugin/pb/backend.proto
+      - sdk/plugin/pb/system_view_service_ent.proto
       - vault/replication_services_ent.proto
       - vault/request_forwarding_service.proto
     RPC_REQUEST_STANDARD_NAME:
       - sdk/database/dbplugin/database.proto
       - sdk/database/dbplugin/v5/proto/database.proto
+      - sdk/database/dbplugin/v5/proto/database_ent.proto
       - sdk/logical/version.proto
       - sdk/plugin/pb/backend.proto
+      - sdk/plugin/pb/system_view_service_ent.proto
       - vault/replication/replication_resolver_ent.proto
       - vault/replication_services_ent.proto
       - vault/request_forwarding_service.proto
     RPC_RESPONSE_STANDARD_NAME:
       - sdk/database/dbplugin/database.proto
       - sdk/database/dbplugin/v5/proto/database.proto
+      - sdk/database/dbplugin/v5/proto/database_ent.proto
       - sdk/logical/version.proto
       - sdk/plugin/pb/backend.proto
       - vault/hcp_link/proto/meta/meta.proto
@@ -113,9 +127,11 @@ lint:
     SERVICE_SUFFIX:
       - sdk/database/dbplugin/database.proto
       - sdk/database/dbplugin/v5/proto/database.proto
+      - sdk/database/dbplugin/v5/proto/database_ent.proto
       - sdk/helper/pluginutil/multiplexing.proto
       - sdk/logical/version.proto
       - sdk/plugin/pb/backend.proto
+      - sdk/plugin/pb/system_view_service_ent.proto
       - vault/hcp_link/proto/link_control/link_control.proto
       - vault/hcp_link/proto/meta/meta.proto
       - vault/replication/replication_resolver_ent.proto
diff --git a/builtin/audit/file/backend.go b/builtin/audit/file/backend.go
deleted file mode 100644
index 795aa8c3007..00000000000
--- a/builtin/audit/file/backend.go
+++ /dev/null
@@ -1,382 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package file
-
-import (
-	"context"
-	"fmt"
-	"reflect"
-	"strconv"
-	"strings"
-	"sync"
-	"sync/atomic"
-
-	"github.com/hashicorp/eventlogger"
-	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/go-secure-stdlib/parseutil"
-	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/internal/observability/event"
-	"github.com/hashicorp/vault/sdk/helper/salt"
-	"github.com/hashicorp/vault/sdk/logical"
-)
-
-const (
-	stdout  = "stdout"
-	discard = "discard"
-)
-
-var _ audit.Backend = (*Backend)(nil)
-
-// Backend is the audit backend for the file-based audit store.
-//
-// NOTE: This audit backend is currently very simple: it appends to a file.
-// It doesn't do anything more at the moment to assist with rotation
-// or reset the write cursor, this should be done in the future.
-type Backend struct {
-	fallback   bool
-	name       string
-	nodeIDList []eventlogger.NodeID
-	nodeMap    map[eventlogger.NodeID]eventlogger.Node
-	salt       *atomic.Value
-	saltConfig *salt.Config
-	saltMutex  sync.RWMutex
-	saltView   logical.Storage
-}
-
-func Factory(_ context.Context, conf *audit.BackendConfig, headersConfig audit.HeaderFormatter) (audit.Backend, error) {
-	const op = "file.Factory"
-
-	if conf.SaltConfig == nil {
-		return nil, fmt.Errorf("%s: nil salt config", op)
-	}
-
-	if conf.SaltView == nil {
-		return nil, fmt.Errorf("%s: nil salt view", op)
-	}
-
-	if conf.Logger == nil || reflect.ValueOf(conf.Logger).IsNil() {
-		return nil, fmt.Errorf("%s: nil logger", op)
-	}
-
-	// The config options 'fallback' and 'filter' are mutually exclusive, a fallback
-	// device catches everything, so it cannot be allowed to filter.
-	var fallback bool
-	var err error
-	if fallbackRaw, ok := conf.Config["fallback"]; ok {
-		fallback, err = parseutil.ParseBool(fallbackRaw)
-		if err != nil {
-			return nil, fmt.Errorf("%s: unable to parse 'fallback': %w", op, err)
-		}
-	}
-
-	if _, ok := conf.Config["filter"]; ok && fallback {
-		return nil, fmt.Errorf("%s: cannot configure a fallback device with a filter: %w", op, event.ErrInvalidParameter)
-	}
-
-	// Get file path from config or fall back to the old option name ('path') for compatibility
-	// (see commit bac4fe0799a372ba1245db642f3f6cd1f1d02669).
-	var filePath string
-	if p, ok := conf.Config["file_path"]; ok {
-		filePath = p
-	} else if p, ok = conf.Config["path"]; ok {
-		filePath = p
-	} else {
-		return nil, fmt.Errorf("%s: file_path is required", op)
-	}
-
-	// normalize file path if configured for stdout
-	if strings.EqualFold(filePath, stdout) {
-		filePath = stdout
-	}
-	if strings.EqualFold(filePath, discard) {
-		filePath = discard
-	}
-
-	b := &Backend{
-		fallback:   fallback,
-		name:       conf.MountPath,
-		saltConfig: conf.SaltConfig,
-		saltView:   conf.SaltView,
-		salt:       new(atomic.Value),
-		nodeIDList: []eventlogger.NodeID{},
-		nodeMap:    make(map[eventlogger.NodeID]eventlogger.Node),
-	}
-
-	// Ensure we are working with the right type by explicitly storing a nil of
-	// the right type
-	b.salt.Store((*salt.Salt)(nil))
-
-	err = b.configureFilterNode(conf.Config["filter"])
-	if err != nil {
-		return nil, fmt.Errorf("%s: error configuring filter node: %w", op, err)
-	}
-
-	cfg, err := formatterConfig(conf.Config)
-	if err != nil {
-		return nil, fmt.Errorf("%s: failed to create formatter config: %w", op, err)
-	}
-
-	formatterOpts := []audit.Option{
-		audit.WithHeaderFormatter(headersConfig),
-		audit.WithPrefix(conf.Config["prefix"]),
-	}
-
-	err = b.configureFormatterNode(conf.MountPath, cfg, conf.Logger, formatterOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("%s: error configuring formatter node: %w", op, err)
-	}
-
-	err = b.configureSinkNode(conf.MountPath, filePath, conf.Config["mode"], cfg.RequiredFormat.String())
-	if err != nil {
-		return nil, fmt.Errorf("%s: error configuring sink node: %w", op, err)
-	}
-
-	return b, nil
-}
-
-func (b *Backend) Salt(ctx context.Context) (*salt.Salt, error) {
-	s := b.salt.Load().(*salt.Salt)
-	if s != nil {
-		return s, nil
-	}
-
-	b.saltMutex.Lock()
-	defer b.saltMutex.Unlock()
-
-	s = b.salt.Load().(*salt.Salt)
-	if s != nil {
-		return s, nil
-	}
-
-	newSalt, err := salt.NewSalt(ctx, b.saltView, b.saltConfig)
-	if err != nil {
-		b.salt.Store((*salt.Salt)(nil))
-		return nil, err
-	}
-
-	b.salt.Store(newSalt)
-	return newSalt, nil
-}
-
-func (b *Backend) LogTestMessage(ctx context.Context, in *logical.LogInput) error {
-	if len(b.nodeIDList) > 0 {
-		return audit.ProcessManual(ctx, in, b.nodeIDList, b.nodeMap)
-	}
-
-	return nil
-}
-
-func (b *Backend) Reload(_ context.Context) error {
-	for _, n := range b.nodeMap {
-		if n.Type() == eventlogger.NodeTypeSink {
-			return n.Reopen()
-		}
-	}
-
-	return nil
-}
-
-func (b *Backend) Invalidate(_ context.Context) {
-	b.saltMutex.Lock()
-	defer b.saltMutex.Unlock()
-	b.salt.Store((*salt.Salt)(nil))
-}
-
-// formatterConfig creates the configuration required by a formatter node using
-// the config map supplied to the factory.
-func formatterConfig(config map[string]string) (audit.FormatterConfig, error) {
-	const op = "file.formatterConfig"
-
-	var opts []audit.Option
-
-	if format, ok := config["format"]; ok {
-		opts = append(opts, audit.WithFormat(format))
-	}
-
-	// Check if hashing of accessor is disabled
-	if hmacAccessorRaw, ok := config["hmac_accessor"]; ok {
-		v, err := strconv.ParseBool(hmacAccessorRaw)
-		if err != nil {
-			return audit.FormatterConfig{}, fmt.Errorf("%s: unable to parse 'hmac_accessor': %w", op, err)
-		}
-		opts = append(opts, audit.WithHMACAccessor(v))
-	}
-
-	// Check if raw logging is enabled
-	if raw, ok := config["log_raw"]; ok {
-		v, err := strconv.ParseBool(raw)
-		if err != nil {
-			return audit.FormatterConfig{}, fmt.Errorf("%s: unable to parse 'log_raw': %w", op, err)
-		}
-		opts = append(opts, audit.WithRaw(v))
-	}
-
-	if elideListResponsesRaw, ok := config["elide_list_responses"]; ok {
-		v, err := strconv.ParseBool(elideListResponsesRaw)
-		if err != nil {
-			return audit.FormatterConfig{}, fmt.Errorf("%s: unable to parse 'elide_list_responses': %w", op, err)
-		}
-		opts = append(opts, audit.WithElision(v))
-	}
-
-	return audit.NewFormatterConfig(opts...)
-}
-
-// configureFilterNode is used to configure a filter node and associated ID on the Backend.
-func (b *Backend) configureFilterNode(filter string) error {
-	const op = "file.(Backend).configureFilterNode"
-
-	filter = strings.TrimSpace(filter)
-	if filter == "" {
-		return nil
-	}
-
-	filterNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return fmt.Errorf("%s: error generating random NodeID for filter node: %w", op, err)
-	}
-
-	filterNode, err := audit.NewEntryFilter(filter)
-	if err != nil {
-		return fmt.Errorf("%s: error creating filter node: %w", op, err)
-	}
-
-	b.nodeIDList = append(b.nodeIDList, filterNodeID)
-	b.nodeMap[filterNodeID] = filterNode
-
-	return nil
-}
-
-// configureFormatterNode is used to configure a formatter node and associated ID on the Backend.
-func (b *Backend) configureFormatterNode(name string, formatConfig audit.FormatterConfig, logger hclog.Logger, opts ...audit.Option) error {
-	const op = "file.(Backend).configureFormatterNode"
-
-	formatterNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return fmt.Errorf("%s: error generating random NodeID for formatter node: %w", op, err)
-	}
-
-	formatterNode, err := audit.NewEntryFormatter(name, formatConfig, b, logger, opts...)
-	if err != nil {
-		return fmt.Errorf("%s: error creating formatter: %w", op, err)
-	}
-
-	b.nodeIDList = append(b.nodeIDList, formatterNodeID)
-	b.nodeMap[formatterNodeID] = formatterNode
-
-	return nil
-}
-
-// configureSinkNode is used to configure a sink node and associated ID on the Backend.
-func (b *Backend) configureSinkNode(name string, filePath string, mode string, format string) error {
-	const op = "file.(Backend).configureSinkNode"
-
-	name = strings.TrimSpace(name)
-	if name == "" {
-		return fmt.Errorf("%s: name is required: %w", op, event.ErrInvalidParameter)
-	}
-
-	filePath = strings.TrimSpace(filePath)
-	if filePath == "" {
-		return fmt.Errorf("%s: file path is required: %w", op, event.ErrInvalidParameter)
-	}
-
-	format = strings.TrimSpace(format)
-	if format == "" {
-		return fmt.Errorf("%s: format is required: %w", op, event.ErrInvalidParameter)
-	}
-
-	sinkNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return fmt.Errorf("%s: error generating random NodeID for sink node: %w", op, err)
-	}
-
-	// normalize file path if configured for stdout or discard
-	if strings.EqualFold(filePath, stdout) {
-		filePath = stdout
-	} else if strings.EqualFold(filePath, discard) {
-		filePath = discard
-	}
-
-	var sinkNode eventlogger.Node
-	var sinkName string
-
-	switch filePath {
-	case stdout:
-		sinkName = stdout
-		sinkNode, err = event.NewStdoutSinkNode(format)
-	case discard:
-		sinkName = discard
-		sinkNode = event.NewNoopSink()
-	default:
-		// The NewFileSink function attempts to open the file and will return an error if it can't.
-		sinkName = name
-		sinkNode, err = event.NewFileSink(filePath, format, []event.Option{event.WithFileMode(mode)}...)
-	}
-
-	if err != nil {
-		return fmt.Errorf("%s: file sink creation failed for path %q: %w", op, filePath, err)
-	}
-
-	// Wrap the sink node with metrics middleware
-	sinkMetricTimer, err := audit.NewSinkMetricTimer(sinkName, sinkNode)
-	if err != nil {
-		return fmt.Errorf("%s: unable to add timing metrics to sink for path %q: %w", op, filePath, err)
-	}
-
-	// Decide what kind of labels we want and wrap the sink node inside a metrics counter.
-	var metricLabeler event.Labeler
-	switch {
-	case b.fallback:
-		metricLabeler = &audit.MetricLabelerAuditFallback{}
-	default:
-		metricLabeler = &audit.MetricLabelerAuditSink{}
-	}
-
-	sinkMetricCounter, err := event.NewMetricsCounter(sinkName, sinkMetricTimer, metricLabeler)
-	if err != nil {
-		return fmt.Errorf("%s: unable to add counting metrics to sink for path %q: %w", op, filePath, err)
-	}
-
-	b.nodeIDList = append(b.nodeIDList, sinkNodeID)
-	b.nodeMap[sinkNodeID] = sinkMetricCounter
-
-	return nil
-}
-
-// Name for this backend, this would ideally correspond to the mount path for the audit device.
-func (b *Backend) Name() string {
-	return b.name
-}
-
-// Nodes returns the nodes which should be used by the event framework to process audit entries.
-func (b *Backend) Nodes() map[eventlogger.NodeID]eventlogger.Node {
-	return b.nodeMap
-}
-
-// NodeIDs returns the IDs of the nodes, in the order they are required.
-func (b *Backend) NodeIDs() []eventlogger.NodeID {
-	return b.nodeIDList
-}
-
-// EventType returns the event type for the backend.
-func (b *Backend) EventType() eventlogger.EventType {
-	return eventlogger.EventType(event.AuditType.String())
-}
-
-// HasFiltering determines if the first node for the pipeline is an eventlogger.NodeTypeFilter.
-func (b *Backend) HasFiltering() bool {
-	if b.nodeMap == nil {
-		return false
-	}
-
-	return len(b.nodeIDList) > 0 && b.nodeMap[b.nodeIDList[0]].Type() == eventlogger.NodeTypeFilter
-}
-
-// IsFallback can be used to determine if this audit backend device is intended to
-// be used as a fallback to catch all events that are not written when only using
-// filtered pipelines.
-func (b *Backend) IsFallback() bool {
-	return b.fallback
-}
diff --git a/builtin/audit/file/backend_test.go b/builtin/audit/file/backend_test.go
deleted file mode 100644
index f3e495b343b..00000000000
--- a/builtin/audit/file/backend_test.go
+++ /dev/null
@@ -1,653 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package file
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strconv"
-	"testing"
-
-	"github.com/hashicorp/eventlogger"
-	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/internal/observability/event"
-	"github.com/hashicorp/vault/sdk/helper/salt"
-	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/stretchr/testify/require"
-)
-
-// TestAuditFile_fileModeNew verifies that the backend Factory correctly sets
-// the file mode when the mode argument is set.
-func TestAuditFile_fileModeNew(t *testing.T) {
-	t.Parallel()
-
-	modeStr := "0777"
-	mode, err := strconv.ParseUint(modeStr, 8, 32)
-	require.NoError(t, err)
-
-	file := filepath.Join(t.TempDir(), "auditTest.txt")
-
-	backendConfig := &audit.BackendConfig{
-		Config: map[string]string{
-			"path": file,
-			"mode": modeStr,
-		},
-		MountPath:  "foo/bar",
-		SaltConfig: &salt.Config{},
-		SaltView:   &logical.InmemStorage{},
-		Logger:     hclog.NewNullLogger(),
-	}
-	_, err = Factory(context.Background(), backendConfig, nil)
-	require.NoError(t, err)
-
-	info, err := os.Stat(file)
-	require.NoErrorf(t, err, "cannot retrieve file mode from `Stat`")
-	require.Equalf(t, os.FileMode(mode), info.Mode(), "File mode does not match.")
-}
-
-// TestAuditFile_fileModeExisting verifies that the backend Factory correctly sets
-// the mode on an existing file.
-func TestAuditFile_fileModeExisting(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	f, err := os.CreateTemp(dir, "auditTest.log")
-	require.NoErrorf(t, err, "Failure to create test file.")
-
-	err = os.Chmod(f.Name(), 0o777)
-	require.NoErrorf(t, err, "Failure to chmod temp file for testing.")
-
-	err = f.Close()
-	require.NoErrorf(t, err, "Failure to close temp file for test.")
-
-	backendConfig := &audit.BackendConfig{
-		Config: map[string]string{
-			"path": f.Name(),
-		},
-		MountPath:  "foo/bar",
-		SaltConfig: &salt.Config{},
-		SaltView:   &logical.InmemStorage{},
-		Logger:     hclog.NewNullLogger(),
-	}
-
-	_, err = Factory(context.Background(), backendConfig, nil)
-	require.NoError(t, err)
-
-	info, err := os.Stat(f.Name())
-	require.NoErrorf(t, err, "cannot retrieve file mode from `Stat`")
-	require.Equalf(t, os.FileMode(0o600), info.Mode(), "File mode does not match.")
-}
-
-// TestAuditFile_fileMode0000 verifies that setting the audit file mode to
-// "0000" prevents Vault from modifying the permissions of the file.
-func TestAuditFile_fileMode0000(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	f, err := os.CreateTemp(dir, "auditTest.log")
-	require.NoErrorf(t, err, "Failure to create test file.")
-
-	err = os.Chmod(f.Name(), 0o777)
-	require.NoErrorf(t, err, "Failure to chmod temp file for testing.")
-
-	err = f.Close()
-	require.NoErrorf(t, err, "Failure to close temp file for test.")
-
-	backendConfig := &audit.BackendConfig{
-		Config: map[string]string{
-			"path": f.Name(),
-			"mode": "0000",
-		},
-		MountPath:  "foo/bar",
-		SaltConfig: &salt.Config{},
-		SaltView:   &logical.InmemStorage{},
-		Logger:     hclog.NewNullLogger(),
-	}
-
-	_, err = Factory(context.Background(), backendConfig, nil)
-	require.NoError(t, err)
-
-	info, err := os.Stat(f.Name())
-	require.NoErrorf(t, err, "cannot retrieve file mode from `Stat`. The error is %v", err)
-	require.Equalf(t, os.FileMode(0o777), info.Mode(), "File mode does not match.")
-}
-
-// TestAuditFile_EventLogger_fileModeNew verifies that the Factory function
-// correctly sets the file mode when the useEventLogger argument is set to
-// true.
-func TestAuditFile_EventLogger_fileModeNew(t *testing.T) {
-	modeStr := "0777"
-	mode, err := strconv.ParseUint(modeStr, 8, 32)
-	require.NoError(t, err)
-
-	file := filepath.Join(t.TempDir(), "auditTest.txt")
-
-	backendConfig := &audit.BackendConfig{
-		Config: map[string]string{
-			"path": file,
-			"mode": modeStr,
-		},
-		MountPath:  "foo/bar",
-		SaltConfig: &salt.Config{},
-		SaltView:   &logical.InmemStorage{},
-		Logger:     hclog.NewNullLogger(),
-	}
-
-	_, err = Factory(context.Background(), backendConfig, nil)
-	require.NoError(t, err)
-
-	info, err := os.Stat(file)
-	require.NoErrorf(t, err, "Cannot retrieve file mode from `Stat`")
-	require.Equalf(t, os.FileMode(mode), info.Mode(), "File mode does not match.")
-}
-
-// TestBackend_formatterConfig ensures that all the configuration values are parsed correctly.
-func TestBackend_formatterConfig(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		config          map[string]string
-		want            audit.FormatterConfig
-		wantErr         bool
-		expectedMessage string
-	}{
-		"happy-path-json": {
-			config: map[string]string{
-				"format":               audit.JSONFormat.String(),
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "true",
-			},
-			want: audit.FormatterConfig{
-				Raw:                true,
-				HMACAccessor:       true,
-				ElideListResponses: true,
-				RequiredFormat:     "json",
-			}, wantErr: false,
-		},
-		"happy-path-jsonx": {
-			config: map[string]string{
-				"format":               audit.JSONxFormat.String(),
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "true",
-			},
-			want: audit.FormatterConfig{
-				Raw:                true,
-				HMACAccessor:       true,
-				ElideListResponses: true,
-				RequiredFormat:     "jsonx",
-			},
-			wantErr: false,
-		},
-		"invalid-format": {
-			config: map[string]string{
-				"format":               " squiggly ",
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "true",
-			},
-			want:            audit.FormatterConfig{},
-			wantErr:         true,
-			expectedMessage: "audit.NewFormatterConfig: error applying options: audit.(format).validate: 'squiggly' is not a valid format: invalid parameter",
-		},
-		"invalid-hmac-accessor": {
-			config: map[string]string{
-				"format":        audit.JSONFormat.String(),
-				"hmac_accessor": "maybe",
-			},
-			want:            audit.FormatterConfig{},
-			wantErr:         true,
-			expectedMessage: "file.formatterConfig: unable to parse 'hmac_accessor': strconv.ParseBool: parsing \"maybe\": invalid syntax",
-		},
-		"invalid-log-raw": {
-			config: map[string]string{
-				"format":        audit.JSONFormat.String(),
-				"hmac_accessor": "true",
-				"log_raw":       "maybe",
-			},
-			want:            audit.FormatterConfig{},
-			wantErr:         true,
-			expectedMessage: "file.formatterConfig: unable to parse 'log_raw': strconv.ParseBool: parsing \"maybe\": invalid syntax",
-		},
-		"invalid-elide-bool": {
-			config: map[string]string{
-				"format":               audit.JSONFormat.String(),
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "maybe",
-			},
-			want:            audit.FormatterConfig{},
-			wantErr:         true,
-			expectedMessage: "file.formatterConfig: unable to parse 'elide_list_responses': strconv.ParseBool: parsing \"maybe\": invalid syntax",
-		},
-	}
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got, err := formatterConfig(tc.config)
-			if tc.wantErr {
-				require.Error(t, err)
-				require.EqualError(t, err, tc.expectedMessage)
-			} else {
-				require.NoError(t, err)
-			}
-			require.Equal(t, tc.want, got)
-		})
-	}
-}
-
-// TestBackend_configureFilterNode ensures that configureFilterNode handles various
-// filter values as expected. Empty (including whitespace) strings should return
-// no error but skip configuration of the node.
-func TestBackend_configureFilterNode(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		filter           string
-		shouldSkipNode   bool
-		wantErr          bool
-		expectedErrorMsg string
-	}{
-		"happy": {
-			filter: "operation == update",
-		},
-		"empty": {
-			filter:         "",
-			shouldSkipNode: true,
-		},
-		"spacey": {
-			filter:         "    ",
-			shouldSkipNode: true,
-		},
-		"bad": {
-			filter:           "___qwerty",
-			wantErr:          true,
-			expectedErrorMsg: "file.(Backend).configureFilterNode: error creating filter node: audit.NewEntryFilter: cannot create new audit filter",
-		},
-		"unsupported-field": {
-			filter:           "foo == bar",
-			wantErr:          true,
-			expectedErrorMsg: "filter references an unsupported field: foo == bar",
-		},
-	}
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			b := &Backend{
-				nodeIDList: []eventlogger.NodeID{},
-				nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-			}
-
-			err := b.configureFilterNode(tc.filter)
-
-			switch {
-			case tc.wantErr:
-				require.Error(t, err)
-				require.ErrorContains(t, err, tc.expectedErrorMsg)
-				require.Len(t, b.nodeIDList, 0)
-				require.Len(t, b.nodeMap, 0)
-			case tc.shouldSkipNode:
-				require.NoError(t, err)
-				require.Len(t, b.nodeIDList, 0)
-				require.Len(t, b.nodeMap, 0)
-			default:
-				require.NoError(t, err)
-				require.Len(t, b.nodeIDList, 1)
-				require.Len(t, b.nodeMap, 1)
-				id := b.nodeIDList[0]
-				node := b.nodeMap[id]
-				require.Equal(t, eventlogger.NodeTypeFilter, node.Type())
-			}
-		})
-	}
-}
-
-// TestBackend_configureFormatterNode ensures that configureFormatterNode
-// populates the nodeIDList and nodeMap on Backend when given valid formatConfig.
-func TestBackend_configureFormatterNode(t *testing.T) {
-	t.Parallel()
-
-	b := &Backend{
-		nodeIDList: []eventlogger.NodeID{},
-		nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-	}
-
-	formatConfig, err := audit.NewFormatterConfig()
-	require.NoError(t, err)
-
-	err = b.configureFormatterNode("juan", formatConfig, hclog.NewNullLogger())
-
-	require.NoError(t, err)
-	require.Len(t, b.nodeIDList, 1)
-	require.Len(t, b.nodeMap, 1)
-	id := b.nodeIDList[0]
-	node := b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeFormatter, node.Type())
-}
-
-// TestBackend_configureSinkNode ensures that we can correctly configure the sink
-// node on the Backend, and any incorrect parameters result in the relevant errors.
-func TestBackend_configureSinkNode(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		name           string
-		filePath       string
-		mode           string
-		format         string
-		wantErr        bool
-		expectedErrMsg string
-		expectedName   string
-	}{
-		"name-empty": {
-			name:           "",
-			wantErr:        true,
-			expectedErrMsg: "file.(Backend).configureSinkNode: name is required: invalid parameter",
-		},
-		"name-whitespace": {
-			name:           "   ",
-			wantErr:        true,
-			expectedErrMsg: "file.(Backend).configureSinkNode: name is required: invalid parameter",
-		},
-		"filePath-empty": {
-			name:           "foo",
-			filePath:       "",
-			wantErr:        true,
-			expectedErrMsg: "file.(Backend).configureSinkNode: file path is required: invalid parameter",
-		},
-		"filePath-whitespace": {
-			name:           "foo",
-			filePath:       "   ",
-			wantErr:        true,
-			expectedErrMsg: "file.(Backend).configureSinkNode: file path is required: invalid parameter",
-		},
-		"filePath-stdout-lower": {
-			name:         "foo",
-			expectedName: "stdout",
-			filePath:     "stdout",
-			format:       "json",
-		},
-		"filePath-stdout-upper": {
-			name:         "foo",
-			expectedName: "stdout",
-			filePath:     "STDOUT",
-			format:       "json",
-		},
-		"filePath-stdout-mixed": {
-			name:         "foo",
-			expectedName: "stdout",
-			filePath:     "StdOut",
-			format:       "json",
-		},
-		"filePath-discard-lower": {
-			name:         "foo",
-			expectedName: "discard",
-			filePath:     "discard",
-			format:       "json",
-		},
-		"filePath-discard-upper": {
-			name:         "foo",
-			expectedName: "discard",
-			filePath:     "DISCARD",
-			format:       "json",
-		},
-		"filePath-discard-mixed": {
-			name:         "foo",
-			expectedName: "discard",
-			filePath:     "DisCArd",
-			format:       "json",
-		},
-		"format-empty": {
-			name:           "foo",
-			filePath:       "/tmp/",
-			format:         "",
-			wantErr:        true,
-			expectedErrMsg: "file.(Backend).configureSinkNode: format is required: invalid parameter",
-		},
-		"format-whitespace": {
-			name:           "foo",
-			filePath:       "/tmp/",
-			format:         "   ",
-			wantErr:        true,
-			expectedErrMsg: "file.(Backend).configureSinkNode: format is required: invalid parameter",
-		},
-		"filePath-weird-with-mode-zero": {
-			name:           "foo",
-			filePath:       "/tmp/qwerty",
-			format:         "json",
-			mode:           "0",
-			wantErr:        true,
-			expectedErrMsg: "file.(Backend).configureSinkNode: file sink creation failed for path \"/tmp/qwerty\": event.NewFileSink: unable to determine existing file mode: stat /tmp/qwerty: no such file or directory",
-		},
-		"happy": {
-			name:         "foo",
-			filePath:     "/tmp/audit.log",
-			mode:         "",
-			format:       "json",
-			wantErr:      false,
-			expectedName: "foo",
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			b := &Backend{
-				nodeIDList: []eventlogger.NodeID{},
-				nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-			}
-
-			err := b.configureSinkNode(tc.name, tc.filePath, tc.mode, tc.format)
-
-			if tc.wantErr {
-				require.Error(t, err)
-				require.EqualError(t, err, tc.expectedErrMsg)
-				require.Len(t, b.nodeIDList, 0)
-				require.Len(t, b.nodeMap, 0)
-			} else {
-				require.NoError(t, err)
-				require.Len(t, b.nodeIDList, 1)
-				require.Len(t, b.nodeMap, 1)
-				id := b.nodeIDList[0]
-				node := b.nodeMap[id]
-				require.Equal(t, eventlogger.NodeTypeSink, node.Type())
-				mc, ok := node.(*event.MetricsCounter)
-				require.True(t, ok)
-				require.Equal(t, tc.expectedName, mc.Name)
-			}
-		})
-	}
-}
-
-// TestBackend_configureFilterFormatterSink ensures that configuring all three
-// types of nodes on a Backend works as expected, i.e. we have all three nodes
-// at the end and nothing gets overwritten. The order of calls influences the
-// slice of IDs on the Backend.
-func TestBackend_configureFilterFormatterSink(t *testing.T) {
-	t.Parallel()
-
-	b := &Backend{
-		nodeIDList: []eventlogger.NodeID{},
-		nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-	}
-
-	formatConfig, err := audit.NewFormatterConfig()
-	require.NoError(t, err)
-
-	err = b.configureFilterNode("path == bar")
-	require.NoError(t, err)
-
-	err = b.configureFormatterNode("juan", formatConfig, hclog.NewNullLogger())
-	require.NoError(t, err)
-
-	err = b.configureSinkNode("foo", "/tmp/foo", "0777", "json")
-	require.NoError(t, err)
-
-	require.Len(t, b.nodeIDList, 3)
-	require.Len(t, b.nodeMap, 3)
-
-	id := b.nodeIDList[0]
-	node := b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeFilter, node.Type())
-
-	id = b.nodeIDList[1]
-	node = b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeFormatter, node.Type())
-
-	id = b.nodeIDList[2]
-	node = b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeSink, node.Type())
-}
-
-// TestBackend_Factory_Conf is used to ensure that any configuration which is
-// supplied, is validated and tested.
-func TestBackend_Factory_Conf(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	tests := map[string]struct {
-		backendConfig        *audit.BackendConfig
-		isErrorExpected      bool
-		expectedErrorMessage string
-	}{
-		"nil-salt-config": {
-			backendConfig: &audit.BackendConfig{
-				SaltConfig: nil,
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "file.Factory: nil salt config",
-		},
-		"nil-salt-view": {
-			backendConfig: &audit.BackendConfig{
-				SaltConfig: &salt.Config{},
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "file.Factory: nil salt view",
-		},
-		"nil-logger": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     nil,
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "file.Factory: nil logger",
-		},
-		"fallback-device-with-filter": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"fallback":  "true",
-					"file_path": discard,
-					"filter":    "mount_type == kv",
-				},
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "file.Factory: cannot configure a fallback device with a filter: invalid parameter",
-		},
-		"non-fallback-device-with-filter": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"fallback":  "false",
-					"file_path": discard,
-					"filter":    "mount_type == kv",
-				},
-			},
-			isErrorExpected: false,
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			be, err := Factory(ctx, tc.backendConfig, nil)
-
-			switch {
-			case tc.isErrorExpected:
-				require.Error(t, err)
-				require.EqualError(t, err, tc.expectedErrorMessage)
-			default:
-				require.NoError(t, err)
-				require.NotNil(t, be)
-			}
-		})
-	}
-}
-
-// TestBackend_IsFallback ensures that the 'fallback' config setting is parsed
-// and set correctly, then exposed via the interface method IsFallback().
-func TestBackend_IsFallback(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	tests := map[string]struct {
-		backendConfig      *audit.BackendConfig
-		isFallbackExpected bool
-	}{
-		"fallback": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"fallback":  "true",
-					"file_path": discard,
-				},
-			},
-			isFallbackExpected: true,
-		},
-		"no-fallback": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"fallback":  "false",
-					"file_path": discard,
-				},
-			},
-			isFallbackExpected: false,
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			be, err := Factory(ctx, tc.backendConfig, nil)
-			require.NoError(t, err)
-			require.NotNil(t, be)
-			require.Equal(t, tc.isFallbackExpected, be.IsFallback())
-		})
-	}
-}
diff --git a/builtin/audit/socket/backend.go b/builtin/audit/socket/backend.go
deleted file mode 100644
index c88c922a107..00000000000
--- a/builtin/audit/socket/backend.go
+++ /dev/null
@@ -1,342 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package socket
-
-import (
-	"context"
-	"fmt"
-	"reflect"
-	"strconv"
-	"strings"
-	"sync"
-
-	"github.com/hashicorp/eventlogger"
-	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/go-secure-stdlib/parseutil"
-	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/internal/observability/event"
-	"github.com/hashicorp/vault/sdk/helper/salt"
-	"github.com/hashicorp/vault/sdk/logical"
-)
-
-var _ audit.Backend = (*Backend)(nil)
-
-// Backend is the audit backend for the socket audit transport.
-type Backend struct {
-	fallback   bool
-	name       string
-	nodeIDList []eventlogger.NodeID
-	nodeMap    map[eventlogger.NodeID]eventlogger.Node
-	salt       *salt.Salt
-	saltConfig *salt.Config
-	saltMutex  sync.RWMutex
-	saltView   logical.Storage
-}
-
-func Factory(_ context.Context, conf *audit.BackendConfig, headersConfig audit.HeaderFormatter) (audit.Backend, error) {
-	const op = "socket.Factory"
-
-	if conf.SaltConfig == nil {
-		return nil, fmt.Errorf("%s: nil salt config", op)
-	}
-
-	if conf.SaltView == nil {
-		return nil, fmt.Errorf("%s: nil salt view", op)
-	}
-
-	if conf.Logger == nil || reflect.ValueOf(conf.Logger).IsNil() {
-		return nil, fmt.Errorf("%s: nil logger", op)
-	}
-
-	address, ok := conf.Config["address"]
-	if !ok {
-		return nil, fmt.Errorf("%s: address is required", op)
-	}
-
-	socketType, ok := conf.Config["socket_type"]
-	if !ok {
-		socketType = "tcp"
-	}
-
-	writeDeadline, ok := conf.Config["write_timeout"]
-	if !ok {
-		writeDeadline = "2s"
-	}
-
-	// The config options 'fallback' and 'filter' are mutually exclusive, a fallback
-	// device catches everything, so it cannot be allowed to filter.
-	var fallback bool
-	var err error
-	if fallbackRaw, ok := conf.Config["fallback"]; ok {
-		fallback, err = parseutil.ParseBool(fallbackRaw)
-		if err != nil {
-			return nil, fmt.Errorf("%s: unable to parse 'fallback': %w", op, err)
-		}
-	}
-
-	if _, ok := conf.Config["filter"]; ok && fallback {
-		return nil, fmt.Errorf("%s: cannot configure a fallback device with a filter: %w", op, event.ErrInvalidParameter)
-	}
-
-	b := &Backend{
-		fallback:   fallback,
-		name:       conf.MountPath,
-		saltConfig: conf.SaltConfig,
-		saltView:   conf.SaltView,
-		nodeIDList: []eventlogger.NodeID{},
-		nodeMap:    make(map[eventlogger.NodeID]eventlogger.Node),
-	}
-
-	err = b.configureFilterNode(conf.Config["filter"])
-	if err != nil {
-		return nil, fmt.Errorf("%s: error configuring filter node: %w", op, err)
-	}
-
-	cfg, err := formatterConfig(conf.Config)
-	if err != nil {
-		return nil, fmt.Errorf("%s: failed to create formatter config: %w", op, err)
-	}
-
-	opts := []audit.Option{
-		audit.WithHeaderFormatter(headersConfig),
-		audit.WithPrefix(conf.Config["prefix"]),
-	}
-
-	err = b.configureFormatterNode(conf.MountPath, cfg, conf.Logger, opts...)
-	if err != nil {
-		return nil, fmt.Errorf("%s: error configuring formatter node: %w", op, err)
-	}
-
-	sinkOpts := []event.Option{
-		event.WithSocketType(socketType),
-		event.WithMaxDuration(writeDeadline),
-	}
-
-	err = b.configureSinkNode(conf.MountPath, address, cfg.RequiredFormat.String(), sinkOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("%s: error configuring sink node: %w", op, err)
-	}
-
-	return b, nil
-}
-
-func (b *Backend) LogTestMessage(ctx context.Context, in *logical.LogInput) error {
-	if len(b.nodeIDList) > 0 {
-		return audit.ProcessManual(ctx, in, b.nodeIDList, b.nodeMap)
-	}
-
-	return nil
-}
-
-func (b *Backend) Reload(ctx context.Context) error {
-	for _, n := range b.nodeMap {
-		if n.Type() == eventlogger.NodeTypeSink {
-			return n.Reopen()
-		}
-	}
-
-	return nil
-}
-
-func (b *Backend) Salt(ctx context.Context) (*salt.Salt, error) {
-	b.saltMutex.RLock()
-	if b.salt != nil {
-		defer b.saltMutex.RUnlock()
-		return b.salt, nil
-	}
-	b.saltMutex.RUnlock()
-	b.saltMutex.Lock()
-	defer b.saltMutex.Unlock()
-	if b.salt != nil {
-		return b.salt, nil
-	}
-	s, err := salt.NewSalt(ctx, b.saltView, b.saltConfig)
-	if err != nil {
-		return nil, err
-	}
-	b.salt = s
-	return s, nil
-}
-
-func (b *Backend) Invalidate(_ context.Context) {
-	b.saltMutex.Lock()
-	defer b.saltMutex.Unlock()
-	b.salt = nil
-}
-
-// formatterConfig creates the configuration required by a formatter node using
-// the config map supplied to the factory.
-func formatterConfig(config map[string]string) (audit.FormatterConfig, error) {
-	const op = "socket.formatterConfig"
-
-	var cfgOpts []audit.Option
-
-	if format, ok := config["format"]; ok {
-		cfgOpts = append(cfgOpts, audit.WithFormat(format))
-	}
-
-	// Check if hashing of accessor is disabled
-	if hmacAccessorRaw, ok := config["hmac_accessor"]; ok {
-		v, err := strconv.ParseBool(hmacAccessorRaw)
-		if err != nil {
-			return audit.FormatterConfig{}, fmt.Errorf("%s: unable to parse 'hmac_accessor': %w", op, err)
-		}
-		cfgOpts = append(cfgOpts, audit.WithHMACAccessor(v))
-	}
-
-	// Check if raw logging is enabled
-	if raw, ok := config["log_raw"]; ok {
-		v, err := strconv.ParseBool(raw)
-		if err != nil {
-			return audit.FormatterConfig{}, fmt.Errorf("%s: unable to parse 'log_raw': %w", op, err)
-		}
-		cfgOpts = append(cfgOpts, audit.WithRaw(v))
-	}
-
-	if elideListResponsesRaw, ok := config["elide_list_responses"]; ok {
-		v, err := strconv.ParseBool(elideListResponsesRaw)
-		if err != nil {
-			return audit.FormatterConfig{}, fmt.Errorf("%s: unable to parse 'elide_list_responses': %w", op, err)
-		}
-		cfgOpts = append(cfgOpts, audit.WithElision(v))
-	}
-
-	return audit.NewFormatterConfig(cfgOpts...)
-}
-
-// configureFilterNode is used to configure a filter node and associated ID on the Backend.
-func (b *Backend) configureFilterNode(filter string) error {
-	const op = "socket.(Backend).configureFilterNode"
-
-	filter = strings.TrimSpace(filter)
-	if filter == "" {
-		return nil
-	}
-
-	filterNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return fmt.Errorf("%s: error generating random NodeID for filter node: %w", op, err)
-	}
-
-	filterNode, err := audit.NewEntryFilter(filter)
-	if err != nil {
-		return fmt.Errorf("%s: error creating filter node: %w", op, err)
-	}
-
-	b.nodeIDList = append(b.nodeIDList, filterNodeID)
-	b.nodeMap[filterNodeID] = filterNode
-
-	return nil
-}
-
-// configureFormatterNode is used to configure a formatter node and associated ID on the Backend.
-func (b *Backend) configureFormatterNode(name string, formatConfig audit.FormatterConfig, logger hclog.Logger, opts ...audit.Option) error {
-	const op = "socket.(Backend).configureFormatterNode"
-
-	formatterNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return fmt.Errorf("%s: error generating random NodeID for formatter node: %w", op, err)
-	}
-
-	formatterNode, err := audit.NewEntryFormatter(name, formatConfig, b, logger, opts...)
-	if err != nil {
-		return fmt.Errorf("%s: error creating formatter: %w", op, err)
-	}
-
-	b.nodeIDList = append(b.nodeIDList, formatterNodeID)
-	b.nodeMap[formatterNodeID] = formatterNode
-
-	return nil
-}
-
-// configureSinkNode is used to configure a sink node and associated ID on the Backend.
-func (b *Backend) configureSinkNode(name string, address string, format string, opts ...event.Option) error {
-	const op = "socket.(Backend).configureSinkNode"
-
-	name = strings.TrimSpace(name)
-	if name == "" {
-		return fmt.Errorf("%s: name is required: %w", op, event.ErrInvalidParameter)
-	}
-
-	address = strings.TrimSpace(address)
-	if address == "" {
-		return fmt.Errorf("%s: address is required: %w", op, event.ErrInvalidParameter)
-	}
-
-	format = strings.TrimSpace(format)
-	if format == "" {
-		return fmt.Errorf("%s: format is required: %w", op, event.ErrInvalidParameter)
-	}
-
-	sinkNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return fmt.Errorf("%s: error generating random NodeID for sink node: %w", op, err)
-	}
-
-	n, err := event.NewSocketSink(address, format, opts...)
-	if err != nil {
-		return fmt.Errorf("%s: error creating socket sink node: %w", op, err)
-	}
-
-	// Wrap the sink node with metrics middleware
-	sinkMetricTimer, err := audit.NewSinkMetricTimer(name, n)
-	if err != nil {
-		return fmt.Errorf("%s: unable to add timing metrics to sink for path %q: %w", op, name, err)
-	}
-
-	// Decide what kind of labels we want and wrap the sink node inside a metrics counter.
-	var metricLabeler event.Labeler
-	switch {
-	case b.fallback:
-		metricLabeler = &audit.MetricLabelerAuditFallback{}
-	default:
-		metricLabeler = &audit.MetricLabelerAuditSink{}
-	}
-
-	sinkMetricCounter, err := event.NewMetricsCounter(name, sinkMetricTimer, metricLabeler)
-	if err != nil {
-		return fmt.Errorf("%s: unable to add counting metrics to sink for path %q: %w", op, name, err)
-	}
-
-	b.nodeIDList = append(b.nodeIDList, sinkNodeID)
-	b.nodeMap[sinkNodeID] = sinkMetricCounter
-
-	return nil
-}
-
-// Name for this backend, this would ideally correspond to the mount path for the audit device.
-func (b *Backend) Name() string {
-	return b.name
-}
-
-// Nodes returns the nodes which should be used by the event framework to process audit entries.
-func (b *Backend) Nodes() map[eventlogger.NodeID]eventlogger.Node {
-	return b.nodeMap
-}
-
-// NodeIDs returns the IDs of the nodes, in the order they are required.
-func (b *Backend) NodeIDs() []eventlogger.NodeID {
-	return b.nodeIDList
-}
-
-// EventType returns the event type for the backend.
-func (b *Backend) EventType() eventlogger.EventType {
-	return eventlogger.EventType(event.AuditType.String())
-}
-
-// HasFiltering determines if the first node for the pipeline is an eventlogger.NodeTypeFilter.
-func (b *Backend) HasFiltering() bool {
-	if b.nodeMap == nil {
-		return false
-	}
-
-	return len(b.nodeIDList) > 0 && b.nodeMap[b.nodeIDList[0]].Type() == eventlogger.NodeTypeFilter
-}
-
-// IsFallback can be used to determine if this audit backend device is intended to
-// be used as a fallback to catch all events that are not written when only using
-// filtered pipelines.
-func (b *Backend) IsFallback() bool {
-	return b.fallback
-}
diff --git a/builtin/audit/socket/backend_test.go b/builtin/audit/socket/backend_test.go
deleted file mode 100644
index 1c94e5ce6a0..00000000000
--- a/builtin/audit/socket/backend_test.go
+++ /dev/null
@@ -1,549 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package socket
-
-import (
-	"context"
-	"testing"
-
-	"github.com/hashicorp/eventlogger"
-	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/internal/observability/event"
-	"github.com/hashicorp/vault/sdk/helper/salt"
-	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/stretchr/testify/require"
-)
-
-// TestBackend_formatterConfig ensures that all the configuration values are parsed correctly.
-func TestBackend_formatterConfig(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		config         map[string]string
-		want           audit.FormatterConfig
-		wantErr        bool
-		expectedErrMsg string
-	}{
-		"happy-path-json": {
-			config: map[string]string{
-				"format":               audit.JSONFormat.String(),
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "true",
-			},
-			want: audit.FormatterConfig{
-				Raw:                true,
-				HMACAccessor:       true,
-				ElideListResponses: true,
-				RequiredFormat:     "json",
-			}, wantErr: false,
-		},
-		"happy-path-jsonx": {
-			config: map[string]string{
-				"format":               audit.JSONxFormat.String(),
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "true",
-			},
-			want: audit.FormatterConfig{
-				Raw:                true,
-				HMACAccessor:       true,
-				ElideListResponses: true,
-				RequiredFormat:     "jsonx",
-			},
-			wantErr: false,
-		},
-		"invalid-format": {
-			config: map[string]string{
-				"format":               " squiggly ",
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "true",
-			},
-			want:           audit.FormatterConfig{},
-			wantErr:        true,
-			expectedErrMsg: "audit.NewFormatterConfig: error applying options: audit.(format).validate: 'squiggly' is not a valid format: invalid parameter",
-		},
-		"invalid-hmac-accessor": {
-			config: map[string]string{
-				"format":        audit.JSONFormat.String(),
-				"hmac_accessor": "maybe",
-			},
-			want:           audit.FormatterConfig{},
-			wantErr:        true,
-			expectedErrMsg: "socket.formatterConfig: unable to parse 'hmac_accessor': strconv.ParseBool: parsing \"maybe\": invalid syntax",
-		},
-		"invalid-log-raw": {
-			config: map[string]string{
-				"format":        audit.JSONFormat.String(),
-				"hmac_accessor": "true",
-				"log_raw":       "maybe",
-			},
-			want:           audit.FormatterConfig{},
-			wantErr:        true,
-			expectedErrMsg: "socket.formatterConfig: unable to parse 'log_raw': strconv.ParseBool: parsing \"maybe\": invalid syntax",
-		},
-		"invalid-elide-bool": {
-			config: map[string]string{
-				"format":               audit.JSONFormat.String(),
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "maybe",
-			},
-			want:           audit.FormatterConfig{},
-			wantErr:        true,
-			expectedErrMsg: "socket.formatterConfig: unable to parse 'elide_list_responses': strconv.ParseBool: parsing \"maybe\": invalid syntax",
-		},
-	}
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got, err := formatterConfig(tc.config)
-			if tc.wantErr {
-				require.Error(t, err)
-				require.EqualError(t, err, tc.expectedErrMsg)
-			} else {
-				require.NoError(t, err)
-			}
-			require.Equal(t, tc.want, got)
-		})
-	}
-}
-
-// TestBackend_configureFilterNode ensures that configureFilterNode handles various
-// filter values as expected. Empty (including whitespace) strings should return
-// no error but skip configuration of the node.
-func TestBackend_configureFilterNode(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		filter           string
-		shouldSkipNode   bool
-		wantErr          bool
-		expectedErrorMsg string
-	}{
-		"happy": {
-			filter: "mount_point == \"/auth/token\"",
-		},
-		"empty": {
-			filter:         "",
-			shouldSkipNode: true,
-		},
-		"spacey": {
-			filter:         "    ",
-			shouldSkipNode: true,
-		},
-		"bad": {
-			filter:           "___qwerty",
-			wantErr:          true,
-			expectedErrorMsg: "socket.(Backend).configureFilterNode: error creating filter node: audit.NewEntryFilter: cannot create new audit filter",
-		},
-		"unsupported-field": {
-			filter:           "foo == bar",
-			wantErr:          true,
-			expectedErrorMsg: "filter references an unsupported field: foo == bar",
-		},
-	}
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			b := &Backend{
-				nodeIDList: []eventlogger.NodeID{},
-				nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-			}
-
-			err := b.configureFilterNode(tc.filter)
-
-			switch {
-			case tc.wantErr:
-				require.Error(t, err)
-				require.ErrorContains(t, err, tc.expectedErrorMsg)
-				require.Len(t, b.nodeIDList, 0)
-				require.Len(t, b.nodeMap, 0)
-			case tc.shouldSkipNode:
-				require.NoError(t, err)
-				require.Len(t, b.nodeIDList, 0)
-				require.Len(t, b.nodeMap, 0)
-			default:
-				require.NoError(t, err)
-				require.Len(t, b.nodeIDList, 1)
-				require.Len(t, b.nodeMap, 1)
-				id := b.nodeIDList[0]
-				node := b.nodeMap[id]
-				require.Equal(t, eventlogger.NodeTypeFilter, node.Type())
-			}
-		})
-	}
-}
-
-// TestBackend_configureFormatterNode ensures that configureFormatterNode
-// populates the nodeIDList and nodeMap on Backend when given valid formatConfig.
-func TestBackend_configureFormatterNode(t *testing.T) {
-	t.Parallel()
-
-	b := &Backend{
-		nodeIDList: []eventlogger.NodeID{},
-		nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-	}
-
-	formatConfig, err := audit.NewFormatterConfig()
-	require.NoError(t, err)
-
-	err = b.configureFormatterNode("juan", formatConfig, hclog.NewNullLogger())
-
-	require.NoError(t, err)
-	require.Len(t, b.nodeIDList, 1)
-	require.Len(t, b.nodeMap, 1)
-	id := b.nodeIDList[0]
-	node := b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeFormatter, node.Type())
-}
-
-// TestBackend_configureSinkNode ensures that we can correctly configure the sink
-// node on the Backend, and any incorrect parameters result in the relevant errors.
-func TestBackend_configureSinkNode(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		name           string
-		address        string
-		format         string
-		wantErr        bool
-		expectedErrMsg string
-		expectedName   string
-	}{
-		"name-empty": {
-			name:           "",
-			address:        "wss://foo",
-			wantErr:        true,
-			expectedErrMsg: "socket.(Backend).configureSinkNode: name is required: invalid parameter",
-		},
-		"name-whitespace": {
-			name:           "   ",
-			address:        "wss://foo",
-			wantErr:        true,
-			expectedErrMsg: "socket.(Backend).configureSinkNode: name is required: invalid parameter",
-		},
-		"address-empty": {
-			name:           "foo",
-			address:        "",
-			wantErr:        true,
-			expectedErrMsg: "socket.(Backend).configureSinkNode: address is required: invalid parameter",
-		},
-		"address-whitespace": {
-			name:           "foo",
-			address:        "   ",
-			wantErr:        true,
-			expectedErrMsg: "socket.(Backend).configureSinkNode: address is required: invalid parameter",
-		},
-		"format-empty": {
-			name:           "foo",
-			address:        "wss://foo",
-			format:         "",
-			wantErr:        true,
-			expectedErrMsg: "socket.(Backend).configureSinkNode: format is required: invalid parameter",
-		},
-		"format-whitespace": {
-			name:           "foo",
-			address:        "wss://foo",
-			format:         "   ",
-			wantErr:        true,
-			expectedErrMsg: "socket.(Backend).configureSinkNode: format is required: invalid parameter",
-		},
-		"happy": {
-			name:         "foo",
-			address:      "wss://foo",
-			format:       "json",
-			wantErr:      false,
-			expectedName: "foo",
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			b := &Backend{
-				nodeIDList: []eventlogger.NodeID{},
-				nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-			}
-
-			err := b.configureSinkNode(tc.name, tc.address, tc.format)
-
-			if tc.wantErr {
-				require.Error(t, err)
-				require.EqualError(t, err, tc.expectedErrMsg)
-				require.Len(t, b.nodeIDList, 0)
-				require.Len(t, b.nodeMap, 0)
-			} else {
-				require.NoError(t, err)
-				require.Len(t, b.nodeIDList, 1)
-				require.Len(t, b.nodeMap, 1)
-				id := b.nodeIDList[0]
-				node := b.nodeMap[id]
-				require.Equal(t, eventlogger.NodeTypeSink, node.Type())
-				mc, ok := node.(*event.MetricsCounter)
-				require.True(t, ok)
-				require.Equal(t, tc.expectedName, mc.Name)
-			}
-		})
-	}
-}
-
-// TestBackend_configureFilterFormatterSink ensures that configuring all three
-// types of nodes on a Backend works as expected, i.e. we have all three nodes
-// at the end and nothing gets overwritten. The order of calls influences the
-// slice of IDs on the Backend.
-func TestBackend_configureFilterFormatterSink(t *testing.T) {
-	t.Parallel()
-
-	b := &Backend{
-		nodeIDList: []eventlogger.NodeID{},
-		nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-	}
-
-	formatConfig, err := audit.NewFormatterConfig()
-	require.NoError(t, err)
-
-	err = b.configureFilterNode("mount_type == kv")
-	require.NoError(t, err)
-
-	err = b.configureFormatterNode("juan", formatConfig, hclog.NewNullLogger())
-	require.NoError(t, err)
-
-	err = b.configureSinkNode("foo", "https://hashicorp.com", "json")
-	require.NoError(t, err)
-
-	require.Len(t, b.nodeIDList, 3)
-	require.Len(t, b.nodeMap, 3)
-
-	id := b.nodeIDList[0]
-	node := b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeFilter, node.Type())
-
-	id = b.nodeIDList[1]
-	node = b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeFormatter, node.Type())
-
-	id = b.nodeIDList[2]
-	node = b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeSink, node.Type())
-}
-
-// TestBackend_Factory_Conf is used to ensure that any configuration which is
-// supplied, is validated and tested.
-func TestBackend_Factory_Conf(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	tests := map[string]struct {
-		backendConfig        *audit.BackendConfig
-		isErrorExpected      bool
-		expectedErrorMessage string
-	}{
-		"nil-salt-config": {
-			backendConfig: &audit.BackendConfig{
-				SaltConfig: nil,
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "socket.Factory: nil salt config",
-		},
-		"nil-salt-view": {
-			backendConfig: &audit.BackendConfig{
-				SaltConfig: &salt.Config{},
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "socket.Factory: nil salt view",
-		},
-		"nil-logger": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     nil,
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "socket.Factory: nil logger",
-		},
-		"no-address": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config:     map[string]string{},
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "socket.Factory: address is required",
-		},
-		"empty-address": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"address": "",
-				},
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "socket.Factory: error configuring sink node: socket.(Backend).configureSinkNode: address is required: invalid parameter",
-		},
-		"whitespace-address": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"address": "    ",
-				},
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "socket.Factory: error configuring sink node: socket.(Backend).configureSinkNode: address is required: invalid parameter",
-		},
-		"write-duration-valid": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"address":       "hashicorp.com",
-					"write_timeout": "5s",
-				},
-			},
-			isErrorExpected: false,
-		},
-		"write-duration-not-valid": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"address":       "hashicorp.com",
-					"write_timeout": "qwerty",
-				},
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "socket.Factory: error configuring sink node: socket.(Backend).configureSinkNode: error creating socket sink node: event.NewSocketSink: error applying options: unable to parse max duration: time: invalid duration \"qwerty\"",
-		},
-		"non-fallback-device-with-filter": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"address":       "hashicorp.com",
-					"write_timeout": "5s",
-					"fallback":      "false",
-					"filter":        "mount_type == kv",
-				},
-			},
-			isErrorExpected: false,
-		},
-		"fallback-device-with-filter": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"address":       "hashicorp.com",
-					"write_timeout": "2s",
-					"fallback":      "true",
-					"filter":        "mount_type == kv",
-				},
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "socket.Factory: cannot configure a fallback device with a filter: invalid parameter",
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			be, err := Factory(ctx, tc.backendConfig, nil)
-
-			switch {
-			case tc.isErrorExpected:
-				require.Error(t, err)
-				require.EqualError(t, err, tc.expectedErrorMessage)
-			default:
-				require.NoError(t, err)
-				require.NotNil(t, be)
-			}
-		})
-	}
-}
-
-// TestBackend_IsFallback ensures that the 'fallback' config setting is parsed
-// and set correctly, then exposed via the interface method IsFallback().
-func TestBackend_IsFallback(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	tests := map[string]struct {
-		backendConfig      *audit.BackendConfig
-		isFallbackExpected bool
-	}{
-		"fallback": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "qwerty",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"fallback":      "true",
-					"address":       "hashicorp.com",
-					"write_timeout": "5s",
-				},
-			},
-			isFallbackExpected: true,
-		},
-		"no-fallback": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "qwerty",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"fallback":      "false",
-					"address":       "hashicorp.com",
-					"write_timeout": "5s",
-				},
-			},
-			isFallbackExpected: false,
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			be, err := Factory(ctx, tc.backendConfig, nil)
-			require.NoError(t, err)
-			require.NotNil(t, be)
-			require.Equal(t, tc.isFallbackExpected, be.IsFallback())
-		})
-	}
-}
diff --git a/builtin/audit/syslog/backend.go b/builtin/audit/syslog/backend.go
deleted file mode 100644
index 28d2d6f59b6..00000000000
--- a/builtin/audit/syslog/backend.go
+++ /dev/null
@@ -1,328 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package syslog
-
-import (
-	"context"
-	"fmt"
-	"reflect"
-	"strconv"
-	"strings"
-	"sync"
-
-	"github.com/hashicorp/eventlogger"
-	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/go-secure-stdlib/parseutil"
-	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/internal/observability/event"
-	"github.com/hashicorp/vault/sdk/helper/salt"
-	"github.com/hashicorp/vault/sdk/logical"
-)
-
-var _ audit.Backend = (*Backend)(nil)
-
-// Backend is the audit backend for the syslog-based audit store.
-type Backend struct {
-	fallback   bool
-	name       string
-	nodeIDList []eventlogger.NodeID
-	nodeMap    map[eventlogger.NodeID]eventlogger.Node
-	salt       *salt.Salt
-	saltConfig *salt.Config
-	saltMutex  sync.RWMutex
-	saltView   logical.Storage
-}
-
-func Factory(_ context.Context, conf *audit.BackendConfig, headersConfig audit.HeaderFormatter) (audit.Backend, error) {
-	const op = "syslog.Factory"
-
-	if conf.SaltConfig == nil {
-		return nil, fmt.Errorf("%s: nil salt config", op)
-	}
-
-	if conf.SaltView == nil {
-		return nil, fmt.Errorf("%s: nil salt view", op)
-	}
-
-	if conf.Logger == nil || reflect.ValueOf(conf.Logger).IsNil() {
-		return nil, fmt.Errorf("%s: nil logger", op)
-	}
-
-	// Get facility or default to AUTH
-	facility, ok := conf.Config["facility"]
-	if !ok {
-		facility = "AUTH"
-	}
-
-	// Get tag or default to 'vault'
-	tag, ok := conf.Config["tag"]
-	if !ok {
-		tag = "vault"
-	}
-
-	// The config options 'fallback' and 'filter' are mutually exclusive, a fallback
-	// device catches everything, so it cannot be allowed to filter.
-	var fallback bool
-	var err error
-	if fallbackRaw, ok := conf.Config["fallback"]; ok {
-		fallback, err = parseutil.ParseBool(fallbackRaw)
-		if err != nil {
-			return nil, fmt.Errorf("%s: unable to parse 'fallback': %w", op, err)
-		}
-	}
-
-	if _, ok := conf.Config["filter"]; ok && fallback {
-		return nil, fmt.Errorf("%s: cannot configure a fallback device with a filter: %w", op, event.ErrInvalidParameter)
-	}
-
-	b := &Backend{
-		fallback:   fallback,
-		name:       conf.MountPath,
-		saltConfig: conf.SaltConfig,
-		saltView:   conf.SaltView,
-		nodeIDList: []eventlogger.NodeID{},
-		nodeMap:    make(map[eventlogger.NodeID]eventlogger.Node),
-	}
-
-	err = b.configureFilterNode(conf.Config["filter"])
-	if err != nil {
-		return nil, fmt.Errorf("%s: error configuring filter node: %w", op, err)
-	}
-
-	cfg, err := formatterConfig(conf.Config)
-	if err != nil {
-		return nil, fmt.Errorf("%s: failed to create formatter config: %w", op, err)
-	}
-
-	formatterOpts := []audit.Option{
-		audit.WithHeaderFormatter(headersConfig),
-		audit.WithPrefix(conf.Config["prefix"]),
-	}
-
-	err = b.configureFormatterNode(conf.MountPath, cfg, conf.Logger, formatterOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("%s: error configuring formatter node: %w", op, err)
-	}
-
-	sinkOpts := []event.Option{
-		event.WithFacility(facility),
-		event.WithTag(tag),
-	}
-
-	err = b.configureSinkNode(conf.MountPath, cfg.RequiredFormat.String(), sinkOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("%s: error configuring sink node: %w", op, err)
-	}
-
-	return b, nil
-}
-
-func (b *Backend) LogTestMessage(ctx context.Context, in *logical.LogInput) error {
-	if len(b.nodeIDList) > 0 {
-		return audit.ProcessManual(ctx, in, b.nodeIDList, b.nodeMap)
-	}
-
-	return nil
-}
-
-func (b *Backend) Reload(_ context.Context) error {
-	return nil
-}
-
-func (b *Backend) Salt(ctx context.Context) (*salt.Salt, error) {
-	b.saltMutex.RLock()
-	if b.salt != nil {
-		defer b.saltMutex.RUnlock()
-		return b.salt, nil
-	}
-	b.saltMutex.RUnlock()
-	b.saltMutex.Lock()
-	defer b.saltMutex.Unlock()
-	if b.salt != nil {
-		return b.salt, nil
-	}
-	s, err := salt.NewSalt(ctx, b.saltView, b.saltConfig)
-	if err != nil {
-		return nil, err
-	}
-	b.salt = s
-	return s, nil
-}
-
-func (b *Backend) Invalidate(_ context.Context) {
-	b.saltMutex.Lock()
-	defer b.saltMutex.Unlock()
-	b.salt = nil
-}
-
-// formatterConfig creates the configuration required by a formatter node using
-// the config map supplied to the factory.
-func formatterConfig(config map[string]string) (audit.FormatterConfig, error) {
-	const op = "syslog.formatterConfig"
-
-	var opts []audit.Option
-
-	if format, ok := config["format"]; ok {
-		opts = append(opts, audit.WithFormat(format))
-	}
-
-	// Check if hashing of accessor is disabled
-	if hmacAccessorRaw, ok := config["hmac_accessor"]; ok {
-		v, err := strconv.ParseBool(hmacAccessorRaw)
-		if err != nil {
-			return audit.FormatterConfig{}, fmt.Errorf("%s: unable to parse 'hmac_accessor': %w", op, err)
-		}
-		opts = append(opts, audit.WithHMACAccessor(v))
-	}
-
-	// Check if raw logging is enabled
-	if raw, ok := config["log_raw"]; ok {
-		v, err := strconv.ParseBool(raw)
-		if err != nil {
-			return audit.FormatterConfig{}, fmt.Errorf("%s: unable to parse 'log_raw': %w", op, err)
-		}
-		opts = append(opts, audit.WithRaw(v))
-	}
-
-	if elideListResponsesRaw, ok := config["elide_list_responses"]; ok {
-		v, err := strconv.ParseBool(elideListResponsesRaw)
-		if err != nil {
-			return audit.FormatterConfig{}, fmt.Errorf("%s: unable to parse 'elide_list_responses': %w", op, err)
-		}
-		opts = append(opts, audit.WithElision(v))
-	}
-
-	return audit.NewFormatterConfig(opts...)
-}
-
-// configureFilterNode is used to configure a filter node and associated ID on the Backend.
-func (b *Backend) configureFilterNode(filter string) error {
-	const op = "syslog.(Backend).configureFilterNode"
-
-	filter = strings.TrimSpace(filter)
-	if filter == "" {
-		return nil
-	}
-
-	filterNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return fmt.Errorf("%s: error generating random NodeID for filter node: %w", op, err)
-	}
-
-	filterNode, err := audit.NewEntryFilter(filter)
-	if err != nil {
-		return fmt.Errorf("%s: error creating filter node: %w", op, err)
-	}
-
-	b.nodeIDList = append(b.nodeIDList, filterNodeID)
-	b.nodeMap[filterNodeID] = filterNode
-
-	return nil
-}
-
-// configureFormatterNode is used to configure a formatter node and associated ID on the Backend.
-func (b *Backend) configureFormatterNode(name string, formatConfig audit.FormatterConfig, logger hclog.Logger, opts ...audit.Option) error {
-	const op = "syslog.(Backend).configureFormatterNode"
-
-	formatterNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return fmt.Errorf("%s: error generating random NodeID for formatter node: %w", op, err)
-	}
-
-	formatterNode, err := audit.NewEntryFormatter(name, formatConfig, b, logger, opts...)
-	if err != nil {
-		return fmt.Errorf("%s: error creating formatter: %w", op, err)
-	}
-
-	b.nodeIDList = append(b.nodeIDList, formatterNodeID)
-	b.nodeMap[formatterNodeID] = formatterNode
-
-	return nil
-}
-
-// configureSinkNode is used to configure a sink node and associated ID on the Backend.
-func (b *Backend) configureSinkNode(name string, format string, opts ...event.Option) error {
-	const op = "syslog.(Backend).configureSinkNode"
-
-	name = strings.TrimSpace(name)
-	if name == "" {
-		return fmt.Errorf("%s: name is required: %w", op, event.ErrInvalidParameter)
-	}
-
-	format = strings.TrimSpace(format)
-	if format == "" {
-		return fmt.Errorf("%s: format is required: %w", op, event.ErrInvalidParameter)
-	}
-
-	sinkNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return fmt.Errorf("%s: error generating random NodeID for sink node: %w", op, err)
-	}
-
-	n, err := event.NewSyslogSink(format, opts...)
-	if err != nil {
-		return fmt.Errorf("%s: error creating syslog sink node: %w", op, err)
-	}
-
-	// Wrap the sink node with metrics middleware
-	sinkMetricTimer, err := audit.NewSinkMetricTimer(name, n)
-	if err != nil {
-		return fmt.Errorf("%s: unable to add timing metrics to sink for path %q: %w", op, name, err)
-	}
-
-	// Decide what kind of labels we want and wrap the sink node inside a metrics counter.
-	var metricLabeler event.Labeler
-	switch {
-	case b.fallback:
-		metricLabeler = &audit.MetricLabelerAuditFallback{}
-	default:
-		metricLabeler = &audit.MetricLabelerAuditSink{}
-	}
-
-	sinkMetricCounter, err := event.NewMetricsCounter(name, sinkMetricTimer, metricLabeler)
-	if err != nil {
-		return fmt.Errorf("%s: unable to add counting metrics to sink for path %q: %w", op, name, err)
-	}
-
-	b.nodeIDList = append(b.nodeIDList, sinkNodeID)
-	b.nodeMap[sinkNodeID] = sinkMetricCounter
-
-	return nil
-}
-
-// Name for this backend, this would ideally correspond to the mount path for the audit device.
-func (b *Backend) Name() string {
-	return b.name
-}
-
-// Nodes returns the nodes which should be used by the event framework to process audit entries.
-func (b *Backend) Nodes() map[eventlogger.NodeID]eventlogger.Node {
-	return b.nodeMap
-}
-
-// NodeIDs returns the IDs of the nodes, in the order they are required.
-func (b *Backend) NodeIDs() []eventlogger.NodeID {
-	return b.nodeIDList
-}
-
-// EventType returns the event type for the backend.
-func (b *Backend) EventType() eventlogger.EventType {
-	return eventlogger.EventType(event.AuditType.String())
-}
-
-// HasFiltering determines if the first node for the pipeline is an eventlogger.NodeTypeFilter.
-func (b *Backend) HasFiltering() bool {
-	if b.nodeMap == nil {
-		return false
-	}
-
-	return len(b.nodeIDList) > 0 && b.nodeMap[b.nodeIDList[0]].Type() == eventlogger.NodeTypeFilter
-}
-
-// IsFallback can be used to determine if this audit backend device is intended to
-// be used as a fallback to catch all events that are not written when only using
-// filtered pipelines.
-func (b *Backend) IsFallback() bool {
-	return b.fallback
-}
diff --git a/builtin/audit/syslog/backend_test.go b/builtin/audit/syslog/backend_test.go
deleted file mode 100644
index fb1e297b327..00000000000
--- a/builtin/audit/syslog/backend_test.go
+++ /dev/null
@@ -1,450 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package syslog
-
-import (
-	"context"
-	"testing"
-
-	"github.com/hashicorp/go-hclog"
-
-	"github.com/hashicorp/eventlogger"
-	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/internal/observability/event"
-	"github.com/hashicorp/vault/sdk/helper/salt"
-	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/stretchr/testify/require"
-)
-
-// TestBackend_formatterConfig ensures that all the configuration values are parsed correctly.
-func TestBackend_formatterConfig(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		config         map[string]string
-		want           audit.FormatterConfig
-		wantErr        bool
-		expectedErrMsg string
-	}{
-		"happy-path-json": {
-			config: map[string]string{
-				"format":               audit.JSONFormat.String(),
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "true",
-			},
-			want: audit.FormatterConfig{
-				Raw:                true,
-				HMACAccessor:       true,
-				ElideListResponses: true,
-				RequiredFormat:     "json",
-			}, wantErr: false,
-		},
-		"happy-path-jsonx": {
-			config: map[string]string{
-				"format":               audit.JSONxFormat.String(),
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "true",
-			},
-			want: audit.FormatterConfig{
-				Raw:                true,
-				HMACAccessor:       true,
-				ElideListResponses: true,
-				RequiredFormat:     "jsonx",
-			},
-			wantErr: false,
-		},
-		"invalid-format": {
-			config: map[string]string{
-				"format":               " squiggly ",
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "true",
-			},
-			want:           audit.FormatterConfig{},
-			wantErr:        true,
-			expectedErrMsg: "audit.NewFormatterConfig: error applying options: audit.(format).validate: 'squiggly' is not a valid format: invalid parameter",
-		},
-		"invalid-hmac-accessor": {
-			config: map[string]string{
-				"format":        audit.JSONFormat.String(),
-				"hmac_accessor": "maybe",
-			},
-			want:           audit.FormatterConfig{},
-			wantErr:        true,
-			expectedErrMsg: "syslog.formatterConfig: unable to parse 'hmac_accessor': strconv.ParseBool: parsing \"maybe\": invalid syntax",
-		},
-		"invalid-log-raw": {
-			config: map[string]string{
-				"format":        audit.JSONFormat.String(),
-				"hmac_accessor": "true",
-				"log_raw":       "maybe",
-			},
-			want:           audit.FormatterConfig{},
-			wantErr:        true,
-			expectedErrMsg: "syslog.formatterConfig: unable to parse 'log_raw': strconv.ParseBool: parsing \"maybe\": invalid syntax",
-		},
-		"invalid-elide-bool": {
-			config: map[string]string{
-				"format":               audit.JSONFormat.String(),
-				"hmac_accessor":        "true",
-				"log_raw":              "true",
-				"elide_list_responses": "maybe",
-			},
-			want:           audit.FormatterConfig{},
-			wantErr:        true,
-			expectedErrMsg: "syslog.formatterConfig: unable to parse 'elide_list_responses': strconv.ParseBool: parsing \"maybe\": invalid syntax",
-		},
-	}
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			got, err := formatterConfig(tc.config)
-			if tc.wantErr {
-				require.Error(t, err)
-				require.EqualError(t, err, tc.expectedErrMsg)
-			} else {
-				require.NoError(t, err)
-			}
-			require.Equal(t, tc.want, got)
-		})
-	}
-}
-
-// TestBackend_configureFilterNode ensures that configureFilterNode handles various
-// filter values as expected. Empty (including whitespace) strings should return
-// no error but skip configuration of the node.
-func TestBackend_configureFilterNode(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		filter           string
-		shouldSkipNode   bool
-		wantErr          bool
-		expectedErrorMsg string
-	}{
-		"happy": {
-			filter: "namespace == bar",
-		},
-		"empty": {
-			filter:         "",
-			shouldSkipNode: true,
-		},
-		"spacey": {
-			filter:         "    ",
-			shouldSkipNode: true,
-		},
-		"bad": {
-			filter:           "___qwerty",
-			wantErr:          true,
-			expectedErrorMsg: "syslog.(Backend).configureFilterNode: error creating filter node: audit.NewEntryFilter: cannot create new audit filter",
-		},
-		"unsupported-field": {
-			filter:           "foo == bar",
-			wantErr:          true,
-			expectedErrorMsg: "filter references an unsupported field: foo == bar",
-		},
-	}
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			b := &Backend{
-				nodeIDList: []eventlogger.NodeID{},
-				nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-			}
-
-			err := b.configureFilterNode(tc.filter)
-
-			switch {
-			case tc.wantErr:
-				require.Error(t, err)
-				require.ErrorContains(t, err, tc.expectedErrorMsg)
-				require.Len(t, b.nodeIDList, 0)
-				require.Len(t, b.nodeMap, 0)
-			case tc.shouldSkipNode:
-				require.NoError(t, err)
-				require.Len(t, b.nodeIDList, 0)
-				require.Len(t, b.nodeMap, 0)
-			default:
-				require.NoError(t, err)
-				require.Len(t, b.nodeIDList, 1)
-				require.Len(t, b.nodeMap, 1)
-				id := b.nodeIDList[0]
-				node := b.nodeMap[id]
-				require.Equal(t, eventlogger.NodeTypeFilter, node.Type())
-			}
-		})
-	}
-}
-
-// TestBackend_configureFormatterNode ensures that configureFormatterNode
-// populates the nodeIDList and nodeMap on Backend when given valid formatConfig.
-func TestBackend_configureFormatterNode(t *testing.T) {
-	t.Parallel()
-
-	b := &Backend{
-		nodeIDList: []eventlogger.NodeID{},
-		nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-	}
-
-	formatConfig, err := audit.NewFormatterConfig()
-	require.NoError(t, err)
-
-	err = b.configureFormatterNode("juan", formatConfig, hclog.NewNullLogger())
-
-	require.NoError(t, err)
-	require.Len(t, b.nodeIDList, 1)
-	require.Len(t, b.nodeMap, 1)
-	id := b.nodeIDList[0]
-	node := b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeFormatter, node.Type())
-}
-
-// TestBackend_configureSinkNode ensures that we can correctly configure the sink
-// node on the Backend, and any incorrect parameters result in the relevant errors.
-func TestBackend_configureSinkNode(t *testing.T) {
-	t.Parallel()
-
-	tests := map[string]struct {
-		name           string
-		format         string
-		wantErr        bool
-		expectedErrMsg string
-		expectedName   string
-	}{
-		"name-empty": {
-			name:           "",
-			wantErr:        true,
-			expectedErrMsg: "syslog.(Backend).configureSinkNode: name is required: invalid parameter",
-		},
-		"name-whitespace": {
-			name:           "   ",
-			wantErr:        true,
-			expectedErrMsg: "syslog.(Backend).configureSinkNode: name is required: invalid parameter",
-		},
-		"format-empty": {
-			name:           "foo",
-			format:         "",
-			wantErr:        true,
-			expectedErrMsg: "syslog.(Backend).configureSinkNode: format is required: invalid parameter",
-		},
-		"format-whitespace": {
-			name:           "foo",
-			format:         "   ",
-			wantErr:        true,
-			expectedErrMsg: "syslog.(Backend).configureSinkNode: format is required: invalid parameter",
-		},
-		"happy": {
-			name:         "foo",
-			format:       "json",
-			wantErr:      false,
-			expectedName: "foo",
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			b := &Backend{
-				nodeIDList: []eventlogger.NodeID{},
-				nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-			}
-
-			err := b.configureSinkNode(tc.name, tc.format)
-
-			if tc.wantErr {
-				require.Error(t, err)
-				require.EqualError(t, err, tc.expectedErrMsg)
-				require.Len(t, b.nodeIDList, 0)
-				require.Len(t, b.nodeMap, 0)
-			} else {
-				require.NoError(t, err)
-				require.Len(t, b.nodeIDList, 1)
-				require.Len(t, b.nodeMap, 1)
-				id := b.nodeIDList[0]
-				node := b.nodeMap[id]
-				require.Equal(t, eventlogger.NodeTypeSink, node.Type())
-				mc, ok := node.(*event.MetricsCounter)
-				require.True(t, ok)
-				require.Equal(t, tc.expectedName, mc.Name)
-			}
-		})
-	}
-}
-
-// TestBackend_configureFilterFormatterSink ensures that configuring all three
-// types of nodes on a Backend works as expected, i.e. we have all three nodes
-// at the end and nothing gets overwritten. The order of calls influences the
-// slice of IDs on the Backend.
-func TestBackend_configureFilterFormatterSink(t *testing.T) {
-	t.Parallel()
-
-	b := &Backend{
-		nodeIDList: []eventlogger.NodeID{},
-		nodeMap:    map[eventlogger.NodeID]eventlogger.Node{},
-	}
-
-	formatConfig, err := audit.NewFormatterConfig()
-	require.NoError(t, err)
-
-	err = b.configureFilterNode("mount_type == kv")
-	require.NoError(t, err)
-
-	err = b.configureFormatterNode("juan", formatConfig, hclog.NewNullLogger())
-	require.NoError(t, err)
-
-	err = b.configureSinkNode("foo", "json")
-	require.NoError(t, err)
-
-	require.Len(t, b.nodeIDList, 3)
-	require.Len(t, b.nodeMap, 3)
-
-	id := b.nodeIDList[0]
-	node := b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeFilter, node.Type())
-
-	id = b.nodeIDList[1]
-	node = b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeFormatter, node.Type())
-
-	id = b.nodeIDList[2]
-	node = b.nodeMap[id]
-	require.Equal(t, eventlogger.NodeTypeSink, node.Type())
-}
-
-// TestBackend_Factory_Conf is used to ensure that any configuration which is
-// supplied, is validated and tested.
-func TestBackend_Factory_Conf(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	tests := map[string]struct {
-		backendConfig        *audit.BackendConfig
-		isErrorExpected      bool
-		expectedErrorMessage string
-	}{
-		"nil-salt-config": {
-			backendConfig: &audit.BackendConfig{
-				SaltConfig: nil,
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "syslog.Factory: nil salt config",
-		},
-		"nil-salt-view": {
-			backendConfig: &audit.BackendConfig{
-				SaltConfig: &salt.Config{},
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "syslog.Factory: nil salt view",
-		},
-		"non-fallback-device-with-filter": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"fallback": "false",
-					"filter":   "mount_type == kv",
-				},
-			},
-			isErrorExpected: false,
-		},
-		"fallback-device-with-filter": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "discard",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"fallback": "true",
-					"filter":   "mount_type == kv",
-				},
-			},
-			isErrorExpected:      true,
-			expectedErrorMessage: "syslog.Factory: cannot configure a fallback device with a filter: invalid parameter",
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			be, err := Factory(ctx, tc.backendConfig, nil)
-
-			switch {
-			case tc.isErrorExpected:
-				require.Error(t, err)
-				require.EqualError(t, err, tc.expectedErrorMessage)
-			default:
-				require.NoError(t, err)
-				require.NotNil(t, be)
-			}
-		})
-	}
-}
-
-// TestBackend_IsFallback ensures that the 'fallback' config setting is parsed
-// and set correctly, then exposed via the interface method IsFallback().
-func TestBackend_IsFallback(t *testing.T) {
-	t.Parallel()
-
-	ctx := context.Background()
-
-	tests := map[string]struct {
-		backendConfig      *audit.BackendConfig
-		isFallbackExpected bool
-	}{
-		"fallback": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "qwerty",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"fallback": "true",
-				},
-			},
-			isFallbackExpected: true,
-		},
-		"no-fallback": {
-			backendConfig: &audit.BackendConfig{
-				MountPath:  "qwerty",
-				SaltConfig: &salt.Config{},
-				SaltView:   &logical.InmemStorage{},
-				Logger:     hclog.NewNullLogger(),
-				Config: map[string]string{
-					"fallback": "false",
-				},
-			},
-			isFallbackExpected: false,
-		},
-	}
-
-	for name, tc := range tests {
-		name := name
-		tc := tc
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			be, err := Factory(ctx, tc.backendConfig, nil)
-			require.NoError(t, err)
-			require.NotNil(t, be)
-			require.Equal(t, tc.isFallbackExpected, be.IsFallback())
-		})
-	}
-}
diff --git a/builtin/credential/approle/backend.go b/builtin/credential/approle/backend.go
index 4afdd596078..dcdee123dd1 100644
--- a/builtin/credential/approle/backend.go
+++ b/builtin/credential/approle/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
@@ -110,6 +110,10 @@ func Backend(conf *logical.BackendConfig) (*backend, error) {
 				secretIDLocalPrefix,
 				secretIDAccessorLocalPrefix,
 			},
+			SealWrapStorage: []string{
+				secretIDPrefix,
+				secretIDLocalPrefix,
+			},
 		},
 		Paths: framework.PathAppend(
 			rolePaths(b),
diff --git a/builtin/credential/approle/backend_test.go b/builtin/credential/approle/backend_test.go
index 95912952d82..39230c46cfd 100644
--- a/builtin/credential/approle/backend_test.go
+++ b/builtin/credential/approle/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
diff --git a/builtin/credential/approle/cmd/approle/main.go b/builtin/credential/approle/cmd/approle/main.go
index d28cea383be..a8aec5bd92a 100644
--- a/builtin/credential/approle/cmd/approle/main.go
+++ b/builtin/credential/approle/cmd/approle/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/credential/approle/path_login.go b/builtin/credential/approle/path_login.go
index 72b7ac352f0..1bf71156270 100644
--- a/builtin/credential/approle/path_login.go
+++ b/builtin/credential/approle/path_login.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
@@ -125,7 +125,7 @@ func (b *backend) pathLoginUpdate(ctx context.Context, req *logical.Request, dat
 	// RoleID must be supplied during every login
 	roleID := strings.TrimSpace(data.Get("role_id").(string))
 	if roleID == "" {
-		return logical.ErrorResponse("missing role_id"), nil
+		return nil, logical.ErrInvalidCredentials
 	}
 
 	// Look for the storage entry that maps the roleID to role
diff --git a/builtin/credential/approle/path_login_test.go b/builtin/credential/approle/path_login_test.go
index 7dd8c7f0ff1..3c1d0894c2d 100644
--- a/builtin/credential/approle/path_login_test.go
+++ b/builtin/credential/approle/path_login_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
diff --git a/builtin/credential/approle/path_role.go b/builtin/credential/approle/path_role.go
index eaffcdaa453..00e8edd8780 100644
--- a/builtin/credential/approle/path_role.go
+++ b/builtin/credential/approle/path_role.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
@@ -227,52 +227,6 @@ can only be set during role creation and once set, it can't be reset later.`,
 								Required:    true,
 								Description: "If true, the secret identifiers generated using this role will be cluster local. This can only be set during role creation and once set, it can't be reset later",
 							},
-							"token_bound_cidrs": {
-								Type:        framework.TypeCommaStringSlice,
-								Required:    true,
-								Description: `Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.`,
-							},
-							"token_explicit_max_ttl": {
-								Type:        framework.TypeInt64,
-								Required:    true,
-								Description: "If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.",
-							},
-							"token_max_ttl": {
-								Type:        framework.TypeInt64,
-								Required:    true,
-								Description: "The maximum lifetime of the generated token",
-							},
-							"token_no_default_policy": {
-								Type:        framework.TypeBool,
-								Required:    true,
-								Description: "If true, the 'default' policy will not automatically be added to generated tokens",
-							},
-							"token_period": {
-								Type:        framework.TypeInt64,
-								Required:    true,
-								Description: "If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value.",
-							},
-							"token_policies": {
-								Type:        framework.TypeCommaStringSlice,
-								Required:    true,
-								Description: "Comma-separated list of policies",
-							},
-							"token_type": {
-								Type:        framework.TypeString,
-								Required:    true,
-								Default:     "default-service",
-								Description: "The type of token to generate, service or batch",
-							},
-							"token_ttl": {
-								Type:        framework.TypeInt64,
-								Required:    true,
-								Description: "The initial ttl of the token to generate",
-							},
-							"token_num_uses": {
-								Type:        framework.TypeInt,
-								Required:    true,
-								Description: "The maximum number of times a token may be used, a value of zero means unlimited",
-							},
 							"period": {
 								Type:        framework.TypeInt64,
 								Required:    false,
@@ -299,6 +253,12 @@ can only be set during role creation and once set, it can't be reset later.`,
 	}
 
 	tokenutil.AddTokenFields(p.Fields)
+	{
+		// AppRole is coded differently from other Auth methods, it is the only one that
+		// populates the `Fields` field of the response
+		readOperation := p.Operations[logical.ReadOperation].(*framework.PathOperation)
+		tokenutil.AddTokenFields(readOperation.Responses[http.StatusOK][0].Fields)
+	}
 
 	return []*framework.Path{
 		p,
diff --git a/builtin/credential/approle/path_role_test.go b/builtin/credential/approle/path_role_test.go
index 6b35afc725e..2febef89fba 100644
--- a/builtin/credential/approle/path_role_test.go
+++ b/builtin/credential/approle/path_role_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
diff --git a/builtin/credential/approle/path_tidy_user_id.go b/builtin/credential/approle/path_tidy_user_id.go
index 0367a0940f2..84c660fe402 100644
--- a/builtin/credential/approle/path_tidy_user_id.go
+++ b/builtin/credential/approle/path_tidy_user_id.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
diff --git a/builtin/credential/approle/path_tidy_user_id_test.go b/builtin/credential/approle/path_tidy_user_id_test.go
index 4b932cd11f5..b0028108d83 100644
--- a/builtin/credential/approle/path_tidy_user_id_test.go
+++ b/builtin/credential/approle/path_tidy_user_id_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
diff --git a/builtin/credential/approle/validation.go b/builtin/credential/approle/validation.go
index b99af755d81..02f3a93631c 100644
--- a/builtin/credential/approle/validation.go
+++ b/builtin/credential/approle/validation.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
diff --git a/builtin/credential/approle/validation_test.go b/builtin/credential/approle/validation_test.go
index d3386aa3561..009d0fd7483 100644
--- a/builtin/credential/approle/validation_test.go
+++ b/builtin/credential/approle/validation_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
diff --git a/builtin/credential/aws/backend.go b/builtin/credential/aws/backend.go
index df5f7ec2332..857aac0dfc8 100644
--- a/builtin/credential/aws/backend.go
+++ b/builtin/credential/aws/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -73,17 +73,19 @@ type backend struct {
 	// of tidyCooldownPeriod.
 	nextTidyTime time.Time
 
-	// Map to hold the EC2 client objects indexed by region and STS role.
+	// Map to hold the EC2 client objects indexed by a composite key of Account
+	// ID, region, and STS role.
 	// This avoids the overhead of creating a client object for every login request.
 	// When the credentials are modified or deleted, all the cached client objects
 	// will be flushed. The empty STS role signifies the master account
-	EC2ClientsMap map[string]map[string]*ec2.EC2
+	EC2ClientsMap map[clientKey]*ec2.EC2
 
-	// Map to hold the IAM client objects indexed by region and STS role.
+	// Map to hold the IAM client objects indexed by a composite key of Account
+	// ID, region, and STS role.
 	// This avoids the overhead of creating a client object for every login request.
 	// When the credentials are modified or deleted, all the cached client objects
 	// will be flushed. The empty STS role signifies the master account
-	IAMClientsMap map[string]map[string]*iam.IAM
+	IAMClientsMap map[clientKey]*iam.IAM
 
 	// Map to associate a partition to a random region in that partition. Users of
 	// this don't care what region in the partition they use, but there is some client
@@ -117,13 +119,31 @@ type backend struct {
 	deprecatedTerms *strings.Replacer
 }
 
+// clientKey is a composite key for caching IAM or EC2 clients.
+type clientKey struct {
+	AccountID string
+	Region    string
+	STSRole   string // Use an empty string for the master account
+}
+
+func (c clientKey) String() string {
+	// For clarity in logs, we explicitly state when the master account is
+	// being used instead of showing an empty string for the role.
+	rolePart := c.STSRole
+	if rolePart == "" {
+		rolePart = "<master-account>"
+	}
+
+	return fmt.Sprintf("%s/%s/%s", c.AccountID, c.Region, rolePart)
+}
+
 func Backend(_ *logical.BackendConfig) (*backend, error) {
 	b := &backend{
 		// Setting the periodic func to be run once in an hour.
 		// If there is a real need, this can be made configurable.
 		tidyCooldownPeriod:     time.Hour,
-		EC2ClientsMap:          make(map[string]map[string]*ec2.EC2),
-		IAMClientsMap:          make(map[string]map[string]*iam.IAM),
+		EC2ClientsMap:          make(map[clientKey]*ec2.EC2),
+		IAMClientsMap:          make(map[clientKey]*iam.IAM),
 		iamUserIdToArnCache:    cache.New(7*24*time.Hour, 24*time.Hour),
 		tidyDenyListCASGuard:   new(uint32),
 		tidyAccessListCASGuard: new(uint32),
@@ -199,6 +219,10 @@ func Backend(_ *logical.BackendConfig) (*backend, error) {
 		InitializeFunc: b.initialize,
 		BackendType:    logical.TypeCredential,
 		Clean:          b.cleanup,
+		RotateCredential: func(ctx context.Context, request *logical.Request) error {
+			_, err := b.rotateRoot(ctx, request)
+			return err
+		},
 	}
 
 	b.partitionToRegionMap = generatePartitionToRegionMap()
diff --git a/builtin/credential/aws/backend_e2e_test.go b/builtin/credential/aws/backend_e2e_test.go
index ea8076b8761..fa1902b771e 100644
--- a/builtin/credential/aws/backend_e2e_test.go
+++ b/builtin/credential/aws/backend_e2e_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/backend_test.go b/builtin/credential/aws/backend_test.go
index d56478266d9..56d0afccba7 100644
--- a/builtin/credential/aws/backend_test.go
+++ b/builtin/credential/aws/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -8,7 +8,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"os"
 	"strings"
@@ -34,6 +34,7 @@ func TestBackend_CreateParseVerifyRoleTag(t *testing.T) {
 	config := logical.TestBackendConfig()
 	storage := &logical.InmemStorage{}
 	config.StorageView = storage
+	config.System = &testSystemView{}
 
 	b, err := Backend(config)
 	if err != nil {
@@ -260,6 +261,7 @@ func TestBackend_ConfigTidyIdentities(t *testing.T) {
 		config := logical.TestBackendConfig()
 		storage := &logical.InmemStorage{}
 		config.StorageView = storage
+		config.System = &testSystemView{}
 
 		b, err := Backend(config)
 		if err != nil {
@@ -317,6 +319,7 @@ func TestBackend_ConfigTidyRoleTags(t *testing.T) {
 		config := logical.TestBackendConfig()
 		storage := &logical.InmemStorage{}
 		config.StorageView = storage
+		config.System = &testSystemView{}
 
 		b, err := Backend(config)
 		if err != nil {
@@ -374,6 +377,7 @@ func TestBackend_TidyIdentities(t *testing.T) {
 		config := logical.TestBackendConfig()
 		storage := &logical.InmemStorage{}
 		config.StorageView = storage
+		config.System = &testSystemView{}
 
 		b, err := Backend(config)
 		if err != nil {
@@ -424,6 +428,7 @@ func TestBackend_TidyRoleTags(t *testing.T) {
 		config := logical.TestBackendConfig()
 		storage := &logical.InmemStorage{}
 		config.StorageView = storage
+		config.System = &testSystemView{}
 
 		b, err := Backend(config)
 		if err != nil {
@@ -473,6 +478,7 @@ func TestBackend_ConfigClient(t *testing.T) {
 	config := logical.TestBackendConfig()
 	storage := &logical.InmemStorage{}
 	config.StorageView = storage
+	config.System = &testSystemView{}
 
 	b, err := Backend(config)
 	if err != nil {
@@ -614,6 +620,7 @@ func TestBackend_pathConfigCertificate(t *testing.T) {
 	config := logical.TestBackendConfig()
 	storage := &logical.InmemStorage{}
 	config.StorageView = storage
+	config.System = &testSystemView{}
 
 	b, err := Backend(config)
 	if err != nil {
@@ -771,6 +778,8 @@ func TestBackend_parseAndVerifyRoleTagValue(t *testing.T) {
 	config := logical.TestBackendConfig()
 	storage := &logical.InmemStorage{}
 	config.StorageView = storage
+	config.System = &testSystemView{}
+
 	b, err := Backend(config)
 	if err != nil {
 		t.Fatal(err)
@@ -853,6 +862,8 @@ func TestBackend_PathRoleTag(t *testing.T) {
 	config := logical.TestBackendConfig()
 	storage := &logical.InmemStorage{}
 	config.StorageView = storage
+	config.System = &testSystemView{}
+
 	b, err := Backend(config)
 	if err != nil {
 		t.Fatal(err)
@@ -920,6 +931,8 @@ func TestBackend_PathBlacklistRoleTag(t *testing.T) {
 		storage := &logical.InmemStorage{}
 		config := logical.TestBackendConfig()
 		config.StorageView = storage
+		config.System = &testSystemView{}
+
 		b, err := Backend(config)
 		if err != nil {
 			t.Fatal(err)
@@ -1046,6 +1059,7 @@ This is an acceptance test.
 	export TEST_AWS_EC2_IAM_ROLE_ARN=$(aws iam get-role --role-name $(curl -q http://169.254.169.254/latest/meta-data/iam/security-credentials/ -S -s) --query Role.Arn --output text)
 	export TEST_AWS_EC2_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
 
+
 	If the test is not being run on an EC2 instance that has access to
 	credentials using EC2RoleProvider, on top of the above vars, following
 	needs to be set:
@@ -1378,6 +1392,8 @@ func TestBackend_pathStsConfig(t *testing.T) {
 	config := logical.TestBackendConfig()
 	storage := &logical.InmemStorage{}
 	config.StorageView = storage
+	config.System = &testSystemView{}
+
 	b, err := Backend(config)
 	if err != nil {
 		t.Fatal(err)
@@ -1407,6 +1423,11 @@ func TestBackend_pathStsConfig(t *testing.T) {
 		"sts_role": "arn:aws:iam:account1:role/myRole",
 	}
 
+	data2 := map[string]interface{}{
+		"sts_role":    "arn:aws:iam:account2:role/myRole2",
+		"external_id": "fake_id",
+	}
+
 	stsReq.Data = data
 	// test create operation
 	resp, err := b.HandleRequest(context.Background(), stsReq)
@@ -1440,13 +1461,28 @@ func TestBackend_pathStsConfig(t *testing.T) {
 
 	stsReq.Operation = logical.CreateOperation
 	stsReq.Path = "config/sts/account2"
-	stsReq.Data = data
-	// create another entry to test the list operation
+	stsReq.Data = data2
+	// create another entry with alternate data to test ExternalID and LIST
 	resp, err = b.HandleRequest(context.Background(), stsReq)
 	if err != nil || (resp != nil && resp.IsError()) {
 		t.Fatal(err)
 	}
 
+	// test second read
+	stsReq.Operation = logical.ReadOperation
+	resp, err = b.HandleRequest(context.Background(), stsReq)
+	if err != nil {
+		t.Fatal(err)
+	}
+	expectedStsRole = "arn:aws:iam:account2:role/myRole2"
+	expectedExternalID := "fake_id"
+	if resp.Data["sts_role"].(string) != expectedStsRole {
+		t.Fatalf("bad: expected:%s\n got:%s\n", expectedStsRole, resp.Data["sts_role"].(string))
+	}
+	if resp.Data["external_id"].(string) != expectedExternalID {
+		t.Fatalf("bad: expected:%s\n got:%s\n", expectedExternalID, resp.Data["external_id"].(string))
+	}
+
 	stsReq.Operation = logical.ListOperation
 	stsReq.Path = "config/sts"
 	// test list operation
@@ -1495,7 +1531,7 @@ func buildCallerIdentityLoginData(request *http.Request, roleName string) (map[s
 	if err != nil {
 		return nil, err
 	}
-	requestBody, err := ioutil.ReadAll(request.Body)
+	requestBody, err := io.ReadAll(request.Body)
 	if err != nil {
 		return nil, err
 	}
diff --git a/builtin/credential/aws/certificates.go b/builtin/credential/aws/certificates.go
index a56b757521f..5139a6c87fd 100644
--- a/builtin/credential/aws/certificates.go
+++ b/builtin/credential/aws/certificates.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/cli.go b/builtin/credential/aws/cli.go
index 2cc228ac54b..8223d8aa3c5 100644
--- a/builtin/credential/aws/cli.go
+++ b/builtin/credential/aws/cli.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/client.go b/builtin/credential/aws/client.go
index bed15bb6a49..194d028e41d 100644
--- a/builtin/credential/aws/client.go
+++ b/builtin/credential/aws/client.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -6,15 +6,21 @@ package awsauth
 import (
 	"context"
 	"fmt"
+	"strconv"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/sts"
 	cleanhttp "github.com/hashicorp/go-cleanhttp"
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
@@ -58,6 +64,26 @@ func (b *backend) getRawClientConfig(ctx context.Context, s logical.Storage, reg
 		credsConfig.AccessKey = config.AccessKey
 		credsConfig.SecretKey = config.SecretKey
 		maxRetries = config.MaxRetries
+
+		if config.IdentityTokenAudience != "" {
+			ns, err := namespace.FromContext(ctx)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get namespace from context: %w", err)
+			}
+
+			fetcher := &PluginIdentityTokenFetcher{
+				sys:      b.System(),
+				logger:   b.Logger(),
+				ns:       ns,
+				audience: config.IdentityTokenAudience,
+				ttl:      config.IdentityTokenTTL,
+			}
+
+			sessionSuffix := strconv.FormatInt(time.Now().UnixNano(), 10)
+			credsConfig.RoleSessionName = fmt.Sprintf("vault-aws-auth-%s", sessionSuffix)
+			credsConfig.WebIdentityTokenFetcher = fetcher
+			credsConfig.RoleARN = config.RoleARN
+		}
 	}
 
 	credsConfig.HTTPClient = cleanhttp.DefaultClient()
@@ -84,7 +110,7 @@ func (b *backend) getRawClientConfig(ctx context.Context, s logical.Storage, reg
 // It uses getRawClientConfig to obtain config for the runtime environment, and if
 // stsRole is a non-empty string, it will use AssumeRole to obtain a set of assumed
 // credentials. The credentials will expire after 15 minutes but will auto-refresh.
-func (b *backend) getClientConfig(ctx context.Context, s logical.Storage, region, stsRole, accountID, clientType string) (*aws.Config, error) {
+func (b *backend) getClientConfig(ctx context.Context, s logical.Storage, region, stsRole, externalID, accountID, clientType string) (*aws.Config, error) {
 	config, err := b.getRawClientConfig(ctx, s, region, clientType)
 	if err != nil {
 		return nil, err
@@ -105,7 +131,12 @@ func (b *backend) getClientConfig(ctx context.Context, s logical.Storage, region
 		if err != nil {
 			return nil, err
 		}
-		assumedCredentials := stscreds.NewCredentials(sess, stsRole)
+		var assumedCredentials *credentials.Credentials
+		if externalID != "" {
+			assumedCredentials = stscreds.NewCredentials(sess, stsRole, func(p *stscreds.AssumeRoleProvider) { p.ExternalID = aws.String(externalID) })
+		} else {
+			assumedCredentials = stscreds.NewCredentials(sess, stsRole)
+		}
 		// Test that we actually have permissions to assume the role
 		if _, err = assumedCredentials.Get(); err != nil {
 			return nil, err
@@ -144,10 +175,7 @@ func (b *backend) getClientConfig(ctx context.Context, s logical.Storage, region
 // the cached EC2 client objects will be flushed. Config mutex lock should be
 // acquired for write operation before calling this method.
 func (b *backend) flushCachedEC2Clients() {
-	// deleting items in map during iteration is safe
-	for region := range b.EC2ClientsMap {
-		delete(b.EC2ClientsMap, region)
-	}
+	b.EC2ClientsMap = make(map[clientKey]*ec2.EC2)
 }
 
 // flushCachedIAMClients deletes all the cached iam client objects from the
@@ -155,10 +183,7 @@ func (b *backend) flushCachedEC2Clients() {
 // the backend, all the cached IAM client objects will be flushed. Config mutex
 // lock should be acquired for write operation before calling this method.
 func (b *backend) flushCachedIAMClients() {
-	// deleting items in map during iteration is safe
-	for region := range b.IAMClientsMap {
-		delete(b.IAMClientsMap, region)
-	}
+	b.IAMClientsMap = make(map[clientKey]*iam.IAM)
 }
 
 // Gets an entry out of the user ID cache
@@ -180,30 +205,41 @@ func (b *backend) setCachedUserId(userId, arn string) {
 	}
 }
 
-func (b *backend) stsRoleForAccount(ctx context.Context, s logical.Storage, accountID string) (string, error) {
+func (b *backend) stsRoleForAccount(ctx context.Context, s logical.Storage, accountID string) (string, string, error) {
 	// Check if an STS configuration exists for the AWS account
 	sts, err := b.lockedAwsStsEntry(ctx, s, accountID)
 	if err != nil {
-		return "", fmt.Errorf("error fetching STS config for account ID %q: %w", accountID, err)
+		return "", "", fmt.Errorf("error fetching STS config for account ID %q: %w", accountID, err)
 	}
 	// An empty STS role signifies the master account
 	if sts != nil {
-		return sts.StsRole, nil
+		return sts.StsRole, sts.ExternalID, nil
 	}
-	return "", nil
+
+	// Return an error if there's no STS config for an account which is not the default one
+	if b.defaultAWSAccountID != "" && b.defaultAWSAccountID != accountID {
+		return "", "", fmt.Errorf("no STS configuration found for account ID %q", accountID)
+	}
+	return "", "", nil
 }
 
 // clientEC2 creates a client to interact with AWS EC2 API
 func (b *backend) clientEC2(ctx context.Context, s logical.Storage, region, accountID string) (*ec2.EC2, error) {
-	stsRole, err := b.stsRoleForAccount(ctx, s, accountID)
+	stsRole, stsExternalID, err := b.stsRoleForAccount(ctx, s, accountID)
 	if err != nil {
 		return nil, err
 	}
 	b.configMutex.RLock()
-	if b.EC2ClientsMap[region] != nil && b.EC2ClientsMap[region][stsRole] != nil {
+
+	key := clientKey{
+		AccountID: accountID,
+		Region:    region,
+		STSRole:   stsRole,
+	}
+	if cachedClient, ok := b.EC2ClientsMap[key]; ok {
 		defer b.configMutex.RUnlock()
 		// If the client object was already created, return it
-		return b.EC2ClientsMap[region][stsRole], nil
+		return cachedClient, nil
 	}
 
 	// Release the read lock and acquire the write lock
@@ -212,13 +248,13 @@ func (b *backend) clientEC2(ctx context.Context, s logical.Storage, region, acco
 	defer b.configMutex.Unlock()
 
 	// If the client gets created while switching the locks, return it
-	if b.EC2ClientsMap[region] != nil && b.EC2ClientsMap[region][stsRole] != nil {
-		return b.EC2ClientsMap[region][stsRole], nil
+	if cachedClient, ok := b.EC2ClientsMap[key]; ok {
+		return cachedClient, nil
 	}
 
 	// Create an AWS config object using a chain of providers
 	var awsConfig *aws.Config
-	awsConfig, err = b.getClientConfig(ctx, s, region, stsRole, accountID, "ec2")
+	awsConfig, err = b.getClientConfig(ctx, s, region, stsRole, stsExternalID, accountID, "ec2")
 	if err != nil {
 		return nil, err
 	}
@@ -236,34 +272,36 @@ func (b *backend) clientEC2(ctx context.Context, s logical.Storage, region, acco
 	if client == nil {
 		return nil, fmt.Errorf("could not obtain ec2 client")
 	}
-	if _, ok := b.EC2ClientsMap[region]; !ok {
-		b.EC2ClientsMap[region] = map[string]*ec2.EC2{stsRole: client}
-	} else {
-		b.EC2ClientsMap[region][stsRole] = client
-	}
 
-	return b.EC2ClientsMap[region][stsRole], nil
+	b.EC2ClientsMap[key] = client
+	return b.EC2ClientsMap[key], nil
 }
 
 // clientIAM creates a client to interact with AWS IAM API
 func (b *backend) clientIAM(ctx context.Context, s logical.Storage, region, accountID string) (*iam.IAM, error) {
-	stsRole, err := b.stsRoleForAccount(ctx, s, accountID)
+	stsRole, stsExternalID, err := b.stsRoleForAccount(ctx, s, accountID)
 	if err != nil {
 		return nil, err
 	}
 	if stsRole == "" {
-		b.Logger().Debug(fmt.Sprintf("no stsRole found for %s", accountID))
+		b.Logger().Debug("no stsRole found for account", "accountID", accountID)
 	} else {
-		b.Logger().Debug(fmt.Sprintf("found stsRole %s for account %s", stsRole, accountID))
+		b.Logger().Debug("found stsRole for account", "stsRole", stsRole, "accountID", accountID)
 	}
 	b.configMutex.RLock()
-	if b.IAMClientsMap[region] != nil && b.IAMClientsMap[region][stsRole] != nil {
+
+	key := clientKey{
+		AccountID: accountID,
+		Region:    region,
+		STSRole:   stsRole,
+	}
+	if cachedClient, ok := b.IAMClientsMap[key]; ok {
 		defer b.configMutex.RUnlock()
 		// If the client object was already created, return it
-		b.Logger().Debug(fmt.Sprintf("returning cached client for region %s and stsRole %s", region, stsRole))
-		return b.IAMClientsMap[region][stsRole], nil
+		b.Logger().Debug("returning cached client for key", "key", key)
+		return cachedClient, nil
 	}
-	b.Logger().Debug(fmt.Sprintf("no cached client for region %s and stsRole %s", region, stsRole))
+	b.Logger().Debug("no cached client for key", "key", key)
 
 	// Release the read lock and acquire the write lock
 	b.configMutex.RUnlock()
@@ -271,13 +309,14 @@ func (b *backend) clientIAM(ctx context.Context, s logical.Storage, region, acco
 	defer b.configMutex.Unlock()
 
 	// If the client gets created while switching the locks, return it
-	if b.IAMClientsMap[region] != nil && b.IAMClientsMap[region][stsRole] != nil {
-		return b.IAMClientsMap[region][stsRole], nil
+	if cachedClient, ok := b.IAMClientsMap[key]; ok {
+		b.Logger().Debug("returning cached client for key", "key", key)
+		return cachedClient, nil
 	}
 
 	// Create an AWS config object using a chain of providers
 	var awsConfig *aws.Config
-	awsConfig, err = b.getClientConfig(ctx, s, region, stsRole, accountID, "iam")
+	awsConfig, err = b.getClientConfig(ctx, s, region, stsRole, stsExternalID, accountID, "iam")
 	if err != nil {
 		return nil, err
 	}
@@ -295,10 +334,39 @@ func (b *backend) clientIAM(ctx context.Context, s logical.Storage, region, acco
 	if client == nil {
 		return nil, fmt.Errorf("could not obtain iam client")
 	}
-	if _, ok := b.IAMClientsMap[region]; !ok {
-		b.IAMClientsMap[region] = map[string]*iam.IAM{stsRole: client}
-	} else {
-		b.IAMClientsMap[region][stsRole] = client
+	b.IAMClientsMap[key] = client
+	return b.IAMClientsMap[key], nil
+}
+
+// PluginIdentityTokenFetcher fetches plugin identity tokens from Vault. It is provided
+// to the AWS SDK client to keep assumed role credentials refreshed through expiration.
+// When the client's STS credentials expire, it will use this interface to fetch a new
+// plugin identity token and exchange it for new STS credentials.
+type PluginIdentityTokenFetcher struct {
+	sys      logical.SystemView
+	logger   hclog.Logger
+	audience string
+	ns       *namespace.Namespace
+	ttl      time.Duration
+}
+
+var _ stscreds.TokenFetcher = (*PluginIdentityTokenFetcher)(nil)
+
+func (f PluginIdentityTokenFetcher) FetchToken(ctx aws.Context) ([]byte, error) {
+	nsCtx := namespace.ContextWithNamespace(ctx, f.ns)
+	resp, err := f.sys.GenerateIdentityToken(nsCtx, &pluginutil.IdentityTokenRequest{
+		Audience: f.audience,
+		TTL:      f.ttl,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate plugin identity token: %w", err)
 	}
-	return b.IAMClientsMap[region][stsRole], nil
+	f.logger.Info("fetched new plugin identity token")
+
+	if resp.TTL < f.ttl {
+		f.logger.Debug("generated plugin identity token has shorter TTL than requested",
+			"requested", f.ttl, "actual", resp.TTL)
+	}
+
+	return []byte(resp.Token.Token()), nil
 }
diff --git a/builtin/credential/aws/cmd/aws/main.go b/builtin/credential/aws/cmd/aws/main.go
index 8a1ecff0bee..ec5950580f8 100644
--- a/builtin/credential/aws/cmd/aws/main.go
+++ b/builtin/credential/aws/cmd/aws/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/credential/aws/path_config_certificate.go b/builtin/credential/aws/path_config_certificate.go
index 1b15fcf3b57..d76fe79a9dd 100644
--- a/builtin/credential/aws/path_config_certificate.go
+++ b/builtin/credential/aws/path_config_certificate.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/path_config_client.go b/builtin/credential/aws/path_config_client.go
index c2123720621..315381d0a34 100644
--- a/builtin/credential/aws/path_config_client.go
+++ b/builtin/credential/aws/path_config_client.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -6,6 +6,7 @@ package awsauth
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net/http"
 	"net/textproto"
 	"net/url"
@@ -14,11 +15,15 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/automatedrotationutil"
+	"github.com/hashicorp/vault/sdk/helper/pluginidentityutil"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/rotation"
 )
 
 func (b *backend) pathConfigClient() *framework.Path {
-	return &framework.Path{
+	p := &framework.Path{
 		Pattern: "config/client$",
 
 		DisplayAttrs: &framework.DisplayAttributes{
@@ -85,6 +90,12 @@ func (b *backend) pathConfigClient() *framework.Path {
 				Default:     aws.UseServiceDefaultRetries,
 				Description: "Maximum number of retries for recoverable exceptions of AWS APIs",
 			},
+
+			"role_arn": {
+				Type:        framework.TypeString,
+				Default:     "",
+				Description: "Role ARN to assume for plugin identity token federation",
+			},
 		},
 
 		ExistenceCheck: b.pathConfigClientExistenceCheck,
@@ -96,6 +107,8 @@ func (b *backend) pathConfigClient() *framework.Path {
 					OperationVerb:   "configure",
 					OperationSuffix: "client",
 				},
+				ForwardPerformanceSecondary: true,
+				ForwardPerformanceStandby:   true,
 			},
 			logical.UpdateOperation: &framework.PathOperation{
 				Callback: b.pathConfigClientCreateUpdate,
@@ -103,6 +116,8 @@ func (b *backend) pathConfigClient() *framework.Path {
 					OperationVerb:   "configure",
 					OperationSuffix: "client",
 				},
+				ForwardPerformanceSecondary: true,
+				ForwardPerformanceStandby:   true,
 			},
 			logical.DeleteOperation: &framework.PathOperation{
 				Callback: b.pathConfigClientDelete,
@@ -121,6 +136,10 @@ func (b *backend) pathConfigClient() *framework.Path {
 		HelpSynopsis:    pathConfigClientHelpSyn,
 		HelpDescription: pathConfigClientHelpDesc,
 	}
+	pluginidentityutil.AddPluginIdentityTokenFields(p.Fields)
+	automatedrotationutil.AddAutomatedRotationFields(p.Fields)
+
+	return p
 }
 
 // Establishes dichotomy of request operation between CreateOperation and UpdateOperation.
@@ -168,18 +187,23 @@ func (b *backend) pathConfigClientRead(ctx context.Context, req *logical.Request
 		return nil, nil
 	}
 
+	configData := map[string]interface{}{
+		"access_key":                 clientConfig.AccessKey,
+		"endpoint":                   clientConfig.Endpoint,
+		"iam_endpoint":               clientConfig.IAMEndpoint,
+		"sts_endpoint":               clientConfig.STSEndpoint,
+		"sts_region":                 clientConfig.STSRegion,
+		"use_sts_region_from_client": clientConfig.UseSTSRegionFromClient,
+		"iam_server_id_header_value": clientConfig.IAMServerIdHeaderValue,
+		"max_retries":                clientConfig.MaxRetries,
+		"allowed_sts_header_values":  clientConfig.AllowedSTSHeaderValues,
+		"role_arn":                   clientConfig.RoleARN,
+	}
+
+	clientConfig.PopulatePluginIdentityTokenData(configData)
+	clientConfig.PopulateAutomatedRotationData(configData)
 	return &logical.Response{
-		Data: map[string]interface{}{
-			"access_key":                 clientConfig.AccessKey,
-			"endpoint":                   clientConfig.Endpoint,
-			"iam_endpoint":               clientConfig.IAMEndpoint,
-			"sts_endpoint":               clientConfig.STSEndpoint,
-			"sts_region":                 clientConfig.STSRegion,
-			"use_sts_region_from_client": clientConfig.UseSTSRegionFromClient,
-			"iam_server_id_header_value": clientConfig.IAMServerIdHeaderValue,
-			"max_retries":                clientConfig.MaxRetries,
-			"allowed_sts_header_values":  clientConfig.AllowedSTSHeaderValues,
-		},
+		Data: configData,
 	}, nil
 }
 
@@ -334,6 +358,75 @@ func (b *backend) pathConfigClientCreateUpdate(ctx context.Context, req *logical
 		configEntry.MaxRetries = data.Get("max_retries").(int)
 	}
 
+	roleArnStr, ok := data.GetOk("role_arn")
+	if ok {
+		if configEntry.RoleARN != roleArnStr.(string) {
+			changedCreds = true
+			configEntry.RoleARN = roleArnStr.(string)
+		}
+	} else if req.Operation == logical.CreateOperation {
+		configEntry.RoleARN = data.Get("role_arn").(string)
+	}
+
+	if err := configEntry.ParsePluginIdentityTokenFields(data); err != nil {
+		return logical.ErrorResponse(err.Error()), nil
+	}
+
+	if err := configEntry.ParseAutomatedRotationFields(data); err != nil {
+		return logical.ErrorResponse(err.Error()), nil
+	}
+
+	// handle mutual exclusivity
+	if configEntry.IdentityTokenAudience != "" && configEntry.AccessKey != "" {
+		return logical.ErrorResponse("only one of 'access_key' or 'identity_token_audience' can be set"), nil
+	}
+
+	if configEntry.IdentityTokenAudience != "" && configEntry.RoleARN == "" {
+		return logical.ErrorResponse("role_arn must be set when identity_token_audience is set"), nil
+	}
+
+	if configEntry.IdentityTokenAudience != "" {
+		_, err := b.System().GenerateIdentityToken(ctx, &pluginutil.IdentityTokenRequest{
+			Audience: configEntry.IdentityTokenAudience,
+		})
+		if err != nil {
+			if errors.Is(err, pluginidentityutil.ErrPluginWorkloadIdentityUnsupported) {
+				return logical.ErrorResponse(err.Error()), nil
+			}
+			return nil, err
+		}
+	}
+
+	var performedRotationManagerOpern string
+	if configEntry.ShouldDeregisterRotationJob() {
+		performedRotationManagerOpern = rotation.PerformedDeregistration
+		// Disable Automated Rotation and Deregister credentials if required
+		deregisterReq := &rotation.RotationJobDeregisterRequest{
+			MountPoint: req.MountPoint,
+			ReqPath:    req.Path,
+		}
+
+		b.Logger().Debug("Deregistering rotation job", "mount", req.MountPoint+req.Path)
+		if err := b.System().DeregisterRotationJob(ctx, deregisterReq); err != nil {
+			return logical.ErrorResponse("error deregistering rotation job: %s", err), nil
+		}
+	} else if configEntry.ShouldRegisterRotationJob() {
+		performedRotationManagerOpern = rotation.PerformedRegistration
+		// Register the rotation job if it's required.
+		cfgReq := &rotation.RotationJobConfigureRequest{
+			MountPoint:       req.MountPoint,
+			ReqPath:          req.Path,
+			RotationSchedule: configEntry.RotationSchedule,
+			RotationWindow:   configEntry.RotationWindow,
+			RotationPeriod:   configEntry.RotationPeriod,
+		}
+
+		b.Logger().Debug("Registering rotation job", "mount", req.MountPoint+req.Path)
+		if _, err = b.System().RegisterRotationJob(ctx, cfgReq); err != nil {
+			return logical.ErrorResponse("error registering rotation job: %s", err), nil
+		}
+	}
+
 	// Since this endpoint supports both create operation and update operation,
 	// the error checks for access_key and secret_key not being set are not present.
 	// This allows calling this endpoint multiple times to provide the values.
@@ -346,7 +439,14 @@ func (b *backend) pathConfigClientCreateUpdate(ctx context.Context, req *logical
 
 	if changedCreds || changedOtherConfig || req.Operation == logical.CreateOperation {
 		if err := req.Storage.Put(ctx, entry); err != nil {
-			return nil, err
+			wrappedError := err
+			if performedRotationManagerOpern != "" {
+				b.Logger().Error("write to storage failed but the rotation manager still succeeded.",
+					"operation", performedRotationManagerOpern, "mount", req.MountPoint, "path", req.Path)
+				wrappedError = fmt.Errorf("write to storage failed but the rotation manager still succeeded; "+
+					"operation=%s, mount=%s, path=%s, storageError=%s", performedRotationManagerOpern, req.MountPoint, req.Path, err)
+			}
+			return nil, wrappedError
 		}
 	}
 
@@ -373,6 +473,9 @@ func (b *backend) configClientToEntry(conf *clientConfig) (*logical.StorageEntry
 // Struct to hold 'aws_access_key' and 'aws_secret_key' that are required to
 // interact with the AWS EC2 API.
 type clientConfig struct {
+	pluginidentityutil.PluginIdentityTokenParams
+	automatedrotationutil.AutomatedRotationParams
+
 	AccessKey              string   `json:"access_key"`
 	SecretKey              string   `json:"secret_key"`
 	Endpoint               string   `json:"endpoint"`
@@ -383,6 +486,7 @@ type clientConfig struct {
 	IAMServerIdHeaderValue string   `json:"iam_server_id_header_value"`
 	AllowedSTSHeaderValues []string `json:"allowed_sts_header_values"`
 	MaxRetries             int      `json:"max_retries"`
+	RoleARN                string   `json:"role_arn"`
 }
 
 func (c *clientConfig) validateAllowedSTSHeaderValues(headers http.Header) error {
diff --git a/builtin/credential/aws/path_config_client_test.go b/builtin/credential/aws/path_config_client_test.go
index ed9b98ec5df..e901705c2b2 100644
--- a/builtin/credential/aws/path_config_client_test.go
+++ b/builtin/credential/aws/path_config_client_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -7,13 +7,19 @@ import (
 	"context"
 	"testing"
 
+	"github.com/hashicorp/vault/sdk/helper/automatedrotationutil"
+	"github.com/hashicorp/vault/sdk/helper/pluginidentityutil"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/rotation"
+	"github.com/stretchr/testify/assert"
 )
 
 func TestBackend_pathConfigClient(t *testing.T) {
 	config := logical.TestBackendConfig()
 	storage := &logical.InmemStorage{}
 	config.StorageView = storage
+	config.System = &testSystemView{}
 
 	b, err := Backend(config)
 	if err != nil {
@@ -129,3 +135,55 @@ func TestBackend_pathConfigClient(t *testing.T) {
 			data["sts_region"], resp.Data["sts_region"])
 	}
 }
+
+// TestBackend_PathConfigClient_PluginIdentityToken tests that configuration
+// of plugin WIF returns an immediate error.
+func TestBackend_PathConfigClient_PluginIdentityToken(t *testing.T) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
+	b, err := Backend(config)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = b.Setup(context.Background(), config)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	configData := map[string]interface{}{
+		"identity_token_ttl":      int64(10),
+		"identity_token_audience": "test-aud",
+		"role_arn":                "test-role-arn",
+	}
+
+	configReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Storage:   config.StorageView,
+		Path:      "config/client",
+		Data:      configData,
+	}
+
+	resp, err := b.HandleRequest(context.Background(), configReq)
+	assert.NoError(t, err)
+	assert.NotNil(t, resp)
+	assert.ErrorContains(t, resp.Error(), pluginidentityutil.ErrPluginWorkloadIdentityUnsupported.Error())
+}
+
+type testSystemView struct {
+	logical.StaticSystemView
+}
+
+func (d testSystemView) GenerateIdentityToken(_ context.Context, _ *pluginutil.IdentityTokenRequest) (*pluginutil.IdentityTokenResponse, error) {
+	return nil, pluginidentityutil.ErrPluginWorkloadIdentityUnsupported
+}
+
+func (d testSystemView) RegisterRotationJob(_ context.Context, _ *rotation.RotationJobConfigureRequest) (string, error) {
+	return "", automatedrotationutil.ErrRotationManagerUnsupported
+}
+
+func (d testSystemView) DeregisterRotationJob(_ context.Context, _ *rotation.RotationJobDeregisterRequest) error {
+	return nil
+}
diff --git a/builtin/credential/aws/path_config_identity.go b/builtin/credential/aws/path_config_identity.go
index 0c6f8c3398e..5f9d8ff4c1b 100644
--- a/builtin/credential/aws/path_config_identity.go
+++ b/builtin/credential/aws/path_config_identity.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -32,6 +32,7 @@ var (
 			"inferred_aws_region",
 			"inferred_entity_id",
 			"inferred_entity_type",
+			"inferred_hostname",
 		},
 	}
 
@@ -66,7 +67,7 @@ func (b *backend) pathConfigIdentity() *framework.Path {
 			"iam_alias": {
 				Type:        framework.TypeString,
 				Default:     identityAliasIAMUniqueID,
-				Description: fmt.Sprintf("Configure how the AWS auth method generates entity aliases when using IAM auth. Valid values are %q, %q, and %q. Defaults to %q.", identityAliasRoleID, identityAliasIAMUniqueID, identityAliasIAMFullArn, identityAliasRoleID),
+				Description: fmt.Sprintf("Configure how the AWS auth method generates entity aliases when using IAM auth. Valid values are %q, %q, %q and %q. Defaults to %q.", identityAliasRoleID, identityAliasIAMUniqueID, identityAliasIAMFullArn, identityAliasIAMCanonicalArn, identityAliasRoleID),
 			},
 			iamAuthMetadataFields.FieldName: authmetadata.FieldSchema(iamAuthMetadataFields),
 			"ec2_alias": {
@@ -150,7 +151,7 @@ func pathConfigIdentityUpdate(ctx context.Context, req *logical.Request, data *f
 	iamAliasRaw, ok := data.GetOk("iam_alias")
 	if ok {
 		iamAlias := iamAliasRaw.(string)
-		allowedIAMAliasValues := []string{identityAliasRoleID, identityAliasIAMUniqueID, identityAliasIAMFullArn}
+		allowedIAMAliasValues := []string{identityAliasRoleID, identityAliasIAMUniqueID, identityAliasIAMFullArn, identityAliasIAMCanonicalArn}
 		if !strutil.StrListContains(allowedIAMAliasValues, iamAlias) {
 			return logical.ErrorResponse(fmt.Sprintf("iam_alias of %q not in set of allowed values: %v", iamAlias, allowedIAMAliasValues)), nil
 		}
@@ -194,11 +195,12 @@ type identityConfig struct {
 }
 
 const (
-	identityAliasIAMUniqueID   = "unique_id"
-	identityAliasIAMFullArn    = "full_arn"
-	identityAliasEC2InstanceID = "instance_id"
-	identityAliasEC2ImageID    = "image_id"
-	identityAliasRoleID        = "role_id"
+	identityAliasIAMUniqueID     = "unique_id"
+	identityAliasIAMFullArn      = "full_arn"
+	identityAliasIAMCanonicalArn = "canonical_arn"
+	identityAliasEC2InstanceID   = "instance_id"
+	identityAliasEC2ImageID      = "image_id"
+	identityAliasRoleID          = "role_id"
 )
 
 const pathConfigIdentityHelpSyn = `
diff --git a/builtin/credential/aws/path_config_identity_test.go b/builtin/credential/aws/path_config_identity_test.go
index 085cf18b4f7..10e4df7ca76 100644
--- a/builtin/credential/aws/path_config_identity_test.go
+++ b/builtin/credential/aws/path_config_identity_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/path_config_rotate_root.go b/builtin/credential/aws/path_config_rotate_root.go
index 0a0e64fcb00..289ba1b2069 100644
--- a/builtin/credential/aws/path_config_rotate_root.go
+++ b/builtin/credential/aws/path_config_rotate_root.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -10,7 +10,6 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/ec2"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/iam/iamiface"
 	"github.com/hashicorp/go-cleanhttp"
@@ -42,6 +41,10 @@ func (b *backend) pathConfigRotateRoot() *framework.Path {
 }
 
 func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	return b.rotateRoot(ctx, req)
+}
+
+func (b *backend) rotateRoot(ctx context.Context, req *logical.Request) (*logical.Response, error) {
 	// First get the AWS key and secret and validate that we _can_ rotate them.
 	// We need the read lock here to prevent anything else from mutating it while we're using it.
 	b.configMutex.Lock()
@@ -177,8 +180,8 @@ func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.R
 
 	// Previous cached clients need to be cleared because they may have been made using
 	// the soon-to-be-obsolete credentials.
-	b.IAMClientsMap = make(map[string]map[string]*iam.IAM)
-	b.EC2ClientsMap = make(map[string]map[string]*ec2.EC2)
+	b.flushCachedIAMClients()
+	b.flushCachedEC2Clients()
 
 	// Now to clean up the old key.
 	deleteAccessKeyInput := iam.DeleteAccessKeyInput{
diff --git a/builtin/credential/aws/path_config_rotate_root_test.go b/builtin/credential/aws/path_config_rotate_root_test.go
index d457f9787fa..2afe609f97f 100644
--- a/builtin/credential/aws/path_config_rotate_root_test.go
+++ b/builtin/credential/aws/path_config_rotate_root_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/path_config_sts.go b/builtin/credential/aws/path_config_sts.go
index 21034f69fef..46d67f1e544 100644
--- a/builtin/credential/aws/path_config_sts.go
+++ b/builtin/credential/aws/path_config_sts.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -13,7 +13,8 @@ import (
 
 // awsStsEntry is used to store details of an STS role for assumption
 type awsStsEntry struct {
-	StsRole string `json:"sts_role"`
+	StsRole    string `json:"sts_role"`
+	ExternalID string `json:"external_id,omitempty"` // optional, but recommended
 }
 
 func (b *backend) pathListSts() *framework.Path {
@@ -57,6 +58,11 @@ instances in this account.`,
 				Description: `AWS ARN for STS role to be assumed when interacting with the account specified.
 The Vault server must have permissions to assume this role.`,
 			},
+			"external_id": {
+				Type:        framework.TypeString,
+				Description: `AWS external ID to be used when assuming the STS role.`,
+				Required:    false,
+			},
 		},
 
 		ExistenceCheck: b.pathConfigStsExistenceCheck,
@@ -192,10 +198,15 @@ func (b *backend) pathConfigStsRead(ctx context.Context, req *logical.Request, d
 		return nil, nil
 	}
 
+	dt := map[string]interface{}{
+		"sts_role": stsEntry.StsRole,
+	}
+	if stsEntry.ExternalID != "" {
+		dt["external_id"] = stsEntry.ExternalID
+	}
+
 	return &logical.Response{
-		Data: map[string]interface{}{
-			"sts_role": stsEntry.StsRole,
-		},
+		Data: dt,
 	}, nil
 }
 
@@ -230,6 +241,13 @@ func (b *backend) pathConfigStsCreateUpdate(ctx context.Context, req *logical.Re
 		return logical.ErrorResponse("sts role cannot be empty"), nil
 	}
 
+	stsExternalID, ok := data.GetOk("external_id")
+	if ok {
+		stsEntry.ExternalID = stsExternalID.(string)
+	}
+
+	b.Logger().Info("setting sts", "account_id", accountID, "sts_role", stsEntry.StsRole, "external_id", stsEntry.ExternalID)
+
 	// save the provided STS role
 	if err := b.nonLockedSetAwsStsEntry(ctx, req.Storage, accountID, stsEntry); err != nil {
 		return nil, err
diff --git a/builtin/credential/aws/path_config_tidy_identity_accesslist.go b/builtin/credential/aws/path_config_tidy_identity_accesslist.go
index b9d194b5197..fc59b8d69ca 100644
--- a/builtin/credential/aws/path_config_tidy_identity_accesslist.go
+++ b/builtin/credential/aws/path_config_tidy_identity_accesslist.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/path_config_tidy_roletag_denylist.go b/builtin/credential/aws/path_config_tidy_roletag_denylist.go
index 7707ff7c1f8..e229d5b8b7d 100644
--- a/builtin/credential/aws/path_config_tidy_roletag_denylist.go
+++ b/builtin/credential/aws/path_config_tidy_roletag_denylist.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/path_identity_accesslist.go b/builtin/credential/aws/path_identity_accesslist.go
index 8c7462bd5f6..a593b1df8d2 100644
--- a/builtin/credential/aws/path_identity_accesslist.go
+++ b/builtin/credential/aws/path_identity_accesslist.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/path_login.go b/builtin/credential/aws/path_login.go
index c4330ad6afd..9c1b7b6677c 100644
--- a/builtin/credential/aws/path_login.go
+++ b/builtin/credential/aws/path_login.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -12,10 +12,9 @@ import (
 	"encoding/xml"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
-	"regexp"
 	"strings"
 	"time"
 
@@ -30,6 +29,7 @@ import (
 	"github.com/hashicorp/go-retryablehttp"
 	"github.com/hashicorp/go-secure-stdlib/awsutil"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	iRegexp "github.com/hashicorp/go-secure-stdlib/regexp"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/helper/pkcs7"
@@ -1396,6 +1396,8 @@ func (b *backend) pathLoginUpdateIam(ctx context.Context, req *logical.Request,
 		identityAlias = callerUniqueId
 	case identityAliasIAMFullArn:
 		identityAlias = callerID.Arn
+	case identityAliasIAMCanonicalArn:
+		identityAlias = entity.canonicalArn()
 	}
 
 	// If we're just looking up for MFA, return the Alias info
@@ -1454,6 +1456,7 @@ func (b *backend) pathLoginUpdateIam(ctx context.Context, req *logical.Request,
 
 	inferredEntityType := ""
 	inferredEntityID := ""
+	inferredHostname := ""
 	if roleEntry.InferredEntityType == ec2EntityType {
 		instance, err := b.validateInstance(ctx, req.Storage, entity.SessionInfo, roleEntry.InferredAWSRegion, callerID.Account)
 		if err != nil {
@@ -1480,6 +1483,7 @@ func (b *backend) pathLoginUpdateIam(ctx context.Context, req *logical.Request,
 
 		inferredEntityType = ec2EntityType
 		inferredEntityID = entity.SessionInfo
+		inferredHostname = *instance.PrivateDnsName
 	}
 
 	auth := &logical.Auth{
@@ -1494,6 +1498,7 @@ func (b *backend) pathLoginUpdateIam(ctx context.Context, req *logical.Request,
 			"inferred_entity_id":  inferredEntityID,
 			"inferred_aws_region": roleEntry.InferredAWSRegion,
 			"account_id":          entity.AccountNumber,
+			"inferred_hostname":   inferredHostname,
 		},
 		DisplayName: entity.FriendlyName,
 		Alias: &logical.Alias{
@@ -1515,6 +1520,7 @@ func (b *backend) pathLoginUpdateIam(ctx context.Context, req *logical.Request,
 		"inferred_entity_id":   inferredEntityID,
 		"inferred_aws_region":  roleEntry.InferredAWSRegion,
 		"account_id":           entity.AccountNumber,
+		"inferred_hostname":    inferredHostname,
 	}); err != nil {
 		b.Logger().Warn(fmt.Sprintf("unable to set alias metadata due to %s", err))
 	}
@@ -1672,8 +1678,10 @@ func validateVaultHeaderValue(method string, headers http.Header, parsedUrl *url
 	case http.MethodPost:
 		if authzHeaders, ok := headers["Authorization"]; ok {
 			// authzHeader looks like AWS4-HMAC-SHA256 Credential=AKI..., SignedHeaders=host;x-amz-date;x-vault-awsiam-id, Signature=...
-			// We need to extract out the SignedHeaders
-			re := regexp.MustCompile(".*SignedHeaders=([^,]+)")
+			// We need to extract out the SignedHeaders.
+			// We are using an interned regexp library here to avoid redundant objects and save memory.
+			re := iRegexp.MustCompileInterned(".*SignedHeaders=([^,]+)")
+
 			authzHeader := strings.Join(authzHeaders, ",")
 			matches := re.FindSubmatch([]byte(authzHeader))
 			if len(matches) < 1 {
@@ -1797,7 +1805,7 @@ func submitCallerIdentityRequest(ctx context.Context, maxRetries int, method, en
 	}
 
 	// we check for status code afterwards to also print out response body
-	responseBody, err := ioutil.ReadAll(response.Body)
+	responseBody, err := io.ReadAll(response.Body)
 	if err != nil {
 		return nil, err
 	}
diff --git a/builtin/credential/aws/path_login_test.go b/builtin/credential/aws/path_login_test.go
index fe4a3a766b7..d9285b1c81f 100644
--- a/builtin/credential/aws/path_login_test.go
+++ b/builtin/credential/aws/path_login_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -315,6 +315,8 @@ func TestBackend_pathLogin_NoClientConfig(t *testing.T) {
 	storage := new(logical.InmemStorage)
 	config := logical.TestBackendConfig()
 	config.StorageView = storage
+	config.System = &testSystemView{}
+
 	b, err := Backend(config)
 	if err != nil {
 		t.Fatal(err)
@@ -363,6 +365,8 @@ func TestBackend_pathLogin_IAMHeaders(t *testing.T) {
 	storage := &logical.InmemStorage{}
 	config := logical.TestBackendConfig()
 	config.StorageView = storage
+	config.System = &testSystemView{}
+
 	b, err := Backend(config)
 	if err != nil {
 		t.Fatal(err)
@@ -408,6 +412,7 @@ func TestBackend_pathLogin_IAMHeaders(t *testing.T) {
 				"inferred_aws_region",
 				"inferred_entity_id",
 				"inferred_entity_type",
+				"inferred_hostname",
 			},
 			"ec2_alias": "role_id",
 			"ec2_metadata": []string{
@@ -569,6 +574,8 @@ func TestBackend_pathLogin_IAMRoleResolution(t *testing.T) {
 	storage := &logical.InmemStorage{}
 	config := logical.TestBackendConfig()
 	config.StorageView = storage
+	config.System = &testSystemView{}
+
 	b, err := Backend(config)
 	if err != nil {
 		t.Fatal(err)
@@ -614,6 +621,7 @@ func TestBackend_pathLogin_IAMRoleResolution(t *testing.T) {
 				"inferred_aws_region",
 				"inferred_entity_id",
 				"inferred_entity_type",
+				"inferred_hostname",
 			},
 			"ec2_alias": "role_id",
 			"ec2_metadata": []string{
@@ -668,6 +676,8 @@ func TestBackend_defaultAliasMetadata(t *testing.T) {
 	storage := &logical.InmemStorage{}
 	config := logical.TestBackendConfig()
 	config.StorageView = storage
+	config.System = &testSystemView{}
+
 	b, err := Backend(config)
 	if err != nil {
 		t.Fatal(err)
diff --git a/builtin/credential/aws/path_role.go b/builtin/credential/aws/path_role.go
index 40dd4bb9b30..52695e6ab06 100644
--- a/builtin/credential/aws/path_role.go
+++ b/builtin/credential/aws/path_role.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -395,7 +395,7 @@ func (b *backend) initialize(ctx context.Context, req *logical.InitializationReq
 	return nil
 }
 
-// awsVersion stores info about the the latest aws version that we have
+// awsVersion stores info about the latest aws version that we have
 // upgraded to.
 type awsVersion struct {
 	Version int `json:"version"`
diff --git a/builtin/credential/aws/path_role_tag.go b/builtin/credential/aws/path_role_tag.go
index 3584f08f26a..8fd35b66813 100644
--- a/builtin/credential/aws/path_role_tag.go
+++ b/builtin/credential/aws/path_role_tag.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/path_role_test.go b/builtin/credential/aws/path_role_test.go
index 3d3fbc3c6f7..d3518e302c6 100644
--- a/builtin/credential/aws/path_role_test.go
+++ b/builtin/credential/aws/path_role_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
@@ -14,6 +14,7 @@ import (
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/awsutil"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
+	"github.com/hashicorp/vault/helper/constants"
 	vlttesting "github.com/hashicorp/vault/helper/testhelpers/logical"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/helper/policyutil"
@@ -634,8 +635,12 @@ func TestAwsEc2_RoleCrud(t *testing.T) {
 		"token_type":                     "default",
 	}
 
+	if constants.IsEnterprise {
+		expected["alias_metadata"] = map[string]string{}
+	}
+
 	if resp.Data["role_id"] == nil {
-		t.Fatal("role_id not found in repsonse")
+		t.Fatal("role_id not found in response")
 	}
 	expected["role_id"] = resp.Data["role_id"]
 	if diff := deep.Equal(expected, resp.Data); diff != nil {
diff --git a/builtin/credential/aws/path_roletag_denylist.go b/builtin/credential/aws/path_roletag_denylist.go
index 131ea717058..ec5bacca7d7 100644
--- a/builtin/credential/aws/path_roletag_denylist.go
+++ b/builtin/credential/aws/path_roletag_denylist.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/path_tidy_identity_accesslist.go b/builtin/credential/aws/path_tidy_identity_accesslist.go
index acfff00b1a9..848678083bf 100644
--- a/builtin/credential/aws/path_tidy_identity_accesslist.go
+++ b/builtin/credential/aws/path_tidy_identity_accesslist.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/aws/path_tidy_roletag_denylist.go b/builtin/credential/aws/path_tidy_roletag_denylist.go
index 665cb0319f1..78517c98f29 100644
--- a/builtin/credential/aws/path_tidy_roletag_denylist.go
+++ b/builtin/credential/aws/path_tidy_roletag_denylist.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package awsauth
diff --git a/builtin/credential/cert/backend.go b/builtin/credential/cert/backend.go
index f7f1255595f..34fba694554 100644
--- a/builtin/credential/cert/backend.go
+++ b/builtin/credential/cert/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
@@ -8,7 +8,9 @@ import (
 	"crypto/x509"
 	"fmt"
 	"io"
+	"maps"
 	"net/http"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -18,6 +20,7 @@ import (
 	"github.com/hashicorp/go-multierror"
 	lru "github.com/hashicorp/golang-lru/v2"
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/locksutil"
 	"github.com/hashicorp/vault/sdk/helper/ocsp"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -26,8 +29,9 @@ const (
 	operationPrefixCert = "cert"
 	trustedCertPath     = "cert/"
 
-	defaultRoleCacheSize = 200
-	maxRoleCacheSize     = 10000
+	defaultRoleCacheSize  = 200
+	defaultOcspMaxRetries = 4
+	maxRoleCacheSize      = 100000
 )
 
 func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error) {
@@ -42,7 +46,8 @@ func Backend() *backend {
 	// ignoring the error as it only can occur with <= 0 size
 	cache, _ := lru.New[string, *trusted](defaultRoleCacheSize)
 	b := backend{
-		trustedCache: cache,
+		trustedCache:      cache,
+		trustedCacheLocks: locksutil.CreateLocks(),
 	}
 	b.Backend = &framework.Backend{
 		Help: backendHelp,
@@ -70,11 +75,40 @@ func Backend() *backend {
 	return &b
 }
 
+type trustedRetry struct {
+	attempt  int
+	deadline time.Time
+}
+
 type trusted struct {
 	pool          *x509.CertPool
 	trusted       []*ParsedCert
 	trustedNonCAs []*ParsedCert
 	ocspConf      *ocsp.VerifyConfig
+	loaded        map[string]struct{}
+	retry         *trustedRetry
+}
+
+func (t *trusted) clone() *trusted {
+	return &trusted{
+		pool:          t.pool.Clone(),
+		trusted:       slices.Clone(t.trusted),
+		trustedNonCAs: slices.Clone(t.trustedNonCAs),
+		ocspConf: &ocsp.VerifyConfig{
+			OcspEnabled:          t.ocspConf.OcspEnabled,
+			ExtraCas:             slices.Clone(t.ocspConf.ExtraCas),
+			OcspServersOverride:  slices.Clone(t.ocspConf.OcspServersOverride),
+			OcspFailureMode:      t.ocspConf.OcspFailureMode,
+			QueryAllServers:      t.ocspConf.QueryAllServers,
+			OcspThisUpdateMaxAge: t.ocspConf.OcspThisUpdateMaxAge,
+			OcspMaxRetries:       t.ocspConf.OcspMaxRetries,
+		},
+		loaded: maps.Clone(t.loaded),
+		retry: &trustedRetry{
+			attempt:  t.retry.attempt,
+			deadline: t.retry.deadline,
+		},
+	}
 }
 
 type backend struct {
@@ -89,6 +123,8 @@ type backend struct {
 
 	trustedCache         *lru.Cache[string, *trusted]
 	trustedCacheDisabled atomic.Bool
+	trustedCacheLocks    []*locksutil.LockEntry
+	trustedCacheFull     atomic.Pointer[trusted]
 }
 
 func (b *backend) initialize(ctx context.Context, req *logical.InitializationRequest) error {
@@ -136,7 +172,7 @@ func (b *backend) updatedConfig(config *config) {
 	case config.RoleCacheSize < 0:
 		// Just to clean up memory
 		b.trustedCacheDisabled.Store(true)
-		b.trustedCache.Purge()
+		b.flushTrustedCache()
 	case config.RoleCacheSize == 0:
 		config.RoleCacheSize = defaultRoleCacheSize
 		fallthrough
@@ -199,6 +235,7 @@ func (b *backend) flushTrustedCache() {
 	if b.trustedCache != nil { // defensive
 		b.trustedCache.Purge()
 	}
+	b.trustedCacheFull.Store(nil)
 }
 
 const backendHelp = `
diff --git a/builtin/credential/cert/backend_test.go b/builtin/credential/cert/backend_test.go
index a7bb32de5f4..c0ea9278a07 100644
--- a/builtin/credential/cert/backend_test.go
+++ b/builtin/credential/cert/backend_test.go
@@ -1,14 +1,14 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
 
 import (
 	"context"
+	"crypto"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
@@ -20,6 +20,7 @@ import (
 	mathrand "math/rand"
 	"net"
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -28,8 +29,8 @@ import (
 	"time"
 
 	"github.com/go-test/deep"
-	cleanhttp "github.com/hashicorp/go-cleanhttp"
-	rootcerts "github.com/hashicorp/go-rootcerts"
+	"github.com/hashicorp/go-cleanhttp"
+	"github.com/hashicorp/go-rootcerts"
 	"github.com/hashicorp/go-sockaddr"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/builtin/logical/pki"
@@ -37,10 +38,13 @@ import (
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/helper/tokenutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 	"github.com/mitchellh/mapstructure"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ocsp"
 	"golang.org/x/net/http2"
 )
 
@@ -60,7 +64,7 @@ const (
 	testRootCertCRL     = "test-fixtures/cacert2crl"
 )
 
-func generateTestCertAndConnState(t *testing.T, template *x509.Certificate) (string, tls.ConnectionState, error) {
+func generateTestCertAndConnState(t *testing.T, template *x509.Certificate, caKey *ecdsa.PrivateKey) (string, tls.ConnectionState, error) {
 	t.Helper()
 	tempDir, err := ioutil.TempDir("", "vault-cert-auth-test-")
 	if err != nil {
@@ -80,7 +84,10 @@ func generateTestCertAndConnState(t *testing.T, template *x509.Certificate) (str
 		BasicConstraintsValid: true,
 		IsCA:                  true,
 	}
-	caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+
+	if caKey == nil {
+		caKey, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	}
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -654,7 +661,7 @@ func TestBackend_NonCAExpiry(t *testing.T) {
 	template.IPAddresses = []net.IP{parsedIP}
 
 	// Private key for CA cert
-	caPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	caPrivateKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -722,7 +729,7 @@ func TestBackend_NonCAExpiry(t *testing.T) {
 	template.SerialNumber = big.NewInt(5678)
 
 	template.KeyUsage = x509.KeyUsage(x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign)
-	issuedPrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	issuedPrivateKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -839,7 +846,7 @@ func TestBackend_NonCAExpiry(t *testing.T) {
 	time.Sleep(5 * time.Second)
 
 	// Login attempt after certificate expiry should fail
-	resp, err = b.HandleRequest(context.Background(), loginReq)
+	_, err = b.HandleRequest(context.Background(), loginReq)
 	if err == nil {
 		t.Fatalf("expected error due to expired certificate")
 	}
@@ -1313,6 +1320,8 @@ func TestBackend_ext_singleCert(t *testing.T) {
 			testAccStepLoginWithMetadata(t, connState, "web", map[string]string{"2-1-1-1": "A UTF8String Extension"}, true),
 			testAccStepCert(t, "web", ca, "foo", allowed{metadata_ext: "1.2.3.45"}, false),
 			testAccStepLoginWithMetadata(t, connState, "web", map[string]string{}, true),
+			testAccStepSetConfig(t, config{EnableMetadataOnFailures: true}, connState),
+			testAccStepReadConfig(t, config{EnableMetadataOnFailures: true}, connState),
 		},
 	})
 }
@@ -1335,7 +1344,7 @@ func TestBackend_dns_singleCert(t *testing.T) {
 		NotAfter:     time.Now().Add(262980 * time.Hour),
 	}
 
-	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate)
+	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate, nil)
 	if tempDir != "" {
 		defer os.RemoveAll(tempDir)
 	}
@@ -1382,7 +1391,7 @@ func TestBackend_email_singleCert(t *testing.T) {
 		NotAfter:     time.Now().Add(262980 * time.Hour),
 	}
 
-	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate)
+	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate, nil)
 	if tempDir != "" {
 		defer os.RemoveAll(tempDir)
 	}
@@ -1440,6 +1449,40 @@ func TestBackend_organizationalUnit_singleCert(t *testing.T) {
 	})
 }
 
+// TestBackend_organization_singleCert checks validation of the Organization (O) field on a self-signed cert that is
+// trusted
+func TestBackend_organization_singleCert(t *testing.T) {
+	connState, err := testConnState(
+		"test-fixtures/root/rootcawocert.pem",
+		"test-fixtures/root/rootcawokey.pem",
+		"test-fixtures/root/rootcawocert.pem",
+		// These have been generated to last 100 years with the following Vault PKI commands:
+		// $ vault -v secrets enable pki
+		// $ vault secrets tune -max-lease-ttl=876000h pki
+		// $ vault write pki/root/generate/exported common_name=example.com organization="example" ip_sans=127.0.0.1 ttl=875999h
+	)
+	if err != nil {
+		t.Fatalf("error testing connection state: %v", err)
+	}
+	ca, err := ioutil.ReadFile("test-fixtures/root/rootcawocert.pem")
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	logicaltest.Test(t, logicaltest.TestCase{
+		CredentialBackend: testFactory(t),
+		Steps: []logicaltest.TestStep{
+			testAccStepCert(t, "web", ca, "foo", allowed{organizations: "example"}, false),
+			testAccStepLogin(t, connState),
+			testAccStepCert(t, "web", ca, "foo", allowed{organizations: "exa*"}, false),
+			testAccStepLogin(t, connState),
+			testAccStepCert(t, "web", ca, "foo", allowed{organizations: "example,otherspecimen"}, false),
+			testAccStepLogin(t, connState),
+			testAccStepCert(t, "web", ca, "foo", allowed{organizations: "foo"}, false),
+			testAccStepLoginInvalid(t, connState),
+		},
+	})
+}
+
 // Test a self-signed client with URI alt names (root CA) that is trusted
 func TestBackend_uri_singleCert(t *testing.T) {
 	u, err := url.Parse("spiffe://example.com/host")
@@ -1463,7 +1506,7 @@ func TestBackend_uri_singleCert(t *testing.T) {
 		NotAfter:     time.Now().Add(262980 * time.Hour),
 	}
 
-	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate)
+	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate, nil)
 	if tempDir != "" {
 		defer os.RemoveAll(tempDir)
 	}
@@ -1491,6 +1534,58 @@ func TestBackend_uri_singleCert(t *testing.T) {
 	})
 }
 
+// Test a self-signed client with URI alt names (root CA) that is trusted
+func TestBackend_sameKey_differentCN(t *testing.T) {
+	certTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "example.com",
+		},
+		DNSNames: []string{"example.com"},
+		ExtKeyUsage: []x509.ExtKeyUsage{
+			x509.ExtKeyUsageServerAuth,
+			x509.ExtKeyUsageClientAuth,
+		},
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageKeyAgreement,
+		SerialNumber: big.NewInt(mathrand.Int63()),
+		NotBefore:    time.Now().Add(-30 * time.Second),
+		NotAfter:     time.Now().Add(262980 * time.Hour),
+	}
+	caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal("error generating cert keypair")
+	}
+	tempDir1, connState1, err := generateTestCertAndConnState(t, certTemplate, caKey)
+	if tempDir1 != "" {
+		defer os.RemoveAll(tempDir1)
+	}
+	cert1, err := ioutil.ReadFile(filepath.Join(tempDir1, "cert.pem"))
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	certTemplate.Subject.CommonName = "notfake.com"
+	tempDir2, connState2, err := generateTestCertAndConnState(t, certTemplate, caKey)
+	if tempDir2 != "" {
+		defer os.RemoveAll(tempDir2)
+	}
+	if err != nil {
+		t.Fatalf("error testing connection state: %v", err)
+	}
+
+	logicaltest.Test(t, logicaltest.TestCase{
+		CredentialBackend: testFactory(t),
+		Steps: []logicaltest.TestStep{
+			testAccStepCert(t, "web", cert1, "foo", allowed{common_names: "example.com"}, false),
+			testAccStepLogin(t, connState1),
+			testAccStepLoginInvalid(t, connState2),
+			testAccStepCert(t, "web", cert1, "foo", allowed{}, false),
+			testAccStepLogin(t, connState1),
+			testAccStepLoginInvalid(t, connState2),
+		},
+	})
+}
+
 // Test against a collection of matching and non-matching rules
 func TestBackend_mixed_constraints(t *testing.T) {
 	connState, err := testConnState("test-fixtures/keys/cert.pem",
@@ -1531,6 +1626,88 @@ func TestBackend_untrusted(t *testing.T) {
 	})
 }
 
+// Test a forged CN
+func TestBackend_different_cn(t *testing.T) {
+	config := logical.TestBackendConfig()
+	storage := &logical.InmemStorage{}
+	config.StorageView = storage
+
+	b, err := Factory(context.Background(), config)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	connState, err := testConnState("test-fixtures/keys/cert.pem",
+		"test-fixtures/keys/key.pem", "test-fixtures/root/rootcacert.pem")
+	if err != nil {
+		t.Fatalf("error testing connection state: %v", err)
+	}
+	connState2, err := testConnState("test-fixtures/keys/cert-alt-cn.pem",
+		"test-fixtures/keys/key.pem", "test-fixtures/root/rootcacert.pem")
+	if err != nil {
+		t.Fatalf("error testing connection state: %v", err)
+	}
+	ca, err := ioutil.ReadFile("test-fixtures/keys/cert.pem")
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	name := "web"
+
+	addCertReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "certs/" + name,
+		Data: map[string]interface{}{
+			"certificate":  string(ca),
+			"policies":     "foo",
+			"display_name": name,
+			"lease":        1000,
+		},
+		Storage:    storage,
+		Connection: &logical.Connection{ConnState: &connState},
+	}
+
+	_, err = b.HandleRequest(context.Background(), addCertReq)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	loginReq := &logical.Request{
+		Operation:       logical.UpdateOperation,
+		Path:            "login",
+		Unauthenticated: true,
+		Data: map[string]interface{}{
+			"name": name,
+		},
+		Storage:    storage,
+		Connection: &logical.Connection{ConnState: &connState},
+	}
+
+	resp, err := b.HandleRequest(context.Background(), loginReq)
+	if err != nil {
+		t.Fatal(err.Error())
+	}
+	if resp.IsError() {
+		t.Fatal(resp.Error())
+	}
+
+	loginReq = &logical.Request{
+		Operation:       logical.UpdateOperation,
+		Path:            "login",
+		Unauthenticated: true,
+		Data: map[string]interface{}{
+			"name": name,
+		},
+		Storage:    storage,
+		Connection: &logical.Connection{ConnState: &connState2},
+	}
+
+	resp, err = b.HandleRequest(context.Background(), loginReq)
+	if err == nil && !resp.IsError() {
+		t.Fatal("expected error")
+	}
+}
+
 func TestBackend_validCIDR(t *testing.T) {
 	config := logical.TestBackendConfig()
 	storage := &logical.InmemStorage{}
@@ -1724,6 +1901,7 @@ func testAccStepSetConfig(t *testing.T, conf config, connState tls.ConnectionSta
 		ConnState: &connState,
 		Data: map[string]interface{}{
 			"enable_identity_alias_metadata": conf.EnableIdentityAliasMetadata,
+			"enable_metadata_on_failures":    conf.EnableMetadataOnFailures,
 		},
 	}
 }
@@ -1748,6 +1926,20 @@ func testAccStepReadConfig(t *testing.T, conf config, connState tls.ConnectionSt
 				t.Fatalf("bad: expected enable_identity_alias_metadata to be %t, got %t", conf.EnableIdentityAliasMetadata, b)
 			}
 
+			metaValueRaw, ok := resp.Data["enable_metadata_on_failures"]
+			if !ok {
+				t.Fatalf("enable_metadata_on_failures not found in response")
+			}
+
+			metaValue, ok := metaValueRaw.(bool)
+			if !ok {
+				t.Fatalf("bad: expected enable_metadata_on_failures to be a bool")
+			}
+
+			if metaValue != conf.EnableMetadataOnFailures {
+				t.Fatalf("bad: expected enable_metadata_on_failures to be %t, got %t", conf.EnableMetadataOnFailures, metaValue)
+			}
+
 			return nil
 		},
 	}
@@ -1918,12 +2110,13 @@ func testAccStepListCerts(
 }
 
 type allowed struct {
-	names                string // allowed names in the certificate, looks at common, name, dns, email [depricated]
+	names                string // allowed names in the certificate, looks at common, name, dns, email [deprecated]
 	common_names         string // allowed common names in the certificate
 	dns                  string // allowed dns names in the SAN extension of the certificate
 	emails               string // allowed email names in SAN extension of the certificate
 	uris                 string // allowed uris in SAN extension of the certificate
 	organizational_units string // allowed OUs in the certificate
+	organizations        string // allowed Os in the certificate
 	ext                  string // required extensions in the certificate
 	metadata_ext         string // allowed metadata extensions to add to identity alias
 }
@@ -1932,6 +2125,23 @@ func testAccStepCert(t *testing.T, name string, cert []byte, policies string, te
 	return testAccStepCertWithExtraParams(t, name, cert, policies, testData, expectError, nil)
 }
 
+func testStepEnableMetadataFailures() logicaltest.TestStep {
+	return logicaltest.TestStep{
+		Operation: logical.UpdateOperation,
+		Path:      "config",
+		ErrorOk:   false,
+		Data: map[string]interface{}{
+			"enable_metadata_on_failures": true,
+		},
+		Check: func(resp *logical.Response) error {
+			if resp != nil && resp.IsError() {
+				return fmt.Errorf("expected nil response got a response error: %v", resp)
+			}
+			return nil
+		},
+	}
+}
+
 func testAccStepCertWithExtraParams(t *testing.T, name string, cert []byte, policies string, testData allowed, expectError bool, extraParams map[string]interface{}) logicaltest.TestStep {
 	data := map[string]interface{}{
 		"certificate":                  string(cert),
@@ -1943,6 +2153,7 @@ func testAccStepCertWithExtraParams(t *testing.T, name string, cert []byte, poli
 		"allowed_email_sans":           testData.emails,
 		"allowed_uri_sans":             testData.uris,
 		"allowed_organizational_units": testData.organizational_units,
+		"allowed_organizations":        testData.organizations,
 		"required_extensions":          testData.ext,
 		"allowed_metadata_extensions":  testData.metadata_ext,
 		"lease":                        1000,
@@ -2057,6 +2268,11 @@ func testConnState(certPath, keyPath, rootCertPath string) (tls.ConnectionState,
 	if err != nil {
 		return tls.ConnectionState{}, err
 	}
+
+	return testConnStateWithCert(cert, rootCAs)
+}
+
+func testConnStateWithCert(cert tls.Certificate, rootCAs *x509.CertPool) (tls.ConnectionState, error) {
 	listenConf := &tls.Config{
 		Certificates:       []tls.Certificate{cert},
 		ClientAuth:         tls.RequestClientCert,
@@ -2169,12 +2385,13 @@ func Test_Renew(t *testing.T) {
 		Raw: map[string]interface{}{
 			"name":        "test",
 			"certificate": ca,
-			"policies":    "foo,bar",
+			// Uppercase B should not cause an issue during renewal
+			"token_policies": "foo,Bar",
 		},
 		Schema: pathCerts(b).Fields,
 	}
 
-	resp, err := b.pathCertWrite(context.Background(), req, fd)
+	_, err = b.pathCertWrite(context.Background(), req, fd)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -2183,7 +2400,7 @@ func Test_Renew(t *testing.T) {
 		Raw:    map[string]interface{}{},
 		Schema: pathLogin(b).Fields,
 	}
-	resp, err = b.pathLogin(context.Background(), req, empty_login_fd)
+	resp, err := b.pathLogin(context.Background(), req, empty_login_fd)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -2210,20 +2427,20 @@ func Test_Renew(t *testing.T) {
 	}
 
 	// Change the policies -- this should fail
-	fd.Raw["policies"] = "zip,zap"
-	resp, err = b.pathCertWrite(context.Background(), req, fd)
+	fd.Raw["token_policies"] = "zip,zap"
+	_, err = b.pathCertWrite(context.Background(), req, fd)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	resp, err = b.pathLoginRenew(context.Background(), req, empty_login_fd)
+	_, err = b.pathLoginRenew(context.Background(), req, empty_login_fd)
 	if err == nil {
 		t.Fatal("expected error")
 	}
 
 	// Put the policies back, this should be okay
-	fd.Raw["policies"] = "bar,foo"
-	resp, err = b.pathCertWrite(context.Background(), req, fd)
+	fd.Raw["token_policies"] = "bar,foo"
+	_, err = b.pathCertWrite(context.Background(), req, fd)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -2242,7 +2459,7 @@ func Test_Renew(t *testing.T) {
 	// Add period value to cert entry
 	period := 350 * time.Second
 	fd.Raw["period"] = period.String()
-	resp, err = b.pathCertWrite(context.Background(), req, fd)
+	_, err = b.pathCertWrite(context.Background(), req, fd)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -2263,7 +2480,7 @@ func Test_Renew(t *testing.T) {
 	}
 
 	// Delete CA, make sure we can't renew
-	resp, err = b.pathCertDelete(context.Background(), req, fd)
+	_, err = b.pathCertDelete(context.Background(), req, fd)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -2336,3 +2553,652 @@ func TestBackend_CertUpgrade(t *testing.T) {
 		t.Fatal(diff)
 	}
 }
+
+// TestOCSPFailOpenWithBadIssuer validates we fail all different types of cert auth
+// login scenarios if we encounter an OCSP verification error
+func TestOCSPFailOpenWithBadIssuer(t *testing.T) {
+	caFile := "test-fixtures/root/rootcacert.pem"
+	pemCa, err := os.ReadFile(caFile)
+	require.NoError(t, err, "failed reading in file %s", caFile)
+	caTLS := loadCerts(t, caFile, "test-fixtures/root/rootcakey.pem")
+	leafTLS := loadCerts(t, "test-fixtures/keys/cert.pem", "test-fixtures/keys/key.pem")
+
+	rootConfig := &rootcerts.Config{
+		CAFile: caFile,
+	}
+	rootCAs, err := rootcerts.LoadCACerts(rootConfig)
+	connState, err := testConnStateWithCert(leafTLS, rootCAs)
+	require.NoError(t, err, "error testing connection state: %v", err)
+
+	badCa, badCaKey := createCa(t)
+
+	// Setup an OCSP handler
+	ocspHandler := func(ca *x509.Certificate, caKey crypto.Signer) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			now := time.Now()
+			ocspRes := ocsp.Response{
+				SerialNumber: leafTLS.Leaf.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				NextUpdate:   now.Add(30 * time.Minute),
+				Status:       ocsp.Good,
+			}
+			response, err := ocsp.CreateResponse(ca, ca, ocspRes, caKey)
+			if err != nil {
+				t.Fatalf("failed generating OCSP response: %v", err)
+			}
+			_, _ = w.Write(response)
+		})
+	}
+	goodTs := httptest.NewServer(ocspHandler(caTLS.Leaf, caTLS.PrivateKey.(crypto.Signer)))
+	badTs := httptest.NewServer(ocspHandler(badCa, badCaKey))
+	defer goodTs.Close()
+	defer badTs.Close()
+
+	steps := []logicaltest.TestStep{
+		// step 1/2: This should fail as we get a response from a bad root, even with ocsp_fail_open is set to true
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{badTs.URL},
+				"ocsp_query_all_servers": false,
+				"ocsp_fail_open":         true,
+			}),
+		testAccStepLoginInvalid(t, connState),
+		// step 3/4: This should fail as we query all the servers which will get a response with an invalid signature
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{goodTs.URL, badTs.URL},
+				"ocsp_query_all_servers": true,
+				"ocsp_fail_open":         true,
+			}),
+		testAccStepLoginInvalid(t, connState),
+		// step 5/6: This should fail as we will query the OCSP server with the bad root key first.
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{badTs.URL, goodTs.URL},
+				"ocsp_query_all_servers": false,
+				"ocsp_fail_open":         true,
+			}),
+		testAccStepLoginInvalid(t, connState),
+		// step 7/8: This should pass as we will only query the first server with the valid root signature
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{goodTs.URL, badTs.URL},
+				"ocsp_query_all_servers": false,
+				"ocsp_fail_open":         true,
+			}),
+		testAccStepLogin(t, connState),
+	}
+
+	// Setup a new factory everytime to avoid OCSP caching from influencing the test
+	for i := 0; i < len(steps); i += 2 {
+		setup := i
+		execute := i + 1
+		t.Run(fmt.Sprintf("steps-%d-%d", setup+1, execute+1), func(t *testing.T) {
+			logicaltest.Test(t, logicaltest.TestCase{
+				CredentialBackend: testFactory(t),
+				Steps:             []logicaltest.TestStep{steps[setup], steps[execute]},
+			})
+		})
+	}
+}
+
+// TestOCSPWithMixedValidResponses validates the expected behavior of multiple OCSP servers configured,
+// with and without ocsp_query_all_servers enabled or disabled.
+func TestOCSPWithMixedValidResponses(t *testing.T) {
+	caFile := "test-fixtures/root/rootcacert.pem"
+	pemCa, err := os.ReadFile(caFile)
+	require.NoError(t, err, "failed reading in file %s", caFile)
+	caTLS := loadCerts(t, caFile, "test-fixtures/root/rootcakey.pem")
+	leafTLS := loadCerts(t, "test-fixtures/keys/cert.pem", "test-fixtures/keys/key.pem")
+
+	rootConfig := &rootcerts.Config{
+		CAFile: caFile,
+	}
+	rootCAs, err := rootcerts.LoadCACerts(rootConfig)
+	connState, err := testConnStateWithCert(leafTLS, rootCAs)
+	require.NoError(t, err, "error testing connection state: %v", err)
+
+	// Setup an OCSP handler
+	ocspHandler := func(status int) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			now := time.Now()
+			ocspRes := ocsp.Response{
+				SerialNumber: leafTLS.Leaf.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				NextUpdate:   now.Add(30 * time.Minute),
+				Status:       status,
+			}
+			response, err := ocsp.CreateResponse(caTLS.Leaf, caTLS.Leaf, ocspRes, caTLS.PrivateKey.(crypto.Signer))
+			if err != nil {
+				t.Fatalf("failed generating OCSP response: %v", err)
+			}
+			_, _ = w.Write(response)
+		})
+	}
+	goodTs := httptest.NewServer(ocspHandler(ocsp.Good))
+	revokeTs := httptest.NewServer(ocspHandler(ocsp.Revoked))
+	defer goodTs.Close()
+	defer revokeTs.Close()
+
+	steps := []logicaltest.TestStep{
+		// step 1/2: This should pass as we will query the first server and get a valid good response, not testing
+		// the second configured server
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{goodTs.URL, revokeTs.URL},
+				"ocsp_query_all_servers": false,
+			}),
+		testAccStepLogin(t, connState),
+		// step 3/4: This should fail as we will query the revoking OCSP server first and get a revoke response
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{revokeTs.URL, goodTs.URL},
+				"ocsp_query_all_servers": false,
+			}),
+		testAccStepLoginInvalid(t, connState),
+		// step 5/6: This should fail as we will query all the OCSP servers and prefer the revoke response
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo",
+			allowed{names: "cert.example.com"}, false, map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{goodTs.URL, revokeTs.URL},
+				"ocsp_query_all_servers": true,
+			}),
+		testAccStepLoginInvalid(t, connState),
+	}
+
+	// Setup a new factory everytime to avoid OCSP caching from influencing the test
+	for i := 0; i < len(steps); i += 2 {
+		setup := i
+		execute := i + 1
+		t.Run(fmt.Sprintf("steps-%d-%d", setup+1, execute+1), func(t *testing.T) {
+			logicaltest.Test(t, logicaltest.TestCase{
+				CredentialBackend: testFactory(t),
+				Steps:             []logicaltest.TestStep{steps[setup], steps[execute]},
+			})
+		})
+	}
+}
+
+// TestOCSPFailOpenWithGoodResponse validates the expected behavior with multiple OCSP servers configured
+// one that returns a Good response the other is not available, along with the ocsp_fail_open in multiple modes
+func TestOCSPFailOpenWithGoodResponse(t *testing.T) {
+	caFile := "test-fixtures/root/rootcacert.pem"
+	pemCa, err := os.ReadFile(caFile)
+	require.NoError(t, err, "failed reading in file %s", caFile)
+	caTLS := loadCerts(t, caFile, "test-fixtures/root/rootcakey.pem")
+	leafTLS := loadCerts(t, "test-fixtures/keys/cert.pem", "test-fixtures/keys/key.pem")
+
+	rootConfig := &rootcerts.Config{
+		CAFile: caFile,
+	}
+	rootCAs, err := rootcerts.LoadCACerts(rootConfig)
+	connState, err := testConnStateWithCert(leafTLS, rootCAs)
+	require.NoError(t, err, "error testing connection state: %v", err)
+
+	// Setup an OCSP handler
+	ocspHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		now := time.Now()
+		ocspRes := ocsp.Response{
+			SerialNumber: leafTLS.Leaf.SerialNumber,
+			ThisUpdate:   now.Add(-1 * time.Hour),
+			NextUpdate:   now.Add(30 * time.Minute),
+			Status:       ocsp.Good,
+		}
+		response, err := ocsp.CreateResponse(caTLS.Leaf, caTLS.Leaf, ocspRes, caTLS.PrivateKey.(crypto.Signer))
+		if err != nil {
+			t.Fatalf("failed generating OCSP response: %v", err)
+		}
+		_, _ = w.Write(response)
+	})
+	ts := httptest.NewServer(ocspHandler)
+	defer ts.Close()
+
+	steps := []logicaltest.TestStep{
+		// Step 1/2 With no proper responses from any OCSP server and fail_open to true, we should pass validation
+		// as fail_open is true
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{"http://127.0.0.1:30000", "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         true,
+				"ocsp_query_all_servers": false,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLogin(t, connState),
+		// Step 3/4 With no proper responses from any OCSP server and fail_open to false we should fail validation
+		// as fail_open is false
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo",
+			allowed{names: "cert.example.com"}, false, map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{"http://127.0.0.1:30000", "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         false,
+				"ocsp_query_all_servers": false,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLoginInvalid(t, connState),
+		// Step 5/6 With a single positive response, query all servers set to false and fail open true, pass validation
+		// as query all servers is false
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         true,
+				"ocsp_query_all_servers": false,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLogin(t, connState),
+		// Step 7/8 With a single positive response, query all servers set to false and fail open false, pass validation
+		// as query all servers is false
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo",
+			allowed{names: "cert.example.com"}, false, map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         false,
+				"ocsp_query_all_servers": false,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLogin(t, connState),
+		// Step 9/10 With a single positive response, query all servers set to true and fail open true, pass validation
+		// as fail open is true
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         true,
+				"ocsp_query_all_servers": true,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLogin(t, connState),
+		// Step 11/12 With a single positive response, query all servers set to true and fail open false, fail validation
+		// as not all servers agree
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo",
+			allowed{names: "cert.example.com"}, false, map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         false,
+				"ocsp_query_all_servers": true,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLoginInvalid(t, connState),
+	}
+
+	// Setup a new factory everytime to avoid OCSP caching from influencing the test
+	for i := 0; i < len(steps); i += 2 {
+		setup := i
+		execute := i + 1
+		t.Run(fmt.Sprintf("steps-%d-%d", setup+1, execute+1), func(t *testing.T) {
+			logicaltest.Test(t, logicaltest.TestCase{
+				CredentialBackend: testFactory(t),
+				Steps:             []logicaltest.TestStep{steps[setup], steps[execute]},
+			})
+		})
+	}
+}
+
+// TestOCSPFailOpenWithRevokeResponse validates the expected behavior with multiple OCSP servers configured
+// one that returns a Revoke response the other is not available, along with the ocsp_fail_open in multiple modes
+func TestOCSPFailOpenWithRevokeResponse(t *testing.T) {
+	caFile := "test-fixtures/root/rootcacert.pem"
+	pemCa, err := os.ReadFile(caFile)
+	require.NoError(t, err, "failed reading in file %s", caFile)
+	caTLS := loadCerts(t, caFile, "test-fixtures/root/rootcakey.pem")
+	leafTLS := loadCerts(t, "test-fixtures/keys/cert.pem", "test-fixtures/keys/key.pem")
+
+	rootConfig := &rootcerts.Config{
+		CAFile: caFile,
+	}
+	rootCAs, err := rootcerts.LoadCACerts(rootConfig)
+	connState, err := testConnStateWithCert(leafTLS, rootCAs)
+	require.NoError(t, err, "error testing connection state: %v", err)
+
+	// Setup an OCSP handler
+	ocspHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		now := time.Now()
+		ocspRes := ocsp.Response{
+			SerialNumber: leafTLS.Leaf.SerialNumber,
+			ThisUpdate:   now.Add(-1 * time.Hour),
+			NextUpdate:   now.Add(30 * time.Minute),
+			Status:       ocsp.Revoked,
+		}
+		response, err := ocsp.CreateResponse(caTLS.Leaf, caTLS.Leaf, ocspRes, caTLS.PrivateKey.(crypto.Signer))
+		if err != nil {
+			t.Fatalf("failed generating OCSP response: %v", err)
+		}
+		_, _ = w.Write(response)
+	})
+	ts := httptest.NewServer(ocspHandler)
+	defer ts.Close()
+
+	// With no OCSP servers available, make sure that we behave as we expect
+	steps := []logicaltest.TestStep{
+		// Step 1/2 With a single revoke response, query all servers set to false and fail open true, fail validation
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         true,
+				"ocsp_query_all_servers": false,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLoginInvalid(t, connState),
+		// Step 3/4 With a single revoke response, query all servers set to false and fail open false, fail validation
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo",
+			allowed{names: "cert.example.com"}, false, map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         false,
+				"ocsp_query_all_servers": false,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLoginInvalid(t, connState),
+		// Step 5/6 With a single revoke response, query all servers set to true and fail open false, fail validation
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo",
+			allowed{names: "cert.example.com"}, false, map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         false,
+				"ocsp_query_all_servers": true,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLoginInvalid(t, connState),
+		// Step 7/8 With a single revoke response, query all servers set to true and fail open true, fail validation
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         true,
+				"ocsp_query_all_servers": true,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLoginInvalid(t, connState),
+	}
+
+	// Setup a new factory everytime to avoid OCSP caching from influencing the test
+	for i := 0; i < len(steps); i += 2 {
+		setup := i
+		execute := i + 1
+		t.Run(fmt.Sprintf("steps-%d-%d", setup+1, execute+1), func(t *testing.T) {
+			logicaltest.Test(t, logicaltest.TestCase{
+				CredentialBackend: testFactory(t),
+				Steps:             []logicaltest.TestStep{steps[setup], steps[execute]},
+			})
+		})
+	}
+}
+
+// TestOCSPFailOpenWithUnknownResponse validates the expected behavior with multiple OCSP servers configured
+// one that returns an Unknown response the other is not available, along with the ocsp_fail_open in multiple modes
+func TestOCSPFailOpenWithUnknownResponse(t *testing.T) {
+	caFile := "test-fixtures/root/rootcacert.pem"
+	pemCa, err := os.ReadFile(caFile)
+	require.NoError(t, err, "failed reading in file %s", caFile)
+	caTLS := loadCerts(t, caFile, "test-fixtures/root/rootcakey.pem")
+	leafTLS := loadCerts(t, "test-fixtures/keys/cert.pem", "test-fixtures/keys/key.pem")
+
+	rootConfig := &rootcerts.Config{
+		CAFile: caFile,
+	}
+	rootCAs, err := rootcerts.LoadCACerts(rootConfig)
+	connState, err := testConnStateWithCert(leafTLS, rootCAs)
+	require.NoError(t, err, "error testing connection state: %v", err)
+
+	// Setup an OCSP handler
+	ocspHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		now := time.Now()
+		ocspRes := ocsp.Response{
+			SerialNumber: leafTLS.Leaf.SerialNumber,
+			ThisUpdate:   now.Add(-1 * time.Hour),
+			NextUpdate:   now.Add(30 * time.Minute),
+			Status:       ocsp.Unknown,
+		}
+		response, err := ocsp.CreateResponse(caTLS.Leaf, caTLS.Leaf, ocspRes, caTLS.PrivateKey.(crypto.Signer))
+		if err != nil {
+			t.Fatalf("failed generating OCSP response: %v", err)
+		}
+		_, _ = w.Write(response)
+	})
+	ts := httptest.NewServer(ocspHandler)
+	defer ts.Close()
+
+	// With no OCSP servers available, make sure that we behave as we expect
+	steps := []logicaltest.TestStep{
+		// Step 1/2 With a single unknown response, query all servers set to false and fail open true, pass validation
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         true,
+				"ocsp_query_all_servers": false,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLogin(t, connState),
+		// Step 3/4 With a single unknown response, query all servers set to false and fail open false, fail validation
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo",
+			allowed{names: "cert.example.com"}, false, map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         false,
+				"ocsp_query_all_servers": false,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLoginInvalid(t, connState),
+		// Step 5/6 With a single unknown response, query all servers set to true and fail open true, fail validation
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo", allowed{names: "cert.example.com"}, false,
+			map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         true,
+				"ocsp_query_all_servers": true,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLogin(t, connState),
+		// Step 7/8 With a single unknown response, query all servers set to true and fail open false, fail validation
+		testAccStepCertWithExtraParams(t, "web", pemCa, "foo",
+			allowed{names: "cert.example.com"}, false, map[string]interface{}{
+				"ocsp_enabled":           true,
+				"ocsp_servers_override":  []string{ts.URL, "http://127.0.0.1:30001"},
+				"ocsp_fail_open":         false,
+				"ocsp_query_all_servers": true,
+				"ocsp_max_retries":       0,
+			}),
+		testAccStepLoginInvalid(t, connState),
+	}
+
+	// Setup a new factory everytime to avoid OCSP caching from influencing the test
+	for i := 0; i < len(steps); i += 2 {
+		setup := i
+		execute := i + 1
+		t.Run(fmt.Sprintf("steps-%d-%d", setup+1, execute+1), func(t *testing.T) {
+			logicaltest.Test(t, logicaltest.TestCase{
+				CredentialBackend: testFactory(t),
+				Steps:             []logicaltest.TestStep{steps[setup], steps[execute]},
+			})
+		})
+	}
+}
+
+// TestOcspMaxRetriesUpdate verifies that the ocsp_max_retries field is properly initialized
+// with our default value of 4, legacy roles have it initialized automatically to 4 and we
+// can properly store and retrieve updates to the field.
+func TestOcspMaxRetriesUpdate(t *testing.T) {
+	storage := &logical.InmemStorage{}
+	ctx := context.Background()
+
+	lb, err := Factory(context.Background(), &logical.BackendConfig{
+		System: &logical.StaticSystemView{
+			DefaultLeaseTTLVal: 300 * time.Second,
+			MaxLeaseTTLVal:     1800 * time.Second,
+		},
+		StorageView: storage,
+	})
+	require.NoError(t, err, "failed creating backend")
+
+	caFile := "test-fixtures/root/rootcacert.pem"
+	pemCa, err := os.ReadFile(caFile)
+	require.NoError(t, err, "failed reading in file %s", caFile)
+
+	data := map[string]interface{}{
+		"certificate":  string(pemCa),
+		"display_name": "test",
+	}
+
+	// Test initial creation of role sets ocsp_max_retries to a default of 4
+	_, err = lb.HandleRequest(ctx, &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "certs/test",
+		Data:      data,
+		Storage:   storage,
+	})
+	require.NoError(t, err, "failed initial role creation request")
+
+	resp, err := lb.HandleRequest(ctx, &logical.Request{
+		Operation: logical.ReadOperation,
+		Path:      "certs/test",
+		Storage:   storage,
+	})
+	require.NoError(t, err, "failed reading role request")
+	require.NotNil(t, resp)
+	require.Equal(t, 4, resp.Data["ocsp_max_retries"], "ocsp config didn't match expectations")
+
+	// Test we can update the field and read it back
+	data["ocsp_max_retries"] = 1
+	_, err = lb.HandleRequest(ctx, &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "certs/test",
+		Data:      data,
+		Storage:   storage,
+	})
+	require.NoError(t, err, "failed updating role request")
+
+	resp, err = lb.HandleRequest(ctx, &logical.Request{
+		Operation: logical.ReadOperation,
+		Path:      "certs/test",
+		Storage:   storage,
+	})
+	require.NoError(t, err, "failed reading role request")
+	require.NotNil(t, resp)
+	require.Equal(t, 1, resp.Data["ocsp_max_retries"], "ocsp config didn't match expectations on update")
+
+	// Verify existing storage entries get updated with a value of 4
+	entry := &logical.StorageEntry{
+		Key: "cert/legacy",
+		Value: []byte(`{"token_bound_cidrs":null,"token_explicit_max_ttl":0,"token_max_ttl":0,
+						"token_no_default_policy":false,"token_num_uses":0,"token_period":0,
+						"token_policies":null,"token_type":0,"token_ttl":0,"Name":"test",
+						"Certificate":"-----BEGIN CERTIFICATE-----\nMIIDPDCCAiSgAwIBAgIUb5id+GcaMeMnYBv3MvdTGWigyJ0wDQYJKoZIhvcNAQEL\nBQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wHhcNMTYwMjI5MDIyNzI5WhcNMjYw\nMjI2MDIyNzU5WjAWMRQwEgYDVQQDEwtleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcN\nAQEBBQADggEPADCCAQoCggEBAOxTMvhTuIRc2YhxZpmPwegP86cgnqfT1mXxi1A7\nQ7qax24Nqbf00I3oDMQtAJlj2RB3hvRSCb0/lkF7i1Bub+TGxuM7NtZqp2F8FgG0\nz2md+W6adwW26rlxbQKjmRvMn66G9YPTkoJmPmxt2Tccb9+apmwW7lslL5j8H48x\nAHJTMb+PMP9kbOHV5Abr3PT4jXUPUr/mWBvBiKiHG0Xd/HEmlyOEPeAThxK+I5tb\n6m+eB+7cL9BsvQpy135+2bRAxUphvFi5NhryJ2vlAvoJ8UqigsNK3E28ut60FAoH\nSWRfFUFFYtfPgTDS1yOKU/z/XMU2giQv2HrleWt0mp4jqBUCAwEAAaOBgTB/MA4G\nA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSdxLNP/ocx\n7HK6JT3/sSAe76iTmzAfBgNVHSMEGDAWgBSdxLNP/ocx7HK6JT3/sSAe76iTmzAc\nBgNVHREEFTATggtleGFtcGxlLmNvbYcEfwAAATANBgkqhkiG9w0BAQsFAAOCAQEA\nwHThDRsXJunKbAapxmQ6bDxSvTvkLA6m97TXlsFgL+Q3Jrg9HoJCNowJ0pUTwhP2\nU946dCnSCkZck0fqkwVi4vJ5EQnkvyEbfN4W5qVsQKOFaFVzep6Qid4rZT6owWPa\ncNNzNcXAee3/j6hgr6OQ/i3J6fYR4YouYxYkjojYyg+CMdn6q8BoV0BTsHdnw1/N\nScbnBHQIvIZMBDAmQueQZolgJcdOuBLYHe/kRy167z8nGg+PUFKIYOL8NaOU1+CJ\nt2YaEibVq5MRqCbRgnd9a2vG0jr5a3Mn4CUUYv+5qIjP3hUusYenW1/EWtn1s/gk\nzehNe5dFTjFpylg1o6b8Ow==\n-----END CERTIFICATE-----\n",
+						"DisplayName":"test","Policies":null,"TTL":0,"MaxTTL":0,"Period":0,
+						"AllowedNames":null,"AllowedCommonNames":null,"AllowedDNSSANs":null,
+						"AllowedEmailSANs":null,"AllowedURISANs":null,"AllowedOrganizationalUnits":null,
+						"AllowedOrganizations":null,"RequiredExtensions":null,"AllowedMetadataExtensions":null,
+						"BoundCIDRs":null,"OcspCaCertificates":"","OcspEnabled":false,"OcspServersOverride":null,
+						"OcspFailOpen":false,"OcspQueryAllServers":false}`),
+	}
+	err = storage.Put(ctx, entry)
+	require.NoError(t, err, "failed putting legacy storage entry")
+
+	resp, err = lb.HandleRequest(ctx, &logical.Request{
+		Operation: logical.ReadOperation,
+		Path:      "certs/legacy",
+		Storage:   storage,
+	})
+	require.NoError(t, err, "failed reading role request")
+	require.NotNil(t, resp)
+	require.Equal(t, 4, resp.Data["ocsp_max_retries"], "ocsp config didn't match expectations on legacy entry")
+}
+
+func TestRecoverPartialLoad(t *testing.T) {
+	storage := &logical.InmemStorage{}
+	ctx := context.Background()
+
+	lb, err := Factory(context.Background(), &logical.BackendConfig{
+		System: &logical.StaticSystemView{
+			DefaultLeaseTTLVal: 300 * time.Second,
+			MaxLeaseTTLVal:     1800 * time.Second,
+		},
+		StorageView: storage,
+	})
+	require.NoError(t, err, "failed creating backend")
+
+	b, ok := lb.(*backend)
+	require.True(t, ok, "somehow the backend was the wrong type")
+
+	// There a single certificate in storage...
+	nonCACert, err := os.ReadFile(testCertPath1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	entry, err := logical.StorageEntryJSON("cert/cert_a", CertEntry{
+		Name:        "cert_a",
+		Certificate: string(nonCACert),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = storage.Put(ctx, entry)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// ...but storage doesn't actually work right now....
+	storage.FailGet(true)
+
+	// ...can we load certificates? no.
+	_, _, trustedNonCAs, _ := b.getTrustedCerts(ctx, storage, "")
+	require.Len(t, trustedNonCAs, 0, "should have no non CA certificates yet")
+
+	// We should have a cache, and it should have a retry assocaited with it.
+	trusted, _ /*complete*/ := b.getTrustedCertsFromCache("")
+	require.NotNil(t, trusted, "cache didn't exist")
+	require.NotNil(t, trusted.retry, "cache not marked with a retry")
+	// We can't verify complete because it depends on how fast the test is running (techincally)
+
+	// Make sure that we reload the cache, and repair storage. (It works now!)
+	trusted.retry.deadline = time.Now().Add(-1 * time.Second)
+	storage.FailGet(false)
+
+	// Now when we get the trusted certs, it should actually work!
+	_, _, trustedNonCAs, _ = b.getTrustedCerts(ctx, storage, "")
+	require.Len(t, trustedNonCAs, 1, "should have recovered and loaded a non-CA cert")
+	require.Equal(t, trustedNonCAs[0].Entry.Name, "cert_a", "non-CA cert name didn't match")
+}
+
+func loadCerts(t *testing.T, certFile, certKey string) tls.Certificate {
+	caTLS, err := tls.LoadX509KeyPair(certFile, certKey)
+	require.NoError(t, err, "failed reading ca/key files")
+
+	caTLS.Leaf, err = x509.ParseCertificate(caTLS.Certificate[0])
+	require.NoError(t, err, "failed parsing certificate from file %s", certFile)
+
+	return caTLS
+}
+
+func createCa(t *testing.T) (*x509.Certificate, *ecdsa.PrivateKey) {
+	rootCaKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err, "failed generated root key for CA")
+
+	// Validate we reject CSRs that contain CN that aren't in the original order
+	cr := &x509.Certificate{
+		Subject:               pkix.Name{CommonName: "Root Cert"},
+		SerialNumber:          big.NewInt(1),
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+		SignatureAlgorithm:    x509.ECDSAWithSHA256,
+		NotBefore:             time.Now().Add(-1 * time.Second),
+		NotAfter:              time.Now().AddDate(1, 0, 0),
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageOCSPSigning},
+	}
+	rootCaBytes, err := x509.CreateCertificate(rand.Reader, cr, cr, &rootCaKey.PublicKey, rootCaKey)
+	require.NoError(t, err, "failed generating root ca")
+
+	rootCa, err := x509.ParseCertificate(rootCaBytes)
+	require.NoError(t, err, "failed parsing root ca")
+
+	return rootCa, rootCaKey
+}
diff --git a/builtin/credential/cert/cli.go b/builtin/credential/cert/cli.go
index 2e7a8b8e22e..87d892ae034 100644
--- a/builtin/credential/cert/cli.go
+++ b/builtin/credential/cert/cli.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
diff --git a/builtin/credential/cert/cmd/cert/main.go b/builtin/credential/cert/cmd/cert/main.go
index 45eb75d36ca..e78cc3108a0 100644
--- a/builtin/credential/cert/cmd/cert/main.go
+++ b/builtin/credential/cert/cmd/cert/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/credential/cert/path_certs.go b/builtin/credential/cert/path_certs.go
index 81d6de7f44d..6aa4a311733 100644
--- a/builtin/credential/cert/path_certs.go
+++ b/builtin/credential/cert/path_certs.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-sockaddr"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/tokenutil"
@@ -90,6 +91,16 @@ from the AuthorityInformationAccess extension on the certificate being inspected
 				Default:     false,
 				Description: "If set to true, rather than accepting the first successful OCSP response, query all servers and consider the certificate valid only if all servers agree.",
 			},
+			"ocsp_this_update_max_age": {
+				Type:        framework.TypeDurationSecond,
+				Default:     0,
+				Description: "If greater than 0, specifies the maximum age of an OCSP thisUpdate field to avoid accepting old responses without a nextUpdate field.",
+			},
+			"ocsp_max_retries": {
+				Type:        framework.TypeInt,
+				Default:     4,
+				Description: "The number of retries the OCSP client should attempt per query.",
+			},
 			"allowed_names": {
 				Type: framework.TypeCommaStringSlice,
 				Description: `A comma-separated list of names.
@@ -155,6 +166,17 @@ At least one must exist in the OU field.`,
 				},
 			},
 
+			"allowed_organizations": {
+				Type: framework.TypeCommaStringSlice,
+				Description: `A comma-separated list of Organization names.
+At least one must exist in the O field. Supports globbing.`,
+				DisplayAttrs: &framework.DisplayAttributes{
+					Name:        "Allowed Organizations",
+					Group:       "Constraints",
+					Description: "A list of Organization names.  At least one must exist in the O field.",
+				},
+			},
+
 			"required_extensions": {
 				Type: framework.TypeCommaStringSlice,
 				Description: `A comma-separated string or array of extensions
@@ -242,7 +264,7 @@ func (b *backend) Cert(ctx context.Context, s logical.Storage, n string) (*CertE
 		return nil, nil
 	}
 
-	var result CertEntry
+	result := CertEntry{OcspMaxRetries: defaultOcspMaxRetries} // Specify our defaults if the key is missing
 	if err := entry.DecodeJSON(&result); err != nil {
 		return nil, err
 	}
@@ -301,6 +323,7 @@ func (b *backend) pathCertRead(ctx context.Context, req *logical.Request, d *fra
 		"allowed_email_sans":           cert.AllowedEmailSANs,
 		"allowed_uri_sans":             cert.AllowedURISANs,
 		"allowed_organizational_units": cert.AllowedOrganizationalUnits,
+		"allowed_organizations":        cert.AllowedOrganizations,
 		"required_extensions":          cert.RequiredExtensions,
 		"allowed_metadata_extensions":  cert.AllowedMetadataExtensions,
 		"ocsp_ca_certificates":         cert.OcspCaCertificates,
@@ -308,6 +331,8 @@ func (b *backend) pathCertRead(ctx context.Context, req *logical.Request, d *fra
 		"ocsp_servers_override":        cert.OcspServersOverride,
 		"ocsp_fail_open":               cert.OcspFailOpen,
 		"ocsp_query_all_servers":       cert.OcspQueryAllServers,
+		"ocsp_this_update_max_age":     int64(cert.OcspThisUpdateMaxAge.Seconds()),
+		"ocsp_max_retries":             cert.OcspMaxRetries,
 	}
 	cert.PopulateTokenData(data)
 
@@ -343,7 +368,8 @@ func (b *backend) pathCertWrite(ctx context.Context, req *logical.Request, d *fr
 
 	if cert == nil {
 		cert = &CertEntry{
-			Name: name,
+			Name:           name,
+			OcspMaxRetries: defaultOcspMaxRetries,
 		}
 	}
 
@@ -366,6 +392,19 @@ func (b *backend) pathCertWrite(ctx context.Context, req *logical.Request, d *fr
 	if ocspQueryAll, ok := d.GetOk("ocsp_query_all_servers"); ok {
 		cert.OcspQueryAllServers = ocspQueryAll.(bool)
 	}
+	if ocspThisUpdateMaxAge, ok := d.GetOk("ocsp_this_update_max_age"); ok {
+		maxAgeDuration, err := parseutil.ParseDurationSecond(ocspThisUpdateMaxAge)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse ocsp_this_update_max_age: %w", err)
+		}
+		cert.OcspThisUpdateMaxAge = maxAgeDuration
+	}
+	if ocspMaxRetries, ok := d.GetOk("ocsp_max_retries"); ok {
+		cert.OcspMaxRetries = ocspMaxRetries.(int)
+		if cert.OcspMaxRetries < 0 {
+			return nil, fmt.Errorf("ocsp_max_retries can not be a negative number")
+		}
+	}
 	if displayNameRaw, ok := d.GetOk("display_name"); ok {
 		cert.DisplayName = displayNameRaw.(string)
 	}
@@ -387,6 +426,9 @@ func (b *backend) pathCertWrite(ctx context.Context, req *logical.Request, d *fr
 	if allowedOrganizationalUnitsRaw, ok := d.GetOk("allowed_organizational_units"); ok {
 		cert.AllowedOrganizationalUnits = allowedOrganizationalUnitsRaw.([]string)
 	}
+	if allowedOrganizations, ok := d.GetOk("allowed_organizations"); ok {
+		cert.AllowedOrganizations = allowedOrganizations.([]string)
+	}
 	if requiredExtensionsRaw, ok := d.GetOk("required_extensions"); ok {
 		cert.RequiredExtensions = requiredExtensionsRaw.([]string)
 	}
@@ -507,15 +549,18 @@ type CertEntry struct {
 	AllowedEmailSANs           []string
 	AllowedURISANs             []string
 	AllowedOrganizationalUnits []string
+	AllowedOrganizations       []string
 	RequiredExtensions         []string
 	AllowedMetadataExtensions  []string
 	BoundCIDRs                 []*sockaddr.SockAddrMarshaler
 
-	OcspCaCertificates  string
-	OcspEnabled         bool
-	OcspServersOverride []string
-	OcspFailOpen        bool
-	OcspQueryAllServers bool
+	OcspCaCertificates   string
+	OcspEnabled          bool
+	OcspServersOverride  []string
+	OcspFailOpen         bool
+	OcspQueryAllServers  bool
+	OcspThisUpdateMaxAge time.Duration
+	OcspMaxRetries       int
 }
 
 const pathCertHelpSyn = `
diff --git a/builtin/credential/cert/path_config.go b/builtin/credential/cert/path_config.go
index 1183775f6bc..3ca978dc79b 100644
--- a/builtin/credential/cert/path_config.go
+++ b/builtin/credential/cert/path_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
@@ -42,6 +42,11 @@ func pathConfig(b *backend) *framework.Path {
 				Default:     defaultRoleCacheSize,
 				Description: `The size of the in memory role cache`,
 			},
+			"enable_metadata_on_failures": {
+				Type:        framework.TypeBool,
+				Default:     false,
+				Description: `If set, metadata of the client certificate will be returned on authentication failures.`,
+			},
 		},
 
 		Operations: map[logical.Operation]framework.OperationHandler{
@@ -87,6 +92,9 @@ func (b *backend) pathConfigWrite(ctx context.Context, req *logical.Request, dat
 		}
 		config.RoleCacheSize = cacheSize
 	}
+	if enableMetadataOnFailures, ok := data.GetOk("enable_metadata_on_failures"); ok {
+		config.EnableMetadataOnFailures = enableMetadataOnFailures.(bool)
+	}
 	if err := b.storeConfig(ctx, req.Storage, config); err != nil {
 		return nil, err
 	}
@@ -104,6 +112,7 @@ func (b *backend) pathConfigRead(ctx context.Context, req *logical.Request, d *f
 		"enable_identity_alias_metadata": cfg.EnableIdentityAliasMetadata,
 		"ocsp_cache_size":                cfg.OcspCacheSize,
 		"role_cache_size":                cfg.RoleCacheSize,
+		"enable_metadata_on_failures":    cfg.EnableMetadataOnFailures,
 	}
 
 	return &logical.Response{
@@ -133,4 +142,5 @@ type config struct {
 	EnableIdentityAliasMetadata bool `json:"enable_identity_alias_metadata"`
 	OcspCacheSize               int  `json:"ocsp_cache_size"`
 	RoleCacheSize               int  `json:"role_cache_size"`
+	EnableMetadataOnFailures    bool `json:"enable_metadata_on_failures"`
 }
diff --git a/builtin/credential/cert/path_crls.go b/builtin/credential/cert/path_crls.go
index f38654869d7..87834f4e1b4 100644
--- a/builtin/credential/cert/path_crls.go
+++ b/builtin/credential/cert/path_crls.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
diff --git a/builtin/credential/cert/path_crls_test.go b/builtin/credential/cert/path_crls_test.go
index 26a47b32933..837566f9a8d 100644
--- a/builtin/credential/cert/path_crls_test.go
+++ b/builtin/credential/cert/path_crls_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
diff --git a/builtin/credential/cert/path_login.go b/builtin/credential/cert/path_login.go
index 5b9fec9a6c2..35e227629fd 100644
--- a/builtin/credential/cert/path_login.go
+++ b/builtin/credential/cert/path_login.go
@@ -1,10 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
 
 import (
-	"bytes"
 	"context"
 	"crypto/tls"
 	"crypto/x509"
@@ -14,17 +13,22 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
+	"math"
+	"math/rand"
+	"net/url"
 	"strings"
+	"time"
 
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/cidrutil"
+	"github.com/hashicorp/vault/sdk/helper/locksutil"
 	"github.com/hashicorp/vault/sdk/helper/ocsp"
 	"github.com/hashicorp/vault/sdk/helper/policyutil"
 	"github.com/hashicorp/vault/sdk/logical"
-	glob "github.com/ryanuber/go-glob"
+	"github.com/ryanuber/go-glob"
 )
 
 // ParsedCert is a certificate that has been configured as trusted
@@ -33,6 +37,8 @@ type ParsedCert struct {
 	Certificates []*x509.Certificate
 }
 
+const certAuthFailMsg = "failed to match all constraints for this login certificate"
+
 func pathLogin(b *backend) *framework.Path {
 	return &framework.Path{
 		Pattern: "login",
@@ -66,12 +72,27 @@ func (b *backend) loginPathWrapper(wrappedOp func(ctx context.Context, req *logi
 }
 
 func (b *backend) pathLoginResolveRole(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	// Quota role rule creates send a probe to test if the backend returns
+	// ErrUnsupportedOperation for ResolveRole, and there's no req.Storage populated
+	// for these.  So just return a non-ErrUnsupportedOperation error.
+	if req.Storage == nil {
+		return logical.ErrorResponse("no storage"), logical.ErrMissingRequiredState
+	}
+
+	config, err := b.Config(ctx, req.Storage)
+	if err != nil {
+		return nil, err
+	}
+	if b.configUpdated.Load() {
+		b.updatedConfig(config)
+	}
+
 	var matched *ParsedCert
 
 	if verifyResp, resp, err := b.verifyCredentials(ctx, req, data); err != nil {
 		return nil, err
 	} else if resp != nil {
-		return resp, nil
+		return certAuthLoginFailureResponse(config, resp, req), nil
 	} else {
 		matched = verifyResp
 	}
@@ -114,7 +135,7 @@ func (b *backend) pathLogin(ctx context.Context, req *logical.Request, data *fra
 	if verifyResp, resp, err := b.verifyCredentials(ctx, req, data); err != nil {
 		return nil, err
 	} else if resp != nil {
-		return resp, nil
+		return certAuthLoginFailureResponse(config, resp, req), nil
 	} else {
 		matched = verifyResp
 	}
@@ -177,6 +198,56 @@ func (b *backend) pathLogin(ctx context.Context, req *logical.Request, data *fra
 	}, nil
 }
 
+func certAuthLoginFailureResponse(config *config, resp *logical.Response, req *logical.Request) *logical.Response {
+	if !config.EnableMetadataOnFailures || !resp.IsError() {
+		return resp
+	}
+	var initialErrMsg string
+	if err := resp.Error(); err != nil {
+		initialErrMsg = err.Error()
+	}
+
+	clientCert, exists := getClientCert(req)
+	if !exists {
+		return logical.ErrorResponse("no client certificate found\n" + initialErrMsg)
+	}
+
+	// Trim these values as they can be anything from any sort of failed certificate
+	// and we don't want to expose audit entries to randomly large strings.
+	const maxChars = 100
+	metadata := map[string]string{
+		"common_name":      trimToMaxChars(clientCert.Subject.CommonName, maxChars),
+		"serial_number":    trimToMaxChars(clientCert.SerialNumber.String(), maxChars),
+		"subject_key_id":   trimToMaxChars(certutil.GetHexFormatted(clientCert.SubjectKeyId, ":"), maxChars),
+		"authority_key_id": trimToMaxChars(certutil.GetHexFormatted(clientCert.AuthorityKeyId, ":"), maxChars),
+	}
+
+	return logical.ErrorResponseWithData(metadata, initialErrMsg)
+}
+
+func getClientCert(req *logical.Request) (*x509.Certificate, bool) {
+	if req == nil || req.Connection == nil || req.Connection.ConnState == nil || req.Connection.ConnState.PeerCertificates == nil {
+		return nil, false
+	}
+	clientCerts := req.Connection.ConnState.PeerCertificates
+	if len(clientCerts) == 0 {
+		return nil, false
+	}
+	clientCert := clientCerts[0]
+	if clientCert == nil || clientCert.IsCA {
+		return nil, false
+	}
+	return clientCert, true
+}
+
+func trimToMaxChars(formatted string, maxSize int) string {
+	if len(formatted) > maxSize {
+		return formatted[:maxSize-3] + "..."
+	}
+
+	return formatted
+}
+
 func (b *backend) pathLoginRenew(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 	config, err := b.Config(ctx, req.Storage)
 	if err != nil {
@@ -191,7 +262,7 @@ func (b *backend) pathLoginRenew(ctx context.Context, req *logical.Request, d *f
 		if verifyResp, resp, err := b.verifyCredentials(ctx, req, d); err != nil {
 			return nil, err
 		} else if resp != nil {
-			return resp, nil
+			return certAuthLoginFailureResponse(config, resp, req), nil
 		} else {
 			matched = verifyResp
 		}
@@ -277,18 +348,16 @@ func (b *backend) verifyCredentials(ctx context.Context, req *logical.Request, d
 		for _, trustedNonCA := range trustedNonCAs {
 			tCert := trustedNonCA.Certificates[0]
 			// Check for client cert being explicitly listed in the config (and matching other constraints)
-			if tCert.SerialNumber.Cmp(clientCert.SerialNumber) == 0 &&
-				bytes.Equal(tCert.AuthorityKeyId, clientCert.AuthorityKeyId) {
-				pkMatch, err := certutil.ComparePublicKeysAndType(tCert.PublicKey, clientCert.PublicKey)
-				if err != nil {
-					return nil, nil, err
-				}
-				if !pkMatch {
-					// Someone may be trying to pass off a forged certificate as the trusted non-CA cert.  Reject early.
-					return nil, logical.ErrorResponse("public key mismatch of a trusted leaf certificate"), nil
-				}
+			if tCert.SerialNumber.Cmp(clientCert.SerialNumber) == 0 {
 				matches, err := b.matchesConstraints(ctx, clientCert, trustedNonCA.Certificates, trustedNonCA, verifyConf)
 
+				if matches {
+					if !tCert.Equal(clientCert) {
+						// Someone may be trying to pass off a forged certificate as the trusted non-CA cert.  Reject early.
+						return nil, logical.ErrorResponse("certificate mismatch of a trusted leaf certificate"), nil
+					}
+				}
+
 				// matchesConstraints returns an error when OCSP verification fails,
 				// but some other path might still give us success. Add to the
 				// retErr multierror, but avoid duplicates. This way, if we reach a
@@ -311,10 +380,11 @@ func (b *backend) verifyCredentials(ctx context.Context, req *logical.Request, d
 	// If no trusted chain was found, client is not authenticated
 	// This check happens after checking for a matching configured non-CA certs
 	if len(trustedChains) == 0 {
-		if retErr == nil {
-			return nil, logical.ErrorResponse(fmt.Sprintf("invalid certificate or no client certificate supplied; additionally got errors during verification: %v", retErr)), nil
+		if retErr != nil {
+			return nil, logical.ErrorResponse(fmt.Sprintf("%s; additionally got errors during verification: %v", certAuthFailMsg, retErr)), nil
 		}
-		return nil, logical.ErrorResponse("invalid certificate or no client certificate supplied"), nil
+
+		return nil, logical.ErrorResponse(certAuthFailMsg), nil
 	}
 
 	// Search for a ParsedCert that intersects with the validated chains and any additional constraints
@@ -349,10 +419,10 @@ func (b *backend) verifyCredentials(ctx context.Context, req *logical.Request, d
 	}
 
 	if retErr != nil {
-		return nil, logical.ErrorResponse(fmt.Sprintf("no chain matching all constraints could be found for this login certificate; additionally got errors during verification: %v", retErr)), nil
+		return nil, logical.ErrorResponse(fmt.Sprintf("%s; additionally got errors during verification: %v", certAuthFailMsg, retErr)), nil
 	}
 
-	return nil, logical.ErrorResponse("no chain matching all constraints could be found for this login certificate"), nil
+	return nil, logical.ErrorResponse(certAuthFailMsg), nil
 }
 
 func (b *backend) matchesConstraints(ctx context.Context, clientCert *x509.Certificate, trustedChain []*x509.Certificate,
@@ -365,6 +435,7 @@ func (b *backend) matchesConstraints(ctx context.Context, clientCert *x509.Certi
 		b.matchesEmailSANs(clientCert, config) &&
 		b.matchesURISANs(clientCert, config) &&
 		b.matchesOrganizationalUnits(clientCert, config) &&
+		b.matchesOrganizations(clientCert, config) &&
 		b.matchesCertificateExtensions(clientCert, config)
 	if config.Entry.OcspEnabled {
 		ocspGood, err := b.checkForCertInOCSP(ctx, clientCert, trustedChain, conf)
@@ -479,7 +550,7 @@ func (b *backend) matchesURISANs(clientCert *x509.Certificate, config *ParsedCer
 	return false
 }
 
-// matchesOrganizationalUnits verifies that the certificate matches at least one configurd allowed OU
+// matchesOrganizationalUnits verifies that the certificate matches at least one configured allowed OU
 func (b *backend) matchesOrganizationalUnits(clientCert *x509.Certificate, config *ParsedCert) bool {
 	// Default behavior (no OUs) is to allow all OUs
 	if len(config.Entry.AllowedOrganizationalUnits) == 0 {
@@ -498,6 +569,25 @@ func (b *backend) matchesOrganizationalUnits(clientCert *x509.Certificate, confi
 	return false
 }
 
+// matchesOrganizations verifies that the certificate matches at least one configured allowed organization (O)
+func (b *backend) matchesOrganizations(clientCert *x509.Certificate, config *ParsedCert) bool {
+	// Default behavior (no Organizations (Os)) is to allow all organizations (Os)
+	if len(config.Entry.AllowedOrganizations) == 0 {
+		return true
+	}
+
+	// At least one pattern must match at least one name if any patterns are specified
+	for _, allowedOrganization := range config.Entry.AllowedOrganizations {
+		for _, o := range clientCert.Subject.Organization {
+			if glob.Glob(allowedOrganization, o) {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
 // matchesCertificateExtensions verifies that the certificate matches configured
 // required extensions
 func (b *backend) matchesCertificateExtensions(clientCert *x509.Certificate, config *ParsedCert) bool {
@@ -592,18 +682,63 @@ func (b *backend) certificateExtensionsMetadata(clientCert *x509.Certificate, co
 
 func (b *backend) getTrustedCerts(ctx context.Context, storage logical.Storage, certName string) (pool *x509.CertPool, trusted []*ParsedCert, trustedNonCAs []*ParsedCert, conf *ocsp.VerifyConfig) {
 	if !b.trustedCacheDisabled.Load() {
-		if trusted, found := b.trustedCache.Get(certName); found {
+		trusted, complete := b.getTrustedCertsFromCache(certName)
+		if complete {
 			return trusted.pool, trusted.trusted, trusted.trustedNonCAs, trusted.ocspConf
 		}
 	}
 	return b.loadTrustedCerts(ctx, storage, certName)
 }
 
+func (b *backend) getTrustedCertsFromCache(certName string) (*trusted, bool) {
+	var trusted *trusted
+	if certName == "" {
+		trusted = b.trustedCacheFull.Load()
+	} else {
+		trusted, _ = b.trustedCache.Get(certName)
+	}
+
+	if trusted == nil {
+		return nil, false
+	}
+
+	// We're complete (for our purposes here) if we're really complete
+	// (because retry is nil) or if it's just not time to retry the load yet.
+	complete := (trusted.retry == nil) || time.Now().Before(trusted.retry.deadline)
+	return trusted, complete
+}
+
 // loadTrustedCerts is used to load all the trusted certificates from the backend
 func (b *backend) loadTrustedCerts(ctx context.Context, storage logical.Storage, certName string) (pool *x509.CertPool, trustedCerts []*ParsedCert, trustedNonCAs []*ParsedCert, conf *ocsp.VerifyConfig) {
-	pool = x509.NewCertPool()
-	trustedCerts = make([]*ParsedCert, 0)
-	trustedNonCAs = make([]*ParsedCert, 0)
+	lock := locksutil.LockForKey(b.trustedCacheLocks, certName)
+	lock.Lock()
+	defer lock.Unlock()
+
+	var cache *trusted
+	if !b.trustedCacheDisabled.Load() {
+		var complete bool
+		cache, complete = b.getTrustedCertsFromCache(certName)
+		if complete {
+			return cache.pool, cache.trusted, cache.trustedNonCAs, cache.ocspConf
+		}
+	}
+
+	if cache == nil {
+		cache = &trusted{
+			pool:          x509.NewCertPool(),
+			trusted:       make([]*ParsedCert, 0),
+			trustedNonCAs: make([]*ParsedCert, 0),
+			loaded:        make(map[string]struct{}),
+			ocspConf:      &ocsp.VerifyConfig{},
+		}
+	} else {
+		cache = cache.clone()
+	}
+
+	pool = cache.pool
+	trustedCerts = cache.trusted
+	trustedNonCAs = cache.trustedNonCAs
+	conf = cache.ocspConf
 
 	var names []string
 	if certName != "" {
@@ -617,25 +752,23 @@ func (b *backend) loadTrustedCerts(ctx context.Context, storage logical.Storage,
 		}
 	}
 
-	conf = &ocsp.VerifyConfig{}
+	anyErrors := false
 	for _, name := range names {
-		entry, err := b.Cert(ctx, storage, strings.TrimPrefix(name, trustedCertPath))
-		if err != nil {
-			b.Logger().Error("failed to load trusted cert", "name", name, "error", err)
+		if _, found := cache.loaded[name]; found {
 			continue
 		}
+
+		entry, parsed, ocsp_ca_certs := b.loadTrustedCert(ctx, storage, name)
 		if entry == nil {
-			// This could happen when the certName was provided and the cert doesn'log exist,
-			// or just if between the LIST and the GET the cert was deleted.
+			anyErrors = true
 			continue
 		}
+		parsed = append(parsed, ocsp_ca_certs...)
 
-		parsed := parsePEM([]byte(entry.Certificate))
-		if len(parsed) == 0 {
-			b.Logger().Error("failed to parse certificate", "name", name)
-			continue
-		}
-		parsed = append(parsed, parsePEM([]byte(entry.OcspCaCertificates))...)
+		// NOTE: From this point on please finish adding the cert to all the
+		// appropriate lists and pools and configuration! Perform any error
+		// checking above this line.
+		cache.loaded[name] = struct{}{}
 
 		if !parsed[0].IsCA {
 			trustedNonCAs = append(trustedNonCAs, &ParsedCert{
@@ -647,12 +780,12 @@ func (b *backend) loadTrustedCerts(ctx context.Context, storage logical.Storage,
 				pool.AddCert(p)
 			}
 
-			// Create a ParsedCert entry
 			trustedCerts = append(trustedCerts, &ParsedCert{
 				Entry:        entry,
 				Certificates: parsed,
 			})
 		}
+
 		if entry.OcspEnabled {
 			conf.OcspEnabled = true
 			conf.OcspServersOverride = append(conf.OcspServersOverride, entry.OcspServersOverride...)
@@ -662,20 +795,85 @@ func (b *backend) loadTrustedCerts(ctx context.Context, storage logical.Storage,
 				conf.OcspFailureMode = ocsp.FailOpenFalse
 			}
 			conf.QueryAllServers = conf.QueryAllServers || entry.OcspQueryAllServers
+			conf.OcspThisUpdateMaxAge = entry.OcspThisUpdateMaxAge
+			conf.OcspMaxRetries = entry.OcspMaxRetries
+
+			if len(ocsp_ca_certs) > 0 {
+				conf.ExtraCas = ocsp_ca_certs
+			}
 		}
 	}
 
 	if !b.trustedCacheDisabled.Load() {
-		b.trustedCache.Add(certName, &trusted{
-			pool:          pool,
-			trusted:       trustedCerts,
-			trustedNonCAs: trustedNonCAs,
-			ocspConf:      conf,
-		})
+		if anyErrors {
+			// If something went wrong then we are going to set up for an
+			// exponential backoff on reloading the certificates.
+			if cache.retry == nil {
+				cache.retry = &trustedRetry{}
+			}
+
+			// Limits are arbitrary. Max of 2^55 backoff just so that delay
+			// and the the jitter fits into a double. Is that silly? Yes.
+			// 2^55 seconds is more years than the computer will keep
+			// running.
+			if cache.retry.attempt < 55 {
+				cache.retry.attempt += 1
+			}
+
+			d := 1 << cache.retry.attempt
+			pct := (rand.Float64() * 2.0) - 1.0      // between -100% and +100%
+			d += int(math.Floor(float64(d/4) * pct)) // between -25% and +25%
+			cache.retry.deadline = time.Now().Add(time.Duration(d) * time.Second)
+		} else {
+			// No problems, cache is complete, no need to retry.
+			cache.retry = nil
+		}
+
+		cache.trustedNonCAs = trustedNonCAs
+		cache.trusted = trustedCerts
+		if certName == "" {
+			b.trustedCacheFull.Store(cache)
+		} else {
+			b.trustedCache.Add(certName, cache)
+		}
 	}
 	return
 }
 
+func (b *backend) loadTrustedCert(ctx context.Context, storage logical.Storage, name string) (*CertEntry, []*x509.Certificate, []*x509.Certificate) {
+	entry, err := b.Cert(ctx, storage, strings.TrimPrefix(name, trustedCertPath))
+	if err != nil {
+		b.Logger().Error("failed to load trusted cert", "name", name, "error", err)
+		return nil, nil, nil
+	}
+
+	if entry == nil {
+		// This could happen when the certName was provided and the cert doesn't exist,
+		// or just if between the LIST and the GET the cert was deleted.
+		b.Logger().Error("loaded a nil trusted cert", "name", name)
+		return nil, nil, nil
+	}
+
+	parsed := parsePEM([]byte(entry.Certificate))
+	if len(parsed) == 0 {
+		b.Logger().Error("failed to parse certificate", "name", name)
+		return nil, nil, nil
+	}
+
+	var ocsp_ca_certs []*x509.Certificate = nil
+	if len(entry.OcspCaCertificates) > 0 {
+		ocsp_ca_certs, err = certutil.ParseCertsPEM([]byte(entry.OcspCaCertificates))
+		if err != nil {
+			// NOTE: For compatibility, failure to parse the OcspCaCertificates
+			// is never actually fatal to loading the broader file
+			b.Logger().Error("failed to parse ocsp_ca_certificates", "name", name, "error", err)
+			ocsp_ca_certs = nil
+		}
+	}
+
+	return entry, parsed, ocsp_ca_certs
+}
+
 func (b *backend) checkForCertInOCSP(ctx context.Context, clientCert *x509.Certificate, chain []*x509.Certificate, conf *ocsp.VerifyConfig) (bool, error) {
 	if !conf.OcspEnabled || len(chain) < 2 {
 		return true, nil
@@ -684,6 +882,16 @@ func (b *backend) checkForCertInOCSP(ctx context.Context, clientCert *x509.Certi
 	defer b.ocspClientMutex.RUnlock()
 	err := b.ocspClient.VerifyLeafCertificate(ctx, clientCert, chain[1], conf)
 	if err != nil {
+		if ocsp.IsOcspVerificationError(err) {
+			// We don't want anything to override an OCSP verification error
+			return false, err
+		}
+		if conf.OcspFailureMode == ocsp.FailOpenTrue {
+			onlyNetworkErrors := b.handleOcspErrorInFailOpen(err)
+			if onlyNetworkErrors {
+				return true, nil
+			}
+		}
 		// We want to preserve error messages when they have additional,
 		// potentially useful information. Just having a revoked cert
 		// isn't additionally useful.
@@ -695,6 +903,28 @@ func (b *backend) checkForCertInOCSP(ctx context.Context, clientCert *x509.Certi
 	return true, nil
 }
 
+func (b *backend) handleOcspErrorInFailOpen(err error) bool {
+	urlError := &url.Error{}
+	allNetworkErrors := true
+	if multiError, ok := err.(*multierror.Error); ok {
+		for _, myErr := range multiError.Errors {
+			if !errors.As(myErr, &urlError) {
+				allNetworkErrors = false
+			}
+		}
+	} else if !errors.As(err, &urlError) {
+		allNetworkErrors = false
+	}
+
+	if allNetworkErrors {
+		b.Logger().Warn("OCSP is set to fail-open, and could not retrieve "+
+			"OCSP based revocation but proceeding.", "detail", err)
+		return true
+	}
+
+	return false
+}
+
 func (b *backend) checkForChainInCRLs(chain []*x509.Certificate) bool {
 	badChain := false
 	for _, cert := range chain {
diff --git a/builtin/credential/cert/path_login_test.go b/builtin/credential/cert/path_login_test.go
index 508c20b157c..445f122dc42 100644
--- a/builtin/credential/cert/path_login_test.go
+++ b/builtin/credential/cert/path_login_test.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
 
 import (
 	"context"
+	"crypto"
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
@@ -23,6 +24,7 @@ import (
 	logicaltest "github.com/hashicorp/vault/helper/testhelpers/logical"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ocsp"
 )
 
@@ -73,7 +75,7 @@ func TestCert_RoleResolve(t *testing.T) {
 		NotAfter:     time.Now().Add(262980 * time.Hour),
 	}
 
-	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate)
+	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate, nil)
 	if tempDir != "" {
 		defer os.RemoveAll(tempDir)
 	}
@@ -134,7 +136,7 @@ func TestCert_RoleResolveWithoutProvidingCertName(t *testing.T) {
 		NotAfter:     time.Now().Add(262980 * time.Hour),
 	}
 
-	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate)
+	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate, nil)
 	if tempDir != "" {
 		defer os.RemoveAll(tempDir)
 	}
@@ -202,7 +204,52 @@ func testAccStepResolveRoleExpectRoleResolutionToFail(t *testing.T, connState tl
 				t.Fatal("Error not part of response.")
 			}
 
-			if !strings.Contains(errString, "invalid certificate") {
+			if _, dataKeyExists := resp.Data["data"]; dataKeyExists {
+				t.Fatal("metadata key 'data' existed in response without feature enabled")
+			}
+
+			if !strings.Contains(errString, certAuthFailMsg) {
+				t.Fatalf("Error was not due to invalid role name. Error: %s", errString)
+			}
+			return nil
+		},
+		Data: map[string]interface{}{
+			"name": certName,
+		},
+	}
+}
+
+func testAccStepResolveRoleExpectRoleResolutionToFailWithData(t *testing.T, connState tls.ConnectionState, certName string) logicaltest.TestStep {
+	return logicaltest.TestStep{
+		Operation:       logical.ResolveRoleOperation,
+		Path:            "login",
+		Unauthenticated: true,
+		ConnState:       &connState,
+		ErrorOk:         true,
+		Check: func(resp *logical.Response) error {
+			if resp == nil && !resp.IsError() {
+				t.Fatalf("Response was not an error: resp:%#v", resp)
+			}
+
+			errString, ok := resp.Data["error"].(string)
+			if !ok {
+				t.Fatal("Error not part of response.")
+			}
+
+			dataKeysRaw, dataKeyExists := resp.Data["data"]
+			if !dataKeyExists {
+				t.Fatal("metadata key 'data' did not exist in response feature enabled")
+			}
+			dataKeys, ok := dataKeysRaw.(map[string]string)
+			if !ok {
+				t.Fatalf("the 'data' field was not a map: %T", dataKeysRaw)
+			}
+
+			for _, key := range []string{"common_name", "serial_number", "authority_key_id", "subject_key_id"} {
+				require.Contains(t, dataKeys, key, "response metadata key %s was missing in response: %v", key, resp)
+			}
+
+			if !strings.Contains(errString, certAuthFailMsg) {
 				t.Fatalf("Error was not due to invalid role name. Error: %s", errString)
 			}
 			return nil
@@ -230,7 +277,7 @@ func testAccStepResolveRoleOCSPFail(t *testing.T, connState tls.ConnectionState,
 				t.Fatal("Error not part of response.")
 			}
 
-			if !strings.Contains(errString, "no chain matching") {
+			if !strings.Contains(errString, certAuthFailMsg) {
 				t.Fatalf("Error was not due to OCSP failure. Error: %s", errString)
 			}
 			return nil
@@ -258,7 +305,7 @@ func TestCert_RoleResolve_RoleDoesNotExist(t *testing.T) {
 		NotAfter:     time.Now().Add(262980 * time.Hour),
 	}
 
-	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate)
+	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate, nil)
 	if tempDir != "" {
 		defer os.RemoveAll(tempDir)
 	}
@@ -281,19 +328,6 @@ func TestCert_RoleResolve_RoleDoesNotExist(t *testing.T) {
 }
 
 func TestCert_RoleResolveOCSP(t *testing.T) {
-	cases := []struct {
-		name        string
-		failOpen    bool
-		certStatus  int
-		errExpected bool
-	}{
-		{"failFalseGoodCert", false, ocsp.Good, false},
-		{"failFalseRevokedCert", false, ocsp.Revoked, true},
-		{"failFalseUnknownCert", false, ocsp.Unknown, true},
-		{"failTrueGoodCert", true, ocsp.Good, false},
-		{"failTrueRevokedCert", true, ocsp.Revoked, true},
-		{"failTrueUnknownCert", true, ocsp.Unknown, false},
-	}
 	certTemplate := &x509.Certificate{
 		Subject: pkix.Name{
 			CommonName: "example.com",
@@ -310,7 +344,7 @@ func TestCert_RoleResolveOCSP(t *testing.T) {
 		NotAfter:     time.Now().Add(262980 * time.Hour),
 		OCSPServer:   []string{fmt.Sprintf("http://localhost:%d", ocspPort)},
 	}
-	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate)
+	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate, nil)
 	if tempDir != "" {
 		defer os.RemoveAll(tempDir)
 	}
@@ -332,15 +366,76 @@ func TestCert_RoleResolveOCSP(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
+	tempDir, connState2, err := generateTestCertAndConnState(t, certTemplate, nil)
+	if err != nil {
+		t.Fatalf("error testing connection state: %v", err)
+	}
+	ca2, err := ioutil.ReadFile(filepath.Join(tempDir, "ca_cert.pem"))
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	issuer2 := parsePEM(ca2)
+	pkf2, err := ioutil.ReadFile(filepath.Join(tempDir, "ca_key.pem"))
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	pk2, err := certutil.ParsePEMBundle(string(pkf2))
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	type caData struct {
+		privateKey crypto.Signer
+		caBytes    []byte
+		caChain    []*x509.Certificate
+		connState  tls.ConnectionState
+	}
+
+	ca1Data := caData{
+		pk.PrivateKey,
+		ca,
+		issuer,
+		connState,
+	}
+	ca2Data := caData{
+		pk2.PrivateKey,
+		ca2,
+		issuer2,
+		connState2,
+	}
+
+	cases := []struct {
+		name        string
+		failOpen    bool
+		certStatus  int
+		errExpected bool
+		caData      caData
+		ocspCaCerts string
+	}{
+		{name: "failFalseGoodCert", certStatus: ocsp.Good, caData: ca1Data},
+		{name: "failFalseRevokedCert", certStatus: ocsp.Revoked, errExpected: true, caData: ca1Data},
+		{name: "failFalseUnknownCert", certStatus: ocsp.Unknown, errExpected: true, caData: ca1Data},
+		{name: "failTrueGoodCert", failOpen: true, certStatus: ocsp.Good, caData: ca1Data},
+		{name: "failTrueRevokedCert", failOpen: true, certStatus: ocsp.Revoked, errExpected: true, caData: ca1Data},
+		{name: "failTrueUnknownCert", failOpen: true, certStatus: ocsp.Unknown, caData: ca1Data},
+		{name: "failFalseGoodCertExtraCas", certStatus: ocsp.Good, caData: ca2Data, ocspCaCerts: string(pkf2)},
+		{name: "failFalseRevokedCertExtraCas", certStatus: ocsp.Revoked, errExpected: true, caData: ca2Data, ocspCaCerts: string(pkf2)},
+		{name: "failFalseUnknownCertExtraCas", certStatus: ocsp.Unknown, errExpected: true, caData: ca2Data, ocspCaCerts: string(pkf2)},
+		{name: "failTrueGoodCertExtraCas", failOpen: true, certStatus: ocsp.Good, caData: ca2Data, ocspCaCerts: string(pkf2)},
+		{name: "failTrueRevokedCertExtraCas", failOpen: true, certStatus: ocsp.Revoked, errExpected: true, caData: ca2Data, ocspCaCerts: string(pkf2)},
+		{name: "failTrueUnknownCertExtraCas", failOpen: true, certStatus: ocsp.Unknown, caData: ca2Data, ocspCaCerts: string(pkf2)},
+	}
+
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			resp, err := ocsp.CreateResponse(issuer[0], issuer[0], ocsp.Response{
+			resp, err := ocsp.CreateResponse(c.caData.caChain[0], c.caData.caChain[0], ocsp.Response{
 				Status:       c.certStatus,
 				SerialNumber: certTemplate.SerialNumber,
 				ProducedAt:   time.Now(),
 				ThisUpdate:   time.Now(),
 				NextUpdate:   time.Now().Add(time.Hour),
-			}, pk.PrivateKey)
+			}, c.caData.privateKey)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -351,18 +446,18 @@ func TestCert_RoleResolveOCSP(t *testing.T) {
 			var resolveStep logicaltest.TestStep
 			var loginStep logicaltest.TestStep
 			if c.errExpected {
-				loginStep = testAccStepLoginWithNameInvalid(t, connState, "web")
-				resolveStep = testAccStepResolveRoleOCSPFail(t, connState, "web")
+				loginStep = testAccStepLoginWithNameInvalid(t, c.caData.connState, "web")
+				resolveStep = testAccStepResolveRoleOCSPFail(t, c.caData.connState, "web")
 			} else {
-				loginStep = testAccStepLoginWithName(t, connState, "web")
-				resolveStep = testAccStepResolveRoleWithName(t, connState, "web")
+				loginStep = testAccStepLoginWithName(t, c.caData.connState, "web")
+				resolveStep = testAccStepResolveRoleWithName(t, c.caData.connState, "web")
 			}
 			logicaltest.Test(t, logicaltest.TestCase{
 				CredentialBackend: b,
 				Steps: []logicaltest.TestStep{
-					testAccStepCertWithExtraParams(t, "web", ca, "foo", allowed{dns: "example.com"}, false,
-						map[string]interface{}{"ocsp_enabled": true, "ocsp_fail_open": c.failOpen}),
-					testAccStepReadCertPolicy(t, "web", false, map[string]interface{}{"ocsp_enabled": true, "ocsp_fail_open": c.failOpen}),
+					testAccStepCertWithExtraParams(t, "web", c.caData.caBytes, "foo", allowed{dns: "example.com"}, false,
+						map[string]interface{}{"ocsp_enabled": true, "ocsp_fail_open": c.failOpen, "ocsp_ca_certificates": c.ocspCaCerts}),
+					testAccStepReadCertPolicy(t, "web", false, map[string]interface{}{"ocsp_enabled": true, "ocsp_fail_open": c.failOpen, "ocsp_ca_certificates": c.ocspCaCerts}),
 					loginStep,
 					resolveStep,
 				},
@@ -371,6 +466,44 @@ func TestCert_RoleResolveOCSP(t *testing.T) {
 	}
 }
 
-func serialFromBigInt(serial *big.Int) string {
-	return strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":"))
+// TestCert_MetadataOnFailure verifies that we return the cert metadata
+// in the response on failures if the configuration option is enabled.
+func TestCert_MetadataOnFailure(t *testing.T) {
+	certTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "example.com",
+		},
+		DNSNames:    []string{"example.com"},
+		IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
+		ExtKeyUsage: []x509.ExtKeyUsage{
+			x509.ExtKeyUsageServerAuth,
+			x509.ExtKeyUsageClientAuth,
+		},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageKeyAgreement,
+		SerialNumber: big.NewInt(mathrand.Int63()),
+		NotBefore:    time.Now().Add(-30 * time.Second),
+		NotAfter:     time.Now().Add(262980 * time.Hour),
+	}
+
+	tempDir, connState, err := generateTestCertAndConnState(t, certTemplate, nil)
+	if tempDir != "" {
+		defer os.RemoveAll(tempDir)
+	}
+	if err != nil {
+		t.Fatalf("error testing connection state: %v", err)
+	}
+	ca, err := ioutil.ReadFile(filepath.Join(tempDir, "ca_cert.pem"))
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	logicaltest.Test(t, logicaltest.TestCase{
+		CredentialBackend: testFactory(t),
+		Steps: []logicaltest.TestStep{
+			testStepEnableMetadataFailures(),
+			testAccStepCert(t, "web", ca, "foo", allowed{dns: "example.com"}, false),
+			testAccStepLoginWithName(t, connState, "web"),
+			testAccStepResolveRoleExpectRoleResolutionToFailWithData(t, connState, "notweb"),
+		},
+	})
 }
diff --git a/builtin/credential/cert/test-fixtures/keys/cert-alt-cn.pem b/builtin/credential/cert/test-fixtures/keys/cert-alt-cn.pem
new file mode 100644
index 00000000000..06975732de0
--- /dev/null
+++ b/builtin/credential/cert/test-fixtures/keys/cert-alt-cn.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDFjCCAf6gAwIBAgIJAJIiPq+77hewMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNV
+BAMTC2V4YW1wbGUuY29tMCAXDTI1MDYxODE5MzEzM1oYDzIwNTAwNjE5MTkzMTMz
+WjAWMRQwEgYDVQQDDAtub3RmYWtlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBALGcdEr6/NmCaRaSMuHyTVuXygOgfJocUk0QFZ8oAH7XrU/Kbh35
+WNLLO2Ol9jl47FND0Z/tT7MLYr4Sovni7YFpFBfXBWBRp0oDJXemVkYTYXmYQOmX
+0JnjPwRdqWuRytkgxd+pY4Iy/U/p1q67tlL9AQqB8ywJomGDIiFqZYnTJjDuTU0R
+t5PtwDdE5H2pAeiVc4yxoU3F3TnFRDF5HkFaiTALhqLlOXaJ8qrZ2h7iCRrlHcue
+GA51/OrcYTkIQL+q+3R182cUuKZi78PFCNa7En/xi3FFRgfufgABheYrhwtzdg05
+eMc9xXDeAm+MPaW2kO/pgs8/mp6oiX8q9p8CAwEAAaNlMGMwIQYDVR0RBBowGIIQ
+Y2VydC5leGFtcGxlLmNvbYcEfwAAATAdBgNVHQ4EFgQUmuMiWgeoyPlkEyXcJ7Og
+qJotlJkwHwYDVR0jBBgwFoAUncSzT/6HMexyuiU9/7EgHu+ok5swDQYJKoZIhvcN
+AQELBQADggEBANYE2poNMZakvN2a8hGbVHNXCR4+j5dE/nIw0ZW2PPv4CuNJ3whN
+G15MT790k9DiNNecJBP32jwAOedIWKr3aqasur4eXA8xhN1nbtJODWxXYaV3USs7
+C1Mu9DV3aRiyFhEv6Va6RL4gCnOqOZdXG1+dAkughBKrRNJAMo5Wop/VC8rkSssO
+NpQBt7ROIJjyTXrHQq23HR/uVv511AE5hDMDzxaVbsslBuzhD4nHOJ/Y/LWcXHJ1
+8W6S1vgSES2lo8U5tthSE4WyYW6kH6r2hBrK4ESdpdAUfO/lVNCe5KeYYWRwzMOw
+oj9OOxBsjSX5C368IWM4sAn08mYJUUmq3i4=
+-----END CERTIFICATE-----
diff --git a/builtin/credential/cert/test-fixtures/keys/cert.pem b/builtin/credential/cert/test-fixtures/keys/cert.pem
index 942d26698b1..5b7fa1aed06 100644
--- a/builtin/credential/cert/test-fixtures/keys/cert.pem
+++ b/builtin/credential/cert/test-fixtures/keys/cert.pem
@@ -1,22 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIIDtTCCAp2gAwIBAgIUf+jhKTFBnqSs34II0WS1L4QsbbAwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wHhcNMTYwMjI5MDIyNzQxWhcNMjUw
-MTA1MTAyODExWjAbMRkwFwYDVQQDExBjZXJ0LmV4YW1wbGUuY29tMIIBIjANBgkq
-hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsZx0Svr82YJpFpIy4fJNW5fKA6B8mhxS
-TRAVnygAftetT8puHflY0ss7Y6X2OXjsU0PRn+1PswtivhKi+eLtgWkUF9cFYFGn
-SgMld6ZWRhNheZhA6ZfQmeM/BF2pa5HK2SDF36ljgjL9T+nWrru2Uv0BCoHzLAmi
-YYMiIWplidMmMO5NTRG3k+3AN0TkfakB6JVzjLGhTcXdOcVEMXkeQVqJMAuGouU5
-donyqtnaHuIJGuUdy54YDnX86txhOQhAv6r7dHXzZxS4pmLvw8UI1rsSf/GLcUVG
-B+5+AAGF5iuHC3N2DTl4xz3FcN4Cb4w9pbaQ7+mCzz+anqiJfyr2nwIDAQABo4H1
-MIHyMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUm++e
-HpyM3p708bgZJuRYEdX1o+UwHwYDVR0jBBgwFoAUncSzT/6HMexyuiU9/7EgHu+o
-k5swOwYIKwYBBQUHAQEELzAtMCsGCCsGAQUFBzAChh9odHRwOi8vMTI3LjAuMC4x
-OjgyMDAvdjEvcGtpL2NhMCEGA1UdEQQaMBiCEGNlcnQuZXhhbXBsZS5jb22HBH8A
-AAEwMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovLzEyNy4wLjAuMTo4MjAwL3YxL3Br
-aS9jcmwwDQYJKoZIhvcNAQELBQADggEBABsuvmPSNjjKTVN6itWzdQy+SgMIrwfs
-X1Yb9Lefkkwmp9ovKFNQxa4DucuCuzXcQrbKwWTfHGgR8ct4rf30xCRoA7dbQWq4
-aYqNKFWrRaBRAaaYZ/O1ApRTOrXqRx9Eqr0H1BXLsoAq+mWassL8sf6siae+CpwA
-KqBko5G0dNXq5T4i2LQbmoQSVetIrCJEeMrU+idkuqfV2h1BQKgSEhFDABjFdTCN
-QDAHsEHsi2M4/jRW9fqEuhHSDfl2n7tkFUI8wTHUUCl7gXwweJ4qtaSXIwKXYzNj
-xqKHA8Purc1Yfybz4iE1JCROi9fInKlzr5xABq8nb9Qc/J9DIQM+Xmk=
+MIIC2zCCAcOgAwIBAgIJAJIiPq+77hewMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNV
+BAMTC2V4YW1wbGUuY29tMCAXDTI1MDEwNjE0MzgzMloYDzIwNTAwMTA3MTQzODMy
+WjAbMRkwFwYDVQQDExBjZXJ0LmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAsZx0Svr82YJpFpIy4fJNW5fKA6B8mhxSTRAVnygAftet
+T8puHflY0ss7Y6X2OXjsU0PRn+1PswtivhKi+eLtgWkUF9cFYFGnSgMld6ZWRhNh
+eZhA6ZfQmeM/BF2pa5HK2SDF36ljgjL9T+nWrru2Uv0BCoHzLAmiYYMiIWplidMm
+MO5NTRG3k+3AN0TkfakB6JVzjLGhTcXdOcVEMXkeQVqJMAuGouU5donyqtnaHuIJ
+GuUdy54YDnX86txhOQhAv6r7dHXzZxS4pmLvw8UI1rsSf/GLcUVGB+5+AAGF5iuH
+C3N2DTl4xz3FcN4Cb4w9pbaQ7+mCzz+anqiJfyr2nwIDAQABoyUwIzAhBgNVHREE
+GjAYghBjZXJ0LmV4YW1wbGUuY29thwR/AAABMA0GCSqGSIb3DQEBCwUAA4IBAQB/
+0M2jZ8cZJW23s1xpMDS5u2ScrW4QdpVsPbuBu5dxi3SNx7MK0CbvcNVUEZE0WV6b
+rCYvYS0+SBi0skudHRV7IeRADPcvzbXY/AdFktWt0adtQ/5B/DKeZIRrnhGtlzhD
+m8b3TTnKLoGdV7iS5HO8emvlzaihY/5PjObkztLRLLDRmBAOwYv4z/xBhEqZJRV1
+Ztywy/Qy5srNJug+sHmj8JlBldob/Ohk7Eon04XvXMuCIBptPG/QytnmgGbDGghD
+WO/HpCWBh6GHrwzQtof8y7Upxi16i5DSiFbRwNXgRyST4W/ChpZoggvOJ/RI4o2g
+5serAZLPfBGztdRbTef2
 -----END CERTIFICATE-----
diff --git a/builtin/credential/cert/test-fixtures/keys/rebuild-cert.md b/builtin/credential/cert/test-fixtures/keys/rebuild-cert.md
new file mode 100644
index 00000000000..6a69ff78e46
--- /dev/null
+++ b/builtin/credential/cert/test-fixtures/keys/rebuild-cert.md
@@ -0,0 +1,6 @@
+To rebuild the cert.pem within this folder run the following commands
+
+```shell
+$ openssl x509 -in cert.pem -signkey key.pem -x509toreq -out cert.csr
+$ openssl x509 -req -in cert.csr -CA ../root/rootcacert.pem -CAkey ../root/rootcakey.pem -CAcreateserial -out cert.pem -days 9132 -sha256 -extensions v3_req -extfile <(echo "[v3_req]\nsubjectAltName=DNS:cert.example.com,IP:127.0.0.1")
+```
diff --git a/builtin/credential/cert/test-fixtures/root/rootcawocert.pem b/builtin/credential/cert/test-fixtures/root/rootcawocert.pem
new file mode 100644
index 00000000000..14536c16ae6
--- /dev/null
+++ b/builtin/credential/cert/test-fixtures/root/rootcawocert.pem
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDYjCCAkqgAwIBAgIUM4ANPdEihcrpgryBFpBr3QCr2a4wDQYJKoZIhvcNAQEL
+BQAwKDEQMA4GA1UEChMHZXhhbXBsZTEUMBIGA1UEAxMLZXhhbXBsZS5jb20wIBcN
+MjUwOTE4MTcxMjUwWhgPMjEyNTA4MjUxNjEzMjBaMCgxEDAOBgNVBAoTB2V4YW1w
+bGUxFDASBgNVBAMTC2V4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEA45oJCYBM7SI4KwfAQHTRQnJt5PGap0s/ckdoozjulpDRE45OKT3Q
+Dbc6mYXgBXVCpcHjVweqptPUetoWUwpPppgmbj4/MvaPWFebskspE9i/W85m9SOk
+s1V8zD73Apf3m2l6v3VyZ1hGHaM1uLTcRj47qR+dF6naU76QWjIObKqFDBk24kDD
+Ktr6IEVF44GERqfson+u40NqQE/ZnqTk5jnBEWKf3Lp/NNlmrKb3EZ1jkPhCNE9N
+IsShs5qg+3y0PNut4wCE5WXaYCIIk7ydn8s3dJO6cMSkCZpAvyXz1Af0oSh+aqKH
+Y1+uudfu8sheRCRd4u0J+4Q27J9GpQeOrwIDAQABo4GBMH8wDgYDVR0PAQH/BAQD
+AgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFPTXC7WMp/TjZ2OyfotP13k6
+5MDCMB8GA1UdIwQYMBaAFPTXC7WMp/TjZ2OyfotP13k65MDCMBwGA1UdEQQVMBOC
+C2V4YW1wbGUuY29thwR/AAABMA0GCSqGSIb3DQEBCwUAA4IBAQAZ+sdJdmeZznMu
+W7LAt/yPhf1gIMReL3WTRi9zAxjOyJCmMOcqGbSWX+iYah5fm16ehmfaenZjli9e
+JEgfsD9PlZgopwrThFB6haW3O+9WpMAcQ4gbJTQMpV0M7wLcj3SNtnY3jaQ9AB5X
+ys0nc146wVaJgUZycvCkOwTDo6JZ0Z1F5qbNI82bUSZdkXC1MgyHI0uFfmSloXi/
+jTdv9o1zjsYEjckzqVuGzuGXT5zl96WBE4RofJhzRPRefccnYJQ3aitzuzxbl3J/
+FtiW3HYBupXfXr46gXncuWfB3MNDzxftf1OeDfYdT7Een5zV8PdIqoFOvIl51ZC1
+/lVyaDYd
+-----END CERTIFICATE-----
\ No newline at end of file
diff --git a/builtin/credential/cert/test-fixtures/root/rootcawokey.pem b/builtin/credential/cert/test-fixtures/root/rootcawokey.pem
new file mode 100644
index 00000000000..0bbe2bf4969
--- /dev/null
+++ b/builtin/credential/cert/test-fixtures/root/rootcawokey.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA45oJCYBM7SI4KwfAQHTRQnJt5PGap0s/ckdoozjulpDRE45O
+KT3QDbc6mYXgBXVCpcHjVweqptPUetoWUwpPppgmbj4/MvaPWFebskspE9i/W85m
+9SOks1V8zD73Apf3m2l6v3VyZ1hGHaM1uLTcRj47qR+dF6naU76QWjIObKqFDBk2
+4kDDKtr6IEVF44GERqfson+u40NqQE/ZnqTk5jnBEWKf3Lp/NNlmrKb3EZ1jkPhC
+NE9NIsShs5qg+3y0PNut4wCE5WXaYCIIk7ydn8s3dJO6cMSkCZpAvyXz1Af0oSh+
+aqKHY1+uudfu8sheRCRd4u0J+4Q27J9GpQeOrwIDAQABAoIBACR+Miy/0ZXEAtWD
+bKPpFxRcXJp00qM4QXgFUxW4ryidF6jXDFk4e/92/YJYIM8/Oexx5g2yQP52wH7i
+MOonoRXJF4Bdoqx9NAaqJWC1BGUWP7hso71ydZn7fwMQpXJZA257vx6rqig/0x41
+aQuwlBD/MXmwg/OjXEpJJ8QOepmZgEte2stFJOF1dxnWwRk3KDFsAIukYdxkzb/Z
+oaLDetDj678t71ab6EPToPDRAzu9zIzyP9KhbirPepLOTrwfEU552oSYs4THU0+z
+PJy/vMKuEa/M56a8WoyV5S+Q/t9VgTkUUgqpEsodXvsd3el7xOquuVTcQyRLTXqB
+SrP0rSECgYEA8oVNGgxMk9vTXbEFxWqLIEkDU8h3A9e0IS19VqBXEML5YKNAh5xh
+zar+xqlkIXWTqD0qFIgtE7ggB+Gu7Gb7lGrI1bj2tLAMlaEImqvT9ALtSzsiIK1L
+8KpNBdPkOlWlG2OA3fU0m0TynjtwOaxHGRVmf67BEG6v/wWk77q97lsCgYEA8EB1
+n0TaW2PTqCU9F2wwuoML8XEn0L0+J7rXJy+vC3rjr8asglxVNndXV3/Z+jtwupQN
+y1MIxUA2WghGr40N53UHnQzSjn3IKfi6Nqb/uKiW34KppcI0W3MrqhLEoytyhj+Q
+8UTryrajaiKvNgWo+J/8oAqFoNuCOFhwa0ByuT0CgYBS4WVpGnztJvoEEeRUBEZJ
+oUomzuKFiKkBkac8/IzkqI1LDl+WOMZf4CkzwV375U+x9j00SRmGnK0tpF4AYm1l
+2lyKVazSMTwLwr3LBh/oSzvHMw1Ft5O1Sq4J6NEdcnl7c7Ttpcf1rElx9AQ1YX/m
+vZ6K0jEeqYUyFT65wsr38wKBgQDVKhwyqEClfbk6I3BE6/WARu2914xgJMiVL63e
+UuyY3vxN5ZUCRTJGFTUlqYaaA0tOADcNBCtv+D1BPL6a3ChOCQQsUEgxrWB//PQb
+saiLCupyfdhP/jO+QD2ptOVLcS03+AZ+S4x6W/o6HXQgFn2Ju0nGJg/SXXD41V9J
+ifFAcQKBgH692iebaAhWHgEbYNlIdpwZh+hhraOVp6D+xi+2j0TbZi5gZtsBzzkK
+RTlU6rmgYgUOlURYM7uysFcddB2pgraSrFigQ6J7LHRpowaJxyHC9yQbQ4Y0UjgK
+Mrh68/EHSDhm1M0J+CwleLkYNfW+xE5TCABgvv5mLl1hIOa3tyYq
+-----END RSA PRIVATE KEY-----
\ No newline at end of file
diff --git a/builtin/credential/cert/test_responder.go b/builtin/credential/cert/test_responder.go
index 2052736d33c..16aa255e656 100644
--- a/builtin/credential/cert/test_responder.go
+++ b/builtin/credential/cert/test_responder.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Package ocsp implements an OCSP responder based on a generic storage backend.
@@ -19,7 +19,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
 	"time"
@@ -168,7 +168,7 @@ func (rs *Responder) ServeHTTP(response http.ResponseWriter, request *http.Reque
 			return
 		}
 	case "POST":
-		requestBody, err = ioutil.ReadAll(request.Body)
+		requestBody, err = io.ReadAll(request.Body)
 		if err != nil {
 			rs.log.Log("Problem reading body of POST", err)
 			response.WriteHeader(http.StatusBadRequest)
diff --git a/builtin/credential/github/backend.go b/builtin/credential/github/backend.go
index 6e80e7b313d..7f8026e6807 100644
--- a/builtin/credential/github/backend.go
+++ b/builtin/credential/github/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package github
diff --git a/builtin/credential/github/backend_test.go b/builtin/credential/github/backend_test.go
index 4f3dee07813..6b8cb426c94 100644
--- a/builtin/credential/github/backend_test.go
+++ b/builtin/credential/github/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package github
diff --git a/builtin/credential/github/cli.go b/builtin/credential/github/cli.go
index 177433bde49..90cb40e7790 100644
--- a/builtin/credential/github/cli.go
+++ b/builtin/credential/github/cli.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package github
diff --git a/builtin/credential/github/cmd/github/main.go b/builtin/credential/github/cmd/github/main.go
index 40a3a0002bf..5438af66b51 100644
--- a/builtin/credential/github/cmd/github/main.go
+++ b/builtin/credential/github/cmd/github/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/credential/github/path_config.go b/builtin/credential/github/path_config.go
index abe78760fc1..f871a2ff8f6 100644
--- a/builtin/credential/github/path_config.go
+++ b/builtin/credential/github/path_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package github
diff --git a/builtin/credential/github/path_config_test.go b/builtin/credential/github/path_config_test.go
index 19338ff44d2..48abf63c76c 100644
--- a/builtin/credential/github/path_config_test.go
+++ b/builtin/credential/github/path_config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package github
diff --git a/builtin/credential/github/path_login.go b/builtin/credential/github/path_login.go
index 181076a6587..b01967bd264 100644
--- a/builtin/credential/github/path_login.go
+++ b/builtin/credential/github/path_login.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package github
diff --git a/builtin/credential/github/path_login_test.go b/builtin/credential/github/path_login_test.go
index cfc47a98434..254257f5b05 100644
--- a/builtin/credential/github/path_login_test.go
+++ b/builtin/credential/github/path_login_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package github
diff --git a/builtin/credential/ldap/backend.go b/builtin/credential/ldap/backend.go
index a649bbbde49..39438911198 100644
--- a/builtin/credential/ldap/backend.go
+++ b/builtin/credential/ldap/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ldap
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"sync"
 
+	goldap "github.com/go-ldap/ldap/v3"
 	"github.com/hashicorp/cap/ldap"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/sdk/framework"
@@ -55,8 +56,9 @@ func Backend() *backend {
 			pathConfigRotateRoot(&b),
 		},
 
-		AuthRenew:   b.pathLoginRenew,
-		BackendType: logical.TypeCredential,
+		AuthRenew:        b.pathLoginRenew,
+		BackendType:      logical.TypeCredential,
+		RotateCredential: b.rotateRootCredential,
 	}
 
 	return &b
@@ -68,6 +70,14 @@ type backend struct {
 	mu sync.RWMutex
 }
 
+func (b *backend) maybeLogDebug(msg string, args ...interface{}) {
+	if b.Logger().IsDebug() {
+		b.Logger().Debug(msg, args...)
+	}
+}
+
+// Login authenticates a user against the LDAP server using the provided username and password.
+// It returns the effective username, policies associated with the user, a response containing
 func (b *backend) Login(ctx context.Context, req *logical.Request, username string, password string, usernameAsAlias bool) (string, []string, *logical.Response, []string, error) {
 	cfg, err := b.Config(ctx, req)
 	if err != nil {
@@ -83,6 +93,7 @@ func (b *backend) Login(ctx context.Context, req *logical.Request, username stri
 
 	ldapClient, err := ldap.NewClient(ctx, ldaputil.ConvertConfig(cfg.ConfigEntry))
 	if err != nil {
+		b.maybeLogDebug("error creating client", "error", err)
 		return "", nil, logical.ErrorResponse(err.Error()), nil, nil
 	}
 
@@ -93,12 +104,18 @@ func (b *backend) Login(ctx context.Context, req *logical.Request, username stri
 	if err != nil {
 		if strings.Contains(err.Error(), "discovery of user bind DN failed") ||
 			strings.Contains(err.Error(), "unable to bind user") {
+			b.maybeLogDebug("error getting user bind DN", username, "error", err)
 			return "", nil, logical.ErrorResponse(errUserBindFailed), nil, logical.ErrInvalidCredentials
 		}
 
 		return "", nil, logical.ErrorResponse(err.Error()), nil, nil
 	}
 
+	b.maybeLogDebug("user binddn fetched", "username", username, "binddn", c.UserDN)
+	if c.UserDN == "" {
+		return "", nil, logical.ErrorResponse("user bind DN is empty after authentication"), nil, nil
+	}
+
 	ldapGroups := c.Groups
 	ldapResponse := &logical.Response{
 		Data: map[string]interface{}{},
@@ -107,32 +124,60 @@ func (b *backend) Login(ctx context.Context, req *logical.Request, username stri
 		errString := fmt.Sprintf(
 			"no LDAP groups found in groupDN %q; only policies from locally-defined groups available",
 			cfg.GroupDN)
-		ldapResponse.AddWarning(errString)
+
+		b.maybeLogDebug(errString)
 	}
 
 	for _, warning := range c.Warnings {
-		ldapResponse.AddWarning(string(warning))
+		b.maybeLogDebug(string(warning))
 	}
 
-	var allGroups []string
 	canonicalUsername := username
-	cs := *cfg.CaseSensitiveNames
+	if usernameAsAlias {
+		// expect to get the username from UserDN in the case where we are setting the
+		// entity alias to be the username.
+		parsed, err := goldap.ParseDN(c.UserDN)
+		if err != nil {
+			b.Logger().Error("Invalid DN after authentication", "user_dn", c.UserDN, "error", err)
+			return "", nil, logical.ErrorResponse("invalid DN after authentication"), nil, nil
+		}
+
+		b.maybeLogDebug("User DN parsed", "parsed", parsed, "username", username)
+		var found bool
+		for _, rdn := range parsed.RDNs {
+			if found {
+				b.maybeLogDebug("Found canonical username", "canonicalUsername", canonicalUsername, "cfg.userAttr", cfg.UserAttr)
+				break
+			}
+			for _, attr := range rdn.Attributes {
+				b.maybeLogDebug("Handling RDN", "attr.Type", attr.Type, "attr.Value", attr.Value, "cfg.UserAttr", cfg.UserAttr)
+				if strings.EqualFold(attr.Type, cfg.UserAttr) {
+					b.maybeLogDebug("Found user attribute in RDN", "attr.Type", attr.Type, "attr.Value", attr.Value)
+					canonicalUsername = attr.Value
+					found = true
+					break
+				}
+			}
+		}
+	}
+
+	var allGroups []string
+
+	cs := cfg.CaseSensitiveNames != nil && *cfg.CaseSensitiveNames
 	if !cs {
-		canonicalUsername = strings.ToLower(username)
+		canonicalUsername = strings.ToLower(canonicalUsername)
 	}
+
 	// Import the custom added groups from ldap backend
 	user, err := b.User(ctx, req.Storage, canonicalUsername)
 	if err == nil && user != nil && user.Groups != nil {
-		if b.Logger().IsDebug() {
-			b.Logger().Debug("adding local groups", "num_local_groups", len(user.Groups), "local_groups", user.Groups)
-		}
 		allGroups = append(allGroups, user.Groups...)
 	}
 	// Merge local and LDAP groups
 	allGroups = append(allGroups, ldapGroups...)
 
 	canonicalGroups := allGroups
-	// If not case sensitive, lowercase all
+	// If not case-sensitive, lowercase all
 	if !cs {
 		canonicalGroups = make([]string, len(allGroups))
 		for i, v := range allGroups {
@@ -155,16 +200,23 @@ func (b *backend) Login(ctx context.Context, req *logical.Request, username stri
 	policies = strutil.RemoveDuplicates(policies, true)
 
 	if usernameAsAlias {
-		return username, policies, ldapResponse, allGroups, nil
+		b.maybeLogDebug("UsernameAlias is set", "canonicalUsername", canonicalUsername, "policies", policies, "groups", allGroups)
+		return canonicalUsername, policies, ldapResponse, allGroups, nil
 	}
 
 	userAttrValues := c.UserAttributes[cfg.UserAttr]
 	if len(userAttrValues) == 0 {
+		b.Logger().Error("missing entity alias attribute value")
 		return "", nil, logical.ErrorResponse("missing entity alias attribute value"), nil, nil
 	}
-	entityAliasAttribute := userAttrValues[0]
 
-	return entityAliasAttribute, policies, ldapResponse, allGroups, nil
+	effectiveUsername := userAttrValues[0]
+	if effectiveUsername == "" {
+		b.Logger().Error("empty entity alias attribute value")
+		return "", nil, logical.ErrorResponse("empty entity alias attribute value"), nil, nil
+	}
+
+	return effectiveUsername, policies, ldapResponse, allGroups, nil
 }
 
 const backendHelp = `
diff --git a/builtin/credential/ldap/backend_test.go b/builtin/credential/ldap/backend_test.go
index 0e4a0d1a315..eb92f546609 100644
--- a/builtin/credential/ldap/backend_test.go
+++ b/builtin/credential/ldap/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ldap
@@ -15,19 +15,39 @@ import (
 	"github.com/go-test/deep"
 	hclog "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/testhelpers/ldap"
 	logicaltest "github.com/hashicorp/vault/helper/testhelpers/logical"
+	"github.com/hashicorp/vault/sdk/helper/automatedrotationutil"
 	"github.com/hashicorp/vault/sdk/helper/ldaputil"
 	"github.com/hashicorp/vault/sdk/helper/policyutil"
 	"github.com/hashicorp/vault/sdk/helper/tokenutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/rotation"
 	"github.com/mitchellh/mapstructure"
 )
 
+type testSystemView struct {
+	logical.StaticSystemView
+}
+
+func (d testSystemView) RegisterRotationJob(_ context.Context, _ *rotation.RotationJobConfigureRequest) (string, error) {
+	return "", automatedrotationutil.ErrRotationManagerUnsupported
+}
+
+func (d testSystemView) DeregisterRotationJob(_ context.Context, _ *rotation.RotationJobDeregisterRequest) error {
+	return nil
+}
+
 func createBackendWithStorage(t *testing.T) (*backend, logical.Storage) {
+	sv := testSystemView{}
+	sv.MaxLeaseTTLVal = time.Hour * 2 * 24
+	sv.DefaultLeaseTTLVal = time.Minute
+
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
+	config.System = sv
 
 	b := Backend()
 	if b == nil {
@@ -136,28 +156,6 @@ func TestLdapAuthBackend_CaseSensitivity(t *testing.T) {
 	ctx := context.Background()
 
 	testVals := func(caseSensitive bool) {
-		// Clear storage
-		userList, err := storage.List(ctx, "user/")
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, user := range userList {
-			err = storage.Delete(ctx, "user/"+user)
-			if err != nil {
-				t.Fatal(err)
-			}
-		}
-		groupList, err := storage.List(ctx, "group/")
-		if err != nil {
-			t.Fatal(err)
-		}
-		for _, group := range groupList {
-			err = storage.Delete(ctx, "group/"+group)
-			if err != nil {
-				t.Fatal(err)
-			}
-		}
-
 		configReq := &logical.Request{
 			Path:      "config",
 			Operation: logical.ReadOperation,
@@ -265,9 +263,74 @@ func TestLdapAuthBackend_CaseSensitivity(t *testing.T) {
 		if !reflect.DeepEqual(expected, resp.Auth.Policies) {
 			t.Fatalf("bad: policies: expected: %q, actual: %q", expected, resp.Auth.Policies)
 		}
+
+		// Test proper deletion of users
+		userReqDel := &logical.Request{
+			Operation: logical.DeleteOperation,
+			Data: map[string]interface{}{
+				"groups":   "EngineerS",
+				"policies": "userpolicy",
+			},
+			Path:    "users/hermeS conRad",
+			Storage: storage,
+		}
+		resp, err = b.HandleRequest(ctx, userReqDel)
+		if err != nil || (resp != nil && resp.IsError()) {
+			t.Fatalf("err:%v resp:%#v", err, resp)
+		}
+		if caseSensitive {
+			// The online test server is actually case sensitive so we need to
+			// delete again so it works
+			userReq = &logical.Request{
+				Operation: logical.DeleteOperation,
+				Data: map[string]interface{}{
+					"groups":   "EngineerS",
+					"policies": "userpolicy",
+				},
+				Path:       "users/Hermes Conrad",
+				Storage:    storage,
+				Connection: &logical.Connection{},
+			}
+			resp, err = b.HandleRequest(ctx, userReq)
+			if err != nil || (resp != nil && resp.IsError()) {
+				t.Fatalf("err:%v resp:%#v", err, resp)
+			}
+		}
+
+		// Expect storage for user path to be cleared
+		userList, err := storage.List(ctx, "user/")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if userList != nil {
+			t.Fatalf("deletion of users failed")
+		}
+
+		// Test proper deletion of groups
+		groupReqDel := &logical.Request{
+			Operation: logical.DeleteOperation,
+			Data: map[string]interface{}{
+				"policies": "grouppolicy",
+			},
+			Path:    "groups/EngineerS",
+			Storage: storage,
+		}
+		resp, err = b.HandleRequest(ctx, groupReqDel)
+		if err != nil || (resp != nil && resp.IsError()) {
+			t.Fatalf("err:%v resp:%#v", err, resp)
+		}
+
+		// Expect storage for group path to be cleared
+		groupList, err := storage.List(ctx, "group/")
+		if err != nil {
+			t.Fatal(err)
+		}
+		if groupList != nil {
+			t.Fatalf("deletion of groups failed")
+		}
 	}
 
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 	configReq := &logical.Request{
 		Operation: logical.UpdateOperation,
@@ -313,7 +376,7 @@ func TestLdapAuthBackend_UserPolicies(t *testing.T) {
 	var err error
 	b, storage := createBackendWithStorage(t)
 
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 	configReq := &logical.Request{
 		Operation: logical.UpdateOperation,
@@ -402,15 +465,17 @@ func TestLdapAuthBackend_UserPolicies(t *testing.T) {
 func factory(t *testing.T) logical.Backend {
 	defaultLeaseTTLVal := time.Hour * 24
 	maxLeaseTTLVal := time.Hour * 24 * 32
+
+	sv := testSystemView{}
+	sv.DefaultLeaseTTLVal = defaultLeaseTTLVal
+	sv.MaxLeaseTTLVal = maxLeaseTTLVal
+
 	b, err := Factory(context.Background(), &logical.BackendConfig{
 		Logger: hclog.New(&hclog.LoggerOptions{
 			Name:  "FactoryLogger",
 			Level: hclog.Debug,
 		}),
-		System: &logical.StaticSystemView{
-			DefaultLeaseTTLVal: defaultLeaseTTLVal,
-			MaxLeaseTTLVal:     maxLeaseTTLVal,
-		},
+		System: sv,
 	})
 	if err != nil {
 		t.Fatalf("Unable to create backend: %s", err)
@@ -418,9 +483,77 @@ func factory(t *testing.T) logical.Backend {
 	return b
 }
 
+// TestBackend_LoginRegression_AnonBind is a test for the regression reported in
+// https://github.com/hashicorp/vault/issues/26183.
+func TestBackend_LoginRegression_AnonBind(t *testing.T) {
+	b := factory(t)
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
+	cfg.AnonymousGroupSearch = true
+	defer cleanup()
+
+	logicaltest.Test(t, logicaltest.TestCase{
+		CredentialBackend: b,
+		Steps: []logicaltest.TestStep{
+			testAccStepConfigUrl(t, cfg),
+			// Map Admin_staff group (from LDAP server) with foo policy
+			testAccStepGroup(t, "admin_staff", "foo"),
+
+			// Map engineers group (local) with bar policy
+			testAccStepGroup(t, "engineers", "bar"),
+
+			// Map hermes conrad user with local engineers group
+			testAccStepUser(t, "hermes conrad", "engineers"),
+
+			// Authenticate
+			testAccStepLogin(t, "hermes conrad", "hermes"),
+
+			// Verify both groups mappings can be listed back
+			testAccStepGroupList(t, []string{"engineers", "admin_staff"}),
+
+			// Verify user mapping can be listed back
+			testAccStepUserList(t, []string{"hermes conrad"}),
+		},
+	})
+}
+
+// TestBackend_LoginRegression_UserAttr is a test for the regression reported in
+// https://github.com/hashicorp/vault/issues/26171.
+// Vault relies on case insensitive user attribute keys for mapping user
+// attributes to entity alias metadata.
+func TestBackend_LoginRegression_UserAttr(t *testing.T) {
+	b := factory(t)
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
+	cfg.UserAttr = "givenName"
+	defer cleanup()
+
+	logicaltest.Test(t, logicaltest.TestCase{
+		CredentialBackend: b,
+		Steps: []logicaltest.TestStep{
+			testAccStepConfigUrl(t, cfg),
+			// Map Admin_staff group (from LDAP server) with foo policy
+			testAccStepGroup(t, "admin_staff", "foo"),
+
+			// Map engineers group (local) with bar policy
+			testAccStepGroup(t, "engineers", "bar"),
+
+			// Map hermes conrad user with local engineers group
+			testAccStepUser(t, "hermes", "engineers"),
+
+			// Authenticate
+			testAccStepLogin(t, "hermes", "hermes"),
+
+			// Verify both groups mappings can be listed back
+			testAccStepGroupList(t, []string{"engineers", "admin_staff"}),
+
+			// Verify user mapping can be listed back
+			testAccStepUserList(t, []string{"hermes"}),
+		},
+	})
+}
+
 func TestBackend_basic(t *testing.T) {
 	b := factory(t)
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 
 	logicaltest.Test(t, logicaltest.TestCase{
@@ -450,7 +583,7 @@ func TestBackend_basic(t *testing.T) {
 
 func TestBackend_basic_noPolicies(t *testing.T) {
 	b := factory(t)
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 
 	logicaltest.Test(t, logicaltest.TestCase{
@@ -468,7 +601,7 @@ func TestBackend_basic_noPolicies(t *testing.T) {
 
 func TestBackend_basic_group_noPolicies(t *testing.T) {
 	b := factory(t)
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 
 	logicaltest.Test(t, logicaltest.TestCase{
@@ -489,7 +622,7 @@ func TestBackend_basic_group_noPolicies(t *testing.T) {
 
 func TestBackend_basic_authbind(t *testing.T) {
 	b := factory(t)
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 
 	logicaltest.Test(t, logicaltest.TestCase{
@@ -506,7 +639,7 @@ func TestBackend_basic_authbind(t *testing.T) {
 
 func TestBackend_basic_authbind_userfilter(t *testing.T) {
 	b := factory(t)
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 
 	// userattr not used in the userfilter should result in a warning in the response
@@ -649,7 +782,7 @@ func TestBackend_basic_authbind_userfilter(t *testing.T) {
 
 func TestBackend_basic_authbind_metadata_name(t *testing.T) {
 	b := factory(t)
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 
 	cfg.UserAttr = "cn"
@@ -714,7 +847,7 @@ func addUPNAttributeToLDAPSchemaAndUser(t *testing.T, cfg *ldaputil.ConfigEntry,
 
 func TestBackend_basic_discover(t *testing.T) {
 	b := factory(t)
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 
 	logicaltest.Test(t, logicaltest.TestCase{
@@ -731,7 +864,7 @@ func TestBackend_basic_discover(t *testing.T) {
 
 func TestBackend_basic_nogroupdn(t *testing.T) {
 	b := factory(t)
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 
 	logicaltest.Test(t, logicaltest.TestCase{
@@ -816,24 +949,140 @@ func TestBackend_configDefaultsAfterUpdate(t *testing.T) {
 	})
 }
 
+// TestLdapAuthBackend_AliasLookaheadDefault will test the alias lookahead functionality
+// for the LDAP auth backend with a default configuration (i.e. case insensitive if the flag is
+// not set or is set to false).
+func TestLdapAuthBackend_AliasLookaheadDefault(t *testing.T) {
+	// create config and storage
+	b, storage := createBackendWithStorage(t)
+
+	// Create user "testuser"
+	resp, err := b.HandleRequest(namespace.RootContext(nil), &logical.Request{
+		Path:      "users/testuser",
+		Operation: logical.UpdateOperation,
+		Storage:   storage,
+		Data: map[string]interface{}{
+			"policies": []string{"default"},
+			"groups":   "testgroup,nested/testgroup",
+		},
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: resp: %#v\nerr: %v", resp, err)
+	}
+
+	// List users
+	resp, err = b.HandleRequest(namespace.RootContext(nil), &logical.Request{
+		Path:      "users/",
+		Operation: logical.ListOperation,
+		Storage:   storage,
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: resp: %#v\nerr: %v", resp, err)
+	}
+	expected := []string{"testuser"}
+	if !reflect.DeepEqual(expected, resp.Data["keys"].([]string)) {
+		t.Fatalf("bad: listed users; expected: %#v actual: %#v", expected, resp.Data["keys"].([]string))
+	}
+
+	resp, err = b.HandleRequest(context.Background(), &logical.Request{
+		Operation: logical.AliasLookaheadOperation,
+		Storage:   storage,
+		Path:      "login/testuser",
+		Data: map[string]interface{}{
+			"Raw": map[string]interface{}{
+				"username": "testuser",
+			},
+		},
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: resp: %#v\nerr: %v", resp, err)
+	}
+	if resp.Auth.Alias.Name != "testuser" {
+		t.Fatalf("bad: alias lookahead did not return expected alias name; expected: 'testuser', actual: '%s'", resp.Auth.Alias.Name)
+	}
+}
+
+// TestLdapAuthBackend_AliasLookaheadCaseSensitive will test the alias lookahead functionality
+// for the LDAP auth backend when a case sensitive configuration flag is set
+func TestLdapAuthBackend_AliasLookaheadCaseSensitive(t *testing.T) {
+	// create config and storage
+	b, storage := createBackendWithStorage(t)
+
+	// make the backend case sensitive
+	resp, err := b.HandleRequest(namespace.RootContext(nil), &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "config",
+		Data: map[string]interface{}{
+			"case_sensitive_names": true,
+		},
+		Storage: storage,
+	})
+
+	// Create user "teSTuser"
+	resp, err = b.HandleRequest(namespace.RootContext(nil), &logical.Request{
+		Path:      "users/teSTuser",
+		Operation: logical.UpdateOperation,
+		Storage:   storage,
+		Data: map[string]interface{}{
+			"policies": []string{"default"},
+			"groups":   "testgroup,nested/testgroup",
+		},
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: resp: %#v\nerr: %v", resp, err)
+	}
+
+	// List users
+	resp, err = b.HandleRequest(namespace.RootContext(nil), &logical.Request{
+		Path:      "users/",
+		Operation: logical.ListOperation,
+		Storage:   storage,
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: resp: %#v\nerr: %v", resp, err)
+	}
+	expected := []string{"teSTuser"}
+	if !reflect.DeepEqual(expected, resp.Data["keys"].([]string)) {
+		t.Fatalf("bad: listed users; expected: %#v actual: %#v", expected, resp.Data["keys"].([]string))
+	}
+
+	resp, err = b.HandleRequest(context.Background(), &logical.Request{
+		Operation: logical.AliasLookaheadOperation,
+		Storage:   storage,
+		Path:      "login/teSTuser",
+		Data: map[string]interface{}{
+			"Raw": map[string]interface{}{
+				"username": "teSTuser",
+			},
+		},
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: resp: %#v\nerr: %v", resp, err)
+	}
+	if resp.Auth.Alias.Name != "teSTuser" {
+		t.Fatalf("bad: alias lookahead did not return expected alias name; expected: 'teSTuser', actual: '%s'", resp.Auth.Alias.Name)
+	}
+}
+
 func testAccStepConfigUrl(t *testing.T, cfg *ldaputil.ConfigEntry) logicaltest.TestStep {
 	return logicaltest.TestStep{
 		Operation: logical.UpdateOperation,
 		Path:      "config",
 		Data: map[string]interface{}{
-			"url":                  cfg.Url,
-			"userattr":             cfg.UserAttr,
-			"userdn":               cfg.UserDN,
-			"userfilter":           cfg.UserFilter,
-			"groupdn":              cfg.GroupDN,
-			"groupattr":            cfg.GroupAttr,
-			"binddn":               cfg.BindDN,
-			"bindpass":             cfg.BindPassword,
-			"case_sensitive_names": true,
-			"token_policies":       "abc,xyz",
-			"request_timeout":      cfg.RequestTimeout,
-			"connection_timeout":   cfg.ConnectionTimeout,
-			"username_as_alias":    cfg.UsernameAsAlias,
+			"url":                    cfg.Url,
+			"userattr":               cfg.UserAttr,
+			"userdn":                 cfg.UserDN,
+			"userfilter":             cfg.UserFilter,
+			"groupdn":                cfg.GroupDN,
+			"groupattr":              cfg.GroupAttr,
+			"binddn":                 cfg.BindDN,
+			"bindpass":               cfg.BindPassword,
+			"anonymous_group_search": cfg.AnonymousGroupSearch,
+			"case_sensitive_names":   true,
+			"token_policies":         "abc,xyz",
+			"request_timeout":        cfg.RequestTimeout,
+			"connection_timeout":     cfg.ConnectionTimeout,
+			"username_as_alias":      cfg.UsernameAsAlias,
 		},
 	}
 }
@@ -1114,8 +1363,8 @@ func testAccStepLoginNoGroupDN(t *testing.T, user string, pass string) logicalte
 
 		// Verifies a search without defined GroupDN returns a warning rather than failing
 		Check: func(resp *logical.Response) error {
-			if len(resp.Warnings) != 1 {
-				return fmt.Errorf("expected a warning due to no group dn, got: %#v", resp.Warnings)
+			if len(resp.Warnings) != 0 {
+				return fmt.Errorf("expected a no warnings, got: %#v", resp.Warnings)
 			}
 
 			return logicaltest.TestCheckAuth([]string{"bar", "default"})(resp)
@@ -1180,7 +1429,7 @@ func TestLdapAuthBackend_ConfigUpgrade(t *testing.T) {
 
 	ctx := context.Background()
 
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 	configReq := &logical.Request{
 		Operation: logical.UpdateOperation,
@@ -1246,6 +1495,9 @@ func TestLdapAuthBackend_ConfigUpgrade(t *testing.T) {
 			MaximumPageSize:          1000,
 		},
 	}
+	if constants.IsEnterprise {
+		exp.TokenParams.AliasMetadata = make(map[string]string)
+	}
 
 	configEntry, err := b.Config(ctx, configReq)
 	if err != nil {
diff --git a/builtin/credential/ldap/cli.go b/builtin/credential/ldap/cli.go
index f7f4a63156d..48981d3c416 100644
--- a/builtin/credential/ldap/cli.go
+++ b/builtin/credential/ldap/cli.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ldap
diff --git a/builtin/credential/ldap/cmd/ldap/main.go b/builtin/credential/ldap/cmd/ldap/main.go
index 8594cc527e7..f3ee8aa140a 100644
--- a/builtin/credential/ldap/cmd/ldap/main.go
+++ b/builtin/credential/ldap/cmd/ldap/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/credential/ldap/path_config.go b/builtin/credential/ldap/path_config.go
index e24d04b295c..27619c24820 100644
--- a/builtin/credential/ldap/path_config.go
+++ b/builtin/credential/ldap/path_config.go
@@ -1,21 +1,28 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ldap
 
 import (
 	"context"
+	"fmt"
 	"strings"
 
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/automatedrotationutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/ldaputil"
 	"github.com/hashicorp/vault/sdk/helper/tokenutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/rotation"
 )
 
 const userFilterWarning = "userfilter configured does not consider userattr and may result in colliding entity aliases on logins"
 
+const rootRotationJobName = "ldap-auth-root-creds"
+
+const rootRotationUrlKey = "rotation_url"
+
 func pathConfig(b *backend) *framework.Path {
 	p := &framework.Path{
 		Pattern: `config`,
@@ -39,6 +46,8 @@ func pathConfig(b *backend) *framework.Path {
 				DisplayAttrs: &framework.DisplayAttributes{
 					OperationVerb: "configure-auth",
 				},
+				ForwardPerformanceSecondary: true,
+				ForwardPerformanceStandby:   true,
 			},
 		},
 
@@ -54,6 +63,15 @@ func pathConfig(b *backend) *framework.Path {
 		Description: "Password policy to use to rotate the root password",
 	}
 
+	automatedrotationutil.AddAutomatedRotationFields(p.Fields)
+
+	p.Fields[rootRotationUrlKey] = &framework.FieldSchema{
+		Type:        framework.TypeString,
+		Description: "LDAP URL to connect to for password rotation if it is different from the configured LDAP URL",
+		Default:     "",
+		Required:    false,
+	}
+
 	return p
 }
 
@@ -137,7 +155,10 @@ func (b *backend) pathConfigRead(ctx context.Context, req *logical.Request, d *f
 
 	data := cfg.PasswordlessMap()
 	cfg.PopulateTokenData(data)
+	cfg.PopulateAutomatedRotationData(data)
+
 	data["password_policy"] = cfg.PasswordPolicy
+	data[rootRotationUrlKey] = cfg.RotationUrl
 
 	resp := &logical.Response{
 		Data: data,
@@ -207,16 +228,70 @@ func (b *backend) pathConfigWrite(ctx context.Context, req *logical.Request, d *
 		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
 	}
 
+	if err := cfg.ParseAutomatedRotationFields(d); err != nil {
+		return nil, err
+	}
+
 	if passwordPolicy, ok := d.GetOk("password_policy"); ok {
 		cfg.PasswordPolicy = passwordPolicy.(string)
 	}
+	if rotationUrl, ok := d.GetOk(rootRotationUrlKey); ok {
+		cfg.RotationUrl = rotationUrl.(string)
+	}
+
+	var rotOp string
+	if cfg.ShouldDeregisterRotationJob() {
+		rotOp = rotation.PerformedDeregistration
+		dr := &rotation.RotationJobDeregisterRequest{
+			MountPoint: req.MountPoint,
+			ReqPath:    req.Path,
+		}
+
+		err := b.System().DeregisterRotationJob(ctx, dr)
+		if err != nil {
+			return logical.ErrorResponse("error de-registering rotation job: %s", err), nil
+		}
+	} else if cfg.ShouldRegisterRotationJob() {
+		rotOp = rotation.PerformedRegistration
+		// Now that the root config is set up, register the rotation job if it's required.
+		r := &rotation.RotationJobConfigureRequest{
+			Name:             rootRotationJobName,
+			MountPoint:       req.MountPoint,
+			ReqPath:          req.Path,
+			RotationSchedule: cfg.RotationSchedule,
+			RotationWindow:   cfg.RotationWindow,
+			RotationPeriod:   cfg.RotationPeriod,
+		}
+
+		b.Logger().Debug("registering rotation job", "mount", r.MountPoint, "path", r.ReqPath)
+		_, err = b.System().RegisterRotationJob(ctx, r)
+		if err != nil {
+			return logical.ErrorResponse("error registering rotation job: %s", err), nil
+		}
+	}
+
+	wrapRotationError := func(innerError error) error {
+		b.Logger().Error("write to storage failed but the rotation manager still succeeded.",
+			"operation", rotOp, "mount", req.MountPoint, "path", req.Path)
+		wrappedError := fmt.Errorf("write to storage failed, but the rotation manager still succeeded: "+
+			"operation=%s, mount=%s, path=%s, storageError=%s", rotOp, req.MountPoint, req.Path, err)
+		return wrappedError
+	}
 
 	entry, err := logical.StorageEntryJSON("config", cfg)
 	if err != nil {
-		return nil, err
+		var wrappedError error
+		if rotOp != "" {
+			wrappedError = wrapRotationError(err)
+		}
+		return nil, wrappedError
 	}
 	if err := req.Storage.Put(ctx, entry); err != nil {
-		return nil, err
+		var wrappedError error
+		if rotOp != "" {
+			wrappedError = wrapRotationError(err)
+		}
+		return nil, wrappedError
 	}
 
 	if warnings := b.checkConfigUserFilter(cfg); len(warnings) > 0 {
@@ -251,8 +326,10 @@ func (b *backend) getConfigFieldData() (*framework.FieldData, error) {
 type ldapConfigEntry struct {
 	tokenutil.TokenParams
 	*ldaputil.ConfigEntry
+	automatedrotationutil.AutomatedRotationParams
 
 	PasswordPolicy string `json:"password_policy"`
+	RotationUrl    string `json:"rotation_url"`
 }
 
 const pathConfigHelpSyn = `
diff --git a/builtin/credential/ldap/path_config_rotate_root.go b/builtin/credential/ldap/path_config_rotate_root.go
index e095bc35036..fb7e90fa0a6 100644
--- a/builtin/credential/ldap/path_config_rotate_root.go
+++ b/builtin/credential/ldap/path_config_rotate_root.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-2.0
 
 package ldap
 
 import (
 	"context"
+	"errors"
 
 	"github.com/go-ldap/ldap/v3"
 	"github.com/hashicorp/vault/sdk/framework"
@@ -36,22 +37,50 @@ func pathConfigRotateRoot(b *backend) *framework.Path {
 	}
 }
 
-func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
+	err := b.rotateRootCredential(ctx, req)
+	if err != nil {
+		// log here instead of inside the actual rotate call because the rotation manager also logs, so this is
+		// the "equivalent" place for manual rotations.
+		b.Logger().Error("failed to rotate root credential on user request", "path", req.Path, "error", err.Error())
+	} else {
+		// err is nil in this case
+		b.Logger().Info("succesfully rotated root credential on user request", "path", req.Path)
+	}
+	var responseError responseError
+	if errors.As(err, &responseError) {
+		return logical.ErrorResponse(responseError.Error()), nil
+	}
+
+	// naturally this is `nil, nil` if the err is nil
+	return nil, err
+}
+
+// responseError exists to capture the cases in the old rotate call that returned specific error responses
+type responseError struct {
+	error
+}
+
+func (b *backend) rotateRootCredential(ctx context.Context, req *logical.Request) error {
 	// lock the backend's state - really just the config state - for mutating
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
 	cfg, err := b.Config(ctx, req)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	if cfg == nil {
-		return logical.ErrorResponse("attempted to rotate root on an undefined config"), nil
+		return responseError{errors.New("attempted to rotate root on an undefined config")}
 	}
 
 	u, p := cfg.BindDN, cfg.BindPassword
 	if u == "" || p == "" {
-		return logical.ErrorResponse("auth is not using authenticated search, no root to rotate"), nil
+		// Logging this is as it may be useful to know that the binddn/bindpass is not set.
+		if b.Logger().IsDebug() {
+			b.Logger().Debug("auth is not using authenticated search, no root to rotate")
+		}
+		return responseError{errors.New("auth is not using authenticated search, no root to rotate")}
 	}
 
 	// grab our ldap client
@@ -60,14 +89,19 @@ func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.R
 		LDAP:   ldaputil.NewLDAP(),
 	}
 
-	conn, err := client.DialLDAP(cfg.ConfigEntry)
+	// Create a copy of the config to modify for rotation
+	rotateConfig := *cfg.ConfigEntry
+	if cfg.RotationUrl != "" {
+		rotateConfig.Url = cfg.RotationUrl
+	}
+	conn, err := client.DialLDAP(&rotateConfig)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	err = conn.Bind(u, p)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	lreq := &ldap.ModifyRequest{
@@ -81,27 +115,27 @@ func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.R
 		newPassword, err = base62.Random(defaultPasswordLength)
 	}
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	lreq.Replace("userPassword", []string{newPassword})
 
 	err = conn.Modify(lreq)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	// update config with new password
 	cfg.BindPassword = newPassword
 	entry, err := logical.StorageEntryJSON("config", cfg)
 	if err != nil {
-		return nil, err
+		return err
 	}
 	if err := req.Storage.Put(ctx, entry); err != nil {
 		// we might have to roll-back the password here?
-		return nil, err
+		return err
 	}
 
-	return nil, nil
+	return nil
 }
 
 const pathConfigRotateRootHelpSyn = `
diff --git a/builtin/credential/ldap/path_config_rotate_root_test.go b/builtin/credential/ldap/path_config_rotate_root_test.go
index 65073472ca0..c4790eca874 100644
--- a/builtin/credential/ldap/path_config_rotate_root_test.go
+++ b/builtin/credential/ldap/path_config_rotate_root_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-2.0
 
 package ldap
@@ -22,7 +22,7 @@ func TestRotateRoot(t *testing.T) {
 	ctx := context.Background()
 
 	b, store := createBackendWithStorage(t)
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 	// set up auth config
 	req := &logical.Request{
@@ -64,3 +64,63 @@ func TestRotateRoot(t *testing.T) {
 		t.Fatalf("the password should have changed, but it didn't")
 	}
 }
+
+// TestRotateRootWithRotationUrl relies on a docker ldap server with a suitable person object (cn=admin,dc=planetexpress,dc=com)
+// with bindpassword "admin". `PrepareTestContainer` does this for us. - see the backend_test for more details
+// It checks that rotation url is being used instead of the main URL and assures that setting rotation url does't
+// replace main URL
+func TestRotateRootWithRotationUrl(t *testing.T) {
+	if os.Getenv(logicaltest.TestEnvVar) == "" {
+		t.Skip("skipping rotate root tests because VAULT_ACC is unset")
+	}
+	ctx := context.Background()
+
+	b, store := createBackendWithStorage(t)
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
+	defer cleanup()
+	const mainDummyUrl = "ldap://example.com:389"
+	// set up auth config
+	req := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "config",
+		Storage:   store,
+		Data: map[string]interface{}{
+			"url":          mainDummyUrl,
+			"binddn":       cfg.BindDN,
+			"bindpass":     cfg.BindPassword,
+			"userdn":       cfg.UserDN,
+			"rotation_url": cfg.Url,
+		},
+	}
+
+	resp, err := b.HandleRequest(ctx, req)
+	if err != nil {
+		t.Fatalf("failed to initialize ldap auth config: %s", err)
+	}
+	if resp != nil && resp.IsError() {
+		t.Fatalf("failed to initialize ldap auth config: %s", resp.Data["error"])
+	}
+
+	req = &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "config/rotate-root",
+		Storage:   store,
+	}
+
+	_, err = b.HandleRequest(ctx, req)
+	if err != nil {
+		t.Fatalf("failed to rotate password: %s", err)
+	}
+
+	newCFG, err := b.Config(ctx, req)
+	if newCFG.BindDN != cfg.BindDN {
+		t.Fatalf("BindDN %q changed unexpectedly, found new value %q", cfg.BindDN, newCFG.BindDN)
+	}
+	if newCFG.BindPassword == cfg.BindPassword {
+		t.Fatalf("the password should have changed, but it didn't")
+	}
+	// expecting the newCFG url to be "ldap://example.com:389"
+	if newCFG.Url != mainDummyUrl {
+		t.Fatalf("URL %q changed unexpectedly, found new value %q", mainDummyUrl, newCFG.Url)
+	}
+}
diff --git a/builtin/credential/ldap/path_groups.go b/builtin/credential/ldap/path_groups.go
index 645b6428fd8..33331dec049 100644
--- a/builtin/credential/ldap/path_groups.go
+++ b/builtin/credential/ldap/path_groups.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ldap
@@ -87,7 +87,20 @@ func (b *backend) Group(ctx context.Context, s logical.Storage, n string) (*Grou
 }
 
 func (b *backend) pathGroupDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	err := req.Storage.Delete(ctx, "group/"+d.Get("name").(string))
+	groupname := d.Get("name").(string)
+
+	cfg, err := b.Config(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	if cfg == nil {
+		return logical.ErrorResponse("ldap backend not configured"), nil
+	}
+	if !*cfg.CaseSensitiveNames {
+		groupname = strings.ToLower(groupname)
+	}
+
+	err = req.Storage.Delete(ctx, "group/"+groupname)
 	if err != nil {
 		return nil, err
 	}
diff --git a/builtin/credential/ldap/path_login.go b/builtin/credential/ldap/path_login.go
index a1c28dea02b..3768cb92769 100644
--- a/builtin/credential/ldap/path_login.go
+++ b/builtin/credential/ldap/path_login.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ldap
@@ -6,6 +6,7 @@ package ldap
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/cidrutil"
@@ -50,6 +51,16 @@ func (b *backend) pathLoginAliasLookahead(ctx context.Context, req *logical.Requ
 		return nil, fmt.Errorf("missing username")
 	}
 
+	cfg, err := b.Config(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+
+	caseSensitive := cfg != nil && cfg.CaseSensitiveNames != nil && *cfg.CaseSensitiveNames
+	// if the username is not configured to be case-sensitive, we normalize it to lower case.
+	if !caseSensitive {
+		username = strings.ToLower(username)
+	}
 	return &logical.Response{
 		Auth: &logical.Auth{
 			Alias: &logical.Alias{
@@ -83,8 +94,16 @@ func (b *backend) pathLogin(ctx context.Context, req *logical.Request, d *framew
 	password := d.Get("password").(string)
 
 	effectiveUsername, policies, resp, groupNames, err := b.Login(ctx, req, username, password, cfg.UsernameAsAlias)
-	if err != nil || (resp != nil && resp.IsError()) {
-		return resp, err
+	if err != nil {
+		return nil, err
+	}
+
+	if resp != nil {
+		if resp.IsError() {
+			return nil, resp.Error()
+		}
+	} else {
+		return nil, fmt.Errorf("login response is nil, this should not happen")
 	}
 
 	auth := &logical.Auth{
@@ -98,7 +117,16 @@ func (b *backend) pathLogin(ctx context.Context, req *logical.Request, d *framew
 		Alias: &logical.Alias{
 			Name: effectiveUsername,
 			Metadata: map[string]string{
+				// Should be the same as raw username, but we store it here for posterity.
 				"name": username,
+				// We store the original username in the metadata so that we can
+				// reference it later if needed, such as in the alias lookahead.
+				// This is useful for cases where the username is transformed or
+				// normalized (e.g., lowercased) for authentication purposes.
+				"rawUsername": username,
+				// The effective username is the one that will be used for policies and aliases.
+				// This may differ from the raw username if transformations are applied.
+				"effectiveUsername": effectiveUsername,
 			},
 		},
 	}
diff --git a/builtin/credential/ldap/path_users.go b/builtin/credential/ldap/path_users.go
index 55326f64086..37a3b88671c 100644
--- a/builtin/credential/ldap/path_users.go
+++ b/builtin/credential/ldap/path_users.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ldap
@@ -96,7 +96,20 @@ func (b *backend) User(ctx context.Context, s logical.Storage, n string) (*UserE
 }
 
 func (b *backend) pathUserDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	err := req.Storage.Delete(ctx, "user/"+d.Get("name").(string))
+	username := d.Get("name").(string)
+
+	cfg, err := b.Config(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	if cfg == nil {
+		return logical.ErrorResponse("ldap backend not configured"), nil
+	}
+	if !*cfg.CaseSensitiveNames {
+		username = strings.ToLower(username)
+	}
+
+	err = req.Storage.Delete(ctx, "user/"+username)
 	if err != nil {
 		return nil, err
 	}
diff --git a/builtin/credential/okta/backend.go b/builtin/credential/okta/backend.go
index 96507f7879c..6f641860903 100644
--- a/builtin/credential/okta/backend.go
+++ b/builtin/credential/okta/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package okta
@@ -13,7 +13,7 @@ import (
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/cidrutil"
 	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/okta/okta-sdk-golang/v2/okta"
+	"github.com/okta/okta-sdk-golang/v5/okta"
 	"github.com/patrickmn/go-cache"
 )
 
@@ -118,6 +118,7 @@ func (b *backend) Login(ctx context.Context, req *logical.Request, username, pas
 		StateToken   string         `json:"stateToken"`
 	}
 
+	// The okta-sdk-golang API says to construct your own requests for auth, and the Request Executor is gone, so
 	authReq, err := shim.NewRequest("POST", "authn", map[string]interface{}{
 		"username": username,
 		"password": password,
@@ -129,9 +130,6 @@ func (b *backend) Login(ctx context.Context, req *logical.Request, username, pas
 	var result authResult
 	rsp, err := shim.Do(authReq, &result)
 	if err != nil {
-		if oe, ok := err.(*okta.Error); ok {
-			return nil, logical.ErrorResponse("Okta auth failed: %v (code=%v)", err, oe.ErrorCode), nil, nil
-		}
 		return nil, logical.ErrorResponse(fmt.Sprintf("Okta auth failed: %v", err)), nil, nil
 	}
 	if rsp == nil {
@@ -370,23 +368,23 @@ func (b *backend) Login(ctx context.Context, req *logical.Request, username, pas
 	return policies, oktaResponse, allGroups, nil
 }
 
-func (b *backend) getOktaGroups(ctx context.Context, client *okta.Client, user *okta.User) ([]string, error) {
-	groups, resp, err := client.User.ListUserGroups(ctx, user.Id)
+func (b *backend) getOktaGroups(ctx context.Context, client *okta.APIClient, user *okta.User) ([]string, error) {
+	groups, resp, err := client.UserAPI.ListUserGroups(ctx, user.GetId()).Execute()
 	if err != nil {
 		return nil, err
 	}
 	oktaGroups := make([]string, 0, len(groups))
 	for _, group := range groups {
-		oktaGroups = append(oktaGroups, group.Profile.Name)
+		oktaGroups = append(oktaGroups, group.Profile.GetName())
 	}
 	for resp.HasNextPage() {
 		var nextGroups []*okta.Group
-		resp, err = resp.Next(ctx, &nextGroups)
+		resp, err = resp.Next(&nextGroups)
 		if err != nil {
 			return nil, err
 		}
 		for _, group := range nextGroups {
-			oktaGroups = append(oktaGroups, group.Profile.Name)
+			oktaGroups = append(oktaGroups, group.Profile.GetName())
 		}
 	}
 	if b.Logger().IsDebug() {
diff --git a/builtin/credential/okta/backend_test.go b/builtin/credential/okta/backend_test.go
index b347524656a..4dcdc95ac98 100644
--- a/builtin/credential/okta/backend_test.go
+++ b/builtin/credential/okta/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package okta
@@ -17,8 +17,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/helper/policyutil"
 	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/okta/okta-sdk-golang/v2/okta"
-	"github.com/okta/okta-sdk-golang/v2/okta/query"
+	"github.com/okta/okta-sdk-golang/v5/okta"
 	"github.com/stretchr/testify/require"
 )
 
@@ -115,15 +114,15 @@ func TestBackend_Config(t *testing.T) {
 
 func createOktaGroups(t *testing.T, username string, token string, org string) []string {
 	orgURL := "https://" + org + "." + previewBaseURL
-	ctx, client, err := okta.NewClient(context.Background(), okta.WithOrgUrl(orgURL), okta.WithToken(token))
+	cfg, err := okta.NewConfiguration(okta.WithOrgUrl(orgURL), okta.WithToken(token))
 	require.Nil(t, err)
+	client := okta.NewAPIClient(cfg)
+	ctx := context.Background()
 
-	users, _, err := client.User.ListUsers(ctx, &query.Params{
-		Q: username,
-	})
+	users, _, err := client.UserAPI.ListUsers(ctx).Q(username).Execute()
 	require.Nil(t, err)
 	require.Len(t, users, 1)
-	userID := users[0].Id
+	userID := users[0].GetId()
 	var groupIDs []string
 
 	// Verify that login's call to list the groups of the user logging in will page
@@ -133,26 +132,24 @@ func createOktaGroups(t *testing.T, username string, token string, org string) [
 	// only 200 results are returned for most orgs."
 	for i := 0; i < 201; i++ {
 		name := fmt.Sprintf("TestGroup%d", i)
-		groups, _, err := client.Group.ListGroups(ctx, &query.Params{
-			Q: name,
-		})
+		groups, _, err := client.GroupAPI.ListGroups(ctx).Q(name).Execute()
 		require.Nil(t, err)
 
 		var groupID string
 		if len(groups) == 0 {
-			group, _, err := client.Group.CreateGroup(ctx, okta.Group{
+			group, _, err := client.GroupAPI.CreateGroup(ctx).Group(okta.Group{
 				Profile: &okta.GroupProfile{
-					Name: fmt.Sprintf("TestGroup%d", i),
+					Name: okta.PtrString(fmt.Sprintf("TestGroup%d", i)),
 				},
-			})
+			}).Execute()
 			require.Nil(t, err)
-			groupID = group.Id
+			groupID = group.GetId()
 		} else {
-			groupID = groups[0].Id
+			groupID = groups[0].GetId()
 		}
 		groupIDs = append(groupIDs, groupID)
 
-		_, err = client.Group.AddUserToGroup(ctx, groupID, userID)
+		_, err = client.GroupAPI.AssignUserToGroup(ctx, groupID, userID).Execute()
 		require.Nil(t, err)
 	}
 	return groupIDs
@@ -160,11 +157,12 @@ func createOktaGroups(t *testing.T, username string, token string, org string) [
 
 func deleteOktaGroups(t *testing.T, token string, org string, groupIDs []string) {
 	orgURL := "https://" + org + "." + previewBaseURL
-	ctx, client, err := okta.NewClient(context.Background(), okta.WithOrgUrl(orgURL), okta.WithToken(token))
+	cfg, err := okta.NewConfiguration(okta.WithOrgUrl(orgURL), okta.WithToken(token))
 	require.Nil(t, err)
+	client := okta.NewAPIClient(cfg)
 
 	for _, groupID := range groupIDs {
-		_, err := client.Group.DeleteGroup(ctx, groupID)
+		_, err := client.GroupAPI.DeleteGroup(context.Background(), groupID).Execute()
 		require.Nil(t, err)
 	}
 }
diff --git a/builtin/credential/okta/cli.go b/builtin/credential/okta/cli.go
index faa7f86f2fa..01b7c90a072 100644
--- a/builtin/credential/okta/cli.go
+++ b/builtin/credential/okta/cli.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package okta
diff --git a/builtin/credential/okta/cmd/okta/main.go b/builtin/credential/okta/cmd/okta/main.go
index 2b6c3e9496d..d6600828631 100644
--- a/builtin/credential/okta/cmd/okta/main.go
+++ b/builtin/credential/okta/cmd/okta/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/credential/okta/path_config.go b/builtin/credential/okta/path_config.go
index 6bdb241b2d2..39afe3bdf3f 100644
--- a/builtin/credential/okta/path_config.go
+++ b/builtin/credential/okta/path_config.go
@@ -1,11 +1,14 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package okta
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"net/url"
 	"strings"
@@ -16,7 +19,8 @@ import (
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/tokenutil"
 	"github.com/hashicorp/vault/sdk/logical"
-	oktanew "github.com/okta/okta-sdk-golang/v2/okta"
+	oktanew "github.com/okta/okta-sdk-golang/v5/okta"
+	gocache "github.com/patrickmn/go-cache"
 )
 
 const (
@@ -290,17 +294,19 @@ func (b *backend) pathConfigExistenceCheck(ctx context.Context, req *logical.Req
 }
 
 type oktaShim interface {
-	Client() (*oktanew.Client, context.Context)
+	Client() (*oktanew.APIClient, context.Context)
 	NewRequest(method string, url string, body interface{}) (*http.Request, error)
 	Do(req *http.Request, v interface{}) (interface{}, error)
 }
 
 type oktaShimNew struct {
-	client *oktanew.Client
+	cfg    *oktanew.Configuration
+	client *oktanew.APIClient
 	ctx    context.Context
+	cache  *gocache.Cache // cache used to hold authorization values created for NewRequests
 }
 
-func (new *oktaShimNew) Client() (*oktanew.Client, context.Context) {
+func (new *oktaShimNew) Client() (*oktanew.APIClient, context.Context) {
 	return new.client, new.ctx
 }
 
@@ -308,18 +314,113 @@ func (new *oktaShimNew) NewRequest(method string, url string, body interface{})
 	if !strings.HasPrefix(url, "/") {
 		url = "/api/v1/" + url
 	}
-	return new.client.GetRequestExecutor().NewRequest(method, url, body)
+
+	// reimplementation of RequestExecutor.NewRequest() in v2 of okta-golang-sdk
+	var buff io.ReadWriter
+	if body != nil {
+		switch v := body.(type) {
+		case []byte:
+			buff = bytes.NewBuffer(v)
+		case *bytes.Buffer:
+			buff = v
+		default:
+			buff = &bytes.Buffer{}
+			// need to create an encoder specifically to disable html escaping
+			encoder := json.NewEncoder(buff)
+			encoder.SetEscapeHTML(false)
+			err := encoder.Encode(body)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	url = new.cfg.Okta.Client.OrgUrl + url
+	req, err := http.NewRequest(method, url, buff)
+	if err != nil {
+		return nil, err
+	}
+
+	// construct an authorization header for the request using our okta config
+	var auth oktanew.Authorization
+	// I think the only usage of the shim is in credential/okta/backend.go, and in that case, the
+	// AuthorizationMode is only ever SSWS (since OktaClient() below never overrides the default authorization
+	// mode. This function will faithfully replicate the old RequestExecutor code, though.
+	switch new.cfg.Okta.Client.AuthorizationMode {
+	case "SSWS":
+		auth = oktanew.NewSSWSAuth(new.cfg.Okta.Client.Token, req)
+	case "Bearer":
+		auth = oktanew.NewBearerAuth(new.cfg.Okta.Client.Token, req)
+	case "PrivateKey":
+		auth = oktanew.NewPrivateKeyAuth(oktanew.PrivateKeyAuthConfig{
+			TokenCache:       new.cache,
+			HttpClient:       new.cfg.HTTPClient,
+			PrivateKeySigner: new.cfg.PrivateKeySigner,
+			PrivateKey:       new.cfg.Okta.Client.PrivateKey,
+			PrivateKeyId:     new.cfg.Okta.Client.PrivateKeyId,
+			ClientId:         new.cfg.Okta.Client.ClientId,
+			OrgURL:           new.cfg.Okta.Client.OrgUrl,
+			Scopes:           new.cfg.Okta.Client.Scopes,
+			MaxRetries:       new.cfg.Okta.Client.RateLimit.MaxRetries,
+			MaxBackoff:       new.cfg.Okta.Client.RateLimit.MaxBackoff,
+			Req:              req,
+		})
+	case "JWT":
+		auth = oktanew.NewJWTAuth(oktanew.JWTAuthConfig{
+			TokenCache:      new.cache,
+			HttpClient:      new.cfg.HTTPClient,
+			OrgURL:          new.cfg.Okta.Client.OrgUrl,
+			Scopes:          new.cfg.Okta.Client.Scopes,
+			ClientAssertion: new.cfg.Okta.Client.ClientAssertion,
+			MaxRetries:      new.cfg.Okta.Client.RateLimit.MaxRetries,
+			MaxBackoff:      new.cfg.Okta.Client.RateLimit.MaxBackoff,
+			Req:             req,
+		})
+	default:
+		return nil, fmt.Errorf("unknown authorization mode %v", new.cfg.Okta.Client.AuthorizationMode)
+	}
+
+	// Authorize adds a header based on the contents of the Authorization struct
+	err = auth.Authorize("POST", url)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Add("Accept", "application/json")
+
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	return req, nil
 }
 
 func (new *oktaShimNew) Do(req *http.Request, v interface{}) (interface{}, error) {
-	return new.client.GetRequestExecutor().Do(new.ctx, req, v)
+	resp, err := new.cfg.HTTPClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp.Body == nil {
+		return nil, nil
+	}
+	defer resp.Body.Close()
+
+	bt, err := io.ReadAll(resp.Body)
+	err = json.Unmarshal(bt, v)
+	if err != nil {
+		return nil, err
+	}
+
+	// as far as i can tell, we only use the first return to check if it is nil, and assume that means an error happened.
+	return resp, nil
 }
 
 type oktaShimOld struct {
 	client *oktaold.Client
 }
 
-func (new *oktaShimOld) Client() (*oktanew.Client, context.Context) {
+func (new *oktaShimOld) Client() (*oktanew.APIClient, context.Context) {
 	return nil, nil
 }
 
@@ -331,7 +432,25 @@ func (new *oktaShimOld) Do(req *http.Request, v interface{}) (interface{}, error
 	return new.client.Do(req, v)
 }
 
-// OktaClient creates a basic okta client connection
+func (c *ConfigEntry) OktaConfiguration(ctx context.Context) (*oktanew.Configuration, error) {
+	baseURL := defaultBaseURL
+	if c.Production != nil {
+		if !*c.Production {
+			baseURL = previewBaseURL
+		}
+	}
+	if c.BaseURL != "" {
+		baseURL = c.BaseURL
+	}
+
+	cfg, err := oktanew.NewConfiguration(oktanew.WithOrgUrl("https://"+c.Org+"."+baseURL), oktanew.WithToken(c.Token))
+	if err != nil {
+		return nil, err
+	}
+	return cfg, nil
+}
+
+// OktaClient returns an OktaShim, based on the presence of a token in the ConfigEntry.
 func (c *ConfigEntry) OktaClient(ctx context.Context) (oktaShim, error) {
 	baseURL := defaultBaseURL
 	if c.Production != nil {
@@ -344,13 +463,18 @@ func (c *ConfigEntry) OktaClient(ctx context.Context) (oktaShim, error) {
 	}
 
 	if c.Token != "" {
-		ctx, client, err := oktanew.NewClient(ctx,
+		cfg, err := oktanew.NewConfiguration(
 			oktanew.WithOrgUrl("https://"+c.Org+"."+baseURL),
 			oktanew.WithToken(c.Token))
 		if err != nil {
 			return nil, err
 		}
-		return &oktaShimNew{client, ctx}, nil
+		return &oktaShimNew{
+			cfg:    cfg,
+			client: oktanew.NewAPIClient(cfg),
+			ctx:    ctx,
+			cache:  gocache.New(gocache.DefaultExpiration, 1*time.Second),
+		}, nil
 	}
 	client, err := oktaold.NewClientWithDomain(cleanhttp.DefaultClient(), c.Org, baseURL, "")
 	if err != nil {
diff --git a/builtin/credential/okta/path_groups.go b/builtin/credential/okta/path_groups.go
index 9ae9826d309..0ca603fa6f8 100644
--- a/builtin/credential/okta/path_groups.go
+++ b/builtin/credential/okta/path_groups.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package okta
diff --git a/builtin/credential/okta/path_groups_test.go b/builtin/credential/okta/path_groups_test.go
index f8fac1d2fed..03c8b6efe78 100644
--- a/builtin/credential/okta/path_groups_test.go
+++ b/builtin/credential/okta/path_groups_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package okta
diff --git a/builtin/credential/okta/path_login.go b/builtin/credential/okta/path_login.go
index 5b86545d20e..f51266c5da4 100644
--- a/builtin/credential/okta/path_login.go
+++ b/builtin/credential/okta/path_login.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package okta
diff --git a/builtin/credential/okta/path_users.go b/builtin/credential/okta/path_users.go
index d66a5ed463e..5ccc115091b 100644
--- a/builtin/credential/okta/path_users.go
+++ b/builtin/credential/okta/path_users.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package okta
diff --git a/builtin/credential/radius/backend.go b/builtin/credential/radius/backend.go
index 40e680ebcc2..0c3674e577a 100644
--- a/builtin/credential/radius/backend.go
+++ b/builtin/credential/radius/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package radius
diff --git a/builtin/credential/radius/backend_test.go b/builtin/credential/radius/backend_test.go
index 3c885008422..f7d0a1f0a15 100644
--- a/builtin/credential/radius/backend_test.go
+++ b/builtin/credential/radius/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package radius
@@ -185,7 +185,8 @@ func TestBackend_users(t *testing.T) {
 			testStepUpdateUser(t, "web", "foo"),
 			testStepUpdateUser(t, "web2", "foo"),
 			testStepUpdateUser(t, "web3", "foo"),
-			testStepUserList(t, []string{"web", "web2", "web3"}),
+			testStepUpdateUser(t, "Web4", "foo"),
+			testStepUserList(t, []string{"Web4", "web", "web2", "web3"}),
 		},
 	})
 }
diff --git a/builtin/credential/radius/cmd/radius/main.go b/builtin/credential/radius/cmd/radius/main.go
index 9adc5bfc78d..ec0a6db147f 100644
--- a/builtin/credential/radius/cmd/radius/main.go
+++ b/builtin/credential/radius/cmd/radius/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/credential/radius/path_config.go b/builtin/credential/radius/path_config.go
index 1ed33ede6c1..02922db0f93 100644
--- a/builtin/credential/radius/path_config.go
+++ b/builtin/credential/radius/path_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package radius
diff --git a/builtin/credential/radius/path_login.go b/builtin/credential/radius/path_login.go
index b38e90cdf2a..dd59476b741 100644
--- a/builtin/credential/radius/path_login.go
+++ b/builtin/credential/radius/path_login.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package radius
diff --git a/builtin/credential/radius/path_users.go b/builtin/credential/radius/path_users.go
index 21ebd262f0d..0070392a92c 100644
--- a/builtin/credential/radius/path_users.go
+++ b/builtin/credential/radius/path_users.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package radius
@@ -6,7 +6,6 @@ package radius
 import (
 	"context"
 	"fmt"
-	"strings"
 
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/policyutil"
@@ -87,7 +86,7 @@ func (b *backend) user(ctx context.Context, s logical.Storage, username string)
 		return nil, fmt.Errorf("missing username")
 	}
 
-	entry, err := s.Get(ctx, "user/"+strings.ToLower(username))
+	entry, err := s.Get(ctx, "user/"+username)
 	if err != nil {
 		return nil, err
 	}
diff --git a/builtin/credential/token/cli.go b/builtin/credential/token/cli.go
index f3ecd97058c..bc29e5f37db 100644
--- a/builtin/credential/token/cli.go
+++ b/builtin/credential/token/cli.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package token
diff --git a/builtin/credential/userpass/backend.go b/builtin/credential/userpass/backend.go
index e361f08ca48..8705a126f40 100644
--- a/builtin/credential/userpass/backend.go
+++ b/builtin/credential/userpass/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package userpass
diff --git a/builtin/credential/userpass/backend_test.go b/builtin/credential/userpass/backend_test.go
index 7280667c8a7..0acc4ebc0d8 100644
--- a/builtin/credential/userpass/backend_test.go
+++ b/builtin/credential/userpass/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package userpass
@@ -8,11 +8,12 @@ import (
 	"crypto/tls"
 	"fmt"
 	"reflect"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/go-test/deep"
-	sockaddr "github.com/hashicorp/go-sockaddr"
+	"github.com/hashicorp/go-sockaddr"
 	logicaltest "github.com/hashicorp/vault/helper/testhelpers/logical"
 	"github.com/hashicorp/vault/sdk/helper/policyutil"
 	"github.com/hashicorp/vault/sdk/helper/tokenutil"
@@ -201,6 +202,35 @@ func TestBackend_userCreateOperation(t *testing.T) {
 	})
 }
 
+// TestBackend_userCreateOperationCheckCase will test the alias lookahead functionality
+// for the userpass auth method to ensure the alias returned is always lowercase due to
+// the effective case insensitivity of the auth method
+func TestBackend_userCreateOperationCheckCase(t *testing.T) {
+	b, err := Factory(context.Background(), &logical.BackendConfig{
+		Logger: nil,
+		System: &logical.StaticSystemView{
+			DefaultLeaseTTLVal: testSysTTL,
+			MaxLeaseTTLVal:     testSysMaxTTL,
+		},
+	})
+	if err != nil {
+		t.Fatalf("Unable to create backend: %s", err)
+	}
+
+	logicaltest.Test(t, logicaltest.TestCase{
+		CredentialBackend: b,
+		Steps: []logicaltest.TestStep{
+			testUserCreateOperation(t, "web", "password", "foo"),
+			testAccStepLogin(t, "web", "password", []string{"default", "foo"}),
+			testAccStepLoginAlias(t, "web", "password"),
+			testAccStepLogin(t, "WEb", "password", []string{"default", "foo"}),
+			testAccStepLoginAlias(t, "wEb", "password"),
+			testAccStepLogin(t, "WEb", "password", []string{"default", "foo"}),
+			testAccStepLoginAlias(t, "WEb", "password"),
+		},
+	})
+}
+
 func TestBackend_passwordUpdate(t *testing.T) {
 	b, err := Factory(context.Background(), &logical.BackendConfig{
 		Logger: nil,
@@ -302,6 +332,30 @@ func testAccStepLogin(t *testing.T, user string, pass string, policies []string)
 	}
 }
 
+// userpass is case insentive, so we need to ensure that the alias lookahead returns all lowercase username
+// even if the username is provided in a different case.
+func testAccStepLoginAlias(t *testing.T, user string, pass string) logicaltest.TestStep {
+	return logicaltest.TestStep{
+		Operation: logical.AliasLookaheadOperation,
+		Path:      "login/" + user,
+		Data: map[string]interface{}{
+			"Raw": map[string]interface{}{
+				"username": user,
+			},
+		},
+		Check: func(resp *logical.Response) error {
+			if resp.Auth.Alias.Name != strings.ToLower(user) {
+				return fmt.Errorf("expected alias name to be '%s', got: %s", strings.ToLower(user), resp.Auth.Alias.Name)
+			}
+			if resp.IsError() {
+				return fmt.Errorf("bad: %#v", resp)
+			}
+			return nil
+		},
+		ConnState: &tls.ConnectionState{},
+	}
+}
+
 func testUserCreateOperation(
 	t *testing.T, name string, password string, policies string,
 ) logicaltest.TestStep {
diff --git a/builtin/credential/userpass/cli.go b/builtin/credential/userpass/cli.go
index ab1f138e780..952171931c4 100644
--- a/builtin/credential/userpass/cli.go
+++ b/builtin/credential/userpass/cli.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package userpass
diff --git a/builtin/credential/userpass/cmd/userpass/main.go b/builtin/credential/userpass/cmd/userpass/main.go
index d8dfed7f5e1..708c147f6df 100644
--- a/builtin/credential/userpass/cmd/userpass/main.go
+++ b/builtin/credential/userpass/cmd/userpass/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/credential/userpass/path_login.go b/builtin/credential/userpass/path_login.go
index b53953ee837..93589aacdb6 100644
--- a/builtin/credential/userpass/path_login.go
+++ b/builtin/credential/userpass/path_login.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package userpass
@@ -47,10 +47,10 @@ func pathLogin(b *backend) *framework.Path {
 	}
 }
 
-func (b *backend) pathLoginAliasLookahead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	username := d.Get("username").(string)
-	if username == "" {
-		return nil, fmt.Errorf("missing username")
+func (b *backend) pathLoginAliasLookahead(_ context.Context, _ *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	username, err := b.getUsername(d)
+	if err != nil {
+		return nil, err
 	}
 
 	return &logical.Response{
@@ -62,12 +62,25 @@ func (b *backend) pathLoginAliasLookahead(ctx context.Context, req *logical.Requ
 	}, nil
 }
 
+// getUsername retrieves the username from the field data, ensuring it is not
+// empty. The username is always returned in lowercase.
+func (b *backend) getUsername(d *framework.FieldData) (string, error) {
+	username := d.Get("username").(string)
+	if username == "" {
+		return "", fmt.Errorf("missing username")
+	}
+	return strings.ToLower(username), nil
+}
+
 func (b *backend) pathLogin(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	username := strings.ToLower(d.Get("username").(string))
+	username, err := b.getUsername(d)
+	if err != nil {
+		return nil, err
+	}
 
 	password := d.Get("password").(string)
 	if password == "" {
-		return nil, fmt.Errorf("missing password")
+		return nil, logical.ErrInvalidCredentials
 	}
 
 	// Get the user and validate auth
@@ -89,7 +102,7 @@ func (b *backend) pathLogin(ctx context.Context, req *logical.Request, d *framew
 	} else {
 		// This is still acceptable as bcrypt will still make sure it takes
 		// a long time, it's just nicer to be random if possible
-		userPassword = []byte("dummy")
+		userPassword = []byte("$2a$10$/rzAjBPX3APZv8DesvsjB.OKdMif2xomluDfaxQ.OZcF06EuECsVG")
 	}
 
 	// Check for a password match. Check for a hash collision for Vault 0.2+,
diff --git a/builtin/credential/userpass/path_user_password.go b/builtin/credential/userpass/path_user_password.go
index 1f2a9c670f5..0f742c110dd 100644
--- a/builtin/credential/userpass/path_user_password.go
+++ b/builtin/credential/userpass/path_user_password.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package userpass
@@ -6,15 +6,37 @@ package userpass
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 	"golang.org/x/crypto/bcrypt"
 )
 
+const (
+	pathUserPasswordHelpDesc = `
+This endpoint allows resetting the user's password.
+`
+	pathUserPasswordHelpSyn = `
+Reset user's password.
+`
+
+	// The name of the username parameter supplied via the API.
+	paramUsername = "username"
+
+	// The name of the password parameter supplied via the API.
+	paramPassword = "password"
+
+	// The name of the password hash parameter supplied via the API.
+	paramPasswordHash = "password_hash"
+
+	// The expected length of any hash generated by bcrypt.
+	bcryptHashLength = 60
+)
+
 func pathUserPassword(b *backend) *framework.Path {
 	return &framework.Path{
-		Pattern: "users/" + framework.GenericNameRegex("username") + "/password$",
+		Pattern: "users/" + framework.GenericNameRegex(paramUsername) + "/password$",
 
 		DisplayAttrs: &framework.DisplayAttributes{
 			OperationPrefix: operationPrefixUserpass,
@@ -23,15 +45,20 @@ func pathUserPassword(b *backend) *framework.Path {
 		},
 
 		Fields: map[string]*framework.FieldSchema{
-			"username": {
+			paramUsername: {
 				Type:        framework.TypeString,
 				Description: "Username for this user.",
 			},
 
-			"password": {
+			paramPassword: {
 				Type:        framework.TypeString,
 				Description: "Password for this user.",
 			},
+
+			paramPasswordHash: {
+				Type:        framework.TypeString,
+				Description: "Pre-hashed password in bcrypt format for this user.",
+			},
 		},
 
 		Callbacks: map[logical.Operation]framework.OperationFunc{
@@ -44,7 +71,7 @@ func pathUserPassword(b *backend) *framework.Path {
 }
 
 func (b *backend) pathUserPasswordUpdate(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	username := d.Get("username").(string)
+	username := d.Get(paramUsername).(string)
 
 	userEntry, err := b.user(ctx, req.Storage, username)
 	if err != nil {
@@ -56,7 +83,7 @@ func (b *backend) pathUserPasswordUpdate(ctx context.Context, req *logical.Reque
 
 	userErr, intErr := b.updateUserPassword(req, d, userEntry)
 	if intErr != nil {
-		return nil, err
+		return nil, intErr
 	}
 	if userErr != nil {
 		return logical.ErrorResponse(userErr.Error()), logical.ErrInvalidRequest
@@ -65,24 +92,51 @@ func (b *backend) pathUserPasswordUpdate(ctx context.Context, req *logical.Reque
 	return nil, b.setUser(ctx, req.Storage, username, userEntry)
 }
 
-func (b *backend) updateUserPassword(req *logical.Request, d *framework.FieldData, userEntry *UserEntry) (error, error) {
-	password := d.Get("password").(string)
-	if password == "" {
-		return fmt.Errorf("missing password"), nil
+func (b *backend) updateUserPassword(_ *logical.Request, d *framework.FieldData, userEntry *UserEntry) (error, error) {
+	password := d.Get(paramPassword).(string)
+	passwordHash := d.Get(paramPasswordHash).(string)
+
+	var hash []byte
+	var err error
+
+	switch {
+	case password != "" && passwordHash != "":
+		return fmt.Errorf("%q and %q cannot be supplied together", paramPassword, paramPasswordHash), nil
+	case password == "" && passwordHash == "":
+		return fmt.Errorf("%q or %q must be supplied", paramPassword, paramPasswordHash), nil
+	case password != "":
+		hash, err = bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	case passwordHash != "":
+		hash, err = parsePasswordHash(passwordHash)
 	}
-	// Generate a hash of the password
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+
 	if err != nil {
 		return nil, err
 	}
+
 	userEntry.PasswordHash = hash
+
 	return nil, nil
 }
 
-const pathUserPasswordHelpSyn = `
-Reset user's password.
-`
+// parsePasswordHash is used to parse a password hash that follows the bcrypt standard.
+// It examines the prefix of the string supplied to verify it complies with a supported
+// version before returning the string in bytes.
+func parsePasswordHash(passwordHash string) ([]byte, error) {
+	var res []byte
+
+	switch {
+	// All bcrypt hashes should be the same length.
+	case len(passwordHash) != bcryptHashLength:
+		return nil, fmt.Errorf("password hash has incorrect length")
+	// See: https://en.wikipedia.org/wiki/Bcrypt for versioning history.
+	case strings.HasPrefix(passwordHash, "$2a$"), // $2a% (non-ASCII character support)
+		strings.HasPrefix(passwordHash, "$2y$"), // $2y$ (PHP fixed)
+		strings.HasPrefix(passwordHash, "$2b$"): // $2b$ (truncation fix)
+		res = []byte(passwordHash)
+	default:
+		return nil, fmt.Errorf("password hash has incorrect prefix")
+	}
 
-const pathUserPasswordHelpDesc = `
-This endpoint allows resetting the user's password.
-`
+	return res, nil
+}
diff --git a/builtin/credential/userpass/path_user_password_test.go b/builtin/credential/userpass/path_user_password_test.go
new file mode 100644
index 00000000000..73d08572426
--- /dev/null
+++ b/builtin/credential/userpass/path_user_password_test.go
@@ -0,0 +1,92 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package userpass
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// TestUserPass_ParseHash ensures that we correctly validate password hashes that
+// conform to the bcrypt standard based on the prefix of the hash.
+func TestUserPass_ParseHash(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		input                string
+		isErrorExpected      bool
+		expectedErrorMessage string
+	}{
+		"too-short": {
+			input:                "too short",
+			isErrorExpected:      true,
+			expectedErrorMessage: "password hash has incorrect length",
+		},
+		"60-spaces": {
+			input:                "                                                            ",
+			isErrorExpected:      true,
+			expectedErrorMessage: "password hash has incorrect prefix",
+		},
+		"jibberish": {
+			input:                "jibberfishjibberfishjibberfishjibberfishjibberfishjibberfish",
+			isErrorExpected:      true,
+			expectedErrorMessage: "password hash has incorrect prefix",
+		},
+		"non-ascii-prefix": {
+			input:           "$2a$qwertyjibberfishjibberfishjibberfishjibberfishjibberfish",
+			isErrorExpected: false,
+		},
+		"truncation-prefix": {
+			input:           "$2b$qwertyjibberfishjibberfishjibberfishjibberfishjibberfish",
+			isErrorExpected: false,
+		},
+		"php-only-fixed-prefix": {
+			input:           "$2y$qwertyjibberfishjibberfishjibberfishjibberfishjibberfish",
+			isErrorExpected: false,
+		},
+		"php-only-existing": {
+			input:                "$2x$qwertyjibberfishjibberfishjibberfishjibberfishjibberfish",
+			isErrorExpected:      true,
+			expectedErrorMessage: "password hash has incorrect prefix",
+		},
+	}
+
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := parsePasswordHash(tc.input)
+			switch {
+			case tc.isErrorExpected:
+				require.EqualError(t, err, tc.expectedErrorMessage)
+			default:
+				require.NoError(t, err)
+				require.Equal(t, tc.input, string(got))
+			}
+		})
+	}
+}
+
+// TestUserPass_BcryptHashLength ensures that using the bcrypt library to generate
+// a hash from a password always produces the same length.
+func TestUserPass_BcryptHashLength(t *testing.T) {
+	t.Parallel()
+
+	tests := []string{
+		"",
+		"    ",
+		"foo",
+		"this is a long password woo",
+	}
+
+	for _, input := range tests {
+		hash, err := bcrypt.GenerateFromPassword([]byte(input), bcrypt.DefaultCost)
+		require.NoError(t, err)
+		require.Len(t, hash, bcryptHashLength)
+	}
+}
diff --git a/builtin/credential/userpass/path_user_policies.go b/builtin/credential/userpass/path_user_policies.go
index 1dd9b9675de..5826ab8ad28 100644
--- a/builtin/credential/userpass/path_user_policies.go
+++ b/builtin/credential/userpass/path_user_policies.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package userpass
diff --git a/builtin/credential/userpass/path_users.go b/builtin/credential/userpass/path_users.go
index 66687f6b02a..bb83f8e7884 100644
--- a/builtin/credential/userpass/path_users.go
+++ b/builtin/credential/userpass/path_users.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package userpass
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	sockaddr "github.com/hashicorp/go-sockaddr"
+	"github.com/hashicorp/go-sockaddr"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/tokenutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -37,7 +37,7 @@ func pathUsersList(b *backend) *framework.Path {
 
 func pathUsers(b *backend) *framework.Path {
 	p := &framework.Path{
-		Pattern: "users/" + framework.GenericNameRegex("username"),
+		Pattern: "users/" + framework.GenericNameRegex(paramUsername),
 
 		DisplayAttrs: &framework.DisplayAttributes{
 			OperationPrefix: operationPrefixUserpass,
@@ -47,12 +47,12 @@ func pathUsers(b *backend) *framework.Path {
 		},
 
 		Fields: map[string]*framework.FieldSchema{
-			"username": {
+			paramUsername: {
 				Type:        framework.TypeString,
 				Description: "Username for this user.",
 			},
 
-			"password": {
+			paramPassword: {
 				Type:        framework.TypeString,
 				Description: "Password for this user.",
 				DisplayAttrs: &framework.DisplayAttributes{
@@ -60,6 +60,14 @@ func pathUsers(b *backend) *framework.Path {
 				},
 			},
 
+			paramPasswordHash: {
+				Type:        framework.TypeString,
+				Description: "Pre-hashed password in bcrypt format for this user.",
+				DisplayAttrs: &framework.DisplayAttributes{
+					Sensitive: true,
+				},
+			},
+
 			"policies": {
 				Type:        framework.TypeCommaStringSlice,
 				Description: tokenutil.DeprecationText("token_policies"),
@@ -103,7 +111,7 @@ func pathUsers(b *backend) *framework.Path {
 }
 
 func (b *backend) userExistenceCheck(ctx context.Context, req *logical.Request, d *framework.FieldData) (bool, error) {
-	userEntry, err := b.user(ctx, req.Storage, d.Get("username").(string))
+	userEntry, err := b.user(ctx, req.Storage, d.Get(paramUsername).(string))
 	if err != nil {
 		return false, err
 	}
@@ -163,7 +171,7 @@ func (b *backend) pathUserList(ctx context.Context, req *logical.Request, d *fra
 }
 
 func (b *backend) pathUserDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	err := req.Storage.Delete(ctx, "user/"+strings.ToLower(d.Get("username").(string)))
+	err := req.Storage.Delete(ctx, "user/"+strings.ToLower(d.Get(paramUsername).(string)))
 	if err != nil {
 		return nil, err
 	}
@@ -172,7 +180,7 @@ func (b *backend) pathUserDelete(ctx context.Context, req *logical.Request, d *f
 }
 
 func (b *backend) pathUserRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	user, err := b.user(ctx, req.Storage, strings.ToLower(d.Get("username").(string)))
+	user, err := b.user(ctx, req.Storage, strings.ToLower(d.Get(paramUsername).(string)))
 	if err != nil {
 		return nil, err
 	}
@@ -203,7 +211,7 @@ func (b *backend) pathUserRead(ctx context.Context, req *logical.Request, d *fra
 }
 
 func (b *backend) userCreateUpdate(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	username := strings.ToLower(d.Get("username").(string))
+	username := strings.ToLower(d.Get(paramUsername).(string))
 	userEntry, err := b.user(ctx, req.Storage, username)
 	if err != nil {
 		return nil, err
@@ -217,7 +225,7 @@ func (b *backend) userCreateUpdate(ctx context.Context, req *logical.Request, d
 		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
 	}
 
-	if _, ok := d.GetOk("password"); ok {
+	if d.Get(paramPassword).(string) != "" || d.Get(paramPasswordHash).(string) != "" {
 		userErr, intErr := b.updateUserPassword(req, d, userEntry)
 		if intErr != nil {
 			return nil, intErr
@@ -250,11 +258,18 @@ func (b *backend) userCreateUpdate(ctx context.Context, req *logical.Request, d
 }
 
 func (b *backend) pathUserWrite(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	password := d.Get("password").(string)
-	if req.Operation == logical.CreateOperation && password == "" {
-		return logical.ErrorResponse("missing password"), logical.ErrInvalidRequest
+	password := d.Get(paramPassword).(string)
+	passwordHash := d.Get(paramPasswordHash).(string)
+
+	switch {
+	case password != "" && passwordHash != "":
+		return logical.ErrorResponse(fmt.Sprintf("%q and %q cannot be supplied together", paramPassword, paramPasswordHash)), logical.ErrInvalidRequest
+	case password == "" && passwordHash == "" && req.Operation == logical.CreateOperation:
+		// Password or pre-hashed password are only required on 'create'.
+		return logical.ErrorResponse(fmt.Sprintf("%q or %q must be supplied", paramPassword, paramPasswordHash)), logical.ErrInvalidRequest
+	default:
+		return b.userCreateUpdate(ctx, req, d)
 	}
-	return b.userCreateUpdate(ctx, req, d)
 }
 
 type UserEntry struct {
diff --git a/builtin/credential/userpass/stepwise_test.go b/builtin/credential/userpass/stepwise_test.go
index 241d7707b73..91875d172a6 100644
--- a/builtin/credential/userpass/stepwise_test.go
+++ b/builtin/credential/userpass/stepwise_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package userpass
diff --git a/builtin/logical/aws/backend.go b/builtin/logical/aws/backend.go
index b33fb1b4d69..184b476724d 100644
--- a/builtin/logical/aws/backend.go
+++ b/builtin/logical/aws/backend.go
@@ -1,16 +1,18 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
 
 import (
 	"context"
+	"fmt"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/aws/aws-sdk-go/service/iam/iamiface"
 	"github.com/aws/aws-sdk-go/service/sts/stsiface"
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/queue"
@@ -33,6 +35,7 @@ func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend,
 
 func Backend(_ *logical.BackendConfig) *backend {
 	var b backend
+	b.minAllowableRotationPeriod = minAllowableRotationPeriod
 	b.credRotationQueue = queue.New()
 	b.Backend = &framework.Backend{
 		Help: strings.TrimSpace(backendHelp),
@@ -54,6 +57,7 @@ func Backend(_ *logical.BackendConfig) *backend {
 			pathRoles(&b),
 			pathListRoles(&b),
 			pathStaticRoles(&b),
+			pathListStaticRoles(&b),
 			pathStaticCredentials(&b),
 			pathUser(&b),
 		},
@@ -62,6 +66,7 @@ func Backend(_ *logical.BackendConfig) *backend {
 			secretAccessKeys(&b),
 		},
 
+		InitializeFunc:    b.initialize,
 		Invalidate:        b.invalidate,
 		WALRollback:       b.walRollback,
 		WALRollbackMinAge: minAwsUserRollbackAge,
@@ -71,6 +76,10 @@ func Backend(_ *logical.BackendConfig) *backend {
 			}
 			return nil
 		},
+		RotateCredential: func(ctx context.Context, req *logical.Request) error {
+			_, err := b.rotateRoot(ctx, req)
+			return err
+		},
 		BackendType: logical.TypeLogical,
 	}
 
@@ -80,6 +89,10 @@ func Backend(_ *logical.BackendConfig) *backend {
 type backend struct {
 	*framework.Backend
 
+	// Function pointer used to override the IAM client creation for mocked testing
+	// If set, this function will be called instead of creating real IAM clients
+	nonCachedClientIAMFunc func(context.Context, logical.Storage, hclog.Logger, *staticRoleEntry) (iamiface.IAMAPI, error)
+
 	// Mutex to protect access to reading and writing policies
 	roleMutex sync.RWMutex
 
@@ -94,6 +107,8 @@ type backend struct {
 	// the age of a static role's credential is tracked by a priority queue and handled
 	// by the PeriodicFunc
 	credRotationQueue *queue.PriorityQueue
+
+	minAllowableRotationPeriod time.Duration
 }
 
 const backendHelp = `
@@ -122,8 +137,9 @@ func (b *backend) clearClients() {
 }
 
 // clientIAM returns the configured IAM client. If nil, it constructs a new one
-// and returns it, setting it the internal variable
-func (b *backend) clientIAM(ctx context.Context, s logical.Storage) (iamiface.IAMAPI, error) {
+// and returns it, setting it the internal variable.
+// entry is only needed when configuring the client to use for role assumption.
+func (b *backend) clientIAM(ctx context.Context, s logical.Storage, entry *staticRoleEntry) (iamiface.IAMAPI, error) {
 	b.clientMutex.RLock()
 	if b.iamClient != nil {
 		b.clientMutex.RUnlock()
@@ -141,10 +157,11 @@ func (b *backend) clientIAM(ctx context.Context, s logical.Storage) (iamiface.IA
 		return b.iamClient, nil
 	}
 
-	iamClient, err := b.nonCachedClientIAM(ctx, s, b.Logger())
+	iamClient, err := b.nonCachedClientIAM(ctx, s, b.Logger(), entry)
 	if err != nil {
 		return nil, err
 	}
+
 	b.iamClient = iamClient
 
 	return b.iamClient, nil
@@ -176,3 +193,76 @@ func (b *backend) clientSTS(ctx context.Context, s logical.Storage) (stsiface.ST
 
 	return b.stsClient, nil
 }
+
+func (b *backend) initialize(ctx context.Context, request *logical.InitializationRequest) error {
+	if !b.WriteSafeReplicationState() {
+		b.Logger().Info("skipping populating rotation queue")
+		return nil
+	}
+	b.Logger().Info("populating rotation queue")
+
+	creds, err := request.Storage.List(ctx, pathStaticCreds+"/")
+	if err != nil {
+		return err
+	}
+	b.Logger().Debug(fmt.Sprintf("Adding %d items to the rotation queue", len(creds)))
+	for _, roleName := range creds {
+		if roleName == "" {
+			continue
+		}
+		credPath := formatCredsStoragePath(roleName)
+		credsEntry, err := request.Storage.Get(ctx, credPath)
+		if err != nil {
+			return fmt.Errorf("could not read credentials: %w", err)
+		}
+		if credsEntry == nil {
+			continue
+		}
+		credentials := awsCredentials{}
+		if err := credsEntry.DecodeJSON(&credentials); err != nil {
+			return fmt.Errorf("failed to decode credentials: %w", err)
+		}
+
+		configEntry, err := request.Storage.Get(ctx, formatRoleStoragePath(roleName))
+		if err != nil {
+			return fmt.Errorf("could not read role: %w", err)
+		}
+		if configEntry == nil {
+			continue
+		}
+		config := staticRoleEntry{}
+		if err := configEntry.DecodeJSON(&config); err != nil {
+			return fmt.Errorf("failed to decode role config: %w", err)
+		}
+
+		if credentials.Expiration == nil {
+			expiration := time.Now().UTC().Add(config.RotationPeriod)
+			credentials.Expiration = &expiration
+			_, err := logical.StorageEntryJSON(credPath, creds)
+			if err != nil {
+				return fmt.Errorf("failed to marshal object to JSON: %w", err)
+			}
+			b.Logger().Debug("no known expiration time for credentials so resetting the expiration", "role", roleName, "new expiration", expiration)
+		}
+
+		err = b.credRotationQueue.Push(&queue.Item{
+			Key:      config.Name,
+			Value:    config,
+			Priority: credentials.priority(config),
+		})
+		if err != nil {
+			return fmt.Errorf("failed to add creds for role %s to queue: %w", roleName, err)
+		}
+	}
+	return nil
+}
+
+// getNonCachedIAMClient returns an IAM client. In a test env, if a mocked client creation
+// function is set (nonCachedClientIAMFunc), it will be used instead of the default client creation function.
+// This allows us to mock AWS clients in tests.
+func (b *backend) getNonCachedIAMClient(ctx context.Context, storage logical.Storage, cfg staticRoleEntry) (iamiface.IAMAPI, error) {
+	if b.nonCachedClientIAMFunc != nil {
+		return b.nonCachedClientIAMFunc(ctx, storage, b.Logger(), &cfg)
+	}
+	return b.nonCachedClientIAM(ctx, storage, b.Logger(), &cfg)
+}
diff --git a/builtin/logical/aws/backend_test.go b/builtin/logical/aws/backend_test.go
index b5376f64687..feea197db22 100644
--- a/builtin/logical/aws/backend_test.go
+++ b/builtin/logical/aws/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -36,6 +36,23 @@ import (
 
 var initSetup sync.Once
 
+// This looks a bit curious. The policy document and the role document act
+// as a logical intersection of policies. The role allows ec2:Describe*
+// (among other permissions). This policy allows everything BUT
+// ec2:DescribeAvailabilityZones. Thus, the logical intersection of the two
+// is all ec2:Describe* EXCEPT ec2:DescribeAvailabilityZones, and so the
+// describeAZs call should fail
+const allowAllButDescribeAzs = `{
+	"Version": "2012-10-17",
+	"Statement": [
+		{
+			"Effect": "Allow",
+			"NotAction": "ec2:DescribeAvailabilityZones",
+			"Resource": "*"
+		}
+	]
+}`
+
 type mockIAMClient struct {
 	iamiface.IAMAPI
 }
@@ -45,7 +62,9 @@ func (m *mockIAMClient) CreateUserWithContext(_ aws.Context, input *iam.CreateUs
 }
 
 func getBackend(t *testing.T) logical.Backend {
-	be, _ := Factory(context.Background(), logical.TestBackendConfig())
+	cfg := logical.TestBackendConfig()
+	cfg.System = &testSystemView{}
+	be, _ := Factory(context.Background(), cfg)
 	return be
 }
 
@@ -97,7 +116,7 @@ func TestAcceptanceBackend_basicSTS(t *testing.T) {
 		PreCheck: func() {
 			testAccPreCheck(t)
 			createUser(t, userName, accessKey)
-			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn})
+			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn}, nil)
 			// Sleep sometime because AWS is eventually consistent
 			// Both the createUser and createRole depend on this
 			log.Println("[WARN] Sleeping for 10 seconds waiting for AWS...")
@@ -123,7 +142,8 @@ func TestAcceptanceBackend_basicSTS(t *testing.T) {
 	})
 }
 
-func TestBackend_policyCrud(t *testing.T) {
+// TestBackend_policyCRUD tests the CRUD operations for a policy.
+func TestBackend_policyCRUD(t *testing.T) {
 	t.Parallel()
 	compacted, err := compactJSON(testDynamoPolicy)
 	if err != nil {
@@ -252,23 +272,32 @@ func getAccountID() (string, error) {
 	return *res.Account, nil
 }
 
-func createRole(t *testing.T, roleName, awsAccountID string, policyARNs []string) {
-	const testRoleAssumePolicy = `{
+func createRole(t *testing.T, roleName, awsAccountID string, policyARNs, extraTrustPolicies []string) {
+	t.Helper()
+
+	trustPolicyStmts := append([]string{
+		fmt.Sprintf(`
+		{
+		  "Effect":"Allow",
+		  "Principal": {
+			  "AWS": "arn:aws:iam::%s:root"
+		  },
+		  "Action": [
+			  "sts:AssumeRole",
+			  "sts:SetSourceIdentity"
+		  ]
+		}`, awsAccountID),
+	},
+		extraTrustPolicies...)
+
+	testRoleAssumePolicy := fmt.Sprintf(`{
       "Version": "2012-10-17",
       "Statement": [
-          {
-              "Effect":"Allow",
-              "Principal": {
-                  "AWS": "arn:aws:iam::%s:root"
-              },
-              "Action": [
-                  "sts:AssumeRole",
-                  "sts:SetSourceIdentity"
-              ]
-          }
+%s
       ]
 }
-`
+`, strings.Join(trustPolicyStmts, ","))
+
 	awsConfig := &aws.Config{
 		Region:     aws.String("us-east-1"),
 		HTTPClient: cleanhttp.DefaultClient(),
@@ -278,23 +307,23 @@ func createRole(t *testing.T, roleName, awsAccountID string, policyARNs []string
 		t.Fatal(err)
 	}
 	svc := iam.New(sess)
-	trustPolicy := fmt.Sprintf(testRoleAssumePolicy, awsAccountID)
 
 	params := &iam.CreateRoleInput{
-		AssumeRolePolicyDocument: aws.String(trustPolicy),
+		AssumeRolePolicyDocument: aws.String(testRoleAssumePolicy),
 		RoleName:                 aws.String(roleName),
 		Path:                     aws.String("/"),
 	}
 
 	log.Printf("[INFO] AWS CreateRole: %s", roleName)
-	if _, err := svc.CreateRole(params); err != nil {
+	output, err := svc.CreateRole(params)
+	if err != nil {
 		t.Fatalf("AWS CreateRole failed: %v", err)
 	}
 
 	for _, policyARN := range policyARNs {
 		attachment := &iam.AttachRolePolicyInput{
 			PolicyArn: aws.String(policyARN),
-			RoleName:  aws.String(roleName), // Required
+			RoleName:  output.Role.RoleName,
 		}
 		_, err = svc.AttachRolePolicy(attachment)
 		if err != nil {
@@ -315,21 +344,21 @@ func createUser(t *testing.T, userName string, accessKey *awsAccessKey) {
 	//	  do anything
 	// 4. Generate API creds to get an actual access key and secret key
 	timebombPolicyTemplate := `{
-		"Version": "2012-10-17",
-		"Statement": [
-			{
-				"Effect": "Deny",
-				"Action": "*",
-				"Resource": "*",
-				"Condition": {
-					"DateGreaterThan": {
-						"aws:CurrentTime": "%s"
-					}
+	"Version": "2012-10-17",
+	"Statement": [
+		{
+			"Effect": "Deny",
+			"Action": "*",
+			"Resource": "*",
+			"Condition": {
+				"DateGreaterThan": {
+					"aws:CurrentTime": "%s"
 				}
 			}
-		]
-	}
-	`
+		}
+	]
+}
+`
 	validity := time.Duration(2 * time.Hour)
 	expiry := time.Now().Add(validity)
 	timebombPolicy := fmt.Sprintf(timebombPolicyTemplate, expiry.Format(time.RFC3339))
@@ -657,7 +686,7 @@ func testAccStepRotateRoot(oldAccessKey *awsAccessKey) logicaltest.TestStep {
 	}
 }
 
-func testAccStepRead(t *testing.T, path, name string, credentialTests []credentialTestFunc) logicaltest.TestStep {
+func testAccStepRead(_ *testing.T, path, name string, credentialTests []credentialTestFunc) logicaltest.TestStep {
 	return logicaltest.TestStep{
 		Operation: logical.ReadOperation,
 		Path:      path + "/" + name,
@@ -909,6 +938,8 @@ func testAccStepReadPolicy(t *testing.T, name string, value string) logicaltest.
 				"iam_groups":               []string(nil),
 				"iam_tags":                 map[string]string(nil),
 				"mfa_serial_number":        "",
+				"session_tags":             map[string]string(nil),
+				"external_id":              "",
 			}
 			if !reflect.DeepEqual(resp.Data, expected) {
 				return fmt.Errorf("bad: got: %#v\nexpected: %#v", resp.Data, expected)
@@ -1107,22 +1138,7 @@ func TestAcceptanceBackend_iamUserGroups(t *testing.T) {
 func TestAcceptanceBackend_AssumedRoleWithPolicyDoc(t *testing.T) {
 	t.Parallel()
 	roleName := generateUniqueRoleName(t.Name())
-	// This looks a bit curious. The policy document and the role document act
-	// as a logical intersection of policies. The role allows ec2:Describe*
-	// (among other permissions). This policy allows everything BUT
-	// ec2:DescribeAvailabilityZones. Thus, the logical intersection of the two
-	// is all ec2:Describe* EXCEPT ec2:DescribeAvailabilityZones, and so the
-	// describeAZs call should fail
-	allowAllButDescribeAzs := `
-{
-	"Version": "2012-10-17",
-	"Statement": [{
-			"Effect": "Allow",
-			"NotAction": "ec2:DescribeAvailabilityZones",
-			"Resource": "*"
-	}]
-}
-`
+
 	awsAccountID, err := getAccountID()
 	if err != nil {
 		t.Logf("Unable to retrive user via sts:GetCallerIdentity: %#v", err)
@@ -1137,7 +1153,7 @@ func TestAcceptanceBackend_AssumedRoleWithPolicyDoc(t *testing.T) {
 		AcceptanceTest: true,
 		PreCheck: func() {
 			testAccPreCheck(t)
-			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn})
+			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn}, nil)
 			// Sleep sometime because AWS is eventually consistent
 			log.Println("[WARN] Sleeping for 10 seconds waiting for AWS...")
 			time.Sleep(10 * time.Second)
@@ -1173,7 +1189,7 @@ func TestAcceptanceBackend_AssumedRoleWithPolicyARN(t *testing.T) {
 		AcceptanceTest: true,
 		PreCheck: func() {
 			testAccPreCheck(t)
-			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn, iamPolicyArn})
+			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn, iamPolicyArn}, nil)
 			log.Printf("[WARN] Sleeping for 10 seconds waiting for AWS...")
 			time.Sleep(10 * time.Second)
 		},
@@ -1194,22 +1210,7 @@ func TestAcceptanceBackend_AssumedRoleWithGroups(t *testing.T) {
 	t.Parallel()
 	roleName := generateUniqueRoleName(t.Name())
 	groupName := generateUniqueGroupName(t.Name())
-	// This looks a bit curious. The policy document and the role document act
-	// as a logical intersection of policies. The role allows ec2:Describe*
-	// (among other permissions). This policy allows everything BUT
-	// ec2:DescribeAvailabilityZones. Thus, the logical intersection of the two
-	// is all ec2:Describe* EXCEPT ec2:DescribeAvailabilityZones, and so the
-	// describeAZs call should fail
-	allowAllButDescribeAzs := `{
-	"Version": "2012-10-17",
-	"Statement": [
-		{
-			"Effect": "Allow",
-			"NotAction": "ec2:DescribeAvailabilityZones",
-			"Resource": "*"
-		}
-	]
-}`
+
 	awsAccountID, err := getAccountID()
 	if err != nil {
 		t.Logf("Unable to retrive user via sts:GetCallerIdentity: %#v", err)
@@ -1225,7 +1226,7 @@ func TestAcceptanceBackend_AssumedRoleWithGroups(t *testing.T) {
 		AcceptanceTest: true,
 		PreCheck: func() {
 			testAccPreCheck(t)
-			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn})
+			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn}, nil)
 			createGroup(t, groupName, allowAllButDescribeAzs, []string{})
 			// Sleep sometime because AWS is eventually consistent
 			log.Println("[WARN] Sleeping for 10 seconds waiting for AWS...")
@@ -1247,6 +1248,62 @@ func TestAcceptanceBackend_AssumedRoleWithGroups(t *testing.T) {
 	})
 }
 
+// TestAcceptanceBackend_AssumedRoleWithSessionTags tests that session tags are
+// passed to the assumed role.
+func TestAcceptanceBackend_AssumedRoleWithSessionTags(t *testing.T) {
+	t.Parallel()
+	roleName := generateUniqueRoleName(t.Name())
+	awsAccountID, err := getAccountID()
+	if err != nil {
+		t.Logf("Unable to retrive user via sts:GetCallerIdentity: %#v", err)
+		t.Skip("Could not determine AWS account ID from sts:GetCallerIdentity for acceptance tests, skipping")
+	}
+
+	roleARN := fmt.Sprintf("arn:aws:iam::%s:role/%s", awsAccountID, roleName)
+	roleData := map[string]interface{}{
+		"policy_document": allowAllButDescribeAzs,
+		"role_arns":       []string{roleARN},
+		"credential_type": assumedRoleCred,
+		"session_tags": map[string]string{
+			"foo": "bar",
+			"baz": "qux",
+		},
+	}
+
+	// allowSessionTagsPolicy allows the role to tag the session, it needs to be
+	// included in the trust policy.
+	allowSessionTagsPolicy := fmt.Sprintf(`
+		{
+			"Sid": "AllowPassSessionTagsAndTransitive",
+			"Effect": "Allow",
+			"Action": "sts:TagSession",
+			"Principal": {
+				  "AWS": "arn:aws:iam::%s:root"
+			}
+		}
+`, awsAccountID)
+
+	logicaltest.Test(t, logicaltest.TestCase{
+		AcceptanceTest: true,
+		PreCheck: func() {
+			testAccPreCheck(t)
+			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn}, []string{allowSessionTagsPolicy})
+			log.Println("[WARN] Sleeping for 10 seconds waiting for AWS...")
+			time.Sleep(10 * time.Second)
+		},
+		LogicalBackend: getBackend(t),
+		Steps: []logicaltest.TestStep{
+			testAccStepConfig(t),
+			testAccStepWriteRole(t, "test", roleData),
+			testAccStepRead(t, "sts", "test", []credentialTestFunc{describeInstancesTest, describeAzsTestUnauthorized}),
+			testAccStepRead(t, "creds", "test", []credentialTestFunc{describeInstancesTest, describeAzsTestUnauthorized}),
+		},
+		Teardown: func() error {
+			return deleteTestRole(roleName)
+		},
+	})
+}
+
 func TestAcceptanceBackend_FederationTokenWithPolicyARN(t *testing.T) {
 	t.Parallel()
 	userName := generateUniqueUserName(t.Name())
@@ -1328,6 +1385,7 @@ func TestAcceptanceBackend_FederationTokenWithGroups(t *testing.T) {
 	})
 }
 
+// TestAcceptanceBackend_SessionToken
 func TestAcceptanceBackend_SessionToken(t *testing.T) {
 	t.Parallel()
 	userName := generateUniqueUserName(t.Name())
@@ -1427,7 +1485,7 @@ func TestAcceptanceBackend_RoleDefaultSTSTTL(t *testing.T) {
 		AcceptanceTest: true,
 		PreCheck: func() {
 			testAccPreCheck(t)
-			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn})
+			createRole(t, roleName, awsAccountID, []string{ec2PolicyArn}, nil)
 			log.Println("[WARN] Sleeping for 10 seconds waiting for AWS...")
 			time.Sleep(10 * time.Second)
 		},
@@ -1443,7 +1501,8 @@ func TestAcceptanceBackend_RoleDefaultSTSTTL(t *testing.T) {
 	})
 }
 
-func TestBackend_policyArnCrud(t *testing.T) {
+// TestBackend_policyArnCRUD test the CRUD operations for policy ARNs.
+func TestBackend_policyArnCRUD(t *testing.T) {
 	t.Parallel()
 	logicaltest.Test(t, logicaltest.TestCase{
 		AcceptanceTest: false,
@@ -1483,6 +1542,8 @@ func testAccStepReadArnPolicy(t *testing.T, name string, value string) logicalte
 				"iam_groups":               []string(nil),
 				"iam_tags":                 map[string]string(nil),
 				"mfa_serial_number":        "",
+				"session_tags":             map[string]string(nil),
+				"external_id":              "",
 			}
 			if !reflect.DeepEqual(resp.Data, expected) {
 				return fmt.Errorf("bad: got: %#v\nexpected: %#v", resp.Data, expected)
@@ -1503,7 +1564,8 @@ func testAccStepWriteArnRoleRef(t *testing.T, vaultRoleName, awsRoleName, awsAcc
 	}
 }
 
-func TestBackend_iamGroupsCrud(t *testing.T) {
+// TestBackend_iamGroupsCRUD tests CRUD operations for IAM groups.
+func TestBackend_iamGroupsCRUD(t *testing.T) {
 	t.Parallel()
 	logicaltest.Test(t, logicaltest.TestCase{
 		AcceptanceTest: false,
@@ -1554,6 +1616,8 @@ func testAccStepReadIamGroups(t *testing.T, name string, groups []string) logica
 				"iam_groups":               groups,
 				"iam_tags":                 map[string]string(nil),
 				"mfa_serial_number":        "",
+				"session_tags":             map[string]string(nil),
+				"external_id":              "",
 			}
 			if !reflect.DeepEqual(resp.Data, expected) {
 				return fmt.Errorf("bad: got: %#v\nexpected: %#v", resp.Data, expected)
@@ -1564,7 +1628,8 @@ func testAccStepReadIamGroups(t *testing.T, name string, groups []string) logica
 	}
 }
 
-func TestBackend_iamTagsCrud(t *testing.T) {
+// TestBackend_iamTagsCRUD tests the CRUD operations for IAM tags.
+func TestBackend_iamTagsCRUD(t *testing.T) {
 	logicaltest.Test(t, logicaltest.TestCase{
 		AcceptanceTest: false,
 		LogicalBackend: getBackend(t),
@@ -1614,6 +1679,176 @@ func testAccStepReadIamTags(t *testing.T, name string, tags map[string]string) l
 				"iam_groups":               []string(nil),
 				"iam_tags":                 tags,
 				"mfa_serial_number":        "",
+				"session_tags":             map[string]string(nil),
+				"external_id":              "",
+			}
+			if !reflect.DeepEqual(resp.Data, expected) {
+				return fmt.Errorf("bad: got: %#v\nexpected: %#v", resp.Data, expected)
+			}
+
+			return nil
+		},
+	}
+}
+
+// TestBackend_stsSessionTagsCRUD tests the CRUD operations for STS session tags.
+func TestBackend_stsSessionTagsCRUD(t *testing.T) {
+	t.Parallel()
+
+	tagParams0 := map[string]string{"tag1": "value1", "tag2": "value2"}
+	tagParams1 := map[string]string{"tag1": "value1", "tag2": "value4", "tag3": "value3"}
+
+	// list of tags in the form of "key=value"
+	tagParamsList0 := []string{"key1=value1", "key2=value2"}
+	tagParamsList0Expect := map[string]string{"key1": "value1", "key2": "value2"}
+	tagParamsList1 := []string{"key1=value2", "key3=value4"}
+	tagParamsList1Expect := map[string]string{"key1": "value2", "key3": "value4"}
+
+	type testCase struct {
+		name        string
+		expectTags  []map[string]string
+		tagsParams  []any
+		externalIDs []string
+	}
+
+	for _, tt := range []testCase{
+		{
+			name: "mapped-only",
+			tagsParams: []any{
+				tagParams0,
+				map[string]string{},
+				tagParams1,
+			},
+			expectTags: []map[string]string{
+				tagParams0,
+				{},
+				tagParams1,
+			},
+			externalIDs: []string{"foo", "", "bar"},
+		},
+		{
+			name: "string-list-only",
+			tagsParams: []any{
+				tagParamsList0,
+				tagParamsList1,
+			},
+			expectTags: []map[string]string{
+				tagParamsList0Expect,
+				tagParamsList1Expect,
+			},
+			externalIDs: []string{"foo"},
+		},
+		{
+			name: "mixed-param-types",
+			tagsParams: []any{
+				tagParams0,
+				tagParamsList0,
+				tagParams1,
+				tagParamsList1,
+			},
+			expectTags: []map[string]string{
+				tagParams0,
+				tagParamsList0Expect,
+				tagParams1,
+				tagParamsList1Expect,
+			},
+			externalIDs: []string{"foo", "bar"},
+		},
+		{
+			name: "unset-tags",
+			tagsParams: []any{
+				tagParams0,
+				map[string]string{},
+			},
+			expectTags: []map[string]string{
+				tagParams0,
+				{},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			steps := []logicaltest.TestStep{
+				testAccStepConfig(t),
+			}
+
+			if len(tt.tagsParams) != len(tt.expectTags) {
+				t.Fatalf("invalid test case: test case params and expect must have the same length")
+			}
+
+			// lastNonEmptyExternalID is used to store the last non-empty external ID for the
+			// test case. The value will is expected to be set on the role. Setting the value
+			// to an empty string has no effect on update operations.
+			var lastNonEmptyExternalID string
+			for idx, params := range tt.tagsParams {
+				var externalID string
+				if len(tt.externalIDs) > idx {
+					externalID = tt.externalIDs[idx]
+				}
+				if externalID != "" {
+					lastNonEmptyExternalID = externalID
+				}
+				steps = append(steps, testAccStepWriteSTSSessionTags(t, tt.name, params, externalID))
+				steps = append(steps, testAccStepReadSTSSessionTags(t, tt.name, tt.expectTags[idx], lastNonEmptyExternalID, false))
+			}
+			steps = append(
+				steps,
+				testAccStepDeletePolicy(t, tt.name),
+				testAccStepReadSTSSessionTags(t, tt.name, nil, "", true),
+			)
+			logicaltest.Test(t, logicaltest.TestCase{
+				AcceptanceTest: false,
+				LogicalBackend: getBackend(t),
+				Steps:          steps,
+			})
+		})
+	}
+}
+
+func testAccStepWriteSTSSessionTags(t *testing.T, name string, tags any, externalID string) logicaltest.TestStep {
+	t.Helper()
+
+	data := map[string]interface{}{
+		"credential_type": assumedRoleCred,
+		"session_tags":    tags,
+	}
+	if externalID != "" {
+		data["external_id"] = externalID
+	}
+	return logicaltest.TestStep{
+		Operation: logical.UpdateOperation,
+		Path:      "roles/" + name,
+		Data:      data,
+	}
+}
+
+func testAccStepReadSTSSessionTags(t *testing.T, name string, tags any, externalID string, expectNilResp bool) logicaltest.TestStep {
+	t.Helper()
+
+	return logicaltest.TestStep{
+		Operation: logical.ReadOperation,
+		Path:      "roles/" + name,
+		Check: func(resp *logical.Response) error {
+			if resp == nil {
+				if expectNilResp {
+					return nil
+				}
+				return fmt.Errorf("vault response not received")
+			}
+
+			expected := map[string]interface{}{
+				"policy_arns":              []string(nil),
+				"role_arns":                []string(nil),
+				"policy_document":          "",
+				"credential_type":          assumedRoleCred,
+				"default_sts_ttl":          int64(0),
+				"max_sts_ttl":              int64(0),
+				"user_path":                "",
+				"permissions_boundary_arn": "",
+				"iam_groups":               []string(nil),
+				"iam_tags":                 map[string]string(nil),
+				"mfa_serial_number":        "",
+				"session_tags":             tags,
+				"external_id":              externalID,
 			}
 			if !reflect.DeepEqual(resp.Data, expected) {
 				return fmt.Errorf("bad: got: %#v\nexpected: %#v", resp.Data, expected)
diff --git a/builtin/logical/aws/client.go b/builtin/logical/aws/client.go
index dd6a5819663..733cb114828 100644
--- a/builtin/logical/aws/client.go
+++ b/builtin/logical/aws/client.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"strconv"
@@ -23,8 +24,8 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
-// NOTE: The caller is required to ensure that b.clientMutex is at least read locked
-func (b *backend) getRootConfig(ctx context.Context, s logical.Storage, clientType string, logger hclog.Logger) (*aws.Config, error) {
+// getRootIAMConfig creates an *aws.Config for Vault to connect to IAM.
+func (b *backend) getRootIAMConfig(ctx context.Context, s logical.Storage, logger hclog.Logger) (*aws.Config, error) {
 	credsConfig := &awsutil.CredentialsConfig{}
 	var endpoint string
 	var maxRetries int = aws.UseServiceDefaultRetries
@@ -43,11 +44,9 @@ func (b *backend) getRootConfig(ctx context.Context, s logical.Storage, clientTy
 		credsConfig.SecretKey = config.SecretKey
 		credsConfig.Region = config.Region
 		maxRetries = config.MaxRetries
-		switch {
-		case clientType == "iam" && config.IAMEndpoint != "":
+
+		if config.IAMEndpoint != "" {
 			endpoint = *aws.String(config.IAMEndpoint)
-		case clientType == "sts" && config.STSEndpoint != "":
-			endpoint = *aws.String(config.STSEndpoint)
 		}
 
 		if config.IdentityTokenAudience != "" {
@@ -72,13 +71,7 @@ func (b *backend) getRootConfig(ctx context.Context, s logical.Storage, clientTy
 	}
 
 	if credsConfig.Region == "" {
-		credsConfig.Region = os.Getenv("AWS_REGION")
-		if credsConfig.Region == "" {
-			credsConfig.Region = os.Getenv("AWS_DEFAULT_REGION")
-			if credsConfig.Region == "" {
-				credsConfig.Region = "us-east-1"
-			}
-		}
+		credsConfig.Region = getFallbackRegion()
 	}
 
 	credsConfig.HTTPClient = cleanhttp.DefaultClient()
@@ -99,36 +92,225 @@ func (b *backend) getRootConfig(ctx context.Context, s logical.Storage, clientTy
 	}, nil
 }
 
-func (b *backend) nonCachedClientIAM(ctx context.Context, s logical.Storage, logger hclog.Logger) (*iam.IAM, error) {
-	awsConfig, err := b.getRootConfig(ctx, s, "iam", logger)
+// Return a slice of *aws.Config, based on descending configuration priority. STS endpoints are the only place this is used.
+// NOTE: The caller is required to ensure that b.clientMutex is at least read locked
+func (b *backend) getRootSTSConfigs(ctx context.Context, s logical.Storage, logger hclog.Logger) ([]*aws.Config, error) {
+	// set fallback region (we can overwrite later)
+	fallbackRegion := getFallbackRegion()
+
+	maxRetries := aws.UseServiceDefaultRetries
+
+	entry, err := s.Get(ctx, "config/root")
 	if err != nil {
 		return nil, err
 	}
+	var configs []*aws.Config
+
+	// ensure the nil case uses defaults
+	if entry == nil {
+		ccfg := awsutil.CredentialsConfig{
+			HTTPClient: cleanhttp.DefaultClient(),
+			Logger:     logger,
+			Region:     fallbackRegion,
+		}
+		creds, err := ccfg.GenerateCredentialChain()
+		if err != nil {
+			return nil, err
+		}
+		configs = append(configs, &aws.Config{
+			Credentials: creds,
+			Region:      aws.String(fallbackRegion),
+			Endpoint:    aws.String(""),
+			MaxRetries:  aws.Int(maxRetries),
+		})
+
+		return configs, nil
+	}
+
+	var config rootConfig
+	if err := entry.DecodeJSON(&config); err != nil {
+		return nil, fmt.Errorf("error reading root configuration: %w", err)
+	}
+
+	var endpoints []string
+	var regions []string
+	credsConfig := &awsutil.CredentialsConfig{}
+
+	credsConfig.AccessKey = config.AccessKey
+	credsConfig.SecretKey = config.SecretKey
+	credsConfig.HTTPClient = cleanhttp.DefaultClient()
+	credsConfig.Logger = logger
+
+	if config.Region != "" {
+		regions = append(regions, config.Region)
+	}
+
+	maxRetries = config.MaxRetries
+	if config.STSEndpoint != "" {
+		endpoints = append(endpoints, config.STSEndpoint)
+		if config.STSRegion != "" {
+			// this retains original logic, where sts region was only used if sts endpoint was set
+			regions = []string{config.STSRegion} // override to be "only" region if set
+		}
+
+		if len(config.STSFallbackEndpoints) > 0 {
+			endpoints = append(endpoints, config.STSFallbackEndpoints...)
+		}
+
+		if len(config.STSFallbackRegions) > 0 {
+			regions = append(regions, config.STSFallbackRegions...)
+		}
+	}
+
+	opts := make([]awsutil.Option, 0)
+	if config.IdentityTokenAudience != "" {
+		ns, err := namespace.FromContext(ctx)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get namespace from context: %w", err)
+		}
+
+		fetcher := &PluginIdentityTokenFetcher{
+			sys:      b.System(),
+			logger:   b.Logger(),
+			ns:       ns,
+			audience: config.IdentityTokenAudience,
+			ttl:      config.IdentityTokenTTL,
+		}
+
+		sessionSuffix := strconv.FormatInt(time.Now().UnixNano(), 10)
+		credsConfig.RoleSessionName = fmt.Sprintf("vault-aws-secrets-%s", sessionSuffix)
+		credsConfig.WebIdentityTokenFetcher = fetcher
+		credsConfig.RoleARN = config.RoleARN
+
+		// explicitly disable environment and shared credential providers when using Web Identity Token Fetcher
+		// enables WIF usage in environments that may use AWS Profiles or environment variables for other use-cases
+		opts = append(opts, awsutil.WithEnvironmentCredentials(false), awsutil.WithSharedCredentials(false))
+	}
+
+	// at this point, in the IAM case,
+	// - regions contains config.Region, if it was set.
+	// - endpoints contains iam_endpoint, if it was set.
+	// in the sts case,
+	// - regions contains sts_region, if it was set, then sts_fallback_regions in order, if they were set.
+	// - endpoints contains sts_endpoint, if it was set, then sts_fallback_endpoints in order, if they were set.
+
+	// case in which nothing was supplied
+	if len(regions) == 0 {
+		// fallback region is in descending order, AWS_REGION, or AWS_DEFAULT_REGION, or us-east-1
+		regions = append(regions, fallbackRegion)
+	}
+
+	if len(endpoints) == 0 {
+		for _, v := range regions {
+			endpoints = append(endpoints, matchingSTSEndpoint(v))
+		}
+	}
+
+	// for this approach of using parallel arrays to part out the configs, we want equal numbers of regions and endpoints
+	if len(regions) != len(endpoints) {
+		return nil, errors.New("number of regions does not match number of endpoints")
+	}
+
+	for i := 0; i < len(endpoints); i++ {
+		if len(regions) > i {
+			credsConfig.Region = regions[i]
+		} else {
+			credsConfig.Region = fallbackRegion
+		}
+		creds, err := credsConfig.GenerateCredentialChain(opts...)
+		if err != nil {
+			return nil, err
+		}
+		configs = append(configs, &aws.Config{
+			Credentials: creds,
+			Region:      aws.String(credsConfig.Region),
+			Endpoint:    aws.String(endpoints[i]),
+			MaxRetries:  aws.Int(maxRetries),
+			HTTPClient:  cleanhttp.DefaultClient(),
+		})
+	}
+
+	return configs, nil
+}
+
+func (b *backend) nonCachedClientIAM(ctx context.Context, s logical.Storage, logger hclog.Logger, entry *staticRoleEntry) (*iam.IAM, error) {
+	var awsConfig *aws.Config
+	var err error
+
+	if entry != nil && entry.AssumeRoleARN != "" {
+		awsConfig, err = b.assumeRoleStatic(ctx, s, entry)
+		if err != nil {
+			return nil, fmt.Errorf("failed to assume role %q: %w", entry.AssumeRoleARN, err)
+		}
+	} else {
+		awsConfig, err = b.getRootIAMConfig(ctx, s, logger)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	sess, err := session.NewSession(awsConfig)
 	if err != nil {
 		return nil, err
 	}
 	client := iam.New(sess)
 	if client == nil {
-		return nil, fmt.Errorf("could not obtain iam client")
+		return nil, fmt.Errorf("could not obtain IAM client")
 	}
 	return client, nil
 }
 
 func (b *backend) nonCachedClientSTS(ctx context.Context, s logical.Storage, logger hclog.Logger) (*sts.STS, error) {
-	awsConfig, err := b.getRootConfig(ctx, s, "sts", logger)
+	awsConfig, err := b.getRootSTSConfigs(ctx, s, logger)
 	if err != nil {
 		return nil, err
 	}
-	sess, err := session.NewSession(awsConfig)
-	if err != nil {
-		return nil, err
+
+	var client *sts.STS
+
+	for _, cfg := range awsConfig {
+		sess, err := session.NewSession(cfg)
+		if err != nil {
+			return nil, err
+		}
+		client = sts.New(sess)
+		if client == nil {
+			return nil, fmt.Errorf("could not obtain sts client")
+		}
+
+		// ping the client - we only care about errors
+		_, err = client.GetCallerIdentity(&sts.GetCallerIdentityInput{})
+		if err == nil {
+			return client, nil
+		} else {
+			b.Logger().Debug("couldn't connect with config trying next", "failed endpoint", *cfg.Endpoint, "failed region", *cfg.Region)
+		}
 	}
-	client := sts.New(sess)
-	if client == nil {
-		return nil, fmt.Errorf("could not obtain sts client")
+
+	return nil, fmt.Errorf("could not obtain sts client")
+}
+
+// matchingSTSEndpoint returns the endpoint for the supplied region, according to
+// http://docs.aws.amazon.com/general/latest/gr/sts.html
+func matchingSTSEndpoint(stsRegion string) string {
+	return fmt.Sprintf("https://sts.%s.amazonaws.com", stsRegion)
+}
+
+// getFallbackRegion returns an aws region fallback. It will check in the AWS specified order:
+// - AWS_REGION, then
+// - AWS_DEFAULT_REGION, then
+// - us-east-1
+func getFallbackRegion() string {
+	// set fallback region (we can overwrite later)
+	fallbackRegion := os.Getenv("AWS_REGION")
+	if fallbackRegion == "" {
+		fallbackRegion = os.Getenv("AWS_DEFAULT_REGION")
 	}
-	return client, nil
+	if fallbackRegion == "" {
+		fallbackRegion = "us-east-1"
+	}
+
+	return fallbackRegion
 }
 
 // PluginIdentityTokenFetcher fetches plugin identity tokens from Vault. It is provided
diff --git a/builtin/logical/aws/client_ce.go b/builtin/logical/aws/client_ce.go
new file mode 100644
index 00000000000..50e806217ca
--- /dev/null
+++ b/builtin/logical/aws/client_ce.go
@@ -0,0 +1,21 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package aws
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// assumeRoleStatic assumes an AWS role for cross-account static role management.
+// It uses the role ARN and session name provided in the staticRoleEntry configuration
+// to generate credentials for the assumed role.
+func (b *backend) assumeRoleStatic(ctx context.Context, s logical.Storage, entry *staticRoleEntry) (*aws.Config, error) {
+	return nil, fmt.Errorf("cross-account static roles are only supported in Vault Enterprise")
+}
diff --git a/builtin/logical/aws/cmd/aws/main.go b/builtin/logical/aws/cmd/aws/main.go
index 62c7efe6cf3..c856f155f2c 100644
--- a/builtin/logical/aws/cmd/aws/main.go
+++ b/builtin/logical/aws/cmd/aws/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/logical/aws/iam_policies.go b/builtin/logical/aws/iam_policies.go
index 9735a2af81a..7592e1f81d3 100644
--- a/builtin/logical/aws/iam_policies.go
+++ b/builtin/logical/aws/iam_policies.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -66,7 +66,7 @@ func (b *backend) getGroupPolicies(ctx context.Context, s logical.Storage, iamGr
 		return nil, nil, nil
 	}
 
-	iamClient, err = b.clientIAM(ctx, s)
+	iamClient, err = b.clientIAM(ctx, s, nil)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/builtin/logical/aws/iam_policies_test.go b/builtin/logical/aws/iam_policies_test.go
index 15d0ab80164..17ca8645b19 100644
--- a/builtin/logical/aws/iam_policies_test.go
+++ b/builtin/logical/aws/iam_policies_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
diff --git a/builtin/logical/aws/path_config_lease.go b/builtin/logical/aws/path_config_lease.go
index 0e2ad43afe8..e27cb9cc127 100644
--- a/builtin/logical/aws/path_config_lease.go
+++ b/builtin/logical/aws/path_config_lease.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
diff --git a/builtin/logical/aws/path_config_root.go b/builtin/logical/aws/path_config_root.go
index a361395eeed..0f58a3511bf 100644
--- a/builtin/logical/aws/path_config_root.go
+++ b/builtin/logical/aws/path_config_root.go
@@ -1,19 +1,27 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
 
 import (
 	"context"
+	"errors"
+	"fmt"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/automatedrotationutil"
 	"github.com/hashicorp/vault/sdk/helper/pluginidentityutil"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/rotation"
 )
 
 // A single default template that supports both the different credential types (IAM/STS) that are capped at differing length limits (64 chars/32 chars respectively)
-const defaultUserNameTemplate = `{{ if (eq .Type "STS") }}{{ printf "vault-%s-%s"  (unix_time) (random 20) | truncate 32 }}{{ else }}{{ printf "vault-%s-%s-%s" (printf "%s-%s" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}{{ end }}`
+const (
+	defaultUserNameTemplate = `{{ if (eq .Type "STS") }}{{ printf "vault-%s-%s"  (unix_time) (random 20) | truncate 32 }}{{ else }}{{ printf "vault-%s-%s-%s" (printf "%s-%s" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}{{ end }}`
+	rootRotationJobName     = "aws-root-creds"
+)
 
 func pathConfigRoot(b *backend) *framework.Path {
 	p := &framework.Path{
@@ -46,6 +54,18 @@ func pathConfigRoot(b *backend) *framework.Path {
 				Type:        framework.TypeString,
 				Description: "Endpoint to custom STS server URL",
 			},
+			"sts_region": {
+				Type:        framework.TypeString,
+				Description: "Specific region for STS API calls.",
+			},
+			"sts_fallback_endpoints": {
+				Type:        framework.TypeCommaStringSlice,
+				Description: "Fallback endpoints if sts_endpoint is unreachable",
+			},
+			"sts_fallback_regions": {
+				Type:        framework.TypeCommaStringSlice,
+				Description: "Fallback regions if sts_region is unreachable",
+			},
 			"max_retries": {
 				Type:        framework.TypeInt,
 				Default:     aws.UseServiceDefaultRetries,
@@ -61,6 +81,8 @@ func pathConfigRoot(b *backend) *framework.Path {
 			},
 		},
 
+		ExistenceCheck: b.pathConfigRootExistenceCheck,
+
 		Operations: map[logical.Operation]framework.OperationHandler{
 			logical.ReadOperation: &framework.PathOperation{
 				Callback: b.pathConfigRootRead,
@@ -74,6 +96,17 @@ func pathConfigRoot(b *backend) *framework.Path {
 					OperationVerb:   "configure",
 					OperationSuffix: "root-iam-credentials",
 				},
+				ForwardPerformanceSecondary: true,
+				ForwardPerformanceStandby:   true,
+			},
+			logical.CreateOperation: &framework.PathOperation{
+				Callback: b.pathConfigRootWrite,
+				DisplayAttrs: &framework.DisplayAttributes{
+					OperationVerb:   "configure",
+					OperationSuffix: "root-iam-credentials",
+				},
+				ForwardPerformanceSecondary: true,
+				ForwardPerformanceStandby:   true,
 			},
 		},
 
@@ -81,71 +114,145 @@ func pathConfigRoot(b *backend) *framework.Path {
 		HelpDescription: pathConfigRootHelpDesc,
 	}
 	pluginidentityutil.AddPluginIdentityTokenFields(p.Fields)
+	automatedrotationutil.AddAutomatedRotationFields(p.Fields)
 
 	return p
 }
 
+// Establishes dichotomy of request operation between CreateOperation and UpdateOperation.
+// Returning 'true' forces an UpdateOperation, CreateOperation otherwise.
+func (b *backend) pathConfigRootExistenceCheck(ctx context.Context, req *logical.Request, data *framework.FieldData) (bool, error) {
+	entry, err := getConfigFromStorage(ctx, req)
+	if err != nil {
+		return false, err
+	}
+	return entry != nil, nil
+}
+
 func (b *backend) pathConfigRootRead(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 	b.clientMutex.RLock()
 	defer b.clientMutex.RUnlock()
 
-	entry, err := req.Storage.Get(ctx, "config/root")
+	config, err := getConfigFromStorage(ctx, req)
 	if err != nil {
 		return nil, err
 	}
-	if entry == nil {
+	if config == nil {
 		return nil, nil
 	}
 
-	var config rootConfig
-
-	if err := entry.DecodeJSON(&config); err != nil {
-		return nil, err
-	}
-
 	configData := map[string]interface{}{
-		"access_key":        config.AccessKey,
-		"region":            config.Region,
-		"iam_endpoint":      config.IAMEndpoint,
-		"sts_endpoint":      config.STSEndpoint,
-		"max_retries":       config.MaxRetries,
-		"username_template": config.UsernameTemplate,
-		"role_arn":          config.RoleARN,
+		"access_key":             config.AccessKey,
+		"region":                 config.Region,
+		"iam_endpoint":           config.IAMEndpoint,
+		"sts_endpoint":           config.STSEndpoint,
+		"sts_region":             config.STSRegion,
+		"sts_fallback_endpoints": config.STSFallbackEndpoints,
+		"sts_fallback_regions":   config.STSFallbackRegions,
+		"max_retries":            config.MaxRetries,
+		"username_template":      config.UsernameTemplate,
+		"role_arn":               config.RoleARN,
 	}
 
 	config.PopulatePluginIdentityTokenData(configData)
+	config.PopulateAutomatedRotationData(configData)
+
 	return &logical.Response{
 		Data: configData,
 	}, nil
 }
 
 func (b *backend) pathConfigRootWrite(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
-	region := data.Get("region").(string)
-	iamendpoint := data.Get("iam_endpoint").(string)
-	stsendpoint := data.Get("sts_endpoint").(string)
-	maxretries := data.Get("max_retries").(int)
-	roleARN := data.Get("role_arn").(string)
+	b.clientMutex.Lock()
+	defer b.clientMutex.Unlock()
+
+	// check for existing config
+	rc, err := getConfigFromStorage(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+
+	if rc == nil {
+		// Baseline
+		rc = &rootConfig{}
+	}
+
+	if accessKey, ok := data.GetOk("access_key"); ok {
+		rc.AccessKey = accessKey.(string)
+	} else if req.Operation == logical.CreateOperation {
+		rc.AccessKey = data.Get("access_key").(string)
+	}
+
+	if secretKey, ok := data.GetOk("secret_key"); ok {
+		rc.SecretKey = secretKey.(string)
+	} else if req.Operation == logical.CreateOperation {
+		rc.SecretKey = data.Get("secret_key").(string)
+	}
+
+	if region, ok := data.GetOk("region"); ok {
+		rc.Region = region.(string)
+	} else if req.Operation == logical.CreateOperation {
+		rc.Region = data.Get("region").(string)
+	}
+
+	if iamEndpoint, ok := data.GetOk("iam_endpoint"); ok {
+		rc.IAMEndpoint = iamEndpoint.(string)
+	} else if req.Operation == logical.CreateOperation {
+		rc.IAMEndpoint = data.Get("iam_endpoint").(string)
+	}
+
+	if stsEndpoint, ok := data.GetOk("sts_endpoint"); ok {
+		rc.STSEndpoint = stsEndpoint.(string)
+	} else if req.Operation == logical.CreateOperation {
+		rc.STSEndpoint = data.Get("sts_endpoint").(string)
+	}
+
+	if stsRegion, ok := data.GetOk("sts_region"); ok {
+		rc.STSRegion = stsRegion.(string)
+	} else if req.Operation == logical.CreateOperation {
+		rc.STSRegion = data.Get("sts_region").(string)
+	}
+
+	if maxRetries, ok := data.GetOk("max_retries"); ok {
+		rc.MaxRetries = maxRetries.(int)
+	} else if req.Operation == logical.CreateOperation {
+		rc.MaxRetries = data.Get("max_retries").(int)
+	}
+
+	if roleARN, ok := data.GetOk("role_arn"); ok {
+		rc.RoleARN = roleARN.(string)
+	} else if req.Operation == logical.CreateOperation {
+		rc.RoleARN = data.Get("role_arn").(string)
+	}
+
+	if stsFallbackEndpoints, ok := data.GetOk("sts_fallback_endpoints"); ok {
+		rc.STSFallbackEndpoints = stsFallbackEndpoints.([]string)
+	} else if req.Operation == logical.CreateOperation {
+		rc.STSFallbackEndpoints = data.Get("sts_fallback_endpoints").([]string)
+	}
+
+	if stsFallbackRegions, ok := data.GetOk("sts_fallback_regions"); ok {
+		rc.STSFallbackRegions = stsFallbackRegions.([]string)
+	} else if req.Operation == logical.CreateOperation {
+		rc.STSFallbackRegions = data.Get("sts_fallback_regions").([]string)
+	}
+
 	usernameTemplate := data.Get("username_template").(string)
 	if usernameTemplate == "" {
 		usernameTemplate = defaultUserNameTemplate
 	}
+	rc.UsernameTemplate = usernameTemplate
 
-	b.clientMutex.Lock()
-	defer b.clientMutex.Unlock()
-
-	rc := rootConfig{
-		AccessKey:        data.Get("access_key").(string),
-		SecretKey:        data.Get("secret_key").(string),
-		IAMEndpoint:      iamendpoint,
-		STSEndpoint:      stsendpoint,
-		Region:           region,
-		MaxRetries:       maxretries,
-		UsernameTemplate: usernameTemplate,
-		RoleARN:          roleARN,
+	if len(rc.STSFallbackEndpoints) != len(rc.STSFallbackRegions) {
+		return logical.ErrorResponse("fallback endpoints and fallback regions must be the same length"), nil
 	}
+
 	if err := rc.ParsePluginIdentityTokenFields(data); err != nil {
 		return logical.ErrorResponse(err.Error()), nil
 	}
+	if err := rc.ParseAutomatedRotationFields(data); err != nil {
+		return logical.ErrorResponse(err.Error()), nil
+	}
 
 	if rc.IdentityTokenAudience != "" && rc.AccessKey != "" {
 		return logical.ErrorResponse("only one of 'access_key' or 'identity_token_audience' can be set"), nil
@@ -155,13 +262,58 @@ func (b *backend) pathConfigRootWrite(ctx context.Context, req *logical.Request,
 		return logical.ErrorResponse("missing required 'role_arn' when 'identity_token_audience' is set"), nil
 	}
 
-	entry, err := logical.StorageEntryJSON("config/root", rc)
-	if err != nil {
-		return nil, err
+	if rc.IdentityTokenAudience != "" {
+		_, err := b.System().GenerateIdentityToken(ctx, &pluginutil.IdentityTokenRequest{
+			Audience: rc.IdentityTokenAudience,
+		})
+		if err != nil {
+			if errors.Is(err, pluginidentityutil.ErrPluginWorkloadIdentityUnsupported) {
+				return logical.ErrorResponse(err.Error()), nil
+			}
+			return nil, err
+		}
 	}
 
-	if err := req.Storage.Put(ctx, entry); err != nil {
-		return nil, err
+	var performedRotationManagerOpern string
+	if rc.ShouldDeregisterRotationJob() {
+		performedRotationManagerOpern = rotation.PerformedDeregistration
+		// Disable Automated Rotation and Deregister credentials if required
+		deregisterReq := &rotation.RotationJobDeregisterRequest{
+			MountPoint: req.MountPoint,
+			ReqPath:    req.Path,
+		}
+
+		b.Logger().Debug("Deregistering rotation job", "mount", req.MountPoint+req.Path)
+		if err := b.System().DeregisterRotationJob(ctx, deregisterReq); err != nil {
+			return logical.ErrorResponse("error deregistering rotation job: %s", err), nil
+		}
+	} else if rc.ShouldRegisterRotationJob() {
+		performedRotationManagerOpern = rotation.PerformedRegistration
+		// Register the rotation job if it's required.
+		cfgReq := &rotation.RotationJobConfigureRequest{
+			MountPoint:       req.MountPoint,
+			ReqPath:          req.Path,
+			RotationSchedule: rc.RotationSchedule,
+			RotationWindow:   rc.RotationWindow,
+			RotationPeriod:   rc.RotationPeriod,
+		}
+
+		b.Logger().Debug("Registering rotation job", "mount", req.MountPoint+req.Path)
+		if _, err = b.System().RegisterRotationJob(ctx, cfgReq); err != nil {
+			return logical.ErrorResponse("error registering rotation job: %s", err), nil
+		}
+	}
+
+	// Save the config
+	if err := putConfigToStorage(ctx, req, rc); err != nil {
+		wrappedError := err
+		if performedRotationManagerOpern != "" {
+			b.Logger().Error("write to storage failed but the rotation manager still succeeded.",
+				"operation", performedRotationManagerOpern, "mount", req.MountPoint, "path", req.Path)
+			wrappedError = fmt.Errorf("write to storage failed but the rotation manager still succeeded; "+
+				"operation=%s, mount=%s, path=%s, storageError=%s", performedRotationManagerOpern, req.MountPoint, req.Path, err)
+		}
+		return nil, wrappedError
 	}
 
 	// clear possible cached IAM / STS clients after successfully updating
@@ -172,17 +324,52 @@ func (b *backend) pathConfigRootWrite(ctx context.Context, req *logical.Request,
 	return nil, nil
 }
 
+func getConfigFromStorage(ctx context.Context, req *logical.Request) (*rootConfig, error) {
+	entry, err := req.Storage.Get(ctx, "config/root")
+	if err != nil {
+		return nil, err
+	}
+	if entry == nil {
+		return nil, nil
+	}
+
+	var config rootConfig
+
+	if err := entry.DecodeJSON(&config); err != nil {
+		return nil, err
+	}
+
+	return &config, nil
+}
+
+func putConfigToStorage(ctx context.Context, req *logical.Request, rc *rootConfig) error {
+	entry, err := logical.StorageEntryJSON("config/root", rc)
+	if err != nil {
+		return err
+	}
+
+	if err := req.Storage.Put(ctx, entry); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 type rootConfig struct {
 	pluginidentityutil.PluginIdentityTokenParams
+	automatedrotationutil.AutomatedRotationParams
 
-	AccessKey        string `json:"access_key"`
-	SecretKey        string `json:"secret_key"`
-	IAMEndpoint      string `json:"iam_endpoint"`
-	STSEndpoint      string `json:"sts_endpoint"`
-	Region           string `json:"region"`
-	MaxRetries       int    `json:"max_retries"`
-	UsernameTemplate string `json:"username_template"`
-	RoleARN          string `json:"role_arn"`
+	AccessKey            string   `json:"access_key"`
+	SecretKey            string   `json:"secret_key"`
+	IAMEndpoint          string   `json:"iam_endpoint"`
+	STSEndpoint          string   `json:"sts_endpoint"`
+	STSRegion            string   `json:"sts_region"`
+	STSFallbackEndpoints []string `json:"sts_fallback_endpoints"`
+	STSFallbackRegions   []string `json:"sts_fallback_regions"`
+	Region               string   `json:"region"`
+	MaxRetries           int      `json:"max_retries"`
+	UsernameTemplate     string   `json:"username_template"`
+	RoleARN              string   `json:"role_arn"`
 }
 
 const pathConfigRootHelpSyn = `
diff --git a/builtin/logical/aws/path_config_root_test.go b/builtin/logical/aws/path_config_root_test.go
index 0e1c0186025..b82a63d3497 100644
--- a/builtin/logical/aws/path_config_root_test.go
+++ b/builtin/logical/aws/path_config_root_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -6,37 +6,50 @@ package aws
 import (
 	"context"
 	"reflect"
-	"strings"
 	"testing"
+	"time"
 
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/sdk/helper/automatedrotationutil"
+	"github.com/hashicorp/vault/sdk/helper/pluginidentityutil"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/rotation"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestBackend_PathConfigRoot(t *testing.T) {
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
 
 	b := Backend(config)
 	if err := b.Setup(context.Background(), config); err != nil {
 		t.Fatal(err)
 	}
 
+	// Create operation
 	configData := map[string]interface{}{
-		"access_key":              "AKIAEXAMPLE",
-		"secret_key":              "RandomData",
-		"region":                  "us-west-2",
-		"iam_endpoint":            "https://iam.amazonaws.com",
-		"sts_endpoint":            "https://sts.us-west-2.amazonaws.com",
-		"max_retries":             10,
-		"username_template":       defaultUserNameTemplate,
-		"role_arn":                "",
-		"identity_token_audience": "",
-		"identity_token_ttl":      int64(0),
+		"access_key":                 "AKIAEXAMPLE",
+		"secret_key":                 "RandomData",
+		"region":                     "us-west-2",
+		"iam_endpoint":               "https://iam.amazonaws.com",
+		"sts_endpoint":               "https://sts.us-west-2.amazonaws.com",
+		"sts_region":                 "",
+		"sts_fallback_endpoints":     []string{},
+		"sts_fallback_regions":       []string{},
+		"role_arn":                   "",
+		"identity_token_audience":    "",
+		"identity_token_ttl":         int64(0),
+		"rotation_schedule":          "",
+		"rotation_period":            time.Duration(0).Seconds(),
+		"rotation_window":            time.Duration(0).Seconds(),
+		"disable_automated_rotation": false,
 	}
 
 	configReq := &logical.Request{
-		Operation: logical.UpdateOperation,
+		Operation: logical.CreateOperation,
 		Storage:   config.StorageView,
 		Path:      "config/root",
 		Data:      configData,
@@ -56,6 +69,58 @@ func TestBackend_PathConfigRoot(t *testing.T) {
 		t.Fatalf("bad: config reading failed: resp:%#v\n err: %v", resp, err)
 	}
 
+	// Ensure default values are enforced
+	configData["max_retries"] = -1
+	configData["username_template"] = defaultUserNameTemplate
+
+	delete(configData, "secret_key")
+	require.Equal(t, configData, resp.Data)
+	if !reflect.DeepEqual(resp.Data, configData) {
+		t.Errorf("bad: expected to read config root as %#v, got %#v instead", configData, resp.Data)
+	}
+
+	// Update operation
+	configData = map[string]interface{}{
+		"access_key":                 "AKIAEXAMPLE",
+		"secret_key":                 "RandomData",
+		"region":                     "us-west-2",
+		"iam_endpoint":               "https://iam.amazonaws.com",
+		"sts_endpoint":               "https://sts.us-west-2.amazonaws.com",
+		"sts_region":                 "",
+		"sts_fallback_endpoints":     []string{},
+		"sts_fallback_regions":       []string{},
+		"max_retries":                10,
+		"username_template":          defaultUserNameTemplate,
+		"role_arn":                   "",
+		"identity_token_audience":    "",
+		"identity_token_ttl":         int64(0),
+		"rotation_schedule":          "",
+		"rotation_period":            time.Duration(0).Seconds(),
+		"rotation_window":            time.Duration(0).Seconds(),
+		"disable_automated_rotation": false,
+	}
+
+	configReq = &logical.Request{
+		Operation: logical.UpdateOperation,
+		Storage:   config.StorageView,
+		Path:      "config/root",
+		Data:      configData,
+	}
+
+	resp, err = b.HandleRequest(context.Background(), configReq)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: config writing failed: resp:%#v\n err: %v", resp, err)
+	}
+
+	resp, err = b.HandleRequest(context.Background(), &logical.Request{
+		Operation: logical.ReadOperation,
+		Storage:   config.StorageView,
+		Path:      "config/root",
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: config reading failed: resp:%#v\n err: %v", resp, err)
+	}
+
 	delete(configData, "secret_key")
 	require.Equal(t, configData, resp.Data)
 	if !reflect.DeepEqual(resp.Data, configData) {
@@ -63,12 +128,11 @@ func TestBackend_PathConfigRoot(t *testing.T) {
 	}
 }
 
-// TestBackend_PathConfigRoot_PluginIdentityToken tests parsing and validation of
-// configuration used to set the secret engine up for web identity federation using
-// plugin identity tokens.
-func TestBackend_PathConfigRoot_PluginIdentityToken(t *testing.T) {
+// TestBackend_PathConfigRoot_STSFallback tests valid versions of STS fallback parameters - slice and csv
+func TestBackend_PathConfigRoot_STSFallback(t *testing.T) {
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
 
 	b := Backend(config)
 	if err := b.Setup(context.Background(), config); err != nil {
@@ -76,9 +140,22 @@ func TestBackend_PathConfigRoot_PluginIdentityToken(t *testing.T) {
 	}
 
 	configData := map[string]interface{}{
-		"identity_token_ttl":      int64(10),
-		"identity_token_audience": "test-aud",
-		"role_arn":                "test-role-arn",
+		"access_key":                 "AKIAEXAMPLE",
+		"secret_key":                 "RandomData",
+		"region":                     "us-west-2",
+		"iam_endpoint":               "https://iam.amazonaws.com",
+		"sts_endpoint":               "https://sts.us-west-2.amazonaws.com",
+		"sts_region":                 "",
+		"sts_fallback_endpoints":     []string{"192.168.1.1", "127.0.0.1"},
+		"sts_fallback_regions":       []string{"my-house-1", "my-house-2"},
+		"max_retries":                10,
+		"username_template":          defaultUserNameTemplate,
+		"role_arn":                   "",
+		"identity_token_audience":    "",
+		"identity_token_ttl":         int64(0),
+		"rotation_schedule":          "",
+		"rotation_window":            time.Duration(0).Seconds(),
+		"disable_automated_rotation": false,
 	}
 
 	configReq := &logical.Request{
@@ -102,21 +179,32 @@ func TestBackend_PathConfigRoot_PluginIdentityToken(t *testing.T) {
 		t.Fatalf("bad: config reading failed: resp:%#v\n err: %v", resp, err)
 	}
 
-	// Grab the subset of fields from the response we care to look at for this case
-	got := map[string]interface{}{
-		"identity_token_ttl":      resp.Data["identity_token_ttl"],
-		"identity_token_audience": resp.Data["identity_token_audience"],
-		"role_arn":                resp.Data["role_arn"],
-	}
-
-	if !reflect.DeepEqual(got, configData) {
+	delete(configData, "secret_key")
+	// remove rotation_period from response for comparison with original config
+	delete(resp.Data, "rotation_period")
+	require.Equal(t, configData, resp.Data)
+	if !reflect.DeepEqual(resp.Data, configData) {
 		t.Errorf("bad: expected to read config root as %#v, got %#v instead", configData, resp.Data)
 	}
 
-	// mutually exclusive fields must result in an error
+	// test we can handle comma separated strings, per CommaStringSlice
 	configData = map[string]interface{}{
-		"identity_token_audience": "test-aud",
-		"access_key":              "ASIAIO10230XVB",
+		"access_key":                 "AKIAEXAMPLE",
+		"secret_key":                 "RandomData",
+		"region":                     "us-west-2",
+		"iam_endpoint":               "https://iam.amazonaws.com",
+		"sts_endpoint":               "https://sts.us-west-2.amazonaws.com",
+		"sts_region":                 "",
+		"sts_fallback_endpoints":     "1.1.1.1,8.8.8.8",
+		"sts_fallback_regions":       "zone-1,zone-2",
+		"max_retries":                10,
+		"username_template":          defaultUserNameTemplate,
+		"role_arn":                   "",
+		"identity_token_audience":    "",
+		"identity_token_ttl":         int64(0),
+		"rotation_schedule":          "",
+		"rotation_window":            time.Duration(0).Seconds(),
+		"disable_automated_rotation": false,
 	}
 
 	configReq = &logical.Request{
@@ -127,32 +215,411 @@ func TestBackend_PathConfigRoot_PluginIdentityToken(t *testing.T) {
 	}
 
 	resp, err = b.HandleRequest(context.Background(), configReq)
-	if !resp.IsError() {
-		t.Fatalf("expected an error but got nil")
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: config writing failed: resp:%#v\n err: %v", resp, err)
 	}
-	expectedError := "only one of 'access_key' or 'identity_token_audience' can be set"
-	if !strings.Contains(resp.Error().Error(), expectedError) {
-		t.Fatalf("expected err %s, got %s", expectedError, resp.Error())
+
+	resp, err = b.HandleRequest(context.Background(), &logical.Request{
+		Operation: logical.ReadOperation,
+		Storage:   config.StorageView,
+		Path:      "config/root",
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: config reading failed: resp:%#v\n err: %v", resp, err)
 	}
 
-	// missing role arn with audience must result in an error
-	configData = map[string]interface{}{
+	delete(configData, "secret_key")
+	// remove rotation_period from response for comparison with original config
+	delete(resp.Data, "rotation_period")
+	configData["sts_fallback_endpoints"] = []string{"1.1.1.1", "8.8.8.8"}
+	configData["sts_fallback_regions"] = []string{"zone-1", "zone-2"}
+	require.Equal(t, configData, resp.Data)
+	if !reflect.DeepEqual(resp.Data, configData) {
+		t.Errorf("bad: expected to read config root as %#v, got %#v instead", configData, resp.Data)
+	}
+}
+
+// TestBackend_PathConfigRoot_STSFallback_mismatchedfallback ensures configuration writing will fail if the
+// region/endpoint entries are different lengths
+func TestBackend_PathConfigRoot_STSFallback_mismatchedfallback(t *testing.T) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
+	b := Backend(config)
+	if err := b.Setup(context.Background(), config); err != nil {
+		t.Fatal(err)
+	}
+
+	// test we can handle comma separated strings, per CommaStringSlice
+	configData := map[string]interface{}{
+		"access_key":              "AKIAEXAMPLE",
+		"secret_key":              "RandomData",
+		"region":                  "us-west-2",
+		"iam_endpoint":            "https://iam.amazonaws.com",
+		"sts_endpoint":            "https://sts.us-west-2.amazonaws.com",
+		"sts_region":              "",
+		"sts_fallback_endpoints":  "1.1.1.1,8.8.8.8",
+		"sts_fallback_regions":    "zone-1,zone-2",
+		"max_retries":             10,
+		"username_template":       defaultUserNameTemplate,
+		"role_arn":                "",
+		"identity_token_audience": "",
+		"identity_token_ttl":      int64(0),
+	}
+
+	configReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Storage:   config.StorageView,
+		Path:      "config/root",
+		Data:      configData,
+	}
+
+	resp, err := b.HandleRequest(context.Background(), configReq)
+	if err != nil {
+		t.Fatalf("bad: config writing failed: err: %v", err)
+	}
+	if resp != nil && !resp.IsError() {
+		t.Fatalf("expected an error, but it successfully wrote")
+	}
+}
+
+// TestBackend_PathConfigRoot_STSFallback_defaultEndpointRegion ensures that if no endpoints are specified, we can
+// still make a config with the appropriate values.
+func TestBackend_PathConfigRoot_STSFallback_defaultEndpointRegion(t *testing.T) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
+	b := Backend(config)
+	if err := b.Setup(context.Background(), config); err != nil {
+		t.Fatal(err)
+	}
+
+	configData := map[string]interface{}{
+		"access_key":              "AKIAEXAMPLE",
+		"secret_key":              "RandomData",
+		"max_retries":             10,
+		"username_template":       defaultUserNameTemplate,
+		"role_arn":                "",
+		"identity_token_audience": "",
+		"identity_token_ttl":      int64(0),
+	}
+
+	configReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Storage:   config.StorageView,
+		Path:      "config/root",
+		Data:      configData,
+	}
+
+	_, err := b.HandleRequest(context.Background(), configReq)
+	if err != nil {
+		t.Fatalf("bad: config writing failed: err: %v", err)
+	}
+
+	cfgs, err := b.getRootSTSConfigs(context.Background(), config.StorageView, b.Logger())
+	if err != nil {
+		t.Fatalf("couldn't get STS configs with default region/endpoints: %v", err)
+	}
+	if len(cfgs) != 1 {
+		t.Fatalf("got %d configs, but expected 1", len(cfgs))
+	} else {
+		cfg := cfgs[0]
+		if *(cfg.Endpoint) != matchingSTSEndpoint(*(cfg.Region)) {
+			t.Fatalf("region and endpoint didn't match: %s vs. %s", *(cfg.Region), *(cfg.Endpoint))
+		}
+	}
+}
+
+// TestBackend_PathConfigRoot_IAM_specifiedRegion ensures that if a region is set, we get a good config (with a blank
+// endpoint)
+func TestBackend_PathConfigRoot_IAM_specifiedRegion(t *testing.T) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
+	b := Backend(config)
+	if err := b.Setup(context.Background(), config); err != nil {
+		t.Fatal(err)
+	}
+
+	desiredRegion := "us-west-2"
+
+	configData := map[string]interface{}{
+		"access_key":              "AKIAEXAMPLE",
+		"secret_key":              "RandomData",
+		"max_retries":             10,
+		"username_template":       defaultUserNameTemplate,
+		"region":                  desiredRegion,
+		"role_arn":                "",
+		"identity_token_audience": "",
+		"identity_token_ttl":      int64(0),
+	}
+
+	configReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Storage:   config.StorageView,
+		Path:      "config/root",
+		Data:      configData,
+	}
+
+	_, err := b.HandleRequest(context.Background(), configReq)
+	if err != nil {
+		t.Fatalf("bad: config writing failed: err: %v", err)
+	}
+
+	cfg, err := b.getRootIAMConfig(context.Background(), config.StorageView, b.Logger())
+	if err != nil {
+		t.Fatalf("couldn't get IAM configs with default region/endpoints: %v", err)
+	}
+	if *(cfg.Endpoint) != "" {
+		t.Fatalf("endpoint should have remained blank but it became %s", *(cfg.Endpoint))
+	}
+	if *(cfg.Region) != desiredRegion {
+		t.Fatalf("region changed from config: %s became %s", desiredRegion, *(cfg.Region))
+	}
+}
+
+// TestBackend_PathConfigRoot_IAM_specifiedRegionAndEndpoint ensures that if a region and endpoint are set, we get a
+// good config
+func TestBackend_PathConfigRoot_IAM_specifiedRegionAndEndpoint(t *testing.T) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
+	b := Backend(config)
+	if err := b.Setup(context.Background(), config); err != nil {
+		t.Fatal(err)
+	}
+
+	desiredRegion := "custom-region"
+	desiredEndpoint := "https://custom-endpoint.local"
+
+	configData := map[string]interface{}{
+		"access_key":              "AKIAEXAMPLE",
+		"secret_key":              "RandomData",
+		"max_retries":             10,
+		"username_template":       defaultUserNameTemplate,
+		"region":                  desiredRegion,
+		"iam_endpoint":            desiredEndpoint,
+		"role_arn":                "",
+		"identity_token_audience": "",
+		"identity_token_ttl":      int64(0),
+	}
+
+	configReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Storage:   config.StorageView,
+		Path:      "config/root",
+		Data:      configData,
+	}
+
+	_, err := b.HandleRequest(context.Background(), configReq)
+	if err != nil {
+		t.Fatalf("bad: config writing failed: err: %v", err)
+	}
+
+	cfg, err := b.getRootIAMConfig(context.Background(), config.StorageView, b.Logger())
+	if err != nil {
+		t.Fatalf("couldn't get IAM configs with default region/endpoints: %v", err)
+	}
+
+	if *(cfg.Endpoint) != desiredEndpoint {
+		t.Fatalf("endpoint should have been %s but it became %s", desiredEndpoint, *(cfg.Endpoint))
+	}
+	if *(cfg.Region) != desiredRegion {
+		t.Fatalf("region changed from config: %s became %s", desiredRegion, *(cfg.Region))
+	}
+}
+
+// TestBackend_PathConfigRoot_IAM_defaultEndpointRegion ensures that if no endpoints are specified, we can still
+// make a config with the appropriate values.
+func TestBackend_PathConfigRoot_IAM_defaultEndpointRegion(t *testing.T) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
+	b := Backend(config)
+	if err := b.Setup(context.Background(), config); err != nil {
+		t.Fatal(err)
+	}
+
+	configData := map[string]interface{}{
+		"access_key":              "AKIAEXAMPLE",
+		"secret_key":              "RandomData",
+		"max_retries":             10,
+		"username_template":       defaultUserNameTemplate,
+		"role_arn":                "",
+		"identity_token_audience": "",
+		"identity_token_ttl":      int64(0),
+	}
+
+	configReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Storage:   config.StorageView,
+		Path:      "config/root",
+		Data:      configData,
+	}
+
+	_, err := b.HandleRequest(context.Background(), configReq)
+	if err != nil {
+		t.Fatalf("bad: config writing failed: err: %v", err)
+	}
+
+	cfg, err := b.getRootIAMConfig(context.Background(), config.StorageView, b.Logger())
+	if err != nil {
+		t.Fatalf("couldn't get IAM configs with default region/endpoints: %v", err)
+	}
+	// ensure endpoint is blank, because AWS wants that
+	if *(cfg.Endpoint) != "" {
+		t.Fatalf("expected endpoint to be blank but it was %s", *(cfg.Endpoint))
+	}
+}
+
+// TestBackend_PathConfigRoot_STSIAM_SetEverything ensures that if both IAM and STS are configured, they interact
+// correctly.
+func TestBackend_PathConfigRoot_STSIAM_SetEverything(t *testing.T) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
+	b := Backend(config)
+	if err := b.Setup(context.Background(), config); err != nil {
+		t.Fatal(err)
+	}
+
+	desiredRegion := "us-west-2"
+	stsRegion := "us-east-1"
+	stsEndpoint := "https://sts.us-east-1.amazonaws.com"
+
+	configData := map[string]interface{}{
+		"access_key":              "AKIAEXAMPLE",
+		"secret_key":              "RandomData",
+		"max_retries":             10,
+		"username_template":       defaultUserNameTemplate,
+		"region":                  desiredRegion,
+		"sts_region":              stsRegion,
+		"sts_endpoint":            stsEndpoint,
+		"sts_fallback_regions":    "ap-west-1,fake-region-2",
+		"sts_fallback_endpoints":  "1.1.1.1,192.168.2.3",
+		"role_arn":                "",
+		"identity_token_audience": "",
+		"identity_token_ttl":      int64(0),
+	}
+
+	configReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Storage:   config.StorageView,
+		Path:      "config/root",
+		Data:      configData,
+	}
+
+	_, err := b.HandleRequest(context.Background(), configReq)
+	if err != nil {
+		t.Fatalf("bad: config writing failed: err: %v", err)
+	}
+
+	// get IAM
+	cfg, err := b.getRootIAMConfig(context.Background(), config.StorageView, b.Logger())
+	if err != nil {
+		t.Fatalf("couldn't get IAM configs with default region/endpoints: %v", err)
+	}
+
+	if *(cfg.Endpoint) != "" {
+		t.Fatalf("endpoint should have remained blank but it became %s", *(cfg.Endpoint))
+	}
+	if *(cfg.Region) != desiredRegion {
+		t.Fatalf("region changed from config: %s became %s", desiredRegion, *(cfg.Region))
+	}
+
+	// get STS
+	cfgs, err := b.getRootSTSConfigs(context.Background(), config.StorageView, b.Logger())
+	if err != nil {
+		t.Fatalf("couldn't get IAM configs with default region/endpoints: %v", err)
+	}
+	if len(cfgs) != 3 {
+		t.Fatalf("got %d configs, but expected 3", len(cfgs))
+	}
+}
+
+// TestBackend_PathConfigRoot_PluginIdentityToken tests that configuration
+// of plugin WIF returns an immediate error.
+func TestBackend_PathConfigRoot_PluginIdentityToken(t *testing.T) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
+	b := Backend(config)
+	if err := b.Setup(context.Background(), config); err != nil {
+		t.Fatal(err)
+	}
+
+	configData := map[string]interface{}{
+		"identity_token_ttl":      int64(10),
 		"identity_token_audience": "test-aud",
+		"role_arn":                "test-role-arn",
 	}
 
-	configReq = &logical.Request{
+	configReq := &logical.Request{
 		Operation: logical.UpdateOperation,
 		Storage:   config.StorageView,
 		Path:      "config/root",
 		Data:      configData,
 	}
 
-	resp, err = b.HandleRequest(context.Background(), configReq)
-	if !resp.IsError() {
-		t.Fatalf("expected an error but got nil")
+	resp, err := b.HandleRequest(context.Background(), configReq)
+	assert.NoError(t, err)
+	assert.NotNil(t, resp)
+	assert.ErrorContains(t, resp.Error(), pluginidentityutil.ErrPluginWorkloadIdentityUnsupported.Error())
+}
+
+// TestBackend_PathConfigRoot_RegisterRootRotation tests that configuration
+// and registering a root credential returns an immediate error.
+func TestBackend_PathConfigRoot_RegisterRootRotation(t *testing.T) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
+	nsCtx := namespace.ContextWithNamespace(context.Background(), namespace.RootNamespace)
+
+	b := Backend(config)
+	if err := b.Setup(nsCtx, config); err != nil {
+		t.Fatal(err)
 	}
-	expectedError = "missing required 'role_arn' when 'identity_token_audience' is set"
-	if !strings.Contains(resp.Error().Error(), expectedError) {
-		t.Fatalf("expected err %s, got %s", expectedError, resp.Error())
+
+	configData := map[string]interface{}{
+		"access_key":        "access-key",
+		"secret_key":        "secret-key",
+		"rotation_schedule": "*/1 * * * *",
+		"rotation_window":   120,
+	}
+
+	configReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Storage:   config.StorageView,
+		Path:      "config/root",
+		Data:      configData,
 	}
+
+	resp, err := b.HandleRequest(context.Background(), configReq)
+	assert.NoError(t, err)
+	assert.NotNil(t, resp)
+	assert.ErrorContains(t, resp.Error(), automatedrotationutil.ErrRotationManagerUnsupported.Error())
+}
+
+type testSystemView struct {
+	logical.StaticSystemView
+}
+
+func (d testSystemView) GenerateIdentityToken(_ context.Context, _ *pluginutil.IdentityTokenRequest) (*pluginutil.IdentityTokenResponse, error) {
+	return nil, pluginidentityutil.ErrPluginWorkloadIdentityUnsupported
+}
+
+func (d testSystemView) RegisterRotationJob(_ context.Context, _ *rotation.RotationJobConfigureRequest) (string, error) {
+	return "", automatedrotationutil.ErrRotationManagerUnsupported
+}
+
+func (d testSystemView) DeregisterRotationJob(_ context.Context, _ *rotation.RotationJobDeregisterRequest) error {
+	return nil
 }
diff --git a/builtin/logical/aws/path_config_rotate_root.go b/builtin/logical/aws/path_config_rotate_root.go
index 72f9c82e4d0..7da2e53f799 100644
--- a/builtin/logical/aws/path_config_rotate_root.go
+++ b/builtin/logical/aws/path_config_rotate_root.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -37,8 +37,12 @@ func pathConfigRotateRoot(b *backend) *framework.Path {
 }
 
 func (b *backend) pathConfigRotateRootUpdate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	return b.rotateRoot(ctx, req)
+}
+
+func (b *backend) rotateRoot(ctx context.Context, req *logical.Request) (*logical.Response, error) {
 	// have to get the client config first because that takes out a read lock
-	client, err := b.clientIAM(ctx, req.Storage)
+	client, err := b.clientIAM(ctx, req.Storage, nil)
 	if err != nil {
 		return nil, err
 	}
diff --git a/builtin/logical/aws/path_roles.go b/builtin/logical/aws/path_roles.go
index abf24a072ef..b2153c6b449 100644
--- a/builtin/logical/aws/path_roles.go
+++ b/builtin/logical/aws/path_roles.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -115,7 +115,23 @@ delimited key pairs.`,
 					Value: "[key1=value1, key2=value2]",
 				},
 			},
-
+			"session_tags": {
+				Type: framework.TypeKVPairs,
+				Description: fmt.Sprintf(`Session tags to be set for %q creds created by this role. These must be presented
+as Key-Value pairs. This can be represented as a map or a list of equal sign
+delimited key pairs.`, assumedRoleCred),
+				DisplayAttrs: &framework.DisplayAttributes{
+					Name:  "Session Tags",
+					Value: "[key1=value1, key2=value2]",
+				},
+			},
+			"external_id": {
+				Type:        framework.TypeString,
+				Description: "External ID to set when assuming the role; only valid when credential_type is " + assumedRoleCred,
+				DisplayAttrs: &framework.DisplayAttributes{
+					Name: "External ID",
+				},
+			},
 			"default_sts_ttl": {
 				Type:        framework.TypeDurationSecond,
 				Description: fmt.Sprintf("Default TTL for %s, %s, and %s credential types when no TTL is explicitly requested with the credentials", assumedRoleCred, federationTokenCred, sessionTokenCred),
@@ -341,6 +357,14 @@ func (b *backend) pathRolesWrite(ctx context.Context, req *logical.Request, d *f
 		roleEntry.SerialNumber = serialNumber.(string)
 	}
 
+	if sessionTags, ok := d.GetOk("session_tags"); ok {
+		roleEntry.SessionTags = sessionTags.(map[string]string)
+	}
+
+	if externalID, ok := d.GetOk("external_id"); ok {
+		roleEntry.ExternalID = externalID.(string)
+	}
+
 	if legacyRole != "" {
 		roleEntry = upgradeLegacyPolicyEntry(legacyRole)
 		if roleEntry.InvalidData != "" {
@@ -527,6 +551,8 @@ type awsRoleEntry struct {
 	PolicyDocument           string            `json:"policy_document"`                       // JSON-serialized inline policy to attach to IAM users and/or to specify as the Policy parameter in AssumeRole calls
 	IAMGroups                []string          `json:"iam_groups"`                            // Names of IAM groups that generated IAM users will be added to
 	IAMTags                  map[string]string `json:"iam_tags"`                              // IAM tags that will be added to the generated IAM users
+	SessionTags              map[string]string `json:"session_tags"`                          // Session tags that will be added as Tags parameter in AssumedRole calls
+	ExternalID               string            `json:"external_id"`                           // External ID to added as ExternalID in AssumeRole calls
 	InvalidData              string            `json:"invalid_data,omitempty"`                // Invalid role data. Exists to support converting the legacy role data into the new format
 	ProhibitFlexibleCredPath bool              `json:"prohibit_flexible_cred_path,omitempty"` // Disallow accessing STS credentials via the creds path and vice verse
 	Version                  int               `json:"version"`                               // Version number of the role format
@@ -545,6 +571,8 @@ func (r *awsRoleEntry) toResponseData() map[string]interface{} {
 		"policy_document":          r.PolicyDocument,
 		"iam_groups":               r.IAMGroups,
 		"iam_tags":                 r.IAMTags,
+		"session_tags":             r.SessionTags,
+		"external_id":              r.ExternalID,
 		"default_sts_ttl":          int64(r.DefaultSTSTTL.Seconds()),
 		"max_sts_ttl":              int64(r.MaxSTSTTL.Seconds()),
 		"user_path":                r.UserPath,
@@ -612,6 +640,14 @@ func (r *awsRoleEntry) validate() error {
 		errors = multierror.Append(errors, fmt.Errorf("cannot supply role_arns when credential_type isn't %s", assumedRoleCred))
 	}
 
+	if len(r.SessionTags) > 0 && !strutil.StrListContains(r.CredentialTypes, assumedRoleCred) {
+		errors = multierror.Append(errors, fmt.Errorf("cannot supply session_tags when credential_type isn't %s", assumedRoleCred))
+	}
+
+	if r.ExternalID != "" && !strutil.StrListContains(r.CredentialTypes, assumedRoleCred) {
+		errors = multierror.Append(errors, fmt.Errorf("cannot supply external_id when credential_type isn't %s", assumedRoleCred))
+	}
+
 	return errors.ErrorOrNil()
 }
 
diff --git a/builtin/logical/aws/path_roles_test.go b/builtin/logical/aws/path_roles_test.go
index 32d65da7bb8..7ba0c5e70cf 100644
--- a/builtin/logical/aws/path_roles_test.go
+++ b/builtin/logical/aws/path_roles_test.go
@@ -1,15 +1,17 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
 
 import (
 	"context"
+	"errors"
 	"reflect"
 	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
@@ -366,22 +368,74 @@ func TestRoleEntryValidationIamUserCred(t *testing.T) {
 		CredentialTypes: []string{iamUserCred},
 		RoleArns:        []string{"arn:aws:iam::123456789012:role/SomeRole"},
 	}
-	if roleEntry.validate() == nil {
-		t.Errorf("bad: invalid roleEntry with invalid RoleArns parameter %#v passed validation", roleEntry)
-	}
+	assertMultiError(t, roleEntry.validate(),
+		[]error{
+			errors.New(
+				"cannot supply role_arns when credential_type isn't assumed_role",
+			),
+		})
 
 	roleEntry = awsRoleEntry{
 		CredentialTypes: []string{iamUserCred},
 		PolicyArns:      []string{adminAccessPolicyARN},
 		DefaultSTSTTL:   1,
 	}
-	if roleEntry.validate() == nil {
-		t.Errorf("bad: invalid roleEntry with unrecognized DefaultSTSTTL %#v passed validation", roleEntry)
-	}
+	assertMultiError(t, roleEntry.validate(),
+		[]error{
+			errors.New(
+				"default_sts_ttl parameter only valid for assumed_role, federation_token, and session_token credential types",
+			),
+		})
 	roleEntry.DefaultSTSTTL = 0
+
 	roleEntry.MaxSTSTTL = 1
-	if roleEntry.validate() == nil {
-		t.Errorf("bad: invalid roleEntry with unrecognized MaxSTSTTL %#v passed validation", roleEntry)
+	assertMultiError(t, roleEntry.validate(),
+		[]error{
+			errors.New(
+				"max_sts_ttl parameter only valid for assumed_role, federation_token, and session_token credential types",
+			),
+		})
+	roleEntry.MaxSTSTTL = 0
+
+	roleEntry.SessionTags = map[string]string{
+		"Key1": "Value1",
+		"Key2": "Value2",
+	}
+	assertMultiError(t, roleEntry.validate(),
+		[]error{
+			errors.New(
+				"cannot supply session_tags when credential_type isn't assumed_role",
+			),
+		})
+	roleEntry.SessionTags = nil
+
+	roleEntry.ExternalID = "my-ext-id"
+	assertMultiError(t, roleEntry.validate(),
+		[]error{
+			errors.New(
+				"cannot supply external_id when credential_type isn't assumed_role"),
+		})
+}
+
+func assertMultiError(t *testing.T, err error, expected []error) {
+	t.Helper()
+
+	if err == nil {
+		t.Errorf("expected error, got nil")
+		return
+	}
+
+	var multiErr *multierror.Error
+	if errors.As(err, &multiErr) {
+		if multiErr.Len() != len(expected) {
+			t.Errorf("expected %d error, got %d", len(expected), multiErr.Len())
+		} else {
+			if !reflect.DeepEqual(expected, multiErr.Errors) {
+				t.Errorf("expected error %q, actual %q", expected, multiErr.Errors)
+			}
+		}
+	} else {
+		t.Errorf("expected multierror, got %T", err)
 	}
 }
 
@@ -392,8 +446,13 @@ func TestRoleEntryValidationAssumedRoleCred(t *testing.T) {
 		RoleArns:        []string{"arn:aws:iam::123456789012:role/SomeRole"},
 		PolicyArns:      []string{adminAccessPolicyARN},
 		PolicyDocument:  allowAllPolicyDocument,
-		DefaultSTSTTL:   2,
-		MaxSTSTTL:       3,
+		ExternalID:      "my-ext-id",
+		SessionTags: map[string]string{
+			"Key1": "Value1",
+			"Key2": "Value2",
+		},
+		DefaultSTSTTL: 2,
+		MaxSTSTTL:     3,
 	}
 	if err := roleEntry.validate(); err != nil {
 		t.Errorf("bad: valid roleEntry %#v failed validation: %v", roleEntry, err)
diff --git a/builtin/logical/aws/path_static_creds.go b/builtin/logical/aws/path_static_creds.go
index 14fca7cd6de..24622d0b1d8 100644
--- a/builtin/logical/aws/path_static_creds.go
+++ b/builtin/logical/aws/path_static_creds.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -7,6 +7,7 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"time"
 
 	"github.com/fatih/structs"
 	"github.com/hashicorp/vault/sdk/framework"
@@ -21,8 +22,9 @@ const (
 )
 
 type awsCredentials struct {
-	AccessKeyID     string `json:"access_key" structs:"access_key" mapstructure:"access_key"`
-	SecretAccessKey string `json:"secret_key" structs:"secret_key" mapstructure:"secret_key"`
+	AccessKeyID     string     `json:"access_key" structs:"access_key" mapstructure:"access_key"`
+	Expiration      *time.Time `json:"expiration,omitempty" structs:"expiration" mapstructure:"expiration"`
+	SecretAccessKey string     `json:"secret_key" structs:"secret_key" mapstructure:"secret_key"`
 }
 
 func pathStaticCredentials(b *backend) *framework.Path {
@@ -89,6 +91,13 @@ func formatCredsStoragePath(roleName string) string {
 	return fmt.Sprintf("%s/%s", pathStaticCreds, roleName)
 }
 
+func (a *awsCredentials) priority(role staticRoleEntry) int64 {
+	if a.Expiration != nil {
+		return a.Expiration.Unix()
+	}
+	return time.Now().Add(role.RotationPeriod).Unix()
+}
+
 const pathStaticCredsHelpSyn = `Retrieve static credentials from the named role.`
 
 const pathStaticCredsHelpDesc = `
diff --git a/builtin/logical/aws/path_static_creds_test.go b/builtin/logical/aws/path_static_creds_test.go
index e128a5f0730..5cfc94f1acc 100644
--- a/builtin/logical/aws/path_static_creds_test.go
+++ b/builtin/logical/aws/path_static_creds_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -7,10 +7,12 @@ import (
 	"context"
 	"reflect"
 	"testing"
+	"time"
 
 	"github.com/fatih/structs"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
 )
 
 // TestStaticCredsRead verifies that we can correctly read a cred that exists, and correctly _not read_
@@ -91,3 +93,22 @@ func staticCredsFieldData(data map[string]interface{}) *framework.FieldData {
 		Schema: schema,
 	}
 }
+
+// Test_awsCredentials_priority verifies that the expiration in the credentials
+// is returned as the priority value when it is present, but otherwise the
+// priority is now + the rotation period
+func Test_awsCredentials_priority(t *testing.T) {
+	expiration := time.Date(2023, 10, 24, 15, 21, 0o0, 0o0, time.UTC)
+	roleConfig := staticRoleEntry{RotationPeriod: time.Hour}
+	t.Run("use credential value", func(t *testing.T) {
+		creds := &awsCredentials{
+			Expiration: &expiration,
+		}
+		require.Equal(t, expiration.Unix(), creds.priority(roleConfig))
+	})
+	t.Run("use role value", func(t *testing.T) {
+		hourUnix := time.Now().Add(time.Hour).Unix()
+		creds := &awsCredentials{}
+		require.InDelta(t, hourUnix, creds.priority(roleConfig), float64(time.Minute/time.Second))
+	})
+}
diff --git a/builtin/logical/aws/path_static_roles.go b/builtin/logical/aws/path_static_roles.go
index f07eab54ab1..21b4cff93ef 100644
--- a/builtin/logical/aws/path_static_roles.go
+++ b/builtin/logical/aws/path_static_roles.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -21,16 +21,22 @@ import (
 const (
 	pathStaticRole = "static-roles"
 
-	paramRoleName       = "name"
-	paramUsername       = "username"
-	paramRotationPeriod = "rotation_period"
+	paramRoleName        = "name"
+	paramUsername        = "username"
+	paramRotationPeriod  = "rotation_period"
+	paramAssumeRoleARN   = "assume_role_arn"
+	paramRoleSessionName = "assume_role_session_name"
+	paramExternalID      = "external_id"
 )
 
 type staticRoleEntry struct {
-	Name           string        `json:"name" structs:"name" mapstructure:"name"`
-	ID             string        `json:"id" structs:"id" mapstructure:"id"`
-	Username       string        `json:"username" structs:"username" mapstructure:"username"`
-	RotationPeriod time.Duration `json:"rotation_period" structs:"rotation_period" mapstructure:"rotation_period"`
+	Name                  string        `json:"name" structs:"name" mapstructure:"name"`
+	ID                    string        `json:"id" structs:"id" mapstructure:"id"`
+	Username              string        `json:"username" structs:"username" mapstructure:"username"`
+	RotationPeriod        time.Duration `json:"rotation_period" structs:"rotation_period" mapstructure:"rotation_period"`
+	AssumeRoleARN         string        `json:"assume_role_arn" structs:"assume_role_arn" mapstructure:"assume_role_arn"`
+	AssumeRoleSessionName string        `json:"assume_role_session_name" structs:"assume_role_session_name" mapstructure:"assume_role_session_name"`
+	ExternalID            string        `json:"external_id" structs:"external_id" mapstructure:"external_id"`
 }
 
 func pathStaticRoles(b *backend) *framework.Path {
@@ -53,23 +59,12 @@ func pathStaticRoles(b *backend) *framework.Path {
 			},
 		}},
 	}
+	fields := roleResponse[http.StatusOK][0].Fields
+	AddStaticAssumeRoleFieldsEnt(fields)
 
 	return &framework.Path{
 		Pattern: fmt.Sprintf("%s/%s", pathStaticRole, framework.GenericNameWithAtRegex(paramRoleName)),
-		Fields: map[string]*framework.FieldSchema{
-			paramRoleName: {
-				Type:        framework.TypeString,
-				Description: descRoleName,
-			},
-			paramUsername: {
-				Type:        framework.TypeString,
-				Description: descUsername,
-			},
-			paramRotationPeriod: {
-				Type:        framework.TypeDurationSecond,
-				Description: descRotationPeriod,
-			},
-		},
+		Fields:  fields,
 
 		Operations: map[logical.Operation]framework.OperationHandler{
 			logical.ReadOperation: &framework.PathOperation{
@@ -99,6 +94,19 @@ func pathStaticRoles(b *backend) *framework.Path {
 	}
 }
 
+func pathListStaticRoles(b *backend) *framework.Path {
+	return &framework.Path{
+		Pattern: fmt.Sprintf("%s/?$", pathStaticRole),
+		Operations: map[logical.Operation]framework.OperationHandler{
+			logical.ListOperation: &framework.PathOperation{
+				Callback: b.pathStaticRolesList,
+			},
+		},
+		HelpSynopsis:    pathStaticRolesHelpSyn,
+		HelpDescription: pathStaticRolesHelpDesc,
+	}
+}
+
 func (b *backend) pathStaticRolesRead(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 	roleName, ok := data.GetOk(paramRoleName)
 	if !ok {
@@ -159,6 +167,11 @@ func (b *backend) pathStaticRolesWrite(ctx context.Context, req *logical.Request
 
 	// other params are optional if we're not Creating
 
+	err = validateAssumeRoleFields(data, &config)
+	if err != nil {
+		return nil, err
+	}
+
 	if rawUsername, ok := data.GetOk(paramUsername); ok {
 		config.Username = rawUsername.(string)
 
@@ -194,12 +207,13 @@ func (b *backend) pathStaticRolesWrite(ctx context.Context, req *logical.Request
 
 	// Bootstrap initial set of keys if they did not exist before. AWS Secret Access Keys can only be obtained on creation,
 	// so we need to boostrap new roles with a new initial set of keys to be able to serve valid credentials to Vault clients.
-	existingCreds, err := req.Storage.Get(ctx, formatCredsStoragePath(config.Name))
+	credsPath := formatCredsStoragePath(config.Name)
+	existingCredsEntry, err := req.Storage.Get(ctx, credsPath)
 	if err != nil {
 		return nil, fmt.Errorf("unable to verify if credentials already exist for role %q: %w", config.Name, err)
 	}
-	if existingCreds == nil {
-		err := b.createCredential(ctx, req.Storage, config, false)
+	if existingCredsEntry == nil {
+		creds, err := b.createCredential(ctx, req.Storage, config, false)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create new credentials for role %q: %w", config.Name, err)
 		}
@@ -207,21 +221,39 @@ func (b *backend) pathStaticRolesWrite(ctx context.Context, req *logical.Request
 		err = b.credRotationQueue.Push(&queue.Item{
 			Key:      config.Name,
 			Value:    config,
-			Priority: time.Now().Add(config.RotationPeriod).Unix(),
+			Priority: creds.priority(config),
 		})
 		if err != nil {
 			return nil, fmt.Errorf("failed to add item into the rotation queue for role %q: %w", config.Name, err)
 		}
 	} else {
+		var existingCreds awsCredentials
+		err := existingCredsEntry.DecodeJSON(&existingCreds)
+		if err != nil {
+			return nil, fmt.Errorf("unable to decode existing credentials for role %s: %w", config.Name, err)
+		}
 		// creds already exist, so all we need to do is update the rotation
 		// what here stays the same and what changes? Can we change the name?
 		i, err := b.credRotationQueue.PopByKey(config.Name)
 		if err != nil {
 			return nil, fmt.Errorf("expected an item with name %q, but got an error: %w", config.Name, err)
 		}
+		// check if i is nil to prevent panic because
+		// 1. PopByKey returns nil if the key does not exist; and
+		// 2. the static cred queue is not repopulated on reload (see VAULT-30877)
+		if i == nil {
+			return nil, fmt.Errorf("expected an item with name %q, but got nil", config.Name)
+		}
 		i.Value = config
 		// update the next rotation to occur at now + the new rotation period
-		i.Priority = time.Now().Add(config.RotationPeriod).Unix()
+		newExpiration := time.Now().Add(config.RotationPeriod)
+		existingCreds.Expiration = &newExpiration
+		_, err = logical.StorageEntryJSON(credsPath, &existingCreds)
+		if err != nil {
+			return nil, fmt.Errorf("error updating credentials for role %s: %w", config.Name, err)
+		}
+		i.Priority = existingCreds.priority(config)
+
 		err = b.credRotationQueue.Push(i)
 		if err != nil {
 			return nil, fmt.Errorf("failed to add updated item into the rotation queue for role %q: %w", config.Name, err)
@@ -270,6 +302,21 @@ func (b *backend) pathStaticRolesDelete(ctx context.Context, req *logical.Reques
 	return nil, req.Storage.Delete(ctx, formatRoleStoragePath(roleName.(string)))
 }
 
+func (b *backend) pathStaticRolesList(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	b.roleMutex.RLock()
+	defer b.roleMutex.RUnlock()
+
+	roles, err := req.Storage.List(ctx, pathStaticRole+"/")
+	if err != nil {
+		return nil, fmt.Errorf("error listing static roles at %s: %w", pathStaticRole, err)
+	}
+	if len(roles) == 0 {
+		return &logical.Response{Data: map[string]interface{}{}}, nil
+	}
+
+	return logical.ListResponse(roles), nil
+}
+
 func (b *backend) validateRoleName(name string) error {
 	if name == "" {
 		return errors.New("empty role name attribute given")
@@ -280,10 +327,11 @@ func (b *backend) validateRoleName(name string) error {
 // validateIAMUser checks the user information we have for the role against the information on AWS. On a create, it uses the username
 // to retrieve the user information and _sets_ the userID. On update, it validates the userID and username.
 func (b *backend) validateIAMUserExists(ctx context.Context, storage logical.Storage, entry *staticRoleEntry, isCreate bool) error {
-	c, err := b.clientIAM(ctx, storage)
+	c, err := b.getNonCachedIAMClient(ctx, storage, *entry)
 	if err != nil {
-		return fmt.Errorf("unable to validate username %q: %w", entry.Username, err)
+		return fmt.Errorf("unable to get client to validate username %q: %w", entry.Username, err)
 	}
+	b.iamClient = c
 
 	// we don't really care about the content of the result, just that it's not an error
 	out, err := c.GetUser(&iam.GetUserInput{
@@ -312,8 +360,8 @@ const (
 )
 
 func (b *backend) validateRotationPeriod(period time.Duration) error {
-	if period < minAllowableRotationPeriod {
-		return fmt.Errorf("role rotation period out of range: must be greater than %.2f seconds", minAllowableRotationPeriod.Seconds())
+	if period < b.minAllowableRotationPeriod {
+		return fmt.Errorf("role rotation period out of range: must be greater than %.2f seconds", b.minAllowableRotationPeriod.Seconds())
 	}
 	return nil
 }
@@ -345,4 +393,7 @@ const (
 	descUsername       = "The IAM user to adopt as a static role."
 	descRotationPeriod = `Period by which to rotate the backing credential of the adopted user. 
 This can be a Go duration (e.g, '1m', 24h'), or an integer number of seconds.`
+	descAssumeRoleARN   = `The AWS ARN for the role to be assumed when interacting with the account specified.`
+	descRoleSessionName = `An identifier for the assumed role session.`
+	descExternalID      = `An external ID to be passed to the assumed role session.`
 )
diff --git a/builtin/logical/aws/path_static_roles_ce.go b/builtin/logical/aws/path_static_roles_ce.go
new file mode 100644
index 00000000000..1bd6c5e21af
--- /dev/null
+++ b/builtin/logical/aws/path_static_roles_ce.go
@@ -0,0 +1,29 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package aws
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/vault/sdk/framework"
+)
+
+// AddStaticAssumeRoleFieldsEnt is a no-op for community edition
+func AddStaticAssumeRoleFieldsEnt(fields map[string]*framework.FieldSchema) {
+	// no-op
+}
+
+func validateAssumeRoleFields(data *framework.FieldData, config *staticRoleEntry) error {
+	_, hasAssumeRoleARN := data.GetOk(paramAssumeRoleARN)
+	_, hasRoleSessionName := data.GetOk(paramRoleSessionName)
+	_, hasExternalID := data.GetOk(paramExternalID)
+
+	if hasAssumeRoleARN || hasRoleSessionName || hasExternalID {
+		return fmt.Errorf("cross-account static roles are only supported in Vault Enterprise")
+	}
+
+	return nil
+}
diff --git a/builtin/logical/aws/path_static_roles_test.go b/builtin/logical/aws/path_static_roles_test.go
index 0244d6a39c7..49667a484e9 100644
--- a/builtin/logical/aws/path_static_roles_test.go
+++ b/builtin/logical/aws/path_static_roles_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -6,11 +6,14 @@ package aws
 import (
 	"context"
 	"errors"
+	"strconv"
 	"testing"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/service/iam/iamiface"
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/awsutil"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -97,7 +100,10 @@ func TestStaticRolesValidation(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			b.iamClient = miam
+			// Used to override the real IAM client creation to return the mocked client
+			b.nonCachedClientIAMFunc = func(ctx context.Context, s logical.Storage, logger hclog.Logger, entry *staticRoleEntry) (iamiface.IAMAPI, error) {
+				return miam, nil
+			}
 			if err := b.Setup(bgCTX, config); err != nil {
 				t.Fatal(err)
 			}
@@ -241,7 +247,10 @@ func TestStaticRolesWrite(t *testing.T) {
 			}
 
 			b := Backend(config)
-			b.iamClient = miam
+			// Used to override the real IAM client creation to return the mocked client
+			b.nonCachedClientIAMFunc = func(ctx context.Context, s logical.Storage, logger hclog.Logger, entry *staticRoleEntry) (iamiface.IAMAPI, error) {
+				return miam, nil
+			}
 			if err := b.Setup(bgCTX, config); err != nil {
 				t.Fatal(err)
 			}
@@ -454,7 +463,10 @@ func TestStaticRoleDelete(t *testing.T) {
 			}
 
 			b := Backend(config)
-			b.iamClient = miam
+			// Used to override the real IAM client creation to return the mocked client
+			b.nonCachedClientIAMFunc = func(ctx context.Context, s logical.Storage, logger hclog.Logger, entry *staticRoleEntry) (iamiface.IAMAPI, error) {
+				return miam, nil
+			}
 
 			// put in storage
 			staticRole := staticRoleEntry{
@@ -522,6 +534,61 @@ func TestStaticRoleDelete(t *testing.T) {
 	}
 }
 
+// TestStaticRolesList validates that we can list all the static roles in the storage backend.
+func TestStaticRolesList(t *testing.T) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	bgCTX := context.Background()
+
+	staticRoles := []staticRoleEntry{}
+	for i := 1; i <= 10; i++ {
+		roles := staticRoleEntry{
+			Name:           "testrole" + strconv.Itoa(i),
+			Username:       "jane-doe",
+			RotationPeriod: 24 * time.Hour,
+		}
+		staticRoles = append(staticRoles, roles)
+	}
+
+	for _, role := range staticRoles {
+		entry, err := logical.StorageEntryJSON(formatRoleStoragePath(role.Name), role)
+		if err != nil {
+			t.Fatalf("failed to create storage entry for %s: %v", role.Name, err)
+		}
+		err = config.StorageView.Put(bgCTX, entry)
+		if err != nil {
+			t.Fatalf("failed to store role %s: %v", role.Name, err)
+		}
+	}
+
+	b := Backend(config)
+	resp, err := b.HandleRequest(bgCTX, &logical.Request{
+		Operation: logical.ListOperation,
+		Path:      "static-roles",
+		Storage:   config.StorageView,
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: listing roles failed. resp:%#v\n err:%v", resp, err)
+	}
+
+	if len(resp.Data["keys"].([]string)) != 10 {
+		t.Fatalf("failed to list all 10 roles")
+	}
+
+	resp, err = b.HandleRequest(bgCTX, &logical.Request{
+		Operation: logical.ListOperation,
+		Path:      "static-roles/",
+		Storage:   config.StorageView,
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: listing roles failed. resp:%#v\n err:%v", resp, err)
+	}
+
+	if len(resp.Data["keys"].([]string)) != 10 {
+		t.Fatalf("failed to list all 10 roles")
+	}
+}
+
 func staticRoleFieldData(data map[string]interface{}) *framework.FieldData {
 	schema := map[string]*framework.FieldSchema{
 		paramRoleName: {
diff --git a/builtin/logical/aws/path_user.go b/builtin/logical/aws/path_user.go
index 46b9c3e928a..d5d43190a3f 100644
--- a/builtin/logical/aws/path_user.go
+++ b/builtin/logical/aws/path_user.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -157,7 +157,7 @@ func (b *backend) pathCredsRead(ctx context.Context, req *logical.Request, d *fr
 		case !strutil.StrListContains(role.RoleArns, roleArn):
 			return logical.ErrorResponse(fmt.Sprintf("role_arn %q not in allowed role arns for Vault role %q", roleArn, roleName)), nil
 		}
-		return b.assumeRole(ctx, req.Storage, req.DisplayName, roleName, roleArn, role.PolicyDocument, role.PolicyArns, role.IAMGroups, ttl, roleSessionName)
+		return b.assumeRole(ctx, req.Storage, req.DisplayName, roleName, roleArn, role.PolicyDocument, role.PolicyArns, role.IAMGroups, ttl, roleSessionName, role.SessionTags, role.ExternalID)
 	case federationTokenCred:
 		return b.getFederationToken(ctx, req.Storage, req.DisplayName, roleName, role.PolicyDocument, role.PolicyArns, role.IAMGroups, ttl)
 	case sessionTokenCred:
@@ -175,7 +175,7 @@ func (b *backend) pathUserRollback(ctx context.Context, req *logical.Request, _k
 	username := entry.UserName
 
 	// Get the client
-	client, err := b.clientIAM(ctx, req.Storage)
+	client, err := b.clientIAM(ctx, req.Storage, nil)
 	if err != nil {
 		return err
 	}
diff --git a/builtin/logical/aws/rollback.go b/builtin/logical/aws/rollback.go
index 6136db9baae..c2050d73e7f 100644
--- a/builtin/logical/aws/rollback.go
+++ b/builtin/logical/aws/rollback.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
diff --git a/builtin/logical/aws/rotation.go b/builtin/logical/aws/rotation.go
index 0e9e22fc827..bd3c37db6d0 100644
--- a/builtin/logical/aws/rotation.go
+++ b/builtin/logical/aws/rotation.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -59,10 +59,12 @@ func (b *backend) rotateCredential(ctx context.Context, storage logical.Storage)
 		return false, nil
 	}
 
+	b.Logger().Debug("rotating credential", "role", item.Key)
 	cfg := item.Value.(staticRoleEntry)
 
-	err = b.createCredential(ctx, storage, cfg, true)
+	creds, err := b.createCredential(ctx, storage, cfg, true)
 	if err != nil {
+		b.Logger().Error("failed to create credential, re-queueing", "error", err)
 		// put it back in the queue with a backoff
 		item.Priority = time.Now().Add(10 * time.Second).Unix()
 		innerErr := b.credRotationQueue.Push(item)
@@ -74,7 +76,7 @@ func (b *backend) rotateCredential(ctx context.Context, storage logical.Storage)
 	}
 
 	// set new priority and re-queue
-	item.Priority = time.Now().Add(cfg.RotationPeriod).Unix()
+	item.Priority = creds.priority(cfg)
 	err = b.credRotationQueue.Push(item)
 	if err != nil {
 		return true, fmt.Errorf("failed to add item into the rotation queue for role %q: %w", cfg.Name, err)
@@ -84,10 +86,11 @@ func (b *backend) rotateCredential(ctx context.Context, storage logical.Storage)
 }
 
 // createCredential will create a new iam credential, deleting the oldest one if necessary.
-func (b *backend) createCredential(ctx context.Context, storage logical.Storage, cfg staticRoleEntry, shouldLockStorage bool) error {
-	iamClient, err := b.clientIAM(ctx, storage)
+func (b *backend) createCredential(ctx context.Context, storage logical.Storage, cfg staticRoleEntry, shouldLockStorage bool) (*awsCredentials, error) {
+	// Always create a fresh client
+	iamClient, err := b.getNonCachedIAMClient(ctx, storage, cfg)
 	if err != nil {
-		return fmt.Errorf("unable to get the AWS IAM client: %w", err)
+		return nil, fmt.Errorf("failed to get IAM client for role %q: %w", cfg.Name, err)
 	}
 
 	// IAM users can have a most 2 sets of keys at a time.
@@ -97,14 +100,14 @@ func (b *backend) createCredential(ctx context.Context, storage logical.Storage,
 
 	err = b.validateIAMUserExists(ctx, storage, &cfg, false)
 	if err != nil {
-		return fmt.Errorf("iam user didn't exist, or username/userid didn't match: %w", err)
+		return nil, fmt.Errorf("iam user didn't exist, or username/userid didn't match: %w", err)
 	}
 
 	accessKeys, err := iamClient.ListAccessKeys(&iam.ListAccessKeysInput{
 		UserName: aws.String(cfg.Username),
 	})
 	if err != nil {
-		return fmt.Errorf("unable to list existing access keys for IAM user %q: %w", cfg.Username, err)
+		return nil, fmt.Errorf("unable to list existing access keys for IAM user %q: %w", cfg.Username, err)
 	}
 
 	// If we have the maximum number of keys, we have to delete one to make another (so we can get the credentials).
@@ -127,7 +130,7 @@ func (b *backend) createCredential(ctx context.Context, storage logical.Storage,
 			UserName:    oldestKey.UserName,
 		})
 		if err != nil {
-			return fmt.Errorf("unable to delete oldest access keys for user %q: %w", cfg.Username, err)
+			return nil, fmt.Errorf("unable to delete oldest access keys for user %q: %w", cfg.Username, err)
 		}
 	}
 
@@ -136,16 +139,19 @@ func (b *backend) createCredential(ctx context.Context, storage logical.Storage,
 		UserName: aws.String(cfg.Username),
 	})
 	if err != nil {
-		return fmt.Errorf("unable to create new access keys for user %q: %w", cfg.Username, err)
+		return nil, fmt.Errorf("unable to create new access keys for user %q: %w", cfg.Username, err)
 	}
+	expiration := time.Now().UTC().Add(cfg.RotationPeriod)
 
-	// Persist new keys
-	entry, err := logical.StorageEntryJSON(formatCredsStoragePath(cfg.Name), &awsCredentials{
+	creds := &awsCredentials{
 		AccessKeyID:     *out.AccessKey.AccessKeyId,
 		SecretAccessKey: *out.AccessKey.SecretAccessKey,
-	})
+		Expiration:      &expiration,
+	}
+	// Persist new keys
+	entry, err := logical.StorageEntryJSON(formatCredsStoragePath(cfg.Name), creds)
 	if err != nil {
-		return fmt.Errorf("failed to marshal object to JSON: %w", err)
+		return nil, fmt.Errorf("failed to marshal object to JSON: %w", err)
 	}
 	if shouldLockStorage {
 		b.roleMutex.Lock()
@@ -153,10 +159,10 @@ func (b *backend) createCredential(ctx context.Context, storage logical.Storage,
 	}
 	err = storage.Put(ctx, entry)
 	if err != nil {
-		return fmt.Errorf("failed to save object in storage: %w", err)
+		return nil, fmt.Errorf("failed to save object in storage: %w", err)
 	}
 
-	return nil
+	return creds, nil
 }
 
 // delete credential will remove the credential associated with the role from storage.
@@ -186,8 +192,13 @@ func (b *backend) deleteCredential(ctx context.Context, storage logical.Storage,
 		return fmt.Errorf("couldn't delete from storage: %w", err)
 	}
 
+	iamClient, err := b.nonCachedClientIAM(ctx, storage, b.Logger(), &cfg)
+	if err != nil {
+		return fmt.Errorf("failed to get IAM client for role %q while deleting: %w", cfg.Name, err)
+	}
+
 	// because we have the information, this is the one we created, so it's safe for us to delete.
-	_, err = b.iamClient.DeleteAccessKey(&iam.DeleteAccessKeyInput{
+	_, err = iamClient.DeleteAccessKey(&iam.DeleteAccessKeyInput{
 		AccessKeyId: aws.String(creds.AccessKeyID),
 		UserName:    aws.String(cfg.Username),
 	})
diff --git a/builtin/logical/aws/rotation_test.go b/builtin/logical/aws/rotation_test.go
index 51de3141b0a..5fb90736ab4 100644
--- a/builtin/logical/aws/rotation_test.go
+++ b/builtin/logical/aws/rotation_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -6,15 +6,23 @@ package aws
 import (
 	"context"
 	"errors"
+	"fmt"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/iam/iamiface"
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/helper/testhelpers"
+	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/queue"
+	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
 )
 
 // TestRotation verifies that the rotation code and priority queue correctly selects and rotates credentials
@@ -109,6 +117,7 @@ func TestRotation(t *testing.T) {
 
 			b := Backend(config)
 
+			expirations := make([]*time.Time, len(c.creds))
 			// insert all our creds
 			for i, cred := range c.creds {
 
@@ -138,13 +147,21 @@ func TestRotation(t *testing.T) {
 				if err != nil {
 					t.Fatalf("couldn't initialze mock IAM handler: %s", err)
 				}
-				b.iamClient = miam
 
-				err = b.createCredential(bgCTX, config.StorageView, cred.config, true)
+				// Used to override the IAM client creation to return the mocked client
+				b.nonCachedClientIAMFunc = func(ctx context.Context, storage logical.Storage, logger hclog.Logger, entry *staticRoleEntry) (iamiface.IAMAPI, error) {
+					if entry.Username == cred.config.Username && entry.ID == cred.config.ID {
+						return miam, nil
+					}
+					return nil, fmt.Errorf("unexpected IAM client creation for user %q", entry.Username)
+				}
+
+				c, err := b.createCredential(bgCTX, config.StorageView, cred.config, true)
 				if err != nil {
 					t.Fatalf("couldn't insert credential %d: %s", i, err)
 				}
 
+				expirations[i] = c.Expiration
 				item := &queue.Item{
 					Key:      cred.config.Name,
 					Value:    cred.config,
@@ -183,7 +200,11 @@ func TestRotation(t *testing.T) {
 			if err != nil {
 				t.Fatalf("couldn't initialze mock IAM handler: %s", err)
 			}
-			b.iamClient = miam
+
+			// Set the IAM mock client to be used in the rotation
+			b.nonCachedClientIAMFunc = func(ctx context.Context, storage logical.Storage, logger hclog.Logger, entry *staticRoleEntry) (iamiface.IAMAPI, error) {
+				return miam, nil
+			}
 
 			req := &logical.Request{
 				Storage: config.StorageView,
@@ -205,10 +226,12 @@ func TestRotation(t *testing.T) {
 					t.Fatalf("could not unmarshal storage view entry for cred %d to an aws credential: %s", i, err)
 				}
 
-				if cred.changed && out.SecretAccessKey != newSecret {
-					t.Fatalf("expected the key for cred %d to have changed, but it hasn't", i)
-				} else if !cred.changed && out.SecretAccessKey != oldSecret {
-					t.Fatalf("expected the key for cred %d to have stayed the same, but it changed", i)
+				if cred.changed {
+					require.Equal(t, out.SecretAccessKey, newSecret, "expected the key for cred %d to have changed, but it hasn't", i)
+					require.NotEqual(t, out.Expiration.UTC(), expirations[i].UTC(), "expected the expiration for cred %d to have changed, but it hasn't", i)
+				} else {
+					require.Equal(t, out.SecretAccessKey, oldSecret, "expected the key for cred %d to have stayed the same, but it changed", i)
+					require.Equal(t, out.Expiration.UTC(), expirations[i].UTC(), "expected the expiration for cred %d to have changed, but it hasn't", i)
 				}
 			}
 		})
@@ -329,9 +352,12 @@ func TestCreateCredential(t *testing.T) {
 			}
 
 			b := Backend(config)
-			b.iamClient = fiam
 
-			err = b.createCredential(context.Background(), config.StorageView, staticRoleEntry{Username: c.username, ID: c.id}, true)
+			b.nonCachedClientIAMFunc = func(ctx context.Context, s logical.Storage, logger hclog.Logger, entry *staticRoleEntry) (iamiface.IAMAPI, error) {
+				return fiam, nil
+			}
+
+			_, err = b.createCredential(context.Background(), config.StorageView, staticRoleEntry{Username: c.username, ID: c.id}, true)
 			if err != nil {
 				t.Fatalf("got an error we didn't expect: %q", err)
 			}
@@ -392,9 +418,12 @@ func TestRequeueOnError(t *testing.T) {
 		t.Fail()
 	}
 
-	b.iamClient = miam
+	// Used to override the IAM real client creation to return the mocked client
+	b.nonCachedClientIAMFunc = func(ctx context.Context, s logical.Storage, logger hclog.Logger, entry *staticRoleEntry) (iamiface.IAMAPI, error) {
+		return miam, nil
+	}
 
-	err = b.createCredential(bgCTX, config.StorageView, cred, true)
+	_, err = b.createCredential(bgCTX, config.StorageView, cred, true)
 	if err != nil {
 		t.Fatalf("couldn't insert credential: %s", err)
 	}
@@ -417,7 +446,9 @@ func TestRequeueOnError(t *testing.T) {
 	if err != nil {
 		t.Fatalf("couldn't initialize the mock iam: %s", err)
 	}
-	b.iamClient = miam
+	b.nonCachedClientIAMFunc = func(ctx context.Context, s logical.Storage, logger hclog.Logger, entry *staticRoleEntry) (iamiface.IAMAPI, error) {
+		return miam, nil
+	}
 
 	// now rotate, but it will fail
 	r, e := b.rotateCredential(bgCTX, config.StorageView)
@@ -437,3 +468,141 @@ func TestRequeueOnError(t *testing.T) {
 		t.Fatalf("priority should be within 5 seconds of our backoff interval")
 	}
 }
+
+type mockIAM struct {
+	iamiface.IAMAPI
+	// mapping username -> number of times CreateAccessKey has been queried
+	// for this user
+	newKeys map[string]int
+	l       sync.Mutex
+}
+
+func (m *mockIAM) GetUser(input *iam.GetUserInput) (*iam.GetUserOutput, error) {
+	return &iam.GetUserOutput{User: &iam.User{UserId: aws.String(""), UserName: input.UserName}}, nil
+}
+
+func (m *mockIAM) ListAccessKeys(input *iam.ListAccessKeysInput) (*iam.ListAccessKeysOutput, error) {
+	return &iam.ListAccessKeysOutput{
+		AccessKeyMetadata: []*iam.AccessKeyMetadata{
+			{
+				AccessKeyId: aws.String(fmt.Sprintf("%s-key", *input.UserName)),
+			},
+		},
+	}, nil
+}
+
+func (m *mockIAM) CreateAccessKey(input *iam.CreateAccessKeyInput) (*iam.CreateAccessKeyOutput, error) {
+	m.l.Lock()
+	defer m.l.Unlock()
+	m.newKeys[*input.UserName]++
+	count := m.newKeys[*input.UserName]
+	return &iam.CreateAccessKeyOutput{
+		AccessKey: &iam.AccessKey{
+			AccessKeyId:     aws.String(fmt.Sprintf("%s-key", *input.UserName)),
+			SecretAccessKey: aws.String(fmt.Sprintf("%s-%d", *input.UserName, count)),
+		},
+	}, nil
+}
+
+// Test_RotationQueueInitialized creates a 2 node cluster and sets up the AWS
+// credentials backend. The test creates 3 sets of static credentials. Two of
+// those have a low rotation period and should get rotated during the test. The
+// third has a high rotation period and should not be rotated. The test verifies
+// that the correct secrets are rotated, then transfers leadership to the other
+// node. The test verifies that credentials are once again rotated on the new
+// active node.
+func Test_RotationQueueInitialized(t *testing.T) {
+	mockClient := &mockIAM{
+		newKeys: make(map[string]int),
+	}
+	coreConfig := &vault.CoreConfig{
+		LogicalBackends: map[string]logical.Factory{
+			"aws": func(ctx context.Context, config *logical.BackendConfig) (logical.Backend, error) {
+				b := Backend(config)
+				b.iamClient = mockClient
+				b.minAllowableRotationPeriod = 1 * time.Second
+
+				// Used to override the IAM real client creation to return the mocked client
+				b.nonCachedClientIAMFunc = func(ctx context.Context, storage logical.Storage, logger hclog.Logger, entry *staticRoleEntry) (iamiface.IAMAPI, error) {
+					return mockClient, nil
+				}
+
+				err := b.Setup(ctx, config)
+				return b, err
+			},
+		},
+		RollbackPeriod: 1 * time.Second,
+	}
+
+	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+		NumCores:    2,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	cores := cluster.Cores
+	vault.TestWaitActive(t, cores[0].Core)
+	client := cores[0].Client
+	err := client.Sys().Mount("aws", &api.MountInput{
+		Type: "aws",
+	})
+	require.NoError(t, err)
+
+	// create 3 static roles with different rotation periods
+	_, err = client.Logical().Write("aws/static-roles/role1", map[string]interface{}{
+		"username":        "user1",
+		"rotation_period": "2s",
+	})
+	require.NoError(t, err)
+	_, err = client.Logical().Write("aws/static-roles/role2", map[string]interface{}{
+		"username":        "user2",
+		"rotation_period": "1s",
+	})
+	require.NoError(t, err)
+	_, err = client.Logical().Write("aws/static-roles/role3", map[string]interface{}{
+		"username":        "user3",
+		"rotation_period": "5m",
+	})
+	require.NoError(t, err)
+
+	getSecret := func(c *api.Client, role string) string {
+		r, err := c.Logical().Read("aws/static-creds/" + role)
+		require.NoError(t, err)
+		return r.Data["secret_key"].(string)
+	}
+
+	role1Secret := getSecret(client, "role1")
+	role2Secret := getSecret(client, "role2")
+	role3Secret := getSecret(client, "role3")
+
+	verifySecretsRotated := func(c *api.Client, originalRole1Secret, originalRole2Secret, originalRole3Secret string) (updatedRole1Secret, updatedRole2Secret string) {
+		testhelpers.RetryUntil(t, 5*time.Second, func() error {
+			// verify that both secrets with a low rotation period get rotated
+			updatedRole1Secret = getSecret(c, "role1")
+			updatedRole2Secret = getSecret(c, "role2")
+
+			if originalRole1Secret == updatedRole1Secret && originalRole2Secret == updatedRole2Secret {
+				return fmt.Errorf("secrets haven't been rotated")
+			}
+
+			// verify that the secret with a high rotation period doesn't get
+			// rotated
+			updatedRole3Secret := getSecret(c, "role3")
+			if updatedRole3Secret != role3Secret {
+				return fmt.Errorf("secret has been rotated but should not have been")
+			}
+			return nil
+		})
+		return
+	}
+
+	role1Secret, role2Secret = verifySecretsRotated(client, role1Secret, role2Secret, role3Secret)
+
+	// seal to make to core 1 the active node
+	cores[0].Seal(t)
+
+	// verify that the correct secrets get rotated again
+	vault.TestWaitActive(t, cores[1].Core)
+	verifySecretsRotated(cores[1].Client, role1Secret, role2Secret, role3Secret)
+}
diff --git a/builtin/logical/aws/secret_access_keys.go b/builtin/logical/aws/secret_access_keys.go
index 151a9a5cd75..1e075a4d145 100644
--- a/builtin/logical/aws/secret_access_keys.go
+++ b/builtin/logical/aws/secret_access_keys.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -238,7 +238,7 @@ func (b *backend) getSessionToken(ctx context.Context, s logical.Storage, serial
 
 func (b *backend) assumeRole(ctx context.Context, s logical.Storage,
 	displayName, roleName, roleArn, policy string, policyARNs []string,
-	iamGroups []string, lifeTimeInSeconds int64, roleSessionName string) (*logical.Response, error,
+	iamGroups []string, lifeTimeInSeconds int64, roleSessionName string, sessionTags map[string]string, externalID string) (*logical.Response, error,
 ) {
 	// grab any IAM group policies associated with the vault role, both inline
 	// and managed
@@ -295,6 +295,19 @@ func (b *backend) assumeRole(ctx context.Context, s logical.Storage,
 	if len(policyARNs) > 0 {
 		assumeRoleInput.SetPolicyArns(convertPolicyARNs(policyARNs))
 	}
+	if externalID != "" {
+		assumeRoleInput.SetExternalId(externalID)
+	}
+	var tags []*sts.Tag
+	for k, v := range sessionTags {
+		tags = append(tags,
+			&sts.Tag{
+				Key:   aws.String(k),
+				Value: aws.String(v),
+			},
+		)
+	}
+	assumeRoleInput.SetTags(tags)
 	tokenResp, err := stsClient.AssumeRoleWithContext(ctx, assumeRoleInput)
 	if err != nil {
 		return logical.ErrorResponse("Error assuming role: %s", err), awsutil.CheckAWSError(err)
@@ -348,7 +361,7 @@ func (b *backend) secretAccessKeysCreate(
 	displayName, policyName string,
 	role *awsRoleEntry,
 ) (*logical.Response, error) {
-	iamClient, err := b.clientIAM(ctx, s)
+	iamClient, err := b.clientIAM(ctx, s, nil)
 	if err != nil {
 		return logical.ErrorResponse(err.Error()), nil
 	}
diff --git a/builtin/logical/aws/secret_access_keys_test.go b/builtin/logical/aws/secret_access_keys_test.go
index 8c6804d9464..a6717ca399c 100644
--- a/builtin/logical/aws/secret_access_keys_test.go
+++ b/builtin/logical/aws/secret_access_keys_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
@@ -120,6 +120,8 @@ func TestGenUsername(t *testing.T) {
 func TestReadConfig_DefaultTemplate(t *testing.T) {
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
 	b := Backend(config)
 	if err := b.Setup(context.Background(), config); err != nil {
 		t.Fatal(err)
@@ -164,6 +166,8 @@ func TestReadConfig_DefaultTemplate(t *testing.T) {
 func TestReadConfig_CustomTemplate(t *testing.T) {
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
+	config.System = &testSystemView{}
+
 	b := Backend(config)
 	if err := b.Setup(context.Background(), config); err != nil {
 		t.Fatal(err)
diff --git a/builtin/logical/aws/stepwise_test.go b/builtin/logical/aws/stepwise_test.go
index dff852859f9..20a487a75ea 100644
--- a/builtin/logical/aws/stepwise_test.go
+++ b/builtin/logical/aws/stepwise_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
diff --git a/builtin/logical/consul/backend.go b/builtin/logical/consul/backend.go
index 52aeb3cbcee..177e4408195 100644
--- a/builtin/logical/consul/backend.go
+++ b/builtin/logical/consul/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/builtin/logical/consul/backend_test.go b/builtin/logical/consul/backend_test.go
index aa377f26e08..1d787b83bde 100644
--- a/builtin/logical/consul/backend_test.go
+++ b/builtin/logical/consul/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/builtin/logical/consul/client.go b/builtin/logical/consul/client.go
index 8a98200af17..ecbad9d4944 100644
--- a/builtin/logical/consul/client.go
+++ b/builtin/logical/consul/client.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/builtin/logical/consul/cmd/consul/main.go b/builtin/logical/consul/cmd/consul/main.go
index 6f0dfe45c3a..662e813d55b 100644
--- a/builtin/logical/consul/cmd/consul/main.go
+++ b/builtin/logical/consul/cmd/consul/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/logical/consul/path_config.go b/builtin/logical/consul/path_config.go
index 11da1f222c6..440b6f817b2 100644
--- a/builtin/logical/consul/path_config.go
+++ b/builtin/logical/consul/path_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/builtin/logical/consul/path_roles.go b/builtin/logical/consul/path_roles.go
index 1341544ea34..324bc478f81 100644
--- a/builtin/logical/consul/path_roles.go
+++ b/builtin/logical/consul/path_roles.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/builtin/logical/consul/path_token.go b/builtin/logical/consul/path_token.go
index 6cddd1fddc7..6de43cecdb3 100644
--- a/builtin/logical/consul/path_token.go
+++ b/builtin/logical/consul/path_token.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/builtin/logical/consul/path_token_test.go b/builtin/logical/consul/path_token_test.go
index 7f5ac3d2b68..f7736237b7c 100644
--- a/builtin/logical/consul/path_token_test.go
+++ b/builtin/logical/consul/path_token_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/builtin/logical/consul/secret_token.go b/builtin/logical/consul/secret_token.go
index f2219f0790b..ad27c62288c 100644
--- a/builtin/logical/consul/secret_token.go
+++ b/builtin/logical/consul/secret_token.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/builtin/logical/database/backend.go b/builtin/logical/database/backend.go
index b92dd2f23ed..b64248bc698 100644
--- a/builtin/logical/database/backend.go
+++ b/builtin/logical/database/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"net/rpc"
+	"regexp"
 	"strconv"
 	"strings"
 	"sync"
@@ -28,6 +29,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/locksutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/queue"
+	"github.com/mitchellh/mapstructure"
 )
 
 const (
@@ -38,6 +40,8 @@ const (
 	minRootCredRollbackAge  = 1 * time.Minute
 )
 
+var databaseConfigNameFromRotationIDRegex = regexp.MustCompile("^.+/config/(.+$)")
+
 type dbPluginInstance struct {
 	sync.RWMutex
 	database databaseVersionWrapper
@@ -104,6 +108,7 @@ func Backend(conf *logical.BackendConfig) *databaseBackend {
 				"config/*",
 				"static-role/*",
 			},
+			AllowSnapshotRead: []string{"static-roles/*", "static-roles", "static-creds/*"},
 		},
 		Paths: framework.PathAppend(
 			[]*framework.Path{
@@ -126,6 +131,7 @@ func Backend(conf *logical.BackendConfig) *databaseBackend {
 		WALRollback:       b.walRollback,
 		WALRollbackMinAge: minRootCredRollbackAge,
 		BackendType:       logical.TypeLogical,
+		RotateCredential:  b.rotateRootCredential,
 	}
 
 	b.logger = conf.Logger
@@ -161,6 +167,9 @@ func (b *databaseBackend) collectPluginInstanceGaugeValues(context.Context) ([]m
 
 type databaseBackend struct {
 	// connections holds configured database connections by config name
+	createConnectionLock sync.Mutex
+
+	// Connections are loaded lazily, when a connection to a specific database plugin is needed.
 	connections *syncmap.SyncMap[string, *dbPluginInstance]
 	logger      log.Logger
 
@@ -204,6 +213,19 @@ func (b *databaseBackend) DatabaseConfig(ctx context.Context, s logical.Storage,
 	return &config, nil
 }
 
+// ConnectionDetails decodes the DatabaseConfig.ConnectionDetails map into a
+// struct
+func (b *databaseBackend) ConnectionDetails(ctx context.Context, config *DatabaseConfig) (*ConnectionDetails, error) {
+	cd := &ConnectionDetails{}
+
+	err := mapstructure.WeakDecode(config.ConnectionDetails, &cd)
+	if err != nil {
+		return nil, err
+	}
+
+	return cd, nil
+}
+
 type upgradeStatements struct {
 	// This json tag has a typo in it, the new version does not. This
 	// necessitates this upgrade logic.
@@ -227,6 +249,20 @@ func (b *databaseBackend) StaticRole(ctx context.Context, s logical.Storage, rol
 	return b.roleAtPath(ctx, s, roleName, databaseStaticRolePath)
 }
 
+func (b *databaseBackend) StoreStaticRole(ctx context.Context, s logical.Storage, r *roleEntry) error {
+	logger := b.Logger().With("role", r.Name, "database", r.DBName)
+	entry, err := logical.StorageEntryJSON(databaseStaticRolePath+r.Name, r)
+	if err != nil {
+		logger.Error("unable to encode entry for storage", "error", err)
+		return err
+	}
+	if err := s.Put(ctx, entry); err != nil {
+		logger.Error("unable to write to storage", "error", err)
+		return err
+	}
+	return nil
+}
+
 func (b *databaseBackend) roleAtPath(ctx context.Context, s logical.Storage, roleName string, pathPrefix string) (*roleEntry, error) {
 	entry, err := s.Get(ctx, pathPrefix+roleName)
 	if err != nil {
@@ -246,6 +282,11 @@ func (b *databaseBackend) roleAtPath(ctx context.Context, s logical.Storage, rol
 		return nil, err
 	}
 
+	// handle upgrade for new field Name
+	if result.Name == "" {
+		result.Name = roleName
+	}
+
 	switch {
 	case upgradeCh.Statements != nil:
 		var stmts v4.Statements
@@ -290,12 +331,36 @@ func (b *databaseBackend) GetConnection(ctx context.Context, s logical.Storage,
 	return b.GetConnectionWithConfig(ctx, name, config)
 }
 
+func (b *databaseBackend) GetConnectionSkipVerify(ctx context.Context, s logical.Storage, name string) (*dbPluginInstance, error) {
+	config, err := b.DatabaseConfig(ctx, s, name)
+	if err != nil {
+		return nil, err
+	}
+
+	// Force the skip verifying the connection
+	config.VerifyConnection = false
+
+	return b.GetConnectionWithConfig(ctx, name, config)
+}
+
 func (b *databaseBackend) GetConnectionWithConfig(ctx context.Context, name string, config *DatabaseConfig) (*dbPluginInstance, error) {
+	// fast path, reuse the existing connection
 	dbi := b.connections.Get(name)
 	if dbi != nil {
 		return dbi, nil
 	}
 
+	// slow path, create a new connection
+	// if we don't lock the rest of the operation, there is a race condition for multiple callers of this function
+	b.createConnectionLock.Lock()
+	defer b.createConnectionLock.Unlock()
+
+	// check again in case we lost the race
+	dbi = b.connections.Get(name)
+	if dbi != nil {
+		return dbi, nil
+	}
+
 	id, err := uuid.GenerateUUID()
 	if err != nil {
 		return nil, err
@@ -318,7 +383,7 @@ func (b *databaseBackend) GetConnectionWithConfig(ctx context.Context, name stri
 
 	initReq := v5.InitializeRequest{
 		Config:           config.ConnectionDetails,
-		VerifyConnection: true,
+		VerifyConnection: config.VerifyConnection,
 	}
 	_, err = dbw.Initialize(ctx, initReq)
 	if err != nil {
@@ -332,14 +397,17 @@ func (b *databaseBackend) GetConnectionWithConfig(ctx context.Context, name stri
 		name:                 name,
 		runningPluginVersion: pluginVersion,
 	}
-	oldConn := b.connections.Put(name, dbi)
-	if oldConn != nil {
-		err := oldConn.Close()
+	conn, ok := b.connections.PutIfEmpty(name, dbi)
+	if !ok {
+		// this is a bug
+		b.Logger().Warn("BUG: there was a race condition adding to the database connection map")
+		// There was already an existing connection, so we will use that and close our new one to avoid a race condition.
+		err := dbi.Close()
 		if err != nil {
-			b.Logger().Warn("Error closing database connection", "error", err)
+			b.Logger().Warn("Error closing new database connection", "error", err)
 		}
 	}
-	return dbi, nil
+	return conn, nil
 }
 
 // ClearConnection closes the database connection and
@@ -422,6 +490,69 @@ func (b *databaseBackend) dbEvent(ctx context.Context,
 	}
 }
 
+type AdditionalDatabaseMetadata struct {
+	key   string
+	value interface{}
+}
+
+func recordDatabaseObservation(ctx context.Context, b *databaseBackend, req *logical.Request, connectionName string, observationType string,
+	additionalMetadata ...AdditionalDatabaseMetadata,
+) {
+	metadata := map[string]interface{}{}
+
+	if req != nil {
+		metadata["path"] = req.Path
+		metadata["client_id"] = req.ClientID
+		metadata["entity_id"] = req.EntityID
+		metadata["request_id"] = req.ID
+	}
+
+	if connectionName != "" {
+		metadata["connection_name"] = connectionName
+	}
+
+	for _, meta := range additionalMetadata {
+		metadata[meta.key] = meta.value
+	}
+
+	err := b.RecordObservation(ctx, observationType, metadata)
+
+	if err != nil && !errors.Is(err, framework.ErrNoObservations) {
+		b.Logger().Error("error recording observation", "observationType", observationType, "error", err)
+	}
+}
+
+func (b *databaseBackend) getDatabaseConfigNameFromRotationID(path string) (string, error) {
+	if !databaseConfigNameFromRotationIDRegex.MatchString(path) {
+		return "", fmt.Errorf("no name found from rotation ID")
+	}
+	res := databaseConfigNameFromRotationIDRegex.FindStringSubmatch(path)
+	if len(res) != 2 {
+		return "", fmt.Errorf("unexpected number of matches (%d) for name in rotation ID", len(res))
+	}
+	return res[1], nil
+}
+
+// GetConnectionMetrics returns a count of the active Database connections.
+// The returned count depends on the database connections map which is not
+// guaranteed to be an exhaustive list of all configured connections.
+func (b *databaseBackend) GetConnectionMetrics() (map[string]int, error) {
+	// Access the private b.connections field here
+	counts := make(map[string]int)
+	connectionsCopy := b.connections.Values()
+
+	for _, v := range connectionsCopy {
+		dbType, err := v.database.Type()
+		if err != nil {
+			continue
+		}
+
+		counts[dbType]++
+	}
+
+	return counts, nil
+}
+
 const backendHelp = `
 The database backend supports using many different databases
 as secret backends, including but not limited to:
diff --git a/builtin/logical/database/backend_get_test.go b/builtin/logical/database/backend_get_test.go
new file mode 100644
index 00000000000..dc1bd4b50de
--- /dev/null
+++ b/builtin/logical/database/backend_get_test.go
@@ -0,0 +1,109 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package database
+
+import (
+	"context"
+	"sync"
+	"testing"
+
+	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/queue"
+)
+
+func newSystemViewWrapper(view logical.SystemView) logical.SystemView {
+	return &systemViewWrapper{
+		view,
+	}
+}
+
+type systemViewWrapper struct {
+	logical.SystemView
+}
+
+var _ logical.ExtendedSystemView = (*systemViewWrapper)(nil)
+
+func (s *systemViewWrapper) RequestWellKnownRedirect(ctx context.Context, src, dest string) error {
+	panic("nope")
+}
+
+func (s *systemViewWrapper) DeregisterWellKnownRedirect(ctx context.Context, src string) bool {
+	panic("nope")
+}
+
+func (s *systemViewWrapper) Auditor() logical.Auditor {
+	panic("nope")
+}
+
+func (s *systemViewWrapper) ForwardGenericRequest(ctx context.Context, request *logical.Request) (*logical.Response, error) {
+	panic("nope")
+}
+
+func (s *systemViewWrapper) APILockShouldBlockRequest() (bool, error) {
+	panic("nope")
+}
+
+func (s *systemViewWrapper) GetPinnedPluginVersion(ctx context.Context, pluginType consts.PluginType, pluginName string) (*pluginutil.PinnedVersion, error) {
+	return nil, pluginutil.ErrPinnedVersionNotFound
+}
+
+func (s *systemViewWrapper) LookupPluginVersion(ctx context.Context, pluginName string, pluginType consts.PluginType, version string) (*pluginutil.PluginRunner, error) {
+	return &pluginutil.PluginRunner{
+		Name:           mockv5,
+		Type:           consts.PluginTypeDatabase,
+		Builtin:        true,
+		BuiltinFactory: New,
+	}, nil
+}
+
+func getDbBackend(t *testing.T) (*databaseBackend, logical.Storage) {
+	t.Helper()
+	config := logical.TestBackendConfig()
+	config.System = newSystemViewWrapper(config.System)
+	config.StorageView = &logical.InmemStorage{}
+	// Create and init the backend ourselves instead of using a Factory because
+	// the factory function kicks off threads that cause racy tests.
+	b := Backend(config)
+	if err := b.Setup(context.Background(), config); err != nil {
+		t.Fatal(err)
+	}
+	b.schedule = &TestSchedule{}
+	b.credRotationQueue = queue.New()
+	b.populateQueue(context.Background(), config.StorageView)
+
+	return b, config.StorageView
+}
+
+// TestGetConnectionRaceCondition checks that GetConnection always returns the same instance, even when asked
+// by multiple goroutines in parallel.
+func TestGetConnectionRaceCondition(t *testing.T) {
+	ctx := context.Background()
+	b, s := getDbBackend(t)
+	defer b.Cleanup(ctx)
+	configureDBMount(t, s)
+
+	goroutines := 16
+
+	wg := sync.WaitGroup{}
+	wg.Add(goroutines)
+	dbis := make([]*dbPluginInstance, goroutines)
+	errs := make([]error, goroutines)
+	for i := 0; i < goroutines; i++ {
+		go func(i int) {
+			defer wg.Done()
+			dbis[i], errs[i] = b.GetConnection(ctx, s, mockv5)
+		}(i)
+	}
+	wg.Wait()
+	for i := 0; i < goroutines; i++ {
+		if errs[i] != nil {
+			t.Fatal(errs[i])
+		}
+		if dbis[0] != dbis[i] {
+			t.Fatal("Error: database instances did not match")
+		}
+	}
+}
diff --git a/builtin/logical/database/backend_test.go b/builtin/logical/database/backend_test.go
index a1b96ad392f..1cb10575fac 100644
--- a/builtin/logical/database/backend_test.go
+++ b/builtin/logical/database/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -23,9 +23,12 @@ import (
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/helper/builtinplugins"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/pluginconsts"
+	"github.com/hashicorp/vault/helper/testhelpers/certhelpers"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	postgreshelper "github.com/hashicorp/vault/helper/testhelpers/postgresql"
 	vaulthttp "github.com/hashicorp/vault/http"
+	"github.com/hashicorp/vault/plugins/database/cassandra"
 	"github.com/hashicorp/vault/plugins/database/postgresql"
 	v4 "github.com/hashicorp/vault/sdk/database/dbplugin"
 	v5 "github.com/hashicorp/vault/sdk/database/dbplugin/v5"
@@ -38,6 +41,7 @@ import (
 	_ "github.com/jackc/pgx/v4"
 	"github.com/mitchellh/mapstructure"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func getClusterPostgresDBWithFactory(t *testing.T, factory logical.Factory) (*vault.TestCluster, logical.SystemView) {
@@ -91,11 +95,21 @@ func TestBackend_PluginMain_PostgresMultiplexed(t *testing.T) {
 	v5.ServeMultiplex(postgresql.New)
 }
 
+// TestBackend_PluginMain_CassandraMultiplexed tests the Cassandra database plugin
+func TestBackend_PluginMain_CassandraMultiplexed(t *testing.T) {
+	if os.Getenv(pluginutil.PluginVaultVersionEnv) == "" {
+		return
+	}
+
+	v5.ServeMultiplex(cassandra.New)
+}
+
 func TestBackend_RoleUpgrade(t *testing.T) {
 	storage := &logical.InmemStorage{}
 	backend := &databaseBackend{}
 
 	roleExpected := &roleEntry{
+		Name: "test",
 		Statements: v4.Statements{
 			CreationStatements: "test",
 			Creation:           []string{"test"},
@@ -209,6 +223,12 @@ func TestBackend_config_connection(t *testing.T) {
 			"root_credentials_rotate_statements": []string{},
 			"password_policy":                    "",
 			"plugin_version":                     "",
+			"verify_connection":                  false,
+			"skip_static_role_import_rotation":   false,
+			"rotation_schedule":                  "",
+			"rotation_period":                    time.Duration(0).Seconds(),
+			"rotation_window":                    time.Duration(0).Seconds(),
+			"disable_automated_rotation":         false,
 		}
 		configReq.Operation = logical.ReadOperation
 		resp, err = b.HandleRequest(namespace.RootContext(nil), configReq)
@@ -263,6 +283,12 @@ func TestBackend_config_connection(t *testing.T) {
 			"root_credentials_rotate_statements": []string{},
 			"password_policy":                    "",
 			"plugin_version":                     "",
+			"verify_connection":                  false,
+			"skip_static_role_import_rotation":   false,
+			"rotation_schedule":                  "",
+			"rotation_period":                    time.Duration(0).Seconds(),
+			"rotation_window":                    time.Duration(0).Seconds(),
+			"disable_automated_rotation":         false,
 		}
 		configReq.Operation = logical.ReadOperation
 		resp, err = b.HandleRequest(namespace.RootContext(nil), configReq)
@@ -271,6 +297,7 @@ func TestBackend_config_connection(t *testing.T) {
 		}
 
 		delete(resp.Data["connection_details"].(map[string]interface{}), "name")
+		delete(resp.Data, "AutomatedRotationParams")
 		if !reflect.DeepEqual(expected, resp.Data) {
 			t.Fatalf("bad: expected:%#v\nactual:%#v\n", expected, resp.Data)
 		}
@@ -306,6 +333,12 @@ func TestBackend_config_connection(t *testing.T) {
 			"root_credentials_rotate_statements": []string{},
 			"password_policy":                    "",
 			"plugin_version":                     "",
+			"verify_connection":                  false,
+			"skip_static_role_import_rotation":   false,
+			"rotation_schedule":                  "",
+			"rotation_period":                    time.Duration(0).Seconds(),
+			"rotation_window":                    time.Duration(0).Seconds(),
+			"disable_automated_rotation":         false,
 		}
 		configReq.Operation = logical.ReadOperation
 		resp, err = b.HandleRequest(namespace.RootContext(nil), configReq)
@@ -314,6 +347,7 @@ func TestBackend_config_connection(t *testing.T) {
 		}
 
 		delete(resp.Data["connection_details"].(map[string]interface{}), "name")
+		delete(resp.Data, "AutomatedRotationParams")
 		if !reflect.DeepEqual(expected, resp.Data) {
 			t.Fatalf("bad: expected:%#v\nactual:%#v\n", expected, resp.Data)
 		}
@@ -345,6 +379,8 @@ func TestBackend_config_connection(t *testing.T) {
 	assert.Equal(t, "plugin-test", eventSender.Events[2].Event.Metadata.AsMap()["name"])
 }
 
+// TestBackend_BadConnectionString tests that an error response resulting from
+// a failed connection does not expose the URL. The middleware should sanitize it.
 func TestBackend_BadConnectionString(t *testing.T) {
 	cluster, sys := getClusterPostgresDB(t)
 	defer cluster.Cleanup()
@@ -359,7 +395,7 @@ func TestBackend_BadConnectionString(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, _ := postgreshelper.PrepareTestContainer(t, "13.4-buster")
+	cleanup, _ := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	respCheck := func(req *logical.Request) {
@@ -410,8 +446,8 @@ func TestBackend_basic(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "13.4-buster")
-	defer cleanup()
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
+	t.Cleanup(cleanup)
 
 	// Configure a connection
 	data := map[string]interface{}{
@@ -658,6 +694,7 @@ func (s *singletonDBFactory) factory(context.Context, *logical.BackendConfig) (l
 }
 
 func TestBackend_connectionCrud(t *testing.T) {
+	t.Parallel()
 	dbFactory := &singletonDBFactory{}
 	cluster, sys := getClusterPostgresDBWithFactory(t, dbFactory.factory)
 	defer cluster.Cleanup()
@@ -665,7 +702,7 @@ func TestBackend_connectionCrud(t *testing.T) {
 	dbFactory.sys = sys
 	client := cluster.Cores[0].Client.Logical()
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "13.4-buster")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// Mount the database plugin.
@@ -715,7 +752,6 @@ func TestBackend_connectionCrud(t *testing.T) {
 		"allowed_roles":  []string{"plugin-role-test"},
 		"username":       "postgres",
 		"password":       "secret",
-		"private_key":    "PRIVATE_KEY",
 	})
 	if err != nil {
 		t.Fatalf("err:%s resp:%#v\n", err, resp)
@@ -736,9 +772,6 @@ func TestBackend_connectionCrud(t *testing.T) {
 	if _, exists := returnedConnectionDetails["password"]; exists {
 		t.Fatal("password should NOT be found in the returned config")
 	}
-	if _, exists := returnedConnectionDetails["private_key"]; exists {
-		t.Fatal("private_key should NOT be found in the returned config")
-	}
 
 	// Replace connection url with templated version
 	templatedConnURL := strings.ReplaceAll(connURL, "postgres:secret", "{{username}}:{{password}}")
@@ -748,7 +781,6 @@ func TestBackend_connectionCrud(t *testing.T) {
 		"allowed_roles":  []string{"plugin-role-test"},
 		"username":       "postgres",
 		"password":       "secret",
-		"private_key":    "PRIVATE_KEY",
 	})
 	if err != nil {
 		t.Fatalf("err:%s resp:%#v\n", err, resp)
@@ -765,6 +797,12 @@ func TestBackend_connectionCrud(t *testing.T) {
 		"root_credentials_rotate_statements": []any{},
 		"password_policy":                    "",
 		"plugin_version":                     "",
+		"verify_connection":                  false,
+		"skip_static_role_import_rotation":   false,
+		"rotation_schedule":                  "",
+		"rotation_period":                    json.Number("0"),
+		"rotation_window":                    json.Number("0"),
+		"disable_automated_rotation":         false,
 	}
 	resp, err = client.Read("database/config/plugin-test")
 	if err != nil {
@@ -772,6 +810,7 @@ func TestBackend_connectionCrud(t *testing.T) {
 	}
 
 	delete(resp.Data["connection_details"].(map[string]interface{}), "name")
+	delete(resp.Data, "AutomatedRotationParams")
 	if diff := deep.Equal(resp.Data, expected); diff != nil {
 		t.Fatal(strings.Join(diff, "\n"))
 	}
@@ -854,6 +893,57 @@ func TestBackend_connectionCrud(t *testing.T) {
 	}
 }
 
+func TestBackend_connectionSanitizePrivateKey(t *testing.T) {
+	t.Parallel()
+	dbFactory := &singletonDBFactory{}
+	cluster, sys := getClusterPostgresDBWithFactory(t, dbFactory.factory)
+	defer cluster.Cleanup()
+
+	dbFactory.sys = sys
+	client := cluster.Cores[0].Client.Logical()
+
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
+	defer cleanup()
+
+	// Mount the database plugin.
+	resp, err := client.Write("sys/mounts/database", map[string]interface{}{
+		"type": "database",
+	})
+	if err != nil {
+		t.Fatalf("err:%s resp:%#v\n", err, resp)
+	}
+
+	caCert := certhelpers.NewCert(t, certhelpers.CommonName("ca"), certhelpers.IsCA(true), certhelpers.SelfSign())
+	clientCert := certhelpers.NewCert(t, certhelpers.CommonName("postgres"), certhelpers.DNS("localhost"), certhelpers.Parent(caCert))
+
+	// Create a connection
+	resp, err = client.Write("database/config/plugin-test", map[string]interface{}{
+		"connection_url":    connURL,
+		"plugin_name":       "postgresql-database-plugin",
+		"allowed_roles":     []string{"plugin-role-test"},
+		"username":          "postgres",
+		"tls_certificate":   string(clientCert.CombinedPEM()),
+		"private_key":       string(clientCert.PrivateKeyPEM()),
+		"tls_ca":            string(caCert.CombinedPEM()),
+		"verify_connection": false,
+	})
+	if err != nil {
+		t.Fatalf("err:%s resp:%#v\n", err, resp)
+	}
+
+	resp, err = client.Read("database/config/plugin-test")
+	if err != nil {
+		t.Fatalf("err:%s resp:%#v\n", err, resp)
+	}
+	returnedConnectionDetails := resp.Data["connection_details"].(map[string]interface{})
+	if strings.Contains(returnedConnectionDetails["connection_url"].(string), "secret") {
+		t.Fatal("password should not be found in the connection url")
+	}
+	if _, exists := returnedConnectionDetails["private_key"]; exists {
+		t.Fatal("private_key should NOT be found in the returned config")
+	}
+}
+
 func TestBackend_roleCrud(t *testing.T) {
 	cluster, sys := getClusterPostgresDB(t)
 	defer cluster.Cleanup()
@@ -872,7 +962,7 @@ func TestBackend_roleCrud(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "13.4-buster")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// Configure a connection
@@ -1121,7 +1211,7 @@ func TestBackend_allowedRoles(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "13.4-buster")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// Configure a connection
@@ -1318,7 +1408,7 @@ func TestBackend_RotateRootCredentials(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "13.4-buster")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	connURL = strings.ReplaceAll(connURL, "postgres:secret", "{{username}}:{{password}}")
@@ -1451,7 +1541,7 @@ func TestBackend_ConnectionURL_redacted(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			cleanup, u := postgreshelper.PrepareTestContainerWithPassword(t, "13.4-buster", tt.password)
+			cleanup, u := postgreshelper.PrepareTestContainerWithPassword(t, tt.password)
 			t.Cleanup(cleanup)
 
 			p, err := url.Parse(u)
@@ -1515,6 +1605,133 @@ func TestBackend_ConnectionURL_redacted(t *testing.T) {
 	}
 }
 
+// TestBackend_GetConnectionMetrics tests the GetConnectionMetrics method
+// of the database backend to ensure it correctly counts the number of connections
+// for each plugin type.
+func TestBackend_GetConnectionMetrics(t *testing.T) {
+	cluster, sys := getCluster(t)
+	defer cluster.Cleanup()
+
+	vault.TestAddTestPlugin(t, cluster.Cores[0].Core, "cassandra-database-plugin", consts.PluginTypeDatabase, "", "TestBackend_PluginMain_CassandraMultiplexed",
+		[]string{fmt.Sprintf("%s=%s", pluginutil.PluginCACertPEMEnv, cluster.CACertPEMFile)})
+	vault.TestAddTestPlugin(t, cluster.Cores[0].Core, "postgresql-database-plugin", consts.PluginTypeDatabase, "", "TestBackend_PluginMain_PostgresMultiplexed",
+		[]string{fmt.Sprintf("%s=%s", pluginutil.PluginCACertPEMEnv, cluster.CACertPEMFile)})
+
+	postgresConfig := map[string]interface{}{
+		"name":              "postgres-plugin-test",
+		"plugin_name":       "postgresql-database-plugin",
+		"connection_url":    "some_postgres_url",
+		"username":          "postgres",
+		"password":          "secret",
+		"verify_connection": false,
+	}
+
+	cassandraConfig := map[string]interface{}{
+		"name":              "cassandra-plugin-test",
+		"plugin_name":       "cassandra-database-plugin",
+		"hosts":             "some_cassandra_url",
+		"username":          "cassandra",
+		"password":          "secret",
+		"verify_connection": false,
+	}
+
+	postgresConfigV2 := map[string]interface{}{
+		"name":              "postgres-plugin-test-second-connection",
+		"plugin_name":       "postgresql-database-plugin",
+		"connection_url":    "some_postgres_url",
+		"username":          "postgres",
+		"password":          "secret",
+		"verify_connection": false,
+	}
+
+	cassandraConfigV2 := map[string]interface{}{
+		"name":              "cassandra-plugin-test-second-connection",
+		"plugin_name":       "cassandra-database-plugin",
+		"hosts":             "some_cassandra_url",
+		"username":          "cassandra",
+		"password":          "secret",
+		"verify_connection": false,
+	}
+
+	tests := []struct {
+		name              string
+		connectionConfigs []map[string]interface{}
+		expectedCounts    map[string]int
+	}{
+		{
+			name: "1 Postgres, 1 Cassandra connection",
+			connectionConfigs: []map[string]interface{}{
+				postgresConfig,
+				cassandraConfig,
+			},
+			expectedCounts: map[string]int{
+				pluginconsts.DbPostgresqlPluginType: 1,
+				pluginconsts.DbCassandraPluginType:  1,
+			},
+		},
+		{
+			name: "1 Postgres connection",
+			connectionConfigs: []map[string]interface{}{
+				postgresConfig,
+			},
+			expectedCounts: map[string]int{
+				pluginconsts.DbPostgresqlPluginType: 1,
+			},
+		},
+		{
+			name:              "No Connections",
+			connectionConfigs: []map[string]interface{}{},
+			expectedCounts:    map[string]int{},
+		},
+		{
+			name: " 2 Postgres, 2 Cassandra connections",
+			connectionConfigs: []map[string]interface{}{
+				postgresConfig,
+				postgresConfigV2,
+				cassandraConfig,
+				cassandraConfigV2,
+			},
+			expectedCounts: map[string]int{
+				pluginconsts.DbPostgresqlPluginType: 2,
+				pluginconsts.DbCassandraPluginType:  2,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			config := logical.TestBackendConfig()
+			config.StorageView = &logical.InmemStorage{}
+			config.System = sys
+
+			b, err := Factory(context.Background(), config)
+			require.NoError(t, err)
+			defer b.Cleanup(context.Background())
+
+			// Create connections
+			for _, connData := range tt.connectionConfigs {
+				req := &logical.Request{
+					Operation: logical.UpdateOperation,
+					Path:      fmt.Sprintf("config/%s", connData["name"]),
+					Storage:   config.StorageView,
+					Data:      connData,
+				}
+				resp, err := b.HandleRequest(namespace.RootContext(nil), req)
+				if err != nil || (resp != nil && resp.IsError()) {
+					t.Fatalf("Failed to configure connection %s: err:%s resp:%#v\n", connData["name"], err, resp)
+				}
+			}
+
+			// Get metric counts
+			metricsReporter, ok := b.(logical.MetricsReporter)
+			require.True(t, ok)
+			connectionCount, err := metricsReporter.GetConnectionMetrics()
+			require.NoError(t, err)
+			require.Equal(t, tt.expectedCounts, connectionCount, "Unexpected connection counts")
+		})
+	}
+}
+
 type hangingPlugin struct{}
 
 func (h hangingPlugin) Initialize(_ context.Context, req v5.InitializeRequest) (v5.InitializeResponse, error) {
diff --git a/builtin/logical/database/credentials.go b/builtin/logical/database/credentials.go
index 790dde05a35..3b305203102 100644
--- a/builtin/logical/database/credentials.go
+++ b/builtin/logical/database/credentials.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -6,7 +6,6 @@ package database
 import (
 	"context"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/pem"
@@ -18,6 +17,7 @@ import (
 	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/sdk/database/dbplugin/v5"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/helper/template"
 	"github.com/mitchellh/mapstructure"
 )
@@ -133,7 +133,7 @@ func (kg *rsaKeyGenerator) generate(r io.Reader) ([]byte, []byte, error) {
 		return nil, nil, fmt.Errorf("invalid key_bits: %v", kg.KeyBits)
 	}
 
-	key, err := rsa.GenerateKey(reader, keyBits)
+	key, err := cryptoutil.GenerateRSAKey(reader, keyBits)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/builtin/logical/database/credentials_test.go b/builtin/logical/database/credentials_test.go
index 7f2c4eb3dbb..2189034615a 100644
--- a/builtin/logical/database/credentials_test.go
+++ b/builtin/logical/database/credentials_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
diff --git a/builtin/logical/database/dbplugin/plugin_test.go b/builtin/logical/database/dbplugin/plugin_test.go
index 8c9737cdbff..f34cfc6edd0 100644
--- a/builtin/logical/database/dbplugin/plugin_test.go
+++ b/builtin/logical/database/dbplugin/plugin_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package dbplugin_test
diff --git a/builtin/logical/database/mocks_test.go b/builtin/logical/database/mocks_test.go
index 4182affd201..7796d8b09d1 100644
--- a/builtin/logical/database/mocks_test.go
+++ b/builtin/logical/database/mocks_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
diff --git a/builtin/logical/database/mockv4.go b/builtin/logical/database/mockv4.go
index f3a75351196..b6a86be2711 100644
--- a/builtin/logical/database/mockv4.go
+++ b/builtin/logical/database/mockv4.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
diff --git a/builtin/logical/database/mockv5.go b/builtin/logical/database/mockv5.go
index d532fed4bdf..969fe5cfe0a 100644
--- a/builtin/logical/database/mockv5.go
+++ b/builtin/logical/database/mockv5.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -51,6 +51,9 @@ func (m MockDatabaseV5) Initialize(ctx context.Context, req v5.InitializeRequest
 		"req", req)
 
 	config := req.Config
+	if config == nil {
+		config = map[string]interface{}{}
+	}
 	config["from-plugin"] = "this value is from the plugin itself"
 
 	resp := v5.InitializeResponse{
diff --git a/builtin/logical/database/observation_consts.go b/builtin/logical/database/observation_consts.go
new file mode 100644
index 00000000000..ff1f9857420
--- /dev/null
+++ b/builtin/logical/database/observation_consts.go
@@ -0,0 +1,60 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package database
+
+const (
+	// Connection related observations:
+
+	ObservationTypeDatabaseConfigWrite     = "database/connection/config/write"
+	ObservationTypeDatabaseConfigDelete    = "database/connection/config/delete"
+	ObservationTypeDatabaseConfigRead      = "database/connection/config/read"
+	ObservationTypeDatabaseConnectionReset = "database/connection/reset"
+
+	// Reload related observations:
+	// Note: the following three observations mean that, for any reload, Vault will emit
+	// n+1 observations, where n is the number of connections that we attempt to reload.
+	// database/plugin/reload will not contain a connection_name, as it will be a summary
+	// database/connection/reload/* will be per-plugin, and will contain a connection_name
+
+	// ObservationTypeDatabaseReloadPlugin is emitted when a plugin reload is issued
+	ObservationTypeDatabaseReloadPlugin = "database/plugin/reload"
+	// ObservationTypeDatabaseReloadSuccess is emitted for each connection successfully reloaded
+	ObservationTypeDatabaseReloadSuccess = "database/connection/reload/success"
+	// ObservationTypeDatabaseReloadFail is emitted for each connection unsuccessfully reloaded
+	ObservationTypeDatabaseReloadFail = "database/connection/reload/fail"
+
+	// Role related observations
+
+	ObservationTypeDatabaseRoleCreate = "database/role/create"
+	ObservationTypeDatabaseRoleUpdate = "database/role/update"
+	ObservationTypeDatabaseRoleRead   = "database/role/read"
+	// ObservationTypeDatabaseRoleDelete is emitted whenever a role is deleted.
+	// Note that this observation does not include a connection_name, to avoid doing an
+	// additional storage read.
+	ObservationTypeDatabaseRoleDelete = "database/role/delete"
+
+	ObservationTypeDatabaseCredentialCreateSuccess = "database/credential/create/success"
+	ObservationTypeDatabaseCredentialCreateFail    = "database/credential/create/fail"
+	ObservationTypeDatabaseCredentialRenew         = "database/credential/renew"
+	ObservationTypeDatabaseCredentialRevoke        = "database/credential/revoke"
+
+	// Rotate-root observations
+
+	ObservationTypeDatabaseRotateRootSuccess = "database/rotate-root/success"
+	ObservationTypeDatabaseRotateRootFailure = "database/rotate-root/fail"
+
+	// Static role observations
+
+	ObservationTypeDatabaseRotateStaticRoleSuccess = "database/static-role/rotate/success"
+	ObservationTypeDatabaseRotateStaticRoleFailure = "database/static-role/rotate/fail"
+	ObservationTypeDatabaseStaticRoleCreate        = "database/static-role/create"
+	ObservationTypeDatabaseStaticRoleUpdate        = "database/static-role/update"
+	ObservationTypeDatabaseStaticRoleRead          = "database/static-role/read"
+	// ObservationTypeDatabaseStaticRoleDelete is emitted whenever a static role is deleted.
+	// Note that this observation does not include a connection_name, to avoid doing an
+	// additional storage read.
+	ObservationTypeDatabaseStaticRoleDelete = "database/static-role/delete"
+
+	ObservationTypeDatabaseStaticCredentialRead = "database/static-credential/read"
+)
diff --git a/builtin/logical/database/path_config_connection.go b/builtin/logical/database/path_config_connection.go
index 2f8f40a1bf0..8701356415c 100644
--- a/builtin/logical/database/path_config_connection.go
+++ b/builtin/logical/database/path_config_connection.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"net/url"
 	"sort"
-	"strings"
 
 	"github.com/fatih/structs"
 	"github.com/hashicorp/go-uuid"
@@ -17,9 +16,11 @@ import (
 	"github.com/hashicorp/vault/helper/versions"
 	v5 "github.com/hashicorp/vault/sdk/database/dbplugin/v5"
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/automatedrotationutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/rotation"
 )
 
 var (
@@ -40,7 +41,23 @@ type DatabaseConfig struct {
 
 	RootCredentialsRotateStatements []string `json:"root_credentials_rotate_statements" structs:"root_credentials_rotate_statements" mapstructure:"root_credentials_rotate_statements"`
 
-	PasswordPolicy string `json:"password_policy" structs:"password_policy" mapstructure:"password_policy"`
+	PasswordPolicy   string `json:"password_policy" structs:"password_policy" mapstructure:"password_policy"`
+	VerifyConnection bool   `json:"verify_connection" structs:"verify_connection" mapstructure:"verify_connection"`
+
+	// SkipStaticRoleImportRotation is a flag to toggle wether or not a given
+	// static account's password should be rotated on creation of the static
+	// roles associated with this DB config. This can be overridden at the
+	// role-level by the role's skip_import_rotation field. The default is
+	// false. Enterprise only.
+	SkipStaticRoleImportRotation bool `json:"skip_static_role_import_rotation" structs:"skip_static_role_import_rotation" mapstructure:"skip_static_role_import_rotation"`
+
+	automatedrotationutil.AutomatedRotationParams
+}
+
+// ConnectionDetails represents the DatabaseConfig.ConnectionDetails map as a
+// struct
+type ConnectionDetails struct {
+	SelfManaged bool `json:"self_managed" structs:"self_managed" mapstructure:"self_managed"`
 }
 
 func (c *DatabaseConfig) SupportsCredentialType(credentialType v5.CredentialType) bool {
@@ -100,6 +117,7 @@ func (b *databaseBackend) pathConnectionReset() framework.OperationFunc {
 		}
 
 		b.dbEvent(ctx, "reset", req.Path, name, false)
+		recordDatabaseObservation(ctx, b, req, name, ObservationTypeDatabaseConnectionReset)
 		return nil, nil
 	}
 }
@@ -159,6 +177,7 @@ func (b *databaseBackend) reloadPlugin() framework.OperationFunc {
 			return nil, err
 		}
 		reloaded := []string{}
+		reloadFailed := []string{}
 		for _, connName := range connNames {
 			entry, err := req.Storage.Get(ctx, fmt.Sprintf("config/%s", connName))
 			if err != nil {
@@ -174,18 +193,26 @@ func (b *databaseBackend) reloadPlugin() framework.OperationFunc {
 			}
 			if config.PluginName == pluginName {
 				if err := b.reloadConnection(ctx, req.Storage, connName); err != nil {
-					var successfullyReloaded string
-					if len(reloaded) > 0 {
-						successfullyReloaded = fmt.Sprintf("successfully reloaded %d connection(s): %s; ",
-							len(reloaded),
-							strings.Join(reloaded, ", "))
-					}
-					return nil, fmt.Errorf("%sfailed to reload connection %q: %w", successfullyReloaded, connName, err)
+					b.Logger().Error("failed to reload connection", "name", connName, "error", err)
+					b.dbEvent(ctx, "reload-connection-fail", req.Path, "", false, "name", connName)
+					recordDatabaseObservation(ctx, b, req, connName, ObservationTypeDatabaseReloadFail,
+						AdditionalDatabaseMetadata{key: "plugin_name", value: pluginName})
+					reloadFailed = append(reloadFailed, connName)
+				} else {
+					b.Logger().Debug("reloaded connection", "name", connName)
+					b.dbEvent(ctx, "reload-connection", req.Path, "", true, "name", connName)
+					recordDatabaseObservation(ctx, b, req, connName, ObservationTypeDatabaseReloadSuccess,
+						AdditionalDatabaseMetadata{key: "plugin_name", value: pluginName})
+					reloaded = append(reloaded, connName)
 				}
-				reloaded = append(reloaded, connName)
 			}
 		}
 
+		recordDatabaseObservation(ctx, b, req, "", ObservationTypeDatabaseReloadPlugin,
+			AdditionalDatabaseMetadata{key: "plugin_name", value: pluginName},
+			AdditionalDatabaseMetadata{key: "reloaded", value: reloaded},
+			AdditionalDatabaseMetadata{key: "reload_failed", value: reloadFailed})
+
 		resp := &logical.Response{
 			Data: map[string]interface{}{
 				"connections": reloaded,
@@ -193,10 +220,12 @@ func (b *databaseBackend) reloadPlugin() framework.OperationFunc {
 			},
 		}
 
-		if len(reloaded) == 0 {
-			resp.AddWarning(fmt.Sprintf("no connections were found with plugin_name %q", pluginName))
+		if len(reloaded) > 0 {
+			b.dbEvent(ctx, "reload", req.Path, "", true, "plugin_name", pluginName)
+		} else if len(reloaded) == 0 && len(reloadFailed) == 0 {
+			b.Logger().Debug("no connections were found", "plugin_name", pluginName)
 		}
-		b.dbEvent(ctx, "reload", req.Path, "", true, "plugin_name", pluginName)
+
 		return resp, nil
 	}
 }
@@ -204,58 +233,62 @@ func (b *databaseBackend) reloadPlugin() framework.OperationFunc {
 // pathConfigurePluginConnection returns a configured framework.Path setup to
 // operate on plugins.
 func pathConfigurePluginConnection(b *databaseBackend) *framework.Path {
-	return &framework.Path{
-		Pattern: fmt.Sprintf("config/%s", framework.GenericNameRegex("name")),
-
-		DisplayAttrs: &framework.DisplayAttributes{
-			OperationPrefix: operationPrefixDatabase,
+	fields := map[string]*framework.FieldSchema{
+		"name": {
+			Type:        framework.TypeString,
+			Description: "Name of this database connection",
 		},
 
-		Fields: map[string]*framework.FieldSchema{
-			"name": {
-				Type:        framework.TypeString,
-				Description: "Name of this database connection",
-			},
-
-			"plugin_name": {
-				Type: framework.TypeString,
-				Description: `The name of a builtin or previously registered
+		"plugin_name": {
+			Type: framework.TypeString,
+			Description: `The name of a builtin or previously registered
 				plugin known to vault. This endpoint will create an instance of
 				that plugin type.`,
-			},
+		},
 
-			"plugin_version": {
-				Type:        framework.TypeString,
-				Description: `The version of the plugin to use.`,
-			},
+		"plugin_version": {
+			Type:        framework.TypeString,
+			Description: `The version of the plugin to use.`,
+		},
 
-			"verify_connection": {
-				Type:    framework.TypeBool,
-				Default: true,
-				Description: `If true, the connection details are verified by
+		"verify_connection": {
+			Type:    framework.TypeBool,
+			Default: true,
+			Description: `If true, the connection details are verified by
 				actually connecting to the database. Defaults to true.`,
-			},
+		},
 
-			"allowed_roles": {
-				Type: framework.TypeCommaStringSlice,
-				Description: `Comma separated string or array of the role names
+		"allowed_roles": {
+			Type: framework.TypeCommaStringSlice,
+			Description: `Comma separated string or array of the role names
 				allowed to get creds from this database connection. If empty no
 				roles are allowed. If "*" all roles are allowed.`,
-			},
+		},
 
-			"root_rotation_statements": {
-				Type: framework.TypeStringSlice,
-				Description: `Specifies the database statements to be executed
+		"root_rotation_statements": {
+			Type: framework.TypeStringSlice,
+			Description: `Specifies the database statements to be executed
 				to rotate the root user's credentials. See the plugin's API 
 				page for more information on support and formatting for this 
 				parameter.`,
-			},
-			"password_policy": {
-				Type:        framework.TypeString,
-				Description: `Password policy to use when generating passwords.`,
-			},
+		},
+		"password_policy": {
+			Type:        framework.TypeString,
+			Description: `Password policy to use when generating passwords.`,
+		},
+	}
+	AddConnectionFieldsEnt(fields)
+	automatedrotationutil.AddAutomatedRotationFields(fields)
+
+	return &framework.Path{
+		Pattern: fmt.Sprintf("config/%s", framework.GenericNameRegex("name")),
+
+		DisplayAttrs: &framework.DisplayAttributes{
+			OperationPrefix: operationPrefixDatabase,
 		},
 
+		Fields: fields,
+
 		ExistenceCheck: b.connectionExistenceCheck(),
 
 		Operations: map[logical.Operation]framework.OperationHandler{
@@ -265,6 +298,8 @@ func pathConfigurePluginConnection(b *databaseBackend) *framework.Path {
 					OperationVerb:   "configure",
 					OperationSuffix: "connection",
 				},
+				ForwardPerformanceSecondary: true,
+				ForwardPerformanceStandby:   true,
 			},
 			logical.UpdateOperation: &framework.PathOperation{
 				Callback: b.connectionWriteHandler(),
@@ -272,6 +307,8 @@ func pathConfigurePluginConnection(b *databaseBackend) *framework.Path {
 					OperationVerb:   "configure",
 					OperationSuffix: "connection",
 				},
+				ForwardPerformanceSecondary: true,
+				ForwardPerformanceStandby:   true,
 			},
 			logical.ReadOperation: &framework.PathOperation{
 				Callback: b.connectionReadHandler(),
@@ -378,7 +415,7 @@ func (b *databaseBackend) connectionReadHandler() framework.OperationFunc {
 		delete(config.ConnectionDetails, "service_account_json")
 
 		resp := &logical.Response{}
-		if dbi, err := b.GetConnection(ctx, req.Storage, name); err == nil {
+		if dbi, err := b.GetConnectionSkipVerify(ctx, req.Storage, name); err == nil {
 			config.RunningPluginVersion = dbi.runningPluginVersion
 			if config.PluginVersion != "" && config.PluginVersion != config.RunningPluginVersion {
 				warning := fmt.Sprintf("Plugin version is configured as %q, but running %q", config.PluginVersion, config.RunningPluginVersion)
@@ -392,6 +429,13 @@ func (b *databaseBackend) connectionReadHandler() framework.OperationFunc {
 		}
 
 		resp.Data = structs.New(config).Map()
+		config.PopulateAutomatedRotationData(resp.Data)
+		// remove extra nested AutomatedRotationParams key
+		// before returning response
+		delete(resp.Data, "AutomatedRotationParams")
+
+		recordDatabaseObservation(ctx, b, req, name, ObservationTypeDatabaseConfigRead)
+
 		return resp, nil
 	}
 }
@@ -414,6 +458,7 @@ func (b *databaseBackend) connectionDeleteHandler() framework.OperationFunc {
 		}
 
 		b.dbEvent(ctx, "config-delete", req.Path, name, true)
+		recordDatabaseObservation(ctx, b, req, name, ObservationTypeDatabaseConfigDelete)
 		return nil, nil
 	}
 }
@@ -422,15 +467,15 @@ func (b *databaseBackend) connectionDeleteHandler() framework.OperationFunc {
 // both builtin and plugin database types.
 func (b *databaseBackend) connectionWriteHandler() framework.OperationFunc {
 	return func(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
-		verifyConnection := data.Get("verify_connection").(bool)
-
 		name := data.Get("name").(string)
 		if name == "" {
 			return logical.ErrorResponse(respErrEmptyName), nil
 		}
 
 		// Baseline
-		config := &DatabaseConfig{}
+		config := &DatabaseConfig{
+			VerifyConnection: true,
+		}
 
 		entry, err := req.Storage.Get(ctx, fmt.Sprintf("config/%s", name))
 		if err != nil {
@@ -442,6 +487,13 @@ func (b *databaseBackend) connectionWriteHandler() framework.OperationFunc {
 			}
 		}
 
+		// If this value was provided as part of the request we want to set it to this value
+		if verifyConnectionRaw, ok := data.GetOk("verify_connection"); ok {
+			config.VerifyConnection = verifyConnectionRaw.(bool)
+		} else if req.Operation == logical.CreateOperation {
+			config.VerifyConnection = data.Get("verify_connection").(bool)
+		}
+
 		if pluginNameRaw, ok := data.GetOk("plugin_name"); ok {
 			config.PluginName = pluginNameRaw.(string)
 		} else if req.Operation == logical.CreateOperation {
@@ -472,6 +524,14 @@ func (b *databaseBackend) connectionWriteHandler() framework.OperationFunc {
 			config.PasswordPolicy = passwordPolicyRaw.(string)
 		}
 
+		if skipImportRotationRaw, ok := data.GetOk("skip_static_role_import_rotation"); ok {
+			config.SkipStaticRoleImportRotation = skipImportRotationRaw.(bool)
+		}
+
+		if err := config.ParseAutomatedRotationFields(data); err != nil {
+			return logical.ErrorResponse(err.Error()), nil
+		}
+
 		// Remove these entries from the data before we store it keyed under
 		// ConnectionDetails.
 		delete(data.Raw, "name")
@@ -481,6 +541,11 @@ func (b *databaseBackend) connectionWriteHandler() framework.OperationFunc {
 		delete(data.Raw, "verify_connection")
 		delete(data.Raw, "root_rotation_statements")
 		delete(data.Raw, "password_policy")
+		delete(data.Raw, "skip_static_role_import_rotation")
+		delete(data.Raw, "rotation_schedule")
+		delete(data.Raw, "rotation_window")
+		delete(data.Raw, "rotation_period")
+		delete(data.Raw, "disable_automated_rotation")
 
 		id, err := uuid.GenerateUUID()
 		if err != nil {
@@ -509,7 +574,7 @@ func (b *databaseBackend) connectionWriteHandler() framework.OperationFunc {
 
 		initReq := v5.InitializeRequest{
 			Config:           config.ConnectionDetails,
-			VerifyConnection: verifyConnection,
+			VerifyConnection: config.VerifyConnection,
 		}
 		initResp, err := dbw.Initialize(ctx, initReq)
 		if err != nil {
@@ -531,6 +596,36 @@ func (b *databaseBackend) connectionWriteHandler() framework.OperationFunc {
 			oldConn.Close()
 		}
 
+		var performedRotationManagerOpern string
+		if config.ShouldDeregisterRotationJob() {
+			performedRotationManagerOpern = rotation.PerformedDeregistration
+			// Disable Automated Rotation and Deregister credentials if required
+			deregisterReq := &rotation.RotationJobDeregisterRequest{
+				MountPoint: req.MountPoint,
+				ReqPath:    req.Path,
+			}
+
+			b.Logger().Debug("Deregistering rotation job", "mount", req.MountPoint+req.Path)
+			if err := b.System().DeregisterRotationJob(ctx, deregisterReq); err != nil {
+				return logical.ErrorResponse("error deregistering rotation job: %s", err), nil
+			}
+		} else if config.ShouldRegisterRotationJob() {
+			performedRotationManagerOpern = rotation.PerformedRegistration
+			// Register the rotation job if it's required.
+			cfgReq := &rotation.RotationJobConfigureRequest{
+				MountPoint:       req.MountPoint,
+				ReqPath:          req.Path,
+				RotationSchedule: config.RotationSchedule,
+				RotationWindow:   config.RotationWindow,
+				RotationPeriod:   config.RotationPeriod,
+			}
+
+			b.Logger().Debug("Registering rotation job", "mount", req.MountPoint+req.Path)
+			if _, err = b.System().RegisterRotationJob(ctx, cfgReq); err != nil {
+				return logical.ErrorResponse("error registering rotation job: %s", err), nil
+			}
+		}
+
 		// 1.12.0 and 1.12.1 stored builtin plugins in storage, but 1.12.2 reverted
 		// that, so clean up any pre-existing stored builtin versions on write.
 		if versions.IsBuiltinVersion(config.PluginVersion) {
@@ -538,7 +633,14 @@ func (b *databaseBackend) connectionWriteHandler() framework.OperationFunc {
 		}
 		err = storeConfig(ctx, req.Storage, name, config)
 		if err != nil {
-			return nil, err
+			wrappedError := err
+			if performedRotationManagerOpern != "" {
+				b.Logger().Error("write to storage failed but the rotation manager still succeeded.",
+					"operation", performedRotationManagerOpern, "mount", req.MountPoint, "path", req.Path)
+				wrappedError = fmt.Errorf("write to storage failed but the rotation manager still succeeded; "+
+					"operation=%s, mount=%s, path=%s, storageError=%s", performedRotationManagerOpern, req.MountPoint, req.Path, err)
+			}
+			return nil, wrappedError
 		}
 
 		resp := &logical.Response{}
@@ -560,7 +662,24 @@ func (b *databaseBackend) connectionWriteHandler() framework.OperationFunc {
 				"Vault (or the sdk if using a custom plugin) to gain password policy support", config.PluginName))
 		}
 
+		// We can ignore the error at this point since we're simply adding a warning.
+		dbType, _ := dbw.Type()
+		if dbType == "snowflake" && config.ConnectionDetails["password"] != nil {
+			resp.AddWarning(`[DEPRECATED] Single-factor password authentication is deprecated in Snowflake and will
+be removed by November 2025. Key pair authentication will be required after this date. Please
+see the Vault documentation for details on the removal of this feature. More information is
+available at https://www.snowflake.com/en/blog/blocking-single-factor-password-authentification`)
+		}
+
+		var rotationPeriodString string
+		if config.RotationPeriod != 0 {
+			rotationPeriodString = config.RotationPeriod.String()
+		}
 		b.dbEvent(ctx, "config-write", req.Path, name, true)
+		recordDatabaseObservation(ctx, b, req, name, ObservationTypeDatabaseConfigWrite,
+			AdditionalDatabaseMetadata{key: "root_rotation_period", value: rotationPeriodString},
+			AdditionalDatabaseMetadata{key: "root_rotation_schedule", value: config.RotationSchedule})
+
 		if len(resp.Warnings) == 0 {
 			return nil, nil
 		}
diff --git a/builtin/logical/database/path_config_connection_ce.go b/builtin/logical/database/path_config_connection_ce.go
new file mode 100644
index 00000000000..31a56fd557f
--- /dev/null
+++ b/builtin/logical/database/path_config_connection_ce.go
@@ -0,0 +1,13 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package database
+
+import "github.com/hashicorp/vault/sdk/framework"
+
+// AddConnectionFieldsEnt is a no-op for community edition
+func AddConnectionFieldsEnt(fields map[string]*framework.FieldSchema) {
+	// no-op
+}
diff --git a/builtin/logical/database/path_config_connection_test.go b/builtin/logical/database/path_config_connection_test.go
index 3741d82dc43..83a2c79bbb6 100644
--- a/builtin/logical/database/path_config_connection_test.go
+++ b/builtin/logical/database/path_config_connection_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
diff --git a/builtin/logical/database/path_creds_create.go b/builtin/logical/database/path_creds_create.go
index d8696fc0a12..43d215f7718 100644
--- a/builtin/logical/database/path_creds_create.go
+++ b/builtin/logical/database/path_creds_create.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -87,6 +87,21 @@ func (b *databaseBackend) pathCredsCreateRead() framework.OperationFunc {
 			return logical.ErrorResponse(fmt.Sprintf("unknown role: %s", name)), nil
 		}
 
+		defer func(credType *v5.CredentialType) {
+			if err == nil && (resp == nil || !resp.IsError()) {
+				recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseCredentialCreateSuccess,
+					AdditionalDatabaseMetadata{key: "role_name", value: name},
+					AdditionalDatabaseMetadata{key: "credential_type", value: credType.String()},
+					AdditionalDatabaseMetadata{key: "default_ttl", value: role.DefaultTTL.String()},
+					AdditionalDatabaseMetadata{key: "max_ttl", value: role.MaxTTL.String()})
+			} else {
+				b.dbEvent(ctx, "creds-create-fail", req.Path, name, modified)
+				recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseCredentialCreateFail,
+					AdditionalDatabaseMetadata{key: "role_name", value: name},
+					AdditionalDatabaseMetadata{key: "credential_type", value: credType.String()})
+			}
+		}(&role.CredentialType) // argument is evaluated now, but since it's a pointer should refer correctly to updated values
+
 		dbConfig, err := b.DatabaseConfig(ctx, req.Storage, role.DBName)
 		if err != nil {
 			return nil, err
@@ -141,21 +156,9 @@ func (b *databaseBackend) pathCredsCreateRead() framework.OperationFunc {
 		// Generate the credential based on the role's credential type
 		switch role.CredentialType {
 		case v5.CredentialTypePassword:
-			generator, err := newPasswordGenerator(role.CredentialConfig)
-			if err != nil {
-				return nil, fmt.Errorf("failed to construct credential generator: %s", err)
-			}
-
-			// Fall back to database config-level password policy if not set on role
-			if generator.PasswordPolicy == "" {
-				generator.PasswordPolicy = dbConfig.PasswordPolicy
-			}
-
-			// Generate the password
-			password, err := generator.generate(ctx, b, dbi.database)
+			password, err := b.generateNewPassword(ctx, role.CredentialConfig, dbConfig.PasswordPolicy, dbi)
 			if err != nil {
-				b.CloseIfShutdown(dbi, err)
-				return nil, fmt.Errorf("failed to generate password: %s", err)
+				return nil, err
 			}
 
 			// Set input credential
@@ -163,15 +166,9 @@ func (b *databaseBackend) pathCredsCreateRead() framework.OperationFunc {
 			newUserReq.Password = password
 
 		case v5.CredentialTypeRSAPrivateKey:
-			generator, err := newRSAKeyGenerator(role.CredentialConfig)
+			public, private, err := b.generateNewKeypair(role.CredentialConfig)
 			if err != nil {
-				return nil, fmt.Errorf("failed to construct credential generator: %s", err)
-			}
-
-			// Generate the RSA key pair
-			public, private, err := generator.generate(b.GetRandomReader())
-			if err != nil {
-				return nil, fmt.Errorf("failed to generate RSA key pair: %s", err)
+				return nil, err
 			}
 
 			// Set input credential
@@ -256,9 +253,11 @@ func (b *databaseBackend) pathStaticCredsRead() framework.OperationFunc {
 		}
 
 		respData := map[string]interface{}{
-			"username":            role.StaticAccount.Username,
-			"ttl":                 role.StaticAccount.CredentialTTL().Seconds(),
-			"last_vault_rotation": role.StaticAccount.LastVaultRotation,
+			"username": role.StaticAccount.Username,
+			"ttl":      role.StaticAccount.CredentialTTL().Seconds(),
+		}
+		if !role.StaticAccount.LastVaultRotation.IsZero() {
+			respData["last_vault_rotation"] = role.StaticAccount.LastVaultRotation
 		}
 
 		if role.StaticAccount.UsesRotationPeriod() {
@@ -268,6 +267,8 @@ func (b *databaseBackend) pathStaticCredsRead() framework.OperationFunc {
 			if role.StaticAccount.RotationWindow.Seconds() != 0 {
 				respData["rotation_window"] = role.StaticAccount.RotationWindow.Seconds()
 			}
+
+			respData["ttl"] = role.StaticAccount.CredentialTTL().Seconds()
 		}
 
 		switch role.CredentialType {
@@ -277,6 +278,10 @@ func (b *databaseBackend) pathStaticCredsRead() framework.OperationFunc {
 			respData["rsa_private_key"] = string(role.StaticAccount.PrivateKey)
 		}
 
+		recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseStaticCredentialRead,
+			AdditionalDatabaseMetadata{key: "role_name", value: name},
+			AdditionalDatabaseMetadata{key: "credential_type", value: role.CredentialType.String()})
+
 		return &logical.Response{
 			Data: respData,
 		}, nil
diff --git a/builtin/logical/database/path_roles.go b/builtin/logical/database/path_roles.go
index e223018962f..dd47eaabdda 100644
--- a/builtin/logical/database/path_roles.go
+++ b/builtin/logical/database/path_roles.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -20,6 +20,11 @@ import (
 	"github.com/robfig/cron/v3"
 )
 
+var (
+	errNoUpdateAfterRotation            = "updating password not allowed after rotation"
+	errNoPasswordAndSelfManagedPassword = "cannot set both `password` and `self_managed_password`"
+)
+
 func pathListRoles(b *databaseBackend) []*framework.Path {
 	return []*framework.Path{
 		{
@@ -87,10 +92,11 @@ func pathRoles(b *databaseBackend) []*framework.Path {
 			Fields:         fieldsForType(databaseStaticRolePath),
 			ExistenceCheck: b.pathStaticRoleExistenceCheck,
 			Callbacks: map[logical.Operation]framework.OperationFunc{
-				logical.ReadOperation:   b.pathStaticRoleRead,
-				logical.CreateOperation: b.pathStaticRoleCreateUpdate,
-				logical.UpdateOperation: b.pathStaticRoleCreateUpdate,
-				logical.DeleteOperation: b.pathStaticRoleDelete,
+				logical.ReadOperation:    b.pathStaticRoleRead,
+				logical.CreateOperation:  b.pathStaticRoleCreateUpdate,
+				logical.UpdateOperation:  b.pathStaticRoleCreateUpdate,
+				logical.DeleteOperation:  b.pathStaticRoleDelete,
+				logical.RecoverOperation: b.pathStaticRoleRecover,
 			},
 
 			HelpSynopsis:    pathStaticRoleHelpSyn,
@@ -217,7 +223,15 @@ func staticFields() map[string]*framework.FieldSchema {
 	this functionality. See the plugin's API page for more information on
 	support and formatting for this parameter.`,
 		},
+		// Deprecated: use 'password' instead
+		"self_managed_password": {
+			Type: framework.TypeString,
+			Description: `Used to connect to a self-managed static account. Must
+	be provided by the user when root credentials are not provided.`,
+			Deprecated: true,
+		},
 	}
+	AddStaticFieldsEnt(fields)
 	return fields
 }
 
@@ -244,6 +258,8 @@ func (b *databaseBackend) pathRoleDelete(ctx context.Context, req *logical.Reque
 		return nil, err
 	}
 	b.dbEvent(ctx, "role-delete", req.Path, name, true)
+	recordDatabaseObservation(ctx, b, req, "", ObservationTypeDatabaseRoleDelete,
+		AdditionalDatabaseMetadata{key: "role_name", value: name})
 	return nil, nil
 }
 
@@ -285,11 +301,14 @@ func (b *databaseBackend) pathStaticRoleDelete(ctx context.Context, req *logical
 	}
 
 	b.dbEvent(ctx, "static-role-delete", req.Path, name, true)
+	recordDatabaseObservation(ctx, b, req, "", ObservationTypeDatabaseStaticRoleDelete,
+		AdditionalDatabaseMetadata{key: "role_name", value: name})
 	return nil, merr.ErrorOrNil()
 }
 
 func (b *databaseBackend) pathStaticRoleRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	role, err := b.StaticRole(ctx, req.Storage, d.Get("name").(string))
+	roleName := d.Get("name").(string)
+	role, err := b.StaticRole(ctx, req.Storage, roleName)
 	if err != nil {
 		return nil, err
 	}
@@ -298,9 +317,10 @@ func (b *databaseBackend) pathStaticRoleRead(ctx context.Context, req *logical.R
 	}
 
 	data := map[string]interface{}{
-		"db_name":             role.DBName,
-		"rotation_statements": role.Statements.Rotation,
-		"credential_type":     role.CredentialType.String(),
+		"db_name":              role.DBName,
+		"rotation_statements":  role.Statements.Rotation,
+		"credential_type":      role.CredentialType.String(),
+		"skip_import_rotation": role.SkipImportRotation,
 	}
 
 	// guard against nil StaticAccount; shouldn't happen but we'll be safe
@@ -330,13 +350,17 @@ func (b *databaseBackend) pathStaticRoleRead(ctx context.Context, req *logical.R
 		data["rotation_statements"] = []string{}
 	}
 
+	recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseStaticRoleRead,
+		AdditionalDatabaseMetadata{key: "role_name", value: roleName})
+
 	return &logical.Response{
 		Data: data,
 	}, nil
 }
 
 func (b *databaseBackend) pathRoleRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	role, err := b.Role(ctx, req.Storage, d.Get("name").(string))
+	roleName := d.Get("name").(string)
+	role, err := b.Role(ctx, req.Storage, roleName)
 	if err != nil {
 		return nil, err
 	}
@@ -370,6 +394,9 @@ func (b *databaseBackend) pathRoleRead(ctx context.Context, req *logical.Request
 		data["renew_statements"] = []string{}
 	}
 
+	recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseRoleRead,
+		AdditionalDatabaseMetadata{key: "role_name", value: roleName})
+
 	return &logical.Response{
 		Data: data,
 	}, nil
@@ -413,6 +440,7 @@ func (b *databaseBackend) pathRoleCreateUpdate(ctx context.Context, req *logical
 	createOperation := (req.Operation == logical.CreateOperation)
 
 	// DB Attributes
+	var credentialType string
 	{
 		if dbNameRaw, ok := data.GetOk("db_name"); ok {
 			role.DBName = dbNameRaw.(string)
@@ -424,7 +452,7 @@ func (b *databaseBackend) pathRoleCreateUpdate(ctx context.Context, req *logical
 		}
 
 		if credentialTypeRaw, ok := data.GetOk("credential_type"); ok {
-			credentialType := credentialTypeRaw.(string)
+			credentialType = credentialTypeRaw.(string)
 			if err := role.setCredentialType(credentialType); err != nil {
 				return logical.ErrorResponse(err.Error()), nil
 			}
@@ -501,9 +529,63 @@ func (b *databaseBackend) pathRoleCreateUpdate(ctx context.Context, req *logical
 	}
 
 	b.dbEvent(ctx, fmt.Sprintf("role-%s", req.Operation), req.Path, name, true)
+
+	if createOperation {
+		recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseRoleCreate,
+			AdditionalDatabaseMetadata{key: "role_name", value: name},
+			AdditionalDatabaseMetadata{key: "credential_type", value: credentialType},
+			AdditionalDatabaseMetadata{key: "default_ttl", value: role.DefaultTTL.String()},
+			AdditionalDatabaseMetadata{key: "max_ttl", value: role.MaxTTL.String()})
+	} else {
+		recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseRoleUpdate,
+			AdditionalDatabaseMetadata{key: "role_name", value: name},
+			AdditionalDatabaseMetadata{key: "credential_type", value: credentialType},
+			AdditionalDatabaseMetadata{key: "default_ttl", value: role.DefaultTTL.String()},
+			AdditionalDatabaseMetadata{key: "max_ttl", value: role.MaxTTL.String()})
+	}
+
 	return nil, nil
 }
 
+func (b *databaseBackend) pathStaticRoleRecover(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	exists, err := b.pathStaticRoleExistenceCheck(ctx, req, data)
+	if err != nil {
+		return nil, err
+	}
+
+	if exists {
+		return logical.ErrorResponse("cannot recover a static role that already exists"), nil
+	}
+
+	snapStorage, err := logical.NewSnapshotStorageView(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create snapshot storage: %s", err)
+	}
+
+	name := data.Get("name").(string)
+	if req.RecoverSourcePath != "" {
+		fd, err := b.RecoverSourcePathFieldData(req)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse the recover source path: %w", err)
+		}
+		name = fd.Get("name").(string)
+	}
+
+	role, err := b.StaticRole(ctx, snapStorage, name)
+	if err != nil {
+		return nil, err
+	}
+	if role.StaticAccount.Password != "" {
+		data.Raw["password"] = role.StaticAccount.Password
+	}
+	req.Operation = logical.CreateOperation
+	defer func() {
+		req.Operation = logical.RecoverOperation
+	}()
+	return b.pathStaticRoleCreateUpdate(ctx, req, data)
+}
+
+// ignore-nil-nil-function-check
 func (b *databaseBackend) pathStaticRoleCreateUpdate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 	response := &logical.Response{}
 	name := data.Get("name").(string)
@@ -525,7 +607,7 @@ func (b *databaseBackend) pathStaticRoleCreateUpdate(ctx context.Context, req *l
 		return logical.ErrorResponse("Role and Static Role names must be unique"), nil
 	}
 
-	role, err := b.StaticRole(ctx, req.Storage, data.Get("name").(string))
+	role, err := b.StaticRole(ctx, req.Storage, name)
 	if err != nil {
 		return nil, err
 	}
@@ -536,6 +618,7 @@ func (b *databaseBackend) pathStaticRoleCreateUpdate(ctx context.Context, req *l
 	createRole := (req.Operation == logical.CreateOperation)
 	if role == nil {
 		role = &roleEntry{
+			Name:          name,
 			StaticAccount: &staticAccount{},
 		}
 		createRole = true
@@ -621,13 +704,69 @@ func (b *databaseBackend) pathStaticRoleCreateUpdate(ctx context.Context, req *l
 		role.Statements.Rotation = data.Get("rotation_statements").([]string)
 	}
 
+	var credentialType string
 	if credentialTypeRaw, ok := data.GetOk("credential_type"); ok {
-		credentialType := credentialTypeRaw.(string)
+		credentialType = credentialTypeRaw.(string)
 		if err := role.setCredentialType(credentialType); err != nil {
 			return logical.ErrorResponse(err.Error()), nil
 		}
 	}
 
+	dbConfig, err := b.DatabaseConfig(ctx, req.Storage, role.DBName)
+	if err != nil {
+		return nil, err
+	}
+
+	lastVaultRotation := role.StaticAccount.LastVaultRotation
+	updateAllowed := lastVaultRotation.IsZero()
+
+	if passwordRaw, ok := data.GetOk("password"); ok {
+		// We will allow users to update the password until the point where
+		// Vault assumes management of the account so that we don't break the
+		// promise of Vault being the source of truth.
+		if updateAllowed {
+			role.StaticAccount.Password = passwordRaw.(string)
+
+			connDetails, err := b.ConnectionDetails(ctx, dbConfig)
+			if err != nil {
+				return nil, err
+			}
+
+			if connDetails != nil && connDetails.SelfManaged {
+				// SelfManagedPassword was deprecated in favor of Password, so they
+				// should map to the same value
+				role.StaticAccount.SelfManagedPassword = passwordRaw.(string)
+			}
+		} else {
+			return logical.ErrorResponse("%s: role=%s, lastVaultRotation=%s", errNoUpdateAfterRotation, name, lastVaultRotation), nil
+		}
+	}
+
+	if smPasswordRaw, ok := data.GetOk("self_managed_password"); ok {
+		if _, ok := data.GetOk("password"); ok {
+			return logical.ErrorResponse(errNoPasswordAndSelfManagedPassword), nil
+		}
+		if updateAllowed {
+			// SelfManagedPassword was deprecated in favor of Password, so they
+			// should map to the same value
+			role.StaticAccount.SelfManagedPassword = smPasswordRaw.(string)
+			role.StaticAccount.Password = smPasswordRaw.(string)
+		} else {
+			return logical.ErrorResponse("%s: role=%s, lastVaultRotation=%s", errNoUpdateAfterRotation, name, lastVaultRotation), nil
+		}
+	}
+
+	if skipImportRotationRaw, ok := data.GetOk("skip_import_rotation"); ok {
+		if !createRole {
+			response.AddWarning("skip_import_rotation has no effect on updates")
+		} else {
+			role.SkipImportRotation = skipImportRotationRaw.(bool)
+		}
+	} else if createRole {
+		// default to the config-level setting
+		role.SkipImportRotation = dbConfig.SkipStaticRoleImportRotation
+	}
+
 	var credentialConfig map[string]string
 	if raw, ok := data.GetOk("credential_config"); ok {
 		credentialConfig = raw.(map[string]string)
@@ -638,72 +777,130 @@ func (b *databaseBackend) pathStaticRoleCreateUpdate(ctx context.Context, req *l
 		return logical.ErrorResponse("credential_config validation failed: %s", err), nil
 	}
 
-	// lvr represents the roles' LastVaultRotation
-	lvr := role.StaticAccount.LastVaultRotation
-
-	// Only call setStaticAccount if we're creating the role for the
-	// first time
+	// Only call setStaticAccount if we're creating the role for the first time
 	var item *queue.Item
 	switch req.Operation {
 	case logical.CreateOperation:
-		// setStaticAccount calls Storage.Put and saves the role to storage
-		resp, err := b.setStaticAccount(ctx, req.Storage, &setStaticAccountInput{
-			RoleName: name,
-			Role:     role,
-		})
-		if err != nil {
-			if resp != nil && resp.WALID != "" {
-				b.Logger().Debug("deleting WAL for failed role creation", "WAL ID", resp.WALID, "role", name)
-				walDeleteErr := framework.DeleteWAL(ctx, req.Storage, resp.WALID)
-				if walDeleteErr != nil {
-					b.Logger().Debug("failed to delete WAL for failed role creation", "WAL ID", resp.WALID, "error", walDeleteErr)
-					var merr *multierror.Error
-					merr = multierror.Append(merr, err)
-					merr = multierror.Append(merr, fmt.Errorf("failed to clean up WAL from failed role creation: %w", walDeleteErr))
-					err = merr.ErrorOrNil()
-				}
+		if role.SkipImportRotation {
+			b.Logger().Debug("skipping static role import rotation", "role", name)
+
+			// Synthetically set lastVaultRotation to now, so that it gets
+			// queued correctly.
+			// NOTE: We intentionally do not set role.StaticAccount.LastVaultRotation
+			// because the zero value indicates Vault has not rotated the
+			// password yet
+			lastVaultRotation = time.Now()
+
+			// NextVaultRotation allows calculating the TTL on GET /static-creds
+			// requests and to calculate the queue priority in populateQueue()
+			// across restarts. We can't rely on LastVaultRotation in these
+			// cases bacause, when import rotation is skipped, LastVaultRotation
+			// is set to a zero value in storage.
+			role.StaticAccount.SetNextVaultRotation(lastVaultRotation)
+
+			// we were told to not rotate, just add the entry
+			err := b.StoreStaticRole(ctx, req.Storage, role)
+			if err != nil {
+				return nil, err
 			}
+		} else {
+			// setStaticAccount calls Storage.Put and saves the role to storage
+			resp, err := b.setStaticAccount(ctx, req.Storage, &setStaticAccountInput{
+				RoleName: name,
+				Role:     role,
+			})
+			if err != nil {
+				if resp != nil && resp.WALID != "" {
+					b.Logger().Debug("deleting WAL for failed role creation", "WAL ID", resp.WALID, "role", name)
+					walDeleteErr := framework.DeleteWAL(ctx, req.Storage, resp.WALID)
+					if walDeleteErr != nil {
+						b.Logger().Debug("failed to delete WAL for failed role creation", "WAL ID", resp.WALID, "error", walDeleteErr)
+						var merr *multierror.Error
+						merr = multierror.Append(merr, err)
+						merr = multierror.Append(merr, fmt.Errorf("failed to clean up WAL from failed role creation: %w", walDeleteErr))
+						err = merr.ErrorOrNil()
+					}
+				}
 
-			return nil, err
+				return nil, err
+			}
+			// guard against RotationTime not being set or zero-value
+			lastVaultRotation = resp.RotationTime
 		}
-		// guard against RotationTime not being set or zero-value
-		lvr = resp.RotationTime
+
 		item = &queue.Item{
 			Key: name,
 		}
 	case logical.UpdateOperation:
+		// if lastVaultRotation is zero, the role had `skip_import_rotation` set
+		if lastVaultRotation.IsZero() {
+			lastVaultRotation = time.Now()
+		}
+
+		// Ensure that NextVaultRotation is recalculated in case the rotation period changed
+		role.StaticAccount.SetNextVaultRotation(lastVaultRotation)
+
 		// store updated Role
-		entry, err := logical.StorageEntryJSON(databaseStaticRolePath+name, role)
+		err := b.StoreStaticRole(ctx, req.Storage, role)
 		if err != nil {
 			return nil, err
 		}
-		if err := req.Storage.Put(ctx, entry); err != nil {
-			return nil, err
-		}
+
 		item, err = b.popFromRotationQueueByKey(name)
 		if err != nil {
 			return nil, err
 		}
 	}
 
+	var next time.Time
 	if rotationPeriodOk {
-		b.logger.Debug("init priority for RotationPeriod", "lvr", lvr, "next", lvr.Add(role.StaticAccount.RotationPeriod))
-		item.Priority = lvr.Add(role.StaticAccount.RotationPeriod).Unix()
+		next = lastVaultRotation.Add(role.StaticAccount.RotationPeriod)
+		item.Priority = next.Unix()
 	} else if rotationScheduleOk {
-		next := role.StaticAccount.Schedule.Next(lvr)
-		b.logger.Debug("init priority for Schedule", "lvr", lvr, "next", next)
+		next = role.StaticAccount.Schedule.Next(lastVaultRotation)
 		item.Priority = next.Unix()
 	}
+	b.logger.Trace("initialized priority", "role", name, "lastVaultRotation", lastVaultRotation, "next", next)
 
 	// Add their rotation to the queue
 	if err := b.pushItem(item); err != nil {
 		return nil, err
 	}
 	b.dbEvent(ctx, fmt.Sprintf("static-role-%s", req.Operation), req.Path, name, true)
+
+	var nextVaultRotation time.Time
+	var rotationPeriod time.Duration
+	if role.StaticAccount != nil {
+		nextVaultRotation = role.StaticAccount.NextVaultRotation
+		rotationPeriod = role.StaticAccount.RotationPeriod
+	}
+
+	if req.Operation == logical.CreateOperation {
+		recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseStaticRoleCreate,
+			AdditionalDatabaseMetadata{key: "role_name", value: name},
+			AdditionalDatabaseMetadata{key: "credential_type", value: role.CredentialType.String()},
+			AdditionalDatabaseMetadata{key: "rotation_period", value: rotationPeriod.String()},
+			AdditionalDatabaseMetadata{key: "rotation_schedule", value: rotationScheduleRaw},
+			AdditionalDatabaseMetadata{key: "next_vault_rotation", value: nextVaultRotation.String()},
+		)
+	} else {
+		recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseStaticRoleUpdate,
+			AdditionalDatabaseMetadata{key: "role_name", value: name},
+			AdditionalDatabaseMetadata{key: "credential_type", value: role.CredentialType.String()},
+			AdditionalDatabaseMetadata{key: "rotation_period", value: rotationPeriod.String()},
+			AdditionalDatabaseMetadata{key: "rotation_schedule", value: rotationScheduleRaw},
+			AdditionalDatabaseMetadata{key: "next_vault_rotation", value: nextVaultRotation.String()},
+		)
+	}
+
+	if len(response.Warnings) == 0 {
+		return nil, nil
+	}
 	return response, nil
 }
 
 type roleEntry struct {
+	Name             string                 `json:"name"`
 	DBName           string                 `json:"db_name"`
 	Statements       v4.Statements          `json:"statements"`
 	DefaultTTL       time.Duration          `json:"default_ttl"`
@@ -711,6 +908,12 @@ type roleEntry struct {
 	CredentialType   v5.CredentialType      `json:"credential_type"`
 	CredentialConfig map[string]interface{} `json:"credential_config"`
 	StaticAccount    *staticAccount         `json:"static_account" mapstructure:"static_account"`
+
+	// SkipImportRotation is a flag to toggle wether or not the static
+	// account's password should be rotated on creation of the static role.
+	// This overrides the config-level field skip_static_role_import_rotation.
+	// The default is false. Enterprise only.
+	SkipImportRotation bool `json:"skip_import_rotation"`
 }
 
 // setCredentialType sets the credential type for the role given its string form.
@@ -785,6 +988,12 @@ type staticAccount struct {
 	// Username to create or assume management for static accounts
 	Username string `json:"username"`
 
+	// SelfManagedPassword is used to make a dedicated connection to the DB
+	// user specified by Username. The credentials will leverage the existing
+	// static role mechanisms to handle password rotations. Required when root
+	// credentials are not provided.
+	SelfManagedPassword string `json:"self_managed_password"`
+
 	// Password is the current password credential for static accounts. As an input,
 	// this is used/required when trying to assume management of an existing static
 	// account. Returned on credential request if the role's credential type is
@@ -797,7 +1006,8 @@ type staticAccount struct {
 	// CredentialTypeRSAPrivateKey.
 	PrivateKey []byte `json:"private_key"`
 
-	// LastVaultRotation represents the last time Vault rotated the password
+	// LastVaultRotation represents the last time Vault rotated the password.
+	// A zero value indicates that Vault has not rotated this password yet.
 	LastVaultRotation time.Time `json:"last_vault_rotation"`
 
 	// NextVaultRotation represents the next time Vault is expected to rotate
@@ -836,7 +1046,7 @@ type staticAccount struct {
 // querying for the next schedule expiry since the last known vault rotation.
 func (s *staticAccount) NextRotationTime() time.Time {
 	if s.UsesRotationPeriod() {
-		return s.LastVaultRotation.Add(s.RotationPeriod)
+		return s.NextVaultRotation
 	}
 	return s.Schedule.Next(time.Now())
 }
@@ -885,7 +1095,8 @@ func (s *staticAccount) ShouldRotate(priority int64, t time.Time) bool {
 	return priority <= t.Unix() && s.IsInsideRotationWindow(t)
 }
 
-// SetNextVaultRotation
+// SetNextVaultRotation sets the next vault rotation to time t plus the role's
+// rotation period or to the next schedule.
 func (s *staticAccount) SetNextVaultRotation(t time.Time) {
 	if s.UsesRotationPeriod() {
 		s.NextVaultRotation = t.Add(s.RotationPeriod)
diff --git a/builtin/logical/database/path_roles_ce.go b/builtin/logical/database/path_roles_ce.go
new file mode 100644
index 00000000000..f483ff5cd23
--- /dev/null
+++ b/builtin/logical/database/path_roles_ce.go
@@ -0,0 +1,13 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package database
+
+import "github.com/hashicorp/vault/sdk/framework"
+
+// AddStaticFieldsEnt is a no-op for comminuty edition
+func AddStaticFieldsEnt(fields map[string]*framework.FieldSchema) {
+	// no-op
+}
diff --git a/builtin/logical/database/path_roles_test.go b/builtin/logical/database/path_roles_test.go
index 91737da2cf8..85cd4cd1763 100644
--- a/builtin/logical/database/path_roles_test.go
+++ b/builtin/logical/database/path_roles_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -15,9 +15,11 @@ import (
 	"github.com/hashicorp/vault/helper/namespace"
 	postgreshelper "github.com/hashicorp/vault/helper/testhelpers/postgresql"
 	v5 "github.com/hashicorp/vault/sdk/database/dbplugin/v5"
+	"github.com/hashicorp/vault/sdk/helper/testhelpers/snapshots"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
 )
 
 func TestBackend_Roles_CredentialTypes(t *testing.T) {
@@ -171,7 +173,7 @@ func TestBackend_Roles_CredentialTypes(t *testing.T) {
 				Storage:   config.StorageView,
 				Data: map[string]interface{}{
 					"db_name":             "test-database",
-					"creation_statements": "CREATE USER {{name}}",
+					"creation_statements": `CREATE USER "{{name}}"`,
 					"credential_type":     tt.args.credentialType.String(),
 					"credential_config":   tt.args.credentialConfig,
 				},
@@ -222,7 +224,7 @@ func TestBackend_StaticRole_Config(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// create the database user
@@ -487,7 +489,7 @@ func TestBackend_StaticRole_ReadCreds(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// create the database user
@@ -667,7 +669,7 @@ func TestBackend_StaticRole_Updates(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// create the database user
@@ -966,7 +968,7 @@ func TestBackend_StaticRole_Role_name_check(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// create the database user
@@ -1087,6 +1089,76 @@ func TestBackend_StaticRole_Role_name_check(t *testing.T) {
 	}
 }
 
+// TestStaticRole_NewCredentialGeneration verifies that new
+// credentials are generated if a retried credential continues
+// to fail
+func TestStaticRole_NewCredentialGeneration(t *testing.T) {
+	ctx := context.Background()
+	b, storage, mockDB := getBackend(t)
+	defer b.Cleanup(ctx)
+	configureDBMount(t, storage)
+
+	roleName := "hashicorp"
+	createRole(t, b, storage, mockDB, "hashicorp")
+
+	t.Run("rotation failures should generate new password on retry", func(t *testing.T) {
+		// Fail to rotate the role
+		generateWALFromFailedRotation(t, b, storage, mockDB, roleName)
+
+		// Get WAL
+		walIDs := requireWALs(t, storage, 1)
+		wal, err := b.findStaticWAL(ctx, storage, walIDs[0])
+		if err != nil || wal == nil {
+			t.Fatal(err)
+		}
+
+		// Store password
+		initialPassword := wal.NewPassword
+
+		// Rotate role manually and fail again #1 with same password
+		generateWALFromFailedRotation(t, b, storage, mockDB, roleName)
+
+		// Ensure WAL is deleted since retrying password failed
+		requireWALs(t, storage, 0)
+
+		// Successfully rotate the role
+		mockDB.On("UpdateUser", mock.Anything, mock.Anything).
+			Return(v5.UpdateUserResponse{}, nil).
+			Once()
+		_, err = b.HandleRequest(context.Background(), &logical.Request{
+			Operation: logical.UpdateOperation,
+			Path:      "rotate-role/" + roleName,
+			Storage:   storage,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		// Ensure WAL is flushed since request was successful
+		requireWALs(t, storage, 0)
+
+		// Read the credential
+		data := map[string]interface{}{}
+		req := &logical.Request{
+			Operation: logical.ReadOperation,
+			Path:      "static-creds/" + roleName,
+			Storage:   storage,
+			Data:      data,
+		}
+
+		resp, err := b.HandleRequest(namespace.RootContext(nil), req)
+		if err != nil || (resp != nil && resp.IsError()) {
+			t.Fatalf("err:%s resp:%#v\n", err, resp)
+		}
+
+		// Confirm successful rotation used new credential
+		// Assert previous failing credential is not being used
+		if resp.Data["password"] == initialPassword {
+			t.Fatalf("expected password to be different after second retry")
+		}
+	})
+}
+
 func TestWALsStillTrackedAfterUpdate(t *testing.T) {
 	ctx := context.Background()
 	b, storage, mockDB := getBackend(t)
@@ -1282,6 +1354,57 @@ func TestIsInsideRotationWindow(t *testing.T) {
 	}
 }
 
+// TestStaticRoleTTLAfterUpdate tests that a static roles
+// TTL is properly updated after updating rotation period
+// This addresses a bug in which NextVaultRotation was not
+// set on update
+func TestStaticRoleTTLAfterUpdate(t *testing.T) {
+	ctx := context.Background()
+	b, storage, mockDB := getBackend(t)
+	defer b.Cleanup(ctx)
+	configureDBMount(t, storage)
+
+	roleName := "hashicorp"
+	data := map[string]interface{}{
+		"username":        "hashicorp",
+		"db_name":         "mockv5",
+		"rotation_period": "10m",
+	}
+
+	createRoleWithData(t, b, storage, mockDB, roleName, data)
+	// read credential
+	resp := readStaticCred(t, b, storage, mockDB, roleName)
+	var initialTTL float64
+	if v, ok := resp.Data["ttl"]; !ok || v == nil {
+		require.FailNow(t, "initial ttl should be set")
+	} else {
+		initialTTL, ok = v.(float64)
+		if !ok {
+			require.FailNow(t, "expected ttl to be an integer")
+		}
+	}
+
+	updateStaticRoleWithData(t, b, storage, mockDB, roleName, map[string]interface{}{
+		"username":        "hashicorp",
+		"db_name":         "mockv5",
+		"rotation_period": "20m",
+	})
+
+	resp = readStaticCred(t, b, storage, mockDB, roleName)
+	var updatedTTL float64
+	if v, ok := resp.Data["ttl"]; !ok || v == nil {
+		require.FailNow(t, "expected ttl to be set after update")
+	} else {
+		updatedTTL, ok = v.(float64)
+		if !ok {
+			require.FailNow(t, "expected ttl to be a float64 after update")
+		}
+	}
+
+	require.Greaterf(t, updatedTTL, initialTTL, "expected ttl to be greater than %f, actual value: %f",
+		initialTTL, updatedTTL)
+}
+
 func createRole(t *testing.T, b *databaseBackend, storage logical.Storage, mockDB *mockNewDatabase, roleName string) {
 	t.Helper()
 	mockDB.On("UpdateUser", mock.Anything, mock.Anything).
@@ -1318,6 +1441,47 @@ func createRoleWithData(t *testing.T, b *databaseBackend, s logical.Storage, moc
 	}
 }
 
+func readStaticCred(t *testing.T, b *databaseBackend, s logical.Storage, mockDB *mockNewDatabase, roleName string) *logical.Response {
+	t.Helper()
+	mockDB.On("UpdateUser", mock.Anything, mock.Anything).
+		Return(v5.UpdateUserResponse{}, nil).
+		Once()
+	resp, err := b.HandleRequest(context.Background(), &logical.Request{
+		Operation: logical.ReadOperation,
+		Path:      "static-creds/" + roleName,
+		Storage:   s,
+	})
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatal(resp, err)
+	}
+	return resp
+}
+
+func updateStaticRoleWithData(t *testing.T, b *databaseBackend, storage logical.Storage, mockDB *mockNewDatabase, roleName string, d map[string]interface{}) {
+	t.Helper()
+
+	mockDB.On("UpdateUser", mock.Anything, mock.Anything).
+		Return(v5.UpdateUserResponse{}, nil).
+		Once()
+
+	req := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "static-roles/" + roleName,
+		Storage:   storage,
+		Data:      d,
+	}
+
+	resp, err := b.HandleRequest(context.Background(), req)
+	assert.NoError(t, err, "unexpected error")
+	if resp != nil {
+		assert.NoError(t, resp.Error(), "unexpected error in response")
+	}
+
+	if t.Failed() {
+		require.FailNow(t, "failed to update static role: %s", roleName)
+	}
+}
+
 const testRoleStaticCreate = `
 CREATE ROLE "{{name}}" WITH
   LOGIN
@@ -1331,3 +1495,90 @@ ALTER USER "{{name}}" WITH PASSWORD '{{password}}';
 const testRoleStaticUpdateRotation = `
 ALTER USER "{{name}}" WITH PASSWORD '{{password}}';GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "{{name}}";
 `
+
+// TestStaticRole_Recover verifies that a role that exists in a snapshot can be
+// read, listed, and recovered
+func TestStaticRole_Recover(t *testing.T) {
+	b, storage, mockDB := getBackend(t)
+	b2, snapStorage, mockDBSnap := getBackend(t)
+	ctx := context.Background()
+	defer b.Cleanup(ctx)
+	defer b2.Cleanup(ctx)
+	tc := snapshots.NewSnapshotTestCaseWithStorages(t, b, storage, snapStorage)
+
+	configureDBMount(t, storage)
+	configureDBMount(t, snapStorage)
+
+	createRole(t, b2, snapStorage, mockDBSnap, "hashicorp")
+
+	tc.RunRead(t, "static-roles/hashicorp")
+
+	tc.RunList(t, "static-roles")
+
+	mockDB.On("UpdateUser", mock.Anything, mock.Anything).
+		Return(v5.UpdateUserResponse{}, nil).
+		Once()
+	_, err := tc.DoRecover(t, "static-roles/hashicorp")
+	require.NoError(t, err)
+	readStaticCred(t, b, storage, mockDB, "hashicorp")
+
+	mockDB.On("UpdateUser", mock.Anything, mock.Anything).
+		Return(v5.UpdateUserResponse{}, nil).
+		Once()
+	_, err = tc.DoRecover(t, "static-roles/hashicorp-copy", snapshots.WithRecoverSourcePath("static-roles/hashicorp"))
+	require.NoError(t, err)
+	readStaticCred(t, b, storage, mockDB, "hashicorp-copy")
+}
+
+// TestStaticRole_RecoverExists verifies that a static role cannot be updated
+// via a recover operation, but can be copied to a new role
+func TestStaticRole_RecoverExists(t *testing.T) {
+	b, storage, mockDB := getBackend(t)
+	b2, snapStorage, mockDBSnap := getBackend(t)
+	ctx := context.Background()
+	defer b.Cleanup(ctx)
+	defer b2.Cleanup(ctx)
+	tc := snapshots.NewSnapshotTestCaseWithStorages(t, b, storage, snapStorage)
+
+	configureDBMount(t, storage)
+	configureDBMount(t, snapStorage)
+
+	createRole(t, b2, snapStorage, mockDBSnap, "hashicorp")
+	createRole(t, b, storage, mockDB, "hashicorp")
+
+	resp, err := tc.DoRecover(t, "static-roles/hashicorp")
+	require.NoError(t, err)
+	require.True(t, resp.IsError())
+	require.ErrorContains(t, resp.Error(), "cannot recover a static role that already exists")
+
+	mockDB.On("UpdateUser", mock.Anything, mock.Anything).
+		Return(v5.UpdateUserResponse{}, nil).
+		Once()
+	resp, err = tc.DoRecover(t, "static-roles/hashicorp-copy", snapshots.WithRecoverSourcePath("static-roles/hashicorp"))
+	require.NoError(t, err)
+	require.False(t, resp.IsError())
+	readStaticCred(t, b, storage, mockDB, "hashicorp-copy")
+}
+
+// TestStaticCreds_Recover verifies that static credentials can be read from the
+// snapshot without side effects, but they cannot be recovered
+func TestStaticCreds_Recover(t *testing.T) {
+	b, storage, mockDB := getBackend(t)
+	b2, snapStorage, mockDBSnap := getBackend(t)
+	ctx := context.Background()
+	defer b.Cleanup(ctx)
+	defer b2.Cleanup(ctx)
+	tc := snapshots.NewSnapshotTestCaseWithStorages(t, b, storage, snapStorage)
+
+	configureDBMount(t, storage)
+	configureDBMount(t, snapStorage)
+
+	createRole(t, b2, snapStorage, mockDBSnap, "hashicorp")
+	createRole(t, b, storage, mockDB, "hashicorp")
+
+	rotateRole(t, b, snapStorage, mockDB, "hashicorp")
+	tc.RunRead(t, "static-creds/hashicorp")
+
+	_, err := tc.DoRecover(t, "static-creds/hashicorp")
+	require.Error(t, err)
+}
diff --git a/builtin/logical/database/path_rotate_credentials.go b/builtin/logical/database/path_rotate_credentials.go
index f2f7fa321ea..a11a045cbf3 100644
--- a/builtin/logical/database/path_rotate_credentials.go
+++ b/builtin/logical/database/path_rotate_credentials.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -74,84 +74,147 @@ func pathRotateRootCredentials(b *databaseBackend) []*framework.Path {
 	}
 }
 
+func (b *databaseBackend) rotateRootCredential(ctx context.Context, req *logical.Request) error {
+	name, err := b.getDatabaseConfigNameFromRotationID(req.RotationID)
+	if err != nil {
+		return err
+	}
+
+	_, err = b.performRootRotation(ctx, req, name)
+
+	return err
+}
+
 func (b *databaseBackend) pathRotateRootCredentialsUpdate() framework.OperationFunc {
 	return func(ctx context.Context, req *logical.Request, data *framework.FieldData) (resp *logical.Response, err error) {
 		name := data.Get("name").(string)
-		modified := false
-		defer func() {
-			if err == nil {
-				b.dbEvent(ctx, "rotate-root", req.Path, name, modified)
-			} else {
-				b.dbEvent(ctx, "rotate-root-fail", req.Path, name, modified)
-			}
-		}()
-
-		if name == "" {
-			return logical.ErrorResponse(respErrEmptyName), nil
-		}
-
-		config, err := b.DatabaseConfig(ctx, req.Storage, name)
+		resp, err = b.performRootRotation(ctx, req, name)
 		if err != nil {
-			return nil, err
+			b.Logger().Error("failed to rotate root credential on user request", "path", req.Path, "error", err.Error())
+		} else {
+			b.Logger().Info("succesfully rotated root credential on user request", "path", req.Path)
 		}
+		return resp, err
+	}
+}
 
-		rootUsername, ok := config.ConnectionDetails["username"].(string)
-		if !ok || rootUsername == "" {
-			return nil, fmt.Errorf("unable to rotate root credentials: no username in configuration")
-		}
+func (b *databaseBackend) performRootRotation(ctx context.Context, req *logical.Request, name string) (resp *logical.Response, err error) {
+	if name == "" {
+		return logical.ErrorResponse(respErrEmptyName), nil
+	}
 
-		rootPassword, ok := config.ConnectionDetails["password"].(string)
-		if !ok || rootPassword == "" {
-			return nil, fmt.Errorf("unable to rotate root credentials: no password in configuration")
+	modified := false
+	defer func() {
+		if err == nil {
+			b.dbEvent(ctx, "rotate-root", req.Path, name, modified)
+		} else {
+			b.dbEvent(ctx, "rotate-root-fail", req.Path, name, modified)
 		}
+	}()
 
-		dbi, err := b.GetConnection(ctx, req.Storage, name)
-		if err != nil {
-			return nil, err
+	config, err := b.DatabaseConfig(ctx, req.Storage, name)
+	if err != nil {
+		return nil, err
+	}
+
+	defer func() {
+		if err == nil {
+			recordDatabaseObservation(ctx, b, req, name, ObservationTypeDatabaseRotateRootSuccess,
+				AdditionalDatabaseMetadata{key: "rotation_period", value: config.RotationPeriod.String()},
+				AdditionalDatabaseMetadata{key: "rotation_schedule", value: config.RotationSchedule})
+		} else {
+			recordDatabaseObservation(ctx, b, req, name, ObservationTypeDatabaseRotateRootFailure,
+				AdditionalDatabaseMetadata{key: "rotation_period", value: config.RotationPeriod.String()},
+				AdditionalDatabaseMetadata{key: "rotation_schedule", value: config.RotationSchedule})
 		}
+	}()
 
-		// Take the write lock on the instance
-		dbi.Lock()
-		defer func() {
-			dbi.Unlock()
-			// Even on error, still remove the connection
-			b.ClearConnectionId(name, dbi.id)
-		}()
-		defer func() {
-			// Close the plugin
-			dbi.closed = true
-			if err := dbi.database.Close(); err != nil {
-				b.Logger().Error("error closing the database plugin connection", "err", err)
-			}
-		}()
+	rootUsername, userOk := config.ConnectionDetails["username"].(string)
+	if !userOk || rootUsername == "" {
+		return nil, fmt.Errorf("unable to rotate root credentials: no username in configuration")
+	}
 
-		generator, err := newPasswordGenerator(nil)
-		if err != nil {
-			return nil, fmt.Errorf("failed to construct credential generator: %s", err)
-		}
-		generator.PasswordPolicy = config.PasswordPolicy
+	dbi, err := b.GetConnection(ctx, req.Storage, name)
+	if err != nil {
+		return nil, err
+	}
 
-		// Generate new credentials
-		oldPassword := config.ConnectionDetails["password"].(string)
-		newPassword, err := generator.generate(ctx, b, dbi.database)
-		if err != nil {
-			b.CloseIfShutdown(dbi, err)
-			return nil, fmt.Errorf("failed to generate password: %s", err)
-		}
-		config.ConnectionDetails["password"] = newPassword
+	dbType, err := dbi.database.Type()
+	if err != nil {
+		return nil, fmt.Errorf("unable to determine database type: %w", err)
+	}
+
+	rootPassword, passOk := config.ConnectionDetails["password"].(string)
+	isPasswordSet := passOk && rootPassword != ""
+
+	rootPrivateKey, pkeyOk := config.ConnectionDetails["private_key"].(string)
+	isPrivateKeySet := pkeyOk && rootPrivateKey != ""
+
+	// If both are unset, return an error. If we get past this, we know at least one is set.
+	if !isPasswordSet && !isPrivateKeySet {
+		return nil, fmt.Errorf("unable to rotate root credentials: both private_key and password fields are missing from the configuration")
+	}
 
-		// Write a WAL entry
-		walID, err := framework.PutWAL(ctx, req.Storage, rotateRootWALKey, &rotateRootCredentialsWAL{
-			ConnectionName: name,
-			UserName:       rootUsername,
-			OldPassword:    oldPassword,
-			NewPassword:    newPassword,
-		})
+	// If both are set, return an error.
+	if isPasswordSet && isPrivateKeySet {
+		return nil, fmt.Errorf("unable to rotate root credentials: both private_key and password fields are set in the configuration")
+	}
+
+	// Take the write lock on the instance
+	dbi.Lock()
+	defer func() {
+		dbi.Unlock()
+		// Even on error, still remove the connection
+		b.ClearConnectionId(name, dbi.id)
+	}()
+	defer func() {
+		// Close the plugin
+		dbi.closed = true
+		if err := dbi.database.Close(); err != nil {
+			b.Logger().Error("error closing the database plugin connection", "err", err)
+		}
+	}()
+
+	var walEntry *rotateRootCredentialsWAL
+	var updateReq v5.UpdateUserRequest
+	// If private key is set, use it. This takes precedence over password.
+	if isPrivateKeySet {
+		// For now snowflake is the only database type to support private key rotation.
+		if dbType == "snowflake" {
+			newKeypairCredentialConfig := map[string]interface{}{
+				"format":   "pkcs8",
+				"key_bits": 4096,
+			}
+			newPublicKey, newPrivateKey, err := b.generateNewKeypair(newKeypairCredentialConfig)
+			if err != nil {
+				return nil, err
+			}
+			config.ConnectionDetails["private_key"] = string(newPrivateKey)
+
+			oldPrivateKey := config.ConnectionDetails["private_key"].(string)
+			walEntry = NewRotateRootCredentialsWALPrivateKeyEntry(name, rootUsername, string(newPublicKey), string(newPrivateKey), oldPrivateKey)
+			updateReq = v5.UpdateUserRequest{
+				Username:       rootUsername,
+				CredentialType: v5.CredentialTypeRSAPrivateKey,
+				PublicKey: &v5.ChangePublicKey{
+					NewPublicKey: newPublicKey,
+					Statements: v5.Statements{
+						Commands: config.RootCredentialsRotateStatements,
+					},
+				},
+			}
+		}
+	} else {
+		// Private key isn't set so we're using the password field.
+		newPassword, err := b.generateNewPassword(ctx, nil, config.PasswordPolicy, dbi)
 		if err != nil {
 			return nil, err
 		}
+		config.ConnectionDetails["password"] = newPassword
 
-		updateReq := v5.UpdateUserRequest{
+		oldPassword := config.ConnectionDetails["password"].(string)
+		walEntry = NewRotateRootCredentialsWALPasswordEntry(name, rootUsername, newPassword, oldPassword)
+		updateReq = v5.UpdateUserRequest{
 			Username:       rootUsername,
 			CredentialType: v5.CredentialTypePassword,
 			Password: &v5.ChangePassword{
@@ -161,31 +224,42 @@ func (b *databaseBackend) pathRotateRootCredentialsUpdate() framework.OperationF
 				},
 			},
 		}
-		newConfigDetails, err := dbi.database.UpdateUser(ctx, updateReq, true)
-		if err != nil {
-			return nil, fmt.Errorf("failed to update user: %w", err)
-		}
-		if newConfigDetails != nil {
-			config.ConnectionDetails = newConfigDetails
-		}
-		modified = true
+	}
 
-		// 1.12.0 and 1.12.1 stored builtin plugins in storage, but 1.12.2 reverted
-		// that, so clean up any pre-existing stored builtin versions on write.
-		if versions.IsBuiltinVersion(config.PluginVersion) {
-			config.PluginVersion = ""
-		}
-		err = storeConfig(ctx, req.Storage, name, config)
-		if err != nil {
-			return nil, err
-		}
+	if walEntry == nil {
+		return nil, fmt.Errorf("unable to rotate root credentials: no valid credential type found")
+	}
 
-		err = framework.DeleteWAL(ctx, req.Storage, walID)
-		if err != nil {
-			b.Logger().Warn("unable to delete WAL", "error", err, "WAL ID", walID)
-		}
-		return nil, nil
+	// Write a WAL entry
+	walID, err := framework.PutWAL(ctx, req.Storage, rotateRootWALKey, walEntry)
+	if err != nil {
+		return nil, err
+	}
+
+	newConfigDetails, err := dbi.database.UpdateUser(ctx, updateReq, true)
+	if err != nil {
+		return nil, fmt.Errorf("failed to update user: %w", err)
+	}
+	if newConfigDetails != nil {
+		config.ConnectionDetails = newConfigDetails
 	}
+	modified = true
+
+	// 1.12.0 and 1.12.1 stored builtin plugins in storage, but 1.12.2 reverted
+	// that, so clean up any pre-existing stored builtin versions on write.
+	if versions.IsBuiltinVersion(config.PluginVersion) {
+		config.PluginVersion = ""
+	}
+	err = storeConfig(ctx, req.Storage, name, config)
+	if err != nil {
+		return nil, err
+	}
+
+	err = framework.DeleteWAL(ctx, req.Storage, walID)
+	if err != nil {
+		b.Logger().Warn("unable to delete WAL", "error", err, "WAL ID", walID)
+	}
+	return nil, nil
 }
 
 func (b *databaseBackend) pathRotateRoleCredentialsUpdate() framework.OperationFunc {
@@ -211,6 +285,24 @@ func (b *databaseBackend) pathRotateRoleCredentialsUpdate() framework.OperationF
 			return logical.ErrorResponse("no static role found for role name"), nil
 		}
 
+		// We defer after we've found that the static role exists, otherwise it's not really fair to say
+		// that the rotation failed.
+		defer func(s *staticAccount, credType *v5.CredentialType) {
+			if err == nil {
+				recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseRotateStaticRoleSuccess,
+					AdditionalDatabaseMetadata{key: "role_name", value: name},
+					AdditionalDatabaseMetadata{key: "credential_type", value: credType.String()},
+					AdditionalDatabaseMetadata{key: "credential_ttl", value: s.CredentialTTL().String()},
+					AdditionalDatabaseMetadata{key: "rotation_period", value: s.RotationPeriod.String()},
+					AdditionalDatabaseMetadata{key: "rotation_schedule", value: s.RotationSchedule},
+					AdditionalDatabaseMetadata{key: "next_vault_rotation", value: s.NextVaultRotation.String()})
+			} else {
+				recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseRotateStaticRoleFailure,
+					AdditionalDatabaseMetadata{key: "role_name", value: name},
+					AdditionalDatabaseMetadata{key: "credential_type", value: credType.String()})
+			}
+		}(role.StaticAccount, &role.CredentialType) // argument is evaluated now, but since it's a pointer should refer correctly to updated values
+
 		// In create/update of static accounts, we only care if the operation
 		// err'd , and this call does not return credentials
 		item, err := b.popFromRotationQueueByKey(name)
@@ -232,7 +324,7 @@ func (b *databaseBackend) pathRotateRoleCredentialsUpdate() framework.OperationF
 		// this item back on the queue. The err should still be returned at the end
 		// of this method.
 		if err != nil {
-			b.logger.Warn("unable to rotate credentials in rotate-role", "error", err)
+			b.logger.Error("unable to rotate credentials in rotate-role on user request", "path", req.Path, "error", err.Error())
 			// Update the priority to re-try this rotation and re-add the item to
 			// the queue
 			item.Priority = time.Now().Add(10 * time.Second).Unix()
@@ -243,6 +335,8 @@ func (b *databaseBackend) pathRotateRoleCredentialsUpdate() framework.OperationF
 			}
 		} else {
 			item.Priority = role.StaticAccount.NextRotationTimeFromInput(resp.RotationTime).Unix()
+			ttl := role.StaticAccount.CredentialTTL().Seconds()
+			b.Logger().Info("rotated credential in rotate-role on user request", "path", req.Path, "TTL", ttl)
 			// Clear any stored WAL ID as we must have successfully deleted our WAL to get here.
 			item.Value = ""
 			modified = true
@@ -258,7 +352,6 @@ func (b *databaseBackend) pathRotateRoleCredentialsUpdate() framework.OperationF
 				"continue in the background but it is also safe to retry manually: %w", err)
 		}
 
-		// return any err from the setStaticAccount call
 		return nil, nil
 	}
 }
diff --git a/builtin/logical/database/path_rotate_credentials_test.go b/builtin/logical/database/path_rotate_credentials_test.go
new file mode 100644
index 00000000000..14570224fd9
--- /dev/null
+++ b/builtin/logical/database/path_rotate_credentials_test.go
@@ -0,0 +1,171 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package database
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/vault/helper/namespace"
+	postgreshelper "github.com/hashicorp/vault/helper/testhelpers/postgresql"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// TestRotateRootPassword_Postgres tests database secrets root rotation for password credentials with Postgres.
+func TestRotateRootPassword_Postgres(t *testing.T) {
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
+	defer cleanup()
+
+	cluster, sys := getClusterWithFactory(t, Factory)
+	defer cluster.Cleanup()
+
+	connURL = strings.Replace(connURL, "postgres:secret", "{{username}}:{{password}}", 1)
+
+	testRotateRoot(t, sys, true, connURL, "postgresql-database-plugin", "postgres", "secret")
+}
+
+// TestRotateRootKeypair_Snowflake_Acc tests database secrets root rotation for private key credentials with Snowflake.
+func TestRotateRootKeypair_Snowflake_Acc(t *testing.T) {
+	// SNOWFLAKE_PRIVATE_KEY is the path to the private key file.
+	privateKeyPath, ok := os.LookupEnv("VAULT_SNOWFLAKE_PRIVATE_KEY")
+	if !ok {
+		t.Skip("VAULT_SNOWFLAKE_PRIVATE_KEY not set, skipping test")
+	}
+
+	keyFile, err := os.ReadFile(privateKeyPath)
+	if err != nil {
+		t.Fatalf("failed to read private key file: %s", err)
+	}
+
+	connURL, ok := os.LookupEnv("VAULT_SNOWFLAKE_CONNECTION_URL")
+	if !ok {
+		t.Skip("VAULT_SNOWFLAKE_CONNECTION_URL not set, skipping test")
+	}
+
+	username, ok := os.LookupEnv("VAULT_SNOWFLAKE_USERNAME")
+	if !ok {
+		t.Skip("VAULT_SNOWFLAKE_USERNAME not set, skipping test")
+	}
+
+	cluster, sys := getClusterWithFactory(t, Factory)
+	defer cluster.Cleanup()
+
+	testRotateRoot(t, sys, false, connURL, "snowflake-database-plugin", username, string(keyFile))
+}
+
+// Helper function to run rotate root tests.
+func testRotateRoot(t *testing.T, sys logical.SystemView, isPassword bool, connURL string, pluginName, username, credential string) {
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+	config.System = sys
+
+	lb, err := Factory(context.Background(), config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, ok := lb.(*databaseBackend)
+	if !ok {
+		t.Fatal("could not convert to db backend")
+	}
+	defer b.Cleanup(context.Background())
+
+	// Configure a connection
+	configData := map[string]any{
+		"connection_url":    connURL,
+		"plugin_name":       pluginName,
+		"verify_connection": false,
+		"allowed_roles":     []string{"*"},
+		"name":              "plugin-test",
+		"username":          username,
+	}
+	if isPassword {
+		configData["password"] = credential
+	} else {
+		configData["private_key"] = credential
+	}
+	req := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "config/plugin-test",
+		Storage:   config.StorageView,
+		Data:      configData,
+	}
+	resp, err := b.HandleRequest(namespace.RootContext(context.Background()), req)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("err:%s resp:%#v\n", err, resp)
+	}
+
+	// Create a dynamic role
+	req = &logical.Request{
+		Operation: logical.CreateOperation,
+		Path:      "roles/test",
+		Storage:   config.StorageView,
+		Data: map[string]interface{}{
+			"db_name":             "plugin-test",
+			"creation_statements": `CREATE USER "{{name}}"`,
+		},
+	}
+	resp, err = b.HandleRequest(context.Background(), req)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("err:%s resp:%#v\n", err, resp)
+	}
+
+	// Read some creds to validate the connection
+	req = &logical.Request{
+		Operation: logical.ReadOperation,
+		Path:      "creds/test",
+		Storage:   config.StorageView,
+	}
+	resp, err = b.HandleRequest(context.Background(), req)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("err:%s resp:%#v\n", err, resp)
+	}
+
+	// Rotate the root credentials
+	req = &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "rotate-root/plugin-test",
+		Storage:   config.StorageView,
+	}
+	resp, err = b.HandleRequest(namespace.RootContext(context.Background()), req)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("err:%s resp:%#v\n", err, resp)
+	}
+
+	// Read creds a second time to validate the root rotation still works
+	req = &logical.Request{
+		Operation: logical.ReadOperation,
+		Path:      "creds/test",
+		Storage:   config.StorageView,
+	}
+	resp, err = b.HandleRequest(context.Background(), req)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("err:%s resp:%#v\n", err, resp)
+	}
+
+	// Write back the original credential to ensure it no longer works
+	req = &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "config/plugin-test",
+		Storage:   config.StorageView,
+		Data:      configData,
+	}
+	resp, err = b.HandleRequest(namespace.RootContext(context.Background()), req)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("err:%s resp:%#v\n", err, resp)
+	}
+
+	// Read some more creds again and expect an error]
+	// Note: For Snowflake, this step may fail if you are using the account's 2nd private key
+	req = &logical.Request{
+		Operation: logical.ReadOperation,
+		Path:      "creds/test",
+		Storage:   config.StorageView,
+	}
+	resp, err = b.HandleRequest(context.Background(), req)
+	if err == nil || (resp != nil && !resp.IsError()) {
+		t.Fatalf("expected authentication error but did not receive an error, resp:%#v\n", resp)
+	}
+}
diff --git a/builtin/logical/database/rollback.go b/builtin/logical/database/rollback.go
index 6e1b1dc4840..d1b3b07c40b 100644
--- a/builtin/logical/database/rollback.go
+++ b/builtin/logical/database/rollback.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -22,8 +22,32 @@ const rotateRootWALKey = "rotateRootWALKey"
 type rotateRootCredentialsWAL struct {
 	ConnectionName string
 	UserName       string
-	NewPassword    string
-	OldPassword    string
+
+	NewPassword string
+	OldPassword string
+
+	NewPublicKey  string
+	NewPrivateKey string
+	OldPrivateKey string
+}
+
+func NewRotateRootCredentialsWALPasswordEntry(connectionName, userName, newPassword, oldPassword string) *rotateRootCredentialsWAL {
+	return &rotateRootCredentialsWAL{
+		ConnectionName: connectionName,
+		UserName:       userName,
+		NewPassword:    newPassword,
+		OldPassword:    oldPassword,
+	}
+}
+
+func NewRotateRootCredentialsWALPrivateKeyEntry(connectionName, userName, newPublicKey, newPrivateKey, oldPrivateKey string) *rotateRootCredentialsWAL {
+	return &rotateRootCredentialsWAL{
+		ConnectionName: connectionName,
+		UserName:       userName,
+		NewPublicKey:   newPublicKey,
+		NewPrivateKey:  newPrivateKey,
+		OldPrivateKey:  oldPrivateKey,
+	}
 }
 
 // walRollback handles WAL entries that result from partial failures
diff --git a/builtin/logical/database/rollback_test.go b/builtin/logical/database/rollback_test.go
index f60491a6662..a3d48c5a49c 100644
--- a/builtin/logical/database/rollback_test.go
+++ b/builtin/logical/database/rollback_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -44,7 +44,7 @@ func TestBackend_RotateRootCredentials_WAL_rollback(t *testing.T) {
 	}
 	defer lb.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	connURL = strings.ReplaceAll(connURL, "postgres:secret", "{{username}}:{{password}}")
@@ -129,12 +129,7 @@ func TestBackend_RotateRootCredentials_WAL_rollback(t *testing.T) {
 	}
 
 	// Put a WAL entry that will be used for rolling back the database password
-	walEntry := &rotateRootCredentialsWAL{
-		ConnectionName: "plugin-test",
-		UserName:       databaseUser,
-		OldPassword:    defaultPassword,
-		NewPassword:    "newSecret",
-	}
+	walEntry := NewRotateRootCredentialsWALPasswordEntry("plugin-test", databaseUser, "newSecret", defaultPassword)
 	_, err = framework.PutWAL(context.Background(), config.StorageView, rotateRootWALKey, walEntry)
 	if err != nil {
 		t.Fatal(err)
@@ -183,7 +178,7 @@ func TestBackend_RotateRootCredentials_WAL_no_rollback_1(t *testing.T) {
 	}
 	defer lb.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	connURL = strings.ReplaceAll(connURL, "postgres:secret", "{{username}}:{{password}}")
@@ -235,12 +230,7 @@ func TestBackend_RotateRootCredentials_WAL_no_rollback_1(t *testing.T) {
 	}
 
 	// Put a WAL entry
-	walEntry := &rotateRootCredentialsWAL{
-		ConnectionName: "plugin-test",
-		UserName:       databaseUser,
-		OldPassword:    defaultPassword,
-		NewPassword:    "newSecret",
-	}
+	walEntry := NewRotateRootCredentialsWALPasswordEntry("plugin-test", databaseUser, "newSecret", defaultPassword)
 	_, err = framework.PutWAL(context.Background(), config.StorageView, rotateRootWALKey, walEntry)
 	if err != nil {
 		t.Fatal(err)
@@ -291,7 +281,7 @@ func TestBackend_RotateRootCredentials_WAL_no_rollback_2(t *testing.T) {
 	}
 	defer lb.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	connURL = strings.ReplaceAll(connURL, "postgres:secret", "{{username}}:{{password}}")
@@ -391,12 +381,7 @@ func TestBackend_RotateRootCredentials_WAL_no_rollback_2(t *testing.T) {
 	}
 
 	// Put a WAL entry
-	walEntry := &rotateRootCredentialsWAL{
-		ConnectionName: "plugin-test",
-		UserName:       databaseUser,
-		OldPassword:    defaultPassword,
-		NewPassword:    "newSecret",
-	}
+	walEntry := NewRotateRootCredentialsWALPasswordEntry("plugin-test", databaseUser, "newSecret", defaultPassword)
 	_, err = framework.PutWAL(context.Background(), config.StorageView, rotateRootWALKey, walEntry)
 	if err != nil {
 		t.Fatal(err)
diff --git a/builtin/logical/database/rotation.go b/builtin/logical/database/rotation.go
index 0e5840bd30c..b93878d9187 100644
--- a/builtin/logical/database/rotation.go
+++ b/builtin/logical/database/rotation.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -64,6 +64,25 @@ func (b *databaseBackend) populateQueue(ctx context.Context, s logical.Storage)
 			continue
 		}
 
+		// If an account's NextVaultRotation period is zero time (time.Time{}), it means that the
+		// role was created before we added the `NextVaultRotation` field. In this
+		// case, we need to calculate the next rotation time based on the
+		// LastVaultRotation and the RotationPeriod. However, if the role was
+		// created with skip_import_rotation set, we need to use the current time
+		// instead of LastVaultRotation because LastVaultRotation is 0
+		if role.StaticAccount.NextVaultRotation.IsZero() {
+			log.Debug("NextVaultRotation unset (zero time). Role may predate field", roleName)
+			if role.StaticAccount.LastVaultRotation.IsZero() {
+				log.Debug("Setting NextVaultRotation based on current time", roleName)
+				role.StaticAccount.SetNextVaultRotation(time.Now())
+			} else {
+				log.Debug("Setting NextVaultRotation based on LastVaultRotation", roleName)
+				role.StaticAccount.SetNextVaultRotation(role.StaticAccount.LastVaultRotation)
+			}
+
+			b.StoreStaticRole(ctx, s, role)
+		}
+
 		item := queue.Item{
 			Key:      roleName,
 			Priority: role.StaticAccount.NextRotationTime().Unix(),
@@ -234,13 +253,8 @@ func (b *databaseBackend) rotateCredential(ctx context.Context, s logical.Storag
 			// write to storage after updating NextVaultRotation so the next
 			// time this item is checked for rotation our role that we retrieve
 			// from storage reflects that change
-			entry, err := logical.StorageEntryJSON(databaseStaticRolePath+input.RoleName, input.Role)
+			err := b.StoreStaticRole(ctx, s, input.Role)
 			if err != nil {
-				logger.Error("unable to encode entry for storage", "error", err)
-				return false
-			}
-			if err := s.Put(ctx, entry); err != nil {
-				logger.Error("unable to write to storage", "error", err)
 				return false
 			}
 		}
@@ -254,13 +268,24 @@ func (b *databaseBackend) rotateCredential(ctx context.Context, s logical.Storag
 
 	// send an event indicating if the rotation was a success or failure
 	rotated := false
-	defer func() {
+	defer func(s *staticAccount, credType *v5.CredentialType) {
 		if rotated {
+			b.Logger().Info("successfully rotated static role", "name", roleName, "ttl", s.CredentialTTL().Seconds())
 			b.dbEvent(ctx, "rotate", "", roleName, true)
+			recordDatabaseObservation(ctx, b, nil, role.DBName, ObservationTypeDatabaseRotateStaticRoleSuccess,
+				AdditionalDatabaseMetadata{key: "role_name", value: roleName},
+				AdditionalDatabaseMetadata{key: "credential_type", value: credType.String()},
+				AdditionalDatabaseMetadata{key: "credential_ttl", value: s.CredentialTTL().String()},
+				AdditionalDatabaseMetadata{key: "rotation_period", value: s.RotationPeriod.String()},
+				AdditionalDatabaseMetadata{key: "rotation_schedule", value: s.RotationSchedule},
+				AdditionalDatabaseMetadata{key: "next_vault_rotation", value: s.NextVaultRotation.String()})
 		} else {
 			b.dbEvent(ctx, "rotate-fail", "", roleName, false)
+			recordDatabaseObservation(ctx, b, nil, role.DBName, ObservationTypeDatabaseRotateStaticRoleFailure,
+				AdditionalDatabaseMetadata{key: "role_name", value: roleName},
+				AdditionalDatabaseMetadata{key: "credential_type", value: credType.String()})
 		}
-	}()
+	}(role.StaticAccount, &role.CredentialType) // argument is evaluated now, but since it's a pointer should refer correctly to updated values
 
 	// If there is a WAL entry related to this Role, the corresponding WAL ID
 	// should be stored in the Item's Value field.
@@ -270,7 +295,7 @@ func (b *databaseBackend) rotateCredential(ctx context.Context, s logical.Storag
 
 	resp, err := b.setStaticAccount(ctx, s, input)
 	if err != nil {
-		logger.Error("unable to rotate credentials in periodic function", "error", err)
+		logger.Error("unable to rotate credentials in periodic function", "name", roleName, "error", err.Error())
 
 		// Increment the priority enough so that the next call to this method
 		// likely will not attempt to rotate it, as a back-off of sorts
@@ -301,6 +326,7 @@ func (b *databaseBackend) rotateCredential(ctx context.Context, s logical.Storag
 	if err := b.pushItem(item); err != nil {
 		logger.Warn("unable to push item on to queue", "error", err)
 	}
+
 	rotated = true
 	return true
 }
@@ -349,9 +375,9 @@ type setStaticAccountOutput struct {
 
 // setStaticAccount sets the credential for a static account associated with a
 // Role. This method does many things:
-// - verifies role exists and is in the allowed roles list
-// - loads an existing WAL entry if WALID input is given, otherwise creates a
-// new WAL entry
+//   - verifies role exists and is in the allowed roles list
+//   - loads an existing WAL entry if WALID input is given, otherwise creates a
+//     new WAL entry
 //   - gets a database connection
 //   - accepts an input credential, otherwise generates a new one for
 //     the role's credential type
@@ -413,9 +439,15 @@ func (b *databaseBackend) setStaticAccount(ctx context.Context, s logical.Storag
 		Commands: input.Role.Statements.Rotation,
 	}
 
+	// Add external password to request so we can use static account connection
+	if input.Role.StaticAccount.SelfManagedPassword != "" {
+		updateReq.SelfManagedPassword = input.Role.StaticAccount.SelfManagedPassword
+	}
+
 	// Use credential from input if available. This happens if we're restoring from
 	// a WAL item or processing the rotation queue with an item that has a WAL
 	// associated with it
+	var usedCredentialFromPreviousRotation bool
 	if output.WALID != "" {
 		wal, err := b.findStaticWAL(ctx, s, output.WALID)
 		if err != nil {
@@ -443,6 +475,7 @@ func (b *databaseBackend) setStaticAccount(ctx context.Context, s logical.Storag
 				Statements:  statements,
 			}
 			input.Role.StaticAccount.Password = wal.NewPassword
+			usedCredentialFromPreviousRotation = true
 		case wal.CredentialType == v5.CredentialTypeRSAPrivateKey:
 			// Roll forward by using the credential in the existing WAL entry
 			updateReq.CredentialType = v5.CredentialTypeRSAPrivateKey
@@ -451,6 +484,7 @@ func (b *databaseBackend) setStaticAccount(ctx context.Context, s logical.Storag
 				Statements:   statements,
 			}
 			input.Role.StaticAccount.PrivateKey = wal.NewPrivateKey
+			usedCredentialFromPreviousRotation = true
 		}
 	}
 
@@ -464,21 +498,9 @@ func (b *databaseBackend) setStaticAccount(ctx context.Context, s logical.Storag
 
 		switch input.Role.CredentialType {
 		case v5.CredentialTypePassword:
-			generator, err := newPasswordGenerator(input.Role.CredentialConfig)
+			newPassword, err := b.generateNewPassword(ctx, input.Role.CredentialConfig, dbConfig.PasswordPolicy, dbi)
 			if err != nil {
-				return output, fmt.Errorf("failed to construct credential generator: %s", err)
-			}
-
-			// Fall back to database config-level password policy if not set on role
-			if generator.PasswordPolicy == "" {
-				generator.PasswordPolicy = dbConfig.PasswordPolicy
-			}
-
-			// Generate the password
-			newPassword, err := generator.generate(ctx, b, dbi.database)
-			if err != nil {
-				b.CloseIfShutdown(dbi, err)
-				return output, fmt.Errorf("failed to generate password: %s", err)
+				return output, err
 			}
 
 			// Set new credential in WAL entry and update user request
@@ -492,15 +514,9 @@ func (b *databaseBackend) setStaticAccount(ctx context.Context, s logical.Storag
 			// Set new credential in static account
 			input.Role.StaticAccount.Password = newPassword
 		case v5.CredentialTypeRSAPrivateKey:
-			generator, err := newRSAKeyGenerator(input.Role.CredentialConfig)
-			if err != nil {
-				return output, fmt.Errorf("failed to construct credential generator: %s", err)
-			}
-
-			// Generate the RSA key pair
-			public, private, err := generator.generate(b.GetRandomReader())
+			public, private, err := b.generateNewKeypair(input.Role.CredentialConfig)
 			if err != nil {
-				return output, fmt.Errorf("failed to generate RSA key pair: %s", err)
+				return output, err
 			}
 
 			// Set new credential in WAL entry and update user request
@@ -525,10 +541,25 @@ func (b *databaseBackend) setStaticAccount(ctx context.Context, s logical.Storag
 	_, err = dbi.database.UpdateUser(ctx, updateReq, false)
 	if err != nil {
 		b.CloseIfShutdown(dbi, err)
+		if usedCredentialFromPreviousRotation {
+			b.Logger().Debug("credential stored in WAL failed, deleting WAL", "role", input.RoleName, "WAL ID", output.WALID)
+			if err := framework.DeleteWAL(ctx, s, output.WALID); err != nil {
+				b.Logger().Warn("failed to delete WAL", "error", err, "WAL ID", output.WALID)
+			}
+
+			// Generate a new WAL entry and credential for next attempt
+			output.WALID = ""
+		}
 		return output, fmt.Errorf("error setting credentials: %w", err)
 	}
 	modified = true
 
+	// static user password successfully updated in external system
+	// update self-managed password if available for future connections
+	if input.Role.StaticAccount.SelfManagedPassword != "" {
+		input.Role.StaticAccount.SelfManagedPassword = input.Role.StaticAccount.Password
+	}
+
 	// Store updated role information
 	// lvr is the known LastVaultRotation
 	lvr := time.Now()
@@ -536,11 +567,7 @@ func (b *databaseBackend) setStaticAccount(ctx context.Context, s logical.Storag
 	input.Role.StaticAccount.SetNextVaultRotation(lvr)
 	output.RotationTime = lvr
 
-	entry, err := logical.StorageEntryJSON(databaseStaticRolePath+input.RoleName, input.Role)
-	if err != nil {
-		return output, err
-	}
-	if err := s.Put(ctx, entry); err != nil {
+	if err := b.StoreStaticRole(ctx, s, input.Role); err != nil {
 		return output, err
 	}
 
@@ -555,6 +582,44 @@ func (b *databaseBackend) setStaticAccount(ctx context.Context, s logical.Storag
 	return &setStaticAccountOutput{RotationTime: lvr}, nil
 }
 
+// Returns a new password, error.
+func (b *databaseBackend) generateNewPassword(ctx context.Context, credentialConfig map[string]interface{}, passwordPolicy string, dbi *dbPluginInstance) (string, error) {
+	generator, err := newPasswordGenerator(credentialConfig)
+	if err != nil {
+		return "", fmt.Errorf("failed to construct credential generator: %s", err)
+	}
+
+	// Fall back to database config-level password policy if not set on role
+	if generator.PasswordPolicy == "" {
+		generator.PasswordPolicy = passwordPolicy
+	}
+
+	// Generate the password
+	newPassword, err := generator.generate(ctx, b, dbi.database)
+	if err != nil {
+		b.CloseIfShutdown(dbi, err)
+		return "", fmt.Errorf("failed to generate password: %s", err)
+	}
+
+	return newPassword, nil
+}
+
+// Returns a new public key, private key, error.
+func (b *databaseBackend) generateNewKeypair(credentialConfig map[string]interface{}) ([]byte, []byte, error) {
+	generator, err := newRSAKeyGenerator(credentialConfig)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to construct credential generator: %s", err)
+	}
+
+	// Generate the RSA key pair
+	public, private, err := generator.generate(b.GetRandomReader())
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to generate RSA key pair: %s", err)
+	}
+
+	return public, private, nil
+}
+
 // initQueue preforms the necessary checks and initializations needed to perform
 // automatic credential rotation for roles associated with static accounts. This
 // method verifies if a queue is needed (primary server or local mount), and if
diff --git a/builtin/logical/database/rotation_test.go b/builtin/logical/database/rotation_test.go
index 2f23cd7208a..251d8d14687 100644
--- a/builtin/logical/database/rotation_test.go
+++ b/builtin/logical/database/rotation_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -36,6 +36,7 @@ import (
 )
 
 const (
+	mockv5                       = "mockv5"
 	dbUser                       = "vaultstatictest"
 	dbUserDefaultPassword        = "password"
 	testMinRotationWindowSeconds = 5
@@ -62,8 +63,8 @@ func TestBackend_StaticRole_Rotation_basic(t *testing.T) {
 
 	b.schedule = &TestSchedule{}
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
-	defer cleanup()
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
+	t.Cleanup(cleanup)
 
 	// create the database user
 	createTestPGUser(t, connURL, dbUser, dbUserDefaultPassword, testRoleStaticCreate)
@@ -273,7 +274,7 @@ func TestBackend_StaticRole_Rotation_Schedule_ErrorRecover(t *testing.T) {
 
 	b.schedule = &TestSchedule{}
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	t.Cleanup(cleanup)
 
 	// create the database user
@@ -457,7 +458,7 @@ func TestBackend_StaticRole_Rotation_NonStaticError(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// create the database user
@@ -561,7 +562,7 @@ func TestBackend_StaticRole_Rotation_Revoke_user(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// create the database user
@@ -782,7 +783,7 @@ func TestBackend_StaticRole_Rotation_QueueWAL_discard_role_newer_rotation_date(t
 		t.Fatal("could not convert to db backend")
 	}
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// create the database user
@@ -951,7 +952,7 @@ func assertWALCount(t *testing.T, s logical.Storage, expected int, key string) {
 type userCreator func(t *testing.T, username, password string)
 
 func TestBackend_StaticRole_Rotation_PostgreSQL(t *testing.T) {
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "13.4-buster")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 	uc := userCreator(func(t *testing.T, username, password string) {
 		createTestPGUser(t, connURL, username, password, testRoleStaticCreate)
@@ -1028,28 +1029,23 @@ func TestBackend_StaticRole_Rotation_MongoDBAtlas(t *testing.T) {
 // does not break on invalid values.
 func TestQueueTickIntervalKeyConfig(t *testing.T) {
 	t.Parallel()
-	cluster, sys := getClusterPostgresDB(t)
+	cluster, sys := getCluster(t)
 	defer cluster.Cleanup()
 
-	config := logical.TestBackendConfig()
-	config.StorageView = &logical.InmemStorage{}
-	config.System = sys
-	config.Config[queueTickIntervalKey] = "1"
-
-	// Rotation ticker starts running in Factory call
-	b, err := Factory(context.Background(), config)
-	require.Nil(t, err)
-	b.Cleanup(context.Background())
-
-	config.Config[queueTickIntervalKey] = "0"
-	b, err = Factory(context.Background(), config)
-	require.Nil(t, err)
-	b.Cleanup(context.Background())
-
-	config.Config[queueTickIntervalKey] = "-1"
-	b, err = Factory(context.Background(), config)
-	require.Nil(t, err)
-	b.Cleanup(context.Background())
+	values := []string{"1", "0", "-1"}
+	for _, v := range values {
+		t.Run("test"+v, func(t *testing.T) {
+			config := logical.TestBackendConfig()
+			config.StorageView = &logical.InmemStorage{}
+			config.System = sys
+			config.Config[queueTickIntervalKey] = v
+
+			// Rotation ticker starts running in Factory call
+			b, err := Factory(context.Background(), config)
+			require.Nil(t, err)
+			b.Cleanup(context.Background())
+		})
+	}
 }
 
 func testBackend_StaticRole_Rotations(t *testing.T, createUser userCreator, opts map[string]interface{}) {
@@ -1245,7 +1241,7 @@ func TestBackend_StaticRole_Rotation_LockRegression(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// Configure a connection
@@ -1324,7 +1320,7 @@ func TestBackend_StaticRole_Rotation_Invalid_Role(t *testing.T) {
 	}
 	defer b.Cleanup(context.Background())
 
-	cleanup, connURL := postgreshelper.PrepareTestContainer(t, "")
+	cleanup, connURL := postgreshelper.PrepareTestContainer(t)
 	defer cleanup()
 
 	// create the database user
@@ -1446,7 +1442,7 @@ func TestStoredWALsCorrectlyProcessed(t *testing.T) {
 
 	rotationPeriodData := map[string]interface{}{
 		"username":        "hashicorp",
-		"db_name":         "mockv5",
+		"db_name":         mockv5,
 		"rotation_period": "86400s",
 	}
 
@@ -1500,7 +1496,7 @@ func TestStoredWALsCorrectlyProcessed(t *testing.T) {
 			},
 			map[string]interface{}{
 				"username":          "hashicorp",
-				"db_name":           "mockv5",
+				"db_name":           mockv5,
 				"rotation_schedule": "*/10 * * * * *",
 			},
 		},
@@ -1624,6 +1620,92 @@ func TestDeletesOlderWALsOnLoad(t *testing.T) {
 	requireWALs(t, storage, 1)
 }
 
+// TestStaticRoleNextVaultRotationOnRestart verifies that a static role created prior to Vault 1.15.0
+// (when roles were created without NextVaultRotation set) is automatically assigned a valid
+// NextVaultRotation when loaded from storage and the rotation queue is repopulated.
+func TestStaticRoleNextVaultRotationOnRestart(t *testing.T) {
+	ctx := context.Background()
+	b, storage, mockDB := getBackend(t)
+	defer b.Cleanup(ctx)
+	configureDBMount(t, storage)
+
+	roleName := "hashicorp"
+	data := map[string]interface{}{
+		"username":        "hashicorp",
+		"db_name":         "mockv5",
+		"rotation_period": "10m",
+	}
+
+	createRoleWithData(t, b, storage, mockDB, roleName, data)
+	item, err := b.credRotationQueue.Pop()
+	require.NoError(t, err)
+	firstPriority := item.Priority
+	role, err := b.StaticRole(context.Background(), storage, roleName)
+	firstPassword := role.StaticAccount.Password
+	require.NoError(t, err)
+
+	// force NextVaultRotation to zero to simulate roles before 1.15.0
+	role.StaticAccount.NextVaultRotation = time.Time{}
+	entry, err := logical.StorageEntryJSON(databaseStaticRolePath+roleName, role)
+	require.NoError(t, err)
+	if err := storage.Put(context.Background(), entry); err != nil {
+		t.Fatal("failed to write role to storage", err)
+	}
+
+	// Confirm that NextVaultRotation is nil
+	role, err = b.StaticRole(ctx, storage, roleName)
+	require.NoError(t, err)
+	require.Equal(t, role.StaticAccount.NextVaultRotation, time.Time{})
+
+	// Repopulate queue to simulate restart
+	b.populateQueue(ctx, storage)
+
+	success := b.rotateCredential(t.Context(), storage)
+	require.False(t, success, "expected rotation to fail")
+
+	role, err = b.StaticRole(ctx, storage, roleName)
+	require.NoError(t, err)
+	require.Equal(t, role.StaticAccount.Password, firstPassword)
+	item, err = b.credRotationQueue.Pop()
+	require.NoError(t, err)
+	newPriority := item.Priority
+	require.Equal(t, role.StaticAccount.NextVaultRotation.Unix(), newPriority) // Confirm NextVaultRotation and priority are equal
+	require.Equal(t, newPriority, firstPriority)                               // confirm that priority has not changed
+}
+
+// TestRotationSchedulePriorityAfterRestart checks that the priority of a
+// static role with rotation schedule does not change after a restart
+// This addresses VAULT-35616, where role schedules were incorrectly shifting
+// from the local timezone to UTC after reloading from storage.
+func TestRotationSchedulePriorityAfterRestart(t *testing.T) {
+	ctx := context.Background()
+	b, storage, mockDB := getBackend(t)
+
+	// Replace test scheduler with default scheduler
+	scheduler := &schedule.DefaultSchedule{}
+	b.schedule = scheduler
+	defer b.Cleanup(ctx)
+	configureDBMount(t, storage)
+
+	roleName := "hashicorp"
+	data := map[string]interface{}{
+		"username":          "hashicorp",
+		"db_name":           "mockv5",
+		"rotation_schedule": "*/30 * * * SAT",
+	}
+
+	createRoleWithData(t, b, storage, mockDB, roleName, data)
+	item, err := b.credRotationQueue.Pop()
+	require.NoError(t, err)
+	firstPriority := item.Priority
+
+	// Repopulate queue to simulate restart
+	b.populateQueue(ctx, storage)
+	item, err = b.credRotationQueue.Pop()
+	newPriority := item.Priority
+	require.Equal(t, newPriority, firstPriority) // confirm that priority has not changed
+}
+
 func generateWALFromFailedRotation(t *testing.T, b *databaseBackend, storage logical.Storage, mockDB *mockNewDatabase, roleName string) {
 	t.Helper()
 	mockDB.On("UpdateUser", mock.Anything, mock.Anything).
@@ -1668,6 +1750,29 @@ func requireWALs(t *testing.T, storage logical.Storage, expectedCount int) []str
 	return wals
 }
 
+// getBackendWithConfig returns an initialized test backend for the given
+// BackendConfig
+func getBackendInitQueue(t *testing.T, c *logical.BackendConfig, tickInterval string) (*databaseBackend, *logical.BackendConfig, *mockNewDatabase) {
+	t.Helper()
+	// make queue ticks more frequent for tests
+	c.Config[queueTickIntervalKey] = tickInterval
+	c.StorageView = &logical.InmemStorage{}
+	// Create and init the backend ourselves instead of using a Factory because
+	// the factory function kicks off threads that cause racy tests.
+	b := Backend(c)
+	ctx := context.Background()
+	if err := b.Setup(ctx, c); err != nil {
+		t.Fatal(err)
+	}
+	b.schedule = &TestSchedule{}
+	b.credRotationQueue = queue.New()
+	b.initQueue(ctx, c)
+
+	mockDB := setupMockDB(b)
+
+	return b, c, mockDB
+}
+
 func getBackend(t *testing.T) (*databaseBackend, logical.Storage, *mockNewDatabase) {
 	t.Helper()
 	config := logical.TestBackendConfig()
@@ -1675,7 +1780,8 @@ func getBackend(t *testing.T) (*databaseBackend, logical.Storage, *mockNewDataba
 	// Create and init the backend ourselves instead of using a Factory because
 	// the factory function kicks off threads that cause racy tests.
 	b := Backend(config)
-	if err := b.Setup(context.Background(), config); err != nil {
+	ctx := context.Background()
+	if err := b.Setup(ctx, config); err != nil {
 		t.Fatal(err)
 	}
 	b.schedule = &TestSchedule{}
@@ -1699,9 +1805,9 @@ func setupMockDB(b *databaseBackend) *mockNewDatabase {
 	dbi := &dbPluginInstance{
 		database: dbw,
 		id:       "foo-id",
-		name:     "mockV5",
+		name:     mockv5,
 	}
-	b.connections.Put("mockv5", dbi)
+	b.connections.Put(mockv5, dbi)
 
 	return mockDB
 }
@@ -1710,7 +1816,7 @@ func setupMockDB(b *databaseBackend) *mockNewDatabase {
 // plugin init code paths, allowing us to use a manually populated mock DB object.
 func configureDBMount(t *testing.T, storage logical.Storage) {
 	t.Helper()
-	entry, err := logical.StorageEntryJSON(fmt.Sprintf("config/mockv5"), &DatabaseConfig{
+	entry, err := logical.StorageEntryJSON(fmt.Sprintf("config/"+mockv5), &DatabaseConfig{
 		AllowedRoles: []string{"*"},
 	})
 	if err != nil {
diff --git a/builtin/logical/database/schedule/schedule.go b/builtin/logical/database/schedule/schedule.go
index 8f30717ec13..a40c5484216 100644
--- a/builtin/logical/database/schedule/schedule.go
+++ b/builtin/logical/database/schedule/schedule.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package schedule
 
 import (
 	"fmt"
+	"time"
 
 	"github.com/robfig/cron/v3"
 )
@@ -34,6 +35,8 @@ func (d *DefaultSchedule) Parse(rotationSchedule string) (*cron.SpecSchedule, er
 	if !ok {
 		return nil, fmt.Errorf("invalid rotation schedule")
 	}
+	// Force the location to be UTC instead of the local timezone
+	sched.Location = time.UTC
 	return sched, nil
 }
 
diff --git a/builtin/logical/database/secret_creds.go b/builtin/logical/database/secret_creds.go
index e2130c1cf7d..17959b40e3d 100644
--- a/builtin/logical/database/secret_creds.go
+++ b/builtin/logical/database/secret_creds.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -34,6 +34,9 @@ func (b *databaseBackend) secretCredsRenew() framework.OperationFunc {
 			return nil, fmt.Errorf("secret is missing username internal data")
 		}
 		username, ok := usernameRaw.(string)
+		if !ok {
+			return nil, fmt.Errorf("username not a string")
+		}
 
 		roleNameRaw, ok := req.Secret.InternalData["role"]
 		if !ok {
@@ -86,6 +89,10 @@ func (b *databaseBackend) secretCredsRenew() framework.OperationFunc {
 		resp := &logical.Response{Secret: req.Secret}
 		resp.Secret.TTL = role.DefaultTTL
 		resp.Secret.MaxTTL = role.MaxTTL
+
+		recordDatabaseObservation(ctx, b, req, role.DBName, ObservationTypeDatabaseCredentialRenew,
+			AdditionalDatabaseMetadata{key: "role_name", value: role.Name},
+			AdditionalDatabaseMetadata{key: "credential_type", value: role.CredentialType.String()})
 		return resp, nil
 	}
 }
@@ -98,6 +105,9 @@ func (b *databaseBackend) secretCredsRevoke() framework.OperationFunc {
 			return nil, fmt.Errorf("secret is missing username internal data")
 		}
 		username, ok := usernameRaw.(string)
+		if !ok {
+			return nil, fmt.Errorf("username not a string")
+		}
 
 		var resp *logical.Response
 
@@ -105,11 +115,12 @@ func (b *databaseBackend) secretCredsRevoke() framework.OperationFunc {
 		if !ok {
 			return nil, fmt.Errorf("no role name was provided")
 		}
+		roleNameString := roleNameRaw.(string)
 
 		var dbName string
 		var statements v4.Statements
 
-		role, err := b.Role(ctx, req.Storage, roleNameRaw.(string))
+		role, err := b.Role(ctx, req.Storage, roleNameString)
 		if err != nil {
 			return nil, err
 		}
@@ -162,6 +173,10 @@ func (b *databaseBackend) secretCredsRevoke() framework.OperationFunc {
 			b.CloseIfShutdown(dbi, err)
 			return nil, err
 		}
+
+		recordDatabaseObservation(ctx, b, req, dbName, ObservationTypeDatabaseCredentialRevoke,
+			AdditionalDatabaseMetadata{key: "role_name", value: roleNameString})
+
 		return resp, nil
 	}
 }
diff --git a/builtin/logical/database/version_wrapper.go b/builtin/logical/database/version_wrapper.go
index f5280307c95..6b9e8b83c38 100644
--- a/builtin/logical/database/version_wrapper.go
+++ b/builtin/logical/database/version_wrapper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
@@ -35,6 +35,7 @@ func newDatabaseWrapper(ctx context.Context, pluginName string, pluginVersion st
 	if versions.IsBuiltinVersion(pluginVersion) {
 		pluginVersion = ""
 	}
+
 	newDB, err := v5.PluginFactoryVersion(ctx, pluginName, pluginVersion, sys, logger)
 	if err == nil {
 		dbw = databaseVersionWrapper{
diff --git a/builtin/logical/database/version_wrapper_test.go b/builtin/logical/database/version_wrapper_test.go
index 47840385966..15a3c94b9c5 100644
--- a/builtin/logical/database/version_wrapper_test.go
+++ b/builtin/logical/database/version_wrapper_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
diff --git a/builtin/logical/database/versioning_large_test.go b/builtin/logical/database/versioning_large_test.go
index be936c76033..0251fe86bfc 100644
--- a/builtin/logical/database/versioning_large_test.go
+++ b/builtin/logical/database/versioning_large_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package database
diff --git a/builtin/logical/nomad/backend.go b/builtin/logical/nomad/backend.go
index 4c7e149185e..c0bd3a4b780 100644
--- a/builtin/logical/nomad/backend.go
+++ b/builtin/logical/nomad/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package nomad
diff --git a/builtin/logical/nomad/backend_test.go b/builtin/logical/nomad/backend_test.go
index e4e3fcded07..7547b76c335 100644
--- a/builtin/logical/nomad/backend_test.go
+++ b/builtin/logical/nomad/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package nomad
diff --git a/builtin/logical/nomad/cmd/nomad/main.go b/builtin/logical/nomad/cmd/nomad/main.go
index 493e1be2d5d..c0ef6186d57 100644
--- a/builtin/logical/nomad/cmd/nomad/main.go
+++ b/builtin/logical/nomad/cmd/nomad/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/logical/nomad/path_config_access.go b/builtin/logical/nomad/path_config_access.go
index cde6f97edb8..b19f7c86a9f 100644
--- a/builtin/logical/nomad/path_config_access.go
+++ b/builtin/logical/nomad/path_config_access.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package nomad
diff --git a/builtin/logical/nomad/path_config_lease.go b/builtin/logical/nomad/path_config_lease.go
index 2569a07ade0..c774b99724f 100644
--- a/builtin/logical/nomad/path_config_lease.go
+++ b/builtin/logical/nomad/path_config_lease.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package nomad
diff --git a/builtin/logical/nomad/path_creds_create.go b/builtin/logical/nomad/path_creds_create.go
index 9c25bed07dd..dc5cc1f1998 100644
--- a/builtin/logical/nomad/path_creds_create.go
+++ b/builtin/logical/nomad/path_creds_create.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package nomad
diff --git a/builtin/logical/nomad/path_roles.go b/builtin/logical/nomad/path_roles.go
index 4732dec5b8a..8afe6afeec7 100644
--- a/builtin/logical/nomad/path_roles.go
+++ b/builtin/logical/nomad/path_roles.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package nomad
diff --git a/builtin/logical/nomad/secret_token.go b/builtin/logical/nomad/secret_token.go
index 2eaf19be279..2bcf3b2d92a 100644
--- a/builtin/logical/nomad/secret_token.go
+++ b/builtin/logical/nomad/secret_token.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package nomad
diff --git a/builtin/logical/pki/acme_authorizations.go b/builtin/logical/pki/acme_authorizations.go
index 64548ffed99..8f3a115cdc6 100644
--- a/builtin/logical/pki/acme_authorizations.go
+++ b/builtin/logical/pki/acme_authorizations.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -20,6 +20,7 @@ type ACMEIdentifier struct {
 	Value         string             `json:"value"`
 	OriginalValue string             `json:"original_value"`
 	IsWildcard    bool               `json:"is_wildcard"`
+	IsV6IP        bool               `json:"is_v6_ip"`
 }
 
 func (ai *ACMEIdentifier) MaybeParseWildcard() (bool, string, error) {
diff --git a/builtin/logical/pki/acme_billing.go b/builtin/logical/pki/acme_billing.go
index 6c66ad447cf..2b53041b92c 100644
--- a/builtin/logical/pki/acme_billing.go
+++ b/builtin/logical/pki/acme_billing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/acme_billing_test.go b/builtin/logical/pki/acme_billing_test.go
index 1911d6804e6..b87a7b086fe 100644
--- a/builtin/logical/pki/acme_billing_test.go
+++ b/builtin/logical/pki/acme_billing_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -19,6 +19,7 @@ import (
 	"github.com/hashicorp/vault/builtin/logical/pki/dnstest"
 	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/helper/timeutil"
+	"github.com/hashicorp/vault/sdk/helper/testcluster"
 	"github.com/hashicorp/vault/vault"
 	"github.com/hashicorp/vault/vault/activity"
 	"github.com/stretchr/testify/require"
@@ -33,6 +34,17 @@ func TestACMEBilling(t *testing.T) {
 	cluster, client, _ := setupAcmeBackend(t)
 	defer cluster.Cleanup()
 
+	var activeCore *vault.TestClusterCore
+	{
+		activeNode, _, err := testcluster.GetActiveAndStandbys(t.Context(), cluster)
+		require.NoError(t, err)
+		activeCore = activeNode.(*vault.TestClusterCore)
+	}
+	activeCore.StopPkiCertificateCountConsumerJob()
+	// The new root and int should have been counted, but we are not asserting that here
+	// to avoid a possible race condition with the consumer job.
+	activeCore.ResetPkiCertificateCounts()
+
 	dns := dnstest.SetupResolver(t, "dadgarcorp.com")
 	defer dns.Cleanup()
 
@@ -67,44 +79,55 @@ func TestACMEBilling(t *testing.T) {
 	// Unique identifier: should increase by one.
 	doACMEForDomainWithDNS(t, dns, acmeClientPKI, []string{"dadgarcorp.com"})
 	expectedCount = validateClientCount(t, client, "pki", expectedCount+1, "new certificate")
+	activeCore.RequirePkiCertificateCounts(t, 1, 1)
 
 	// Different identifier; should increase by one.
 	doACMEForDomainWithDNS(t, dns, acmeClientPKI, []string{"example.dadgarcorp.com"})
 	expectedCount = validateClientCount(t, client, "pki", expectedCount+1, "new certificate")
+	activeCore.RequirePkiCertificateCounts(t, 1, 1)
 
 	// While same identifiers, used together and so thus are unique; increase by one.
 	doACMEForDomainWithDNS(t, dns, acmeClientPKI, []string{"example.dadgarcorp.com", "dadgarcorp.com"})
 	expectedCount = validateClientCount(t, client, "pki", expectedCount+1, "new certificate")
+	activeCore.RequirePkiCertificateCounts(t, 1, 1)
 
 	// Same identifiers in different order are not unique; keep the same.
 	doACMEForDomainWithDNS(t, dns, acmeClientPKI, []string{"dadgarcorp.com", "example.dadgarcorp.com"})
 	expectedCount = validateClientCount(t, client, "pki", expectedCount, "different order; same identifiers")
+	activeCore.RequirePkiCertificateCounts(t, 1, 1)
 
 	// Using a different mount shouldn't affect counts.
 	doACMEForDomainWithDNS(t, dns, acmeClientPKI2, []string{"dadgarcorp.com"})
 	expectedCount = validateClientCount(t, client, "", expectedCount, "different mount; same identifiers")
+	activeCore.RequirePkiCertificateCounts(t, 1, 1)
 
 	// But using a different identifier should.
 	doACMEForDomainWithDNS(t, dns, acmeClientPKI2, []string{"pki2.dadgarcorp.com"})
 	expectedCount = validateClientCount(t, client, "pki2", expectedCount+1, "different mount with different identifiers")
+	activeCore.RequirePkiCertificateCounts(t, 1, 1)
 
 	// A new identifier in a unique namespace will affect results.
 	doACMEForDomainWithDNS(t, dns, acmeClientPKINS1, []string{"unique.dadgarcorp.com"})
 	expectedCount = validateClientCount(t, client, "ns1/pki", expectedCount+1, "unique identifier in a namespace")
+	activeCore.RequirePkiCertificateCounts(t, 1, 1)
 
 	// But in a different namespace with the existing identifier will not.
 	doACMEForDomainWithDNS(t, dns, acmeClientPKINS2, []string{"unique.dadgarcorp.com"})
 	expectedCount = validateClientCount(t, client, "", expectedCount, "existing identifier in a namespace")
+	activeCore.RequirePkiCertificateCounts(t, 1, 1)
+
 	doACMEForDomainWithDNS(t, dns, acmeClientPKI2, []string{"unique.dadgarcorp.com"})
 	expectedCount = validateClientCount(t, client, "", expectedCount, "existing identifier outside of a namespace")
+	activeCore.RequirePkiCertificateCounts(t, 1, 1)
 
 	// Creating a unique identifier in a namespace with a mount with the
 	// same name as another namespace should increase counts as well.
 	doACMEForDomainWithDNS(t, dns, acmeClientPKINS2, []string{"very-unique.dadgarcorp.com"})
 	expectedCount = validateClientCount(t, client, "ns2/pki", expectedCount+1, "unique identifier in a different namespace")
+	activeCore.RequirePkiCertificateCounts(t, 1, 1)
 
 	// Check the current fragment
-	fragment := cluster.Cores[0].Core.ResetActivityLog()[0]
+	fragment := activeCore.Core.ResetActivityLog()[0]
 	if fragment == nil {
 		t.Fatal("no fragment created")
 	}
@@ -131,10 +154,10 @@ func validateClientCount(t *testing.T, client *api.Client, mount string, expecte
 
 	require.NotNil(t, resp)
 	require.NotNil(t, resp.Data)
-	require.Contains(t, resp.Data, "non_entity_clients")
+	require.Contains(t, resp.Data, "acme_clients")
 	require.Contains(t, resp.Data, "months")
 
-	rawCount := resp.Data["non_entity_clients"].(json.Number)
+	rawCount := resp.Data["acme_clients"].(json.Number)
 	count, err := rawCount.Int64()
 	require.NoError(t, err, "failed to parse number as int64: "+rawCount.String())
 
@@ -158,8 +181,8 @@ func validateClientCount(t *testing.T, client *api.Client, mount string, expecte
 	// Validate this month's aggregate counts match the overall value.
 	require.Contains(t, monthlyInfo, "counts", "expected monthly info to contain a count key")
 	monthlyCounts := monthlyInfo["counts"].(map[string]interface{})
-	require.Contains(t, monthlyCounts, "non_entity_clients", "expected month[0].counts to contain a non_entity_clients key")
-	monthlyCountNonEntityRaw := monthlyCounts["non_entity_clients"].(json.Number)
+	require.Contains(t, monthlyCounts, "acme_clients", "expected month[0].counts to contain a non_entity_clients key")
+	monthlyCountNonEntityRaw := monthlyCounts["acme_clients"].(json.Number)
 	monthlyCountNonEntity, err := monthlyCountNonEntityRaw.Int64()
 	require.NoError(t, err, "failed to parse number as int64: "+monthlyCountNonEntityRaw.String())
 	require.Equal(t, count, monthlyCountNonEntity, "expected equal values for non entity client counts")
@@ -194,8 +217,8 @@ func validateClientCount(t *testing.T, client *api.Client, mount string, expecte
 		// This namespace must have a non-empty aggregate non-entity count.
 		require.Contains(t, namespace, "counts", "expected monthly.namespaces[%v] to contain a counts key", index)
 		namespaceCounts := namespace["counts"].(map[string]interface{})
-		require.Contains(t, namespaceCounts, "non_entity_clients", "expected namespace counts to contain a non_entity_clients key")
-		namespaceCountNonEntityRaw := namespaceCounts["non_entity_clients"].(json.Number)
+		require.Contains(t, namespaceCounts, "acme_clients", "expected namespace counts to contain a non_entity_clients key")
+		namespaceCountNonEntityRaw := namespaceCounts["acme_clients"].(json.Number)
 		namespaceCountNonEntity, err := namespaceCountNonEntityRaw.Int64()
 		require.NoError(t, err, "failed to parse number as int64: "+namespaceCountNonEntityRaw.String())
 		require.Greater(t, namespaceCountNonEntity, int64(0), "expected at least one non-entity client count value in the namespace")
@@ -217,8 +240,8 @@ func validateClientCount(t *testing.T, client *api.Client, mount string, expecte
 			// This mount must also have a non-empty non-entity client count.
 			require.Contains(t, mountInfo, "counts", "expected monthly.namespaces[%v].mounts[%v] to contain a counts key", index, mountIndex)
 			mountCounts := mountInfo["counts"].(map[string]interface{})
-			require.Contains(t, mountCounts, "non_entity_clients", "expected mount counts to contain a non_entity_clients key")
-			mountCountNonEntityRaw := mountCounts["non_entity_clients"].(json.Number)
+			require.Contains(t, mountCounts, "acme_clients", "expected mount counts to contain a non_entity_clients key")
+			mountCountNonEntityRaw := mountCounts["acme_clients"].(json.Number)
 			mountCountNonEntity, err := mountCountNonEntityRaw.Int64()
 			require.NoError(t, err, "failed to parse number as int64: "+mountCountNonEntityRaw.String())
 			require.Greater(t, mountCountNonEntity, int64(0), "expected at least one non-entity client count value in the mount")
diff --git a/builtin/logical/pki/acme_challenge_engine.go b/builtin/logical/pki/acme_challenge_engine.go
index 330a55b1ccd..eba94571904 100644
--- a/builtin/logical/pki/acme_challenge_engine.go
+++ b/builtin/logical/pki/acme_challenge_engine.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -7,6 +7,7 @@ import (
 	"container/list"
 	"context"
 	"fmt"
+	"strings"
 	"sync"
 	"time"
 
@@ -315,13 +316,13 @@ func (ace *ACMEChallengeEngine) AcceptChallenge(sc *storageContext, account stri
 func (ace *ACMEChallengeEngine) VerifyChallenge(runnerSc *storageContext, id string, validationQueueRetries int, finished chan bool, config *acmeConfigEntry) {
 	sc, cancel := runnerSc.WithFreshTimeout(MaxChallengeTimeout)
 	defer cancel()
-	runnerSc.Backend.Logger().Debug("Starting verification of challenge", "id", id)
+	runnerSc.Logger().Debug("Starting verification of challenge", "id", id)
 
 	if retry, retryAfter, err := ace._verifyChallenge(sc, id, config); err != nil {
 		// Because verification of this challenge failed, we need to retry
 		// it in the future. Log the error and re-add the item to the queue
 		// to try again later.
-		sc.Backend.Logger().Error(fmt.Sprintf("ACME validation failed for %v: %v", id, err))
+		sc.Logger().Error(fmt.Sprintf("ACME validation failed for %v: %v", id, err))
 
 		if retry {
 			validationQueueRetries++
@@ -331,10 +332,10 @@ func (ace *ACMEChallengeEngine) VerifyChallenge(runnerSc *storageContext, id str
 			// we have a secondary check here to see if we are consistently looping within the validation
 			// queue that is larger than the normal retry attempts we would allow.
 			if validationQueueRetries > MaxRetryAttempts*2 {
-				sc.Backend.Logger().Warn("reached max error attempts within challenge queue: %v, giving up", id)
+				sc.Logger().Warn("reached max error attempts within challenge queue: %v, giving up", id)
 				_, _, err = ace._verifyChallengeCleanup(sc, nil, id)
 				if err != nil {
-					sc.Backend.Logger().Warn("Failed cleaning up challenge entry: %v", err)
+					sc.Logger().Warn("Failed cleaning up challenge entry: %v", err)
 				}
 				finished <- true
 				return
@@ -435,7 +436,9 @@ func (ace *ACMEChallengeEngine) _verifyChallenge(sc *storageContext, id string,
 			return ace._verifyChallengeCleanup(sc, err, id)
 		}
 
-		valid, err = ValidateHTTP01Challenge(authz.Identifier.Value, cv.Token, cv.Thumbprint, config)
+		domain := encodeIdentifierForHTTP01Challenge(authz.Identifier)
+
+		valid, err = ValidateHTTP01Challenge(domain, cv.Token, cv.Thumbprint, config)
 		if err != nil {
 			err = fmt.Errorf("%w: error validating http-01 challenge %v: %v; %v", ErrIncorrectResponse, id, err, ChallengeAttemptFailedMsg)
 			return ace._verifyChallengeRetry(sc, cv, authzPath, authz, challenge, err, id)
@@ -488,12 +491,33 @@ func (ace *ACMEChallengeEngine) _verifyChallenge(sc *storageContext, id string,
 
 	if err := saveAuthorizationAtPath(sc, authzPath, authz); err != nil {
 		err = fmt.Errorf("error saving updated (validated) authorization %v/%v for challenge %v: %w", cv.Account, cv.Authorization, id, err)
-		return ace._verifyChallengeRetry(sc, cv, authzPath, authz, challenge, err, id)
+		return ace._verifyChallengeRetry(sc, cv, authzPath, authz, challenge, fmt.Errorf("%w: %s", ErrServerInternal, err.Error()), id)
 	}
 
 	return ace._verifyChallengeCleanup(sc, nil, id)
 }
 
+func encodeIdentifierForHTTP01Challenge(identifier *ACMEIdentifier) string {
+	if !(identifier.Type == ACMEIPIdentifier && identifier.IsV6IP) {
+		return identifier.Value
+	}
+
+	// If our IPv6 identifier has a zone we need to encode the % to %25 otherwise
+	// the http.Client won't properly use it. RFC6874 specifies how the zone
+	// identifier in the URI should be handled. In section 2:
+	//
+	//    According to URI syntax [RFC3986], "%" is always treated as
+	//    an escape character in a URI, so, according to the established URI
+	//    syntax [RFC3986] any occurrences of literal "%" symbols in a URI MUST
+	//    be percent-encoded and represented in the form "%25". Thus, the
+	//    scoped address fe80::a%en1 would appear in a URI as
+	//    http://[fe80::a%25en1].
+	escapedIPv6 := strings.Replace(identifier.Value, "%", "%25", 1)
+
+	// IPv6 addresses need to be surrounded by [] within URLs
+	return fmt.Sprintf("[%s]", escapedIPv6)
+}
+
 func (ace *ACMEChallengeEngine) _verifyChallengeRetry(sc *storageContext, cv *ChallengeValidation, authzPath string, auth *ACMEAuthorization, challenge *ACMEChallenge, verificationErr error, id string) (bool, time.Time, error) {
 	now := time.Now()
 	path := acmeValidationPrefix + id
diff --git a/builtin/logical/pki/acme_challenge_engine_test.go b/builtin/logical/pki/acme_challenge_engine_test.go
new file mode 100644
index 00000000000..f1452f368b4
--- /dev/null
+++ b/builtin/logical/pki/acme_challenge_engine_test.go
@@ -0,0 +1,47 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package pki
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// Test_encodeIdentifierForHTTP01Challenge validates the encoding behaviors of our identifiers
+// for the HTTP01 challenge. Basically properly encode the identifier for an HTTP request.
+func Test_encodeIdentifierForHTTP01Challenge(t *testing.T) {
+	tests := []struct {
+		name string
+		arg  *ACMEIdentifier
+		want string
+	}{
+		{
+			name: "dns",
+			arg:  &ACMEIdentifier{Type: ACMEDNSIdentifier, Value: "www.dadgarcorp.com"},
+			want: "www.dadgarcorp.com",
+		},
+		{
+			name: "ipv4",
+			arg:  &ACMEIdentifier{Type: ACMEIPIdentifier, Value: "192.168.1.1"},
+			want: "192.168.1.1",
+		},
+		{
+			name: "ipv6",
+			arg:  &ACMEIdentifier{Type: ACMEIPIdentifier, Value: "2001:0db8:0000:0000:0000:0000:0000:0068", IsV6IP: true},
+			want: "[2001:0db8:0000:0000:0000:0000:0000:0068]",
+		},
+		{
+			name: "ipv6-zoned",
+			arg:  &ACMEIdentifier{Type: ACMEIPIdentifier, Value: "fe80::1cc0:3e8c:119f:c2e1%ens18", IsV6IP: true},
+			want: "[fe80::1cc0:3e8c:119f:c2e1%25ens18]",
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, encodeIdentifierForHTTP01Challenge(tt.arg), "encodeIdentifierForHTTP01Challenge(%v)", tt.arg)
+		})
+	}
+}
diff --git a/builtin/logical/pki/acme_challenges.go b/builtin/logical/pki/acme_challenges.go
index 85c051c86e0..b5eade5fccb 100644
--- a/builtin/logical/pki/acme_challenges.go
+++ b/builtin/logical/pki/acme_challenges.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -42,14 +42,14 @@ var OIDACMEIdentifier = asn1.ObjectIdentifier{1, 3, 6, 1, 5, 5, 7, 1, 31}
 func ValidateKeyAuthorization(keyAuthz string, token string, thumbprint string) (bool, error) {
 	parts := strings.Split(keyAuthz, ".")
 	if len(parts) != 2 {
-		return false, fmt.Errorf("invalid authorization: got %v parts, expected 2", len(parts))
+		return false, fmt.Errorf("%w: %s", ErrMalformed, fmt.Errorf("invalid authorization: got %v parts, expected 2", len(parts)).Error())
 	}
 
 	tokenPart := parts[0]
 	thumbprintPart := parts[1]
 
 	if token != tokenPart || thumbprint != thumbprintPart {
-		return false, fmt.Errorf("key authorization was invalid")
+		return false, fmt.Errorf("%w: %s", ErrIncorrectResponse, fmt.Errorf("key authorization was invalid").Error())
 	}
 
 	return true, nil
@@ -126,7 +126,7 @@ func ValidateHTTP01Challenge(domain string, token string, thumbprint string, con
 	path := "http://" + domain + "/.well-known/acme-challenge/" + token
 	dialer, err := buildDialerConfig(config)
 	if err != nil {
-		return false, fmt.Errorf("failed to build dialer: %w", err)
+		return false, fmt.Errorf("%w: %s", ErrServerInternal, fmt.Errorf("failed to build dialer: %w", err).Error())
 	}
 
 	transport := &http.Transport{
@@ -167,7 +167,7 @@ func ValidateHTTP01Challenge(domain string, token string, thumbprint string, con
 
 	resp, err := client.Get(path)
 	if err != nil {
-		return false, fmt.Errorf("http-01: failed to fetch path %v: %w", path, err)
+		return false, fmt.Errorf("%w: %s", ErrConnection, fmt.Errorf("http-01: failed to fetch path %v: %w", path, err).Error())
 	}
 
 	// We provision a buffer which allows for a variable size challenge, some
@@ -180,15 +180,15 @@ func ValidateHTTP01Challenge(domain string, token string, thumbprint string, con
 	// Attempt to read the body, but don't do so infinitely.
 	body, err := io.ReadAll(io.LimitReader(resp.Body, int64(maxExpected+1)))
 	if err != nil {
-		return false, fmt.Errorf("http-01: unexpected error while reading body: %w", err)
+		return false, fmt.Errorf("%w: %s", ErrIncorrectResponse, fmt.Errorf("http-01: unexpected error while reading body: %w", err).Error())
 	}
 
 	if len(body) > maxExpected {
-		return false, fmt.Errorf("http-01: response too large: received %v > %v bytes", len(body), maxExpected)
+		return false, fmt.Errorf("%w: %s", ErrMalformed, fmt.Errorf("http-01: response too large: received %v > %v bytes", len(body), maxExpected).Error())
 	}
 
 	if len(body) < minExpected {
-		return false, fmt.Errorf("http-01: response too small: received %v < %v bytes", len(body), minExpected)
+		return false, fmt.Errorf("%w: %s", ErrMalformed, fmt.Errorf("http-01: response too small: received %v < %v bytes", len(body), minExpected).Error())
 	}
 
 	// Per RFC 8555 Section 8.3. HTTP Challenge:
@@ -215,7 +215,7 @@ func ValidateDNS01Challenge(domain string, token string, thumbprint string, conf
 	// 2. To use a context to set stricter timeout limits.
 	resolver, err := buildResolver(config)
 	if err != nil {
-		return false, fmt.Errorf("failed to build resolver: %w", err)
+		return false, fmt.Errorf("%w: %s", ErrServerInternal, fmt.Errorf("failed to build resolver: %w", err).Error())
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
@@ -224,7 +224,7 @@ func ValidateDNS01Challenge(domain string, token string, thumbprint string, conf
 	name := DNSChallengePrefix + domain
 	results, err := resolver.LookupTXT(ctx, name)
 	if err != nil {
-		return false, fmt.Errorf("dns-01: failed to lookup TXT records for domain (%v) via resolver %v: %w", name, config.DNSResolver, err)
+		return false, fmt.Errorf("%w: %s", ErrDNS, fmt.Errorf("dns-01: failed to lookup TXT records for domain (%v) via resolver %v: %w", name, config.DNSResolver, err).Error())
 	}
 
 	for _, keyAuthz := range results {
@@ -234,7 +234,7 @@ func ValidateDNS01Challenge(domain string, token string, thumbprint string, conf
 		}
 	}
 
-	return false, fmt.Errorf("dns-01: challenge failed against %v records", len(results))
+	return false, fmt.Errorf("%w: %s", ErrDNS, fmt.Errorf("dns-01: challenge failed against %v records", len(results)).Error())
 }
 
 func ValidateTLSALPN01Challenge(domain string, token string, thumbprint string, config *acmeConfigEntry) (bool, error) {
@@ -456,7 +456,7 @@ func ValidateTLSALPN01Challenge(domain string, token string, thumbprint string,
 	// resolved according to configuration.
 	dialer, err := buildDialerConfig(config)
 	if err != nil {
-		return false, fmt.Errorf("failed to build dialer: %w", err)
+		return false, fmt.Errorf("%w: %s", ErrServerInternal, fmt.Errorf("failed to build dialer: %w", err).Error())
 	}
 
 	// Per RFC 8737 Section 3. TLS with Application-Layer Protocol
@@ -471,7 +471,7 @@ func ValidateTLSALPN01Challenge(domain string, token string, thumbprint string,
 	address := fmt.Sprintf("%v:"+ALPNPort, domain)
 	conn, err := dialer.Dial("tcp", address)
 	if err != nil {
-		return false, fmt.Errorf("tls-alpn-01: failed to dial host: %w", err)
+		return false, fmt.Errorf("%w: %s", ErrConnection, fmt.Errorf("tls-alpn-01: failed to dial host: %w", err).Error())
 	}
 
 	// Initiate the connection to the remote peer.
@@ -496,7 +496,7 @@ func ValidateTLSALPN01Challenge(domain string, token string, thumbprint string,
 	// See note above about why we can allow Handshake to complete
 	// successfully.
 	if err := client.HandshakeContext(ctx); err != nil {
-		return false, fmt.Errorf("tls-alpn-01: failed to perform handshake: %w", err)
+		return false, fmt.Errorf("%w: %s", ErrTLS, fmt.Errorf("tls-alpn-01: failed to perform handshake: %w", err).Error())
 	}
 	return true, nil
 }
diff --git a/builtin/logical/pki/acme_challenges_test.go b/builtin/logical/pki/acme_challenges_test.go
index c1b919be757..2b340884daa 100644
--- a/builtin/logical/pki/acme_challenges_test.go
+++ b/builtin/logical/pki/acme_challenges_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/acme_eab_policy.go b/builtin/logical/pki/acme_eab_policy.go
index 43af5d33005..e9decb2735f 100644
--- a/builtin/logical/pki/acme_eab_policy.go
+++ b/builtin/logical/pki/acme_eab_policy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/acme_errors.go b/builtin/logical/pki/acme_errors.go
index 3c9c059f7d2..39c29636d80 100644
--- a/builtin/logical/pki/acme_errors.go
+++ b/builtin/logical/pki/acme_errors.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -110,7 +110,7 @@ type ErrorResponse struct {
 	StatusCode  int              `json:"-"`
 	Type        string           `json:"type"`
 	Detail      string           `json:"detail"`
-	Subproblems []*ErrorResponse `json:"subproblems"`
+	Subproblems []*ErrorResponse `json:"subproblems,omitempty"`
 }
 
 func (e *ErrorResponse) MarshalForStorage() map[string]interface{} {
@@ -142,8 +142,7 @@ func (e *ErrorResponse) Marshal() (*logical.Response, error) {
 	return &resp, nil
 }
 
-func FindType(given error) (err error, id string, code int, found bool) {
-	matchedError := false
+func FindType(given error) (err error, id string, code int, matchedError bool) {
 	for err, id = range errIdMappings {
 		if errors.Is(given, err) {
 			matchedError = true
diff --git a/builtin/logical/pki/acme_jws.go b/builtin/logical/pki/acme_jws.go
index cc096c55c25..3ad5e998461 100644
--- a/builtin/logical/pki/acme_jws.go
+++ b/builtin/logical/pki/acme_jws.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/acme_state.go b/builtin/logical/pki/acme_state.go
index aa070105843..755c08141b9 100644
--- a/builtin/logical/pki/acme_state.go
+++ b/builtin/logical/pki/acme_state.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -11,7 +11,6 @@ import (
 	"io"
 	"net"
 	"path"
-	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -119,7 +118,7 @@ func (a *acmeState) reloadConfigIfRequired(sc *storageContext) error {
 		return nil
 	}
 
-	config, err := sc.getAcmeConfig()
+	config, err := getAcmeConfig(sc)
 	if err != nil {
 		return fmt.Errorf("failed reading ACME config: %w", err)
 	}
@@ -311,7 +310,22 @@ func (a *acmeState) UpdateAccount(sc *storageContext, acct *acmeAccount) error {
 // LoadAccount will load the account object based on the passed in keyId field value
 // otherwise will return an error if the account does not exist.
 func (a *acmeState) LoadAccount(ac *acmeContext, keyId string) (*acmeAccount, error) {
-	entry, err := ac.sc.Storage.Get(ac.sc.Context, acmeAccountPrefix+keyId)
+	acct, err := a.LoadAccountWithoutDirEnforcement(ac.sc, keyId)
+	if err != nil {
+		return acct, err
+	}
+
+	if acct.AcmeDirectory != ac.acmeDirectory {
+		return nil, fmt.Errorf("%w: account part of different ACME directory path", ErrMalformed)
+	}
+
+	return acct, nil
+}
+
+// LoadAccountWithoutDirEnforcement will load the account object based on the passed in keyId field value,
+// but does not enforce the ACME directory path, normally this is used by non ACME specific APIs.
+func (a *acmeState) LoadAccountWithoutDirEnforcement(sc *storageContext, keyId string) (*acmeAccount, error) {
+	entry, err := sc.Storage.Get(sc.Context, acmeAccountPrefix+keyId)
 	if err != nil {
 		return nil, fmt.Errorf("error loading account: %w", err)
 	}
@@ -324,13 +338,7 @@ func (a *acmeState) LoadAccount(ac *acmeContext, keyId string) (*acmeAccount, er
 	if err != nil {
 		return nil, fmt.Errorf("error decoding account: %w", err)
 	}
-
-	if acct.AcmeDirectory != ac.acmeDirectory {
-		return nil, fmt.Errorf("%w: account part of different ACME directory path", ErrMalformed)
-	}
-
 	acct.KeyId = keyId
-
 	return &acct, nil
 }
 
@@ -536,6 +544,27 @@ func (a *acmeState) LoadOrder(ac *acmeContext, userCtx *jwsCtx, orderId string)
 	return &order, nil
 }
 
+// LoadAccountOrders will load all orders for a given account ID, this should be used by the
+// management interface only, not through any of the ACME APIs.
+func (a *acmeState) LoadAccountOrders(sc *storageContext, accountId string) ([]*acmeOrder, error) {
+	orderIds, err := a.ListOrderIds(sc, accountId)
+	if err != nil {
+		return nil, fmt.Errorf("failed listing order ids for account id %s: %w", accountId, err)
+	}
+
+	var orders []*acmeOrder
+	for _, orderId := range orderIds {
+		order, err := a.LoadOrder(&acmeContext{sc: sc}, &jwsCtx{Kid: accountId}, orderId)
+		if err != nil {
+			return nil, err
+		}
+
+		orders = append(orders, order)
+	}
+
+	return orders, nil
+}
+
 func (a *acmeState) SaveOrder(ac *acmeContext, order *acmeOrder) error {
 	if order.OrderId == "" {
 		return fmt.Errorf("invalid order, missing order id")
@@ -565,15 +594,7 @@ func (a *acmeState) ListOrderIds(sc *storageContext, accountId string) ([]string
 		return nil, fmt.Errorf("failed listing order ids for account %s: %w", accountId, err)
 	}
 
-	orderIds := []string{}
-	for _, order := range rawOrderIds {
-		if strings.HasSuffix(order, "/") {
-			// skip any folders we might have for some reason
-			continue
-		}
-		orderIds = append(orderIds, order)
-	}
-	return orderIds, nil
+	return filterDirEntries(rawOrderIds), nil
 }
 
 type acmeCertEntry struct {
@@ -672,17 +693,20 @@ func (a *acmeState) ListEabIds(sc *storageContext) ([]string, error) {
 	if err != nil {
 		return nil, err
 	}
-	var ids []string
-	for _, entry := range entries {
-		if strings.HasSuffix(entry, "/") {
-			continue
-		}
-		ids = append(ids, entry)
-	}
+	ids := filterDirEntries(entries)
 
 	return ids, nil
 }
 
+func (a *acmeState) ListAccountIds(sc *storageContext) ([]string, error) {
+	entries, err := sc.Storage.List(sc.Context, acmeAccountPrefix)
+	if err != nil {
+		return nil, fmt.Errorf("failed listing ACME account prefix directory %s: %w", acmeAccountPrefix, err)
+	}
+
+	return filterDirEntries(entries), nil
+}
+
 func getAcmeSerialToAccountTrackerPath(accountId string, serial string) string {
 	return acmeAccountPrefix + accountId + "/certs/" + normalizeSerial(serial)
 }
diff --git a/builtin/logical/pki/acme_state_test.go b/builtin/logical/pki/acme_state_test.go
index ed9586e834e..6f935031573 100644
--- a/builtin/logical/pki/acme_state_test.go
+++ b/builtin/logical/pki/acme_state_test.go
@@ -1,9 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
 
 import (
+	"encoding/json"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -41,3 +42,28 @@ func TestAcmeNonces(t *testing.T) {
 		require.False(t, a.RedeemNonce(nonce))
 	}
 }
+
+// TestErrorResponseNoSubproblems builds the http body that exists in the header of an ACME error response and checks
+// in a simple case that "type" and "detail" two fields on the body do exist, but that "subproblems" a field which is
+// optional, is omitted because it does not exist in this case (rather than being included with a value null which can
+// trip up some systems).
+func TestErrorResponseNoSubproblems(t *testing.T) {
+	t.Parallel()
+	errResponse, err := TranslateError(ErrAlreadyRevoked)
+	if err != nil {
+		return
+	}
+	require.NoError(t, err, "already revoked should generate an error response")
+	require.NotNil(t, errResponse.Data)
+	body := map[string]string{}
+	rawBody, ok := errResponse.Data["http_raw_body"]
+	err = json.Unmarshal(rawBody.([]byte), &body)
+	require.True(t, ok, "Raw Body of Error response should exist, but doesn't")
+	typeString, ok := body["type"]
+	require.True(t, ok, "Type on Raw Body of Error response should exist, but doesn't")
+	require.Equal(t, typeString, "urn:ietf:params:acme:error:alreadyRevoked")
+	_, ok = body["detail"]
+	require.True(t, ok, "Detail on Raw Body of Error response should exist, but doesn't")
+	subProblems, ok := body["subproblems"]
+	require.False(t, ok, "subproblems on Raw Body of Error response should be omitted, but exists with value %v", subProblems)
+}
diff --git a/builtin/logical/pki/acme_wrappers.go b/builtin/logical/pki/acme_wrappers.go
index febe48b9e43..acfb372a34f 100644
--- a/builtin/logical/pki/acme_wrappers.go
+++ b/builtin/logical/pki/acme_wrappers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -17,12 +17,13 @@ import (
 )
 
 type acmeContext struct {
+	issuing.IssuerRoleContext
+
 	// baseUrl is the combination of the configured cluster local URL and the acmePath up to /acme/
 	baseUrl    *url.URL
 	clusterUrl *url.URL
 	sc         *storageContext
-	role       *issuing.RoleEntry
-	issuer     *issuing.IssuerEntry
+	acmeState  *acmeState
 	// acmeDirectory is a string that can distinguish the various acme directories we have configured
 	// if something needs to remain locked into a directory path structure.
 	acmeDirectory string
@@ -32,7 +33,7 @@ type acmeContext struct {
 }
 
 func (c acmeContext) getAcmeState() *acmeState {
-	return c.sc.Backend.GetAcmeState()
+	return c.acmeState
 }
 
 type (
@@ -110,7 +111,7 @@ func (b *backend) acmeWrapper(opts acmeWrapperOpts, op acmeOperation) framework.
 	return acmeErrorWrapper(func(ctx context.Context, r *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 		sc := b.makeStorageContext(ctx, r.Storage)
 
-		config, err := sc.Backend.GetAcmeState().getConfigWithUpdate(sc)
+		config, err := b.GetAcmeState().getConfigWithUpdate(sc)
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch ACME configuration: %w", err)
 		}
@@ -144,7 +145,7 @@ func (b *backend) acmeWrapper(opts acmeWrapperOpts, op acmeOperation) framework.
 			return nil, err
 		}
 
-		isCiepsEnabled, ciepsPolicy, err := getCiepsAcmeSettings(sc, opts, config, data)
+		isCiepsEnabled, ciepsPolicy, err := getCiepsAcmeSettings(b, sc, opts, config, data)
 		if err != nil {
 			return nil, err
 		}
@@ -160,15 +161,15 @@ func (b *backend) acmeWrapper(opts acmeWrapperOpts, op acmeOperation) framework.
 		}
 
 		acmeCtx := &acmeContext{
-			baseUrl:       acmeBaseUrl,
-			clusterUrl:    clusterBase,
-			sc:            sc,
-			role:          role,
-			issuer:        issuer,
-			acmeDirectory: acmeDirectory,
-			eabPolicy:     eabPolicy,
-			ciepsPolicy:   ciepsPolicy,
-			runtimeOpts:   runtimeOpts,
+			IssuerRoleContext: issuing.NewIssuerRoleContext(ctx, issuer, role),
+			baseUrl:           acmeBaseUrl,
+			clusterUrl:        clusterBase,
+			sc:                sc,
+			acmeState:         b.acmeState,
+			acmeDirectory:     acmeDirectory,
+			eabPolicy:         eabPolicy,
+			ciepsPolicy:       ciepsPolicy,
+			runtimeOpts:       runtimeOpts,
 		}
 
 		return op(acmeCtx, r, data)
@@ -455,7 +456,7 @@ func getAcmeRoleAndIssuer(sc *storageContext, data *framework.FieldData, config
 
 func getAndValidateAcmeRole(sc *storageContext, requestedRole string) (*issuing.RoleEntry, error) {
 	var err error
-	role, err := sc.Backend.GetRole(sc.Context, sc.Storage, requestedRole)
+	role, err := sc.GetRole(requestedRole)
 	if err != nil {
 		return nil, fmt.Errorf("%w: err loading role", ErrServerInternal)
 	}
@@ -496,7 +497,7 @@ func isAcmeDisabled(sc *storageContext, config *acmeConfigEntry, policy EabPolic
 
 	disableAcme, nonFatalErr := isPublicACMEDisabledByEnv()
 	if nonFatalErr != nil {
-		sc.Backend.Logger().Warn(fmt.Sprintf("could not parse env var '%s'", disableAcmeEnvVar), "error", nonFatalErr)
+		sc.Logger().Warn(fmt.Sprintf("could not parse env var '%s'", disableAcmeEnvVar), "error", nonFatalErr)
 	}
 
 	// The OS environment if true will override any configuration option.
diff --git a/builtin/logical/pki/acme_wrappers_test.go b/builtin/logical/pki/acme_wrappers_test.go
index cabca180940..bd11360b42b 100644
--- a/builtin/logical/pki/acme_wrappers_test.go
+++ b/builtin/logical/pki/acme_wrappers_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -82,12 +82,12 @@ func TestACMEIssuerRoleLoading(t *testing.T) {
 	for _, tt := range tc {
 		t.Run(tt.name, func(t *testing.T) {
 			f := b.acmeWrapper(acmeWrapperOpts{}, func(acmeCtx *acmeContext, r *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
-				if tt.roleName != acmeCtx.role.Name {
-					return nil, fmt.Errorf("expected role %s but got %s", tt.roleName, acmeCtx.role.Name)
+				if tt.roleName != acmeCtx.Role.Name {
+					return nil, fmt.Errorf("expected role %s but got %s", tt.roleName, acmeCtx.Role.Name)
 				}
 
-				if tt.expectedIssuerName != acmeCtx.issuer.Name {
-					return nil, fmt.Errorf("expected issuer %s but got %s", tt.expectedIssuerName, acmeCtx.issuer.Name)
+				if tt.expectedIssuerName != acmeCtx.Issuer.Name {
+					return nil, fmt.Errorf("expected issuer %s but got %s", tt.expectedIssuerName, acmeCtx.Issuer.Name)
 				}
 
 				return nil, nil
diff --git a/builtin/logical/pki/backend.go b/builtin/logical/pki/backend.go
index 566f5c255f5..956af331410 100644
--- a/builtin/logical/pki/backend.go
+++ b/builtin/logical/pki/backend.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
 
 import (
 	"context"
+	"crypto/x509"
 	"fmt"
 	"strings"
 	"sync"
@@ -13,9 +14,12 @@ import (
 
 	"github.com/armon/go-metrics"
 	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
 	"github.com/hashicorp/vault/builtin/logical/pki/managed_key"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/framework"
@@ -48,9 +52,9 @@ const (
  * will be forwarded to that cluster's active node and not go all the way up to the performance primary's
  * active node.
  *
- * If a certificate issue request has a role in which no_store is set to true, that node itself
- * will issue the certificate and not forward the request to the active node, as this does not
- * need to write to storage.
+ * If a certificate issue request has a role in which no_store and no_store_metadata is set to
+ * true, that node itself will issue the certificate and not forward the request to the active
+ * node, as this does not need to write to storage.
  *
  * Following the same pattern, if a managed key is involved to sign an issued certificate request
  * and the local node does not have access for some reason to it, the request will be forwarded to
@@ -124,9 +128,11 @@ func Backend(conf *logical.BackendConfig) *backend {
 				localDeltaWALPath,
 				legacyCRLPath,
 				clusterConfigPath,
-				"crls/",
-				"certs/",
+				issuing.PathCrls,
+				issuing.PathCerts,
+				issuing.PathCertMetadata,
 				acmePathPrefix,
+				autoTidyLastRunPath,
 			},
 
 			Root: []string{
@@ -142,7 +148,7 @@ func Backend(conf *logical.BackendConfig) *backend {
 
 			WriteForwardedStorage: []string{
 				crossRevocationPath,
-				unifiedRevocationWritePathPrefix,
+				revocation.UnifiedRevocationWritePathPrefix,
 				unifiedDeltaWALPath,
 			},
 
@@ -232,6 +238,8 @@ func Backend(conf *logical.BackendConfig) *backend {
 			pathAcmeConfig(&b),
 			pathAcmeEabList(&b),
 			pathAcmeEabDelete(&b),
+			pathAcmeMgmtAccountList(&b),
+			pathAcmeMgmtAccountRead(&b),
 		},
 
 		Secrets: []*framework.Secret{
@@ -290,17 +298,27 @@ func Backend(conf *logical.BackendConfig) *backend {
 		conf.System.ReplicationState().HasState(consts.ReplicationDRSecondary)
 	b.crlBuilder = newCRLBuilder(!cannotRebuildCRLs)
 
-	// Delay the first tidy until after we've started up.
-	b.lastTidy = time.Now()
+	// Delay the first tidy until after we've started up, this will be reset within the initialize function
+	now := time.Now()
+	b.tidyStatusLock.Lock()
+	b.lastAutoTidy = now
+	b.tidyStatusLock.Unlock()
+
+	// Keep track of when this mount was started up.
+	b.mountStartup = now
 
 	b.unifiedTransferStatus = newUnifiedTransferStatus()
 
 	b.acmeState = NewACMEState()
 	b.certificateCounter = NewCertificateCounter(b.backendUUID)
 
+	b.pkiCertificateCounter = logical.NewNullPkiCertificateCounter()
+
+	b.pkiObserver = observe.NewPkiCeObserver(b.Logger(), b)
+
 	// It is important that we call SetupEnt at the very end as
 	// some ENT backends need access to the member vars initialized above.
-	b.SetupEnt()
+	b.SetupEnt(conf)
 	return &b
 }
 
@@ -316,12 +334,24 @@ type backend struct {
 
 	tidyStatusLock sync.RWMutex
 	tidyStatus     *tidyStatus
-	lastTidy       time.Time
+	// lastAutoTidy should be accessed through the tidyStatusLock,
+	// use getAutoTidyLastRun and writeAutoTidyLastRun instead of direct access
+	lastAutoTidy time.Time
+
+	// autoTidyBackoff a random time in the future in which auto-tidy can't start
+	// for after the system starts up to avoid a thundering herd of tidy operations
+	// at startup.
+	autoTidyBackoff time.Time
 
 	unifiedTransferStatus *UnifiedTransferStatus
 
+	// certificateCounter emits metrics about the number of stored certificates.
 	certificateCounter *CertificateCounter
 
+	// pkiCertificateCounter keeps track of issued and stored certificate counts
+	// for the purposes of PKI-only billing.
+	pkiCertificateCounter logical.PkiCertificateCounter
+
 	pkiStorageVersion atomic.Value
 	crlBuilder        *CrlBuilder
 
@@ -331,6 +361,11 @@ type backend struct {
 	// Context around ACME operations
 	acmeState       *acmeState
 	acmeAccountLock sync.RWMutex // (Write) Locked on Tidy, (Read) Locked on Account Creation
+
+	// Track when this mount was started.
+	mountStartup time.Time
+
+	pkiObserver observe.PkiObserver
 }
 
 // BackendOps a bridge/legacy interface until we can further
@@ -340,6 +375,8 @@ type BackendOps interface {
 	pki_backend.SystemViewGetter
 	pki_backend.MountInfo
 	pki_backend.Logger
+	revocation.RevokerFactory
+
 	UseLegacyBundleCaStorage() bool
 	CrlBuilder() *CrlBuilder
 	GetRevokeStorageLock() *sync.RWMutex
@@ -442,9 +479,38 @@ func (b *backend) initialize(ctx context.Context, ir *logical.InitializationRequ
 		b.GetCertificateCounter().SetError(err)
 	}
 
+	// Initialize lastAutoTidy from disk
+	b.initializeLastTidyFromStorage(sc)
+
 	return b.initializeEnt(sc, ir)
 }
 
+// initializeLastTidyFromStorage reads the time we last ran auto tidy from storage and initializes
+// b.lastAutoTidy with the value. If no previous value existed, we persist time.Now() and initialize
+// b.lastAutoTidy with that value.
+func (b *backend) initializeLastTidyFromStorage(sc *storageContext) {
+	now := time.Now()
+
+	lastTidyTime, err := sc.getAutoTidyLastRun()
+	if err != nil {
+		lastTidyTime = now
+		b.Logger().Error("failed loading previous tidy last run time, using now", "error", err.Error())
+	}
+	if lastTidyTime.IsZero() {
+		// No previous time was set, persist now so we can track a starting point across Vault restarts
+		lastTidyTime = now
+		if err = b.updateLastAutoTidyTime(sc, now); err != nil {
+			b.Logger().Error("failed persisting tidy last run time", "error", err.Error())
+		}
+	}
+
+	// We bypass using updateLastAutoTidyTime here to avoid the storage write on init
+	// that normally isn't required
+	b.tidyStatusLock.Lock()
+	defer b.tidyStatusLock.Unlock()
+	b.lastAutoTidy = lastTidyTime
+}
+
 func (b *backend) cleanup(ctx context.Context) {
 	sc := b.makeStorageContext(ctx, b.storage)
 
@@ -653,7 +719,7 @@ func (b *backend) periodicFunc(ctx context.Context, request *logical.Request) er
 		}
 
 		// Then attempt to rebuild the CRLs if required.
-		warnings, err := b.CrlBuilder().rebuildIfForced(sc)
+		warnings, err := b.CrlBuilder().RebuildIfForced(sc)
 		if err != nil {
 			return err
 		}
@@ -702,13 +768,20 @@ func (b *backend) periodicFunc(ctx context.Context, request *logical.Request) er
 
 		// Check if we should run another tidy...
 		now := time.Now()
-		b.tidyStatusLock.RLock()
-		nextOp := b.lastTidy.Add(config.Interval)
-		b.tidyStatusLock.RUnlock()
+		nextOp := b.getLastAutoTidyTime().Add(config.Interval)
 		if now.Before(nextOp) {
 			return nil
 		}
 
+		if b.autoTidyBackoff.IsZero() {
+			b.autoTidyBackoff = config.CalculateStartupBackoff(b.mountStartup)
+		}
+
+		if b.autoTidyBackoff.After(now) {
+			b.Logger().Info("Auto tidy will not run as we are still within the random backoff ending at", "backoff_until", b.autoTidyBackoff)
+			return nil
+		}
+
 		// Ensure a tidy isn't already running... If it is, we'll trigger
 		// again when the running one finishes.
 		if !atomic.CompareAndSwapUint32(b.tidyCASGuard, 0, 1) {
@@ -718,9 +791,11 @@ func (b *backend) periodicFunc(ctx context.Context, request *logical.Request) er
 		// Prevent ourselves from starting another tidy operation while
 		// this one is still running. This operation runs in the background
 		// and has a separate error reporting mechanism.
-		b.tidyStatusLock.Lock()
-		b.lastTidy = now
-		b.tidyStatusLock.Unlock()
+		err = b.updateLastAutoTidyTime(sc, now)
+		if err != nil {
+			// We don't really mind if this write fails, we'll re-run in the future
+			b.Logger().Warn("failed to persist auto tidy last run time", "error", err.Error())
+		}
 
 		// Because the request from the parent storage will be cleared at
 		// some point (and potentially reused) -- due to tidy executing in
@@ -790,7 +865,7 @@ func (b *backend) initializeStoredCertificateCounts(ctx context.Context) error {
 		return nil
 	}
 
-	entries, err := b.storage.List(ctx, "certs/")
+	entries, err := b.storage.List(ctx, issuing.PathCerts)
 	if err != nil {
 		return err
 	}
@@ -803,3 +878,77 @@ func (b *backend) initializeStoredCertificateCounts(ctx context.Context) error {
 	certCounter.InitializeCountsFromStorage(entries, revokedEntries)
 	return nil
 }
+
+var _ revocation.Revoker = &revoker{}
+
+type revoker struct {
+	backend        *backend
+	storageContext *storageContext
+	crlConfig      *pki_backend.CrlConfig
+}
+
+func (r *revoker) RevokeCert(cert *x509.Certificate) (revocation.RevokeCertInfo, error) {
+	r.backend.GetRevokeStorageLock().Lock()
+	defer r.backend.GetRevokeStorageLock().Unlock()
+	resp, err := revokeCert(r.storageContext, r.crlConfig, cert)
+	return parseRevokeCertOutput(resp, err)
+}
+
+func (r *revoker) RevokeCertBySerial(serial string) (revocation.RevokeCertInfo, error) {
+	// NOTE: tryRevokeCertBySerial grabs the revoke storage lock for us
+	resp, err := tryRevokeCertBySerial(r.storageContext, r.crlConfig, serial)
+	return parseRevokeCertOutput(resp, err)
+}
+
+// There are a bunch of reasons that a certificate will/won't be revoked. Sadly we will need a further
+// refactoring but for now handle the basics of the reasons/response objects back to a usable object
+// that doesn't directly reply to the API request
+func parseRevokeCertOutput(resp *logical.Response, err error) (revocation.RevokeCertInfo, error) {
+	if err != nil {
+		return revocation.RevokeCertInfo{}, err
+	}
+
+	if resp == nil {
+		// nil, nil response, most likely means the certificate was missing,
+		// but *might* be other things such as a tainted mount
+		return revocation.RevokeCertInfo{}, nil
+	}
+
+	if resp.IsError() {
+		// There are a few reasons we return a response error but not an error,
+		// such as UserError's or they tried to revoke the CA
+		return revocation.RevokeCertInfo{}, resp.Error()
+	}
+
+	// It is possible we don't return the field for various reasons if just a bunch of warnings are set.
+	if revTimeRaw, ok := resp.Data["revocation_time"]; ok {
+		revTimeInt, err := parseutil.ParseInt(revTimeRaw)
+		if err != nil {
+			// Lets me lenient for now
+			revTimeInt = 0
+		}
+		revTime := time.Unix(revTimeInt, 0)
+		return revocation.RevokeCertInfo{
+			RevocationTime: revTime,
+		}, nil
+	}
+
+	// Since we don't really know what went wrong if anything, for example the certificate might
+	// have been expired or close to expiry, lets punt on it for now
+	return revocation.RevokeCertInfo{
+		Warnings: resp.Warnings,
+	}, nil
+}
+
+func (b *backend) GetRevoker(ctx context.Context, s logical.Storage) (revocation.Revoker, error) {
+	sc := b.makeStorageContext(ctx, s)
+	crlConfig, err := b.CrlBuilder().GetConfigWithUpdate(sc)
+	if err != nil {
+		return nil, err
+	}
+	return &revoker{
+		backend:        b,
+		crlConfig:      crlConfig,
+		storageContext: sc,
+	}, nil
+}
diff --git a/builtin/logical/pki/backend_oss.go b/builtin/logical/pki/backend_oss.go
index aa8c413e767..6b74eafbb10 100644
--- a/builtin/logical/pki/backend_oss.go
+++ b/builtin/logical/pki/backend_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -25,4 +25,4 @@ func (b *backend) periodicFuncEnt(_ *storageContext, _ *logical.Request) error {
 
 func (b *backend) cleanupEnt(_ *storageContext) {}
 
-func (b *backend) SetupEnt() {}
+func (b *backend) SetupEnt(conf *logical.BackendConfig) {}
diff --git a/builtin/logical/pki/backend_oss_test.go b/builtin/logical/pki/backend_oss_test.go
index fb464829334..3a264018f74 100644
--- a/builtin/logical/pki/backend_oss_test.go
+++ b/builtin/logical/pki/backend_oss_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/builtin/logical/pki/backend_test.go b/builtin/logical/pki/backend_test.go
index 46b9c16f508..9841355c31c 100644
--- a/builtin/logical/pki/backend_test.go
+++ b/builtin/logical/pki/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -26,6 +26,7 @@ import (
 	"net"
 	"net/url"
 	"os"
+	"os/exec"
 	"reflect"
 	"slices"
 	"sort"
@@ -44,11 +45,14 @@ import (
 	"github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
 	"github.com/hashicorp/vault/builtin/logical/pki/parsing"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
 	"github.com/hashicorp/vault/helper/testhelpers"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	logicaltest "github.com/hashicorp/vault/helper/testhelpers/logical"
 	"github.com/hashicorp/vault/helper/testhelpers/teststorage"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/helper/testhelpers/schema"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
@@ -296,6 +300,87 @@ func TestBackend_CSRValues(t *testing.T) {
 	logicaltest.Test(t, testCase)
 }
 
+func TestBackend_SerialNumberSource(t *testing.T) {
+	t.Parallel()
+	b, s := CreateBackendWithStorage(t)
+
+	var err error
+
+	_, err = CBWrite(b, s, "root/generate/internal", map[string]interface{}{
+		"ttl":         "40h",
+		"common_name": "myvault.com",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = CBWrite(b, s, "roles/json-csr", map[string]interface{}{
+		"allow_any_name":         true,
+		"enforce_hostnames":      false,
+		"allowed_serial_numbers": "foo*",
+		"serial_number_source":   "json-csr",
+		"key_type":               "any",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = CBWrite(b, s, "roles/json", map[string]interface{}{
+		"allow_any_name":         true,
+		"enforce_hostnames":      false,
+		"allowed_serial_numbers": "foo*",
+		"serial_number_source":   "json",
+		"key_type":               "any",
+	})
+
+	// Create a CSR with a serial number not allowed by the role.
+	tmpl := &x509.CertificateRequest{
+		Subject: pkix.Name{SerialNumber: "bar"},
+	}
+	_, _, csrPem := generateCSR(t, tmpl, "ec", 256)
+
+	// Signing a csr with a disallowed subject serial number in the CSR
+	// with serial_number_source=json-csr should fail.
+	_, err = CBWrite(b, s, "sign/json-csr", map[string]interface{}{
+		"common_name": "localhost",
+		"csr":         csrPem,
+	})
+	if err == nil {
+		t.Fatal("expected an error")
+	}
+
+	// The serial number in the request should take precedence.
+	_, err = CBWrite(b, s, "sign/json-csr", map[string]interface{}{
+		"common_name":   "localhost",
+		"csr":           csrPem,
+		"serial_number": "foobar",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Try signing the cert with serial_number_source=json.
+	// The serial in the CSR should be ignored.
+	_, err = CBWrite(b, s, "sign/json", map[string]interface{}{
+		"common_name": "localhost",
+		"csr":         csrPem,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Try signing the cert with serial_number_source=json
+	// and a serial number in the request
+	_, err = CBWrite(b, s, "sign/json", map[string]interface{}{
+		"common_name":   "localhost",
+		"csr":           csrPem,
+		"serial_number": "foobar2",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestBackend_URLsCRUD(t *testing.T) {
 	t.Parallel()
 	initTest.Do(setCerts)
@@ -498,6 +583,10 @@ func generateURLSteps(t *testing.T, caCert, caKey string, intdata, reqdata map[s
 			"http://example.com/crl1",
 			"http://example.com/crl2",
 		},
+		DeltaCRLDistributionPoints: []string{
+			"http://example.com/delta1",
+			"http://example.com/delta2",
+		},
 		OCSPServers: []string{
 			"http://example.com/ocsp1",
 			"http://example.com/ocsp2",
@@ -509,14 +598,14 @@ func generateURLSteps(t *testing.T, caCert, caKey string, intdata, reqdata map[s
 		},
 	}
 
-	priv1024, _ := rsa.GenerateKey(rand.Reader, 1024)
+	priv1024, _ := cryptoutil.GenerateRSAKey(rand.Reader, 1024)
 	csr1024, _ := x509.CreateCertificateRequest(rand.Reader, &csrTemplate, priv1024)
 	csrPem1024 := strings.TrimSpace(string(pem.EncodeToMemory(&pem.Block{
 		Type:  "CERTIFICATE REQUEST",
 		Bytes: csr1024,
 	})))
 
-	priv2048, _ := rsa.GenerateKey(rand.Reader, 2048)
+	priv2048, _ := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	csr2048, _ := x509.CreateCertificateRequest(rand.Reader, &csrTemplate, priv2048)
 	csrPem2048 := strings.TrimSpace(string(pem.EncodeToMemory(&pem.Block{
 		Type:  "CERTIFICATE REQUEST",
@@ -543,9 +632,10 @@ func generateURLSteps(t *testing.T, caCert, caKey string, intdata, reqdata map[s
 			Operation: logical.UpdateOperation,
 			Path:      "config/urls",
 			Data: map[string]interface{}{
-				"issuing_certificates":    strings.Join(expected.IssuingCertificates, ","),
-				"crl_distribution_points": strings.Join(expected.CRLDistributionPoints, ","),
-				"ocsp_servers":            strings.Join(expected.OCSPServers, ","),
+				"issuing_certificates":          strings.Join(expected.IssuingCertificates, ","),
+				"crl_distribution_points":       strings.Join(expected.CRLDistributionPoints, ","),
+				"delta_crl_distribution_points": strings.Join(expected.DeltaCRLDistributionPoints, ","),
+				"ocsp_servers":                  strings.Join(expected.OCSPServers, ","),
 			},
 		},
 
@@ -622,11 +712,17 @@ func generateURLSteps(t *testing.T, caCert, caKey string, intdata, reqdata map[s
 
 				skid, _ := hex.DecodeString("142EB317B75856CBAE500940E61FAF9D8B14C2C6")
 
+				deltaCrlDistributionPoints, err := certutil.ParseDeltaCRLExtension(cert)
+				if err != nil {
+					return fmt.Errorf("error: invalid delta crl extension: %v", err.Error())
+				}
 				switch {
 				case !reflect.DeepEqual(expected.IssuingCertificates, cert.IssuingCertificateURL):
 					return fmt.Errorf("IssuingCertificateURL:\nexpected\n%#v\ngot\n%#v\n", expected.IssuingCertificates, cert.IssuingCertificateURL)
 				case !reflect.DeepEqual(expected.CRLDistributionPoints, cert.CRLDistributionPoints):
 					return fmt.Errorf("CRLDistributionPoints:\nexpected\n%#v\ngot\n%#v\n", expected.CRLDistributionPoints, cert.CRLDistributionPoints)
+				case !reflect.DeepEqual(expected.DeltaCRLDistributionPoints, deltaCrlDistributionPoints):
+					return fmt.Errorf("DeltaCRLDistributionPoints:\nexpected\n%#v\ngot\n%#v\n", expected.DeltaCRLDistributionPoints, deltaCrlDistributionPoints)
 				case !reflect.DeepEqual(expected.OCSPServers, cert.OCSPServer):
 					return fmt.Errorf("OCSPServer:\nexpected\n%#v\ngot\n%#v\n", expected.OCSPServers, cert.OCSPServer)
 				case !reflect.DeepEqual([]string{"intermediate.cert.com"}, cert.DNSNames):
@@ -673,11 +769,17 @@ func generateURLSteps(t *testing.T, caCert, caKey string, intdata, reqdata map[s
 				}
 				cert := certs[0]
 
+				deltaCrlDistributionPoints, err := certutil.ParseDeltaCRLExtension(cert)
+				if err != nil {
+					return fmt.Errorf("error: invalid delta crl extension: %v", err.Error())
+				}
 				switch {
 				case !reflect.DeepEqual(expected.IssuingCertificates, cert.IssuingCertificateURL):
 					return fmt.Errorf("expected\n%#v\ngot\n%#v\n", expected.IssuingCertificates, cert.IssuingCertificateURL)
 				case !reflect.DeepEqual(expected.CRLDistributionPoints, cert.CRLDistributionPoints):
 					return fmt.Errorf("expected\n%#v\ngot\n%#v\n", expected.CRLDistributionPoints, cert.CRLDistributionPoints)
+				case !reflect.DeepEqual(expected.DeltaCRLDistributionPoints, deltaCrlDistributionPoints):
+					return fmt.Errorf("exected\n%#v\ngot\n%#v\n", expected.DeltaCRLDistributionPoints, deltaCrlDistributionPoints)
 				case !reflect.DeepEqual(expected.OCSPServers, cert.OCSPServer):
 					return fmt.Errorf("expected\n%#v\ngot\n%#v\n", expected.OCSPServers, cert.OCSPServer)
 				case !reflect.DeepEqual([]string(nil), cert.DNSNames):
@@ -698,7 +800,7 @@ func generateCSR(t *testing.T, csrTemplate *x509.CertificateRequest, keyType str
 	var err error
 	switch keyType {
 	case "rsa":
-		priv, err = rsa.GenerateKey(rand.Reader, keyBits)
+		priv, err = cryptoutil.GenerateRSAKey(rand.Reader, keyBits)
 	case "ec":
 		switch keyBits {
 		case 224:
@@ -1179,7 +1281,7 @@ func generateRoleSteps(t *testing.T, useCSRs bool) []logicaltest.TestStep {
 		case "rsa":
 			privKey, ok = generatedRSAKeys[keyBits]
 			if !ok {
-				privKey, _ = rsa.GenerateKey(rand.Reader, keyBits)
+				privKey, _ = cryptoutil.GenerateRSAKey(rand.Reader, keyBits)
 				generatedRSAKeys[keyBits] = privKey
 			}
 
@@ -2010,8 +2112,9 @@ func TestBackend_PathFetchCertList(t *testing.T) {
 
 	// config urls
 	urlsData := map[string]interface{}{
-		"issuing_certificates":    "http://127.0.0.1:8200/v1/pki/ca",
-		"crl_distribution_points": "http://127.0.0.1:8200/v1/pki/crl",
+		"issuing_certificates":          "http://127.0.0.1:8200/v1/pki/ca",
+		"crl_distribution_points":       "http://127.0.0.1:8200/v1/pki/crl",
+		"delta_crl_distribution_points": "http://127.0.0.1:8200/v1/pki/crl/delta",
 	}
 
 	resp, err = b.HandleRequest(context.Background(), &logical.Request{
@@ -2103,7 +2206,7 @@ func TestBackend_PathFetchCertList(t *testing.T) {
 	// list certs/
 	resp, err = b.HandleRequest(context.Background(), &logical.Request{
 		Operation:  logical.ListOperation,
-		Path:       "certs/",
+		Path:       issuing.PathCerts,
 		Storage:    storage,
 		MountPoint: "pki/",
 	})
@@ -2163,7 +2266,7 @@ func runTestSignVerbatim(t *testing.T, keyType string) {
 	}
 
 	// create a CSR and key
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	key, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -2275,7 +2378,7 @@ func runTestSignVerbatim(t *testing.T, keyType string) {
 		t.Fatal(err)
 	}
 	if resp != nil && resp.IsError() {
-		t.Fatalf(resp.Error().Error())
+		t.Fatal(resp.Error().Error())
 	}
 	if resp.Data == nil || resp.Data["certificate"] == nil {
 		t.Fatal("did not get expected data")
@@ -2315,7 +2418,7 @@ func runTestSignVerbatim(t *testing.T, keyType string) {
 		t.Fatal(err)
 	}
 	if resp != nil && resp.IsError() {
-		t.Fatalf(resp.Error().Error())
+		t.Fatal(resp.Error().Error())
 	}
 	if resp.Data == nil || resp.Data["certificate"] == nil {
 		t.Fatal("did not get expected data")
@@ -2539,6 +2642,59 @@ func TestBackend_Root_Idempotency(t *testing.T) {
 	}
 }
 
+// TestBackend_SignIntermediate_EnforceLeafFlag verifies if the flag is true
+// that we will leverage the issuer's configured behavior
+func TestBackend_SignIntermediate_EnforceLeafFlag(t *testing.T) {
+	t.Parallel()
+	b, s := CreateBackendWithStorage(t)
+
+	resp, err := CBWrite(b, s, "root/generate/internal", map[string]interface{}{
+		"ttl":         "40h",
+		"common_name": "myvault.com",
+	})
+	require.NoError(t, err, "failed generating root cert")
+	rootCert := parseCert(t, resp.Data["certificate"].(string))
+
+	_, err = CBWrite(b, s, "issuer/default", map[string]interface{}{
+		"leaf_not_after_behavior": "err",
+	})
+	require.NoError(t, err, "failed updating root issuer cert behavior")
+
+	resp, err = CBWrite(b, s, "intermediate/generate/internal", map[string]interface{}{
+		"common_name": "myint.com",
+	})
+	require.NoError(t, err, "failed generating intermediary CSR")
+	csr := resp.Data["csr"]
+
+	_, err = CBWrite(b, s, "root/sign-intermediate", map[string]interface{}{
+		"common_name":                     "myint.com",
+		"other_sans":                      "1.3.6.1.4.1.311.20.2.3;utf8:caadmin@example.com",
+		"csr":                             csr,
+		"ttl":                             "60h",
+		"enforce_leaf_not_after_behavior": true,
+	})
+	require.Error(t, err, "sign-intermediate should have failed as root issuer leaf behavior is set to err")
+
+	// Now test with permit, the old default behavior
+	_, err = CBWrite(b, s, "issuer/default", map[string]interface{}{
+		"leaf_not_after_behavior": "permit",
+	})
+	require.NoError(t, err, "failed updating root issuer cert behavior to permit")
+
+	resp, err = CBWrite(b, s, "root/sign-intermediate", map[string]interface{}{
+		"common_name":                     "myint.com",
+		"other_sans":                      "1.3.6.1.4.1.311.20.2.3;utf8:caadmin@example.com",
+		"csr":                             csr,
+		"ttl":                             "60h",
+		"enforce_leaf_not_after_behavior": true,
+	})
+	require.NoError(t, err, "failed to sign intermediary CA with permit as issuer")
+	intCert := parseCert(t, resp.Data["certificate"].(string))
+
+	require.Truef(t, rootCert.NotAfter.Before(intCert.NotAfter),
+		"root cert notAfter %v was not before ca cert's notAfter %v", rootCert.NotAfter, intCert.NotAfter)
+}
+
 func TestBackend_SignIntermediate_AllowedPastCAValidity(t *testing.T) {
 	t.Parallel()
 	b_root, s_root := CreateBackendWithStorage(t)
@@ -2546,7 +2702,7 @@ func TestBackend_SignIntermediate_AllowedPastCAValidity(t *testing.T) {
 	var err error
 
 	// Direct issuing from root
-	_, err = CBWrite(b_root, s_root, "root/generate/internal", map[string]interface{}{
+	resp, err := CBWrite(b_root, s_root, "root/generate/internal", map[string]interface{}{
 		"ttl":         "40h",
 		"common_name": "myvault.com",
 	})
@@ -2554,6 +2710,8 @@ func TestBackend_SignIntermediate_AllowedPastCAValidity(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	rootCert := parseCert(t, resp.Data["certificate"].(string))
+
 	_, err = CBWrite(b_root, s_root, "roles/test", map[string]interface{}{
 		"allow_bare_domains": true,
 		"allow_subdomains":   true,
@@ -2563,7 +2721,7 @@ func TestBackend_SignIntermediate_AllowedPastCAValidity(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	resp, err := CBWrite(b_int, s_int, "intermediate/generate/internal", map[string]interface{}{
+	resp, err = CBWrite(b_int, s_int, "intermediate/generate/internal", map[string]interface{}{
 		"common_name": "myint.com",
 	})
 	schema.ValidateResponse(t, schema.GetResponseSchema(t, b_root.Route("intermediate/generate/internal"), logical.UpdateOperation), resp, true)
@@ -2614,6 +2772,9 @@ func TestBackend_SignIntermediate_AllowedPastCAValidity(t *testing.T) {
 	cert := parseCert(t, resp.Data["certificate"].(string))
 	certSkid := certutil.GetHexFormatted(cert.SubjectKeyId, ":")
 	require.Equal(t, intSkid, certSkid)
+
+	require.Equal(t, rootCert.NotAfter, cert.NotAfter, "intermediary cert's NotAfter did not match root cert's NotAfter")
+	require.Contains(t, resp.Warnings, intCaTruncatationWarning, "missing warning about intermediary CA notAfter truncation")
 }
 
 func TestBackend_ConsulSignLeafWithLegacyRole(t *testing.T) {
@@ -2676,7 +2837,7 @@ func TestBackend_SignSelfIssued(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	key, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -2820,7 +2981,7 @@ func TestBackend_SignSelfIssued_DifferentTypes(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	key, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -3662,6 +3823,7 @@ func TestReadWriteDeleteRoles(t *testing.T) {
 	expectedData := map[string]interface{}{
 		"key_type":                           "rsa",
 		"use_csr_sans":                       true,
+		"serial_number_source":               "json-csr",
 		"client_flag":                        true,
 		"allowed_serial_numbers":             []interface{}{},
 		"generate_lease":                     false,
@@ -3709,6 +3871,10 @@ func TestReadWriteDeleteRoles(t *testing.T) {
 		"allowed_user_ids":                   []interface{}{},
 	}
 
+	if issuing.MetadataPermitted {
+		expectedData["no_store_metadata"] = false
+	}
+
 	if diff := deep.Equal(expectedData, resp.Data); len(diff) > 0 {
 		t.Fatalf("pki role default values have changed, diff: %v", diff)
 	}
@@ -3771,7 +3937,7 @@ func setCerts() {
 	}
 	ecCACert = strings.TrimSpace(string(pem.EncodeToMemory(caCertPEMBlock)))
 
-	rak, err := rsa.GenerateKey(rand.Reader, 2048)
+	rak, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	if err != nil {
 		panic(err)
 	}
@@ -4050,6 +4216,8 @@ func TestBackend_RevokePlusTidy_Intermediate(t *testing.T) {
 			"tidy_move_legacy_ca_bundle":            false,
 			"tidy_revocation_queue":                 false,
 			"tidy_cross_cluster_revoked_certs":      false,
+			"tidy_cert_metadata":                    false,
+			"tidy_cmpv2_nonce_store":                false,
 			"pause_duration":                        "0s",
 			"state":                                 "Finished",
 			"error":                                 nil,
@@ -4071,6 +4239,8 @@ func TestBackend_RevokePlusTidy_Intermediate(t *testing.T) {
 			"acme_account_revoked_count":            json.Number("0"),
 			"acme_account_deleted_count":            json.Number("0"),
 			"total_acme_account_count":              json.Number("0"),
+			"cert_metadata_deleted_count":           json.Number("0"),
+			"cmpv2_nonce_deleted_count":             json.Number("0"),
 		}
 		// Let's copy the times from the response so that we can use deep.Equal()
 		timeStarted, ok := tidyStatus.Data["time_started"]
@@ -4789,7 +4959,7 @@ func TestBackend_Roles_KeySizeRegression(t *testing.T) {
 		/*  8 */ {"ed25519", []int{0}, []int{0}, false, []string{"ed25519"}, []int{0}, false},
 
 		// Any key type should reject insecure RSA key sizes.
-		/*  9 */ {"any", []int{0}, []int{0, 256, 384, 512}, false, []string{"rsa", "rsa"}, []int{512, 1024}, true},
+		/*  9 */ {"any", []int{0}, []int{0, 256, 384, 512}, false, []string{"rsa"}, []int{1024}, true},
 		// But work for everything else.
 		/* 10 */ {"any", []int{0}, []int{0, 256, 384, 512}, false, []string{"rsa", "rsa", "ec", "ec", "ec", "ec", "ed25519"}, []int{2048, 3072, 224, 256, 384, 521, 0}, false},
 
@@ -5151,6 +5321,9 @@ func TestPerIssuerAIA(t *testing.T) {
 	require.Empty(t, rootCert.OCSPServer)
 	require.Empty(t, rootCert.IssuingCertificateURL)
 	require.Empty(t, rootCert.CRLDistributionPoints)
+	deltaCrlDistributionPoints, err := certutil.ParseDeltaCRLExtension(rootCert)
+	require.NoError(t, err)
+	require.Empty(t, deltaCrlDistributionPoints)
 
 	// Set some local URLs on the issuer.
 	resp, err = CBWrite(b, s, "issuer/default", map[string]interface{}{
@@ -5177,12 +5350,16 @@ func TestPerIssuerAIA(t *testing.T) {
 	require.Empty(t, leafCert.OCSPServer)
 	require.Equal(t, leafCert.IssuingCertificateURL, []string{"https://google.com"})
 	require.Empty(t, leafCert.CRLDistributionPoints)
+	deltaCrlDistributionPoints, err = certutil.ParseDeltaCRLExtension(leafCert)
+	require.NoError(t, err)
+	require.Empty(t, deltaCrlDistributionPoints)
 
 	// Set global URLs and ensure they don't appear on this issuer's leaf.
 	_, err = CBWrite(b, s, "config/urls", map[string]interface{}{
-		"issuing_certificates":    []string{"https://example.com/ca", "https://backup.example.com/ca"},
-		"crl_distribution_points": []string{"https://example.com/crl", "https://backup.example.com/crl"},
-		"ocsp_servers":            []string{"https://example.com/ocsp", "https://backup.example.com/ocsp"},
+		"issuing_certificates":          []string{"https://example.com/ca", "https://backup.example.com/ca"},
+		"crl_distribution_points":       []string{"https://example.com/crl", "https://backup.example.com/crl"},
+		"delta_crl_distribution_points": []string{"https://example.com/crl/delta", "https://backup.example.com/crl/delta"},
+		"ocsp_servers":                  []string{"https://example.com/ocsp", "https://backup.example.com/ocsp"},
 	})
 	require.NoError(t, err)
 	resp, err = CBWrite(b, s, "issuer/default/issue/testing", map[string]interface{}{
@@ -5194,6 +5371,9 @@ func TestPerIssuerAIA(t *testing.T) {
 	require.Empty(t, leafCert.OCSPServer)
 	require.Equal(t, leafCert.IssuingCertificateURL, []string{"https://google.com"})
 	require.Empty(t, leafCert.CRLDistributionPoints)
+	deltaCrlDistributionPoints, err = certutil.ParseDeltaCRLExtension(leafCert)
+	require.NoError(t, err)
+	require.Empty(t, deltaCrlDistributionPoints)
 
 	// Now come back and remove the local modifications and ensure we get
 	// the defaults again.
@@ -5210,6 +5390,9 @@ func TestPerIssuerAIA(t *testing.T) {
 	require.Equal(t, leafCert.IssuingCertificateURL, []string{"https://example.com/ca", "https://backup.example.com/ca"})
 	require.Equal(t, leafCert.OCSPServer, []string{"https://example.com/ocsp", "https://backup.example.com/ocsp"})
 	require.Equal(t, leafCert.CRLDistributionPoints, []string{"https://example.com/crl", "https://backup.example.com/crl"})
+	deltaCrlDistributionPoints, err = certutil.ParseDeltaCRLExtension(leafCert)
+	require.NoError(t, err)
+	require.Equal(t, deltaCrlDistributionPoints, []string{"https://example.com/crl/delta", "https://backup.example.com/crl/delta"})
 
 	// Validate that we can set an issuer name and remove it.
 	_, err = CBPatch(b, s, "issuer/default", map[string]interface{}{
@@ -6020,7 +6203,7 @@ func TestPKI_EmptyCRLConfigUpgraded(t *testing.T) {
 	b, s := CreateBackendWithStorage(t)
 
 	// Write an empty CRLConfig into storage.
-	crlConfigEntry, err := logical.StorageEntryJSON("config/crl", &crlConfig{})
+	crlConfigEntry, err := logical.StorageEntryJSON("config/crl", &pki_backend.CrlConfig{})
 	require.NoError(t, err)
 	err = s.Put(ctx, crlConfigEntry)
 	require.NoError(t, err)
@@ -6029,13 +6212,14 @@ func TestPKI_EmptyCRLConfigUpgraded(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, resp)
 	require.NotNil(t, resp.Data)
-	require.Equal(t, resp.Data["expiry"], defaultCrlConfig.Expiry)
-	require.Equal(t, resp.Data["disable"], defaultCrlConfig.Disable)
-	require.Equal(t, resp.Data["ocsp_disable"], defaultCrlConfig.OcspDisable)
-	require.Equal(t, resp.Data["auto_rebuild"], defaultCrlConfig.AutoRebuild)
-	require.Equal(t, resp.Data["auto_rebuild_grace_period"], defaultCrlConfig.AutoRebuildGracePeriod)
-	require.Equal(t, resp.Data["enable_delta"], defaultCrlConfig.EnableDelta)
-	require.Equal(t, resp.Data["delta_rebuild_interval"], defaultCrlConfig.DeltaRebuildInterval)
+	require.Equal(t, resp.Data["expiry"], pki_backend.DefaultCrlConfig.Expiry)
+	require.Equal(t, resp.Data["disable"], pki_backend.DefaultCrlConfig.Disable)
+	require.Equal(t, resp.Data["ocsp_disable"], pki_backend.DefaultCrlConfig.OcspDisable)
+	require.Equal(t, resp.Data["auto_rebuild"], pki_backend.DefaultCrlConfig.AutoRebuild)
+	require.Equal(t, resp.Data["auto_rebuild_grace_period"], pki_backend.DefaultCrlConfig.AutoRebuildGracePeriod)
+	require.Equal(t, resp.Data["enable_delta"], pki_backend.DefaultCrlConfig.EnableDelta)
+	require.Equal(t, resp.Data["delta_rebuild_interval"], pki_backend.DefaultCrlConfig.DeltaRebuildInterval)
+	require.Equal(t, resp.Data["max_crl_entries"], pki_backend.DefaultCrlConfig.MaxCRLEntries)
 }
 
 func TestPKI_ListRevokedCerts(t *testing.T) {
@@ -6131,10 +6315,11 @@ func TestPKI_TemplatedAIAs(t *testing.T) {
 	schema.ValidateResponse(t, schema.GetResponseSchema(t, b.Route("config/cluster"), logical.ReadOperation), resp, true)
 
 	aiaData := map[string]interface{}{
-		"crl_distribution_points": "{{cluster_path}}/issuer/{{issuer_id}}/crl/der",
-		"issuing_certificates":    "{{cluster_aia_path}}/issuer/{{issuer_id}}/der",
-		"ocsp_servers":            "{{cluster_path}}/ocsp",
-		"enable_templating":       true,
+		"crl_distribution_points":       "{{cluster_path}}/issuer/{{issuer_id}}/crl/der",
+		"delta_crl_distribution_points": "{{cluster_path}}/issuer/{{issuer_id}}/crl/delta",
+		"issuing_certificates":          "{{cluster_aia_path}}/issuer/{{issuer_id}}/der",
+		"ocsp_servers":                  "{{cluster_path}}/ocsp",
+		"enable_templating":             true,
 	}
 	_, err = CBWrite(b, s, "config/urls", aiaData)
 	require.NoError(t, err)
@@ -6152,10 +6337,11 @@ func TestPKI_TemplatedAIAs(t *testing.T) {
 
 	// Clearing the config and regenerating the root should still succeed.
 	_, err = CBWrite(b, s, "config/urls", map[string]interface{}{
-		"crl_distribution_points": "{{cluster_path}}/issuer/my-root-id/crl/der",
-		"issuing_certificates":    "{{cluster_aia_path}}/issuer/my-root-id/der",
-		"ocsp_servers":            "{{cluster_path}}/ocsp",
-		"enable_templating":       true,
+		"crl_distribution_points":       "{{cluster_path}}/issuer/my-root-id/crl/der",
+		"delta_crl_distribution_points": "{{cluster_path}}/issuer/my-root-id/crl/delta",
+		"issuing_certificates":          "{{cluster_aia_path}}/issuer/my-root-id/der",
+		"ocsp_servers":                  "{{cluster_path}}/ocsp",
+		"enable_templating":             true,
 	})
 	require.NoError(t, err)
 	resp, err = CBWrite(b, s, "root/generate/internal", rootData)
@@ -6181,22 +6367,27 @@ func TestPKI_TemplatedAIAs(t *testing.T) {
 	require.Equal(t, cert.OCSPServer, []string{"http://localhost:8200/v1/pki/ocsp"})
 	require.Equal(t, cert.IssuingCertificateURL, []string{"http://localhost:8200/cdn/pki/issuer/" + issuerId + "/der"})
 	require.Equal(t, cert.CRLDistributionPoints, []string{"http://localhost:8200/v1/pki/issuer/" + issuerId + "/crl/der"})
+	deltaCrlDistributionPoints, err := certutil.ParseDeltaCRLExtension(cert)
+	require.NoError(t, err)
+	require.Equal(t, deltaCrlDistributionPoints, []string{"http://localhost:8200/v1/pki/issuer/" + issuerId + "/crl/delta"})
 
 	// Modify our issuer to set custom AIAs: these URLs are bad.
 	_, err = CBPatch(b, s, "issuer/default", map[string]interface{}{
-		"enable_aia_url_templating": "false",
-		"crl_distribution_points":   "a",
-		"issuing_certificates":      "b",
-		"ocsp_servers":              "c",
+		"enable_aia_url_templating":     "false",
+		"crl_distribution_points":       "a",
+		"issuing_certificates":          "b",
+		"ocsp_servers":                  "c",
+		"delta_crl_distribution_points": "d",
 	})
 	require.Error(t, err)
 
 	// These URLs are good.
 	_, err = CBPatch(b, s, "issuer/default", map[string]interface{}{
-		"enable_aia_url_templating": "false",
-		"crl_distribution_points":   "http://localhost/a",
-		"issuing_certificates":      "http://localhost/b",
-		"ocsp_servers":              "http://localhost/c",
+		"enable_aia_url_templating":     "false",
+		"crl_distribution_points":       "http://localhost/a",
+		"delta_crl_distribution_points": "http://localhost/d",
+		"issuing_certificates":          "http://localhost/b",
+		"ocsp_servers":                  "http://localhost/c",
 	})
 
 	resp, err = CBWrite(b, s, "issue/testing", map[string]interface{}{
@@ -6209,13 +6400,17 @@ func TestPKI_TemplatedAIAs(t *testing.T) {
 	require.Equal(t, cert.OCSPServer, []string{"http://localhost/c"})
 	require.Equal(t, cert.IssuingCertificateURL, []string{"http://localhost/b"})
 	require.Equal(t, cert.CRLDistributionPoints, []string{"http://localhost/a"})
+	deltaCrlDistributionPoints, err = certutil.ParseDeltaCRLExtension(cert)
+	require.NoError(t, err)
+	require.Equal(t, deltaCrlDistributionPoints, []string{"http://localhost/d"})
 
 	// These URLs are bad, but will fail at issuance time due to AIA templating.
 	resp, err = CBPatch(b, s, "issuer/default", map[string]interface{}{
-		"enable_aia_url_templating": "true",
-		"crl_distribution_points":   "a",
-		"issuing_certificates":      "b",
-		"ocsp_servers":              "c",
+		"enable_aia_url_templating":     "true",
+		"crl_distribution_points":       "a",
+		"issuing_certificates":          "b",
+		"ocsp_servers":                  "c",
+		"delta_crl_distribution_points": "d",
 	})
 	requireSuccessNonNilResponse(t, resp, err)
 	require.NotEmpty(t, resp.Warnings)
@@ -6700,12 +6895,14 @@ const (
 	shouldBeAuthed pathAuthChecker = iota
 	shouldBeUnauthedReadList
 	shouldBeUnauthedWriteOnly
+	shouldBeUnauthedReadWriteOnly
 )
 
 var pathAuthChckerMap = map[pathAuthChecker]pathAuthCheckerFunc{
-	shouldBeAuthed:            pathShouldBeAuthed,
-	shouldBeUnauthedReadList:  pathShouldBeUnauthedReadList,
-	shouldBeUnauthedWriteOnly: pathShouldBeUnauthedWriteOnly,
+	shouldBeAuthed:                pathShouldBeAuthed,
+	shouldBeUnauthedReadList:      pathShouldBeUnauthedReadList,
+	shouldBeUnauthedWriteOnly:     pathShouldBeUnauthedWriteOnly,
+	shouldBeUnauthedReadWriteOnly: pathShouldBeUnauthedWriteOnly,
 }
 
 func TestProperAuthing(t *testing.T) {
@@ -6760,7 +6957,10 @@ func TestProperAuthing(t *testing.T) {
 	}
 	serial := resp.Data["serial_number"].(string)
 	eabKid := "13b80844-e60d-42d2-b7e9-152a8e834b90"
+	acmeKeyId := "hrKmDYTvicHoHGVN2-3uzZV_BPGdE0W_dNaqYTtYqeo="
 	paths := map[string]pathAuthChecker{
+		"acme/mgmt/account/keyid/":               shouldBeAuthed,
+		"acme/mgmt/account/keyid/" + acmeKeyId:   shouldBeAuthed,
 		"ca_chain":                               shouldBeUnauthedReadList,
 		"cert/ca_chain":                          shouldBeUnauthedReadList,
 		"ca":                                     shouldBeUnauthedReadList,
@@ -6780,7 +6980,7 @@ func TestProperAuthing(t *testing.T) {
 		"cert/unified-delta-crl":                 shouldBeUnauthedReadList,
 		"cert/unified-delta-crl/raw":             shouldBeUnauthedReadList,
 		"cert/unified-delta-crl/raw/pem":         shouldBeUnauthedReadList,
-		"certs/":                                 shouldBeAuthed,
+		issuing.PathCerts:                        shouldBeAuthed,
 		"certs/revoked/":                         shouldBeAuthed,
 		"certs/revocation-queue/":                shouldBeAuthed,
 		"certs/unified-revoked/":                 shouldBeAuthed,
@@ -6798,6 +6998,8 @@ func TestProperAuthing(t *testing.T) {
 		"crl/delta/pem":                          shouldBeUnauthedReadList,
 		"crl/rotate":                             shouldBeAuthed,
 		"crl/rotate-delta":                       shouldBeAuthed,
+		"eab/":                                   shouldBeAuthed,
+		"eab/" + eabKid:                          shouldBeAuthed,
 		"intermediate/cross-sign":                shouldBeAuthed,
 		"intermediate/generate/exported":         shouldBeAuthed,
 		"intermediate/generate/internal":         shouldBeAuthed,
@@ -6877,8 +7079,6 @@ func TestProperAuthing(t *testing.T) {
 		"unified-crl/delta/pem":                  shouldBeUnauthedReadList,
 		"unified-ocsp":                           shouldBeUnauthedWriteOnly,
 		"unified-ocsp/dGVzdAo=":                  shouldBeUnauthedReadList,
-		"eab/":                                   shouldBeAuthed,
-		"eab/" + eabKid:                          shouldBeAuthed,
 	}
 
 	entPaths := getEntProperAuthingPaths(serial)
@@ -6949,7 +7149,10 @@ func TestProperAuthing(t *testing.T) {
 			raw_path = strings.ReplaceAll(raw_path, "{serial}", serial)
 		}
 		if strings.Contains(raw_path, "acme/account/") && strings.Contains(raw_path, "{kid}") {
-			raw_path = strings.ReplaceAll(raw_path, "{kid}", "hrKmDYTvicHoHGVN2-3uzZV_BPGdE0W_dNaqYTtYqeo=")
+			raw_path = strings.ReplaceAll(raw_path, "{kid}", acmeKeyId)
+		}
+		if strings.Contains(raw_path, "acme/mgmt/account/") && strings.Contains(raw_path, "{keyid}") {
+			raw_path = strings.ReplaceAll(raw_path, "{keyid}", acmeKeyId)
 		}
 		if strings.Contains(raw_path, "acme/") && strings.Contains(raw_path, "{auth_id}") {
 			raw_path = strings.ReplaceAll(raw_path, "{auth_id}", "29da8c38-7a09-465e-b9a6-3d76802b1afd")
@@ -6999,6 +7202,10 @@ func TestProperAuthing(t *testing.T) {
 			if hasGet || hasList {
 				t.Fatalf("Unauthed write-only endpoints should not have GET/LIST capabilities: %v->%v", openapi_path, raw_path)
 			}
+		} else if handler == shouldBeUnauthedReadWriteOnly {
+			if hasDelete || hasList {
+				t.Fatalf("Unauthed read-write-only endpoints should not have DELETE/LIST capabilities: %v->%v", openapi_path, raw_path)
+			}
 		}
 	}
 
@@ -7007,15 +7214,16 @@ func TestProperAuthing(t *testing.T) {
 	}
 }
 
+type patchIssuerTestCase struct {
+	Field   string
+	Before  interface{}
+	Patched interface{}
+}
+
 func TestPatchIssuer(t *testing.T) {
 	t.Parallel()
 
-	type TestCase struct {
-		Field   string
-		Before  interface{}
-		Patched interface{}
-	}
-	testCases := []TestCase{
+	testCases := []patchIssuerTestCase{
 		{
 			Field:   "issuer_name",
 			Before:  "root",
@@ -7046,6 +7254,11 @@ func TestPatchIssuer(t *testing.T) {
 			Before:  []string{"http://localhost/v1/pki-1/crl"},
 			Patched: []string{"http://localhost/v1/pki/crl"},
 		},
+		{
+			Field:   "delta_crl_distribution_points",
+			Before:  []string{"http://localhost/v1/pki-1/crl/delta"},
+			Patched: []string{"http://localhost/v1/pki/crl/delta"},
+		},
 		{
 			Field:   "ocsp_servers",
 			Before:  []string{"http://localhost/v1/pki-1/ocsp"},
@@ -7062,65 +7275,83 @@ func TestPatchIssuer(t *testing.T) {
 			Patched: []string{"self"},
 		},
 	}
+	testPatchIssuer(t, testCases)
+}
 
-	for index, testCase := range testCases {
-		t.Logf("index: %v / tc: %v", index, testCase)
+func testPatchIssuer(t *testing.T, testCases []patchIssuerTestCase) {
+	for _, testCase := range testCases {
+		t.Run(testCase.Field, func(t *testing.T) {
+			b, s := CreateBackendWithStorage(t)
+
+			// 1. Setup root issuer.
+			resp, err := CBWrite(b, s, "root/generate/internal", map[string]interface{}{
+				"common_name": "Vault Root CA",
+				"key_type":    "ec",
+				"ttl":         "7200h",
+				"issuer_name": "root",
+			})
+			requireSuccessNonNilResponse(t, resp, err, "failed generating root issuer")
+			id := string(resp.Data["issuer_id"].(issuing.IssuerID))
 
-		b, s := CreateBackendWithStorage(t)
+			// 2. Enable Cluster paths
+			resp, err = CBWrite(b, s, "config/urls", map[string]interface{}{
+				"path":     "https://localhost/v1/pki",
+				"aia_path": "http://localhost/v1/pki",
+			})
+			requireSuccessNonNilResponse(t, resp, err, "failed updating AIA config")
+
+			// 3. Add AIA information
+			resp, err = CBPatch(b, s, "issuer/default", map[string]interface{}{
+				"issuing_certificates":          "http://localhost/v1/pki-1/ca",
+				"crl_distribution_points":       "http://localhost/v1/pki-1/crl",
+				"delta_crl_distribution_points": "http://localhost/v1/pki-1/crl/delta",
+				"ocsp_servers":                  "http://localhost/v1/pki-1/ocsp",
+			})
+			requireSuccessNonNilResponse(t, resp, err, "failed setting up issuer")
 
-		// 1. Setup root issuer.
-		resp, err := CBWrite(b, s, "root/generate/internal", map[string]interface{}{
-			"common_name": "Vault Root CA",
-			"key_type":    "ec",
-			"ttl":         "7200h",
-			"issuer_name": "root",
-		})
-		requireSuccessNonNilResponse(t, resp, err, "failed generating root issuer")
-		id := string(resp.Data["issuer_id"].(issuing.IssuerID))
+			// 4. Read the issuer before.
+			resp, err = CBRead(b, s, "issuer/default")
+			requireSuccessNonNilResponse(t, resp, err, "failed reading root issuer before")
+			require.Equal(t, testCase.Before, resp.Data[testCase.Field], "bad expectations")
 
-		// 2. Enable Cluster paths
-		resp, err = CBWrite(b, s, "config/urls", map[string]interface{}{
-			"path":     "https://localhost/v1/pki",
-			"aia_path": "http://localhost/v1/pki",
-		})
-		requireSuccessNonNilResponse(t, resp, err, "failed updating AIA config")
+			// 5. Perform modification.
+			resp, err = CBPatch(b, s, "issuer/default", map[string]interface{}{
+				testCase.Field: testCase.Patched,
+			})
+			requireSuccessNonNilResponse(t, resp, err, "failed patching root issuer")
 
-		// 3. Add AIA information
-		resp, err = CBPatch(b, s, "issuer/default", map[string]interface{}{
-			"issuing_certificates":    "http://localhost/v1/pki-1/ca",
-			"crl_distribution_points": "http://localhost/v1/pki-1/crl",
-			"ocsp_servers":            "http://localhost/v1/pki-1/ocsp",
-		})
-		requireSuccessNonNilResponse(t, resp, err, "failed setting up issuer")
+			if testCase.Field != "manual_chain" {
+				require.Equal(t, testCase.Patched, resp.Data[testCase.Field], "failed persisting value")
+			} else {
+				// self->id
+				require.Equal(t, []string{id}, resp.Data[testCase.Field], "failed persisting value")
+			}
 
-		// 4. Read the issuer before.
-		resp, err = CBRead(b, s, "issuer/default")
-		requireSuccessNonNilResponse(t, resp, err, "failed reading root issuer before")
-		require.Equal(t, testCase.Before, resp.Data[testCase.Field], "bad expectations")
+			// 6. Ensure it stuck
+			resp, err = CBRead(b, s, "issuer/default")
+			requireSuccessNonNilResponse(t, resp, err, "failed reading root issuer after")
 
-		// 5. Perform modification.
-		resp, err = CBPatch(b, s, "issuer/default", map[string]interface{}{
-			testCase.Field: testCase.Patched,
-		})
-		requireSuccessNonNilResponse(t, resp, err, "failed patching root issuer")
+			if testCase.Field != "manual_chain" {
+				require.Equal(t, testCase.Patched, resp.Data[testCase.Field])
+			} else {
+				// self->id
+				require.Equal(t, []string{id}, resp.Data[testCase.Field], "failed persisting value")
+			}
 
-		if testCase.Field != "manual_chain" {
-			require.Equal(t, testCase.Patched, resp.Data[testCase.Field], "failed persisting value")
-		} else {
-			// self->id
-			require.Equal(t, []string{id}, resp.Data[testCase.Field], "failed persisting value")
-		}
+			// 7. Patch it back
+			resp, err = CBPatch(b, s, "issuer/default", map[string]interface{}{
+				testCase.Field: testCase.Before,
+			})
+			requireSuccessNonNilResponse(t, resp, err, "failed patching root issuer")
 
-		// 6. Ensure it stuck
-		resp, err = CBRead(b, s, "issuer/default")
-		requireSuccessNonNilResponse(t, resp, err, "failed reading root issuer after")
+			require.Equal(t, testCase.Before, resp.Data[testCase.Field], "failed persisting value")
 
-		if testCase.Field != "manual_chain" {
-			require.Equal(t, testCase.Patched, resp.Data[testCase.Field])
-		} else {
-			// self->id
-			require.Equal(t, []string{id}, resp.Data[testCase.Field], "failed persisting value")
-		}
+			// 8. Ensure it stuck
+			resp, err = CBRead(b, s, "issuer/default")
+			requireSuccessNonNilResponse(t, resp, err, "failed reading root issuer after")
+
+			require.Equal(t, testCase.Before, resp.Data[testCase.Field])
+		})
 	}
 }
 
@@ -7136,10 +7367,11 @@ func TestGenerateRootCAWithAIA(t *testing.T) {
 	require.NoError(t, err, "failed to write AIA settings")
 
 	_, err = CBWrite(b_root, s_root, "config/urls", map[string]interface{}{
-		"crl_distribution_points": "{{cluster_path}}/issuer/{{issuer_id}}/crl/der",
-		"issuing_certificates":    "{{cluster_aia_path}}/issuer/{{issuer_id}}/der",
-		"ocsp_servers":            "{{cluster_path}}/ocsp",
-		"enable_templating":       true,
+		"crl_distribution_points":       "{{cluster_path}}/issuer/{{issuer_id}}/crl/der",
+		"delta_crl_distribution_points": "{{cluster_path}}/issuer/{{issuer_id}}/crl/delta/der",
+		"issuing_certificates":          "{{cluster_aia_path}}/issuer/{{issuer_id}}/der",
+		"ocsp_servers":                  "{{cluster_path}}/ocsp",
+		"enable_templating":             true,
 	})
 	require.NoError(t, err, "failed to write AIA settings")
 
@@ -7151,6 +7383,187 @@ func TestGenerateRootCAWithAIA(t *testing.T) {
 	requireSuccessNonNilResponse(t, resp, err, "expected root generation to succeed")
 }
 
+// TestIssuance_AlwaysEnforceErr validates that we properly return an error in all request
+// types that go beyond the issuer's NotAfter
+func TestIssuance_AlwaysEnforceErr(t *testing.T) {
+	t.Parallel()
+	b, s := CreateBackendWithStorage(t)
+
+	resp, err := CBWrite(b, s, "root/generate/internal", map[string]interface{}{
+		"common_name": "root myvault.com",
+		"key_type":    "ec",
+		"ttl":         "10h",
+		"issuer_name": "root-ca",
+		"key_name":    "root-key",
+	})
+	requireSuccessNonNilResponse(t, resp, err, "expected root generation to succeed")
+
+	resp, err = CBPatch(b, s, "issuer/root-ca", map[string]interface{}{
+		"leaf_not_after_behavior": "always_enforce_err",
+	})
+	requireSuccessNonNilResponse(t, resp, err, "failed updating root issuer with always_enforce_err")
+
+	resp, err = CBWrite(b, s, "roles/test-role", map[string]interface{}{
+		"allow_any_name":         true,
+		"key_type":               "ec",
+		"allowed_serial_numbers": "*",
+	})
+
+	expectedErrContains := "cannot satisfy request, as TTL would result in notAfter"
+
+	// Make sure we fail on CA issuance requests now
+	t.Run("ca-issuance", func(t *testing.T) {
+		resp, err = CBWrite(b, s, "intermediate/generate/internal", map[string]interface{}{
+			"common_name": "myint.com",
+		})
+		requireSuccessNonNilResponse(t, resp, err, "failed generating intermediary CSR")
+		requireFieldsSetInResp(t, resp, "csr")
+		csr := resp.Data["csr"]
+
+		_, err = CBWrite(b, s, "issuer/root-ca/sign-intermediate", map[string]interface{}{
+			"csr":            csr,
+			"use_csr_values": true,
+			"ttl":            "60h",
+		})
+		require.ErrorContains(t, err, expectedErrContains, "sign-intermediate should have failed as root issuer leaf behavior is set to always_enforce_err")
+
+		// Make sure it works if we are under
+		resp, err = CBWrite(b, s, "issuer/root-ca/sign-intermediate", map[string]interface{}{
+			"csr":            csr,
+			"use_csr_values": true,
+			"ttl":            "30m",
+		})
+		requireSuccessNonNilResponse(t, resp, err, "sign-intermediate should have passed with a lower TTL value and always_enforce_err")
+	})
+
+	// Make sure we fail on leaf csr signing leaf as we always did for 'err'
+	t.Run("sign-leaf-csr", func(t *testing.T) {
+		_, csrPem := generateTestCsr(t, certutil.ECPrivateKey, 256)
+
+		resp, err = CBWrite(b, s, "issuer/root-ca/sign/test-role", map[string]interface{}{
+			"ttl": "60h",
+			"csr": csrPem,
+		})
+		require.ErrorContains(t, err, expectedErrContains, "expected error from sign csr got: %v", resp)
+
+		// Make sure it works if we are under
+		resp, err = CBWrite(b, s, "issuer/root-ca/sign/test-role", map[string]interface{}{
+			"ttl": "30m",
+			"csr": csrPem,
+		})
+		requireSuccessNonNilResponse(t, resp, err, "sign should have succeeded with a lower TTL and always_enforce_err")
+	})
+
+	// Make sure we fail on leaf csr signing leaf as we always did for 'err'
+	t.Run("issue-leaf-csr", func(t *testing.T) {
+		resp, err = CBWrite(b, s, "issuer/root-ca/issue/test-role", map[string]interface{}{
+			"ttl":         "60h",
+			"common_name": "leaf.example.com",
+		})
+		require.ErrorContains(t, err, expectedErrContains, "expected error from issue got: %v", resp)
+
+		// Make sure it works if we are under
+		resp, err = CBWrite(b, s, "issuer/root-ca/issue/test-role", map[string]interface{}{
+			"ttl":         "30m",
+			"common_name": "leaf.example.com",
+		})
+		requireSuccessNonNilResponse(t, resp, err, "issue should have worked with a lower TTL and always_enforce_err")
+	})
+}
+
+// TestIssuance_SignIntermediateKeyUsages tests the field "key_usage" both when directly generating a root certificate,
+// and when signing a CA CSR.  In particular, this test verifies that:
+// - the key usage DigitalSignature is added if present
+// - non-existent or invalid key usages return a warning, but are ignored by certificate generation
+// - CertSign and CRLSign are ignored
+func TestIssuance_SignIntermediateKeyUsages(t *testing.T) {
+	t.Parallel()
+	b, s := CreateBackendWithStorage(t)
+
+	resp, err := CBWrite(b, s, "root/generate/internal", map[string]interface{}{
+		"common_name": "root myvault.com",
+		"key_type":    "ec",
+		"ttl":         "10h",
+		"issuer_name": "root-ca",
+		"key_name":    "root-key",
+		"key_usage":   "DigitalSignature,DogPetting",
+	})
+	requireSuccessNonNilResponse(t, resp, err, "expected root generation to succeed")
+	require.Contains(t, resp.Warnings, "Invalid key usage will be ignored: unrecognized key usage DogPetting")
+	rootCertRaw := resp.Data["certificate"]
+	rootCert := parseCert(t, rootCertRaw.(string))
+	require.Equal(t, x509.KeyUsageDigitalSignature, rootCert.KeyUsage&x509.KeyUsageDigitalSignature, "keyUsage Digital Signature was not present")
+	require.Equal(t, x509.KeyUsageCertSign, rootCert.KeyUsage&x509.KeyUsageCertSign, "keyUsage CertSign was not present")
+	require.Equal(t, x509.KeyUsageCRLSign, rootCert.KeyUsage&x509.KeyUsageCRLSign, "keyUsage CRLSign was not present")
+	require.Equal(t, x509.KeyUsageDigitalSignature|x509.KeyUsageCertSign|x509.KeyUsageCRLSign, rootCert.KeyUsage, "unexpected KeyUsage present")
+	resp, err = CBWrite(b, s, "intermediate/generate/internal", map[string]interface{}{
+		"common_name": "myint.com",
+	})
+	requireSuccessNonNilResponse(t, resp, err, "failed generating intermediary CSR")
+	requireFieldsSetInResp(t, resp, "csr")
+	csr := resp.Data["csr"]
+
+	resp, err = CBWrite(b, s, "issuer/root-ca/sign-intermediate", map[string]interface{}{
+		"csr":       csr,
+		"key_usage": "CRLSign,CertSign,DigitalSignature,KeyEncipherment,KeyAgreement",
+		"ttl":       "60h",
+	})
+	requireSuccessNonNilResponse(t, resp, err, "expected intermediate signing to succeed")
+	require.Contains(t, resp.Warnings, "Invalid key usage: key usage KeyEncipherment is only valid for non-Ca certs; key usage KeyAgreement is only valid for non-Ca certs")
+	intCertRaw := resp.Data["certificate"]
+	intCert := parseCert(t, intCertRaw.(string))
+	require.Equal(t, x509.KeyUsageDigitalSignature, intCert.KeyUsage&x509.KeyUsageDigitalSignature, "keyUsage Digital Signature was not present")
+	require.Equal(t, x509.KeyUsageCertSign, intCert.KeyUsage&x509.KeyUsageCertSign, "keyUsage CertSign was not present")
+	require.Equal(t, x509.KeyUsageCRLSign, intCert.KeyUsage&x509.KeyUsageCRLSign, "keyUsage CRLSign was not present")
+	require.Equal(t, x509.KeyUsageDigitalSignature|x509.KeyUsageCertSign|x509.KeyUsageCRLSign, intCert.KeyUsage, "unexpected KeyUsage present on intermediate certificate")
+}
+
+func TestIssuance_DeltaCRLDistributionPoint(t *testing.T) {
+	t.Parallel()
+	b, s := CreateBackendWithStorage(t)
+
+	// Set up the Mount-Level AIA information
+	resp, err := CBWrite(b, s, "config/urls", map[string]interface{}{
+		"delta_crl_distribution_points": []string{"http://example.com/crl/delta", "http://backup.example.com/crl/delta"},
+	})
+	requireSuccessNonNilResponse(t, resp, err, "expected setting mount-level DeltaCRLDistributionPoints to succeed")
+	require.Contains(t, resp.Warnings, "delta_crl_distribution_points were set: http://example.com/crl/delta, http://backup.example.com/crl/delta but not crl_distribution_points, consider setting crl_distribution_points")
+
+	// Create a (Root) Certificate with this AIA information
+	resp, err = CBWrite(b, s, "root/generate/internal", map[string]interface{}{
+		"common_name": "root myvault.com",
+		"key_type":    "ec",
+		"ttl":         "10h",
+		"issuer_name": "root-ca",
+		"key_name":    "root-key",
+	})
+	requireSuccessNonNilResponse(t, resp, err, "expected root generation to succeed")
+	require.NotNil(t, resp.Data, "expected response to have body")
+	require.NotNil(t, resp.Data["certificate"], "expected response to contain generated certificate")
+
+	// Use openssl to check that the certificate created does have the expected Delta CRL Distribution Point Information
+	tmpDir := t.TempDir()
+	filePath := writeToTmpDir(t, tmpDir, "certificate.pem", resp.Data["certificate"].(string))
+
+	opensslCmd, output, found := findOpenSSL()
+	if !found {
+		t.Skipf("no appropriate OpenSSL version found")
+	}
+	log := corehelpers.NewTestLogger(t)
+	log.Info("Using OpenSSL", "path", opensslCmd, "version", output)
+
+	// The open ssl test:
+	args := []string{
+		"x509",
+		"-noout",
+		"-text",
+		"-in", filePath,
+	}
+	out, err := exec.Command(opensslCmd, args...).CombinedOutput()
+	require.NoError(t, err, "failed running command %s with args: %v\n%s", opensslCmd, args, string(out))
+	require.Regexp(t, `\s+X509v3 Freshest CRL:\s+Full Name:\s+URI:http://example.com/crl/delta\s+Full Name:\s+URI:http://backup\.example\.com/crl/delta`, string(out))
+}
+
 var (
 	initTest  sync.Once
 	rsaCAKey  string
diff --git a/builtin/logical/pki/ca_test.go b/builtin/logical/pki/ca_test.go
index 4517604f8a0..9cdeafca959 100644
--- a/builtin/logical/pki/ca_test.go
+++ b/builtin/logical/pki/ca_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -9,7 +9,6 @@ import (
 	"crypto/ed25519"
 	"crypto/elliptic"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/json"
@@ -24,6 +23,7 @@ import (
 	"github.com/hashicorp/vault/api"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 )
@@ -98,7 +98,7 @@ func TestBackend_CA_Steps(t *testing.T) {
 		}
 		ecCACert = strings.TrimSpace(string(pem.EncodeToMemory(caCertPEMBlock)))
 
-		rak, err := rsa.GenerateKey(rand.Reader, 2048)
+		rak, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 		if err != nil {
 			panic(err)
 		}
diff --git a/builtin/logical/pki/ca_util.go b/builtin/logical/pki/ca_util.go
index 6f2f005217b..cd421683fa2 100644
--- a/builtin/logical/pki/ca_util.go
+++ b/builtin/logical/pki/ca_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -72,6 +72,7 @@ func getGenerationParams(sc *storageContext, data *framework.FieldData) (exporte
 		PostalCode:                data.Get("postal_code").([]string),
 		NotBeforeDuration:         time.Duration(data.Get("not_before_duration").(int)) * time.Second,
 		CNValidations:             []string{"disabled"},
+		KeyUsage:                  data.Get("key_usage").([]string),
 	}
 	*role.AllowWildcardCertificates = true
 
@@ -84,14 +85,13 @@ func getGenerationParams(sc *storageContext, data *framework.FieldData) (exporte
 
 func generateCABundle(sc *storageContext, input *inputBundle, data *certutil.CreationBundle, randomSource io.Reader) (*certutil.ParsedCertBundle, error) {
 	ctx := sc.Context
-	b := sc.Backend
 
 	if kmsRequested(input) {
 		keyId, err := getManagedKeyId(input.apiData)
 		if err != nil {
 			return nil, err
 		}
-		return managed_key.GenerateManagedKeyCABundle(ctx, b, keyId, data, randomSource)
+		return managed_key.GenerateManagedKeyCABundle(ctx, sc.GetPkiManagedView(), keyId, data, randomSource)
 	}
 
 	if existingKeyRequested(input) {
@@ -110,7 +110,7 @@ func generateCABundle(sc *storageContext, input *inputBundle, data *certutil.Cre
 			if err != nil {
 				return nil, err
 			}
-			return managed_key.GenerateManagedKeyCABundle(ctx, b, keyId, data, randomSource)
+			return managed_key.GenerateManagedKeyCABundle(ctx, sc.GetPkiManagedView(), keyId, data, randomSource)
 		}
 
 		return certutil.CreateCertificateWithKeyGenerator(data, randomSource, existingKeyGeneratorFromBytes(keyEntry))
@@ -121,7 +121,6 @@ func generateCABundle(sc *storageContext, input *inputBundle, data *certutil.Cre
 
 func generateCSRBundle(sc *storageContext, input *inputBundle, data *certutil.CreationBundle, addBasicConstraints bool, randomSource io.Reader) (*certutil.ParsedCSRBundle, error) {
 	ctx := sc.Context
-	b := sc.Backend
 
 	if kmsRequested(input) {
 		keyId, err := getManagedKeyId(input.apiData)
@@ -129,7 +128,7 @@ func generateCSRBundle(sc *storageContext, input *inputBundle, data *certutil.Cr
 			return nil, err
 		}
 
-		return managed_key.GenerateManagedKeyCSRBundle(ctx, b, keyId, data, addBasicConstraints, randomSource)
+		return managed_key.GenerateManagedKeyCSRBundle(ctx, sc.GetPkiManagedView(), keyId, data, addBasicConstraints, randomSource)
 	}
 
 	if existingKeyRequested(input) {
@@ -148,7 +147,7 @@ func generateCSRBundle(sc *storageContext, input *inputBundle, data *certutil.Cr
 			if err != nil {
 				return nil, err
 			}
-			return managed_key.GenerateManagedKeyCSRBundle(ctx, b, keyId, data, addBasicConstraints, randomSource)
+			return managed_key.GenerateManagedKeyCSRBundle(ctx, sc.GetPkiManagedView(), keyId, data, addBasicConstraints, randomSource)
 		}
 
 		return certutil.CreateCSRWithKeyGenerator(data, addBasicConstraints, randomSource, existingKeyGeneratorFromBytes(key))
@@ -157,8 +156,8 @@ func generateCSRBundle(sc *storageContext, input *inputBundle, data *certutil.Cr
 	return certutil.CreateCSRWithRandomSource(data, addBasicConstraints, randomSource)
 }
 
-func parseCABundle(ctx context.Context, b *backend, bundle *certutil.CertBundle) (*certutil.ParsedCertBundle, error) {
-	return issuing.ParseCABundle(ctx, b, bundle)
+func parseCABundle(ctx context.Context, mkv managed_key.PkiManagedKeyView, bundle *certutil.CertBundle) (*certutil.ParsedCertBundle, error) {
+	return issuing.ParseCABundle(ctx, mkv, bundle)
 }
 
 func (sc *storageContext) getKeyTypeAndBitsForRole(data *framework.FieldData) (string, int, error) {
@@ -190,7 +189,7 @@ func (sc *storageContext) getKeyTypeAndBitsForRole(data *framework.FieldData) (s
 			return "", 0, errors.New("unable to determine managed key id: " + err.Error())
 		}
 
-		pubKeyManagedKey, err := managed_key.GetManagedKeyPublicKey(sc.Context, sc.Backend, keyId)
+		pubKeyManagedKey, err := managed_key.GetManagedKeyPublicKey(sc.Context, sc.GetPkiManagedView(), keyId)
 		if err != nil {
 			return "", 0, errors.New("failed to lookup public key from managed key: " + err.Error())
 		}
@@ -222,7 +221,7 @@ func (sc *storageContext) getExistingPublicKey(data *framework.FieldData) (crypt
 	if err != nil {
 		return nil, err
 	}
-	return getPublicKey(sc.Context, sc.Backend, key)
+	return getPublicKey(sc.Context, sc.GetPkiManagedView(), key)
 }
 
 func getKeyTypeAndBitsFromPublicKeyForRole(pubKey crypto.PublicKey) (certutil.PrivateKeyType, int, error) {
@@ -235,7 +234,7 @@ func getKeyTypeAndBitsFromPublicKeyForRole(pubKey crypto.PublicKey) (certutil.Pr
 		keyBits = certutil.GetPublicKeySize(pubKey)
 	case *ecdsa.PublicKey:
 		keyType = certutil.ECPrivateKey
-	case *ed25519.PublicKey:
+	case ed25519.PublicKey:
 		keyType = certutil.Ed25519PrivateKey
 	default:
 		return certutil.UnknownPrivateKey, 0, fmt.Errorf("unsupported public key: %#v", pubKey)
diff --git a/builtin/logical/pki/ca_util_test.go b/builtin/logical/pki/ca_util_test.go
new file mode 100644
index 00000000000..84215d45e09
--- /dev/null
+++ b/builtin/logical/pki/ca_util_test.go
@@ -0,0 +1,82 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package pki
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	"testing"
+
+	"github.com/hashicorp/vault/sdk/helper/certutil"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
+)
+
+func TestGetKeyTypeAndBitsFromPublicKeyForRole(t *testing.T) {
+	rsaKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("error generating rsa key: %s", err)
+	}
+
+	ecdsaKey, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	if err != nil {
+		t.Fatalf("error generating ecdsa key: %s", err)
+	}
+
+	publicKey, _, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("error generating ed25519 key: %s", err)
+	}
+
+	testCases := map[string]struct {
+		publicKey       crypto.PublicKey
+		expectedKeyType certutil.PrivateKeyType
+		expectedKeyBits int
+		expectError     bool
+	}{
+		"rsa": {
+			publicKey:       rsaKey.Public(),
+			expectedKeyType: certutil.RSAPrivateKey,
+			expectedKeyBits: 2048,
+		},
+		"ecdsa": {
+			publicKey:       ecdsaKey.Public(),
+			expectedKeyType: certutil.ECPrivateKey,
+			expectedKeyBits: 0,
+		},
+		"ed25519": {
+			publicKey:       publicKey,
+			expectedKeyType: certutil.Ed25519PrivateKey,
+			expectedKeyBits: 0,
+		},
+		"bad key type": {
+			publicKey:       []byte{},
+			expectedKeyType: certutil.UnknownPrivateKey,
+			expectedKeyBits: 0,
+			expectError:     true,
+		},
+	}
+
+	for name, tt := range testCases {
+		t.Run(name, func(t *testing.T) {
+			keyType, keyBits, err := getKeyTypeAndBitsFromPublicKeyForRole(tt.publicKey)
+			if err != nil && !tt.expectError {
+				t.Fatalf("unexpected error: %s", err)
+			}
+			if err == nil && tt.expectError {
+				t.Fatal("expected error, got nil")
+			}
+
+			if keyType != tt.expectedKeyType {
+				t.Fatalf("key type mismatch: expected %s, got %s", tt.expectedKeyType, keyType)
+			}
+
+			if keyBits != tt.expectedKeyBits {
+				t.Fatalf("key bits mismatch: expected %d, got %d", tt.expectedKeyBits, keyBits)
+			}
+		})
+	}
+}
diff --git a/builtin/logical/pki/cert_util.go b/builtin/logical/pki/cert_util.go
index fa0651fbb8b..d9bbb5670ce 100644
--- a/builtin/logical/pki/cert_util.go
+++ b/builtin/logical/pki/cert_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -22,6 +22,7 @@ import (
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
 	"github.com/hashicorp/vault/builtin/logical/pki/parsing"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
@@ -61,59 +62,10 @@ var (
 	endWildRegex       = labelRegex + `\*`
 	middleWildRegex    = labelRegex + `\*` + labelRegex
 	leftWildLabelRegex = regexp.MustCompile(`^(` + allWildRegex + `|` + startWildRegex + `|` + endWildRegex + `|` + middleWildRegex + `)$`)
-
-	// Cloned from https://github.com/golang/go/blob/82c713feb05da594567631972082af2fcba0ee4f/src/crypto/x509/x509.go#L327-L379
-	oidSignatureMD2WithRSA      = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 2}
-	oidSignatureMD5WithRSA      = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 4}
-	oidSignatureSHA1WithRSA     = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 5}
-	oidSignatureSHA256WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 11}
-	oidSignatureSHA384WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 12}
-	oidSignatureSHA512WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 13}
-	oidSignatureRSAPSS          = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 10}
-	oidSignatureDSAWithSHA1     = asn1.ObjectIdentifier{1, 2, 840, 10040, 4, 3}
-	oidSignatureDSAWithSHA256   = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 3, 2}
-	oidSignatureECDSAWithSHA1   = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 1}
-	oidSignatureECDSAWithSHA256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 2}
-	oidSignatureECDSAWithSHA384 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 3}
-	oidSignatureECDSAWithSHA512 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 4}
-	oidSignatureEd25519         = asn1.ObjectIdentifier{1, 3, 101, 112}
-	oidISOSignatureSHA1WithRSA  = asn1.ObjectIdentifier{1, 3, 14, 3, 2, 29}
-
-	signatureAlgorithmDetails = []struct {
-		algo       x509.SignatureAlgorithm
-		name       string
-		oid        asn1.ObjectIdentifier
-		pubKeyAlgo x509.PublicKeyAlgorithm
-		hash       crypto.Hash
-	}{
-		{x509.MD2WithRSA, "MD2-RSA", oidSignatureMD2WithRSA, x509.RSA, crypto.Hash(0) /* no value for MD2 */},
-		{x509.MD5WithRSA, "MD5-RSA", oidSignatureMD5WithRSA, x509.RSA, crypto.MD5},
-		{x509.SHA1WithRSA, "SHA1-RSA", oidSignatureSHA1WithRSA, x509.RSA, crypto.SHA1},
-		{x509.SHA1WithRSA, "SHA1-RSA", oidISOSignatureSHA1WithRSA, x509.RSA, crypto.SHA1},
-		{x509.SHA256WithRSA, "SHA256-RSA", oidSignatureSHA256WithRSA, x509.RSA, crypto.SHA256},
-		{x509.SHA384WithRSA, "SHA384-RSA", oidSignatureSHA384WithRSA, x509.RSA, crypto.SHA384},
-		{x509.SHA512WithRSA, "SHA512-RSA", oidSignatureSHA512WithRSA, x509.RSA, crypto.SHA512},
-		{x509.SHA256WithRSAPSS, "SHA256-RSAPSS", oidSignatureRSAPSS, x509.RSA, crypto.SHA256},
-		{x509.SHA384WithRSAPSS, "SHA384-RSAPSS", oidSignatureRSAPSS, x509.RSA, crypto.SHA384},
-		{x509.SHA512WithRSAPSS, "SHA512-RSAPSS", oidSignatureRSAPSS, x509.RSA, crypto.SHA512},
-		{x509.DSAWithSHA1, "DSA-SHA1", oidSignatureDSAWithSHA1, x509.DSA, crypto.SHA1},
-		{x509.DSAWithSHA256, "DSA-SHA256", oidSignatureDSAWithSHA256, x509.DSA, crypto.SHA256},
-		{x509.ECDSAWithSHA1, "ECDSA-SHA1", oidSignatureECDSAWithSHA1, x509.ECDSA, crypto.SHA1},
-		{x509.ECDSAWithSHA256, "ECDSA-SHA256", oidSignatureECDSAWithSHA256, x509.ECDSA, crypto.SHA256},
-		{x509.ECDSAWithSHA384, "ECDSA-SHA384", oidSignatureECDSAWithSHA384, x509.ECDSA, crypto.SHA384},
-		{x509.ECDSAWithSHA512, "ECDSA-SHA512", oidSignatureECDSAWithSHA512, x509.ECDSA, crypto.SHA512},
-		{x509.PureEd25519, "Ed25519", oidSignatureEd25519, x509.Ed25519, crypto.Hash(0) /* no pre-hashing */},
-	}
 )
 
 func doesPublicKeyAlgoMatchSignatureAlgo(pubKey x509.PublicKeyAlgorithm, algo x509.SignatureAlgorithm) bool {
-	for _, detail := range signatureAlgorithmDetails {
-		if detail.algo == algo {
-			return pubKey == detail.pubKeyAlgo
-		}
-	}
-
-	return false
+	return issuing.DoesPublicKeyAlgoMatchSignatureAlgo(pubKey, algo)
 }
 
 func getFormat(data *framework.FieldData) string {
@@ -139,9 +91,9 @@ func (sc *storageContext) fetchCAInfo(issuerRef string, usage issuing.IssuerUsag
 func (sc *storageContext) fetchCAInfoWithIssuer(issuerRef string, usage issuing.IssuerUsage) (*certutil.CAInfoBundle, issuing.IssuerID, error) {
 	var issuerId issuing.IssuerID
 
-	if sc.Backend.UseLegacyBundleCaStorage() {
+	if sc.UseLegacyBundleCaStorage() {
 		// We have not completed the migration so attempt to load the bundle from the legacy location
-		sc.Backend.Logger().Info("Using legacy CA bundle as PKI migration has not completed.")
+		sc.Logger().Info("Using legacy CA bundle as PKI migration has not completed.")
 		issuerId = legacyBundleShimID
 	} else {
 		var err error
@@ -163,24 +115,24 @@ func (sc *storageContext) fetchCAInfoWithIssuer(issuerRef string, usage issuing.
 // fetchCAInfoByIssuerId will fetch the CA info, will return an error if no ca info exists for the given issuerId.
 // This does support the loading using the legacyBundleShimID
 func (sc *storageContext) fetchCAInfoByIssuerId(issuerId issuing.IssuerID, usage issuing.IssuerUsage) (*certutil.CAInfoBundle, error) {
-	return issuing.FetchCAInfoByIssuerId(sc.Context, sc.Storage, sc.Backend, issuerId, usage)
+	return issuing.FetchCAInfoByIssuerId(sc.Context, sc.Storage, sc.GetPkiManagedView(), issuerId, usage)
 }
 
 func fetchCertBySerialBigInt(sc *storageContext, prefix string, serial *big.Int) (*logical.StorageEntry, error) {
 	return fetchCertBySerial(sc, prefix, serialFromBigInt(serial))
 }
 
-// Allows fetching certificates from the backend; it handles the slightly
+// fetchCertBySerial allows fetching certificates from the backend; it handles the slightly
 // separate pathing for CRL, and revoked certificates.
 //
 // Support for fetching CA certificates was removed, due to the new issuers
 // changes.
-func fetchCertBySerial(sc *storageContext, prefix, serial string) (*logical.StorageEntry, error) {
+func fetchCertBySerial(sc pki_backend.StorageContext, prefix, serial string) (*logical.StorageEntry, error) {
 	var path, legacyPath string
 	var err error
 	var certEntry *logical.StorageEntry
 
-	hyphenSerial := normalizeSerial(serial)
+	hyphenSerial := parsing.NormalizeSerialForStorage(serial)
 	colonSerial := strings.ReplaceAll(strings.ToLower(serial), "-", ":")
 
 	switch {
@@ -189,8 +141,8 @@ func fetchCertBySerial(sc *storageContext, prefix, serial string) (*logical.Stor
 	case strings.HasPrefix(prefix, "revoked/"):
 		legacyPath = "revoked/" + colonSerial
 		path = "revoked/" + hyphenSerial
-	case serial == legacyCRLPath || serial == deltaCRLPath || serial == unifiedCRLPath || serial == unifiedDeltaCRLPath:
-		warnings, err := sc.Backend.CrlBuilder().rebuildIfForced(sc)
+	case serial == issuing.LegacyCRLPath || serial == issuing.DeltaCRLPath || serial == issuing.UnifiedCRLPath || serial == issuing.UnifiedDeltaCRLPath:
+		warnings, err := sc.CrlBuilder().RebuildIfForced(sc)
 		if err != nil {
 			return nil, err
 		}
@@ -199,28 +151,28 @@ func fetchCertBySerial(sc *storageContext, prefix, serial string) (*logical.Stor
 			for index, warning := range warnings {
 				msg = fmt.Sprintf("%v\n %d. %v", msg, index+1, warning)
 			}
-			sc.Backend.Logger().Warn(msg)
+			sc.Logger().Warn(msg)
 		}
 
-		unified := serial == unifiedCRLPath || serial == unifiedDeltaCRLPath
-		path, err = sc.resolveIssuerCRLPath(defaultRef, unified)
+		unified := serial == issuing.UnifiedCRLPath || serial == issuing.UnifiedDeltaCRLPath
+		path, err = issuing.ResolveIssuerCRLPath(sc.GetContext(), sc.GetStorage(), sc.UseLegacyBundleCaStorage(), issuing.DefaultRef, unified)
 		if err != nil {
 			return nil, err
 		}
 
-		if serial == deltaCRLPath || serial == unifiedDeltaCRLPath {
-			if sc.Backend.UseLegacyBundleCaStorage() {
+		if serial == issuing.DeltaCRLPath || serial == issuing.UnifiedDeltaCRLPath {
+			if sc.UseLegacyBundleCaStorage() {
 				return nil, fmt.Errorf("refusing to serve delta CRL with legacy CA bundle")
 			}
 
-			path += deltaCRLPathSuffix
+			path += issuing.DeltaCRLPathSuffix
 		}
 	default:
-		legacyPath = "certs/" + colonSerial
-		path = "certs/" + hyphenSerial
+		legacyPath = issuing.PathCerts + colonSerial
+		path = issuing.PathCerts + hyphenSerial
 	}
 
-	certEntry, err = sc.Storage.Get(sc.Context, path)
+	certEntry, err = sc.GetStorage().Get(sc.GetContext(), path)
 	if err != nil {
 		return nil, errutil.InternalError{Err: fmt.Sprintf("error fetching certificate %s: %s", serial, err)}
 	}
@@ -240,7 +192,7 @@ func fetchCertBySerial(sc *storageContext, prefix, serial string) (*logical.Stor
 	// always manifest on Windows, and thus the initial check for a revoked
 	// cert fails would return an error when the cert isn't revoked, preventing
 	// the happy path from working.
-	certEntry, _ = sc.Storage.Get(sc.Context, legacyPath)
+	certEntry, _ = sc.GetStorage().Get(sc.GetContext(), legacyPath)
 	if certEntry == nil {
 		return nil, nil
 	}
@@ -250,12 +202,12 @@ func fetchCertBySerial(sc *storageContext, prefix, serial string) (*logical.Stor
 
 	// Update old-style paths to new-style paths
 	certEntry.Key = path
-	certCounter := sc.Backend.GetCertificateCounter()
+	certCounter := sc.GetCertificateCounter()
 	certsCounted := certCounter.IsInitialized()
-	if err = sc.Storage.Put(sc.Context, certEntry); err != nil {
-		return nil, errutil.InternalError{Err: fmt.Sprintf("error saving certificate with serial %s to new location", serial)}
+	if err = sc.GetStorage().Put(sc.GetContext(), certEntry); err != nil {
+		return nil, errutil.InternalError{Err: fmt.Sprintf("error saving certificate with serial %s to new location: %s", serial, err)}
 	}
-	if err = sc.Storage.Delete(sc.Context, legacyPath); err != nil {
+	if err = sc.GetStorage().Delete(sc.GetContext(), legacyPath); err != nil {
 		// If we fail here, we have an extra (copy) of a cert in storage, add to metrics:
 		switch {
 		case strings.HasPrefix(prefix, "revoked/"):
@@ -263,7 +215,7 @@ func fetchCertBySerial(sc *storageContext, prefix, serial string) (*logical.Stor
 		default:
 			certCounter.IncrementTotalCertificatesCount(certsCounted, path)
 		}
-		return nil, errutil.InternalError{Err: fmt.Sprintf("error deleting certificate with serial %s from old location", serial)}
+		return nil, errutil.InternalError{Err: fmt.Sprintf("error deleting certificate with serial %s from old location: %s", serial, err)}
 	}
 
 	return certEntry, nil
@@ -327,7 +279,6 @@ func generateCert(sc *storageContext,
 	randomSource io.Reader) (*certutil.ParsedCertBundle, []string, error,
 ) {
 	ctx := sc.Context
-	b := sc.Backend
 
 	if input.role == nil {
 		return nil, nil, errutil.InternalError{Err: "no role found in data bundle"}
@@ -337,7 +288,7 @@ func generateCert(sc *storageContext,
 		return nil, nil, errutil.UserError{Err: "RSA keys < 2048 bits are unsafe and not supported"}
 	}
 
-	data, warnings, err := generateCreationBundle(b, input, caSign, nil)
+	data, warnings, err := generateCreationBundle(sc.System(), input, caSign, nil)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -348,6 +299,19 @@ func generateCert(sc *storageContext,
 	if isCA {
 		data.Params.IsCA = isCA
 		data.Params.PermittedDNSDomains = input.apiData.Get("permitted_dns_domains").([]string)
+		data.Params.ExcludedDNSDomains = input.apiData.Get("excluded_dns_domains").([]string)
+		data.Params.PermittedIPRanges, err = convertIpRanges(input.apiData.Get("permitted_ip_ranges").([]string))
+		if err != nil {
+			return nil, nil, errutil.UserError{Err: fmt.Sprintf("invalid permitted_ip_ranges value: %s", err)}
+		}
+		data.Params.ExcludedIPRanges, err = convertIpRanges(input.apiData.Get("excluded_ip_ranges").([]string))
+		if err != nil {
+			return nil, nil, errutil.UserError{Err: fmt.Sprintf("invalid excluded_ip_ranges value: %s", err)}
+		}
+		data.Params.PermittedEmailAddresses = input.apiData.Get("permitted_email_addresses").([]string)
+		data.Params.ExcludedEmailAddresses = input.apiData.Get("excluded_email_addresses").([]string)
+		data.Params.PermittedURIDomains = input.apiData.Get("permitted_uri_domains").([]string)
+		data.Params.ExcludedURIDomains = input.apiData.Get("excluded_uri_domains").([]string)
 
 		if data.SigningBundle == nil {
 			// Generating a self-signed root certificate. Since we have no
@@ -399,10 +363,25 @@ func generateCert(sc *storageContext,
 	return parsedBundle, warnings, nil
 }
 
+// convertIpRanges parses each string in the input slice as an IP network. Input
+// strings are expected to be in the CIDR notation of IP address and prefix length
+// like "192.0.2.0/24" or "2001:db8::/32", as defined in RFC 4632 and RFC 4291.
+func convertIpRanges(ipRanges []string) ([]*net.IPNet, error) {
+	var ret []*net.IPNet
+	for _, ipRange := range ipRanges {
+		_, ipnet, err := net.ParseCIDR(ipRange)
+		if err != nil {
+			return nil, fmt.Errorf("error parsing IP range %q: %w", ipRange, err)
+		}
+		ret = append(ret, ipnet)
+	}
+	return ret, nil
+}
+
 // N.B.: This is only meant to be used for generating intermediate CAs.
 // It skips some sanity checks.
 func generateIntermediateCSR(sc *storageContext, input *inputBundle, randomSource io.Reader) (*certutil.ParsedCSRBundle, []string, error) {
-	creation, warnings, err := generateCreationBundle(sc.Backend, input, nil, nil)
+	creation, warnings, err := generateCreationBundle(sc.System(), input, nil, nil)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -410,6 +389,10 @@ func generateIntermediateCSR(sc *storageContext, input *inputBundle, randomSourc
 		return nil, nil, errutil.InternalError{Err: "nil parameters received from parameter bundle generation"}
 	}
 
+	_, exists := input.apiData.GetOk("key_usage")
+	if !exists {
+		creation.Params.KeyUsage = 0
+	}
 	addBasicConstraints := input.apiData != nil && input.apiData.Get("add_basic_constraints").(bool)
 	parsedBundle, err := generateCSRBundle(sc, input, creation, addBasicConstraints, randomSource)
 	if err != nil {
@@ -468,7 +451,39 @@ func (i SignCertInputFromDataFields) GetPermittedDomains() []string {
 	return i.data.Get("permitted_dns_domains").([]string)
 }
 
-func signCert(b *backend, data *inputBundle, caSign *certutil.CAInfoBundle, isCA bool, useCSRValues bool) (*certutil.ParsedCertBundle, []string, error) {
+func (i SignCertInputFromDataFields) GetExcludedDomains() []string {
+	return i.data.Get("excluded_dns_domains").([]string)
+}
+
+func (i SignCertInputFromDataFields) GetPermittedIpRanges() ([]*net.IPNet, error) {
+	return convertIpRanges(i.data.Get("permitted_ip_ranges").([]string))
+}
+
+func (i SignCertInputFromDataFields) GetExcludedIpRanges() ([]*net.IPNet, error) {
+	return convertIpRanges(i.data.Get("excluded_ip_ranges").([]string))
+}
+
+func (i SignCertInputFromDataFields) GetPermittedEmailAddresses() []string {
+	return i.data.Get("permitted_email_addresses").([]string)
+}
+
+func (i SignCertInputFromDataFields) GetExcludedEmailAddresses() []string {
+	return i.data.Get("excluded_email_addresses").([]string)
+}
+
+func (i SignCertInputFromDataFields) GetPermittedUriDomains() []string {
+	return i.data.Get("permitted_uri_domains").([]string)
+}
+
+func (i SignCertInputFromDataFields) GetExcludedUriDomains() []string {
+	return i.data.Get("excluded_uri_domains").([]string)
+}
+
+func (i SignCertInputFromDataFields) IgnoreCSRSignature() bool {
+	return false
+}
+
+func signCert(sysView logical.SystemView, data *inputBundle, caSign *certutil.CAInfoBundle, isCA bool, useCSRValues bool) (*certutil.ParsedCertBundle, []string, error) {
 	if data.role == nil {
 		return nil, nil, errutil.InternalError{Err: "no role found in data bundle"}
 	}
@@ -476,7 +491,7 @@ func signCert(b *backend, data *inputBundle, caSign *certutil.CAInfoBundle, isCA
 	entityInfo := issuing.NewEntityInfoFromReq(data.req)
 	signCertInput := NewSignCertInputFromDataFields(data.apiData, isCA, useCSRValues)
 
-	return issuing.SignCert(b.System(), data.role, entityInfo, caSign, signCertInput)
+	return issuing.SignCert(sysView, data.role, entityInfo, caSign, signCertInput)
 }
 
 func getOtherSANsFromX509Extensions(exts []pkix.Extension) ([]certutil.OtherNameUtf8, error) {
@@ -498,6 +513,10 @@ type CreationBundleInputFromFieldData struct {
 	data *framework.FieldData
 }
 
+func (cb CreationBundleInputFromFieldData) IgnoreCSRSignature() bool {
+	return false
+}
+
 func (cb CreationBundleInputFromFieldData) GetCommonName() string {
 	return cb.data.Get("common_name").(string)
 }
@@ -542,18 +561,18 @@ func (cb CreationBundleInputFromFieldData) GetUserIds() []string {
 // generateCreationBundle is a shared function that reads parameters supplied
 // from the various endpoints and generates a CreationParameters with the
 // parameters that can be used to issue or sign
-func generateCreationBundle(b *backend, data *inputBundle, caSign *certutil.CAInfoBundle, csr *x509.CertificateRequest) (*certutil.CreationBundle, []string, error) {
+func generateCreationBundle(sysView logical.SystemView, data *inputBundle, caSign *certutil.CAInfoBundle, csr *x509.CertificateRequest) (*certutil.CreationBundle, []string, error) {
 	entityInfo := issuing.NewEntityInfoFromReq(data.req)
 	creationBundleInput := NewCreationBundleInputFromFieldData(data.apiData)
 
-	return issuing.GenerateCreationBundle(b.System(), data.role, entityInfo, creationBundleInput, caSign, csr)
+	return issuing.GenerateCreationBundle(sysView, data.role, entityInfo, creationBundleInput, caSign, csr)
 }
 
 // getCertificateNotAfter compute a certificate's NotAfter date based on the mount ttl, role, signing bundle and input
 // api data being sent. Returns a NotAfter time, a set of warnings or an error.
-func getCertificateNotAfter(b *backend, data *inputBundle, caSign *certutil.CAInfoBundle) (time.Time, []string, error) {
+func getCertificateNotAfter(sysView logical.SystemView, data *inputBundle, caSign *certutil.CAInfoBundle) (time.Time, []string, error) {
 	input := NewCertNotAfterInputFromFieldData(data.apiData)
-	return issuing.GetCertificateNotAfter(b.System(), data.role, input, caSign)
+	return issuing.GetCertificateNotAfter(sysView, data.role, input, caSign)
 }
 
 // applyIssuerLeafNotAfterBehavior resets a certificate's notAfter time or errors out based on the
diff --git a/builtin/logical/pki/cert_util_test.go b/builtin/logical/pki/cert_util_test.go
index 28618dde68e..f7ac603210c 100644
--- a/builtin/logical/pki/cert_util_test.go
+++ b/builtin/logical/pki/cert_util_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"net"
 	"net/url"
+	"os"
 	"reflect"
 	"strings"
 	"testing"
@@ -21,6 +22,7 @@ import (
 	"github.com/hashicorp/vault/builtin/logical/pki/parsing"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
+	"github.com/hashicorp/vault/sdk/helper/testhelpers/schema"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/stretchr/testify/require"
 )
@@ -39,7 +41,7 @@ func TestPki_FetchCertBySerial(t *testing.T) {
 			&logical.Request{
 				Storage: storage,
 			},
-			"certs/",
+			issuing.PathCerts,
 			"00:00:00:00:00:00:00:00",
 		},
 		"revoked cert": {
@@ -125,7 +127,7 @@ func TestPki_MultipleOUs(t *testing.T) {
 			OU:     []string{"Z", "E", "V"},
 		},
 	}
-	cb, _, err := generateCreationBundle(b, input, nil, nil)
+	cb, _, err := generateCreationBundle(b.System(), input, nil, nil)
 	if err != nil {
 		t.Fatalf("Error: %v", err)
 	}
@@ -245,7 +247,7 @@ func TestPki_PermitFQDNs(t *testing.T) {
 		name := name
 		testCase := testCase
 		t.Run(name, func(t *testing.T) {
-			cb, _, err := generateCreationBundle(b, testCase.input, nil, nil)
+			cb, _, err := generateCreationBundle(b.System(), testCase.input, nil, nil)
 			if err != nil {
 				t.Fatalf("Error: %v", err)
 			}
@@ -266,13 +268,119 @@ func TestPki_PermitFQDNs(t *testing.T) {
 }
 
 type parseCertificateTestCase struct {
-	name       string
-	data       map[string]interface{}
-	roleData   map[string]interface{} // if a role is to be created
-	ttl        time.Duration
-	wantParams certutil.CreationParameters
-	wantFields map[string]interface{}
-	wantErr    bool
+	name            string
+	data            map[string]interface{}
+	roleData        map[string]interface{} // if a role is to be created
+	ttl             time.Duration
+	wantParams      certutil.CreationParameters
+	wantFields      map[string]interface{}
+	wantIssuanceErr string // If not empty, require.ErrorContains will be used on this string
+}
+
+// TestDisableVerifyCertificateEnvVar verifies that env var VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION
+// can be used to disable cert verification.
+func TestDisableVerifyCertificateEnvVar(t *testing.T) {
+	caData := map[string]any{
+		// Copied from the "full CA" test case of TestParseCertificate,
+		// with tweaked permitted_dns_domains and ttl
+		"common_name":           "the common name",
+		"alt_names":             "user@example.com,admin@example.com,example.com,www.example.com",
+		"ip_sans":               "1.2.3.4,1.2.3.5",
+		"uri_sans":              "https://example.com,https://www.example.com",
+		"other_sans":            "1.3.6.1.4.1.311.20.2.3;utf8:caadmin@example.com",
+		"ttl":                   "3h",
+		"max_path_length":       2,
+		"permitted_dns_domains": ".example.com,.www.example.com",
+		"ou":                    "unit1, unit2",
+		"organization":          "org1, org2",
+		"country":               "US, CA",
+		"locality":              "locality1, locality2",
+		"province":              "province1, province2",
+		"street_address":        "street_address1, street_address2",
+		"postal_code":           "postal_code1, postal_code2",
+		"not_before_duration":   "45s",
+		"key_type":              "rsa",
+		"use_pss":               true,
+		"key_bits":              2048,
+		"signature_bits":        384,
+	}
+
+	roleData := map[string]any{
+		"allow_any_name":      true,
+		"cn_validations":      "disabled",
+		"allow_ip_sans":       true,
+		"allowed_other_sans":  "1.3.6.1.4.1.311.20.2.3;utf8:*@example.com",
+		"allowed_uri_sans":    "https://example.com,https://www.example.com",
+		"allowed_user_ids":    "*",
+		"not_before_duration": "45s",
+		"signature_bits":      384,
+		"key_usage":           "KeyAgreement",
+		"ext_key_usage":       "ServerAuth",
+		"ext_key_usage_oids":  "1.3.6.1.5.5.7.3.67,1.3.6.1.5.5.7.3.68",
+		"client_flag":         false,
+		"server_flag":         false,
+		"policy_identifiers":  "1.2.3.4.5.6.7.8.9.0",
+	}
+
+	certData := map[string]any{
+		// using the same order as in https://developer.hashicorp.com/vault/api-docs/secret/pki#generate-certificate-and-key
+		"common_name": "the common name non ca",
+		"alt_names":   "user@example.com,admin@example.com,example.com,www.example.com",
+		"ip_sans":     "1.2.3.4,1.2.3.5",
+		"uri_sans":    "https://example.com,https://www.example.com",
+		"other_sans":  "1.3.6.1.4.1.311.20.2.3;utf8:caadmin@example.com",
+		"ttl":         "2h",
+		// format
+		// private_key_format
+		"exclude_cn_from_sans": true,
+		// not_after
+		// remove_roots_from_chain
+		"user_ids": "humanoid,robot",
+	}
+
+	defer func() {
+		os.Unsetenv("VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION")
+	}()
+
+	b, s := CreateBackendWithStorage(t)
+
+	// Create the CA
+	resp, err := CBWrite(b, s, "root/generate/internal", caData)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	// Create the role
+	resp, err = CBWrite(b, s, "roles/test", roleData)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	// Try to create the cert -- should fail verification, since example.com is not allowed
+	t.Run("no VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION env var", func(t *testing.T) {
+		resp, err = CBWrite(b, s, "issue/test", certData)
+		require.ErrorContains(t, err, `DNS name "example.com" is not permitted by any constraint`)
+	})
+
+	// Try to create the cert -- should fail verification, since example.com is not allowed
+	t.Run("VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION=false", func(t *testing.T) {
+		os.Setenv("VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION", "false")
+		resp, err = CBWrite(b, s, "issue/test", certData)
+		require.ErrorContains(t, err, `DNS name "example.com" is not permitted by any constraint`)
+	})
+
+	// Create the cert, should succeed with the disable env var set
+	t.Run("VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION=true", func(t *testing.T) {
+		os.Setenv("VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION", "true")
+		resp, err = CBWrite(b, s, "issue/test", certData)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+	})
+
+	// Invalid env var
+	t.Run("invalid VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION", func(t *testing.T) {
+		os.Setenv("VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION", "invalid")
+		resp, err = CBWrite(b, s, "issue/test", certData)
+		require.ErrorContains(t, err, "failed parsing environment variable VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION")
+	})
 }
 
 func TestParseCertificate(t *testing.T) {
@@ -280,12 +388,16 @@ func TestParseCertificate(t *testing.T) {
 
 	parseURL := func(s string) *url.URL {
 		u, err := url.Parse(s)
-		if err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, err)
 		return u
 	}
 
+	convertIps := func(ipRanges ...string) []*net.IPNet {
+		ret, err := convertIpRanges(ipRanges)
+		require.NoError(t, err)
+		return ret
+	}
+
 	tests := []*parseCertificateTestCase{
 		{
 			name: "simple CA",
@@ -327,56 +439,69 @@ func TestParseCertificate(t *testing.T) {
 				SKID:                          []byte("We'll assert that it is not nil as an special case"),
 			},
 			wantFields: map[string]interface{}{
-				"common_name":           "the common name",
-				"alt_names":             "",
-				"ip_sans":               "",
-				"uri_sans":              "",
-				"other_sans":            "",
-				"signature_bits":        384,
-				"exclude_cn_from_sans":  true,
-				"ou":                    "",
-				"organization":          "",
-				"country":               "",
-				"locality":              "",
-				"province":              "",
-				"street_address":        "",
-				"postal_code":           "",
-				"serial_number":         "",
-				"ttl":                   "1h0m30s",
-				"max_path_length":       -1,
-				"permitted_dns_domains": "",
-				"use_pss":               false,
-				"key_type":              "ec",
-				"key_bits":              384,
-				"skid":                  "We'll assert that it is not nil as an special case",
+				"common_name":               "the common name",
+				"alt_names":                 "",
+				"ip_sans":                   "",
+				"uri_sans":                  "",
+				"other_sans":                "",
+				"signature_bits":            384,
+				"exclude_cn_from_sans":      true,
+				"ou":                        "",
+				"organization":              "",
+				"country":                   "",
+				"locality":                  "",
+				"province":                  "",
+				"street_address":            "",
+				"postal_code":               "",
+				"serial_number":             "",
+				"ttl":                       "1h0m30s",
+				"max_path_length":           -1,
+				"permitted_dns_domains":     "",
+				"excluded_dns_domains":      "",
+				"permitted_ip_ranges":       "",
+				"excluded_ip_ranges":        "",
+				"permitted_email_addresses": "",
+				"excluded_email_addresses":  "",
+				"permitted_uri_domains":     "",
+				"excluded_uri_domains":      "",
+				"use_pss":                   false,
+				"key_type":                  "ec",
+				"key_bits":                  384,
+				"skid":                      "We'll assert that it is not nil as an special case",
 			},
-			wantErr: false,
 		},
 		{
 			// Note that this test's data is used to create the internal CA used by test "full non CA cert"
 			name: "full CA",
 			data: map[string]interface{}{
 				// using the same order as in https://developer.hashicorp.com/vault/api-docs/secret/pki#sign-certificate
-				"common_name":           "the common name",
-				"alt_names":             "user@example.com,admin@example.com,example.com,www.example.com",
-				"ip_sans":               "1.2.3.4,1.2.3.5",
-				"uri_sans":              "https://example.com,https://www.example.com",
-				"other_sans":            "1.3.6.1.4.1.311.20.2.3;utf8:caadmin@example.com",
-				"ttl":                   "2h",
-				"max_path_length":       2,
-				"permitted_dns_domains": ".example.com,.www.example.com",
-				"ou":                    "unit1, unit2",
-				"organization":          "org1, org2",
-				"country":               "US, CA",
-				"locality":              "locality1, locality2",
-				"province":              "province1, province2",
-				"street_address":        "street_address1, street_address2",
-				"postal_code":           "postal_code1, postal_code2",
-				"not_before_duration":   "45s",
-				"key_type":              "rsa",
-				"use_pss":               true,
-				"key_bits":              2048,
-				"signature_bits":        384,
+				"common_name":               "the common name",
+				"alt_names":                 "user@example.com,admin@example.com,example.com,www.example.com",
+				"ip_sans":                   "1.2.3.4,1.2.3.5",
+				"uri_sans":                  "https://example.com,https://www.example.com",
+				"other_sans":                "1.3.6.1.4.1.311.20.2.3;utf8:caadmin@example.com",
+				"ttl":                       "2h",
+				"max_path_length":           2,
+				"permitted_dns_domains":     "example.com,.example.com,.www.example.com",
+				"excluded_dns_domains":      "bad.example.com,reallybad.com",
+				"permitted_ip_ranges":       "192.0.2.1/24,76.76.21.21/24,2001:4860:4860::8889/32", // Note that while an IP address if specified here, it is the network address that will be stored
+				"excluded_ip_ranges":        "127.0.0.1/16,2001:4860:4860::8888/32",
+				"permitted_email_addresses": "info@example.com,user@example.com,admin@example.com",
+				"excluded_email_addresses":  "root@example.com,robots@example.com",
+				"permitted_uri_domains":     "example.com,www.example.com",
+				"excluded_uri_domains":      "ftp.example.com,gopher.www.example.com",
+				"ou":                        "unit1, unit2",
+				"organization":              "org1, org2",
+				"country":                   "US, CA",
+				"locality":                  "locality1, locality2",
+				"province":                  "province1, province2",
+				"street_address":            "street_address1, street_address2",
+				"postal_code":               "postal_code1, postal_code2",
+				"not_before_duration":       "45s",
+				"key_type":                  "rsa",
+				"use_pss":                   true,
+				"key_bits":                  2048,
+				"signature_bits":            384,
 				// TODO(kitography): Specify key usage
 			},
 			ttl: 2 * time.Hour,
@@ -409,37 +534,50 @@ func TestParseCertificate(t *testing.T) {
 				UsePSS:                        true,
 				ForceAppendCaChain:            false,
 				UseCSRValues:                  false,
-				PermittedDNSDomains:           []string{".example.com", ".www.example.com"},
+				PermittedDNSDomains:           []string{"example.com", ".example.com", ".www.example.com"},
+				ExcludedDNSDomains:            []string{"bad.example.com", "reallybad.com"},
+				PermittedIPRanges:             convertIps("192.0.2.0/24", "76.76.21.0/24", "2001:4860::/32"), // Note that we stored the network address rather than the specific IP address
+				ExcludedIPRanges:              convertIps("127.0.0.0/16", "2001:4860::/32"),
+				PermittedEmailAddresses:       []string{"info@example.com", "user@example.com", "admin@example.com"},
+				ExcludedEmailAddresses:        []string{"root@example.com", "robots@example.com"},
+				PermittedURIDomains:           []string{"example.com", "www.example.com"},
+				ExcludedURIDomains:            []string{"ftp.example.com", "gopher.www.example.com"},
 				URLs:                          nil,
 				MaxPathLength:                 2,
 				NotBeforeDuration:             45 * time.Second,
 				SKID:                          []byte("We'll assert that it is not nil as an special case"),
 			},
 			wantFields: map[string]interface{}{
-				"common_name":           "the common name",
-				"alt_names":             "example.com,www.example.com,admin@example.com,user@example.com",
-				"ip_sans":               "1.2.3.4,1.2.3.5",
-				"uri_sans":              "https://example.com,https://www.example.com",
-				"other_sans":            "1.3.6.1.4.1.311.20.2.3;UTF-8:caadmin@example.com",
-				"signature_bits":        384,
-				"exclude_cn_from_sans":  true,
-				"ou":                    "unit1,unit2",
-				"organization":          "org1,org2",
-				"country":               "CA,US",
-				"locality":              "locality1,locality2",
-				"province":              "province1,province2",
-				"street_address":        "street_address1,street_address2",
-				"postal_code":           "postal_code1,postal_code2",
-				"serial_number":         "",
-				"ttl":                   "2h0m45s",
-				"max_path_length":       2,
-				"permitted_dns_domains": ".example.com,.www.example.com",
-				"use_pss":               true,
-				"key_type":              "rsa",
-				"key_bits":              2048,
-				"skid":                  "We'll assert that it is not nil as an special case",
+				"common_name":               "the common name",
+				"alt_names":                 "example.com,www.example.com,admin@example.com,user@example.com",
+				"ip_sans":                   "1.2.3.4,1.2.3.5",
+				"uri_sans":                  "https://example.com,https://www.example.com",
+				"other_sans":                "1.3.6.1.4.1.311.20.2.3;UTF-8:caadmin@example.com",
+				"signature_bits":            384,
+				"exclude_cn_from_sans":      true,
+				"ou":                        "unit1,unit2",
+				"organization":              "org1,org2",
+				"country":                   "CA,US",
+				"locality":                  "locality1,locality2",
+				"province":                  "province1,province2",
+				"street_address":            "street_address1,street_address2",
+				"postal_code":               "postal_code1,postal_code2",
+				"serial_number":             "",
+				"ttl":                       "2h0m45s",
+				"max_path_length":           2,
+				"permitted_dns_domains":     "example.com,.example.com,.www.example.com",
+				"excluded_dns_domains":      "bad.example.com,reallybad.com",
+				"permitted_ip_ranges":       "192.0.2.0/24,76.76.21.0/24,2001:4860::/32",
+				"excluded_ip_ranges":        "127.0.0.0/16,2001:4860::/32",
+				"permitted_email_addresses": "info@example.com,user@example.com,admin@example.com",
+				"excluded_email_addresses":  "root@example.com,robots@example.com",
+				"permitted_uri_domains":     "example.com,www.example.com",
+				"excluded_uri_domains":      "ftp.example.com,gopher.www.example.com",
+				"use_pss":                   true,
+				"key_type":                  "rsa",
+				"key_bits":                  2048,
+				"skid":                      "We'll assert that it is not nil as an special case",
 			},
-			wantErr: false,
 		},
 		{
 			// Note that we use the data of test "full CA" to create the internal CA needed for this test
@@ -448,7 +586,7 @@ func TestParseCertificate(t *testing.T) {
 				// using the same order as in https://developer.hashicorp.com/vault/api-docs/secret/pki#generate-certificate-and-key
 				"common_name": "the common name non ca",
 				"alt_names":   "user@example.com,admin@example.com,example.com,www.example.com",
-				"ip_sans":     "1.2.3.4,1.2.3.5",
+				"ip_sans":     "192.0.2.1,192.0.2.2", // These must be permitted by the full CA
 				"uri_sans":    "https://example.com,https://www.example.com",
 				"other_sans":  "1.3.6.1.4.1.311.20.2.3;utf8:caadmin@example.com",
 				"ttl":         "2h",
@@ -482,7 +620,7 @@ func TestParseCertificate(t *testing.T) {
 				},
 				DNSNames:                      []string{"example.com", "www.example.com"},
 				EmailAddresses:                []string{"admin@example.com", "user@example.com"},
-				IPAddresses:                   []net.IP{[]byte{1, 2, 3, 4}, []byte{1, 2, 3, 5}},
+				IPAddresses:                   []net.IP{[]byte{192, 0, 2, 1}, []byte{192, 0, 2, 2}},
 				URIs:                          []*url.URL{parseURL("https://example.com"), parseURL("https://www.example.com")},
 				OtherSANs:                     map[string][]string{"1.3.6.1.4.1.311.20.2.3": {"caadmin@example.com"}},
 				IsCA:                          false,
@@ -505,76 +643,174 @@ func TestParseCertificate(t *testing.T) {
 				SKID:                          []byte("We'll assert that it is not nil as an special case"),
 			},
 			wantFields: map[string]interface{}{
-				"common_name":           "the common name non ca",
-				"alt_names":             "example.com,www.example.com,admin@example.com,user@example.com",
-				"ip_sans":               "1.2.3.4,1.2.3.5",
-				"uri_sans":              "https://example.com,https://www.example.com",
-				"other_sans":            "1.3.6.1.4.1.311.20.2.3;UTF-8:caadmin@example.com",
-				"signature_bits":        384,
-				"exclude_cn_from_sans":  true,
-				"ou":                    "",
-				"organization":          "",
-				"country":               "",
-				"locality":              "",
-				"province":              "",
-				"street_address":        "",
-				"postal_code":           "",
-				"serial_number":         "",
-				"ttl":                   "2h0m45s",
-				"max_path_length":       0,
-				"permitted_dns_domains": "",
-				"use_pss":               false,
-				"key_type":              "rsa",
-				"key_bits":              2048,
-				"skid":                  "We'll assert that it is not nil as an special case",
+				"common_name":               "the common name non ca",
+				"alt_names":                 "example.com,www.example.com,admin@example.com,user@example.com",
+				"ip_sans":                   "192.0.2.1,192.0.2.2",
+				"uri_sans":                  "https://example.com,https://www.example.com",
+				"other_sans":                "1.3.6.1.4.1.311.20.2.3;UTF-8:caadmin@example.com",
+				"signature_bits":            384,
+				"exclude_cn_from_sans":      true,
+				"ou":                        "",
+				"organization":              "",
+				"country":                   "",
+				"locality":                  "",
+				"province":                  "",
+				"street_address":            "",
+				"postal_code":               "",
+				"serial_number":             "",
+				"ttl":                       "2h0m45s",
+				"max_path_length":           0,
+				"permitted_dns_domains":     "",
+				"excluded_dns_domains":      "",
+				"permitted_ip_ranges":       "",
+				"excluded_ip_ranges":        "",
+				"permitted_email_addresses": "",
+				"excluded_email_addresses":  "",
+				"permitted_uri_domains":     "",
+				"excluded_uri_domains":      "",
+				"use_pss":                   false,
+				"key_type":                  "rsa",
+				"key_bits":                  2048,
+				"skid":                      "We'll assert that it is not nil as an special case",
+			},
+		},
+		{
+			name: "DNS domain not permitted",
+			data: map[string]interface{}{
+				"common_name": "the common name non ca",
+				"alt_names":   "badexample.com",
+				"ttl":         "2h",
+			},
+			ttl: 2 * time.Hour,
+			roleData: map[string]interface{}{
+				"allow_any_name": true,
+				"cn_validations": "disabled",
+			},
+			wantIssuanceErr: `DNS name "badexample.com" is not permitted by any constraint`,
+		},
+		{
+			name: "DNS domain explicitly excluded",
+			data: map[string]interface{}{
+				"common_name": "the common name non ca",
+				"alt_names":   "bad.example.com",
+				"ttl":         "2h",
 			},
-			wantErr: false,
+			ttl: 2 * time.Hour,
+			roleData: map[string]interface{}{
+				"allow_any_name": true,
+				"cn_validations": "disabled",
+			},
+			wantIssuanceErr: `DNS name "bad.example.com" is excluded by constraint "bad.example.com"`,
+		},
+		{
+			name: "IP address not permitted",
+			data: map[string]interface{}{
+				"common_name": "the common name non ca",
+				"ip_sans":     "192.0.3.1",
+				"ttl":         "2h",
+			},
+			ttl: 2 * time.Hour,
+			roleData: map[string]interface{}{
+				"allow_any_name": true,
+				"cn_validations": "disabled",
+			},
+			wantIssuanceErr: `IP address "192.0.3.1" is not permitted by any constraint`,
+		},
+		{
+			name: "IP address explicitly excluded",
+			data: map[string]interface{}{
+				"common_name": "the common name non ca",
+				"ip_sans":     "127.0.0.123",
+				"ttl":         "2h",
+			},
+			ttl: 2 * time.Hour,
+			roleData: map[string]interface{}{
+				"allow_any_name": true,
+				"cn_validations": "disabled",
+			},
+			wantIssuanceErr: `IP address "127.0.0.123" is excluded by constraint "127.0.0.0/16"`,
+		},
+		{
+			name: "email address not permitted",
+			data: map[string]interface{}{
+				"common_name": "the common name non ca",
+				"alt_names":   "random@example.com",
+				"ttl":         "2h",
+			},
+			ttl: 2 * time.Hour,
+			roleData: map[string]interface{}{
+				"allow_any_name": true,
+				"cn_validations": "disabled",
+			},
+			wantIssuanceErr: `email address "random@example.com" is not permitted by any constraint`,
+		},
+		{
+			name: "email address explicitly excluded",
+			data: map[string]interface{}{
+				"common_name": "the common name non ca",
+				"alt_names":   "root@example.com",
+				"ttl":         "2h",
+			},
+			ttl: 2 * time.Hour,
+			roleData: map[string]interface{}{
+				"allow_any_name": true,
+				"cn_validations": "disabled",
+			},
+			wantIssuanceErr: `email address "root@example.com" is excluded by constraint "root@example.com"`,
 		},
 	}
 	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			b, s := CreateBackendWithStorage(t)
 
-		b, s := CreateBackendWithStorage(t)
+			var cert *x509.Certificate
+			issueTime := time.Now()
+			if tt.wantParams.IsCA {
+				resp, err := CBWrite(b, s, "root/generate/internal", tt.data)
+				require.NoError(t, err)
+				require.NotNil(t, resp)
 
-		var cert *x509.Certificate
-		issueTime := time.Now()
-		if tt.wantParams.IsCA {
-			resp, err := CBWrite(b, s, "root/generate/internal", tt.data)
-			require.NoError(t, err)
-			require.NotNil(t, resp)
-
-			certData := resp.Data["certificate"].(string)
-			cert, err = parsing.ParseCertificateFromString(certData)
-			require.NoError(t, err)
-			require.NotNil(t, cert)
-		} else {
-			// use the "simple CA" data to create the internal CA
-			caData := tests[1].data
-			caData["ttl"] = "3h"
-			resp, err := CBWrite(b, s, "root/generate/internal", caData)
-			require.NoError(t, err)
-			require.NotNil(t, resp)
-
-			// create a role
-			resp, err = CBWrite(b, s, "roles/test", tt.roleData)
-			require.NoError(t, err)
-			require.NotNil(t, resp)
-
-			// create the cert
-			resp, err = CBWrite(b, s, "issue/test", tt.data)
-			require.NoError(t, err)
-			require.NotNil(t, resp)
-
-			certData := resp.Data["certificate"].(string)
-			cert, err = parsing.ParseCertificateFromString(certData)
-			require.NoError(t, err)
-			require.NotNil(t, cert)
-		}
+				certData := resp.Data["certificate"].(string)
+				cert, err = parsing.ParseCertificateFromString(certData)
+				require.NoError(t, err)
+				require.NotNil(t, cert)
+			} else {
+				// use the "simple CA" data to create the internal CA
+				caData := tests[1].data
+				caData["ttl"] = "3h"
+				resp, err := CBWrite(b, s, "root/generate/internal", caData)
+				require.NoError(t, err)
+				require.NotNil(t, resp)
 
-		t.Run(tt.name+" parameters", func(t *testing.T) {
-			testParseCertificateToCreationParameters(t, issueTime, tt, cert)
-		})
-		t.Run(tt.name+" fields", func(t *testing.T) {
-			testParseCertificateToFields(t, issueTime, tt, cert)
+				// create a role
+				resp, err = CBWrite(b, s, "roles/test", tt.roleData)
+				require.NoError(t, err)
+				require.NotNil(t, resp)
+
+				// create the cert
+				resp, err = CBWrite(b, s, "issue/test", tt.data)
+				if tt.wantIssuanceErr != "" {
+					require.ErrorContains(t, err, tt.wantIssuanceErr)
+				} else {
+					require.NoError(t, err)
+					require.NotNil(t, resp)
+
+					certData := resp.Data["certificate"].(string)
+					cert, err = parsing.ParseCertificateFromString(certData)
+					require.NoError(t, err)
+					require.NotNil(t, cert)
+				}
+			}
+
+			if tt.wantIssuanceErr != "" {
+				return
+			}
+			t.Run(tt.name+" parameters", func(t *testing.T) {
+				testParseCertificateToCreationParameters(t, issueTime, tt, cert)
+			})
+			t.Run(tt.name+" fields", func(t *testing.T) {
+				testParseCertificateToFields(t, issueTime, tt, cert)
+			})
 		})
 	}
 }
@@ -582,72 +818,64 @@ func TestParseCertificate(t *testing.T) {
 func testParseCertificateToCreationParameters(t *testing.T, issueTime time.Time, tt *parseCertificateTestCase, cert *x509.Certificate) {
 	params, err := certutil.ParseCertificateToCreationParameters(*cert)
 
-	if tt.wantErr {
-		require.Error(t, err)
-	} else {
-		require.NoError(t, err)
+	require.NoError(t, err)
 
-		ignoreBasicConstraintsValidForNonCA := tt.wantParams.IsCA
-
-		var diff []string
-		for _, d := range deep.Equal(tt.wantParams, params) {
-			switch {
-			case strings.HasPrefix(d, "SKID"):
-				continue
-			case strings.HasPrefix(d, "BasicConstraintsValidForNonCA") && ignoreBasicConstraintsValidForNonCA:
-				continue
-			case strings.HasPrefix(d, "NotBeforeDuration"):
-				continue
-			case strings.HasPrefix(d, "NotAfter"):
-				continue
-			}
-			diff = append(diff, d)
-		}
-		if diff != nil {
-			t.Errorf("testParseCertificateToCreationParameters() diff: %s", strings.Join(diff, "\n"))
+	ignoreBasicConstraintsValidForNonCA := tt.wantParams.IsCA
+
+	var diff []string
+	for _, d := range deep.Equal(tt.wantParams, params) {
+		switch {
+		case strings.HasPrefix(d, "SKID"):
+			continue
+		case strings.HasPrefix(d, "BasicConstraintsValidForNonCA") && ignoreBasicConstraintsValidForNonCA:
+			continue
+		case strings.HasPrefix(d, "NotBeforeDuration"):
+			continue
+		case strings.HasPrefix(d, "NotAfter"):
+			continue
 		}
+		diff = append(diff, d)
+	}
+	if diff != nil {
+		t.Errorf("testParseCertificateToCreationParameters() diff: %s", strings.Join(diff, "\n"))
+	}
 
-		require.NotNil(t, params.SKID)
-		require.GreaterOrEqual(t, params.NotBeforeDuration, tt.wantParams.NotBeforeDuration,
-			"NotBeforeDuration want: %s got: %s", tt.wantParams.NotBeforeDuration, params.NotBeforeDuration)
+	require.NotNil(t, params.SKID)
+	require.GreaterOrEqual(t, params.NotBeforeDuration, tt.wantParams.NotBeforeDuration,
+		"NotBeforeDuration want: %s got: %s", tt.wantParams.NotBeforeDuration, params.NotBeforeDuration)
 
-		require.GreaterOrEqual(t, params.NotAfter, issueTime.Add(tt.ttl).Add(-1*time.Minute),
-			"NotAfter want: %s got: %s", tt.wantParams.NotAfter, params.NotAfter)
-		require.LessOrEqual(t, params.NotAfter, issueTime.Add(tt.ttl).Add(1*time.Minute),
-			"NotAfter want: %s got: %s", tt.wantParams.NotAfter, params.NotAfter)
-	}
+	require.GreaterOrEqual(t, params.NotAfter, issueTime.Add(tt.ttl).Add(-1*time.Minute),
+		"NotAfter want: %s got: %s", tt.wantParams.NotAfter, params.NotAfter)
+	require.LessOrEqual(t, params.NotAfter, issueTime.Add(tt.ttl).Add(1*time.Minute),
+		"NotAfter want: %s got: %s", tt.wantParams.NotAfter, params.NotAfter)
 }
 
 func testParseCertificateToFields(t *testing.T, issueTime time.Time, tt *parseCertificateTestCase, cert *x509.Certificate) {
 	fields, err := certutil.ParseCertificateToFields(*cert)
-	if tt.wantErr {
-		require.Error(t, err)
-	} else {
-		require.NoError(t, err)
+	require.NoError(t, err)
 
-		require.NotNil(t, fields["skid"])
-		delete(fields, "skid")
-		delete(tt.wantFields, "skid")
+	require.NotNil(t, fields["skid"])
+	delete(fields, "skid")
+	delete(tt.wantFields, "skid")
 
-		{
-			// Sometimes TTL comes back as 1s off, so we'll allow that
-			expectedTTL, err := parseutil.ParseDurationSecond(tt.wantFields["ttl"].(string))
-			require.NoError(t, err)
-			actualTTL, err := parseutil.ParseDurationSecond(fields["ttl"].(string))
-			require.NoError(t, err)
-
-			diff := expectedTTL - actualTTL
-			require.LessOrEqual(t, actualTTL, expectedTTL, // NotAfter is generated before NotBefore so the time.Now of notBefore may be later, shrinking our calculated TTL during very slow tests
-				"ttl should be, if off, smaller than expected want: %s got: %s", tt.wantFields["ttl"], fields["ttl"])
-			require.LessOrEqual(t, diff, 30*time.Second, // Test can be slow, allow more off in the other direction
-				"ttl must be at most 30s off, want: %s got: %s", tt.wantFields["ttl"], fields["ttl"])
-			delete(fields, "ttl")
-			delete(tt.wantFields, "ttl")
-		}
+	{
+		// Sometimes TTL comes back as 1s off, so we'll allow that
+		expectedTTL, err := parseutil.ParseDurationSecond(tt.wantFields["ttl"].(string))
+		require.NoError(t, err)
+		actualTTL, err := parseutil.ParseDurationSecond(fields["ttl"].(string))
+		require.NoError(t, err)
 
-		if diff := deep.Equal(tt.wantFields, fields); diff != nil {
-			t.Errorf("testParseCertificateToFields() diff: %s", strings.ReplaceAll(strings.Join(diff, "\n"), "map", "\nmap"))
-		}
+		diff := expectedTTL - actualTTL
+		require.LessOrEqual(t, actualTTL, expectedTTL, // NotAfter is generated before NotBefore so the time.Now of notBefore may be later, shrinking our calculated TTL during very slow tests
+			"ttl should be, if off, smaller than expected want: %s got: %s", tt.wantFields["ttl"], fields["ttl"])
+		require.LessOrEqual(t, diff, 30*time.Second, // Test can be slow, allow more off in the other direction
+			"ttl must be at most 30s off, want: %s got: %s", tt.wantFields["ttl"], fields["ttl"])
+		delete(fields, "ttl")
+		delete(tt.wantFields, "ttl")
+	}
+
+	if diff := deep.Equal(tt.wantFields, fields); diff != nil {
+		t.Errorf("testParseCertificateToFields() diff: %s", strings.ReplaceAll(strings.Join(diff, "\n"), "map", "\nmap"))
 	}
 }
 
@@ -723,7 +951,6 @@ func TestParseCsr(t *testing.T) {
 				"serial_number":         "",
 				"add_basic_constraints": false,
 			},
-			wantErr: false,
 		},
 		{
 			name: "full CSR with basic constraints",
@@ -810,7 +1037,6 @@ func TestParseCsr(t *testing.T) {
 				"serial_number":         "37:60:16:e4:85:d5:96:38:3a:ed:31:06:8d:ed:7a:46:d4:22:63:d8",
 				"add_basic_constraints": true,
 			},
-			wantErr: false,
 		},
 		{
 			name: "full CSR without basic constraints",
@@ -897,7 +1123,6 @@ func TestParseCsr(t *testing.T) {
 				"serial_number":         "37:60:16:e4:85:d5:96:38:3a:ed:31:06:8d:ed:7a:46:d4:22:63:d8",
 				"add_basic_constraints": false,
 			},
-			wantErr: false,
 		},
 	}
 	for _, tt := range tests {
@@ -926,26 +1151,130 @@ func TestParseCsr(t *testing.T) {
 func testParseCsrToCreationParameters(t *testing.T, issueTime time.Time, tt *parseCertificateTestCase, csr *x509.CertificateRequest) {
 	params, err := certutil.ParseCsrToCreationParameters(*csr)
 
-	if tt.wantErr {
-		require.Error(t, err)
-	} else {
-		require.NoError(t, err)
+	require.NoError(t, err)
 
-		if diff := deep.Equal(tt.wantParams, params); diff != nil {
-			t.Errorf("testParseCertificateToCreationParameters() diff: %s", strings.ReplaceAll(strings.Join(diff, "\n"), "map", "\nmap"))
-		}
+	if diff := deep.Equal(tt.wantParams, params); diff != nil {
+		t.Errorf("testParseCertificateToCreationParameters() diff: %s", strings.ReplaceAll(strings.Join(diff, "\n"), "map", "\nmap"))
 	}
 }
 
 func testParseCsrToFields(t *testing.T, issueTime time.Time, tt *parseCertificateTestCase, csr *x509.CertificateRequest) {
 	fields, err := certutil.ParseCsrToFields(*csr)
-	if tt.wantErr {
-		require.Error(t, err)
-	} else {
+	require.NoError(t, err)
+
+	if diff := deep.Equal(tt.wantFields, fields); diff != nil {
+		t.Errorf("testParseCertificateToFields() diff: %s", strings.ReplaceAll(strings.Join(diff, "\n"), "map", "\nmap"))
+	}
+}
+
+// TestVerify_chained_name_constraints verifies that we perform name constraints certificate validation using the
+// entire CA chain.
+//
+// This test constructs a root CA that
+// - allows: .example.com
+// - excludes: bad.example.com
+//
+// and an intermediate that
+// - forbids alsobad.example.com
+//
+// It verifies that the intermediate
+// - can issue certs like good.example.com
+// - rejects names like notanexample.com since they are not in the namespace of names permitted by the root CA
+// - rejects bad.example.com, since the root CA excludes it
+// - rejects alsobad.example.com, since the intermediate CA excludes it.
+func TestVerify_chained_name_constraints(t *testing.T) {
+	t.Parallel()
+	bRoot, sRoot := CreateBackendWithStorage(t)
+
+	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+	// Setup
+
+	var bInt *backend
+	var sInt logical.Storage
+	{
+		resp, err := CBWrite(bRoot, sRoot, "root/generate/internal", map[string]interface{}{
+			"ttl":                   "40h",
+			"common_name":           "myvault.com",
+			"permitted_dns_domains": ".example.com,myint.com",
+			"excluded_dns_domains":  "bad.example.com",
+		})
 		require.NoError(t, err)
+		require.NotNil(t, resp)
 
-		if diff := deep.Equal(tt.wantFields, fields); diff != nil {
-			t.Errorf("testParseCertificateToFields() diff: %s", strings.ReplaceAll(strings.Join(diff, "\n"), "map", "\nmap"))
-		}
+		// Create the CSR
+		bInt, sInt = CreateBackendWithStorage(t)
+		resp, err = CBWrite(bInt, sInt, "intermediate/generate/internal", map[string]interface{}{
+			"common_name": "myint.com",
+		})
+		require.NoError(t, err)
+		schema.ValidateResponse(t, schema.GetResponseSchema(t, bRoot.Route("intermediate/generate/internal"), logical.UpdateOperation), resp, true)
+		csr := resp.Data["csr"]
+
+		// Sign the CSR
+		resp, err = CBWrite(bRoot, sRoot, "root/sign-intermediate", map[string]interface{}{
+			"common_name":          "myint.com",
+			"csr":                  csr,
+			"ttl":                  "60h",
+			"excluded_dns_domains": "alsobad.example.com",
+		})
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+
+		// Import the New Signed Certificate into the Intermediate Mount.
+		// Note that we append the root CA certificate to the signed intermediate, so that
+		// the entire chain is stored by set-signed.
+		resp, err = CBWrite(bInt, sInt, "intermediate/set-signed", map[string]interface{}{
+			"certificate": strings.Join(resp.Data["ca_chain"].([]string), "\n"),
+		})
+		require.NoError(t, err)
+
+		// Create a Role in the Intermediate Mount
+		resp, err = CBWrite(bInt, sInt, "roles/test", map[string]interface{}{
+			"allow_bare_domains": true,
+			"allow_subdomains":   true,
+			"allow_any_name":     true,
+		})
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+	}
+
+	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+	// Tests
+
+	testCases := []struct {
+		commonName string
+		wantError  string
+	}{
+		{
+			commonName: "good.example.com",
+		},
+		{
+			commonName: "notanexample.com",
+			wantError:  "should not be permitted by root CA",
+		},
+		{
+			commonName: "bad.example.com",
+			wantError:  "should be rejected by the root CA",
+		},
+		{
+			commonName: "alsobad.example.com",
+			wantError:  "should be rejected by the intermediate CA",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.commonName, func(t *testing.T) {
+			resp, err := CBWrite(bInt, sInt, "issue/test", map[string]any{
+				"common_name": tc.commonName,
+			})
+			if tc.wantError != "" {
+				require.Error(t, err, tc.wantError)
+				require.ErrorContains(t, err, "certificate is not authorized to sign for this name")
+				require.Nil(t, resp)
+			} else {
+				require.NoError(t, err)
+				require.NoError(t, resp.Error())
+			}
+		})
 	}
 }
diff --git a/builtin/logical/pki/chain_test.go b/builtin/logical/pki/chain_test.go
index 0dba2cd282e..dc3f05f397d 100644
--- a/builtin/logical/pki/chain_test.go
+++ b/builtin/logical/pki/chain_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/chain_util.go b/builtin/logical/pki/chain_util.go
index 594319f7ada..ffecf06b8c0 100644
--- a/builtin/logical/pki/chain_util.go
+++ b/builtin/logical/pki/chain_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -6,6 +6,7 @@ package pki
 import (
 	"bytes"
 	"crypto/x509"
+	"errors"
 	"fmt"
 	"sort"
 
@@ -439,7 +440,7 @@ func (sc *storageContext) rebuildIssuersChains(referenceCert *issuing.IssuerEntr
 		}
 	}
 	if len(msg) > 0 {
-		return fmt.Errorf(msg)
+		return errors.New(msg)
 	}
 
 	// Finally, write all issuers to disk.
diff --git a/builtin/logical/pki/cieps_util_oss.go b/builtin/logical/pki/cieps_util_oss.go
index 52524b9d4f5..b9a89e0099b 100644
--- a/builtin/logical/pki/cieps_util_oss.go
+++ b/builtin/logical/pki/cieps_util_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -20,6 +20,6 @@ func issueAcmeCertUsingCieps(_ *backend, _ *acmeContext, _ *logical.Request, _ *
 	return nil, "", fmt.Errorf("cieps is an enterprise only feature")
 }
 
-func getCiepsAcmeSettings(sc *storageContext, opts acmeWrapperOpts, config *acmeConfigEntry, data *framework.FieldData) (bool, string, error) {
+func getCiepsAcmeSettings(b *backend, sc *storageContext, opts acmeWrapperOpts, config *acmeConfigEntry, data *framework.FieldData) (bool, string, error) {
 	return false, "", nil
 }
diff --git a/builtin/logical/pki/cmd/pki/main.go b/builtin/logical/pki/cmd/pki/main.go
index 49bbe146e75..df37ce46ad8 100644
--- a/builtin/logical/pki/cmd/pki/main.go
+++ b/builtin/logical/pki/cmd/pki/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/logical/pki/cmpv2_util_oss.go b/builtin/logical/pki/cmpv2_util_oss.go
new file mode 100644
index 00000000000..679a7bb3a30
--- /dev/null
+++ b/builtin/logical/pki/cmpv2_util_oss.go
@@ -0,0 +1,16 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package pki
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+func (b *backend) doTidyCMPV2NonceStore(_ context.Context, _ logical.Storage) error {
+	return nil
+}
diff --git a/builtin/logical/pki/config_util.go b/builtin/logical/pki/config_util.go
index 87feab78cad..ed19f26fb9a 100644
--- a/builtin/logical/pki/config_util.go
+++ b/builtin/logical/pki/config_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/crl_test.go b/builtin/logical/pki/crl_test.go
index 28f38063adb..9c25c0c7cbb 100644
--- a/builtin/logical/pki/crl_test.go
+++ b/builtin/logical/pki/crl_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -15,6 +15,8 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
 	"github.com/hashicorp/vault/helper/constants"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/helper/testhelpers/schema"
@@ -61,10 +63,10 @@ func TestBackend_CRLConfigUpdate(t *testing.T) {
 
 	require.Equal(t, "24h", resp.Data["expiry"])
 	require.Equal(t, false, resp.Data["disable"])
-	require.Equal(t, defaultCrlConfig.OcspDisable, resp.Data["ocsp_disable"])
-	require.Equal(t, defaultCrlConfig.OcspExpiry, resp.Data["ocsp_expiry"])
-	require.Equal(t, defaultCrlConfig.AutoRebuild, resp.Data["auto_rebuild"])
-	require.Equal(t, defaultCrlConfig.AutoRebuildGracePeriod, resp.Data["auto_rebuild_grace_period"])
+	require.Equal(t, pki_backend.DefaultCrlConfig.OcspDisable, resp.Data["ocsp_disable"])
+	require.Equal(t, pki_backend.DefaultCrlConfig.OcspExpiry, resp.Data["ocsp_expiry"])
+	require.Equal(t, pki_backend.DefaultCrlConfig.AutoRebuild, resp.Data["auto_rebuild"])
+	require.Equal(t, pki_backend.DefaultCrlConfig.AutoRebuildGracePeriod, resp.Data["auto_rebuild_grace_period"])
 }
 
 func TestBackend_CRLConfig(t *testing.T) {
@@ -283,7 +285,7 @@ func crlEnableDisableTestForBackend(t *testing.T, b *backend, s logical.Storage,
 	}
 
 	serials := make(map[int]string)
-	for i := 0; i < 6; i++ {
+	for i := 0; i < 7; i++ {
 		resp, err := CBWrite(b, s, "issue/test", map[string]interface{}{
 			"common_name": "test.foobar.com",
 		})
@@ -321,11 +323,15 @@ func crlEnableDisableTestForBackend(t *testing.T, b *backend, s logical.Storage,
 		}
 	}
 
-	revoke := func(serialIndex int) {
+	revoke := func(serialIndex int, errorText ...string) {
 		_, err = CBWrite(b, s, "revoke", map[string]interface{}{
 			"serial_number": serials[serialIndex],
 		})
-		if err != nil {
+		if err != nil && len(errorText) == 1 {
+			if strings.Contains(err.Error(), errorText[0]) {
+				err = nil
+				return
+			}
 			t.Fatal(err)
 		}
 
@@ -375,6 +381,24 @@ func crlEnableDisableTestForBackend(t *testing.T, b *backend, s logical.Storage,
 
 	crlCreationTime2 := getParsedCrlFromBackend(t, b, s, "crl").TBSCertList.ThisUpdate
 	require.NotEqual(t, crlCreationTime1, crlCreationTime2)
+
+	// Set a limit, and test that it blocks building an over-large CRL
+	CBWrite(b, s, "config/crl", map[string]interface{}{
+		"max_crl_entries": 6,
+	})
+	revoke(6, "revocation list size (7) exceeds configured maximum (6)")
+	test(6)
+
+	_, err = CBRead(b, s, "crl/rotate")
+	require.Error(t, err)
+	require.True(t, strings.Contains(err.Error(), "revocation list size (7) exceeds configured maximum (6)"))
+
+	// Set unlimited, and try again
+	CBWrite(b, s, "config/crl", map[string]interface{}{
+		"max_crl_entries": -1,
+	})
+	_, err = CBRead(b, s, "crl/rotate")
+	require.NoError(t, err)
 }
 
 func TestBackend_Secondary_CRL_Rebuilding(t *testing.T) {
@@ -416,7 +440,7 @@ func TestCrlRebuilder(t *testing.T) {
 	cb := newCRLBuilder(true /* can rebuild and write CRLs */)
 
 	// Force an initial build
-	warnings, err := cb.rebuild(sc, true)
+	warnings, err := cb.Rebuild(sc, true)
 	require.NoError(t, err, "Failed to rebuild CRL")
 	require.Empty(t, warnings, "unexpectedly got warnings rebuilding CRL")
 
@@ -424,7 +448,7 @@ func TestCrlRebuilder(t *testing.T) {
 	crl1 := parseCrlPemBytes(t, resp.Data["http_raw_body"].([]byte))
 
 	// We shouldn't rebuild within this call.
-	warnings, err = cb.rebuildIfForced(sc)
+	warnings, err = cb.RebuildIfForced(sc)
 	require.NoError(t, err, "Failed to rebuild if forced CRL")
 	require.Empty(t, warnings, "unexpectedly got warnings rebuilding CRL")
 
@@ -443,7 +467,7 @@ func TestCrlRebuilder(t *testing.T) {
 
 	// This should rebuild the CRL
 	cb.requestRebuildIfActiveNode(b)
-	warnings, err = cb.rebuildIfForced(sc)
+	warnings, err = cb.RebuildIfForced(sc)
 	require.NoError(t, err, "Failed to rebuild if forced CRL")
 	require.Empty(t, warnings, "unexpectedly got warnings rebuilding CRL")
 	resp = requestCrlFromBackend(t, s, b)
@@ -974,13 +998,13 @@ func TestAutoRebuild(t *testing.T) {
 	require.NoError(t, err)
 	require.NotNil(t, resp)
 	require.NotNil(t, resp.Data)
-	require.Equal(t, resp.Data["expiry"], defaultCrlConfig.Expiry)
-	require.Equal(t, resp.Data["disable"], defaultCrlConfig.Disable)
-	require.Equal(t, resp.Data["ocsp_disable"], defaultCrlConfig.OcspDisable)
-	require.Equal(t, resp.Data["auto_rebuild"], defaultCrlConfig.AutoRebuild)
-	require.Equal(t, resp.Data["auto_rebuild_grace_period"], defaultCrlConfig.AutoRebuildGracePeriod)
-	require.Equal(t, resp.Data["enable_delta"], defaultCrlConfig.EnableDelta)
-	require.Equal(t, resp.Data["delta_rebuild_interval"], defaultCrlConfig.DeltaRebuildInterval)
+	require.Equal(t, resp.Data["expiry"], pki_backend.DefaultCrlConfig.Expiry)
+	require.Equal(t, resp.Data["disable"], pki_backend.DefaultCrlConfig.Disable)
+	require.Equal(t, resp.Data["ocsp_disable"], pki_backend.DefaultCrlConfig.OcspDisable)
+	require.Equal(t, resp.Data["auto_rebuild"], pki_backend.DefaultCrlConfig.AutoRebuild)
+	require.Equal(t, resp.Data["auto_rebuild_grace_period"], pki_backend.DefaultCrlConfig.AutoRebuildGracePeriod)
+	require.Equal(t, resp.Data["enable_delta"], pki_backend.DefaultCrlConfig.EnableDelta)
+	require.Equal(t, resp.Data["delta_rebuild_interval"], pki_backend.DefaultCrlConfig.DeltaRebuildInterval)
 
 	// Safety guard: we play with rebuild timing below.
 	_, err = client.Logical().Write("pki/config/crl", map[string]interface{}{
@@ -1059,7 +1083,7 @@ func TestAutoRebuild(t *testing.T) {
 	require.NotNil(t, resp.Data)
 	require.NotEmpty(t, resp.Data["value"])
 	revEntryValue := resp.Data["value"].(string)
-	var revInfo revocationInfo
+	var revInfo revocation.RevocationInfo
 	err = json.Unmarshal([]byte(revEntryValue), &revInfo)
 	require.NoError(t, err)
 	require.Equal(t, revInfo.CertificateIssuer, issuing.IssuerID(rootIssuer))
@@ -1232,7 +1256,7 @@ func TestTidyIssuerAssociation(t *testing.T) {
 	require.NotNil(t, entry)
 	require.NotNil(t, entry.Value)
 
-	var leafInfo revocationInfo
+	var leafInfo revocation.RevocationInfo
 	err = entry.DecodeJSON(&leafInfo)
 	require.NoError(t, err)
 	require.Equal(t, rootID, leafInfo.CertificateIssuer)
@@ -1473,7 +1497,7 @@ func TestCRLIssuerRemoval(t *testing.T) {
 
 	// List items in storage under both CRL paths so we know what is there in
 	// the "good" state.
-	crlList, err := s.List(ctx, "crls/")
+	crlList, err := s.List(ctx, issuing.PathCrls)
 	require.NoError(t, err)
 	require.Contains(t, crlList, "config")
 	require.Greater(t, len(crlList), 1)
@@ -1511,7 +1535,7 @@ func TestCRLIssuerRemoval(t *testing.T) {
 	}
 
 	// Finally list storage entries again to ensure they are cleaned up.
-	afterCRLList, err := s.List(ctx, "crls/")
+	afterCRLList, err := s.List(ctx, issuing.PathCrls)
 	require.NoError(t, err)
 	for _, entry := range crlList {
 		require.Contains(t, afterCRLList, entry)
diff --git a/builtin/logical/pki/crl_util.go b/builtin/logical/pki/crl_util.go
index 78d6a5d7481..2426953c3e0 100644
--- a/builtin/logical/pki/crl_util.go
+++ b/builtin/logical/pki/crl_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -17,6 +17,9 @@ import (
 
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/parsing"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
@@ -24,7 +27,7 @@ import (
 )
 
 const (
-	revokedPath                      = "revoked/"
+	revokedPath                      = revocation.RevokedPath
 	crossRevocationPrefix            = "cross-revocation-queue/"
 	crossRevocationPath              = crossRevocationPrefix + "{{clusterId}}/"
 	deltaWALLastBuildSerialName      = "last-build-serial"
@@ -38,13 +41,6 @@ const (
 	unifiedDeltaWALLastRevokedSerial = unifiedDeltaWALPath + deltaWALLastRevokedSerialName
 )
 
-type revocationInfo struct {
-	CertificateBytes  []byte           `json:"certificate_bytes"`
-	RevocationTime    int64            `json:"revocation_time"`
-	RevocationTimeUTC time.Time        `json:"revocation_time_utc"`
-	CertificateIssuer issuing.IssuerID `json:"issuer_id"`
-}
-
 type revocationRequest struct {
 	RequestedAt time.Time `json:"requested_at"`
 }
@@ -97,7 +93,7 @@ type CrlBuilder struct {
 
 	_config               sync.RWMutex
 	dirty                 *atomic.Bool
-	config                crlConfig
+	config                pki_backend.CrlConfig
 	haveInitializedConfig bool
 
 	// Whether to invalidate our LastModifiedTime due to write on the
@@ -112,6 +108,8 @@ type CrlBuilder struct {
 	crossQueue           *revocationQueue
 }
 
+var _ pki_backend.CrlBuilderType = (*CrlBuilder)(nil)
+
 const (
 	_ignoreForceFlag  = true
 	_enforceForceFlag = false
@@ -126,7 +124,7 @@ func newCRLBuilder(canRebuild bool) *CrlBuilder {
 		// to stabilize.
 		lastDeltaRebuildCheck: time.Now(),
 		dirty:                 &atomic.Bool{},
-		config:                defaultCrlConfig,
+		config:                pki_backend.DefaultCrlConfig,
 		invalidate:            &atomic.Bool{},
 		haveInitializedQueue:  &atomic.Bool{},
 		revQueue:              newRevocationQueue(),
@@ -137,6 +135,14 @@ func newCRLBuilder(canRebuild bool) *CrlBuilder {
 	return builder
 }
 
+func (cb *CrlBuilder) SetLastDeltaRebuildCheckTime(t time.Time) {
+	cb.lastDeltaRebuildCheck = t
+}
+
+func (cb *CrlBuilder) ShouldInvalidate() bool {
+	return cb.invalidate.Load()
+}
+
 func (cb *CrlBuilder) markConfigDirty() {
 	cb.dirty.Store(true)
 }
@@ -163,7 +169,7 @@ func (cb *CrlBuilder) reloadConfigIfRequired(sc *storageContext) error {
 		if config != nil {
 			cb.config = *config
 		} else {
-			cb.config = defaultCrlConfig
+			cb.config = pki_backend.DefaultCrlConfig
 		}
 
 		// Updated the config; unset dirty.
@@ -174,7 +180,7 @@ func (cb *CrlBuilder) reloadConfigIfRequired(sc *storageContext) error {
 			triggerChangeNotification = false // do not trigger on the initial loading of configuration.
 		}
 
-		// Certain things need to be triggered on all server types when crlConfig is loaded.
+		// Certain things need to be triggered on all server types when CrlConfig is loaded.
 		if triggerChangeNotification {
 			cb.notifyOnConfigChange(sc, previousConfig, cb.config)
 		}
@@ -183,12 +189,12 @@ func (cb *CrlBuilder) reloadConfigIfRequired(sc *storageContext) error {
 	return nil
 }
 
-func (cb *CrlBuilder) notifyOnConfigChange(sc *storageContext, priorConfig crlConfig, newConfig crlConfig) {
+func (cb *CrlBuilder) notifyOnConfigChange(sc *storageContext, priorConfig pki_backend.CrlConfig, newConfig pki_backend.CrlConfig) {
 	// If you need to hook into a CRL configuration change across different server types
 	// such as primary clusters as well as performance replicas, it is easier to do here than
 	// in two places (API layer and in invalidateFunc)
 	if priorConfig.UnifiedCRL != newConfig.UnifiedCRL && newConfig.UnifiedCRL {
-		sc.Backend.GetUnifiedTransferStatus().forceRun()
+		sc.GetUnifiedTransferStatus().forceRun()
 	}
 
 	if priorConfig.UseGlobalQueue != newConfig.UseGlobalQueue && newConfig.UseGlobalQueue {
@@ -196,10 +202,10 @@ func (cb *CrlBuilder) notifyOnConfigChange(sc *storageContext, priorConfig crlCo
 	}
 }
 
-func (cb *CrlBuilder) getConfigWithUpdate(sc *storageContext) (*crlConfig, error) {
+func (cb *CrlBuilder) GetConfigWithUpdate(sc pki_backend.StorageContext) (*pki_backend.CrlConfig, error) {
 	// Config may mutate immediately after accessing, but will be freshly
 	// fetched if necessary.
-	if err := cb.reloadConfigIfRequired(sc); err != nil {
+	if err := cb.reloadConfigIfRequired(sc.(*storageContext)); err != nil {
 		return nil, err
 	}
 
@@ -210,12 +216,12 @@ func (cb *CrlBuilder) getConfigWithUpdate(sc *storageContext) (*crlConfig, error
 	return &configCopy, nil
 }
 
-func (cb *CrlBuilder) getConfigWithForcedUpdate(sc *storageContext) (*crlConfig, error) {
+func (cb *CrlBuilder) getConfigWithForcedUpdate(sc *storageContext) (*pki_backend.CrlConfig, error) {
 	cb.markConfigDirty()
-	return cb.getConfigWithUpdate(sc)
+	return cb.GetConfigWithUpdate(sc)
 }
 
-func (cb *CrlBuilder) writeConfig(sc *storageContext, config *crlConfig) (*crlConfig, error) {
+func (cb *CrlBuilder) writeConfig(sc *storageContext, config *pki_backend.CrlConfig) (*pki_backend.CrlConfig, error) {
 	cb._config.Lock()
 	defer cb._config.Unlock()
 
@@ -228,7 +234,7 @@ func (cb *CrlBuilder) writeConfig(sc *storageContext, config *crlConfig) (*crlCo
 	if config != nil {
 		cb.config = *config
 	} else {
-		cb.config = defaultCrlConfig
+		cb.config = pki_backend.DefaultCrlConfig
 	}
 
 	triggerChangeNotification := true
@@ -237,7 +243,7 @@ func (cb *CrlBuilder) writeConfig(sc *storageContext, config *crlConfig) (*crlCo
 		triggerChangeNotification = false // do not trigger on the initial loading of configuration.
 	}
 
-	// Certain things need to be triggered on all server types when crlConfig is loaded.
+	// Certain things need to be triggered on all server types when CrlConfig is loaded.
 	if triggerChangeNotification {
 		cb.notifyOnConfigChange(sc, previousConfig, cb.config)
 	}
@@ -246,7 +252,7 @@ func (cb *CrlBuilder) writeConfig(sc *storageContext, config *crlConfig) (*crlCo
 }
 
 func (cb *CrlBuilder) checkForAutoRebuild(sc *storageContext) error {
-	cfg, err := cb.getConfigWithUpdate(sc)
+	cfg, err := cb.GetConfigWithUpdate(sc)
 	if err != nil {
 		return err
 	}
@@ -291,9 +297,9 @@ func (cb *CrlBuilder) checkForAutoRebuild(sc *storageContext) error {
 		// This may occur if the duration is empty; in that case
 		// assume the default. The default should be valid and shouldn't
 		// error.
-		defaultPeriod, defaultErr := parseutil.ParseDurationSecond(defaultCrlConfig.AutoRebuildGracePeriod)
+		defaultPeriod, defaultErr := parseutil.ParseDurationSecond(pki_backend.DefaultCrlConfig.AutoRebuildGracePeriod)
 		if defaultErr != nil {
-			return fmt.Errorf("error checking for auto-rebuild status: unable to parse duration from both config's grace period (%v) and default grace period (%v):\n- config: %v\n- default: %w\n", cfg.AutoRebuildGracePeriod, defaultCrlConfig.AutoRebuildGracePeriod, err, defaultErr)
+			return fmt.Errorf("error checking for auto-rebuild status: unable to parse duration from both config's grace period (%v) and default grace period (%v):\n- config: %v\n- default: %w\n", cfg.AutoRebuildGracePeriod, pki_backend.DefaultCrlConfig.AutoRebuildGracePeriod, err, defaultErr)
 		}
 
 		period = defaultPeriod
@@ -337,19 +343,19 @@ func (cb *CrlBuilder) flushCRLBuildTimeInvalidation(sc *storageContext) error {
 	return nil
 }
 
-// rebuildIfForced is to be called by readers or periodic functions that might need to trigger
+// RebuildIfForced is to be called by readers or periodic functions that might need to trigger
 // a refresh of the CRL before the read occurs.
-func (cb *CrlBuilder) rebuildIfForced(sc *storageContext) ([]string, error) {
+func (cb *CrlBuilder) RebuildIfForced(sc pki_backend.StorageContext) ([]string, error) {
 	if cb.forceRebuild.Load() {
-		return cb._doRebuild(sc, true, _enforceForceFlag)
+		return cb._doRebuild(sc.(*storageContext), true, _enforceForceFlag)
 	}
 
 	return nil, nil
 }
 
 // rebuild is to be called by various write apis that know the CRL is to be updated and can be now.
-func (cb *CrlBuilder) rebuild(sc *storageContext, forceNew bool) ([]string, error) {
-	return cb._doRebuild(sc, forceNew, _ignoreForceFlag)
+func (cb *CrlBuilder) Rebuild(sc pki_backend.StorageContext, forceNew bool) ([]string, error) {
+	return cb._doRebuild(sc.(*storageContext), forceNew, _ignoreForceFlag)
 }
 
 // requestRebuildIfActiveNode will schedule a rebuild of the CRL from the next read or write api call assuming we are the active node of a cluster
@@ -387,9 +393,9 @@ func (cb *CrlBuilder) _doRebuild(sc *storageContext, forceNew bool, ignoreForceF
 	return nil, nil
 }
 
-func (cb *CrlBuilder) _getPresentDeltaWALForClearing(sc *storageContext, path string) ([]string, error) {
+func (cb *CrlBuilder) _getPresentDeltaWALForClearing(sc pki_backend.StorageContext, path string) ([]string, error) {
 	// Clearing of the delta WAL occurs after a new complete CRL has been built.
-	walSerials, err := sc.Storage.List(sc.Context, path)
+	walSerials, err := sc.GetStorage().List(sc.GetContext(), path)
 	if err != nil {
 		return nil, fmt.Errorf("error fetching list of delta WAL certificates to clear: %w", err)
 	}
@@ -400,12 +406,12 @@ func (cb *CrlBuilder) _getPresentDeltaWALForClearing(sc *storageContext, path st
 	return walSerials, nil
 }
 
-func (cb *CrlBuilder) getPresentLocalDeltaWALForClearing(sc *storageContext) ([]string, error) {
+func (cb *CrlBuilder) GetPresentLocalDeltaWALForClearing(sc pki_backend.StorageContext) ([]string, error) {
 	return cb._getPresentDeltaWALForClearing(sc, localDeltaWALPath)
 }
 
-func (cb *CrlBuilder) getPresentUnifiedDeltaWALForClearing(sc *storageContext) ([]string, error) {
-	walClusters, err := sc.Storage.List(sc.Context, unifiedDeltaWALPrefix)
+func (cb *CrlBuilder) GetPresentUnifiedDeltaWALForClearing(sc pki_backend.StorageContext) ([]string, error) {
+	walClusters, err := sc.GetStorage().List(sc.GetContext(), unifiedDeltaWALPrefix)
 	if err != nil {
 		return nil, fmt.Errorf("error fetching list of clusters with delta WAL entries: %w", err)
 	}
@@ -419,7 +425,7 @@ func (cb *CrlBuilder) getPresentUnifiedDeltaWALForClearing(sc *storageContext) (
 		}
 
 		// Here, we don't want to include the unifiedDeltaWALPrefix because
-		// clearUnifiedDeltaWAL handles that for us. Instead, just include
+		// ClearUnifiedDeltaWAL handles that for us. Instead, just include
 		// the cluster identifier.
 		for _, clusterPath := range clusterPaths {
 			allPaths = append(allPaths, cluster+clusterPath)
@@ -429,7 +435,7 @@ func (cb *CrlBuilder) getPresentUnifiedDeltaWALForClearing(sc *storageContext) (
 	return allPaths, nil
 }
 
-func (cb *CrlBuilder) _clearDeltaWAL(sc *storageContext, walSerials []string, path string) error {
+func (cb *CrlBuilder) _clearDeltaWAL(sc pki_backend.StorageContext, walSerials []string, path string) error {
 	// Clearing of the delta WAL occurs after a new complete CRL has been built.
 	for _, serial := range walSerials {
 		// Don't remove our special entries!
@@ -437,7 +443,7 @@ func (cb *CrlBuilder) _clearDeltaWAL(sc *storageContext, walSerials []string, pa
 			continue
 		}
 
-		if err := sc.Storage.Delete(sc.Context, path+serial); err != nil {
+		if err := sc.GetStorage().Delete(sc.GetContext(), path+serial); err != nil {
 			return fmt.Errorf("error clearing delta WAL certificate: %w", err)
 		}
 	}
@@ -445,11 +451,11 @@ func (cb *CrlBuilder) _clearDeltaWAL(sc *storageContext, walSerials []string, pa
 	return nil
 }
 
-func (cb *CrlBuilder) clearLocalDeltaWAL(sc *storageContext, walSerials []string) error {
+func (cb *CrlBuilder) ClearLocalDeltaWAL(sc pki_backend.StorageContext, walSerials []string) error {
 	return cb._clearDeltaWAL(sc, walSerials, localDeltaWALPath)
 }
 
-func (cb *CrlBuilder) clearUnifiedDeltaWAL(sc *storageContext, walSerials []string) error {
+func (cb *CrlBuilder) ClearUnifiedDeltaWAL(sc pki_backend.StorageContext, walSerials []string) error {
 	return cb._clearDeltaWAL(sc, walSerials, unifiedDeltaWALPrefix)
 }
 
@@ -463,7 +469,7 @@ func (cb *CrlBuilder) rebuildDeltaCRLsIfForced(sc *storageContext, override bool
 	// This guarantee means we can avoid checking delta CRL expiry. Thus,
 	// we only need to rebuild the delta CRL when we have new revocations,
 	// within our time window for updating it.
-	cfg, err := cb.getConfigWithUpdate(sc)
+	cfg, err := cb.GetConfigWithUpdate(sc)
 	if err != nil {
 		return nil, err
 	}
@@ -516,7 +522,7 @@ func (cb *CrlBuilder) rebuildDeltaCRLsIfForced(sc *storageContext, override bool
 	}
 
 	// Finally, we must've needed to do the rebuild. Execute!
-	return cb.rebuildDeltaCRLsHoldingLock(sc, false)
+	return cb.RebuildDeltaCRLsHoldingLock(sc, false)
 }
 
 func (cb *CrlBuilder) _shouldRebuildLocalCRLs(sc *storageContext, override bool) (bool, error) {
@@ -567,9 +573,9 @@ func (cb *CrlBuilder) _shouldRebuildLocalCRLs(sc *storageContext, override bool)
 
 func (cb *CrlBuilder) _shouldRebuildUnifiedCRLs(sc *storageContext, override bool) (bool, error) {
 	// Unified CRL can only be built by the main cluster.
-	b := sc.Backend
-	if b.System().ReplicationState().HasState(consts.ReplicationDRSecondary|consts.ReplicationPerformanceStandby) ||
-		(!b.System().LocalMount() && b.System().ReplicationState().HasState(consts.ReplicationPerformanceSecondary)) {
+	sysView := sc.System()
+	if sysView.ReplicationState().HasState(consts.ReplicationDRSecondary|consts.ReplicationPerformanceStandby) ||
+		(!sysView.LocalMount() && sysView.ReplicationState().HasState(consts.ReplicationPerformanceSecondary)) {
 		return false, nil
 	}
 
@@ -643,11 +649,11 @@ func (cb *CrlBuilder) rebuildDeltaCRLs(sc *storageContext, forceNew bool) ([]str
 	cb._builder.Lock()
 	defer cb._builder.Unlock()
 
-	return cb.rebuildDeltaCRLsHoldingLock(sc, forceNew)
+	return cb.RebuildDeltaCRLsHoldingLock(sc, forceNew)
 }
 
-func (cb *CrlBuilder) rebuildDeltaCRLsHoldingLock(sc *storageContext, forceNew bool) ([]string, error) {
-	return buildAnyCRLs(sc, forceNew, true /* building delta */)
+func (cb *CrlBuilder) RebuildDeltaCRLsHoldingLock(sc pki_backend.StorageContext, forceNew bool) ([]string, error) {
+	return buildAnyCRLs(sc.(*storageContext), forceNew, true /* building delta */)
 }
 
 func (cb *CrlBuilder) addCertForRevocationCheck(cluster, serial string) {
@@ -680,14 +686,14 @@ func (cb *CrlBuilder) maybeGatherQueueForFirstProcess(sc *storageContext, isNotP
 		return nil
 	}
 
-	sc.Backend.Logger().Debug(fmt.Sprintf("gathering first time existing revocations"))
+	sc.Logger().Debug(fmt.Sprintf("gathering first time existing revocations"))
 
 	clusters, err := sc.Storage.List(sc.Context, crossRevocationPrefix)
 	if err != nil {
 		return fmt.Errorf("failed to list cross-cluster revocation queue participating clusters: %w", err)
 	}
 
-	sc.Backend.Logger().Debug(fmt.Sprintf("found %v clusters: %v", len(clusters), clusters))
+	sc.Logger().Debug(fmt.Sprintf("found %v clusters: %v", len(clusters), clusters))
 
 	for cIndex, cluster := range clusters {
 		cluster = cluster[0 : len(cluster)-1]
@@ -697,7 +703,7 @@ func (cb *CrlBuilder) maybeGatherQueueForFirstProcess(sc *storageContext, isNotP
 			return fmt.Errorf("failed to list cross-cluster revocation queue entries for cluster %v (%v): %w", cluster, cIndex, err)
 		}
 
-		sc.Backend.Logger().Debug(fmt.Sprintf("found %v serials for cluster %v: %v", len(serials), cluster, serials))
+		sc.Logger().Debug(fmt.Sprintf("found %v serials for cluster %v: %v", len(serials), cluster, serials))
 
 		for _, serial := range serials {
 			if serial[len(serial)-1] == '/' {
@@ -731,10 +737,10 @@ func (cb *CrlBuilder) maybeGatherQueueForFirstProcess(sc *storageContext, isNotP
 }
 
 func (cb *CrlBuilder) processRevocationQueue(sc *storageContext) error {
-	sc.Backend.Logger().Debug(fmt.Sprintf("starting to process revocation requests"))
+	sc.Logger().Debug(fmt.Sprintf("starting to process revocation requests"))
 
-	isNotPerfPrimary := sc.Backend.System().ReplicationState().HasState(consts.ReplicationDRSecondary|consts.ReplicationPerformanceStandby) ||
-		(!sc.Backend.System().LocalMount() && sc.Backend.System().ReplicationState().HasState(consts.ReplicationPerformanceSecondary))
+	isNotPerfPrimary := sc.System().ReplicationState().HasState(consts.ReplicationDRSecondary|consts.ReplicationPerformanceStandby) ||
+		(!sc.System().LocalMount() && sc.System().ReplicationState().HasState(consts.ReplicationPerformanceSecondary))
 
 	if err := cb.maybeGatherQueueForFirstProcess(sc, isNotPerfPrimary); err != nil {
 		return fmt.Errorf("failed to gather first queue: %w", err)
@@ -743,14 +749,14 @@ func (cb *CrlBuilder) processRevocationQueue(sc *storageContext) error {
 	revQueue := cb.revQueue.Iterate()
 	removalQueue := cb.removalQueue.Iterate()
 
-	sc.Backend.Logger().Debug(fmt.Sprintf("gathered %v revocations and %v confirmation entries", len(revQueue), len(removalQueue)))
+	sc.Logger().Debug(fmt.Sprintf("gathered %v revocations and %v confirmation entries", len(revQueue), len(removalQueue)))
 
-	crlConfig, err := cb.getConfigWithUpdate(sc)
+	crlConfig, err := cb.GetConfigWithUpdate(sc)
 	if err != nil {
 		return err
 	}
 
-	ourClusterId, err := sc.Backend.System().ClusterID(sc.Context)
+	ourClusterId, err := sc.System().ClusterID(sc.Context)
 	if err != nil {
 		return fmt.Errorf("unable to fetch clusterID to ignore local revocation entries: %w", err)
 	}
@@ -812,7 +818,7 @@ func (cb *CrlBuilder) processRevocationQueue(sc *storageContext) error {
 	}
 
 	if isNotPerfPrimary {
-		sc.Backend.Logger().Debug(fmt.Sprintf("not on perf primary so ignoring any revocation confirmations"))
+		sc.Logger().Debug(fmt.Sprintf("not on perf primary so ignoring any revocation confirmations"))
 
 		// See note in pki/backend.go; this should be empty.
 		cb.removalQueue.RemoveAll()
@@ -848,9 +854,9 @@ func (cb *CrlBuilder) processRevocationQueue(sc *storageContext) error {
 }
 
 func (cb *CrlBuilder) processCrossClusterRevocations(sc *storageContext) error {
-	sc.Backend.Logger().Debug(fmt.Sprintf("starting to process unified revocations"))
+	sc.Logger().Debug(fmt.Sprintf("starting to process unified revocations"))
 
-	crlConfig, err := cb.getConfigWithUpdate(sc)
+	crlConfig, err := cb.GetConfigWithUpdate(sc)
 	if err != nil {
 		return err
 	}
@@ -861,9 +867,9 @@ func (cb *CrlBuilder) processCrossClusterRevocations(sc *storageContext) error {
 	}
 
 	crossQueue := cb.crossQueue.Iterate()
-	sc.Backend.Logger().Debug(fmt.Sprintf("gathered %v unified revocations entries", len(crossQueue)))
+	sc.Logger().Debug(fmt.Sprintf("gathered %v unified revocations entries", len(crossQueue)))
 
-	ourClusterId, err := sc.Backend.System().ClusterID(sc.Context)
+	ourClusterId, err := sc.System().ClusterID(sc.Context)
 	if err != nil {
 		return fmt.Errorf("unable to fetch clusterID to ignore local unified revocation entries: %w", err)
 	}
@@ -909,58 +915,14 @@ func (cb *CrlBuilder) processCrossClusterRevocations(sc *storageContext) error {
 	return nil
 }
 
-// Helper function to fetch a map of IssuerID->parsed cert for revocation
-// usage. Unlike other paths, this needs to handle the legacy bundle
-// more gracefully than rejecting it outright.
-func fetchIssuerMapForRevocationChecking(sc *storageContext) (map[issuing.IssuerID]*x509.Certificate, error) {
-	var err error
-	var issuers []issuing.IssuerID
-
-	if !sc.Backend.UseLegacyBundleCaStorage() {
-		issuers, err = sc.listIssuers()
-		if err != nil {
-			return nil, fmt.Errorf("could not fetch issuers list: %w", err)
-		}
-	} else {
-		// Hack: this isn't a real IssuerID, but it works for fetchCAInfo
-		// since it resolves the reference.
-		issuers = []issuing.IssuerID{legacyBundleShimID}
-	}
-
-	issuerIDCertMap := make(map[issuing.IssuerID]*x509.Certificate, len(issuers))
-	for _, issuer := range issuers {
-		_, bundle, caErr := sc.fetchCertBundleByIssuerId(issuer, false)
-		if caErr != nil {
-			return nil, fmt.Errorf("error fetching CA certificate for issuer id %v: %w", issuer, caErr)
-		}
-
-		if bundle == nil {
-			return nil, fmt.Errorf("faulty reference: %v - CA info not found", issuer)
-		}
-
-		parsedBundle, err := parseCABundle(sc.Context, sc.Backend, bundle)
-		if err != nil {
-			return nil, errutil.InternalError{Err: err.Error()}
-		}
-
-		if parsedBundle.Certificate == nil {
-			return nil, errutil.InternalError{Err: "stored CA information not able to be parsed"}
-		}
-
-		issuerIDCertMap[issuer] = parsedBundle.Certificate
-	}
-
-	return issuerIDCertMap, nil
-}
-
 // Revoke a certificate from a given serial number if it is present in local
 // storage.
-func tryRevokeCertBySerial(sc *storageContext, config *crlConfig, serial string) (*logical.Response, error) {
+func tryRevokeCertBySerial(sc *storageContext, config *pki_backend.CrlConfig, serial string) (*logical.Response, error) {
 	// revokeCert requires us to hold these locks before calling it.
-	sc.Backend.GetRevokeStorageLock().Lock()
-	defer sc.Backend.GetRevokeStorageLock().Unlock()
+	sc.GetRevokeStorageLock().Lock()
+	defer sc.GetRevokeStorageLock().Unlock()
 
-	certEntry, err := fetchCertBySerial(sc, "certs/", serial)
+	certEntry, err := fetchCertBySerial(sc, issuing.PathCerts, serial)
 	if err != nil {
 		switch err.(type) {
 		case errutil.UserError:
@@ -983,24 +945,24 @@ func tryRevokeCertBySerial(sc *storageContext, config *crlConfig, serial string)
 }
 
 // Revokes a cert, and tries to be smart about error recovery
-func revokeCert(sc *storageContext, config *crlConfig, cert *x509.Certificate) (*logical.Response, error) {
+func revokeCert(sc *storageContext, config *pki_backend.CrlConfig, cert *x509.Certificate) (*logical.Response, error) {
 	// As this backend is self-contained and this function does not hook into
 	// third parties to manage users or resources, if the mount is tainted,
 	// revocation doesn't matter anyways -- the CRL that would be written will
 	// be immediately blown away by the view being cleared. So we can simply
 	// fast path a successful exit.
-	if sc.Backend.System().Tainted() {
+	if sc.System().Tainted() {
 		return nil, nil
 	}
 
-	colonSerial := serialFromCert(cert)
-	hyphenSerial := normalizeSerial(colonSerial)
+	colonSerial := parsing.SerialFromCert(cert)
+	hyphenSerial := parsing.NormalizeSerialForStorage(colonSerial)
 
 	// Validate that no issuers match the serial number to be revoked. We need
 	// to gracefully degrade to the legacy cert bundle when it is required, as
 	// secondary PR clusters might not have been upgraded, but still need to
 	// handle revoking certs.
-	issuerIDCertMap, err := fetchIssuerMapForRevocationChecking(sc)
+	issuerIDCertMap, err := revocation.FetchIssuerMapForRevocationChecking(sc)
 	if err != nil {
 		return nil, err
 	}
@@ -1013,7 +975,7 @@ func revokeCert(sc *storageContext, config *crlConfig, cert *x509.Certificate) (
 		}
 	}
 
-	curRevInfo, err := sc.fetchRevocationInfo(colonSerial)
+	curRevInfo, err := fetchRevocationInfo(sc, colonSerial)
 	if err != nil {
 		return nil, err
 	}
@@ -1040,7 +1002,7 @@ func revokeCert(sc *storageContext, config *crlConfig, cert *x509.Certificate) (
 	}
 
 	currTime := time.Now()
-	revInfo := revocationInfo{
+	revInfo := revocation.RevocationInfo{
 		CertificateBytes:  cert.Raw,
 		RevocationTime:    currTime.Unix(),
 		RevocationTimeUTC: currTime.UTC(),
@@ -1048,14 +1010,14 @@ func revokeCert(sc *storageContext, config *crlConfig, cert *x509.Certificate) (
 
 	// We may not find an issuer with this certificate; that's fine so
 	// ignore the return value.
-	associateRevokedCertWithIsssuer(&revInfo, cert, issuerIDCertMap)
+	revInfo.AssociateRevokedCertWithIsssuer(cert, issuerIDCertMap)
 
 	revEntry, err := logical.StorageEntryJSON(revokedPath+hyphenSerial, revInfo)
 	if err != nil {
 		return nil, fmt.Errorf("error creating revocation entry: %w", err)
 	}
 
-	certCounter := sc.Backend.GetCertificateCounter()
+	certCounter := sc.GetCertificateCounter()
 	certsCounted := certCounter.IsInitialized()
 	err = sc.Storage.Put(sc.Context, revEntry)
 	if err != nil {
@@ -1078,22 +1040,22 @@ func revokeCert(sc *storageContext, config *crlConfig, cert *x509.Certificate) (
 	// the unified storage space through a periodic function.
 	failedWritingUnifiedCRL := false
 	if config.UnifiedCRL {
-		entry := &unifiedRevocationEntry{
+		entry := &revocation.UnifiedRevocationEntry{
 			SerialNumber:      colonSerial,
 			CertExpiration:    cert.NotAfter,
 			RevocationTimeUTC: revInfo.RevocationTimeUTC,
 			CertificateIssuer: revInfo.CertificateIssuer,
 		}
 
-		ignoreErr := writeUnifiedRevocationEntry(sc, entry)
+		ignoreErr := revocation.WriteUnifiedRevocationEntry(sc.GetContext(), sc.GetStorage(), entry)
 		if ignoreErr != nil {
 			// Just log the error if we fail to write across clusters, a separate background
 			// thread will reattempt it later on as we have the local write done.
-			sc.Backend.Logger().Error("Failed to write unified revocation entry, will re-attempt later",
+			sc.Logger().Error("Failed to write unified revocation entry, will re-attempt later",
 				"serial_number", colonSerial, "error", ignoreErr)
-			sc.Backend.GetUnifiedTransferStatus().forceRun()
+			sc.GetUnifiedTransferStatus().forceRun()
 
-			resp.AddWarning(fmt.Sprintf("Failed to write unified revocation entry, will re-attempt later: %v", err))
+			resp.AddWarning(fmt.Sprintf("Failed to write unified revocation entry, will re-attempt later: %v", ignoreErr))
 			failedWritingUnifiedCRL = true
 		}
 	}
@@ -1103,7 +1065,7 @@ func revokeCert(sc *storageContext, config *crlConfig, cert *x509.Certificate) (
 		// already rebuilt the full CRL so the Delta WAL will be cleared
 		// afterwards. Writing an entry only to immediately remove it
 		// isn't necessary.
-		warnings, crlErr := sc.Backend.CrlBuilder().rebuild(sc, false)
+		warnings, crlErr := sc.CrlBuilder().Rebuild(sc, false)
 		if crlErr != nil {
 			switch crlErr.(type) {
 			case errutil.UserError:
@@ -1124,7 +1086,7 @@ func revokeCert(sc *storageContext, config *crlConfig, cert *x509.Certificate) (
 	return resp, nil
 }
 
-func writeRevocationDeltaWALs(sc *storageContext, config *crlConfig, resp *logical.Response, failedWritingUnifiedCRL bool, hyphenSerial string, colonSerial string) error {
+func writeRevocationDeltaWALs(sc *storageContext, config *pki_backend.CrlConfig, resp *logical.Response, failedWritingUnifiedCRL bool, hyphenSerial string, colonSerial string) error {
 	if err := writeSpecificRevocationDeltaWALs(sc, hyphenSerial, colonSerial, localDeltaWALPath); err != nil {
 		return fmt.Errorf("failed to write local delta WAL entry: %w", err)
 	}
@@ -1146,9 +1108,9 @@ func writeRevocationDeltaWALs(sc *storageContext, config *crlConfig, resp *logic
 		if ignoredErr := writeSpecificRevocationDeltaWALs(sc, hyphenSerial, colonSerial, unifiedDeltaWALPath); ignoredErr != nil {
 			// Just log the error if we fail to write across clusters, a separate background
 			// thread will reattempt it later on as we have the local write done.
-			sc.Backend.Logger().Error("Failed to write cross-cluster delta WAL entry, will re-attempt later",
+			sc.Logger().Error("Failed to write cross-cluster delta WAL entry, will re-attempt later",
 				"serial_number", colonSerial, "error", ignoredErr)
-			sc.Backend.GetUnifiedTransferStatus().forceRun()
+			sc.GetUnifiedTransferStatus().forceRun()
 
 			resp.AddWarning(fmt.Sprintf("Failed to write cross-cluster delta WAL entry, will re-attempt later: %v", ignoredErr))
 		}
@@ -1243,8 +1205,7 @@ func buildAnyCRLs(sc *storageContext, forceNew bool, isDelta bool) ([]string, er
 	var wasLegacy bool
 
 	// First, fetch an updated copy of the CRL config. We'll pass this into buildCRL.
-	crlBuilder := sc.Backend.CrlBuilder()
-	globalCRLConfig, err := crlBuilder.getConfigWithUpdate(sc)
+	globalCRLConfig, err := sc.CrlBuilder().GetConfigWithUpdate(sc)
 	if err != nil {
 		return nil, fmt.Errorf("error building CRL: while updating config: %w", err)
 	}
@@ -1261,7 +1222,7 @@ func buildAnyCRLs(sc *storageContext, forceNew bool, isDelta bool) ([]string, er
 		return nil, nil
 	}
 
-	if !sc.Backend.UseLegacyBundleCaStorage() {
+	if !sc.UseLegacyBundleCaStorage() {
 		issuers, err = sc.listIssuers()
 		if err != nil {
 			return nil, fmt.Errorf("error building CRL: while listing issuers: %w", err)
@@ -1369,13 +1330,13 @@ func buildAnyCRLs(sc *storageContext, forceNew bool, isDelta bool) ([]string, er
 	if !isDelta {
 		// After we've confirmed the primary CRLs have built OK, go ahead and
 		// clear the delta CRL WAL and rebuild it.
-		if err := crlBuilder.clearLocalDeltaWAL(sc, currLocalDeltaSerials); err != nil {
+		if err := sc.CrlBuilder().ClearLocalDeltaWAL(sc, currLocalDeltaSerials); err != nil {
 			return nil, fmt.Errorf("error building CRLs: unable to clear Delta WAL: %w", err)
 		}
-		if err := crlBuilder.clearUnifiedDeltaWAL(sc, currUnifiedDeltaSerials); err != nil {
+		if err := sc.CrlBuilder().ClearUnifiedDeltaWAL(sc, currUnifiedDeltaSerials); err != nil {
 			return nil, fmt.Errorf("error building CRLs: unable to clear Delta WAL: %w", err)
 		}
-		deltaWarnings, err := crlBuilder.rebuildDeltaCRLsHoldingLock(sc, forceNew)
+		deltaWarnings, err := sc.CrlBuilder().RebuildDeltaCRLsHoldingLock(sc, forceNew)
 		if err != nil {
 			return nil, fmt.Errorf("error building CRLs: unable to rebuild empty Delta WAL: %w", err)
 		}
@@ -1409,7 +1370,7 @@ func getLastWALSerial(sc *storageContext, path string) (string, error) {
 func buildAnyLocalCRLs(
 	sc *storageContext,
 	issuersConfig *issuing.IssuerConfigEntry,
-	globalCRLConfig *crlConfig,
+	globalCRLConfig *pki_backend.CrlConfig,
 	issuers []issuing.IssuerID,
 	issuerIDEntryMap map[issuing.IssuerID]*issuing.IssuerEntry,
 	issuerIDCertMap map[issuing.IssuerID]*x509.Certificate,
@@ -1439,7 +1400,7 @@ func buildAnyLocalCRLs(
 	// visible now, should also be visible on the complete CRL we're writing.
 	var currDeltaCerts []string
 	if !isDelta {
-		currDeltaCerts, err = sc.Backend.CrlBuilder().getPresentLocalDeltaWALForClearing(sc)
+		currDeltaCerts, err = sc.CrlBuilder().GetPresentLocalDeltaWALForClearing(sc)
 		if err != nil {
 			return nil, nil, fmt.Errorf("error building CRLs: unable to get present delta WAL entries for removal: %w", err)
 		}
@@ -1503,7 +1464,7 @@ func buildAnyLocalCRLs(
 	if isDelta {
 		// Update our last build time here so we avoid checking for new certs
 		// for a while.
-		sc.Backend.CrlBuilder().lastDeltaRebuildCheck = time.Now()
+		sc.CrlBuilder().SetLastDeltaRebuildCheckTime(time.Now())
 
 		if len(lastDeltaSerial) > 0 {
 			// When we have a last delta serial, write out the relevant info
@@ -1528,7 +1489,7 @@ func buildAnyLocalCRLs(
 func buildAnyUnifiedCRLs(
 	sc *storageContext,
 	issuersConfig *issuing.IssuerConfigEntry,
-	globalCRLConfig *crlConfig,
+	globalCRLConfig *pki_backend.CrlConfig,
 	issuers []issuing.IssuerID,
 	issuerIDEntryMap map[issuing.IssuerID]*issuing.IssuerEntry,
 	issuerIDCertMap map[issuing.IssuerID]*x509.Certificate,
@@ -1541,9 +1502,9 @@ func buildAnyUnifiedCRLs(
 	var warnings []string
 
 	// Unified CRL can only be built by the main cluster.
-	b := sc.Backend
-	if b.System().ReplicationState().HasState(consts.ReplicationDRSecondary|consts.ReplicationPerformanceStandby) ||
-		(!b.System().LocalMount() && b.System().ReplicationState().HasState(consts.ReplicationPerformanceSecondary)) {
+	sysView := sc.System()
+	if sysView.ReplicationState().HasState(consts.ReplicationDRSecondary|consts.ReplicationPerformanceStandby) ||
+		(!sysView.LocalMount() && sysView.ReplicationState().HasState(consts.ReplicationPerformanceSecondary)) {
 		return nil, nil, nil
 	}
 
@@ -1582,7 +1543,7 @@ func buildAnyUnifiedCRLs(
 	// visible now, should also be visible on the complete CRL we're writing.
 	var currDeltaCerts []string
 	if !isDelta {
-		currDeltaCerts, err = sc.Backend.CrlBuilder().getPresentUnifiedDeltaWALForClearing(sc)
+		currDeltaCerts, err = sc.CrlBuilder().GetPresentUnifiedDeltaWALForClearing(sc)
 		if err != nil {
 			return nil, nil, fmt.Errorf("error building CRLs: unable to get present delta WAL entries for removal: %w", err)
 		}
@@ -1646,7 +1607,7 @@ func buildAnyUnifiedCRLs(
 	if isDelta {
 		// Update our last build time here so we avoid checking for new certs
 		// for a while.
-		sc.Backend.CrlBuilder().lastDeltaRebuildCheck = time.Now()
+		sc.CrlBuilder().SetLastDeltaRebuildCheckTime(time.Now())
 
 		// Persist all of our known last revoked serial numbers here, as the
 		// last seen serial during build. This will allow us to detect if any
@@ -1679,7 +1640,7 @@ func buildAnyUnifiedCRLs(
 func buildAnyCRLsWithCerts(
 	sc *storageContext,
 	issuersConfig *issuing.IssuerConfigEntry,
-	globalCRLConfig *crlConfig,
+	globalCRLConfig *pki_backend.CrlConfig,
 	internalCRLConfig *issuing.InternalCRLConfigEntry,
 	issuers []issuing.IssuerID,
 	issuerIDEntryMap map[issuing.IssuerID]*issuing.IssuerEntry,
@@ -1807,6 +1768,20 @@ func buildAnyCRLsWithCerts(
 				internalCRLConfig.LastModified = time.Now().UTC()
 			}
 
+			// Enforce the max CRL size guard before building the actual CRL
+			if globalCRLConfig.MaxCRLEntries > -1 {
+				limit := maxCRLEntriesOrDefault(globalCRLConfig.MaxCRLEntries)
+				revokedCount := len(revokedCerts)
+				if revokedCount > limit {
+					// Also log a nasty error to get the operator's attention
+					sc.Logger().Error("CRL was not updated, as it exceeds the configured max size.  The CRL now does not contain all revoked certificates!  This may be indicative of a runaway issuance/revocation pattern.", "limit", limit)
+					return nil, fmt.Errorf("error building CRL: revocation list size (%d) exceeds configured maximum (%d)", revokedCount, limit)
+				}
+				if revokedCount > int(float32(limit)*0.90) {
+					sc.Logger().Warn("warning, revoked certificate count is within 10% of the configured maximum CRL size", "revoked_certs", revokedCount, "limit", limit)
+				}
+			}
+
 			// Lastly, build the CRL.
 			nextUpdate, err := buildCRL(sc, globalCRLConfig, forceNew, representative, revokedCerts, crlIdentifier, crlNumber, isUnified, isDelta, lastCompleteNumber)
 			if err != nil {
@@ -1858,7 +1833,7 @@ func buildAnyCRLsWithCerts(
 		}
 
 		if !stillHaveIssuerForID {
-			if err := sc.Storage.Delete(sc.Context, "crls/"+crlId.String()); err != nil {
+			if err := sc.Storage.Delete(sc.Context, issuing.PathCrls+crlId.String()); err != nil {
 				return nil, fmt.Errorf("error building CRLs: unable to clean up deleted issuers' CRL: %w", err)
 			}
 		}
@@ -1868,7 +1843,7 @@ func buildAnyCRLsWithCerts(
 	return warnings, nil
 }
 
-func isRevInfoIssuerValid(revInfo *revocationInfo, issuerIDCertMap map[issuing.IssuerID]*x509.Certificate) bool {
+func isRevInfoIssuerValid(revInfo *revocation.RevocationInfo, issuerIDCertMap map[issuing.IssuerID]*x509.Certificate) bool {
 	if len(revInfo.CertificateIssuer) > 0 {
 		issuerId := revInfo.CertificateIssuer
 		if _, issuerExists := issuerIDCertMap[issuerId]; issuerExists {
@@ -1879,20 +1854,6 @@ func isRevInfoIssuerValid(revInfo *revocationInfo, issuerIDCertMap map[issuing.I
 	return false
 }
 
-func associateRevokedCertWithIsssuer(revInfo *revocationInfo, revokedCert *x509.Certificate, issuerIDCertMap map[issuing.IssuerID]*x509.Certificate) bool {
-	for issuerId, issuerCert := range issuerIDCertMap {
-		if bytes.Equal(revokedCert.RawIssuer, issuerCert.RawSubject) {
-			if err := revokedCert.CheckSignatureFrom(issuerCert); err == nil {
-				// Valid mapping. Add it to the specified entry.
-				revInfo.CertificateIssuer = issuerId
-				return true
-			}
-		}
-	}
-
-	return false
-}
-
 func getLocalRevokedCertEntries(sc *storageContext, issuerIDCertMap map[issuing.IssuerID]*x509.Certificate, isDelta bool) ([]pkix.RevokedCertificate, map[issuing.IssuerID][]pkix.RevokedCertificate, error) {
 	var unassignedCerts []pkix.RevokedCertificate
 	revokedCertsMap := make(map[issuing.IssuerID][]pkix.RevokedCertificate)
@@ -1920,7 +1881,7 @@ func getLocalRevokedCertEntries(sc *storageContext, issuerIDCertMap map[issuing.
 			continue
 		}
 
-		var revInfo revocationInfo
+		var revInfo revocation.RevocationInfo
 		revokedEntry, err := sc.Storage.Get(sc.Context, revokedPath+serial)
 		if err != nil {
 			return nil, nil, errutil.InternalError{Err: fmt.Sprintf("unable to fetch revoked cert with serial %s: %s", serial, err)}
@@ -1997,7 +1958,7 @@ func getLocalRevokedCertEntries(sc *storageContext, issuerIDCertMap map[issuing.
 		}
 
 		// Now we need to assign the revoked certificate to an issuer.
-		foundParent := associateRevokedCertWithIsssuer(&revInfo, revokedCert, issuerIDCertMap)
+		foundParent := revInfo.AssociateRevokedCertWithIsssuer(revokedCert, issuerIDCertMap)
 		if !foundParent {
 			// If the parent isn't found, add it to the unassigned bucket.
 			unassignedCerts = append(unassignedCerts, newRevCert)
@@ -2084,7 +2045,7 @@ func getUnifiedRevokedCertEntries(sc *storageContext, issuerIDCertMap map[issuin
 				continue
 			}
 
-			var xRevEntry unifiedRevocationEntry
+			var xRevEntry revocation.UnifiedRevocationEntry
 			if err := entryRaw.DecodeJSON(&xRevEntry); err != nil {
 				return nil, nil, fmt.Errorf("failed json decoding of unified revocation entry at path %v: %w ", serialPath, err)
 			}
@@ -2154,7 +2115,7 @@ func augmentWithRevokedIssuers(issuerIDEntryMap map[issuing.IssuerID]*issuing.Is
 
 // Builds a CRL by going through the list of revoked certificates and building
 // a new CRL with the stored revocation times and serial numbers.
-func buildCRL(sc *storageContext, crlInfo *crlConfig, forceNew bool, thisIssuerId issuing.IssuerID, revoked []pkix.RevokedCertificate, identifier issuing.CrlID, crlNumber int64, isUnified bool, isDelta bool, lastCompleteNumber int64) (*time.Time, error) {
+func buildCRL(sc *storageContext, crlInfo *pki_backend.CrlConfig, forceNew bool, thisIssuerId issuing.IssuerID, revoked []pkix.RevokedCertificate, identifier issuing.CrlID, crlNumber int64, isUnified bool, isDelta bool, lastCompleteNumber int64) (*time.Time, error) {
 	var revokedCerts []pkix.RevokedCertificate
 
 	crlLifetime, err := parseutil.ParseDurationSecond(crlInfo.Expiry)
@@ -2217,7 +2178,7 @@ WRITE:
 		return nil, errutil.InternalError{Err: fmt.Sprintf("error creating new CRL: %s", err)}
 	}
 
-	writePath := "crls/" + identifier.String()
+	writePath := issuing.PathCrls + identifier.String()
 	if thisIssuerId == legacyBundleShimID {
 		// Ignore the CRL ID as it won't be persisted anyways; hard-code the
 		// old legacy path and allow it to be updated.
@@ -2246,6 +2207,6 @@ WRITE:
 
 // shouldLocalPathsUseUnified assuming a legacy path for a CRL/OCSP request, does our
 // configuration say we should be returning the unified response or not
-func shouldLocalPathsUseUnified(cfg *crlConfig) bool {
+func shouldLocalPathsUseUnified(cfg *pki_backend.CrlConfig) bool {
 	return cfg.UnifiedCRL && cfg.UnifiedCRLOnExistingPaths
 }
diff --git a/builtin/logical/pki/defaultdirectorypolicytype_enumer.go b/builtin/logical/pki/defaultdirectorypolicytype_enumer.go
new file mode 100644
index 00000000000..917225ff834
--- /dev/null
+++ b/builtin/logical/pki/defaultdirectorypolicytype_enumer.go
@@ -0,0 +1,51 @@
+// Code generated by "enumer -type=DefaultDirectoryPolicyType"; DO NOT EDIT.
+
+package pki
+
+import (
+	"fmt"
+)
+
+const _DefaultDirectoryPolicyTypeName = "ForbidSignVerbatimRoleExternalPolicy"
+
+var _DefaultDirectoryPolicyTypeIndex = [...]uint8{0, 6, 18, 22, 36}
+
+func (i DefaultDirectoryPolicyType) String() string {
+	if i < 0 || i >= DefaultDirectoryPolicyType(len(_DefaultDirectoryPolicyTypeIndex)-1) {
+		return fmt.Sprintf("DefaultDirectoryPolicyType(%d)", i)
+	}
+	return _DefaultDirectoryPolicyTypeName[_DefaultDirectoryPolicyTypeIndex[i]:_DefaultDirectoryPolicyTypeIndex[i+1]]
+}
+
+var _DefaultDirectoryPolicyTypeValues = []DefaultDirectoryPolicyType{0, 1, 2, 3}
+
+var _DefaultDirectoryPolicyTypeNameToValueMap = map[string]DefaultDirectoryPolicyType{
+	_DefaultDirectoryPolicyTypeName[0:6]:   0,
+	_DefaultDirectoryPolicyTypeName[6:18]:  1,
+	_DefaultDirectoryPolicyTypeName[18:22]: 2,
+	_DefaultDirectoryPolicyTypeName[22:36]: 3,
+}
+
+// DefaultDirectoryPolicyTypeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func DefaultDirectoryPolicyTypeString(s string) (DefaultDirectoryPolicyType, error) {
+	if val, ok := _DefaultDirectoryPolicyTypeNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to DefaultDirectoryPolicyType values", s)
+}
+
+// DefaultDirectoryPolicyTypeValues returns all values of the enum
+func DefaultDirectoryPolicyTypeValues() []DefaultDirectoryPolicyType {
+	return _DefaultDirectoryPolicyTypeValues
+}
+
+// IsADefaultDirectoryPolicyType returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i DefaultDirectoryPolicyType) IsADefaultDirectoryPolicyType() bool {
+	for _, v := range _DefaultDirectoryPolicyTypeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/builtin/logical/pki/dnstest/server.go b/builtin/logical/pki/dnstest/server.go
index 751c0ae873f..00c88ca52b7 100644
--- a/builtin/logical/pki/dnstest/server.go
+++ b/builtin/logical/pki/dnstest/server.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package dnstest
diff --git a/builtin/logical/pki/fields.go b/builtin/logical/pki/fields.go
index abf0ac4cd2c..404cd4718cd 100644
--- a/builtin/logical/pki/fields.go
+++ b/builtin/logical/pki/fields.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -166,6 +166,13 @@ Any values are added with OID 0.9.2342.19200300.100.1.1.`,
 			Name: "User ID(s)",
 		},
 	}
+	fields["cert_metadata"] = &framework.FieldSchema{
+		Type:        framework.TypeString,
+		Description: `User supplied metadata to store associated with this certificate's serial number, base64 encoded`,
+		DisplayAttrs: &framework.DisplayAttributes{
+			Name: "Certificate Metadata",
+		},
+	}
 
 	fields = addIssuerRefField(fields)
 
@@ -383,6 +390,60 @@ func addCAIssueFields(fields map[string]*framework.FieldSchema) map[string]*fram
 			Name: "Permitted DNS Domains",
 		},
 	}
+	fields["excluded_dns_domains"] = &framework.FieldSchema{
+		Type:        framework.TypeCommaStringSlice,
+		Description: `Domains for which this certificate is not allowed to sign or issue child certificates (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10).`,
+		DisplayAttrs: &framework.DisplayAttributes{
+			Name: "Excluded DNS Domains",
+		},
+	}
+
+	fields["permitted_ip_ranges"] = &framework.FieldSchema{
+		Type: framework.TypeCommaStringSlice,
+		Description: `IP ranges for which this certificate is allowed to sign or issue child certificates (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10).
+Ranges must be specified in the notation of IP address and prefix length, like "192.0.2.0/24" or "2001:db8::/32", as defined in RFC 4632 and RFC 4291.`,
+		DisplayAttrs: &framework.DisplayAttributes{
+			Name: "Permitted IP ranges",
+		},
+	}
+	fields["excluded_ip_ranges"] = &framework.FieldSchema{
+		Type: framework.TypeCommaStringSlice,
+		Description: `IP ranges for which this certificate is not allowed to sign or issue child certificates (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10).
+Ranges must be specified in the notation of IP address and prefix length, like "192.0.2.0/24" or "2001:db8::/32", as defined in RFC 4632 and RFC 4291.`,
+		DisplayAttrs: &framework.DisplayAttributes{
+			Name: "Excluded IP ranges",
+		},
+	}
+
+	fields["permitted_email_addresses"] = &framework.FieldSchema{
+		Type:        framework.TypeCommaStringSlice,
+		Description: `Email addresses for which this certificate is allowed to sign or issue child certificates (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10).`,
+		DisplayAttrs: &framework.DisplayAttributes{
+			Name: "Permitted email addresses",
+		},
+	}
+	fields["excluded_email_addresses"] = &framework.FieldSchema{
+		Type:        framework.TypeCommaStringSlice,
+		Description: `Email addresses for which this certificate is not allowed to sign or issue child certificates (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10).`,
+		DisplayAttrs: &framework.DisplayAttributes{
+			Name: "Excluded email addresses",
+		},
+	}
+
+	fields["permitted_uri_domains"] = &framework.FieldSchema{
+		Type:        framework.TypeCommaStringSlice,
+		Description: `URI domains for which this certificate is allowed to sign or issue child certificates (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10).`,
+		DisplayAttrs: &framework.DisplayAttributes{
+			Name: "Permitted URI domains",
+		},
+	}
+	fields["excluded_uri_domains"] = &framework.FieldSchema{
+		Type:        framework.TypeCommaStringSlice,
+		Description: `URI domains for which this certificate is not allowed to sign or issue child certificates (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10).`,
+		DisplayAttrs: &framework.DisplayAttributes{
+			Name: "Excluded URI domains",
+		},
+	}
 
 	fields = addIssuerNameField(fields)
 
@@ -572,6 +633,16 @@ the cross-cluster revoked certificate store. Only runs on the active
 primary node.`,
 	}
 
+	fields["tidy_cert_metadata"] = &framework.FieldSchema{
+		Type:        framework.TypeBool,
+		Description: `Set to true to enable tidying up certificate metadata`,
+	}
+
+	fields["tidy_cmpv2_nonce_store"] = &framework.FieldSchema{
+		Type:        framework.TypeBool,
+		Description: `Set to true to enable tidying up the CMPv2 nonce store`,
+	}
+
 	return fields
 }
 
@@ -644,3 +715,33 @@ RSA key-type issuer. Defaults to false.`,
 
 	return fields
 }
+
+func addCACertKeyUsage(fields map[string]*framework.FieldSchema) map[string]*framework.FieldSchema {
+	fields["key_usage"] = &framework.FieldSchema{ // Same Name as Leaf-Cert Field, and CA CSR Field, but Description and Default Differ
+		Type:    framework.TypeCommaStringSlice,
+		Default: []string{"CertSign", "CRLSign"},
+		Description: `This list of key usages (not extended key usages) will be 
+added to the existing set of key usages, CRL,CertSign, on 
+the generated certificate.  Valid values can be found at 
+https://golang.org/pkg/crypto/x509/#KeyUsage -- simply drop 
+the "KeyUsage" part of the name.  To use the issuer for 
+CMPv2, DigitalSignature must be set.`,
+	}
+
+	return fields
+}
+
+func addCaCsrKeyUsage(fields map[string]*framework.FieldSchema) map[string]*framework.FieldSchema {
+	fields["key_usage"] = &framework.FieldSchema{ // Same Name as Leaf-Cert, CA-Cert Field, but Description and Default Differ
+		Type:    framework.TypeCommaStringSlice,
+		Default: []string{},
+		Description: `Specifies key_usage to encode in the certificate signing
+request.  This is a comma-separated string or list of key
+usages (not extended key usages). Valid values can be found
+at https://golang.org/pkg/crypto/x509/#KeyUsage -- simply 
+drop the "KeyUsage" part of the name.  If not set, key 
+usage will not appear on the CSR.`,
+	}
+
+	return fields
+}
diff --git a/builtin/logical/pki/ifmodifiedreqtype_enumer.go b/builtin/logical/pki/ifmodifiedreqtype_enumer.go
new file mode 100644
index 00000000000..b366fd825fc
--- /dev/null
+++ b/builtin/logical/pki/ifmodifiedreqtype_enumer.go
@@ -0,0 +1,53 @@
+// Code generated by "enumer -type=ifModifiedReqType -trimprefix=ifModified"; DO NOT EDIT.
+
+package pki
+
+import (
+	"fmt"
+)
+
+const _ifModifiedReqTypeName = "UnknownCACRLDeltaCRLUnifiedCRLUnifiedDeltaCRL"
+
+var _ifModifiedReqTypeIndex = [...]uint8{0, 7, 9, 12, 20, 30, 45}
+
+func (i ifModifiedReqType) String() string {
+	if i < 0 || i >= ifModifiedReqType(len(_ifModifiedReqTypeIndex)-1) {
+		return fmt.Sprintf("ifModifiedReqType(%d)", i)
+	}
+	return _ifModifiedReqTypeName[_ifModifiedReqTypeIndex[i]:_ifModifiedReqTypeIndex[i+1]]
+}
+
+var _ifModifiedReqTypeValues = []ifModifiedReqType{0, 1, 2, 3, 4, 5}
+
+var _ifModifiedReqTypeNameToValueMap = map[string]ifModifiedReqType{
+	_ifModifiedReqTypeName[0:7]:   0,
+	_ifModifiedReqTypeName[7:9]:   1,
+	_ifModifiedReqTypeName[9:12]:  2,
+	_ifModifiedReqTypeName[12:20]: 3,
+	_ifModifiedReqTypeName[20:30]: 4,
+	_ifModifiedReqTypeName[30:45]: 5,
+}
+
+// ifModifiedReqTypeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func ifModifiedReqTypeString(s string) (ifModifiedReqType, error) {
+	if val, ok := _ifModifiedReqTypeNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to ifModifiedReqType values", s)
+}
+
+// ifModifiedReqTypeValues returns all values of the enum
+func ifModifiedReqTypeValues() []ifModifiedReqType {
+	return _ifModifiedReqTypeValues
+}
+
+// IsAifModifiedReqType returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i ifModifiedReqType) IsAifModifiedReqType() bool {
+	for _, v := range _ifModifiedReqTypeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/builtin/logical/pki/integration_test.go b/builtin/logical/pki/integration_test.go
index b4550d3f05a..ae109665faa 100644
--- a/builtin/logical/pki/integration_test.go
+++ b/builtin/logical/pki/integration_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -480,6 +480,87 @@ func TestIntegration_AutoIssuer(t *testing.T) {
 	require.Equal(t, issuerIdOneReimported, resp.Data["default"])
 }
 
+// TestLDAPAiaCrlUrls validates we can properly handle CRL urls that are ldap based.
+func TestLDAPAiaCrlUrls(t *testing.T) {
+	t.Parallel()
+
+	coreConfig := &vault.CoreConfig{
+		LogicalBackends: map[string]logical.Factory{
+			"pki": Factory,
+		},
+	}
+	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
+		NumCores:    1,
+		HandlerFunc: vaulthttp.Handler,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+	singleCore := cluster.Cores[0]
+	vault.TestWaitActive(t, singleCore.Core)
+	client := singleCore.Client
+
+	mountPKIEndpoint(t, client, "pki")
+
+	// Attempt multiple urls
+	crls := []string{
+		"ldap://ldap.example.com/cn=example%20CA,dc=example,dc=com?certificateRevocationList;binary",
+		"ldap://ldap.example.com/cn=CA,dc=example,dc=com?authorityRevocationList;binary",
+	}
+
+	_, err := client.Logical().Write("pki/config/urls", map[string]interface{}{
+		"crl_distribution_points": crls,
+	})
+	require.NoError(t, err)
+
+	resp, err := client.Logical().Read("pki/config/urls")
+	require.NoError(t, err, "failed reading config/urls")
+	require.NotNil(t, resp, "resp was nil")
+	require.NotNil(t, resp.Data, "data within response was nil")
+	require.NotEmpty(t, resp.Data["crl_distribution_points"], "crl_distribution_points was nil within data")
+	require.Len(t, resp.Data["crl_distribution_points"], len(crls))
+
+	for _, crlVal := range crls {
+		require.Contains(t, resp.Data["crl_distribution_points"], crlVal)
+	}
+
+	resp, err = client.Logical().Write("pki/root/generate/internal", map[string]interface{}{
+		"ttl":         "40h",
+		"common_name": "Root R1",
+		"key_type":    "ec",
+	})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotNil(t, resp.Data)
+	require.NotEmpty(t, resp.Data["issuer_id"])
+	rootIssuerId := resp.Data["issuer_id"].(string)
+
+	_, err = client.Logical().Write("pki/roles/example-root", map[string]interface{}{
+		"allowed_domains":  "example.com",
+		"allow_subdomains": "true",
+		"max_ttl":          "1h",
+		"key_type":         "ec",
+		"issuer_ref":       rootIssuerId,
+	})
+	require.NoError(t, err)
+
+	resp, err = client.Logical().Write("pki/issue/example-root", map[string]interface{}{
+		"common_name": "test.example.com",
+		"ttl":         "5m",
+	})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotNil(t, resp.Data)
+	require.NotEmpty(t, resp.Data["certificate"])
+
+	certPEM := resp.Data["certificate"].(string)
+	certBlock, _ := pem.Decode([]byte(certPEM))
+	require.NotNil(t, certBlock)
+	cert, err := x509.ParseCertificate(certBlock.Bytes)
+	require.NoError(t, err)
+
+	require.EqualValues(t, crls, cert.CRLDistributionPoints)
+}
+
 func TestIntegrationOCSPClientWithPKI(t *testing.T) {
 	t.Parallel()
 
@@ -630,9 +711,6 @@ func TestIntegrationOCSPClientWithPKI(t *testing.T) {
 			return testLogger
 		}, 10)
 
-		err = ocspClient.VerifyLeafCertificate(context.Background(), cert, issuer, conf)
-		require.NoError(t, err)
-
 		_, err = client.Logical().Write("pki/revoke", map[string]interface{}{
 			"serial_number": serialNumber,
 		})
@@ -640,6 +718,7 @@ func TestIntegrationOCSPClientWithPKI(t *testing.T) {
 
 		err = ocspClient.VerifyLeafCertificate(context.Background(), cert, issuer, conf)
 		require.Error(t, err)
+		require.Contains(t, err.Error(), serialNumber, "Expected revoked serial number to appear in err")
 	}
 }
 
diff --git a/builtin/logical/pki/issuing/aia.go b/builtin/logical/pki/issuing/aia.go
index 4c05c4231d7..70567647b9d 100644
--- a/builtin/logical/pki/issuing/aia.go
+++ b/builtin/logical/pki/issuing/aia.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package issuing
@@ -6,9 +6,10 @@ package issuing
 import (
 	"context"
 	"fmt"
+	"net/url"
 	"strings"
+	"unicode/utf8"
 
-	"github.com/asaskevich/govalidator"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -16,10 +17,11 @@ import (
 const ClusterConfigPath = "config/cluster"
 
 type AiaConfigEntry struct {
-	IssuingCertificates   []string `json:"issuing_certificates"`
-	CRLDistributionPoints []string `json:"crl_distribution_points"`
-	OCSPServers           []string `json:"ocsp_servers"`
-	EnableTemplating      bool     `json:"enable_templating"`
+	IssuingCertificates        []string `json:"issuing_certificates"`
+	CRLDistributionPoints      []string `json:"crl_distribution_points"`
+	DeltaCRLDistributionPoints []string `json:"delta_crl_distribution_points"`
+	OCSPServers                []string `json:"ocsp_servers"`
+	EnableTemplating           bool     `json:"enable_templating"`
 }
 
 type ClusterConfigEntry struct {
@@ -33,7 +35,8 @@ func GetAIAURLs(ctx context.Context, s logical.Storage, i *IssuerEntry) (*certut
 
 	// If none are set (either due to a nil entry or because no URLs have
 	// been provided), fall back to the global AIA URL config.
-	if entries == nil || (len(entries.IssuingCertificates) == 0 && len(entries.CRLDistributionPoints) == 0 && len(entries.OCSPServers) == 0) {
+	if entries == nil || (len(entries.IssuingCertificates) == 0 && len(entries.CRLDistributionPoints) == 0 &&
+		len(entries.OCSPServers) == 0) && len(entries.DeltaCRLDistributionPoints) == 0 {
 		var err error
 
 		entries, err = GetGlobalAIAURLs(ctx, s)
@@ -56,10 +59,11 @@ func GetGlobalAIAURLs(ctx context.Context, storage logical.Storage) (*AiaConfigE
 	}
 
 	entries := &AiaConfigEntry{
-		IssuingCertificates:   []string{},
-		CRLDistributionPoints: []string{},
-		OCSPServers:           []string{},
-		EnableTemplating:      false,
+		IssuingCertificates:        []string{},
+		CRLDistributionPoints:      []string{},
+		DeltaCRLDistributionPoints: []string{},
+		OCSPServers:                []string{},
+		EnableTemplating:           false,
 	}
 
 	if entry == nil {
@@ -74,14 +78,15 @@ func GetGlobalAIAURLs(ctx context.Context, storage logical.Storage) (*AiaConfigE
 }
 
 func ToURLEntries(ctx context.Context, s logical.Storage, issuer IssuerID, c *AiaConfigEntry) (*certutil.URLEntries, error) {
-	if len(c.IssuingCertificates) == 0 && len(c.CRLDistributionPoints) == 0 && len(c.OCSPServers) == 0 {
+	if len(c.IssuingCertificates) == 0 && len(c.CRLDistributionPoints) == 0 && len(c.OCSPServers) == 0 && len(c.DeltaCRLDistributionPoints) == 0 {
 		return &certutil.URLEntries{}, nil
 	}
 
 	result := certutil.URLEntries{
-		IssuingCertificates:   c.IssuingCertificates[:],
-		CRLDistributionPoints: c.CRLDistributionPoints[:],
-		OCSPServers:           c.OCSPServers[:],
+		IssuingCertificates:        c.IssuingCertificates[:],
+		CRLDistributionPoints:      c.CRLDistributionPoints[:],
+		DeltaCRLDistributionPoints: c.DeltaCRLDistributionPoints[:],
+		OCSPServers:                c.OCSPServers[:],
 	}
 
 	if c.EnableTemplating {
@@ -91,9 +96,10 @@ func ToURLEntries(ctx context.Context, s logical.Storage, issuer IssuerID, c *Ai
 		}
 
 		for name, source := range map[string]*[]string{
-			"issuing_certificates":    &result.IssuingCertificates,
-			"crl_distribution_points": &result.CRLDistributionPoints,
-			"ocsp_servers":            &result.OCSPServers,
+			"issuing_certificates":          &result.IssuingCertificates,
+			"crl_distribution_points":       &result.CRLDistributionPoints,
+			"delta_crl_distribution_points": &result.DeltaCRLDistributionPoints,
+			"ocsp_servers":                  &result.OCSPServers,
 		} {
 			templated := make([]string, len(*source))
 			for index, uri := range *source {
@@ -145,10 +151,39 @@ func GetClusterConfig(ctx context.Context, s logical.Storage) (*ClusterConfigEnt
 
 func ValidateURLs(urls []string) string {
 	for _, curr := range urls {
-		if !govalidator.IsURL(curr) || strings.Contains(curr, "{{issuer_id}}") || strings.Contains(curr, "{{cluster_path}}") || strings.Contains(curr, "{{cluster_aia_path}}") {
+		if !isURL(curr) || strings.Contains(curr, "{{issuer_id}}") || strings.Contains(curr, "{{cluster_path}}") || strings.Contains(curr, "{{cluster_aia_path}}") {
 			return curr
 		}
 	}
 
 	return ""
 }
+
+const (
+	maxURLRuneCount = 2083
+	minURLRuneCount = 3
+)
+
+// IsURL checks if the string is an URL.
+func isURL(str string) bool {
+	if str == "" || utf8.RuneCountInString(str) >= maxURLRuneCount || len(str) <= minURLRuneCount || strings.HasPrefix(str, ".") {
+		return false
+	}
+	strTemp := str
+	if strings.Contains(str, ":") && !strings.Contains(str, "://") {
+		// support no indicated urlscheme but with colon for port number
+		// http:// is appended so url.Parse will succeed, strTemp used so it does not impact rxURL.MatchString
+		strTemp = "http://" + str
+	}
+	u, err := url.ParseRequestURI(strTemp)
+	if err != nil {
+		return false
+	}
+	if strings.HasPrefix(u.Host, ".") {
+		return false
+	}
+	if u.Host == "" && (u.Path != "" && !strings.Contains(u.Path, ".")) {
+		return false
+	}
+	return true
+}
diff --git a/builtin/logical/pki/issuing/cert_verify.go b/builtin/logical/pki/issuing/cert_verify.go
new file mode 100644
index 00000000000..6f2af5ad90f
--- /dev/null
+++ b/builtin/logical/pki/issuing/cert_verify.go
@@ -0,0 +1,61 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package issuing
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strconv"
+
+	ctx509 "github.com/google/certificate-transparency-go/x509"
+	"github.com/hashicorp/vault/sdk/helper/certutil"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// disableVerifyCertificateEnvVar is an environment variable that can be used to disable the
+// verification done when issuing or signing certificates that was added by VAULT-22013. It
+// is meant as a scape hatch to avoid breaking deployments that the new verification would
+// break.
+const disableVerifyCertificateEnvVar = "VAULT_DISABLE_PKI_CONSTRAINTS_VERIFICATION"
+
+func isCertificateVerificationDisabled() (bool, error) {
+	disableRaw, ok := os.LookupEnv(disableVerifyCertificateEnvVar)
+	if !ok {
+		return false, nil
+	}
+
+	disable, err := strconv.ParseBool(disableRaw)
+	if err != nil {
+		return false, fmt.Errorf("failed parsing environment variable %s: %w", disableVerifyCertificateEnvVar, err)
+	}
+
+	return disable, nil
+}
+
+func VerifyCertificate(ctx context.Context, storage logical.Storage, issuerId IssuerID, parsedBundle *certutil.ParsedCertBundle) error {
+	if verificationDisabled, err := isCertificateVerificationDisabled(); err != nil {
+		return err
+	} else if verificationDisabled {
+		return nil
+	}
+
+	// Note that we use github.com/google/certificate-transparency-go/x509 to perform certificate verification,
+	// since that library provides options to disable checks that the standard library does not.
+	options := ctx509.VerifyOptions{
+		KeyUsages:                      nil,
+		MaxConstraintComparisions:      0, // Use the library's 'sensible default'
+		DisableTimeChecks:              true,
+		DisableEKUChecks:               true,
+		DisableCriticalExtensionChecks: false,
+		DisableNameChecks:              false,
+		DisablePathLenChecks:           false,
+		DisableNameConstraintChecks:    false,
+	}
+	if err := entSetCertVerifyOptions(ctx, storage, issuerId, &options); err != nil {
+		return err
+	}
+
+	return certutil.VerifyCertificate(parsedBundle, options)
+}
diff --git a/builtin/logical/pki/issuing/config_issuer.go b/builtin/logical/pki/issuing/config_issuer.go
index aa9e10ec739..c6042691d0d 100644
--- a/builtin/logical/pki/issuing/config_issuer.go
+++ b/builtin/logical/pki/issuing/config_issuer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package issuing
diff --git a/builtin/logical/pki/issuing/config_key.go b/builtin/logical/pki/issuing/config_key.go
index b0526a25c6f..74afd647ceb 100644
--- a/builtin/logical/pki/issuing/config_key.go
+++ b/builtin/logical/pki/issuing/config_key.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package issuing
diff --git a/builtin/logical/pki/issuing/config_revocation.go b/builtin/logical/pki/issuing/config_revocation.go
index c1f8ff0ee07..416e5b6fbab 100644
--- a/builtin/logical/pki/issuing/config_revocation.go
+++ b/builtin/logical/pki/issuing/config_revocation.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package issuing
@@ -143,7 +143,7 @@ func _cleanupInternalCRLMapping(ctx context.Context, s logical.Storage, mapping
 	// Depending on which path we're writing this config to, we need to
 	// remove CRLs from the relevant folder too.
 	isLocal := path == StorageLocalCRLConfig
-	baseCRLPath := "crls/"
+	baseCRLPath := PathCrls
 	if !isLocal {
 		baseCRLPath = "unified-crls/"
 	}
diff --git a/builtin/logical/pki/issuing/context.go b/builtin/logical/pki/issuing/context.go
new file mode 100644
index 00000000000..85b5e702f7f
--- /dev/null
+++ b/builtin/logical/pki/issuing/context.go
@@ -0,0 +1,22 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package issuing
+
+import "context"
+
+// IssuerRoleContext combines in a single struct an issuer and a role that we should
+// leverage to issue a certificate along with the
+type IssuerRoleContext struct {
+	context.Context
+	Role   *RoleEntry
+	Issuer *IssuerEntry
+}
+
+func NewIssuerRoleContext(ctx context.Context, issuer *IssuerEntry, role *RoleEntry) IssuerRoleContext {
+	return IssuerRoleContext{
+		Context: ctx,
+		Role:    role,
+		Issuer:  issuer,
+	}
+}
diff --git a/builtin/logical/pki/issuing/issue_common.go b/builtin/logical/pki/issuing/issue_common.go
index e9a496258c5..057a69ce4f1 100644
--- a/builtin/logical/pki/issuing/issue_common.go
+++ b/builtin/logical/pki/issuing/issue_common.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package issuing
@@ -17,7 +17,6 @@ import (
 
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/builtin/logical/pki/parsing"
-	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
@@ -26,6 +25,12 @@ import (
 	"golang.org/x/net/idna"
 )
 
+const (
+	PathCerts        = "certs/"
+	PathCertMetadata = "cert-metadata/"
+	PathCrls         = "crls/"
+)
+
 var (
 	// labelRegex is a single label from a valid domain name and was extracted
 	// from hostnameRegex below for use in leftWildLabelRegex, without any
@@ -58,6 +63,12 @@ type EntityInfo struct {
 	EntityID    string
 }
 
+type CertificateCounter interface {
+	IsInitialized() bool
+	IncrementTotalCertificatesCount(certsCounted bool, newSerial string)
+	IncrementTotalRevokedCertificatesCount(certsCounted bool, newSerial string)
+}
+
 func NewEntityInfoFromReq(req *logical.Request) EntityInfo {
 	if req == nil {
 		return EntityInfo{}
@@ -80,6 +91,7 @@ type CreationBundleInput interface {
 	GetOptionalSkid() (interface{}, bool)
 	IsUserIdInSchema() (interface{}, bool)
 	GetUserIds() []string
+	IgnoreCSRSignature() bool
 }
 
 // GenerateCreationBundle is a shared function that reads parameters supplied
@@ -106,8 +118,15 @@ func GenerateCreationBundle(b logical.SystemView, role *RoleEntry, entityInfo En
 		ridSerialNumber = cb.GetSerialNumber()
 
 		// only take serial number from CSR if one was not supplied via API
-		if ridSerialNumber == "" && csr != nil {
-			ridSerialNumber = csr.Subject.SerialNumber
+		switch role.SerialNumberSource {
+		case "", "json-csr":
+			if ridSerialNumber == "" && csr != nil {
+				ridSerialNumber = csr.Subject.SerialNumber
+			}
+		case "json":
+			// use the value from cb set above
+		default:
+			return nil, nil, errutil.UserError{Err: "invalid value for serial_number_source"}
 		}
 
 		if csr != nil && role.UseCSRSANs {
@@ -417,6 +436,7 @@ func GenerateCreationBundle(b logical.SystemView, role *RoleEntry, entityInfo En
 			NotBeforeDuration:             role.NotBeforeDuration,
 			ForceAppendCaChain:            caSign != nil,
 			SKID:                          skid,
+			IgnoreCSRSignature:            cb.IgnoreCSRSignature(),
 		},
 		SigningBundle: caSign,
 		CSR:           csr,
@@ -995,7 +1015,7 @@ func ApplyIssuerLeafNotAfterBehavior(caSign *certutil.CAInfoBundle, notAfter tim
 			// Explicitly do nothing.
 		case certutil.TruncateNotAfterBehavior:
 			notAfter = caSign.Certificate.NotAfter
-		case certutil.ErrNotAfterBehavior:
+		case certutil.ErrNotAfterBehavior, certutil.AlwaysEnforceErr:
 			fallthrough
 		default:
 			return time.Time{}, errutil.UserError{Err: fmt.Sprintf(
@@ -1006,9 +1026,9 @@ func ApplyIssuerLeafNotAfterBehavior(caSign *certutil.CAInfoBundle, notAfter tim
 }
 
 // StoreCertificate given a certificate bundle that was signed, persist the certificate to storage
-func StoreCertificate(ctx context.Context, s logical.Storage, certCounter pki_backend.CertificateCounter, certBundle *certutil.ParsedCertBundle) error {
+func StoreCertificate(ctx context.Context, s logical.Storage, certCounter CertificateCounter, certBundle *certutil.ParsedCertBundle) error {
 	hyphenSerialNumber := parsing.NormalizeSerialForStorageFromBigInt(certBundle.Certificate.SerialNumber)
-	key := "certs/" + hyphenSerialNumber
+	key := PathCerts + hyphenSerialNumber
 	certsCounted := certCounter.IsInitialized()
 	err := s.Put(ctx, &logical.StorageEntry{
 		Key:   key,
diff --git a/builtin/logical/pki/issuing/issuers.go b/builtin/logical/pki/issuing/issuers.go
index a3e36581579..cc497f14ec2 100644
--- a/builtin/logical/pki/issuing/issuers.go
+++ b/builtin/logical/pki/issuing/issuers.go
@@ -1,9 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package issuing
 
 import (
+	"bytes"
 	"context"
 	"crypto/x509"
 	"fmt"
@@ -43,6 +44,13 @@ const (
 	LegacyCertBundlePath  = "config/ca_bundle"
 	LegacyBundleShimID    = IssuerID("legacy-entry-shim-id")
 	LegacyBundleShimKeyID = KeyID("legacy-entry-shim-key-id")
+
+	LegacyCRLPath        = "crl"
+	DeltaCRLPath         = "delta-crl"
+	DeltaCRLPathSuffix   = "-delta"
+	UnifiedCRLPath       = "unified-crl"
+	UnifiedDeltaCRLPath  = "unified-delta-crl"
+	UnifiedCRLPathPrefix = "unified-"
 )
 
 type IssuerID string
@@ -129,10 +137,13 @@ type IssuerEntry struct {
 	AIAURIs              *AiaConfigEntry           `json:"aia_uris,omitempty"`
 	LastModified         time.Time                 `json:"last_modified"`
 	Version              uint                      `json:"version"`
+	entIssuerEntry
 }
 
+// GetCertificate returns a x509.Certificate of the CA certificate
+// represented by this issuer.
 func (i IssuerEntry) GetCertificate() (*x509.Certificate, error) {
-	cert, err := parsing.ParseCertificateFromBytes([]byte(i.Certificate))
+	cert, err := parsing.ParseCertificateFromString(i.Certificate)
 	if err != nil {
 		return nil, errutil.InternalError{Err: fmt.Sprintf("unable to parse certificate from issuer: %s: %v", err.Error(), i.ID)}
 	}
@@ -140,6 +151,32 @@ func (i IssuerEntry) GetCertificate() (*x509.Certificate, error) {
 	return cert, nil
 }
 
+// GetFullCaChain returns a slice of x509.Certificate values of this issuer full ca chain,
+// which starts with the CA certificate represented by this issuer followed by the entire CA chain
+func (i IssuerEntry) GetFullCaChain() ([]*x509.Certificate, error) {
+	var chains []*x509.Certificate
+	issuerCert, err := i.GetCertificate()
+	if err != nil {
+		return nil, err
+	}
+
+	chains = append(chains, issuerCert)
+
+	for rangeI, chainVal := range i.CAChain {
+		parsedChainVal, err := parsing.ParseCertificateFromString(chainVal)
+		if err != nil {
+			return nil, fmt.Errorf("error parsing issuer %s ca chain index value [%d]: %w", i.ID, rangeI, err)
+		}
+
+		if bytes.Equal(parsedChainVal.Raw, issuerCert.Raw) {
+			continue
+		}
+		chains = append(chains, parsedChainVal)
+	}
+
+	return chains, nil
+}
+
 func (i IssuerEntry) EnsureUsage(usage IssuerUsage) error {
 	// We want to spit out a nice error message about missing usages.
 	if i.Usage.HasUsage(usage) {
@@ -209,6 +246,29 @@ func (i IssuerEntry) CanMaybeSignWithAlgo(algo x509.SignatureAlgorithm) error {
 	return fmt.Errorf("unable to use issuer of type %v to sign with %v key type", cert.PublicKeyAlgorithm.String(), algo.String())
 }
 
+// ResolveAndFetchIssuerForIssuance takes a name or uuid referencing an issuer, loads the issuer
+// and validates that we have the associated private key and is allowed to perform issuance operations.
+func ResolveAndFetchIssuerForIssuance(ctx context.Context, s logical.Storage, issuerName string) (*IssuerEntry, error) {
+	if len(issuerName) == 0 {
+		return nil, fmt.Errorf("unable to fetch pki issuer: empty issuer name")
+	}
+	issuerId, err := ResolveIssuerReference(ctx, s, issuerName)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve issuer %s: %w", issuerName, err)
+	}
+
+	issuer, err := FetchIssuerById(ctx, s, issuerId)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load issuer %s: %w", issuerName, err)
+	}
+
+	if issuer.Usage.HasUsage(IssuanceUsage) && len(issuer.KeyID) > 0 {
+		return issuer, nil
+	}
+
+	return nil, fmt.Errorf("issuer %s missing proper issuance usage or doesn't have associated key", issuerName)
+}
+
 func ResolveIssuerReference(ctx context.Context, s logical.Storage, reference string) (IssuerID, error) {
 	if reference == DefaultRef {
 		// Handle fetching the default issuer.
@@ -492,3 +552,38 @@ func GetLegacyCertBundle(ctx context.Context, s logical.Storage) (*IssuerEntry,
 
 	return issuer, cb, nil
 }
+
+func ResolveIssuerCRLPath(ctx context.Context, storage logical.Storage, useLegacyBundleCaStorage bool, reference string, unified bool) (string, error) {
+	if useLegacyBundleCaStorage {
+		return "crl", nil
+	}
+
+	issuer, err := ResolveIssuerReference(ctx, storage, reference)
+	if err != nil {
+		return "crl", err
+	}
+
+	var crlConfig *InternalCRLConfigEntry
+	if unified {
+		crlConfig, err = GetUnifiedCRLConfig(ctx, storage)
+		if err != nil {
+			return "crl", err
+		}
+	} else {
+		crlConfig, err = GetLocalCRLConfig(ctx, storage)
+		if err != nil {
+			return "crl", err
+		}
+	}
+
+	if crlId, ok := crlConfig.IssuerIDCRLMap[issuer]; ok && len(crlId) > 0 {
+		path := fmt.Sprintf("crls/%v", crlId)
+		if unified {
+			path = ("unified-") + path
+		}
+
+		return path, nil
+	}
+
+	return "crl", fmt.Errorf("unable to find CRL for issuer: id:%v/ref:%v", issuer, reference)
+}
diff --git a/builtin/logical/pki/issuing/issuers_oss.go b/builtin/logical/pki/issuing/issuers_oss.go
new file mode 100644
index 00000000000..6f665c2dfb8
--- /dev/null
+++ b/builtin/logical/pki/issuing/issuers_oss.go
@@ -0,0 +1,8 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package issuing
+
+type entIssuerEntry struct{}
diff --git a/builtin/logical/pki/issuing/issuing_stubs_oss.go b/builtin/logical/pki/issuing/issuing_stubs_oss.go
new file mode 100644
index 00000000000..ebbb550cb7d
--- /dev/null
+++ b/builtin/logical/pki/issuing/issuing_stubs_oss.go
@@ -0,0 +1,19 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package issuing
+
+import (
+	"context"
+
+	ctx509 "github.com/google/certificate-transparency-go/x509"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+//go:generate go run github.com/hashicorp/vault/tools/stubmaker
+
+func entSetCertVerifyOptions(ctx context.Context, storage logical.Storage, issuerId IssuerID, options *ctx509.VerifyOptions) error {
+	return nil
+}
diff --git a/builtin/logical/pki/issuing/keys.go b/builtin/logical/pki/issuing/keys.go
index 0e703ddc6ca..1a4999fd252 100644
--- a/builtin/logical/pki/issuing/keys.go
+++ b/builtin/logical/pki/issuing/keys.go
@@ -1,10 +1,12 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package issuing
 
 import (
 	"context"
+	"crypto"
+	"encoding/pem"
 	"fmt"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/managed_key"
@@ -150,3 +152,34 @@ func GetManagedKeyUUID(key *KeyEntry) (managed_key.UUIDKey, error) {
 	}
 	return managed_key.ExtractManagedKeyId([]byte(key.PrivateKey))
 }
+
+func GetSignerFromKeyEntry(ctx context.Context, mkv managed_key.PkiManagedKeyView, keyEntry *KeyEntry) (crypto.Signer, certutil.PrivateKeyType, error) {
+	if keyEntry.PrivateKeyType == certutil.UnknownPrivateKey {
+		return nil, certutil.UnknownPrivateKey, fmt.Errorf("unsupported unknown private key type for key: %s (%s)", keyEntry.ID, keyEntry.Name)
+	}
+
+	if keyEntry.IsManagedPrivateKey() {
+		managedKeyId, err := GetManagedKeyUUID(keyEntry)
+		if err != nil {
+			return nil, certutil.UnknownPrivateKey, fmt.Errorf("unable to get managed key uuid: %w", err)
+		}
+		bundle, actualKeyType, err := managed_key.CreateKmsKeyBundle(ctx, mkv, managedKeyId)
+		if err != nil {
+			return nil, certutil.UnknownPrivateKey, fmt.Errorf("failed to create kms key bundle from managed key uuid %s: %w", managedKeyId, err)
+		}
+
+		// The bundle's PrivateKeyType value is set to a ManagedKeyType so use the actual key type value
+		return bundle.PrivateKey, actualKeyType, nil
+	}
+
+	pemBlock, _ := pem.Decode([]byte(keyEntry.PrivateKey))
+	if pemBlock == nil {
+		return nil, certutil.UnknownPrivateKey, fmt.Errorf("no data found in PEM block")
+	}
+
+	signer, _, err := certutil.ParseDERKey(pemBlock.Bytes)
+	if err != nil {
+		return nil, certutil.UnknownPrivateKey, fmt.Errorf("failed to parse PEM block: %w", err)
+	}
+	return signer, keyEntry.PrivateKeyType, nil
+}
diff --git a/builtin/logical/pki/issuing/roles.go b/builtin/logical/pki/issuing/roles.go
index 86b15c2df1e..278628282a6 100644
--- a/builtin/logical/pki/issuing/roles.go
+++ b/builtin/logical/pki/issuing/roles.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package issuing
@@ -53,6 +53,7 @@ type RoleEntry struct {
 	EmailProtectionFlag           bool          `json:"email_protection_flag"`
 	UseCSRCommonName              bool          `json:"use_csr_common_name"`
 	UseCSRSANs                    bool          `json:"use_csr_sans"`
+	SerialNumberSource            string        `json:"serial_number_source"`
 	KeyType                       string        `json:"key_type"`
 	KeyBits                       int           `json:"key_bits"`
 	UsePSS                        bool          `json:"use_pss"`
@@ -72,6 +73,7 @@ type RoleEntry struct {
 	PostalCode                    []string      `json:"postal_code"`
 	GenerateLease                 *bool         `json:"generate_lease,omitempty"`
 	NoStore                       bool          `json:"no_store"`
+	NoStoreMetadata               bool          `json:"no_store_metadata"`
 	RequireCN                     bool          `json:"require_cn"`
 	CNValidations                 []string      `json:"cn_validations"`
 	AllowedOtherSANs              []string      `json:"allowed_other_sans"`
@@ -113,6 +115,7 @@ func (r *RoleEntry) ToResponseData() map[string]interface{} {
 		"email_protection_flag":              r.EmailProtectionFlag,
 		"use_csr_common_name":                r.UseCSRCommonName,
 		"use_csr_sans":                       r.UseCSRSANs,
+		"serial_number_source":               r.SerialNumberSource,
 		"key_type":                           r.KeyType,
 		"key_bits":                           r.KeyBits,
 		"signature_bits":                     r.SignatureBits,
@@ -146,6 +149,7 @@ func (r *RoleEntry) ToResponseData() map[string]interface{} {
 	if r.GenerateLease != nil {
 		responseData["generate_lease"] = r.GenerateLease
 	}
+	AddNoStoreMetadata(responseData, r)
 	return responseData
 }
 
@@ -374,6 +378,7 @@ func SignVerbatimRoleWithOpts(opts ...RoleModifier) *RoleEntry {
 		KeyType:                   "any",
 		UseCSRCommonName:          true,
 		UseCSRSANs:                true,
+		SerialNumberSource:        "json-csr",
 		AllowedOtherSANs:          []string{"*"},
 		AllowedSerialNumbers:      []string{"*"},
 		AllowedURISANs:            []string{"*"},
diff --git a/builtin/logical/pki/issuing/roles_metadata_stubs_oss.go b/builtin/logical/pki/issuing/roles_metadata_stubs_oss.go
new file mode 100644
index 00000000000..2ac89e52325
--- /dev/null
+++ b/builtin/logical/pki/issuing/roles_metadata_stubs_oss.go
@@ -0,0 +1,34 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package issuing
+
+//go:generate go run github.com/hashicorp/vault/tools/stubmaker
+
+import "github.com/hashicorp/vault/sdk/framework"
+
+func AddNoStoreMetadata(roleData map[string]interface{}, r *RoleEntry) {
+	return
+}
+
+func WithNoStoreMetadata(noStoreMetadata bool) RoleModifier {
+	return func(r *RoleEntry) {
+		r.NoStoreMetadata = true
+	}
+}
+
+const MetadataPermitted = false
+
+func AddNoStoreMetadataRoleField(fields map[string]*framework.FieldSchema) map[string]*framework.FieldSchema {
+	return fields
+}
+
+func GetNoStoreMetadata(data *framework.FieldData) bool {
+	return true
+}
+
+func NoStoreMetadataValue(value bool) bool {
+	return true
+}
diff --git a/builtin/logical/pki/issuing/sign_cert.go b/builtin/logical/pki/issuing/sign_cert.go
index 773e8b2a96d..46f1af96528 100644
--- a/builtin/logical/pki/issuing/sign_cert.go
+++ b/builtin/logical/pki/issuing/sign_cert.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package issuing
@@ -9,6 +9,7 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"fmt"
+	"net"
 
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
@@ -21,22 +22,35 @@ type SignCertInput interface {
 	IsCA() bool
 	UseCSRValues() bool
 	GetPermittedDomains() []string
+	GetExcludedDomains() []string
+	GetPermittedIpRanges() ([]*net.IPNet, error)
+	GetExcludedIpRanges() ([]*net.IPNet, error)
+	GetPermittedEmailAddresses() []string
+	GetExcludedEmailAddresses() []string
+	GetPermittedUriDomains() []string
+	GetExcludedUriDomains() []string
 }
 
-func NewBasicSignCertInput(csr *x509.CertificateRequest, isCA bool, useCSRValues bool) BasicSignCertInput {
+func NewBasicSignCertInput(csr *x509.CertificateRequest, isCA, useCSRValues bool) BasicSignCertInput {
+	return NewBasicSignCertInputWithIgnore(csr, isCA, useCSRValues, false)
+}
+
+func NewBasicSignCertInputWithIgnore(csr *x509.CertificateRequest, isCA, useCSRValues, ignoreCsrSignature bool) BasicSignCertInput {
 	return BasicSignCertInput{
-		isCA:         isCA,
-		useCSRValues: useCSRValues,
-		csr:          csr,
+		isCA:               isCA,
+		useCSRValues:       useCSRValues,
+		csr:                csr,
+		ignoreCsrSignature: ignoreCsrSignature,
 	}
 }
 
 var _ SignCertInput = BasicSignCertInput{}
 
 type BasicSignCertInput struct {
-	isCA         bool
-	useCSRValues bool
-	csr          *x509.CertificateRequest
+	isCA               bool
+	useCSRValues       bool
+	csr                *x509.CertificateRequest
+	ignoreCsrSignature bool
 }
 
 func (b BasicSignCertInput) GetTTL() int {
@@ -91,6 +105,10 @@ func (b BasicSignCertInput) GetCSR() (*x509.CertificateRequest, error) {
 	return b.csr, nil
 }
 
+func (b BasicSignCertInput) IgnoreCSRSignature() bool {
+	return b.ignoreCsrSignature
+}
+
 func (b BasicSignCertInput) IsCA() bool {
 	return b.isCA
 }
@@ -103,6 +121,38 @@ func (b BasicSignCertInput) GetPermittedDomains() []string {
 	return []string{}
 }
 
+func (b BasicSignCertInput) GetExcludedDomains() []string {
+	return []string{}
+}
+
+// GetPermittedIpRanges returns the permitted IP ranges for the name constraints extension.
+// ignore-nil-nil-function-check
+func (b BasicSignCertInput) GetPermittedIpRanges() ([]*net.IPNet, error) {
+	return nil, nil
+}
+
+// GetExcludedIpRanges returns the excluded IP ranges for the name constraints extension.
+// ignore-nil-nil-function-check
+func (b BasicSignCertInput) GetExcludedIpRanges() ([]*net.IPNet, error) {
+	return nil, nil
+}
+
+func (b BasicSignCertInput) GetPermittedEmailAddresses() []string {
+	return []string{}
+}
+
+func (b BasicSignCertInput) GetExcludedEmailAddresses() []string {
+	return []string{}
+}
+
+func (b BasicSignCertInput) GetPermittedUriDomains() []string {
+	return []string{}
+}
+
+func (b BasicSignCertInput) GetExcludedUriDomains() []string {
+	return []string{}
+}
+
 func SignCert(b logical.SystemView, role *RoleEntry, entityInfo EntityInfo, caSign *certutil.CAInfoBundle, signInput SignCertInput) (*certutil.ParsedCertBundle, []string, error) {
 	if role == nil {
 		return nil, nil, errutil.InternalError{Err: "no role found in data bundle"}
@@ -274,6 +324,19 @@ func SignCert(b logical.SystemView, role *RoleEntry, entityInfo EntityInfo, caSi
 
 	if signInput.IsCA() {
 		creation.Params.PermittedDNSDomains = signInput.GetPermittedDomains()
+		creation.Params.ExcludedDNSDomains = signInput.GetExcludedDomains()
+		creation.Params.PermittedIPRanges, err = signInput.GetPermittedIpRanges()
+		if err != nil {
+			return nil, nil, errutil.UserError{Err: fmt.Sprintf("error parsinng permitted IP ranges: %v", err)}
+		}
+		creation.Params.ExcludedIPRanges, err = signInput.GetExcludedIpRanges()
+		if err != nil {
+			return nil, nil, errutil.UserError{Err: fmt.Sprintf("error parsinng excluded IP ranges: %v", err)}
+		}
+		creation.Params.PermittedEmailAddresses = signInput.GetPermittedEmailAddresses()
+		creation.Params.ExcludedEmailAddresses = signInput.GetExcludedEmailAddresses()
+		creation.Params.PermittedURIDomains = signInput.GetPermittedUriDomains()
+		creation.Params.ExcludedURIDomains = signInput.GetExcludedUriDomains()
 	} else {
 		for _, ext := range csr.Extensions {
 			if ext.Id.Equal(certutil.ExtensionBasicConstraintsOID) {
diff --git a/builtin/logical/pki/issuing/signing_utils.go b/builtin/logical/pki/issuing/signing_utils.go
new file mode 100644
index 00000000000..1487c31040a
--- /dev/null
+++ b/builtin/logical/pki/issuing/signing_utils.go
@@ -0,0 +1,162 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package issuing
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"errors"
+)
+
+// DER encoded RSA PSS parameters for the
+// SHA256, SHA384, and SHA512 hashes as defined in RFC 3447, Appendix A.2.3.
+// The parameters contain the following values:
+//   - hashAlgorithm contains the associated hash identifier with NULL parameters
+//   - maskGenAlgorithm always contains the default mgf1SHA1 identifier
+//   - saltLength contains the length of the associated hash
+//   - trailerField always contains the default trailerFieldBC value
+var (
+	pssParametersSHA256 = asn1.RawValue{FullBytes: []byte{48, 52, 160, 15, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 1, 5, 0, 161, 28, 48, 26, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 8, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 1, 5, 0, 162, 3, 2, 1, 32}}
+	pssParametersSHA384 = asn1.RawValue{FullBytes: []byte{48, 52, 160, 15, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 2, 5, 0, 161, 28, 48, 26, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 8, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 2, 5, 0, 162, 3, 2, 1, 48}}
+	pssParametersSHA512 = asn1.RawValue{FullBytes: []byte{48, 52, 160, 15, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 3, 5, 0, 161, 28, 48, 26, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 8, 48, 13, 6, 9, 96, 134, 72, 1, 101, 3, 4, 2, 3, 5, 0, 162, 3, 2, 1, 64}}
+)
+
+var (
+	emptyRawValue = asn1.RawValue{}
+
+	oidSignatureMD2WithRSA      = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 2}
+	oidSignatureMD5WithRSA      = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 4}
+	oidSignatureSHA1WithRSA     = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 5}
+	oidSignatureSHA256WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 11}
+	oidSignatureSHA384WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 12}
+	oidSignatureSHA512WithRSA   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 13}
+	oidSignatureRSAPSS          = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 10}
+	oidSignatureDSAWithSHA1     = asn1.ObjectIdentifier{1, 2, 840, 10040, 4, 3}
+	oidSignatureDSAWithSHA256   = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 3, 2}
+	oidSignatureECDSAWithSHA1   = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 1}
+	oidSignatureECDSAWithSHA256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 2}
+	oidSignatureECDSAWithSHA384 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 3}
+	oidSignatureECDSAWithSHA512 = asn1.ObjectIdentifier{1, 2, 840, 10045, 4, 3, 4}
+	oidSignatureEd25519         = asn1.ObjectIdentifier{1, 3, 101, 112}
+	oidISOSignatureSHA1WithRSA  = asn1.ObjectIdentifier{1, 3, 14, 3, 2, 29}
+
+	signatureAlgorithmDetails = []struct {
+		algo       x509.SignatureAlgorithm
+		name       string
+		oid        asn1.ObjectIdentifier
+		params     asn1.RawValue
+		pubKeyAlgo x509.PublicKeyAlgorithm
+		hash       crypto.Hash
+		isRSAPSS   bool
+	}{
+		{x509.MD5WithRSA, "MD5-RSA", oidSignatureMD5WithRSA, asn1.NullRawValue, x509.RSA, crypto.MD5, false},
+		{x509.SHA1WithRSA, "SHA1-RSA", oidSignatureSHA1WithRSA, asn1.NullRawValue, x509.RSA, crypto.SHA1, false},
+		{x509.SHA1WithRSA, "SHA1-RSA", oidISOSignatureSHA1WithRSA, asn1.NullRawValue, x509.RSA, crypto.SHA1, false},
+		{x509.SHA256WithRSA, "SHA256-RSA", oidSignatureSHA256WithRSA, asn1.NullRawValue, x509.RSA, crypto.SHA256, false},
+		{x509.SHA384WithRSA, "SHA384-RSA", oidSignatureSHA384WithRSA, asn1.NullRawValue, x509.RSA, crypto.SHA384, false},
+		{x509.SHA512WithRSA, "SHA512-RSA", oidSignatureSHA512WithRSA, asn1.NullRawValue, x509.RSA, crypto.SHA512, false},
+		{x509.SHA256WithRSAPSS, "SHA256-RSAPSS", oidSignatureRSAPSS, pssParametersSHA256, x509.RSA, crypto.SHA256, true},
+		{x509.SHA384WithRSAPSS, "SHA384-RSAPSS", oidSignatureRSAPSS, pssParametersSHA384, x509.RSA, crypto.SHA384, true},
+		{x509.SHA512WithRSAPSS, "SHA512-RSAPSS", oidSignatureRSAPSS, pssParametersSHA512, x509.RSA, crypto.SHA512, true},
+		{x509.DSAWithSHA1, "DSA-SHA1", oidSignatureDSAWithSHA1, emptyRawValue, x509.DSA, crypto.SHA1, false},
+		{x509.DSAWithSHA256, "DSA-SHA256", oidSignatureDSAWithSHA256, emptyRawValue, x509.DSA, crypto.SHA256, false},
+		{x509.ECDSAWithSHA1, "ECDSA-SHA1", oidSignatureECDSAWithSHA1, emptyRawValue, x509.ECDSA, crypto.SHA1, false},
+		{x509.ECDSAWithSHA256, "ECDSA-SHA256", oidSignatureECDSAWithSHA256, emptyRawValue, x509.ECDSA, crypto.SHA256, false},
+		{x509.ECDSAWithSHA384, "ECDSA-SHA384", oidSignatureECDSAWithSHA384, emptyRawValue, x509.ECDSA, crypto.SHA384, false},
+		{x509.ECDSAWithSHA512, "ECDSA-SHA512", oidSignatureECDSAWithSHA512, emptyRawValue, x509.ECDSA, crypto.SHA512, false},
+		{x509.PureEd25519, "Ed25519", oidSignatureEd25519, emptyRawValue, x509.Ed25519, crypto.Hash(0) /* no pre-hashing */, false},
+	}
+)
+
+// SigningParamsForKey returns the signature algorithm and its Algorithm
+// Identifier to use for signing, based on the key type. If sigAlgo is not zero
+// then it overrides the default.
+// This function is copied from crypto/x509/x509.go in the Go standard library.
+func SigningParamsForKey(key crypto.Signer, sigAlgo x509.SignatureAlgorithm) (x509.SignatureAlgorithm, pkix.AlgorithmIdentifier, error) {
+	var ai pkix.AlgorithmIdentifier
+	var pubType x509.PublicKeyAlgorithm
+	var defaultAlgo x509.SignatureAlgorithm
+
+	switch pub := key.Public().(type) {
+	case *rsa.PublicKey:
+		pubType = x509.RSA
+		defaultAlgo = x509.SHA256WithRSA
+
+	case *ecdsa.PublicKey:
+		pubType = x509.ECDSA
+		switch pub.Curve {
+		case elliptic.P224(), elliptic.P256():
+			defaultAlgo = x509.ECDSAWithSHA256
+		case elliptic.P384():
+			defaultAlgo = x509.ECDSAWithSHA384
+		case elliptic.P521():
+			defaultAlgo = x509.ECDSAWithSHA512
+		default:
+			return 0, ai, errors.New("x509: unsupported elliptic curve")
+		}
+
+	case ed25519.PublicKey:
+		pubType = x509.Ed25519
+		defaultAlgo = x509.PureEd25519
+
+	default:
+		return 0, ai, errors.New("x509: only RSA, ECDSA and Ed25519 keys supported")
+	}
+
+	if sigAlgo == 0 {
+		sigAlgo = defaultAlgo
+	}
+
+	for _, details := range signatureAlgorithmDetails {
+		if details.algo == sigAlgo {
+			if details.pubKeyAlgo != pubType {
+				return 0, ai, errors.New("x509: requested SignatureAlgorithm does not match private key type")
+			}
+			if details.hash == crypto.MD5 {
+				return 0, ai, errors.New("x509: signing with MD5 is not supported")
+			}
+
+			return sigAlgo, pkix.AlgorithmIdentifier{
+				Algorithm:  details.oid,
+				Parameters: details.params,
+			}, nil
+		}
+	}
+
+	return 0, ai, errors.New("x509: unknown SignatureAlgorithm")
+}
+
+func DoesPublicKeyAlgoMatchSignatureAlgo(pubKey x509.PublicKeyAlgorithm, algo x509.SignatureAlgorithm) bool {
+	for _, detail := range signatureAlgorithmDetails {
+		if detail.algo == algo {
+			return pubKey == detail.pubKeyAlgo
+		}
+	}
+
+	return false
+}
+
+func IsRSAPSS(algo x509.SignatureAlgorithm) bool {
+	for _, details := range signatureAlgorithmDetails {
+		if details.algo == algo {
+			return details.isRSAPSS
+		}
+	}
+	return false
+}
+
+func HashFunc(algo x509.SignatureAlgorithm) crypto.Hash {
+	for _, details := range signatureAlgorithmDetails {
+		if details.algo == algo {
+			return details.hash
+		}
+	}
+	return crypto.Hash(0)
+}
diff --git a/builtin/logical/pki/key_util.go b/builtin/logical/pki/key_util.go
index c8538908aaf..e08d01824fe 100644
--- a/builtin/logical/pki/key_util.go
+++ b/builtin/logical/pki/key_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -17,7 +17,7 @@ import (
 )
 
 func comparePublicKey(sc *storageContext, key *issuing.KeyEntry, publicKey crypto.PublicKey) (bool, error) {
-	publicKeyForKeyEntry, err := getPublicKey(sc.Context, sc.Backend, key)
+	publicKeyForKeyEntry, err := getPublicKey(sc.Context, sc.GetPkiManagedView(), key)
 	if err != nil {
 		return false, err
 	}
@@ -25,9 +25,9 @@ func comparePublicKey(sc *storageContext, key *issuing.KeyEntry, publicKey crypt
 	return certutil.ComparePublicKeysAndType(publicKeyForKeyEntry, publicKey)
 }
 
-func getPublicKey(ctx context.Context, b *backend, key *issuing.KeyEntry) (crypto.PublicKey, error) {
+func getPublicKey(ctx context.Context, mkv managed_key.PkiManagedKeyView, key *issuing.KeyEntry) (crypto.PublicKey, error) {
 	if key.PrivateKeyType == certutil.ManagedPrivateKey {
-		return managed_key.GetPublicKeyFromKeyBytes(ctx, b, []byte(key.PrivateKey))
+		return managed_key.GetPublicKeyFromKeyBytes(ctx, mkv, []byte(key.PrivateKey))
 	}
 
 	signer, _, _, err := getSignerFromKeyEntryBytes(key)
diff --git a/builtin/logical/pki/managed_key/common.go b/builtin/logical/pki/managed_key/common.go
index 4637dadb460..54f51dfd8fe 100644
--- a/builtin/logical/pki/managed_key/common.go
+++ b/builtin/logical/pki/managed_key/common.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package managed_key
diff --git a/builtin/logical/pki/managed_key/managed_key_util_oss.go b/builtin/logical/pki/managed_key/managed_key_util_oss.go
index ad92b39c6c1..5e00b2dae62 100644
--- a/builtin/logical/pki/managed_key/managed_key_util_oss.go
+++ b/builtin/logical/pki/managed_key/managed_key_util_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/builtin/logical/pki/metadata.pb.go b/builtin/logical/pki/metadata.pb.go
new file mode 100644
index 00000000000..5dabf1f4aa4
--- /dev/null
+++ b/builtin/logical/pki/metadata.pb.go
@@ -0,0 +1,171 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.5
+// 	protoc        (unknown)
+// source: builtin/logical/pki/metadata.proto
+
+package pki
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type CertificateMetadata struct {
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	IssuerId       string                 `protobuf:"bytes,1,opt,name=issuer_id,json=issuerId,proto3" json:"issuer_id,omitempty"`
+	Role           string                 `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`
+	Expiration     *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expiration,proto3" json:"expiration,omitempty"`
+	ClientMetadata []byte                 `protobuf:"bytes,4,opt,name=client_metadata,json=clientMetadata,proto3,oneof" json:"client_metadata,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *CertificateMetadata) Reset() {
+	*x = CertificateMetadata{}
+	mi := &file_builtin_logical_pki_metadata_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CertificateMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CertificateMetadata) ProtoMessage() {}
+
+func (x *CertificateMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_builtin_logical_pki_metadata_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CertificateMetadata.ProtoReflect.Descriptor instead.
+func (*CertificateMetadata) Descriptor() ([]byte, []int) {
+	return file_builtin_logical_pki_metadata_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CertificateMetadata) GetIssuerId() string {
+	if x != nil {
+		return x.IssuerId
+	}
+	return ""
+}
+
+func (x *CertificateMetadata) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+func (x *CertificateMetadata) GetExpiration() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Expiration
+	}
+	return nil
+}
+
+func (x *CertificateMetadata) GetClientMetadata() []byte {
+	if x != nil {
+		return x.ClientMetadata
+	}
+	return nil
+}
+
+var File_builtin_logical_pki_metadata_proto protoreflect.FileDescriptor
+
+var file_builtin_logical_pki_metadata_proto_rawDesc = string([]byte{
+	0x0a, 0x22, 0x62, 0x75, 0x69, 0x6c, 0x74, 0x69, 0x6e, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61,
+	0x6c, 0x2f, 0x70, 0x6b, 0x69, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x70, 0x6b, 0x69, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc4, 0x01, 0x0a, 0x13, 0x43,
+	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x12, 0x1b, 0x0a, 0x09, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x49, 0x64, 0x12,
+	0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72,
+	0x6f, 0x6c, 0x65, 0x12, 0x3a, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
+	0x61, 0x6d, 0x70, 0x52, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x2c, 0x0a, 0x0f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x0e, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x88, 0x01, 0x01, 0x42, 0x12, 0x0a,
+	0x10, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x42, 0x30, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f,
+	0x62, 0x75, 0x69, 0x6c, 0x74, 0x69, 0x6e, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2f,
+	0x70, 0x6b, 0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
+
+var (
+	file_builtin_logical_pki_metadata_proto_rawDescOnce sync.Once
+	file_builtin_logical_pki_metadata_proto_rawDescData []byte
+)
+
+func file_builtin_logical_pki_metadata_proto_rawDescGZIP() []byte {
+	file_builtin_logical_pki_metadata_proto_rawDescOnce.Do(func() {
+		file_builtin_logical_pki_metadata_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_builtin_logical_pki_metadata_proto_rawDesc), len(file_builtin_logical_pki_metadata_proto_rawDesc)))
+	})
+	return file_builtin_logical_pki_metadata_proto_rawDescData
+}
+
+var file_builtin_logical_pki_metadata_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_builtin_logical_pki_metadata_proto_goTypes = []any{
+	(*CertificateMetadata)(nil),   // 0: pki.CertificateMetadata
+	(*timestamppb.Timestamp)(nil), // 1: google.protobuf.Timestamp
+}
+var file_builtin_logical_pki_metadata_proto_depIdxs = []int32{
+	1, // 0: pki.CertificateMetadata.expiration:type_name -> google.protobuf.Timestamp
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_builtin_logical_pki_metadata_proto_init() }
+func file_builtin_logical_pki_metadata_proto_init() {
+	if File_builtin_logical_pki_metadata_proto != nil {
+		return
+	}
+	file_builtin_logical_pki_metadata_proto_msgTypes[0].OneofWrappers = []any{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_builtin_logical_pki_metadata_proto_rawDesc), len(file_builtin_logical_pki_metadata_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_builtin_logical_pki_metadata_proto_goTypes,
+		DependencyIndexes: file_builtin_logical_pki_metadata_proto_depIdxs,
+		MessageInfos:      file_builtin_logical_pki_metadata_proto_msgTypes,
+	}.Build()
+	File_builtin_logical_pki_metadata_proto = out.File
+	file_builtin_logical_pki_metadata_proto_goTypes = nil
+	file_builtin_logical_pki_metadata_proto_depIdxs = nil
+}
diff --git a/builtin/logical/pki/metadata.proto b/builtin/logical/pki/metadata.proto
new file mode 100644
index 00000000000..4b898fdfb6e
--- /dev/null
+++ b/builtin/logical/pki/metadata.proto
@@ -0,0 +1,17 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+syntax = "proto3";
+
+package pki;
+
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/hashicorp/vault/builtin/logical/pki";
+
+message CertificateMetadata {
+  string issuer_id = 1;
+  string role = 2;
+  google.protobuf.Timestamp expiration = 3;
+  optional bytes client_metadata = 4;
+}
diff --git a/builtin/logical/pki/metadata_oss.go b/builtin/logical/pki/metadata_oss.go
new file mode 100644
index 00000000000..8016cc723ca
--- /dev/null
+++ b/builtin/logical/pki/metadata_oss.go
@@ -0,0 +1,30 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package pki
+
+import (
+	"context"
+	"crypto/x509"
+	"errors"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+var ErrMetadataIsEntOnly = errors.New("certificate metadata is only supported on Vault Enterprise")
+
+func storeCertMetadata(ctx context.Context, storage logical.Storage, issuerId issuing.IssuerID, role string, certificate *x509.Certificate, certMetadata interface{}) error {
+	return ErrMetadataIsEntOnly
+}
+
+func (b *backend) doTidyCertMetadata(ctx context.Context, req *logical.Request, logger hclog.Logger, config *tidyConfig) error {
+	return ErrMetadataIsEntOnly
+}
+
+func validateCertMetadataConfiguration(role *issuing.RoleEntry) error {
+	return ErrMetadataIsEntOnly
+}
diff --git a/builtin/logical/pki/metrics.go b/builtin/logical/pki/metrics.go
index c1c8b528c3e..a8670ae92d8 100644
--- a/builtin/logical/pki/metrics.go
+++ b/builtin/logical/pki/metrics.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -10,6 +10,7 @@ import (
 	"sync/atomic"
 
 	"github.com/armon/go-metrics"
+	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
 )
 
 type CertificateCounter struct {
@@ -185,7 +186,7 @@ func (c *CertificateCounter) IncrementTotalCertificatesCount(certsCounted bool,
 		switch {
 		case !certsCounted:
 			// This is unsafe, but a good best-attempt
-			if strings.HasPrefix(newSerial, "certs/") {
+			if strings.HasPrefix(newSerial, issuing.PathCerts) {
 				newSerial = newSerial[6:]
 			}
 			c.possibleDoubleCountedSerials = append(c.possibleDoubleCountedSerials, newSerial)
diff --git a/builtin/logical/pki/observe/observation_consts.go b/builtin/logical/pki/observe/observation_consts.go
new file mode 100644
index 00000000000..2147c400025
--- /dev/null
+++ b/builtin/logical/pki/observe/observation_consts.go
@@ -0,0 +1,186 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package observe
+
+const (
+	// ---
+	// Generate Root:
+
+	ObservationTypePKIGenerateRoot = "pki/root/generate"
+
+	// ---
+	// Generate Intermediate:
+
+	ObservationTypePKIGenerateIntermediate = "pki/intermediate/generate"
+
+	// ---
+	// Issue + Sign
+
+	// ObservationTypePKIIssue observations will be emitted for both the issue (pki/issue/:name) and
+	// issue-and-sign endpoints (pki/sign/:name). Observations for isssued-and-signed certs will
+	// contain "signed" = true, and unsigned certs will contain "signed" = false.
+	ObservationTypePKIIssue = "pki/issue"
+
+	// ObservationTypePKICIEPSIssue observations will be emitted for both the CIEPS issue and
+	// issue-and-sign endpoints. Observations for issued-and-signed certs will
+	// contain "signed" = true, and unsigned certs will contain "signed" = false.
+	ObservationTypePKICIEPSIssue = "pki/cieps/issue"
+
+	// ---
+	// Issuer Related Observations
+
+	ObservationTypePKIIssuerRead       = "pki/issuer/read"
+	ObservationTypePKIIssuerWrite      = "pki/issuer/write"
+	ObservationTypePKIIssuerPatch      = "pki/issuer/patch"
+	ObservationTypePKIIssuerDelete     = "pki/issuer/delete"
+	ObservationTypePKIIssuerResignCRLs = "pki/issuer/resign-crls"
+	// ObservationTypePKIIssuersImport is emitted when an import happens for issuers.
+	// This can happen via /pki/config/ca, /pki/issuers/import/bundle, /pki/intermediate/set-signed,
+	// and others.
+	ObservationTypePKIIssuersImport = "pki/issuer/import"
+	// ObservationTypePKIConfigIssuersWrite is emitted both for writes to /pki/config/issuers
+	// and /pki/root/replace, as they have the same code path.
+	ObservationTypePKIConfigIssuersWrite = "pki/config/issuers/write"
+	ObservationTypePKIConfigIssuersRead  = "pki/config/issuers/read"
+
+	// ObservationTypePKIReadIssuerCertificate is issued when the issuer's certificate is read,
+	// i.e. the following:
+	// https://developer.hashicorp.com/vault/api-docs/secret/pki#read-issuer-certificate
+	ObservationTypePKIReadIssuerCertificate = "pki/issuer/certificate/read"
+
+	ObservationTypePKIIssuerSignIntermediate = "pki/issuer/sign/intermediate"
+	ObservationTypePKIIssuerSignSelfIssued   = "pki/issuer/sign/self-issued"
+
+	// ---
+	// Role related observations
+
+	ObservationTypePKIRoleRead   = "pki/role/read"
+	ObservationTypePKIRoleWrite  = "pki/role/write"
+	ObservationTypePKIRolePatch  = "pki/role/patch"
+	ObservationTypePKIRoleDelete = "pki/role/delete"
+
+	// ---
+	// Cert metadata
+
+	// ObservationTypePKIReadCertificateMetadata is emitted when /pki/cert-metadata/:serial is called.
+	ObservationTypePKIReadCertificateMetadata = "pki/certificate-metadata/read"
+
+	// ---
+	// Tidy
+
+	// ObservationTypePKITidy is emitted when a tidy operation is accepted, not completed.
+	ObservationTypePKITidy = "pki/tidy"
+
+	// ---
+	// Revoke
+
+	ObservationTypePKIRevoke = "pki/revoke"
+
+	// ---
+	// Rotate CRLs
+
+	// ObservationTypePKIRotateCRL is emitted when pki/crl/rotate is called, which forces a rotation of all issuers' CRLs.
+	ObservationTypePKIRotateCRL = "pki/crl/rotate"
+	// ObservationTypePKIRotateDeltaCRL is emitted when pki/crl/rotate-delta is called, which forces a rotation of all issuers' delta CRLs.
+	ObservationTypePKIRotateDeltaCRL = "pki/crl/rotate-delta"
+
+	// ---
+	// Key Related Observations
+
+	ObservationTypePKIKeysGenerate    = "pki/keys/generate"
+	ObservationTypePKIKeysImport      = "pki/keys/import"
+	ObservationTypePKIConfigKeysWrite = "pki/config/keys/write"
+	ObservationTypePKIConfigKeysRead  = "pki/config/keys/read"
+	ObservationTypePKIKeyRead         = "pki/key/read"
+	ObservationTypePKIKeyWrite        = "pki/key/write"
+	ObservationTypePKIKeyDelete       = "pki/key/delete"
+
+	// ---
+	// OCSP Related Observations
+	// Note that statuses are kept to their values as per https://datatracker.ietf.org/doc/html/rfc6960 and
+	// are not translated to be 'human-readable'. This observation covers both pki/ocsp and pki/unified-ocsp
+	// endpoints, returning a "unified" boolean in the body.
+
+	ObservationTypePKIOCSP = "pki/ocsp"
+
+	// ---
+	// Config Related Observations
+
+	// ObservationTypePKIConfigClusterRead will be emitted on a read to
+	// pki/config/cluster
+	ObservationTypePKIConfigClusterRead = "pki/config/integrations/cluster/read"
+	// ObservationTypePKIConfigClusterWrite will be emitted on a write to
+	// pki/config/cluster.
+	ObservationTypePKIConfigClusterWrite = "pki/config/integrations/cluster/write"
+
+	// ObservationTypePKIConfigIntegrationsGardiumRead will be emitted on a read to
+	// pki/config/integrations/gardium. It will not include any user-specified URLs.
+	ObservationTypePKIConfigIntegrationsGardiumRead = "pki/config/integrations/gardium/read"
+	// ObservationTypePKIConfigIntegrationsGardiumWrite will be emitted on a write to
+	// pki/config/integrations/gardium. It will not include any user-specified URLs.
+	ObservationTypePKIConfigIntegrationsGardiumWrite = "pki/config/integrations/gardium/write"
+
+	// ObservationTypePKIConfigURLsRead will be emitted on a read to
+	// pki/config/urls. It will not include any user-specified URLs.
+	ObservationTypePKIConfigURLsRead = "pki/config/urls/read"
+	// ObservationTypePKIConfigURLsWrite will be emitted on a write to
+	// pki/config/urls. It will not include any user-specified URLs.
+	ObservationTypePKIConfigURLsWrite = "pki/config/urls/write"
+
+	// ObservationTypePKIConfigExternalPolicyRead is emitted when a read call goes to
+	// pki/config/external-policy (CIEPS).
+	ObservationTypePKIConfigExternalPolicyRead = "pki/config/external-policy/read"
+	// ObservationTypePKIConfigExternalPolicyWrite is emitted when a write call goes to
+	// pki/config/external-policy (CIEPS). Note that any sensitive information, like
+	// certificates or URLs.
+	ObservationTypePKIConfigExternalPolicyWrite = "pki/config/external-policy/write"
+
+	ObservationTypePKIConfigCRLRead  = "pki/config/crl/read"
+	ObservationTypePKIConfigCRLWrite = "pki/config/crl/write"
+
+	// ---
+	// ACME Related Observations
+
+	ObservationTypePKIConfigACMERead  = "pki/config/acme/read"
+	ObservationTypePKIConfigACMEWrite = "pki/config/acme/write"
+
+	ObservationTypePKIAcmeRevoke         = "pki/acme/revoke"
+	ObservationTypePKIAcmeNewOrder       = "pki/acme/order/new-order"
+	ObservationTypePKIAcmeListOrders     = "pki/acme/order/list-orders"
+	ObservationTypePKIAcmeGetOrder       = "pki/acme/order/get-order"
+	ObservationTypePKIAcmeFinalizeOrder  = "pki/acme/order/finalize-order"
+	ObservationTypePKIAcmeFetchOrderCert = "pki/acme/order/fetch-order-cert"
+	ObservationTypePKIAcmeNewAccount     = "pki/acme/account/new-account"
+	ObservationTypePKIAcmeUpdateAccount  = "pki/acme/account/update-account"
+	ObservationTypePKIAcmeChallenge      = "pki/acme/challenge"
+	ObservationTypePKIAcmeAuthorization  = "pki/acme/authorization"
+	ObservationTypePKIAcmeNewEab         = "pki/acme/new-eab"
+
+	// ---
+	// EST Related Observations
+
+	ObservationTypePKIConfigESTRead  = "pki/config/est/read"
+	ObservationTypePKIConfigESTWrite = "pki/config/est/write"
+
+	ObservationTypePKIESTCACerts = "pki/est/ca-certs"
+
+	ObservationTypePKIESTEnroll   = "pki/est/enroll"
+	ObservationTypePKIESTReEnroll = "pki/est/re-enroll"
+
+	// ---
+	// CMPv2 Related Observations
+
+	ObservationTypePKIConfigCMPv2Read  = "pki/config/cmpv2/read"
+	ObservationTypePKIConfigCMPv2Write = "pki/config/cmpv2/write"
+
+	ObservationTypePKICMPCertRequest = "pki/cmpv2/cert-request"
+
+	// ---
+	// SCEP Related Observations
+
+	ObservationTypePKIConfigSCEPRead  = "pki/config/scep/read"
+	ObservationTypePKIConfigSCEPWrite = "pki/config/scep/write"
+
+	ObservationTypePKISCEPPKIOperation = "pki/scep/operation/pki"
+)
diff --git a/builtin/logical/pki/observe/observe.go b/builtin/logical/pki/observe/observe.go
new file mode 100644
index 00000000000..6d9eb59a5f1
--- /dev/null
+++ b/builtin/logical/pki/observe/observe.go
@@ -0,0 +1,29 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package observe
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+type PluginObserve interface {
+	// RecordObservation is used to record observations through the plugin's observation system.
+	// It returns ErrNoObservations if the observation system has not been configured or enabled.
+	RecordObservation(ctx context.Context, observationType string, data map[string]interface{}) error
+}
+
+type PkiObserver interface {
+	RecordPKIObservation(ctx context.Context, req *logical.Request, observationType string, additionalMetadata ...AdditionalPKIMetadata)
+}
+
+type AdditionalPKIMetadata struct {
+	key   string
+	value any
+}
+
+func NewAdditionalPKIMetadata(key string, value any) AdditionalPKIMetadata {
+	return AdditionalPKIMetadata{key: key, value: value}
+}
diff --git a/builtin/logical/pki/observe/observer_ce.go b/builtin/logical/pki/observe/observer_ce.go
new file mode 100644
index 00000000000..2471a5bf4d9
--- /dev/null
+++ b/builtin/logical/pki/observe/observer_ce.go
@@ -0,0 +1,29 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package observe
+
+import (
+	"context"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+type PkiCeObserver struct {
+	logger   hclog.Logger
+	observer PluginObserve
+}
+
+var _ PkiObserver = (*PkiCeObserver)(nil)
+
+func (p PkiCeObserver) RecordPKIObservation(_ context.Context, _ *logical.Request, _ string, _ ...AdditionalPKIMetadata) {
+	// No-op for Community Edition
+}
+
+func NewPkiCeObserver(logger hclog.Logger, observer PluginObserve) *PkiCeObserver {
+	return &PkiCeObserver{
+		logger:   logger,
+		observer: observer,
+	}
+}
diff --git a/builtin/logical/pki/parsing/asn1.go b/builtin/logical/pki/parsing/asn1.go
new file mode 100644
index 00000000000..891e3d815b5
--- /dev/null
+++ b/builtin/logical/pki/parsing/asn1.go
@@ -0,0 +1,18 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package parsing
+
+import "encoding/asn1"
+
+// Asn1UnmarshallNoTrailing is a wrapper around asn1.Unmarshal that ensures there
+// is no trailing data in the input returning an error if there is.
+func Asn1UnmarshallNoTrailing(b []byte, val any) error {
+	rest, err := asn1.Unmarshal(b, val)
+	if err != nil {
+		return err
+	} else if len(rest) != 0 {
+		return asn1.SyntaxError{Msg: "trailing data"}
+	}
+	return nil
+}
diff --git a/builtin/logical/pki/parsing/asn1_test.go b/builtin/logical/pki/parsing/asn1_test.go
new file mode 100644
index 00000000000..4d33b4d3047
--- /dev/null
+++ b/builtin/logical/pki/parsing/asn1_test.go
@@ -0,0 +1,52 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package parsing
+
+import (
+	"testing"
+
+	"github.com/google/certificate-transparency-go/asn1"
+	"github.com/stretchr/testify/require"
+)
+
+// TestAsn1UnmarshallNoTrailing tests the Asn1UnmarshallNoTrailing function returns
+// errors as we expect if the input is not marshalled correctly or there is trailing
+// data.
+func TestAsn1UnmarshallNoTrailing(t *testing.T) {
+	stringToMarshal := "a string"
+	marshal, err := asn1.Marshal(stringToMarshal)
+	require.NoError(t, err, "marshal failed")
+
+	var myTestString string
+
+	type args struct {
+		b   []byte
+		val any
+	}
+	tests := []struct {
+		name    string
+		args    args
+		wantErr bool
+	}{
+		{"happy-path", args{marshal, &myTestString}, false},
+		{"bad-marshalling", args{[]byte("incorrect"), &myTestString}, true},
+		{"trailing-data", args{append(marshal, []byte("\n")...), &myTestString}, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			myTestString = ""
+			err := Asn1UnmarshallNoTrailing(tt.args.b, tt.args.val)
+
+			if (err != nil) != tt.wantErr {
+				t.Errorf("Asn1UnmarshallNoTrailing() error = %v, wantErr %v", err, tt.wantErr)
+			}
+
+			if !tt.wantErr {
+				if myTestString != stringToMarshal {
+					t.Errorf("Asn1UnmarshallNoTrailing() = %v, want %v", myTestString, stringToMarshal)
+				}
+			}
+		})
+	}
+}
diff --git a/builtin/logical/pki/parsing/certificate.go b/builtin/logical/pki/parsing/certificate.go
index c8f68b98e93..4f3e6bfebdc 100644
--- a/builtin/logical/pki/parsing/certificate.go
+++ b/builtin/logical/pki/parsing/certificate.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package parsing
@@ -12,6 +12,14 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 )
 
+func SerialFromCert(cert *x509.Certificate) string {
+	return SerialFromBigInt(cert.SerialNumber)
+}
+
+func SerialFromBigInt(serial *big.Int) string {
+	return strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":"))
+}
+
 // NormalizeSerialForStorageFromBigInt given a serial number, format it as a string
 // that is safe to store within a filesystem
 func NormalizeSerialForStorageFromBigInt(serial *big.Int) string {
diff --git a/builtin/logical/pki/parsing/csrs.go b/builtin/logical/pki/parsing/csrs.go
index 34d6c11be31..1295d9502f9 100644
--- a/builtin/logical/pki/parsing/csrs.go
+++ b/builtin/logical/pki/parsing/csrs.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package parsing
diff --git a/builtin/logical/pki/parsing/pem.go b/builtin/logical/pki/parsing/pem.go
index aa5513ab17c..c29d81a436b 100644
--- a/builtin/logical/pki/parsing/pem.go
+++ b/builtin/logical/pki/parsing/pem.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package parsing
diff --git a/builtin/logical/pki/path_acme_account.go b/builtin/logical/pki/path_acme_account.go
index 20804a71735..d8034f6a0bd 100644
--- a/builtin/logical/pki/path_acme_account.go
+++ b/builtin/logical/pki/path_acme_account.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-secure-stdlib/strutil"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -178,7 +179,7 @@ func (b *backend) acmeNewAccountHandler(acmeCtx *acmeContext, r *logical.Request
 		return b.acmeNewAccountCreateHandler(acmeCtx, userCtx, contacts, termsOfServiceAgreed, r, eabData)
 	}
 
-	return b.acmeNewAccountUpdateHandler(acmeCtx, userCtx, contacts, status, eabData)
+	return b.acmeNewAccountUpdateHandler(acmeCtx, userCtx, contacts, status, r, eabData)
 }
 
 func formatNewAccountResponse(acmeCtx *acmeContext, acct *acmeAccount, eabData map[string]interface{}) *logical.Response {
@@ -316,10 +317,15 @@ func (b *backend) acmeNewAccountCreateHandler(acmeCtx *acmeContext, userCtx *jws
 	// > The server returns this account object in a 201 (Created) response,
 	// > with the account URL in a Location header field.
 	resp.Data[logical.HTTPStatusCode] = http.StatusCreated
+
+	b.pkiObserver.RecordPKIObservation(acmeCtx, r, observe.ObservationTypePKIAcmeNewAccount,
+		observe.NewAdditionalPKIMetadata("key_id", userCtx.Kid),
+	)
+
 	return resp, nil
 }
 
-func (b *backend) acmeNewAccountUpdateHandler(acmeCtx *acmeContext, userCtx *jwsCtx, contact []string, status string, eabData map[string]interface{}) (*logical.Response, error) {
+func (b *backend) acmeNewAccountUpdateHandler(acmeCtx *acmeContext, userCtx *jwsCtx, contact []string, status string, r *logical.Request, eabData map[string]interface{}) (*logical.Response, error) {
 	if !userCtx.Existing {
 		return nil, fmt.Errorf("cannot submit to account updates without a 'kid': %w", ErrMalformed)
 	}
@@ -369,6 +375,12 @@ func (b *backend) acmeNewAccountUpdateHandler(acmeCtx *acmeContext, userCtx *jws
 	}
 
 	resp := formatAccountResponse(acmeCtx, account)
+
+	b.pkiObserver.RecordPKIObservation(acmeCtx, r, observe.ObservationTypePKIAcmeUpdateAccount,
+		observe.NewAdditionalPKIMetadata("key_id", account.KeyId),
+		observe.NewAdditionalPKIMetadata("status", account.Status),
+	)
+
 	return resp, nil
 }
 
diff --git a/builtin/logical/pki/path_acme_account_mgmt.go b/builtin/logical/pki/path_acme_account_mgmt.go
new file mode 100644
index 00000000000..c8a499dbabf
--- /dev/null
+++ b/builtin/logical/pki/path_acme_account_mgmt.go
@@ -0,0 +1,226 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package pki
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+func pathAcmeMgmtAccountList(b *backend) *framework.Path {
+	return &framework.Path{
+		Pattern: "acme/mgmt/account/keyid/?$",
+
+		Operations: map[logical.Operation]framework.OperationHandler{
+			logical.ListOperation: &framework.PathOperation{
+				Callback: b.pathAcmeMgmtListAccounts,
+				DisplayAttrs: &framework.DisplayAttributes{
+					OperationPrefix: operationPrefixPKI,
+					OperationVerb:   "list-acme-account-keys",
+					Description:     "List all ACME account key identifiers.",
+				},
+			},
+		},
+
+		HelpSynopsis:    "List all ACME account key identifiers.",
+		HelpDescription: `Allows an operator to list all ACME account key identifiers.`,
+	}
+}
+
+func pathAcmeMgmtAccountRead(b *backend) *framework.Path {
+	return &framework.Path{
+		Pattern: "acme/mgmt/account/keyid/" + framework.GenericNameRegex("keyid"),
+		Fields: map[string]*framework.FieldSchema{
+			"keyid": {
+				Type:        framework.TypeString,
+				Description: "The key identifier of the account.",
+				Required:    true,
+			},
+			"status": {
+				Type:          framework.TypeString,
+				Description:   "The status of the account.",
+				Required:      true,
+				AllowedValues: []interface{}{AccountStatusValid.String(), AccountStatusRevoked.String()},
+			},
+		},
+		Operations: map[logical.Operation]framework.OperationHandler{
+			logical.ReadOperation: &framework.PathOperation{
+				Callback: b.pathAcmeMgmtReadAccount,
+				DisplayAttrs: &framework.DisplayAttributes{
+					OperationPrefix: operationPrefixPKI,
+					OperationSuffix: "acme-key-id",
+				},
+			},
+			logical.UpdateOperation: &framework.PathOperation{
+				Callback: b.pathAcmeMgmtUpdateAccount,
+				DisplayAttrs: &framework.DisplayAttributes{
+					OperationPrefix: operationPrefixPKI,
+					OperationSuffix: "acme-key-id",
+				},
+			},
+		},
+
+		HelpSynopsis:    "Fetch the details or update the status of an ACME account by key identifier.",
+		HelpDescription: `Allows an operator to retrieve details of an ACME account and to update the account status.`,
+	}
+}
+
+func (b *backend) pathAcmeMgmtListAccounts(ctx context.Context, r *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	sc := b.makeStorageContext(ctx, r.Storage)
+
+	accountIds, err := b.GetAcmeState().ListAccountIds(sc)
+	if err != nil {
+		return nil, err
+	}
+
+	return logical.ListResponse(accountIds), nil
+}
+
+func (b *backend) pathAcmeMgmtReadAccount(ctx context.Context, r *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	keyId := d.Get("keyid").(string)
+	if len(keyId) == 0 {
+		return logical.ErrorResponse("keyid is required"), logical.ErrInvalidRequest
+	}
+
+	sc := b.makeStorageContext(ctx, r.Storage)
+	as := b.GetAcmeState()
+
+	accountEntry, err := as.LoadAccountWithoutDirEnforcement(sc, keyId)
+	if err != nil {
+		if errors.Is(err, ErrAccountDoesNotExist) {
+			return logical.ErrorResponse("ACME key id %s did not exist", keyId), logical.ErrNotFound
+		}
+		return nil, fmt.Errorf("failed loading ACME account id %q: %w", keyId, err)
+	}
+
+	orders, err := as.LoadAccountOrders(sc, accountEntry.KeyId)
+	if err != nil {
+		return nil, fmt.Errorf("failed loading orders for account %q: %w", accountEntry.KeyId, err)
+	}
+
+	orderData := make([]map[string]interface{}, 0, len(orders))
+	for _, order := range orders {
+		orderData = append(orderData, acmeOrderToDataMap(order))
+	}
+
+	dataMap := acmeAccountToDataMap(accountEntry)
+	dataMap["orders"] = orderData
+	return &logical.Response{Data: dataMap}, nil
+}
+
+func (b *backend) pathAcmeMgmtUpdateAccount(ctx context.Context, r *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	keyId := d.Get("keyid").(string)
+	if len(keyId) == 0 {
+		return logical.ErrorResponse("keyid is required"), logical.ErrInvalidRequest
+	}
+
+	status, err := convertToAccountStatus(d.Get("status"))
+	if err != nil {
+		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
+	}
+	if status != AccountStatusValid && status != AccountStatusRevoked {
+		return logical.ErrorResponse("invalid status %q", status), logical.ErrInvalidRequest
+	}
+
+	sc := b.makeStorageContext(ctx, r.Storage)
+	as := b.GetAcmeState()
+
+	accountEntry, err := as.LoadAccountWithoutDirEnforcement(sc, keyId)
+	if err != nil {
+		if errors.Is(err, ErrAccountDoesNotExist) {
+			return logical.ErrorResponse("ACME key id %q did not exist", keyId), logical.ErrNotFound
+		}
+		return nil, fmt.Errorf("failed loading ACME account id %q: %w", keyId, err)
+	}
+
+	if accountEntry.Status != status {
+		accountEntry.Status = status
+
+		switch status {
+		case AccountStatusRevoked:
+			accountEntry.AccountRevokedDate = time.Now()
+		case AccountStatusValid:
+			accountEntry.AccountRevokedDate = time.Time{}
+		}
+
+		if err := as.UpdateAccount(sc, accountEntry); err != nil {
+			return nil, fmt.Errorf("failed saving account %q: %w", keyId, err)
+		}
+	}
+
+	dataMap := acmeAccountToDataMap(accountEntry)
+	return &logical.Response{Data: dataMap}, nil
+}
+
+func convertToAccountStatus(status any) (ACMEAccountStatus, error) {
+	if status == nil {
+		return "", fmt.Errorf("status is required")
+	}
+
+	statusStr, ok := status.(string)
+	if !ok {
+		return "", fmt.Errorf("status must be a string")
+	}
+
+	switch strings.ToLower(strings.TrimSpace(statusStr)) {
+	case AccountStatusValid.String():
+		return AccountStatusValid, nil
+	case AccountStatusRevoked.String():
+		return AccountStatusRevoked, nil
+	case AccountStatusDeactivated.String():
+		return AccountStatusDeactivated, nil
+	default:
+		return "", fmt.Errorf("invalid status %q", statusStr)
+	}
+}
+
+func acmeAccountToDataMap(accountEntry *acmeAccount) map[string]interface{} {
+	revokedDate := ""
+	if !accountEntry.AccountRevokedDate.IsZero() {
+		revokedDate = accountEntry.AccountRevokedDate.Format(time.RFC3339)
+	}
+
+	eab := map[string]string{}
+	if accountEntry.Eab != nil {
+		eab["eab_id"] = accountEntry.Eab.KeyID
+		eab["directory"] = accountEntry.Eab.AcmeDirectory
+		eab["created_time"] = accountEntry.Eab.CreatedOn.Format(time.RFC3339)
+		eab["key_type"] = accountEntry.Eab.KeyType
+	}
+
+	return map[string]interface{}{
+		"key_id":       accountEntry.KeyId,
+		"status":       accountEntry.Status,
+		"contacts":     accountEntry.Contact,
+		"created_time": accountEntry.AccountCreatedDate.Format(time.RFC3339),
+		"revoked_time": revokedDate,
+		"directory":    accountEntry.AcmeDirectory,
+		"eab":          eab,
+	}
+}
+
+func acmeOrderToDataMap(order *acmeOrder) map[string]interface{} {
+	identifiers := make([]string, 0, len(order.Identifiers))
+	for _, identifier := range order.Identifiers {
+		identifiers = append(identifiers, identifier.Value)
+	}
+	var certExpiry string
+	if !order.CertificateExpiry.IsZero() {
+		certExpiry = order.CertificateExpiry.Format(time.RFC3339)
+	}
+	return map[string]interface{}{
+		"order_id":           order.OrderId,
+		"status":             string(order.Status),
+		"identifiers":        identifiers,
+		"cert_serial_number": strings.ReplaceAll(order.CertificateSerialNumber, "-", ":"),
+		"cert_expiry":        certExpiry,
+		"order_expiry":       order.Expires.Format(time.RFC3339),
+	}
+}
diff --git a/builtin/logical/pki/path_acme_authorizations.go b/builtin/logical/pki/path_acme_authorizations.go
index 983c55fee4e..fb8656ee2dc 100644
--- a/builtin/logical/pki/path_acme_authorizations.go
+++ b/builtin/logical/pki/path_acme_authorizations.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -6,6 +6,7 @@ package pki
 import (
 	"fmt"
 
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -63,6 +64,11 @@ func (b *backend) acmeAuthorizationHandler(acmeCtx *acmeContext, r *logical.Requ
 		}
 	}
 
+	b.pkiObserver.RecordPKIObservation(acmeCtx, r, observe.ObservationTypePKIAcmeAuthorization,
+		observe.NewAdditionalPKIMetadata("auth_id", authId),
+		observe.NewAdditionalPKIMetadata("status", status),
+	)
+
 	if len(data) == 0 {
 		return b.acmeAuthorizationFetchHandler(acmeCtx, r, fields, userCtx, data, authz)
 	}
diff --git a/builtin/logical/pki/path_acme_challenges.go b/builtin/logical/pki/path_acme_challenges.go
index eed8d1ea41f..3b94dec30db 100644
--- a/builtin/logical/pki/path_acme_challenges.go
+++ b/builtin/logical/pki/path_acme_challenges.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -6,6 +6,7 @@ package pki
 import (
 	"fmt"
 
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -62,6 +63,11 @@ func (b *backend) acmeChallengeHandler(acmeCtx *acmeContext, r *logical.Request,
 		return nil, fmt.Errorf("failed to load authorization: %w", err)
 	}
 
+	b.pkiObserver.RecordPKIObservation(acmeCtx, r, observe.ObservationTypePKIAcmeChallenge,
+		observe.NewAdditionalPKIMetadata("auth_id", authId),
+		observe.NewAdditionalPKIMetadata("challenge_type", challengeType),
+	)
+
 	return b.acmeChallengeFetchHandler(acmeCtx, r, fields, userCtx, data, authz, challengeType)
 }
 
diff --git a/builtin/logical/pki/path_acme_directory.go b/builtin/logical/pki/path_acme_directory.go
index ea49a44ee64..ac173a16134 100644
--- a/builtin/logical/pki/path_acme_directory.go
+++ b/builtin/logical/pki/path_acme_directory.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/path_acme_eab.go b/builtin/logical/pki/path_acme_eab.go
index fa026a1c189..d576b457072 100644
--- a/builtin/logical/pki/path_acme_eab.go
+++ b/builtin/logical/pki/path_acme_eab.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -173,7 +174,7 @@ a warning that it did not exist.`,
 }
 
 type eabType struct {
-	KeyID         string    `json:"-"`
+	KeyID         string    `json:"key-id"`
 	KeyType       string    `json:"key-type"`
 	PrivateBytes  []byte    `json:"private-bytes"`
 	AcmeDirectory string    `json:"acme-directory"`
@@ -244,6 +245,13 @@ func (b *backend) pathAcmeCreateEab(ctx context.Context, r *logical.Request, dat
 
 	encodedKey := base64.RawURLEncoding.EncodeToString(eab.PrivateBytes)
 
+	b.pkiObserver.RecordPKIObservation(ctx, r, observe.ObservationTypePKIAcmeNewEab,
+		observe.NewAdditionalPKIMetadata("id", eab.KeyID),
+		observe.NewAdditionalPKIMetadata("key_type", eab.KeyType),
+		observe.NewAdditionalPKIMetadata("acme_directory", path.Join(eab.AcmeDirectory, "directory")),
+		observe.NewAdditionalPKIMetadata("created_on", eab.CreatedOn.Format(time.RFC3339)),
+	)
+
 	return &logical.Response{
 		Data: map[string]interface{}{
 			"id":             eab.KeyID,
diff --git a/builtin/logical/pki/path_acme_nonce.go b/builtin/logical/pki/path_acme_nonce.go
index 7c8d5d407bb..c7c8fc1e350 100644
--- a/builtin/logical/pki/path_acme_nonce.go
+++ b/builtin/logical/pki/path_acme_nonce.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/path_acme_order.go b/builtin/logical/pki/path_acme_order.go
index c61f076b817..d7211d3d86a 100644
--- a/builtin/logical/pki/path_acme_order.go
+++ b/builtin/logical/pki/path_acme_order.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -10,11 +10,13 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/netip"
 	"sort"
 	"strings"
 	"time"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/strutil"
@@ -22,8 +24,6 @@ import (
 	"golang.org/x/net/idna"
 )
 
-var maxAcmeCertTTL = 90 * (24 * time.Hour)
-
 func pathAcmeListOrders(b *backend, baseUrl string, opts acmeWrapperOpts) *framework.Path {
 	return patternAcmeListOrders(b, baseUrl+"/orders", opts)
 }
@@ -160,7 +160,7 @@ func addFieldsForACMEOrder(fields map[string]*framework.FieldSchema) {
 	}
 }
 
-func (b *backend) acmeFetchCertOrderHandler(ac *acmeContext, _ *logical.Request, fields *framework.FieldData, uc *jwsCtx, data map[string]interface{}, _ *acmeAccount) (*logical.Response, error) {
+func (b *backend) acmeFetchCertOrderHandler(ac *acmeContext, req *logical.Request, fields *framework.FieldData, uc *jwsCtx, data map[string]interface{}, _ *acmeAccount) (*logical.Response, error) {
 	orderId := fields.Get("order_id").(string)
 
 	order, err := b.GetAcmeState().LoadOrder(ac, uc, orderId)
@@ -176,7 +176,7 @@ func (b *backend) acmeFetchCertOrderHandler(ac *acmeContext, _ *logical.Request,
 		return nil, fmt.Errorf("order is missing required fields to load certificate")
 	}
 
-	certEntry, err := fetchCertBySerial(ac.sc, "certs/", order.CertificateSerialNumber)
+	certEntry, err := fetchCertBySerial(ac.sc, issuing.PathCerts, order.CertificateSerialNumber)
 	if err != nil {
 		return nil, fmt.Errorf("failed reading certificate %s from storage: %w", order.CertificateSerialNumber, err)
 	}
@@ -214,6 +214,25 @@ func (b *backend) acmeFetchCertOrderHandler(ac *acmeContext, _ *logical.Request,
 		return nil, fmt.Errorf("failed encoding certificate ca chain: %w", err)
 	}
 
+	var role string
+	var issuerName string
+	var issuerId string
+	if ac.Role != nil {
+		role = ac.Role.Name
+	}
+	if ac.Issuer != nil {
+		issuerId = ac.Issuer.ID.String()
+		issuerName = ac.Issuer.Name
+	}
+	b.pkiObserver.RecordPKIObservation(ac, req, observe.ObservationTypePKIAcmeFetchOrderCert,
+		observe.NewAdditionalPKIMetadata("role_name", role),
+		observe.NewAdditionalPKIMetadata("issuer_name", issuerName),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuerId),
+		observe.NewAdditionalPKIMetadata("order_id", order.OrderId),
+		observe.NewAdditionalPKIMetadata("serial_number", order.CertificateSerialNumber),
+		observe.NewAdditionalPKIMetadata("account_id", order.AccountId),
+	)
+
 	return &logical.Response{
 		Data: map[string]interface{}{
 			logical.HTTPContentType: "application/pem-certificate-chain",
@@ -273,10 +292,11 @@ func (b *backend) acmeFinalizeOrderHandler(ac *acmeContext, r *logical.Request,
 			return nil, err
 		}
 
-		err = issuing.StoreCertificate(ac.sc.Context, ac.sc.Storage, ac.sc.Backend.GetCertificateCounter(), signedCertBundle)
+		err = issuing.StoreCertificate(ac.sc.Context, ac.sc.Storage, ac.sc.GetCertificateCounter(), signedCertBundle)
 		if err != nil {
 			return nil, err
 		}
+		b.pkiCertificateCounter.AddIssuedCertificate(true)
 	}
 	hyphenSerialNumber := normalizeSerialFromBigInt(signedCertBundle.Certificate.SerialNumber)
 
@@ -301,6 +321,32 @@ func (b *backend) acmeFinalizeOrderHandler(ac *acmeContext, r *logical.Request,
 		err = nil
 	}
 
+	var role string
+	var issuerName string
+	var stored bool
+	if ac.Role != nil {
+		role = ac.Role.Name
+		stored = !ac.Role.NoStore
+	}
+	if ac.Issuer != nil {
+		issuerName = ac.Issuer.Name
+	}
+
+	b.pkiObserver.RecordPKIObservation(ac, r, observe.ObservationTypePKIAcmeFinalizeOrder,
+		observe.NewAdditionalPKIMetadata("role_name", role),
+		observe.NewAdditionalPKIMetadata("issuer_name", issuerName),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuerId.String()),
+		observe.NewAdditionalPKIMetadata("order_id", order.OrderId),
+		observe.NewAdditionalPKIMetadata("stored", stored),
+		observe.NewAdditionalPKIMetadata("public_key_algorithm", signedCertBundle.Certificate.PublicKeyAlgorithm.String()),
+		observe.NewAdditionalPKIMetadata("public_key_size", certutil.GetPublicKeySize(signedCertBundle.Certificate.PublicKey)),
+		observe.NewAdditionalPKIMetadata("common_name", csr.Subject.CommonName),
+		observe.NewAdditionalPKIMetadata("serial_number", order.CertificateSerialNumber),
+		observe.NewAdditionalPKIMetadata("certificate_expiry", order.CertificateExpiry.String()),
+		observe.NewAdditionalPKIMetadata("status", ACMEOrderValid),
+		observe.NewAdditionalPKIMetadata("account_id", order.AccountId),
+	)
+
 	return formatOrderResponse(ac, order), nil
 }
 
@@ -478,7 +524,7 @@ func removeDuplicatesAndSortIps(ipIdentifiers []net.IP) []net.IP {
 
 func maybeAugmentReqDataWithSuitableCN(ac *acmeContext, csr *x509.CertificateRequest, data *framework.FieldData) {
 	// Role doesn't require a CN, so we don't care.
-	if !ac.role.RequireCN {
+	if !ac.Role.RequireCN {
 		return
 	}
 
@@ -524,13 +570,14 @@ func issueCertFromCsr(ac *acmeContext, csr *x509.CertificateRequest) (*certutil.
 	// (TLS) clients are mostly verifying against server's DNS SANs.
 	maybeAugmentReqDataWithSuitableCN(ac, csr, data)
 
-	signingBundle, issuerId, err := ac.sc.fetchCAInfoWithIssuer(ac.issuer.ID.String(), issuing.IssuanceUsage)
+	signingBundle, issuerId, err := ac.sc.fetchCAInfoWithIssuer(ac.Issuer.ID.String(), issuing.IssuanceUsage)
 	if err != nil {
-		return nil, "", fmt.Errorf("failed loading CA %s: %w", ac.issuer.ID.String(), err)
+		return nil, "", fmt.Errorf("failed loading CA %s: %w", ac.Issuer.ID.String(), err)
 	}
 
 	// ACME issued cert will override the TTL values to truncate to the issuer's
-	// expiration if we go beyond, no matter the setting
+	// expiration if we go beyond, no matter the setting.
+	// Note that if set to certutil.AlwaysEnforceErr we will error out
 	if signingBundle.LeafNotAfterBehavior == certutil.ErrNotAfterBehavior {
 		signingBundle.LeafNotAfterBehavior = certutil.TruncateNotAfterBehavior
 	}
@@ -538,17 +585,24 @@ func issueCertFromCsr(ac *acmeContext, csr *x509.CertificateRequest) (*certutil.
 	input := &inputBundle{
 		req:     &logical.Request{},
 		apiData: data,
-		role:    ac.role,
+		role:    ac.Role,
 	}
 
-	normalNotAfter, _, err := getCertificateNotAfter(ac.sc.Backend, input, signingBundle)
+	normalNotAfter, _, err := getCertificateNotAfter(ac.sc.System(), input, signingBundle)
 	if err != nil {
 		return nil, "", fmt.Errorf("failed computing certificate TTL from role/mount: %v: %w", err, ErrMalformed)
 	}
 
-	// Force a maximum 90 day TTL or lower for ACME
-	if time.Now().Add(maxAcmeCertTTL).Before(normalNotAfter) {
-		input.apiData.Raw["ttl"] = maxAcmeCertTTL
+	// We only allow ServerAuth key usage from ACME issued certs
+	// when configuration does not allow usage of ExtKeyusage field.
+	config, err := ac.acmeState.getConfigWithUpdate(ac.sc)
+	if err != nil {
+		return nil, "", fmt.Errorf("failed to fetch ACME configuration: %w", err)
+	}
+
+	// Force our configured max acme TTL
+	if time.Now().Add(config.MaxTTL).Before(normalNotAfter) {
+		input.apiData.Raw["ttl"] = config.MaxTTL.Seconds()
 	}
 
 	if csr.PublicKeyAlgorithm == x509.UnknownPublicKeyAlgorithm || csr.PublicKey == nil {
@@ -568,22 +622,15 @@ func issueCertFromCsr(ac *acmeContext, csr *x509.CertificateRequest) (*certutil.
 	// unit, we have no way of validating this (via ACME here, without perhaps
 	// an external policy engine), and thus should not be setting it on our
 	// final issued certificate.
-	parsedBundle, _, err := signCert(ac.sc.Backend, input, signingBundle, false /* is_ca=false */, false /* use_csr_values */)
+	parsedBundle, _, err := signCert(ac.sc.System(), input, signingBundle, false /* is_ca=false */, false /* use_csr_values */)
 	if err != nil {
 		return nil, "", fmt.Errorf("%w: refusing to sign CSR: %s", ErrBadCSR, err.Error())
 	}
 
-	if err = parsedBundle.Verify(); err != nil {
+	if err = issuing.VerifyCertificate(ac.Context, ac.sc.Storage, issuerId, parsedBundle); err != nil {
 		return nil, "", fmt.Errorf("verification of parsed bundle failed: %w", err)
 	}
 
-	// We only allow ServerAuth key usage from ACME issued certs
-	// when configuration does not allow usage of ExtKeyusage field.
-	config, err := ac.sc.Backend.GetAcmeState().getConfigWithUpdate(ac.sc)
-	if err != nil {
-		return nil, "", fmt.Errorf("failed to fetch ACME configuration: %w", err)
-	}
-
 	if !config.AllowRoleExtKeyUsage {
 		for _, usage := range parsedBundle.Certificate.ExtKeyUsage {
 			if usage != x509.ExtKeyUsageServerAuth {
@@ -636,7 +683,7 @@ func parseCsrFromFinalize(data map[string]interface{}) (*x509.CertificateRequest
 	return csr, nil
 }
 
-func (b *backend) acmeGetOrderHandler(ac *acmeContext, _ *logical.Request, fields *framework.FieldData, uc *jwsCtx, _ map[string]interface{}, _ *acmeAccount) (*logical.Response, error) {
+func (b *backend) acmeGetOrderHandler(ac *acmeContext, req *logical.Request, fields *framework.FieldData, uc *jwsCtx, _ map[string]interface{}, _ *acmeAccount) (*logical.Response, error) {
 	orderId := fields.Get("order_id").(string)
 
 	order, err := b.GetAcmeState().LoadOrder(ac, uc, orderId)
@@ -672,10 +719,28 @@ func (b *backend) acmeGetOrderHandler(ac *acmeContext, _ *logical.Request, field
 		order.AuthorizationIds = filteredAuthorizationIds
 	}
 
+	var role string
+	var issuerName string
+	var issuerId string
+	if ac.Role != nil {
+		role = ac.Role.Name
+	}
+	if ac.Issuer != nil {
+		issuerName = ac.Issuer.Name
+		issuerId = ac.Issuer.ID.String()
+	}
+
+	b.pkiObserver.RecordPKIObservation(ac, req, observe.ObservationTypePKIAcmeGetOrder,
+		observe.NewAdditionalPKIMetadata("role_name", role),
+		observe.NewAdditionalPKIMetadata("issuer_name", issuerName),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuerId),
+		observe.NewAdditionalPKIMetadata("order_id", orderId),
+	)
+
 	return formatOrderResponse(ac, order), nil
 }
 
-func (b *backend) acmeListOrdersHandler(ac *acmeContext, _ *logical.Request, _ *framework.FieldData, uc *jwsCtx, _ map[string]interface{}, acct *acmeAccount) (*logical.Response, error) {
+func (b *backend) acmeListOrdersHandler(ac *acmeContext, req *logical.Request, _ *framework.FieldData, uc *jwsCtx, _ map[string]interface{}, acct *acmeAccount) (*logical.Response, error) {
 	orderIds, err := b.GetAcmeState().ListOrderIds(ac.sc, acct.KeyId)
 	if err != nil {
 		return nil, err
@@ -704,10 +769,28 @@ func (b *backend) acmeListOrdersHandler(ac *acmeContext, _ *logical.Request, _ *
 		},
 	}
 
+	var role string
+	var issuerName string
+	var issuerId string
+	if ac.Role != nil {
+		role = ac.Role.Name
+	}
+	if ac.Issuer != nil {
+		issuerName = ac.Issuer.Name
+		issuerId = ac.Issuer.ID.String()
+	}
+
+	b.pkiObserver.RecordPKIObservation(ac, req, observe.ObservationTypePKIAcmeListOrders,
+		observe.NewAdditionalPKIMetadata("role_name", role),
+		observe.NewAdditionalPKIMetadata("issuer_name", issuerName),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuerId),
+		observe.NewAdditionalPKIMetadata("order_ids", orderIds),
+	)
+
 	return resp, nil
 }
 
-func (b *backend) acmeNewOrderHandler(ac *acmeContext, _ *logical.Request, _ *framework.FieldData, _ *jwsCtx, data map[string]interface{}, account *acmeAccount) (*logical.Response, error) {
+func (b *backend) acmeNewOrderHandler(ac *acmeContext, req *logical.Request, _ *framework.FieldData, _ *jwsCtx, data map[string]interface{}, account *acmeAccount) (*logical.Response, error) {
 	identifiers, err := parseOrderIdentifiers(data)
 	if err != nil {
 		return nil, err
@@ -732,7 +815,7 @@ func (b *backend) acmeNewOrderHandler(ac *acmeContext, _ *logical.Request, _ *fr
 		return nil, err
 	}
 
-	err = b.validateIdentifiersAgainstRole(ac.role, identifiers)
+	err = b.validateIdentifiersAgainstRole(ac.Role, identifiers)
 	if err != nil {
 		return nil, err
 	}
@@ -784,6 +867,28 @@ func (b *backend) acmeNewOrderHandler(ac *acmeContext, _ *logical.Request, _ *fr
 	// > If the server is willing to issue the requested certificate, it
 	// > responds with a 201 (Created) response.
 	resp.Data[logical.HTTPStatusCode] = http.StatusCreated
+
+	var role string
+	var issuerName string
+	var issuerId string
+	if ac.Role != nil {
+		role = ac.Role.Name
+	}
+	if ac.Issuer != nil {
+		issuerName = ac.Issuer.Name
+		issuerId = ac.Issuer.ID.String()
+	}
+
+	b.pkiObserver.RecordPKIObservation(ac, req, observe.ObservationTypePKIAcmeNewOrder,
+		observe.NewAdditionalPKIMetadata("role_name", role),
+		observe.NewAdditionalPKIMetadata("issuer_name", issuerName),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuerId),
+		observe.NewAdditionalPKIMetadata("not_before", notBefore),
+		observe.NewAdditionalPKIMetadata("not_after", notAfter),
+		observe.NewAdditionalPKIMetadata("order_id", order.OrderId),
+		observe.NewAdditionalPKIMetadata("account_id", order.AccountId),
+	)
+
 	return resp, nil
 }
 
@@ -962,10 +1067,24 @@ func parseOrderIdentifiers(data map[string]interface{}) ([]*ACMEIdentifier, erro
 		switch typeStr {
 		case string(ACMEIPIdentifier):
 			identifier.Type = ACMEIPIdentifier
-			ip := net.ParseIP(valueStr)
-			if ip == nil {
+			ip, err := netip.ParseAddr(valueStr)
+			if err != nil {
 				return nil, fmt.Errorf("value argument (%s) failed validation: failed parsing as IP: %w", valueStr, ErrMalformed)
 			}
+			if ip.Is6() {
+				if len(ip.Zone()) > 0 {
+					// If we are given an identifier with a local zone that doesn't make much sense
+					// as zone's are specific to the sender not us. For now disallow, perhaps in the
+					// future we should simply drop the zone?
+					return nil, fmt.Errorf("value argument (%s) failed validation: IPv6 identifiers with zone information are not allowed: %w", valueStr, ErrMalformed)
+				}
+
+				// We should keep whatever formatting of the IPv6 address that came in according
+				// to RFC8738 Section 2:
+				// An identifier for the IPv6 address 2001:db8::1 would be formatted like so:
+				//   {"type": "ip", "value": "2001:db8::1"}
+				identifier.IsV6IP = true
+			}
 		case string(ACMEDNSIdentifier):
 			identifier.Type = ACMEDNSIdentifier
 
@@ -1012,6 +1131,10 @@ func parseOrderIdentifiers(data map[string]interface{}) ([]*ACMEIdentifier, erro
 		identifiers = append(identifiers, identifier)
 	}
 
+	if len(identifiers) == 0 {
+		return nil, fmt.Errorf("no parsed identifiers were found: %w", ErrMalformed)
+	}
+
 	return identifiers, nil
 }
 
diff --git a/builtin/logical/pki/path_acme_order_test.go b/builtin/logical/pki/path_acme_order_test.go
index 01472536ce3..f77d2743d3f 100644
--- a/builtin/logical/pki/path_acme_order_test.go
+++ b/builtin/logical/pki/path_acme_order_test.go
@@ -1,15 +1,18 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
 
 import (
+	"fmt"
 	"net"
+	"strings"
 	"testing"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -96,6 +99,135 @@ func TestACME_ValidateIdentifiersAgainstRole(t *testing.T) {
 	}
 }
 
+// Test_parseOrderIdentifiers validates we convert ACME requests into proper ACMEIdentifiers
+func Test_parseOrderIdentifiers(t *testing.T) {
+	tests := []struct {
+		name    string
+		data    map[string]interface{}
+		want    *ACMEIdentifier
+		wantErr assert.ErrorAssertionFunc
+	}{
+		{
+			name: "ipv4",
+			data: map[string]interface{}{"type": "ip", "value": "192.168.1.1"},
+			want: &ACMEIdentifier{
+				Type:          ACMEIPIdentifier,
+				Value:         "192.168.1.1",
+				OriginalValue: "192.168.1.1",
+				IsWildcard:    false,
+				IsV6IP:        false,
+			},
+			wantErr: assert.NoError,
+		},
+		{
+			name: "ipv6",
+			data: map[string]interface{}{"type": "ip", "value": "2001:0:130F::9C0:876A:130B"},
+			want: &ACMEIdentifier{
+				Type:          ACMEIPIdentifier,
+				Value:         "2001:0:130F::9C0:876A:130B",
+				OriginalValue: "2001:0:130F::9C0:876A:130B",
+				IsWildcard:    false,
+				IsV6IP:        true,
+			},
+			wantErr: assert.NoError,
+		},
+		{
+			name: "ipv4-in-ipv6",
+			data: map[string]interface{}{"type": "ip", "value": "::ffff:192.168.1.1"},
+			want: &ACMEIdentifier{
+				Type:          ACMEIPIdentifier,
+				Value:         "::ffff:192.168.1.1",
+				OriginalValue: "::ffff:192.168.1.1",
+				IsWildcard:    false,
+				IsV6IP:        true,
+			},
+			wantErr: assert.NoError,
+		},
+		{
+			name: "dns",
+			data: map[string]interface{}{"type": "dns", "value": "dadgarcorp.com"},
+			want: &ACMEIdentifier{
+				Type:          ACMEDNSIdentifier,
+				Value:         "dadgarcorp.com",
+				OriginalValue: "dadgarcorp.com",
+				IsWildcard:    false,
+				IsV6IP:        false,
+			},
+			wantErr: assert.NoError,
+		},
+		{
+			name: "wildcard-dns",
+			data: map[string]interface{}{"type": "dns", "value": "*.dadgarcorp.com"},
+			want: &ACMEIdentifier{
+				Type:          ACMEDNSIdentifier,
+				Value:         "dadgarcorp.com",
+				OriginalValue: "*.dadgarcorp.com",
+				IsWildcard:    true,
+				IsV6IP:        false,
+			},
+			wantErr: assert.NoError,
+		},
+		{
+			name:    "ipv6-with-zone", // This is debatable if we should strip or fail
+			data:    map[string]interface{}{"type": "ip", "value": "fe80::1cc0:3e8c:119f:c2e1%ens18"},
+			wantErr: ErrorContains("IPv6 identifiers with zone information are not allowed"),
+		},
+		{
+			name:    "bad-dns-wildcard",
+			data:    map[string]interface{}{"type": "dns", "value": "*192.168.1.1"},
+			wantErr: ErrorContains("invalid wildcard"),
+		},
+		{
+			name:    "ip-in-dns",
+			data:    map[string]interface{}{"type": "dns", "value": "192.168.1.1"},
+			wantErr: ErrorContains("parsed OK as IP address"),
+		},
+		{
+			name:    "empty-identifiers",
+			data:    nil,
+			wantErr: ErrorContains("no parsed identifiers were found"),
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			identifiers := map[string]interface{}{"identifiers": []interface{}{}}
+			if tt.data != nil {
+				identifiers["identifiers"] = append(identifiers["identifiers"].([]interface{}), tt.data)
+			}
+			got, err := parseOrderIdentifiers(identifiers)
+			if !tt.wantErr(t, err, fmt.Sprintf("parseOrderIdentifiers(%v)", tt.data)) {
+				return
+			} else if err != nil {
+				// If we passed the test above and an error was set no point in testing below
+				return
+			}
+
+			require.Len(t, got, 1, "expected a single return value")
+			acmeId := got[0]
+			require.Equal(t, tt.want.Type, acmeId.Type)
+			require.Equal(t, tt.want.Value, acmeId.Value)
+			require.Equal(t, tt.want.OriginalValue, acmeId.OriginalValue)
+			require.Equal(t, tt.want.IsWildcard, acmeId.IsWildcard)
+			require.Equal(t, tt.want.IsV6IP, acmeId.IsV6IP)
+		})
+	}
+}
+
+func ErrorContains(errMsg string) assert.ErrorAssertionFunc {
+	return func(t assert.TestingT, err error, i ...interface{}) bool {
+		if err == nil {
+			return assert.Fail(t, "expected error got none", i...)
+		}
+
+		if !strings.Contains(err.Error(), errMsg) {
+			return assert.Fail(t, fmt.Sprintf("error did not contain '%s':\n%+v", errMsg, err), i...)
+		}
+
+		return true
+	}
+}
+
 func _buildACMEIdentifiers(values ...string) []*ACMEIdentifier {
 	var identifiers []*ACMEIdentifier
 
diff --git a/builtin/logical/pki/path_acme_revoke.go b/builtin/logical/pki/path_acme_revoke.go
index 8cab32a8e1d..29f97e57ce9 100644
--- a/builtin/logical/pki/path_acme_revoke.go
+++ b/builtin/logical/pki/path_acme_revoke.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -11,6 +11,9 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -40,7 +43,7 @@ func patternAcmeRevoke(b *backend, pattern string, opts acmeWrapperOpts) *framew
 	}
 }
 
-func (b *backend) acmeRevocationHandler(acmeCtx *acmeContext, _ *logical.Request, _ *framework.FieldData, userCtx *jwsCtx, data map[string]interface{}) (*logical.Response, error) {
+func (b *backend) acmeRevocationHandler(acmeCtx *acmeContext, req *logical.Request, _ *framework.FieldData, userCtx *jwsCtx, data map[string]interface{}) (*logical.Response, error) {
 	var cert *x509.Certificate
 
 	rawCertificate, present := data["certificate"]
@@ -82,7 +85,7 @@ func (b *backend) acmeRevocationHandler(acmeCtx *acmeContext, _ *logical.Request
 
 	// Fetch the CRL config as we need it to ultimately do the
 	// revocation. This should be cached and thus relatively fast.
-	config, err := b.CrlBuilder().getConfigWithUpdate(acmeCtx.sc)
+	config, err := b.CrlBuilder().GetConfigWithUpdate(acmeCtx.sc)
 	if err != nil {
 		return nil, fmt.Errorf("unable to revoke certificate: failed reading revocation config: %v: %w", err, ErrServerInternal)
 	}
@@ -90,7 +93,7 @@ func (b *backend) acmeRevocationHandler(acmeCtx *acmeContext, _ *logical.Request
 	// Load our certificate from storage to ensure it exists and matches
 	// what was given to us.
 	serial := serialFromCert(cert)
-	certEntry, err := fetchCertBySerial(acmeCtx.sc, "certs/", serial)
+	certEntry, err := fetchCertBySerial(acmeCtx.sc, issuing.PathCerts, serial)
 	if err != nil {
 		return nil, fmt.Errorf("unable to revoke certificate: err reading global cert entry: %v: %w", err, ErrServerInternal)
 	}
@@ -124,6 +127,12 @@ func (b *backend) acmeRevocationHandler(acmeCtx *acmeContext, _ *logical.Request
 		return nil, fmt.Errorf("unable to revoke certificate: %w", ErrAlreadyRevoked)
 	}
 
+	b.pkiObserver.RecordPKIObservation(acmeCtx, req, observe.ObservationTypePKIAcmeRevoke,
+		observe.NewAdditionalPKIMetadata("issuer_name", cert.Issuer.String()),
+		observe.NewAdditionalPKIMetadata("is_ca", cert.IsCA),
+		observe.NewAdditionalPKIMetadata("serial_number", cert.SerialNumber.String()),
+	)
+
 	// Finally, do the relevant permissions/authorization check as
 	// appropriate based on the type of revocation happening.
 	if !userCtx.Existing {
@@ -133,7 +142,7 @@ func (b *backend) acmeRevocationHandler(acmeCtx *acmeContext, _ *logical.Request
 	return b.acmeRevocationByAccount(acmeCtx, userCtx, cert, config)
 }
 
-func (b *backend) acmeRevocationByPoP(acmeCtx *acmeContext, userCtx *jwsCtx, cert *x509.Certificate, config *crlConfig) (*logical.Response, error) {
+func (b *backend) acmeRevocationByPoP(acmeCtx *acmeContext, userCtx *jwsCtx, cert *x509.Certificate, config *pki_backend.CrlConfig) (*logical.Response, error) {
 	// Since this account does not exist, ensure we've gotten a private key
 	// matching the certificate's public key. This private key isn't
 	// explicitly provided, but instead provided by proxy (public key,
@@ -159,7 +168,7 @@ func (b *backend) acmeRevocationByPoP(acmeCtx *acmeContext, userCtx *jwsCtx, cer
 	return revokeCert(acmeCtx.sc, config, cert)
 }
 
-func (b *backend) acmeRevocationByAccount(acmeCtx *acmeContext, userCtx *jwsCtx, cert *x509.Certificate, config *crlConfig) (*logical.Response, error) {
+func (b *backend) acmeRevocationByAccount(acmeCtx *acmeContext, userCtx *jwsCtx, cert *x509.Certificate, config *pki_backend.CrlConfig) (*logical.Response, error) {
 	// Fetch the account; disallow revocations from non-valid-status accounts.
 	_, err := requireValidAcmeAccount(acmeCtx, userCtx)
 	if err != nil {
diff --git a/builtin/logical/pki/path_acme_test.go b/builtin/logical/pki/path_acme_test.go
index cee8fe36078..5ca158c8186 100644
--- a/builtin/logical/pki/path_acme_test.go
+++ b/builtin/logical/pki/path_acme_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -32,6 +32,7 @@ import (
 	"github.com/hashicorp/vault/helper/testhelpers"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
@@ -60,7 +61,7 @@ func TestAcmeBasicWorkflow(t *testing.T) {
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			baseAcmeURL := "/v1/pki/" + tc.prefixUrl
-			accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+			accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 			require.NoError(t, err, "failed creating rsa key")
 
 			acmeClient := getAcmeClientForCluster(t, cluster, baseAcmeURL, accountKey)
@@ -310,7 +311,7 @@ func TestAcmeBasicWorkflow(t *testing.T) {
 			// Make sure the certificate has a NotAfter date of a maximum of 90 days
 			acmeCert, err := x509.ParseCertificate(certs[0])
 			require.NoError(t, err, "failed parsing acme cert bytes")
-			maxAcmeNotAfter := time.Now().Add(maxAcmeCertTTL)
+			maxAcmeNotAfter := time.Now().Add(defaultAcmeMaxTTL)
 			if maxAcmeNotAfter.Before(acmeCert.NotAfter) {
 				require.Fail(t, fmt.Sprintf("certificate has a NotAfter value %v greater than ACME max ttl %v", acmeCert.NotAfter, maxAcmeNotAfter))
 			}
@@ -592,7 +593,7 @@ func TestAcmeAccountsCrossingDirectoryPath(t *testing.T) {
 	defer cluster.Cleanup()
 
 	baseAcmeURL := "/v1/pki/acme/"
-	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa key")
 
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
@@ -628,7 +629,7 @@ func TestAcmeEabCrossingDirectoryPath(t *testing.T) {
 	require.NoError(t, err)
 
 	baseAcmeURL := "/v1/pki/acme/"
-	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa key")
 
 	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
@@ -710,6 +711,85 @@ func TestAcmeConfigChecksPublicAcmeEnv(t *testing.T) {
 	require.NoError(t, err)
 }
 
+// TestAcmeHonorsAlwaysEnforceErr verifies that we get an error and not truncated if the issuer's
+// leaf_not_after_behavior is set to always_enforce_err
+func TestAcmeHonorsAlwaysEnforceErr(t *testing.T) {
+	t.Parallel()
+
+	cluster, client, _ := setupAcmeBackend(t)
+	defer cluster.Cleanup()
+
+	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	mount := "pki"
+	resp, err := client.Logical().WriteWithContext(context.Background(), mount+"/issuers/generate/intermediate/internal",
+		map[string]interface{}{
+			"key_name":    "short-key",
+			"key_type":    "ec",
+			"common_name": "test.com",
+		})
+	require.NoError(t, err, "failed creating intermediary CSR")
+	intermediateCSR := resp.Data["csr"].(string)
+
+	// Sign the intermediate CSR using /pki
+	resp, err = client.Logical().Write(mount+"/issuer/root-ca/sign-intermediate", map[string]interface{}{
+		"csr":     intermediateCSR,
+		"ttl":     "10m",
+		"max_ttl": "1h",
+	})
+	require.NoError(t, err, "failed signing intermediary CSR")
+	intermediateCertPEM := resp.Data["certificate"].(string)
+
+	// Configure the intermediate cert as the CA in /pki2
+	resp, err = client.Logical().Write(mount+"/issuers/import/cert", map[string]interface{}{
+		"pem_bundle": intermediateCertPEM,
+	})
+	require.NoError(t, err, "failed importing intermediary cert")
+	importedIssuersRaw := resp.Data["imported_issuers"].([]interface{})
+	require.Len(t, importedIssuersRaw, 1)
+	shortCaUuid := importedIssuersRaw[0].(string)
+
+	_, err = client.Logical().Write(mount+"/issuer/"+shortCaUuid, map[string]interface{}{
+		"leaf_not_after_behavior": "always_enforce_err",
+		"issuer_name":             "short-ca",
+	})
+	require.NoError(t, err, "failed updating issuer name")
+
+	baseAcmeURL := "/v1/pki/issuer/short-ca/acme/"
+	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err, "failed creating rsa key")
+
+	acmeClient := getAcmeClientForCluster(t, cluster, baseAcmeURL, accountKey)
+
+	// Create new account
+	t.Logf("Testing register on %s", baseAcmeURL)
+	acct, err := acmeClient.Register(testCtx, &acme.Account{}, func(tosURL string) bool { return true })
+	require.NoError(t, err, "failed registering account")
+
+	// Create an order
+	t.Logf("Testing Authorize Order on %s", baseAcmeURL)
+	identifiers := []string{"*.localdomain"}
+	order, err := acmeClient.AuthorizeOrder(testCtx, []acme.AuthzID{
+		{Type: "dns", Value: identifiers[0]},
+	})
+	require.NoError(t, err, "failed creating order")
+
+	// HACK: Update authorization/challenge to completed as we can't really do it properly in this workflow
+	//       test.
+	markAuthorizationSuccess(t, client, acmeClient, acct, order)
+
+	// Build a proper CSR, with the correct name and signed with a different key works.
+	goodCr := &x509.CertificateRequest{DNSNames: []string{identifiers[0]}}
+	csrKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err, "failed generated key for CSR")
+	csr, err := x509.CreateCertificateRequest(rand.Reader, goodCr, csrKey)
+	require.NoError(t, err, "failed generating csr")
+
+	_, _, err = acmeClient.CreateOrderCert(testCtx, order.FinalizeURL, csr, true)
+	require.ErrorContains(t, err, "cannot satisfy request, as TTL would result in notAfter", "failed finalizing order")
+}
+
 // TestAcmeTruncatesToIssuerExpiry make sure that if the selected issuer's expiry is shorter than the
 // CSR's selected TTL value in ACME and the issuer's leaf_not_after_behavior setting is set to Err,
 // we will override the configured behavior and truncate to the issuer's NotAfter
@@ -759,7 +839,7 @@ func TestAcmeTruncatesToIssuerExpiry(t *testing.T) {
 	require.NoError(t, err, "failed updating issuer name")
 
 	baseAcmeURL := "/v1/pki/issuer/short-ca/acme/"
-	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa key")
 
 	acmeClient := getAcmeClientForCluster(t, cluster, baseAcmeURL, accountKey)
@@ -831,7 +911,7 @@ func TestAcmeRoleExtKeyUsage(t *testing.T) {
 	_, err := client.Logical().Write("pki/roles/"+roleName, roleOpt)
 
 	baseAcmeURL := "/v1/pki/roles/" + roleName + "/acme/"
-	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa key")
 
 	require.NoError(t, err, "failed creating role test-role")
@@ -1100,7 +1180,7 @@ func TestAcmeWithCsrIncludingBasicConstraintExtension(t *testing.T) {
 	defer cancel()
 
 	baseAcmeURL := "/v1/pki/acme/"
-	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa key")
 
 	acmeClient := getAcmeClientForCluster(t, cluster, baseAcmeURL, accountKey)
@@ -1394,7 +1474,7 @@ func setupAcmeBackendOnClusterAtPath(t *testing.T, cluster *vault.TestCluster, c
 	return cluster, client, pathConfig
 }
 
-func testAcmeCertSignedByCa(t *testing.T, client *api.Client, derCerts [][]byte, issuerRef string) {
+func testAcmeCertSignedByCa(t *testing.T, client *api.Client, derCerts [][]byte, issuerRef string) *x509.Certificate {
 	t.Helper()
 	require.NotEmpty(t, derCerts)
 	acmeCert, err := x509.ParseCertificate(derCerts[0])
@@ -1418,6 +1498,8 @@ func testAcmeCertSignedByCa(t *testing.T, client *api.Client, derCerts [][]byte,
 	if diffs := deep.Equal(expectedCerts, derCerts); diffs != nil {
 		t.Fatalf("diffs were found between the acme chain returned and the expected value: \n%v", diffs)
 	}
+
+	return acmeCert
 }
 
 // TestAcmeValidationError make sure that we properly return errors on validation errors.
@@ -1430,7 +1512,7 @@ func TestAcmeValidationError(t *testing.T) {
 	defer cancel()
 
 	baseAcmeURL := "/v1/pki/acme/"
-	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa key")
 
 	acmeClient := getAcmeClientForCluster(t, cluster, baseAcmeURL, accountKey)
@@ -1538,12 +1620,12 @@ func TestAcmeRevocationAcrossAccounts(t *testing.T) {
 	defer cancel()
 
 	baseAcmeURL := "/v1/pki/acme/"
-	accountKey1, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey1, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa key")
 
 	acmeClient1 := getAcmeClientForCluster(t, cluster, baseAcmeURL, accountKey1)
 
-	leafKey, certs := doACMEWorkflow(t, vaultClient, acmeClient1)
+	_, leafKey, certs := doACMEWorkflow(t, vaultClient, acmeClient1)
 	acmeCert, err := x509.ParseCertificate(certs[0])
 	require.NoError(t, err, "failed parsing acme cert bytes")
 
@@ -1593,7 +1675,7 @@ func TestAcmeRevocationAcrossAccounts(t *testing.T) {
 		"revocation time was not greater than 0, cert was not revoked: %v", revocationTimeInt)
 
 	// Make sure we can revoke a certificate without a registered ACME account
-	leafKey2, certs2 := doACMEWorkflow(t, vaultClient, acmeClient1)
+	_, leafKey2, certs2 := doACMEWorkflow(t, vaultClient, acmeClient1)
 
 	acmeClient3 := getAcmeClientForCluster(t, cluster, baseAcmeURL, nil)
 	err = acmeClient3.RevokeCert(ctx, leafKey2, certs2[0], acme.CRLReasonUnspecified)
@@ -1613,7 +1695,180 @@ func TestAcmeRevocationAcrossAccounts(t *testing.T) {
 		"revocation time was not greater than 0, cert was not revoked: %v", revocationTimeInt)
 }
 
-func doACMEWorkflow(t *testing.T, vaultClient *api.Client, acmeClient *acme.Client) (*ecdsa.PrivateKey, [][]byte) {
+// TestAcmeMaxTTL verify that we can update the ACME configuration's max_ttl value and
+// get a certificate that has a higher notAfter beyond the 90 day original limit
+func TestAcmeMaxTTL(t *testing.T) {
+	t.Parallel()
+	cluster, client, _ := setupAcmeBackend(t)
+	defer cluster.Cleanup()
+
+	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	numHours := 140 * 24 // The ACME role has a TTL of 152 days
+	acmeConfig := map[string]interface{}{
+		"enabled":                  true,
+		"allowed_issuers":          "*",
+		"allowed_roles":            "*",
+		"default_directory_policy": "role:acme",
+		"dns_resolver":             "",
+		"eab_policy_name":          "",
+		"max_ttl":                  fmt.Sprintf("%dh", numHours),
+	}
+	_, err := client.Logical().WriteWithContext(testCtx, "pki/config/acme", acmeConfig)
+	require.NoError(t, err, "error configuring acme")
+
+	// First Create Our Client
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
+	require.NoError(t, err, "failed creating rsa key")
+	acmeClient := getAcmeClientForCluster(t, cluster, "/v1/pki/acme/", accountKey)
+
+	discovery, err := acmeClient.Discover(testCtx)
+	require.NoError(t, err, "failed acme discovery call")
+	t.Logf("%v", discovery)
+
+	acct, err := acmeClient.Register(testCtx, &acme.Account{
+		Contact: []string{"mailto:test@example.com"},
+	}, func(tosURL string) bool { return true })
+	require.NoError(t, err, "failed registering account")
+	require.Equal(t, acme.StatusValid, acct.Status)
+	require.Contains(t, acct.Contact, "mailto:test@example.com")
+	require.Len(t, acct.Contact, 1)
+
+	authorizations := []acme.AuthzID{
+		{"dns", "localhost"},
+	}
+	// Create an order
+	identifiers := make([]string, len(authorizations))
+	for index, auth := range authorizations {
+		identifiers[index] = auth.Value
+	}
+
+	createOrder, err := acmeClient.AuthorizeOrder(testCtx, authorizations)
+	require.NoError(t, err, "failed creating order")
+	require.Equal(t, acme.StatusPending, createOrder.Status)
+	require.Empty(t, createOrder.CertURL)
+	require.Equal(t, createOrder.URI+"/finalize", createOrder.FinalizeURL)
+	require.Len(t, createOrder.AuthzURLs, len(authorizations), "expected same number of authzurls as identifiers")
+
+	// HACK: Update authorization/challenge to completed as we can't really do it properly in this workflow
+	//       test.
+	markAuthorizationSuccess(t, client, acmeClient, acct, createOrder)
+
+	// Submit the CSR
+	requestCSR := x509.CertificateRequest{
+		Subject: pkix.Name{CommonName: "localhost"},
+	}
+	csrKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err, "failed generated key for CSR")
+	csr, err := x509.CreateCertificateRequest(rand.Reader, &requestCSR, csrKey)
+	require.NoError(t, err, "failed generating csr")
+
+	certs, _, err := acmeClient.CreateOrderCert(testCtx, createOrder.FinalizeURL, csr, true)
+	require.NoError(t, err, "failed finalizing order")
+
+	// Validate we get a signed cert back
+	acmeCert := testAcmeCertSignedByCa(t, client, certs, "int-ca")
+	duration := time.Duration(numHours) * time.Hour
+	maxTTL := time.Now().Add(duration)
+	buffer := time.Duration(24) * time.Hour
+	dayTruncate := time.Duration(24) * time.Hour
+
+	acmeCertNotAfter := acmeCert.NotAfter.Truncate(dayTruncate)
+
+	// Make sure we are in the ballpark of our max_ttl value.
+	require.Greaterf(t, acmeCertNotAfter, maxTTL.Add(-1*buffer), "ACME cert: %v should have been greater than max TTL was %v", acmeCert.NotAfter, maxTTL)
+	require.Less(t, acmeCertNotAfter, maxTTL.Add(buffer), "ACME cert: %v should have been less than max TTL was %v", acmeCert.NotAfter, maxTTL)
+}
+
+// TestVaultOperatorACMEDisableWorkflow validates that the Vault management API for ACME accounts works as expected.
+func TestVaultOperatorACMEDisableWorkflow(t *testing.T) {
+	t.Parallel()
+	cluster, vaultClient, _ := setupAcmeBackend(t)
+	defer cluster.Cleanup()
+	testCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	// Make sure we can call list on an empty ACME mount
+	resp, err := vaultClient.Logical().ListWithContext(testCtx, "pki/acme/mgmt/account/keyid")
+	require.NoError(t, err, "failed listing acme accounts")
+	require.Nil(t, resp, "expected nil, nil response on list of an empty mount")
+
+	// Make sure we get nil, nil response when trying to read a non-existent key (the API returns this for a 404)
+	resp, err = vaultClient.Logical().ReadWithContext(testCtx, "pki/acme/mgmt/account/keyid/doesnotexist")
+	require.NoError(t, err, "failed reading non-existent ACME key")
+	require.Nil(t, resp, "expected nil, nil response on a non-existent ACME key")
+
+	// Make sure we get an error response when trying to write to a non-existent key, unlike read the write call returns an error.
+	_, err = vaultClient.Logical().WriteWithContext(testCtx, "pki/acme/mgmt/account/keyid/doesnotexist", map[string]interface{}{"status": "valid"})
+	require.ErrorContains(t, err, "did not exist", "failed writing non-existent ACME key")
+
+	baseAcmeURL := "/v1/pki/acme/"
+	accountKey1, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
+	require.NoError(t, err, "failed creating rsa key")
+
+	acmeClient := getAcmeClientForCluster(t, cluster, baseAcmeURL, accountKey1)
+	acct, _, _ := doACMEWorkflow(t, vaultClient, acmeClient)
+
+	// ACME client KID is formatted as https://127.0.0.1:60777/v1/pki/acme/account/45f52b66-a3ed-4080-dec7-cdcff1ef189f
+	acmeClientKid := acmeClient.KID
+
+	// Make sure we can call list on an empty ACME mount
+	resp, err = vaultClient.Logical().ListWithContext(testCtx, "pki/acme/mgmt/account/keyid")
+	require.NoError(t, err, "failed listing acme accounts")
+	require.NotNil(t, resp, "expected non-nil response on list on ACME keyid")
+	keysFromList := resp.Data["keys"].([]interface{})
+	require.Len(t, keysFromList, 1, "expected one key in the list")
+	kid := keysFromList[0].(string)
+	require.True(t, strings.HasSuffix(string(acmeClientKid), kid), "expected key to match the one the ACME client has")
+
+	// Make sure we can read the key we just listed
+	resp, err = vaultClient.Logical().ReadWithContext(testCtx, "pki/acme/mgmt/account/keyid/"+kid)
+	require.NoError(t, err, "failed reading ACME with account key")
+	require.NotNil(t, resp, "read response was nil on ACME keyid")
+	require.Equal(t, "acme/", resp.Data["directory"], "expected directory field in response")
+	require.Equal(t, kid, resp.Data["key_id"], "expected key_id field in response")
+	require.Equal(t, "valid", resp.Data["status"], "expected status field in response")
+	require.NotEmpty(t, resp.Data["created_time"], "expected created_time field in response")
+	require.NotEmpty(t, resp.Data["orders"], "expected orders field in response")
+	require.Empty(t, resp.Data["revoked_time"], "expected revoked_time field in response")
+	require.Empty(t, resp.Data["eab"], "expected eab field in response to be empty")
+	orders := resp.Data["orders"].([]interface{})
+	require.Len(t, orders, 1, "expected one order in the list")
+	order := orders[0].(map[string]interface{})
+	require.NotEmpty(t, order["order_id"], "expected order_id field in response")
+	require.NotEmpty(t, order["cert_expiry"], "expected cert_expiry field in response")
+	require.NotEmpty(t, order["cert_serial_number"], "expected cert_serial_number field in response")
+
+	// Make sure we can update the status of the account to revoked and the revoked_time field is set
+	resp, err = vaultClient.Logical().WriteWithContext(testCtx, "pki/acme/mgmt/account/keyid/"+kid, map[string]interface{}{"status": "revoked"})
+	require.NoError(t, err, "failed updating writing ACME with account key")
+	require.NotNil(t, resp, "expected non-nil response on write to ACME keyid")
+	require.Equal(t, "acme/", resp.Data["directory"], "expected directory field in response")
+	require.Equal(t, kid, resp.Data["key_id"], "expected key_id field in response")
+	require.Equal(t, "revoked", resp.Data["status"], "expected status field in response")
+	require.NotEmpty(t, resp.Data["created_time"], "expected created_time field in response")
+	require.NotEmpty(t, resp.Data["revoked_time"], "expected revoked_time field in response")
+	require.Empty(t, resp.Data["eab"], "expected eab field in response to be empty")
+	require.Empty(t, resp.Data["orders"], "write response should not contain orders")
+
+	// Now make sure that we can't use the ACME account anymore
+	identifiers := []string{"*.localdomain"}
+	_, err = acmeClient.AuthorizeOrder(testCtx, []acme.AuthzID{
+		{Type: "dns", Value: identifiers[0]},
+	})
+	require.ErrorContains(t, err, "account in status: revoked", "Requesting an order with a revoked account should have failed")
+
+	// Switch the account back to valid and make sure we can use it again
+	resp, err = vaultClient.Logical().WriteWithContext(testCtx, "pki/acme/mgmt/account/keyid/"+kid, map[string]interface{}{"status": "valid"})
+	require.NoError(t, err, "failed updating writing ACME with account key")
+	require.Empty(t, resp.Data["revoked_time"], "revoked_time should have been reset")
+	require.Equal(t, "valid", resp.Data["status"], "status should have been reset to valid")
+
+	doACMEOrderWorkflow(t, vaultClient, acmeClient, acct)
+}
+
+func doACMEWorkflow(t *testing.T, vaultClient *api.Client, acmeClient *acme.Client) (*acme.Account, *ecdsa.PrivateKey, [][]byte) {
 	testCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
@@ -1628,6 +1883,14 @@ func doACMEWorkflow(t *testing.T, vaultClient *api.Client, acmeClient *acme.Clie
 		}
 	}
 
+	csrKey, certs := doACMEOrderWorkflow(t, vaultClient, acmeClient, acct)
+	return acct, csrKey, certs
+}
+
+func doACMEOrderWorkflow(t *testing.T, vaultClient *api.Client, acmeClient *acme.Client, acct *acme.Account) (*ecdsa.PrivateKey, [][]byte) {
+	testCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
 	// Create an order
 	identifiers := []string{"*.localdomain"}
 	order, err := acmeClient.AuthorizeOrder(testCtx, []acme.AuthzID{
@@ -1779,7 +2042,7 @@ func TestACMEClientRequestLimits(t *testing.T) {
 	for _, tc := range cases {
 
 		// First Create Our Client
-		accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+		accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 		require.NoError(t, err, "failed creating rsa key")
 		acmeClient := getAcmeClientForCluster(t, cluster, "/v1/pki/acme/", accountKey)
 
diff --git a/builtin/logical/pki/path_config_acme.go b/builtin/logical/pki/path_config_acme.go
index a005e77b6a4..3ac8981392e 100644
--- a/builtin/logical/pki/path_config_acme.go
+++ b/builtin/logical/pki/path_config_acme.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -11,7 +11,9 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+	"time"
 
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
@@ -23,6 +25,7 @@ const (
 	pathConfigAcmeHelpSyn  = "Configuration of ACME Endpoints"
 	pathConfigAcmeHelpDesc = "Here we configure:\n\nenabled=false, whether ACME is enabled, defaults to false meaning that clusters will by default not get ACME support,\nallowed_issuers=\"default\", which issuers are allowed for use with ACME; by default, this will only be the primary (default) issuer,\nallowed_roles=\"*\", which roles are allowed for use with ACME; by default these will be all roles matching our selection criteria,\ndefault_directory_policy=\"\", either \"forbid\", preventing the default directory from being used at all, \"role:<role_name>\" which is the role to be used for non-role-qualified ACME requests; or \"sign-verbatim\", the default meaning ACME issuance will be equivalent to sign-verbatim.,\ndns_resolver=\"\", which specifies a custom DNS resolver to use for all ACME-related DNS lookups"
 	disableAcmeEnvVar      = "VAULT_DISABLE_PUBLIC_ACME"
+	defaultAcmeMaxTTL      = 90 * (24 * time.Hour)
 )
 
 type acmeConfigEntry struct {
@@ -33,6 +36,7 @@ type acmeConfigEntry struct {
 	DefaultDirectoryPolicy string        `json:"default_directory_policy"`
 	DNSResolver            string        `json:"dns_resolver"`
 	EabPolicyName          EabPolicyName `json:"eab_policy_name"`
+	MaxTTL                 time.Duration `json:"max_ttl"`
 }
 
 var defaultAcmeConfig = acmeConfigEntry{
@@ -43,6 +47,7 @@ var defaultAcmeConfig = acmeConfigEntry{
 	DefaultDirectoryPolicy: "sign-verbatim",
 	DNSResolver:            "",
 	EabPolicyName:          eabPolicyNotRequired,
+	MaxTTL:                 defaultAcmeMaxTTL,
 }
 
 var (
@@ -53,7 +58,7 @@ var (
 	rolePrefixLength      = len(rolePrefix)
 )
 
-func (sc *storageContext) getAcmeConfig() (*acmeConfigEntry, error) {
+func getAcmeConfig(sc *storageContext) (*acmeConfigEntry, error) {
 	entry, err := sc.Storage.Get(sc.Context, storageAcmeConfig)
 	if err != nil {
 		return nil, err
@@ -69,6 +74,11 @@ func (sc *storageContext) getAcmeConfig() (*acmeConfigEntry, error) {
 		return nil, errutil.InternalError{Err: fmt.Sprintf("unable to decode ACME configuration: %v", err)}
 	}
 
+	// Update previous stored configurations to use the default max ttl we used to enforce
+	if mapping.MaxTTL == 0 {
+		mapping.MaxTTL = defaultAcmeMaxTTL
+	}
+
 	return &mapping, nil
 }
 
@@ -129,6 +139,11 @@ func pathAcmeConfig(b *backend) *framework.Path {
 				Description: `Specify the policy to use for external account binding behaviour, 'not-required', 'new-account-required' or 'always-required'`,
 				Default:     "always-required",
 			},
+			"max_ttl": {
+				Type:        framework.TypeDurationSecond,
+				Description: `Specify the maximum TTL for ACME certificates. Role TTL values will be limited to this value`,
+				Default:     defaultAcmeMaxTTL.Seconds(),
+			},
 		},
 
 		Operations: map[logical.Operation]framework.OperationHandler{
@@ -170,6 +185,10 @@ func (b *backend) pathAcmeRead(ctx context.Context, req *logical.Request, _ *fra
 		}
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigACMERead,
+		observe.NewAdditionalPKIMetadata("enabled", config.Enabled),
+	)
+
 	return genResponseFromAcmeConfig(config, warnings), nil
 }
 
@@ -183,6 +202,7 @@ func genResponseFromAcmeConfig(config *acmeConfigEntry, warnings []string) *logi
 			"enabled":                  config.Enabled,
 			"dns_resolver":             config.DNSResolver,
 			"eab_policy":               config.EabPolicyName,
+			"max_ttl":                  config.MaxTTL.Seconds(),
 		},
 		Warnings: warnings,
 	}
@@ -251,6 +271,14 @@ func (b *backend) pathAcmeWrite(ctx context.Context, req *logical.Request, d *fr
 		config.EabPolicyName = eabPolicy.Name
 	}
 
+	if maxTTLRaw, ok := d.GetOk("max_ttl"); ok {
+		maxTTL := time.Second * time.Duration(maxTTLRaw.(int))
+		if maxTTL <= 0 {
+			return nil, fmt.Errorf("invalid max_ttl value, must be greater than 0")
+		}
+		config.MaxTTL = maxTTL
+	}
+
 	// Validate Default Directory Behavior:
 	defaultDirectoryPolicyType, extraInfo, err := getDefaultDirectoryPolicyType(config.DefaultDirectoryPolicy)
 	if err != nil {
@@ -341,6 +369,13 @@ func (b *backend) pathAcmeWrite(ctx context.Context, req *logical.Request, d *fr
 		return nil, fmt.Errorf("failed persisting: %w", err)
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigACMEWrite,
+		observe.NewAdditionalPKIMetadata("enabled", config.Enabled),
+		observe.NewAdditionalPKIMetadata("default_directory_policy_type", defaultDirectoryPolicyType),
+		observe.NewAdditionalPKIMetadata("max_ttl", config.MaxTTL),
+		observe.NewAdditionalPKIMetadata("eab_policy_name", config.EabPolicyName),
+	)
+
 	return genResponseFromAcmeConfig(config, warnings), nil
 }
 
@@ -394,6 +429,7 @@ func getDefaultDirectoryPolicyType(defaultDirectoryPolicy string) (DefaultDirect
 	}
 }
 
+//go:generate enumer -type=DefaultDirectoryPolicyType
 type DefaultDirectoryPolicyType int
 
 const (
diff --git a/builtin/logical/pki/path_config_acme_test.go b/builtin/logical/pki/path_config_acme_test.go
index 47ba1f817de..bcdeb3d4254 100644
--- a/builtin/logical/pki/path_config_acme_test.go
+++ b/builtin/logical/pki/path_config_acme_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -6,11 +6,11 @@ package pki
 import (
 	"context"
 	"crypto/rand"
-	"crypto/rsa"
 	"testing"
 	"time"
 
 	"github.com/hashicorp/vault/helper/constants"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/stretchr/testify/require"
 )
 
@@ -117,7 +117,7 @@ func TestAcmeConfig(t *testing.T) {
 				require.NoError(t, err)
 
 				baseAcmeURL := "/v1/pki/" + tc.prefixUrl
-				accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+				accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 				require.NoError(t, err, "failed creating rsa key")
 
 				acmeClient := getAcmeClientForCluster(t, cluster, baseAcmeURL, accountKey)
diff --git a/builtin/logical/pki/path_config_ca.go b/builtin/logical/pki/path_config_ca.go
index a898b811bef..f3b3f4951f8 100644
--- a/builtin/logical/pki/path_config_ca.go
+++ b/builtin/logical/pki/path_config_ca.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -8,6 +8,7 @@ import (
 	"net/http"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -223,6 +224,10 @@ func (b *backend) pathCAIssuersRead(ctx context.Context, req *logical.Request, _
 		return logical.ErrorResponse("Error loading issuers configuration: " + err.Error()), nil
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigIssuersRead,
+		observe.NewAdditionalPKIMetadata("default_issuer_id", config.DefaultIssuerId),
+		observe.NewAdditionalPKIMetadata("default_follows_latest_issuer", config.DefaultFollowsLatestIssuer))
+
 	return b.formatCAIssuerConfigRead(config), nil
 }
 
@@ -291,6 +296,10 @@ func (b *backend) pathCAIssuersWrite(ctx context.Context, req *logical.Request,
 		return logical.ErrorResponse("Error updating issuer configuration: " + err.Error()), nil
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigIssuersWrite,
+		observe.NewAdditionalPKIMetadata("default_issuer_id", config.DefaultIssuerId),
+		observe.NewAdditionalPKIMetadata("default_follows_latest_issuer", config.DefaultFollowsLatestIssuer))
+
 	return response, nil
 }
 
@@ -381,6 +390,9 @@ func (b *backend) pathKeyDefaultRead(ctx context.Context, req *logical.Request,
 		return logical.ErrorResponse("Error loading keys configuration: " + err.Error()), nil
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigKeysRead,
+		observe.NewAdditionalPKIMetadata("default_key_id", config.DefaultKeyId))
+
 	return &logical.Response{
 		Data: map[string]interface{}{
 			defaultRef: config.DefaultKeyId,
@@ -414,6 +426,10 @@ func (b *backend) pathKeyDefaultWrite(ctx context.Context, req *logical.Request,
 		return logical.ErrorResponse("Error updating issuer configuration: " + err.Error()), nil
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigKeysWrite,
+		observe.NewAdditionalPKIMetadata("default_key_id", parsedKey),
+	)
+
 	return &logical.Response{
 		Data: map[string]interface{}{
 			defaultRef: parsedKey,
diff --git a/builtin/logical/pki/path_config_cluster.go b/builtin/logical/pki/path_config_cluster.go
index a97769831b1..d522fd0a45a 100644
--- a/builtin/logical/pki/path_config_cluster.go
+++ b/builtin/logical/pki/path_config_cluster.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -9,6 +9,7 @@ import (
 	"net/http"
 
 	"github.com/asaskevich/govalidator"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -143,6 +144,8 @@ func (b *backend) pathReadCluster(ctx context.Context, req *logical.Request, _ *
 		},
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigClusterRead)
+
 	return resp, nil
 }
 
@@ -181,6 +184,11 @@ func (b *backend) pathWriteCluster(ctx context.Context, req *logical.Request, da
 		},
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigClusterWrite,
+		observe.NewAdditionalPKIMetadata("path", cfg.Path),
+		observe.NewAdditionalPKIMetadata("aia_path", cfg.AIAPath),
+	)
+
 	return resp, nil
 }
 
diff --git a/builtin/logical/pki/path_config_crl.go b/builtin/logical/pki/path_config_crl.go
index cd28643f4a7..a5fb206a534 100644
--- a/builtin/logical/pki/path_config_crl.go
+++ b/builtin/logical/pki/path_config_crl.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -9,44 +9,76 @@ import (
 	"net/http"
 
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
 	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
-const latestCrlConfigVersion = 1
-
-// CRLConfig holds basic CRL configuration information
-type crlConfig struct {
-	Version                   int    `json:"version"`
-	Expiry                    string `json:"expiry"`
-	Disable                   bool   `json:"disable"`
-	OcspDisable               bool   `json:"ocsp_disable"`
-	AutoRebuild               bool   `json:"auto_rebuild"`
-	AutoRebuildGracePeriod    string `json:"auto_rebuild_grace_period"`
-	OcspExpiry                string `json:"ocsp_expiry"`
-	EnableDelta               bool   `json:"enable_delta"`
-	DeltaRebuildInterval      string `json:"delta_rebuild_interval"`
-	UseGlobalQueue            bool   `json:"cross_cluster_revocation"`
-	UnifiedCRL                bool   `json:"unified_crl"`
-	UnifiedCRLOnExistingPaths bool   `json:"unified_crl_on_existing_paths"`
-}
-
-// Implicit default values for the config if it does not exist.
-var defaultCrlConfig = crlConfig{
-	Version:                   latestCrlConfigVersion,
-	Expiry:                    "72h",
-	Disable:                   false,
-	OcspDisable:               false,
-	OcspExpiry:                "12h",
-	AutoRebuild:               false,
-	AutoRebuildGracePeriod:    "12h",
-	EnableDelta:               false,
-	DeltaRebuildInterval:      "15m",
-	UseGlobalQueue:            false,
-	UnifiedCRL:                false,
-	UnifiedCRLOnExistingPaths: false,
+var configCRLFields = map[string]*framework.FieldSchema{
+	"expiry": {
+		Type: framework.TypeString,
+		Description: `The amount of time the generated CRL should be
+valid; defaults to 72 hours`,
+		Default: "72h",
+	},
+	"disable": {
+		Type:        framework.TypeBool,
+		Description: `If set to true, disables generating the CRL entirely.`,
+	},
+	"ocsp_disable": {
+		Type:        framework.TypeBool,
+		Description: `If set to true, ocsp unauthorized responses will be returned.`,
+	},
+	"ocsp_expiry": {
+		Type: framework.TypeString,
+		Description: `The amount of time an OCSP response will be valid (controls 
+the NextUpdate field); defaults to 12 hours`,
+		Default: "1h",
+	},
+	"auto_rebuild": {
+		Type:        framework.TypeBool,
+		Description: `If set to true, enables automatic rebuilding of the CRL`,
+	},
+	"auto_rebuild_grace_period": {
+		Type:        framework.TypeString,
+		Description: `The time before the CRL expires to automatically rebuild it, when enabled. Must be shorter than the CRL expiry. Defaults to 12h.`,
+		Default:     "12h",
+	},
+	"enable_delta": {
+		Type:        framework.TypeBool,
+		Description: `Whether to enable delta CRLs between authoritative CRL rebuilds`,
+	},
+	"delta_rebuild_interval": {
+		Type:        framework.TypeString,
+		Description: `The time between delta CRL rebuilds if a new revocation has occurred. Must be shorter than the CRL expiry. Defaults to 15m.`,
+		Default:     "15m",
+	},
+	"cross_cluster_revocation": {
+		Type: framework.TypeBool,
+		Description: `Whether to enable a global, cross-cluster revocation queue.
+Must be used with auto_rebuild=true.`,
+	},
+	"unified_crl": {
+		Type: framework.TypeBool,
+		Description: `If set to true enables global replication of revocation entries,
+also enabling unified versions of OCSP and CRLs if their respective features are enabled.
+disable for CRLs and ocsp_disable for OCSP.`,
+		Default: "false",
+	},
+	"unified_crl_on_existing_paths": {
+		Type: framework.TypeBool,
+		Description: `If set to true, 
+existing CRL and OCSP paths will return the unified CRL instead of a response based on cluster-local data`,
+		Default: "false",
+	},
+	"max_crl_entries": {
+		Type:        framework.TypeInt,
+		Description: `The maximum number of entries the CRL can contain.  This is meant as a guard against accidental runaway revocations overloading Vault storage.  If this limit is exceeded writing the CRL will fail.  If set to -1 this limit is disabled.`,
+		Default:     pki_backend.DefaultCrlConfig.MaxCRLEntries,
+	},
 }
 
 func pathConfigCRL(b *backend) *framework.Path {
@@ -57,65 +89,7 @@ func pathConfigCRL(b *backend) *framework.Path {
 			OperationPrefix: operationPrefixPKI,
 		},
 
-		Fields: map[string]*framework.FieldSchema{
-			"expiry": {
-				Type: framework.TypeString,
-				Description: `The amount of time the generated CRL should be
-valid; defaults to 72 hours`,
-				Default: "72h",
-			},
-			"disable": {
-				Type:        framework.TypeBool,
-				Description: `If set to true, disables generating the CRL entirely.`,
-			},
-			"ocsp_disable": {
-				Type:        framework.TypeBool,
-				Description: `If set to true, ocsp unauthorized responses will be returned.`,
-			},
-			"ocsp_expiry": {
-				Type: framework.TypeString,
-				Description: `The amount of time an OCSP response will be valid (controls 
-the NextUpdate field); defaults to 12 hours`,
-				Default: "1h",
-			},
-			"auto_rebuild": {
-				Type:        framework.TypeBool,
-				Description: `If set to true, enables automatic rebuilding of the CRL`,
-			},
-			"auto_rebuild_grace_period": {
-				Type:        framework.TypeString,
-				Description: `The time before the CRL expires to automatically rebuild it, when enabled. Must be shorter than the CRL expiry. Defaults to 12h.`,
-				Default:     "12h",
-			},
-			"enable_delta": {
-				Type:        framework.TypeBool,
-				Description: `Whether to enable delta CRLs between authoritative CRL rebuilds`,
-			},
-			"delta_rebuild_interval": {
-				Type:        framework.TypeString,
-				Description: `The time between delta CRL rebuilds if a new revocation has occurred. Must be shorter than the CRL expiry. Defaults to 15m.`,
-				Default:     "15m",
-			},
-			"cross_cluster_revocation": {
-				Type: framework.TypeBool,
-				Description: `Whether to enable a global, cross-cluster revocation queue.
-Must be used with auto_rebuild=true.`,
-			},
-			"unified_crl": {
-				Type: framework.TypeBool,
-				Description: `If set to true enables global replication of revocation entries,
-also enabling unified versions of OCSP and CRLs if their respective features are enabled.
-disable for CRLs and ocsp_disable for OCSP.`,
-				Default: "false",
-			},
-			"unified_crl_on_existing_paths": {
-				Type: framework.TypeBool,
-				Description: `If set to true, 
-existing CRL and OCSP paths will return the unified CRL instead of a response based on cluster-local data`,
-				Default: "false",
-			},
-		},
-
+		Fields: configCRLFields,
 		Operations: map[logical.Operation]framework.OperationHandler{
 			logical.ReadOperation: &framework.PathOperation{
 				DisplayAttrs: &framework.DisplayAttributes{
@@ -125,69 +99,7 @@ existing CRL and OCSP paths will return the unified CRL instead of a response ba
 				Responses: map[int][]framework.Response{
 					http.StatusOK: {{
 						Description: "OK",
-						Fields: map[string]*framework.FieldSchema{
-							"expiry": {
-								Type: framework.TypeString,
-								Description: `The amount of time the generated CRL should be
-valid; defaults to 72 hours`,
-								Required: true,
-							},
-							"disable": {
-								Type:        framework.TypeBool,
-								Description: `If set to true, disables generating the CRL entirely.`,
-								Required:    true,
-							},
-							"ocsp_disable": {
-								Type:        framework.TypeBool,
-								Description: `If set to true, ocsp unauthorized responses will be returned.`,
-								Required:    true,
-							},
-							"ocsp_expiry": {
-								Type: framework.TypeString,
-								Description: `The amount of time an OCSP response will be valid (controls 
-the NextUpdate field); defaults to 12 hours`,
-								Required: true,
-							},
-							"auto_rebuild": {
-								Type:        framework.TypeBool,
-								Description: `If set to true, enables automatic rebuilding of the CRL`,
-								Required:    true,
-							},
-							"auto_rebuild_grace_period": {
-								Type:        framework.TypeString,
-								Description: `The time before the CRL expires to automatically rebuild it, when enabled. Must be shorter than the CRL expiry. Defaults to 12h.`,
-								Required:    true,
-							},
-							"enable_delta": {
-								Type:        framework.TypeBool,
-								Description: `Whether to enable delta CRLs between authoritative CRL rebuilds`,
-								Required:    true,
-							},
-							"delta_rebuild_interval": {
-								Type:        framework.TypeString,
-								Description: `The time between delta CRL rebuilds if a new revocation has occurred. Must be shorter than the CRL expiry. Defaults to 15m.`,
-								Required:    true,
-							},
-							"cross_cluster_revocation": {
-								Type: framework.TypeBool,
-								Description: `Whether to enable a global, cross-cluster revocation queue.
-Must be used with auto_rebuild=true.`,
-								Required: true,
-							},
-							"unified_crl": {
-								Type: framework.TypeBool,
-								Description: `If set to true enables global replication of revocation entries,
-also enabling unified versions of OCSP and CRLs if their respective features are enabled.
-disable for CRLs and ocsp_disable for OCSP.`,
-								Required: true,
-							},
-							"unified_crl_on_existing_paths": {
-								Type: framework.TypeBool,
-								Description: `If set to true, 
-existing CRL and OCSP paths will return the unified CRL instead of a response based on cluster-local data`,
-								Required: true,
-							},
-						},
+						Fields:      configCRLFields,
 					}},
 				},
 			},
@@ -200,65 +112,7 @@ existing CRL and OCSP paths will return the unified CRL instead of a response ba
 				Responses: map[int][]framework.Response{
 					http.StatusOK: {{
 						Description: "OK",
-						Fields: map[string]*framework.FieldSchema{
-							"expiry": {
-								Type: framework.TypeString,
-								Description: `The amount of time the generated CRL should be
-valid; defaults to 72 hours`,
-								Default: "72h",
-							},
-							"disable": {
-								Type:        framework.TypeBool,
-								Description: `If set to true, disables generating the CRL entirely.`,
-							},
-							"ocsp_disable": {
-								Type:        framework.TypeBool,
-								Description: `If set to true, ocsp unauthorized responses will be returned.`,
-							},
-							"ocsp_expiry": {
-								Type: framework.TypeString,
-								Description: `The amount of time an OCSP response will be valid (controls 
-the NextUpdate field); defaults to 12 hours`,
-								Default: "1h",
-							},
-							"auto_rebuild": {
-								Type:        framework.TypeBool,
-								Description: `If set to true, enables automatic rebuilding of the CRL`,
-							},
-							"auto_rebuild_grace_period": {
-								Type:        framework.TypeString,
-								Description: `The time before the CRL expires to automatically rebuild it, when enabled. Must be shorter than the CRL expiry. Defaults to 12h.`,
-								Default:     "12h",
-							},
-							"enable_delta": {
-								Type:        framework.TypeBool,
-								Description: `Whether to enable delta CRLs between authoritative CRL rebuilds`,
-							},
-							"delta_rebuild_interval": {
-								Type:        framework.TypeString,
-								Description: `The time between delta CRL rebuilds if a new revocation has occurred. Must be shorter than the CRL expiry. Defaults to 15m.`,
-								Default:     "15m",
-							},
-							"cross_cluster_revocation": {
-								Type: framework.TypeBool,
-								Description: `Whether to enable a global, cross-cluster revocation queue.
-Must be used with auto_rebuild=true.`,
-								Required: false,
-							},
-							"unified_crl": {
-								Type: framework.TypeBool,
-								Description: `If set to true enables global replication of revocation entries,
-also enabling unified versions of OCSP and CRLs if their respective features are enabled.
-disable for CRLs and ocsp_disable for OCSP.`,
-								Required: false,
-							},
-							"unified_crl_on_existing_paths": {
-								Type: framework.TypeBool,
-								Description: `If set to true, 
-existing CRL and OCSP paths will return the unified CRL instead of a response based on cluster-local data`,
-								Required: false,
-							},
-						},
+						Fields:      configCRLFields,
 					}},
 				},
 				// Read more about why these flags are set in backend.go.
@@ -280,6 +134,8 @@ func (b *backend) pathCRLRead(ctx context.Context, req *logical.Request, _ *fram
 		return nil, fmt.Errorf("failed fetching CRL config: %w", err)
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigCRLRead)
+
 	return genResponseFromCrlConfig(config), nil
 }
 
@@ -359,6 +215,13 @@ func (b *backend) pathCRLWrite(ctx context.Context, req *logical.Request, d *fra
 		config.UnifiedCRLOnExistingPaths = unifiedCrlOnExistingPathsRaw.(bool)
 	}
 
+	if maxCRLEntriesRaw, ok := d.GetOk("max_crl_entries"); ok {
+		v := maxCRLEntriesRaw.(int)
+		if v == -1 || v > 0 {
+			config.MaxCRLEntries = v
+		}
+	}
+
 	if config.UnifiedCRLOnExistingPaths && !config.UnifiedCRL {
 		return logical.ErrorResponse("unified_crl_on_existing_paths cannot be enabled if unified_crl is disabled"), nil
 	}
@@ -424,7 +287,7 @@ func (b *backend) pathCRLWrite(ctx context.Context, req *logical.Request, d *fra
 		// auto-rebuild and we aren't now or equivalently, we changed our
 		// mind about delta CRLs and need a new complete one or equivalently,
 		// we changed our mind about unified CRLs), rotate the CRLs.
-		warnings, crlErr := b.CrlBuilder().rebuild(sc, true)
+		warnings, crlErr := b.CrlBuilder().Rebuild(sc, true)
 		if crlErr != nil {
 			switch crlErr.(type) {
 			case errutil.UserError:
@@ -438,10 +301,33 @@ func (b *backend) pathCRLWrite(ctx context.Context, req *logical.Request, d *fra
 		}
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigCRLWrite,
+		observe.NewAdditionalPKIMetadata("version", config.Version),
+		observe.NewAdditionalPKIMetadata("expiry", config.Expiry),
+		observe.NewAdditionalPKIMetadata("disable", config.Disable),
+		observe.NewAdditionalPKIMetadata("ocsp_disable", config.OcspDisable),
+		observe.NewAdditionalPKIMetadata("auto_rebuild", config.AutoRebuild),
+		observe.NewAdditionalPKIMetadata("auto_rebuild_grace_period", config.AutoRebuildGracePeriod),
+		observe.NewAdditionalPKIMetadata("ocsp_expiry", config.OcspExpiry),
+		observe.NewAdditionalPKIMetadata("enable_delta", config.EnableDelta),
+		observe.NewAdditionalPKIMetadata("delta_rebuild_interval", config.DeltaRebuildInterval),
+		observe.NewAdditionalPKIMetadata("cross_cluster_revocation", config.UseGlobalQueue),
+		observe.NewAdditionalPKIMetadata("unified_crl", config.UnifiedCRL),
+		observe.NewAdditionalPKIMetadata("unified_crl_on_existing_paths", config.UnifiedCRLOnExistingPaths),
+		observe.NewAdditionalPKIMetadata("max_crl_entries", config.MaxCRLEntries),
+	)
+
 	return resp, nil
 }
 
-func genResponseFromCrlConfig(config *crlConfig) *logical.Response {
+func maxCRLEntriesOrDefault(size int) int {
+	if size == 0 {
+		return pki_backend.DefaultCrlConfig.MaxCRLEntries
+	}
+	return size
+}
+
+func genResponseFromCrlConfig(config *pki_backend.CrlConfig) *logical.Response {
 	return &logical.Response{
 		Data: map[string]interface{}{
 			"expiry":                        config.Expiry,
@@ -455,6 +341,7 @@ func genResponseFromCrlConfig(config *crlConfig) *logical.Response {
 			"cross_cluster_revocation":      config.UseGlobalQueue,
 			"unified_crl":                   config.UnifiedCRL,
 			"unified_crl_on_existing_paths": config.UnifiedCRLOnExistingPaths,
+			"max_crl_entries":               maxCRLEntriesOrDefault(config.MaxCRLEntries),
 		},
 	}
 }
diff --git a/builtin/logical/pki/path_config_urls.go b/builtin/logical/pki/path_config_urls.go
index c79102b0350..f68b08e7214 100644
--- a/builtin/logical/pki/path_config_urls.go
+++ b/builtin/logical/pki/path_config_urls.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -7,8 +7,10 @@ import (
 	"context"
 	"fmt"
 	"net/http"
+	"strings"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -34,6 +36,12 @@ for the issuing certificate attribute. See also RFC 5280 Section 4.2.2.1.`,
 for the CRL distribution points attribute. See also RFC 5280 Section 4.2.1.13.`,
 			},
 
+			"delta_crl_distribution_points": {
+				Type: framework.TypeCommaStringSlice,
+				Description: `Comma-separated list of URLs to be used
+for the Delta CRL distribution points attribute.  See also RFC 5280 Section 4.2.1.15.`,
+			},
+
 			"ocsp_servers": {
 				Type: framework.TypeCommaStringSlice,
 				Description: `Comma-separated list of URLs to be used
@@ -73,6 +81,11 @@ for the issuing certificate attribute. See also RFC 5280 Section 4.2.2.1.`,
 								Type: framework.TypeCommaStringSlice,
 								Description: `Comma-separated list of URLs to be used
 for the CRL distribution points attribute. See also RFC 5280 Section 4.2.1.13.`,
+							},
+							"delta_crl_distribution_points": {
+								Type: framework.TypeCommaStringSlice,
+								Description: `Comma-separated list of URLs to be used
+for the Delta CRL distribution points attribute.  See also RFC 5280 Section 4.2.1.15.`,
 							},
 							"ocsp_servers": {
 								Type: framework.TypeCommaStringSlice,
@@ -113,6 +126,11 @@ for the issuing certificate attribute. See also RFC 5280 Section 4.2.2.1.`,
 for the CRL distribution points attribute. See also RFC 5280 Section 4.2.1.13.`,
 								Required: true,
 							},
+							"delta_crl_distribution_points": {
+								Type: framework.TypeCommaStringSlice,
+								Description: `Comma-separated list of URLs to be used
+for the Delta CRL distribution points attribute.  See also RFC 5280 Section 4.2.1.15.`,
+							},
 							"ocsp_servers": {
 								Type: framework.TypeCommaStringSlice,
 								Description: `Comma-separated list of URLs to be used
@@ -146,10 +164,11 @@ func getGlobalAIAURLs(ctx context.Context, storage logical.Storage) (*issuing.Ai
 	}
 
 	entries := &issuing.AiaConfigEntry{
-		IssuingCertificates:   []string{},
-		CRLDistributionPoints: []string{},
-		OCSPServers:           []string{},
-		EnableTemplating:      false,
+		IssuingCertificates:        []string{},
+		CRLDistributionPoints:      []string{},
+		DeltaCRLDistributionPoints: []string{},
+		OCSPServers:                []string{},
+		EnableTemplating:           false,
 	}
 
 	if entry == nil {
@@ -188,13 +207,16 @@ func (b *backend) pathReadURL(ctx context.Context, req *logical.Request, _ *fram
 
 	resp := &logical.Response{
 		Data: map[string]interface{}{
-			"issuing_certificates":    entries.IssuingCertificates,
-			"crl_distribution_points": entries.CRLDistributionPoints,
-			"ocsp_servers":            entries.OCSPServers,
-			"enable_templating":       entries.EnableTemplating,
+			"issuing_certificates":          entries.IssuingCertificates,
+			"crl_distribution_points":       entries.CRLDistributionPoints,
+			"delta_crl_distribution_points": entries.DeltaCRLDistributionPoints,
+			"ocsp_servers":                  entries.OCSPServers,
+			"enable_templating":             entries.EnableTemplating,
 		},
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigURLsRead)
+
 	return resp, nil
 }
 
@@ -213,19 +235,28 @@ func (b *backend) pathWriteURL(ctx context.Context, req *logical.Request, data *
 	if urlsInt, ok := data.GetOk("crl_distribution_points"); ok {
 		entries.CRLDistributionPoints = urlsInt.([]string)
 	}
+	if urlsInt, ok := data.GetOk("delta_crl_distribution_points"); ok {
+		entries.DeltaCRLDistributionPoints = urlsInt.([]string)
+	}
 	if urlsInt, ok := data.GetOk("ocsp_servers"); ok {
 		entries.OCSPServers = urlsInt.([]string)
 	}
 
 	resp := &logical.Response{
 		Data: map[string]interface{}{
-			"issuing_certificates":    entries.IssuingCertificates,
-			"crl_distribution_points": entries.CRLDistributionPoints,
-			"ocsp_servers":            entries.OCSPServers,
-			"enable_templating":       entries.EnableTemplating,
+			"issuing_certificates":          entries.IssuingCertificates,
+			"crl_distribution_points":       entries.CRLDistributionPoints,
+			"delta_crl_distribution_points": entries.DeltaCRLDistributionPoints,
+			"ocsp_servers":                  entries.OCSPServers,
+			"enable_templating":             entries.EnableTemplating,
 		},
 	}
 
+	if ((entries.DeltaCRLDistributionPoints != nil) && (len(entries.DeltaCRLDistributionPoints) > 0)) &&
+		(entries.CRLDistributionPoints == nil || len(entries.CRLDistributionPoints) == 0) {
+		resp.AddWarning(fmt.Sprintf("delta_crl_distribution_points were set: %v but not crl_distribution_points, consider setting crl_distribution_points", strings.Join(entries.DeltaCRLDistributionPoints, ", ")))
+	}
+
 	if entries.EnableTemplating && !b.UseLegacyBundleCaStorage() {
 		sc := b.makeStorageContext(ctx, req.Storage)
 		issuers, err := sc.listIssuers()
@@ -255,6 +286,11 @@ func (b *backend) pathWriteURL(ctx context.Context, req *logical.Request, data *
 				"invalid URL found in Authority Information Access (AIA) parameter crl_distribution_points: %s", badURL)), nil
 		}
 
+		if badURL := issuing.ValidateURLs(entries.DeltaCRLDistributionPoints); badURL != "" {
+			return logical.ErrorResponse(fmt.Sprintf(
+				"invalid URL found in Authority Information Access (AIA) parameter delta_crl_distribution_points: %s", badURL)), nil
+		}
+
 		if badURL := issuing.ValidateURLs(entries.OCSPServers); badURL != "" {
 			return logical.ErrorResponse(fmt.Sprintf(
 				"invalid URL found in Authority Information Access (AIA) parameter ocsp_servers: %s", badURL)), nil
@@ -265,6 +301,10 @@ func (b *backend) pathWriteURL(ctx context.Context, req *logical.Request, data *
 		return nil, err
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIConfigURLsWrite,
+		observe.NewAdditionalPKIMetadata("enable_templating", entries.EnableTemplating),
+	)
+
 	return resp, nil
 }
 
diff --git a/builtin/logical/pki/path_fetch.go b/builtin/logical/pki/path_fetch.go
index bdedbde4295..4c1e5af8248 100644
--- a/builtin/logical/pki/path_fetch.go
+++ b/builtin/logical/pki/path_fetch.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -12,6 +12,8 @@ import (
 	"time"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
 	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
@@ -248,7 +250,7 @@ func pathFetchListCerts(b *backend) *framework.Path {
 }
 
 func (b *backend) pathFetchCertList(ctx context.Context, req *logical.Request, _ *framework.FieldData) (response *logical.Response, retErr error) {
-	entries, err := req.Storage.List(ctx, "certs/")
+	entries, err := req.Storage.List(ctx, issuing.PathCerts)
 	if err != nil {
 		return nil, err
 	}
@@ -306,7 +308,7 @@ func (b *backend) pathFetchRead(ctx context.Context, req *logical.Request, data
 			contentType = "application/pkix-cert"
 		}
 	case req.Path == "crl" || req.Path == "crl/pem" || req.Path == "crl/delta" || req.Path == "crl/delta/pem" || req.Path == "cert/crl" || req.Path == "cert/crl/raw" || req.Path == "cert/crl/raw/pem" || req.Path == "cert/delta-crl" || req.Path == "cert/delta-crl/raw" || req.Path == "cert/delta-crl/raw/pem" || req.Path == "unified-crl" || req.Path == "unified-crl/pem" || req.Path == "unified-crl/delta" || req.Path == "unified-crl/delta/pem" || req.Path == "cert/unified-crl" || req.Path == "cert/unified-crl/raw" || req.Path == "cert/unified-crl/raw/pem" || req.Path == "cert/unified-delta-crl" || req.Path == "cert/unified-delta-crl/raw" || req.Path == "cert/unified-delta-crl/raw/pem":
-		config, err := b.CrlBuilder().getConfigWithUpdate(sc)
+		config, err := b.CrlBuilder().GetConfigWithUpdate(sc)
 		if err != nil {
 			retErr = err
 			goto reply
@@ -360,7 +362,9 @@ func (b *backend) pathFetchRead(ctx context.Context, req *logical.Request, data
 			contentType = "application/pem-certificate-chain"
 		}
 	default:
-		serial = data.Get("serial").(string)
+		if ser, ok := data.GetOk("serial"); ok {
+			serial = ser.(string)
+		}
 		pemType = "CERTIFICATE"
 	}
 	if len(serial) == 0 {
@@ -452,7 +456,7 @@ func (b *backend) pathFetchRead(ctx context.Context, req *logical.Request, data
 		}
 	}
 	if revokedEntry != nil {
-		var revInfo revocationInfo
+		var revInfo revocation.RevocationInfo
 		err := revokedEntry.DecodeJSON(&revInfo)
 		if err != nil {
 			return logical.ErrorResponse(fmt.Sprintf("Error decoding revocation entry for serial %s: %s", serial, err)), nil
@@ -507,6 +511,13 @@ reply:
 		}
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIReadIssuerCertificate,
+		observe.NewAdditionalPKIMetadata("pem_type", pemType),
+		observe.NewAdditionalPKIMetadata("content_type", contentType),
+		observe.NewAdditionalPKIMetadata("revocation_time", revocationTimeRfc3339),
+		observe.NewAdditionalPKIMetadata("serial_number", serial),
+	)
+
 	return
 }
 
diff --git a/builtin/logical/pki/path_fetch_issuers.go b/builtin/logical/pki/path_fetch_issuers.go
index bd5d8e63560..b0e4055b821 100644
--- a/builtin/logical/pki/path_fetch_issuers.go
+++ b/builtin/logical/pki/path_fetch_issuers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -192,6 +193,12 @@ for the issuing certificate attribute. See also RFC 5280 Section 4.2.2.1.`,
 		Type: framework.TypeCommaStringSlice,
 		Description: `Comma-separated list of URLs to be used
 for the CRL distribution points attribute. See also RFC 5280 Section 4.2.1.13.`,
+	}
+	fields["delta_crl_distribution_points"] = &framework.FieldSchema{
+		Type: framework.TypeCommaStringSlice,
+		Description: `Comma-separated list of URLs to be used
+for the Delta CRL distribution points attribute, also known as Freshest CRL
+distribution points attribute. See also RFC 5280 Section 4.2.1.15.`,
 	}
 	fields["ocsp_servers"] = &framework.FieldSchema{
 		Type: framework.TypeCommaStringSlice,
@@ -209,90 +216,13 @@ and using '{{cluster_aia_path}}' requires /config/cluster's 'aia_path' member
 to be set on all PR secondary clusters.`,
 		Default: false,
 	}
+	addEntPathIssuerFields(fields)
+	updateIssuerFields := issuerResponseFields(false)
 
 	updateIssuerSchema := map[int][]framework.Response{
 		http.StatusOK: {{
 			Description: "OK",
-			Fields: map[string]*framework.FieldSchema{
-				"issuer_id": {
-					Type:        framework.TypeString,
-					Description: `Issuer Id`,
-					Required:    false,
-				},
-				"issuer_name": {
-					Type:        framework.TypeString,
-					Description: `Issuer Name`,
-					Required:    false,
-				},
-				"key_id": {
-					Type:        framework.TypeString,
-					Description: `Key Id`,
-					Required:    false,
-				},
-				"certificate": {
-					Type:        framework.TypeString,
-					Description: `Certificate`,
-					Required:    false,
-				},
-				"manual_chain": {
-					Type:        framework.TypeStringSlice,
-					Description: `Manual Chain`,
-					Required:    false,
-				},
-				"ca_chain": {
-					Type:        framework.TypeStringSlice,
-					Description: `CA Chain`,
-					Required:    false,
-				},
-				"leaf_not_after_behavior": {
-					Type:        framework.TypeString,
-					Description: `Leaf Not After Behavior`,
-					Required:    false,
-				},
-				"usage": {
-					Type:        framework.TypeString,
-					Description: `Usage`,
-					Required:    false,
-				},
-				"revocation_signature_algorithm": {
-					Type:        framework.TypeString,
-					Description: `Revocation Signature Alogrithm`,
-					Required:    false,
-				},
-				"revoked": {
-					Type:        framework.TypeBool,
-					Description: `Revoked`,
-					Required:    false,
-				},
-				"revocation_time": {
-					Type:     framework.TypeInt,
-					Required: false,
-				},
-				"revocation_time_rfc3339": {
-					Type:     framework.TypeString,
-					Required: false,
-				},
-				"issuing_certificates": {
-					Type:        framework.TypeStringSlice,
-					Description: `Issuing Certificates`,
-					Required:    false,
-				},
-				"crl_distribution_points": {
-					Type:        framework.TypeStringSlice,
-					Description: `CRL Distribution Points`,
-					Required:    false,
-				},
-				"ocsp_servers": {
-					Type:        framework.TypeStringSlice,
-					Description: `OCSP Servers`,
-					Required:    false,
-				},
-				"enable_aia_url_templating": {
-					Type:        framework.TypeBool,
-					Description: `Whether or not templating is enabled for AIA fields`,
-					Required:    false,
-				},
-			},
+			Fields:      updateIssuerFields,
 		}},
 	}
 
@@ -340,6 +270,100 @@ to be set on all PR secondary clusters.`,
 	}
 }
 
+func issuerResponseFields(required bool) map[string]*framework.FieldSchema {
+	fields := map[string]*framework.FieldSchema{
+		"issuer_id": {
+			Type:        framework.TypeString,
+			Description: `Issuer Id`,
+			Required:    required,
+		},
+		"issuer_name": {
+			Type:        framework.TypeString,
+			Description: `Issuer Name`,
+			Required:    required,
+		},
+		"key_id": {
+			Type:        framework.TypeString,
+			Description: `Key Id`,
+			Required:    required,
+		},
+		"certificate": {
+			Type:        framework.TypeString,
+			Description: `Certificate`,
+			Required:    required,
+		},
+		"manual_chain": {
+			Type:        framework.TypeStringSlice,
+			Description: `Manual Chain`,
+			Required:    required,
+		},
+		"ca_chain": {
+			Type:        framework.TypeStringSlice,
+			Description: `CA Chain`,
+			Required:    required,
+		},
+		"leaf_not_after_behavior": {
+			Type:        framework.TypeString,
+			Description: `Leaf Not After Behavior`,
+			Required:    required,
+		},
+		"usage": {
+			Type:        framework.TypeString,
+			Description: `Usage`,
+			Required:    required,
+		},
+		"revocation_signature_algorithm": {
+			Type:        framework.TypeString,
+			Description: `Revocation Signature Alogrithm`,
+			Required:    required,
+		},
+		"revoked": {
+			Type:        framework.TypeBool,
+			Description: `Revoked`,
+			Required:    required,
+		},
+		"revocation_time": {
+			Type:        framework.TypeInt,
+			Description: `Revocation time`,
+			Required:    required,
+		},
+		"revocation_time_rfc3339": {
+			Type:        framework.TypeString,
+			Description: `Revocation time RFC 3339 formatted`,
+			Required:    required,
+		},
+		"issuing_certificates": {
+			Type:        framework.TypeStringSlice,
+			Description: `Issuing Certificates`,
+			Required:    required,
+		},
+		"crl_distribution_points": {
+			Type:        framework.TypeStringSlice,
+			Description: `CRL Distribution Points`,
+			Required:    required,
+		},
+		"delta_crl_distribution_points": {
+			Type:        framework.TypeStringSlice,
+			Description: `Delta CRL Distribution Points`,
+			Required:    required,
+		},
+		"ocsp_servers": {
+			Type:        framework.TypeStringSlice,
+			Description: `OCSP Servers`,
+			Required:    required,
+		},
+		"enable_aia_url_templating": {
+			Type:        framework.TypeBool,
+			Description: `Whether or not templating is enabled for AIA fields`,
+			Required:    required,
+		},
+	}
+
+	addEntPathIssuerResponseFields(fields)
+
+	return fields
+}
+
 func buildPathGetIssuer(b *backend, pattern string, displayAttrs *framework.DisplayAttributes) *framework.Path {
 	fields := map[string]*framework.FieldSchema{}
 	fields = addIssuerRefField(fields)
@@ -422,6 +446,12 @@ func (b *backend) pathGetIssuer(ctx context.Context, req *logical.Request, data
 		return nil, err
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIIssuerRead,
+		observe.NewAdditionalPKIMetadata("issuer_name", issuer.Name),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuer.ID),
+		observe.NewAdditionalPKIMetadata("last_modified", issuer.LastModified.String()),
+		observe.NewAdditionalPKIMetadata("revoked", issuer.Revoked))
+
 	return respondReadIssuer(issuer)
 }
 
@@ -452,8 +482,10 @@ func respondReadIssuer(issuer *issuing.IssuerEntry) (*logical.Response, error) {
 		"revoked":                        issuer.Revoked,
 		"issuing_certificates":           []string{},
 		"crl_distribution_points":        []string{},
+		"delta_crl_distribution_points":  []string{},
 		"ocsp_servers":                   []string{},
 	}
+	setEntIssuerData(data, issuer)
 
 	if issuer.Revoked {
 		data["revocation_time"] = issuer.RevocationTime
@@ -463,8 +495,11 @@ func respondReadIssuer(issuer *issuing.IssuerEntry) (*logical.Response, error) {
 	if issuer.AIAURIs != nil {
 		data["issuing_certificates"] = issuer.AIAURIs.IssuingCertificates
 		data["crl_distribution_points"] = issuer.AIAURIs.CRLDistributionPoints
+		data["delta_crl_distribution_points"] = issuer.AIAURIs.DeltaCRLDistributionPoints
 		data["ocsp_servers"] = issuer.AIAURIs.OCSPServers
 		data["enable_aia_url_templating"] = issuer.AIAURIs.EnableTemplating
+	} else {
+		data["enable_aia_url_templating"] = false
 	}
 
 	response := &logical.Response{
@@ -529,6 +564,8 @@ func (b *backend) pathUpdateIssuer(ctx context.Context, req *logical.Request, da
 	switch rawLeafBehavior {
 	case "err":
 		newLeafBehavior = certutil.ErrNotAfterBehavior
+	case "always_enforce_err":
+		newLeafBehavior = certutil.AlwaysEnforceErr
 	case "truncate":
 		newLeafBehavior = certutil.TruncateNotAfterBehavior
 	case "permit":
@@ -570,6 +607,10 @@ func (b *backend) pathUpdateIssuer(ctx context.Context, req *logical.Request, da
 	if badURL := issuing.ValidateURLs(crlDistributionPoints); !enableTemplating && badURL != "" {
 		return logical.ErrorResponse(fmt.Sprintf("invalid URL found in Authority Information Access (AIA) parameter crl_distribution_points: %s", badURL)), nil
 	}
+	deltaCRLDistributionPoints := data.Get("delta_crl_distribution_points").([]string)
+	if badURL := issuing.ValidateURLs(deltaCRLDistributionPoints); !enableTemplating && badURL != "" {
+		return logical.ErrorResponse(fmt.Sprintf("invalid URL found in Authority Information Access (AIA) parameter delta_crl_distribution_points: %s", badURL)), nil
+	}
 	ocspServers := data.Get("ocsp_servers").([]string)
 	if badURL := issuing.ValidateURLs(ocspServers); !enableTemplating && badURL != "" {
 		return logical.ErrorResponse(fmt.Sprintf("invalid URL found in Authority Information Access (AIA) parameter ocsp_servers: %s", badURL)), nil
@@ -618,7 +659,7 @@ func (b *backend) pathUpdateIssuer(ctx context.Context, req *logical.Request, da
 		modified = true
 	}
 
-	if issuer.AIAURIs == nil && (len(issuerCertificates) > 0 || len(crlDistributionPoints) > 0 || len(ocspServers) > 0) {
+	if issuer.AIAURIs == nil && (len(issuerCertificates) > 0 || len(crlDistributionPoints) > 0 || len(ocspServers) > 0 || len(deltaCRLDistributionPoints) > 0) {
 		issuer.AIAURIs = &issuing.AiaConfigEntry{}
 	}
 	if issuer.AIAURIs != nil {
@@ -641,6 +682,10 @@ func (b *backend) pathUpdateIssuer(ctx context.Context, req *logical.Request, da
 				Source: &ocspServers,
 				Dest:   &issuer.AIAURIs.OCSPServers,
 			},
+			{
+				Source: &deltaCRLDistributionPoints,
+				Dest:   &issuer.AIAURIs.DeltaCRLDistributionPoints,
+			},
 		}
 
 		// For each pair, if it is different on the object, update it.
@@ -657,11 +702,17 @@ func (b *backend) pathUpdateIssuer(ctx context.Context, req *logical.Request, da
 
 		// If no AIA URLs exist on the issuer, set the AIA URLs entry to nil
 		// to ease usage later.
-		if len(issuer.AIAURIs.IssuingCertificates) == 0 && len(issuer.AIAURIs.CRLDistributionPoints) == 0 && len(issuer.AIAURIs.OCSPServers) == 0 {
+		if len(issuer.AIAURIs.IssuingCertificates) == 0 && len(issuer.AIAURIs.CRLDistributionPoints) == 0 && len(issuer.AIAURIs.OCSPServers) == 0 && len(issuer.AIAURIs.DeltaCRLDistributionPoints) == 0 {
 			issuer.AIAURIs = nil
 		}
 	}
 
+	var updatedIssuanceValidations bool
+	if updateEntIssuerFields(issuer, data, false) {
+		modified = true
+		updatedIssuanceValidations = true
+	}
+
 	// Updating the chain should be the last modification as there's a chance
 	// it'll write it out to disk for us. We'd hate to then modify the issuer
 	// again and write it a second time.
@@ -693,25 +744,45 @@ func (b *backend) pathUpdateIssuer(ctx context.Context, req *logical.Request, da
 	}
 
 	if updateChain {
+		oldChain := issuer.ManualChain
 		issuer.ManualChain = constructedChain
 
 		// Building the chain will write the issuer to disk; no need to do it
 		// twice.
 		modified = false
-		err := sc.rebuildIssuersChains(issuer)
+		err = sc.rebuildIssuersChains(issuer)
 		if err != nil {
 			return nil, err
 		}
+
+		if issuer.Usage.HasUsage(issuing.IssuanceUsage) {
+			// Issuer has been saved by building the chain above
+			err = b.issueSignEmptyCert(ctx, req, issuer.ID.String())
+			if err != nil {
+				issuer.ManualChain = oldChain
+				newErr := sc.rebuildIssuersChains(issuer)
+				if newErr != nil {
+					return logical.ErrorResponse("error reverting bad chain update, state unknown: %v, \ninitial error: %v", newErr.Error(), err.Error()), nil
+				}
+				return logical.ErrorResponse("other changes to issuer may be persisted.  Error setting manual chain, issuer would be unusuable with this chain: %v", err), nil
+			} else {
+				updatedIssuanceValidations = false
+			}
+		}
+
 	}
 
 	if modified {
-		err := sc.writeIssuer(issuer)
+		err = sc.writeIssuer(issuer)
 		if err != nil {
 			return nil, err
 		}
 	}
 
 	response, err := respondReadIssuer(issuer)
+	if err != nil {
+		return response, err
+	}
 	if newName != oldName {
 		addWarningOnDereferencing(sc, oldName, response)
 	}
@@ -721,6 +792,22 @@ func (b *backend) pathUpdateIssuer(ctx context.Context, req *logical.Request, da
 			response.AddWarning(fmt.Sprintf("issuance may fail: %v\n\nConsider setting the cluster-local address if it is not already set.", aiaErr))
 		}
 	}
+	if (issuer.AIAURIs != nil && issuer.AIAURIs.DeltaCRLDistributionPoints != nil && len(issuer.AIAURIs.DeltaCRLDistributionPoints) > 0) &&
+		(issuer.AIAURIs.CRLDistributionPoints == nil || len(issuer.AIAURIs.CRLDistributionPoints) == 0) {
+		response.AddWarning(fmt.Sprintf("delta crl distribution points were set: %v but no base crl distribution point was set, consider setting base crl distribution point.", strings.Join(issuer.AIAURIs.DeltaCRLDistributionPoints, ", ")))
+	}
+	if updatedIssuanceValidations {
+		warning := checkIssuer(issuer, ctx, req, b)
+		if warning != "" {
+			response.AddWarning(warning)
+		}
+	}
+
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIIssuerWrite,
+		observe.NewAdditionalPKIMetadata("issuer_name", issuer.Name),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuer.ID),
+		observe.NewAdditionalPKIMetadata("last_modified", issuer.LastModified.String()),
+		observe.NewAdditionalPKIMetadata("revoked", issuer.Revoked))
 
 	return response, err
 }
@@ -797,6 +884,8 @@ func (b *backend) pathPatchIssuer(ctx context.Context, req *logical.Request, dat
 		switch rawLeafBehavior {
 		case "err":
 			newLeafBehavior = certutil.ErrNotAfterBehavior
+		case "always_enforce_err":
+			newLeafBehavior = certutil.AlwaysEnforceErr
 		case "truncate":
 			newLeafBehavior = certutil.TruncateNotAfterBehavior
 		case "permit":
@@ -885,6 +974,10 @@ func (b *backend) pathPatchIssuer(ctx context.Context, req *logical.Request, dat
 			Source: "crl_distribution_points",
 			Dest:   &issuer.AIAURIs.CRLDistributionPoints,
 		},
+		{
+			Source: "delta_crl_distribution_points",
+			Dest:   &issuer.AIAURIs.DeltaCRLDistributionPoints,
+		},
 		{
 			Source: "ocsp_servers",
 			Dest:   &issuer.AIAURIs.OCSPServers,
@@ -894,7 +987,7 @@ func (b *backend) pathPatchIssuer(ctx context.Context, req *logical.Request, dat
 	if enableTemplatingRaw, ok := data.GetOk("enable_aia_url_templating"); ok {
 		enableTemplating := enableTemplatingRaw.(bool)
 		if enableTemplating != issuer.AIAURIs.EnableTemplating {
-			issuer.AIAURIs.EnableTemplating = true
+			issuer.AIAURIs.EnableTemplating = enableTemplating
 			modified = true
 		}
 	}
@@ -917,10 +1010,16 @@ func (b *backend) pathPatchIssuer(ctx context.Context, req *logical.Request, dat
 
 	// If no AIA URLs exist on the issuer, set the AIA URLs entry to nil to
 	// ease usage later.
-	if len(issuer.AIAURIs.IssuingCertificates) == 0 && len(issuer.AIAURIs.CRLDistributionPoints) == 0 && len(issuer.AIAURIs.OCSPServers) == 0 {
+	if len(issuer.AIAURIs.IssuingCertificates) == 0 && len(issuer.AIAURIs.CRLDistributionPoints) == 0 && len(issuer.AIAURIs.DeltaCRLDistributionPoints) == 0 && len(issuer.AIAURIs.OCSPServers) == 0 {
 		issuer.AIAURIs = nil
 	}
 
+	updatedIssuanceValidations := false
+	if updateEntIssuerFields(issuer, data, true) {
+		modified = true
+		updatedIssuanceValidations = true
+	}
+
 	// Manual Chain Changes
 	newPathData, ok := data.GetOk("manual_chain")
 	if ok {
@@ -953,15 +1052,32 @@ func (b *backend) pathPatchIssuer(ctx context.Context, req *logical.Request, dat
 		}
 
 		if updateChain {
+			oldChain := issuer.ManualChain
 			issuer.ManualChain = constructedChain
 
 			// Building the chain will write the issuer to disk; no need to do it
 			// twice.
 			modified = false
-			err := sc.rebuildIssuersChains(issuer)
+			err = sc.rebuildIssuersChains(issuer)
 			if err != nil {
 				return nil, err
 			}
+			// If this issuer is supposed to be issuing certificates, test that will work
+			if issuer.Usage.HasUsage(issuing.IssuanceUsage) {
+				// Issuer has been saved by building the chain above
+				err = b.issueSignEmptyCert(ctx, req, issuer.Name)
+				if err != nil {
+					issuer.ManualChain = oldChain
+					newErr := sc.rebuildIssuersChains(issuer)
+					if newErr != nil {
+						return logical.ErrorResponse("error reverting bad chain update, state unknown: %v, \ninitial error: %v", newErr.Error(), err.Error()), nil
+					}
+					return logical.ErrorResponse("other changes to issuer may be persisted.  Error setting manual chain, issuer would be unusuable with this chain: %v", err), nil
+				} else {
+					updatedIssuanceValidations = false
+				}
+			}
+
 		}
 	}
 
@@ -973,19 +1089,49 @@ func (b *backend) pathPatchIssuer(ctx context.Context, req *logical.Request, dat
 	}
 
 	response, err := respondReadIssuer(issuer)
+	if err != nil {
+		return nil, err
+	}
 	if newName != oldName {
 		addWarningOnDereferencing(sc, oldName, response)
 	}
+	if updatedIssuanceValidations {
+		warning := checkIssuer(issuer, ctx, req, b)
+		if warning != "" {
+			response.AddWarning(warning)
+		}
+	}
 	if issuer.AIAURIs != nil && issuer.AIAURIs.EnableTemplating {
 		_, aiaErr := ToURLEntries(sc, issuer.ID, issuer.AIAURIs)
 		if aiaErr != nil {
 			response.AddWarning(fmt.Sprintf("issuance may fail: %v\n\nConsider setting the cluster-local address if it is not already set.", aiaErr))
 		}
 	}
+	if (issuer.AIAURIs != nil && issuer.AIAURIs.DeltaCRLDistributionPoints != nil && len(issuer.AIAURIs.DeltaCRLDistributionPoints) > 0) &&
+		(issuer.AIAURIs.CRLDistributionPoints == nil || len(issuer.AIAURIs.CRLDistributionPoints) == 0) {
+		response.AddWarning(fmt.Sprintf("delta crl distribution points were set: %v but no base crl distribution point was set, consider setting base crl distribution point.", strings.Join(issuer.AIAURIs.DeltaCRLDistributionPoints, ", ")))
+	}
+
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIIssuerPatch,
+		observe.NewAdditionalPKIMetadata("issuer_name", issuer.Name),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuer.ID),
+		observe.NewAdditionalPKIMetadata("last_modified", issuer.LastModified.String()),
+		observe.NewAdditionalPKIMetadata("revoked", issuer.Revoked))
 
 	return response, err
 }
 
+// checkIssuer looks at an issuer that has already been written, and returns a warning if it is not functional.
+func checkIssuer(issuer *issuing.IssuerEntry, ctx context.Context, req *logical.Request, b *backend) (warning string) {
+	if issuer.Usage.HasUsage(issuing.IssuanceUsage) {
+		err := b.issueSignEmptyCert(ctx, req, issuer.ID.String())
+		if err != nil {
+			return fmt.Sprintf("warning: issuer with issuance usage %s cannot issue certificates with this configuration: %v", issuer.ID.String(), err)
+		}
+	}
+	return ""
+}
+
 func (b *backend) pathGetRawIssuer(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 	if b.UseLegacyBundleCaStorage() {
 		return logical.ErrorResponse("Can not get issuer until migration has completed"), nil
@@ -1121,7 +1267,7 @@ func (b *backend) pathDeleteIssuer(ctx context.Context, req *logical.Request, da
 	// Finally, we need to rebuild both the local and the unified CRLs. This
 	// will free up any now unnecessary space used in both the CRL config
 	// and for the underlying CRL.
-	warnings, err := b.CrlBuilder().rebuild(sc, true)
+	warnings, err := b.CrlBuilder().Rebuild(sc, true)
 	if err != nil {
 		return nil, err
 	}
@@ -1130,6 +1276,11 @@ func (b *backend) pathDeleteIssuer(ctx context.Context, req *logical.Request, da
 		response.AddWarning(fmt.Sprintf("Warning %d during CRL rebuild: %v", index+1, warning))
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIIssuerDelete,
+		observe.NewAdditionalPKIMetadata("issuer_name", issuer.Name),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuer.ID),
+		observe.NewAdditionalPKIMetadata("was_default", wasDefault))
+
 	return response, nil
 }
 
@@ -1231,7 +1382,7 @@ func (b *backend) pathGetIssuerCRL(ctx context.Context, req *logical.Request, da
 	}
 
 	sc := b.makeStorageContext(ctx, req.Storage)
-	warnings, err := b.CrlBuilder().rebuildIfForced(sc)
+	warnings, err := b.CrlBuilder().RebuildIfForced(sc)
 	if err != nil {
 		return nil, err
 	}
@@ -1271,7 +1422,7 @@ func (b *backend) pathGetIssuerCRL(ctx context.Context, req *logical.Request, da
 		return response, nil
 	}
 
-	crlPath, err := sc.resolveIssuerCRLPath(issuerName, isUnified)
+	crlPath, err := issuing.ResolveIssuerCRLPath(sc.GetContext(), sc.GetStorage(), sc.UseLegacyBundleCaStorage(), issuerName, isUnified)
 	if err != nil {
 		return nil, err
 	}
diff --git a/builtin/logical/pki/path_fetch_issuers_stubs_oss.go b/builtin/logical/pki/path_fetch_issuers_stubs_oss.go
new file mode 100644
index 00000000000..3ba2c3db181
--- /dev/null
+++ b/builtin/logical/pki/path_fetch_issuers_stubs_oss.go
@@ -0,0 +1,21 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package pki
+
+import (
+	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/sdk/framework"
+)
+
+//go:generate go run github.com/hashicorp/vault/tools/stubmaker
+
+func addEntPathIssuerFields(fields map[string]*framework.FieldSchema)         {}
+func addEntPathIssuerResponseFields(fields map[string]*framework.FieldSchema) {}
+func setEntIssuerData(data map[string]any, issuer *issuing.IssuerEntry)       {}
+
+func updateEntIssuerFields(issuer *issuing.IssuerEntry, data *framework.FieldData, ignoreNotPresent bool) bool {
+	return false
+}
diff --git a/builtin/logical/pki/path_fetch_issuers_test.go b/builtin/logical/pki/path_fetch_issuers_test.go
new file mode 100644
index 00000000000..de65824cd31
--- /dev/null
+++ b/builtin/logical/pki/path_fetch_issuers_test.go
@@ -0,0 +1,110 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package pki
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestManualChainValidation creates a series of issuers, and then tries to set the manual_chain on the final issuer
+// to something completely incorrect (missing an intermediate issuer).  In this case, the attempt to write the manual
+// chain throws an error, and the manual chain is not updated.
+func TestManualChainValidation(t *testing.T) {
+	// Set Up a Cluster
+	cluster, client := setupTestPkiCluster(t)
+	defer cluster.Cleanup()
+
+	// Set Up Root-A
+	mount := "pki"
+
+	resp, err := client.Logical().WriteWithContext(context.Background(), mount+"/issuers/generate/root/internal",
+		map[string]interface{}{
+			"issuer_name": "rootCa",
+			"key_name":    "root-key",
+			"key_type":    "ec",
+			"common_name": "Test Root",
+			"ttl":         "7200h",
+		})
+	require.NoError(t, err, "failed creating root CA")
+
+	// Set Up Int-A
+	resp, err = client.Logical().WriteWithContext(context.Background(), mount+"/issuers/generate/intermediate/internal",
+		map[string]interface{}{
+			"key_name":    "int-a-key",
+			"key_type":    "ec",
+			"common_name": "Test Int A",
+		})
+	require.NoError(t, err, "failed creating intermediary CSR")
+	intermediateCSR := resp.Data["csr"].(string)
+
+	// Sign the intermediate CSR
+	resp, err = client.Logical().Write(mount+"/issuer/rootCa/sign-intermediate", map[string]interface{}{
+		"csr":         intermediateCSR,
+		"ttl":         "7100h",
+		"common_name": "Test Int A",
+	})
+	require.NoError(t, err, "failed signing intermediary CSR")
+	intermediateCertPEM := resp.Data["certificate"].(string)
+
+	// Import the intermediate cert
+	resp, err = client.Logical().Write(mount+"/issuers/import/cert", map[string]interface{}{
+		"pem_bundle": intermediateCertPEM,
+	})
+	require.NoError(t, err, "failed importing intermediary cert")
+	importedIssuersRaw := resp.Data["imported_issuers"].([]interface{})
+	require.Len(t, importedIssuersRaw, 1)
+	intCaUuid := importedIssuersRaw[0].(string)
+
+	_, err = client.Logical().Write(mount+"/issuer/"+intCaUuid, map[string]interface{}{
+		"issuer_name": "intA",
+	})
+	require.NoError(t, err, "failed updating issuer name")
+
+	// Set Up Int-B (Child of Int-A)
+	resp, err = client.Logical().WriteWithContext(context.Background(), mount+"/issuers/generate/intermediate/internal",
+		map[string]interface{}{
+			"key_name":    "int-b-key",
+			"key_type":    "ec",
+			"common_name": "Test Int B",
+		})
+	require.NoError(t, err, "failed creating intermediary CSR")
+	subIntermediateCSR := resp.Data["csr"].(string)
+
+	// Sign the intermediate CSR
+	resp, err = client.Logical().Write(mount+"/issuer/intA/sign-intermediate", map[string]interface{}{
+		"csr":         subIntermediateCSR,
+		"ttl":         "7100h",
+		"common_name": "Test Int B",
+	})
+	require.NoError(t, err, "failed signing intermediary CSR")
+	subIntermediateCertPEM := resp.Data["certificate"].(string)
+
+	// Import the intermediate cert
+	resp, err = client.Logical().Write(mount+"/issuers/import/cert", map[string]interface{}{
+		"pem_bundle": subIntermediateCertPEM,
+	})
+	require.NoError(t, err, "failed importing intermediary cert")
+	subImportedIssuersRaw := resp.Data["imported_issuers"].([]interface{})
+	require.Len(t, subImportedIssuersRaw, 1)
+	subIntCaUuid := subImportedIssuersRaw[0].(string)
+
+	resp, err = client.Logical().Write(mount+"/issuer/"+subIntCaUuid, map[string]interface{}{
+		"issuer_name": "intB",
+	})
+	require.NoError(t, err, "failed updating issuer name")
+
+	// Try to Set Int-B Manual Chain to Just Be Root-A; Expect An Error
+	resp, err = client.Logical().Write(mount+"/issuer/intB", map[string]interface{}{
+		"issuer_name":  "intB",
+		"manual_chain": []string{"intB", "rootCa"}, // Misses "intA" which issued "intB"
+	})
+	require.Error(t, err, "failed updating intermediary cert")
+
+	resp, err = client.Logical().Read(mount + "/issuer/intB")
+	require.NoError(t, err, "failed reading intermediary cert")
+	require.Nil(t, resp.Data["manual_chain"], "error reverting manual chain, got non-nil manual chain")
+}
diff --git a/builtin/logical/pki/path_fetch_keys.go b/builtin/logical/pki/path_fetch_keys.go
index 0cf826d6f26..3f00a376968 100644
--- a/builtin/logical/pki/path_fetch_keys.go
+++ b/builtin/logical/pki/path_fetch_keys.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -11,6 +11,7 @@ import (
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
 	"github.com/hashicorp/vault/builtin/logical/pki/managed_key"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
@@ -267,7 +268,7 @@ func (b *backend) pathGetKeyHandler(ctx context.Context, req *logical.Request, d
 			return nil, errutil.InternalError{Err: fmt.Sprintf("failed fetching managed key info from key id %s (%s): %v", key.ID, key.Name, err)}
 		}
 
-		pkForSkid, err = managed_key.GetManagedKeyPublicKey(sc.Context, sc.Backend, managedKeyUUID)
+		pkForSkid, err = managed_key.GetManagedKeyPublicKey(sc.Context, sc.GetPkiManagedView(), managedKeyUUID)
 		if err != nil {
 			return nil, err
 		}
@@ -290,6 +291,13 @@ func (b *backend) pathGetKeyHandler(ctx context.Context, req *logical.Request, d
 	}
 	respData[skidParam] = certutil.GetHexFormatted([]byte(skid), ":")
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIKeyRead,
+		observe.NewAdditionalPKIMetadata("key_id", key.ID),
+		observe.NewAdditionalPKIMetadata("key_name", key.Name),
+		observe.NewAdditionalPKIMetadata("key_type", key.PrivateKeyType),
+		observe.NewAdditionalPKIMetadata("key_ref", keyRef),
+	)
+
 	return &logical.Response{Data: respData}, nil
 }
 
@@ -348,6 +356,13 @@ func (b *backend) pathUpdateKeyHandler(ctx context.Context, req *logical.Request
 		resp.AddWarning("Name successfully deleted, you will now need to reference this key by it's Id: " + string(key.ID))
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIKeyWrite,
+		observe.NewAdditionalPKIMetadata("key_id", key.ID),
+		observe.NewAdditionalPKIMetadata("key_name", key.Name),
+		observe.NewAdditionalPKIMetadata("key_type", key.PrivateKeyType),
+		observe.NewAdditionalPKIMetadata("key_ref", keyRef),
+	)
+
 	return resp, nil
 }
 
@@ -397,5 +412,10 @@ func (b *backend) pathDeleteKeyHandler(ctx context.Context, req *logical.Request
 		response.AddWarning(msg)
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIKeyDelete,
+		observe.NewAdditionalPKIMetadata("was_default", wasDefault),
+		observe.NewAdditionalPKIMetadata("key_ref", keyRef),
+	)
+
 	return response, nil
 }
diff --git a/builtin/logical/pki/path_intermediate.go b/builtin/logical/pki/path_intermediate.go
index 60742a3d8c3..f1c2a4c43ed 100644
--- a/builtin/logical/pki/path_intermediate.go
+++ b/builtin/logical/pki/path_intermediate.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"net/http"
 
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -157,12 +158,17 @@ func (b *backend) pathGenerateIntermediate(ctx context.Context, req *logical.Req
 	}
 
 	entries, err := getGlobalAIAURLs(ctx, req.Storage)
-	if err == nil && len(entries.OCSPServers) == 0 && len(entries.IssuingCertificates) == 0 && len(entries.CRLDistributionPoints) == 0 {
+	if err == nil && len(entries.OCSPServers) == 0 && len(entries.IssuingCertificates) == 0 &&
+		len(entries.CRLDistributionPoints) == 0 && len(entries.DeltaCRLDistributionPoints) == 0 {
 		// If the operator hasn't configured any of the URLs prior to
 		// generating this issuer, we should add a warning to the response,
 		// informing them they might want to do so and re-generate the issuer.
 		resp.AddWarning("This mount hasn't configured any authority information access (AIA) fields; this may make it harder for systems to find missing certificates in the chain or to validate revocation status of certificates. Consider updating /config/urls or the newly generated issuer with this information. Since this certificate is an intermediate, it might be useful to regenerate this certificate after fixing this problem for the root mount.")
 	}
+	if (entries.DeltaCRLDistributionPoints != nil && len(entries.DeltaCRLDistributionPoints) > 0) &&
+		(entries.CRLDistributionPoints == nil || len(entries.CRLDistributionPoints) == 0) {
+		resp.AddWarning("This mount has configured delta crl distribution points but no base crl distribution points were set.")
+	}
 
 	switch format {
 	case "pem":
@@ -205,6 +211,14 @@ func (b *backend) pathGenerateIntermediate(ctx context.Context, req *logical.Req
 
 	resp = addWarnings(resp, warnings)
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIGenerateIntermediate,
+		observe.NewAdditionalPKIMetadata("key_id", myKey.ID),
+		observe.NewAdditionalPKIMetadata("key_name", myKey.Name),
+		observe.NewAdditionalPKIMetadata("key_type", myKey.PrivateKeyType),
+		observe.NewAdditionalPKIMetadata("role_name", role.Name),
+		observe.NewAdditionalPKIMetadata("exported", exported),
+		observe.NewAdditionalPKIMetadata("type", format))
+
 	return resp, nil
 }
 
diff --git a/builtin/logical/pki/path_issue_sign.go b/builtin/logical/pki/path_issue_sign.go
index e426a6af9f9..300662302ed 100644
--- a/builtin/logical/pki/path_issue_sign.go
+++ b/builtin/logical/pki/path_issue_sign.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
@@ -315,6 +316,7 @@ func (b *backend) pathSignVerbatim(ctx context.Context, req *logical.Request, da
 	// to populate and influence the sign-verbatim behavior.
 	if role != nil {
 		opts = append(opts, issuing.WithNoStore(role.NoStore))
+		opts = append(opts, issuing.WithNoStoreMetadata(role.NoStoreMetadata))
 		opts = append(opts, issuing.WithIssuer(role.Issuer))
 
 		if role.TTL > 0 {
@@ -338,10 +340,24 @@ func (b *backend) pathSignVerbatim(ctx context.Context, req *logical.Request, da
 	return b.pathIssueSignCert(ctx, req, data, entry, true, true)
 }
 
+// pathIssueSignCert is called by issueSignEmptyCert (to validate an issuer) in which case it is not handling the
+// request, only serving to provide useful (error) information to a request
+// pathIssueSignCert is also the handler for issuing and signing endpoints, in which case it serves requests entirely
 func (b *backend) pathIssueSignCert(ctx context.Context, req *logical.Request, data *framework.FieldData, role *issuing.RoleEntry, useCSR, useCSRValues bool) (*logical.Response, error) {
-	// If storing the certificate and on a performance standby, forward this request on to the primary
-	// Allow performance secondaries to generate and store certificates locally to them.
-	if !role.NoStore && b.System().ReplicationState().HasState(consts.ReplicationPerformanceStandby) {
+	// Error out early if incompatible fields set:
+	certMetadata, metadataInRequest := data.GetOk("cert_metadata")
+	if metadataInRequest {
+		err := validateCertMetadataConfiguration(role)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// If storing the certificate or certMetadata about this certificate and on a performance standby, forward this request
+	// on to the primary
+	// Allow performance secondaries to generate and store certificates and certMetadata locally to them.
+	needsStorage := !role.NoStore || (metadataInRequest && !role.NoStoreMetadata && issuing.MetadataPermitted)
+	if needsStorage && b.System().ReplicationState().HasState(consts.ReplicationPerformanceStandby) {
 		return nil, logical.ErrReadOnly
 	}
 
@@ -389,17 +405,23 @@ func (b *backend) pathIssueSignCert(ctx context.Context, req *logical.Request, d
 				"error fetching CA certificate: %s", caErr)}
 		}
 	}
-
+	issuerId, err := issuing.ResolveIssuerReference(ctx, req.Storage, role.Issuer)
+	if err != nil {
+		if issuerId == issuing.IssuerRefNotFound {
+			b.Logger().Warn("could not resolve issuer reference, may be using a legacy CA bundle")
+		} else {
+			return nil, err
+		}
+	}
 	input := &inputBundle{
 		req:     req,
 		apiData: data,
 		role:    role,
 	}
 	var parsedBundle *certutil.ParsedCertBundle
-	var err error
 	var warnings []string
 	if useCSR {
-		parsedBundle, warnings, err = signCert(b, input, signingBundle, false, useCSRValues)
+		parsedBundle, warnings, err = signCert(b.System(), input, signingBundle, false, useCSRValues)
 	} else {
 		parsedBundle, warnings, err = generateCert(sc, input, signingBundle, false, rand.Reader)
 	}
@@ -424,6 +446,10 @@ func (b *backend) pathIssueSignCert(ctx context.Context, req *logical.Request, d
 		return nil, err
 	}
 
+	if err = issuing.VerifyCertificate(sc.GetContext(), sc.GetStorage(), issuerId, parsedBundle); err != nil {
+		return nil, err
+	}
+
 	if !role.NoStore {
 		err = issuing.StoreCertificate(ctx, req.Storage, b.GetCertificateCounter(), parsedBundle)
 		if err != nil {
@@ -431,6 +457,21 @@ func (b *backend) pathIssueSignCert(ctx context.Context, req *logical.Request, d
 		}
 	}
 
+	if metadataInRequest {
+		metadataBytes, err := base64.StdEncoding.DecodeString(certMetadata.(string))
+		if err != nil {
+			// TODO: Should we clean up the original cert here?
+			return nil, err
+		}
+		err = storeCertMetadata(ctx, req.Storage, issuerId, role.Name, parsedBundle.Certificate, metadataBytes)
+		if err != nil {
+			// TODO: Should we clean up the original cert here?
+			return nil, err
+		}
+	}
+
+	b.pkiCertificateCounter.AddIssuedCertificate(!role.NoStore)
+
 	if useCSR {
 		if role.UseCSRCommonName && data.Get("common_name").(string) != "" {
 			resp.AddWarning("the common_name field was provided but the role is set with \"use_csr_common_name\" set to true")
@@ -442,6 +483,23 @@ func (b *backend) pathIssueSignCert(ctx context.Context, req *logical.Request, d
 
 	resp = addWarnings(resp, warnings)
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIIssue,
+		observe.NewAdditionalPKIMetadata("issuer_id", issuerId),
+		observe.NewAdditionalPKIMetadata("issuer_name", role.Issuer),
+		observe.NewAdditionalPKIMetadata("signed", useCSR),
+		observe.NewAdditionalPKIMetadata("role_name", role.Name),
+		observe.NewAdditionalPKIMetadata("stored", !role.NoStore),
+		observe.NewAdditionalPKIMetadata("common_name", parsedBundle.Certificate.Subject.CommonName),
+		observe.NewAdditionalPKIMetadata("not_after", parsedBundle.Certificate.NotAfter.String()),
+		observe.NewAdditionalPKIMetadata("not_before", parsedBundle.Certificate.NotBefore.String()),
+		observe.NewAdditionalPKIMetadata("subject_key_id", parsedBundle.Certificate.SubjectKeyId),
+		observe.NewAdditionalPKIMetadata("authority_key_id", parsedBundle.Certificate.AuthorityKeyId),
+		observe.NewAdditionalPKIMetadata("serial_number", parsedBundle.Certificate.SerialNumber.String()),
+		observe.NewAdditionalPKIMetadata("public_key_algorithm", parsedBundle.Certificate.PublicKeyAlgorithm.String()),
+		observe.NewAdditionalPKIMetadata("public_key_size", certutil.GetPublicKeySize(parsedBundle.Certificate.PublicKey)),
+		observe.NewAdditionalPKIMetadata("lease_generated", generateLease),
+	)
+
 	return resp, nil
 }
 
@@ -602,3 +660,40 @@ requested common name is allowed by the role policy.
 This path requires a CSR; if you want Vault to generate a private key
 for you, use the issue path instead.
 `
+
+func (b *backend) issueSignEmptyCert(ctx context.Context, req *logical.Request, issuerName string) error {
+	emptyRole := &issuing.RoleEntry{
+		AllowLocalhost:    true,
+		AllowedBaseDomain: "*",
+		AllowAnyName:      true,
+		AllowedDomains:    []string{"*"},
+		AllowBaseDomain:   true,
+		AllowBareDomains:  true,
+		AllowGlobDomains:  true,
+		AllowSubdomains:   true,
+		AllowIPSANs:       true,
+		NoStore:           true,
+		NoStoreMetadata:   true,
+		Issuer:            issuerName,
+		RequireCN:         false,
+		KeyBits:           256,  // Any stored role will have some value here;
+		KeyType:           "ec", // We need more tests with "ec"
+	}
+	schema := map[string]*framework.FieldSchema{}
+	schema = addNonCACommonFields(addIssueAndSignCommonFields(schema))
+	emptyData := &framework.FieldData{
+		Raw: map[string]interface{}{
+			"ttl":        "300s",
+			"issuer_ref": issuerName,
+		},
+		Schema: schema,
+	}
+	resp, err := b.pathIssueSignCert(ctx, req, emptyData, emptyRole, false, false)
+	if err != nil {
+		return fmt.Errorf("certificate path set on issuer %v is not functional: %v", issuerName, err)
+	}
+	if resp.IsError() {
+		return fmt.Errorf("certificate path set on issuer %v is not functional: %v", issuerName, resp.Error())
+	}
+	return nil
+}
diff --git a/builtin/logical/pki/path_manage_issuers.go b/builtin/logical/pki/path_manage_issuers.go
index 2611a807a1b..45d875d00aa 100644
--- a/builtin/logical/pki/path_manage_issuers.go
+++ b/builtin/logical/pki/path_manage_issuers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -14,6 +14,8 @@ import (
 	"time"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -116,6 +118,7 @@ func buildPathGenerateRoot(b *backend, pattern string, displayAttrs *framework.D
 	ret.Fields = addCACommonFields(map[string]*framework.FieldSchema{})
 	ret.Fields = addCAKeyGenerationFields(ret.Fields)
 	ret.Fields = addCAIssueFields(ret.Fields)
+	ret.Fields = addCACertKeyUsage(ret.Fields)
 	return ret
 }
 
@@ -196,6 +199,7 @@ extension with CA: true. Only needed as a
 workaround in some compatibility scenarios
 with Active Directory Certificate Services.`,
 	}
+	ret.Fields = addCaCsrKeyUsage(ret.Fields)
 
 	// At this time Go does not support signing CSRs using PSS signatures, see
 	// https://github.com/golang/go/issues/45990
@@ -268,6 +272,12 @@ secret-key (optional) and certificates.`,
 	}
 }
 
+// ImportedKeyInfo is a set of information about each key imported.
+type ImportedKeyInfo struct {
+	KeyName string `json:"key_name"`
+	KeyId   string `json:"key_id"`
+}
+
 func (b *backend) pathImportIssuers(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 	// Since we're planning on updating issuers here, grab the lock so we've
 	// got a consistent view.
@@ -368,6 +378,8 @@ func (b *backend) pathImportIssuers(ctx context.Context, req *logical.Request, d
 
 	sc := b.makeStorageContext(ctx, req.Storage)
 
+	importedKeys := make([]*issuing.KeyEntry, 0)
+	importedKeyInfo := make([]*ImportedKeyInfo, 0)
 	for keyIndex, keyPem := range keys {
 		// Handle import of private key.
 		key, existing, err := importKeyFromBytes(sc, keyPem, "")
@@ -377,13 +389,22 @@ func (b *backend) pathImportIssuers(ctx context.Context, req *logical.Request, d
 
 		if !existing {
 			createdKeys = append(createdKeys, key.ID.String())
+			importedKeys = append(importedKeys, key)
+			keyInfo := &ImportedKeyInfo{
+				KeyName: key.Name,
+				KeyId:   key.ID.String(),
+			}
+			importedKeyInfo = append(importedKeyInfo, keyInfo)
 		} else {
 			existingKeys = append(existingKeys, key.ID.String())
 		}
 	}
 
+	// ImportedIssuerInfo
+	importedIssuers := make([]*issuing.IssuerEntry, 0)
+	importedIssuerInfo := make([]*ImportedIssuerInfo, 0)
 	for certIndex, certPem := range issuers {
-		cert, existing, err := sc.importIssuer(certPem, "")
+		cert, issuerInfo, existing, err := sc.importIssuer(certPem, "")
 		if err != nil {
 			return logical.ErrorResponse(fmt.Sprintf("Error parsing issuer %v: %v\n%v", certIndex, err, certPem)), nil
 		}
@@ -391,6 +412,8 @@ func (b *backend) pathImportIssuers(ctx context.Context, req *logical.Request, d
 		issuerKeyMap[cert.ID.String()] = cert.KeyID.String()
 		if !existing {
 			createdIssuers = append(createdIssuers, cert.ID.String())
+			importedIssuers = append(importedIssuers, cert)
+			importedIssuerInfo = append(importedIssuerInfo, issuerInfo)
 		} else {
 			existingIssuers = append(existingIssuers, cert.ID.String())
 		}
@@ -407,7 +430,7 @@ func (b *backend) pathImportIssuers(ctx context.Context, req *logical.Request, d
 	}
 
 	if len(createdIssuers) > 0 {
-		warnings, err := b.CrlBuilder().rebuild(sc, true)
+		warnings, err := b.CrlBuilder().Rebuild(sc, true)
 		if err != nil {
 			// Before returning, check if the error message includes the
 			// string "PSS". If so, it indicates we might've wanted to modify
@@ -489,10 +512,28 @@ func (b *backend) pathImportIssuers(ctx context.Context, req *logical.Request, d
 	// Also while we're here, we should let the user know the next steps.
 	// In particular, if there's no default AIA URLs configuration, we should
 	// tell the user that's probably next.
-	if entries, err := getGlobalAIAURLs(ctx, req.Storage); err == nil && len(entries.IssuingCertificates) == 0 && len(entries.CRLDistributionPoints) == 0 && len(entries.OCSPServers) == 0 {
-		response.AddWarning("This mount hasn't configured any authority information access (AIA) fields; this may make it harder for systems to find missing certificates in the chain or to validate revocation status of certificates. Consider updating /config/urls or the newly generated issuer with this information.")
+	entries, err := getGlobalAIAURLs(ctx, req.Storage)
+	if err != nil {
+		response.AddWarning(fmt.Sprintf("error reading authority information access (AIA) fields: %v", err.Error()))
+	}
+	if err == nil {
+		if len(entries.IssuingCertificates) == 0 && len(entries.CRLDistributionPoints) == 0 && len(entries.DeltaCRLDistributionPoints) == 0 && len(entries.OCSPServers) == 0 {
+			response.AddWarning("This mount hasn't configured any authority information access (AIA) fields; this may make it harder for systems to find missing certificates in the chain or to validate revocation status of certificates. Consider updating /config/urls or the newly generated issuer with this information.")
+		}
+		if len(entries.CRLDistributionPoints) == 0 && len(entries.DeltaCRLDistributionPoints) != 0 {
+			response.AddWarning("delta crl distribution points were set, but no base crl distribution points were set.")
+		}
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIIssuersImport,
+		observe.NewAdditionalPKIMetadata("mapping", issuerKeyMap),
+		observe.NewAdditionalPKIMetadata("imported_keys", createdKeys),
+		observe.NewAdditionalPKIMetadata("imported_key_info", importedKeyInfo),
+		observe.NewAdditionalPKIMetadata("imported_issuers", createdIssuers),
+		observe.NewAdditionalPKIMetadata("imported_issuer_info", importedIssuerInfo),
+		observe.NewAdditionalPKIMetadata("existing_keys", existingKeys),
+		observe.NewAdditionalPKIMetadata("existing_issuers", existingIssuers))
+
 	return response, nil
 }
 
@@ -513,6 +554,7 @@ secret-keys.
 
 func pathRevokeIssuer(b *backend) *framework.Path {
 	fields := addIssuerRefField(map[string]*framework.FieldSchema{})
+	responseFields := issuerResponseFields(true)
 
 	return &framework.Path{
 		Pattern: "issuer/" + framework.GenericNameRegex(issuerRefParam) + "/revoke",
@@ -531,83 +573,7 @@ func pathRevokeIssuer(b *backend) *framework.Path {
 				Responses: map[int][]framework.Response{
 					http.StatusOK: {{
 						Description: "OK",
-						Fields: map[string]*framework.FieldSchema{
-							"issuer_id": {
-								Type:        framework.TypeString,
-								Description: `ID of the issuer`,
-								Required:    true,
-							},
-							"issuer_name": {
-								Type:        framework.TypeString,
-								Description: `Name of the issuer`,
-								Required:    true,
-							},
-							"key_id": {
-								Type:        framework.TypeString,
-								Description: `ID of the Key`,
-								Required:    true,
-							},
-							"certificate": {
-								Type:        framework.TypeString,
-								Description: `Certificate`,
-								Required:    true,
-							},
-							"manual_chain": {
-								Type:        framework.TypeCommaStringSlice,
-								Description: `Manual Chain`,
-								Required:    true,
-							},
-							"ca_chain": {
-								Type:        framework.TypeCommaStringSlice,
-								Description: `Certificate Authority Chain`,
-								Required:    true,
-							},
-							"leaf_not_after_behavior": {
-								Type:        framework.TypeString,
-								Description: ``,
-								Required:    true,
-							},
-							"usage": {
-								Type:        framework.TypeString,
-								Description: `Allowed usage`,
-								Required:    true,
-							},
-							"revocation_signature_algorithm": {
-								Type:        framework.TypeString,
-								Description: `Which signature algorithm to use when building CRLs`,
-								Required:    true,
-							},
-							"revoked": {
-								Type:        framework.TypeBool,
-								Description: `Whether the issuer was revoked`,
-								Required:    true,
-							},
-							"issuing_certificates": {
-								Type:        framework.TypeCommaStringSlice,
-								Description: `Specifies the URL values for the Issuing Certificate field`,
-								Required:    true,
-							},
-							"crl_distribution_points": {
-								Type:        framework.TypeStringSlice,
-								Description: `Specifies the URL values for the CRL Distribution Points field`,
-								Required:    true,
-							},
-							"ocsp_servers": {
-								Type:        framework.TypeStringSlice,
-								Description: `Specifies the URL values for the OCSP Servers field`,
-								Required:    true,
-							},
-							"revocation_time": {
-								Type:        framework.TypeInt64,
-								Description: `Time of revocation`,
-								Required:    false,
-							},
-							"revocation_time_rfc3339": {
-								Type:        framework.TypeTime,
-								Description: `RFC formatted time of revocation`,
-								Required:    false,
-							},
-						},
+						Fields:      responseFields,
 					}},
 				},
 				// Read more about why these flags are set in backend.go
@@ -677,7 +643,7 @@ func (b *backend) pathRevokeIssuer(ctx context.Context, req *logical.Request, da
 
 	// Now, if the parent issuer exists within this mount, we'd have written
 	// a storage entry for this certificate, making it appear as any other
-	// leaf. We need to add a revocationInfo entry for this into storage,
+	// leaf. We need to add a RevocationInfo entry for this into storage,
 	// so that it appears as if it was revoked.
 	//
 	// This is a _necessary_ but not necessarily _sufficient_ step to
@@ -688,7 +654,7 @@ func (b *backend) pathRevokeIssuer(ctx context.Context, req *logical.Request, da
 	// include both in two separate CRLs. Hence, the former is the condition
 	// we check in CRL building, but this step satisfies other guarantees
 	// within Vault.
-	certEntry, err := fetchCertBySerial(sc, "certs/", issuer.SerialNumber)
+	certEntry, err := fetchCertBySerial(sc, issuing.PathCerts, issuer.SerialNumber)
 	if err == nil && certEntry != nil {
 		// We've inverted this error check as it doesn't matter; we already
 		// consider this certificate revoked.
@@ -712,7 +678,7 @@ func (b *backend) pathRevokeIssuer(ctx context.Context, req *logical.Request, da
 			//
 			// We'll let a cleanup pass or CRL build identify the issuer for
 			// us.
-			revInfo := revocationInfo{
+			revInfo := revocation.RevocationInfo{
 				CertificateBytes:  issuerCert.Raw,
 				RevocationTime:    issuer.RevocationTime,
 				RevocationTimeUTC: issuer.RevocationTimeUTC,
@@ -731,7 +697,7 @@ func (b *backend) pathRevokeIssuer(ctx context.Context, req *logical.Request, da
 	}
 
 	// Rebuild the CRL to include the newly revoked issuer.
-	warnings, crlErr := b.CrlBuilder().rebuild(sc, false)
+	warnings, crlErr := b.CrlBuilder().Rebuild(sc, false)
 	if crlErr != nil {
 		switch crlErr.(type) {
 		case errutil.UserError:
diff --git a/builtin/logical/pki/path_manage_keys.go b/builtin/logical/pki/path_manage_keys.go
index a7727d9d6d8..fe532b9f5eb 100644
--- a/builtin/logical/pki/path_manage_keys.go
+++ b/builtin/logical/pki/path_manage_keys.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/managed_key"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -128,13 +129,14 @@ func (b *backend) pathGenerateKeyHandler(ctx context.Context, req *logical.Reque
 	exportPrivateKey := false
 	var keyBundle certutil.KeyBundle
 	var actualPrivateKeyType certutil.PrivateKeyType
+	var keyBits int
 	switch {
 	case strings.HasSuffix(req.Path, "/exported"):
 		exportPrivateKey = true
 		fallthrough
 	case strings.HasSuffix(req.Path, "/internal"):
 		keyType := data.Get(keyTypeParam).(string)
-		keyBits := data.Get(keyBitsParam).(int)
+		keyBits = data.Get(keyBitsParam).(int)
 
 		keyBits, _, err := certutil.ValidateDefaultOrValueKeyTypeSignatureLength(keyType, keyBits, 0)
 		if err != nil {
@@ -179,6 +181,14 @@ func (b *backend) pathGenerateKeyHandler(ctx context.Context, req *logical.Reque
 	if exportPrivateKey {
 		responseData["private_key"] = privateKeyPemString
 	}
+
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIKeysGenerate,
+		observe.NewAdditionalPKIMetadata("key_type", string(actualPrivateKeyType)),
+		observe.NewAdditionalPKIMetadata("key_bits", keyBits),
+		observe.NewAdditionalPKIMetadata("key_id", key.ID),
+		observe.NewAdditionalPKIMetadata("key_name", key.Name),
+	)
+
 	return &logical.Response{
 		Data: responseData,
 	}, nil
@@ -316,5 +326,12 @@ func (b *backend) pathImportKeyHandler(ctx context.Context, req *logical.Request
 		resp.AddWarning("Key already imported, use key/ endpoint to update name.")
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIKeysImport,
+		observe.NewAdditionalPKIMetadata("existed", existed),
+		observe.NewAdditionalPKIMetadata("key_type", key.PrivateKeyType),
+		observe.NewAdditionalPKIMetadata("key_id", key.ID),
+		observe.NewAdditionalPKIMetadata("key_name", key.Name),
+	)
+
 	return &resp, nil
 }
diff --git a/builtin/logical/pki/path_manage_keys_test.go b/builtin/logical/pki/path_manage_keys_test.go
index 58c4222260b..062e13528b3 100644
--- a/builtin/logical/pki/path_manage_keys_test.go
+++ b/builtin/logical/pki/path_manage_keys_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/path_ocsp.go b/builtin/logical/pki/path_ocsp.go
index 2a5a1b8dc7b..ea5c447a2d0 100644
--- a/builtin/logical/pki/path_ocsp.go
+++ b/builtin/logical/pki/path_ocsp.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -19,8 +19,12 @@ import (
 	"strings"
 	"time"
 
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
@@ -156,7 +160,7 @@ func buildOcspPostWithPath(b *backend, pattern string, displayAttrs *framework.D
 
 func (b *backend) ocspHandler(ctx context.Context, request *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 	sc := b.makeStorageContext(ctx, request.Storage)
-	cfg, err := b.CrlBuilder().getConfigWithUpdate(sc)
+	cfg, err := b.CrlBuilder().GetConfigWithUpdate(sc)
 	if err != nil || cfg.OcspDisable || (isUnifiedOcspPath(request) && !cfg.UnifiedCRL) {
 		return OcspUnauthorizedResponse, nil
 	}
@@ -175,7 +179,7 @@ func (b *backend) ocspHandler(ctx context.Context, request *logical.Request, dat
 
 	ocspStatus, err := getOcspStatus(sc, ocspReq, useUnifiedStorage)
 	if err != nil {
-		return logAndReturnInternalError(b, err), nil
+		return logAndReturnInternalError(b.Logger(), err), nil
 	}
 
 	caBundle, issuer, err := lookupOcspIssuer(sc, ocspReq, ocspStatus.issuerID)
@@ -193,14 +197,26 @@ func (b *backend) ocspHandler(ctx context.Context, request *logical.Request, dat
 			// https://www.rfc-editor.org/rfc/rfc5019#section-2.2.3
 			return OcspUnauthorizedResponse, nil
 		}
-		return logAndReturnInternalError(b, err), nil
+		return logAndReturnInternalError(b.Logger(), err), nil
 	}
 
 	byteResp, err := genResponse(cfg, caBundle, ocspStatus, ocspReq.HashAlgorithm, issuer.RevocationSigAlg)
 	if err != nil {
-		return logAndReturnInternalError(b, err), nil
+		return logAndReturnInternalError(b.Logger(), err), nil
 	}
 
+	var serialNumber string
+	if ocspStatus.serialNumber != nil {
+		serialNumber = ocspStatus.serialNumber.String()
+	}
+
+	b.pkiObserver.RecordPKIObservation(ctx, request, observe.ObservationTypePKIOCSP,
+		observe.NewAdditionalPKIMetadata("issuer_id", ocspStatus.issuerID),
+		observe.NewAdditionalPKIMetadata("unified", useUnifiedStorage),
+		observe.NewAdditionalPKIMetadata("serial_number", serialNumber),
+		observe.NewAdditionalPKIMetadata("ocsp_status", ocspStatus.ocspStatus),
+	)
+
 	return &logical.Response{
 		Data: map[string]interface{}{
 			logical.HTTPContentType: ocspResponseContentType,
@@ -210,7 +226,7 @@ func (b *backend) ocspHandler(ctx context.Context, request *logical.Request, dat
 	}, nil
 }
 
-func canUseUnifiedStorage(req *logical.Request, cfg *crlConfig) bool {
+func canUseUnifiedStorage(req *logical.Request, cfg *pki_backend.CrlConfig) bool {
 	if isUnifiedOcspPath(req) {
 		return true
 	}
@@ -224,13 +240,13 @@ func isUnifiedOcspPath(req *logical.Request) bool {
 	return strings.HasPrefix(req.Path, "unified-ocsp")
 }
 
-func generateUnknownResponse(cfg *crlConfig, sc *storageContext, ocspReq *ocsp.Request) *logical.Response {
+func generateUnknownResponse(cfg *pki_backend.CrlConfig, sc *storageContext, ocspReq *ocsp.Request) *logical.Response {
 	// Generate an Unknown OCSP response, signing with the default issuer from the mount as we did
 	// not match the request's issuer. If no default issuer can be used, return with Unauthorized as there
 	// isn't much else we can do at this point.
 	config, err := sc.getIssuersConfig()
 	if err != nil {
-		return logAndReturnInternalError(sc.Backend, err)
+		return logAndReturnInternalError(sc.Logger(), err)
 	}
 
 	if config.DefaultIssuerId == "" {
@@ -245,7 +261,7 @@ func generateUnknownResponse(cfg *crlConfig, sc *storageContext, ocspReq *ocsp.R
 			// no way to sign a response so Unauthorized it is.
 			return OcspUnauthorizedResponse
 		}
-		return logAndReturnInternalError(sc.Backend, err)
+		return logAndReturnInternalError(sc.Logger(), err)
 	}
 
 	if !issuer.Usage.HasUsage(issuing.OCSPSigningUsage) {
@@ -260,7 +276,7 @@ func generateUnknownResponse(cfg *crlConfig, sc *storageContext, ocspReq *ocsp.R
 
 	byteResp, err := genResponse(cfg, caBundle, info, ocspReq.HashAlgorithm, issuer.RevocationSigAlg)
 	if err != nil {
-		return logAndReturnInternalError(sc.Backend, err)
+		return logAndReturnInternalError(sc.Logger(), err)
 	}
 
 	return &logical.Response{
@@ -313,12 +329,12 @@ func fetchDerEncodedRequest(request *logical.Request, data *framework.FieldData)
 	}
 }
 
-func logAndReturnInternalError(b *backend, err error) *logical.Response {
+func logAndReturnInternalError(logger hclog.Logger, err error) *logical.Response {
 	// Since OCSP might be a high traffic endpoint, we will log at debug level only
 	// any internal errors we do get. There is no way for us to return to the end-user
 	// errors, so we rely on the log statement to help in debugging possible
 	// issues in the field.
-	b.Logger().Debug("OCSP internal error", "error", err)
+	logger.Debug("OCSP internal error", "error", err)
 	return OcspInternalErrorResponse
 }
 
@@ -334,7 +350,7 @@ func getOcspStatus(sc *storageContext, ocspReq *ocsp.Request, useUnifiedStorage
 	}
 
 	if revEntryRaw != nil {
-		var revEntry revocationInfo
+		var revEntry revocation.RevocationInfo
 		if err := revEntryRaw.DecodeJSON(&revEntry); err != nil {
 			return nil, err
 		}
@@ -433,7 +449,7 @@ func getOcspIssuerParsedBundle(sc *storageContext, issuerId issuing.IssuerID) (*
 		return nil, nil, ErrIssuerHasNoKey
 	}
 
-	caBundle, err := parseCABundle(sc.Context, sc.Backend, bundle)
+	caBundle, err := parseCABundle(sc.Context, sc.GetPkiManagedView(), bundle)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -446,7 +462,7 @@ func lookupIssuerIds(sc *storageContext, optRevokedIssuer issuing.IssuerID) ([]i
 		return []issuing.IssuerID{optRevokedIssuer}, nil
 	}
 
-	if sc.Backend.UseLegacyBundleCaStorage() {
+	if sc.UseLegacyBundleCaStorage() {
 		return []issuing.IssuerID{legacyBundleShimID}, nil
 	}
 
@@ -474,7 +490,7 @@ func doesRequestMatchIssuer(parsedBundle *certutil.ParsedCertBundle, req *ocsp.R
 	return bytes.Equal(req.IssuerKeyHash, issuerKeyHash) && bytes.Equal(req.IssuerNameHash, issuerNameHash), nil
 }
 
-func genResponse(cfg *crlConfig, caBundle *certutil.ParsedCertBundle, info *ocspRespInfo, reqHash crypto.Hash, revSigAlg x509.SignatureAlgorithm) ([]byte, error) {
+func genResponse(cfg *pki_backend.CrlConfig, caBundle *certutil.ParsedCertBundle, info *ocspRespInfo, reqHash crypto.Hash, revSigAlg x509.SignatureAlgorithm) ([]byte, error) {
 	curTime := time.Now()
 	duration, err := parseutil.ParseDurationSecond(cfg.OcspExpiry)
 	if err != nil {
diff --git a/builtin/logical/pki/path_ocsp_test.go b/builtin/logical/pki/path_ocsp_test.go
index baeb49cb1dc..6bdb63ae6c8 100644
--- a/builtin/logical/pki/path_ocsp_test.go
+++ b/builtin/logical/pki/path_ocsp_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -19,6 +19,8 @@ import (
 
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/helper/testhelpers/schema"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -163,7 +165,7 @@ func TestOcsp_InvalidIssuerIdInRevocationEntry(t *testing.T) {
 
 	// Twiddle the entry so that the issuer id is no longer valid.
 	storagePath := revokedPath + normalizeSerial(serial)
-	var revInfo revocationInfo
+	var revInfo revocation.RevocationInfo
 	revEntry, err := s.Get(ctx, storagePath)
 	require.NoError(t, err, "failed looking up storage path: %s", storagePath)
 	err = revEntry.DecodeJSON(&revInfo)
@@ -207,7 +209,7 @@ func TestOcsp_UnknownIssuerIdWithDefaultHavingOcspUsageRemoved(t *testing.T) {
 
 	// Twiddle the entry so that the issuer id is no longer valid.
 	storagePath := revokedPath + normalizeSerial(serial)
-	var revInfo revocationInfo
+	var revInfo revocation.RevocationInfo
 	revEntry, err := s.Get(ctx, storagePath)
 	require.NoError(t, err, "failed looking up storage path: %s", storagePath)
 	err = revEntry.DecodeJSON(&revInfo)
@@ -607,7 +609,7 @@ func runOcspRequestTest(t *testing.T, requestType string, caKeyType string,
 		nextUpdateDiff := nextUpdate.Sub(thisUpdate)
 		require.Equal(t, expectedDiff, nextUpdateDiff,
 			fmt.Sprintf("the delta between thisUpdate %s and nextUpdate: %s should have been around: %s but was %s",
-				thisUpdate, nextUpdate, defaultCrlConfig.OcspExpiry, nextUpdateDiff))
+				thisUpdate, nextUpdate, pki_backend.DefaultCrlConfig.OcspExpiry, nextUpdateDiff))
 	} else {
 		// With the config value set to 0, we shouldn't have a NextUpdate field set
 		require.True(t, ocspResp.NextUpdate.IsZero(), "nextUpdate value was not zero as expected was: %v", ocspResp.NextUpdate)
diff --git a/builtin/logical/pki/path_resign_crls.go b/builtin/logical/pki/path_resign_crls.go
index 95187c5734a..435edeeb622 100644
--- a/builtin/logical/pki/path_resign_crls.go
+++ b/builtin/logical/pki/path_resign_crls.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -22,6 +22,8 @@ import (
 
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -73,7 +75,7 @@ to the issuer.`,
 				Type: framework.TypeString,
 				Description: `The amount of time the generated CRL should be
 valid; defaults to 72 hours.`,
-				Default: defaultCrlConfig.Expiry,
+				Default: pki_backend.DefaultCrlConfig.Expiry,
 			},
 			crlsParam: {
 				Type:        framework.TypeStringSlice,
@@ -142,7 +144,7 @@ to the issuer.`,
 				Type: framework.TypeString,
 				Description: `The amount of time the generated CRL should be
 valid; defaults to 72 hours.`,
-				Default: defaultCrlConfig.Expiry,
+				Default: pki_backend.DefaultCrlConfig.Expiry,
 			},
 			formatParam: {
 				Type: framework.TypeString,
@@ -265,6 +267,11 @@ func (b *backend) pathUpdateResignCrlsHandler(ctx context.Context, request *logi
 
 	body := encodeResponse(crlBytes, format == "der")
 
+	b.pkiObserver.RecordPKIObservation(ctx, request, observe.ObservationTypePKIIssuerResignCRLs,
+		observe.NewAdditionalPKIMetadata("issuer_name", issuerRef),
+		observe.NewAdditionalPKIMetadata("signature_algorithm", caBundle.RevocationSigAlg),
+		observe.NewAdditionalPKIMetadata("number", big.NewInt(int64(crlNumber)).String()))
+
 	return &logical.Response{
 		Warnings: warnings,
 		Data: map[string]interface{}{
@@ -552,6 +559,10 @@ func parseSerialNum(cert map[string]interface{}) (*big.Int, error) {
 	if !serialExists {
 		return nil, errors.New("missing 'serial_number' field")
 	}
+	return parseSerialNumStr(serialNumRaw)
+}
+
+func parseSerialNumStr(serialNumRaw interface{}) (*big.Int, error) {
 	serialNumStr, err := parseutil.ParseString(serialNumRaw)
 	if err != nil {
 		return nil, fmt.Errorf("'serial_number' field value was not a string: %w", err)
diff --git a/builtin/logical/pki/path_resign_crls_test.go b/builtin/logical/pki/path_resign_crls_test.go
index 2b2e1ede137..2a09a50db23 100644
--- a/builtin/logical/pki/path_resign_crls_test.go
+++ b/builtin/logical/pki/path_resign_crls_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/path_revoke.go b/builtin/logical/pki/path_revoke.go
index 0e9a376f3a8..8e267371594 100644
--- a/builtin/logical/pki/path_revoke.go
+++ b/builtin/logical/pki/path_revoke.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -18,6 +18,8 @@ import (
 	"time"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
@@ -346,7 +348,7 @@ func (b *backend) pathRevokeWriteHandleCertificate(ctx context.Context, req *log
 	// Start with the latter since its cheaper. Fetch the cert (by serial)
 	// and if it exists, compare the contents.
 	sc := b.makeStorageContext(ctx, req.Storage)
-	certEntry, err := fetchCertBySerial(sc, "certs/", serial)
+	certEntry, err := fetchCertBySerial(sc, issuing.PathCerts, serial)
 	if err != nil {
 		return serial, false, nil, err
 	}
@@ -497,7 +499,7 @@ func validatePublicKeyMatchesCert(verifier crypto.PublicKey, certReference *x509
 	return nil
 }
 
-func (b *backend) maybeRevokeCrossCluster(sc *storageContext, config *crlConfig, serial string, havePrivateKey bool) (*logical.Response, error) {
+func (b *backend) maybeRevokeCrossCluster(sc *storageContext, config *pki_backend.CrlConfig, serial string, havePrivateKey bool) (*logical.Response, error) {
 	if !config.UseGlobalQueue {
 		return logical.ErrorResponse(fmt.Sprintf("certificate with serial %s not found.", serial)), nil
 	}
@@ -563,7 +565,7 @@ func (b *backend) pathRevokeWrite(ctx context.Context, req *logical.Request, dat
 	var cert *x509.Certificate
 	var serial string
 
-	config, err := sc.Backend.CrlBuilder().getConfigWithUpdate(sc)
+	config, err := sc.CrlBuilder().GetConfigWithUpdate(sc)
 	if err != nil {
 		return nil, fmt.Errorf("error revoking serial: %s: failed reading config: %w", serial, err)
 	}
@@ -580,7 +582,7 @@ func (b *backend) pathRevokeWrite(ctx context.Context, req *logical.Request, dat
 			return logical.ErrorResponse("The serial number must be provided"), nil
 		}
 
-		certEntry, err := fetchCertBySerial(sc, "certs/", serial)
+		certEntry, err := fetchCertBySerial(sc, issuing.PathCerts, serial)
 		if err != nil {
 			switch err.(type) {
 			case errutil.UserError:
@@ -632,7 +634,7 @@ func (b *backend) pathRevokeWrite(ctx context.Context, req *logical.Request, dat
 	// disk.
 	if writeCert {
 		err := req.Storage.Put(ctx, &logical.StorageEntry{
-			Key:   "certs/" + normalizeSerial(serial),
+			Key:   issuing.PathCerts + normalizeSerial(serial),
 			Value: cert.Raw,
 		})
 		if err != nil {
@@ -650,6 +652,24 @@ func (b *backend) pathRevokeWrite(ctx context.Context, req *logical.Request, dat
 	b.GetRevokeStorageLock().Lock()
 	defer b.GetRevokeStorageLock().Unlock()
 
+	var serialNumber string
+	var isCa bool
+	var akid []byte
+	var skid []byte
+	if cert != nil {
+		serialNumber = cert.SerialNumber.String()
+		isCa = cert.IsCA
+		akid = cert.AuthorityKeyId
+		skid = cert.SubjectKeyId
+	}
+
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIRevoke,
+		observe.NewAdditionalPKIMetadata("is_ca", isCa),
+		observe.NewAdditionalPKIMetadata("subject_key_id", skid),
+		observe.NewAdditionalPKIMetadata("authority_key_id", akid),
+		observe.NewAdditionalPKIMetadata("serial_number", serialNumber),
+	)
+
 	return revokeCert(sc, config, cert)
 }
 
@@ -658,7 +678,7 @@ func (b *backend) pathRotateCRLRead(ctx context.Context, req *logical.Request, _
 	defer b.GetRevokeStorageLock().RUnlock()
 
 	sc := b.makeStorageContext(ctx, req.Storage)
-	warnings, crlErr := b.CrlBuilder().rebuild(sc, false)
+	warnings, crlErr := b.CrlBuilder().Rebuild(sc, false)
 	if crlErr != nil {
 		switch crlErr.(type) {
 		case errutil.UserError:
@@ -678,13 +698,15 @@ func (b *backend) pathRotateCRLRead(ctx context.Context, req *logical.Request, _
 		resp.AddWarning(fmt.Sprintf("Warning %d during CRL rebuild: %v", index+1, warning))
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIRotateCRL)
+
 	return resp, nil
 }
 
 func (b *backend) pathRotateDeltaCRLRead(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
 	sc := b.makeStorageContext(ctx, req.Storage)
 
-	cfg, err := b.CrlBuilder().getConfigWithUpdate(sc)
+	cfg, err := b.CrlBuilder().GetConfigWithUpdate(sc)
 	if err != nil {
 		return nil, fmt.Errorf("error fetching CRL configuration: %w", err)
 	}
@@ -714,6 +736,8 @@ func (b *backend) pathRotateDeltaCRLRead(ctx context.Context, req *logical.Reque
 		resp.AddWarning(fmt.Sprintf("Warning %d during CRL rebuild: %v", index+1, warning))
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIRotateDeltaCRL)
+
 	return resp, nil
 }
 
diff --git a/builtin/logical/pki/path_roles.go b/builtin/logical/pki/path_roles.go
index 56bdc0aa8cd..58666ce6054 100644
--- a/builtin/logical/pki/path_roles.go
+++ b/builtin/logical/pki/path_roles.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
@@ -278,6 +279,15 @@ include the Common Name (cn); use use_csr_common_name
 for that. Defaults to true.`,
 		},
 
+		"serial_number_source": {
+			Type:     framework.TypeString,
+			Required: true,
+			Description: `Source for the certificate subject serial number.
+If "json-csr" (default), the value from the JSON serial_number field is used,
+falling back to the value in the CSR if empty. If "json", the value from the
+serial_number JSON field is used, ignoring the value in the CSR.`,
+		},
+
 		"ou": {
 			Type: framework.TypeCommaStringSlice,
 			Description: `If set, OU (OrganizationalUnit) will be set to
@@ -364,7 +374,7 @@ non-Hostname, non-Email address CNs.`,
 			Type: framework.TypeCommaStringSlice,
 			Description: `A comma-separated string or list of policy OIDs, or a JSON list of qualified policy
 information, which must include an oid, and may include a notice and/or cps url, using the form 
-[{"oid"="1.3.6.1.4.1.7.8","notice"="I am a user Notice"}, {"oid"="1.3.6.1.4.1.44947.1.2.4 ","cps"="https://example.com"}].`,
+[{"oid"="1.3.6.1.4.1.7.8","notice"="I am a user Notice"}, {"oid"="1.3.6.1.4.1.32473.1.2.4","cps"="https://example.com"}].`,
 		},
 
 		"basic_constraints_valid_for_non_ca": {
@@ -387,6 +397,8 @@ serviced by this role.`,
 		},
 	}
 
+	issuing.AddNoStoreMetadataRoleField(pathRolesResponseFields)
+
 	return &framework.Path{
 		Pattern: "roles/" + framework.GenericNameRegex("name"),
 
@@ -395,7 +407,7 @@ serviced by this role.`,
 			OperationSuffix: "role",
 		},
 
-		Fields: map[string]*framework.FieldSchema{
+		Fields: issuing.AddNoStoreMetadataRoleField(map[string]*framework.FieldSchema{
 			"backend": {
 				Type:        framework.TypeString,
 				Description: "Backend Type",
@@ -674,6 +686,19 @@ for that. Defaults to true.`,
 				},
 			},
 
+			"serial_number_source": {
+				Type:    framework.TypeString,
+				Default: "json-csr",
+				Description: `Source for the certificate subject serial number.
+If "json-csr" (default), the value from the JSON serial_number field is used,
+falling back to the value in the CSR if empty. If "json", the value from the
+serial_number JSON field is used, ignoring the value in the CSR.`,
+				DisplayAttrs: &framework.DisplayAttributes{
+					Name:  "Serial number source",
+					Value: "json-csr",
+				},
+			},
+
 			"ou": {
 				Type: framework.TypeCommaStringSlice,
 				Description: `If set, OU (OrganizationalUnit) will be set to
@@ -777,7 +802,7 @@ non-Hostname, non-Email address CNs.`,
 				Type: framework.TypeCommaStringSlice,
 				Description: `A comma-separated string or list of policy OIDs, or a JSON list of qualified policy
 information, which must include an oid, and may include a notice and/or cps url, using the form 
-[{"oid"="1.3.6.1.4.1.7.8","notice"="I am a user Notice"}, {"oid"="1.3.6.1.4.1.44947.1.2.4 ","cps"="https://example.com"}].`,
+[{"oid"="1.3.6.1.4.1.7.8","notice"="I am a user Notice"}, {"oid"="1.3.6.1.4.1.32473.1.2.4","cps"="https://example.com"}].`,
 			},
 
 			"basic_constraints_valid_for_non_ca": {
@@ -806,7 +831,7 @@ The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ.`,
 serviced by this role.`,
 				Default: defaultRef,
 			},
-		},
+		}),
 
 		Operations: map[logical.Operation]framework.OperationHandler{
 			logical.ReadOperation: &framework.PathOperation{
@@ -896,11 +921,16 @@ func (b *backend) GetRole(ctx context.Context, s logical.Storage, n string) (*is
 }
 
 func (b *backend) pathRoleDelete(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
-	err := req.Storage.Delete(ctx, "role/"+data.Get("name").(string))
+	roleName := data.Get("name").(string)
+	err := req.Storage.Delete(ctx, "role/"+roleName)
 	if err != nil {
 		return nil, err
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIRoleDelete,
+		observe.NewAdditionalPKIMetadata("role_name", roleName),
+	)
+
 	return nil, nil
 }
 
@@ -921,6 +951,12 @@ func (b *backend) pathRoleRead(ctx context.Context, req *logical.Request, data *
 	resp := &logical.Response{
 		Data: role.ToResponseData(),
 	}
+
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIRoleRead,
+		observe.NewAdditionalPKIMetadata("issuer_name", role.Issuer),
+		observe.NewAdditionalPKIMetadata("role_name", role.Name),
+	)
+
 	return resp, nil
 }
 
@@ -962,6 +998,7 @@ func (b *backend) pathRoleCreate(ctx context.Context, req *logical.Request, data
 		UsePSS:                        data.Get("use_pss").(bool),
 		UseCSRCommonName:              data.Get("use_csr_common_name").(bool),
 		UseCSRSANs:                    data.Get("use_csr_sans").(bool),
+		SerialNumberSource:            data.Get("serial_number_source").(string),
 		KeyUsage:                      data.Get("key_usage").([]string),
 		ExtKeyUsage:                   data.Get("ext_key_usage").([]string),
 		ExtKeyUsageOIDs:               data.Get("ext_key_usage_oids").([]string),
@@ -974,6 +1011,7 @@ func (b *backend) pathRoleCreate(ctx context.Context, req *logical.Request, data
 		PostalCode:                    data.Get("postal_code").([]string),
 		GenerateLease:                 new(bool),
 		NoStore:                       data.Get("no_store").(bool),
+		NoStoreMetadata:               issuing.GetNoStoreMetadata(data),
 		RequireCN:                     data.Get("require_cn").(bool),
 		CNValidations:                 data.Get("cn_validations").([]string),
 		AllowedSerialNumbers:          data.Get("allowed_serial_numbers").([]string),
@@ -1041,6 +1079,16 @@ func (b *backend) pathRoleCreate(ctx context.Context, req *logical.Request, data
 		return nil, err
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIRoleWrite,
+		observe.NewAdditionalPKIMetadata("issuer_name", entry.Issuer),
+		observe.NewAdditionalPKIMetadata("role_name", entry.Name),
+		observe.NewAdditionalPKIMetadata("max_ttl", entry.MaxTTL.String()),
+		observe.NewAdditionalPKIMetadata("ttl", entry.TTL.String()),
+		observe.NewAdditionalPKIMetadata("no_store", entry.NoStore),
+		observe.NewAdditionalPKIMetadata("not_after", entry.NotAfter),
+		observe.NewAdditionalPKIMetadata("not_before", entry.NotBeforeDuration.String()),
+	)
+
 	return resp, nil
 }
 
@@ -1058,6 +1106,12 @@ func validateRole(b *backend, entry *issuing.RoleEntry, ctx context.Context, s l
 		return logical.ErrorResponse(err.Error()), nil
 	}
 
+	if entry.SerialNumberSource != "" &&
+		entry.SerialNumberSource != "json-csr" &&
+		entry.SerialNumberSource != "json" {
+		return logical.ErrorResponse("unknown serial_number_source %s", entry.SerialNumberSource), nil
+	}
+
 	if len(entry.ExtKeyUsageOIDs) > 0 {
 		for _, oidstr := range entry.ExtKeyUsageOIDs {
 			_, err := certutil.StringToOid(oidstr)
@@ -1162,6 +1216,7 @@ func (b *backend) pathRolePatch(ctx context.Context, req *logical.Request, data
 		UsePSS:                        getWithExplicitDefault(data, "use_pss", oldEntry.UsePSS).(bool),
 		UseCSRCommonName:              getWithExplicitDefault(data, "use_csr_common_name", oldEntry.UseCSRCommonName).(bool),
 		UseCSRSANs:                    getWithExplicitDefault(data, "use_csr_sans", oldEntry.UseCSRSANs).(bool),
+		SerialNumberSource:            getWithExplicitDefault(data, "serial_number_source", oldEntry.SerialNumberSource).(string),
 		KeyUsage:                      getWithExplicitDefault(data, "key_usage", oldEntry.KeyUsage).([]string),
 		ExtKeyUsage:                   getWithExplicitDefault(data, "ext_key_usage", oldEntry.ExtKeyUsage).([]string),
 		ExtKeyUsageOIDs:               getWithExplicitDefault(data, "ext_key_usage_oids", oldEntry.ExtKeyUsageOIDs).([]string),
@@ -1174,6 +1229,7 @@ func (b *backend) pathRolePatch(ctx context.Context, req *logical.Request, data
 		PostalCode:                    getWithExplicitDefault(data, "postal_code", oldEntry.PostalCode).([]string),
 		GenerateLease:                 new(bool),
 		NoStore:                       getWithExplicitDefault(data, "no_store", oldEntry.NoStore).(bool),
+		NoStoreMetadata:               issuing.NoStoreMetadataValue(getWithExplicitDefault(data, "no_store_metadata", oldEntry.NoStoreMetadata).(bool)),
 		RequireCN:                     getWithExplicitDefault(data, "require_cn", oldEntry.RequireCN).(bool),
 		CNValidations:                 getWithExplicitDefault(data, "cn_validations", oldEntry.CNValidations).([]string),
 		AllowedSerialNumbers:          getWithExplicitDefault(data, "allowed_serial_numbers", oldEntry.AllowedSerialNumbers).([]string),
@@ -1248,6 +1304,16 @@ func (b *backend) pathRolePatch(ctx context.Context, req *logical.Request, data
 		return nil, err
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIRolePatch,
+		observe.NewAdditionalPKIMetadata("issuer_name", entry.Issuer),
+		observe.NewAdditionalPKIMetadata("role_name", entry.Name),
+		observe.NewAdditionalPKIMetadata("max_ttl", entry.MaxTTL.String()),
+		observe.NewAdditionalPKIMetadata("ttl", entry.TTL.String()),
+		observe.NewAdditionalPKIMetadata("no_store", entry.NoStore),
+		observe.NewAdditionalPKIMetadata("not_after", entry.NotAfter),
+		observe.NewAdditionalPKIMetadata("not_before", entry.NotBeforeDuration.String()),
+	)
+
 	return resp, nil
 }
 
diff --git a/builtin/logical/pki/path_roles_test.go b/builtin/logical/pki/path_roles_test.go
index 3b3d911c8fb..05f8f3c59b9 100644
--- a/builtin/logical/pki/path_roles_test.go
+++ b/builtin/logical/pki/path_roles_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -879,6 +879,11 @@ func TestPki_RolePatch(t *testing.T) {
 			Before:  false,
 			Patched: true,
 		},
+		{
+			Field:   "serial_number_source",
+			Before:  "json-csr",
+			Patched: "json",
+		},
 		{
 			Field:   "ou",
 			Before:  []string{"crypto"},
@@ -1026,8 +1031,8 @@ func TestPki_RolePatch(t *testing.T) {
 func TestPKI_RolePolicyInformation_Flat(t *testing.T) {
 	t.Parallel()
 	type TestCase struct {
-		Input   interface{}
-		ASN     interface{}
+		Input   string
+		ASN     string
 		OidList []string
 	}
 
@@ -1046,9 +1051,9 @@ func TestPKI_RolePolicyInformation_Flat(t *testing.T) {
 			OidList: expectedSimpleOidList,
 		},
 		{
-			Input:   "[{\"oid\":\"1.3.6.1.4.1.7.8\",\"notice\":\"I am a user Notice\"},{\"oid\":\"1.3.6.1.44947.1.2.4\",\"cps\":\"https://example.com\"}]",
-			ASN:     "MF8wLQYHKwYBBAEHCDAiMCAGCCsGAQUFBwICMBQMEkkgYW0gYSB1c2VyIE5vdGljZTAuBgkrBgGC3xMBAgQwITAfBggrBgEFBQcCARYTaHR0cHM6Ly9leGFtcGxlLmNvbQ==",
-			OidList: append(*new([]string), "1.3.6.1.4.1.7.8", "1.3.6.1.44947.1.2.4"),
+			Input:   "[{\"oid\":\"1.3.6.1.4.1.7.8\",\"notice\":\"I am a user Notice\"},{\"oid\":\"1.3.6.1.32473.1.2.4\",\"cps\":\"https://example.com\"}]",
+			ASN:     "MF8wLQYHKwYBBAEHCDAiMCAGCCsGAQUFBwICMBQMEkkgYW0gYSB1c2VyIE5vdGljZTAuBgkrBgGB/VkBAgQwITAfBggrBgEFBQcCARYTaHR0cHM6Ly9leGFtcGxlLmNvbQ==",
+			OidList: append(*new([]string), "1.3.6.1.4.1.7.8", "1.3.6.1.32473.1.2.4"),
 		},
 	}
 
@@ -1071,10 +1076,6 @@ func TestPKI_RolePolicyInformation_Flat(t *testing.T) {
 	}
 
 	for index, testCase := range testCases {
-		var roleResp *logical.Response
-		var issueResp *logical.Response
-		var err error
-
 		// Create/update the role
 		roleData := map[string]interface{}{}
 		roleData[policyIdentifiersParam] = testCase.Input
@@ -1086,15 +1087,16 @@ func TestPKI_RolePolicyInformation_Flat(t *testing.T) {
 			Data:      roleData,
 		}
 
-		roleResp, err = b.HandleRequest(context.Background(), roleReq)
+		roleResp, err := b.HandleRequest(context.Background(), roleReq)
 		if err != nil || (roleResp != nil && roleResp.IsError()) {
 			t.Fatalf("bad [%d], setting policy identifier %v err: %v resp: %#v", index, testCase.Input, err, roleResp)
 		}
 
 		// Issue Using this role
-		issueData := map[string]interface{}{}
-		issueData["common_name"] = "localhost"
-		issueData["ttl"] = "2s"
+		issueData := map[string]interface{}{
+			"common_name": "localhost",
+			"ttl":         "2s",
+		}
 
 		issueReq := &logical.Request{
 			Operation: logical.UpdateOperation,
@@ -1103,10 +1105,13 @@ func TestPKI_RolePolicyInformation_Flat(t *testing.T) {
 			Data:      issueData,
 		}
 
-		issueResp, err = b.HandleRequest(context.Background(), issueReq)
+		issueResp, err := b.HandleRequest(context.Background(), issueReq)
 		if err != nil || (issueResp != nil && issueResp.IsError()) {
 			t.Fatalf("bad [%d], setting policy identifier %v err: %v resp: %#v", index, testCase.Input, err, issueResp)
 		}
+		if issueResp == nil || issueResp.Data == nil {
+			t.Fatalf("bad [%d], setting policy identifier %v no response", index, testCase.Input)
+		}
 
 		// Validate the OIDs
 		policyIdentifiers, err := getPolicyIdentifiersOffCertificate(*issueResp)
@@ -1126,10 +1131,8 @@ func TestPKI_RolePolicyInformation_Flat(t *testing.T) {
 		if err != nil {
 			t.Fatalf("bad [%d], getting extension from %v err: %v resp: %#v", index, testCase.Input, err, issueResp)
 		}
-		certificateB64 := make([]byte, len(certificateAsn)*2)
-		base64.StdEncoding.Encode(certificateB64, certificateAsn)
-		certificateString := string(certificateB64[:])
-		assert.Contains(t, certificateString, testCase.ASN)
+		certificateString := base64.StdEncoding.EncodeToString(certificateAsn)
+		assert.Equal(t, certificateString, testCase.ASN)
 	}
 }
 
@@ -1140,8 +1143,8 @@ func getPolicyIdentifiersOffCertificate(resp logical.Response) ([]string, error)
 	if err != nil {
 		return nil, err
 	}
-	policyIdentifierStrings := make([]string, len(certificate.PolicyIdentifiers))
-	for index, asnOid := range certificate.PolicyIdentifiers {
+	policyIdentifierStrings := make([]string, len(certificate.Policies))
+	for index, asnOid := range certificate.Policies {
 		policyIdentifierStrings[index] = asnOid.String()
 	}
 	return policyIdentifierStrings, nil
diff --git a/builtin/logical/pki/path_root.go b/builtin/logical/pki/path_root.go
index 07f3b5b0627..a214be07ae4 100644
--- a/builtin/logical/pki/path_root.go
+++ b/builtin/logical/pki/path_root.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -21,6 +21,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/builtin/logical/pki/parsing"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
@@ -29,6 +30,8 @@ import (
 	"golang.org/x/crypto/ed25519"
 )
 
+const intCaTruncatationWarning = "the signed intermediary CA certificate's notAfter was truncated to the issuer's notAfter"
+
 func pathGenerateRoot(b *backend) *framework.Path {
 	pattern := "root/generate/" + framework.GenericNameRegex("exported")
 
@@ -195,6 +198,13 @@ func (b *backend) pathCAGenerateRoot(ctx context.Context, req *logical.Request,
 		},
 	}
 
+	if keyUsages, ok := data.GetOk("key_usage"); ok {
+		err = validateCaKeyUsages(keyUsages.([]string))
+		if err != nil {
+			resp.AddWarning(fmt.Sprintf("Invalid key usage will be ignored: %v", err.Error()))
+		}
+	}
+
 	if len(parsedBundle.Certificate.RawSubject) <= 2 {
 		// Strictly a subject is a SEQUENCE of SETs of SEQUENCES.
 		//
@@ -208,12 +218,19 @@ func (b *backend) pathCAGenerateRoot(ctx context.Context, req *logical.Request,
 		resp.AddWarning("This issuer certificate was generated without a Subject; this makes it likely that issuing leaf certs with this certificate will cause TLS validation libraries to reject this certificate.")
 	}
 
-	if len(parsedBundle.Certificate.OCSPServer) == 0 && len(parsedBundle.Certificate.IssuingCertificateURL) == 0 && len(parsedBundle.Certificate.CRLDistributionPoints) == 0 {
+	deltaCrlDistributionPoints, err := certutil.ParseDeltaCRLExtension(parsedBundle.Certificate)
+	if err != nil {
+		return logical.ErrorResponse(fmt.Sprintf("error: invalid delta crl extension: %v", err.Error())), nil
+	}
+	if len(parsedBundle.Certificate.OCSPServer) == 0 && len(parsedBundle.Certificate.IssuingCertificateURL) == 0 && len(parsedBundle.Certificate.CRLDistributionPoints) == 0 && len(deltaCrlDistributionPoints) == 0 {
 		// If the operator hasn't configured any of the URLs prior to
 		// generating this issuer, we should add a warning to the response,
 		// informing them they might want to do so prior to issuing leaves.
 		resp.AddWarning("This mount hasn't configured any authority information access (AIA) fields; this may make it harder for systems to find missing certificates in the chain or to validate revocation status of certificates. Consider updating /config/urls or the newly generated issuer with this information.")
 	}
+	if len(deltaCrlDistributionPoints) > 0 && len(parsedBundle.Certificate.CRLDistributionPoints) == 0 {
+		resp.AddWarning("This mount has configured Delta CRL distribution points are set but no CRL Distribution Points.")
+	}
 
 	switch format {
 	case "pem":
@@ -289,9 +306,10 @@ func (b *backend) pathCAGenerateRoot(ctx context.Context, req *logical.Request,
 	if err != nil {
 		return nil, err
 	}
+	b.pkiCertificateCounter.AddIssuedCertificate(true)
 
 	// Build a fresh CRL
-	warnings, err = b.CrlBuilder().rebuild(sc, true)
+	warnings, err = b.CrlBuilder().Rebuild(sc, true)
 	if err != nil {
 		return nil, err
 	}
@@ -315,6 +333,23 @@ func (b *backend) pathCAGenerateRoot(ctx context.Context, req *logical.Request,
 
 	resp = addWarnings(resp, warnings)
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIGenerateRoot,
+		observe.NewAdditionalPKIMetadata("issuer_name", myIssuer.Name),
+		observe.NewAdditionalPKIMetadata("issuer_id", myIssuer.ID),
+		observe.NewAdditionalPKIMetadata("key_id", myKey.ID),
+		observe.NewAdditionalPKIMetadata("key_name", myKey.Name),
+		observe.NewAdditionalPKIMetadata("key_type", myKey.PrivateKeyType),
+		observe.NewAdditionalPKIMetadata("role_name", role.Name),
+		observe.NewAdditionalPKIMetadata("serial_number", cb.SerialNumber),
+		observe.NewAdditionalPKIMetadata("type", format),
+		observe.NewAdditionalPKIMetadata("common_name", parsedBundle.Certificate.Subject.CommonName),
+		observe.NewAdditionalPKIMetadata("subject_key_id", parsedBundle.Certificate.SubjectKeyId),
+		observe.NewAdditionalPKIMetadata("authority_key_id", parsedBundle.Certificate.AuthorityKeyId),
+		observe.NewAdditionalPKIMetadata("public_key_algorithm", parsedBundle.Certificate.PublicKeyAlgorithm.String()),
+		observe.NewAdditionalPKIMetadata("public_key_size", certutil.GetPublicKeySize(parsedBundle.Certificate.PublicKey)),
+		observe.NewAdditionalPKIMetadata("not_after", parsedBundle.Certificate.NotAfter.String()),
+		observe.NewAdditionalPKIMetadata("not_before", parsedBundle.Certificate.NotBefore.String()))
+
 	return resp, nil
 }
 
@@ -354,6 +389,7 @@ func (b *backend) pathIssuerSignIntermediate(ctx context.Context, req *logical.R
 		NotAfter:                  data.Get("not_after").(string),
 		NotBeforeDuration:         time.Duration(data.Get("not_before_duration").(int)) * time.Second,
 		CNValidations:             []string{"disabled"},
+		KeyUsage:                  data.Get("key_usage").([]string),
 	}
 	*role.AllowWildcardCertificates = true
 
@@ -363,7 +399,7 @@ func (b *backend) pathIssuerSignIntermediate(ctx context.Context, req *logical.R
 
 	var caErr error
 	sc := b.makeStorageContext(ctx, req.Storage)
-	signingBundle, caErr := sc.fetchCAInfo(issuerName, issuing.IssuanceUsage)
+	signingBundle, issuerId, caErr := sc.fetchCAInfoWithIssuer(issuerName, issuing.IssuanceUsage)
 	if caErr != nil {
 		switch caErr.(type) {
 		case errutil.UserError:
@@ -375,10 +411,16 @@ func (b *backend) pathIssuerSignIntermediate(ctx context.Context, req *logical.R
 		}
 	}
 
-	// Since we are signing an intermediate, we explicitly want to override
-	// the leaf NotAfterBehavior to permit issuing intermediates longer than
-	// the life of this issuer.
-	signingBundle.LeafNotAfterBehavior = certutil.PermitNotAfterBehavior
+	warnAboutTruncate := false
+	if enforceLeafNotAfter := data.Get("enforce_leaf_not_after_behavior").(bool); !enforceLeafNotAfter {
+		// Since we are signing an intermediate, we will by default truncate the
+		// signed intermediary in order to generate a valid intermediary chain. This
+		// was changed in 1.17.x as the default prior was PermitNotAfterBehavior
+		if signingBundle.LeafNotAfterBehavior != certutil.AlwaysEnforceErr {
+			warnAboutTruncate = true
+			signingBundle.LeafNotAfterBehavior = certutil.TruncateNotAfterBehavior
+		}
+	}
 
 	useCSRValues := data.Get("use_csr_values").(bool)
 
@@ -393,7 +435,7 @@ func (b *backend) pathIssuerSignIntermediate(ctx context.Context, req *logical.R
 		apiData: data,
 		role:    role,
 	}
-	parsedBundle, warnings, err := signCert(b, input, signingBundle, true, useCSRValues)
+	parsedBundle, warnings, err := signCert(b.System(), input, signingBundle, true, useCSRValues)
 	if err != nil {
 		switch err.(type) {
 		case errutil.UserError:
@@ -404,7 +446,7 @@ func (b *backend) pathIssuerSignIntermediate(ctx context.Context, req *logical.R
 		}
 	}
 
-	if err := parsedBundle.Verify(); err != nil {
+	if err := issuing.VerifyCertificate(sc.GetContext(), sc.GetStorage(), issuerId, parsedBundle); err != nil {
 		return nil, fmt.Errorf("verification of parsed bundle failed: %w", err)
 	}
 
@@ -417,6 +459,30 @@ func (b *backend) pathIssuerSignIntermediate(ctx context.Context, req *logical.R
 	if err != nil {
 		return nil, err
 	}
+	b.pkiCertificateCounter.AddIssuedCertificate(true)
+
+	if warnAboutTruncate &&
+		signingBundle.Certificate.NotAfter.Equal(parsedBundle.Certificate.NotAfter) {
+		resp.AddWarning(intCaTruncatationWarning)
+	}
+
+	if keyUsages, ok := data.GetOk("key_usage"); ok {
+		err = validateCaKeyUsages(keyUsages.([]string))
+		if err != nil {
+			resp.AddWarning(fmt.Sprintf("Invalid key usage: %v", err.Error()))
+		}
+	}
+
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIIssuerSignIntermediate,
+		observe.NewAdditionalPKIMetadata("issuer_name", issuerName),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuerId),
+		observe.NewAdditionalPKIMetadata("not_after", parsedBundle.Certificate.NotAfter.String()),
+		observe.NewAdditionalPKIMetadata("not_before", parsedBundle.Certificate.NotBefore.String()),
+		observe.NewAdditionalPKIMetadata("common_name", parsedBundle.Certificate.Subject.CommonName),
+		observe.NewAdditionalPKIMetadata("subject_key_id", parsedBundle.Certificate.SubjectKeyId),
+		observe.NewAdditionalPKIMetadata("authority_key_id", parsedBundle.Certificate.AuthorityKeyId),
+		observe.NewAdditionalPKIMetadata("role_name", role.Name),
+		observe.NewAdditionalPKIMetadata("type", format))
 
 	return resp, nil
 }
@@ -456,12 +522,19 @@ func signIntermediateResponse(signingBundle *certutil.CAInfoBundle, parsedBundle
 		resp.AddWarning("This issuer certificate was generated without a Subject; this makes it likely that issuing leaf certs with this certificate will cause TLS validation libraries to reject this certificate.")
 	}
 
-	if len(parsedBundle.Certificate.OCSPServer) == 0 && len(parsedBundle.Certificate.IssuingCertificateURL) == 0 && len(parsedBundle.Certificate.CRLDistributionPoints) == 0 {
+	deltaCrlDistributionPoints, err := certutil.ParseDeltaCRLExtension(parsedBundle.Certificate)
+	if err != nil {
+		return logical.ErrorResponse(fmt.Sprintf("invalid delta crl extension on generated certificate: %v", err.Error())), nil
+	}
+	if len(parsedBundle.Certificate.OCSPServer) == 0 && len(parsedBundle.Certificate.IssuingCertificateURL) == 0 && len(parsedBundle.Certificate.CRLDistributionPoints) == 0 && len(deltaCrlDistributionPoints) == 0 {
 		// If the operator hasn't configured any of the URLs prior to
 		// generating this issuer, we should add a warning to the response,
 		// informing them they might want to do so prior to issuing leaves.
 		resp.AddWarning("This mount hasn't configured any authority information access (AIA) fields; this may make it harder for systems to find missing certificates in the chain or to validate revocation status of certificates. Consider updating /config/urls or the newly generated issuer with this information.")
 	}
+	if len(deltaCrlDistributionPoints) > 0 && len(parsedBundle.Certificate.CRLDistributionPoints) == 0 {
+		resp.AddWarning("This mount has configured delta CRL distribution points, but not CRL distribution points.")
+	}
 
 	caChain := append([]string{cb.Certificate}, cb.CAChain...)
 
@@ -523,7 +596,7 @@ func (b *backend) pathIssuerSignSelfIssued(ctx context.Context, req *logical.Req
 	}
 
 	sc := b.makeStorageContext(ctx, req.Storage)
-	signingBundle, caErr := sc.fetchCAInfo(issuerName, issuing.IssuanceUsage)
+	signingBundle, issuerId, caErr := sc.fetchCAInfoWithIssuer(issuerName, issuing.IssuanceUsage)
 	if caErr != nil {
 		switch caErr.(type) {
 		case errutil.UserError:
@@ -546,6 +619,15 @@ func (b *backend) pathIssuerSignSelfIssued(ctx context.Context, req *logical.Req
 	cert.IssuingCertificateURL = urls.IssuingCertificates
 	cert.CRLDistributionPoints = urls.CRLDistributionPoints
 	cert.OCSPServer = urls.OCSPServers
+	bundleData := &certutil.CreationBundle{
+		Params:        &certutil.CreationParameters{URLs: urls},
+		SigningBundle: nil,
+		CSR:           nil,
+	}
+	err = certutil.AddDeltaCRLExtension(bundleData, cert)
+	if err != nil {
+		return nil, err
+	}
 
 	// If the requested signature algorithm isn't the same as the signing certificate, and
 	// the user has requested a cross-algorithm signature, reset the template's signing algorithm
@@ -581,6 +663,20 @@ func (b *backend) pathIssuerSignSelfIssued(ctx context.Context, req *logical.Req
 		Bytes: newCert,
 	})
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIIssuerSignSelfIssued,
+		observe.NewAdditionalPKIMetadata("issuer_name", issuerName),
+		observe.NewAdditionalPKIMetadata("issuer_id", issuerId.String()),
+		observe.NewAdditionalPKIMetadata("issuing_ca", signingCB.IssuingCA),
+		observe.NewAdditionalPKIMetadata("serial_number", cert.SerialNumber),
+		observe.NewAdditionalPKIMetadata("not_after", cert.NotAfter.String()),
+		observe.NewAdditionalPKIMetadata("not_before", cert.NotBefore.String()),
+		observe.NewAdditionalPKIMetadata("common_name", cert.Subject.CommonName),
+		observe.NewAdditionalPKIMetadata("public_key_algorithm", cert.PublicKeyAlgorithm.String()),
+		observe.NewAdditionalPKIMetadata("public_key_size", certutil.GetPublicKeySize(cert.PublicKey)),
+		observe.NewAdditionalPKIMetadata("signing_algorithm", signingAlgorithm.String()),
+		observe.NewAdditionalPKIMetadata("subject_key_id", cert.SubjectKeyId),
+		observe.NewAdditionalPKIMetadata("authority_key_id", cert.AuthorityKeyId))
+
 	return &logical.Response{
 		Data: map[string]interface{}{
 			"certificate": strings.TrimSpace(string(pemCert)),
@@ -617,6 +713,24 @@ func publicKeyType(pub crypto.PublicKey) (pubType x509.PublicKeyAlgorithm, sigAl
 	return
 }
 
+func validateCaKeyUsages(keyUsages []string) error {
+	invalidKeyUsages := []string{}
+	for _, usage := range keyUsages {
+		cleanUsage := strings.ToLower(strings.TrimSpace(usage))
+		switch cleanUsage {
+		case "crlsign", "certsign", "digitalsignature":
+		case "contentcommitment", "keyencipherment", "dataencipherment", "keyagreement", "encipheronly", "decipheronly":
+			invalidKeyUsages = append(invalidKeyUsages, fmt.Sprintf("key usage %s is only valid for non-Ca certs", usage))
+		default:
+			invalidKeyUsages = append(invalidKeyUsages, fmt.Sprintf("unrecognized key usage %s", usage))
+		}
+	}
+	if invalidKeyUsages != nil {
+		return errors.New(strings.Join(invalidKeyUsages, "; "))
+	}
+	return nil
+}
+
 const pathGenerateRootHelpSyn = `
 Generate a new CA certificate and private key used for signing.
 `
diff --git a/builtin/logical/pki/path_sign_issuers.go b/builtin/logical/pki/path_sign_issuers.go
index e9bdc5e8a30..154a28a07b8 100644
--- a/builtin/logical/pki/path_sign_issuers.go
+++ b/builtin/logical/pki/path_sign_issuers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -36,6 +36,11 @@ func pathSignIntermediate(b *backend) *framework.Path {
 
 func buildPathIssuerSignIntermediateRaw(b *backend, pattern string, displayAttrs *framework.DisplayAttributes) *framework.Path {
 	fields := addIssuerRefField(map[string]*framework.FieldSchema{})
+	fields["enforce_leaf_not_after_behavior"] = &framework.FieldSchema{
+		Type:        framework.TypeBool,
+		Default:     false,
+		Description: "Do not truncate the NotAfter field, use the issuer's configured leaf_not_after_behavior",
+	}
 	path := &framework.Path{
 		Pattern:      pattern,
 		DisplayAttrs: displayAttrs,
@@ -105,7 +110,7 @@ certs signed by this path; for instance,
 the non-repudiation flag;
 3) Extensions requested in the CSR will be copied
 into the issued certificate.`,
-	}
+	} // TODO: Re-Write This (!)
 
 	fields["signature_bits"] = &framework.FieldSchema{
 		Type:    framework.TypeInt,
@@ -144,6 +149,8 @@ in the above RFC section.`,
 RSA key-type issuer. Defaults to false.`,
 	}
 
+	fields = addCACertKeyUsage(fields)
+
 	return path
 }
 
diff --git a/builtin/logical/pki/path_tidy.go b/builtin/logical/pki/path_tidy.go
index d3b0776eca0..b0c24b6d65d 100644
--- a/builtin/logical/pki/path_tidy.go
+++ b/builtin/logical/pki/path_tidy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -8,6 +8,7 @@ import (
 	"crypto/x509"
 	"errors"
 	"fmt"
+	"math/rand/v2"
 	"net/http"
 	"sync/atomic"
 	"time"
@@ -16,6 +17,9 @@ import (
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -23,15 +27,16 @@ import (
 
 var tidyCancelledError = errors.New("tidy operation cancelled")
 
+//go:generate enumer -type=tidyStatusState -trimprefix=tidyStatus
 type tidyStatusState int
 
 const (
-	tidyStatusInactive   tidyStatusState = iota
-	tidyStatusStarted                    = iota
-	tidyStatusFinished                   = iota
-	tidyStatusError                      = iota
-	tidyStatusCancelling                 = iota
-	tidyStatusCancelled                  = iota
+	tidyStatusInactive tidyStatusState = iota
+	tidyStatusStarted
+	tidyStatusFinished
+	tidyStatusError
+	tidyStatusCancelling
+	tidyStatusCancelled
 )
 
 type tidyStatus struct {
@@ -49,6 +54,8 @@ type tidyStatus struct {
 	tidyRevocationQueue   bool
 	tidyCrossRevokedCerts bool
 	tidyAcme              bool
+	tidyCertMetadata      bool
+	tidyCMPV2NonceStore   bool
 	pauseDuration         string
 
 	// Status
@@ -65,6 +72,8 @@ type tidyStatus struct {
 	missingIssuerCertCount   uint
 	revQueueDeletedCount     uint
 	crossRevokedDeletedCount uint
+	certMetadataDeletedCount uint
+	cmpv2NonceDeletedCount   uint
 
 	acmeAccountsCount        uint
 	acmeAccountsRevokedCount uint
@@ -74,8 +83,10 @@ type tidyStatus struct {
 
 type tidyConfig struct {
 	// AutoTidy config
-	Enabled  bool          `json:"enabled"`
-	Interval time.Duration `json:"interval_duration"`
+	Enabled           bool          `json:"enabled"`
+	Interval          time.Duration `json:"interval_duration"`
+	MinStartupBackoff time.Duration `json:"min_startup_backoff_duration"`
+	MaxStartupBackoff time.Duration `json:"max_startup_backoff_duration"`
 
 	// Tidy Operations
 	CertStore         bool `json:"tidy_cert_store"`
@@ -86,6 +97,8 @@ type tidyConfig struct {
 	RevocationQueue   bool `json:"tidy_revocation_queue"`
 	CrossRevokedCerts bool `json:"tidy_cross_cluster_revoked_certs"`
 	TidyAcme          bool `json:"tidy_acme"`
+	CertMetadata      bool `json:"tidy_cert_metadata"`
+	CMPV2NonceStore   bool `json:"tidy_cmpv2_nonce_store"`
 
 	// Safety Buffers
 	SafetyBuffer            time.Duration `json:"safety_buffer"`
@@ -100,16 +113,31 @@ type tidyConfig struct {
 }
 
 func (tc *tidyConfig) IsAnyTidyEnabled() bool {
-	return tc.CertStore || tc.RevokedCerts || tc.IssuerAssocs || tc.ExpiredIssuers || tc.BackupBundle || tc.TidyAcme || tc.CrossRevokedCerts || tc.RevocationQueue
+	return tc.CertStore || tc.RevokedCerts || tc.IssuerAssocs || tc.ExpiredIssuers || tc.BackupBundle || tc.TidyAcme || tc.CrossRevokedCerts || tc.RevocationQueue || tc.CertMetadata || tc.CMPV2NonceStore
 }
 
 func (tc *tidyConfig) AnyTidyConfig() string {
-	return "tidy_cert_store / tidy_revoked_certs / tidy_revoked_cert_issuer_associations / tidy_expired_issuers / tidy_move_legacy_ca_bundle / tidy_revocation_queue / tidy_cross_cluster_revoked_certs / tidy_acme"
+	return "tidy_cert_store / tidy_revoked_certs / tidy_revoked_cert_issuer_associations / tidy_expired_issuers / tidy_move_legacy_ca_bundle / tidy_acme / tidy_cross_cluster_revoked_certs / tidy_revocation_queue / tidy_cert_metadata / tidy_cmpv2_nonce_store"
+}
+
+func (tc *tidyConfig) CalculateStartupBackoff(mountStartup time.Time) time.Time {
+	minBackoff := int64(tc.MinStartupBackoff.Seconds())
+	maxBackoff := int64(tc.MaxStartupBackoff.Seconds())
+
+	maxNumber := maxBackoff - minBackoff
+	if maxNumber <= 0 {
+		return mountStartup.Add(tc.MinStartupBackoff)
+	}
+
+	backoffSecs := rand.Int64N(maxNumber) + minBackoff
+	return mountStartup.Add(time.Duration(backoffSecs) * time.Second)
 }
 
 var defaultTidyConfig = tidyConfig{
 	Enabled:                 false,
 	Interval:                12 * time.Hour,
+	MinStartupBackoff:       5 * time.Minute,
+	MaxStartupBackoff:       15 * time.Minute,
 	CertStore:               false,
 	RevokedCerts:            false,
 	IssuerAssocs:            false,
@@ -125,6 +153,181 @@ var defaultTidyConfig = tidyConfig{
 	RevocationQueue:         false,
 	QueueSafetyBuffer:       48 * time.Hour,
 	CrossRevokedCerts:       false,
+	CertMetadata:            false,
+	CMPV2NonceStore:         false,
+}
+
+var tidyStatusResponseFields = map[string]*framework.FieldSchema{
+	"safety_buffer": {
+		Type:        framework.TypeInt,
+		Description: `Safety buffer time duration`,
+		Required:    true,
+	},
+	"issuer_safety_buffer": {
+		Type:        framework.TypeInt,
+		Description: `Issuer safety buffer`,
+		Required:    true,
+	},
+	"revocation_queue_safety_buffer": {
+		Type:        framework.TypeInt,
+		Description: `Revocation queue safety buffer`,
+		Required:    true,
+	},
+	"acme_account_safety_buffer": {
+		Type:        framework.TypeInt,
+		Description: `Safety buffer after creation after which accounts lacking orders are revoked`,
+		Required:    false,
+	},
+	"tidy_cert_store": {
+		Type:        framework.TypeBool,
+		Description: `Tidy certificate store`,
+		Required:    true,
+	},
+	"tidy_revoked_certs": {
+		Type:        framework.TypeBool,
+		Description: `Tidy revoked certificates`,
+		Required:    true,
+	},
+	"tidy_revoked_cert_issuer_associations": {
+		Type:        framework.TypeBool,
+		Description: `Tidy revoked certificate issuer associations`,
+		Required:    true,
+	},
+	"tidy_expired_issuers": {
+		Type:        framework.TypeBool,
+		Description: `Tidy expired issuers`,
+		Required:    true,
+	},
+	"tidy_cross_cluster_revoked_certs": {
+		Type:        framework.TypeBool,
+		Description: `Tidy the cross-cluster revoked certificate store`,
+		Required:    false,
+	},
+	"tidy_acme": {
+		Type:        framework.TypeBool,
+		Description: `Tidy Unused Acme Accounts, and Orders`,
+		Required:    true,
+	},
+	"tidy_cert_metadata": {
+		Type:        framework.TypeBool,
+		Description: `Tidy cert metadata`,
+		Required:    true,
+	},
+	"tidy_cmpv2_nonce_store": {
+		Type:        framework.TypeBool,
+		Description: `Tidy CMPv2 nonce store`,
+		Required:    true,
+	},
+	"pause_duration": {
+		Type:        framework.TypeString,
+		Description: `Duration to pause between tidying certificates`,
+		Required:    true,
+	},
+	"state": {
+		Type:        framework.TypeString,
+		Description: `One of Inactive, Running, Finished, or Error`,
+		Required:    true,
+	},
+	"error": {
+		Type:        framework.TypeString,
+		Description: `The error message`,
+		Required:    true,
+	},
+	"time_started": {
+		Type:        framework.TypeString,
+		Description: `Time the operation started`,
+		Required:    true,
+	},
+	"time_finished": {
+		Type:        framework.TypeString,
+		Description: `Time the operation finished`,
+		Required:    false,
+	},
+	"last_auto_tidy_finished": {
+		Type:        framework.TypeString,
+		Description: `Time the last auto-tidy operation finished`,
+		Required:    true,
+	},
+	"message": {
+		Type:        framework.TypeString,
+		Description: `Message of the operation`,
+		Required:    true,
+	},
+	"cert_store_deleted_count": {
+		Type:        framework.TypeInt,
+		Description: `The number of certificate storage entries deleted`,
+		Required:    true,
+	},
+	"revoked_cert_deleted_count": {
+		Type:        framework.TypeInt,
+		Description: `The number of revoked certificate entries deleted`,
+		Required:    true,
+	},
+	"current_cert_store_count": {
+		Type:        framework.TypeInt,
+		Description: `The number of revoked certificate entries deleted`,
+		Required:    true,
+	},
+	"cross_revoked_cert_deleted_count": {
+		Type:        framework.TypeInt,
+		Description: ``,
+		Required:    true,
+	},
+	"current_revoked_cert_count": {
+		Type:        framework.TypeInt,
+		Description: `The number of revoked certificate entries deleted`,
+		Required:    true,
+	},
+	"revocation_queue_deleted_count": {
+		Type:     framework.TypeInt,
+		Required: true,
+	},
+	"tidy_move_legacy_ca_bundle": {
+		Type:     framework.TypeBool,
+		Required: true,
+	},
+	"tidy_revocation_queue": {
+		Type:     framework.TypeBool,
+		Required: true,
+	},
+	"missing_issuer_cert_count": {
+		Type:     framework.TypeInt,
+		Required: true,
+	},
+	"internal_backend_uuid": {
+		Type:     framework.TypeString,
+		Required: true,
+	},
+	"total_acme_account_count": {
+		Type:        framework.TypeInt,
+		Description: `Total number of acme accounts iterated over`,
+		Required:    false,
+	},
+	"acme_account_deleted_count": {
+		Type:        framework.TypeInt,
+		Description: `The number of revoked acme accounts removed`,
+		Required:    false,
+	},
+	"acme_account_revoked_count": {
+		Type:        framework.TypeInt,
+		Description: `The number of unused acme accounts revoked`,
+		Required:    false,
+	},
+	"acme_orders_deleted_count": {
+		Type:        framework.TypeInt,
+		Description: `The number of expired, unused acme orders removed`,
+		Required:    false,
+	},
+	"cert_metadata_deleted_count": {
+		Type:        framework.TypeInt,
+		Description: `The number of metadata entries removed`,
+		Required:    false,
+	},
+	"cmpv2_nonce_deleted_count": {
+		Type:        framework.TypeInt,
+		Description: `The number of CMPv2 nonces removed`,
+		Required:    false,
+	},
 }
 
 func pathTidy(b *backend) *framework.Path {
@@ -170,157 +373,7 @@ func pathTidyCancel(b *backend) *framework.Path {
 				Responses: map[int][]framework.Response{
 					http.StatusOK: {{
 						Description: "OK",
-						Fields: map[string]*framework.FieldSchema{
-							"safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Safety buffer time duration`,
-								Required:    false,
-							},
-							"issuer_safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Issuer safety buffer`,
-								Required:    false,
-							},
-							"revocation_queue_safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Revocation queue safety buffer`,
-								Required:    true,
-							},
-							"tidy_cert_store": {
-								Type:        framework.TypeBool,
-								Description: `Tidy certificate store`,
-								Required:    false,
-							},
-							"tidy_revoked_certs": {
-								Type:        framework.TypeBool,
-								Description: `Tidy revoked certificates`,
-								Required:    false,
-							},
-							"tidy_revoked_cert_issuer_associations": {
-								Type:        framework.TypeBool,
-								Description: `Tidy revoked certificate issuer associations`,
-								Required:    false,
-							},
-							"tidy_acme": {
-								Type:        framework.TypeBool,
-								Description: `Tidy Unused Acme Accounts, and Orders`,
-								Required:    false,
-							},
-							"acme_account_safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Safety buffer after creation after which accounts lacking orders are revoked`,
-								Required:    false,
-							},
-							"tidy_expired_issuers": {
-								Type:        framework.TypeBool,
-								Description: `Tidy expired issuers`,
-								Required:    false,
-							},
-							"pause_duration": {
-								Type:        framework.TypeString,
-								Description: `Duration to pause between tidying certificates`,
-								Required:    false,
-							},
-							"state": {
-								Type:        framework.TypeString,
-								Description: `One of Inactive, Running, Finished, or Error`,
-								Required:    false,
-							},
-							"error": {
-								Type:        framework.TypeString,
-								Description: `The error message`,
-								Required:    false,
-							},
-							"time_started": {
-								Type:        framework.TypeString,
-								Description: `Time the operation started`,
-								Required:    false,
-							},
-							"time_finished": {
-								Type:        framework.TypeString,
-								Description: `Time the operation finished`,
-								Required:    false,
-							},
-							"last_auto_tidy_finished": {
-								Type:        framework.TypeString,
-								Description: `Time the last auto-tidy operation finished`,
-								Required:    true,
-							},
-							"message": {
-								Type:        framework.TypeString,
-								Description: `Message of the operation`,
-								Required:    false,
-							},
-							"cert_store_deleted_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of certificate storage entries deleted`,
-								Required:    false,
-							},
-							"revoked_cert_deleted_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of revoked certificate entries deleted`,
-								Required:    false,
-							},
-							"current_cert_store_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of revoked certificate entries deleted`,
-								Required:    false,
-							},
-							"current_revoked_cert_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of revoked certificate entries deleted`,
-								Required:    false,
-							},
-							"missing_issuer_cert_count": {
-								Type:     framework.TypeInt,
-								Required: false,
-							},
-							"tidy_move_legacy_ca_bundle": {
-								Type:     framework.TypeBool,
-								Required: false,
-							},
-							"tidy_cross_cluster_revoked_certs": {
-								Type:        framework.TypeBool,
-								Description: `Tidy the cross-cluster revoked certificate store`,
-								Required:    false,
-							},
-							"tidy_revocation_queue": {
-								Type:     framework.TypeBool,
-								Required: false,
-							},
-							"revocation_queue_deleted_count": {
-								Type:     framework.TypeInt,
-								Required: false,
-							},
-							"cross_revoked_cert_deleted_count": {
-								Type:     framework.TypeInt,
-								Required: false,
-							},
-							"internal_backend_uuid": {
-								Type:     framework.TypeString,
-								Required: false,
-							},
-							"total_acme_account_count": {
-								Type:        framework.TypeInt,
-								Description: `Total number of acme accounts iterated over`,
-								Required:    false,
-							},
-							"acme_account_deleted_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of revoked acme accounts removed`,
-								Required:    false,
-							},
-							"acme_account_revoked_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of unused acme accounts revoked`,
-								Required:    false,
-							},
-							"acme_orders_deleted_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of expired, unused acme orders removed`,
-								Required:    false,
-							},
-						},
+						Fields:      tidyStatusResponseFields,
 					}},
 				},
 				ForwardPerformanceStandby: true,
@@ -347,158 +400,7 @@ func pathTidyStatus(b *backend) *framework.Path {
 				Responses: map[int][]framework.Response{
 					http.StatusOK: {{
 						Description: "OK",
-						Fields: map[string]*framework.FieldSchema{
-							"safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Safety buffer time duration`,
-								Required:    true,
-							},
-							"issuer_safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Issuer safety buffer`,
-								Required:    true,
-							},
-							"revocation_queue_safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Revocation queue safety buffer`,
-								Required:    true,
-							},
-							"acme_account_safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Safety buffer after creation after which accounts lacking orders are revoked`,
-								Required:    false,
-							},
-							"tidy_cert_store": {
-								Type:        framework.TypeBool,
-								Description: `Tidy certificate store`,
-								Required:    true,
-							},
-							"tidy_revoked_certs": {
-								Type:        framework.TypeBool,
-								Description: `Tidy revoked certificates`,
-								Required:    true,
-							},
-							"tidy_revoked_cert_issuer_associations": {
-								Type:        framework.TypeBool,
-								Description: `Tidy revoked certificate issuer associations`,
-								Required:    true,
-							},
-							"tidy_expired_issuers": {
-								Type:        framework.TypeBool,
-								Description: `Tidy expired issuers`,
-								Required:    true,
-							},
-							"tidy_cross_cluster_revoked_certs": {
-								Type:        framework.TypeBool,
-								Description: `Tidy the cross-cluster revoked certificate store`,
-								Required:    false,
-							},
-							"tidy_acme": {
-								Type:        framework.TypeBool,
-								Description: `Tidy Unused Acme Accounts, and Orders`,
-								Required:    true,
-							},
-							"pause_duration": {
-								Type:        framework.TypeString,
-								Description: `Duration to pause between tidying certificates`,
-								Required:    true,
-							},
-							"state": {
-								Type:        framework.TypeString,
-								Description: `One of Inactive, Running, Finished, or Error`,
-								Required:    true,
-							},
-							"error": {
-								Type:        framework.TypeString,
-								Description: `The error message`,
-								Required:    true,
-							},
-							"time_started": {
-								Type:        framework.TypeString,
-								Description: `Time the operation started`,
-								Required:    true,
-							},
-							"time_finished": {
-								Type:        framework.TypeString,
-								Description: `Time the operation finished`,
-								Required:    false,
-							},
-							"last_auto_tidy_finished": {
-								Type:        framework.TypeString,
-								Description: `Time the last auto-tidy operation finished`,
-								Required:    true,
-							},
-							"message": {
-								Type:        framework.TypeString,
-								Description: `Message of the operation`,
-								Required:    true,
-							},
-							"cert_store_deleted_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of certificate storage entries deleted`,
-								Required:    true,
-							},
-							"revoked_cert_deleted_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of revoked certificate entries deleted`,
-								Required:    true,
-							},
-							"current_cert_store_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of revoked certificate entries deleted`,
-								Required:    true,
-							},
-							"cross_revoked_cert_deleted_count": {
-								Type:        framework.TypeInt,
-								Description: ``,
-								Required:    true,
-							},
-							"current_revoked_cert_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of revoked certificate entries deleted`,
-								Required:    true,
-							},
-							"revocation_queue_deleted_count": {
-								Type:     framework.TypeInt,
-								Required: true,
-							},
-							"tidy_move_legacy_ca_bundle": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-							"tidy_revocation_queue": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-							"missing_issuer_cert_count": {
-								Type:     framework.TypeInt,
-								Required: true,
-							},
-							"internal_backend_uuid": {
-								Type:     framework.TypeString,
-								Required: true,
-							},
-							"total_acme_account_count": {
-								Type:        framework.TypeInt,
-								Description: `Total number of acme accounts iterated over`,
-								Required:    false,
-							},
-							"acme_account_deleted_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of revoked acme accounts removed`,
-								Required:    false,
-							},
-							"acme_account_revoked_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of unused acme accounts revoked`,
-								Required:    false,
-							},
-							"acme_orders_deleted_count": {
-								Type:        framework.TypeInt,
-								Description: `The number of expired, unused acme orders removed`,
-								Required:    false,
-							},
-						},
+						Fields:      tidyStatusResponseFields,
 					}},
 				},
 				ForwardPerformanceStandby: true,
@@ -510,6 +412,108 @@ func pathTidyStatus(b *backend) *framework.Path {
 }
 
 func pathConfigAutoTidy(b *backend) *framework.Path {
+	autoTidyResponseFields := map[string]*framework.FieldSchema{
+		"enabled": {
+			Type:        framework.TypeBool,
+			Description: `Specifies whether automatic tidy is enabled or not`,
+			Required:    true,
+		},
+		"min_startup_backoff_duration": {
+			Type:        framework.TypeInt,
+			Description: `The minimum amount of time in seconds auto-tidy will be delayed after startup`,
+			Required:    true,
+		},
+		"max_startup_backoff_duration": {
+			Type:        framework.TypeInt,
+			Description: `The maximum amount of time in seconds auto-tidy will be delayed after startup`,
+			Required:    true,
+		},
+		"interval_duration": {
+			Type:        framework.TypeInt,
+			Description: `Specifies the duration between automatic tidy operation`,
+			Required:    true,
+		},
+		"tidy_cert_store": {
+			Type:        framework.TypeBool,
+			Description: `Specifies whether to tidy up the certificate store`,
+			Required:    true,
+		},
+		"tidy_revoked_certs": {
+			Type:        framework.TypeBool,
+			Description: `Specifies whether to remove all invalid and expired certificates from storage`,
+			Required:    true,
+		},
+		"tidy_revoked_cert_issuer_associations": {
+			Type:        framework.TypeBool,
+			Description: `Specifies whether to associate revoked certificates with their corresponding issuers`,
+			Required:    true,
+		},
+		"tidy_expired_issuers": {
+			Type:        framework.TypeBool,
+			Description: `Specifies whether tidy expired issuers`,
+			Required:    true,
+		},
+		"tidy_acme": {
+			Type:        framework.TypeBool,
+			Description: `Tidy Unused Acme Accounts, and Orders`,
+			Required:    true,
+		},
+		"tidy_cert_metadata": {
+			Type:        framework.TypeBool,
+			Description: `Tidy cert metadata`,
+			Required:    true,
+		},
+		"tidy_cmpv2_nonce_store": {
+			Type:        framework.TypeBool,
+			Description: `Tidy CMPv2 nonce store`,
+			Required:    true,
+		},
+		"safety_buffer": {
+			Type:        framework.TypeInt,
+			Description: `Safety buffer time duration`,
+			Required:    true,
+		},
+		"issuer_safety_buffer": {
+			Type:        framework.TypeInt,
+			Description: `Issuer safety buffer`,
+			Required:    true,
+		},
+		"acme_account_safety_buffer": {
+			Type:        framework.TypeInt,
+			Description: `Safety buffer after creation after which accounts lacking orders are revoked`,
+			Required:    true,
+		},
+		"pause_duration": {
+			Type:        framework.TypeString,
+			Description: `Duration to pause between tidying certificates`,
+			Required:    true,
+		},
+		"tidy_cross_cluster_revoked_certs": {
+			Type:        framework.TypeBool,
+			Description: `Tidy the cross-cluster revoked certificate store`,
+			Required:    true,
+		},
+		"tidy_revocation_queue": {
+			Type:     framework.TypeBool,
+			Required: true,
+		},
+		"tidy_move_legacy_ca_bundle": {
+			Type:     framework.TypeBool,
+			Required: true,
+		},
+		"revocation_queue_safety_buffer": {
+			Type:     framework.TypeInt,
+			Required: true,
+		},
+		"publish_stored_certificate_count_metrics": {
+			Type:     framework.TypeBool,
+			Required: true,
+		},
+		"maintain_stored_certificate_counts": {
+			Type:     framework.TypeBool,
+			Required: true,
+		},
+	}
 	return &framework.Path{
 		Pattern: "config/auto-tidy",
 		DisplayAttrs: &framework.DisplayAttributes{
@@ -520,6 +524,16 @@ func pathConfigAutoTidy(b *backend) *framework.Path {
 				Type:        framework.TypeBool,
 				Description: `Set to true to enable automatic tidy operations.`,
 			},
+			"min_startup_backoff_duration": {
+				Type:        framework.TypeDurationSecond,
+				Description: `The minimum amount of time in seconds auto-tidy will be delayed after startup.`,
+				Default:     int(defaultTidyConfig.MinStartupBackoff.Seconds()),
+			},
+			"max_startup_backoff_duration": {
+				Type:        framework.TypeDurationSecond,
+				Description: `The maximum amount of time in seconds auto-tidy will be delayed after startup.`,
+				Default:     int(defaultTidyConfig.MaxStartupBackoff.Seconds()),
+			},
 			"interval_duration": {
 				Type:        framework.TypeDurationSecond,
 				Description: `Interval at which to run an auto-tidy operation. This is the time between tidy invocations (after one finishes to the start of the next). Running a manual tidy will reset this duration.`,
@@ -550,87 +564,7 @@ available on the tidy-status endpoint.`,
 				Responses: map[int][]framework.Response{
 					http.StatusOK: {{
 						Description: "OK",
-						Fields: map[string]*framework.FieldSchema{
-							"enabled": {
-								Type:        framework.TypeBool,
-								Description: `Specifies whether automatic tidy is enabled or not`,
-								Required:    true,
-							},
-							"interval_duration": {
-								Type:        framework.TypeInt,
-								Description: `Specifies the duration between automatic tidy operation`,
-								Required:    true,
-							},
-							"tidy_cert_store": {
-								Type:        framework.TypeBool,
-								Description: `Specifies whether to tidy up the certificate store`,
-								Required:    true,
-							},
-							"tidy_revoked_certs": {
-								Type:        framework.TypeBool,
-								Description: `Specifies whether to remove all invalid and expired certificates from storage`,
-								Required:    true,
-							},
-							"tidy_revoked_cert_issuer_associations": {
-								Type:        framework.TypeBool,
-								Description: `Specifies whether to associate revoked certificates with their corresponding issuers`,
-								Required:    true,
-							},
-							"tidy_expired_issuers": {
-								Type:        framework.TypeBool,
-								Description: `Specifies whether tidy expired issuers`,
-								Required:    true,
-							},
-							"tidy_acme": {
-								Type:        framework.TypeBool,
-								Description: `Tidy Unused Acme Accounts, and Orders`,
-								Required:    true,
-							},
-							"safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Safety buffer time duration`,
-								Required:    true,
-							},
-							"issuer_safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Issuer safety buffer`,
-								Required:    true,
-							},
-							"acme_account_safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Safety buffer after creation after which accounts lacking orders are revoked`,
-								Required:    false,
-							},
-							"pause_duration": {
-								Type:        framework.TypeString,
-								Description: `Duration to pause between tidying certificates`,
-								Required:    true,
-							},
-							"tidy_move_legacy_ca_bundle": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-							"tidy_cross_cluster_revoked_certs": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-							"tidy_revocation_queue": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-							"revocation_queue_safety_buffer": {
-								Type:     framework.TypeInt,
-								Required: true,
-							},
-							"publish_stored_certificate_count_metrics": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-							"maintain_stored_certificate_counts": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-						},
+						Fields:      autoTidyResponseFields,
 					}},
 				},
 			},
@@ -643,88 +577,7 @@ available on the tidy-status endpoint.`,
 				Responses: map[int][]framework.Response{
 					http.StatusOK: {{
 						Description: "OK",
-						Fields: map[string]*framework.FieldSchema{
-							"enabled": {
-								Type:        framework.TypeBool,
-								Description: `Specifies whether automatic tidy is enabled or not`,
-								Required:    true,
-							},
-							"interval_duration": {
-								Type:        framework.TypeInt,
-								Description: `Specifies the duration between automatic tidy operation`,
-								Required:    true,
-							},
-							"tidy_cert_store": {
-								Type:        framework.TypeBool,
-								Description: `Specifies whether to tidy up the certificate store`,
-								Required:    true,
-							},
-							"tidy_revoked_certs": {
-								Type:        framework.TypeBool,
-								Description: `Specifies whether to remove all invalid and expired certificates from storage`,
-								Required:    true,
-							},
-							"tidy_revoked_cert_issuer_associations": {
-								Type:        framework.TypeBool,
-								Description: `Specifies whether to associate revoked certificates with their corresponding issuers`,
-								Required:    true,
-							},
-							"tidy_expired_issuers": {
-								Type:        framework.TypeBool,
-								Description: `Specifies whether tidy expired issuers`,
-								Required:    true,
-							},
-							"tidy_acme": {
-								Type:        framework.TypeBool,
-								Description: `Tidy Unused Acme Accounts, and Orders`,
-								Required:    true,
-							},
-							"safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Safety buffer time duration`,
-								Required:    true,
-							},
-							"issuer_safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Issuer safety buffer`,
-								Required:    true,
-							},
-							"acme_account_safety_buffer": {
-								Type:        framework.TypeInt,
-								Description: `Safety buffer after creation after which accounts lacking orders are revoked`,
-								Required:    true,
-							},
-							"pause_duration": {
-								Type:        framework.TypeString,
-								Description: `Duration to pause between tidying certificates`,
-								Required:    true,
-							},
-							"tidy_cross_cluster_revoked_certs": {
-								Type:        framework.TypeBool,
-								Description: `Tidy the cross-cluster revoked certificate store`,
-								Required:    true,
-							},
-							"tidy_revocation_queue": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-							"tidy_move_legacy_ca_bundle": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-							"revocation_queue_safety_buffer": {
-								Type:     framework.TypeInt,
-								Required: true,
-							},
-							"publish_stored_certificate_count_metrics": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-							"maintain_stored_certificate_counts": {
-								Type:     framework.TypeBool,
-								Required: true,
-							},
-						},
+						Fields:      autoTidyResponseFields,
 					}},
 				},
 				// Read more about why these flags are set in backend.go.
@@ -752,6 +605,8 @@ func (b *backend) pathTidyWrite(ctx context.Context, req *logical.Request, d *fr
 	tidyCrossRevokedCerts := d.Get("tidy_cross_cluster_revoked_certs").(bool)
 	tidyAcme := d.Get("tidy_acme").(bool)
 	acmeAccountSafetyBuffer := d.Get("acme_account_safety_buffer").(int)
+	tidyCertMetadata := d.Get("tidy_cert_metadata").(bool)
+	tidyCMPV2NonceStore := d.Get("tidy_cmpv2_nonce_store").(bool)
 
 	if safetyBuffer < 1 {
 		return logical.ErrorResponse("safety_buffer must be greater than zero"), nil
@@ -781,6 +636,10 @@ func (b *backend) pathTidyWrite(ctx context.Context, req *logical.Request, d *fr
 		}
 	}
 
+	if tidyCertMetadata && !constants.IsEnterprise {
+		return logical.ErrorResponse("certificate metadata is only supported on Vault Enterprise"), nil
+	}
+
 	bufferDuration := time.Duration(safetyBuffer) * time.Second
 	issuerBufferDuration := time.Duration(issuerSafetyBuffer) * time.Second
 	queueSafetyBufferDuration := time.Duration(queueSafetyBuffer) * time.Second
@@ -803,6 +662,8 @@ func (b *backend) pathTidyWrite(ctx context.Context, req *logical.Request, d *fr
 		CrossRevokedCerts:       tidyCrossRevokedCerts,
 		TidyAcme:                tidyAcme,
 		AcmeAccountSafetyBuffer: acmeAccountSafetyBufferDuration,
+		CertMetadata:            tidyCertMetadata,
+		CMPV2NonceStore:         tidyCMPV2NonceStore,
 	}
 
 	if !atomic.CompareAndSwapUint32(b.tidyCASGuard, 0, 1) {
@@ -817,16 +678,20 @@ func (b *backend) pathTidyWrite(ctx context.Context, req *logical.Request, d *fr
 		Storage: req.Storage,
 	}
 
+	resp := &logical.Response{}
 	// Mark the last tidy operation as relatively recent, to ensure we don't
 	// try to trigger the periodic function.
-	b.tidyStatusLock.Lock()
-	b.lastTidy = time.Now()
-	b.tidyStatusLock.Unlock()
+	// NOTE: not sure this is correct as we are updating the auto tidy time with this manual run. Ideally we
+	//       could track when we ran each type of tidy was last run which would allow manual runs and auto
+	//       runs to properly impact each other.
+	sc := b.makeStorageContext(ctx, req.Storage)
+	if err := b.updateLastAutoTidyTime(sc, time.Now()); err != nil {
+		resp.AddWarning(fmt.Sprintf("failed persisting tidy last run time: %v", err))
+	}
 
 	// Kick off the actual tidy.
 	b.startTidyOperation(req, config)
 
-	resp := &logical.Response{}
 	if !config.IsAnyTidyEnabled() {
 		resp.AddWarning("Manual tidy requested but no tidy operations were set. Enable at least one tidy operation to be run (" + config.AnyTidyConfig() + ").")
 	} else {
@@ -841,6 +706,14 @@ func (b *backend) pathTidyWrite(ctx context.Context, req *logical.Request, d *fr
 		}
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKITidy,
+		observe.NewAdditionalPKIMetadata("tidy_cert_store", tidyCertStore),
+		observe.NewAdditionalPKIMetadata("tidy_revoked_certs", tidyRevokedCerts),
+		observe.NewAdditionalPKIMetadata("tidy_revoked_cert_issuer_associations", tidyRevokedAssocs),
+		observe.NewAdditionalPKIMetadata("tidy_expired_issuers", tidyExpiredIssuers),
+		observe.NewAdditionalPKIMetadata("tidy_backup_bundle", tidyBackupBundle),
+	)
+
 	return logical.RespondWithStatusCode(resp, req, http.StatusAccepted)
 }
 
@@ -929,6 +802,28 @@ func (b *backend) startTidyOperation(req *logical.Request, config *tidyConfig) {
 				}
 			}
 
+			// Check for cancel before continuing.
+			if atomic.CompareAndSwapUint32(b.tidyCancelCAS, 1, 0) {
+				return tidyCancelledError
+			}
+
+			if config.CertMetadata {
+				if err := b.doTidyCertMetadata(ctx, req, logger, config); err != nil {
+					return err
+				}
+			}
+
+			// Check for cancel before continuing.
+			if atomic.CompareAndSwapUint32(b.tidyCancelCAS, 1, 0) {
+				return tidyCancelledError
+			}
+
+			if config.CMPV2NonceStore {
+				if err := b.doTidyCMPV2NonceStore(ctx, req.Storage); err != nil {
+					return err
+				}
+			}
+
 			return nil
 		}
 
@@ -941,15 +836,16 @@ func (b *backend) startTidyOperation(req *logical.Request, config *tidyConfig) {
 			// Since the tidy operation finished without an error, we don't
 			// really want to start another tidy right away (if the interval
 			// is too short). So mark the last tidy as now.
-			b.tidyStatusLock.Lock()
-			b.lastTidy = time.Now()
-			b.tidyStatusLock.Unlock()
+			sc := b.makeStorageContext(ctx, req.Storage)
+			if err := b.updateLastAutoTidyTime(sc, time.Now()); err != nil {
+				logger.Error("error persisting last tidy run time", "error", err)
+			}
 		}
 	}()
 }
 
 func (b *backend) doTidyCertStore(ctx context.Context, req *logical.Request, logger hclog.Logger, config *tidyConfig) error {
-	serials, err := req.Storage.List(ctx, "certs/")
+	serials, err := req.Storage.List(ctx, issuing.PathCerts)
 	if err != nil {
 		return fmt.Errorf("error fetching list of certs: %w", err)
 	}
@@ -970,14 +866,14 @@ func (b *backend) doTidyCertStore(ctx context.Context, req *logical.Request, log
 			time.Sleep(config.PauseDuration)
 		}
 
-		certEntry, err := req.Storage.Get(ctx, "certs/"+serial)
+		certEntry, err := req.Storage.Get(ctx, issuing.PathCerts+serial)
 		if err != nil {
 			return fmt.Errorf("error fetching certificate %q: %w", serial, err)
 		}
 
 		if certEntry == nil {
 			logger.Warn("certificate entry is nil; tidying up since it is no longer useful for any server operations", "serial", serial)
-			if err := req.Storage.Delete(ctx, "certs/"+serial); err != nil {
+			if err := req.Storage.Delete(ctx, issuing.PathCerts+serial); err != nil {
 				return fmt.Errorf("error deleting nil entry with serial %s: %w", serial, err)
 			}
 			b.tidyStatusIncCertStoreCount()
@@ -986,7 +882,7 @@ func (b *backend) doTidyCertStore(ctx context.Context, req *logical.Request, log
 
 		if certEntry.Value == nil || len(certEntry.Value) == 0 {
 			logger.Warn("certificate entry has no value; tidying up since it is no longer useful for any server operations", "serial", serial)
-			if err := req.Storage.Delete(ctx, "certs/"+serial); err != nil {
+			if err := req.Storage.Delete(ctx, issuing.PathCerts+serial); err != nil {
 				return fmt.Errorf("error deleting entry with nil value with serial %s: %w", serial, err)
 			}
 			b.tidyStatusIncCertStoreCount()
@@ -999,7 +895,7 @@ func (b *backend) doTidyCertStore(ctx context.Context, req *logical.Request, log
 		}
 
 		if time.Since(cert.NotAfter) > config.SafetyBuffer {
-			if err := req.Storage.Delete(ctx, "certs/"+serial); err != nil {
+			if err := req.Storage.Delete(ctx, issuing.PathCerts+serial); err != nil {
 				return fmt.Errorf("error deleting serial %q from storage: %w", serial, err)
 			}
 			b.tidyStatusIncCertStoreCount()
@@ -1019,7 +915,7 @@ func (b *backend) doTidyRevocationStore(ctx context.Context, req *logical.Reques
 
 	// Fetch and parse our issuers so we can associate them if necessary.
 	sc := b.makeStorageContext(ctx, req.Storage)
-	issuerIDCertMap, err := fetchIssuerMapForRevocationChecking(sc)
+	issuerIDCertMap, err := revocation.FetchIssuerMapForRevocationChecking(sc)
 	if err != nil {
 		return err
 	}
@@ -1036,7 +932,7 @@ func (b *backend) doTidyRevocationStore(ctx context.Context, req *logical.Reques
 
 	fixedIssuers := 0
 
-	var revInfo revocationInfo
+	var revInfo revocation.RevocationInfo
 	for i, serial := range revokedSerials {
 		b.tidyStatusMessage(fmt.Sprintf("Tidying revoked certificates: checking certificate %d of %d", i, len(revokedSerials)))
 		metrics.SetGauge([]string{"secrets", "pki", "tidy", "revoked_cert_current_entry"}, float32(i))
@@ -1095,7 +991,7 @@ func (b *backend) doTidyRevocationStore(ctx context.Context, req *logical.Reques
 				b.tidyStatusIncMissingIssuerCertCount()
 				revInfo.CertificateIssuer = issuing.IssuerID("")
 				storeCert = true
-				if associateRevokedCertWithIsssuer(&revInfo, revokedCert, issuerIDCertMap) {
+				if revInfo.AssociateRevokedCertWithIsssuer(revokedCert, issuerIDCertMap) {
 					fixedIssuers += 1
 				}
 			}
@@ -1110,7 +1006,7 @@ func (b *backend) doTidyRevocationStore(ctx context.Context, req *logical.Reques
 				if err := req.Storage.Delete(ctx, "revoked/"+serial); err != nil {
 					return fmt.Errorf("error deleting serial %q from revoked list: %w", serial, err)
 				}
-				if err := req.Storage.Delete(ctx, "certs/"+serial); err != nil {
+				if err := req.Storage.Delete(ctx, issuing.PathCerts+serial); err != nil {
 					return fmt.Errorf("error deleting serial %q from store when tidying revoked: %w", serial, err)
 				}
 				rebuildCRL = true
@@ -1151,7 +1047,7 @@ func (b *backend) doTidyRevocationStore(ctx context.Context, req *logical.Reques
 		}
 
 		if !config.AutoRebuild {
-			warnings, err := b.CrlBuilder().rebuild(sc, false)
+			warnings, err := b.CrlBuilder().Rebuild(sc, false)
 			if err != nil {
 				return err
 			}
@@ -1190,7 +1086,7 @@ func (b *backend) doTidyExpiredIssuers(ctx context.Context, req *logical.Request
 
 	// Fetch and parse our issuers so we have their expiration date.
 	sc := b.makeStorageContext(ctx, req.Storage)
-	issuerIDCertMap, err := fetchIssuerMapForRevocationChecking(sc)
+	issuerIDCertMap, err := revocation.FetchIssuerMapForRevocationChecking(sc)
 	if err != nil {
 		return err
 	}
@@ -1263,7 +1159,7 @@ func (b *backend) doTidyExpiredIssuers(ctx context.Context, req *logical.Request
 		b.GetRevokeStorageLock().Lock()
 		defer b.GetRevokeStorageLock().Unlock()
 
-		warnings, err := b.CrlBuilder().rebuild(sc, false)
+		warnings, err := b.CrlBuilder().Rebuild(sc, false)
 		if err != nil {
 			return err
 		}
@@ -1512,7 +1408,7 @@ func (b *backend) doTidyCrossRevocationStore(ctx context.Context, req *logical.R
 				continue
 			}
 
-			var details unifiedRevocationEntry
+			var details revocation.UnifiedRevocationEntry
 			if err := entry.DecodeJSON(&details); err != nil {
 				return fmt.Errorf("error decoding cross-cluster revocation entry (%v) to tidy: %w", ePath, err)
 			}
@@ -1646,6 +1542,8 @@ func (b *backend) pathTidyStatusRead(_ context.Context, _ *logical.Request, _ *f
 			"tidy_revocation_queue":                 nil,
 			"tidy_cross_cluster_revoked_certs":      nil,
 			"tidy_acme":                             nil,
+			"tidy_cert_metadata":                    nil,
+			"tidy_cmpv2_nonce_store":                nil,
 			"pause_duration":                        nil,
 			"state":                                 "Inactive",
 			"error":                                 nil,
@@ -1665,6 +1563,9 @@ func (b *backend) pathTidyStatusRead(_ context.Context, _ *logical.Request, _ *f
 			"acme_account_revoked_count":            nil,
 			"acme_orders_deleted_count":             nil,
 			"acme_account_safety_buffer":            nil,
+			"cert_metadata_deleted_count":           nil,
+			"cmpv2_nonce_deleted_count":             nil,
+			"last_auto_tidy_finished":               b.getLastAutoTidyTimeWithoutLock(), // we acquired the tidyStatusLock above.
 		},
 	}
 
@@ -1698,6 +1599,8 @@ func (b *backend) pathTidyStatusRead(_ context.Context, _ *logical.Request, _ *f
 	resp.Data["tidy_revocation_queue"] = b.tidyStatus.tidyRevocationQueue
 	resp.Data["tidy_cross_cluster_revoked_certs"] = b.tidyStatus.tidyCrossRevokedCerts
 	resp.Data["tidy_acme"] = b.tidyStatus.tidyAcme
+	resp.Data["tidy_cert_metadata"] = b.tidyStatus.tidyCertMetadata
+	resp.Data["tidy_cmpv2_nonce_store"] = b.tidyStatus.tidyCMPV2NonceStore
 	resp.Data["pause_duration"] = b.tidyStatus.pauseDuration
 	resp.Data["time_started"] = b.tidyStatus.timeStarted
 	resp.Data["message"] = b.tidyStatus.message
@@ -1707,14 +1610,17 @@ func (b *backend) pathTidyStatusRead(_ context.Context, _ *logical.Request, _ *f
 	resp.Data["revocation_queue_deleted_count"] = b.tidyStatus.revQueueDeletedCount
 	resp.Data["cross_revoked_cert_deleted_count"] = b.tidyStatus.crossRevokedDeletedCount
 	resp.Data["revocation_queue_safety_buffer"] = b.tidyStatus.revQueueSafetyBuffer
-	resp.Data["last_auto_tidy_finished"] = b.lastTidy
 	resp.Data["total_acme_account_count"] = b.tidyStatus.acmeAccountsCount
 	resp.Data["acme_account_deleted_count"] = b.tidyStatus.acmeAccountsDeletedCount
 	resp.Data["acme_account_revoked_count"] = b.tidyStatus.acmeAccountsRevokedCount
 	resp.Data["acme_orders_deleted_count"] = b.tidyStatus.acmeOrdersDeletedCount
 	resp.Data["acme_account_safety_buffer"] = b.tidyStatus.acmeAccountSafetyBuffer
+	resp.Data["cert_metadata_deleted_count"] = b.tidyStatus.certMetadataDeletedCount
+	resp.Data["cmpv2_nonce_deleted_count"] = b.tidyStatus.cmpv2NonceDeletedCount
 
 	switch b.tidyStatus.state {
+	case tidyStatusInactive:
+		resp.Data["state"] = "Inactive"
 	case tidyStatusStarted:
 		resp.Data["state"] = "Running"
 	case tidyStatusFinished:
@@ -1756,8 +1662,44 @@ func (b *backend) pathConfigAutoTidyWrite(ctx context.Context, req *logical.Requ
 		return nil, err
 	}
 
+	isAutoTidyBeingEnabled := false
+
 	if enabledRaw, ok := d.GetOk("enabled"); ok {
-		config.Enabled = enabledRaw.(bool)
+		enabled, err := parseutil.ParseBool(enabledRaw)
+		if err != nil {
+			return logical.ErrorResponse(fmt.Sprintf("failed to parse enabled flag as a boolean: %s", err.Error())), nil
+		}
+		if !config.Enabled && enabled {
+			// we are turning on auto-tidy reset our persisted time to now
+			isAutoTidyBeingEnabled = true
+		}
+		config.Enabled = enabled
+	}
+
+	if minStartupBackoffRaw, ok := d.GetOk("min_startup_backoff_duration"); ok {
+		minDuration, err := parseutil.ParseDurationSecond(minStartupBackoffRaw)
+		if err != nil {
+			return logical.ErrorResponse(fmt.Sprintf("failed to parse min_startup_backoff_duration flag as a duration: %s", err.Error())), nil
+		}
+		if minDuration.Seconds() < 1 {
+			return logical.ErrorResponse(fmt.Sprintf("min_startup_backoff_duration must be at least 1 second: parsed: %v", minDuration)), nil
+		}
+		config.MinStartupBackoff = minDuration
+	}
+
+	if maxStartupBackoffRaw, ok := d.GetOk("max_startup_backoff_duration"); ok {
+		maxDuration, err := parseutil.ParseDurationSecond(maxStartupBackoffRaw)
+		if err != nil {
+			return logical.ErrorResponse(fmt.Sprintf("failed to parse max_startup_backoff_duration flag as a duration: %s", err.Error())), nil
+		}
+		if maxDuration.Seconds() < 1 {
+			return logical.ErrorResponse(fmt.Sprintf("max_startup_backoff_duration must be at least 1 second: parsed: %v", maxDuration)), nil
+		}
+		config.MaxStartupBackoff = maxDuration
+	}
+
+	if config.MinStartupBackoff > config.MaxStartupBackoff {
+		return logical.ErrorResponse(fmt.Sprintf("max_startup_backoff_duration %v must be greater or equal to min_startup_backoff_duration %v", config.MaxStartupBackoff, config.MinStartupBackoff)), nil
 	}
 
 	if intervalRaw, ok := d.GetOk("interval_duration"); ok {
@@ -1838,6 +1780,21 @@ func (b *backend) pathConfigAutoTidyWrite(ctx context.Context, req *logical.Requ
 		}
 	}
 
+	if tidyCertMetadataRaw, ok := d.GetOk("tidy_cert_metadata"); ok {
+		config.CertMetadata = tidyCertMetadataRaw.(bool)
+
+		if config.CertMetadata && !constants.IsEnterprise {
+			return logical.ErrorResponse("certificate metadata is only supported on Vault Enterprise"), nil
+		}
+	}
+
+	if tidyCmpv2NonceStoreRaw, ok := d.GetOk("tidy_cmpv2_nonce_store"); ok {
+		config.CMPV2NonceStore = tidyCmpv2NonceStoreRaw.(bool)
+		if config.CMPV2NonceStore && !constants.IsEnterprise {
+			return logical.ErrorResponse("CMPv2 is only supported on Vault Enterprise"), nil
+		}
+	}
+
 	if config.Enabled && !config.IsAnyTidyEnabled() {
 		return logical.ErrorResponse("Auto-tidy enabled but no tidy operations were requested. Enable at least one tidy operation to be run (" + config.AnyTidyConfig() + ")."), nil
 	}
@@ -1858,6 +1815,13 @@ func (b *backend) pathConfigAutoTidyWrite(ctx context.Context, req *logical.Requ
 		return nil, err
 	}
 
+	if isAutoTidyBeingEnabled {
+		if err := b.updateLastAutoTidyTime(sc, time.Now()); err != nil {
+			b.Logger().Warn("failed to update last auto tidy run time to now, the first auto-tidy "+
+				"might run soon and not at the next delay provided", "error", err.Error())
+		}
+	}
+
 	return &logical.Response{
 		Data: getTidyConfigData(*config),
 	}, nil
@@ -1880,6 +1844,8 @@ func (b *backend) tidyStatusStart(config *tidyConfig) {
 		tidyRevocationQueue:     config.RevocationQueue,
 		tidyCrossRevokedCerts:   config.CrossRevokedCerts,
 		tidyAcme:                config.TidyAcme,
+		tidyCertMetadata:        config.CertMetadata,
+		tidyCMPV2NonceStore:     config.CMPV2NonceStore,
 		pauseDuration:           config.PauseDuration.String(),
 
 		state:       tidyStatusStarted,
@@ -1897,7 +1863,7 @@ func (b *backend) tidyStatusStop(err error) {
 	b.tidyStatus.err = err
 	if err == nil {
 		b.tidyStatus.state = tidyStatusFinished
-	} else if err == tidyCancelledError {
+	} else if errors.Is(err, tidyCancelledError) {
 		b.tidyStatus.state = tidyStatusCancelled
 	} else {
 		b.tidyStatus.state = tidyStatusError
@@ -1982,6 +1948,44 @@ func (b *backend) tidyStatusIncDelAcmeOrderCount() {
 	b.tidyStatus.acmeOrdersDeletedCount++
 }
 
+func (b *backend) tidyStatusIncCertMetadataCount() {
+	b.tidyStatusLock.Lock()
+	defer b.tidyStatusLock.Unlock()
+
+	b.tidyStatus.certMetadataDeletedCount++
+}
+
+func (b *backend) tidyStatusIncCMPV2NonceDeletedCount() {
+	b.tidyStatusLock.Lock()
+	defer b.tidyStatusLock.Unlock()
+
+	b.tidyStatus.cmpv2NonceDeletedCount++
+}
+
+// updateLastAutoTidyTime should be used to update b.lastAutoTidy as the required locks
+// are acquired and the auto tidy time is persisted to storage to work across restarts
+func (b *backend) updateLastAutoTidyTime(sc *storageContext, lastRunTime time.Time) error {
+	b.tidyStatusLock.Lock()
+	defer b.tidyStatusLock.Unlock()
+
+	b.lastAutoTidy = lastRunTime
+	return sc.writeAutoTidyLastRun(lastRunTime)
+}
+
+// getLastAutoTidyTime should be used to read from b.lastAutoTidy as the required locks
+// are acquired prior to reading
+func (b *backend) getLastAutoTidyTime() time.Time {
+	b.tidyStatusLock.RLock()
+	defer b.tidyStatusLock.RUnlock()
+	return b.getLastAutoTidyTimeWithoutLock()
+}
+
+// getLastAutoTidyTimeWithoutLock should be used to read from b.lastAutoTidy with the
+// b.tidyStatusLock being acquired, normally use getLastAutoTidyTime
+func (b *backend) getLastAutoTidyTimeWithoutLock() time.Time {
+	return b.lastAutoTidy
+}
+
 const pathTidyHelpSyn = `
 Tidy up the backend by removing expired certificates, revocation information,
 or both.
@@ -2078,6 +2082,8 @@ func getTidyConfigData(config tidyConfig) map[string]interface{} {
 		// This map is in the same order as tidyConfig to ensure that all fields are accounted for
 		"enabled":                                  config.Enabled,
 		"interval_duration":                        int(config.Interval / time.Second),
+		"min_startup_backoff_duration":             int(config.MinStartupBackoff.Seconds()),
+		"max_startup_backoff_duration":             int(config.MaxStartupBackoff.Seconds()),
 		"tidy_cert_store":                          config.CertStore,
 		"tidy_revoked_certs":                       config.RevokedCerts,
 		"tidy_revoked_cert_issuer_associations":    config.IssuerAssocs,
@@ -2093,5 +2099,7 @@ func getTidyConfigData(config tidyConfig) map[string]interface{} {
 		"tidy_revocation_queue":                    config.RevocationQueue,
 		"revocation_queue_safety_buffer":           int(config.QueueSafetyBuffer / time.Second),
 		"tidy_cross_cluster_revoked_certs":         config.CrossRevokedCerts,
+		"tidy_cert_metadata":                       config.CertMetadata,
+		"tidy_cmpv2_nonce_store":                   config.CMPV2NonceStore,
 	}
 }
diff --git a/builtin/logical/pki/path_tidy_test.go b/builtin/logical/pki/path_tidy_test.go
index 46c9b5a89cd..488889d4bfe 100644
--- a/builtin/logical/pki/path_tidy_test.go
+++ b/builtin/logical/pki/path_tidy_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -8,7 +8,6 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
@@ -23,6 +22,7 @@ import (
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/helper/testhelpers"
 	vaulthttp "github.com/hashicorp/vault/http"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/testhelpers/schema"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -39,9 +39,13 @@ func TestTidyConfigs(t *testing.T) {
 	require.Greater(t, len(operations), 1, "expected more than one operation")
 	t.Logf("Got tidy operations: %v", operations)
 
-	lastOp := operations[len(operations)-1]
+	lastOp := "tidy_acme"
 
 	for _, operation := range operations {
+		if operation == "tidy_cmpv2_nonce_store" || operation == "tidy_cert_metadata" {
+			// Skip, since these require ENT
+			continue
+		}
 		b, s := CreateBackendWithStorage(t)
 
 		resp, err := CBWrite(b, s, "config/auto-tidy", map[string]interface{}{
@@ -236,11 +240,13 @@ func TestAutoTidy(t *testing.T) {
 
 	// Write the auto-tidy config.
 	_, err = client.Logical().Write("pki/config/auto-tidy", map[string]interface{}{
-		"enabled":            true,
-		"interval_duration":  "1s",
-		"tidy_cert_store":    true,
-		"tidy_revoked_certs": true,
-		"safety_buffer":      "1s",
+		"enabled":                      true,
+		"interval_duration":            "1s",
+		"tidy_cert_store":              true,
+		"tidy_revoked_certs":           true,
+		"safety_buffer":                "1s",
+		"min_startup_backoff_duration": "1s",
+		"max_startup_backoff_duration": "1s",
 	})
 	require.NoError(t, err)
 
@@ -299,41 +305,9 @@ func TestAutoTidy(t *testing.T) {
 	// Wait for cert to expire and the safety buffer to elapse.
 	time.Sleep(time.Until(leafCert.NotAfter) + 3*time.Second)
 
-	// Wait for auto-tidy to run afterwards.
-	var foundTidyRunning string
-	var foundTidyFinished bool
-	timeoutChan := time.After(120 * time.Second)
-	for {
-		if foundTidyRunning != "" && foundTidyFinished {
-			break
-		}
-
-		select {
-		case <-timeoutChan:
-			t.Fatalf("expected auto-tidy to run (%v) and finish (%v) before 120 seconds elapsed", foundTidyRunning, foundTidyFinished)
-		default:
-			time.Sleep(250 * time.Millisecond)
-
-			resp, err = client.Logical().Read("pki/tidy-status")
-			require.NoError(t, err)
-			require.NotNil(t, resp)
-			require.NotNil(t, resp.Data)
-			require.NotEmpty(t, resp.Data["state"])
-			require.NotEmpty(t, resp.Data["time_started"])
-			state := resp.Data["state"].(string)
-			started := resp.Data["time_started"].(string)
-			t.Logf("Resp: %v", resp.Data)
-
-			// We want the _next_ tidy run after the cert expires. This
-			// means if we're currently finished when we hit this the
-			// first time, we want to wait for the next run.
-			if foundTidyRunning == "" {
-				foundTidyRunning = started
-			} else if foundTidyRunning != started && !foundTidyFinished && state == "Finished" {
-				foundTidyFinished = true
-			}
-		}
-	}
+	// We run this twice to make absolutely sure we didn't read a previous run of tidy
+	_, lastRun := waitForTidyToFinish(t, client, "pki")
+	waitForTidyToFinishWithLastRun(t, client, "pki", lastRun)
 
 	// Cert should no longer exist.
 	resp, err = client.Logical().Read("pki/cert/" + leafSerial)
@@ -341,6 +315,67 @@ func TestAutoTidy(t *testing.T) {
 	require.Nil(t, resp)
 }
 
+// TestAutoTidyPersistsAcrossRestarts validates that on initial
+// startup of a mount we persisted the current auto tidy time so that
+// our counter that auto-tidy is based on isn't reset everytime Vault restarts
+func TestAutoTidyPersistsAcrossRestarts(t *testing.T) {
+	t.Parallel()
+
+	newPeriod := 1 * time.Second
+
+	// This test requires the periodicFunc to trigger, which requires we stand
+	// up a full test cluster.
+	coreConfig := &vault.CoreConfig{
+		LogicalBackends: map[string]logical.Factory{
+			"pki": Factory,
+		},
+		RollbackPeriod: newPeriod,
+	}
+	opts := &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+		NumCores:    1,
+	}
+	cluster := vault.NewTestCluster(t, coreConfig, opts)
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	client := cluster.Cores[0].Client
+
+	// Mount PKI
+	err := client.Sys().Mount("pki", &api.MountInput{
+		Type: "pki",
+	})
+	require.NoError(t, err, "failed mounting pki")
+
+	// Run a tidy that should set us up
+	_, err = client.Logical().Write("pki/tidy", map[string]interface{}{
+		"tidy_cert_store": "true",
+	})
+	require.NoError(t, err, "failed running tidy")
+
+	waitForTidyToFinish(t, client, "pki")
+
+	resp, err := client.Logical().Read("pki/tidy-status")
+	require.NoError(t, err, "failed reading tidy status")
+	require.NotNil(t, resp, "response from tidy-status was nil")
+	lastAutoTidy, exists := resp.Data["last_auto_tidy_finished"]
+	require.True(t, exists, "did not find last_auto_tidy_finished")
+
+	cluster.StopCore(t, 0)
+	cluster.StartCore(t, 0, opts)
+	cluster.UnsealCore(t, cluster.Cores[0])
+	vault.TestWaitActive(t, cluster.Cores[0].Core)
+
+	client = cluster.Cores[0].Client
+	resp, err = client.Logical().Read("pki/tidy-status")
+	require.NoError(t, err, "failed reading tidy status")
+	require.NotNil(t, resp, "response from tidy-status was nil")
+	postRestartLastAutoTidy, exists := resp.Data["last_auto_tidy_finished"]
+	require.True(t, exists, "did not find last_auto_tidy_finished")
+
+	require.Equal(t, lastAutoTidy, postRestartLastAutoTidy, "values for last_auto_tidy_finished did not match on restart")
+}
+
 func TestTidyCancellation(t *testing.T) {
 	t.Parallel()
 
@@ -553,6 +588,8 @@ func TestTidyIssuerConfig(t *testing.T) {
 	defaultConfigMap["pause_duration"] = time.Duration(defaultConfigMap["pause_duration"].(float64)).String()
 	defaultConfigMap["revocation_queue_safety_buffer"] = int(time.Duration(defaultConfigMap["revocation_queue_safety_buffer"].(float64)) / time.Second)
 	defaultConfigMap["acme_account_safety_buffer"] = int(time.Duration(defaultConfigMap["acme_account_safety_buffer"].(float64)) / time.Second)
+	defaultConfigMap["min_startup_backoff_duration"] = int(time.Duration(defaultConfigMap["min_startup_backoff_duration"].(float64)) / time.Second)
+	defaultConfigMap["max_startup_backoff_duration"] = int(time.Duration(defaultConfigMap["max_startup_backoff_duration"].(float64)) / time.Second)
 
 	require.Equal(t, defaultConfigMap, resp.Data)
 
@@ -647,9 +684,8 @@ func TestCertStorageMetrics(t *testing.T) {
 
 	// Since certificate counts are off by default, we shouldn't see counts in the tidy status
 	tidyStatus, err := client.Logical().Read("pki/tidy-status")
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err, "failed reading from tidy-status")
+
 	// backendUUID should exist, we need this for metrics
 	backendUUID := tidyStatus.Data["internal_backend_uuid"].(string)
 	// "current_cert_store_count", "current_revoked_cert_count"
@@ -683,6 +719,8 @@ func TestCertStorageMetrics(t *testing.T) {
 		"safety_buffer":                            "1s",
 		"maintain_stored_certificate_counts":       true,
 		"publish_stored_certificate_count_metrics": false,
+		"min_startup_backoff_duration":             "1s",
+		"max_startup_backoff_duration":             "1s",
 	})
 	require.NoError(t, err)
 
@@ -692,16 +730,7 @@ func TestCertStorageMetrics(t *testing.T) {
 	testhelpers.EnsureCoresUnsealed(t, cluster)
 
 	// Wait until a tidy run has completed.
-	testhelpers.RetryUntil(t, 5*time.Second, func() error {
-		resp, err = client.Logical().Read("pki/tidy-status")
-		if err != nil {
-			return fmt.Errorf("error reading tidy status: %w", err)
-		}
-		if finished, ok := resp.Data["time_finished"]; !ok || finished == "" || finished == nil {
-			return fmt.Errorf("tidy time_finished not run yet: %v", finished)
-		}
-		return nil
-	})
+	tidyStatus, _ = waitForTidyToFinish(t, client, "pki")
 
 	// Since publish_stored_certificate_count_metrics is still false, these metrics should still not exist yet
 	stableMetric = inmemSink.Data()
@@ -716,9 +745,6 @@ func TestCertStorageMetrics(t *testing.T) {
 	}
 
 	// But since certificate counting is on, the metrics should exist on tidyStatus endpoint:
-	tidyStatus, err = client.Logical().Read("pki/tidy-status")
-	require.NoError(t, err, "failed reading tidy-status endpoint")
-
 	// backendUUID should exist, we need this for metrics
 	backendUUID = tidyStatus.Data["internal_backend_uuid"].(string)
 	// "current_cert_store_count", "current_revoked_cert_count"
@@ -838,49 +864,11 @@ func TestCertStorageMetrics(t *testing.T) {
 	t.Logf("%v: Sleeping for %v, leaf certificate expires: %v", time.Now().Format(time.RFC3339), sleepFor, leafCert.NotAfter)
 	time.Sleep(sleepFor)
 
-	// Wait for auto-tidy to run afterwards.
-	var foundTidyRunning string
-	var foundTidyFinished bool
-	timeoutChan := time.After(120 * time.Second)
-	for {
-		if foundTidyRunning != "" && foundTidyFinished {
-			break
-		}
-
-		select {
-		case <-timeoutChan:
-			t.Fatalf("expected auto-tidy to run (%v) and finish (%v) before 120 seconds elapsed", foundTidyRunning, foundTidyFinished)
-		default:
-			time.Sleep(250 * time.Millisecond)
-
-			resp, err = client.Logical().Read("pki/tidy-status")
-			require.NoError(t, err)
-			require.NotNil(t, resp)
-			require.NotNil(t, resp.Data)
-			require.NotEmpty(t, resp.Data["state"])
-			require.NotEmpty(t, resp.Data["time_started"])
-			state := resp.Data["state"].(string)
-			started := resp.Data["time_started"].(string)
-
-			t.Logf("%v: Resp: %v", time.Now().Format(time.RFC3339), resp.Data)
-
-			// We want the _next_ tidy run after the cert expires. This
-			// means if we're currently finished when we hit this the
-			// first time, we want to wait for the next run.
-			if foundTidyRunning == "" {
-				foundTidyRunning = started
-			} else if foundTidyRunning != started && !foundTidyFinished && state == "Finished" {
-				foundTidyFinished = true
-			}
-		}
-	}
+	_, lastRun := waitForTidyToFinish(t, client, "pki")
+	tidyStatus, _ = waitForTidyToFinishWithLastRun(t, client, "pki", lastRun)
 
 	// After Tidy, Cert Store Count Should Still Be Available, and Be Updated:
 	// Check Metrics After Cert Has Be Created and Revoked
-	tidyStatus, err = client.Logical().Read("pki/tidy-status")
-	if err != nil {
-		t.Fatal(err)
-	}
 	backendUUID = tidyStatus.Data["internal_backend_uuid"].(string)
 	// "current_cert_store_count", "current_revoked_cert_count"
 	certStoreCount, ok = tidyStatus.Data["current_cert_store_count"]
@@ -932,7 +920,7 @@ func TestTidyAcmeWithBackdate(t *testing.T) {
 
 	// Register an Account, do nothing with it
 	baseAcmeURL := "/v1/pki/acme/"
-	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa key")
 
 	acmeClient := getAcmeClientForCluster(t, cluster, baseAcmeURL, accountKey)
@@ -940,8 +928,8 @@ func TestTidyAcmeWithBackdate(t *testing.T) {
 	// Create new account with order/cert
 	t.Logf("Testing register on %s", baseAcmeURL)
 	acct, err := acmeClient.Register(testCtx, &acme.Account{}, func(tosURL string) bool { return true })
-	t.Logf("got account URI: %v", acct.URI)
 	require.NoError(t, err, "failed registering account")
+	t.Logf("got account URI: %v", acct.URI)
 	identifiers := []string{"*.localdomain"}
 	order, err := acmeClient.AuthorizeOrder(testCtx, []acme.AuthzID{
 		{Type: "dns", Value: identifiers[0]},
@@ -1005,7 +993,7 @@ func TestTidyAcmeWithBackdate(t *testing.T) {
 	require.NoError(t, err)
 
 	// Wait for tidy to finish.
-	tidyResp := waitForTidyToFinish(t, client, "pki")
+	tidyResp, _ := waitForTidyToFinish(t, client, "pki")
 
 	require.Equal(t, tidyResp.Data["acme_orders_deleted_count"], json.Number("1"),
 		"expected to revoke a single ACME order: %v", tidyResp)
@@ -1033,7 +1021,7 @@ func TestTidyAcmeWithBackdate(t *testing.T) {
 	require.NoError(t, err)
 
 	// Wait for tidy to finish.
-	tidyResp = waitForTidyToFinish(t, client, "pki")
+	tidyResp, _ = waitForTidyToFinish(t, client, "pki")
 	require.Equal(t, tidyResp.Data["acme_orders_deleted_count"], json.Number("0"),
 		"no ACME orders should have been deleted: %v", tidyResp)
 	require.Equal(t, tidyResp.Data["acme_account_revoked_count"], json.Number("1"),
@@ -1089,7 +1077,7 @@ func TestTidyAcmeWithSafetyBuffer(t *testing.T) {
 
 	// Register an Account, do nothing with it
 	baseAcmeURL := "/v1/pki/acme/"
-	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa key")
 
 	acmeClient := getAcmeClientForCluster(t, cluster, baseAcmeURL, accountKey)
@@ -1097,8 +1085,8 @@ func TestTidyAcmeWithSafetyBuffer(t *testing.T) {
 	// Create new account
 	t.Logf("Testing register on %s", baseAcmeURL)
 	acct, err := acmeClient.Register(testCtx, &acme.Account{}, func(tosURL string) bool { return true })
-	t.Logf("got account URI: %v", acct.URI)
 	require.NoError(t, err, "failed registering account")
+	t.Logf("got account URI: %v", acct.URI)
 
 	// -> Ensure we see it in storage. Since we don't have direct storage
 	// access, use sys/raw interface.
@@ -1120,7 +1108,7 @@ func TestTidyAcmeWithSafetyBuffer(t *testing.T) {
 	require.NoError(t, err)
 
 	// Wait for tidy to finish.
-	statusResp := waitForTidyToFinish(t, client, "pki")
+	statusResp, _ := waitForTidyToFinish(t, client, "pki")
 	require.Equal(t, statusResp.Data["acme_account_revoked_count"], json.Number("1"), "expected to revoke a single ACME account")
 
 	// Wait for the account to expire.
@@ -1292,18 +1280,40 @@ func backDate(original time.Time, change time.Duration) time.Time {
 	return original.Add(-change)
 }
 
-func waitForTidyToFinish(t *testing.T, client *api.Client, mount string) *api.Secret {
+func waitForTidyToFinish(t *testing.T, client *api.Client, mount string) (*api.Secret, time.Time) {
+	return waitForTidyToFinishWithLastRun(t, client, mount, time.Time{})
+}
+
+func waitForTidyToFinishWithLastRun(t *testing.T, client *api.Client, mount string, previousFinishTime time.Time) (*api.Secret, time.Time) {
+	t.Helper()
+
 	var statusResp *api.Secret
-	testhelpers.RetryUntil(t, 5*time.Second, func() error {
+	var currentFinishTime time.Time
+	testhelpers.RetryUntil(t, 30*time.Second, func() error {
 		var err error
-
 		tidyStatusPath := mount + "/tidy-status"
 		statusResp, err = client.Logical().Read(tidyStatusPath)
 		if err != nil {
 			return fmt.Errorf("failed reading path: %s: %w", tidyStatusPath, err)
 		}
-		if state, ok := statusResp.Data["state"]; !ok || state == "Running" {
-			return fmt.Errorf("tidy status state is still running")
+		if statusResp == nil {
+			return fmt.Errorf("got nil, nil response from: %s", tidyStatusPath)
+		}
+		if state, ok := statusResp.Data["state"]; !ok || state != "Finished" {
+			return fmt.Errorf("tidy has not finished got state: %v", state)
+		}
+
+		if currentFinishTimeRaw, ok := statusResp.Data["time_finished"]; !ok {
+			return fmt.Errorf("tidy status did not contain a time_finished field")
+		} else {
+			if currentFinishTimeStr, ok := currentFinishTimeRaw.(string); !ok {
+				return fmt.Errorf("tidy status time_finished field was not a string was %T", currentFinishTimeRaw)
+			} else {
+				currentFinishTime, err = time.Parse(time.RFC3339, currentFinishTimeStr)
+				if !currentFinishTime.After(previousFinishTime) {
+					return fmt.Errorf("tidy status time_finished %v was not after previous time %v", currentFinishTime, previousFinishTime)
+				}
+			}
 		}
 
 		if errorOccurred, ok := statusResp.Data["error"]; !ok || !(errorOccurred == nil || errorOccurred == "") {
@@ -1314,5 +1324,5 @@ func waitForTidyToFinish(t *testing.T, client *api.Client, mount string) *api.Se
 	})
 
 	t.Logf("got tidy status: %v", statusResp.Data)
-	return statusResp
+	return statusResp, currentFinishTime
 }
diff --git a/builtin/logical/pki/periodic.go b/builtin/logical/pki/periodic.go
index b5c6209b145..e516c762b18 100644
--- a/builtin/logical/pki/periodic.go
+++ b/builtin/logical/pki/periodic.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -10,6 +10,7 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -36,19 +37,18 @@ func newUnifiedTransferStatus() *UnifiedTransferStatus {
 // send all missing local revocation entries to the unified space if the feature
 // is enabled.
 func runUnifiedTransfer(sc *storageContext) {
-	b := sc.Backend
-	status := b.GetUnifiedTransferStatus()
+	status := sc.GetUnifiedTransferStatus()
 
-	isPerfStandby := b.System().ReplicationState().HasState(consts.ReplicationDRSecondary | consts.ReplicationPerformanceStandby)
+	isPerfStandby := sc.System().ReplicationState().HasState(consts.ReplicationDRSecondary | consts.ReplicationPerformanceStandby)
 
-	if isPerfStandby || b.System().LocalMount() {
+	if isPerfStandby || sc.System().LocalMount() {
 		// We only do this on active enterprise nodes, when we aren't a local mount
 		return
 	}
 
-	config, err := b.CrlBuilder().getConfigWithUpdate(sc)
+	config, err := sc.CrlBuilder().GetConfigWithUpdate(sc)
 	if err != nil {
-		b.Logger().Error("failed to retrieve crl config from storage for unified transfer background process",
+		sc.Logger().Error("failed to retrieve crl config from storage for unified transfer background process",
 			"error", err)
 		return
 	}
@@ -58,15 +58,15 @@ func runUnifiedTransfer(sc *storageContext) {
 		return
 	}
 
-	clusterId, err := b.System().ClusterID(sc.Context)
+	clusterId, err := sc.System().ClusterID(sc.Context)
 	if err != nil {
-		b.Logger().Error("failed to fetch cluster id for unified transfer background process",
+		sc.Logger().Error("failed to fetch cluster id for unified transfer background process",
 			"error", err)
 		return
 	}
 
 	if !status.isRunning.CompareAndSwap(false, true) {
-		b.Logger().Debug("an existing unified transfer process is already running")
+		sc.Logger().Debug("an existing unified transfer process is already running")
 		return
 	}
 	defer status.isRunning.Store(false)
@@ -91,13 +91,13 @@ func runUnifiedTransfer(sc *storageContext) {
 
 	err = doUnifiedTransferMissingLocalSerials(sc, clusterId)
 	if err != nil {
-		b.Logger().Error("an error occurred running unified transfer", "error", err.Error())
+		sc.Logger().Error("an error occurred running unified transfer", "error", err.Error())
 		status.forceRerun.Store(true)
 	} else {
 		if config.EnableDelta {
 			err = doUnifiedTransferMissingDeltaWALSerials(sc, clusterId)
 			if err != nil {
-				b.Logger().Error("an error occurred running unified transfer", "error", err.Error())
+				sc.Logger().Error("an error occurred running unified transfer", "error", err.Error())
 				status.forceRerun.Store(true)
 			}
 		}
@@ -125,7 +125,7 @@ func doUnifiedTransferMissingLocalSerials(sc *storageContext, clusterId string)
 	errCount := 0
 	for i, serialNum := range localRevokedSerialNums {
 		if i%25 == 0 {
-			config, _ := sc.Backend.CrlBuilder().getConfigWithUpdate(sc)
+			config, _ := sc.CrlBuilder().GetConfigWithUpdate(sc)
 			if config != nil && !config.UnifiedCRL {
 				return errors.New("unified crl has been disabled after we started, stopping")
 			}
@@ -134,14 +134,14 @@ func doUnifiedTransferMissingLocalSerials(sc *storageContext, clusterId string)
 			err := readRevocationEntryAndTransfer(sc, serialNum)
 			if err != nil {
 				errCount++
-				sc.Backend.Logger().Error("Failed transferring local revocation to unified space",
+				sc.Logger().Error("Failed transferring local revocation to unified space",
 					"serial", serialNum, "error", err)
 			}
 		}
 	}
 
 	if errCount > 0 {
-		sc.Backend.Logger().Warn(fmt.Sprintf("Failed transfering %d local serials to unified storage", errCount))
+		sc.Logger().Warn(fmt.Sprintf("Failed transfering %d local serials to unified storage", errCount))
 	}
 
 	return nil
@@ -224,7 +224,7 @@ func doUnifiedTransferMissingDeltaWALSerials(sc *storageContext, clusterId strin
 	errCount := 0
 	for index, serial := range localWALEntries {
 		if index%25 == 0 {
-			config, _ := sc.Backend.CrlBuilder().getConfigWithUpdate(sc)
+			config, _ := sc.CrlBuilder().GetConfigWithUpdate(sc)
 			if config != nil && (!config.UnifiedCRL || !config.EnableDelta) {
 				return errors.New("unified or delta CRLs have been disabled after we started, stopping")
 			}
@@ -247,7 +247,7 @@ func doUnifiedTransferMissingDeltaWALSerials(sc *storageContext, clusterId strin
 		if !isRevokedCopied {
 			// We need to wait here to copy over.
 			errCount += 1
-			sc.Backend.Logger().Debug("Delta WAL exists locally, but corresponding cross-cluster full revocation entry is missing; skipping", "serial", serial)
+			sc.Logger().Debug("Delta WAL exists locally, but corresponding cross-cluster full revocation entry is missing; skipping", "serial", serial)
 			continue
 		}
 
@@ -258,7 +258,7 @@ func doUnifiedTransferMissingDeltaWALSerials(sc *storageContext, clusterId strin
 		entry, err := sc.Storage.Get(sc.Context, localPath)
 		if err != nil || entry == nil {
 			errCount += 1
-			sc.Backend.Logger().Error("Failed reading local delta WAL entry to copy to cross-cluster", "serial", serial, "err", err)
+			sc.Logger().Error("Failed reading local delta WAL entry to copy to cross-cluster", "serial", serial, "err", err)
 			continue
 		}
 
@@ -266,14 +266,14 @@ func doUnifiedTransferMissingDeltaWALSerials(sc *storageContext, clusterId strin
 		err = sc.Storage.Put(sc.Context, entry)
 		if err != nil {
 			errCount += 1
-			sc.Backend.Logger().Error("Failed sync local delta WAL entry to cross-cluster unified delta WAL location", "serial", serial, "err", err)
+			sc.Logger().Error("Failed sync local delta WAL entry to cross-cluster unified delta WAL location", "serial", serial, "err", err)
 			continue
 		}
 	}
 
 	if errCount > 0 {
 		// See note above about why we don't fail here.
-		sc.Backend.Logger().Warn(fmt.Sprintf("Failed transfering %d local delta WAL serials to unified storage", errCount))
+		sc.Logger().Warn(fmt.Sprintf("Failed transfering %d local delta WAL serials to unified storage", errCount))
 		return nil
 	}
 
@@ -295,17 +295,17 @@ func doUnifiedTransferMissingDeltaWALSerials(sc *storageContext, clusterId strin
 
 func readRevocationEntryAndTransfer(sc *storageContext, serial string) error {
 	hyphenSerial := normalizeSerial(serial)
-	revInfo, err := sc.fetchRevocationInfo(hyphenSerial)
+	revInfo, err := fetchRevocationInfo(sc, hyphenSerial)
 	if err != nil {
 		return fmt.Errorf("failed loading revocation entry for serial: %s: %w", serial, err)
 	}
 	if revInfo == nil {
-		sc.Backend.Logger().Debug("no certificate revocation entry for serial", "serial", serial)
+		sc.Logger().Debug("no certificate revocation entry for serial", "serial", serial)
 		return nil
 	}
 	cert, err := x509.ParseCertificate(revInfo.CertificateBytes)
 	if err != nil {
-		sc.Backend.Logger().Debug("failed parsing certificate stored in revocation entry for serial",
+		sc.Logger().Debug("failed parsing certificate stored in revocation entry for serial",
 			"serial", serial, "error", err)
 		return nil
 	}
@@ -326,12 +326,12 @@ func readRevocationEntryAndTransfer(sc *storageContext, serial string) error {
 		return nil
 	}
 
-	entry := &unifiedRevocationEntry{
+	entry := &revocation.UnifiedRevocationEntry{
 		SerialNumber:      hyphenSerial,
 		CertExpiration:    cert.NotAfter,
 		RevocationTimeUTC: revocationTime,
 		CertificateIssuer: revInfo.CertificateIssuer,
 	}
 
-	return writeUnifiedRevocationEntry(sc, entry)
+	return revocation.WriteUnifiedRevocationEntry(sc.GetContext(), sc.GetStorage(), entry)
 }
diff --git a/builtin/logical/pki/pki_backend/common.go b/builtin/logical/pki/pki_backend/common.go
index b34fda07619..b7dea6b976e 100644
--- a/builtin/logical/pki/pki_backend/common.go
+++ b/builtin/logical/pki/pki_backend/common.go
@@ -1,10 +1,16 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki_backend
 
 import (
+	"context"
+	"fmt"
+	"strings"
+
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
@@ -20,7 +26,80 @@ type Logger interface {
 	Logger() log.Logger
 }
 
-type CertificateCounter interface {
-	IsInitialized() bool
-	IncrementTotalCertificatesCount(certsCounted bool, newSerial string)
+//go:generate enumer -type=RolePathPolicy -text -json -transform=kebab-case
+type RolePathPolicy int
+
+const (
+	RPPUnknown RolePathPolicy = iota
+	RPPSignVerbatim
+	RPPRole
+)
+
+var (
+	pathPolicyRolePrefix       = "role:"
+	pathPolicyRolePrefixLength = len(pathPolicyRolePrefix)
+)
+
+// GetRoleByPathOrPathPolicy loads an existing role based on if the data field data contains a 'role' parameter
+// or by the values within the pathPolicy
+func GetRoleByPathOrPathPolicy(ctx context.Context, s logical.Storage, data *framework.FieldData, pathPolicy string) (*issuing.RoleEntry, error) {
+	var role *issuing.RoleEntry
+
+	// The role name from the path is the highest priority
+	if roleName, ok := getRoleNameFromPath(data); ok {
+		var err error
+		role, err = issuing.GetRole(ctx, s, roleName)
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		policyType, policyVal, err := GetPathPolicyType(pathPolicy)
+		if err != nil {
+			return nil, err
+		}
+
+		switch policyType {
+		case RPPRole:
+			role, err = issuing.GetRole(ctx, s, policyVal)
+			if err != nil {
+				return nil, err
+			}
+		case RPPSignVerbatim:
+			role = issuing.SignVerbatimRole()
+		default:
+			return nil, fmt.Errorf("unsupported policy type returned: %s from policy path: %s", policyType, pathPolicy)
+		}
+	}
+
+	return role, nil
+}
+
+func GetPathPolicyType(pathPolicy string) (RolePathPolicy, string, error) {
+	policy := strings.TrimSpace(pathPolicy)
+
+	switch {
+	case policy == "sign-verbatim":
+		return RPPSignVerbatim, "", nil
+	case strings.HasPrefix(policy, pathPolicyRolePrefix):
+		if policy == pathPolicyRolePrefix {
+			return RPPUnknown, "", fmt.Errorf("no role specified by policy %v", pathPolicy)
+		}
+		roleName := pathPolicy[pathPolicyRolePrefixLength:]
+		return RPPRole, roleName, nil
+	default:
+		return RPPUnknown, "", fmt.Errorf("string %v was not a valid default path policy", pathPolicy)
+	}
+}
+
+func getRoleNameFromPath(data *framework.FieldData) (string, bool) {
+	// If our schema doesn't include the parameter bail
+	if _, ok := data.Schema["role"]; !ok {
+		return "", false
+	}
+
+	if roleName, ok := data.GetOk("role"); ok {
+		return roleName.(string), true
+	}
+
+	return "", false
 }
diff --git a/builtin/logical/pki/pki_backend/crl_builder.go b/builtin/logical/pki/pki_backend/crl_builder.go
new file mode 100644
index 00000000000..cae00586379
--- /dev/null
+++ b/builtin/logical/pki/pki_backend/crl_builder.go
@@ -0,0 +1,20 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package pki_backend
+
+import "time"
+
+type CrlBuilderType interface {
+	RebuildIfForced(sc StorageContext) ([]string, error)
+	Rebuild(sc StorageContext, forceNew bool) ([]string, error)
+	RebuildDeltaCRLsHoldingLock(sc StorageContext, forceNew bool) ([]string, error)
+	GetPresentLocalDeltaWALForClearing(sc StorageContext) ([]string, error)
+	GetPresentUnifiedDeltaWALForClearing(sc StorageContext) ([]string, error)
+	GetConfigWithUpdate(sc StorageContext) (*CrlConfig, error)
+	ClearLocalDeltaWAL(sc StorageContext, walSerials []string) error
+	ClearUnifiedDeltaWAL(sc StorageContext, walSerials []string) error
+
+	SetLastDeltaRebuildCheckTime(t time.Time)
+	ShouldInvalidate() bool
+}
diff --git a/builtin/logical/pki/pki_backend/crl_config.go b/builtin/logical/pki/pki_backend/crl_config.go
new file mode 100644
index 00000000000..6795283c9d4
--- /dev/null
+++ b/builtin/logical/pki/pki_backend/crl_config.go
@@ -0,0 +1,40 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package pki_backend
+
+const latestCrlConfigVersion = 1
+
+// CRLConfig holds basic CRL configuration information
+type CrlConfig struct {
+	Version                   int    `json:"version"`
+	Expiry                    string `json:"expiry"`
+	Disable                   bool   `json:"disable"`
+	OcspDisable               bool   `json:"ocsp_disable"`
+	AutoRebuild               bool   `json:"auto_rebuild"`
+	AutoRebuildGracePeriod    string `json:"auto_rebuild_grace_period"`
+	OcspExpiry                string `json:"ocsp_expiry"`
+	EnableDelta               bool   `json:"enable_delta"`
+	DeltaRebuildInterval      string `json:"delta_rebuild_interval"`
+	UseGlobalQueue            bool   `json:"cross_cluster_revocation"`
+	UnifiedCRL                bool   `json:"unified_crl"`
+	UnifiedCRLOnExistingPaths bool   `json:"unified_crl_on_existing_paths"`
+	MaxCRLEntries             int    `json:"max_crl_entries"`
+}
+
+// Implicit default values for the config if it does not exist.
+var DefaultCrlConfig = CrlConfig{
+	Version:                   latestCrlConfigVersion,
+	Expiry:                    "72h",
+	Disable:                   false,
+	OcspDisable:               false,
+	OcspExpiry:                "12h",
+	AutoRebuild:               false,
+	AutoRebuildGracePeriod:    "12h",
+	EnableDelta:               false,
+	DeltaRebuildInterval:      "15m",
+	UseGlobalQueue:            false,
+	UnifiedCRL:                false,
+	UnifiedCRLOnExistingPaths: false,
+	MaxCRLEntries:             100000,
+}
diff --git a/builtin/logical/pki/pki_backend/rolepathpolicy_enumer.go b/builtin/logical/pki/pki_backend/rolepathpolicy_enumer.go
new file mode 100644
index 00000000000..305e34a6b54
--- /dev/null
+++ b/builtin/logical/pki/pki_backend/rolepathpolicy_enumer.go
@@ -0,0 +1,80 @@
+// Code generated by "enumer -type=RolePathPolicy -text -json -transform=kebab-case"; DO NOT EDIT.
+
+package pki_backend
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+const _RolePathPolicyName = "RPPUnknownRPPSignVerbatimRPPRole"
+
+var _RolePathPolicyIndex = [...]uint8{0, 10, 25, 32}
+
+func (i RolePathPolicy) String() string {
+	if i < 0 || i >= RolePathPolicy(len(_RolePathPolicyIndex)-1) {
+		return fmt.Sprintf("RolePathPolicy(%d)", i)
+	}
+	return _RolePathPolicyName[_RolePathPolicyIndex[i]:_RolePathPolicyIndex[i+1]]
+}
+
+var _RolePathPolicyValues = []RolePathPolicy{0, 1, 2}
+
+var _RolePathPolicyNameToValueMap = map[string]RolePathPolicy{
+	_RolePathPolicyName[0:10]:  0,
+	_RolePathPolicyName[10:25]: 1,
+	_RolePathPolicyName[25:32]: 2,
+}
+
+// RolePathPolicyString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func RolePathPolicyString(s string) (RolePathPolicy, error) {
+	if val, ok := _RolePathPolicyNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to RolePathPolicy values", s)
+}
+
+// RolePathPolicyValues returns all values of the enum
+func RolePathPolicyValues() []RolePathPolicy {
+	return _RolePathPolicyValues
+}
+
+// IsARolePathPolicy returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i RolePathPolicy) IsARolePathPolicy() bool {
+	for _, v := range _RolePathPolicyValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
+
+// MarshalJSON implements the json.Marshaler interface for RolePathPolicy
+func (i RolePathPolicy) MarshalJSON() ([]byte, error) {
+	return json.Marshal(i.String())
+}
+
+// UnmarshalJSON implements the json.Unmarshaler interface for RolePathPolicy
+func (i *RolePathPolicy) UnmarshalJSON(data []byte) error {
+	var s string
+	if err := json.Unmarshal(data, &s); err != nil {
+		return fmt.Errorf("RolePathPolicy should be a string, got %s", data)
+	}
+
+	var err error
+	*i, err = RolePathPolicyString(s)
+	return err
+}
+
+// MarshalText implements the encoding.TextMarshaler interface for RolePathPolicy
+func (i RolePathPolicy) MarshalText() ([]byte, error) {
+	return []byte(i.String()), nil
+}
+
+// UnmarshalText implements the encoding.TextUnmarshaler interface for RolePathPolicy
+func (i *RolePathPolicy) UnmarshalText(text []byte) error {
+	var err error
+	*i, err = RolePathPolicyString(string(text))
+	return err
+}
diff --git a/builtin/logical/pki/pki_backend/storage_context.go b/builtin/logical/pki/pki_backend/storage_context.go
new file mode 100644
index 00000000000..ce8f409df5a
--- /dev/null
+++ b/builtin/logical/pki/pki_backend/storage_context.go
@@ -0,0 +1,25 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package pki_backend
+
+import (
+	"context"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/managed_key"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+type StorageContext interface {
+	GetContext() context.Context
+	GetStorage() logical.Storage
+
+	UseLegacyBundleCaStorage() bool
+	GetPkiManagedView() managed_key.PkiManagedKeyView
+	CrlBuilder() CrlBuilderType
+	GetCertificateCounter() issuing.CertificateCounter
+
+	Logger() hclog.Logger
+}
diff --git a/builtin/logical/pki/revocation/revocation_entry.go b/builtin/logical/pki/revocation/revocation_entry.go
new file mode 100644
index 00000000000..db6d0a18d69
--- /dev/null
+++ b/builtin/logical/pki/revocation/revocation_entry.go
@@ -0,0 +1,34 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package revocation
+
+import (
+	"context"
+	"time"
+
+	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/parsing"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+type UnifiedRevocationEntry struct {
+	SerialNumber      string           `json:"-"`
+	CertExpiration    time.Time        `json:"certificate_expiration_utc"`
+	RevocationTimeUTC time.Time        `json:"revocation_time_utc"`
+	CertificateIssuer issuing.IssuerID `json:"issuer_id"`
+}
+
+const (
+	UnifiedRevocationReadPathPrefix  = "unified-revocation/"
+	UnifiedRevocationWritePathPrefix = UnifiedRevocationReadPathPrefix + "{{clusterId}}/"
+)
+
+func WriteUnifiedRevocationEntry(ctx context.Context, storage logical.Storage, ure *UnifiedRevocationEntry) error {
+	json, err := logical.StorageEntryJSON(UnifiedRevocationWritePathPrefix+parsing.NormalizeSerialForStorage(ure.SerialNumber), ure)
+	if err != nil {
+		return err
+	}
+
+	return storage.Put(ctx, json)
+}
diff --git a/builtin/logical/pki/revocation/revoke.go b/builtin/logical/pki/revocation/revoke.go
new file mode 100644
index 00000000000..4ba37db05ef
--- /dev/null
+++ b/builtin/logical/pki/revocation/revoke.go
@@ -0,0 +1,100 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package revocation
+
+import (
+	"bytes"
+	"context"
+	"crypto/x509"
+	"fmt"
+	"time"
+
+	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
+	"github.com/hashicorp/vault/sdk/helper/errutil"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+const (
+	RevokedPath = "revoked/"
+)
+
+type RevokerFactory interface {
+	GetRevoker(context.Context, logical.Storage) (Revoker, error)
+}
+
+type RevokeCertInfo struct {
+	RevocationTime time.Time
+	Warnings       []string
+}
+
+type Revoker interface {
+	RevokeCert(cert *x509.Certificate) (RevokeCertInfo, error)
+	RevokeCertBySerial(serial string) (RevokeCertInfo, error)
+}
+
+type RevocationInfo struct {
+	CertificateBytes  []byte           `json:"certificate_bytes"`
+	RevocationTime    int64            `json:"revocation_time"`
+	RevocationTimeUTC time.Time        `json:"revocation_time_utc"`
+	CertificateIssuer issuing.IssuerID `json:"issuer_id"`
+}
+
+func (ri *RevocationInfo) AssociateRevokedCertWithIsssuer(revokedCert *x509.Certificate, issuerIDCertMap map[issuing.IssuerID]*x509.Certificate) bool {
+	for issuerId, issuerCert := range issuerIDCertMap {
+		if bytes.Equal(revokedCert.RawIssuer, issuerCert.RawSubject) {
+			if err := revokedCert.CheckSignatureFrom(issuerCert); err == nil {
+				// Valid mapping. Add it to the specified entry.
+				ri.CertificateIssuer = issuerId
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+// FetchIssuerMapForRevocationChecking fetches a map of IssuerID->parsed cert for revocation
+// usage. Unlike other paths, this needs to handle the legacy bundle
+// more gracefully than rejecting it outright.
+func FetchIssuerMapForRevocationChecking(sc pki_backend.StorageContext) (map[issuing.IssuerID]*x509.Certificate, error) {
+	var err error
+	var issuers []issuing.IssuerID
+
+	if !sc.UseLegacyBundleCaStorage() {
+		issuers, err = issuing.ListIssuers(sc.GetContext(), sc.GetStorage())
+		if err != nil {
+			return nil, fmt.Errorf("could not fetch issuers list: %w", err)
+		}
+	} else {
+		// Hack: this isn't a real IssuerID, but it works for fetchCAInfo
+		// since it resolves the reference.
+		issuers = []issuing.IssuerID{issuing.LegacyBundleShimID}
+	}
+
+	issuerIDCertMap := make(map[issuing.IssuerID]*x509.Certificate, len(issuers))
+	for _, issuer := range issuers {
+		_, bundle, caErr := issuing.FetchCertBundleByIssuerId(sc.GetContext(), sc.GetStorage(), issuer, false)
+		if caErr != nil {
+			return nil, fmt.Errorf("error fetching CA certificate for issuer id %v: %w", issuer, caErr)
+		}
+
+		if bundle == nil {
+			return nil, fmt.Errorf("faulty reference: %v - CA info not found", issuer)
+		}
+
+		parsedBundle, err := issuing.ParseCABundle(sc.GetContext(), sc.GetPkiManagedView(), bundle)
+		if err != nil {
+			return nil, errutil.InternalError{Err: err.Error()}
+		}
+
+		if parsedBundle.Certificate == nil {
+			return nil, errutil.InternalError{Err: "stored CA information not able to be parsed"}
+		}
+
+		issuerIDCertMap[issuer] = parsedBundle.Certificate
+	}
+
+	return issuerIDCertMap, nil
+}
diff --git a/builtin/logical/pki/secret_certs.go b/builtin/logical/pki/secret_certs.go
index 274aa55edf6..c808a6bbf9f 100644
--- a/builtin/logical/pki/secret_certs.go
+++ b/builtin/logical/pki/secret_certs.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -8,6 +8,8 @@ import (
 	"crypto/x509"
 	"fmt"
 
+	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
+	"github.com/hashicorp/vault/builtin/logical/pki/observe"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -55,7 +57,7 @@ func (b *backend) secretCredsRevoke(ctx context.Context, req *logical.Request, _
 	sc := b.makeStorageContext(ctx, req.Storage)
 	serial := serialInt.(string)
 
-	certEntry, err := fetchCertBySerial(sc, "certs/", serial)
+	certEntry, err := fetchCertBySerial(sc, issuing.PathCerts, serial)
 	if err != nil {
 		return nil, err
 	}
@@ -77,10 +79,16 @@ func (b *backend) secretCredsRevoke(ctx context.Context, req *logical.Request, _
 		return nil, nil
 	}
 
-	config, err := sc.Backend.CrlBuilder().getConfigWithUpdate(sc)
+	config, err := sc.CrlBuilder().GetConfigWithUpdate(sc)
 	if err != nil {
 		return nil, fmt.Errorf("error revoking serial: %s: failed reading config: %w", serial, err)
 	}
 
+	b.pkiObserver.RecordPKIObservation(ctx, req, observe.ObservationTypePKIRevoke,
+		observe.NewAdditionalPKIMetadata("issuer_name", cert.Issuer.String()),
+		observe.NewAdditionalPKIMetadata("is_ca", cert.IsCA),
+		observe.NewAdditionalPKIMetadata("serial_number", cert.SerialNumber.String()),
+	)
+
 	return revokeCert(sc, config, cert)
 }
diff --git a/builtin/logical/pki/storage.go b/builtin/logical/pki/storage.go
index 67a0ff1c157..b67c827ac1e 100644
--- a/builtin/logical/pki/storage.go
+++ b/builtin/logical/pki/storage.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -11,11 +11,15 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"sync"
 	"time"
 
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
 	"github.com/hashicorp/vault/builtin/logical/pki/managed_key"
+	"github.com/hashicorp/vault/builtin/logical/pki/pki_backend"
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
 	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
@@ -35,16 +39,19 @@ const (
 	legacyMigrationBundleLogKey = "config/legacyMigrationBundleLog"
 	legacyCertBundlePath        = issuing.LegacyCertBundlePath
 	legacyCertBundleBackupPath  = "config/ca_bundle.bak"
-	legacyCRLPath               = "crl"
-	deltaCRLPath                = "delta-crl"
-	deltaCRLPathSuffix          = "-delta"
-	unifiedCRLPath              = "unified-crl"
-	unifiedDeltaCRLPath         = "unified-delta-crl"
-	unifiedCRLPathPrefix        = "unified-"
+
+	legacyCRLPath        = issuing.LegacyCRLPath
+	deltaCRLPath         = issuing.DeltaCRLPath
+	deltaCRLPathSuffix   = issuing.DeltaCRLPathSuffix
+	unifiedCRLPath       = issuing.UnifiedCRLPath
+	unifiedDeltaCRLPath  = issuing.UnifiedDeltaCRLPath
+	unifiedCRLPathPrefix = issuing.UnifiedCRLPathPrefix
 
 	autoTidyConfigPath = "config/auto-tidy"
 	clusterConfigPath  = "config/cluster"
 
+	autoTidyLastRunPath = "config/auto-tidy-last-run"
+
 	maxRolesToScanOnIssuerChange = 100
 	maxRolesToFindOnIssuerChange = 10
 )
@@ -59,6 +66,8 @@ type storageContext struct {
 	Backend *backend
 }
 
+var _ pki_backend.StorageContext = (*storageContext)(nil)
+
 func (b *backend) makeStorageContext(ctx context.Context, s logical.Storage) *storageContext {
 	return &storageContext{
 		Context: ctx,
@@ -76,6 +85,50 @@ func (sc *storageContext) WithFreshTimeout(timeout time.Duration) (*storageConte
 	}, cancel
 }
 
+func (sc *storageContext) GetContext() context.Context {
+	return sc.Context
+}
+
+func (sc *storageContext) GetStorage() logical.Storage {
+	return sc.Storage
+}
+
+func (sc *storageContext) Logger() hclog.Logger {
+	return sc.Backend.Logger()
+}
+
+func (sc *storageContext) System() logical.SystemView {
+	return sc.Backend.System()
+}
+
+func (sc *storageContext) CrlBuilder() pki_backend.CrlBuilderType {
+	return sc.Backend.CrlBuilder()
+}
+
+func (sc *storageContext) GetUnifiedTransferStatus() *UnifiedTransferStatus {
+	return sc.Backend.GetUnifiedTransferStatus()
+}
+
+func (sc *storageContext) GetPkiManagedView() managed_key.PkiManagedKeyView {
+	return sc.Backend
+}
+
+func (sc *storageContext) GetCertificateCounter() issuing.CertificateCounter {
+	return sc.Backend.GetCertificateCounter()
+}
+
+func (sc *storageContext) UseLegacyBundleCaStorage() bool {
+	return sc.Backend.UseLegacyBundleCaStorage()
+}
+
+func (sc *storageContext) GetRevokeStorageLock() *sync.RWMutex {
+	return sc.Backend.GetRevokeStorageLock()
+}
+
+func (sc *storageContext) GetRole(name string) (*issuing.RoleEntry, error) {
+	return sc.Backend.GetRole(sc.Context, sc.Storage, name)
+}
+
 func (sc *storageContext) listKeys() ([]issuing.KeyID, error) {
 	return issuing.ListKeys(sc.Context, sc.Storage)
 }
@@ -268,7 +321,22 @@ func (sc *storageContext) deleteIssuer(id issuing.IssuerID) (bool, error) {
 	return issuing.DeleteIssuer(sc.Context, sc.Storage, id)
 }
 
-func (sc *storageContext) importIssuer(certValue string, issuerName string) (*issuing.IssuerEntry, bool, error) {
+// ImportedIssuerInfo is a set of information reported by importIssuer about the issuer it just imported.
+// All of this is available via the cert in the issuing.IssuerEntry certificate, but this prevents the
+// need to re-parse the cert.
+type ImportedIssuerInfo struct {
+	IssuerName         string `json:"issuer_name"`
+	IssuerId           string `json:"issuer_id"`
+	SerialNumber       string `json:"serial_number"`
+	CommonName         string `json:"common_name"`
+	SKID               []byte `json:"subject_key_id"`
+	AKID               []byte `json:"authority_key_id"`
+	NotBefore          string `json:"not_before"`
+	NotAfter           string `json:"not_after"`
+	PublicKeyAlgorithm string `json:"public_key_algorithm"`
+}
+
+func (sc *storageContext) importIssuer(certValue string, issuerName string) (*issuing.IssuerEntry, *ImportedIssuerInfo, bool, error) {
 	// importIssuers imports the specified PEM-format certificate (from
 	// certValue) into the new PKI storage format. The first return field is a
 	// reference to the new issuer; the second is whether or not the issuer
@@ -295,18 +363,18 @@ func (sc *storageContext) importIssuer(certValue string, issuerName string) (*is
 	// known keys.
 	issuerCert, err := parseCertificateFromBytes([]byte(certValue))
 	if err != nil {
-		return nil, false, err
+		return nil, nil, false, err
 	}
 
 	// Ensure this certificate is a usable as a CA certificate.
 	if !issuerCert.BasicConstraintsValid || !issuerCert.IsCA {
-		return nil, false, errutil.UserError{Err: "Refusing to import non-CA certificate"}
+		return nil, nil, false, errutil.UserError{Err: "Refusing to import non-CA certificate"}
 	}
 
 	// Ensure this certificate has a parsed public key. Otherwise, we've
 	// likely been given a bad certificate.
 	if issuerCert.PublicKeyAlgorithm == x509.UnknownPublicKeyAlgorithm || issuerCert.PublicKey == nil {
-		return nil, false, errutil.UserError{Err: "Refusing to import CA certificate with empty PublicKey. This usually means the SubjectPublicKeyInfo field has an OID not recognized by Go, such as 1.2.840.113549.1.1.10 for rsaPSS."}
+		return nil, nil, false, errutil.UserError{Err: "Refusing to import CA certificate with empty PublicKey. This usually means the SubjectPublicKeyInfo field has an OID not recognized by Go, such as 1.2.840.113549.1.1.10 for rsaPSS."}
 	}
 
 	// Before we can import a known issuer, we first need to know if the issuer
@@ -314,24 +382,36 @@ func (sc *storageContext) importIssuer(certValue string, issuerName string) (*is
 	// issuers and comparing their private value against this value.
 	knownIssuers, err := sc.listIssuers()
 	if err != nil {
-		return nil, false, err
+		return nil, nil, false, err
+	}
+
+	issuerInfo := &ImportedIssuerInfo{
+		SerialNumber:       issuerCert.SerialNumber.String(),
+		CommonName:         issuerCert.Subject.CommonName,
+		SKID:               issuerCert.SubjectKeyId,
+		AKID:               issuerCert.AuthorityKeyId,
+		NotBefore:          issuerCert.NotBefore.String(),
+		NotAfter:           issuerCert.NotAfter.String(),
+		PublicKeyAlgorithm: issuerCert.PublicKeyAlgorithm.String(),
 	}
 
 	foundExistingIssuerWithName := false
 	for _, identifier := range knownIssuers {
 		existingIssuer, err := sc.fetchIssuerById(identifier)
 		if err != nil {
-			return nil, false, err
+			return nil, nil, false, err
 		}
 		existingIssuerCert, err := existingIssuer.GetCertificate()
 		if err != nil {
-			return nil, false, err
+			return nil, nil, false, err
 		}
 		if areCertificatesEqual(existingIssuerCert, issuerCert) {
 			// Here, we don't need to stitch together the key entries,
 			// because the last run should've done that for us (or, when
 			// importing a key).
-			return existingIssuer, true, nil
+			issuerInfo.IssuerId = existingIssuer.ID.String()
+			issuerInfo.IssuerName = existingIssuer.Name
+			return existingIssuer, issuerInfo, true, nil
 		}
 
 		// Allow us to find an existing matching issuer with a different name before erroring out
@@ -341,7 +421,7 @@ func (sc *storageContext) importIssuer(certValue string, issuerName string) (*is
 	}
 
 	if foundExistingIssuerWithName {
-		return nil, false, errutil.UserError{Err: fmt.Sprintf("another issuer is using the requested name: %s", issuerName)}
+		return nil, nil, false, errutil.UserError{Err: fmt.Sprintf("another issuer is using the requested name: %s", issuerName)}
 	}
 
 	// Haven't found an issuer, so we've gotta create it and write it into
@@ -353,6 +433,8 @@ func (sc *storageContext) importIssuer(certValue string, issuerName string) (*is
 	result.LeafNotAfterBehavior = certutil.ErrNotAfterBehavior
 	result.Usage.ToggleUsage(issuing.AllIssuerUsages)
 	result.Version = issuing.LatestIssuerVersion
+	issuerInfo.IssuerId = result.ID.String()
+	issuerInfo.IssuerName = result.Name
 
 	// If we lack relevant bits for CRL, prohibit it from being set
 	// on the usage side.
@@ -363,7 +445,7 @@ func (sc *storageContext) importIssuer(certValue string, issuerName string) (*is
 	// We shouldn't add CSRs or multiple certificates in this
 	countCertificates := strings.Count(result.Certificate, "-BEGIN ")
 	if countCertificates != 1 {
-		return nil, false, fmt.Errorf("bad issuer: potentially multiple PEM blobs in one certificate storage entry:\n%v", result.Certificate)
+		return nil, nil, false, fmt.Errorf("bad issuer: potentially multiple PEM blobs in one certificate storage entry:\n%v", result.Certificate)
 	}
 
 	result.SerialNumber = serialFromCert(issuerCert)
@@ -374,7 +456,7 @@ func (sc *storageContext) importIssuer(certValue string, issuerName string) (*is
 	// it, to give ourselves a better chance of succeeding below.
 	knownKeys, err := sc.listKeys()
 	if err != nil {
-		return nil, false, err
+		return nil, nil, false, err
 	}
 
 	// Now, for each key, try and compute the issuer<->key link. We delay
@@ -383,12 +465,12 @@ func (sc *storageContext) importIssuer(certValue string, issuerName string) (*is
 	for _, identifier := range knownKeys {
 		existingKey, err := sc.fetchKeyById(identifier)
 		if err != nil {
-			return nil, false, err
+			return nil, nil, false, err
 		}
 
 		equal, err := comparePublicKey(sc, existingKey, issuerCert.PublicKey)
 		if err != nil {
-			return nil, false, err
+			return nil, nil, false, err
 		}
 
 		if equal {
@@ -404,23 +486,23 @@ func (sc *storageContext) importIssuer(certValue string, issuerName string) (*is
 	// Finally, rebuild the chains. In this process, because the provided
 	// reference issuer is non-nil, we'll save this issuer to storage.
 	if err := sc.rebuildIssuersChains(&result); err != nil {
-		return nil, false, err
+		return nil, nil, false, err
 	}
 
 	// If there was no prior default value set and/or we had no known
 	// issuers when we started, set this issuer as default.
 	issuerDefaultSet, err := sc.isDefaultIssuerSet()
 	if err != nil {
-		return nil, false, err
+		return nil, nil, false, err
 	}
 	if (len(knownIssuers) == 0 || !issuerDefaultSet) && len(result.KeyID) != 0 {
 		if err = sc.updateDefaultIssuerId(result.ID); err != nil {
-			return nil, false, err
+			return nil, nil, false, err
 		}
 	}
 
 	// All done; return our new key reference.
-	return &result, false, nil
+	return &result, issuerInfo, false, nil
 }
 
 func areCertificatesEqual(cert1 *x509.Certificate, cert2 *x509.Certificate) bool {
@@ -467,41 +549,6 @@ func (sc *storageContext) resolveIssuerReference(reference string) (issuing.Issu
 	return issuing.ResolveIssuerReference(sc.Context, sc.Storage, reference)
 }
 
-func (sc *storageContext) resolveIssuerCRLPath(reference string, unified bool) (string, error) {
-	if sc.Backend.UseLegacyBundleCaStorage() {
-		return legacyCRLPath, nil
-	}
-
-	issuer, err := sc.resolveIssuerReference(reference)
-	if err != nil {
-		return legacyCRLPath, err
-	}
-
-	var crlConfig *issuing.InternalCRLConfigEntry
-	if unified {
-		crlConfig, err = issuing.GetUnifiedCRLConfig(sc.Context, sc.Storage)
-		if err != nil {
-			return legacyCRLPath, err
-		}
-	} else {
-		crlConfig, err = issuing.GetLocalCRLConfig(sc.Context, sc.Storage)
-		if err != nil {
-			return legacyCRLPath, err
-		}
-	}
-
-	if crlId, ok := crlConfig.IssuerIDCRLMap[issuer]; ok && len(crlId) > 0 {
-		path := fmt.Sprintf("crls/%v", crlId)
-		if unified {
-			path = unifiedCRLPathPrefix + path
-		}
-
-		return path, nil
-	}
-
-	return legacyCRLPath, fmt.Errorf("unable to find CRL for issuer: id:%v/ref:%v", issuer, reference)
-}
-
 // Builds a certutil.CertBundle from the specified issuer identifier,
 // optionally loading the key or not. This method supports loading legacy
 // bundles using the legacyBundleShimID issuerId, and if no entry is found will return an error.
@@ -521,13 +568,13 @@ func (sc *storageContext) writeCaBundle(caBundle *certutil.CertBundle, issuerNam
 		return &issuing.IssuerEntry{}, myKey, nil
 	}
 
-	myIssuer, _, err := sc.importIssuer(caBundle.Certificate, issuerName)
+	myIssuer, _, _, err := sc.importIssuer(caBundle.Certificate, issuerName)
 	if err != nil {
 		return nil, nil, err
 	}
 
 	for _, cert := range caBundle.CAChain {
-		if _, _, err = sc.importIssuer(cert, ""); err != nil {
+		if _, _, _, err = sc.importIssuer(cert, ""); err != nil {
 			return nil, nil, err
 		}
 	}
@@ -613,15 +660,15 @@ func (sc *storageContext) checkForRolesReferencing(issuerId string) (timeout boo
 	return false, inUseBy, nil
 }
 
-func (sc *storageContext) getRevocationConfig() (*crlConfig, error) {
+func (sc *storageContext) getRevocationConfig() (*pki_backend.CrlConfig, error) {
 	entry, err := sc.Storage.Get(sc.Context, "config/crl")
 	if err != nil {
 		return nil, err
 	}
 
-	var result crlConfig
+	var result pki_backend.CrlConfig
 	if entry == nil {
-		result = defaultCrlConfig
+		result = pki_backend.DefaultCrlConfig
 		return &result, nil
 	}
 
@@ -631,15 +678,15 @@ func (sc *storageContext) getRevocationConfig() (*crlConfig, error) {
 
 	if result.Version == 0 {
 		// Automatically update existing configurations.
-		result.OcspDisable = defaultCrlConfig.OcspDisable
-		result.OcspExpiry = defaultCrlConfig.OcspExpiry
-		result.AutoRebuild = defaultCrlConfig.AutoRebuild
-		result.AutoRebuildGracePeriod = defaultCrlConfig.AutoRebuildGracePeriod
+		result.OcspDisable = pki_backend.DefaultCrlConfig.OcspDisable
+		result.OcspExpiry = pki_backend.DefaultCrlConfig.OcspExpiry
+		result.AutoRebuild = pki_backend.DefaultCrlConfig.AutoRebuild
+		result.AutoRebuildGracePeriod = pki_backend.DefaultCrlConfig.AutoRebuildGracePeriod
 		result.Version = 1
 	}
 	if result.Version == 1 {
 		if result.DeltaRebuildInterval == "" {
-			result.DeltaRebuildInterval = defaultCrlConfig.DeltaRebuildInterval
+			result.DeltaRebuildInterval = pki_backend.DefaultCrlConfig.DeltaRebuildInterval
 		}
 		result.Version = 2
 	}
@@ -647,13 +694,13 @@ func (sc *storageContext) getRevocationConfig() (*crlConfig, error) {
 	// Depending on client version, it's possible that the expiry is unset.
 	// This sets the default value to prevent issues in downstream code.
 	if result.Expiry == "" {
-		result.Expiry = defaultCrlConfig.Expiry
+		result.Expiry = pki_backend.DefaultCrlConfig.Expiry
 	}
 
-	isLocalMount := sc.Backend.System().LocalMount()
+	isLocalMount := sc.System().LocalMount()
 	if (!constants.IsEnterprise || isLocalMount) && (result.UnifiedCRLOnExistingPaths || result.UnifiedCRL || result.UseGlobalQueue) {
 		// An end user must have had Enterprise, enabled the unified config args and then downgraded to OSS.
-		sc.Backend.Logger().Warn("Not running Vault Enterprise or using a local mount, " +
+		sc.Logger().Warn("Not running Vault Enterprise or using a local mount, " +
 			"disabling unified_crl, unified_crl_on_existing_paths and cross_cluster_revocation config flags.")
 		result.UnifiedCRLOnExistingPaths = false
 		result.UnifiedCRL = false
@@ -663,7 +710,7 @@ func (sc *storageContext) getRevocationConfig() (*crlConfig, error) {
 	return &result, nil
 }
 
-func (sc *storageContext) setRevocationConfig(config *crlConfig) error {
+func (sc *storageContext) setRevocationConfig(config *pki_backend.CrlConfig) error {
 	entry, err := logical.StorageEntryJSON("config/crl", config)
 	if err != nil {
 		return fmt.Errorf("failed building storage entry JSON: %w", err)
@@ -697,6 +744,14 @@ func (sc *storageContext) getAutoTidyConfig() (*tidyConfig, error) {
 		result.IssuerSafetyBuffer = defaultTidyConfig.IssuerSafetyBuffer
 	}
 
+	if result.MinStartupBackoff == 0 {
+		result.MinStartupBackoff = defaultTidyConfig.MinStartupBackoff
+	}
+
+	if result.MaxStartupBackoff == 0 {
+		result.MaxStartupBackoff = defaultTidyConfig.MaxStartupBackoff
+	}
+
 	return &result, nil
 }
 
@@ -753,9 +808,44 @@ func (sc *storageContext) writeClusterConfig(config *issuing.ClusterConfigEntry)
 	return sc.Storage.Put(sc.Context, entry)
 }
 
-func (sc *storageContext) fetchRevocationInfo(serial string) (*revocationInfo, error) {
-	var revInfo *revocationInfo
-	revEntry, err := fetchCertBySerial(sc, revokedPath, serial)
+// tidyLastRun Track the various pieces of information around tidy on a specific cluster
+type tidyLastRun struct {
+	LastRunTime time.Time
+}
+
+func (sc *storageContext) getAutoTidyLastRun() (time.Time, error) {
+	entry, err := sc.Storage.Get(sc.Context, autoTidyLastRunPath)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("failed getting auto tidy last run: %w", err)
+	}
+	if entry == nil {
+		return time.Time{}, nil
+	}
+
+	var result tidyLastRun
+	if err = entry.DecodeJSON(&result); err != nil {
+		return time.Time{}, fmt.Errorf("failed parsing auto tidy last run: %w", err)
+	}
+	return result.LastRunTime, nil
+}
+
+func (sc *storageContext) writeAutoTidyLastRun(lastRunTime time.Time) error {
+	lastRun := tidyLastRun{LastRunTime: lastRunTime}
+	entry, err := logical.StorageEntryJSON(autoTidyLastRunPath, lastRun)
+	if err != nil {
+		return fmt.Errorf("failed generating json for auto tidy last run: %w", err)
+	}
+
+	if err := sc.Storage.Put(sc.Context, entry); err != nil {
+		return fmt.Errorf("failed writing auto tidy last run: %w", err)
+	}
+
+	return nil
+}
+
+func fetchRevocationInfo(sc pki_backend.StorageContext, serial string) (*revocation.RevocationInfo, error) {
+	var revInfo *revocation.RevocationInfo
+	revEntry, err := fetchCertBySerial(sc, revocation.RevokedPath, serial)
 	if err != nil {
 		return nil, err
 	}
@@ -768,3 +858,15 @@ func (sc *storageContext) fetchRevocationInfo(serial string) (*revocationInfo, e
 
 	return revInfo, nil
 }
+
+// filterDirEntries filters out directory entries from a list of entries normally from a List operation.
+func filterDirEntries(entries []string) []string {
+	ids := make([]string, 0, len(entries))
+	for _, entry := range entries {
+		if strings.HasSuffix(entry, "/") {
+			continue
+		}
+		ids = append(ids, entry)
+	}
+	return ids
+}
diff --git a/builtin/logical/pki/storage_migrations.go b/builtin/logical/pki/storage_migrations.go
index de9b61a9158..9164f0ce1a6 100644
--- a/builtin/logical/pki/storage_migrations.go
+++ b/builtin/logical/pki/storage_migrations.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/storage_migrations_test.go b/builtin/logical/pki/storage_migrations_test.go
index d5f297874f8..3f2bcaa9385 100644
--- a/builtin/logical/pki/storage_migrations_test.go
+++ b/builtin/logical/pki/storage_migrations_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
diff --git a/builtin/logical/pki/storage_test.go b/builtin/logical/pki/storage_test.go
index 3ace55e51c1..9b211e1c8db 100644
--- a/builtin/logical/pki/storage_test.go
+++ b/builtin/logical/pki/storage_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -135,16 +135,27 @@ func Test_KeysIssuerImport(t *testing.T) {
 	require.Equal(t, key1Ref1.ID, key1Ref2.ID)
 	require.Equal(t, key1Ref1.Name, key1Ref2.Name)
 
-	issuer1Ref1, existing, err := sc.importIssuer(issuer1.Certificate, "issuer1")
+	issuer1Ref1, issuerInfo, existing, err := sc.importIssuer(issuer1.Certificate, "issuer1")
 	require.NoError(t, err)
 	require.False(t, existing)
 	require.Equal(t, strings.TrimSpace(issuer1.Certificate), strings.TrimSpace(issuer1Ref1.Certificate))
 	require.Equal(t, key1Ref1.ID, issuer1Ref1.KeyID)
 	require.Equal(t, "issuer1", issuer1Ref1.Name)
 
+	require.NotNil(t, issuerInfo)
+	require.Equal(t, issuerInfo.IssuerName, issuer1Ref1.Name)
+	require.Equal(t, issuerInfo.IssuerId, issuer1Ref1.ID.String())
+	require.NotEmpty(t, issuerInfo.NotAfter)
+	require.NotEmpty(t, issuerInfo.NotBefore)
+	require.NotEmpty(t, issuerInfo.AKID)
+	require.NotEmpty(t, issuerInfo.SKID)
+	// The issuer cert does not have a subject/common name.
+	require.Empty(t, issuerInfo.CommonName)
+	require.Equal(t, "RSA", issuerInfo.PublicKeyAlgorithm)
+
 	// Make sure if we attempt to re-import the same issuer, no import/updates occur.
 	// So the existing flag should be set to true, and we do not update the existing Name field.
-	issuer1Ref2, existing, err := sc.importIssuer(issuer1.Certificate, "ignore-me")
+	issuer1Ref2, _, existing, err := sc.importIssuer(issuer1.Certificate, "ignore-me")
 	require.NoError(t, err)
 	require.True(t, existing)
 	require.Equal(t, strings.TrimSpace(issuer1.Certificate), strings.TrimSpace(issuer1Ref1.Certificate))
@@ -159,7 +170,7 @@ func Test_KeysIssuerImport(t *testing.T) {
 	require.NoError(t, err)
 
 	// Same double import tests as above, but make sure if the previous was created through writeIssuer not importIssuer.
-	issuer2Ref, existing, err := sc.importIssuer(issuer2.Certificate, "ignore-me")
+	issuer2Ref, _, existing, err := sc.importIssuer(issuer2.Certificate, "ignore-me")
 	require.NoError(t, err)
 	require.True(t, existing)
 	require.Equal(t, strings.TrimSpace(issuer2.Certificate), strings.TrimSpace(issuer2Ref.Certificate))
@@ -242,6 +253,7 @@ func genCertBundle(t *testing.T, b *backend, s logical.Storage) *certutil.CertBu
 	fields := addCACommonFields(map[string]*framework.FieldSchema{})
 	fields = addCAKeyGenerationFields(fields)
 	fields = addCAIssueFields(fields)
+	fields = addCACertKeyUsage(fields)
 	apiData := &framework.FieldData{
 		Schema: fields,
 		Raw: map[string]interface{}{
diff --git a/builtin/logical/pki/storage_unified.go b/builtin/logical/pki/storage_unified.go
index c279c26191e..2a04497f74b 100644
--- a/builtin/logical/pki/storage_unified.go
+++ b/builtin/logical/pki/storage_unified.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -6,25 +6,15 @@ package pki
 import (
 	"fmt"
 	"strings"
-	"time"
 
-	"github.com/hashicorp/vault/builtin/logical/pki/issuing"
-	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/builtin/logical/pki/revocation"
 )
 
 const (
-	unifiedRevocationReadPathPrefix  = "unified-revocation/"
-	unifiedRevocationWritePathPrefix = unifiedRevocationReadPathPrefix + "{{clusterId}}/"
+	unifiedRevocationReadPathPrefix = revocation.UnifiedRevocationReadPathPrefix
 )
 
-type unifiedRevocationEntry struct {
-	SerialNumber      string           `json:"-"`
-	CertExpiration    time.Time        `json:"certificate_expiration_utc"`
-	RevocationTimeUTC time.Time        `json:"revocation_time_utc"`
-	CertificateIssuer issuing.IssuerID `json:"issuer_id"`
-}
-
-func getUnifiedRevocationBySerial(sc *storageContext, serial string) (*unifiedRevocationEntry, error) {
+func getUnifiedRevocationBySerial(sc *storageContext, serial string) (*revocation.UnifiedRevocationEntry, error) {
 	clusterPaths, err := lookupUnifiedClusterPaths(sc)
 	if err != nil {
 		return nil, err
@@ -38,7 +28,7 @@ func getUnifiedRevocationBySerial(sc *storageContext, serial string) (*unifiedRe
 		}
 
 		if entryRaw != nil {
-			var revEntry unifiedRevocationEntry
+			var revEntry revocation.UnifiedRevocationEntry
 			if err := entryRaw.DecodeJSON(&revEntry); err != nil {
 				return nil, fmt.Errorf("failed json decoding of unified entry at path %s: %w", serialPath, err)
 			}
@@ -50,15 +40,6 @@ func getUnifiedRevocationBySerial(sc *storageContext, serial string) (*unifiedRe
 	return nil, nil
 }
 
-func writeUnifiedRevocationEntry(sc *storageContext, ure *unifiedRevocationEntry) error {
-	json, err := logical.StorageEntryJSON(unifiedRevocationWritePathPrefix+normalizeSerial(ure.SerialNumber), ure)
-	if err != nil {
-		return err
-	}
-
-	return sc.Storage.Put(sc.Context, json)
-}
-
 // listClusterSpecificUnifiedRevokedCerts returns a list of revoked certificates from a given cluster
 func listClusterSpecificUnifiedRevokedCerts(sc *storageContext, clusterId string) ([]string, error) {
 	path := unifiedRevocationReadPathPrefix + clusterId + "/"
diff --git a/builtin/logical/pki/test_helpers.go b/builtin/logical/pki/test_helpers.go
index 2806a5dcafd..58d58f2feae 100644
--- a/builtin/logical/pki/test_helpers.go
+++ b/builtin/logical/pki/test_helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -17,6 +17,9 @@ import (
 	"math"
 	"math/big"
 	http2 "net/http"
+	"os"
+	"os/exec"
+	"path"
 	"strings"
 	"testing"
 	"time"
@@ -37,6 +40,7 @@ func CreateBackendWithStorage(t testing.TB) (*backend, logical.Storage) {
 
 	var err error
 	b := Backend(config)
+	b.pkiCertificateCounter = &testingPkiCertificateCounter{}
 	err = b.Setup(context.Background(), config)
 	if err != nil {
 		t.Fatal(err)
@@ -473,3 +477,66 @@ func requireSerialInStorage(t *testing.T, client *api.Client, serial string) {
 	require.NotNilf(t, resp.Data, "reading certificate returned a nil data response for serial: %s", serial)
 	require.NotEmpty(t, resp.Data["certificate"], "certificate field was empty for serial: %s", serial)
 }
+
+func writeToTmpDir(t *testing.T, tmpDir string, filename string, contents string) string {
+	filePath := path.Join(tmpDir, filename)
+	out, err := os.Create(filePath)
+	require.NoError(t, err, "failed creating file %s", filePath)
+	_, err = out.WriteString(contents)
+	require.NoError(t, err, "failed writing to file %s", filePath)
+	err = out.Close()
+	require.NoError(t, err, "failed closing file %s", filePath)
+	return filePath
+}
+
+// Openssl is a good reference implementation for x509 and CMPv2
+func findOpenSSL() (string, string, bool) {
+	paths := os.Getenv("PATH")
+	for _, pathFolder := range strings.Split(paths, ":") {
+		cmd := path.Join(pathFolder, "openssl")
+		out, err := exec.Command(cmd, "version").CombinedOutput()
+		if err != nil {
+			continue
+		}
+		// We need a v3 version of OpenSSL to properly support the CMP command we run
+		if strings.Contains(string(out), "OpenSSL 3.") {
+			return cmd, string(out), true
+		}
+	}
+
+	return "", "", false
+}
+
+type testingPkiCertificateCounter struct {
+	IssuedCount uint64
+	StoredCount uint64
+}
+
+var _ logical.PkiCertificateCounter = (*testingPkiCertificateCounter)(nil)
+
+func (c *testingPkiCertificateCounter) Reset() {
+	c.IssuedCount = 0
+	c.StoredCount = 0
+}
+
+func (c *testingPkiCertificateCounter) IncrementCount(issuedCerts, storedCerts uint64) {
+	c.IssuedCount += issuedCerts
+	c.StoredCount += storedCerts
+}
+
+func (c *testingPkiCertificateCounter) AddIssuedCertificate(stored bool) {
+	if stored {
+		c.IncrementCount(1, 1)
+	} else {
+		c.IncrementCount(1, 0)
+	}
+}
+
+func (c *testingPkiCertificateCounter) RequireCount(t require.TestingT, issuedCerts, storedCerts uint64) {
+	require.Equal(t, issuedCerts, c.IssuedCount, "issued certificates count mismatch %s")
+	require.Equal(t, storedCerts, c.StoredCount, "stored certificates count mismatch %s")
+}
+
+func (c *testingPkiCertificateCounter) RequireZero(t require.TestingT) {
+	c.RequireCount(t, 0, 0)
+}
diff --git a/builtin/logical/pki/tidystatusstate_enumer.go b/builtin/logical/pki/tidystatusstate_enumer.go
new file mode 100644
index 00000000000..11db8e64c42
--- /dev/null
+++ b/builtin/logical/pki/tidystatusstate_enumer.go
@@ -0,0 +1,53 @@
+// Code generated by "enumer -type=tidyStatusState -trimprefix=tidyStatus"; DO NOT EDIT.
+
+package pki
+
+import (
+	"fmt"
+)
+
+const _tidyStatusStateName = "InactiveStartedFinishedErrorCancellingCancelled"
+
+var _tidyStatusStateIndex = [...]uint8{0, 8, 15, 23, 28, 38, 47}
+
+func (i tidyStatusState) String() string {
+	if i < 0 || i >= tidyStatusState(len(_tidyStatusStateIndex)-1) {
+		return fmt.Sprintf("tidyStatusState(%d)", i)
+	}
+	return _tidyStatusStateName[_tidyStatusStateIndex[i]:_tidyStatusStateIndex[i+1]]
+}
+
+var _tidyStatusStateValues = []tidyStatusState{0, 1, 2, 3, 4, 5}
+
+var _tidyStatusStateNameToValueMap = map[string]tidyStatusState{
+	_tidyStatusStateName[0:8]:   0,
+	_tidyStatusStateName[8:15]:  1,
+	_tidyStatusStateName[15:23]: 2,
+	_tidyStatusStateName[23:28]: 3,
+	_tidyStatusStateName[28:38]: 4,
+	_tidyStatusStateName[38:47]: 5,
+}
+
+// tidyStatusStateString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func tidyStatusStateString(s string) (tidyStatusState, error) {
+	if val, ok := _tidyStatusStateNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to tidyStatusState values", s)
+}
+
+// tidyStatusStateValues returns all values of the enum
+func tidyStatusStateValues() []tidyStatusState {
+	return _tidyStatusStateValues
+}
+
+// IsAtidyStatusState returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i tidyStatusState) IsAtidyStatusState() bool {
+	for _, v := range _tidyStatusStateValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/builtin/logical/pki/util.go b/builtin/logical/pki/util.go
index 50ea8f91cd2..a53c2931ef7 100644
--- a/builtin/logical/pki/util.go
+++ b/builtin/logical/pki/util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pki
@@ -17,7 +17,6 @@ import (
 	"github.com/hashicorp/vault/builtin/logical/pki/managed_key"
 	"github.com/hashicorp/vault/builtin/logical/pki/parsing"
 	"github.com/hashicorp/vault/sdk/framework"
-	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -40,11 +39,11 @@ var (
 )
 
 func serialFromCert(cert *x509.Certificate) string {
-	return serialFromBigInt(cert.SerialNumber)
+	return parsing.SerialFromCert(cert)
 }
 
 func serialFromBigInt(serial *big.Int) string {
-	return strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":"))
+	return parsing.SerialFromBigInt(serial)
 }
 
 func normalizeSerialFromBigInt(serial *big.Int) string {
@@ -253,15 +252,16 @@ func parseIfNotModifiedSince(req *logical.Request) (time.Time, error) {
 	return headerTimeValue, nil
 }
 
+//go:generate enumer -type=ifModifiedReqType -trimprefix=ifModified
 type ifModifiedReqType int
 
 const (
-	ifModifiedUnknown         ifModifiedReqType = iota
-	ifModifiedCA                                = iota
-	ifModifiedCRL                               = iota
-	ifModifiedDeltaCRL                          = iota
-	ifModifiedUnifiedCRL                        = iota
-	ifModifiedUnifiedDeltaCRL                   = iota
+	ifModifiedUnknown ifModifiedReqType = iota
+	ifModifiedCA
+	ifModifiedCRL
+	ifModifiedDeltaCRL
+	ifModifiedUnifiedCRL
+	ifModifiedUnifiedDeltaCRL
 )
 
 type IfModifiedSinceHelper struct {
@@ -307,7 +307,7 @@ func (sc *storageContext) isIfModifiedSinceBeforeLastModified(helper *IfModified
 
 	switch helper.reqType {
 	case ifModifiedCRL, ifModifiedDeltaCRL:
-		if sc.Backend.CrlBuilder().invalidate.Load() {
+		if sc.CrlBuilder().ShouldInvalidate() {
 			// When we see the CRL is invalidated, respond with false
 			// regardless of what the local CRL state says. We've likely
 			// renamed some issuers or are about to rebuild a new CRL....
@@ -327,7 +327,7 @@ func (sc *storageContext) isIfModifiedSinceBeforeLastModified(helper *IfModified
 			lastModified = crlConfig.DeltaLastModified
 		}
 	case ifModifiedUnifiedCRL, ifModifiedUnifiedDeltaCRL:
-		if sc.Backend.CrlBuilder().invalidate.Load() {
+		if sc.CrlBuilder().ShouldInvalidate() {
 			// When we see the CRL is invalidated, respond with false
 			// regardless of what the local CRL state says. We've likely
 			// renamed some issuers or are about to rebuild a new CRL....
diff --git a/builtin/logical/pkiext/nginx_test.go b/builtin/logical/pkiext/nginx_test.go
index e7d3ab42ed7..5fb900b8f0e 100644
--- a/builtin/logical/pkiext/nginx_test.go
+++ b/builtin/logical/pkiext/nginx_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pkiext
@@ -39,7 +39,7 @@ const (
 
 func buildNginxContainer(t *testing.T, root string, crl string, chain string, private string) (func(), string, int, string, string, int) {
 	containerfile := `
-FROM nginx:latest
+FROM nginx:1.27.1
 
 RUN mkdir /www /etc/nginx/ssl && rm /etc/nginx/conf.d/*.conf
 
diff --git a/builtin/logical/pkiext/pkiext_binary/acme_test.go b/builtin/logical/pkiext/pkiext_binary/acme_test.go
index f4a7be0c1d8..bb286feb411 100644
--- a/builtin/logical/pkiext/pkiext_binary/acme_test.go
+++ b/builtin/logical/pkiext/pkiext_binary/acme_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pkiext_binary
@@ -8,7 +8,6 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
@@ -30,6 +29,7 @@ import (
 	"github.com/hashicorp/vault/helper/testhelpers"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	hDocker "github.com/hashicorp/vault/sdk/helper/docker"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/acme"
@@ -704,7 +704,7 @@ func doAcmeValidationWithGoLibrary(t *testing.T, directoryUrl string, acmeOrderI
 	}
 	httpClient := &http.Client{Transport: tr}
 
-	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa account key")
 	logger.Trace("Using the following url for the ACME directory", "url", directoryUrl)
 	acmeClient := &acme.Client{
@@ -957,7 +957,7 @@ func SubtestACMEStepDownNode(t *testing.T, cluster *VaultPkiCluster) {
 		DNSNames: []string{hostname, hostname},
 	}
 
-	accountKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	accountKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NoError(t, err, "failed creating rsa account key")
 
 	acmeClient := &acme.Client{
diff --git a/builtin/logical/pkiext/pkiext_binary/pki_cluster.go b/builtin/logical/pkiext/pkiext_binary/pki_cluster.go
index 4462f510387..281767a3e57 100644
--- a/builtin/logical/pkiext/pkiext_binary/pki_cluster.go
+++ b/builtin/logical/pkiext/pkiext_binary/pki_cluster.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pkiext_binary
@@ -40,6 +40,7 @@ func NewVaultPkiCluster(t *testing.T) *VaultPkiCluster {
 			},
 			NumCores: 3,
 		},
+		DisableMlock: true,
 	}
 
 	cluster := docker.NewTestDockerCluster(t, opts)
diff --git a/builtin/logical/pkiext/pkiext_binary/pki_mount.go b/builtin/logical/pkiext/pkiext_binary/pki_mount.go
index 15ce16b2a3c..e1c19bd62b1 100644
--- a/builtin/logical/pkiext/pkiext_binary/pki_mount.go
+++ b/builtin/logical/pkiext/pkiext_binary/pki_mount.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pkiext_binary
diff --git a/builtin/logical/pkiext/test_helpers.go b/builtin/logical/pkiext/test_helpers.go
index 0950923e314..14d586d2d1b 100644
--- a/builtin/logical/pkiext/test_helpers.go
+++ b/builtin/logical/pkiext/test_helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pkiext
diff --git a/builtin/logical/pkiext/zlint_test.go b/builtin/logical/pkiext/zlint_test.go
index 206d23cb03a..bae1539b74d 100644
--- a/builtin/logical/pkiext/zlint_test.go
+++ b/builtin/logical/pkiext/zlint_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pkiext
@@ -6,10 +6,16 @@ package pkiext
 import (
 	"context"
 	"encoding/json"
+	"fmt"
+	"regexp"
+	"runtime"
+	"strings"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/hashicorp/vault/builtin/logical/pki"
+	"github.com/hashicorp/vault/helper/testhelpers"
 	"github.com/hashicorp/vault/sdk/helper/docker"
 	"github.com/stretchr/testify/require"
 )
@@ -17,14 +23,23 @@ import (
 var (
 	zRunner        *docker.Runner
 	buildZLintOnce sync.Once
+	releaseRegex   = regexp.MustCompile(`^go\d+\.\d+\.\d+$`)
 )
 
 func buildZLintContainer(t *testing.T) {
-	containerfile := `
-FROM docker.mirror.hashicorp.services/library/golang:latest
-
-RUN go install github.com/zmap/zlint/v3/cmd/zlint@latest
-`
+	// Leverage the Go version running the test to pull a version tagged image
+	// to avoid the issues we sometimes encounter pulling images with the latest tag
+	runtimeVer := runtime.Version()
+	goVersion := "latest"
+	// The version returned from Go might not be a release tag such as go1.23.2, if it
+	// isn't fallback to latest
+	if releaseRegex.MatchString(runtimeVer) {
+		goVersion = strings.TrimPrefix(runtime.Version(), "go")
+	}
+	containerfile := fmt.Sprintf(`
+FROM docker.mirror.hashicorp.services/library/golang:%s
+RUN go install github.com/zmap/zlint/v3/cmd/zlint@v3.6.2
+`, goVersion)
 
 	bCtx := docker.NewBuildContext()
 
@@ -50,15 +65,21 @@ RUN go install github.com/zmap/zlint/v3/cmd/zlint@latest
 	}
 
 	ctx := context.Background()
-	output, err := zRunner.BuildImage(ctx, containerfile, bCtx,
-		docker.BuildRemove(true), docker.BuildForceRemove(true),
-		docker.BuildPullParent(true),
-		docker.BuildTags([]string{imageName + ":" + imageTag}))
-	if err != nil {
-		t.Fatalf("Could not build new image: %v", err)
-	}
 
-	t.Logf("Image build output: %v", string(output))
+	// Sometimes we see timeouts and issues pulling the zlint code from GitHub
+	testhelpers.RetryUntil(t, 30*time.Second, func() error {
+		output, err := zRunner.BuildImage(ctx, containerfile, bCtx,
+			docker.BuildRemove(true),
+			docker.BuildForceRemove(true),
+			docker.BuildPullParent(true),
+			docker.BuildTags([]string{imageName + ":" + imageTag}))
+		if err != nil {
+			return fmt.Errorf("could not build new image with zlint: %w", err)
+		}
+
+		t.Logf("Image build output: %v", string(output))
+		return nil
+	})
 }
 
 func RunZLintContainer(t *testing.T, certificate string) []byte {
diff --git a/builtin/logical/rabbitmq/backend.go b/builtin/logical/rabbitmq/backend.go
index e6a093d5426..9df386b7b48 100644
--- a/builtin/logical/rabbitmq/backend.go
+++ b/builtin/logical/rabbitmq/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
diff --git a/builtin/logical/rabbitmq/backend_test.go b/builtin/logical/rabbitmq/backend_test.go
index 21510b2f988..a15ce32bf1b 100644
--- a/builtin/logical/rabbitmq/backend_test.go
+++ b/builtin/logical/rabbitmq/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
diff --git a/builtin/logical/rabbitmq/cmd/rabbitmq/main.go b/builtin/logical/rabbitmq/cmd/rabbitmq/main.go
index 942db13dc14..44558caf41b 100644
--- a/builtin/logical/rabbitmq/cmd/rabbitmq/main.go
+++ b/builtin/logical/rabbitmq/cmd/rabbitmq/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/logical/rabbitmq/passwords.go b/builtin/logical/rabbitmq/passwords.go
index ee6b9d02fca..c37cc1dc44c 100644
--- a/builtin/logical/rabbitmq/passwords.go
+++ b/builtin/logical/rabbitmq/passwords.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
diff --git a/builtin/logical/rabbitmq/path_config_connection.go b/builtin/logical/rabbitmq/path_config_connection.go
index d586ffc035a..92e4812898e 100644
--- a/builtin/logical/rabbitmq/path_config_connection.go
+++ b/builtin/logical/rabbitmq/path_config_connection.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
diff --git a/builtin/logical/rabbitmq/path_config_connection_test.go b/builtin/logical/rabbitmq/path_config_connection_test.go
index 8e7de881c07..424a446d020 100644
--- a/builtin/logical/rabbitmq/path_config_connection_test.go
+++ b/builtin/logical/rabbitmq/path_config_connection_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
diff --git a/builtin/logical/rabbitmq/path_config_lease.go b/builtin/logical/rabbitmq/path_config_lease.go
index cf82a2024cc..7f08020ae4c 100644
--- a/builtin/logical/rabbitmq/path_config_lease.go
+++ b/builtin/logical/rabbitmq/path_config_lease.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
diff --git a/builtin/logical/rabbitmq/path_config_lease_test.go b/builtin/logical/rabbitmq/path_config_lease_test.go
index 542a5d284e7..d8f3d12c2fa 100644
--- a/builtin/logical/rabbitmq/path_config_lease_test.go
+++ b/builtin/logical/rabbitmq/path_config_lease_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
diff --git a/builtin/logical/rabbitmq/path_role_create.go b/builtin/logical/rabbitmq/path_role_create.go
index 956a0167208..0b0ce6f06af 100644
--- a/builtin/logical/rabbitmq/path_role_create.go
+++ b/builtin/logical/rabbitmq/path_role_create.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
@@ -6,7 +6,7 @@ package rabbitmq
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
+	"io"
 
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/template"
@@ -113,7 +113,7 @@ func (b *backend) pathCredsRead(ctx context.Context, req *logical.Request, d *fr
 		}
 	}()
 	if !isIn200s(resp.StatusCode) {
-		body, _ := ioutil.ReadAll(resp.Body)
+		body, _ := io.ReadAll(resp.Body)
 		return nil, fmt.Errorf("error creating user %s - %d: %s", username, resp.StatusCode, body)
 	}
 
@@ -128,7 +128,7 @@ func (b *backend) pathCredsRead(ctx context.Context, req *logical.Request, d *fr
 			b.Logger().Error(fmt.Sprintf("deleting %s due to permissions being in an unknown state, but failed: %s", username, err))
 		}
 		if !isIn200s(resp.StatusCode) {
-			body, _ := ioutil.ReadAll(resp.Body)
+			body, _ := io.ReadAll(resp.Body)
 			b.Logger().Error(fmt.Sprintf("deleting %s due to permissions being in an unknown state, but error deleting: %d: %s", username, resp.StatusCode, body))
 		}
 	}()
@@ -151,7 +151,7 @@ func (b *backend) pathCredsRead(ctx context.Context, req *logical.Request, d *fr
 				}
 			}()
 			if !isIn200s(resp.StatusCode) {
-				body, _ := ioutil.ReadAll(resp.Body)
+				body, _ := io.ReadAll(resp.Body)
 				return fmt.Errorf("error updating vhost permissions for %s - %d: %s", vhost, resp.StatusCode, body)
 			}
 			return nil
@@ -180,7 +180,7 @@ func (b *backend) pathCredsRead(ctx context.Context, req *logical.Request, d *fr
 					}
 				}()
 				if !isIn200s(resp.StatusCode) {
-					body, _ := ioutil.ReadAll(resp.Body)
+					body, _ := io.ReadAll(resp.Body)
 					return fmt.Errorf("error updating vhost permissions for %s - %d: %s", vhost, resp.StatusCode, body)
 				}
 				return nil
diff --git a/builtin/logical/rabbitmq/path_role_create_test.go b/builtin/logical/rabbitmq/path_role_create_test.go
index 0f2591caf7d..228b08b682d 100644
--- a/builtin/logical/rabbitmq/path_role_create_test.go
+++ b/builtin/logical/rabbitmq/path_role_create_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
diff --git a/builtin/logical/rabbitmq/path_roles.go b/builtin/logical/rabbitmq/path_roles.go
index 9164d5780b6..5a06f2e5f3a 100644
--- a/builtin/logical/rabbitmq/path_roles.go
+++ b/builtin/logical/rabbitmq/path_roles.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
diff --git a/builtin/logical/rabbitmq/secret_creds.go b/builtin/logical/rabbitmq/secret_creds.go
index eaaf2afd0a6..f52cdd1d960 100644
--- a/builtin/logical/rabbitmq/secret_creds.go
+++ b/builtin/logical/rabbitmq/secret_creds.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rabbitmq
diff --git a/builtin/logical/ssh/backend.go b/builtin/logical/ssh/backend.go
index f750e79fac5..c64c98a47c6 100644
--- a/builtin/logical/ssh/backend.go
+++ b/builtin/logical/ssh/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
@@ -9,6 +9,7 @@ import (
 	"sync"
 
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/helper/salt"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -17,9 +18,10 @@ const operationPrefixSSH = "ssh"
 
 type backend struct {
 	*framework.Backend
-	view      logical.Storage
-	salt      *salt.Salt
-	saltMutex sync.RWMutex
+	view        logical.Storage
+	salt        *salt.Salt
+	saltMutex   sync.RWMutex
+	backendUUID string
 }
 
 func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error) {
@@ -54,6 +56,10 @@ func Backend(conf *logical.BackendConfig) (*backend, error) {
 				caPrivateKeyStoragePath,
 				keysStoragePrefix,
 			},
+
+			AllowSnapshotRead: []string{
+				"config/ca",
+			},
 		},
 
 		Paths: []*framework.Path{
@@ -77,6 +83,8 @@ func Backend(conf *logical.BackendConfig) (*backend, error) {
 		Invalidate:  b.invalidate,
 		BackendType: logical.TypeLogical,
 	}
+
+	b.backendUUID = conf.BackendUUID
 	return &b, nil
 }
 
@@ -112,6 +120,18 @@ func (b *backend) invalidate(_ context.Context, key string) {
 	}
 }
 
+func (b *backend) GetManagedKeyView() (logical.ManagedKeySystemView, error) {
+	managedKeyView, ok := b.System().(logical.ManagedKeySystemView)
+	if !ok {
+		return nil, errutil.InternalError{Err: "unsupported system view"}
+	}
+	return managedKeyView, nil
+}
+
+func (b *backend) BackendUUID() string {
+	return b.backendUUID
+}
+
 const backendHelp = `
 The SSH backend generates credentials allowing clients to establish SSH
 connections to remote hosts.
diff --git a/builtin/logical/ssh/backend_test.go b/builtin/logical/ssh/backend_test.go
index ad2c048d5e9..1cb878c9376 100644
--- a/builtin/logical/ssh/backend_test.go
+++ b/builtin/logical/ssh/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
@@ -15,6 +15,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
@@ -24,6 +25,7 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 	"github.com/mitchellh/mapstructure"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
 )
@@ -212,6 +214,101 @@ func testSSH(user, host string, auth ssh.AuthMethod, command string) error {
 	return nil
 }
 
+// TestBackend_ReadRolesReturnsAllFields validates we did not forget to return a newly added
+// field from the ssh role in the read API.
+func TestBackend_ReadRolesReturnsAllFields(t *testing.T) {
+	t.Parallel()
+
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+
+	b, err := Backend(config)
+	require.NoError(t, err, "failed creating backend")
+	err = b.Setup(context.Background(), config)
+	require.NoError(t, err, "failed setting up backend")
+
+	tests := []struct {
+		name          string
+		data          map[string]interface{}
+		ignoredFields []string
+	}{
+		{
+			name: "otp",
+			data: map[string]interface{}{
+				"key_type":     "otp",
+				"default_user": "ubuntu",
+			},
+			ignoredFields: []string{
+				"allow_host_certificates", "allow_subdomains",
+				"default_user_template", "allowed_extensions", "allowed_user_key_lengths",
+				"allow_empty_principals", "ttl", "allowed_domains_template",
+				"default_extensions_template", "default_critical_options",
+				"allow_bare_domains", "allowed_domains", "allowed_critical_options",
+				"allow_user_certificates", "allow_user_key_ids", "algorithm_signer",
+				"not_before_duration", "max_ttl", "default_extensions", "allowed_users_template", "key_id_format",
+			},
+		},
+		{
+			name: "ca",
+			data: map[string]interface{}{
+				"key_type":                "ca",
+				"algorithm_signer":        "rsa-sha2-256",
+				"allow_user_certificates": true,
+			},
+			ignoredFields: []string{"port", "cidr_list", "exclude_cidr_list"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var fieldsToIgnore []string
+			fieldsToIgnore = append(fieldsToIgnore, tc.ignoredFields...)
+			// These fields apply to all use cases, role_version is never returned and
+			// allowed_user_key_types_lengths is an internal value for the allowed_user_key_lengths field
+			fieldsToIgnore = append(fieldsToIgnore, "role_version")
+			fieldsToIgnore = append(fieldsToIgnore, "allowed_user_key_types_lengths")
+
+			roleName := fmt.Sprintf("roles/role-%s", tc.name)
+			req := &logical.Request{
+				Operation: logical.UpdateOperation,
+				Path:      roleName,
+				Storage:   config.StorageView,
+				Data:      tc.data,
+			}
+			resp, err := b.HandleRequest(context.Background(), req)
+			if err != nil || (resp != nil && resp.IsError()) || resp != nil {
+				t.Fatalf("failed to create role %s: resp:%#v err:%s", roleName, resp, err)
+			}
+
+			req = &logical.Request{
+				Operation: logical.ReadOperation,
+				Path:      roleName,
+				Storage:   config.StorageView,
+			}
+			resp, err = b.HandleRequest(context.Background(), req)
+			if err != nil || (resp != nil && resp.IsError()) || resp == nil {
+				t.Fatalf("failed to read role %s: resp:%#v err:%s", roleName, resp, err)
+			}
+
+			roleMap := map[string]interface{}{}
+			err = mapstructure.Decode(sshRole{}, &roleMap)
+			require.NoError(t, err, "failed getting all fields in ssh role")
+
+			// Identify missing fields from OTP response
+			var missingFields []string
+			for fieldName := range roleMap {
+				if _, ok := resp.Data[fieldName]; !ok {
+					if strutil.StrListContains(fieldsToIgnore, fieldName) {
+						continue
+					}
+					missingFields = append(missingFields, fieldName)
+				}
+			}
+			assert.Empty(t, missingFields, "response was missing fields: %s", missingFields)
+		})
+	}
+}
+
 func TestBackend_AllowedUsers(t *testing.T) {
 	config := logical.TestBackendConfig()
 	config.StorageView = &logical.InmemStorage{}
@@ -1298,6 +1395,80 @@ func TestBackend_OptionsOverrideDefaults(t *testing.T) {
 	logicaltest.Test(t, testCase)
 }
 
+func TestBackend_EmptyPrincipals(t *testing.T) {
+	config := logical.TestBackendConfig()
+
+	b, err := Factory(context.Background(), config)
+	if err != nil {
+		t.Fatalf("Cannot create backend: %s", err)
+	}
+	testCase := logicaltest.TestCase{
+		LogicalBackend: b,
+		Steps: []logicaltest.TestStep{
+			configCaStep(testCAPublicKey, testCAPrivateKey),
+			createRoleStep("no_user_principals", map[string]interface{}{
+				"key_type":                "ca",
+				"allow_user_certificates": true,
+				"allowed_user_key_lengths": map[string]interface{}{
+					"rsa": 2048,
+				},
+				"allowed_users": "no_principals",
+			}),
+			{
+				Operation: logical.UpdateOperation,
+				Path:      "sign/no_user_principals",
+				Data: map[string]interface{}{
+					"public_key": testCAPublicKey,
+				},
+				ErrorOk: true,
+				Check: func(resp *logical.Response) error {
+					if resp.Data["error"] != "empty valid principals not allowed by role" {
+						return errors.New("expected empty valid principals not allowed by role")
+					}
+					return nil
+				},
+			},
+			createRoleStep("no_host_principals", map[string]interface{}{
+				"key_type":                "ca",
+				"allow_host_certificates": true,
+				"allowed_domains":         "*",
+			}),
+			{
+				Operation: logical.UpdateOperation,
+				Path:      "sign/no_host_principals",
+				Data: map[string]interface{}{
+					"cert_type":  "host",
+					"public_key": testCAPublicKeyEd25519,
+				},
+				ErrorOk: true,
+				Check: func(resp *logical.Response) error {
+					if resp.Data["error"] != "empty valid principals not allowed by role" {
+						return errors.New("expected empty valid principals not allowed by role")
+					}
+					return nil
+				},
+			},
+			{
+				Operation: logical.UpdateOperation,
+				Path:      "sign/no_host_principals",
+				Data: map[string]interface{}{
+					"cert_type":        "host",
+					"public_key":       testCAPublicKeyEd25519,
+					"valid_principals": "example.com",
+				},
+				ErrorOk: true,
+				Check: func(resp *logical.Response) error {
+					if resp.Data["error"] != nil {
+						return errors.New("expected no error")
+					}
+					return nil
+				},
+			},
+		},
+	}
+	logicaltest.Test(t, testCase)
+}
+
 func TestBackend_AllowedUserKeyLengths(t *testing.T) {
 	config := logical.TestBackendConfig()
 
@@ -1315,6 +1486,7 @@ func TestBackend_AllowedUserKeyLengths(t *testing.T) {
 				"allowed_user_key_lengths": map[string]interface{}{
 					"rsa": 4096,
 				},
+				"allowed_users": "guest",
 			}),
 			{
 				Operation: logical.UpdateOperation,
@@ -1336,13 +1508,15 @@ func TestBackend_AllowedUserKeyLengths(t *testing.T) {
 				"allowed_user_key_lengths": map[string]interface{}{
 					"rsa": 2048,
 				},
+				"allowed_users": "guest",
 			}),
 			// Pass with 2048 key
 			{
 				Operation: logical.UpdateOperation,
 				Path:      "sign/stdkey",
 				Data: map[string]interface{}{
-					"public_key": testCAPublicKey,
+					"public_key":       testCAPublicKey,
+					"valid_principals": "guest",
 				},
 			},
 			// Fail with 4096 key
@@ -1350,7 +1524,8 @@ func TestBackend_AllowedUserKeyLengths(t *testing.T) {
 				Operation: logical.UpdateOperation,
 				Path:      "sign/stdkey",
 				Data: map[string]interface{}{
-					"public_key": publicKey4096,
+					"public_key":       publicKey4096,
+					"valid_principals": "guest",
 				},
 				ErrorOk: true,
 				Check: func(resp *logical.Response) error {
@@ -1366,13 +1541,15 @@ func TestBackend_AllowedUserKeyLengths(t *testing.T) {
 				"allowed_user_key_lengths": map[string]interface{}{
 					"rsa": []int{2048, 4096},
 				},
+				"allowed_users": "guest",
 			}),
 			// Pass with 2048-bit key
 			{
 				Operation: logical.UpdateOperation,
 				Path:      "sign/multikey",
 				Data: map[string]interface{}{
-					"public_key": testCAPublicKey,
+					"public_key":       testCAPublicKey,
+					"valid_principals": "guest",
 				},
 			},
 			// Pass with 4096-bit key
@@ -1380,7 +1557,8 @@ func TestBackend_AllowedUserKeyLengths(t *testing.T) {
 				Operation: logical.UpdateOperation,
 				Path:      "sign/multikey",
 				Data: map[string]interface{}{
-					"public_key": publicKey4096,
+					"public_key":       publicKey4096,
+					"valid_principals": "guest",
 				},
 			},
 			// Fail with 3072-bit key
@@ -1403,7 +1581,8 @@ func TestBackend_AllowedUserKeyLengths(t *testing.T) {
 				Operation: logical.UpdateOperation,
 				Path:      "sign/multikey",
 				Data: map[string]interface{}{
-					"public_key": publicKeyECDSA256,
+					"public_key":       publicKeyECDSA256,
+					"valid_principals": "guest",
 				},
 				ErrorOk: true,
 				Check: func(resp *logical.Response) error {
@@ -1420,13 +1599,15 @@ func TestBackend_AllowedUserKeyLengths(t *testing.T) {
 					"ec":                  []int{256},
 					"ecdsa-sha2-nistp521": 0,
 				},
+				"allowed_users": "guest",
 			}),
 			// Pass with ECDSA P-256
 			{
 				Operation: logical.UpdateOperation,
 				Path:      "sign/ectypes",
 				Data: map[string]interface{}{
-					"public_key": publicKeyECDSA256,
+					"public_key":       publicKeyECDSA256,
+					"valid_principals": "guest",
 				},
 			},
 			// Pass with ECDSA P-521
@@ -1434,7 +1615,8 @@ func TestBackend_AllowedUserKeyLengths(t *testing.T) {
 				Operation: logical.UpdateOperation,
 				Path:      "sign/ectypes",
 				Data: map[string]interface{}{
-					"public_key": publicKeyECDSA521,
+					"public_key":       publicKeyECDSA521,
+					"valid_principals": "guest",
 				},
 			},
 			// Fail with RSA key
@@ -1442,7 +1624,8 @@ func TestBackend_AllowedUserKeyLengths(t *testing.T) {
 				Operation: logical.UpdateOperation,
 				Path:      "sign/ectypes",
 				Data: map[string]interface{}{
-					"public_key": publicKey3072,
+					"public_key":       publicKey3072,
+					"valid_principals": "guest",
 				},
 				ErrorOk: true,
 				Check: func(resp *logical.Response) error {
@@ -1896,6 +2079,7 @@ func TestSSHBackend_IssueSign(t *testing.T) {
 					"ecdsa-sha2-nistp521": 0,
 					"ed25519":             0,
 				},
+				"allow_empty_principals": true,
 			}),
 			// Key_type not in allowed_user_key_types_lengths
 			issueSSHKeyPairStep("testing", "ec", 256, true, "provided key_type value not in allowed_user_key_types"),
@@ -2726,13 +2910,14 @@ func TestProperAuthing(t *testing.T) {
 	_, err = client.Logical().WriteWithContext(ctx, "ssh/roles/test-ca", map[string]interface{}{
 		"key_type":                "ca",
 		"allow_user_certificates": true,
+		"allowed_users":           "toor",
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	_, err = client.Logical().WriteWithContext(ctx, "ssh/issue/test-ca", map[string]interface{}{
-		"username": "toor",
+		"valid_principals": "toor",
 	})
 	if err != nil {
 		t.Fatal(err)
diff --git a/builtin/logical/ssh/cmd/ssh/main.go b/builtin/logical/ssh/cmd/ssh/main.go
index 4a2163d99b6..3e8487fa8a4 100644
--- a/builtin/logical/ssh/cmd/ssh/main.go
+++ b/builtin/logical/ssh/cmd/ssh/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/logical/ssh/managed_key/common.go b/builtin/logical/ssh/managed_key/common.go
new file mode 100644
index 00000000000..792bfa5ed3d
--- /dev/null
+++ b/builtin/logical/ssh/managed_key/common.go
@@ -0,0 +1,115 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package managed_key
+
+import (
+	"context"
+	"crypto"
+	"encoding/asn1"
+	"fmt"
+	"io"
+	"math/big"
+
+	"github.com/hashicorp/vault/sdk/logical"
+	"golang.org/x/crypto/ssh"
+)
+
+type ManagedKeyInfo struct {
+	publicKey ssh.PublicKey
+	Name      NameKey
+	Uuid      UUIDKey
+	ctx       context.Context
+	mkv       SSHManagedKeyView
+}
+
+type managedKeyId interface {
+	String() string
+}
+
+type SSHManagedKeyView interface {
+	BackendUUID() string
+	GetManagedKeyView() (logical.ManagedKeySystemView, error)
+	GetRandomReader() io.Reader
+}
+
+type (
+	UUIDKey string
+	NameKey string
+)
+
+type ecdsaSignature struct {
+	R, S *big.Int
+}
+
+var HashFunctions = map[string]crypto.Hash{
+	ssh.KeyAlgoECDSA256:  crypto.SHA256,
+	ssh.KeyAlgoECDSA384:  crypto.SHA384,
+	ssh.KeyAlgoECDSA521:  crypto.SHA512,
+	ssh.KeyAlgoRSA:       crypto.SHA1,
+	ssh.KeyAlgoRSASHA256: crypto.SHA256,
+	ssh.KeyAlgoRSASHA512: crypto.SHA512,
+}
+
+func (u UUIDKey) String() string {
+	return string(u)
+}
+
+func (n NameKey) String() string {
+	return string(n)
+}
+
+func (m ManagedKeyInfo) PublicKey() ssh.PublicKey {
+	return m.publicKey
+}
+
+func (m ManagedKeyInfo) Sign(rand io.Reader, data []byte) (*ssh.Signature, error) {
+	return m.SignWithAlgorithm(rand, data, "")
+}
+
+func (m ManagedKeyInfo) SignWithAlgorithm(rand io.Reader, input []byte, algorithm string) (*ssh.Signature, error) {
+	keyType := m.publicKey.Type()
+	if keyType != ssh.KeyAlgoRSA && (algorithm == ssh.KeyAlgoRSASHA256 || algorithm == ssh.KeyAlgoRSASHA512) {
+		return nil, fmt.Errorf("invalid algorithm %s for key type %s", algorithm, keyType)
+	}
+
+	if algorithm == "default" || algorithm == "" {
+		if keyType == ssh.KeyAlgoRSA {
+			algorithm = ssh.KeyAlgoRSASHA256
+		} else {
+			algorithm = keyType
+		}
+	}
+
+	opts, ok := HashFunctions[algorithm]
+	if !ok {
+		return nil, fmt.Errorf("invalid hash algorithm %s", algorithm)
+	}
+
+	hashFcn := opts.New()
+	hashFcn.Write(input)
+	digest := hashFcn.Sum(nil)
+
+	sig, err := Sign(m.ctx, m.mkv, m.Uuid, rand, digest, opts)
+	if err != nil {
+		return nil, err
+	}
+
+	var sigBytes []byte
+	switch keyType {
+	case ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521:
+		var ecdsaSig ecdsaSignature
+		_, err = asn1.Unmarshal(sig, &ecdsaSig)
+		if err != nil {
+			return nil, fmt.Errorf("error unmarshalling signature: %w", err)
+		}
+		sigBytes = ssh.Marshal(ecdsaSig)
+	case ssh.KeyAlgoRSA:
+		sigBytes = sig
+	}
+
+	return &ssh.Signature{
+		Format: algorithm,
+		Blob:   sigBytes,
+	}, nil
+}
diff --git a/builtin/logical/ssh/managed_key/managed_key_util_ce.go b/builtin/logical/ssh/managed_key/managed_key_util_ce.go
new file mode 100644
index 00000000000..9c4bb69ce29
--- /dev/null
+++ b/builtin/logical/ssh/managed_key/managed_key_util_ce.go
@@ -0,0 +1,21 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package managed_key
+
+import (
+	"context"
+	"crypto"
+	"errors"
+	"io"
+)
+
+func GetManagedKeyInfo(ctx context.Context, mkv SSHManagedKeyView, keyId managedKeyId) (*ManagedKeyInfo, error) {
+	return nil, errors.New("managed keys are supported within enterprise edition only")
+}
+
+func Sign(ctx context.Context, mkv SSHManagedKeyView, keyId managedKeyId, rand io.Reader, msg []byte, opts crypto.SignerOpts) ([]byte, error) {
+	return nil, errors.New("managed keys are supported within enterprise edition only")
+}
diff --git a/builtin/logical/ssh/path_cleanup_dynamic_host_keys.go b/builtin/logical/ssh/path_cleanup_dynamic_host_keys.go
index 7d028def309..3055cfae4a3 100644
--- a/builtin/logical/ssh/path_cleanup_dynamic_host_keys.go
+++ b/builtin/logical/ssh/path_cleanup_dynamic_host_keys.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
diff --git a/builtin/logical/ssh/path_config_ca.go b/builtin/logical/ssh/path_config_ca.go
index 6d003c0ae5c..64bd6c841a8 100644
--- a/builtin/logical/ssh/path_config_ca.go
+++ b/builtin/logical/ssh/path_config_ca.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
@@ -10,7 +10,6 @@ import (
 	"crypto/ed25519"
 	"crypto/elliptic"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
 	"errors"
@@ -18,7 +17,9 @@ import (
 	"io"
 
 	multierror "github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/vault/builtin/logical/ssh/managed_key"
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/mikesmitty/edkey"
 	"golang.org/x/crypto/ssh"
@@ -31,12 +32,19 @@ const (
 	caPublicKeyStoragePathDeprecated  = "public_key"
 	caPrivateKeyStoragePath           = "config/ca_private_key"
 	caPrivateKeyStoragePathDeprecated = "config/ca_bundle"
+	caManagedKeyStoragePath           = "config/ca_managed_key"
 )
 
 type keyStorageEntry struct {
 	Key string `json:"key" structs:"key" mapstructure:"key"`
 }
 
+type managedKeyStorageEntry struct {
+	KeyId     managed_key.UUIDKey `json:"key_id" structs:"key_id" mapstructure:"key_id"`
+	KeyName   managed_key.NameKey `json:"key_name" structs:"key_name" mapstructure:"key_name"`
+	PublicKey string              `json:"public_key" structs:"public_key" mapstructure:"public_key"`
+}
+
 func pathConfigCA(b *backend) *framework.Path {
 	return &framework.Path{
 		Pattern: "config/ca",
@@ -56,7 +64,7 @@ func pathConfigCA(b *backend) *framework.Path {
 			},
 			"generate_signing_key": {
 				Type:        framework.TypeBool,
-				Description: `Generate SSH key pair internally rather than use the private_key and public_key fields.`,
+				Description: `Generate SSH key pair internally rather than use the private_key and public_key fields. If managed key config is provided, this field is ignored.`,
 				Default:     true,
 			},
 			"key_type": {
@@ -69,6 +77,14 @@ func pathConfigCA(b *backend) *framework.Path {
 				Description: `Specifies the desired key bits when generating variable-length keys (such as when key_type="ssh-rsa") or which NIST P-curve to use when key_type="ec" (256, 384, or 521).`,
 				Default:     0,
 			},
+			"managed_key_name": {
+				Type:        framework.TypeString,
+				Description: `The name of the managed key to use. When using a managed key, this field or managed_key_id is required.`,
+			},
+			"managed_key_id": {
+				Type:        framework.TypeString,
+				Description: `The id of the managed key to use. When using a managed key, this field or managed_key_name is required.`,
+			},
 		},
 
 		Operations: map[logical.Operation]framework.OperationHandler{
@@ -91,6 +107,9 @@ func pathConfigCA(b *backend) *framework.Path {
 					OperationSuffix: "ca-configuration",
 				},
 			},
+			logical.RecoverOperation: &framework.PathOperation{
+				Callback: b.pathConfigCARecover,
+			},
 		},
 
 		HelpSynopsis: `Set the SSH private key used for signing certificates.`,
@@ -104,18 +123,20 @@ Read operations will return the public key, if already stored/generated.`,
 }
 
 func (b *backend) pathConfigCARead(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
-	publicKeyEntry, err := caKey(ctx, req.Storage, caPublicKey)
+	// prevent migration from deprecated paths on snapshot read as writes to a loaded snapshot storage are forbidden
+	allowMigration := !req.IsSnapshotReadOrList()
+	publicKey, err := getCAPublicKey(ctx, req.Storage, allowMigration)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read CA public key: %w", err)
 	}
 
-	if publicKeyEntry == nil {
+	if publicKey == "" {
 		return logical.ErrorResponse("keys haven't been configured yet"), nil
 	}
 
 	response := &logical.Response{
 		Data: map[string]interface{}{
-			"public_key": publicKeyEntry.Key,
+			"public_key": publicKey,
 		},
 	}
 
@@ -126,13 +147,22 @@ func (b *backend) pathConfigCADelete(ctx context.Context, req *logical.Request,
 	if err := req.Storage.Delete(ctx, caPrivateKeyStoragePath); err != nil {
 		return nil, err
 	}
+	if err := req.Storage.Delete(ctx, caPrivateKeyStoragePathDeprecated); err != nil {
+		return nil, err
+	}
 	if err := req.Storage.Delete(ctx, caPublicKeyStoragePath); err != nil {
 		return nil, err
 	}
+	if err := req.Storage.Delete(ctx, caPublicKeyStoragePathDeprecated); err != nil {
+		return nil, err
+	}
+	if err := req.Storage.Delete(ctx, caManagedKeyStoragePath); err != nil {
+		return nil, err
+	}
 	return nil, nil
 }
 
-func caKey(ctx context.Context, storage logical.Storage, keyType string) (*keyStorageEntry, error) {
+func readStoredKeyEntry(ctx context.Context, storage logical.Storage, keyType string, allowMigration bool) (*logical.StorageEntry, error) {
 	var path, deprecatedPath string
 	switch keyType {
 	case caPrivateKey:
@@ -157,25 +187,39 @@ func caKey(ctx context.Context, storage logical.Storage, keyType string) (*keySt
 		if err != nil {
 			return nil, err
 		}
+
 		if entry != nil {
+			// modify entry variable, both for possible migration and also to comply with the expected JSON entry for the caller
 			entry, err = logical.StorageEntryJSON(path, keyStorageEntry{
 				Key: string(entry.Value),
 			})
 			if err != nil {
 				return nil, err
 			}
-			if err := storage.Put(ctx, entry); err != nil {
-				return nil, err
-			}
-			if err = storage.Delete(ctx, deprecatedPath); err != nil {
-				return nil, err
+			// migrations are disable on recover, as we can't write to the loaded snapshot storage
+			if allowMigration {
+				if err := storage.Put(ctx, entry); err != nil {
+					return nil, err
+				}
+				if err = storage.Delete(ctx, deprecatedPath); err != nil {
+					return nil, err
+				}
 			}
 		}
 	}
+	return entry, nil
+}
+
+// readStoredKey reads a key from storage, returning nil if not found.
+// ignore-nil-nil-function-check
+func readStoredKey(ctx context.Context, storage logical.Storage, keyType string, allowMigration bool) (*keyStorageEntry, error) {
+	entry, err := readStoredKeyEntry(ctx, storage, keyType, allowMigration)
+	if err != nil {
+		return nil, err
+	}
 	if entry == nil {
 		return nil, nil
 	}
-
 	var keyEntry keyStorageEntry
 	if err := entry.DecodeJSON(&keyEntry); err != nil {
 		return nil, err
@@ -185,101 +229,99 @@ func caKey(ctx context.Context, storage logical.Storage, keyType string) (*keySt
 }
 
 func (b *backend) pathConfigCAUpdate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
-	var err error
+	found, err := caKeysConfigured(ctx, req.Storage)
+	if err != nil {
+		return nil, err
+	}
+	if found {
+		return logical.ErrorResponse("keys are already configured; delete them before reconfiguring"), nil
+	}
+
 	publicKey := data.Get("public_key").(string)
 	privateKey := data.Get("private_key").(string)
 
-	var generateSigningKey bool
+	managedKeyName := data.Get("managed_key_name").(string)
+	managedKeyID := data.Get("managed_key_id").(string)
 
-	generateSigningKeyRaw, ok := data.GetOk("generate_signing_key")
-	switch {
-	// explicitly set true
-	case ok && generateSigningKeyRaw.(bool):
-		if publicKey != "" || privateKey != "" {
-			return logical.ErrorResponse("public_key and private_key must not be set when generate_signing_key is set to true"), nil
-		}
+	useManagedKey := managedKeyName != "" || managedKeyID != ""
 
-		generateSigningKey = true
+	generateSigningKey := data.Get("generate_signing_key").(bool)
 
-	// explicitly set to false, or not set and we have both a public and private key
-	case ok, publicKey != "" && privateKey != "":
-		if publicKey == "" {
-			return logical.ErrorResponse("missing public_key"), nil
+	if useManagedKey {
+		generateSigningKey = false
+		err = b.createManagedKey(ctx, req.Storage, managedKeyName, managedKeyID)
+		if err != nil {
+			return nil, err
 		}
+	} else {
+		if publicKey != "" && privateKey != "" {
+			_, err := ssh.ParsePrivateKey([]byte(privateKey))
+			if err != nil {
+				return logical.ErrorResponse(fmt.Sprintf("Unable to parse private_key as an SSH private key: %v", err)), nil
+			}
 
-		if privateKey == "" {
-			return logical.ErrorResponse("missing private_key"), nil
-		}
+			_, err = parsePublicSSHKey(publicKey)
+			if err != nil {
+				return logical.ErrorResponse(fmt.Sprintf("Unable to parse public_key as an SSH public key: %v", err)), nil
+			}
+		} else if generateSigningKey {
+			keyType := data.Get("key_type").(string)
+			keyBits := data.Get("key_bits").(int)
 
-		_, err := ssh.ParsePrivateKey([]byte(privateKey))
-		if err != nil {
-			return logical.ErrorResponse(fmt.Sprintf("Unable to parse private_key as an SSH private key: %v", err)), nil
+			publicKey, privateKey, err = generateSSHKeyPair(b.Backend.GetRandomReader(), keyType, keyBits)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			return logical.ErrorResponse("if generate_signing_key is false, either both public_key and private_key or a managed key must be provided"), nil
 		}
 
-		_, err = parsePublicSSHKey(publicKey)
+		err = createStoredKey(ctx, req.Storage, publicKey, privateKey)
 		if err != nil {
-			return logical.ErrorResponse(fmt.Sprintf("Unable to parse public_key as an SSH public key: %v", err)), nil
+			return nil, err
 		}
-
-	// not set and no public/private key provided so generate
-	case publicKey == "" && privateKey == "":
-		generateSigningKey = true
-
-	// not set, but one or the other supplied
-	default:
-		return logical.ErrorResponse("only one of public_key and private_key set; both must be set to use, or both must be blank to auto-generate"), nil
 	}
 
 	if generateSigningKey {
-		keyType := data.Get("key_type").(string)
-		keyBits := data.Get("key_bits").(int)
-
-		publicKey, privateKey, err = generateSSHKeyPair(b.Backend.GetRandomReader(), keyType, keyBits)
-		if err != nil {
-			return nil, err
+		response := &logical.Response{
+			Data: map[string]interface{}{
+				"public_key": publicKey,
+			},
 		}
-	}
 
-	if publicKey == "" || privateKey == "" {
-		return nil, fmt.Errorf("failed to generate or parse the keys")
-	}
-
-	publicKeyEntry, err := caKey(ctx, req.Storage, caPublicKey)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read CA public key: %w", err)
+		return response, nil
 	}
 
-	privateKeyEntry, err := caKey(ctx, req.Storage, caPrivateKey)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read CA private key: %w", err)
-	}
+	return nil, nil
+}
 
-	if (publicKeyEntry != nil && publicKeyEntry.Key != "") || (privateKeyEntry != nil && privateKeyEntry.Key != "") {
-		return logical.ErrorResponse("keys are already configured; delete them before reconfiguring"), nil
+func createStoredKey(ctx context.Context, s logical.Storage, publicKey, privateKey string) error {
+	if publicKey == "" || privateKey == "" {
+		return fmt.Errorf("failed to generate or parse the keys")
 	}
 
 	entry, err := logical.StorageEntryJSON(caPublicKeyStoragePath, &keyStorageEntry{
 		Key: publicKey,
 	})
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	// Save the public key
-	err = req.Storage.Put(ctx, entry)
+	err = s.Put(ctx, entry)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	entry, err = logical.StorageEntryJSON(caPrivateKeyStoragePath, &keyStorageEntry{
 		Key: privateKey,
 	})
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	// Save the private key
-	err = req.Storage.Put(ctx, entry)
+	err = s.Put(ctx, entry)
 	if err != nil {
 		var mErr *multierror.Error
 
@@ -287,25 +329,15 @@ func (b *backend) pathConfigCAUpdate(ctx context.Context, req *logical.Request,
 
 		// If storing private key fails, the corresponding public key should be
 		// removed
-		if delErr := req.Storage.Delete(ctx, caPublicKeyStoragePath); delErr != nil {
+		if delErr := s.Delete(ctx, caPublicKeyStoragePath); delErr != nil {
 			mErr = multierror.Append(mErr, fmt.Errorf("failed to cleanup CA public key: %w", delErr))
-			return nil, mErr
+			return mErr
 		}
 
-		return nil, err
+		return err
 	}
 
-	if generateSigningKey {
-		response := &logical.Response{
-			Data: map[string]interface{}{
-				"public_key": publicKey,
-			},
-		}
-
-		return response, nil
-	}
-
-	return nil, nil
+	return nil
 }
 
 func generateSSHKeyPair(randomSource io.Reader, keyType string, keyBits int) (string, string, error) {
@@ -326,7 +358,7 @@ func generateSSHKeyPair(randomSource io.Reader, keyType string, keyBits int) (st
 			return "", "", fmt.Errorf("refusing to generate weak %v key: %v bits < 2048 bits", keyType, keyBits)
 		}
 
-		privateSeed, err := rsa.GenerateKey(randomSource, keyBits)
+		privateSeed, err := cryptoutil.GenerateRSAKey(randomSource, keyBits)
 		if err != nil {
 			return "", "", err
 		}
@@ -406,3 +438,172 @@ func generateSSHKeyPair(randomSource io.Reader, keyType string, keyBits int) (st
 
 	return string(ssh.MarshalAuthorizedKey(public)), string(pem.EncodeToMemory(privateBlock)), nil
 }
+
+func (b *backend) createManagedKey(ctx context.Context, s logical.Storage, managedKeyName, managedKeyId string) error {
+	var keyId managed_key.UUIDKey
+	var keyName managed_key.NameKey
+	var keyInfo *managed_key.ManagedKeyInfo
+	var err error
+
+	if managedKeyId != "" {
+		keyId = managed_key.UUIDKey(managedKeyId)
+		keyInfo, err = managed_key.GetManagedKeyInfo(ctx, b, keyId)
+	} else if managedKeyName != "" {
+		keyName = managed_key.NameKey(managedKeyName)
+		keyInfo, err = managed_key.GetManagedKeyInfo(ctx, b, keyName)
+	}
+
+	if err != nil {
+		return fmt.Errorf("error retrieving public key: %s", err)
+	}
+
+	entry, err := logical.StorageEntryJSON(caManagedKeyStoragePath, &managedKeyStorageEntry{
+		PublicKey: string(ssh.MarshalAuthorizedKey(keyInfo.PublicKey())),
+		KeyName:   keyInfo.Name,
+		KeyId:     keyInfo.Uuid,
+	})
+	if err != nil {
+		return fmt.Errorf("error creating storage entry: %s", err)
+	}
+
+	// Save the public key
+	err = s.Put(ctx, entry)
+	if err != nil {
+		return fmt.Errorf("error writing key entry to storage: %s", err)
+	}
+
+	return nil
+}
+
+func getCAPublicKey(ctx context.Context, storage logical.Storage, allowMigration bool) (string, error) {
+	var publicKey string
+
+	storedKeyEntry, err := readStoredKey(ctx, storage, caPublicKey, allowMigration)
+	if err != nil {
+		return "", err
+	}
+
+	if storedKeyEntry == nil {
+		managedKeyEntry, err := readManagedKey(ctx, storage)
+		if err != nil {
+			return "", err
+		}
+
+		if managedKeyEntry == nil {
+			return "", nil
+		}
+
+		publicKey = managedKeyEntry.PublicKey
+	} else {
+		publicKey = storedKeyEntry.Key
+	}
+
+	return publicKey, nil
+}
+
+func readManagedKey(ctx context.Context, storage logical.Storage) (*managedKeyStorageEntry, error) {
+	entry, err := storage.Get(ctx, caManagedKeyStoragePath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read CA key of type managed key: %w", err)
+	}
+
+	if entry == nil {
+		return nil, nil
+	}
+
+	var keyEntry managedKeyStorageEntry
+	if err := entry.DecodeJSON(&keyEntry); err != nil {
+		return nil, err
+	}
+
+	return &keyEntry, nil
+}
+
+func caKeysConfigured(ctx context.Context, s logical.Storage) (bool, error) {
+	const allowMigration = false // no need to allow migration when just checking for existence, we can do that later
+	publicKeyEntry, err := readStoredKey(ctx, s, caPublicKey, allowMigration)
+	if err != nil {
+		return false, fmt.Errorf("failed to read CA public key: %w", err)
+	}
+
+	privateKeyEntry, err := readStoredKey(ctx, s, caPrivateKey, allowMigration)
+	if err != nil {
+		return false, fmt.Errorf("failed to read CA private key: %w", err)
+	}
+
+	if (publicKeyEntry != nil && publicKeyEntry.Key != "") || (privateKeyEntry != nil && privateKeyEntry.Key != "") {
+		return true, nil
+	}
+
+	managedKeyEntry, err := readManagedKey(ctx, s)
+	if err != nil {
+		return false, fmt.Errorf("failed to read CA managed key: %w", err)
+	}
+
+	if managedKeyEntry != nil {
+		return true, nil
+	}
+
+	return false, nil
+}
+
+// pathConfigCARecover recovers the CA from the target snapshot back to the live storage.
+// ignore-nil-nil-function-check
+func (b *backend) pathConfigCARecover(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	// check live storage for existing keys. Disallow recovery if CA is already configured for consistency with create operation
+	found, err := caKeysConfigured(ctx, req.Storage)
+	if err != nil {
+		return nil, err
+	}
+	if found {
+		return logical.ErrorResponse("keys are already configured; delete them before recovering the CA"), nil
+	}
+
+	// fetch directly from the snapshot storage instead of following the usual restore procedure of getting the values
+	// from the req.Data, since those came from a previous CARead operation on the loaded snapshot, which only contains
+	// the public key.
+	snapshotStorage, err := logical.NewSnapshotStorageView(req)
+	if err != nil {
+		return nil, err
+	}
+	const allowMigration = false // prevent migration from deprecated paths as we can't allow writes on the snapshot storage
+	publicKeyEntry, err := readStoredKeyEntry(ctx, snapshotStorage, caPublicKey, allowMigration)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read CA public key for restore: %w", err)
+	}
+	privateKeyEntry, err := readStoredKeyEntry(ctx, snapshotStorage, caPrivateKey, allowMigration)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read CA private key for restore: %w", err)
+	}
+	managedKey, err := readManagedKey(ctx, snapshotStorage)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read CA managed key for restore: %w", err)
+	}
+
+	if publicKeyEntry == nil && privateKeyEntry == nil && managedKey == nil {
+		return logical.ErrorResponse("no CA keys found in snapshot storage to restore"), nil
+	}
+
+	// it's possible that we've read the keys from a deprecated path in the snapshot, but it should be automatically
+	// upgraded to the new path anyway, so we don't care about restoring it back to the deprecated path
+	if publicKeyEntry != nil {
+		err = req.Storage.Put(ctx, publicKeyEntry)
+		if err != nil {
+			return nil, fmt.Errorf("failed to restore public key entry in storage: %w", err)
+		}
+	}
+	if privateKeyEntry != nil {
+		err = req.Storage.Put(ctx, privateKeyEntry)
+		if err != nil {
+			return nil, fmt.Errorf("failed to restore private key entry in storage: %w", err)
+		}
+	}
+	if managedKey != nil {
+		err = b.createManagedKey(ctx, req.Storage, managedKey.KeyName.String(), managedKey.KeyId.String())
+		if err != nil {
+			return nil, fmt.Errorf("failed to restore managed key entry in storage: %w", err)
+		}
+	}
+
+	return nil, nil
+}
diff --git a/builtin/logical/ssh/path_config_ca_test.go b/builtin/logical/ssh/path_config_ca_test.go
index a096073c696..7e2090fc72d 100644
--- a/builtin/logical/ssh/path_config_ca_test.go
+++ b/builtin/logical/ssh/path_config_ca_test.go
@@ -1,14 +1,18 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"strings"
 	"testing"
 
+	"github.com/hashicorp/vault/sdk/helper/testhelpers/snapshots"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
 )
 
 func TestSSH_ConfigCAStorageUpgrade(t *testing.T) {
@@ -37,7 +41,7 @@ func TestSSH_ConfigCAStorageUpgrade(t *testing.T) {
 	}
 
 	// Reading it should return the key as well as upgrade the storage path
-	privateKeyEntry, err := caKey(context.Background(), config.StorageView, caPrivateKey)
+	privateKeyEntry, err := readStoredKey(context.Background(), config.StorageView, caPrivateKey, true)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -71,7 +75,7 @@ func TestSSH_ConfigCAStorageUpgrade(t *testing.T) {
 	}
 
 	// Reading it should return the key as well as upgrade the storage path
-	publicKeyEntry, err := caKey(context.Background(), config.StorageView, caPublicKey)
+	publicKeyEntry, err := readStoredKey(context.Background(), config.StorageView, caPublicKey, true)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -178,6 +182,28 @@ func TestSSH_ConfigCAUpdateDelete(t *testing.T) {
 	if err != nil || (resp != nil && resp.IsError()) {
 		t.Fatalf("bad: err: %v, resp:%v", err, resp)
 	}
+
+	// verify deletion of keys on deprecated path
+	err = config.StorageView.Put(context.Background(), &logical.StorageEntry{
+		Key:   caPublicKeyStoragePathDeprecated,
+		Value: []byte(testCAPublicKey),
+	})
+	require.NoError(t, err)
+	err = config.StorageView.Put(context.Background(), &logical.StorageEntry{
+		Key:   caPrivateKeyStoragePathDeprecated,
+		Value: []byte(testCAPrivateKey),
+	})
+	require.NoError(t, err)
+	caReq.Operation = logical.DeleteOperation
+	resp, err = b.HandleRequest(context.Background(), caReq)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("bad: err: %v, resp:%v", err, resp)
+	}
+	// ensure it was deleted
+	caReq.Operation = logical.ReadOperation
+	resp, err = b.HandleRequest(context.Background(), caReq)
+	require.NoError(t, err)
+	require.Error(t, resp.Error())
 }
 
 func createDeleteHelper(t *testing.T, b logical.Backend, config *logical.BackendConfig, index int, keyType string, keyBits int) {
@@ -259,6 +285,7 @@ func TestSSH_ConfigCAKeyTypes(t *testing.T) {
 		"key_type":                "ca",
 		"ttl":                     "30s",
 		"not_before_duration":     "2h",
+		"allow_empty_principals":  true,
 	}
 	roleReq := &logical.Request{
 		Operation: logical.UpdateOperation,
@@ -275,3 +302,414 @@ func TestSSH_ConfigCAKeyTypes(t *testing.T) {
 		createDeleteHelper(t, b, config, index, scenario.keyType, scenario.keyBits)
 	}
 }
+
+func TestReadManagedKey(t *testing.T) {
+	t.Parallel()
+
+	storage := &logical.InmemStorage{}
+	entry, err := readManagedKey(context.Background(), storage)
+	if err != nil {
+		t.Fatalf("error reading managed key: %s", err)
+	}
+
+	if entry != nil {
+		t.Fatal("expected nil, but got a non-nil return")
+	}
+
+	err = writeKey(context.Background(), storage, caManagedKeyStoragePath, "test-managed-key")
+	if err != nil {
+		t.Fatalf("error writing test key: %s", err)
+	}
+
+	entry, err = readManagedKey(context.Background(), storage)
+	if err != nil {
+		t.Fatalf("error reading managed key: %s", err)
+	}
+
+	if entry == nil {
+		t.Fatal("unexpected nil entry")
+	}
+
+	if entry.PublicKey != "test-managed-key" {
+		t.Fatalf("key value mismatch: expected %s, got %s", "test-managed-key", entry.PublicKey)
+	}
+}
+
+func TestReadStoredKey(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		privateKeyStoragePath string
+		publicKeyStoragePath  string
+		publicKey             string
+		privateKey            string
+	}{
+		"stored-keys-configured": {
+			privateKeyStoragePath: caPrivateKeyStoragePath,
+			publicKeyStoragePath:  caPublicKeyStoragePath,
+			publicKey:             testCAPublicKey,
+			privateKey:            testCAPrivateKey,
+		},
+	}
+
+	for name, tt := range testCases {
+		t.Run(name, func(t *testing.T) {
+			storage := &logical.InmemStorage{}
+
+			if err := writeKey(ctx, storage, tt.privateKeyStoragePath, tt.privateKey); err != nil {
+				t.Fatalf("error writing private key: %s", err)
+			}
+
+			if err := writeKey(ctx, storage, tt.publicKeyStoragePath, tt.publicKey); err != nil {
+				t.Fatalf("error writing public key: %s", err)
+			}
+
+			publicKeyEntry, err := readStoredKey(context.Background(), storage, caPublicKey, true)
+			if err != nil {
+				t.Fatalf("error reading public key: %s", err)
+			}
+
+			if publicKeyEntry.Key != tt.publicKey {
+				t.Fatalf("returned key does not match: expected %s, got %s", tt.publicKey, publicKeyEntry.Key)
+			}
+
+			privateKeyEntry, err := readStoredKey(context.Background(), storage, caPrivateKey, true)
+			if err != nil {
+				t.Fatalf("error reading private key: %s", err)
+			}
+
+			if privateKeyEntry.Key != tt.privateKey {
+				t.Fatalf("returned key does not match: expected %s, got %s", tt.privateKey, privateKeyEntry.Key)
+			}
+		})
+	}
+}
+
+func TestGetCAPublicKey(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		publicKeyStoragePath string
+		publicKey            string
+	}{
+		"stored-keys-configured": {
+			publicKeyStoragePath: caPublicKeyStoragePath,
+			publicKey:            testCAPublicKey,
+		},
+		"managed-key-configured": {
+			publicKeyStoragePath: caManagedKeyStoragePath,
+			publicKey:            testCAPublicKey,
+		},
+		"no-keys-configured": {},
+	}
+
+	for name, tt := range testCases {
+		t.Run(name, func(t *testing.T) {
+			storage := &logical.InmemStorage{}
+			err := writeKey(ctx, storage, tt.publicKeyStoragePath, tt.publicKey)
+			if err != nil {
+				t.Fatalf("error writing key: %s", err)
+			}
+
+			key, err := getCAPublicKey(ctx, storage, true)
+			if err != nil {
+				t.Fatalf("error retrieving public key: %s", err)
+			}
+
+			if key != tt.publicKey {
+				t.Fatalf("key values do not match: expected %s, got %s", tt.publicKey, key)
+			}
+		})
+	}
+}
+
+func TestCreateStoredKey(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		publicKey  string
+		privateKey string
+		expectErr  bool
+	}{
+		"both-keys-provided": {
+			publicKey:  testCAPublicKey,
+			privateKey: testCAPrivateKey,
+		},
+		"only-public-key": {
+			publicKey: testCAPublicKey,
+			expectErr: true,
+		},
+		"only-private-key": {
+			privateKey: testCAPrivateKey,
+			expectErr:  true,
+		},
+		"empty keys": {
+			expectErr: true,
+		},
+	}
+
+	for name, tt := range testCases {
+		t.Run(name, func(t *testing.T) {
+			storage := &logical.InmemStorage{}
+			err := createStoredKey(context.Background(), storage, tt.publicKey, tt.privateKey)
+			if err != nil && !tt.expectErr {
+				t.Fatalf("unexpected error: %s", err)
+			} else if err == nil && tt.expectErr {
+				t.Fatal("expected error, got nil")
+			}
+
+			if !tt.expectErr {
+				err = readKey(context.Background(), storage, caPublicKeyStoragePath)
+				if err != nil {
+					t.Fatalf("error reading public key: %s", err)
+				}
+
+				err = readKey(context.Background(), storage, caPrivateKeyStoragePath)
+				if err != nil {
+					t.Fatalf("error reading private key: %s", err)
+				}
+			}
+		})
+	}
+}
+
+func TestCAKeysConfigured(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		privateKeyStoragePath string
+		publicKeyStoragePath  string
+		publicKey             string
+		privateKey            string
+		expectedValue         bool
+	}{
+		"stored-keys-configured": {
+			privateKeyStoragePath: caPrivateKeyStoragePath,
+			publicKeyStoragePath:  caPublicKeyStoragePath,
+			publicKey:             testCAPublicKey,
+			privateKey:            testCAPrivateKey,
+			expectedValue:         true,
+		},
+		"deprecated-path-keys-configured": {
+			privateKeyStoragePath: caPrivateKeyStoragePathDeprecated,
+			publicKeyStoragePath:  caPublicKeyStoragePathDeprecated,
+			publicKey:             testCAPublicKey,
+			privateKey:            testCAPrivateKey,
+			expectedValue:         true,
+		},
+		"managed-key-configured": {
+			publicKeyStoragePath: caManagedKeyStoragePath,
+			publicKey:            testCAPublicKey,
+			expectedValue:        true,
+		},
+		"stored-keys-empty": {
+			privateKeyStoragePath: caPrivateKeyStoragePath,
+			publicKeyStoragePath:  caPublicKeyStoragePath,
+			expectedValue:         false,
+		},
+		"no-storage-entry": {
+			expectedValue: false,
+		},
+	}
+
+	for name, tt := range testCases {
+		t.Run(name, func(t *testing.T) {
+			storage := &logical.InmemStorage{}
+
+			if err := writeKey(ctx, storage, tt.privateKeyStoragePath, tt.privateKey); err != nil {
+				t.Fatalf("error writing private key: %s", err)
+			}
+
+			if err := writeKey(ctx, storage, tt.publicKeyStoragePath, tt.publicKey); err != nil {
+				t.Fatalf("error writing public key: %s", err)
+			}
+
+			keysConfigured, err := caKeysConfigured(context.Background(), storage)
+			if err != nil {
+				t.Fatalf("error checking for configured keys: %s", err)
+			}
+
+			if tt.expectedValue != keysConfigured {
+				t.Fatalf("unexpected return value: expected %v, got %v", tt.expectedValue, keysConfigured)
+			}
+		})
+	}
+}
+
+func writeKey(ctx context.Context, s logical.Storage, path, key string) error {
+	if path == "" {
+		return nil
+	}
+
+	var entry *logical.StorageEntry
+	var err error
+	switch path {
+	case caPublicKeyStoragePath, caPrivateKeyStoragePath:
+		entry, err = logical.StorageEntryJSON(path, &keyStorageEntry{Key: key})
+		if err != nil {
+			return err
+		}
+	case caPublicKeyStoragePathDeprecated, caPrivateKeyStoragePathDeprecated:
+		entry, err = logical.StorageEntryJSON(path, []byte(key))
+		if err != nil {
+			return err
+		}
+	case caManagedKeyStoragePath:
+		entry, err = logical.StorageEntryJSON(path, &managedKeyStorageEntry{
+			KeyId:     "test-key-id",
+			KeyName:   "test-key-name",
+			PublicKey: key,
+		})
+		if err != nil {
+			return err
+		}
+	default:
+		return fmt.Errorf("unexpected storage path %s", path)
+	}
+
+	return s.Put(ctx, entry)
+}
+
+func readKey(ctx context.Context, s logical.Storage, path string) error {
+	switch path {
+	case caPublicKeyStoragePath, caPrivateKeyStoragePath:
+		var entry keyStorageEntry
+
+		storageEntry, err := s.Get(ctx, path)
+		if err != nil {
+			return fmt.Errorf("error reading public key from storage: %s", err)
+		}
+
+		err = storageEntry.DecodeJSON(&entry)
+		if err != nil {
+			return fmt.Errorf("error decoding storage entry: %s", err)
+		}
+
+		if entry.Key == "" {
+			return errors.New("stored key was empty")
+		}
+	case caManagedKeyStoragePath:
+		var entry managedKeyStorageEntry
+
+		storageEntry, err := s.Get(ctx, path)
+		if err != nil {
+			return fmt.Errorf("error reading managed key from storage: %s", err)
+		}
+
+		err = storageEntry.DecodeJSON(&entry)
+		if err != nil {
+			return fmt.Errorf("error decoding storage entry: %s", err)
+		}
+
+		if entry.KeyId == "" || entry.KeyName == "" || entry.PublicKey == "" {
+			return errors.New("managed key storage fields were empty")
+		}
+	default:
+		return fmt.Errorf("unexpected storage path %s", path)
+	}
+
+	return nil
+}
+
+// TestCARecover verifies secret recovery of the SSH CA
+func TestCARecover(t *testing.T) {
+	var err error
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+
+	b, err := Factory(context.Background(), config)
+	if err != nil {
+		t.Fatalf("Cannot create backend: %s", err)
+	}
+	tc := snapshots.NewSnapshotTestCase(t, b)
+
+	// generate CA keys on the snapshot storage
+	_, err = b.HandleRequest(context.Background(), &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "config/ca",
+		Storage:   tc.SnapshotStorage(),
+		Data: map[string]interface{}{
+			"public_key":  testCAPublicKey,
+			"private_key": testCAPrivateKey,
+		},
+	})
+	require.NoError(t, err)
+
+	// write different CA to the regular storage
+	_, err = b.HandleRequest(context.Background(), &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "config/ca",
+		Storage:   tc.RegularStorage(),
+		Data: map[string]interface{}{
+			"generate_signing_key": true,
+		},
+	})
+	require.NoError(t, err)
+	t.Run("read no side effects", func(t *testing.T) {
+		tc.RunRead(t, "config/ca")
+	})
+
+	t.Run("recover succeeds", func(t *testing.T) {
+		tc.DoRecover(t, "config/ca")
+		data, err := b.HandleRequest(context.Background(), &logical.Request{
+			Operation: logical.ReadOperation,
+			Path:      "config/ca",
+			Storage:   tc.SnapshotStorage(),
+			Data: map[string]interface{}{
+				"public_key": "should be the actual public key but the SSH CA recovery doesn't really care as it reads directly from snapshot storage",
+			},
+		})
+		require.NoError(t, err)
+		require.NotNil(t, data)
+		require.Equal(t, testCAPublicKey, data.Data["public_key"])
+	})
+}
+
+// TestCARecoverMigration is the same as TestCARecover, but recovering from a snapshot with the data in the deprecated
+// storage paths, which ensures that the migration logic is skipped during recovery.
+func TestCARecoverMigration(t *testing.T) {
+	var err error
+	config := logical.TestBackendConfig()
+	config.StorageView = &logical.InmemStorage{}
+
+	b, err := Factory(context.Background(), config)
+	if err != nil {
+		t.Fatalf("Cannot create backend: %s", err)
+	}
+	tc := snapshots.NewSnapshotTestCase(t, b)
+	err = tc.SnapshotStorage().Put(context.Background(), &logical.StorageEntry{
+		Key:   caPublicKeyStoragePathDeprecated,
+		Value: []byte(testCAPublicKey),
+	})
+	require.NoError(t, err)
+	err = tc.SnapshotStorage().Put(context.Background(), &logical.StorageEntry{
+		Key:   caPrivateKeyStoragePathDeprecated,
+		Value: []byte(testCAPrivateKey),
+	})
+	require.NoError(t, err)
+
+	require.NoError(t, err)
+	t.Run("read no side effects", func(t *testing.T) {
+		tc.RunRead(t, "config/ca")
+	})
+
+	t.Run("recover succeeds", func(t *testing.T) {
+		tc.DoRecover(t, "config/ca")
+		// ensure that even though the migration on read is disabled, by reading from the old path in the snapshot and
+		// creating a entry in the regular storage, that the entry ends up in the new path
+		entry, err := tc.RegularStorage().Get(context.Background(), caPublicKeyStoragePathDeprecated)
+		require.NoError(t, err)
+		require.Nil(t, entry)
+		data, err := b.HandleRequest(context.Background(), &logical.Request{
+			Operation: logical.ReadOperation,
+			Path:      "config/ca",
+			Storage:   tc.SnapshotStorage(),
+			Data: map[string]interface{}{
+				"public_key": "should be the actual public key but the SSH CA recovery doesn't really care as it reads directly from snapshot storage",
+			},
+		})
+		require.NoError(t, err)
+		require.NotNil(t, data)
+		require.Equal(t, testCAPublicKey, data.Data["public_key"])
+	})
+}
diff --git a/builtin/logical/ssh/path_config_zeroaddress.go b/builtin/logical/ssh/path_config_zeroaddress.go
index a84d03d7c49..e8ec10ba6a6 100644
--- a/builtin/logical/ssh/path_config_zeroaddress.go
+++ b/builtin/logical/ssh/path_config_zeroaddress.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
diff --git a/builtin/logical/ssh/path_creds_create.go b/builtin/logical/ssh/path_creds_create.go
index 781ce056f9d..66248f9a0b4 100644
--- a/builtin/logical/ssh/path_creds_create.go
+++ b/builtin/logical/ssh/path_creds_create.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
diff --git a/builtin/logical/ssh/path_fetch.go b/builtin/logical/ssh/path_fetch.go
index da5935bbd44..5ce642283b7 100644
--- a/builtin/logical/ssh/path_fetch.go
+++ b/builtin/logical/ssh/path_fetch.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
@@ -29,18 +29,19 @@ func pathFetchPublicKey(b *backend) *framework.Path {
 }
 
 func (b *backend) pathFetchPublicKey(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
-	publicKeyEntry, err := caKey(ctx, req.Storage, caPublicKey)
+	const allowMigration = true // only paths that support snapshot reads are
+	publicKey, err := getCAPublicKey(ctx, req.Storage, allowMigration)
 	if err != nil {
 		return nil, err
 	}
-	if publicKeyEntry == nil || publicKeyEntry.Key == "" {
+	if publicKey == "" {
 		return nil, nil
 	}
 
 	response := &logical.Response{
 		Data: map[string]interface{}{
 			logical.HTTPContentType: "text/plain",
-			logical.HTTPRawBody:     []byte(publicKeyEntry.Key),
+			logical.HTTPRawBody:     []byte(publicKey),
 			logical.HTTPStatusCode:  200,
 		},
 	}
diff --git a/builtin/logical/ssh/path_issue.go b/builtin/logical/ssh/path_issue.go
index 422f6621ee0..9df8e71470e 100644
--- a/builtin/logical/ssh/path_issue.go
+++ b/builtin/logical/ssh/path_issue.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
@@ -58,7 +58,7 @@ be later than the role max TTL.`,
 			},
 			"valid_principals": {
 				Type:        framework.TypeString,
-				Description: `Valid principals, either usernames or hostnames, that the certificate should be signed for.`,
+				Description: `Valid principals, either usernames or hostnames, that the certificate should be signed for.  Must be non-empty unless allow_empty_principals=true (not recommended) or a value for DefaultUser has been set in the role`,
 			},
 			"cert_type": {
 				Type:        framework.TypeString,
diff --git a/builtin/logical/ssh/path_issue_sign.go b/builtin/logical/ssh/path_issue_sign.go
index 91fca5a4085..2f15a7adda9 100644
--- a/builtin/logical/ssh/path_issue_sign.go
+++ b/builtin/logical/ssh/path_issue_sign.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
@@ -20,6 +20,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	"github.com/hashicorp/vault/builtin/logical/ssh/managed_key"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/strutil"
@@ -101,17 +102,9 @@ func (b *backend) pathSignIssueCertificateHelper(ctx context.Context, req *logic
 		return logical.ErrorResponse(err.Error()), nil
 	}
 
-	privateKeyEntry, err := caKey(ctx, req.Storage, caPrivateKey)
+	signer, err := b.getCASigner(ctx, req.Storage)
 	if err != nil {
-		return nil, fmt.Errorf("failed to read CA private key: %w", err)
-	}
-	if privateKeyEntry == nil || privateKeyEntry.Key == "" {
-		return nil, errors.New("failed to read CA private key")
-	}
-
-	signer, err := ssh.ParsePrivateKey([]byte(privateKeyEntry.Key))
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse stored CA private key: %w", err)
+		return nil, fmt.Errorf("error creating signer: %w", err)
 	}
 
 	cBundle := creationBundle{
@@ -189,10 +182,19 @@ func (b *backend) calculateValidPrincipals(data *framework.FieldData, req *logic
 		allowedPrincipals = strutil.RemoveDuplicates(strutil.ParseStringSlice(principalsAllowedByRole, ","), false)
 	}
 
+	if len(parsedPrincipals) == 0 && defaultPrincipal != "" {
+		// defaultPrincipal will either be the defaultUser or a rendered defaultUserTemplate
+		parsedPrincipals = []string{defaultPrincipal}
+	}
+
 	switch {
 	case len(parsedPrincipals) == 0:
-		// There is nothing to process
-		return nil, nil
+		if role.AllowEmptyPrincipals {
+			// There is nothing to process
+			return nil, nil
+		} else {
+			return nil, fmt.Errorf("empty valid principals not allowed by role")
+		}
 	case len(allowedPrincipals) == 0:
 		// User has requested principals to be set, but role is not configured
 		// with any principals
@@ -559,3 +561,40 @@ func createKeyTypeToMapKey(keyType string, keyBits int) map[string][]string {
 
 	return keyTypeToMapKey
 }
+
+func (b *backend) getCASigner(ctx context.Context, s logical.Storage) (ssh.Signer, error) {
+	var signer ssh.Signer
+
+	const allowMigration = true // migration from deprecated paths is allowed when signing
+	storedKey, err := readStoredKey(ctx, s, caPrivateKey, allowMigration)
+	if err != nil {
+		return nil, fmt.Errorf("error reading stored key: %w", err)
+	}
+
+	if storedKey != nil {
+		if storedKey.Key == "" {
+			return nil, errors.New("stored private key was empty")
+		}
+
+		signer, err = ssh.ParsePrivateKey([]byte(storedKey.Key))
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse stored CA private key: %w", err)
+		}
+	} else {
+		managedKey, err := readManagedKey(ctx, s)
+		if err != nil {
+			return nil, fmt.Errorf("error reading managed key: %w", err)
+		}
+
+		if managedKey == nil {
+			return nil, errors.New("no keys configured")
+		}
+
+		signer, err = managed_key.GetManagedKeyInfo(ctx, b, managedKey.KeyId)
+		if err != nil {
+			return nil, fmt.Errorf("error getting managed key info: %w", err)
+		}
+	}
+
+	return signer, nil
+}
diff --git a/builtin/logical/ssh/path_lookup.go b/builtin/logical/ssh/path_lookup.go
index f3a6b58ecc3..3376b85e8c7 100644
--- a/builtin/logical/ssh/path_lookup.go
+++ b/builtin/logical/ssh/path_lookup.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
diff --git a/builtin/logical/ssh/path_roles.go b/builtin/logical/ssh/path_roles.go
index 5e1a00194a9..dc138b4f4cc 100644
--- a/builtin/logical/ssh/path_roles.go
+++ b/builtin/logical/ssh/path_roles.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
@@ -66,6 +66,7 @@ type sshRole struct {
 	AlgorithmSigner            string            `mapstructure:"algorithm_signer" json:"algorithm_signer"`
 	Version                    int               `mapstructure:"role_version" json:"role_version"`
 	NotBeforeDuration          time.Duration     `mapstructure:"not_before_duration" json:"not_before_duration"`
+	AllowEmptyPrincipals       bool              `mapstructure:"allow_empty_principals" json:"allow_empty_principals"`
 }
 
 func pathListRoles(b *backend) *framework.Path {
@@ -363,6 +364,11 @@ func pathRoles(b *backend) *framework.Path {
 					Value: 30,
 				},
 			},
+			"allow_empty_principals": {
+				Type:        framework.TypeBool,
+				Description: `Whether to allow issuing certificates with no valid principals (meaning any valid principal).  Exists for backwards compatibility only, the default of false is highly recommended.`,
+				Default:     false,
+			},
 		},
 
 		Callbacks: map[logical.Operation]framework.OperationFunc{
@@ -499,6 +505,7 @@ func (b *backend) createCARole(allowedUsers, defaultUser, signer string, data *f
 		AlgorithmSigner:           signer,
 		Version:                   roleEntryVersion,
 		NotBeforeDuration:         time.Duration(data.Get("not_before_duration").(int)) * time.Second,
+		AllowEmptyPrincipals:      data.Get("allow_empty_principals").(bool),
 	}
 
 	if !role.AllowUserCertificates && !role.AllowHostCertificates {
@@ -587,17 +594,18 @@ func (b *backend) checkUpgrade(ctx context.Context, s logical.Storage, n string,
 		// signing key type as we want to make ssh-rsa an explicitly notated
 		// algorithm choice.
 		var publicKey ssh.PublicKey
-		publicKeyEntry, err := caKey(ctx, s, caPublicKey)
+		const allowPathMigration = true
+		publicKeyStr, err := getCAPublicKey(ctx, s, allowPathMigration)
 		if err != nil {
 			b.Logger().Debug(fmt.Sprintf("failed to load public key entry while attempting to migrate: %v", err))
 			goto SKIPVERSION2
 		}
-		if publicKeyEntry == nil || publicKeyEntry.Key == "" {
+		if publicKeyStr == "" {
 			b.Logger().Debug(fmt.Sprintf("got empty public key entry while attempting to migrate"))
 			goto SKIPVERSION2
 		}
 
-		publicKey, err = parsePublicSSHKey(publicKeyEntry.Key)
+		publicKey, err = parsePublicSSHKey(publicKeyStr)
 		if err == nil {
 			// Move an empty signing algorithm to an explicit ssh-rsa (SHA-1)
 			// if this key is of type RSA. This isn't a secure default but
@@ -691,6 +699,7 @@ func (b *backend) parseRole(role *sshRole) (map[string]interface{}, error) {
 			"allowed_user_key_lengths":    role.AllowedUserKeyTypesLengths,
 			"algorithm_signer":            role.AlgorithmSigner,
 			"not_before_duration":         int64(role.NotBeforeDuration.Seconds()),
+			"allow_empty_principals":      role.AllowEmptyPrincipals,
 		}
 	case KeyTypeDynamic:
 		return nil, fmt.Errorf("dynamic key type roles are no longer supported")
diff --git a/builtin/logical/ssh/path_sign.go b/builtin/logical/ssh/path_sign.go
index 20bd2259a34..f9b85d8e497 100644
--- a/builtin/logical/ssh/path_sign.go
+++ b/builtin/logical/ssh/path_sign.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
diff --git a/builtin/logical/ssh/path_verify.go b/builtin/logical/ssh/path_verify.go
index 323fecd0279..a83526a5a17 100644
--- a/builtin/logical/ssh/path_verify.go
+++ b/builtin/logical/ssh/path_verify.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
diff --git a/builtin/logical/ssh/secret_otp.go b/builtin/logical/ssh/secret_otp.go
index 522c60e2dfd..eeed10aacf5 100644
--- a/builtin/logical/ssh/secret_otp.go
+++ b/builtin/logical/ssh/secret_otp.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
diff --git a/builtin/logical/ssh/util.go b/builtin/logical/ssh/util.go
index 89980ada013..3d3605ffae0 100644
--- a/builtin/logical/ssh/util.go
+++ b/builtin/logical/ssh/util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ssh
@@ -6,7 +6,6 @@ package ssh
 import (
 	"context"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/x509"
 	"encoding/base64"
 	"encoding/pem"
@@ -15,6 +14,7 @@ import (
 	"strings"
 
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"golang.org/x/crypto/ssh"
 )
@@ -22,7 +22,7 @@ import (
 // Creates a new RSA key pair with the given key length. The private key will be
 // of pem format and the public key will be of OpenSSH format.
 func generateRSAKeys(keyBits int) (publicKeyRsa string, privateKeyRsa string, err error) {
-	privateKey, err := rsa.GenerateKey(rand.Reader, keyBits)
+	privateKey, err := cryptoutil.GenerateRSAKey(rand.Reader, keyBits)
 	if err != nil {
 		return "", "", fmt.Errorf("error generating RSA key-pair: %w", err)
 	}
diff --git a/builtin/logical/totp/backend.go b/builtin/logical/totp/backend.go
index 08cbe385a01..75a0612d5fd 100644
--- a/builtin/logical/totp/backend.go
+++ b/builtin/logical/totp/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package totp
diff --git a/builtin/logical/totp/backend_test.go b/builtin/logical/totp/backend_test.go
index 1d3ba4d4f9c..bccd4c28b4c 100644
--- a/builtin/logical/totp/backend_test.go
+++ b/builtin/logical/totp/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package totp
@@ -339,6 +339,8 @@ func TestBackend_keyCrudDefaultValues(t *testing.T) {
 			testAccStepReadKey(t, "test", expected),
 			testAccStepValidateCode(t, "test", code, true, false),
 			// Next step should fail because it should be in the used cache
+			testAccStepValidateCode(t, "test", code+" ", false, true),
+			testAccStepValidateCode(t, "test", "  "+code, false, true),
 			testAccStepValidateCode(t, "test", code, false, true),
 			testAccStepValidateCode(t, "test", invalidCode, false, false),
 			testAccStepDeleteKey(t, "test"),
diff --git a/builtin/logical/totp/cmd/totp/main.go b/builtin/logical/totp/cmd/totp/main.go
index c051e133a4c..68c5bd04a9e 100644
--- a/builtin/logical/totp/cmd/totp/main.go
+++ b/builtin/logical/totp/cmd/totp/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/logical/totp/path_code.go b/builtin/logical/totp/path_code.go
index 7e7278c10f8..2502fafdf0b 100644
--- a/builtin/logical/totp/path_code.go
+++ b/builtin/logical/totp/path_code.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package totp
@@ -6,6 +6,7 @@ package totp
 import (
 	"context"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/hashicorp/vault/sdk/framework"
@@ -86,7 +87,7 @@ func (b *backend) pathReadCode(ctx context.Context, req *logical.Request, data *
 
 func (b *backend) pathValidateCode(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 	name := data.Get("name").(string)
-	code := data.Get("code").(string)
+	code := strings.TrimSpace(data.Get("code").(string))
 
 	// Enforce input value requirements
 	if code == "" {
diff --git a/builtin/logical/totp/path_keys.go b/builtin/logical/totp/path_keys.go
index 049ddddad3e..22548d649d3 100644
--- a/builtin/logical/totp/path_keys.go
+++ b/builtin/logical/totp/path_keys.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package totp
diff --git a/builtin/logical/transit/api_utils.go b/builtin/logical/transit/api_utils.go
new file mode 100644
index 00000000000..c783fdd0877
--- /dev/null
+++ b/builtin/logical/transit/api_utils.go
@@ -0,0 +1,29 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package transit
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/vault/sdk/helper/keysutil"
+)
+
+// parsePaddingSchemeArg validate that the provided padding scheme argument received on the api can be used.
+func parsePaddingSchemeArg(keyType keysutil.KeyType, rawPs any) (keysutil.PaddingScheme, error) {
+	ps, ok := rawPs.(string)
+	if !ok {
+		return "", fmt.Errorf("argument was not a string: %T", rawPs)
+	}
+
+	paddingScheme, err := keysutil.ParsePaddingScheme(ps)
+	if err != nil {
+		return "", err
+	}
+
+	if !keyType.PaddingSchemesSupported() {
+		return "", fmt.Errorf("unsupported key type %s for padding scheme", keyType.String())
+	}
+
+	return paddingScheme, nil
+}
diff --git a/builtin/logical/transit/api_utils_test.go b/builtin/logical/transit/api_utils_test.go
new file mode 100644
index 00000000000..97503b3070e
--- /dev/null
+++ b/builtin/logical/transit/api_utils_test.go
@@ -0,0 +1,52 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package transit
+
+import (
+	"testing"
+
+	"github.com/hashicorp/vault/sdk/helper/keysutil"
+)
+
+// Test_parsePaddingSchemeArg validate the various use cases we have around parsing
+// the various padding_scheme arg possible values.
+func Test_parsePaddingSchemeArg(t *testing.T) {
+	type args struct {
+		keyType keysutil.KeyType
+		rawPs   any
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    keysutil.PaddingScheme
+		wantErr bool
+	}{
+		// Error cases
+		{name: "nil-ps", args: args{keyType: keysutil.KeyType_RSA2048, rawPs: nil}, wantErr: true},
+		{name: "nonstring-ps", args: args{keyType: keysutil.KeyType_RSA2048, rawPs: 5}, wantErr: true},
+		{name: "invalid-ps", args: args{keyType: keysutil.KeyType_RSA2048, rawPs: "unknown"}, wantErr: true},
+		{name: "bad-keytype-oaep", args: args{keyType: keysutil.KeyType_AES128_CMAC, rawPs: "oaep"}, wantErr: true},
+		{name: "bad-keytype-pkcs1", args: args{keyType: keysutil.KeyType_ECDSA_P256, rawPs: "pkcs1v15"}, wantErr: true},
+		{name: "oaep-capped", args: args{keyType: keysutil.KeyType_RSA4096, rawPs: "OAEP"}, wantErr: true},
+		{name: "pkcs1-whitespace", args: args{keyType: keysutil.KeyType_RSA3072, rawPs: "   pkcs1v15    "}, wantErr: true},
+
+		// Valid cases
+		{name: "oaep-2048", args: args{keyType: keysutil.KeyType_RSA2048, rawPs: "oaep"}, want: keysutil.PaddingScheme_OAEP},
+		{name: "oaep-3072", args: args{keyType: keysutil.KeyType_RSA3072, rawPs: "oaep"}, want: keysutil.PaddingScheme_OAEP},
+		{name: "oaep-4096", args: args{keyType: keysutil.KeyType_RSA4096, rawPs: "oaep"}, want: keysutil.PaddingScheme_OAEP},
+		{name: "pkcs1", args: args{keyType: keysutil.KeyType_RSA3072, rawPs: "pkcs1v15"}, want: keysutil.PaddingScheme_PKCS1v15},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := parsePaddingSchemeArg(tt.args.keyType, tt.args.rawPs)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("parsePaddingSchemeArg() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("parsePaddingSchemeArg() got = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/builtin/logical/transit/backend.go b/builtin/logical/transit/backend.go
index e30d7660496..ff71198a1c9 100644
--- a/builtin/logical/transit/backend.go
+++ b/builtin/logical/transit/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/keysutil"
@@ -26,6 +27,8 @@ const (
 	minCacheSize = 10
 )
 
+var ErrKeyTypeEntOnly = "key type %s is only available in enterprise versions of Vault"
+
 func Factory(ctx context.Context, conf *logical.BackendConfig) (logical.Backend, error) {
 	b, err := Backend(ctx, conf)
 	if err != nil {
@@ -77,10 +80,12 @@ func Backend(ctx context.Context, conf *logical.BackendConfig) (*backend, error)
 			b.pathImportCertChain(),
 		},
 
-		Secrets:      []*framework.Secret{},
-		Invalidate:   b.invalidate,
-		BackendType:  logical.TypeLogical,
-		PeriodicFunc: b.periodicFunc,
+		Secrets:        []*framework.Secret{},
+		Invalidate:     b.invalidate,
+		BackendType:    logical.TypeLogical,
+		PeriodicFunc:   b.periodicFunc,
+		InitializeFunc: b.initialize,
+		Clean:          b.cleanup,
 	}
 
 	b.backendUUID = conf.BackendUUID
@@ -107,11 +112,15 @@ func Backend(ctx context.Context, conf *logical.BackendConfig) (*backend, error)
 		return nil, err
 	}
 
+	b.setupEnt()
+
 	return &b, nil
 }
 
 type backend struct {
 	*framework.Backend
+	entBackend
+
 	lm *keysutil.LockManager
 	// Lock to make changes to any of the backend's cache configuration.
 	configMutex          sync.RWMutex
@@ -168,6 +177,11 @@ func (b *backend) GetPolicy(ctx context.Context, polReq keysutil.PolicyRequest,
 	if err != nil {
 		return p, false, err
 	}
+
+	if p != nil && p.Type.IsEnterpriseOnly() && !constants.IsEnterprise {
+		return nil, false, fmt.Errorf(ErrKeyTypeEntOnly, p.Type)
+	}
+
 	return p, true, nil
 }
 
@@ -185,6 +199,8 @@ func (b *backend) invalidate(ctx context.Context, key string) {
 		defer b.configMutex.Unlock()
 		b.cacheSizeChanged = true
 	}
+
+	b.invalidateEnt(ctx, key)
 }
 
 // periodicFunc is a central collection of functions that run on an interval.
@@ -203,7 +219,11 @@ func (b *backend) periodicFunc(ctx context.Context, req *logical.Request) error
 		b.autoRotateOnce = sync.Once{}
 	}
 
-	return err
+	if err != nil {
+		return err
+	}
+
+	return b.periodicFuncEnt(ctx, req)
 }
 
 // autoRotateKeys retrieves all transit keys and rotates those which have an
@@ -292,3 +312,11 @@ func (b *backend) rotateIfRequired(ctx context.Context, req *logical.Request, ke
 	}
 	return nil
 }
+
+func (b *backend) initialize(ctx context.Context, request *logical.InitializationRequest) error {
+	return b.initializeEnt(ctx, request)
+}
+
+func (b *backend) cleanup(ctx context.Context) {
+	b.cleanupEnt(ctx)
+}
diff --git a/builtin/logical/transit/backend_ce.go b/builtin/logical/transit/backend_ce.go
new file mode 100644
index 00000000000..6cf0d373cf9
--- /dev/null
+++ b/builtin/logical/transit/backend_ce.go
@@ -0,0 +1,35 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package transit
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/helper/keysutil"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+type entBackend struct{}
+
+func (b *backend) initializeEnt(_ context.Context, _ *logical.InitializationRequest) error {
+	return nil
+}
+
+func (b *backend) invalidateEnt(_ context.Context, _ string) {}
+
+func (b *backend) periodicFuncEnt(_ context.Context, _ *logical.Request) error { return nil }
+
+func (b *backend) cleanupEnt(_ context.Context) {}
+
+func (b *backend) setupEnt() {}
+
+func entEncodePrivateKey(_ string, p *keysutil.Policy, _ *keysutil.KeyEntry) (string, error) {
+	return "", nil
+}
+
+func entEncodePublicKey(_ string, p *keysutil.Policy, _ *keysutil.KeyEntry) (string, error) {
+	return "", nil
+}
diff --git a/builtin/logical/transit/backend_test.go b/builtin/logical/transit/backend_test.go
index 528ccf68218..f99df68ba15 100644
--- a/builtin/logical/transit/backend_test.go
+++ b/builtin/logical/transit/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -148,83 +148,96 @@ func testTransit_RSA(t *testing.T, keyType string) {
 
 	plaintext := "dGhlIHF1aWNrIGJyb3duIGZveA==" // "the quick brown fox"
 
-	encryptReq := &logical.Request{
-		Path:      "encrypt/rsa",
-		Operation: logical.UpdateOperation,
-		Storage:   storage,
-		Data: map[string]interface{}{
-			"plaintext": plaintext,
-		},
-	}
+	for _, padding := range []keysutil.PaddingScheme{keysutil.PaddingScheme_OAEP, keysutil.PaddingScheme_PKCS1v15, ""} {
+		encryptReq := &logical.Request{
+			Path:      "encrypt/rsa",
+			Operation: logical.UpdateOperation,
+			Storage:   storage,
+			Data: map[string]interface{}{
+				"plaintext": plaintext,
+			},
+		}
 
-	resp, err = b.HandleRequest(context.Background(), encryptReq)
-	if err != nil || (resp != nil && resp.IsError()) {
-		t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
-	}
+		if padding != "" {
+			encryptReq.Data["padding_scheme"] = padding
+		}
 
-	ciphertext1 := resp.Data["ciphertext"].(string)
+		resp, err = b.HandleRequest(context.Background(), encryptReq)
+		if err != nil || (resp != nil && resp.IsError()) {
+			t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
+		}
 
-	decryptReq := &logical.Request{
-		Path:      "decrypt/rsa",
-		Operation: logical.UpdateOperation,
-		Storage:   storage,
-		Data: map[string]interface{}{
-			"ciphertext": ciphertext1,
-		},
-	}
+		ciphertext1 := resp.Data["ciphertext"].(string)
 
-	resp, err = b.HandleRequest(context.Background(), decryptReq)
-	if err != nil || (resp != nil && resp.IsError()) {
-		t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
-	}
+		decryptReq := &logical.Request{
+			Path:      "decrypt/rsa",
+			Operation: logical.UpdateOperation,
+			Storage:   storage,
+			Data: map[string]interface{}{
+				"ciphertext": ciphertext1,
+			},
+		}
+		if padding != "" {
+			decryptReq.Data["padding_scheme"] = padding
+		}
 
-	decryptedPlaintext := resp.Data["plaintext"]
+		resp, err = b.HandleRequest(context.Background(), decryptReq)
+		if err != nil || (resp != nil && resp.IsError()) {
+			t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
+		}
 
-	if plaintext != decryptedPlaintext {
-		t.Fatalf("bad: plaintext; expected: %q\nactual: %q", plaintext, decryptedPlaintext)
-	}
+		decryptedPlaintext := resp.Data["plaintext"]
 
-	// Rotate the key
-	rotateReq := &logical.Request{
-		Path:      "keys/rsa/rotate",
-		Operation: logical.UpdateOperation,
-		Storage:   storage,
-	}
-	resp, err = b.HandleRequest(context.Background(), rotateReq)
-	if err != nil || (resp != nil && resp.IsError()) {
-		t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
-	}
+		if plaintext != decryptedPlaintext {
+			t.Fatalf("bad: plaintext; expected: %q\nactual: %q", plaintext, decryptedPlaintext)
+		}
 
-	// Encrypt again
-	resp, err = b.HandleRequest(context.Background(), encryptReq)
-	if err != nil || (resp != nil && resp.IsError()) {
-		t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
-	}
-	ciphertext2 := resp.Data["ciphertext"].(string)
+		// Rotate the key
+		rotateReq := &logical.Request{
+			Path:      "keys/rsa/rotate",
+			Operation: logical.UpdateOperation,
+			Storage:   storage,
+		}
+		resp, err = b.HandleRequest(context.Background(), rotateReq)
+		if err != nil || (resp != nil && resp.IsError()) {
+			t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
+		}
 
-	if ciphertext1 == ciphertext2 {
-		t.Fatalf("expected different ciphertexts")
-	}
+		// Encrypt again
+		resp, err = b.HandleRequest(context.Background(), encryptReq)
+		if err != nil || (resp != nil && resp.IsError()) {
+			t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
+		}
+		ciphertext2 := resp.Data["ciphertext"].(string)
 
-	// See if the older ciphertext can still be decrypted
-	resp, err = b.HandleRequest(context.Background(), decryptReq)
-	if err != nil || (resp != nil && resp.IsError()) {
-		t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
-	}
-	if resp.Data["plaintext"].(string) != plaintext {
-		t.Fatal("failed to decrypt old ciphertext after rotating the key")
-	}
+		if ciphertext1 == ciphertext2 {
+			t.Fatalf("expected different ciphertexts")
+		}
 
-	// Decrypt the new ciphertext
-	decryptReq.Data = map[string]interface{}{
-		"ciphertext": ciphertext2,
-	}
-	resp, err = b.HandleRequest(context.Background(), decryptReq)
-	if err != nil || (resp != nil && resp.IsError()) {
-		t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
-	}
-	if resp.Data["plaintext"].(string) != plaintext {
-		t.Fatal("failed to decrypt ciphertext after rotating the key")
+		// See if the older ciphertext can still be decrypted
+		resp, err = b.HandleRequest(context.Background(), decryptReq)
+		if err != nil || (resp != nil && resp.IsError()) {
+			t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
+		}
+		if resp.Data["plaintext"].(string) != plaintext {
+			t.Fatal("failed to decrypt old ciphertext after rotating the key")
+		}
+
+		// Decrypt the new ciphertext
+		decryptReq.Data = map[string]interface{}{
+			"ciphertext": ciphertext2,
+		}
+		if padding != "" {
+			decryptReq.Data["padding_scheme"] = padding
+		}
+
+		resp, err = b.HandleRequest(context.Background(), decryptReq)
+		if err != nil || (resp != nil && resp.IsError()) {
+			t.Fatalf("bad: err: %v\nresp: %#v", err, resp)
+		}
+		if resp.Data["plaintext"].(string) != plaintext {
+			t.Fatal("failed to decrypt ciphertext after rotating the key")
+		}
 	}
 
 	signReq := &logical.Request{
diff --git a/builtin/logical/transit/cmd/transit/main.go b/builtin/logical/transit/cmd/transit/main.go
index 701f7f00e76..6c91593f824 100644
--- a/builtin/logical/transit/cmd/transit/main.go
+++ b/builtin/logical/transit/cmd/transit/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/builtin/logical/transit/key_utils.go b/builtin/logical/transit/key_utils.go
new file mode 100644
index 00000000000..e6c37bf437f
--- /dev/null
+++ b/builtin/logical/transit/key_utils.go
@@ -0,0 +1,62 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package transit
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/vault/sdk/helper/keysutil"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+func (b *backend) getReadLockedPolicy(ctx context.Context, s logical.Storage, name string) (*keysutil.Policy, error) {
+	p, _, err := b.GetPolicy(ctx, keysutil.PolicyRequest{
+		Storage: s,
+		Name:    name,
+	}, b.GetRandomReader())
+	if err != nil {
+		return nil, err
+	}
+	if p == nil {
+		return nil, fmt.Errorf("%w: key %s not found", logical.ErrInvalidRequest, name)
+	}
+	if !b.System().CachingDisabled() {
+		p.Lock(false)
+	}
+	return p, nil
+}
+
+// runWithReadLockedPolicy runs a function passing in the policy specified by keyName that has been
+// locked in a read only fashion without the ability to upsert the policy
+func (b *backend) runWithReadLockedPolicy(ctx context.Context, s logical.Storage, keyName string, f func(p *keysutil.Policy) (*logical.Response, error)) (*logical.Response, error) {
+	p, err := b.getReadLockedPolicy(ctx, s, keyName)
+	if err != nil {
+		if errors.Is(err, logical.ErrInvalidRequest) {
+			return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
+		}
+		return nil, err
+	}
+	defer p.Unlock()
+	return f(p)
+}
+
+// validateKeyVersion verifies that the passed in key version is valid for our
+// current key policy, returning correct version to use within the policy.
+func validateKeyVersion(p *keysutil.Policy, ver int) (int, error) {
+	switch {
+	case ver < 0:
+		return 0, fmt.Errorf("cannot use negative key version %d", ver)
+	case ver == 0:
+		// Allowed, will use latest; set explicitly here to ensure the string
+		// is generated properly
+		ver = p.LatestVersion
+	case ver == p.LatestVersion:
+		// Allowed
+	case p.MinEncryptionVersion > 0 && ver < p.MinEncryptionVersion:
+		return 0, fmt.Errorf("cannot use key version %d: version is too old (disallowed by policy) for key %s", ver, p.Name)
+	}
+	return ver, nil
+}
diff --git a/builtin/logical/transit/managed_key_util.go b/builtin/logical/transit/managed_key_util.go
index ccc1c324f2e..d32b959ed30 100644
--- a/builtin/logical/transit/managed_key_util.go
+++ b/builtin/logical/transit/managed_key_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/builtin/logical/transit/path_backup.go b/builtin/logical/transit/path_backup.go
index 019a28408e6..854452a38fe 100644
--- a/builtin/logical/transit/path_backup.go
+++ b/builtin/logical/transit/path_backup.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_backup_test.go b/builtin/logical/transit/path_backup_test.go
index 05d7a10f600..2f022ae97fc 100644
--- a/builtin/logical/transit/path_backup_test.go
+++ b/builtin/logical/transit/path_backup_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_byok.go b/builtin/logical/transit/path_byok.go
index 4826203352c..ad0a848b454 100644
--- a/builtin/logical/transit/path_byok.go
+++ b/builtin/logical/transit/path_byok.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -13,6 +13,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/keysutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -97,6 +98,10 @@ func (b *backend) pathPolicyBYOKExportRead(ctx context.Context, req *logical.Req
 		return logical.ErrorResponse("key is not exportable"), nil
 	}
 
+	if srcP.Type.IsEnterpriseOnly() && !constants.IsEnterprise {
+		return logical.ErrorResponse(fmt.Sprintf(ErrKeyTypeEntOnly, srcP.Type)), logical.ErrInvalidRequest
+	}
+
 	retKeys := map[string]string{}
 	switch version {
 	case "":
@@ -154,7 +159,7 @@ func getBYOKExportKey(dstP *keysutil.Policy, srcP *keysutil.Policy, key *keysuti
 
 	var targetKey interface{}
 	switch srcP.Type {
-	case keysutil.KeyType_AES128_GCM96, keysutil.KeyType_AES256_GCM96, keysutil.KeyType_ChaCha20_Poly1305, keysutil.KeyType_HMAC:
+	case keysutil.KeyType_AES128_GCM96, keysutil.KeyType_AES256_GCM96, keysutil.KeyType_ChaCha20_Poly1305, keysutil.KeyType_HMAC, keysutil.KeyType_AES128_CMAC, keysutil.KeyType_AES256_CMAC, keysutil.KeyType_AES192_CMAC, keysutil.KeyType_AES128_CBC, keysutil.KeyType_AES256_CBC:
 		targetKey = key.Key
 	case keysutil.KeyType_RSA2048, keysutil.KeyType_RSA3072, keysutil.KeyType_RSA4096:
 		targetKey = key.RSAKey
diff --git a/builtin/logical/transit/path_byok_test.go b/builtin/logical/transit/path_byok_test.go
index 44dbafa18be..23e3e4fe0b1 100644
--- a/builtin/logical/transit/path_byok_test.go
+++ b/builtin/logical/transit/path_byok_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_cache_config.go b/builtin/logical/transit/path_cache_config.go
index 941f98250ad..ff6d023333b 100644
--- a/builtin/logical/transit/path_cache_config.go
+++ b/builtin/logical/transit/path_cache_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_cache_config_test.go b/builtin/logical/transit/path_cache_config_test.go
index 0141f6a32de..5e533e19d9a 100644
--- a/builtin/logical/transit/path_cache_config_test.go
+++ b/builtin/logical/transit/path_cache_config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_certificates.go b/builtin/logical/transit/path_certificates.go
index aa4aeb55f6c..14fc0dcb859 100644
--- a/builtin/logical/transit/path_certificates.go
+++ b/builtin/logical/transit/path_certificates.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_certificates_test.go b/builtin/logical/transit/path_certificates_test.go
index 9a6305e7a04..c6024ba9bc5 100644
--- a/builtin/logical/transit/path_certificates_test.go
+++ b/builtin/logical/transit/path_certificates_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -6,7 +6,6 @@ package transit
 import (
 	"context"
 	cryptoRand "crypto/rand"
-	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
@@ -17,6 +16,7 @@ import (
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/builtin/logical/pki"
 	vaulthttp "github.com/hashicorp/vault/http"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 	"github.com/stretchr/testify/require"
@@ -167,7 +167,7 @@ func testTransit_ImportCertChain(t *testing.T, apiClient *api.Client, keyType st
 	require.NoError(t, err)
 
 	// Setup a new CSR
-	privKey, err := rsa.GenerateKey(cryptoRand.Reader, 3072)
+	privKey, err := cryptoutil.GenerateRSAKey(cryptoRand.Reader, 3072)
 	require.NoError(t, err)
 
 	var csrTemplate x509.CertificateRequest
diff --git a/builtin/logical/transit/path_cmac_ce.go b/builtin/logical/transit/path_cmac_ce.go
new file mode 100644
index 00000000000..2dfcb8c934e
--- /dev/null
+++ b/builtin/logical/transit/path_cmac_ce.go
@@ -0,0 +1,18 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package transit
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+func (b *backend) pathCMACVerify(_ context.Context, _ *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
+	return logical.ErrorResponse(fmt.Sprintf(ErrKeyTypeEntOnly, "cmac")), nil
+}
diff --git a/builtin/logical/transit/path_config_keys.go b/builtin/logical/transit/path_config_keys.go
index 45c38ac49f8..8e0c6241cd5 100644
--- a/builtin/logical/transit/path_config_keys.go
+++ b/builtin/logical/transit/path_config_keys.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_config_keys_test.go b/builtin/logical/transit/path_config_keys_test.go
index d5aa12b9cfd..0c1d2ce0e95 100644
--- a/builtin/logical/transit/path_config_keys_test.go
+++ b/builtin/logical/transit/path_config_keys_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_datakey.go b/builtin/logical/transit/path_datakey.go
index 53aff54690b..72e6849edb9 100644
--- a/builtin/logical/transit/path_datakey.go
+++ b/builtin/logical/transit/path_datakey.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -17,6 +17,14 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
+type DataKeyParams struct {
+	keyVersion int
+	bits       int
+	context    []byte
+	nonce      []byte
+	factories  []any
+}
+
 func (b *backend) pathDatakey() *framework.Path {
 	return &framework.Path{
 		Pattern: "datakey/" + framework.GenericNameRegex("plaintext") + "/" + framework.GenericNameRegex("name"),
@@ -39,6 +47,12 @@ func (b *backend) pathDatakey() *framework.Path {
 ciphertext; "wrapped" will return the ciphertext only.`,
 			},
 
+			"padding_scheme": {
+				Type: framework.TypeString,
+				Description: `The padding scheme to use for decrypt. Currently only applies to RSA key types.
+Options are 'oaep' or 'pkcs1v15'. Defaults to 'oaep'`,
+			},
+
 			"context": {
 				Type:        framework.TypeString,
 				Description: "Context for key derivation. Required for derived keys.",
@@ -75,8 +89,12 @@ min_encryption_version configured on the key.`,
 }
 
 func (b *backend) pathDatakeyWrite(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	params, err := getDataKeyParams(d)
+	if err != nil {
+		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
+	}
+
 	name := d.Get("name").(string)
-	ver := d.Get("key_version").(int)
 
 	plaintext := d.Get("plaintext").(string)
 	plaintextAllowed := false
@@ -88,28 +106,6 @@ func (b *backend) pathDatakeyWrite(ctx context.Context, req *logical.Request, d
 		return logical.ErrorResponse("Invalid path, must be 'plaintext' or 'wrapped'"), logical.ErrInvalidRequest
 	}
 
-	var err error
-
-	// Decode the context if any
-	contextRaw := d.Get("context").(string)
-	var context []byte
-	if len(contextRaw) != 0 {
-		context, err = base64.StdEncoding.DecodeString(contextRaw)
-		if err != nil {
-			return logical.ErrorResponse("failed to base64-decode context"), logical.ErrInvalidRequest
-		}
-	}
-
-	// Decode the nonce if any
-	nonceRaw := d.Get("nonce").(string)
-	var nonce []byte
-	if len(nonceRaw) != 0 {
-		nonce, err = base64.StdEncoding.DecodeString(nonceRaw)
-		if err != nil {
-			return logical.ErrorResponse("failed to base64-decode nonce"), logical.ErrInvalidRequest
-		}
-	}
-
 	// Get the policy
 	p, _, err := b.GetPolicy(ctx, keysutil.PolicyRequest{
 		Storage: req.Storage,
@@ -126,80 +122,130 @@ func (b *backend) pathDatakeyWrite(ctx context.Context, req *logical.Request, d
 	}
 	defer p.Unlock()
 
-	newKey := make([]byte, 32)
-	bits := d.Get("bits").(int)
-	switch bits {
-	case 512:
-		newKey = make([]byte, 64)
-	case 256:
-	case 128:
-		newKey = make([]byte, 16)
-	default:
-		return logical.ErrorResponse("invalid bit length"), logical.ErrInvalidRequest
+	params.factories = make([]any, 0)
+	if ps, ok := d.GetOk("padding_scheme"); ok {
+		paddingScheme, err := parsePaddingSchemeArg(p.Type, ps)
+		if err != nil {
+			return logical.ErrorResponse(fmt.Sprintf("padding_scheme argument invalid: %s", err.Error())), logical.ErrInvalidRequest
+		}
+		params.factories = append(params.factories, paddingScheme)
+
+	}
+
+	keyVersion := params.keyVersion
+	if params.keyVersion == 0 {
+		keyVersion = p.LatestVersion
+	}
+
+	resp := &logical.Response{
+		Data: map[string]interface{}{
+			"key_version": keyVersion,
+		},
 	}
-	_, err = rand.Read(newKey)
+
+	if len(params.nonce) > 0 && !nonceAllowed(p) {
+		return nil, ErrNonceNotAllowed
+	}
+
+	if constants.IsFIPS() && shouldWarnAboutNonceUsage(p, params.nonce) {
+		resp.AddWarning("A provided nonce value was used within FIPS mode, this violates FIPS 140 compliance.")
+	}
+
+	ciphertext, plaintext, err := b.generateDataKey(ctx, p, params)
 	if err != nil {
-		return nil, err
+		switch err.(type) {
+		case errutil.UserError:
+			return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
+		case errutil.InternalError:
+			return nil, err
+		default:
+			return nil, err
+		}
 	}
 
-	var managedKeyFactory ManagedKeyFactory
+	resp.Data["ciphertext"] = ciphertext
+
+	if plaintextAllowed {
+		resp.Data["plaintext"] = plaintext
+	}
+
+	return resp, nil
+}
+
+func (b *backend) generateDataKey(ctx context.Context, p *keysutil.Policy, params *DataKeyParams) (string, string, error) {
+	factories := params.factories
 	if p.Type == keysutil.KeyType_MANAGED_KEY {
 		managedKeySystemView, ok := b.System().(logical.ManagedKeySystemView)
 		if !ok {
-			return nil, errors.New("unsupported system view")
+			return "", "", errors.New("unsupported system view")
 		}
 
-		managedKeyFactory = ManagedKeyFactory{
+		factories = append(params.factories, ManagedKeyFactory{
 			managedKeyParams: keysutil.ManagedKeyParameters{
 				ManagedKeySystemView: managedKeySystemView,
 				BackendUUID:          b.backendUUID,
 				Context:              ctx,
 			},
-		}
+		})
 	}
 
-	ciphertext, err := p.EncryptWithFactory(ver, context, nonce, base64.StdEncoding.EncodeToString(newKey), nil, managedKeyFactory)
+	newKey := make([]byte, params.bits/8)
+
+	_, err := rand.Read(newKey)
 	if err != nil {
-		switch err.(type) {
-		case errutil.UserError:
-			return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
-		case errutil.InternalError:
-			return nil, err
-		default:
-			return nil, err
-		}
+		return "", "", err
 	}
 
-	if ciphertext == "" {
-		return nil, fmt.Errorf("empty ciphertext returned")
+	opts := keysutil.EncryptionOptions{
+		KeyVersion: params.keyVersion,
+		Context:    params.context,
+		Nonce:      params.nonce,
 	}
 
-	keyVersion := ver
-	if keyVersion == 0 {
-		keyVersion = p.LatestVersion
+	ciphertext, err := p.EncryptWithOptions(opts, base64.StdEncoding.EncodeToString(newKey), factories...)
+	if err != nil {
+		return "", "", err
 	}
 
-	// Generate the response
-	resp := &logical.Response{
-		Data: map[string]interface{}{
-			"ciphertext":  ciphertext,
-			"key_version": keyVersion,
-		},
+	if ciphertext == "" {
+		return "", "", fmt.Errorf("empty ciphertext returned")
 	}
 
-	if len(nonce) > 0 && !nonceAllowed(p) {
-		return nil, ErrNonceNotAllowed
+	return ciphertext, base64.StdEncoding.EncodeToString(newKey), nil
+}
+
+func getDataKeyParams(d *framework.FieldData) (*DataKeyParams, error) {
+	params := &DataKeyParams{}
+
+	var err error
+	params.keyVersion = d.Get("key_version").(int)
+
+	// Decode the context if any
+	if contextRaw, ok := d.GetOk("context"); ok {
+		if context, ok := contextRaw.(string); ok && len(context) != 0 {
+			params.context, err = base64.StdEncoding.DecodeString(context)
+			if err != nil {
+				return nil, errors.New("failed to base64-decode context")
+			}
+		}
 	}
 
-	if constants.IsFIPS() && shouldWarnAboutNonceUsage(p, nonce) {
-		resp.AddWarning("A provided nonce value was used within FIPS mode, this violates FIPS 140 compliance.")
+	// Decode the nonce if any
+	if nonceRaw, ok := d.GetOk("nonce"); ok {
+		if nonce, ok := nonceRaw.(string); ok && len(nonce) != 0 {
+			params.nonce, err = base64.StdEncoding.DecodeString(nonce)
+			if err != nil {
+				return nil, errors.New("failed to base64-decode nonce")
+			}
+		}
 	}
 
-	if plaintextAllowed {
-		resp.Data["plaintext"] = base64.StdEncoding.EncodeToString(newKey)
+	params.bits = d.Get("bits").(int)
+	if params.bits != 128 && params.bits != 256 && params.bits != 512 {
+		return nil, errors.New("invalid bit length")
 	}
 
-	return resp, nil
+	return params, nil
 }
 
 const pathDatakeyHelpSyn = `Generate a data key`
diff --git a/builtin/logical/transit/path_datakey_test.go b/builtin/logical/transit/path_datakey_test.go
new file mode 100644
index 00000000000..085e5302960
--- /dev/null
+++ b/builtin/logical/transit/path_datakey_test.go
@@ -0,0 +1,125 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package transit
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/mitchellh/mapstructure"
+	"github.com/stretchr/testify/require"
+)
+
+// TestDataKeyWithPaddingScheme validates that we properly leverage padding scheme
+// args for the returned keys
+func TestDataKeyWithPaddingScheme(t *testing.T) {
+	b, s := createBackendWithStorage(t)
+	keyName := "test"
+	createKeyReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "keys/" + keyName,
+		Storage:   s,
+		Data: map[string]interface{}{
+			"type": "rsa-2048",
+		},
+	}
+
+	resp, err := b.HandleRequest(context.Background(), createKeyReq)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("failed key creation: err: %v resp: %#v", err, resp)
+	}
+
+	tests := []struct {
+		Name                 string
+		PaddingScheme        string
+		DecryptPaddingScheme string
+		ShouldFailToDecrypt  bool
+	}{
+		{"no-padding-scheme", "", "", false},
+		{"oaep", "oaep", "oaep", false},
+		{"pkcs1v15", "pkcs1v15", "pkcs1v15", false},
+		{"mixed-should-fail", "pkcs1v15", "oaep", true},
+		{"mixed-based-on-default-should-fail", "", "pkcs1v15", true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.Name, func(t *testing.T) {
+			dataKeyReq := &logical.Request{
+				Operation: logical.UpdateOperation,
+				Path:      "datakey/wrapped/" + keyName,
+				Storage:   s,
+				Data:      map[string]interface{}{},
+			}
+			if len(tc.PaddingScheme) > 0 {
+				dataKeyReq.Data["padding_scheme"] = tc.PaddingScheme
+			}
+
+			resp, err = b.HandleRequest(context.Background(), dataKeyReq)
+			if err != nil || (resp != nil && resp.IsError()) {
+				t.Fatalf("failed data key api: err: %v resp: %#v", err, resp)
+			}
+			require.NotNil(t, resp, "Got nil nil response")
+			var d struct {
+				Ciphertext string `mapstructure:"ciphertext"`
+			}
+			err = mapstructure.Decode(resp.Data, &d)
+			require.NoError(t, err, "failed decoding datakey api response")
+			require.NotEmpty(t, d.Ciphertext, "ciphertext should not be empty")
+
+			// Attempt to decrypt with data key with the same padding scheme
+			decryptReq := &logical.Request{
+				Operation: logical.UpdateOperation,
+				Path:      "decrypt/" + keyName,
+				Storage:   s,
+				Data: map[string]interface{}{
+					"ciphertext": d.Ciphertext,
+				},
+			}
+			if len(tc.DecryptPaddingScheme) > 0 {
+				decryptReq.Data["padding_scheme"] = tc.DecryptPaddingScheme
+			}
+
+			resp, err = b.HandleRequest(context.Background(), decryptReq)
+			if tc.ShouldFailToDecrypt {
+				require.Error(t, err, "Should have failed decryption as padding schemes are mixed")
+			} else {
+				if err != nil || (resp != nil && resp.IsError()) {
+					t.Fatalf("failed to decrypt data key: err: %v resp: %#v", err, resp)
+				}
+			}
+		})
+	}
+}
+
+// TestDataKeyWithPaddingSchemeInvalidKeyType validates we fail when we specify a
+// padding_scheme value on an invalid key type (non-RSA)
+func TestDataKeyWithPaddingSchemeInvalidKeyType(t *testing.T) {
+	b, s := createBackendWithStorage(t)
+	keyName := "test"
+	createKeyReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "keys/" + keyName,
+		Storage:   s,
+		Data:      map[string]interface{}{},
+	}
+
+	resp, err := b.HandleRequest(context.Background(), createKeyReq)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("failed key creation: err: %v resp: %#v", err, resp)
+	}
+
+	dataKeyReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "datakey/wrapped/" + keyName,
+		Storage:   s,
+		Data: map[string]interface{}{
+			"padding_scheme": "oaep",
+		},
+	}
+
+	resp, err = b.HandleRequest(context.Background(), dataKeyReq)
+	require.ErrorContains(t, err, "invalid request")
+	require.NotNil(t, resp, "response should not be nil")
+	require.Contains(t, resp.Error().Error(), "padding_scheme argument invalid: unsupported key")
+}
diff --git a/builtin/logical/transit/path_decrypt.go b/builtin/logical/transit/path_decrypt.go
index 1daf74daf5d..5b86289d052 100644
--- a/builtin/logical/transit/path_decrypt.go
+++ b/builtin/logical/transit/path_decrypt.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -50,6 +50,12 @@ func (b *backend) pathDecrypt() *framework.Path {
 The ciphertext to decrypt, provided as returned by encrypt.`,
 			},
 
+			"padding_scheme": {
+				Type: framework.TypeString,
+				Description: `The padding scheme to use for decrypt. Currently only applies to RSA key types.
+Options are 'oaep' or 'pkcs1v15'. Defaults to 'oaep'`,
+			},
+
 			"context": {
 				Type: framework.TypeString,
 				Description: `
@@ -130,6 +136,9 @@ func (b *backend) pathDecryptWrite(ctx context.Context, req *logical.Request, d
 			Nonce:          d.Get("nonce").(string),
 			AssociatedData: d.Get("associated_data").(string),
 		}
+		if ps, ok := d.GetOk("padding_scheme"); ok {
+			batchInputItems[0].PaddingScheme = ps.(string)
+		}
 	}
 
 	batchResponseItems := make([]DecryptBatchResponseItem, len(batchInputItems))
@@ -192,33 +201,45 @@ func (b *backend) pathDecryptWrite(ctx context.Context, req *logical.Request, d
 			continue
 		}
 
-		var factory interface{}
+		var factories []any
+		if item.PaddingScheme != "" {
+			paddingScheme, err := parsePaddingSchemeArg(p.Type, item.PaddingScheme)
+			if err != nil {
+				batchResponseItems[i].Error = fmt.Sprintf("'[%d].padding_scheme' invalid: %s", i, err.Error())
+				continue
+			}
+			factories = append(factories, paddingScheme)
+		}
 		if item.AssociatedData != "" {
 			if !p.Type.AssociatedDataSupported() {
 				batchResponseItems[i].Error = fmt.Sprintf("'[%d].associated_data' provided for non-AEAD cipher suite %v", i, p.Type.String())
 				continue
 			}
 
-			factory = AssocDataFactory{item.AssociatedData}
+			factories = append(factories, AssocDataFactory{item.AssociatedData})
 		}
 
-		var managedKeyFactory ManagedKeyFactory
 		if p.Type == keysutil.KeyType_MANAGED_KEY {
 			managedKeySystemView, ok := b.System().(logical.ManagedKeySystemView)
 			if !ok {
 				batchResponseItems[i].Error = errors.New("unsupported system view").Error()
 			}
 
-			managedKeyFactory = ManagedKeyFactory{
+			factories = append(factories, ManagedKeyFactory{
 				managedKeyParams: keysutil.ManagedKeyParameters{
 					ManagedKeySystemView: managedKeySystemView,
 					BackendUUID:          b.backendUUID,
 					Context:              ctx,
 				},
-			}
+			})
+		}
+
+		opts := keysutil.EncryptionOptions{
+			Context: item.DecodedContext,
+			Nonce:   item.DecodedNonce,
 		}
 
-		plaintext, err := p.DecryptWithFactory(item.DecodedContext, item.DecodedNonce, item.Ciphertext, factory, managedKeyFactory)
+		plaintext, err := p.DecryptWithOptions(opts, item.Ciphertext, factories...)
 		if err != nil {
 			switch err.(type) {
 			case errutil.InternalError:
diff --git a/builtin/logical/transit/path_decrypt_bench_test.go b/builtin/logical/transit/path_decrypt_bench_test.go
index d0816fdb644..3f274fd80c0 100644
--- a/builtin/logical/transit/path_decrypt_bench_test.go
+++ b/builtin/logical/transit/path_decrypt_bench_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_decrypt_test.go b/builtin/logical/transit/path_decrypt_test.go
index a61d85ddc2a..244fbec4188 100644
--- a/builtin/logical/transit/path_decrypt_test.go
+++ b/builtin/logical/transit/path_decrypt_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_encrypt.go b/builtin/logical/transit/path_encrypt.go
index 38c618f9b36..aef4a2fafd1 100644
--- a/builtin/logical/transit/path_encrypt.go
+++ b/builtin/logical/transit/path_encrypt.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -34,6 +34,9 @@ type BatchRequestItem struct {
 	// Ciphertext for decryption
 	Ciphertext string `json:"ciphertext" structs:"ciphertext" mapstructure:"ciphertext"`
 
+	// PaddingScheme for encryption/decryption
+	PaddingScheme string `json:"padding_scheme" structs:"padding_scheme" mapstructure:"padding_scheme"`
+
 	// Nonce to be used when v1 convergent encryption is used
 	Nonce string `json:"nonce" structs:"nonce" mapstructure:"nonce"`
 
@@ -49,6 +52,12 @@ type BatchRequestItem struct {
 	// Reference is an arbitrary caller supplied string value that will be placed on the
 	// batch response to ease correlation between inputs and outputs
 	Reference string `json:"reference" structs:"reference" mapstructure:"reference"`
+
+	// IV is the user-supplied IV to be used for AES-CBC encryption
+	IV string `json:"iv" structs:"iv" mapstructure:"iv"`
+
+	// DecodedIV is the base64 decoded version of IV
+	DecodedIV []byte
 }
 
 // EncryptBatchResponseItem represents a response item for batch processing
@@ -105,6 +114,12 @@ func (b *backend) pathEncrypt() *framework.Path {
 				Description: "Base64 encoded plaintext value to be encrypted",
 			},
 
+			"padding_scheme": {
+				Type: framework.TypeString,
+				Description: `The padding scheme to use for decrypt. Currently only applies to RSA key types.
+Options are 'oaep' or 'pkcs1v15'. Defaults to 'oaep'`,
+			},
+
 			"context": {
 				Type:        framework.TypeString,
 				Description: "Base64 encoded context for key derivation. Required if key derivation is enabled",
@@ -177,6 +192,12 @@ Specifies a list of items to be encrypted in a single batch. When this parameter
 is set, if the parameters 'plaintext', 'context' and 'nonce' are also set, they
 will be ignored. Any batch output will preserve the order of the batch input.`,
 			},
+			"iv": {
+				Type: framework.TypeString,
+				Description: `
+Specifies a base64-encoded IV to use with AES-CBC. The length of the IV must
+be 16 bytes (128 bits).'`,
+			},
 		},
 
 		Callbacks: map[logical.Operation]framework.OperationFunc{
@@ -259,6 +280,13 @@ func decodeBatchRequestItems(src interface{}, requirePlaintext bool, requireCiph
 		} else if requirePlaintext {
 			errs.Errors = append(errs.Errors, fmt.Sprintf("'[%d].plaintext' missing plaintext to encrypt", i))
 		}
+		if v, has := item["padding_scheme"]; has {
+			if casted, ok := v.(string); ok {
+				(*dst)[i].PaddingScheme = casted
+			} else {
+				errs.Errors = append(errs.Errors, fmt.Sprintf("'[%d].padding_scheme' expected type 'string', got unconvertible type '%T'", i, item["padding_scheme"]))
+			}
+		}
 
 		if v, has := item["nonce"]; has {
 			if !reflect.ValueOf(v).IsValid() {
@@ -302,6 +330,15 @@ func decodeBatchRequestItems(src interface{}, requirePlaintext bool, requireCiph
 				errs.Errors = append(errs.Errors, fmt.Sprintf("'[%d].reference' expected type 'string', got unconvertible type '%T'", i, item["reference"]))
 			}
 		}
+
+		if v, has := item["iv"]; has {
+			if !reflect.ValueOf(v).IsValid() {
+			} else if casted, ok := v.(string); ok {
+				(*dst)[i].IV = casted
+			} else {
+				errs.Errors = append(errs.Errors, fmt.Sprintf("'[%d].iv' expected type 'string', got unconvertible type '%T'", i, item["iv"]))
+			}
+		}
 	}
 
 	if len(errs.Errors) > 0 {
@@ -357,6 +394,14 @@ func (b *backend) pathEncryptWrite(ctx context.Context, req *logical.Request, d
 			Nonce:          d.Get("nonce").(string),
 			KeyVersion:     d.Get("key_version").(int),
 			AssociatedData: d.Get("associated_data").(string),
+			IV:             d.Get("iv").(string),
+		}
+		if psRaw, ok := d.GetOk("padding_scheme"); ok {
+			if ps, ok := psRaw.(string); ok {
+				batchInputItems[0].PaddingScheme = ps
+			} else {
+				return logical.ErrorResponse("padding_scheme was not a string"), logical.ErrInvalidRequest
+			}
 		}
 	}
 
@@ -401,6 +446,16 @@ func (b *backend) pathEncryptWrite(ctx context.Context, req *logical.Request, d
 				continue
 			}
 		}
+
+		// Decode the IV
+		if len(item.IV) > 0 {
+			batchInputItems[i].DecodedIV, err = base64.StdEncoding.DecodeString(item.IV)
+			if err != nil {
+				userErrorInBatch = true
+				batchResponseItems[i].Error = err.Error()
+				continue
+			}
+		}
 	}
 
 	// Get the policy
@@ -435,10 +490,20 @@ func (b *backend) pathEncryptWrite(ctx context.Context, req *logical.Request, d
 			polReq.KeyType = keysutil.KeyType_AES256_GCM96
 		case "chacha20-poly1305":
 			polReq.KeyType = keysutil.KeyType_ChaCha20_Poly1305
+		case "rsa-2048":
+			polReq.KeyType = keysutil.KeyType_RSA2048
+		case "rsa-3072":
+			polReq.KeyType = keysutil.KeyType_RSA3072
+		case "rsa-4096":
+			polReq.KeyType = keysutil.KeyType_RSA4096
 		case "ecdsa-p256", "ecdsa-p384", "ecdsa-p521":
 			return logical.ErrorResponse(fmt.Sprintf("key type %v not supported for this operation", keyType)), logical.ErrInvalidRequest
 		case "managed_key":
 			polReq.KeyType = keysutil.KeyType_MANAGED_KEY
+		case "aes128-cbc":
+			polReq.KeyType = keysutil.KeyType_AES128_CBC
+		case "aes256-cbc":
+			polReq.KeyType = keysutil.KeyType_AES256_CBC
 		default:
 			return logical.ErrorResponse(fmt.Sprintf("unknown key type %v", keyType)), logical.ErrInvalidRequest
 		}
@@ -482,33 +547,47 @@ func (b *backend) pathEncryptWrite(ctx context.Context, req *logical.Request, d
 			warnAboutNonceUsage = true
 		}
 
-		var factory interface{}
+		var factories []any
+		if item.PaddingScheme != "" {
+			paddingScheme, err := parsePaddingSchemeArg(p.Type, item.PaddingScheme)
+			if err != nil {
+				batchResponseItems[i].Error = fmt.Sprintf("'[%d].padding_scheme' invalid: %s", i, err.Error())
+				continue
+			}
+			factories = append(factories, paddingScheme)
+		}
 		if item.AssociatedData != "" {
 			if !p.Type.AssociatedDataSupported() {
 				batchResponseItems[i].Error = fmt.Sprintf("'[%d].associated_data' provided for non-AEAD cipher suite %v", i, p.Type.String())
 				continue
 			}
 
-			factory = AssocDataFactory{item.AssociatedData}
+			factories = append(factories, AssocDataFactory{item.AssociatedData})
 		}
 
-		var managedKeyFactory ManagedKeyFactory
 		if p.Type == keysutil.KeyType_MANAGED_KEY {
 			managedKeySystemView, ok := b.System().(logical.ManagedKeySystemView)
 			if !ok {
 				batchResponseItems[i].Error = errors.New("unsupported system view").Error()
 			}
 
-			managedKeyFactory = ManagedKeyFactory{
+			factories = append(factories, ManagedKeyFactory{
 				managedKeyParams: keysutil.ManagedKeyParameters{
 					ManagedKeySystemView: managedKeySystemView,
 					BackendUUID:          b.backendUUID,
 					Context:              ctx,
 				},
-			}
+			})
+		}
+
+		opts := keysutil.EncryptionOptions{
+			KeyVersion: item.KeyVersion,
+			Context:    item.DecodedContext,
+			Nonce:      item.DecodedNonce,
+			IV:         item.DecodedIV,
 		}
 
-		ciphertext, err := p.EncryptWithFactory(item.KeyVersion, item.DecodedContext, item.DecodedNonce, item.Plaintext, factory, managedKeyFactory)
+		ciphertext, err := p.EncryptWithOptions(opts, item.Plaintext, factories...)
 		if err != nil {
 			switch err.(type) {
 			case errutil.InternalError:
diff --git a/builtin/logical/transit/path_encrypt_bench_test.go b/builtin/logical/transit/path_encrypt_bench_test.go
index a57c90fa7d6..650356c0331 100644
--- a/builtin/logical/transit/path_encrypt_bench_test.go
+++ b/builtin/logical/transit/path_encrypt_bench_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_encrypt_test.go b/builtin/logical/transit/path_encrypt_test.go
index e46d32a5f06..be1c52ab232 100644
--- a/builtin/logical/transit/path_encrypt_test.go
+++ b/builtin/logical/transit/path_encrypt_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_export.go b/builtin/logical/transit/path_export.go
index c47b2b67354..9fae7df444f 100644
--- a/builtin/logical/transit/path_export.go
+++ b/builtin/logical/transit/path_export.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -16,6 +16,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/keysutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -27,6 +28,7 @@ const (
 	exportTypeHMACKey          = "hmac-key"
 	exportTypePublicKey        = "public-key"
 	exportTypeCertificateChain = "certificate-chain"
+	exportTypeCMACKey          = "cmac-key"
 )
 
 func (b *backend) pathExportKeys() *framework.Path {
@@ -42,7 +44,7 @@ func (b *backend) pathExportKeys() *framework.Path {
 		Fields: map[string]*framework.FieldSchema{
 			"type": {
 				Type:        framework.TypeString,
-				Description: "Type of key to export (encryption-key, signing-key, hmac-key, public-key)",
+				Description: "Type of key to export (encryption-key, signing-key, hmac-key, public-key, cmac-key)",
 			},
 			"name": {
 				Type:        framework.TypeString,
@@ -74,6 +76,10 @@ func (b *backend) pathPolicyExportRead(ctx context.Context, req *logical.Request
 	case exportTypeHMACKey:
 	case exportTypePublicKey:
 	case exportTypeCertificateChain:
+	case exportTypeCMACKey:
+		if !constants.IsEnterprise {
+			return logical.ErrorResponse(fmt.Sprintf(ErrKeyTypeEntOnly, exportTypeCMACKey)), logical.ErrInvalidRequest
+		}
 	default:
 		return logical.ErrorResponse(fmt.Sprintf("invalid export type: %s", exportType)), logical.ErrInvalidRequest
 	}
@@ -177,7 +183,7 @@ func getExportKey(policy *keysutil.Policy, key *keysutil.KeyEntry, exportType st
 
 	case exportTypeEncryptionKey:
 		switch policy.Type {
-		case keysutil.KeyType_AES128_GCM96, keysutil.KeyType_AES256_GCM96, keysutil.KeyType_ChaCha20_Poly1305:
+		case keysutil.KeyType_AES128_GCM96, keysutil.KeyType_AES256_GCM96, keysutil.KeyType_ChaCha20_Poly1305, keysutil.KeyType_AES128_CBC, keysutil.KeyType_AES256_CBC:
 			return strings.TrimSpace(base64.StdEncoding.EncodeToString(key.Key)), nil
 
 		case keysutil.KeyType_RSA2048, keysutil.KeyType_RSA3072, keysutil.KeyType_RSA4096:
@@ -219,6 +225,14 @@ func getExportKey(policy *keysutil.Policy, key *keysutil.KeyEntry, exportType st
 				return "", err
 			}
 			return rsaKey, nil
+		default:
+			key, err := entEncodePrivateKey(exportType, policy, key)
+			if err != nil {
+				return "", err
+			}
+			if key != "" {
+				return key, nil
+			}
 		}
 	case exportTypePublicKey:
 		switch policy.Type {
@@ -247,6 +261,14 @@ func getExportKey(policy *keysutil.Policy, key *keysutil.KeyEntry, exportType st
 				return "", err
 			}
 			return rsaKey, nil
+		default:
+			key, err := entEncodePublicKey(exportType, policy, key)
+			if err != nil {
+				return "", err
+			}
+			if key != "" {
+				return key, nil
+			}
 		}
 	case exportTypeCertificateChain:
 		if key.CertificateChain == nil {
@@ -265,6 +287,11 @@ func getExportKey(policy *keysutil.Policy, key *keysutil.KeyEntry, exportType st
 		certChain := strings.Join(pemCerts, "\n")
 
 		return certChain, nil
+	case exportTypeCMACKey:
+		switch policy.Type {
+		case keysutil.KeyType_AES128_CMAC, keysutil.KeyType_AES256_CMAC, keysutil.KeyType_AES192_CMAC:
+			return strings.TrimSpace(base64.StdEncoding.EncodeToString(key.Key)), nil
+		}
 	}
 
 	return "", fmt.Errorf("unknown key type %v for export type %v", policy.Type, exportType)
diff --git a/builtin/logical/transit/path_export_test.go b/builtin/logical/transit/path_export_test.go
index b91ef47fb42..a4ab3437d06 100644
--- a/builtin/logical/transit/path_export_test.go
+++ b/builtin/logical/transit/path_export_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -62,127 +62,136 @@ func TestTransit_Export_Unknown_ExportType(t *testing.T) {
 func TestTransit_Export_KeyVersion_ExportsCorrectVersion(t *testing.T) {
 	t.Parallel()
 
-	verifyExportsCorrectVersion(t, "encryption-key", "aes128-gcm96")
-	verifyExportsCorrectVersion(t, "encryption-key", "aes256-gcm96")
-	verifyExportsCorrectVersion(t, "encryption-key", "chacha20-poly1305")
-	verifyExportsCorrectVersion(t, "encryption-key", "rsa-2048")
-	verifyExportsCorrectVersion(t, "encryption-key", "rsa-3072")
-	verifyExportsCorrectVersion(t, "encryption-key", "rsa-4096")
-	verifyExportsCorrectVersion(t, "signing-key", "ecdsa-p256")
-	verifyExportsCorrectVersion(t, "signing-key", "ecdsa-p384")
-	verifyExportsCorrectVersion(t, "signing-key", "ecdsa-p521")
-	verifyExportsCorrectVersion(t, "signing-key", "ed25519")
-	verifyExportsCorrectVersion(t, "signing-key", "rsa-2048")
-	verifyExportsCorrectVersion(t, "signing-key", "rsa-3072")
-	verifyExportsCorrectVersion(t, "signing-key", "rsa-4096")
-	verifyExportsCorrectVersion(t, "hmac-key", "aes128-gcm96")
-	verifyExportsCorrectVersion(t, "hmac-key", "aes256-gcm96")
-	verifyExportsCorrectVersion(t, "hmac-key", "chacha20-poly1305")
-	verifyExportsCorrectVersion(t, "hmac-key", "ecdsa-p256")
-	verifyExportsCorrectVersion(t, "hmac-key", "ecdsa-p384")
-	verifyExportsCorrectVersion(t, "hmac-key", "ecdsa-p521")
-	verifyExportsCorrectVersion(t, "hmac-key", "ed25519")
-	verifyExportsCorrectVersion(t, "hmac-key", "hmac")
-	verifyExportsCorrectVersion(t, "public-key", "rsa-2048")
-	verifyExportsCorrectVersion(t, "public-key", "rsa-3072")
-	verifyExportsCorrectVersion(t, "public-key", "rsa-4096")
-	verifyExportsCorrectVersion(t, "public-key", "ecdsa-p256")
-	verifyExportsCorrectVersion(t, "public-key", "ecdsa-p384")
-	verifyExportsCorrectVersion(t, "public-key", "ecdsa-p521")
-	verifyExportsCorrectVersion(t, "public-key", "ed25519")
+	verifyExportsCorrectVersion(t, "encryption-key", "aes128-gcm96", "", "")
+	verifyExportsCorrectVersion(t, "encryption-key", "aes256-gcm96", "", "")
+	verifyExportsCorrectVersion(t, "encryption-key", "chacha20-poly1305", "", "")
+	verifyExportsCorrectVersion(t, "encryption-key", "rsa-2048", "", "")
+	verifyExportsCorrectVersion(t, "encryption-key", "rsa-3072", "", "")
+	verifyExportsCorrectVersion(t, "encryption-key", "rsa-4096", "", "")
+	verifyExportsCorrectVersion(t, "signing-key", "ecdsa-p256", "", "")
+	verifyExportsCorrectVersion(t, "signing-key", "ecdsa-p384", "", "")
+	verifyExportsCorrectVersion(t, "signing-key", "ecdsa-p521", "", "")
+	verifyExportsCorrectVersion(t, "signing-key", "ed25519", "", "")
+	verifyExportsCorrectVersion(t, "signing-key", "rsa-2048", "", "")
+	verifyExportsCorrectVersion(t, "signing-key", "rsa-3072", "", "")
+	verifyExportsCorrectVersion(t, "signing-key", "rsa-4096", "", "")
+	verifyExportsCorrectVersion(t, "hmac-key", "aes128-gcm96", "", "")
+	verifyExportsCorrectVersion(t, "hmac-key", "aes256-gcm96", "", "")
+	verifyExportsCorrectVersion(t, "hmac-key", "chacha20-poly1305", "", "")
+	verifyExportsCorrectVersion(t, "hmac-key", "ecdsa-p256", "", "")
+	verifyExportsCorrectVersion(t, "hmac-key", "ecdsa-p384", "", "")
+	verifyExportsCorrectVersion(t, "hmac-key", "ecdsa-p521", "", "")
+	verifyExportsCorrectVersion(t, "hmac-key", "ed25519", "", "")
+	verifyExportsCorrectVersion(t, "hmac-key", "hmac", "", "")
+	verifyExportsCorrectVersion(t, "public-key", "rsa-2048", "", "")
+	verifyExportsCorrectVersion(t, "public-key", "rsa-3072", "", "")
+	verifyExportsCorrectVersion(t, "public-key", "rsa-4096", "", "")
+	verifyExportsCorrectVersion(t, "public-key", "ecdsa-p256", "", "")
+	verifyExportsCorrectVersion(t, "public-key", "ecdsa-p384", "", "")
+	verifyExportsCorrectVersion(t, "public-key", "ecdsa-p521", "", "")
+	verifyExportsCorrectVersion(t, "public-key", "ed25519", "", "")
 }
 
-func verifyExportsCorrectVersion(t *testing.T, exportType, keyType string) {
-	b, storage := createBackendWithSysView(t)
+func verifyExportsCorrectVersion(t *testing.T, exportType, keyType, parameterSet, ecKeyType string) {
+	t.Run(keyType+":"+ecKeyType, func(t *testing.T) {
+		b, storage := createBackendWithSysView(t)
 
-	// First create a key, v1
-	req := &logical.Request{
-		Storage:   storage,
-		Operation: logical.UpdateOperation,
-		Path:      "keys/foo",
-	}
-	req.Data = map[string]interface{}{
-		"exportable": true,
-		"type":       keyType,
-	}
-	if keyType == "hmac" {
-		req.Data["key_size"] = 32
-	}
-	_, err := b.HandleRequest(context.Background(), req)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	verifyVersion := func(versionRequest string, expectedVersion int) {
+		// First create a key, v1
 		req := &logical.Request{
 			Storage:   storage,
-			Operation: logical.ReadOperation,
-			Path:      fmt.Sprintf("export/%s/foo/%s", exportType, versionRequest),
-		}
-		rsp, err := b.HandleRequest(context.Background(), req)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		typRaw, ok := rsp.Data["type"]
-		if !ok {
-			t.Fatal("no type returned from export")
+			Operation: logical.UpdateOperation,
+			Path:      "keys/foo",
 		}
-		typ, ok := typRaw.(string)
-		if !ok {
-			t.Fatalf("could not find key type, resp data is %#v", rsp.Data)
+		req.Data = map[string]interface{}{
+			"exportable": true,
+			"type":       keyType,
 		}
-		if typ != keyType {
-			t.Fatalf("key type mismatch; %q vs %q", typ, keyType)
+		if parameterSet != "" {
+			req.Data["parameter_set"] = parameterSet
 		}
-
-		keysRaw, ok := rsp.Data["keys"]
-		if !ok {
-			t.Fatal("could not find keys value")
+		if ecKeyType != "" {
+			req.Data["hybrid_key_type_pqc"] = "ml-dsa"
+			req.Data["hybrid_key_type_ec"] = ecKeyType
 		}
-		keys, ok := keysRaw.(map[string]string)
-		if !ok {
-			t.Fatal("could not cast to keys map")
+		if keyType == "hmac" {
+			req.Data["key_size"] = 32
 		}
-		if len(keys) != 1 {
-			t.Fatal("unexpected number of keys found")
+		_, err := b.HandleRequest(context.Background(), req)
+		if err != nil {
+			t.Fatal(err)
 		}
 
-		for k := range keys {
-			if k != strconv.Itoa(expectedVersion) {
-				t.Fatalf("expected version %q, received version %q", strconv.Itoa(expectedVersion), k)
+		verifyVersion := func(versionRequest string, expectedVersion int) {
+			req := &logical.Request{
+				Storage:   storage,
+				Operation: logical.ReadOperation,
+				Path:      fmt.Sprintf("export/%s/foo/%s", exportType, versionRequest),
+			}
+			rsp, err := b.HandleRequest(context.Background(), req)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			typRaw, ok := rsp.Data["type"]
+			if !ok {
+				t.Fatal("no type returned from export")
+			}
+			typ, ok := typRaw.(string)
+			if !ok {
+				t.Fatalf("could not find key type, resp data is %#v", rsp.Data)
+			}
+			if typ != keyType {
+				t.Fatalf("key type mismatch; %q vs %q", typ, keyType)
+			}
+
+			keysRaw, ok := rsp.Data["keys"]
+			if !ok {
+				t.Fatal("could not find keys value")
+			}
+			keys, ok := keysRaw.(map[string]string)
+			if !ok {
+				t.Fatal("could not cast to keys map")
+			}
+			if len(keys) != 1 {
+				t.Fatal("unexpected number of keys found")
+			}
+
+			for k := range keys {
+				if k != strconv.Itoa(expectedVersion) {
+					t.Fatalf("expected version %q, received version %q", strconv.Itoa(expectedVersion), k)
+				}
 			}
 		}
-	}
 
-	verifyVersion("v1", 1)
-	verifyVersion("1", 1)
-	verifyVersion("latest", 1)
+		verifyVersion("v1", 1)
+		verifyVersion("1", 1)
+		verifyVersion("latest", 1)
 
-	req.Path = "keys/foo/rotate"
-	// v2
-	_, err = b.HandleRequest(context.Background(), req)
-	if err != nil {
-		t.Fatal(err)
-	}
+		req.Path = "keys/foo/rotate"
+		// v2
+		_, err = b.HandleRequest(context.Background(), req)
+		if err != nil {
+			t.Fatal(err)
+		}
 
-	verifyVersion("v1", 1)
-	verifyVersion("1", 1)
-	verifyVersion("v2", 2)
-	verifyVersion("2", 2)
-	verifyVersion("latest", 2)
+		verifyVersion("v1", 1)
+		verifyVersion("1", 1)
+		verifyVersion("v2", 2)
+		verifyVersion("2", 2)
+		verifyVersion("latest", 2)
 
-	// v3
-	_, err = b.HandleRequest(context.Background(), req)
-	if err != nil {
-		t.Fatal(err)
-	}
+		// v3
+		_, err = b.HandleRequest(context.Background(), req)
+		if err != nil {
+			t.Fatal(err)
+		}
 
-	verifyVersion("v1", 1)
-	verifyVersion("1", 1)
-	verifyVersion("v3", 3)
-	verifyVersion("3", 3)
-	verifyVersion("latest", 3)
+		verifyVersion("v1", 1)
+		verifyVersion("1", 1)
+		verifyVersion("v3", 3)
+		verifyVersion("3", 3)
+		verifyVersion("latest", 3)
+	})
 }
 
 func TestTransit_Export_ValidVersionsOnly(t *testing.T) {
diff --git a/builtin/logical/transit/path_hash.go b/builtin/logical/transit/path_hash.go
index 250822d0b9d..6e3812560ce 100644
--- a/builtin/logical/transit/path_hash.go
+++ b/builtin/logical/transit/path_hash.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_hash_test.go b/builtin/logical/transit/path_hash_test.go
index 9ded6721a8d..847745cdad7 100644
--- a/builtin/logical/transit/path_hash_test.go
+++ b/builtin/logical/transit/path_hash_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_hmac.go b/builtin/logical/transit/path_hmac.go
index 0465b8dfa2b..10ae014e0eb 100644
--- a/builtin/logical/transit/path_hmac.go
+++ b/builtin/logical/transit/path_hmac.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -28,7 +28,7 @@ type batchResponseHMACItem struct {
 	HMAC string `json:"hmac,omitempty" mapstructure:"hmac"`
 
 	// Valid indicates whether signature matches the signature derived from the input string
-	Valid bool `json:"valid,omitempty" mapstructure:"valid"`
+	Valid bool `json:"valid" mapstructure:"valid"`
 
 	// Error, if set represents a failure encountered while encrypting a
 	// corresponding batch request item
@@ -257,7 +257,19 @@ func (b *backend) pathHMACVerify(ctx context.Context, req *logical.Request, d *f
 	name := d.Get("name").(string)
 	algorithm := d.Get("urlalgorithm").(string)
 	if algorithm == "" {
-		algorithm = d.Get("algorithm").(string)
+		hashAlgorithmRaw, hasHashAlgorithm := d.GetOk("hash_algorithm")
+		algorithmRaw, hasAlgorithm := d.GetOk("algorithm")
+
+		// As `algorithm` is deprecated, make sure we only read it if
+		// `hash_algorithm` is not present.
+		switch {
+		case hasHashAlgorithm:
+			algorithm = hashAlgorithmRaw.(string)
+		case hasAlgorithm:
+			algorithm = algorithmRaw.(string)
+		default:
+			algorithm = d.Get("hash_algorithm").(string)
+		}
 	}
 
 	// Get the policy
diff --git a/builtin/logical/transit/path_hmac_test.go b/builtin/logical/transit/path_hmac_test.go
index 4fa0fbce318..6c456c24019 100644
--- a/builtin/logical/transit/path_hmac_test.go
+++ b/builtin/logical/transit/path_hmac_test.go
@@ -1,17 +1,22 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
 
 import (
 	"context"
+	"encoding/base64"
 	"fmt"
 	"strconv"
 	"strings"
 	"testing"
 
+	"github.com/hashicorp/vault/api"
+	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/helper/keysutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
 )
 
 func TestTransit_HMAC(t *testing.T) {
@@ -94,17 +99,40 @@ func TestTransit_HMAC(t *testing.T) {
 			}
 
 			// Now verify
+			verify := func() {
+				t.Helper()
+
+				resp, err = b.HandleRequest(context.Background(), req)
+				if err != nil {
+					t.Fatalf("%v: %v", err, resp)
+				}
+				if resp == nil {
+					t.Fatal("expected non-nil response")
+				}
+				if errStr, ok := resp.Data["error"]; ok {
+					t.Fatalf("error validating hmac: %s", errStr)
+				}
+				if resp.Data["valid"].(bool) == false {
+					t.Fatalf("error validating hmac;\nreq:\n%#v\nresp:\n%#v", *req, *resp)
+				}
+			}
 			req.Path = strings.ReplaceAll(req.Path, "hmac", "verify")
 			req.Data["hmac"] = value.(string)
-			resp, err = b.HandleRequest(context.Background(), req)
-			if err != nil {
-				t.Fatalf("%v: %v", err, resp)
-			}
-			if resp == nil {
-				t.Fatal("expected non-nil response")
-			}
-			if resp.Data["valid"].(bool) == false {
-				panic(fmt.Sprintf("error validating hmac;\nreq:\n%#v\nresp:\n%#v", *req, *resp))
+			verify()
+
+			// If `algorithm` parameter is used, try with `hash_algorithm` as well
+			if algorithm, ok := req.Data["algorithm"]; ok {
+				// Note that `hash_algorithm` takes precedence over `algorithm`, since the
+				// latter is deprecated.
+				req.Data["hash_algorithm"] = algorithm
+				req.Data["algorithm"] = "xxx"
+				defer func() {
+					// Restore the req fields, since it is re-used by the tests below
+					delete(req.Data, "hash_algorithm")
+					req.Data["algorithm"] = algorithm
+				}()
+
+				verify()
 			}
 		}
 
@@ -372,3 +400,91 @@ func TestTransit_batchHMAC(t *testing.T) {
 		t.Fatalf("expected error validating hmac\nreq\n%#v\nresp\n%#v", *req, *resp)
 	}
 }
+
+// TestHMACBatchResultsFields checks that responses to HMAC verify requests using batch_input
+// contain all expected fields
+func TestHMACBatchResultsFields(t *testing.T) {
+	coreConfig := &vault.CoreConfig{
+		LogicalBackends: map[string]logical.Factory{
+			"transit": Factory,
+		},
+	}
+
+	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	cores := cluster.Cores
+
+	vault.TestWaitActive(t, cores[0].Core)
+
+	client := cores[0].Client
+
+	err := client.Sys().Mount("transit", &api.MountInput{
+		Type: "transit",
+	})
+	require.NoError(t, err)
+
+	keyName := "hmac-test-key"
+	_, err = client.Logical().Write("transit/keys/"+keyName, map[string]interface{}{"type": "hmac", "key_size": 32})
+	require.NoError(t, err)
+
+	batchInput := make([]map[string]interface{}, 0, 2)
+	for i := range []int{1, 2} {
+		index := strconv.Itoa(i)
+		item := map[string]interface{}{
+			"input":     base64.StdEncoding.EncodeToString([]byte("the quick brown fox " + index)),
+			"reference": index,
+		}
+
+		batchInput = append(batchInput, item)
+	}
+
+	cmacPath := fmt.Sprintf("transit/hmac/%s", keyName)
+	resp, err := client.Logical().Write(cmacPath, map[string]interface{}{"batch_input": batchInput})
+	require.NoError(t, err)
+
+	batchResp, ok := resp.Data["batch_results"].([]interface{})
+	require.True(t, ok, fmt.Sprintf("unexpected type for batch_results: expected list, got %T", resp.Data["batch_results"]))
+
+	hmacByRef := make(map[string]string)
+	for _, entry := range batchResp {
+		result, ok := entry.(map[string]interface{})
+		require.True(t, ok, fmt.Sprintf("unexpected type for batch_results: expected map[string]interface{}, got %T", entry))
+		ref := result["reference"].(string)
+		hmac := result["hmac"].(string)
+
+		require.NotContains(t, hmacByRef, ref, "duplicated reference value %v in batch: %v", ref, batchResp)
+		hmacByRef[ref] = hmac
+	}
+
+	batchVerifyInput := make([]map[string]interface{}, 0, 2)
+	batchVerifyInput = append(batchVerifyInput, map[string]interface{}{
+		"input":     base64.StdEncoding.EncodeToString([]byte("the quick brown fox 1")),
+		"hmac":      hmacByRef["1"],
+		"reference": 1,
+	})
+	// use wrong HMAC to get valid=false
+	batchVerifyInput = append(batchVerifyInput, map[string]interface{}{
+		"input":     base64.StdEncoding.EncodeToString([]byte("the quick brown fox 2")),
+		"hmac":      hmacByRef["1"],
+		"reference": 2,
+	})
+
+	verifyPath := fmt.Sprintf("transit/verify/%s", keyName)
+	resp, err = client.Logical().Write(verifyPath, map[string]interface{}{"batch_input": batchVerifyInput})
+	require.NoError(t, err)
+
+	batchResp, ok = resp.Data["batch_results"].([]interface{})
+	require.True(t, ok, fmt.Sprintf("unexpected type for batch_results: expected list, got %T", resp.Data["batch_results"]))
+
+	for _, entry := range batchResp {
+		result, ok := entry.(map[string]interface{})
+		require.True(t, ok, fmt.Sprintf("unexpected type for batch_results: expected map[string]interface{}, got %T", entry))
+
+		require.Contains(t, result, "reference")
+		require.Contains(t, result, "valid")
+	}
+}
diff --git a/builtin/logical/transit/path_import.go b/builtin/logical/transit/path_import.go
index 355c4e7b83f..b12f443d3c1 100644
--- a/builtin/logical/transit/path_import.go
+++ b/builtin/logical/transit/path_import.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -17,10 +17,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/google/tink/go/kwp/subtle"
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/keysutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/tink-crypto/tink-go/v2/kwp/subtle"
 )
 
 const EncryptedKeyBytes = 512
@@ -45,7 +46,8 @@ func (b *backend) pathImport() *framework.Path {
 				Default: "aes256-gcm96",
 				Description: `The type of key being imported. Currently, "aes128-gcm96" (symmetric), "aes256-gcm96" (symmetric), "ecdsa-p256"
 (asymmetric), "ecdsa-p384" (asymmetric), "ecdsa-p521" (asymmetric), "ed25519" (asymmetric), "rsa-2048" (asymmetric), "rsa-3072"
-(asymmetric), "rsa-4096" (asymmetric) are supported.  Defaults to "aes256-gcm96".
+(asymmetric), "rsa-4096" (asymmetric), "ml-dsa-44 (asymmetric)", "ml-dsa-65 (asymmetric)", "ml-dsa-87 (asymmetric)", "hmac", "aes128-cmac", 
+"aes192-cmac", aes256-cmac" are supported.  Defaults to "aes256-gcm96".
 `,
 			},
 			"hash_function": {
@@ -214,10 +216,24 @@ func (b *backend) pathImportWrite(ctx context.Context, req *logical.Request, d *
 		polReq.KeyType = keysutil.KeyType_RSA4096
 	case "hmac":
 		polReq.KeyType = keysutil.KeyType_HMAC
+	case "aes128-cmac":
+		polReq.KeyType = keysutil.KeyType_AES128_CMAC
+	case "aes256-cmac":
+		polReq.KeyType = keysutil.KeyType_AES256_CMAC
+	case "aes192-cmac":
+		polReq.KeyType = keysutil.KeyType_AES192_CMAC
+	case "aes128-cbc":
+		polReq.KeyType = keysutil.KeyType_AES128_CBC
+	case "aes256-cbc":
+		polReq.KeyType = keysutil.KeyType_AES256_CBC
 	default:
 		return logical.ErrorResponse(fmt.Sprintf("unknown key type: %v", keyType)), logical.ErrInvalidRequest
 	}
 
+	if polReq.KeyType.IsEnterpriseOnly() && !constants.IsEnterprise {
+		return logical.ErrorResponse(ErrKeyTypeEntOnly, polReq.KeyType), logical.ErrInvalidRequest
+	}
+
 	p, _, err := b.GetPolicy(ctx, polReq, b.GetRandomReader())
 	if err != nil {
 		return nil, err
diff --git a/builtin/logical/transit/path_import_test.go b/builtin/logical/transit/path_import_test.go
index ab471f0ff38..29ded0a76f6 100644
--- a/builtin/logical/transit/path_import_test.go
+++ b/builtin/logical/transit/path_import_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -19,9 +19,10 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/google/tink/go/kwp/subtle"
 	uuid "github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/tink-crypto/tink-go/v2/kwp/subtle"
 )
 
 var keyTypes = []string{
@@ -162,7 +163,7 @@ func TestTransit_Import(t *testing.T) {
 	t.Run(
 		"import into a key fails before wrapping key is read",
 		func(t *testing.T) {
-			fakeWrappingKey, err := rsa.GenerateKey(rand.Reader, 4096)
+			fakeWrappingKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 4096)
 			if err != nil {
 				t.Fatalf("failed to generate fake wrapping key: %s", err)
 			}
@@ -502,7 +503,7 @@ func TestTransit_ImportVersion(t *testing.T) {
 	t.Run(
 		"import into a key version fails before wrapping key is read",
 		func(t *testing.T) {
-			fakeWrappingKey, err := rsa.GenerateKey(rand.Reader, 4096)
+			fakeWrappingKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 4096)
 			if err != nil {
 				t.Fatalf("failed to generate fake wrapping key: %s", err)
 			}
@@ -1027,11 +1028,11 @@ func generateKey(keyType string) (interface{}, error) {
 	case "ecdsa-p521":
 		return ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
 	case "rsa-2048":
-		return rsa.GenerateKey(rand.Reader, 2048)
+		return cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	case "rsa-3072":
-		return rsa.GenerateKey(rand.Reader, 3072)
+		return cryptoutil.GenerateRSAKey(rand.Reader, 3072)
 	case "rsa-4096":
-		return rsa.GenerateKey(rand.Reader, 4096)
+		return cryptoutil.GenerateRSAKey(rand.Reader, 4096)
 	default:
 		return nil, fmt.Errorf("failed to generate unsupported key type: %s", keyType)
 	}
diff --git a/builtin/logical/transit/path_keys.go b/builtin/logical/transit/path_keys.go
index bc931cc30c9..49521d2ff99 100644
--- a/builtin/logical/transit/path_keys.go
+++ b/builtin/logical/transit/path_keys.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -9,11 +9,13 @@ import (
 	"encoding/base64"
 	"encoding/pem"
 	"fmt"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/fatih/structs"
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/keysutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -59,7 +61,7 @@ func (b *backend) pathKeys() *framework.Path {
 				Description: `
 The type of key to create. Currently, "aes128-gcm96" (symmetric), "aes256-gcm96" (symmetric), "ecdsa-p256"
 (asymmetric), "ecdsa-p384" (asymmetric), "ecdsa-p521" (asymmetric), "ed25519" (asymmetric), "rsa-2048" (asymmetric), "rsa-3072"
-(asymmetric), "rsa-4096" (asymmetric) are supported.  Defaults to "aes256-gcm96".
+(asymmetric), "rsa-4096" (asymmetric), "ml-dsa" (asymmetric), "slh-dsa" (asymmetric) are supported.  Defaults to "aes256-gcm96".
 `,
 			},
 
@@ -129,6 +131,22 @@ key.`,
 				Type:        framework.TypeString,
 				Description: "The UUID of the managed key to use for this transit key",
 			},
+			"parameter_set": {
+				Type: framework.TypeString,
+				Description: `The parameter set to use. Applies to ML-DSA and SLH-DSA key types.
+For ML-DSA key types, valid values are 44, 65, or 87.
+For SLH-DSA key types, valid values are SLH-DSA-SHA2-128s, SLH-DSA-SHAKE-128s, SLH-DSA-SHA2-128f, SLH-DSA-SHAKE-128f, SLH-DSA-SHA2-192s, SLH-DSA-SHAKE-192s, SLH-DSA-SHA2-192f, SLH-DSA-SHAKE-192f, SLH-DSA-SHA2-256s, SLH-DSA-SHAKE-256s, SLH-DSA-SHA2-256f, SLH-DSA-SHAKE-256f`,
+			},
+			"hybrid_key_type_pqc": {
+				Type: framework.TypeString,
+				Description: `The key type of the post-quantum key to use for hybrid signature schemes.
+Supported types are: ML-DSA.`,
+			},
+			"hybrid_key_type_ec": {
+				Type: framework.TypeString,
+				Description: `The key type of the elliptic curve key to use for hybrid signature schemes.
+Supported types are: ecdsa-p256, ecdsa-p384, ecdsa-p521, and ed25519.`,
+			},
 		},
 
 		Operations: map[logical.Operation]framework.OperationHandler{
@@ -163,6 +181,15 @@ func (b *backend) pathKeysList(ctx context.Context, req *logical.Request, d *fra
 		return nil, err
 	}
 
+	// filter out partial paths
+	entries = slices.DeleteFunc(entries, func(s string) bool {
+		if strings.HasSuffix(s, "/") {
+			return true
+		}
+
+		return false
+	})
+
 	return logical.ListResponse(entries), nil
 }
 
@@ -177,6 +204,9 @@ func (b *backend) pathPolicyWrite(ctx context.Context, req *logical.Request, d *
 	autoRotatePeriod := time.Second * time.Duration(d.Get("auto_rotate_period").(int))
 	managedKeyName := d.Get("managed_key_name").(string)
 	managedKeyId := d.Get("managed_key_id").(string)
+	parameterSet := d.Get("parameter_set").(string)
+	pqcKeyType := d.Get("hybrid_key_type_pqc").(string)
+	ecKeyType := d.Get("hybrid_key_type_ec").(string)
 
 	if autoRotatePeriod != 0 && autoRotatePeriod < time.Hour {
 		return logical.ErrorResponse("auto rotate period must be 0 to disable or at least an hour"), nil
@@ -222,6 +252,57 @@ func (b *backend) pathPolicyWrite(ctx context.Context, req *logical.Request, d *
 		polReq.KeyType = keysutil.KeyType_HMAC
 	case "managed_key":
 		polReq.KeyType = keysutil.KeyType_MANAGED_KEY
+	case "aes128-cmac":
+		polReq.KeyType = keysutil.KeyType_AES128_CMAC
+	case "aes192-cmac":
+		polReq.KeyType = keysutil.KeyType_AES192_CMAC
+	case "aes256-cmac":
+		polReq.KeyType = keysutil.KeyType_AES256_CMAC
+	case "ml-dsa":
+		polReq.KeyType = keysutil.KeyType_ML_DSA
+
+		if parameterSet != keysutil.ParameterSet_ML_DSA_44 &&
+			parameterSet != keysutil.ParameterSet_ML_DSA_65 &&
+			parameterSet != keysutil.ParameterSet_ML_DSA_87 {
+			return logical.ErrorResponse(fmt.Sprintf("invalid parameter set %s for key type %s", parameterSet, keyType)), logical.ErrInvalidRequest
+		}
+
+		polReq.ParameterSet = parameterSet
+	case "hybrid":
+		polReq.KeyType = keysutil.KeyType_HYBRID
+
+		var err error
+		polReq.HybridConfig, err = getHybridKeyConfig(pqcKeyType, parameterSet, ecKeyType)
+		if err != nil {
+			return logical.ErrorResponse(fmt.Sprintf("invalid config for hybrid key: %s", err)), logical.ErrInvalidRequest
+		}
+
+		polReq.ParameterSet = parameterSet
+
+	case "slh-dsa":
+		polReq.KeyType = keysutil.KeyType_SLH_DSA
+		parameterSet = strings.ToLower(parameterSet)
+		switch parameterSet {
+		case keysutil.ParameterSet_SLH_DSA_SHA2_128S,
+			keysutil.ParameterSet_SLH_DSA_SHAKE_128S,
+			keysutil.ParameterSet_SLH_DSA_SHA2_128F,
+			keysutil.ParameterSet_SLH_DSA_SHAKE_128F,
+			keysutil.ParameterSet_SLH_DSA_SHA2_192S,
+			keysutil.ParameterSet_SLH_DSA_SHAKE_192S,
+			keysutil.ParameterSet_SLH_DSA_SHA2_192F,
+			keysutil.ParameterSet_SLH_DSA_SHAKE_192F,
+			keysutil.ParameterSet_SLH_DSA_SHA2_256S,
+			keysutil.ParameterSet_SLH_DSA_SHAKE_256S,
+			keysutil.ParameterSet_SLH_DSA_SHA2_256F,
+			keysutil.ParameterSet_SLH_DSA_SHAKE_256F:
+			polReq.ParameterSet = parameterSet
+		default:
+			return logical.ErrorResponse(fmt.Sprintf("invalid parameter set %s for key type %s", parameterSet, keyType)), logical.ErrInvalidRequest
+		}
+	case "aes128-cbc":
+		polReq.KeyType = keysutil.KeyType_AES128_CBC
+	case "aes256-cbc":
+		polReq.KeyType = keysutil.KeyType_AES256_CBC
 	default:
 		return logical.ErrorResponse(fmt.Sprintf("unknown key type %v", keyType)), logical.ErrInvalidRequest
 	}
@@ -244,6 +325,10 @@ func (b *backend) pathPolicyWrite(ctx context.Context, req *logical.Request, d *
 		polReq.ManagedKeyUUID = keyId
 	}
 
+	if polReq.KeyType.IsEnterpriseOnly() && !constants.IsEnterprise {
+		return logical.ErrorResponse(fmt.Sprintf(ErrKeyTypeEntOnly, polReq.KeyType)), logical.ErrInvalidRequest
+	}
+
 	p, upserted, err := b.GetPolicy(ctx, polReq, b.GetRandomReader())
 	if err != nil {
 		return nil, err
@@ -251,9 +336,10 @@ func (b *backend) pathPolicyWrite(ctx context.Context, req *logical.Request, d *
 	if p == nil {
 		return nil, fmt.Errorf("error generating key: returned policy was nil")
 	}
-	if b.System().CachingDisabled() {
-		p.Unlock()
+	if !b.System().CachingDisabled() {
+		p.Lock(true)
 	}
+	defer p.Unlock()
 
 	resp, err := b.formatKeyPolicy(p, nil)
 	if err != nil {
@@ -271,6 +357,7 @@ type asymKey struct {
 	PublicKey        string    `json:"public_key" structs:"public_key" mapstructure:"public_key"`
 	CertificateChain string    `json:"certificate_chain" structs:"certificate_chain" mapstructure:"certificate_chain"`
 	CreationTime     time.Time `json:"creation_time" structs:"creation_time" mapstructure:"creation_time"`
+	HybridPublicKey  string    `json:"hybrid_public_key" structs:"hybrid_public_key" mapstructure:"hybrid_public_key"`
 }
 
 func (b *backend) pathPolicyRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
@@ -360,15 +447,24 @@ func (b *backend) formatKeyPolicy(p *keysutil.Policy, context []byte) (*logical.
 		}
 	}
 
+	if p.ParameterSet != "" {
+		resp.Data["parameter_set"] = p.ParameterSet
+	}
+
+	if p.Type == keysutil.KeyType_HYBRID {
+		resp.Data["hybrid_key_type_pqc"] = p.HybridConfig.PQCKeyType.String()
+		resp.Data["hybrid_key_type_ec"] = p.HybridConfig.ECKeyType.String()
+	}
+
 	switch p.Type {
-	case keysutil.KeyType_AES128_GCM96, keysutil.KeyType_AES256_GCM96, keysutil.KeyType_ChaCha20_Poly1305:
+	case keysutil.KeyType_AES128_GCM96, keysutil.KeyType_AES256_GCM96, keysutil.KeyType_ChaCha20_Poly1305, keysutil.KeyType_AES128_CBC, keysutil.KeyType_AES256_CBC:
 		retKeys := map[string]int64{}
 		for k, v := range p.Keys {
 			retKeys[k] = v.DeprecatedCreationTime
 		}
 		resp.Data["keys"] = retKeys
 
-	case keysutil.KeyType_ECDSA_P256, keysutil.KeyType_ECDSA_P384, keysutil.KeyType_ECDSA_P521, keysutil.KeyType_ED25519, keysutil.KeyType_RSA2048, keysutil.KeyType_RSA3072, keysutil.KeyType_RSA4096:
+	case keysutil.KeyType_ECDSA_P256, keysutil.KeyType_ECDSA_P384, keysutil.KeyType_ECDSA_P521, keysutil.KeyType_ED25519, keysutil.KeyType_RSA2048, keysutil.KeyType_RSA3072, keysutil.KeyType_RSA4096, keysutil.KeyType_ML_DSA, keysutil.KeyType_HYBRID, keysutil.KeyType_SLH_DSA:
 		retKeys := map[string]map[string]interface{}{}
 		for k, v := range p.Keys {
 			key := asymKey{
@@ -431,6 +527,8 @@ func (b *backend) formatKeyPolicy(p *keysutil.Policy, context []byte) (*logical.
 					return nil, err
 				}
 				key.PublicKey = pubKey
+			case keysutil.KeyType_ML_DSA:
+				key.Name = "ml-dsa-" + p.ParameterSet
 			}
 
 			retKeys[k] = structs.New(key).Map()
@@ -453,6 +551,38 @@ func (b *backend) pathPolicyDelete(ctx context.Context, req *logical.Request, d
 	return nil, nil
 }
 
+func getHybridKeyConfig(pqcKeyType, parameterSet, ecKeyType string) (keysutil.HybridKeyConfig, error) {
+	config := keysutil.HybridKeyConfig{}
+
+	switch pqcKeyType {
+	case "ml-dsa":
+		config.PQCKeyType = keysutil.KeyType_ML_DSA
+
+		if parameterSet != keysutil.ParameterSet_ML_DSA_44 &&
+			parameterSet != keysutil.ParameterSet_ML_DSA_65 &&
+			parameterSet != keysutil.ParameterSet_ML_DSA_87 {
+			return keysutil.HybridKeyConfig{}, fmt.Errorf("invalid parameter set %s for key type %s", parameterSet, pqcKeyType)
+		}
+	default:
+		return keysutil.HybridKeyConfig{}, fmt.Errorf("invalid PQC key type: %s", pqcKeyType)
+	}
+
+	switch ecKeyType {
+	case "ecdsa-p256":
+		config.ECKeyType = keysutil.KeyType_ECDSA_P256
+	case "ecdsa-p384":
+		config.ECKeyType = keysutil.KeyType_ECDSA_P384
+	case "ecdsa-p521":
+		config.ECKeyType = keysutil.KeyType_ECDSA_P521
+	case "ed25519":
+		config.ECKeyType = keysutil.KeyType_ED25519
+	default:
+		return keysutil.HybridKeyConfig{}, fmt.Errorf("invalid key type for hybrid key: %s", ecKeyType)
+	}
+
+	return config, nil
+}
+
 const pathPolicyHelpSyn = `Managed named encryption keys`
 
 const pathPolicyHelpDesc = `
diff --git a/builtin/logical/transit/path_keys_config.go b/builtin/logical/transit/path_keys_config.go
index ed91d236dc9..57f719d0772 100644
--- a/builtin/logical/transit/path_keys_config.go
+++ b/builtin/logical/transit/path_keys_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_keys_config_test.go b/builtin/logical/transit/path_keys_config_test.go
index 98bcbe44853..75130376599 100644
--- a/builtin/logical/transit/path_keys_config_test.go
+++ b/builtin/logical/transit/path_keys_config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_keys_test.go b/builtin/logical/transit/path_keys_test.go
index 3a0abfeb0bb..6c6ad2f6064 100644
--- a/builtin/logical/transit/path_keys_test.go
+++ b/builtin/logical/transit/path_keys_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit_test
@@ -10,12 +10,13 @@ import (
 	"testing"
 	"time"
 
-	uuid "github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/builtin/audit/file"
 	"github.com/hashicorp/vault/builtin/logical/transit"
+	"github.com/hashicorp/vault/helper/constants"
 	vaulthttp "github.com/hashicorp/vault/http"
+	"github.com/hashicorp/vault/sdk/helper/keysutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 )
@@ -26,7 +27,7 @@ func TestTransit_Issue_2958(t *testing.T) {
 			"transit": transit.Factory,
 		},
 		AuditBackends: map[string]audit.Factory{
-			"file": file.Factory,
+			"file": audit.NewFileBackend,
 		},
 	}
 
@@ -196,3 +197,225 @@ func TestTransit_CreateKeyWithAutorotation(t *testing.T) {
 		})
 	}
 }
+
+// TestTransit_CreateKey validates transit key creation functionality
+func TestTransit_CreateKey(t *testing.T) {
+	testCases := map[string]struct {
+		creationParams map[string]interface{}
+		shouldError    bool
+		entOnly        bool
+	}{
+		"AES-128 GCM": {
+			creationParams: map[string]interface{}{"type": "aes128-gcm96"},
+		},
+		"AES-256 GCM": {
+			creationParams: map[string]interface{}{"type": "aes256-gcm96"},
+		},
+		"CHACHA20": {
+			creationParams: map[string]interface{}{"type": "chacha20-poly1305"},
+		},
+		"ECDSA-P256": {
+			creationParams: map[string]interface{}{"type": "ecdsa-p256"},
+		},
+		"ECDSA-P384": {
+			creationParams: map[string]interface{}{"type": "ecdsa-p384"},
+		},
+		"ECDSA-P521": {
+			creationParams: map[string]interface{}{"type": "ecdsa-p521"},
+		},
+		"RSA_2048": {
+			creationParams: map[string]interface{}{"type": "rsa-2048"},
+		},
+		"RSA_3072": {
+			creationParams: map[string]interface{}{"type": "rsa-3072"},
+		},
+		"RSA_4096": {
+			creationParams: map[string]interface{}{"type": "rsa-4096"},
+		},
+		"HMAC": {
+			creationParams: map[string]interface{}{"type": "hmac", "key_size": 128},
+		},
+		"AES-128 CMAC": {
+			creationParams: map[string]interface{}{"type": "aes128-cmac"},
+			entOnly:        true,
+		},
+		"AES-192 CMAC": {
+			creationParams: map[string]interface{}{"type": "aes192-cmac"},
+			entOnly:        true,
+		},
+		"AES-256 CMAC": {
+			creationParams: map[string]interface{}{"type": "aes256-cmac"},
+			entOnly:        true,
+		},
+		"ML-DSA-44": {
+			creationParams: map[string]interface{}{"type": "ml-dsa", "parameter_set": "44"},
+			entOnly:        true,
+		},
+		"ML-DSA-65": {
+			creationParams: map[string]interface{}{"type": "ml-dsa", "parameter_set": "65"},
+			entOnly:        true,
+		},
+		"ML-DSA-87": {
+			creationParams: map[string]interface{}{"type": "ml-dsa", "parameter_set": "87"},
+			entOnly:        true,
+		},
+		"Hybrid ML-DSA-44-ECDSA-P256": {
+			creationParams: map[string]interface{}{"type": "hybrid", "parameter_set": "44", "hybrid_key_type_ec": "ecdsa-p256", "hybrid_key_type_pqc": "ml-dsa"},
+			entOnly:        true,
+		},
+		"Hybrid ML-DSA-44-ECDSA-P384": {
+			creationParams: map[string]interface{}{"type": "hybrid", "parameter_set": "44", "hybrid_key_type_ec": "ecdsa-p384", "hybrid_key_type_pqc": "ml-dsa"},
+			entOnly:        true,
+		},
+		"Hybrid ML-DSA-44-ECDSA-P521": {
+			creationParams: map[string]interface{}{"type": "hybrid", "parameter_set": "44", "hybrid_key_type_ec": "ecdsa-p521", "hybrid_key_type_pqc": "ml-dsa"},
+			entOnly:        true,
+		},
+		"Hybrid ML-DSA-65-ECDSA-P256": {
+			creationParams: map[string]interface{}{"type": "hybrid", "parameter_set": "65", "hybrid_key_type_ec": "ecdsa-p256", "hybrid_key_type_pqc": "ml-dsa"},
+			entOnly:        true,
+		},
+		"Hybrid ML-DSA-65-ECDSA-P384": {
+			creationParams: map[string]interface{}{"type": "hybrid", "parameter_set": "65", "hybrid_key_type_ec": "ecdsa-p384", "hybrid_key_type_pqc": "ml-dsa"},
+			entOnly:        true,
+		},
+		"Hybrid ML-DSA-65-ECDSA-P521": {
+			creationParams: map[string]interface{}{"type": "hybrid", "parameter_set": "65", "hybrid_key_type_ec": "ecdsa-p521", "hybrid_key_type_pqc": "ml-dsa"},
+			entOnly:        true,
+		},
+		"Hybrid ML-DSA-87-ECDSA-P256": {
+			creationParams: map[string]interface{}{"type": "hybrid", "parameter_set": "87", "hybrid_key_type_ec": "ecdsa-p256", "hybrid_key_type_pqc": "ml-dsa"},
+			entOnly:        true,
+		},
+		"Hybrid ML-DSA-87-ECDSA-P384": {
+			creationParams: map[string]interface{}{"type": "hybrid", "parameter_set": "87", "hybrid_key_type_ec": "ecdsa-p384", "hybrid_key_type_pqc": "ml-dsa"},
+			entOnly:        true,
+		},
+		"Hybrid ML-DSA-87-ECDSA-P521": {
+			creationParams: map[string]interface{}{"type": "hybrid", "parameter_set": "87", "hybrid_key_type_ec": "ecdsa-p521", "hybrid_key_type_pqc": "ml-dsa"},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHA2-128s": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHA2_128S},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHAKE-128s": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHAKE_128S},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHA2-128f": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHA2_128F},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHAKE-128f": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHAKE_128F},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHA2-192s": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHA2_192S},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHAKE-192s": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHAKE_192S},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHA2-192f": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHA2_192F},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHAKE-192f": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHAKE_192F},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHA2-256s": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHA2_256S},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHAKE-256s": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHAKE_256S},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHA2-256f": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHA2_256F},
+			entOnly:        true,
+		},
+		"SLH-DSA-SHAKE-256f": {
+			creationParams: map[string]interface{}{"type": "slh-dsa", "parameter_set": keysutil.ParameterSet_SLH_DSA_SHAKE_256F},
+			entOnly:        true,
+		},
+		"AES-128 CBC": {
+			creationParams: map[string]interface{}{"type": "aes128-cbc"},
+			entOnly:        true,
+		},
+		"AES-256 CBC": {
+			creationParams: map[string]interface{}{"type": "aes256-cbc"},
+			entOnly:        true,
+		},
+		"bad key type": {
+			creationParams: map[string]interface{}{"type": "fake-key-type"},
+			shouldError:    true,
+		},
+	}
+
+	coreConfig := &vault.CoreConfig{
+		LogicalBackends: map[string]logical.Factory{
+			"transit": transit.Factory,
+		},
+	}
+	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+	cores := cluster.Cores
+	vault.TestWaitActive(t, cores[0].Core)
+	client := cores[0].Client
+	err := client.Sys().Mount("transit", &api.MountInput{
+		Type: "transit",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for name, tt := range testCases {
+		t.Run(name, func(t *testing.T) {
+			keyName, err := uuid.GenerateUUID()
+			if err != nil {
+				t.Fatalf("error generating key name: %s", err)
+			}
+
+			resp, err := client.Logical().Write(fmt.Sprintf("transit/keys/%s", keyName), tt.creationParams)
+			if err != nil {
+				if !constants.IsEnterprise && tt.entOnly {
+					// key type is only available on ent and we aren't on ENT
+					return
+				}
+
+				if !tt.shouldError {
+					t.Fatalf("unexpected error creating key: %s", err)
+				}
+			}
+
+			if err == nil {
+				if !constants.IsEnterprise && tt.entOnly {
+					t.Fatal("key type should be enterprise only but did not fail creation on CE")
+				}
+
+				if tt.shouldError {
+					t.Fatal("expected error but got nil")
+				}
+			}
+
+			if err == nil {
+				keyType, ok := resp.Data["type"]
+				if !ok {
+					t.Fatal("missing key type in response")
+				}
+
+				if keyType != tt.creationParams["type"] {
+					t.Fatalf("incorrect key type: expected %s, got %s", tt.creationParams["type"], keyType)
+				}
+			}
+		})
+	}
+}
diff --git a/builtin/logical/transit/path_random.go b/builtin/logical/transit/path_random.go
index 6e057a975fd..aa9dc25923c 100644
--- a/builtin/logical/transit/path_random.go
+++ b/builtin/logical/transit/path_random.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_random_test.go b/builtin/logical/transit/path_random_test.go
index a58820b987b..682339cab1f 100644
--- a/builtin/logical/transit/path_random_test.go
+++ b/builtin/logical/transit/path_random_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_restore.go b/builtin/logical/transit/path_restore.go
index 1b3b3459990..1cdb1a88a8e 100644
--- a/builtin/logical/transit/path_restore.go
+++ b/builtin/logical/transit/path_restore.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_restore_test.go b/builtin/logical/transit/path_restore_test.go
index 1cd0dcd61eb..cd299970fb0 100644
--- a/builtin/logical/transit/path_restore_test.go
+++ b/builtin/logical/transit/path_restore_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_rewrap.go b/builtin/logical/transit/path_rewrap.go
index 49b69c7255e..df326ad5d2d 100644
--- a/builtin/logical/transit/path_rewrap.go
+++ b/builtin/logical/transit/path_rewrap.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -19,6 +19,39 @@ import (
 
 var ErrNonceNotAllowed = errors.New("provided nonce not allowed for this key")
 
+type RewrapBatchRequestItem struct {
+	// Context for key derivation. This is required for derived keys.
+	Context string `json:"context" structs:"context" mapstructure:"context"`
+
+	// DecodedContext is the base64 decoded version of Context
+	DecodedContext []byte
+
+	// Ciphertext for decryption
+	Ciphertext string `json:"ciphertext" structs:"ciphertext" mapstructure:"ciphertext"`
+
+	// Nonce to be used when v1 convergent encryption is used
+	Nonce string `json:"nonce" structs:"nonce" mapstructure:"nonce"`
+
+	// The key version to be used for encryption
+	KeyVersion int `json:"key_version" structs:"key_version" mapstructure:"key_version"`
+
+	// DecodedNonce is the base64 decoded version of Nonce
+	DecodedNonce []byte
+
+	// Associated Data for AEAD ciphers
+	AssociatedData string `json:"associated_data" struct:"associated_data" mapstructure:"associated_data"`
+
+	// Reference is an arbitrary caller supplied string value that will be placed on the
+	// batch response to ease correlation between inputs and outputs
+	Reference string `json:"reference" structs:"reference" mapstructure:"reference"`
+
+	// EncryptPaddingScheme specifies the RSA padding scheme for encryption
+	EncryptPaddingScheme string `json:"encrypt_padding_scheme" structs:"encrypt_padding_scheme" mapstructure:"encrypt_padding_scheme"`
+
+	// DecryptPaddingScheme specifies the RSA padding scheme for decryption
+	DecryptPaddingScheme string `json:"decrypt_padding_scheme" structs:"decrypt_padding_scheme" mapstructure:"decrypt_padding_scheme"`
+}
+
 func (b *backend) pathRewrap() *framework.Path {
 	return &framework.Path{
 		Pattern: "rewrap/" + framework.GenericNameRegex("name"),
@@ -39,6 +72,18 @@ func (b *backend) pathRewrap() *framework.Path {
 				Description: "Ciphertext value to rewrap",
 			},
 
+			"encrypt_padding_scheme": {
+				Type: framework.TypeString,
+				Description: `The padding scheme to use for rewrap's encrypt step. Currently only applies to RSA key types.
+Options are 'oaep' or 'pkcs1v15'. Defaults to 'oaep'`,
+			},
+
+			"decrypt_padding_scheme": {
+				Type: framework.TypeString,
+				Description: `The padding scheme to use for rewrap's decrypt step. Currently only applies to RSA key types.
+Options are 'oaep' or 'pkcs1v15'. Defaults to 'oaep'`,
+			},
+
 			"context": {
 				Type:        framework.TypeString,
 				Description: "Base64 encoded context for key derivation. Required for derived keys.",
@@ -76,7 +121,7 @@ Any batch output will preserve the order of the batch input.`,
 
 func (b *backend) pathRewrapWrite(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 	batchInputRaw := d.Raw["batch_input"]
-	var batchInputItems []BatchRequestItem
+	var batchInputItems []RewrapBatchRequestItem
 	var err error
 	if batchInputRaw != nil {
 		err = mapstructure.Decode(batchInputRaw, &batchInputItems)
@@ -93,13 +138,19 @@ func (b *backend) pathRewrapWrite(ctx context.Context, req *logical.Request, d *
 			return logical.ErrorResponse("missing ciphertext to decrypt"), logical.ErrInvalidRequest
 		}
 
-		batchInputItems = make([]BatchRequestItem, 1)
-		batchInputItems[0] = BatchRequestItem{
+		batchInputItems = make([]RewrapBatchRequestItem, 1)
+		batchInputItems[0] = RewrapBatchRequestItem{
 			Ciphertext: ciphertext,
 			Context:    d.Get("context").(string),
 			Nonce:      d.Get("nonce").(string),
 			KeyVersion: d.Get("key_version").(int),
 		}
+		if ps, ok := d.GetOk("decrypt_padding_scheme"); ok {
+			batchInputItems[0].DecryptPaddingScheme = ps.(string)
+		}
+		if ps, ok := d.GetOk("encrypt_padding_scheme"); ok {
+			batchInputItems[0].EncryptPaddingScheme = ps.(string)
+		}
 	}
 
 	batchResponseItems := make([]EncryptBatchResponseItem, len(batchInputItems))
@@ -156,12 +207,26 @@ func (b *backend) pathRewrapWrite(ctx context.Context, req *logical.Request, d *
 			continue
 		}
 
+		var factories []any
+		if item.DecryptPaddingScheme != "" {
+			paddingScheme, err := parsePaddingSchemeArg(p.Type, item.DecryptPaddingScheme)
+			if err != nil {
+				batchResponseItems[i].Error = fmt.Sprintf("'[%d].decrypt_padding_scheme' invalid: %s", i, err.Error())
+				continue
+			}
+			factories = append(factories, paddingScheme)
+		}
 		if item.Nonce != "" && !nonceAllowed(p) {
 			batchResponseItems[i].Error = ErrNonceNotAllowed.Error()
 			continue
 		}
 
-		plaintext, err := p.Decrypt(item.DecodedContext, item.DecodedNonce, item.Ciphertext)
+		opts := keysutil.EncryptionOptions{
+			Context: item.DecodedContext,
+			Nonce:   item.DecodedNonce,
+		}
+
+		plaintext, err := p.DecryptWithOptions(opts, item.Ciphertext, factories...)
 		if err != nil {
 			switch err.(type) {
 			case errutil.UserError:
@@ -172,11 +237,27 @@ func (b *backend) pathRewrapWrite(ctx context.Context, req *logical.Request, d *
 			}
 		}
 
+		factories = make([]any, 0)
+		if item.EncryptPaddingScheme != "" {
+			paddingScheme, err := parsePaddingSchemeArg(p.Type, item.EncryptPaddingScheme)
+			if err != nil {
+				batchResponseItems[i].Error = fmt.Sprintf("'[%d].encrypt_padding_scheme' invalid: %s", i, err.Error())
+				continue
+			}
+			factories = append(factories, paddingScheme)
+			factories = append(factories, keysutil.PaddingScheme(item.EncryptPaddingScheme))
+		}
 		if !warnAboutNonceUsage && shouldWarnAboutNonceUsage(p, item.DecodedNonce) {
 			warnAboutNonceUsage = true
 		}
 
-		ciphertext, err := p.Encrypt(item.KeyVersion, item.DecodedContext, item.DecodedNonce, plaintext)
+		opts = keysutil.EncryptionOptions{
+			KeyVersion: item.KeyVersion,
+			Context:    item.DecodedContext,
+			Nonce:      item.DecodedNonce,
+		}
+
+		ciphertext, err := p.EncryptWithOptions(opts, plaintext, factories...)
 		if err != nil {
 			switch err.(type) {
 			case errutil.UserError:
diff --git a/builtin/logical/transit/path_rewrap_test.go b/builtin/logical/transit/path_rewrap_test.go
index 55f28874656..416f42578b9 100644
--- a/builtin/logical/transit/path_rewrap_test.go
+++ b/builtin/logical/transit/path_rewrap_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -326,3 +326,116 @@ func TestTransit_BatchRewrapCase3(t *testing.T) {
 
 	}
 }
+
+// TestTransit_BatchRewrapCase4 batch rewrap leveraging RSA padding schemes
+func TestTransit_BatchRewrapCase4(t *testing.T) {
+	var resp *logical.Response
+	var err error
+
+	b, s := createBackendWithStorage(t)
+
+	batchEncryptionInput := []interface{}{
+		map[string]interface{}{"plaintext": "dmlzaGFsCg==", "reference": "ek", "padding_scheme": "pkcs1v15"},
+		map[string]interface{}{"plaintext": "dGhlIHF1aWNrIGJyb3duIGZveA==", "reference": "do", "padding_scheme": "pkcs1v15"},
+	}
+	batchEncryptionData := map[string]interface{}{
+		"type":        "rsa-2048",
+		"batch_input": batchEncryptionInput,
+	}
+	batchReq := &logical.Request{
+		Operation: logical.CreateOperation,
+		Path:      "encrypt/upserted_key",
+		Storage:   s,
+		Data:      batchEncryptionData,
+	}
+	resp, err = b.HandleRequest(context.Background(), batchReq)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("err:%v resp:%#v", err, resp)
+	}
+
+	batchEncryptionResponseItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)
+
+	batchRewrapInput := make([]interface{}, len(batchEncryptionResponseItems))
+	for i, item := range batchEncryptionResponseItems {
+		batchRewrapInput[i] = map[string]interface{}{
+			"ciphertext":             item.Ciphertext,
+			"reference":              item.Reference,
+			"decrypt_padding_scheme": "pkcs1v15",
+			"encrypt_padding_scheme": "oaep",
+		}
+	}
+
+	batchRewrapData := map[string]interface{}{
+		"batch_input": batchRewrapInput,
+	}
+
+	rotateReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "keys/upserted_key/rotate",
+		Storage:   s,
+	}
+	resp, err = b.HandleRequest(context.Background(), rotateReq)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("err:%v resp:%#v", err, resp)
+	}
+
+	rewrapReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "rewrap/upserted_key",
+		Storage:   s,
+		Data:      batchRewrapData,
+	}
+
+	resp, err = b.HandleRequest(context.Background(), rewrapReq)
+	if err != nil || (resp != nil && resp.IsError()) {
+		t.Fatalf("err:%v resp:%#v", err, resp)
+	}
+
+	batchRewrapResponseItems := resp.Data["batch_results"].([]EncryptBatchResponseItem)
+
+	if len(batchRewrapResponseItems) != len(batchEncryptionResponseItems) {
+		t.Fatalf("bad: length of input and output or rewrap are not matching; expected: %d, actual: %d", len(batchEncryptionResponseItems), len(batchRewrapResponseItems))
+	}
+
+	decReq := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "decrypt/upserted_key",
+		Storage:   s,
+	}
+
+	for i, eItem := range batchEncryptionResponseItems {
+		rItem := batchRewrapResponseItems[i]
+
+		inputRef := batchEncryptionInput[i].(map[string]interface{})["reference"]
+		if eItem.Reference != inputRef {
+			t.Fatalf("bad: reference mismatch. Expected %s, Actual: %s", inputRef, eItem.Reference)
+		}
+
+		if eItem.Ciphertext == rItem.Ciphertext {
+			t.Fatalf("bad: rewrap input and output are the same")
+		}
+
+		if !strings.HasPrefix(rItem.Ciphertext, "vault:v2") {
+			t.Fatalf("bad: invalid version of ciphertext in rewrap response; expected: 'vault:v2', actual: %s", rItem.Ciphertext)
+		}
+
+		if rItem.KeyVersion != 2 {
+			t.Fatalf("unexpected key version; got: %d, expected: %d", rItem.KeyVersion, 2)
+		}
+
+		decReq.Data = map[string]interface{}{
+			"ciphertext": rItem.Ciphertext,
+		}
+
+		resp, err = b.HandleRequest(context.Background(), decReq)
+		if err != nil || (resp != nil && resp.IsError()) {
+			t.Fatalf("err:%v resp:%#v", err, resp)
+		}
+
+		plaintext1 := "dGhlIHF1aWNrIGJyb3duIGZveA=="
+		plaintext2 := "dmlzaGFsCg=="
+		if resp.Data["plaintext"] != plaintext1 && resp.Data["plaintext"] != plaintext2 {
+			t.Fatalf("bad: plaintext. Expected: %q or %q, Actual: %q", plaintext1, plaintext2, resp.Data["plaintext"])
+		}
+	}
+}
diff --git a/builtin/logical/transit/path_rotate.go b/builtin/logical/transit/path_rotate.go
index c024aede4bc..ec70fa58517 100644
--- a/builtin/logical/transit/path_rotate.go
+++ b/builtin/logical/transit/path_rotate.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -56,9 +56,12 @@ func (b *backend) pathRotateWrite(ctx context.Context, req *logical.Request, d *
 		Name:    name,
 	}, b.GetRandomReader())
 	if err != nil {
+		// the error here will be something about "couldn't get policy")
+		b.Logger().Error("failed to rotate key on user request", "name", name, "error", err.Error())
 		return nil, err
 	}
 	if p == nil {
+		b.Logger().Error("failed to rotate key on user request", "name", name, "error", "key not found")
 		return logical.ErrorResponse("key not found"), logical.ErrInvalidRequest
 	}
 	if !b.System().CachingDisabled() {
@@ -70,7 +73,7 @@ func (b *backend) pathRotateWrite(ctx context.Context, req *logical.Request, d *
 		var keyId string
 		keyId, err = GetManagedKeyUUID(ctx, b, managedKeyName, managedKeyId)
 		if err != nil {
-			p.Unlock()
+			b.Logger().Error("failed to rotate key", "name", name, "error", err.Error())
 			return nil, err
 		}
 		err = p.RotateManagedKey(ctx, req.Storage, keyId)
@@ -80,10 +83,18 @@ func (b *backend) pathRotateWrite(ctx context.Context, req *logical.Request, d *
 	}
 
 	if err != nil {
+		b.Logger().Error("failed to rotate key on user request", "name", name, "error", err.Error())
 		return nil, err
 	}
 
-	return b.formatKeyPolicy(p, nil)
+	resp, err := b.formatKeyPolicy(p, nil)
+	if err != nil {
+		b.Logger().Error("failed to rotate key on user request", "name", name, "error", err.Error())
+	} else {
+		b.Logger().Info("succesfully rotated key on user request", "name", name)
+	}
+	// formatKeyPolicy returns a response even on error so be sure to return both.
+	return resp, err
 }
 
 const pathRotateHelpSyn = `Rotate named encryption key`
diff --git a/builtin/logical/transit/path_sign_verify.go b/builtin/logical/transit/path_sign_verify.go
index 3307c5ca99b..d76c9831f3f 100644
--- a/builtin/logical/transit/path_sign_verify.go
+++ b/builtin/logical/transit/path_sign_verify.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -7,11 +7,11 @@ import (
 	"context"
 	"crypto/rsa"
 	"encoding/base64"
-	"errors"
 	"fmt"
 	"strconv"
 	"strings"
 
+	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/helper/keysutil"
@@ -19,6 +19,41 @@ import (
 	"github.com/mitchellh/mapstructure"
 )
 
+// policySignArgs are the arguments required to pass through to the SDK policy.SignWithOptions
+type policySignArgs struct {
+	keyVersion int
+	keyContext []byte
+	input      []byte
+	options    keysutil.SigningOptions
+}
+
+type policyVerifyArgs struct {
+	keyContext []byte
+	input      []byte
+	options    keysutil.SigningOptions
+	sig        string
+}
+
+type commonSignVerifyApiArgs struct {
+	keyName       string
+	hashAlgorithm keysutil.HashType
+	marshaling    keysutil.MarshalingType
+	prehashed     bool
+	sigAlgorithm  string
+	saltLength    int
+}
+
+// signApiArgs represents the input arguments that apply to all members of the batch
+type signApiArgs struct {
+	commonSignVerifyApiArgs
+	keyVersion int
+}
+
+// verifyApiArgs represents the input arguments that apply to all members of the batch
+type verifyApiArgs struct {
+	commonSignVerifyApiArgs
+}
+
 // BatchRequestSignItem represents a request item for batch processing.
 // A map type allows us to distinguish between empty and missing values.
 type batchRequestSignItem map[string]string
@@ -51,7 +86,7 @@ type batchResponseSignItem struct {
 
 // BatchRequestVerifyItem represents a request item for batch processing.
 // A map type allows us to distinguish between empty and missing values.
-type batchRequestVerifyItem map[string]string
+type batchRequestVerifyItem map[string]interface{}
 
 // BatchResponseVerifyItem represents a response item for batch processing
 type batchResponseVerifyItem struct {
@@ -102,6 +137,12 @@ func (b *backend) pathSign() *framework.Path {
 derivation is enabled; currently only available with ed25519 keys.`,
 			},
 
+			"signature_context": {
+				Type: framework.TypeString,
+				Description: `Base64 encoded context for Ed25519ph and Ed25519ctx signatures.
+Currently only available with Ed25519 keys. (Enterprise Only)`,
+			},
+
 			"hash_algorithm": {
 				Type:    framework.TypeString,
 				Default: defaultHashAlgorithm,
@@ -206,6 +247,12 @@ func (b *backend) pathVerify() *framework.Path {
 derivation is enabled; currently only available with ed25519 keys.`,
 			},
 
+			"signature_context": {
+				Type: framework.TypeString,
+				Description: `Base64 encoded context for Ed25519ph and Ed25519ctx signatures. 
+Currently only available with Ed25519 keys. (Enterprise Only)`,
+			},
+
 			"signature": {
 				Type:        framework.TypeString,
 				Description: "The signature, including vault header/key version",
@@ -216,6 +263,11 @@ derivation is enabled; currently only available with ed25519 keys.`,
 				Description: "The HMAC, including vault header/key version",
 			},
 
+			"cmac": {
+				Type:        framework.TypeString,
+				Description: "The CMAC, including vault header/key version (Enterprise only)",
+			},
+
 			"input": {
 				Type:        framework.TypeString,
 				Description: "The base64-encoded input data to verify",
@@ -226,6 +278,11 @@ derivation is enabled; currently only available with ed25519 keys.`,
 				Description: `Hash algorithm to use (POST URL parameter)`,
 			},
 
+			"mac_length": {
+				Type:        framework.TypeInt,
+				Description: `MAC length to use (POST body parameter). Valid values are:`,
+			},
+
 			"hash_algorithm": {
 				Type:    framework.TypeString,
 				Default: defaultHashAlgorithm,
@@ -279,7 +336,7 @@ Options are 'auto' (the default used by Golang, causing the salt to be as large
 			"batch_input": {
 				Type: framework.TypeSlice,
 				Description: `Specifies a list of items for processing. When this parameter is set,
-any supplied  'input', 'hmac' or 'signature' parameters will be ignored. Responses are returned in the
+any supplied  'input', 'hmac', 'cmac' or 'signature' parameters will be ignored. Responses are returned in the
 'batch_results' array component of the 'data' element of the response. Any batch output will
 preserve the order of the batch input`,
 			},
@@ -294,7 +351,7 @@ preserve the order of the batch input`,
 	}
 }
 
-func (b *backend) getSaltLength(d *framework.FieldData) (int, error) {
+func getSaltLength(d *framework.FieldData) (int, error) {
 	rawSaltLength, ok := d.GetOk("salt_length")
 	// This should only happen when something is wrong with the schema,
 	// so this is a reasonable default.
@@ -322,33 +379,10 @@ func (b *backend) getSaltLength(d *framework.FieldData) (int, error) {
 }
 
 func (b *backend) pathSignWrite(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	name := d.Get("name").(string)
-	ver := d.Get("key_version").(int)
-	hashAlgorithmStr := d.Get("urlalgorithm").(string)
-	if hashAlgorithmStr == "" {
-		hashAlgorithmStr = d.Get("hash_algorithm").(string)
-		if hashAlgorithmStr == "" {
-			hashAlgorithmStr = d.Get("algorithm").(string)
-			if hashAlgorithmStr == "" {
-				hashAlgorithmStr = defaultHashAlgorithm
-			}
-		}
-	}
-
-	hashAlgorithm, ok := keysutil.HashTypeMap[hashAlgorithmStr]
-	if !ok {
-		return logical.ErrorResponse(fmt.Sprintf("invalid hash algorithm %q", hashAlgorithmStr)), logical.ErrInvalidRequest
-	}
-
-	marshalingStr := d.Get("marshaling_algorithm").(string)
-	marshaling, ok := keysutil.MarshalingTypeMap[marshalingStr]
-	if !ok {
-		return logical.ErrorResponse(fmt.Sprintf("invalid marshaling type %q", marshalingStr)), logical.ErrInvalidRequest
-	}
-
-	prehashed := d.Get("prehashed").(bool)
-	sigAlgorithm := d.Get("signature_algorithm").(string)
-	saltLength, err := b.getSaltLength(d)
+	// Fetch the top-level arguments for the sign api. These do not include
+	// the values that are within the batch input parameters, only those that
+	// apply globally.
+	apiArgs, err := getSignApiArgs(d)
 	if err != nil {
 		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
 	}
@@ -356,7 +390,7 @@ func (b *backend) pathSignWrite(ctx context.Context, req *logical.Request, d *fr
 	// Get the policy
 	p, _, err := b.GetPolicy(ctx, keysutil.PolicyRequest{
 		Storage: req.Storage,
-		Name:    name,
+		Name:    apiArgs.keyName,
 	}, b.GetRandomReader())
 	if err != nil {
 		return nil, err
@@ -369,15 +403,8 @@ func (b *backend) pathSignWrite(ctx context.Context, req *logical.Request, d *fr
 	}
 	defer p.Unlock()
 
-	if !p.Type.SigningSupported() {
-		return logical.ErrorResponse(fmt.Sprintf("key type %v does not support signing", p.Type)), logical.ErrInvalidRequest
-	}
-
-	// Allow managed keys to specify no hash algo without additional conditions.
-	if hashAlgorithm == keysutil.HashTypeNone && p.Type != keysutil.KeyType_MANAGED_KEY {
-		if !prehashed || sigAlgorithm != "pkcs1v15" {
-			return logical.ErrorResponse("hash_algorithm=none requires both prehashed=true and signature_algorithm=pkcs1v15"), logical.ErrInvalidRequest
-		}
+	if err := validateCommonSignVerifyApiArgs(p, apiArgs.commonSignVerifyApiArgs); err != nil {
+		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
 	}
 
 	batchInputRaw := d.Raw["batch_input"]
@@ -398,65 +425,23 @@ func (b *backend) pathSignWrite(ctx context.Context, req *logical.Request, d *fr
 			"input":   d.Get("input").(string),
 			"context": d.Get("context").(string),
 		}
+
+		// Only defined within the ENT schema, so this is useless on CE.
+		if sigContext, ok := d.GetOk("signature_context"); ok {
+			batchInputItems[0]["signature_context"] = sigContext.(string)
+		}
 	}
 
 	response := make([]batchResponseSignItem, len(batchInputItems))
 	for i, item := range batchInputItems {
-
-		rawInput, ok := item["input"]
-		if !ok {
-			response[i].Error = "missing input"
-			response[i].err = logical.ErrInvalidRequest
-			continue
-		}
-
-		input, err := base64.StdEncoding.DecodeString(rawInput)
+		psa, err := b.getPolicySignArgs(ctx, p, apiArgs, item)
 		if err != nil {
-			response[i].Error = fmt.Sprintf("unable to decode input as base64: %s", err)
+			response[i].Error = err.Error()
 			response[i].err = logical.ErrInvalidRequest
 			continue
 		}
 
-		if p.Type.HashSignatureInput() && !prehashed {
-			hf := keysutil.HashFuncMap[hashAlgorithm]()
-			if hf != nil {
-				hf.Write(input)
-				input = hf.Sum(nil)
-			}
-		}
-
-		contextRaw := item["context"]
-		var context []byte
-		if len(contextRaw) != 0 {
-			context, err = base64.StdEncoding.DecodeString(contextRaw)
-			if err != nil {
-				response[i].Error = "failed to base64-decode context"
-				response[i].err = logical.ErrInvalidRequest
-				continue
-			}
-		}
-
-		var managedKeyParameters keysutil.ManagedKeyParameters
-		if p.Type == keysutil.KeyType_MANAGED_KEY {
-			managedKeySystemView, ok := b.System().(logical.ManagedKeySystemView)
-			if !ok {
-				return nil, errors.New("unsupported system view")
-			}
-
-			managedKeyParameters = keysutil.ManagedKeyParameters{
-				ManagedKeySystemView: managedKeySystemView,
-				BackendUUID:          b.backendUUID,
-				Context:              ctx,
-			}
-		}
-
-		sig, err := p.SignWithOptions(ver, context, input, &keysutil.SigningOptions{
-			HashAlgorithm:    hashAlgorithm,
-			Marshaling:       marshaling,
-			SaltLength:       saltLength,
-			SigAlgorithm:     sigAlgorithm,
-			ManagedKeyParams: managedKeyParameters,
-		})
+		sig, err := p.SignWithOptions(psa.keyVersion, psa.keyContext, psa.input, &psa.options)
 		if err != nil {
 			if batchInputRaw != nil {
 				response[i].Error = err.Error()
@@ -465,7 +450,7 @@ func (b *backend) pathSignWrite(ctx context.Context, req *logical.Request, d *fr
 		} else if sig == nil {
 			response[i].err = fmt.Errorf("signature could not be computed")
 		} else {
-			keyVersion := ver
+			keyVersion := apiArgs.keyVersion
 			if keyVersion == 0 {
 				keyVersion = p.LatestVersion
 			}
@@ -508,33 +493,129 @@ func (b *backend) pathSignWrite(ctx context.Context, req *logical.Request, d *fr
 	return resp, nil
 }
 
-func (b *backend) pathVerifyWrite(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	batchInputRaw := d.Raw["batch_input"]
-	var batchInputItems []batchRequestVerifyItem
-	if batchInputRaw != nil {
-		err := mapstructure.Decode(batchInputRaw, &batchInputItems)
-		if err != nil {
-			return nil, fmt.Errorf("failed to parse batch input: %w", err)
-		}
+func (b *backend) getPolicySignArgs(ctx context.Context, p *keysutil.Policy, args signApiArgs, item batchRequestSignItem) (policySignArgs, error) {
+	rawInput, ok := item["input"]
+	if !ok {
+		return policySignArgs{}, fmt.Errorf("missing input")
+	}
 
-		if len(batchInputItems) == 0 {
-			return logical.ErrorResponse("missing batch input to process"), logical.ErrInvalidRequest
-		}
-	} else {
-		// use empty string if input is missing - not an error
-		inputB64 := d.Get("input").(string)
+	input, err := base64.StdEncoding.DecodeString(rawInput)
+	if err != nil {
+		return policySignArgs{}, fmt.Errorf("unable to decode input: %s", err)
+	}
 
-		batchInputItems = make([]batchRequestVerifyItem, 1)
-		batchInputItems[0] = batchRequestVerifyItem{
-			"input": inputB64,
+	if p.Type.HashSignatureInput() && !args.prehashed {
+		hf := keysutil.HashFuncMap[args.hashAlgorithm]()
+		if hf != nil {
+			hf.Write(input)
+			input = hf.Sum(nil)
 		}
-		if sig, ok := d.GetOk("signature"); ok {
-			batchInputItems[0]["signature"] = sig.(string)
-		}
-		if hmac, ok := d.GetOk("hmac"); ok {
-			batchInputItems[0]["hmac"] = hmac.(string)
+	}
+
+	keyContext, err := decodeBase64Arg(item["context"])
+	if err != nil {
+		return policySignArgs{}, fmt.Errorf("failed to base64-decode context")
+	}
+
+	psa := policySignArgs{
+		keyVersion: args.keyVersion,
+		keyContext: keyContext,
+		input:      input,
+		options: keysutil.SigningOptions{
+			HashAlgorithm: args.hashAlgorithm,
+			Marshaling:    args.marshaling,
+			SaltLength:    args.saltLength,
+			SigAlgorithm:  args.sigAlgorithm,
+		},
+	}
+
+	if err := b.populateEntPolicySigningOptions(ctx, p, args, item, &psa); err != nil {
+		return policySignArgs{}, fmt.Errorf("failed to parse batch item: %s", err)
+	}
+	return psa, nil
+}
+
+func validateCommonSignVerifyApiArgs(p *keysutil.Policy, apiArgs commonSignVerifyApiArgs) error {
+	if !p.Type.SigningSupported() {
+		return fmt.Errorf("key type %v does not support signing", p.Type)
+	}
+
+	// Perform Vault version specific checks (CE vs ENT)
+	return validateSignApiArgsVersionSpecific(p, apiArgs)
+}
+
+func getSignApiArgs(d *framework.FieldData) (signApiArgs, error) {
+	keyVersion := d.Get("key_version").(int)
+	commonArgs, err := getCommonSignVerifyApiArgs(d)
+	if err != nil {
+		return signApiArgs{}, err
+	}
+
+	return signApiArgs{
+		commonSignVerifyApiArgs: commonArgs,
+		keyVersion:              keyVersion,
+	}, nil
+}
+
+func getCommonSignVerifyApiArgs(d *framework.FieldData) (commonSignVerifyApiArgs, error) {
+	keyName := d.Get("name").(string)
+	hashAlgorithmStr, hashAlgorithm, ok := getHashAlgorithmFromArgs(d)
+	if !ok {
+		return commonSignVerifyApiArgs{}, fmt.Errorf("invalid hash algorithm %q", hashAlgorithmStr)
+	}
+
+	marshalingStr := d.Get("marshaling_algorithm").(string)
+	marshaling, ok := keysutil.MarshalingTypeMap[marshalingStr]
+	if !ok {
+		return commonSignVerifyApiArgs{}, fmt.Errorf("invalid marshaling type %q", marshalingStr)
+	}
+
+	prehashed := d.Get("prehashed").(bool)
+	sigAlgorithm := d.Get("signature_algorithm").(string)
+	saltLength, err := getSaltLength(d)
+	if err != nil {
+		return commonSignVerifyApiArgs{}, err
+	}
+
+	return commonSignVerifyApiArgs{
+		keyName:       keyName,
+		hashAlgorithm: hashAlgorithm,
+		marshaling:    marshaling,
+		prehashed:     prehashed,
+		sigAlgorithm:  sigAlgorithm,
+		saltLength:    saltLength,
+	}, nil
+}
+
+func getHashAlgorithmFromArgs(d *framework.FieldData) (string, keysutil.HashType, bool) {
+	hashAlgorithmStr := d.Get("urlalgorithm").(string)
+	if hashAlgorithmStr == "" {
+		hashAlgorithmStr = d.Get("hash_algorithm").(string)
+		if hashAlgorithmStr == "" {
+			hashAlgorithmStr = d.Get("algorithm").(string)
+			if hashAlgorithmStr == "" {
+				hashAlgorithmStr = defaultHashAlgorithm
+			}
 		}
-		batchInputItems[0]["context"] = d.Get("context").(string)
+	}
+
+	hashAlgorithm, ok := keysutil.HashTypeMap[hashAlgorithmStr]
+	return hashAlgorithmStr, hashAlgorithm, ok
+}
+
+func decodeBase64Arg(fieldVal interface{}) ([]byte, error) {
+	parsedStr, err := parseutil.ParseString(fieldVal)
+	if err != nil {
+		return nil, err
+	}
+
+	return base64.StdEncoding.DecodeString(parsedStr)
+}
+
+func (b *backend) pathVerifyWrite(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	batchInputItems, isBatchInput, err := getVerifyBatchItems(d)
+	if err != nil {
+		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
 	}
 
 	// For simplicity, 'signature' and 'hmac' cannot be mixed across batch_input elements.
@@ -542,26 +623,30 @@ func (b *backend) pathVerifyWrite(ctx context.Context, req *logical.Request, d *
 	// If one batch_input item is 'hmac', they all must be 'hmac'.
 	sigFound := false
 	hmacFound := false
+	cmacFound := false
 	missing := false
 	for _, v := range batchInputItems {
 		if _, ok := v["signature"]; ok {
 			sigFound = true
 		} else if _, ok := v["hmac"]; ok {
 			hmacFound = true
+		} else if _, ok := v["cmac"]; ok {
+			cmacFound = true
 		} else {
 			missing = true
 		}
 	}
+	optionsSet := numBooleansTrue(sigFound, hmacFound, cmacFound)
 
 	switch {
-	case batchInputRaw == nil && sigFound && hmacFound:
-		return logical.ErrorResponse("provide one of 'signature' or 'hmac'"), logical.ErrInvalidRequest
+	case !isBatchInput && optionsSet > 1:
+		return logical.ErrorResponse("provide one of 'signature', 'hmac' or 'cmac'"), logical.ErrInvalidRequest
 
-	case batchInputRaw == nil && !sigFound && !hmacFound:
-		return logical.ErrorResponse("neither a 'signature' nor an 'hmac' were given to verify"), logical.ErrInvalidRequest
+	case !isBatchInput && optionsSet == 0:
+		return logical.ErrorResponse("missing one of 'signature', 'hmac' or 'cmac' arguments to verify"), logical.ErrInvalidRequest
 
-	case sigFound && hmacFound:
-		return logical.ErrorResponse("elements of batch_input must all provide 'signature' or all provide 'hmac'"), logical.ErrInvalidRequest
+	case optionsSet > 1:
+		return logical.ErrorResponse("elements of batch_input must all provide either 'signature', 'hmac' or 'cmac'"), logical.ErrInvalidRequest
 
 	case missing && sigFound:
 		return logical.ErrorResponse("some elements of batch_input are missing 'signature'"), logical.ErrInvalidRequest
@@ -569,39 +654,20 @@ func (b *backend) pathVerifyWrite(ctx context.Context, req *logical.Request, d *
 	case missing && hmacFound:
 		return logical.ErrorResponse("some elements of batch_input are missing 'hmac'"), logical.ErrInvalidRequest
 
-	case missing:
-		return logical.ErrorResponse("no batch_input elements have 'signature' or 'hmac'"), logical.ErrInvalidRequest
+	case missing && cmacFound:
+		return logical.ErrorResponse("some elements of batch_input are missing 'cmac'"), logical.ErrInvalidRequest
+
+	case optionsSet == 0:
+		return logical.ErrorResponse("no batch_input elements have 'signature', 'hmac' or 'cmac'"), logical.ErrInvalidRequest
 
 	case hmacFound:
 		return b.pathHMACVerify(ctx, req, d)
-	}
 
-	name := d.Get("name").(string)
-	hashAlgorithmStr := d.Get("urlalgorithm").(string)
-	if hashAlgorithmStr == "" {
-		hashAlgorithmStr = d.Get("hash_algorithm").(string)
-		if hashAlgorithmStr == "" {
-			hashAlgorithmStr = d.Get("algorithm").(string)
-			if hashAlgorithmStr == "" {
-				hashAlgorithmStr = defaultHashAlgorithm
-			}
-		}
+	case cmacFound:
+		return b.pathCMACVerify(ctx, req, d)
 	}
 
-	hashAlgorithm, ok := keysutil.HashTypeMap[hashAlgorithmStr]
-	if !ok {
-		return logical.ErrorResponse(fmt.Sprintf("invalid hash algorithm %q", hashAlgorithmStr)), logical.ErrInvalidRequest
-	}
-
-	marshalingStr := d.Get("marshaling_algorithm").(string)
-	marshaling, ok := keysutil.MarshalingTypeMap[marshalingStr]
-	if !ok {
-		return logical.ErrorResponse(fmt.Sprintf("invalid marshaling type %q", marshalingStr)), logical.ErrInvalidRequest
-	}
-
-	prehashed := d.Get("prehashed").(bool)
-	sigAlgorithm := d.Get("signature_algorithm").(string)
-	saltLength, err := b.getSaltLength(d)
+	apiArgs, err := getVerifyApiArgs(d)
 	if err != nil {
 		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
 	}
@@ -609,7 +675,7 @@ func (b *backend) pathVerifyWrite(ctx context.Context, req *logical.Request, d *
 	// Get the policy
 	p, _, err := b.GetPolicy(ctx, keysutil.PolicyRequest{
 		Storage: req.Storage,
-		Name:    name,
+		Name:    apiArgs.keyName,
 	}, b.GetRandomReader())
 	if err != nil {
 		return nil, err
@@ -622,90 +688,28 @@ func (b *backend) pathVerifyWrite(ctx context.Context, req *logical.Request, d *
 	}
 	defer p.Unlock()
 
-	if !p.Type.SigningSupported() {
-		return logical.ErrorResponse(fmt.Sprintf("key type %v does not support verification", p.Type)), logical.ErrInvalidRequest
-	}
-
-	// Allow managed keys to specify no hash algo without additional conditions.
-	if hashAlgorithm == keysutil.HashTypeNone && p.Type != keysutil.KeyType_MANAGED_KEY {
-		if !prehashed || sigAlgorithm != "pkcs1v15" {
-			return logical.ErrorResponse("hash_algorithm=none requires both prehashed=true and signature_algorithm=pkcs1v15"), logical.ErrInvalidRequest
-		}
+	if err := validateCommonSignVerifyApiArgs(p, apiArgs.commonSignVerifyApiArgs); err != nil {
+		return logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
 	}
 
 	response := make([]batchResponseVerifyItem, len(batchInputItems))
 
 	for i, item := range batchInputItems {
-
-		rawInput, ok := item["input"]
-		if !ok {
-			response[i].Error = "missing input"
-			response[i].err = logical.ErrInvalidRequest
-			continue
-		}
-
-		input, err := base64.StdEncoding.DecodeString(rawInput)
+		pva, err := b.getPolicyVerifyArgs(ctx, p, apiArgs, item)
 		if err != nil {
-			response[i].Error = fmt.Sprintf("unable to decode input as base64: %s", err)
+			response[i].Error = fmt.Sprintf("failed to parse item: %s", err)
 			response[i].err = logical.ErrInvalidRequest
 			continue
 		}
 
-		sig, ok := item["signature"]
-		if !ok {
-			response[i].Error = "missing signature"
-			response[i].err = logical.ErrInvalidRequest
-			continue
-		}
-
-		if p.Type.HashSignatureInput() && !prehashed {
-			hf := keysutil.HashFuncMap[hashAlgorithm]()
-			if hf != nil {
-				hf.Write(input)
-				input = hf.Sum(nil)
-			}
-		}
-
-		contextRaw := item["context"]
-		var context []byte
-		if len(contextRaw) != 0 {
-			context, err = base64.StdEncoding.DecodeString(contextRaw)
-			if err != nil {
-				response[i].Error = "failed to base64-decode context"
-				response[i].err = logical.ErrInvalidRequest
-				continue
-			}
-		}
-		var managedKeyParameters keysutil.ManagedKeyParameters
-		if p.Type == keysutil.KeyType_MANAGED_KEY {
-			managedKeySystemView, ok := b.System().(logical.ManagedKeySystemView)
-			if !ok {
-				return nil, errors.New("unsupported system view")
-			}
-
-			managedKeyParameters = keysutil.ManagedKeyParameters{
-				ManagedKeySystemView: managedKeySystemView,
-				BackendUUID:          b.backendUUID,
-				Context:              ctx,
-			}
-		}
-
-		signingOptions := &keysutil.SigningOptions{
-			HashAlgorithm:    hashAlgorithm,
-			Marshaling:       marshaling,
-			SaltLength:       saltLength,
-			SigAlgorithm:     sigAlgorithm,
-			ManagedKeyParams: managedKeyParameters,
-		}
-
-		valid, err := p.VerifySignatureWithOptions(context, input, sig, signingOptions)
+		valid, err := p.VerifySignatureWithOptions(pva.keyContext, pva.input, pva.sig, &pva.options)
 		if err != nil {
 			switch err.(type) {
 			case errutil.UserError:
 				response[i].Error = err.Error()
 				response[i].err = logical.ErrInvalidRequest
 			default:
-				if batchInputRaw != nil {
+				if isBatchInput {
 					response[i].Error = err.Error()
 				}
 				response[i].err = err
@@ -717,10 +721,12 @@ func (b *backend) pathVerifyWrite(ctx context.Context, req *logical.Request, d *
 
 	// Generate the response
 	resp := &logical.Response{}
-	if batchInputRaw != nil {
+	if isBatchInput {
 		// Copy the references
 		for i := range batchInputItems {
-			response[i].Reference = batchInputItems[i]["reference"]
+			if ref, err := parseutil.ParseString(batchInputItems[i]["reference"]); err == nil {
+				response[i].Reference = ref
+			}
 		}
 		resp.Data = map[string]interface{}{
 			"batch_results": response,
@@ -740,6 +746,112 @@ func (b *backend) pathVerifyWrite(ctx context.Context, req *logical.Request, d *
 	return resp, nil
 }
 
+func getVerifyApiArgs(d *framework.FieldData) (verifyApiArgs, error) {
+	commonArgs, err := getCommonSignVerifyApiArgs(d)
+	if err != nil {
+		return verifyApiArgs{}, err
+	}
+
+	return verifyApiArgs{
+		commonSignVerifyApiArgs: commonArgs,
+	}, nil
+}
+
+func getVerifyBatchItems(d *framework.FieldData) ([]batchRequestVerifyItem, bool, error) {
+	if batchInputRaw, ok := d.Raw["batch_input"]; ok && batchInputRaw != nil {
+		var batchInputItems []batchRequestVerifyItem
+		err := mapstructure.Decode(batchInputRaw, &batchInputItems)
+		if err != nil {
+			return nil, false, fmt.Errorf("failed to parse batch input: %w", err)
+		}
+
+		if len(batchInputItems) == 0 {
+			return nil, false, fmt.Errorf("missing batch input to process")
+		}
+
+		return batchInputItems, true, nil
+	}
+
+	// use empty string if input is missing - not an error
+	item := batchRequestVerifyItem{
+		"input": d.Get("input").(string),
+	}
+	if sig, ok := d.GetOk("signature"); ok {
+		item["signature"] = sig.(string)
+	}
+	if hmac, ok := d.GetOk("hmac"); ok {
+		item["hmac"] = hmac.(string)
+	}
+	if cmac, ok := d.GetOk("cmac"); ok {
+		item["cmac"] = cmac.(string)
+	}
+
+	item["context"] = d.Get("context").(string)
+
+	if sigContext, ok := d.GetOk("signature_context"); ok {
+		item["signature_context"] = sigContext.(string)
+	}
+
+	return []batchRequestVerifyItem{item}, false, nil
+}
+
+func (b *backend) getPolicyVerifyArgs(ctx context.Context, p *keysutil.Policy, apiArgs verifyApiArgs, item batchRequestVerifyItem) (policyVerifyArgs, error) {
+	input, err := decodeBase64Arg(item["input"])
+	if err != nil {
+		return policyVerifyArgs{}, fmt.Errorf("failed to parse input: %s", err)
+	}
+
+	sigRaw, ok := item["signature"]
+	if !ok {
+		return policyVerifyArgs{}, fmt.Errorf("missing signature")
+	}
+	sig, err := parseutil.ParseString(sigRaw)
+	if err != nil {
+		return policyVerifyArgs{}, fmt.Errorf("failed to parse signature as a string: %s", err)
+	}
+
+	if p.Type.HashSignatureInput() && !apiArgs.prehashed {
+		hf := keysutil.HashFuncMap[apiArgs.hashAlgorithm]()
+		if hf != nil {
+			hf.Write(input)
+			input = hf.Sum(nil)
+		}
+	}
+
+	keyContext, err := decodeBase64Arg(item["context"])
+	if err != nil {
+		return policyVerifyArgs{}, fmt.Errorf("failed to parse context: %s", err)
+	}
+
+	vsa := policyVerifyArgs{
+		keyContext: keyContext,
+		input:      input,
+		sig:        sig,
+		options: keysutil.SigningOptions{
+			HashAlgorithm: apiArgs.hashAlgorithm,
+			Marshaling:    apiArgs.marshaling,
+			SaltLength:    apiArgs.saltLength,
+			SigAlgorithm:  apiArgs.sigAlgorithm,
+		},
+	}
+
+	if err := b.populateEntPolicyVerifyOptions(ctx, p, apiArgs, item, &vsa); err != nil {
+		return policyVerifyArgs{}, fmt.Errorf("failed to parse batch item: %s", err)
+	}
+
+	return vsa, nil
+}
+
+func numBooleansTrue(bools ...bool) int {
+	numSet := 0
+	for _, value := range bools {
+		if value {
+			numSet++
+		}
+	}
+	return numSet
+}
+
 const pathSignHelpSyn = `Generate a signature for input data using the named key`
 
 const pathSignHelpDesc = `
diff --git a/builtin/logical/transit/path_sign_verify_ce.go b/builtin/logical/transit/path_sign_verify_ce.go
new file mode 100644
index 00000000000..ee084825364
--- /dev/null
+++ b/builtin/logical/transit/path_sign_verify_ce.go
@@ -0,0 +1,81 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package transit
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/vault/sdk/helper/keysutil"
+)
+
+// validateSignApiArgsVersionSpecific will perform a validation of the Sign API parameters
+// from the Enterprise or CE point of view.
+func validateSignApiArgsVersionSpecific(p *keysutil.Policy, apiArgs commonSignVerifyApiArgs) error {
+	if err := _validateEntSpecificKeyType(p); err != nil {
+		return err
+	}
+
+	if apiArgs.hashAlgorithm == keysutil.HashTypeNone {
+		if !apiArgs.prehashed || apiArgs.sigAlgorithm != "pkcs1v15" {
+			return fmt.Errorf("hash_algorithm=none requires both prehashed=true and signature_algorithm=pkcs1v15")
+		}
+	}
+
+	return nil
+}
+
+// populateEntPolicySigning augments or tweaks the input parameters to the SDK policy.SignWithOptions for
+// Enterprise usage.
+func (b *backend) populateEntPolicySigningOptions(_ context.Context, p *keysutil.Policy, args signApiArgs, item batchRequestSignItem, _ *policySignArgs) error {
+	return _forbidEd25519EntBehavior(p, args.commonSignVerifyApiArgs, item["signature_context"])
+}
+
+// populateEntPolicyVerifyOptions augments or tweaks the input parameters to the SDK policy.VerifyWithOptions for
+// Enterprise usage.
+func (b *backend) populateEntPolicyVerifyOptions(_ context.Context, p *keysutil.Policy, args verifyApiArgs, item batchRequestVerifyItem, _ *policyVerifyArgs) error {
+	sigContext, err := _validateString(item, "signature_context")
+	if err != nil {
+		return err
+	}
+	return _forbidEd25519EntBehavior(p, args.commonSignVerifyApiArgs, sigContext)
+}
+
+func _validateString(item batchRequestVerifyItem, key string) (string, error) {
+	if itemVal, exists := item[key]; exists {
+		if itemStrVal, ok := itemVal.(string); ok {
+			return itemStrVal, nil
+		}
+		return "", fmt.Errorf("expected string for key=%q, got=%q", key, itemVal)
+	}
+	return "", nil
+}
+
+func _forbidEd25519EntBehavior(p *keysutil.Policy, apiArgs commonSignVerifyApiArgs, sigContext string) error {
+	if p.Type != keysutil.KeyType_ED25519 {
+		return nil
+	}
+
+	switch {
+	case apiArgs.prehashed:
+		return fmt.Errorf("only Pure Ed25519 signatures supported, prehashed must be false")
+	case apiArgs.hashAlgorithm == keysutil.HashTypeSHA2512:
+		return fmt.Errorf("only Pure Ed25519 signatures supported, hash_alogithm should not be set")
+	case sigContext != "":
+		return fmt.Errorf("only Pure Ed25519 signatures supported, signature_context must be empty")
+	}
+
+	return nil
+}
+
+func _validateEntSpecificKeyType(p *keysutil.Policy) error {
+	switch p.Type {
+	case keysutil.KeyType_AES128_CMAC, keysutil.KeyType_AES256_CMAC, keysutil.KeyType_AES192_CMAC, keysutil.KeyType_MANAGED_KEY:
+		return fmt.Errorf("enterprise specific key type %q can not be used on CE", p.Type)
+	default:
+		return nil
+	}
+}
diff --git a/builtin/logical/transit/path_sign_verify_test.go b/builtin/logical/transit/path_sign_verify_test.go
index 1421f71c34d..89497340133 100644
--- a/builtin/logical/transit/path_sign_verify_test.go
+++ b/builtin/logical/transit/path_sign_verify_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
@@ -7,6 +7,7 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
+	"maps"
 	"strconv"
 	"strings"
 	"testing"
@@ -15,6 +16,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/keysutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/mitchellh/mapstructure"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ed25519"
 )
 
@@ -368,6 +370,103 @@ func validatePublicKey(t *testing.T, in string, sig string, pubKeyRaw []byte, ex
 	}
 }
 
+// TestTransit_SignVerify_Ed25519Behavior makes sure the options on ENT for a
+// Ed25519ph/ctx signature fail on CE and ENT if invalid
+func TestTransit_SignVerify_Ed25519Behavior(t *testing.T) {
+	b, storage := createBackendWithSysView(t)
+
+	// First create a key
+	req := &logical.Request{
+		Storage:   storage,
+		Operation: logical.UpdateOperation,
+		Path:      "keys/foo",
+		Data: map[string]interface{}{
+			"type": "ed25519",
+		},
+	}
+	_, err := b.HandleRequest(context.Background(), req)
+	require.NoError(t, err, "failed creating ed25519 key")
+
+	tests := []struct {
+		name       string
+		args       map[string]interface{}
+		worksOnEnt bool
+	}{
+		{"sha2-512 only", map[string]interface{}{"hash_algorithm": "sha2-512"}, false},
+		{"prehashed only", map[string]interface{}{"prehashed": "true"}, false},
+		{"incorrect input for ph args", map[string]interface{}{"prehashed": "true", "hash_algorithm": "sha2-512"}, false},
+		{"context too long", map[string]interface{}{"signature_context": strings.Repeat("x", 1024)}, false},
+		{
+			name: "ctx-signature",
+			args: map[string]interface{}{
+				"signature_context": "dGVzdGluZyBjb250ZXh0Cg==",
+			},
+			worksOnEnt: true,
+		},
+		{
+			name: "ph-signature",
+			args: map[string]interface{}{
+				"input":             "3a81oZNherrMQXNJriBBMRLm+k6JqX6iCp7u5ktV05ohkpkqJ0/BqDa6PCOj/uu9RU1EI2Q86A4qmslPpUyknw==",
+				"prehashed":         "true",
+				"hash_algorithm":    "sha2-512",
+				"signature_context": "dGVzdGluZyBjb250ZXh0Cg==",
+			},
+			worksOnEnt: true,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			signData := map[string]interface{}{"input": "dGhlIHF1aWNrIGJyb3duIGZveA=="}
+
+			// if tc.args specifies input, this should overwrite our static value above.
+			maps.Copy(signData, tc.args)
+
+			req = &logical.Request{
+				Storage:   storage,
+				Operation: logical.UpdateOperation,
+				Path:      "sign/foo",
+				Data:      signData,
+			}
+
+			signSignature := "YmFkIHNpZ25hdHVyZQo=" // "bad signature" but is overwritten if sign works
+			resp, err := b.HandleRequest(context.Background(), req)
+			if constants.IsEnterprise && tc.worksOnEnt {
+				require.NoError(t, err, "expected sign to work on ENT but failed: resp: %v", resp)
+				require.NotNil(t, resp, "sign should have had non-nil response on ENT")
+				require.False(t, resp.IsError(), "sign expected to work on ENT but failed")
+				signSignature = resp.Data["signature"].(string)
+				require.NotEmpty(t, signSignature, "sign expected to work on ENT but was empty")
+			} else {
+				require.ErrorContains(t, err, "invalid request", "expected sign request to fail with invalid request")
+			}
+
+			verifyData := map[string]interface{}{
+				"input":     signData["input"],
+				"signature": signSignature,
+			}
+
+			// if tc.args specifies input, this should overwrite our static value above.
+			maps.Copy(verifyData, tc.args)
+
+			req = &logical.Request{
+				Storage:   storage,
+				Operation: logical.UpdateOperation,
+				Path:      "verify/foo",
+				Data:      verifyData,
+			}
+			resp, err = b.HandleRequest(context.Background(), req)
+			if constants.IsEnterprise && tc.worksOnEnt {
+				require.NoError(t, err, "verify expected to work on ENT but failed: resp: %v", resp)
+				require.NotNil(t, resp, "verify should have had non-nil response on ENT")
+				require.False(t, resp.IsError(), "expected verify to work on ENT but failed")
+				require.True(t, resp.Data["valid"].(bool), "signature verification should have worked")
+			} else {
+				require.ErrorContains(t, err, "invalid request", "expected verify request to fail with invalid request")
+			}
+		})
+	}
+}
+
 func TestTransit_SignVerify_ED25519(t *testing.T) {
 	b, storage := createBackendWithSysView(t)
 
diff --git a/builtin/logical/transit/path_trim.go b/builtin/logical/transit/path_trim.go
index 3f0a4df0ad2..98e1ca1cd59 100644
--- a/builtin/logical/transit/path_trim.go
+++ b/builtin/logical/transit/path_trim.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_trim_test.go b/builtin/logical/transit/path_trim_test.go
index 448d0fba34b..c497c3d347b 100644
--- a/builtin/logical/transit/path_trim_test.go
+++ b/builtin/logical/transit/path_trim_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_wrapping_key.go b/builtin/logical/transit/path_wrapping_key.go
index 42ccb888a24..8d4d87db597 100644
--- a/builtin/logical/transit/path_wrapping_key.go
+++ b/builtin/logical/transit/path_wrapping_key.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/path_wrapping_key_test.go b/builtin/logical/transit/path_wrapping_key_test.go
index 9ed58e45c28..140de807e78 100644
--- a/builtin/logical/transit/path_wrapping_key_test.go
+++ b/builtin/logical/transit/path_wrapping_key_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/logical/transit/stepwise_test.go b/builtin/logical/transit/stepwise_test.go
index 77cf093b991..edaded5a27f 100644
--- a/builtin/logical/transit/stepwise_test.go
+++ b/builtin/logical/transit/stepwise_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package transit
diff --git a/builtin/plugin/backend.go b/builtin/plugin/backend.go
index 4ab5c593df6..500e2622ea8 100644
--- a/builtin/plugin/backend.go
+++ b/builtin/plugin/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugin
diff --git a/builtin/plugin/backend_lazyLoad_test.go b/builtin/plugin/backend_lazyLoad_test.go
index 3e52cc14ac4..4d1cee46372 100644
--- a/builtin/plugin/backend_lazyLoad_test.go
+++ b/builtin/plugin/backend_lazyLoad_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugin
diff --git a/builtin/plugin/backend_test.go b/builtin/plugin/backend_test.go
index 71344406128..d9732e49a12 100644
--- a/builtin/plugin/backend_test.go
+++ b/builtin/plugin/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugin_test
diff --git a/builtin/plugin/mock_plugin_test.go b/builtin/plugin/mock_plugin_test.go
deleted file mode 100644
index 6c189a846a8..00000000000
--- a/builtin/plugin/mock_plugin_test.go
+++ /dev/null
@@ -1,11 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package plugin
-
-import (
-	_ "github.com/hashicorp/vault-plugin-mock"
-)
-
-// This file exists to force an import of vault-plugin-mock (which itself does nothing),
-// for purposes of CI and GitHub actions testing between plugin repos and Vault.
diff --git a/builtin/plugin/v5/backend.go b/builtin/plugin/v5/backend.go
index 38433dff71b..ece714b2c1a 100644
--- a/builtin/plugin/v5/backend.go
+++ b/builtin/plugin/v5/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugin
diff --git a/changelog/10624.txt b/changelog/10624.txt
new file mode 100644
index 00000000000..fdb473b80d0
--- /dev/null
+++ b/changelog/10624.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+storage/azure: Updated metadata endpoint to `GetMSIEndpoint`, which supports more than just the metadata service.
+```
diff --git a/changelog/11084.txt b/changelog/11084.txt
new file mode 100644
index 00000000000..444c93da995
--- /dev/null
+++ b/changelog/11084.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+serviceregistration: Added support for Consul ServiceMeta tags from config file from the new `service_meta` config field.
+```
diff --git a/changelog/14723.txt b/changelog/14723.txt
new file mode 100644
index 00000000000..04953430d86
--- /dev/null
+++ b/changelog/14723.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+core/identity: allow identity backend to be tuned using standard secrets backend tuning parameters.
+```
+
diff --git a/changelog/16484.txt b/changelog/16484.txt
new file mode 100644
index 00000000000..055f214dabd
--- /dev/null
+++ b/changelog/16484.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/appid, auth/cert, auth/github, auth/ldap, auth/okta, auth/radius, auth/userpass: fixed an issue with policy name normalization that would prevent a token associated with a policy containing an uppercase character to be renewed.
+```
diff --git a/changelog/16974.txt b/changelog/16974.txt
new file mode 100644
index 00000000000..202670ea436
--- /dev/null
+++ b/changelog/16974.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Add a `--dev-no-kv` flag to prevent auto mounting a key-value secret backend when running a dev server
+```
diff --git a/changelog/17007.txt b/changelog/17007.txt
new file mode 100644
index 00000000000..6c2a2801b24
--- /dev/null
+++ b/changelog/17007.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/token: fixes an edge case bug that "identity_policies" is nil and causes cli vault login error
+```
diff --git a/changelog/17272.txt b/changelog/17272.txt
new file mode 100644
index 00000000000..9d580d80e31
--- /dev/null
+++ b/changelog/17272.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/cert: Adds support for TLS certificate authenticaion through a reverse proxy that terminates the SSL connection
+```
diff --git a/changelog/17598.txt b/changelog/17598.txt
new file mode 100644
index 00000000000..8171255f8e9
--- /dev/null
+++ b/changelog/17598.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core/config: reload service registration configuration on SIGHUP
+```
diff --git a/changelog/18615.txt b/changelog/18615.txt
new file mode 100644
index 00000000000..2aa4b32a4cb
--- /dev/null
+++ b/changelog/18615.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: fix issue when attempting to re-bootstrap HA when using Raft as HA but not storage
+```
\ No newline at end of file
diff --git a/changelog/19064.txt b/changelog/19064.txt
new file mode 100644
index 00000000000..cf31525e25e
--- /dev/null
+++ b/changelog/19064.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core/cli: Example 'help' pages for vault read / write docs improved.
+```
diff --git a/changelog/21159.txt b/changelog/21159.txt
new file mode 100644
index 00000000000..25c1e53d90d
--- /dev/null
+++ b/changelog/21159.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+storage/dynamodb: Speed up list and delete of large directories by only requesting keys from DynamoDB
+```
+
diff --git a/changelog/21993.txt b/changelog/21993.txt
new file mode 100644
index 00000000000..856cfc9662e
--- /dev/null
+++ b/changelog/21993.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Allow vault CLI HTTP headers to be specified using the JSON-encoded VAULT_HEADERS environment variable
+```
\ No newline at end of file
diff --git a/changelog/22460.txt b/changelog/22460.txt
new file mode 100644
index 00000000000..dba53a78ed2
--- /dev/null
+++ b/changelog/22460.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/aws: add canonical ARN as entity alias option
+```
diff --git a/changelog/22726.txt b/changelog/22726.txt
new file mode 100644
index 00000000000..7da05f79482
--- /dev/null
+++ b/changelog/22726.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/aws: Add sts_region parameter to root config for STS API calls.
+```
\ No newline at end of file
diff --git a/changelog/23621.txt b/changelog/23621.txt
index 0db83bd2df3..2af5f337e63 100644
--- a/changelog/23621.txt
+++ b/changelog/23621.txt
@@ -1,3 +1,3 @@
 ```release-note:feature
-**Vault Proxy Static Secret Caching**: Adds support for static secret (KVv1 and KVv2) caching to Vault Proxy.
+**Vault Proxy Static Secret Caching (enterprise)**: Adds support for static secret (KVv1 and KVv2) caching to Vault Proxy.
 ```
diff --git a/changelog/23740.txt b/changelog/23740.txt
deleted file mode 100644
index 76582bcfbcb..00000000000
--- a/changelog/23740.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-```release-note:feature
-core: add sys/internal/ui/version endpoint
-```
\ No newline at end of file
diff --git a/changelog/24152.txt b/changelog/24152.txt
new file mode 100644
index 00000000000..80ef3015377
--- /dev/null
+++ b/changelog/24152.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+website/docs: Add note about eventual consietency with the MongoDB Atlas database secrets engine
+```
diff --git a/changelog/24382.txt b/changelog/24382.txt
index 5dee6f646fe..4c76944e18a 100644
--- a/changelog/24382.txt
+++ b/changelog/24382.txt
@@ -1,4 +1,4 @@
 ```release-note:feature
-**Default Lease Count Quota**: Apply a new global default lease count quota of 300k leases for all
+**Default Lease Count Quota (enterprise)**: Apply a new global default lease count quota of 300k leases for all
 new installs of Vault.
 ```
diff --git a/changelog/24558.txt b/changelog/24558.txt
deleted file mode 100644
index 83d13d76086..00000000000
--- a/changelog/24558.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-```release-note:feature
-**Audit Filtering**: Audit devices support expression-based filter rules (powered by go-bexpr) to determine which entries are written to the audit log.```
-```
diff --git a/changelog/25080.txt b/changelog/25080.txt
new file mode 100644
index 00000000000..ad43618d828
--- /dev/null
+++ b/changelog/25080.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+storage/raft: Fix auto_join not working with mDNS provider.
+```
diff --git a/changelog/25093.txt b/changelog/25093.txt
index 3deea016bd9..a0691e03e14 100644
--- a/changelog/25093.txt
+++ b/changelog/25093.txt
@@ -1,5 +1,5 @@
 ```release-note:feature
-**Request Limiter**: Add adaptive concurrency limits to write-based HTTP
-methods and special-case `pki/issue` requests to prevent overloading the Vault
-server.
+**Request Limiter (enterprise)**: Add adaptive concurrency limits to
+write-based HTTP methods and special-case `pki/issue` requests to prevent
+overloading the Vault server.
 ```
diff --git a/changelog/25219.txt b/changelog/25219.txt
deleted file mode 100644
index bf6ee22794c..00000000000
--- a/changelog/25219.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-```release-note:feature
-**Plugin Workload Identity**: Vault can generate identity tokens for plugins to use in workload identity federation auth flows.
-```
\ No newline at end of file
diff --git a/changelog/25391.txt b/changelog/25391.txt
new file mode 100644
index 00000000000..522cbe849fb
--- /dev/null
+++ b/changelog/25391.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+command/server: Removed environment variable requirement to generate pprof 
+files using SIGUSR2. Added CPU profile support.
+```
diff --git a/changelog/25418.txt b/changelog/25418.txt
new file mode 100644
index 00000000000..7bee2fa79b6
--- /dev/null
+++ b/changelog/25418.txt
@@ -0,0 +1,4 @@
+
+```release-note:improvement
+auth/aws: Add inferred_hostname metadata for IAM AWS authentication method.
+```
diff --git a/changelog/25439.txt b/changelog/25439.txt
new file mode 100644
index 00000000000..7b1775c9b99
--- /dev/null
+++ b/changelog/25439.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/quotas: Deleting a namespace that contains a rate limit quota no longer breaks replication
+```
diff --git a/changelog/25486.txt b/changelog/25486.txt
new file mode 100644
index 00000000000..9293c69dba0
--- /dev/null
+++ b/changelog/25486.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/transit: Add support for RSA padding scheme pkcs1v15 for encryption
+```
diff --git a/changelog/25550.txt b/changelog/25550.txt
new file mode 100644
index 00000000000..8a325837e56
--- /dev/null
+++ b/changelog/25550.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+openapi: added the missing migrate parameter for the unseal endpoint in vault/logical_system_paths.go
+```
diff --git a/changelog/25636.txt b/changelog/25636.txt
new file mode 100644
index 00000000000..d5528fb5df3
--- /dev/null
+++ b/changelog/25636.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: make the best effort timeout for encryption count tracking persistence configurable via an environment variable.
+```
\ No newline at end of file
diff --git a/changelog/25637.txt b/changelog/25637.txt
new file mode 100644
index 00000000000..b0f5ec496e3
--- /dev/null
+++ b/changelog/25637.txt
@@ -0,0 +1,3 @@
+```release-note:deprecation
+secrets/azure: Deprecate field "password_policy" as we are not able to set it anymore with the new MS Graph API.
+```
\ No newline at end of file
diff --git a/changelog/25646.txt b/changelog/25646.txt
new file mode 100644
index 00000000000..d8c659a1dd8
--- /dev/null
+++ b/changelog/25646.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Adds allowed_response_headers, plugin_version and user_lockout_config params to auth method configuration
+```
\ No newline at end of file
diff --git a/changelog/25697.txt b/changelog/25697.txt
new file mode 100644
index 00000000000..ecc2ac18676
--- /dev/null
+++ b/changelog/25697.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/login: Fixed a potential deadlock when a login fails and user lockout is enabled.
+```
diff --git a/changelog/25713.txt b/changelog/25713.txt
new file mode 100644
index 00000000000..250045059ec
--- /dev/null
+++ b/changelog/25713.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core/metrics: add metrics for secret sync client count 
+```
diff --git a/changelog/25744.txt b/changelog/25744.txt
new file mode 100644
index 00000000000..274b228bc20
--- /dev/null
+++ b/changelog/25744.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Move CLI token helper functions to importable packages in `api` module.
+```
diff --git a/changelog/25751.txt b/changelog/25751.txt
new file mode 100644
index 00000000000..cfde6d9de06
--- /dev/null
+++ b/changelog/25751.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: include secret syncs counts in the `vault operator usage` command output 
+```
\ No newline at end of file
diff --git a/changelog/25766.txt b/changelog/25766.txt
new file mode 100644
index 00000000000..7166fc3a355
--- /dev/null
+++ b/changelog/25766.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: call resultant-acl without namespace header when user mounted at root namespace
+```
diff --git a/changelog/25862.txt b/changelog/25862.txt
new file mode 100644
index 00000000000..ea772623b2a
--- /dev/null
+++ b/changelog/25862.txt
@@ -0,0 +1,3 @@
+```release-note: enhancement
+auth/userpass: Support supplying of a pre-hashed password instead of the password itself
+```
\ No newline at end of file
diff --git a/changelog/25867.txt b/changelog/25867.txt
new file mode 100644
index 00000000000..c7611aaa86c
--- /dev/null
+++ b/changelog/25867.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: remove user_lockout_config settings for unsupported methods
+```
diff --git a/changelog/25874.txt b/changelog/25874.txt
new file mode 100644
index 00000000000..bf9ae37f02b
--- /dev/null
+++ b/changelog/25874.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: remove leading slash from KV version 2 secret paths
+```
diff --git a/changelog/25912.txt b/changelog/25912.txt
new file mode 100644
index 00000000000..fdb419c8f46
--- /dev/null
+++ b/changelog/25912.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/cert: Allow validation with OCSP responses with no NextUpdate time
+```
diff --git a/changelog/25937.txt b/changelog/25937.txt
new file mode 100644
index 00000000000..d2ff2e8057c
--- /dev/null
+++ b/changelog/25937.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/jwt: Update plugin to v0.20.1
+```
diff --git a/changelog/25953.txt b/changelog/25953.txt
new file mode 100644
index 00000000000..42132176bc6
--- /dev/null
+++ b/changelog/25953.txt
@@ -0,0 +1,4 @@
+```release-note:change
+core: return an additional "invalid token" error message in 403 response when the provided request token is expired,
+exceeded the number of uses, or is a bogus value
+```
\ No newline at end of file
diff --git a/changelog/25968.txt b/changelog/25968.txt
new file mode 100644
index 00000000000..e048b706dea
--- /dev/null
+++ b/changelog/25968.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Do not require sudo for API wrapper functions GetAuth and GetAuthWithContext
+```
diff --git a/changelog/25982.txt b/changelog/25982.txt
new file mode 100644
index 00000000000..59a7d0512b7
--- /dev/null
+++ b/changelog/25982.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: Allow cert auth login attempts if ocsp_fail_open is true and OCSP servers are unreachable
+```
diff --git a/changelog/25986.txt b/changelog/25986.txt
new file mode 100644
index 00000000000..3f64fe3c871
--- /dev/null
+++ b/changelog/25986.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: Address an issue in which OCSP query responses were not cached
+```
diff --git a/changelog/25991.txt b/changelog/25991.txt
new file mode 100644
index 00000000000..410732d43f7
--- /dev/null
+++ b/changelog/25991.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+storage/raft: panic on unknown Raft operations
+```
diff --git a/changelog/25992.txt b/changelog/25992.txt
new file mode 100644
index 00000000000..14f528c665b
--- /dev/null
+++ b/changelog/25992.txt
@@ -0,0 +1,7 @@
+```release-note:improvement
+
+storage/raft (enterprise): add support for separate entry size limit for mount
+and namespace table paths in storage to allow increased mount table size without
+allowing other user storage entries to become larger.
+
+```
\ No newline at end of file
diff --git a/changelog/25999.txt b/changelog/25999.txt
new file mode 100644
index 00000000000..5999f7976ac
--- /dev/null
+++ b/changelog/25999.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix kubernetes auth method roles tab  
+```
diff --git a/changelog/26020.txt b/changelog/26020.txt
new file mode 100644
index 00000000000..2833bf64df3
--- /dev/null
+++ b/changelog/26020.txt
@@ -0,0 +1,7 @@
+```release-note:improvement
+core/activity: Include ACME clients in activity log responses
+```
+
+```release-note:improvement
+ui: Display ACME clients on a separate page in the UI.
+```
diff --git a/changelog/26073.txt b/changelog/26073.txt
new file mode 100644
index 00000000000..90a964db99c
--- /dev/null
+++ b/changelog/26073.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+identity: alias metadata is now returned when listing entity aliases
+```
diff --git a/changelog/26088.txt b/changelog/26088.txt
new file mode 100644
index 00000000000..1bce05fa812
--- /dev/null
+++ b/changelog/26088.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+audit: timestamps across multiple audit devices for an audit entry will now match.
+```
\ No newline at end of file
diff --git a/changelog/26091.txt b/changelog/26091.txt
new file mode 100644
index 00000000000..31a219247ae
--- /dev/null
+++ b/changelog/26091.txt
@@ -0,0 +1,3 @@
+```release-note:security
+auth/cert: validate OCSP response was signed by the expected issuer and serial number matched request
+```
diff --git a/changelog/26110.txt b/changelog/26110.txt
new file mode 100644
index 00000000000..5a05cc21467
--- /dev/null
+++ b/changelog/26110.txt
@@ -0,0 +1,3 @@
+```release-note:change
+sdk: String templates now have a maximum size of 100,000 characters.
+```
\ No newline at end of file
diff --git a/changelog/26135.txt b/changelog/26135.txt
new file mode 100644
index 00000000000..75cc1dc750e
--- /dev/null
+++ b/changelog/26135.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+storage/azure: Perform validation on Azure account name and container name 
+```
diff --git a/changelog/26147.txt b/changelog/26147.txt
new file mode 100644
index 00000000000..efc179ee70f
--- /dev/null
+++ b/changelog/26147.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secret/database: Fixed race condition where database mounts may leak connections
+```
diff --git a/changelog/26166.txt b/changelog/26166.txt
new file mode 100644
index 00000000000..430a5a5fec6
--- /dev/null
+++ b/changelog/26166.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Only reload seal configuration when enable_multiseal is set to true.
+```
diff --git a/changelog/26167.txt b/changelog/26167.txt
new file mode 100644
index 00000000000..f53d18c9fef
--- /dev/null
+++ b/changelog/26167.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+cli/debug: Fix resource leak in CLI debug command.
+```
\ No newline at end of file
diff --git a/changelog/26172.txt b/changelog/26172.txt
new file mode 100644
index 00000000000..86e855dfb0a
--- /dev/null
+++ b/changelog/26172.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+agent: Agent will re-trigger auto auth if token used for rendering templates has been revoked, has exceeded the number of uses, or is a bogus value.
+```
\ No newline at end of file
diff --git a/changelog/26200.txt b/changelog/26200.txt
new file mode 100644
index 00000000000..3d1e03a257f
--- /dev/null
+++ b/changelog/26200.txt
@@ -0,0 +1,6 @@
+```release-note:bug
+auth/ldap: Fix login error missing entity alias attribute value.
+```
+```release-note:bug
+auth/ldap: Fix login error for group search anonymous bind.
+```
diff --git a/changelog/26243.txt b/changelog/26243.txt
new file mode 100644
index 00000000000..9a2dc396349
--- /dev/null
+++ b/changelog/26243.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+cli: fixed a bug where the Vault CLI would error out if 
+HOME was not set.
+```
diff --git a/changelog/26263.txt b/changelog/26263.txt
new file mode 100644
index 00000000000..4d5eb123935
--- /dev/null
+++ b/changelog/26263.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: fixes cases where inputs did not have associated labels
+```
\ No newline at end of file
diff --git a/changelog/26291.txt b/changelog/26291.txt
new file mode 100644
index 00000000000..f5fa6cca1e0
--- /dev/null
+++ b/changelog/26291.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/jwt: Update plugin to v0.20.2
+```
diff --git a/changelog/26307.txt b/changelog/26307.txt
new file mode 100644
index 00000000000..1684c8d4280
--- /dev/null
+++ b/changelog/26307.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+proxy: Proxy will re-trigger auto auth if the token used for requests has been revoked, has exceeded the number of uses,
+or is an otherwise invalid value.
+```
diff --git a/changelog/26325.txt b/changelog/26325.txt
new file mode 100644
index 00000000000..cbfc6c1f9c6
--- /dev/null
+++ b/changelog/26325.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fixed a bug where the replication pages did not update display when navigating between DR and performance
+```
diff --git a/changelog/26346.txt b/changelog/26346.txt
new file mode 100644
index 00000000000..1f6a8a486a9
--- /dev/null
+++ b/changelog/26346.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui: Update dependencies including D3 libraries
+```
diff --git a/changelog/26381.txt b/changelog/26381.txt
new file mode 100644
index 00000000000..c1d55e4781b
--- /dev/null
+++ b/changelog/26381.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/seal: During a seal reload through SIGHUP, only write updated seal barrier on an active node
+```
diff --git a/changelog/26383.txt b/changelog/26383.txt
new file mode 100644
index 00000000000..8b675a9ef41
--- /dev/null
+++ b/changelog/26383.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+api: fixed a bug where LifetimeWatcher routines weren't respecting exponential backoff in the presence of unexpected errors
+```
diff --git a/changelog/26384.txt b/changelog/26384.txt
new file mode 100644
index 00000000000..56fb0a57757
--- /dev/null
+++ b/changelog/26384.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+plugin/wif: fix a bug where the namespace was not set for external plugins using workload identity federation
+```
diff --git a/changelog/26396.txt b/changelog/26396.txt
new file mode 100644
index 00000000000..7f66e5cd58c
--- /dev/null
+++ b/changelog/26396.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: show banner instead of permission denied error when batch token is expired
+```
diff --git a/changelog/26406.txt b/changelog/26406.txt
new file mode 100644
index 00000000000..8e55cb7e40e
--- /dev/null
+++ b/changelog/26406.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+replication (enterprise): Periodically write current time on the primary to storage, use that downstream to measure replication lag in time, expose that in health and replication status endpoints.
+```
diff --git a/changelog/26427.txt b/changelog/26427.txt
new file mode 100644
index 00000000000..615e9e15f06
--- /dev/null
+++ b/changelog/26427.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+agent: `vault.namespace` no longer gets incorrectly overridden by `auto_auth.namespace`, if set
+```
diff --git a/changelog/26464.txt b/changelog/26464.txt
new file mode 100644
index 00000000000..c033d8cf455
--- /dev/null
+++ b/changelog/26464.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+sdk/decompression: DecompressWithCanary will now chunk the decompression in memory to prevent loading it all at once.
+```
diff --git a/changelog/26477.txt b/changelog/26477.txt
new file mode 100644
index 00000000000..f24fca805cd
--- /dev/null
+++ b/changelog/26477.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/pki: fixed validation bug which rejected ldap schemed URLs in crl_distribution_points.
+```
\ No newline at end of file
diff --git a/changelog/26485.txt b/changelog/26485.txt
new file mode 100644
index 00000000000..6cc54cfb998
--- /dev/null
+++ b/changelog/26485.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fixes undefined start time in filename for downloaded client count attribution csv
+```
diff --git a/changelog/26507.txt b/changelog/26507.txt
new file mode 100644
index 00000000000..3f3c8f17a8b
--- /dev/null
+++ b/changelog/26507.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**Plugin Identity Tokens**: Adds secret-less configuration of AWS auth engine using web identity federation.
+```
\ No newline at end of file
diff --git a/changelog/26519.txt b/changelog/26519.txt
new file mode 100644
index 00000000000..2104c03c188
--- /dev/null
+++ b/changelog/26519.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core/activity: Include ACME client metrics to precomputed queries
+```
diff --git a/changelog/26523.txt b/changelog/26523.txt
new file mode 100644
index 00000000000..3b3ef6427d4
--- /dev/null
+++ b/changelog/26523.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core (enterprise): fix bug where raft followers disagree with the seal type after returning to one seal from two.
+```
diff --git a/changelog/26525.txt b/changelog/26525.txt
new file mode 100644
index 00000000000..df087f2b208
--- /dev/null
+++ b/changelog/26525.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core/activity: Include ACME clients in vault operator usage response
+```
diff --git a/changelog/26527.txt b/changelog/26527.txt
new file mode 100644
index 00000000000..ff3b3c35d03
--- /dev/null
+++ b/changelog/26527.txt
@@ -0,0 +1,3 @@
+```release-note:change
+api: Upgrade from github.com/go-jose/go-jose/v3 v3.0.3 to github.com/go-jose/go-jose/v4 v4.0.1.
+```
\ No newline at end of file
diff --git a/changelog/26528.txt b/changelog/26528.txt
new file mode 100644
index 00000000000..ce43d4c86da
--- /dev/null
+++ b/changelog/26528.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to v0.17.1
+```
\ No newline at end of file
diff --git a/changelog/26570.txt b/changelog/26570.txt
new file mode 100644
index 00000000000..79efe31414f
--- /dev/null
+++ b/changelog/26570.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+agent: Add metric (vault.agent.authenticated) that is set to 1 when vault agent has a valid token and zero if it does not.
+```
\ No newline at end of file
diff --git a/changelog/26577.txt b/changelog/26577.txt
new file mode 100644
index 00000000000..8293f5403f2
--- /dev/null
+++ b/changelog/26577.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Update userpass user form to allow setting `password_hash` field.
+```
\ No newline at end of file
diff --git a/changelog/26607.txt b/changelog/26607.txt
new file mode 100644
index 00000000000..b28c3d40597
--- /dev/null
+++ b/changelog/26607.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fix `redact_version` listener parameter being ignored for some OpenAPI related endpoints.
+```
diff --git a/changelog/26616.txt b/changelog/26616.txt
new file mode 100644
index 00000000000..af8e85e9194
--- /dev/null
+++ b/changelog/26616.txt
@@ -0,0 +1,5 @@
+```release-note:bug
+core/audit: Audit logging a Vault request/response will now use a minimum 5 second context timeout. 
+If the existing context deadline occurs later than 5s in the future, it will be used, otherwise a 
+new context, separate from the original will be used.
+```
\ No newline at end of file
diff --git a/changelog/26628.txt b/changelog/26628.txt
new file mode 100644
index 00000000000..2ab067f3ef0
--- /dev/null
+++ b/changelog/26628.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/aws: add support for external_ids in AWS assume-role
+```
\ No newline at end of file
diff --git a/changelog/26653.txt b/changelog/26653.txt
new file mode 100644
index 00000000000..5ba7c2196d5
--- /dev/null
+++ b/changelog/26653.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui (enterprise): Update filters on the custom messages list view.
+```
\ No newline at end of file
diff --git a/changelog/26660.txt b/changelog/26660.txt
new file mode 100644
index 00000000000..9490cd0b6ef
--- /dev/null
+++ b/changelog/26660.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+storage/etcd: Update etcd3 client to v3.5.13 to allow use of TLSv1.3.
+```
diff --git a/changelog/26663.txt b/changelog/26663.txt
new file mode 100644
index 00000000000..ac29ce0ecee
--- /dev/null
+++ b/changelog/26663.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Show computed values from `sys/internal/ui/mounts` endpoint for auth mount configuration view
+```
diff --git a/changelog/26693.txt b/changelog/26693.txt
new file mode 100644
index 00000000000..7e768789f35
--- /dev/null
+++ b/changelog/26693.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Remove possibility of returning an undefined timezone from date-format helper
+```
\ No newline at end of file
diff --git a/changelog/26708.txt b/changelog/26708.txt
new file mode 100644
index 00000000000..8bcd10d57fd
--- /dev/null
+++ b/changelog/26708.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui: Upgrade Ember to version 5.4
+```
\ No newline at end of file
diff --git a/changelog/26729.txt b/changelog/26729.txt
new file mode 100644
index 00000000000..4277b50a98e
--- /dev/null
+++ b/changelog/26729.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui (enterprise): Update dashboard to make activity log query using the same start time as the metrics overview
+```
\ No newline at end of file
diff --git a/changelog/26777.txt b/changelog/26777.txt
new file mode 100644
index 00000000000..1d04c164662
--- /dev/null
+++ b/changelog/26777.txt
@@ -0,0 +1,4 @@
+```release-note:change
+audit: breaking change - Vault now allows audit logs to contain 'correlation-id' and 'x-correlation-id' headers when they 
+are present in the incoming request. By default they are not HMAC'ed (but can be configured to HMAC by Vault Operators).
+```
diff --git a/changelog/26790.txt b/changelog/26790.txt
new file mode 100644
index 00000000000..593d2de67d9
--- /dev/null
+++ b/changelog/26790.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Refresh model within a namespace on the Secrets Sync overview page.
+```
\ No newline at end of file
diff --git a/changelog/26796.txt b/changelog/26796.txt
new file mode 100644
index 00000000000..1c9809a8c89
--- /dev/null
+++ b/changelog/26796.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/pki: sign-intermediate API will truncate notAfter if calculated to go beyond the signing issuer's notAfter. Previously the notAfter was permitted to go beyond leading to invalid chains.
+```
diff --git a/changelog/26797.txt b/changelog/26797.txt
new file mode 100644
index 00000000000..72b6b380240
--- /dev/null
+++ b/changelog/26797.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki: Add a new ACME configuration parameter that allows increasing the maximum TTL for ACME leaf certificates
+```
diff --git a/changelog/26828.txt b/changelog/26828.txt
new file mode 100644
index 00000000000..4c9a004c460
--- /dev/null
+++ b/changelog/26828.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/database: Add support for GCP CloudSQL private IP's.
+```
diff --git a/changelog/26841.txt b/changelog/26841.txt
new file mode 100644
index 00000000000..a65e5affbef
--- /dev/null
+++ b/changelog/26841.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui (enterprise): Allow HVD users to access Secrets Sync.
+```
\ No newline at end of file
diff --git a/changelog/26844.txt b/changelog/26844.txt
new file mode 100644
index 00000000000..49f7bf2f161
--- /dev/null
+++ b/changelog/26844.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auto-auth: Addressed issue where having no permissions to renew a renewable token caused auto-auth to attempt to renew constantly with no backoff
+```
diff --git a/changelog/26845.txt b/changelog/26845.txt
new file mode 100644
index 00000000000..2f19eaf8f28
--- /dev/null
+++ b/changelog/26845.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui: deleting a nested secret will no longer redirect you to the nearest path segment
+```
\ No newline at end of file
diff --git a/changelog/26848.txt b/changelog/26848.txt
new file mode 100644
index 00000000000..6cce04d9434
--- /dev/null
+++ b/changelog/26848.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Hide dashboard client count card if user does not have permission to view clients.
+```
\ No newline at end of file
diff --git a/changelog/26858.txt b/changelog/26858.txt
new file mode 100644
index 00000000000..911fd20c174
--- /dev/null
+++ b/changelog/26858.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix broken help link in console for the web command.
+```
diff --git a/changelog/26863.txt b/changelog/26863.txt
new file mode 100644
index 00000000000..75d864e6c84
--- /dev/null
+++ b/changelog/26863.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+agent: Correctly constructs kv-v2 secret paths in nested namespaces. 
+```
\ No newline at end of file
diff --git a/changelog/26868.txt b/changelog/26868.txt
new file mode 100644
index 00000000000..3a25d05efdb
--- /dev/null
+++ b/changelog/26868.txt
@@ -0,0 +1,3 @@
+```release-note:change
+api: Update backoff/v3 to backoff/v4.3.0
+```
\ No newline at end of file
diff --git a/changelog/26872.txt b/changelog/26872.txt
new file mode 100644
index 00000000000..3309a231061
--- /dev/null
+++ b/changelog/26872.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Resolved accessibility issues with Web REPL. Associated label and help text with input, added a conditional to show the console/ui-panel only when toggled open, added keyboard focus trap. 
+```
\ No newline at end of file
diff --git a/changelog/26876.txt b/changelog/26876.txt
new file mode 100644
index 00000000000..6522b0ecd9a
--- /dev/null
+++ b/changelog/26876.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Add missing field delegated_auth_accessors to GET /sys/mounts/:path API response
+```
diff --git a/changelog/26877.txt b/changelog/26877.txt
new file mode 100644
index 00000000000..959e7825148
--- /dev/null
+++ b/changelog/26877.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kv: Update plugin to v0.18.0
+```
diff --git a/changelog/26878.txt b/changelog/26878.txt
new file mode 100644
index 00000000000..a8cfc576480
--- /dev/null
+++ b/changelog/26878.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/metrics: store cluster name in unencrypted storage to prevent blank cluster name
+```
diff --git a/changelog/26890.txt b/changelog/26890.txt
new file mode 100644
index 00000000000..74d06a9cf78
--- /dev/null
+++ b/changelog/26890.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/jwt: Update plugin to v0.20.3
+```
diff --git a/changelog/26896.txt b/changelog/26896.txt
new file mode 100644
index 00000000000..6147953d0b2
--- /dev/null
+++ b/changelog/26896.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/azure: Update vault-plugin-secrets-azure to 0.17.2 to include a bug fix for azure role creation
+```
diff --git a/changelog/26985.txt b/changelog/26985.txt
new file mode 100644
index 00000000000..7894bd3d407
--- /dev/null
+++ b/changelog/26985.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Prevent perpetual loading screen when Vault needs initialization
+```
diff --git a/changelog/26993.txt b/changelog/26993.txt
new file mode 100644
index 00000000000..35acaa79a8a
--- /dev/null
+++ b/changelog/26993.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Update PGP display and show error for Generate Operation Token flow with PGP
+```
\ No newline at end of file
diff --git a/changelog/27014.txt b/changelog/27014.txt
new file mode 100644
index 00000000000..94f6ebbe075
--- /dev/null
+++ b/changelog/27014.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Address a data race updating a seal's last seen healthy time attribute
+```
diff --git a/changelog/27019.txt b/changelog/27019.txt
new file mode 100644
index 00000000000..722e0d46c9e
--- /dev/null
+++ b/changelog/27019.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix link to v2 generic secrets engine from secrets list page.
+```
\ No newline at end of file
diff --git a/changelog/27033.txt b/changelog/27033.txt
new file mode 100644
index 00000000000..a06152dedc2
--- /dev/null
+++ b/changelog/27033.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+command/server: Add support for dumping pprof files during startup using CLI option `pprof-dump-dir`
+```
diff --git a/changelog/27093.txt b/changelog/27093.txt
new file mode 100644
index 00000000000..a24becec3ea
--- /dev/null
+++ b/changelog/27093.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+pki: Fix error in cross-signing using ed25519 keys
+```
diff --git a/changelog/27094.txt b/changelog/27094.txt
new file mode 100644
index 00000000000..9cd743f55f9
--- /dev/null
+++ b/changelog/27094.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix KVv2 json editor to allow null values.
+```
\ No newline at end of file
diff --git a/changelog/27117.txt b/changelog/27117.txt
new file mode 100644
index 00000000000..21ced168556
--- /dev/null
+++ b/changelog/27117.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis: Update plugin to v0.3.0
+```
diff --git a/changelog/27120.txt b/changelog/27120.txt
new file mode 100644
index 00000000000..3a9630b986c
--- /dev/null
+++ b/changelog/27120.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix KVv2 cursor jumping inside json editor after initial input.
+```
\ No newline at end of file
diff --git a/changelog/27123.txt b/changelog/27123.txt
new file mode 100644
index 00000000000..f23dd835c5e
--- /dev/null
+++ b/changelog/27123.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+agent/sink: Allow configuration of the user and group ID of the file sink.
+```
+```release-note:improvement
+proxy/sink: Allow configuration of the user and group ID of the file sink.
+```
diff --git a/changelog/27130.txt b/changelog/27130.txt
new file mode 100644
index 00000000000..ba3352c4128
--- /dev/null
+++ b/changelog/27130.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/centrify: Remove the deprecated Centrify auth method plugin
+```
diff --git a/changelog/27131.txt b/changelog/27131.txt
new file mode 100644
index 00000000000..465da55fe96
--- /dev/null
+++ b/changelog/27131.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix configuration link from Secret Engine list view for Ember engines.
+```
\ No newline at end of file
diff --git a/changelog/27132.txt b/changelog/27132.txt
new file mode 100644
index 00000000000..2c519450452
--- /dev/null
+++ b/changelog/27132.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/snowflake: Update plugin to v0.11.0
+```
diff --git a/changelog/27133.txt b/changelog/27133.txt
new file mode 100644
index 00000000000..d19c4b849b3
--- /dev/null
+++ b/changelog/27133.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/alicloud: Update plugin to v0.18.0
+```
diff --git a/changelog/27134.txt b/changelog/27134.txt
new file mode 100644
index 00000000000..e477acb87d1
--- /dev/null
+++ b/changelog/27134.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/alicloud: Update plugin to v0.17.0
+```
diff --git a/changelog/27136.txt b/changelog/27136.txt
new file mode 100644
index 00000000000..24be2b0e0a2
--- /dev/null
+++ b/changelog/27136.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/elasticsearch: Update plugin to v0.15.0
+```
diff --git a/changelog/27137.txt b/changelog/27137.txt
new file mode 100644
index 00000000000..e977dd42986
--- /dev/null
+++ b/changelog/27137.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.13.0
+```
diff --git a/changelog/27139.txt b/changelog/27139.txt
new file mode 100644
index 00000000000..1b7915fc6d0
--- /dev/null
+++ b/changelog/27139.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis-elasticache: Update plugin to v0.4.0
+```
diff --git a/changelog/27140.txt b/changelog/27140.txt
new file mode 100644
index 00000000000..4910718fb82
--- /dev/null
+++ b/changelog/27140.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/gcp: Update plugin to v0.18.0
+```
diff --git a/changelog/27141.txt b/changelog/27141.txt
new file mode 100644
index 00000000000..b34464a8094
--- /dev/null
+++ b/changelog/27141.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to v0.19.0
+```
diff --git a/changelog/27142.txt b/changelog/27142.txt
new file mode 100644
index 00000000000..9a36667fc35
--- /dev/null
+++ b/changelog/27142.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/oci: Update plugin to v0.16.0
+```
diff --git a/changelog/27143.txt b/changelog/27143.txt
new file mode 100644
index 00000000000..9e0f8383557
--- /dev/null
+++ b/changelog/27143.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/mongodbatlas: Update plugin to v0.12.0
+```
diff --git a/changelog/27145.txt b/changelog/27145.txt
new file mode 100644
index 00000000000..45bca4ba1eb
--- /dev/null
+++ b/changelog/27145.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/couchbase: Update plugin to v0.11.0
+```
diff --git a/changelog/27146.txt b/changelog/27146.txt
new file mode 100644
index 00000000000..0e106b92f68
--- /dev/null
+++ b/changelog/27146.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.18.0
+```
diff --git a/changelog/27147.txt b/changelog/27147.txt
new file mode 100644
index 00000000000..30d13d3661e
--- /dev/null
+++ b/changelog/27147.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/terraform: Update plugin to v0.8.0
+```
diff --git a/changelog/27149.txt b/changelog/27149.txt
new file mode 100644
index 00000000000..653851c940a
--- /dev/null
+++ b/changelog/27149.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/mongodbatlas: Update plugin to v0.12.0
+```
diff --git a/changelog/27159.txt b/changelog/27159.txt
new file mode 100644
index 00000000000..a21f894d051
--- /dev/null
+++ b/changelog/27159.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kv: Update plugin to v0.19.0
+```
diff --git a/changelog/27161.txt b/changelog/27161.txt
new file mode 100644
index 00000000000..5764f028bdd
--- /dev/null
+++ b/changelog/27161.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/cf: Update plugin to v0.17.0
+```
diff --git a/changelog/27163.txt b/changelog/27163.txt
new file mode 100644
index 00000000000..307cb66bf90
--- /dev/null
+++ b/changelog/27163.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcpkms: Update plugin to v0.17.0
+```
diff --git a/changelog/27164.txt b/changelog/27164.txt
new file mode 100644
index 00000000000..4c942e1b995
--- /dev/null
+++ b/changelog/27164.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcp: Update plugin to v0.19.0
+```
diff --git a/changelog/27172.txt b/changelog/27172.txt
new file mode 100644
index 00000000000..60e88ec4797
--- /dev/null
+++ b/changelog/27172.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/ad: Update plugin to v0.18.0
+```
diff --git a/changelog/27177.txt b/changelog/27177.txt
new file mode 100644
index 00000000000..c01050b6fa2
--- /dev/null
+++ b/changelog/27177.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kerberos: Update plugin to v0.12.0
+```
diff --git a/changelog/27178.txt b/changelog/27178.txt
new file mode 100644
index 00000000000..c84c67f34e2
--- /dev/null
+++ b/changelog/27178.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui/kubernetes: Update the roles filter-input to use explicit search.
+```
diff --git a/changelog/27184.txt b/changelog/27184.txt
new file mode 100644
index 00000000000..500045efb5a
--- /dev/null
+++ b/changelog/27184.txt
@@ -0,0 +1,3 @@
+```release-note:change
+core/identity: improve performance for secondary nodes receiving identity related updates through replication
+```
diff --git a/changelog/27186.txt b/changelog/27186.txt
new file mode 100644
index 00000000000..b8d6adaf253
--- /dev/null
+++ b/changelog/27186.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kubernetes: Update plugin to v0.19.0
+```
diff --git a/changelog/27187.txt b/changelog/27187.txt
new file mode 100644
index 00000000000..a723b1b4c5b
--- /dev/null
+++ b/changelog/27187.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kubernetes: Update plugin to v0.8.0
+```
diff --git a/changelog/27202.txt b/changelog/27202.txt
new file mode 100644
index 00000000000..224f976bba0
--- /dev/null
+++ b/changelog/27202.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: Merge error messages returned in login failures and include error when present  
+```
diff --git a/changelog/27203.txt b/changelog/27203.txt
new file mode 100644
index 00000000000..b0dee9ee38f
--- /dev/null
+++ b/changelog/27203.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**LDAP Secrets engine hierarchical path support**: Hierarchical path handling is now supported for role and set APIs.
+```
diff --git a/changelog/27211.txt b/changelog/27211.txt
new file mode 100644
index 00000000000..26bf725ebff
--- /dev/null
+++ b/changelog/27211.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/transit: Use 'hash_algorithm' parameter if present in HMAC verify requests. Otherwise fall back to deprecated 'algorithm' parameter.
+```
diff --git a/changelog/27262.txt b/changelog/27262.txt
new file mode 100644
index 00000000000..93c2fbe3f0d
--- /dev/null
+++ b/changelog/27262.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/secrets-sync: Hide Secrets Sync from the sidebar nav if user does not have access to the feature.
+```
diff --git a/changelog/27263.txt b/changelog/27263.txt
new file mode 100644
index 00000000000..cb008c59fae
--- /dev/null
+++ b/changelog/27263.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Do not show resultant-ACL banner when ancestor namespace grants wildcard access.
+```
diff --git a/changelog/27265.txt b/changelog/27265.txt
new file mode 100644
index 00000000000..926b2c7a07d
--- /dev/null
+++ b/changelog/27265.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed an erroneous warning appearing about `-address` not being set when it is.
+```
diff --git a/changelog/27277.txt b/changelog/27277.txt
new file mode 100644
index 00000000000..1a7abc5a6f0
--- /dev/null
+++ b/changelog/27277.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+storage/raft (enterprise): Fix a regression introduced in 1.15.8 that causes
+autopilot to fail to discover new server versions and so not trigger an upgrade.
+```
\ No newline at end of file
diff --git a/changelog/27289.txt b/changelog/27289.txt
new file mode 100644
index 00000000000..3e10cf0a02f
--- /dev/null
+++ b/changelog/27289.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Allow users to wrap inputted data again instead of resetting form
+```
diff --git a/changelog/27346.txt b/changelog/27346.txt
new file mode 100644
index 00000000000..17f50216cb9
--- /dev/null
+++ b/changelog/27346.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Update language in Transit secret engine to reflect that not all keys are for encyryption
+```
diff --git a/changelog/27348.txt b/changelog/27348.txt
new file mode 100644
index 00000000000..ec7ece0b851
--- /dev/null
+++ b/changelog/27348.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Mask obfuscated fields when creating/editing a Secrets sync destination.
+```
diff --git a/changelog/27350.txt b/changelog/27350.txt
new file mode 100644
index 00000000000..ddf95bc0052
--- /dev/null
+++ b/changelog/27350.txt
@@ -0,0 +1,4 @@
+```release-note:change
+activity log: Deprecated the field "default_report_months". Instead, the billing start time will be used to determine the start time
+when querying the activity log endpoints.
+```
\ No newline at end of file
diff --git a/changelog/27352.txt b/changelog/27352.txt
new file mode 100644
index 00000000000..70a7fa36612
--- /dev/null
+++ b/changelog/27352.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fix issue where a month without new clients breaks the client count dashboard
+```
diff --git a/changelog/27366.txt b/changelog/27366.txt
new file mode 100644
index 00000000000..16b936e5dfb
--- /dev/null
+++ b/changelog/27366.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix a bug where disabling TTL on the AWS credential form would still send TTL value
+```
\ No newline at end of file
diff --git a/changelog/27379.txt b/changelog/27379.txt
new file mode 100644
index 00000000000..1744873c283
--- /dev/null
+++ b/changelog/27379.txt
@@ -0,0 +1,5 @@
+```release-note:change
+activity: The startTime will be set to the start of the current billing period by default.
+The endTime will be set to the end of the current month. This applies to /sys/internal/counters/activity,
+/sys/internal/counters/activity/export, and the vault operator usage command that utilizes /sys/internal/counters/activity.
+```
diff --git a/changelog/27394.txt b/changelog/27394.txt
new file mode 100644
index 00000000000..81a04305f48
--- /dev/null
+++ b/changelog/27394.txt
@@ -0,0 +1,4 @@
+```release-note:feature
+**Vault Minimal Version**: Add the ability to build a minimal version of Vault
+with only core features using the BUILD_MINIMAL environment variable.
+```
diff --git a/changelog/27405.txt b/changelog/27405.txt
new file mode 100644
index 00000000000..ac5162e8010
--- /dev/null
+++ b/changelog/27405.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: AWS credentials form sets credential_type from backing role
+```
diff --git a/changelog/27424.txt b/changelog/27424.txt
new file mode 100644
index 00000000000..fcfb93ea4bc
--- /dev/null
+++ b/changelog/27424.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Allow creation of session_token type roles for AWS secret backend
+```
\ No newline at end of file
diff --git a/changelog/27426.txt b/changelog/27426.txt
new file mode 100644
index 00000000000..ac18d438622
--- /dev/null
+++ b/changelog/27426.txt
@@ -0,0 +1,4 @@
+```release-note:change
+activity log: Deprecates the current_billing_period field for /sys/internal/counters/activity. The default start time
+will automatically be set the billing period start date.
+```
\ No newline at end of file
diff --git a/changelog/27435.txt b/changelog/27435.txt
new file mode 100644
index 00000000000..916a81c9017
--- /dev/null
+++ b/changelog/27435.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+helper/pkcs7: Fix parsing certain messages containing only certificates
+```
diff --git a/changelog/27455.txt b/changelog/27455.txt
new file mode 100644
index 00000000000..38b7c92ae6d
--- /dev/null
+++ b/changelog/27455.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui: Uses the internal/counters/activity/export endpoint for client count export data.
+```
\ No newline at end of file
diff --git a/changelog/27457.txt b/changelog/27457.txt
new file mode 100644
index 00000000000..e3cf89a7652
--- /dev/null
+++ b/changelog/27457.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+sdk/helper: Allow setting environment variables when using NewTestDockerCluster
+```
diff --git a/changelog/27459.txt b/changelog/27459.txt
new file mode 100644
index 00000000000..d46570f5a41
--- /dev/null
+++ b/changelog/27459.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+config: Vault TCP listener config now correctly supports the documented proxy_protocol_behavior 
+setting of 'deny_unauthorized'
+```
diff --git a/changelog/27464.txt b/changelog/27464.txt
new file mode 100644
index 00000000000..ff9d9f508bc
--- /dev/null
+++ b/changelog/27464.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+storage/raft: Improve autopilot logging on startup to show config values clearly and avoid spurious logs
+```
diff --git a/changelog/27474.txt b/changelog/27474.txt
new file mode 100644
index 00000000000..86c773517a3
--- /dev/null
+++ b/changelog/27474.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+storage/raft (enterprise): Fix issue with namespace cache not getting cleared on snapshot restore, resulting in namespaces not found in the snapshot being inaccurately represented by API responses.
+```
diff --git a/changelog/27479.txt b/changelog/27479.txt
new file mode 100644
index 00000000000..355fbbafbe4
--- /dev/null
+++ b/changelog/27479.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Ensure token expired banner displays when batch token expires
+```
\ No newline at end of file
diff --git a/changelog/27498.txt b/changelog/27498.txt
new file mode 100644
index 00000000000..ac191560732
--- /dev/null
+++ b/changelog/27498.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/jwt: Update plugin to v0.21.0
+```
diff --git a/changelog/27510.txt b/changelog/27510.txt
new file mode 100644
index 00000000000..af574898b60
--- /dev/null
+++ b/changelog/27510.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+agent: Add the ability to dump pprof to the filesystem using SIGUSR2
+```
+```release-note:improvement
+proxy: Add the ability to dump pprof to the filesystem using SIGUSR2
+```
diff --git a/changelog/27518.txt b/changelog/27518.txt
new file mode 100644
index 00000000000..c8412c62b02
--- /dev/null
+++ b/changelog/27518.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+agent: Fixed an issue causing excessive CPU usage during normal operation
+```
+
+```release-note:bug
+proxy: Fixed an issue causing excessive CPU usage during normal operation
+```
\ No newline at end of file
diff --git a/changelog/27531.txt b/changelog/27531.txt
new file mode 100644
index 00000000000..3dda984d1d7
--- /dev/null
+++ b/changelog/27531.txt
@@ -0,0 +1,5 @@
+```release-note:bug
+core/audit: Audit logging a Vault request/response checks if the existing context 
+is cancelled and will now use a new context with a 5 second timeout.
+If the existing context is cancelled a new context, will be used.
+```
\ No newline at end of file
diff --git a/changelog/27538.txt b/changelog/27538.txt
new file mode 100644
index 00000000000..e1d14481502
--- /dev/null
+++ b/changelog/27538.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Creates separate section for updating sensitive creds for Secrets sync create/edit view.
+```
diff --git a/changelog/27547.txt b/changelog/27547.txt
new file mode 100644
index 00000000000..ca18d264a43
--- /dev/null
+++ b/changelog/27547.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+activity log: Changes how new client counts in the current month are estimated, in order to return more
+visibly sensible totals.
+```
\ No newline at end of file
diff --git a/changelog/27559.txt b/changelog/27559.txt
new file mode 100644
index 00000000000..a9afccdc98d
--- /dev/null
+++ b/changelog/27559.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Remove deprecated `current_billing_period` from dashboard activity log request
+```
diff --git a/changelog/27563.txt b/changelog/27563.txt
new file mode 100644
index 00000000000..294b5e7cf64
--- /dev/null
+++ b/changelog/27563.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+storage/azure: Fix invalid account name initialization bug
+```
\ No newline at end of file
diff --git a/changelog/27569.txt b/changelog/27569.txt
new file mode 100644
index 00000000000..cb81aa23df7
--- /dev/null
+++ b/changelog/27569.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix cursor jump on KVv2 json editor that would occur after pressing ENTER.
+```
diff --git a/changelog/27574.txt b/changelog/27574.txt
new file mode 100644
index 00000000000..8c1f888242c
--- /dev/null
+++ b/changelog/27574.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Display an error and force a timeout when TOTP passcode is incorrect 
+```
\ No newline at end of file
diff --git a/changelog/27578.txt b/changelog/27578.txt
new file mode 100644
index 00000000000..3a1b62a2a51
--- /dev/null
+++ b/changelog/27578.txt
@@ -0,0 +1,3 @@
+```release-note:change
+cli: The undocumented `-dev-three-node` and `-dev-four-cluster` CLI options have been removed.
+```
diff --git a/changelog/27589.txt b/changelog/27589.txt
new file mode 100644
index 00000000000..844857ff1e7
--- /dev/null
+++ b/changelog/27589.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+core/config: fix issue when using `proxy_protocol_behavior` with `deny_unauthorized`, 
+which causes the Vault TCP listener to close after receiving an untrusted upstream proxy connection.
+```
\ No newline at end of file
diff --git a/changelog/27605.txt b/changelog/27605.txt
new file mode 100644
index 00000000000..b449daf7892
--- /dev/null
+++ b/changelog/27605.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+storage/raft: Bump raft to v1.7.0 which includes pre-vote. This should make clusters more stable during network partitions.
+```
diff --git a/changelog/27620.txt b/changelog/27620.txt
new file mode 100644
index 00000000000..e808a0b4e0e
--- /dev/null
+++ b/changelog/27620.txt
@@ -0,0 +1,5 @@
+```release-note:feature
+**AWS secrets engine STS session tags support**: Adds support for setting STS
+session tags when generating temporary credentials using the AWS secrets
+engine.
+```
diff --git a/changelog/27631.txt b/changelog/27631.txt
new file mode 100644
index 00000000000..d71fbb5508a
--- /dev/null
+++ b/changelog/27631.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed an issue with performance standbys not being able to handle rotate root requests.
+```
\ No newline at end of file
diff --git a/changelog/27633.txt b/changelog/27633.txt
new file mode 100644
index 00000000000..1f5156b3bdc
--- /dev/null
+++ b/changelog/27633.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: make authLock and mountsLock in Core configurable via the detect_deadlocks configuration parameter.
+```
\ No newline at end of file
diff --git a/changelog/27652.txt b/changelog/27652.txt
new file mode 100644
index 00000000000..7c9d257fd90
--- /dev/null
+++ b/changelog/27652.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to v0.19.2
+```
diff --git a/changelog/27656.txt b/changelog/27656.txt
new file mode 100644
index 00000000000..e4445f826af
--- /dev/null
+++ b/changelog/27656.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+license utilization reporting (enterprise): Auto-roll billing start date.
+```
\ No newline at end of file
diff --git a/changelog/27660.txt b/changelog/27660.txt
new file mode 100644
index 00000000000..e754dbbfa36
--- /dev/null
+++ b/changelog/27660.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core (enterprise): Fix HTTP redirects in namespaces to use the correct path and (in the case of event subscriptions) the correct URI scheme.
+```
\ No newline at end of file
diff --git a/changelog/27681.txt b/changelog/27681.txt
new file mode 100644
index 00000000000..13f5f829d52
--- /dev/null
+++ b/changelog/27681.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/pki: fix lack of serial number to a certificate read resulting in a server side error.
+```
\ No newline at end of file
diff --git a/changelog/27694.txt b/changelog/27694.txt
new file mode 100644
index 00000000000..6f5d03e9161
--- /dev/null
+++ b/changelog/27694.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed issue with `vault hcp connect` where HCP resources with uppercase letters were inaccessible when entering the correct project name.
+```
\ No newline at end of file
diff --git a/changelog/27696.txt b/changelog/27696.txt
new file mode 100644
index 00000000000..42956c33601
--- /dev/null
+++ b/changelog/27696.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: Use subject's serial number, not issuer's within error message text in OCSP request errors
+```
diff --git a/changelog/27724.txt b/changelog/27724.txt
new file mode 100644
index 00000000000..0e58502bbce
--- /dev/null
+++ b/changelog/27724.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/cf: Update plugin to v0.18.0
+```
diff --git a/changelog/27726.txt b/changelog/27726.txt
new file mode 100644
index 00000000000..80f2cc850fe
--- /dev/null
+++ b/changelog/27726.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+raft/autopilot: Fixed panic that may occur during shutdown
+```
diff --git a/changelog/27728.txt b/changelog/27728.txt
new file mode 100644
index 00000000000..6c1c18ef50a
--- /dev/null
+++ b/changelog/27728.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fix namespace picker not working when in small screen where the sidebar is collapsed by default.
+```
\ No newline at end of file
diff --git a/changelog/27730.txt b/changelog/27730.txt
new file mode 100644
index 00000000000..d2653062939
--- /dev/null
+++ b/changelog/27730.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+proxy/cache (enterprise): Fixed an issue where cached static secrets could fail to update if the secrets belonged to a non-root namespace.
+```
diff --git a/changelog/27742.txt b/changelog/27742.txt
new file mode 100644
index 00000000000..6f958a02a7b
--- /dev/null
+++ b/changelog/27742.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fix issue where enabling then disabling "Tidy ACME" in PKI results in failed API call.
+```
\ No newline at end of file
diff --git a/changelog/27750.txt b/changelog/27750.txt
new file mode 100644
index 00000000000..04c24fe59e7
--- /dev/null
+++ b/changelog/27750.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/identity: Fixed an issue where deleted/reassigned entity-aliases were not removed from in-memory database.
+```
diff --git a/changelog/27790.txt b/changelog/27790.txt
new file mode 100644
index 00000000000..1475d0831a2
--- /dev/null
+++ b/changelog/27790.txt
@@ -0,0 +1,3 @@
+```release-note:change
+activity (enterprise): filter all fields in client count responses by the request namespace  
+```
\ No newline at end of file
diff --git a/changelog/27796.txt b/changelog/27796.txt
new file mode 100644
index 00000000000..7a1e7ebac3b
--- /dev/null
+++ b/changelog/27796.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: simplify the date range editing experience in the client counts dashboard.
+```
\ No newline at end of file
diff --git a/changelog/27799.txt b/changelog/27799.txt
new file mode 100644
index 00000000000..217f6d78d91
--- /dev/null
+++ b/changelog/27799.txt
@@ -0,0 +1,3 @@
+```release-note:change
+consul-template: updated to version 0.39.1
+```
\ No newline at end of file
diff --git a/changelog/27809.txt b/changelog/27809.txt
new file mode 100644
index 00000000000..332c9155d95
--- /dev/null
+++ b/changelog/27809.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+audit: Ensure that any underyling errors from audit devices are logged even if we consider auditing to be a success.
+```
\ No newline at end of file
diff --git a/changelog/27816.txt b/changelog/27816.txt
new file mode 100644
index 00000000000..92dd2d7bb90
--- /dev/null
+++ b/changelog/27816.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: remove initial start/end parameters on the activity call for client counts dashboard.
+```
\ No newline at end of file
diff --git a/changelog/27830.txt b/changelog/27830.txt
new file mode 100644
index 00000000000..6a3d7e3041f
--- /dev/null
+++ b/changelog/27830.txt
@@ -0,0 +1,3 @@
+```release-note:change
+activity (enterprise): remove deprecated fields distinct_entities and non_entity_tokens
+```
\ No newline at end of file
diff --git a/changelog/27831.txt b/changelog/27831.txt
new file mode 100644
index 00000000000..27224ef7db6
--- /dev/null
+++ b/changelog/27831.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: For AWS and SSH secret engines hide mount configuration details in toggle and display configuration details or cta.
+```
\ No newline at end of file
diff --git a/changelog/27846.txt b/changelog/27846.txt
new file mode 100644
index 00000000000..50cba99062f
--- /dev/null
+++ b/changelog/27846.txt
@@ -0,0 +1,7 @@
+```release-note:change
+activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) now requires the `sudo` ACL capability.
+```
+
+```release-note:improvement
+activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) can now be called in non-root namespaces. Resulting records will be filtered to include the requested namespace (via `X-Vault-Namespace` header or within the path) and all child namespaces.
+```
diff --git a/changelog/27858.txt b/changelog/27858.txt
new file mode 100644
index 00000000000..398d94ac438
--- /dev/null
+++ b/changelog/27858.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/aws: fixes an issue where not supplying an external id was interpreted as an empty external id
+```
diff --git a/changelog/27859.txt b/changelog/27859.txt
new file mode 100644
index 00000000000..d6836641fae
--- /dev/null
+++ b/changelog/27859.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+audit: sinks (file, socket, syslog) will attempt to log errors to the server operational 
+log before returning (if there are errors to log, and the context is done).
+```
diff --git a/changelog/27881.txt b/changelog/27881.txt
new file mode 100644
index 00000000000..0b3f9aa7fd6
--- /dev/null
+++ b/changelog/27881.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+sys: Fix a bug where mounts of external plugins that were registered before Vault v1.0.0 could not be tuned to
+use versioned plugins.
+```
\ No newline at end of file
diff --git a/changelog/27883.txt b/changelog/27883.txt
new file mode 100644
index 00000000000..63752f78f10
--- /dev/null
+++ b/changelog/27883.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+website/docs: Added API documentation for Azure Secrets Engine delete role
+```
\ No newline at end of file
diff --git a/changelog/27889.txt b/changelog/27889.txt
new file mode 100644
index 00000000000..2b4959a5d71
--- /dev/null
+++ b/changelog/27889.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+secrets/database: Add PSC support for GCP CloudSQL MySQL and Postgresql
+```
+```release-note:improvement
+secrets/database: Add PrivateIP support for MySQL
+```
diff --git a/changelog/27891.txt b/changelog/27891.txt
new file mode 100644
index 00000000000..c5962285e7d
--- /dev/null
+++ b/changelog/27891.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+proxy/cache (enterprise): Fixed an issue where Proxy would not correctly update KV secrets when talking to a perf standby. Proxy will now attempt to forward requests to update secrets triggered by events to the active node. Note that this requires `allow_forwarding_via_header` to be configured on the cluster.
+```
diff --git a/changelog/27902.txt b/changelog/27902.txt
new file mode 100644
index 00000000000..e058e8d9627
--- /dev/null
+++ b/changelog/27902.txt
@@ -0,0 +1,5 @@
+```release-note:improvement
+auth/cert: Cache full list of role trust information separately to avoid
+eviction, and avoid duplicate loading during multiple simultaneous logins on
+the same role.
+```
\ No newline at end of file
diff --git a/changelog/27918.txt b/changelog/27918.txt
new file mode 100644
index 00000000000..bdf34609efe
--- /dev/null
+++ b/changelog/27918.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Move secret-engine configuration create/edit from routing `vault/settings/secrets/configure/<backend>` to  `vault/secrets/<backend>/configuration/edit`
+```
\ No newline at end of file
diff --git a/changelog/27920.txt b/changelog/27920.txt
new file mode 100644
index 00000000000..6cb68773163
--- /dev/null
+++ b/changelog/27920.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/api: Added missing LICENSE files to API sub-modules to ensure Go module tooling recognizes MPL-2.0 license.
+```
diff --git a/changelog/27927.txt b/changelog/27927.txt
new file mode 100644
index 00000000000..afc37a7acbd
--- /dev/null
+++ b/changelog/27927.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+storage/s3: Pass context to AWS SDK calls
+```
+```release-note:improvement
+storage/dynamodb: Pass context to AWS SDK calls
+```
diff --git a/changelog/27929.txt b/changelog/27929.txt
new file mode 100644
index 00000000000..d957bcace4d
--- /dev/null
+++ b/changelog/27929.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+identity/oidc: prevent JWKS from being generated by multiple concurrent requests
+```
diff --git a/changelog/27939.txt b/changelog/27939.txt
new file mode 100644
index 00000000000..093b742b90b
--- /dev/null
+++ b/changelog/27939.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core (enterprise): Fix 500 errors that occurred querying `sys/internal/ui/mounts` for a mount prefixed by a namespace path when path filters are configured.
+```
\ No newline at end of file
diff --git a/changelog/27950.txt b/changelog/27950.txt
new file mode 100644
index 00000000000..27a1e53b174
--- /dev/null
+++ b/changelog/27950.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/database/hana: Update HANA db client to v1.10.1
+```
diff --git a/changelog/27952.txt b/changelog/27952.txt
new file mode 100644
index 00000000000..aa7d2ba84f9
--- /dev/null
+++ b/changelog/27952.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+audit: Internal implementation changes to the audit subsystem which improve performance.
+```
diff --git a/changelog/27966.txt b/changelog/27966.txt
new file mode 100644
index 00000000000..616bfe5c8ac
--- /dev/null
+++ b/changelog/27966.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core/metrics: ensure core HA metrics are always output to Prometheus.
+```
\ No newline at end of file
diff --git a/changelog/28016.txt b/changelog/28016.txt
new file mode 100644
index 00000000000..ef8f06b873a
--- /dev/null
+++ b/changelog/28016.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/terraform: Update plugin to v0.9.0
+```
diff --git a/changelog/28024.txt b/changelog/28024.txt
new file mode 100644
index 00000000000..8d1fbaa0e2a
--- /dev/null
+++ b/changelog/28024.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+database/postgres: Add new fields to the plugin's config endpoint for client certificate authentication.
+```
diff --git a/changelog/28036.txt b/changelog/28036.txt
new file mode 100644
index 00000000000..f47891e46c8
--- /dev/null
+++ b/changelog/28036.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Update the client count dashboard to use API namespace filtering and other UX improvements
+```
\ No newline at end of file
diff --git a/changelog/28042.txt b/changelog/28042.txt
new file mode 100644
index 00000000000..f49cad8ac59
--- /dev/null
+++ b/changelog/28042.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+activity: The sys/internal/counters/activity endpoint will return current month data when the end_date parameter is set to a future date.
+```
diff --git a/changelog/28056.txt b/changelog/28056.txt
new file mode 100644
index 00000000000..f39fbe2921c
--- /dev/null
+++ b/changelog/28056.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+audit: Adds TRACE logging to log request/response under certain circumstances, and further improvements to the audit subsystem.
+```
\ No newline at end of file
diff --git a/changelog/28059.txt b/changelog/28059.txt
new file mode 100644
index 00000000000..550fd75af5c
--- /dev/null
+++ b/changelog/28059.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+command: The `vault secrets move` and `vault auth move` command will no longer attempt to write to storage on performance standby nodes.
+```
diff --git a/changelog/28062.txt b/changelog/28062.txt
new file mode 100644
index 00000000000..c6a1fbef198
--- /dev/null
+++ b/changelog/28062.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core/activity: Ensure client count queries that include the current month return consistent results by sorting the clients before performing estimation 
+```
\ No newline at end of file
diff --git a/changelog/28064.txt b/changelog/28064.txt
new file mode 100644
index 00000000000..6f18843cad3
--- /dev/null
+++ b/changelog/28064.txt
@@ -0,0 +1,7 @@
+```release-note:improvement
+activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) now includes identity metadata about entity clients.
+```
+
+```release-note:change
+activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) now responds with a status of 204 instead 400 when no data exists within the time range specified by `start_time` and `end_time`.
+```
diff --git a/changelog/28068.txt b/changelog/28068.txt
new file mode 100644
index 00000000000..ec608a67a10
--- /dev/null
+++ b/changelog/28068.txt
@@ -0,0 +1,7 @@
+```release-note:improvement
+cli: `vault operator usage` will now include a warning if the specified usage period contains estimated client counts.
+```
+
+```release-note:improvement
+activity: `/sys/internal/counters/activity` will now include a warning if the specified usage period contains estimated client counts.
+```
\ No newline at end of file
diff --git a/changelog/28076.txt b/changelog/28076.txt
new file mode 100644
index 00000000000..bb9adb94294
--- /dev/null
+++ b/changelog/28076.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+website/docs: corrected invalid json in sample payload for azure secrets engine create/update role
+```
\ No newline at end of file
diff --git a/changelog/28093.txt b/changelog/28093.txt
new file mode 100644
index 00000000000..830f53baa64
--- /dev/null
+++ b/changelog/28093.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fixes toast (flash) alert message saying "created" when deleting a kv v2 secret
+```
\ No newline at end of file
diff --git a/changelog/28121.txt b/changelog/28121.txt
new file mode 100644
index 00000000000..1769ac67c8b
--- /dev/null
+++ b/changelog/28121.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/okta: update to okta sdk v5 from v2. Transitively updates go-jose dependency to >=3.0.3 to resolve GO-2024-2631. See https://github.com/okta/okta-sdk-golang/blob/master/MIGRATING.md for details on changes.
+```
diff --git a/changelog/28126.txt b/changelog/28126.txt
new file mode 100644
index 00000000000..5dfb7a86495
--- /dev/null
+++ b/changelog/28126.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+auto-auth/cert: support watching changes on certificate/key files and notifying the auth handler when `enable_reauth_on_new_credentials` is enabled.
+```
+```release-note:improvement
+auto-auth: support new config option `enable_reauth_on_new_credentials`, supporting re-authentication when receiving new credential on certain auto-auth types
+```
diff --git a/changelog/28139.txt b/changelog/28139.txt
new file mode 100644
index 00000000000..f538ddf769d
--- /dev/null
+++ b/changelog/28139.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/database: Skip connection verification on reading existing DB connection configuration
+```
\ No newline at end of file
diff --git a/changelog/28148.txt b/changelog/28148.txt
new file mode 100644
index 00000000000..141e6a0129d
--- /dev/null
+++ b/changelog/28148.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**Feature Name**: Add WIF fields to AWS secrets engine.
+```
diff --git a/changelog/28186.txt b/changelog/28186.txt
new file mode 100644
index 00000000000..ee17101e4b5
--- /dev/null
+++ b/changelog/28186.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+raft/autopilot: Persist Raft server versions so autopilot always knows the versions of all servers in the cluster. Include server versions in the Raft bootstrap challenge answer so autopilot immediately knows the versions of new nodes.
+```
\ No newline at end of file
diff --git a/changelog/28199.txt b/changelog/28199.txt
new file mode 100644
index 00000000000..9b94d97f8c5
--- /dev/null
+++ b/changelog/28199.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**Self-Managed Static Roles**: Self-Managed Static Roles are now supported for select SQL database engines (Postgres, Oracle). Requires Vault Enterprise.
+```
\ No newline at end of file
diff --git a/changelog/28204.txt b/changelog/28204.txt
new file mode 100644
index 00000000000..beaef7968c7
--- /dev/null
+++ b/changelog/28204.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fixes renew-self being called right after login for non-renewable tokens
+```
\ No newline at end of file
diff --git a/changelog/28207.txt b/changelog/28207.txt
new file mode 100644
index 00000000000..0c3e07b517e
--- /dev/null
+++ b/changelog/28207.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+proxy/cache (enterprise): Fixed an issue where Proxy with static secret caching enabled would not correctly handle requests to older secret versions for KVv2 secrets. Proxy's static secret cache now properly handles all requests relating to older versions for KVv2 secrets.
+```
diff --git a/changelog/28212.txt b/changelog/28212.txt
new file mode 100644
index 00000000000..a5e1a2b19a0
--- /dev/null
+++ b/changelog/28212.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**KV v2 Patch/Subkey (enterprise)**: Adds GUI support to read the subkeys of a KV v2 secret and patch (partially update) secret data.
+```
diff --git a/changelog/28230.txt b/changelog/28230.txt
new file mode 100644
index 00000000000..13934ace8c2
--- /dev/null
+++ b/changelog/28230.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed an issue where maximum request duration timeout was not being added to all requests containing strings sys/monitor and sys/events. With this change, timeout is now added to all requests except monitor and events endpoint. 
+```
diff --git a/changelog/28237.txt b/changelog/28237.txt
new file mode 100644
index 00000000000..8b5728f3f43
--- /dev/null
+++ b/changelog/28237.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki: Key Usage can now be set on intermediate and root CAs, and CSRs generated by the PKI secret's engine.
+```
diff --git a/changelog/28263.txt b/changelog/28263.txt
new file mode 100644
index 00000000000..704ff2bb30a
--- /dev/null
+++ b/changelog/28263.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/alicloud: Update plugin to v0.19.0
+```
diff --git a/changelog/28264.txt b/changelog/28264.txt
new file mode 100644
index 00000000000..03a508fa880
--- /dev/null
+++ b/changelog/28264.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kerberos: Update plugin to v0.13.0
+```
diff --git a/changelog/28266.txt b/changelog/28266.txt
new file mode 100644
index 00000000000..084977f1851
--- /dev/null
+++ b/changelog/28266.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/cf: Update plugin to v0.19.0
+```
diff --git a/changelog/28267.txt b/changelog/28267.txt
new file mode 100644
index 00000000000..def6986c7d6
--- /dev/null
+++ b/changelog/28267.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to v0.20.0
+```
diff --git a/changelog/28268.txt b/changelog/28268.txt
new file mode 100644
index 00000000000..b622284ade7
--- /dev/null
+++ b/changelog/28268.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/mongodbatlas: Update plugin to v0.13.0
+```
diff --git a/changelog/28269.txt b/changelog/28269.txt
new file mode 100644
index 00000000000..336e88a4401
--- /dev/null
+++ b/changelog/28269.txt
@@ -0,0 +1,3 @@
+```release-note:change
+sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.0, which also bumps github.com/docker/docker to v26.1.5+incompatible
+```
diff --git a/changelog/28271.txt b/changelog/28271.txt
new file mode 100644
index 00000000000..6cc6148f3d2
--- /dev/null
+++ b/changelog/28271.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/alicloud: Update plugin to v0.18.0
+```
diff --git a/changelog/28275.txt b/changelog/28275.txt
new file mode 100644
index 00000000000..85564eed28a
--- /dev/null
+++ b/changelog/28275.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/snowflake: Update plugin to v0.12.0
+```
diff --git a/changelog/28277.txt b/changelog/28277.txt
new file mode 100644
index 00000000000..60985a1d9c2
--- /dev/null
+++ b/changelog/28277.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/elasticsearch: Update plugin to v0.16.0
+```
diff --git a/changelog/28286.txt b/changelog/28286.txt
new file mode 100644
index 00000000000..c7010a19924
--- /dev/null
+++ b/changelog/28286.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+audit: Internal implementation changes to the audit subsystem which improve relability.
+```
\ No newline at end of file
diff --git a/changelog/28287.txt b/changelog/28287.txt
new file mode 100644
index 00000000000..7e6a6b8e750
--- /dev/null
+++ b/changelog/28287.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kubernetes: Update plugin to v0.9.0
+```
diff --git a/changelog/28289.txt b/changelog/28289.txt
new file mode 100644
index 00000000000..e203556fb13
--- /dev/null
+++ b/changelog/28289.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kubernetes: Update plugin to v0.20.0
+```
diff --git a/changelog/28293.txt b/changelog/28293.txt
new file mode 100644
index 00000000000..4db93f90dcf
--- /dev/null
+++ b/changelog/28293.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis-elasticache: Update plugin to v0.5.0
+```
diff --git a/changelog/28294.txt b/changelog/28294.txt
new file mode 100644
index 00000000000..13168cf2d74
--- /dev/null
+++ b/changelog/28294.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.19.0
+```
diff --git a/changelog/28300.txt b/changelog/28300.txt
new file mode 100644
index 00000000000..4357135fb9e
--- /dev/null
+++ b/changelog/28300.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcpkms: Update plugin to v0.18.0
+```
diff --git a/changelog/28307.txt b/changelog/28307.txt
new file mode 100644
index 00000000000..9f1f3be3162
--- /dev/null
+++ b/changelog/28307.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/oci: Update plugin to v0.17.0
+```
diff --git a/changelog/28309.txt b/changelog/28309.txt
new file mode 100644
index 00000000000..94574b31210
--- /dev/null
+++ b/changelog/28309.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: ocsp_ca_certificates field was not honored when validating OCSP responses signed by a CA that did not issue the certificate.
+```
\ No newline at end of file
diff --git a/changelog/28312.txt b/changelog/28312.txt
new file mode 100644
index 00000000000..e2959b09ac2
--- /dev/null
+++ b/changelog/28312.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/terraform: Update plugin to v0.10.0
+```
diff --git a/changelog/28324.txt b/changelog/28324.txt
new file mode 100644
index 00000000000..a38b971b6b1
--- /dev/null
+++ b/changelog/28324.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcp: Update plugin to v0.20.0
+```
diff --git a/changelog/28325.txt b/changelog/28325.txt
new file mode 100644
index 00000000000..b00c20b1922
--- /dev/null
+++ b/changelog/28325.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.14.0
+```
diff --git a/changelog/28327.txt b/changelog/28327.txt
new file mode 100644
index 00000000000..4d77459f356
--- /dev/null
+++ b/changelog/28327.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/couchbase: Update plugin to v0.12.0
+```
diff --git a/changelog/28330.txt b/changelog/28330.txt
new file mode 100644
index 00000000000..4c325326d6e
--- /dev/null
+++ b/changelog/28330.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secret/aws: Fixed potential panic after step-down and the queue has not repopulated.
+```
diff --git a/changelog/28334.txt b/changelog/28334.txt
new file mode 100644
index 00000000000..6a126a0e02a
--- /dev/null
+++ b/changelog/28334.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kv: Update plugin to v0.20.0
+```
diff --git a/changelog/28348.txt b/changelog/28348.txt
new file mode 100644
index 00000000000..7b8177491b8
--- /dev/null
+++ b/changelog/28348.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/mongodbatlas: Update plugin to v0.13.0
+```
diff --git a/changelog/28349.txt b/changelog/28349.txt
new file mode 100644
index 00000000000..c81df34fc00
--- /dev/null
+++ b/changelog/28349.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/jwt: Update plugin to v0.22.0
+```
diff --git a/changelog/28360.txt b/changelog/28360.txt
new file mode 100644
index 00000000000..722c8361eaa
--- /dev/null
+++ b/changelog/28360.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcpkms: Update plugin to v0.19.0
+```
diff --git a/changelog/28361.txt b/changelog/28361.txt
new file mode 100644
index 00000000000..075bb21414f
--- /dev/null
+++ b/changelog/28361.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/ad: Update plugin to v0.19.0
+```
diff --git a/changelog/28366.txt b/changelog/28366.txt
new file mode 100644
index 00000000000..5f2d6578398
--- /dev/null
+++ b/changelog/28366.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/gcp: Update plugin to v0.19.0
+```
diff --git a/changelog/28371.txt b/changelog/28371.txt
new file mode 100644
index 00000000000..c719c4be56c
--- /dev/null
+++ b/changelog/28371.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix UI improperly checking capabilities for enabling performance and dr replication
+```
diff --git a/changelog/28404.txt b/changelog/28404.txt
new file mode 100644
index 00000000000..cca52cce8b6
--- /dev/null
+++ b/changelog/28404.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis: Update plugin to v0.4.0
+```
diff --git a/changelog/28441.txt b/changelog/28441.txt
new file mode 100644
index 00000000000..e78ed504af2
--- /dev/null
+++ b/changelog/28441.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth: Updated error handling for missing login credentials in AppRole and UserPass auth methods to return a 400 error instead of a 500 error.
+```
diff --git a/changelog/28450.txt b/changelog/28450.txt
new file mode 100644
index 00000000000..38f27478e85
--- /dev/null
+++ b/changelog/28450.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: During certificate validation, OCSP requests are debug logged even if Vault's log level is above DEBUG.
+```
\ No newline at end of file
diff --git a/changelog/28456.txt b/changelog/28456.txt
new file mode 100644
index 00000000000..af0a582ecb8
--- /dev/null
+++ b/changelog/28456.txt
@@ -0,0 +1,3 @@
+```release-note:change
+sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.1, which also bumps github.com/docker/docker to v27.2.1+incompatible
+```
diff --git a/changelog/28466.txt b/changelog/28466.txt
new file mode 100644
index 00000000000..be9016ec05e
--- /dev/null
+++ b/changelog/28466.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/ssh: Add a flag, `allow_empty_principals` to allow keys or certs to apply to any user/principal.
+```
diff --git a/changelog/28479.txt b/changelog/28479.txt
new file mode 100644
index 00000000000..4045d48837e
--- /dev/null
+++ b/changelog/28479.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.14.1
+```
diff --git a/changelog/28488.txt b/changelog/28488.txt
new file mode 100644
index 00000000000..bc297fc2f20
--- /dev/null
+++ b/changelog/28488.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki: Track the last time auto-tidy ran to address auto-tidy not running if the auto-tidy interval is longer than scheduled Vault restarts.
+```
diff --git a/changelog/28494.txt b/changelog/28494.txt
new file mode 100644
index 00000000000..50b9223968a
--- /dev/null
+++ b/changelog/28494.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+proxy/cache (enterprise): Fixed a data race that could occur while tracking capabilities in Proxy's static secret cache.
+```
diff --git a/changelog/28498.txt b/changelog/28498.txt
new file mode 100644
index 00000000000..0a6810ad739
--- /dev/null
+++ b/changelog/28498.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/token: Fix token TTL calculation so that it uses `max_lease_ttl` tune value for tokens created via `auth/token/create`.
+```
diff --git a/changelog/28509.txt b/changelog/28509.txt
new file mode 100644
index 00000000000..821f8411464
--- /dev/null
+++ b/changelog/28509.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+databases: fix issue where local timezone was getting lost when using a rotation schedule cron
+```
diff --git a/changelog/28519.txt b/changelog/28519.txt
new file mode 100644
index 00000000000..9cd11f74ff3
--- /dev/null
+++ b/changelog/28519.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+database/postgresql: Fix potential error revoking privileges in postgresql database secrets engine when a schema contains special characters
+```
diff --git a/changelog/28526.txt b/changelog/28526.txt
new file mode 100644
index 00000000000..b22b093efc9
--- /dev/null
+++ b/changelog/28526.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+physical/raft: Log when the MAP_POPULATE mmap flag gets disabled before opening the database.
+```
\ No newline at end of file
diff --git a/changelog/28539.txt b/changelog/28539.txt
new file mode 100644
index 00000000000..ebbc5476135
--- /dev/null
+++ b/changelog/28539.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fix `default_role` input missing from oidc auth method configuration form
+```
diff --git a/changelog/28564.txt b/changelog/28564.txt
new file mode 100644
index 00000000000..22e6b74198e
--- /dev/null
+++ b/changelog/28564.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: log at level ERROR rather than INFO when all seals are unhealthy.
+```
diff --git a/changelog/28574.txt b/changelog/28574.txt
new file mode 100644
index 00000000000..b3e6c34c8b9
--- /dev/null
+++ b/changelog/28574.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a CLI precedence issue where -agent-address didn't override VAULT_AGENT_ADDR as it should
+```
diff --git a/changelog/28596.txt b/changelog/28596.txt
new file mode 100644
index 00000000000..9e79f89a405
--- /dev/null
+++ b/changelog/28596.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+audit: Audit logs will contain User-Agent headers when they are present in the incoming request. They are not
+HMAC'ed by default but can be configured to be via the `/sys/config/auditing/request-headers/user-agent` endpoint.
+```
diff --git a/changelog/28597.txt b/changelog/28597.txt
new file mode 100644
index 00000000000..774c200f1ad
--- /dev/null
+++ b/changelog/28597.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: When using ocsp_ca_certificates, an error was produced though extra certs validation succeeded.
+```
diff --git a/changelog/28629.txt b/changelog/28629.txt
new file mode 100644
index 00000000000..7d10d6da64e
--- /dev/null
+++ b/changelog/28629.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Add button to copy secret path in kv v1 and v2 secrets engines
+```
diff --git a/changelog/28631.txt b/changelog/28631.txt
new file mode 100644
index 00000000000..a4857ea1123
--- /dev/null
+++ b/changelog/28631.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/seal: Fix an issue that could cause reading from sys/seal-backend-status to return stale information.
+```
diff --git a/changelog/28654.txt b/changelog/28654.txt
new file mode 100644
index 00000000000..35f7c619e47
--- /dev/null
+++ b/changelog/28654.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki: Add a CRL entry limit to prevent runaway revocations from overloading Vault, reconfigurable with max_crl_entries on the CRL config.
+```
diff --git a/changelog/28669.txt b/changelog/28669.txt
new file mode 100644
index 00000000000..e2594052edb
--- /dev/null
+++ b/changelog/28669.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed panic seen when performing help requests without /v1/ in the URL.
+```
diff --git a/changelog/28678.txt b/changelog/28678.txt
new file mode 100644
index 00000000000..018e4adb730
--- /dev/null
+++ b/changelog/28678.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki: Add ACME error types to errors encountered during challenge validation.
+```
diff --git a/changelog/28698.txt b/changelog/28698.txt
new file mode 100644
index 00000000000..7a9eb052929
--- /dev/null
+++ b/changelog/28698.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: No longer running decodeURIComponent on KVv2 list view allowing percent encoded data-octets in path name.
+```
diff --git a/changelog/28699.txt b/changelog/28699.txt
new file mode 100644
index 00000000000..e2a4cf156f4
--- /dev/null
+++ b/changelog/28699.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to v0.20.1
+```
diff --git a/changelog/28703.txt b/changelog/28703.txt
new file mode 100644
index 00000000000..c4283eccb2e
--- /dev/null
+++ b/changelog/28703.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/approle: seal wrap approle secrets if seal wrap is enabled.
+```
\ No newline at end of file
diff --git a/changelog/28704.txt b/changelog/28704.txt
new file mode 100644
index 00000000000..eb9289b9886
--- /dev/null
+++ b/changelog/28704.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.14.2
+```
diff --git a/changelog/28712.txt b/changelog/28712.txt
new file mode 100644
index 00000000000..3682452776b
--- /dev/null
+++ b/changelog/28712.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.19.1
+```
diff --git a/changelog/28718.txt b/changelog/28718.txt
new file mode 100644
index 00000000000..e32c7b2d593
--- /dev/null
+++ b/changelog/28718.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/pki: Address issue with ACME HTTP-01 challenges failing for IPv6 IPs due to improperly formatted URLs
+```
diff --git a/changelog/28742.txt b/changelog/28742.txt
new file mode 100644
index 00000000000..8d5050f1ed7
--- /dev/null
+++ b/changelog/28742.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Adds copy button to identity entity, alias and mfa method IDs
+```
\ No newline at end of file
diff --git a/changelog/28748.txt b/changelog/28748.txt
new file mode 100644
index 00000000000..fb486b73722
--- /dev/null
+++ b/changelog/28748.txt
@@ -0,0 +1,6 @@
+```release-note:bug
+agent: Fix chown error running agent on Windows with an auto-auth file sinks. 
+```
+```release-note:bug
+proxy: Fix chown error running proxy on Windows with an auto-auth file sink.
+```
diff --git a/changelog/28751.txt b/changelog/28751.txt
new file mode 100644
index 00000000000..05c08659736
--- /dev/null
+++ b/changelog/28751.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+audit: Prevent users from enabling multiple audit devices of file type with the same file_path to write to.
+```
diff --git a/changelog/28752.txt b/changelog/28752.txt
new file mode 100644
index 00000000000..9cc548ecc0c
--- /dev/null
+++ b/changelog/28752.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: Add a mount tuneable that trims trailing slashes of request paths during POST.  Needed to support CMPv2 in PKI.
+```
diff --git a/changelog/28775.txt b/changelog/28775.txt
new file mode 100644
index 00000000000..26193fc42a1
--- /dev/null
+++ b/changelog/28775.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/aws: Fix issue with static credentials not rotating after restart or leadership change.  
+```
\ No newline at end of file
diff --git a/changelog/28780.txt b/changelog/28780.txt
new file mode 100644
index 00000000000..f727340b097
--- /dev/null
+++ b/changelog/28780.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.14.3
+```
diff --git a/changelog/28798.txt b/changelog/28798.txt
new file mode 100644
index 00000000000..992e240ee62
--- /dev/null
+++ b/changelog/28798.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui: Upgrade Ember data to v5.3.2 (and minor upgrade of ember-cli, ember-source to v5.8.0)
+```
diff --git a/changelog/28807.txt b/changelog/28807.txt
new file mode 100644
index 00000000000..6fc7c308f37
--- /dev/null
+++ b/changelog/28807.txt
@@ -0,0 +1,3 @@
+```release-note:change
+login (enterprise): Return a 500 error during logins when performance standby nodes make failed gRPC requests to the active node. 
+```
\ No newline at end of file
diff --git a/changelog/28808.txt b/changelog/28808.txt
new file mode 100644
index 00000000000..20d4d1ce4e3
--- /dev/null
+++ b/changelog/28808.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+ui: Replace KVv2 json secret details view with Hds::CodeBlock component allowing users to search the full secret height.
+```
+```release-note:bug
+ui: Allow users to search the full json object within the json code-editor edit/create view.
+```
diff --git a/changelog/28822.txt b/changelog/28822.txt
new file mode 100644
index 00000000000..7f8f48fe72c
--- /dev/null
+++ b/changelog/28822.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Add identity_token_key to mount view for the GCP and Azure Secret engines.
+```
diff --git a/changelog/28824.txt b/changelog/28824.txt
new file mode 100644
index 00000000000..b770f286af4
--- /dev/null
+++ b/changelog/28824.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+ui: Adds navigation for LDAP hierarchical roles
+```
+```release-note:bug
+ui: Fixes rendering issues of LDAP dynamic and static roles with the same name
+```
diff --git a/changelog/28825.txt b/changelog/28825.txt
new file mode 100644
index 00000000000..6de7e12949f
--- /dev/null
+++ b/changelog/28825.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+website/docs: changed outdated reference to consul-helm repository to consul-k8s repository.
+```
diff --git a/changelog/28832.txt b/changelog/28832.txt
new file mode 100644
index 00000000000..1219900bd44
--- /dev/null
+++ b/changelog/28832.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+secret/pki: Fix a bug that prevents PKI issuer field enable_aia_url_templating
+to be set to false.
+```
diff --git a/changelog/28839.txt b/changelog/28839.txt
new file mode 100644
index 00000000000..b719e5ea470
--- /dev/null
+++ b/changelog/28839.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/transit: Fix a race in which responses from the key update api could contain results from another subsequent update
+```
diff --git a/changelog/28848.txt b/changelog/28848.txt
new file mode 100644
index 00000000000..ef41fe30f1a
--- /dev/null
+++ b/changelog/28848.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.19.2
+```
diff --git a/changelog/28858.txt b/changelog/28858.txt
new file mode 100644
index 00000000000..422b9d65060
--- /dev/null
+++ b/changelog/28858.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**Product Usage Reporting**: Added product usage reporting, which collects anonymous, numerical, non-sensitive data about Vault feature usage, and adds it to the existing utilization reports.
+```
\ No newline at end of file
diff --git a/changelog/28867.txt b/changelog/28867.txt
new file mode 100644
index 00000000000..a0e541bce63
--- /dev/null
+++ b/changelog/28867.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+core: Fix an issue where duplicate identity aliases in storage could be merged
+inconsistently during different unseal events or on different servers.
+```
diff --git a/changelog/28873.txt b/changelog/28873.txt
new file mode 100644
index 00000000000..f509c11bbc3
--- /dev/null
+++ b/changelog/28873.txt
@@ -0,0 +1,6 @@
+```release-note:bug
+ui: Fixes login to web UI when MFA is enabled for OIDC (i.e. azure, auth0) and Okta auth methods
+```
+```release-note:bug
+ui (enterprise): Fixes login to web UI when MFA is enabled for SAML auth methods
+```
diff --git a/changelog/28875.txt b/changelog/28875.txt
new file mode 100644
index 00000000000..471920e9b26
--- /dev/null
+++ b/changelog/28875.txt
@@ -0,0 +1,3 @@
+```release-note:change
+storage/raft: Do not allow nodes that have been removed from the raft cluster configuration to respond to requests. Shutdown and seal raft nodes when they are removed. 
+```
diff --git a/changelog/28878.txt b/changelog/28878.txt
new file mode 100644
index 00000000000..abcc3d2f3c8
--- /dev/null
+++ b/changelog/28878.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+core: Improved an internal helper function that sanitizes paths by adding a check for leading backslashes 
+in addition to the existing check for leading slashes.
+```
\ No newline at end of file
diff --git a/changelog/28881.txt b/changelog/28881.txt
new file mode 100644
index 00000000000..3fc3b791460
--- /dev/null
+++ b/changelog/28881.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/ldap: Fixed an issue where debug level logging was not emitted.
+```
\ No newline at end of file
diff --git a/changelog/28884.txt b/changelog/28884.txt
new file mode 100644
index 00000000000..3a797146ef6
--- /dev/null
+++ b/changelog/28884.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/radius: Fixed an issue where usernames with upper case characters where not honored
+```
\ No newline at end of file
diff --git a/changelog/28895.txt b/changelog/28895.txt
new file mode 100644
index 00000000000..d084c6dfbee
--- /dev/null
+++ b/changelog/28895.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: Added new `enable_post_unseal_trace` and `post_unseal_trace_directory` config options to generate Go traces during the post-unseal step for debug purposes.
+```
diff --git a/changelog/28901.txt b/changelog/28901.txt
new file mode 100644
index 00000000000..054a343130f
--- /dev/null
+++ b/changelog/28901.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/ssh: Return the flag `allow_empty_principals` in the read role api when key_type is "ca"
+```
diff --git a/changelog/28907.txt b/changelog/28907.txt
new file mode 100644
index 00000000000..9d301b850e6
--- /dev/null
+++ b/changelog/28907.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secret/pki: Introduce a new value `always_enforce_err` within `leaf_not_after_behavior` to force the error in all circumstances such as CA issuance and ACME requests if requested TTL values are beyond the issuer's NotAfter.
+```
diff --git a/changelog/28938.txt b/changelog/28938.txt
new file mode 100644
index 00000000000..2fe42304f07
--- /dev/null
+++ b/changelog/28938.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: Add `removed_from_cluster` field to sys/seal-status and vault status output to indicate whether the node has been removed from the HA cluster. 
+```
diff --git a/changelog/28989.txt b/changelog/28989.txt
new file mode 100644
index 00000000000..879f713b4a7
--- /dev/null
+++ b/changelog/28989.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+secret/db: Update static role rotation to generate a new password after 2 failed attempts.
+Unblocks customers that were stuck in a failing loop when attempting to rotate static role passwords.
+```
\ No newline at end of file
diff --git a/changelog/28991.txt b/changelog/28991.txt
new file mode 100644
index 00000000000..e7120258db2
--- /dev/null
+++ b/changelog/28991.txt
@@ -0,0 +1,6 @@
+```release-note:change
+api: Add to sys/health whether the node has been removed from the HA cluster. If the node has been removed, return code 530 by default or the value of the `removedcode` query parameter.   
+```
+```release-note:change
+api: Add to sys/health whether the standby node has been able to successfully send heartbeats to the active node and the time in milliseconds since the last heartbeat. If the standby has been unable to send a heartbeat, return code 474 by default or the value of the `haunhealthycode` query parameter.    
+```
diff --git a/changelog/29020.txt b/changelog/29020.txt
new file mode 100644
index 00000000000..928e61d265f
--- /dev/null
+++ b/changelog/29020.txt
@@ -0,0 +1,5 @@
+```release-note: improvement
+sdk/helper: utitilize a randomly seeded cryptographic determinstic random bit generator for
+RSA key generation when using slow random sources, speeding key generation
+considerably.
+```
diff --git a/changelog/29044.txt b/changelog/29044.txt
new file mode 100644
index 00000000000..a4e54a2f796
--- /dev/null
+++ b/changelog/29044.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/cert: Add new configuration option `enable_metadata_on_failures` to add client cert metadata on login failures to audit log and response
+```
diff --git a/changelog/29045.txt b/changelog/29045.txt
new file mode 100644
index 00000000000..0132732f54d
--- /dev/null
+++ b/changelog/29045.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/pki: Enforce the issuer constraint extensions (extended key usage, name constraints, issuer name) when issuing or signing leaf certificates. For more information see [PKI considerations](https://developer.hashicorp.com/vault/docs/secrets/pki/considerations#issuer-constraints-enforcement)
+```
diff --git a/changelog/29047.txt b/changelog/29047.txt
new file mode 100644
index 00000000000..6afc9cdcd41
--- /dev/null
+++ b/changelog/29047.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+ui: Adds ability to edit, create, and view the Azure secrets engine configuration.
+```
+```release-note:improvement
+ui (enterprise): Allow WIF configuration on the Azure secrets engine.
+```
diff --git a/changelog/29050.txt b/changelog/29050.txt
new file mode 100644
index 00000000000..96ecd1e5351
--- /dev/null
+++ b/changelog/29050.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+core: fix bug in seal unwrapper that caused high storage latency in Vault CE. For every storage read request, the
+seal unwrapper was performing the read twice, and would also issue an unnecessary storage write.
+```
diff --git a/changelog/29051.txt b/changelog/29051.txt
new file mode 100644
index 00000000000..13c42006d9e
--- /dev/null
+++ b/changelog/29051.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/aws: add fallback endpoint and region parameters to sts configuration
+```
diff --git a/changelog/29060.txt b/changelog/29060.txt
new file mode 100644
index 00000000000..41e9ab952d2
--- /dev/null
+++ b/changelog/29060.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+CLI: adds an optional flag (--fail-if-not-fulfilled) to the renew command, which lets the renew command fail on unfulfillable requests and allows command chaining to allow further executions.
+```
\ No newline at end of file
diff --git a/changelog/29082.txt b/changelog/29082.txt
new file mode 100644
index 00000000000..94e1ab78af7
--- /dev/null
+++ b/changelog/29082.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+sdk: Add Vault build date to system view plugin environment response
+```
diff --git a/changelog/29090.txt b/changelog/29090.txt
new file mode 100644
index 00000000000..1679bc15dae
--- /dev/null
+++ b/changelog/29090.txt
@@ -0,0 +1,3 @@
+```release-note:change
+core/raft: Return an error on sys/storage/raft/join if a node that has been removed from raft cluster attempts to re-join when it still has existing raft data on disk.   
+```
diff --git a/changelog/29091.txt b/changelog/29091.txt
new file mode 100644
index 00000000000..409d8ddf4a6
--- /dev/null
+++ b/changelog/29091.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/metrics: Fix unlocked mounts read for usage reporting.
+```
diff --git a/changelog/29097.txt b/changelog/29097.txt
new file mode 100644
index 00000000000..15e8c75a71b
--- /dev/null
+++ b/changelog/29097.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+sdk/database: Fix a bug where slow database connections can cause goroutines to be blocked.
+```
diff --git a/changelog/29114.txt b/changelog/29114.txt
new file mode 100644
index 00000000000..8f0a9113375
--- /dev/null
+++ b/changelog/29114.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Decode `connection_url` to fix database connection updates (i.e. editing connection config, deleting roles) failing when urls include template variables.
+```
\ No newline at end of file
diff --git a/changelog/29117.txt b/changelog/29117.txt
new file mode 100644
index 00000000000..97bcd1e9702
--- /dev/null
+++ b/changelog/29117.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/seal (enterprise): Fix problem with nodes unable to join Raft clusters with Seal High Availability enabled.
+```
diff --git a/changelog/29118.txt b/changelog/29118.txt
new file mode 100644
index 00000000000..39295ca98a5
--- /dev/null
+++ b/changelog/29118.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/ldap: Adds an option to enable sAMAccountname logins when upndomain is set. 
+```
diff --git a/changelog/29128.txt b/changelog/29128.txt
new file mode 100644
index 00000000000..ce458a0800f
--- /dev/null
+++ b/changelog/29128.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+vault/diagnose: Fix time to expiration reporting within the TLS verification to not be a month off.
+```
diff --git a/changelog/29131.txt b/changelog/29131.txt
new file mode 100644
index 00000000000..f8750518952
--- /dev/null
+++ b/changelog/29131.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+secrets/openldap: Update static role rotation to generate a new password after 2 failed attempts.
+Unblocks customers that were stuck in a failing loop when attempting to rotate static role passwords.
+```
diff --git a/changelog/29134.txt b/changelog/29134.txt
new file mode 100644
index 00000000000..8fd4ca62e02
--- /dev/null
+++ b/changelog/29134.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/ldap: No longer return authentication warnings to client.
+```
diff --git a/changelog/29173.txt b/changelog/29173.txt
new file mode 100644
index 00000000000..7ccdfbdda39
--- /dev/null
+++ b/changelog/29173.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki: Add a new set of APIs that allow listing ACME account key ids, retrieving ACME account information along with the associated order and certificate information and updating an ACME account's status
+```
diff --git a/changelog/29176.txt b/changelog/29176.txt
new file mode 100644
index 00000000000..a701cd11708
--- /dev/null
+++ b/changelog/29176.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Prevent integer overflows of the barrier key counter on key rotation requests
+```
diff --git a/changelog/29200.txt b/changelog/29200.txt
new file mode 100644
index 00000000000..03177bea039
--- /dev/null
+++ b/changelog/29200.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Adds params to postgresql database to improve editing a connection in the web browser.
+```
diff --git a/changelog/29206.txt b/changelog/29206.txt
new file mode 100644
index 00000000000..26cda21a9cb
--- /dev/null
+++ b/changelog/29206.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Application static breadcrumbs should be formatted in title case.
+```
\ No newline at end of file
diff --git a/changelog/29228.txt b/changelog/29228.txt
new file mode 100644
index 00000000000..d60e1349425
--- /dev/null
+++ b/changelog/29228.txt
@@ -0,0 +1,3 @@
+```release-note:change
+server/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4.
+```
diff --git a/changelog/29237.txt b/changelog/29237.txt
new file mode 100644
index 00000000000..796a8a5bc4a
--- /dev/null
+++ b/changelog/29237.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: Add activation flags. A mechanism for users to opt in to new functionality at a convenient time. Previously used only in Enterprise for SecretSync, activation flags are now available in CE for future features to use.
+```
diff --git a/changelog/29241.txt b/changelog/29241.txt
new file mode 100644
index 00000000000..06699fdf127
--- /dev/null
+++ b/changelog/29241.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+UI: Fix missing Client Count card when running as a Vault Dedicated cluster
+```
diff --git a/changelog/29245.txt b/changelog/29245.txt
new file mode 100644
index 00000000000..17d6b0837d4
--- /dev/null
+++ b/changelog/29245.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki: Complete the set of name constraints parameters by adding permitted_email_addresses, permitted_ip_ranges, permitted_uri_domains, excluded_dns_domains, excluded_email_addresses, excluded_ip_ranges, and excluded_uri_domains; this makes it possible for the name constraints extension to be fully specified when creating root and intermediate CA certificates.
+```
diff --git a/changelog/29255.txt b/changelog/29255.txt
new file mode 100644
index 00000000000..2d9eda7b28a
--- /dev/null
+++ b/changelog/29255.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/pki: Fix a bug that prevented the full CA chain to be used when enforcing name constraints.
+```
diff --git a/changelog/29263.txt b/changelog/29263.txt
new file mode 100644
index 00000000000..f6df0717fdc
--- /dev/null
+++ b/changelog/29263.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Add support for the name constraints extension to be fully specified when creating root and intermediate CA certificates.
+```
\ No newline at end of file
diff --git a/changelog/29273.txt b/changelog/29273.txt
new file mode 100644
index 00000000000..b491294a14b
--- /dev/null
+++ b/changelog/29273.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+sdk: Add helpers and CE stubs for plugins to communicate with Rotation Manager (Enterprise).
+```
diff --git a/changelog/29290.txt b/changelog/29290.txt
new file mode 100644
index 00000000000..1120ae65d8f
--- /dev/null
+++ b/changelog/29290.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui: Partially reverts #20431 and removes ability to download unencrypted kv v2 secret data
+```
\ No newline at end of file
diff --git a/changelog/29293.txt b/changelog/29293.txt
new file mode 100644
index 00000000000..056b7cf9689
--- /dev/null
+++ b/changelog/29293.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+ui: Adds navigation for LDAP hierarchical libraries
+```
+```release-note:bug
+ui: Fixes navigation for quick actions in LDAP roles' popup menu
+```
\ No newline at end of file
diff --git a/changelog/29295.txt b/changelog/29295.txt
new file mode 100644
index 00000000000..488f86bab9c
--- /dev/null
+++ b/changelog/29295.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/cf: Update plugin to v0.19.1
+```
diff --git a/changelog/29302.txt b/changelog/29302.txt
new file mode 100644
index 00000000000..0caf8896c84
--- /dev/null
+++ b/changelog/29302.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/ldap: An error will now be returned on login if the number of entries returned from the user DN LDAP search is more than one.
+```
diff --git a/changelog/29303.txt b/changelog/29303.txt
new file mode 100644
index 00000000000..c71765c2f43
--- /dev/null
+++ b/changelog/29303.txt
@@ -0,0 +1,3 @@
+```release-note:change
+core (enterprise): Add tracking of performance standbys by their HA node ID so that RPC connections can be more easily cleaned up when nodes are removed.
+```
diff --git a/changelog/29306.txt b/changelog/29306.txt
new file mode 100644
index 00000000000..aa0525f41d8
--- /dev/null
+++ b/changelog/29306.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+raft/autopilot: We've updated the autopilot reconciliation logic (by updating the raft-autopilot dependency to v0.3.0) to avoid artificially increasing the quorum in presence of an unhealthy node. Now autopilot will start the reconciliation process by attempting to demote a failed voter node before any promotions, fixing the issue where Vault would initially increase quorum when faced with a failure of a voter node. In certain configurations, especially when using Vault Enterprise Redundancy Zones and losing a voter then a non-voter in quick succession, this would lead to a loss of quorum and cluster failure.
+```
diff --git a/changelog/29312.txt b/changelog/29312.txt
new file mode 100644
index 00000000000..999dc382b4f
--- /dev/null
+++ b/changelog/29312.txt
@@ -0,0 +1,5 @@
+```release-note:bug
+identity/oidc (enterprise): Fix delays in rotation and invalidation of OIDC keys when there are too many namespaces.
+The Cache-Control header returned by the identity/oidc/.well-known/keys endpoint now depends only on the named keys for
+the queried namespace.
+```
diff --git a/changelog/29325.txt b/changelog/29325.txt
new file mode 100644
index 00000000000..5c213fea0a4
--- /dev/null
+++ b/changelog/29325.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+identity: Added reporting in Vault logs during unseal to help identify any
+duplicate identify resources in storage.
+```
diff --git a/changelog/29326.txt b/changelog/29326.txt
new file mode 100644
index 00000000000..f0f38b84735
--- /dev/null
+++ b/changelog/29326.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core/identity: Improve performance of loading entities when unsealing by batching updates, caching local alias storage reads, and doing more work in parallel. 
+```
diff --git a/changelog/29334.txt b/changelog/29334.txt
new file mode 100644
index 00000000000..c4078739680
--- /dev/null
+++ b/changelog/29334.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+plugins: Fix a bug that causes zombie dbus-daemon processes on certain systems.
+```
diff --git a/changelog/29342.txt b/changelog/29342.txt
new file mode 100644
index 00000000000..1631e975730
--- /dev/null
+++ b/changelog/29342.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/pki: fixes issue #28749 requiring all chains to be single line of authority.
+```
\ No newline at end of file
diff --git a/changelog/29356.txt b/changelog/29356.txt
new file mode 100644
index 00000000000..904646271c7
--- /dev/null
+++ b/changelog/29356.txt
@@ -0,0 +1,5 @@
+```release-note:feature
+**Identity De-duplication**: Vault can now automatically resolve duplicate
+Entities and Groups by renaming them. This feature is disabled by default and
+can be enabled through the `force_identity_deduplication` activation flag.
+```
diff --git a/changelog/29369.txt b/changelog/29369.txt
new file mode 100644
index 00000000000..a55e8e9e7ac
--- /dev/null
+++ b/changelog/29369.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki: Add `serial_number_source` option to PKI roles to control the source for the subject serial number.
+```
diff --git a/changelog/29371.txt b/changelog/29371.txt
new file mode 100644
index 00000000000..1f3efba3ecf
--- /dev/null
+++ b/changelog/29371.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+physical/dynamodb: Allow Vault to modify its DynamoDB table and use per-per-request billing mode.
+```
\ No newline at end of file
diff --git a/changelog/29376.txt b/changelog/29376.txt
new file mode 100644
index 00000000000..07d974a59d5
--- /dev/null
+++ b/changelog/29376.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+activity: Include activity records from clients created by deleted or disabled auth mounts in Export API response.
+```
diff --git a/changelog/29399.txt b/changelog/29399.txt
new file mode 100644
index 00000000000..1969a973a9c
--- /dev/null
+++ b/changelog/29399.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+database/mssql: Fix a bug where contained databases would silently fail root rotation if a custom root rotation statement was not provided.
+```
diff --git a/changelog/29402.txt b/changelog/29402.txt
new file mode 100644
index 00000000000..3f12457a1fc
--- /dev/null
+++ b/changelog/29402.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: add support for reading certain sensitive seal wrap and managed key (enterprise) configuration values from the environment or files.
+```
diff --git a/changelog/29416.txt b/changelog/29416.txt
new file mode 100644
index 00000000000..d2a92e57190
--- /dev/null
+++ b/changelog/29416.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui (enterprise): Fixes token renewal to ensure capability checks are performed in the relevant namespace, resolving 'Not authorized' errors for resources that users have permission to access.
+```
\ No newline at end of file
diff --git a/changelog/29423.txt b/changelog/29423.txt
new file mode 100644
index 00000000000..bf3c663dc2f
--- /dev/null
+++ b/changelog/29423.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+ui: Adds ability to edit, create, and view the GCP secrets engine configuration.
+```
+```release-note:improvement
+ui (enterprise): Allow WIF configuration on the GCP secrets engine.
+```
diff --git a/changelog/29430.txt b/changelog/29430.txt
new file mode 100644
index 00000000000..584090e1693
--- /dev/null
+++ b/changelog/29430.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixes text overflow on Secrets engines and Auth Engines list views for long names & descriptions
+```
\ No newline at end of file
diff --git a/changelog/29432.txt b/changelog/29432.txt
new file mode 100644
index 00000000000..7d0266eab2c
--- /dev/null
+++ b/changelog/29432.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+activity: Show activity records from clients created in deleted namespaces when activity log is queried from admin namespace.
+```
\ No newline at end of file
diff --git a/changelog/29470.txt b/changelog/29470.txt
new file mode 100644
index 00000000000..36f28af7ed9
--- /dev/null
+++ b/changelog/29470.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+events (enterprise): Send events downstream to performance standby nodes in a cluster, removing the need to redirect client event subscriptions to the active node.
+```
diff --git a/changelog/29473.txt b/changelog/29473.txt
new file mode 100644
index 00000000000..89fe47bd01f
--- /dev/null
+++ b/changelog/29473.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets(pki): Error if attempt to set a manual chain on an issuer that can't issue any certificate.
+```
diff --git a/changelog/29485.txt b/changelog/29485.txt
new file mode 100644
index 00000000000..1a25aed32d2
--- /dev/null
+++ b/changelog/29485.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: Config reloading on SIGHUP now includes some Raft settings, which are now also present in `/sys/config/state/sanitized` output.
+```
diff --git a/changelog/29497.txt b/changelog/29497.txt
new file mode 100644
index 00000000000..52d91535f33
--- /dev/null
+++ b/changelog/29497.txt
@@ -0,0 +1,11 @@
+```release-note:feature
+**Automated Root Rotation**: Adds Automated Root Rotation capabilities to the AWS Auth and AWS Secrets
+plugins. This allows plugin users to automate their root credential rotations based on configurable
+schedules/periods via the Rotation Manager. Note: Enterprise only.
+```
+```release-note:change
+secrets/aws: The AWS Secrets engine now persists entries to storage between writes. This enables users
+to not have to pass every required field on each write and to make individual updates as necessary.
+Note: in order to zero out a value that is previously configured, users must now explicitly set the
+field to its zero value on an update.
+```
\ No newline at end of file
diff --git a/changelog/29498.txt b/changelog/29498.txt
new file mode 100644
index 00000000000..b2cad9629a5
--- /dev/null
+++ b/changelog/29498.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui/database: Fixes 'cannot update static username' error when updating static role's rotation period
+```
\ No newline at end of file
diff --git a/changelog/29499.txt b/changelog/29499.txt
new file mode 100644
index 00000000000..500ad0c5d9e
--- /dev/null
+++ b/changelog/29499.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/seal: Azure seals required client_secret, preventing use of managed service identities and user assigned identities.
+```
diff --git a/changelog/29506.txt b/changelog/29506.txt
new file mode 100644
index 00000000000..005a89dd11b
--- /dev/null
+++ b/changelog/29506.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fix bug when if failing to persist the barrier keyring to track encryption counts, the number of outstanding encryptions remains added to the count, overcounting encryptions.
+```
diff --git a/changelog/29512.txt b/changelog/29512.txt
new file mode 100644
index 00000000000..b60481bd9d4
--- /dev/null
+++ b/changelog/29512.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/alicloud: Update plugin to v0.19.0
+```
diff --git a/changelog/29517.txt b/changelog/29517.txt
new file mode 100644
index 00000000000..68c33a5caca
--- /dev/null
+++ b/changelog/29517.txt
@@ -0,0 +1,6 @@
+```release-note:change
+agent/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4.
+```
+```release-note:change
+proxy/config: Configuration values including IPv6 addresses will be automatically translated and displayed conformant to RFC-5952 §4.
+```
diff --git a/changelog/29519.txt b/changelog/29519.txt
new file mode 100644
index 00000000000..974b17668ae
--- /dev/null
+++ b/changelog/29519.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/database: Fix a bug where a global database plugin reload exits if any of the database connections are not available
+```
diff --git a/changelog/29528.txt b/changelog/29528.txt
new file mode 100644
index 00000000000..416945c789d
--- /dev/null
+++ b/changelog/29528.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/cf: Update plugin to v0.20.0
+```
diff --git a/changelog/29535.txt b/changelog/29535.txt
new file mode 100644
index 00000000000..3adc28d5997
--- /dev/null
+++ b/changelog/29535.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**Automated Root Rotation**: A schedule or ttl can be defined for automated rotation of the root credential.
+```
diff --git a/changelog/29537.txt b/changelog/29537.txt
new file mode 100644
index 00000000000..bb57707af6a
--- /dev/null
+++ b/changelog/29537.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+database: Fix a bug where static role passwords are erroneously rotated across backend restarts when using skip import rotation.
+```
diff --git a/changelog/29541.txt b/changelog/29541.txt
new file mode 100644
index 00000000000..1d9750757a6
--- /dev/null
+++ b/changelog/29541.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/terraform: Update plugin to v0.11.0
+```
diff --git a/changelog/29542.txt b/changelog/29542.txt
new file mode 100644
index 00000000000..dde43701b55
--- /dev/null
+++ b/changelog/29542.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/elasticsearch: Update plugin to v0.17.0
+```
diff --git a/changelog/29543.txt b/changelog/29543.txt
new file mode 100644
index 00000000000..7178735f7c1
--- /dev/null
+++ b/changelog/29543.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/couchbase: Update plugin to v0.13.0
+```
diff --git a/changelog/29546.txt b/changelog/29546.txt
new file mode 100644
index 00000000000..2b7c076c1c8
--- /dev/null
+++ b/changelog/29546.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+api/client: Add Cert auth method support. This allows the client to authenticate using a client certificate.
+```
diff --git a/changelog/29551.txt b/changelog/29551.txt
new file mode 100644
index 00000000000..f1da23013f2
--- /dev/null
+++ b/changelog/29551.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.14.5
+```
diff --git a/changelog/29553.txt b/changelog/29553.txt
new file mode 100644
index 00000000000..c9a82b29911
--- /dev/null
+++ b/changelog/29553.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/jwt: Update plugin to v0.23.0
+```
diff --git a/changelog/29554.txt b/changelog/29554.txt
new file mode 100644
index 00000000000..cf1adbf4ed6
--- /dev/null
+++ b/changelog/29554.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/snowflake: Update plugin to v0.13.0
+```
diff --git a/changelog/29557.txt b/changelog/29557.txt
new file mode 100644
index 00000000000..70fa0be32ab
--- /dev/null
+++ b/changelog/29557.txt
@@ -0,0 +1,5 @@
+```release-note:feature
+**Automated Root Rotation**: Adds Automated Root Rotation capabilities to the DB Secrets plugin.
+This allows plugin users to automate their root credential rotations based on configurable
+schedules/periods via the Rotation Manager. Note: Enterprise only.
+```
\ No newline at end of file
diff --git a/changelog/29562.txt b/changelog/29562.txt
new file mode 100644
index 00000000000..80345750ecd
--- /dev/null
+++ b/changelog/29562.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+export API: Normalize the start_date parameter to the start of the month as is done in the sys/counters API to keep the results returned from both of the API's consistent.
+```
\ No newline at end of file
diff --git a/changelog/29583.txt b/changelog/29583.txt
new file mode 100644
index 00000000000..2176938c8c7
--- /dev/null
+++ b/changelog/29583.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/mongodbatlas: Update plugin to v0.14.0
+```
diff --git a/changelog/29584.txt b/changelog/29584.txt
new file mode 100644
index 00000000000..72d8ac47748
--- /dev/null
+++ b/changelog/29584.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/mongodbatlas: Update plugin to v0.14.0
+```
diff --git a/changelog/29588.txt b/changelog/29588.txt
new file mode 100644
index 00000000000..c9952ac7e3f
--- /dev/null
+++ b/changelog/29588.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: MFA methods now display the namespace path instead of the namespace id.
+```
diff --git a/changelog/29591.txt b/changelog/29591.txt
new file mode 100644
index 00000000000..e23ab05ab06
--- /dev/null
+++ b/changelog/29591.txt
@@ -0,0 +1,9 @@
+```release-note:change
+auth/gcp: Update plugin to v0.20.0
+```
+
+```release-note:feature
+**Automated Root Rotation**: Adds Automated Root Rotation capabilities to the GCP Auth plugin.
+This allows plugin users to automate their root credential rotations based on configurable
+schedules/periods via the Rotation Manager. Note: Enterprise only.
+```
diff --git a/changelog/29592.txt b/changelog/29592.txt
new file mode 100644
index 00000000000..07a0b36243d
--- /dev/null
+++ b/changelog/29592.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kubernetes: Update plugin to v0.10.0
+```
diff --git a/changelog/29594.txt b/changelog/29594.txt
new file mode 100644
index 00000000000..2917cd1fe9e
--- /dev/null
+++ b/changelog/29594.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis-elasticache: Update plugin to v0.6.0
+```
diff --git a/changelog/29597.txt b/changelog/29597.txt
new file mode 100644
index 00000000000..b8e388144ac
--- /dev/null
+++ b/changelog/29597.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis: Update plugin to v0.5.0
+```
diff --git a/changelog/29598.txt b/changelog/29598.txt
new file mode 100644
index 00000000000..e5d70b2d2f0
--- /dev/null
+++ b/changelog/29598.txt
@@ -0,0 +1,9 @@
+```release-note:change
+secrets/gcp: Update plugin to v0.21.0
+```
+
+```release-note:feature
+**Automated Root Rotation**: Adds Automated Root Rotation capabilities to the GCP Secrets plugin.
+This allows plugin users to automate their root credential rotations based on configurable
+schedules/periods via the Rotation Manager. Note: Enterprise only.
+```
diff --git a/changelog/29605.txt b/changelog/29605.txt
new file mode 100644
index 00000000000..7ab27da8faf
--- /dev/null
+++ b/changelog/29605.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.15.0
+```
diff --git a/changelog/29606.txt b/changelog/29606.txt
new file mode 100644
index 00000000000..44c138238e8
--- /dev/null
+++ b/changelog/29606.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.20.0
+```
diff --git a/changelog/29612.txt b/changelog/29612.txt
new file mode 100644
index 00000000000..66ab71ab168
--- /dev/null
+++ b/changelog/29612.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcpkms: Update plugin to v0.20.0
+```
diff --git a/changelog/29613.txt b/changelog/29613.txt
new file mode 100644
index 00000000000..fed862730bb
--- /dev/null
+++ b/changelog/29613.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/alicloud: Update plugin to v0.20.0
+```
diff --git a/changelog/29614.txt b/changelog/29614.txt
new file mode 100644
index 00000000000..5d7e228d642
--- /dev/null
+++ b/changelog/29614.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kv: Update plugin to v0.21.0
+```
diff --git a/changelog/29617.txt b/changelog/29617.txt
new file mode 100644
index 00000000000..abed569fa6d
--- /dev/null
+++ b/changelog/29617.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kerberos: Update plugin to v0.14.0
+```
diff --git a/changelog/29618.txt b/changelog/29618.txt
new file mode 100644
index 00000000000..9d09292da40
--- /dev/null
+++ b/changelog/29618.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+events (enterprise): Send events downstream to a performance standby node only when there is a subscriber on the standby node with a filter matching the events.
+```
diff --git a/changelog/29619.txt b/changelog/29619.txt
new file mode 100644
index 00000000000..05f2c42ddfe
--- /dev/null
+++ b/changelog/29619.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kubernetes: Update plugin to v0.21.0
+```
diff --git a/changelog/29620.txt b/changelog/29620.txt
new file mode 100644
index 00000000000..b097f5d9e60
--- /dev/null
+++ b/changelog/29620.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/oci: Update plugin to v0.18.0
+```
diff --git a/changelog/29633.txt b/changelog/29633.txt
new file mode 100644
index 00000000000..9df7a4b970d
--- /dev/null
+++ b/changelog/29633.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui/database: Added input field for setting 'skip_import_rotation' when creating a static role 
+```
diff --git a/changelog/29639.txt b/changelog/29639.txt
new file mode 100644
index 00000000000..07e1a6c6868
--- /dev/null
+++ b/changelog/29639.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to v0.21.0
+```
diff --git a/changelog/29648.txt b/changelog/29648.txt
new file mode 100644
index 00000000000..9b5b655f15c
--- /dev/null
+++ b/changelog/29648.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/ad: Update plugin to v0.20.1
+```
diff --git a/changelog/29653.txt b/changelog/29653.txt
new file mode 100644
index 00000000000..dd343d68052
--- /dev/null
+++ b/changelog/29653.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+api/tokenhelper: Exec token_helper without a shell
+```
diff --git a/changelog/29677.txt b/changelog/29677.txt
new file mode 100644
index 00000000000..61103ff49fb
--- /dev/null
+++ b/changelog/29677.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: adds key value pair string inputs as optional form for wrap tool
+```
diff --git a/changelog/29680.txt b/changelog/29680.txt
new file mode 100644
index 00000000000..7180684e793
--- /dev/null
+++ b/changelog/29680.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+agent: Fixed an issue where giving the agent multiple config files could cause the merged config to be incorrect
+when `template_config` is set in one of the config files.
+```
\ No newline at end of file
diff --git a/changelog/29720.txt b/changelog/29720.txt
new file mode 100644
index 00000000000..9748c332a3c
--- /dev/null
+++ b/changelog/29720.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Use Hds::CodeBlock component to replace readonly JsonEditor instances
+```
\ No newline at end of file
diff --git a/changelog/29727.txt b/changelog/29727.txt
new file mode 100644
index 00000000000..5aa9d1be61d
--- /dev/null
+++ b/changelog/29727.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.15.1
+```
diff --git a/changelog/29728.txt b/changelog/29728.txt
new file mode 100644
index 00000000000..01aba067023
--- /dev/null
+++ b/changelog/29728.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.20.1
+```
diff --git a/changelog/29729.txt b/changelog/29729.txt
new file mode 100644
index 00000000000..89a54449f0b
--- /dev/null
+++ b/changelog/29729.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to v0.21.1
+```
diff --git a/changelog/29736.txt b/changelog/29736.txt
new file mode 100644
index 00000000000..64cd74a59fe
--- /dev/null
+++ b/changelog/29736.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/gcp: Update plugin to v0.20.1
+```
diff --git a/changelog/29747.txt b/changelog/29747.txt
new file mode 100644
index 00000000000..6f454c09352
--- /dev/null
+++ b/changelog/29747.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcp: Update plugin to v0.21.1
+```
diff --git a/changelog/29751.txt b/changelog/29751.txt
new file mode 100644
index 00000000000..fe28c1a10e0
--- /dev/null
+++ b/changelog/29751.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**UI Secrets Engines**: TOTP secrets engine is now supported.
+```
\ No newline at end of file
diff --git a/changelog/29754.txt b/changelog/29754.txt
new file mode 100644
index 00000000000..ad576f4390b
--- /dev/null
+++ b/changelog/29754.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/database: Glimmerizing and adding validations to role create
+```
\ No newline at end of file
diff --git a/changelog/29774.txt b/changelog/29774.txt
new file mode 100644
index 00000000000..0e0b2ad689c
--- /dev/null
+++ b/changelog/29774.txt
@@ -0,0 +1,3 @@
+```release-note:change
+core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address 
+```
\ No newline at end of file
diff --git a/changelog/29775.txt b/changelog/29775.txt
new file mode 100644
index 00000000000..046715ab809
--- /dev/null
+++ b/changelog/29775.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: revert Azure wrapper that introduced a regression in Azure auth for seals.
+```
\ No newline at end of file
diff --git a/changelog/29792.txt b/changelog/29792.txt
new file mode 100644
index 00000000000..f7b5e232a71
--- /dev/null
+++ b/changelog/29792.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fix Azure authentication for seal/managed keys to work for both federated workload identity and managed user identities.  Fixes regression for federated workload identities.
+```
\ No newline at end of file
diff --git a/changelog/29820.txt b/changelog/29820.txt
new file mode 100644
index 00000000000..0c9edb810d4
--- /dev/null
+++ b/changelog/29820.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/database: Adding input field for setting skip static role password rotation for database connection config, updating static role skip field to use toggle button 
+```
\ No newline at end of file
diff --git a/changelog/29834.txt b/changelog/29834.txt
new file mode 100644
index 00000000000..83a5dd3eba7
--- /dev/null
+++ b/changelog/29834.txt
@@ -0,0 +1,3 @@
+```release-note:change
+UI: remove outdated and unneeded js string extensions
+```
diff --git a/changelog/29842.txt b/changelog/29842.txt
new file mode 100644
index 00000000000..2ab011fdd5f
--- /dev/null
+++ b/changelog/29842.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/aws: Add LIST endpoint to the AWS secrets engine static roles.
+```
\ No newline at end of file
diff --git a/changelog/29852.txt b/changelog/29852.txt
new file mode 100644
index 00000000000..c63e21df080
--- /dev/null
+++ b/changelog/29852.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/pki: Fix a bug that prevents enabling automatic tidying of the CMPv2 nonce store.
+```
diff --git a/changelog/29874.txt b/changelog/29874.txt
new file mode 100644
index 00000000000..faa3f65767f
--- /dev/null
+++ b/changelog/29874.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+raft/retry_join: Fix decoding `auto_join` configurations that include escape characters
+```
diff --git a/changelog/29917.txt b/changelog/29917.txt
new file mode 100644
index 00000000000..fd511332807
--- /dev/null
+++ b/changelog/29917.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fix a bug that prevents certain loggers from writing to a log file.
+```
diff --git a/changelog/29922.txt b/changelog/29922.txt
new file mode 100644
index 00000000000..e1997dd36c6
--- /dev/null
+++ b/changelog/29922.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/ldap: Fix a bug that does not properly delete users and groups by first converting their names to lowercase when case senstivity option is off.
+```
\ No newline at end of file
diff --git a/changelog/29970.txt b/changelog/29970.txt
new file mode 100644
index 00000000000..35514df73a0
--- /dev/null
+++ b/changelog/29970.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcp: Update plugin to v0.21.2
+```
diff --git a/changelog/29974.txt b/changelog/29974.txt
new file mode 100644
index 00000000000..313e3c5740a
--- /dev/null
+++ b/changelog/29974.txt
@@ -0,0 +1,3 @@
+```release-note:change
+server: disable_mlock configuration option is now required for integrated storage and no longer has a default. If you are using the default value with integrated storage, you must now explicitly set disable_mlock to true or false or Vault server will fail to start.
+```
diff --git a/changelog/29976.txt b/changelog/29976.txt
new file mode 100644
index 00000000000..d033371914f
--- /dev/null
+++ b/changelog/29976.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+storage/raft: Upgrade hashicorp/raft library to v1.7.3 which includes additional logging on the leader when opening and sending a snapshot to a follower.
+```
diff --git a/changelog/29978.txt b/changelog/29978.txt
new file mode 100644
index 00000000000..03c0d289ef3
--- /dev/null
+++ b/changelog/29978.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+plugins: plugin registration should honor the `plugin_tmpdir` config
+```
\ No newline at end of file
diff --git a/changelog/29982.txt b/changelog/29982.txt
new file mode 100644
index 00000000000..ee4e2f7ef31
--- /dev/null
+++ b/changelog/29982.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/aws: fix a bug where environment and shared credential providers were overriding the WIF configuration
+```
\ No newline at end of file
diff --git a/changelog/29996.txt b/changelog/29996.txt
new file mode 100644
index 00000000000..6ed173c9c49
--- /dev/null
+++ b/changelog/29996.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+aws/secrets: Prevent vault from rejecting secret role configurations where no regions or endpoints are set
+```
+
diff --git a/changelog/30034.txt b/changelog/30034.txt
new file mode 100644
index 00000000000..e24ed26ea49
--- /dev/null
+++ b/changelog/30034.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+secrets/pki: fix a bug where key_usage was ignored when generating root certificates, and signing certain
+intermediate certificates.
+```
\ No newline at end of file
diff --git a/changelog/30037.txt b/changelog/30037.txt
new file mode 100644
index 00000000000..8b503335751
--- /dev/null
+++ b/changelog/30037.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to v0.21.2
+```
diff --git a/changelog/30039.txt b/changelog/30039.txt
new file mode 100644
index 00000000000..1dfc7a2b3ac
--- /dev/null
+++ b/changelog/30039.txt
@@ -0,0 +1,15 @@
+```release-note:bug
+secrets/aws: fix a panic when a performance standby node attempts to write/update config.
+```
+
+```release-note:bug
+auth/aws: fix a panic when a performance standby node attempts to write/update config.
+```
+
+```release-note:bug
+auth/ldap: fix a panic when a performance standby node attempts to write/update config.
+```
+
+```release-note:bug
+secrets/db: fix a panic when a performance standby node attempts to write/update config.
+```
diff --git a/changelog/30052.txt b/changelog/30052.txt
new file mode 100644
index 00000000000..1198380c7b4
--- /dev/null
+++ b/changelog/30052.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.20.2. Login requires `resource_group_name`, `vm_name`, and `vmss_name` to match token claims
+```
\ No newline at end of file
diff --git a/changelog/30055.txt b/changelog/30055.txt
new file mode 100644
index 00000000000..4808afaaabe
--- /dev/null
+++ b/changelog/30055.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/database: Updating toggle buttons for skip_rotation_import to reverse polarity of values that get displayed versus whats sent to api
+```
\ No newline at end of file
diff --git a/changelog/30069.txt b/changelog/30069.txt
new file mode 100644
index 00000000000..1d939ff7308
--- /dev/null
+++ b/changelog/30069.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+identity: reintroduce RPC functionality for group creates, allowing performance standbys to handle external group changes during login and token renewal
+```
\ No newline at end of file
diff --git a/changelog/30071.txt b/changelog/30071.txt
new file mode 100644
index 00000000000..acdf6277a27
--- /dev/null
+++ b/changelog/30071.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+activity: mount_type was added to the API response of sys/internal/counters/activity
+```
diff --git a/changelog/30073.txt b/changelog/30073.txt
new file mode 100644
index 00000000000..174644c079f
--- /dev/null
+++ b/changelog/30073.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+mongodb: fix mongodb connection issue when using TLS client + username/password authentication
+```
\ No newline at end of file
diff --git a/changelog/30079.txt b/changelog/30079.txt
new file mode 100644
index 00000000000..2b3590d391a
--- /dev/null
+++ b/changelog/30079.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.15.2
+```
diff --git a/changelog/30080.txt b/changelog/30080.txt
new file mode 100644
index 00000000000..e1ab14955b3
--- /dev/null
+++ b/changelog/30080.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcp: Update plugin to v0.21.3
+```
diff --git a/changelog/30081.txt b/changelog/30081.txt
new file mode 100644
index 00000000000..dd5821343cf
--- /dev/null
+++ b/changelog/30081.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/gcp: Update plugin to v0.20.2
+```
diff --git a/changelog/30082.txt b/changelog/30082.txt
new file mode 100644
index 00000000000..5d2f3771709
--- /dev/null
+++ b/changelog/30082.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.20.3
+```
diff --git a/changelog/30083.txt b/changelog/30083.txt
new file mode 100644
index 00000000000..035e77d941e
--- /dev/null
+++ b/changelog/30083.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to v0.21.3
+```
diff --git a/changelog/30119.txt b/changelog/30119.txt
new file mode 100644
index 00000000000..259c8414ca1
--- /dev/null
+++ b/changelog/30119.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/database: Adding warning modal pop up when creating a static role that will be rotated immediately
+```
\ No newline at end of file
diff --git a/changelog/30136.txt b/changelog/30136.txt
new file mode 100644
index 00000000000..befe9091cc3
--- /dev/null
+++ b/changelog/30136.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+storage/mysql: Added support for getting mysql backend username and password from the environment variables `VAULT_MYSQL_USERNAME` and `VAULT_MYSQL_PASSWORD`.
+```
\ No newline at end of file
diff --git a/changelog/30164.txt b/changelog/30164.txt
new file mode 100644
index 00000000000..e17cfbdf648
--- /dev/null
+++ b/changelog/30164.txt
@@ -0,0 +1,3 @@
+```release-note:change
+activity: provided value for `end_time` in `sys/internal/counters/activity` is now capped at the end of the last completed month.
+```
\ No newline at end of file
diff --git a/changelog/30168.txt b/changelog/30168.txt
new file mode 100644
index 00000000000..f68c3054e1b
--- /dev/null
+++ b/changelog/30168.txt
@@ -0,0 +1,3 @@
+```release-note:bugfix
+secrets/pki: acme header error response no longer includes key subproblems if no subproblems exist.
+```
diff --git a/changelog/30181.txt b/changelog/30181.txt
new file mode 100644
index 00000000000..56fca339ab1
--- /dev/null
+++ b/changelog/30181.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: remove ember-svg-jar dependency
+```
diff --git a/changelog/30188.txt b/changelog/30188.txt
new file mode 100644
index 00000000000..9664a244d0a
--- /dev/null
+++ b/changelog/30188.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Use the Helios Design System Code Block component for all readonly code editors and use its Code Editor component for all other code editors
+```
\ No newline at end of file
diff --git a/changelog/30214.txt b/changelog/30214.txt
new file mode 100644
index 00000000000..733bd861dcb
--- /dev/null
+++ b/changelog/30214.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/transit: fix a panic when rotating on a managed key returns an error
+```
\ No newline at end of file
diff --git a/changelog/30265.txt b/changelog/30265.txt
new file mode 100644
index 00000000000..fb6d495d0e3
--- /dev/null
+++ b/changelog/30265.txt
@@ -0,0 +1,5 @@
+```release-note:bug
+secrets/openldap: Prevent static role rotation on upgrade when `NextVaultRotation` is nil.
+Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing `NextVaultRotation` value. 
+Now sets it to either `LastVaultRotation + RotationPeriod` or `now + RotationPeriod`.
+```
\ No newline at end of file
diff --git a/changelog/30275.txt b/changelog/30275.txt
new file mode 100644
index 00000000000..5c4f484a4dd
--- /dev/null
+++ b/changelog/30275.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/database: Adding password input field for creating a static role
+```
\ No newline at end of file
diff --git a/changelog/30279.txt b/changelog/30279.txt
new file mode 100644
index 00000000000..1c4601ec4ca
--- /dev/null
+++ b/changelog/30279.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.15.4
+```
diff --git a/changelog/30312.txt b/changelog/30312.txt
new file mode 100644
index 00000000000..fe3b4476798
--- /dev/null
+++ b/changelog/30312.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/aws: fix a case where GovCloud wasn't taken into account; fix a case where the region setting wasn't respected
+```
\ No newline at end of file
diff --git a/changelog/30319.txt b/changelog/30319.txt
new file mode 100644
index 00000000000..6b6a1c403df
--- /dev/null
+++ b/changelog/30319.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki: Add Delta (Freshest) CRL support to AIA information (both mount-level and issuer configured)
+```
diff --git a/changelog/30320.txt b/changelog/30320.txt
new file mode 100644
index 00000000000..3ed6ac40488
--- /dev/null
+++ b/changelog/30320.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+database: Prevent static roles created in versions prior to 1.15.0 from rotating on backend restart.
+```
\ No newline at end of file
diff --git a/changelog/30327.txt b/changelog/30327.txt
new file mode 100644
index 00000000000..800b8527f5d
--- /dev/null
+++ b/changelog/30327.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+database: no longer incorrectly add an "unrecognized parameters" warning for certain SQL database secrets config operations when another warning is returned
+```
diff --git a/changelog/30349.txt b/changelog/30349.txt
new file mode 100644
index 00000000000..fa35126218d
--- /dev/null
+++ b/changelog/30349.txt
@@ -0,0 +1,4 @@
+
+```release-note:improvement
+ui (enterprise): Replace date selector in client count usage page with fixed start and end dates that align with billing periods in order to return more relevant client counting data. 
+```
diff --git a/changelog/30354.txt b/changelog/30354.txt
new file mode 100644
index 00000000000..6d927c93291
--- /dev/null
+++ b/changelog/30354.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core/metrics: added a new telemetry metric, `vault.core.response_status_code`, with two labels, `code`, and `type`, detailing the status codes of all responses to requests that Vault handles.
+```
\ No newline at end of file
diff --git a/changelog/30386.txt b/changelog/30386.txt
new file mode 100644
index 00000000000..ee5d14bb250
--- /dev/null
+++ b/changelog/30386.txt
@@ -0,0 +1,3 @@
+```release-note:deprecation
+core: deprecate duplicate attributes in HCL configuration files and policy definitions
+```
diff --git a/changelog/30390.txt b/changelog/30390.txt
new file mode 100644
index 00000000000..6e6e6a880ca
--- /dev/null
+++ b/changelog/30390.txt
@@ -0,0 +1,4 @@
+```release-note:bug
+identity: Fix non-deterministic merge behavior when two entities have
+conflicting local aliases.
+```
diff --git a/changelog/30425.txt b/changelog/30425.txt
new file mode 100644
index 00000000000..79f6111e372
--- /dev/null
+++ b/changelog/30425.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**UI Telemetry**: add Posthog for UI telemetry tracking on HVD managed clusters
+```
\ No newline at end of file
diff --git a/changelog/30431.txt b/changelog/30431.txt
new file mode 100644
index 00000000000..bda0c891a86
--- /dev/null
+++ b/changelog/30431.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/jwt: Update plugin to v0.23.2
+```
diff --git a/changelog/30488.txt b/changelog/30488.txt
new file mode 100644
index 00000000000..9f8a68fd948
--- /dev/null
+++ b/changelog/30488.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Update date selector in client count usage page to disable current month selection for Vault clusters without a license.
+```
diff --git a/changelog/30490.txt b/changelog/30490.txt
new file mode 100644
index 00000000000..bdc3e006657
--- /dev/null
+++ b/changelog/30490.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**Vault Namespace Picker**: Updating the Vault Namespace Picker to enable search functionality, allow direct navigation to nested namespaces and improve accessibility.
+```
\ No newline at end of file
diff --git a/changelog/30493.txt b/changelog/30493.txt
new file mode 100644
index 00000000000..49b399e9dbe
--- /dev/null
+++ b/changelog/30493.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Replaces all instances of the deprecated event.keyCode with event.key
+```
diff --git a/changelog/30500.txt b/changelog/30500.txt
new file mode 100644
index 00000000000..cfe43594c68
--- /dev/null
+++ b/changelog/30500.txt
@@ -0,0 +1,12 @@
+```release-note:improvement
+ui: Improve accessibility of login form to meet a11y standards
+```
+```release-note:improvement
+ui: Hide "Other" tab when mounts are configured with `listing_visibility="unauth"`; all methods can be accessed via the "Sign in with other methods" link
+```
+```release-note:change
+ui: `/vault/auth?with=` query parameter now exclusively refers to the auth mount path and renders a simplified form
+```
+```release-note:change
+ui: Selecting a different method in the login form no longer updates the `/vault/auth?with=` query parameter
+```
\ No newline at end of file
diff --git a/changelog/30506.txt b/changelog/30506.txt
new file mode 100644
index 00000000000..e724b5aad02
--- /dev/null
+++ b/changelog/30506.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui: Client counting "running total" charts now reflect new clients only
+```
diff --git a/changelog/30543.txt b/changelog/30543.txt
new file mode 100644
index 00000000000..b544616d44d
--- /dev/null
+++ b/changelog/30543.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.20.4
+```
diff --git a/changelog/30561.txt b/changelog/30561.txt
new file mode 100644
index 00000000000..ae6357d20e0
--- /dev/null
+++ b/changelog/30561.txt
@@ -0,0 +1,3 @@
+```release-note:deprecation
+api: Deprecated the `/sys/internal/counters/tokens` endpoint. Attempting to call this endpoint will return a 403 "unsupported path" exception. 
+```
\ No newline at end of file
diff --git a/changelog/30576.txt b/changelog/30576.txt
new file mode 100644
index 00000000000..b59a34cf54c
--- /dev/null
+++ b/changelog/30576.txt
@@ -0,0 +1,3 @@
+```release-note: improvement
+core: Updated code and documentation to support FIPS 140-3 compliant algorithms.
+```
diff --git a/changelog/30583.txt b/changelog/30583.txt
new file mode 100644
index 00000000000..3f8f0b1787c
--- /dev/null
+++ b/changelog/30583.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/cf: Update plugin to v0.20.1
+```
diff --git a/changelog/30592.txt b/changelog/30592.txt
new file mode 100644
index 00000000000..cbe68904686
--- /dev/null
+++ b/changelog/30592.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**Custom login settings**: Adds view to list, read and delete rules defining customizations for the web UI login form
+```
\ No newline at end of file
diff --git a/changelog/30603.txt b/changelog/30603.txt
new file mode 100644
index 00000000000..dfac20bd6a0
--- /dev/null
+++ b/changelog/30603.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: support for X25519MLKEM768 (post quantum key agreement) in the Go TLS stack.
+```
\ No newline at end of file
diff --git a/changelog/30606.txt b/changelog/30606.txt
new file mode 100644
index 00000000000..f8d3e258578
--- /dev/null
+++ b/changelog/30606.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/database: Treat all rotation_schedule values as UTC to ensure consistent behavior.
+```
diff --git a/changelog/30659.txt b/changelog/30659.txt
new file mode 100644
index 00000000000..75cd5283fe7
--- /dev/null
+++ b/changelog/30659.txt
@@ -0,0 +1,4 @@
+```release-note:feature
+**Development Cluster Configuration** (enterprise): Added `development_cluster` as a field to Vault's utilization reports.
+The field is configurable via HCL and indicates whether the cluster is being used in a development environment, defaults to false if not set.
+```
\ No newline at end of file
diff --git a/changelog/30670.txt b/changelog/30670.txt
new file mode 100644
index 00000000000..6235bf9dedb
--- /dev/null
+++ b/changelog/30670.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix broken link to Hashicorp Vault developer site in the Web REPL help.
+```
diff --git a/changelog/30673.txt b/changelog/30673.txt
new file mode 100644
index 00000000000..9fc1085b7fe
--- /dev/null
+++ b/changelog/30673.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+plugins: Support registration of CE plugins with extracted artifact directory.
+```
diff --git a/changelog/30678.txt b/changelog/30678.txt
new file mode 100644
index 00000000000..35763ca4e3d
--- /dev/null
+++ b/changelog/30678.txt
@@ -0,0 +1,5 @@
+```release-note:change
+ui/activity: Replaces mount and namespace attribution charts with a table to allow sorting 
+client count data by `namespace`, `mount_path`, `mount_type` or number of clients for 
+a selected month. 
+```
diff --git a/changelog/30680.txt b/changelog/30680.txt
new file mode 100644
index 00000000000..a6f2af0fd92
--- /dev/null
+++ b/changelog/30680.txt
@@ -0,0 +1,7 @@
+```release-note:improvement
+ui: Enable search for a namespace on the namespace list page.
+```
+
+```release-note:bug
+ui: Fix refresh namespace list after deleting a namespace.
+```
diff --git a/changelog/30681.txt b/changelog/30681.txt
new file mode 100644
index 00000000000..be7dc81839e
--- /dev/null
+++ b/changelog/30681.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+physical/postgres: Adds support to authenticate with the PostgreSQL Backend server with cloud based identities (AWS IAM, Azure MSI and GCP IAM)
+```
diff --git a/changelog/30692.txt b/changelog/30692.txt
new file mode 100644
index 00000000000..09d36ce5693
--- /dev/null
+++ b/changelog/30692.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Add 'Refresh list' button to the namespace list page.
+```
\ No newline at end of file
diff --git a/changelog/30700.txt b/changelog/30700.txt
new file mode 100644
index 00000000000..91f3e925ee0
--- /dev/null
+++ b/changelog/30700.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**Login form customization** (enterprise): Adds support to choose a default and/or backup auth methods for the web UI login form to streamline the web UI login experience.
+```
\ No newline at end of file
diff --git a/changelog/30703.txt b/changelog/30703.txt
new file mode 100644
index 00000000000..d719d7a8c02
--- /dev/null
+++ b/changelog/30703.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**Auto Irrevocable Lease Removal (enterprise)**: Add the Vault Enterprise configuration param, `remove_irrevocable_lease_after`. When set to a non-zero value, this will automatically delete irrevocable leases after the configured duration exceeds the lease's expire time. The minimum duration allowed for this field is two days.
+```
diff --git a/changelog/30725.txt b/changelog/30725.txt
new file mode 100644
index 00000000000..d393d36e1af
--- /dev/null
+++ b/changelog/30725.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+events: Add `vault_index` to an event's metadata if the metadata contains `modified=true`, to support client consistency controls when reading from Vault in response to an event where storage was modified.
+```
diff --git a/changelog/30728.txt b/changelog/30728.txt
new file mode 100644
index 00000000000..fb785a08f41
--- /dev/null
+++ b/changelog/30728.txt
@@ -0,0 +1,3 @@
+```release-note: improvement
+transit: Exclude the partial wrapping key path from the transit/keys LIST operation.
+```
\ No newline at end of file
diff --git a/changelog/30737.txt b/changelog/30737.txt
new file mode 100644
index 00000000000..2ee6cc93226
--- /dev/null
+++ b/changelog/30737.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Automatically refresh namespace list inside the namespace picker after creating or deleting a namespace in the UI.
+```
diff --git a/changelog/30739.txt b/changelog/30739.txt
new file mode 100644
index 00000000000..d20b759ac77
--- /dev/null
+++ b/changelog/30739.txt
@@ -0,0 +1,4 @@
+```release-note:feature
+**Secret Recovery from Snapshot (enterprise)**: Adds a framework to load an integrated storage 
+snapshot into Vault and read, list, and recover KV v1 and cubbyhole secrets from the snapshot.
+```
diff --git a/changelog/30748.txt b/changelog/30748.txt
new file mode 100644
index 00000000000..89bf47ed721
--- /dev/null
+++ b/changelog/30748.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/snowflake: Update plugin to v0.14.0
+```
diff --git a/changelog/30765.txt b/changelog/30765.txt
new file mode 100644
index 00000000000..28976b1dcfc
--- /dev/null
+++ b/changelog/30765.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui: Client count side nav link 'Vault Usage Metrics' renamed to 'Client Usage'
+```
\ No newline at end of file
diff --git a/changelog/30778.txt b/changelog/30778.txt
new file mode 100644
index 00000000000..684a7d95939
--- /dev/null
+++ b/changelog/30778.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui/kmip: Fixes KMIP credentials view and displays `private_key` after generating
+```
\ No newline at end of file
diff --git a/changelog/30785.txt b/changelog/30785.txt
new file mode 100644
index 00000000000..b51eeb3c600
--- /dev/null
+++ b/changelog/30785.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis-elasticache: Update plugin to v0.7.0
+```
diff --git a/changelog/30794.txt b/changelog/30794.txt
new file mode 100644
index 00000000000..5109a56002d
--- /dev/null
+++ b/changelog/30794.txt
@@ -0,0 +1,3 @@
+```release-note:security
+core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes.
+```
\ No newline at end of file
diff --git a/changelog/30796.txt b/changelog/30796.txt
new file mode 100644
index 00000000000..8cbca2a8f0f
--- /dev/null
+++ b/changelog/30796.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/elasticsearch: Update plugin to v0.18.0
+```
diff --git a/changelog/30797.txt b/changelog/30797.txt
new file mode 100644
index 00000000000..50f518c5805
--- /dev/null
+++ b/changelog/30797.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis: Update plugin to v0.6.0
+```
diff --git a/changelog/30809.txt b/changelog/30809.txt
new file mode 100644
index 00000000000..d4f65544720
--- /dev/null
+++ b/changelog/30809.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/alicloud: Update plugin to v0.20.0
+```
diff --git a/changelog/30810.txt b/changelog/30810.txt
new file mode 100644
index 00000000000..b7047f643fd
--- /dev/null
+++ b/changelog/30810.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/alicloud: Update plugin to v0.21.0
+```
diff --git a/changelog/30811.txt b/changelog/30811.txt
new file mode 100644
index 00000000000..8f6b18b5a0e
--- /dev/null
+++ b/changelog/30811.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+plugins: Clarify usage of sha256, command, and version for plugin registration of binary or artifact with API and CLI. Introduce new RegisterPluginDetailed and RegisterPluginWtihContextDetailed functions to API client to propagate response along with error, and mark RegisterPlugin and RegisterPluginWithContext as deprecated.
+```
\ No newline at end of file
diff --git a/changelog/30819.txt b/changelog/30819.txt
new file mode 100644
index 00000000000..ec7c7e9647e
--- /dev/null
+++ b/changelog/30819.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/ad: Update plugin to v0.21.0
+```
diff --git a/changelog/30826.txt b/changelog/30826.txt
new file mode 100644
index 00000000000..c6907b7609b
--- /dev/null
+++ b/changelog/30826.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kv: Update plugin to v0.24.0
+```
diff --git a/changelog/30832.txt b/changelog/30832.txt
new file mode 100644
index 00000000000..061bc0d5356
--- /dev/null
+++ b/changelog/30832.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to v0.22.0
+```
diff --git a/changelog/30835.txt b/changelog/30835.txt
new file mode 100644
index 00000000000..ffbdc6582cc
--- /dev/null
+++ b/changelog/30835.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcpkms: Update plugin to v0.21.0
+```
diff --git a/changelog/30836.txt b/changelog/30836.txt
new file mode 100644
index 00000000000..a5361e2f3cd
--- /dev/null
+++ b/changelog/30836.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/couchbase: Update plugin to v0.14.0
+```
diff --git a/changelog/30838.txt b/changelog/30838.txt
new file mode 100644
index 00000000000..968bbe23f42
--- /dev/null
+++ b/changelog/30838.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Redirect users authenticating with Vault as an OIDC provider to log in again when token expires.
+```
\ No newline at end of file
diff --git a/changelog/30841.txt b/changelog/30841.txt
new file mode 100644
index 00000000000..61f02c09529
--- /dev/null
+++ b/changelog/30841.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/oci: Update plugin to v0.19.0
+```
diff --git a/changelog/30842.txt b/changelog/30842.txt
new file mode 100644
index 00000000000..41b97607c1d
--- /dev/null
+++ b/changelog/30842.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/cf: Update plugin to v0.21.0
+```
diff --git a/changelog/30844.txt b/changelog/30844.txt
new file mode 100644
index 00000000000..1fa85be741a
--- /dev/null
+++ b/changelog/30844.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to v0.16.0
+```
diff --git a/changelog/30845.txt b/changelog/30845.txt
new file mode 100644
index 00000000000..c5bb3bb1389
--- /dev/null
+++ b/changelog/30845.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kerberos: Update plugin to v0.15.0
+```
diff --git a/changelog/30846.txt b/changelog/30846.txt
new file mode 100644
index 00000000000..1ebba97f0aa
--- /dev/null
+++ b/changelog/30846.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcp: Update plugin to v0.22.0
+```
diff --git a/changelog/30849.txt b/changelog/30849.txt
new file mode 100644
index 00000000000..44841cbd5cd
--- /dev/null
+++ b/changelog/30849.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/gcp: Update plugin to v0.21.0
+```
diff --git a/changelog/30852.txt b/changelog/30852.txt
new file mode 100644
index 00000000000..6a8583b35d3
--- /dev/null
+++ b/changelog/30852.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/transit: ensure verify endpoint always returns valid field in batch_results with HMAC
+```
\ No newline at end of file
diff --git a/changelog/30855.txt b/changelog/30855.txt
new file mode 100644
index 00000000000..f5351603212
--- /dev/null
+++ b/changelog/30855.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kubernetes: Update plugin to v0.11.0
+```
diff --git a/changelog/30856.txt b/changelog/30856.txt
new file mode 100644
index 00000000000..0c425625810
--- /dev/null
+++ b/changelog/30856.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/mongodbatlas: Update plugin to v0.15.0
+```
diff --git a/changelog/30860.txt b/changelog/30860.txt
new file mode 100644
index 00000000000..1eb50767bd5
--- /dev/null
+++ b/changelog/30860.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/mongodbatlas: Update plugin to v0.15.0
+```
diff --git a/changelog/30868.txt b/changelog/30868.txt
new file mode 100644
index 00000000000..c9d21ea9f8d
--- /dev/null
+++ b/changelog/30868.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/snowflake: Update plugin to v0.14.1
+```
diff --git a/changelog/30872.txt b/changelog/30872.txt
new file mode 100644
index 00000000000..6726646ed19
--- /dev/null
+++ b/changelog/30872.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.21.0
+```
diff --git a/changelog/30876.txt b/changelog/30876.txt
new file mode 100644
index 00000000000..9ce952dfebf
--- /dev/null
+++ b/changelog/30876.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/jwt: Update plugin to v0.24.1
+```
diff --git a/changelog/30887.txt b/changelog/30887.txt
new file mode 100644
index 00000000000..86209434fa5
--- /dev/null
+++ b/changelog/30887.txt
@@ -0,0 +1,6 @@
+```release-note:change
+api: Update the default API client to check for the `Retry-After` header and, if it exists, wait for the specified duration before retrying the request.
+```
+```release-note:change
+quotas/rate-limit: Round up the `Retry-After` value to the nearest second when calculating the retry delay.
+```
diff --git a/changelog/30890.txt b/changelog/30890.txt
new file mode 100644
index 00000000000..66b87507623
--- /dev/null
+++ b/changelog/30890.txt
@@ -0,0 +1,3 @@
+```release-note:change
+logical/system: add ent stub for plugin catalog handling
+```
diff --git a/changelog/30905.txt b/changelog/30905.txt
new file mode 100644
index 00000000000..ddd6f9c5486
--- /dev/null
+++ b/changelog/30905.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/terraform: Update plugin to v0.12.0
+```
diff --git a/changelog/30910.txt b/changelog/30910.txt
new file mode 100644
index 00000000000..e08d3b40a3a
--- /dev/null
+++ b/changelog/30910.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kubernetes: Update plugin to v0.22.1
+```
diff --git a/changelog/30926.txt b/changelog/30926.txt
new file mode 100644
index 00000000000..7bc93c8caee
--- /dev/null
+++ b/changelog/30926.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Omit automatic version control information of the main module from compiled Vault binaries 
+```
diff --git a/changelog/30960.txt b/changelog/30960.txt
new file mode 100644
index 00000000000..753e400dd75
--- /dev/null
+++ b/changelog/30960.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix initial setting of form toggle inputs for parameters nested within the `config` block
+```
diff --git a/changelog/31001.txt b/changelog/31001.txt
new file mode 100644
index 00000000000..85cf909ebea
--- /dev/null
+++ b/changelog/31001.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/secrets: Display the plugin version on the secret engine list view. Move KV's version to a tooltip that appears when hovering over the engine's name.
+```
\ No newline at end of file
diff --git a/changelog/31010.txt b/changelog/31010.txt
new file mode 100644
index 00000000000..a3b304692af
--- /dev/null
+++ b/changelog/31010.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to v0.21.1
+```
diff --git a/changelog/31022.txt b/changelog/31022.txt
new file mode 100644
index 00000000000..737ce1a0114
--- /dev/null
+++ b/changelog/31022.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core: Improve memory use of path management for namespaces, auth methods, and secrets engines. Now Vault should handle larger numbers of namespaces and multiple instances of the same secrets engine or auth method more efficiently.
+```
diff --git a/changelog/31045.txt b/changelog/31045.txt
new file mode 100644
index 00000000000..e0e70a49bfa
--- /dev/null
+++ b/changelog/31045.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fix string contains check in Identity APIs to be case-insensitive.
+```
\ No newline at end of file
diff --git a/changelog/31053.txt b/changelog/31053.txt
new file mode 100644
index 00000000000..f2cd3a2ffc7
--- /dev/null
+++ b/changelog/31053.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+sdk: add stub code for retrieving rotation schedule information
+```
diff --git a/changelog/31069.txt b/changelog/31069.txt
new file mode 100644
index 00000000000..4aceb520d75
--- /dev/null
+++ b/changelog/31069.txt
@@ -0,0 +1,3 @@
+```release-note:change
+http: Add JSON configurable limits to HTTP handling for JSON payloads: `max_json_depth`, `max_json_string_value_length`, `max_json_object_entry_count`, `max_json_array_element_count`.
+```
\ No newline at end of file
diff --git a/changelog/31094.txt b/changelog/31094.txt
new file mode 100644
index 00000000000..a05e2ce8ff5
--- /dev/null
+++ b/changelog/31094.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Revert camelizing of parameters returned from `sys/internal/ui/mounts` so mount paths match serve value
+```
\ No newline at end of file
diff --git a/changelog/31136.txt b/changelog/31136.txt
new file mode 100644
index 00000000000..0d78bb1b42d
--- /dev/null
+++ b/changelog/31136.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix kv v2 overview page from erroring if a user does not have access to the /subkeys endpoint and the policy check fails.
+```
\ No newline at end of file
diff --git a/changelog/31149.txt b/changelog/31149.txt
new file mode 100644
index 00000000000..69b4f2128fc
--- /dev/null
+++ b/changelog/31149.txt
@@ -0,0 +1,3 @@
+```release-note:change
+activity: Renamed `timestamp` in export API response to `token_creation_time`.
+```
diff --git a/changelog/31150.txt b/changelog/31150.txt
new file mode 100644
index 00000000000..fcdd2fbe684
--- /dev/null
+++ b/changelog/31150.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixes UI login settings list page which was not rendering rules with an underscore in the name.
+```
\ No newline at end of file
diff --git a/changelog/31210.txt b/changelog/31210.txt
new file mode 100644
index 00000000000..3ffa7cd6a65
--- /dev/null
+++ b/changelog/31210.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/cert: test non-CA cert equality on login matching instead of individual fields.
+```
\ No newline at end of file
diff --git a/changelog/31211.txt b/changelog/31211.txt
new file mode 100644
index 00000000000..03d19b01ea1
--- /dev/null
+++ b/changelog/31211.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+audit: Add additional verifications to the target of file audit sinks.
+```
diff --git a/changelog/31215.txt b/changelog/31215.txt
new file mode 100644
index 00000000000..e1d0b07822c
--- /dev/null
+++ b/changelog/31215.txt
@@ -0,0 +1,5 @@
+```release-note:deprecation
+core: disallow usage of duplicate attributes in HCL configuration files and policy definitions, which were already
+deprecated. For now those errors can be suppressed back to warnings by setting the environment variable
+VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES.
+```
\ No newline at end of file
diff --git a/changelog/31223.txt b/changelog/31223.txt
new file mode 100644
index 00000000000..9523fdeac38
--- /dev/null
+++ b/changelog/31223.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+activity (enterprise): Fix `development_cluster` setting being overwritten on performance secondaries upon cluster reload.
+```
\ No newline at end of file
diff --git a/changelog/31232.txt b/changelog/31232.txt
new file mode 100644
index 00000000000..c0bb0168b96
--- /dev/null
+++ b/changelog/31232.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki: Add the digest OID when logging SCEP digest mismatch errors.
+```
diff --git a/changelog/31266.txt b/changelog/31266.txt
new file mode 100644
index 00000000000..c8c768493c0
--- /dev/null
+++ b/changelog/31266.txt
@@ -0,0 +1,7 @@
+```release-note:bug
+plugins: Fix panics that can occur when a plugin audits a request or response before the Vault server has finished unsealing.
+```
+
+```release-note:bug
+kmip (enterprise): Fix a panic that can happen when a KMIP client makes a request before the Vault server has finished unsealing.
+```
\ No newline at end of file
diff --git a/changelog/31274.txt b/changelog/31274.txt
new file mode 100644
index 00000000000..885f6542cee
--- /dev/null
+++ b/changelog/31274.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+gcs: fix failed locking due to updated library error checks
+```
diff --git a/changelog/31276.txt b/changelog/31276.txt
new file mode 100644
index 00000000000..e6a292a7205
--- /dev/null
+++ b/changelog/31276.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix regression in 1.20.0 to properly set namespace context for capabilities checks
+```
diff --git a/changelog/31300.txt b/changelog/31300.txt
new file mode 100644
index 00000000000..531541ace68
--- /dev/null
+++ b/changelog/31300.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Include user's root namespace in the namespace picker if it's a namespace other than the actual root ("")
+```
diff --git a/changelog/31326.txt b/changelog/31326.txt
new file mode 100644
index 00000000000..59720005a00
--- /dev/null
+++ b/changelog/31326.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix selecting multiple namespaces in the namespace picker when the path contains matching nodes
+```
diff --git a/changelog/31331.txt b/changelog/31331.txt
new file mode 100644
index 00000000000..be1e2e447c9
--- /dev/null
+++ b/changelog/31331.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+openapi: Add OpenAPI support for secret recovery operations.
+```
diff --git a/changelog/31352.txt b/changelog/31352.txt
new file mode 100644
index 00000000000..7e6928f1dda
--- /dev/null
+++ b/changelog/31352.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth: update alias lookahead to respect username case for LDAP and username/password
+```
diff --git a/changelog/31363.txt b/changelog/31363.txt
new file mode 100644
index 00000000000..59e1dd94084
--- /dev/null
+++ b/changelog/31363.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/ldap: Introduces an option to connect to an alternative LDAP URL for root credential rotation, in cases where it differs from the configured LDAP URL.
+```
\ No newline at end of file
diff --git a/changelog/31392.txt b/changelog/31392.txt
new file mode 100644
index 00000000000..1702410e5ff
--- /dev/null
+++ b/changelog/31392.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same.
+```
diff --git a/changelog/31393.txt b/changelog/31393.txt
new file mode 100644
index 00000000000..62cee05fd7b
--- /dev/null
+++ b/changelog/31393.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui/client-counts: removes tabs for each client count type and adds split view for counts per type in overview stacked bar chart 
+```
diff --git a/changelog/31401.txt b/changelog/31401.txt
new file mode 100644
index 00000000000..3ae6b45274d
--- /dev/null
+++ b/changelog/31401.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/ldap: add explicit logging to rotations in ldap
+```
\ No newline at end of file
diff --git a/changelog/31402.txt b/changelog/31402.txt
new file mode 100644
index 00000000000..14f9fcfb1e1
--- /dev/null
+++ b/changelog/31402.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/database: log password rotation success (info) and failure (error). Some relevant log lines have been updated to include "path" fields.
+```
diff --git a/changelog/31420.txt b/changelog/31420.txt
new file mode 100644
index 00000000000..d1393433963
--- /dev/null
+++ b/changelog/31420.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/transit: add logging on both success and failure of key rotation
+```
diff --git a/changelog/31421.txt b/changelog/31421.txt
new file mode 100644
index 00000000000..d328bca62ae
--- /dev/null
+++ b/changelog/31421.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+identity/mfa: revert cache entry change from #31217 and document cache entry values
+```
diff --git a/changelog/31422.txt b/changelog/31422.txt
new file mode 100644
index 00000000000..e34df8321a5
--- /dev/null
+++ b/changelog/31422.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) response now includes a new timestamp that denotes the first time the client was used within the specified query period.
+```
\ No newline at end of file
diff --git a/changelog/31438.txt b/changelog/31438.txt
new file mode 100644
index 00000000000..f98b822ce93
--- /dev/null
+++ b/changelog/31438.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load.
+```
diff --git a/changelog/31442.txt b/changelog/31442.txt
new file mode 100644
index 00000000000..4a79f604a77
--- /dev/null
+++ b/changelog/31442.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/database/postgresql: Support for multiline statements in the `rotation_statements` field.
+```
diff --git a/changelog/31443.txt b/changelog/31443.txt
new file mode 100644
index 00000000000..5bcfb33892b
--- /dev/null
+++ b/changelog/31443.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+raft/autopilot: Fixes an issue with enterprise redundancy zones where, if the leader was in a redundancy zone and that leader becomes unavailable, the node would become an unzoned voter. This can artificially inflate the required number of nodes for quorum, leading to a situation where the cluster cannot recover if another leader subsequently becomes unavailable. Vault will now keep an unavailable node in its last known redundancy zone as a non-voter.
+``` 
diff --git a/changelog/31478.txt b/changelog/31478.txt
new file mode 100644
index 00000000000..23f8bbd28a1
--- /dev/null
+++ b/changelog/31478.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix DR secondary view from not loading/transitioning.
+```
diff --git a/changelog/31501.txt b/changelog/31501.txt
new file mode 100644
index 00000000000..90cf7ecf30c
--- /dev/null
+++ b/changelog/31501.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/cert: Support RFC 9440 colon-wrapped Base64 certificates in `x_forwarded_for_client_cert_header`, to fix TLS certificate auth errors with Google Cloud Application Load Balancer.
+```
\ No newline at end of file
diff --git a/changelog/31555.txt b/changelog/31555.txt
new file mode 100644
index 00000000000..e079adcec24
--- /dev/null
+++ b/changelog/31555.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+sys/mounts: enable unsetting allowed_response_headers
+```
\ No newline at end of file
diff --git a/changelog/34699.txt b/changelog/34699.txt
new file mode 100644
index 00000000000..878252ececc
--- /dev/null
+++ b/changelog/34699.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui: Removed `FormError` component (not used)
+```
diff --git a/changelog/9733.txt b/changelog/9733.txt
new file mode 100644
index 00000000000..f345cbd5278
--- /dev/null
+++ b/changelog/9733.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+db/cassandra: Add `disable_host_initial_lookup` option to backend, allowing the disabling of initial host lookup.
+```
diff --git a/changelog/_10062.txt b/changelog/_10062.txt
new file mode 100644
index 00000000000..6e677690c8c
--- /dev/null
+++ b/changelog/_10062.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+ui/activity (enterprise): Add clarifying text to explain the "Initial Usage" column will only have timestamps for clients initially used after upgrading to version 1.21
+```
+```release-note:improvement
+ui/activity (enterprise): Support filtering months dropdown by ISO timestamp or display value.
+```
diff --git a/changelog/_10068.txt b/changelog/_10068.txt
new file mode 100644
index 00000000000..a31b5d799ec
--- /dev/null
+++ b/changelog/_10068.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Added sudo-permissioned `sys/reporting/scan` endpoint which will output a set of files containing information about Vault state to the location specified by the `reporting_scan_directory` config item.
+```
\ No newline at end of file
diff --git a/changelog/_10083.txt b/changelog/_10083.txt
new file mode 100644
index 00000000000..f0bb2a70d3b
--- /dev/null
+++ b/changelog/_10083.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core/metrics: Reading and listing from a snapshot are now tracked via the `vault.route.read-snapshot.{mount_point}` and `vault.route.list-snapshot.{mount_point}` metrics.
+```
\ No newline at end of file
diff --git a/changelog/_10124.txt b/changelog/_10124.txt
new file mode 100644
index 00000000000..ab886475462
--- /dev/null
+++ b/changelog/_10124.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+license utilization reporting (enterprise): Add metrics for the number of issued PKI certificates.
+```
+```release-note:improvement
+sys (enterprise): Add sys/billing/certificates API endpoint to retrieve the number of issued PKI certificates.
+```
diff --git a/changelog/_10199.txt b/changelog/_10199.txt
new file mode 100644
index 00000000000..540563a41f6
--- /dev/null
+++ b/changelog/_10199.txt
@@ -0,0 +1,27 @@
+```release-note:bug
+auth/approle (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+```
+```release-note:bug
+auth/aws (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+```
+```release-note:bug
+auth/github (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+```
+```release-note:bug
+auth/ldap (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+```
+```release-note:bug
+auth/okta (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+```
+```release-note:bug
+auth/radius (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+```
+```release-note:bug
+auth/scep (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+```
+```release-note:bug
+auth/cert (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+```
+```release-note:bug
+auth/userpass (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
+```
diff --git a/changelog/_10227.txt b/changelog/_10227.txt
new file mode 100644
index 00000000000..038d0f594d4
--- /dev/null
+++ b/changelog/_10227.txt
@@ -0,0 +1,3 @@
+```release-note:change
+ui/secrets: Secrets engines url paths renamed from '/secrets' to '/secrets-engines'
+```
\ No newline at end of file
diff --git a/changelog/_10265.txt b/changelog/_10265.txt
new file mode 100644
index 00000000000..55c64340589
--- /dev/null
+++ b/changelog/_10265.txt
@@ -0,0 +1,3 @@
+```release-note:security
+ui: disable scarf analytics for ui builds
+```
\ No newline at end of file
diff --git a/changelog/_8367.txt b/changelog/_8367.txt
new file mode 100644
index 00000000000..2b87ad63c7f
--- /dev/null
+++ b/changelog/_8367.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**AES-CBC in Transit** (Enterprise): Add support for encryption and decryption with AES-CBC in the Transit Secrets Engine.
+```
\ No newline at end of file
diff --git a/changelog/_8461.txt b/changelog/_8461.txt
new file mode 100644
index 00000000000..4d48dadf1ca
--- /dev/null
+++ b/changelog/_8461.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration
+```
\ No newline at end of file
diff --git a/changelog/_8581.txt b/changelog/_8581.txt
new file mode 100644
index 00000000000..b1306514a5f
--- /dev/null
+++ b/changelog/_8581.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/ssh: Add support for recovering the SSH plugin CA from a loaded snapshot (enterprise only).
+```
\ No newline at end of file
diff --git a/changelog/_8640.txt b/changelog/_8640.txt
new file mode 100644
index 00000000000..c4feab7e371
--- /dev/null
+++ b/changelog/_8640.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+Secrets Recovery (enterprise): Support recovering items from a snapshot to a new path in the live cluster. By calling the `vault recover` command with a `-from` flag, users can specify the path of the item in the snapshot.  
+```
\ No newline at end of file
diff --git a/changelog/_8642.txt b/changelog/_8642.txt
new file mode 100644
index 00000000000..78d6a4824a8
--- /dev/null
+++ b/changelog/_8642.txt
@@ -0,0 +1,3 @@
+```release-note:change
+sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible
+```
diff --git a/changelog/_8643.txt b/changelog/_8643.txt
new file mode 100644
index 00000000000..29b63169ea2
--- /dev/null
+++ b/changelog/_8643.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets-sync (enterprise): GCP locational KMS keys are no longer incorrectly removed when the location name is all lowercase.
+```
\ No newline at end of file
diff --git a/changelog/_8651.txt b/changelog/_8651.txt
new file mode 100644
index 00000000000..dc21c1c4480
--- /dev/null
+++ b/changelog/_8651.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+storage/raft (enterprise): Add `autoload_enabled` option to raft automated snapshot configurations. When enabled, this option will automatically load raft snapshots into Vault, which can then be used for recovery operations.
+```
\ No newline at end of file
diff --git a/changelog/_8663.txt b/changelog/_8663.txt
new file mode 100644
index 00000000000..e9edb5d9549
--- /dev/null
+++ b/changelog/_8663.txt
@@ -0,0 +1,9 @@
+```release-note:change
+ui: Remove namespace context filter for activity in client count dashboard
+```
+```release-note:change
+ui: Add client count attribution for the full billing period to the client counts overview table 
+```
+```release-note:improvement
+ui: Add `namespace_path`, `mount_path` and `mount_type` filters to attribution table  
+```
diff --git a/changelog/_8707.txt b/changelog/_8707.txt
new file mode 100644
index 00000000000..7e840f4aed6
--- /dev/null
+++ b/changelog/_8707.txt
@@ -0,0 +1,6 @@
+```release-note:bug
+core/seal: When Seal-HA is enabled, make it an error to persist the barrier
+keyring when not all seals are healthy.  This prevents the possibility of
+failing to unseal when a different subset of seals are healthy than were
+healthy at last write.
+```
diff --git a/changelog/_8725.txt b/changelog/_8725.txt
new file mode 100644
index 00000000000..39e3c0ea9cd
--- /dev/null
+++ b/changelog/_8725.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core/metrics: Add service name prefix for core HA metrics to avoid duplicate, zero-value metrics.
+```
\ No newline at end of file
diff --git a/changelog/_8740.txt b/changelog/_8740.txt
new file mode 100644
index 00000000000..6a550bc58ad
--- /dev/null
+++ b/changelog/_8740.txt
@@ -0,0 +1,6 @@
+```release-note:improvement
+core/snapshot-load (enterprise): Add a `force` query parameter to the `DELETE sys/storage/raft/snapshot-load/{snapshot_id}` endpoint to allow for forced deletion of snapshots. This is useful when the snapshot is in a state that prevents normal deletion, such as being in the process of loading.
+```
+```release-note:improvement
+cli (enterprise): Add a `-force` flag to `vault operator raft snapshot unload` command to force deletion of a loaded snapshot.
+```
diff --git a/changelog/_8800.txt b/changelog/_8800.txt
new file mode 100644
index 00000000000..8c73f338a7f
--- /dev/null
+++ b/changelog/_8800.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki (enterprise): add new batch/certs endpoint to allow multiple certificates to be fetched at once.
+```
\ No newline at end of file
diff --git a/changelog/_8807.txt b/changelog/_8807.txt
new file mode 100644
index 00000000000..5d08248b784
--- /dev/null
+++ b/changelog/_8807.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+api (sys/utilization-report): Added namespace filter and more granularity for secret sync data in the response.
+```
\ No newline at end of file
diff --git a/changelog/_8808.txt b/changelog/_8808.txt
new file mode 100644
index 00000000000..23aee435a6d
--- /dev/null
+++ b/changelog/_8808.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Add new logical client request interfaces for read, write, delete, list operations.
+```
diff --git a/changelog/_8820.txt b/changelog/_8820.txt
new file mode 100644
index 00000000000..c2b50838626
--- /dev/null
+++ b/changelog/_8820.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: update plugin to v0.16.1
+```
diff --git a/changelog/_8832.txt b/changelog/_8832.txt
new file mode 100644
index 00000000000..145c9cf9834
--- /dev/null
+++ b/changelog/_8832.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Enhanced secret engine selection dynamically displays all available plugins from the plugin catalog.
+```
\ No newline at end of file
diff --git a/changelog/_8834.txt b/changelog/_8834.txt
new file mode 100644
index 00000000000..b3a888e45ef
--- /dev/null
+++ b/changelog/_8834.txt
@@ -0,0 +1,3 @@
+```release-note:change
+Secrets Recovery (enterprise): Deprecate the `recover_snapshot_id` query parameter to pass the snapshot ID for recover operations, in favor of a `X-Vault-Recover-Snapshot-Id` header. Vault will still accept the query parameter for backward compatibility. Also support setting the HTTP method to `RECOVER` for recover operations, in addition to `POST` and `PUT`.
+```
diff --git a/changelog/_8880.txt b/changelog/_8880.txt
new file mode 100644
index 00000000000..de06f46e3c5
--- /dev/null
+++ b/changelog/_8880.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**UI Client List Explorer (Enterprise)**: Adds ability to view and filter client IDs and metadata by namespace, mount path, or mount type for a billing period.
+```
diff --git a/changelog/_8884.txt b/changelog/_8884.txt
new file mode 100644
index 00000000000..cdb3cb248f5
--- /dev/null
+++ b/changelog/_8884.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+raft (enterprise): auto-join will now work in regions that do not support dual-stack
+```
\ No newline at end of file
diff --git a/changelog/_8899.txt b/changelog/_8899.txt
new file mode 100644
index 00000000000..ddede1e0f6f
--- /dev/null
+++ b/changelog/_8899.txt
@@ -0,0 +1,3 @@
+```release-note:security
+core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3.
+```
diff --git a/changelog/_8922.txt b/changelog/_8922.txt
new file mode 100644
index 00000000000..a6616333209
--- /dev/null
+++ b/changelog/_8922.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/database (enterprise): Add support for reading, listing, and recovering static roles from a loaded snapshot. Also add support for reading static credentials from a loaded snapshot.
+```
diff --git a/changelog/_9040.txt b/changelog/_9040.txt
new file mode 100644
index 00000000000..a4569e7e0aa
--- /dev/null
+++ b/changelog/_9040.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+**ui/activity**: Updates running total stats to be displayed via a donut chart.
+```
+
diff --git a/changelog/_9056.txt b/changelog/_9056.txt
new file mode 100644
index 00000000000..7416e7b7cb3
--- /dev/null
+++ b/changelog/_9056.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+logging: Fixed an issue where the `log_requests_level` configuration was not respected on a SIGHUP reload when set to "off" or removed from the config file.
+```
diff --git a/changelog/_9060.txt b/changelog/_9060.txt
new file mode 100644
index 00000000000..5427226a953
--- /dev/null
+++ b/changelog/_9060.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix page loading error when users navigate away from identity entities and groups list views.
+```
diff --git a/changelog/_9104.txt b/changelog/_9104.txt
new file mode 100644
index 00000000000..2917215fb3e
--- /dev/null
+++ b/changelog/_9104.txt
@@ -0,0 +1,3 @@
+```release-note:security
+core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27.
+```
diff --git a/changelog/_9106.txt b/changelog/_9106.txt
new file mode 100644
index 00000000000..93abe4a3bb7
--- /dev/null
+++ b/changelog/_9106.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/transit: Fix error when using ed25519 keys that were imported with derivation enabled
+```
diff --git a/changelog/_9107.txt b/changelog/_9107.txt
new file mode 100644
index 00000000000..03b33ecc128
--- /dev/null
+++ b/changelog/_9107.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+openapi: Add openapi response definitions to `sys/internal/counters/activity/*` endpoints.
+```
\ No newline at end of file
diff --git a/changelog/_9148.txt b/changelog/_9148.txt
new file mode 100644
index 00000000000..24bb9715fb0
--- /dev/null
+++ b/changelog/_9148.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/activity: Adds filtering by month to the Client Count dashboard to link client counts to specific client IDs from the export API
+```
\ No newline at end of file
diff --git a/changelog/_9165.txt b/changelog/_9165.txt
new file mode 100644
index 00000000000..53548c31f44
--- /dev/null
+++ b/changelog/_9165.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+proxy/cache (enterprise): Vault Proxy will now use vault_index on events to be able to update cached static secrets from performance secondaries without needing to be forwarded. This will take precedence over attempting to forward the request to the primary.
+```
diff --git a/changelog/_9201.txt b/changelog/_9201.txt
new file mode 100644
index 00000000000..76968474f58
--- /dev/null
+++ b/changelog/_9201.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Role based quotas now work for cert auth
+```
diff --git a/changelog/_9225.txt b/changelog/_9225.txt
new file mode 100644
index 00000000000..40353ecff94
--- /dev/null
+++ b/changelog/_9225.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**UI Secrets Recovery (Enterprise)**: Allows end users to recover single KV v1 secrets, Cubbyhole secrets, or Database static roles from a loaded snapshot if the secrets were changed or deleted in error. Automatic snapshot configurations can now automatically load the snapshot to Vault itself, making it available for recovery. Snapshot management permissions are separated from recovery permissions so that recovery operations can be delegated but controlled.
+```
diff --git a/changelog/_9306.txt b/changelog/_9306.txt
new file mode 100644
index 00000000000..042af463d13
--- /dev/null
+++ b/changelog/_9306.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/pki (enterprise): add integrations/guardium configuration endpoint.
+```
\ No newline at end of file
diff --git a/changelog/_9309.txt b/changelog/_9309.txt
new file mode 100644
index 00000000000..d1f36e897f8
--- /dev/null
+++ b/changelog/_9309.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**UI: Secret Engine Tune Support**: Add support for updating secret engine mount configuration via the Tune endpoint
+```
\ No newline at end of file
diff --git a/changelog/_9330.txt b/changelog/_9330.txt
new file mode 100644
index 00000000000..caa9c06a1bf
--- /dev/null
+++ b/changelog/_9330.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Format multiline API error messages to render as bulleted lists.
+```
\ No newline at end of file
diff --git a/changelog/_9331.txt b/changelog/_9331.txt
new file mode 100644
index 00000000000..1306d24efac
--- /dev/null
+++ b/changelog/_9331.txt
@@ -0,0 +1,3 @@
+```release-note:change
+core: Updates post-install script to print updated license information
+```
\ No newline at end of file
diff --git a/changelog/_9336.txt b/changelog/_9336.txt
new file mode 100644
index 00000000000..2233328a686
--- /dev/null
+++ b/changelog/_9336.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed issue where under certain circumstances the rotation manager would spawn goroutines indefinitely.
+```
\ No newline at end of file
diff --git a/changelog/_9342.txt b/changelog/_9342.txt
new file mode 100644
index 00000000000..bcfc1d49a71
--- /dev/null
+++ b/changelog/_9342.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/auth: the role field on the OIDC login form now auto-fills from the `role` URL query string parameter
+```
diff --git a/changelog/_9343.txt b/changelog/_9343.txt
new file mode 100644
index 00000000000..add051a31e5
--- /dev/null
+++ b/changelog/_9343.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+auth/cert: Add allowed_organizations support
+```
\ No newline at end of file
diff --git a/changelog/_9366.txt b/changelog/_9366.txt
new file mode 100644
index 00000000000..e00e2164b0d
--- /dev/null
+++ b/changelog/_9366.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+core (enterprise): add support for new pki-only license feature
+```
diff --git a/changelog/_9394.txt b/changelog/_9394.txt
new file mode 100644
index 00000000000..5f24f425674
--- /dev/null
+++ b/changelog/_9394.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/auth: the role field on the SAML login form now auto-fills from the `role` URL query string parameter
+```
diff --git a/changelog/_9417.txt b/changelog/_9417.txt
new file mode 100644
index 00000000000..438b31a157b
--- /dev/null
+++ b/changelog/_9417.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/snowflake: Update plugin to [v0.14.2](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.14.2)
+```
diff --git a/changelog/_9432.txt b/changelog/_9432.txt
new file mode 100644
index 00000000000..5f3a57cf4d2
--- /dev/null
+++ b/changelog/_9432.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+secrets/database: Add root rotation support for Snowflake database secrets engines using key-pair credentials.
+```
diff --git a/changelog/_9449.txt b/changelog/_9449.txt
new file mode 100644
index 00000000000..b53f7ec3b50
--- /dev/null
+++ b/changelog/_9449.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: resultant-acl now merges segment-wildcard (`+`) paths with existing prefix rules in `glob_paths`, so clients receive a complete view of glob-style permissions. This unblocks UI sidebar navigation checks and namespace access banners.
+```
diff --git a/changelog/_9466.txt b/changelog/_9466.txt
new file mode 100644
index 00000000000..1ecd0cfdec6
--- /dev/null
+++ b/changelog/_9466.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core (enterprise): Avoid duplicate seal rewrapping, and ensure that cluster secondaries rewrap after a seal migration.
+```
diff --git a/changelog/_9478.txt b/changelog/_9478.txt
new file mode 100644
index 00000000000..30b726996f9
--- /dev/null
+++ b/changelog/_9478.txt
@@ -0,0 +1,3 @@
+```release-note:change
+policies: change list comparison to allowed_parameters and denied_parameters from "exact match" to "contains all"
+```
\ No newline at end of file
diff --git a/changelog/_9522.txt b/changelog/_9522.txt
new file mode 100644
index 00000000000..6a75d786c9e
--- /dev/null
+++ b/changelog/_9522.txt
@@ -0,0 +1,2 @@
+```release-note:bug
+ui: Fixes permissions for hiding and showing sidebar navigation items for policies that include special characters: `+`, `*`
\ No newline at end of file
diff --git a/changelog/_9523.txt b/changelog/_9523.txt
new file mode 100644
index 00000000000..91d3f876863
--- /dev/null
+++ b/changelog/_9523.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+Raft: Auto-join will now allow you to enforce IPv4 on networks that allow IPv6 and dual-stack enablement, which is on by default in certain regions.
+```
\ No newline at end of file
diff --git a/changelog/_9577.txt b/changelog/_9577.txt
new file mode 100644
index 00000000000..5b03ca9b57b
--- /dev/null
+++ b/changelog/_9577.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/secrets: Updated filters on secret engines list to sort by path, engine type and version
+```
diff --git a/changelog/_9648.txt b/changelog/_9648.txt
new file mode 100644
index 00000000000..9167c6a4157
--- /dev/null
+++ b/changelog/_9648.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/alicloud: Update plugin to [v0.21.1](https://github.com/hashicorp/vault-plugin-auth-alicloud/releases/tag/v0.21.1)
+```
diff --git a/changelog/_9660.txt b/changelog/_9660.txt
new file mode 100644
index 00000000000..22a6d877e43
--- /dev/null
+++ b/changelog/_9660.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+secrets/database: respect the escaping/disable_escaping state when using self-managed static roles
+```
diff --git a/changelog/_9688.txt b/changelog/_9688.txt
new file mode 100644
index 00000000000..0fd4b0afcbc
--- /dev/null
+++ b/changelog/_9688.txt
@@ -0,0 +1,3 @@
+```release-note:change
+http: Evaluate rate limit quotas before checking JSON limits during request handling. 
+```
\ No newline at end of file
diff --git a/changelog/_9756.txt b/changelog/_9756.txt
new file mode 100644
index 00000000000..6f89d33c72e
--- /dev/null
+++ b/changelog/_9756.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis: Update plugin to [v0.6.1](https://github.com/hashicorp/vault-plugin-database-redis/releases/tag/v0.6.1)
+```
diff --git a/changelog/_9763.txt b/changelog/_9763.txt
new file mode 100644
index 00000000000..fdefafb3691
--- /dev/null
+++ b/changelog/_9763.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/alicloud: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-alicloud/releases/tag/v0.22.0)
+```
diff --git a/changelog/_9770.txt b/changelog/_9770.txt
new file mode 100644
index 00000000000..76ab6d204c2
--- /dev/null
+++ b/changelog/_9770.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/azure: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-azure/releases/tag/v0.22.0)
+```
diff --git a/changelog/_9788.txt b/changelog/_9788.txt
new file mode 100644
index 00000000000..9d7d88c32b9
--- /dev/null
+++ b/changelog/_9788.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/elasticsearch: Update plugin to [v0.19.0](https://github.com/hashicorp/vault-plugin-database-elasticsearch/releases/tag/v0.19.0)
+```
diff --git a/changelog/_9789.txt b/changelog/_9789.txt
new file mode 100644
index 00000000000..62a0ed13bf9
--- /dev/null
+++ b/changelog/_9789.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis-elasticache: Update plugin to [v0.8.0](https://github.com/hashicorp/vault-plugin-database-redis-elasticache/releases/tag/v0.8.0)
+```
diff --git a/changelog/_9791.txt b/changelog/_9791.txt
new file mode 100644
index 00000000000..2587c06d425
--- /dev/null
+++ b/changelog/_9791.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/couchbase: Update plugin to [v0.15.0](https://github.com/hashicorp/vault-plugin-database-couchbase/releases/tag/v0.15.0)
+```
diff --git a/changelog/_9797.txt b/changelog/_9797.txt
new file mode 100644
index 00000000000..8b95c201a60
--- /dev/null
+++ b/changelog/_9797.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/cf: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-cf/releases/tag/v0.22.0)
+```
diff --git a/changelog/_9805.txt b/changelog/_9805.txt
new file mode 100644
index 00000000000..acac5e76dac
--- /dev/null
+++ b/changelog/_9805.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kv: Update plugin to [v0.25.0](https://github.com/hashicorp/vault-plugin-secrets-kv/releases/tag/v0.25.0)
+```
diff --git a/changelog/_9808.txt b/changelog/_9808.txt
new file mode 100644
index 00000000000..81f2a605226
--- /dev/null
+++ b/changelog/_9808.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/kubernetes: Update plugin to [v0.12.0](https://github.com/hashicorp/vault-plugin-secrets-kubernetes/releases/tag/v0.12.0)
+```
diff --git a/changelog/_9809.txt b/changelog/_9809.txt
new file mode 100644
index 00000000000..510974875ad
--- /dev/null
+++ b/changelog/_9809.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/terraform: Update plugin to [v0.13.0](https://github.com/hashicorp/vault-plugin-secrets-terraform/releases/tag/v0.13.0)
+```
diff --git a/changelog/_9810.txt b/changelog/_9810.txt
new file mode 100644
index 00000000000..454ccf69ff4
--- /dev/null
+++ b/changelog/_9810.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/gcp: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-gcp/releases/tag/v0.22.0)
+```
diff --git a/changelog/_9813.txt b/changelog/_9813.txt
new file mode 100644
index 00000000000..af3ad070c38
--- /dev/null
+++ b/changelog/_9813.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/alicloud: Update plugin to [v0.21.0](https://github.com/hashicorp/vault-plugin-secrets-alicloud/releases/tag/v0.21.0)
+```
diff --git a/changelog/_9816.txt b/changelog/_9816.txt
new file mode 100644
index 00000000000..b64f6b0295d
--- /dev/null
+++ b/changelog/_9816.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/mongodbatlas: Update plugin to [v0.16.0](https://github.com/hashicorp/vault-plugin-database-mongodbatlas/releases/tag/v0.16.0)
+```
diff --git a/changelog/_9817.txt b/changelog/_9817.txt
new file mode 100644
index 00000000000..5fd2c8e90ba
--- /dev/null
+++ b/changelog/_9817.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/mongodbatlas: Update plugin to [v0.16.0](https://github.com/hashicorp/vault-plugin-secrets-mongodbatlas/releases/tag/v0.16.0)
+```
diff --git a/changelog/_9821.txt b/changelog/_9821.txt
new file mode 100644
index 00000000000..d2336747777
--- /dev/null
+++ b/changelog/_9821.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/jwt: Update plugin to [v0.25.0](https://github.com/hashicorp/vault-plugin-auth-jwt/releases/tag/v0.25.0)
+```
diff --git a/changelog/_9822.txt b/changelog/_9822.txt
new file mode 100644
index 00000000000..39cad15c2fa
--- /dev/null
+++ b/changelog/_9822.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kerberos: Update plugin to [v0.16.0](https://github.com/hashicorp/vault-plugin-auth-kerberos/releases/tag/v0.16.0)
+```
diff --git a/changelog/_9824.txt b/changelog/_9824.txt
new file mode 100644
index 00000000000..2c41bb6f61b
--- /dev/null
+++ b/changelog/_9824.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/oci: Update plugin to [v0.20.0](https://github.com/hashicorp/vault-plugin-auth-oci/releases/tag/v0.20.0)
+```
diff --git a/changelog/_9833.txt b/changelog/_9833.txt
new file mode 100644
index 00000000000..06fb4844c08
--- /dev/null
+++ b/changelog/_9833.txt
@@ -0,0 +1,4 @@
+```release-note:improvement
+activity (enterprise): Add a cumulative namespace client count API at `sys/internal/counters/activity/cumulative`.
+For each namespace in the response it returns the sum of its own client counts and that of all its child namespaces.
+```
\ No newline at end of file
diff --git a/changelog/_9834.txt b/changelog/_9834.txt
new file mode 100644
index 00000000000..6aaed09f46a
--- /dev/null
+++ b/changelog/_9834.txt
@@ -0,0 +1,3 @@
+```release-note:change
+auth/kubernetes: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-auth-kubernetes/releases/tag/v0.23.0)
+```
diff --git a/changelog/_9838.txt b/changelog/_9838.txt
new file mode 100644
index 00000000000..2a741157a72
--- /dev/null
+++ b/changelog/_9838.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-secrets-azure/releases/tag/v0.23.0)
+```
diff --git a/changelog/_9840.txt b/changelog/_9840.txt
new file mode 100644
index 00000000000..4fd99da6745
--- /dev/null
+++ b/changelog/_9840.txt
@@ -0,0 +1,3 @@
+```release-note:feature
+**Login MFA TOTP Self-Enrollment (Enterprise)**: Simplify creation of login MFA TOTP credentials for users, allowing them to self-enroll MFA TOTP using a QR code (TOTP secret) generated during login. The new functionality is configurable on the TOTP login MFA method configuration screen and via the `enable_self_enrollment` parameter in the API.
+```
diff --git a/changelog/_9848.txt b/changelog/_9848.txt
new file mode 100644
index 00000000000..fee5bb07c5f
--- /dev/null
+++ b/changelog/_9848.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/snowflake: Update plugin to [v0.15.0](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.15.0)
+```
diff --git a/changelog/_9868.txt b/changelog/_9868.txt
new file mode 100644
index 00000000000..1656ab11112
--- /dev/null
+++ b/changelog/_9868.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcpkms: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-secrets-gcpkms/releases/tag/v0.22.0)
+```
diff --git a/changelog/_9870.txt b/changelog/_9870.txt
new file mode 100644
index 00000000000..a5c7a583285
--- /dev/null
+++ b/changelog/_9870.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth: fixed panic when suppling integer as a lease_id in renewal.
+```
\ No newline at end of file
diff --git a/changelog/_9888.txt b/changelog/_9888.txt
new file mode 100644
index 00000000000..0f12ac0370e
--- /dev/null
+++ b/changelog/_9888.txt
@@ -0,0 +1,3 @@
+```release-note:change
+database/redis: Update plugin to [v0.7.0](https://github.com/hashicorp/vault-plugin-database-redis/releases/tag/v0.7.0)
+```
diff --git a/changelog/_9890.txt b/changelog/_9890.txt
new file mode 100644
index 00000000000..f1fc8ae349c
--- /dev/null
+++ b/changelog/_9890.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+ui/activity (enterprise): Reduce requests to the activity export API by only fetching new data when the dashboard initially loads or is manually refreshed.
+```
\ No newline at end of file
diff --git a/changelog/_9936.txt b/changelog/_9936.txt
new file mode 100644
index 00000000000..23ac486839d
--- /dev/null
+++ b/changelog/_9936.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/openldap: Update plugin to [v0.17.0](https://github.com/hashicorp/vault-plugin-secrets-openldap/releases/tag/v0.17.0)
+```
diff --git a/changelog/_9942.txt b/changelog/_9942.txt
new file mode 100644
index 00000000000..c25eaa1c4c3
--- /dev/null
+++ b/changelog/_9942.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: interpret all new rotation manager rotation_schedules as UTC to avoid inadvertent use of tz-local
+```
diff --git a/changelog/_9944.txt b/changelog/_9944.txt
new file mode 100644
index 00000000000..77e7da97b74
--- /dev/null
+++ b/changelog/_9944.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+ui (enterprise): Fixes login form so input renders correctly when token is a preferred login method for a namespace.
+```
diff --git a/changelog/_9946.txt b/changelog/_9946.txt
new file mode 100644
index 00000000000..d873b83eb27
--- /dev/null
+++ b/changelog/_9946.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/gcp: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-secrets-gcp/releases/tag/v0.23.0)
+```
diff --git a/changelog/_9979.txt b/changelog/_9979.txt
new file mode 100644
index 00000000000..343a7023fe6
--- /dev/null
+++ b/changelog/_9979.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/spiffe: Address an issue updating a role with overlapping workload_id_pattern values it previously contained.
+```
diff --git a/changelog/_9981.txt b/changelog/_9981.txt
new file mode 100644
index 00000000000..906bf9b9de8
--- /dev/null
+++ b/changelog/_9981.txt
@@ -0,0 +1,3 @@
+```release-note:security
+auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
+```
diff --git a/changelog/_9990.txt b/changelog/_9990.txt
new file mode 100644
index 00000000000..8c97a0f0209
--- /dev/null
+++ b/changelog/_9990.txt
@@ -0,0 +1,3 @@
+```release-note:change
+secrets/azure: Update azure enterprise secrets plugin to include static roles.
+```
diff --git a/changelog/_go-ver-1170.txt b/changelog/_go-ver-1170.txt
index dac8f3a0cb9..e06311e84e5 100644
--- a/changelog/_go-ver-1170.txt
+++ b/changelog/_go-ver-1170.txt
@@ -1,3 +1,3 @@
 ```release-note:change
-core: Bump Go version to 1.21.7.
+core: Bump Go version to 1.22.2
 ```
diff --git a/changelog/_go-ver-1180.txt b/changelog/_go-ver-1180.txt
new file mode 100644
index 00000000000..45b3d2ef5f4
--- /dev/null
+++ b/changelog/_go-ver-1180.txt
@@ -0,0 +1,3 @@
+```release-note:change
+core: Bump Go version to 1.22.7
+```
diff --git a/changelog/_go-ver-1190.txt b/changelog/_go-ver-1190.txt
new file mode 100644
index 00000000000..f006ea847af
--- /dev/null
+++ b/changelog/_go-ver-1190.txt
@@ -0,0 +1,3 @@
+```release-note:change
+core: Bump Go version to 1.23.3.
+```
diff --git a/changelog/_go-ver-1200.txt b/changelog/_go-ver-1200.txt
new file mode 100644
index 00000000000..e30a0634c90
--- /dev/null
+++ b/changelog/_go-ver-1200.txt
@@ -0,0 +1,3 @@
+```release-note:change
+core: Bump Go version to 1.24.2.
+```
diff --git a/changelog/_go-ver-1210.txt b/changelog/_go-ver-1210.txt
new file mode 100644
index 00000000000..cdcdfec50d8
--- /dev/null
+++ b/changelog/_go-ver-1210.txt
@@ -0,0 +1,3 @@
+```release-note:change
+core: Bump Go version to 1.25.2
+```
diff --git a/changelog/note-ce.tmpl b/changelog/note-ce.tmpl
new file mode 100644
index 00000000000..7239145a41b
--- /dev/null
+++ b/changelog/note-ce.tmpl
@@ -0,0 +1,3 @@
+{{- define "note" -}}
+{{.Body}}{{if not (stringHasPrefix .Issue "_")}} [[GH-{{- .Issue -}}](https://github.com/hashicorp/vault/pull/{{- .Issue -}})]{{else}}{{if .Hash }} ([{{- slice .Hash 0 8 -}}](https://github.com/hashicorp/vault/commit/{{- .Hash -}})){{end}}{{end}}
+{{- end -}}
diff --git a/changelog/note-ent.tmpl b/changelog/note-ent.tmpl
new file mode 100644
index 00000000000..7d3e7e87121
--- /dev/null
+++ b/changelog/note-ent.tmpl
@@ -0,0 +1,3 @@
+{{- define "note" -}}
+{{.Body}}
+{{- end -}}
diff --git a/changelog/note.tmpl b/changelog/note.tmpl
index 022546f2753..dad09f23b71 100644
--- a/changelog/note.tmpl
+++ b/changelog/note.tmpl
@@ -1,3 +1,3 @@
 {{- define "note" -}}
-{{.Body}}{{if not (stringHasPrefix .Issue "_")}} [[GH-{{- .Issue -}}](https://github.com/hashicorp/vault/pull/{{- .Issue -}})]{{end}}
+{{.Body}}{{if not (stringHasPrefix .Issue "_")}} [[GH-{{- .Issue -}}](https://github.com/hashicorp/vault/pull/{{- .Issue -}})]{{else}}{{if .Hash }} ([{{- slice .Hash 0 8 -}}](https://github.com/hashicorp/vault/commits/{{- .Hash -}})){{end}}{{end}}
 {{- end -}}
diff --git a/command/agent.go b/command/agent.go
index 3c1643856f1..86e4f810a12 100644
--- a/command/agent.go
+++ b/command/agent.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -13,9 +13,11 @@ import (
 	"net"
 	"net/http"
 	"os"
+	"path/filepath"
 	"sort"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	systemd "github.com/coreos/go-systemd/daemon"
@@ -73,6 +75,7 @@ type AgentCommand struct {
 
 	ShutdownCh chan struct{}
 	SighupCh   chan struct{}
+	SigUSR2Ch  chan struct{}
 
 	tlsReloadFuncsLock sync.RWMutex
 	tlsReloadFuncs     []reloadutil.ReloadFunc
@@ -83,8 +86,7 @@ type AgentCommand struct {
 
 	// Telemetry object
 	metricsHelper *metricsutil.MetricsHelper
-
-	cleanupGuard sync.Once
+	cleanupGuard  sync.Once
 
 	startedCh  chan struct{} // for tests
 	reloadedCh chan struct{} // for tests
@@ -328,6 +330,9 @@ func (c *AgentCommand) Run(args []string) int {
 			client.SetNamespace(config.AutoAuth.Method.Namespace)
 		}
 		templateNamespace = client.Namespace()
+		if !namespaceSetByEnvironmentVariable && config.Vault != nil && config.Vault.Namespace != "" {
+			templateNamespace = config.Vault.Namespace
+		}
 
 		sinkClient, err := client.CloneWithHeaders()
 		if err != nil {
@@ -541,6 +546,83 @@ func (c *AgentCommand) Run(args []string) int {
 		}
 	}
 
+	// Create the AuthHandler, SinkServer, TemplateServer, and ExecServer now so that we can pass AuthHandler struct
+	// values into the Proxy http.Handler. We will wait to actually start these servers
+	// once we have configured the handlers for each listener below
+	authInProgress := &atomic.Bool{}
+	invalidTokenErrCh := make(chan error)
+	var ah *auth.AuthHandler
+	var ss *sink.SinkServer
+	var ts *template.Server
+	var es *exec.Server
+	if method != nil {
+		enableTemplateTokenCh := len(config.Templates) > 0
+		enableEnvTemplateTokenCh := len(config.EnvTemplates) > 0
+
+		// Auth Handler is going to set its own retry values, so we want to
+		// work on a copy of the client to not affect other subsystems.
+		ahClient, err := c.client.CloneWithHeaders()
+		if err != nil {
+			c.UI.Error(fmt.Sprintf("Error cloning client for auth handler: %v", err))
+			return 1
+		}
+
+		// Override the set namespace with the auto-auth specific namespace
+		if !namespaceSetByEnvironmentVariable && config.AutoAuth.Method.Namespace != "" {
+			ahClient.SetNamespace(config.AutoAuth.Method.Namespace)
+		}
+
+		if config.DisableIdleConnsAutoAuth {
+			ahClient.SetMaxIdleConnections(-1)
+		}
+
+		if config.DisableKeepAlivesAutoAuth {
+			ahClient.SetDisableKeepAlives(true)
+		}
+
+		ah = auth.NewAuthHandler(&auth.AuthHandlerConfig{
+			Logger:                       c.logger.Named("auth.handler"),
+			Client:                       ahClient,
+			WrapTTL:                      config.AutoAuth.Method.WrapTTL,
+			MinBackoff:                   config.AutoAuth.Method.MinBackoff,
+			MaxBackoff:                   config.AutoAuth.Method.MaxBackoff,
+			EnableReauthOnNewCredentials: config.AutoAuth.EnableReauthOnNewCredentials,
+			EnableTemplateTokenCh:        enableTemplateTokenCh,
+			EnableExecTokenCh:            enableEnvTemplateTokenCh,
+			Token:                        previousToken,
+			ExitOnError:                  config.AutoAuth.Method.ExitOnError,
+			UserAgent:                    useragent.AgentAutoAuthString(),
+			MetricsSignifier:             "agent",
+		})
+
+		ss = sink.NewSinkServer(&sink.SinkServerConfig{
+			Logger:        c.logger.Named("sink.server"),
+			Client:        ahClient,
+			ExitAfterAuth: config.ExitAfterAuth,
+		})
+
+		ts = template.NewServer(&template.ServerConfig{
+			Logger:        c.logger.Named("template.server"),
+			LogLevel:      c.logger.GetLevel(),
+			LogWriter:     c.logWriter,
+			AgentConfig:   c.config,
+			Namespace:     templateNamespace,
+			ExitAfterAuth: config.ExitAfterAuth,
+		})
+
+		es, err = exec.NewServer(&exec.ServerConfig{
+			AgentConfig: c.config,
+			Namespace:   templateNamespace,
+			Logger:      c.logger.Named("exec.server"),
+			LogLevel:    c.logger.GetLevel(),
+			LogWriter:   c.logWriter,
+		})
+		if err != nil {
+			c.logger.Error("could not create exec server", "error", err)
+			return 1
+		}
+	}
+
 	var listeners []net.Listener
 
 	// If there are templates, add an in-process listener
@@ -565,6 +647,7 @@ func (c *AgentCommand) Run(args []string) int {
 			lnBundle, err := cache.StartListener(lnConfig)
 			if err != nil {
 				c.UI.Error(fmt.Sprintf("Error starting listener: %v", err))
+				c.tlsReloadFuncsLock.Unlock()
 				return 1
 			}
 
@@ -577,31 +660,31 @@ func (c *AgentCommand) Run(args []string) int {
 
 		listeners = append(listeners, ln)
 
-		proxyVaultToken := true
-		var inmemSink sink.Sink
+		apiProxyLogger.Debug("auto-auth token is allowed to be used; configuring inmem sink")
+		inmemSink, err := inmem.New(&sink.SinkConfig{
+			Logger: apiProxyLogger,
+		}, leaseCache)
+		if err != nil {
+			c.UI.Error(fmt.Sprintf("Error creating inmem sink for cache: %v", err))
+			c.tlsReloadFuncsLock.Unlock()
+			return 1
+		}
+		sinks = append(sinks, &sink.SinkConfig{
+			Logger: apiProxyLogger,
+			Sink:   inmemSink,
+		})
+		useAutoAuthToken := false
+		forceAutoAuthToken := false
 		if config.APIProxy != nil {
-			if config.APIProxy.UseAutoAuthToken {
-				apiProxyLogger.Debug("auto-auth token is allowed to be used; configuring inmem sink")
-				inmemSink, err = inmem.New(&sink.SinkConfig{
-					Logger: apiProxyLogger,
-				}, leaseCache)
-				if err != nil {
-					c.UI.Error(fmt.Sprintf("Error creating inmem sink for cache: %v", err))
-					return 1
-				}
-				sinks = append(sinks, &sink.SinkConfig{
-					Logger: apiProxyLogger,
-					Sink:   inmemSink,
-				})
-			}
-			proxyVaultToken = !config.APIProxy.ForceAutoAuthToken
+			useAutoAuthToken = config.APIProxy.UseAutoAuthToken
+			forceAutoAuthToken = config.APIProxy.ForceAutoAuthToken
 		}
 
 		var muxHandler http.Handler
 		if leaseCache != nil {
-			muxHandler = cache.ProxyHandler(ctx, apiProxyLogger, leaseCache, inmemSink, proxyVaultToken)
+			muxHandler = cache.ProxyHandler(ctx, apiProxyLogger, leaseCache, inmemSink, forceAutoAuthToken, useAutoAuthToken, authInProgress, invalidTokenErrCh)
 		} else {
-			muxHandler = cache.ProxyHandler(ctx, apiProxyLogger, apiProxy, inmemSink, proxyVaultToken)
+			muxHandler = cache.ProxyHandler(ctx, apiProxyLogger, apiProxy, inmemSink, forceAutoAuthToken, useAutoAuthToken, authInProgress, invalidTokenErrCh)
 		}
 
 		// Parse 'require_request_header' listener config option, and wrap
@@ -677,6 +760,16 @@ func (c *AgentCommand) Run(args []string) int {
 				case c.reloadedCh <- struct{}{}:
 				default:
 				}
+			case <-c.SigUSR2Ch:
+				pprofPath := filepath.Join(os.TempDir(), "vault-agent-pprof")
+				cpuProfileDuration := time.Second * 1
+				err := WritePprofToFile(pprofPath, cpuProfileDuration)
+				if err != nil {
+					c.logger.Error(err.Error())
+					continue
+				}
+
+				c.logger.Info(fmt.Sprintf("Wrote pprof files to: %s", pprofPath))
 			case <-ctx.Done():
 				return nil
 			}
@@ -707,71 +800,6 @@ func (c *AgentCommand) Run(args []string) int {
 
 	// Start auto-auth and sink servers
 	if method != nil {
-		enableTemplateTokenCh := len(config.Templates) > 0
-		enableEnvTemplateTokenCh := len(config.EnvTemplates) > 0
-
-		// Auth Handler is going to set its own retry values, so we want to
-		// work on a copy of the client to not affect other subsystems.
-		ahClient, err := c.client.CloneWithHeaders()
-		if err != nil {
-			c.UI.Error(fmt.Sprintf("Error cloning client for auth handler: %v", err))
-			return 1
-		}
-
-		// Override the set namespace with the auto-auth specific namespace
-		if !namespaceSetByEnvironmentVariable && config.AutoAuth.Method.Namespace != "" {
-			ahClient.SetNamespace(config.AutoAuth.Method.Namespace)
-		}
-
-		if config.DisableIdleConnsAutoAuth {
-			ahClient.SetMaxIdleConnections(-1)
-		}
-
-		if config.DisableKeepAlivesAutoAuth {
-			ahClient.SetDisableKeepAlives(true)
-		}
-
-		ah := auth.NewAuthHandler(&auth.AuthHandlerConfig{
-			Logger:                       c.logger.Named("auth.handler"),
-			Client:                       ahClient,
-			WrapTTL:                      config.AutoAuth.Method.WrapTTL,
-			MinBackoff:                   config.AutoAuth.Method.MinBackoff,
-			MaxBackoff:                   config.AutoAuth.Method.MaxBackoff,
-			EnableReauthOnNewCredentials: config.AutoAuth.EnableReauthOnNewCredentials,
-			EnableTemplateTokenCh:        enableTemplateTokenCh,
-			EnableExecTokenCh:            enableEnvTemplateTokenCh,
-			Token:                        previousToken,
-			ExitOnError:                  config.AutoAuth.Method.ExitOnError,
-			UserAgent:                    useragent.AgentAutoAuthString(),
-			MetricsSignifier:             "agent",
-		})
-
-		ss := sink.NewSinkServer(&sink.SinkServerConfig{
-			Logger:        c.logger.Named("sink.server"),
-			Client:        ahClient,
-			ExitAfterAuth: config.ExitAfterAuth,
-		})
-
-		ts := template.NewServer(&template.ServerConfig{
-			Logger:        c.logger.Named("template.server"),
-			LogLevel:      c.logger.GetLevel(),
-			LogWriter:     c.logWriter,
-			AgentConfig:   c.config,
-			Namespace:     templateNamespace,
-			ExitAfterAuth: config.ExitAfterAuth,
-		})
-
-		es, err := exec.NewServer(&exec.ServerConfig{
-			AgentConfig: c.config,
-			Namespace:   templateNamespace,
-			Logger:      c.logger.Named("exec.server"),
-			LogLevel:    c.logger.GetLevel(),
-			LogWriter:   c.logWriter,
-		})
-		if err != nil {
-			c.logger.Error("could not create exec server", "error", err)
-			return 1
-		}
 
 		g.Add(func() error {
 			return ah.Run(ctx, method)
@@ -785,7 +813,7 @@ func (c *AgentCommand) Run(args []string) int {
 		})
 
 		g.Add(func() error {
-			err := ss.Run(ctx, ah.OutputCh, sinks)
+			err := ss.Run(ctx, ah.OutputCh, sinks, ah.AuthInProgress)
 			c.logger.Info("sinks finished, exiting")
 
 			// Start goroutine to drain from ah.OutputCh from this point onward
@@ -816,7 +844,7 @@ func (c *AgentCommand) Run(args []string) int {
 		})
 
 		g.Add(func() error {
-			return ts.Run(ctx, ah.TemplateTokenCh, config.Templates)
+			return ts.Run(ctx, ah.TemplateTokenCh, config.Templates, ah.AuthInProgress, ah.InvalidToken)
 		}, func(error) {
 			// Let the lease cache know this is a shutdown; no need to evict
 			// everything
@@ -911,10 +939,11 @@ func (c *AgentCommand) applyConfigOverrides(f *FlagSets, config *agentConfig.Con
 	})
 
 	c.setStringFlag(f, config.Vault.Address, &StringVar{
-		Name:    flagNameAddress,
-		Target:  &c.flagAddress,
-		Default: "https://127.0.0.1:8200",
-		EnvVar:  api.EnvVaultAddress,
+		Name:        flagNameAddress,
+		Target:      &c.flagAddress,
+		Default:     "https://127.0.0.1:8200",
+		EnvVar:      api.EnvVaultAddress,
+		Normalizers: []func(string) string{configutil.NormalizeAddr},
 	})
 	config.Vault.Address = c.flagAddress
 	c.setStringFlag(f, config.Vault.CACert, &StringVar{
@@ -1003,13 +1032,13 @@ func (c *AgentCommand) setStringFlag(f *FlagSets, configVal string, fVar *String
 		// Don't do anything as the flag is already set from the command line
 	case flagEnvSet:
 		// Use value from env var
-		*fVar.Target = flagEnvValue
+		fVar.SetTarget(flagEnvValue)
 	case configVal != "":
 		// Use value from config
-		*fVar.Target = configVal
+		fVar.SetTarget(configVal)
 	default:
 		// Use the default value
-		*fVar.Target = fVar.Default
+		fVar.SetTarget(fVar.Default)
 	}
 }
 
@@ -1182,12 +1211,17 @@ func (c *AgentCommand) loadConfig(paths []string) (*agentConfig.Config, error) {
 	cfg := agentConfig.NewConfig()
 
 	for _, configPath := range paths {
-		configFromPath, err := agentConfig.LoadConfig(configPath)
+		// TODO (HCL_DUP_KEYS_DEPRECATION): go back to agentConfig.LoadConfig and remove duplicate when deprecation is done
+		configFromPath, duplicate, err := agentConfig.LoadConfigCheckDuplicates(configPath)
 		if err != nil {
 			errs = multierror.Append(errs, fmt.Errorf("error loading configuration from %s: %w", configPath, err))
 		} else {
 			cfg = cfg.Merge(configFromPath)
 		}
+		if duplicate {
+			c.UI.Warn(fmt.Sprintf(
+				"WARNING: Duplicate keys found in the Vault agent configuration file %q, duplicate keys in HCL files are deprecated and will be forbidden in a future release.", configPath))
+		}
 	}
 
 	if errs != nil {
diff --git a/command/agent/agent_auto_auth_self_heal_test.go b/command/agent/agent_auto_auth_self_heal_test.go
new file mode 100644
index 00000000000..04762c5fd66
--- /dev/null
+++ b/command/agent/agent_auto_auth_self_heal_test.go
@@ -0,0 +1,413 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package agent
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	ctconfig "github.com/hashicorp/consul-template/config"
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/api"
+	agentConfig "github.com/hashicorp/vault/command/agent/config"
+	"github.com/hashicorp/vault/command/agent/template"
+	"github.com/hashicorp/vault/command/agentproxyshared/auth"
+	tokenfile "github.com/hashicorp/vault/command/agentproxyshared/auth/token-file"
+	"github.com/hashicorp/vault/command/agentproxyshared/sink"
+	"github.com/hashicorp/vault/command/agentproxyshared/sink/file"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
+	"github.com/hashicorp/vault/helper/testhelpers/minimal"
+	"github.com/hashicorp/vault/sdk/helper/pointerutil"
+	"github.com/stretchr/testify/require"
+)
+
+// TestAutoAuthSelfHealing_TokenFileAuth_SinkOutput tests that
+// if the token is revoked, Auto Auth is re-triggered and a valid new token
+// is written to a sink, and the template is correctly rendered with the new token
+func TestAutoAuthSelfHealing_TokenFileAuth_SinkOutput(t *testing.T) {
+	// Unset the environment variable so that agent picks up the right test cluster address
+	t.Setenv(api.EnvVaultAddress, "")
+
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	logger := corehelpers.NewTestLogger(t)
+	serverClient := cluster.Cores[0].Client
+
+	// Create token
+	secret, err := serverClient.Auth().Token().Create(&api.TokenCreateRequest{})
+	require.NoError(t, err)
+	require.NotNil(t, secret)
+	require.NotNil(t, secret.Auth)
+	require.NotEmpty(t, secret.Auth.ClientToken)
+	token := secret.Auth.ClientToken
+
+	// Write token to the auto-auth token file
+	pathVaultToken := makeTempFile(t, "token-file", token)
+
+	// Give us some leeway of 3 errors 1 from each of: auth handler, sink server template server.
+	errCh := make(chan error, 3)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+
+	// Create auth handler
+	am, err := tokenfile.NewTokenFileAuthMethod(&auth.AuthConfig{
+		Logger: logger.Named("auth.method"),
+		Config: map[string]interface{}{
+			"token_file_path": pathVaultToken,
+		},
+	})
+	require.NoError(t, err)
+
+	// Create sink file
+	pathSinkFile := makeTempFile(t, "sink-file", "")
+	require.NoError(t, err)
+
+	ahConfig := &auth.AuthHandlerConfig{
+		Logger:                       logger.Named("auth.handler"),
+		Client:                       serverClient,
+		EnableExecTokenCh:            true,
+		EnableTemplateTokenCh:        true,
+		EnableReauthOnNewCredentials: true,
+		ExitOnError:                  false,
+	}
+	ah := auth.NewAuthHandler(ahConfig)
+	go func() {
+		errCh <- ah.Run(ctx, am)
+	}()
+
+	config := &sink.SinkConfig{
+		Logger: logger.Named("sink.file"),
+		Config: map[string]interface{}{
+			"path": pathSinkFile,
+		},
+	}
+	fs, err := file.NewFileSink(config)
+	require.NoError(t, err)
+	config.Sink = fs
+
+	ss := sink.NewSinkServer(&sink.SinkServerConfig{
+		Logger: logger.Named("sink.server"),
+		Client: serverClient,
+	})
+	go func() {
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
+	}()
+
+	// Create template server
+	sc := &template.ServerConfig{
+		Logger: logger.Named("template.server"),
+		AgentConfig: &agentConfig.Config{
+			Vault: &agentConfig.Vault{
+				Address:       serverClient.Address(),
+				TLSSkipVerify: true,
+			},
+			TemplateConfig: &agentConfig.TemplateConfig{
+				StaticSecretRenderInt: 1 * time.Second,
+			},
+			AutoAuth: &agentConfig.AutoAuth{
+				Sinks: []*agentConfig.Sink{
+					{
+						Type: "file",
+						Config: map[string]interface{}{
+							"path": pathSinkFile,
+						},
+					},
+				},
+			},
+			ExitAfterAuth: false,
+		},
+		LogLevel:      hclog.Trace,
+		LogWriter:     hclog.DefaultOutput,
+		ExitAfterAuth: false,
+	}
+
+	pathTemplateOutput := makeTempFile(t, "template-output", "")
+	require.NoError(t, err)
+	templateTest := &ctconfig.TemplateConfig{
+		Contents:    pointerutil.StringPtr(`{{ with secret "auth/token/lookup-self" }}{{ .Data.id }}{{ end }}`),
+		Destination: pointerutil.StringPtr(pathTemplateOutput),
+	}
+	templatesToRender := []*ctconfig.TemplateConfig{templateTest}
+
+	server := template.NewServer(sc)
+	go func() {
+		errCh <- server.Run(ctx, ah.TemplateTokenCh, templatesToRender, ah.AuthInProgress, ah.InvalidToken)
+	}()
+
+	// Send token to template channel, and wait for the template to render
+	ah.TemplateTokenCh <- token
+	err = waitForFileContent(t, pathTemplateOutput, token)
+
+	// Revoke Token
+	err = serverClient.Auth().Token().RevokeOrphan(token)
+	require.NoError(t, err)
+
+	// Create new token
+	tokenSecret, err := serverClient.Auth().Token().Create(&api.TokenCreateRequest{})
+	require.NoError(t, err)
+	require.NotNil(t, tokenSecret)
+	require.NotNil(t, tokenSecret.Auth)
+	require.NotEmpty(t, tokenSecret.Auth.ClientToken)
+	newToken := tokenSecret.Auth.ClientToken
+
+	// Write token to file
+	err = os.WriteFile(pathVaultToken, []byte(newToken), 0o600)
+	require.NoError(t, err)
+
+	// Wait for auto-auth to complete and verify token has been written to the sink
+	// and the template has been re-rendered
+	err = waitForFileContent(t, pathSinkFile, newToken)
+	require.NoError(t, err)
+
+	err = waitForFileContent(t, pathTemplateOutput, newToken)
+	require.NoError(t, err)
+
+	// Calling cancel will stop the 'Run' funcs we started in Goroutines, we should
+	// then check that there were no errors in our channel.
+	cancel()
+	wrapUpTimeout := 5 * time.Second
+	for {
+		select {
+		case <-time.After(wrapUpTimeout):
+			t.Fatal("test timed out")
+		case err := <-errCh:
+			require.NoError(t, err)
+		case <-ctx.Done():
+			// We can finish the test ourselves
+			return
+		}
+	}
+}
+
+// Test_NoAutoAuthSelfHealing_BadPolicy tests that auto auth
+// is not re-triggered if a token with incorrect policy access
+// is used to render a template
+func Test_NoAutoAuthSelfHealing_BadPolicy(t *testing.T) {
+	// Unset the environment variable so that agent picks up the right test cluster address
+	t.Setenv(api.EnvVaultAddress, "")
+
+	policyName := "kv-access"
+
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	logger := corehelpers.NewTestLogger(t)
+	serverClient := cluster.Cores[0].Client
+
+	// Write a policy with correct access to the secrets
+	err := serverClient.Sys().PutPolicy(policyName, `
+path "/kv/*" {
+	capabilities = ["create", "read", "update", "delete", "list"]
+}
+path "/secret/*" {
+	capabilities = ["create", "read", "update", "delete", "list"]
+}`)
+	require.NoError(t, err)
+
+	// Create a token without enough policy access to the kv secrets
+	secret, err := serverClient.Auth().Token().Create(&api.TokenCreateRequest{
+		Policies: []string{"default"},
+	})
+	require.NoError(t, err)
+	require.NotNil(t, secret)
+	require.NotNil(t, secret.Auth)
+	require.NotEmpty(t, secret.Auth.ClientToken)
+	require.Len(t, secret.Auth.Policies, 1)
+	require.Contains(t, secret.Auth.Policies, "default")
+	token := secret.Auth.ClientToken
+
+	// Write token to vault-token file
+	pathVaultToken := makeTempFile(t, "vault-token", token)
+
+	// Give us some leeway of 3 errors 1 from each of: auth handler, sink server template server.
+	errCh := make(chan error, 3)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+
+	// Create auth handler
+	am, err := tokenfile.NewTokenFileAuthMethod(&auth.AuthConfig{
+		Logger: logger.Named("auth.method"),
+		Config: map[string]interface{}{
+			"token_file_path": pathVaultToken,
+		},
+	})
+	require.NoError(t, err)
+
+	ahConfig := &auth.AuthHandlerConfig{
+		Logger:                       logger.Named("auth.handler"),
+		Client:                       serverClient,
+		EnableExecTokenCh:            true,
+		EnableReauthOnNewCredentials: true,
+		ExitOnError:                  false,
+	}
+	ah := auth.NewAuthHandler(ahConfig)
+	go func() {
+		errCh <- ah.Run(ctx, am)
+	}()
+
+	// Create sink file
+	pathSinkFile := makeTempFile(t, "sink-file", "")
+
+	config := &sink.SinkConfig{
+		Logger: logger.Named("sink.file"),
+		Config: map[string]interface{}{
+			"path": pathSinkFile,
+		},
+	}
+	fs, err := file.NewFileSink(config)
+	require.NoError(t, err)
+	config.Sink = fs
+
+	ss := sink.NewSinkServer(&sink.SinkServerConfig{
+		Logger: logger.Named("sink.server"),
+		Client: serverClient,
+	})
+	go func() {
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
+	}()
+
+	// Create template server
+	sc := template.ServerConfig{
+		Logger: logger.Named("template.server"),
+		AgentConfig: &agentConfig.Config{
+			Vault: &agentConfig.Vault{
+				Address:       serverClient.Address(),
+				TLSSkipVerify: true,
+			},
+			TemplateConfig: &agentConfig.TemplateConfig{
+				StaticSecretRenderInt: 1 * time.Second,
+			},
+			// Need to create at least one sink output so that it does not exit after rendering
+			AutoAuth: &agentConfig.AutoAuth{
+				Sinks: []*agentConfig.Sink{
+					{
+						Type: "file",
+						Config: map[string]interface{}{
+							"path": pathSinkFile,
+						},
+					},
+				},
+			},
+			ExitAfterAuth: false,
+		},
+		LogLevel:      hclog.Trace,
+		LogWriter:     hclog.DefaultOutput,
+		ExitAfterAuth: false,
+	}
+
+	pathTemplateDestination := makeTempFile(t, "kv-data", "")
+	templateTest := &ctconfig.TemplateConfig{
+		Contents:    pointerutil.StringPtr(`"{{ with secret "secret/data/otherapp" }}{{ .Data.data.username }}{{ end }}"`),
+		Destination: pointerutil.StringPtr(pathTemplateDestination),
+	}
+	templatesToRender := []*ctconfig.TemplateConfig{templateTest}
+
+	server := template.NewServer(&sc)
+	go func() {
+		errCh <- server.Run(ctx, ah.TemplateTokenCh, templatesToRender, ah.AuthInProgress, ah.InvalidToken)
+	}()
+
+	// Send token to the template channel
+	ah.TemplateTokenCh <- token
+
+	// Create new token with the correct policy access
+	tokenSecret, err := serverClient.Auth().Token().Create(&api.TokenCreateRequest{
+		Policies: []string{policyName},
+	})
+	require.NoError(t, err)
+	require.NotNil(t, tokenSecret)
+	require.NotNil(t, tokenSecret.Auth)
+	require.NotEmpty(t, tokenSecret.Auth.ClientToken)
+	require.Len(t, tokenSecret.Auth.Policies, 2)
+	require.Contains(t, tokenSecret.Auth.Policies, "default")
+	require.Contains(t, tokenSecret.Auth.Policies, policyName)
+	newToken := tokenSecret.Auth.ClientToken
+
+	// Write new token to token file (where Agent would re-auto-auth from if
+	// it were triggered)
+	err = os.WriteFile(pathVaultToken, []byte(newToken), 0o600)
+	require.NoError(t, err)
+
+	// Wait for any potential *incorrect* re-triggers of auto auth
+	time.Sleep(time.Second * 3)
+
+	// Auto auth should not have been re-triggered because of just a permission denied error
+	// Verify that the new token has NOT been written to the token sink
+	tokenInSink, err := os.ReadFile(pathSinkFile)
+	require.NoError(t, err)
+	require.Equal(t, token, string(tokenInSink))
+
+	// Validate that the template still hasn't been rendered.
+	templateContent, err := os.ReadFile(pathTemplateDestination)
+	require.NoError(t, err)
+	require.Equal(t, "", string(templateContent))
+
+	cancel()
+	wrapUpTimeout := 5 * time.Second
+	for {
+		select {
+		case <-time.After(wrapUpTimeout):
+			t.Fatal("test timed out")
+		case err := <-errCh:
+			require.NoError(t, err)
+		case <-ctx.Done():
+			// We can finish the test ourselves
+			return
+		}
+	}
+}
+
+// waitForFileContent waits for the file at filePath to exist and contain fileContent
+// or it will return in an error. Waits for five seconds, with 100ms intervals.
+// Returns nil if content became the same, or non-nil if it didn't.
+func waitForFileContent(t *testing.T, filePath, expectedContent string) error {
+	t.Helper()
+
+	var err error
+	tick := time.Tick(100 * time.Millisecond)
+	timeout := time.After(5 * time.Second)
+	// We need to wait for the files to be updated...
+	for {
+		select {
+		case <-timeout:
+			return fmt.Errorf("timed out waiting for file content, last error: %w", err)
+		case <-tick:
+		}
+
+		content, err := os.ReadFile(filePath)
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				continue
+			}
+			return err
+		}
+
+		stringContent := string(content)
+		if stringContent != expectedContent {
+			err = fmt.Errorf("content not yet the same, expectedContent=%s, content=%s", expectedContent, stringContent)
+			continue
+		}
+
+		return nil
+	}
+}
+
+// makeTempFile creates a temp file with the specified name, populates it with the
+// supplied contents and closes it. The path to the file is returned, also the file
+// will be automatically removed when the test which created it, finishes.
+func makeTempFile(t *testing.T, name, contents string) string {
+	t.Helper()
+
+	f, err := os.Create(filepath.Join(t.TempDir(), name))
+	require.NoError(t, err)
+	path := f.Name()
+
+	_, err = f.WriteString(contents)
+	require.NoError(t, err)
+
+	err = f.Close()
+	require.NoError(t, err)
+
+	return path
+}
diff --git a/command/agent/alicloud_end_to_end_test.go b/command/agent/alicloud_end_to_end_test.go
index 1337bfb8a86..dc37a6a8ed0 100644
--- a/command/agent/alicloud_end_to_end_test.go
+++ b/command/agent/alicloud_end_to_end_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
@@ -15,7 +15,7 @@ import (
 	"github.com/aliyun/alibaba-cloud-sdk-go/sdk/auth/credentials"
 	"github.com/aliyun/alibaba-cloud-sdk-go/sdk/auth/credentials/providers"
 	"github.com/aliyun/alibaba-cloud-sdk-go/services/sts"
-	uuid "github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/go-uuid"
 	vaultalicloud "github.com/hashicorp/vault-plugin-auth-alicloud"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/command/agentproxyshared/auth"
@@ -147,7 +147,7 @@ func TestAliCloudEndToEnd(t *testing.T) {
 		Client: client,
 	})
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
diff --git a/command/agent/approle_end_to_end_test.go b/command/agent/approle_end_to_end_test.go
index 60004986534..9ced7a47dea 100644
--- a/command/agent/approle_end_to_end_test.go
+++ b/command/agent/approle_end_to_end_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
@@ -256,7 +256,7 @@ func testAppRoleEndToEnd(t *testing.T, removeSecretIDFile bool, bindSecretID boo
 	})
 
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
@@ -639,7 +639,7 @@ func testAppRoleWithWrapping(t *testing.T, bindSecretID bool, secretIDLess bool,
 		Client: client,
 	})
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 
 	defer func() {
diff --git a/command/agent/auto_auth_preload_token_end_to_end_test.go b/command/agent/auto_auth_preload_token_end_to_end_test.go
index b566d7e7db2..bd443bedab1 100644
--- a/command/agent/auto_auth_preload_token_end_to_end_test.go
+++ b/command/agent/auto_auth_preload_token_end_to_end_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/api"
 	credAppRole "github.com/hashicorp/vault/builtin/credential/approle"
 	"github.com/hashicorp/vault/command/agentproxyshared/auth"
@@ -184,7 +184,7 @@ func TestTokenPreload_UsingAutoAuth(t *testing.T) {
 	}()
 
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
diff --git a/command/agent/aws_end_to_end_test.go b/command/agent/aws_end_to_end_test.go
index 25d8cbd697b..b6d453cbddb 100644
--- a/command/agent/aws_end_to_end_test.go
+++ b/command/agent/aws_end_to_end_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
@@ -14,8 +14,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/sts"
-	hclog "github.com/hashicorp/go-hclog"
-	uuid "github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/api"
 	vaultaws "github.com/hashicorp/vault/builtin/credential/aws"
 	"github.com/hashicorp/vault/command/agentproxyshared/auth"
@@ -163,7 +163,7 @@ func TestAWSEndToEnd(t *testing.T) {
 		Client: client,
 	})
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
diff --git a/command/agent/cache_end_to_end_test.go b/command/agent/cache_end_to_end_test.go
index 555d3f2879b..637c0ab4a01 100644
--- a/command/agent/cache_end_to_end_test.go
+++ b/command/agent/cache_end_to_end_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
@@ -12,13 +12,13 @@ import (
 	"testing"
 	"time"
 
-	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-hclog"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/api"
 	credAppRole "github.com/hashicorp/vault/builtin/credential/approle"
 	"github.com/hashicorp/vault/command/agentproxyshared/auth"
 	agentapprole "github.com/hashicorp/vault/command/agentproxyshared/auth/approle"
-	cache "github.com/hashicorp/vault/command/agentproxyshared/cache"
+	"github.com/hashicorp/vault/command/agentproxyshared/cache"
 	"github.com/hashicorp/vault/command/agentproxyshared/sink"
 	"github.com/hashicorp/vault/command/agentproxyshared/sink/file"
 	"github.com/hashicorp/vault/command/agentproxyshared/sink/inmem"
@@ -241,7 +241,7 @@ func TestCache_UsingAutoAuthToken(t *testing.T) {
 	inmemSinkConfig.Sink = inmemSink
 
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config, inmemSinkConfig})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config, inmemSinkConfig}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
@@ -318,8 +318,8 @@ func TestCache_UsingAutoAuthToken(t *testing.T) {
 	mux := http.NewServeMux()
 	mux.Handle(consts.AgentPathCacheClear, leaseCache.HandleCacheClear(ctx))
 
-	// Passing a non-nil inmemsink tells the agent to use the auto-auth token
-	mux.Handle("/", cache.ProxyHandler(ctx, cacheLogger, leaseCache, inmemSink, true))
+	// Setting useAutoAuthToken to true to ensure that the auto-auth token is used
+	mux.Handle("/", cache.ProxyHandler(ctx, cacheLogger, leaseCache, inmemSink, false, true, nil, nil))
 	server := &http.Server{
 		Handler:           mux,
 		ReadHeaderTimeout: 10 * time.Second,
diff --git a/command/agent/cert_end_to_end_test.go b/command/agent/cert_end_to_end_test.go
index c67b5e408cd..9b2139e3aee 100644
--- a/command/agent/cert_end_to_end_test.go
+++ b/command/agent/cert_end_to_end_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
@@ -12,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/api"
 	vaultcert "github.com/hashicorp/vault/builtin/credential/cert"
 	"github.com/hashicorp/vault/builtin/logical/pki"
@@ -198,7 +198,7 @@ func testCertEndToEnd(t *testing.T, withCertRoleName, ahWrapping bool) {
 		Client: client,
 	})
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
@@ -536,7 +536,7 @@ func TestCertEndToEnd_CertsInConfig(t *testing.T) {
 		Client: client,
 	})
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
diff --git a/command/agent/cf_end_to_end_test.go b/command/agent/cf_end_to_end_test.go
index a20cdcc76c6..bab26755e74 100644
--- a/command/agent/cf_end_to_end_test.go
+++ b/command/agent/cf_end_to_end_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-hclog"
 	credCF "github.com/hashicorp/vault-plugin-auth-cf"
 	"github.com/hashicorp/vault-plugin-auth-cf/testing/certificates"
 	cfAPI "github.com/hashicorp/vault-plugin-auth-cf/testing/cf"
@@ -150,7 +150,7 @@ func TestCFEndToEnd(t *testing.T) {
 		Client: client,
 	})
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
diff --git a/command/agent/config/config.go b/command/agent/config/config.go
index d1597cece8f..20d11c064b3 100644
--- a/command/agent/config/config.go
+++ b/command/agent/config/config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package config
@@ -23,6 +23,7 @@ import (
 	"github.com/hashicorp/hcl/hcl/ast"
 	"github.com/hashicorp/vault/command/agentproxyshared"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/sdk/helper/pointerutil"
 	"github.com/mitchellh/mapstructure"
@@ -129,8 +130,6 @@ type AutoAuth struct {
 	Method *Method `hcl:"-"`
 	Sinks  []*Sink `hcl:"sinks"`
 
-	// NOTE: This is unsupported outside of testing and may disappear at any
-	// time.
 	EnableReauthOnNewCredentials bool `hcl:"enable_reauth_on_new_credentials"`
 }
 
@@ -183,6 +182,9 @@ type ExecConfig struct {
 func NewConfig() *Config {
 	return &Config{
 		SharedConfig: new(configutil.SharedConfig),
+		TemplateConfig: &TemplateConfig{
+			MaxConnectionsPerHost: DefaultTemplateConfigMaxConnsPerHost,
+		},
 	}
 }
 
@@ -250,8 +252,13 @@ func (c *Config) Merge(c2 *Config) *Config {
 		result.DisableKeepAlivesTemplating = c2.DisableKeepAlivesTemplating
 	}
 
+	// Instead of checking if TemplateConfig is not nil, we compare against the default value
+	// that is set in NewConfig to determine if a TemplateConfig was specified in the config
+	defaultConfig := TemplateConfig{
+		MaxConnectionsPerHost: DefaultTemplateConfigMaxConnsPerHost,
+	}
 	result.TemplateConfig = c.TemplateConfig
-	if c2.TemplateConfig != nil {
+	if *c2.TemplateConfig != defaultConfig {
 		result.TemplateConfig = c2.TemplateConfig
 	}
 
@@ -486,31 +493,47 @@ func (c *Config) validateEnvTemplateConfig() error {
 // LoadConfig loads the configuration at the given path, regardless if
 // it's a file or directory.
 func LoadConfig(path string) (*Config, error) {
+	cfg, _, err := LoadConfigCheckDuplicates(path)
+	return cfg, err
+}
+
+// LoadConfigCheckDuplicates is the same as the above but adds the ability to check if the HCL config file has
+// duplicate attributes.
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only LoadConfig once deprecation is complete
+func LoadConfigCheckDuplicates(path string) (cfg *Config, duplicate bool, err error) {
 	fi, err := os.Stat(path)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	if fi.IsDir() {
-		return LoadConfigDir(path)
+		return LoadConfigDirCheckDuplicates(path)
 	}
-	return LoadConfigFile(path)
+	return LoadConfigFileCheckDuplicates(path)
 }
 
 // LoadConfigDir loads the configuration at the given path if it's a directory
 func LoadConfigDir(dir string) (*Config, error) {
+	cfg, _, err := LoadConfigDirCheckDuplicates(dir)
+	return cfg, err
+}
+
+// LoadConfigDirCheckDuplicates is the same as the above but adds the ability to check if the HCL config file has
+// duplicate attributes.
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only LoadConfigDir once deprecation is complete
+func LoadConfigDirCheckDuplicates(dir string) (cfg *Config, duplicate bool, err error) {
 	f, err := os.Open(dir)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 	defer f.Close()
 
 	fi, err := f.Stat()
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 	if !fi.IsDir() {
-		return nil, fmt.Errorf("configuration path must be a directory: %q", dir)
+		return nil, false, fmt.Errorf("configuration path must be a directory: %q", dir)
 	}
 
 	var files []string
@@ -519,7 +542,7 @@ func LoadConfigDir(dir string) (*Config, error) {
 		var fis []os.FileInfo
 		fis, err = f.Readdir(128)
 		if err != nil && err != io.EOF {
-			return nil, err
+			return nil, false, err
 		}
 
 		for _, fi := range fis {
@@ -547,10 +570,11 @@ func LoadConfigDir(dir string) (*Config, error) {
 
 	result := NewConfig()
 	for _, f := range files {
-		config, err := LoadConfigFile(f)
+		config, dup, err := LoadConfigFileCheckDuplicates(f)
 		if err != nil {
-			return nil, fmt.Errorf("error loading %q: %w", f, err)
+			return nil, duplicate, fmt.Errorf("error loading %q: %w", f, err)
 		}
+		duplicate = duplicate || dup
 
 		if result == nil {
 			result = config
@@ -559,7 +583,7 @@ func LoadConfigDir(dir string) (*Config, error) {
 		}
 	}
 
-	return result, nil
+	return result, duplicate, nil
 }
 
 // isTemporaryFile returns true or false depending on whether the
@@ -573,25 +597,33 @@ func isTemporaryFile(name string) bool {
 
 // LoadConfigFile loads the configuration at the given path if it's a file
 func LoadConfigFile(path string) (*Config, error) {
+	cfg, _, err := LoadConfigFileCheckDuplicates(path)
+	return cfg, err
+}
+
+// LoadConfigFileCheckDuplicates is the same as the above but adds the ability to check if the HCL config file has
+// duplicate attributes.
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only LoadConfigFile once deprecation is complete
+func LoadConfigFileCheckDuplicates(path string) (cfg *Config, duplicate bool, err error) {
 	fi, err := os.Stat(path)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	if fi.IsDir() {
-		return nil, fmt.Errorf("location is a directory, not a file")
+		return nil, false, fmt.Errorf("location is a directory, not a file")
 	}
 
 	// Read the file
 	d, err := os.ReadFile(path)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	// Parse!
-	obj, err := hcl.Parse(string(d))
+	obj, duplicate, err := random.ParseAndCheckForDuplicateHclAttributes(string(d))
 	if err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
 
 	// Attribute
@@ -605,13 +637,14 @@ func LoadConfigFile(path string) (*Config, error) {
 	// Start building the result
 	result := NewConfig()
 	if err := hcl.DecodeObject(result, obj); err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
 
-	sharedConfig, err := configutil.ParseConfig(string(d))
+	sharedConfig, dup, err := configutil.ParseConfigCheckDuplicate(string(d))
 	if err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
+	duplicate = duplicate || dup
 
 	// Pruning custom headers for Agent for now
 	for _, ln := range sharedConfig.Listeners {
@@ -622,35 +655,35 @@ func LoadConfigFile(path string) (*Config, error) {
 
 	list, ok := obj.Node.(*ast.ObjectList)
 	if !ok {
-		return nil, fmt.Errorf("error parsing: file doesn't contain a root object")
+		return nil, duplicate, fmt.Errorf("error parsing: file doesn't contain a root object")
 	}
 
 	if err := parseAutoAuth(result, list); err != nil {
-		return nil, fmt.Errorf("error parsing 'auto_auth': %w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'auto_auth': %w", err)
 	}
 
 	if err := parseCache(result, list); err != nil {
-		return nil, fmt.Errorf("error parsing 'cache':%w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'cache':%w", err)
 	}
 
 	if err := parseAPIProxy(result, list); err != nil {
-		return nil, fmt.Errorf("error parsing 'api_proxy':%w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'api_proxy':%w", err)
 	}
 
 	if err := parseTemplateConfig(result, list); err != nil {
-		return nil, fmt.Errorf("error parsing 'template_config': %w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'template_config': %w", err)
 	}
 
 	if err := parseTemplates(result, list); err != nil {
-		return nil, fmt.Errorf("error parsing 'template': %w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'template': %w", err)
 	}
 
 	if err := parseExec(result, list); err != nil {
-		return nil, fmt.Errorf("error parsing 'exec': %w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'exec': %w", err)
 	}
 
 	if err := parseEnvTemplates(result, list); err != nil {
-		return nil, fmt.Errorf("error parsing 'env_template': %w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'env_template': %w", err)
 	}
 
 	if result.Cache != nil && result.APIProxy == nil && (result.Cache.UseAutoAuthToken || result.Cache.ForceAutoAuthToken) {
@@ -662,7 +695,7 @@ func LoadConfigFile(path string) (*Config, error) {
 
 	err = parseVault(result, list)
 	if err != nil {
-		return nil, fmt.Errorf("error parsing 'vault':%w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'vault':%w", err)
 	}
 
 	if result.Vault != nil {
@@ -681,7 +714,7 @@ func LoadConfigFile(path string) (*Config, error) {
 	if disableIdleConnsEnv := os.Getenv(DisableIdleConnsEnv); disableIdleConnsEnv != "" {
 		result.DisableIdleConns, err = parseutil.ParseCommaStringSlice(strings.ToLower(disableIdleConnsEnv))
 		if err != nil {
-			return nil, fmt.Errorf("error parsing environment variable %s: %v", DisableIdleConnsEnv, err)
+			return nil, duplicate, fmt.Errorf("error parsing environment variable %s: %v", DisableIdleConnsEnv, err)
 		}
 	}
 
@@ -696,14 +729,14 @@ func LoadConfigFile(path string) (*Config, error) {
 		case "":
 			continue
 		default:
-			return nil, fmt.Errorf("unknown disable_idle_connections value: %s", subsystem)
+			return nil, duplicate, fmt.Errorf("unknown disable_idle_connections value: %s", subsystem)
 		}
 	}
 
 	if disableKeepAlivesEnv := os.Getenv(DisableKeepAlivesEnv); disableKeepAlivesEnv != "" {
 		result.DisableKeepAlives, err = parseutil.ParseCommaStringSlice(strings.ToLower(disableKeepAlivesEnv))
 		if err != nil {
-			return nil, fmt.Errorf("error parsing environment variable %s: %v", DisableKeepAlivesEnv, err)
+			return nil, duplicate, fmt.Errorf("error parsing environment variable %s: %v", DisableKeepAlivesEnv, err)
 		}
 	}
 
@@ -718,11 +751,11 @@ func LoadConfigFile(path string) (*Config, error) {
 		case "":
 			continue
 		default:
-			return nil, fmt.Errorf("unknown disable_keep_alives value: %s", subsystem)
+			return nil, duplicate, fmt.Errorf("unknown disable_keep_alives value: %s", subsystem)
 		}
 	}
 
-	return result, nil
+	return result, duplicate, nil
 }
 
 func parseVault(result *Config, list *ast.ObjectList) error {
@@ -745,6 +778,10 @@ func parseVault(result *Config, list *ast.ObjectList) error {
 		return err
 	}
 
+	if v.Address != "" {
+		v.Address = configutil.NormalizeAddr(v.Address)
+	}
+
 	if v.TLSSkipVerifyRaw != nil {
 		v.TLSSkipVerify, err = parseutil.ParseBool(v.TLSSkipVerifyRaw)
 		if err != nil {
@@ -1032,10 +1069,63 @@ func parseMethod(result *Config, list *ast.ObjectList) error {
 	// Canonicalize namespace path if provided
 	m.Namespace = namespace.Canonicalize(m.Namespace)
 
+	// Normalize any configuration addresses
+	if len(m.Config) > 0 {
+		var err error
+		for k, v := range m.Config {
+			vStr, ok := v.(string)
+			if !ok {
+				continue
+			}
+			m.Config[k], err = normalizeAutoAuthMethod(m.Type, k, vStr)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
 	result.AutoAuth.Method = &m
 	return nil
 }
 
+// autoAuthMethodKeys maps an auto-auth method type to its associated
+// configuration whose values are URLs, IP addresses, or host:port style
+// addresses. All auto-auth types must have an entry in this map, otherwise our
+// normalization check will fail when parsing the storage entry config.
+// Auto-auth method types which don't contain such keys should include an empty
+// array.
+var autoAuthMethodKeys = map[string][]string{
+	"alicloud":   {""},
+	"approle":    {""},
+	"aws":        {""},
+	"azure":      {"resource"},
+	"cert":       {""},
+	"cf":         {""},
+	"gcp":        {"service_account"},
+	"jwt":        {""},
+	"ldap":       {""},
+	"kerberos":   {""},
+	"kubernetes": {""},
+	"oci":        {""},
+	"token_file": {""},
+}
+
+// normalizeAutoAuthMethod takes a storage name, a configuration key
+// and its associated value and will normalize any URLs, IP addresses, or
+// host:port style addresses.
+func normalizeAutoAuthMethod(method string, key string, value string) (string, error) {
+	keys, ok := autoAuthMethodKeys[method]
+	if !ok {
+		return "", fmt.Errorf("unknown auto-auth method type %s", method)
+	}
+
+	if slices.Contains(keys, key) {
+		return configutil.NormalizeAddr(value), nil
+	}
+
+	return value, nil
+}
+
 func parseSinks(result *Config, list *ast.ObjectList) error {
 	name := "sink"
 
@@ -1106,9 +1196,6 @@ func parseTemplateConfig(result *Config, list *ast.ObjectList) error {
 
 	templateConfigList := list.Filter(name)
 	if len(templateConfigList.Items) == 0 {
-		result.TemplateConfig = &TemplateConfig{
-			MaxConnectionsPerHost: DefaultTemplateConfigMaxConnsPerHost,
-		}
 		return nil
 	}
 
diff --git a/command/agent/config/config_test.go b/command/agent/config/config_test.go
index 6c12ebe5def..1372a218596 100644
--- a/command/agent/config/config_test.go
+++ b/command/agent/config/config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package config
@@ -14,6 +14,7 @@ import (
 	"github.com/hashicorp/vault/command/agentproxyshared"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/sdk/helper/pointerutil"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/exp/slices"
 )
 
@@ -230,6 +231,9 @@ func TestLoadConfigDir_AgentCache(t *testing.T) {
 		t.Fatal(err)
 	}
 	config2, err := LoadConfigFile("./test-fixtures/config-dir-cache/config-cache2.hcl")
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	mergedConfig := config.Merge(config2)
 
@@ -441,77 +445,117 @@ func TestLoadConfigFile_AgentCache_NoListeners(t *testing.T) {
 	}
 }
 
-func TestLoadConfigFile(t *testing.T) {
-	if err := os.Setenv("TEST_AAD_ENV", "aad"); err != nil {
-		t.Fatal(err)
-	}
-	defer func() {
-		if err := os.Unsetenv("TEST_AAD_ENV"); err != nil {
-			t.Fatal(err)
-		}
-	}()
-
-	config, err := LoadConfigFile("./test-fixtures/config.hcl")
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+// Test_LoadConfigFile_AutoAuth_AddrConformance verifies basic config file
+// loading in addition to RFC-5942 §4 normalization of auto-auth methods.
+// See: https://rfc-editor.org/rfc/rfc5952.html
+func Test_LoadConfigFile_AutoAuth_AddrConformance(t *testing.T) {
+	t.Setenv("TEST_AAD_ENV", "aad")
+
+	for name, method := range map[string]*Method{
+		"aws": {
+			Type:      "aws",
+			MountPath: "auth/aws",
+			Namespace: "aws-namespace/",
+			Config: map[string]any{
+				"role": "foobar",
+			},
+		},
+		"azure": {
+			Type:      "azure",
+			MountPath: "auth/azure",
+			Namespace: "azure-namespace/",
+			Config: map[string]any{
+				"authenticate_from_environment": true,
+				"role":                          "dev-role",
+				"resource":                      "https://[2001:0:0:1::1]",
+			},
+		},
+		"gcp": {
+			Type:      "gcp",
+			MountPath: "auth/gcp",
+			Namespace: "gcp-namespace/",
+			Config: map[string]any{
+				"role":            "dev-role",
+				"service_account": "https://[2001:db8:ac3:fe4::1]",
+			},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			config, err := LoadConfigFile("./test-fixtures/config-auto-auth-" + name + ".hcl")
+			require.NoError(t, err)
 
-	expected := &Config{
-		SharedConfig: &configutil.SharedConfig{
-			PidFile: "./pidfile",
-			LogFile: "/var/log/vault/vault-agent.log",
-		},
-		AutoAuth: &AutoAuth{
-			Method: &Method{
-				Type:      "aws",
-				MountPath: "auth/aws",
-				Namespace: "my-namespace/",
-				Config: map[string]interface{}{
-					"role": "foobar",
+			expected := &Config{
+				SharedConfig: &configutil.SharedConfig{
+					PidFile: "./pidfile",
+					Listeners: []*configutil.Listener{
+						{
+							Type:       "unix",
+							Address:    "/path/to/socket",
+							TLSDisable: true,
+							AgentAPI: &configutil.AgentAPI{
+								EnableQuit: true,
+							},
+						},
+						{
+							Type:       "tcp",
+							Address:    "2001:db8::1:8200", // Normalized
+							TLSDisable: true,
+						},
+						{
+							Type:       "tcp",
+							Address:    "[2001:0:0:1::1]:3000", // Normalized
+							Role:       "metrics_only",
+							TLSDisable: true,
+						},
+						{
+							Type:        "tcp",
+							Role:        "default",
+							Address:     "2001:db8:0:1:1:1:1:1:8400", // Normalized
+							TLSKeyFile:  "/path/to/cakey.pem",
+							TLSCertFile: "/path/to/cacert.pem",
+						},
+					},
+					LogFile: "/var/log/vault/vault-agent.log",
 				},
-				MaxBackoff: 0,
-			},
-			Sinks: []*Sink{
-				{
-					Type:   "file",
-					DHType: "curve25519",
-					DHPath: "/tmp/file-foo-dhpath",
-					AAD:    "foobar",
-					Config: map[string]interface{}{
-						"path": "/tmp/file-foo",
+				Vault: &Vault{
+					Address: "https://[2001:db8::1]:8200", // Address is normalized
+					Retry: &Retry{
+						NumRetries: 12, // Default number of retries when a vault stanza is set
 					},
 				},
-				{
-					Type:      "file",
-					WrapTTL:   5 * time.Minute,
-					DHType:    "curve25519",
-					DHPath:    "/tmp/file-foo-dhpath2",
-					AAD:       "aad",
-					DeriveKey: true,
-					Config: map[string]interface{}{
-						"path": "/tmp/file-bar",
+				AutoAuth: &AutoAuth{
+					Method: method, // Method properties are normalized correctly
+					Sinks: []*Sink{
+						{
+							Type:   "file",
+							DHType: "curve25519",
+							DHPath: "/tmp/file-foo-dhpath",
+							AAD:    "foobar",
+							Config: map[string]interface{}{
+								"path": "/tmp/file-foo",
+							},
+						},
+						{
+							Type:      "file",
+							WrapTTL:   5 * time.Minute,
+							DHType:    "curve25519",
+							DHPath:    "/tmp/file-foo-dhpath2",
+							AAD:       "aad",
+							DeriveKey: true,
+							Config: map[string]interface{}{
+								"path": "/tmp/file-bar",
+							},
+						},
 					},
 				},
-			},
-		},
-		TemplateConfig: &TemplateConfig{
-			MaxConnectionsPerHost: DefaultTemplateConfigMaxConnsPerHost,
-		},
-	}
-
-	config.Prune()
-	if diff := deep.Equal(config, expected); diff != nil {
-		t.Fatal(diff)
-	}
-
-	config, err = LoadConfigFile("./test-fixtures/config-embedded-type.hcl")
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+				TemplateConfig: &TemplateConfig{
+					MaxConnectionsPerHost: DefaultTemplateConfigMaxConnsPerHost,
+				},
+			}
 
-	config.Prune()
-	if diff := deep.Equal(config, expected); diff != nil {
-		t.Fatal(diff)
+			config.Prune()
+			require.EqualValues(t, expected, config)
+		})
 	}
 }
 
@@ -1100,6 +1144,55 @@ func TestLoadConfigFile_TemplateConfig(t *testing.T) {
 	}
 }
 
+// TestLoadConfigFile_TemplateConfig_MergeConfigs tests that in the case of multiple config files,
+// a provided TemplateConfig in one file is properly preserved in the merged config
+func TestLoadConfigFile_TemplateConfig_MergeConfigs(t *testing.T) {
+	configPaths := []string{
+		"./test-fixtures/config-template_config.hcl",
+		"./test-fixtures/config-template-min-no-auth.hcl",
+	}
+
+	expected := &Config{
+		SharedConfig: &configutil.SharedConfig{},
+		Vault: &Vault{
+			Address: "http://127.0.0.1:1111",
+			Retry: &Retry{
+				NumRetries: 5,
+			},
+		},
+		TemplateConfig: &TemplateConfig{
+			ExitOnRetryFailure:    true,
+			StaticSecretRenderInt: 1 * time.Minute,
+			MaxConnectionsPerHost: 100,
+			LeaseRenewalThreshold: FloatPtr(0.8),
+		},
+		Templates: []*ctconfig.TemplateConfig{
+			{
+				Source:      pointerutil.StringPtr("/path/on/disk/to/template.ctmpl"),
+				Destination: pointerutil.StringPtr("/path/on/disk/where/template/will/render.txt"),
+			},
+			{
+				Source:      pointerutil.StringPtr("/path/on/disk/to/template2.ctmpl"),
+				Destination: pointerutil.StringPtr("/path/on/disk/where/template/will/render2.txt"),
+			},
+		},
+	}
+
+	cfg := NewConfig()
+	for _, path := range configPaths {
+		configFromPath, err := LoadConfigFile(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		cfg = cfg.Merge(configFromPath)
+	}
+
+	cfg.Prune()
+	if diff := deep.Equal(cfg, expected); diff != nil {
+		t.Fatal(diff)
+	}
+}
+
 // TestLoadConfigFile_Template tests template definitions in Vault Agent
 func TestLoadConfigFile_Template(t *testing.T) {
 	testCases := map[string]struct {
diff --git a/command/agent/config/test-fixtures/bad-config-api_proxy-cache.hcl b/command/agent/config/test-fixtures/bad-config-api_proxy-cache.hcl
index b35a06f2848..8cdb3b7237e 100644
--- a/command/agent/config/test-fixtures/bad-config-api_proxy-cache.hcl
+++ b/command/agent/config/test-fixtures/bad-config-api_proxy-cache.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/bad-config-auto_auth-nosinks-nocache-notemplates.hcl b/command/agent/config/test-fixtures/bad-config-auto_auth-nosinks-nocache-notemplates.hcl
index 1d618befa97..dc663973d89 100644
--- a/command/agent/config/test-fixtures/bad-config-auto_auth-nosinks-nocache-notemplates.hcl
+++ b/command/agent/config/test-fixtures/bad-config-auto_auth-nosinks-nocache-notemplates.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/bad-config-auto_auth-wrapped-multiple-sinks.hcl b/command/agent/config/test-fixtures/bad-config-auto_auth-wrapped-multiple-sinks.hcl
index eea90860cbe..d9dd0929307 100644
--- a/command/agent/config/test-fixtures/bad-config-auto_auth-wrapped-multiple-sinks.hcl
+++ b/command/agent/config/test-fixtures/bad-config-auto_auth-wrapped-multiple-sinks.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/bad-config-cache-auto_auth-method-wrapping.hcl b/command/agent/config/test-fixtures/bad-config-cache-auto_auth-method-wrapping.hcl
index e90ba98bb0a..6baa54eda21 100644
--- a/command/agent/config/test-fixtures/bad-config-cache-auto_auth-method-wrapping.hcl
+++ b/command/agent/config/test-fixtures/bad-config-cache-auto_auth-method-wrapping.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/bad-config-cache-force-token-no-auth-method.hcl b/command/agent/config/test-fixtures/bad-config-cache-force-token-no-auth-method.hcl
index 39f2bc74026..28c38b5503f 100644
--- a/command/agent/config/test-fixtures/bad-config-cache-force-token-no-auth-method.hcl
+++ b/command/agent/config/test-fixtures/bad-config-cache-force-token-no-auth-method.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/bad-config-cache-inconsistent-auto_auth.hcl b/command/agent/config/test-fixtures/bad-config-cache-inconsistent-auto_auth.hcl
index f5d39af89ee..c6a3d0e530d 100644
--- a/command/agent/config/test-fixtures/bad-config-cache-inconsistent-auto_auth.hcl
+++ b/command/agent/config/test-fixtures/bad-config-cache-inconsistent-auto_auth.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/bad-config-cache-no-listeners.hcl b/command/agent/config/test-fixtures/bad-config-cache-no-listeners.hcl
index 46f2802689a..2ebaa39cb6d 100644
--- a/command/agent/config/test-fixtures/bad-config-cache-no-listeners.hcl
+++ b/command/agent/config/test-fixtures/bad-config-cache-no-listeners.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/bad-config-disable-idle-connections.hcl b/command/agent/config/test-fixtures/bad-config-disable-idle-connections.hcl
index 10b7e54a7a5..7af4db5b539 100644
--- a/command/agent/config/test-fixtures/bad-config-disable-idle-connections.hcl
+++ b/command/agent/config/test-fixtures/bad-config-disable-idle-connections.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/bad-config-disable-keep-alives.hcl b/command/agent/config/test-fixtures/bad-config-disable-keep-alives.hcl
index 47f1eb2e52c..ca570187601 100644
--- a/command/agent/config/test-fixtures/bad-config-disable-keep-alives.hcl
+++ b/command/agent/config/test-fixtures/bad-config-disable-keep-alives.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/bad-config-env-templates-disalowed-fields.hcl b/command/agent/config/test-fixtures/bad-config-env-templates-disalowed-fields.hcl
index 4355fd078f9..43535262969 100644
--- a/command/agent/config/test-fixtures/bad-config-env-templates-disalowed-fields.hcl
+++ b/command/agent/config/test-fixtures/bad-config-env-templates-disalowed-fields.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 auto_auth {
diff --git a/command/agent/config/test-fixtures/bad-config-env-templates-invalid-signal.hcl b/command/agent/config/test-fixtures/bad-config-env-templates-invalid-signal.hcl
index 7cbbc09318b..f8d176f6e28 100644
--- a/command/agent/config/test-fixtures/bad-config-env-templates-invalid-signal.hcl
+++ b/command/agent/config/test-fixtures/bad-config-env-templates-invalid-signal.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 auto_auth {
diff --git a/command/agent/config/test-fixtures/bad-config-env-templates-missing-exec.hcl b/command/agent/config/test-fixtures/bad-config-env-templates-missing-exec.hcl
index 8fbbd83bae5..42ed3ff92a1 100644
--- a/command/agent/config/test-fixtures/bad-config-env-templates-missing-exec.hcl
+++ b/command/agent/config/test-fixtures/bad-config-env-templates-missing-exec.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 auto_auth {
diff --git a/command/agent/config/test-fixtures/bad-config-env-templates-no-name.hcl b/command/agent/config/test-fixtures/bad-config-env-templates-no-name.hcl
index 7c7363a4654..c772927c6c6 100644
--- a/command/agent/config/test-fixtures/bad-config-env-templates-no-name.hcl
+++ b/command/agent/config/test-fixtures/bad-config-env-templates-no-name.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 auto_auth {
diff --git a/command/agent/config/test-fixtures/bad-config-env-templates-with-file-templates.hcl b/command/agent/config/test-fixtures/bad-config-env-templates-with-file-templates.hcl
index ace9410bd0b..cbcac668e14 100644
--- a/command/agent/config/test-fixtures/bad-config-env-templates-with-file-templates.hcl
+++ b/command/agent/config/test-fixtures/bad-config-env-templates-with-file-templates.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 auto_auth {
diff --git a/command/agent/config/test-fixtures/bad-config-env-templates-with-proxy.hcl b/command/agent/config/test-fixtures/bad-config-env-templates-with-proxy.hcl
index ac0824441af..a8b3ed8677c 100644
--- a/command/agent/config/test-fixtures/bad-config-env-templates-with-proxy.hcl
+++ b/command/agent/config/test-fixtures/bad-config-env-templates-with-proxy.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 auto_auth {
diff --git a/command/agent/config/test-fixtures/bad-config-method-wrapping-and-sink-wrapping.hcl b/command/agent/config/test-fixtures/bad-config-method-wrapping-and-sink-wrapping.hcl
index 89c766d5ceb..2033a5ba16a 100644
--- a/command/agent/config/test-fixtures/bad-config-method-wrapping-and-sink-wrapping.hcl
+++ b/command/agent/config/test-fixtures/bad-config-method-wrapping-and-sink-wrapping.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-api_proxy-auto_auth-all-api_proxy-config.hcl b/command/agent/config/test-fixtures/config-api_proxy-auto_auth-all-api_proxy-config.hcl
index 79b2009630a..42d438776cc 100644
--- a/command/agent/config/test-fixtures/config-api_proxy-auto_auth-all-api_proxy-config.hcl
+++ b/command/agent/config/test-fixtures/config-api_proxy-auto_auth-all-api_proxy-config.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-auto-auth-aws.hcl b/command/agent/config/test-fixtures/config-auto-auth-aws.hcl
new file mode 100644
index 00000000000..59d90ab345f
--- /dev/null
+++ b/command/agent/config/test-fixtures/config-auto-auth-aws.hcl
@@ -0,0 +1,69 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+pid_file = "./pidfile"
+log_file = "/var/log/vault/vault-agent.log"
+
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}
+
+auto_auth {
+  method {
+    type      = "aws"
+    namespace = "/aws-namespace"
+    config = {
+      role = "foobar"
+    }
+  }
+
+  sink {
+    type = "file"
+    config = {
+      path = "/tmp/file-foo"
+    }
+    aad     = "foobar"
+    dh_type = "curve25519"
+    dh_path = "/tmp/file-foo-dhpath"
+  }
+
+  sink {
+    type        = "file"
+    wrap_ttl    = "5m"
+    aad_env_var = "TEST_AAD_ENV"
+    dh_type     = "curve25519"
+    dh_path     = "/tmp/file-foo-dhpath2"
+    derive_key  = true
+    config = {
+      path = "/tmp/file-bar"
+    }
+  }
+}
+
+listener "unix" {
+  address     = "/path/to/socket"
+  tls_disable = true
+
+  agent_api {
+    enable_quit = true
+  }
+}
+
+listener "tcp" {
+  address     = "2001:0db8::0001:8200"
+  tls_disable = true
+}
+
+listener {
+  type        = "tcp"
+  address     = "[2001:0:0:1:0:0:0:1]:3000"
+  tls_disable = true
+  role        = "metrics_only"
+}
+
+listener "tcp" {
+  role          = "default"
+  address       = "2001:db8:0:1:1:1:1:1:8400"
+  tls_key_file  = "/path/to/cakey.pem"
+  tls_cert_file = "/path/to/cacert.pem"
+}
diff --git a/command/agent/config/test-fixtures/config-auto-auth-azure.hcl b/command/agent/config/test-fixtures/config-auto-auth-azure.hcl
new file mode 100644
index 00000000000..4bb5f60b1ff
--- /dev/null
+++ b/command/agent/config/test-fixtures/config-auto-auth-azure.hcl
@@ -0,0 +1,71 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+pid_file = "./pidfile"
+log_file = "/var/log/vault/vault-agent.log"
+
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}
+
+auto_auth {
+  method {
+    type      = "azure"
+    namespace = "/azure-namespace"
+    config = {
+      authenticate_from_environment = true
+      role                          = "dev-role"
+      resource                      = "https://[2001:0:0:1:0:0:0:1]",
+    }
+  }
+
+  sink {
+    type = "file"
+    config = {
+      path = "/tmp/file-foo"
+    }
+    aad     = "foobar"
+    dh_type = "curve25519"
+    dh_path = "/tmp/file-foo-dhpath"
+  }
+
+  sink {
+    type        = "file"
+    wrap_ttl    = "5m"
+    aad_env_var = "TEST_AAD_ENV"
+    dh_type     = "curve25519"
+    dh_path     = "/tmp/file-foo-dhpath2"
+    derive_key  = true
+    config = {
+      path = "/tmp/file-bar"
+    }
+  }
+}
+
+listener "unix" {
+  address     = "/path/to/socket"
+  tls_disable = true
+
+  agent_api {
+    enable_quit = true
+  }
+}
+
+listener "tcp" {
+  address     = "2001:0db8::0001:8200"
+  tls_disable = true
+}
+
+listener {
+  type        = "tcp"
+  address     = "[2001:0:0:1:0:0:0:1]:3000"
+  tls_disable = true
+  role        = "metrics_only"
+}
+
+listener "tcp" {
+  role          = "default"
+  address       = "2001:db8:0:1:1:1:1:1:8400"
+  tls_key_file  = "/path/to/cakey.pem"
+  tls_cert_file = "/path/to/cacert.pem"
+}
diff --git a/command/agent/config/test-fixtures/config-auto-auth-gcp.hcl b/command/agent/config/test-fixtures/config-auto-auth-gcp.hcl
new file mode 100644
index 00000000000..7c33f5f093c
--- /dev/null
+++ b/command/agent/config/test-fixtures/config-auto-auth-gcp.hcl
@@ -0,0 +1,70 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+pid_file = "./pidfile"
+log_file = "/var/log/vault/vault-agent.log"
+
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}
+
+auto_auth {
+  method {
+    type      = "gcp"
+    namespace = "/gcp-namespace"
+    config = {
+      role            = "dev-role"
+      service_account = "https://[2001:DB8:AC3:FE4::1]"
+    }
+  }
+
+  sink {
+    type = "file"
+    config = {
+      path = "/tmp/file-foo"
+    }
+    aad     = "foobar"
+    dh_type = "curve25519"
+    dh_path = "/tmp/file-foo-dhpath"
+  }
+
+  sink {
+    type        = "file"
+    wrap_ttl    = "5m"
+    aad_env_var = "TEST_AAD_ENV"
+    dh_type     = "curve25519"
+    dh_path     = "/tmp/file-foo-dhpath2"
+    derive_key  = true
+    config = {
+      path = "/tmp/file-bar"
+    }
+  }
+}
+
+listener "unix" {
+  address     = "/path/to/socket"
+  tls_disable = true
+
+  agent_api {
+    enable_quit = true
+  }
+}
+
+listener "tcp" {
+  address     = "2001:0db8::0001:8200"
+  tls_disable = true
+}
+
+listener {
+  type        = "tcp"
+  address     = "[2001:0:0:1:0:0:0:1]:3000"
+  tls_disable = true
+  role        = "metrics_only"
+}
+
+listener "tcp" {
+  role          = "default"
+  address       = "2001:db8:0:1:1:1:1:1:8400"
+  tls_key_file  = "/path/to/cakey.pem"
+  tls_cert_file = "/path/to/cacert.pem"
+}
diff --git a/command/agent/config/test-fixtures/config-cache-auto_auth-false.hcl b/command/agent/config/test-fixtures/config-cache-auto_auth-false.hcl
index 7fbaa7418e8..3ade5a32ce9 100644
--- a/command/agent/config/test-fixtures/config-cache-auto_auth-false.hcl
+++ b/command/agent/config/test-fixtures/config-cache-auto_auth-false.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-cache-auto_auth-force.hcl b/command/agent/config/test-fixtures/config-cache-auto_auth-force.hcl
index 5d280bd2035..ed2ab4bcb50 100644
--- a/command/agent/config/test-fixtures/config-cache-auto_auth-force.hcl
+++ b/command/agent/config/test-fixtures/config-cache-auto_auth-force.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-cache-auto_auth-no-sink.hcl b/command/agent/config/test-fixtures/config-cache-auto_auth-no-sink.hcl
index e951427430e..c19367f19df 100644
--- a/command/agent/config/test-fixtures/config-cache-auto_auth-no-sink.hcl
+++ b/command/agent/config/test-fixtures/config-cache-auto_auth-no-sink.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-cache-auto_auth-true.hcl b/command/agent/config/test-fixtures/config-cache-auto_auth-true.hcl
index bbc945ccac3..b2182afc3f6 100644
--- a/command/agent/config/test-fixtures/config-cache-auto_auth-true.hcl
+++ b/command/agent/config/test-fixtures/config-cache-auto_auth-true.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-cache-embedded-type.hcl b/command/agent/config/test-fixtures/config-cache-embedded-type.hcl
index 6661966c281..3fb989fbc8c 100644
--- a/command/agent/config/test-fixtures/config-cache-embedded-type.hcl
+++ b/command/agent/config/test-fixtures/config-cache-embedded-type.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-cache-no-auto_auth.hcl b/command/agent/config/test-fixtures/config-cache-no-auto_auth.hcl
index b654e202da1..04fec62ada4 100644
--- a/command/agent/config/test-fixtures/config-cache-no-auto_auth.hcl
+++ b/command/agent/config/test-fixtures/config-cache-no-auto_auth.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-cache-no-listeners.hcl b/command/agent/config/test-fixtures/config-cache-no-listeners.hcl
index 0ad5203fd87..ce86cabb7bf 100644
--- a/command/agent/config/test-fixtures/config-cache-no-listeners.hcl
+++ b/command/agent/config/test-fixtures/config-cache-no-listeners.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-cache-persist-empty-type.hcl b/command/agent/config/test-fixtures/config-cache-persist-empty-type.hcl
index f85799bb93c..f691a1d018a 100644
--- a/command/agent/config/test-fixtures/config-cache-persist-empty-type.hcl
+++ b/command/agent/config/test-fixtures/config-cache-persist-empty-type.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-cache-persist-false.hcl b/command/agent/config/test-fixtures/config-cache-persist-false.hcl
index f48dfd85763..11fd36e4289 100644
--- a/command/agent/config/test-fixtures/config-cache-persist-false.hcl
+++ b/command/agent/config/test-fixtures/config-cache-persist-false.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-cache.hcl b/command/agent/config/test-fixtures/config-cache.hcl
index 148ef6e7ccb..ff8dc67d1a3 100644
--- a/command/agent/config/test-fixtures/config-cache.hcl
+++ b/command/agent/config/test-fixtures/config-cache.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-consistency-apiproxy.hcl b/command/agent/config/test-fixtures/config-consistency-apiproxy.hcl
index 318c3697374..92cd0274928 100644
--- a/command/agent/config/test-fixtures/config-consistency-apiproxy.hcl
+++ b/command/agent/config/test-fixtures/config-consistency-apiproxy.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 api_proxy {
diff --git a/command/agent/config/test-fixtures/config-consistency.hcl b/command/agent/config/test-fixtures/config-consistency.hcl
index 7ed75229735..8d0829cb209 100644
--- a/command/agent/config/test-fixtures/config-consistency.hcl
+++ b/command/agent/config/test-fixtures/config-consistency.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 cache {
diff --git a/command/agent/config/test-fixtures/config-dir-auto-auth-and-listener/config1.hcl b/command/agent/config/test-fixtures/config-dir-auto-auth-and-listener/config1.hcl
index 1bd5e93c770..e5988953a31 100644
--- a/command/agent/config/test-fixtures/config-dir-auto-auth-and-listener/config1.hcl
+++ b/command/agent/config/test-fixtures/config-dir-auto-auth-and-listener/config1.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-dir-auto-auth-and-listener/config2.hcl b/command/agent/config/test-fixtures/config-dir-auto-auth-and-listener/config2.hcl
index b5d7425ebe4..a20588d14ba 100644
--- a/command/agent/config/test-fixtures/config-dir-auto-auth-and-listener/config2.hcl
+++ b/command/agent/config/test-fixtures/config-dir-auto-auth-and-listener/config2.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-dir-cache/config-cache1.hcl b/command/agent/config/test-fixtures/config-dir-cache/config-cache1.hcl
index f65b4c6ddbc..54c56f4044f 100644
--- a/command/agent/config/test-fixtures/config-dir-cache/config-cache1.hcl
+++ b/command/agent/config/test-fixtures/config-dir-cache/config-cache1.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-dir-cache/config-cache2.hcl b/command/agent/config/test-fixtures/config-dir-cache/config-cache2.hcl
index 57929cd55c8..003ee8894f1 100644
--- a/command/agent/config/test-fixtures/config-dir-cache/config-cache2.hcl
+++ b/command/agent/config/test-fixtures/config-dir-cache/config-cache2.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 cache {
diff --git a/command/agent/config/test-fixtures/config-dir-vault-block/config1.hcl b/command/agent/config/test-fixtures/config-dir-vault-block/config1.hcl
index b99ee93f907..092133af292 100644
--- a/command/agent/config/test-fixtures/config-dir-vault-block/config1.hcl
+++ b/command/agent/config/test-fixtures/config-dir-vault-block/config1.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 vault {
diff --git a/command/agent/config/test-fixtures/config-dir-vault-block/config2.hcl b/command/agent/config/test-fixtures/config-dir-vault-block/config2.hcl
index 1bd5e93c770..e5988953a31 100644
--- a/command/agent/config/test-fixtures/config-dir-vault-block/config2.hcl
+++ b/command/agent/config/test-fixtures/config-dir-vault-block/config2.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-idle-connections-all.hcl b/command/agent/config/test-fixtures/config-disable-idle-connections-all.hcl
index b6869a2000a..1d9ba2a7062 100644
--- a/command/agent/config/test-fixtures/config-disable-idle-connections-all.hcl
+++ b/command/agent/config/test-fixtures/config-disable-idle-connections-all.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-idle-connections-auto-auth.hcl b/command/agent/config/test-fixtures/config-disable-idle-connections-auto-auth.hcl
index 02bda0b0a6e..943b3860614 100644
--- a/command/agent/config/test-fixtures/config-disable-idle-connections-auto-auth.hcl
+++ b/command/agent/config/test-fixtures/config-disable-idle-connections-auto-auth.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-idle-connections-caching.hcl b/command/agent/config/test-fixtures/config-disable-idle-connections-caching.hcl
index 624d1bd1c86..a23d75d50a1 100644
--- a/command/agent/config/test-fixtures/config-disable-idle-connections-caching.hcl
+++ b/command/agent/config/test-fixtures/config-disable-idle-connections-caching.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-idle-connections-empty.hcl b/command/agent/config/test-fixtures/config-disable-idle-connections-empty.hcl
index 6b7ac26df73..cf4c3d60075 100644
--- a/command/agent/config/test-fixtures/config-disable-idle-connections-empty.hcl
+++ b/command/agent/config/test-fixtures/config-disable-idle-connections-empty.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-idle-connections-proxying.hcl b/command/agent/config/test-fixtures/config-disable-idle-connections-proxying.hcl
index 2219b84eb28..7d79050bbea 100644
--- a/command/agent/config/test-fixtures/config-disable-idle-connections-proxying.hcl
+++ b/command/agent/config/test-fixtures/config-disable-idle-connections-proxying.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-idle-connections-templating.hcl b/command/agent/config/test-fixtures/config-disable-idle-connections-templating.hcl
index 4f819c7a443..236134ec93d 100644
--- a/command/agent/config/test-fixtures/config-disable-idle-connections-templating.hcl
+++ b/command/agent/config/test-fixtures/config-disable-idle-connections-templating.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-keep-alives-all.hcl b/command/agent/config/test-fixtures/config-disable-keep-alives-all.hcl
index 356c79ff5bb..dbd527c71c7 100644
--- a/command/agent/config/test-fixtures/config-disable-keep-alives-all.hcl
+++ b/command/agent/config/test-fixtures/config-disable-keep-alives-all.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-keep-alives-auto-auth.hcl b/command/agent/config/test-fixtures/config-disable-keep-alives-auto-auth.hcl
index a7648c480ff..4d505b68e02 100644
--- a/command/agent/config/test-fixtures/config-disable-keep-alives-auto-auth.hcl
+++ b/command/agent/config/test-fixtures/config-disable-keep-alives-auto-auth.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-keep-alives-caching.hcl b/command/agent/config/test-fixtures/config-disable-keep-alives-caching.hcl
index 4f93218ee50..101f9c0be0d 100644
--- a/command/agent/config/test-fixtures/config-disable-keep-alives-caching.hcl
+++ b/command/agent/config/test-fixtures/config-disable-keep-alives-caching.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-keep-alives-empty.hcl b/command/agent/config/test-fixtures/config-disable-keep-alives-empty.hcl
index b0969776fde..010cd5571c6 100644
--- a/command/agent/config/test-fixtures/config-disable-keep-alives-empty.hcl
+++ b/command/agent/config/test-fixtures/config-disable-keep-alives-empty.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-keep-alives-proxying.hcl b/command/agent/config/test-fixtures/config-disable-keep-alives-proxying.hcl
index 13825465257..666abeae23c 100644
--- a/command/agent/config/test-fixtures/config-disable-keep-alives-proxying.hcl
+++ b/command/agent/config/test-fixtures/config-disable-keep-alives-proxying.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-disable-keep-alives-templating.hcl b/command/agent/config/test-fixtures/config-disable-keep-alives-templating.hcl
index 9e154a9ce46..e98e22c054c 100644
--- a/command/agent/config/test-fixtures/config-disable-keep-alives-templating.hcl
+++ b/command/agent/config/test-fixtures/config-disable-keep-alives-templating.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-embedded-type.hcl b/command/agent/config/test-fixtures/config-embedded-type.hcl
deleted file mode 100644
index cf3c182a85f..00000000000
--- a/command/agent/config/test-fixtures/config-embedded-type.hcl
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-pid_file = "./pidfile"
-log_file = "/var/log/vault/vault-agent.log"
-
-auto_auth {
-	method "aws" {
-		mount_path = "auth/aws"
-		namespace = "my-namespace"
-		config = {
-			role = "foobar"
-		}
-	}
-
-	sink "file" {
-		config = {
-			path = "/tmp/file-foo"
-		}
-		aad = "foobar"
-		dh_type = "curve25519"
-		dh_path = "/tmp/file-foo-dhpath"
-	}
-
-	sink "file" {
-		wrap_ttl = "5m" 
-		aad_env_var = "TEST_AAD_ENV"
-		dh_type = "curve25519"
-		dh_path = "/tmp/file-foo-dhpath2"
-		derive_key = true
-		config = {
-			path = "/tmp/file-bar"
-		}
-	}
-}
diff --git a/command/agent/config/test-fixtures/config-env-templates-complex.hcl b/command/agent/config/test-fixtures/config-env-templates-complex.hcl
index adcd4b0dccc..3c103a8d48b 100644
--- a/command/agent/config/test-fixtures/config-env-templates-complex.hcl
+++ b/command/agent/config/test-fixtures/config-env-templates-complex.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 auto_auth {
diff --git a/command/agent/config/test-fixtures/config-env-templates-simple.hcl b/command/agent/config/test-fixtures/config-env-templates-simple.hcl
index 3ca1a190980..40bf536a4c2 100644
--- a/command/agent/config/test-fixtures/config-env-templates-simple.hcl
+++ b/command/agent/config/test-fixtures/config-env-templates-simple.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 auto_auth {
diff --git a/command/agent/config/test-fixtures/config-env-templates-with-source.hcl b/command/agent/config/test-fixtures/config-env-templates-with-source.hcl
index 7643ff28d82..8d303ed9198 100644
--- a/command/agent/config/test-fixtures/config-env-templates-with-source.hcl
+++ b/command/agent/config/test-fixtures/config-env-templates-with-source.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 auto_auth {
diff --git a/command/agent/config/test-fixtures/config-method-exit-on-err.hcl b/command/agent/config/test-fixtures/config-method-exit-on-err.hcl
index d6b32c70de5..bf0a44250ec 100644
--- a/command/agent/config/test-fixtures/config-method-exit-on-err.hcl
+++ b/command/agent/config/test-fixtures/config-method-exit-on-err.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-method-initial-backoff.hcl b/command/agent/config/test-fixtures/config-method-initial-backoff.hcl
index a7fbccd4ba9..ecdb7d7677e 100644
--- a/command/agent/config/test-fixtures/config-method-initial-backoff.hcl
+++ b/command/agent/config/test-fixtures/config-method-initial-backoff.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-method-wrapping.hcl b/command/agent/config/test-fixtures/config-method-wrapping.hcl
index 0012bb5708a..36d272c1c65 100644
--- a/command/agent/config/test-fixtures/config-method-wrapping.hcl
+++ b/command/agent/config/test-fixtures/config-method-wrapping.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-template-full-nosink.hcl b/command/agent/config/test-fixtures/config-template-full-nosink.hcl
index cda6d020c61..eb2f8170e68 100644
--- a/command/agent/config/test-fixtures/config-template-full-nosink.hcl
+++ b/command/agent/config/test-fixtures/config-template-full-nosink.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-template-full.hcl b/command/agent/config/test-fixtures/config-template-full.hcl
index 649510d167c..387413db9fb 100644
--- a/command/agent/config/test-fixtures/config-template-full.hcl
+++ b/command/agent/config/test-fixtures/config-template-full.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-template-many-nosink.hcl b/command/agent/config/test-fixtures/config-template-many-nosink.hcl
index 2882d76de0f..d5571e0ab15 100644
--- a/command/agent/config/test-fixtures/config-template-many-nosink.hcl
+++ b/command/agent/config/test-fixtures/config-template-many-nosink.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-template-many.hcl b/command/agent/config/test-fixtures/config-template-many.hcl
index 99238170499..55ff2c841b6 100644
--- a/command/agent/config/test-fixtures/config-template-many.hcl
+++ b/command/agent/config/test-fixtures/config-template-many.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-template-min-no-auth.hcl b/command/agent/config/test-fixtures/config-template-min-no-auth.hcl
new file mode 100644
index 00000000000..52b7818f7e0
--- /dev/null
+++ b/command/agent/config/test-fixtures/config-template-min-no-auth.hcl
@@ -0,0 +1,7 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+template {
+  source      = "/path/on/disk/to/template2.ctmpl"
+  destination = "/path/on/disk/where/template/will/render2.txt"
+}
diff --git a/command/agent/config/test-fixtures/config-template-min-nosink.hcl b/command/agent/config/test-fixtures/config-template-min-nosink.hcl
index 395be10e367..e197e16f471 100644
--- a/command/agent/config/test-fixtures/config-template-min-nosink.hcl
+++ b/command/agent/config/test-fixtures/config-template-min-nosink.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-template-min.hcl b/command/agent/config/test-fixtures/config-template-min.hcl
index 523a81e46bf..65625bbc133 100644
--- a/command/agent/config/test-fixtures/config-template-min.hcl
+++ b/command/agent/config/test-fixtures/config-template-min.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-template-with-cache.hcl b/command/agent/config/test-fixtures/config-template-with-cache.hcl
index 14e8ab11997..6546d0b6a8f 100644
--- a/command/agent/config/test-fixtures/config-template-with-cache.hcl
+++ b/command/agent/config/test-fixtures/config-template-with-cache.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-template_config-empty.hcl b/command/agent/config/test-fixtures/config-template_config-empty.hcl
index b497032a74a..5427a1051bc 100644
--- a/command/agent/config/test-fixtures/config-template_config-empty.hcl
+++ b/command/agent/config/test-fixtures/config-template_config-empty.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 vault {
diff --git a/command/agent/config/test-fixtures/config-template_config-missing.hcl b/command/agent/config/test-fixtures/config-template_config-missing.hcl
index 4673e0c1dfd..8697bfbc5cf 100644
--- a/command/agent/config/test-fixtures/config-template_config-missing.hcl
+++ b/command/agent/config/test-fixtures/config-template_config-missing.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 vault {
diff --git a/command/agent/config/test-fixtures/config-template_config.hcl b/command/agent/config/test-fixtures/config-template_config.hcl
index be6bd384d81..a3caa3b3d16 100644
--- a/command/agent/config/test-fixtures/config-template_config.hcl
+++ b/command/agent/config/test-fixtures/config-template_config.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 vault {
diff --git a/command/agent/config/test-fixtures/config-vault-retry-empty.hcl b/command/agent/config/test-fixtures/config-vault-retry-empty.hcl
index b6bf1abe8fe..26d19dcc5fe 100644
--- a/command/agent/config/test-fixtures/config-vault-retry-empty.hcl
+++ b/command/agent/config/test-fixtures/config-vault-retry-empty.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config-vault-retry.hcl b/command/agent/config/test-fixtures/config-vault-retry.hcl
index aedbfdc5205..0cb14fa5277 100644
--- a/command/agent/config/test-fixtures/config-vault-retry.hcl
+++ b/command/agent/config/test-fixtures/config-vault-retry.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/agent/config/test-fixtures/config.hcl b/command/agent/config/test-fixtures/config.hcl
deleted file mode 100644
index f6ca0e684e0..00000000000
--- a/command/agent/config/test-fixtures/config.hcl
+++ /dev/null
@@ -1,37 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-pid_file = "./pidfile"
-log_file = "/var/log/vault/vault-agent.log"
-
-auto_auth {
-	method {
-		type = "aws"
-		namespace = "/my-namespace"
-		config = {
-			role = "foobar"
-		}
-	}
-
-	sink {
-		type = "file"
-		config = {
-			path = "/tmp/file-foo"
-		}
-		aad = "foobar"
-		dh_type = "curve25519"
-		dh_path = "/tmp/file-foo-dhpath"
-	}
-
-	sink {
-		type = "file"
-		wrap_ttl = "5m" 
-		aad_env_var = "TEST_AAD_ENV"
-		dh_type = "curve25519"
-		dh_path = "/tmp/file-foo-dhpath2"
-		derive_key = true
-		config = {
-			path = "/tmp/file-bar"
-		}
-	}
-}
diff --git a/command/agent/doc.go b/command/agent/doc.go
index 785fe94060a..d818525ba0f 100644
--- a/command/agent/doc.go
+++ b/command/agent/doc.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 /*
diff --git a/command/agent/exec/childprocessstate_enumer.go b/command/agent/exec/childprocessstate_enumer.go
new file mode 100644
index 00000000000..154606ed62f
--- /dev/null
+++ b/command/agent/exec/childprocessstate_enumer.go
@@ -0,0 +1,51 @@
+// Code generated by "enumer -type=childProcessState -trimprefix=childProcessState"; DO NOT EDIT.
+
+package exec
+
+import (
+	"fmt"
+)
+
+const _childProcessStateName = "NotStartedRunningRestartingStopped"
+
+var _childProcessStateIndex = [...]uint8{0, 10, 17, 27, 34}
+
+func (i childProcessState) String() string {
+	if i >= childProcessState(len(_childProcessStateIndex)-1) {
+		return fmt.Sprintf("childProcessState(%d)", i)
+	}
+	return _childProcessStateName[_childProcessStateIndex[i]:_childProcessStateIndex[i+1]]
+}
+
+var _childProcessStateValues = []childProcessState{0, 1, 2, 3}
+
+var _childProcessStateNameToValueMap = map[string]childProcessState{
+	_childProcessStateName[0:10]:  0,
+	_childProcessStateName[10:17]: 1,
+	_childProcessStateName[17:27]: 2,
+	_childProcessStateName[27:34]: 3,
+}
+
+// childProcessStateString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func childProcessStateString(s string) (childProcessState, error) {
+	if val, ok := _childProcessStateNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to childProcessState values", s)
+}
+
+// childProcessStateValues returns all values of the enum
+func childProcessStateValues() []childProcessState {
+	return _childProcessStateValues
+}
+
+// IsAchildProcessState returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i childProcessState) IsAchildProcessState() bool {
+	for _, v := range _childProcessStateValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/command/agent/exec/exec.go b/command/agent/exec/exec.go
index 11008786863..715179961ab 100644
--- a/command/agent/exec/exec.go
+++ b/command/agent/exec/exec.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package exec
@@ -26,6 +26,7 @@ import (
 	"golang.org/x/exp/slices"
 )
 
+//go:generate enumer -type=childProcessState -trimprefix=childProcessState
 type childProcessState uint8
 
 const (
diff --git a/command/agent/exec/exec_test.go b/command/agent/exec/exec_test.go
index a825037faa4..6651552bb02 100644
--- a/command/agent/exec/exec_test.go
+++ b/command/agent/exec/exec_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package exec
diff --git a/command/agent/exec/test-app/main.go b/command/agent/exec/test-app/main.go
index db8845aa605..0bffe9583f8 100644
--- a/command/agent/exec/test-app/main.go
+++ b/command/agent/exec/test-app/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/command/agent/internal/ctmanager/runner_config.go b/command/agent/internal/ctmanager/runner_config.go
index 03b134dbcbd..158b08f841b 100644
--- a/command/agent/internal/ctmanager/runner_config.go
+++ b/command/agent/internal/ctmanager/runner_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ctmanager
diff --git a/command/agent/jwt_end_to_end_test.go b/command/agent/jwt_end_to_end_test.go
index 1c8d1c0d50d..6589ebbe488 100644
--- a/command/agent/jwt_end_to_end_test.go
+++ b/command/agent/jwt_end_to_end_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
@@ -11,7 +11,7 @@ import (
 	"testing"
 	"time"
 
-	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-hclog"
 	vaultjwt "github.com/hashicorp/vault-plugin-auth-jwt"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/command/agentproxyshared/auth"
@@ -223,7 +223,7 @@ func testJWTEndToEnd(t *testing.T, ahWrapping, useSymlink, removeJWTAfterReading
 		Client: client,
 	})
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
diff --git a/command/agent/oci_end_to_end_test.go b/command/agent/oci_end_to_end_test.go
index eb5f215ed88..e963264e108 100644
--- a/command/agent/oci_end_to_end_test.go
+++ b/command/agent/oci_end_to_end_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-hclog"
 	vaultoci "github.com/hashicorp/vault-plugin-auth-oci"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/command/agentproxyshared/auth"
@@ -165,7 +165,7 @@ func TestOCIEndToEnd(t *testing.T) {
 		Client: client,
 	})
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
diff --git a/command/agent/template/template.go b/command/agent/template/template.go
index fe88c7332e0..f31891c5f68 100644
--- a/command/agent/template/template.go
+++ b/command/agent/template/template.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Package template is responsible for rendering user supplied templates to
@@ -14,17 +14,21 @@ import (
 	"fmt"
 	"io"
 	"math"
+	"strings"
+	sync "sync/atomic"
 	"time"
 
 	ctconfig "github.com/hashicorp/consul-template/config"
 	"github.com/hashicorp/consul-template/manager"
 	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/command/agent/config"
 	"github.com/hashicorp/vault/command/agent/internal/ctmanager"
 	"github.com/hashicorp/vault/helper/useragent"
 	"github.com/hashicorp/vault/sdk/helper/backoff"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/pointerutil"
+	"github.com/hashicorp/vault/sdk/logical"
 	"go.uber.org/atomic"
 )
 
@@ -90,7 +94,7 @@ func NewServer(conf *ServerConfig) *Server {
 // Run kicks off the internal Consul Template runner, and listens for changes to
 // the token from the AuthHandler. If Done() is called on the context, shut down
 // the Runner and return
-func (ts *Server) Run(ctx context.Context, incoming chan string, templates []*ctconfig.TemplateConfig) error {
+func (ts *Server) Run(ctx context.Context, incoming chan string, templates []*ctconfig.TemplateConfig, tokenRenewalInProgress *sync.Bool, invalidTokenCh chan error) error {
 	if incoming == nil {
 		return errors.New("template server: incoming channel is nil")
 	}
@@ -156,7 +160,6 @@ func (ts *Server) Run(ctx context.Context, incoming chan string, templates []*ct
 		case <-ctx.Done():
 			ts.runner.Stop()
 			return nil
-
 		case token := <-incoming:
 			if token != *latestToken {
 				ts.logger.Info("template server received new token")
@@ -243,6 +246,24 @@ func (ts *Server) Run(ctx context.Context, incoming chan string, templates []*ct
 				ts.runner.Stop()
 				return nil
 			}
+		case err := <-ts.runner.ServerErrCh:
+			var responseError *api.ResponseError
+			ok := errors.As(err, &responseError)
+			if !ok {
+				ts.logger.Error("template server: could not extract error response")
+				continue
+			}
+			if responseError.StatusCode == 403 && strings.Contains(responseError.Error(), logical.ErrInvalidToken.Error()) && !tokenRenewalInProgress.Load() {
+				ts.logger.Info("template server: received invalid token error")
+
+				// Drain the error channel and incoming channel before sending a new error
+				select {
+				case <-invalidTokenCh:
+				case <-incoming:
+				default:
+				}
+				invalidTokenCh <- err
+			}
 		}
 	}
 }
diff --git a/command/agent/template/template_test.go b/command/agent/template/template_test.go
index e03460ec826..1f44b4e5235 100644
--- a/command/agent/template/template_test.go
+++ b/command/agent/template/template_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package template
@@ -11,6 +11,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"strings"
+	sync "sync/atomic"
 	"testing"
 	"time"
 
@@ -387,8 +388,9 @@ func TestServerRun(t *testing.T) {
 			}
 
 			errCh := make(chan error)
+			serverErrCh := make(chan error, 1)
 			go func() {
-				errCh <- server.Run(ctx, templateTokenCh, templatesToRender)
+				errCh <- server.Run(ctx, templateTokenCh, templatesToRender, &sync.Bool{}, serverErrCh)
 			}()
 
 			// send a dummy value to trigger the internal Runner to query for secret
@@ -492,8 +494,9 @@ func TestNewServerLogLevels(t *testing.T) {
 			defer cancel()
 
 			errCh := make(chan error)
+			serverErrCh := make(chan error, 1)
 			go func() {
-				errCh <- server.Run(ctx, templateTokenCh, templatesToRender)
+				errCh <- server.Run(ctx, templateTokenCh, templatesToRender, &sync.Bool{}, serverErrCh)
 			}()
 
 			// send a dummy value to trigger auth so the server will exit
diff --git a/command/agent/testing.go b/command/agent/testing.go
index d8c405490f4..9dca5222253 100644
--- a/command/agent/testing.go
+++ b/command/agent/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
diff --git a/command/agent/token_file_end_to_end_test.go b/command/agent/token_file_end_to_end_test.go
index 7eb8c9a69fc..424dd3a3baf 100644
--- a/command/agent/token_file_end_to_end_test.go
+++ b/command/agent/token_file_end_to_end_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agent
@@ -111,7 +111,7 @@ func TestTokenFileEndToEnd(t *testing.T) {
 		Client: client,
 	})
 	go func() {
-		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config})
+		errCh <- ss.Run(ctx, ah.OutputCh, []*sink.SinkConfig{config}, ah.AuthInProgress)
 	}()
 	defer func() {
 		select {
diff --git a/command/agent_generate_config.go b/command/agent_generate_config.go
index cc394490961..e12047a44d5 100644
--- a/command/agent_generate_config.go
+++ b/command/agent_generate_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/agent_generate_config_test.go b/command/agent_generate_config_test.go
index cbe341f8f36..b0a27583a00 100644
--- a/command/agent_generate_config_test.go
+++ b/command/agent_generate_config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/agent_test.go b/command/agent_test.go
index c87885680f7..ad4185e5d3d 100644
--- a/command/agent_test.go
+++ b/command/agent_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -30,6 +30,7 @@ import (
 	credAppRole "github.com/hashicorp/vault/builtin/credential/approle"
 	"github.com/hashicorp/vault/command/agent"
 	agentConfig "github.com/hashicorp/vault/command/agent/config"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/helper/testhelpers/minimal"
 	"github.com/hashicorp/vault/helper/useragent"
 	vaulthttp "github.com/hashicorp/vault/http"
@@ -91,6 +92,7 @@ func testAgentCommand(tb testing.TB, logger hclog.Logger) (*cli.MockUi, *AgentCo
 		},
 		ShutdownCh: MakeShutdownCh(),
 		SighupCh:   MakeSighupCh(),
+		SigUSR2Ch:  MakeSigUSR2Ch(),
 		logger:     logger,
 		startedCh:  make(chan struct{}, 5),
 		reloadedCh: make(chan struct{}, 5),
@@ -162,23 +164,9 @@ func testAgentExitAfterAuth(t *testing.T, viaFlag bool) {
 	os.Remove(in)
 	t.Logf("input: %s", in)
 
-	sink1f, err := os.CreateTemp("", "sink1.jwt.test.")
-	if err != nil {
-		t.Fatal(err)
-	}
-	sink1 := sink1f.Name()
-	sink1f.Close()
-	os.Remove(sink1)
-	t.Logf("sink1: %s", sink1)
+	sinkFileName1 := makeTempFile(t, "sink-file", "")
 
-	sink2f, err := os.CreateTemp("", "sink2.jwt.test.")
-	if err != nil {
-		t.Fatal(err)
-	}
-	sink2 := sink2f.Name()
-	sink2f.Close()
-	os.Remove(sink2)
-	t.Logf("sink2: %s", sink2)
+	sinkFileName2 := makeTempFile(t, "sink-file", "")
 
 	conff, err := os.CreateTemp("", "conf.jwt.test.")
 	if err != nil {
@@ -228,7 +216,7 @@ auto_auth {
 }
 `
 
-	config = fmt.Sprintf(config, exitAfterAuthTemplText, in, sink1, sink2)
+	config = fmt.Sprintf(config, exitAfterAuthTemplText, in, sinkFileName1, sinkFileName2)
 	if err := os.WriteFile(conf, []byte(config), 0o600); err != nil {
 		t.Fatal(err)
 	} else {
@@ -261,7 +249,7 @@ auto_auth {
 		t.Fatal("timeout reached while waiting for agent to exit")
 	}
 
-	sink1Bytes, err := os.ReadFile(sink1)
+	sink1Bytes, err := os.ReadFile(sinkFileName1)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -269,7 +257,7 @@ auto_auth {
 		t.Fatal("got no output from sink 1")
 	}
 
-	sink2Bytes, err := os.ReadFile(sink2)
+	sink2Bytes, err := os.ReadFile(sinkFileName2)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -359,6 +347,8 @@ listener "tcp" {
     tls_disable = true
     require_request_header = true
 	disable_request_limiter = true
+	# TODO (HCL_DUP_KEYS_DEPRECATION): remove duplicate attribute below
+	disable_request_limiter = true
 }
 `
 	listenAddr1 := generateListenerAddress(t)
@@ -373,8 +363,8 @@ listener "tcp" {
 		listenAddr3,
 	)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
+	t.Setenv(random.AllowHclDuplicatesEnvVar, "true")
 	// Start the agent
 	ui, cmd := testAgentCommand(t, logger)
 	cmd.client = serverClient
@@ -411,6 +401,11 @@ listener "tcp" {
 	// Perform the tests
 	//----------------------------------------------------
 
+	// TODO (HCL_DUP_KEYS_DEPRECATION): Eventually remove this check together with the duplicate attribute in this
+	// test's configuration
+	require.Contains(t, ui.ErrorWriter.String(),
+		"WARNING: Duplicate keys found")
+
 	// Test against a listener configuration that omits
 	// 'require_request_header', with the header missing from the request.
 	agentClient := newApiClient("http://"+listenAddr1, false)
@@ -475,7 +470,6 @@ listener "tcp" {
 `, generateListenerAddress(t))
 
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the agent
 	ui, cmd := testAgentCommand(t, logger)
@@ -489,6 +483,112 @@ listener "tcp" {
 	}
 }
 
+// TestAgent_NoAutoAuthTokenIfNotConfigured tests that API proxy will not use the auto-auth token
+// unless configured to.
+func TestAgent_NoAutoAuthTokenIfNotConfigured(t *testing.T) {
+	logger := logging.NewVaultLogger(hclog.Trace)
+	cluster := minimal.NewTestSoloCluster(t, nil)
+
+	serverClient := cluster.Cores[0].Client
+
+	// Unset the environment variable so that proxy picks up the right test
+	// cluster address
+	defer os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
+	os.Unsetenv(api.EnvVaultAddress)
+
+	// Create token file
+	tokenFileName := makeTempFile(t, "token-file", serverClient.Token())
+
+	sinkFileName := makeTempFile(t, "sink-file", "")
+
+	autoAuthConfig := fmt.Sprintf(`
+auto_auth {
+    method {
+		type = "token_file"
+        config = {
+            token_file_path = "%s"
+        }
+    }
+
+	sink "file" {
+		config = {
+			path = "%s"
+		}
+	}
+}`, tokenFileName, sinkFileName)
+
+	apiProxyConfig := `
+api_proxy {
+	use_auto_auth_token = false
+}
+`
+	listenAddr := generateListenerAddress(t)
+	listenConfig := fmt.Sprintf(`
+listener "tcp" {
+  address = "%s"
+  tls_disable = true
+}
+`, listenAddr)
+
+	config := fmt.Sprintf(`
+vault {
+  address = "%s"
+  tls_skip_verify = true
+}
+%s
+%s
+%s
+`, serverClient.Address(), apiProxyConfig, listenConfig, autoAuthConfig)
+	configPath := makeTempFile(t, "config.hcl", config)
+
+	// Start proxy
+	ui, cmd := testAgentCommand(t, logger)
+	cmd.startedCh = make(chan struct{})
+
+	wg := &sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		code := cmd.Run([]string{"-config", configPath})
+		if code != 0 {
+			t.Errorf("non-zero return code when running agent: %d", code)
+			t.Logf("STDOUT from agent:\n%s", ui.OutputWriter.String())
+			t.Logf("STDERR from agent:\n%s", ui.ErrorWriter.String())
+		}
+		wg.Done()
+	}()
+
+	select {
+	case <-cmd.startedCh:
+	case <-time.After(5 * time.Second):
+		t.Errorf("timeout")
+	}
+
+	proxyClient, err := api.NewClient(api.DefaultConfig())
+	if err != nil {
+		t.Fatal(err)
+	}
+	proxyClient.SetToken("")
+	err = proxyClient.SetAddress("http://" + listenAddr)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Wait for the sink to be populated.
+	// Realistically won't be this long, but keeping it long just in case, for CI.
+	time.Sleep(10 * time.Second)
+
+	secret, err := proxyClient.Auth().Token().CreateOrphan(&api.TokenCreateRequest{
+		Policies: []string{"default"},
+		TTL:      "30m",
+	})
+	if secret != nil || err == nil {
+		t.Fatal("expected this to fail, since without a token you should not be able to make a token")
+	}
+
+	close(cmd.ShutdownCh)
+	wg.Wait()
+}
+
 // TestAgent_Template_UserAgent Validates that the User-Agent sent to Vault
 // as part of Templating requests is correct. Uses the custom handler
 // userAgentHandler struct defined in this test package, so that Vault validates the
@@ -588,7 +688,6 @@ auto_auth {
 
 	config = fmt.Sprintf(config, serverClient.Address(), roleIDPath, secretIDPath, templateConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the agent
 	ui, cmd := testAgentCommand(t, logger)
@@ -793,7 +892,6 @@ auto_auth {
 
 			config = fmt.Sprintf(config, serverClient.Address(), roleIDPath, secretIDPath, templateConfig, exitAfterAuth)
 			configPath := makeTempFile(t, "config.hcl", config)
-			defer os.Remove(configPath)
 
 			// Start the agent
 			ui, cmd := testAgentCommand(t, logger)
@@ -919,10 +1017,6 @@ func setupAppRole(t *testing.T, serverClient *api.Client) (string, string) {
 	// Write the RoleID and SecretID to temp files
 	roleIDPath := makeTempFile(t, "role_id.txt", roleID+"\n")
 	secretIDPath := makeTempFile(t, "secret_id.txt", secretID+"\n")
-	t.Cleanup(func() {
-		os.Remove(roleIDPath)
-		os.Remove(secretIDPath)
-	})
 
 	return roleIDPath, secretIDPath
 }
@@ -1071,7 +1165,6 @@ auto_auth {
 
 			config = fmt.Sprintf(config, roleIDPath, secretIDPath, templateConfig)
 			configPath := makeTempFile(t, "config.hcl", config)
-			defer os.Remove(configPath)
 
 			// Start the agent
 			ui, cmd := testAgentCommand(t, logger)
@@ -1248,7 +1341,6 @@ exit_after_auth = true
 
 	config = fmt.Sprintf(config, serverClient.Address(), roleIDPath, secretIDPath, tmpDir, tmpDir, tmpDir)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the agent
 	ui, cmd := testAgentCommand(t, logger)
@@ -1358,19 +1450,33 @@ func request(t *testing.T, client *api.Client, req *api.Request, expectedStatusC
 	return body
 }
 
-// makeTempFile creates a temp file and populates it.
+// makeTempFile creates a temp file with the specified name, populates it with the
+// supplied contents and closes it. The path to the file is returned, also the file
+// will be automatically removed when the test which created it, finishes.
 func makeTempFile(t *testing.T, name, contents string) string {
 	t.Helper()
-	f, err := os.CreateTemp("", name)
+
+	f, err := os.Create(filepath.Join(t.TempDir(), name))
 	if err != nil {
 		t.Fatal(err)
 	}
 	path := f.Name()
-	f.WriteString(contents)
-	f.Close()
+
+	_, err = f.WriteString(contents)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = f.Close()
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	return path
 }
 
+// populateTempFile creates a temp file with the specified name, populates it with the
+// supplied contents and closes it. The file pointer is returned.
 func populateTempFile(t *testing.T, name, contents string) *os.File {
 	t.Helper()
 
@@ -1471,8 +1577,7 @@ func TestAgent_Template_Retry(t *testing.T) {
 	defer os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
 	os.Unsetenv(api.EnvVaultAddress)
 
-	methodConf, cleanup := prepAgentApproleKV(t, serverClient)
-	defer cleanup()
+	methodConf := prepAgentApproleKV(t, serverClient)
 
 	err := serverClient.Sys().TuneMount("secret", api.MountConfigInput{
 		Options: map[string]string{
@@ -1575,7 +1680,6 @@ template_config {
 `, methodConf, serverClient.Address(), retryConf, templateConfig)
 
 			configPath := makeTempFile(t, "config.hcl", config)
-			defer os.Remove(configPath)
 
 			// Start the agent
 			_, cmd := testAgentCommand(t, logger)
@@ -1655,7 +1759,7 @@ template_config {
 // such that the resulting token will have global permissions across /kv
 // and /secret mounts.  Returns the auto_auth config stanza to setup an Agent
 // to connect using approle.
-func prepAgentApproleKV(t *testing.T, client *api.Client) (string, func()) {
+func prepAgentApproleKV(t *testing.T, client *api.Client) string {
 	t.Helper()
 
 	policyAutoAuthAppRole := `
@@ -1716,11 +1820,7 @@ auto_auth {
 }
 `, roleIDFile, secretIDFile)
 
-	cleanup := func() {
-		_ = os.Remove(roleIDFile)
-		_ = os.Remove(secretIDFile)
-	}
-	return config, cleanup
+	return config
 }
 
 // TestAgent_AutoAuth_UserAgent tests that the User-Agent sent
@@ -1754,13 +1854,7 @@ func TestAgent_AutoAuth_UserAgent(t *testing.T) {
 	// Enable the approle auth method
 	roleIDPath, secretIDPath := setupAppRole(t, serverClient)
 
-	sinkf, err := os.CreateTemp("", "sink.test.")
-	if err != nil {
-		t.Fatal(err)
-	}
-	sink := sinkf.Name()
-	sinkf.Close()
-	os.Remove(sink)
+	sinkFileName := makeTempFile(t, "sink-file", "")
 
 	autoAuthConfig := fmt.Sprintf(`
 auto_auth {
@@ -1777,7 +1871,7 @@ auto_auth {
 			path = "%s"
 		}
 	}
-}`, roleIDPath, secretIDPath, sink)
+}`, roleIDPath, secretIDPath, sinkFileName)
 
 	listenAddr := generateListenerAddress(t)
 	listenConfig := fmt.Sprintf(`
@@ -1799,7 +1893,6 @@ api_proxy {
 %s
 `, serverClient.Address(), listenConfig, autoAuthConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Unset the environment variable so that agent picks up the right test
 	// cluster address
@@ -1895,7 +1988,6 @@ vault {
 %s
 `, serverClient.Address(), listenConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the agent
 	_, cmd := testAgentCommand(t, logger)
@@ -1987,7 +2079,6 @@ vault {
 %s
 `, serverClient.Address(), listenConfig, cacheConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the agent
 	_, cmd := testAgentCommand(t, logger)
@@ -2063,7 +2154,6 @@ vault {
 %s
 `, serverClient.Address(), cacheConfig, listenConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the agent
 	_, cmd := testAgentCommand(t, logger)
@@ -2234,7 +2324,6 @@ vault {
 %s
 `, serverClient.Address(), retryConf, cacheConfig, listenConfig)
 			configPath := makeTempFile(t, "config.hcl", config)
-			defer os.Remove(configPath)
 
 			// Start the agent
 			_, cmd := testAgentCommand(t, logger)
@@ -2313,8 +2402,7 @@ func TestAgent_TemplateConfig_ExitOnRetryFailure(t *testing.T) {
 	defer os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
 	os.Unsetenv(api.EnvVaultAddress)
 
-	autoAuthConfig, cleanup := prepAgentApproleKV(t, serverClient)
-	defer cleanup()
+	autoAuthConfig := prepAgentApproleKV(t, serverClient)
 
 	err := serverClient.Sys().TuneMount("secret", api.MountConfigInput{
 		Options: map[string]string{
@@ -2498,7 +2586,6 @@ vault {
 `, autoAuthConfig, serverClient.Address(), listenConfig, templateConfig, template)
 
 			configPath := makeTempFile(t, "config.hcl", config)
-			defer os.Remove(configPath)
 
 			// Start the agent
 			ui, cmd := testAgentCommand(t, logger)
@@ -2613,7 +2700,6 @@ listener "tcp" {
 }
 `, listenAddr)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the agent
 	ui, cmd := testAgentCommand(t, logging.NewVaultLogger(hclog.Trace))
@@ -2709,7 +2795,6 @@ cache {}
 `, serverClient.Address(), listenAddr, listenAddr2)
 
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the agent
 	_, cmd := testAgentCommand(t, nil)
@@ -3031,6 +3116,40 @@ func TestAgent_Config_ReloadTls(t *testing.T) {
 	}
 }
 
+// TestAgent_Config_HclDuplicateKey checks that a log warning is printed when the agent config has duplicate attributes
+// TODO (HCL_DUP_KEYS_DEPRECATION): always expect error once deprecation is done
+func TestAgent_Config_HclDuplicateKey(t *testing.T) {
+	t.Run("duplicate error with env unset", func(t *testing.T) {
+		configFile := populateTempFile(t, "agent-config.hcl", `
+log_level = "trace"
+log_level = "debug"
+`)
+		_, _, err := agentConfig.LoadConfigFileCheckDuplicates(configFile.Name())
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "Each argument can only be defined once")
+	})
+	t.Run("duplicate error with env set to false", func(t *testing.T) {
+		configFile := populateTempFile(t, "agent-config.hcl", `
+log_level = "trace"
+log_level = "debug"
+`)
+		t.Setenv(random.AllowHclDuplicatesEnvVar, "false")
+		_, _, err := agentConfig.LoadConfigFileCheckDuplicates(configFile.Name())
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "Each argument can only be defined once")
+	})
+	t.Run("duplicate warning with env set to true", func(t *testing.T) {
+		configFile := populateTempFile(t, "agent-config.hcl", `
+log_level = "trace"
+log_level = "debug"
+`)
+		t.Setenv(random.AllowHclDuplicatesEnvVar, "true")
+		_, duplicate, err := agentConfig.LoadConfigFileCheckDuplicates(configFile.Name())
+		require.NoError(t, err)
+		require.True(t, duplicate)
+	})
+}
+
 // TestAgent_NonTLSListener_SIGHUP tests giving a SIGHUP signal to a listener
 // without a TLS configuration. Prior to fixing GitHub issue #19480, this
 // would cause a panic.
@@ -3065,7 +3184,6 @@ vault {
 %s
 `, serverClient.Address(), listenConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the agent
 	ui, cmd := testAgentCommand(t, logger)
@@ -3105,6 +3223,143 @@ vault {
 	}
 }
 
+// TestAgent_TokenRenewal tests that LifeTimeWatcher does not make
+// many renewal attempts if the token's policy does not allow for it to renew
+// itself. Prior to a bug fix in the PR that added this test, this would have resulted
+// in hundreds of token renewal requests with no backoff.
+func TestAgent_TokenRenewal(t *testing.T) {
+	logger := logging.NewVaultLogger(hclog.Trace)
+	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	serverClient := cluster.Cores[0].Client
+
+	auditLogFileName := makeTempFile(t, "audit-log", "")
+	err := serverClient.Sys().EnableAuditWithOptions("file-audit-for-TestAgent_TokenRenewal", &api.EnableAuditOptions{
+		Type: "file",
+		Options: map[string]string{
+			"file_path": auditLogFileName,
+		},
+	})
+	require.NoError(t, err)
+
+	// Unset the environment variable so that agent picks up the right test
+	// cluster address
+	defer os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
+	os.Unsetenv(api.EnvVaultAddress)
+
+	policyName := "less-than-default"
+	// Has a subset of the default policy's permissions
+	// Specifically removing renew-self.
+	err = serverClient.Sys().PutPolicy(policyName, `
+path "auth/token/lookup-self" {
+    capabilities = ["read"]
+}
+
+# Allow tokens to revoke themselves
+path "auth/token/revoke-self" {
+    capabilities = ["update"]
+}
+
+# Allow a token to look up its own capabilities on a path
+path "sys/capabilities-self" {
+    capabilities = ["update"]
+}
+`)
+	require.NoError(t, err)
+
+	renewable := true
+	// Make the token renewable but give it no permissions
+	// (e.g. the permission to renew itself)
+	tokenCreateRequest := &api.TokenCreateRequest{
+		Policies:        []string{policyName},
+		TTL:             "10s",
+		Renewable:       &renewable,
+		NoDefaultPolicy: true,
+	}
+
+	secret, err := serverClient.Auth().Token().CreateOrphan(tokenCreateRequest)
+	require.NoError(t, err)
+	lowPermissionToken := secret.Auth.ClientToken
+
+	tokenFileName := makeTempFile(t, "token-file", lowPermissionToken)
+
+	sinkFileName := makeTempFile(t, "sink-file", "")
+
+	autoAuthConfig := fmt.Sprintf(`
+auto_auth {
+    method {
+		type = "token_file"
+        config = {
+            token_file_path = "%s"
+        }
+    }
+
+	sink "file" {
+		config = {
+			path = "%s"
+		}
+	}
+}`, tokenFileName, sinkFileName)
+
+	config := fmt.Sprintf(`
+vault {
+  address = "%s"
+  tls_skip_verify = true
+}
+
+log_level = "trace"
+
+%s
+`, serverClient.Address(), autoAuthConfig)
+	configPath := makeTempFile(t, "config.hcl", config)
+
+	// Start the agent
+	ui, cmd := testAgentCommand(t, logger)
+
+	cmd.startedCh = make(chan struct{})
+
+	wg := &sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		cmd.Run([]string{"-config", configPath})
+		wg.Done()
+	}()
+
+	select {
+	case <-cmd.startedCh:
+	case <-time.After(5 * time.Second):
+		t.Errorf("timeout")
+		t.Errorf("stdout: %s", ui.OutputWriter.String())
+		t.Errorf("stderr: %s", ui.ErrorWriter.String())
+	}
+
+	// Sleep, to allow the renewal/auth process to work and ensure that it doesn't
+	// go crazy with renewals.
+	time.Sleep(30 * time.Second)
+
+	fileBytes, err := os.ReadFile(auditLogFileName)
+	require.NoError(t, err)
+	stringAudit := string(fileBytes)
+
+	// This is a bit of an imperfect way to test things, but we want to make sure
+	// that a token like this doesn't keep triggering retries.
+	// Due to the fact this is an auto-auth specific thing, unit tests for the
+	// LifetimeWatcher wouldn't be sufficient here.
+	// Prior to the fix made in the same PR this test was added, it would trigger many, many
+	// retries (hundreds to thousands in less than a minute).
+	// We really want to make sure that doesn't happen.
+	numberOfRenewSelves := strings.Count(stringAudit, "auth/token/renew-self")
+	// We actually expect ~6, but I added some buffer for CI weirdness. It can also vary
+	// due to the grace added/removed from the sleep in LifetimeWatcher too.
+	if numberOfRenewSelves > 10 {
+		t.Fatalf("did too many renews -- Vault received %d renew-self requests", numberOfRenewSelves)
+	}
+}
+
 // TestAgent_Logging_ConsulTemplate attempts to ensure two things about Vault Agent logs:
 // 1. When -log-format command line arg is set to JSON, it is honored as the output format
 // for messages generated from within the consul-template library.
@@ -3258,7 +3513,6 @@ func TestAgent_DeleteAfterVersion_Rendering(t *testing.T) {
 	require.NoError(t, err)
 
 	tokenFileName := makeTempFile(t, "token-file", serverClient.Token())
-	defer os.Remove(tokenFileName)
 
 	autoAuthConfig := fmt.Sprintf(`
 auto_auth {
@@ -3292,7 +3546,6 @@ template {
 
 	config = fmt.Sprintf(config, serverClient.Address(), autoAuthConfig, templateConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the agent
 	ui, cmd := testAgentCommand(t, logger)
@@ -3359,6 +3612,113 @@ template {
 	}
 }
 
+// TestAgent_Config_AddrConformance verifies that the vault address is correctly
+// normalized to conform to RFC-5942 §4 when configured by a config file,
+// environment variables, or CLI flags.
+// See: https://rfc-editor.org/rfc/rfc5952.html
+func TestAgent_Config_AddrConformance(t *testing.T) {
+	for name, test := range map[string]struct {
+		args     []string
+		envVars  map[string]string
+		cfg      string
+		expected *agentConfig.Config
+	}{
+		"ipv4 config": {
+			cfg: `
+vault {
+  address = "https://127.0.0.1:8200"
+}`,
+			expected: &agentConfig.Config{
+				Vault: &agentConfig.Vault{
+					Address: "https://127.0.0.1:8200",
+				},
+			},
+		},
+		"ipv6 config": {
+			cfg: `
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}`,
+			expected: &agentConfig.Config{
+				Vault: &agentConfig.Vault{
+					// Use the normalized version in the config
+					Address: "https://[2001:db8::1]:8200",
+				},
+			},
+		},
+		"ipv6 cli arg overrides": {
+			args: []string{"-address=https://[2001:0:0:1:0:0:0:1]:8200"},
+			cfg: `
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}`,
+			expected: &agentConfig.Config{
+				Vault: &agentConfig.Vault{
+					// Use a normalized version of the args address
+					Address: "https://[2001:0:0:1::1]:8200",
+				},
+			},
+		},
+		"ipv6 env var overrides": {
+			envVars: map[string]string{
+				"VAULT_ADDR": "https://[2001:DB8:AC3:FE4::1]:8200",
+			},
+			cfg: `
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}`,
+			expected: &agentConfig.Config{
+				Vault: &agentConfig.Vault{
+					// Use a normalized version of the env var address
+					Address: "https://[2001:db8:ac3:fe4::1]:8200",
+				},
+			},
+		},
+		"ipv6 all uses cli overrides": {
+			args: []string{"-address=https://[2001:0:0:1:0:0:0:1]:8200"},
+			envVars: map[string]string{
+				"VAULT_ADDR": "https://[2001:DB8:AC3:FE4::1]:8200",
+			},
+			cfg: `
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}`,
+			expected: &agentConfig.Config{
+				Vault: &agentConfig.Vault{
+					// Use a normalized version of the args address
+					Address: "https://[2001:0:0:1::1]:8200",
+				},
+			},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			// In CI our tests are run with VAULT_ADDR=, which will break our tests
+			// because it'll default to an unset address. Ensure that's cleared out
+			// of the environment.
+			t.Cleanup(func() {
+				os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
+			})
+			os.Unsetenv(api.EnvVaultAddress)
+			for k, v := range test.envVars {
+				t.Setenv(k, v)
+			}
+
+			configFile := populateTempFile(t, "agent-"+strings.ReplaceAll(name, " ", "-"), test.cfg)
+			cfg, err := agentConfig.LoadConfigFile(configFile.Name())
+			require.NoError(t, err)
+			require.NotEmptyf(t, cfg.Vault.Address, "agent config is missing address: %+v", cfg.Vault)
+
+			cmd := &AgentCommand{BaseCommand: &BaseCommand{}}
+			f := cmd.Flags()
+			args := append([]string{}, test.args...)
+			require.NoError(t, f.Parse(args))
+
+			cmd.applyConfigOverrides(f, cfg)
+			require.Equalf(t, test.expected.Vault.Address, cfg.Vault.Address, "agent config is missing address: config: %+v, flags: %+v", cfg.Vault, f)
+		})
+	}
+}
+
 // Get a randomly assigned port and then free it again before returning it.
 // There is still a race when trying to use it, but should work better
 // than a static port.
@@ -3366,9 +3726,7 @@ func generateListenerAddress(t *testing.T) string {
 	t.Helper()
 
 	ln1, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	listenAddr := ln1.Addr().String()
 	ln1.Close()
 	return listenAddr
diff --git a/command/agentproxyshared/auth/alicloud/alicloud.go b/command/agentproxyshared/auth/alicloud/alicloud.go
index d700bc02fa2..a9d0538c946 100644
--- a/command/agentproxyshared/auth/alicloud/alicloud.go
+++ b/command/agentproxyshared/auth/alicloud/alicloud.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package alicloud
diff --git a/command/agentproxyshared/auth/approle/approle.go b/command/agentproxyshared/auth/approle/approle.go
index ef32d493cd0..e0218ca6134 100644
--- a/command/agentproxyshared/auth/approle/approle.go
+++ b/command/agentproxyshared/auth/approle/approle.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
diff --git a/command/agentproxyshared/auth/auth.go b/command/agentproxyshared/auth/auth.go
index 7c22f36d58f..197cd255a2d 100644
--- a/command/agentproxyshared/auth/auth.go
+++ b/command/agentproxyshared/auth/auth.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package auth
@@ -7,9 +7,11 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"math"
 	"math/rand"
 	"net/http"
+	"sync/atomic"
 	"time"
 
 	"github.com/armon/go-metrics"
@@ -51,6 +53,8 @@ type AuthHandler struct {
 	OutputCh                     chan string
 	TemplateTokenCh              chan string
 	ExecTokenCh                  chan string
+	AuthInProgress               *atomic.Bool
+	InvalidToken                 chan error
 	token                        string
 	userAgent                    string
 	metricsSignifier             string
@@ -92,6 +96,8 @@ func NewAuthHandler(conf *AuthHandlerConfig) *AuthHandler {
 		OutputCh:                     make(chan string, 1),
 		TemplateTokenCh:              make(chan string, 1),
 		ExecTokenCh:                  make(chan string, 1),
+		InvalidToken:                 make(chan error, 1),
+		AuthInProgress:               &atomic.Bool{},
 		token:                        conf.Token,
 		logger:                       conf.Logger,
 		client:                       conf.Client,
@@ -139,12 +145,18 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 	backoffCfg := newAutoAuthBackoff(ah.minBackoff, ah.maxBackoff, ah.exitOnError)
 
 	ah.logger.Info("starting auth handler")
+
+	// Set unauthenticated when starting up
+	metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
+
 	defer func() {
 		am.Shutdown()
 		close(ah.OutputCh)
 		close(ah.TemplateTokenCh)
 		close(ah.ExecTokenCh)
 		ah.logger.Info("auth handler stopped")
+		// Set unauthenticated when shutting down
+		metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 	}()
 
 	credCh := am.NewCreds()
@@ -180,6 +192,17 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 	first := true
 
 	for {
+		// We will unset this bool in sink.go once the token has been written to
+		// any sinks, or the sink server stops
+		ah.AuthInProgress.Store(true)
+		// Drain any Invalid Token errors from the channel that could have been sent before AuthInProgress
+		// was set to true
+		select {
+		case <-ah.InvalidToken:
+			ah.logger.Info("renewal already in progress, draining extra auth renewal triggers")
+		default:
+			// Do nothing, keep going
+		}
 		select {
 		case <-ctx.Done():
 			return nil
@@ -200,6 +223,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 			if err != nil {
 				ah.logger.Error("error creating client for authentication call", "error", err, "backoff", backoffCfg)
 				metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+				// Set unauthenticated when authentication fails
+				metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 				if backoffSleep(ctx, backoffCfg) {
 					continue
@@ -227,6 +252,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 			if err != nil {
 				ah.logger.Error("could not look up token", "err", err, "backoff", backoffCfg)
 				metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+				// Set unauthenticated when authentication fails
+				metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 				if backoffSleep(ctx, backoffCfg) {
 					continue
@@ -247,6 +274,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 			if err != nil {
 				ah.logger.Error("error getting path or data from method", "error", err, "backoff", backoffCfg)
 				metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+				// Set unauthenticated when authentication fails
+				metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 				if backoffSleep(ctx, backoffCfg) {
 					continue
@@ -260,6 +289,7 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 			if err != nil {
 				ah.logger.Error("error creating client for wrapped call", "error", err, "backoff", backoffCfg)
 				metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+				metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 				if backoffSleep(ctx, backoffCfg) {
 					continue
@@ -283,10 +313,11 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 			isTokenFileMethod = path == "auth/token/lookup-self"
 			if isTokenFileMethod {
 				token, _ := data["token"].(string)
-				lookupSelfClient, err := clientToUse.CloneWithHeaders()
-				if err != nil {
+				// The error is called clientErr as to not shadow the other err above it.
+				lookupSelfClient, clientErr := clientToUse.CloneWithHeaders()
+				if clientErr != nil {
 					ah.logger.Error("failed to clone client to perform token lookup")
-					return err
+					return clientErr
 				}
 				lookupSelfClient.SetToken(token)
 				secret, err = lookupSelfClient.Auth().Token().LookupSelf()
@@ -298,6 +329,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 			if err != nil {
 				ah.logger.Error("error authenticating", "error", err, "backoff", backoffCfg)
 				metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+				// Set unauthenticated when authentication fails
+				metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 				if backoffSleep(ctx, backoffCfg) {
 					continue
@@ -313,6 +346,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 			if secret.WrapInfo == nil {
 				ah.logger.Error("authentication returned nil wrap info", "backoff", backoffCfg)
 				metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+				// Set unauthenticated when authentication fails
+				metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 				if backoffSleep(ctx, backoffCfg) {
 					continue
@@ -322,6 +357,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 			if secret.WrapInfo.Token == "" {
 				ah.logger.Error("authentication returned empty wrapped client token", "backoff", backoffCfg)
 				metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+				// Set unauthenticated when authentication fails
+				metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 				if backoffSleep(ctx, backoffCfg) {
 					continue
@@ -332,6 +369,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 			if err != nil {
 				ah.logger.Error("failed to encode wrapinfo", "error", err, "backoff", backoffCfg)
 				metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+				// Set unauthenticated when authentication fails
+				metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 				if backoffSleep(ctx, backoffCfg) {
 					continue
@@ -371,6 +410,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 				if secret == nil || secret.Data == nil {
 					ah.logger.Error("token file validation failed, token may be invalid", "backoff", backoffCfg)
 					metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+					// Set unauthenticated when authentication fails
+					metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 					if backoffSleep(ctx, backoffCfg) {
 						continue
@@ -381,6 +422,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 				if !ok || token == "" {
 					ah.logger.Error("token file validation returned empty client token", "backoff", backoffCfg)
 					metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+					// Set unauthenticated when authentication fails
+					metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 					if backoffSleep(ctx, backoffCfg) {
 						continue
@@ -397,6 +440,7 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 					Renewable:     renewable,
 				}
 				ah.logger.Info("authentication successful, sending token to sinks")
+
 				ah.OutputCh <- token
 				if ah.enableTemplateTokenCh {
 					ah.TemplateTokenCh <- token
@@ -413,6 +457,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 				if secret == nil || secret.Auth == nil {
 					ah.logger.Error("authentication returned nil auth info", "backoff", backoffCfg)
 					metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+					// Set unauthenticated when authentication fails
+					metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 					if backoffSleep(ctx, backoffCfg) {
 						continue
@@ -422,6 +468,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 				if secret.Auth.ClientToken == "" {
 					ah.logger.Error("authentication returned empty client token", "backoff", backoffCfg)
 					metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+					// Set unauthenticated when authentication fails
+					metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 					if backoffSleep(ctx, backoffCfg) {
 						continue
@@ -454,6 +502,8 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 		if err != nil {
 			ah.logger.Error("error creating lifetime watcher", "error", err, "backoff", backoffCfg)
 			metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
+			// Set unauthenticated when authentication fails
+			metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
 
 			if backoffSleep(ctx, backoffCfg) {
 				continue
@@ -462,10 +512,10 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 		}
 
 		metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "success"}, 1)
-		// We don't want to trigger the renewal process for tokens with
-		// unlimited TTL, such as the root token.
-		if leaseDuration == 0 && isTokenFileMethod {
-			ah.logger.Info("not starting token renewal process, as token has unlimited TTL")
+		metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 1)
+		// We don't want to trigger the renewal process for the root token
+		if isRootToken(leaseDuration, isTokenFileMethod, secret) {
+			ah.logger.Info("not starting token renewal process, as token is root token")
 		} else {
 			ah.logger.Info("starting renewal process")
 			go watcher.Renew()
@@ -480,23 +530,67 @@ func (ah *AuthHandler) Run(ctx context.Context, am AuthMethod) error {
 				break LifetimeWatcherLoop
 
 			case err := <-watcher.DoneCh():
-				ah.logger.Info("lifetime watcher done channel triggered")
+				ah.logger.Info("lifetime watcher done channel triggered, re-authenticating")
 				if err != nil {
+					ah.logger.Error("error renewing token", "error", err, "backoff", backoffCfg)
 					metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "failure"}, 1)
-					ah.logger.Error("error renewing token", "error", err)
+					// Set unauthenticated when authentication fails
+					metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 0)
+
+					// Add some exponential backoff so that if auth is successful
+					// but the watcher errors, we won't go into an immediate
+					// aggressive retry loop.
+					// This might be quite a small sleep, since if we have a successful
+					// auth, we reset the backoff. Still, some backoff is important, and
+					// ensuring we follow the normal flow is important:
+					// auth -> try to renew
+					if !backoffSleep(ctx, backoffCfg) {
+						// We're at max retries. Return an error.
+						return fmt.Errorf("exceeded max retries failing to renew auth token")
+					}
+				}
+
+				// If the lease duration is 0, wait a second before re-authenticating
+				// so that we don't go into a loop, as the LifetimeWatcher will immediately
+				// return for tokens like this.
+				if leaseDuration == 0 {
+					time.Sleep(1 * time.Second)
 				}
+
 				break LifetimeWatcherLoop
 
 			case <-watcher.RenewCh():
 				metrics.IncrCounter([]string{ah.metricsSignifier, "auth", "success"}, 1)
+				// Set authenticated when authentication succeeds
+				metrics.SetGauge([]string{ah.metricsSignifier, "authenticated"}, 1)
 				ah.logger.Info("renewed auth token")
-
 			case <-credCh:
 				ah.logger.Info("auth method found new credentials, re-authenticating")
 				break LifetimeWatcherLoop
+			case <-ah.InvalidToken:
+				ah.logger.Info("invalid token found, re-authenticating")
+				break LifetimeWatcherLoop
+			}
+		}
+	}
+}
+
+// isRootToken checks if the secret in the argument is the root token
+// This is determinable without leaseDuration and isTokenFileMethod,
+// but those make it easier to rule out other tokens cheaply.
+func isRootToken(leaseDuration int, isTokenFileMethod bool, secret *api.Secret) bool {
+	// This check is cheaper than the others, so we do this first.
+	if leaseDuration == 0 && isTokenFileMethod && !secret.Renewable {
+		if secret != nil {
+			policies, err := secret.TokenPolicies()
+			if err == nil {
+				if len(policies) == 1 && policies[0] == "root" {
+					return true
+				}
 			}
 		}
 	}
+	return false
 }
 
 // autoAuthBackoff tracks exponential backoff state.
diff --git a/command/agentproxyshared/auth/auth_test.go b/command/agentproxyshared/auth/auth_test.go
index b866b317dcd..e344f9d7bbf 100644
--- a/command/agentproxyshared/auth/auth_test.go
+++ b/command/agentproxyshared/auth/auth_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package auth
diff --git a/command/agentproxyshared/auth/aws/aws.go b/command/agentproxyshared/auth/aws/aws.go
index 13ab7e48338..c08e94cd763 100644
--- a/command/agentproxyshared/auth/aws/aws.go
+++ b/command/agentproxyshared/auth/aws/aws.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aws
diff --git a/command/agentproxyshared/auth/azure/azure.go b/command/agentproxyshared/auth/azure/azure.go
index 00e8fea6e29..5132a48b1b4 100644
--- a/command/agentproxyshared/auth/azure/azure.go
+++ b/command/agentproxyshared/auth/azure/azure.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package azure
diff --git a/command/agentproxyshared/auth/azure/azure_test.go b/command/agentproxyshared/auth/azure/azure_test.go
index 0c9b9985d02..cfe05b9d89a 100644
--- a/command/agentproxyshared/auth/azure/azure_test.go
+++ b/command/agentproxyshared/auth/azure/azure_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package azure
diff --git a/command/agentproxyshared/auth/cert/cert.go b/command/agentproxyshared/auth/cert/cert.go
index fabe9a6365f..abab2db6385 100644
--- a/command/agentproxyshared/auth/cert/cert.go
+++ b/command/agentproxyshared/auth/cert/cert.go
@@ -1,18 +1,25 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
 
 import (
 	"context"
+	"crypto/tls"
+	"encoding/hex"
 	"errors"
 	"fmt"
 	"net/http"
+	"os"
+	"sync"
+	"time"
 
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/command/agentproxyshared/auth"
 	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/helper/parseutil"
+	"golang.org/x/crypto/blake2b"
 )
 
 type certMethod struct {
@@ -27,6 +34,14 @@ type certMethod struct {
 
 	// Client is the cached client to use if cert info was provided.
 	client *api.Client
+
+	stopCh          chan struct{}
+	doneCh          chan struct{}
+	credSuccessGate chan struct{}
+	ticker          *time.Ticker
+	once            *sync.Once
+	credsFound      chan struct{}
+	latestHash      *string
 }
 
 var _ auth.AuthMethodWithClient = &certMethod{}
@@ -38,10 +53,17 @@ func NewCertAuthMethod(conf *auth.AuthConfig) (auth.AuthMethod, error) {
 
 	// Not concerned if the conf.Config is empty as the 'name'
 	// parameter is optional when using TLS Auth
-
+	lastHash := ""
 	c := &certMethod{
 		logger:    conf.Logger,
 		mountPath: conf.MountPath,
+
+		stopCh:          make(chan struct{}),
+		doneCh:          make(chan struct{}),
+		credSuccessGate: make(chan struct{}),
+		once:            new(sync.Once),
+		credsFound:      make(chan struct{}),
+		latestHash:      &lastHash,
 	}
 
 	if conf.Config != nil {
@@ -87,6 +109,20 @@ func NewCertAuthMethod(conf *auth.AuthConfig) (auth.AuthMethod, error) {
 		}
 	}
 
+	if c.isCertConfigured() && c.reload {
+		reloadPeriod := time.Minute
+		if reloadPeriodRaw, ok := conf.Config["reload_period"]; ok {
+			period, err := parseutil.ParseDurationSecond(reloadPeriodRaw)
+			if err != nil {
+				return nil, fmt.Errorf("error parsing 'reload_period' value: %w", err)
+			}
+			reloadPeriod = period
+		}
+		c.ticker = time.NewTicker(reloadPeriod)
+
+		go c.runWatcher()
+	}
+
 	return c, nil
 }
 
@@ -103,12 +139,26 @@ func (c *certMethod) Authenticate(_ context.Context, client *api.Client) (string
 }
 
 func (c *certMethod) NewCreds() chan struct{} {
-	return nil
+	return c.credsFound
 }
 
-func (c *certMethod) CredSuccess() {}
+func (c *certMethod) CredSuccess() {
+	c.once.Do(func() {
+		close(c.credSuccessGate)
+	})
+}
 
-func (c *certMethod) Shutdown() {}
+func (c *certMethod) Shutdown() {
+	if c.isCertConfigured() && c.reload {
+		c.ticker.Stop()
+		close(c.stopCh)
+		<-c.doneCh
+	}
+}
+
+func (c *certMethod) isCertConfigured() bool {
+	return c.caCert != "" || (c.clientKey != "" && c.clientCert != "")
+}
 
 // AuthClient uses the existing client's address and returns a new client with
 // the auto-auth method's certificate information if that's provided in its
@@ -118,7 +168,7 @@ func (c *certMethod) AuthClient(client *api.Client) (*api.Client, error) {
 
 	clientToAuth := client
 
-	if c.caCert != "" || (c.clientKey != "" && c.clientCert != "") {
+	if c.isCertConfigured() {
 		// Return cached client if present
 		if c.client != nil && !c.reload {
 			return c.client, nil
@@ -141,6 +191,13 @@ func (c *certMethod) AuthClient(client *api.Client) (*api.Client, error) {
 			return nil, err
 		}
 
+		// set last hash if load it successfully
+		if hash, err := c.hashCert(c.clientCert, c.clientKey, c.caCert); err != nil {
+			return nil, err
+		} else {
+			c.latestHash = &hash
+		}
+
 		var err error
 		clientToAuth, err = api.NewClient(config)
 		if err != nil {
@@ -156,3 +213,95 @@ func (c *certMethod) AuthClient(client *api.Client) (*api.Client, error) {
 
 	return clientToAuth, nil
 }
+
+// hashCert returns reads and verifies the given cert/key pair and return the hashing result
+// in string representation. Otherwise, returns an error.
+// As the pair of cert/key and ca cert are optional because they may be configured externally
+// or use system default ca bundle, empty paths are simply skipped.
+// A valid hashing result means:
+// 1. All presented files are readable.
+// 2. The client cert/key pair is valid if presented.
+// 3. Any presented file in this bundle changed, the hash changes.
+func (c *certMethod) hashCert(certFile, keyFile, caFile string) (string, error) {
+	var buf []byte
+	if certFile != "" && keyFile != "" {
+		certPEMBlock, err := os.ReadFile(certFile)
+		if err != nil {
+			return "", err
+		}
+		c.logger.Debug("Loaded cert file", "file", certFile, "length", len(certPEMBlock))
+
+		keyPEMBlock, err := os.ReadFile(keyFile)
+		if err != nil {
+			return "", err
+		}
+		c.logger.Debug("Loaded key file", "file", keyFile, "length", len(keyPEMBlock))
+
+		// verify
+		_, err = tls.X509KeyPair(certPEMBlock, keyPEMBlock)
+		if err != nil {
+			return "", err
+		}
+		c.logger.Debug("The cert/key are valid")
+		buf = append(certPEMBlock, keyPEMBlock...)
+	}
+
+	if caFile != "" {
+		data, err := os.ReadFile(caFile)
+		if err != nil {
+			return "", err
+		}
+		c.logger.Debug("Loaded ca file", "file", caFile, "length", len(data))
+		buf = append(buf, data...)
+	}
+
+	sum := blake2b.Sum256(buf)
+	return hex.EncodeToString(sum[:]), nil
+}
+
+// runWatcher uses polling instead of inotify to sense the changes on the cert/key/ca files.
+// The reason not to use inotify:
+// 1. To not miss any changes, we need to watch the directory instead of files when using inotify.
+// 2. These files are not frequently changed/renewed, and they don't need to be reloaded immediately after renewal.
+// 3. Some network based filesystem and FUSE don't support inotify.
+func (c *certMethod) runWatcher() {
+	defer close(c.doneCh)
+
+	select {
+	case <-c.stopCh:
+		return
+
+	case <-c.credSuccessGate:
+		// We only start the next loop once we're initially successful,
+		// since at startup Authenticate will be called, and we don't want
+		// to end up immediately re-authenticating by having found a new
+		// value
+	}
+
+	for {
+		changed := false
+		select {
+		case <-c.stopCh:
+			return
+
+		case <-c.ticker.C:
+			c.logger.Debug("Checking if files changed", "cert", c.clientCert, "key", c.clientKey)
+			hash, err := c.hashCert(c.clientCert, c.clientKey, c.caCert)
+			// ignore errors in watcher
+			if err == nil {
+				c.logger.Debug("hash before/after", "new", hash, "old", *c.latestHash)
+				changed = *c.latestHash != hash
+			} else {
+				c.logger.Warn("hash failed for cert/key files", "err", err)
+			}
+		}
+
+		if changed {
+			c.logger.Info("The cert/key files changed")
+			select {
+			case c.credsFound <- struct{}{}:
+			case <-c.stopCh:
+			}
+		}
+	}
+}
diff --git a/command/agentproxyshared/auth/cert/cert_test.go b/command/agentproxyshared/auth/cert/cert_test.go
index 6a7e4f779e9..d2f6060f80e 100644
--- a/command/agentproxyshared/auth/cert/cert_test.go
+++ b/command/agentproxyshared/auth/cert/cert_test.go
@@ -1,14 +1,17 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cert
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"path"
+	"path/filepath"
 	"reflect"
 	"testing"
+	"time"
 
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/api"
@@ -28,6 +31,7 @@ func TestCertAuthMethod_Authenticate(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer method.Shutdown()
 
 	client, err := api.NewClient(nil)
 	if err != nil {
@@ -65,6 +69,7 @@ func TestCertAuthMethod_AuthClient_withoutCerts(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer method.Shutdown()
 
 	client, err := api.NewClient(api.DefaultConfig())
 	if err != nil {
@@ -108,6 +113,7 @@ func TestCertAuthMethod_AuthClient_withCerts(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer method.Shutdown()
 
 	client, err := api.NewClient(nil)
 	if err != nil {
@@ -134,29 +140,38 @@ func TestCertAuthMethod_AuthClient_withCerts(t *testing.T) {
 	}
 }
 
-func TestCertAuthMethod_AuthClient_withCertsReload(t *testing.T) {
-	clientCert, err := os.Open("./test-fixtures/keys/cert.pem")
+func copyFile(from, to string) error {
+	data, err := os.ReadFile(from)
 	if err != nil {
-		t.Fatal(err)
+		return err
 	}
 
-	defer clientCert.Close()
+	return os.WriteFile(to, data, 0o600)
+}
 
-	clientKey, err := os.Open("./test-fixtures/keys/key.pem")
-	if err != nil {
-		t.Fatal(err)
+// TestCertAuthMethod_AuthClient_withCertsReload makes the file change and ensures the cert auth method deliver the event.
+func TestCertAuthMethod_AuthClient_withCertsReload(t *testing.T) {
+	// Initial the cert/key pair to temp path
+	certPath := filepath.Join(os.TempDir(), "app.crt")
+	keyPath := filepath.Join(os.TempDir(), "app.key")
+	if err := copyFile("./test-fixtures/keys/cert.pem", certPath); err != nil {
+		t.Fatal("copy cert file failed", err)
 	}
-
-	defer clientKey.Close()
+	defer os.Remove(certPath)
+	if err := copyFile("./test-fixtures/keys/key.pem", keyPath); err != nil {
+		t.Fatal("copy key file failed", err)
+	}
+	defer os.Remove(keyPath)
 
 	config := &auth.AuthConfig{
 		Logger:    hclog.NewNullLogger(),
 		MountPath: "cert-test",
 		Config: map[string]interface{}{
-			"name":        "with-certs-reloaded",
-			"client_cert": clientCert.Name(),
-			"client_key":  clientKey.Name(),
-			"reload":      true,
+			"name":          "with-certs-reloaded",
+			"client_cert":   certPath,
+			"client_key":    keyPath,
+			"reload":        true,
+			"reload_period": 1,
 		},
 	}
 
@@ -164,6 +179,7 @@ func TestCertAuthMethod_AuthClient_withCertsReload(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer method.Shutdown()
 
 	client, err := api.NewClient(nil)
 	if err != nil {
@@ -188,4 +204,113 @@ func TestCertAuthMethod_AuthClient_withCertsReload(t *testing.T) {
 	if reloadedClient == clientToUse {
 		t.Fatal("expected client from AuthClient to return back a new client")
 	}
+
+	method.CredSuccess()
+	// Only make a change to the cert file, it doesn't match the key file so the client won't pick and load them.
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	if err = copyFile("./test-fixtures/keys/cert1.pem", certPath); err != nil {
+		t.Fatal("update cert file failed", err)
+	}
+
+	select {
+	case <-ctx.Done():
+	case <-method.NewCreds():
+		cancel()
+		t.Fatal("malformed cert should not be observed as a change")
+	}
+
+	// Make a change to the key file and now they are good to be picked.
+	if err = copyFile("./test-fixtures/keys/key1.pem", keyPath); err != nil {
+		t.Fatal("update key file failed", err)
+	}
+	ctx, cancel = context.WithTimeout(context.Background(), 3*time.Second)
+	select {
+	case <-ctx.Done():
+		t.Fatal("failed to watch the cert change: timeout")
+	case <-method.NewCreds():
+		cancel()
+	}
+}
+
+// TestCertAuthMethod_hashCert_withEmptyPaths tests hashCert() if it works well with optional options.
+func TestCertAuthMethod_hashCert_withEmptyPaths(t *testing.T) {
+	c := &certMethod{
+		logger: hclog.NewNullLogger(),
+	}
+
+	// It skips empty file paths
+	sum, err := c.hashCert("", "", "")
+	if sum == "" || err != nil {
+		t.Fatal("hashCert() should skip empty file paths and succeed.")
+	}
+	emptySum := sum
+
+	// Only present ca cert
+	sum, err = c.hashCert("", "", "./test-fixtures/root/rootcacert.pem")
+	if sum == "" || err != nil {
+		t.Fatal("hashCert() should succeed when only present ca cert.")
+	}
+
+	// Only present client cert/key
+	sum, err = c.hashCert("./test-fixtures/keys/cert.pem", "./test-fixtures/keys/key.pem", "")
+	if sum == "" || err != nil {
+		fmt.Println(sum, err)
+		t.Fatal("hashCert() should succeed when only present client cert/key.")
+	}
+
+	// The client cert/key should be presented together or will be skipped
+	sum, err = c.hashCert("./test-fixtures/keys/cert.pem", "", "")
+	if sum == "" || err != nil {
+		t.Fatal("hashCert() should succeed when only present client cert.")
+	} else if sum != emptySum {
+		t.Fatal("hashCert() should skip the client cert/key when only present client cert.")
+	}
+}
+
+// TestCertAuthMethod_hashCert_withInvalidClientCert adds test cases for invalid input for hashCert().
+func TestCertAuthMethod_hashCert_withInvalidClientCert(t *testing.T) {
+	c := &certMethod{
+		logger: hclog.NewNullLogger(),
+	}
+
+	// With mismatched cert/key pair
+	sum, err := c.hashCert("./test-fixtures/keys/cert1.pem", "./test-fixtures/keys/key.pem", "")
+	if sum != "" || err == nil {
+		t.Fatal("hashCert() should fail with invalid client cert.")
+	}
+
+	// With non-existed paths
+	sum, err = c.hashCert("./test-fixtures/keys/cert2.pem", "./test-fixtures/keys/key.pem", "")
+	if sum != "" || err == nil {
+		t.Fatal("hashCert() should fail with non-existed client cert path.")
+	}
+}
+
+// TestCertAuthMethod_hashCert_withChange tests hashCert() if it detects changes from both client cert/key and ca cert.
+func TestCertAuthMethod_hashCert_withChange(t *testing.T) {
+	c := &certMethod{
+		logger: hclog.NewNullLogger(),
+	}
+
+	// A good first case.
+	sum, err := c.hashCert("./test-fixtures/keys/cert.pem", "./test-fixtures/keys/key.pem", "./test-fixtures/root/rootcacert.pem")
+	if sum == "" || err != nil {
+		t.Fatal("hashCert() shouldn't fail with a valid pair of cert/key.")
+	}
+
+	// Only change the ca cert from the first case.
+	sum1, err := c.hashCert("./test-fixtures/keys/cert.pem", "./test-fixtures/keys/key.pem", "./test-fixtures/keys/cert.pem")
+	if sum1 == "" || err != nil {
+		t.Fatal("hashCert() shouldn't fail with valid pair of cert/key.")
+	} else if sum == sum1 {
+		t.Fatal("The hash should be different with a different ca cert.")
+	}
+
+	// Only change the cert/key pair from the first case.
+	sum2, err := c.hashCert("./test-fixtures/keys/cert1.pem", "./test-fixtures/keys/key1.pem", "./test-fixtures/root/rootcacert.pem")
+	if sum2 == "" || err != nil {
+		t.Fatal("hashCert() shouldn't fail with a valid cert/key pair")
+	} else if sum == sum2 || sum1 == sum2 {
+		t.Fatal("The hash should be different with a different pair of cert/key.")
+	}
 }
diff --git a/command/agentproxyshared/auth/cert/test-fixtures/keys/cert1.pem b/command/agentproxyshared/auth/cert/test-fixtures/keys/cert1.pem
new file mode 100644
index 00000000000..01afb2157e3
--- /dev/null
+++ b/command/agentproxyshared/auth/cert/test-fixtures/keys/cert1.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICrTCCAZUCCQDDXho7UXdaIjANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDEwtl
+eGFtcGxlLmNvbTAeFw0yNDA4MTcwOTE0MDRaFw0zNDA4MTUwOTE0MDRaMBsxGTAX
+BgNVBAMMEGNlcnQuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQDDSMAi8aL1XLCRrPl8KjJcH/pJe9QJtzUIU3T9tfj+Eq8yMUbFu+so
+ec+knsxTi5zN7wq1/t9B9tIvDVG0C9T7BbhX2dYPNC1oY7DtdI3KqA76Z78v533Y
+p/WFMHn9X1v0g7qOHm9Y7V6oHg7m+ICq84fORbmfgNW/tPNqTJRU4wyzlIPw1Toi
+9awHMZHZmbjUwFgSQ8TOXgZfWo1ZmbOFY2epBIRCapsYpJgwKXy1UjIfQIQ6e6xm
+KbKQ/IIeuufo5U8vYV91nGNOVkieeGQ8vmVa1f/oyFfChCRR+aLCqbUGfJWzdicm
+eqyQVmPqJxTFuh7WMq+cOX5A068sYj0FAgMBAAEwDQYJKoZIhvcNAQELBQADggEB
+AFtUgRS+OZXmDmhIiaw4OrMruz3N2PCjWo/y+rK5gECuApGv7may3k9E65yRUvBb
+Ch68y1TMr+7J0MDl1CIbJUnLJkmcID+IvLVS3hVJ9H0raP6epDRvfkM3Xc/RwNgS
+PS1H1K8oxDPoo4an1yc6UoKng5KCAUYN+8dR9iVpCIPzRm0LSDIqMyamxoeNLfrO
+Nta+sKu1iS/MHy/MVLqyRDwTP2DnfYJTvhQDK5Y5bi7Chkv7g3ug/o2RZ38rRiRd
+Os90dDmTCgnYBSJtfKWF5gSnzP+OTs6Yb6KOIY7gLY/r1PBPabSuAnRMS/iTi6tq
+l91Cs+vnv6HNcZsGphoQJq8=
+-----END CERTIFICATE-----
diff --git a/command/agentproxyshared/auth/cert/test-fixtures/keys/key1.pem b/command/agentproxyshared/auth/cert/test-fixtures/keys/key1.pem
new file mode 100644
index 00000000000..ea07f86416f
--- /dev/null
+++ b/command/agentproxyshared/auth/cert/test-fixtures/keys/key1.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDDSMAi8aL1XLCR
+rPl8KjJcH/pJe9QJtzUIU3T9tfj+Eq8yMUbFu+soec+knsxTi5zN7wq1/t9B9tIv
+DVG0C9T7BbhX2dYPNC1oY7DtdI3KqA76Z78v533Yp/WFMHn9X1v0g7qOHm9Y7V6o
+Hg7m+ICq84fORbmfgNW/tPNqTJRU4wyzlIPw1Toi9awHMZHZmbjUwFgSQ8TOXgZf
+Wo1ZmbOFY2epBIRCapsYpJgwKXy1UjIfQIQ6e6xmKbKQ/IIeuufo5U8vYV91nGNO
+VkieeGQ8vmVa1f/oyFfChCRR+aLCqbUGfJWzdicmeqyQVmPqJxTFuh7WMq+cOX5A
+068sYj0FAgMBAAECggEAP1vIMs4xL+g9xVXYsAdExYz+eH77gZd2Vlg1eedjfJN1
+UhSYwKjCmCRFUUTQSD7gxhPLZtblepJpCSkKHB9Gn5bwg1hC0jX8kYTer3wEUP8L
+tQSaDCHQO83qo6bhvWoF/KQMj/Wh7Lk+3864yQlRPaW7pxoKKozzTLqZyyBDc/KR
+YaUco+9NFqClHd/TRehoykYa7OvNVJjBDxTnnxijE0d5w83rP+wDJczhe/Xn/0f1
+Q7JFa4NpKmLEXj93GZiteloE80AbVnMiIemGB8ZZGHcySiib3wzuLk32dLS8zguU
+gp3E1FhL5xI7gsS7ClA/S6+tK1c46FzQYuIA105tAQKBgQDhnoxCW0N8xV5I1tje
+Q1AW+tMVyO6yaREFuoz6tE6AZ1drywyHdqia/QNbXkdllYVQDMlszQ3tmZ8RT/+5
+NdJ+LnNag8T6PaN3AtXAf0uveCL1et5ffWuRicesJCCJ10ESFQaVccZEqhJhtnQk
+giqICNHV0dWIEVsZGi5R4sA0wQKBgQDdlICpZud2SLrSx00Fb6TfZumxWjDwDb9D
+avoQJb376pg1qpAh53hUJbHWPlspeG/k24J0oRrnb3aln8QS21qVov90YllEWwnO
+xebYgdjvfOIZ1b8vJ2/UkfLX9Xa9KuzvGpv4BSNOZ8UNHI6Dj/eFmWP+q/a3vzJT
+rEgoC1xFRQKBgQCGkZtUxLxnAg1vYn3ta7asTiRyvOrqDNKzWQZXTg34dirlRzGM
+5pBACSLkb0Ika98c1NObCl8BVXxTxiRfoqOO0UPKPAfTvcnu5Qj7DLHm0cAALK3P
+xK3RG521pcKmlHXiRBouLrM0J0BZeYqib+TQSHpnjwVOaBOu0DfKbXV4wQKBgAaU
+VEWzcogGnNWJaXYR3Jltmt7TSMS4A8fis04rcLq8OozNZb47+0y0WdV8wIQ4uUnY
+YsVHy1635pQAbHgK32O2FVPFX9UxxtbG9ZXUNTbXRHdz61thFmb/dnCHL2FqluJ6
+rcrtjCDV3/oFsQ2jBryG03tKa+cE3F+zq+jUfYbpAoGAauV0h6kqS5mF+sa3F+I1
+zIZ7k81r5csZXkgQ6HphIAvo5NSv7H1jeSkGbZmg29irReggZLsy6nU4B4ZVt1p9
+GIsLgJfkCkHT+Vf0ipygAwFnbEUKqs6A/D0EUtAF2Oc7nVl0NIX+9LmEx7Dwl34i
+bTTPVgw5bid08eiN46NN9J4=
+-----END PRIVATE KEY-----
diff --git a/command/agentproxyshared/auth/cf/cf.go b/command/agentproxyshared/auth/cf/cf.go
index 27396be20af..ae398aee3cc 100644
--- a/command/agentproxyshared/auth/cf/cf.go
+++ b/command/agentproxyshared/auth/cf/cf.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cf
diff --git a/command/agentproxyshared/auth/gcp/gcp.go b/command/agentproxyshared/auth/gcp/gcp.go
index 5d913581bca..9b598ee5bf7 100644
--- a/command/agentproxyshared/auth/gcp/gcp.go
+++ b/command/agentproxyshared/auth/gcp/gcp.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package gcp
@@ -8,7 +8,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"time"
 
@@ -151,7 +151,7 @@ func (g *gcpMethod) Authenticate(ctx context.Context, client *api.Client) (retPa
 				return
 			}
 			defer resp.Body.Close()
-			jwtBytes, err := ioutil.ReadAll(resp.Body)
+			jwtBytes, err := io.ReadAll(resp.Body)
 			if err != nil {
 				retErr = fmt.Errorf("error reading instance token response body: %w", err)
 				return
diff --git a/command/agentproxyshared/auth/jwt/jwt.go b/command/agentproxyshared/auth/jwt/jwt.go
index fce03ad7d76..aa22cc95188 100644
--- a/command/agentproxyshared/auth/jwt/jwt.go
+++ b/command/agentproxyshared/auth/jwt/jwt.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package jwt
diff --git a/command/agentproxyshared/auth/jwt/jwt_test.go b/command/agentproxyshared/auth/jwt/jwt_test.go
index 62fbc24e811..5372ce68dec 100644
--- a/command/agentproxyshared/auth/jwt/jwt_test.go
+++ b/command/agentproxyshared/auth/jwt/jwt_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package jwt
diff --git a/command/agentproxyshared/auth/kerberos/integtest/integrationtest.sh b/command/agentproxyshared/auth/kerberos/integtest/integrationtest.sh
index 6b8a6925de9..76d759ce26b 100755
--- a/command/agentproxyshared/auth/kerberos/integtest/integrationtest.sh
+++ b/command/agentproxyshared/auth/kerberos/integtest/integrationtest.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 # Instructions
diff --git a/command/agentproxyshared/auth/kerberos/kerberos.go b/command/agentproxyshared/auth/kerberos/kerberos.go
index 566fa222a47..fe69c15ecfb 100644
--- a/command/agentproxyshared/auth/kerberos/kerberos.go
+++ b/command/agentproxyshared/auth/kerberos/kerberos.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kerberos
diff --git a/command/agentproxyshared/auth/kerberos/kerberos_test.go b/command/agentproxyshared/auth/kerberos/kerberos_test.go
index 819cb7dff4e..1e1a0041b05 100644
--- a/command/agentproxyshared/auth/kerberos/kerberos_test.go
+++ b/command/agentproxyshared/auth/kerberos/kerberos_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kerberos
diff --git a/command/agentproxyshared/auth/kubernetes/kubernetes.go b/command/agentproxyshared/auth/kubernetes/kubernetes.go
index 639226505f2..8dc4aedae98 100644
--- a/command/agentproxyshared/auth/kubernetes/kubernetes.go
+++ b/command/agentproxyshared/auth/kubernetes/kubernetes.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kubernetes
@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"strings"
@@ -123,7 +122,7 @@ func (k *kubernetesMethod) readJWT() (string, error) {
 	}
 	defer data.Close()
 
-	contentBytes, err := ioutil.ReadAll(data)
+	contentBytes, err := io.ReadAll(data)
 	if err != nil {
 		return "", err
 	}
diff --git a/command/agentproxyshared/auth/kubernetes/kubernetes_test.go b/command/agentproxyshared/auth/kubernetes/kubernetes_test.go
index 93b348c7f52..37450e2e830 100644
--- a/command/agentproxyshared/auth/kubernetes/kubernetes_test.go
+++ b/command/agentproxyshared/auth/kubernetes/kubernetes_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kubernetes
diff --git a/command/agentproxyshared/auth/ldap/ldap.go b/command/agentproxyshared/auth/ldap/ldap.go
index d654f21898e..bee88501cd9 100644
--- a/command/agentproxyshared/auth/ldap/ldap.go
+++ b/command/agentproxyshared/auth/ldap/ldap.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ldap
diff --git a/command/agentproxyshared/auth/ldap/ldap_test.go b/command/agentproxyshared/auth/ldap/ldap_test.go
index 8f612db8c57..157c52a4a01 100644
--- a/command/agentproxyshared/auth/ldap/ldap_test.go
+++ b/command/agentproxyshared/auth/ldap/ldap_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ldap
diff --git a/command/agentproxyshared/auth/oci/oci.go b/command/agentproxyshared/auth/oci/oci.go
index 40294065366..2c0d9ccafe1 100644
--- a/command/agentproxyshared/auth/oci/oci.go
+++ b/command/agentproxyshared/auth/oci/oci.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package oci
diff --git a/command/agentproxyshared/auth/token-file/token_file.go b/command/agentproxyshared/auth/token-file/token_file.go
index c2154f7ab96..3f8743af64d 100644
--- a/command/agentproxyshared/auth/token-file/token_file.go
+++ b/command/agentproxyshared/auth/token-file/token_file.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package token_file
diff --git a/command/agentproxyshared/auth/token-file/token_file_test.go b/command/agentproxyshared/auth/token-file/token_file_test.go
index 7e6e8982b24..71f065f77d2 100644
--- a/command/agentproxyshared/auth/token-file/token_file_test.go
+++ b/command/agentproxyshared/auth/token-file/token_file_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package token_file
diff --git a/command/agentproxyshared/cache/api_proxy.go b/command/agentproxyshared/cache/api_proxy.go
index 35aea9f1e67..8805490eaac 100644
--- a/command/agentproxyshared/cache/api_proxy.go
+++ b/command/agentproxyshared/cache/api_proxy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
@@ -9,13 +9,14 @@ import (
 	gohttp "net/http"
 	"sync"
 
-	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-retryablehttp"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/http"
 )
 
+//go:generate enumer -type=EnforceConsistency -trimprefix=EnforceConsistency
 type EnforceConsistency int
 
 const (
@@ -23,6 +24,7 @@ const (
 	EnforceConsistencyAlways
 )
 
+//go:generate enumer -type=WhenInconsistentAction -trimprefix=WhenInconsistent
 type WhenInconsistentAction int
 
 const (
diff --git a/command/agentproxyshared/cache/api_proxy_test.go b/command/agentproxyshared/cache/api_proxy_test.go
index 9e7035918cb..11450751839 100644
--- a/command/agentproxyshared/cache/api_proxy_test.go
+++ b/command/agentproxyshared/cache/api_proxy_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
@@ -285,9 +285,9 @@ func setupClusterAndAgentCommon(ctx context.Context, t *testing.T, coreConfig *v
 
 		mux.Handle("/agent/v1/cache-clear", leaseCache.HandleCacheClear(ctx))
 
-		mux.Handle("/", ProxyHandler(ctx, cacheLogger, leaseCache, nil, true))
+		mux.Handle("/", ProxyHandler(ctx, cacheLogger, leaseCache, nil, false, false, nil, nil))
 	} else {
-		mux.Handle("/", ProxyHandler(ctx, apiProxyLogger, apiProxy, nil, true))
+		mux.Handle("/", ProxyHandler(ctx, apiProxyLogger, apiProxy, nil, false, false, nil, nil))
 	}
 
 	server := &http.Server{
diff --git a/command/agentproxyshared/cache/cache_test.go b/command/agentproxyshared/cache/cache_test.go
index 12e1e18e3a4..25318a923e7 100644
--- a/command/agentproxyshared/cache/cache_test.go
+++ b/command/agentproxyshared/cache/cache_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
@@ -81,7 +81,7 @@ func TestCache_AutoAuthTokenStripping(t *testing.T) {
 	mux := http.NewServeMux()
 	mux.Handle(consts.AgentPathCacheClear, leaseCache.HandleCacheClear(ctx))
 
-	mux.Handle("/", ProxyHandler(ctx, cacheLogger, leaseCache, mock.NewSink("testid"), true))
+	mux.Handle("/", ProxyHandler(ctx, cacheLogger, leaseCache, mock.NewSink("testid"), false, true, nil, nil))
 	server := &http.Server{
 		Handler:           mux,
 		ReadHeaderTimeout: 10 * time.Second,
@@ -168,9 +168,8 @@ func TestCache_AutoAuthClientTokenProxyStripping(t *testing.T) {
 
 	// Create a muxer and add paths relevant for the lease cache layer
 	mux := http.NewServeMux()
-	// mux.Handle(consts.AgentPathCacheClear, leaseCache.HandleCacheClear(ctx))
 
-	mux.Handle("/", ProxyHandler(ctx, cacheLogger, leaseCache, mock.NewSink(realToken), false))
+	mux.Handle("/", ProxyHandler(ctx, cacheLogger, leaseCache, mock.NewSink(realToken), true, true, nil, nil))
 	server := &http.Server{
 		Handler:           mux,
 		ReadHeaderTimeout: 10 * time.Second,
@@ -227,17 +226,19 @@ func TestCache_ConcurrentRequests(t *testing.T) {
 				"key": key,
 			})
 			if err != nil {
-				t.Fatal(err)
+				t.Error(err.Error())
+				return
 			}
 			secret, err := testClient.Logical().Read(key)
 			if err != nil {
-				t.Fatal(err)
+				t.Error(err.Error())
+				return
 			}
 			if secret == nil || secret.Data["key"].(string) != key {
-				t.Fatal(fmt.Sprintf("failed to read value for key: %q", key))
+				t.Errorf("failed to read value for key: %q", key)
+				return
 			}
 		}(i)
-
 	}
 	wg.Wait()
 }
diff --git a/command/agentproxyshared/cache/cacheboltdb/bolt.go b/command/agentproxyshared/cache/cacheboltdb/bolt.go
index 05d5ad93637..b84f2408b22 100644
--- a/command/agentproxyshared/cache/cacheboltdb/bolt.go
+++ b/command/agentproxyshared/cache/cacheboltdb/bolt.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cacheboltdb
@@ -12,10 +12,10 @@ import (
 	"time"
 
 	"github.com/golang/protobuf/proto"
-	bolt "github.com/hashicorp-forge/bbolt"
 	"github.com/hashicorp/go-hclog"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	"github.com/hashicorp/go-multierror"
+	bolt "go.etcd.io/bbolt"
 )
 
 const (
diff --git a/command/agentproxyshared/cache/cacheboltdb/bolt_test.go b/command/agentproxyshared/cache/cacheboltdb/bolt_test.go
index 06a31780b5a..7aa5354a02b 100644
--- a/command/agentproxyshared/cache/cacheboltdb/bolt_test.go
+++ b/command/agentproxyshared/cache/cacheboltdb/bolt_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cacheboltdb
@@ -14,11 +14,11 @@ import (
 	"time"
 
 	"github.com/golang/protobuf/proto"
-	bolt "github.com/hashicorp-forge/bbolt"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/command/agentproxyshared/cache/keymanager"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	bolt "go.etcd.io/bbolt"
 )
 
 func getTestKeyManager(t *testing.T) keymanager.KeyManager {
diff --git a/command/agentproxyshared/cache/cachememdb/cache_memdb.go b/command/agentproxyshared/cache/cachememdb/cache_memdb.go
index ed2cd0ac800..9d3e819fd9c 100644
--- a/command/agentproxyshared/cache/cachememdb/cache_memdb.go
+++ b/command/agentproxyshared/cache/cachememdb/cache_memdb.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cachememdb
@@ -240,7 +240,7 @@ func (c *CacheMemDB) SetCapabilitiesIndex(index *CapabilitiesIndex) error {
 // EvictCapabilitiesIndex removes a capabilities index from the cache based on index name and value.
 func (c *CacheMemDB) EvictCapabilitiesIndex(indexName string, indexValues ...interface{}) error {
 	index, err := c.GetCapabilitiesIndex(indexName, indexValues...)
-	if err == ErrCacheItemNotFound {
+	if errors.Is(err, ErrCacheItemNotFound) {
 		return nil
 	}
 	if err != nil {
diff --git a/command/agentproxyshared/cache/cachememdb/cache_memdb_test.go b/command/agentproxyshared/cache/cachememdb/cache_memdb_test.go
index 245f066281e..f963f1ff6c1 100644
--- a/command/agentproxyshared/cache/cachememdb/cache_memdb_test.go
+++ b/command/agentproxyshared/cache/cachememdb/cache_memdb_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cachememdb
diff --git a/command/agentproxyshared/cache/cachememdb/index.go b/command/agentproxyshared/cache/cachememdb/index.go
index 484409a5795..41fccaafb81 100644
--- a/command/agentproxyshared/cache/cachememdb/index.go
+++ b/command/agentproxyshared/cache/cachememdb/index.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cachememdb
@@ -53,6 +53,15 @@ type Index struct {
 	// Required: true, Unique: false
 	RequestPath string
 
+	// Versions are the versions of the secret for KVv2 static secrets only. This is
+	// a map of version to response, where version is the version number and response is the
+	// serialized cached response for that secret version.
+	// We could have chosen to put index.Response as Versions[0], but opted not to for consistency,
+	// and also to elevate the fact that the current version/representation of the path being
+	// cached here is stored there, not here.
+	// Required: false, Unique: false
+	Versions map[int][]byte
+
 	// Lease is the identifier of the lease in Vault, that belongs to the
 	// response held by this index.
 	// Required: false, Unique: true
diff --git a/command/agentproxyshared/cache/cachememdb/index_test.go b/command/agentproxyshared/cache/cachememdb/index_test.go
index 7b348e3402b..a10a6056e42 100644
--- a/command/agentproxyshared/cache/cachememdb/index_test.go
+++ b/command/agentproxyshared/cache/cachememdb/index_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cachememdb
diff --git a/command/agentproxyshared/cache/enforceconsistency_enumer.go b/command/agentproxyshared/cache/enforceconsistency_enumer.go
new file mode 100644
index 00000000000..e2354111df3
--- /dev/null
+++ b/command/agentproxyshared/cache/enforceconsistency_enumer.go
@@ -0,0 +1,49 @@
+// Code generated by "enumer -type=EnforceConsistency -trimprefix=EnforceConsistency"; DO NOT EDIT.
+
+package cache
+
+import (
+	"fmt"
+)
+
+const _EnforceConsistencyName = "NeverAlways"
+
+var _EnforceConsistencyIndex = [...]uint8{0, 5, 11}
+
+func (i EnforceConsistency) String() string {
+	if i < 0 || i >= EnforceConsistency(len(_EnforceConsistencyIndex)-1) {
+		return fmt.Sprintf("EnforceConsistency(%d)", i)
+	}
+	return _EnforceConsistencyName[_EnforceConsistencyIndex[i]:_EnforceConsistencyIndex[i+1]]
+}
+
+var _EnforceConsistencyValues = []EnforceConsistency{0, 1}
+
+var _EnforceConsistencyNameToValueMap = map[string]EnforceConsistency{
+	_EnforceConsistencyName[0:5]:  0,
+	_EnforceConsistencyName[5:11]: 1,
+}
+
+// EnforceConsistencyString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func EnforceConsistencyString(s string) (EnforceConsistency, error) {
+	if val, ok := _EnforceConsistencyNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to EnforceConsistency values", s)
+}
+
+// EnforceConsistencyValues returns all values of the enum
+func EnforceConsistencyValues() []EnforceConsistency {
+	return _EnforceConsistencyValues
+}
+
+// IsAEnforceConsistency returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i EnforceConsistency) IsAEnforceConsistency() bool {
+	for _, v := range _EnforceConsistencyValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/command/agentproxyshared/cache/handler.go b/command/agentproxyshared/cache/handler.go
index 25acaee01cb..0e9f1576e8d 100644
--- a/command/agentproxyshared/cache/handler.go
+++ b/command/agentproxyshared/cache/handler.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
@@ -11,8 +11,9 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
+	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/armon/go-metrics"
@@ -23,19 +24,23 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
-func ProxyHandler(ctx context.Context, logger hclog.Logger, proxier Proxier, inmemSink sink.Sink, proxyVaultToken bool) http.Handler {
+func ProxyHandler(ctx context.Context, logger hclog.Logger, proxier Proxier, inmemSink sink.Sink, forceAutoAuthToken bool, useAutoAuthToken bool, authInProgress *atomic.Bool, invalidTokenErrCh chan error) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		logger.Info("received request", "method", r.Method, "path", r.URL.Path)
 
-		if !proxyVaultToken {
+		if forceAutoAuthToken {
 			r.Header.Del(consts.AuthHeaderName)
 		}
 
 		token := r.Header.Get(consts.AuthHeaderName)
 
-		if token == "" && inmemSink != nil {
-			logger.Debug("using auto auth token", "method", r.Method, "path", r.URL.Path)
-			token = inmemSink.(sink.SinkReader).Token()
+		var autoAuthToken string
+		if inmemSink != nil {
+			autoAuthToken = inmemSink.(sink.SinkReader).Token()
+			if token == "" && useAutoAuthToken {
+				logger.Debug("using auto auth token", "method", r.Method, "path", r.URL.Path)
+				token = autoAuthToken
+			}
 		}
 
 		// Parse and reset body.
@@ -59,15 +64,31 @@ func ProxyHandler(ctx context.Context, logger hclog.Logger, proxier Proxier, inm
 		if err != nil {
 			// If this is an api.Response error, don't wrap the response.
 			if resp != nil && resp.Response.Error() != nil {
+				responseErrMessage := resp.Response.Error()
 				copyHeader(w.Header(), resp.Response.Header)
 				w.WriteHeader(resp.Response.StatusCode)
 				io.Copy(w, resp.Response.Body)
 				metrics.IncrCounter([]string{"agent", "proxy", "client_error"}, 1)
+				// Re-trigger auto auth if the token is the same as the auto auth token
+				if resp.Response.StatusCode == 403 && strings.Contains(responseErrMessage.Error(), logical.ErrInvalidToken.Error()) &&
+					autoAuthToken == token && !authInProgress.Load() {
+					// Drain the error channel first
+					logger.Info("proxy received an invalid token error")
+					select {
+					case <-invalidTokenErrCh:
+					default:
+					}
+					invalidTokenErrCh <- resp.Response.Error()
+				}
 			} else {
 				metrics.IncrCounter([]string{"agent", "proxy", "error"}, 1)
 				logical.RespondError(w, http.StatusInternalServerError, fmt.Errorf("failed to get the response: %w", err))
 			}
 			return
+		} else if resp == nil {
+			metrics.IncrCounter([]string{"agent", "proxy", "error"}, 1)
+			logical.RespondError(w, http.StatusInternalServerError, fmt.Errorf("failed to get the response: %w", err))
+			return
 		}
 
 		err = sanitizeAutoAuthTokenResponse(ctx, logger, inmemSink, req, resp)
@@ -200,7 +221,7 @@ func sanitizeAutoAuthTokenResponse(ctx context.Context, logger hclog.Logger, inm
 	if resp.Response.Body != nil {
 		resp.Response.Body.Close()
 	}
-	resp.Response.Body = ioutil.NopCloser(bytes.NewReader(bodyBytes))
+	resp.Response.Body = io.NopCloser(bytes.NewReader(bodyBytes))
 	resp.Response.ContentLength = int64(len(bodyBytes))
 
 	// Serialize and re-read the response
diff --git a/command/agentproxyshared/cache/keymanager/manager.go b/command/agentproxyshared/cache/keymanager/manager.go
index 46fc499d2e1..0a11c0bc47f 100644
--- a/command/agentproxyshared/cache/keymanager/manager.go
+++ b/command/agentproxyshared/cache/keymanager/manager.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package keymanager
diff --git a/command/agentproxyshared/cache/keymanager/passthrough.go b/command/agentproxyshared/cache/keymanager/passthrough.go
index f88d2787a72..29161a04287 100644
--- a/command/agentproxyshared/cache/keymanager/passthrough.go
+++ b/command/agentproxyshared/cache/keymanager/passthrough.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package keymanager
diff --git a/command/agentproxyshared/cache/keymanager/passthrough_test.go b/command/agentproxyshared/cache/keymanager/passthrough_test.go
index b3dc9b72525..59ed9449d93 100644
--- a/command/agentproxyshared/cache/keymanager/passthrough_test.go
+++ b/command/agentproxyshared/cache/keymanager/passthrough_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package keymanager
diff --git a/command/agentproxyshared/cache/lease_cache.go b/command/agentproxyshared/cache/lease_cache.go
index 6e8b564a620..08307a3b49d 100644
--- a/command/agentproxyshared/cache/lease_cache.go
+++ b/command/agentproxyshared/cache/lease_cache.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
@@ -14,6 +14,7 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -220,6 +221,7 @@ func (c *LeaseCache) PersistentStorage() *cacheboltdb.BoltStorage {
 // checkCacheForDynamicSecretRequest checks the cache for a particular request based on its
 // computed ID. It returns a non-nil *SendResponse if an entry is found.
 func (c *LeaseCache) checkCacheForDynamicSecretRequest(id string) (*SendResponse, error) {
+	c.logger.Trace("checking cache for dynamic secret request", "id", id)
 	return c.checkCacheForRequest(id, nil)
 }
 
@@ -229,6 +231,7 @@ func (c *LeaseCache) checkCacheForDynamicSecretRequest(id string) (*SendResponse
 // cache entry, and return nil if it isn't. It will also evict the cache if this is a non-GET
 // request.
 func (c *LeaseCache) checkCacheForStaticSecretRequest(id string, req *SendRequest) (*SendResponse, error) {
+	c.logger.Trace("checking cache for static secret request", "id", id)
 	return c.checkCacheForRequest(id, req)
 }
 
@@ -269,15 +272,28 @@ func (c *LeaseCache) checkCacheForRequest(id string, req *SendRequest) (*SendRes
 		}
 	}
 
+	var response []byte
+	version := getStaticSecretVersionFromRequest(req)
+	if version == 0 {
+		response = index.Response
+	} else {
+		response = index.Versions[version]
+	}
+
+	// We don't have this response as either a current or older version.
+	if response == nil {
+		return nil, nil
+	}
+
 	// Cached request is found, deserialize the response
-	reader := bufio.NewReader(bytes.NewReader(index.Response))
+	reader := bufio.NewReader(bytes.NewReader(response))
 	resp, err := http.ReadResponse(reader, nil)
 	if err != nil {
 		c.logger.Error("failed to deserialize response", "error", err)
 		return nil, err
 	}
 
-	sendResp, err := NewSendResponse(&api.Response{Response: resp}, index.Response)
+	sendResp, err := NewSendResponse(&api.Response{Response: resp}, response)
 	if err != nil {
 		c.logger.Error("failed to create new send response", "error", err)
 		return nil, err
@@ -411,7 +427,7 @@ func (c *LeaseCache) Send(ctx context.Context, req *SendRequest) (*SendResponse,
 			return nil, err
 		}
 		if cachedResp != nil {
-			c.logger.Debug("returning cached static secret response", "id", staticSecretCacheId, "path", req.Request.URL.Path)
+			c.logger.Debug("returning cached static secret response", "id", staticSecretCacheId, "path", getStaticSecretPathFromRequest(req))
 			return cachedResp, nil
 		}
 	}
@@ -482,7 +498,8 @@ func (c *LeaseCache) Send(ctx context.Context, req *SendRequest) (*SendResponse,
 		// included in the request path.
 		index.RequestPath = getStaticSecretPathFromRequest(req)
 
-		err := c.cacheStaticSecret(ctx, req, resp, index)
+		c.logger.Trace("attempting to cache static secret with following request path", "request path", index.RequestPath, "version", getStaticSecretVersionFromRequest(req))
+		err := c.cacheStaticSecret(ctx, req, resp, index, secret)
 		if err != nil {
 			return nil, err
 		}
@@ -616,16 +633,19 @@ func (c *LeaseCache) Send(ctx context.Context, req *SendRequest) (*SendResponse,
 	return resp, nil
 }
 
-func (c *LeaseCache) cacheStaticSecret(ctx context.Context, req *SendRequest, resp *SendResponse, index *cachememdb.Index) error {
+func (c *LeaseCache) cacheStaticSecret(ctx context.Context, req *SendRequest, resp *SendResponse, index *cachememdb.Index, secret *api.Secret) error {
 	// If a cached version of this secret exists, we now have access, so
 	// we don't need to re-cache, just update index.Tokens
 	indexFromCache, err := c.db.Get(cachememdb.IndexNameID, index.ID)
-	if err != nil && err != cachememdb.ErrCacheItemNotFound {
+	if err != nil && !errors.Is(err, cachememdb.ErrCacheItemNotFound) {
 		return err
 	}
 
+	version := getStaticSecretVersionFromRequest(req)
+
 	// The index already exists, so all we need to do is add our token
-	// to the index's allowed token list, then re-store it.
+	// to the index's allowed token list, and if necessary, the new version,
+	// then re-store it.
 	if indexFromCache != nil {
 		// We must hold a lock for the index while it's being updated.
 		// We keep the two locking mechanisms distinct, so that it's only writes
@@ -634,6 +654,45 @@ func (c *LeaseCache) cacheStaticSecret(ctx context.Context, req *SendRequest, re
 		defer indexFromCache.IndexLock.Unlock()
 		indexFromCache.Tokens[req.Token] = struct{}{}
 
+		// Are we looking for a version that's already cached?
+		haveVersion := false
+		if version != 0 {
+			_, ok := indexFromCache.Versions[version]
+			if ok {
+				haveVersion = true
+			}
+		} else {
+			if indexFromCache.Response != nil {
+				haveVersion = true
+			}
+		}
+
+		if !haveVersion {
+			var respBytes bytes.Buffer
+			err = resp.Response.Write(&respBytes)
+			if err != nil {
+				c.logger.Error("failed to serialize response", "error", err)
+				return err
+			}
+
+			// Reset the response body for upper layers to read
+			if resp.Response.Body != nil {
+				resp.Response.Body.Close()
+			}
+			resp.Response.Body = io.NopCloser(bytes.NewReader(resp.ResponseBody))
+
+			// Set the index's Response
+			if version == 0 {
+				indexFromCache.Response = respBytes.Bytes()
+				// For current KVv2 secrets, see if we can add the version that the secret is
+				// to the versions map, too. If we got the latest version and the version is #2,
+				// also update Versions[2]
+				c.addToVersionListForCurrentVersionKVv2Secret(indexFromCache, secret)
+			} else {
+				indexFromCache.Versions[version] = respBytes.Bytes()
+			}
+		}
+
 		return c.storeStaticSecretIndex(ctx, req, indexFromCache)
 	}
 
@@ -651,8 +710,19 @@ func (c *LeaseCache) cacheStaticSecret(ctx context.Context, req *SendRequest, re
 	}
 	resp.Response.Body = io.NopCloser(bytes.NewReader(resp.ResponseBody))
 
+	// Initialize the versions
+	index.Versions = map[int][]byte{}
+
 	// Set the index's Response
-	index.Response = respBytes.Bytes()
+	if version == 0 {
+		index.Response = respBytes.Bytes()
+		// For current KVv2 secrets, see if we can add the version that the secret is
+		// to the versions map, too. If we got the latest version and the version is #2,
+		// also update Versions[2]
+		c.addToVersionListForCurrentVersionKVv2Secret(index, secret)
+	} else {
+		index.Versions[version] = respBytes.Bytes()
+	}
 
 	// Initialize the token map and add this token to it.
 	index.Tokens = map[string]struct{}{req.Token: {}}
@@ -660,12 +730,53 @@ func (c *LeaseCache) cacheStaticSecret(ctx context.Context, req *SendRequest, re
 	// Set the index type
 	index.Type = cacheboltdb.StaticSecretType
 
+	// Store the index:
 	return c.storeStaticSecretIndex(ctx, req, index)
 }
 
+// addToVersionListForCurrentVersionKVv2Secret takes a secret index and, if it's
+// a KVv2 secret, adds the given response to the corresponding version for it.
+// This function fails silently, as we could be parsing arbitrary JSON.
+// This function can store a version for a KVv1 secret iff:
+// - It has 'data' in the path
+// - It has a numerical 'metadata.version' field
+// However, this risk seems very small, and the negatives of such a secret being
+// stored in the cache aren't worth additional mitigations to check if it's a KVv1
+// or KVv2 mount (such as doing a 'preflight' request like the CLI).
+// There's no way to access it and it's just a couple of extra bytes, in the
+// case that this does happen to a KVv1 secret.
+func (c *LeaseCache) addToVersionListForCurrentVersionKVv2Secret(index *cachememdb.Index, secret *api.Secret) {
+	if secret != nil {
+		// First do an imperfect but lightweight check. This saves parsing the secret in the case that the secret isn't KVv2.
+		// KVv2 secrets always contain /data/, but KVv1 secrets can too, so we can't rely on this.
+		if strings.Contains(index.RequestPath, "/data/") {
+			metadata, ok := secret.Data["metadata"]
+			if ok {
+				metaDataAsMap, ok := metadata.(map[string]interface{})
+				if ok {
+					versionJson, ok := metaDataAsMap["version"].(json.Number)
+					if ok {
+						versionInt64, err := versionJson.Int64()
+						if err == nil {
+							version := int(versionInt64)
+							c.logger.Trace("adding response for current KVv2 secret to index's Versions map", "path", index.RequestPath, "version", version)
+
+							if index.Versions == nil {
+								index.Versions = map[int][]byte{}
+							}
+
+							index.Versions[version] = index.Response
+						}
+					}
+				}
+			}
+		}
+	}
+}
+
 func (c *LeaseCache) storeStaticSecretIndex(ctx context.Context, req *SendRequest, index *cachememdb.Index) error {
 	// Store the index in the cache
-	c.logger.Debug("storing static secret response into the cache", "method", req.Request.Method, "path", req.Request.URL.Path, "id", index.ID)
+	c.logger.Debug("storing static secret response into the cache", "path", index.RequestPath, "id", index.ID)
 	err := c.Set(ctx, index)
 	if err != nil {
 		c.logger.Error("failed to cache the proxied response", "error", err)
@@ -680,6 +791,7 @@ func (c *LeaseCache) storeStaticSecretIndex(ctx context.Context, req *SendReques
 
 	path := getStaticSecretPathFromRequest(req)
 
+	capabilitiesIndex.IndexLock.Lock()
 	// Extra caution -- avoid potential nil
 	if capabilitiesIndex.ReadablePaths == nil {
 		capabilitiesIndex.ReadablePaths = make(map[string]struct{})
@@ -687,6 +799,7 @@ func (c *LeaseCache) storeStaticSecretIndex(ctx context.Context, req *SendReques
 
 	// update the index with the new capability:
 	capabilitiesIndex.ReadablePaths[path] = struct{}{}
+	capabilitiesIndex.IndexLock.Unlock()
 
 	err = c.SetCapabilitiesIndex(ctx, capabilitiesIndex)
 	if err != nil {
@@ -694,7 +807,7 @@ func (c *LeaseCache) storeStaticSecretIndex(ctx context.Context, req *SendReques
 		return err
 	}
 
-	// Lastly, ensure that we start renewing this index, if it's  new.
+	// Lastly, ensure that we start renewing this index, if it's new.
 	// We require the 'created' check so that we don't renew the same
 	// index multiple times.
 	if c.capabilityManager != nil && created {
@@ -711,7 +824,7 @@ func (c *LeaseCache) retrieveOrCreateTokenCapabilitiesEntry(token string) (*cach
 	// The index ID is a hash of the token.
 	indexId := hashStaticSecretIndex(token)
 	indexFromCache, err := c.db.GetCapabilitiesIndex(cachememdb.IndexNameID, indexId)
-	if err != nil && err != cachememdb.ErrCacheItemNotFound {
+	if err != nil && !errors.Is(err, cachememdb.ErrCacheItemNotFound) {
 		return nil, false, err
 	}
 
@@ -884,6 +997,25 @@ func canonicalizeStaticSecretPath(requestPath string, ns string) string {
 	return path
 }
 
+// getStaticSecretVersionFromRequest gets the version of a secret
+// from a request. For the latest secret and for KVv1 secrets,
+// this will return 0.
+func getStaticSecretVersionFromRequest(req *SendRequest) int {
+	if req == nil || req.Request == nil {
+		return 0
+	}
+	version := req.Request.FormValue("version")
+	if version == "" {
+		return 0
+	}
+	versionInt, err := strconv.Atoi(version)
+	if err != nil {
+		// It's not a valid version.
+		return 0
+	}
+	return versionInt
+}
+
 // getStaticSecretPathFromRequest gets the canonical path for a
 // request, taking into account intricacies relating to /v1/ and namespaces
 // in the header.
@@ -922,6 +1054,7 @@ func computeStaticSecretCacheIndex(req *SendRequest) string {
 	if path == "" {
 		return path
 	}
+
 	return hashStaticSecretIndex(path)
 }
 
@@ -963,7 +1096,7 @@ func (c *LeaseCache) HandleCacheClear(ctx context.Context) http.Handler {
 			// Default to 500 on error, unless the user provided an invalid type,
 			// which would then be a 400.
 			httpStatus := http.StatusInternalServerError
-			if err == errInvalidType {
+			if errors.Is(err, errInvalidType) {
 				httpStatus = http.StatusBadRequest
 			}
 			logical.RespondError(w, httpStatus, fmt.Errorf("failed to clear cache: %w", err))
diff --git a/command/agentproxyshared/cache/lease_cache_test.go b/command/agentproxyshared/cache/lease_cache_test.go
index 7bb45482865..6dac619759e 100644
--- a/command/agentproxyshared/cache/lease_cache_test.go
+++ b/command/agentproxyshared/cache/lease_cache_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
@@ -511,7 +511,7 @@ func TestLeaseCache_StoreCacheableStaticSecret(t *testing.T) {
 	// We expect two entries to be stored by this:
 	// 1. The actual static secret
 	// 2. The capabilities index
-	err := lc.cacheStaticSecret(context.Background(), request, response, index)
+	err := lc.cacheStaticSecret(context.Background(), request, response, index, nil)
 	if err != nil {
 		return
 	}
@@ -577,7 +577,7 @@ func TestLeaseCache_StaticSecret_CacheClear_All(t *testing.T) {
 	// We expect two entries to be stored by this:
 	// 1. The actual static secret
 	// 2. The capabilities index
-	err := lc.cacheStaticSecret(context.Background(), request, response, index)
+	err := lc.cacheStaticSecret(context.Background(), request, response, index, nil)
 	if err != nil {
 		return
 	}
diff --git a/command/agentproxyshared/cache/listener.go b/command/agentproxyshared/cache/listener.go
index c962a2c8c37..3372b4d7b9b 100644
--- a/command/agentproxyshared/cache/listener.go
+++ b/command/agentproxyshared/cache/listener.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
diff --git a/command/agentproxyshared/cache/proxy.go b/command/agentproxyshared/cache/proxy.go
index 503d981d60e..8dad2da55a9 100644
--- a/command/agentproxyshared/cache/proxy.go
+++ b/command/agentproxyshared/cache/proxy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
@@ -57,7 +57,7 @@ func NewSendResponse(apiResponse *api.Response, responseBody []byte) (*SendRespo
 	}
 
 	// If a response body is separately provided we set that as the SendResponse.ResponseBody,
-	// otherwise we will do an ioutil.ReadAll to extract the response body from apiResponse.
+	// otherwise we will do an io.ReadAll to extract the response body from apiResponse.
 	switch {
 	case len(responseBody) > 0:
 		resp.ResponseBody = responseBody
diff --git a/command/agentproxyshared/cache/static_secret_cache_updater.go b/command/agentproxyshared/cache/static_secret_cache_updater.go
index fbae0f3f24d..2af98765d47 100644
--- a/command/agentproxyshared/cache/static_secret_cache_updater.go
+++ b/command/agentproxyshared/cache/static_secret_cache_updater.go
@@ -1,18 +1,23 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
 
 import (
+	"bufio"
 	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"net/url"
+	"strings"
+	"sync/atomic"
 	"time"
 
+	"github.com/coder/websocket"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/vault/api"
@@ -20,11 +25,12 @@ import (
 	"github.com/hashicorp/vault/command/agentproxyshared/cache/cachememdb"
 	"github.com/hashicorp/vault/command/agentproxyshared/sink"
 	"github.com/hashicorp/vault/helper/useragent"
+	"github.com/hashicorp/vault/sdk/logical"
 	"golang.org/x/exp/maps"
-	"nhooyr.io/websocket"
 )
 
-// Example Event:
+// Example write event (this does not contain all possible fields):
+// Note that vault_index was added in 1.21.
 //{
 //  "id": "a3be9fb1-b514-519f-5b25-b6f144a8c1ce",
 //  "source": "https://vaultproject.io/",
@@ -38,6 +44,7 @@ import (
 //        "data_path": "secret/data/foo",
 //        "modified": "true",
 //        "oldest_version": "0",
+//        "vault_index":"djE6N2YzYTQ0NzAtN2UxMi03ODA3LTUxYmQtZmJiMmI5YzJhYjUxOjY4OjY4OjNlODcwOTdkNTc5YTgwNjVlNjNkMjUxMGYzYjcyNDExMmUwMmJlNjVmZDg2MjNlNzA0ZWZiYTg0NzM4Njk3N2U="
 //        "operation": "data-write",
 //        "path": "secret/data/foo"
 //      }
@@ -54,6 +61,38 @@ import (
 //  "time": "2023-09-12T15:19:49.394915-07:00"
 //}
 
+// Example event with namespaces for an undelete (this does not contain all possible fields):
+// {
+//  "id": "6c6b13fd-f133-f351-3cf0-b09ae6a417b1",
+//  "source": "vault://hostname",
+//  "specversion": "1.0",
+//  "type": "*",
+//  "data": {
+//    "event": {
+//      "id": "6c6b13fd-f133-f351-3cf0-b09ae6a417b1",
+//      "metadata": {
+//        "current_version": "3",
+//        "destroyed_versions": "[2,3]",
+//        "modified": "true",
+//        "vault_index":"djE6N2YzYTQ0NzAtN2UxMi03ODA3LTUxYmQtZmJiMmI5YzJhYjUxOjY4OjY4OjNlODcwOTdkNTc5YTgwNjVlNjNkMjUxMGYzYjcyNDExMmUwMmJlNjVmZDg2MjNlNzA0ZWZiYTg0NzM4Njk3N2U="
+//        "oldest_version": "0",
+//        "operation": "destroy",
+//        "path": "secret-v2/destroy/my-secret"
+//      }
+//    },
+//    "event_type": "kv-v2/destroy",
+//    "plugin_info": {
+//      "mount_class": "secret",
+//      "mount_accessor": "kv_b27b3cad",
+//      "mount_path": "secret-v2/",
+//      "plugin": "kv",
+//      "version": "2"
+//    }
+//  },
+//  "datacontentype": "application/cloudevents",
+//  "time": "2024-08-27T12:46:01.373097-04:00"
+//}
+
 // StaticSecretCacheUpdater is a struct that utilizes
 // the event system to keep the static secret cache up to date.
 type StaticSecretCacheUpdater struct {
@@ -61,6 +100,15 @@ type StaticSecretCacheUpdater struct {
 	leaseCache *LeaseCache
 	logger     hclog.Logger
 	tokenSink  sink.Sink
+
+	// allowForwardingViaHeaderDisabled is a bool that tracks if
+	// allow_forwarding_via_header is disabled on the cluster we're talking to.
+	// If we get an error back saying that it's disabled, we'll set this to true
+	// and never try to forward again.
+	// This is only ever used on clusters with version below 1.21 (whose events do
+	// not have a vault_index), as we will prefer using client controlled consistency
+	// when possible.
+	allowForwardingViaHeaderDisabled bool
 }
 
 // StaticSecretCacheUpdaterConfig is the configuration for initializing a new
@@ -155,11 +203,36 @@ func (updater *StaticSecretCacheUpdater) streamStaticSecretEvents(ctx context.Co
 			}
 			modified, ok := metadata["modified"].(string)
 			if ok && modified == "true" {
+				// If data_path were in every event, we'd get that instead, but unfortunately it isn't.
 				path, ok := metadata["path"].(string)
 				if !ok {
-					return fmt.Errorf("unexpected event format when decoding 'path' element, message: %s\nerror: %w", string(message), err)
+					return fmt.Errorf("unexpected event format when decoding 'data_path' element, message: %s\nerror: %w", string(message), err)
+				}
+				namespace, ok := data["namespace"].(string)
+				if ok {
+					path = namespace + path
+				}
+
+				deletedOrDestroyedVersions, newPath := checkForDeleteOrDestroyEvent(messageMap)
+				if len(deletedOrDestroyedVersions) > 0 {
+					path = newPath
+					err = updater.handleDeleteDestroyVersions(path, deletedOrDestroyedVersions)
+					if err != nil {
+						// While we are kind of 'missing' an event this way, re-calling this function will
+						// result in the secret remaining up to date.
+						return fmt.Errorf("error handling delete/destroy versions for static secret: path: %q, message: %s error: %w", path, message, err)
+					}
 				}
-				err := updater.updateStaticSecret(ctx, path)
+
+				// Note: For delete/destroy events, we continue through to updating the secret itself, too.
+				// This means that if the latest version of the secret gets deleted, then the cache keeps
+				// knowledge of which the latest version is.
+				// One intricacy of e.g. destroyed events is that if the latest secret is destroyed, continuing
+				// to update the secret will 404. This is consistent with other behaviour. For Proxy, this means
+				// the secret may be evicted. That's okay.
+
+				vaultIndex, _ := metadata["vault_index"].(string)
+				err = updater.updateStaticSecret(ctx, path, vaultIndex)
 				if err != nil {
 					// While we are kind of 'missing' an event this way, re-calling this function will
 					// result in the secret remaining up to date.
@@ -176,7 +249,98 @@ func (updater *StaticSecretCacheUpdater) streamStaticSecretEvents(ctx context.Co
 	return nil
 }
 
-// preEventStreamUpdate is called after successful connection to the event system but before
+// checkForDeleteOrDestroyEvent checks an event message for delete/destroy events and if there
+// are any, returns the versions to be deleted or destroyed, as well as the path to
+// If none can be found, returns empty array and empty string.
+// We have to do this since events do not always return data_path for all events. If they did,
+// we could rely on that instead of doing string manipulation.
+// Example return value: [1, 2, 3], "secrets/data/my-secret".
+func checkForDeleteOrDestroyEvent(eventMap map[string]interface{}) ([]int, string) {
+	var versions []int
+
+	data, ok := eventMap["data"].(map[string]interface{})
+	if !ok {
+		return versions, ""
+	}
+
+	event, ok := data["event"].(map[string]interface{})
+	if !ok {
+		return versions, ""
+	}
+
+	metadata, ok := event["metadata"].(map[string]interface{})
+	if !ok {
+		return versions, ""
+	}
+
+	// We should have only one of these:
+	deletedVersions, ok := metadata["deleted_versions"].(string)
+	if ok {
+		err := json.Unmarshal([]byte(deletedVersions), &versions)
+		if err != nil {
+			return versions, ""
+		}
+	}
+
+	destroyedVersions, ok := metadata["destroyed_versions"].(string)
+	if ok {
+		err := json.Unmarshal([]byte(destroyedVersions), &versions)
+		if err != nil {
+			return versions, ""
+		}
+	}
+
+	undeletedVersions, ok := metadata["undeleted_versions"].(string)
+	if ok {
+		err := json.Unmarshal([]byte(undeletedVersions), &versions)
+		if err != nil {
+			return versions, ""
+		}
+	}
+
+	// We have neither deleted_versions nor destroyed_versions, return early
+	if len(versions) == 0 {
+		return versions, ""
+	}
+
+	path, ok := metadata["path"].(string)
+	if !ok {
+		return versions, ""
+	}
+
+	namespace, ok := data["namespace"].(string)
+	if ok {
+		path = namespace + path
+	}
+
+	pluginInfo, ok := data["plugin_info"].(map[string]interface{})
+	if !ok {
+		return versions, ""
+	}
+
+	mountPath := pluginInfo["mount_path"].(string)
+	if !ok {
+		return versions, ""
+	}
+
+	// We get the path without the mount path for safety, just in case the namespace or mount path
+	// have 'data' inside.
+	namespaceMountPathOnly := namespace + mountPath
+	pathWithoutMountPath := strings.TrimPrefix(path, namespaceMountPathOnly)
+
+	// We need to trim destroy or delete to add the correct path for where the secret
+	// is stored.
+	trimmedPath := strings.TrimPrefix(pathWithoutMountPath, "delete")
+	trimmedPath = strings.TrimPrefix(trimmedPath, "destroy")
+	trimmedPath = strings.TrimPrefix(trimmedPath, "undelete")
+
+	// This is how we form the ID of the cached secrets
+	fixedPath := namespaceMountPathOnly + "data" + trimmedPath
+
+	return versions, fixedPath
+}
+
+// preEventStreamUpdate is called after successful connection to the event system, but before
 // we process any events, to ensure we don't miss any updates.
 // In some cases, this will result in multiple processing of the same updates, but
 // this ensures that we don't lose any updates to secrets that might have been sent
@@ -194,7 +358,7 @@ func (updater *StaticSecretCacheUpdater) preEventStreamUpdate(ctx context.Contex
 		if index.Type != cacheboltdb.StaticSecretType {
 			continue
 		}
-		err = updater.updateStaticSecret(ctx, index.RequestPath)
+		err = updater.updateStaticSecret(ctx, index.RequestPath, "")
 		if err != nil {
 			errs = multierror.Append(errs, err)
 		}
@@ -205,15 +369,58 @@ func (updater *StaticSecretCacheUpdater) preEventStreamUpdate(ctx context.Contex
 	return errs.ErrorOrNil()
 }
 
+// handleDeleteDestroyVersions will handle calls to deleteVersions and destroyVersions for a given cached
+// secret. The handling is simple: remove them from the cache. We do the same for undeletes, as this will
+// also affect the cache, but we don't re-grab the secret for undeletes.
+func (updater *StaticSecretCacheUpdater) handleDeleteDestroyVersions(path string, versions []int) error {
+	indexId := hashStaticSecretIndex(path)
+	// received delete/destroy versions request: path=secret-v2/delete/my-secret
+	updater.logger.Debug("received delete/undelete/destroy versions request", "path", path, "indexId", indexId, "versions", versions)
+
+	index, err := updater.leaseCache.db.Get(cachememdb.IndexNameID, indexId)
+	if errors.Is(err, cachememdb.ErrCacheItemNotFound) {
+		// This event doesn't correspond to a secret in our cache
+		// so this is a no-op.
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+
+	// Hold the lock as we're modifying the secret
+	index.IndexLock.Lock()
+	defer index.IndexLock.Unlock()
+
+	for _, version := range versions {
+		delete(index.Versions, version)
+	}
+
+	// Lastly, store the secret
+	updater.logger.Debug("storing updated secret as result of delete/undelete/destroy", "path", path, "deletedVersions", versions)
+	err = updater.leaseCache.db.Set(index)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // updateStaticSecret checks for updates for a static secret on the path given,
-// and updates the cache if appropriate
-func (updater *StaticSecretCacheUpdater) updateStaticSecret(ctx context.Context, path string) error {
+// and updates the cache if appropriate. For KVv2 secrets, we will also update
+// the version at index.Versions[currentVersion] with the same data.
+// if requiredVaultIndex is provided, we will use api.RequireState to
+// require that state in the request. If it isn't provided, we won't.
+func (updater *StaticSecretCacheUpdater) updateStaticSecret(ctx context.Context, path string, requiredVaultIndex string) error {
 	// We clone the client, as we won't be using the same token.
 	client, err := updater.client.Clone()
 	if err != nil {
 		return err
 	}
 
+	// Clear the client's header namespace since we'll be including the
+	// namespace as part of the path.
+	client.ClearNamespace()
+
 	indexId := hashStaticSecretIndex(path)
 
 	updater.logger.Debug("received update static secret request", "path", path, "indexId", indexId)
@@ -236,15 +443,55 @@ func (updater *StaticSecretCacheUpdater) updateStaticSecret(ctx context.Context,
 	}
 	request.Headers.Set("User-Agent", useragent.ProxyString())
 
+	// requiredVaultIndex will be present on any modified event from a Vault 1.21+ cluster.
+	if requiredVaultIndex != "" {
+		client = client.WithRequestCallbacks(api.RequireState(requiredVaultIndex))
+	} else {
+		// Pre-1.21 event system fallback behaviour. Try and forward the request instead.
+		if !updater.allowForwardingViaHeaderDisabled {
+			// Set this to always forward to active, since events could come before
+			// replication, and if we're connected to the standby, then we will be
+			// receiving events from the primary but otherwise getting old values from
+			// the standby here. This makes sure that Proxy functions properly
+			// even when its Vault address is set to a standby, since we cannot
+			// currently receive events from a standby.
+			// We only try this if updater.allowForwardingViaHeaderDisabled is false
+			// and if we receive an error indicating that the config is set to false,
+			// we will never set this header again.
+			request.Headers.Set(api.HeaderForward, "active-node")
+		}
+	}
+
+	minRetries := 10
+	if client.MaxRetries() < minRetries {
+		// If for whatever reason we have less retries configured than 10,
+		// set the retries to 10. This is important for managing the retries for
+		// 412 (consistency) errors when retrying on performance secondaries.
+		client.SetMaxRetries(minRetries)
+	}
+
 	var resp *api.Response
 	var tokensToRemove []string
 	var successfulAttempt bool
 	for _, token := range maps.Keys(index.Tokens) {
 		client.SetToken(token)
 		request.Headers.Set(api.AuthHeaderName, token)
+
 		resp, err = client.RawRequestWithContext(ctx, request)
+		// 1.21 fallback behaviour. Validate if we should keep trying to forward the event.
+		if requiredVaultIndex == "" && err != nil {
+			if strings.Contains(err.Error(), "forwarding via header X-Vault-Forward disabled") {
+				updater.logger.Info("allow_forwarding_via_header disabled, re-attempting update and no longer attempting to forward")
+				updater.allowForwardingViaHeaderDisabled = true
+
+				// Try again without the header
+				request.Headers.Del(api.HeaderForward)
+				resp, err = client.RawRequestWithContext(ctx, request)
+			}
+		}
+
 		if err != nil {
-			updater.logger.Trace("received error when trying to update cache", "path", path, "err", err, "token", token)
+			updater.logger.Trace("received error when trying to update cache", "path", path, "err", err, "token", token, "namespace", index.Namespace)
 			// We cannot access this secret with this token for whatever reason,
 			// so token for removal.
 			tokensToRemove = append(tokensToRemove, token)
@@ -279,10 +526,35 @@ func (updater *StaticSecretCacheUpdater) updateStaticSecret(ctx context.Context,
 			return err
 		}
 
-		// Set the index's Response
 		index.Response = respBytes.Bytes()
 		index.LastRenewed = time.Now().UTC()
 
+		// For KVv2 secrets, let's also update index.Versions[version_of_secret]
+		// with the response we received from the current version.
+		// Instead of relying on current_version in the event, we should
+		// check the message we received, since it's possible the secret
+		// got updated between receipt of the event and when we received
+		// the request for the secret.
+		// First, re-read secret into response so that we can parse it again:
+		reader := bufio.NewReader(bytes.NewReader(index.Response))
+		resp, err := http.ReadResponse(reader, nil)
+		if err != nil {
+			// This shouldn't happen, but log just in case it does. There's
+			// no real negative consequences of the following function though.
+			updater.logger.Warn("failed to deserialize response", "error", err)
+		}
+
+		secret, err := api.ParseSecret(resp.Body)
+		if err != nil {
+			// This shouldn't happen, but log just in case it does. There's
+			// no real negative consequences of the following function though.
+			updater.logger.Warn("failed to serialize response", "error", err)
+		}
+
+		// In case of failures or KVv1 secrets, this function will simply fail silently,
+		// which is fine (and expected) since this could be arbitrary JSON.
+		updater.leaseCache.addToVersionListForCurrentVersionKVv2Secret(index, secret)
+
 		// Lastly, store the secret
 		updater.logger.Debug("storing response into the cache due to update", "path", path)
 		err = updater.leaseCache.db.Set(index)
@@ -325,6 +597,7 @@ func (updater *StaticSecretCacheUpdater) openWebSocketConnection(ctx context.Con
 	}
 	query := webSocketURL.Query()
 	query.Set("json", "true")
+	query.Set("namespaces", "*")
 	webSocketURL.RawQuery = query.Encode()
 
 	updater.client.AddHeader(api.AuthHeaderName, updater.client.Token())
@@ -359,13 +632,23 @@ func (updater *StaticSecretCacheUpdater) openWebSocketConnection(ctx context.Con
 	}
 
 	if err != nil {
+		errMessage := err.Error()
 		if resp != nil {
 			if resp.StatusCode == http.StatusNotFound {
 				return nil, fmt.Errorf("received 404 when opening web socket to %s, ensure Vault is Enterprise version 1.16 or above", wsURL)
 			}
+			if resp.StatusCode == http.StatusForbidden {
+				var errBytes []byte
+				errBytes, err = io.ReadAll(resp.Body)
+				resp.Body.Close()
+				if err != nil {
+					return nil, fmt.Errorf("error occured when attempting to read error response from Vault server")
+				}
+				errMessage = string(errBytes)
+			}
 		}
 		return nil, fmt.Errorf("error returned when opening event stream web socket to %s, ensure auto-auth token"+
-			" has correct permissions and Vault is Enterprise version 1.16 or above: %w", wsURL, err)
+			" has correct permissions and Vault is Enterprise version 1.16 or above: %s", wsURL, errMessage)
 	}
 
 	if conn == nil {
@@ -379,7 +662,7 @@ func (updater *StaticSecretCacheUpdater) openWebSocketConnection(ctx context.Con
 // Once a token is provided to the sink, we will start the websocket and start consuming
 // events and updating secrets.
 // Run will shut down gracefully when the context is cancelled.
-func (updater *StaticSecretCacheUpdater) Run(ctx context.Context) error {
+func (updater *StaticSecretCacheUpdater) Run(ctx context.Context, authRenewalInProgress *atomic.Bool, invalidTokenErrCh chan error) error {
 	updater.logger.Info("starting static secret cache updater subsystem")
 	defer func() {
 		updater.logger.Info("static secret cache updater subsystem stopped")
@@ -415,6 +698,15 @@ tokenLoop:
 			if err != nil {
 				updater.logger.Error("error occurred during streaming static secret cache update events", "err", err)
 				shouldBackoff = true
+				if strings.Contains(err.Error(), logical.ErrInvalidToken.Error()) && !authRenewalInProgress.Load() {
+					// Drain the channel in case there is an error that has already been sent but not received
+					select {
+					case <-invalidTokenErrCh:
+					default:
+					}
+					updater.logger.Error("received invalid token error while opening websocket")
+					invalidTokenErrCh <- err
+				}
 				continue
 			}
 		}
diff --git a/command/agentproxyshared/cache/static_secret_cache_updater_test.go b/command/agentproxyshared/cache/static_secret_cache_updater_test.go
index f77ad4168a6..3b3a2b4d5e3 100644
--- a/command/agentproxyshared/cache/static_secret_cache_updater_test.go
+++ b/command/agentproxyshared/cache/static_secret_cache_updater_test.go
@@ -1,15 +1,21 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
 
 import (
+	"bufio"
+	"bytes"
 	"context"
 	"fmt"
+	"net/http"
+	"os"
 	"sync"
+	syncatomic "sync/atomic"
 	"testing"
 	"time"
 
+	"github.com/coder/websocket"
 	"github.com/hashicorp/go-hclog"
 	kv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/api"
@@ -24,7 +30,6 @@ import (
 	"github.com/hashicorp/vault/vault"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/atomic"
-	"nhooyr.io/websocket"
 )
 
 // Avoiding a circular dependency in the test.
@@ -64,9 +69,7 @@ func testNewStaticSecretCacheUpdater(t *testing.T, client *api.Client) *StaticSe
 		Logger:     logging.NewVaultLogger(hclog.Trace).Named("cache.updater"),
 		TokenSink:  tokenSink,
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	return updater
 }
 
@@ -79,9 +82,7 @@ func TestNewStaticSecretCacheUpdater(t *testing.T) {
 	config := api.DefaultConfig()
 	logger := logging.NewVaultLogger(hclog.Trace).Named("cache.updater")
 	client, err := api.NewClient(config)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	tokenSink := newMockSink(t)
 
 	// Expect an error if any of the arguments are nil:
@@ -128,9 +129,7 @@ func TestNewStaticSecretCacheUpdater(t *testing.T) {
 		Logger:     logging.NewVaultLogger(hclog.Trace).Named("cache.updater"),
 		TokenSink:  tokenSink,
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	require.NotNil(t, updater)
 }
 
@@ -156,10 +155,138 @@ func TestOpenWebSocketConnection(t *testing.T) {
 	}
 }
 
+// TestOpenWebSocketConnection_BadPolicyToken tests attempting to open a websocket
+// connection to the events system using a token that has incorrect policy access
+// will not trigger auto auth
+func TestOpenWebSocketConnection_BadPolicyToken(t *testing.T) {
+	// We need a valid cluster for the connection to succeed.
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	updater := testNewStaticSecretCacheUpdater(t, client)
+
+	eventPolicy := `path "sys/events/subscribe/*" {
+		capabilities = ["deny"]
+	}`
+	client.Sys().PutPolicy("no_events_access", eventPolicy)
+
+	// Create a new token with a bad policy
+	token, err := client.Auth().Token().Create(&api.TokenCreateRequest{
+		Policies: []string{"no_events_access"},
+	})
+	require.NoError(t, err)
+
+	// Set the client token to one with an invalid policy
+	updater.tokenSink.WriteToken(token.Auth.ClientToken)
+	client.SetToken(token.Auth.ClientToken)
+
+	ctx, cancelFunc := context.WithCancel(context.Background())
+
+	authInProgress := &syncatomic.Bool{}
+	renewalChannel := make(chan error)
+	errCh := make(chan error)
+	go func() {
+		errCh <- updater.Run(ctx, authInProgress, renewalChannel)
+	}()
+	defer func() {
+		select {
+		case <-ctx.Done():
+		case err := <-errCh:
+			require.NoError(t, err)
+		}
+	}()
+
+	defer cancelFunc()
+
+	// Verify that the token has been written to the sink before checking auto auth
+	// is not re-triggered
+	err = updater.streamStaticSecretEvents(ctx)
+	require.ErrorContains(t, err, logical.ErrPermissionDenied.Error())
+
+	// Auto auth should not be retriggered
+	timeout := time.After(2 * time.Second)
+	select {
+	case <-renewalChannel:
+		t.Fatal("incorrectly triggered auto auth")
+	case <-ctx.Done():
+		t.Fatal("context was closed before auto auth could be re-triggered")
+	case <-timeout:
+	}
+}
+
+// TestOpenWebSocketConnection_AutoAuthSelfHeal tests attempting to open a websocket
+// connection to the events system using an invalid token will re-trigger
+// auto auth.
+func TestOpenWebSocketConnection_AutoAuthSelfHeal(t *testing.T) {
+	// We need a valid cluster for the connection to succeed.
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	updater := testNewStaticSecretCacheUpdater(t, client)
+
+	// Revoke the token before it can be used to open a connection to the events system
+	client.Auth().Token().RevokeOrphan(client.Token())
+	updater.tokenSink.WriteToken(client.Token())
+	time.Sleep(100 * time.Millisecond)
+
+	ctx, cancelFunc := context.WithCancel(context.Background())
+
+	authInProgress := &syncatomic.Bool{}
+	renewalChannel := make(chan error)
+	errCh := make(chan error)
+	go func() {
+		errCh <- updater.Run(ctx, authInProgress, renewalChannel)
+	}()
+	defer func() {
+		select {
+		case <-ctx.Done():
+		case err := <-errCh:
+			require.NoError(t, err)
+		}
+	}()
+
+	defer cancelFunc()
+
+	// Wait for static secret updater to begin
+	timeout := time.After(10 * time.Second)
+
+	select {
+	case <-renewalChannel:
+	case <-ctx.Done():
+		t.Fatal("context was closed before auto auth could be re-triggered")
+	case <-timeout:
+		t.Fatal("timed out before auto auth could be re-triggered")
+	}
+	authInProgress.Store(false)
+
+	// Verify that auto auth is re-triggered again because another auth is "not in progress"
+	timeout = time.After(15 * time.Second)
+	select {
+	case <-renewalChannel:
+	case <-ctx.Done():
+		t.Fatal("context was closed before auto auth could be re-triggered")
+	case <-timeout:
+		t.Fatal("timed out before auto auth could be re-triggered")
+	}
+	authInProgress.Store(true)
+
+	// Verify that auto auth is NOT re-triggered again because another auth is in progress
+	timeout = time.After(2 * time.Second)
+	select {
+	case <-renewalChannel:
+		t.Fatal("auto auth was incorrectly re-triggered")
+	case <-ctx.Done():
+		t.Fatal("context was closed before auto auth could be re-triggered")
+	case <-timeout:
+	}
+}
+
 // TestOpenWebSocketConnectionReceivesEventsDefaultMount tests that the openWebSocketConnection function
 // works as expected with the default KVV1 mount, and then the connection can be used to receive an event.
 // This acts as more of an event system sanity check than a test of the updater
 // logic. It's still important coverage, though.
+// It also adds a client timeout of 1 second and checks that the connection does not timeout as this is a
+// streaming request.
 func TestOpenWebSocketConnectionReceivesEventsDefaultMount(t *testing.T) {
 	if !constants.IsEnterprise {
 		t.Skip("test can only run on enterprise due to requiring the event notification system")
@@ -169,14 +296,17 @@ func TestOpenWebSocketConnectionReceivesEventsDefaultMount(t *testing.T) {
 	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
 	})
+
+	oldClientTimeout := os.Getenv("VAULT_CLIENT_TIMEOUT")
+	os.Setenv("VAULT_CLIENT_TIMEOUT", "1")
+	defer os.Setenv("VAULT_CLIENT_TIMEOUT", oldClientTimeout)
+
 	client := cluster.Cores[0].Client
 
 	updater := testNewStaticSecretCacheUpdater(t, client)
 
 	conn, err := updater.openWebSocketConnection(context.Background())
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	require.NotNil(t, conn)
 
 	t.Cleanup(func() {
@@ -190,24 +320,18 @@ func TestOpenWebSocketConnectionReceivesEventsDefaultMount(t *testing.T) {
 	}
 	// Put a secret, which should trigger an event
 	err = client.KVv1("secret").Put(context.Background(), "foo", makeData(100))
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	for i := 0; i < 5; i++ {
 		// Do a fresh PUT just to refresh the secret and send a new message
 		err = client.KVv1("secret").Put(context.Background(), "foo", makeData(i))
-		if err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, err)
 
 		// This method blocks until it gets a secret, so this test
 		// will only pass if we're receiving events correctly.
-		_, message, err := conn.Read(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
-		t.Log(string(message))
+		// It will fail here if the connection times out.
+		_, _, err = conn.Read(context.Background())
+		require.NoError(t, err)
 	}
 }
 
@@ -233,9 +357,7 @@ func TestOpenWebSocketConnectionReceivesEventsKVV1(t *testing.T) {
 	updater := testNewStaticSecretCacheUpdater(t, client)
 
 	conn, err := updater.openWebSocketConnection(context.Background())
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	require.NotNil(t, conn)
 
 	t.Cleanup(func() {
@@ -245,9 +367,7 @@ func TestOpenWebSocketConnectionReceivesEventsKVV1(t *testing.T) {
 	err = client.Sys().Mount("secret-v1", &api.MountInput{
 		Type: "kv",
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	makeData := func(i int) map[string]interface{} {
 		return map[string]interface{}{
@@ -256,27 +376,21 @@ func TestOpenWebSocketConnectionReceivesEventsKVV1(t *testing.T) {
 	}
 	// Put a secret, which should trigger an event
 	err = client.KVv1("secret-v1").Put(context.Background(), "foo", makeData(100))
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	for i := 0; i < 5; i++ {
 		// Do a fresh PUT just to refresh the secret and send a new message
 		err = client.KVv1("secret-v1").Put(context.Background(), "foo", makeData(i))
-		if err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, err)
 
 		// This method blocks until it gets a secret, so this test
 		// will only pass if we're receiving events correctly.
 		_, _, err := conn.Read(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, err)
 	}
 }
 
-// TestOpenWebSocketConnectionReceivesEvents tests that the openWebSocketConnection function
+// TestOpenWebSocketConnectionReceivesEventsKVV2 tests that the openWebSocketConnection function
 // works as expected with KVV2, and then the connection can be used to receive an event.
 // This acts as more of an event system sanity check than a test of the updater
 // logic. It's still important coverage, though.
@@ -298,9 +412,7 @@ func TestOpenWebSocketConnectionReceivesEventsKVV2(t *testing.T) {
 	updater := testNewStaticSecretCacheUpdater(t, client)
 
 	conn, err := updater.openWebSocketConnection(context.Background())
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	require.NotNil(t, conn)
 
 	t.Cleanup(func() {
@@ -316,29 +428,21 @@ func TestOpenWebSocketConnectionReceivesEventsKVV2(t *testing.T) {
 	err = client.Sys().Mount("secret-v2", &api.MountInput{
 		Type: "kv-v2",
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	// Put a secret, which should trigger an event
 	_, err = client.KVv2("secret-v2").Put(context.Background(), "foo", makeData(100))
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	for i := 0; i < 5; i++ {
 		// Do a fresh PUT just to refresh the secret and send a new message
 		_, err = client.KVv2("secret-v2").Put(context.Background(), "foo", makeData(i))
-		if err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, err)
 
 		// This method blocks until it gets a secret, so this test
 		// will only pass if we're receiving events correctly.
 		_, _, err := conn.Read(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, err)
 	}
 }
 
@@ -358,24 +462,18 @@ func TestOpenWebSocketConnectionTestServer(t *testing.T) {
 	keys, rootToken := vault.TestCoreInit(t, core)
 	for _, key := range keys {
 		_, err := core.Unseal(key)
-		if err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, err)
 	}
 
 	config := api.DefaultConfig()
 	config.Address = addr
 	client, err := api.NewClient(config)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	client.SetToken(rootToken)
 	updater := testNewStaticSecretCacheUpdater(t, client)
 
 	conn, err := updater.openWebSocketConnection(context.Background())
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	require.NotNil(t, conn)
 }
 
@@ -405,9 +503,7 @@ func Test_StreamStaticSecretEvents_UpdatesCacheWithNewSecrets(t *testing.T) {
 	runStreamStaticSecretEvents := func() {
 		wg.Add(1)
 		err := updater.streamStaticSecretEvents(context.Background())
-		if err != nil {
-			t.Fatal(err)
-		}
+		require.NoError(t, err)
 	}
 	go runStreamStaticSecretEvents()
 
@@ -419,6 +515,7 @@ func Test_StreamStaticSecretEvents_UpdatesCacheWithNewSecrets(t *testing.T) {
 	index := &cachememdb.Index{
 		Namespace:   "root/",
 		RequestPath: path,
+		Versions:    map[int][]byte{},
 		LastRenewed: initialTime,
 		ID:          indexId,
 		// Valid token provided, so update should work.
@@ -426,9 +523,7 @@ func Test_StreamStaticSecretEvents_UpdatesCacheWithNewSecrets(t *testing.T) {
 		Response: []byte{},
 	}
 	err := leaseCache.db.Set(index)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	secretData := map[string]interface{}{
 		"foo": "bar",
@@ -437,9 +532,7 @@ func Test_StreamStaticSecretEvents_UpdatesCacheWithNewSecrets(t *testing.T) {
 	err = client.Sys().Mount("secret-v2", &api.MountInput{
 		Type: "kv-v2",
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	// Wait for the event stream to be fully up and running. Should be faster than this in reality, but
 	// we make it five seconds to protect against CI flakiness.
@@ -447,9 +540,7 @@ func Test_StreamStaticSecretEvents_UpdatesCacheWithNewSecrets(t *testing.T) {
 
 	// Put a secret, which should trigger an event
 	_, err = client.KVv2("secret-v2").Put(context.Background(), "foo", secretData)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	// Wait for the event to arrive. Events are usually much, much faster
 	// than this, but we make it five seconds to protect against CI flakiness.
@@ -457,15 +548,19 @@ func Test_StreamStaticSecretEvents_UpdatesCacheWithNewSecrets(t *testing.T) {
 
 	// Then, do a GET to see if the index got updated by the event
 	newIndex, err := leaseCache.db.Get(cachememdb.IndexNameID, indexId)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 	require.NotNil(t, newIndex)
 	require.NotEqual(t, []byte{}, newIndex.Response)
 	require.Truef(t, initialTime.Before(newIndex.LastRenewed), "last updated time not updated on index")
 	require.Equal(t, index.RequestPath, newIndex.RequestPath)
 	require.Equal(t, index.Tokens, newIndex.Tokens)
 
+	// Assert that the corresponding version got updated too
+	require.Len(t, newIndex.Versions, 1)
+	require.NotNil(t, newIndex.Versions)
+	require.NotNil(t, newIndex.Versions[1])
+	require.Equal(t, newIndex.Versions[1], newIndex.Response)
+
 	wg.Done()
 }
 
@@ -491,14 +586,13 @@ func TestUpdateStaticSecret(t *testing.T) {
 		RequestPath: "secret/foo",
 		LastRenewed: initialTime,
 		ID:          indexId,
+		Versions:    map[int][]byte{},
 		// Valid token provided, so update should work.
 		Tokens:   map[string]struct{}{client.Token(): {}},
 		Response: []byte{},
 	}
 	err := leaseCache.db.Set(index)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	secretData := map[string]interface{}{
 		"foo": "bar",
@@ -506,25 +600,104 @@ func TestUpdateStaticSecret(t *testing.T) {
 
 	// create the secret in Vault. n.b. the test cluster has already mounted the KVv1 backend at "secret"
 	err = client.KVv1("secret").Put(context.Background(), "foo", secretData)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	// attempt the update
-	err = updater.updateStaticSecret(context.Background(), path)
-	if err != nil {
-		t.Fatal(err)
-	}
+	err = updater.updateStaticSecret(context.Background(), path, "")
+	require.NoError(t, err)
 
 	newIndex, err := leaseCache.db.Get(cachememdb.IndexNameID, indexId)
-	if err != nil {
-		t.Fatal(err)
+	require.NoError(t, err)
+	require.NotNil(t, newIndex)
+	require.Truef(t, initialTime.Before(newIndex.LastRenewed), "last updated time not updated on index")
+	require.NotEqual(t, []byte{}, newIndex.Response)
+	require.Equal(t, index.RequestPath, newIndex.RequestPath)
+	require.Equal(t, index.Tokens, newIndex.Tokens)
+	require.Len(t, newIndex.Versions, 0)
+
+	reader := bufio.NewReader(bytes.NewReader(newIndex.Response))
+	resp, err := http.ReadResponse(reader, nil)
+	require.NoError(t, err)
+
+	secret, err := api.ParseSecret(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, secretData, secret.Data)
+}
+
+// TestUpdateStaticSecret_KVv2 tests that updateStaticSecret works as expected, reaching out
+// to Vault to get an updated secret when called. It should also update the corresponding
+// version of that secret in the cache index's Versions field.
+func TestUpdateStaticSecret_KVv2(t *testing.T) {
+	t.Parallel()
+	// We need a valid cluster for the connection to succeed.
+	cluster := vault.NewTestCluster(t, &vault.CoreConfig{
+		LogicalBackends: map[string]logical.Factory{
+			"kv": kv.VersionedKVFactory,
+		},
+	}, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+	})
+	client := cluster.Cores[0].Client
+
+	updater := testNewStaticSecretCacheUpdater(t, client)
+	leaseCache := updater.leaseCache
+
+	path := "secret-v2/data/foo"
+	indexId := hashStaticSecretIndex(path)
+	initialTime := time.Now().UTC()
+	// pre-populate the leaseCache with a secret to update
+	index := &cachememdb.Index{
+		Namespace:   "root/",
+		RequestPath: path,
+		LastRenewed: initialTime,
+		ID:          indexId,
+		Versions:    map[int][]byte{},
+		// Valid token provided, so update should work.
+		Tokens:   map[string]struct{}{client.Token(): {}},
+		Response: []byte{},
+	}
+	err := leaseCache.db.Set(index)
+	require.NoError(t, err)
+
+	secretData := map[string]interface{}{
+		"foo": "bar",
 	}
+
+	err = client.Sys().Mount("secret-v2", &api.MountInput{
+		Type: "kv-v2",
+	})
+	require.NoError(t, err)
+
+	// create the secret in Vault
+	_, err = client.KVv2("secret-v2").Put(context.Background(), "foo", secretData)
+	require.NoError(t, err)
+
+	// attempt the update
+	err = updater.updateStaticSecret(context.Background(), path, "")
+	require.NoError(t, err)
+
+	newIndex, err := leaseCache.db.Get(cachememdb.IndexNameID, indexId)
+	require.NoError(t, err)
 	require.NotNil(t, newIndex)
 	require.Truef(t, initialTime.Before(newIndex.LastRenewed), "last updated time not updated on index")
 	require.NotEqual(t, []byte{}, newIndex.Response)
 	require.Equal(t, index.RequestPath, newIndex.RequestPath)
 	require.Equal(t, index.Tokens, newIndex.Tokens)
+
+	// It should have also updated version 1 with the same version.
+	require.Len(t, newIndex.Versions, 1)
+	require.NotNil(t, newIndex.Versions[1])
+	require.Equal(t, newIndex.Versions[1], newIndex.Response)
+
+	reader := bufio.NewReader(bytes.NewReader(newIndex.Response))
+	resp, err := http.ReadResponse(reader, nil)
+	require.NoError(t, err)
+
+	secret, err := api.ParseSecret(resp.Body)
+	require.NoError(t, err)
+	data, ok := secret.Data["data"]
+	require.True(t, ok)
+	require.Equal(t, secretData, data)
 }
 
 // TestUpdateStaticSecret_EvictsIfInvalidTokens tests that updateStaticSecret will
@@ -554,9 +727,7 @@ func TestUpdateStaticSecret_EvictsIfInvalidTokens(t *testing.T) {
 		Tokens: map[string]struct{}{"invalid token": {}},
 	}
 	err := leaseCache.db.Set(index)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	secretData := map[string]interface{}{
 		"foo": "bar",
@@ -564,15 +735,11 @@ func TestUpdateStaticSecret_EvictsIfInvalidTokens(t *testing.T) {
 
 	// create the secret in Vault. n.b. the test cluster has already mounted the KVv1 backend at "secret"
 	err = client.KVv1("secret").Put(context.Background(), "foo", secretData)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	// attempt the update
-	err = updater.updateStaticSecret(context.Background(), path)
-	if err != nil {
-		t.Fatal(err)
-	}
+	err = updater.updateStaticSecret(context.Background(), path, "")
+	require.NoError(t, err)
 
 	newIndex, err := leaseCache.db.Get(cachememdb.IndexNameID, indexId)
 	require.Equal(t, cachememdb.ErrCacheItemNotFound, err)
@@ -593,11 +760,9 @@ func TestUpdateStaticSecret_HandlesNonCachedPaths(t *testing.T) {
 
 	path := "secret/foo"
 
-	// attempt the update
-	err := updater.updateStaticSecret(context.Background(), path)
-	if err != nil {
-		t.Fatal(err)
-	}
+	// Attempt the update
+	err := updater.updateStaticSecret(context.Background(), path, "")
+	require.NoError(t, err)
 	require.Nil(t, err)
 }
 
@@ -627,15 +792,14 @@ func TestPreEventStreamUpdate(t *testing.T) {
 		RequestPath: path,
 		LastRenewed: initialTime,
 		ID:          indexId,
+		Versions:    map[int][]byte{},
 		// Valid token provided, so update should work.
 		Tokens:   map[string]struct{}{client.Token(): {}},
 		Response: []byte{},
 		Type:     cacheboltdb.StaticSecretType,
 	}
 	err := leaseCache.db.Set(index)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	secretData := map[string]interface{}{
 		"foo": "bar",
@@ -644,15 +808,11 @@ func TestPreEventStreamUpdate(t *testing.T) {
 	err = client.Sys().Mount("secret-v2", &api.MountInput{
 		Type: "kv-v2",
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	// Put a secret (with different values to what's currently in the cache)
 	_, err = client.KVv2("secret-v2").Put(context.Background(), "foo", secretData)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	// perform the pre-event stream update:
 	err = updater.preEventStreamUpdate(context.Background())
@@ -666,6 +826,7 @@ func TestPreEventStreamUpdate(t *testing.T) {
 	require.Truef(t, initialTime.Before(newIndex.LastRenewed), "last updated time not updated on index")
 	require.Equal(t, index.RequestPath, newIndex.RequestPath)
 	require.Equal(t, index.Tokens, newIndex.Tokens)
+	require.Equal(t, index.Versions, newIndex.Versions)
 }
 
 // TestPreEventStreamUpdateErrorUpdating tests that preEventStreamUpdate correctly responds
@@ -700,9 +861,7 @@ func TestPreEventStreamUpdateErrorUpdating(t *testing.T) {
 		Type:     cacheboltdb.StaticSecretType,
 	}
 	err := leaseCache.db.Set(index)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	secretData := map[string]interface{}{
 		"foo": "bar",
@@ -711,15 +870,11 @@ func TestPreEventStreamUpdateErrorUpdating(t *testing.T) {
 	err = client.Sys().Mount("secret-v2", &api.MountInput{
 		Type: "kv-v2",
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	// Put a secret (with different values to what's currently in the cache)
 	_, err = client.KVv2("secret-v2").Put(context.Background(), "foo", secretData)
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	// Seal Vault, so that the update will fail
 	cluster.EnsureCoresSealed(t)
@@ -732,3 +887,189 @@ func TestPreEventStreamUpdateErrorUpdating(t *testing.T) {
 	_, err = leaseCache.db.Get(cachememdb.IndexNameID, indexId)
 	require.Equal(t, cachememdb.ErrCacheItemNotFound, err)
 }
+
+// TestCheckForDeleteOrDestroyEvent tests the behaviour of checkForDeleteOrDestroyEvent
+// and assures it gives the right responses for different events.
+func TestCheckForDeleteOrDestroyEvent(t *testing.T) {
+	t.Parallel()
+
+	expectedVersions := []int{1, 3, 5}
+	jsonFormatExpectedVersions := "[1,3,5]"
+	expectedPath := "secret-v2/data/my-secret"
+	deletedVersionEventMap := map[string]interface{}{
+		"id":     "abc",
+		"source": "abc",
+		"data": map[string]interface{}{
+			"event": map[string]interface{}{
+				"id": "bar",
+				"metadata": map[string]interface{}{
+					"current_version":  "2",
+					"deleted_versions": jsonFormatExpectedVersions,
+					"modified":         true,
+					"operation":        "delete",
+					"path":             "secret-v2/delete/my-secret",
+				},
+			},
+			"event_type": "kv-v2/delete",
+			"plugin_info": map[string]interface{}{
+				"mount_path": "secret-v2/",
+				"plugin":     "kv",
+				"version":    2,
+			},
+		},
+	}
+
+	undeletedVersionEventMap := map[string]interface{}{
+		"id":     "abc",
+		"source": "abc",
+		"data": map[string]interface{}{
+			"event": map[string]interface{}{
+				"id": "bar",
+				"metadata": map[string]interface{}{
+					"current_version":    "2",
+					"undeleted_versions": jsonFormatExpectedVersions,
+					"modified":           true,
+					"operation":          "undelete",
+					"path":               "secret-v2/undelete/my-secret",
+				},
+			},
+			"event_type": "kv-v2/undelete",
+			"plugin_info": map[string]interface{}{
+				"mount_path": "secret-v2/",
+				"plugin":     "kv",
+				"version":    2,
+			},
+		},
+	}
+
+	destroyedVersionEventMap := map[string]interface{}{
+		"id":     "abc",
+		"source": "abc",
+		"data": map[string]interface{}{
+			"event": map[string]interface{}{
+				"id": "bar",
+				"metadata": map[string]interface{}{
+					"current_version":    "2",
+					"destroyed_versions": jsonFormatExpectedVersions,
+					"modified":           true,
+					"operation":          "destroy",
+					"path":               "secret-v2/destroy/my-secret",
+				},
+			},
+			"event_type": "kv-v2/destroy",
+			"plugin_info": map[string]interface{}{
+				"mount_path": "secret-v2/",
+				"plugin":     "kv",
+				"version":    2,
+			},
+		},
+	}
+
+	actualVersions, actualPath := checkForDeleteOrDestroyEvent(deletedVersionEventMap)
+	require.Equal(t, expectedVersions, actualVersions)
+	require.Equal(t, expectedPath, actualPath)
+
+	actualVersions, actualPath = checkForDeleteOrDestroyEvent(undeletedVersionEventMap)
+	require.Equal(t, expectedVersions, actualVersions)
+	require.Equal(t, expectedPath, actualPath)
+
+	actualVersions, actualPath = checkForDeleteOrDestroyEvent(destroyedVersionEventMap)
+	require.Equal(t, expectedVersions, actualVersions)
+	require.Equal(t, expectedPath, actualPath)
+}
+
+// TestCheckForDeleteOrDestroyNamespacedEvent tests the behaviour of checkForDeleteOrDestroyEvent
+// with namespaces in paths.
+func TestCheckForDeleteOrDestroyNamespacedEvent(t *testing.T) {
+	t.Parallel()
+
+	expectedVersions := []int{1, 3, 5}
+	jsonFormatExpectedVersions := "[1,3,5]"
+	expectedPath := "ns/secret-v2/data/my-secret"
+	deletedVersionEventMap := map[string]interface{}{
+		"id":     "abc",
+		"source": "abc",
+		"data": map[string]interface{}{
+			"event": map[string]interface{}{
+				"id": "bar",
+				"metadata": map[string]interface{}{
+					"current_version":  "2",
+					"deleted_versions": jsonFormatExpectedVersions,
+					"modified":         true,
+					"operation":        "delete",
+					"data_path":        "secret-v2/data/my-secret",
+					"path":             "secret-v2/delete/my-secret",
+				},
+			},
+			"namespace":  "ns/",
+			"event_type": "kv-v2/delete",
+			"plugin_info": map[string]interface{}{
+				"mount_path": "secret-v2/",
+				"plugin":     "kv",
+				"version":    2,
+			},
+		},
+	}
+
+	undeletedVersionEventMap := map[string]interface{}{
+		"id":     "abc",
+		"source": "abc",
+		"data": map[string]interface{}{
+			"event": map[string]interface{}{
+				"id": "bar",
+				"metadata": map[string]interface{}{
+					"current_version":    "2",
+					"undeleted_versions": jsonFormatExpectedVersions,
+					"modified":           true,
+					"operation":          "undelete",
+					"data_path":          "secret-v2/data/my-secret",
+					"path":               "secret-v2/undelete/my-secret",
+				},
+			},
+			"namespace":  "ns/",
+			"event_type": "kv-v2/undelete",
+			"plugin_info": map[string]interface{}{
+				"mount_path": "secret-v2/",
+				"plugin":     "kv",
+				"version":    2,
+			},
+		},
+	}
+
+	destroyedVersionEventMap := map[string]interface{}{
+		"id":     "abc",
+		"source": "abc",
+		"data": map[string]interface{}{
+			"event": map[string]interface{}{
+				"id": "bar",
+				"metadata": map[string]interface{}{
+					"current_version":    "2",
+					"destroyed_versions": jsonFormatExpectedVersions,
+					"modified":           true,
+					"operation":          "destroy",
+					"data_path":          "secret-v2/data/my-secret",
+					"path":               "secret-v2/destroy/my-secret",
+				},
+			},
+			"namespace":  "ns/",
+			"event_type": "kv-v2/destroy",
+			"plugin_info": map[string]interface{}{
+				"mount_path": "secret-v2/",
+				"plugin":     "kv",
+				"version":    2,
+			},
+		},
+	}
+
+	actualVersions, actualPath := checkForDeleteOrDestroyEvent(deletedVersionEventMap)
+	require.Equal(t, expectedVersions, actualVersions)
+	require.Equal(t, expectedPath, actualPath)
+
+	actualVersions, actualPath = checkForDeleteOrDestroyEvent(undeletedVersionEventMap)
+	require.Equal(t, expectedVersions, actualVersions)
+	require.Equal(t, expectedPath, actualPath)
+
+	actualVersions, actualPath = checkForDeleteOrDestroyEvent(destroyedVersionEventMap)
+	require.Equal(t, expectedVersions, actualVersions)
+	require.Equal(t, expectedPath, actualPath)
+}
diff --git a/command/agentproxyshared/cache/static_secret_capability_manager.go b/command/agentproxyshared/cache/static_secret_capability_manager.go
index 46de4740dd9..9c236494fb8 100644
--- a/command/agentproxyshared/cache/static_secret_capability_manager.go
+++ b/command/agentproxyshared/cache/static_secret_capability_manager.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
@@ -19,6 +19,13 @@ import (
 	"golang.org/x/exp/maps"
 )
 
+type TokenCapabilityRefreshBehaviour int
+
+const (
+	TokenCapabilityRefreshBehaviourOptimistic TokenCapabilityRefreshBehaviour = iota
+	TokenCapabilityRefreshBehaviourPessimistic
+)
+
 const (
 	// DefaultWorkers is the default number of workers for the worker pool.
 	DefaultWorkers = 5
@@ -37,15 +44,17 @@ type StaticSecretCapabilityManager struct {
 	logger                                     hclog.Logger
 	workerPool                                 *workerpool.WorkerPool
 	staticSecretTokenCapabilityRefreshInterval time.Duration
+	tokenCapabilityRefreshBehaviour            TokenCapabilityRefreshBehaviour
 }
 
 // StaticSecretCapabilityManagerConfig is the configuration for initializing a new
 // StaticSecretCapabilityManager.
 type StaticSecretCapabilityManagerConfig struct {
-	LeaseCache                                 *LeaseCache
-	Logger                                     hclog.Logger
-	Client                                     *api.Client
-	StaticSecretTokenCapabilityRefreshInterval time.Duration
+	LeaseCache                                  *LeaseCache
+	Logger                                      hclog.Logger
+	Client                                      *api.Client
+	StaticSecretTokenCapabilityRefreshInterval  time.Duration
+	StaticSecretTokenCapabilityRefreshBehaviour string
 }
 
 // NewStaticSecretCapabilityManager creates a new instance of a StaticSecretCapabilityManager.
@@ -70,6 +79,18 @@ func NewStaticSecretCapabilityManager(conf *StaticSecretCapabilityManagerConfig)
 		conf.StaticSecretTokenCapabilityRefreshInterval = DefaultStaticSecretTokenCapabilityRefreshInterval
 	}
 
+	behaviour := TokenCapabilityRefreshBehaviourOptimistic
+	if conf.StaticSecretTokenCapabilityRefreshBehaviour != "" {
+		switch conf.StaticSecretTokenCapabilityRefreshBehaviour {
+		case "optimistic":
+			behaviour = TokenCapabilityRefreshBehaviourOptimistic
+		case "pessimistic":
+			behaviour = TokenCapabilityRefreshBehaviourPessimistic
+		default:
+			return nil, fmt.Errorf("TokenCapabilityRefreshBehaviour must be either \"optimistic\" or \"pessimistic\"")
+		}
+	}
+
 	workerPool := workerpool.New(DefaultWorkers)
 
 	return &StaticSecretCapabilityManager{
@@ -78,6 +99,7 @@ func NewStaticSecretCapabilityManager(conf *StaticSecretCapabilityManagerConfig)
 		logger:     conf.Logger,
 		workerPool: workerPool,
 		staticSecretTokenCapabilityRefreshInterval: conf.StaticSecretTokenCapabilityRefreshInterval,
+		tokenCapabilityRefreshBehaviour:            behaviour,
 	}, nil
 }
 
@@ -121,8 +143,10 @@ func (sscm *StaticSecretCapabilityManager) StartRenewingCapabilities(indexToRene
 
 		capabilitiesIndex.IndexLock.RLock()
 		token := capabilitiesIndex.Token
-		indexReadablePathsMap := capabilitiesIndex.ReadablePaths
+		indexReadablePathsMap := map[string]struct{}{}
+		maps.Copy(indexReadablePathsMap, capabilitiesIndex.ReadablePaths)
 		capabilitiesIndex.IndexLock.RUnlock()
+
 		indexReadablePaths := maps.Keys(indexReadablePathsMap)
 
 		client, err := sscm.client.Clone()
@@ -136,9 +160,15 @@ func (sscm *StaticSecretCapabilityManager) StartRenewingCapabilities(indexToRene
 
 		capabilities, err := getCapabilities(indexReadablePaths, client)
 		if err != nil {
-			sscm.logger.Error("error when attempting to retrieve updated token capabilities", "indexToRenew.ID", indexToRenew.ID, "err", err)
-			sscm.submitWorkToPoolAfterInterval(work)
-			return
+			sscm.logger.Warn("error when attempting to retrieve updated token capabilities", "indexToRenew.ID", indexToRenew.ID, "err", err)
+			if sscm.tokenCapabilityRefreshBehaviour == TokenCapabilityRefreshBehaviourPessimistic {
+				// Vault is be sealed or unreachable. If pessimistic, assume we might have
+				// lost access. Set capabilities to an empty set, so they are all removed.
+				capabilities = make(map[string][]string)
+			} else {
+				sscm.submitWorkToPoolAfterInterval(work)
+				return
+			}
 		}
 
 		newReadablePaths := reconcileCapabilities(indexReadablePaths, capabilities)
@@ -188,6 +218,7 @@ func (sscm *StaticSecretCapabilityManager) StartRenewingCapabilities(indexToRene
 				sscm.submitWorkToPoolAfterInterval(work)
 				return
 			}
+			sscm.logger.Debug("successfully evicted capabilities index from cache", "index.ID", indexToRenew.ID)
 			// If we successfully evicted the index, no need to re-submit the work to the pool.
 			return
 		}
diff --git a/command/agentproxyshared/cache/static_secret_capability_manager_test.go b/command/agentproxyshared/cache/static_secret_capability_manager_test.go
index ca15ca43f18..417c1a54f97 100644
--- a/command/agentproxyshared/cache/static_secret_capability_manager_test.go
+++ b/command/agentproxyshared/cache/static_secret_capability_manager_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
@@ -345,6 +345,88 @@ func TestSubmitWorkUpdatesIndexWithBadToken(t *testing.T) {
 	sscm.workerPool.Stop()
 }
 
+// TestSubmitWorkSealedVaultOptimistic tests that the capability manager
+// behaves as expected when
+// sscm.tokenCapabilityRefreshBehaviour == TokenCapabilityRefreshBehaviourOptimistic
+func TestSubmitWorkSealedVaultOptimistic(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	token := "not real token"
+	indexId := hashStaticSecretIndex(token)
+
+	sscm := testNewStaticSecretCapabilityManager(t, client)
+	index := &cachememdb.CapabilitiesIndex{
+		ID:    indexId,
+		Token: token,
+		ReadablePaths: map[string]struct{}{
+			"foo/bar":                {},
+			"auth/token/lookup-self": {},
+		},
+	}
+	err := sscm.leaseCache.db.SetCapabilitiesIndex(index)
+	require.Nil(t, err)
+
+	// Seal the cluster
+	cluster.EnsureCoresSealed(t)
+
+	sscm.StartRenewingCapabilities(index)
+
+	// Wait for the job to complete at least once...
+	time.Sleep(3 * time.Second)
+
+	// This entry should not be evicted.
+	newIndex, err := sscm.leaseCache.db.GetCapabilitiesIndex(cachememdb.IndexNameID, indexId)
+	require.NoError(t, err)
+	require.NotNil(t, newIndex)
+
+	// Forcefully stop any remaining workers
+	sscm.workerPool.Stop()
+}
+
+// TestSubmitWorkSealedVaultPessimistic tests that the capability manager
+// behaves as expected when
+// sscm.tokenCapabilityRefreshBehaviour == TokenCapabilityRefreshBehaviourPessimistic
+func TestSubmitWorkSealedVaultPessimistic(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	token := "not real token"
+	indexId := hashStaticSecretIndex(token)
+
+	sscm := testNewStaticSecretCapabilityManager(t, client)
+	sscm.tokenCapabilityRefreshBehaviour = TokenCapabilityRefreshBehaviourPessimistic
+
+	index := &cachememdb.CapabilitiesIndex{
+		ID:    indexId,
+		Token: token,
+		ReadablePaths: map[string]struct{}{
+			"foo/bar":                {},
+			"auth/token/lookup-self": {},
+		},
+	}
+	err := sscm.leaseCache.db.SetCapabilitiesIndex(index)
+	require.Nil(t, err)
+
+	// Seal the cluster
+	cluster.EnsureCoresSealed(t)
+
+	sscm.StartRenewingCapabilities(index)
+
+	// Wait for the job to complete at least once...
+	time.Sleep(3 * time.Second)
+
+	// This entry should be evicted.
+	newIndex, err := sscm.leaseCache.db.GetCapabilitiesIndex(cachememdb.IndexNameID, indexId)
+	require.Error(t, err)
+	require.Nil(t, newIndex)
+
+	// Forcefully stop any remaining workers
+	sscm.workerPool.Stop()
+}
+
 // TestSubmitWorkUpdatesAllIndexes tests that an index will be correctly updated if the capabilities differ, as
 // well as the indexes related to the paths that are being checked for.
 func TestSubmitWorkUpdatesAllIndexes(t *testing.T) {
diff --git a/command/agentproxyshared/cache/testing.go b/command/agentproxyshared/cache/testing.go
index 72ff895e5bd..7c799686234 100644
--- a/command/agentproxyshared/cache/testing.go
+++ b/command/agentproxyshared/cache/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cache
diff --git a/command/agentproxyshared/cache/wheninconsistentaction_enumer.go b/command/agentproxyshared/cache/wheninconsistentaction_enumer.go
new file mode 100644
index 00000000000..fdbf58e1baf
--- /dev/null
+++ b/command/agentproxyshared/cache/wheninconsistentaction_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=WhenInconsistentAction -trimprefix=WhenInconsistent"; DO NOT EDIT.
+
+package cache
+
+import (
+	"fmt"
+)
+
+const _WhenInconsistentActionName = "FailRetryForward"
+
+var _WhenInconsistentActionIndex = [...]uint8{0, 4, 9, 16}
+
+func (i WhenInconsistentAction) String() string {
+	if i < 0 || i >= WhenInconsistentAction(len(_WhenInconsistentActionIndex)-1) {
+		return fmt.Sprintf("WhenInconsistentAction(%d)", i)
+	}
+	return _WhenInconsistentActionName[_WhenInconsistentActionIndex[i]:_WhenInconsistentActionIndex[i+1]]
+}
+
+var _WhenInconsistentActionValues = []WhenInconsistentAction{0, 1, 2}
+
+var _WhenInconsistentActionNameToValueMap = map[string]WhenInconsistentAction{
+	_WhenInconsistentActionName[0:4]:  0,
+	_WhenInconsistentActionName[4:9]:  1,
+	_WhenInconsistentActionName[9:16]: 2,
+}
+
+// WhenInconsistentActionString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func WhenInconsistentActionString(s string) (WhenInconsistentAction, error) {
+	if val, ok := _WhenInconsistentActionNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to WhenInconsistentAction values", s)
+}
+
+// WhenInconsistentActionValues returns all values of the enum
+func WhenInconsistentActionValues() []WhenInconsistentAction {
+	return _WhenInconsistentActionValues
+}
+
+// IsAWhenInconsistentAction returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i WhenInconsistentAction) IsAWhenInconsistentAction() bool {
+	for _, v := range _WhenInconsistentActionValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/command/agentproxyshared/helpers.go b/command/agentproxyshared/helpers.go
index f1ef47cfee3..034b981f376 100644
--- a/command/agentproxyshared/helpers.go
+++ b/command/agentproxyshared/helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agentproxyshared
diff --git a/command/agentproxyshared/helpers_test.go b/command/agentproxyshared/helpers_test.go
index e5f1d6007c8..ec93ba43802 100644
--- a/command/agentproxyshared/helpers_test.go
+++ b/command/agentproxyshared/helpers_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package agentproxyshared
diff --git a/command/agentproxyshared/sink/file/file_sink.go b/command/agentproxyshared/sink/file/file_sink.go
index bf26a86b3c7..5c38790dedb 100644
--- a/command/agentproxyshared/sink/file/file_sink.go
+++ b/command/agentproxyshared/sink/file/file_sink.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package file
@@ -13,12 +13,15 @@ import (
 	hclog "github.com/hashicorp/go-hclog"
 	uuid "github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/command/agentproxyshared/sink"
+	"github.com/hashicorp/vault/helper/osutil"
 )
 
 // fileSink is a Sink implementation that writes a token to a file
 type fileSink struct {
 	path   string
 	mode   os.FileMode
+	owner  int
+	group  int
 	logger hclog.Logger
 }
 
@@ -33,6 +36,8 @@ func NewFileSink(conf *sink.SinkConfig) (sink.Sink, error) {
 	f := &fileSink{
 		logger: conf.Logger,
 		mode:   0o640,
+		owner:  os.Getuid(),
+		group:  os.Getgid(),
 	}
 
 	pathRaw, ok := conf.Config["path"]
@@ -61,11 +66,31 @@ func NewFileSink(conf *sink.SinkConfig) (sink.Sink, error) {
 		f.mode = os.FileMode(mode)
 	}
 
+	if modeRaw, ok := conf.Config["owner"]; ok {
+		owner, typeOK := modeRaw.(int)
+		if !typeOK {
+			return nil, errors.New("could not parse 'owner' as integer")
+		}
+
+		f.logger.Debug("overriding default file sink", "owner", owner)
+		f.owner = owner
+	}
+
+	if modeRaw, ok := conf.Config["group"]; ok {
+		group, typeOK := modeRaw.(int)
+		if !typeOK {
+			return nil, errors.New("could not parse 'group' as integer")
+		}
+
+		f.logger.Debug("overriding default file sink", "group", group)
+		f.group = group
+	}
+
 	if err := f.WriteToken(""); err != nil {
 		return nil, fmt.Errorf("error during write check: %w", err)
 	}
 
-	f.logger.Info("file sink configured", "path", f.path, "mode", f.mode)
+	f.logger.Info("file sink configured", "path", f.path, "mode", f.mode, "owner", f.owner, "group", f.group)
 
 	return f, nil
 }
@@ -93,6 +118,10 @@ func (f *fileSink) WriteToken(token string) error {
 		return fmt.Errorf("error opening temp file in dir %s for writing: %w", targetDir, err)
 	}
 
+	if err := osutil.Chown(tmpFile, f.owner, f.group); err != nil {
+		return fmt.Errorf("error changing ownership of %s: %w", tmpFile.Name(), err)
+	}
+
 	valToWrite := token
 	if token == "" {
 		valToWrite = u
diff --git a/command/agentproxyshared/sink/file/file_sink_test.go b/command/agentproxyshared/sink/file/file_sink_test.go
index e603c6a32d3..e38036363fe 100644
--- a/command/agentproxyshared/sink/file/file_sink_test.go
+++ b/command/agentproxyshared/sink/file/file_sink_test.go
@@ -1,13 +1,12 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package file
 
 import (
-	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
+	"syscall"
 	"testing"
 
 	hclog "github.com/hashicorp/go-hclog"
@@ -16,15 +15,8 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/logging"
 )
 
-const (
-	fileServerTestDir = "vault-agent-file-test"
-)
-
 func testFileSink(t *testing.T, log hclog.Logger) (*sink.SinkConfig, string) {
-	tmpDir, err := ioutil.TempDir("", fmt.Sprintf("%s.", fileServerTestDir))
-	if err != nil {
-		t.Fatal(err)
-	}
+	tmpDir := t.TempDir()
 
 	path := filepath.Join(tmpDir, "token")
 
@@ -74,7 +66,7 @@ func TestFileSink(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	fileBytes, err := ioutil.ReadFile(path)
+	fileBytes, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -84,19 +76,17 @@ func TestFileSink(t *testing.T) {
 	}
 }
 
-func testFileSinkMode(t *testing.T, log hclog.Logger) (*sink.SinkConfig, string) {
-	tmpDir, err := ioutil.TempDir("", fmt.Sprintf("%s.", fileServerTestDir))
-	if err != nil {
-		t.Fatal(err)
-	}
+func testFileSinkMode(t *testing.T, log hclog.Logger, gid int) (*sink.SinkConfig, string) {
+	tmpDir := t.TempDir()
 
 	path := filepath.Join(tmpDir, "token")
 
 	config := &sink.SinkConfig{
 		Logger: log.Named("sink.file"),
 		Config: map[string]interface{}{
-			"path": path,
-			"mode": 0o644,
+			"path":  path,
+			"mode":  0o644,
+			"group": gid,
 		},
 	}
 
@@ -112,7 +102,65 @@ func testFileSinkMode(t *testing.T, log hclog.Logger) (*sink.SinkConfig, string)
 func TestFileSinkMode(t *testing.T) {
 	log := logging.NewVaultLogger(hclog.Trace)
 
-	fs, tmpDir := testFileSinkMode(t, log)
+	fs, tmpDir := testFileSinkMode(t, log, os.Getegid())
+	defer os.RemoveAll(tmpDir)
+
+	path := filepath.Join(tmpDir, "token")
+
+	uuidStr, _ := uuid.GenerateUUID()
+	if err := fs.WriteToken(uuidStr); err != nil {
+		t.Fatal(err)
+	}
+
+	file, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+
+	fi, err := file.Stat()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fi.Mode() != os.FileMode(0o644) {
+		t.Fatalf("wrong file mode was detected at %s", path)
+	}
+
+	fileBytes, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if string(fileBytes) != uuidStr {
+		t.Fatalf("expected %s, got %s", uuidStr, string(fileBytes))
+	}
+}
+
+// TestFileSinkMode_Ownership tests that the file is owned by the group specified
+// in the configuration. This test requires the current user to be in at least two
+// groups. If the user is not in two groups, the test will be skipped.
+func TestFileSinkMode_Ownership(t *testing.T) {
+	groups, err := os.Getgroups()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if len(groups) < 2 {
+		t.Skip("not enough groups to test file ownership")
+	}
+
+	// find a group that is not the current group
+	var gid int
+	for _, g := range groups {
+		if g != os.Getegid() {
+			gid = g
+			break
+		}
+	}
+
+	log := logging.NewVaultLogger(hclog.Trace)
+
+	fs, tmpDir := testFileSinkMode(t, log, gid)
 	defer os.RemoveAll(tmpDir)
 
 	path := filepath.Join(tmpDir, "token")
@@ -135,8 +183,12 @@ func TestFileSinkMode(t *testing.T) {
 	if fi.Mode() != os.FileMode(0o644) {
 		t.Fatalf("wrong file mode was detected at %s", path)
 	}
+	// check if file is owned by the group
+	if fi.Sys().(*syscall.Stat_t).Gid != uint32(gid) {
+		t.Fatalf("file is not owned by the group %d", gid)
+	}
 
-	fileBytes, err := ioutil.ReadFile(path)
+	fileBytes, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/command/agentproxyshared/sink/file/sink_test.go b/command/agentproxyshared/sink/file/sink_test.go
index d061342af97..e200e1e9148 100644
--- a/command/agentproxyshared/sink/file/sink_test.go
+++ b/command/agentproxyshared/sink/file/sink_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package file
@@ -13,8 +13,8 @@ import (
 	"testing"
 	"time"
 
-	hclog "github.com/hashicorp/go-hclog"
-	uuid "github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/command/agentproxyshared/sink"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 )
@@ -37,8 +37,10 @@ func TestSinkServer(t *testing.T) {
 	in := make(chan string)
 	sinks := []*sink.SinkConfig{fs1, fs2}
 	errCh := make(chan error)
+	tokenRenewalInProgress := &atomic.Bool{}
+	tokenRenewalInProgress.Store(true)
 	go func() {
-		errCh <- ss.Run(ctx, in, sinks)
+		errCh <- ss.Run(ctx, in, sinks, tokenRenewalInProgress)
 	}()
 
 	// Seed a token
@@ -67,6 +69,10 @@ func TestSinkServer(t *testing.T) {
 			t.Fatalf("expected %s, got %s", uuidStr, string(fileBytes))
 		}
 	}
+
+	if tokenRenewalInProgress.Load() {
+		t.Fatal("should have reset tokenRenewalInProgress to false")
+	}
 }
 
 type badSink struct {
@@ -104,8 +110,11 @@ func TestSinkServerRetry(t *testing.T) {
 	in := make(chan string)
 	sinks := []*sink.SinkConfig{{Sink: b1}, {Sink: b2}}
 	errCh := make(chan error)
+	tokenRenewalInProgress := &atomic.Bool{}
+	tokenRenewalInProgress.Store(true)
+
 	go func() {
-		errCh <- ss.Run(ctx, in, sinks)
+		errCh <- ss.Run(ctx, in, sinks, tokenRenewalInProgress)
 	}()
 
 	// Seed a token
@@ -120,6 +129,10 @@ func TestSinkServerRetry(t *testing.T) {
 		t.Fatal("bad try count")
 	}
 
+	if !tokenRenewalInProgress.Load() {
+		t.Fatal("token renewal should still be in progress, sink server has not exited")
+	}
+
 	in <- "good"
 
 	time.Sleep(2 * time.Second)
@@ -138,4 +151,8 @@ func TestSinkServerRetry(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
+
+	if tokenRenewalInProgress.Load() {
+		t.Fatal("should have reset tokenRenewalInProgress to false")
+	}
 }
diff --git a/command/agentproxyshared/sink/inmem/inmem_sink.go b/command/agentproxyshared/sink/inmem/inmem_sink.go
index a9e7ee9a303..ac7394e9183 100644
--- a/command/agentproxyshared/sink/inmem/inmem_sink.go
+++ b/command/agentproxyshared/sink/inmem/inmem_sink.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package inmem
diff --git a/command/agentproxyshared/sink/mock/mock_sink.go b/command/agentproxyshared/sink/mock/mock_sink.go
index c660da79062..7905dd1e423 100644
--- a/command/agentproxyshared/sink/mock/mock_sink.go
+++ b/command/agentproxyshared/sink/mock/mock_sink.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mock
diff --git a/command/agentproxyshared/sink/sink.go b/command/agentproxyshared/sink/sink.go
index 571153cd5f0..79ec806a630 100644
--- a/command/agentproxyshared/sink/sink.go
+++ b/command/agentproxyshared/sink/sink.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package sink
@@ -13,7 +13,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/helper/dhutil"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
@@ -72,7 +72,7 @@ func NewSinkServer(conf *SinkServerConfig) *SinkServer {
 
 // Run executes the server's run loop, which is responsible for reading
 // in new tokens and pushing them out to the various sinks.
-func (ss *SinkServer) Run(ctx context.Context, incoming chan string, sinks []*SinkConfig) error {
+func (ss *SinkServer) Run(ctx context.Context, incoming chan string, sinks []*SinkConfig, tokenWriteInProgress *atomic.Bool) error {
 	latestToken := new(string)
 	writeSink := func(currSink *SinkConfig, currToken string) error {
 		if currToken != *latestToken {
@@ -101,6 +101,7 @@ func (ss *SinkServer) Run(ctx context.Context, incoming chan string, sinks []*Si
 
 	ss.logger.Info("starting sink server")
 	defer func() {
+		tokenWriteInProgress.Store(false)
 		ss.logger.Info("sink server stopped")
 	}()
 
@@ -138,6 +139,7 @@ func (ss *SinkServer) Run(ctx context.Context, incoming chan string, sinks []*Si
 				}
 			} else {
 				ss.logger.Trace("no sinks, ignoring new token")
+				tokenWriteInProgress.Store(false)
 				if ss.exitAfterAuth {
 					ss.logger.Trace("no sinks, exitAfterAuth, bye")
 					return nil
@@ -164,8 +166,11 @@ func (ss *SinkServer) Run(ctx context.Context, incoming chan string, sinks []*Si
 					sinkCh <- st
 				}
 			} else {
-				if atomic.LoadInt32(ss.remaining) == 0 && ss.exitAfterAuth {
-					return nil
+				if atomic.LoadInt32(ss.remaining) == 0 {
+					tokenWriteInProgress.Store(false)
+					if ss.exitAfterAuth {
+						return nil
+					}
 				}
 			}
 		}
diff --git a/command/agentproxyshared/winsvc/service.go b/command/agentproxyshared/winsvc/service.go
index df15971c9ab..b46bc6cc389 100644
--- a/command/agentproxyshared/winsvc/service.go
+++ b/command/agentproxyshared/winsvc/service.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package winsvc
diff --git a/command/agentproxyshared/winsvc/service_windows.go b/command/agentproxyshared/winsvc/service_windows.go
index f3807d9ec7d..d46f5044c09 100644
--- a/command/agentproxyshared/winsvc/service_windows.go
+++ b/command/agentproxyshared/winsvc/service_windows.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build windows
diff --git a/command/approle_concurrency_integ_test.go b/command/approle_concurrency_integ_test.go
index b40dd352c98..cd993f26ffa 100644
--- a/command/approle_concurrency_integ_test.go
+++ b/command/approle_concurrency_integ_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/audit.go b/command/audit.go
index 1c59140a9a9..3befdccd375 100644
--- a/command/audit.go
+++ b/command/audit.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/audit_disable.go b/command/audit_disable.go
index 79914ea5d99..607e3b677ed 100644
--- a/command/audit_disable.go
+++ b/command/audit_disable.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/audit_disable_test.go b/command/audit_disable_test.go
index 786140ee326..65aaae15087 100644
--- a/command/audit_disable_test.go
+++ b/command/audit_disable_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/audit_enable.go b/command/audit_enable.go
index a163f471cc4..3813e14ac85 100644
--- a/command/audit_enable.go
+++ b/command/audit_enable.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/audit_enable_test.go b/command/audit_enable_test.go
index 6c0c769e23e..648288b272d 100644
--- a/command/audit_enable_test.go
+++ b/command/audit_enable_test.go
@@ -1,10 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
 
 import (
-	"io/ioutil"
 	"os"
 	"strings"
 	"testing"
@@ -169,45 +168,25 @@ func TestAuditEnableCommand_Run(t *testing.T) {
 		client, closer := testVaultServerAllBackends(t)
 		defer closer()
 
-		files, err := ioutil.ReadDir("../builtin/audit")
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		var backends []string
-		for _, f := range files {
-			if f.IsDir() {
-				backends = append(backends, f.Name())
-			}
-		}
-
-		for _, b := range backends {
+		for _, name := range []string{"file", "socket", "syslog"} {
 			ui, cmd := testAuditEnableCommand(t)
 			cmd.client = client
 
-			args := []string{
-				b,
-			}
-			switch b {
+			args := []string{name}
+			switch name {
 			case "file":
 				args = append(args, "file_path=discard")
 			case "socket":
-				args = append(args, "address=127.0.0.1:8888",
-					"skip_test=true")
+				args = append(args, "address=127.0.0.1:8888", "skip_test=true")
 			case "syslog":
 				if _, exists := os.LookupEnv("WSLENV"); exists {
 					t.Log("skipping syslog test on WSL")
 					continue
 				}
-				if os.Getenv("CIRCLECI") == "true" {
-					// TODO install syslog in docker image we run our tests in
-					t.Log("skipping syslog test on CircleCI")
-					continue
-				}
 			}
 			code := cmd.Run(args)
 			if exp := 0; code != exp {
-				t.Errorf("type %s, expected %d to be %d - %s", b, code, exp, ui.OutputWriter.String()+ui.ErrorWriter.String())
+				t.Errorf("type %s, expected %d to be %d - %s", name, code, exp, ui.OutputWriter.String()+ui.ErrorWriter.String())
 			}
 		}
 	})
diff --git a/command/audit_list.go b/command/audit_list.go
index cf3a16f0f07..8922134ed1d 100644
--- a/command/audit_list.go
+++ b/command/audit_list.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/audit_list_test.go b/command/audit_list_test.go
index 43ddbacf91f..f6989fc1470 100644
--- a/command/audit_list_test.go
+++ b/command/audit_list_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth.go b/command/auth.go
index 57489a186f1..c37a9224d45 100644
--- a/command/auth.go
+++ b/command/auth.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth_disable.go b/command/auth_disable.go
index 1476b71d0f0..b1f3d861241 100644
--- a/command/auth_disable.go
+++ b/command/auth_disable.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth_disable_test.go b/command/auth_disable_test.go
index f9da8a7d770..bfadb192128 100644
--- a/command/auth_disable_test.go
+++ b/command/auth_disable_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth_enable.go b/command/auth_enable.go
index dcea5141fcf..57edf733633 100644
--- a/command/auth_enable.go
+++ b/command/auth_enable.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -23,24 +23,25 @@ var (
 type AuthEnableCommand struct {
 	*BaseCommand
 
-	flagDescription               string
-	flagPath                      string
-	flagDefaultLeaseTTL           time.Duration
-	flagMaxLeaseTTL               time.Duration
-	flagAuditNonHMACRequestKeys   []string
-	flagAuditNonHMACResponseKeys  []string
-	flagListingVisibility         string
-	flagPluginName                string
-	flagPassthroughRequestHeaders []string
-	flagAllowedResponseHeaders    []string
-	flagOptions                   map[string]string
-	flagLocal                     bool
-	flagSealWrap                  bool
-	flagExternalEntropyAccess     bool
-	flagTokenType                 string
-	flagVersion                   int
-	flagPluginVersion             string
-	flagIdentityTokenKey          string
+	flagDescription                string
+	flagPath                       string
+	flagDefaultLeaseTTL            time.Duration
+	flagMaxLeaseTTL                time.Duration
+	flagAuditNonHMACRequestKeys    []string
+	flagAuditNonHMACResponseKeys   []string
+	flagListingVisibility          string
+	flagPluginName                 string
+	flagPassthroughRequestHeaders  []string
+	flagAllowedResponseHeaders     []string
+	flagOptions                    map[string]string
+	flagLocal                      bool
+	flagSealWrap                   bool
+	flagExternalEntropyAccess      bool
+	flagTokenType                  string
+	flagVersion                    int
+	flagPluginVersion              string
+	flagIdentityTokenKey           string
+	flagTrimRequestTrailingSlashes BoolPtr
 }
 
 func (c *AuthEnableCommand) Synopsis() string {
@@ -217,6 +218,12 @@ func (c *AuthEnableCommand) Flags() *FlagSets {
 		Usage:   "Select the key used to sign plugin identity tokens.",
 	})
 
+	f.BoolPtrVar(&BoolPtrVar{
+		Name:   flagNameTrimRequestTrailingSlashes,
+		Target: &c.flagTrimRequestTrailingSlashes,
+		Usage:  "Whether to trim trailing slashes for incoming requests to this mount",
+	})
+
 	return set
 }
 
@@ -324,6 +331,11 @@ func (c *AuthEnableCommand) Run(args []string) int {
 		if fl.Name == flagNameIdentityTokenKey {
 			authOpts.Config.IdentityTokenKey = c.flagIdentityTokenKey
 		}
+
+		if fl.Name == flagNameTrimRequestTrailingSlashes && c.flagTrimRequestTrailingSlashes.IsSet() {
+			val := c.flagTrimRequestTrailingSlashes.Get()
+			authOpts.Config.TrimRequestTrailingSlashes = &val
+		}
 	})
 
 	if err := client.Sys().EnableAuthWithOptions(authPath, authOpts); err != nil {
diff --git a/command/auth_enable_test.go b/command/auth_enable_test.go
index 3467c9b0065..07b56dac5a8 100644
--- a/command/auth_enable_test.go
+++ b/command/auth_enable_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -100,6 +100,7 @@ func TestAuthEnableCommand_Run(t *testing.T) {
 			"-allowed-response-headers", "authorization",
 			"-listing-visibility", "unauth",
 			"-identity-token-key", "default",
+			"-trim-request-trailing-slashes=true",
 			"userpass",
 		})
 		if exp := 0; code != exp {
@@ -127,6 +128,9 @@ func TestAuthEnableCommand_Run(t *testing.T) {
 		if exp := "The best kind of test"; authInfo.Description != exp {
 			t.Errorf("expected %q to be %q", authInfo.Description, exp)
 		}
+		if !authInfo.Config.TrimRequestTrailingSlashes {
+			t.Errorf("expected trim_request_trailing_slashes to be enabled")
+		}
 		if diff := deep.Equal([]string{"authorization,authentication", "www-authentication"}, authInfo.Config.PassthroughRequestHeaders); len(diff) > 0 {
 			t.Errorf("Failed to find expected values in PassthroughRequestHeaders. Difference is: %v", diff)
 		}
diff --git a/command/auth_help.go b/command/auth_help.go
index 68365e737c3..8e4cb018713 100644
--- a/command/auth_help.go
+++ b/command/auth_help.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth_help_test.go b/command/auth_help_test.go
index 3c0218b2477..7ca72b81ff6 100644
--- a/command/auth_help_test.go
+++ b/command/auth_help_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth_list.go b/command/auth_list.go
index d095156e155..978c28e5df4 100644
--- a/command/auth_list.go
+++ b/command/auth_list.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth_list_test.go b/command/auth_list_test.go
index 087010a8ce3..b4ff0b8eb57 100644
--- a/command/auth_list_test.go
+++ b/command/auth_list_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth_move.go b/command/auth_move.go
index 3ede5fc49fc..0671b41c79b 100644
--- a/command/auth_move.go
+++ b/command/auth_move.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth_move_test.go b/command/auth_move_test.go
index 0b585e7e003..ceead3d48f0 100644
--- a/command/auth_move_test.go
+++ b/command/auth_move_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth_test.go b/command/auth_test.go
index e6c895df8fe..37ddeead2c5 100644
--- a/command/auth_test.go
+++ b/command/auth_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/auth_tune.go b/command/auth_tune.go
index 56c2d25fae9..77a32f493b3 100644
--- a/command/auth_tune.go
+++ b/command/auth_tune.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -40,6 +40,7 @@ type AuthTuneCommand struct {
 	flagUserLockoutCounterResetDuration time.Duration
 	flagUserLockoutDisable              bool
 	flagIdentityTokenKey                string
+	flagTrimRequestTrailingSlashes      BoolPtr
 }
 
 func (c *AuthTuneCommand) Synopsis() string {
@@ -195,6 +196,11 @@ func (c *AuthTuneCommand) Flags() *FlagSets {
 		Usage: "Select the semantic version of the plugin to run. The new version must be registered in " +
 			"the plugin catalog, and will not start running until the plugin is reloaded.",
 	})
+	f.BoolPtrVar(&BoolPtrVar{
+		Name:   flagNameTrimRequestTrailingSlashes,
+		Target: &c.flagTrimRequestTrailingSlashes,
+		Usage:  "Whether to trim trailing slashes for incoming requests to this mount",
+	})
 
 	f.StringVar(&StringVar{
 		Name:    flagNameIdentityTokenKey,
@@ -245,74 +251,111 @@ func (c *AuthTuneCommand) Run(args []string) int {
 		c.flagOptions["version"] = strconv.Itoa(c.flagVersion)
 	}
 
-	mountConfigInput := api.MountConfigInput{
-		DefaultLeaseTTL: ttlToAPI(c.flagDefaultLeaseTTL),
-		MaxLeaseTTL:     ttlToAPI(c.flagMaxLeaseTTL),
-		Options:         c.flagOptions,
+	defaultLeaseTtl := ttlToAPI(c.flagDefaultLeaseTTL)
+	maxLeaseTtl := ttlToAPI(c.flagMaxLeaseTTL)
+	options := c.flagOptions
+	tuneMountInput := api.TuneMountConfigInput{
+		DefaultLeaseTTL: &defaultLeaseTtl,
+		MaxLeaseTTL:     &maxLeaseTtl,
+		Options:         &options,
 	}
 
+	userLockoutConfig := api.TuneUserLockoutConfigInput{}
+	userLockoutConfigSet := false
+
 	// Set these values only if they are provided in the CLI
 	f.Visit(func(fl *flag.Flag) {
 		if fl.Name == flagNameAuditNonHMACRequestKeys {
-			mountConfigInput.AuditNonHMACRequestKeys = c.flagAuditNonHMACRequestKeys
+			if len(c.flagAuditNonHMACRequestKeys) == 1 && c.flagAuditNonHMACRequestKeys[0] == "" {
+				emptyList := []string{}
+				tuneMountInput.AuditNonHMACRequestKeys = &emptyList
+			} else {
+				tuneMountInput.AuditNonHMACRequestKeys = &c.flagAuditNonHMACRequestKeys
+			}
 		}
 
 		if fl.Name == flagNameAuditNonHMACResponseKeys {
-			mountConfigInput.AuditNonHMACResponseKeys = c.flagAuditNonHMACResponseKeys
+			if len(c.flagAuditNonHMACResponseKeys) == 1 && c.flagAuditNonHMACResponseKeys[0] == "" {
+				emptyList := []string{}
+				tuneMountInput.AuditNonHMACResponseKeys = &emptyList
+			} else {
+				tuneMountInput.AuditNonHMACResponseKeys = &c.flagAuditNonHMACResponseKeys
+			}
 		}
 
 		if fl.Name == flagNameDescription {
-			mountConfigInput.Description = &c.flagDescription
+			tuneMountInput.Description = &c.flagDescription
 		}
 
 		if fl.Name == flagNameListingVisibility {
-			mountConfigInput.ListingVisibility = c.flagListingVisibility
+			tuneMountInput.ListingVisibility = &c.flagListingVisibility
 		}
 
 		if fl.Name == flagNamePassthroughRequestHeaders {
-			mountConfigInput.PassthroughRequestHeaders = c.flagPassthroughRequestHeaders
+			if len(c.flagPassthroughRequestHeaders) == 1 && c.flagPassthroughRequestHeaders[0] == "" {
+				emptyList := []string{}
+				tuneMountInput.PassthroughRequestHeaders = &emptyList
+			} else {
+				tuneMountInput.PassthroughRequestHeaders = &c.flagPassthroughRequestHeaders
+			}
 		}
 
 		if fl.Name == flagNameAllowedResponseHeaders {
-			mountConfigInput.AllowedResponseHeaders = c.flagAllowedResponseHeaders
+			if len(c.flagAllowedResponseHeaders) == 1 && c.flagAllowedResponseHeaders[0] == "" {
+				emptyList := []string{}
+				tuneMountInput.AllowedResponseHeaders = &emptyList
+			} else {
+				tuneMountInput.AllowedResponseHeaders = &c.flagAllowedResponseHeaders
+			}
 		}
 
 		if fl.Name == flagNameTokenType {
-			mountConfigInput.TokenType = c.flagTokenType
+			tuneMountInput.TokenType = &c.flagTokenType
 		}
+
 		switch fl.Name {
 		case flagNameUserLockoutThreshold, flagNameUserLockoutDuration, flagNameUserLockoutCounterResetDuration, flagNameUserLockoutDisable:
-			if mountConfigInput.UserLockoutConfig == nil {
-				mountConfigInput.UserLockoutConfig = &api.UserLockoutConfigInput{}
-			}
+			userLockoutConfigSet = true
 		}
 		if fl.Name == flagNameUserLockoutThreshold {
-			mountConfigInput.UserLockoutConfig.LockoutThreshold = strconv.FormatUint(uint64(c.flagUserLockoutThreshold), 10)
+			lockoutThreshold := strconv.FormatUint(uint64(c.flagUserLockoutThreshold), 10)
+			userLockoutConfig.LockoutThreshold = &lockoutThreshold
 		}
 		if fl.Name == flagNameUserLockoutDuration {
-			mountConfigInput.UserLockoutConfig.LockoutDuration = ttlToAPI(c.flagUserLockoutDuration)
+			lockoutDuration := ttlToAPI(c.flagUserLockoutDuration)
+			userLockoutConfig.LockoutDuration = &lockoutDuration
 		}
 		if fl.Name == flagNameUserLockoutCounterResetDuration {
-			mountConfigInput.UserLockoutConfig.LockoutCounterResetDuration = ttlToAPI(c.flagUserLockoutCounterResetDuration)
+			lockoutCounterResetDuration := ttlToAPI(c.flagUserLockoutCounterResetDuration)
+			userLockoutConfig.LockoutCounterResetDuration = &lockoutCounterResetDuration
 		}
 		if fl.Name == flagNameUserLockoutDisable {
-			mountConfigInput.UserLockoutConfig.DisableLockout = &c.flagUserLockoutDisable
+			userLockoutConfig.DisableLockout = &c.flagUserLockoutDisable
 		}
 
 		if fl.Name == flagNamePluginVersion {
-			mountConfigInput.PluginVersion = c.flagPluginVersion
+			tuneMountInput.PluginVersion = &c.flagPluginVersion
 		}
 
 		if fl.Name == flagNameIdentityTokenKey {
-			mountConfigInput.IdentityTokenKey = c.flagIdentityTokenKey
+			tuneMountInput.IdentityTokenKey = &c.flagIdentityTokenKey
+		}
+
+		if fl.Name == flagNameTrimRequestTrailingSlashes && c.flagTrimRequestTrailingSlashes.IsSet() {
+			val := c.flagTrimRequestTrailingSlashes.Get()
+			tuneMountInput.TrimRequestTrailingSlashes = &val
 		}
 	})
 
+	if userLockoutConfigSet {
+		tuneMountInput.UserLockoutConfig = &userLockoutConfig
+	}
+
 	// Append /auth (since that's where auths live) and a trailing slash to
 	// indicate it's a path in output
 	mountPath := ensureTrailingSlash(sanitizePath(args[0]))
 
-	if err := client.Sys().TuneMount("/auth/"+mountPath, mountConfigInput); err != nil {
+	if err := client.Sys().TuneMountAllowNil("/auth/"+mountPath, tuneMountInput); err != nil {
 		c.UI.Error(fmt.Sprintf("Error tuning auth method %s: %s", mountPath, err))
 		return 2
 	}
diff --git a/command/auth_tune_test.go b/command/auth_tune_test.go
index c9b7923d83d..9cf3c59bd5b 100644
--- a/command/auth_tune_test.go
+++ b/command/auth_tune_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/cli"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
+	"github.com/hashicorp/vault/helper/testhelpers/minimal"
 )
 
 func testAuthTuneCommand(tb testing.TB) (*cli.MockUi, *AuthTuneCommand) {
@@ -120,6 +121,7 @@ func TestAuthTuneCommand_Run(t *testing.T) {
 				"-listing-visibility", "unauth",
 				"-plugin-version", version,
 				"-identity-token-key", "default",
+				"-trim-request-trailing-slashes=true",
 				"my-auth/",
 			})
 			if exp := 0; code != exp {
@@ -156,6 +158,9 @@ func TestAuthTuneCommand_Run(t *testing.T) {
 			if exp := 3600; mountInfo.Config.MaxLeaseTTL != exp {
 				t.Errorf("expected %d to be %d", mountInfo.Config.MaxLeaseTTL, exp)
 			}
+			if !mountInfo.Config.TrimRequestTrailingSlashes {
+				t.Errorf("expected trim_request_trailing_slashes to be enabled")
+			}
 			if diff := deep.Equal([]string{"authorization", "www-authentication"}, mountInfo.Config.PassthroughRequestHeaders); len(diff) > 0 {
 				t.Errorf("Failed to find expected values in PassthroughRequestHeaders. Difference is: %v", diff)
 			}
@@ -293,3 +298,139 @@ func TestAuthTuneCommand_Run(t *testing.T) {
 		assertNoTabs(t, cmd)
 	})
 }
+
+// TestUnsetFieldsAuthTune first sets the array and string values on the auth mount, then in a second call sets those
+// fields back to the original empty list or empty string.  Then the new values are read to check that they are in fact
+// 'unset' properly.  This is a regression test (VAULT-34426).
+func TestUnsetFieldsAuthTune(t *testing.T) {
+	t.Parallel()
+
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	// Mount
+	if err := client.Sys().EnableAuthWithOptions("my-auth", &api.EnableAuthOptions{
+		Type: "userpass",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	mountInfo, err := client.Sys().GetAuth("my-auth/")
+	if err != nil {
+		t.Fatalf("expected my-auth endpoint to exist: %v", err)
+	}
+
+	ui, cmdSet := testAuthTuneCommand(t)
+	cmdSet.client = client
+
+	code := cmdSet.Run([]string{
+		"-description", "new description",
+		"-default-lease-ttl", "30m",
+		"-max-lease-ttl", "1h",
+		"-audit-non-hmac-request-keys", "foo,bar",
+		"-audit-non-hmac-response-keys", "foo,bar",
+		"-passthrough-request-headers", "authorization",
+		"-allowed-response-headers", "authorization,www-authentication",
+		"-listing-visibility", "unauth",
+		"-identity-token-key", "default",
+		"-trim-request-trailing-slashes=true",
+		"my-auth/",
+	})
+	if exp := 0; code != exp {
+		t.Fatalf("expected %d to be %d", code, exp)
+	}
+
+	expected := "Success! Tuned the auth method at: my-auth/"
+	combined := ui.OutputWriter.String() + ui.ErrorWriter.String()
+	if !strings.Contains(combined, expected) {
+		t.Fatalf("expected %q to contain %q", combined, expected)
+	}
+
+	mountInfo, err = client.Sys().GetAuth("my-auth/")
+	if err != nil {
+		t.Fatalf("expected my-auth endpoint to exist: %v", err)
+	}
+
+	if exp := "new description"; mountInfo.Description != exp {
+		t.Fatalf("expected %q to be %q", mountInfo.Description, exp)
+	}
+	if exp := "userpass"; mountInfo.Type != exp {
+		t.Fatalf("expected %q to be %q", mountInfo.Type, exp)
+	}
+	if exp := 1800; mountInfo.Config.DefaultLeaseTTL != exp {
+		t.Fatalf("expected %d to be %d", mountInfo.Config.DefaultLeaseTTL, exp)
+	}
+	if exp := 3600; mountInfo.Config.MaxLeaseTTL != exp {
+		t.Fatalf("expected %d to be %d", mountInfo.Config.MaxLeaseTTL, exp)
+	}
+	if !mountInfo.Config.TrimRequestTrailingSlashes {
+		t.Fatalf("expected trim_request_trailing_slashes to be enabled")
+	}
+	if diff := deep.Equal([]string{"authorization"}, mountInfo.Config.PassthroughRequestHeaders); len(diff) > 0 {
+		t.Fatalf("Failed to find expected values in PassthroughRequestHeaders. Difference is: %v", diff)
+	}
+	if diff := deep.Equal([]string{"authorization,www-authentication"}, mountInfo.Config.AllowedResponseHeaders); len(diff) > 0 {
+		t.Fatalf("Failed to find expected values in AllowedResponseHeaders. Difference is: %v", diff)
+	}
+	if diff := deep.Equal([]string{"foo,bar"}, mountInfo.Config.AuditNonHMACRequestKeys); len(diff) > 0 {
+		t.Fatalf("Failed to find expected values in AuditNonHMACRequestKeys. Difference is: %v", diff)
+	}
+	if diff := deep.Equal([]string{"foo,bar"}, mountInfo.Config.AuditNonHMACResponseKeys); len(diff) > 0 {
+		t.Fatalf("Failed to find expected values in AuditNonHMACResponseKeys. Difference is: %v", diff)
+	}
+	if diff := deep.Equal("default", mountInfo.Config.IdentityTokenKey); len(diff) > 0 {
+		t.Fatalf("Failed to find expected values in IdentityTokenKey. Difference is: %v", diff)
+	}
+
+	uiNew, cmdUnset := testAuthTuneCommand(t)
+	cmdUnset.client = client
+
+	unsetCode := cmdUnset.Run([]string{
+		"-description", "",
+		"-default-lease-ttl", "30m",
+		"-max-lease-ttl", "1h",
+		"-audit-non-hmac-request-keys", "",
+		"-audit-non-hmac-response-keys", "",
+		"-passthrough-request-headers", "",
+		"-allowed-response-headers", "",
+		"-listing-visibility", "unauth",
+		"-identity-token-key", "",
+		"-trim-request-trailing-slashes=false",
+		"my-auth/",
+	})
+	if exp := 0; unsetCode != exp {
+		t.Fatalf("expected %d to be %d", unsetCode, exp)
+	}
+
+	combined = uiNew.OutputWriter.String() + uiNew.ErrorWriter.String()
+	if !strings.Contains(combined, expected) {
+		t.Fatalf("expected %q to contain %q", combined, expected)
+	}
+
+	mountInfo, err = client.Sys().GetAuth("my-auth/")
+	if err != nil {
+		t.Fatalf("expected to be able to fetch auth: %v", err)
+	}
+
+	if exp := ""; mountInfo.Description != exp {
+		t.Fatalf("expected %q to be %q", mountInfo.Description, exp)
+	}
+	if mountInfo.Config.TrimRequestTrailingSlashes {
+		t.Fatalf("expected trim_request_trailing_slashes to be disabled")
+	}
+	if mountInfo.Config.PassthroughRequestHeaders != nil {
+		t.Fatalf("Failed to find expected values in PassthroughRequestHeaders. Expected nil slice got: %v", mountInfo.Config.PassthroughRequestHeaders)
+	}
+	if mountInfo.Config.AllowedResponseHeaders != nil {
+		t.Fatalf("Failed to find expected values in AllowedResponseHeaders. Expected nil slice got: %v", mountInfo.Config.AllowedResponseHeaders)
+	}
+	if mountInfo.Config.AuditNonHMACRequestKeys != nil {
+		t.Fatalf("Failed to find expected values in AuditNonHMACRequestKeys. Expected nil slice got: %v", mountInfo.Config.AuditNonHMACRequestKeys)
+	}
+	if mountInfo.Config.AuditNonHMACResponseKeys != nil {
+		t.Fatalf("Failed to find expected values in AuditNonHMACResponseKeys. Expected nil slice got: %v", mountInfo.Config.AuditNonHMACResponseKeys)
+	}
+	if diff := deep.Equal("", mountInfo.Config.IdentityTokenKey); len(diff) > 0 {
+		t.Fatalf("Failed to find expected values in IdentityTokenKey. Difference is: %v", diff)
+	}
+}
diff --git a/command/base.go b/command/base.go
index 5acd2227fa4..a5e3f0fa499 100644
--- a/command/base.go
+++ b/command/base.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -8,7 +8,6 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"regexp"
@@ -19,10 +18,13 @@ import (
 	"github.com/hashicorp/cli"
 	hcpvlib "github.com/hashicorp/vault-hcp-lib"
 	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/api/cliconfig"
+	"github.com/hashicorp/vault/api/tokenhelper"
 	"github.com/hashicorp/vault/command/config"
-	"github.com/hashicorp/vault/command/token"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/mattn/go-isatty"
+	"github.com/mitchellh/go-homedir"
 	"github.com/pkg/errors"
 	"github.com/posener/complete"
 )
@@ -72,10 +74,17 @@ type BaseCommand struct {
 
 	flagHeader map[string]string
 
-	tokenHelper    token.TokenHelper
+	tokenHelper    tokenhelper.TokenHelper
 	hcpTokenHelper hcpvlib.HCPTokenHelper
 
+	flagSnapshotID string
+
 	client *api.Client
+
+	// hclDuplicateKeysWarningPrinted tracks if a command execution has already printed the warning, to avoid printing
+	// it multiple times on a single execution.
+	// TODO (HCL_DUP_KEYS_DEPRECATION): remove this once we don't use the warning anymore
+	hclDuplicateKeysWarningPrinted bool
 }
 
 // Client returns the HTTP API client. The client is cached on the command to
@@ -83,8 +92,13 @@ type BaseCommand struct {
 func (c *BaseCommand) Client() (*api.Client, error) {
 	// Read the test client if present
 	if c.client != nil {
-		if err := c.applyHCPConfig(); err != nil {
-			return nil, err
+		// Ignoring homedir errors here and moving on to avoid
+		// spamming user with warnings/errors that homedir isn't set.
+		path, err := homedir.Dir()
+		if err == nil {
+			if err := c.applyHCPConfig(path); err != nil {
+				return nil, err
+			}
 		}
 
 		return c.client, nil
@@ -100,7 +114,7 @@ func (c *BaseCommand) Client() (*api.Client, error) {
 		config.Address = c.flagAddress
 	}
 	if c.flagAgentProxyAddress != "" {
-		config.Address = c.flagAgentProxyAddress
+		config.AgentAddress = c.flagAgentProxyAddress
 	}
 
 	if c.flagOutputCurlString {
@@ -195,12 +209,17 @@ func (c *BaseCommand) Client() (*api.Client, error) {
 
 	c.client = client
 
-	if err := c.applyHCPConfig(); err != nil {
-		return nil, err
+	// Ignoring homedir errors here and moving on to avoid
+	// spamming user with warnings/errors that homedir isn't set.
+	path, err := homedir.Dir()
+	if err == nil {
+		if err := c.applyHCPConfig(path); err != nil {
+			return nil, err
+		}
 	}
 
 	if c.addrWarning != "" && c.UI != nil {
-		if os.Getenv("VAULT_ADDR") == "" {
+		if os.Getenv("VAULT_ADDR") == "" && !c.flags.hadAddressFlag {
 			if !c.flagNonInteractive && isatty.IsTerminal(os.Stdin.Fd()) {
 				c.UI.Warn(wrapAtLength(c.addrWarning))
 			}
@@ -210,12 +229,12 @@ func (c *BaseCommand) Client() (*api.Client, error) {
 	return client, nil
 }
 
-func (c *BaseCommand) applyHCPConfig() error {
+func (c *BaseCommand) applyHCPConfig(path string) error {
 	if c.hcpTokenHelper == nil {
 		c.hcpTokenHelper = c.HCPTokenHelper()
 	}
 
-	hcpToken, err := c.hcpTokenHelper.GetHCPToken()
+	hcpToken, err := c.hcpTokenHelper.GetHCPToken(path)
 	if err != nil {
 		return err
 	}
@@ -248,20 +267,24 @@ func (c *BaseCommand) SetAddress(addr string) {
 }
 
 // SetTokenHelper sets the token helper on the command.
-func (c *BaseCommand) SetTokenHelper(th token.TokenHelper) {
+func (c *BaseCommand) SetTokenHelper(th tokenhelper.TokenHelper) {
 	c.tokenHelper = th
 }
 
 // TokenHelper returns the token helper attached to the command.
-func (c *BaseCommand) TokenHelper() (token.TokenHelper, error) {
+func (c *BaseCommand) TokenHelper() (tokenhelper.TokenHelper, error) {
 	if c.tokenHelper != nil {
 		return c.tokenHelper, nil
 	}
-
-	helper, err := DefaultTokenHelper()
+	// TODO (HCL_DUP_KEYS_DEPRECATION): Return to DefaultTokenHelper once duplicates are forbidden
+	helper, duplicates, err := cliconfig.DefaultTokenHelperCheckDuplicates()
 	if err != nil {
 		return nil, err
 	}
+	if duplicates && !c.hclDuplicateKeysWarningPrinted {
+		c.hclDuplicateKeysWarningPrinted = true
+		c.UI.Warn("WARNING: Duplicate keys found in the Vault token helper configuration file, duplicate keys in HCL files are deprecated and will be forbidden in a future release.")
+	}
 	return helper, nil
 }
 
@@ -359,6 +382,7 @@ const (
 	FlagSetOutputField
 	FlagSetOutputFormat
 	FlagSetOutputDetailed
+	FlagSetSnapshot
 )
 
 // flagSet creates the flags for this command. The result is cached on the
@@ -376,11 +400,12 @@ func (c *BaseCommand) flagSet(bit FlagSetBit) *FlagSets {
 			f := set.NewFlagSet("HTTP Options")
 
 			addrStringVar := &StringVar{
-				Name:       flagNameAddress,
-				Target:     &c.flagAddress,
-				EnvVar:     api.EnvVaultAddress,
-				Completion: complete.PredictAnything,
-				Usage:      "Address of the Vault server.",
+				Name:        flagNameAddress,
+				Target:      &c.flagAddress,
+				EnvVar:      api.EnvVaultAddress,
+				Completion:  complete.PredictAnything,
+				Normalizers: []func(string) string{configutil.NormalizeAddr},
+				Usage:       "Address of the Vault server.",
 			}
 
 			if c.flagAddress != "" {
@@ -392,11 +417,12 @@ func (c *BaseCommand) flagSet(bit FlagSetBit) *FlagSets {
 			f.StringVar(addrStringVar)
 
 			agentAddrStringVar := &StringVar{
-				Name:       "agent-address",
-				Target:     &c.flagAgentProxyAddress,
-				EnvVar:     api.EnvVaultAgentAddr,
-				Completion: complete.PredictAnything,
-				Usage:      "Address of the Agent.",
+				Name:        "agent-address",
+				Target:      &c.flagAgentProxyAddress,
+				EnvVar:      api.EnvVaultAgentAddr,
+				Completion:  complete.PredictAnything,
+				Normalizers: []func(string) string{configutil.NormalizeAddr},
+				Usage:       "Address of the Agent.",
 			}
 			f.StringVar(agentAddrStringVar)
 
@@ -600,6 +626,16 @@ func (c *BaseCommand) flagSet(bit FlagSetBit) *FlagSets {
 					Usage:   "Enables additional metadata during some operations",
 				})
 			}
+
+			if bit&FlagSetSnapshot != 0 {
+				outputSet.StringVar(&StringVar{
+					Name:       "snapshot-id",
+					Target:     &c.flagSnapshotID,
+					Default:    "",
+					Completion: complete.PredictAnything,
+					Usage:      "ID of the loaded snapshot that this command will use",
+				})
+			}
 		}
 
 		c.flags = set
@@ -615,6 +651,10 @@ type FlagSets struct {
 	hiddens     map[string]struct{}
 	completions complete.Flags
 	ui          cli.Ui
+	// hadAddressFlag signals if the FlagSet had an -address
+	// flag set, for the purposes of warning (see also:
+	// BaseCommand::addrWarning).
+	hadAddressFlag bool
 }
 
 // NewFlagSets creates a new flag sets.
@@ -623,7 +663,7 @@ func NewFlagSets(ui cli.Ui) *FlagSets {
 
 	// Errors and usage are controlled by the CLI.
 	mainSet.Usage = func() {}
-	mainSet.SetOutput(ioutil.Discard)
+	mainSet.SetOutput(io.Discard)
 
 	return &FlagSets{
 		flagSets:    make([]*FlagSet, 0, 6),
@@ -657,6 +697,15 @@ type (
 // Parse parses the given flags, returning any errors.
 // Warnings, if any, regarding the arguments format are sent to stdout
 func (f *FlagSets) Parse(args []string, opts ...ParseOptions) error {
+	// Before parsing, check to see if we have an address flag, for the
+	// purposes of warning later. This must be done now, as the argument
+	// will be removed during parsing.
+	for _, arg := range args {
+		if strings.HasPrefix(arg, "-address") {
+			f.hadAddressFlag = true
+		}
+	}
+
 	err := f.mainSet.Parse(args)
 
 	displayFlagWarningsDisabled := false
diff --git a/command/base_flags.go b/command/base_flags.go
index 3f3fc1abdad..460047b5bab 100644
--- a/command/base_flags.go
+++ b/command/base_flags.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -460,56 +460,89 @@ func (i *uint64Value) Hidden() bool     { return i.hidden }
 
 // -- StringVar and stringValue
 type StringVar struct {
-	Name       string
-	Aliases    []string
-	Usage      string
-	Default    string
-	Hidden     bool
-	EnvVar     string
-	Target     *string
-	Completion complete.Predictor
+	Name        string
+	Aliases     []string
+	Usage       string
+	Default     string
+	Hidden      bool
+	EnvVar      string
+	Target      *string
+	Normalizers []func(string) string
+	Completion  complete.Predictor
+}
+
+func (s *StringVar) SetTarget(val string) {
+	if s == nil {
+		return
+	}
+
+	for _, f := range s.Normalizers {
+		val = f(val)
+	}
+
+	*s.Target = val
 }
 
 func (f *FlagSet) StringVar(i *StringVar) {
-	initial := i.Default
-	if v, exist := os.LookupEnv(i.EnvVar); exist {
-		initial = v
+	if i == nil {
+		return
 	}
 
-	def := ""
-	if i.Default != "" {
-		def = i.Default
+	val := i.Default
+	envVar, ok := os.LookupEnv(i.EnvVar)
+	if ok {
+		val = envVar
 	}
 
 	f.VarFlag(&VarFlag{
 		Name:       i.Name,
 		Aliases:    i.Aliases,
 		Usage:      i.Usage,
-		Default:    def,
+		Default:    i.Default,
 		EnvVar:     i.EnvVar,
-		Value:      newStringValue(initial, i.Target, i.Hidden),
+		Value:      newStringValue(val, i.Target, i.Hidden, i.Normalizers),
 		Completion: i.Completion,
 	})
 }
 
 type stringValue struct {
-	hidden bool
-	target *string
+	hidden      bool
+	target      *string
+	normalizers []func(string) string
 }
 
-func newStringValue(def string, target *string, hidden bool) *stringValue {
-	*target = def
-	return &stringValue{
-		hidden: hidden,
-		target: target,
+func newStringValue(val string, target *string, hidden bool, normalizers []func(string) string) *stringValue {
+	sv := &stringValue{
+		hidden:      hidden,
+		target:      target,
+		normalizers: append(normalizers, strings.TrimSpace),
 	}
+	sv.set(val)
+
+	return sv
 }
 
 func (s *stringValue) Set(val string) error {
-	*s.target = val
+	s.set(val)
 	return nil
 }
 
+func (s *stringValue) set(val string) {
+	*s.target = s.normalize(val)
+}
+
+func (s *stringValue) normalize(in string) string {
+	if s == nil || len(s.normalizers) < 1 {
+		return in
+	}
+
+	for _, f := range s.normalizers {
+		in = f(in)
+	}
+
+	return in
+}
+
 func (s *stringValue) Get() interface{} { return *s.target }
 func (s *stringValue) String() string   { return *s.target }
 func (s *stringValue) Example() string  { return "string" }
diff --git a/command/base_flags_test.go b/command/base_flags_test.go
index ea3561ef8f1..af4dca9cc61 100644
--- a/command/base_flags_test.go
+++ b/command/base_flags_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/base_helpers.go b/command/base_helpers.go
index 06e8b802193..f13a9cc9e52 100644
--- a/command/base_helpers.go
+++ b/command/base_helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/base_helpers_test.go b/command/base_helpers_test.go
index c5268007368..f5522c22e7b 100644
--- a/command/base_helpers_test.go
+++ b/command/base_helpers_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/base_predict.go b/command/base_predict.go
index 72ba402fe97..299d2994d7f 100644
--- a/command/base_predict.go
+++ b/command/base_predict.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -10,6 +10,7 @@ import (
 	"sync"
 
 	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/api/cliconfig"
 	"github.com/posener/complete"
 )
 
@@ -28,7 +29,9 @@ func (p *Predict) Client() *api.Client {
 			client, _ := api.NewClient(nil)
 
 			if client.Token() == "" {
-				helper, err := DefaultTokenHelper()
+				// ignore duplicate keys in HCL files on autocompletion as printing a warning here would be too annoying
+				// TODO (HCL_DUP_KEYS_DEPRECATION): remove the comment above
+				helper, err := cliconfig.DefaultTokenHelper()
 				if err != nil {
 					return
 				}
diff --git a/command/base_predict_test.go b/command/base_predict_test.go
index 4c17651ecdb..71ca5baadb3 100644
--- a/command/base_predict_test.go
+++ b/command/base_predict_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -351,7 +351,6 @@ func TestPredict_Plugins(t *testing.T) {
 				"aws",
 				"azure",
 				"cassandra-database-plugin",
-				"centrify",
 				"cert",
 				"cf",
 				"consul",
@@ -391,7 +390,9 @@ func TestPredict_Plugins(t *testing.T) {
 				"redis-elasticache-database-plugin",
 				"redshift-database-plugin",
 				"saml",
+				"scep",
 				"snowflake-database-plugin",
+				"spiffe",
 				"ssh",
 				"terraform",
 				"totp",
@@ -445,6 +446,22 @@ func TestPredict_Plugins(t *testing.T) {
 						}
 					}
 				}
+				if !strutil.StrListContains(act, "scep") {
+					for i, v := range tc.exp {
+						if v == "scep" {
+							tc.exp = append(tc.exp[:i], tc.exp[i+1:]...)
+							break
+						}
+					}
+				}
+				if !strutil.StrListContains(act, "spiffe") {
+					for i, v := range tc.exp {
+						if v == "spiffe" {
+							tc.exp = append(tc.exp[:i], tc.exp[i+1:]...)
+							break
+						}
+					}
+				}
 				if d := cmp.Diff(act, tc.exp); len(d) > 0 {
 					t.Errorf("expected: %q, got: %q, diff: %v", tc.exp, act, d)
 				}
diff --git a/command/base_test.go b/command/base_test.go
index 2be878a09b2..62b22f0cc4c 100644
--- a/command/base_test.go
+++ b/command/base_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -24,60 +24,64 @@ func getDefaultCliHeaders(t *testing.T) http.Header {
 }
 
 func TestClient_FlagHeader(t *testing.T) {
-	defaultHeaders := getDefaultCliHeaders(t)
+	t.Parallel()
 
-	cases := []struct {
+	cases := map[string]struct {
 		Input map[string]string
 		Valid bool
 	}{
-		{
+		"empty": {
 			map[string]string{},
 			true,
 		},
-		{
+		"valid": {
 			map[string]string{"foo": "bar", "header2": "value2"},
 			true,
 		},
-		{
+		"invalid": {
 			map[string]string{"X-Vault-foo": "bar", "header2": "value2"},
 			false,
 		},
 	}
 
-	for _, tc := range cases {
-		expectedHeaders := defaultHeaders.Clone()
-		for key, val := range tc.Input {
-			expectedHeaders.Add(key, val)
-		}
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			expectedHeaders := getDefaultCliHeaders(t)
+			for key, val := range tc.Input {
+				expectedHeaders.Add(key, val)
+			}
 
-		bc := &BaseCommand{flagHeader: tc.Input}
-		cli, err := bc.Client()
+			bc := &BaseCommand{flagHeader: tc.Input}
+			cli, err := bc.Client()
 
-		if err == nil && !tc.Valid {
-			t.Errorf("No error for input[%#v], but not valid", tc.Input)
-			continue
-		}
+			if err == nil && !tc.Valid {
+				t.Errorf("No error for input[%#v], but not valid", tc.Input)
+			}
 
-		if err != nil {
-			if tc.Valid {
-				t.Errorf("Error[%v] with input[%#v], but valid", err, tc.Input)
+			if err != nil {
+				if tc.Valid {
+					t.Errorf("Error[%v] with input[%#v], but valid", err, tc.Input)
+				}
+				return
 			}
-			continue
-		}
 
-		if cli == nil {
-			t.Error("client should not be nil")
-		}
+			if cli == nil {
+				t.Error("client should not be nil")
+			}
 
-		actualHeaders := cli.Headers()
-		if !reflect.DeepEqual(expectedHeaders, actualHeaders) {
-			t.Errorf("expected [%#v] but got [%#v]", expectedHeaders, actualHeaders)
-		}
+			actualHeaders := cli.Headers()
+			if !reflect.DeepEqual(expectedHeaders, actualHeaders) {
+				t.Errorf("expected [%#v] but got [%#v]", expectedHeaders, actualHeaders)
+			}
+		})
 	}
 }
 
 // TestClient_HCPConfiguration tests that the HCP configuration is applied correctly when it exists in cache.
 func TestClient_HCPConfiguration(t *testing.T) {
+	t.Parallel()
+
 	cases := map[string]struct {
 		Valid        bool
 		ExpectedAddr string
@@ -94,7 +98,8 @@ func TestClient_HCPConfiguration(t *testing.T) {
 
 	for n, tst := range cases {
 		t.Run(n, func(t *testing.T) {
-			bc := &BaseCommand{hcpTokenHelper: &hcpvlib.TestingHCPTokenHelper{tst.Valid}}
+			t.Parallel()
+			bc := &BaseCommand{hcpTokenHelper: &hcpvlib.TestingHCPTokenHelper{ValidCache: tst.Valid}}
 			cli, err := bc.Client()
 			assert.NoError(t, err)
 
@@ -109,3 +114,80 @@ func TestClient_HCPConfiguration(t *testing.T) {
 		})
 	}
 }
+
+// Test_FlagSet_StringVar_Normalizers verifies that the normalizer callbacks
+// works as expected.
+func Test_FlagSet_StringVar_Normalizers(t *testing.T) {
+	appendA := func(in string) string { return in + "a" }
+	prependB := func(in string) string { return "b" + in }
+
+	for name, test := range map[string]struct {
+		in            func() *StringVar
+		envVars       map[string]string
+		expectedValue string
+	}{
+		"no normalizers no env vars uses default value": {
+			in: func() *StringVar {
+				resT := ""
+				return &StringVar{
+					Name:    "test",
+					Target:  &resT,
+					EnvVar:  "VAULT_TEST",
+					Default: "default",
+				}
+			},
+			expectedValue: "default",
+		},
+		"one normalizer no env vars normalizes default value": {
+			in: func() *StringVar {
+				resT := ""
+				return &StringVar{
+					Name:        "test",
+					Target:      &resT,
+					EnvVar:      "VAULT_TEST",
+					Default:     "default",
+					Normalizers: []func(string) string{appendA},
+				}
+			},
+			expectedValue: "defaulta",
+		},
+		"two normalizers no env vars normalizes default value with both": {
+			in: func() *StringVar {
+				resT := ""
+				return &StringVar{
+					Name:        "test",
+					Target:      &resT,
+					EnvVar:      "VAULT_TEST",
+					Default:     "default",
+					Normalizers: []func(string) string{appendA, prependB},
+				}
+			},
+			expectedValue: "bdefaulta",
+		},
+		"two normalizers with env vars normalizes env var value with both": {
+			in: func() *StringVar {
+				resT := ""
+				return &StringVar{
+					Name:        "test",
+					Target:      &resT,
+					EnvVar:      "VAULT_TEST",
+					Default:     "default",
+					Normalizers: []func(string) string{appendA, prependB},
+				}
+			},
+			envVars:       map[string]string{"VAULT_TEST": "env_override"},
+			expectedValue: "benv_overridea",
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			for k, v := range test.envVars {
+				t.Setenv(k, v)
+			}
+			fsets := NewFlagSets(nil)
+			fs := fsets.NewFlagSet("test")
+			sv := test.in()
+			fs.StringVar(sv)
+			require.Equal(t, test.expectedValue, *sv.Target)
+		})
+	}
+}
diff --git a/command/command_stubs_oss.go b/command/command_stubs_oss.go
index d1de67e4def..e2bfdaeabdf 100644
--- a/command/command_stubs_oss.go
+++ b/command/command_stubs_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -16,11 +16,6 @@ import (
 func entInitCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions, commands map[string]cli.CommandFactory) {
 }
 
-func entEnableFourClusterDev(c *ServerCommand, base *vault.CoreConfig, info map[string]string, infoKeys []string, tempDir string) int {
-	c.logger.Error("-dev-four-cluster only supported in enterprise Vault")
-	return 1
-}
-
 func entAdjustCoreConfig(config *server.Config, coreConfig *vault.CoreConfig) {
 }
 
@@ -31,3 +26,8 @@ func entCheckStorageType(coreConfig *vault.CoreConfig) bool {
 func entGetFIPSInfoKey() string {
 	return ""
 }
+
+func entCheckRequestLimiter(_cmd *ServerCommand, _config *server.Config) {
+}
+
+func entExtendAddonHandlers(handlers *vaultHandlers) {}
diff --git a/command/command_test.go b/command/command_test.go
index 61171db5a55..7a4be03fdaa 100644
--- a/command/command_test.go
+++ b/command/command_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -17,13 +17,13 @@ import (
 	kv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/audit"
-	auditFile "github.com/hashicorp/vault/builtin/audit/file"
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/builtin/logical/pki"
 	"github.com/hashicorp/vault/builtin/logical/ssh"
 	"github.com/hashicorp/vault/builtin/logical/transit"
-	"github.com/hashicorp/vault/helper/benchhelpers"
 	"github.com/hashicorp/vault/helper/builtinplugins"
+	"github.com/hashicorp/vault/helper/testhelpers"
+	"github.com/hashicorp/vault/helper/testhelpers/teststorage"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/physical/inmem"
@@ -39,7 +39,7 @@ var (
 	}
 
 	defaultVaultAuditBackends = map[string]audit.Factory{
-		"file": auditFile.Factory,
+		"file": audit.NewFileBackend,
 	}
 
 	defaultVaultLogicalBackends = map[string]logical.Factory{
@@ -123,10 +123,11 @@ func testVaultServerWithKVVersion(tb testing.TB, kvVersion string) (*api.Client,
 func testVaultServerAllBackends(tb testing.TB) (*api.Client, func()) {
 	tb.Helper()
 
+	handlers := newVaultHandlers()
 	client, _, closer := testVaultServerCoreConfig(tb, &vault.CoreConfig{
-		CredentialBackends: credentialBackends,
-		AuditBackends:      auditBackends,
-		LogicalBackends:    logicalBackends,
+		CredentialBackends: handlers.credentialBackends,
+		AuditBackends:      handlers.auditBackends,
+		LogicalBackends:    handlers.logicalBackends,
 		BuiltinRegistry:    builtinplugins.Registry,
 	})
 	return client, closer
@@ -162,6 +163,23 @@ func testVaultServerUnsealWithKVVersionWithSeal(tb testing.TB, kvVersion string,
 	})
 }
 
+func testVaultRaftCluster(tb testing.TB) *vault.TestCluster {
+	conf := &vault.CoreConfig{
+		CredentialBackends: defaultVaultCredentialBackends,
+		AuditBackends:      defaultVaultAuditBackends,
+		LogicalBackends:    defaultVaultLogicalBackends,
+		BuiltinRegistry:    builtinplugins.Registry,
+	}
+	opts := &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+		NumCores:    3,
+	}
+	teststorage.RaftBackendSetup(conf, opts)
+	cluster := vault.NewTestCluster(tb, conf, opts)
+	testhelpers.WaitForActiveNodeAndStandbys(tb, cluster)
+	return cluster
+}
+
 // testVaultServerUnseal creates a test vault cluster and returns a configured
 // API client, list of unseal keys (as strings), and a closer function
 // configured with the given plugin directory.
@@ -190,12 +208,12 @@ func testVaultServerCoreConfig(tb testing.TB, coreConfig *vault.CoreConfig) (*ap
 func testVaultServerCoreConfigWithOpts(tb testing.TB, coreConfig *vault.CoreConfig, opts *vault.TestClusterOptions) (*api.Client, []string, func()) {
 	tb.Helper()
 
-	cluster := vault.NewTestCluster(benchhelpers.TBtoT(tb), coreConfig, opts)
+	cluster := vault.NewTestCluster(tb, coreConfig, opts)
 	cluster.Start()
 
 	// Make it easy to get access to the active
 	core := cluster.Cores[0].Core
-	vault.TestWaitActive(benchhelpers.TBtoT(tb), core)
+	vault.TestWaitActive(tb, core)
 
 	// Get the client already setup for us!
 	client := cluster.Cores[0].Client
diff --git a/command/command_testonly/operator_usage_testonly_oss_test.go b/command/command_testonly/operator_usage_testonly_oss_test.go
new file mode 100644
index 00000000000..44919f619a3
--- /dev/null
+++ b/command/command_testonly/operator_usage_testonly_oss_test.go
@@ -0,0 +1,101 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build testonly && !enterprise
+
+package command_testonly
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/cli"
+	"github.com/hashicorp/vault/command"
+	"github.com/hashicorp/vault/helper/timeutil"
+	vaulthttp "github.com/hashicorp/vault/http"
+	"github.com/hashicorp/vault/sdk/helper/clientcountutil"
+	"github.com/hashicorp/vault/sdk/helper/clientcountutil/generation"
+	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
+)
+
+func testOperatorUsageCommand(tb testing.TB) (*cli.MockUi, *command.OperatorUsageCommand) {
+	tb.Helper()
+
+	ui := cli.NewMockUi()
+	return ui, &command.OperatorUsageCommand{
+		BaseCommand: &command.BaseCommand{
+			UI: ui,
+		},
+	}
+}
+
+// TestOperatorUsageCommandRun writes mock activity log data and runs the
+// operator usage command. The test verifies that the output contains the
+// expected values per client type.
+// This test cannot be run in parallel because it sets the VAULT_TOKEN env
+// var
+func TestOperatorUsageCommandRun(t *testing.T) {
+	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+		NumCores:    1,
+	})
+	defer cluster.Cleanup()
+	core := cluster.Cores[0].Core
+	vault.TestWaitActive(t, core)
+
+	client := cluster.Cores[0].Client
+	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{"enabled": "enable"})
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+
+	_, err = clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(2).
+		NewClientsSeen(6, clientcountutil.WithClientType("entity")).
+		NewClientsSeen(4, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(2, clientcountutil.WithClientType("secret-sync")).
+		NewClientsSeen(7, clientcountutil.WithClientType("pki-acme")).
+		NewPreviousMonthData(1).
+		NewClientsSeen(3, clientcountutil.WithClientType("entity")).
+		NewClientsSeen(4, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(5, clientcountutil.WithClientType("secret-sync")).
+		NewClientsSeen(8, clientcountutil.WithClientType("pki-acme")).
+		Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES, generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES)
+	require.NoError(t, err)
+
+	ui, cmd := testOperatorUsageCommand(t)
+
+	t.Setenv("VAULT_TOKEN", client.Token())
+	start := timeutil.MonthsPreviousTo(2, now).Format(time.RFC3339)
+	end := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now)).UTC().Format(time.RFC3339)
+	// Reset and check output
+	code := cmd.Run([]string{
+		"-address", client.Address(),
+		"-tls-skip-verify",
+		"-start-time", start,
+		"-end-time", end,
+	})
+	require.Equal(t, 0, code, ui.ErrorWriter.String())
+	output := ui.OutputWriter.String()
+	outputLines := strings.Split(output, "\n")
+	require.Equal(t, fmt.Sprintf("Period start: %s", start), outputLines[0])
+	require.Equal(t, fmt.Sprintf("Period end: %s", end), outputLines[1])
+
+	require.Contains(t, outputLines[3], "Secret sync")
+	require.Contains(t, outputLines[3], "ACME clients")
+	nsCounts := strings.Fields(outputLines[5])
+	require.Equal(t, "[root]", nsCounts[0])
+	require.Equal(t, "9", nsCounts[1])
+	require.Equal(t, "8", nsCounts[2])
+	require.Equal(t, "7", nsCounts[3])
+	require.Equal(t, "15", nsCounts[4])
+	require.Equal(t, "39", nsCounts[5])
+
+	totalCounts := strings.Fields(outputLines[7])
+	require.Equal(t, "Total", totalCounts[0])
+	require.Equal(t, nsCounts[1:], totalCounts[1:])
+}
diff --git a/command/command_testonly/server_testonly_test.go b/command/command_testonly/server_testonly_test.go
deleted file mode 100644
index 68f8943440d..00000000000
--- a/command/command_testonly/server_testonly_test.go
+++ /dev/null
@@ -1,213 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-//go:build testonly
-
-package command_testonly
-
-import (
-	"os"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/hashicorp/vault/api"
-	"github.com/hashicorp/vault/command"
-	"github.com/hashicorp/vault/limits"
-	"github.com/hashicorp/vault/vault"
-	"github.com/mitchellh/mapstructure"
-	"github.com/stretchr/testify/require"
-)
-
-func init() {
-	if signed := os.Getenv("VAULT_LICENSE_CI"); signed != "" {
-		os.Setenv(command.EnvVaultLicense, signed)
-	}
-}
-
-const (
-	baseHCL = `
-		backend "inmem" { }
-		disable_mlock = true
-		listener "tcp" {
-			address     = "127.0.0.1:8209"
-			tls_disable = "true"
-		}
-		api_addr = "http://127.0.0.1:8209"
-	`
-	requestLimiterDisableHCL = `
-  request_limiter {
-	disable = true
-  }
-`
-	requestLimiterEnableHCL = `
-  request_limiter {
-	disable = false
-  }
-`
-)
-
-// TestServer_ReloadRequestLimiter tests a series of reloads and state
-// transitions between RequestLimiter enable and disable.
-func TestServer_ReloadRequestLimiter(t *testing.T) {
-	t.Parallel()
-
-	enabledResponse := &vault.RequestLimiterResponse{
-		GlobalDisabled:   false,
-		ListenerDisabled: false,
-		Limiters: map[string]*vault.LimiterStatus{
-			limits.WriteLimiter: {
-				Enabled: true,
-				Flags:   limits.DefaultLimiterFlags[limits.WriteLimiter],
-			},
-			limits.SpecialPathLimiter: {
-				Enabled: true,
-				Flags:   limits.DefaultLimiterFlags[limits.SpecialPathLimiter],
-			},
-		},
-	}
-
-	disabledResponse := &vault.RequestLimiterResponse{
-		GlobalDisabled:   true,
-		ListenerDisabled: false,
-		Limiters: map[string]*vault.LimiterStatus{
-			limits.WriteLimiter: {
-				Enabled: false,
-			},
-			limits.SpecialPathLimiter: {
-				Enabled: false,
-			},
-		},
-	}
-
-	cases := []struct {
-		name             string
-		configAfter      string
-		expectedResponse *vault.RequestLimiterResponse
-	}{
-		{
-			"disable after default",
-			baseHCL + requestLimiterDisableHCL,
-			disabledResponse,
-		},
-		{
-			"disable after disable",
-			baseHCL + requestLimiterDisableHCL,
-			disabledResponse,
-		},
-		{
-			"enable after disable",
-			baseHCL + requestLimiterEnableHCL,
-			enabledResponse,
-		},
-		{
-			"default after enable",
-			baseHCL,
-			disabledResponse,
-		},
-		{
-			"default after default",
-			baseHCL,
-			disabledResponse,
-		},
-		{
-			"enable after default",
-			baseHCL + requestLimiterEnableHCL,
-			enabledResponse,
-		},
-		{
-			"enable after enable",
-			baseHCL + requestLimiterEnableHCL,
-			enabledResponse,
-		},
-	}
-
-	ui, srv := command.TestServerCommand(t)
-
-	f, err := os.CreateTemp(t.TempDir(), "")
-	require.NoErrorf(t, err, "error creating temp dir: %v", err)
-
-	_, err = f.WriteString(baseHCL)
-	require.NoErrorf(t, err, "cannot write temp file contents")
-
-	configPath := f.Name()
-
-	var output string
-	wg := &sync.WaitGroup{}
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		code := srv.Run([]string{"-config", configPath})
-		output = ui.ErrorWriter.String() + ui.OutputWriter.String()
-		require.Equal(t, 0, code, output)
-	}()
-
-	select {
-	case <-srv.StartedCh():
-	case <-time.After(5 * time.Second):
-		t.Fatalf("timeout")
-	}
-	defer func() {
-		srv.ShutdownCh <- struct{}{}
-		wg.Wait()
-	}()
-
-	err = f.Close()
-	require.NoErrorf(t, err, "unable to close temp file")
-
-	// create a client and unseal vault
-	cli, err := srv.Client()
-	require.NoError(t, err)
-	require.NoError(t, cli.SetAddress("http://127.0.0.1:8209"))
-	initResp, err := cli.Sys().Init(&api.InitRequest{SecretShares: 1, SecretThreshold: 1})
-	require.NoError(t, err)
-	_, err = cli.Sys().Unseal(initResp.Keys[0])
-	require.NoError(t, err)
-	cli.SetToken(initResp.RootToken)
-
-	output = ui.ErrorWriter.String() + ui.OutputWriter.String()
-	require.Contains(t, output, "Request Limiter: disabled")
-
-	verifyLimiters := func(t *testing.T, expectedResponse *vault.RequestLimiterResponse) {
-		t.Helper()
-
-		statusResp, err := cli.Logical().Read("/sys/internal/request-limiter/status")
-		require.NoError(t, err)
-		require.NotNil(t, statusResp)
-
-		limitersResp, ok := statusResp.Data["request_limiter"]
-		require.True(t, ok)
-		require.NotNil(t, limitersResp)
-
-		var limiters *vault.RequestLimiterResponse
-		err = mapstructure.Decode(limitersResp, &limiters)
-		require.NoError(t, err)
-		require.NotNil(t, limiters)
-
-		require.Equal(t, expectedResponse, limiters)
-	}
-
-	// Start off with default disabled
-	verifyLimiters(t, disabledResponse)
-
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			// Write the new contents and reload the server
-			f, err = os.OpenFile(configPath, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o644)
-			require.NoError(t, err)
-			defer f.Close()
-
-			_, err = f.WriteString(tc.configAfter)
-			require.NoErrorf(t, err, "cannot write temp file contents")
-
-			srv.SighupCh <- struct{}{}
-			select {
-			case <-srv.ReloadedCh():
-			case <-time.After(5 * time.Second):
-				t.Fatalf("test timed out")
-			}
-
-			verifyLimiters(t, tc.expectedResponse)
-		})
-	}
-}
diff --git a/command/commands.go b/command/commands.go
index 682fe7d3b8e..75c8170f0f9 100644
--- a/command/commands.go
+++ b/command/commands.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -10,53 +10,18 @@ import (
 
 	"github.com/hashicorp/cli"
 	hcpvlib "github.com/hashicorp/vault-hcp-lib"
-	credAliCloud "github.com/hashicorp/vault-plugin-auth-alicloud"
-	credCentrify "github.com/hashicorp/vault-plugin-auth-centrify"
-	credCF "github.com/hashicorp/vault-plugin-auth-cf"
-	credGcp "github.com/hashicorp/vault-plugin-auth-gcp/plugin"
 	credOIDC "github.com/hashicorp/vault-plugin-auth-jwt"
-	credKerb "github.com/hashicorp/vault-plugin-auth-kerberos"
-	credOCI "github.com/hashicorp/vault-plugin-auth-oci"
 	logicalKv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/audit"
-	auditFile "github.com/hashicorp/vault/builtin/audit/file"
-	auditSocket "github.com/hashicorp/vault/builtin/audit/socket"
-	auditSyslog "github.com/hashicorp/vault/builtin/audit/syslog"
-	credAws "github.com/hashicorp/vault/builtin/credential/aws"
 	credCert "github.com/hashicorp/vault/builtin/credential/cert"
-	credGitHub "github.com/hashicorp/vault/builtin/credential/github"
-	credLdap "github.com/hashicorp/vault/builtin/credential/ldap"
-	credOkta "github.com/hashicorp/vault/builtin/credential/okta"
 	credToken "github.com/hashicorp/vault/builtin/credential/token"
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
 	logicalDb "github.com/hashicorp/vault/builtin/logical/database"
 	"github.com/hashicorp/vault/builtin/plugin"
 	_ "github.com/hashicorp/vault/helper/builtinplugins"
-	physAerospike "github.com/hashicorp/vault/physical/aerospike"
-	physAliCloudOSS "github.com/hashicorp/vault/physical/alicloudoss"
-	physAzure "github.com/hashicorp/vault/physical/azure"
-	physCassandra "github.com/hashicorp/vault/physical/cassandra"
-	physCockroachDB "github.com/hashicorp/vault/physical/cockroachdb"
-	physConsul "github.com/hashicorp/vault/physical/consul"
-	physCouchDB "github.com/hashicorp/vault/physical/couchdb"
-	physDynamoDB "github.com/hashicorp/vault/physical/dynamodb"
-	physEtcd "github.com/hashicorp/vault/physical/etcd"
-	physFoundationDB "github.com/hashicorp/vault/physical/foundationdb"
-	physGCS "github.com/hashicorp/vault/physical/gcs"
-	physManta "github.com/hashicorp/vault/physical/manta"
-	physMSSQL "github.com/hashicorp/vault/physical/mssql"
-	physMySQL "github.com/hashicorp/vault/physical/mysql"
-	physOCI "github.com/hashicorp/vault/physical/oci"
-	physPostgreSQL "github.com/hashicorp/vault/physical/postgresql"
 	physRaft "github.com/hashicorp/vault/physical/raft"
-	physS3 "github.com/hashicorp/vault/physical/s3"
-	physSpanner "github.com/hashicorp/vault/physical/spanner"
-	physSwift "github.com/hashicorp/vault/physical/swift"
-	physZooKeeper "github.com/hashicorp/vault/physical/zookeeper"
-	"github.com/hashicorp/vault/plugins/event"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/physical"
-	physFile "github.com/hashicorp/vault/sdk/physical/file"
 	physInmem "github.com/hashicorp/vault/sdk/physical/inmem"
 	sr "github.com/hashicorp/vault/serviceregistration"
 	csr "github.com/hashicorp/vault/serviceregistration/consul"
@@ -132,6 +97,8 @@ const (
 	flagNamePluginVersion = "plugin-version"
 	// flagNameIdentityTokenKey selects the key used to sign plugin identity tokens
 	flagNameIdentityTokenKey = "identity-token-key"
+	// flagNameTrimRequestTrailingSlashes selects the key used to determine whether to trim trailing slashes
+	flagNameTrimRequestTrailingSlashes = "trim-request-trailing-slashes"
 	// flagNameUserLockoutThreshold is the flag name used for tuning the auth mount lockout threshold parameter
 	flagNameUserLockoutThreshold = "user-lockout-threshold"
 	// flagNameUserLockoutDuration is the flag name used for tuning the auth mount lockout duration parameter
@@ -164,88 +131,69 @@ const (
 	flagNameDelegatedAuthAccessors = "delegated-auth-accessors"
 )
 
-var (
-	auditBackends = map[string]audit.Factory{
-		"file":   auditFile.Factory,
-		"socket": auditSocket.Factory,
-		"syslog": auditSyslog.Factory,
-	}
-
-	credentialBackends = map[string]logical.Factory{
-		"plugin": plugin.Factory,
-	}
-
-	eventBackends = map[string]event.Factory{}
-
-	logicalBackends = map[string]logical.Factory{
-		"plugin":   plugin.Factory,
-		"database": logicalDb.Factory,
-		// This is also available in the plugin catalog, but is here due to the need to
-		// automatically mount it.
-		"kv": logicalKv.Factory,
-	}
+// vaultHandlers contains the handlers for creating the various Vault backends.
+type vaultHandlers struct {
+	physicalBackends     map[string]physical.Factory
+	loginHandlers        map[string]LoginHandler
+	auditBackends        map[string]audit.Factory
+	credentialBackends   map[string]logical.Factory
+	logicalBackends      map[string]logical.Factory
+	serviceRegistrations map[string]sr.Factory
+}
 
-	physicalBackends = map[string]physical.Factory{
-		"aerospike":              physAerospike.NewAerospikeBackend,
-		"alicloudoss":            physAliCloudOSS.NewAliCloudOSSBackend,
-		"azure":                  physAzure.NewAzureBackend,
-		"cassandra":              physCassandra.NewCassandraBackend,
-		"cockroachdb":            physCockroachDB.NewCockroachDBBackend,
-		"consul":                 physConsul.NewConsulBackend,
-		"couchdb_transactional":  physCouchDB.NewTransactionalCouchDBBackend,
-		"couchdb":                physCouchDB.NewCouchDBBackend,
-		"dynamodb":               physDynamoDB.NewDynamoDBBackend,
-		"etcd":                   physEtcd.NewEtcdBackend,
-		"file_transactional":     physFile.NewTransactionalFileBackend,
-		"file":                   physFile.NewFileBackend,
-		"foundationdb":           physFoundationDB.NewFDBBackend,
-		"gcs":                    physGCS.NewBackend,
-		"inmem_ha":               physInmem.NewInmemHA,
-		"inmem_transactional_ha": physInmem.NewTransactionalInmemHA,
-		"inmem_transactional":    physInmem.NewTransactionalInmem,
-		"inmem":                  physInmem.NewInmem,
-		"manta":                  physManta.NewMantaBackend,
-		"mssql":                  physMSSQL.NewMSSQLBackend,
-		"mysql":                  physMySQL.NewMySQLBackend,
-		"oci":                    physOCI.NewBackend,
-		"postgresql":             physPostgreSQL.NewPostgreSQLBackend,
-		"s3":                     physS3.NewS3Backend,
-		"spanner":                physSpanner.NewBackend,
-		"swift":                  physSwift.NewSwiftBackend,
-		"raft":                   physRaft.NewRaftBackend,
-		"zookeeper":              physZooKeeper.NewZooKeeperBackend,
+// newMinimalVaultHandlers returns a new vaultHandlers that a minimal Vault would use.
+func newMinimalVaultHandlers() *vaultHandlers {
+	return &vaultHandlers{
+		physicalBackends: map[string]physical.Factory{
+			"inmem_ha":               physInmem.NewInmemHA,
+			"inmem_transactional_ha": physInmem.NewTransactionalInmemHA,
+			"inmem_transactional":    physInmem.NewTransactionalInmem,
+			"inmem":                  physInmem.NewInmem,
+			"raft":                   physRaft.NewRaftBackend,
+		},
+		loginHandlers: map[string]LoginHandler{
+			"cert":  &credCert.CLIHandler{},
+			"oidc":  &credOIDC.CLIHandler{},
+			"token": &credToken.CLIHandler{},
+			"userpass": &credUserpass.CLIHandler{
+				DefaultMount: "userpass",
+			},
+		},
+		auditBackends: map[string]audit.Factory{
+			"file":   audit.NewFileBackend,
+			"socket": audit.NewSocketBackend,
+			"syslog": audit.NewSyslogBackend,
+		},
+		credentialBackends: map[string]logical.Factory{
+			"plugin": plugin.Factory,
+		},
+		logicalBackends: map[string]logical.Factory{
+			"plugin":   plugin.Factory,
+			"database": logicalDb.Factory,
+			// This is also available in the plugin catalog, but is here due to the need to
+			// automatically mount it.
+			"kv": logicalKv.Factory,
+		},
+		serviceRegistrations: map[string]sr.Factory{
+			"consul":     csr.NewServiceRegistration,
+			"kubernetes": ksr.NewServiceRegistration,
+		},
 	}
+}
 
-	serviceRegistrations = map[string]sr.Factory{
-		"consul":     csr.NewServiceRegistration,
-		"kubernetes": ksr.NewServiceRegistration,
-	}
+// newVaultHandlers returns a new vaultHandlers composed of newMinimalVaultHandlers()
+// and any addon handlers from Vault CE and Vault Enterprise selected by Go build tags.
+func newVaultHandlers() *vaultHandlers {
+	handlers := newMinimalVaultHandlers()
+	extendAddonHandlers(handlers)
+	entExtendAddonHandlers(handlers)
 
-	loginHandlers = map[string]LoginHandler{
-		"alicloud": &credAliCloud.CLIHandler{},
-		"aws":      &credAws.CLIHandler{},
-		"centrify": &credCentrify.CLIHandler{},
-		"cert":     &credCert.CLIHandler{},
-		"cf":       &credCF.CLIHandler{},
-		"gcp":      &credGcp.CLIHandler{},
-		"github":   &credGitHub.CLIHandler{},
-		"kerberos": &credKerb.CLIHandler{},
-		"ldap":     &credLdap.CLIHandler{},
-		"oci":      &credOCI.CLIHandler{},
-		"oidc":     &credOIDC.CLIHandler{},
-		"okta":     &credOkta.CLIHandler{},
-		"pcf":      &credCF.CLIHandler{}, // Deprecated.
-		"radius": &credUserpass.CLIHandler{
-			DefaultMount: "radius",
-		},
-		"token": &credToken.CLIHandler{},
-		"userpass": &credUserpass.CLIHandler{
-			DefaultMount: "userpass",
-		},
-	}
-)
+	return handlers
+}
 
 func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) map[string]cli.CommandFactory {
+	handlers := newVaultHandlers()
+
 	getBaseCommand := func() *BaseCommand {
 		return &BaseCommand{
 			UI:             ui,
@@ -264,6 +212,7 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) map[string]cli.Co
 				},
 				ShutdownCh: MakeShutdownCh(),
 				SighupCh:   MakeSighupCh(),
+				SigUSR2Ch:  MakeSigUSR2Ch(),
 			}, nil
 		},
 		"agent generate-config": func() (cli.Command, error) {
@@ -314,7 +263,7 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) map[string]cli.Co
 		"auth help": func() (cli.Command, error) {
 			return &AuthHelpCommand{
 				BaseCommand: getBaseCommand(),
-				Handlers:    loginHandlers,
+				Handlers:    handlers.loginHandlers,
 			}, nil
 		},
 		"auth list": func() (cli.Command, error) {
@@ -371,7 +320,7 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) map[string]cli.Co
 		"login": func() (cli.Command, error) {
 			return &LoginCommand{
 				BaseCommand: getBaseCommand(),
-				Handlers:    loginHandlers,
+				Handlers:    handlers.loginHandlers,
 			}, nil
 		},
 		"namespace": func() (cli.Command, error) {
@@ -442,7 +391,7 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) map[string]cli.Co
 		"operator migrate": func() (cli.Command, error) {
 			return &OperatorMigrateCommand{
 				BaseCommand:      getBaseCommand(),
-				PhysicalBackends: physicalBackends,
+				PhysicalBackends: handlers.physicalBackends,
 				ShutdownCh:       MakeShutdownCh(),
 			}, nil
 		},
@@ -602,9 +551,7 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) map[string]cli.Co
 			}, nil
 		},
 		"plugin register": func() (cli.Command, error) {
-			return &PluginRegisterCommand{
-				BaseCommand: getBaseCommand(),
-			}, nil
+			return NewPluginRegisterCommand(getBaseCommand()), nil
 		},
 		"plugin reload": func() (cli.Command, error) {
 			return &PluginReloadCommand{
@@ -648,6 +595,7 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) map[string]cli.Co
 				},
 				ShutdownCh: MakeShutdownCh(),
 				SighupCh:   MakeSighupCh(),
+				SigUSR2Ch:  MakeSigUSR2Ch(),
 			}, nil
 		},
 		"policy": func() (cli.Command, error) {
@@ -732,13 +680,11 @@ func initCommands(ui, serverCmdUi cli.Ui, runOpts *RunOptions) map[string]cli.Co
 					tokenHelper: runOpts.TokenHelper,
 					flagAddress: runOpts.Address,
 				},
-				AuditBackends:      auditBackends,
-				CredentialBackends: credentialBackends,
-				EventBackends:      eventBackends,
-				LogicalBackends:    logicalBackends,
-				PhysicalBackends:   physicalBackends,
-
-				ServiceRegistrations: serviceRegistrations,
+				AuditBackends:        handlers.auditBackends,
+				CredentialBackends:   handlers.credentialBackends,
+				LogicalBackends:      handlers.logicalBackends,
+				PhysicalBackends:     handlers.physicalBackends,
+				ServiceRegistrations: handlers.serviceRegistrations,
 
 				ShutdownCh: MakeShutdownCh(),
 				SighupCh:   MakeSighupCh(),
diff --git a/command/commands_full.go b/command/commands_full.go
new file mode 100644
index 00000000000..b0e7831f505
--- /dev/null
+++ b/command/commands_full.go
@@ -0,0 +1,96 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !minimal
+
+package command
+
+import (
+	"maps"
+
+	credAliCloud "github.com/hashicorp/vault-plugin-auth-alicloud"
+	credCF "github.com/hashicorp/vault-plugin-auth-cf"
+	credGcp "github.com/hashicorp/vault-plugin-auth-gcp/plugin"
+	credKerb "github.com/hashicorp/vault-plugin-auth-kerberos"
+	credOCI "github.com/hashicorp/vault-plugin-auth-oci"
+	credAws "github.com/hashicorp/vault/builtin/credential/aws"
+	credGitHub "github.com/hashicorp/vault/builtin/credential/github"
+	credLdap "github.com/hashicorp/vault/builtin/credential/ldap"
+	credOkta "github.com/hashicorp/vault/builtin/credential/okta"
+	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
+	_ "github.com/hashicorp/vault/helper/builtinplugins"
+	physAerospike "github.com/hashicorp/vault/physical/aerospike"
+	physAliCloudOSS "github.com/hashicorp/vault/physical/alicloudoss"
+	physAzure "github.com/hashicorp/vault/physical/azure"
+	physCassandra "github.com/hashicorp/vault/physical/cassandra"
+	physCockroachDB "github.com/hashicorp/vault/physical/cockroachdb"
+	physConsul "github.com/hashicorp/vault/physical/consul"
+	physCouchDB "github.com/hashicorp/vault/physical/couchdb"
+	physDynamoDB "github.com/hashicorp/vault/physical/dynamodb"
+	physEtcd "github.com/hashicorp/vault/physical/etcd"
+	physFoundationDB "github.com/hashicorp/vault/physical/foundationdb"
+	physGCS "github.com/hashicorp/vault/physical/gcs"
+	physManta "github.com/hashicorp/vault/physical/manta"
+	physMSSQL "github.com/hashicorp/vault/physical/mssql"
+	physMySQL "github.com/hashicorp/vault/physical/mysql"
+	physOCI "github.com/hashicorp/vault/physical/oci"
+	physPostgreSQL "github.com/hashicorp/vault/physical/postgresql"
+	physS3 "github.com/hashicorp/vault/physical/s3"
+	physSpanner "github.com/hashicorp/vault/physical/spanner"
+	physSwift "github.com/hashicorp/vault/physical/swift"
+	physZooKeeper "github.com/hashicorp/vault/physical/zookeeper"
+	"github.com/hashicorp/vault/sdk/physical"
+	physFile "github.com/hashicorp/vault/sdk/physical/file"
+)
+
+func newFullAddonHandlers() (map[string]physical.Factory, map[string]LoginHandler) {
+	addonPhysicalBackends := map[string]physical.Factory{
+		"aerospike":             physAerospike.NewAerospikeBackend,
+		"alicloudoss":           physAliCloudOSS.NewAliCloudOSSBackend,
+		"azure":                 physAzure.NewAzureBackend,
+		"cassandra":             physCassandra.NewCassandraBackend,
+		"cockroachdb":           physCockroachDB.NewCockroachDBBackend,
+		"consul":                physConsul.NewConsulBackend,
+		"couchdb_transactional": physCouchDB.NewTransactionalCouchDBBackend,
+		"couchdb":               physCouchDB.NewCouchDBBackend,
+		"dynamodb":              physDynamoDB.NewDynamoDBBackend,
+		"etcd":                  physEtcd.NewEtcdBackend,
+		"file_transactional":    physFile.NewTransactionalFileBackend,
+		"file":                  physFile.NewFileBackend,
+		"foundationdb":          physFoundationDB.NewFDBBackend,
+		"gcs":                   physGCS.NewBackend,
+		"manta":                 physManta.NewMantaBackend,
+		"mssql":                 physMSSQL.NewMSSQLBackend,
+		"mysql":                 physMySQL.NewMySQLBackend,
+		"oci":                   physOCI.NewBackend,
+		"postgresql":            physPostgreSQL.NewPostgreSQLBackend,
+		"s3":                    physS3.NewS3Backend,
+		"spanner":               physSpanner.NewBackend,
+		"swift":                 physSwift.NewSwiftBackend,
+		"zookeeper":             physZooKeeper.NewZooKeeperBackend,
+	}
+	addonLoginHandlers := map[string]LoginHandler{
+		"alicloud": &credAliCloud.CLIHandler{},
+		"aws":      &credAws.CLIHandler{},
+		"cf":       &credCF.CLIHandler{},
+		"gcp":      &credGcp.CLIHandler{},
+		"github":   &credGitHub.CLIHandler{},
+		"kerberos": &credKerb.CLIHandler{},
+		"ldap":     &credLdap.CLIHandler{},
+		"oci":      &credOCI.CLIHandler{},
+		"okta":     &credOkta.CLIHandler{},
+		"pcf":      &credCF.CLIHandler{}, // Deprecated.
+		"radius": &credUserpass.CLIHandler{
+			DefaultMount: "radius",
+		},
+	}
+
+	return addonPhysicalBackends, addonLoginHandlers
+}
+
+func extendAddonHandlers(handlers *vaultHandlers) {
+	addonPhysicalBackends, addonLoginHandlers := newFullAddonHandlers()
+
+	maps.Copy(handlers.physicalBackends, addonPhysicalBackends)
+	maps.Copy(handlers.loginHandlers, addonLoginHandlers)
+}
diff --git a/command/commands_full_test.go b/command/commands_full_test.go
new file mode 100644
index 00000000000..6343db37603
--- /dev/null
+++ b/command/commands_full_test.go
@@ -0,0 +1,46 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise && !minimal
+
+package command
+
+import (
+	"maps"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Test_extendAddonHandlers tests extendAddonHandlers() extends the minimal Vault handlers with handlers
+// generated by newFullAddonHandlers()
+func Test_extendAddonHandlers(t *testing.T) {
+	handlers := newMinimalVaultHandlers()
+	expMinPhysicalBackends := maps.Clone(handlers.physicalBackends)
+	expMinLoginHandlers := maps.Clone(handlers.loginHandlers)
+
+	expAddonPhysicalBackends, expAddonLoginHandlers := newFullAddonHandlers()
+
+	extendAddonHandlers(handlers)
+
+	require.Equal(t, len(expMinPhysicalBackends)+len(expAddonPhysicalBackends), len(handlers.physicalBackends),
+		"extended total physical backends mismatch total of minimal and full addon physical backends")
+	require.Equal(t, len(expMinLoginHandlers)+len(expAddonLoginHandlers), len(handlers.loginHandlers),
+		"extended total login handlers mismatch total of minimal and full addon login handlers")
+
+	for k := range expMinPhysicalBackends {
+		require.Contains(t, handlers.physicalBackends, k, "expected to contain minimal physical backend")
+	}
+
+	for k := range expAddonPhysicalBackends {
+		require.Contains(t, handlers.physicalBackends, k, "expected to contain full addon physical backend")
+	}
+
+	for k := range expMinLoginHandlers {
+		require.Contains(t, handlers.loginHandlers, k, "expected to contain minimal login handler")
+	}
+
+	for k := range expAddonLoginHandlers {
+		require.Contains(t, handlers.loginHandlers, k, "expected to contain full addon login handler")
+	}
+}
diff --git a/command/commands_min.go b/command/commands_min.go
new file mode 100644
index 00000000000..225aa6878b0
--- /dev/null
+++ b/command/commands_min.go
@@ -0,0 +1,14 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build minimal
+
+package command
+
+import (
+	_ "github.com/hashicorp/vault/helper/builtinplugins"
+)
+
+func extendAddonHandlers(*vaultHandlers) {
+	// No-op
+}
diff --git a/command/commands_nonwindows.go b/command/commands_nonwindows.go
index 90cfa253a2b..f2ff50a21e0 100644
--- a/command/commands_nonwindows.go
+++ b/command/commands_nonwindows.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !windows
diff --git a/command/commands_test.go b/command/commands_test.go
index ac057f737cc..894bfcd2edf 100644
--- a/command/commands_test.go
+++ b/command/commands_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -25,6 +25,9 @@ func Test_Commands_HCPInit(t *testing.T) {
 	}
 
 	for n, tst := range tests {
+		n := n
+		tst := tst
+
 		t.Run(n, func(t *testing.T) {
 			t.Parallel()
 
diff --git a/command/commands_windows.go b/command/commands_windows.go
index 016a2d2cb50..ff2c6a265b5 100644
--- a/command/commands_windows.go
+++ b/command/commands_windows.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build windows
diff --git a/command/config.go b/command/config.go
deleted file mode 100644
index 9a5ee7ac570..00000000000
--- a/command/config.go
+++ /dev/null
@@ -1,57 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package command
-
-import (
-	"github.com/hashicorp/vault/command/config"
-)
-
-const (
-	// DefaultConfigPath is the default path to the configuration file
-	DefaultConfigPath = "~/.vault"
-
-	// ConfigPathEnv is the environment variable that can be used to
-	// override where the Vault configuration is.
-	ConfigPathEnv = "VAULT_CONFIG_PATH"
-)
-
-// Config is the CLI configuration for Vault that can be specified via
-// a `$HOME/.vault` file which is HCL-formatted (therefore HCL or JSON).
-type DefaultConfig struct {
-	// TokenHelper is the executable/command that is executed for storing
-	// and retrieving the authentication token for the Vault CLI. If this
-	// is not specified, then vault's internal token store will be used, which
-	// stores the token on disk unencrypted.
-	TokenHelper string `hcl:"token_helper"`
-}
-
-// Config loads the configuration and returns it. If the configuration
-// is already loaded, it is returned.
-//
-// Config just calls into config.Config for backwards compatibility purposes.
-// Use config.Config instead.
-func Config() (*DefaultConfig, error) {
-	conf, err := config.Config()
-	return (*DefaultConfig)(conf), err
-}
-
-// LoadConfig reads the configuration from the given path. If path is
-// empty, then the default path will be used, or the environment variable
-// if set.
-//
-// LoadConfig just calls into config.LoadConfig for backwards compatibility
-// purposes. Use config.LoadConfig instead.
-func LoadConfig(path string) (*DefaultConfig, error) {
-	conf, err := config.LoadConfig(path)
-	return (*DefaultConfig)(conf), err
-}
-
-// ParseConfig parses the given configuration as a string.
-//
-// ParseConfig just calls into config.ParseConfig for backwards compatibility
-// purposes. Use config.ParseConfig instead.
-func ParseConfig(contents string) (*DefaultConfig, error) {
-	conf, err := config.ParseConfig(contents)
-	return (*DefaultConfig)(conf), err
-}
diff --git a/command/config/config.go b/command/config/config.go
deleted file mode 100644
index 4421226f24c..00000000000
--- a/command/config/config.go
+++ /dev/null
@@ -1,103 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package config
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-
-	"github.com/hashicorp/hcl"
-	"github.com/hashicorp/hcl/hcl/ast"
-	"github.com/hashicorp/vault/sdk/helper/hclutil"
-	homedir "github.com/mitchellh/go-homedir"
-)
-
-const (
-	// DefaultConfigPath is the default path to the configuration file
-	DefaultConfigPath = "~/.vault"
-
-	// ConfigPathEnv is the environment variable that can be used to
-	// override where the Vault configuration is.
-	ConfigPathEnv = "VAULT_CONFIG_PATH"
-)
-
-// Config is the CLI configuration for Vault that can be specified via
-// a `$HOME/.vault` file which is HCL-formatted (therefore HCL or JSON).
-type DefaultConfig struct {
-	// TokenHelper is the executable/command that is executed for storing
-	// and retrieving the authentication token for the Vault CLI. If this
-	// is not specified, then vault's internal token store will be used, which
-	// stores the token on disk unencrypted.
-	TokenHelper string `hcl:"token_helper"`
-}
-
-// Config loads the configuration and returns it. If the configuration
-// is already loaded, it is returned.
-func Config() (*DefaultConfig, error) {
-	var err error
-	config, err := LoadConfig("")
-	if err != nil {
-		return nil, err
-	}
-
-	return config, nil
-}
-
-// LoadConfig reads the configuration from the given path. If path is
-// empty, then the default path will be used, or the environment variable
-// if set.
-func LoadConfig(path string) (*DefaultConfig, error) {
-	if path == "" {
-		path = DefaultConfigPath
-	}
-	if v := os.Getenv(ConfigPathEnv); v != "" {
-		path = v
-	}
-
-	// NOTE: requires HOME env var to be set
-	path, err := homedir.Expand(path)
-	if err != nil {
-		return nil, fmt.Errorf("error expanding config path %q: %w", path, err)
-	}
-
-	contents, err := ioutil.ReadFile(path)
-	if err != nil && !os.IsNotExist(err) {
-		return nil, err
-	}
-
-	conf, err := ParseConfig(string(contents))
-	if err != nil {
-		return nil, fmt.Errorf("error parsing config file at %q: %w; ensure that the file is valid; Ansible Vault is known to conflict with it.", path, err)
-	}
-
-	return conf, nil
-}
-
-// ParseConfig parses the given configuration as a string.
-func ParseConfig(contents string) (*DefaultConfig, error) {
-	root, err := hcl.Parse(contents)
-	if err != nil {
-		return nil, err
-	}
-
-	// Top-level item should be the object list
-	list, ok := root.Node.(*ast.ObjectList)
-	if !ok {
-		return nil, fmt.Errorf("failed to parse config; does not contain a root object")
-	}
-
-	valid := []string{
-		"token_helper",
-	}
-	if err := hclutil.CheckHCLKeys(list, valid); err != nil {
-		return nil, err
-	}
-
-	var c DefaultConfig
-	if err := hcl.DecodeObject(&c, list); err != nil {
-		return nil, err
-	}
-	return &c, nil
-}
diff --git a/command/config/config_test.go b/command/config/config_test.go
deleted file mode 100644
index 04cb1be9863..00000000000
--- a/command/config/config_test.go
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package config
-
-import (
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-const FixturePath = "../test-fixtures"
-
-func TestLoadConfig(t *testing.T) {
-	config, err := LoadConfig(filepath.Join(FixturePath, "config.hcl"))
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	expected := &DefaultConfig{
-		TokenHelper: "foo",
-	}
-	if !reflect.DeepEqual(expected, config) {
-		t.Fatalf("bad: %#v", config)
-	}
-}
-
-func TestLoadConfig_noExist(t *testing.T) {
-	config, err := LoadConfig("nope/not-once/.never")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if config.TokenHelper != "" {
-		t.Errorf("expected %q to be %q", config.TokenHelper, "")
-	}
-}
-
-func TestParseConfig_badKeys(t *testing.T) {
-	_, err := ParseConfig(`
-token_helper = "/token"
-nope = "true"
-`)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-
-	if !strings.Contains(err.Error(), `invalid key "nope" on line 3`) {
-		t.Errorf("bad error: %s", err.Error())
-	}
-}
diff --git a/command/config/hcp_token.go b/command/config/hcp_token.go
index 58bc7832e21..b18b5ad1360 100644
--- a/command/config/hcp_token.go
+++ b/command/config/hcp_token.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package config
diff --git a/command/config/util.go b/command/config/util.go
deleted file mode 100644
index 3c6f7ca6239..00000000000
--- a/command/config/util.go
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package config
-
-import (
-	"github.com/hashicorp/vault/command/token"
-)
-
-// DefaultTokenHelper returns the token helper that is configured for Vault.
-// This helper should only be used for non-server CLI commands.
-func DefaultTokenHelper() (token.TokenHelper, error) {
-	config, err := LoadConfig("")
-	if err != nil {
-		return nil, err
-	}
-
-	path := config.TokenHelper
-	if path == "" {
-		return token.NewInternalTokenHelper()
-	}
-
-	path, err = token.ExternalTokenHelperPath(path)
-	if err != nil {
-		return nil, err
-	}
-	return &token.ExternalTokenHelper{BinaryPath: path}, nil
-}
diff --git a/command/config/validate_listener.go b/command/config/validate_listener.go
deleted file mode 100644
index 09123bdc75b..00000000000
--- a/command/config/validate_listener.go
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-//go:build !fips_140_3
-
-package config
-
-import "github.com/hashicorp/vault/internalshared/configutil"
-
-func IsValidListener(listener *configutil.Listener) error {
-	return nil
-}
diff --git a/command/config_test.go b/command/config_test.go
deleted file mode 100644
index 187d4ce8b4b..00000000000
--- a/command/config_test.go
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package command
-
-import (
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-const FixturePath = "./test-fixtures"
-
-func TestLoadConfig(t *testing.T) {
-	config, err := LoadConfig(filepath.Join(FixturePath, "config.hcl"))
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	expected := &DefaultConfig{
-		TokenHelper: "foo",
-	}
-	if !reflect.DeepEqual(expected, config) {
-		t.Fatalf("bad: %#v", config)
-	}
-}
-
-func TestLoadConfig_noExist(t *testing.T) {
-	config, err := LoadConfig("nope/not-once/.never")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if config.TokenHelper != "" {
-		t.Errorf("expected %q to be %q", config.TokenHelper, "")
-	}
-}
-
-func TestParseConfig_badKeys(t *testing.T) {
-	_, err := ParseConfig(`
-token_helper = "/token"
-nope = "true"
-`)
-	if err == nil {
-		t.Fatal("expected error")
-	}
-
-	if !strings.Contains(err.Error(), `invalid key "nope" on line 3`) {
-		t.Errorf("bad error: %s", err.Error())
-	}
-}
diff --git a/command/debug.go b/command/debug.go
index 09df88fb4d6..9ae21c5865c 100644
--- a/command/debug.go
+++ b/command/debug.go
@@ -1,13 +1,15 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
 
 import (
+	"archive/tar"
+	"compress/gzip"
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -23,10 +25,10 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/helper/osutil"
+	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/version"
-	"github.com/mholt/archiver/v3"
 	"github.com/oklog/run"
 	"github.com/posener/complete"
 )
@@ -210,7 +212,7 @@ Usage: vault debug [options]
   output. The command uses the Vault address and token as specified via
   the login command, environment variables, or CLI flags.
 
-  To create a debug package using default duration and interval values in the 
+  To create a debug package using default duration and interval values in the
   current directory that captures all applicable targets:
 
   $ vault debug
@@ -374,7 +376,7 @@ func (c *DebugCommand) generateIndex() error {
 	}
 
 	// Write out file
-	if err := ioutil.WriteFile(filepath.Join(c.flagOutput, "index.json"), bytes, 0o600); err != nil {
+	if err := os.WriteFile(filepath.Join(c.flagOutput, "index.json"), bytes, 0o600); err != nil {
 		return fmt.Errorf("error generating index file; %s", err)
 	}
 
@@ -494,7 +496,7 @@ func (c *DebugCommand) preflight(rawArgs []string) (string, error) {
 
 	// Populate initial index fields
 	c.debugIndex = &debugIndex{
-		VaultAddress:           client.Address(),
+		VaultAddress:           configutil.NormalizeAddr(client.Address()),
 		ClientVersion:          version.GetVersion().VersionNumber(),
 		ServerVersion:          serverHealth.Version,
 		Compress:               c.flagCompress,
@@ -687,17 +689,18 @@ func (c *DebugCommand) collectHostInfo(ctx context.Context) {
 			return
 		}
 		if resp != nil {
-			defer resp.Body.Close()
-
 			secret, err := api.ParseSecret(resp.Body)
 			if err != nil {
 				c.captureError("host", err)
+				resp.Body.Close()
 				return
 			}
 			if secret != nil && secret.Data != nil {
 				hostEntry := secret.Data
 				c.hostInfoCollection = append(c.hostInfoCollection, hostEntry)
 			}
+
+			resp.Body.Close()
 		}
 	}
 }
@@ -777,7 +780,7 @@ func (c *DebugCommand) collectPprof(ctx context.Context) {
 					return
 				}
 
-				err = ioutil.WriteFile(filepath.Join(dirName, target+".prof"), data, 0o600)
+				err = os.WriteFile(filepath.Join(dirName, target+".prof"), data, 0o600)
 				if err != nil {
 					c.captureError("pprof."+target, err)
 				}
@@ -795,13 +798,13 @@ func (c *DebugCommand) collectPprof(ctx context.Context) {
 				return
 			}
 
-			err = ioutil.WriteFile(filepath.Join(dirName, "goroutines.txt"), data, 0o600)
+			err = os.WriteFile(filepath.Join(dirName, "goroutines.txt"), data, 0o600)
 			if err != nil {
 				c.captureError("pprof.goroutines-text", err)
 			}
 		}()
 
-		// If the our remaining duration is less than the interval value
+		// If our remaining duration is less than the interval value
 		// skip profile and trace.
 		runDuration := currentTimestamp.Sub(startTime)
 		if (c.flagDuration+debugDurationGrace)-runDuration < c.flagInterval {
@@ -819,7 +822,7 @@ func (c *DebugCommand) collectPprof(ctx context.Context) {
 				return
 			}
 
-			err = ioutil.WriteFile(filepath.Join(dirName, "profile.prof"), data, 0o600)
+			err = os.WriteFile(filepath.Join(dirName, "profile.prof"), data, 0o600)
 			if err != nil {
 				c.captureError("pprof.profile", err)
 			}
@@ -835,7 +838,7 @@ func (c *DebugCommand) collectPprof(ctx context.Context) {
 				return
 			}
 
-			err = ioutil.WriteFile(filepath.Join(dirName, "trace.out"), data, 0o600)
+			err = os.WriteFile(filepath.Join(dirName, "trace.out"), data, 0o600)
 			if err != nil {
 				c.captureError("pprof.trace", err)
 			}
@@ -971,7 +974,7 @@ func (c *DebugCommand) persistCollection(collection []map[string]interface{}, ou
 	if err != nil {
 		return err
 	}
-	if err := ioutil.WriteFile(filepath.Join(c.flagOutput, outFile), bytes, 0o600); err != nil {
+	if err := os.WriteFile(filepath.Join(c.flagOutput, outFile), bytes, 0o600); err != nil {
 		return err
 	}
 
@@ -983,14 +986,100 @@ func (c *DebugCommand) compress(dst string) error {
 		defer osutil.Umask(osutil.Umask(0o077))
 	}
 
-	tgz := archiver.NewTarGz()
-	if err := tgz.Archive([]string{c.flagOutput}, dst); err != nil {
-		return fmt.Errorf("failed to compress data: %s", err)
+	if err := archiveToTgz(c.flagOutput, dst); err != nil {
+		return fmt.Errorf("failed to compress data: %w", err)
 	}
 
 	// If everything is fine up to this point, remove original directory
 	if err := os.RemoveAll(c.flagOutput); err != nil {
-		return fmt.Errorf("failed to remove data directory: %s", err)
+		return fmt.Errorf("failed to remove data directory: %w", err)
+	}
+
+	return nil
+}
+
+// archiveToTgz compresses all the files in sourceDir to a
+// a tarball at destination.
+func archiveToTgz(sourceDir, destination string) error {
+	file, err := os.Create(destination)
+	if err != nil {
+		return fmt.Errorf("failed to create file: %w", err)
+	}
+	defer file.Close()
+
+	gzipWriter := gzip.NewWriter(file)
+	defer gzipWriter.Close()
+
+	tarWriter := tar.NewWriter(gzipWriter)
+	defer tarWriter.Close()
+
+	err = filepath.Walk(sourceDir,
+		func(filePath string, info os.FileInfo, err error) error {
+			if err != nil {
+				return err
+			}
+			return addFileToTar(sourceDir, filePath, tarWriter)
+		})
+
+	return err
+}
+
+// addFileToTar takes a file at filePath and adds it to the tar
+// being written to by tarWriter, alongside its header.
+// The tar header name will be relative. Example: If we're tarring
+// a file in ~/a/b/c/foo/bar.json, the header name will be foo/bar.json
+func addFileToTar(sourceDir, filePath string, tarWriter *tar.Writer) error {
+	file, err := os.Open(filePath)
+	if err != nil {
+		return fmt.Errorf("failed to open file %q: %w", filePath, err)
+	}
+	defer file.Close()
+
+	stat, err := file.Stat()
+	if err != nil {
+		return fmt.Errorf("failed to stat file %q: %w", filePath, err)
+	}
+
+	var link string
+	mode := stat.Mode()
+	if mode&os.ModeSymlink != 0 {
+		if link, err = os.Readlink(filePath); err != nil {
+			return fmt.Errorf("failed to read symlink for file %q: %w", filePath, err)
+		}
+	}
+	tarHeader, err := tar.FileInfoHeader(stat, link)
+	if err != nil {
+		return fmt.Errorf("failed to create tar header for file %q: %w", filePath, err)
+	}
+
+	// The tar header name should be relative, so remove the sourceDir from it,
+	// but preserve the last directory name.
+	// Example: If we're tarring a file in ~/a/b/c/foo/bar.json
+	// The name should be foo/bar.json
+	sourceDirExceptLastDir := filepath.Dir(sourceDir)
+	headerName := strings.TrimPrefix(filepath.Clean(filePath), filepath.Clean(sourceDirExceptLastDir)+"/")
+
+	// Directories should end with a slash.
+	if stat.IsDir() && !strings.HasSuffix(headerName, "/") {
+		headerName += "/"
+	}
+	tarHeader.Name = headerName
+
+	err = tarWriter.WriteHeader(tarHeader)
+	if err != nil {
+		return fmt.Errorf("failed to write tar header for file %q: %w", filePath, err)
+	}
+
+	// If it's not a regular file (e.g. link or directory) we shouldn't
+	// copy the file. The body of a tar entry (i.e. what's done by the
+	// below io.Copy call) is only required for tar files of TypeReg.
+	if tarHeader.Typeflag != tar.TypeReg {
+		return nil
+	}
+
+	_, err = io.Copy(tarWriter, file)
+	if err != nil {
+		return fmt.Errorf("failed to copy file %q into tarball: %w", filePath, err)
 	}
 
 	return nil
@@ -1007,7 +1096,7 @@ func pprofTarget(ctx context.Context, client *api.Client, target string, params
 	}
 	defer resp.Body.Close()
 
-	data, err := ioutil.ReadAll(resp.Body)
+	data, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
@@ -1027,7 +1116,7 @@ func pprofProfile(ctx context.Context, client *api.Client, duration time.Duratio
 	}
 	defer resp.Body.Close()
 
-	data, err := ioutil.ReadAll(resp.Body)
+	data, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
@@ -1047,7 +1136,7 @@ func pprofTrace(ctx context.Context, client *api.Client, duration time.Duration)
 	}
 	defer resp.Body.Close()
 
-	data, err := ioutil.ReadAll(resp.Body)
+	data, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
diff --git a/command/debug_test.go b/command/debug_test.go
index 279c48f0a5a..484df40227a 100644
--- a/command/debug_test.go
+++ b/command/debug_test.go
@@ -1,13 +1,14 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
 
 import (
 	"archive/tar"
+	"compress/gzip"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -18,7 +19,7 @@ import (
 
 	"github.com/hashicorp/cli"
 	"github.com/hashicorp/vault/api"
-	"github.com/mholt/archiver/v3"
+	"github.com/stretchr/testify/require"
 )
 
 func testDebugCommand(tb testing.TB) (*cli.MockUi, *DebugCommand) {
@@ -35,11 +36,7 @@ func testDebugCommand(tb testing.TB) (*cli.MockUi, *DebugCommand) {
 func TestDebugCommand_Run(t *testing.T) {
 	t.Parallel()
 
-	testDir, err := ioutil.TempDir("", "vault-debug")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(testDir)
+	testDir := t.TempDir()
 
 	cases := []struct {
 		name string
@@ -104,6 +101,54 @@ func TestDebugCommand_Run(t *testing.T) {
 	}
 }
 
+// expectHeaderNamesInTarGzFile asserts that the expectedHeaderNames
+// match exactly to the header names in the tar.gz file at tarballPath.
+// Will error if there are more or less than expected.
+// ignoreUnexpectedHeaders toggles ignoring the presence of headers not
+// in expectedHeaderNames.
+func expectHeaderNamesInTarGzFile(t *testing.T, tarballPath string, expectedHeaderNames []string, ignoreUnexpectedHeaders bool) {
+	t.Helper()
+
+	file, err := os.Open(tarballPath)
+	require.NoError(t, err)
+
+	uncompressedStream, err := gzip.NewReader(file)
+	require.NoError(t, err)
+
+	tarReader := tar.NewReader(uncompressedStream)
+	headersFoundMap := make(map[string]any)
+
+	for {
+		header, err := tarReader.Next()
+		if err == io.EOF {
+			// We're at the end of the tar.
+			break
+		}
+		require.NoError(t, err)
+
+		// Ignore directories.
+		if header.Typeflag == tar.TypeDir {
+			continue
+		}
+
+		for _, name := range expectedHeaderNames {
+			if header.Name == name {
+				headersFoundMap[header.Name] = struct{}{}
+			}
+		}
+		if _, ok := headersFoundMap[header.Name]; !ok && !ignoreUnexpectedHeaders {
+			t.Fatalf("unexpected file: %s", header.Name)
+		}
+	}
+
+	// Expect that every expectedHeader was found at some point
+	for _, name := range expectedHeaderNames {
+		if _, ok := headersFoundMap[name]; !ok {
+			t.Fatalf("missing header from tar: %s", name)
+		}
+	}
+}
+
 func TestDebugCommand_Archive(t *testing.T) {
 	t.Parallel()
 
@@ -137,11 +182,7 @@ func TestDebugCommand_Archive(t *testing.T) {
 
 			// Create temp dirs for each test case since os.Stat and tgz.Walk
 			// (called down below) exhibits raciness otherwise.
-			testDir, err := ioutil.TempDir("", "vault-debug")
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer os.RemoveAll(testDir)
+			testDir := t.TempDir()
 
 			client, closer := testVaultServer(t)
 			defer closer()
@@ -177,32 +218,14 @@ func TestDebugCommand_Archive(t *testing.T) {
 			}
 
 			bundlePath := filepath.Join(testDir, basePath+expectedExt)
-			_, err = os.Stat(bundlePath)
+			_, err := os.Stat(bundlePath)
 			if os.IsNotExist(err) {
 				t.Log(ui.OutputWriter.String())
 				t.Fatal(err)
 			}
 
-			tgz := archiver.NewTarGz()
-			err = tgz.Walk(bundlePath, func(f archiver.File) error {
-				fh, ok := f.Header.(*tar.Header)
-				if !ok {
-					return fmt.Errorf("invalid file header: %#v", f.Header)
-				}
-
-				// Ignore base directory and index file
-				if fh.Name == basePath+"/" || fh.Name == filepath.Join(basePath, "index.json") {
-					return nil
-				}
-
-				if fh.Name != filepath.Join(basePath, "server_status.json") {
-					return fmt.Errorf("unexpected file: %s", fh.Name)
-				}
-				return nil
-			})
-			if err != nil {
-				t.Fatal(err)
-			}
+			expectedHeaders := []string{filepath.Join(basePath, "index.json"), filepath.Join(basePath, "server_status.json")}
+			expectHeaderNamesInTarGzFile(t, bundlePath, expectedHeaders, false)
 		})
 	}
 }
@@ -258,11 +281,7 @@ func TestDebugCommand_CaptureTargets(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			testDir, err := ioutil.TempDir("", "vault-debug")
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer os.RemoveAll(testDir)
+			testDir := t.TempDir()
 
 			client, closer := testVaultServer(t)
 			defer closer()
@@ -287,45 +306,22 @@ func TestDebugCommand_CaptureTargets(t *testing.T) {
 			}
 
 			bundlePath := filepath.Join(testDir, basePath+debugCompressionExt)
-			_, err = os.Open(bundlePath)
+			_, err := os.Open(bundlePath)
 			if err != nil {
 				t.Fatalf("failed to open archive: %s", err)
 			}
 
-			tgz := archiver.NewTarGz()
-			err = tgz.Walk(bundlePath, func(f archiver.File) error {
-				fh, ok := f.Header.(*tar.Header)
-				if !ok {
-					t.Fatalf("invalid file header: %#v", f.Header)
-				}
-
-				// Ignore base directory and index file
-				if fh.Name == basePath+"/" || fh.Name == filepath.Join(basePath, "index.json") {
-					return nil
-				}
-
-				for _, fileName := range tc.expectedFiles {
-					if fh.Name == filepath.Join(basePath, fileName) {
-						return nil
-					}
-				}
-
-				// If we reach here, it means that this is an unexpected file
-				return fmt.Errorf("unexpected file: %s", fh.Name)
-			})
-			if err != nil {
-				t.Fatal(err)
+			expectedHeaders := []string{filepath.Join(basePath, "index.json")}
+			for _, fileName := range tc.expectedFiles {
+				expectedHeaders = append(expectedHeaders, filepath.Join(basePath, fileName))
 			}
+			expectHeaderNamesInTarGzFile(t, bundlePath, expectedHeaders, false)
 		})
 	}
 }
 
 func TestDebugCommand_Pprof(t *testing.T) {
-	testDir, err := ioutil.TempDir("", "vault-debug")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(testDir)
+	testDir := t.TempDir()
 
 	client, closer := testVaultServer(t)
 	defer closer()
@@ -379,11 +375,7 @@ func TestDebugCommand_Pprof(t *testing.T) {
 func TestDebugCommand_IndexFile(t *testing.T) {
 	t.Parallel()
 
-	testDir, err := ioutil.TempDir("", "vault-debug")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(testDir)
+	testDir := t.TempDir()
 
 	client, closer := testVaultServer(t)
 	defer closer()
@@ -409,7 +401,7 @@ func TestDebugCommand_IndexFile(t *testing.T) {
 		t.Fatalf("expected %d to be %d", code, exp)
 	}
 
-	content, err := ioutil.ReadFile(filepath.Join(outputPath, "index.json"))
+	content, err := os.ReadFile(filepath.Join(outputPath, "index.json"))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -426,11 +418,7 @@ func TestDebugCommand_IndexFile(t *testing.T) {
 func TestDebugCommand_TimingChecks(t *testing.T) {
 	t.Parallel()
 
-	testDir, err := ioutil.TempDir("", "vault-debug")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(testDir)
+	testDir := t.TempDir()
 
 	cases := []struct {
 		name            string
@@ -585,11 +573,7 @@ func TestDebugCommand_OutputExists(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			testDir, err := ioutil.TempDir("", "vault-debug")
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer os.RemoveAll(testDir)
+			testDir := t.TempDir()
 
 			client, closer := testVaultServer(t)
 			defer closer()
@@ -602,12 +586,12 @@ func TestDebugCommand_OutputExists(t *testing.T) {
 
 			// Create a conflicting file/directory
 			if tc.compress {
-				_, err = os.Create(outputPath)
+				_, err := os.Create(outputPath)
 				if err != nil {
 					t.Fatal(err)
 				}
 			} else {
-				err = os.Mkdir(outputPath, 0o700)
+				err := os.Mkdir(outputPath, 0o700)
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -639,11 +623,7 @@ func TestDebugCommand_OutputExists(t *testing.T) {
 func TestDebugCommand_PartialPermissions(t *testing.T) {
 	t.Parallel()
 
-	testDir, err := ioutil.TempDir("", "vault-debug")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(testDir)
+	testDir := t.TempDir()
 
 	client, closer := testVaultServer(t)
 	defer closer()
@@ -680,38 +660,14 @@ func TestDebugCommand_PartialPermissions(t *testing.T) {
 		t.Fatalf("failed to open archive: %s", err)
 	}
 
-	tgz := archiver.NewTarGz()
-	err = tgz.Walk(bundlePath, func(f archiver.File) error {
-		fh, ok := f.Header.(*tar.Header)
-		if !ok {
-			t.Fatalf("invalid file header: %#v", f.Header)
-		}
-
-		// Ignore base directory and index file
-		if fh.Name == basePath+"/" {
-			return nil
-		}
-
-		// Ignore directories, which still get created by pprof but should
-		// otherwise be empty.
-		if fh.FileInfo().IsDir() {
-			return nil
-		}
-
-		switch {
-		case fh.Name == filepath.Join(basePath, "index.json"):
-		case fh.Name == filepath.Join(basePath, "replication_status.json"):
-		case fh.Name == filepath.Join(basePath, "server_status.json"):
-		case fh.Name == filepath.Join(basePath, "vault.log"):
-		default:
-			return fmt.Errorf("unexpected file: %s", fh.Name)
-		}
-
-		return nil
-	})
-	if err != nil {
-		t.Fatal(err)
+	expectedHeaders := []string{
+		filepath.Join(basePath, "index.json"), filepath.Join(basePath, "server_status.json"),
+		filepath.Join(basePath, "vault.log"),
 	}
+
+	// We set ignoreUnexpectedHeaders to true as replication_status.json is only sometimes
+	// produced. Relying on it being or not being there would be racy.
+	expectHeaderNamesInTarGzFile(t, bundlePath, expectedHeaders, true)
 }
 
 // set insecure umask to see if the files and directories get created with right permissions
@@ -748,11 +704,7 @@ func TestDebugCommand_InsecureUmask(t *testing.T) {
 			// set insecure umask
 			defer syscall.Umask(syscall.Umask(0))
 
-			testDir, err := ioutil.TempDir("", "vault-debug")
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer os.RemoveAll(testDir)
+			testDir := t.TempDir()
 
 			client, closer := testVaultServer(t)
 			defer closer()
@@ -790,39 +742,39 @@ func TestDebugCommand_InsecureUmask(t *testing.T) {
 			// check permissions of the parent debug directory
 			err = isValidFilePermissions(fs)
 			if err != nil {
-				t.Fatalf(err.Error())
+				t.Fatal(err.Error())
 			}
 
 			// check permissions of the files within the parent directory
 			switch tc.compress {
 			case true:
-				tgz := archiver.NewTarGz()
+				file, err := os.Open(bundlePath)
+				require.NoError(t, err)
 
-				err = tgz.Walk(bundlePath, func(f archiver.File) error {
-					fh, ok := f.Header.(*tar.Header)
-					if !ok {
-						return fmt.Errorf("invalid file header: %#v", f.Header)
-					}
-					err = isValidFilePermissions(fh.FileInfo())
-					if err != nil {
-						t.Fatalf(err.Error())
-					}
-					return nil
-				})
+				uncompressedStream, err := gzip.NewReader(file)
+				require.NoError(t, err)
+
+				tarReader := tar.NewReader(uncompressedStream)
 
+				for {
+					header, err := tarReader.Next()
+					if err == io.EOF {
+						break
+					}
+					err = isValidFilePermissions(header.FileInfo())
+					require.NoError(t, err)
+				}
 			case false:
 				err = filepath.Walk(bundlePath, func(path string, info os.FileInfo, err error) error {
 					err = isValidFilePermissions(info)
 					if err != nil {
-						t.Fatalf(err.Error())
+						t.Fatal(err.Error())
 					}
 					return nil
 				})
 			}
 
-			if err != nil {
-				t.Fatal(err)
-			}
+			require.NoError(t, err)
 		})
 	}
 }
diff --git a/command/delete.go b/command/delete.go
index 6986a84ec34..750c541214a 100644
--- a/command/delete.go
+++ b/command/delete.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/delete_test.go b/command/delete_test.go
index 6da1d1d7fa9..0c1a8912c8e 100644
--- a/command/delete_test.go
+++ b/command/delete_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/events.go b/command/events.go
index 48f1fdd2268..3986db3f59c 100644
--- a/command/events.go
+++ b/command/events.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -11,10 +11,10 @@ import (
 	"os"
 	"strings"
 
+	"github.com/coder/websocket"
 	"github.com/hashicorp/cli"
 	"github.com/hashicorp/vault/api"
 	"github.com/posener/complete"
-	"nhooyr.io/websocket"
 )
 
 var (
diff --git a/command/events_test.go b/command/events_test.go
index dfeb12d706b..1b0fcb319c3 100644
--- a/command/events_test.go
+++ b/command/events_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/format.go b/command/format.go
index 548a9a089c8..75d0753ef78 100644
--- a/command/format.go
+++ b/command/format.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -357,6 +357,10 @@ func (t TableFormatter) OutputSealStatusStruct(ui cli.Ui, secret *api.Secret, da
 		out = append(out, fmt.Sprintf("Cluster ID | %s", status.ClusterID))
 	}
 
+	if status.RemovedFromCluster != nil {
+		out = append(out, fmt.Sprintf("Removed From Cluster | %t", *status.RemovedFromCluster))
+	}
+
 	// Output if HCP link is configured
 	if status.HCPLinkStatus != "" {
 		out = append(out, fmt.Sprintf("HCP Link Status | %s", status.HCPLinkStatus))
diff --git a/command/format_test.go b/command/format_test.go
index 77093a3e29b..4a07050f3e1 100644
--- a/command/format_test.go
+++ b/command/format_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/generaterootkind_enumer.go b/command/generaterootkind_enumer.go
new file mode 100644
index 00000000000..a53d2846de8
--- /dev/null
+++ b/command/generaterootkind_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=generateRootKind -trimprefix=generateRoot"; DO NOT EDIT.
+
+package command
+
+import (
+	"fmt"
+)
+
+const _generateRootKindName = "RegularDRRecovery"
+
+var _generateRootKindIndex = [...]uint8{0, 7, 9, 17}
+
+func (i generateRootKind) String() string {
+	if i < 0 || i >= generateRootKind(len(_generateRootKindIndex)-1) {
+		return fmt.Sprintf("generateRootKind(%d)", i)
+	}
+	return _generateRootKindName[_generateRootKindIndex[i]:_generateRootKindIndex[i+1]]
+}
+
+var _generateRootKindValues = []generateRootKind{0, 1, 2}
+
+var _generateRootKindNameToValueMap = map[string]generateRootKind{
+	_generateRootKindName[0:7]:  0,
+	_generateRootKindName[7:9]:  1,
+	_generateRootKindName[9:17]: 2,
+}
+
+// generateRootKindString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func generateRootKindString(s string) (generateRootKind, error) {
+	if val, ok := _generateRootKindNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to generateRootKind values", s)
+}
+
+// generateRootKindValues returns all values of the enum
+func generateRootKindValues() []generateRootKind {
+	return _generateRootKindValues
+}
+
+// IsAgenerateRootKind returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i generateRootKind) IsAgenerateRootKind() bool {
+	for _, v := range _generateRootKindValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/command/healthcheck/healthcheck.go b/command/healthcheck/healthcheck.go
index 81829cdc1d7..3ba9686a3ad 100644
--- a/command/healthcheck/healthcheck.go
+++ b/command/healthcheck/healthcheck.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 /*
@@ -128,7 +128,7 @@ func (e *Executor) Execute() (map[string][]*Result, error) {
 
 		for _, result := range results {
 			result.Endpoint = e.templatePath(result.Endpoint)
-			result.StatusDisplay = ResultStatusNameMap[result.Status]
+			result.StatusDisplay = result.Status.String()
 		}
 
 		ret[checker.Name()] = results
@@ -252,6 +252,7 @@ type Check interface {
 	Evaluate(e *Executor) ([]*Result, error)
 }
 
+//go:generate enumer -type=ResultStatus -trimprefix=Result -transform=snake
 type ResultStatus int
 
 const (
@@ -264,16 +265,6 @@ const (
 	ResultInsufficientPermissions
 )
 
-var ResultStatusNameMap = map[ResultStatus]string{
-	ResultNotApplicable:           "not_applicable",
-	ResultOK:                      "ok",
-	ResultInformational:           "informational",
-	ResultWarning:                 "warning",
-	ResultCritical:                "critical",
-	ResultInvalidVersion:          "invalid_version",
-	ResultInsufficientPermissions: "insufficient_permissions",
-}
-
 var NameResultStatusMap = map[string]ResultStatus{
 	"not_applicable":           ResultNotApplicable,
 	"ok":                       ResultOK,
diff --git a/command/healthcheck/pki.go b/command/healthcheck/pki.go
index 6522cdbc83a..ed8d0c24baf 100644
--- a/command/healthcheck/pki.go
+++ b/command/healthcheck/pki.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_allow_acme_headers.go b/command/healthcheck/pki_allow_acme_headers.go
index 186cc40af96..88a4b20bfaa 100644
--- a/command/healthcheck/pki_allow_acme_headers.go
+++ b/command/healthcheck/pki_allow_acme_headers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_allow_if_modified_since.go b/command/healthcheck/pki_allow_if_modified_since.go
index 38eaee9aab6..d33b7f7ac68 100644
--- a/command/healthcheck/pki_allow_if_modified_since.go
+++ b/command/healthcheck/pki_allow_if_modified_since.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_audit_visibility.go b/command/healthcheck/pki_audit_visibility.go
index e58543cb6f1..fb84a5de040 100644
--- a/command/healthcheck/pki_audit_visibility.go
+++ b/command/healthcheck/pki_audit_visibility.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_ca_validity_period.go b/command/healthcheck/pki_ca_validity_period.go
index d18e0881efc..ca07a58ff58 100644
--- a/command/healthcheck/pki_ca_validity_period.go
+++ b/command/healthcheck/pki_ca_validity_period.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
@@ -65,9 +65,8 @@ func (h *CAValidityPeriod) LoadConfig(config map[string]interface{}) error {
 		if len(name_split) != 3 || name_split[1] != "expiry" {
 			return fmt.Errorf("bad parameter: %v / %v / %v", parameter, len(name_split), name_split[1])
 		}
-
-		status, present := NameResultStatusMap[name_split[2]]
-		if !present {
+		status, err := ResultStatusString(name_split[2])
+		if err != nil {
 			return fmt.Errorf("bad parameter: %v's type %v isn't in name map", parameter, name_split[2])
 		}
 
diff --git a/command/healthcheck/pki_crl_validity_period.go b/command/healthcheck/pki_crl_validity_period.go
index ad591fa9fb7..5ed4e620733 100644
--- a/command/healthcheck/pki_crl_validity_period.go
+++ b/command/healthcheck/pki_crl_validity_period.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_enable_acme_issuance.go b/command/healthcheck/pki_enable_acme_issuance.go
index 990cc37e9d3..744da1cdc23 100644
--- a/command/healthcheck/pki_enable_acme_issuance.go
+++ b/command/healthcheck/pki_enable_acme_issuance.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_enable_auto_tidy.go b/command/healthcheck/pki_enable_auto_tidy.go
index d8a43ba0a60..f3d7ce2c9db 100644
--- a/command/healthcheck/pki_enable_auto_tidy.go
+++ b/command/healthcheck/pki_enable_auto_tidy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_hardware_backed_root.go b/command/healthcheck/pki_hardware_backed_root.go
index 7fbe306ee74..bdb02293b7b 100644
--- a/command/healthcheck/pki_hardware_backed_root.go
+++ b/command/healthcheck/pki_hardware_backed_root.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_role_allows_glob_wildcards.go b/command/healthcheck/pki_role_allows_glob_wildcards.go
index f3edd8bd8a1..48e29ffae85 100644
--- a/command/healthcheck/pki_role_allows_glob_wildcards.go
+++ b/command/healthcheck/pki_role_allows_glob_wildcards.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_role_allows_localhost.go b/command/healthcheck/pki_role_allows_localhost.go
index aec00dc7942..689f216a204 100644
--- a/command/healthcheck/pki_role_allows_localhost.go
+++ b/command/healthcheck/pki_role_allows_localhost.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_role_no_store_false.go b/command/healthcheck/pki_role_no_store_false.go
index 94330cc1b8e..23b8ce6c226 100644
--- a/command/healthcheck/pki_role_no_store_false.go
+++ b/command/healthcheck/pki_role_no_store_false.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_root_issued_leaves.go b/command/healthcheck/pki_root_issued_leaves.go
index 85359b2e59a..cb649a43abb 100644
--- a/command/healthcheck/pki_root_issued_leaves.go
+++ b/command/healthcheck/pki_root_issued_leaves.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_tidy_last_run.go b/command/healthcheck/pki_tidy_last_run.go
index a699325cbeb..34f5c2668c0 100644
--- a/command/healthcheck/pki_tidy_last_run.go
+++ b/command/healthcheck/pki_tidy_last_run.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/pki_too_many_certs.go b/command/healthcheck/pki_too_many_certs.go
index f7873e640e0..b7df8ec02d7 100644
--- a/command/healthcheck/pki_too_many_certs.go
+++ b/command/healthcheck/pki_too_many_certs.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/resultstatus_enumer.go b/command/healthcheck/resultstatus_enumer.go
new file mode 100644
index 00000000000..eb8182cb4ac
--- /dev/null
+++ b/command/healthcheck/resultstatus_enumer.go
@@ -0,0 +1,54 @@
+// Code generated by "enumer -type=ResultStatus -trimprefix=Result -transform=snake"; DO NOT EDIT.
+
+package healthcheck
+
+import (
+	"fmt"
+)
+
+const _ResultStatusName = "not_applicableokinformationalwarningcriticalinvalid_versioninsufficient_permissions"
+
+var _ResultStatusIndex = [...]uint8{0, 14, 16, 29, 36, 44, 59, 83}
+
+func (i ResultStatus) String() string {
+	if i < 0 || i >= ResultStatus(len(_ResultStatusIndex)-1) {
+		return fmt.Sprintf("ResultStatus(%d)", i)
+	}
+	return _ResultStatusName[_ResultStatusIndex[i]:_ResultStatusIndex[i+1]]
+}
+
+var _ResultStatusValues = []ResultStatus{0, 1, 2, 3, 4, 5, 6}
+
+var _ResultStatusNameToValueMap = map[string]ResultStatus{
+	_ResultStatusName[0:14]:  0,
+	_ResultStatusName[14:16]: 1,
+	_ResultStatusName[16:29]: 2,
+	_ResultStatusName[29:36]: 3,
+	_ResultStatusName[36:44]: 4,
+	_ResultStatusName[44:59]: 5,
+	_ResultStatusName[59:83]: 6,
+}
+
+// ResultStatusString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func ResultStatusString(s string) (ResultStatus, error) {
+	if val, ok := _ResultStatusNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to ResultStatus values", s)
+}
+
+// ResultStatusValues returns all values of the enum
+func ResultStatusValues() []ResultStatus {
+	return _ResultStatusValues
+}
+
+// IsAResultStatus returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i ResultStatus) IsAResultStatus() bool {
+	for _, v := range _ResultStatusValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/command/healthcheck/shared.go b/command/healthcheck/shared.go
index 611b5337e61..97403cb4216 100644
--- a/command/healthcheck/shared.go
+++ b/command/healthcheck/shared.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/healthcheck/util.go b/command/healthcheck/util.go
index d8a7ba945e3..c10a7b9b365 100644
--- a/command/healthcheck/util.go
+++ b/command/healthcheck/util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package healthcheck
diff --git a/command/init_func_test.go b/command/init_func_test.go
new file mode 100644
index 00000000000..dd57d5b5bf3
--- /dev/null
+++ b/command/init_func_test.go
@@ -0,0 +1,12 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package command
+
+import "os"
+
+func init() {
+	if signed := os.Getenv("VAULT_LICENSE_CI"); signed != "" {
+		os.Setenv(EnvVaultLicense, signed)
+	}
+}
diff --git a/command/kv.go b/command/kv.go
index f17baf5d3ab..aca38f17c8a 100644
--- a/command/kv.go
+++ b/command/kv.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_delete.go b/command/kv_delete.go
index 67cc56ac4e7..d9359b88128 100644
--- a/command/kv_delete.go
+++ b/command/kv_delete.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_destroy.go b/command/kv_destroy.go
index 0299be4cea8..000e6e8546b 100644
--- a/command/kv_destroy.go
+++ b/command/kv_destroy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_enable_versioning.go b/command/kv_enable_versioning.go
index 921c286e3aa..179ffed06e9 100644
--- a/command/kv_enable_versioning.go
+++ b/command/kv_enable_versioning.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_get.go b/command/kv_get.go
index e31c8a32a5c..e953c415b8d 100644
--- a/command/kv_get.go
+++ b/command/kv_get.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_helpers.go b/command/kv_helpers.go
index ed3bc38118e..00e06a19b25 100644
--- a/command/kv_helpers.go
+++ b/command/kv_helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_helpers_test.go b/command/kv_helpers_test.go
index 06a1bb8ee9a..e03a0226d44 100644
--- a/command/kv_helpers_test.go
+++ b/command/kv_helpers_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_list.go b/command/kv_list.go
index 4e19d9d7ae3..582f1ad50e4 100644
--- a/command/kv_list.go
+++ b/command/kv_list.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_metadata.go b/command/kv_metadata.go
index 14e1b5bfa3a..e35da9ffc22 100644
--- a/command/kv_metadata.go
+++ b/command/kv_metadata.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_metadata_delete.go b/command/kv_metadata_delete.go
index 6f672fc6aea..50f882e6113 100644
--- a/command/kv_metadata_delete.go
+++ b/command/kv_metadata_delete.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_metadata_get.go b/command/kv_metadata_get.go
index 2722c330efe..b86e299c847 100644
--- a/command/kv_metadata_get.go
+++ b/command/kv_metadata_get.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_metadata_patch.go b/command/kv_metadata_patch.go
index ff59c12fb7c..7f93b970973 100644
--- a/command/kv_metadata_patch.go
+++ b/command/kv_metadata_patch.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_metadata_patch_test.go b/command/kv_metadata_patch_test.go
index 1dc0e123773..bb78d2bbe50 100644
--- a/command/kv_metadata_patch_test.go
+++ b/command/kv_metadata_patch_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_metadata_put.go b/command/kv_metadata_put.go
index 5b8124229de..6b3e4ad6784 100644
--- a/command/kv_metadata_put.go
+++ b/command/kv_metadata_put.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_metadata_put_test.go b/command/kv_metadata_put_test.go
index 50f815ac487..a6a558f8325 100644
--- a/command/kv_metadata_put_test.go
+++ b/command/kv_metadata_put_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_patch.go b/command/kv_patch.go
index 791273558e4..e32d886f053 100644
--- a/command/kv_patch.go
+++ b/command/kv_patch.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_put.go b/command/kv_put.go
index b51705791f5..1511d6d05b2 100644
--- a/command/kv_put.go
+++ b/command/kv_put.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_rollback.go b/command/kv_rollback.go
index d1f23caee05..75df18064d0 100644
--- a/command/kv_rollback.go
+++ b/command/kv_rollback.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_test.go b/command/kv_test.go
index c5ca555be6b..c6ba2bf3f34 100644
--- a/command/kv_test.go
+++ b/command/kv_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/kv_undelete.go b/command/kv_undelete.go
index 7d438387193..e3b368cf336 100644
--- a/command/kv_undelete.go
+++ b/command/kv_undelete.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/lease.go b/command/lease.go
index 3e0817ffd0d..a2cfa5fa9b8 100644
--- a/command/lease.go
+++ b/command/lease.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/lease_lookup.go b/command/lease_lookup.go
index 51b7aab6041..e6ec01a16ac 100644
--- a/command/lease_lookup.go
+++ b/command/lease_lookup.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/lease_lookup_test.go b/command/lease_lookup_test.go
index 2c9b81caf5f..f0829863d38 100644
--- a/command/lease_lookup_test.go
+++ b/command/lease_lookup_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/lease_renew.go b/command/lease_renew.go
index b0671c37968..0af191b331a 100644
--- a/command/lease_renew.go
+++ b/command/lease_renew.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/lease_renew_test.go b/command/lease_renew_test.go
index eac098fe463..31cd4f15ed1 100644
--- a/command/lease_renew_test.go
+++ b/command/lease_renew_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/lease_revoke.go b/command/lease_revoke.go
index 59a09de597e..594c03591d0 100644
--- a/command/lease_revoke.go
+++ b/command/lease_revoke.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/lease_revoke_test.go b/command/lease_revoke_test.go
index aeb9987e7dd..37e86389460 100644
--- a/command/lease_revoke_test.go
+++ b/command/lease_revoke_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/list.go b/command/list.go
index 6505f76af8c..0df6641113c 100644
--- a/command/list.go
+++ b/command/list.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"github.com/hashicorp/cli"
+	"github.com/hashicorp/vault/api"
 	"github.com/posener/complete"
 )
 
@@ -45,7 +46,7 @@ Usage: vault list [options] PATH
 }
 
 func (c *ListCommand) Flags() *FlagSets {
-	set := c.flagSet(FlagSetHTTP | FlagSetOutputFormat | FlagSetOutputDetailed)
+	set := c.flagSet(FlagSetHTTP | FlagSetOutputFormat | FlagSetOutputDetailed | FlagSetSnapshot)
 	return set
 }
 
@@ -82,7 +83,12 @@ func (c *ListCommand) Run(args []string) int {
 	}
 
 	path := sanitizePath(args[0])
-	secret, err := client.Logical().List(path)
+	var secret *api.Secret
+	if c.flagSnapshotID != "" {
+		secret, err = client.Logical().ListFromSnapshot(path, c.flagSnapshotID)
+	} else {
+		secret, err = client.Logical().List(path)
+	}
 	if err != nil {
 		c.UI.Error(fmt.Sprintf("Error listing %s: %s", path, err))
 		return 2
diff --git a/command/list_test.go b/command/list_test.go
index e7a870d7ffb..f311544ff1b 100644
--- a/command/list_test.go
+++ b/command/list_test.go
@@ -1,13 +1,17 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 
 	"github.com/hashicorp/cli"
+	"github.com/hashicorp/vault/api"
+	"github.com/stretchr/testify/require"
 )
 
 func testListCommand(tb testing.TB) (*cli.MockUi, *ListCommand) {
@@ -133,3 +137,32 @@ func TestListCommand_Run(t *testing.T) {
 		assertNoTabs(t, cmd)
 	})
 }
+
+// TestList_Snapshot tests that the read_snapshot_id query parameter is added
+// to the request when the -snapshot-id flag is used.
+func TestList_Snapshot(t *testing.T) {
+	t.Parallel()
+	mockVaultServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		snapID := r.URL.Query().Get("read_snapshot_id")
+		if snapID != "abcd" {
+			w.WriteHeader(http.StatusBadRequest)
+		}
+		w.Write([]byte(`{"data":{"keys":["foo","bar"]}}`))
+	}))
+	defer mockVaultServer.Close()
+
+	cfg := api.DefaultConfig()
+	cfg.Address = mockVaultServer.URL
+	client, err := api.NewClient(cfg)
+	require.NoError(t, err)
+
+	ui, cmd := testListCommand(t)
+	cmd.client = client
+
+	// a list command with a snapshot id shouldn't error
+	code := cmd.Run([]string{
+		"-snapshot-id", "abcd", "path/",
+	})
+	combined := ui.OutputWriter.String() + ui.ErrorWriter.String()
+	require.Equal(t, 0, code, combined)
+}
diff --git a/command/log_flags.go b/command/log_flags.go
index cbde95d3308..da02432aa5d 100644
--- a/command/log_flags.go
+++ b/command/log_flags.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/log_flags_test.go b/command/log_flags_test.go
index 1e54397f87f..435400339db 100644
--- a/command/log_flags_test.go
+++ b/command/log_flags_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/login.go b/command/login.go
index 6252b7219df..1e5f8c24781 100644
--- a/command/login.go
+++ b/command/login.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/login_test.go b/command/login_test.go
index 3f7c01d3c86..cc86bcd8116 100644
--- a/command/login_test.go
+++ b/command/login_test.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
 
 import (
 	"context"
+	"os"
 	"regexp"
 	"strings"
 	"testing"
@@ -15,8 +16,10 @@ import (
 	credToken "github.com/hashicorp/vault/builtin/credential/token"
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/command/token"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/helper/testhelpers"
 	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
 )
 
 // minTokenLengthExternal is the minimum size of SSC
@@ -613,3 +616,57 @@ func TestLoginMFATwoPhaseNonInteractiveMethodName(t *testing.T) {
 
 	validateFunc(methodName)
 }
+
+// TestLoginPrintsWarningOnDuplicateHclKeys ensures that a warning is printed when the token helper file contains
+// duplicate keys.
+func TestLoginPrintsWarningOnDuplicateHclKeys(t *testing.T) {
+	f, err := os.CreateTemp(t.TempDir(), ".vault")
+	f.WriteString(`
+token_helper = "/token"
+token_helper = ""
+`)
+	require.NoError(t, err)
+	t.Setenv("VAULT_CONFIG_PATH", f.Name())
+
+	client, closer := testVaultServer(t)
+	defer closer()
+
+	secret, err := client.Auth().Token().Create(&api.TokenCreateRequest{
+		Policies: []string{"default"},
+		TTL:      "30m",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	token := secret.Auth.ClientToken
+
+	t.Run("fail if duplicates are not allowed", func(t *testing.T) {
+		_, cmd := testLoginCommand(t)
+		cmd.tokenHelper = nil // cause default one to be used
+		cmd.client = client
+
+		code := cmd.Run([]string{
+			token,
+		})
+		if exp := 1; code != exp {
+			t.Errorf("expected %d to be %d", code, exp)
+		}
+	})
+
+	t.Run("succeed if duplicates are allowed", func(t *testing.T) {
+		t.Setenv(random.AllowHclDuplicatesEnvVar, "true")
+		ui, cmd := testLoginCommand(t)
+		cmd.tokenHelper = nil // cause default one to be used
+		cmd.client = client
+
+		code := cmd.Run([]string{
+			token,
+		})
+		if exp := 0; code != exp {
+			t.Errorf("expected %d to be %d", code, exp)
+		}
+
+		require.Contains(t, ui.ErrorWriter.String(),
+			"WARNING: Duplicate keys found in the Vault token helper configuration file, duplicate keys in HCL files are deprecated and will be forbidden in a future release.")
+	})
+}
diff --git a/command/main.go b/command/main.go
index d6fad4b6c9a..bda4e0475ba 100644
--- a/command/main.go
+++ b/command/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -18,7 +18,7 @@ import (
 	"github.com/hashicorp/cli"
 	hcpvlib "github.com/hashicorp/vault-hcp-lib"
 	"github.com/hashicorp/vault/api"
-	"github.com/hashicorp/vault/command/token"
+	"github.com/hashicorp/vault/api/tokenhelper"
 	"github.com/mattn/go-colorable"
 )
 
@@ -135,7 +135,7 @@ func getGlobalFlagValue(arg string) string {
 }
 
 type RunOptions struct {
-	TokenHelper    token.TokenHelper
+	TokenHelper    tokenhelper.TokenHelper
 	HCPTokenHelper hcpvlib.HCPTokenHelper
 	Stdout         io.Writer
 	Stderr         io.Writer
@@ -186,6 +186,8 @@ func RunCustom(args []string, runOpts *RunOptions) int {
 		runOpts.Stderr = colorable.NewNonColorable(runOpts.Stderr)
 	}
 
+	// This bytes.Buffer override of the uiErrWriter is why we don't see errors printed to the screen
+	// when running commands with e.g. -output-curl-string
 	uiErrWriter := runOpts.Stderr
 	if outputCurlString || outputPolicy {
 		uiErrWriter = &bytes.Buffer{}
@@ -318,6 +320,9 @@ func generateCurlString(exitCode int, runOpts *RunOptions, preParsingErrBuf *byt
 		return 1
 	}
 
+	// When we actually return from client.rawRequestWithContext(), this value should be set to the OutputStringError
+	// that contains the data/context required to output the actual string, so it's doubtful this chunk of code will
+	// ever run, but I'm guessing it's a defense in depth thing.
 	if api.LastOutputStringError == nil {
 		if exitCode == 127 {
 			// Usage, just pass it through
diff --git a/command/monitor.go b/command/monitor.go
index f39ca72a360..a438424b59b 100644
--- a/command/monitor.go
+++ b/command/monitor.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/monitor_test.go b/command/monitor_test.go
index fd1b288fd24..9b659c0568c 100644
--- a/command/monitor_test.go
+++ b/command/monitor_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/namespace.go b/command/namespace.go
index c47b26648c8..eb272a4e607 100644
--- a/command/namespace.go
+++ b/command/namespace.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/namespace_api_lock.go b/command/namespace_api_lock.go
index 4193508ec4f..bf27e5773fa 100644
--- a/command/namespace_api_lock.go
+++ b/command/namespace_api_lock.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/namespace_api_unlock.go b/command/namespace_api_unlock.go
index 0c9cd22eadd..b11b7bc2409 100644
--- a/command/namespace_api_unlock.go
+++ b/command/namespace_api_unlock.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/namespace_create.go b/command/namespace_create.go
index 6499bf2a25c..54c0d4e6859 100644
--- a/command/namespace_create.go
+++ b/command/namespace_create.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/namespace_delete.go b/command/namespace_delete.go
index e7704ca5cd8..5e8871e4c7e 100644
--- a/command/namespace_delete.go
+++ b/command/namespace_delete.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/namespace_list.go b/command/namespace_list.go
index e8581670edb..49702cd01f6 100644
--- a/command/namespace_list.go
+++ b/command/namespace_list.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/namespace_lookup.go b/command/namespace_lookup.go
index 376a0adc419..3fe96c5d239 100644
--- a/command/namespace_lookup.go
+++ b/command/namespace_lookup.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/namespace_patch.go b/command/namespace_patch.go
index d3868c6134f..beae964f20c 100644
--- a/command/namespace_patch.go
+++ b/command/namespace_patch.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator.go b/command/operator.go
index 8d918f3492a..47bcfa708b7 100644
--- a/command/operator.go
+++ b/command/operator.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_diagnose.go b/command/operator_diagnose.go
index 460a24f1011..bdb7d6d2403 100644
--- a/command/operator_diagnose.go
+++ b/command/operator_diagnose.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -19,7 +19,7 @@ import (
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-kms-wrapping/entropy/v2"
 	"github.com/hashicorp/go-secure-stdlib/reloadutil"
-	uuid "github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/go-uuid"
 	cserver "github.com/hashicorp/vault/command/server"
 	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/helper/metricsutil"
@@ -33,6 +33,7 @@ import (
 	"github.com/hashicorp/vault/vault"
 	"github.com/hashicorp/vault/vault/diagnose"
 	"github.com/hashicorp/vault/vault/hcp_link"
+	"github.com/hashicorp/vault/vault/seal"
 	"github.com/hashicorp/vault/version"
 	"github.com/posener/complete"
 	"golang.org/x/term"
@@ -202,17 +203,19 @@ func (c *OperatorDiagnoseCommand) RunWithParsedFlags() int {
 
 func (c *OperatorDiagnoseCommand) offlineDiagnostics(ctx context.Context) error {
 	rloadFuncs := make(map[string][]reloadutil.ReloadFunc)
+	handlers := newVaultHandlers()
+
 	server := &ServerCommand{
 		// TODO: set up a different one?
 		// In particular, a UI instance that won't output?
 		BaseCommand: c.BaseCommand,
 
 		// TODO: refactor to a common place?
-		AuditBackends:        auditBackends,
-		CredentialBackends:   credentialBackends,
-		LogicalBackends:      logicalBackends,
-		PhysicalBackends:     physicalBackends,
-		ServiceRegistrations: serviceRegistrations,
+		AuditBackends:        handlers.auditBackends,
+		CredentialBackends:   handlers.credentialBackends,
+		LogicalBackends:      handlers.logicalBackends,
+		PhysicalBackends:     handlers.physicalBackends,
+		ServiceRegistrations: handlers.serviceRegistrations,
 
 		// TODO: other ServerCommand options?
 
@@ -432,10 +435,14 @@ func (c *OperatorDiagnoseCommand) offlineDiagnostics(ctx context.Context) error
 	sealcontext, sealspan := diagnose.StartSpan(ctx, "Create Vault Server Configuration Seals")
 
 	var setSealResponse *SetSealResponse
-	existingSealGenerationInfo, err := vault.PhysicalSealGenInfo(sealcontext, *backend)
-	if err != nil {
-		diagnose.Fail(sealcontext, fmt.Sprintf("Unable to get Seal generation information from storage: %s.", err.Error()))
-		goto SEALFAIL
+	var err error
+	var existingSealGenerationInfo *seal.SealGenerationInfo
+	if config.IsMultisealEnabled() {
+		existingSealGenerationInfo, err = vault.PhysicalSealGenInfo(sealcontext, *backend)
+		if err != nil {
+			diagnose.Fail(sealcontext, fmt.Sprintf("Unable to get Seal generation information from storage: %s.", err.Error()))
+			goto SEALFAIL
+		}
 	}
 
 	setSealResponse, err = setSeal(server, config, make([]string, 0), make(map[string]string), existingSealGenerationInfo, false /* unsealed vault has no partially wrapped paths */)
diff --git a/command/operator_diagnose_test.go b/command/operator_diagnose_test.go
index 9f7fbde762b..83152985fff 100644
--- a/command/operator_diagnose_test.go
+++ b/command/operator_diagnose_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !race
@@ -7,14 +7,17 @@ package command
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
 	"github.com/hashicorp/cli"
-	"github.com/hashicorp/vault/command/server"
+	"github.com/hashicorp/vault/helper/constants"
+	pkihelper "github.com/hashicorp/vault/helper/testhelpers/pki"
 	"github.com/hashicorp/vault/vault/diagnose"
 )
 
@@ -31,8 +34,55 @@ func testOperatorDiagnoseCommand(tb testing.TB) *OperatorDiagnoseCommand {
 	}
 }
 
+func generateTLSConfigOk(t *testing.T, ca pkihelper.LeafWithIntermediary) string {
+	t.Helper()
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, "tls_config_ok.hcl")
+
+	templateFile := "./server/test-fixtures/tls_config_ok.hcl"
+	contents, err := os.ReadFile(templateFile)
+	if err != nil {
+		t.Fatalf("failed to read file %s: %v", templateFile, err)
+	}
+	contents = []byte(strings.ReplaceAll(string(contents), "{REPLACE_LEAF_CERT_FILE}", ca.Leaf.CertFile))
+	contents = []byte(strings.ReplaceAll(string(contents), "{REPLACE_LEAF_KEY_FILE}", ca.Leaf.KeyFile))
+
+	err = os.WriteFile(configPath, contents, 0o644)
+	if err != nil {
+		t.Fatalf("failed to write file %s: %v", configPath, err)
+	}
+
+	return configPath
+}
+
+func generateTransitTLSCheck(t *testing.T, ca pkihelper.LeafWithIntermediary) string {
+	t.Helper()
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, "diagnose_seal_transit_tls_check.hcl")
+
+	templateFile := "./server/test-fixtures/diagnose_seal_transit_tls_check.hcl"
+	contents, err := os.ReadFile(templateFile)
+	if err != nil {
+		t.Fatalf("failed to read file %s: %v", templateFile, err)
+	}
+	contents = []byte(strings.ReplaceAll(string(contents), "{REPLACE_LEAF_CERT_FILE}", ca.Leaf.CertFile))
+	contents = []byte(strings.ReplaceAll(string(contents), "{REPLACE_LEAF_KEY_FILE}", ca.Leaf.KeyFile))
+	contents = []byte(strings.ReplaceAll(string(contents), "{REPLACE_COMBINED_CA_CHAIN_FILE}", ca.CombinedCaFile))
+
+	err = os.WriteFile(configPath, contents, 0o644)
+	if err != nil {
+		t.Fatalf("failed to write file %s: %v", configPath, err)
+	}
+
+	return configPath
+}
+
 func TestOperatorDiagnoseCommand_Run(t *testing.T) {
 	t.Parallel()
+	testca := pkihelper.GenerateCertWithIntermediaryRoot(t)
+	tlsConfigOkConfigFile := generateTLSConfigOk(t, testca)
+	transitTLSCheckConfigFile := generateTransitTLSCheck(t, testca)
+
 	cases := []struct {
 		name     string
 		args     []string
@@ -41,7 +91,7 @@ func TestOperatorDiagnoseCommand_Run(t *testing.T) {
 		{
 			"diagnose_ok",
 			[]string{
-				"-config", "./server/test-fixtures/config_diagnose_ok.hcl",
+				"-config", "./server/test-fixtures/config_diagnose_ok_singleseal.hcl",
 			},
 			[]*diagnose.Result{
 				{
@@ -349,7 +399,7 @@ func TestOperatorDiagnoseCommand_Run(t *testing.T) {
 		{
 			"diagnose_listener_config_ok",
 			[]string{
-				"-config", "./server/test-fixtures/tls_config_ok.hcl",
+				"-config", tlsConfigOkConfigFile,
 			},
 			[]*diagnose.Result{
 				{
@@ -461,7 +511,7 @@ func TestOperatorDiagnoseCommand_Run(t *testing.T) {
 		{
 			"diagnose_seal_transit_tls_check_fail",
 			[]string{
-				"-config", "./server/test-fixtures/diagnose_seal_transit_tls_check.hcl",
+				"-config", transitTLSCheckConfigFile,
 			},
 			[]*diagnose.Result{
 				{
@@ -611,9 +661,9 @@ func TestOperatorDiagnoseCommand_Run(t *testing.T) {
 		for _, tc := range cases {
 			tc := tc
 			t.Run(tc.name, func(t *testing.T) {
-				if tc.name == "diagnose_ok" && server.IsMultisealSupported() {
+				if tc.name == "diagnose_ok" && constants.IsEnterprise {
 					t.Skip("Test not valid in ENT")
-				} else if tc.name == "diagnose_ok_multiseal" && !server.IsMultisealSupported() {
+				} else if tc.name == "diagnose_ok_multiseal" && !constants.IsEnterprise {
 					t.Skip("Test not valid in community edition")
 				} else {
 					t.Parallel()
@@ -684,7 +734,7 @@ func compareResult(exp *diagnose.Result, act *diagnose.Result) error {
 		for _, c := range act.Children {
 			errStrings = append(errStrings, fmt.Sprintf("%+v", c))
 		}
-		return fmt.Errorf(strings.Join(errStrings, ","))
+		return errors.New(strings.Join(errStrings, ","))
 	}
 
 	if len(exp.Children) > 0 {
diff --git a/command/operator_generate_root.go b/command/operator_generate_root.go
index b7518aa91c5..8602abfa718 100644
--- a/command/operator_generate_root.go
+++ b/command/operator_generate_root.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -23,6 +23,7 @@ var (
 	_ cli.CommandAutocomplete = (*OperatorGenerateRootCommand)(nil)
 )
 
+//go:generate enumer -type=generateRootKind -trimprefix=generateRoot
 type generateRootKind int
 
 const (
diff --git a/command/operator_generate_root_test.go b/command/operator_generate_root_test.go
index e27592d856a..d8f5a3eee02 100644
--- a/command/operator_generate_root_test.go
+++ b/command/operator_generate_root_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !race
diff --git a/command/operator_init.go b/command/operator_init.go
index b4b5de9759b..8b0483437ab 100644
--- a/command/operator_init.go
+++ b/command/operator_init.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_init_test.go b/command/operator_init_test.go
index 73fe4ff59e9..a37130b3a66 100644
--- a/command/operator_init_test.go
+++ b/command/operator_init_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !race
diff --git a/command/operator_key_status.go b/command/operator_key_status.go
index 015bd891f75..a859c4b3161 100644
--- a/command/operator_key_status.go
+++ b/command/operator_key_status.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_key_status_test.go b/command/operator_key_status_test.go
index ccaac388308..3d3139d7a32 100644
--- a/command/operator_key_status_test.go
+++ b/command/operator_key_status_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_members.go b/command/operator_members.go
index 83d7a2d4301..af85fa82e50 100644
--- a/command/operator_members.go
+++ b/command/operator_members.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_migrate.go b/command/operator_migrate.go
index 3af73e69638..77e1f723875 100644
--- a/command/operator_migrate.go
+++ b/command/operator_migrate.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -20,6 +20,7 @@ import (
 	"github.com/hashicorp/hcl"
 	"github.com/hashicorp/hcl/hcl/ast"
 	"github.com/hashicorp/vault/command/server"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/physical/raft"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/physical"
@@ -331,10 +332,14 @@ func (c *OperatorMigrateCommand) loadMigratorConfig(path string) (*migratorConfi
 		return nil, err
 	}
 
-	obj, err := hcl.ParseBytes(d)
+	// TODO (HCL_DUP_KEYS_DEPRECATION): Return to hcl.Parse once duplicates are forbidden
+	obj, duplicate, err := random.ParseAndCheckForDuplicateHclAttributes(string(d))
 	if err != nil {
 		return nil, err
 	}
+	if duplicate {
+		c.UI.Warn("WARNING: Duplicate keys found in migration configuration file, duplicate keys in HCL files are deprecated and will be forbidden in a future release.")
+	}
 
 	var result migratorConfig
 	if err := hcl.DecodeObject(&result, obj); err != nil {
diff --git a/command/operator_migrate_test.go b/command/operator_migrate_test.go
index 9a6c27196eb..0c3ad15e1d7 100644
--- a/command/operator_migrate_test.go
+++ b/command/operator_migrate_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -15,27 +15,25 @@ import (
 	"strings"
 	"sync"
 	"testing"
-	"time"
 
 	"github.com/go-test/deep"
+	"github.com/hashicorp/cli"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/base62"
 	"github.com/hashicorp/vault/command/server"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/vault"
 )
 
 const trailing_slash_key = "trailing_slash/"
 
-func init() {
-	rand.Seed(time.Now().UnixNano())
-}
-
 func TestMigration(t *testing.T) {
+	handlers := newVaultHandlers()
 	t.Run("Default", func(t *testing.T) {
 		data := generateData()
 
-		fromFactory := physicalBackends["file"]
+		fromFactory := handlers.physicalBackends["file"]
 
 		folder := t.TempDir()
 
@@ -51,7 +49,7 @@ func TestMigration(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		toFactory := physicalBackends["inmem"]
+		toFactory := handlers.physicalBackends["inmem"]
 		confTo := map[string]string{}
 		to, err := toFactory(confTo, nil)
 		if err != nil {
@@ -72,7 +70,7 @@ func TestMigration(t *testing.T) {
 	t.Run("Concurrent migration", func(t *testing.T) {
 		data := generateData()
 
-		fromFactory := physicalBackends["file"]
+		fromFactory := handlers.physicalBackends["file"]
 
 		folder := t.TempDir()
 
@@ -88,7 +86,7 @@ func TestMigration(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		toFactory := physicalBackends["inmem"]
+		toFactory := handlers.physicalBackends["inmem"]
 		confTo := map[string]string{}
 		to, err := toFactory(confTo, nil)
 		if err != nil {
@@ -110,7 +108,7 @@ func TestMigration(t *testing.T) {
 	t.Run("Start option", func(t *testing.T) {
 		data := generateData()
 
-		fromFactory := physicalBackends["inmem"]
+		fromFactory := handlers.physicalBackends["inmem"]
 		confFrom := map[string]string{}
 		from, err := fromFactory(confFrom, nil)
 		if err != nil {
@@ -120,7 +118,7 @@ func TestMigration(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		toFactory := physicalBackends["file"]
+		toFactory := handlers.physicalBackends["file"]
 		folder := t.TempDir()
 		confTo := map[string]string{
 			"path": folder,
@@ -149,7 +147,7 @@ func TestMigration(t *testing.T) {
 	t.Run("Start option (parallel)", func(t *testing.T) {
 		data := generateData()
 
-		fromFactory := physicalBackends["inmem"]
+		fromFactory := handlers.physicalBackends["inmem"]
 		confFrom := map[string]string{}
 		from, err := fromFactory(confFrom, nil)
 		if err != nil {
@@ -159,7 +157,7 @@ func TestMigration(t *testing.T) {
 			t.Fatal(err)
 		}
 
-		toFactory := physicalBackends["file"]
+		toFactory := handlers.physicalBackends["file"]
 		folder := t.TempDir()
 		confTo := map[string]string{
 			"path": folder,
@@ -186,31 +184,38 @@ func TestMigration(t *testing.T) {
 	})
 
 	t.Run("Config parsing", func(t *testing.T) {
-		cmd := new(OperatorMigrateCommand)
+		ui := cli.NewMockUi()
+		cmd := &OperatorMigrateCommand{
+			BaseCommand: &BaseCommand{
+				UI: ui,
+			},
+		}
 		cfgName := filepath.Join(t.TempDir(), "migrator")
 		os.WriteFile(cfgName, []byte(`
-storage_source "src_type" {
+storage_source "consul" {
   path = "src_path"
 }
 
-storage_destination "dest_type" {
+storage_destination "raft" {
+  path = "dest_path"
   path = "dest_path"
 }`), 0o644)
 
 		expCfg := &migratorConfig{
 			StorageSource: &server.Storage{
-				Type: "src_type",
+				Type: "consul",
 				Config: map[string]string{
 					"path": "src_path",
 				},
 			},
 			StorageDestination: &server.Storage{
-				Type: "dest_type",
+				Type: "raft",
 				Config: map[string]string{
 					"path": "dest_path",
 				},
 			},
 		}
+		t.Setenv(random.AllowHclDuplicatesEnvVar, "true")
 		cfg, err := cmd.loadMigratorConfig(cfgName)
 		if err != nil {
 			t.Fatal(cfg)
@@ -218,6 +223,9 @@ storage_destination "dest_type" {
 		if diff := deep.Equal(cfg, expCfg); diff != nil {
 			t.Fatal(diff)
 		}
+		// TODO (HCL_DUP_KEYS_DEPRECATION): Remove warning and leave only this "verifyBad" test down below
+		strings.Contains(ui.ErrorWriter.String(), "WARNING: Duplicate keys found in migration configuration file, duplicate keys in HCL files are deprecated and will be forbidden in a future release.")
+		t.Setenv(random.AllowHclDuplicatesEnvVar, "false")
 
 		verifyBad := func(cfg string) {
 			os.WriteFile(cfgName, []byte(cfg), 0o644)
@@ -229,47 +237,57 @@ storage_destination "dest_type" {
 
 		// missing source
 		verifyBad(`
-storage_destination "dest_type" {
+storage_destination "raft" {
   path = "dest_path"
 }`)
 
 		// missing destination
 		verifyBad(`
-storage_source "src_type" {
+storage_source "consul" {
   path = "src_path"
 }`)
 
 		// duplicate source
 		verifyBad(`
-storage_source "src_type" {
+storage_source "consul" {
   path = "src_path"
 }
 
-storage_source "src_type2" {
+storage_source "raft" {
   path = "src_path"
 }
 
-storage_destination "dest_type" {
+storage_destination "raft" {
   path = "dest_path"
 }`)
 
 		// duplicate destination
 		verifyBad(`
-storage_source "src_type" {
+storage_source "consul" {
   path = "src_path"
 }
 
-storage_destination "dest_type" {
+storage_destination "raft" {
+  path = "dest_path"
+}
+
+storage_destination "consul" {
   path = "dest_path"
+}`)
+		// duplicate hcl attribute
+		verifyBad(`
+storage_source "consul" {
+  path = "src_path"
 }
 
-storage_destination "dest_type2" {
+storage_destination "raft" {
+  path = "dest_path"
   path = "dest_path"
 }`)
 	})
 
 	t.Run("DFS Scan", func(t *testing.T) {
-		s, _ := physicalBackends["inmem"](map[string]string{}, nil)
+		s, _ := handlers.physicalBackends["inmem"](map[string]string{}, nil)
 
 		data := generateData()
 		data["cc"] = []byte{}
diff --git a/command/operator_raft.go b/command/operator_raft.go
index deaff14cdf2..7262f30c493 100644
--- a/command/operator_raft.go
+++ b/command/operator_raft.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_raft_autopilot_get_config.go b/command/operator_raft_autopilot_get_config.go
index bdeeed6f8c0..94dde44b676 100644
--- a/command/operator_raft_autopilot_get_config.go
+++ b/command/operator_raft_autopilot_get_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_raft_autopilot_set_config.go b/command/operator_raft_autopilot_set_config.go
index 39b9b2ddcb6..dc1c1f30e72 100644
--- a/command/operator_raft_autopilot_set_config.go
+++ b/command/operator_raft_autopilot_set_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_raft_autopilot_state.go b/command/operator_raft_autopilot_state.go
index 4fc4ca4445e..835bd824a8e 100644
--- a/command/operator_raft_autopilot_state.go
+++ b/command/operator_raft_autopilot_state.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_raft_join.go b/command/operator_raft_join.go
index aaaaf2891e1..da1a074fd2d 100644
--- a/command/operator_raft_join.go
+++ b/command/operator_raft_join.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -9,6 +9,7 @@ import (
 
 	"github.com/hashicorp/cli"
 	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/posener/complete"
 )
 
@@ -45,7 +46,7 @@ Usage: vault operator raft join [options] <leader-api-addr|auto-join-configurati
   configuration.
 
       $ vault operator raft join "provider=aws region=eu-west-1 ..."
-			
+
   Join the current node as a peer to the Raft cluster by providing cloud auto-join
   configuration with an explicit URI scheme and port.
 
@@ -195,7 +196,7 @@ func (c *OperatorRaftJoinCommand) Run(args []string) int {
 		joinReq.AutoJoinScheme = c.flagAutoJoinScheme
 		joinReq.AutoJoinPort = c.flagAutoJoinPort
 	} else {
-		joinReq.LeaderAPIAddr = leaderInfo
+		joinReq.LeaderAPIAddr = configutil.NormalizeAddr(leaderInfo)
 	}
 
 	resp, err := client.Sys().RaftJoin(joinReq)
diff --git a/command/operator_raft_listpeers.go b/command/operator_raft_listpeers.go
index b92ab8f0b51..b9325cfae98 100644
--- a/command/operator_raft_listpeers.go
+++ b/command/operator_raft_listpeers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_raft_remove_peer.go b/command/operator_raft_remove_peer.go
index fabd9ce30d3..8e46336fbf5 100644
--- a/command/operator_raft_remove_peer.go
+++ b/command/operator_raft_remove_peer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_raft_snapshot.go b/command/operator_raft_snapshot.go
index 02fc4c2b8a4..449799cb504 100644
--- a/command/operator_raft_snapshot.go
+++ b/command/operator_raft_snapshot.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_raft_snapshot_inspect.go b/command/operator_raft_snapshot_inspect.go
index 43c3fb0e4a1..fea5f9eee66 100644
--- a/command/operator_raft_snapshot_inspect.go
+++ b/command/operator_raft_snapshot_inspect.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_raft_snapshot_inspect_test.go b/command/operator_raft_snapshot_inspect_test.go
index d7003769560..9a1671ee604 100644
--- a/command/operator_raft_snapshot_inspect_test.go
+++ b/command/operator_raft_snapshot_inspect_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_raft_snapshot_restore.go b/command/operator_raft_snapshot_restore.go
index 516fba522fe..2d064302cd1 100644
--- a/command/operator_raft_snapshot_restore.go
+++ b/command/operator_raft_snapshot_restore.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_raft_snapshot_save.go b/command/operator_raft_snapshot_save.go
index 38580ed5e1f..92fbd79190f 100644
--- a/command/operator_raft_snapshot_save.go
+++ b/command/operator_raft_snapshot_save.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_rekey.go b/command/operator_rekey.go
index 9b484156828..144d39d8034 100644
--- a/command/operator_rekey.go
+++ b/command/operator_rekey.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -337,6 +337,15 @@ func (c *OperatorRekeyCommand) init(client *api.Client) int {
 
 // cancel is used to abort the rekey process.
 func (c *OperatorRekeyCommand) cancel(client *api.Client) int {
+	if c.flagNonce != "" && c.flagVerify {
+		c.UI.Error("The -nonce flag is not valid with the -verify flag")
+		return 1
+	}
+
+	if c.flagNonce != "" {
+		return c.cancelWithNonce(client)
+	}
+
 	// Handle the different API requests
 	var fn func() error
 	switch strings.ToLower(strings.TrimSpace(c.flagTarget)) {
@@ -366,6 +375,29 @@ func (c *OperatorRekeyCommand) cancel(client *api.Client) int {
 	return 0
 }
 
+func (c *OperatorRekeyCommand) cancelWithNonce(client *api.Client) int {
+	var fn func(nonce string) error
+	switch strings.ToLower(strings.TrimSpace(c.flagTarget)) {
+	case "barrier":
+		fn = client.Sys().RekeyCancelWithNonce
+	case "recovery", "hsm":
+		fn = client.Sys().RekeyRecoveryKeyCancelWithNonce
+
+	default:
+		c.UI.Error(fmt.Sprintf("Unknown target: %s", c.flagTarget))
+		return 1
+	}
+
+	// Make the request
+	if err := fn(c.flagNonce); err != nil {
+		c.UI.Error(fmt.Sprintf("Error canceling rekey: %s", err))
+		return 2
+	}
+
+	c.UI.Output("Success! Canceled rekeying (if it was started)")
+	return 0
+}
+
 // provide prompts the user for the seal key and posts it to the update root
 // endpoint. If this is the last unseal, this function outputs it.
 func (c *OperatorRekeyCommand) provide(client *api.Client, key string) int {
diff --git a/command/operator_rekey_test.go b/command/operator_rekey_test.go
index d8a4ee2537b..687462a3476 100644
--- a/command/operator_rekey_test.go
+++ b/command/operator_rekey_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !race
@@ -67,6 +67,16 @@ func TestOperatorRekeyCommand_Run(t *testing.T) {
 			"incorrect number",
 			2,
 		},
+		{
+			"cancel_verify_nonce",
+			[]string{
+				"-cancel",
+				"-verify",
+				"-nonce", "abcd",
+			},
+			"The -nonce flag is not valid with the -verify flag",
+			1,
+		},
 	}
 
 	t.Run("validations", func(t *testing.T) {
@@ -152,10 +162,11 @@ func TestOperatorRekeyCommand_Run(t *testing.T) {
 		defer closer()
 
 		// Initialize a rekey
-		if _, err := client.Sys().RekeyInit(&api.RekeyInitRequest{
+		init, err := client.Sys().RekeyInit(&api.RekeyInitRequest{
 			SecretShares:    1,
 			SecretThreshold: 1,
-		}); err != nil {
+		})
+		if err != nil {
 			t.Fatal(err)
 		}
 
@@ -163,7 +174,7 @@ func TestOperatorRekeyCommand_Run(t *testing.T) {
 		cmd.client = client
 
 		code := cmd.Run([]string{
-			"-cancel",
+			"-cancel", "-nonce", init.Nonce,
 		})
 		if exp := 0; code != exp {
 			t.Errorf("expected %d to be %d", code, exp)
diff --git a/command/operator_seal.go b/command/operator_seal.go
index f390972f204..7d8e4ccf411 100644
--- a/command/operator_seal.go
+++ b/command/operator_seal.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_seal_test.go b/command/operator_seal_test.go
index 6208d639632..5611feea5d2 100644
--- a/command/operator_seal_test.go
+++ b/command/operator_seal_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_step_down.go b/command/operator_step_down.go
index e8b93acf075..aa40b32a86c 100644
--- a/command/operator_step_down.go
+++ b/command/operator_step_down.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_step_down_test.go b/command/operator_step_down_test.go
index 8cb108be98c..da3de63dbac 100644
--- a/command/operator_step_down_test.go
+++ b/command/operator_step_down_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_unseal.go b/command/operator_unseal.go
index a667f209dcb..a9122e63117 100644
--- a/command/operator_unseal.go
+++ b/command/operator_unseal.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_unseal_test.go b/command/operator_unseal_test.go
index 42f603e4882..3168a99440f 100644
--- a/command/operator_unseal_test.go
+++ b/command/operator_unseal_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/operator_usage.go b/command/operator_usage.go
index 8fa0f8f4151..593acc05f5d 100644
--- a/command/operator_usage.go
+++ b/command/operator_usage.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -56,7 +56,7 @@ func (c *OperatorUsageCommand) Flags() *FlagSets {
 
 	f.TimeVar(&TimeVar{
 		Name:       "start-time",
-		Usage:      "Start of report period. Defaults to 'default_reporting_period' before end time.",
+		Usage:      "Start of report period. Defaults to billing start time",
 		Target:     &c.flagStartTime,
 		Completion: complete.PredictNothing,
 		Default:    time.Time{},
@@ -64,7 +64,7 @@ func (c *OperatorUsageCommand) Flags() *FlagSets {
 	})
 	f.TimeVar(&TimeVar{
 		Name:       "end-time",
-		Usage:      "End of report period. Defaults to end of last month.",
+		Usage:      "End of report period. Defaults to end of the current month.",
 		Target:     &c.flagEndTime,
 		Completion: complete.PredictNothing,
 		Default:    time.Time{},
@@ -132,7 +132,7 @@ func (c *OperatorUsageCommand) Run(args []string) int {
 	c.outputTimestamps(resp.Data)
 
 	out := []string{
-		"Namespace path | Distinct entities | Non-Entity tokens | Active clients",
+		"Namespace path | Entity Clients | Non-Entity clients | Secret syncs | ACME clients | Active clients",
 	}
 
 	out = append(out, c.namespacesOutput(resp.Data)...)
@@ -142,6 +142,12 @@ func (c *OperatorUsageCommand) Run(args []string) int {
 	colConfig.Empty = " " // Do not show n/a on intentional blank lines
 	colConfig.Glue = "   "
 	c.UI.Output(tableOutput(out, colConfig))
+
+	// Also, output the warnings returned, if any:
+	for _, warning := range resp.Warnings {
+		c.UI.Warn(warning)
+	}
+
 	return 0
 }
 
@@ -196,8 +202,9 @@ type UsageResponse struct {
 	entityCount   int64
 	// As per 1.9, the tokenCount field will contain the distinct non-entity
 	// token clients instead of each individual token.
-	tokenCount int64
-
+	tokenCount  int64
+	secretSyncs int64
+	acmeCount   int64
 	clientCount int64
 }
 
@@ -232,16 +239,22 @@ func (c *OperatorUsageCommand) parseNamespaceCount(rawVal interface{}) (UsageRes
 		return ret, errors.New("missing counts")
 	}
 
-	ret.entityCount, ok = jsonNumberOK(counts, "distinct_entities")
+	ret.entityCount, ok = jsonNumberOK(counts, "entity_clients")
 	if !ok {
-		return ret, errors.New("missing distinct_entities")
+		return ret, errors.New("missing entity_clients")
 	}
 
-	ret.tokenCount, ok = jsonNumberOK(counts, "non_entity_tokens")
+	ret.tokenCount, ok = jsonNumberOK(counts, "non_entity_clients")
 	if !ok {
-		return ret, errors.New("missing non_entity_tokens")
+		return ret, errors.New("missing non_entity_clients")
 	}
 
+	// don't error if the secret syncs key is missing
+	ret.secretSyncs, _ = jsonNumberOK(counts, "secret_syncs")
+
+	// don't error if acme clients is missing
+	ret.acmeCount, _ = jsonNumberOK(counts, "acme_clients")
+
 	ret.clientCount, ok = jsonNumberOK(counts, "clients")
 	if !ok {
 		return ret, errors.New("missing clients")
@@ -274,8 +287,8 @@ func (c *OperatorUsageCommand) namespacesOutput(data map[string]interface{}) []s
 			sortOrder = "2" + val.namespacePath
 		}
 
-		formattedLine := fmt.Sprintf("%s | %d | %d | %d",
-			val.namespacePath, val.entityCount, val.tokenCount, val.clientCount)
+		formattedLine := fmt.Sprintf("%s | %d | %d | %d | %d | %d",
+			val.namespacePath, val.entityCount, val.tokenCount, val.secretSyncs, val.acmeCount, val.clientCount)
 		nsOut = append(nsOut, UsageCommandNamespace{
 			formattedLine: formattedLine,
 			sortOrder:     sortOrder,
@@ -296,7 +309,7 @@ func (c *OperatorUsageCommand) namespacesOutput(data map[string]interface{}) []s
 
 func (c *OperatorUsageCommand) totalOutput(data map[string]interface{}) []string {
 	// blank line separating it from namespaces
-	out := []string{"  |  |  |  "}
+	out := []string{"  |  |  |  |  |  "}
 
 	total, ok := data["total"].(map[string]interface{})
 	if !ok {
@@ -304,24 +317,30 @@ func (c *OperatorUsageCommand) totalOutput(data map[string]interface{}) []string
 		return out
 	}
 
-	entityCount, ok := jsonNumberOK(total, "distinct_entities")
+	entityCount, ok := jsonNumberOK(total, "entity_clients")
 	if !ok {
-		c.UI.Error("missing distinct_entities in total")
+		c.UI.Error("missing entity_clients in total")
 		return out
 	}
 
-	tokenCount, ok := jsonNumberOK(total, "non_entity_tokens")
+	tokenCount, ok := jsonNumberOK(total, "non_entity_clients")
 	if !ok {
-		c.UI.Error("missing non_entity_tokens in total")
+		c.UI.Error("missing non_entity_clients in total")
 		return out
 	}
+	// don't error if secret syncs key is missing
+	secretSyncs, _ := jsonNumberOK(total, "secret_syncs")
+
+	// don't error if acme clients is missing
+	acmeCount, _ := jsonNumberOK(total, "acme_clients")
+
 	clientCount, ok := jsonNumberOK(total, "clients")
 	if !ok {
 		c.UI.Error("missing clients in total")
 		return out
 	}
 
-	out = append(out, fmt.Sprintf("Total | %d | %d | %d",
-		entityCount, tokenCount, clientCount))
+	out = append(out, fmt.Sprintf("Total | %d | %d | %d | %d | %d",
+		entityCount, tokenCount, secretSyncs, acmeCount, clientCount))
 	return out
 }
diff --git a/command/operator_utilization.go b/command/operator_utilization.go
index 71291cca73c..36c061e540c 100644
--- a/command/operator_utilization.go
+++ b/command/operator_utilization.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/patch.go b/command/patch.go
index f7b006f0f12..cc9b4929dea 100644
--- a/command/patch.go
+++ b/command/patch.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/patch_test.go b/command/patch_test.go
index 35725793730..933f6ec12df 100644
--- a/command/patch_test.go
+++ b/command/patch_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/path_help.go b/command/path_help.go
index 335de684008..8860b34969c 100644
--- a/command/path_help.go
+++ b/command/path_help.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/path_help_test.go b/command/path_help_test.go
index 33c06b4fe55..bb389014b6e 100644
--- a/command/path_help_test.go
+++ b/command/path_help_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pgp_test.go b/command/pgp_test.go
index df14d895f7e..037fa5f5963 100644
--- a/command/pgp_test.go
+++ b/command/pgp_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pki.go b/command/pki.go
index 8b90a6aa7b3..8e98736ab89 100644
--- a/command/pki.go
+++ b/command/pki.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pki_health_check.go b/command/pki_health_check.go
index d70e3ecb0e6..6df6e7c352d 100644
--- a/command/pki_health_check.go
+++ b/command/pki_health_check.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pki_health_check_test.go b/command/pki_health_check_test.go
index d63574a270a..6cf9c052577 100644
--- a/command/pki_health_check_test.go
+++ b/command/pki_health_check_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pki_issue_intermediate.go b/command/pki_issue_intermediate.go
index 7545b22cc7d..4f2d88e3a55 100644
--- a/command/pki_issue_intermediate.go
+++ b/command/pki_issue_intermediate.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pki_issue_intermediate_test.go b/command/pki_issue_intermediate_test.go
index cb66d45e7c5..14da96769a0 100644
--- a/command/pki_issue_intermediate_test.go
+++ b/command/pki_issue_intermediate_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pki_list_intermediate.go b/command/pki_list_intermediate.go
index 7314e671bce..f0f26f68df2 100644
--- a/command/pki_list_intermediate.go
+++ b/command/pki_list_intermediate.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pki_list_intermediate_test.go b/command/pki_list_intermediate_test.go
index 5abfabd5599..868b29d98d2 100644
--- a/command/pki_list_intermediate_test.go
+++ b/command/pki_list_intermediate_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pki_reissue_intermediate.go b/command/pki_reissue_intermediate.go
index fa4dd38fbe7..694050a3785 100644
--- a/command/pki_reissue_intermediate.go
+++ b/command/pki_reissue_intermediate.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -113,6 +113,10 @@ func (c *PKIReIssueCACommand) Run(args []string) int {
 	}
 
 	templateData, err := parseTemplateCertificate(*certificate, useExistingKey, keyRef)
+	if err != nil {
+		c.UI.Error(fmt.Sprintf("Error fetching parsing template certificate: %v", err))
+		return 1
+	}
 	data := updateTemplateWithData(templateData, userData)
 
 	return pkiIssue(c.BaseCommand, parentIssuer, intermediateMount, c.flagNewIssuerName, c.flagKeyStorageSource, data)
diff --git a/command/pki_reissue_intermediate_test.go b/command/pki_reissue_intermediate_test.go
index 45657fe1199..cd77e6c396a 100644
--- a/command/pki_reissue_intermediate_test.go
+++ b/command/pki_reissue_intermediate_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pki_verify_sign.go b/command/pki_verify_sign.go
index f6d8dc93cd3..3dd639c963c 100644
--- a/command/pki_verify_sign.go
+++ b/command/pki_verify_sign.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/pki_verify_sign_test.go b/command/pki_verify_sign_test.go
index 4001aadbc92..6406cf8a9a8 100644
--- a/command/pki_verify_sign_test.go
+++ b/command/pki_verify_sign_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin.go b/command/plugin.go
index 862b55bb046..5f67dfeaad9 100644
--- a/command/plugin.go
+++ b/command/plugin.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_deregister.go b/command/plugin_deregister.go
index 1f1e4360acd..eb6b090a202 100644
--- a/command/plugin_deregister.go
+++ b/command/plugin_deregister.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_deregister_test.go b/command/plugin_deregister_test.go
index 46e52df7979..8982977e3e9 100644
--- a/command/plugin_deregister_test.go
+++ b/command/plugin_deregister_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -91,14 +91,18 @@ func TestPluginDeregisterCommand_Run(t *testing.T) {
 		ui, cmd := testPluginDeregisterCommand(t)
 		cmd.client = client
 
-		if err := client.Sys().RegisterPlugin(&api.RegisterPluginInput{
+		registerResp, err := client.Sys().RegisterPluginDetailed(&api.RegisterPluginInput{
 			Name:    pluginName,
 			Type:    api.PluginTypeCredential,
 			Command: pluginName,
 			SHA256:  sha256Sum,
-		}); err != nil {
+		})
+		if err != nil {
 			t.Fatal(err)
 		}
+		if len(registerResp.Warnings) > 0 {
+			t.Errorf("expected no warnings, got %q", registerResp.Warnings)
+		}
 
 		code := cmd.Run([]string{
 			consts.PluginTypeCredential.String(),
@@ -114,7 +118,7 @@ func TestPluginDeregisterCommand_Run(t *testing.T) {
 			t.Errorf("expected %q to contain %q", combined, expected)
 		}
 
-		resp, err := client.Sys().ListPlugins(&api.ListPluginsInput{
+		listResp, err := client.Sys().ListPlugins(&api.ListPluginsInput{
 			Type: api.PluginTypeCredential,
 		})
 		if err != nil {
@@ -122,7 +126,7 @@ func TestPluginDeregisterCommand_Run(t *testing.T) {
 		}
 
 		found := false
-		for _, plugins := range resp.PluginsByType {
+		for _, plugins := range listResp.PluginsByType {
 			for _, p := range plugins {
 				if p == pluginName {
 					found = true
@@ -130,7 +134,7 @@ func TestPluginDeregisterCommand_Run(t *testing.T) {
 			}
 		}
 		if found {
-			t.Errorf("expected %q to not be in %q", pluginName, resp.PluginsByType)
+			t.Errorf("expected %q to not be in %q", pluginName, listResp.PluginsByType)
 		}
 	})
 
diff --git a/command/plugin_info.go b/command/plugin_info.go
index e47a23c6651..d85d2d82e01 100644
--- a/command/plugin_info.go
+++ b/command/plugin_info.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_info_test.go b/command/plugin_info_test.go
index 58525312d71..e03329beec4 100644
--- a/command/plugin_info_test.go
+++ b/command/plugin_info_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_list.go b/command/plugin_list.go
index 28714adf4f5..1a2d009dee4 100644
--- a/command/plugin_list.go
+++ b/command/plugin_list.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_list_test.go b/command/plugin_list_test.go
index 4ad37868b2c..b1d4103f764 100644
--- a/command/plugin_list_test.go
+++ b/command/plugin_list_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_register.go b/command/plugin_register.go
index d124b38b891..7a18c278904 100644
--- a/command/plugin_register.go
+++ b/command/plugin_register.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -17,6 +17,12 @@ var (
 	_ cli.CommandAutocomplete = (*PluginRegisterCommand)(nil)
 )
 
+func NewPluginRegisterCommand(baseCommand *BaseCommand) cli.Command {
+	return &PluginRegisterCommand{
+		BaseCommand: baseCommand,
+	}
+}
+
 type PluginRegisterCommand struct {
 	*BaseCommand
 
@@ -27,6 +33,7 @@ type PluginRegisterCommand struct {
 	flagOCIImage string
 	flagRuntime  string
 	flagEnv      []string
+	flagDownload bool
 }
 
 func (c *PluginRegisterCommand) Synopsis() string {
@@ -53,6 +60,12 @@ Usage: vault plugin register [options] TYPE NAME
           -args=--with-glibc,--with-cgo \
           auth my-custom-plugin
 
+  Register a plugin with -download (enterprise only):
+
+      $ vault plugin register \
+          -version=v0.17.0+ent \
+          -download=true \
+          secret vault-plugin-secrets-keymgmt
 ` + c.Flags().Help()
 
 	return strings.TrimSpace(helpText)
@@ -75,22 +88,27 @@ func (c *PluginRegisterCommand) Flags() *FlagSets {
 		Name:       "command",
 		Target:     &c.flagCommand,
 		Completion: complete.PredictAnything,
-		Usage: "Command to spawn the plugin. This defaults to the name of the " +
-			"plugin if both oci_image and command are unspecified.",
+		Usage: "Command to spawn the plugin. If -sha256 is provided to register with a plugin binary, " +
+			"this defaults to the name of the plugin if both oci_image and command are unspecified. " +
+			"Otherwise, if -sha256 is not provided, a plugin artifact is expected for registration, and " +
+			"this will be ignored because the run command is known.",
 	})
 
 	f.StringVar(&StringVar{
 		Name:       "sha256",
 		Target:     &c.flagSHA256,
 		Completion: complete.PredictAnything,
-		Usage:      "SHA256 of the plugin binary or the oci_image provided. This is required for all plugins.",
+		Usage: "SHA256 of the plugin binary or the OCI image provided. " +
+			"This is required to register with a plugin binary but should not be " +
+			"specified when registering with a plugin artifact.",
 	})
 
 	f.StringVar(&StringVar{
 		Name:       "version",
 		Target:     &c.flagVersion,
 		Completion: complete.PredictAnything,
-		Usage:      "Semantic version of the plugin. Used as the tag when specifying oci_image, but with any leading 'v' trimmed. Optional.",
+		Usage: "Semantic version of the plugin. Used as the tag when specifying oci_image, but with any leading 'v' trimmed. " +
+			"This is required to register with a plugin artifact but optional when registering with a plugin binary.",
 	})
 
 	f.StringVar(&StringVar{
@@ -116,6 +134,14 @@ func (c *PluginRegisterCommand) Flags() *FlagSets {
 			"flag can be specified multiple times to specify multiple environment variables.",
 	})
 
+	f.BoolVar(&BoolVar{
+		Name:       "download",
+		Target:     &c.flagDownload,
+		Completion: complete.PredictAnything,
+		Usage: "Enterprise only. If set, Vault will automatically download plugins from" +
+			"releases.hashicorp.com",
+	})
+
 	return set
 }
 
@@ -144,8 +170,10 @@ func (c *PluginRegisterCommand) Run(args []string) int {
 	case len(args) > 2:
 		c.UI.Error(fmt.Sprintf("Too many arguments (expected 1 or 2, got %d)", len(args)))
 		return 1
-	case c.flagSHA256 == "":
-		c.UI.Error("SHA256 is required for all plugins, please provide -sha256")
+	case c.flagSHA256 == "" && c.flagVersion == "":
+		c.UI.Error("One of -sha256 or -version is required. " +
+			"If registering with a binary, please provide at least -sha256 (-version optional)." +
+			"If registering with an artifact, please provide -version only.")
 		return 1
 
 	// These cases should come after invalid cases have been checked
@@ -171,11 +199,11 @@ func (c *PluginRegisterCommand) Run(args []string) int {
 	pluginName := strings.TrimSpace(pluginNameRaw)
 
 	command := c.flagCommand
-	if command == "" && c.flagOCIImage == "" {
+	if c.flagSHA256 != "" && (command == "" && c.flagOCIImage == "") {
 		command = pluginName
 	}
 
-	if err := client.Sys().RegisterPlugin(&api.RegisterPluginInput{
+	resp, err := client.Sys().RegisterPluginDetailed(&api.RegisterPluginInput{
 		Name:     pluginName,
 		Type:     pluginType,
 		Args:     c.flagArgs,
@@ -185,11 +213,21 @@ func (c *PluginRegisterCommand) Run(args []string) int {
 		OCIImage: c.flagOCIImage,
 		Runtime:  c.flagRuntime,
 		Env:      c.flagEnv,
-	}); err != nil {
+		Download: c.flagDownload,
+	})
+	if err != nil {
 		c.UI.Error(fmt.Sprintf("Error registering plugin %s: %s", pluginName, err))
 		return 2
 	}
 
+	if resp != nil && len(resp.Warnings) > 0 {
+		c.UI.Warn(wrapAtLength(fmt.Sprintf(
+			"Warnings while registering plugin %s: %s",
+			pluginName,
+			strings.Join(resp.Warnings, "\n\n"),
+		)) + "\n")
+	}
+
 	c.UI.Output(fmt.Sprintf("Success! Registered plugin: %s", pluginName))
 	return 0
 }
diff --git a/command/plugin_register_test.go b/command/plugin_register_test.go
index 8d04b7733e4..8e97e0902dc 100644
--- a/command/plugin_register_test.go
+++ b/command/plugin_register_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_reload.go b/command/plugin_reload.go
index bdcd6f696ef..ea75ef630f9 100644
--- a/command/plugin_reload.go
+++ b/command/plugin_reload.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_reload_status.go b/command/plugin_reload_status.go
index c653955978a..0ce9e962663 100644
--- a/command/plugin_reload_status.go
+++ b/command/plugin_reload_status.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_reload_test.go b/command/plugin_reload_test.go
index d84062d8d25..54569521e1c 100644
--- a/command/plugin_reload_test.go
+++ b/command/plugin_reload_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -108,14 +108,18 @@ func TestPluginReloadCommand_Run(t *testing.T) {
 		ui, cmd := testPluginReloadCommand(t)
 		cmd.client = client
 
-		if err := client.Sys().RegisterPlugin(&api.RegisterPluginInput{
+		resp, err := client.Sys().RegisterPluginDetailed(&api.RegisterPluginInput{
 			Name:    pluginName,
 			Type:    api.PluginTypeCredential,
 			Command: pluginName,
 			SHA256:  sha256Sum,
-		}); err != nil {
+		})
+		if err != nil {
 			t.Fatal(err)
 		}
+		if len(resp.Warnings) > 0 {
+			t.Errorf("expected no warnings, got: %v", resp.Warnings)
+		}
 
 		code := cmd.Run([]string{
 			"-plugin", pluginName,
diff --git a/command/plugin_runtime.go b/command/plugin_runtime.go
index ce15bb31fdb..e8647230f78 100644
--- a/command/plugin_runtime.go
+++ b/command/plugin_runtime.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_runtime_deregister.go b/command/plugin_runtime_deregister.go
index 47b790f2cc0..41cff05700e 100644
--- a/command/plugin_runtime_deregister.go
+++ b/command/plugin_runtime_deregister.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_runtime_deregister_test.go b/command/plugin_runtime_deregister_test.go
index 1569fceb3f1..c770dd9e97f 100644
--- a/command/plugin_runtime_deregister_test.go
+++ b/command/plugin_runtime_deregister_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_runtime_info.go b/command/plugin_runtime_info.go
index 22c95a23357..35b57bd18ba 100644
--- a/command/plugin_runtime_info.go
+++ b/command/plugin_runtime_info.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_runtime_info_test.go b/command/plugin_runtime_info_test.go
index 40166b094bf..d78a4df381c 100644
--- a/command/plugin_runtime_info_test.go
+++ b/command/plugin_runtime_info_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_runtime_list.go b/command/plugin_runtime_list.go
index 64cca1805f6..d2c3c0b43d8 100644
--- a/command/plugin_runtime_list.go
+++ b/command/plugin_runtime_list.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_runtime_list_test.go b/command/plugin_runtime_list_test.go
index 8f8d209ca41..06e91157e13 100644
--- a/command/plugin_runtime_list_test.go
+++ b/command/plugin_runtime_list_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_runtime_register.go b/command/plugin_runtime_register.go
index 175be302f51..d0ab7e6fc54 100644
--- a/command/plugin_runtime_register.go
+++ b/command/plugin_runtime_register.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_runtime_register_test.go b/command/plugin_runtime_register_test.go
index 3b28587cf62..615043fb3bd 100644
--- a/command/plugin_runtime_register_test.go
+++ b/command/plugin_runtime_register_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/plugin_test.go b/command/plugin_test.go
index 2e72bb7c189..97eeea83252 100644
--- a/command/plugin_test.go
+++ b/command/plugin_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -45,15 +45,19 @@ func testPluginCreateAndRegister(tb testing.TB, client *api.Client, dir, name st
 
 	pth, sha256Sum := testPluginCreate(tb, dir, name)
 
-	if err := client.Sys().RegisterPlugin(&api.RegisterPluginInput{
+	resp, err := client.Sys().RegisterPluginDetailed(&api.RegisterPluginInput{
 		Name:    name,
 		Type:    pluginType,
 		Command: name,
 		SHA256:  sha256Sum,
 		Version: version,
-	}); err != nil {
+	})
+	if err != nil {
 		tb.Fatal(err)
 	}
+	if len(resp.Warnings) > 0 {
+		tb.Errorf("expected no warnings, got: %v", resp.Warnings)
+	}
 
 	return pth, sha256Sum
 }
@@ -64,15 +68,19 @@ func testPluginCreateAndRegisterVersioned(tb testing.TB, client *api.Client, dir
 
 	pth, sha256Sum := testPluginCreate(tb, dir, name)
 
-	if err := client.Sys().RegisterPlugin(&api.RegisterPluginInput{
+	resp, err := client.Sys().RegisterPluginDetailed(&api.RegisterPluginInput{
 		Name:    name,
 		Type:    pluginType,
 		Command: name,
 		SHA256:  sha256Sum,
 		Version: "v1.0.0",
-	}); err != nil {
+	})
+	if err != nil {
 		tb.Fatal(err)
 	}
+	if len(resp.Warnings) > 0 {
+		tb.Errorf("expected no warnings, got: %v", resp.Warnings)
+	}
 
 	return pth, sha256Sum, "v1.0.0"
 }
diff --git a/command/policy.go b/command/policy.go
index 5e5f61bb2d7..8d4a1211040 100644
--- a/command/policy.go
+++ b/command/policy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/policy_delete.go b/command/policy_delete.go
index d5c3b8aabc1..d3e241adc1c 100644
--- a/command/policy_delete.go
+++ b/command/policy_delete.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/policy_delete_test.go b/command/policy_delete_test.go
index 6b3bd01e3f3..06068110b21 100644
--- a/command/policy_delete_test.go
+++ b/command/policy_delete_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/policy_fmt.go b/command/policy_fmt.go
index ea3dd2ab995..b34da8a7260 100644
--- a/command/policy_fmt.go
+++ b/command/policy_fmt.go
@@ -1,9 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
 
 import (
+	"bytes"
 	"fmt"
 	"io/ioutil"
 	"strings"
@@ -11,6 +12,7 @@ import (
 	"github.com/hashicorp/cli"
 	"github.com/hashicorp/hcl/hcl/printer"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/vault"
 	homedir "github.com/mitchellh/go-homedir"
 	"github.com/posener/complete"
@@ -93,17 +95,34 @@ func (c *PolicyFmtCommand) Run(args []string) int {
 
 	// Actually parse the policy. We always use the root namespace here because
 	// we don't want to modify the results.
-	if _, err := vault.ParseACLPolicy(namespace.RootNamespace, string(b)); err != nil {
+	// TODO (HCL_DUP_KEYS_DEPRECATION): Revert back to ParseACLPolicy once the deprecation is done
+	_, duplicate, err := vault.ParseACLPolicyCheckDuplicates(namespace.RootNamespace, string(b))
+	if err != nil {
 		c.UI.Error(err.Error())
 		return 1
 	}
+	if duplicate {
+		c.UI.Warn("WARNING: Duplicate keys found in the provided policy, duplicate keys in HCL files are deprecated and will be forbidden in a future release.")
+	}
 
-	// Generate final contents
-	result, err := printer.Format(b)
+	// TODO (HCL_DUP_KEYS_DEPRECATION): Restore commented code and remove section below once deprecation is done
+	//result, err := printer.Format(b)
+	//if err != nil {
+	//	c.UI.Error(fmt.Sprintf("Error printing result: %s", err))
+	//	return 1
+	//}
+	ast, _, err := random.ParseAndCheckForDuplicateHclAttributes(string(b))
 	if err != nil {
+		c.UI.Error(err.Error())
+		return 1
+	}
+	var buf bytes.Buffer
+	if err := printer.DefaultConfig.Fprint(&buf, ast); err != nil {
 		c.UI.Error(fmt.Sprintf("Error printing result: %s", err))
 		return 1
 	}
+	buf.WriteString("\n")
+	result := buf.Bytes()
 
 	// Write them back out
 	if err := ioutil.WriteFile(path, result, 0o644); err != nil {
diff --git a/command/policy_fmt_test.go b/command/policy_fmt_test.go
index 41de53c9e6c..392a1da2afe 100644
--- a/command/policy_fmt_test.go
+++ b/command/policy_fmt_test.go
@@ -1,15 +1,16 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
 
 import (
-	"io/ioutil"
 	"os"
 	"strings"
 	"testing"
 
 	"github.com/hashicorp/cli"
+	"github.com/hashicorp/vault/helper/random"
+	"github.com/stretchr/testify/require"
 )
 
 func testPolicyFmtCommand(tb testing.TB) (*cli.MockUi, *PolicyFmtCommand) {
@@ -24,213 +25,128 @@ func testPolicyFmtCommand(tb testing.TB) (*cli.MockUi, *PolicyFmtCommand) {
 }
 
 func TestPolicyFmtCommand_Run(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name string
-		args []string
-		out  string
-		code int
+	testCases := map[string]struct {
+		args      []string
+		envVars   map[string]string
+		policyArg string
+		out       string
+		expected  string
+		code      int
 	}{
-		{
-			"not_enough_args",
-			[]string{},
-			"Not enough arguments",
-			1,
+		"not_enough_args": {
+			args: []string{},
+			out:  "Not enough arguments",
+			code: 1,
 		},
-		{
-			"too_many_args",
-			[]string{"foo", "bar"},
-			"Too many arguments",
-			1,
+		"too_many_args": {
+			args: []string{"foo", "bar"},
+			out:  "Too many arguments",
+			code: 1,
 		},
-	}
-
-	t.Run("validations", func(t *testing.T) {
-		t.Parallel()
+		"default": {
+			policyArg: `
+path "secret" {
+  capabilities  =           ["create",    "update","delete"]
 
-		for _, tc := range cases {
-			tc := tc
+}`,
+			expected: `
+path "secret" {
+  capabilities = ["create", "update", "delete"]
+}
+`,
+			code: 0,
+		},
+		"bad_hcl": {
+			policyArg: `dafdaf`,
+			out:       "failed to parse policy",
+			code:      1,
+		},
+		"bad_policy": {
+			policyArg: `banana "foo" {}`,
+			out:       "failed to parse policy",
+			code:      1,
+		},
+		"bad_policy2": {
+			policyArg: `path "secret" { capabilities = ["bogus"] }`,
+			out:       "failed to parse policy",
+			code:      1,
+		},
+		// TODO (HCL_DUP_KEYS_DEPRECATION): remove this test once deprecation is fully done
+		"hcl_duplicate_key_env_set": {
+			policyArg: `
+path "secret" {
+  capabilities = ["create", "update", "delete"]
+  capabilities = ["create"]
+}
+`,
+			envVars: map[string]string{random.AllowHclDuplicatesEnvVar: "true"},
+			code:    0,
+			out:     "WARNING: Duplicate keys found in the provided policy, duplicate keys in HCL files are deprecated and will be forbidden in a future release.",
+		},
+		"hcl_duplicate_key_env_not_set": {
+			policyArg: `
+path "secret" {
+  capabilities = ["create", "update", "delete"]
+  capabilities = ["create"]
+}
+`,
+			code: 1,
+			out:  "failed to parse policy: The argument \"capabilities\" at 4:3 was already set. Each argument can only be defined once",
+		},
+		"hcl_duplicate_key_env_set_to_false": {
+			policyArg: `
+path "secret" {
+  capabilities = ["create", "update", "delete"]
+  capabilities = ["create"]
+}
+`,
+			envVars: map[string]string{random.AllowHclDuplicatesEnvVar: "false"},
+			code:    1,
+			out:     "failed to parse policy: The argument \"capabilities\" at 4:3 was already set. Each argument can only be defined once",
+		},
+	}
 
-			t.Run(tc.name, func(t *testing.T) {
-				t.Parallel()
+	client, closer := testVaultServer(t)
+	t.Cleanup(closer)
 
-				client, closer := testVaultServer(t)
-				defer closer()
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			r := require.New(t)
 
-				ui, cmd := testPolicyFmtCommand(t)
-				cmd.client = client
+			for k, v := range tc.envVars {
+				t.Setenv(k, v)
+			}
 
-				code := cmd.Run(tc.args)
-				if code != tc.code {
-					t.Errorf("expected %d to be %d", code, tc.code)
-				}
+			args := tc.args
+			if tc.policyArg != "" {
+				f := populateTempFile(t, "fmt-test-*.hcl", tc.policyArg)
+				args = append(args, f.Name())
+			}
 
-				combined := ui.OutputWriter.String() + ui.ErrorWriter.String()
-				if !strings.Contains(combined, tc.out) {
-					t.Errorf("expected %q to contain %q", combined, tc.out)
-				}
-			})
-		}
-	})
+			ui, cmd := testPolicyFmtCommand(t)
+			cmd.client = client
 
-	t.Run("default", func(t *testing.T) {
-		t.Parallel()
+			code := cmd.Run(args)
+			r.Equal(tc.code, code)
 
-		policy := strings.TrimSpace(`
-path "secret" {
-  capabilities  =           ["create",    "update","delete"]
+			if tc.out != "" {
+				t.Log(ui.ErrorWriter.String())
+				r.Contains(ui.ErrorWriter.String(), tc.out)
+			}
 
-}
-`)
-
-		f, err := ioutil.TempFile("", "")
-		if err != nil {
-			t.Fatal(err)
-		}
-		defer os.Remove(f.Name())
-		if _, err := f.WriteString(policy); err != nil {
-			t.Fatal(err)
-		}
-		f.Close()
-
-		client, closer := testVaultServer(t)
-		defer closer()
-
-		_, cmd := testPolicyFmtCommand(t)
-		cmd.client = client
-
-		code := cmd.Run([]string{
-			f.Name(),
+			if tc.expected != "" {
+				contents, err := os.ReadFile(args[0])
+				r.NoError(err)
+				r.Equal(strings.TrimSpace(tc.expected), strings.TrimSpace(string(contents)))
+			}
 		})
-		if exp := 0; code != exp {
-			t.Errorf("expected %d to be %d", code, exp)
-		}
-
-		expected := strings.TrimSpace(`
-path "secret" {
-  capabilities = ["create", "update", "delete"]
+	}
 }
-`) + "\n"
-
-		contents, err := ioutil.ReadFile(f.Name())
-		if err != nil {
-			t.Fatal(err)
-		}
-		if string(contents) != expected {
-			t.Errorf("expected %q to be %q", string(contents), expected)
-		}
-	})
-
-	t.Run("bad_hcl", func(t *testing.T) {
-		t.Parallel()
-
-		policy := `dafdaf`
-
-		f, err := ioutil.TempFile("", "")
-		if err != nil {
-			t.Fatal(err)
-		}
-		defer os.Remove(f.Name())
-		if _, err := f.WriteString(policy); err != nil {
-			t.Fatal(err)
-		}
-		f.Close()
-
-		client, closer := testVaultServer(t)
-		defer closer()
-
-		ui, cmd := testPolicyFmtCommand(t)
-		cmd.client = client
-
-		code := cmd.Run([]string{
-			f.Name(),
-		})
-		if exp := 1; code != exp {
-			t.Errorf("expected %d to be %d", code, exp)
-		}
-
-		stderr := ui.ErrorWriter.String()
-		expected := "failed to parse policy"
-		if !strings.Contains(stderr, expected) {
-			t.Errorf("expected %q to include %q", stderr, expected)
-		}
-	})
-
-	t.Run("bad_policy", func(t *testing.T) {
-		t.Parallel()
-
-		policy := `banana "foo" {}`
-
-		f, err := ioutil.TempFile("", "")
-		if err != nil {
-			t.Fatal(err)
-		}
-		defer os.Remove(f.Name())
-		if _, err := f.WriteString(policy); err != nil {
-			t.Fatal(err)
-		}
-		f.Close()
-
-		client, closer := testVaultServer(t)
-		defer closer()
-
-		ui, cmd := testPolicyFmtCommand(t)
-		cmd.client = client
-
-		code := cmd.Run([]string{
-			f.Name(),
-		})
-		if exp := 1; code != exp {
-			t.Errorf("expected %d to be %d", code, exp)
-		}
-
-		stderr := ui.ErrorWriter.String()
-		expected := "failed to parse policy"
-		if !strings.Contains(stderr, expected) {
-			t.Errorf("expected %q to include %q", stderr, expected)
-		}
-	})
-
-	t.Run("bad_policy", func(t *testing.T) {
-		t.Parallel()
-
-		policy := `path "secret/" { capabilities = ["bogus"] }`
-
-		f, err := ioutil.TempFile("", "")
-		if err != nil {
-			t.Fatal(err)
-		}
-		defer os.Remove(f.Name())
-		if _, err := f.WriteString(policy); err != nil {
-			t.Fatal(err)
-		}
-		f.Close()
-
-		client, closer := testVaultServer(t)
-		defer closer()
-
-		ui, cmd := testPolicyFmtCommand(t)
-		cmd.client = client
-
-		code := cmd.Run([]string{
-			f.Name(),
-		})
-		if exp := 1; code != exp {
-			t.Errorf("expected %d to be %d", code, exp)
-		}
-
-		stderr := ui.ErrorWriter.String()
-		expected := "failed to parse policy"
-		if !strings.Contains(stderr, expected) {
-			t.Errorf("expected %q to include %q", stderr, expected)
-		}
-	})
-
-	t.Run("no_tabs", func(t *testing.T) {
-		t.Parallel()
-
-		_, cmd := testPolicyFmtCommand(t)
-		assertNoTabs(t, cmd)
-	})
+
+// TestPolicyFmtCommandNoTabs asserts the CLI help has no tab characters.
+func TestPolicyFmtCommandNoTabs(t *testing.T) {
+	t.Parallel()
+
+	_, cmd := testPolicyFmtCommand(t)
+	assertNoTabs(t, cmd)
 }
diff --git a/command/policy_list.go b/command/policy_list.go
index 147efb97167..cb2cdabdaaa 100644
--- a/command/policy_list.go
+++ b/command/policy_list.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/policy_list_test.go b/command/policy_list_test.go
index c603d310fcd..aec04c1b107 100644
--- a/command/policy_list_test.go
+++ b/command/policy_list_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/policy_read.go b/command/policy_read.go
index dd7a698de65..40bff05c7fb 100644
--- a/command/policy_read.go
+++ b/command/policy_read.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/policy_read_test.go b/command/policy_read_test.go
index e18298e5115..00152fc936c 100644
--- a/command/policy_read_test.go
+++ b/command/policy_read_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/policy_write.go b/command/policy_write.go
index 193c9496880..19568a17077 100644
--- a/command/policy_write.go
+++ b/command/policy_write.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/policy_write_test.go b/command/policy_write_test.go
index 64f67eb2a8b..4a67f229a34 100644
--- a/command/policy_write_test.go
+++ b/command/policy_write_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/print.go b/command/print.go
index d5e3b2a5529..e0e0499c52f 100644
--- a/command/print.go
+++ b/command/print.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/print_token.go b/command/print_token.go
index 9402e8a1523..a5ecc1bb9b9 100644
--- a/command/print_token.go
+++ b/command/print_token.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/proxy.go b/command/proxy.go
index 79138d745ba..1018ee99f5a 100644
--- a/command/proxy.go
+++ b/command/proxy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -12,9 +12,11 @@ import (
 	"net"
 	"net/http"
 	"os"
+	"path/filepath"
 	"sort"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	systemd "github.com/coreos/go-systemd/daemon"
@@ -70,6 +72,7 @@ type ProxyCommand struct {
 
 	ShutdownCh chan struct{}
 	SighupCh   chan struct{}
+	SigUSR2Ch  chan struct{}
 
 	tlsReloadFuncsLock sync.RWMutex
 	tlsReloadFuncs     []reloadutil.ReloadFunc
@@ -519,7 +522,8 @@ func (c *ProxyCommand) Run(args []string) int {
 				LeaseCache: leaseCache,
 				Logger:     c.logger.Named("cache.staticsecretcapabilitymanager"),
 				Client:     client,
-				StaticSecretTokenCapabilityRefreshInterval: config.Cache.StaticSecretTokenCapabilityRefreshInterval,
+				StaticSecretTokenCapabilityRefreshInterval:  config.Cache.StaticSecretTokenCapabilityRefreshInterval,
+				StaticSecretTokenCapabilityRefreshBehaviour: config.Cache.StaticSecretTokenCapabilityRefreshBehaviour,
 			})
 			if err != nil {
 				c.UI.Error(fmt.Sprintf("Error creating static secret capability manager: %v", err))
@@ -529,6 +533,58 @@ func (c *ProxyCommand) Run(args []string) int {
 		}
 	}
 
+	// Create the AuthHandler and the Sink Server so that we can pass AuthHandler struct
+	// values into the Proxy http.Handler. We will wait to actually start these servers
+	// once we have configured handlers for each listener below
+	authInProgress := &atomic.Bool{}
+	invalidTokenErrCh := make(chan error)
+	var ah *auth.AuthHandler
+	var ss *sink.SinkServer
+	if method != nil {
+		// Auth Handler is going to set its own retry values, so we want to
+		// work on a copy of the client to not affect other subsystems.
+		ahClient, err := c.client.CloneWithHeaders()
+		if err != nil {
+			c.UI.Error(fmt.Sprintf("Error cloning client for auth handler: %v", err))
+			return 1
+		}
+
+		// Override the set namespace with the auto-auth specific namespace
+		if !namespaceSetByEnvironmentVariable && config.AutoAuth.Method.Namespace != "" {
+			ahClient.SetNamespace(config.AutoAuth.Method.Namespace)
+		}
+
+		if config.DisableIdleConnsAutoAuth {
+			ahClient.SetMaxIdleConnections(-1)
+		}
+
+		if config.DisableKeepAlivesAutoAuth {
+			ahClient.SetDisableKeepAlives(true)
+		}
+
+		ah = auth.NewAuthHandler(&auth.AuthHandlerConfig{
+			Logger:                       c.logger.Named("auth.handler"),
+			Client:                       ahClient,
+			WrapTTL:                      config.AutoAuth.Method.WrapTTL,
+			MinBackoff:                   config.AutoAuth.Method.MinBackoff,
+			MaxBackoff:                   config.AutoAuth.Method.MaxBackoff,
+			EnableReauthOnNewCredentials: config.AutoAuth.EnableReauthOnNewCredentials,
+			Token:                        previousToken,
+			ExitOnError:                  config.AutoAuth.Method.ExitOnError,
+			UserAgent:                    useragent.ProxyAutoAuthString(),
+			MetricsSignifier:             "proxy",
+		})
+
+		authInProgress = ah.AuthInProgress
+		invalidTokenErrCh = ah.InvalidToken
+
+		ss = sink.NewSinkServer(&sink.SinkServerConfig{
+			Logger:        c.logger.Named("sink.server"),
+			Client:        ahClient,
+			ExitAfterAuth: config.ExitAfterAuth,
+		})
+	}
+
 	var listeners []net.Listener
 
 	// Ensure we've added all the reload funcs for TLS before anyone triggers a reload.
@@ -548,6 +604,7 @@ func (c *ProxyCommand) Run(args []string) int {
 			lnBundle, err := cache.StartListener(lnConfig)
 			if err != nil {
 				c.UI.Error(fmt.Sprintf("Error starting listener: %v", err))
+				c.tlsReloadFuncsLock.Unlock()
 				return 1
 			}
 
@@ -560,31 +617,31 @@ func (c *ProxyCommand) Run(args []string) int {
 
 		listeners = append(listeners, ln)
 
-		proxyVaultToken := true
-		var inmemSink sink.Sink
+		apiProxyLogger.Debug("configuring inmem auto-auth sink")
+		inmemSink, err := inmem.New(&sink.SinkConfig{
+			Logger: apiProxyLogger,
+		}, leaseCache)
+		if err != nil {
+			c.UI.Error(fmt.Sprintf("Error creating inmem sink for cache: %v", err))
+			c.tlsReloadFuncsLock.Unlock()
+			return 1
+		}
+		sinks = append(sinks, &sink.SinkConfig{
+			Logger: apiProxyLogger,
+			Sink:   inmemSink,
+		})
+		useAutoAuthToken := false
+		forceAutoAuthToken := false
 		if config.APIProxy != nil {
-			if config.APIProxy.UseAutoAuthToken {
-				apiProxyLogger.Debug("configuring inmem auto-auth sink")
-				inmemSink, err = inmem.New(&sink.SinkConfig{
-					Logger: apiProxyLogger,
-				}, leaseCache)
-				if err != nil {
-					c.UI.Error(fmt.Sprintf("Error creating inmem sink for cache: %v", err))
-					return 1
-				}
-				sinks = append(sinks, &sink.SinkConfig{
-					Logger: apiProxyLogger,
-					Sink:   inmemSink,
-				})
-			}
-			proxyVaultToken = !config.APIProxy.ForceAutoAuthToken
+			useAutoAuthToken = config.APIProxy.UseAutoAuthToken
+			forceAutoAuthToken = config.APIProxy.ForceAutoAuthToken
 		}
 
 		var muxHandler http.Handler
 		if leaseCache != nil {
-			muxHandler = cache.ProxyHandler(ctx, apiProxyLogger, leaseCache, inmemSink, proxyVaultToken)
+			muxHandler = cache.ProxyHandler(ctx, apiProxyLogger, leaseCache, inmemSink, forceAutoAuthToken, useAutoAuthToken, authInProgress, invalidTokenErrCh)
 		} else {
-			muxHandler = cache.ProxyHandler(ctx, apiProxyLogger, apiProxy, inmemSink, proxyVaultToken)
+			muxHandler = cache.ProxyHandler(ctx, apiProxyLogger, apiProxy, inmemSink, forceAutoAuthToken, useAutoAuthToken, authInProgress, invalidTokenErrCh)
 		}
 
 		// Parse 'require_request_header' listener config option, and wrap
@@ -660,6 +717,16 @@ func (c *ProxyCommand) Run(args []string) int {
 				case c.reloadedCh <- struct{}{}:
 				default:
 				}
+			case <-c.SigUSR2Ch:
+				pprofPath := filepath.Join(os.TempDir(), "vault-proxy-pprof")
+				cpuProfileDuration := time.Second * 1
+				err := WritePprofToFile(pprofPath, cpuProfileDuration)
+				if err != nil {
+					c.logger.Error(err.Error())
+					continue
+				}
+
+				c.logger.Info(fmt.Sprintf("Wrote pprof files to: %s", pprofPath))
 			case <-ctx.Done():
 				return nil
 			}
@@ -690,46 +757,6 @@ func (c *ProxyCommand) Run(args []string) int {
 
 	// Start auto-auth and sink servers
 	if method != nil {
-		// Auth Handler is going to set its own retry values, so we want to
-		// work on a copy of the client to not affect other subsystems.
-		ahClient, err := c.client.CloneWithHeaders()
-		if err != nil {
-			c.UI.Error(fmt.Sprintf("Error cloning client for auth handler: %v", err))
-			return 1
-		}
-
-		// Override the set namespace with the auto-auth specific namespace
-		if !namespaceSetByEnvironmentVariable && config.AutoAuth.Method.Namespace != "" {
-			ahClient.SetNamespace(config.AutoAuth.Method.Namespace)
-		}
-
-		if config.DisableIdleConnsAutoAuth {
-			ahClient.SetMaxIdleConnections(-1)
-		}
-
-		if config.DisableKeepAlivesAutoAuth {
-			ahClient.SetDisableKeepAlives(true)
-		}
-
-		ah := auth.NewAuthHandler(&auth.AuthHandlerConfig{
-			Logger:                       c.logger.Named("auth.handler"),
-			Client:                       ahClient,
-			WrapTTL:                      config.AutoAuth.Method.WrapTTL,
-			MinBackoff:                   config.AutoAuth.Method.MinBackoff,
-			MaxBackoff:                   config.AutoAuth.Method.MaxBackoff,
-			EnableReauthOnNewCredentials: config.AutoAuth.EnableReauthOnNewCredentials,
-			Token:                        previousToken,
-			ExitOnError:                  config.AutoAuth.Method.ExitOnError,
-			UserAgent:                    useragent.ProxyAutoAuthString(),
-			MetricsSignifier:             "proxy",
-		})
-
-		ss := sink.NewSinkServer(&sink.SinkServerConfig{
-			Logger:        c.logger.Named("sink.server"),
-			Client:        ahClient,
-			ExitAfterAuth: config.ExitAfterAuth,
-		})
-
 		g.Add(func() error {
 			return ah.Run(ctx, method)
 		}, func(error) {
@@ -742,7 +769,7 @@ func (c *ProxyCommand) Run(args []string) int {
 		})
 
 		g.Add(func() error {
-			err := ss.Run(ctx, ah.OutputCh, sinks)
+			err := ss.Run(ctx, ah.OutputCh, sinks, ah.AuthInProgress)
 			c.logger.Info("sinks finished, exiting")
 
 			// Start goroutine to drain from ah.OutputCh from this point onward
@@ -771,7 +798,7 @@ func (c *ProxyCommand) Run(args []string) int {
 	// Add the static secret cache updater, if appropriate
 	if updater != nil {
 		g.Add(func() error {
-			err := updater.Run(ctx)
+			err := updater.Run(ctx, authInProgress, invalidTokenErrCh)
 			return err
 		}, func(error) {
 			cancelFunc()
@@ -838,10 +865,11 @@ func (c *ProxyCommand) applyConfigOverrides(f *FlagSets, config *proxyConfig.Con
 	})
 
 	c.setStringFlag(f, config.Vault.Address, &StringVar{
-		Name:    flagNameAddress,
-		Target:  &c.flagAddress,
-		Default: "https://127.0.0.1:8200",
-		EnvVar:  api.EnvVaultAddress,
+		Name:        flagNameAddress,
+		Target:      &c.flagAddress,
+		Default:     "https://127.0.0.1:8200",
+		EnvVar:      api.EnvVaultAddress,
+		Normalizers: []func(string) string{configutil.NormalizeAddr},
 	})
 	config.Vault.Address = c.flagAddress
 	c.setStringFlag(f, config.Vault.CACert, &StringVar{
@@ -915,13 +943,13 @@ func (c *ProxyCommand) setStringFlag(f *FlagSets, configVal string, fVar *String
 		// Don't do anything as the flag is already set from the command line
 	case flagEnvSet:
 		// Use value from env var
-		*fVar.Target = flagEnvValue
+		fVar.SetTarget(flagEnvValue)
 	case configVal != "":
 		// Use value from config
-		*fVar.Target = configVal
+		fVar.SetTarget(configVal)
 	default:
 		// Use the default value
-		*fVar.Target = fVar.Default
+		fVar.SetTarget(fVar.Default)
 	}
 }
 
@@ -1094,12 +1122,17 @@ func (c *ProxyCommand) loadConfig(paths []string) (*proxyConfig.Config, error) {
 	cfg := proxyConfig.NewConfig()
 
 	for _, configPath := range paths {
-		configFromPath, err := proxyConfig.LoadConfig(configPath)
+		// TODO (HCL_DUP_KEYS_DEPRECATION): go back to proxyConfig.LoadConfig and remove duplicate when deprecation is done
+		configFromPath, duplicate, err := proxyConfig.LoadConfigCheckDuplicate(configPath)
 		if err != nil {
 			errors = multierror.Append(errors, fmt.Errorf("error loading configuration from %s: %w", configPath, err))
 		} else {
 			cfg = cfg.Merge(configFromPath)
 		}
+		if duplicate {
+			c.UI.Warn(fmt.Sprintf(
+				"WARNING: Duplicate keys found in the Vault proxy configuration file %q, duplicate keys in HCL files are deprecated and will be forbidden in a future release.", configPath))
+		}
 	}
 
 	if errors != nil {
diff --git a/command/proxy/config/config.go b/command/proxy/config/config.go
index d22b74fad83..520abeb0a6f 100644
--- a/command/proxy/config/config.go
+++ b/command/proxy/config/config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package config
@@ -11,6 +11,7 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 
@@ -21,6 +22,7 @@ import (
 	"github.com/hashicorp/hcl/hcl/ast"
 	"github.com/hashicorp/vault/command/agentproxyshared"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/internalshared/configutil"
 )
 
@@ -109,6 +111,7 @@ type Cache struct {
 	DisableCachingDynamicSecrets                  bool                            `hcl:"disable_caching_dynamic_secrets"`
 	StaticSecretTokenCapabilityRefreshIntervalRaw interface{}                     `hcl:"static_secret_token_capability_refresh_interval"`
 	StaticSecretTokenCapabilityRefreshInterval    time.Duration                   `hcl:"-"`
+	StaticSecretTokenCapabilityRefreshBehaviour   string                          `hcl:"static_secret_token_capability_refresh_behavior"`
 }
 
 // AutoAuth is the configured authentication method and sinks
@@ -116,8 +119,6 @@ type AutoAuth struct {
 	Method *Method `hcl:"-"`
 	Sinks  []*Sink `hcl:"sinks"`
 
-	// NOTE: This is unsupported outside of testing and may disappear at any
-	// time.
 	EnableReauthOnNewCredentials bool `hcl:"enable_reauth_on_new_credentials"`
 }
 
@@ -271,37 +272,62 @@ func (c *Config) ValidateConfig() error {
 		return fmt.Errorf("no auto_auth, cache, or listener block found in config")
 	}
 
+	if c.Cache != nil && c.Cache.StaticSecretTokenCapabilityRefreshBehaviour != "" {
+		switch c.Cache.StaticSecretTokenCapabilityRefreshBehaviour {
+		case "pessimistic":
+		case "optimistic":
+		default:
+			return fmt.Errorf("cache.static_secret_token_capability_refresh_behavior must be either \"optimistic\" or \"pessimistic\"")
+		}
+	}
+
 	return nil
 }
 
 // LoadConfig loads the configuration at the given path, regardless if
 // it's a file or directory.
 func LoadConfig(path string) (*Config, error) {
+	cfg, _, err := LoadConfigCheckDuplicate(path)
+	return cfg, err
+}
+
+// LoadConfigCheckDuplicate is the same as the above but adds the ability to check if the HCL config file has
+// duplicate attributes.
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only LoadConfig once deprecation is complete
+func LoadConfigCheckDuplicate(path string) (cfg *Config, duplicate bool, err error) {
 	fi, err := os.Stat(path)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	if fi.IsDir() {
-		return LoadConfigDir(path)
+		return LoadConfigDirCheckDuplicate(path)
 	}
-	return LoadConfigFile(path)
+	return LoadConfigFileCheckDuplicate(path)
 }
 
 // LoadConfigDir loads the configuration at the given path if it's a directory
 func LoadConfigDir(dir string) (*Config, error) {
+	cfg, _, err := LoadConfigDirCheckDuplicate(dir)
+	return cfg, err
+}
+
+// LoadConfigDirCheckDuplicate is the same as the above but adds the ability to check if the HCL config file has
+// duplicate attributes.
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only LoadConfigDir once deprecation is complete
+func LoadConfigDirCheckDuplicate(dir string) (cfg *Config, duplicate bool, err error) {
 	f, err := os.Open(dir)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 	defer f.Close()
 
 	fi, err := f.Stat()
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 	if !fi.IsDir() {
-		return nil, fmt.Errorf("configuration path must be a directory: %q", dir)
+		return nil, false, fmt.Errorf("configuration path must be a directory: %q", dir)
 	}
 
 	var files []string
@@ -310,7 +336,7 @@ func LoadConfigDir(dir string) (*Config, error) {
 		var fis []os.FileInfo
 		fis, err = f.Readdir(128)
 		if err != nil && err != io.EOF {
-			return nil, err
+			return nil, false, err
 		}
 
 		for _, fi := range fis {
@@ -338,10 +364,11 @@ func LoadConfigDir(dir string) (*Config, error) {
 
 	result := NewConfig()
 	for _, f := range files {
-		config, err := LoadConfigFile(f)
+		config, dup, err := LoadConfigFileCheckDuplicate(f)
 		if err != nil {
-			return nil, fmt.Errorf("error loading %q: %w", f, err)
+			return nil, duplicate, fmt.Errorf("error loading %q: %w", f, err)
 		}
+		duplicate = duplicate || dup
 
 		if result == nil {
 			result = config
@@ -350,7 +377,7 @@ func LoadConfigDir(dir string) (*Config, error) {
 		}
 	}
 
-	return result, nil
+	return result, duplicate, nil
 }
 
 // isTemporaryFile returns true or false depending on whether the
@@ -363,26 +390,35 @@ func isTemporaryFile(name string) bool {
 }
 
 // LoadConfigFile loads the configuration at the given path if it's a file
-func LoadConfigFile(path string) (*Config, error) {
+func LoadConfigFile(path string) (cfg *Config, err error) {
+	cfg, _, err = LoadConfigFileCheckDuplicate(path)
+	return cfg, err
+}
+
+// LoadConfigFileCheckDuplicate is the same as the above but adds the ability to check if the HCL config file has
+// duplicate attributes.
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only LoadConfigFile once deprecation is complete
+func LoadConfigFileCheckDuplicate(path string) (cfg *Config, duplicate bool, err error) {
 	fi, err := os.Stat(path)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	if fi.IsDir() {
-		return nil, fmt.Errorf("location is a directory, not a file")
+		return nil, false, fmt.Errorf("location is a directory, not a file")
 	}
 
 	// Read the file
 	d, err := os.ReadFile(path)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	// Parse!
-	obj, err := hcl.Parse(string(d))
+	// TODO (HCL_DUP_KEYS_DEPRECATION): Return to hcl.Parse once deprecation is complete
+	obj, duplicate, err := random.ParseAndCheckForDuplicateHclAttributes(string(d))
 	if err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
 
 	// Attribute
@@ -396,13 +432,15 @@ func LoadConfigFile(path string) (*Config, error) {
 	// Start building the result
 	result := NewConfig()
 	if err := hcl.DecodeObject(result, obj); err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
 
-	sharedConfig, err := configutil.ParseConfig(string(d))
+	// TODO (HCL_DUP_KEYS_DEPRECATION): Return to configutil.ParseConfig once deprecation is complete
+	sharedConfig, dup, err := configutil.ParseConfigCheckDuplicate(string(d))
 	if err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
+	duplicate = duplicate || dup
 
 	// Pruning custom headers for Vault for now
 	for _, ln := range sharedConfig.Listeners {
@@ -413,24 +451,24 @@ func LoadConfigFile(path string) (*Config, error) {
 
 	list, ok := obj.Node.(*ast.ObjectList)
 	if !ok {
-		return nil, fmt.Errorf("error parsing: file doesn't contain a root object")
+		return nil, duplicate, fmt.Errorf("error parsing: file doesn't contain a root object")
 	}
 
 	if err := parseAutoAuth(result, list); err != nil {
-		return nil, fmt.Errorf("error parsing 'auto_auth': %w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'auto_auth': %w", err)
 	}
 
 	if err := parseCache(result, list); err != nil {
-		return nil, fmt.Errorf("error parsing 'cache':%w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'cache':%w", err)
 	}
 
 	if err := parseAPIProxy(result, list); err != nil {
-		return nil, fmt.Errorf("error parsing 'api_proxy':%w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'api_proxy':%w", err)
 	}
 
 	err = parseVault(result, list)
 	if err != nil {
-		return nil, fmt.Errorf("error parsing 'vault':%w", err)
+		return nil, duplicate, fmt.Errorf("error parsing 'vault':%w", err)
 	}
 
 	if result.Vault != nil {
@@ -449,7 +487,7 @@ func LoadConfigFile(path string) (*Config, error) {
 	if disableIdleConnsEnv := os.Getenv(DisableIdleConnsEnv); disableIdleConnsEnv != "" {
 		result.DisableIdleConns, err = parseutil.ParseCommaStringSlice(strings.ToLower(disableIdleConnsEnv))
 		if err != nil {
-			return nil, fmt.Errorf("error parsing environment variable %s: %v", DisableIdleConnsEnv, err)
+			return nil, duplicate, fmt.Errorf("error parsing environment variable %s: %v", DisableIdleConnsEnv, err)
 		}
 	}
 
@@ -462,14 +500,14 @@ func LoadConfigFile(path string) (*Config, error) {
 		case "":
 			continue
 		default:
-			return nil, fmt.Errorf("unknown disable_idle_connections value: %s", subsystem)
+			return nil, duplicate, fmt.Errorf("unknown disable_idle_connections value: %s", subsystem)
 		}
 	}
 
 	if disableKeepAlivesEnv := os.Getenv(DisableKeepAlivesEnv); disableKeepAlivesEnv != "" {
 		result.DisableKeepAlives, err = parseutil.ParseCommaStringSlice(strings.ToLower(disableKeepAlivesEnv))
 		if err != nil {
-			return nil, fmt.Errorf("error parsing environment variable %s: %v", DisableKeepAlivesEnv, err)
+			return nil, duplicate, fmt.Errorf("error parsing environment variable %s: %v", DisableKeepAlivesEnv, err)
 		}
 	}
 
@@ -482,11 +520,11 @@ func LoadConfigFile(path string) (*Config, error) {
 		case "":
 			continue
 		default:
-			return nil, fmt.Errorf("unknown disable_keep_alives value: %s", subsystem)
+			return nil, duplicate, fmt.Errorf("unknown disable_keep_alives value: %s", subsystem)
 		}
 	}
 
-	return result, nil
+	return result, duplicate, nil
 }
 
 func parseVault(result *Config, list *ast.ObjectList) error {
@@ -509,6 +547,10 @@ func parseVault(result *Config, list *ast.ObjectList) error {
 		return err
 	}
 
+	if v.Address != "" {
+		v.Address = configutil.NormalizeAddr(v.Address)
+	}
+
 	if v.TLSSkipVerifyRaw != nil {
 		v.TLSSkipVerify, err = parseutil.ParseBool(v.TLSSkipVerifyRaw)
 		if err != nil {
@@ -785,10 +827,63 @@ func parseMethod(result *Config, list *ast.ObjectList) error {
 	// Canonicalize namespace path if provided
 	m.Namespace = namespace.Canonicalize(m.Namespace)
 
+	// Normalize any configuration addresses
+	if len(m.Config) > 0 {
+		var err error
+		for k, v := range m.Config {
+			vStr, ok := v.(string)
+			if !ok {
+				continue
+			}
+			m.Config[k], err = normalizeAutoAuthMethod(m.Type, k, vStr)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
 	result.AutoAuth.Method = &m
 	return nil
 }
 
+// autoAuthMethodKeys maps an auto-auth method type to its associated
+// configuration whose values are URLs, IP addresses, or host:port style
+// addresses. All auto-auth types must have an entry in this map, otherwise our
+// normalization check will fail when parsing the storage entry config.
+// Auto-auth method types which don't contain such keys should include an empty
+// array.
+var autoAuthMethodKeys = map[string][]string{
+	"alicloud":   {""},
+	"approle":    {""},
+	"aws":        {""},
+	"azure":      {"resource"},
+	"cert":       {""},
+	"cf":         {""},
+	"gcp":        {"service_account"},
+	"jwt":        {""},
+	"ldap":       {""},
+	"kerberos":   {""},
+	"kubernetes": {""},
+	"oci":        {""},
+	"token_file": {""},
+}
+
+// normalizeAutoAuthMethod takes a storage name, a configuration key
+// and it's associated value and will normalize any URLs, IP addresses, or
+// host:port style addresses.
+func normalizeAutoAuthMethod(method string, key string, value string) (string, error) {
+	keys, ok := autoAuthMethodKeys[method]
+	if !ok {
+		return "", fmt.Errorf("unknown auto-auth method type %s", method)
+	}
+
+	if slices.Contains(keys, key) {
+		return configutil.NormalizeAddr(value), nil
+	}
+
+	return value, nil
+}
+
 func parseSinks(result *Config, list *ast.ObjectList) error {
 	name := "sink"
 
diff --git a/command/proxy/config/config_test.go b/command/proxy/config/config_test.go
index e0afc50de54..3e59f0c476a 100644
--- a/command/proxy/config/config_test.go
+++ b/command/proxy/config/config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package config
@@ -10,6 +10,7 @@ import (
 	"github.com/go-test/deep"
 	"github.com/hashicorp/vault/command/agentproxyshared"
 	"github.com/hashicorp/vault/internalshared/configutil"
+	"github.com/stretchr/testify/require"
 )
 
 // TestLoadConfigFile_ProxyCache tests loading a config file containing a cache
@@ -203,3 +204,126 @@ func TestLoadConfigFile_ProxyCacheStaticSecrets(t *testing.T) {
 		t.Fatal(diff)
 	}
 }
+
+// Test_LoadConfigFile_AutoAuth_AddrConformance verifies basic config file
+// loading in addition to RFC-5942 §4 normalization of auto-auth methods.
+// See: https://rfc-editor.org/rfc/rfc5952.html
+func Test_LoadConfigFile_AutoAuth_AddrConformance(t *testing.T) {
+	t.Parallel()
+
+	for name, method := range map[string]*Method{
+		"aws": {
+			Type:      "aws",
+			MountPath: "auth/aws",
+			Namespace: "aws-namespace/",
+			Config: map[string]any{
+				"role": "foobar",
+			},
+		},
+		"azure": {
+			Type:      "azure",
+			MountPath: "auth/azure",
+			Namespace: "azure-namespace/",
+			Config: map[string]any{
+				"authenticate_from_environment": true,
+				"role":                          "dev-role",
+				"resource":                      "https://[2001:0:0:1::1]",
+			},
+		},
+		"gcp": {
+			Type:      "gcp",
+			MountPath: "auth/gcp",
+			Namespace: "gcp-namespace/",
+			Config: map[string]any{
+				"role":            "dev-role",
+				"service_account": "https://[2001:db8:ac3:fe4::1]",
+			},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			config, err := LoadConfigFile("./test-fixtures/config-auto-auth-" + name + ".hcl")
+			require.NoError(t, err)
+
+			expected := &Config{
+				SharedConfig: &configutil.SharedConfig{
+					PidFile: "./pidfile",
+					Listeners: []*configutil.Listener{
+						{
+							Type:        "unix",
+							Address:     "/path/to/socket",
+							TLSDisable:  true,
+							SocketMode:  "configmode",
+							SocketUser:  "configuser",
+							SocketGroup: "configgroup",
+						},
+						{
+							Type:       "tcp",
+							Address:    "2001:db8::1:8200", // Normalized
+							TLSDisable: true,
+						},
+						{
+							Type:       "tcp",
+							Address:    "[2001:0:0:1::1]:3000", // Normalized
+							Role:       "metrics_only",
+							TLSDisable: true,
+						},
+						{
+							Type:        "tcp",
+							Role:        "default",
+							Address:     "2001:db8:0:1:1:1:1:1:8400", // Normalized
+							TLSKeyFile:  "/path/to/cakey.pem",
+							TLSCertFile: "/path/to/cacert.pem",
+						},
+					},
+				},
+				Vault: &Vault{
+					Address:          "https://[2001:db8::1]:8200", // Normalized
+					CACert:           "config_ca_cert",
+					CAPath:           "config_ca_path",
+					TLSSkipVerifyRaw: interface{}("true"),
+					TLSSkipVerify:    true,
+					ClientCert:       "config_client_cert",
+					ClientKey:        "config_client_key",
+					Retry: &Retry{
+						NumRetries: 12,
+					},
+				},
+				AutoAuth: &AutoAuth{
+					Method: method, // Method properties are normalized correctly
+					Sinks: []*Sink{
+						{
+							Type:   "file",
+							DHType: "curve25519",
+							DHPath: "/tmp/file-foo-dhpath",
+							AAD:    "foobar",
+							Config: map[string]interface{}{
+								"path": "/tmp/file-foo",
+							},
+						},
+					},
+				},
+				APIProxy: &APIProxy{
+					EnforceConsistency:  "always",
+					WhenInconsistent:    "retry",
+					UseAutoAuthTokenRaw: true,
+					UseAutoAuthToken:    true,
+					ForceAutoAuthToken:  false,
+				},
+				Cache: &Cache{
+					Persist: &agentproxyshared.PersistConfig{
+						Type:                    "kubernetes",
+						Path:                    "/vault/agent-cache/",
+						KeepAfterImport:         true,
+						ExitOnErr:               true,
+						ServiceAccountTokenFile: "/tmp/serviceaccount/token",
+					},
+				},
+			}
+
+			config.Prune()
+			require.EqualValues(t, expected, config)
+		})
+	}
+}
diff --git a/command/proxy/config/test-fixtures/config-auto-auth-aws.hcl b/command/proxy/config/test-fixtures/config-auto-auth-aws.hcl
new file mode 100644
index 00000000000..19987f26b9d
--- /dev/null
+++ b/command/proxy/config/test-fixtures/config-auto-auth-aws.hcl
@@ -0,0 +1,76 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+pid_file = "./pidfile"
+
+auto_auth {
+  method {
+    type      = "aws"
+    namespace = "/aws-namespace"
+    config = {
+      role = "foobar"
+    }
+  }
+
+  sink {
+    type = "file"
+    config = {
+      path = "/tmp/file-foo"
+    }
+    aad     = "foobar"
+    dh_type = "curve25519"
+    dh_path = "/tmp/file-foo-dhpath"
+  }
+}
+
+api_proxy {
+  use_auto_auth_token = true
+  enforce_consistency = "always"
+  when_inconsistent   = "retry"
+}
+
+cache {
+  persist = {
+    type                       = "kubernetes"
+    path                       = "/vault/agent-cache/"
+    keep_after_import          = true
+    exit_on_err                = true
+    service_account_token_file = "/tmp/serviceaccount/token"
+  }
+}
+
+listener "unix" {
+  address      = "/path/to/socket"
+  tls_disable  = true
+  socket_mode  = "configmode"
+  socket_user  = "configuser"
+  socket_group = "configgroup"
+}
+
+listener "tcp" {
+  address     = "2001:0db8::0001:8200"
+  tls_disable = true
+}
+
+listener {
+  type        = "tcp"
+  address     = "[2001:0:0:1:0:0:0:1]:3000"
+  tls_disable = true
+  role        = "metrics_only"
+}
+
+listener "tcp" {
+  role          = "default"
+  address       = "2001:db8:0:1:1:1:1:1:8400"
+  tls_key_file  = "/path/to/cakey.pem"
+  tls_cert_file = "/path/to/cacert.pem"
+}
+
+vault {
+  address         = "https://[2001:0db8::0001]:8200"
+  ca_cert         = "config_ca_cert"
+  ca_path         = "config_ca_path"
+  tls_skip_verify = "true"
+  client_cert     = "config_client_cert"
+  client_key      = "config_client_key"
+}
diff --git a/command/proxy/config/test-fixtures/config-auto-auth-azure.hcl b/command/proxy/config/test-fixtures/config-auto-auth-azure.hcl
new file mode 100644
index 00000000000..9ca5a5f51b0
--- /dev/null
+++ b/command/proxy/config/test-fixtures/config-auto-auth-azure.hcl
@@ -0,0 +1,78 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+pid_file = "./pidfile"
+
+auto_auth {
+  method {
+    type      = "azure"
+    namespace = "/azure-namespace"
+    config = {
+      authenticate_from_environment = true
+      role                          = "dev-role"
+      resource                      = "https://[2001:0:0:1:0:0:0:1]",
+    }
+  }
+
+  sink {
+    type = "file"
+    config = {
+      path = "/tmp/file-foo"
+    }
+    aad     = "foobar"
+    dh_type = "curve25519"
+    dh_path = "/tmp/file-foo-dhpath"
+  }
+}
+
+api_proxy {
+  use_auto_auth_token = true
+  enforce_consistency = "always"
+  when_inconsistent   = "retry"
+}
+
+cache {
+  persist = {
+    type                       = "kubernetes"
+    path                       = "/vault/agent-cache/"
+    keep_after_import          = true
+    exit_on_err                = true
+    service_account_token_file = "/tmp/serviceaccount/token"
+  }
+}
+
+listener "unix" {
+  address      = "/path/to/socket"
+  tls_disable  = true
+  socket_mode  = "configmode"
+  socket_user  = "configuser"
+  socket_group = "configgroup"
+}
+
+listener "tcp" {
+  address     = "2001:0db8::0001:8200"
+  tls_disable = true
+}
+
+listener {
+  type        = "tcp"
+  address     = "[2001:0:0:1:0:0:0:1]:3000"
+  tls_disable = true
+  role        = "metrics_only"
+}
+
+listener "tcp" {
+  role          = "default"
+  address       = "2001:db8:0:1:1:1:1:1:8400"
+  tls_key_file  = "/path/to/cakey.pem"
+  tls_cert_file = "/path/to/cacert.pem"
+}
+
+vault {
+  address         = "https://[2001:0db8::0001]:8200"
+  ca_cert         = "config_ca_cert"
+  ca_path         = "config_ca_path"
+  tls_skip_verify = "true"
+  client_cert     = "config_client_cert"
+  client_key      = "config_client_key"
+}
diff --git a/command/proxy/config/test-fixtures/config-auto-auth-gcp.hcl b/command/proxy/config/test-fixtures/config-auto-auth-gcp.hcl
new file mode 100644
index 00000000000..21799ba7368
--- /dev/null
+++ b/command/proxy/config/test-fixtures/config-auto-auth-gcp.hcl
@@ -0,0 +1,77 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+pid_file = "./pidfile"
+
+auto_auth {
+  method {
+    type      = "gcp"
+    namespace = "/gcp-namespace"
+    config = {
+      role            = "dev-role"
+      service_account = "https://[2001:DB8:AC3:FE4::1]"
+    }
+  }
+
+  sink {
+    type = "file"
+    config = {
+      path = "/tmp/file-foo"
+    }
+    aad     = "foobar"
+    dh_type = "curve25519"
+    dh_path = "/tmp/file-foo-dhpath"
+  }
+}
+
+api_proxy {
+  use_auto_auth_token = true
+  enforce_consistency = "always"
+  when_inconsistent   = "retry"
+}
+
+cache {
+  persist = {
+    type                       = "kubernetes"
+    path                       = "/vault/agent-cache/"
+    keep_after_import          = true
+    exit_on_err                = true
+    service_account_token_file = "/tmp/serviceaccount/token"
+  }
+}
+
+listener "unix" {
+  address      = "/path/to/socket"
+  tls_disable  = true
+  socket_mode  = "configmode"
+  socket_user  = "configuser"
+  socket_group = "configgroup"
+}
+
+listener "tcp" {
+  address     = "2001:0db8::0001:8200"
+  tls_disable = true
+}
+
+listener {
+  type        = "tcp"
+  address     = "[2001:0:0:1:0:0:0:1]:3000"
+  tls_disable = true
+  role        = "metrics_only"
+}
+
+listener "tcp" {
+  role          = "default"
+  address       = "2001:db8:0:1:1:1:1:1:8400"
+  tls_key_file  = "/path/to/cakey.pem"
+  tls_cert_file = "/path/to/cacert.pem"
+}
+
+vault {
+  address         = "https://[2001:0db8::0001]:8200"
+  ca_cert         = "config_ca_cert"
+  ca_path         = "config_ca_path"
+  tls_skip_verify = "true"
+  client_cert     = "config_client_cert"
+  client_key      = "config_client_key"
+}
diff --git a/command/proxy/config/test-fixtures/config-cache-but-no-secrets.hcl b/command/proxy/config/test-fixtures/config-cache-but-no-secrets.hcl
index edd8e6a2a58..b05fc0a3591 100644
--- a/command/proxy/config/test-fixtures/config-cache-but-no-secrets.hcl
+++ b/command/proxy/config/test-fixtures/config-cache-but-no-secrets.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/proxy/config/test-fixtures/config-cache-embedded-type.hcl b/command/proxy/config/test-fixtures/config-cache-embedded-type.hcl
index cd953e7f3d0..53f25cb7909 100644
--- a/command/proxy/config/test-fixtures/config-cache-embedded-type.hcl
+++ b/command/proxy/config/test-fixtures/config-cache-embedded-type.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/proxy/config/test-fixtures/config-cache-static-no-auto-auth.hcl b/command/proxy/config/test-fixtures/config-cache-static-no-auto-auth.hcl
index 815d7fd8e61..2c580046fd0 100644
--- a/command/proxy/config/test-fixtures/config-cache-static-no-auto-auth.hcl
+++ b/command/proxy/config/test-fixtures/config-cache-static-no-auto-auth.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/proxy/config/test-fixtures/config-cache-static-secret-cache.hcl b/command/proxy/config/test-fixtures/config-cache-static-secret-cache.hcl
index fa395bd8bdc..822842d3d63 100644
--- a/command/proxy/config/test-fixtures/config-cache-static-secret-cache.hcl
+++ b/command/proxy/config/test-fixtures/config-cache-static-secret-cache.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/proxy/config/test-fixtures/config-cache.hcl b/command/proxy/config/test-fixtures/config-cache.hcl
index caf15347956..c64d688ebf1 100644
--- a/command/proxy/config/test-fixtures/config-cache.hcl
+++ b/command/proxy/config/test-fixtures/config-cache.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 pid_file = "./pidfile"
diff --git a/command/proxy_test.go b/command/proxy_test.go
index cffc93b7507..3de79bbfef2 100644
--- a/command/proxy_test.go
+++ b/command/proxy_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -24,6 +24,7 @@ import (
 	credAppRole "github.com/hashicorp/vault/builtin/credential/approle"
 	"github.com/hashicorp/vault/command/agent"
 	proxyConfig "github.com/hashicorp/vault/command/proxy/config"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/helper/testhelpers/minimal"
 	"github.com/hashicorp/vault/helper/useragent"
 	vaulthttp "github.com/hashicorp/vault/http"
@@ -44,6 +45,7 @@ func testProxyCommand(tb testing.TB, logger hclog.Logger) (*cli.MockUi, *ProxyCo
 		},
 		ShutdownCh: MakeShutdownCh(),
 		SighupCh:   MakeSighupCh(),
+		SigUSR2Ch:  MakeSigUSR2Ch(),
 		logger:     logger,
 		startedCh:  make(chan struct{}, 5),
 		reloadedCh: make(chan struct{}, 5),
@@ -120,23 +122,8 @@ func testProxyExitAfterAuth(t *testing.T, viaFlag bool) {
 	os.Remove(in)
 	t.Logf("input: %s", in)
 
-	sink1f, err := os.CreateTemp(dir, "sink1.jwt.test.")
-	if err != nil {
-		t.Fatal(err)
-	}
-	sink1 := sink1f.Name()
-	sink1f.Close()
-	os.Remove(sink1)
-	t.Logf("sink1: %s", sink1)
-
-	sink2f, err := os.CreateTemp(dir, "sink2.jwt.test.")
-	if err != nil {
-		t.Fatal(err)
-	}
-	sink2 := sink2f.Name()
-	sink2f.Close()
-	os.Remove(sink2)
-	t.Logf("sink2: %s", sink2)
+	sinkFileName1 := makeTempFile(t, "sink-file", "")
+	sinkFileName2 := makeTempFile(t, "sink-file", "")
 
 	conff, err := os.CreateTemp(dir, "conf.jwt.test.")
 	if err != nil {
@@ -159,85 +146,928 @@ func testProxyExitAfterAuth(t *testing.T, viaFlag bool) {
 		exitAfterAuthTemplText = ""
 	}
 
-	config := `
-%s
+	config := `
+%s
+
+auto_auth {
+        method {
+                type = "jwt"
+                config = {
+                        role = "test"
+                        path = "%s"
+                }
+        }
+
+        sink {
+                type = "file"
+                config = {
+                        path = "%s"
+                }
+        }
+
+        sink "file" {
+                config = {
+                        path = "%s"
+                }
+        }
+}
+`
+
+	config = fmt.Sprintf(config, exitAfterAuthTemplText, in, sinkFileName1, sinkFileName2)
+	if err := os.WriteFile(conf, []byte(config), 0o600); err != nil {
+		t.Fatal(err)
+	} else {
+		logger.Trace("wrote test config", "path", conf)
+	}
+
+	doneCh := make(chan struct{})
+	go func() {
+		ui, cmd := testProxyCommand(t, logger)
+		cmd.client = client
+
+		args := []string{"-config", conf}
+		if viaFlag {
+			args = append(args, "-exit-after-auth")
+		}
+
+		code := cmd.Run(args)
+		if code != 0 {
+			t.Errorf("expected %d to be %d", code, 0)
+			t.Logf("output from proxy:\n%s", ui.OutputWriter.String())
+			t.Logf("error from proxy:\n%s", ui.ErrorWriter.String())
+		}
+		close(doneCh)
+	}()
+
+	select {
+	case <-doneCh:
+		break
+	case <-time.After(1 * time.Minute):
+		t.Fatal("timeout reached while waiting for proxy to exit")
+	}
+
+	sink1Bytes, err := os.ReadFile(sinkFileName1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(sink1Bytes) == 0 {
+		t.Fatal("got no output from sink 1")
+	}
+
+	sink2Bytes, err := os.ReadFile(sinkFileName2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(sink2Bytes) == 0 {
+		t.Fatal("got no output from sink 2")
+	}
+
+	if string(sink1Bytes) != string(sink2Bytes) {
+		t.Fatal("sink 1/2 values don't match")
+	}
+}
+
+// TestProxy_NoTriggerAutoAuth_BadPolicy tests that auto auth is not re-triggered
+// if Proxy uses a token with incorrect policy access.
+func TestProxy_NoTriggerAutoAuth_BadPolicy(t *testing.T) {
+	proxyLogger := logging.NewVaultLogger(hclog.Trace)
+	vaultLogger := logging.NewVaultLogger(hclog.Info)
+	cluster := vault.NewTestCluster(t, &vault.CoreConfig{}, &vault.TestClusterOptions{
+		NumCores:    1,
+		HandlerFunc: vaulthttp.Handler,
+		Logger:      vaultLogger,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	serverClient := cluster.Cores[0].Client
+
+	// Add a secret to the KV engine
+	_, err := serverClient.Logical().Write("secret/foo", map[string]interface{}{"user": "something"})
+	require.NoError(t, err)
+
+	// Create kv read policy
+	noKvAccess := `path "secret/*" {
+capabilities = ["deny"]
+}`
+	err = serverClient.Sys().PutPolicy("noKvAccess", noKvAccess)
+	require.NoError(t, err)
+
+	// Create a token with that policy
+	opts := &api.TokenCreateRequest{Policies: []string{"noKvAccess"}}
+	tokenResp, err := serverClient.Auth().Token().Create(opts)
+	require.NoError(t, err)
+	firstToken := tokenResp.Auth.ClientToken
+
+	// Create token file
+	tokenFileName := makeTempFile(t, "token-file", firstToken)
+
+	sinkFileName := makeTempFile(t, "sink-file", "")
+
+	autoAuthConfig := fmt.Sprintf(`
+auto_auth {
+    method {
+		type = "token_file"
+        config = {
+            token_file_path = "%s"
+        }
+    }
+	sink "file" {
+		config = {
+			# TODO (HCL_DUP_KEYS_DEPRECATION): remove duplicate attribute below
+			path = ""
+			path = "%s"
+		}
+	}
+}`, tokenFileName, sinkFileName)
+
+	listenAddr := generateListenerAddress(t)
+	listenConfig := fmt.Sprintf(`
+	listener "tcp" {
+	 address = "%s"
+	 tls_disable = true
+	}
+	`, listenAddr)
+
+	config := fmt.Sprintf(`
+	vault {
+	 address = "%s"
+	 tls_skip_verify = true
+	}
+	api_proxy {
+	 use_auto_auth_token = "force"
+	}
+	%s
+	%s
+	`, serverClient.Address(), listenConfig, autoAuthConfig)
+	configPath := makeTempFile(t, "config.hcl", config)
+
+	// Unset the environment variable so that proxy picks up the right test
+	// cluster address
+	defer os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
+	os.Unsetenv(api.EnvVaultAddress)
+
+	// Start proxy
+	ui, cmd := testProxyCommand(t, proxyLogger)
+	cmd.startedCh = make(chan struct{})
+
+	wg := &sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		t.Setenv(random.AllowHclDuplicatesEnvVar, "true")
+		cmd.Run([]string{"-config", configPath})
+		wg.Done()
+	}()
+
+	select {
+	case <-cmd.startedCh:
+	case <-time.After(5 * time.Second):
+		t.Fatalf("timeout")
+	}
+
+	// TODO (HCL_DUP_KEYS_DEPRECATION): Eventually remove this check together with the duplicate attribute in this
+	// test's configuration
+	require.Contains(t, ui.ErrorWriter.String(),
+		"WARNING: Duplicate keys found")
+
+	// Validate that the auto-auth token has been correctly attained
+	// and works for LookupSelf
+	conf := api.DefaultConfig()
+	conf.Address = "http://" + listenAddr
+	proxyClient, err := api.NewClient(conf)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	proxyClient.SetToken("")
+	err = proxyClient.SetAddress("http://" + listenAddr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Wait for re-triggered auto auth to write new token to sink
+	waitForFile := func(prevModTime time.Time) time.Time {
+		ticker := time.Tick(100 * time.Millisecond)
+		timeout := time.After(15 * time.Second)
+		for {
+			select {
+			case <-ticker:
+			case <-timeout:
+				return prevModTime
+			}
+			modTime, err := os.Stat(sinkFileName)
+			require.NoError(t, err)
+			if modTime.ModTime().After(prevModTime) {
+				return modTime.ModTime()
+			}
+		}
+	}
+
+	// Wait for the token to be sent to syncs and be available to be used
+	initialModTime := waitForFile(time.Time{})
+	req := proxyClient.NewRequest("GET", "/v1/auth/token/lookup-self")
+	_ = request(t, proxyClient, req, 200)
+
+	// Write a new token to the token file
+	newTokenResp, err := serverClient.Auth().Token().Create(&api.TokenCreateRequest{})
+	require.NoError(t, err)
+	secondToken := newTokenResp.Auth.ClientToken
+	err = os.WriteFile(tokenFileName, []byte(secondToken), 0o600)
+	require.NoError(t, err)
+
+	// Make a request to a path that the token does not have access to
+	req = proxyClient.NewRequest("GET", "/v1/secret/foo")
+	_, err = proxyClient.RawRequest(req)
+	require.Error(t, err)
+	require.ErrorContains(t, err, logical.ErrPermissionDenied.Error())
+	require.NotContains(t, err.Error(), logical.ErrInvalidToken.Error())
+
+	// Sleep for a bit to ensure that auto auth is not re-triggered
+	newModTime := waitForFile(initialModTime)
+	if newModTime.After(initialModTime) {
+		t.Fatal("auto auth was incorrectly re-triggered")
+	}
+
+	// Read from the sink file and verify that the token has not changed
+	newToken, err := os.ReadFile(sinkFileName)
+	require.Equal(t, firstToken, string(newToken))
+
+	close(cmd.ShutdownCh)
+	wg.Wait()
+}
+
+// TestProxy_NoTriggerAutoAuth_ProxyTokenNotAutoAuth tests that auto auth is not re-triggered
+// if Proxy uses a token that is not equal to the auto auth token
+func TestProxy_NoTriggerAutoAuth_ProxyTokenNotAutoAuth(t *testing.T) {
+	proxyLogger := logging.NewVaultLogger(hclog.Info)
+	cluster := minimal.NewTestSoloCluster(t, nil)
+
+	serverClient := cluster.Cores[0].Client
+
+	// Create a token
+	tokenResp, err := serverClient.Auth().Token().Create(&api.TokenCreateRequest{})
+	require.NoError(t, err)
+	firstToken := tokenResp.Auth.ClientToken
+
+	// Create token file
+	tokenFileName := makeTempFile(t, "token-file", firstToken)
+
+	sinkFileName := makeTempFile(t, "sink-file", "")
+
+	autoAuthConfig := fmt.Sprintf(`
+auto_auth {
+    method {
+		type = "token_file"
+        config = {
+            token_file_path = "%s"
+        }
+    }
+	sink "file" {
+		config = {
+			path = "%s"
+		}
+	}
+}`, tokenFileName, sinkFileName)
+
+	listenAddr := generateListenerAddress(t)
+	listenConfig := fmt.Sprintf(`
+	listener "tcp" {
+	 address = "%s"
+	 tls_disable = true
+	}
+	`, listenAddr)
+
+	// Do not use the auto auth token if a token is provided with the proxy client
+	config := fmt.Sprintf(`
+	vault {
+	 address = "%s"
+	 tls_skip_verify = true
+	}
+	api_proxy {
+	 use_auto_auth_token = true
+	}
+	%s
+	%s
+	`, serverClient.Address(), listenConfig, autoAuthConfig)
+	configPath := makeTempFile(t, "config.hcl", config)
+
+	// Unset the environment variable so that proxy picks up the right test
+	// cluster address
+	defer os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
+	os.Unsetenv(api.EnvVaultAddress)
+
+	// Start proxy
+	_, cmd := testProxyCommand(t, proxyLogger)
+	cmd.startedCh = make(chan struct{})
+
+	wg := &sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		cmd.Run([]string{"-config", configPath})
+		wg.Done()
+	}()
+
+	select {
+	case <-cmd.startedCh:
+	case <-time.After(5 * time.Second):
+		t.Fatalf("timeout")
+	}
+
+	// Validate that the auto-auth token has been correctly attained
+	// and works for LookupSelf
+	conf := api.DefaultConfig()
+	conf.Address = "http://" + listenAddr
+	proxyClient, err := api.NewClient(conf)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	proxyClient.SetToken(firstToken)
+	err = proxyClient.SetAddress("http://" + listenAddr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Wait for re-triggered auto auth to write new token to sink
+	waitForFile := func(prevModTime time.Time) time.Time {
+		ticker := time.Tick(100 * time.Millisecond)
+		timeout := time.After(15 * time.Second)
+		for {
+			select {
+			case <-ticker:
+			case <-timeout:
+				return prevModTime
+			}
+			modTime, err := os.Stat(sinkFileName)
+			require.NoError(t, err)
+			if modTime.ModTime().After(prevModTime) {
+				return modTime.ModTime()
+			}
+		}
+	}
+
+	// Wait for the token is available to be used
+	createTime := waitForFile(time.Time{})
+	require.NoError(t, err)
+	_, err = serverClient.Auth().Token().LookupSelf()
+	require.NoError(t, err)
+
+	// Revoke token
+	err = serverClient.Auth().Token().RevokeOrphan(firstToken)
+	require.NoError(t, err)
+
+	// Write a new token to the token file
+	newTokenResp, err := serverClient.Auth().Token().Create(&api.TokenCreateRequest{})
+	require.NoError(t, err)
+	secondToken := newTokenResp.Auth.ClientToken
+	err = os.WriteFile(tokenFileName, []byte(secondToken), 0o600)
+	require.NoError(t, err)
+
+	// Proxy uses revoked token to make request and should result in an error
+	proxyClient.SetToken("random token")
+	_, err = proxyClient.Auth().Token().LookupSelf()
+	require.Error(t, err)
+
+	// Wait to see if the sink file is modified
+	newModTime := waitForFile(createTime)
+	if newModTime.After(createTime) {
+		t.Fatal("auto auth was incorrectly re-triggered")
+	}
+
+	// Read from the sink and verify that the token has not changed
+	newToken, err := os.ReadFile(sinkFileName)
+	require.Equal(t, firstToken, string(newToken))
+
+	close(cmd.ShutdownCh)
+	wg.Wait()
+}
+
+// TestProxy_ReTriggerAutoAuth_ForceAutoAuthToken tests that auto auth is re-triggered
+// if Proxy always forcibly uses the auto auth token
+func TestProxy_ReTriggerAutoAuth_ForceAutoAuthToken(t *testing.T) {
+	proxyLogger := logging.NewVaultLogger(hclog.Trace)
+	vaultLogger := logging.NewVaultLogger(hclog.Info)
+	cluster := vault.NewTestCluster(t, &vault.CoreConfig{}, &vault.TestClusterOptions{
+		NumCores:    1,
+		HandlerFunc: vaulthttp.Handler,
+		Logger:      vaultLogger,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	serverClient := cluster.Cores[0].Client
+
+	// Create a token
+	tokenResp, err := serverClient.Auth().Token().Create(&api.TokenCreateRequest{})
+	require.NoError(t, err)
+	firstToken := tokenResp.Auth.ClientToken
+
+	// Create token file
+	tokenFileName := makeTempFile(t, "token-file", firstToken)
+
+	sinkFileName := makeTempFile(t, "sink-file", "")
+
+	autoAuthConfig := fmt.Sprintf(`
+auto_auth {
+    method {
+		type = "token_file"
+        config = {
+            token_file_path = "%s"
+        }
+    }
+	sink "file" {
+		config = {
+			path = "%s"
+		}
+	}
+}`, tokenFileName, sinkFileName)
+
+	listenAddr := generateListenerAddress(t)
+	listenConfig := fmt.Sprintf(`
+	listener "tcp" {
+	 address = "%s"
+	 tls_disable = true
+	}
+	`, listenAddr)
+
+	// Do not use the auto auth token if a token is provided with the proxy client
+	config := fmt.Sprintf(`
+	vault {
+	 address = "%s"
+	 tls_skip_verify = true
+	}
+	api_proxy {
+	 use_auto_auth_token = "force"
+	}
+	%s
+	%s
+	`, serverClient.Address(), listenConfig, autoAuthConfig)
+	configPath := makeTempFile(t, "config.hcl", config)
+
+	// Unset the environment variable so that proxy picks up the right test
+	// cluster address
+	defer os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
+	os.Unsetenv(api.EnvVaultAddress)
+
+	// Start proxy
+	_, cmd := testProxyCommand(t, proxyLogger)
+	cmd.startedCh = make(chan struct{})
+
+	wg := &sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		cmd.Run([]string{"-config", configPath})
+		wg.Done()
+	}()
+
+	select {
+	case <-cmd.startedCh:
+	case <-time.After(5 * time.Second):
+		t.Fatalf("timeout")
+	}
+
+	// Validate that the auto-auth token has been correctly attained
+	// and works for LookupSelf
+	conf := api.DefaultConfig()
+	conf.Address = "http://" + listenAddr
+	proxyClient, err := api.NewClient(conf)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	proxyClient.SetToken(firstToken)
+	err = proxyClient.SetAddress("http://" + listenAddr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Wait for re-triggered auto auth to write new token to sink
+	waitForFile := func(prevModTime time.Time) time.Time {
+		ticker := time.Tick(100 * time.Millisecond)
+		timeout := time.After(15 * time.Second)
+		for {
+			select {
+			case <-ticker:
+			case <-timeout:
+				return prevModTime
+			}
+			modTime, err := os.Stat(sinkFileName)
+			require.NoError(t, err)
+			if modTime.ModTime().After(prevModTime) {
+				return modTime.ModTime()
+			}
+		}
+	}
+
+	// Wait for the token is available to be used
+	createTime := waitForFile(time.Time{})
+	require.NoError(t, err)
+	req := proxyClient.NewRequest("GET", "/v1/auth/token/lookup-self")
+	_, err = proxyClient.RawRequest(req)
+	require.NoError(t, err)
+
+	// Revoke token
+	req = serverClient.NewRequest("PUT", "/v1/auth/token/revoke")
+	req.BodyBytes = []byte(fmt.Sprintf(`{
+	  "token": "%s"
+	}`, firstToken))
+	_ = request(t, serverClient, req, 204)
+
+	// Create new token
+	newTokenResp, err := serverClient.Auth().Token().Create(&api.TokenCreateRequest{})
+	require.NoError(t, err)
+	secondToken := newTokenResp.Auth.ClientToken
+
+	// Proxy uses the same token in the token file to make a request, which should result in error
+	req = proxyClient.NewRequest("GET", "/v1/auth/token/lookup-self")
+	_, err = proxyClient.RawRequest(req)
+	require.Error(t, err)
+
+	// Write a new token to the token file so that auto auth can write new token to sink
+	err = os.WriteFile(tokenFileName, []byte(secondToken), 0o600)
+	require.NoError(t, err)
+
+	// Wait to see if that the sink file is modified
+	waitForFile(createTime)
+
+	// Read from the sink and verify that the sink contains the new token
+	newToken, err := os.ReadFile(sinkFileName)
+	require.Equal(t, secondToken, string(newToken))
+
+	close(cmd.ShutdownCh)
+	wg.Wait()
+}
+
+// TestProxy_ReTriggerAutoAuth_ProxyIsAutoAuthToken tests that auto auth is re-triggered
+// the proxy client uses a token that is equal to the auto auth token
+func TestProxy_ReTriggerAutoAuth_ProxyIsAutoAuthToken(t *testing.T) {
+	proxyLogger := logging.NewVaultLogger(hclog.Trace)
+	vaultLogger := logging.NewVaultLogger(hclog.Info)
+	cluster := vault.NewTestCluster(t, &vault.CoreConfig{
+		CredentialBackends: map[string]logical.Factory{
+			"approle": credAppRole.Factory,
+		},
+	}, &vault.TestClusterOptions{
+		NumCores:    1,
+		HandlerFunc: vaulthttp.Handler,
+		Logger:      vaultLogger,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	serverClient := cluster.Cores[0].Client
+
+	// Enable the approle auth method
+	req := serverClient.NewRequest("POST", "/v1/sys/auth/approle")
+	req.BodyBytes = []byte(`{
+		"type": "approle"
+	}`)
+	request(t, serverClient, req, 204)
+
+	// Create a named role
+	req = serverClient.NewRequest("PUT", "/v1/auth/approle/role/test-role")
+	req.BodyBytes = []byte(`{
+	  "secret_id_num_uses": "10",
+	  "secret_id_ttl": "1m",
+	  "token_max_ttl": "4m",
+	  "token_num_uses": "10",
+	  "token_ttl": "4m",
+	  "policies": "default"
+	}`)
+	request(t, serverClient, req, 204)
+
+	// Fetch the RoleID of the named role
+	req = serverClient.NewRequest("GET", "/v1/auth/approle/role/test-role/role-id")
+	body := request(t, serverClient, req, 200)
+	data := body["data"].(map[string]interface{})
+	roleID := data["role_id"].(string)
+
+	// Get a SecretID issued against the named role
+	req = serverClient.NewRequest("PUT", "/v1/auth/approle/role/test-role/secret-id")
+	body = request(t, serverClient, req, 200)
+	data = body["data"].(map[string]interface{})
+	secretID := data["secret_id"].(string)
+
+	// Write the RoleID and SecretID to temp files
+	roleIDPath := makeTempFile(t, "role_id.txt", roleID+"\n")
+	secretIDPath := makeTempFile(t, "secret_id.txt", secretID+"\n")
+
+	sinkFileName := makeTempFile(t, "sink-file", "")
+
+	autoAuthConfig := fmt.Sprintf(`
+auto_auth {
+    method "approle" {
+        mount_path = "auth/approle"
+        config = {
+            role_id_file_path = "%s"
+            secret_id_file_path = "%s"
+        }
+    }
+
+	sink "file" {
+		config = {
+			path = "%s"
+		}
+	}
+}`, roleIDPath, secretIDPath, sinkFileName)
+
+	listenAddr := generateListenerAddress(t)
+	listenConfig := fmt.Sprintf(`
+listener "tcp" {
+  address = "%s"
+  tls_disable = true
+}
+`, listenAddr)
+
+	config := fmt.Sprintf(`
+vault {
+  address = "%s"
+  tls_skip_verify = true
+}
+api_proxy {
+  use_auto_auth_token = true
+}
+%s
+%s
+`, serverClient.Address(), listenConfig, autoAuthConfig)
+	configPath := makeTempFile(t, "config.hcl", config)
+
+	// Unset the environment variable so that proxy picks up the right test
+	// cluster address
+	defer os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
+	os.Unsetenv(api.EnvVaultAddress)
+
+	// Start proxy
+	_, cmd := testProxyCommand(t, proxyLogger)
+	cmd.startedCh = make(chan struct{})
+
+	wg := &sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		cmd.Run([]string{"-config", configPath})
+		wg.Done()
+	}()
+
+	select {
+	case <-cmd.startedCh:
+	case <-time.After(5 * time.Second):
+		t.Errorf("timeout")
+	}
+
+	// Validate that the auto-auth token has been correctly attained
+	// and works for LookupSelf
+	conf := api.DefaultConfig()
+	conf.Address = "http://" + listenAddr
+	proxyClient, err := api.NewClient(conf)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = proxyClient.SetAddress("http://" + listenAddr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Wait for re-triggered auto auth to write new token to sink
+	waitForFile := func(prevModTime time.Time) {
+		ticker := time.Tick(100 * time.Millisecond)
+		timeout := time.After(15 * time.Second)
+		for {
+			select {
+			case <-ticker:
+			case <-timeout:
+				t.Fatal("timed out waiting for re-triggered auto auth to complete")
+			}
+			modTime, err := os.Stat(sinkFileName)
+			require.NoError(t, err)
+			if modTime.ModTime().After(prevModTime) {
+				return
+			}
+		}
+	}
+
+	// Wait for the token to be sent to syncs and be available to be used
+	waitForFile(time.Time{})
+	oldToken, err := os.ReadFile(sinkFileName)
+	require.NoError(t, err)
+	prevModTime, err := os.Stat(sinkFileName)
+	require.NoError(t, err)
+
+	// Set proxy token
+	proxyClient.SetToken(string(oldToken))
+
+	// Make request using proxy client to test that token is valid
+	req = proxyClient.NewRequest("GET", "/v1/auth/token/lookup-self")
+	body = request(t, proxyClient, req, 200)
+
+	// Revoke token
+	req = serverClient.NewRequest("PUT", "/v1/auth/token/revoke")
+	req.BodyBytes = []byte(fmt.Sprintf(`{
+	  "token": "%s"
+	}`, oldToken))
+	body = request(t, serverClient, req, 204)
+
+	// Proxy uses revoked token to make request and should result in an error
+	req = proxyClient.NewRequest("GET", "/v1/auth/token/lookup-self")
+	_, err = proxyClient.RawRequest(req)
+	require.Error(t, err)
+
+	// Wait for new token to be written and available to use
+	waitForFile(prevModTime.ModTime())
+
+	// Verify new token is not equal to the old token
+	newToken, err := os.ReadFile(sinkFileName)
+	require.NoError(t, err)
+	require.NotEqual(t, string(newToken), string(oldToken))
+
+	// Verify that proxy no longer fails when making a request with the new token
+	proxyClient.SetToken(string(newToken))
+	req = proxyClient.NewRequest("GET", "/v1/auth/token/lookup-self")
+	body = request(t, proxyClient, req, 200)
+
+	close(cmd.ShutdownCh)
+	wg.Wait()
+}
+
+// TestProxy_ReTriggerAutoAuth_RevokedToken tests that auto auth is re-triggered
+// when Proxy uses a revoked auto auth token to make a request
+func TestProxy_ReTriggerAutoAuth_RevokedToken(t *testing.T) {
+	proxyLogger := logging.NewVaultLogger(hclog.Trace)
+	vaultLogger := logging.NewVaultLogger(hclog.Info)
+	cluster := vault.NewTestCluster(t, &vault.CoreConfig{
+		CredentialBackends: map[string]logical.Factory{
+			"approle": credAppRole.Factory,
+		},
+	}, &vault.TestClusterOptions{
+		NumCores:    1,
+		HandlerFunc: vaulthttp.Handler,
+		Logger:      vaultLogger,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	serverClient := cluster.Cores[0].Client
+
+	// Enable the approle auth method
+	req := serverClient.NewRequest("POST", "/v1/sys/auth/approle")
+	req.BodyBytes = []byte(`{
+		"type": "approle"
+	}`)
+	request(t, serverClient, req, 204)
+
+	// Create a named role
+	req = serverClient.NewRequest("PUT", "/v1/auth/approle/role/test-role")
+	req.BodyBytes = []byte(`{
+	  "secret_id_num_uses": "10",
+	  "secret_id_ttl": "1m",
+	  "token_max_ttl": "4m",
+	  "token_num_uses": "10",
+	  "token_ttl": "4m",
+	  "policies": "default"
+	}`)
+	request(t, serverClient, req, 204)
+
+	// Fetch the RoleID of the named role
+	req = serverClient.NewRequest("GET", "/v1/auth/approle/role/test-role/role-id")
+	body := request(t, serverClient, req, 200)
+	data := body["data"].(map[string]interface{})
+	roleID := data["role_id"].(string)
+
+	// Get a SecretID issued against the named role
+	req = serverClient.NewRequest("PUT", "/v1/auth/approle/role/test-role/secret-id")
+	body = request(t, serverClient, req, 200)
+	data = body["data"].(map[string]interface{})
+	secretID := data["secret_id"].(string)
 
+	// Write the RoleID and SecretID to temp files
+	roleIDPath := makeTempFile(t, "role_id.txt", roleID+"\n")
+	secretIDPath := makeTempFile(t, "secret_id.txt", secretID+"\n")
+
+	sinkFileName := makeTempFile(t, "sink-file", "")
+	autoAuthConfig := fmt.Sprintf(`
 auto_auth {
-        method {
-                type = "jwt"
-                config = {
-                        role = "test"
-                        path = "%s"
-                }
+    method "approle" {
+        mount_path = "auth/approle"
+        config = {
+            role_id_file_path = "%s"
+            secret_id_file_path = "%s"
         }
+    }
 
-        sink {
-                type = "file"
-                config = {
-                        path = "%s"
-                }
-        }
+	sink "file" {
+		config = {
+			path = "%s"
+		}
+	}
+}`, roleIDPath, secretIDPath, sinkFileName)
 
-        sink "file" {
-                config = {
-                        path = "%s"
-                }
-        }
+	listenAddr := generateListenerAddress(t)
+	listenConfig := fmt.Sprintf(`
+listener "tcp" {
+  address = "%s"
+  tls_disable = true
 }
-`
+`, listenAddr)
 
-	config = fmt.Sprintf(config, exitAfterAuthTemplText, in, sink1, sink2)
-	if err := os.WriteFile(conf, []byte(config), 0o600); err != nil {
-		t.Fatal(err)
-	} else {
-		logger.Trace("wrote test config", "path", conf)
-	}
+	config := fmt.Sprintf(`
+vault {
+  address = "%s"
+  tls_skip_verify = true
+}
+api_proxy {
+  use_auto_auth_token = "force"
+}
+%s
+%s
+`, serverClient.Address(), listenConfig, autoAuthConfig)
+	configPath := makeTempFile(t, "config.hcl", config)
 
-	doneCh := make(chan struct{})
-	go func() {
-		ui, cmd := testProxyCommand(t, logger)
-		cmd.client = client
+	// Unset the environment variable so that proxy picks up the right test
+	// cluster address
+	defer os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
+	os.Unsetenv(api.EnvVaultAddress)
 
-		args := []string{"-config", conf}
-		if viaFlag {
-			args = append(args, "-exit-after-auth")
-		}
+	// Start proxy
+	_, cmd := testProxyCommand(t, proxyLogger)
+	cmd.startedCh = make(chan struct{})
 
-		code := cmd.Run(args)
-		if code != 0 {
-			t.Errorf("expected %d to be %d", code, 0)
-			t.Logf("output from proxy:\n%s", ui.OutputWriter.String())
-			t.Logf("error from proxy:\n%s", ui.ErrorWriter.String())
-		}
-		close(doneCh)
+	wg := &sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		cmd.Run([]string{"-config", configPath})
+		wg.Done()
 	}()
 
 	select {
-	case <-doneCh:
-		break
-	case <-time.After(1 * time.Minute):
-		t.Fatal("timeout reached while waiting for proxy to exit")
+	case <-cmd.startedCh:
+	case <-time.After(5 * time.Second):
+		t.Errorf("timeout")
 	}
 
-	sink1Bytes, err := os.ReadFile(sink1)
+	// Validate that the auto-auth token has been correctly attained
+	// and works for LookupSelf
+	conf := api.DefaultConfig()
+	conf.Address = "http://" + listenAddr
+	proxyClient, err := api.NewClient(conf)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(sink1Bytes) == 0 {
-		t.Fatal("got no output from sink 1")
-	}
 
-	sink2Bytes, err := os.ReadFile(sink2)
+	proxyClient.SetToken("")
+	err = proxyClient.SetAddress("http://" + listenAddr)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(sink2Bytes) == 0 {
-		t.Fatal("got no output from sink 2")
+	// Wait for re-triggered auto auth to write new token to sink
+	waitForFile := func(prevModTime time.Time) {
+		ticker := time.Tick(100 * time.Millisecond)
+		timeout := time.After(15 * time.Second)
+		for {
+			select {
+			case <-ticker:
+			case <-timeout:
+				t.Fatal("timed out waiting for re-triggered auto auth to complete")
+			}
+			modTime, err := os.Stat(sinkFileName)
+			require.NoError(t, err)
+			if modTime.ModTime().After(prevModTime) {
+				return
+			}
+		}
 	}
 
-	if string(sink1Bytes) != string(sink2Bytes) {
-		t.Fatal("sink 1/2 values don't match")
-	}
+	// Wait for the token to be sent to syncs and be available to be used
+	waitForFile(time.Time{})
+	req = proxyClient.NewRequest("GET", "/v1/auth/token/lookup-self")
+	body = request(t, proxyClient, req, 200)
+
+	oldToken, err := os.ReadFile(sinkFileName)
+	require.NoError(t, err)
+	prevModTime, err := os.Stat(sinkFileName)
+	require.NoError(t, err)
+
+	// Revoke token
+	req = serverClient.NewRequest("PUT", "/v1/auth/token/revoke")
+	req.BodyBytes = []byte(fmt.Sprintf(`{
+	  "token": "%s"
+	}`, oldToken))
+	body = request(t, serverClient, req, 204)
+
+	// Proxy uses revoked token to make request and should result in an error
+	req = proxyClient.NewRequest("GET", "/v1/auth/token/lookup-self")
+	_, err = proxyClient.RawRequest(req)
+	require.Error(t, err)
+
+	// Wait for new token to be written and available to use
+	waitForFile(prevModTime.ModTime())
+
+	// Verify new token is not equal to the old token
+	newToken, err := os.ReadFile(sinkFileName)
+	require.NoError(t, err)
+	require.NotEqual(t, string(newToken), string(oldToken))
+
+	// Verify that proxy no longer fails when making a request
+	req = proxyClient.NewRequest("GET", "/v1/auth/token/lookup-self")
+	body = request(t, proxyClient, req, 200)
+
+	close(cmd.ShutdownCh)
+	wg.Wait()
 }
 
 // TestProxy_AutoAuth_UserAgent tests that the User-Agent sent
@@ -302,17 +1132,8 @@ func TestProxy_AutoAuth_UserAgent(t *testing.T) {
 	// Write the RoleID and SecretID to temp files
 	roleIDPath := makeTempFile(t, "role_id.txt", roleID+"\n")
 	secretIDPath := makeTempFile(t, "secret_id.txt", secretID+"\n")
-	defer os.Remove(roleIDPath)
-	defer os.Remove(secretIDPath)
-
-	sinkf, err := os.CreateTemp("", "sink.test.")
-	if err != nil {
-		t.Fatal(err)
-	}
-	sink := sinkf.Name()
-	sinkf.Close()
-	os.Remove(sink)
 
+	sinkFileName := makeTempFile(t, "sink-file", "")
 	autoAuthConfig := fmt.Sprintf(`
 auto_auth {
     method "approle" {
@@ -328,7 +1149,7 @@ auto_auth {
 			path = "%s"
 		}
 	}
-}`, roleIDPath, secretIDPath, sink)
+}`, roleIDPath, secretIDPath, sinkFileName)
 
 	listenAddr := generateListenerAddress(t)
 	listenConfig := fmt.Sprintf(`
@@ -350,7 +1171,6 @@ api_proxy {
 %s
 `, serverClient.Address(), listenConfig, autoAuthConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Unset the environment variable so that proxy picks up the right test
 	// cluster address
@@ -446,7 +1266,6 @@ vault {
 %s
 `, serverClient.Address(), listenConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the proxy
 	_, cmd := testProxyCommand(t, logger)
@@ -538,7 +1357,6 @@ vault {
 %s
 `, serverClient.Address(), listenConfig, cacheConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start the proxy
 	_, cmd := testProxyCommand(t, logger)
@@ -616,7 +1434,6 @@ vault {
 %s
 `, serverClient.Address(), cacheConfig, listenConfig)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	// Start proxy
 	_, cmd := testProxyCommand(t, logger)
@@ -685,11 +1502,121 @@ vault {
 	wg.Wait()
 }
 
+// TestProxy_NoAutoAuthTokenIfNotConfigured tests that Proxy will not use the auto-auth token
+// unless configured to.
+func TestProxy_NoAutoAuthTokenIfNotConfigured(t *testing.T) {
+	logger := logging.NewVaultLogger(hclog.Trace)
+	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	serverClient := cluster.Cores[0].Client
+
+	// Unset the environment variable so that proxy picks up the right test
+	// cluster address
+	defer os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
+	os.Unsetenv(api.EnvVaultAddress)
+
+	// Create token file
+	tokenFileName := makeTempFile(t, "token-file", serverClient.Token())
+
+	sinkFileName := makeTempFile(t, "sink-file", "")
+
+	autoAuthConfig := fmt.Sprintf(`
+auto_auth {
+    method {
+		type = "token_file"
+        config = {
+            token_file_path = "%s"
+        }
+    }
+
+	sink "file" {
+		config = {
+			path = "%s"
+		}
+	}
+}`, tokenFileName, sinkFileName)
+
+	apiProxyConfig := `
+api_proxy {
+	use_auto_auth_token = false
+}
+`
+	listenAddr := generateListenerAddress(t)
+	listenConfig := fmt.Sprintf(`
+listener "tcp" {
+  address = "%s"
+  tls_disable = true
+}
+`, listenAddr)
+
+	config := fmt.Sprintf(`
+vault {
+  address = "%s"
+  tls_skip_verify = true
+}
+%s
+%s
+%s
+`, serverClient.Address(), apiProxyConfig, listenConfig, autoAuthConfig)
+	configPath := makeTempFile(t, "config.hcl", config)
+
+	// Start proxy
+	ui, cmd := testProxyCommand(t, logger)
+	cmd.startedCh = make(chan struct{})
+
+	wg := &sync.WaitGroup{}
+	wg.Add(1)
+	go func() {
+		code := cmd.Run([]string{"-config", configPath})
+		if code != 0 {
+			t.Errorf("non-zero return code when running proxy: %d", code)
+			t.Logf("STDOUT from proxy:\n%s", ui.OutputWriter.String())
+			t.Logf("STDERR from proxy:\n%s", ui.ErrorWriter.String())
+		}
+		wg.Done()
+	}()
+
+	select {
+	case <-cmd.startedCh:
+	case <-time.After(5 * time.Second):
+		t.Errorf("timeout")
+	}
+
+	proxyClient, err := api.NewClient(api.DefaultConfig())
+	if err != nil {
+		t.Fatal(err)
+	}
+	proxyClient.SetToken("")
+	err = proxyClient.SetAddress("http://" + listenAddr)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Wait for the sink to be populated.
+	// Realistically won't be this long, but keeping it long just in case, for CI.
+	time.Sleep(10 * time.Second)
+
+	secret, err := proxyClient.Auth().Token().CreateOrphan(&api.TokenCreateRequest{
+		Policies: []string{"default"},
+		TTL:      "30m",
+	})
+	if secret != nil || err == nil {
+		t.Fatal("expected this to fail, since without a token you should not be able to make a token")
+	}
+
+	close(cmd.ShutdownCh)
+	wg.Wait()
+}
+
 // TestProxy_ApiProxy_Retry Tests the retry functionalities of Vault Proxy's API Proxy
 func TestProxy_ApiProxy_Retry(t *testing.T) {
-	//----------------------------------------------------
+	// ----------------------------------------------------
 	// Start the server and proxy
-	//----------------------------------------------------
+	// ----------------------------------------------------
 	logger := logging.NewVaultLogger(hclog.Trace)
 	var h handler
 	cluster := vault.NewTestCluster(t,
@@ -730,6 +1657,7 @@ func TestProxy_ApiProxy_Retry(t *testing.T) {
 	intRef := func(i int) *int {
 		return &i
 	}
+
 	// start test cases here
 	testCases := map[string]struct {
 		retries     *int
@@ -788,7 +1716,6 @@ vault {
 %s
 `, serverClient.Address(), retryConf, cacheConfig, listenConfig)
 			configPath := makeTempFile(t, "config.hcl", config)
-			defer os.Remove(configPath)
 
 			_, cmd := testProxyCommand(t, logger)
 			cmd.startedCh = make(chan struct{})
@@ -861,7 +1788,6 @@ listener "tcp" {
 }
 `, listenAddr)
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	ui, cmd := testProxyCommand(t, logger)
 	cmd.client = serverClient
@@ -951,7 +1877,6 @@ cache {}
 `, serverClient.Address(), listenAddr, listenAddr2)
 
 	configPath := makeTempFile(t, "config.hcl", config)
-	defer os.Remove(configPath)
 
 	_, cmd := testProxyCommand(t, nil)
 	cmd.startedCh = make(chan struct{})
@@ -1280,3 +2205,115 @@ func TestProxy_Config_ReloadTls(t *testing.T) {
 		t.Fatalf("got a non-zero exit status: %d, stdout/stderr: %s", code, output)
 	}
 }
+
+// TestProxy_Config_AddrConformance verifies that the vault address is correctly
+// normalized to conform to RFC-5942 §4 when configured by a config file,
+// environment variables, or CLI flags.
+// See: https://rfc-editor.org/rfc/rfc5952.html
+func TestProxy_Config_AddrConformance(t *testing.T) {
+	for name, test := range map[string]struct {
+		args     []string
+		envVars  map[string]string
+		cfg      string
+		expected *proxyConfig.Config
+	}{
+		"ipv4 config": {
+			cfg: `
+vault {
+  address = "https://127.0.0.1:8200"
+}
+`,
+			expected: &proxyConfig.Config{
+				Vault: &proxyConfig.Vault{
+					Address: "https://127.0.0.1:8200",
+				},
+			},
+		},
+		"ipv6 config": {
+			cfg: `
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}
+`,
+			expected: &proxyConfig.Config{
+				Vault: &proxyConfig.Vault{
+					// Use the normalized version in the config
+					Address: "https://[2001:db8::1]:8200",
+				},
+			},
+		},
+		"ipv6 cli arg overrides": {
+			args: []string{"-address=https://[2001:0:0:1:0:0:0:1]:8200"},
+			cfg: `
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}
+`,
+			expected: &proxyConfig.Config{
+				Vault: &proxyConfig.Vault{
+					// Use a normalized version of the args address
+					Address: "https://[2001:0:0:1::1]:8200",
+				},
+			},
+		},
+		"ipv6 env var overrides": {
+			envVars: map[string]string{
+				"VAULT_ADDR": "https://[2001:DB8:AC3:FE4::1]:8200",
+			},
+			cfg: `
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}
+`,
+			expected: &proxyConfig.Config{
+				Vault: &proxyConfig.Vault{
+					// Use a normalized version of the env var address
+					Address: "https://[2001:db8:ac3:fe4::1]:8200",
+				},
+			},
+		},
+		"ipv6 all uses cli overrides": {
+			args: []string{"-address=https://[2001:0:0:1:0:0:0:1]:8200"},
+			envVars: map[string]string{
+				"VAULT_ADDR": "https://[2001:DB8:AC3:FE4::1]:8200",
+			},
+			cfg: `
+vault {
+  address = "https://[2001:0db8::0001]:8200"
+}
+`,
+			expected: &proxyConfig.Config{
+				Vault: &proxyConfig.Vault{
+					// Use a normalized version of the args address
+					Address: "https://[2001:0:0:1::1]:8200",
+				},
+			},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			// In CI our tests are run with VAULT_ADDR=, which will break our tests
+			// because it'll default to an unset address. Ensure that's cleared out
+			// of the environment.
+			t.Cleanup(func() {
+				os.Setenv(api.EnvVaultAddress, os.Getenv(api.EnvVaultAddress))
+			})
+			os.Unsetenv(api.EnvVaultAddress)
+			for k, v := range test.envVars {
+				t.Setenv(k, v)
+			}
+
+			configFile := populateTempFile(t, "proxy-"+strings.ReplaceAll(name, " ", "-"), test.cfg)
+			cfg, err := proxyConfig.LoadConfigFile(configFile.Name())
+			require.NoError(t, err)
+			require.NotEmptyf(t, cfg.Vault.Address, "proxy config is missing address: %+v", cfg.Vault)
+
+			cmd := &ProxyCommand{BaseCommand: &BaseCommand{}}
+			f := cmd.Flags()
+			args := append([]string{}, test.args...)
+			require.NoError(t, f.Parse(args))
+
+			cmd.applyConfigOverrides(f, cfg)
+			require.Equalf(t, test.expected.Vault.Address, cfg.Vault.Address, "proxy config is missing address: config: %+v, flags: %+v", cfg.Vault, f)
+		})
+	}
+}
diff --git a/command/read.go b/command/read.go
index 742e0367638..44ef3ede5b2 100644
--- a/command/read.go
+++ b/command/read.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -36,9 +36,17 @@ Usage: vault read [options] PATH
   Reads data from Vault at the given path. This can be used to read secrets,
   generate dynamic credentials, get configuration details, and more.
 
-  Read a secret from the static secrets engine:
+  Read details of your own token:
 
-      $ vault read secret/my-secret
+      $ vault read auth/token/lookup-self
+
+  Read entity details of a given ID:
+
+      $ vault read identity/entity/id/2f09126d-d161-abb8-2241-555886491d97
+
+  Generate credentials for my-role in an AWS secrets engine:
+
+      $ vault read aws/creds/my-role
 
   For a full list of examples and paths, please see the documentation that
   corresponds to the secrets engine in use.
@@ -49,7 +57,7 @@ Usage: vault read [options] PATH
 }
 
 func (c *ReadCommand) Flags() *FlagSets {
-	return c.flagSet(FlagSetHTTP | FlagSetOutputField | FlagSetOutputFormat)
+	return c.flagSet(FlagSetHTTP | FlagSetOutputField | FlagSetOutputFormat | FlagSetSnapshot)
 }
 
 func (c *ReadCommand) AutocompleteArgs() complete.Predictor {
@@ -99,6 +107,13 @@ func (c *ReadCommand) Run(args []string) int {
 		return 1
 	}
 
+	if c.flagSnapshotID != "" {
+		if data == nil {
+			data = make(map[string][]string)
+		}
+		data["read_snapshot_id"] = []string{c.flagSnapshotID}
+	}
+
 	if Format(c.UI) != "raw" {
 		secret, err := client.Logical().ReadWithDataWithContext(ctx, path, data)
 		if err != nil {
diff --git a/command/read_test.go b/command/read_test.go
index fe8961afb66..ac5a193133e 100644
--- a/command/read_test.go
+++ b/command/read_test.go
@@ -1,13 +1,17 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 
 	"github.com/hashicorp/cli"
+	"github.com/hashicorp/vault/api"
+	"github.com/stretchr/testify/require"
 )
 
 func testReadCommand(tb testing.TB) (*cli.MockUi, *ReadCommand) {
@@ -165,3 +169,39 @@ func TestReadCommand_Run(t *testing.T) {
 		assertNoTabs(t, cmd)
 	})
 }
+
+// TestRead_Snapshot tests that the read_snapshot_id query parameter is added
+// to the request when the -snapshot-id flag is used.
+func TestRead_Snapshot(t *testing.T) {
+	t.Parallel()
+	mockVaultServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		snapID := r.URL.Query().Get("read_snapshot_id")
+		if snapID != "abcd" {
+			w.WriteHeader(http.StatusBadRequest)
+		}
+		w.Write([]byte(`{"secret":{"data":{"foo":"bar"}}}`))
+	}))
+	defer mockVaultServer.Close()
+
+	cfg := api.DefaultConfig()
+	cfg.Address = mockVaultServer.URL
+	client, err := api.NewClient(cfg)
+	require.NoError(t, err)
+
+	ui, cmd := testReadCommand(t)
+	cmd.client = client
+
+	// a read command with a snapshot id shouldn't error
+	code := cmd.Run([]string{
+		"-snapshot-id", "abcd", "path/to/item",
+	})
+	combined := ui.OutputWriter.String() + ui.ErrorWriter.String()
+	require.Equal(t, 0, code, combined)
+
+	// check that the raw flag also works with a snapshot id
+	code = cmd.Run([]string{
+		"-format", "raw", "-snapshot-id", "abcd", "path/to/item",
+	})
+	combined = ui.OutputWriter.String() + ui.ErrorWriter.String()
+	require.Equal(t, 0, code, combined)
+}
diff --git a/command/rotate.go b/command/rotate.go
index 2a17e41f9b5..35735776753 100644
--- a/command/rotate.go
+++ b/command/rotate.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/rotate_test.go b/command/rotate_test.go
index 927812934c3..60d1816953a 100644
--- a/command/rotate_test.go
+++ b/command/rotate_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/secrets.go b/command/secrets.go
index a205aae1744..25aa3f21fe7 100644
--- a/command/secrets.go
+++ b/command/secrets.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/secrets_disable.go b/command/secrets_disable.go
index 163af4a785c..445b20f1177 100644
--- a/command/secrets_disable.go
+++ b/command/secrets_disable.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/secrets_disable_test.go b/command/secrets_disable_test.go
index 25310713643..935ef36fc13 100644
--- a/command/secrets_disable_test.go
+++ b/command/secrets_disable_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/secrets_enable.go b/command/secrets_enable.go
index d02bd69d459..55eb63dd4a8 100644
--- a/command/secrets_enable.go
+++ b/command/secrets_enable.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -23,25 +23,27 @@ var (
 type SecretsEnableCommand struct {
 	*BaseCommand
 
-	flagDescription               string
-	flagPath                      string
-	flagDefaultLeaseTTL           time.Duration
-	flagMaxLeaseTTL               time.Duration
-	flagAuditNonHMACRequestKeys   []string
-	flagAuditNonHMACResponseKeys  []string
-	flagListingVisibility         string
-	flagPassthroughRequestHeaders []string
-	flagAllowedResponseHeaders    []string
-	flagForceNoCache              bool
-	flagPluginName                string
-	flagPluginVersion             string
-	flagOptions                   map[string]string
-	flagLocal                     bool
-	flagSealWrap                  bool
-	flagExternalEntropyAccess     bool
-	flagVersion                   int
-	flagAllowedManagedKeys        []string
-	flagIdentityTokenKey          string
+	flagDescription                string
+	flagPath                       string
+	flagDefaultLeaseTTL            time.Duration
+	flagMaxLeaseTTL                time.Duration
+	flagAuditNonHMACRequestKeys    []string
+	flagAuditNonHMACResponseKeys   []string
+	flagListingVisibility          string
+	flagPassthroughRequestHeaders  []string
+	flagAllowedResponseHeaders     []string
+	flagForceNoCache               bool
+	flagPluginName                 string
+	flagPluginVersion              string
+	flagOptions                    map[string]string
+	flagLocal                      bool
+	flagSealWrap                   bool
+	flagExternalEntropyAccess      bool
+	flagVersion                    int
+	flagAllowedManagedKeys         []string
+	flagDelegatedAuthAccessors     []string
+	flagIdentityTokenKey           string
+	flagTrimRequestTrailingSlashes BoolPtr
 }
 
 func (c *SecretsEnableCommand) Synopsis() string {
@@ -229,6 +231,14 @@ func (c *SecretsEnableCommand) Flags() *FlagSets {
 			"each time with 1 key.",
 	})
 
+	f.StringSliceVar(&StringSliceVar{
+		Name:   flagNameDelegatedAuthAccessors,
+		Target: &c.flagDelegatedAuthAccessors,
+		Usage: "A list of permitted authentication accessors this backend can delegate authentication to. " +
+			"Note that multiple values may be specified by providing this option multiple times, " +
+			"each time with 1 accessor.",
+	})
+
 	f.StringVar(&StringVar{
 		Name:    flagNameIdentityTokenKey,
 		Target:  &c.flagIdentityTokenKey,
@@ -236,6 +246,12 @@ func (c *SecretsEnableCommand) Flags() *FlagSets {
 		Usage:   "Select the key used to sign plugin identity tokens.",
 	})
 
+	f.BoolPtrVar(&BoolPtrVar{
+		Name:   flagNameTrimRequestTrailingSlashes,
+		Target: &c.flagTrimRequestTrailingSlashes,
+		Usage:  "Whether to trim trailing slashes for incoming requests to this mount",
+	})
+
 	return set
 }
 
@@ -339,6 +355,10 @@ func (c *SecretsEnableCommand) Run(args []string) int {
 			mountInput.Config.AllowedManagedKeys = c.flagAllowedManagedKeys
 		}
 
+		if fl.Name == flagNameDelegatedAuthAccessors {
+			mountInput.Config.DelegatedAuthAccessors = c.flagDelegatedAuthAccessors
+		}
+
 		if fl.Name == flagNamePluginVersion {
 			mountInput.Config.PluginVersion = c.flagPluginVersion
 		}
@@ -346,6 +366,11 @@ func (c *SecretsEnableCommand) Run(args []string) int {
 		if fl.Name == flagNameIdentityTokenKey {
 			mountInput.Config.IdentityTokenKey = c.flagIdentityTokenKey
 		}
+
+		if fl.Name == flagNameTrimRequestTrailingSlashes && c.flagTrimRequestTrailingSlashes.IsSet() {
+			val := c.flagTrimRequestTrailingSlashes.Get()
+			mountInput.Config.TrimRequestTrailingSlashes = &val
+		}
 	})
 
 	if err := client.Sys().Mount(mountPath, mountInput); err != nil {
diff --git a/command/secrets_enable_test.go b/command/secrets_enable_test.go
index 3d6766b53e3..0dc8cfd3aed 100644
--- a/command/secrets_enable_test.go
+++ b/command/secrets_enable_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -119,6 +119,8 @@ func TestSecretsEnableCommand_Run(t *testing.T) {
 			"-allowed-response-headers", "authorization",
 			"-allowed-managed-keys", "key1,key2",
 			"-identity-token-key", "default",
+			"-delegated-auth-accessors", "authAcc1,authAcc2",
+			"-trim-request-trailing-slashes=true",
 			"-force-no-cache",
 			"pki",
 		})
@@ -156,6 +158,9 @@ func TestSecretsEnableCommand_Run(t *testing.T) {
 		if exp := true; mountInfo.Config.ForceNoCache != exp {
 			t.Errorf("expected %t to be %t", mountInfo.Config.ForceNoCache, exp)
 		}
+		if !mountInfo.Config.TrimRequestTrailingSlashes {
+			t.Errorf("expected trim_request_trailing_slashes to be enabled")
+		}
 		if diff := deep.Equal([]string{"authorization,authentication", "www-authentication"}, mountInfo.Config.PassthroughRequestHeaders); len(diff) > 0 {
 			t.Errorf("Failed to find expected values in PassthroughRequestHeaders. Difference is: %v", diff)
 		}
@@ -171,6 +176,9 @@ func TestSecretsEnableCommand_Run(t *testing.T) {
 		if diff := deep.Equal([]string{"key1,key2"}, mountInfo.Config.AllowedManagedKeys); len(diff) > 0 {
 			t.Errorf("Failed to find expected values in AllowedManagedKeys. Difference is: %v", diff)
 		}
+		if diff := deep.Equal([]string{"authAcc1,authAcc2"}, mountInfo.Config.DelegatedAuthAccessors); len(diff) > 0 {
+			t.Errorf("Failed to find expected values in DelegatedAuthAccessors. Difference is: %v", diff)
+		}
 		if diff := deep.Equal("default", mountInfo.Config.IdentityTokenKey); len(diff) > 0 {
 			t.Errorf("Failed to find expected values in IdentityTokenKey. Difference is: %v", diff)
 		}
diff --git a/command/secrets_list.go b/command/secrets_list.go
index 2819e2a1d39..5777e5df1e3 100644
--- a/command/secrets_list.go
+++ b/command/secrets_list.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/secrets_list_test.go b/command/secrets_list_test.go
index dcc51eb0189..ac6fc6009db 100644
--- a/command/secrets_list_test.go
+++ b/command/secrets_list_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/secrets_move.go b/command/secrets_move.go
index bd4062969a4..557d4f4f6dc 100644
--- a/command/secrets_move.go
+++ b/command/secrets_move.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/secrets_move_test.go b/command/secrets_move_test.go
index ed7a5a5c629..58a43b4b761 100644
--- a/command/secrets_move_test.go
+++ b/command/secrets_move_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/secrets_tune.go b/command/secrets_tune.go
index b853aec2711..bcce9338da2 100644
--- a/command/secrets_tune.go
+++ b/command/secrets_tune.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -23,20 +23,21 @@ var (
 type SecretsTuneCommand struct {
 	*BaseCommand
 
-	flagAuditNonHMACRequestKeys   []string
-	flagAuditNonHMACResponseKeys  []string
-	flagDefaultLeaseTTL           time.Duration
-	flagDescription               string
-	flagListingVisibility         string
-	flagMaxLeaseTTL               time.Duration
-	flagPassthroughRequestHeaders []string
-	flagAllowedResponseHeaders    []string
-	flagOptions                   map[string]string
-	flagVersion                   int
-	flagPluginVersion             string
-	flagAllowedManagedKeys        []string
-	flagDelegatedAuthAccessors    []string
-	flagIdentityTokenKey          string
+	flagAuditNonHMACRequestKeys    []string
+	flagAuditNonHMACResponseKeys   []string
+	flagDefaultLeaseTTL            time.Duration
+	flagDescription                string
+	flagListingVisibility          string
+	flagMaxLeaseTTL                time.Duration
+	flagPassthroughRequestHeaders  []string
+	flagAllowedResponseHeaders     []string
+	flagOptions                    map[string]string
+	flagVersion                    int
+	flagPluginVersion              string
+	flagAllowedManagedKeys         []string
+	flagDelegatedAuthAccessors     []string
+	flagIdentityTokenKey           string
+	flagTrimRequestTrailingSlashes BoolPtr
 }
 
 func (c *SecretsTuneCommand) Synopsis() string {
@@ -175,6 +176,12 @@ func (c *SecretsTuneCommand) Flags() *FlagSets {
 		Usage:   "Select the key used to sign plugin identity tokens.",
 	})
 
+	f.BoolPtrVar(&BoolPtrVar{
+		Name:   flagNameTrimRequestTrailingSlashes,
+		Target: &c.flagTrimRequestTrailingSlashes,
+		Usage:  "Whether to trim trailing slashes for incoming requests to this mount",
+	})
+
 	return set
 }
 
@@ -267,6 +274,10 @@ func (c *SecretsTuneCommand) Run(args []string) int {
 		if fl.Name == flagNameIdentityTokenKey {
 			mountConfigInput.IdentityTokenKey = c.flagIdentityTokenKey
 		}
+		if fl.Name == flagNameTrimRequestTrailingSlashes && c.flagTrimRequestTrailingSlashes.IsSet() {
+			val := c.flagTrimRequestTrailingSlashes.Get()
+			mountConfigInput.TrimRequestTrailingSlashes = &val
+		}
 	})
 
 	if err := client.Sys().TuneMount(mountPath, mountConfigInput); err != nil {
diff --git a/command/secrets_tune_test.go b/command/secrets_tune_test.go
index 5bd70a0f0de..3d4c39bb3a8 100644
--- a/command/secrets_tune_test.go
+++ b/command/secrets_tune_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -195,6 +195,8 @@ func TestSecretsTuneCommand_Run(t *testing.T) {
 				"-identity-token-key", "default",
 				"-listing-visibility", "unauth",
 				"-plugin-version", version,
+				"-delegated-auth-accessors", "authAcc1,authAcc2",
+				"-trim-request-trailing-slashes=true",
 				"mount_tune_integration/",
 			})
 			if exp := 0; code != exp {
@@ -231,6 +233,9 @@ func TestSecretsTuneCommand_Run(t *testing.T) {
 			if exp := 3600; mountInfo.Config.MaxLeaseTTL != exp {
 				t.Errorf("expected %d to be %d", mountInfo.Config.MaxLeaseTTL, exp)
 			}
+			if !mountInfo.Config.TrimRequestTrailingSlashes {
+				t.Errorf("expected trim_request_trailing_slashes to be enabled")
+			}
 			if diff := deep.Equal([]string{"authorization", "www-authentication"}, mountInfo.Config.PassthroughRequestHeaders); len(diff) > 0 {
 				t.Errorf("Failed to find expected values for PassthroughRequestHeaders. Difference is: %v", diff)
 			}
@@ -246,6 +251,9 @@ func TestSecretsTuneCommand_Run(t *testing.T) {
 			if diff := deep.Equal([]string{"key1,key2"}, mountInfo.Config.AllowedManagedKeys); len(diff) > 0 {
 				t.Errorf("Failed to find expected values in AllowedManagedKeys. Difference is: %v", diff)
 			}
+			if diff := deep.Equal([]string{"authAcc1,authAcc2"}, mountInfo.Config.DelegatedAuthAccessors); len(diff) > 0 {
+				t.Errorf("Failed to find expected values in DelegatedAuthAccessors. Difference is: %v", diff)
+			}
 			if diff := deep.Equal("default", mountInfo.Config.IdentityTokenKey); len(diff) > 0 {
 				t.Errorf("Failed to find expected values in IdentityTokenKey. Difference is: %v", diff)
 			}
diff --git a/command/server.go b/command/server.go
index 402a923f7ec..1144d28a2c6 100644
--- a/command/server.go
+++ b/command/server.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -11,7 +11,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -39,7 +38,6 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-secure-stdlib/reloadutil"
 	"github.com/hashicorp/vault/audit"
-	config2 "github.com/hashicorp/vault/command/config"
 	"github.com/hashicorp/vault/command/server"
 	"github.com/hashicorp/vault/helper/builtinplugins"
 	"github.com/hashicorp/vault/helper/constants"
@@ -47,12 +45,10 @@ import (
 	loghelper "github.com/hashicorp/vault/helper/logging"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/helper/testhelpers/teststorage"
 	"github.com/hashicorp/vault/helper/useragent"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/internalshared/listenerutil"
-	"github.com/hashicorp/vault/plugins/event"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/strutil"
@@ -65,7 +61,6 @@ import (
 	"github.com/hashicorp/vault/vault/plugincatalog"
 	vaultseal "github.com/hashicorp/vault/vault/seal"
 	"github.com/hashicorp/vault/version"
-	"github.com/mitchellh/go-testing-interface"
 	"github.com/posener/complete"
 	"github.com/sasha-s/go-deadlock"
 	"go.uber.org/atomic"
@@ -97,7 +92,6 @@ type ServerCommand struct {
 	CredentialBackends map[string]logical.Factory
 	LogicalBackends    map[string]logical.Factory
 	PhysicalBackends   map[string]physical.Factory
-	EventBackends      map[string]event.Factory
 
 	ServiceRegistrations map[string]sr.Factory
 
@@ -124,6 +118,7 @@ type ServerCommand struct {
 	flagConfigs            []string
 	flagRecovery           bool
 	flagExperiments        []string
+	flagCLIDump            string
 	flagDev                bool
 	flagDevTLS             bool
 	flagDevTLSCertDir      string
@@ -137,10 +132,9 @@ type ServerCommand struct {
 	flagDevLatency         int
 	flagDevLatencyJitter   int
 	flagDevLeasedKV        bool
+	flagDevNoKV            bool
 	flagDevKVV1            bool
 	flagDevSkipInit        bool
-	flagDevThreeNode       bool
-	flagDevFourCluster     bool
 	flagDevTransactional   bool
 	flagDevAutoSeal        bool
 	flagDevClusterJson     string
@@ -148,6 +142,9 @@ type ServerCommand struct {
 	flagTestServerConfig   bool
 	flagDevConsul          bool
 	flagExitOnCoreShutdown bool
+	ignoreLicenseEnvVar    bool
+
+	sealsToFinalize []*vault.Seal
 }
 
 func (c *ServerCommand) Synopsis() string {
@@ -225,6 +222,13 @@ func (c *ServerCommand) Flags() *FlagSets {
 			"Valid experiments are: " + strings.Join(experiments.ValidExperiments(), ", "),
 	})
 
+	f.StringVar(&StringVar{
+		Name:       "pprof-dump-dir",
+		Target:     &c.flagCLIDump,
+		Completion: complete.PredictDirs("*"),
+		Usage:      "Directory where generated profiles are created. If left unset, files are not generated.",
+	})
+
 	f = set.NewFlagSet("Dev Options")
 
 	f.BoolVar(&BoolVar{
@@ -274,11 +278,12 @@ func (c *ServerCommand) Flags() *FlagSets {
 	})
 
 	f.StringVar(&StringVar{
-		Name:    "dev-listen-address",
-		Target:  &c.flagDevListenAddr,
-		Default: "127.0.0.1:8200",
-		EnvVar:  "VAULT_DEV_LISTEN_ADDRESS",
-		Usage:   "Address to bind to in \"dev\" mode.",
+		Name:        "dev-listen-address",
+		Target:      &c.flagDevListenAddr,
+		Default:     "127.0.0.1:8200",
+		EnvVar:      "VAULT_DEV_LISTEN_ADDRESS",
+		Usage:       "Address to bind to in \"dev\" mode.",
+		Normalizers: []func(string) string{configutil.NormalizeAddr},
 	})
 	f.BoolVar(&BoolVar{
 		Name:    "dev-no-store-token",
@@ -345,6 +350,13 @@ func (c *ServerCommand) Flags() *FlagSets {
 		Hidden:  true,
 	})
 
+	f.BoolVar(&BoolVar{
+		Name:    "dev-no-kv",
+		Target:  &c.flagDevNoKV,
+		Default: false,
+		Hidden:  true,
+	})
+
 	f.BoolVar(&BoolVar{
 		Name:    "dev-kv-v1",
 		Target:  &c.flagDevKVV1,
@@ -366,20 +378,6 @@ func (c *ServerCommand) Flags() *FlagSets {
 		Hidden:  true,
 	})
 
-	f.BoolVar(&BoolVar{
-		Name:    "dev-three-node",
-		Target:  &c.flagDevThreeNode,
-		Default: false,
-		Hidden:  true,
-	})
-
-	f.BoolVar(&BoolVar{
-		Name:    "dev-four-cluster",
-		Target:  &c.flagDevFourCluster,
-		Default: false,
-		Hidden:  true,
-	})
-
 	f.BoolVar(&BoolVar{
 		Name:    "dev-consul",
 		Target:  &c.flagDevConsul,
@@ -422,9 +420,7 @@ func (c *ServerCommand) AutocompleteFlags() complete.Flags {
 }
 
 func (c *ServerCommand) flushLog() {
-	c.logger.(hclog.OutputResettable).ResetOutputWithFlush(&hclog.LoggerOptions{
-		Output: c.logWriter,
-	}, c.logGate)
+	c.logGate.Flush()
 }
 
 func (c *ServerCommand) parseConfig() (*server.Config, []configutil.ConfigError, error) {
@@ -432,10 +428,15 @@ func (c *ServerCommand) parseConfig() (*server.Config, []configutil.ConfigError,
 	// Load the configuration
 	var config *server.Config
 	for _, path := range c.flagConfigs {
-		current, err := server.LoadConfig(path)
+		// TODO (HCL_DUP_KEYS_DEPRECATION): return to server.LoadConfig once deprecation is done
+		current, duplicate, err := server.LoadConfigCheckDuplicate(path)
 		if err != nil {
 			return nil, nil, fmt.Errorf("error loading configuration from %s: %w", path, err)
 		}
+		if duplicate {
+			c.UI.Warn(fmt.Sprintf(
+				"WARNING: Duplicate keys found in the Vault server configuration file %q, duplicate keys in HCL files are deprecated and will be forbidden in a future release.", path))
+		}
 
 		configErrors = append(configErrors, current.Validate(path)...)
 
@@ -447,9 +448,10 @@ func (c *ServerCommand) parseConfig() (*server.Config, []configutil.ConfigError,
 	}
 
 	if config != nil && config.Entropy != nil && config.Entropy.Mode == configutil.EntropyAugmentation && constants.IsFIPS() {
-		c.UI.Warn("WARNING: Entropy Augmentation is not supported in FIPS 140-2 Inside mode; disabling from server configuration!\n")
+		c.UI.Warn("WARNING: Entropy Augmentation is not supported in FIPS 140-3 Inside mode; disabling from server configuration!\n")
 		config.Entropy = nil
 	}
+	entCheckRequestLimiter(c, config)
 
 	return config, configErrors, nil
 }
@@ -515,7 +517,7 @@ func (c *ServerCommand) runRecoveryMode() int {
 	}
 	if config.Storage.Type == storageTypeRaft || (config.HAStorage != nil && config.HAStorage.Type == storageTypeRaft) {
 		if envCA := os.Getenv("VAULT_CLUSTER_ADDR"); envCA != "" {
-			config.ClusterAddr = envCA
+			config.ClusterAddr = configutil.NormalizeAddr(envCA)
 		}
 
 		if len(config.ClusterAddr) == 0 {
@@ -743,9 +745,9 @@ func (c *ServerCommand) runRecoveryMode() int {
 func logProxyEnvironmentVariables(logger hclog.Logger) {
 	proxyCfg := httpproxy.FromEnvironment()
 	cfgMap := map[string]string{
-		"http_proxy":  proxyCfg.HTTPProxy,
-		"https_proxy": proxyCfg.HTTPSProxy,
-		"no_proxy":    proxyCfg.NoProxy,
+		"http_proxy":  configutil.NormalizeAddr(proxyCfg.HTTPProxy),
+		"https_proxy": configutil.NormalizeAddr(proxyCfg.HTTPSProxy),
+		"no_proxy":    configutil.NormalizeAddr(proxyCfg.NoProxy),
 	}
 	for k, v := range cfgMap {
 		u, err := url.Parse(v)
@@ -799,7 +801,7 @@ func (c *ServerCommand) setupStorage(config *server.Config) (physical.Backend, e
 		}
 	case storageTypeRaft:
 		if envCA := os.Getenv("VAULT_CLUSTER_ADDR"); envCA != "" {
-			config.ClusterAddr = envCA
+			config.ClusterAddr = configutil.NormalizeAddr(envCA)
 		}
 		if len(config.ClusterAddr) == 0 {
 			return nil, errors.New("Cluster address must be set when using raft storage")
@@ -898,6 +900,26 @@ func (c *ServerCommand) InitListeners(config *server.Config, disableClustering b
 		}
 		props["max_request_size"] = fmt.Sprintf("%d", lnConfig.MaxRequestSize)
 
+		if lnConfig.CustomMaxJSONDepth == 0 {
+			lnConfig.CustomMaxJSONDepth = vaulthttp.CustomMaxJSONDepth
+		}
+		props["max_json_depth"] = fmt.Sprintf("%d", lnConfig.CustomMaxJSONDepth)
+
+		if lnConfig.CustomMaxJSONStringValueLength == 0 {
+			lnConfig.CustomMaxJSONStringValueLength = vaulthttp.CustomMaxJSONStringValueLength
+		}
+		props["max_json_string_value_length"] = fmt.Sprintf("%d", lnConfig.CustomMaxJSONStringValueLength)
+
+		if lnConfig.CustomMaxJSONObjectEntryCount == 0 {
+			lnConfig.CustomMaxJSONObjectEntryCount = vaulthttp.CustomMaxJSONObjectEntryCount
+		}
+		props["max_json_object_entry_count"] = fmt.Sprintf("%d", lnConfig.CustomMaxJSONObjectEntryCount)
+
+		if lnConfig.CustomMaxJSONArrayElementCount == 0 {
+			lnConfig.CustomMaxJSONArrayElementCount = vaulthttp.CustomMaxJSONArrayElementCount
+		}
+		props["max_json_array_element_count"] = fmt.Sprintf("%d", lnConfig.CustomMaxJSONArrayElementCount)
+
 		if lnConfig.MaxRequestDuration == 0 {
 			lnConfig.MaxRequestDuration = vault.DefaultMaxRequestDuration
 		}
@@ -1031,7 +1053,7 @@ func (c *ServerCommand) Run(args []string) int {
 	}
 
 	// Automatically enable dev mode if other dev flags are provided.
-	if c.flagDevConsul || c.flagDevHA || c.flagDevTransactional || c.flagDevLeasedKV || c.flagDevThreeNode || c.flagDevFourCluster || c.flagDevAutoSeal || c.flagDevKVV1 || c.flagDevTLS {
+	if c.flagDevConsul || c.flagDevHA || c.flagDevTransactional || c.flagDevLeasedKV || c.flagDevAutoSeal || c.flagDevKVV1 || c.flagDevNoKV || c.flagDevTLS {
 		c.flagDev = true
 	}
 
@@ -1095,11 +1117,6 @@ func (c *ServerCommand) Run(args []string) int {
 
 	f.applyLogConfigOverrides(config.SharedConfig)
 
-	// Set 'trace' log level for the following 'dev' clusters
-	if c.flagDevThreeNode || c.flagDevFourCluster {
-		config.LogLevel = "trace"
-	}
-
 	l, err := c.configureLogging(config)
 	if err != nil {
 		c.UI.Error(err.Error())
@@ -1139,7 +1156,8 @@ func (c *ServerCommand) Run(args []string) int {
 
 	logProxyEnvironmentVariables(c.logger)
 
-	if envMlock := os.Getenv("VAULT_DISABLE_MLOCK"); envMlock != "" {
+	envMlock := os.Getenv("VAULT_DISABLE_MLOCK")
+	if envMlock != "" {
 		var err error
 		config.DisableMlock, err = strconv.ParseBool(envMlock)
 		if err != nil {
@@ -1148,10 +1166,34 @@ func (c *ServerCommand) Run(args []string) int {
 		}
 	}
 
+	isMlockSet := func() bool {
+		// DisableMlock key has been found and thus explicitly set
+		return strutil.StrListContainsCaseInsensitive(config.SharedConfig.FoundKeys, "DisableMlock") ||
+			// envvar set
+			envMlock != ""
+	}
+
+	// ensure that the DisableMlock key is explicitly set if using integrated storage
+	if !c.flagDev && mlock.Supported() && config.Storage != nil && config.Storage.Type == storageTypeRaft && !isMlockSet() {
+
+		c.UI.Error(wrapAtLength(
+			"ERROR: disable_mlock must be configured 'true' or 'false': Mlock " +
+				"prevents memory from being swapped to disk for security reasons, " +
+				"but can cause Vault on Integrated Storage to run out of memory " +
+				"if the machine was not provisioned with enough RAM. Disabling " +
+				"mlock can prevent this issue, but can result in the reveal of " +
+				"plaintext secrets when memory is swapped to disk, so it is only " +
+				"recommended on systems with encrypted swap or where swap is disabled." +
+				"Prior to Vault 1.20, disable_mlock defaulted to 'false' when the" +
+				"value was not set explicitly.",
+		))
+		return 1
+	}
+
 	if envLicensePath := os.Getenv(EnvVaultLicensePath); envLicensePath != "" {
 		config.LicensePath = envLicensePath
 	}
-	if envLicense := os.Getenv(EnvVaultLicense); envLicense != "" {
+	if envLicense := os.Getenv(EnvVaultLicense); envLicense != "" && !c.ignoreLicenseEnvVar {
 		config.License = envLicense
 	}
 
@@ -1182,20 +1224,6 @@ func (c *ServerCommand) Run(args []string) int {
 				"in a Docker container, provide the IPC_LOCK cap to the container."))
 	}
 
-	inmemMetrics, metricSink, prometheusEnabled, err := configutil.SetupTelemetry(&configutil.SetupTelemetryOpts{
-		Config:      config.Telemetry,
-		Ui:          c.UI,
-		ServiceName: "vault",
-		DisplayName: "Vault",
-		UserAgent:   useragent.String(),
-		ClusterName: config.ClusterName,
-	})
-	if err != nil {
-		c.UI.Error(fmt.Sprintf("Error initializing telemetry: %s", err))
-		return 1
-	}
-	metricsHelper := metricsutil.NewMetricsHelper(inmemMetrics, prometheusEnabled)
-
 	// Initialize the storage backend
 	var backend physical.Backend
 	if !c.flagDev || config.Storage != nil {
@@ -1211,6 +1239,27 @@ func (c *ServerCommand) Run(args []string) int {
 		}
 	}
 
+	clusterName := config.ClusterName
+
+	// Attempt to retrieve cluster name from insecure storage
+	if clusterName == "" {
+		clusterName, err = c.readClusterNameFromInsecureStorage(backend)
+	}
+
+	inmemMetrics, metricSink, prometheusEnabled, err := configutil.SetupTelemetry(&configutil.SetupTelemetryOpts{
+		Config:      config.Telemetry,
+		Ui:          c.UI,
+		ServiceName: "vault",
+		DisplayName: "Vault",
+		UserAgent:   useragent.String(),
+		ClusterName: clusterName,
+	})
+	if err != nil {
+		c.UI.Error(fmt.Sprintf("Error initializing telemetry: %s", err))
+		return 1
+	}
+	metricsHelper := metricsutil.NewMetricsHelper(inmemMetrics, prometheusEnabled)
+
 	// Initialize the Service Discovery, if there is one
 	var configSR sr.ServiceRegistration
 	if config.ServiceRegistration != nil {
@@ -1254,17 +1303,12 @@ func (c *ServerCommand) Run(args []string) int {
 		return 1
 	}
 
-	currentSeals := setSealResponse.getCreatedSeals()
-	defer c.finalizeSeals(ctx, &currentSeals)
+	c.setSealsToFinalize(setSealResponse.getCreatedSeals())
+	defer func() {
+		c.finalizeSeals(ctx, c.sealsToFinalize)
+	}()
 
 	coreConfig := createCoreConfig(c, config, backend, configSR, setSealResponse.barrierSeal, setSealResponse.unwrapSeal, metricsHelper, metricSink, secureRandomReader)
-	if c.flagDevThreeNode {
-		return c.enableThreeNodeDevCluster(&coreConfig, info, infoKeys, c.flagDevListenAddr, os.Getenv("VAULT_DEV_TEMP_DIR"))
-	}
-
-	if c.flagDevFourCluster {
-		return entEnableFourClusterDev(c, &coreConfig, info, infoKeys, os.Getenv("VAULT_DEV_TEMP_DIR"))
-	}
 
 	if allowPendingRemoval := os.Getenv(consts.EnvVaultAllowPendingRemovalMounts); allowPendingRemoval != "" {
 		var err error
@@ -1440,12 +1484,6 @@ func (c *ServerCommand) Run(args []string) int {
 	infoKeys = append(infoKeys, "administrative namespace")
 	info["administrative namespace"] = config.AdministrativeNamespacePath
 
-	infoKeys = append(infoKeys, "request limiter")
-	info["request limiter"] = "disabled"
-	if config.RequestLimiter != nil && !config.RequestLimiter.Disable {
-		info["request limiter"] = "enabled"
-	}
-
 	sort.Strings(infoKeys)
 	c.UI.Output("==> Vault server configuration:\n")
 
@@ -1541,6 +1579,10 @@ func (c *ServerCommand) Run(args []string) int {
 		}
 	}
 
+	core.SetSealReloadFunc(func(ctx context.Context) error {
+		return c.reloadSealsOnLeaderActivation(ctx, core)
+	})
+
 	// Output the header that the server has started
 	if !c.logFlags.flagCombineLogs {
 		c.UI.Output("==> Vault server started! Log data will stream in below:\n")
@@ -1578,7 +1620,7 @@ func (c *ServerCommand) Run(args []string) int {
 			clusterJson.CACertPath = fmt.Sprintf("%s/%s", certDir, server.VaultDevCAFilename)
 		}
 
-		if c.flagDevClusterJson != "" && !c.flagDevThreeNode {
+		if c.flagDevClusterJson != "" {
 			b, err := jsonutil.EncodeJSON(clusterJson)
 			if err != nil {
 				c.UI.Error(fmt.Sprintf("Error encoding cluster.json: %s", err))
@@ -1603,6 +1645,11 @@ func (c *ServerCommand) Run(args []string) int {
 		coreShutdownDoneCh = core.ShutdownDone()
 	}
 
+	cliDumpCh := make(chan struct{})
+	if c.flagCLIDump != "" {
+		go func() { cliDumpCh <- struct{}{} }()
+	}
+
 	// Wait for shutdown
 	shutdownTriggered := false
 	retCode := 0
@@ -1623,22 +1670,10 @@ func (c *ServerCommand) Run(args []string) int {
 			c.notifySystemd(systemd.SdNotifyReloading)
 
 			// Check for new log level
-			var config *server.Config
-			var configErrors []configutil.ConfigError
-			for _, path := range c.flagConfigs {
-				current, err := server.LoadConfig(path)
-				if err != nil {
-					c.logger.Error("could not reload config", "path", path, "error", err)
-					goto RUNRELOADFUNCS
-				}
-
-				configErrors = append(configErrors, current.Validate(path)...)
-
-				if config == nil {
-					config = current
-				} else {
-					config = config.Merge(current)
-				}
+			config, configErrors, err := c.reloadConfigFiles()
+			if err != nil {
+				c.logger.Error("could not reload config", "error", err)
+				goto RUNRELOADFUNCS
 			}
 
 			// Ensure at least one config was found.
@@ -1652,16 +1687,18 @@ func (c *ServerCommand) Run(args []string) int {
 				c.logger.Warn(cErr.String())
 			}
 
-			if !cmp.Equal(core.GetCoreConfigInternal().Seals, config.Seals) {
-				setSealResponse, err = c.reloadSeals(ctx, core, config)
-				if err != nil {
-					c.UI.Error(fmt.Errorf("error reloading seal config: %s", err).Error())
-					config.Seals = core.GetCoreConfigInternal().Seals
-				} else {
-					// finalize the old seals and set the new seals as the current ones
-					c.finalizeSeals(ctx, &currentSeals)
-					currentSeals = setSealResponse.getCreatedSeals()
-				}
+			if err := core.ReloadRaftConfig(config.Storage.Config); err != nil {
+				c.logger.Warn("error reloading raft config", "error", err.Error())
+			}
+
+			// Note that seal reloading can also be triggered via Core.TriggerSealReload.
+			// See the call to Core.SetSealReloadFunc above.
+			if reloaded, err := c.reloadSealsOnSigHup(ctx, core, config); err != nil {
+				c.UI.Error(fmt.Errorf("error reloading seal config: %s", err).Error())
+				config.Seals = core.GetCoreConfigInternal().Seals
+				goto RUNRELOADFUNCS
+			} else if !reloaded {
+				config.Seals = core.GetCoreConfigInternal().Seals
 			}
 
 			core.SetConfig(config)
@@ -1677,6 +1714,8 @@ func (c *ServerCommand) Run(args []string) int {
 
 			core.ReloadRequestLimiter()
 
+			core.ReloadOverloadController()
+
 			// reloading HCP link
 			hcpLink, err = c.reloadHCPLink(hcpLink, config, core, hcpLogger)
 			if err != nil {
@@ -1688,11 +1727,26 @@ func (c *ServerCommand) Run(args []string) int {
 				level, err := loghelper.ParseLogLevel(config.LogLevel)
 				if err != nil {
 					c.logger.Error("unknown log level found on reload", "level", config.LogLevel)
-					goto RUNRELOADFUNCS
+				} else {
+					core.SetLogLevel(level)
 				}
-				core.SetLogLevel(level)
 			}
 
+			// notify ServiceRegistration that a configuration reload has occurred
+			if sr := coreConfig.GetServiceRegistration(); sr != nil {
+				var srConfig *map[string]string
+				if config.ServiceRegistration != nil {
+					srConfig = &config.ServiceRegistration.Config
+				}
+				sr.NotifyConfigurationReload(srConfig)
+			}
+
+			if err := core.ReloadCensusManager(ctx, false); err != nil {
+				c.UI.Error(err.Error())
+			}
+
+			core.ReloadReplicationCanaryWriteInterval()
+
 		RUNRELOADFUNCS:
 			if err := c.Reload(c.reloadFuncsLock, c.reloadFuncs, c.flagConfigs, core); err != nil {
 				c.UI.Error(fmt.Sprintf("Error(s) were encountered during reload: %s", err))
@@ -1703,22 +1757,14 @@ func (c *ServerCommand) Run(args []string) int {
 				c.UI.Error(err.Error())
 			}
 
-			if err := core.ReloadCensus(); err != nil {
-				c.UI.Error(err.Error())
-			}
-			select {
-			case c.licenseReloadedCh <- err:
-			default:
-			}
-
 			// Let the managedKeyRegistry react to configuration changes (i.e.
 			// changes in kms_libraries)
 			core.ReloadManagedKeyRegistryConfig()
 
 			// Notify systemd that the server has completed reloading config
 			c.notifySystemd(systemd.SdNotifyReady)
-
 		case <-c.SigUSR2Ch:
+			c.logger.Info("Received SIGUSR2, dumping goroutines. This is expected behavior. Vault continues to run normally.")
 			logWriter := c.logger.StandardWriter(&hclog.StandardLoggerOptions{})
 			pprof.Lookup("goroutine").WriteTo(logWriter, 2)
 
@@ -1760,42 +1806,60 @@ func (c *ServerCommand) Run(args []string) int {
 			// We can only get pprof outputs via the API but sometimes Vault can get
 			// into a state where it cannot process requests so we can get pprof outputs
 			// via SIGUSR2.
-			if os.Getenv("VAULT_PPROF_WRITE_TO_FILE") != "" {
-				dir := ""
-				path := os.Getenv("VAULT_PPROF_FILE_PATH")
-				if path != "" {
-					if _, err := os.Stat(path); err != nil {
-						c.logger.Error("Checking pprof path failed", "error", err)
-						continue
-					}
-					dir = path
-				} else {
-					dir, err = os.MkdirTemp("", "vault-pprof")
-					if err != nil {
-						c.logger.Error("Could not create temporary directory for pprof", "error", err)
-						continue
-					}
-				}
+			pprofPath := filepath.Join(os.TempDir(), "vault-pprof")
+			cpuProfileDuration := time.Second * 1
+			err := WritePprofToFile(pprofPath, cpuProfileDuration)
+			if err != nil {
+				c.logger.Error(err.Error())
+				continue
+			}
 
-				dumps := []string{"goroutine", "heap", "allocs", "threadcreate"}
-				for _, dump := range dumps {
-					pFile, err := os.Create(filepath.Join(dir, dump))
-					if err != nil {
-						c.logger.Error("error creating pprof file", "name", dump, "error", err)
-						break
-					}
+			c.logger.Info(fmt.Sprintf("Wrote pprof files to: %s", pprofPath))
+		case <-cliDumpCh:
+			path := c.flagCLIDump
+
+			if _, err := os.Stat(path); err != nil && !errors.Is(err, os.ErrNotExist) {
+				c.logger.Error("Checking cli dump path failed", "error", err)
+				continue
+			}
+
+			pprofPath := filepath.Join(path, "vault-pprof")
+			err := os.MkdirAll(pprofPath, os.ModePerm)
+			if err != nil {
+				c.logger.Error("Could not create temporary directory for pprof", "error", err)
+				continue
+			}
+
+			dumps := []string{"goroutine", "heap", "allocs", "threadcreate", "profile"}
+			for _, dump := range dumps {
+				pFile, err := os.Create(filepath.Join(pprofPath, dump))
+				if err != nil {
+					c.logger.Error("error creating pprof file", "name", dump, "error", err)
+					break
+				}
 
+				if dump != "profile" {
 					err = pprof.Lookup(dump).WriteTo(pFile, 0)
 					if err != nil {
 						c.logger.Error("error generating pprof data", "name", dump, "error", err)
 						pFile.Close()
 						break
 					}
-					pFile.Close()
+				} else {
+					// CPU profiles need to run for a duration so we're going to run it
+					// just for one second to avoid blocking here.
+					if err := pprof.StartCPUProfile(pFile); err != nil {
+						c.logger.Error("could not start CPU profile: ", err)
+						pFile.Close()
+						break
+					}
+					time.Sleep(time.Second * 1)
+					pprof.StopCPUProfile()
 				}
-
-				c.logger.Info(fmt.Sprintf("Wrote pprof files to: %s", dir))
+				pFile.Close()
 			}
+
+			c.logger.Info(fmt.Sprintf("Wrote startup pprof files to: %s", pprofPath))
 		}
 	}
 	// Notify systemd that the server is shutting down
@@ -1822,6 +1886,29 @@ func (c *ServerCommand) Run(args []string) int {
 	return retCode
 }
 
+func (c *ServerCommand) reloadConfigFiles() (*server.Config, []configutil.ConfigError, error) {
+	var config *server.Config
+	var configErrors []configutil.ConfigError
+	for _, path := range c.flagConfigs {
+		// don't care about HCL duplicate attributes here on reloading
+		// TODO (HCL_DUP_KEYS_DEPRECATION): go back to server.LoadConfig and remove duplicate when deprecation is done
+		current, _, err := server.LoadConfigCheckDuplicate(path)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		configErrors = append(configErrors, current.Validate(path)...)
+
+		if config == nil {
+			config = current
+		} else {
+			config = config.Merge(current)
+		}
+	}
+
+	return config, configErrors, nil
+}
+
 func (c *ServerCommand) configureSeals(ctx context.Context, config *server.Config, backend physical.Backend, infoKeys []string, info map[string]string) (*SetSealResponse, io.Reader, error) {
 	existingSealGenerationInfo, err := vault.PhysicalSealGenInfo(ctx, backend)
 	if err != nil {
@@ -1863,8 +1950,15 @@ func (c *ServerCommand) configureSeals(ctx context.Context, config *server.Confi
 	return setSealResponse, secureRandomReader, nil
 }
 
-func (c *ServerCommand) finalizeSeals(ctx context.Context, seals *[]*vault.Seal) {
-	for _, seal := range *seals {
+func (c *ServerCommand) setSealsToFinalize(seals []*vault.Seal) {
+	prev := c.sealsToFinalize
+	c.sealsToFinalize = seals
+
+	c.finalizeSeals(context.Background(), prev)
+}
+
+func (c *ServerCommand) finalizeSeals(ctx context.Context, seals []*vault.Seal) {
+	for _, seal := range seals {
 		// Ensure that the seal finalizer is called, even if using verify-only
 		err := (*seal).Finalize(ctx)
 		if err != nil {
@@ -2063,271 +2157,37 @@ func (c *ServerCommand) enableDev(core *vault.Core, coreConfig *vault.CoreConfig
 		}
 	}
 
-	kvVer := "2"
-	if c.flagDevKVV1 || c.flagDevLeasedKV {
-		kvVer = "1"
-	}
-	req := &logical.Request{
-		Operation:   logical.UpdateOperation,
-		ClientToken: init.RootToken,
-		Path:        "sys/mounts/secret",
-		Data: map[string]interface{}{
-			"type":        "kv",
-			"path":        "secret/",
-			"description": "key/value secret storage",
-			"options": map[string]string{
-				"version": kvVer,
-			},
-		},
-	}
-	resp, err := core.HandleRequest(ctx, req)
-	if err != nil {
-		return nil, fmt.Errorf("error creating default KV store: %w", err)
-	}
-	if resp.IsError() {
-		return nil, fmt.Errorf("failed to create default KV store: %w", resp.Error())
-	}
-
-	return init, nil
-}
-
-func (c *ServerCommand) enableThreeNodeDevCluster(base *vault.CoreConfig, info map[string]string, infoKeys []string, devListenAddress, tempDir string) int {
-	conf, opts := teststorage.ClusterSetup(base, &vault.TestClusterOptions{
-		HandlerFunc:       vaulthttp.Handler,
-		BaseListenAddress: c.flagDevListenAddr,
-		Logger:            c.logger,
-		TempDir:           tempDir,
-		DefaultHandlerProperties: vault.HandlerProperties{
-			ListenerConfig: &configutil.Listener{
-				Profiling: configutil.ListenerProfiling{
-					UnauthenticatedPProfAccess: true,
-				},
-				Telemetry: configutil.ListenerTelemetry{
-					UnauthenticatedMetricsAccess: true,
-				},
-			},
-		},
-	}, nil)
-	testCluster := vault.NewTestCluster(&testing.RuntimeT{}, conf, opts)
-	defer c.cleanupGuard.Do(testCluster.Cleanup)
-
-	if constants.IsEnterprise {
-		err := testcluster.WaitForActiveNodeAndPerfStandbys(context.Background(), testCluster)
-		if err != nil {
-			c.UI.Error(fmt.Sprintf("perf standbys didn't become ready: %v", err))
-			return 1
+	if !c.flagDevNoKV {
+		if !core.IsMountTypeAllowed("kv") {
+			return nil, fmt.Errorf("license does not allow for KV mounts, consider using -dev-no-kv flag")
+		}
+		kvVer := "2"
+		if c.flagDevKVV1 || c.flagDevLeasedKV {
+			kvVer = "1"
 		}
-	}
-
-	info["cluster parameters path"] = testCluster.TempDir
-	infoKeys = append(infoKeys, "cluster parameters path")
-
-	for i, core := range testCluster.Cores {
-		info[fmt.Sprintf("node %d api address", i)] = fmt.Sprintf("https://%s", core.Listeners[0].Address.String())
-		infoKeys = append(infoKeys, fmt.Sprintf("node %d api address", i))
-	}
-
-	infoKeys = append(infoKeys, "version")
-	verInfo := version.GetVersion()
-	info["version"] = verInfo.FullVersionNumber(false)
-	if verInfo.Revision != "" {
-		info["version sha"] = strings.Trim(verInfo.Revision, "'")
-		infoKeys = append(infoKeys, "version sha")
-	}
-
-	infoKeys = append(infoKeys, "cgo")
-	info["cgo"] = "disabled"
-	if version.CgoEnabled {
-		info["cgo"] = "enabled"
-	}
-
-	infoKeys = append(infoKeys, "go version")
-	info["go version"] = runtime.Version()
-
-	fipsStatus := entGetFIPSInfoKey()
-	if fipsStatus != "" {
-		infoKeys = append(infoKeys, "fips")
-		info["fips"] = fipsStatus
-	}
-
-	// Server configuration output
-	padding := 24
-
-	sort.Strings(infoKeys)
-	c.UI.Output("==> Vault server configuration:\n")
-
-	for _, k := range infoKeys {
-		c.UI.Output(fmt.Sprintf(
-			"%s%s: %s",
-			strings.Repeat(" ", padding-len(k)),
-			strings.Title(k),
-			info[k]))
-	}
-
-	c.UI.Output("")
-
-	for _, core := range testCluster.Cores {
-		core.Server.Handler = vaulthttp.Handler.Handler(&vault.HandlerProperties{
-			Core:           core.Core,
-			ListenerConfig: &configutil.Listener{},
-		})
-		core.SetClusterHandler(core.Server.Handler)
-	}
-
-	testCluster.Start()
-
-	ctx := namespace.ContextWithNamespace(context.Background(), namespace.RootNamespace)
-
-	if base.DevToken != "" {
 		req := &logical.Request{
-			ID:          "dev-gen-root",
 			Operation:   logical.UpdateOperation,
-			ClientToken: testCluster.RootToken,
-			Path:        "auth/token/create",
+			ClientToken: init.RootToken,
+			Path:        "sys/mounts/secret",
 			Data: map[string]interface{}{
-				"id":                base.DevToken,
-				"policies":          []string{"root"},
-				"no_parent":         true,
-				"no_default_policy": true,
+				"type":        "kv",
+				"path":        "secret/",
+				"description": "key/value secret storage",
+				"options": map[string]string{
+					"version": kvVer,
+				},
 			},
 		}
-		resp, err := testCluster.Cores[0].HandleRequest(ctx, req)
-		if err != nil {
-			c.UI.Error(fmt.Sprintf("failed to create root token with ID %s: %s", base.DevToken, err))
-			return 1
-		}
-		if resp == nil {
-			c.UI.Error(fmt.Sprintf("nil response when creating root token with ID %s", base.DevToken))
-			return 1
-		}
-		if resp.Auth == nil {
-			c.UI.Error(fmt.Sprintf("nil auth when creating root token with ID %s", base.DevToken))
-			return 1
-		}
-
-		testCluster.RootToken = resp.Auth.ClientToken
-
-		req.ID = "dev-revoke-init-root"
-		req.Path = "auth/token/revoke-self"
-		req.Data = nil
-		_, err = testCluster.Cores[0].HandleRequest(ctx, req)
-		if err != nil {
-			c.UI.Output(fmt.Sprintf("failed to revoke initial root token: %s", err))
-			return 1
-		}
-	}
-
-	// Set the token
-	tokenHelper, err := c.TokenHelper()
-	if err != nil {
-		c.UI.Error(fmt.Sprintf("Error getting token helper: %s", err))
-		return 1
-	}
-	if err := tokenHelper.Store(testCluster.RootToken); err != nil {
-		c.UI.Error(fmt.Sprintf("Error storing in token helper: %s", err))
-		return 1
-	}
-
-	if err := ioutil.WriteFile(filepath.Join(testCluster.TempDir, "root_token"), []byte(testCluster.RootToken), 0o600); err != nil {
-		c.UI.Error(fmt.Sprintf("Error writing token to tempfile: %s", err))
-		return 1
-	}
-
-	c.UI.Output(fmt.Sprintf(
-		"==> Three node dev mode is enabled\n\n" +
-			"The unseal key and root token are reproduced below in case you\n" +
-			"want to seal/unseal the Vault or play with authentication.\n",
-	))
-
-	for i, key := range testCluster.BarrierKeys {
-		c.UI.Output(fmt.Sprintf(
-			"Unseal Key %d: %s",
-			i+1, base64.StdEncoding.EncodeToString(key),
-		))
-	}
-
-	c.UI.Output(fmt.Sprintf(
-		"\nRoot Token: %s\n", testCluster.RootToken,
-	))
-
-	c.UI.Output(fmt.Sprintf(
-		"\nUseful env vars:\n"+
-			"VAULT_TOKEN=%s\n"+
-			"VAULT_ADDR=%s\n"+
-			"VAULT_CACERT=%s/ca_cert.pem\n",
-		testCluster.RootToken,
-		testCluster.Cores[0].Client.Address(),
-		testCluster.TempDir,
-	))
-
-	if c.flagDevClusterJson != "" {
-		clusterJson := testcluster.ClusterJson{
-			Nodes:      []testcluster.ClusterNode{},
-			CACertPath: filepath.Join(testCluster.TempDir, "ca_cert.pem"),
-			RootToken:  testCluster.RootToken,
-		}
-		for _, core := range testCluster.Cores {
-			clusterJson.Nodes = append(clusterJson.Nodes, testcluster.ClusterNode{
-				APIAddress: core.Client.Address(),
-			})
-		}
-		b, err := jsonutil.EncodeJSON(clusterJson)
+		resp, err := core.HandleRequest(ctx, req)
 		if err != nil {
-			c.UI.Error(fmt.Sprintf("Error encoding cluster.json: %s", err))
-			return 1
+			return nil, fmt.Errorf("error creating default KV store: %w", err)
 		}
-		err = os.WriteFile(c.flagDevClusterJson, b, 0o600)
-		if err != nil {
-			c.UI.Error(fmt.Sprintf("Error writing cluster.json %q: %s", c.flagDevClusterJson, err))
-			return 1
+		if resp.IsError() {
+			return nil, fmt.Errorf("failed to create default KV store: %w", resp.Error())
 		}
 	}
 
-	// Output the header that the server has started
-	c.UI.Output("==> Vault server started! Log data will stream in below:\n")
-
-	// Inform any tests that the server is ready
-	select {
-	case c.startedCh <- struct{}{}:
-	default:
-	}
-
-	// Release the log gate.
-	c.flushLog()
-
-	// Wait for shutdown
-	shutdownTriggered := false
-
-	for !shutdownTriggered {
-		select {
-		case <-c.ShutdownCh:
-			c.UI.Output("==> Vault shutdown triggered")
-
-			// Stop the listeners so that we don't process further client requests.
-			c.cleanupGuard.Do(testCluster.Cleanup)
-
-			// Finalize will wait until after Vault is sealed, which means the
-			// request forwarding listeners will also be closed (and also
-			// waited for).
-			for _, core := range testCluster.Cores {
-				if err := core.Shutdown(); err != nil {
-					c.UI.Error(fmt.Sprintf("Error with core shutdown: %s", err))
-				}
-			}
-
-			shutdownTriggered = true
-
-		case <-c.SighupCh:
-			c.UI.Output("==> Vault reload triggered")
-			for _, core := range testCluster.Cores {
-				if err := c.Reload(core.ReloadFuncsLock, core.ReloadFuncs, nil, core.Core); err != nil {
-					c.UI.Error(fmt.Sprintf("Error(s) were encountered during reload: %s", err))
-				}
-			}
-		}
-	}
-
-	return 0
+	return init, nil
 }
 
 // addPlugin adds any plugins to the catalog
@@ -2435,7 +2295,7 @@ func (c *ServerCommand) detectRedirect(detect physical.RedirectDetect,
 	}
 
 	// Return the URL string
-	return url.String(), nil
+	return configutil.NormalizeAddr(url.String()), nil
 }
 
 func (c *ServerCommand) Reload(lock *sync.RWMutex, reloadFuncs *map[string][]reloadutil.ReloadFunc, configPath []string, core *vault.Core) error {
@@ -2463,6 +2323,15 @@ func (c *ServerCommand) Reload(lock *sync.RWMutex, reloadFuncs *map[string][]rel
 					}
 				}
 			}
+
+		case strings.HasPrefix(k, "observations|"):
+			for _, relFunc := range relFuncs {
+				if relFunc != nil {
+					if err := relFunc(); err != nil {
+						reloadErrors = multierror.Append(reloadErrors, fmt.Errorf("error encountered reloading observation system with ledger at path %q: %w", strings.TrimPrefix(k, "observations|"), err))
+					}
+				}
+			}
 		}
 	}
 
@@ -2670,7 +2539,7 @@ func setSeal(c *ServerCommand, config *server.Config, infoKeys []string, info ma
 				wrapper = aeadwrapper.NewShamirWrapper()
 			}
 			configuredSeals++
-		} else if server.IsMultisealSupported() {
+		} else if config.IsMultisealEnabled() {
 			recordSealConfigWarning(fmt.Errorf("error configuring seal: %v", wrapperConfigError))
 		} else {
 			// It seems that we are checking for this particular error here is to distinguish between a
@@ -2738,7 +2607,7 @@ func setSeal(c *ServerCommand, config *server.Config, infoKeys []string, info ma
 
 	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 	// Compute seal generation
-	sealGenerationInfo, err := c.computeSealGenerationInfo(existingSealGenerationInfo, allSealKmsConfigs, hasPartiallyWrappedPaths)
+	sealGenerationInfo, err := c.computeSealGenerationInfo(existingSealGenerationInfo, allSealKmsConfigs, hasPartiallyWrappedPaths, config.IsMultisealEnabled())
 	if err != nil {
 		return nil, err
 	}
@@ -2796,7 +2665,7 @@ func setSeal(c *ServerCommand, config *server.Config, infoKeys []string, info ma
 		}
 		unwrapSeal = vault.NewDefaultSeal(a)
 
-	case server.IsMultisealSupported():
+	case config.IsMultisealEnabled():
 		// We know we are not using Shamir seal, that we are not migrating away from one, and multi seal is supported,
 		// so just put enabled and disabled wrappers on the same seal Access
 		allSealWrappers := append(enabledSealWrappers, disabledSealWrappers...)
@@ -2837,7 +2706,7 @@ func setSeal(c *ServerCommand, config *server.Config, infoKeys []string, info ma
 	}, nil
 }
 
-func (c *ServerCommand) computeSealGenerationInfo(existingSealGenInfo *vaultseal.SealGenerationInfo, sealConfigs []*configutil.KMS, hasPartiallyWrappedPaths bool) (*vaultseal.SealGenerationInfo, error) {
+func (c *ServerCommand) computeSealGenerationInfo(existingSealGenInfo *vaultseal.SealGenerationInfo, sealConfigs []*configutil.KMS, hasPartiallyWrappedPaths, multisealEnabled bool) (*vaultseal.SealGenerationInfo, error) {
 	generation := uint64(1)
 
 	if existingSealGenInfo != nil {
@@ -2857,9 +2726,10 @@ func (c *ServerCommand) computeSealGenerationInfo(existingSealGenInfo *vaultseal
 	newSealGenInfo := &vaultseal.SealGenerationInfo{
 		Generation: generation,
 		Seals:      sealConfigs,
+		Enabled:    multisealEnabled,
 	}
 
-	if server.IsMultisealSupported() {
+	if multisealEnabled || (existingSealGenInfo != nil && existingSealGenInfo.Enabled) {
 		err := newSealGenInfo.Validate(existingSealGenInfo, hasPartiallyWrappedPaths)
 		if err != nil {
 			return nil, err
@@ -2940,11 +2810,11 @@ func initHaBackend(c *ServerCommand, config *server.Config, coreConfig *vault.Co
 func determineRedirectAddr(c *ServerCommand, coreConfig *vault.CoreConfig, config *server.Config) error {
 	var retErr error
 	if envRA := os.Getenv("VAULT_API_ADDR"); envRA != "" {
-		coreConfig.RedirectAddr = envRA
+		coreConfig.RedirectAddr = configutil.NormalizeAddr(envRA)
 	} else if envRA := os.Getenv("VAULT_REDIRECT_ADDR"); envRA != "" {
-		coreConfig.RedirectAddr = envRA
+		coreConfig.RedirectAddr = configutil.NormalizeAddr(envRA)
 	} else if envAA := os.Getenv("VAULT_ADVERTISE_ADDR"); envAA != "" {
-		coreConfig.RedirectAddr = envAA
+		coreConfig.RedirectAddr = configutil.NormalizeAddr(envAA)
 	}
 
 	// Attempt to detect the redirect address, if possible
@@ -2976,7 +2846,7 @@ func determineRedirectAddr(c *ServerCommand, coreConfig *vault.CoreConfig, confi
 		if c.flagDevTLS {
 			protocol = "https"
 		}
-		coreConfig.RedirectAddr = fmt.Sprintf("%s://%s", protocol, config.Listeners[0].Address)
+		coreConfig.RedirectAddr = configutil.NormalizeAddr(fmt.Sprintf("%s://%s", protocol, config.Listeners[0].Address))
 	}
 	return retErr
 }
@@ -2985,7 +2855,7 @@ func findClusterAddress(c *ServerCommand, coreConfig *vault.CoreConfig, config *
 	if disableClustering {
 		coreConfig.ClusterAddr = ""
 	} else if envCA := os.Getenv("VAULT_CLUSTER_ADDR"); envCA != "" {
-		coreConfig.ClusterAddr = envCA
+		coreConfig.ClusterAddr = configutil.NormalizeAddr(envCA)
 	} else {
 		var addrToUse string
 		switch {
@@ -3017,7 +2887,7 @@ func findClusterAddress(c *ServerCommand, coreConfig *vault.CoreConfig, config *
 		u.Host = net.JoinHostPort(host, strconv.Itoa(nPort+1))
 		// Will always be TLS-secured
 		u.Scheme = "https"
-		coreConfig.ClusterAddr = u.String()
+		coreConfig.ClusterAddr = configutil.NormalizeAddr(u.String())
 	}
 
 CLUSTER_SYNTHESIS_COMPLETE:
@@ -3081,7 +2951,6 @@ func createCoreConfig(c *ServerCommand, config *server.Config, backend physical.
 		AuditBackends:                  c.AuditBackends,
 		CredentialBackends:             c.CredentialBackends,
 		LogicalBackends:                c.LogicalBackends,
-		EventBackends:                  c.EventBackends,
 		LogLevel:                       config.LogLevel,
 		Logger:                         c.logger,
 		DetectDeadlocks:                config.DetectDeadlocks,
@@ -3091,6 +2960,7 @@ func createCoreConfig(c *ServerCommand, config *server.Config, backend physical.
 		DisableMlock:                   config.DisableMlock,
 		MaxLeaseTTL:                    config.MaxLeaseTTL,
 		DefaultLeaseTTL:                config.DefaultLeaseTTL,
+		RemoveIrrevocableLeaseAfter:    config.RemoveIrrevocableLeaseAfter,
 		ClusterName:                    config.ClusterName,
 		CacheSize:                      config.CacheSize,
 		PluginDirectory:                config.PluginDirectory,
@@ -3103,6 +2973,7 @@ func createCoreConfig(c *ServerCommand, config *server.Config, backend physical.
 		DisableSealWrap:                config.DisableSealWrap,
 		DisablePerformanceStandby:      config.DisablePerformanceStandby,
 		DisableIndexing:                config.DisableIndexing,
+		AllowAuditLogPrefixing:         config.AllowAuditLogPrefixing,
 		AllLoggers:                     c.allLoggers,
 		BuiltinRegistry:                builtinplugins.Registry,
 		DisableKeyEncodingChecks:       config.DisablePrintableCheck,
@@ -3113,15 +2984,12 @@ func createCoreConfig(c *ServerCommand, config *server.Config, backend physical.
 		EnableResponseHeaderRaftNodeID: config.EnableResponseHeaderRaftNodeID,
 		License:                        config.License,
 		LicensePath:                    config.LicensePath,
+		LicenseReload:                  c.licenseReloadedCh,
 		DisableSSCTokens:               config.DisableSSCTokens,
 		Experiments:                    config.Experiments,
 		AdministrativeNamespacePath:    config.AdministrativeNamespacePath,
-	}
-
-	if config.RequestLimiter != nil {
-		coreConfig.DisableRequestLimiter = config.RequestLimiter.Disable
-	} else {
-		coreConfig.DisableRequestLimiter = true
+		ObservationSystemConfig:        config.Observations,
+		ReportingScanDirectory:         config.ReportingScanDirectory,
 	}
 
 	if c.flagDev {
@@ -3295,11 +3163,7 @@ func initDevCore(c *ServerCommand, coreConfig *vault.CoreConfig, config *server.
 func startHttpServers(c *ServerCommand, core *vault.Core, config *server.Config, lns []listenerutil.Listener) error {
 	for _, ln := range lns {
 		if ln.Config == nil {
-			return fmt.Errorf("Found nil listener config after parsing")
-		}
-
-		if err := config2.IsValidListener(ln.Config); err != nil {
-			return err
+			return fmt.Errorf("found nil listener config after parsing")
 		}
 
 		handler := vaulthttp.Handler.Handler(&vault.HandlerProperties{
@@ -3346,38 +3210,185 @@ func startHttpServers(c *ServerCommand, core *vault.Core, config *server.Config,
 	return nil
 }
 
-func (c *ServerCommand) reloadSeals(ctx context.Context, core *vault.Core, config *server.Config) (*SetSealResponse, error) {
-	if len(config.Seals) == 1 && config.Seals[0].Disabled {
-		return nil, errors.New("moving from autoseal to shamir requires seal migration")
+// reloadSealsOnLeaderActivation checks to see if the in-memory seal generation info is stale, and if so,
+// reloads the seal configuration.
+func (c *ServerCommand) reloadSealsOnLeaderActivation(ctx context.Context, core *vault.Core) error {
+	existingSealGenerationInfo, err := vault.PhysicalSealGenInfo(ctx, core.PhysicalAccess())
+	if err != nil {
+		return fmt.Errorf("error checking for stale seal generation info: %w", err)
+	}
+	if existingSealGenerationInfo == nil {
+		c.logger.Debug("not reloading seals config since there is no seal generation info in storage")
+		return nil
+	}
+
+	currentSealGenerationInfo := core.SealAccess().GetAccess().GetSealGenerationInfo()
+	if currentSealGenerationInfo == nil {
+		c.logger.Debug("not reloading seal config since there is no current generation info (the seal has not been initialized)")
+		return nil
 	}
+	if currentSealGenerationInfo.Generation >= existingSealGenerationInfo.Generation {
+		c.logger.Debug("seal generation info is up to date, not reloading seal configuration")
+		return nil
+	}
+
+	// Reload seal configuration
 
+	config, _, err := c.reloadConfigFiles()
+	if err != nil {
+		return fmt.Errorf("error reading configuration files while reloading seal configuration: %w", err)
+	}
+	if config == nil {
+		return errors.New("no configuration files found while reloading seal configuration")
+	}
+	reloaded, err := c.reloadSeals(ctx, false, core, config)
+	if reloaded {
+		core.SetConfig(config)
+	}
+	return err
+}
+
+// reloadSealsOnSigHup will reload seal configurtion as a result of receiving a SIGHUP signal.
+func (c *ServerCommand) reloadSealsOnSigHup(ctx context.Context, core *vault.Core, config *server.Config) (bool, error) {
+	return c.reloadSeals(ctx, true, core, config)
+}
+
+// reloadSeals reloads configuration files and determines whether it needs to re-create the Seal.Access() objects.
+// This function needs do detect that core.SealAccess() is no longer using the seal Wrapper that is specified
+// in the seal configuration files.
+// This function returns true if the newConfig was used to re-create the Seal.Access() objects. In other words,
+// if false is returned, there were no changes done to the seals.
+func (c *ServerCommand) reloadSeals(ctx context.Context, grabStateLock bool, core *vault.Core, newConfig *server.Config) (bool, error) {
+	if core.IsInSealMigrationMode(grabStateLock) {
+		c.logger.Debug("not reloading seal configuration since Vault is in migration mode")
+		return false, nil
+	}
+
+	currentConfig := core.GetCoreConfigInternal()
+
+	// We only want to reload if multiseal is currently enabled, or it is being enabled
+	if !(currentConfig.IsMultisealEnabled() || newConfig.IsMultisealEnabled()) {
+		c.logger.Debug("not reloading seal configuration since enable_multiseal is not set, nor is it being disabled")
+		return false, nil
+	}
+
+	if conf, err := core.PhysicalBarrierSealConfig(ctx); err != nil {
+		return false, fmt.Errorf("error reading barrier seal configuration from storage while reloading seals: %w", err)
+	} else if conf == nil {
+		c.logger.Debug("not reloading seal configuration since there is no barrier config in storage (the seal has not been initialized)")
+		return false, nil
+	}
+
+	if core.SealAccess().BarrierSealConfigType() == vault.SealConfigTypeShamir {
+		switch {
+		case len(newConfig.Seals) == 0:
+			// We are fine, our ServerCommand.reloadConfigFiles() does not do the "automagic" creation
+			// of the Shamir seal configuration.
+			c.logger.Debug("not reloading seal configuration since the new one has no seal stanzas")
+			return false, nil
+
+		case len(newConfig.Seals) == 1 && newConfig.Seals[0].Disabled:
+			// If we have only one seal and it is disabled, it means that the newConfig wants to migrate
+			// to Shamir, which is not supported by seal reloading.
+			c.logger.Debug("not reloading seal configuration since the new one specifies migration to Shamir")
+			return false, nil
+
+		case len(newConfig.Seals) == 1 && newConfig.Seals[0].Type == vault.SealConfigTypeShamir.String():
+			// Having a single Shamir seal in newConfig is not really possible, since a Shamir seal
+			// is specified in configuration by *not* having a seal stanza. If we were to hit this
+			// case, though, it is equivalent to trying to migrate to Shamir, which is not supported
+			// by seal reloading.
+			c.logger.Debug("not reloading seal configuration since the new one has single Shamir stanza")
+			return false, nil
+		}
+	}
+
+	// Verify that the new config we picked up is not trying to migrate from autoseal to shamir
+	if len(newConfig.Seals) == 1 && newConfig.Seals[0].Disabled {
+		// If we get here, it means the node was not started in migration mode, but the new config says
+		// we should go into migration mode. This case should be caught by the core.IsInSealMigrationMode()
+		// above.
+
+		return false, errors.New("not reloading seal configuration: moving from autoseal to shamir requires seal migration")
+	}
+
+	// Verify that the new config we picked up is not trying to migrate shamir to autoseal
 	if core.SealAccess().BarrierSealConfigType() == vault.SealConfigTypeShamir {
-		return nil, errors.New("moving from shamir to autoseal requires seal migration")
+		return false, errors.New("not reloading seal configuration: moving from Shamir to autoseal requires seal migration")
 	}
 
 	infoKeysReload := make([]string, 0)
 	infoReload := make(map[string]string)
 
-	setSealResponse, secureRandomReader, err := c.configureSeals(ctx, config, core.PhysicalAccess(), infoKeysReload, infoReload)
+	core.SetMultisealEnabled(newConfig.IsMultisealEnabled())
+	setSealResponse, secureRandomReader, err := c.configureSeals(ctx, newConfig, core.PhysicalAccess(), infoKeysReload, infoReload)
 	if err != nil {
-		return nil, err
+		return false, fmt.Errorf("error reloading seal configuration: %w", err)
 	}
 	if setSealResponse.sealConfigError != nil {
-		return nil, err
+		return false, fmt.Errorf("error reloading seal configuration: %w", setSealResponse.sealConfigError)
 	}
 
 	newGen := setSealResponse.barrierSeal.GetAccess().GetSealGenerationInfo()
 
-	err = core.SetSeals(setSealResponse.barrierSeal, secureRandomReader, !newGen.IsRewrapped() || setSealResponse.hasPartiallyWrappedPaths)
+	var standby, perf bool
+	if grabStateLock {
+		// If grabStateLock is false we know we are on a leader activation
+		standby, perf = core.StandbyStates()
+	}
+	switch {
+	case !perf && !standby:
+		c.logger.Debug("persisting reloaded seals as we are the active node")
+		err = core.SetSeals(ctx, grabStateLock, setSealResponse.barrierSeal, secureRandomReader, !newGen.IsRewrapped() || setSealResponse.hasPartiallyWrappedPaths)
+		if err != nil {
+			return false, fmt.Errorf("error setting seal: %s", err)
+		}
+
+		if err := core.SetPhysicalSealGenInfo(ctx, newGen); err != nil {
+			c.logger.Warn("could not update seal information in storage", "err", err)
+		}
+	case perf:
+		c.logger.Debug("updating reloaded seals in memory on perf standby")
+		err = core.SetSealsOnPerfStandby(ctx, grabStateLock, setSealResponse.barrierSeal, secureRandomReader)
+		if err != nil {
+			return false, fmt.Errorf("error setting seal on perf standby: %s", err)
+		}
+	default:
+		return false, errors.New("skipping seal reload as we are a standby")
+	}
+
+	// finalize the old seals and set the new seals as the current ones
+	c.setSealsToFinalize(setSealResponse.getCreatedSeals())
+
+	c.logger.Debug("seal configuration reloaded successfully")
+
+	return true, nil
+}
+
+// Attempt to read the cluster name from the insecure storage.
+func (c *ServerCommand) readClusterNameFromInsecureStorage(b physical.Backend) (string, error) {
+	ctx := context.Background()
+	entry, err := b.Get(ctx, "core/cluster/local/name")
 	if err != nil {
-		return nil, fmt.Errorf("error setting seal: %s", err)
+		return "", err
 	}
 
-	if err := core.SetPhysicalSealGenInfo(ctx, newGen); err != nil {
-		c.logger.Warn("could not update seal information in storage", "err", err)
+	var result map[string]interface{}
+	// Decode JSON data into the map
+
+	if entry != nil {
+		if err := jsonutil.DecodeJSON(entry.Value, &result); err != nil {
+			return "", fmt.Errorf("failed to decode JSON data: %w", err)
+		}
+	}
+
+	// Retrieve the value of the "name" field from the map
+	name, ok := result["name"].(string)
+	if !ok {
+		return "", fmt.Errorf("failed to extract name field from decoded JSON")
 	}
 
-	return setSealResponse, nil
+	return name, nil
 }
 
 func SetStorageMigration(b physical.Backend, active bool) error {
diff --git a/command/server/config.go b/command/server/config.go
index 938683d6a76..f960f404ca5 100644
--- a/command/server/config.go
+++ b/command/server/config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
@@ -11,20 +11,24 @@ import (
 	"math"
 	"os"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/hashicorp/go-discover"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/hcl"
 	"github.com/hashicorp/hcl/hcl/ast"
 	"github.com/hashicorp/vault/helper/experiments"
 	"github.com/hashicorp/vault/helper/osutil"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/strutil"
 	"github.com/hashicorp/vault/sdk/helper/testcluster"
+	"github.com/hashicorp/vault/vault/observations"
 	"github.com/mitchellh/mapstructure"
 )
 
@@ -66,6 +70,9 @@ type Config struct {
 	DefaultLeaseTTL    time.Duration `hcl:"-"`
 	DefaultLeaseTTLRaw interface{}   `hcl:"default_lease_ttl,alias:DefaultLeaseTTL"`
 
+	RemoveIrrevocableLeaseAfter    time.Duration `hcl:"-"`
+	RemoveIrrevocableLeaseAfterRaw interface{}   `hcl:"remove_irrevocable_lease_after,alias:RemoveIrrevocableLeaseAfter"`
+
 	ClusterCipherSuites string `hcl:"cluster_cipher_suites"`
 
 	PluginDirectory string `hcl:"plugin_directory"`
@@ -87,6 +94,9 @@ type Config struct {
 	DisableClustering    bool        `hcl:"-"`
 	DisableClusteringRaw interface{} `hcl:"disable_clustering,alias:DisableClustering"`
 
+	AllowAuditLogPrefixing    bool        `hcl:"-"`
+	AllowAuditLogPrefixingRaw interface{} `hcl:"allow_audit_log_prefixing,alias:AllowAuditLogPrefixing"`
+
 	DisablePerformanceStandby    bool        `hcl:"-"`
 	DisablePerformanceStandbyRaw interface{} `hcl:"disable_performance_standby,alias:DisablePerformanceStandby"`
 
@@ -107,6 +117,8 @@ type Config struct {
 
 	DetectDeadlocks string `hcl:"detect_deadlocks"`
 
+	Observations *observations.ObservationSystemConfig `hcl:"observations"`
+
 	ImpreciseLeaseRoleTracking bool `hcl:"imprecise_lease_role_tracking"`
 
 	EnableResponseHeaderRaftNodeID    bool        `hcl:"-"`
@@ -115,6 +127,11 @@ type Config struct {
 	License          string `hcl:"-"`
 	LicensePath      string `hcl:"license_path"`
 	DisableSSCTokens bool   `hcl:"-"`
+
+	EnablePostUnsealTrace bool   `hcl:"enable_post_unseal_trace"`
+	PostUnsealTraceDir    string `hcl:"post_unseal_trace_directory"`
+
+	ReportingScanDirectory string `hcl:"reporting_scan_directory"`
 }
 
 const (
@@ -321,6 +338,11 @@ func (c *Config) Merge(c2 *Config) *Config {
 		result.DefaultLeaseTTL = c2.DefaultLeaseTTL
 	}
 
+	result.RemoveIrrevocableLeaseAfter = c.RemoveIrrevocableLeaseAfter
+	if c2.RemoveIrrevocableLeaseAfter > result.RemoveIrrevocableLeaseAfter {
+		result.RemoveIrrevocableLeaseAfter = c2.RemoveIrrevocableLeaseAfter
+	}
+
 	result.ClusterCipherSuites = c.ClusterCipherSuites
 	if c2.ClusterCipherSuites != "" {
 		result.ClusterCipherSuites = c2.ClusterCipherSuites
@@ -385,6 +407,11 @@ func (c *Config) Merge(c2 *Config) *Config {
 		result.DisablePerformanceStandby = c2.DisablePerformanceStandby
 	}
 
+	result.AllowAuditLogPrefixing = c.AllowAuditLogPrefixing
+	if c2.AllowAuditLogPrefixing {
+		result.AllowAuditLogPrefixing = c2.AllowAuditLogPrefixing
+	}
+
 	result.DisableSealWrap = c.DisableSealWrap
 	if c2.DisableSealWrap {
 		result.DisableSealWrap = c2.DisableSealWrap
@@ -410,6 +437,25 @@ func (c *Config) Merge(c2 *Config) *Config {
 		result.DetectDeadlocks = c2.DetectDeadlocks
 	}
 
+	result.DisablePrintableCheck = c.DisablePrintableCheck
+	if c2.DisablePrintableCheckRaw != nil {
+		result.DisablePrintableCheck = c2.DisablePrintableCheck
+	}
+	result.Observations = c.Observations
+	if c2.Observations != nil {
+		if result.Observations == nil {
+			result.Observations = &observations.ObservationSystemConfig{}
+		}
+		if c2.Observations.LedgerPath != "" {
+			result.Observations.LedgerPath = c2.Observations.LedgerPath
+		}
+		result.Observations.TypePrefixDenylist = append(result.Observations.TypePrefixDenylist, c2.Observations.TypePrefixDenylist...)
+		result.Observations.TypePrefixAllowlist = append(result.Observations.TypePrefixAllowlist, c2.Observations.TypePrefixAllowlist...)
+		if c2.Observations.FileMode != "" {
+			result.Observations.FileMode = c2.Observations.FileMode
+		}
+	}
+
 	result.ImpreciseLeaseRoleTracking = c.ImpreciseLeaseRoleTracking
 	if c2.ImpreciseLeaseRoleTracking {
 		result.ImpreciseLeaseRoleTracking = c2.ImpreciseLeaseRoleTracking
@@ -425,6 +471,21 @@ func (c *Config) Merge(c2 *Config) *Config {
 		result.LicensePath = c2.LicensePath
 	}
 
+	result.EnablePostUnsealTrace = c.EnablePostUnsealTrace
+	if c2.EnablePostUnsealTrace {
+		result.EnablePostUnsealTrace = c2.EnablePostUnsealTrace
+	}
+
+	result.PostUnsealTraceDir = c.PostUnsealTraceDir
+	if c2.PostUnsealTraceDir != "" {
+		result.PostUnsealTraceDir = c2.PostUnsealTraceDir
+	}
+
+	result.ReportingScanDirectory = c.ReportingScanDirectory
+	if c2.ReportingScanDirectory != "" {
+		result.ReportingScanDirectory = c2.ReportingScanDirectory
+	}
+
 	// Use values from top-level configuration for storage if set
 	if storage := result.Storage; storage != nil {
 		if result.APIAddr != "" {
@@ -463,11 +524,18 @@ func (c *Config) Merge(c2 *Config) *Config {
 }
 
 // LoadConfig loads the configuration at the given path, regardless if
-// its a file or directory.
+// it's a file or directory.
 func LoadConfig(path string) (*Config, error) {
+	cfg, _, err := LoadConfigCheckDuplicate(path)
+	return cfg, err
+}
+
+// LoadConfigCheckDuplicate is the same as the above function but also checks for duplicate attributes
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only LoadConfig once deprecation is complete
+func LoadConfigCheckDuplicate(path string) (cfg *Config, duplicate bool, err error) {
 	fi, err := os.Stat(path)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	if fi.IsDir() {
@@ -477,31 +545,38 @@ func LoadConfig(path string) (*Config, error) {
 			var err error
 			enableFilePermissionsCheck, err = strconv.ParseBool(enableFilePermissionsCheckEnv)
 			if err != nil {
-				return nil, errors.New("Error parsing the environment variable VAULT_ENABLE_FILE_PERMISSIONS_CHECK")
+				return nil, false, errors.New("Error parsing the environment variable VAULT_ENABLE_FILE_PERMISSIONS_CHECK")
 			}
 		}
 		f, err := os.Open(path)
 		if err != nil {
-			return nil, err
+			return nil, false, err
 		}
 		defer f.Close()
 
 		if enableFilePermissionsCheck {
 			err = osutil.OwnerPermissionsMatchFile(f, 0, 0)
 			if err != nil {
-				return nil, err
+				return nil, false, err
 			}
 		}
-		return CheckConfig(LoadConfigDir(path))
-	}
-	return CheckConfig(LoadConfigFile(path))
-}
 
-func CheckConfig(c *Config, e error) (*Config, error) {
-	if e != nil {
-		return c, e
+		cfg, duplicate, err = LoadConfigDirCheckDuplicate(path)
+		if err != nil {
+			return nil, duplicate, err
+		}
+	} else {
+		cfg, duplicate, err = LoadConfigFileCheckDuplicate(path)
+		if err != nil {
+			return nil, duplicate, err
+		}
 	}
 
+	cfg, err = CheckConfig(cfg)
+	return cfg, duplicate, err
+}
+
+func CheckConfig(c *Config) (*Config, error) {
 	if err := c.checkSealConfig(); err != nil {
 		return nil, err
 	}
@@ -524,21 +599,28 @@ func CheckConfig(c *Config, e error) (*Config, error) {
 
 // LoadConfigFile loads the configuration from the given file.
 func LoadConfigFile(path string) (*Config, error) {
+	cfg, _, err := LoadConfigFileCheckDuplicate(path)
+	return cfg, err
+}
+
+// LoadConfigFileCheckDuplicate is the same as the above function but also checks for duplicate attributes
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only ParseConfig once deprecation is complete
+func LoadConfigFileCheckDuplicate(path string) (cfg *Config, duplicate bool, err error) {
 	// Open the file
 	f, err := os.Open(path)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 	defer f.Close()
 	// Read the file
 	d, err := io.ReadAll(f)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
-	conf, err := ParseConfig(string(d), path)
+	conf, duplicate, err := ParseConfigCheckDuplicate(string(d), path)
 	if err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
 
 	var enableFilePermissionsCheck bool
@@ -546,7 +628,7 @@ func LoadConfigFile(path string) (*Config, error) {
 		var err error
 		enableFilePermissionsCheck, err = strconv.ParseBool(enableFilePermissionsCheckEnv)
 		if err != nil {
-			return nil, errors.New("Error parsing the environment variable VAULT_ENABLE_FILE_PERMISSIONS_CHECK")
+			return nil, duplicate, errors.New("Error parsing the environment variable VAULT_ENABLE_FILE_PERMISSIONS_CHECK")
 		}
 	}
 
@@ -554,139 +636,166 @@ func LoadConfigFile(path string) (*Config, error) {
 		// check permissions of the config file
 		err = osutil.OwnerPermissionsMatchFile(f, 0, 0)
 		if err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 		// check permissions of the plugin directory
 		if conf.PluginDirectory != "" {
 
 			err = osutil.OwnerPermissionsMatch(conf.PluginDirectory, conf.PluginFileUid, conf.PluginFilePermissions)
 			if err != nil {
-				return nil, err
+				return nil, duplicate, err
 			}
 		}
 	}
-	return conf, nil
+	return conf, duplicate, nil
 }
 
 func ParseConfig(d, source string) (*Config, error) {
+	cfg, _, err := ParseConfigCheckDuplicate(d, source)
+	return cfg, err
+}
+
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only ParseConfig once deprecation is complete
+func ParseConfigCheckDuplicate(d, source string) (cfg *Config, duplicate bool, err error) {
 	// Parse!
-	obj, err := hcl.Parse(d)
+	obj, duplicate, err := random.ParseAndCheckForDuplicateHclAttributes(d)
 	if err != nil {
-		return nil, err
+		if strings.Contains(err.Error(), "was already set. Each argument can only be defined once") {
+			knownPossibleAttributeDupErrors := []string{"retry_join", "transform", "listener"}
+			for _, s := range knownPossibleAttributeDupErrors {
+				if strings.Contains(err.Error(), fmt.Sprintf("The argument %q at", s)) {
+					return nil, duplicate, fmt.Errorf("%w (if using the attribute syntax %s = [...], change it to the block syntax %s { ... })", err, s, s)
+				}
+			}
+		}
+		return nil, duplicate, err
 	}
 
 	// Start building the result
 	result := NewConfig()
 	if err := hcl.DecodeObject(result, obj); err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
 
 	if rendered, err := configutil.ParseSingleIPTemplate(result.APIAddr); err != nil {
-		return nil, err
+		return nil, duplicate, err
 	} else {
 		result.APIAddr = rendered
 	}
 	if rendered, err := configutil.ParseSingleIPTemplate(result.ClusterAddr); err != nil {
-		return nil, err
+		return nil, duplicate, err
 	} else {
 		result.ClusterAddr = rendered
 	}
 
-	sharedConfig, err := configutil.ParseConfig(d)
+	sharedConfig, dup, err := configutil.ParseConfigCheckDuplicate(d)
 	if err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
+	duplicate = duplicate || dup
 	result.SharedConfig = sharedConfig
 
 	if result.MaxLeaseTTLRaw != nil {
 		if result.MaxLeaseTTL, err = parseutil.ParseDurationSecond(result.MaxLeaseTTLRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 	if result.DefaultLeaseTTLRaw != nil {
 		if result.DefaultLeaseTTL, err = parseutil.ParseDurationSecond(result.DefaultLeaseTTLRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
+		}
+	}
+
+	if result.RemoveIrrevocableLeaseAfterRaw != nil {
+		if result.RemoveIrrevocableLeaseAfter, err = parseutil.ParseDurationSecond(result.RemoveIrrevocableLeaseAfterRaw); err != nil {
+			return nil, duplicate, err
 		}
 	}
 
 	if result.EnableUIRaw != nil {
 		if result.EnableUI, err = parseutil.ParseBool(result.EnableUIRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
 	if result.DisableCacheRaw != nil {
 		if result.DisableCache, err = parseutil.ParseBool(result.DisableCacheRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
 	if result.DisablePrintableCheckRaw != nil {
 		if result.DisablePrintableCheck, err = parseutil.ParseBool(result.DisablePrintableCheckRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
 	if result.EnableRawEndpointRaw != nil {
 		if result.EnableRawEndpoint, err = parseutil.ParseBool(result.EnableRawEndpointRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
 	if result.EnableIntrospectionEndpointRaw != nil {
 		if result.EnableIntrospectionEndpoint, err = parseutil.ParseBool(result.EnableIntrospectionEndpointRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
 	if result.DisableClusteringRaw != nil {
 		if result.DisableClustering, err = parseutil.ParseBool(result.DisableClusteringRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
 	if result.PluginFilePermissionsRaw != nil {
 		octalPermissionsString, err := parseutil.ParseString(result.PluginFilePermissionsRaw)
 		if err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 		pluginFilePermissions, err := strconv.ParseInt(octalPermissionsString, 8, 64)
 		if err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 		if pluginFilePermissions < math.MinInt || pluginFilePermissions > math.MaxInt {
-			return nil, fmt.Errorf("file permission value %v cannot be safely cast to int: exceeds bounds (%v, %v)", pluginFilePermissions, math.MinInt, math.MaxInt)
+			return nil, duplicate, fmt.Errorf("file permission value %v cannot be safely cast to int: exceeds bounds (%v, %v)", pluginFilePermissions, math.MinInt, math.MaxInt)
 		}
 		result.PluginFilePermissions = int(pluginFilePermissions)
 	}
 
 	if result.DisableSentinelTraceRaw != nil {
 		if result.DisableSentinelTrace, err = parseutil.ParseBool(result.DisableSentinelTraceRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
 	if result.DisablePerformanceStandbyRaw != nil {
 		if result.DisablePerformanceStandby, err = parseutil.ParseBool(result.DisablePerformanceStandbyRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
+		}
+	}
+
+	if result.AllowAuditLogPrefixingRaw != nil {
+		if result.AllowAuditLogPrefixing, err = parseutil.ParseBool(result.AllowAuditLogPrefixingRaw); err != nil {
+			return nil, duplicate, err
 		}
 	}
 
 	if result.DisableSealWrapRaw != nil {
 		if result.DisableSealWrap, err = parseutil.ParseBool(result.DisableSealWrapRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
 	if result.DisableIndexingRaw != nil {
 		if result.DisableIndexing, err = parseutil.ParseBool(result.DisableIndexingRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
 	if result.EnableResponseHeaderHostnameRaw != nil {
 		if result.EnableResponseHeaderHostname, err = parseutil.ParseBool(result.EnableResponseHeaderHostnameRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
@@ -697,27 +806,27 @@ func ParseConfig(d, source string) (*Config, error) {
 
 	if result.EnableResponseHeaderRaftNodeIDRaw != nil {
 		if result.EnableResponseHeaderRaftNodeID, err = parseutil.ParseBool(result.EnableResponseHeaderRaftNodeIDRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 	}
 
 	list, ok := obj.Node.(*ast.ObjectList)
 	if !ok {
-		return nil, fmt.Errorf("error parsing: file doesn't contain a root object")
+		return nil, duplicate, fmt.Errorf("error parsing: file doesn't contain a root object")
 	}
 
 	// Look for storage but still support old backend
 	if o := list.Filter("storage"); len(o.Items) > 0 {
 		delete(result.UnusedKeys, "storage")
 		if err := ParseStorage(result, o, "storage"); err != nil {
-			return nil, fmt.Errorf("error parsing 'storage': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'storage': %w", err)
 		}
 		result.found(result.Storage.Type, result.Storage.Type)
 	} else {
 		delete(result.UnusedKeys, "backend")
 		if o := list.Filter("backend"); len(o.Items) > 0 {
 			if err := ParseStorage(result, o, "backend"); err != nil {
-				return nil, fmt.Errorf("error parsing 'backend': %w", err)
+				return nil, duplicate, fmt.Errorf("error parsing 'backend': %w", err)
 			}
 		}
 	}
@@ -725,13 +834,13 @@ func ParseConfig(d, source string) (*Config, error) {
 	if o := list.Filter("ha_storage"); len(o.Items) > 0 {
 		delete(result.UnusedKeys, "ha_storage")
 		if err := parseHAStorage(result, o, "ha_storage"); err != nil {
-			return nil, fmt.Errorf("error parsing 'ha_storage': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'ha_storage': %w", err)
 		}
 	} else {
 		if o := list.Filter("ha_backend"); len(o.Items) > 0 {
 			delete(result.UnusedKeys, "ha_backend")
 			if err := parseHAStorage(result, o, "ha_backend"); err != nil {
-				return nil, fmt.Errorf("error parsing 'ha_backend': %w", err)
+				return nil, duplicate, fmt.Errorf("error parsing 'ha_backend': %w", err)
 			}
 		}
 	}
@@ -740,16 +849,16 @@ func ParseConfig(d, source string) (*Config, error) {
 	if o := list.Filter("service_registration"); len(o.Items) > 0 {
 		delete(result.UnusedKeys, "service_registration")
 		if err := parseServiceRegistration(result, o, "service_registration"); err != nil {
-			return nil, fmt.Errorf("error parsing 'service_registration': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'service_registration': %w", err)
 		}
 	}
 
 	if err := validateExperiments(result.Experiments); err != nil {
-		return nil, fmt.Errorf("error validating experiment(s) from config: %w", err)
+		return nil, duplicate, fmt.Errorf("error validating experiment(s) from config: %w", err)
 	}
 
-	if err := result.parseConfig(list); err != nil {
-		return nil, fmt.Errorf("error parsing enterprise config: %w", err)
+	if err := result.parseConfig(list, source); err != nil {
+		return nil, duplicate, fmt.Errorf("error parsing enterprise config: %w", err)
 	}
 
 	// Remove all unused keys from Config that were satisfied by SharedConfig.
@@ -761,7 +870,7 @@ func ParseConfig(d, source string) (*Config, error) {
 		}
 	}
 
-	return result, nil
+	return result, duplicate, nil
 }
 
 func ExperimentsFromEnvAndCLI(config *Config, envKey string, flagExperiments []string) error {
@@ -830,18 +939,25 @@ func mergeExperiments(left, right []string) []string {
 // LoadConfigDir loads all the configurations in the given directory
 // in alphabetical order.
 func LoadConfigDir(dir string) (*Config, error) {
+	cfg, _, err := LoadConfigDirCheckDuplicate(dir)
+	return cfg, err
+}
+
+// LoadConfigDirCheckDuplicate is the same as the above but checks for duplciate HCL attributes
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only LoadConfigDir once deprecation is complete
+func LoadConfigDirCheckDuplicate(dir string) (cfg *Config, duplicate bool, err error) {
 	f, err := os.Open(dir)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 	defer f.Close()
 
 	fi, err := f.Stat()
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 	if !fi.IsDir() {
-		return nil, fmt.Errorf("configuration path must be a directory: %q", dir)
+		return nil, false, fmt.Errorf("configuration path must be a directory: %q", dir)
 	}
 
 	var files []string
@@ -850,7 +966,7 @@ func LoadConfigDir(dir string) (*Config, error) {
 		var fis []os.FileInfo
 		fis, err = f.Readdir(128)
 		if err != nil && err != io.EOF {
-			return nil, err
+			return nil, false, err
 		}
 
 		for _, fi := range fis {
@@ -878,10 +994,11 @@ func LoadConfigDir(dir string) (*Config, error) {
 
 	result := NewConfig()
 	for _, f := range files {
-		config, err := LoadConfigFile(f)
+		config, dup, err := LoadConfigFileCheckDuplicate(f)
 		if err != nil {
-			return nil, fmt.Errorf("error loading %q: %w", f, err)
+			return nil, duplicate, fmt.Errorf("error loading %q: %w", f, err)
 		}
+		duplicate = duplicate || dup
 
 		if result == nil {
 			result = config
@@ -890,7 +1007,7 @@ func LoadConfigDir(dir string) (*Config, error) {
 		}
 	}
 
-	return result, nil
+	return result, duplicate, nil
 }
 
 // isTemporaryFile returns true or false depending on whether the
@@ -921,33 +1038,49 @@ func ParseStorage(result *Config, list *ast.ObjectList, name string) error {
 	}
 
 	m := make(map[string]string)
-	for key, val := range config {
-		valStr, ok := val.(string)
+	for k, v := range config {
+		vStr, ok := v.(string)
 		if ok {
-			m[key] = valStr
+			var err error
+			m[k], err = normalizeStorageConfigAddresses(key, k, vStr)
+			if err != nil {
+				return err
+			}
 			continue
 		}
-		valBytes, err := json.Marshal(val)
-		if err != nil {
-			return err
+
+		var err error
+		var vBytes []byte
+		// Raft's retry_join requires special normalization due to its complexity
+		if key == "raft" && k == "retry_join" {
+			vBytes, err = normalizeRaftRetryJoin(v)
+			if err != nil {
+				return err
+			}
+		} else {
+			vBytes, err = json.Marshal(v)
+			if err != nil {
+				return err
+			}
 		}
-		m[key] = string(valBytes)
+
+		m[k] = string(vBytes)
 	}
 
 	// Pull out the redirect address since it's common to all backends
 	var redirectAddr string
 	if v, ok := m["redirect_addr"]; ok {
-		redirectAddr = v
+		redirectAddr = configutil.NormalizeAddr(v)
 		delete(m, "redirect_addr")
 	} else if v, ok := m["advertise_addr"]; ok {
-		redirectAddr = v
+		redirectAddr = configutil.NormalizeAddr(v)
 		delete(m, "advertise_addr")
 	}
 
 	// Pull out the cluster address since it's common to all backends
 	var clusterAddr string
 	if v, ok := m["cluster_addr"]; ok {
-		clusterAddr = v
+		clusterAddr = configutil.NormalizeAddr(v)
 		delete(m, "cluster_addr")
 	}
 
@@ -963,11 +1096,11 @@ func ParseStorage(result *Config, list *ast.ObjectList, name string) error {
 
 	// Override with top-level values if they are set
 	if result.APIAddr != "" {
-		redirectAddr = result.APIAddr
+		redirectAddr = configutil.NormalizeAddr(result.APIAddr)
 	}
 
 	if result.ClusterAddr != "" {
-		clusterAddr = result.ClusterAddr
+		clusterAddr = configutil.NormalizeAddr(result.ClusterAddr)
 	}
 
 	if result.DisableClusteringRaw != nil {
@@ -984,6 +1117,117 @@ func ParseStorage(result *Config, list *ast.ObjectList, name string) error {
 	return nil
 }
 
+// storageAddressKeys maps a storage backend type to its associated
+// configuration whose values are URLs, IP addresses, or host:port style
+// addresses. All physical storage types must have an entry in this map,
+// otherwise our normalization check will fail when parsing the storage entry
+// config. Physical storage types which don't contain such keys should include
+// an empty array.
+var storageAddressKeys = map[string][]string{
+	"aerospike":              {"hostname"},
+	"alicloudoss":            {"endpoint"},
+	"azure":                  {"arm_endpoint"},
+	"cassandra":              {"hosts"},
+	"cockroachdb":            {"connection_url"},
+	"consul":                 {"address", "service_address"},
+	"couchdb":                {"endpoint"},
+	"dynamodb":               {"endpoint"},
+	"etcd":                   {"address", "discovery_srv"},
+	"file":                   {},
+	"filesystem":             {},
+	"foundationdb":           {},
+	"gcs":                    {},
+	"inmem":                  {},
+	"inmem_ha":               {},
+	"inmem_transactional":    {},
+	"inmem_transactional_ha": {},
+	"manta":                  {"url"},
+	"mssql":                  {"server"},
+	"mysql":                  {"address"},
+	"oci":                    {},
+	"postgresql":             {"connection_url"},
+	"raft":                   {}, // retry_join is handled separately in normalizeRaftRetryJoin()
+	"s3":                     {"endpoint"},
+	"spanner":                {},
+	"swift":                  {"auth_url", "storage_url"},
+	"zookeeper":              {"address"},
+}
+
+// normalizeStorageConfigAddresses takes a storage name, a configuration key
+// and it's associated value and will normalize any URLs, IP addresses, or
+// host:port style addresses.
+func normalizeStorageConfigAddresses(storage string, key string, value string) (string, error) {
+	keys, ok := storageAddressKeys[storage]
+	if !ok {
+		return "", fmt.Errorf("unknown storage type %s", storage)
+	}
+
+	if slices.Contains(keys, key) {
+		return configutil.NormalizeAddr(value), nil
+	}
+
+	return value, nil
+}
+
+// normalizeRaftRetryJoin takes the hcl decoded value representation of a
+// retry_join stanza and normalizes any URLs, IP addresses, or host:port style
+// addresses, and returns the value encoded as JSON.
+func normalizeRaftRetryJoin(val any) ([]byte, error) {
+	res := []map[string]any{}
+
+	// Depending on whether the retry_join stanzas were configured as an attribute,
+	// a block, or a mixture of both, we'll get different values from which we
+	// need to extract our individual retry joins stanzas.
+	stanzas := []map[string]any{}
+	if retryJoin, ok := val.([]map[string]any); ok {
+		// retry_join stanzas are defined as blocks
+		stanzas = retryJoin
+	} else {
+		// retry_join stanzas are defined as attributes or attributes and blocks
+		retryJoin, ok := val.([]any)
+		if !ok {
+			// retry_join stanzas have not been configured correctly
+			return nil, fmt.Errorf("malformed retry_join stanza: %v", val)
+		}
+
+		for _, stanza := range retryJoin {
+			stanzaVal, ok := stanza.(map[string]any)
+			if !ok {
+				return nil, fmt.Errorf("malformed retry_join stanza: %v", stanza)
+			}
+			stanzas = append(stanzas, stanzaVal)
+		}
+	}
+
+	for _, stanza := range stanzas {
+		normalizedStanza := map[string]any{}
+		for k, v := range stanza {
+			switch k {
+			case "auto_join":
+				cfg, err := discover.Parse(v.(string))
+				if err != nil {
+					return nil, err
+				}
+				for k, v := range cfg {
+					// These are auto_join keys that are valid for the provider in go-discover
+					if slices.Contains([]string{"domain", "auth_url", "url", "host"}, k) {
+						cfg[k] = configutil.NormalizeAddr(v)
+					}
+				}
+				normalizedStanza[k] = cfg.String()
+			case "leader_api_addr":
+				normalizedStanza[k] = configutil.NormalizeAddr(v.(string))
+			default:
+				normalizedStanza[k] = v
+			}
+		}
+
+		res = append(res, normalizedStanza)
+	}
+
+	return json.Marshal(res)
+}
+
 func parseHAStorage(result *Config, list *ast.ObjectList, name string) error {
 	if len(list.Items) > 1 {
 		return fmt.Errorf("only one %q block is permitted", name)
@@ -1003,33 +1247,49 @@ func parseHAStorage(result *Config, list *ast.ObjectList, name string) error {
 	}
 
 	m := make(map[string]string)
-	for key, val := range config {
-		valStr, ok := val.(string)
+	for k, v := range config {
+		vStr, ok := v.(string)
 		if ok {
-			m[key] = valStr
+			var err error
+			m[k], err = normalizeStorageConfigAddresses(key, k, vStr)
+			if err != nil {
+				return err
+			}
 			continue
 		}
-		valBytes, err := json.Marshal(val)
-		if err != nil {
-			return err
+
+		var err error
+		var vBytes []byte
+		// Raft's retry_join requires special normalization due to its complexity
+		if key == "raft" && k == "retry_join" {
+			vBytes, err = normalizeRaftRetryJoin(v)
+			if err != nil {
+				return err
+			}
+		} else {
+			vBytes, err = json.Marshal(v)
+			if err != nil {
+				return err
+			}
 		}
-		m[key] = string(valBytes)
+
+		m[k] = string(vBytes)
 	}
 
 	// Pull out the redirect address since it's common to all backends
 	var redirectAddr string
 	if v, ok := m["redirect_addr"]; ok {
-		redirectAddr = v
+		redirectAddr = configutil.NormalizeAddr(v)
 		delete(m, "redirect_addr")
 	} else if v, ok := m["advertise_addr"]; ok {
-		redirectAddr = v
+		redirectAddr = configutil.NormalizeAddr(v)
 		delete(m, "advertise_addr")
 	}
 
 	// Pull out the cluster address since it's common to all backends
 	var clusterAddr string
 	if v, ok := m["cluster_addr"]; ok {
-		clusterAddr = v
+		clusterAddr = configutil.NormalizeAddr(v)
 		delete(m, "cluster_addr")
 	}
 
@@ -1045,11 +1305,11 @@ func parseHAStorage(result *Config, list *ast.ObjectList, name string) error {
 
 	// Override with top-level values if they are set
 	if result.APIAddr != "" {
-		redirectAddr = result.APIAddr
+		redirectAddr = configutil.NormalizeAddr(result.APIAddr)
 	}
 
 	if result.ClusterAddr != "" {
-		clusterAddr = result.ClusterAddr
+		clusterAddr = configutil.NormalizeAddr(result.ClusterAddr)
 	}
 
 	if result.DisableClusteringRaw != nil {
@@ -1083,6 +1343,12 @@ func parseServiceRegistration(result *Config, list *ast.ObjectList, name string)
 		return multierror.Prefix(err, fmt.Sprintf("%s.%s:", name, key))
 	}
 
+	if key == "consul" {
+		if addr, ok := m["address"]; ok {
+			m["address"] = configutil.NormalizeAddr(addr)
+		}
+	}
+
 	result.ServiceRegistration = &ServiceRegistration{
 		Type:   strings.ToLower(key),
 		Config: m,
@@ -1117,6 +1383,8 @@ func (c *Config) Sanitized() map[string]interface{} {
 		"max_lease_ttl":     c.MaxLeaseTTL / time.Second,
 		"default_lease_ttl": c.DefaultLeaseTTL / time.Second,
 
+		"remove_irrevocable_lease_after": c.RemoveIrrevocableLeaseAfter / time.Second,
+
 		"cluster_cipher_suites": c.ClusterCipherSuites,
 
 		"plugin_directory": c.PluginDirectory,
@@ -1138,8 +1406,8 @@ func (c *Config) Sanitized() map[string]interface{} {
 
 		"disable_sealwrap": c.DisableSealWrap,
 
-		"disable_indexing": c.DisableIndexing,
-
+		"disable_indexing":                c.DisableIndexing,
+		"allow_audit_log_prefixing":       c.AllowAuditLogPrefixing,
 		"enable_response_header_hostname": c.EnableResponseHeaderHostname,
 
 		"enable_response_header_raft_node_id": c.EnableResponseHeaderRaftNodeID,
@@ -1150,6 +1418,9 @@ func (c *Config) Sanitized() map[string]interface{} {
 		"detect_deadlocks": c.DetectDeadlocks,
 
 		"imprecise_lease_role_tracking": c.ImpreciseLeaseRoleTracking,
+
+		"enable_post_unseal_trace":    c.EnablePostUnsealTrace,
+		"post_unseal_trace_directory": c.PostUnsealTraceDir,
 	}
 	for k, v := range sharedResult {
 		result[k] = v
@@ -1169,11 +1440,22 @@ func (c *Config) Sanitized() map[string]interface{} {
 			sanitizedStorage["raft"] = map[string]interface{}{
 				"max_entry_size": c.Storage.Config["max_entry_size"],
 			}
+			for k, v := range c.Storage.Config {
+				sanitizedStorage["raft"].(map[string]interface{})[k] = v
+			}
 		}
 
 		result["storage"] = sanitizedStorage
 	}
 
+	// Sanitize observations stanza
+	if c.Observations != nil {
+		sanitizedObservations := map[string]interface{}{
+			"ledger_path": c.Observations.LedgerPath,
+		}
+		result["observations"] = sanitizedObservations
+	}
+
 	// Sanitize HA storage stanza
 	if c.HAStorage != nil {
 		haStorageType := c.HAStorage.Type
diff --git a/command/server/config_custom_response_headers_test.go b/command/server/config_custom_response_headers_test.go
index 8db646bfd12..fb4c22010ac 100644
--- a/command/server/config_custom_response_headers_test.go
+++ b/command/server/config_custom_response_headers_test.go
@@ -1,10 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
 
 import (
-	"fmt"
 	"testing"
 
 	"github.com/go-test/deep"
@@ -65,7 +64,7 @@ func TestCustomResponseHeadersConfigs(t *testing.T) {
 		t.Fatalf("Error encountered when loading config %+v", err)
 	}
 	if diff := deep.Equal(expectedCustomResponseHeader, config.Listeners[0].CustomResponseHeaders); diff != nil {
-		t.Fatalf(fmt.Sprintf("parsed custom headers do not match the expected ones, difference: %v", diff))
+		t.Fatalf("parsed custom headers do not match the expected ones, difference: %v", diff)
 	}
 }
 
@@ -84,29 +83,29 @@ func TestCustomResponseHeadersConfigsMultipleListeners(t *testing.T) {
 		t.Fatalf("Error encountered when loading config %+v", err)
 	}
 	if diff := deep.Equal(expectedCustomResponseHeader, config.Listeners[0].CustomResponseHeaders); diff != nil {
-		t.Fatalf(fmt.Sprintf("parsed custom headers do not match the expected ones, difference: %v", diff))
+		t.Fatalf("parsed custom headers do not match the expected ones, difference: %v", diff)
 	}
 
 	if diff := deep.Equal(expectedCustomResponseHeader, config.Listeners[1].CustomResponseHeaders); diff == nil {
-		t.Fatalf(fmt.Sprintf("parsed custom headers do not match the expected ones, difference: %v", diff))
+		t.Fatalf("parsed custom headers do not match the expected ones, difference: %v", diff)
 	}
 	if diff := deep.Equal(expectedCustomResponseHeader["default"], config.Listeners[1].CustomResponseHeaders["default"]); diff != nil {
-		t.Fatalf(fmt.Sprintf("parsed custom headers do not match the expected ones, difference: %v", diff))
+		t.Fatalf("parsed custom headers do not match the expected ones, difference: %v", diff)
 	}
 
 	if diff := deep.Equal(expectedCustomResponseHeader, config.Listeners[2].CustomResponseHeaders); diff == nil {
-		t.Fatalf(fmt.Sprintf("parsed custom headers do not match the expected ones, difference: %v", diff))
+		t.Fatalf("parsed custom headers do not match the expected ones, difference: %v", diff)
 	}
 
 	if diff := deep.Equal(defaultSTS, config.Listeners[2].CustomResponseHeaders["default"]); diff != nil {
-		t.Fatalf(fmt.Sprintf("parsed custom headers do not match the expected ones, difference: %v", diff))
+		t.Fatalf("parsed custom headers do not match the expected ones, difference: %v", diff)
 	}
 
 	if diff := deep.Equal(expectedCustomResponseHeader, config.Listeners[3].CustomResponseHeaders); diff == nil {
-		t.Fatalf(fmt.Sprintf("parsed custom headers do not match the expected ones, difference: %v", diff))
+		t.Fatalf("parsed custom headers do not match the expected ones, difference: %v", diff)
 	}
 
 	if diff := deep.Equal(defaultSTS, config.Listeners[3].CustomResponseHeaders["default"]); diff != nil {
-		t.Fatalf(fmt.Sprintf("parsed custom headers do not match the expected ones, difference: %v", diff))
+		t.Fatalf("parsed custom headers do not match the expected ones, difference: %v", diff)
 	}
 }
diff --git a/command/server/config_oss.go b/command/server/config_oss.go
new file mode 100644
index 00000000000..11b4d18971e
--- /dev/null
+++ b/command/server/config_oss.go
@@ -0,0 +1,10 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package server
+
+func (c *Config) IsMultisealEnabled() bool {
+	return false
+}
diff --git a/command/server/config_oss_test.go b/command/server/config_oss_test.go
index 20e97c1cfe7..92c9fd4a40b 100644
--- a/command/server/config_oss_test.go
+++ b/command/server/config_oss_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/command/server/config_stubs_oss.go b/command/server/config_stubs_oss.go
deleted file mode 100644
index 5c2e7e7bb35..00000000000
--- a/command/server/config_stubs_oss.go
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-//go:build !enterprise
-
-package server
-
-//go:generate go run github.com/hashicorp/vault/tools/stubmaker
-
-func IsMultisealSupported() bool {
-	return false
-}
diff --git a/command/server/config_telemetry_test.go b/command/server/config_telemetry_test.go
index 1f29a3862e9..0e98e441b3d 100644
--- a/command/server/config_telemetry_test.go
+++ b/command/server/config_telemetry_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
diff --git a/command/server/config_test.go b/command/server/config_test.go
index 9fa20b182fd..f5ca2ac163b 100644
--- a/command/server/config_test.go
+++ b/command/server/config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
@@ -65,6 +65,14 @@ func TestParseStorage(t *testing.T) {
 	testParseStorageTemplate(t)
 }
 
+// TestParseStorageURLConformance tests that all config attrs whose values can be
+// URLs, IP addresses, or host:port addresses, when configured with an IPv6
+// address, the normalized to be conformant with RFC-5942 §4
+// See: https://rfc-editor.org/rfc/rfc5952.html
+func TestParseStorageURLConformance(t *testing.T) {
+	testParseStorageURLConformance(t)
+}
+
 // TestConfigWithAdministrativeNamespace tests that .hcl and .json configurations are correctly parsed when the administrative_namespace_path is present.
 func TestConfigWithAdministrativeNamespace(t *testing.T) {
 	testConfigWithAdministrativeNamespaceHcl(t)
@@ -87,6 +95,85 @@ func TestUnknownFieldValidationListenerAndStorage(t *testing.T) {
 	testUnknownFieldValidationStorageAndListener(t)
 }
 
+// Test_ReportingScanDirectory makes sure that the reporting scan directory is correctly parsed
+func Test_ReportingScanDirectory(t *testing.T) {
+	config, err := LoadConfigFile("./test-fixtures/reporting_directory.hcl")
+	require.NoError(t, err)
+	require.NotNil(t, config)
+	require.NotEmpty(t, config.ReportingScanDirectory)
+	require.Equal(t, "/foo/bar/", config.ReportingScanDirectory)
+}
+
+// Test_ObservationSystemConfig makes sure that the observation system config
+// is properly loaded.
+func Test_ObservationSystemConfig(t *testing.T) {
+	config, err := LoadConfigFile("./test-fixtures/observations.hcl")
+	require.NoError(t, err)
+	require.NotNil(t, config)
+	require.NotNil(t, config.Observations)
+	require.Equal(t, "/var/ledger.log", config.Observations.LedgerPath)
+	require.Empty(t, config.Observations.TypePrefixAllowlist)
+	require.Empty(t, config.Observations.TypePrefixDenylist)
+}
+
+// Test_ObservationSystemConfigAllowDenyList makes sure that the observation system config
+// is properly loaded with an allowlist and denylist.
+func Test_ObservationSystemConfigAllowDenyList(t *testing.T) {
+	config, err := LoadConfigFile("./test-fixtures/observations_allow_deny.hcl")
+	require.NoError(t, err)
+	require.NotNil(t, config)
+	require.NotNil(t, config.Observations)
+	require.Equal(t, "/var/ledger.log", config.Observations.LedgerPath)
+	require.Equal(t, []string{"deny1", "deny2"}, config.Observations.TypePrefixDenylist)
+	require.Equal(t, []string{"allow1", "allow2", "allow3"}, config.Observations.TypePrefixAllowlist)
+	require.Equal(t, "0777", config.Observations.FileMode)
+}
+
+// Test_ObservationSystemConfigMerge checks merge for observation system config
+func Test_ObservationSystemConfigMerge(t *testing.T) {
+	config, err := LoadConfigFile("./test-fixtures/observations.hcl")
+	require.NoError(t, err)
+	require.NotNil(t, config)
+
+	config2, err := LoadConfigFile("./test-fixtures/observations_allow_deny.hcl")
+	require.NoError(t, err)
+	require.NotNil(t, config2)
+
+	merged := config.Merge(config2)
+	require.NotNil(t, merged)
+	require.NotNil(t, merged.Observations)
+	require.Equal(t, "/var/ledger.log", merged.Observations.LedgerPath)
+	require.Equal(t, []string{"deny1", "deny2"}, merged.Observations.TypePrefixDenylist)
+	require.Equal(t, []string{"allow1", "allow2", "allow3"}, merged.Observations.TypePrefixAllowlist)
+	require.Equal(t, "0777", merged.Observations.FileMode)
+}
+
+// Test_ObservationSystemConfigMergeFromNoObservations checks merge for observation system config from a config
+// without an observation system defined
+func Test_ObservationSystemConfigMergeFromNoObservations(t *testing.T) {
+	config, err := LoadConfigFile("./test-fixtures/config.hcl")
+	require.NoError(t, err)
+	require.NotNil(t, config)
+
+	config2, err := LoadConfigFile("./test-fixtures/observations_allow_deny.hcl")
+	require.NoError(t, err)
+	require.NotNil(t, config2)
+
+	merged := config.Merge(config2)
+	require.NotNil(t, merged)
+	require.NotNil(t, merged.Observations)
+	require.Equal(t, "/var/ledger.log", merged.Observations.LedgerPath)
+	require.Equal(t, []string{"deny1", "deny2"}, merged.Observations.TypePrefixDenylist)
+	require.Equal(t, []string{"allow1", "allow2", "allow3"}, merged.Observations.TypePrefixAllowlist)
+	require.Equal(t, "0777", merged.Observations.FileMode)
+	require.Equal(t, true, merged.EnableUI)
+}
+
+// TestDuplicateKeyValidationHcl checks that the server command displays a warning when the HCL config file contains duplicate keys.
+func TestDuplicateKeyValidationHcl(t *testing.T) {
+	testDuplicateKeyValidationHcl(t)
+}
+
 func TestExperimentsConfigParsing(t *testing.T) {
 	const envKey = "VAULT_EXPERIMENTS"
 	originalValue := validExperiments
@@ -285,7 +372,7 @@ func TestCheckConfig(t *testing.T) {
 
 	for _, tt := range testCases {
 		t.Run(tt.name, func(t *testing.T) {
-			_, err := CheckConfig(tt.config, nil)
+			_, err := CheckConfig(tt.config)
 			if tt.expectError {
 				require.Error(t, err)
 			} else {
diff --git a/command/server/config_test_helpers.go b/command/server/config_test_helpers.go
index 92f406aea99..3974232bd9b 100644
--- a/command/server/config_test_helpers.go
+++ b/command/server/config_test_helpers.go
@@ -1,9 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
 
 import (
+	"encoding/json"
 	"fmt"
 	"reflect"
 	"sort"
@@ -15,6 +16,7 @@ import (
 	"github.com/hashicorp/hcl"
 	"github.com/hashicorp/hcl/hcl/ast"
 	"github.com/hashicorp/hcl/hcl/token"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/stretchr/testify/require"
 )
@@ -29,36 +31,89 @@ func boolPointer(x bool) *bool {
 	return &x
 }
 
+// testConfigRaftRetryJoin decodes and normalizes retry_join stanzas.
 func testConfigRaftRetryJoin(t *testing.T) {
-	config, err := LoadConfigFile("./test-fixtures/raft_retry_join.hcl")
-	if err != nil {
-		t.Fatal(err)
+	retryJoinExpected := []map[string]string{
+		// NOTE: Normalization handles IPv6 addresses and returns auto_join with
+		// sorted stable keys.
+		{"leader_api_addr": "http://127.0.0.1:8200"},
+		{"leader_api_addr": "http://[2001:db8::2:1]:8200"},
+		{"auto_join": "provider=mdns domain=2001:db8::2:1 service=consul"},
+		{"auto_join": "provider=os auth_url=https://[2001:db8::2:1]/auth password=bar tag_key=consul tag_value=server username=foo"},
+		{"auto_join": "provider=triton account=testaccount key_id=1234 tag_key=consul-role tag_value=server url=https://[2001:db8::2:1]"},
+		{"auto_join": "provider=packet address_type=public_v6 auth_token=token project=uuid url=https://[2001:db8::2:1]"},
+		{"auto_join": "provider=vsphere category_name=consul-role host=https://[2001:db8::2:1] insecure_ssl=false password=bar tag_name=consul-server user=foo"},
+		{"auto_join": "provider=k8s label_selector=\"app.kubernetes.io/name=vault, component=server\" namespace=vault"},
+		{"auto_join": "provider=k8s label_selector=\"app.kubernetes.io/name=vault1,component=server\" namespace=vault1"},
 	}
-	retryJoinConfig := `[{"leader_api_addr":"http://127.0.0.1:8200"},{"leader_api_addr":"http://127.0.0.2:8200"},{"leader_api_addr":"http://127.0.0.3:8200"}]`
-	expected := &Config{
-		SharedConfig: &configutil.SharedConfig{
-			Listeners: []*configutil.Listener{
-				{
-					Type:                  "tcp",
-					Address:               "127.0.0.1:8200",
-					CustomResponseHeaders: DefaultCustomHeaders,
-				},
+	testCases := map[string]struct {
+		configFile    string
+		envVars       map[string]string
+		errorContains string
+	}{
+		"attributes_duplicate_error": {
+			configFile:    "./test-fixtures/raft_retry_join_attr.hcl",
+			errorContains: "The argument \"retry_join\" at 11:3 was already set. Each argument can only be defined once (if using the attribute syntax retry_join = [...], change it to the block syntax retry_join { ... })",
+		},
+		"attributes_allowed_with_env_var": {
+			configFile: "./test-fixtures/raft_retry_join_attr.hcl",
+			envVars: map[string]string{
+				random.AllowHclDuplicatesEnvVar: "true",
 			},
-			DisableMlock: true,
 		},
-
-		Storage: &Storage{
-			Type: "raft",
-			Config: map[string]string{
-				"path":       "/storage/path/raft",
-				"node_id":    "raft1",
-				"retry_join": retryJoinConfig,
+		"blocks": {
+			configFile: "./test-fixtures/raft_retry_join_block.hcl",
+		},
+		"mixed_duplicate_error": {
+			configFile:    "./test-fixtures/raft_retry_join_mixed.hcl",
+			errorContains: "The argument \"retry_join\" at 14:3 was already set. Each argument can only be defined once (if using the attribute syntax retry_join = [...], change it to the block syntax retry_join { ... })",
+		},
+		"mixed_allowed_with_env_var": {
+			configFile: "./test-fixtures/raft_retry_join_mixed.hcl",
+			envVars: map[string]string{
+				random.AllowHclDuplicatesEnvVar: "true",
 			},
 		},
 	}
-	config.Prune()
-	if diff := deep.Equal(config, expected); diff != nil {
-		t.Fatal(diff)
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			for k, v := range tc.envVars {
+				t.Setenv(k, v)
+			}
+
+			config, err := LoadConfigFile(tc.configFile)
+			if tc.errorContains != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tc.errorContains)
+				return
+			}
+
+			require.NoError(t, err)
+			retryJoinJSON, err := json.Marshal(retryJoinExpected)
+			require.NoError(t, err)
+
+			expected := NewConfig()
+			expected.SharedConfig.Listeners = []*configutil.Listener{
+				{
+					Type:                  "tcp",
+					Address:               "127.0.0.1:8200",
+					CustomResponseHeaders: DefaultCustomHeaders,
+				},
+			}
+			expected.SharedConfig.DisableMlock = true
+			expected.Storage = &Storage{
+				Type: "raft",
+				Config: map[string]string{
+					"path":       "/storage/path/raft",
+					"node_id":    "raft1",
+					"retry_join": string(retryJoinJSON),
+				},
+			}
+			config.Prune()
+			require.EqualValues(t, expected.SharedConfig, config.SharedConfig)
+			require.EqualValues(t, expected.Storage, config.Storage)
+		})
 	}
 }
 
@@ -143,7 +198,8 @@ func testLoadConfigFile_topLevel(t *testing.T, entropy *configutil.Entropy) {
 		ServiceRegistration: &ServiceRegistration{
 			Type: "consul",
 			Config: map[string]string{
-				"foo": "bar",
+				"foo":     "bar",
+				"address": "https://[2001:db8::1]:8500",
 			},
 		},
 
@@ -163,6 +219,9 @@ func testLoadConfigFile_topLevel(t *testing.T, entropy *configutil.Entropy) {
 		DefaultLeaseTTL:    10 * time.Hour,
 		DefaultLeaseTTLRaw: "10h",
 
+		RemoveIrrevocableLeaseAfter:    10 * 24 * time.Hour,
+		RemoveIrrevocableLeaseAfterRaw: "10d",
+
 		APIAddr:     "top_level_api_addr",
 		ClusterAddr: "top_level_cluster_addr",
 	}
@@ -469,6 +528,9 @@ func testLoadConfigFile(t *testing.T) {
 		DefaultLeaseTTL:    10 * time.Hour,
 		DefaultLeaseTTLRaw: "10h",
 
+		RemoveIrrevocableLeaseAfter:    10 * 24 * time.Hour,
+		RemoveIrrevocableLeaseAfterRaw: "10d",
+
 		EnableResponseHeaderHostname:      true,
 		EnableResponseHeaderHostnameRaw:   true,
 		EnableResponseHeaderRaftNodeID:    true,
@@ -509,7 +571,7 @@ func testUnknownFieldValidation(t *testing.T) {
 			Problem: "unknown or unsupported field bad_value found in configuration",
 			Position: token.Pos{
 				Filename: "./test-fixtures/config.hcl",
-				Offset:   652,
+				Offset:   653,
 				Line:     37,
 				Column:   5,
 			},
@@ -578,6 +640,27 @@ func testUnknownFieldValidationHcl(t *testing.T) {
 	}
 }
 
+// TODO (HCL_DUP_KEYS_DEPRECATION): remove warning test once deprecation is completed
+func testDuplicateKeyValidationHcl(t *testing.T) {
+	t.Run("env unset", func(t *testing.T) {
+		_, _, err := LoadConfigFileCheckDuplicate("./test-fixtures/invalid_config_duplicate_key.hcl")
+		require.Error(t, err)
+	})
+
+	t.Run("env set to false", func(t *testing.T) {
+		t.Setenv(random.AllowHclDuplicatesEnvVar, "false")
+		_, _, err := LoadConfigFileCheckDuplicate("./test-fixtures/invalid_config_duplicate_key.hcl")
+		require.Error(t, err)
+	})
+
+	t.Run("env set to true", func(t *testing.T) {
+		t.Setenv(random.AllowHclDuplicatesEnvVar, "true")
+		_, duplicate, err := LoadConfigFileCheckDuplicate("./test-fixtures/invalid_config_duplicate_key.hcl")
+		require.NoError(t, err)
+		require.True(t, duplicate)
+	})
+}
+
 // testConfigWithAdministrativeNamespaceJson tests that a config with a valid administrative namespace path is correctly validated and loaded.
 func testConfigWithAdministrativeNamespaceJson(t *testing.T) {
 	config, err := LoadConfigFile("./test-fixtures/config_with_valid_admin_ns.json")
@@ -613,7 +696,6 @@ func testLoadConfigFile_json(t *testing.T) {
 					Type:                  "tcp",
 					Address:               "127.0.0.1:443",
 					CustomResponseHeaders: DefaultCustomHeaders,
-					DisableRequestLimiter: false,
 				},
 			},
 
@@ -664,17 +746,19 @@ func testLoadConfigFile_json(t *testing.T) {
 
 		ClusterCipherSuites: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
 
-		MaxLeaseTTL:          10 * time.Hour,
-		MaxLeaseTTLRaw:       "10h",
-		DefaultLeaseTTL:      10 * time.Hour,
-		DefaultLeaseTTLRaw:   "10h",
-		DisableCacheRaw:      interface{}(nil),
-		EnableUI:             true,
-		EnableUIRaw:          true,
-		EnableRawEndpoint:    true,
-		EnableRawEndpointRaw: true,
-		DisableSealWrap:      true,
-		DisableSealWrapRaw:   true,
+		MaxLeaseTTL:                    10 * time.Hour,
+		MaxLeaseTTLRaw:                 "10h",
+		DefaultLeaseTTL:                10 * time.Hour,
+		DefaultLeaseTTLRaw:             "10h",
+		RemoveIrrevocableLeaseAfter:    10 * 24 * time.Hour,
+		RemoveIrrevocableLeaseAfterRaw: "10d",
+		DisableCacheRaw:                interface{}(nil),
+		EnableUI:                       true,
+		EnableUIRaw:                    true,
+		EnableRawEndpoint:              true,
+		EnableRawEndpointRaw:           true,
+		DisableSealWrap:                true,
+		DisableSealWrapRaw:             true,
 	}
 
 	addExpectedEntConfig(expected, []string{})
@@ -853,8 +937,12 @@ func testConfig_Sanitized(t *testing.T) {
 			"add_lease_metrics_namespace_labels":     false,
 			"add_mount_point_rollback_metrics":       false,
 		},
-		"administrative_namespace_path": "admin/",
-		"imprecise_lease_role_tracking": false,
+		"administrative_namespace_path":  "admin/",
+		"imprecise_lease_role_tracking":  false,
+		"enable_post_unseal_trace":       true,
+		"post_unseal_trace_directory":    "/tmp",
+		"remove_irrevocable_lease_after": (30 * 24 * time.Hour) / time.Second,
+		"allow_audit_log_prefixing":      false,
 	}
 
 	addExpectedEntSanitizedConfig(expected, []string{"http"})
@@ -904,6 +992,7 @@ listener "unix" {
   redact_addresses = true
   redact_cluster_name = true
   redact_version = true
+  disable_request_limiter = true
 }`))
 
 	config := Config{
@@ -960,14 +1049,15 @@ listener "unix" {
 					DisableRequestLimiter: true,
 				},
 				{
-					Type:              "unix",
-					Address:           "/var/run/vault.sock",
-					SocketMode:        "644",
-					SocketUser:        "1000",
-					SocketGroup:       "1000",
-					RedactAddresses:   false,
-					RedactClusterName: false,
-					RedactVersion:     false,
+					Type:                  "unix",
+					Address:               "/var/run/vault.sock",
+					SocketMode:            "644",
+					SocketUser:            "1000",
+					SocketGroup:           "1000",
+					RedactAddresses:       false,
+					RedactClusterName:     false,
+					RedactVersion:         false,
+					DisableRequestLimiter: true,
 				},
 			},
 		},
@@ -1121,6 +1211,313 @@ ha_storage "consul" {
 	}
 }
 
+// testParseStorageURLConformance verifies that any storage configuration that
+// takes a URL, IP Address, or host:port address conforms to RFC-5942 §4 when
+// configured with an IPv6 address. See: https://rfc-editor.org/rfc/rfc5952.html
+func testParseStorageURLConformance(t *testing.T) {
+	t.Parallel()
+
+	for name, tc := range map[string]struct {
+		config     string
+		expected   *Storage
+		shouldFail bool
+	}{
+		"aerospike": {
+			config: `
+storage "aerospike" {
+	hostname  = "2001:db8:0:0:0:0:2:1"
+  port      = "3000"
+  namespace = "test"
+  set       = "vault"
+  username  = "admin"
+  password  = "admin"
+}`,
+			expected: &Storage{
+				Type: "aerospike",
+				Config: map[string]string{
+					"hostname":  "2001:db8::2:1",
+					"port":      "3000",
+					"namespace": "test",
+					"set":       "vault",
+					"username":  "admin",
+					"password":  "admin",
+				},
+			},
+		},
+		"alicloudoss": {
+			config: `
+storage "alicloudoss" {
+  access_key = "abcd1234"
+  secret_key = "defg5678"
+	endpoint   = "2001:db8:0:0:0:0:2:1"
+  bucket     = "my-bucket"
+}`,
+			expected: &Storage{
+				Type: "alicloudoss",
+				Config: map[string]string{
+					"access_key": "abcd1234",
+					"secret_key": "defg5678",
+					"endpoint":   "2001:db8::2:1",
+					"bucket":     "my-bucket",
+				},
+			},
+		},
+		"azure": {
+			config: `
+storage "azure" {
+  accountName  = "my-storage-account"
+  accountKey   = "abcd1234"
+	arm_endpoint = "2001:db8:0:0:0:0:2:1"
+  container    = "container-efgh5678"
+  environment  = "AzurePublicCloud"
+}`,
+			expected: &Storage{
+				Type: "azure",
+				Config: map[string]string{
+					"accountName":  "my-storage-account",
+					"accountKey":   "abcd1234",
+					"arm_endpoint": "2001:db8::2:1",
+					"container":    "container-efgh5678",
+					"environment":  "AzurePublicCloud",
+				},
+			},
+		},
+		"cassandra": {
+			config: `
+storage "cassandra" {
+	hosts            = "2001:db8:0:0:0:0:2:1"
+  consistency      = "LOCAL_QUORUM"
+  protocol_version = 3
+}`,
+			expected: &Storage{
+				Type: "cassandra",
+				Config: map[string]string{
+					"hosts":            "2001:db8::2:1",
+					"consistency":      "LOCAL_QUORUM",
+					"protocol_version": "3",
+				},
+			},
+		},
+		"cockroachdb": {
+			config: `
+storage "cockroachdb" {
+  connection_url = "postgres://user123:secret123!@2001:db8:0:0:0:0:2:1:5432/vault"
+  table          = "vault_kv_store"
+}`,
+			expected: &Storage{
+				Type: "cockroachdb",
+				Config: map[string]string{
+					"connection_url": "postgres://user123:secret123%21@[2001:db8::2:1]:5432/vault",
+					"table":          "vault_kv_store",
+				},
+			},
+		},
+		"consul": {
+			config: `
+storage "consul" {
+  address = "[2001:db8:0:0:0:0:2:1]:8500"
+  path    = "vault/"
+}`,
+			expected: &Storage{
+				Type: "consul",
+				Config: map[string]string{
+					"address": "[2001:db8::2:1]:8500",
+					"path":    "vault/",
+				},
+			},
+		},
+		"couchdb": {
+			config: `
+storage "couchdb" {
+  endpoint = "https://[2001:db8:0:0:0:0:2:1]:5984/my-database"
+  username = "admin"
+  password = "admin"
+}`,
+			expected: &Storage{
+				Type: "couchdb",
+				Config: map[string]string{
+					"endpoint": "https://[2001:db8::2:1]:5984/my-database",
+					"username": "admin",
+					"password": "admin",
+				},
+			},
+		},
+		"dynamodb": {
+			config: `
+storage "dynamodb" {
+  endpoint   = "https://[2001:db8:0:0:0:0:2:1]:5984/my-aws-endpoint"
+  ha_enabled = "true"
+  region     = "us-west-2"
+  table      = "vault-data"
+}`,
+			expected: &Storage{
+				Type: "dynamodb",
+				Config: map[string]string{
+					"endpoint":   "https://[2001:db8::2:1]:5984/my-aws-endpoint",
+					"ha_enabled": "true",
+					"region":     "us-west-2",
+					"table":      "vault-data",
+				},
+			},
+		},
+		"etcd": {
+			config: `
+storage "etcd" {
+  address       = "https://[2001:db8:0:0:0:0:2:1]:2379"
+  discovery_srv = "https://[2001:db8:0:0:1:0:0:1]"
+  etcd_api      = "v3"
+}`,
+			expected: &Storage{
+				Type: "etcd",
+				Config: map[string]string{
+					"address":       "https://[2001:db8::2:1]:2379",
+					"discovery_srv": "https://[2001:db8::1:0:0:1]",
+					"etcd_api":      "v3",
+				},
+			},
+		},
+		"manta": {
+			config: `
+storage "manta" {
+  directory = "manta-directory"
+  user      = "myuser"
+  key_id    = "40:9d:d3:f9:0b:86:62:48:f4:2e:a5:8e:43:00:2a:9b"
+  url       = "https://[2001:db8:0:0:0:0:2:1]"
+}`,
+			expected: &Storage{
+				Type: "manta",
+				Config: map[string]string{
+					"directory": "manta-directory",
+					"user":      "myuser",
+					"key_id":    "40:9d:d3:f9:0b:86:62:48:f4:2e:a5:8e:43:00:2a:9b",
+					"url":       "https://[2001:db8::2:1]",
+				},
+			},
+		},
+		"mssql": {
+			config: `
+storage "mssql" {
+  server            = "2001:db8:0:0:0:0:2:1"
+  port              = 1433
+  username          = "user1234"
+  password          = "secret123!"
+  database          = "vault"
+  table             = "vault"
+  appname           = "vault"
+  schema            = "dbo"
+  connectionTimeout = 30
+  logLevel = 0
+}`,
+			expected: &Storage{
+				Type: "mssql",
+				Config: map[string]string{
+					"server":            "2001:db8::2:1",
+					"port":              "1433",
+					"username":          "user1234",
+					"password":          "secret123!",
+					"database":          "vault",
+					"table":             "vault",
+					"appname":           "vault",
+					"schema":            "dbo",
+					"connectionTimeout": "30",
+					"logLevel":          "0",
+				},
+			},
+		},
+		"mysql": {
+			config: `
+storage "mysql" {
+	address  = "[2001:db8:0:0:0:0:2:1]:3306"
+  username = "user1234"
+  password = "secret123!"
+  database = "vault"
+}`,
+			expected: &Storage{
+				Type: "mysql",
+				Config: map[string]string{
+					"address":  "[2001:db8::2:1]:3306",
+					"username": "user1234",
+					"password": "secret123!",
+					"database": "vault",
+				},
+			},
+		},
+		"postgresql": {
+			config: `
+storage "postgresql" {
+  connection_url = "postgres://user123:secret123!@2001:db8:0:0:0:0:2:1:5432/vault"
+  table          = "vault_kv_store"
+}`,
+			expected: &Storage{
+				Type: "postgresql",
+				Config: map[string]string{
+					"connection_url": "postgres://user123:secret123%21@[2001:db8::2:1]:5432/vault",
+					"table":          "vault_kv_store",
+				},
+			},
+		},
+		"s3": {
+			config: `
+storage "s3" {
+  endpoint   = "https://[2001:db8:0:0:0:0:2:1]:5984/my-aws-endpoint"
+  access_key = "abcd1234"
+  secret_key = "defg5678"
+	bucket     = "my-bucket"
+}`,
+			expected: &Storage{
+				Type: "s3",
+				Config: map[string]string{
+					"endpoint":   "https://[2001:db8::2:1]:5984/my-aws-endpoint",
+					"access_key": "abcd1234",
+					"secret_key": "defg5678",
+					"bucket":     "my-bucket",
+				},
+			},
+		},
+		"swift": {
+			config: `
+storage "swift" {
+	auth_url    = "https://[2001:db8:0:0:0:0:2:1]/auth"
+	storage_url = "https://[2001:db8:0:0:0:0:2:1]/storage"
+  username    = "admin"
+  password    = "secret123!"
+  container   = "my-storage-container"
+}`,
+			expected: &Storage{
+				Type: "swift",
+				Config: map[string]string{
+					"auth_url":    "https://[2001:db8::2:1]/auth",
+					"storage_url": "https://[2001:db8::2:1]/storage",
+					"username":    "admin",
+					"password":    "secret123!",
+					"container":   "my-storage-container",
+				},
+			},
+		},
+		"zookeeper": {
+			config: `
+storage "zookeeper" {
+	address = "[2001:db8:0:0:0:0:2:1]:2181"
+  path    = "vault/"
+}`,
+			expected: &Storage{
+				Type: "zookeeper",
+				Config: map[string]string{
+					"address": "[2001:db8::2:1]:2181",
+					"path":    "vault/",
+				},
+			},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			config, err := ParseConfig(tc.config, "")
+			require.NoError(t, err)
+			require.EqualValues(t, tc.expected, config.Storage)
+		})
+	}
+}
+
 func testParseSeals(t *testing.T) {
 	config, err := LoadConfigFile("./test-fixtures/config_seals.hcl")
 	if err != nil {
@@ -1265,6 +1662,9 @@ func testLoadConfigFileLeaseMetrics(t *testing.T) {
 		MaxLeaseTTLRaw:     "10h",
 		DefaultLeaseTTL:    10 * time.Hour,
 		DefaultLeaseTTLRaw: "10h",
+
+		RemoveIrrevocableLeaseAfter:    10 * 24 * time.Hour,
+		RemoveIrrevocableLeaseAfterRaw: "10d",
 	}
 
 	addExpectedEntConfig(expected, []string{})
diff --git a/command/server/config_test_helpers_stubs_oss.go b/command/server/config_test_helpers_stubs_oss.go
index f7b6ef7c115..029bdc58d7c 100644
--- a/command/server/config_test_helpers_stubs_oss.go
+++ b/command/server/config_test_helpers_stubs_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/command/server/config_util.go b/command/server/config_util.go
index 1114be8ebba..3cb720d313e 100644
--- a/command/server/config_util.go
+++ b/command/server/config_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -14,7 +14,7 @@ import (
 
 type entConfig struct{}
 
-func (ec *entConfig) parseConfig(list *ast.ObjectList) error {
+func (ec *entConfig) parseConfig(list *ast.ObjectList, source string) error {
 	return nil
 }
 
diff --git a/command/server/config_util_test.go b/command/server/config_util_test.go
index 81c5212584b..a76b72c0d0e 100644
--- a/command/server/config_util_test.go
+++ b/command/server/config_util_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -6,7 +6,6 @@
 package server
 
 import (
-	"fmt"
 	"testing"
 
 	"github.com/hashicorp/vault/internalshared/configutil"
@@ -87,55 +86,3 @@ func TestCheckSealConfig(t *testing.T) {
 		})
 	}
 }
-
-// TestRequestLimiterConfig verifies that the census config is correctly instantiated from HCL
-func TestRequestLimiterConfig(t *testing.T) {
-	testCases := []struct {
-		name              string
-		inConfig          string
-		outErr            bool
-		outRequestLimiter *configutil.RequestLimiter
-	}{
-		{
-			name:              "empty",
-			outRequestLimiter: nil,
-		},
-		{
-			name: "disabled",
-			inConfig: `
-request_limiter {
-	disable = true
-}`,
-			outRequestLimiter: &configutil.RequestLimiter{Disable: true},
-		},
-		{
-			name: "invalid disable",
-			inConfig: `
-request_limiter {
-	disable = "people make mistakes"
-}`,
-			outErr: true,
-		},
-	}
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			config := fmt.Sprintf(`
-ui = false
-storage "file" {
-	path = "/tmp/test"
-}
-
-listener "tcp" {
-	address = "0.0.0.0:8200"
-}
-%s`, tc.inConfig)
-			gotConfig, err := ParseConfig(config, "")
-			if tc.outErr {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-				require.Equal(t, tc.outRequestLimiter, gotConfig.RequestLimiter)
-			}
-		})
-	}
-}
diff --git a/command/server/hcp_link_config_test.go b/command/server/hcp_link_config_test.go
index c038e9b9906..9bb85fd1fdc 100644
--- a/command/server/hcp_link_config_test.go
+++ b/command/server/hcp_link_config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
diff --git a/command/server/listener.go b/command/server/listener.go
index bdc2117d77e..01d306f4e39 100644
--- a/command/server/listener.go
+++ b/command/server/listener.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
diff --git a/command/server/listener_tcp.go b/command/server/listener_tcp.go
index 6c121ec403e..de8c88cbcbf 100644
--- a/command/server/listener_tcp.go
+++ b/command/server/listener_tcp.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
@@ -19,7 +19,7 @@ import (
 )
 
 func tcpListenerFactory(l *configutil.Listener, _ io.Writer, ui cli.Ui) (net.Listener, map[string]string, reloadutil.ReloadFunc, error) {
-	addr := l.Address
+	addr := configutil.NormalizeAddr(l.Address)
 	if addr == "" {
 		addr = "127.0.0.1:8200"
 	}
@@ -64,6 +64,14 @@ func tcpListenerFactory(l *configutil.Listener, _ io.Writer, ui cli.Ui) (net.Lis
 		if len(l.XForwardedForAuthorizedAddrs) > 0 {
 			props["x_forwarded_for_reject_not_authorized"] = strconv.FormatBool(l.XForwardedForRejectNotAuthorized)
 		}
+
+		if len(l.XForwardedForAuthorizedAddrs) > 0 {
+			props["x_forwarded_for_client_cert_header"] = fmt.Sprintf("%s", l.XForwardedForClientCertHeader)
+		}
+
+		if len(l.XForwardedForAuthorizedAddrs) > 0 {
+			props["x_forwarded_for_client_cert_header_decoders"] = fmt.Sprintf("%s", l.XForwardedForClientCertHeaderDecoders)
+		}
 	}
 
 	tlsConfig, reloadFunc, err := listenerutil.TLSConfig(l, props, ui)
diff --git a/command/server/listener_tcp_test.go b/command/server/listener_tcp_test.go
index 42da6c0d21a..80490e55859 100644
--- a/command/server/listener_tcp_test.go
+++ b/command/server/listener_tcp_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
@@ -6,9 +6,7 @@ package server
 import (
 	"crypto/tls"
 	"crypto/x509"
-	"fmt"
 	"io/ioutil"
-	"math/rand"
 	"net"
 	"os"
 	"testing"
@@ -18,6 +16,7 @@ import (
 	"github.com/hashicorp/go-sockaddr"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/pires/go-proxyproto"
+	"github.com/stretchr/testify/require"
 )
 
 func TestTCPListener(t *testing.T) {
@@ -25,9 +24,7 @@ func TestTCPListener(t *testing.T) {
 		Address:    "127.0.0.1:0",
 		TLSDisable: true,
 	}, nil, cli.NewMockUi())
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+	require.NoError(t, err)
 
 	connFn := func(lnReal net.Listener) (net.Conn, error) {
 		return net.Dial("tcp", ln.Addr().String())
@@ -41,19 +38,13 @@ func TestTCPListener_tls(t *testing.T) {
 	wd, _ := os.Getwd()
 	wd += "/test-fixtures/reload/"
 
-	td, err := ioutil.TempDir("", fmt.Sprintf("vault-test-%d", rand.New(rand.NewSource(time.Now().Unix())).Int63()))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(td)
-
 	// Setup initial certs
-	inBytes, _ := ioutil.ReadFile(wd + "reload_ca.pem")
+	inBytes, err := os.ReadFile(wd + "reload_ca.pem")
+	require.NoError(t, err)
+
 	certPool := x509.NewCertPool()
 	ok := certPool.AppendCertsFromPEM(inBytes)
-	if !ok {
-		t.Fatal("not ok when appending CA cert")
-	}
+	require.True(t, ok, "not ok when appending CA cert")
 
 	ln, _, _, err := tcpListenerFactory(&configutil.Listener{
 		Address:                       "127.0.0.1:0",
@@ -62,9 +53,8 @@ func TestTCPListener_tls(t *testing.T) {
 		TLSRequireAndVerifyClientCert: true,
 		TLSClientCAFile:               wd + "reload_ca.pem",
 	}, nil, cli.NewMockUi())
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+	require.NoError(t, err)
+
 	cwd, _ := os.Getwd()
 
 	clientCert, _ := tls.LoadX509KeyPair(
@@ -100,9 +90,7 @@ func TestTCPListener_tls(t *testing.T) {
 		TLSDisableClientCerts:         true,
 		TLSClientCAFile:               wd + "reload_ca.pem",
 	}, nil, cli.NewMockUi())
-	if err == nil {
-		t.Fatal("expected error due to mutually exclusive client cert options")
-	}
+	require.Error(t, err, "expected error due to mutually exclusive client cert options")
 
 	ln, _, _, err = tcpListenerFactory(&configutil.Listener{
 		Address:               "127.0.0.1:0",
@@ -111,9 +99,7 @@ func TestTCPListener_tls(t *testing.T) {
 		TLSDisableClientCerts: true,
 		TLSClientCAFile:       wd + "reload_ca.pem",
 	}, nil, cli.NewMockUi())
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+	require.NoError(t, err)
 
 	testListenerImpl(t, ln, connFn(false), "foo.example.com", 0, "127.0.0.1", false)
 }
@@ -122,19 +108,11 @@ func TestTCPListener_tls13(t *testing.T) {
 	wd, _ := os.Getwd()
 	wd += "/test-fixtures/reload/"
 
-	td, err := ioutil.TempDir("", fmt.Sprintf("vault-test-%d", rand.New(rand.NewSource(time.Now().Unix())).Int63()))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer os.RemoveAll(td)
-
 	// Setup initial certs
 	inBytes, _ := ioutil.ReadFile(wd + "reload_ca.pem")
 	certPool := x509.NewCertPool()
 	ok := certPool.AppendCertsFromPEM(inBytes)
-	if !ok {
-		t.Fatal("not ok when appending CA cert")
-	}
+	require.True(t, ok, "not ok when appending CA cert")
 
 	ln, _, _, err := tcpListenerFactory(&configutil.Listener{
 		Address:                       "127.0.0.1:0",
@@ -144,9 +122,8 @@ func TestTCPListener_tls13(t *testing.T) {
 		TLSClientCAFile:               wd + "reload_ca.pem",
 		TLSMinVersion:                 "tls13",
 	}, nil, cli.NewMockUi())
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+	require.NoError(t, err)
+
 	cwd, _ := os.Getwd()
 
 	clientCert, _ := tls.LoadX509KeyPair(
@@ -183,9 +160,7 @@ func TestTCPListener_tls13(t *testing.T) {
 		TLSClientCAFile:               wd + "reload_ca.pem",
 		TLSMinVersion:                 "tls13",
 	}, nil, cli.NewMockUi())
-	if err == nil {
-		t.Fatal("expected error due to mutually exclusive client cert options")
-	}
+	require.Error(t, err, "expected error due to mutually exclusive client cert options")
 
 	ln, _, _, err = tcpListenerFactory(&configutil.Listener{
 		Address:               "127.0.0.1:0",
@@ -195,9 +170,7 @@ func TestTCPListener_tls13(t *testing.T) {
 		TLSClientCAFile:       wd + "reload_ca.pem",
 		TLSMinVersion:         "tls13",
 	}, nil, cli.NewMockUi())
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+	require.NoError(t, err)
 
 	testListenerImpl(t, ln, connFn(false), "foo.example.com", tls.VersionTLS13, "127.0.0.1", false)
 
@@ -209,9 +182,7 @@ func TestTCPListener_tls13(t *testing.T) {
 		TLSClientCAFile:       wd + "reload_ca.pem",
 		TLSMaxVersion:         "tls12",
 	}, nil, cli.NewMockUi())
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
+	require.NoError(t, err)
 
 	testListenerImpl(t, ln, connFn(false), "foo.example.com", tls.VersionTLS12, "127.0.0.1", false)
 }
@@ -429,9 +400,7 @@ func TestTCPListener_proxyProtocol(t *testing.T) {
 			proxyProtocolAuthorizedAddrs := []*sockaddr.SockAddrMarshaler{}
 			if tc.AuthorizedAddr != "" {
 				sockAddr, err := sockaddr.NewSockAddr(tc.AuthorizedAddr)
-				if err != nil {
-					t.Fatal(err)
-				}
+				require.NoError(t, err)
 				proxyProtocolAuthorizedAddrs = append(
 					proxyProtocolAuthorizedAddrs,
 					&sockaddr.SockAddrMarshaler{SockAddr: sockAddr},
@@ -444,12 +413,11 @@ func TestTCPListener_proxyProtocol(t *testing.T) {
 				ProxyProtocolBehavior:        tc.Behavior,
 				ProxyProtocolAuthorizedAddrs: proxyProtocolAuthorizedAddrs,
 			}, nil, cli.NewMockUi())
-			if err != nil {
-				t.Fatalf("err: %s", err)
-			}
+			require.NoError(t, err)
 
 			connFn := func(lnReal net.Listener) (net.Conn, error) {
-				conn, err := net.Dial("tcp", ln.Addr().String())
+				d := net.Dialer{Timeout: 3 * time.Second}
+				conn, err := d.Dial("tcp", lnReal.Addr().String())
 				if err != nil {
 					return nil, err
 				}
@@ -464,3 +432,73 @@ func TestTCPListener_proxyProtocol(t *testing.T) {
 		})
 	}
 }
+
+// TestTCPListener_proxyProtocol_keepAcceptingOnInvalidUpstream ensures that the server side listener
+// never returns an error from the listener.Accept method if the error is that the
+// upstream proxy isn't trusted. If an error is returned, underlying Go HTTP native
+// libraries may close down a server and stop listening.
+func TestTCPListener_proxyProtocol_keepAcceptingOnInvalidUpstream(t *testing.T) {
+	timeout := 3 * time.Second
+
+	// Configure proxy so we hit the deny unauthorized behavior.
+	header := &proxyproto.Header{
+		Version:           1,
+		Command:           proxyproto.PROXY,
+		TransportProtocol: proxyproto.TCPv4,
+		SourceAddr: &net.TCPAddr{
+			IP:   net.ParseIP("10.1.1.1"),
+			Port: 1000,
+		},
+		DestinationAddr: &net.TCPAddr{
+			IP:   net.ParseIP("20.2.2.2"),
+			Port: 2000,
+		},
+	}
+
+	var authAddrs []*sockaddr.SockAddrMarshaler
+	sockAddr, err := sockaddr.NewSockAddr("10.0.0.1/32")
+	require.NoError(t, err)
+	authAddrs = append(authAddrs, &sockaddr.SockAddrMarshaler{SockAddr: sockAddr})
+
+	ln, _, _, err := tcpListenerFactory(&configutil.Listener{
+		Address:                      "127.0.0.1:0",
+		TLSDisable:                   true,
+		ProxyProtocolBehavior:        "deny_unauthorized",
+		ProxyProtocolAuthorizedAddrs: authAddrs,
+	}, nil, cli.NewMockUi())
+	require.NoError(t, err)
+
+	// Kick off setting up server side, if we ever accept a connection send it out
+	// via a channel.
+	serverConnCh := make(chan net.Conn, 1)
+	go func() {
+		serverConn, err := ln.Accept()
+		// We shouldn't ever have an error if the problem was only that the upstream
+		// proxy wasn't trusted.
+		// An error would lead to the http.Serve closing the listener and giving up.
+		require.NoError(t, err, "server side listener errored")
+		serverConnCh <- serverConn
+	}()
+
+	// Now try to connect as the client.
+	d := net.Dialer{Timeout: timeout}
+	clientConn, err := d.Dial("tcp", ln.Addr().String())
+	require.NoError(t, err)
+	defer clientConn.Close()
+	_, err = header.WriteTo(clientConn)
+	require.NoError(t, err)
+
+	// Wait for the server to have accepted a connection, or we time out.
+	select {
+	case <-time.After(timeout):
+		// The server still hasn't accepted any valid client connection.
+		// Try to write another header using the same connection which should have
+		// been closed by the server, we expect that this client side connection was
+		// closed as it us untrusted,
+		_, err = header.WriteTo(clientConn)
+		require.Error(t, err, "reused a rejected connection without error")
+	case serverConn := <-serverConnCh:
+		require.NotNil(t, serverConn)
+		defer serverConn.Close()
+	}
+}
diff --git a/command/server/listener_test.go b/command/server/listener_test.go
index b1c6be73f7f..7bf310a98df 100644
--- a/command/server/listener_test.go
+++ b/command/server/listener_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
@@ -9,6 +9,7 @@ import (
 	"io"
 	"net"
 	"testing"
+	"time"
 )
 
 type testListenerConnFn func(net.Listener) (net.Conn, error)
@@ -60,7 +61,11 @@ func testListenerImpl(t *testing.T, ln net.Listener, connFn testListenerConnFn,
 		}
 	}
 
-	server := <-serverCh
+	var server net.Conn
+	select {
+	case <-time.After(3 * time.Second):
+	case server = <-serverCh:
+	}
 
 	if server == nil {
 		if !expectError {
diff --git a/command/server/listener_unix.go b/command/server/listener_unix.go
index 35306d16669..8f8f4799ed4 100644
--- a/command/server/listener_unix.go
+++ b/command/server/listener_unix.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
diff --git a/command/server/listener_unix_test.go b/command/server/listener_unix_test.go
index 72f21bb471c..3cbedc97165 100644
--- a/command/server/listener_unix_test.go
+++ b/command/server/listener_unix_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
diff --git a/command/server/server_seal_transit_acc_test.go b/command/server/server_seal_transit_acc_test.go
index 45e4e9b5165..31d78baea0c 100644
--- a/command/server/server_seal_transit_acc_test.go
+++ b/command/server/server_seal_transit_acc_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
diff --git a/command/server/server_stubs_oss.go b/command/server/server_stubs_oss.go
index 6426318df2a..33bedcb7487 100644
--- a/command/server/server_stubs_oss.go
+++ b/command/server/server_stubs_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/command/server/test-fixtures/config-dir/baz.hcl b/command/server/test-fixtures/config-dir/baz.hcl
index 3f2e01d58dd..3731ea9b8e9 100644
--- a/command/server/test-fixtures/config-dir/baz.hcl
+++ b/command/server/test-fixtures/config-dir/baz.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 telemetry {
diff --git a/command/server/test-fixtures/config-dir/foo.hcl b/command/server/test-fixtures/config-dir/foo.hcl
index 2731eb55191..6e30c32ac3f 100644
--- a/command/server/test-fixtures/config-dir/foo.hcl
+++ b/command/server/test-fixtures/config-dir/foo.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/config.hcl b/command/server/test-fixtures/config.hcl
index 7750e5e6565..cb25d6705b7 100644
--- a/command/server/test-fixtures/config.hcl
+++ b/command/server/test-fixtures/config.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
@@ -53,4 +53,5 @@ enable_response_header_hostname = true
 enable_response_header_raft_node_id = true
 license_path = "/path/to/license"
 plugin_directory = "/path/to/plugins"
-plugin_tmpdir = "/tmp/plugins"
\ No newline at end of file
+plugin_tmpdir = "/tmp/plugins"
+remove_irrevocable_lease_after = "10d"
\ No newline at end of file
diff --git a/command/server/test-fixtures/config.hcl.json b/command/server/test-fixtures/config.hcl.json
index 92c1986ba55..fc420515629 100644
--- a/command/server/test-fixtures/config.hcl.json
+++ b/command/server/test-fixtures/config.hcl.json
@@ -30,5 +30,6 @@
 	"ui":true,
 	"pid_file":"./pidfile",
 	"raw_storage_endpoint":true,
-	"disable_sealwrap":true
+	"disable_sealwrap":true,
+	"remove_irrevocable_lease_after":"10d"
 }
diff --git a/command/server/test-fixtures/config2.hcl b/command/server/test-fixtures/config2.hcl
index 0e383fb2591..c363c4388f4 100644
--- a/command/server/test-fixtures/config2.hcl
+++ b/command/server/test-fixtures/config2.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
@@ -6,60 +6,62 @@ disable_mlock = true
 
 ui = true
 
-api_addr = "top_level_api_addr"
+api_addr     = "top_level_api_addr"
 cluster_addr = "top_level_cluster_addr"
 
 listener "tcp" {
-    address = "127.0.0.1:443"
+  address = "127.0.0.1:443"
 }
 
 storage "consul" {
-    foo = "bar"
-    redirect_addr = "foo"
+  foo           = "bar"
+  redirect_addr = "foo"
 }
 
 ha_storage "consul" {
-    bar = "baz"
-    redirect_addr = "snafu"
-    disable_clustering = "true"
+  bar                = "baz"
+  redirect_addr      = "snafu"
+  disable_clustering = "true"
 }
 
 service_registration "consul" {
-    foo = "bar"
+  foo     = "bar"
+  address = "https://[2001:0db8::0001]:8500"
 }
 
 telemetry {
-    statsd_address = "bar"
-    usage_gauge_period = "5m"
-    maximum_gauge_cardinality = 125
-    statsite_address = "foo"
-    dogstatsd_addr = "127.0.0.1:7254"
-    dogstatsd_tags = ["tag_1:val_1", "tag_2:val_2"]
-    prometheus_retention_time = "30s"
+  statsd_address            = "bar"
+  usage_gauge_period        = "5m"
+  maximum_gauge_cardinality = 125
+  statsite_address          = "foo"
+  dogstatsd_addr            = "127.0.0.1:7254"
+  dogstatsd_tags            = ["tag_1:val_1", "tag_2:val_2"]
+  prometheus_retention_time = "30s"
 }
 
 entropy "seal" {
-    mode = "augmentation"
+  mode = "augmentation"
 }
 
 sentinel {
-    additional_enabled_modules = []
+  additional_enabled_modules = []
 }
 kms "commastringpurpose" {
-    purpose = "foo,bar"
+  purpose = "foo,bar"
 }
 kms "slicepurpose" {
-    purpose = ["zip", "zap"]
+  purpose = ["zip", "zap"]
 }
 seal "nopurpose" {
 }
 seal "stringpurpose" {
-    purpose = "foo"
+  purpose = "foo"
 }
 
-max_lease_ttl = "10h"
-default_lease_ttl = "10h"
-cluster_name = "testcluster"
-pid_file = "./pidfile"
+max_lease_ttl        = "10h"
+default_lease_ttl    = "10h"
+cluster_name         = "testcluster"
+pid_file             = "./pidfile"
 raw_storage_endpoint = true
-disable_sealwrap = true
+disable_sealwrap     = true
+remove_irrevocable_lease_after = "10d"
diff --git a/command/server/test-fixtures/config3.hcl b/command/server/test-fixtures/config3.hcl
index 587698b35e9..cebd5c63469 100644
--- a/command/server/test-fixtures/config3.hcl
+++ b/command/server/test-fixtures/config3.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
@@ -58,3 +58,6 @@ raw_storage_endpoint = true
 disable_sealwrap = true
 disable_sentinel_trace = true
 administrative_namespace_path = "admin/"
+enable_post_unseal_trace = true
+post_unseal_trace_directory = "/tmp"
+remove_irrevocable_lease_after = "30d"
diff --git a/command/server/test-fixtures/config4.hcl b/command/server/test-fixtures/config4.hcl
index 69c767fd697..22cd1899f09 100644
--- a/command/server/test-fixtures/config4.hcl
+++ b/command/server/test-fixtures/config4.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/config5.hcl b/command/server/test-fixtures/config5.hcl
index 5fc5935953b..48ad6ed3453 100644
--- a/command/server/test-fixtures/config5.hcl
+++ b/command/server/test-fixtures/config5.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
@@ -51,4 +51,5 @@ disable_cache = true
  pid_file = "./pidfile"
  raw_storage_endpoint = true
  disable_sealwrap = true
- disable_printable_check = true
\ No newline at end of file
+ disable_printable_check = true
+ remove_irrevocable_lease_after = "10d"
diff --git a/command/server/test-fixtures/config_bad_https_storage.hcl b/command/server/test-fixtures/config_bad_https_storage.hcl
index 41b78ba5743..2e7fa722d59 100644
--- a/command/server/test-fixtures/config_bad_https_storage.hcl
+++ b/command/server/test-fixtures/config_bad_https_storage.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/config_custom_response_headers_1.hcl b/command/server/test-fixtures/config_custom_response_headers_1.hcl
index b12f2059b82..240f627b682 100644
--- a/command/server/test-fixtures/config_custom_response_headers_1.hcl
+++ b/command/server/test-fixtures/config_custom_response_headers_1.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 storage "inmem" {}
diff --git a/command/server/test-fixtures/config_custom_response_headers_multiple_listeners.hcl b/command/server/test-fixtures/config_custom_response_headers_multiple_listeners.hcl
index 99c62b537d9..3f4333b1e0d 100644
--- a/command/server/test-fixtures/config_custom_response_headers_multiple_listeners.hcl
+++ b/command/server/test-fixtures/config_custom_response_headers_multiple_listeners.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 storage "inmem" {}
diff --git a/command/server/test-fixtures/config_diagnose_hastorage_bad_https.hcl b/command/server/test-fixtures/config_diagnose_hastorage_bad_https.hcl
index 264c6dca701..9fba549a9ec 100644
--- a/command/server/test-fixtures/config_diagnose_hastorage_bad_https.hcl
+++ b/command/server/test-fixtures/config_diagnose_hastorage_bad_https.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/config_diagnose_ok.hcl b/command/server/test-fixtures/config_diagnose_ok.hcl
index 761d87e7b2c..5735631a8bb 100644
--- a/command/server/test-fixtures/config_diagnose_ok.hcl
+++ b/command/server/test-fixtures/config_diagnose_ok.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
@@ -45,3 +45,4 @@ pid_file = "./pidfile"
 raw_storage_endpoint = true
 disable_sealwrap = true
 disable_printable_check = true
+enable_multiseal = true
\ No newline at end of file
diff --git a/command/server/test-fixtures/config_diagnose_ok_singleseal.hcl b/command/server/test-fixtures/config_diagnose_ok_singleseal.hcl
new file mode 100644
index 00000000000..15656dae846
--- /dev/null
+++ b/command/server/test-fixtures/config_diagnose_ok_singleseal.hcl
@@ -0,0 +1,47 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+disable_cache = true
+disable_mlock = true
+
+ui = true
+
+listener "tcp" {
+    address = "127.0.0.1:1024"
+    tls_disable = true
+}
+
+backend "consul" {
+    address = "127.0.0.1:1025"
+}
+
+ha_backend "consul" {
+    address = "127.0.0.1:8500"
+    bar = "baz"
+    advertise_addr = "https://127.0.0.1:8500"
+    disable_clustering = "true"
+}
+
+service_registration "consul" {
+    address = "127.0.0.1:8500"
+    foo = "bar"
+}
+
+telemetry {
+    statsd_address = "bar"
+    usage_gauge_period = "5m"
+    maximum_gauge_cardinality = 100
+
+    statsite_address = "foo"
+    dogstatsd_addr = "127.0.0.1:7254"
+    dogstatsd_tags = ["tag_1:val_1", "tag_2:val_2"]
+    metrics_prefix = "myprefix"
+}
+
+max_lease_ttl = "10h"
+default_lease_ttl = "10h"
+cluster_name = "testcluster"
+pid_file = "./pidfile"
+raw_storage_endpoint = true
+disable_sealwrap = true
+disable_printable_check = true
diff --git a/command/server/test-fixtures/config_raft.hcl b/command/server/test-fixtures/config_raft.hcl
index 9563d011d1f..87d99edee75 100644
--- a/command/server/test-fixtures/config_raft.hcl
+++ b/command/server/test-fixtures/config_raft.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/config_seals.hcl b/command/server/test-fixtures/config_seals.hcl
index 0761ff19ba7..de20bd00ef1 100644
--- a/command/server/test-fixtures/config_seals.hcl
+++ b/command/server/test-fixtures/config_seals.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 listener "tcp" {
diff --git a/command/server/test-fixtures/config_small.hcl b/command/server/test-fixtures/config_small.hcl
index 982162f98a6..f2767f1bb9f 100644
--- a/command/server/test-fixtures/config_small.hcl
+++ b/command/server/test-fixtures/config_small.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 storage "raft" {
diff --git a/command/server/test-fixtures/config_with_valid_admin_ns.hcl b/command/server/test-fixtures/config_with_valid_admin_ns.hcl
index af8630612f1..8647bdfa9f7 100644
--- a/command/server/test-fixtures/config_with_valid_admin_ns.hcl
+++ b/command/server/test-fixtures/config_with_valid_admin_ns.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 storage "raft" {
diff --git a/command/server/test-fixtures/diagnose_bad_https_consul_sr.hcl b/command/server/test-fixtures/diagnose_bad_https_consul_sr.hcl
index 8019194148a..7bd712ff50b 100644
--- a/command/server/test-fixtures/diagnose_bad_https_consul_sr.hcl
+++ b/command/server/test-fixtures/diagnose_bad_https_consul_sr.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/diagnose_bad_telemetry1.hcl b/command/server/test-fixtures/diagnose_bad_telemetry1.hcl
index 815b671df7d..713e6770838 100644
--- a/command/server/test-fixtures/diagnose_bad_telemetry1.hcl
+++ b/command/server/test-fixtures/diagnose_bad_telemetry1.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/diagnose_bad_telemetry2.hcl b/command/server/test-fixtures/diagnose_bad_telemetry2.hcl
index 090a7ff6e3e..80a8c9af709 100644
--- a/command/server/test-fixtures/diagnose_bad_telemetry2.hcl
+++ b/command/server/test-fixtures/diagnose_bad_telemetry2.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/diagnose_bad_telemetry3.hcl b/command/server/test-fixtures/diagnose_bad_telemetry3.hcl
index 0a41c80fec6..9a170a848c1 100644
--- a/command/server/test-fixtures/diagnose_bad_telemetry3.hcl
+++ b/command/server/test-fixtures/diagnose_bad_telemetry3.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/diagnose_ok_storage_direct_access.hcl b/command/server/test-fixtures/diagnose_ok_storage_direct_access.hcl
index 90534530117..f174f72ff61 100644
--- a/command/server/test-fixtures/diagnose_ok_storage_direct_access.hcl
+++ b/command/server/test-fixtures/diagnose_ok_storage_direct_access.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/diagnose_raft_no_bolt_folder.hcl b/command/server/test-fixtures/diagnose_raft_no_bolt_folder.hcl
index eaf3660d597..76feb1652d4 100644
--- a/command/server/test-fixtures/diagnose_raft_no_bolt_folder.hcl
+++ b/command/server/test-fixtures/diagnose_raft_no_bolt_folder.hcl
@@ -1,6 +1,7 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
+disable_mlock = true
 storage "raft" {
   path = "/path/to/raft/data"
   node_id = "raft_node_1"
diff --git a/command/server/test-fixtures/diagnose_seal_transit_tls_check.hcl b/command/server/test-fixtures/diagnose_seal_transit_tls_check.hcl
index 17f3274fb52..3a8f1dcb2f9 100644
--- a/command/server/test-fixtures/diagnose_seal_transit_tls_check.hcl
+++ b/command/server/test-fixtures/diagnose_seal_transit_tls_check.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
@@ -20,9 +20,9 @@ backend "consul" {
 seal "transit" {
 
   // TLS Configuration
-  tls_ca_cert        = "./../vault/diagnose/test-fixtures/chain.crt.pem"
-  tls_client_cert    = "./../vault/diagnose/test-fixtures/goodcertwithroot.pem"
-  tls_client_key     = "./../vault/diagnose//test-fixtures/goodkey.pem"
+  tls_ca_cert        = "{REPLACE_COMBINED_CA_CHAIN_FILE}"
+  tls_client_cert    = "{REPLACE_LEAF_CERT_FILE}"
+  tls_client_key     = "{REPLACE_LEAF_KEY_FILE}"
   tls_server_name    = "vault"
   tls_skip_verify    = "false"
 }
@@ -57,3 +57,4 @@ pid_file = "./pidfile"
 raw_storage_endpoint = true
 disable_sealwrap = true
 disable_printable_check = true
+enable_multiseal = true
\ No newline at end of file
diff --git a/command/server/test-fixtures/hcp_link_config.hcl b/command/server/test-fixtures/hcp_link_config.hcl
index bffbe83ae60..a9d35dd9869 100644
--- a/command/server/test-fixtures/hcp_link_config.hcl
+++ b/command/server/test-fixtures/hcp_link_config.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 storage "inmem" {}
diff --git a/command/server/test-fixtures/invalid_config_duplicate_key.hcl b/command/server/test-fixtures/invalid_config_duplicate_key.hcl
new file mode 100644
index 00000000000..0be84afdf04
--- /dev/null
+++ b/command/server/test-fixtures/invalid_config_duplicate_key.hcl
@@ -0,0 +1,31 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+disable_cache = true
+disable_mlock = true
+ui = true
+
+listener "tcp" {
+  address = "127.0.0.1:8200"
+  # duplicate key
+  address = "127.0.0.1:8201"
+}
+
+storage "raft" {
+  path = "/storage/path/raft"
+  node_id = "raft1"
+  performance_multiplier = 1
+}
+
+telemetry {
+  statsd_address = "bar"
+  usage_gauge_period = "5m"
+  maximum_gauge_cardinality = 100
+
+  statsite_address = "foo"
+  dogstatsd_addr = "127.0.0.1:7254"
+  dogstatsd_tags = ["tag_1:val_1", "tag_2:val_2"]
+  metrics_prefix = "myprefix"
+}
+
+cluster_addr = "127.0.0.1:8201"
\ No newline at end of file
diff --git a/command/server/test-fixtures/nostore_config.hcl b/command/server/test-fixtures/nostore_config.hcl
index 306ef7c9cac..c15fefc6baf 100644
--- a/command/server/test-fixtures/nostore_config.hcl
+++ b/command/server/test-fixtures/nostore_config.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
diff --git a/command/server/test-fixtures/observations.hcl b/command/server/test-fixtures/observations.hcl
new file mode 100644
index 00000000000..8cea15b47a7
--- /dev/null
+++ b/command/server/test-fixtures/observations.hcl
@@ -0,0 +1,6 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+observations {
+    ledger_path = "/var/ledger.log"
+}
diff --git a/command/server/test-fixtures/observations_allow_deny.hcl b/command/server/test-fixtures/observations_allow_deny.hcl
new file mode 100644
index 00000000000..67568e1307a
--- /dev/null
+++ b/command/server/test-fixtures/observations_allow_deny.hcl
@@ -0,0 +1,9 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+observations {
+    ledger_path = "/var/ledger.log"
+    type_prefix_denylist = ["deny1", "deny2"]
+    type_prefix_allowlist = ["allow1", "allow2", "allow3"]
+    file_mode = "0777"
+}
diff --git a/command/server/test-fixtures/raft_retry_join.hcl b/command/server/test-fixtures/raft_retry_join.hcl
deleted file mode 100644
index 844dd744e40..00000000000
--- a/command/server/test-fixtures/raft_retry_join.hcl
+++ /dev/null
@@ -1,22 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-storage "raft" {
-	path = "/storage/path/raft"
-	node_id = "raft1"
-	retry_join = [
-    {
-    "leader_api_addr" = "http://127.0.0.1:8200"
-    },
-    {
-    "leader_api_addr" = "http://127.0.0.2:8200"
-    },
-    {
-    "leader_api_addr" = "http://127.0.0.3:8200"
-    }
-  ]
-}
-listener "tcp" {
-	address = "127.0.0.1:8200"
-}
-disable_mlock = true
diff --git a/command/server/test-fixtures/raft_retry_join_attr.hcl b/command/server/test-fixtures/raft_retry_join_attr.hcl
new file mode 100644
index 00000000000..3e80d6e4859
--- /dev/null
+++ b/command/server/test-fixtures/raft_retry_join_attr.hcl
@@ -0,0 +1,38 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+storage "raft" {
+  path    = "/storage/path/raft"
+  node_id = "raft1"
+  retry_join = [
+    { "leader_api_addr" = "http://127.0.0.1:8200" },
+    { "leader_api_addr" = "http://[2001:db8:0:0:0:0:2:1]:8200" }
+  ]
+  retry_join = [
+    { "auto_join" = "provider=mdns service=consul domain=2001:db8:0:0:0:0:2:1" }
+  ]
+  retry_join = [
+    { "auto_join" = "provider=os tag_key=consul tag_value=server username=foo password=bar auth_url=https://[2001:db8:0:0:0:0:2:1]/auth" }
+  ]
+  retry_join = [
+    { "auto_join" = "provider=triton account=testaccount url=https://[2001:db8:0:0:0:0:2:1] key_id=1234 tag_key=consul-role tag_value=server" }
+  ]
+  retry_join = [
+    { "auto_join" = "provider=packet auth_token=token project=uuid url=https://[2001:db8:0:0:0:0:2:1] address_type=public_v6" }
+  ]
+  retry_join = [
+    { "auto_join" = "provider=vsphere category_name=consul-role tag_name=consul-server host=https://[2001:db8:0:0:0:0:2:1] user=foo password=bar insecure_ssl=false" }
+  ]
+  retry_join = [
+    { "auto_join" = "provider=k8s namespace=vault label_selector=\"app.kubernetes.io/name=vault, component=server\"" }
+  ]
+  retry_join = [
+    { "auto_join" = "provider=k8s namespace=vault1 label_selector=\"app.kubernetes.io/name=vault1,component=server\"" }
+  ]
+}
+
+listener "tcp" {
+  address = "127.0.0.1:8200"
+}
+
+disable_mlock = true
diff --git a/command/server/test-fixtures/raft_retry_join_block.hcl b/command/server/test-fixtures/raft_retry_join_block.hcl
new file mode 100644
index 00000000000..ddd1ad18a2a
--- /dev/null
+++ b/command/server/test-fixtures/raft_retry_join_block.hcl
@@ -0,0 +1,41 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+storage "raft" {
+  path    = "/storage/path/raft"
+  node_id = "raft1"
+
+  retry_join {
+    "leader_api_addr" = "http://127.0.0.1:8200"
+  }
+  retry_join {
+    "leader_api_addr" = "http://[2001:db8:0:0:0:0:2:1]:8200"
+  }
+  retry_join {
+    "auto_join" = "provider=mdns service=consul domain=2001:db8:0:0:0:0:2:1"
+  }
+  retry_join {
+    "auto_join" = "provider=os tag_key=consul tag_value=server username=foo password=bar auth_url=https://[2001:db8:0:0:0:0:2:1]/auth"
+  }
+  retry_join {
+    "auto_join" = "provider=triton account=testaccount url=https://[2001:db8:0:0:0:0:2:1] key_id=1234 tag_key=consul-role tag_value=server"
+  }
+  retry_join {
+    "auto_join" = "provider=packet auth_token=token project=uuid url=https://[2001:db8:0:0:0:0:2:1] address_type=public_v6"
+  }
+  retry_join {
+    "auto_join" = "provider=vsphere category_name=consul-role tag_name=consul-server host=https://[2001:db8:0:0:0:0:2:1] user=foo password=bar insecure_ssl=false"
+  }
+  retry_join {
+    "auto_join" = "provider=k8s namespace=vault label_selector=\"app.kubernetes.io/name=vault, component=server\""
+  }
+  retry_join {
+    "auto_join" = "provider=k8s namespace=vault1 label_selector=\"app.kubernetes.io/name=vault1,component=server\""
+  }
+}
+
+listener "tcp" {
+  address = "127.0.0.1:8200"
+}
+
+disable_mlock = true
diff --git a/command/server/test-fixtures/raft_retry_join_mixed.hcl b/command/server/test-fixtures/raft_retry_join_mixed.hcl
new file mode 100644
index 00000000000..540a4c732f1
--- /dev/null
+++ b/command/server/test-fixtures/raft_retry_join_mixed.hcl
@@ -0,0 +1,38 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+storage "raft" {
+  path    = "/storage/path/raft"
+  node_id = "raft1"
+  retry_join = [
+    { "leader_api_addr" = "http://127.0.0.1:8200" },
+    { "leader_api_addr" = "http://[2001:db8:0:0:0:0:2:1]:8200" }
+  ]
+  retry_join {
+    "auto_join" = "provider=mdns service=consul domain=2001:db8:0:0:0:0:2:1"
+  }
+  retry_join = [
+    { "auto_join" = "provider=os tag_key=consul tag_value=server username=foo password=bar auth_url=https://[2001:db8:0:0:0:0:2:1]/auth" }
+  ]
+  retry_join {
+    "auto_join" = "provider=triton account=testaccount url=https://[2001:db8:0:0:0:0:2:1] key_id=1234 tag_key=consul-role tag_value=server"
+  }
+  retry_join = [
+    { "auto_join" = "provider=packet auth_token=token project=uuid url=https://[2001:db8:0:0:0:0:2:1] address_type=public_v6" }
+  ]
+  retry_join {
+    "auto_join" = "provider=vsphere category_name=consul-role tag_name=consul-server host=https://[2001:db8:0:0:0:0:2:1] user=foo password=bar insecure_ssl=false"
+  }
+  retry_join = [
+    { "auto_join" = "provider=k8s namespace=vault label_selector=\"app.kubernetes.io/name=vault, component=server\"" }
+  ]
+  retry_join {
+    "auto_join" = "provider=k8s namespace=vault1 label_selector=\"app.kubernetes.io/name=vault1,component=server\""
+  }
+}
+
+listener "tcp" {
+  address = "127.0.0.1:8200"
+}
+
+disable_mlock = true
diff --git a/command/server/test-fixtures/reporting_directory.hcl b/command/server/test-fixtures/reporting_directory.hcl
new file mode 100644
index 00000000000..5045d2fb375
--- /dev/null
+++ b/command/server/test-fixtures/reporting_directory.hcl
@@ -0,0 +1,4 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+reporting_scan_directory = "/foo/bar/"
\ No newline at end of file
diff --git a/command/server/test-fixtures/telemetry/filter_default_override.hcl b/command/server/test-fixtures/telemetry/filter_default_override.hcl
index d3d540715ee..fc254734a20 100644
--- a/command/server/test-fixtures/telemetry/filter_default_override.hcl
+++ b/command/server/test-fixtures/telemetry/filter_default_override.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_mlock = true
diff --git a/command/server/test-fixtures/telemetry/rollback_mount_point.hcl b/command/server/test-fixtures/telemetry/rollback_mount_point.hcl
index 5aa5a287c8f..289945954d7 100644
--- a/command/server/test-fixtures/telemetry/rollback_mount_point.hcl
+++ b/command/server/test-fixtures/telemetry/rollback_mount_point.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_mlock = true
diff --git a/command/server/test-fixtures/telemetry/valid_prefix_filter.hcl b/command/server/test-fixtures/telemetry/valid_prefix_filter.hcl
index a40e392c092..c54cd934d51 100644
--- a/command/server/test-fixtures/telemetry/valid_prefix_filter.hcl
+++ b/command/server/test-fixtures/telemetry/valid_prefix_filter.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_mlock = true
diff --git a/command/server/test-fixtures/tls_config_ok.hcl b/command/server/test-fixtures/tls_config_ok.hcl
index 02a2733d413..4abee629eff 100644
--- a/command/server/test-fixtures/tls_config_ok.hcl
+++ b/command/server/test-fixtures/tls_config_ok.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 disable_cache = true
@@ -8,8 +8,8 @@ ui = true
 
 listener "tcp" {
     address = "127.0.0.1:1025"
-    tls_cert_file = "./../api/test-fixtures/keys/cert.pem"
-    tls_key_file = "./../api/test-fixtures/keys/key.pem"
+    tls_cert_file = "{REPLACE_LEAF_CERT_FILE}"
+    tls_key_file = "{REPLACE_LEAF_KEY_FILE}"
 }
 
 backend "consul" {
diff --git a/command/server/test-fixtures/unauth_in_flight_access.hcl b/command/server/test-fixtures/unauth_in_flight_access.hcl
index bb04d3d29ec..77dc3386b56 100644
--- a/command/server/test-fixtures/unauth_in_flight_access.hcl
+++ b/command/server/test-fixtures/unauth_in_flight_access.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 storage "inmem" {}
diff --git a/command/server/tls_util.go b/command/server/tls_util.go
index cd07dde9275..be80d71e378 100644
--- a/command/server/tls_util.go
+++ b/command/server/tls_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
diff --git a/command/server/tls_util_test.go b/command/server/tls_util_test.go
index acb010d4109..bc67579931d 100644
--- a/command/server/tls_util_test.go
+++ b/command/server/tls_util_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package server
diff --git a/command/server_noprofile.go b/command/server_noprofile.go
index 07a9a3902e2..687e7c90419 100644
--- a/command/server_noprofile.go
+++ b/command/server_noprofile.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !memprofiler
diff --git a/command/server_profile.go b/command/server_profile.go
index fe5cbf7087d..4d963be9d1e 100644
--- a/command/server_profile.go
+++ b/command/server_profile.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build memprofiler
diff --git a/command/server_test.go b/command/server_test.go
index 160fdc8a345..9c2f1eb42c5 100644
--- a/command/server_test.go
+++ b/command/server_test.go
@@ -1,7 +1,7 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
-//go:build !race && !hsm && !fips_140_3
+//go:build !race && !hsm
 
 // NOTE: we can't use this with HSM. We can't set testing mode on and it's not
 // safe to use env vars since that provides an attack vector in the real world.
@@ -17,6 +17,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
+	"regexp"
 	"strings"
 	"sync"
 	"testing"
@@ -32,16 +33,20 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func init() {
-	if signed := os.Getenv("VAULT_LICENSE_CI"); signed != "" {
-		os.Setenv(EnvVaultLicense, signed)
+// Modifier is a function that modifies a string
+type Modifier func(string) string
+
+// regexReplacer returns a Modifier that replaces all occurrences of re with repl
+func regexReplacer(re, repl string) Modifier {
+	return func(s string) string {
+		return regexp.MustCompile(re).ReplaceAllString(s, repl)
 	}
 }
 
-func testBaseHCL(tb testing.TB, listenerExtras string) string {
+func testBaseHCL(tb testing.TB, listenerExtras string, modifiers ...Modifier) string {
 	tb.Helper()
 
-	return strings.TrimSpace(fmt.Sprintf(`
+	base := strings.TrimSpace(fmt.Sprintf(`
 		disable_mlock = true
 		listener "tcp" {
 			address     = "127.0.0.1:%d"
@@ -49,6 +54,11 @@ func testBaseHCL(tb testing.TB, listenerExtras string) string {
 			%s
 		}
 	`, 0, listenerExtras))
+
+	for _, mod := range modifiers {
+		base = mod(base)
+	}
+	return base
 }
 
 const (
@@ -62,6 +72,12 @@ const (
 	badListenerWriteTimeout      = `http_write_timeout = "56lbs"`
 	badListenerIdleTimeout       = `http_idle_timeout = "78gophers"`
 
+	raftHCL = `
+storage "raft" {
+  path = "/path/to/raft/data"
+  node_id = "raft_node_1"
+}
+	`
 	inmemHCL = `
 backend "inmem_ha" {
   advertise_addr       = "http://127.0.0.1:8200"
@@ -72,7 +88,6 @@ ha_backend "inmem_ha" {
   redirect_addr        = "http://127.0.0.1:8200"
 }
 `
-
 	badHAInmemHCL = `
 ha_backend "inmem" {}
 `
@@ -275,6 +290,13 @@ func TestServer(t *testing.T) {
 			0,
 			[]string{"-test-verify-only", "-recovery"},
 		},
+		{
+			"missing_disable_mlock_value_with_integrated_storage",
+			testBaseHCL(t, goodListenerTimeouts, regexReplacer(`\s*disable_mlock\s*=\s*.+`, "")) + raftHCL,
+			"disable_mlock must be configured",
+			1,
+			[]string{"-test-server-config"},
+		},
 	}
 
 	for _, tc := range cases {
@@ -412,14 +434,14 @@ func TestReloadSeals(t *testing.T) {
 	_, testCommand := testServerCommand(t)
 	testConfig := server.Config{SharedConfig: &configutil.SharedConfig{}}
 
-	_, err := testCommand.reloadSeals(context.Background(), testCore, &testConfig)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
+	testCommand.logger = corehelpers.NewTestLogger(t)
+	ctx := context.Background()
+	reloaded, err := testCommand.reloadSealsOnSigHup(ctx, testCore, &testConfig)
+	require.NoError(t, err)
+	require.False(t, reloaded, "reloadSeals does not support Shamir seals")
 
 	testConfig = server.Config{SharedConfig: &configutil.SharedConfig{Seals: []*configutil.KMS{{Disabled: true}}}}
-	_, err = testCommand.reloadSeals(context.Background(), testCore, &testConfig)
-	if err == nil {
-		t.Fatal("expected error, got nil")
-	}
+	reloaded, err = testCommand.reloadSealsOnSigHup(ctx, testCore, &testConfig)
+	require.NoError(t, err)
+	require.False(t, reloaded, "reloadSeals does not support Shamir seals")
 }
diff --git a/command/server_util.go b/command/server_util.go
index 667b958595d..658b4ac38d6 100644
--- a/command/server_util.go
+++ b/command/server_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -24,6 +24,10 @@ func (c *ServerCommand) ReloadedCh() chan struct{} {
 	return c.reloadedCh
 }
 
+func (c *ServerCommand) LicenseReloadedCh() chan error {
+	return c.licenseReloadedCh
+}
+
 func testServerCommand(tb testing.TB) (*cli.MockUi, *ServerCommand) {
 	tb.Helper()
 
@@ -36,13 +40,14 @@ func testServerCommand(tb testing.TB) (*cli.MockUi, *ServerCommand) {
 		SighupCh:   MakeSighupCh(),
 		SigUSR2Ch:  MakeSigUSR2Ch(),
 		PhysicalBackends: map[string]physical.Factory{
-			"inmem":    physInmem.NewInmem,
-			"inmem_ha": physInmem.NewInmemHA,
+			"inmem":               physInmem.NewInmem,
+			"inmem_ha":            physInmem.NewInmemHA,
+			"inmem_transactional": physInmem.NewTransactionalInmem,
 		},
 
 		// These prevent us from random sleep guessing...
 		startedCh:         make(chan struct{}, 5),
 		reloadedCh:        make(chan struct{}, 5),
-		licenseReloadedCh: make(chan error),
+		licenseReloadedCh: make(chan error, 1),
 	}
 }
diff --git a/command/ssh.go b/command/ssh.go
index cd39ad45782..a39c5e2d358 100644
--- a/command/ssh.go
+++ b/command/ssh.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/ssh_test.go b/command/ssh_test.go
index b6dfd563d24..2dd2ab5c2be 100644
--- a/command/ssh_test.go
+++ b/command/ssh_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/status.go b/command/status.go
index 9f7c7010f86..8a34b546601 100644
--- a/command/status.go
+++ b/command/status.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/status_test.go b/command/status_test.go
index 47a2803d66c..0d8a44729cf 100644
--- a/command/status_test.go
+++ b/command/status_test.go
@@ -1,13 +1,18 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
 
 import (
+	"errors"
+	"fmt"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/hashicorp/cli"
+	"github.com/hashicorp/vault/helper/testhelpers"
+	"github.com/stretchr/testify/require"
 )
 
 func testStatusCommand(tb testing.TB) (*cli.MockUi, *StatusCommand) {
@@ -21,6 +26,41 @@ func testStatusCommand(tb testing.TB) (*cli.MockUi, *StatusCommand) {
 	}
 }
 
+// TestStatusCommand_RaftCluster creates a raft cluster and verifies that a
+// follower has "Removed From Cluster" returned as false in the status command.
+// The test then removes that follower, and checks that "Removed From Cluster"
+// is now true
+func TestStatusCommand_RaftCluster(t *testing.T) {
+	t.Parallel()
+	cluster := testVaultRaftCluster(t)
+	defer cluster.Cleanup()
+
+	toRemove := cluster.Cores[1]
+	expectRemovedFromCluster := func(expectCode int, removed bool) {
+		ui, cmd := testStatusCommand(t)
+		cmd.client = toRemove.Client
+		code := cmd.Run(nil)
+		require.Equal(t, expectCode, code)
+		combined := ui.OutputWriter.String() + ui.ErrorWriter.String()
+		require.Regexp(t, fmt.Sprintf(".*Removed From Cluster\\s+%t.*", removed), combined)
+	}
+
+	expectRemovedFromCluster(0, false)
+
+	_, err := cluster.Cores[0].Client.Logical().Write("sys/storage/raft/remove-peer",
+		map[string]interface{}{
+			"server_id": toRemove.NodeID,
+		})
+	require.NoError(t, err)
+	testhelpers.RetryUntil(t, 10*time.Second, func() error {
+		if !toRemove.Sealed() {
+			return errors.New("core not sealed")
+		}
+		return nil
+	})
+	expectRemovedFromCluster(2, true)
+}
+
 func TestStatusCommand_Run(t *testing.T) {
 	t.Parallel()
 
diff --git a/command/test-backend/main.go b/command/test-backend/main.go
index 69a6fcd0aa5..1f1b5256086 100644
--- a/command/test-backend/main.go
+++ b/command/test-backend/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package test_backend
diff --git a/command/test-fixtures/config.hcl b/command/test-fixtures/config.hcl
index 9161fff4520..e5903be2026 100644
--- a/command/test-fixtures/config.hcl
+++ b/command/test-fixtures/config.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
-
+disable_mlock = true
 token_helper = "foo"
diff --git a/command/test-fixtures/policy.hcl b/command/test-fixtures/policy.hcl
index 6160bf78027..18a466caad7 100644
--- a/command/test-fixtures/policy.hcl
+++ b/command/test-fixtures/policy.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 path "secret/foo" {
diff --git a/command/token.go b/command/token.go
index eb430b48daa..0f585c3080c 100644
--- a/command/token.go
+++ b/command/token.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/token/helper_testing.go b/command/token/helper_testing.go
index e948092f450..a227a8dc052 100644
--- a/command/token/helper_testing.go
+++ b/command/token/helper_testing.go
@@ -1,13 +1,15 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package token
 
 import (
 	"sync"
+
+	"github.com/hashicorp/vault/api/tokenhelper"
 )
 
-var _ TokenHelper = (*TestingTokenHelper)(nil)
+var _ tokenhelper.TokenHelper = (*TestingTokenHelper)(nil)
 
 // TestingTokenHelper implements token.TokenHelper which runs entirely
 // in-memory. This should not be used outside of testing.
diff --git a/command/token/testing.go b/command/token/testing.go
deleted file mode 100644
index 24dc3258e51..00000000000
--- a/command/token/testing.go
+++ /dev/null
@@ -1,81 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package token
-
-import (
-	"fmt"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/hashicorp/cli"
-)
-
-// Test is a public function that can be used in other tests to
-// test that a helper is functioning properly.
-func Test(t *testing.T, h TokenHelper) {
-	if err := h.Store("foo"); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	v, err := h.Get()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if v != "foo" {
-		t.Fatalf("bad: %#v", v)
-	}
-
-	if err := h.Erase(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	v, err = h.Get()
-	if err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	if v != "" {
-		t.Fatalf("bad: %#v", v)
-	}
-}
-
-// TestProcess is used to re-execute this test in order to use it as the
-// helper process. For this to work, the TestExternalTokenHelperProcess function must
-// exist.
-func TestProcess(t *testing.T, s ...string) {
-	h := &ExternalTokenHelper{BinaryPath: TestProcessPath(t, s...)}
-	Test(t, h)
-}
-
-// TestProcessPath returns the path to the test process.
-func TestProcessPath(t *testing.T, s ...string) string {
-	cs := []string{"-test.run=TestExternalTokenHelperProcess", "--", "GO_WANT_HELPER_PROCESS"}
-	cs = append(cs, s...)
-	return fmt.Sprintf(
-		"%s %s",
-		os.Args[0],
-		strings.Join(cs, " "))
-}
-
-// TestExternalTokenHelperProcessCLI can be called to implement TestExternalTokenHelperProcess
-// for TestProcess that just executes a CLI command.
-func TestExternalTokenHelperProcessCLI(t *testing.T, cmd cli.Command) {
-	args := os.Args
-	for len(args) > 0 {
-		if args[0] == "--" {
-			args = args[1:]
-			break
-		}
-
-		args = args[1:]
-	}
-	if len(args) == 0 || args[0] != "GO_WANT_HELPER_PROCESS" {
-		return
-	}
-	args = args[1:]
-
-	os.Exit(cmd.Run(args))
-}
diff --git a/command/token_capabilities.go b/command/token_capabilities.go
index 239793658ba..3a9af5eb3f2 100644
--- a/command/token_capabilities.go
+++ b/command/token_capabilities.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/token_capabilities_test.go b/command/token_capabilities_test.go
index 1588b14a330..e71b10bf0d4 100644
--- a/command/token_capabilities_test.go
+++ b/command/token_capabilities_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/token_create.go b/command/token_create.go
index 3e49bb2ca72..4daff22cec2 100644
--- a/command/token_create.go
+++ b/command/token_create.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/token_create_test.go b/command/token_create_test.go
index 3acd2dd1474..0ee9c544a7e 100644
--- a/command/token_create_test.go
+++ b/command/token_create_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/token_lookup.go b/command/token_lookup.go
index afb622372b1..d9ff9b9cb4d 100644
--- a/command/token_lookup.go
+++ b/command/token_lookup.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/token_lookup_test.go b/command/token_lookup_test.go
index 6a351f781c5..9a548e77bc0 100644
--- a/command/token_lookup_test.go
+++ b/command/token_lookup_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/token_renew.go b/command/token_renew.go
index c354b4e6a50..e1ccbf11bc1 100644
--- a/command/token_renew.go
+++ b/command/token_renew.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -21,8 +21,9 @@ var (
 type TokenRenewCommand struct {
 	*BaseCommand
 
-	flagAccessor  bool
-	flagIncrement time.Duration
+	flagAccessor           bool
+	flagIncrement          time.Duration
+	flagFailIfNotFulfilled bool
 }
 
 func (c *TokenRenewCommand) Synopsis() string {
@@ -86,6 +87,15 @@ func (c *TokenRenewCommand) Flags() *FlagSets {
 			"numeric string with suffix like \"30s\" or \"5m\".",
 	})
 
+	f.BoolVar(&BoolVar{
+		Name:       "fail-if-not-fulfilled",
+		Target:     &c.flagFailIfNotFulfilled,
+		Default:    false,
+		EnvVar:     "",
+		Completion: complete.PredictNothing,
+		Usage:      "Fail if the requested TTL increment cannot be fully fulfilled.",
+	})
+
 	return set
 }
 
@@ -140,5 +150,10 @@ func (c *TokenRenewCommand) Run(args []string) int {
 		return 2
 	}
 
+	if c.flagFailIfNotFulfilled && secret.Auth.LeaseDuration < int(increment.Seconds()) {
+		c.UI.Info("Token renewal completed with capped duration, failing the command because of --fail-if-not-fulfilled")
+		return 1
+	}
+
 	return OutputSecret(c.UI, secret)
 }
diff --git a/command/token_renew_test.go b/command/token_renew_test.go
index 4fc469995b0..c0850bf7495 100644
--- a/command/token_renew_test.go
+++ b/command/token_renew_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -56,6 +56,18 @@ func TestTokenRenewCommand_Run(t *testing.T) {
 			"",
 			0,
 		},
+		{
+			"fail_if_not_fulfilled_exceeds_max_ttl",
+			[]string{"-increment", "33d", "--fail-if-not-fulfilled"},
+			"Token renewal completed with capped duration, failing the command because of --fail-if-not-fulfilled",
+			1,
+		},
+		{
+			"fail_if_not_fulfilled_within_max_ttl",
+			[]string{"-increment", "30m", "--fail-if-not-fulfilled"},
+			"",
+			0,
+		},
 	}
 
 	t.Run("validations", func(t *testing.T) {
diff --git a/command/token_revoke.go b/command/token_revoke.go
index c9f6a2b7f22..e764a15b600 100644
--- a/command/token_revoke.go
+++ b/command/token_revoke.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/token_revoke_test.go b/command/token_revoke_test.go
index 3cdf13d615e..3c039aa4773 100644
--- a/command/token_revoke_test.go
+++ b/command/token_revoke_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/transform.go b/command/transform.go
index 46129cd32e2..417afe094ff 100644
--- a/command/transform.go
+++ b/command/transform.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/transform_import_key.go b/command/transform_import_key.go
index d01100acea0..69677c545dc 100644
--- a/command/transform_import_key.go
+++ b/command/transform_import_key.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/transform_import_key_version.go b/command/transform_import_key_version.go
index 61a6db45b67..b1262f0bb03 100644
--- a/command/transform_import_key_version.go
+++ b/command/transform_import_key_version.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/transit.go b/command/transit.go
index 9b988d7e3c7..655be3b6e2a 100644
--- a/command/transit.go
+++ b/command/transit.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/transit_import_key.go b/command/transit_import_key.go
index 0c77f066744..7bd4baa2aea 100644
--- a/command/transit_import_key.go
+++ b/command/transit_import_key.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -16,10 +16,10 @@ import (
 	"regexp"
 	"strings"
 
-	"github.com/google/tink/go/kwp/subtle"
 	"github.com/hashicorp/cli"
 	"github.com/hashicorp/vault/api"
 	"github.com/posener/complete"
+	"github.com/tink-crypto/tink-go/v2/kwp/subtle"
 )
 
 var (
diff --git a/command/transit_import_key_test.go b/command/transit_import_key_test.go
index 847ab59ff78..c335cdd6baf 100644
--- a/command/transit_import_key_test.go
+++ b/command/transit_import_key_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -7,13 +7,13 @@ import (
 	"bytes"
 	"context"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/x509"
 	"encoding/base64"
 	"testing"
 	"time"
 
 	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/stretchr/testify/require"
 )
 
@@ -171,7 +171,7 @@ func execTransitImport(t *testing.T, client *api.Client, method string, path str
 func generateKeys(t *testing.T) (rsa1 []byte, rsa2 []byte, aes128 []byte, aes256 []byte) {
 	t.Helper()
 
-	priv1, err := rsa.GenerateKey(rand.Reader, 2048)
+	priv1, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NotNil(t, priv1, "failed generating RSA 1 key")
 	require.NoError(t, err, "failed generating RSA 1 key")
 
@@ -179,7 +179,7 @@ func generateKeys(t *testing.T) (rsa1 []byte, rsa2 []byte, aes128 []byte, aes256
 	require.NotNil(t, rsa1, "failed marshaling RSA 1 key")
 	require.NoError(t, err, "failed marshaling RSA 1 key")
 
-	priv2, err := rsa.GenerateKey(rand.Reader, 2048)
+	priv2, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	require.NotNil(t, priv2, "failed generating RSA 2 key")
 	require.NoError(t, err, "failed generating RSA 2 key")
 
diff --git a/command/transit_import_key_version.go b/command/transit_import_key_version.go
index cf248554f77..0ed06425ed4 100644
--- a/command/transit_import_key_version.go
+++ b/command/transit_import_key_version.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/unwrap.go b/command/unwrap.go
index a671071c15a..a5fad8c2d88 100644
--- a/command/unwrap.go
+++ b/command/unwrap.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/unwrap_test.go b/command/unwrap_test.go
index 518d32fb12d..d33d62c83cc 100644
--- a/command/unwrap_test.go
+++ b/command/unwrap_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/util.go b/command/util.go
index 717191025d2..24abdbba264 100644
--- a/command/util.go
+++ b/command/util.go
@@ -1,13 +1,16 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
 
 import (
+	"bytes"
 	"fmt"
 	"io"
 	"net/http"
 	"os"
+	"path/filepath"
+	"runtime/pprof"
 	"testing"
 	"time"
 
@@ -15,16 +18,8 @@ import (
 	"github.com/hashicorp/cli"
 	"github.com/hashicorp/go-cleanhttp"
 	"github.com/hashicorp/vault/api"
-	"github.com/hashicorp/vault/command/config"
-	"github.com/hashicorp/vault/command/token"
 )
 
-// DefaultTokenHelper returns the token helper that is configured for Vault.
-// This helper should only be used for non-server CLI commands.
-func DefaultTokenHelper() (token.TokenHelper, error) {
-	return config.DefaultTokenHelper()
-}
-
 // RawField extracts the raw field from the given data and returns it as a
 // string for printing purposes.
 func RawField(secret *api.Secret, field string) interface{} {
@@ -199,5 +194,43 @@ func (r *recordingRoundTripper) RoundTrip(req *http.Request) (*http.Response, er
 	r.body = body
 	return &http.Response{
 		StatusCode: 200,
+		Body:       io.NopCloser(bytes.NewReader([]byte(`{"warnings": []}`))),
 	}, nil
 }
+
+// WritePprofToFile will create a temporary directory at the specified path
+// and generate pprof files at that location. CPU requires polling over a
+// duration. For most situations 1 second is enough.
+func WritePprofToFile(path string, cpuProfileDuration time.Duration) error {
+	err := os.MkdirAll(path, os.ModePerm)
+	if err != nil {
+		return fmt.Errorf("could not create temporary directory for pprof: %v", err)
+	}
+
+	dumps := []string{"goroutine", "heap", "allocs", "threadcreate", "profile"}
+	for _, dump := range dumps {
+		pFile, err := os.Create(filepath.Join(path, dump))
+		if err != nil {
+			return fmt.Errorf("error creating pprof file %s: %v", dump, err)
+		}
+
+		if dump != "profile" {
+			err = pprof.Lookup(dump).WriteTo(pFile, 0)
+			if err != nil {
+				pFile.Close()
+				return fmt.Errorf("error generating pprof data for %s: %v", dump, err)
+			}
+		} else {
+			// CPU profiles need to run for a duration so we're going to run it
+			// just for one second to avoid blocking here.
+			if err := pprof.StartCPUProfile(pFile); err != nil {
+				pFile.Close()
+				return fmt.Errorf("could not start CPU profile: %v", err)
+			}
+			time.Sleep(cpuProfileDuration)
+			pprof.StopCPUProfile()
+		}
+		pFile.Close()
+	}
+	return nil
+}
diff --git a/command/version.go b/command/version.go
index 8b54511c099..5b064e0445e 100644
--- a/command/version.go
+++ b/command/version.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/version_history.go b/command/version_history.go
index 7326bffdedd..6400a0a6254 100644
--- a/command/version_history.go
+++ b/command/version_history.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/version_history_test.go b/command/version_history_test.go
index 8d2e1844510..22657880b45 100644
--- a/command/version_history_test.go
+++ b/command/version_history_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/version_test.go b/command/version_test.go
index abacfd3662c..67518b6c10a 100644
--- a/command/version_test.go
+++ b/command/version_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/command/write.go b/command/write.go
index 33ee3be0f24..4f06efbcb68 100644
--- a/command/write.go
+++ b/command/write.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
@@ -51,13 +51,15 @@ Usage: vault write [options] PATH [DATA K=V...]
   it is loaded from a file. If the value is "-", Vault will read the value from
   stdin.
 
-  Persist data in the generic secrets engine:
+  Store an arbitrary secret in the token's cubbyhole.
 
-      $ vault write secret/my-secret foo=bar
+      $ vault write cubbyhole/git-credentials username="student01" password="p@$$w0rd"
 
   Create a new encryption key in the transit secrets engine:
 
-      $ vault write -f transit/keys/my-key
+      $ vault write -force transit/keys/my-key
+
+  The -force / -f flag allows a write operation without any input data.
 
   Upload an AWS IAM policy from a file on disk:
 
@@ -67,6 +69,10 @@ Usage: vault write [options] PATH [DATA K=V...]
 
       $ echo $MY_TOKEN | vault write consul/config/access token=-
 
+  Create a token
+
+      $ vault write auth/token/create policies="admin" policies="secops" ttl=8h num_uses=3
+
   For a full list of examples and paths, please see the documentation that
   corresponds to the secret engines in use.
 
diff --git a/command/write_test.go b/command/write_test.go
index 2e7a32833fa..78bbc1e0cc0 100644
--- a/command/write_test.go
+++ b/command/write_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package command
diff --git a/dependencies/2-25-21/deps-upgrade-output.txt b/dependencies/2-25-21/deps-upgrade-output.txt
deleted file mode 100644
index 52eea40c58e..00000000000
--- a/dependencies/2-25-21/deps-upgrade-output.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-hridoyroy@Hridoys-MBP vault % python3 deps_upgrade.py dep.txt           
-github.com/satori/go.uuid
-golang.org/x/text
-github.com/hashicorp/go-gcp-common
-github.com/hashicorp/vault-plugin-secrets-azure
-go.mongodb.org/mongo-driver
-github.com/Microsoft/hcsshim
-package github.com/Microsoft/hcsshim
-	imports github.com/Microsoft/go-winio/pkg/guid
-	imports golang.org/x/sys/windows: build constraints exclude all Go files in /Users/hridoyroy/go/pkg/mod/golang.org/x/sys@v0.0.0-20210124154548-22da62e12c0c/windows
-golang.org/x/crypto
-github.com/containerd/containerd
-github.com/aws/aws-sdk-go
-github.com/hashicorp/serf
-github.com/miekg/dns
-github.com/hashicorp/go-discover
-github.com/hashicorp/serf
\ No newline at end of file
diff --git a/dependencies/2-25-21/deps-upgrade.txt b/dependencies/2-25-21/deps-upgrade.txt
deleted file mode 100644
index 64c7dae59c4..00000000000
--- a/dependencies/2-25-21/deps-upgrade.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-golang.org/x/text
-github.com/hashicorp/go-gcp-common
-github.com/hashicorp/vault-plugin-secrets-azure
-go.mongodb.org/mongo-driver
-github.com/Microsoft/hcsshim
-golang.org/x/crypto
-github.com/containerd/containerd
-github.com/aws/aws-sdk-go
-github.com/hashicorp/serf
-github.com/miekg/dns
-github.com/hashicorp/go-discover
-github.com/hashicorp/serf
\ No newline at end of file
diff --git a/enos/Makefile b/enos/Makefile
index d1f933453d5..24c66eb3b9d 100644
--- a/enos/Makefile
+++ b/enos/Makefile
@@ -1,19 +1,27 @@
+VAULT_VERSION=$$(cat $(CURDIR)/../version/VERSION)
+
 .PHONY: default
 default: check-fmt shellcheck
 
 .PHONY: check-fmt
-check-fmt: check-fmt-enos check-fmt-modules
+check-fmt: check-fmt-enos check-fmt-modules check-shfmt
 
 .PHONY: fmt
-fmt: fmt-enos fmt-modules
+fmt: fmt-enos fmt-modules shfmt
 
 .PHONY: check-fmt-enos
 check-fmt-enos:
 	enos fmt --check --diff .
+	enos fmt --check --diff ./k8s
 
 .PHONY: fmt-enos
 fmt-enos:
 	enos fmt .
+	enos fmt ./k8s
+
+.PHONY: gen-enos
+gen-enos:
+	pushd ../tools/pipeline &> /dev/null && go run ./... generate enos-dynamic-config -d ../../enos -f enos-dynamic-config.hcl -e ce -v $(VAULT_VERSION) -n 3 --log info && popd &> /dev/null
 
 .PHONY: check-fmt-modules
 check-fmt-modules:
@@ -25,11 +33,20 @@ fmt-modules:
 
 .PHONY: validate-enos
 validate-enos:
+	enos scenario validate --timeout 30m0s --chdir ./k8s
 	enos scenario validate --timeout 30m0s
 
 .PHONY: lint
-lint: check-fmt shellcheck validate-enos
+lint: check-fmt check-fmt-modules check-shfmt shellcheck validate-enos
 
 .PHONY: shellcheck
 shellcheck:
 	find ./modules/ -type f -name '*.sh' | xargs shellcheck
+
+.PHONY: shfmt
+shfmt:
+	find ./modules/ -type f -name '*.sh' | xargs shfmt -l -w -i 2 -bn -ci -kp -sr
+
+.PHONY: check-shfmt
+check-shfmt:
+	find ./modules/ -type f -name '*.sh' | xargs shfmt -l -d -i 2 -bn -ci -kp -sr
diff --git a/enos/README.md b/enos/README.md
index a33f4abe1b9..02547cd88d6 100644
--- a/enos/README.md
+++ b/enos/README.md
@@ -18,34 +18,35 @@ is going to give you faster feedback and execution time, whereas Enos is going
 to give you a real-world execution and validation of the requirement. Consider
 the following cases as examples of when one might opt for an Enos scenario:
 
-* The feature require third-party integrations. Whether that be networked
+- The feature require third-party integrations. Whether that be networked
   dependencies like a real Consul backend, a real KMS key to test awskms
   auto-unseal, auto-join discovery using AWS tags, or Cloud hardware KMS's.
-* The feature might behave differently under multiple configuration variants
+- The feature might behave differently under multiple configuration variants
   and therefore should be tested with both combinations, e.g. auto-unseal and
   manual shamir unseal or replication in HA mode with integrated storage or
   Consul storage.
-* The scenario requires coordination between multiple targets. For example,
+- The scenario requires coordination between multiple targets. For example,
   consider the complex lifecycle event of migrating the seal type or storage,
   or manually triggering a raft disaster scenario by partitioning the network
   between the leader and follower nodes. Or perhaps an auto-pilot upgrade between
   a stable version of Vault and our candidate version.
-* The scenario has specific deployment strategy requirements. For example,
+- The scenario has specific deployment strategy requirements. For example,
   if we want to add a regression test for an issue that only arises when the
   software is deployed in a certain manner.
-* The scenario needs to use actual build artifacts that will be promoted
+- The scenario needs to use actual build artifacts that will be promoted
   through the pipeline.
 
 ## Requirements
-* AWS access. HashiCorp Vault developers should use Doormat.
-* Terraform >= 1.2
-* Enos >= v0.0.10. You can [install it from a release channel](https://github.com/hashicorp/Enos-Docs/blob/main/installation.md).
-* Access to the QTI org in Terraform Cloud. HashiCorp Vault developers can
-  access a shared token in 1Password or request their own in #team-quality on
-  Slack.
-* An SSH keypair in the AWS region you wish to run the scenario. You can use
+- AWS access. HashiCorp Vault developers should use Doormat.
+- Terraform >= 1.7
+- Enos >= v0.0.28. You can [download a release](https://github.com/hashicorp/enos/releases/) or
+  install it with Homebrew:
+  ```shell
+  brew tap hashicorp/tap && brew update && brew install hashicorp/tap/enos
+  ```
+- An SSH keypair in the AWS region you wish to run the scenario. You can use
   Doormat to log in to the AWS console to create or upload an existing keypair.
-* A Vault artifact is downloaded from the GHA artifacts when using the `artifact_source:crt` variants, from Artifactory when using `artifact_source:artifactory`, and is built locally from the current branch when using  `artifact_source:local` variant.
+- A Vault artifact is downloaded from the GHA artifacts when using the `artifact_source:crt` variants, from Artifactory when using `artifact_source:artifactory`, and is built locally from the current branch when using  `artifact_source:local` variant.
 
 ## Scenario Variables
 In CI, each scenario is executed via Github Actions and has been configured using
@@ -57,13 +58,33 @@ variables, or you can update `enos.vars.hcl` with values and uncomment the lines
 Variables that are required:
 * `aws_ssh_keypair_name`
 * `aws_ssh_private_key_path`
-* `tfc_api_token`
 * `vault_bundle_path`
 * `vault_license_path` (only required for non-OSS editions)
 
 See [enos.vars.hcl](./enos.vars.hcl) or [enos-variables.hcl](./enos-variables.hcl)
 for further descriptions of the variables.
 
+Additional variable information can also be found in the [Scenario Outlines](#scenario_outlines)
+
+## Scenario Outlines
+Enos is capable of producing an outline of each scenario that is defined in a given directory. These
+scenarios often include a description of what behavior the scenario performs, which variants are
+available, and which variables are required. They also provide a step by step breakdown including
+which quality requirments are verifiend by a given step.
+
+You can generate outlines of all scenarios or specify one via it's name.
+
+From the `enos` directory:
+```bash
+enos scenario outline smoke
+```
+
+There are also HTML versions available for an improved reading experience:
+```bash
+enos scenario outline --format html > index.html
+open index.html
+```
+
 ## Executing Scenarios
 From the `enos` directory:
 
@@ -96,45 +117,6 @@ enos scenario destroy smoke artifact_source:local
 Refer to the [Enos documentation](https://github.com/hashicorp/Enos-Docs)
 for further information regarding installation, execution or composing scenarios.
 
-# Scenarios
-There are current two scenarios: `smoke` and `upgrade`. Both begin by building Vault
-as specified by the selected `artifact_source` variant (see Variants section below for more
-information).
-
-## Smoke
-The [`smoke` scenario](./enos-scenario-smoke.hcl) creates a Vault cluster using
-the version from the current branch (either in CI or locally), with the backend
-specified by the `backend` variant (`raft` or `consul`). Next, it unseals with the
-appropriate method (`awskms` or `shamir`) and performs different verifications
-depending on the backend and seal type.
-
-## Upgrade
-The [`upgrade` scenario](./enos-scenario-upgrade.hcl) creates a Vault cluster using
-the version specified in `vault_upgrade_initial_release`, with the backend specified
-by the `backend` variant (`raft` or `consul`). Next, it upgrades the Vault binary
-that is determined by the `artifact_source` variant. After the upgrade, it verifies that
-cluster is at the desired version, along with additional verifications.
-
-
-## Autopilot
-The [`autopilot` scenario](./enos-scenario-autopilot.hcl) creates a Vault cluster using
-the version specified in `vault_upgrade_initial_release`. It writes test data to the Vault cluster. Next, it creates additional nodes with the candidate version of Vault as determined by the `vault_product_version` variable set.
-The module uses AWS auto-join to handle discovery and unseals with auto-unseal
-or Shamir depending on the `seal` variant. After the new nodes have joined and been
-unsealed, it verifies reading stored data on the new nodes. Autopilot upgrade verification checks the upgrade status is "await-server-removal" and the target version is set to the version of upgraded nodes. This test also verifies the undo_logs status for Vault versions 1.13.x
-
-## Replication
-The [`replication` scenario](./enos-scenario-replication.hcl) creates two 3-node Vault clusters and runs following verification steps:
-
- 1. Writes data on the primary cluster
- 1. Enables performance replication
- 1. Verifies reading stored data from secondary cluster
- 1. Verifies initial replication status between both clusters
- 1. Replaces the leader node and one standby node on the primary Vault cluster
- 1. Verifies updated replication status between both clusters
-
- This scenario verifies the performance replication status on both clusters to have their connection_status as "connected" and that the secondary cluster has known_primaries cluster addresses updated to the active nodes IP addresses of the primary Vault cluster. This scenario currently works around issues VAULT-12311 and VAULT-12309.  The scenario fails when the primary storage backend is Consul due to issue VAULT-12332
-
 ## UI Tests
 The [`ui` scenario](./enos-scenario-ui.hcl) creates a Vault cluster (deployed to AWS) using a version 
 built from the current checkout of the project. Once the cluster is available the UI acceptance tests
@@ -202,11 +184,9 @@ unzipped Vault binary at the `vault_local_binary_path`.
 
 ## `artifact_source:artifactory`
 This variant is for running the Enos scenario to test an artifact from Artifactory. It requires following Enos variables to be set:
-* `artifactory_username`
 * `artifactory_token`
 * `aws_ssh_keypair_name`
 * `aws_ssh_private_key_path`
-* `tfc_api_token`
 * `vault_product_version`
 * `vault_revision`
 
@@ -234,7 +214,6 @@ and destroyed each time a scenario is run, the Terraform state will be managed b
 Here are the steps to configure the GitHub Actions service user:
 
 #### Pre-requisites
-- Access to the `hashicorp-qti` organization in Terraform Cloud.
 - Full access to the CI AWS account is required.
 
 **Notes:**
@@ -247,15 +226,15 @@ Here are the steps to configure the GitHub Actions service user:
   - Access can be requested by clicking: `Cloud Access` --> `AWS` --> `Request Account Access`.
 
 1. **Create the Terraform Cloud Workspace** - The name of the workspace to be created depends on the 
-   repository for which it is being created, but the pattern is: `<repository>-ci-service-user-iam`,
-   e.g. `vault-ci-service-user-iam`. It is important that the execution mode for the workspace be set 
+   repository for which it is being created, but the pattern is: `<repository>-ci-enos-service-user-iam`,
+   e.g. `vault-ci-enos-service-user-iam`. It is important that the execution mode for the workspace be set 
    to `local`. For help on setting up the workspace, contact the QT team on Slack (#team-quality)
 
 
 2. **Execute the Terraform module**
 ```shell
 > cd ./enos/ci/service-user-iam
-> export TF_WORKSPACE=<repo name>-ci-service-user-iam
+> export TF_WORKSPACE=<repo name>-ci-enos-service-user-iam
 > export TF_TOKEN_app_terraform_io=<Terraform Cloud Token>
 > export TF_VAR_repository=<repository name>
 > terraform init
diff --git a/enos/ci/aws-nuke.yml b/enos/ci/aws-nuke.yml
index c8e4204465f..32f8ef8a5fb 100644
--- a/enos/ci/aws-nuke.yml
+++ b/enos/ci/aws-nuke.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 regions:
@@ -21,7 +21,7 @@ regions:
 - us-west-2
 - global
 
-account-blocklist:
+blocklist:
  - 1234567890
 
 accounts:
@@ -55,6 +55,7 @@ presets:
       EC2InternetGatewayAttachment:
         - property: DefaultVPC
           value: "true"
+
   olderthan:
     # Filters resources by age (when available)
     # TIME_LIMIT replaced in CI
@@ -91,12 +92,21 @@ presets:
       IAMRole:
         - property: tag:hc-config-as-code
           value: "honeybee"
+        - property: Name
+          type: glob
+          value: "vault-assumed-role-credentials-demo"
       IAMRolePolicy:
         - property: tag:role:hc-config-as-code
           value: "honeybee"
+        - property: role:RoleName
+          type: glob
+          value: "vault-assumed-role-credentials-demo"
       IAMRolePolicyAttachment:
         - property: tag:role:hc-config-as-code
           value: "honeybee"
+        - property: Name
+          type: glob
+          value: "vault-assumed-role-credentials-demo"
 
   enos:
     # Existing CI to be cleaned up later
@@ -396,3 +406,4 @@ resource-types:
     - WorkSpacesWorkspace
     - XRayGroup
     - XRaySamplingRule
+
diff --git a/enos/ci/bootstrap/main.tf b/enos/ci/bootstrap/main.tf
index db89663153e..4bb0ba017ec 100644
--- a/enos/ci/bootstrap/main.tf
+++ b/enos/ci/bootstrap/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
diff --git a/enos/ci/bootstrap/outputs.tf b/enos/ci/bootstrap/outputs.tf
index a83ef9eb080..4a518ea279d 100644
--- a/enos/ci/bootstrap/outputs.tf
+++ b/enos/ci/bootstrap/outputs.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 output "keys" {
diff --git a/enos/ci/bootstrap/variables.tf b/enos/ci/bootstrap/variables.tf
index 7e80d5ccc91..cd875354060 100644
--- a/enos/ci/bootstrap/variables.tf
+++ b/enos/ci/bootstrap/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "aws_ssh_public_key" {
diff --git a/enos/ci/service-user-iam/main.tf b/enos/ci/service-user-iam/main.tf
index 0df9bcafca7..888432be05e 100644
--- a/enos/ci/service-user-iam/main.tf
+++ b/enos/ci/service-user-iam/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -70,13 +70,16 @@ data "aws_iam_policy_document" "aws_nuke" {
       "iam:DeleteAccessKey",
       "iam:DeleteUser",
       "iam:DeleteUserPolicy",
+      "iam:DetachUserPolicy",
       "iam:GetUser",
       "iam:ListAccessKeys",
       "iam:ListAccountAliases",
       "iam:ListGroupsForUser",
+      "iam:ListSSHPublicKeys",
       "iam:ListUserPolicies",
       "iam:ListUserTags",
       "iam:ListUsers",
+      "iam:ListVirtualMFADevices",
       "iam:UntagUser",
       "servicequotas:ListServiceQuotas"
     ]
@@ -97,6 +100,8 @@ data "aws_iam_policy_document" "enos_scenario" {
       "ec2:AuthorizeSecurityGroupIngress",
       "ec2:CancelSpotFleetRequests",
       "ec2:CancelSpotInstanceRequests",
+      "iam:CreateAccessKey",
+      "ec2:CreateEgressOnlyInternetGateway",
       "ec2:CreateInternetGateway",
       "ec2:CreateKeyPair",
       "ec2:CreateFleet",
@@ -110,6 +115,7 @@ data "aws_iam_policy_document" "enos_scenario" {
       "ec2:CreateTags",
       "ec2:CreateVolume",
       "ec2:CreateVPC",
+      "ec2:DeleteEgressOnlyInternetGateway",
       "ec2:DeleteFleets",
       "ec2:DeleteInternetGateway",
       "ec2:DeleteLaunchTemplate",
@@ -125,6 +131,7 @@ data "aws_iam_policy_document" "enos_scenario" {
       "ec2:DeleteVPC",
       "ec2:DescribeAccountAttributes",
       "ec2:DescribeAvailabilityZones",
+      "ec2:DescribeEgressOnlyInternetGateways",
       "ec2:DescribeFleets",
       "ec2:DescribeFleetHistory",
       "ec2:DescribeFleetInstances",
@@ -182,28 +189,38 @@ data "aws_iam_policy_document" "enos_scenario" {
       "elasticloadbalancing:DescribeTargetGroups",
       "iam:AddRoleToInstanceProfile",
       "iam:AttachRolePolicy",
+      "iam:AttachUserPolicy",
       "iam:CreateInstanceProfile",
       "iam:CreatePolicy",
       "iam:CreateRole",
       "iam:CreateServiceLinkedRole",
+      "iam:CreateUser",
       "iam:DeleteInstanceProfile",
+      "iam:DeleteLoginProfile",
       "iam:DeletePolicy",
       "iam:DeleteRole",
       "iam:DeleteRolePolicy",
       "iam:DetachRolePolicy",
       "iam:GetInstanceProfile",
+      "iam:GetPolicy",
+      "iam:GetPolicyVersion",
       "iam:GetRole",
       "iam:GetRolePolicy",
       "iam:ListAccountAliases",
       "iam:ListAttachedRolePolicies",
+      "iam:ListAttachedUserPolicies",
       "iam:ListInstanceProfiles",
       "iam:ListInstanceProfilesForRole",
+      "iam:ListMFADevices",
       "iam:ListPolicies",
       "iam:ListRolePolicies",
       "iam:ListRoles",
+      "iam:ListServiceSpecificCredentials",
+      "iam:ListSigningCertificates",
       "iam:PassRole",
       "iam:PutRolePolicy",
       "iam:RemoveRoleFromInstanceProfile",
+      "iam:UpdateUser",
       "kms:CreateAlias",
       "kms:CreateKey",
       "kms:Decrypt",
diff --git a/enos/ci/service-user-iam/outputs.tf b/enos/ci/service-user-iam/outputs.tf
index 348696b4d72..67034e92a48 100644
--- a/enos/ci/service-user-iam/outputs.tf
+++ b/enos/ci/service-user-iam/outputs.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 output "ci_role" {
diff --git a/enos/ci/service-user-iam/providers.tf b/enos/ci/service-user-iam/providers.tf
index cf2d21e2029..4ebb3e4e58e 100644
--- a/enos/ci/service-user-iam/providers.tf
+++ b/enos/ci/service-user-iam/providers.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 provider "aws" {
diff --git a/enos/ci/service-user-iam/service-quotas.tf b/enos/ci/service-user-iam/service-quotas.tf
index 676bbb0a3a5..330ca0da8e5 100644
--- a/enos/ci/service-user-iam/service-quotas.tf
+++ b/enos/ci/service-user-iam/service-quotas.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 locals {
diff --git a/enos/ci/service-user-iam/variables.tf b/enos/ci/service-user-iam/variables.tf
index b69c07b81fe..e1f308868d4 100644
--- a/enos/ci/service-user-iam/variables.tf
+++ b/enos/ci/service-user-iam/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "repository" {
diff --git a/enos/enos-descriptions.hcl b/enos/enos-descriptions.hcl
new file mode 100644
index 00000000000..bc91d74c754
--- /dev/null
+++ b/enos/enos-descriptions.hcl
@@ -0,0 +1,227 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+globals {
+  description = {
+    build_vault = <<-EOF
+      Determine which Vault artifact we want to use for the scenario. Depending on the
+      'artifact_source' variant we'll either build Vault from the local branch, fetch a candidate
+      build from Artifactory, or use a local artifact that was built in CI via CRT.
+    EOF
+
+    create_backend_cluster = <<-EOF
+      Create a storage backend cluster if necessary. When configured to use Consul it will
+      install, configure, and start the Consul cluster on the target hosts and wait for the Consul
+      cluster to become healthy. When using integrated raft storage this step is a no-op as the
+      Vault cluster nodes will provide their own integrated storage.
+    EOF
+
+    create_seal_key = <<-EOF
+      Create the necessary seal key infrastructure for Vaults auto-unseal functionality. Depending
+      on the 'seal' variant this step will perform different actions. When using 'shamir' the step
+      is a no-op as we won't require an external seal mechanism. When using 'pkcs11' this step will
+      create a SoftHSM slot and associated token which can be distributed to all target nodes. When
+      using 'awskms' a new AWSKMS key will be created. The necessary security groups and policies
+      for Vault target nodes to access it the AWSKMS key are handled in the target modules.
+    EOF
+
+    create_external_integration_target = <<-EOF
+      Creates the infrastructure necessary to host external services that we need to test some integrations.
+    EOF
+
+    create_vault_cluster = <<-EOF
+      Create the the Vault cluster. In this module we'll install, configure, start, initialize and
+      unseal all the nodes in the Vault. After initialization it also enables various audit engines.
+    EOF
+
+    create_vault_cluster_backend_targets = <<-EOF
+      Create the target machines that we'll install Consul onto when using Consul for storage. We
+      also handle creating AWS instance profiles and security groups that allow for auto-discovery
+      via the retry_join functionality in Consul. The security group firewall rules will
+      automatically allow SSH access from the host external IP address of the machine executing
+      Enos, in addition to all of the required ports for Consul to function and be accessible in the
+      VPC.
+    EOF
+
+    create_vault_cluster_targets = <<-EOF
+      Create the target machines that we'll install Vault onto. We also handle creating AWS instance
+      profiles and security groups that allow for auto-discovery via the retry_join functionality in
+      Consul. The security group firewall rules will automatically allow SSH access from the host
+      external IP address of the machine executing Enos, in addition to all of the required ports
+      for Vault to function and be accessible in the VPC.
+    EOF
+
+    create_vpc = <<-EOF
+      Create an AWS VPC, internet gateway, default security group, and default subnet that allows
+      egress traffic via the internet gateway.
+    EOF
+
+    ec2_info = <<-EOF
+      Query various endpoints in AWS Ec2 to gather metadata we'll use later in our run when creating
+      infrastructure for the Vault cluster. This metadata includes:
+        - AMI IDs for different Linux distributions and platform architectures
+        - Available Ec2 Regions
+        - Availability Zones for our desired machine instance types
+    EOF
+
+    enable_multiseal = <<-EOF
+      Configure the Vault cluster with 'enable_multiseal' and up to three auto-unseal methods
+      via individual, prioritized 'seal' stanzas.
+    EOF
+
+    get_local_metadata = <<-EOF
+      Performs several Vault quality verification that are dynamically modified based on the Vault
+      binary version, commit SHA, build-date (commit SHA date), and edition metadata. When we're
+      testing existing artifacts this expected metadata is passed in via Enos variables. When we're
+      building a local by using the 'artifact_source:local' variant, this step executes and
+      populates the expected metadata with that of our branch so that we don't have to update the
+      Enos variables on each commit.
+    EOF
+
+    get_vault_cluster_ip_addresses = <<-EOF
+      Map the public and private IP addresses of the Vault cluster nodes and segregate them by
+      their leader status. This allows us to easily determine the public IP addresses of the leader
+      and follower nodes.
+    EOF
+
+    read_backend_license = <<-EOF
+      When using Consul Enterprise as a storage backend, ensure that a Consul Enterprise license is
+      present on disk and read its contents so that we can utilize it when configuring the storage
+      cluster. Must have the 'backend:consul' and 'consul_edition:ent' variants.
+    EOF
+
+    read_vault_license = <<-EOF
+      When deploying Vault Enterprise, ensure a Vault Enterprise license is present on disk and
+      read its contents so that we can utilize it when configuring the Vault Enterprise cluster.
+      Must have the 'edition' variant to be set to any Enterprise edition.
+    EOF
+
+    shutdown_nodes = <<-EOF
+      Shut down the nodes to ensure that they are no longer operating software as part of the
+      cluster.
+    EOF
+
+    start_vault_agent = <<-EOF
+      Create an agent approle in the auth engine, generate a Vault Agent configuration file, and
+      start the Vault agent.
+    EOF
+
+    set_up_external_integration_target = <<-EOF
+      Installs and configures software services on those target machines to test integrations.
+    EOF
+
+    stop_vault = <<-EOF
+      Stop the Vault cluster by stopping the vault service via systemctl.
+    EOF
+
+    vault_leader_step_down = <<-EOF
+      Force the Vault cluster leader to step down which forces the Vault cluster to perform a leader
+      election.
+    EOF
+
+    verify_agent_output = <<-EOF
+      Vault running in Agent mode uses templates to create log output.
+    EOF
+
+    verify_log_secrets = <<-EOF
+      Verify that the vault audit log and systemd journal do not leak secret values.
+    EOF
+
+    verify_raft_cluster_all_nodes_are_voters = <<-EOF
+      When configured with a 'backend:raft' variant, verify that all nodes in the cluster are
+      healthy and are voters.
+    EOF
+
+    verify_autopilot_idle_state = <<-EOF
+      Wait for the Autopilot to upgrade the entire Vault cluster and ensure that the target version
+      matches the candidate version. Ensure that the cluster reaches an upgrade state of
+      'await-server-removal'.
+    EOF
+
+    verify_replication_status = <<-EOF
+      Verify that the default replication status is correct depending on the edition of Vault that
+      been deployed. When testing a Community Edition of Vault we'll ensure that replication is not
+      enabled. When testing any Enterprise edition of Vault we'll ensure that Performance and
+      Disaster Recovery replication are available.
+    EOF
+
+    verify_seal_rewrap_entries_processed_eq_entries_succeeded_post_rewrap = <<-EOF
+      Verify that the v1/sys/sealwrap/rewrap Vault API returns the rewrap data and
+      'entries.processed' equals 'entries.succeeded' after the rewrap has completed.
+    EOF
+
+    verify_seal_rewrap_entries_processed_is_gt_zero_post_rewrap = <<-EOF
+      Verify that the /sys/sealwrap/rewrap Vault API returns the rewrap data and the 'entries.processed' has
+      processed at least one entry after the rewrap has completed.
+    EOF
+
+    verify_seal_rewrap_is_running_false_post_rewrap = <<-EOF
+      Verify that the v1/sys/sealwrap/rewrap Vault API returns the rewrap data and 'is_running' is set to
+      'false' after a rewrap has completed.
+    EOF
+
+    verify_seal_rewrap_no_entries_fail_during_rewrap = <<-EOF
+      Verify that the v1/sys/sealwrap/rewrap Vault API returns the rewrap data and 'entries.failed' is '0'
+      after the rewrap has completed.
+    EOF
+
+    verify_seal_type = <<-EOF
+      Vault's reported seal type matches our configuration.
+    EOF
+
+    verify_secrets_engines_create = <<-EOF
+      Verify that Vault is capable mounting, configuring, and using various secrets engines and auth
+      methods. These currently include:
+        - v1/auth/userpass/*
+        - v1/identity/*
+        - v1/kv/*
+        - v1/sys/policy/*
+        - v1/kmip/*
+        - v1/ldap/*
+    EOF
+
+    verify_secrets_engines_read = <<-EOF
+      Verify that data that we've created previously is still valid, consistent, and durable.
+      This includes:
+        - v1/auth/userpass/*
+        - v1/identity/*
+        - v1/kv/*
+        - v1/sys/policy/*
+        - v1/kmip/*
+        - v1/ldap/*
+    EOF
+
+    verify_secrets_engines_delete = <<-EOF
+      Verify that data that we've created previously can be deleted with no errors.
+      This includes:
+        - v1/ssh/*
+    EOF
+
+    verify_ui = <<-EOF
+      The Vault UI assets are embedded in the Vault binary and available when running.
+    EOF
+
+    verify_vault_unsealed = <<-EOF
+      Verify that the Vault cluster has successfully unsealed.
+    EOF
+
+    verify_vault_version = <<-EOF
+      Verify that the Vault CLI has the correct embedded version metadata and that the Vault Cluster
+      verision history includes our expected version. The CLI metadata that is validated includes
+      the Vault version, edition, build date, and any special prerelease metadata.
+    EOF
+
+    wait_for_cluster_to_have_leader = <<-EOF
+      Wait for a leader election to occur before we proceed with any further quality verification.
+    EOF
+
+    wait_for_seal_rewrap = <<-EOF
+      Wait for the Vault cluster seal rewrap process to complete.
+    EOF
+
+    verify_billing_start_date = <<-EOF
+      Verify that the billing start date has successfully rolled over to the latest billing year if needed.
+    EOF
+
+  }
+}
diff --git a/enos/enos-dev-scenario-pr-replication.hcl b/enos/enos-dev-scenario-pr-replication.hcl
new file mode 100644
index 00000000000..dcc7b5faf1a
--- /dev/null
+++ b/enos/enos-dev-scenario-pr-replication.hcl
@@ -0,0 +1,886 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+scenario "dev_pr_replication" {
+  description = <<-EOF
+    This scenario spins up two Vault clusters with either an external Consul cluster or
+    integrated Raft for storage. The secondary cluster is configured with performance replication
+    from the primary cluster. None of our test verification is included in this scenario in order
+    to improve end-to-end speed. If you wish to perform such verification you'll need to use a
+    non-dev scenario.
+
+    For a full tutorial for this scenario, see here:
+    https://hashicorp.atlassian.net/wiki/spaces/VAULT/pages/4163469313/Enos+Tutorial
+  EOF
+
+  // The matrix is where we define all the baseline combinations that enos can utilize to customize
+  // your scenario. By default enos attempts to perform your command on the entire product of these
+  // possible comginations! Most of the time you'll want to reduce that by passing in a filter.
+  // Run 'enos scenario list --help' to see more about how filtering scenarios works in enos.
+  matrix {
+    arch              = ["amd64", "arm64"]
+    artifact          = ["local", "deb", "rpm", "zip"]
+    distro            = ["amzn", "leap", "rhel", "sles", "ubuntu"]
+    edition           = ["ent", "ent.fips1403", "ent.hsm", "ent.hsm.fips1403"]
+    primary_backend   = ["consul", "raft"]
+    primary_seal      = ["awskms", "pkcs11", "shamir"]
+    secondary_backend = ["consul", "raft"]
+    secondary_seal    = ["awskms", "pkcs11", "shamir"]
+
+    exclude {
+      edition = ["ent.hsm", "ent.fips1403", "ent.hsm.fips1403"]
+      arch    = ["arm64"]
+    }
+
+    exclude {
+      artifact = ["rpm"]
+      distro   = ["ubuntu"]
+    }
+
+    exclude {
+      artifact = ["deb"]
+      distro   = ["rhel", "amzn"]
+    }
+
+    exclude {
+      artifact = ["deb", "rpm"]
+      distro   = ["sles", "leap"]
+    }
+
+    exclude {
+      primary_seal = ["pkcs11"]
+      edition      = ["ce", "ent", "ent.fips1403"]
+    }
+
+    exclude {
+      secondary_seal = ["pkcs11"]
+      edition        = ["ce", "ent", "ent.fips1403"]
+    }
+  }
+
+  // Specify which Terraform configs and providers to use in this scenario. Most of the time you'll
+  // never need to change this! If you wanted to test with different terraform or terraform CLI
+  // settings you can define them and assign them here.
+  terraform_cli = terraform_cli.default
+  terraform     = terraform.default
+
+  // Here we declare all of the providers that we might need for our scenario.
+  providers = [
+    provider.aws.default,
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
+  ]
+
+  // These are variable values that are local to our scenario. They are evaluated after external
+  // variables and scenario matrices but before any of our steps.
+  locals {
+    // The enos provider uses different ssh transport configs for different distros (as
+    // specified in enos-providers.hcl), and we need to be able to access both of those here.
+    enos_provider = {
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
+      ubuntu = provider.enos.ubuntu
+    }
+    // We install vault packages from artifactory. If you wish to use one of these variants you'll
+    // need to configure your artifactory credentials.
+    use_artifactory = matrix.artifact == "deb" || matrix.artifact == "rpm"
+    // The IP version to use for the Vault listener and associated things.
+    ip_version = 4
+    // Zip bundles and local builds don't come with systemd units or any associated configuration.
+    // When this is true we'll let enos handle this for us.
+    manage_service = matrix.artifact == "zip" || matrix.artifact == "local"
+    // If you are using an ent edition, you will need a Vault license. Common convention
+    // is to store it at ./support/vault.hclic, but you may change this path according
+    // to your own preference.
+    vault_install_dir = matrix.artifact == "zip" || matrix.artifact == "local" ? global.vault_install_dir["bundle"] : global.vault_install_dir["package"]
+  }
+
+  // Begin scenario steps. These are the steps we'll perform to get your cluster up and running.
+  step "build_or_find_vault_artifact" {
+    description = <<-EOF
+      Depending on how we intend to get our Vault artifact, this step either builds vault from our
+      current branch or finds debian or redhat packages in Artifactory. If we're using a zip bundle
+      we'll get it from releases.hashicorp.com and skip this step entirely. Please note that if you
+      wish to use a deb or rpm artifact you'll have to configure your artifactory credentials!
+
+      Variables that are used in this step:
+
+        artifactory_host:
+          The artifactory host to search. It's very unlikely that you'll want to change this. The
+          default value is the HashiCorp Artifactory instance.
+        artifactory_repo:
+          The artifactory host to search. It's very unlikely that you'll want to change this. The
+          default value is where CRT will publish packages.
+        artifactory_token:
+          The artifactory identity token to use for authentication. You'll need this if you wish
+          to use deb or rpm artifacts! You can get a token by joining the 'artifactory-users' Doormat
+          group and using 'doormat artifactory create-token'.
+        dev_build_local_ui:
+          If you are not testing any changes in the UI, set to false. This will save time by not
+          building the entire UI. If you need to test the UI, set to true.
+        vault_product_version:
+          When using the artifact:rpm or artifact:deb variants we'll use this variable to determine
+          which version of the Vault pacakge we should fetch from Artifactory.
+        vault_artifact_path:
+          When using the artifact:local variant we'll utilize this variable to determine where
+          to create the vault.zip archive from the local branch. Default: to /tmp/vault.zip.
+        vault_local_tags:
+          When using the artifact:local variant we'll use this variable to inject custom build
+          tags. If left unset we'll automatically use the build tags that correspond to the edition
+          variant.
+    EOF
+    module      = matrix.artifact == "local" ? "build_local" : local.use_artifactory ? "build_artifactory_package" : "build_crt"
+
+    variables {
+      // Used for all modules
+      arch            = matrix.arch
+      edition         = matrix.edition
+      product_version = var.vault_product_version
+      // Required for the local build which will always result in using a local zip bundle
+      artifact_path = matrix.artifact == "local" ? abspath(var.vault_artifact_path) : null
+      build_ui      = var.dev_build_local_ui
+      build_tags    = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      goarch        = matrix.arch
+      goos          = "linux"
+      // Required when using a RPM or Deb package
+      // Some of these variables don't have default values so we'll only set them if they are
+      // required.
+      artifactory_host  = local.use_artifactory ? var.artifactory_host : null
+      artifactory_repo  = local.use_artifactory ? var.artifactory_repo : null
+      artifactory_token = local.use_artifactory ? var.artifactory_token : null
+      distro            = matrix.distro
+    }
+  }
+
+  step "ec2_info" {
+    description = "This discovers usefull metadata in Ec2 like AWS AMI IDs that we use in later modules."
+    module      = module.ec2_info
+  }
+
+  step "create_vpc" {
+    description = <<-EOF
+      Create the VPC resources required for our scenario.
+
+        Variables that are used in this step:
+          tags:
+            If you wish to add custom tags to taggable resources in AWS you can set the 'tags' variable
+            and they'll be added to resources when possible.
+    EOF
+    module      = module.create_vpc
+    depends_on  = [step.ec2_info]
+
+    variables {
+      common_tags = global.tags
+    }
+  }
+
+  step "read_backend_license" {
+    description = <<-EOF
+      Read the contents of the backend license if we're using a Consul backend for either cluster
+      and the backend_edition variable is set to "ent".
+
+      Variables that are used in this step:
+        backend_edition:
+          The edition of Consul to use. If left unset it will default to CE.
+        backend_license_path:
+          If this variable is set we'll use it to determine the local path on disk that contains a
+          Consul Enterprise license. If it is not set we'll attempt to load it from
+          ./support/consul.hclic.
+    EOF
+    skip_step   = (var.backend_edition == "ce" || var.backend_edition == "oss") || (matrix.primary_backend == "raft" && matrix.secondary_backend == "raft")
+    module      = module.read_license
+
+    variables {
+      file_name = global.backend_license_path
+    }
+  }
+
+  step "read_vault_license" {
+    description = <<-EOF
+      Validates and reads into memory the contents of a local Vault Enterprise license if we're
+      using an Enterprise edition. This step does not run when using a community edition of Vault.
+
+      Variables that are used in this step:
+        vault_license_path:
+          If this variable is set we'll use it to determine the local path on disk that contains a
+          Vault Enterprise license. If it is not set we'll attempt to load it from
+          ./support/vault.hclic.
+    EOF
+    module      = module.read_license
+
+    variables {
+      file_name = global.vault_license_path
+    }
+  }
+
+  step "create_primary_seal_key" {
+    description = <<-EOF
+      Create the necessary seal keys depending on our configured seal.
+
+      Variables that are used in this step:
+        tags:
+          If you wish to add custom tags to taggable resources in AWS you can set the 'tags' variable
+          and they'll be added to resources when possible.
+    EOF
+    module      = "seal_${matrix.primary_seal}"
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_id   = step.create_vpc.id
+      cluster_meta = "primary"
+      common_tags  = global.tags
+    }
+  }
+
+  step "create_secondary_seal_key" {
+    description = <<-EOF
+      Create the necessary seal keys depending on our configured seal.
+
+      Variables that are used in this step:
+        tags:
+          If you wish to add custom tags to taggable resources in AWS you can set the 'tags' variable
+          and they'll be added to resources when possible.
+    EOF
+    module      = "seal_${matrix.secondary_seal}"
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_id      = step.create_vpc.id
+      cluster_meta    = "secondary"
+      common_tags     = global.tags
+      other_resources = step.create_primary_seal_key.resource_names
+    }
+  }
+
+  step "create_primary_cluster_targets" {
+    description = <<-EOF
+      Creates the necessary machine infrastructure targets for the Vault cluster. We also ensure
+      that the firewall is configured to allow the necessary Vault and Consul traffic and SSH
+      from the machine executing the Enos scenario.
+
+      Variables that are used in this step:
+        aws_ssh_keypair_name:
+          The AWS SSH Keypair name to use for target machines.
+        project_name:
+          The project name is used for additional tag metadata on resources.
+        tags:
+          If you wish to add custom tags to taggable resources in AWS you can set the 'tags' variable
+          and they'll be added to resources when possible.
+        vault_instance_count:
+          How many instances to provision for the Vault cluster. If left unset it will use a default
+          of three.
+    EOF
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      instance_count  = try(var.vault_instance_count, 3)
+      seal_key_names  = step.create_primary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_primary_cluster_backend_targets" {
+    description = <<-EOF
+      Creates the necessary machine infrastructure targets for the backend Consul storage cluster.
+      We also ensure that the firewall is configured to allow the necessary Consul traffic and SSH
+      from the machine executing the Enos scenario. When using integrated storage this step is a
+      no-op that does nothing.
+
+      Variables that are used in this step:
+        tags:
+          If you wish to add custom tags to taggable resources in AWS you can set the 'tags' variable
+          and they'll be added to resources when possible.
+        project_name:
+          The project name is used for additional tag metadata on resources.
+        aws_ssh_keypair_name:
+          The AWS SSH Keypair name to use for target machines.
+    EOF
+    module      = matrix.primary_backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
+      cluster_tag_key = global.backend_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_primary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_secondary_cluster_targets" {
+    description = <<-EOF
+      Creates the necessary machine infrastructure targets for the Vault cluster. We also ensure
+      that the firewall is configured to allow the necessary Vault and Consul traffic and SSH
+      from the machine executing the Enos scenario.
+    EOF
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_secondary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_secondary_cluster_backend_targets" {
+    description = <<-EOF
+      Creates the necessary machine infrastructure targets for the backend Consul storage cluster.
+      We also ensure that the firewall is configured to allow the necessary Consul traffic and SSH
+      from the machine executing the Enos scenario. When using integrated storage this step is a
+      no-op that does nothing.
+    EOF
+
+    module     = matrix.secondary_backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
+      cluster_tag_key = global.backend_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_secondary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_primary_backend_cluster" {
+    description = <<-EOF
+      Install, configure, and start the backend Consul storage cluster for the primary Vault Cluster.
+      When we are using the raft storage variant this step is a no-op.
+
+      Variables that are used in this step:
+        backend_edition:
+          When configured with the backend:consul variant we'll utilize this variable to determine
+          the edition of Consul to use for the cluster. Note that if you set it to 'ent' you will
+          also need a valid license configured for the read_backend_license step. Default: ce.
+        dev_consul_version:
+          When configured with the backend:consul variant we'll utilize this variable to determine
+          the version of Consul to use for the cluster.
+    EOF
+    module      = "backend_${matrix.primary_backend}"
+    depends_on = [
+      step.create_primary_cluster_backend_targets
+    ]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_name    = step.create_primary_cluster_backend_targets.cluster_name
+      cluster_tag_key = global.backend_tag_key
+      hosts           = step.create_primary_cluster_backend_targets.hosts
+      license         = matrix.primary_backend == "consul" ? step.read_backend_license.license : null
+      release = {
+        edition = var.backend_edition
+        version = var.dev_consul_version
+      }
+    }
+  }
+
+  step "create_primary_cluster" {
+    description = <<-EOF
+      Install, configure, start, initialize and unseal the primary Vault cluster on the specified
+      target instances.
+
+      Variables that are used in this step:
+      backend_edition:
+        When configured with the backend:consul variant we'll utilize this variable to determine
+        which version of the consul client to install on each node for Consul storage. Note that
+        if you set it to 'ent' you will also need a valid license configured for the
+        read_backend_license step. If left unset we'll use an unlicensed CE version.
+      dev_config_mode:
+        You can set this variable to instruct enos on how to primarily configure Vault when starting
+        the service. Options are 'file' and 'env' for configuration file or environment variables.
+        If left unset we'll use the default value.
+      dev_consul_version:
+        When configured with the backend:consul variant we'll utilize this variable to determine
+        which version of Consul to install. If left unset we'll utilize the default value.
+      vault_artifact_path:
+        When using the artifact:local variant this variable is utilized to specify where on
+        the local disk the vault.zip file we've built is located. It can be left unset to use
+        the default value.
+      vault_enable_audit_devices:
+        Whether or not to enable various audit devices after unsealing the Vault cluster. By default
+        we'll configure syslog, socket, and file auditing.
+      vault_product_version:
+        When using the artifact:zip variant this variable is utilized to specify the version of
+        Vault to download from releases.hashicorp.com.
+    EOF
+    module      = module.vault_cluster
+    depends_on = [
+      step.create_primary_backend_cluster,
+      step.create_primary_cluster_targets,
+      step.build_or_find_vault_artifact,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      // We set vault_artifactory_release when we want to get a .deb or .rpm package from Artifactory.
+      // We set vault_release when we want to get a .zip bundle from releases.hashicorp.com
+      // We only set one or the other, never both.
+      artifactory_release     = local.use_artifactory ? step.build_or_find_vault_artifact.release : null
+      backend_cluster_name    = step.create_primary_cluster_backend_targets.cluster_name
+      backend_cluster_tag_key = global.backend_tag_key
+      cluster_name            = step.create_primary_cluster_targets.cluster_name
+      config_mode             = var.dev_config_mode
+      consul_license          = matrix.primary_backend == "consul" ? step.read_backend_license.license : null
+      consul_release = matrix.primary_backend == "consul" ? {
+        edition = var.backend_edition
+        version = var.dev_consul_version
+      } : null
+      enable_audit_devices = var.vault_enable_audit_devices
+      hosts                = step.create_primary_cluster_targets.hosts
+      install_dir          = local.vault_install_dir
+      ip_version           = local.ip_version
+      license              = step.read_vault_license.license
+      local_artifact_path  = matrix.artifact == "local" ? abspath(var.vault_artifact_path) : null
+      manage_service       = local.manage_service
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
+      release              = matrix.artifact == "zip" ? { version = var.vault_product_version, edition = matrix.edition } : null
+      seal_attributes      = step.create_primary_seal_key.attributes
+      seal_type            = matrix.primary_seal
+      storage_backend      = matrix.primary_backend
+    }
+  }
+
+  step "create_secondary_backend_cluster" {
+    description = <<-EOF
+      Install, configure, and start the backend Consul storage cluster for the primary Vault Cluster.
+      When we are using the raft storage variant this step is a no-op.
+
+      Variables that are used in this step:
+        backend_edition:
+          When configured with the backend:consul variant we'll utilize this variable to determine
+          the edition of Consul to use for the cluster. Note that if you set it to 'ent' you will
+          also need a valid license configured for the read_backend_license step. Default: ce.
+        dev_consul_version:
+          When configured with the backend:consul variant we'll utilize this variable to determine
+          the version of Consul to use for the cluster.
+    EOF
+    module      = "backend_${matrix.secondary_backend}"
+    depends_on = [
+      step.create_secondary_cluster_backend_targets
+    ]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_name    = step.create_secondary_cluster_backend_targets.cluster_name
+      cluster_tag_key = global.backend_tag_key
+      hosts           = step.create_secondary_cluster_backend_targets.hosts
+      license         = matrix.secondary_backend == "consul" ? step.read_backend_license.license : null
+      release = {
+        edition = var.backend_edition
+        version = var.dev_consul_version
+      }
+    }
+  }
+
+  step "create_secondary_cluster" {
+    description = <<-EOF
+      Install, configure, start, initialize and unseal the secondary Vault cluster on the specified
+      target instances.
+
+      Variables that are used in this step:
+      backend_edition:
+        When configured with the backend:consul variant we'll utilize this variable to determine
+        which version of the consul client to install on each node for Consul storage. Note that
+        if you set it to 'ent' you will also need a valid license configured for the
+        read_backend_license step. If left unset we'll use an unlicensed CE version.
+      dev_config_mode:
+        You can set this variable to instruct enos on how to primarily configure Vault when starting
+        the service. Options are 'file' and 'env' for configuration file or environment variables.
+        If left unset we'll use the default value.
+      dev_consul_version:
+        When configured with the backend:consul variant we'll utilize this variable to determine
+        which version of Consul to install. If left unset we'll utilize the default value.
+      vault_artifact_path:
+        When using the artifact:local variant this variable is utilized to specify where on
+        the local disk the vault.zip file we've built is located. It can be left unset to use
+        the default value.
+      vault_enable_audit_devices:
+        Whether or not to enable various audit devices after unsealing the Vault cluster. By default
+        we'll configure syslog, socket, and file auditing.
+      vault_product_version:
+        When using the artifact:zip variant this variable is utilized to specify the version of
+        Vault to download from releases.hashicorp.com.
+    EOF
+    module      = module.vault_cluster
+    depends_on = [
+      step.create_secondary_backend_cluster,
+      step.create_secondary_cluster_targets
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      // We set vault_artifactory_release when we want to get a .deb or .rpm package from Artifactory.
+      // We set vault_release when we want to get a .zip bundle from releases.hashicorp.com
+      // We only set one or the other, never both.
+      artifactory_release     = local.use_artifactory ? step.build_or_find_vault_artifact.release : null
+      backend_cluster_name    = step.create_secondary_cluster_backend_targets.cluster_name
+      backend_cluster_tag_key = global.backend_tag_key
+      cluster_name            = step.create_secondary_cluster_targets.cluster_name
+      config_mode             = var.dev_config_mode
+      consul_license          = matrix.secondary_backend == "consul" ? step.read_backend_license.license : null
+      consul_release = matrix.secondary_backend == "consul" ? {
+        edition = var.backend_edition
+        version = var.dev_consul_version
+      } : null
+      enable_audit_devices = var.vault_enable_audit_devices
+      hosts                = step.create_secondary_cluster_targets.hosts
+      install_dir          = local.vault_install_dir
+      ip_version           = local.ip_version
+      license              = step.read_vault_license.license
+      local_artifact_path  = matrix.artifact == "local" ? abspath(var.vault_artifact_path) : null
+      manage_service       = local.manage_service
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
+      release              = matrix.artifact == "zip" ? { version = var.vault_product_version, edition = matrix.edition } : null
+      seal_attributes      = step.create_secondary_seal_key.attributes
+      seal_type            = matrix.secondary_seal
+      storage_backend      = matrix.secondary_backend
+    }
+  }
+
+  step "verify_that_vault_primary_cluster_is_unsealed" {
+    description = <<-EOF
+      Wait for the for the primary cluster to unseal and reach a healthy state.
+    EOF
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on = [
+      step.create_primary_cluster
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.create_primary_cluster_targets.hosts
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+    }
+  }
+
+  step "verify_that_vault_secondary_cluster_is_unsealed" {
+    description = <<-EOF
+      Wait for the for the secondary cluster to unseal and reach a healthy state.
+    EOF
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on = [
+      step.create_secondary_cluster
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+    }
+  }
+
+  step "get_primary_cluster_ips" {
+    description = <<-EOF
+      Determine which node is the primary and which are followers and map their private IP address
+      to their public IP address. We'll use this information so that we can enable performance
+      replication on the leader.
+    EOF
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.verify_that_vault_primary_cluster_is_unsealed]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.create_primary_cluster_targets.hosts
+      ip_version        = local.ip_version
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "get_secondary_cluster_ips" {
+    description = <<-EOF
+      Determine which node is the primary and which are followers and map their private IP address
+      to their public IP address. We'll use this information so that we can enable performance
+      replication on the leader.
+    EOF
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.verify_that_vault_secondary_cluster_is_unsealed]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      ip_version        = local.ip_version
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_secondary_cluster.root_token
+    }
+  }
+
+  step "setup_userpass_for_replication_auth" {
+    description = <<-EOF
+      Enable the auth userpass method and create a new user.
+    EOF
+    module      = module.vault_verify_secrets_engines_create
+    depends_on  = [step.get_primary_cluster_ips]
+
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ports             = global.ports
+      ipv4_cidr         = step.create_vpc.ipv4_cidr
+      hosts             = step.create_primary_cluster_targets.hosts
+      leader_host       = step.get_primary_cluster_ips.leader_host
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_edition     = matrix.edition
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "configure_performance_replication_primary" {
+    description = <<-EOF
+      Create a superuser policy write it for our new user. Activate performance replication on
+      the primary.
+    EOF
+    module      = module.vault_setup_perf_primary
+    depends_on = [
+      step.get_primary_cluster_ips,
+      step.get_secondary_cluster_ips,
+      step.setup_userpass_for_replication_auth,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ip_version          = local.ip_version
+      primary_leader_host = step.get_primary_cluster_ips.leader_host
+      vault_addr          = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir   = local.vault_install_dir
+      vault_root_token    = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "generate_secondary_token" {
+    description = <<-EOF
+      Create a random token and write it to sys/replication/performance/primary/secondary-token on
+      the primary.
+    EOF
+    module      = module.generate_secondary_token
+    depends_on  = [step.configure_performance_replication_primary]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ip_version          = local.ip_version
+      primary_leader_host = step.get_primary_cluster_ips.leader_host
+      replication_type    = "performance"
+      vault_addr          = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir   = local.vault_install_dir
+      vault_root_token    = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "configure_performance_replication_secondary" {
+    description = <<-EOF
+      Enable performance replication on the secondary using the new shared token.
+    EOF
+    module      = module.vault_setup_replication_secondary
+    depends_on  = [step.generate_secondary_token]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ip_version            = local.ip_version
+      secondary_leader_host = step.get_secondary_cluster_ips.leader_host
+      replication_type      = "performance"
+      vault_addr            = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir     = local.vault_install_dir
+      vault_root_token      = step.create_secondary_cluster.root_token
+      wrapping_token        = step.generate_secondary_token.secondary_token
+    }
+  }
+
+  step "unseal_secondary_followers" {
+    description = <<-EOF
+      After replication is enabled we need to unseal the followers on the secondary cluster.
+      Depending on how we're configured we'll pass the unseal keys according to this guide:
+      https://developer.hashicorp.com/vault/docs/enterprise/replication#seals
+    EOF
+    module      = module.vault_unseal_replication_followers
+    depends_on = [
+      step.create_primary_cluster,
+      step.create_secondary_cluster,
+      step.get_secondary_cluster_ips,
+      step.configure_performance_replication_secondary
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.get_secondary_cluster_ips.follower_hosts
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+      vault_unseal_keys = matrix.primary_seal == "shamir" ? step.create_primary_cluster.unseal_keys_hex : step.create_primary_cluster.recovery_keys_hex
+      vault_seal_type   = matrix.primary_seal == "shamir" ? matrix.primary_seal : matrix.secondary_seal
+    }
+  }
+
+  step "verify_secondary_cluster_is_unsealed_after_enabling_replication" {
+    description = <<-EOF
+      Verify that the secondary cluster is unsealed after we enable PR replication.
+    EOF
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on = [
+      step.unseal_secondary_followers
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+    }
+  }
+
+  step "verify_performance_replication" {
+    description = <<-EOF
+      Check sys/replication/performance/status and ensure that all nodes are in the correct state
+      after enabling performance replication.
+    EOF
+    module      = module.vault_verify_performance_replication
+    depends_on  = [step.verify_secondary_cluster_is_unsealed_after_enabling_replication]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ip_version            = local.ip_version
+      primary_leader_host   = step.get_primary_cluster_ips.leader_host
+      secondary_leader_host = step.get_secondary_cluster_ips.leader_host
+      vault_addr            = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir     = local.vault_install_dir
+    }
+  }
+
+  // When using a Consul backend, these output values will be for the Consul backend.
+  // When using a Raft backend, these output values will be null.
+  output "audit_device_file_path" {
+    description = "The file path for the file audit device, if enabled"
+    value       = step.create_primary_cluster.audit_device_file_path
+  }
+
+  output "primary_cluster_hosts" {
+    description = "The Vault primary cluster target hosts"
+    value       = step.create_primary_cluster_targets.hosts
+  }
+
+  output "primary_cluster_root_token" {
+    description = "The Vault primary cluster root token"
+    value       = step.create_primary_cluster.root_token
+  }
+
+  output "primary_cluster_unseal_keys_b64" {
+    description = "The Vault primary cluster unseal keys"
+    value       = step.create_primary_cluster.unseal_keys_b64
+  }
+
+  output "primary_cluster_unseal_keys_hex" {
+    description = "The Vault primary cluster unseal keys hex"
+    value       = step.create_primary_cluster.unseal_keys_hex
+  }
+
+  output "primary_cluster_recovery_key_shares" {
+    description = "The Vault primary cluster recovery key shares"
+    value       = step.create_primary_cluster.recovery_key_shares
+  }
+
+  output "primary_cluster_recovery_keys_b64" {
+    description = "The Vault primary cluster recovery keys b64"
+    value       = step.create_primary_cluster.recovery_keys_b64
+  }
+
+  output "primary_cluster_recovery_keys_hex" {
+    description = "The Vault primary cluster recovery keys hex"
+    value       = step.create_primary_cluster.recovery_keys_hex
+  }
+
+  output "secondary_cluster_hosts" {
+    description = "The Vault secondary cluster public IPs"
+    value       = step.create_secondary_cluster_targets.hosts
+  }
+
+  output "secondary_cluster_root_token" {
+    description = "The Vault secondary cluster root token"
+    value       = step.create_secondary_cluster.root_token
+  }
+
+  output "performance_secondary_token" {
+    description = "The performance secondary replication token"
+    value       = step.generate_secondary_token.secondary_token
+  }
+}
diff --git a/enos/enos-dev-scenario-single-cluster.hcl b/enos/enos-dev-scenario-single-cluster.hcl
new file mode 100644
index 00000000000..13cb06a507c
--- /dev/null
+++ b/enos/enos-dev-scenario-single-cluster.hcl
@@ -0,0 +1,468 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+scenario "dev_single_cluster" {
+  description = <<-EOF
+    This scenario spins up a single Vault cluster with either an external Consul cluster or
+    integrated Raft for storage. None of our test verification is included in this scenario in order
+    to improve end-to-end speed. If you wish to perform such verification you'll need to use a
+    non-dev scenario instead.
+
+    For a full tutorial for this scenario, see here:
+    https://hashicorp.atlassian.net/wiki/spaces/VAULT/pages/4163469313/Enos+Tutorial
+  EOF
+
+  // The matrix is where we define all the baseline combinations that enos can utilize to customize
+  // your scenario. By default, Enos attempts to perform your command on the entire product of these
+  // possible combinations! Most of the time you'll want to reduce that by passing in a filter.
+  // Run 'enos scenario list --help' to see more about how filtering scenarios works in enos.
+  matrix {
+    arch     = ["amd64", "arm64"]
+    artifact = ["local", "deb", "rpm", "zip"]
+    backend  = ["consul", "raft"]
+    distro   = ["amzn", "leap", "rhel", "sles", "ubuntu"]
+    edition  = ["ce", "ent", "ent.fips1403", "ent.hsm", "ent.hsm.fips1403"]
+    seal     = ["awskms", "pkcs11", "shamir"]
+
+    exclude {
+      edition = ["ent.hsm", "ent.fips1403", "ent.hsm.fips1403"]
+      arch    = ["arm64"]
+    }
+
+    exclude {
+      artifact = ["rpm"]
+      distro   = ["ubuntu"]
+    }
+
+    exclude {
+      artifact = ["deb"]
+      distro   = ["rhel", "amzn"]
+    }
+
+    exclude {
+      artifact = ["deb", "rpm"]
+      distro   = ["sles", "leap"]
+    }
+
+    exclude {
+      seal    = ["pkcs11"]
+      edition = ["ce", "ent", "ent.fips1403"]
+    }
+  }
+
+  // Specify which Terraform configs and providers to use in this scenario. Most of the time you'll
+  // never need to change this! If you wanted to test with different terraform or terraform CLI
+  // settings you can define them and assign them here.
+  terraform_cli = terraform_cli.default
+  terraform     = terraform.default
+
+  // Here we declare all of the providers that we might need for our scenario.
+  // There are two different configurations for the Enos provider, each specifying
+  // SSH transport configs for different Linux distros.
+  providers = [
+    provider.aws.default,
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
+  ]
+
+  // These are variable values that are local to our scenario. They are evaluated after external
+  // variables and scenario matrices but before any of our steps.
+  locals {
+    // The enos provider uses different ssh transport configs for different distros (as
+    // specified in enos-providers.hcl), and we need to be able to access both of those here.
+    enos_provider = {
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
+      ubuntu = provider.enos.ubuntu
+    }
+    // We install vault packages from artifactory. If you wish to use one of these variants you'll
+    // need to configure your artifactory credentials.
+    use_artifactory = matrix.artifact == "deb" || matrix.artifact == "rpm"
+    // The IP version to use for the Vault listener and associated things.
+    ip_version = 4
+    // Zip bundles and local builds don't come with systemd units or any associated configuration.
+    // When this is true we'll let enos handle this for us.
+    manage_service = matrix.artifact == "zip" || matrix.artifact == "local"
+    // If you are using an ent edition, you will need a Vault license. Common convention
+    // is to store it at ./support/vault.hclic, but you may change this path according
+    // to your own preference.
+    vault_install_dir = matrix.artifact == "zip" || matrix.artifact == "local" ? global.vault_install_dir["bundle"] : global.vault_install_dir["package"]
+  }
+
+  // Begin scenario steps. These are the steps we'll perform to get your cluster up and running.
+  step "build_or_find_vault_artifact" {
+    description = <<-EOF
+      Depending on how we intend to get our Vault artifact, this step either builds vault from our
+      current branch or finds debian or redhat packages in Artifactory. If we're using a zip bundle
+      we'll get it from releases.hashicorp.com and skip this step entirely. Please note that if you
+      wish to use a deb or rpm artifact you'll have to configure your artifactory credentials!
+
+      Variables that are used in this step:
+
+        artifactory_host:
+          The artifactory host to search. It's very unlikely that you'll want to change this. The
+          default value is the HashiCorp Artifactory instance.
+        artifactory_repo:
+          The artifactory host to search. It's very unlikely that you'll want to change this. The
+          default value is where CRT will publish packages.
+        artifactory_token:
+          The artifactory identity token to use for authentication. You'll need this if you wish
+          to use deb or rpm artifacts! You can get a token by joining the 'artifactory-users' Doormat
+          group and using 'doormat artifactory create-token'.
+        dev_build_local_ui:
+          If you are not testing any changes in the UI, set to false. This will save time by not
+          building the entire UI. If you need to test the UI, set to true.
+        vault_product_version:
+          When using the artifact:rpm or artifact:deb variants we'll use this variable to determine
+          which version of the Vault pacakge we should fetch from Artifactory.
+        vault_artifact_path:
+          When using the artifact:local variant we'll utilize this variable to determine where
+          to create the vault.zip archive from the local branch. Default: to /tmp/vault.zip.
+        vault_local_build_tags:
+          When using the artifact:local variant we'll use this variable to inject custom build
+          tags. If left unset we'll automatically use the build tags that correspond to the edition
+          variant.
+    EOF
+    module      = matrix.artifact == "local" ? "build_local" : local.use_artifactory ? "build_artifactory_package" : "build_crt"
+
+    variables {
+      // Used for all modules
+      arch            = matrix.arch
+      edition         = matrix.edition
+      product_version = var.vault_product_version
+      // Required for the local build which will always result in using a local zip bundle
+      artifact_path = matrix.artifact == "local" ? abspath(var.vault_artifact_path) : null
+      build_tags    = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      build_ui      = var.dev_build_local_ui
+      goarch        = matrix.arch
+      goos          = "linux"
+      // Required when using a RPM or Deb package
+      // Some of these variables don't have default values so we'll only set them if they are
+      // required.
+      artifactory_host  = local.use_artifactory ? var.artifactory_host : null
+      artifactory_repo  = local.use_artifactory ? var.artifactory_repo : null
+      artifactory_token = local.use_artifactory ? var.artifactory_token : null
+      distro            = matrix.distro
+      distro_version    = global.distro_version[matrix.distro]
+    }
+  }
+
+  step "ec2_info" {
+    description = "This discovers usefull metadata in Ec2 like AWS AMI ID's that we use in later modules."
+    module      = module.ec2_info
+  }
+
+  step "create_vpc" {
+    description = <<-EOF
+      Create the VPC resources required for our scenario.
+
+        Variables that are used in this step:
+          tags:
+            If you wish to add custom tags to taggable resources in AWS you can set the 'tags' variable
+            and they'll be added to resources when possible.
+    EOF
+    module      = module.create_vpc
+    depends_on  = [step.ec2_info]
+
+    variables {
+      common_tags = global.tags
+    }
+  }
+
+  step "read_backend_license" {
+    description = <<-EOF
+      Read the contents of the backend license if we're using a Consul backend and the edition is "ent".
+
+      Variables that are used in this step:
+        backend_edition:
+          The edition of Consul to use. If left unset it will default to CE.
+         backend_license_path:
+          If this variable is set we'll use it to determine the local path on disk that contains a
+          Consul Enterprise license. If it is not set we'll attempt to load it from
+          ./support/consul.hclic.
+    EOF
+    skip_step   = matrix.backend == "raft" || var.backend_edition == "oss" || var.backend_edition == "ce"
+    module      = module.read_license
+
+    variables {
+      file_name = global.backend_license_path
+    }
+  }
+
+  step "read_vault_license" {
+    description = <<-EOF
+      Validates and reads into memory the contents of a local Vault Enterprise license if we're
+      using an Enterprise edition. This step does not run when using a community edition of Vault.
+
+      Variables that are used in this step:
+        vault_license_path:
+          If this variable is set we'll use it to determine the local path on disk that contains a
+          Vault Enterprise license. If it is not set we'll attempt to load it from
+          ./support/vault.hclic.
+    EOF
+    skip_step   = matrix.edition == "ce"
+    module      = module.read_license
+
+    variables {
+      file_name = global.vault_license_path
+    }
+  }
+
+  step "create_seal_key" {
+    description = <<-EOF
+      Create the necessary seal keys depending on our configured seal.
+
+      Variables that are used in this step:
+        tags:
+          If you wish to add custom tags to taggable resources in AWS you can set the 'tags' variable
+          and they'll be added to resources when possible.
+    EOF
+    module      = "seal_${matrix.seal}"
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_id  = step.create_vpc.id
+      common_tags = global.tags
+    }
+  }
+
+  step "create_vault_cluster_targets" {
+    description = <<-EOF
+      Creates the necessary machine infrastructure targets for the Vault cluster. We also ensure
+      that the firewall is configured to allow the necessary Vault and Consul traffic and SSH
+      from the machine executing the Enos scenario.
+
+      Variables that are used in this step:
+        aws_ssh_keypair_name:
+          The AWS SSH Keypair name to use for target machines.
+        project_name:
+          The project name is used for additional tag metadata on resources.
+        tags:
+          If you wish to add custom tags to taggable resources in AWS you can set the 'tags' variable
+          and they'll be added to resources when possible.
+        vault_instance_count:
+          How many instances to provision for the Vault cluster. If left unset it will use a default
+          of three.
+    EOF
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      instance_count  = try(var.vault_instance_count, 3)
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_vault_cluster_backend_targets" {
+    description = <<-EOF
+      Creates the necessary machine infrastructure targets for the backend Consul storage cluster.
+      We also ensure that the firewall is configured to allow the necessary Consul traffic and SSH
+      from the machine executing the Enos scenario. When using integrated storage this step is a
+      no-op that does nothing.
+
+      Variables that are used in this step:
+        tags:
+          If you wish to add custom tags to taggable resources in AWS you can set the 'tags' variable
+          and they'll be added to resources when possible.
+        project_name:
+          The project name is used for additional tag metadata on resources.
+        aws_ssh_keypair_name:
+          The AWS SSH Keypair name to use for target machines.
+    EOF
+
+    module     = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
+      cluster_tag_key = global.backend_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_backend_cluster" {
+    description = <<-EOF
+      Install, configure, and start the backend Consul storage cluster. When we are using the raft
+      storage variant this step is a no-op.
+
+      Variables that are used in this step:
+        backend_edition:
+          When configured with the backend:consul variant we'll utilize this variable to determine
+          the edition of Consul to use for the cluster. Note that if you set it to 'ent' you will
+          also need a valid license configured for the read_backend_license step. Default: ce.
+        dev_consul_version:
+          When configured with the backend:consul variant we'll utilize this variable to determine
+          the version of Consul to use for the cluster.
+    EOF
+    module      = "backend_${matrix.backend}"
+    depends_on = [
+      step.create_vault_cluster_backend_targets
+    ]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
+      cluster_tag_key = global.backend_tag_key
+      hosts           = step.create_vault_cluster_backend_targets.hosts
+      license         = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      release = {
+        edition = var.backend_edition
+        version = var.dev_consul_version
+      }
+    }
+  }
+
+  step "create_vault_cluster" {
+    description = <<-EOF
+      Install, configure, start, initialize and unseal the Vault cluster on the specified target
+      instances.
+
+      Variables that are used in this step:
+      backend_edition:
+        When configured with the backend:consul variant we'll utilize this variable to determine
+        which version of the consul client to install on each node for Consul storage. Note that
+        if you set it to 'ent' you will also need a valid license configured for the
+        read_backend_license step. If left unset we'll use an unlicensed CE version.
+      dev_config_mode:
+        You can set this variable to instruct enos on how to primarily configure Vault when starting
+        the service. Options are 'file' and 'env' for configuration file or environment variables.
+        If left unset we'll use the default value.
+      dev_consul_version:
+        When configured with the backend:consul variant we'll utilize this variable to determine
+        which version of Consul to install. If left unset we'll utilize the default value.
+      vault_artifact_path:
+        When using the artifact:local variant this variable is utilized to specify where on
+        the local disk the vault.zip file we've built is located. It can be left unset to use
+        the default value.
+      vault_enable_audit_devices:
+        Whether or not to enable various audit devices after unsealing the Vault cluster. By default
+        we'll configure syslog, socket, and file auditing.
+      vault_product_version:
+        When using the artifact:zip variant this variable is utilized to specify the version of
+        Vault to download from releases.hashicorp.com.
+    EOF
+    module      = module.vault_cluster
+    depends_on = [
+      step.create_backend_cluster,
+      step.create_vault_cluster_targets,
+      step.build_or_find_vault_artifact,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      // We set vault_artifactory_release when we want to get a .deb or .rpm package from Artifactory.
+      // We set vault_release when we want to get a .zip bundle from releases.hashicorp.com
+      // We only set one or the other, never both.
+      artifactory_release     = local.use_artifactory ? step.build_or_find_vault_artifact.release : null
+      backend_cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
+      backend_cluster_tag_key = global.backend_tag_key
+      cluster_name            = step.create_vault_cluster_targets.cluster_name
+      config_mode             = var.dev_config_mode
+      consul_license          = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      consul_release = matrix.backend == "consul" ? {
+        edition = var.backend_edition
+        version = var.dev_consul_version
+      } : null
+      enable_audit_devices = var.vault_enable_audit_devices
+      hosts                = step.create_vault_cluster_targets.hosts
+      install_dir          = local.vault_install_dir
+      ip_version           = local.ip_version
+      license              = matrix.edition != "ce" ? step.read_vault_license.license : null
+      local_artifact_path  = matrix.artifact == "local" ? abspath(var.vault_artifact_path) : null
+      manage_service       = local.manage_service
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
+      release              = matrix.artifact == "zip" ? { version = var.vault_product_version, edition = matrix.edition } : null
+      seal_attributes      = step.create_seal_key.attributes
+      seal_type            = matrix.seal
+      storage_backend      = matrix.backend
+    }
+  }
+
+  // When using a Consul backend, these output values will be for the Consul backend.
+  // When using a Raft backend, these output values will be null.
+  output "audit_device_file_path" {
+    description = "The file path for the file audit device, if enabled"
+    value       = step.create_vault_cluster.audit_device_file_path
+  }
+
+  output "cluster_name" {
+    description = "The Vault cluster name"
+    value       = step.create_vault_cluster.cluster_name
+  }
+
+  output "hosts" {
+    description = "The Vault cluster target hosts"
+    value       = step.create_vault_cluster.hosts
+  }
+
+  output "private_ips" {
+    description = "The Vault cluster private IPs"
+    value       = step.create_vault_cluster.private_ips
+  }
+
+  output "public_ips" {
+    description = "The Vault cluster public IPs"
+    value       = step.create_vault_cluster.public_ips
+  }
+
+  output "root_token" {
+    description = "The Vault cluster root token"
+    value       = step.create_vault_cluster.root_token
+  }
+
+  output "recovery_key_shares" {
+    description = "The Vault cluster recovery key shares"
+    value       = step.create_vault_cluster.recovery_key_shares
+  }
+
+  output "recovery_keys_b64" {
+    description = "The Vault cluster recovery keys b64"
+    value       = step.create_vault_cluster.recovery_keys_b64
+  }
+
+  output "recovery_keys_hex" {
+    description = "The Vault cluster recovery keys hex"
+    value       = step.create_vault_cluster.recovery_keys_hex
+  }
+
+  output "seal_key_attributes" {
+    description = "The Vault cluster seal attributes"
+    value       = step.create_seal_key.attributes
+  }
+
+  output "unseal_keys_b64" {
+    description = "The Vault cluster unseal keys"
+    value       = step.create_vault_cluster.unseal_keys_b64
+  }
+
+  output "unseal_keys_hex" {
+    description = "The Vault cluster unseal keys hex"
+    value       = step.create_vault_cluster.unseal_keys_hex
+  }
+}
diff --git a/enos/enos-dev-variables.hcl b/enos/enos-dev-variables.hcl
new file mode 100644
index 00000000000..af98534d2d3
--- /dev/null
+++ b/enos/enos-dev-variables.hcl
@@ -0,0 +1,21 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+variable "dev_build_local_ui" {
+  type        = bool
+  description = "Whether or not to build the web UI when using the local builder var. If the assets have already been built we'll still include them"
+  default     = false
+}
+
+variable "dev_config_mode" {
+  type        = string
+  description = "The method to use when configuring Vault. When set to 'env' we will configure Vault using VAULT_ style environment variables if possible. When 'file' we'll use the HCL configuration file for all configuration options."
+  default     = "file" // or "env"
+}
+
+variable "dev_consul_version" {
+  type        = string
+  description = "The version of Consul to use when using Consul for storage!"
+  default     = "1.18.1"
+  // NOTE: You can also set the "backend_edition" if you want to use Consul Enterprise
+}
diff --git a/enos/enos-dynamic-config.hcl b/enos/enos-dynamic-config.hcl
new file mode 100644
index 00000000000..e3cb16fd23e
--- /dev/null
+++ b/enos/enos-dynamic-config.hcl
@@ -0,0 +1,20 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+# Code generated by pipeline generate enos-dynamic-config DO NOT EDIT.
+
+# This file is overwritten in CI as it contains branch specific and sometimes ever-changing values.
+# It's checked in here so that enos samples and scenarios can be performed, just be aware that this
+# might change out from under you.
+
+globals {
+  sample_attributes = {
+    aws_region              = ["us-east-1", "us-west-2"]
+    distro_version_amzn     = ["2023"]
+    distro_version_leap     = ["15.6"]
+    distro_version_rhel     = ["8.10", "9.6"]
+    distro_version_sles     = ["15.6"]
+    distro_version_ubuntu   = ["22.04", "24.04"]
+    upgrade_initial_version = ["1.18.0", "1.18.1", "1.18.2", "1.18.3", "1.18.4", "1.18.5", "1.18.6", "1.18.7", "1.18.8", "1.18.9", "1.18.10", "1.18.11", "1.18.12", "1.18.13", "1.19.0", "1.19.1", "1.19.2", "1.19.3", "1.19.4", "1.19.5", "1.19.6", "1.19.7", "1.19.8", "1.20.0", "1.20.1", "1.20.2"]
+  }
+}
diff --git a/enos/enos-globals.hcl b/enos/enos-globals.hcl
index f411224d0b0..bfef9ba9cae 100644
--- a/enos/enos-globals.hcl
+++ b/enos/enos-globals.hcl
@@ -1,49 +1,201 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 globals {
-  archs            = ["amd64", "arm64"]
-  artifact_sources = ["local", "crt", "artifactory"]
-  artifact_types   = ["bundle", "package"]
-  backends         = ["consul", "raft"]
-  backend_tag_key  = "VaultStorage"
+  archs                = ["amd64", "arm64"]
+  artifact_sources     = ["local", "crt", "artifactory"]
+  artifact_types       = ["bundle", "package"]
+  backends             = ["consul", "raft"]
+  backend_license_path = abspath(var.backend_license_path != null ? var.backend_license_path : joinpath(path.root, "./support/consul.hclic"))
+  backend_tag_key      = "VaultStorage"
   build_tags = {
     "ce"               = ["ui"]
     "ent"              = ["ui", "enterprise", "ent"]
-    "ent.fips1402"     = ["ui", "enterprise", "cgo", "hsm", "fips", "fips_140_2", "ent.fips1402"]
+    "ent.fips1403"     = ["ui", "enterprise", "cgo", "hsm", "fips", "fips_140_3", "ent.fips1403"]
     "ent.hsm"          = ["ui", "enterprise", "cgo", "hsm", "venthsm"]
-    "ent.hsm.fips1402" = ["ui", "enterprise", "cgo", "hsm", "fips", "fips_140_2", "ent.hsm.fips1402"]
+    "ent.hsm.fips1403" = ["ui", "enterprise", "cgo", "hsm", "fips", "fips_140_3", "ent.hsm.fips1403"]
+  }
+  config_modes    = ["env", "file"]
+  consul_editions = ["ce", "ent"]
+  consul_versions = ["1.18.2", "1.19.2", "1.20.6", "1.21.1"]
+  distros         = ["amzn", "leap", "rhel", "sles", "ubuntu"]
+  // Different distros may require different packages, or use different aliases for the same package
+  distro_packages = {
+    amzn = {
+      "2"    = ["nc", "openldap-clients"]
+      "2023" = ["nc", "openldap-clients"]
+    }
+    leap = {
+      "15.6" = ["netcat", "openssl", "openldap2-client"]
+    }
+    rhel = {
+      "8.10" = ["nc", "openldap-clients"]
+      "9.6"  = ["nc", "openldap-clients"]
+      "10.0" = ["nc", "openldap-clients"]
+    }
+    sles = {
+      // When installing Vault RPM packages on a SLES AMI, the openssl package provided
+      // isn't named "openssl, which rpm doesn't know how to handle. Therefore we add the
+      // "correctly" named one in our package installation before installing Vault.
+      "15.6" = ["netcat-openbsd", "openssl", "openldap2-client"]
+    }
+    ubuntu = {
+      "22.04" = ["netcat", "ldap-utils"]
+      "24.04" = ["netcat-openbsd", "ldap-utils"]
+    }
   }
-  consul_versions = ["1.14.11", "1.15.7", "1.16.3", "1.17.0"]
-  distros         = ["ubuntu", "rhel"]
   distro_version = {
-    "rhel"   = var.rhel_distro_version
-    "ubuntu" = var.ubuntu_distro_version
+    amzn   = var.distro_version_amzn
+    leap   = var.distro_version_leap
+    rhel   = var.distro_version_rhel
+    sles   = var.distro_version_sles
+    ubuntu = var.distro_version_ubuntu
+  }
+  editions            = ["ce", "ent", "ent.fips1403", "ent.hsm", "ent.hsm.fips1403"]
+  enterprise_editions = [for e in global.editions : e if e != "ce"]
+  ip_versions         = ["4", "6"]
+  package_manager = {
+    "amzn"   = "yum"
+    "leap"   = "zypper"
+    "rhel"   = "yum"
+    "sles"   = "zypper"
+    "ubuntu" = "apt"
   }
-  editions = ["ce", "ent", "ent.fips1402", "ent.hsm", "ent.hsm.fips1402"]
   packages = ["jq"]
-  distro_packages = {
-    ubuntu = ["netcat"]
-    rhel   = ["nc"]
+  // Ports that we'll open up for ingress in the security group for all target machines.
+  // Port protocol maps to the IpProtocol schema: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_IpPermission.html
+
+  // Ports that we'll open up for ingress in the security group for all Vault target machines.
+  vault_cluster_ports = {
+    vault_agent : {
+      description = "Vault Agent"
+      port        = 8100
+      protocol    = "tcp"
+    },
+    vault_proxy : {
+      description = "Vault Proxy"
+      port        = 8101
+      protocol    = "tcp"
+    },
+    vault_listener : {
+      description = "Vault Addr listener"
+      port        = 8200
+      protocol    = "tcp"
+    },
+    vault_cluster : {
+      description = "Vault Cluster listener"
+      port        = 8201
+      protocol    = "tcp"
+    }
   }
-  sample_attributes = {
-    aws_region = ["us-east-1", "us-west-2"]
+  // Ports that we'll open up for ingress in the security group for all Consul target machines.
+  consul_cluster_ports = {
+    consul_rpc : {
+      description = "Consul internal communication"
+      port        = 8300
+      protocol    = "tcp"
+    },
+    consul_serf_lan_tcp : {
+      description = "Consul Serf LAN TCP"
+      port        = 8301
+      protocol    = "tcp"
+    },
+    consul_serf_lan_udp : {
+      description = "Consul Serf LAN UDP"
+      port        = 8301
+      protocol    = "udp"
+    },
+    consul_serf_wan_tcp : {
+      description = "Consul Serf WAN TCP"
+      port        = 8302
+      protocol    = "tcp"
+    },
+    consul_serf_wan_udp : {
+      description = "Consul Serf WAN UDP"
+      port        = 8302
+      protocol    = "udp"
+    },
+    consul_http : {
+      description = "Consul HTTP API"
+      port        = 8500
+      protocol    = "tcp"
+    },
+    consul_https : {
+      description = "Consul HTTPS API"
+      port        = 8501
+      protocol    = "tcp"
+    },
+    consul_grpc : {
+      description = "Consul gRPC API"
+      port        = 8502
+      protocol    = "tcp"
+    },
+    consul_grpc_tls : {
+      description = "Consul gRPC TLS API"
+      port        = 8503
+      protocol    = "tcp"
+    },
+    consul_dns_tcp : {
+      description = "Consul TCP DNS Server"
+      port        = 8600
+      protocol    = "tcp"
+    },
+    consul_dns_udp : {
+      description = "Consul UDP DNS Server"
+      port        = 8600
+      protocol    = "udp"
+    }
   }
+  ingress_ports = {
+    ssh : {
+      description = "SSH"
+      port        = 22
+      protocol    = "tcp"
+    }
+  }
+  // Ports that we'll open up for ingress in the security group for all external integration target machines.
+  integration_host_ports = {
+    ldap : {
+      description = "LDAP"
+      port        = 389
+      protocol    = "tcp"
+    },
+    ldaps : {
+      description = "LDAPS"
+      port        = 636
+      protocol    = "tcp"
+    },
+    mysql : {
+      description = "MySQL Server"
+      port        = 3306
+      protocol    = "tcp"
+    },
+    kmip : {
+      description = "KMIP Server"
+      port        = 5696
+      protocol    = "tcp"
+    },
+  }
+
+  // Combine all ports into a single map
+  ports = merge(
+    global.vault_cluster_ports,
+    global.consul_cluster_ports,
+    global.ingress_ports,
+    global.integration_host_ports
+  )
+
   seals = ["awskms", "pkcs11", "shamir"]
   tags = merge({
     "Project Name" : var.project_name
     "Project" : "Enos",
     "Environment" : "ci"
   }, var.tags)
-  // NOTE: when backporting, make sure that our initial versions are less than that
-  // release branch's version. Also beware if adding versions below 1.11.x. Some scenarios
-  // that use this global might not work as expected with earlier versions. Below 1.8.x is
-  // not supported in any way.
-  upgrade_initial_versions = ["1.11.12", "1.12.11", "1.13.11", "1.14.7", "1.15.3"]
-  vault_install_dir_packages = {
-    rhel   = "/bin"
-    ubuntu = "/usr/bin"
-  }
-  vault_license_path = abspath(var.vault_license_path != null ? var.vault_license_path : joinpath(path.root, "./support/vault.hclic"))
-  vault_tag_key      = "Type" // enos_vault_start expects Type as the tag key
+  vault_install_dir = {
+    bundle  = "/opt/vault/bin"
+    package = "/usr/bin"
+  }
+  vault_license_path  = abspath(var.vault_license_path != null ? var.vault_license_path : joinpath(path.root, "./support/vault.hclic"))
+  vault_tag_key       = "vault-cluster"
+  vault_disable_mlock = false
 }
diff --git a/enos/enos-modules.hcl b/enos/enos-modules.hcl
index 8772a9e140b..9085384506a 100644
--- a/enos/enos-modules.hcl
+++ b/enos/enos-modules.hcl
@@ -1,5 +1,5 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 module "autopilot_upgrade_storageconfig" {
   source = "./modules/autopilot_upgrade_storageconfig"
@@ -16,18 +16,39 @@ module "backend_raft" {
   source = "./modules/backend_raft"
 }
 
+module "benchmark_config" {
+  source = "./modules/benchmark/config"
+}
+
+module "benchmark_setup" {
+  source = "./modules/benchmark/setup"
+}
+
+// Find any artifact in Artifactory. Requires the version, revision, and edition.
+module "build_artifactory" {
+  source = "./modules/build_artifactory_artifact"
+}
+
+// Find any released RPM or Deb in Artifactory. Requires the version, edition, distro, and distro
+// version.
+module "build_artifactory_package" {
+  source = "./modules/build_artifactory_package"
+}
+
+// A shim "build module" suitable for use when using locally pre-built artifacts or a zip bundle
+// from releases.hashicorp.com. When using a local pre-built artifact it requires the local
+// artifact path. When using a release zip it does nothing as you'll need to configure the
+// vault_cluster module with release info instead.
 module "build_crt" {
   source = "./modules/build_crt"
 }
 
+// Build the local branch and package it into a zip artifact. Requires the goarch, goos, build tags,
+// and bundle path.
 module "build_local" {
   source = "./modules/build_local"
 }
 
-module "build_artifactory" {
-  source = "./modules/vault_artifactory_artifact"
-}
-
 module "create_vpc" {
   source = "./modules/create_vpc"
 
@@ -35,6 +56,10 @@ module "create_vpc" {
   common_tags = var.tags
 }
 
+module "choose_follower_host" {
+  source = "./modules/choose_follower_host"
+}
+
 module "ec2_info" {
   source = "./modules/ec2_info"
 }
@@ -43,12 +68,38 @@ module "get_local_metadata" {
   source = "./modules/get_local_metadata"
 }
 
+module "generate_dr_operation_token" {
+  source = "./modules/generate_dr_operation_token"
+
+  vault_install_dir = var.vault_install_dir
+}
+
+module "generate_failover_secondary_token" {
+  source = "./modules/generate_failover_secondary_token"
+
+  vault_install_dir = var.vault_install_dir
+}
+
+module "generate_secondary_public_key" {
+  source = "./modules/generate_secondary_public_key"
+
+  vault_install_dir = var.vault_install_dir
+}
+
 module "generate_secondary_token" {
   source = "./modules/generate_secondary_token"
 
   vault_install_dir = var.vault_install_dir
 }
 
+module "hcp_create_vault_cluster" {
+  source = "./modules/hcp/create_vault_cluster"
+}
+
+module "hcp_create_admin_token" {
+  source = "./modules/hcp/create_admin_token"
+}
+
 module "install_packages" {
   source = "./modules/install_packages"
 }
@@ -61,6 +112,11 @@ module "replication_data" {
   source = "./modules/replication_data"
 }
 
+module "restart_vault" {
+  source            = "./modules/restart_vault"
+  vault_install_dir = var.vault_install_dir
+}
+
 module "seal_awskms" {
   source = "./modules/seal_awskms"
 
@@ -82,6 +138,12 @@ module "seal_pkcs11" {
   common_tags         = var.tags
 }
 
+module "set_up_external_integration_target" {
+  source = "./modules/set_up_external_integration_target"
+
+  ldap_version = "1.5.0"
+}
+
 module "shutdown_node" {
   source = "./modules/shutdown_node"
 }
@@ -101,7 +163,7 @@ module "stop_vault" {
   source = "./modules/stop_vault"
 }
 
-# create target instances using ec2:CreateFleet
+// create target instances using ec2:CreateFleet
 module "target_ec2_fleet" {
   source = "./modules/target_ec2_fleet"
 
@@ -110,25 +172,27 @@ module "target_ec2_fleet" {
   ssh_keypair  = var.aws_ssh_keypair_name
 }
 
-# create target instances using ec2:RunInstances
+// create target instances using ec2:RunInstances
 module "target_ec2_instances" {
   source = "./modules/target_ec2_instances"
 
-  common_tags  = var.tags
-  project_name = var.project_name
-  ssh_keypair  = var.aws_ssh_keypair_name
+  common_tags   = var.tags
+  ports_ingress = values(global.ports)
+  project_name  = var.project_name
+  ssh_keypair   = var.aws_ssh_keypair_name
 }
 
-# don't create instances but satisfy the module interface
+// don't create instances but satisfy the module interface
 module "target_ec2_shim" {
   source = "./modules/target_ec2_shim"
 
-  common_tags  = var.tags
-  project_name = var.project_name
-  ssh_keypair  = var.aws_ssh_keypair_name
+  common_tags   = var.tags
+  ports_ingress = values(global.ports)
+  project_name  = var.project_name
+  ssh_keypair   = var.aws_ssh_keypair_name
 }
 
-# create target instances using ec2:RequestSpotFleet
+// create target instances using ec2:RequestSpotFleet
 module "target_ec2_spot_fleet" {
   source = "./modules/target_ec2_spot_fleet"
 
@@ -140,36 +204,57 @@ module "target_ec2_spot_fleet" {
 module "vault_agent" {
   source = "./modules/vault_agent"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  vault_install_dir = var.vault_install_dir
+  vault_agent_port  = global.ports["vault_agent"]["port"]
 }
 
 module "vault_proxy" {
   source = "./modules/vault_proxy"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  vault_install_dir = var.vault_install_dir
+  vault_proxy_port  = global.ports["vault_proxy"]["port"]
 }
 
 module "vault_verify_agent_output" {
   source = "./modules/vault_verify_agent_output"
-
-  vault_instance_count = var.vault_instance_count
 }
 
 module "vault_cluster" {
   source = "./modules/vault_cluster"
 
-  install_dir    = var.vault_install_dir
-  consul_license = var.backend_license_path == null ? null : file(abspath(var.backend_license_path))
-  log_level      = var.vault_log_level
+  install_dir     = var.vault_install_dir
+  consul_license  = var.backend_license_path == null ? null : file(abspath(var.backend_license_path))
+  cluster_tag_key = global.vault_tag_key
+  log_level       = var.vault_log_level
 }
 
 module "vault_get_cluster_ips" {
   source = "./modules/vault_get_cluster_ips"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  vault_install_dir = var.vault_install_dir
+}
+
+module "vault_failover_demote_dr_primary" {
+  source = "./modules/vault_failover_demote_dr_primary"
+
+  vault_install_dir = var.vault_install_dir
+}
+
+module "vault_failover_promote_dr_secondary" {
+  source = "./modules/vault_failover_promote_dr_secondary"
+
+  vault_install_dir = var.vault_install_dir
+}
+
+module "vault_failover_update_dr_primary" {
+  source = "./modules/vault_failover_update_dr_primary"
+
+  vault_install_dir = var.vault_install_dir
+}
+
+module "vault_raft_remove_node_and_verify" {
+  source            = "./modules/vault_raft_remove_node_and_verify"
+  vault_install_dir = var.vault_install_dir
 }
 
 module "vault_raft_remove_peer" {
@@ -177,8 +262,26 @@ module "vault_raft_remove_peer" {
   vault_install_dir = var.vault_install_dir
 }
 
-module "vault_setup_perf_secondary" {
-  source = "./modules/vault_setup_perf_secondary"
+module "vault_setup_dr_primary" {
+  source = "./modules/vault_setup_dr_primary"
+
+  vault_install_dir = var.vault_install_dir
+}
+
+module "vault_setup_perf_primary" {
+  source = "./modules/vault_setup_perf_primary"
+
+  vault_install_dir = var.vault_install_dir
+}
+
+module "vault_setup_replication_secondary" {
+  source = "./modules/vault_setup_replication_secondary"
+
+  vault_install_dir = var.vault_install_dir
+}
+
+module "vault_step_down" {
+  source = "./modules/vault_step_down"
 
   vault_install_dir = var.vault_install_dir
 }
@@ -189,101 +292,109 @@ module "vault_test_ui" {
   ui_run_tests = var.ui_run_tests
 }
 
-module "vault_unseal_nodes" {
-  source = "./modules/vault_unseal_nodes"
+module "vault_unseal_replication_followers" {
+  source = "./modules/vault_unseal_replication_followers"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  vault_install_dir = var.vault_install_dir
 }
 
 module "vault_upgrade" {
   source = "./modules/vault_upgrade"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  vault_install_dir = var.vault_install_dir
 }
 
-
 module "vault_verify_autopilot" {
   source = "./modules/vault_verify_autopilot"
 
   vault_autopilot_upgrade_status = "await-server-removal"
   vault_install_dir              = var.vault_install_dir
-  vault_instance_count           = var.vault_instance_count
 }
 
-module "vault_verify_raft_auto_join_voter" {
-  source = "./modules/vault_verify_raft_auto_join_voter"
+module "vault_verify_dr_replication" {
+  source = "./modules/vault_verify_dr_replication"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  vault_install_dir = var.vault_install_dir
 }
 
-module "vault_verify_undo_logs" {
-  source = "./modules/vault_verify_undo_logs"
+module "vault_verify_removed_node" {
+  source = "./modules/vault_verify_removed_node"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  vault_install_dir = var.vault_install_dir
 }
 
-module "vault_verify_default_lcq" {
-  source = "./modules/vault_verify_default_lcq"
+module "vault_verify_removed_node_shim" {
+  source            = "./modules/vault_verify_removed_node_shim"
+  vault_install_dir = var.vault_install_dir
+}
 
-  vault_autopilot_default_max_leases = "300000"
-  vault_instance_count               = var.vault_instance_count
+module "vault_verify_secrets_engines_create" {
+  source = "./modules/verify_secrets_engines/modules/create"
+
+  aws_enabled       = var.verify_aws_secrets_engine
+  ldap_enabled      = var.verify_ldap_secrets_engine
+  kmip_enabled      = var.verify_kmip_secrets_engine
+  vault_install_dir = var.vault_install_dir
 }
 
-module "vault_verify_replication" {
-  source = "./modules/vault_verify_replication"
+module "vault_verify_secrets_engines_read" {
+  source = "./modules/verify_secrets_engines/modules/read"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  aws_enabled       = var.verify_aws_secrets_engine
+  ldap_enabled      = var.verify_ldap_secrets_engine
+  kmip_enabled      = var.verify_kmip_secrets_engine
+  vault_install_dir = var.vault_install_dir
 }
 
-module "vault_verify_ui" {
-  source = "./modules/vault_verify_ui"
+module "vault_verify_secrets_engines_delete" {
+  source = "./modules/verify_secrets_engines/modules/delete"
 
-  vault_instance_count = var.vault_instance_count
+  vault_install_dir = var.vault_install_dir
 }
 
-module "vault_verify_unsealed" {
-  source = "./modules/vault_verify_unsealed"
+module "vault_verify_default_lcq" {
+  source = "./modules/vault_verify_default_lcq"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  vault_autopilot_default_max_leases = "300000"
 }
 
-module "vault_setup_perf_primary" {
-  source = "./modules/vault_setup_perf_primary"
+module "vault_verify_performance_replication" {
+  source = "./modules/vault_verify_performance_replication"
 
   vault_install_dir = var.vault_install_dir
 }
 
-module "vault_verify_read_data" {
-  source = "./modules/vault_verify_read_data"
+module "vault_verify_raft_auto_join_voter" {
+  source = "./modules/vault_verify_raft_auto_join_voter"
+
+  vault_install_dir       = var.vault_install_dir
+  vault_cluster_addr_port = global.ports["vault_cluster"]["port"]
+}
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+module "vault_verify_replication" {
+  source = "./modules/vault_verify_replication"
 }
 
-module "vault_verify_performance_replication" {
-  source = "./modules/vault_verify_performance_replication"
+module "vault_verify_ui" {
+  source = "./modules/vault_verify_ui"
+}
+
+module "vault_verify_undo_logs" {
+  source = "./modules/vault_verify_undo_logs"
 
   vault_install_dir = var.vault_install_dir
 }
 
-module "vault_verify_version" {
-  source = "./modules/vault_verify_version"
+module "vault_wait_for_cluster_unsealed" {
+  source = "./modules/vault_wait_for_cluster_unsealed"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  vault_install_dir = var.vault_install_dir
 }
 
-module "vault_verify_write_data" {
-  source = "./modules/vault_verify_write_data"
+module "vault_verify_version" {
+  source = "./modules/vault_verify_version"
 
-  vault_install_dir    = var.vault_install_dir
-  vault_instance_count = var.vault_instance_count
+  vault_install_dir = var.vault_install_dir
 }
 
 module "vault_wait_for_leader" {
@@ -298,8 +409,22 @@ module "vault_wait_for_seal_rewrap" {
   vault_install_dir = var.vault_install_dir
 }
 
+module "verify_log_secrets" {
+  source = "./modules/verify_log_secrets"
+
+  radar_license_path = var.vault_radar_license_path != null ? abspath(var.vault_radar_license_path) : null
+}
+
 module "verify_seal_type" {
   source = "./modules/verify_seal_type"
 
   vault_install_dir = var.vault_install_dir
 }
+
+module "vault_verify_billing_start_date" {
+  source = "./modules/vault_verify_billing_start_date"
+
+  vault_install_dir       = var.vault_install_dir
+  vault_instance_count    = var.vault_instance_count
+  vault_cluster_addr_port = global.ports["vault_cluster"]["port"]
+}
diff --git a/enos/enos-providers.hcl b/enos/enos-providers.hcl
index 472589f4a1e..fe4d3e53d65 100644
--- a/enos/enos-providers.hcl
+++ b/enos/enos-providers.hcl
@@ -1,11 +1,12 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 provider "aws" "default" {
   region = var.aws_region
 }
 
-provider "enos" "rhel" {
+// This default SSH user is used in RHEL, Amazon Linux, SUSE, and Leap distros
+provider "enos" "ec2_user" {
   transport = {
     ssh = {
       user             = "ec2-user"
@@ -14,6 +15,7 @@ provider "enos" "rhel" {
   }
 }
 
+// This default SSH user is used in the Ubuntu distro
 provider "enos" "ubuntu" {
   transport = {
     ssh = {
@@ -22,3 +24,6 @@ provider "enos" "ubuntu" {
     }
   }
 }
+
+provider "hcp" "default" {
+}
diff --git a/enos/enos-qualities.hcl b/enos/enos-qualities.hcl
new file mode 100644
index 00000000000..3bd741e90fe
--- /dev/null
+++ b/enos/enos-qualities.hcl
@@ -0,0 +1,673 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+quality "consul_api_agent_host_read" {
+  description = "The /v1/agent/host Consul API returns host info for each node in the cluster"
+}
+
+quality "consul_api_health_node_read" {
+  description = <<-EOF
+    The /v1/health/node/<node> Consul API returns health info for each node in the cluster
+  EOF
+}
+
+quality "consul_api_operator_raft_config_read" {
+  description = "The /v1/operator/raft/configuration Consul API returns raft info for the cluster"
+}
+
+quality "consul_autojoin_aws" {
+  description = "The Consul cluster auto-joins with AWS tag discovery"
+}
+
+quality "consul_cli_validate" {
+  description = "The 'consul validate' command validates the Consul configuration"
+}
+
+quality "consul_config_file" {
+  description = "Consul starts when configured with a configuration file"
+}
+
+quality "consul_ha_leader_election" {
+  description = "The Consul cluster elects a leader node on start up"
+}
+
+quality "consul_health_state_passing_read_nodes_minimum" {
+  description = <<-EOF
+    The Consul cluster meets the minimum of number of healthy nodes according to the
+    /v1/health/state/passing Consul API
+  EOF
+}
+
+quality "consul_operator_raft_configuration_read_voters_minimum" {
+  description = <<-EOF
+    The Consul cluster meets the minimum number of raft voters according to the
+    /v1/operator/raft/configuration Consul API
+  EOF
+}
+
+quality "consul_service_start_client" {
+  description = "The Consul service starts in client mode"
+}
+
+quality "consul_service_start_server" {
+  description = "The Consul service starts in server mode"
+}
+
+quality "consul_service_systemd_notified" {
+  description = "The Consul binary notifies systemd when the service is active"
+}
+
+quality "consul_service_systemd_unit" {
+  description = "The 'consul.service' systemd unit starts the service"
+}
+
+quality "vault_agent_auto_auth_approle" {
+  description = <<-EOF
+    Vault running in Agent mode utilizes the approle auth method to do auto-auth via a role and
+    read secrets from a file source
+  EOF
+}
+
+quality "vault_agent_log_template" {
+  description = global.description.verify_agent_output
+}
+
+quality "vault_api_auth_userpass_login_write" {
+  description = "The v1/auth/userpass/login/<user> Vault API creates a token for a user"
+}
+
+quality "vault_api_auth_userpass_user_write" {
+  description = "The v1/auth/userpass/users/<user> Vault API associates a policy with a user"
+}
+
+quality "vault_api_identity_entity_read" {
+  description = <<-EOF
+    The v1/identity/entity Vault API returns an identity entity, has the correct metadata, and is
+    associated with the expected entity-alias, groups, and policies
+  EOF
+}
+
+quality "vault_api_identity_entity_write" {
+  description = "The v1/identity/entity Vault API creates an identity entity"
+}
+
+quality "vault_api_identity_entity_alias_write" {
+  description = "The v1/identity/entity-alias Vault API creates an identity entity alias"
+}
+
+quality "vault_api_identity_group_write" {
+  description = "The v1/identity/group/<group> Vault API creates an identity group"
+}
+
+quality "vault_api_identity_oidc_config_read" {
+  description = <<-EOF
+    The v1/identity/oidc/config Vault API returns the built-in identity secrets engine configuration
+  EOF
+}
+
+quality "vault_api_identity_oidc_config_write" {
+  description = "The v1/identity/oidc/config Vault API configures the built-in identity secrets engine"
+}
+
+quality "vault_api_identity_oidc_introspect_write" {
+  description = "The v1/identity/oidc/introspect Vault API creates introspect verifies the active state of a signed OIDC token"
+}
+
+quality "vault_api_identity_oidc_key_read" {
+  description = <<-EOF
+    The v1/identity/oidc/key Vault API returns the OIDC signing key and verifies the key's algorithm,
+    rotation_period, and verification_ttl are correct
+  EOF
+}
+
+quality "vault_api_identity_oidc_key_write" {
+  description = "The v1/identity/oidc/key Vault API creates an OIDC signing key"
+}
+
+quality "vault_api_identity_oidc_key_rotate_write" {
+  description = "The v1/identity/oidc/key/<name>/rotate Vault API rotates an OIDC signing key and applies a new verification TTL"
+}
+
+quality "vault_api_identity_oidc_role_read" {
+  description = <<-EOF
+    The v1/identity/oidc/role Vault API returns the OIDC role and verifies that the roles key and
+    ttl are corect.
+  EOF
+}
+
+quality "vault_api_identity_oidc_role_write" {
+  description = "The v1/identity/oidc/role Vault API creates an OIDC role associated with a key and clients"
+}
+
+quality "vault_api_identity_oidc_token_read" {
+  description = "The v1/identity/oidc/token Vault API creates an OIDC token associated with a role"
+}
+
+quality "vault_api_sys_auth_userpass_user_write" {
+  description = "The v1/sys/auth/userpass/users/<user> Vault API associates a superuser policy with a user"
+}
+
+quality "vault_api_ssh_role_delete" {
+  description = "The v1/ssh/role Vault API deletes an SSH role associated with a key and clients"
+}
+
+quality "vault_api_sys_config_read" {
+  description = <<-EOF
+    The v1/sys/config/sanitized Vault API returns sanitized configuration which matches our given
+    configuration
+  EOF
+}
+
+quality "vault_api_sys_ha_status_read" {
+  description = "The v1/sys/ha-status Vault API returns the HA status of the cluster"
+}
+
+quality "vault_api_sys_health_read" {
+  description = <<-EOF
+    The v1/sys/health Vault API returns the correct codes depending on the replication and
+    'seal-status' of the cluster
+  EOF
+}
+
+quality "vault_api_sys_host_info_read" {
+  description = "The v1/sys/host-info Vault API returns the host info for each node in the cluster"
+}
+
+quality "vault_api_sys_leader_read" {
+  description = "The v1/sys/leader Vault API returns the cluster leader info"
+}
+
+quality "vault_api_sys_metrics_vault_core_replication_write_undo_logs_enabled" {
+  description = <<-EOF
+    The v1/sys/metrics Vault API returns metrics and verifies that
+    'Gauges[vault.core.replication.write_undo_logs]' is enabled
+  EOF
+}
+
+quality "vault_api_sys_policy_write" {
+  description = "The v1/sys/policy Vault API writes a policy"
+}
+
+quality "vault_api_sys_quotas_lease_count_read_max_leases_default" {
+  description = <<-EOF
+    The v1/sys/quotas/lease-count/default Vault API returns the lease 'count' and 'max_leases' is
+    set to 300,000
+  EOF
+}
+
+quality "vault_api_sys_replication_dr_primary_enable_write" {
+  description = <<-EOF
+    The v1/sys/replication/dr/primary/enable Vault API enables DR replication
+  EOF
+}
+
+quality "vault_api_sys_replication_dr_primary_secondary_token_write" {
+  description = <<-EOF
+    The v1/sys/replication/dr/primary/secondary-token Vault API configures the DR replication
+    secondary token
+  EOF
+}
+
+quality "vault_api_sys_replication_dr_secondary_enable_write" {
+  description = <<-EOF
+    The v1/sys/replication/dr/secondary/enable Vault API enables DR replication
+  EOF
+}
+
+quality "vault_api_sys_replication_dr_read_connection_status_connected" {
+  description = <<-EOF
+    The v1/sys/replication/dr/status Vault API returns status info and the
+    'connection_status' is correct for the given node
+  EOF
+}
+
+quality "vault_api_sys_replication_dr_status_known_primary_cluster_addrs" {
+  description = <<-EOF
+    The v1/sys/replication/dr/status Vault API returns the DR replication status and
+    'known_primary_cluster_address' is the expected primary cluster leader
+  EOF
+}
+
+quality "vault_api_sys_replication_dr_status_read" {
+  description = <<-EOF
+    The v1/sys/replication/dr/status Vault API returns the DR replication status
+  EOF
+}
+
+quality "vault_api_sys_replication_dr_status_read_cluster_address" {
+  description = <<-EOF
+    The v1/sys/replication/dr/status Vault API returns the DR replication status
+    and the '{primaries,secondaries}[*].cluster_address' is correct for the given node
+  EOF
+}
+
+quality "vault_api_sys_replication_dr_status_read_state_not_idle" {
+  description = <<-EOF
+    The v1/sys/replication/dr/status Vault API returns the DR replication status
+    and the state is not idle
+  EOF
+}
+
+quality "vault_api_sys_replication_performance_primary_enable_write" {
+  description = <<-EOF
+    The v1/sys/replication/performance/primary/enable Vault API enables performance replication
+  EOF
+}
+
+quality "vault_api_sys_replication_performance_primary_secondary_token_write" {
+  description = <<-EOF
+    The v1/sys/replication/performance/primary/secondary-token Vault API configures the replication
+    token
+  EOF
+}
+
+quality "vault_api_sys_replication_performance_secondary_enable_write" {
+  description = <<-EOF
+    The v1/sys/replication/performance/secondary/enable Vault API enables performance replication
+  EOF
+}
+
+quality "vault_api_sys_replication_performance_read_connection_status_connected" {
+  description = <<-EOF
+    The v1/sys/replication/performance/status Vault API returns status info and the
+    'connection_status' is correct for the given node
+  EOF
+}
+
+quality "vault_api_sys_replication_performance_status_known_primary_cluster_addrs" {
+  description = <<-EOF
+    The v1/sys/replication/performance/status Vault API returns the replication status and
+    'known_primary_cluster_address' is the expected primary cluster leader
+  EOF
+}
+
+quality "vault_api_sys_replication_performance_status_read" {
+  description = <<-EOF
+    The v1/sys/replication/performance/status Vault API returns the performance replication status
+  EOF
+}
+
+quality "vault_api_sys_replication_performance_status_read_cluster_address" {
+  description = <<-EOF
+    The v1/sys/replication/performance/status Vault API returns the performance replication status
+    and the '{primaries,secondaries}[*].cluster_address' is correct for the given node
+  EOF
+}
+
+quality "vault_api_sys_replication_performance_status_read_state_not_idle" {
+  description = <<-EOF
+    The v1/sys/replication/performance/status Vault API returns the performance replication status
+    and the state is not idle
+  EOF
+}
+
+quality "vault_api_sys_replication_status_read" {
+  description = <<-EOF
+    The v1/sys/replication/status Vault API returns the performance replication status of the
+    cluster
+  EOF
+}
+
+quality "vault_api_sys_seal_status_api_read_matches_sys_health" {
+  description = <<-EOF
+    The v1/sys/seal-status Vault API and v1/sys/health Vault API agree on the health of each node
+    and the cluster
+  EOF
+}
+
+quality "vault_api_sys_sealwrap_rewrap_read_entries_processed_eq_entries_succeeded_post_rewrap" {
+  description = global.description.verify_seal_rewrap_entries_processed_eq_entries_succeeded_post_rewrap
+}
+
+quality "vault_api_sys_sealwrap_rewrap_read_entries_processed_gt_zero_post_rewrap" {
+  description = global.description.verify_seal_rewrap_entries_processed_is_gt_zero_post_rewrap
+}
+
+quality "vault_api_sys_sealwrap_rewrap_read_is_running_false_post_rewrap" {
+  description = global.description.verify_seal_rewrap_is_running_false_post_rewrap
+}
+
+quality "vault_api_sys_sealwrap_rewrap_read_no_entries_fail_during_rewrap" {
+  description = global.description.verify_seal_rewrap_no_entries_fail_during_rewrap
+}
+
+quality "vault_api_sys_step_down_steps_down" {
+  description = <<-EOF
+    The v1/sys/step-down Vault API forces the cluster leader to step down and intiates a new leader
+    election
+  EOF
+}
+
+quality "vault_api_sys_storage_raft_autopilot_configuration_read" {
+  description = <<-EOF
+    The /sys/storage/raft/autopilot/configuration Vault API returns the autopilot configuration of
+    the cluster
+  EOF
+}
+
+quality "vault_api_sys_storage_raft_autopilot_state_read" {
+  description = <<-EOF
+    The v1/sys/storage/raft/autopilot/state Vault API returns the raft autopilot state of the
+    cluster
+  EOF
+}
+
+quality "vault_api_sys_storage_raft_autopilot_upgrade_info_read_status_matches" {
+  description = <<-EOF
+    The v1/sys/storage/raft/autopilot/state Vault API returns the raft autopilot state and the
+    'upgrade_info.status' matches our expected state
+  EOF
+}
+
+quality "vault_api_sys_storage_raft_autopilot_upgrade_info_target_version_read_matches_candidate" {
+  description = <<-EOF
+    The v1/sys/storage/raft/autopilot/state Vault API returns the raft autopilot state and the
+    'upgrade_info.target_version' matches the the candidate version
+  EOF
+}
+
+quality "vault_api_sys_storage_raft_configuration_read" {
+  description = <<-EOF
+    The v1/sys/storage/raft/configuration Vault API returns the raft configuration of the cluster
+  EOF
+}
+
+quality "vault_api_sys_storage_raft_remove_peer_write_removes_peer" {
+  description = <<-EOF
+    The v1/sys/storage/raft/remove-peer Vault API removes the desired node from the raft sub-system
+  EOF
+}
+
+quality "vault_api_sys_version_history_keys" {
+  description = <<-EOF
+    The v1/sys/version-history Vault API returns the cluster version history and the 'keys' data
+    includes our target version
+  EOF
+}
+
+quality "vault_api_sys_version_history_key_info" {
+  description = <<-EOF
+    The v1/sys/version-history Vault API returns the cluster version history and the
+    'key_info["$expected_version]' data is present for the expected version and the 'build_date'
+    matches the expected build_date.
+  EOF
+}
+
+quality "vault_artifact_bundle" {
+  description = "The candidate binary packaged as a zip bundle is used for testing"
+}
+
+quality "vault_artifact_deb" {
+  description = "The candidate binary packaged as a deb package is used for testing"
+}
+
+quality "vault_artifact_rpm" {
+  description = "The candidate binary packaged as an rpm package is used for testing"
+}
+
+quality "vault_audit_log" {
+  description = "The Vault audit sub-system is enabled with the log and writes to a log"
+}
+
+quality "vault_audit_log_secrets" {
+  description = "The Vault audit sub-system does not output secret values"
+}
+
+quality "vault_audit_socket" {
+  description = "The Vault audit sub-system is enabled with the socket and writes to a socket"
+}
+
+quality "vault_audit_syslog" {
+  description = "The Vault audit sub-system is enabled with the syslog and writes to syslog"
+}
+
+quality "vault_auto_unseals_after_autopilot_upgrade" {
+  description = "Vault auto-unseals after upgrading the cluster with autopilot"
+}
+
+quality "vault_autojoins_new_nodes_into_initialized_cluster" {
+  description = "Vault sucessfully auto-joins new nodes into an existing cluster"
+}
+
+quality "vault_autojoin_aws" {
+  description = "Vault auto-joins nodes using AWS tag discovery"
+}
+
+quality "vault_autopilot_upgrade_leader_election" {
+  description = <<-EOF
+    Vault elects a new leader after upgrading the cluster with autopilot
+  EOF
+}
+
+quality "vault_cli_audit_enable" {
+  description = "The 'vault audit enable' command enables audit devices"
+}
+
+quality "vault_cli_auth_enable_approle" {
+  description = "The 'vault auth enable approle' command enables the approle auth method"
+}
+
+quality "vault_cli_operator_members" {
+  description = "The 'vault operator members' command returns the expected list of members"
+}
+
+quality "vault_cli_operator_raft_remove_peer" {
+  description = "The 'vault operator remove-peer' command removes the desired node"
+}
+
+quality "vault_cli_operator_step_down" {
+  description = "The 'vault operator step-down' command forces the cluster leader to step down"
+}
+
+quality "vault_cli_policy_write" {
+  description = "The 'vault policy write' command writes a policy"
+}
+
+quality "vault_cli_status_exit_code" {
+  description = <<-EOF
+    The 'vault status' command exits with the correct code depending on expected seal status
+  EOF
+}
+
+quality "vault_cluster_upgrade_in_place" {
+  description = <<-EOF
+    Vault starts with existing data and configuration in-place migrates the data
+  EOF
+}
+
+quality "vault_config_env_variables" {
+  description = "Vault starts when configured primarily with environment variables"
+}
+
+quality "vault_config_file" {
+  description = "Vault starts when configured primarily with a configuration file"
+}
+
+quality "vault_config_log_level" {
+  description = "The 'log_level' config stanza modifies its log level"
+}
+
+quality "vault_config_multiseal_is_toggleable" {
+  description = <<-EOF
+    The Vault Cluster can be configured with a single unseal method regardless of the
+    'enable_multiseal' config value
+  EOF
+}
+
+quality "vault_init" {
+  description = "Vault initializes the cluster with the given seal parameters"
+}
+
+quality "vault_journal_secrets" {
+  description = "The Vault systemd journal does not output secret values"
+}
+
+quality "vault_license_required_ent" {
+  description = "Vault Enterprise requires a license in order to start"
+}
+
+quality "vault_listener_ipv4" {
+  description = "Vault operates on ipv4 TCP listeners"
+}
+
+quality "vault_listener_ipv6" {
+  description = "Vault operates on ipv6 TCP listeners"
+}
+
+quality "vault_mount_auth" {
+  description = "Vault mounts the auth engine"
+}
+
+quality "vault_mount_identity" {
+  description = "Vault mounts the identity engine"
+}
+
+quality "vault_mount_kv" {
+  description = "Vault mounts the kv engine"
+}
+
+quality "vault_multiseal_enable" {
+  description = <<-EOF
+    The Vault Cluster starts with 'enable_multiseal' and multiple auto-unseal methods.
+  EOF
+}
+
+quality "vault_proxy_auto_auth_approle" {
+  description = <<-EOF
+    Vault Proxy utilizes the approle auth method to to auto auth via a roles and secrets from file.
+  EOF
+}
+
+quality "vault_proxy_cli_access" {
+  description = <<-EOF
+    The Vault CLI accesses tokens through the Vault proxy without a VAULT_TOKEN available
+  EOF
+}
+
+quality "vault_radar_index_create" {
+  description = "Vault radar is able to create an index from KVv2 mounts"
+}
+
+quality "vault_radar_scan_file" {
+  description = "Vault radar is able to scan a file for secrets"
+}
+
+quality "vault_raft_voters" {
+  description = global.description.verify_raft_cluster_all_nodes_are_voters
+}
+
+quality "vault_raft_removed_after_restart" {
+  description = "A removed raft node will continue reporting as removed after the process is restarted"
+}
+
+quality "vault_raft_removed_statuses" {
+  description = "A removed raft node reports itself as removed in the status endpoints"
+}
+
+quality "vault_raft_removed_cant_rejoin" {
+  description = "A removed raft node cannot rejoin a cluster while it still has old vault/raft data"
+}
+
+quality "vault_raft_removed_rejoin_after_deletion" {
+  description = "A removed raft node can rejoin a cluster if it has deleted its old vault/raft data"
+}
+
+quality "vault_replication_ce_disabled" {
+  description = "Replication is not enabled for CE editions"
+}
+
+quality "vault_replication_ent_dr_available" {
+  description = "DR replication is available on Enterprise"
+}
+
+quality "vault_replication_ent_pr_available" {
+  description = "PR replication is available on Enterprise"
+}
+
+quality "vault_seal_awskms" {
+  description = "Vault auto-unseals with the awskms seal"
+}
+
+quality "vault_seal_shamir" {
+  description = <<-EOF
+    Vault manually unseals with the shamir seal when given the expected number of 'key_shares'
+  EOF
+}
+
+quality "vault_seal_pkcs11" {
+  description = "Vault auto-unseals with the pkcs11 seal"
+}
+
+quality "vault_secrets_kmip_write_config" {
+  description = "The Vault KMIP secrets engine is configured with the correct settings"
+}
+
+quality "vault_secrets_kv_read" {
+  description = "Vault kv secrets engine data is readable"
+}
+
+quality "vault_secrets_kv_write" {
+  description = "Vault kv secrets engine data is writable"
+}
+
+quality "vault_secrets_ldap_write_config" {
+  description = "The Vault LDAP secrets engine is configured with the correct settings"
+}
+
+quality "vault_service_restart" {
+  description = "Vault restarts with existing configuration"
+}
+
+quality "vault_service_start" {
+  description = "Vault starts with the configuration"
+}
+
+quality "vault_service_systemd_notified" {
+  description = "The Vault binary notifies systemd when the service is active"
+}
+
+quality "vault_service_systemd_unit" {
+  description = "The 'vault.service' systemd unit starts the service"
+}
+
+quality "vault_status_seal_type" {
+  description = global.description.verify_seal_type
+}
+
+quality "vault_storage_backend_consul" {
+  description = "Vault operates using Consul for storage"
+}
+
+quality "vault_storage_backend_raft" {
+  description = "Vault operates using integrated Raft storage"
+}
+
+quality "vault_ui_assets" {
+  description = global.description.verify_ui
+}
+
+quality "vault_ui_test" {
+  description = <<-EOF
+    The Vault Web UI test suite runs against a live Vault server with the embedded static assets
+  EOF
+}
+
+quality "vault_unseal_ha_leader_election" {
+  description = "Vault performs a leader election after it is unsealed"
+}
+
+quality "vault_version_build_date" {
+  description = "Vault's reported build date matches our expectations"
+}
+
+quality "vault_version_edition" {
+  description = "Vault's reported edition matches our expectations"
+}
+
+quality "vault_version_release" {
+  description = "Vault's reported release version matches our expectations"
+}
+
+quality "vault_billing_start_date" {
+  description = "Vault's billing start date has adjusted to the latest billing year"
+}
diff --git a/enos/enos-samples-ce-build.hcl b/enos/enos-samples-ce-build.hcl
index 2c3cae0f775..cf8547dfbaa 100644
--- a/enos/enos-samples-ce-build.hcl
+++ b/enos/enos-samples-ce-build.hcl
@@ -1,5 +1,5 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 sample "build_ce_linux_amd64_deb" {
   attributes = global.sample_attributes
@@ -97,7 +97,7 @@ sample "build_ce_linux_arm64_rpm" {
       arch            = ["arm64"]
       artifact_source = ["crt"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -107,7 +107,7 @@ sample "build_ce_linux_arm64_rpm" {
       arch            = ["arm64"]
       artifact_source = ["crt"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -117,7 +117,7 @@ sample "build_ce_linux_arm64_rpm" {
       arch            = ["arm64"]
       artifact_source = ["crt"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -127,7 +127,7 @@ sample "build_ce_linux_arm64_rpm" {
       arch            = ["arm64"]
       artifact_source = ["crt"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -141,7 +141,7 @@ sample "build_ce_linux_amd64_rpm" {
       arch            = ["amd64"]
       artifact_source = ["crt"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "leap", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -151,7 +151,7 @@ sample "build_ce_linux_amd64_rpm" {
       arch            = ["amd64"]
       artifact_source = ["crt"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "leap", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -161,7 +161,7 @@ sample "build_ce_linux_amd64_rpm" {
       arch            = ["amd64"]
       artifact_source = ["crt"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "leap", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -171,7 +171,7 @@ sample "build_ce_linux_amd64_rpm" {
       arch            = ["amd64"]
       artifact_source = ["crt"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "leap", "rhel", "sles"]
       edition         = ["ce"]
 
       exclude {
@@ -191,6 +191,7 @@ sample "build_ce_linux_amd64_zip" {
       arch            = ["amd64"]
       artifact_type   = ["bundle"]
       artifact_source = ["crt"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -200,6 +201,7 @@ sample "build_ce_linux_amd64_zip" {
       arch            = ["amd64"]
       artifact_type   = ["bundle"]
       artifact_source = ["crt"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -209,6 +211,7 @@ sample "build_ce_linux_amd64_zip" {
       arch            = ["amd64"]
       artifact_type   = ["bundle"]
       artifact_source = ["crt"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -218,6 +221,7 @@ sample "build_ce_linux_amd64_zip" {
       arch            = ["amd64"]
       artifact_type   = ["bundle"]
       artifact_source = ["crt"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -231,6 +235,7 @@ sample "build_ce_linux_arm64_zip" {
       arch            = ["arm64"]
       artifact_source = ["crt"]
       artifact_type   = ["bundle"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -240,6 +245,7 @@ sample "build_ce_linux_arm64_zip" {
       arch            = ["arm64"]
       artifact_source = ["crt"]
       artifact_type   = ["bundle"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -249,6 +255,7 @@ sample "build_ce_linux_arm64_zip" {
       arch            = ["arm64"]
       artifact_source = ["crt"]
       artifact_type   = ["bundle"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -258,6 +265,7 @@ sample "build_ce_linux_arm64_zip" {
       arch            = ["arm64"]
       artifact_source = ["crt"]
       artifact_type   = ["bundle"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
diff --git a/enos/enos-samples-ce-release.hcl b/enos/enos-samples-ce-release.hcl
index 4e3d9acdf25..00306ddd224 100644
--- a/enos/enos-samples-ce-release.hcl
+++ b/enos/enos-samples-ce-release.hcl
@@ -1,5 +1,5 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 sample "release_ce_linux_amd64_deb" {
   attributes = global.sample_attributes
@@ -97,7 +97,7 @@ sample "release_ce_linux_arm64_rpm" {
       arch            = ["arm64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -107,7 +107,7 @@ sample "release_ce_linux_arm64_rpm" {
       arch            = ["arm64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -117,7 +117,7 @@ sample "release_ce_linux_arm64_rpm" {
       arch            = ["arm64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -127,7 +127,7 @@ sample "release_ce_linux_arm64_rpm" {
       arch            = ["arm64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -141,7 +141,7 @@ sample "release_ce_linux_amd64_rpm" {
       arch            = ["amd64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "leap", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -151,7 +151,7 @@ sample "release_ce_linux_amd64_rpm" {
       arch            = ["amd64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "leap", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -161,7 +161,7 @@ sample "release_ce_linux_amd64_rpm" {
       arch            = ["amd64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "leap", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -171,7 +171,7 @@ sample "release_ce_linux_amd64_rpm" {
       arch            = ["amd64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["package"]
-      distro          = ["rhel"]
+      distro          = ["amzn", "leap", "rhel", "sles"]
       edition         = ["ce"]
     }
   }
@@ -185,6 +185,7 @@ sample "release_ce_linux_amd64_zip" {
       arch            = ["amd64"]
       artifact_type   = ["bundle"]
       artifact_source = ["artifactory"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -194,6 +195,7 @@ sample "release_ce_linux_amd64_zip" {
       arch            = ["amd64"]
       artifact_type   = ["bundle"]
       artifact_source = ["artifactory"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -203,6 +205,7 @@ sample "release_ce_linux_amd64_zip" {
       arch            = ["amd64"]
       artifact_type   = ["bundle"]
       artifact_source = ["artifactory"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -212,6 +215,7 @@ sample "release_ce_linux_amd64_zip" {
       arch            = ["amd64"]
       artifact_type   = ["bundle"]
       artifact_source = ["artifactory"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -225,6 +229,7 @@ sample "release_ce_linux_arm64_zip" {
       arch            = ["arm64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["bundle"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -234,6 +239,7 @@ sample "release_ce_linux_arm64_zip" {
       arch            = ["arm64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["bundle"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -243,6 +249,7 @@ sample "release_ce_linux_arm64_zip" {
       arch            = ["arm64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["bundle"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
@@ -252,6 +259,7 @@ sample "release_ce_linux_arm64_zip" {
       arch            = ["arm64"]
       artifact_source = ["artifactory"]
       artifact_type   = ["bundle"]
+      distro          = ["amzn", "ubuntu"]
       edition         = ["ce"]
     }
   }
diff --git a/enos/enos-scenario-agent.hcl b/enos/enos-scenario-agent.hcl
index 3c4e7dd8881..edafa58ca24 100644
--- a/enos/enos-scenario-agent.hcl
+++ b/enos/enos-scenario-agent.hcl
@@ -1,34 +1,78 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 scenario "agent" {
+  description = <<-EOF
+    The agent scenario verifies Vault when running in Agent mode. The build can be a local branch,
+    any CRT built Vault artifact saved to the local machine, or any CRT built Vault artifact in the
+    stable channel in Artifactory.
+
+    The scenario creates a new Vault Cluster using the candidate build and then runs the same Vault
+    build in Agent mode and verifies behavior against the Vault cluster. The scenario also performs
+    standard baseline verification that is not specific to the Agent mode deployment.
+
+    # How to run this scenario
+
+    For general instructions on running a scenario, refer to the Enos docs: https://eng-handbook.hashicorp.services/internal-tools/enos/running-a-scenario/
+    For troubleshooting tips and common errors, see https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/.
+
+    Variables required for all scenario variants:
+      - aws_ssh_private_key_path (more info about AWS SSH keypairs: https://eng-handbook.hashicorp.services/internal-tools/enos/getting-started/#set-your-aws-key-pair-name-and-private-key)
+      - aws_ssh_keypair_name
+      - vault_build_date*
+      - vault_product_version
+      - vault_revision*
+
+    * If you don't already know what build date and revision you should be using, see
+    https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
+
+    Variables required for some scenario variants:
+      - artifactory_token (if using `artifact_source:artifactory` in your filter)
+      - aws_region (if different from the default value in enos-variables.hcl)
+      - consul_license_path (if using an ENT edition of Consul)
+      - distro_version_<distro> (if different from the default version for your target
+      distro. See supported distros and default versions in the distro_version_<distro>
+      definitions in enos-variables.hcl)
+      - vault_artifact_path (the path to where you have a Vault artifact already downloaded,
+      if using `artifact_source:crt` in your filter)
+      - vault_license_path (if using an ENT edition of Vault)
+  EOF
+
   matrix {
     arch            = global.archs
     artifact_source = global.artifact_sources
     artifact_type   = global.artifact_types
     backend         = global.backends
+    config_mode     = global.config_modes
+    consul_edition  = global.consul_editions
     consul_version  = global.consul_versions
     distro          = global.distros
     edition         = global.editions
+    ip_version      = global.ip_versions
     seal            = global.seals
-    seal_ha_beta    = ["true", "false"]
 
-    # Our local builder always creates bundles
+    // Our local builder always creates bundles
     exclude {
       artifact_source = ["local"]
       artifact_type   = ["package"]
     }
 
-    # HSM and FIPS 140-2 are only supported on amd64
+    // PKCS#11 can only be used on ent.hsm and ent.hsm.fips1403.
     exclude {
-      arch    = ["arm64"]
-      edition = ["ent.fips1402", "ent.hsm", "ent.hsm.fips1402"]
+      seal    = ["pkcs11"]
+      edition = [for e in matrix.edition : e if !strcontains(e, "hsm")]
     }
 
-    # PKCS#11 can only be used on ent.hsm and ent.hsm.fips1402.
+    // softhsm packages not available for leap/sles.
     exclude {
-      seal    = ["pkcs11"]
-      edition = ["ce", "ent", "ent.fips1402"]
+      seal   = ["pkcs11"]
+      distro = ["leap", "sles"]
+    }
+
+    // Testing in IPV6 mode is currently implemented for integrated Raft storage only
+    exclude {
+      ip_version = ["6"]
+      backend    = ["consul"]
     }
   }
 
@@ -36,63 +80,64 @@ scenario "agent" {
   terraform     = terraform.default
   providers = [
     provider.aws.default,
-    provider.enos.ubuntu,
-    provider.enos.rhel
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
   ]
 
   locals {
     artifact_path = matrix.artifact_source != "artifactory" ? abspath(var.vault_artifact_path) : null
     enos_provider = {
-      rhel   = provider.enos.rhel
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
       ubuntu = provider.enos.ubuntu
     }
-    manage_service    = matrix.artifact_type == "bundle"
-    vault_install_dir = matrix.artifact_type == "bundle" ? var.vault_install_dir : global.vault_install_dir_packages[matrix.distro]
-  }
-
-  step "get_local_metadata" {
-    skip_step = matrix.artifact_source != "local"
-    module    = module.get_local_metadata
+    manage_service = matrix.artifact_type == "bundle"
   }
 
   step "build_vault" {
-    module = "build_${matrix.artifact_source}"
+    description = global.description.build_vault
+    module      = "build_${matrix.artifact_source}"
 
     variables {
-      build_tags           = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
-      artifact_path        = local.artifact_path
-      goarch               = matrix.arch
-      goos                 = "linux"
-      artifactory_host     = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
-      artifactory_repo     = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
-      artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
-      artifactory_token    = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
-      arch                 = matrix.artifact_source == "artifactory" ? matrix.arch : null
-      product_version      = var.vault_product_version
-      artifact_type        = matrix.artifact_type
-      distro               = matrix.artifact_source == "artifactory" ? matrix.distro : null
-      edition              = matrix.artifact_source == "artifactory" ? matrix.edition : null
-      revision             = var.vault_revision
+      build_tags        = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      artifact_path     = local.artifact_path
+      goarch            = matrix.arch
+      goos              = "linux"
+      artifactory_host  = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
+      artifactory_repo  = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
+      artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
+      arch              = matrix.artifact_source == "artifactory" ? matrix.arch : null
+      product_version   = var.vault_product_version
+      artifact_type     = matrix.artifact_type
+      distro            = matrix.artifact_source == "artifactory" ? matrix.distro : null
+      edition           = matrix.artifact_source == "artifactory" ? matrix.edition : null
+      revision          = var.vault_revision
     }
   }
 
   step "ec2_info" {
-    module = module.ec2_info
+    description = global.description.ec2_info
+    module      = module.ec2_info
   }
 
   step "create_vpc" {
-    module = module.create_vpc
+    description = global.description.create_vpc
+    module      = module.create_vpc
 
     variables {
       common_tags = global.tags
+      ip_version  = matrix.ip_version
     }
   }
 
   // This step reads the contents of the backend license if we're using a Consul backend and
-  // the edition is "ent".
+  // an "ent" Consul edition.
   step "read_backend_license" {
-    skip_step = matrix.backend == "raft" || var.backend_edition == "ce"
-    module    = module.read_license
+    description = global.description.read_backend_license
+    skip_step   = matrix.backend == "raft" || matrix.consul_edition == "ce"
+    module      = module.read_license
 
     variables {
       file_name = global.backend_license_path
@@ -100,8 +145,9 @@ scenario "agent" {
   }
 
   step "read_vault_license" {
-    skip_step = matrix.edition == "ce"
-    module    = module.read_license
+    description = global.description.read_vault_license
+    skip_step   = matrix.edition == "ce"
+    module      = module.read_license
 
     variables {
       file_name = global.vault_license_path
@@ -109,8 +155,9 @@ scenario "agent" {
   }
 
   step "create_seal_key" {
-    module     = "seal_${matrix.seal}"
-    depends_on = [step.create_vpc]
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.seal}"
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
@@ -122,9 +169,27 @@ scenario "agent" {
     }
   }
 
+  step "create_external_integration_target" {
+    description = global.description.create_external_integration_target
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["24.04"]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
   step "create_vault_cluster_targets" {
-    module     = module.target_ec2_instances
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
@@ -140,15 +205,16 @@ scenario "agent" {
   }
 
   step "create_vault_cluster_backend_targets" {
-    module     = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
     variables {
-      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["22.04"]
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
       cluster_tag_key = global.backend_tag_key
       common_tags     = global.tags
       seal_key_names  = step.create_seal_key.resource_names
@@ -156,96 +222,194 @@ scenario "agent" {
     }
   }
 
+  step "set_up_external_integration_target" {
+    description = global.description.set_up_external_integration_target
+    module      = module.set_up_external_integration_target
+    depends_on = [
+      step.create_external_integration_target
+    ]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      hosts      = step.create_external_integration_target.hosts
+      ip_version = matrix.ip_version
+      packages   = concat(global.packages, global.distro_packages["ubuntu"]["24.04"], ["podman", "podman-docker"])
+      ports      = global.integration_host_ports
+    }
+  }
+
   step "create_backend_cluster" {
-    module = "backend_${matrix.backend}"
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.backend}"
     depends_on = [
-      step.create_vault_cluster_backend_targets
+      step.create_vault_cluster_backend_targets,
+      step.set_up_external_integration_target
     ]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_server,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_cli_validate,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_unit,
+      quality.consul_service_systemd_notified,
+    ]
+
     variables {
       cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       cluster_tag_key = global.backend_tag_key
-      license         = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      hosts           = step.create_vault_cluster_backend_targets.hosts
+      license         = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       release = {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = matrix.consul_version
       }
-      target_hosts = step.create_vault_cluster_backend_targets.hosts
     }
   }
 
   step "create_vault_cluster" {
-    module = module.vault_cluster
+    description = global.description.create_vault_cluster
+    module      = module.vault_cluster
     depends_on = [
       step.create_backend_cluster,
       step.build_vault,
-      step.create_vault_cluster_targets
+      step.create_vault_cluster_targets,
+      step.set_up_external_integration_target
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_service_start_client,
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_syslog,
+      quality.vault_audit_socket,
+      quality.vault_autojoin_aws,
+      quality.vault_config_env_variables,
+      quality.vault_config_log_level,
+      quality.vault_config_file,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_init,
+      quality.vault_storage_backend_consul,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_cli_status_exit_code,
+      quality.vault_service_systemd_unit,
+      quality.vault_service_systemd_notified,
+    ]
+
     variables {
       artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
       backend_cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       backend_cluster_tag_key = global.backend_tag_key
       cluster_name            = step.create_vault_cluster_targets.cluster_name
-      consul_license          = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       consul_release = matrix.backend == "consul" ? {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = matrix.consul_version
       } : null
       enable_audit_devices = var.vault_enable_audit_devices
-      install_dir          = local.vault_install_dir
+      hosts                = step.create_vault_cluster_targets.hosts
+      install_dir          = global.vault_install_dir[matrix.artifact_type]
+      ip_version           = matrix.ip_version
       license              = matrix.edition != "ce" ? step.read_vault_license.license : null
       local_artifact_path  = local.artifact_path
       manage_service       = local.manage_service
-      packages             = concat(global.packages, global.distro_packages[matrix.distro])
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
       seal_attributes      = step.create_seal_key.attributes
-      seal_ha_beta         = matrix.seal_ha_beta
       seal_type            = matrix.seal
       storage_backend      = matrix.backend
-      target_hosts         = step.create_vault_cluster_targets.hosts
     }
   }
 
+  step "get_local_metadata" {
+    description = global.description.get_local_metadata
+    skip_step   = matrix.artifact_source != "local"
+    module      = module.get_local_metadata
+  }
+
   // Wait for our cluster to elect a leader
   step "wait_for_leader" {
-    module     = module.vault_wait_for_leader
-    depends_on = [step.create_vault_cluster]
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_vault_cluster]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
     variables {
-      timeout           = 120 # seconds
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "start_vault_agent" {
-    module = "vault_agent"
+    description = global.description.start_vault_agent
+    module      = module.vault_agent
     depends_on = [
       step.build_vault,
       step.create_vault_cluster,
       step.wait_for_leader,
     ]
 
+    verifies = [
+      quality.vault_agent_auto_auth_approle,
+      quality.vault_cli_auth_enable_approle,
+    ]
+
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
     variables {
-      vault_install_dir                = local.vault_install_dir
-      vault_instances                  = step.create_vault_cluster_targets.hosts
+      hosts                            = step.create_vault_cluster_targets.hosts
+      ip_version                       = matrix.ip_version
+      vault_addr                       = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir                = global.vault_install_dir[matrix.artifact_type]
       vault_root_token                 = step.create_vault_cluster.root_token
       vault_agent_template_destination = "/tmp/agent_output.txt"
       vault_agent_template_contents    = "{{ with secret \\\"auth/token/lookup-self\\\" }}orphan={{ .Data.orphan }} display_name={{ .Data.display_name }}{{ end }}"
@@ -260,44 +424,87 @@ scenario "agent" {
       step.wait_for_leader,
     ]
 
+    verifies = quality.vault_agent_log_template
+
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
     variables {
-      vault_instances                  = step.create_vault_cluster_targets.hosts
+      hosts                            = step.create_vault_cluster_targets.hosts
       vault_agent_template_destination = "/tmp/agent_output.txt"
       vault_agent_expected_output      = "orphan=true display_name=approle"
     }
   }
 
   step "get_vault_cluster_ips" {
-    module     = module.vault_get_cluster_ips
-    depends_on = [step.wait_for_leader]
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_leader]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
+  step "verify_vault_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on  = [step.wait_for_leader]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
   step "verify_vault_version" {
-    module     = module.vault_verify_version
-    depends_on = [step.wait_for_leader]
+    description = global.description.verify_vault_version
+    module      = module.vault_verify_version
+    depends_on  = [step.verify_vault_unsealed]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_version_history_keys,
+      quality.vault_api_sys_version_history_key_info,
+      quality.vault_version_build_date,
+      quality.vault_version_edition,
+      quality.vault_version_release,
+    ]
+
     variables {
-      vault_instances       = step.create_vault_cluster_targets.hosts
+      hosts                 = step.create_vault_cluster_targets.hosts
+      vault_addr            = step.create_vault_cluster.api_addr_localhost
       vault_edition         = matrix.edition
-      vault_install_dir     = local.vault_install_dir
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
       vault_product_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
       vault_revision        = matrix.artifact_source == "local" ? step.get_local_metadata.revision : var.vault_revision
       vault_build_date      = matrix.artifact_source == "local" ? step.get_local_metadata.build_date : var.vault_build_date
@@ -305,104 +512,196 @@ scenario "agent" {
     }
   }
 
-  step "verify_vault_unsealed" {
-    module     = module.vault_verify_unsealed
-    depends_on = [step.wait_for_leader]
+  step "verify_secrets_engines_create" {
+    description = global.description.verify_secrets_engines_create
+    module      = module.vault_verify_secrets_engines_create
+    depends_on = [
+      step.verify_vault_unsealed,
+      step.get_vault_cluster_ips
+    ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_auth_userpass_user_write,
+      quality.vault_api_identity_entity_write,
+      quality.vault_api_identity_entity_alias_write,
+      quality.vault_api_identity_group_write,
+      quality.vault_api_identity_oidc_config_write,
+      quality.vault_api_identity_oidc_introspect_write,
+      quality.vault_api_identity_oidc_key_write,
+      quality.vault_api_identity_oidc_key_rotate_write,
+      quality.vault_api_identity_oidc_role_write,
+      quality.vault_api_identity_oidc_token_read,
+      quality.vault_api_sys_auth_userpass_user_write,
+      quality.vault_api_sys_policy_write,
+      quality.vault_mount_auth,
+      quality.vault_mount_kv,
+      quality.vault_secrets_kmip_write_config,
+      quality.vault_secrets_kv_write,
+      quality.vault_secrets_ldap_write_config,
+    ]
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      hosts                  = step.create_vault_cluster_targets.hosts
+      ip_version             = matrix.ip_version
+      integration_host_state = step.set_up_external_integration_target.state
+      leader_host            = step.get_vault_cluster_ips.leader_host
+      ports                  = global.ports
+      ipv4_cidr              = step.create_vpc.ipv4_cidr
+      vault_addr             = step.create_vault_cluster.api_addr_localhost
+      vault_edition          = matrix.edition
+      vault_install_dir      = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token       = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_write_test_data" {
-    module = module.vault_verify_write_data
-    depends_on = [
-      step.create_vault_cluster,
-      step.get_vault_cluster_ips
-    ]
+  step "verify_raft_auto_join_voter" {
+    description = global.description.verify_raft_cluster_all_nodes_are_voters
+    skip_step   = matrix.backend != "raft"
+    module      = module.vault_verify_raft_auto_join_voter
+    depends_on  = [step.verify_vault_unsealed]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_raft_voters
+
     variables {
-      leader_public_ip  = step.get_vault_cluster_ips.leader_public_ip
-      leader_private_ip = step.get_vault_cluster_ips.leader_private_ip
-      vault_instances   = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_raft_auto_join_voter" {
-    skip_step = matrix.backend != "raft"
-    module    = module.vault_verify_raft_auto_join_voter
+  step "verify_replication" {
+    description = global.description.verify_replication_status
+    module      = module.vault_verify_replication
+    depends_on  = [step.verify_vault_unsealed]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_replication_ce_disabled,
+      quality.vault_replication_ent_dr_available,
+      quality.vault_replication_ent_pr_available,
+    ]
+
+    variables {
+      hosts         = step.create_vault_cluster_targets.hosts
+      vault_addr    = step.create_vault_cluster.api_addr_localhost
+      vault_edition = matrix.edition
+    }
+  }
+
+  step "verify_secrets_engines_read" {
+    description = global.description.verify_secrets_engines_read
+    module      = module.vault_verify_secrets_engines_read
     depends_on = [
-      step.create_vault_cluster,
-      step.get_vault_cluster_ips
+      step.verify_secrets_engines_create,
+      step.verify_replication
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_identity_entity_read,
+      quality.vault_api_identity_oidc_config_read,
+      quality.vault_api_identity_oidc_key_read,
+      quality.vault_api_identity_oidc_role_read,
+      quality.vault_secrets_kv_read
+    ]
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_vault_cluster_ips.follower_hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_edition     = matrix.edition
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_replication" {
-    module = module.vault_verify_replication
+  step "verify_log_secrets" {
+    skip_step = !var.vault_enable_audit_devices || !var.verify_log_secrets
+
+    description = global.description.verify_log_secrets
+    module      = module.verify_log_secrets
     depends_on = [
-      step.create_vault_cluster,
-      step.get_vault_cluster_ips
+      step.verify_secrets_engines_read,
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_audit_log_secrets,
+      quality.vault_journal_secrets,
+      quality.vault_radar_index_create,
+      quality.vault_radar_scan_file,
+    ]
+
     variables {
-      vault_edition     = matrix.edition
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      audit_log_file_path = step.create_vault_cluster.audit_device_file_path
+      leader_host         = step.get_vault_cluster_ips.leader_host
+      vault_addr          = step.create_vault_cluster.api_addr_localhost
+      vault_root_token    = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_read_test_data" {
-    module = module.vault_verify_read_data
+  step "verify_secrets_engines_delete" {
+    description = global.description.verify_secrets_engines_delete
+    module      = module.vault_verify_secrets_engines_delete
     depends_on = [
-      step.verify_write_test_data,
-      step.verify_replication
+      step.verify_secrets_engines_create,
+      step.verify_secrets_engines_read
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_ssh_role_delete
+    ]
+
     variables {
-      node_public_ips   = step.get_vault_cluster_ips.follower_public_ips
-      vault_install_dir = local.vault_install_dir
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_vault_cluster_ips.follower_hosts
+      leader_host       = step.get_vault_cluster_ips.leader_host
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "verify_ui" {
-    module     = module.vault_verify_ui
-    depends_on = [step.create_vault_cluster]
+    description = global.description.verify_ui
+    module      = module.vault_verify_ui
+    depends_on  = [step.verify_vault_unsealed]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_ui_assets
+
     variables {
-      vault_instances = step.create_vault_cluster_targets.hosts
+      hosts      = step.create_vault_cluster_targets.hosts
+      vault_addr = step.create_vault_cluster.api_addr_localhost
     }
   }
 
@@ -416,9 +715,14 @@ scenario "agent" {
     value       = step.create_vault_cluster.cluster_name
   }
 
+  output "external_integration_server_ldap" {
+    description = "The LDAP test servers info"
+    value       = step.set_up_external_integration_target.state.ldap
+  }
+
   output "hosts" {
     description = "The Vault cluster target hosts"
-    value       = step.create_vault_cluster.target_hosts
+    value       = step.create_vault_cluster.hosts
   }
 
   output "private_ips" {
@@ -451,6 +755,12 @@ scenario "agent" {
     value       = step.create_vault_cluster.recovery_keys_hex
   }
 
+  output "secrets_engines_state" {
+    description = "The state of configured secrets engines"
+    sensitive   = true
+    value       = step.verify_secrets_engines_create.state
+  }
+
   output "seal_attributes" {
     description = "The Vault cluster seal attributes"
     value       = step.create_seal_key.attributes
diff --git a/enos/enos-scenario-autopilot.hcl b/enos/enos-scenario-autopilot.hcl
index dfa9c646da5..95a49191600 100644
--- a/enos/enos-scenario-autopilot.hcl
+++ b/enos/enos-scenario-autopilot.hcl
@@ -1,38 +1,86 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 scenario "autopilot" {
+  description = <<-EOF
+    The autopilot scenario verifies autopilot upgrades between previously released versions of
+    Vault Enterprise against another candidate build. The build can be a local branch, any CRT built
+    Vault Enterprise artifact saved to the local machine, or any CRT built Vault Enterprise artifact
+    in the stable channel in Artifactory.
+
+    The scenario creates a new Vault Cluster with a previously released version of Vault, mounts
+    various engines and creates data, then perform an Autopilot upgrade with any candidate build.
+    The scenario also performs standard baseline verification that is not specific to the autopilot
+    upgrade.
+
+    # How to run this scenario
+
+    For general instructions on running a scenario, refer to the Enos docs: https://eng-handbook.hashicorp.services/internal-tools/enos/running-a-scenario/
+    For troubleshooting tips and common errors, see https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/.
+
+    Variables required for all scenario variants:
+      - aws_ssh_private_key_path (more info about AWS SSH keypairs: https://eng-handbook.hashicorp.services/internal-tools/enos/getting-started/#set-your-aws-key-pair-name-and-private-key)
+      - aws_ssh_keypair_name
+      - vault_build_date*
+      - vault_product_version
+      - vault_revision*
+
+    * If you don't already know what build date and revision you should be using, see
+    https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
+
+    Variables required for some scenario variants:
+      - artifactory_token (if using `artifact_source:artifactory` in your filter)
+      - aws_region (if different from the default value defined in enos-variables.hcl)
+      - consul_license_path (if using an ENT edition of Consul)
+      - distro_version_<distro> (if different from the default version for your target
+      distro. See supported distros and default versions in the distro_version_<distro>
+      definitions in enos-variables.hcl)
+      - vault_artifact_path (the path to where you have a Vault artifact already downloaded,
+      if using `artifact_source:crt` in your filter)
+      - vault_license_path (if using an ENT edition of Vault)
+      - vault_upgrade_initial_version (if the version you want to start with differs
+      from the default value defined in enos-variables.hcl)
+  EOF
+
   matrix {
     arch            = global.archs
     artifact_source = global.artifact_sources
     artifact_type   = global.artifact_types
+    config_mode     = global.config_modes
     distro          = global.distros
-    edition         = global.editions
-    initial_version = global.upgrade_initial_versions
+    edition         = global.enterprise_editions
+    ip_version      = global.ip_versions
     seal            = global.seals
-    seal_ha_beta    = ["true", "false"]
 
-    # Autopilot wasn't available before 1.11.x
-    exclude {
-      initial_version = ["1.8.12", "1.9.10", "1.10.11"]
-    }
-
-    # Our local builder always creates bundles
+    // Our local builder always creates bundles
     exclude {
       artifact_source = ["local"]
       artifact_type   = ["package"]
     }
 
-    # HSM and FIPS 140-2 are only supported on amd64
+    // There are no published versions of these artifacts yet. We'll update this to exclude older
+    // versions after our initial publication of these editions for arm64.
     exclude {
       arch    = ["arm64"]
-      edition = ["ent.fips1402", "ent.hsm", "ent.hsm.fips1402"]
+      edition = ["ent.fips1403", "ent.hsm", "ent.hsm.fips1403"]
     }
 
-    # PKCS#11 can only be used on ent.hsm and ent.hsm.fips1402.
+    // PKCS#11 can only be used on ent.hsm and ent.hsm.fips1403.
     exclude {
       seal    = ["pkcs11"]
-      edition = ["ce", "ent", "ent.fips1402"]
+      edition = [for e in matrix.edition : e if !strcontains(e, "hsm")]
+    }
+
+    // softhsm packages not available for leap/sles.
+    exclude {
+      seal   = ["pkcs11"]
+      distro = ["leap", "sles"]
+    }
+
+    // Testing in IPV6 mode is currently implemented for integrated Raft storage only
+    exclude {
+      ip_version = ["6"]
+      backend    = ["consul"]
     }
   }
 
@@ -40,56 +88,63 @@ scenario "autopilot" {
   terraform     = terraform.default
   providers = [
     provider.aws.default,
-    provider.enos.ubuntu,
-    provider.enos.rhel
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
   ]
 
   locals {
     artifact_path = matrix.artifact_source != "artifactory" ? abspath(var.vault_artifact_path) : null
     enos_provider = {
-      rhel   = provider.enos.rhel
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
       ubuntu = provider.enos.ubuntu
     }
     manage_service                     = matrix.artifact_type == "bundle"
-    vault_install_dir                  = matrix.artifact_type == "bundle" ? var.vault_install_dir : global.vault_install_dir_packages[matrix.distro]
-    vault_autopilot_default_max_leases = semverconstraint(matrix.initial_version, ">=1.16.0-0") ? "300000" : ""
+    vault_install_dir                  = global.vault_install_dir[matrix.artifact_type]
+    vault_autopilot_default_max_leases = semverconstraint(var.vault_upgrade_initial_version, ">=1.16.0-0") ? "300000" : ""
   }
 
   step "build_vault" {
-    module = "build_${matrix.artifact_source}"
+    description = global.description.build_vault
+    module      = "build_${matrix.artifact_source}"
 
     variables {
-      build_tags           = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
-      artifact_path        = local.artifact_path
-      goarch               = matrix.arch
-      goos                 = "linux"
-      artifactory_host     = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
-      artifactory_repo     = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
-      artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
-      artifactory_token    = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
-      arch                 = matrix.artifact_source == "artifactory" ? matrix.arch : null
-      product_version      = var.vault_product_version
-      artifact_type        = matrix.artifact_type
-      distro               = matrix.artifact_source == "artifactory" ? matrix.distro : null
-      edition              = matrix.artifact_source == "artifactory" ? matrix.edition : null
-      revision             = var.vault_revision
+      build_tags        = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      artifact_path     = local.artifact_path
+      goarch            = matrix.arch
+      goos              = "linux"
+      artifactory_host  = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
+      artifactory_repo  = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
+      artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
+      arch              = matrix.artifact_source == "artifactory" ? matrix.arch : null
+      product_version   = var.vault_product_version
+      artifact_type     = matrix.artifact_type
+      distro            = matrix.artifact_source == "artifactory" ? matrix.distro : null
+      edition           = matrix.artifact_source == "artifactory" ? matrix.edition : null
+      revision          = var.vault_revision
     }
   }
 
   step "ec2_info" {
-    module = module.ec2_info
+    description = global.description.ec2_info
+    module      = module.ec2_info
   }
 
   step "create_vpc" {
-    module = module.create_vpc
+    description = global.description.create_vpc
+    module      = module.create_vpc
 
     variables {
       common_tags = global.tags
+      ip_version  = matrix.ip_version
     }
   }
 
   step "read_license" {
-    module = module.read_license
+    description = global.description.read_vault_license
+    module      = module.read_license
 
     variables {
       file_name = global.vault_license_path
@@ -97,8 +152,9 @@ scenario "autopilot" {
   }
 
   step "create_seal_key" {
-    module     = "seal_${matrix.seal}"
-    depends_on = [step.create_vpc]
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.seal}"
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
@@ -110,9 +166,27 @@ scenario "autopilot" {
     }
   }
 
+  step "create_external_integration_target" {
+    description = global.description.create_external_integration_target
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["24.04"]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
   step "create_vault_cluster_targets" {
-    module     = module.target_ec2_instances
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
@@ -122,102 +196,240 @@ scenario "autopilot" {
       ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
       cluster_tag_key = global.vault_tag_key
       common_tags     = global.tags
+      instance_count  = 3
       seal_key_names  = step.create_seal_key.resource_names
       vpc_id          = step.create_vpc.id
     }
   }
 
   step "create_vault_cluster_upgrade_targets" {
-    module     = module.target_ec2_instances
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
     variables {
-      ami_id         = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
-      common_tags    = global.tags
-      cluster_name   = step.create_vault_cluster_targets.cluster_name
-      seal_key_names = step.create_seal_key.resource_names
-      vpc_id         = step.create_vpc.id
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      common_tags     = global.tags
+      cluster_name    = step.create_vault_cluster_targets.cluster_name
+      cluster_tag_key = global.vault_tag_key
+      instance_count  = 3
+      seal_key_names  = step.create_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "set_up_external_integration_target" {
+    description = global.description.set_up_external_integration_target
+    module      = module.set_up_external_integration_target
+    depends_on = [
+      step.create_external_integration_target
+    ]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      hosts      = step.create_external_integration_target.hosts
+      ip_version = matrix.ip_version
+      packages   = concat(global.packages, global.distro_packages["ubuntu"]["24.04"], ["podman", "podman-docker"])
+      ports      = global.integration_host_ports
     }
   }
 
   step "create_vault_cluster" {
+    description = <<-EOF
+      ${global.description.create_vault_cluster} In this instance we'll create a Vault Cluster with
+      and older version and use Autopilot to upgrade to it.
+    EOF
+
     module = module.vault_cluster
     depends_on = [
       step.build_vault,
-      step.create_vault_cluster_targets
+      step.create_vault_cluster_targets,
+      step.set_up_external_integration_target
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      // verified in modules
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_socket,
+      quality.vault_audit_syslog,
+      quality.vault_autojoin_aws,
+      quality.vault_config_env_variables,
+      quality.vault_config_file,
+      quality.vault_config_log_level,
+      quality.vault_init,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_storage_backend_consul,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_cli_status_exit_code,
+      quality.vault_service_systemd_notified,
+      quality.vault_service_systemd_unit,
+    ]
+
     variables {
       cluster_name         = step.create_vault_cluster_targets.cluster_name
+      config_mode          = matrix.config_mode
       enable_audit_devices = var.vault_enable_audit_devices
+      hosts                = step.create_vault_cluster_targets.hosts
       install_dir          = local.vault_install_dir
+      ip_version           = matrix.ip_version
       license              = matrix.edition != "ce" ? step.read_license.license : null
-      packages             = concat(global.packages, global.distro_packages[matrix.distro])
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
       release = {
-        edition = matrix.edition
-        version = matrix.initial_version
+        edition = strcontains(matrix.edition, "fips1403") ? (
+          // Handle mixed fips1402 edition lineages.
+          semverconstraint(var.vault_upgrade_initial_version, "<1.19.4-0,>=1.19.0-0 || <1.18.15-0,>=1.18.0-0 || <1.18.0,>=1.17.0-0 || <1.16.26-0")
+          ? replace(matrix.edition, "fips1403", "fips1402")
+          : matrix.edition
+        ) : matrix.edition
+        version = var.vault_upgrade_initial_version
       }
       seal_attributes = step.create_seal_key.attributes
-      seal_ha_beta    = matrix.seal_ha_beta
       seal_type       = matrix.seal
       storage_backend = "raft"
       storage_backend_addl_config = {
-        autopilot_upgrade_version = matrix.initial_version
+        autopilot_upgrade_version = var.vault_upgrade_initial_version
       }
-      target_hosts = step.create_vault_cluster_targets.hosts
     }
   }
 
   step "get_local_metadata" {
-    skip_step = matrix.artifact_source != "local"
-    module    = module.get_local_metadata
+    description = global.description.get_local_metadata
+    skip_step   = matrix.artifact_source != "local"
+    module      = module.get_local_metadata
   }
 
-  step "get_vault_cluster_ips" {
-    module     = module.vault_get_cluster_ips
-    depends_on = [step.create_vault_cluster]
+  // Wait for our cluster to elect a leader
+  step "wait_for_leader" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_vault_cluster]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster.target_hosts
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
       vault_install_dir = local.vault_install_dir
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_write_test_data" {
-    module = module.vault_verify_write_data
+  step "get_vault_cluster_ips" {
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
     depends_on = [
       step.create_vault_cluster,
-      step.get_vault_cluster_ips
+      step.wait_for_leader,
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
     variables {
-      leader_public_ip  = step.get_vault_cluster_ips.leader_public_ip
-      leader_private_ip = step.get_vault_cluster_ips.leader_private_ip
-      vault_instances   = step.create_vault_cluster.target_hosts
+      hosts             = step.create_vault_cluster.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
       vault_install_dir = local.vault_install_dir
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
+  step "verify_secrets_engines_create" {
+    description = global.description.verify_secrets_engines_create
+    module      = module.vault_verify_secrets_engines_create
+    depends_on = [
+      step.create_vault_cluster,
+      step.get_vault_cluster_ips
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_auth_userpass_user_write,
+      quality.vault_api_identity_entity_write,
+      quality.vault_api_identity_entity_alias_write,
+      quality.vault_api_identity_group_write,
+      quality.vault_api_identity_oidc_config_write,
+      quality.vault_api_identity_oidc_introspect_write,
+      quality.vault_api_identity_oidc_key_write,
+      quality.vault_api_identity_oidc_key_rotate_write,
+      quality.vault_api_identity_oidc_role_write,
+      quality.vault_api_identity_oidc_token_read,
+      quality.vault_api_sys_auth_userpass_user_write,
+      quality.vault_api_sys_policy_write,
+      quality.vault_mount_auth,
+      quality.vault_mount_kv,
+      quality.vault_secrets_kmip_write_config,
+      quality.vault_secrets_kv_write,
+      quality.vault_secrets_ldap_write_config,
+    ]
+
+    variables {
+      hosts                  = step.create_vault_cluster.hosts
+      ip_version             = matrix.ip_version
+      integration_host_state = step.set_up_external_integration_target.state
+      leader_host            = step.get_vault_cluster_ips.leader_host
+      ports                  = global.ports
+      ipv4_cidr              = step.create_vpc.ipv4_cidr
+      vault_addr             = step.create_vault_cluster.api_addr_localhost
+      vault_edition          = matrix.edition
+      vault_install_dir      = local.vault_install_dir
+      vault_root_token       = step.create_vault_cluster.root_token
+    }
+  }
+
   step "create_autopilot_upgrade_storageconfig" {
-    module = module.autopilot_upgrade_storageconfig
+    description = <<-EOF
+      An arithmetic module used to dynamically create autopilot storage configuration depending on
+      whether or not we're testing a local build or a candidate build.
+    EOF
+    module      = module.autopilot_upgrade_storageconfig
 
     variables {
       vault_product_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
@@ -230,7 +442,7 @@ scenario "autopilot" {
       step.build_vault,
       step.create_vault_cluster,
       step.create_autopilot_upgrade_storageconfig,
-      step.verify_write_test_data
+      step.verify_secrets_engines_create
     ]
 
     providers = {
@@ -239,30 +451,32 @@ scenario "autopilot" {
 
     variables {
       artifactory_release         = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
-      enable_audit_devices        = var.vault_enable_audit_devices
       cluster_name                = step.create_vault_cluster_targets.cluster_name
-      log_level                   = var.vault_log_level
+      config_mode                 = matrix.config_mode
+      enable_audit_devices        = var.vault_enable_audit_devices
       force_unseal                = matrix.seal == "shamir"
+      hosts                       = step.create_vault_cluster_upgrade_targets.hosts
       initialize_cluster          = false
       install_dir                 = local.vault_install_dir
+      ip_version                  = matrix.ip_version
       license                     = matrix.edition != "ce" ? step.read_license.license : null
       local_artifact_path         = local.artifact_path
+      log_level                   = var.vault_log_level
       manage_service              = local.manage_service
-      packages                    = concat(global.packages, global.distro_packages[matrix.distro])
+      packages                    = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
       root_token                  = step.create_vault_cluster.root_token
-      seal_ha_beta                = matrix.seal_ha_beta
       seal_attributes             = step.create_seal_key.attributes
       seal_type                   = matrix.seal
       shamir_unseal_keys          = matrix.seal == "shamir" ? step.create_vault_cluster.unseal_keys_hex : null
       storage_backend             = "raft"
       storage_backend_addl_config = step.create_autopilot_upgrade_storageconfig.storage_addl_config
       storage_node_prefix         = "upgrade_node"
-      target_hosts                = step.create_vault_cluster_upgrade_targets.hosts
     }
   }
 
   step "verify_vault_unsealed" {
-    module = module.vault_verify_unsealed
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.create_vault_cluster,
       step.create_vault_cluster_upgrade_targets,
@@ -273,14 +487,23 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_auto_unseals_after_autopilot_upgrade,
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
     variables {
+      hosts             = step.upgrade_vault_cluster_with_autopilot.hosts
+      vault_addr        = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
       vault_install_dir = local.vault_install_dir
-      vault_instances   = step.upgrade_vault_cluster_with_autopilot.target_hosts
     }
   }
 
   step "verify_raft_auto_join_voter" {
-    module = module.vault_verify_raft_auto_join_voter
+    description = global.description.verify_raft_cluster_all_nodes_are_voters
+    module      = module.vault_verify_raft_auto_join_voter
     depends_on = [
       step.upgrade_vault_cluster_with_autopilot,
       step.verify_vault_unsealed
@@ -290,15 +513,20 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_raft_voters
+
     variables {
+      hosts             = step.upgrade_vault_cluster_with_autopilot.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
       vault_install_dir = local.vault_install_dir
-      vault_instances   = step.upgrade_vault_cluster_with_autopilot.target_hosts
       vault_root_token  = step.upgrade_vault_cluster_with_autopilot.root_token
     }
   }
 
   step "verify_autopilot_await_server_removal_state" {
-    module = module.vault_verify_autopilot
+    description = global.description.verify_autopilot_idle_state
+    module      = module.vault_verify_autopilot
     depends_on = [
       step.create_vault_cluster_upgrade_targets,
       step.upgrade_vault_cluster_with_autopilot,
@@ -309,17 +537,24 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_storage_raft_autopilot_upgrade_info_read_status_matches,
+      quality.vault_api_sys_storage_raft_autopilot_upgrade_info_target_version_read_matches_candidate,
+    ]
+
     variables {
+      hosts                           = step.create_vault_cluster.hosts
+      vault_addr                      = step.create_vault_cluster.api_addr_localhost
       vault_autopilot_upgrade_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
       vault_autopilot_upgrade_status  = "await-server-removal"
       vault_install_dir               = local.vault_install_dir
-      vault_instances                 = step.create_vault_cluster.target_hosts
       vault_root_token                = step.upgrade_vault_cluster_with_autopilot.root_token
     }
   }
 
   step "wait_for_leader_in_upgrade_targets" {
-    module = module.vault_wait_for_leader
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
     depends_on = [
       step.create_vault_cluster,
       step.create_vault_cluster_upgrade_targets,
@@ -331,15 +566,24 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_autopilot_upgrade_leader_election,
+    ]
+
     variables {
+      hosts             = step.upgrade_vault_cluster_with_autopilot.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
       vault_install_dir = local.vault_install_dir
       vault_root_token  = step.create_vault_cluster.root_token
-      vault_hosts       = step.upgrade_vault_cluster_with_autopilot.target_hosts
     }
   }
 
   step "get_updated_vault_cluster_ips" {
-    module = module.vault_get_cluster_ips
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
     depends_on = [
       step.create_vault_cluster,
       step.create_vault_cluster_upgrade_targets,
@@ -352,18 +596,27 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
     variables {
-      vault_hosts       = step.upgrade_vault_cluster_with_autopilot.target_hosts
+      hosts             = step.upgrade_vault_cluster_with_autopilot.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
       vault_install_dir = local.vault_install_dir
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_read_test_data" {
-    module = module.vault_verify_read_data
+  step "verify_secrets_engines_read" {
+    description = global.description.verify_secrets_engines_read
+    module      = module.vault_verify_secrets_engines_read
     depends_on = [
       step.get_updated_vault_cluster_ips,
-      step.verify_write_test_data,
+      step.verify_secrets_engines_create,
       step.upgrade_vault_cluster_with_autopilot,
       step.verify_raft_auto_join_voter
     ]
@@ -372,15 +625,85 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_identity_entity_read,
+      quality.vault_api_identity_oidc_config_read,
+      quality.vault_api_identity_oidc_key_read,
+      quality.vault_api_identity_oidc_role_read,
+      quality.vault_secrets_kv_read
+    ]
+
+    variables {
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_updated_vault_cluster_ips.follower_hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
+      vault_edition     = matrix.edition
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "verify_log_secrets" {
+    skip_step = !var.vault_enable_audit_devices || !var.verify_log_secrets
+
+    description = global.description.verify_log_secrets
+    module      = module.verify_log_secrets
+    depends_on = [
+      step.verify_secrets_engines_read,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_audit_log_secrets,
+      quality.vault_journal_secrets,
+      quality.vault_radar_index_create,
+      quality.vault_radar_scan_file,
+    ]
+
+    variables {
+      audit_log_file_path = step.create_vault_cluster.audit_device_file_path
+      leader_host         = step.get_updated_vault_cluster_ips.leader_host
+      vault_addr          = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
+      vault_root_token    = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "verify_secrets_engines_delete" {
+    description = global.description.verify_secrets_engines_delete
+    module      = module.vault_verify_secrets_engines_delete
+    depends_on = [
+      step.verify_secrets_engines_create,
+      step.verify_secrets_engines_read
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_ssh_role_delete
+    ]
+
     variables {
-      node_public_ips      = step.get_updated_vault_cluster_ips.follower_public_ips
-      vault_instance_count = 6
-      vault_install_dir    = local.vault_install_dir
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_updated_vault_cluster_ips.follower_hosts
+      leader_host       = step.get_updated_vault_cluster_ips.leader_host
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "raft_remove_peers" {
-    module = module.vault_raft_remove_peer
+    description = <<-EOF
+      Remove the nodes that were running the prior version of Vault from the raft cluster
+    EOF
+    module      = module.vault_raft_remove_peer
     depends_on = [
       step.create_vault_cluster_upgrade_targets,
       step.get_updated_vault_cluster_ips,
@@ -392,20 +715,66 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_storage_raft_remove_peer_write_removes_peer,
+      quality.vault_cli_operator_raft_remove_peer,
+    ]
+
     variables {
-      operator_instance      = step.get_updated_vault_cluster_ips.leader_public_ip
-      remove_vault_instances = step.create_vault_cluster.target_hosts
-      vault_install_dir      = local.vault_install_dir
-      vault_instance_count   = 3
-      vault_root_token       = step.create_vault_cluster.root_token
+      hosts                   = step.create_vault_cluster.hosts
+      ip_version              = matrix.ip_version
+      operator_instance       = step.get_updated_vault_cluster_ips.leader_public_ip
+      vault_addr              = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
+      vault_cluster_addr_port = step.upgrade_vault_cluster_with_autopilot.cluster_port
+      vault_install_dir       = local.vault_install_dir
+      vault_root_token        = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "verify_raft_node_removed" {
+    description = <<-EOF
+      Verify that the removed nodes are marked as such
+    EOF
+    module      = semverconstraint(var.vault_upgrade_initial_version, ">=1.19.0-0") ? "vault_verify_removed_node" : "vault_verify_removed_node_shim"
+    depends_on = [
+      step.create_vault_cluster,
+      step.create_vault_cluster_targets,
+      step.get_updated_vault_cluster_ips,
+      step.raft_remove_peers,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_raft_removed_after_restart,
+      quality.vault_raft_removed_statuses,
+      quality.vault_raft_removed_cant_rejoin,
+    ]
+
+    variables {
+      add_back_nodes    = false
+      cluster_port      = step.create_vault_cluster.cluster_port
+      hosts             = step.create_vault_cluster.hosts
+      ip_version        = matrix.ip_version
+      listener_port     = step.create_vault_cluster.listener_port
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_leader_host = step.get_updated_vault_cluster_ips.leader_host
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_root_token  = step.create_vault_cluster.root_token
+      vault_seal_type   = matrix.seal
+      vault_unseal_keys = matrix.seal == "shamir" ? step.create_vault_cluster.unseal_keys_hex : null
     }
   }
 
   step "remove_old_nodes" {
-    module = module.shutdown_multiple_nodes
+    description = global.description.shutdown_nodes
+    module      = module.shutdown_multiple_nodes
     depends_on = [
       step.create_vault_cluster,
-      step.raft_remove_peers
+      step.raft_remove_peers,
+      step.verify_raft_node_removed,
     ]
 
     providers = {
@@ -413,13 +782,13 @@ scenario "autopilot" {
     }
 
     variables {
-      old_vault_instances  = step.create_vault_cluster.target_hosts
-      vault_instance_count = 3
+      old_hosts = step.create_vault_cluster.hosts
     }
   }
 
   step "verify_autopilot_idle_state" {
-    module = module.vault_verify_autopilot
+    description = global.description.verify_autopilot_idle_state
+    module      = module.vault_verify_autopilot
     depends_on = [
       step.create_vault_cluster_upgrade_targets,
       step.upgrade_vault_cluster_with_autopilot,
@@ -431,17 +800,24 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_storage_raft_autopilot_upgrade_info_read_status_matches,
+      quality.vault_api_sys_storage_raft_autopilot_upgrade_info_target_version_read_matches_candidate,
+    ]
+
     variables {
+      hosts                           = step.upgrade_vault_cluster_with_autopilot.hosts
+      vault_addr                      = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
       vault_autopilot_upgrade_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
       vault_autopilot_upgrade_status  = "idle"
       vault_install_dir               = local.vault_install_dir
-      vault_instances                 = step.upgrade_vault_cluster_with_autopilot.target_hosts
       vault_root_token                = step.create_vault_cluster.root_token
     }
   }
 
   step "verify_replication" {
-    module = module.vault_verify_replication
+    description = global.description.verify_replication_status
+    module      = module.vault_verify_replication
     depends_on = [
       step.create_vault_cluster_upgrade_targets,
       step.upgrade_vault_cluster_with_autopilot,
@@ -453,15 +829,22 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_replication_ce_disabled,
+      quality.vault_replication_ent_dr_available,
+      quality.vault_replication_ent_pr_available,
+    ]
+
     variables {
-      vault_edition     = matrix.edition
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.upgrade_vault_cluster_with_autopilot.target_hosts
+      hosts         = step.upgrade_vault_cluster_with_autopilot.hosts
+      vault_addr    = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
+      vault_edition = matrix.edition
     }
   }
 
   step "verify_vault_version" {
-    module = module.vault_verify_version
+    description = global.description.verify_vault_version
+    module      = module.vault_verify_version
     depends_on = [
       step.create_vault_cluster_upgrade_targets,
       step.upgrade_vault_cluster_with_autopilot,
@@ -473,8 +856,17 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_version_history_keys,
+      quality.vault_api_sys_version_history_key_info,
+      quality.vault_version_build_date,
+      quality.vault_version_edition,
+      quality.vault_version_release,
+    ]
+
     variables {
-      vault_instances       = step.upgrade_vault_cluster_with_autopilot.target_hosts
+      hosts                 = step.upgrade_vault_cluster_with_autopilot.hosts
+      vault_addr            = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
       vault_edition         = matrix.edition
       vault_install_dir     = local.vault_install_dir
       vault_product_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
@@ -485,7 +877,8 @@ scenario "autopilot" {
   }
 
   step "verify_ui" {
-    module = module.vault_verify_ui
+    description = global.description.verify_ui
+    module      = module.vault_verify_ui
     depends_on = [
       step.create_vault_cluster_upgrade_targets,
       step.upgrade_vault_cluster_with_autopilot,
@@ -497,16 +890,22 @@ scenario "autopilot" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_ui_assets
+
     variables {
-      vault_instances = step.upgrade_vault_cluster_with_autopilot.target_hosts
+      hosts      = step.upgrade_vault_cluster_with_autopilot.hosts
+      vault_addr = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
     }
   }
 
-  step "verify_undo_logs_status" {
-    skip_step = true
-    # NOTE: temporarily disable undo logs checking until it is fixed. See VAULT-20259
-    # skip_step = semverconstraint(var.vault_product_version, "<1.13.0-0")
-    module = module.vault_verify_undo_logs
+  step "verify_undo_logs_enabled_on_primary" {
+    skip_step   = semverconstraint(var.vault_product_version, "<1.13.0-0")
+    module      = module.vault_verify_undo_logs
+    description = <<-EOF
+      Verifies that undo logs is correctly enabled on newly upgraded target hosts. For this it will
+      query the metrics system backend for the vault.core.replication.write_undo_logs gauge.
+    EOF
+
     depends_on = [
       step.create_vault_cluster_upgrade_targets,
       step.remove_old_nodes,
@@ -514,20 +913,48 @@ scenario "autopilot" {
       step.verify_autopilot_idle_state
     ]
 
+    verifies = quality.vault_api_sys_metrics_vault_core_replication_write_undo_logs_enabled
+
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
     variables {
+      expected_state    = 1 # Enabled
+      hosts             = step.get_updated_vault_cluster_ips.leader_hosts
+      timeout           = 180 # Seconds
+      vault_addr        = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
       vault_install_dir = local.vault_install_dir
-      vault_instances   = step.upgrade_vault_cluster_with_autopilot.target_hosts
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  # Verify that upgrading from a version <1.16.0 does not introduce Default LCQ
+  step "verify_undo_logs_disabled_on_followers" {
+    skip_step  = semverconstraint(var.vault_product_version, "<1.13.0-0")
+    module     = module.vault_verify_undo_logs
+    depends_on = [step.verify_undo_logs_enabled_on_primary]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      expected_state    = 0 # Disabled
+      hosts             = step.get_updated_vault_cluster_ips.follower_hosts
+      timeout           = 10 # Seconds
+      vault_addr        = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  // Verify that upgrading from a version <1.16.0 does not introduce Default LCQ
   step "verify_default_lcq" {
-    module = module.vault_verify_default_lcq
+    description = <<-EOF
+      Verify that the default max lease count is 300,000 when the upgraded nodes are running
+      Vault >= 1.16.0.
+    EOF
+    module      = module.vault_verify_default_lcq
     depends_on = [
       step.create_vault_cluster_upgrade_targets,
       step.remove_old_nodes,
@@ -535,12 +962,15 @@ scenario "autopilot" {
       step.verify_autopilot_idle_state
     ]
 
+    verifies = quality.vault_api_sys_quotas_lease_count_read_max_leases_default
+
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
     variables {
-      vault_instances                    = step.upgrade_vault_cluster_with_autopilot.target_hosts
+      hosts                              = step.upgrade_vault_cluster_with_autopilot.hosts
+      vault_addr                         = step.upgrade_vault_cluster_with_autopilot.api_addr_localhost
       vault_root_token                   = step.create_vault_cluster.root_token
       vault_autopilot_default_max_leases = local.vault_autopilot_default_max_leases
     }
@@ -551,6 +981,16 @@ scenario "autopilot" {
     value       = step.create_vault_cluster.audit_device_file_path
   }
 
+  output "external_integration_server_ldap" {
+    description = "The LDAP test servers info"
+    value       = step.set_up_external_integration_target.state.ldap
+  }
+
+  output "integration_host_kmip_state" {
+    description = "The KMIP test servers info"
+    value       = step.set_up_external_integration_target.state.kmip
+  }
+
   output "cluster_name" {
     description = "The Vault cluster name"
     value       = step.create_vault_cluster.cluster_name
@@ -558,7 +998,7 @@ scenario "autopilot" {
 
   output "hosts" {
     description = "The Vault cluster target hosts"
-    value       = step.create_vault_cluster.target_hosts
+    value       = step.create_vault_cluster.hosts
   }
 
   output "private_ips" {
@@ -591,6 +1031,12 @@ scenario "autopilot" {
     value       = step.create_vault_cluster.recovery_keys_hex
   }
 
+  output "secrets_engines_state" {
+    description = "The state of configured secrets engines"
+    sensitive   = true
+    value       = step.verify_secrets_engines_create.state
+  }
+
   output "seal_attributes" {
     description = "The Vault cluster seal attributes"
     value       = step.create_seal_key.attributes
@@ -608,7 +1054,7 @@ scenario "autopilot" {
 
   output "upgrade_hosts" {
     description = "The Vault cluster target hosts"
-    value       = step.upgrade_vault_cluster_with_autopilot.target_hosts
+    value       = step.upgrade_vault_cluster_with_autopilot.hosts
   }
 
   output "upgrade_private_ips" {
diff --git a/enos/enos-scenario-benchmark.hcl b/enos/enos-scenario-benchmark.hcl
new file mode 100644
index 00000000000..40a45eebd34
--- /dev/null
+++ b/enos/enos-scenario-benchmark.hcl
@@ -0,0 +1,583 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+scenario "benchmark" {
+  description = <<-EOF
+    The benchmark scenario creates the required infrastructure to run performance tests against a Vault cluster.
+    A three node Vault cluster is created, along with two additional nodes: one to run prometheus and grafana,
+    and one to run k6, the load generation tool.
+
+    If you've never used Enos before, it's worth noting that the matrix parameters act as filters. You can view a full
+    list of all possible values in enos-globals.hcl. If a matrix parameter listed below is not specified when you run
+    the Enos scenario, then all possible parameters are used. For example, if you don't specify `backend` then this
+    scenario will run for both raft and consul, because those are the two possible values listed for `backends`.
+    Specifying backend:raft will only run the scenario for raft. Specifying backend:consul will create a three node
+    Consul cluster and connect it to Vault.
+
+    If you want to run your benchmarks against a released version of Vault, you can download the Vault release tarball
+    from releases.hashicorp.com, place it inside the 'support' subdirectory (sometimes you have to create this, as
+    it's git-ignored), and specify artifact_source:crt. You also need to add that path to enos-local.vars.hcl as:
+
+    vault_artifact_path = "./support/vault_1.20.0_linux_amd64.zip"
+
+    Substitute in your own actual file name. If you wish to run your benchmarks against your local Vault branch,
+    specify artifact_source:local.
+
+    Often times, when running benchmarks, you're wanting to run one very specific scenario, instead of running
+    many possible scenarios at once. One example of this from the CLI would be:
+
+    enos scenario launch benchmark config_mode:file artifact_source:crt artifact_type:bundle seal:awskms ip_version:4 consul_version:1.20.6 edition:ent consul_edition:ent backend:consul
+
+    This would run exactly 1 scenario, since I've specified every possible matrix parameter. This is what I used when
+    running Consul/IS benchmarks.
+
+    Also note that as of this writing, this scenario does not do automatic benchmarking, results gathering, etc. It's
+    manual. That means this scenario is (as of right now) meant to be run as `enos scenario launch` (plus the scenario
+    name and matrix parameters, as outlined above) _not_ `enos scenario run`. This also means that when you're done
+    running your benchmarks, you need to manually destroy the infrastructure with `enos scenario destroy`.
+
+    If you're going to use an enterprise Consul backend, you'll need to specify the path to a Consul license file under
+    the `backend_license_path` variable in the enos-local.vars.hcl file.
+
+    The benchmark module that implements much of the actual benchmark logic has subdirectories for grafana dashboards
+    that will get automatically uploaded and installed, as well as k6 templates for different benchmarking scenarios.
+
+    It's worth mentioning that by default we've configured IOPS of the underlying storage volume to 16k. This is below
+    the maximum but allows us to create 6 machines and stay below the 100,000 limit in AWS accounts. If you test with
+    raft storage you can increase the IOPs to 24k, but beware that consul storage will need to stay at 16k unless you
+    get an exception for the account from AWS. When I ran these benchmarks, I requested a quota increase from AWS for
+    more IOPs, which is how I was able to run this scenario successfully. You may need to do the same, or if you're not
+    benchmarking Consul's raw performance specifically, you can adjust some of the disk parameters in the
+    create_vault_cluster_backend_targets to provision less IOPs, or use io1 instead of io2, etc.
+
+    Once the scenario has been launched, and everything has finished, grab the public IP of the metrics node and open
+    it in a browser on port 3000. Log into grafana with admin/admin and choose whatever dashboard you wish to see.
+    All of the ones in the grafana-dashboards subdirectory will be available. Then SSH into the public IP of the k6
+    node and run scenarios via the k6-run.sh shell script, e.g. `./k6-run.sh kvv2`. The argument you pass it should
+    match the basename, minus the k6- of the corresponding file in the k6-templates directory, e.g. for the above it
+    would match k6-kvv2-js.tpl.
+
+    When you're done getting the results from your grafana dashboard, destroy the infrastructure with `enos destroy`.
+  EOF
+
+  // The arch and distro is hardcoded here for expediency. We need to install prometheus, grafana, k6, and
+  // the prometheus node exporter. Some of those packages were not available via normal package managers and
+  // had to be installed from source. Doing that for 1 arch and 1 distro was sufficient for our needs and a
+  // lot easier than doing it for all possible combinations. If you need additional arch/distro combinations,
+  // feel free to check out the installation shell scripts in the benchmark module and update them as necessary.
+  matrix {
+    arch            = ["amd64"]
+    artifact_source = global.artifact_sources
+    artifact_type   = global.artifact_types
+    backend         = global.backends
+    config_mode     = global.config_modes
+    consul_edition  = global.consul_editions
+    consul_version  = global.consul_versions
+    distro          = ["ubuntu"]
+    edition         = global.editions
+    ip_version      = global.ip_versions
+    seal            = global.seals
+
+    // Our local builder always creates bundles
+    exclude {
+      artifact_source = ["local"]
+      artifact_type   = ["package"]
+    }
+
+    // PKCS#11 can only be used on ent.hsm and ent.hsm.fips1402.
+    exclude {
+      seal    = ["pkcs11"]
+      edition = [for e in matrix.edition : e if !strcontains(e, "hsm")]
+    }
+
+    // softhsm packages not available for leap/sles.
+    exclude {
+      seal   = ["pkcs11"]
+      distro = ["leap", "sles"]
+    }
+
+    // Testing in IPV6 mode is currently implemented for integrated Raft storage only
+    exclude {
+      ip_version = ["6"]
+      backend    = ["consul"]
+    }
+  }
+
+  terraform_cli = terraform_cli.default
+  terraform     = terraform.default
+  providers = [
+    provider.aws.default,
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
+  ]
+
+  locals {
+    artifact_path = matrix.artifact_source != "artifactory" ? abspath(var.vault_artifact_path) : null
+    enos_provider = {
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
+      ubuntu = provider.enos.ubuntu
+    }
+    manage_service = matrix.artifact_type == "bundle"
+  }
+
+  step "build_vault" {
+    description = global.description.build_vault
+    module      = "build_${matrix.artifact_source}"
+
+    variables {
+      build_tags        = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      artifact_path     = local.artifact_path
+      goarch            = matrix.arch
+      goos              = "linux"
+      artifactory_host  = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
+      artifactory_repo  = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
+      artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
+      arch              = matrix.artifact_source == "artifactory" ? matrix.arch : null
+      product_version   = var.vault_product_version
+      artifact_type     = matrix.artifact_type
+      distro            = matrix.artifact_source == "artifactory" ? matrix.distro : null
+      edition           = matrix.artifact_source == "artifactory" ? matrix.edition : null
+      revision          = var.vault_revision
+    }
+  }
+
+  step "benchmark_config" {
+    description = "Get our configuration for our benchmark modules"
+    module      = module.benchmark_config
+
+    variables {
+      ports_ingress = values(global.ports)
+    }
+  }
+
+  step "ec2_info" {
+    description = global.description.ec2_info
+    module      = module.ec2_info
+  }
+
+  step "create_vpc" {
+    description = global.description.create_vpc
+    module      = module.create_vpc
+
+    variables {
+      common_tags = global.tags
+      ip_version  = matrix.ip_version
+    }
+  }
+
+  step "read_backend_license" {
+    description = global.description.read_backend_license
+    module      = module.read_license
+    skip_step   = matrix.backend == "raft" || matrix.consul_edition == "ce"
+
+    variables {
+      file_name = global.backend_license_path
+    }
+  }
+
+  step "read_vault_license" {
+    description = global.description.read_vault_license
+    skip_step   = matrix.edition == "ce"
+    module      = module.read_license
+
+    variables {
+      file_name = global.vault_license_path
+    }
+  }
+
+  step "create_seal_key" {
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.seal}"
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_id  = step.create_vpc.id
+      common_tags = global.tags
+    }
+  }
+
+  step "create_k6_target" {
+    description = "Create the k6 load generator target machine"
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_tag_key = "benchmark-k6"
+      common_tags     = global.tags
+      instance_count  = 1
+      instance_types  = step.benchmark_config.k6_instance_types
+      ports_ingress   = step.benchmark_config.required_ports
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_metrics_collector_target" {
+    description = "Create the benchmark metrics collector target machine"
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_tag_key = "benchmark-collector"
+      common_tags     = global.tags
+      instance_count  = 1
+      instance_types  = step.benchmark_config.metrics_instance_types
+      ports_ingress   = step.benchmark_config.required_ports
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_vault_cluster_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ami_id           = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_tag_key  = global.vault_tag_key
+      common_tags      = global.tags
+      ebs_optimized    = true
+      instance_count   = 3
+      instance_types   = step.benchmark_config.vault_node_instance_types
+      ports_ingress    = step.benchmark_config.required_ports
+      root_volume_type = "io2"
+      root_volume_size = 24
+      root_volume_iops = step.benchmark_config.storage_disk_iops
+      seal_key_names   = step.create_seal_key.resource_names
+      vpc_id           = step.create_vpc.id
+    }
+  }
+
+  step "create_vault_cluster_backend_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_tag_key = global.backend_tag_key
+      common_tags     = global.tags
+      ebs_optimized   = true
+      instance_count  = 3
+      instance_types = {
+        amd64 = "i3.4xlarge"
+        arm64 = "t4g.small"
+      }
+      ports_ingress    = step.benchmark_config.required_ports
+      root_volume_type = "io2"
+      root_volume_size = 24
+      root_volume_iops = step.benchmark_config.storage_disk_iops
+      seal_key_names   = step.create_seal_key.resource_names
+      vpc_id           = step.create_vpc.id
+    }
+  }
+
+  step "create_backend_cluster" {
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.backend}"
+    depends_on = [
+      step.create_vault_cluster_backend_targets
+    ]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_server,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_cli_validate,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_notified,
+      quality.consul_service_systemd_unit,
+    ]
+
+    variables {
+      cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
+      cluster_tag_key = global.backend_tag_key
+      hosts           = step.create_vault_cluster_backend_targets.hosts
+      license         = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      release = {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      }
+    }
+  }
+
+  step "create_vault_cluster" {
+    description = global.description.create_vault_cluster
+    module      = module.vault_cluster
+    depends_on = [
+      step.create_backend_cluster,
+      step.build_vault,
+      step.create_vault_cluster_targets,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      // verified in modules
+      quality.consul_service_start_client,
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_socket,
+      quality.vault_audit_syslog,
+      quality.vault_autojoin_aws,
+      quality.vault_config_env_variables,
+      quality.vault_config_file,
+      quality.vault_config_log_level,
+      quality.vault_init,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_storage_backend_consul,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_cli_status_exit_code,
+      quality.vault_service_systemd_notified,
+      quality.vault_service_systemd_unit,
+    ]
+
+    variables {
+      artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
+      backend_cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
+      backend_cluster_tag_key = global.backend_tag_key
+      cluster_name            = step.create_vault_cluster_targets.cluster_name
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      consul_release = matrix.backend == "consul" ? {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      } : null
+      enable_audit_devices = false
+      enable_telemetry     = true
+      hosts                = step.create_vault_cluster_targets.hosts
+      install_dir          = global.vault_install_dir[matrix.artifact_type]
+      ip_version           = matrix.ip_version
+      license              = matrix.edition != "ce" ? step.read_vault_license.license : null
+      local_artifact_path  = local.artifact_path
+      manage_service       = local.manage_service
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
+      seal_attributes      = step.create_seal_key.attributes
+      seal_type            = matrix.seal
+      storage_backend      = matrix.backend
+    }
+  }
+
+  step "get_local_metadata" {
+    description = global.description.get_local_metadata
+    skip_step   = matrix.artifact_source != "local"
+    module      = module.get_local_metadata
+  }
+
+  // Wait for our cluster to elect a leader
+  step "wait_for_leader" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_vault_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      timeout           = 120 // seconds
+      ip_version        = matrix.ip_version
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "get_vault_cluster_ips" {
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_leader]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "verify_vault_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on  = [step.wait_for_leader]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "benchmark_setup" {
+    module = module.benchmark_setup
+    depends_on = [
+      step.create_metrics_collector_target,
+      step.create_k6_target,
+      step.verify_vault_unsealed,
+      step.get_vault_cluster_ips,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      consul_hosts                     = matrix.backend == "consul" ? step.create_vault_cluster_backend_targets.hosts : {}
+      grafana_version                  = step.benchmark_config.grafana_version
+      grafana_http_port                = step.benchmark_config.grafana_http_port
+      k6_host                          = step.create_k6_target.hosts[0]
+      leader_addr                      = step.get_vault_cluster_ips.leader_private_ip
+      metrics_host                     = step.create_metrics_collector_target.hosts[0]
+      prometheus_node_exporter_version = step.benchmark_config.prometheus_node_exporter_version
+      prometheus_version               = step.benchmark_config.prometheus_version
+      vault_hosts                      = step.create_vault_cluster_targets.hosts
+      vault_token                      = step.create_vault_cluster.root_token
+      vpc_id                           = step.create_vpc.id
+    }
+  }
+
+  output "audit_device_file_path" {
+    description = "The file path for the file audit device, if enabled"
+    value       = step.create_vault_cluster.audit_device_file_path
+  }
+
+  output "dashboard_url" {
+    description = "The URL for viewing the dashboard in grafana"
+    value       = step.benchmark_setup.dashboard_url
+  }
+
+  output "cluster_name" {
+    description = "The Vault cluster name"
+    value       = step.create_vault_cluster.cluster_name
+  }
+
+  output "hosts" {
+    description = "The Vault cluster target hosts"
+    value       = step.create_vault_cluster.hosts
+  }
+
+  output "private_ips" {
+    description = "The Vault cluster private IPs"
+    value       = step.create_vault_cluster.private_ips
+  }
+
+  output "public_ips" {
+    description = "The Vault cluster public IPs"
+    value       = step.create_vault_cluster.public_ips
+  }
+
+  output "root_token" {
+    description = "The Vault cluster root token"
+    value       = step.create_vault_cluster.root_token
+  }
+
+  output "recovery_key_shares" {
+    description = "The Vault cluster recovery key shares"
+    value       = step.create_vault_cluster.recovery_key_shares
+  }
+
+  output "recovery_keys_b64" {
+    description = "The Vault cluster recovery keys b64"
+    value       = step.create_vault_cluster.recovery_keys_b64
+  }
+
+  output "recovery_keys_hex" {
+    description = "The Vault cluster recovery keys hex"
+    value       = step.create_vault_cluster.recovery_keys_hex
+  }
+
+  output "seal_key_attributes" {
+    description = "The Vault cluster seal attributes"
+    value       = step.create_seal_key.attributes
+  }
+
+  output "unseal_keys_b64" {
+    description = "The Vault cluster unseal keys"
+    value       = step.create_vault_cluster.unseal_keys_b64
+  }
+
+  output "unseal_keys_hex" {
+    description = "The Vault cluster unseal keys hex"
+    value       = step.create_vault_cluster.unseal_keys_hex
+  }
+}
diff --git a/enos/enos-scenario-dr-replication.hcl b/enos/enos-scenario-dr-replication.hcl
new file mode 100644
index 00000000000..a38ebd2b279
--- /dev/null
+++ b/enos/enos-scenario-dr-replication.hcl
@@ -0,0 +1,1486 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+scenario "dr_replication" {
+  description = <<-EOF
+    The DR replication scenario configures disaster recovery replication between two Vault clusters and
+    verifies behavior and failure tolerance. The build can be a local branch, any CRT built Vault
+    Enterprise artifact saved to the local machine, or any CRT built Vault Enterprise artifact in
+    the stable channel in Artifactory.
+
+    The scenario deploys two Vault Enterprise clusters and establishes disaster recovery replication
+    between the primary cluster and the disaster recovery replication secondary cluster. Next, we write
+    test data to the primary cluster and verify that the data is replicated to the secondary cluster.
+    We then promote the secondary cluster to be the primary cluster and demote the primary cluster to be
+    the secondary cluster. We then update the secondary cluster to connect to the new primary cluster.
+    Finally, we verify that the secondary cluster is unsealed after enabling replication and verify the
+    disaster recovery replication status between the primary and secondary clusters.
+
+    # How to run this scenario
+
+    For general instructions on running a scenario, refer to the Enos docs: https://eng-handbook.hashicorp.services/internal-tools/enos/running-a-scenario/
+    For troubleshooting tips and common errors, see https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/.
+
+    Variables required for all scenario variants:
+      - aws_ssh_private_key_path (more info about AWS SSH keypairs: https://eng-handbook.hashicorp.services/internal-tools/enos/getting-started/#set-your-aws-key-pair-name-and-private-key)
+      - aws_ssh_keypair_name
+      - vault_build_date*
+      - vault_product_version
+      - vault_revision*
+
+    * If you don't already know what build date and revision you should be using, see
+    https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
+
+    Variables required for some scenario variants:
+      - artifactory_token (if using `artifact_source:artifactory` in your filter)
+      - aws_region (if different from the default value in enos-variables.hcl)
+      - consul_license_path (if using an ENT edition of Consul)
+      - distro_version_<distro> (if different from the default version for your target
+      distro. See supported distros and default versions in the distro_version_<distro>
+      definitions in enos-variables.hcl)
+      - vault_artifact_path (the path to where you have a Vault artifact already downloaded,
+      if using `artifact_source:crt` in your filter)
+      - vault_license_path (if using an ENT edition of Vault)
+  EOF
+
+  matrix {
+    arch              = global.archs
+    artifact_source   = global.artifact_sources
+    artifact_type     = global.artifact_types
+    config_mode       = global.config_modes
+    consul_edition    = global.consul_editions
+    consul_version    = global.consul_versions
+    distro            = global.distros
+    edition           = global.enterprise_editions
+    ip_version        = global.ip_versions
+    primary_backend   = global.backends
+    primary_seal      = global.seals
+    secondary_backend = global.backends
+    secondary_seal    = global.seals
+
+    // Our local builder always creates bundles
+    exclude {
+      artifact_source = ["local"]
+      artifact_type   = ["package"]
+    }
+
+    // PKCS#11 can only be used on ent.hsm and ent.hsm.fips1403.
+    exclude {
+      primary_seal = ["pkcs11"]
+      edition      = [for e in matrix.edition : e if !strcontains(e, "hsm")]
+    }
+
+    exclude {
+      secondary_seal = ["pkcs11"]
+      edition        = [for e in matrix.edition : e if !strcontains(e, "hsm")]
+    }
+
+    // softhsm packages not available for leap/sles.
+    exclude {
+      primary_seal = ["pkcs11"]
+      distro       = ["leap", "sles"]
+    }
+
+    exclude {
+      secondary_seal = ["pkcs11"]
+      distro         = ["leap", "sles"]
+    }
+
+    // Testing in IPV6 mode is currently implemented for integrated Raft storage only
+    exclude {
+      ip_version      = ["6"]
+      primary_backend = ["consul"]
+    }
+
+    exclude {
+      ip_version        = ["6"]
+      secondary_backend = ["consul"]
+    }
+  }
+
+  terraform_cli = terraform_cli.default
+  terraform     = terraform.default
+  providers = [
+    provider.aws.default,
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
+  ]
+
+  locals {
+    artifact_path = matrix.artifact_source != "artifactory" ? abspath(var.vault_artifact_path) : null
+    enos_provider = {
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
+      ubuntu = provider.enos.ubuntu
+    }
+    manage_service    = matrix.artifact_type == "bundle"
+    vault_install_dir = matrix.artifact_type == "bundle" ? var.vault_install_dir : global.vault_install_dir[matrix.artifact_type]
+  }
+
+  step "build_vault" {
+    description = global.description.build_vault
+    module      = "build_${matrix.artifact_source}"
+
+    variables {
+      build_tags        = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      artifact_path     = local.artifact_path
+      goarch            = matrix.arch
+      goos              = "linux"
+      artifactory_host  = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
+      artifactory_repo  = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
+      artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
+      arch              = matrix.artifact_source == "artifactory" ? matrix.arch : null
+      product_version   = var.vault_product_version
+      artifact_type     = matrix.artifact_type
+      distro            = matrix.artifact_source == "artifactory" ? matrix.distro : null
+      edition           = matrix.artifact_source == "artifactory" ? matrix.edition : null
+      revision          = var.vault_revision
+    }
+  }
+
+  step "ec2_info" {
+    description = global.description.ec2_info
+    module      = module.ec2_info
+  }
+
+  step "create_vpc" {
+    description = global.description.create_vpc
+    module      = module.create_vpc
+
+    variables {
+      common_tags = global.tags
+      ip_version  = matrix.ip_version
+    }
+  }
+
+  // This step reads the contents of the backend license if we're using a Consul backend and
+  // an "ent" Consul edition.
+  step "read_backend_license" {
+    description = global.description.read_backend_license
+    skip_step   = (matrix.primary_backend == "raft" && matrix.secondary_backend == "raft") || matrix.consul_edition == "ce"
+    module      = module.read_license
+
+    variables {
+      file_name = global.backend_license_path
+    }
+  }
+
+  step "read_vault_license" {
+    description = global.description.read_vault_license
+    module      = module.read_license
+
+    variables {
+      file_name = abspath(joinpath(path.root, "./support/vault.hclic"))
+    }
+  }
+
+  step "create_primary_seal_key" {
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.primary_seal}"
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_id   = step.create_vpc.id
+      cluster_meta = "primary"
+      common_tags  = global.tags
+    }
+  }
+
+  step "create_secondary_seal_key" {
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.secondary_seal}"
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_id      = step.create_vpc.id
+      cluster_meta    = "secondary"
+      common_tags     = global.tags
+      other_resources = step.create_primary_seal_key.resource_names
+    }
+  }
+
+  step "create_external_integration_target" {
+    description = global.description.create_external_integration_target
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["24.04"]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  // Create all of our instances for both primary and secondary clusters
+  step "create_primary_cluster_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on = [
+      step.create_vpc,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_primary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_primary_cluster_backend_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.primary_backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on = [
+      step.create_vpc,
+    ]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
+      cluster_tag_key = global.backend_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_primary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_secondary_cluster_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_secondary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_secondary_cluster_backend_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.secondary_backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
+      cluster_tag_key = global.backend_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_secondary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "set_up_external_integration_target" {
+    description = global.description.set_up_external_integration_target
+    module      = module.set_up_external_integration_target
+    depends_on = [
+      step.create_external_integration_target
+    ]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      hosts      = step.create_external_integration_target.hosts
+      ip_version = matrix.ip_version
+      packages   = concat(global.packages, global.distro_packages["ubuntu"]["24.04"], ["podman", "podman-docker"])
+      ports      = global.integration_host_ports
+    }
+  }
+
+  step "create_primary_backend_cluster" {
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.primary_backend}"
+    depends_on = [
+      step.create_primary_cluster_backend_targets,
+    ]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_server,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_cli_validate,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_notified,
+      quality.consul_service_systemd_unit,
+    ]
+
+    variables {
+      cluster_name    = step.create_primary_cluster_backend_targets.cluster_name
+      cluster_tag_key = global.backend_tag_key
+      hosts           = step.create_primary_cluster_backend_targets.hosts
+      license         = (matrix.primary_backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      release = {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      }
+    }
+  }
+
+  step "create_primary_cluster" {
+    description = global.description.create_vault_cluster
+    module      = module.vault_cluster
+    depends_on = [
+      step.create_primary_backend_cluster,
+      step.build_vault,
+      step.create_primary_cluster_targets,
+      step.set_up_external_integration_target
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      // verified in modules
+      quality.consul_service_start_client,
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_socket,
+      quality.vault_audit_syslog,
+      quality.vault_autojoin_aws,
+      quality.vault_config_env_variables,
+      quality.vault_config_file,
+      quality.vault_config_log_level,
+      quality.vault_init,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_storage_backend_consul,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_cli_status_exit_code,
+      quality.vault_service_systemd_notified,
+      quality.vault_service_systemd_unit,
+    ]
+
+    variables {
+      artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
+      backend_cluster_name    = step.create_primary_cluster_backend_targets.cluster_name
+      backend_cluster_tag_key = global.backend_tag_key
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.primary_backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      cluster_name            = step.create_primary_cluster_targets.cluster_name
+      consul_release = matrix.primary_backend == "consul" ? {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      } : null
+      enable_audit_devices = var.vault_enable_audit_devices
+      hosts                = step.create_primary_cluster_targets.hosts
+      install_dir          = global.vault_install_dir[matrix.artifact_type]
+      ip_version           = matrix.ip_version
+      license              = matrix.edition != "ce" ? step.read_vault_license.license : null
+      local_artifact_path  = local.artifact_path
+      manage_service       = local.manage_service
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
+      seal_attributes      = step.create_primary_seal_key.attributes
+      seal_type            = matrix.primary_seal
+      storage_backend      = matrix.primary_backend
+    }
+  }
+
+  step "get_local_metadata" {
+    skip_step = matrix.artifact_source != "local"
+    module    = module.get_local_metadata
+  }
+
+  step "wait_for_primary_cluster_leader" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_primary_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      hosts             = step.create_primary_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "create_secondary_backend_cluster" {
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.secondary_backend}"
+    depends_on = [
+      step.create_secondary_cluster_backend_targets
+    ]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_name    = step.create_secondary_cluster_backend_targets.cluster_name
+      cluster_tag_key = global.backend_tag_key
+      hosts           = step.create_secondary_cluster_backend_targets.hosts
+      license         = (matrix.secondary_backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      release = {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      }
+    }
+  }
+
+  step "create_secondary_cluster" {
+    module = module.vault_cluster
+    depends_on = [
+      step.create_secondary_backend_cluster,
+      step.build_vault,
+      step.create_secondary_cluster_targets
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_client,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_notified,
+      quality.consul_service_systemd_unit,
+    ]
+
+    variables {
+      artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
+      backend_cluster_name    = step.create_secondary_cluster_backend_targets.cluster_name
+      backend_cluster_tag_key = global.backend_tag_key
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.secondary_backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      cluster_name            = step.create_secondary_cluster_targets.cluster_name
+      consul_release = matrix.secondary_backend == "consul" ? {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      } : null
+      enable_audit_devices = var.vault_enable_audit_devices
+      hosts                = step.create_secondary_cluster_targets.hosts
+      install_dir          = global.vault_install_dir[matrix.artifact_type]
+      ip_version           = matrix.ip_version
+      license              = matrix.edition != "ce" ? step.read_vault_license.license : null
+      local_artifact_path  = local.artifact_path
+      manage_service       = local.manage_service
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
+      seal_attributes      = step.create_secondary_seal_key.attributes
+      seal_type            = matrix.secondary_seal
+      storage_backend      = matrix.secondary_backend
+    }
+  }
+
+  step "wait_for_secondary_cluster_leader" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_secondary_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_secondary_cluster.root_token
+    }
+  }
+
+  step "verify_that_vault_primary_cluster_is_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on = [
+      step.create_primary_cluster,
+      step.wait_for_primary_cluster_leader,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_auto_unseals_after_autopilot_upgrade,
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_primary_cluster_targets.hosts
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "verify_that_vault_secondary_cluster_is_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on = [
+      step.create_secondary_cluster,
+      step.wait_for_secondary_cluster_leader,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_auto_unseals_after_autopilot_upgrade,
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "get_primary_cluster_ips" {
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.verify_that_vault_primary_cluster_is_unsealed]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
+    variables {
+      hosts             = step.create_primary_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "get_secondary_cluster_ips" {
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.verify_that_vault_secondary_cluster_is_unsealed]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_secondary_cluster.root_token
+    }
+  }
+
+  step "verify_vault_version" {
+    description = global.description.verify_vault_version
+    module      = module.vault_verify_version
+    depends_on  = [step.get_primary_cluster_ips]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_version_history_keys,
+      quality.vault_api_sys_version_history_key_info,
+      quality.vault_version_build_date,
+      quality.vault_version_edition,
+      quality.vault_version_release,
+    ]
+
+    variables {
+      hosts                 = step.create_primary_cluster_targets.hosts
+      vault_addr            = step.create_primary_cluster.api_addr_localhost
+      vault_edition         = matrix.edition
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
+      vault_product_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
+      vault_revision        = matrix.artifact_source == "local" ? step.get_local_metadata.revision : var.vault_revision
+      vault_build_date      = matrix.artifact_source == "local" ? step.get_local_metadata.build_date : var.vault_build_date
+      vault_root_token      = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "verify_ui" {
+    description = global.description.verify_ui
+    module      = module.vault_verify_ui
+    depends_on  = [step.get_primary_cluster_ips]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = quality.vault_ui_assets
+
+    variables {
+      vault_addr = step.create_primary_cluster.api_addr_localhost
+      hosts      = step.create_primary_cluster_targets.hosts
+    }
+  }
+
+  step "verify_secrets_engines_on_primary" {
+    description = global.description.verify_secrets_engines_create
+    module      = module.vault_verify_secrets_engines_create
+    depends_on = [
+      step.get_primary_cluster_ips
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_auth_userpass_user_write,
+      quality.vault_api_identity_entity_write,
+      quality.vault_api_identity_entity_alias_write,
+      quality.vault_api_identity_group_write,
+      quality.vault_api_identity_oidc_config_write,
+      quality.vault_api_identity_oidc_introspect_write,
+      quality.vault_api_identity_oidc_key_write,
+      quality.vault_api_identity_oidc_key_rotate_write,
+      quality.vault_api_identity_oidc_role_write,
+      quality.vault_api_identity_oidc_token_read,
+      quality.vault_api_sys_auth_userpass_user_write,
+      quality.vault_api_sys_policy_write,
+      quality.vault_mount_auth,
+      quality.vault_mount_kv,
+      quality.vault_secrets_kmip_write_config,
+      quality.vault_secrets_kv_write,
+      quality.vault_secrets_ldap_write_config,
+    ]
+
+    variables {
+      hosts                  = step.create_primary_cluster_targets.hosts
+      ip_version             = matrix.ip_version
+      integration_host_state = step.set_up_external_integration_target.state
+      ldap_enabled           = false
+      leader_host            = step.get_primary_cluster_ips.leader_host
+      ports                  = global.ports
+      ipv4_cidr              = step.create_vpc.ipv4_cidr
+      vault_addr             = step.create_primary_cluster.api_addr_localhost
+      vault_edition          = matrix.edition
+      vault_install_dir      = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token       = step.create_primary_cluster.root_token
+    }
+  }
+
+  # ================================================
+  #     DISASTER RECOVERY (DR) REPLICATION SETUP
+  # ================================================
+  # - Wait for seal rewrap to complete on both clusters.
+  # - Configure DR primary replication on cluster A.
+  # - Generate secondary token on cluster A.
+  # - Configure DR secondary replication on cluster B.
+  # - Confirm replication status on both clusters.
+
+
+  // Wait for our seals to finish any inflight rewraps before we enable DR replication as we don't
+  // want to accidentally swap seal info on the secondary before it has finished.
+  step "configure_dr_replication_primary" {
+    description = <<-EOF
+      Create the necessary superuser auth policy necessary for DR replication, assign it
+      to a our previously create test user, and enable DR replication on the primary
+      cluster.
+    EOF
+    module      = module.vault_setup_dr_primary
+    depends_on = [
+      step.get_primary_cluster_ips,
+      step.get_secondary_cluster_ips,
+      step.verify_secrets_engines_on_primary,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_auth_userpass_user_write,
+      quality.vault_api_sys_policy_write,
+      quality.vault_api_sys_replication_dr_primary_enable_write,
+      quality.vault_cli_policy_write,
+    ]
+
+    variables {
+      ip_version          = matrix.ip_version
+      primary_leader_host = step.get_primary_cluster_ips.leader_host
+      vault_addr          = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir   = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token    = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "generate_secondary_token" {
+    description = <<-EOF
+      Generate a random token and configure the DR replication primary secondary-token and
+      configure the Vault cluster primary replication with the token. Export the wrapping token
+      so that secondary clusters can utilize it.
+    EOF
+    module      = module.generate_secondary_token
+    depends_on  = [step.configure_dr_replication_primary]
+
+    verifies = quality.vault_api_sys_replication_dr_primary_secondary_token_write
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ip_version          = matrix.ip_version
+      primary_leader_host = step.get_primary_cluster_ips.leader_host
+      replication_type    = "dr"
+      vault_addr          = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir   = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token    = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "wait_for_primary_seal_rewrap" {
+    module = module.vault_wait_for_seal_rewrap
+    depends_on = [
+      step.generate_secondary_token,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.create_primary_cluster.hosts
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "wait_for_secondary_seal_rewrap" {
+    module = module.vault_wait_for_seal_rewrap
+    depends_on = [
+      step.wait_for_primary_seal_rewrap,
+
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.create_secondary_cluster.hosts
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_secondary_cluster.root_token
+    }
+  }
+
+  step "configure_dr_replication_secondary" {
+    description = <<-EOF
+      Enable dr replication on the secondary cluster with the wrapping token created by
+      the primary cluster.
+    EOF
+    module      = module.vault_setup_replication_secondary
+    depends_on = [
+      step.wait_for_secondary_seal_rewrap,
+      step.generate_secondary_token,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_api_sys_replication_dr_secondary_enable_write,
+      quality.vault_api_sys_replication_dr_status_read,
+    ]
+
+    variables {
+      ip_version            = matrix.ip_version
+      secondary_leader_host = step.get_secondary_cluster_ips.leader_host
+      replication_type      = "dr"
+      vault_addr            = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token      = step.create_secondary_cluster.root_token
+      wrapping_token        = step.generate_secondary_token.secondary_token
+    }
+  }
+
+  step "unseal_secondary_followers" {
+    description = <<-EOF
+      After replication is enabled the secondary cluster followers need to be unsealed.
+      Secondary unseal keys are passed differently depending primary and secondary seal
+      type combinations. See the guide for more information:
+        https://developer.hashicorp.com/vault/docs/enterprise/replication#seals
+    EOF
+    module      = module.vault_unseal_replication_followers
+    depends_on = [
+      step.configure_dr_replication_secondary
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.get_secondary_cluster_ips.follower_hosts
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_seal_type   = matrix.primary_seal == "shamir" ? matrix.primary_seal : matrix.secondary_seal
+      vault_unseal_keys = matrix.primary_seal == "shamir" ? step.create_primary_cluster.unseal_keys_hex : step.create_primary_cluster.recovery_keys_hex
+    }
+  }
+
+  step "verify_secondary_cluster_is_unsealed_after_enabling_replication" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on = [
+      step.unseal_secondary_followers
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_auto_unseals_after_autopilot_upgrade,
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "verify_dr_replication" {
+    description = <<-EOF
+      Verify that the DR replication status meets our expectations after enabling replication
+      and ensuring that all secondary nodes are unsealed.
+    EOF
+    module      = module.vault_verify_dr_replication
+    depends_on = [
+      step.configure_dr_replication_secondary,
+      step.unseal_secondary_followers,
+      step.verify_secondary_cluster_is_unsealed_after_enabling_replication,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_replication_dr_read_connection_status_connected,
+      quality.vault_api_sys_replication_dr_status_read,
+      quality.vault_api_sys_replication_dr_status_read_cluster_address,
+      quality.vault_api_sys_replication_dr_status_read_state_not_idle,
+      quality.vault_api_sys_replication_dr_status_known_primary_cluster_addrs,
+    ]
+
+    variables {
+      ip_version            = matrix.ip_version
+      primary_leader_host   = step.get_primary_cluster_ips.leader_host
+      secondary_leader_host = step.get_secondary_cluster_ips.leader_host
+      vault_addr            = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  # ==============================
+  #     FAILOVER SCENARIO STEPS
+  # ==============================
+  # 1. Generate a batch DR operation token.
+  # 2. Promote the current secondary cluster B to become the new primary cluster.
+  # 3. Demote cluster A to secondary status.
+  # 4. Test access to Vault data on the new primary cluster B.
+  # 5. Point demoted cluster A to the new primary cluster B (Multistep process).
+  # 6. Verify that the data is replicated to the new primary cluster B.
+
+  step "generate_batch_dr_operation_token" {
+    description = <<-EOF
+      Generate a batch DR operation token that you can use to promote and demote clusters as needed.
+    EOF
+    module      = module.generate_dr_operation_token
+    depends_on  = [step.verify_dr_replication]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      vault_install_dir   = local.vault_install_dir
+      ip_version          = matrix.ip_version
+      primary_leader_host = step.get_primary_cluster_ips.leader_host
+      vault_addr          = step.create_primary_cluster.api_addr_localhost
+      vault_root_token    = step.create_primary_cluster.root_token
+      storage_backend     = matrix.primary_backend
+    }
+  }
+
+  step "vault_failover_promote_dr_secondary_cluster" {
+    description = <<-EOF
+      Promote the secondary cluster to be the primary cluster. This step will also
+      generate a new DR operation token for the secondary cluster to connect to the new
+      primary cluster.
+    EOF
+    module      = module.vault_failover_promote_dr_secondary
+    depends_on  = [step.generate_batch_dr_operation_token]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      vault_install_dir     = local.vault_install_dir
+      vault_addr            = step.create_secondary_cluster.api_addr_localhost
+      ip_version            = matrix.ip_version
+      secondary_leader_host = step.get_secondary_cluster_ips.leader_host
+      vault_root_token      = step.create_secondary_cluster.root_token
+      dr_operation_token    = step.generate_batch_dr_operation_token.dr_operation_token
+    }
+  }
+
+  step "wait_for_promoted_cluster_leader" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.vault_failover_promote_dr_secondary_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_secondary_cluster.root_token
+    }
+  }
+
+  step "vault_failover_demote_dr_primary_cluster" {
+    description = <<-EOF
+      Demote the primary cluster to be the secondary cluster. This step will also
+      generate a new DR operation token for the secondary cluster to connect to the new
+      primary cluster.
+    EOF
+    module      = module.vault_failover_demote_dr_primary
+    depends_on  = [step.wait_for_promoted_cluster_leader]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ip_version          = matrix.ip_version
+      primary_leader_host = step.get_primary_cluster_ips.leader_host
+      vault_addr          = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir   = local.vault_install_dir
+      vault_root_token    = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "wait_for_demoted_cluster_leader" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.vault_failover_demote_dr_primary_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      hosts             = step.create_primary_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "verify_new_primary_cluster_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on = [
+      step.wait_for_demoted_cluster_leader,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_auto_unseals_after_autopilot_upgrade,
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      timeout           = 120 // seconds
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "verify_replicated_data_during_failover" {
+    description = global.description.verify_secrets_engines_read
+    module      = module.vault_verify_secrets_engines_read
+    depends_on = [
+      step.wait_for_demoted_cluster_leader,
+      step.verify_new_primary_cluster_unsealed,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_identity_entity_read,
+      quality.vault_api_identity_oidc_config_read,
+      quality.vault_api_identity_oidc_key_read,
+      quality.vault_api_identity_oidc_role_read,
+      quality.vault_secrets_kv_read
+    ]
+
+    variables {
+      create_state            = step.verify_secrets_engines_on_primary.state
+      hosts                   = step.get_secondary_cluster_ips.follower_hosts
+      ip_version              = matrix.ip_version
+      ldap_enabled            = false
+      vault_addr              = step.create_secondary_cluster.api_addr_localhost
+      vault_edition           = matrix.edition
+      vault_install_dir       = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token        = step.create_secondary_cluster.root_token
+      verify_pki_certs        = false
+      verify_aws_engine_creds = false
+      verify_ssh_secrets      = false
+    }
+  }
+
+  step "generate_demoted_secondary_public_key" {
+    description = <<-EOF
+      Generate a random token and configure the DR replication primary secondary-token and
+      configure the Vault cluster primary replication with the token. Export the wrapping token
+      so that secondary clusters can utilize it.
+    EOF
+    module      = module.generate_secondary_public_key
+    depends_on = [
+      step.verify_replicated_data_during_failover,
+    ]
+
+    verifies = quality.vault_api_sys_replication_dr_primary_secondary_token_write
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ip_version          = matrix.ip_version
+      primary_leader_host = step.get_primary_cluster_ips.leader_host
+      vault_addr          = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir   = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token    = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "generate_demoted_secondary_token" {
+    description = <<-EOF
+      Generate a random token and configure the DR replication primary secondary-token and
+      configure the Vault cluster primary replication with the token. Export the wrapping token
+      so that secondary clusters can utilize it.
+    EOF
+    module      = module.generate_failover_secondary_token
+    depends_on  = [step.generate_demoted_secondary_public_key]
+
+    verifies = quality.vault_api_sys_replication_dr_primary_secondary_token_write
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ip_version           = matrix.ip_version
+      primary_leader_host  = step.get_secondary_cluster_ips.leader_host
+      secondary_public_key = step.generate_demoted_secondary_public_key.secondary_public_key
+      vault_addr           = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir    = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token     = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "vault_failover_update_dr_primary_cluster" {
+    description = <<-EOF
+      Update the secondary cluster to connect to the new primary cluster.
+    EOF
+    module      = module.vault_failover_update_dr_primary
+    depends_on = [
+      step.generate_demoted_secondary_token,
+      step.vault_failover_demote_dr_primary_cluster
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      vault_install_dir     = local.vault_install_dir
+      ip_version            = matrix.ip_version
+      secondary_leader_host = step.get_primary_cluster_ips.leader_host
+      vault_addr            = step.create_primary_cluster.api_addr_localhost
+      vault_root_token      = step.create_primary_cluster.root_token
+      dr_operation_token    = step.generate_batch_dr_operation_token.dr_operation_token
+      wrapping_token        = step.generate_demoted_secondary_token.secondary_token
+    }
+  }
+
+  step "verify_failover_dr_replication" {
+    description = <<-EOF
+      Verify that the DR replication status meets our expectations after enabling replication
+      and ensuring that all secondary nodes are unsealed.
+    EOF
+    module      = module.vault_verify_dr_replication
+    depends_on  = [step.vault_failover_update_dr_primary_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_replication_dr_read_connection_status_connected,
+      quality.vault_api_sys_replication_dr_status_read,
+      quality.vault_api_sys_replication_dr_status_read_cluster_address,
+      quality.vault_api_sys_replication_dr_status_read_state_not_idle,
+      quality.vault_api_sys_replication_dr_status_known_primary_cluster_addrs,
+    ]
+
+    variables {
+      ip_version            = matrix.ip_version
+      primary_leader_host   = step.get_secondary_cluster_ips.leader_host
+      secondary_leader_host = step.get_primary_cluster_ips.leader_host
+      vault_addr            = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "verify_failover_replicated_data" {
+    description = global.description.verify_secrets_engines_read
+    module      = module.vault_verify_secrets_engines_read
+    depends_on = [
+      step.verify_dr_replication,
+      step.get_secondary_cluster_ips,
+      step.verify_secrets_engines_on_primary,
+      step.verify_failover_dr_replication
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_identity_entity_read,
+      quality.vault_api_identity_oidc_config_read,
+      quality.vault_api_identity_oidc_key_read,
+      quality.vault_api_identity_oidc_role_read,
+      quality.vault_secrets_kv_read
+    ]
+
+    variables {
+      create_state            = step.verify_secrets_engines_on_primary.state
+      hosts                   = step.get_secondary_cluster_ips.follower_hosts
+      ip_version              = matrix.ip_version
+      ldap_enabled            = false
+      vault_addr              = step.create_secondary_cluster.api_addr_localhost
+      vault_edition           = matrix.edition
+      vault_install_dir       = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token        = step.create_secondary_cluster.root_token
+      verify_pki_certs        = false
+      verify_aws_engine_creds = false
+      verify_ssh_secrets      = false
+    }
+  }
+
+  # Verification is intentionally disabled for DR clusters because they do not handle client requests.
+  # However, we still include this step to future-proof the module, making it easier to enable delete
+  # verification later for other secrets engines or use cases where DR verification becomes relevant.
+  # For now, the script will short-circuit if verification is disabled. Potential future work will include
+  # verifying against the primary cluster.
+  step "verify_secrets_engines_delete" {
+    description = global.description.verify_secrets_engines_delete
+    module      = module.vault_verify_secrets_engines_delete
+    depends_on = [
+      step.verify_secrets_engines_on_primary,
+      step.verify_failover_replicated_data
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_ssh_role_delete
+    ]
+
+    variables {
+      create_state       = step.verify_secrets_engines_on_primary.state
+      hosts              = step.get_secondary_cluster_ips.follower_hosts
+      leader_host        = step.get_secondary_cluster_ips.leader_host
+      vault_addr         = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir  = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token   = step.create_secondary_cluster.root_token
+      verify_ssh_secrets = false
+    }
+  }
+
+  // Output the results of the scenario.
+
+  output "audit_device_file_path" {
+    description = "The file path for the file audit device, if enabled"
+    value       = step.create_primary_cluster.audit_device_file_path
+  }
+
+  output "external_integration_server_ldap" {
+    description = "The LDAP test servers info"
+    value       = step.set_up_external_integration_target.state.ldap
+  }
+
+  output "primary_cluster_hosts" {
+    description = "The Vault primary cluster target hosts"
+    value       = step.create_primary_cluster_targets.hosts
+  }
+
+  output "primary_cluster_root_token" {
+    description = "The Vault primary cluster root token"
+    value       = step.create_primary_cluster.root_token
+  }
+
+  output "primary_cluster_unseal_keys_b64" {
+    description = "The Vault primary cluster unseal keys"
+    value       = step.create_primary_cluster.unseal_keys_b64
+  }
+
+  output "primary_cluster_unseal_keys_hex" {
+    description = "The Vault primary cluster unseal keys hex"
+    value       = step.create_primary_cluster.unseal_keys_hex
+  }
+
+  output "primary_cluster_recovery_key_shares" {
+    description = "The Vault primary cluster recovery key shares"
+    value       = step.create_primary_cluster.recovery_key_shares
+  }
+
+  output "primary_cluster_recovery_keys_b64" {
+    description = "The Vault primary cluster recovery keys b64"
+    value       = step.create_primary_cluster.recovery_keys_b64
+  }
+
+  output "primary_cluster_recovery_keys_hex" {
+    description = "The Vault primary cluster recovery keys hex"
+    value       = step.create_primary_cluster.recovery_keys_hex
+  }
+
+  output "secondary_cluster_hosts" {
+    description = "The Vault secondary cluster public IPs"
+    value       = step.create_secondary_cluster_targets.hosts
+  }
+
+  output "secondary_cluster_root_token" {
+    description = "The Vault secondary cluster root token"
+    value       = step.create_secondary_cluster.root_token
+  }
+
+  output "secrets_engines_state" {
+    description = "The state of configured secrets engines"
+    sensitive   = true
+    value       = step.verify_secrets_engines_on_primary.state
+  }
+
+  output "dr_secondary_token" {
+    description = "The dr secondary replication token"
+    value       = step.generate_secondary_token.secondary_token
+  }
+
+  output "batch_dr_operation_token" {
+    description = "The dr primary replication token"
+    value       = step.generate_batch_dr_operation_token.dr_operation_token
+  }
+
+  output "demoted_secondary_public_key" {
+    description = "The dr secondary public key"
+    value       = step.generate_demoted_secondary_public_key.secondary_public_key
+  }
+
+  output "demoted_secondary_token" {
+    description = "The dr secondary public key"
+    value       = step.generate_demoted_secondary_token.secondary_token
+  }
+
+  output "initial_primary_replication_status" {
+    description = "The Vault primary cluster dr replication status"
+    value       = step.verify_dr_replication.primary_replication_status
+  }
+
+  output "initial_known_primary_cluster_addresses" {
+    description = "The Vault primary cluster known primary cluster addresses"
+    value       = step.verify_dr_replication.known_primary_cluster_addrs
+  }
+
+  output "initial_secondary_dr_replication_status" {
+    description = "The Vault secondary cluster dr replication status"
+    value       = step.verify_dr_replication.secondary_replication_status
+  }
+
+  output "intial_primary_replication_data_secondaries" {
+    description = "The Vault primary cluster secondaries connection status"
+    value       = step.verify_dr_replication.primary_replication_data_secondaries
+  }
+
+  output "initial_secondary_replication_data_primaries" {
+    description = "The Vault  secondary cluster primaries connection status"
+    value       = step.verify_dr_replication.secondary_replication_data_primaries
+  }
+
+  output "get_primary_cluster_ips_leader" {
+    description = "The Vault updated primary cluster dr replication status"
+    value       = step.get_primary_cluster_ips.leader_public_ip
+  }
+
+  output "get_secondary_cluster_ips_leader" {
+    description = "The Vault updated primary cluster dr replication status"
+    value       = step.get_secondary_cluster_ips.leader_public_ip
+  }
+
+  output "failover_primary_replication_status" {
+    description = "The Vault updated primary cluster dr replication status"
+    value       = step.verify_failover_dr_replication.primary_replication_status
+  }
+
+  output "failover_known_primary_cluster_addresses" {
+    description = "The Vault secondary cluster dr replication status"
+    value       = step.verify_failover_dr_replication.known_primary_cluster_addrs
+  }
+
+  output "failover_secondary_replication_status" {
+    description = "The Vault updated secondary cluster dr replication status"
+    value       = step.verify_failover_dr_replication.secondary_replication_status
+  }
+
+  output "failover_primary_replication_data_secondaries" {
+    description = "The Vault updated primary cluster secondaries connection status"
+    value       = step.verify_failover_dr_replication.primary_replication_data_secondaries
+  }
+
+  output "failover_secondary_replication_data_primaries" {
+    description = "The Vault updated secondary cluster primaries connection status"
+    value       = step.verify_failover_dr_replication.secondary_replication_data_primaries
+  }
+}
diff --git a/enos/enos-scenario-pr-replication.hcl b/enos/enos-scenario-pr-replication.hcl
new file mode 100644
index 00000000000..f091fc9e514
--- /dev/null
+++ b/enos/enos-scenario-pr-replication.hcl
@@ -0,0 +1,1436 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+scenario "pr_replication" {
+  description = <<-EOF
+    The PR replication scenario configures performance replication between two Vault clusters and
+    verifies behavior and failure tolerance. The build can be a local branch, any CRT built Vault
+    Enterprise artifact saved to the local machine, or any CRT built Vault Enterprise artifact in
+    the stable channel in Artifactory.
+
+    The scenario deploys two Vault Enterprise clusters and establishes performance replication
+    between the primary cluster and the performance replication secondary cluster. Next, it simulates
+    a catastrophic failure event whereby the primary leader and a primary follower are ungracefully
+    removed from the cluster while running. This forces a leader election in the primary cluster
+    and requires the secondary cluster to recover replication and establish replication to the new
+    primary leader. The scenario also performs standard baseline verification that is not specific
+    to performance replication.
+
+    # How to run this scenario
+
+    For general instructions on running a scenario, refer to the Enos docs: https://eng-handbook.hashicorp.services/internal-tools/enos/running-a-scenario/
+    For troubleshooting tips and common errors, see https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/.
+
+    Variables required for all scenario variants:
+      - aws_ssh_private_key_path (more info about AWS SSH keypairs: https://eng-handbook.hashicorp.services/internal-tools/enos/getting-started/#set-your-aws-key-pair-name-and-private-key)
+      - aws_ssh_keypair_name
+      - vault_build_date*
+      - vault_product_version
+      - vault_revision*
+
+    * If you don't already know what build date and revision you should be using, see
+    https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
+
+    Variables required for some scenario variants:
+      - artifactory_token (if using `artifact_source:artifactory` in your filter)
+      - aws_region (if different from the default value in enos-variables.hcl)
+      - consul_license_path (if using an ENT edition of Consul)
+      - distro_version_<distro> (if different from the default version for your target
+      distro. See supported distros and default versions in the distro_version_<distro>
+      definitions in enos-variables.hcl)
+      - vault_artifact_path (the path to where you have a Vault artifact already downloaded,
+      if using `artifact_source:crt` in your filter)
+      - vault_license_path (if using an ENT edition of Vault)
+  EOF
+
+  matrix {
+    arch              = global.archs
+    artifact_source   = global.artifact_sources
+    artifact_type     = global.artifact_types
+    config_mode       = global.config_modes
+    consul_edition    = global.consul_editions
+    consul_version    = global.consul_versions
+    distro            = global.distros
+    edition           = global.enterprise_editions
+    ip_version        = global.ip_versions
+    primary_backend   = global.backends
+    primary_seal      = global.seals
+    secondary_backend = global.backends
+    secondary_seal    = global.seals
+
+    // Our local builder always creates bundles
+    exclude {
+      artifact_source = ["local"]
+      artifact_type   = ["package"]
+    }
+
+    // PKCS#11 can only be used on ent.hsm and ent.hsm.fips1403.
+    exclude {
+      primary_seal = ["pkcs11"]
+      edition      = [for e in matrix.edition : e if !strcontains(e, "hsm")]
+    }
+
+    exclude {
+      secondary_seal = ["pkcs11"]
+      edition        = [for e in matrix.edition : e if !strcontains(e, "hsm")]
+    }
+
+    // softhsm packages not available for leap/sles.
+    exclude {
+      primary_seal = ["pkcs11"]
+      distro       = ["leap", "sles"]
+    }
+
+    exclude {
+      secondary_seal = ["pkcs11"]
+      distro         = ["leap", "sles"]
+    }
+
+    // Testing in IPV6 mode is currently implemented for integrated Raft storage only
+    exclude {
+      ip_version      = ["6"]
+      primary_backend = ["consul"]
+    }
+
+    exclude {
+      ip_version        = ["6"]
+      secondary_backend = ["consul"]
+    }
+  }
+
+  terraform_cli = terraform_cli.default
+  terraform     = terraform.default
+  providers = [
+    provider.aws.default,
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
+  ]
+
+  locals {
+    artifact_path = matrix.artifact_source != "artifactory" ? abspath(var.vault_artifact_path) : null
+    enos_provider = {
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
+      ubuntu = provider.enos.ubuntu
+    }
+    manage_service    = matrix.artifact_type == "bundle"
+    vault_install_dir = matrix.artifact_type == "bundle" ? var.vault_install_dir : global.vault_install_dir[matrix.artifact_type]
+  }
+
+  step "build_vault" {
+    description = global.description.build_vault
+    module      = "build_${matrix.artifact_source}"
+
+    variables {
+      build_tags        = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      artifact_path     = local.artifact_path
+      goarch            = matrix.arch
+      goos              = "linux"
+      artifactory_host  = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
+      artifactory_repo  = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
+      artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
+      arch              = matrix.artifact_source == "artifactory" ? matrix.arch : null
+      product_version   = var.vault_product_version
+      artifact_type     = matrix.artifact_type
+      distro            = matrix.artifact_source == "artifactory" ? matrix.distro : null
+      edition           = matrix.artifact_source == "artifactory" ? matrix.edition : null
+      revision          = var.vault_revision
+    }
+  }
+
+  step "ec2_info" {
+    description = global.description.ec2_info
+    module      = module.ec2_info
+  }
+
+  step "create_vpc" {
+    description = global.description.create_vpc
+    module      = module.create_vpc
+
+    variables {
+      common_tags = global.tags
+      ip_version  = matrix.ip_version
+    }
+  }
+
+  // This step reads the contents of the backend license if we're using a Consul backend and
+  // an "ent" Consul edition.
+  step "read_backend_license" {
+    description = global.description.read_backend_license
+    skip_step   = (matrix.primary_backend == "raft" && matrix.secondary_backend == "raft") || matrix.consul_edition == "ce"
+    module      = module.read_license
+
+    variables {
+      file_name = global.backend_license_path
+    }
+  }
+
+  step "read_vault_license" {
+    description = global.description.read_vault_license
+    module      = module.read_license
+
+    variables {
+      file_name = abspath(joinpath(path.root, "./support/vault.hclic"))
+    }
+  }
+
+  step "create_primary_seal_key" {
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.primary_seal}"
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_id   = step.create_vpc.id
+      cluster_meta = "primary"
+      common_tags  = global.tags
+    }
+  }
+
+  step "create_secondary_seal_key" {
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.secondary_seal}"
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_id      = step.create_vpc.id
+      cluster_meta    = "secondary"
+      common_tags     = global.tags
+      other_resources = step.create_primary_seal_key.resource_names
+    }
+  }
+
+  step "create_external_integration_target" {
+    description = global.description.create_external_integration_target
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["24.04"]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  // Create all of our instances for both primary and secondary clusters
+  step "create_primary_cluster_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on = [
+      step.create_vpc,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_primary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_primary_cluster_backend_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.primary_backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on = [
+      step.create_vpc,
+    ]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
+      cluster_tag_key = global.backend_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_primary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_primary_cluster_additional_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on = [
+      step.create_vpc,
+      step.create_primary_cluster_targets,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_name    = step.create_primary_cluster_targets.cluster_name
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_primary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_secondary_cluster_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_secondary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "create_secondary_cluster_backend_targets" {
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.secondary_backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
+      cluster_tag_key = global.backend_tag_key
+      common_tags     = global.tags
+      seal_key_names  = step.create_secondary_seal_key.resource_names
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
+  step "set_up_external_integration_target" {
+    description = global.description.set_up_external_integration_target
+    module      = module.set_up_external_integration_target
+    depends_on = [
+      step.create_external_integration_target
+    ]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      hosts      = step.create_external_integration_target.hosts
+      ip_version = matrix.ip_version
+      packages   = concat(global.packages, global.distro_packages["ubuntu"]["24.04"], ["podman", "podman-docker"])
+      ports      = global.integration_host_ports
+    }
+  }
+
+  step "create_primary_backend_cluster" {
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.primary_backend}"
+    depends_on = [
+      step.create_primary_cluster_backend_targets,
+    ]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_server,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_cli_validate,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_notified,
+      quality.consul_service_systemd_unit,
+    ]
+
+    variables {
+      cluster_name    = step.create_primary_cluster_backend_targets.cluster_name
+      cluster_tag_key = global.backend_tag_key
+      hosts           = step.create_primary_cluster_backend_targets.hosts
+      license         = (matrix.primary_backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      release = {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      }
+    }
+  }
+
+  step "create_primary_cluster" {
+    description = global.description.create_vault_cluster
+    module      = module.vault_cluster
+    depends_on = [
+      step.create_primary_backend_cluster,
+      step.build_vault,
+      step.create_primary_cluster_targets,
+      step.set_up_external_integration_target
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      // verified in modules
+      quality.consul_service_start_client,
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_socket,
+      quality.vault_audit_syslog,
+      quality.vault_autojoin_aws,
+      quality.vault_config_env_variables,
+      quality.vault_config_file,
+      quality.vault_config_log_level,
+      quality.vault_init,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_storage_backend_consul,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_cli_status_exit_code,
+      quality.vault_service_systemd_notified,
+      quality.vault_service_systemd_unit,
+    ]
+
+    variables {
+      artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
+      backend_cluster_name    = step.create_primary_cluster_backend_targets.cluster_name
+      backend_cluster_tag_key = global.backend_tag_key
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.primary_backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      cluster_name            = step.create_primary_cluster_targets.cluster_name
+      consul_release = matrix.primary_backend == "consul" ? {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      } : null
+      enable_audit_devices = var.vault_enable_audit_devices
+      hosts                = step.create_primary_cluster_targets.hosts
+      install_dir          = global.vault_install_dir[matrix.artifact_type]
+      ip_version           = matrix.ip_version
+      license              = matrix.edition != "ce" ? step.read_vault_license.license : null
+      local_artifact_path  = local.artifact_path
+      manage_service       = local.manage_service
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
+      seal_attributes      = step.create_primary_seal_key.attributes
+      seal_type            = matrix.primary_seal
+      storage_backend      = matrix.primary_backend
+    }
+  }
+
+  step "get_local_metadata" {
+    skip_step = matrix.artifact_source != "local"
+    module    = module.get_local_metadata
+  }
+
+  step "wait_for_primary_cluster_leader" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_primary_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      hosts             = step.create_primary_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "create_secondary_backend_cluster" {
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.secondary_backend}"
+    depends_on = [
+      step.create_secondary_cluster_backend_targets
+    ]
+
+    providers = {
+      enos = provider.enos.ubuntu
+    }
+
+    variables {
+      cluster_name    = step.create_secondary_cluster_backend_targets.cluster_name
+      cluster_tag_key = global.backend_tag_key
+      hosts           = step.create_secondary_cluster_backend_targets.hosts
+      license         = (matrix.secondary_backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      release = {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      }
+    }
+  }
+
+  step "create_secondary_cluster" {
+    module = module.vault_cluster
+    depends_on = [
+      step.create_secondary_backend_cluster,
+      step.build_vault,
+      step.create_secondary_cluster_targets
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_client,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_notified,
+      quality.consul_service_systemd_unit,
+    ]
+
+    variables {
+      artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
+      backend_cluster_name    = step.create_secondary_cluster_backend_targets.cluster_name
+      backend_cluster_tag_key = global.backend_tag_key
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.secondary_backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      cluster_name            = step.create_secondary_cluster_targets.cluster_name
+      consul_release = matrix.secondary_backend == "consul" ? {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      } : null
+      enable_audit_devices = var.vault_enable_audit_devices
+      hosts                = step.create_secondary_cluster_targets.hosts
+      install_dir          = global.vault_install_dir[matrix.artifact_type]
+      ip_version           = matrix.ip_version
+      license              = matrix.edition != "ce" ? step.read_vault_license.license : null
+      local_artifact_path  = local.artifact_path
+      manage_service       = local.manage_service
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
+      seal_attributes      = step.create_secondary_seal_key.attributes
+      seal_type            = matrix.secondary_seal
+      storage_backend      = matrix.secondary_backend
+    }
+  }
+
+  step "wait_for_secondary_cluster_leader" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_secondary_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = local.vault_install_dir
+      vault_root_token  = step.create_secondary_cluster.root_token
+    }
+  }
+
+  step "verify_that_vault_primary_cluster_is_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on = [
+      step.create_primary_cluster,
+      step.wait_for_primary_cluster_leader,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_auto_unseals_after_autopilot_upgrade,
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_primary_cluster_targets.hosts
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "verify_that_vault_secondary_cluster_is_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on = [
+      step.create_secondary_cluster,
+      step.wait_for_secondary_cluster_leader,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_auto_unseals_after_autopilot_upgrade,
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "get_primary_cluster_ips" {
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.verify_that_vault_primary_cluster_is_unsealed]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
+    variables {
+      hosts             = step.create_primary_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "get_secondary_cluster_ips" {
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.verify_that_vault_secondary_cluster_is_unsealed]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_secondary_cluster.root_token
+    }
+  }
+
+  step "verify_vault_version" {
+    description = global.description.verify_vault_version
+    module      = module.vault_verify_version
+    depends_on  = [step.get_primary_cluster_ips]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_version_history_keys,
+      quality.vault_api_sys_version_history_key_info,
+      quality.vault_version_build_date,
+      quality.vault_version_edition,
+      quality.vault_version_release,
+    ]
+
+    variables {
+      hosts                 = step.create_primary_cluster_targets.hosts
+      vault_addr            = step.create_primary_cluster.api_addr_localhost
+      vault_edition         = matrix.edition
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
+      vault_product_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
+      vault_revision        = matrix.artifact_source == "local" ? step.get_local_metadata.revision : var.vault_revision
+      vault_build_date      = matrix.artifact_source == "local" ? step.get_local_metadata.build_date : var.vault_build_date
+      vault_root_token      = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "verify_ui" {
+    description = global.description.verify_ui
+    module      = module.vault_verify_ui
+    depends_on  = [step.get_primary_cluster_ips]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = quality.vault_ui_assets
+
+    variables {
+      vault_addr = step.create_primary_cluster.api_addr_localhost
+      hosts      = step.create_primary_cluster_targets.hosts
+    }
+  }
+
+  step "verify_secrets_engines_on_primary" {
+    description = global.description.verify_secrets_engines_create
+    module      = module.vault_verify_secrets_engines_create
+    depends_on = [
+      step.get_primary_cluster_ips
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_auth_userpass_user_write,
+      quality.vault_api_identity_entity_write,
+      quality.vault_api_identity_entity_alias_write,
+      quality.vault_api_identity_group_write,
+      quality.vault_api_identity_oidc_config_write,
+      quality.vault_api_identity_oidc_introspect_write,
+      quality.vault_api_identity_oidc_key_write,
+      quality.vault_api_identity_oidc_key_rotate_write,
+      quality.vault_api_identity_oidc_role_write,
+      quality.vault_api_identity_oidc_token_read,
+      quality.vault_api_sys_auth_userpass_user_write,
+      quality.vault_api_sys_policy_write,
+      quality.vault_mount_auth,
+      quality.vault_mount_kv,
+      quality.vault_secrets_kmip_write_config,
+      quality.vault_secrets_kv_write,
+      quality.vault_secrets_ldap_write_config,
+    ]
+
+    variables {
+      hosts                  = step.create_primary_cluster_targets.hosts
+      ip_version             = matrix.ip_version
+      integration_host_state = step.set_up_external_integration_target.state
+      ldap_enabled           = false
+      leader_host            = step.get_primary_cluster_ips.leader_host
+      ports                  = global.ports
+      ipv4_cidr              = step.create_vpc.ipv4_cidr
+      vault_addr             = step.create_primary_cluster.api_addr_localhost
+      vault_edition          = matrix.edition
+      vault_install_dir      = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token       = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "configure_performance_replication_primary" {
+    description = <<-EOF
+      Create the necessary superuser auth policy necessary for performance replication, assign it
+      to a our previously create test user, and enable performance replication on the primary
+      cluster.
+    EOF
+    module      = module.vault_setup_perf_primary
+    depends_on = [
+      // Wait for both clusters to be up and healthy...
+      step.get_primary_cluster_ips,
+      step.get_secondary_cluster_ips,
+      step.verify_secrets_engines_on_primary,
+      // Wait base verification to complete...
+      step.verify_vault_version,
+      step.verify_ui,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_auth_userpass_user_write,
+      quality.vault_api_identity_entity_write,
+      quality.vault_api_identity_entity_alias_write,
+      quality.vault_api_identity_group_write,
+      quality.vault_api_identity_oidc_config_write,
+      quality.vault_api_identity_oidc_introspect_write,
+      quality.vault_api_identity_oidc_key_write,
+      quality.vault_api_identity_oidc_key_rotate_write,
+      quality.vault_api_identity_oidc_role_write,
+      quality.vault_api_identity_oidc_token_read,
+      quality.vault_api_sys_auth_userpass_user_write,
+      quality.vault_api_sys_policy_write,
+      quality.vault_mount_auth,
+      quality.vault_mount_kv,
+      quality.vault_secrets_kv_write,
+    ]
+
+    variables {
+      ip_version          = matrix.ip_version
+      primary_leader_host = step.get_primary_cluster_ips.leader_host
+      vault_addr          = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir   = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token    = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "generate_secondary_token" {
+    description = <<-EOF
+      Generate a random token and configure the performance replication primary secondary-token and
+      configure the Vault cluster primary replication with the token. Export the wrapping token
+      so that secondary clusters can utilize it.
+    EOF
+    module      = module.generate_secondary_token
+    depends_on  = [step.configure_performance_replication_primary]
+
+    verifies = quality.vault_api_sys_replication_performance_primary_secondary_token_write
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      ip_version          = matrix.ip_version
+      primary_leader_host = step.get_primary_cluster_ips.leader_host
+      replication_type    = "performance"
+      vault_addr          = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir   = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token    = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "configure_performance_replication_secondary" {
+    description = <<-EOF
+      Enable performance replication on the secondary cluster with the wrapping token created by
+      the primary cluster.
+    EOF
+    module      = module.vault_setup_replication_secondary
+    depends_on  = [step.generate_secondary_token]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = quality.vault_api_sys_replication_performance_secondary_enable_write
+
+    variables {
+      ip_version            = matrix.ip_version
+      secondary_leader_host = step.get_secondary_cluster_ips.leader_host
+      replication_type      = "performance"
+      vault_addr            = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token      = step.create_secondary_cluster.root_token
+      wrapping_token        = step.generate_secondary_token.secondary_token
+    }
+  }
+
+  step "unseal_secondary_followers" {
+    description = <<-EOF
+      After replication is enabled the secondary cluster followers need to be unsealed.
+      Secondary unseal keys are passed differently depending primary and secondary seal
+      type combinations. See the guide for more information:
+        https://developer.hashicorp.com/vault/docs/enterprise/replication#seals
+    EOF
+    module      = module.vault_unseal_replication_followers
+    depends_on = [
+      step.create_primary_cluster,
+      step.create_secondary_cluster,
+      step.get_secondary_cluster_ips,
+      step.configure_performance_replication_secondary
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      hosts             = step.get_secondary_cluster_ips.follower_hosts
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_seal_type   = matrix.primary_seal == "shamir" ? matrix.primary_seal : matrix.secondary_seal
+      vault_unseal_keys = matrix.primary_seal == "shamir" ? step.create_primary_cluster.unseal_keys_hex : step.create_primary_cluster.recovery_keys_hex
+    }
+  }
+
+  step "verify_secondary_cluster_is_unsealed_after_enabling_replication" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on = [
+      step.unseal_secondary_followers
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_auto_unseals_after_autopilot_upgrade,
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_secondary_cluster_targets.hosts
+      vault_addr        = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "verify_performance_replication" {
+    description = <<-EOF
+      Verify that the performance replication status meets our expectations after enabling replication
+      and ensuring that all secondary nodes are unsealed.
+    EOF
+    module      = module.vault_verify_performance_replication
+    depends_on  = [step.verify_secondary_cluster_is_unsealed_after_enabling_replication]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_replication_performance_read_connection_status_connected,
+      quality.vault_api_sys_replication_performance_status_read,
+      quality.vault_api_sys_replication_performance_status_read_cluster_address,
+      quality.vault_api_sys_replication_performance_status_read_state_not_idle,
+      quality.vault_api_sys_replication_performance_status_known_primary_cluster_addrs,
+    ]
+
+    variables {
+      ip_version            = matrix.ip_version
+      primary_leader_host   = step.get_primary_cluster_ips.leader_host
+      secondary_leader_host = step.get_secondary_cluster_ips.leader_host
+      vault_addr            = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "verify_replicated_data" {
+    description = global.description.verify_secrets_engines_read
+    module      = module.vault_verify_secrets_engines_read
+    depends_on = [
+      step.verify_performance_replication,
+      step.get_secondary_cluster_ips,
+      step.verify_secrets_engines_on_primary
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_identity_entity_read,
+      quality.vault_api_identity_oidc_config_read,
+      quality.vault_api_identity_oidc_key_read,
+      quality.vault_api_identity_oidc_role_read,
+      quality.vault_secrets_kv_read
+    ]
+
+    variables {
+      create_state            = step.verify_secrets_engines_on_primary.state
+      hosts                   = step.get_secondary_cluster_ips.follower_hosts
+      ip_version              = matrix.ip_version
+      ldap_enabled            = false
+      vault_addr              = step.create_secondary_cluster.api_addr_localhost
+      vault_edition           = matrix.edition
+      vault_install_dir       = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token        = step.create_secondary_cluster.root_token
+      verify_pki_certs        = false
+      verify_aws_engine_creds = false
+      verify_ssh_secrets      = false
+    }
+  }
+
+  step "verify_secrets_engines_delete" {
+    description = global.description.verify_secrets_engines_delete
+    module      = module.vault_verify_secrets_engines_delete
+    depends_on = [
+      step.verify_secrets_engines_on_primary,
+      step.verify_replicated_data
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_ssh_role_delete
+    ]
+
+    variables {
+      create_state       = step.verify_secrets_engines_on_primary.state
+      hosts              = step.get_secondary_cluster_ips.follower_hosts
+      leader_host        = step.get_secondary_cluster_ips.leader_host
+      vault_addr         = step.create_secondary_cluster.api_addr_localhost
+      vault_install_dir  = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token   = step.create_secondary_cluster.root_token
+      verify_ssh_secrets = false
+    }
+  }
+
+  step "add_additional_nodes_to_primary_cluster" {
+    description = <<-EOF
+      Add additional nodes the Vault Cluster to prepare for our catostrophic failure simulation.
+      These nodes will use a different storage storage_node_prefix
+    EOF
+    module      = module.vault_cluster
+    depends_on = [
+      step.create_vpc,
+      step.create_primary_backend_cluster,
+      step.create_primary_cluster,
+      step.verify_replicated_data,
+      step.create_primary_cluster_additional_targets
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      // unique to this invocation of the module
+      quality.vault_autojoins_new_nodes_into_initialized_cluster,
+      // verified in modules
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_socket,
+      quality.vault_audit_syslog,
+      quality.vault_autojoin_aws,
+      quality.vault_config_env_variables,
+      quality.vault_config_file,
+      quality.vault_config_log_level,
+      quality.vault_init,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_storage_backend_consul,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_service_systemd_notified,
+      quality.vault_service_systemd_unit,
+      quality.vault_cli_status_exit_code,
+    ]
+
+    variables {
+      artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
+      backend_cluster_name    = step.create_primary_cluster_backend_targets.cluster_name
+      backend_cluster_tag_key = global.backend_tag_key
+      cluster_name            = step.create_primary_cluster_targets.cluster_name
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.primary_backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
+      consul_release = matrix.primary_backend == "consul" ? {
+        edition = matrix.consul_edition
+        version = matrix.consul_version
+      } : null
+      enable_audit_devices = var.vault_enable_audit_devices
+      force_unseal         = matrix.primary_seal == "shamir"
+      hosts                = step.create_primary_cluster_additional_targets.hosts
+      // Don't init when adding nodes into the cluster.
+      initialize_cluster  = false
+      install_dir         = global.vault_install_dir[matrix.artifact_type]
+      ip_version          = matrix.ip_version
+      license             = matrix.edition != "ce" ? step.read_vault_license.license : null
+      local_artifact_path = local.artifact_path
+      manage_service      = local.manage_service
+      packages            = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
+      root_token          = step.create_primary_cluster.root_token
+      seal_attributes     = step.create_primary_seal_key.attributes
+      seal_type           = matrix.primary_seal
+      shamir_unseal_keys  = matrix.primary_seal == "shamir" ? step.create_primary_cluster.unseal_keys_hex : null
+      storage_backend     = matrix.primary_backend
+      storage_node_prefix = "newprimary_node"
+    }
+  }
+
+  step "verify_additional_primary_nodes_are_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on  = [step.add_additional_nodes_to_primary_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_auto_unseals_after_autopilot_upgrade,
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_primary_cluster_additional_targets.hosts
+      vault_addr        = step.add_additional_nodes_to_primary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "verify_raft_auto_join_voter" {
+    description = global.description.verify_raft_cluster_all_nodes_are_voters
+    skip_step   = matrix.primary_backend != "raft"
+    module      = module.vault_verify_raft_auto_join_voter
+    depends_on = [
+      step.add_additional_nodes_to_primary_cluster,
+      step.create_primary_cluster,
+      step.verify_additional_primary_nodes_are_unsealed
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = quality.vault_raft_voters
+
+    variables {
+      hosts             = step.create_primary_cluster_additional_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "remove_primary_follower_1" {
+    description = <<-EOF
+      Simulate a catostrophic failure by forcefully removing the a follower node from the Vault
+      Cluster.
+    EOF
+    module      = module.shutdown_node
+    depends_on = [
+      step.verify_additional_primary_nodes_are_unsealed,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      host = step.get_primary_cluster_ips.follower_hosts["0"]
+    }
+  }
+
+  step "remove_primary_leader" {
+    description = <<-EOF
+      Simulate a catostrophic failure by forcefully removing the the primary leader node from the
+      Vault Cluster without allowing a graceful shutdown.
+    EOF
+    module      = module.shutdown_node
+    depends_on = [
+      step.get_primary_cluster_ips,
+      step.remove_primary_follower_1
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    variables {
+      host = step.get_primary_cluster_ips.leader_host
+    }
+  }
+
+  step "get_remaining_hosts_replication_data" {
+    description = <<-EOF
+      An arithmetic module that we use to determine various metadata about the the leader and
+      follower nodes of the primary cluster so that we can correctly enable performance replication.
+
+      We execute this to determine information about our hosts after having forced the leader
+      and a follower from the cluster.
+    EOF
+
+    module = module.replication_data
+    depends_on = [
+      step.get_primary_cluster_ips,
+      step.remove_primary_leader,
+    ]
+
+    variables {
+      added_hosts           = step.create_primary_cluster_additional_targets.hosts
+      initial_hosts         = step.create_primary_cluster_targets.hosts
+      removed_follower_host = step.get_primary_cluster_ips.follower_hosts["0"]
+      removed_primary_host  = step.get_primary_cluster_ips.leader_host
+    }
+  }
+
+  step "wait_for_leader_in_remaining_hosts" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on = [
+      step.remove_primary_leader,
+      step.get_remaining_hosts_replication_data,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      hosts             = step.get_remaining_hosts_replication_data.remaining_hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "get_updated_primary_cluster_ips" {
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on = [
+      step.get_remaining_hosts_replication_data,
+      step.wait_for_leader_in_remaining_hosts,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
+    variables {
+      hosts             = step.get_remaining_hosts_replication_data.remaining_hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_primary_cluster.root_token
+    }
+  }
+
+  step "verify_updated_performance_replication" {
+    description = <<-EOF
+      Verify that the performance replication status meets our expectations after the new leader
+      election.
+    EOF
+
+    module = module.vault_verify_performance_replication
+    depends_on = [
+      step.get_remaining_hosts_replication_data,
+      step.wait_for_leader_in_remaining_hosts,
+      step.get_updated_primary_cluster_ips,
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_replication_performance_read_connection_status_connected,
+      quality.vault_api_sys_replication_performance_status_known_primary_cluster_addrs,
+      quality.vault_api_sys_replication_performance_status_read,
+      quality.vault_api_sys_replication_performance_status_read_state_not_idle,
+      quality.vault_api_sys_replication_performance_status_read_cluster_address,
+    ]
+
+    variables {
+      ip_version            = matrix.ip_version
+      primary_leader_host   = step.get_updated_primary_cluster_ips.leader_host
+      secondary_leader_host = step.get_secondary_cluster_ips.leader_host
+      vault_addr            = step.create_primary_cluster.api_addr_localhost
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  output "audit_device_file_path" {
+    description = "The file path for the file audit device, if enabled"
+    value       = step.create_primary_cluster.audit_device_file_path
+  }
+
+  output "external_integration_server_ldap" {
+    description = "The LDAP test servers info"
+    value       = step.set_up_external_integration_target.state.ldap
+  }
+
+  output "primary_cluster_hosts" {
+    description = "The Vault primary cluster target hosts"
+    value       = step.create_primary_cluster_targets.hosts
+  }
+
+  output "primary_cluster_additional_hosts" {
+    description = "The Vault added new node on primary cluster target hosts"
+    value       = step.create_primary_cluster_additional_targets.hosts
+  }
+
+  output "primary_cluster_root_token" {
+    description = "The Vault primary cluster root token"
+    value       = step.create_primary_cluster.root_token
+  }
+
+  output "primary_cluster_unseal_keys_b64" {
+    description = "The Vault primary cluster unseal keys"
+    value       = step.create_primary_cluster.unseal_keys_b64
+  }
+
+  output "primary_cluster_unseal_keys_hex" {
+    description = "The Vault primary cluster unseal keys hex"
+    value       = step.create_primary_cluster.unseal_keys_hex
+  }
+
+  output "primary_cluster_recovery_key_shares" {
+    description = "The Vault primary cluster recovery key shares"
+    value       = step.create_primary_cluster.recovery_key_shares
+  }
+
+  output "primary_cluster_recovery_keys_b64" {
+    description = "The Vault primary cluster recovery keys b64"
+    value       = step.create_primary_cluster.recovery_keys_b64
+  }
+
+  output "primary_cluster_recovery_keys_hex" {
+    description = "The Vault primary cluster recovery keys hex"
+    value       = step.create_primary_cluster.recovery_keys_hex
+  }
+
+  output "secondary_cluster_hosts" {
+    description = "The Vault secondary cluster public IPs"
+    value       = step.create_secondary_cluster_targets.hosts
+  }
+
+  output "secondary_cluster_root_token" {
+    description = "The Vault secondary cluster root token"
+    value       = step.create_secondary_cluster.root_token
+  }
+
+  output "secrets_engines_state" {
+    description = "The state of configured secrets engines"
+    sensitive   = true
+    value       = step.verify_secrets_engines_on_primary.state
+  }
+
+  output "performance_secondary_token" {
+    description = "The performance secondary replication token"
+    value       = step.generate_secondary_token.secondary_token
+  }
+
+  output "remaining_hosts" {
+    description = "The Vault cluster primary hosts after removing the leader and follower"
+    value       = step.get_remaining_hosts_replication_data.remaining_hosts
+  }
+
+  output "initial_primary_replication_status" {
+    description = "The Vault primary cluster performance replication status"
+    value       = step.verify_performance_replication.primary_replication_status
+  }
+
+  output "initial_known_primary_cluster_addresses" {
+    description = "The initial known Vault primary cluster addresses"
+    value       = step.verify_performance_replication.known_primary_cluster_addrs
+  }
+
+  output "initial_secondary_performance_replication_status" {
+    description = "The Vault secondary cluster performance replication status"
+    value       = step.verify_performance_replication.secondary_replication_status
+  }
+
+  output "intial_primary_replication_data_secondaries" {
+    description = "The Vault primary cluster secondaries connection status"
+    value       = step.verify_performance_replication.primary_replication_data_secondaries
+  }
+
+  output "initial_secondary_replication_data_primaries" {
+    description = "The Vault secondary cluster primaries connection status"
+    value       = step.verify_performance_replication.secondary_replication_data_primaries
+  }
+
+  output "updated_primary_replication_status" {
+    description = "The Vault updated primary cluster performance replication status"
+    value       = step.verify_updated_performance_replication.primary_replication_status
+  }
+
+  output "updated_known_primary_cluster_addresses" {
+    description = "The Vault secondary cluster performance replication status"
+    value       = step.verify_updated_performance_replication.known_primary_cluster_addrs
+  }
+
+  output "updated_secondary_replication_status" {
+    description = "The Vault updated secondary cluster performance replication status"
+    value       = step.verify_updated_performance_replication.secondary_replication_status
+  }
+
+  output "updated_primary_replication_data_secondaries" {
+    description = "The Vault updated primary cluster secondaries connection status"
+    value       = step.verify_updated_performance_replication.primary_replication_data_secondaries
+  }
+
+  output "updated_secondary_replication_data_primaries" {
+    description = "The Vault updated secondary cluster primaries connection status"
+    value       = step.verify_updated_performance_replication.secondary_replication_data_primaries
+  }
+}
diff --git a/enos/enos-scenario-proxy.hcl b/enos/enos-scenario-proxy.hcl
index a0f8676a353..035fa0b75b2 100644
--- a/enos/enos-scenario-proxy.hcl
+++ b/enos/enos-scenario-proxy.hcl
@@ -1,34 +1,78 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 scenario "proxy" {
+  description = <<-EOF
+  The proxy scenario verifies Vault when running in Proxy mode. The build can be a local branch,
+    any CRT built Vault artifact saved to the local machine, or any CRT built Vault artifact in the
+    stable channel in Artifactory.
+
+  The scenario creates a new Vault Cluster using the candidate build and then runs the same Vault
+  build in Proxy mode and verifies behavior against the Vault cluster. The scenario also performs
+  standard baseline verification that is not specific to the Proxy mode deployment.
+
+  # How to run this scenario
+
+  For general instructions on running a scenario, refer to the Enos docs: https://eng-handbook.hashicorp.services/internal-tools/enos/running-a-scenario/
+  For troubleshooting tips and common errors, see https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/.
+
+  Variables required for all scenario variants:
+    - aws_ssh_private_key_path (more info about AWS SSH keypairs: https://eng-handbook.hashicorp.services/internal-tools/enos/getting-started/#set-your-aws-key-pair-name-and-private-key)
+    - aws_ssh_keypair_name
+    - vault_build_date*
+    - vault_product_version
+    - vault_revision*
+
+  * If you don't already know what build date and revision you should be using, see
+  https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
+
+  Variables required for some scenario variants:
+    - artifactory_token (if using `artifact_source:artifactory` in your filter)
+    - aws_region (if different from the default value in enos-variables.hcl)
+    - consul_license_path (if using an ENT edition of Consul)
+    - distro_version_<distro> (if different from the default version for your target
+    distro. See supported distros and default versions in the distro_version_<distro>
+    definitions in enos-variables.hcl)
+    - vault_artifact_path (the path to where you have a Vault artifact already downloaded,
+    if using `artifact_source:crt` in your filter)
+    - vault_license_path (if using an ENT edition of Vault)
+  EOF
+
   matrix {
     arch            = global.archs
     artifact_source = global.artifact_sources
     artifact_type   = global.artifact_types
     backend         = global.backends
+    config_mode     = global.config_modes
+    consul_edition  = global.consul_editions
     consul_version  = global.consul_versions
     distro          = global.distros
     edition         = global.editions
+    ip_version      = global.ip_versions
     seal            = global.seals
-    seal_ha_beta    = ["true", "false"]
 
-    # Our local builder always creates bundles
+    // Our local builder always creates bundles
     exclude {
       artifact_source = ["local"]
       artifact_type   = ["package"]
     }
 
-    # HSM and FIPS 140-2 are only supported on amd64
+    // PKCS#11 can only be used on ent.hsm and ent.hsm.fips1403.
     exclude {
-      arch    = ["arm64"]
-      edition = ["ent.fips1402", "ent.hsm", "ent.hsm.fips1402"]
+      seal    = ["pkcs11"]
+      edition = [for e in matrix.edition : e if !strcontains(e, "hsm")]
     }
 
-    # PKCS#11 can only be used on ent.hsm and ent.hsm.fips1402.
+    // softhsm packages not available for leap/sles.
     exclude {
-      seal    = ["pkcs11"]
-      edition = ["ce", "ent", "ent.fips1402"]
+      seal   = ["pkcs11"]
+      distro = ["leap", "sles"]
+    }
+
+    // Testing in IPV6 mode is currently implemented for integrated Raft storage only
+    exclude {
+      ip_version = ["6"]
+      backend    = ["consul"]
     }
   }
 
@@ -36,63 +80,71 @@ scenario "proxy" {
   terraform     = terraform.default
   providers = [
     provider.aws.default,
-    provider.enos.ubuntu,
-    provider.enos.rhel
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
   ]
 
   locals {
     artifact_path = matrix.artifact_source != "artifactory" ? abspath(var.vault_artifact_path) : null
     enos_provider = {
-      rhel   = provider.enos.rhel
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
       ubuntu = provider.enos.ubuntu
     }
     manage_service    = matrix.artifact_type == "bundle"
-    vault_install_dir = matrix.artifact_type == "bundle" ? var.vault_install_dir : global.vault_install_dir_packages[matrix.distro]
+    vault_install_dir = global.vault_install_dir[matrix.artifact_type]
   }
 
   step "get_local_metadata" {
-    skip_step = matrix.artifact_source != "local"
-    module    = module.get_local_metadata
+    description = global.description.get_local_metadata
+    skip_step   = matrix.artifact_source != "local"
+    module      = module.get_local_metadata
   }
 
   step "build_vault" {
-    module = "build_${matrix.artifact_source}"
+    description = global.description.build_vault
+    module      = "build_${matrix.artifact_source}"
 
     variables {
-      build_tags           = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
-      artifact_path        = local.artifact_path
-      goarch               = matrix.arch
-      goos                 = "linux"
-      artifactory_host     = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
-      artifactory_repo     = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
-      artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
-      artifactory_token    = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
-      arch                 = matrix.artifact_source == "artifactory" ? matrix.arch : null
-      product_version      = var.vault_product_version
-      artifact_type        = matrix.artifact_type
-      distro               = matrix.artifact_source == "artifactory" ? matrix.distro : null
-      edition              = matrix.artifact_source == "artifactory" ? matrix.edition : null
-      revision             = var.vault_revision
+      build_tags        = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      artifact_path     = local.artifact_path
+      goarch            = matrix.arch
+      goos              = "linux"
+      artifactory_host  = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
+      artifactory_repo  = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
+      artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
+      arch              = matrix.artifact_source == "artifactory" ? matrix.arch : null
+      product_version   = var.vault_product_version
+      artifact_type     = matrix.artifact_type
+      distro            = matrix.artifact_source == "artifactory" ? matrix.distro : null
+      edition           = matrix.artifact_source == "artifactory" ? matrix.edition : null
+      revision          = var.vault_revision
     }
   }
 
   step "ec2_info" {
-    module = module.ec2_info
+    description = global.description.ec2_info
+    module      = module.ec2_info
   }
 
   step "create_vpc" {
-    module = module.create_vpc
+    description = global.description.create_vpc
+    module      = module.create_vpc
 
     variables {
       common_tags = global.tags
+      ip_version  = matrix.ip_version
     }
   }
 
   // This step reads the contents of the backend license if we're using a Consul backend and
-  // the edition is "ent".
+  // an "ent" Consul edition.
   step "read_backend_license" {
-    skip_step = matrix.backend == "raft" || var.backend_edition == "ce"
-    module    = module.read_license
+    description = global.description.read_backend_license
+    skip_step   = matrix.backend == "raft" || matrix.consul_edition == "ce"
+    module      = module.read_license
 
     variables {
       file_name = global.backend_license_path
@@ -100,8 +152,9 @@ scenario "proxy" {
   }
 
   step "read_vault_license" {
-    skip_step = matrix.edition == "ce"
-    module    = module.read_license
+    description = global.description.read_vault_license
+    skip_step   = matrix.edition == "ce"
+    module      = module.read_license
 
     variables {
       file_name = global.vault_license_path
@@ -109,8 +162,9 @@ scenario "proxy" {
   }
 
   step "create_seal_key" {
-    module     = "seal_${matrix.seal}"
-    depends_on = [step.create_vpc]
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.seal}"
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
@@ -122,9 +176,27 @@ scenario "proxy" {
     }
   }
 
+  step "create_external_integration_target" {
+    description = global.description.create_external_integration_target
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["24.04"]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
   step "create_vault_cluster_targets" {
-    module     = module.target_ec2_instances
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
@@ -140,15 +212,16 @@ scenario "proxy" {
   }
 
   step "create_vault_cluster_backend_targets" {
-    module     = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
     variables {
-      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["22.04"]
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
       cluster_tag_key = global.backend_tag_key
       common_tags     = global.tags
       seal_key_names  = step.create_seal_key.resource_names
@@ -156,30 +229,69 @@ scenario "proxy" {
     }
   }
 
+  step "set_up_external_integration_target" {
+    description = global.description.set_up_external_integration_target
+    module      = module.set_up_external_integration_target
+    depends_on = [
+      step.create_external_integration_target
+    ]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      hosts      = step.create_external_integration_target.hosts
+      ip_version = matrix.ip_version
+      packages   = concat(global.packages, global.distro_packages["ubuntu"]["24.04"], ["podman", "podman-docker"])
+      ports      = global.integration_host_ports
+    }
+  }
+
   step "create_backend_cluster" {
-    module = "backend_${matrix.backend}"
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.backend}"
     depends_on = [
-      step.create_vault_cluster_backend_targets
+      step.create_vault_cluster_backend_targets,
+      step.set_up_external_integration_target
     ]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_server,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_cli_validate,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_notified,
+      quality.consul_service_systemd_unit,
+    ]
+
     variables {
       cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       cluster_tag_key = global.backend_tag_key
-      license         = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      hosts           = step.create_vault_cluster_backend_targets.hosts
+      license         = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       release = {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = matrix.consul_version
       }
-      target_hosts = step.create_vault_cluster_backend_targets.hosts
     }
   }
 
   step "create_vault_cluster" {
-    module = module.vault_cluster
+    description = global.description.create_vault_cluster
+    module      = module.vault_cluster
     depends_on = [
       step.create_backend_cluster,
       step.build_vault,
@@ -190,49 +302,93 @@ scenario "proxy" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_service_start_client,
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_socket,
+      quality.vault_audit_syslog,
+      quality.vault_autojoin_aws,
+      quality.vault_config_env_variables,
+      quality.vault_config_file,
+      quality.vault_config_log_level,
+      quality.vault_init,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_storage_backend_consul,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_service_systemd_notified,
+      quality.vault_service_systemd_unit,
+      quality.vault_cli_status_exit_code,
+    ]
+
     variables {
       artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
       backend_cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       backend_cluster_tag_key = global.backend_tag_key
       cluster_name            = step.create_vault_cluster_targets.cluster_name
-      consul_license          = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       consul_release = matrix.backend == "consul" ? {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = matrix.consul_version
       } : null
       enable_audit_devices = var.vault_enable_audit_devices
-      install_dir          = local.vault_install_dir
+      hosts                = step.create_vault_cluster_targets.hosts
+      install_dir          = global.vault_install_dir[matrix.artifact_type]
+      ip_version           = matrix.ip_version
       license              = matrix.edition != "ce" ? step.read_vault_license.license : null
       local_artifact_path  = local.artifact_path
       manage_service       = local.manage_service
-      packages             = concat(global.packages, global.distro_packages[matrix.distro])
-      seal_ha_beta         = matrix.seal_ha_beta
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
       seal_attributes      = step.create_seal_key.attributes
       seal_type            = matrix.seal
       storage_backend      = matrix.backend
-      target_hosts         = step.create_vault_cluster_targets.hosts
     }
   }
 
   // Wait for our cluster to elect a leader
   step "wait_for_leader" {
-    module     = module.vault_wait_for_leader
-    depends_on = [step.create_vault_cluster]
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_vault_cluster]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
     variables {
-      timeout           = 120 # seconds
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "start_vault_proxy" {
-    module = "vault_proxy"
+    module = module.vault_proxy
     depends_on = [
       step.build_vault,
       step.create_vault_cluster,
@@ -242,40 +398,89 @@ scenario "proxy" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_cli_auth_enable_approle,
+      quality.vault_proxy_auto_auth_approle,
+      quality.vault_proxy_cli_access,
+    ]
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "get_vault_cluster_ips" {
-    module     = module.vault_get_cluster_ips
-    depends_on = [step.wait_for_leader]
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_leader]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
+  step "verify_vault_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on  = [step.create_vault_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
   step "verify_vault_version" {
-    module     = module.vault_verify_version
-    depends_on = [step.create_vault_cluster]
+    description = global.description.verify_vault_version
+    module      = module.vault_verify_version
+    depends_on  = [step.verify_vault_unsealed]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_version_history_keys,
+      quality.vault_api_sys_version_history_key_info,
+      quality.vault_version_build_date,
+      quality.vault_version_edition,
+      quality.vault_version_release,
+    ]
+
     variables {
-      vault_instances       = step.create_vault_cluster_targets.hosts
+      hosts                 = step.create_vault_cluster_targets.hosts
+      vault_addr            = step.create_vault_cluster.api_addr_localhost
       vault_edition         = matrix.edition
-      vault_install_dir     = local.vault_install_dir
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
       vault_product_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
       vault_revision        = matrix.artifact_source == "local" ? step.get_local_metadata.revision : var.vault_revision
       vault_build_date      = matrix.artifact_source == "local" ? step.get_local_metadata.build_date : var.vault_build_date
@@ -283,98 +488,196 @@ scenario "proxy" {
     }
   }
 
-  step "verify_vault_unsealed" {
-    module     = module.vault_verify_unsealed
-    depends_on = [step.create_vault_cluster]
+  step "verify_secrets_engines_create" {
+    description = global.description.verify_secrets_engines_create
+    module      = module.vault_verify_secrets_engines_create
+    depends_on = [
+      step.verify_vault_unsealed,
+      step.get_vault_cluster_ips
+    ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_auth_userpass_user_write,
+      quality.vault_api_identity_entity_write,
+      quality.vault_api_identity_entity_alias_write,
+      quality.vault_api_identity_group_write,
+      quality.vault_api_identity_oidc_config_write,
+      quality.vault_api_identity_oidc_introspect_write,
+      quality.vault_api_identity_oidc_key_write,
+      quality.vault_api_identity_oidc_key_rotate_write,
+      quality.vault_api_identity_oidc_role_write,
+      quality.vault_api_identity_oidc_token_read,
+      quality.vault_api_sys_auth_userpass_user_write,
+      quality.vault_api_sys_policy_write,
+      quality.vault_mount_auth,
+      quality.vault_mount_kv,
+      quality.vault_secrets_kmip_write_config,
+      quality.vault_secrets_kv_write,
+      quality.vault_secrets_ldap_write_config,
+    ]
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      hosts                  = step.create_vault_cluster_targets.hosts
+      ip_version             = matrix.ip_version
+      integration_host_state = step.set_up_external_integration_target.state
+      leader_host            = step.get_vault_cluster_ips.leader_host
+      ports                  = global.ports
+      ipv4_cidr              = step.create_vpc.ipv4_cidr
+      vault_addr             = step.create_vault_cluster.api_addr_localhost
+      vault_edition          = matrix.edition
+      vault_install_dir      = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token       = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_write_test_data" {
-    module = module.vault_verify_write_data
-    depends_on = [
-      step.create_vault_cluster,
-      step.get_vault_cluster_ips
-    ]
+  step "verify_raft_auto_join_voter" {
+    description = global.description.verify_raft_cluster_all_nodes_are_voters
+    skip_step   = matrix.backend != "raft"
+    module      = module.vault_verify_raft_auto_join_voter
+    depends_on  = [step.verify_vault_unsealed]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_raft_voters
+
     variables {
-      leader_public_ip  = step.get_vault_cluster_ips.leader_public_ip
-      leader_private_ip = step.get_vault_cluster_ips.leader_private_ip
-      vault_instances   = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_raft_auto_join_voter" {
-    skip_step  = matrix.backend != "raft"
-    module     = module.vault_verify_raft_auto_join_voter
-    depends_on = [step.create_vault_cluster]
+  step "verify_replication" {
+    description = global.description.verify_replication_status
+    module      = module.vault_verify_replication
+    depends_on  = [step.verify_vault_unsealed]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_replication_ce_disabled,
+      quality.vault_replication_ent_dr_available,
+      quality.vault_replication_ent_pr_available,
+    ]
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
-      vault_root_token  = step.create_vault_cluster.root_token
+      hosts         = step.create_vault_cluster_targets.hosts
+      vault_addr    = step.create_vault_cluster.api_addr_localhost
+      vault_edition = matrix.edition
     }
   }
 
-  step "verify_replication" {
-    module     = module.vault_verify_replication
-    depends_on = [step.create_vault_cluster]
+  step "verify_secrets_engines_read" {
+    description = global.description.verify_secrets_engines_read
+    module      = module.vault_verify_secrets_engines_read
+    depends_on = [
+      step.verify_secrets_engines_create,
+      step.verify_replication
+    ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_identity_entity_read,
+      quality.vault_api_identity_oidc_config_read,
+      quality.vault_api_identity_oidc_key_read,
+      quality.vault_api_identity_oidc_role_read,
+      quality.vault_secrets_kv_read
+    ]
+
     variables {
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_vault_cluster_ips.follower_hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
       vault_edition     = matrix.edition
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_read_test_data" {
-    module = module.vault_verify_read_data
+  step "verify_log_secrets" {
+    skip_step = !var.vault_enable_audit_devices || !var.verify_log_secrets
+
+    description = global.description.verify_log_secrets
+    module      = module.verify_log_secrets
     depends_on = [
-      step.verify_write_test_data,
-      step.verify_replication
+      step.verify_secrets_engines_read,
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_audit_log_secrets,
+      quality.vault_journal_secrets,
+      quality.vault_radar_index_create,
+      quality.vault_radar_scan_file,
+    ]
+
     variables {
-      node_public_ips   = step.get_vault_cluster_ips.follower_public_ips
-      vault_install_dir = local.vault_install_dir
+      audit_log_file_path = step.create_vault_cluster.audit_device_file_path
+      leader_host         = step.get_vault_cluster_ips.leader_host
+      vault_addr          = step.create_vault_cluster.api_addr_localhost
+      vault_root_token    = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "verify_secrets_engines_delete" {
+    description = global.description.verify_secrets_engines_delete
+    module      = module.vault_verify_secrets_engines_delete
+    depends_on = [
+      step.verify_secrets_engines_create,
+      step.verify_secrets_engines_read
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_ssh_role_delete
+    ]
+
+    variables {
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_vault_cluster_ips.follower_hosts
+      leader_host       = step.get_vault_cluster_ips.leader_host
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "verify_ui" {
-    module     = module.vault_verify_ui
-    depends_on = [step.create_vault_cluster]
+    description = global.description.verify_ui
+    module      = module.vault_verify_ui
+    depends_on  = [step.verify_vault_unsealed]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_ui_assets
+
     variables {
-      vault_instances = step.create_vault_cluster_targets.hosts
+      hosts      = step.create_vault_cluster_targets.hosts
+      vault_addr = step.create_vault_cluster.api_addr_localhost
     }
   }
 
@@ -383,6 +686,16 @@ scenario "proxy" {
     value       = step.create_vault_cluster.audit_device_file_path
   }
 
+  output "external_integration_server_ldap" {
+    description = "The LDAP test servers info"
+    value       = step.set_up_external_integration_target.state.ldap
+  }
+
+  output "integration_host_kmip_state" {
+    description = "The KMIP test servers info"
+    value       = step.set_up_external_integration_target.state.kmip
+  }
+
   output "cluster_name" {
     description = "The Vault cluster name"
     value       = step.create_vault_cluster.cluster_name
@@ -390,7 +703,7 @@ scenario "proxy" {
 
   output "hosts" {
     description = "The Vault cluster target hosts"
-    value       = step.create_vault_cluster.target_hosts
+    value       = step.create_vault_cluster.hosts
   }
 
   output "private_ips" {
@@ -423,6 +736,12 @@ scenario "proxy" {
     value       = step.create_vault_cluster.recovery_keys_hex
   }
 
+  output "secrets_engines_state" {
+    description = "The state of configured secrets engines"
+    sensitive   = true
+    value       = step.verify_secrets_engines_create.state
+  }
+
   output "seal_attributes" {
     description = "The Vault cluster seal attributes"
     value       = step.create_seal_key.attributes
diff --git a/enos/enos-scenario-replication.hcl b/enos/enos-scenario-replication.hcl
deleted file mode 100644
index a96bc9b5c7a..00000000000
--- a/enos/enos-scenario-replication.hcl
+++ /dev/null
@@ -1,920 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-// The replication scenario configures performance replication between two Vault clusters and verifies
-// known_primary_cluster_addrs are updated on secondary Vault cluster with the IP addresses of replaced
-// nodes on primary Vault cluster
-scenario "replication" {
-  matrix {
-    arch              = global.archs
-    artifact_source   = global.artifact_sources
-    artifact_type     = global.artifact_types
-    consul_version    = global.consul_versions
-    distro            = global.distros
-    edition           = global.editions
-    primary_backend   = global.backends
-    primary_seal      = global.seals
-    seal_ha_beta      = ["true", "false"]
-    secondary_backend = global.backends
-    secondary_seal    = global.seals
-
-    # Our local builder always creates bundles
-    exclude {
-      artifact_source = ["local"]
-      artifact_type   = ["package"]
-    }
-
-    # HSM and FIPS 140-2 are only supported on amd64
-    exclude {
-      arch    = ["arm64"]
-      edition = ["ent.fips1402", "ent.hsm", "ent.hsm.fips1402"]
-    }
-
-    # PKCS#11 can only be used on ent.hsm and ent.hsm.fips1402.
-    exclude {
-      primary_seal = ["pkcs11"]
-      edition      = ["ce", "ent", "ent.fips1402"]
-    }
-
-    exclude {
-      secondary_seal = ["pkcs11"]
-      edition        = ["ce", "ent", "ent.fips1402"]
-    }
-  }
-
-  terraform_cli = terraform_cli.default
-  terraform     = terraform.default
-  providers = [
-    provider.aws.default,
-    provider.enos.ubuntu,
-    provider.enos.rhel
-  ]
-
-  locals {
-    artifact_path = matrix.artifact_source != "artifactory" ? abspath(var.vault_artifact_path) : null
-    enos_provider = {
-      rhel   = provider.enos.rhel
-      ubuntu = provider.enos.ubuntu
-    }
-    manage_service    = matrix.artifact_type == "bundle"
-    vault_install_dir = matrix.artifact_type == "bundle" ? var.vault_install_dir : global.vault_install_dir_packages[matrix.distro]
-  }
-
-  step "get_local_metadata" {
-    skip_step = matrix.artifact_source != "local"
-    module    = module.get_local_metadata
-  }
-
-  step "build_vault" {
-    module = "build_${matrix.artifact_source}"
-
-    variables {
-      build_tags           = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
-      artifact_path        = local.artifact_path
-      goarch               = matrix.arch
-      goos                 = "linux"
-      artifactory_host     = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
-      artifactory_repo     = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
-      artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
-      artifactory_token    = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
-      arch                 = matrix.artifact_source == "artifactory" ? matrix.arch : null
-      product_version      = var.vault_product_version
-      artifact_type        = matrix.artifact_type
-      distro               = matrix.artifact_source == "artifactory" ? matrix.distro : null
-      edition              = matrix.artifact_source == "artifactory" ? matrix.edition : null
-      revision             = var.vault_revision
-    }
-  }
-
-  step "ec2_info" {
-    module = module.ec2_info
-  }
-
-  step "create_vpc" {
-    module = module.create_vpc
-
-    variables {
-      common_tags = global.tags
-    }
-  }
-
-  // This step reads the contents of the backend license if we're using a Consul backend and
-  // the edition is "ent".
-  step "read_backend_license" {
-    skip_step = (matrix.primary_backend == "raft" && matrix.secondary_backend == "raft") || var.backend_edition == "ce"
-    module    = module.read_license
-
-    variables {
-      file_name = global.backend_license_path
-    }
-  }
-
-  step "read_vault_license" {
-    module = module.read_license
-
-    variables {
-      file_name = abspath(joinpath(path.root, "./support/vault.hclic"))
-    }
-  }
-
-  step "create_primary_seal_key" {
-    module     = "seal_${matrix.primary_seal}"
-    depends_on = [step.create_vpc]
-
-    providers = {
-      enos = provider.enos.ubuntu
-    }
-
-    variables {
-      cluster_id   = step.create_vpc.id
-      cluster_meta = "primary"
-      common_tags  = global.tags
-    }
-  }
-
-  step "create_secondary_seal_key" {
-    module     = "seal_${matrix.secondary_seal}"
-    depends_on = [step.create_vpc]
-
-    providers = {
-      enos = provider.enos.ubuntu
-    }
-
-    variables {
-      cluster_id      = step.create_vpc.id
-      cluster_meta    = "secondary"
-      common_tags     = global.tags
-      other_resources = step.create_primary_seal_key.resource_names
-    }
-  }
-
-  # Create all of our instances for both primary and secondary clusters
-  step "create_primary_cluster_targets" {
-    module = module.target_ec2_instances
-    depends_on = [
-      step.create_vpc,
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
-      cluster_tag_key = global.vault_tag_key
-      common_tags     = global.tags
-      seal_key_names  = step.create_primary_seal_key.resource_names
-      vpc_id          = step.create_vpc.id
-    }
-  }
-
-  step "create_primary_cluster_backend_targets" {
-    module = matrix.primary_backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
-    depends_on = [
-      step.create_vpc,
-    ]
-
-    providers = {
-      enos = provider.enos.ubuntu
-    }
-
-    variables {
-      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["22.04"]
-      cluster_tag_key = global.backend_tag_key
-      common_tags     = global.tags
-      seal_key_names  = step.create_primary_seal_key.resource_names
-      vpc_id          = step.create_vpc.id
-    }
-  }
-
-  step "create_primary_cluster_additional_targets" {
-    module = module.target_ec2_instances
-    depends_on = [
-      step.create_vpc,
-      step.create_primary_cluster_targets,
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
-      cluster_name    = step.create_primary_cluster_targets.cluster_name
-      cluster_tag_key = global.vault_tag_key
-      common_tags     = global.tags
-      seal_key_names  = step.create_primary_seal_key.resource_names
-      vpc_id          = step.create_vpc.id
-    }
-  }
-
-  step "create_secondary_cluster_targets" {
-    module     = module.target_ec2_instances
-    depends_on = [step.create_vpc]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      ami_id          = step.ec2_info.ami_ids[matrix.arch][matrix.distro][global.distro_version[matrix.distro]]
-      cluster_tag_key = global.vault_tag_key
-      common_tags     = global.tags
-      seal_key_names  = step.create_secondary_seal_key.resource_names
-      vpc_id          = step.create_vpc.id
-    }
-  }
-
-  step "create_secondary_cluster_backend_targets" {
-    module     = matrix.secondary_backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
-    depends_on = [step.create_vpc]
-
-    providers = {
-      enos = provider.enos.ubuntu
-    }
-
-    variables {
-      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["22.04"]
-      cluster_tag_key = global.backend_tag_key
-      common_tags     = global.tags
-      seal_key_names  = step.create_secondary_seal_key.resource_names
-      vpc_id          = step.create_vpc.id
-    }
-  }
-
-  step "create_primary_backend_cluster" {
-    module = "backend_${matrix.primary_backend}"
-    depends_on = [
-      step.create_primary_cluster_backend_targets,
-    ]
-
-    providers = {
-      enos = provider.enos.ubuntu
-    }
-
-    variables {
-      cluster_name    = step.create_primary_cluster_backend_targets.cluster_name
-      cluster_tag_key = global.backend_tag_key
-      license         = (matrix.primary_backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
-      release = {
-        edition = var.backend_edition
-        version = matrix.consul_version
-      }
-      target_hosts = step.create_primary_cluster_backend_targets.hosts
-    }
-  }
-
-  step "create_primary_cluster" {
-    module = module.vault_cluster
-    depends_on = [
-      step.create_primary_backend_cluster,
-      step.build_vault,
-      step.create_primary_cluster_targets
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
-      backend_cluster_name    = step.create_primary_cluster_backend_targets.cluster_name
-      backend_cluster_tag_key = global.backend_tag_key
-      consul_license          = (matrix.primary_backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
-      cluster_name            = step.create_primary_cluster_targets.cluster_name
-      consul_release = matrix.primary_backend == "consul" ? {
-        edition = var.backend_edition
-        version = matrix.consul_version
-      } : null
-      enable_audit_devices = var.vault_enable_audit_devices
-      install_dir          = local.vault_install_dir
-      license              = matrix.edition != "ce" ? step.read_vault_license.license : null
-      local_artifact_path  = local.artifact_path
-      manage_service       = local.manage_service
-      packages             = concat(global.packages, global.distro_packages[matrix.distro])
-      seal_attributes      = step.create_primary_seal_key.attributes
-      seal_ha_beta         = matrix.seal_ha_beta
-      seal_type            = matrix.primary_seal
-      storage_backend      = matrix.primary_backend
-      target_hosts         = step.create_primary_cluster_targets.hosts
-    }
-  }
-
-  step "create_secondary_backend_cluster" {
-    module = "backend_${matrix.secondary_backend}"
-    depends_on = [
-      step.create_secondary_cluster_backend_targets
-    ]
-
-    providers = {
-      enos = provider.enos.ubuntu
-    }
-
-    variables {
-      cluster_name    = step.create_secondary_cluster_backend_targets.cluster_name
-      cluster_tag_key = global.backend_tag_key
-      license         = (matrix.secondary_backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
-      release = {
-        edition = var.backend_edition
-        version = matrix.consul_version
-      }
-      target_hosts = step.create_secondary_cluster_backend_targets.hosts
-    }
-  }
-
-  step "create_secondary_cluster" {
-    module = module.vault_cluster
-    depends_on = [
-      step.create_secondary_backend_cluster,
-      step.build_vault,
-      step.create_secondary_cluster_targets
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
-      backend_cluster_name    = step.create_secondary_cluster_backend_targets.cluster_name
-      backend_cluster_tag_key = global.backend_tag_key
-      consul_license          = (matrix.secondary_backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
-      cluster_name            = step.create_secondary_cluster_targets.cluster_name
-      consul_release = matrix.secondary_backend == "consul" ? {
-        edition = var.backend_edition
-        version = matrix.consul_version
-      } : null
-      enable_audit_devices = var.vault_enable_audit_devices
-      install_dir          = local.vault_install_dir
-      license              = matrix.edition != "ce" ? step.read_vault_license.license : null
-      local_artifact_path  = local.artifact_path
-      manage_service       = local.manage_service
-      packages             = concat(global.packages, global.distro_packages[matrix.distro])
-      seal_attributes      = step.create_secondary_seal_key.attributes
-      seal_ha_beta         = matrix.seal_ha_beta
-      seal_type            = matrix.secondary_seal
-      storage_backend      = matrix.secondary_backend
-      target_hosts         = step.create_secondary_cluster_targets.hosts
-    }
-  }
-
-  step "verify_that_vault_primary_cluster_is_unsealed" {
-    module = module.vault_verify_unsealed
-    depends_on = [
-      step.create_primary_cluster
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      vault_instances   = step.create_primary_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
-    }
-  }
-
-  step "verify_that_vault_secondary_cluster_is_unsealed" {
-    module = module.vault_verify_unsealed
-    depends_on = [
-      step.create_secondary_cluster
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      vault_instances   = step.create_secondary_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
-    }
-  }
-
-  step "verify_vault_version" {
-    module = module.vault_verify_version
-    depends_on = [
-      step.create_primary_cluster
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      vault_instances       = step.create_primary_cluster_targets.hosts
-      vault_edition         = matrix.edition
-      vault_install_dir     = local.vault_install_dir
-      vault_product_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
-      vault_revision        = matrix.artifact_source == "local" ? step.get_local_metadata.revision : var.vault_revision
-      vault_build_date      = matrix.artifact_source == "local" ? step.get_local_metadata.build_date : var.vault_build_date
-      vault_root_token      = step.create_primary_cluster.root_token
-    }
-  }
-
-  step "verify_ui" {
-    module = module.vault_verify_ui
-    depends_on = [
-      step.create_primary_cluster
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      vault_instances = step.create_primary_cluster_targets.hosts
-    }
-  }
-
-  step "get_primary_cluster_ips" {
-    module = module.vault_get_cluster_ips
-    depends_on = [
-      step.verify_vault_version,
-      step.verify_ui,
-      step.verify_that_vault_primary_cluster_is_unsealed,
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      vault_hosts       = step.create_primary_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
-      vault_root_token  = step.create_primary_cluster.root_token
-    }
-  }
-
-  step "get_primary_cluster_replication_data" {
-    module     = module.replication_data
-    depends_on = [step.get_primary_cluster_ips]
-
-    variables {
-      follower_hosts = step.get_primary_cluster_ips.follower_hosts
-    }
-  }
-
-  step "get_secondary_cluster_ips" {
-    module     = module.vault_get_cluster_ips
-    depends_on = [step.verify_that_vault_secondary_cluster_is_unsealed]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      vault_hosts       = step.create_secondary_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
-      vault_root_token  = step.create_secondary_cluster.root_token
-    }
-  }
-
-  step "write_test_data_on_primary" {
-    module     = module.vault_verify_write_data
-    depends_on = [step.get_primary_cluster_ips]
-
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      leader_public_ip  = step.get_primary_cluster_ips.leader_public_ip
-      leader_private_ip = step.get_primary_cluster_ips.leader_private_ip
-      vault_instances   = step.create_primary_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
-      vault_root_token  = step.create_primary_cluster.root_token
-    }
-  }
-
-  step "configure_performance_replication_primary" {
-    module = module.vault_setup_perf_primary
-    depends_on = [
-      step.get_primary_cluster_ips,
-      step.get_secondary_cluster_ips,
-      step.write_test_data_on_primary
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      primary_leader_public_ip  = step.get_primary_cluster_ips.leader_public_ip
-      primary_leader_private_ip = step.get_primary_cluster_ips.leader_private_ip
-      vault_install_dir         = local.vault_install_dir
-      vault_root_token          = step.create_primary_cluster.root_token
-    }
-  }
-
-  step "generate_secondary_token" {
-    module     = module.generate_secondary_token
-    depends_on = [step.configure_performance_replication_primary]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      primary_leader_public_ip = step.get_primary_cluster_ips.leader_public_ip
-      vault_install_dir        = local.vault_install_dir
-      vault_root_token         = step.create_primary_cluster.root_token
-    }
-  }
-
-  step "configure_performance_replication_secondary" {
-    module     = module.vault_setup_perf_secondary
-    depends_on = [step.generate_secondary_token]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      secondary_leader_public_ip  = step.get_secondary_cluster_ips.leader_public_ip
-      secondary_leader_private_ip = step.get_secondary_cluster_ips.leader_private_ip
-      vault_install_dir           = local.vault_install_dir
-      vault_root_token            = step.create_secondary_cluster.root_token
-      wrapping_token              = step.generate_secondary_token.secondary_token
-    }
-  }
-
-  // After replication is enabled, the secondary cluster followers need to be unsealed
-  // Secondary unseal keys are passed using the guide https://developer.hashicorp.com/vault/docs/enterprise/replication#seals
-  step "unseal_secondary_followers" {
-    module = module.vault_unseal_nodes
-    depends_on = [
-      step.create_primary_cluster,
-      step.create_secondary_cluster,
-      step.get_secondary_cluster_ips,
-      step.configure_performance_replication_secondary
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      follower_public_ips = step.get_secondary_cluster_ips.follower_public_ips
-      vault_install_dir   = local.vault_install_dir
-      vault_unseal_keys   = matrix.primary_seal == "shamir" ? step.create_primary_cluster.unseal_keys_hex : step.create_primary_cluster.recovery_keys_hex
-      vault_seal_type     = matrix.primary_seal == "shamir" ? matrix.primary_seal : matrix.secondary_seal
-    }
-  }
-
-  step "verify_secondary_cluster_is_unsealed_after_enabling_replication" {
-    module = module.vault_verify_unsealed
-    depends_on = [
-      step.unseal_secondary_followers
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      vault_instances   = step.create_secondary_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
-    }
-  }
-
-  step "verify_performance_replication" {
-    module     = module.vault_verify_performance_replication
-    depends_on = [step.verify_secondary_cluster_is_unsealed_after_enabling_replication]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      primary_leader_public_ip    = step.get_primary_cluster_ips.leader_public_ip
-      primary_leader_private_ip   = step.get_primary_cluster_ips.leader_private_ip
-      secondary_leader_public_ip  = step.get_secondary_cluster_ips.leader_public_ip
-      secondary_leader_private_ip = step.get_secondary_cluster_ips.leader_private_ip
-      vault_install_dir           = local.vault_install_dir
-    }
-  }
-
-  step "verify_replicated_data" {
-    module = module.vault_verify_read_data
-    depends_on = [
-      step.verify_performance_replication,
-      step.get_secondary_cluster_ips,
-      step.write_test_data_on_primary
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      node_public_ips   = step.get_secondary_cluster_ips.follower_public_ips
-      vault_install_dir = local.vault_install_dir
-    }
-  }
-
-  step "add_additional_nodes_to_primary_cluster" {
-    module = module.vault_cluster
-    depends_on = [
-      step.create_vpc,
-      step.create_primary_backend_cluster,
-      step.create_primary_cluster,
-      step.verify_replicated_data,
-      step.create_primary_cluster_additional_targets
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
-      backend_cluster_name    = step.create_primary_cluster_backend_targets.cluster_name
-      backend_cluster_tag_key = global.backend_tag_key
-      cluster_name            = step.create_primary_cluster_targets.cluster_name
-      consul_license          = (matrix.primary_backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
-      consul_release = matrix.primary_backend == "consul" ? {
-        edition = var.backend_edition
-        version = matrix.consul_version
-      } : null
-      enable_audit_devices = var.vault_enable_audit_devices
-      force_unseal         = matrix.primary_seal == "shamir"
-      initialize_cluster   = false
-      install_dir          = local.vault_install_dir
-      license              = matrix.edition != "ce" ? step.read_vault_license.license : null
-      local_artifact_path  = local.artifact_path
-      manage_service       = local.manage_service
-      packages             = concat(global.packages, global.distro_packages[matrix.distro])
-      root_token           = step.create_primary_cluster.root_token
-      seal_ha_beta         = matrix.seal_ha_beta
-      seal_attributes      = step.create_primary_seal_key.attributes
-      seal_type            = matrix.primary_seal
-      shamir_unseal_keys   = matrix.primary_seal == "shamir" ? step.create_primary_cluster.unseal_keys_hex : null
-      storage_backend      = matrix.primary_backend
-      storage_node_prefix  = "newprimary_node"
-      target_hosts         = step.create_primary_cluster_additional_targets.hosts
-    }
-  }
-
-  step "verify_additional_primary_nodes_are_unsealed" {
-    module     = module.vault_verify_unsealed
-    depends_on = [step.add_additional_nodes_to_primary_cluster]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      vault_instances   = step.create_primary_cluster_additional_targets.hosts
-      vault_install_dir = local.vault_install_dir
-    }
-  }
-
-  step "verify_raft_auto_join_voter" {
-    skip_step = matrix.primary_backend != "raft"
-    module    = module.vault_verify_raft_auto_join_voter
-    depends_on = [
-      step.add_additional_nodes_to_primary_cluster,
-      step.create_primary_cluster,
-      step.verify_additional_primary_nodes_are_unsealed
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      vault_instances   = step.create_primary_cluster_additional_targets.hosts
-      vault_install_dir = local.vault_install_dir
-      vault_root_token  = step.create_primary_cluster.root_token
-    }
-  }
-
-  step "remove_primary_follower_1" {
-    module = module.shutdown_node
-    depends_on = [
-      step.get_primary_cluster_replication_data,
-      step.verify_additional_primary_nodes_are_unsealed
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      node_public_ip = step.get_primary_cluster_replication_data.follower_public_ip_1
-    }
-  }
-
-  step "remove_primary_leader" {
-    module = module.shutdown_node
-    depends_on = [
-      step.get_primary_cluster_ips,
-      step.remove_primary_follower_1
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      node_public_ip = step.get_primary_cluster_ips.leader_public_ip
-    }
-  }
-
-  // After we've removed two nodes from the cluster we need to get an updated set of vault hosts
-  // to work with.
-  step "get_remaining_hosts_replication_data" {
-    module = module.replication_data
-    depends_on = [
-      step.get_primary_cluster_ips,
-      step.remove_primary_leader,
-    ]
-
-    variables {
-      added_hosts           = step.create_primary_cluster_additional_targets.hosts
-      added_hosts_count     = var.vault_instance_count
-      initial_hosts         = step.create_primary_cluster_targets.hosts
-      initial_hosts_count   = var.vault_instance_count
-      removed_follower_host = step.get_primary_cluster_replication_data.follower_host_1
-      removed_primary_host  = step.get_primary_cluster_ips.leader_host
-    }
-  }
-
-  // Wait for the remaining hosts in our cluster to elect a new leader.
-  step "wait_for_leader_in_remaining_hosts" {
-    module = module.vault_wait_for_leader
-    depends_on = [
-      step.remove_primary_leader,
-      step.get_remaining_hosts_replication_data,
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      timeout           = 120 # seconds
-      vault_install_dir = local.vault_install_dir
-      vault_root_token  = step.create_primary_cluster.root_token
-      vault_hosts       = step.get_remaining_hosts_replication_data.remaining_hosts
-    }
-  }
-
-  // Get our new leader and follower IP addresses.
-  step "get_updated_primary_cluster_ips" {
-    module = module.vault_get_cluster_ips
-    depends_on = [
-      step.get_remaining_hosts_replication_data,
-      step.wait_for_leader_in_remaining_hosts,
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      vault_hosts          = step.get_remaining_hosts_replication_data.remaining_hosts
-      vault_install_dir    = local.vault_install_dir
-      vault_instance_count = step.get_remaining_hosts_replication_data.remaining_hosts_count
-      vault_root_token     = step.create_primary_cluster.root_token
-    }
-  }
-
-  // Make sure the cluster has the correct performance replication state after the new leader election.
-  step "verify_updated_performance_replication" {
-    module = module.vault_verify_performance_replication
-    depends_on = [
-      step.get_remaining_hosts_replication_data,
-      step.wait_for_leader_in_remaining_hosts,
-      step.get_updated_primary_cluster_ips,
-    ]
-
-    providers = {
-      enos = local.enos_provider[matrix.distro]
-    }
-
-    variables {
-      primary_leader_public_ip    = step.get_updated_primary_cluster_ips.leader_public_ip
-      primary_leader_private_ip   = step.get_updated_primary_cluster_ips.leader_private_ip
-      secondary_leader_public_ip  = step.get_secondary_cluster_ips.leader_public_ip
-      secondary_leader_private_ip = step.get_secondary_cluster_ips.leader_private_ip
-      vault_install_dir           = local.vault_install_dir
-    }
-  }
-
-  output "audit_device_file_path" {
-    description = "The file path for the file audit device, if enabled"
-    value       = step.create_primary_cluster.audit_device_file_path
-  }
-
-  output "primary_cluster_hosts" {
-    description = "The Vault primary cluster target hosts"
-    value       = step.create_primary_cluster_targets.hosts
-  }
-
-  output "primary_cluster_additional_hosts" {
-    description = "The Vault added new node on primary cluster target hosts"
-    value       = step.create_primary_cluster_additional_targets.hosts
-  }
-
-  output "primary_cluster_root_token" {
-    description = "The Vault primary cluster root token"
-    value       = step.create_primary_cluster.root_token
-  }
-
-  output "primary_cluster_unseal_keys_b64" {
-    description = "The Vault primary cluster unseal keys"
-    value       = step.create_primary_cluster.unseal_keys_b64
-  }
-
-  output "primary_cluster_unseal_keys_hex" {
-    description = "The Vault primary cluster unseal keys hex"
-    value       = step.create_primary_cluster.unseal_keys_hex
-  }
-
-  output "primary_cluster_recovery_key_shares" {
-    description = "The Vault primary cluster recovery key shares"
-    value       = step.create_primary_cluster.recovery_key_shares
-  }
-
-  output "primary_cluster_recovery_keys_b64" {
-    description = "The Vault primary cluster recovery keys b64"
-    value       = step.create_primary_cluster.recovery_keys_b64
-  }
-
-  output "primary_cluster_recovery_keys_hex" {
-    description = "The Vault primary cluster recovery keys hex"
-    value       = step.create_primary_cluster.recovery_keys_hex
-  }
-
-  output "secondary_cluster_hosts" {
-    description = "The Vault secondary cluster public IPs"
-    value       = step.create_secondary_cluster_targets.hosts
-  }
-
-  output "secondary_cluster_root_token" {
-    description = "The Vault secondary cluster root token"
-    value       = step.create_secondary_cluster.root_token
-  }
-
-  output "performance_secondary_token" {
-    description = "The performance secondary replication token"
-    value       = step.generate_secondary_token.secondary_token
-  }
-
-  output "remaining_hosts" {
-    description = "The Vault cluster primary hosts after removing the leader and follower"
-    value       = step.get_remaining_hosts_replication_data.remaining_hosts
-  }
-
-  output "initial_primary_replication_status" {
-    description = "The Vault primary cluster performance replication status"
-    value       = step.verify_performance_replication.primary_replication_status
-  }
-
-  output "initial_known_primary_cluster_addresses" {
-    description = "The Vault secondary cluster performance replication status"
-    value       = step.verify_performance_replication.known_primary_cluster_addrs
-  }
-
-  output "initial_secondary_performance_replication_status" {
-    description = "The Vault secondary cluster performance replication status"
-    value       = step.verify_performance_replication.secondary_replication_status
-  }
-
-  output "intial_primary_replication_data_secondaries" {
-    description = "The Vault primary cluster secondaries connection status"
-    value       = step.verify_performance_replication.primary_replication_data_secondaries
-  }
-
-  output "initial_secondary_replication_data_primaries" {
-    description = "The Vault  secondary cluster primaries connection status"
-    value       = step.verify_performance_replication.secondary_replication_data_primaries
-  }
-
-  output "updated_primary_replication_status" {
-    description = "The Vault updated primary cluster performance replication status"
-    value       = step.verify_updated_performance_replication.primary_replication_status
-  }
-
-  output "updated_known_primary_cluster_addresses" {
-    description = "The Vault secondary cluster performance replication status"
-    value       = step.verify_updated_performance_replication.known_primary_cluster_addrs
-  }
-
-  output "updated_secondary_replication_status" {
-    description = "The Vault updated secondary cluster performance replication status"
-    value       = step.verify_updated_performance_replication.secondary_replication_status
-  }
-
-  output "updated_primary_replication_data_secondaries" {
-    description = "The Vault updated primary cluster secondaries connection status"
-    value       = step.verify_updated_performance_replication.primary_replication_data_secondaries
-  }
-
-  output "updated_secondary_replication_data_primaries" {
-    description = "The Vault updated secondary cluster primaries connection status"
-    value       = step.verify_updated_performance_replication.secondary_replication_data_primaries
-  }
-}
diff --git a/enos/enos-scenario-seal-ha.hcl b/enos/enos-scenario-seal-ha.hcl
index 0006f37a2b8..6962165fb55 100644
--- a/enos/enos-scenario-seal-ha.hcl
+++ b/enos/enos-scenario-seal-ha.hcl
@@ -1,40 +1,93 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 scenario "seal_ha" {
+  description = <<-EOF
+    The seal_ha scenario verifies Vault Enterprises seal HA capabilities. The build can be a local
+    branch, any CRT built Vault Enterprise artifact saved to the local machine, or any CRT built
+    Vault Enterprise artifact in the stable channel in Artifactory.
+
+    The scenario deploys a Vault Enterprise cluster with the candidate build and enables a single
+    primary seal, mounts various engines and writes data, then establishes seal HA with a secondary
+    seal, then removes the primary and verifies data integrity and seal data migration. It also
+    verifies that the cluster is able to recover from a forced leader election after the initial
+    seal rewrap. The scenario also performs standard baseline verification that is not specific to
+    seal_ha.
+
+    # How to run this scenario
+
+    For general instructions on running a scenario, refer to the Enos docs: https://eng-handbook.hashicorp.services/internal-tools/enos/running-a-scenario/
+    For troubleshooting tips and common errors, see https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/.
+
+    Variables required for all scenario variants:
+      - aws_ssh_private_key_path (more info about AWS SSH keypairs: https://eng-handbook.hashicorp.services/internal-tools/enos/getting-started/#set-your-aws-key-pair-name-and-private-key)
+      - aws_ssh_keypair_name
+      - vault_build_date*
+      - vault_product_version
+      - vault_revision*
+
+    * If you don't already know what build date and revision you should be using, see
+    https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
+
+    Variables required for some scenario variants:
+      - artifactory_token (if using `artifact_source:artifactory` in your filter)
+      - aws_region (if different from the default value in enos-variables.hcl)
+      - consul_license_path (if using an ENT edition of Consul)
+      - distro_version_<distro> (if different from the default version for your target
+      distro. See supported distros and default versions in the distro_version_<distro>
+      definitions in enos-variables.hcl)
+      - vault_artifact_path (the path to where you have a Vault artifact already downloaded,
+      if using `artifact_source:crt` in your filter)
+      - vault_license_path (if using an ENT edition of Vault)
+  EOF
+
   matrix {
     arch            = global.archs
     artifact_source = global.artifact_sources
     artifact_type   = global.artifact_types
     backend         = global.backends
+    config_mode     = global.config_modes
+    consul_edition  = global.consul_editions
     consul_version  = global.consul_versions
     distro          = global.distros
-    edition         = global.editions
+    edition         = global.enterprise_editions
+    ip_version      = global.ip_versions
     // Seal HA is only supported with auto-unseal devices.
     primary_seal   = ["awskms", "pkcs11"]
     secondary_seal = ["awskms", "pkcs11"]
 
-    # Our local builder always creates bundles
+    // Our local builder always creates bundles
     exclude {
       artifact_source = ["local"]
       artifact_type   = ["package"]
     }
 
-    # HSM and FIPS 140-2 are only supported on amd64
+    // PKCS#11 can only be used on ent.hsm and ent.hsm.fips1403.
+    exclude {
+      primary_seal = ["pkcs11"]
+      edition      = [for e in matrix.edition : e if !strcontains(e, "hsm")]
+    }
+
     exclude {
-      arch    = ["arm64"]
-      edition = ["ent.fips1402", "ent.hsm", "ent.hsm.fips1402"]
+      secondary_seal = ["pkcs11"]
+      edition        = [for e in matrix.edition : e if !strcontains(e, "hsm")]
     }
 
-    # PKCS#11 can only be used on ent.hsm and ent.hsm.fips1402.
+    // softhsm packages not available for leap/sles.
     exclude {
       primary_seal = ["pkcs11"]
-      edition      = ["ce", "ent", "ent.fips1402"]
+      distro       = ["leap", "sles"]
     }
 
     exclude {
       secondary_seal = ["pkcs11"]
-      edition        = ["ce", "ent", "ent.fips1402"]
+      distro         = ["leap", "sles"]
+    }
+
+    // Testing in IPV6 mode is currently implemented for integrated Raft storage only
+    exclude {
+      ip_version = ["6"]
+      backend    = ["consul"]
     }
   }
 
@@ -42,61 +95,90 @@ scenario "seal_ha" {
   terraform     = terraform.default
   providers = [
     provider.aws.default,
-    provider.enos.ubuntu,
-    provider.enos.rhel
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
   ]
 
   locals {
     artifact_path = matrix.artifact_source != "artifactory" ? abspath(var.vault_artifact_path) : null
     enos_provider = {
-      rhel   = provider.enos.rhel
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
       ubuntu = provider.enos.ubuntu
     }
-    manage_service    = matrix.artifact_type == "bundle"
-    vault_install_dir = matrix.artifact_type == "bundle" ? var.vault_install_dir : global.vault_install_dir_packages[matrix.distro]
+    manage_service = matrix.artifact_type == "bundle"
   }
 
   step "get_local_metadata" {
-    skip_step = matrix.artifact_source != "local"
-    module    = module.get_local_metadata
+    description = global.description.get_local_metadata
+    skip_step   = matrix.artifact_source != "local"
+    module      = module.get_local_metadata
   }
 
   step "build_vault" {
-    module = "build_${matrix.artifact_source}"
+    description = global.description.build_vault
+    module      = "build_${matrix.artifact_source}"
 
     variables {
-      build_tags           = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
-      artifact_path        = local.artifact_path
-      goarch               = matrix.arch
-      goos                 = "linux"
-      artifactory_host     = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
-      artifactory_repo     = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
-      artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
-      artifactory_token    = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
-      arch                 = matrix.artifact_source == "artifactory" ? matrix.arch : null
-      product_version      = var.vault_product_version
-      artifact_type        = matrix.artifact_type
-      distro               = matrix.artifact_source == "artifactory" ? matrix.distro : null
-      edition              = matrix.artifact_source == "artifactory" ? matrix.edition : null
-      revision             = var.vault_revision
+      build_tags        = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      artifact_path     = local.artifact_path
+      goarch            = matrix.arch
+      goos              = "linux"
+      artifactory_host  = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
+      artifactory_repo  = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
+      artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
+      arch              = matrix.artifact_source == "artifactory" ? matrix.arch : null
+      product_version   = var.vault_product_version
+      artifact_type     = matrix.artifact_type
+      distro            = matrix.artifact_source == "artifactory" ? matrix.distro : null
+      edition           = matrix.artifact_source == "artifactory" ? matrix.edition : null
+      revision          = var.vault_revision
     }
   }
 
   step "ec2_info" {
-    module = module.ec2_info
+    description = global.description.ec2_info
+    module      = module.ec2_info
   }
 
   step "create_vpc" {
-    module = module.create_vpc
+    description = global.description.create_vpc
+    module      = module.create_vpc
 
     variables {
       common_tags = global.tags
+      ip_version  = matrix.ip_version
+    }
+  }
+
+  // This step reads the contents of the backend license if we're using a Consul backend and
+  // the edition is "ent".
+  step "read_backend_license" {
+    description = global.description.read_backend_license
+    skip_step   = matrix.backend == "raft" || matrix.consul_edition == "ce"
+    module      = module.read_license
+
+    variables {
+      file_name = global.backend_license_path
+    }
+  }
+
+  step "read_vault_license" {
+    description = global.description.read_vault_license
+    skip_step   = matrix.edition == "ce"
+    module      = module.read_license
+
+    variables {
+      file_name = global.vault_license_path
     }
   }
 
   step "create_primary_seal_key" {
-    module     = "seal_${matrix.primary_seal}"
-    depends_on = [step.create_vpc]
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.primary_seal}"
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
@@ -110,8 +192,9 @@ scenario "seal_ha" {
   }
 
   step "create_secondary_seal_key" {
-    module     = "seal_${matrix.secondary_seal}"
-    depends_on = [step.create_vpc]
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.secondary_seal}"
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
@@ -125,29 +208,27 @@ scenario "seal_ha" {
     }
   }
 
-  // This step reads the contents of the backend license if we're using a Consul backend and
-  // the edition is "ent".
-  step "read_backend_license" {
-    skip_step = matrix.backend == "raft" || var.backend_edition == "ce"
-    module    = module.read_license
+  step "create_external_integration_target" {
+    description = global.description.create_external_integration_target
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
 
-    variables {
-      file_name = global.backend_license_path
+    providers = {
+      enos = local.enos_provider["ubuntu"]
     }
-  }
-
-  step "read_vault_license" {
-    skip_step = matrix.edition == "ce"
-    module    = module.read_license
 
     variables {
-      file_name = global.vault_license_path
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["24.04"]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      vpc_id          = step.create_vpc.id
     }
   }
 
   step "create_vault_cluster_targets" {
-    module     = module.target_ec2_instances
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
@@ -163,15 +244,16 @@ scenario "seal_ha" {
   }
 
   step "create_vault_cluster_backend_targets" {
-    module     = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
     variables {
-      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["22.04"]
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
       cluster_tag_key = global.backend_tag_key
       common_tags     = global.tags
       seal_key_names  = step.create_secondary_seal_key.resource_names
@@ -179,30 +261,69 @@ scenario "seal_ha" {
     }
   }
 
+  step "set_up_external_integration_target" {
+    description = global.description.set_up_external_integration_target
+    module      = module.set_up_external_integration_target
+    depends_on = [
+      step.create_external_integration_target
+    ]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      hosts      = step.create_external_integration_target.hosts
+      ip_version = matrix.ip_version
+      packages   = concat(global.packages, global.distro_packages["ubuntu"]["24.04"], ["podman", "podman-docker"])
+      ports      = global.integration_host_ports
+    }
+  }
+
   step "create_backend_cluster" {
-    module = "backend_${matrix.backend}"
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.backend}"
     depends_on = [
-      step.create_vault_cluster_backend_targets
+      step.create_vault_cluster_backend_targets,
+      step.set_up_external_integration_target
     ]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_server,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_cli_validate,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_notified,
+      quality.consul_service_systemd_unit,
+    ]
+
     variables {
       cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       cluster_tag_key = global.backend_tag_key
-      license         = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      hosts           = step.create_vault_cluster_backend_targets.hosts
+      license         = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       release = {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = matrix.consul_version
       }
-      target_hosts = step.create_vault_cluster_backend_targets.hosts
     }
   }
 
   step "create_vault_cluster" {
-    module = module.vault_cluster
+    description = global.description.create_vault_cluster
+    module      = module.vault_cluster
     depends_on = [
       step.create_backend_cluster,
       step.build_vault,
@@ -213,122 +334,219 @@ scenario "seal_ha" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      // verified in modules
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_socket,
+      quality.vault_audit_syslog,
+      quality.vault_autojoin_aws,
+      quality.vault_config_env_variables,
+      quality.vault_config_file,
+      quality.vault_config_log_level,
+      quality.vault_init,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_storage_backend_consul,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_cli_status_exit_code,
+      quality.vault_service_systemd_notified,
+      quality.vault_service_systemd_unit,
+    ]
+
     variables {
       artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
       backend_cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       backend_cluster_tag_key = global.backend_tag_key
       cluster_name            = step.create_vault_cluster_targets.cluster_name
-      consul_license          = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       consul_release = matrix.backend == "consul" ? {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = matrix.consul_version
       } : null
       enable_audit_devices = var.vault_enable_audit_devices
-      install_dir          = local.vault_install_dir
+      hosts                = step.create_vault_cluster_targets.hosts
+      install_dir          = global.vault_install_dir[matrix.artifact_type]
+      ip_version           = matrix.ip_version
       license              = matrix.edition != "ce" ? step.read_vault_license.license : null
       local_artifact_path  = local.artifact_path
       manage_service       = local.manage_service
-      packages             = concat(global.packages, global.distro_packages[matrix.distro])
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
       // Only configure our primary seal during our initial cluster setup
       seal_attributes = step.create_primary_seal_key.attributes
       seal_type       = matrix.primary_seal
       storage_backend = matrix.backend
-      target_hosts    = step.create_vault_cluster_targets.hosts
     }
   }
 
   // Wait for our cluster to elect a leader
   step "wait_for_leader" {
-    module     = module.vault_wait_for_leader
-    depends_on = [step.create_vault_cluster]
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_vault_cluster]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
     variables {
-      timeout           = 120 # seconds
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "get_vault_cluster_ips" {
-    module     = module.vault_get_cluster_ips
-    depends_on = [step.wait_for_leader]
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_leader]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "verify_vault_unsealed" {
-    module     = module.vault_verify_unsealed
-    depends_on = [step.wait_for_leader]
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on  = [step.wait_for_leader]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
     }
   }
 
   // Write some test data before we create the new seal
-  step "verify_write_test_data" {
-    module = module.vault_verify_write_data
+  step "verify_secrets_engines_create" {
+    description = global.description.verify_secrets_engines_create
+    module      = module.vault_verify_secrets_engines_create
     depends_on = [
       step.create_vault_cluster,
       step.get_vault_cluster_ips,
-      step.verify_vault_unsealed,
+      step.verify_vault_unsealed
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_auth_userpass_user_write,
+      quality.vault_api_identity_entity_write,
+      quality.vault_api_identity_entity_alias_write,
+      quality.vault_api_identity_group_write,
+      quality.vault_api_identity_oidc_config_write,
+      quality.vault_api_identity_oidc_introspect_write,
+      quality.vault_api_identity_oidc_key_write,
+      quality.vault_api_identity_oidc_key_rotate_write,
+      quality.vault_api_identity_oidc_role_write,
+      quality.vault_api_identity_oidc_token_read,
+      quality.vault_api_sys_auth_userpass_user_write,
+      quality.vault_api_sys_policy_write,
+      quality.vault_mount_auth,
+      quality.vault_mount_kv,
+      quality.vault_secrets_kmip_write_config,
+      quality.vault_secrets_kv_write,
+      quality.vault_secrets_ldap_write_config,
+    ]
+
     variables {
-      leader_public_ip  = step.get_vault_cluster_ips.leader_public_ip
-      leader_private_ip = step.get_vault_cluster_ips.leader_private_ip
-      vault_instances   = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
-      vault_root_token  = step.create_vault_cluster.root_token
+      hosts                  = step.create_vault_cluster_targets.hosts
+      ip_version             = matrix.ip_version
+      integration_host_state = step.set_up_external_integration_target.state
+      leader_host            = step.get_vault_cluster_ips.leader_host
+      ports                  = global.ports
+      ipv4_cidr              = step.create_vpc.ipv4_cidr
+      vault_addr             = step.create_vault_cluster.api_addr_localhost
+      vault_edition          = matrix.edition
+      vault_install_dir      = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token       = step.create_vault_cluster.root_token
     }
   }
 
   // Wait for the initial seal rewrap to complete before we add our HA seal.
   step "wait_for_initial_seal_rewrap" {
-    module = module.vault_wait_for_seal_rewrap
+    description = global.description.wait_for_seal_rewrap
+    module      = module.vault_wait_for_seal_rewrap
     depends_on = [
-      step.verify_write_test_data,
+      step.verify_secrets_engines_create,
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_sealwrap_rewrap_read_entries_processed_eq_entries_succeeded_post_rewrap,
+      quality.vault_api_sys_sealwrap_rewrap_read_entries_processed_gt_zero_post_rewrap,
+      quality.vault_api_sys_sealwrap_rewrap_read_is_running_false_post_rewrap,
+      quality.vault_api_sys_sealwrap_rewrap_read_no_entries_fail_during_rewrap,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  // Stop the vault service on all nodes before we restart with new seal config
   step "stop_vault" {
-    module = module.stop_vault
+    description = "${global.description.stop_vault}. We do this to write new seal configuration."
+    module      = module.stop_vault
     depends_on = [
       step.create_vault_cluster,
-      step.verify_write_test_data,
+      step.verify_secrets_engines_create,
       step.wait_for_initial_seal_rewrap,
     ]
 
@@ -337,22 +555,27 @@ scenario "seal_ha" {
     }
 
     variables {
-      target_hosts = step.create_vault_cluster_targets.hosts
+      hosts = step.create_vault_cluster_targets.hosts
     }
   }
 
   // Add the secondary seal to the cluster
   step "add_ha_seal_to_cluster" {
-    module     = module.start_vault
-    depends_on = [step.stop_vault]
+    description = global.description.enable_multiseal
+    module      = module.start_vault
+    depends_on  = [step.stop_vault]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_multiseal_enable
+
     variables {
       cluster_name              = step.create_vault_cluster_targets.cluster_name
-      install_dir               = local.vault_install_dir
+      hosts                     = step.create_vault_cluster_targets.hosts
+      install_dir               = global.vault_install_dir[matrix.artifact_type]
+      ip_version                = matrix.ip_version
       license                   = matrix.edition != "ce" ? step.read_vault_license.license : null
       manage_service            = local.manage_service
       seal_attributes           = step.create_primary_seal_key.attributes
@@ -360,59 +583,156 @@ scenario "seal_ha" {
       seal_type                 = matrix.primary_seal
       seal_type_secondary       = matrix.secondary_seal
       storage_backend           = matrix.backend
-      target_hosts              = step.create_vault_cluster_targets.hosts
+    }
+  }
+
+  // Wait for our cluster to elect a leader
+  step "wait_for_leader_election" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.add_ha_seal_to_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "get_leader_ip_for_step_down" {
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_leader_election]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  // Force a step down to trigger a new leader election
+  step "vault_leader_step_down" {
+    description = global.description.vault_leader_step_down
+    module      = module.vault_step_down
+    depends_on  = [step.get_leader_ip_for_step_down]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_step_down_steps_down,
+      quality.vault_cli_operator_step_down,
+    ]
+
+    variables {
+      leader_host       = step.get_leader_ip_for_step_down.leader_host
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   // Wait for our cluster to elect a leader
   step "wait_for_new_leader" {
-    module     = module.vault_wait_for_leader
-    depends_on = [step.add_ha_seal_to_cluster]
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.vault_leader_step_down]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
     variables {
-      timeout           = 120 # seconds
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      timeout           = 120 // seconds
+      ip_version        = matrix.ip_version
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "get_updated_cluster_ips" {
-    module     = module.vault_get_cluster_ips
-    depends_on = [step.wait_for_new_leader]
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_new_leader]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "verify_vault_unsealed_with_new_seal" {
-    module     = module.vault_verify_unsealed
-    depends_on = [step.wait_for_new_leader]
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on  = [step.wait_for_new_leader]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
     }
   }
 
   // Wait for the seal rewrap to complete and verify that no entries failed
   step "wait_for_seal_rewrap" {
-    module = module.vault_wait_for_seal_rewrap
+    description = global.description.wait_for_seal_rewrap
+    module      = module.vault_wait_for_seal_rewrap
     depends_on = [
       step.add_ha_seal_to_cluster,
       step.verify_vault_unsealed_with_new_seal,
@@ -422,26 +742,44 @@ scenario "seal_ha" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_sealwrap_rewrap_read_entries_processed_eq_entries_succeeded_post_rewrap,
+      quality.vault_api_sys_sealwrap_rewrap_read_entries_processed_gt_zero_post_rewrap,
+      quality.vault_api_sys_sealwrap_rewrap_read_is_running_false_post_rewrap,
+      quality.vault_api_sys_sealwrap_rewrap_read_no_entries_fail_during_rewrap,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   // Perform all of our standard verifications after we've enabled multiseal
   step "verify_vault_version" {
-    module     = module.vault_verify_version
-    depends_on = [step.wait_for_seal_rewrap]
+    description = global.description.verify_vault_version
+    module      = module.vault_verify_version
+    depends_on  = [step.wait_for_seal_rewrap]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_version_history_keys,
+      quality.vault_api_sys_version_history_key_info,
+      quality.vault_version_build_date,
+      quality.vault_version_edition,
+      quality.vault_version_release,
+    ]
+
     variables {
-      vault_instances       = step.create_vault_cluster_targets.hosts
+      hosts                 = step.create_vault_cluster_targets.hosts
+      vault_addr            = step.create_vault_cluster.api_addr_localhost
       vault_edition         = matrix.edition
-      vault_install_dir     = local.vault_install_dir
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
       vault_product_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
       vault_revision        = matrix.artifact_source == "local" ? step.get_local_metadata.revision : var.vault_revision
       vault_build_date      = matrix.artifact_source == "local" ? step.get_local_metadata.build_date : var.vault_build_date
@@ -450,66 +788,125 @@ scenario "seal_ha" {
   }
 
   step "verify_raft_auto_join_voter" {
-    skip_step  = matrix.backend != "raft"
-    module     = module.vault_verify_raft_auto_join_voter
-    depends_on = [step.wait_for_seal_rewrap]
+    description = global.description.verify_raft_cluster_all_nodes_are_voters
+    skip_step   = matrix.backend != "raft"
+    module      = module.vault_verify_raft_auto_join_voter
+    depends_on  = [step.wait_for_seal_rewrap]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_raft_voters
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "verify_replication" {
-    module     = module.vault_verify_replication
-    depends_on = [step.wait_for_seal_rewrap]
+    description = global.description.verify_replication_status
+    module      = module.vault_verify_replication
+    depends_on  = [step.wait_for_seal_rewrap]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_replication_ce_disabled,
+      quality.vault_replication_ent_dr_available,
+      quality.vault_replication_ent_pr_available,
+    ]
+
     variables {
-      vault_edition     = matrix.edition
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      hosts         = step.create_vault_cluster_targets.hosts
+      vault_addr    = step.create_vault_cluster.api_addr_localhost
+      vault_edition = matrix.edition
     }
   }
 
   // Make sure our data is still available
-  step "verify_read_test_data" {
-    module     = module.vault_verify_read_data
-    depends_on = [step.wait_for_seal_rewrap]
+  step "verify_secrets_engines_read" {
+    description = global.description.verify_secrets_engines_read
+    module      = module.vault_verify_secrets_engines_read
+    depends_on  = [step.wait_for_seal_rewrap]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_identity_entity_read,
+      quality.vault_api_identity_oidc_config_read,
+      quality.vault_api_identity_oidc_key_read,
+      quality.vault_api_identity_oidc_role_read,
+      quality.vault_secrets_kv_read
+    ]
+
+    variables {
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_updated_cluster_ips.follower_hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_edition     = matrix.edition
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "verify_log_secrets" {
+    skip_step = !var.vault_enable_audit_devices || !var.verify_log_secrets
+
+    description = global.description.verify_log_secrets
+    module      = module.verify_log_secrets
+    depends_on = [
+      step.verify_secrets_engines_read,
+    ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_audit_log_secrets,
+      quality.vault_journal_secrets,
+      quality.vault_radar_index_create,
+      quality.vault_radar_scan_file,
+    ]
+
     variables {
-      node_public_ips   = step.get_updated_cluster_ips.follower_public_ips
-      vault_install_dir = local.vault_install_dir
+      audit_log_file_path = step.create_vault_cluster.audit_device_file_path
+      leader_host         = step.get_updated_cluster_ips.leader_host
+      vault_addr          = step.create_vault_cluster.api_addr_localhost
+      vault_root_token    = step.create_vault_cluster.root_token
     }
   }
 
   step "verify_ui" {
-    module     = module.vault_verify_ui
-    depends_on = [step.wait_for_seal_rewrap]
+    description = global.description.verify_ui
+    module      = module.vault_verify_ui
+    depends_on  = [step.wait_for_seal_rewrap]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_ui_assets
+
     variables {
-      vault_instances = step.create_vault_cluster_targets.hosts
+      hosts      = step.create_vault_cluster_targets.hosts
+      vault_addr = step.create_vault_cluster.api_addr_localhost
     }
   }
 
-  // Make sure we have a "multiseal" seal type
   step "verify_seal_type" {
+    description = "${global.description.verify_seal_type} In this case we expect to have 'multiseal'."
     // Don't run this on versions less than 1.16.0-beta1 until VAULT-21053 is fixed on prior branches.
     skip_step  = semverconstraint(var.vault_product_version, "< 1.16.0-beta1")
     module     = module.verify_seal_type
@@ -519,10 +916,13 @@ scenario "seal_ha" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_status_seal_type
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_hosts       = step.create_vault_cluster_targets.hosts
+      hosts             = step.create_vault_cluster_targets.hosts
       seal_type         = "multiseal"
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
     }
   }
 
@@ -530,10 +930,12 @@ scenario "seal_ha" {
 
   // Stop the vault service on all nodes before we restart with new seal config
   step "stop_vault_for_migration" {
-    module = module.stop_vault
+    description = "${global.description.stop_vault}. We do this to remove the old primary seal."
+    module      = module.stop_vault
     depends_on = [
       step.wait_for_seal_rewrap,
-      step.verify_read_test_data,
+      step.verify_secrets_engines_read,
+      step.verify_log_secrets,
     ]
 
     providers = {
@@ -541,69 +943,93 @@ scenario "seal_ha" {
     }
 
     variables {
-      target_hosts = step.create_vault_cluster_targets.hosts
+      hosts = step.create_vault_cluster_targets.hosts
     }
   }
 
   // Remove the "primary" seal from the cluster. Set our "secondary" seal to priority 1. We do this
   // by restarting vault with the correct config.
   step "remove_primary_seal" {
-    module     = module.start_vault
-    depends_on = [step.stop_vault_for_migration]
+    description = <<-EOF
+      Reconfigure the vault cluster seal configuration with only our secondary seal config which
+      will force a seal migration to a single seal.
+    EOF
+    module      = module.start_vault
+    depends_on  = [step.stop_vault_for_migration]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_config_multiseal_is_toggleable
+
     variables {
       cluster_name    = step.create_vault_cluster_targets.cluster_name
-      install_dir     = local.vault_install_dir
+      hosts           = step.create_vault_cluster_targets.hosts
+      install_dir     = global.vault_install_dir[matrix.artifact_type]
+      ip_version      = matrix.ip_version
       license         = matrix.edition != "ce" ? step.read_vault_license.license : null
       manage_service  = local.manage_service
       seal_alias      = "secondary"
       seal_attributes = step.create_secondary_seal_key.attributes
       seal_type       = matrix.secondary_seal
       storage_backend = matrix.backend
-      target_hosts    = step.create_vault_cluster_targets.hosts
     }
   }
 
   // Wait for our cluster to elect a leader after restarting vault with a new primary seal
   step "wait_for_leader_after_migration" {
-    module     = module.vault_wait_for_leader
-    depends_on = [step.remove_primary_seal]
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.remove_primary_seal]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
     variables {
-      timeout           = 120 # seconds
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      timeout           = 120 // seconds
+      ip_version        = matrix.ip_version
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   // Since we've restarted our cluster we might have a new leader and followers. Get the new IPs.
   step "get_cluster_ips_after_migration" {
-    module     = module.vault_get_cluster_ips
-    depends_on = [step.wait_for_leader_after_migration]
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_leader_after_migration]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   // Make sure we unsealed
   step "verify_vault_unsealed_after_migration" {
-    module     = module.vault_verify_unsealed
+    module     = module.vault_wait_for_cluster_unsealed
     depends_on = [step.wait_for_leader_after_migration]
 
     providers = {
@@ -611,8 +1037,9 @@ scenario "seal_ha" {
     }
 
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
     }
   }
 
@@ -629,24 +1056,65 @@ scenario "seal_ha" {
     }
 
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   // Make sure our data is still available after migration
-  step "verify_read_test_data_after_migration" {
-    module     = module.vault_verify_read_data
+  step "verify_secrets_engines_read_after_migration" {
+    module     = module.vault_verify_secrets_engines_read
     depends_on = [step.wait_for_seal_rewrap_after_migration]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_identity_entity_read,
+      quality.vault_api_identity_oidc_config_read,
+      quality.vault_api_identity_oidc_key_read,
+      quality.vault_api_identity_oidc_role_read,
+      quality.vault_secrets_kv_read,
+    ]
+
     variables {
-      node_public_ips   = step.get_cluster_ips_after_migration.follower_public_ips
-      vault_install_dir = local.vault_install_dir
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_cluster_ips_after_migration.follower_hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_edition     = matrix.edition
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "verify_secrets_engines_delete" {
+    description = global.description.verify_secrets_engines_delete
+    module      = module.vault_verify_secrets_engines_delete
+    depends_on = [
+      step.verify_secrets_engines_create,
+      step.verify_secrets_engines_read_after_migration
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_ssh_role_delete
+    ]
+
+    variables {
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_vault_cluster_ips.follower_hosts
+      leader_host       = step.get_vault_cluster_ips.leader_host
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
@@ -662,9 +1130,10 @@ scenario "seal_ha" {
     }
 
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_hosts       = step.create_vault_cluster_targets.hosts
+      hosts             = step.create_vault_cluster_targets.hosts
       seal_type         = matrix.secondary_seal
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
     }
   }
 
@@ -673,6 +1142,16 @@ scenario "seal_ha" {
     value       = step.create_vault_cluster.audit_device_file_path
   }
 
+  output "external_integration_server_ldap" {
+    description = "The LDAP test servers info"
+    value       = step.set_up_external_integration_target.state.ldap
+  }
+
+  output "integration_host_kmip_state" {
+    description = "The KMIP test servers info"
+    value       = step.set_up_external_integration_target.state.kmip
+  }
+
   output "cluster_name" {
     description = "The Vault cluster name"
     value       = step.create_vault_cluster.cluster_name
@@ -680,7 +1159,7 @@ scenario "seal_ha" {
 
   output "hosts" {
     description = "The Vault cluster target hosts"
-    value       = step.create_vault_cluster.target_hosts
+    value       = step.create_vault_cluster.hosts
   }
 
   output "initial_seal_rewrap" {
@@ -733,6 +1212,12 @@ scenario "seal_ha" {
     value       = step.create_secondary_seal_key.attributes
   }
 
+  output "secrets_engines_state" {
+    description = "The state of configured secrets engines"
+    sensitive   = true
+    value       = step.verify_secrets_engines_create.state
+  }
+
   output "unseal_keys_b64" {
     description = "The Vault cluster unseal keys"
     value       = step.create_vault_cluster.unseal_keys_b64
diff --git a/enos/enos-scenario-smoke.hcl b/enos/enos-scenario-smoke.hcl
index 4aec9f7553f..42264025fe3 100644
--- a/enos/enos-scenario-smoke.hcl
+++ b/enos/enos-scenario-smoke.hcl
@@ -1,34 +1,77 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 scenario "smoke" {
+  description = <<-EOF
+    The smoke scenario verifies a Vault cluster in a fresh installation. The build can be a local branch,
+    any CRT built Vault artifact saved to the local machine, or any CRT built Vault artifact in the
+    stable channel in Artifactory.
+
+    The scenario deploys a Vault cluster with the candidate build and performs an extended
+    set of baseline verification.
+
+    # How to run this scenario
+
+    For general instructions on running a scenario, refer to the Enos docs: https://eng-handbook.hashicorp.services/internal-tools/enos/running-a-scenario/
+    For troubleshooting tips and common errors, see https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/.
+
+    Variables required for all scenario variants:
+      - aws_ssh_private_key_path (more info about AWS SSH keypairs: https://eng-handbook.hashicorp.services/internal-tools/enos/getting-started/#set-your-aws-key-pair-name-and-private-key)
+      - aws_ssh_keypair_name
+      - vault_build_date*
+      - vault_product_version
+      - vault_revision*
+
+    * If you don't already know what build date and revision you should be using, see
+    https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
+
+    Variables required for some scenario variants:
+      - artifactory_token (if using `artifact_source:artifactory` in your filter)
+      - aws_region (if different from the default value in enos-variables.hcl)
+      - consul_license_path (if using an ENT edition of Consul)
+      - distro_version_<distro> (if different from the default version for your target
+      distro. See supported distros and default versions in the distro_version_<distro>
+      definitions in enos-variables.hcl)
+      - vault_artifact_path (the path to where you have a Vault artifact already downloaded,
+      if using `artifact_source:crt` in your filter)
+      - vault_license_path (if using an ENT edition of Vault)
+  EOF
+
   matrix {
     arch            = global.archs
     artifact_source = global.artifact_sources
     artifact_type   = global.artifact_types
     backend         = global.backends
+    config_mode     = global.config_modes
+    consul_edition  = global.consul_editions
     consul_version  = global.consul_versions
     distro          = global.distros
     edition         = global.editions
+    ip_version      = global.ip_versions
     seal            = global.seals
-    seal_ha_beta    = ["true", "false"]
 
-    # Our local builder always creates bundles
+    // Our local builder always creates bundles
     exclude {
       artifact_source = ["local"]
       artifact_type   = ["package"]
     }
 
-    # HSM and FIPS 140-2 are only supported on amd64
+    // PKCS#11 can only be used on ent.hsm and ent.hsm.fips1403.
     exclude {
-      arch    = ["arm64"]
-      edition = ["ent.fips1402", "ent.hsm", "ent.hsm.fips1402"]
+      seal    = ["pkcs11"]
+      edition = [for e in matrix.edition : e if !strcontains(e, "hsm")]
     }
 
-    # PKCS#11 can only be used on ent.hsm and ent.hsm.fips1402.
+    // softhsm packages not available for leap/sles.
     exclude {
-      seal    = ["pkcs11"]
-      edition = ["ce", "ent", "ent.fips1402"]
+      seal   = ["pkcs11"]
+      distro = ["leap", "sles"]
+    }
+
+    // Testing in IPV6 mode is currently implemented for integrated Raft storage only
+    exclude {
+      ip_version = ["6"]
+      backend    = ["consul"]
     }
   }
 
@@ -36,63 +79,62 @@ scenario "smoke" {
   terraform     = terraform.default
   providers = [
     provider.aws.default,
-    provider.enos.ubuntu,
-    provider.enos.rhel
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
   ]
 
   locals {
     artifact_path = matrix.artifact_source != "artifactory" ? abspath(var.vault_artifact_path) : null
     enos_provider = {
-      rhel   = provider.enos.rhel
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
       ubuntu = provider.enos.ubuntu
     }
-    manage_service    = matrix.artifact_type == "bundle"
-    vault_install_dir = matrix.artifact_type == "bundle" ? var.vault_install_dir : global.vault_install_dir_packages[matrix.distro]
-  }
-
-  step "get_local_metadata" {
-    skip_step = matrix.artifact_source != "local"
-    module    = module.get_local_metadata
+    manage_service = matrix.artifact_type == "bundle"
   }
 
   step "build_vault" {
-    module = "build_${matrix.artifact_source}"
+    description = global.description.build_vault
+    module      = "build_${matrix.artifact_source}"
 
     variables {
-      build_tags           = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
-      artifact_path        = local.artifact_path
-      goarch               = matrix.arch
-      goos                 = "linux"
-      artifactory_host     = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
-      artifactory_repo     = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
-      artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
-      artifactory_token    = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
-      arch                 = matrix.artifact_source == "artifactory" ? matrix.arch : null
-      product_version      = var.vault_product_version
-      artifact_type        = matrix.artifact_type
-      distro               = matrix.artifact_source == "artifactory" ? matrix.distro : null
-      edition              = matrix.artifact_source == "artifactory" ? matrix.edition : null
-      revision             = var.vault_revision
+      build_tags        = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      artifact_path     = local.artifact_path
+      goarch            = matrix.arch
+      goos              = "linux"
+      artifactory_host  = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
+      artifactory_repo  = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
+      artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
+      arch              = matrix.artifact_source == "artifactory" ? matrix.arch : null
+      product_version   = var.vault_product_version
+      artifact_type     = matrix.artifact_type
+      distro            = matrix.artifact_source == "artifactory" ? matrix.distro : null
+      edition           = matrix.artifact_source == "artifactory" ? matrix.edition : null
+      revision          = var.vault_revision
     }
   }
 
   step "ec2_info" {
-    module = module.ec2_info
+    description = global.description.ec2_info
+    module      = module.ec2_info
   }
 
   step "create_vpc" {
-    module = module.create_vpc
+    description = global.description.create_vpc
+    module      = module.create_vpc
 
     variables {
       common_tags = global.tags
+      ip_version  = matrix.ip_version
     }
   }
 
-  // This step reads the contents of the backend license if we're using a Consul backend and
-  // the edition is "ent".
   step "read_backend_license" {
-    skip_step = matrix.backend == "raft" || var.backend_edition == "ce"
-    module    = module.read_license
+    description = global.description.read_backend_license
+    module      = module.read_license
+    skip_step   = matrix.backend == "raft" || matrix.consul_edition == "ce"
 
     variables {
       file_name = global.backend_license_path
@@ -100,8 +142,9 @@ scenario "smoke" {
   }
 
   step "read_vault_license" {
-    skip_step = matrix.edition == "ce"
-    module    = module.read_license
+    description = global.description.read_vault_license
+    skip_step   = matrix.edition == "ce"
+    module      = module.read_license
 
     variables {
       file_name = global.vault_license_path
@@ -109,8 +152,9 @@ scenario "smoke" {
   }
 
   step "create_seal_key" {
-    module     = "seal_${matrix.seal}"
-    depends_on = [step.create_vpc]
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.seal}"
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
@@ -122,9 +166,27 @@ scenario "smoke" {
     }
   }
 
+  step "create_external_integration_target" {
+    description = global.description.create_external_integration_target
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["24.04"]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
   step "create_vault_cluster_targets" {
-    module     = module.target_ec2_instances
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
@@ -140,15 +202,16 @@ scenario "smoke" {
   }
 
   step "create_vault_cluster_backend_targets" {
-    module     = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
     variables {
-      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["22.04"]
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
       cluster_tag_key = global.backend_tag_key
       common_tags     = global.tags
       seal_key_names  = step.create_seal_key.resource_names
@@ -156,8 +219,28 @@ scenario "smoke" {
     }
   }
 
+  step "set_up_external_integration_target" {
+    description = global.description.set_up_external_integration_target
+    module      = module.set_up_external_integration_target
+    depends_on = [
+      step.create_external_integration_target
+    ]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      hosts      = step.create_external_integration_target.hosts
+      ip_version = matrix.ip_version
+      packages   = concat(global.packages, global.distro_packages["ubuntu"]["24.04"], ["podman", "podman-docker"])
+      ports      = global.integration_host_ports
+    }
+  }
+
   step "create_backend_cluster" {
-    module = "backend_${matrix.backend}"
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.backend}"
     depends_on = [
       step.create_vault_cluster_backend_targets
     ]
@@ -166,98 +249,280 @@ scenario "smoke" {
       enos = provider.enos.ubuntu
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_server,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_cli_validate,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_notified,
+      quality.consul_service_systemd_unit,
+    ]
+
     variables {
       cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       cluster_tag_key = global.backend_tag_key
-      license         = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      hosts           = step.create_vault_cluster_backend_targets.hosts
+      license         = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       release = {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = matrix.consul_version
       }
-      target_hosts = step.create_vault_cluster_backend_targets.hosts
     }
   }
 
   step "create_vault_cluster" {
-    module = module.vault_cluster
+    description = global.description.create_vault_cluster
+    module      = module.vault_cluster
     depends_on = [
       step.create_backend_cluster,
       step.build_vault,
       step.create_vault_cluster_targets,
+      step.set_up_external_integration_target
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_service_start_client,
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_socket,
+      quality.vault_audit_syslog,
+      quality.vault_autojoin_aws,
+      quality.vault_config_env_variables,
+      quality.vault_config_file,
+      quality.vault_config_log_level,
+      quality.vault_init,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_storage_backend_consul,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_cli_status_exit_code,
+      quality.vault_service_systemd_notified,
+      quality.vault_service_systemd_unit,
+    ]
+
     variables {
       artifactory_release     = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
       backend_cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       backend_cluster_tag_key = global.backend_tag_key
       cluster_name            = step.create_vault_cluster_targets.cluster_name
-      consul_license          = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       consul_release = matrix.backend == "consul" ? {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = matrix.consul_version
       } : null
       enable_audit_devices = var.vault_enable_audit_devices
-      install_dir          = local.vault_install_dir
+      hosts                = step.create_vault_cluster_targets.hosts
+      install_dir          = global.vault_install_dir[matrix.artifact_type]
+      ip_version           = matrix.ip_version
       license              = matrix.edition != "ce" ? step.read_vault_license.license : null
       local_artifact_path  = local.artifact_path
       manage_service       = local.manage_service
-      packages             = concat(global.packages, global.distro_packages[matrix.distro])
-      seal_ha_beta         = matrix.seal_ha_beta
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
       seal_attributes      = step.create_seal_key.attributes
       seal_type            = matrix.seal
       storage_backend      = matrix.backend
-      target_hosts         = step.create_vault_cluster_targets.hosts
+    }
+  }
+
+  step "get_local_metadata" {
+    description = global.description.get_local_metadata
+    skip_step   = matrix.artifact_source != "local"
+    module      = module.get_local_metadata
+  }
+
+  // Wait for our cluster to elect a leader
+  step "wait_for_new_leader" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_vault_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      timeout           = 120 // seconds
+      ip_version        = matrix.ip_version
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "get_leader_ip_for_step_down" {
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_new_leader]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  // Force a step down to trigger a new leader election
+  step "vault_leader_step_down" {
+    description = global.description.vault_leader_step_down
+    module      = module.vault_step_down
+    depends_on  = [step.get_leader_ip_for_step_down]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_step_down_steps_down,
+      quality.vault_cli_operator_step_down,
+    ]
+
+    variables {
+      leader_host       = step.get_leader_ip_for_step_down.leader_host
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   // Wait for our cluster to elect a leader
   step "wait_for_leader" {
-    module     = module.vault_wait_for_leader
-    depends_on = [step.create_vault_cluster]
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.vault_leader_step_down]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_step_down,
+    ]
+
     variables {
-      timeout           = 120 # seconds
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      timeout           = 120 // seconds
+      ip_version        = matrix.ip_version
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "get_vault_cluster_ips" {
-    module     = module.vault_get_cluster_ips
-    depends_on = [step.wait_for_leader]
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_leader]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
+  step "verify_vault_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
+    depends_on  = [step.wait_for_leader]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
   step "verify_vault_version" {
-    module     = module.vault_verify_version
-    depends_on = [step.create_vault_cluster]
+    description = global.description.verify_vault_version
+    module      = module.vault_verify_version
+    depends_on  = [step.verify_vault_unsealed]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_version_history_keys,
+      quality.vault_api_sys_version_history_key_info,
+      quality.vault_version_build_date,
+      quality.vault_version_edition,
+      quality.vault_version_release,
+    ]
+
     variables {
-      vault_instances       = step.create_vault_cluster_targets.hosts
+      hosts                 = step.create_vault_cluster_targets.hosts
+      vault_addr            = step.create_vault_cluster.api_addr_localhost
       vault_edition         = matrix.edition
-      vault_install_dir     = local.vault_install_dir
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
       vault_product_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
       vault_revision        = matrix.artifact_source == "local" ? step.get_local_metadata.revision : var.vault_revision
       vault_build_date      = matrix.artifact_source == "local" ? step.get_local_metadata.build_date : var.vault_build_date
@@ -265,107 +530,237 @@ scenario "smoke" {
     }
   }
 
-  step "verify_vault_unsealed" {
-    module     = module.vault_verify_unsealed
-    depends_on = [step.wait_for_leader]
+
+  step "verify_raft_auto_join_voter" {
+    description = global.description.verify_raft_cluster_all_nodes_are_voters
+    skip_step   = matrix.backend != "raft"
+    module      = module.vault_verify_raft_auto_join_voter
+    depends_on  = [step.verify_vault_unsealed]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_raft_voters
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_write_test_data" {
-    module = module.vault_verify_write_data
+  step "vault_remove_node_and_verify" {
+    description = <<-EOF
+      Remove a follower and ensure that it's marked as removed and can be added back once its data has been deleted
+    EOF
+    module      = semverconstraint(var.vault_product_version, ">=1.19.0-0") && matrix.backend == "raft" ? "vault_raft_remove_node_and_verify" : "vault_verify_removed_node_shim"
     depends_on = [
       step.create_vault_cluster,
-      step.get_vault_cluster_ips
+      step.get_vault_cluster_ips,
+      step.verify_vault_unsealed,
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_storage_raft_remove_peer_write_removes_peer,
+      quality.vault_cli_operator_raft_remove_peer,
+      quality.vault_raft_removed_after_restart,
+      quality.vault_raft_removed_statuses,
+      quality.vault_raft_removed_cant_rejoin,
+      quality.vault_raft_removed_rejoin_after_deletion,
+    ]
+
     variables {
-      leader_public_ip  = step.get_vault_cluster_ips.leader_public_ip
-      leader_private_ip = step.get_vault_cluster_ips.leader_private_ip
-      vault_instances   = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      add_back_nodes    = true
+      cluster_port      = step.create_vault_cluster.cluster_port
+      hosts             = step.get_vault_cluster_ips.follower_hosts
+      ip_version        = matrix.ip_version
+      listener_port     = step.create_vault_cluster.listener_port
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_leader_host = step.get_vault_cluster_ips.leader_host
       vault_root_token  = step.create_vault_cluster.root_token
+      vault_seal_type   = matrix.seal
+      vault_unseal_keys = matrix.seal == "shamir" ? step.create_vault_cluster.unseal_keys_hex : null
     }
   }
 
-  step "verify_raft_auto_join_voter" {
-    skip_step = matrix.backend != "raft"
-    module    = module.vault_verify_raft_auto_join_voter
+  step "verify_secrets_engines_create" {
+    description = global.description.verify_secrets_engines_create
+    module      = module.vault_verify_secrets_engines_create
     depends_on = [
-      step.create_vault_cluster,
-      step.get_vault_cluster_ips
+      step.get_vault_cluster_ips,
+      step.vault_remove_node_and_verify,
+      step.verify_vault_version
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_auth_userpass_user_write,
+      quality.vault_api_identity_entity_write,
+      quality.vault_api_identity_entity_alias_write,
+      quality.vault_api_identity_group_write,
+      quality.vault_api_identity_oidc_config_write,
+      quality.vault_api_identity_oidc_introspect_write,
+      quality.vault_api_identity_oidc_key_write,
+      quality.vault_api_identity_oidc_key_rotate_write,
+      quality.vault_api_identity_oidc_role_write,
+      quality.vault_api_identity_oidc_token_read,
+      quality.vault_api_sys_auth_userpass_user_write,
+      quality.vault_api_sys_policy_write,
+      quality.vault_mount_auth,
+      quality.vault_mount_kv,
+      quality.vault_secrets_kmip_write_config,
+      quality.vault_secrets_kv_write,
+      quality.vault_secrets_ldap_write_config,
+    ]
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
-      vault_root_token  = step.create_vault_cluster.root_token
+      hosts                  = step.create_vault_cluster_targets.hosts
+      ip_version             = matrix.ip_version
+      integration_host_state = step.set_up_external_integration_target.state
+      leader_host            = step.get_vault_cluster_ips.leader_host
+      ports                  = global.ports
+      ipv4_cidr              = step.create_vpc.ipv4_cidr
+      vault_addr             = step.create_vault_cluster.api_addr_localhost
+      vault_edition          = matrix.edition
+      vault_install_dir      = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token       = step.create_vault_cluster.root_token
     }
   }
 
   step "verify_replication" {
-    module = module.vault_verify_replication
+    description = global.description.verify_replication_status
+    module      = module.vault_verify_replication
+    depends_on  = [step.vault_remove_node_and_verify]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_replication_ce_disabled,
+      quality.vault_replication_ent_dr_available,
+      quality.vault_replication_ent_pr_available,
+    ]
+
+    variables {
+      hosts         = step.create_vault_cluster_targets.hosts
+      vault_addr    = step.create_vault_cluster.api_addr_localhost
+      vault_edition = matrix.edition
+    }
+  }
+
+  step "verify_secrets_engines_read" {
+    description = global.description.verify_secrets_engines_read
+    module      = module.vault_verify_secrets_engines_read
     depends_on = [
-      step.create_vault_cluster,
-      step.get_vault_cluster_ips
+      step.verify_secrets_engines_create,
+      step.verify_replication
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_identity_entity_read,
+      quality.vault_api_identity_oidc_config_read,
+      quality.vault_api_identity_oidc_key_read,
+      quality.vault_api_identity_oidc_role_read,
+      quality.vault_secrets_kv_read
+    ]
+
     variables {
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_vault_cluster_ips.follower_hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
       vault_edition     = matrix.edition
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_read_test_data" {
-    module = module.vault_verify_read_data
+  step "verify_log_secrets" {
+    skip_step = !var.vault_enable_audit_devices || !var.verify_log_secrets
+
+    description = global.description.verify_log_secrets
+    module      = module.verify_log_secrets
     depends_on = [
-      step.verify_write_test_data,
-      step.verify_replication
+      step.verify_secrets_engines_read,
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_audit_log_secrets,
+      quality.vault_journal_secrets,
+      quality.vault_radar_index_create,
+      quality.vault_radar_scan_file,
+    ]
+
     variables {
-      node_public_ips   = step.get_vault_cluster_ips.follower_public_ips
-      vault_install_dir = local.vault_install_dir
+      audit_log_file_path = step.create_vault_cluster.audit_device_file_path
+      leader_host         = step.get_vault_cluster_ips.leader_host
+      vault_addr          = step.create_vault_cluster.api_addr_localhost
+      vault_root_token    = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_ui" {
-    module = module.vault_verify_ui
+  step "verify_secrets_engines_delete" {
+    description = global.description.verify_secrets_engines_delete
+    module      = module.vault_verify_secrets_engines_delete
     depends_on = [
-      step.create_vault_cluster,
-      step.get_vault_cluster_ips
+      step.verify_secrets_engines_create,
+      step.verify_secrets_engines_read
+    ]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_ssh_role_delete
     ]
 
+    variables {
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_vault_cluster_ips.follower_hosts
+      leader_host       = step.get_vault_cluster_ips.leader_host
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "verify_ui" {
+    description = global.description.verify_ui
+    module      = module.vault_verify_ui
+    depends_on  = [step.vault_remove_node_and_verify]
+
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_ui_assets
+
     variables {
-      vault_instances = step.create_vault_cluster_targets.hosts
+      hosts      = step.create_vault_cluster_targets.hosts
+      vault_addr = step.create_vault_cluster.api_addr_localhost
     }
   }
 
@@ -374,6 +769,16 @@ scenario "smoke" {
     value       = step.create_vault_cluster.audit_device_file_path
   }
 
+  output "external_integration_server_ldap" {
+    description = "The LDAP test servers info"
+    value       = step.set_up_external_integration_target.state.ldap
+  }
+
+  output "integration_host_kmip_state" {
+    description = "The KMIP test servers info"
+    value       = step.set_up_external_integration_target.state.kmip
+  }
+
   output "cluster_name" {
     description = "The Vault cluster name"
     value       = step.create_vault_cluster.cluster_name
@@ -381,7 +786,7 @@ scenario "smoke" {
 
   output "hosts" {
     description = "The Vault cluster target hosts"
-    value       = step.create_vault_cluster.target_hosts
+    value       = step.create_vault_cluster.hosts
   }
 
   output "private_ips" {
@@ -414,6 +819,12 @@ scenario "smoke" {
     value       = step.create_vault_cluster.recovery_keys_hex
   }
 
+  output "secrets_engines_state" {
+    description = "The state of configured secrets engines"
+    sensitive   = true
+    value       = step.verify_secrets_engines_create.state
+  }
+
   output "seal_key_attributes" {
     description = "The Vault cluster seal attributes"
     value       = step.create_seal_key.attributes
diff --git a/enos/enos-scenario-ui.hcl b/enos/enos-scenario-ui.hcl
index 83810529727..8e31b38e670 100644
--- a/enos/enos-scenario-ui.hcl
+++ b/enos/enos-scenario-ui.hcl
@@ -1,11 +1,30 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 scenario "ui" {
+  description = <<-EOF
+    The UI scenario creates a new cluster and runs the existing Ember test suite
+    against a live Vault cluster instead of a binary in dev mode. It builds Vault
+    from the local branch.
+
+    # How to run this scenario
+
+    For general instructions on running a scenario, refer to the Enos docs: https://eng-handbook.hashicorp.services/internal-tools/enos/running-a-scenario/
+    For troubleshooting tips and common errors, see https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/.
+
+    Variables required for all scenario variants:
+      - aws_ssh_private_key_path (more info about AWS SSH keypairs: https://eng-handbook.hashicorp.services/internal-tools/enos/getting-started/#set-your-aws-key-pair-name-and-private-key)
+      - aws_ssh_keypair_name
+      - vault_product_version
+
+    Variables required for some scenario variants:
+      - consul_license_path (if using an ENT edition of Consul)
+      - vault_license_path (if using an ENT edition of Vault)
+  EOF
   matrix {
-    backend      = global.backends
-    edition      = ["ce", "ent"]
-    seal_ha_beta = ["true", "false"]
+    backend        = global.backends
+    consul_edition = global.consul_editions
+    edition        = ["ce", "ent"]
   }
 
   terraform_cli = terraform_cli.default
@@ -24,19 +43,16 @@ scenario "ui" {
       "ce"  = ["ui"]
       "ent" = ["ui", "enterprise", "ent"]
     }
-    bundle_path    = abspath(var.vault_artifact_path)
+    artifact_path  = abspath(var.vault_artifact_path)
     distro         = "ubuntu"
     consul_version = "1.17.0"
+    ip_version     = 4
     seal           = "awskms"
     tags = merge({
       "Project Name" : var.project_name
       "Project" : "Enos",
       "Environment" : "ci"
     }, var.tags)
-    vault_install_dir_packages = {
-      rhel   = "/bin"
-      ubuntu = "/usr/bin"
-    }
     vault_install_dir  = var.vault_install_dir
     vault_license_path = abspath(var.vault_license_path != null ? var.vault_license_path : joinpath(path.root, "./support/vault.hclic"))
     vault_tag_key      = "Type" // enos_vault_start expects Type as the tag key
@@ -44,11 +60,12 @@ scenario "ui" {
   }
 
   step "build_vault" {
-    module = module.build_local
+    description = global.description.build_vault
+    module      = module.build_local
 
     variables {
       build_tags      = var.vault_local_build_tags != null ? var.vault_local_build_tags : local.build_tags[matrix.edition]
-      bundle_path     = local.bundle_path
+      artifact_path   = local.artifact_path
       goarch          = local.arch
       goos            = "linux"
       product_version = var.vault_product_version
@@ -58,31 +75,26 @@ scenario "ui" {
   }
 
   step "ec2_info" {
-    module = module.ec2_info
+    description = global.description.ec2_info
+    module      = module.ec2_info
   }
 
   step "create_vpc" {
-    module = module.create_vpc
+    description = global.description.create_vpc
+    module      = module.create_vpc
 
     variables {
       common_tags = local.tags
-    }
-  }
-
-  step "create_seal_key" {
-    module = "seal_${local.seal}"
-
-    variables {
-      cluster_id  = step.create_vpc.cluster_id
-      common_tags = global.tags
+      ip_version  = local.ip_version
     }
   }
 
   // This step reads the contents of the backend license if we're using a Consul backend and
   // the edition is "ent".
   step "read_backend_license" {
-    skip_step = matrix.backend == "raft" || var.backend_edition == "ce"
-    module    = module.read_license
+    description = global.description.read_backend_license
+    skip_step   = matrix.backend == "raft" || matrix.consul_edition == "ce"
+    module      = module.read_license
 
     variables {
       file_name = local.backend_license_path
@@ -90,50 +102,64 @@ scenario "ui" {
   }
 
   step "read_vault_license" {
-    skip_step = matrix.edition == "ce"
-    module    = module.read_license
+    description = global.description.read_vault_license
+    skip_step   = matrix.edition == "ce"
+    module      = module.read_license
 
     variables {
       file_name = local.vault_license_path
     }
   }
 
+  step "create_seal_key" {
+    description = global.description.create_seal_key
+    module      = "seal_${local.seal}"
+
+    variables {
+      cluster_id  = step.create_vpc.cluster_id
+      common_tags = global.tags
+    }
+  }
+
   step "create_vault_cluster_targets" {
-    module     = module.target_ec2_instances
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
     variables {
-      ami_id          = step.ec2_info.ami_ids[local.arch][local.distro][var.ubuntu_distro_version]
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
       cluster_tag_key = local.vault_tag_key
       common_tags     = local.tags
-      seal_names      = step.create_seal_key.resource_names
+      seal_key_names  = step.create_seal_key.resource_names
       vpc_id          = step.create_vpc.id
     }
   }
 
   step "create_vault_cluster_backend_targets" {
-    module     = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
     variables {
-      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["22.04"]
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
       cluster_tag_key = local.backend_tag_key
       common_tags     = local.tags
-      seal_names      = step.create_seal_key.resource_names
+      seal_key_names  = step.create_seal_key.resource_names
       vpc_id          = step.create_vpc.id
     }
   }
 
   step "create_backend_cluster" {
-    module = "backend_${matrix.backend}"
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.backend}"
     depends_on = [
       step.create_vault_cluster_backend_targets,
     ]
@@ -142,20 +168,38 @@ scenario "ui" {
       enos = provider.enos.ubuntu
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_server,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_cli_validate,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_notified,
+      quality.consul_service_systemd_unit,
+    ]
+
     variables {
       cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       cluster_tag_key = local.backend_tag_key
-      license         = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      hosts           = step.create_vault_cluster_backend_targets.hosts
+      license         = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       release = {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = local.consul_version
       }
-      target_hosts = step.create_vault_cluster_backend_targets.hosts
     }
   }
 
   step "create_vault_cluster" {
-    module = module.vault_cluster
+    description = global.description.create_vault_cluster
+    module      = module.vault_cluster
     depends_on = [
       step.create_backend_cluster,
       step.build_vault,
@@ -166,48 +210,98 @@ scenario "ui" {
       enos = provider.enos.ubuntu
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_service_start_client,
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_socket,
+      quality.vault_audit_syslog,
+      quality.vault_autojoin_aws,
+      quality.vault_config_env_variables,
+      quality.vault_config_file,
+      quality.vault_config_log_level,
+      quality.vault_init,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_storage_backend_consul,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_cli_status_exit_code,
+      quality.vault_service_systemd_notified,
+      quality.vault_service_systemd_unit,
+    ]
+
     variables {
       backend_cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       backend_cluster_tag_key = local.backend_tag_key
       cluster_name            = step.create_vault_cluster_targets.cluster_name
-      consul_license          = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      config_mode             = "file"
+      consul_license          = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       consul_release = matrix.backend == "consul" ? {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = local.consul_version
       } : null
       enable_audit_devices = var.vault_enable_audit_devices
+      hosts                = step.create_vault_cluster_targets.hosts
       install_dir          = local.vault_install_dir
+      ip_version           = local.ip_version
       license              = matrix.edition != "ce" ? step.read_vault_license.license : null
-      local_artifact_path  = local.bundle_path
-      packages             = global.distro_packages["ubuntu"]
-      seal_ha_beta         = matrix.seal_ha_beta
-      seal_name            = step.create_seal_key.resource_name
+      local_artifact_path  = local.artifact_path
+      packages             = concat(global.packages, global.distro_packages["ubuntu"][global.distro_version["ubuntu"]])
+      seal_attributes      = step.create_seal_key.attributes
       seal_type            = local.seal
       storage_backend      = matrix.backend
-      target_hosts         = step.create_vault_cluster_targets.hosts
     }
   }
 
   // Wait for our cluster to elect a leader
   step "wait_for_leader" {
-    module     = module.vault_wait_for_leader
-    depends_on = [step.create_vault_cluster]
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_vault_cluster]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
     variables {
-      timeout           = 120 # seconds
-      vault_hosts       = step.create_vault_cluster_targets.hosts
+      timeout           = 120 // seconds
+      ip_version        = local.ip_version
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
       vault_install_dir = local.vault_install_dir
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "test_ui" {
-    module     = module.vault_test_ui
-    depends_on = [step.wait_for_leader]
+    description = <<-EOF
+      Verify that the Vault Web UI test suite can run against a live cluster with the compiled
+      assets.
+    EOF
+    module      = module.vault_test_ui
+    depends_on  = [step.wait_for_leader]
+
+    verifies = quality.vault_ui_test
 
     variables {
       vault_addr               = step.create_vault_cluster_targets.hosts[0].public_ip
@@ -230,7 +324,7 @@ scenario "ui" {
 
   output "hosts" {
     description = "The Vault cluster target hosts"
-    value       = step.create_vault_cluster.target_hosts
+    value       = step.create_vault_cluster.hosts
   }
 
   output "private_ips" {
diff --git a/enos/enos-scenario-upgrade.hcl b/enos/enos-scenario-upgrade.hcl
index 6fb37db7f9e..ae23058fb18 100644
--- a/enos/enos-scenario-upgrade.hcl
+++ b/enos/enos-scenario-upgrade.hcl
@@ -1,47 +1,87 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 scenario "upgrade" {
+  description = <<-EOF
+    The upgrade scenario verifies in-place upgrades between previously released versions of Vault
+    against another candidate build. The build can be a local branch, any CRT built Vault artifact
+    saved to the local machine, or any CRT built Vault artifact in the stable channel in Artifactory.
+
+    The scenario creates a new Vault cluster with a previously released version of Vault. It then
+    mounts engines, creates data, and performs an in-place upgrade with any candidate built. Finally,
+    it performs quality verification.
+
+    # How to run this scenario
+
+    For general instructions on running a scenario, refer to the Enos docs: https://eng-handbook.hashicorp.services/internal-tools/enos/running-a-scenario/
+    For troubleshooting tips and common errors, see https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/.
+
+    Variables required for all scenario variants:
+      - aws_ssh_private_key_path (more info about AWS SSH keypairs: https://eng-handbook.hashicorp.services/internal-tools/enos/getting-started/#set-your-aws-key-pair-name-and-private-key)
+      - aws_ssh_keypair_name
+      - vault_build_date*
+      - vault_product_version
+      - vault_revision*
+
+    * If you don't already know what build date and revision you should be using, see
+    https://eng-handbook.hashicorp.services/internal-tools/enos/troubleshooting/#execution-error-expected-vs-got-for-vault-versioneditionrevisionbuild-date.
+
+    Variables required for some scenario variants:
+      - artifactory_token (if using `artifact_source:artifactory` in your filter)
+      - aws_region (if different from the default value in enos-variables.hcl)
+      - consul_license_path (if using an ENT edition of Consul)
+      - distro_version_<distro> (if different from the default version for your target
+      distro. See supported distros and default versions in the distro_version_<distro>
+      definitions in enos-variables.hcl)
+      - vault_artifact_path (the path to where you have a Vault artifact already downloaded,
+      if using `artifact_source:crt` in your filter)
+      - vault_license_path (if using an ENT edition of Vault)
+      - vault_upgrade_initial_version (if the version you want to start with differs
+      from the default value defined in enos-variables.hcl)
+  EOF
+
   matrix {
     arch            = global.archs
     artifact_source = global.artifact_sources
     artifact_type   = global.artifact_types
     backend         = global.backends
+    config_mode     = global.config_modes
+    consul_edition  = global.consul_editions
     consul_version  = global.consul_versions
     distro          = global.distros
     edition         = global.editions
-    // NOTE: when backporting the initial version make sure we don't include initial versions that
-    // are a higher minor version that our release candidate. Also, prior to 1.11.x the
-    // /v1/sys/seal-status API has known issues that could cause this scenario to fail when using
-    // those earlier versions, therefore support from 1.8.x to 1.10.x is unreliable. Prior to 1.8.x
-    // is not supported due to changes with vault's signaling of systemd and the enos-provider
-    // no longer supporting setting the license via the license API.
-    initial_version = global.upgrade_initial_versions
+    ip_version      = global.ip_versions
     seal            = global.seals
-    seal_ha_beta    = ["true", "false"]
 
-    # Our local builder always creates bundles
+    // Our local builder always creates bundles
     exclude {
       artifact_source = ["local"]
       artifact_type   = ["package"]
     }
 
-    # HSM and FIPS 140-2 are only supported on amd64
+    // There are no published versions of these artifacts yet. We'll update this to exclude older
+    // versions after our initial publication of these editions for arm64.
     exclude {
       arch    = ["arm64"]
-      edition = ["ent.fips1402", "ent.hsm", "ent.hsm.fips1402"]
+      edition = ["ent.fips1403", "ent.hsm", "ent.hsm.fips1403"]
     }
 
-    # FIPS 140-2 editions began at 1.10
+    // PKCS#11 can only be used with hsm editions
     exclude {
-      edition         = ["ent.fips1402", "ent.hsm.fips1402"]
-      initial_version = ["1.8.12", "1.9.10"]
+      seal    = ["pkcs11"]
+      edition = [for e in matrix.edition : e if !strcontains(e, "hsm")]
     }
 
-    # PKCS#11 can only be used on ent.hsm and ent.hsm.fips1402.
+    // softhsm packages not available for leap/sles.
     exclude {
-      seal    = ["pkcs11"]
-      edition = ["ce", "ent", "ent.fips1402"]
+      seal   = ["pkcs11"]
+      distro = ["leap", "sles"]
+    }
+
+    // Testing in IPV6 mode is currently implemented for integrated Raft storage only
+    exclude {
+      ip_version = ["6"]
+      backend    = ["consul"]
     }
   }
 
@@ -49,64 +89,64 @@ scenario "upgrade" {
   terraform     = terraform.default
   providers = [
     provider.aws.default,
-    provider.enos.ubuntu,
-    provider.enos.rhel
+    provider.enos.ec2_user,
+    provider.enos.ubuntu
   ]
 
   locals {
     artifact_path = matrix.artifact_source != "artifactory" ? abspath(var.vault_artifact_path) : null
     enos_provider = {
-      rhel   = provider.enos.rhel
+      amzn   = provider.enos.ec2_user
+      leap   = provider.enos.ec2_user
+      rhel   = provider.enos.ec2_user
+      sles   = provider.enos.ec2_user
       ubuntu = provider.enos.ubuntu
     }
-    manage_service    = matrix.artifact_type == "bundle"
-    vault_install_dir = matrix.artifact_type == "bundle" ? var.vault_install_dir : global.vault_install_dir_packages[matrix.distro]
+    manage_service = matrix.artifact_type == "bundle"
   }
 
-  step "get_local_metadata" {
-    skip_step = matrix.artifact_source != "local"
-    module    = module.get_local_metadata
-  }
-
-  # This step gets/builds the upgrade artifact that we will upgrade to
   step "build_vault" {
-    module = "build_${matrix.artifact_source}"
+    description = global.description.build_vault
+    module      = "build_${matrix.artifact_source}"
 
     variables {
-      build_tags           = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
-      artifact_path        = local.artifact_path
-      goarch               = matrix.arch
-      goos                 = "linux"
-      artifactory_host     = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
-      artifactory_repo     = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
-      artifactory_username = matrix.artifact_source == "artifactory" ? var.artifactory_username : null
-      artifactory_token    = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
-      arch                 = matrix.artifact_source == "artifactory" ? matrix.arch : null
-      product_version      = var.vault_product_version
-      artifact_type        = matrix.artifact_type
-      distro               = matrix.artifact_source == "artifactory" ? matrix.distro : null
-      edition              = matrix.artifact_source == "artifactory" ? matrix.edition : null
-      revision             = var.vault_revision
+      build_tags        = var.vault_local_build_tags != null ? var.vault_local_build_tags : global.build_tags[matrix.edition]
+      artifact_path     = local.artifact_path
+      goarch            = matrix.arch
+      goos              = "linux"
+      artifactory_host  = matrix.artifact_source == "artifactory" ? var.artifactory_host : null
+      artifactory_repo  = matrix.artifact_source == "artifactory" ? var.artifactory_repo : null
+      artifactory_token = matrix.artifact_source == "artifactory" ? var.artifactory_token : null
+      arch              = matrix.artifact_source == "artifactory" ? matrix.arch : null
+      product_version   = var.vault_product_version
+      artifact_type     = matrix.artifact_type
+      distro            = matrix.artifact_source == "artifactory" ? matrix.distro : null
+      edition           = matrix.artifact_source == "artifactory" ? matrix.edition : null
+      revision          = var.vault_revision
     }
   }
 
   step "ec2_info" {
-    module = module.ec2_info
+    description = global.description.ec2_info
+    module      = module.ec2_info
   }
 
   step "create_vpc" {
-    module = module.create_vpc
+    description = global.description.create_vpc
+    module      = module.create_vpc
 
     variables {
       common_tags = global.tags
+      ip_version  = matrix.ip_version
     }
   }
 
   // This step reads the contents of the backend license if we're using a Consul backend and
-  // the edition is "ent".
+  // an "ent" Consul edition.
   step "read_backend_license" {
-    skip_step = matrix.backend == "raft" || var.backend_edition == "ce"
-    module    = module.read_license
+    description = global.description.read_backend_license
+    skip_step   = matrix.backend == "raft" || matrix.consul_edition == "ce"
+    module      = module.read_license
 
     variables {
       file_name = global.backend_license_path
@@ -114,8 +154,9 @@ scenario "upgrade" {
   }
 
   step "read_vault_license" {
-    skip_step = matrix.edition == "ce"
-    module    = module.read_license
+    description = global.description.read_vault_license
+    skip_step   = matrix.edition == "ce"
+    module      = module.read_license
 
     variables {
       file_name = global.vault_license_path
@@ -123,8 +164,9 @@ scenario "upgrade" {
   }
 
   step "create_seal_key" {
-    module     = "seal_${matrix.seal}"
-    depends_on = [step.create_vpc]
+    description = global.description.create_seal_key
+    module      = "seal_${matrix.seal}"
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
@@ -136,9 +178,27 @@ scenario "upgrade" {
     }
   }
 
+  step "create_external_integration_target" {
+    description = global.description.create_external_integration_target
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["24.04"]
+      cluster_tag_key = global.vault_tag_key
+      common_tags     = global.tags
+      vpc_id          = step.create_vpc.id
+    }
+  }
+
   step "create_vault_cluster_targets" {
-    module     = module.target_ec2_instances
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = module.target_ec2_instances
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
@@ -154,15 +214,16 @@ scenario "upgrade" {
   }
 
   step "create_vault_cluster_backend_targets" {
-    module     = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
-    depends_on = [step.create_vpc]
+    description = global.description.create_vault_cluster_targets
+    module      = matrix.backend == "consul" ? module.target_ec2_instances : module.target_ec2_shim
+    depends_on  = [step.create_vpc]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
     variables {
-      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"]["22.04"]
+      ami_id          = step.ec2_info.ami_ids["arm64"]["ubuntu"][global.distro_version["ubuntu"]]
       cluster_tag_key = global.backend_tag_key
       common_tags     = global.tags
       seal_key_names  = step.create_seal_key.resource_names
@@ -170,30 +231,69 @@ scenario "upgrade" {
     }
   }
 
+  step "set_up_external_integration_target" {
+    description = global.description.set_up_external_integration_target
+    module      = module.set_up_external_integration_target
+    depends_on = [
+      step.create_external_integration_target
+    ]
+
+    providers = {
+      enos = local.enos_provider["ubuntu"]
+    }
+
+    variables {
+      hosts      = step.create_external_integration_target.hosts
+      ip_version = matrix.ip_version
+      packages   = concat(global.packages, global.distro_packages["ubuntu"]["24.04"], ["podman", "podman-docker"])
+      ports      = global.integration_host_ports
+    }
+  }
+
   step "create_backend_cluster" {
-    module = "backend_${matrix.backend}"
+    description = global.description.create_backend_cluster
+    module      = "backend_${matrix.backend}"
     depends_on = [
       step.create_vault_cluster_backend_targets,
+      step.set_up_external_integration_target
     ]
 
     providers = {
       enos = provider.enos.ubuntu
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_autojoin_aws,
+      quality.consul_config_file,
+      quality.consul_ha_leader_election,
+      quality.consul_service_start_server,
+      // verified in enos_consul_start resource
+      quality.consul_api_agent_host_read,
+      quality.consul_api_health_node_read,
+      quality.consul_api_operator_raft_config_read,
+      quality.consul_cli_validate,
+      quality.consul_health_state_passing_read_nodes_minimum,
+      quality.consul_operator_raft_configuration_read_voters_minimum,
+      quality.consul_service_systemd_notified,
+      quality.consul_service_systemd_unit,
+    ]
+
     variables {
       cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       cluster_tag_key = global.backend_tag_key
-      license         = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
+      hosts           = step.create_vault_cluster_backend_targets.hosts
+      license         = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       release = {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = matrix.consul_version
       }
-      target_hosts = step.create_vault_cluster_backend_targets.hosts
     }
   }
 
   step "create_vault_cluster" {
-    module = module.vault_cluster
+    description = global.description.create_vault_cluster
+    module      = module.vault_cluster
     depends_on = [
       step.create_backend_cluster,
       step.build_vault,
@@ -204,93 +304,216 @@ scenario "upgrade" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      // verified in modules
+      quality.consul_service_start_client,
+      quality.vault_artifact_bundle,
+      quality.vault_artifact_deb,
+      quality.vault_artifact_rpm,
+      quality.vault_audit_log,
+      quality.vault_audit_socket,
+      quality.vault_audit_syslog,
+      quality.vault_autojoin_aws,
+      quality.vault_storage_backend_consul,
+      quality.vault_config_env_variables,
+      quality.vault_config_file,
+      quality.vault_config_log_level,
+      quality.vault_init,
+      quality.vault_license_required_ent,
+      quality.vault_listener_ipv4,
+      quality.vault_listener_ipv6,
+      quality.vault_service_start,
+      quality.vault_storage_backend_raft,
+      // verified in enos_vault_start resource
+      quality.vault_api_sys_config_read,
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_health_read,
+      quality.vault_api_sys_host_info_read,
+      quality.vault_api_sys_replication_status_read,
+      quality.vault_api_sys_seal_status_api_read_matches_sys_health,
+      quality.vault_api_sys_storage_raft_autopilot_configuration_read,
+      quality.vault_api_sys_storage_raft_autopilot_state_read,
+      quality.vault_api_sys_storage_raft_configuration_read,
+      quality.vault_cli_status_exit_code,
+      quality.vault_service_systemd_unit,
+      quality.vault_service_systemd_notified,
+    ]
+
     variables {
       backend_cluster_name    = step.create_vault_cluster_backend_targets.cluster_name
       backend_cluster_tag_key = global.backend_tag_key
-      consul_license          = (matrix.backend == "consul" && var.backend_edition == "ent") ? step.read_backend_license.license : null
       cluster_name            = step.create_vault_cluster_targets.cluster_name
+      config_mode             = matrix.config_mode
+      consul_license          = (matrix.backend == "consul" && matrix.consul_edition == "ent") ? step.read_backend_license.license : null
       consul_release = matrix.backend == "consul" ? {
-        edition = var.backend_edition
+        edition = matrix.consul_edition
         version = matrix.consul_version
       } : null
       enable_audit_devices = var.vault_enable_audit_devices
-      install_dir          = local.vault_install_dir
+      hosts                = step.create_vault_cluster_targets.hosts
+      ip_version           = matrix.ip_version
       license              = matrix.edition != "ce" ? step.read_vault_license.license : null
-      packages             = concat(global.packages, global.distro_packages[matrix.distro])
+      manage_service       = true # always handle systemd for released bundles
+      packages             = concat(global.packages, global.distro_packages[matrix.distro][global.distro_version[matrix.distro]])
       release = {
-        edition = matrix.edition
-        version = matrix.initial_version
+        edition = strcontains(matrix.edition, "fips1403") ? (
+          // Handle mixed fips1402 edition lineages.
+          semverconstraint(var.vault_upgrade_initial_version, "<1.19.4-0,>=1.19.0-0 || <1.18.15-0,>=1.18.0-0 || <1.18.0,>=1.17.0-0 || <1.16.26-0")
+          ? replace(matrix.edition, "fips1403", "fips1402")
+          : matrix.edition
+        ) : matrix.edition
+        version = var.vault_upgrade_initial_version
       }
-      seal_ha_beta    = matrix.seal_ha_beta
       seal_attributes = step.create_seal_key.attributes
       seal_type       = matrix.seal
       storage_backend = matrix.backend
-      target_hosts    = step.create_vault_cluster_targets.hosts
+    }
+  }
+
+  step "get_local_metadata" {
+    description = global.description.get_local_metadata
+    skip_step   = matrix.artifact_source != "local"
+    module      = module.get_local_metadata
+  }
+
+  // Wait for our cluster to elect a leader
+  step "wait_for_leader" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.create_vault_cluster]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      hosts      = step.create_vault_cluster_targets.hosts
+      ip_version = matrix.ip_version
+      timeout    = 120 // seconds
+      vault_addr = step.create_vault_cluster.api_addr_localhost
+      // Use the install dir for our initial version, which always comes from a zip bundle
+      vault_install_dir = global.vault_install_dir["bundle"]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "get_vault_cluster_ips" {
-    module     = module.vault_get_cluster_ips
-    depends_on = [step.create_vault_cluster]
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_leader]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts      = step.create_vault_cluster_targets.hosts
+      ip_version = matrix.ip_version
+      vault_addr = step.create_vault_cluster.api_addr_localhost
+      // Use the install dir for our initial version, which always comes from a zip bundle
+      vault_install_dir = global.vault_install_dir["bundle"]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_write_test_data" {
-    module = module.vault_verify_write_data
+  step "verify_secrets_engines_create" {
+    description = global.description.verify_secrets_engines_create
+    module      = module.vault_verify_secrets_engines_create
     depends_on = [
       step.create_vault_cluster,
-      step.get_vault_cluster_ips,
+      step.get_vault_cluster_ips
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_auth_userpass_user_write,
+      quality.vault_api_identity_entity_write,
+      quality.vault_api_identity_entity_alias_write,
+      quality.vault_api_identity_group_write,
+      quality.vault_api_identity_oidc_config_write,
+      quality.vault_api_identity_oidc_introspect_write,
+      quality.vault_api_identity_oidc_key_write,
+      quality.vault_api_identity_oidc_key_rotate_write,
+      quality.vault_api_identity_oidc_role_write,
+      quality.vault_api_identity_oidc_token_read,
+      quality.vault_api_sys_auth_userpass_user_write,
+      quality.vault_api_sys_policy_write,
+      quality.vault_mount_auth,
+      quality.vault_mount_kv,
+      quality.vault_secrets_kmip_write_config,
+      quality.vault_secrets_kv_write,
+      quality.vault_secrets_ldap_write_config,
+    ]
+
     variables {
-      leader_public_ip  = step.get_vault_cluster_ips.leader_public_ip
-      leader_private_ip = step.get_vault_cluster_ips.leader_private_ip
-      vault_instances   = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts                  = step.create_vault_cluster_targets.hosts
+      ip_version             = matrix.ip_version
+      integration_host_state = step.set_up_external_integration_target.state
+      leader_host            = step.get_vault_cluster_ips.leader_host
+      ports                  = global.ports
+      ipv4_cidr              = step.create_vpc.ipv4_cidr
+      vault_addr             = step.create_vault_cluster.api_addr_localhost
+      vault_edition          = matrix.edition
+      // Use the install dir for our initial version, which always comes from a zip bundle
+      vault_install_dir = global.vault_install_dir["bundle"]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  # This step upgrades the Vault cluster to the var.vault_product_version
-  # by getting a bundle or package of that version from the matrix.artifact_source
+  // This step upgrades the Vault cluster to the var.vault_product_version
+  // by getting a bundle or package of that version from the matrix.artifact_source
   step "upgrade_vault" {
-    module = module.vault_upgrade
+    description = <<-EOF
+      Perform an in-place upgrade of the Vault Cluster nodes by first installing a new version
+      of Vault on the cluster node machines and restarting the service.
+    EOF
+    module      = module.vault_upgrade
     depends_on = [
       step.create_vault_cluster,
-      step.verify_write_test_data,
+      step.verify_secrets_engines_create,
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_cluster_upgrade_in_place,
+      quality.vault_service_restart,
+    ]
+
     variables {
-      vault_api_addr            = "http://localhost:8200"
-      vault_instances           = step.create_vault_cluster_targets.hosts
-      vault_local_artifact_path = local.artifact_path
+      hosts                     = step.create_vault_cluster_targets.hosts
+      ip_version                = matrix.ip_version
+      vault_addr                = step.create_vault_cluster.api_addr_localhost
       vault_artifactory_release = matrix.artifact_source == "artifactory" ? step.build_vault.vault_artifactory_release : null
-      vault_install_dir         = local.vault_install_dir
-      vault_unseal_keys         = matrix.seal == "shamir" ? step.create_vault_cluster.unseal_keys_hex : null
+      vault_install_dir         = global.vault_install_dir[matrix.artifact_type]
+      vault_local_artifact_path = local.artifact_path
+      vault_root_token          = step.create_vault_cluster.root_token
       vault_seal_type           = matrix.seal
+      vault_unseal_keys         = matrix.seal == "shamir" ? step.create_vault_cluster.unseal_keys_hex : null
     }
   }
 
   // Wait for our upgraded cluster to elect a leader
   step "wait_for_leader_after_upgrade" {
-    module = module.vault_wait_for_leader
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
     depends_on = [
       step.create_vault_cluster,
       step.upgrade_vault,
@@ -300,35 +523,122 @@ scenario "upgrade" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
     variables {
-      timeout           = 120 # seconds
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "get_leader_ip_for_step_down" {
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
+    depends_on  = [step.wait_for_leader_after_upgrade]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  // Force a step down to trigger a new leader election
+  step "vault_leader_step_down" {
+    description = global.description.vault_leader_step_down
+    module      = module.vault_step_down
+    depends_on  = [step.get_leader_ip_for_step_down]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_step_down_steps_down,
+      quality.vault_cli_operator_step_down,
+    ]
+
+    variables {
+      leader_host       = step.get_leader_ip_for_step_down.leader_host
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  // Wait for our cluster to elect a leader
+  step "wait_for_leader_after_stepdown" {
+    description = global.description.wait_for_cluster_to_have_leader
+    module      = module.vault_wait_for_leader
+    depends_on  = [step.vault_leader_step_down]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_leader_read,
+      quality.vault_unseal_ha_leader_election,
+    ]
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      timeout           = 120 // seconds
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "get_updated_vault_cluster_ips" {
-    module = module.vault_get_cluster_ips
+    description = global.description.get_vault_cluster_ip_addresses
+    module      = module.vault_get_cluster_ips
     depends_on = [
-      step.create_vault_cluster,
-      step.upgrade_vault,
-      step.wait_for_leader_after_upgrade,
+      step.wait_for_leader_after_stepdown,
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_sys_ha_status_read,
+      quality.vault_api_sys_leader_read,
+      quality.vault_cli_operator_members,
+    ]
+
     variables {
-      vault_hosts       = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_vault_version" {
-    module = module.vault_verify_version
+  step "verify_vault_unsealed" {
+    description = global.description.verify_vault_unsealed
+    module      = module.vault_wait_for_cluster_unsealed
     depends_on = [
       step.get_updated_vault_cluster_ips,
     ]
@@ -337,10 +647,41 @@ scenario "upgrade" {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_seal_awskms,
+      quality.vault_seal_pkcs11,
+      quality.vault_seal_shamir,
+    ]
+
     variables {
-      vault_instances       = step.create_vault_cluster_targets.hosts
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+    }
+  }
+
+  step "verify_vault_version" {
+    description = global.description.verify_vault_version
+    module      = module.vault_verify_version
+    depends_on  = [step.verify_vault_unsealed]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_api_sys_version_history_keys,
+      quality.vault_api_sys_version_history_key_info,
+      quality.vault_version_build_date,
+      quality.vault_version_edition,
+      quality.vault_version_release,
+    ]
+
+    variables {
+      hosts                 = step.create_vault_cluster_targets.hosts
+      vault_addr            = step.create_vault_cluster.api_addr_localhost
       vault_edition         = matrix.edition
-      vault_install_dir     = local.vault_install_dir
+      vault_install_dir     = global.vault_install_dir[matrix.artifact_type]
       vault_product_version = matrix.artifact_source == "local" ? step.get_local_metadata.version : var.vault_product_version
       vault_revision        = matrix.artifact_source == "local" ? step.get_local_metadata.revision : var.vault_revision
       vault_build_date      = matrix.artifact_source == "local" ? step.get_local_metadata.build_date : var.vault_build_date
@@ -348,87 +689,179 @@ scenario "upgrade" {
     }
   }
 
-  step "verify_vault_unsealed" {
-    module = module.vault_verify_unsealed
+  step "verify_secrets_engines_read" {
+    description = global.description.verify_secrets_engines_read
+    module      = module.vault_verify_secrets_engines_read
     depends_on = [
-      step.get_updated_vault_cluster_ips,
+      step.verify_secrets_engines_create,
+      step.verify_vault_unsealed
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_auth_userpass_login_write,
+      quality.vault_api_identity_entity_read,
+      quality.vault_api_identity_oidc_config_read,
+      quality.vault_api_identity_oidc_key_read,
+      quality.vault_api_identity_oidc_role_read,
+      quality.vault_secrets_kv_read
+    ]
+
     variables {
-      vault_instances   = step.create_vault_cluster_targets.hosts
-      vault_install_dir = local.vault_install_dir
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_updated_vault_cluster_ips.follower_hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_edition     = matrix.edition
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+
     }
   }
 
-  step "verify_read_test_data" {
-    module = module.vault_verify_read_data
+  step "verify_log_secrets" {
+    // Only verify log secrets if the audit devices are turned on and we've enabled the check (as
+    // it requires a radar license). Some older versions have known issues so we'll skip this step
+    // in the event that we're upgrading from them, see VAULT-30557 for more information.
+    skip_step = !var.vault_enable_audit_devices || !var.verify_log_secrets || semverconstraint(var.vault_upgrade_initial_version, "=1.17.3 || =1.17.4 || =1.16.7 || =1.16.8")
+
+    description = global.description.verify_log_secrets
+    module      = module.verify_log_secrets
     depends_on = [
-      step.get_updated_vault_cluster_ips,
-      step.verify_write_test_data,
-      step.verify_vault_unsealed
+      step.verify_secrets_engines_read,
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_audit_log_secrets,
+      quality.vault_journal_secrets,
+      quality.vault_radar_index_create,
+      quality.vault_radar_scan_file,
+    ]
+
     variables {
-      node_public_ips   = step.get_updated_vault_cluster_ips.follower_public_ips
-      vault_install_dir = local.vault_install_dir
+      audit_log_file_path = step.create_vault_cluster.audit_device_file_path
+      leader_host         = step.get_updated_vault_cluster_ips.leader_host
+      vault_addr          = step.create_vault_cluster.api_addr_localhost
+      vault_root_token    = step.create_vault_cluster.root_token
     }
   }
 
-  step "verify_raft_auto_join_voter" {
-    skip_step = matrix.backend != "raft"
-    module    = module.vault_verify_raft_auto_join_voter
+  step "verify_secrets_engines_delete" {
+    description = global.description.verify_secrets_engines_delete
+    module      = module.vault_verify_secrets_engines_delete
     depends_on = [
-      step.get_updated_vault_cluster_ips,
+      step.verify_secrets_engines_create,
+      step.verify_secrets_engines_read
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_api_ssh_role_delete
+    ]
+
     variables {
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      create_state      = step.verify_secrets_engines_create.state
+      hosts             = step.get_updated_vault_cluster_ips.follower_hosts
+      leader_host       = step.get_updated_vault_cluster_ips.leader_host
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
+    }
+  }
+
+  step "verify_raft_auto_join_voter" {
+    description = global.description.verify_raft_cluster_all_nodes_are_voters
+    skip_step   = matrix.backend != "raft"
+    module      = module.vault_verify_raft_auto_join_voter
+    depends_on  = [step.verify_vault_unsealed]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = quality.vault_raft_voters
+
+    variables {
+      hosts             = step.create_vault_cluster_targets.hosts
+      ip_version        = matrix.ip_version
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
       vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "verify_replication" {
-    module = module.vault_verify_replication
+    description = global.description.verify_replication_status
+    module      = module.vault_verify_replication
+    depends_on  = [step.verify_vault_unsealed]
+
+    providers = {
+      enos = local.enos_provider[matrix.distro]
+    }
+
+    verifies = [
+      quality.vault_replication_ce_disabled,
+      quality.vault_replication_ent_dr_available,
+      quality.vault_replication_ent_pr_available,
+    ]
+
+    variables {
+      hosts         = step.create_vault_cluster_targets.hosts
+      vault_addr    = step.create_vault_cluster.api_addr_localhost
+      vault_edition = matrix.edition
+    }
+  }
+
+  step "verify_billing_start_date" {
+    description = global.description.verify_billing_start_date
+    skip_step   = semverconstraint(var.vault_product_version, "<=1.16.6-0 || >=1.17.0-0 <=1.17.2-0")
+    module      = module.vault_verify_billing_start_date
     depends_on = [
       step.get_updated_vault_cluster_ips,
+      step.verify_vault_unsealed,
+      step.verify_secrets_engines_read,
     ]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = [
+      quality.vault_billing_start_date,
+    ]
+
     variables {
-      vault_edition     = matrix.edition
-      vault_install_dir = local.vault_install_dir
-      vault_instances   = step.create_vault_cluster_targets.hosts
+      hosts             = step.create_vault_cluster_targets.hosts
+      vault_addr        = step.create_vault_cluster.api_addr_localhost
+      vault_install_dir = global.vault_install_dir[matrix.artifact_type]
+      vault_root_token  = step.create_vault_cluster.root_token
     }
   }
 
   step "verify_ui" {
-    module = module.vault_verify_ui
-    depends_on = [
-      step.get_updated_vault_cluster_ips,
-    ]
+    description = global.description.verify_ui
+    module      = module.vault_verify_ui
+    depends_on  = [step.verify_vault_unsealed]
 
     providers = {
       enos = local.enos_provider[matrix.distro]
     }
 
+    verifies = quality.vault_ui_assets
+
     variables {
-      vault_instances = step.create_vault_cluster_targets.hosts
+      hosts      = step.create_vault_cluster_targets.hosts
+      vault_addr = step.create_vault_cluster.api_addr_localhost
     }
   }
 
@@ -437,6 +870,16 @@ scenario "upgrade" {
     value       = step.create_vault_cluster.audit_device_file_path
   }
 
+  output "external_integration_server_ldap" {
+    description = "The LDAP test servers info"
+    value       = step.set_up_external_integration_target.state.ldap
+  }
+
+  output "integration_host_kmip_state" {
+    description = "The KMIP test servers info"
+    value       = step.set_up_external_integration_target.state.kmip
+  }
+
   output "cluster_name" {
     description = "The Vault cluster name"
     value       = step.create_vault_cluster.cluster_name
@@ -444,7 +887,7 @@ scenario "upgrade" {
 
   output "hosts" {
     description = "The Vault cluster target hosts"
-    value       = step.create_vault_cluster.target_hosts
+    value       = step.create_vault_cluster.hosts
   }
 
   output "private_ips" {
@@ -482,6 +925,12 @@ scenario "upgrade" {
     value       = step.create_seal_key.attributes
   }
 
+  output "secrets_engines_state" {
+    description = "The state of configured secrets engines"
+    sensitive   = true
+    value       = step.verify_secrets_engines_create.state
+  }
+
   output "unseal_keys_b64" {
     description = "The Vault cluster unseal keys"
     value       = step.create_vault_cluster.unseal_keys_b64
diff --git a/enos/enos-terraform.hcl b/enos/enos-terraform.hcl
index c8e03fac262..41e714ca1a1 100644
--- a/enos/enos-terraform.hcl
+++ b/enos/enos-terraform.hcl
@@ -1,21 +1,19 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 terraform_cli "default" {
   plugin_cache_dir = var.terraform_plugin_cache_dir != null ? abspath(var.terraform_plugin_cache_dir) : null
+}
 
-  credentials "app.terraform.io" {
-    token = var.tfc_api_token
-  }
+terraform_cli "dev" {
+  plugin_cache_dir = var.terraform_plugin_cache_dir != null ? abspath(var.terraform_plugin_cache_dir) : null
 
-  /*
   provider_installation {
     dev_overrides = {
-      "app.terraform.io/hashicorp-qti/enos" = abspath("../../enos-provider/dist")
+      "registry.terraform.io/hashicorp-forge/enos" = try(abspath("../../terraform-provider-enos/dist"), null)
     }
     direct {}
   }
-  */
 }
 
 terraform "default" {
@@ -27,7 +25,7 @@ terraform "default" {
     }
 
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.4.0"
     }
   }
diff --git a/enos/enos-variables.hcl b/enos/enos-variables.hcl
index 12a9c961f3b..2e7fcec5075 100644
--- a/enos/enos-variables.hcl
+++ b/enos/enos-variables.hcl
@@ -1,12 +1,5 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-variable "artifactory_username" {
-  type        = string
-  description = "The username to use when testing an artifact from artifactory"
-  default     = null
-  sensitive   = true
-}
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
 variable "artifactory_token" {
   type        = string
@@ -69,16 +62,40 @@ variable "backend_log_level" {
   default     = "trace"
 }
 
-variable "project_name" {
-  description = "The description of the project"
+variable "distro_version_amzn" {
+  description = "The version of Amazon Linux 2 to use"
   type        = string
-  default     = "vault-enos-integration"
+  default     = "2023" // or "2", though pkcs11 has not been tested with 2
+}
+
+variable "distro_version_leap" {
+  description = "The version of openSUSE leap to use"
+  type        = string
+  default     = "15.6"
 }
 
-variable "rhel_distro_version" {
+variable "distro_version_rhel" {
   description = "The version of RHEL to use"
   type        = string
-  default     = "9.1" // or "8.8"
+  default     = "10.0" // or "8.10", "9.6"
+}
+
+variable "distro_version_sles" {
+  description = "The version of SUSE SLES to use"
+  type        = string
+  default     = "15.6"
+}
+
+variable "distro_version_ubuntu" {
+  description = "The version of ubuntu to use"
+  type        = string
+  default     = "24.04" // or "22.04"
+}
+
+variable "project_name" {
+  description = "The description of the project"
+  type        = string
+  default     = "vault-enos-integration"
 }
 
 variable "tags" {
@@ -93,18 +110,6 @@ variable "terraform_plugin_cache_dir" {
   default     = null
 }
 
-variable "tfc_api_token" {
-  description = "The Terraform Cloud QTI Organization API token. This is used to download the enos Terraform provider."
-  type        = string
-  sensitive   = true
-}
-
-variable "ubuntu_distro_version" {
-  description = "The version of ubuntu to use"
-  type        = string
-  default     = "22.04" // or "20.04", "18.04"
-}
-
 variable "ui_test_filter" {
   type        = string
   description = "A test filter to limit the ui tests to execute. Will be appended to the ember test command as '-f=\"<filter>\"'"
@@ -118,7 +123,7 @@ variable "ui_run_tests" {
 }
 
 variable "vault_artifact_type" {
-  description = "The type of Vault artifact to use when installing Vault from artifactory. It should be 'package' for .deb or # .rpm package and 'bundle' for .zip bundles"
+  description = "The type of Vault artifact to use when installing Vault from artifactory. It should be 'package' for .deb or .rpm package and 'bundle' for .zip bundles"
   default     = "bundle"
 }
 
@@ -176,17 +181,44 @@ variable "vault_product_version" {
   default     = null
 }
 
+variable "vault_radar_license_path" {
+  description = "The license for vault-radar which is used to verify the audit log"
+  type        = string
+  default     = null
+}
+
 variable "vault_revision" {
   description = "The git sha of Vault artifact we are testing"
   type        = string
   default     = null
 }
 
-variable "vault_upgrade_initial_release" {
+variable "vault_upgrade_initial_version" {
   description = "The Vault release to deploy before upgrading"
-  default = {
-    edition = "ce"
-    // Vault 1.10.5 has a known issue with retry_join.
-    version = "1.10.4"
-  }
+  type        = string
+  default     = "1.13.13"
+}
+
+variable "verify_aws_secrets_engine" {
+  description = "If true we'll verify AWS secrets engines behavior. Because of user creation restrictions in Doormat AWS accounts, only turn this on for CI, as it depends on resources that exist only in those accounts"
+  type        = bool
+  default     = false
+}
+
+variable "verify_kmip_secrets_engine" {
+  description = "If true we'll verify KMIP secrets engines behavior"
+  type        = bool
+  default     = false
+}
+
+variable "verify_ldap_secrets_engine" {
+  description = "If true we'll verify LDAP secrets engines behavior"
+  type        = bool
+  default     = false
+}
+
+variable "verify_log_secrets" {
+  description = "If true and var.vault_enable_audit_devices is true we'll verify that the audit log does not contain unencrypted secrets. Requires var.vault_radar_license_path to be set to a valid license file."
+  type        = bool
+  default     = false
 }
diff --git a/enos/enos.vars.hcl b/enos/enos.vars.hcl
index 96e2b3612f7..6ab7b8452ec 100644
--- a/enos/enos.vars.hcl
+++ b/enos/enos.vars.hcl
@@ -1,119 +1,118 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
 
-# artifactory_username is the username to use when testing an artifact stored in artfactory.
-# artifactory_username = "yourname@hashicorp.com"
+// artifactory_token is the token to use when authenticating to artifactory.
+// artifactory_token = "yourtoken"
 
-# artifactory_token is the token to use when authenticating to artifactory.
-# artifactory_token = "yourtoken"
+// artifactory_host is the artifactory host to search for vault artifacts.
+// artifactory_host = "https://artifactory.hashicorp.engineering/artifactory"
 
-# artifactory_host is the artifactory host to search for vault artifacts.
-# artifactory_host = "https://artifactory.hashicorp.engineering/artifactory"
+// artifactory_repo is the artifactory repo to search for vault artifacts.
+// artifactory_repo = "hashicorp-crt-stable-local*"
 
-# artifactory_repo is the artifactory repo to search for vault artifacts.
-# artifactory_repo = "hashicorp-crt-stable-local*"
+// aws_region is the AWS region where we'll create infrastructure
+// for the smoke scenario
+// aws_region = "us-east-1"
 
-# aws_region is the AWS region where we'll create infrastructure
-# for the smoke scenario
-# aws_region = "us-east-1"
+// aws_ssh_keypair_name is the AWS keypair to use for SSH
+// aws_ssh_keypair_name = "enos-ci-ssh-key"
 
-# aws_ssh_keypair_name is the AWS keypair to use for SSH
-# aws_ssh_keypair_name = "enos-ci-ssh-key"
+// aws_ssh_private_key_path is the path to the AWS keypair private key
+// aws_ssh_private_key_path = "./support/private_key.pem"
 
-# aws_ssh_private_key_path is the path to the AWS keypair private key
-# aws_ssh_private_key_path = "./support/private_key.pem"
+// backend_license_path is the license for the backend if applicable (Consul Enterprise)".
+// backend_license_path = "./support/consul.hclic"
 
-# backend_edition is the backend (consul) release edition if applicable to the scenario.
-# backend_edition = "ce"
+// backend_log_level is the server log level for the backend. Supported values include 'trace',
+// 'debug', 'info', 'warn', 'error'"
+// backend_log_level = "trace"
 
-# backend_license_path is the license for the backend if applicable (Consul Enterprise)".
-# backend_license_path = "./support/consul.hclic"
+// backend_instance_type is the instance type to use for the Vault backend. Must support arm64
+// backend_instance_type = "t4g.small"
 
-# backend_log_level is the server log level for the backend. Supported values include 'trace',
-# 'debug', 'info', 'warn', 'error'"
-# backend_log_level = "trace"
+// project_name is the description of the project. It will often be used to tag infrastructure
+// resources.
+// project_name = "vault-enos-integration"
 
-# backend_instance_type is the instance type to use for the Vault backend. Must support arm64
-# backend_instance_type = "t4g.small"
+// distro_version_amzn is the version of Amazon Linux 2 to use for "distro:amzn" variants
+// distro_version_amzn = "2"
 
-# project_name is the description of the project. It will often be used to tag infrastructure
-# resources.
-# project_name = "vault-enos-integration"
+// distro_version_leap is the version of openSUSE Leap to use for "distro:leap" variants
+// distro_version_leap = "15.5"
 
-# rhel_distro_version is the version of RHEL to use for "distro:rhel" variants.
-# rhel_distro_version = "9.1" // or "8.8"
+// distro_version_rhel is the version of RHEL to use for "distro:rhel" variants.
+// distro_version_rhel = "9.3" // or "8.9"
 
-# tags are a map of tags that will be applied to infrastructure resources that
-# support tagging.
-# tags = { "Project Name" : "Vault", "Something Cool" : "Value" }
+// distro_version_sles is the version of SUSE SLES to use for "distro:sles" variants.
+// distro_version_sles = "v15_sp5_standard"
 
-# terraform_plugin_cache_dir is the directory to cache Terraform modules and providers.
-# It must exist.
-# terraform_plugin_cache_dir = "/Users/<user>/.terraform/plugin-cache-dir
+// distro_version_ubuntu is the version of ubuntu to use for "distro:ubuntu" variants
+// distro_version_ubuntu = "22.04" // or "24.04"
 
-# tfc_api_token is the Terraform Cloud QTI Organization API token. We need this
-# to download the enos Terraform provider and the enos Terraform modules.
-# tfc_api_token = "XXXXX.atlasv1.XXXXX..."
+// tags are a map of tags that will be applied to infrastructure resources that
+// support tagging.
+// tags = { "Project Name" : "Vault", "Something Cool" : "Value" }
 
-# ui_test_filter is the test filter to limit the ui tests to execute for the ui scenario. It will
-# be appended to the ember test command as '-f=\"<filter>\"'.
-# ui_test_filter = "sometest"
+// terraform_plugin_cache_dir is the directory to cache Terraform modules and providers.
+// It must exist.
+// terraform_plugin_cache_dir = "/Users/<user>/.terraform/plugin-cache-dir
 
-# ui_run_tests sets whether to run the UI tests or not for the ui scenario. If set to false a
-# cluster will be created but no tests will be run.
-# ui_run_tests = true
+// ui_test_filter is the test filter to limit the ui tests to execute for the ui scenario. It will
+// be appended to the ember test command as '-f=\"<filter>\"'.
+// ui_test_filter = "sometest"
 
-# ubuntu_distro_version is the version of ubuntu to use for "distro:ubuntu" variants
-# ubuntu_distro_version = "22.04" // or "20.04", "18.04"
+// ui_run_tests sets whether to run the UI tests or not for the ui scenario. If set to false a
+// cluster will be created but no tests will be run.
+// ui_run_tests = true
 
-# vault_artifact_path is the path to CRT generated or local vault.zip bundle. When
-# using the "builder:local" variant a bundle will be built from the current branch.
-# In CI it will use the output of the build workflow.
-# vault_artifact_path = "./dist/vault.zip"
+// vault_artifact_path is the path to CRT generated or local vault.zip bundle. When
+// using the "builder:local" variant a bundle will be built from the current branch.
+// In CI it will use the output of the build workflow.
+// vault_artifact_path = "./dist/vault.zip"
 
-# vault_artifact_type is the type of Vault artifact to use when installing Vault from artifactory.
-# It should be 'package' for .deb or # .rpm package and 'bundle' for .zip bundles"
-# vault_artifact_type = "bundle"
+// vault_artifact_type is the type of Vault artifact to use when installing Vault from artifactory.
+// It should be 'package' for .deb or # .rpm package and 'bundle' for .zip bundles"
+// vault_artifact_type = "bundle"
 
-# vault_build_date is the build date for Vault artifact. Some validations will require the binary build
-# date to match"
-# vault_build_date = "2023-07-07T14:06:37Z" // make ci-get-date for example
+// vault_build_date is the build date for Vault artifact. Some validations will require the binary build
+// date to match"
+// vault_build_date = "2023-07-07T14:06:37Z" // make ci-get-date for example
 
-# vault_enable_audit_devices sets whether or not to enable every audit device. It true
-# a file audit device will be enabled at the path /var/log/vault_audit.log, the syslog
-# audit device will be enabled, and a socket audit device connecting to 127.0.0.1:9090
-# will be enabled. The netcat program is run in listening mode to provide an endpoint
-# that the socket audit device can connect to.
-# vault_enable_audit_devices = true
+// vault_enable_audit_devices sets whether or not to enable every audit device. It true
+// a file audit device will be enabled at the path /var/log/vault_audit.log, the syslog
+// audit device will be enabled, and a socket audit device connecting to 127.0.0.1:9090
+// will be enabled. The netcat program is run in listening mode to provide an endpoint
+// that the socket audit device can connect to.
+// vault_enable_audit_devices = true
 
-# vault_install_dir is the directory where the vault binary will be installed on
-# the remote machines.
-# vault_install_dir = "/opt/vault/bin"
+// vault_install_dir is the directory where the vault binary will be installed on
+// the remote machines.
+// vault_install_dir = "/opt/vault/bin"
 
-# vault_local_binary_path is the path of the local binary that we're upgrading to.
-# vault_local_binary_path = "./support/vault"
+// vault_local_binary_path is the path of the local binary that we're upgrading to.
+// vault_local_binary_path = "./support/vault"
 
-# vault_instance_type is the instance type to use for the Vault backend
-# vault_instance_type = "t3.small"
+// vault_instance_type is the instance type to use for the Vault backend
+// vault_instance_type = "t3.small"
 
-# vault_instance_count is how many instances to create for the Vault cluster.
-# vault_instance_count = 3
+// vault_instance_count is how many instances to create for the Vault cluster.
+// vault_instance_count = 3
 
-# vault_license_path is the path to a valid Vault enterprise edition license.
-# This is only required for non-ce editions"
-# vault_license_path = "./support/vault.hclic"
+// vault_license_path is the path to a valid Vault enterprise edition license.
+// This is only required for non-ce editions"
+// vault_license_path = "./support/vault.hclic"
 
-# vault_local_build_tags override the build tags we pass to the Go compiler for builder:local variants.
-# vault_local_build_tags = ["ui", "ent"]
+// vault_local_build_tags override the build tags we pass to the Go compiler for builder:local variants.
+// vault_local_build_tags = ["ui", "ent"]
 
-# vault_log_level is the server log level for Vault logs. Supported values (in order of detail) are
-# trace, debug, info, warn, and err."
-# vault_log_level = "trace"
+// vault_log_level is the server log level for Vault logs. Supported values (in order of detail) are
+// trace, debug, info, warn, and err."
+// vault_log_level = "trace"
 
-# vault_product_version is the version of Vault we are testing. Some validations will expect the vault
-# binary and cluster to report this version.
-# vault_product_version = "1.15.0"
+// vault_product_version is the version of Vault we are testing. Some validations will expect the vault
+// binary and cluster to report this version.
+// vault_product_version = "1.15.0"
 
-# vault_revision is the git sha of Vault artifact we are testing. Some validations will expect the vault
-# binary and cluster to report this revision.
-# vault_revision = "df733361af26f8bb29b63704168bbc5ab8d083de"
+// vault_revision is the git sha of Vault artifact we are testing. Some validations will expect the vault
+// binary and cluster to report this revision.
+// vault_revision = "df733361af26f8bb29b63704168bbc5ab8d083de"
diff --git a/enos/k8s/enos-modules-k8s.hcl b/enos/k8s/enos-modules-k8s.hcl
index 2e815eac62b..5cb6ca1db39 100644
--- a/enos/k8s/enos-modules-k8s.hcl
+++ b/enos/k8s/enos-modules-k8s.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 module "create_kind_cluster" {
@@ -12,39 +12,39 @@ module "load_docker_image" {
 module "k8s_deploy_vault" {
   source = "../modules/k8s_deploy_vault"
 
-  vault_instance_count = var.vault_instance_count
+  vault_instance_count = var.instance_count
 }
 
 module "k8s_verify_build_date" {
   source = "../modules/k8s_vault_verify_build_date"
 
-  vault_instance_count = var.vault_instance_count
+  vault_instance_count = var.instance_count
 }
 
 module "k8s_verify_replication" {
   source = "../modules/k8s_vault_verify_replication"
 
-  vault_instance_count = var.vault_instance_count
+  vault_instance_count = var.instance_count
 }
 
 module "k8s_verify_ui" {
   source = "../modules/k8s_vault_verify_ui"
 
-  vault_instance_count = var.vault_instance_count
+  vault_instance_count = var.instance_count
 }
 
 module "k8s_verify_version" {
   source = "../modules/k8s_vault_verify_version"
 
-  vault_instance_count   = var.vault_instance_count
-  vault_product_version  = var.vault_product_version
-  vault_product_revision = var.vault_product_revision
+  vault_instance_count   = var.instance_count
+  vault_product_version  = var.vault_version
+  vault_product_revision = var.vault_revision
 }
 
 module "k8s_verify_write_data" {
   source = "../modules/k8s_vault_verify_write_data"
 
-  vault_instance_count = var.vault_instance_count
+  vault_instance_count = var.instance_count
 }
 
 module "read_license" {
diff --git a/enos/k8s/enos-providers-k8s.hcl b/enos/k8s/enos-providers-k8s.hcl
index e11092c22c5..48ea5d826d9 100644
--- a/enos/k8s/enos-providers-k8s.hcl
+++ b/enos/k8s/enos-providers-k8s.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 provider "enos" "default" {}
diff --git a/enos/k8s/enos-qualities.hcl b/enos/k8s/enos-qualities.hcl
new file mode 100644
index 00000000000..5edec94c7bb
--- /dev/null
+++ b/enos/k8s/enos-qualities.hcl
@@ -0,0 +1,14 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+quality "vault_artifact_container_alpine" {
+  description = "The candidate binary packaged as an Alpine package is used for testing"
+}
+
+quality "vault_artifact_container_ubi" {
+  description = "The candidate binary packaged as an UBI package is used for testing"
+}
+
+quality "vault_artifact_container_tags" {
+  description = "The candidate binary has the expected tags"
+}
diff --git a/enos/k8s/enos-samples-ce.hcl b/enos/k8s/enos-samples-ce.hcl
new file mode 100644
index 00000000000..5752ca921ed
--- /dev/null
+++ b/enos/k8s/enos-samples-ce.hcl
@@ -0,0 +1,38 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+sample "ce_default_linux_amd64_ent_docker" {
+  subset "k8s" {
+    matrix {
+      repo    = ["docker", "ecr"]
+      edition = ["ce"]
+    }
+  }
+}
+
+sample "ce_default_linux_arm64_ce_docker" {
+  subset "k8s" {
+    matrix {
+      repo    = ["docker", "ecr"]
+      edition = ["ce"]
+    }
+  }
+}
+
+sample "ce_ubi_linux_amd64_ce_redhat" {
+  subset "k8s" {
+    matrix {
+      repo    = ["quay"]
+      edition = ["ce"]
+    }
+  }
+}
+
+sample "ce_ubi_linux_arm64_ce_redhat" {
+  subset "k8s" {
+    matrix {
+      repo    = ["quay"]
+      edition = ["ce"]
+    }
+  }
+}
diff --git a/enos/k8s/enos-scenario-k8s.hcl b/enos/k8s/enos-scenario-k8s.hcl
index e40c1870598..e639d262b1d 100644
--- a/enos/k8s/enos-scenario-k8s.hcl
+++ b/enos/k8s/enos-scenario-k8s.hcl
@@ -1,9 +1,18 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 scenario "k8s" {
+  description = <<-EOF
+    The k8s scenario verifies Vault when running in Kubernetes mode. The build can be a container
+    in a remote repository or a local container archive tarball.
+
+    The scenario creates a new kind kubernetes cluster in Docker and creates a Vault Cluster using
+    the candidate artifact and verifies behavior against the Vault cluster.
+  EOF
+
   matrix {
-    edition = ["ce", "ent"]
+    edition = ["ce", "ent", "ent.fips1403", "ent.hsm", "ent.hsm.fips1403"]
+    repo    = ["docker", "ecr", "quay"]
   }
 
   terraform_cli = terraform_cli.default
@@ -15,15 +24,106 @@ scenario "k8s" {
   ]
 
   locals {
-    image_path = abspath(var.vault_docker_image_archive)
-
-    image_repo = var.vault_image_repository != null ? var.vault_image_repository : matrix.edition == "ce" ? "hashicorp/vault" : "hashicorp/vault-enterprise"
-    image_tag  = replace(var.vault_product_version, "+ent", "-ent")
-
+    // For now this works as the vault_version includes metadata. If we ever get to the point that
+    // vault_version excludes metadata we'll have to include the matrix.edition here as well.
+    tag_version     = replace(var.vault_version, "+ent", "-ent")
+    tag_version_ubi = "${local.tag_version}-ubi"
+    // When we load candidate images into our k8s cluster we verify that the archives embedded
+    // repository and tag match our expectations. This is the source of truth for what we _expect_
+    // various artifacts to have. The source of truth for what we use when building is defined in
+    // .github/actions/containerize. If you are modifying these expectations you likely need to
+    // modify the source of truth there.
+    repo_metadata = {
+      "ce" = {
+        docker = {
+          // https://hub.docker.com/r/hashicorp/vault
+          repo = "hashicorp/vault"
+          tag  = local.tag_version
+        }
+        ecr = {
+          // https://gallery.ecr.aws/hashicorp/vault
+          repo = "public.ecr.aws/hashicorp/vault"
+          tag  = local.tag_version
+        }
+        quay = {
+          // https://catalog.redhat.com/software/containers/hashicorp/vault/5fda55bd2937386820429e0c
+          repo = "quay.io/redhat-isv-containers/5f89bb5e0b94cf64cfeb500a"
+          tag  = local.tag_version_ubi
+        }
+      },
+      "ent" = {
+        docker = {
+          // https://hub.docker.com/r/hashicorp/vault-enterprise
+          repo = "hashicorp/vault-enterprise"
+          tag  = local.tag_version
+        }
+        ecr = {
+          // https://gallery.ecr.aws/hashicorp/vault-enterprise
+          repo = "public.ecr.aws/hashicorp/vault-enterprise"
+          tag  = local.tag_version
+        }
+        quay = {
+          // https://catalog.redhat.com/software/containers/hashicorp/vault-enterprise/5fda5633ac3db90370a26443
+          repo = "quay.io/redhat-isv-containers/5f89bb9242e382c85087dce2"
+          tag  = local.tag_version_ubi
+        }
+      },
+      "ent.fips1403" = {
+        docker = {
+          // https://hub.docker.com/r/hashicorp/vault-enterprise-fips
+          repo = "hashicorp/vault-enterprise-fips"
+          tag  = local.tag_version
+        }
+        ecr = {
+          // https://gallery.ecr.aws/hashicorp/vault-enterprise-fips
+          repo = "public.ecr.aws/hashicorp/vault-enterprise-fips"
+          tag  = local.tag_version
+        }
+        quay = {
+          // https://catalog.redhat.com/software/containers/hashicorp/vault-enterprise-fips/628d50e37ff70c66a88517ea
+          repo = "quay.io/redhat-isv-containers/6283f645d02c6b16d9caeb8e"
+          tag  = local.tag_version_ubi
+        }
+      },
+      "ent.hsm" = {
+        docker = {
+          // https://hub.docker.com/r/hashicorp/vault-enterprise
+          repo = "hashicorp/vault-enterprise"
+          tag  = local.tag_version
+        }
+        ecr = {
+          // https://gallery.ecr.aws/hashicorp/vault-enterprise
+          repo = "public.ecr.aws/hashicorp/vault-enterprise"
+          tag  = local.tag_version
+        }
+        quay = {
+          // https://catalog.redhat.com/software/containers/hashicorp/vault-enterprise/5fda5633ac3db90370a26443
+          repo = "quay.io/redhat-isv-containers/5f89bb9242e382c85087dce2"
+          tag  = local.tag_version_ubi
+        }
+      },
+      "ent.hsm.fips1403" = {
+        docker = {
+          // https://hub.docker.com/r/hashicorp/vault-enterprise
+          repo = "hashicorp/vault-enterprise"
+          tag  = local.tag_version
+        }
+        ecr = {
+          // https://gallery.ecr.aws/hashicorp/vault-enterprise
+          repo = "public.ecr.aws/hashicorp/vault-enterprise"
+          tag  = local.tag_version
+        }
+        quay = {
+          // https://catalog.redhat.com/software/containers/hashicorp/vault-enterprise/5fda5633ac3db90370a26443
+          repo = "quay.io/redhat-isv-containers/5f89bb9242e382c85087dce2"
+          tag  = local.tag_version_ubi
+        }
+      },
+    }
     // The additional '-0' is required in the constraint since without it, the semver function will
     // only compare the non-pre-release parts (Major.Minor.Patch) of the version and the constraint,
     // which can lead to unexpected results.
-    version_includes_build_date = semverconstraint(var.vault_product_version, ">=1.11.0-0")
+    version_includes_build_date = semverconstraint(var.vault_version, ">=1.11.0-0")
   }
 
   step "read_license" {
@@ -44,20 +144,34 @@ scenario "k8s" {
   }
 
   step "load_docker_image" {
-    module = module.load_docker_image
+    description = <<-EOF
+      Load an verify the tags of a Vault container image into the kind k8s cluster. If no
+      var.container_image_archive has been set it will attempt to load an image matching the
+      var.vault_version from the matrix.repo.
+    EOF
+    module      = module.load_docker_image
+    depends_on  = [step.create_kind_cluster]
+
+    verifies = [
+      quality.vault_artifact_container_alpine,
+      quality.vault_artifact_container_ubi,
+      quality.vault_artifact_container_tags,
+    ]
 
     variables {
       cluster_name = step.create_kind_cluster.cluster_name
-      image        = local.image_repo
-      tag          = local.image_tag
-      archive      = var.vault_docker_image_archive
+      image        = local.repo_metadata[matrix.edition][matrix.repo].repo
+      tag          = local.repo_metadata[matrix.edition][matrix.repo].tag
+      archive      = var.container_image_archive
     }
-
-    depends_on = [step.create_kind_cluster]
   }
 
   step "deploy_vault" {
     module = module.k8s_deploy_vault
+    depends_on = [
+      step.load_docker_image,
+      step.create_kind_cluster,
+    ]
 
     variables {
       image_tag         = step.load_docker_image.tag
@@ -65,55 +179,26 @@ scenario "k8s" {
       image_repository  = step.load_docker_image.repository
       kubeconfig_base64 = step.create_kind_cluster.kubeconfig_base64
       vault_edition     = matrix.edition
-      vault_log_level   = var.vault_log_level
+      vault_log_level   = var.log_level
       ent_license       = matrix.edition != "ce" ? step.read_license.license : null
     }
-
-    depends_on = [step.load_docker_image, step.create_kind_cluster]
-  }
-
-  step "verify_build_date" {
-    skip_step = !local.version_includes_build_date
-    module    = module.k8s_verify_build_date
-
-    variables {
-      vault_pods        = step.deploy_vault.vault_pods
-      vault_root_token  = step.deploy_vault.vault_root_token
-      kubeconfig_base64 = step.create_kind_cluster.kubeconfig_base64
-      context_name      = step.create_kind_cluster.context_name
-    }
-
-    depends_on = [step.deploy_vault]
   }
 
   step "verify_replication" {
-    module = module.k8s_verify_replication
-
-    variables {
-      vault_pods        = step.deploy_vault.vault_pods
-      vault_edition     = matrix.edition
-      kubeconfig_base64 = step.create_kind_cluster.kubeconfig_base64
-      context_name      = step.create_kind_cluster.context_name
-    }
-
+    module     = module.k8s_verify_replication
     depends_on = [step.deploy_vault]
-  }
-
-  step "verify_ui" {
-    module    = module.k8s_verify_ui
-    skip_step = matrix.edition == "ce"
 
     variables {
       vault_pods        = step.deploy_vault.vault_pods
+      vault_edition     = matrix.edition
       kubeconfig_base64 = step.create_kind_cluster.kubeconfig_base64
       context_name      = step.create_kind_cluster.context_name
     }
-
-    depends_on = [step.deploy_vault]
   }
 
   step "verify_version" {
-    module = module.k8s_verify_version
+    module     = module.k8s_verify_version
+    depends_on = [step.deploy_vault]
 
     variables {
       vault_pods        = step.deploy_vault.vault_pods
@@ -124,12 +209,11 @@ scenario "k8s" {
       check_build_date  = local.version_includes_build_date
       vault_build_date  = var.vault_build_date
     }
-
-    depends_on = [step.deploy_vault]
   }
 
   step "verify_write_data" {
-    module = module.k8s_verify_write_data
+    module     = module.k8s_verify_write_data
+    depends_on = [step.deploy_vault]
 
     variables {
       vault_pods        = step.deploy_vault.vault_pods
@@ -137,7 +221,5 @@ scenario "k8s" {
       kubeconfig_base64 = step.create_kind_cluster.kubeconfig_base64
       context_name      = step.create_kind_cluster.context_name
     }
-
-    depends_on = [step.deploy_vault]
   }
 }
diff --git a/enos/k8s/enos-terraform-k8s.hcl b/enos/k8s/enos-terraform-k8s.hcl
index a38b1b64874..5a4848dff87 100644
--- a/enos/k8s/enos-terraform-k8s.hcl
+++ b/enos/k8s/enos-terraform-k8s.hcl
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform "k8s" {
@@ -6,7 +6,7 @@ terraform "k8s" {
 
   required_providers {
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
 
     helm = {
@@ -17,8 +17,4 @@ terraform "k8s" {
 
 terraform_cli "default" {
   plugin_cache_dir = var.terraform_plugin_cache_dir != null ? abspath(var.terraform_plugin_cache_dir) : null
-
-  credentials "app.terraform.io" {
-    token = var.tfc_api_token
-  }
 }
diff --git a/enos/k8s/enos-variables-k8s.hcl b/enos/k8s/enos-variables-k8s.hcl
index e962ff7e2e7..164da9e6821 100644
--- a/enos/k8s/enos-variables-k8s.hcl
+++ b/enos/k8s/enos-variables-k8s.hcl
@@ -1,37 +1,19 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-variable "vault_image_repository" {
-  description = "The repository for the docker image to load, i.e. hashicorp/vault"
+variable "container_image_archive" {
+  description = "The path to the location of the container image archive to test"
   type        = string
-  default     = null
+  default     = null # If none is given we'll simply load a container from a repo
 }
 
-variable "vault_log_level" {
+variable "log_level" {
   description = "The server log level for Vault logs. Supported values (in order of detail) are trace, debug, info, warn, and err."
   type        = string
-  default     = "info"
-}
-
-variable "vault_product_version" {
-  description = "The vault product version to test"
-  type        = string
-  default     = null
-}
-
-variable "vault_product_revision" {
-  type        = string
-  description = "The vault product revision to test"
-  default     = null
-}
-
-variable "vault_docker_image_archive" {
-  description = "The path to the location of the docker image archive to test"
-  type        = string
-  default     = null
+  default     = "trace"
 }
 
-variable "vault_instance_count" {
+variable "instance_count" {
   description = "How many instances to create for the Vault cluster"
   type        = number
   default     = 3
@@ -43,13 +25,20 @@ variable "terraform_plugin_cache_dir" {
   default     = null
 }
 
-variable "tfc_api_token" {
-  description = "The Terraform Cloud QTI Organization API token."
+variable "vault_build_date" {
+  description = "The expected vault build date"
+  type        = string
+  default     = ""
+}
+
+variable "vault_revision" {
   type        = string
+  description = "The expected vault revision"
+  default     = "ce"
 }
 
-variable "vault_build_date" {
-  description = "The build date for the vault docker image"
+variable "vault_version" {
+  description = "The expected vault version"
   type        = string
-  default     = ""
+  default     = "1.18.0"
 }
diff --git a/enos/modules/artifact/metadata/main.tf b/enos/modules/artifact/metadata/main.tf
new file mode 100644
index 00000000000..7ca4870f8d8
--- /dev/null
+++ b/enos/modules/artifact/metadata/main.tf
@@ -0,0 +1,229 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+// Given the architecture, distro, version, edition, and desired package type,
+// return the metadata for an artifact.
+
+variable "arch" {
+  description = "The artifact platform architecture"
+  type        = string
+
+  validation {
+    condition     = contains(["amd64", "arm64", "s390x"], var.arch)
+    error_message = <<-EOF
+      distro must be one of "amd64", "arm64", "s390x"
+    EOF
+  }
+}
+
+variable "distro" {
+  description = "The target operating system distro"
+  type        = string
+
+  validation {
+    condition     = contains(["amzn", "leap", "rhel", "sles", "ubuntu"], var.distro)
+    error_message = <<-EOF
+      distro must be one of "amzn", "leap", "rhel", "sles", "ubuntu"
+    EOF
+  }
+}
+
+variable "edition" {
+  description = "The Vault edition. E.g. ent or ent.hsm.fips1403"
+  type        = string
+
+  validation {
+    condition     = contains(["oss", "ce", "ent", "ent.fips1402", "ent.fips1403", "ent.hsm", "ent.hsm.fips1402", "ent.hsm.fips1403"], var.edition)
+    error_message = <<-EOF
+      edition must be one of "oss", "ce", "ent", "ent.fips1402", "ent.fips1403", "ent.hsm", "ent.hsm.fips1402", "ent.hsm.fips1403"
+    EOF
+  }
+}
+
+variable "package_type" {
+  description = "The artifact packaging type"
+  type        = string
+
+  validation {
+    condition     = contains(["package", "rpm", "deb", "zip", "bundle"], var.package_type)
+    error_message = <<-EOF
+      package_type must be one of "package", "rpm", "deb", "zip", "bundle"
+    EOF
+  }
+}
+
+variable "vault_version" {
+  description = "The version of Vault or Vault Enterprise. E.g 1.18.2, 1.19.0-rc1, 1.18.5+ent.hsm"
+  type        = string
+}
+
+locals {
+  package_extension_amd64_deb = "-1_amd64.deb"
+  package_extension_amd64_rpm = "-1.x86_64.rpm"
+  package_extension_arm64_deb = "-1_arm64.deb"
+  package_extension_arm64_rpm = "-1.aarch64.rpm"
+  package_extension_s390x_deb = "-1_s390x.deb"
+  package_extension_s390x_rpm = "-1.s390x.rpm"
+
+  // file name extensions for the install packages of vault for the various architectures, distributions and editions
+  package_extensions = {
+    amd64 = {
+      amzn   = local.package_extension_amd64_rpm
+      leap   = local.package_extension_amd64_rpm
+      rhel   = local.package_extension_amd64_rpm
+      sles   = local.package_extension_amd64_rpm
+      ubuntu = local.package_extension_amd64_deb
+    }
+    arm64 = {
+      amzn   = local.package_extension_arm64_rpm
+      leap   = local.package_extension_arm64_rpm
+      rhel   = local.package_extension_arm64_rpm
+      sles   = local.package_extension_arm64_rpm
+      ubuntu = local.package_extension_arm64_deb
+    }
+    s390x = {
+      amzn   = null
+      leap   = local.package_extension_s390x_rpm
+      rhel   = local.package_extension_s390x_rpm
+      sles   = local.package_extension_s390x_rpm
+      ubuntu = local.package_extension_s390x_deb
+    }
+  }
+
+  package_prefixes_rpm = {
+    "ce"               = "vault-"
+    "ent"              = "vault-enterprise-",
+    "ent.fips1402"     = "vault-enterprise-fips1402-",
+    "ent.fips1403"     = "vault-enterprise-fips1403-",
+    "ent.hsm"          = "vault-enterprise-hsm-",
+    "ent.hsm.fips1402" = "vault-enterprise-hsm-fips1402-",
+    "ent.hsm.fips1403" = "vault-enterprise-hsm-fips1403-",
+    "oss"              = "vault-"
+  }
+
+  package_prefixes_deb = {
+    "ce"               = "vault_"
+    "ent"              = "vault-enterprise_",
+    "ent.fips1402"     = "vault-enterprise-fips1402_",
+    "ent.fips1403"     = "vault-enterprise-fips1403_",
+    "ent.hsm"          = "vault-enterprise-hsm_",
+    "ent.hsm.fips1402" = "vault-enterprise-hsm-fips1402_",
+    "ent.hsm.fips1403" = "vault-enterprise-hsm-fips1403_",
+    "oss"              = "vault_"
+  }
+
+  // file name prefixes for the install packages of vault for the various distributions and artifact types (package or bundle)
+  package_prefixes = {
+    amzn   = local.package_prefixes_rpm,
+    leap   = local.package_prefixes_rpm,
+    rhel   = local.package_prefixes_rpm,
+    sles   = local.package_prefixes_rpm,
+    ubuntu = local.package_prefixes_deb,
+  }
+
+  // Stable release Artifactory repos for packages
+  release_repo_rpm = "hashicorp-rpm-release-local*"
+  release_repo_apt = "hashicorp-apt-release-local*"
+  release_repos = {
+    amzn   = local.release_repo_rpm
+    leap   = local.release_repo_rpm
+    rhel   = local.release_repo_rpm
+    sles   = local.release_repo_rpm
+    ubuntu = local.release_repo_apt
+  }
+  release_repo = local.release_repos[var.distro]
+
+  // Stable release Artifactory paths for packages
+  release_package_rpm_arch = {
+    "amd64" = "x86_64",
+    "arm64" = "aarch64",
+    "s390x" = "s390x",
+  }
+  release_path_deb     = "pool/${var.arch}/main"
+  release_sub_path_rpm = "${local.release_package_rpm_arch[var.arch]}/stable"
+  release_path_distro = {
+    amzn = {
+      "2"      = "AmazonLinux/2/${local.release_sub_path_rpm}"
+      "2023"   = "AmazonLinux/latest/${local.release_sub_path_rpm}"
+      "latest" = "AmazonLinux/latest/${local.release_sub_path_rpm}"
+    }
+    leap = {
+      "15.6" = "RHEL/9/${local.release_sub_path_rpm}"
+    }
+    rhel = {
+      "8.10" = "RHEL/8/${local.release_sub_path_rpm}"
+      "9.6"  = "RHEL/9/${local.release_sub_path_rpm}"
+      "10.0" = "RHEL/10/${local.release_sub_path_rpm}"
+    }
+    sles = {
+      "15.6" = "RHEL/9/${local.release_sub_path_rpm}"
+    }
+    ubuntu = {
+      "22.04" = local.release_path_deb,
+      "24.04" = local.release_path_deb,
+    }
+  }
+  release_paths = local.release_path_distro[var.distro]
+
+  // Reduce our supported inputs into two classes: system packages or a binary bundled into a zip archive.
+  package_type = contains(["package", "deb", "rpm"], var.package_type) ? "package" : "bundle"
+
+  // Get the base version. This might still include pre-release metadata
+  // E.g. 1.18.2 => 1.18.2, 1.18.0-rc1 => 1.18.0-rc1, 1.18.0+ent.hsm => 1.18.0
+  semverish_version = try(split("+", var.vault_version)[0], var.vault_version)
+
+  // Determine the "product name". This corresponds properties on the artifactory artifact.
+  product_name = strcontains(var.edition, "ent") ? "vault-enterprise" : "vault"
+
+  // Create the "product version", which is corresponds to properties on the artifactory artifact.
+  // It's the version along with edition metadata. We normalize all enterprise editions to .ent.
+  // E.g. 1.16.0-beta1+ent.hsm.fips1403 -> 1.16.0-beta+ent
+  product_version = strcontains(var.edition, "ent") ? "${local.semverish_version}+ent" : local.semverish_version
+
+  // Convert product version strings to a syntax that matches deb and rpm packaging.
+  // E.g. 1.16.0-beta+ent -> 1.16.0~beta+ent
+  package_version = replace(local.product_version, "-", "~")
+
+  // Get the bundle version. If the vault_version includes metadata, use it. Otherwise add the edition to it.
+  bundle_version = strcontains(var.vault_version, "+") ? var.vault_version : strcontains(var.edition, "ent") ? "${var.vault_version}+${var.edition}" : var.vault_version
+
+  // Prefix for the artifact name. E.g.: vault_, vault-, vault-enterprise_, vault-enterprise-hsm-fips1402-, etc
+  artifact_name_prefix = local.package_type == "package" ? local.package_prefixes[var.distro][var.edition] : "vault_"
+
+  // The version for the artifact name.
+  artifact_version = local.package_type == "package" ? local.package_version : local.bundle_version
+
+  // Suffix and extension for the artifact name. E.g.: _linux_<arch>.zip,
+  artifact_name_extension = local.package_type == "package" ? local.package_extensions[var.arch][var.distro] : "_linux_${var.arch}.zip"
+
+  // Combine prefix/suffix/extension together to form the artifact name
+  artifact_name = "${local.artifact_name_prefix}${local.artifact_version}${local.artifact_name_extension}"
+
+}
+output "artifact_name" {
+  value = local.artifact_name
+}
+
+output "package_type" {
+  value = local.package_type
+}
+
+output "package_version" {
+  value = local.package_version
+}
+
+output "product_name" {
+  value = local.product_name
+}
+
+output "product_version" {
+  value = local.product_version
+}
+
+output "release_repo" {
+  value = local.release_repo
+}
+
+output "release_paths" {
+  value = local.release_paths
+}
diff --git a/enos/modules/autopilot_upgrade_storageconfig/main.tf b/enos/modules/autopilot_upgrade_storageconfig/main.tf
index 3fcb77a7067..40d7c1fba46 100644
--- a/enos/modules/autopilot_upgrade_storageconfig/main.tf
+++ b/enos/modules/autopilot_upgrade_storageconfig/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "vault_product_version" {}
diff --git a/enos/modules/backend_consul/main.tf b/enos/modules/backend_consul/main.tf
index 75b4169161c..41ad42e085e 100644
--- a/enos/modules/backend_consul/main.tf
+++ b/enos/modules/backend_consul/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -6,7 +6,7 @@ terraform {
 
   required_providers {
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.4.4"
     }
   }
@@ -17,7 +17,7 @@ locals {
 }
 
 resource "enos_bundle_install" "consul" {
-  for_each = var.target_hosts
+  for_each = var.hosts
 
   destination = var.install_dir
   release     = merge(var.release, { product = "consul" })
@@ -40,7 +40,7 @@ resource "enos_consul_start" "consul" {
     datacenter       = "dc1"
     retry_join       = ["provider=aws tag_key=${var.cluster_tag_key} tag_value=${var.cluster_name}"]
     server           = true
-    bootstrap_expect = length(var.target_hosts)
+    bootstrap_expect = length(var.hosts)
     log_level        = var.log_level
     log_file         = var.log_dir
   }
@@ -50,7 +50,7 @@ resource "enos_consul_start" "consul" {
 
   transport = {
     ssh = {
-      host = var.target_hosts[each.key].public_ip
+      host = var.hosts[each.key].public_ip
     }
   }
 }
diff --git a/enos/modules/backend_consul/outputs.tf b/enos/modules/backend_consul/outputs.tf
index 8f32783e8de..56dc751a8af 100644
--- a/enos/modules/backend_consul/outputs.tf
+++ b/enos/modules/backend_consul/outputs.tf
@@ -1,18 +1,18 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 output "private_ips" {
   description = "Consul cluster target host private_ips"
-  value       = [for host in var.target_hosts : host.private_ip]
+  value       = [for host in var.hosts : host.private_ip]
 }
 
 output "public_ips" {
   description = "Consul cluster target host public_ips"
-  value       = [for host in var.target_hosts : host.public_ip]
+  value       = [for host in var.hosts : host.public_ip]
 }
 
-output "target_hosts" {
+output "hosts" {
   description = "The Consul cluster instances that were created"
 
-  value = var.target_hosts
+  value = var.hosts
 }
diff --git a/enos/modules/backend_consul/variables.tf b/enos/modules/backend_consul/variables.tf
index 34a96d8535f..10029e459e5 100644
--- a/enos/modules/backend_consul/variables.tf
+++ b/enos/modules/backend_consul/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "cluster_name" {
@@ -25,6 +25,15 @@ variable "data_dir" {
   default     = "/opt/consul/data"
 }
 
+variable "hosts" {
+  description = "The target machines host addresses to use for the consul cluster"
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+}
+
 variable "install_dir" {
   type        = string
   description = "The directory where the consul binary will be installed"
@@ -66,11 +75,3 @@ variable "release" {
     edition = "ce"
   }
 }
-
-variable "target_hosts" {
-  description = "The target machines host addresses to use for the consul cluster"
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-}
diff --git a/enos/modules/backend_raft/main.tf b/enos/modules/backend_raft/main.tf
index eba84003cd8..e1b8d5ac92b 100644
--- a/enos/modules/backend_raft/main.tf
+++ b/enos/modules/backend_raft/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 // Shim module to handle the fact that Vault doesn't actually need a backend module when we use raft.
@@ -7,7 +7,7 @@ terraform {
 
   required_providers {
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.4.0"
     }
   }
@@ -53,18 +53,18 @@ variable "release" {
   default = null
 }
 
-variable "target_hosts" {
+variable "hosts" {
   default = null
 }
 
 output "private_ips" {
-  value = [for host in var.target_hosts : host.private_ip]
+  value = [for host in var.hosts : host.private_ip]
 }
 
 output "public_ips" {
-  value = [for host in var.target_hosts : host.public_ip]
+  value = [for host in var.hosts : host.public_ip]
 }
 
-output "target_hosts" {
-  value = var.target_hosts
+output "hosts" {
+  value = var.hosts
 }
diff --git a/enos/modules/benchmark/README.md b/enos/modules/benchmark/README.md
new file mode 100644
index 00000000000..458aca0caa7
--- /dev/null
+++ b/enos/modules/benchmark/README.md
@@ -0,0 +1,11 @@
+# Benchmark modules
+
+These benchmark modules are designed to benchmark a Vault cluster using either
+raft storage or an external Consul cluster for storage. It supports creating
+an external telemetry collector using a combination of Prometheus and Grafana
+and supports collecting Vault, Consul, and node metrics.
+
+When using this module in your scenario there are a few things to consider:
+  - There are currently assumptions that Ubuntu 22.04 is the target runner for
+    the k6 runner instance.
+  - The Vault and Consul clusters are assumed to be three node clusters.
diff --git a/enos/modules/benchmark/config/main.tf b/enos/modules/benchmark/config/main.tf
new file mode 100644
index 00000000000..4a37a278a9e
--- /dev/null
+++ b/enos/modules/benchmark/config/main.tf
@@ -0,0 +1,171 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+variable "consul_node_instance_types" {
+  description = "The instance types to use depending on architecture"
+  type = object({
+    amd64 = string
+    arm64 = string
+  })
+  default = {
+    amd64 = "i3.4xlarge"
+    arm64 = "t4g.small"
+  }
+}
+
+variable "grafana_version" {
+  type    = string
+  default = "11.6.0"
+}
+
+variable "k6_instance_types" {
+  description = "The instance types to use depending on architecture"
+  type = object({
+    amd64 = string
+    arm64 = string
+  })
+  default = {
+    amd64 = "c5d.4xlarge"
+    arm64 = "t4g.small" # not actually used right now
+  }
+}
+
+variable "metrics_instance_types" {
+  description = "The instance types to use depending on architecture"
+  type = object({
+    amd64 = string
+    arm64 = string
+  })
+  default = {
+    amd64 = "m4.large"
+    arm64 = "t4g.small" # not actually used right now
+  }
+}
+
+variable "ports_ingress" {
+  description = "Additional port mappings to allow for ingress"
+  type = list(object({
+    description = string
+    port        = number
+    protocol    = string
+  }))
+}
+
+variable "prometheus_node_exporter_version" {
+  type    = string
+  default = "1.9.1"
+}
+
+variable "prometheus_version" {
+  type    = string
+  default = "3.3.0"
+}
+
+variable "storage_disk_iops" {
+  description = <<-EOF
+    The IOPS to request for storage disk. AWS accounts have a 100,000 IOPS limit
+    by default so our default limit is 16,000. Some scenarios (backend:raft) can
+    be configured to use the 24,000 maximum without requests. If you wish to
+    test the backend:consul scenarios at the maximum you'll need to request
+    a limit increase for your account.
+  EOF
+  type        = number
+  default     = 16000
+}
+
+variable "vault_node_instance_types" {
+  description = "The instance types to use depending on architecture"
+  type = object({
+    amd64 = string
+    arm64 = string
+  })
+  default = {
+    amd64 = "i3.4xlarge"
+    arm64 = "t4g.small"
+  }
+}
+
+locals {
+  consul_http_port                 = 8500
+  grafana_http_port                = 3000
+  grafana_version                  = var.grafana_version
+  prometheus_exporter_port         = 9100
+  prometheus_http_port             = 9090
+  prometheus_node_exporter_version = var.prometheus_node_exporter_version
+  prometheus_version               = var.prometheus_version
+  benchmark_ports = [
+    {
+      description = "CONSUL_HTTP"
+      port        = local.consul_http_port
+      protocol    = "tcp"
+    },
+    {
+      description = "GRAFANA_HTTP"
+      port        = local.grafana_http_port
+      protocol    = "tcp"
+    },
+    {
+      description = "PROMETHEUS_EXPORTER"
+      port        = local.prometheus_exporter_port
+      protocol    = "tcp"
+    },
+    {
+      description = "PROMETHEUS_HTTP"
+      port        = local.prometheus_http_port
+      protocol    = "tcp"
+    },
+  ]
+  required_ports = concat(var.ports_ingress, local.benchmark_ports)
+}
+
+output "consul_http_port" {
+  value = local.consul_http_port
+}
+
+output "consul_instance_types" {
+  value = var.consul_node_instance_types
+}
+
+output "grafana_http_port" {
+  value = local.grafana_http_port
+}
+
+output "grafana_version" {
+  value = local.grafana_version
+}
+
+output "k6_instance_types" {
+  value = var.k6_instance_types
+}
+
+output "metrics_instance_types" {
+  value = var.metrics_instance_types
+}
+
+output "prometheus_exporter_port" {
+  value = local.prometheus_exporter_port
+}
+
+output "prometheus_http_port" {
+  value = local.prometheus_http_port
+}
+
+output "prometheus_node_exporter_version" {
+  value = local.prometheus_node_exporter_version
+}
+
+output "prometheus_version" {
+  value = local.prometheus_version
+}
+
+output "required_ports" {
+  value = local.required_ports
+}
+
+output "storage_disk_iops" {
+  value = var.storage_disk_iops
+}
+
+output "vault_node_instance_types" {
+  value = var.vault_node_instance_types
+}
diff --git a/enos/modules/benchmark/enable_telemetry_consul/main.tf b/enos/modules/benchmark/enable_telemetry_consul/main.tf
new file mode 100644
index 00000000000..67c77009d05
--- /dev/null
+++ b/enos/modules/benchmark/enable_telemetry_consul/main.tf
@@ -0,0 +1,38 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The consul hosts backing the vault cluster instances"
+}
+
+
+resource "enos_remote_exec" "add_telemetry_to_consul" {
+  for_each = var.hosts
+
+  scripts = [abspath("${path.module}/scripts/add-consul-telemetry.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+module "restart_consul_nodes" {
+  depends_on = [enos_remote_exec.add_telemetry_to_consul]
+  source     = "../../restart_consul"
+  hosts      = var.hosts
+}
diff --git a/enos/modules/benchmark/enable_telemetry_consul/scripts/add-consul-telemetry.sh b/enos/modules/benchmark/enable_telemetry_consul/scripts/add-consul-telemetry.sh
new file mode 100755
index 00000000000..fef0e16d90e
--- /dev/null
+++ b/enos/modules/benchmark/enable_telemetry_consul/scripts/add-consul-telemetry.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+sudo sed -i '$a client_addr = "0.0.0.0"\n' /etc/consul.d/consul.hcl
+sudo sed -i '$a telemetry {\n  prometheus_retention_time = "24h"\n  disable_hostname = true\n}' /etc/consul.d/consul.hcl
diff --git a/enos/modules/benchmark/enable_telemetry_node_exporter/main.tf b/enos/modules/benchmark/enable_telemetry_node_exporter/main.tf
new file mode 100644
index 00000000000..6353c6b16c3
--- /dev/null
+++ b/enos/modules/benchmark/enable_telemetry_node_exporter/main.tf
@@ -0,0 +1,70 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The hosts on which to install and enable host metrics"
+}
+
+variable "prometheus_node_exporter_version" {
+  type = string
+}
+
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
+variable "timeout" {
+  type        = number
+  description = "The max number of seconds to wait before timing out. This is applied to each step so total timeout will be longer."
+  default     = 120
+}
+
+resource "enos_remote_exec" "install_prometheus_node_exporter" {
+  for_each = var.hosts
+
+  environment = {
+    PROMETHEUS_NODE_EXPORTER_VERSION = var.prometheus_node_exporter_version
+    RETRY_INTERVAL                   = var.retry_interval
+    TIMEOUT_SECONDS                  = var.timeout
+  }
+  scripts = [abspath("${path.module}/scripts/install-prometheus-node-exporter.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "run_prometheus_node_exporter" {
+  depends_on = [
+    enos_remote_exec.install_prometheus_node_exporter,
+  ]
+  for_each = var.hosts
+
+  environment = {
+    PROMETHEUS_NODE_EXPORTER_VERSION = var.prometheus_node_exporter_version
+  }
+  scripts = [abspath("${path.module}/scripts/run-prometheus-node-exporter.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/benchmark/enable_telemetry_node_exporter/scripts/install-prometheus-node-exporter.sh b/enos/modules/benchmark/enable_telemetry_node_exporter/scripts/install-prometheus-node-exporter.sh
new file mode 100644
index 00000000000..9c2cb6a9f02
--- /dev/null
+++ b/enos/modules/benchmark/enable_telemetry_node_exporter/scripts/install-prometheus-node-exporter.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+logger() {
+  DT=$(date '+%Y/%m/%d %H:%M:%S')
+  echo "$DT $0: $1"
+}
+
+[[ -z "${PROMETHEUS_NODE_EXPORTER_VERSION}" ]] && fail "PROMETHEUS_NODE_EXPORTER_VERSION env variable has not been set"
+[[ -z "${RETRY_INTERVAL}" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "${TIMEOUT_SECONDS}" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+
+install_prometheus_node_exporter() {
+  file_name="node_exporter-${PROMETHEUS_NODE_EXPORTER_VERSION}.linux-amd64.tar.gz"
+  dir_name=$(echo "$file_name" | rev | cut -d '.' -f 3- | rev)
+  prom_url="https://github.com/prometheus/node_exporter/releases/download/v${PROMETHEUS_NODE_EXPORTER_VERSION}/${file_name}"
+  prom_dir="$HOME/$dir_name"
+  if [ -d "$prom_dir" ]; then
+    logger "prometheus node exporter already downloaded"
+  else
+    logger "downloading prometheus node exporter"
+    cd "$HOME"
+    wget "$prom_url"
+    tar zxf "$file_name"
+  fi
+}
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [[ "$(date +%s)" -lt "${end_time}" ]]; do
+  if install_prometheus_node_exporter; then
+    exit 0
+  fi
+
+  sleep "${RETRY_INTERVAL}"
+done
+
+fail "Timed out waiting for prometheus node exporter to install"
diff --git a/enos/modules/benchmark/enable_telemetry_node_exporter/scripts/run-prometheus-node-exporter.sh b/enos/modules/benchmark/enable_telemetry_node_exporter/scripts/run-prometheus-node-exporter.sh
new file mode 100644
index 00000000000..ca887841236
--- /dev/null
+++ b/enos/modules/benchmark/enable_telemetry_node_exporter/scripts/run-prometheus-node-exporter.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+logger() {
+  DT=$(date '+%Y/%m/%d %H:%M:%S')
+  echo "$DT $0: $1"
+}
+
+file_name="node_exporter-${PROMETHEUS_NODE_EXPORTER_VERSION}.linux-amd64.tar.gz"
+dir_name=$(echo "$file_name" | rev | cut -d '.' -f 3- | rev)
+prom_dir="$HOME/$dir_name"
+
+if [ -d "$prom_dir" ]; then
+  if pgrep node_exporter > /dev/null; then
+    logger "killing prometheus node exporter"
+    pkill node_exporter
+    sleep 3
+  fi
+
+  logger "starting prometheus node exporter"
+  "$prom_dir"/node_exporter >> "$prom_dir"/node_exporter.log 2>&1 &
+else
+  logger "prometheus node exporter couldn't be found"
+fi
diff --git a/enos/modules/benchmark/set_up_k6/k6-templates/k6-approle-login.js.tpl b/enos/modules/benchmark/set_up_k6/k6-templates/k6-approle-login.js.tpl
new file mode 100644
index 00000000000..d951a2fe0c6
--- /dev/null
+++ b/enos/modules/benchmark/set_up_k6/k6-templates/k6-approle-login.js.tpl
@@ -0,0 +1,146 @@
+import http from 'k6/http';
+import { check, sleep } from 'k6';
+import { Counter } from 'k6/metrics';
+import { randomString  } from 'https://jslib.k6.io/k6-utils/1.2.0/index.js';
+
+export const options = {
+    scenarios: {
+%{for idx, host in hosts~}
+        ${idx}: {
+            executor: 'ramping-arrival-rate',
+            exec: 'approle_login',
+            timeUnit: '1s',
+            preAllocatedVUs: 3000,
+            maxVUs: 6000,
+            stages: [
+              { duration: '10s', target: 1000 },
+              { duration: '60s', target: 1000 },
+              { duration: '10s', target: 4000 },
+              { duration: '120s', target: 4000 },
+              { duration: '10s', target: 1000 },
+              { duration: '120s', target: 1000 },
+              { duration: '10s', target: 0 },
+            ],
+            env: {
+                VAULT_ADDR: 'http://${host.private_ip}:8200',
+            },
+        },
+%{endfor~}
+    },
+};
+
+function linearJitterBackoff(attemptNumber, minWait, maxWait) {
+  let rand = Math.random();
+  let jitter = rand * (maxWait - minWait);
+  let jitterMin = int(minWait + jitter);
+  return jitterMin * attemptNumber;
+}
+
+function retryRequest(url, data, params, retries) {
+  let res = http.post(url, data, params);
+  let attemptNum = 1;
+  while (res.status >= 400 && attemptNum <= retries) {
+    sleep(linearJitterBackoff(attemptNum, 1, 5));
+    attemptNum++;
+    res = http.post(url, data, params);
+  }
+  return res;
+}
+
+export function setup() {
+  // Unique auth method name for each instance
+  const auth_name = "approle-" + randomString(8);
+
+  // Mount approle auth method
+  let mount_authmethod_data = {
+    "type": "approle",
+  }
+  const auth_mount_url = 'http://${leader_addr}:8200/v1/sys/auth/' + auth_name;
+
+  let params = {'headers': { 'Content-Type': 'application/json', 'X-Vault-Token': '${vault_token}' }};
+  let res = http.post(auth_mount_url, JSON.stringify(mount_authmethod_data), params);
+  if (res.status >= 400) {
+    console.log("Failed to mount approle auth method")
+    console.log(res);
+    abort("Failed to mount approle auth method: ", auth_name);
+  }
+
+  // Create approle roles
+  const auth_api_url = 'http://${leader_addr}:8200/v1/auth/' + auth_name;
+  let create_approle_data = {
+    "policies": "default",
+    "secret_id_ttl": "0m",
+    "token_ttl": "1m",
+  }
+
+  for (let i = 0; i < 10; i++) {
+    const role_name = "approle" + i;
+    let create_role_url =  auth_api_url + '/role/' + role_name;
+    res = http.post(create_role_url, JSON.stringify(create_approle_data), params);
+    if (res.status >= 400) {
+      console.log("Failed to create approle role");
+      console.log(res);
+      return;
+    }
+
+    let role_id_payload = {
+      "role_name": role_name,
+      "role_id": role_name + "-role",
+    }
+    res = http.post(create_role_url + '/role-id', JSON.stringify(role_id_payload), params);
+    if (res.status >= 400) {
+      console.log("Failed to create role-id");
+      console.log(res);
+      return;
+    }
+
+    let secret_id_payload = {
+      "role_name": role_name,
+      "secret_id": role_name + "-secret",
+    }
+    res = http.post(create_role_url + '/custom-secret-id', JSON.stringify(secret_id_payload), params);
+    if (res.status >= 400) {
+      console.log("Failed to create secret-id");
+      console.log(res);
+      return;
+    }
+
+    let login_data = {
+      "role_id": role_name + "-role",
+      "secret_id": role_name + "-secret",
+    }
+    const login_url = 'http://${leader_addr}:8200/v1/auth/' + auth_name + '/login';
+    res = http.post(login_url, JSON.stringify(login_data), params);
+    if (res.status >= 400) {
+      console.log("Failed to login to " + auth_name);
+      console.log(res);
+      return;
+    }
+  }
+
+  return auth_name;
+}
+
+export function approle_login(data) {
+  const auth_name = data;
+  const role_id = Math.floor(Math.random() * 9);
+  let login_data = {
+    "role_id": "approle" + role_id + "-role",
+    "secret_id": "approle" + role_id + "-secret",
+  }
+
+  const login_url = `$${__ENV.VAULT_ADDR}/v1/auth/` + auth_name + '/login';
+  let params = {
+    'headers': {
+      'Content-Type': 'application/json',
+      'X-Vault-Token': '${vault_token}'
+    },
+    timeout: '10s'
+  };
+  let res = retryRequest(login_url, JSON.stringify(login_data), params);
+  if (res.status >= 400 && res.status != 503) {
+    console.log("Failed to login");
+    console.log(res);
+  }
+  check(res, { 'login success': (r) => r.status < 400 });
+}
diff --git a/enos/modules/benchmark/set_up_k6/k6-templates/k6-kvv1.js.tpl b/enos/modules/benchmark/set_up_k6/k6-templates/k6-kvv1.js.tpl
new file mode 100644
index 00000000000..676bceadf3d
--- /dev/null
+++ b/enos/modules/benchmark/set_up_k6/k6-templates/k6-kvv1.js.tpl
@@ -0,0 +1,78 @@
+import http from 'k6/http';
+import { check, sleep } from 'k6';
+import { randomString  } from 'https://jslib.k6.io/k6-utils/1.2.0/index.js';
+
+export const options = {
+    discardResponseBodies: true,
+    scenarios: {
+%{for idx, host in hosts~}
+        ${idx}: {
+            executor: 'ramping-arrival-rate',
+            exec: 'kv',
+            timeUnit: '1s',
+            preAllocatedVUs: 3000,
+            maxVUs: 6000,
+            stages: [
+              { duration: '10s', target: 1000 },
+              { duration: '60s', target: 1000 },
+              { duration: '10s', target: 4000 },
+              { duration: '120s', target: 4000 },
+              { duration: '10s', target: 1000 },
+              { duration: '120s', target: 1000 },
+              { duration: '10s', target: 0 },
+            ],
+            env: {
+                VAULT_ADDR: 'http://${host.private_ip}:8200',
+            },
+        },
+%{endfor~}
+    },
+};
+
+function linearJitterBackoff(attemptNumber, minWait, maxWait) {
+  let rand = Math.random();
+  let jitter = rand * (maxWait - minWait);
+  let jitterMin = int(minWait + jitter);
+  return jitterMin * attemptNumber;
+}
+
+function retryRequest(url, data, params, retries) {
+  let res = http.post(url, data, params);
+  let attemptNum = 1;
+  while (res.status >= 400 && attemptNum <= retries) {
+    sleep(linearJitterBackoff(attemptNum, 1, 5));
+    attemptNum++;
+    res = http.post(url, data, params);
+  }
+  return res;
+}
+
+export function setup() {
+  let data = {
+    "type": "kv",
+    "config": {
+      "default_lease_ttl": "0s",
+      "max_lease_ttl": "0s",
+      "force_no_cache": false,
+    },
+    "options": {
+      "version": "1"
+    },
+    "local": false,
+    "seal_wrap": false,
+  }
+  http.post('http://${leader_addr}:8200/v1/sys/mounts/kv', JSON.stringify(data), {
+    headers: { 'Content-Type': 'application/json', 'X-Vault-Token': '${vault_token}' },
+  });
+}
+
+export function kv() {
+  const key = randomString(8);
+  const url = `$${__ENV.VAULT_ADDR}/v1/kv/data/` + key;
+
+  let data = {"data": {"foo": "bar"}};
+  let params = {'headers': {'Content-Type': 'application/json', 'X-Vault-Token': '${vault_token}'}};
+  params['tags'] = {'name': 'create-secret'};
+  let res = retryRequest(url, JSON.stringify(data), params);
+  check(res, { 'put was success': (r) => r.status < 400 });
+}
diff --git a/enos/modules/benchmark/set_up_k6/k6-templates/k6-kvv2.js.tpl b/enos/modules/benchmark/set_up_k6/k6-templates/k6-kvv2.js.tpl
new file mode 100644
index 00000000000..5ae382ef353
--- /dev/null
+++ b/enos/modules/benchmark/set_up_k6/k6-templates/k6-kvv2.js.tpl
@@ -0,0 +1,61 @@
+import http from 'k6/http';
+import { check, sleep } from 'k6';
+import { randomString } from 'https://jslib.k6.io/k6-utils/1.2.0/index.js';
+
+export const options = {
+    discardResponseBodies: true,
+    systemTags: ['status'],
+    scenarios: {
+    %{for idx, host in hosts~}
+        ${idx}: {
+            executor: 'ramping-arrival-rate',
+            exec: 'kv',
+            timeUnit: '1s',
+            preAllocatedVUs: 3000,
+            maxVUs: 6000,
+            stages: [
+              { duration: '10s', target: 250 },
+              { duration: '60s', target: 250 },
+              { duration: '10s', target: 1000 },
+              { duration: '120s', target: 1000 },
+              { duration: '10s', target: 1000 },
+              { duration: '120s', target: 750 },
+              { duration: '10s', target: 0 },
+            ],
+            env: {
+                VAULT_ADDR: 'http://${host.private_ip}:8200',
+            },
+        },
+%{endfor~}
+    },
+};
+
+export function setup() {
+  let data = {
+    "type": "kv",
+    "config": {
+      "default_lease_ttl": "0s",
+      "max_lease_ttl": "0s",
+      "force_no_cache": false,
+    },
+    "options": {
+      "version": "2"
+    },
+    "local": false,
+    "seal_wrap": false,
+  }
+  http.post('http://${leader_addr}:8200/v1/sys/mounts/kv2', JSON.stringify(data), {
+    headers: { 'Content-Type': 'application/json', 'X-Vault-Token': '${vault_token}' },
+  });
+}
+
+export function kv() {
+  const key = randomString(8);
+  const url = `$${__ENV.VAULT_ADDR}/v1/kv2/data/` + key;
+
+  let data = {"data": {"foo": "bar"}};
+  let params = {'headers': {'Content-Type': 'application/json', 'X-Vault-Token': '${vault_token}'}};
+  params['tags'] = {'name': 'create-secret'};
+  let res = http.put(url, JSON.stringify(data), params);
+  check(res, { 'put was success': (r) => r.status < 400 });
+}
diff --git a/enos/modules/benchmark/set_up_k6/main.tf b/enos/modules/benchmark/set_up_k6/main.tf
new file mode 100644
index 00000000000..40fde7c9f79
--- /dev/null
+++ b/enos/modules/benchmark/set_up_k6/main.tf
@@ -0,0 +1,130 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "cluster_id" {
+  type = string
+}
+
+variable "host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+}
+
+variable "leader_addr" {
+  type = string
+}
+
+variable "metrics_collector_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+}
+
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
+variable "timeout" {
+  type        = number
+  description = "The max number of seconds to wait before timing out. This is applied to each step so total timeout will be longer."
+  default     = 120
+}
+
+variable "vault_hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+}
+
+variable "vault_token" {
+  type = string
+}
+
+resource "random_string" "k6" {
+  length  = 8
+  numeric = false
+  special = false
+  upper   = false
+}
+
+locals {
+  k6_id = "${var.cluster_id}-${random_string.k6.result}"
+}
+
+resource "enos_remote_exec" "install_k6" {
+  environment = {
+    RETRY_INTERVAL  = var.retry_interval
+    TIMEOUT_SECONDS = var.timeout
+  }
+
+  scripts = [abspath("${path.module}/scripts/install-k6.sh")]
+
+  transport = {
+    ssh = {
+      host = var.host.public_ip
+    }
+  }
+}
+
+resource "enos_file" "k6_scripts" {
+  depends_on = [enos_remote_exec.install_k6]
+
+  for_each    = fileset(abspath("${path.module}/../k6-templates"), "*.tpl")
+  destination = "/home/ubuntu/scripts/${replace(basename(each.value), ".tpl", "")}"
+  content = templatefile("${path.module}/k6-templates/${each.value}", {
+    hosts       = var.vault_hosts
+    vault_token = var.vault_token
+    leader_addr = var.leader_addr
+  })
+
+  transport = {
+    ssh = {
+      host = var.host.public_ip
+    }
+  }
+}
+
+resource "enos_file" "k6_exec_script" {
+  depends_on = [enos_remote_exec.install_k6]
+
+  chmod       = "755"
+  destination = "/home/ubuntu/k6-run.sh"
+  content = templatefile("${path.module}/scripts/k6-run.sh.tpl", {
+    metrics_addr = var.metrics_collector_host.private_ip
+  })
+
+  transport = {
+    ssh = {
+      host = var.host.public_ip
+    }
+  }
+}
+
+output "host" {
+  value = var.host
+}
+
+output "hosts" {
+  value = { "k6" : var.host }
+}
+
+output "public_ip" {
+  value = var.host.public_ip
+}
diff --git a/enos/modules/benchmark/set_up_k6/scripts/install-k6.sh b/enos/modules/benchmark/set_up_k6/scripts/install-k6.sh
new file mode 100755
index 00000000000..af5e4801681
--- /dev/null
+++ b/enos/modules/benchmark/set_up_k6/scripts/install-k6.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+logger() {
+  DT=$(date '+%Y/%m/%d %H:%M:%S')
+  echo "$DT $0: $1"
+}
+
+[[ -z "${RETRY_INTERVAL}" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "${TIMEOUT_SECONDS}" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+
+install_k6() {
+  if command -v k6 &> /dev/null; then
+    logger "k6 already installed"
+    return 0
+  fi
+
+  sudo gpg -k
+  sudo gpg --no-default-keyring --keyring /usr/share/keyrings/k6-archive-keyring.gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys C5AD17C747E3415A3642D57D77C6C491D6AC1D69
+  echo "deb [signed-by=/usr/share/keyrings/k6-archive-keyring.gpg] https://dl.k6.io/deb stable main" | sudo tee /etc/apt/sources.list.d/k6.list
+  sudo apt-get update
+  sudo apt-get install -y k6
+
+  logger "tweak some kernel parameters so k6 doesn't barf"
+  sudo sysctl -w net.ipv4.ip_local_port_range="1024 65535"
+  sudo sysctl -w net.ipv4.tcp_fin_timeout=10
+  sudo sysctl -w net.ipv4.tcp_tw_reuse=1
+
+  logger "setup k6 scripts dir"
+  sudo mkdir -p /home/ubuntu/scripts
+  sudo chown ubuntu:ubuntu /home/ubuntu/scripts
+}
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [[ "$(date +%s)" -lt "${end_time}" ]]; do
+  if install_k6; then
+    exit 0
+  fi
+
+  sleep "${RETRY_INTERVAL}"
+done
+
+fail "Timed out waiting for k6 to install"
diff --git a/enos/modules/benchmark/set_up_k6/scripts/k6-run.sh.tpl b/enos/modules/benchmark/set_up_k6/scripts/k6-run.sh.tpl
new file mode 100755
index 00000000000..16e6173bcc6
--- /dev/null
+++ b/enos/modules/benchmark/set_up_k6/scripts/k6-run.sh.tpl
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+script="$${1:-}"
+
+if [[ -z "$${script}" ]]; then
+  echo "Usage: $0 approle-login | kvv1 | kvv2 | lease-revocation"
+  exit 1
+fi
+
+K6_PROMETHEUS_RW_SERVER_URL=http://${metrics_addr}:9090/api/v1/write k6 run -o experimental-prometheus-rw scripts/k6-$${script}.js
diff --git a/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/aop-bench-dashboard.json b/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/aop-bench-dashboard.json
new file mode 100644
index 00000000000..0119ef05ee0
--- /dev/null
+++ b/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/aop-bench-dashboard.json
@@ -0,0 +1,3912 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "description": "Dashboard for testing various AOP scenarios.",
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": 7,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 35,
+      "panels": [],
+      "title": "K6 Client Metrics",
+      "type": "row"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 20,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 1,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Failures"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 8,
+        "x": 0,
+        "y": 1
+      },
+      "id": 33,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "sum(irate(k6_http_reqs_total{status=~\"2[0-9]{2}\"}[5m]))\n",
+          "fullMetaSearch": false,
+          "hide": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "Success",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        },
+        {
+          "editorMode": "code",
+          "expr": "sum(k6_http_req_failed_rate) \n",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Failures",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "promdatasource"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "sum(irate(k6_http_reqs_total{status!~\"503|2[0-9]{2}\"}[5m]))\n",
+          "fullMetaSearch": false,
+          "hide": true,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "Failures",
+          "range": true,
+          "refId": "C",
+          "useBackend": false
+        },
+        {
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "sum(irate(k6_http_reqs_total{status=~\"503\"}[5m]))\n",
+          "fullMetaSearch": false,
+          "hide": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "Rejections",
+          "range": true,
+          "refId": "D",
+          "useBackend": false
+        }
+      ],
+      "title": "K6 Requests",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 1,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 8,
+        "x": 8,
+        "y": 1
+      },
+      "id": 37,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "max(k6_http_req_duration_p99)",
+          "fullMetaSearch": false,
+          "hide": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "p99",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "K6 Latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 9
+      },
+      "id": 30,
+      "panels": [],
+      "title": "HTTP",
+      "type": "row"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 0,
+        "y": 10
+      },
+      "id": 1,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "sum (irate(vault_core_handle_login_request_count[5m])) by (instance)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} login",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "sum (irate(vault_core_handle_request_count[5m])) by (instance)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} req",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Vault HTTP req/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 8,
+        "y": 10
+      },
+      "id": 6,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "max(vault_core_handle_login_request{quantile=\"0.99\",instance=~\"vault-*\"}) by (instance, quantile)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}} login",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "max(vault_core_handle_request{quantile=\"0.99\",instance=~\"vault-*\"}) by (instance, quantile)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "editorMode": "code",
+          "expr": "sum(irate(vault_core_handle_request_sum{instance=~\"vault-*\"}[5m]))by(instance)/sum(irate(vault_core_handle_request_count{instance=~\"vault-*\"}[5m]))by (instance)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "D"
+        }
+      ],
+      "title": "Vault HTTP Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 16,
+        "y": 10
+      },
+      "id": 4,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_count{}[5m])",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "WAL Writes/s",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 19
+      },
+      "id": 42,
+      "panels": [],
+      "title": "Adaptive Overload Protection",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineStyle": {
+              "fill": "solid"
+            },
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 0,
+        "y": 20
+      },
+      "id": 34,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "promdatasource"
+          },
+          "editorMode": "code",
+          "expr": "vault_wal_write_controller_reject_fraction",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "PID Shed Ratio",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineStyle": {
+              "fill": "solid"
+            },
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 5,
+        "x": 8,
+        "y": 20
+      },
+      "id": 38,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "promdatasource"
+          },
+          "editorMode": "code",
+          "expr": "vault_wal_write_controller_p",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "PID P",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineStyle": {
+              "fill": "solid"
+            },
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 5,
+        "x": 13,
+        "y": 20
+      },
+      "id": 39,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "promdatasource"
+          },
+          "editorMode": "code",
+          "expr": "vault_wal_write_controller_i",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "PID I",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineStyle": {
+              "fill": "solid"
+            },
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 5,
+        "x": 18,
+        "y": 20
+      },
+      "id": 40,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "promdatasource"
+          },
+          "editorMode": "code",
+          "expr": "vault_wal_write_controller_d",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "PID D",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 27
+      },
+      "id": 9,
+      "panels": [],
+      "title": "Concurrency",
+      "type": "row"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 3,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineStyle": {
+              "fill": "solid"
+            },
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 0,
+        "y": 28
+      },
+      "id": 2,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_flushReady_queue_len{}",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "WAL flushReady Queue Length",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 8,
+        "y": 28
+      },
+      "id": 3,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "max (vault_wal_flushReady_batch_size) by (quantile)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_batch_size_sum[5m])/irate(vault_wal_flushReady_batch_size_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Batch Size",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 16,
+        "y": 28
+      },
+      "id": 36,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "max (vault_raft_boltdb_logBatchSize) by (quantile)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "max(irate(vault_raft_boltdb_logBatchSize_sum{instance=~\"vault-*\"}[5m])/irate(vault_raft_boltdb_logBatchSize_count{instance=~\"vault-*\"}[5m]))",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_boltdb_logBatchSize_sum[5m])/irate(vault_raft_boltdb_logBatchSize_count[5m])",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "WAL Batch Bytes",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 0,
+        "y": 35
+      },
+      "id": 32,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_runtime_num_goroutines",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "goroutines",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 8,
+        "y": 35
+      },
+      "id": 41,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_core_in_flight_requests",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "InFlight Requests",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 44
+      },
+      "id": 16,
+      "panels": [],
+      "title": "Vault Nodes",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 45
+      },
+      "id": 8,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "1 - avg(irate(node_cpu_seconds_total{mode=\"idle\",instance=~\"vault-.*\"}[5m])) by (instance, mode)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} CPU",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "CPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 45
+      },
+      "id": 18,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "node_memory_MemTotal_bytes{instance=~\"vault-.*\"} - node_memory_MemFree_bytes{instance=~\"vault-.*\"} - node_memory_Buffers_bytes{instance=~\"vault-.*\"} - node_memory_Cached_bytes{instance=~\"vault-.*\"}",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{host}}",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Memory",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 45
+      },
+      "id": 24,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(node_disk_flush_requests_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Flushes/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 51
+      },
+      "id": 19,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(node_disk_writes_completed_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Write Ops/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "Bps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 51
+      },
+      "id": 20,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(node_disk_written_bytes_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Write Bytes/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 51
+      },
+      "id": 25,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(node_disk_io_time_seconds_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Utilization",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 57
+      },
+      "id": 43,
+      "panels": [],
+      "title": "Test Metrics",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "bars",
+            "fillOpacity": 100,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 0,
+        "y": 58
+      },
+      "id": 44,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "core_leadership_lost_sum",
+          "instant": false,
+          "legendFormat": "{{instance}} leadership lost",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Leadership lost",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 7,
+        "x": 8,
+        "y": 58
+      },
+      "id": 45,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_expire_num_leases",
+          "instant": false,
+          "legendFormat": "{{instance}} leases",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "vault_expire_num_irrevocable_leases",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} irrevocable",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Leases",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 15,
+        "y": 58
+      },
+      "id": 46,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_logshipper_buffer_length[5m])",
+          "instant": false,
+          "legendFormat": "{{type}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Logshipper",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 0,
+        "y": 65
+      },
+      "id": 48,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_replication_heartbeat_sum[$__rate_interval])",
+          "instant": false,
+          "legendFormat": "{{instance}} heartbeats",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Heartbeats",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "WAL Index Diff",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 7,
+        "x": 8,
+        "y": 65
+      },
+      "id": 49,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_replication_wal_last_wal{instance=\"127.0.0.5:8200\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "{{instance}} last_wal",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "vault_replication_fsm_last_remote_wal{instance=\"127.0.0.5:8200\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "secondary last_remote_wal",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "editorMode": "code",
+          "expr": "vault_replication_wal_last_performance_wal{instance=\"127.0.0.2:8200\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "primary last_performance_wal",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "editorMode": "code",
+          "expr": "sum(vault_replication_wal_last_performance_wal{instance=\"127.0.0.2:8200\"}) - sum(vault_replication_fsm_last_remote_wal{instance=\"127.0.0.5:8200\"})",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "D"
+        }
+      ],
+      "title": "Replication Lag",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 15,
+        "y": 65
+      },
+      "id": 47,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_identity_entity_count",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Entities",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 72
+      },
+      "id": 10,
+      "panels": [],
+      "title": "Raft Internals",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 0,
+        "y": 73
+      },
+      "id": 17,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_commitTime",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_commitTime_sum[5m])/irate(vault_raft_commitTime_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Commit Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 6,
+        "y": 73
+      },
+      "id": 12,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_storage_transaction",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_storage_transaction_sum[5m])/irate(vault_raft_storage_transaction_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Storage Transaction Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 4,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Leader Dispatch Logs 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "super-light-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Leader Dispatch Logs 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.3:8200 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "light-green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.3:8200 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.4:8200 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "super-light-blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.4:8200 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 12,
+        "y": 73
+      },
+      "id": 13,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_leader_dispatchLog{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_rpc_appendEntries_storeLogs_sum[5m])/irate(vault_raft_rpc_appendEntries_storeLogs_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Follower Store Logs {{instance}} mean",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_leader_dispatchLog{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs {{quantile}}",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_leader_dispatchLog_sum[5m])/irate(vault_raft_leader_dispatchLog_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs mean",
+          "range": true,
+          "refId": "D"
+        }
+      ],
+      "title": "Raft Store Logs Latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 79
+      },
+      "id": 29,
+      "panels": [],
+      "title": "WAL Internals",
+      "type": "row"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 80
+      },
+      "id": 26,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_persistWALs",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_persistWALs_sum[5m])/irate(vault_wal_persistWALs_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Persist Latency",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 80
+      },
+      "id": 27,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_DEFAULT-PROM}"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_wal_persistWALs_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "WAL Flush/s",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 80
+      },
+      "id": 11,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_flushReady",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_sum[5m])/irate(vault_wal_flushReady_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Flush Latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 86
+      },
+      "id": 28,
+      "panels": [],
+      "title": "FSM",
+      "type": "row"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 0,
+        "y": 87
+      },
+      "id": 15,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_fsm_applyBatch{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_fsm_applyBatch_sum[5m])/irate(vault_raft_fsm_applyBatch_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "FSM Apply Latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 93
+      },
+      "id": 21,
+      "panels": [],
+      "title": "Client Node",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 94
+      },
+      "id": 22,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "1 - avg(irate(node_cpu_seconds_total{mode=\"idle\",instance=\"k6\"}[5m])) by (instance, mode)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} CPU",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "CPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 94
+      },
+      "id": 23,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "node_memory_MemTotal_bytes{instance=\"k6\"} - node_memory_MemFree_bytes{instance=\"k6\"} - node_memory_Buffers_bytes{instance=\"k6\"} - node_memory_Cached_bytes{instance=\"k6\"}",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{host}}",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Memory",
+      "type": "timeseries"
+    }
+  ],
+  "preload": false,
+  "refresh": "5s",
+  "schemaVersion": 41,
+  "tags": [],
+  "templating": {
+    "list": []
+  },
+  "time": {
+    "from": "now-5m",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "Adaptive Overload Protection",
+  "uid": "1223c5ac-a75c-47bf-aea4-3d2e3198132a",
+  "version": 1
+}
\ No newline at end of file
diff --git a/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/consul-is-benchmarks.json b/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/consul-is-benchmarks.json
new file mode 100644
index 00000000000..66f68a4c1f2
--- /dev/null
+++ b/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/consul-is-benchmarks.json
@@ -0,0 +1,6677 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "description": "Dashboard for benchmarking Consul vs Integrated Storage",
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": 3,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 58,
+      "panels": [],
+      "title": "Barrier Operations",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 0,
+        "y": 1
+      },
+      "id": 59,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_barrier_put",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_barrier_put_sum[5m])/irate(vault_barrier_put_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Put",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 12,
+        "y": 1
+      },
+      "id": 60,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_barrier_get",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_barrier_get_sum[5m])/irate(vault_barrier_get_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Get",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 0,
+        "y": 8
+      },
+      "id": 61,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_barrier_delete",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_barrier_delete_sum[5m])/irate(vault_barrier_delete_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Delete",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 12,
+        "x": 12,
+        "y": 8
+      },
+      "id": 62,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_barrier_list",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_barrier_list_sum[5m])/irate(vault_barrier_list_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "List",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 15
+      },
+      "id": 74,
+      "panels": [],
+      "title": "Consul Operations",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 0,
+        "y": 16
+      },
+      "id": 64,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_consul_put",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_consul_put_sum[5m])/irate(vault_consul_put_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Consul Put",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 8,
+        "y": 16
+      },
+      "id": 65,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_consul_get",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_consul_get_sum[5m])/irate(vault_consul_get_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Consul Get",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 16,
+        "y": 16
+      },
+      "id": 66,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_consul_delete",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_consul_delete_sum[5m])/irate(vault_consul_delete_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Consul Delete",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 0,
+        "y": 25
+      },
+      "id": 67,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_consul_list",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_consul_list_sum[5m])/irate(vault_consul_list_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Consul List",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 8,
+        "y": 25
+      },
+      "id": 68,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_consul_transaction",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_consul_transaction_sum[5m])/irate(vault_consul_transaction_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Consul Transaction",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 34
+      },
+      "id": 50,
+      "panels": [],
+      "title": "Consul",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 35
+      },
+      "id": 56,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "consul_raft_replication_appendEntries_rpc",
+          "instant": false,
+          "legendFormat": "{{quantile}} {{peer_id}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Leader Append RPC Times",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 35
+      },
+      "id": 55,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "max(consul_raft_commitTime) by (quantile)",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(consul_raft_commitTime_sum[$__interval])/irate(consul_raft_commitTime_count[$__interval])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Commit Time",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 43
+      },
+      "id": 52,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "max(irate(consul_raft_commitTime_count[5m]))",
+          "instant": false,
+          "legendFormat": "rps",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Commit Rate",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 43
+      },
+      "id": 51,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "max(consul_raft_fsm_apply) by (quantile)",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(consul_fsm_apply_sum[$__interval])/irate(consul_fsm_apply_count[$__interval])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "FSM Apply Time",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 51
+      },
+      "id": 53,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(consul_kvs_apply_sum[$__interval])/irate(consul_kvs_apply_count[$__interval])",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "consul_kvs_apply",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "{{instance}} kvs {{quantile}}",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "consul_txn_apply",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "{{instance}} txn {{quantile}}",
+          "range": true,
+          "refId": "D"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "consul_fsm_txn",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} fsm txn {{quantile}}",
+          "range": true,
+          "refId": "E"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(consul_kvs_apply_sum[$__interval])/irate(consul_kvs_apply_count[$__interval])",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "KV Apply Time",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 51
+      },
+      "id": 54,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "consul_raft_rpc_appendEntries_storeLogs{quantile=\"0.99\"}",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "consul_raft_leader_dispatchLog",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} dispatchLog {{quantile}}",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(consul_raft_rpc_appendEntries_storeLogs_sum{}[1m])/irate(consul_raft_rpc_appendEntries_count{}[1m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean storeLogs",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Store Logs Time",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ns"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 59
+      },
+      "id": 57,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "consul_runtime_total_gc_pause_ns",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Garbage Collector Pause",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 67
+      },
+      "id": 63,
+      "panels": [],
+      "title": "Raft Operations",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 0,
+        "y": 68
+      },
+      "id": 69,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_raft_storage_put",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_raft_storage_put_sum[5m])/irate(vault_raft_storage_put_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Put",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 8,
+        "y": 68
+      },
+      "id": 70,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_raft_storage_get",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_raft_storage_get_sum[5m])/irate(vault_raft_storage_get_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Get",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 16,
+        "y": 68
+      },
+      "id": 71,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_raft_storage_delete",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_raft_storage_delete_sum[5m])/irate(vault_raft_storage_delete_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Delete",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 0,
+        "y": 75
+      },
+      "id": 72,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_raft_storage_list",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_raft_storage_list_sum[5m])/irate(vault_raft_storage_list_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft List",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 8,
+        "y": 75
+      },
+      "id": 73,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "vault_raft_storage_transaction",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_raft_storage_transaction_sum[5m])/irate(vault_raft_storage_transaction_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Transaction",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 82
+      },
+      "id": 35,
+      "panels": [],
+      "title": "K6 Client Metrics",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 20,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 1,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Failures"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 83
+      },
+      "id": 33,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "sum(irate(k6_http_reqs_total{status=~\"2[0-9]{2}\"}[5m]))\n",
+          "fullMetaSearch": false,
+          "hide": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "Success",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "sum(k6_http_req_failed_rate) \n",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Failures",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "sum(irate(k6_http_reqs_total{status!~\"503|2[0-9]{2}\"}[5m]))\n",
+          "fullMetaSearch": false,
+          "hide": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "Failures",
+          "range": true,
+          "refId": "C",
+          "useBackend": false
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "sum(irate(k6_http_reqs_total{status=~\"503\"}[5m]))\n",
+          "fullMetaSearch": false,
+          "hide": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "Rejections",
+          "range": true,
+          "refId": "D",
+          "useBackend": false
+        }
+      ],
+      "title": "K6 Requests",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 1,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "s"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 83
+      },
+      "id": 37,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "max(k6_http_req_duration_p99)",
+          "fullMetaSearch": false,
+          "hide": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "p99",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "K6 Latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 91
+      },
+      "id": 30,
+      "panels": [],
+      "title": "HTTP",
+      "type": "row"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 0,
+        "y": 92
+      },
+      "id": 1,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "sum (irate(vault_core_handle_login_request_count[5m])) by (instance)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} login",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "sum (irate(vault_core_handle_request_count[5m])) by (instance)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} req",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Vault HTTP req/s",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 8,
+        "y": 92
+      },
+      "id": 6,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "max(vault_core_handle_login_request{quantile=\"0.99\",instance=~\"vault-.*\"}) by (instance, quantile)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}} login",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "max(vault_core_handle_request{quantile=\"0.99\",instance=~\"vault-.*\"}) by (instance, quantile)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "editorMode": "code",
+          "expr": "sum(irate(vault_core_handle_request_sum{instance=~\"vault-.*\"}[5m]))by(instance)/sum(irate(vault_core_handle_request_count{instance=~\"vault-.*\"}[5m]))by (instance)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "D"
+        }
+      ],
+      "title": "Vault HTTP Latency",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 16,
+        "y": 92
+      },
+      "id": 4,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_count{}[5m])",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "WAL Writes/s",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 101
+      },
+      "id": 9,
+      "panels": [],
+      "title": "Concurrency",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 3,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineStyle": {
+              "fill": "solid"
+            },
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 0,
+        "y": 102
+      },
+      "id": 2,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_flushReady_queue_len{}",
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "WAL flushReady Queue Length",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 8,
+        "y": 102
+      },
+      "id": 3,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "max (vault_wal_flushReady_batch_size) by (quantile)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_batch_size_sum[5m])/irate(vault_wal_flushReady_batch_size_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Batch Size",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 16,
+        "y": 102
+      },
+      "id": 36,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "max (vault_raft_boltdb_logBatchSize) by (quantile)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "max(irate(vault_raft_boltdb_logBatchSize_sum{instance=~\"vault-.*\"}[5m])/irate(vault_raft_boltdb_logBatchSize_count{instance=~\"vault-.*\"}[5m]))",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_boltdb_logBatchSize_sum[5m])/irate(vault_raft_boltdb_logBatchSize_count[5m])",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "WAL Batch Bytes",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 0,
+        "y": 109
+      },
+      "id": 32,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_runtime_num_goroutines",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "goroutines",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 8,
+        "x": 8,
+        "y": 109
+      },
+      "id": 41,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_core_in_flight_requests",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "InFlight Requests",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 118
+      },
+      "id": 16,
+      "panels": [],
+      "title": "Vault Nodes",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 119
+      },
+      "id": 8,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "1 - avg(irate(node_cpu_seconds_total{mode=\"idle\",instance=~\"vault-.*\"}[5m])) by (instance, mode)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} CPU",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "CPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 119
+      },
+      "id": 18,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "avg(node_memory_MemTotal_bytes{instance=~\"vault-.*\"})\n",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Total",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "editorMode": "code",
+          "expr": "node_memory_MemTotal_bytes{instance=~\"vault-.*\"} - node_memory_MemFree_bytes{instance=~\"vault-.*\"} - node_memory_Buffers_bytes{instance=~\"vault-.*\"} - node_memory_Cached_bytes{instance=~\"vault-.*\"}",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Memory",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 119
+      },
+      "id": 24,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(node_disk_flush_requests_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Flushes/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 125
+      },
+      "id": 19,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(node_disk_writes_completed_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Write Ops/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "Bps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 125
+      },
+      "id": 20,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(node_disk_written_bytes_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "interval": "",
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Write Bytes/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 125
+      },
+      "id": 25,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(node_disk_io_time_seconds_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Utilization",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 131
+      },
+      "id": 75,
+      "panels": [],
+      "title": "Consul Nodes",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 132
+      },
+      "id": 76,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "1 - avg(irate(node_cpu_seconds_total{mode=\"idle\",instance=~\"consul-.*\"}[5m])) by (instance, mode)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} CPU",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "CPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 132
+      },
+      "id": 77,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "avg(node_memory_MemTotal_bytes{instance=~\"consul-.*\"})\n",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Total",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "editorMode": "code",
+          "expr": "node_memory_MemTotal_bytes{instance=~\"consul-.*\"} - node_memory_MemFree_bytes{instance=~\"consul-.*\"} - node_memory_Buffers_bytes{instance=~\"consul-.*\"} - node_memory_Cached_bytes{instance=~\"consul-.*\"}",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Memory",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 132
+      },
+      "id": 78,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(node_disk_flush_requests_total{instance=~\"consul-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Flushes/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 138
+      },
+      "id": 79,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(node_disk_writes_completed_total{instance=~\"consul-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Write Ops/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "Bps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 138
+      },
+      "id": 80,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(node_disk_written_bytes_total{instance=~\"consul-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Disk Write Bytes/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 138
+      },
+      "id": 81,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(node_disk_io_time_seconds_total{instance=~\"consul-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "interval": "",
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Disk Utilization",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 144
+      },
+      "id": 21,
+      "panels": [],
+      "title": "Client Node",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 13,
+        "x": 0,
+        "y": 145
+      },
+      "id": 22,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "avg(irate(node_cpu_seconds_total{mode!=\"idle\",instance=\"k6\"}[5m])) by (mode)",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "k6 {{mode}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "1 - avg(irate(node_cpu_seconds_total{mode=\"idle\",instance=\"k6\"}[5m])) by (mode)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "k6 CPU",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "CPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 11,
+        "x": 13,
+        "y": 145
+      },
+      "id": 23,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "node_memory_MemTotal_bytes{instance=\"k6\"} - node_memory_MemFree_bytes{instance=\"k6\"} - node_memory_Buffers_bytes{instance=\"k6\"} - node_memory_Cached_bytes{instance=\"k6\"}",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Memory",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 151
+      },
+      "id": 43,
+      "panels": [],
+      "title": "Test Metrics",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "bars",
+            "fillOpacity": 100,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 0,
+        "y": 152
+      },
+      "id": 44,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "core_leadership_lost_sum",
+          "instant": false,
+          "legendFormat": "{{instance}} leadership lost",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Leadership lost",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 8,
+        "y": 152
+      },
+      "id": 45,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_expire_num_leases",
+          "instant": false,
+          "legendFormat": "{{instance}} leases",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "vault_expire_num_irrevocable_leases",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} irrevocable",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Leases",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 16,
+        "y": 152
+      },
+      "id": 46,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_logshipper_buffer_length[5m])",
+          "instant": false,
+          "legendFormat": "{{type}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Logshipper",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 0,
+        "y": 159
+      },
+      "id": 48,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_replication_heartbeat_sum[$__rate_interval])",
+          "instant": false,
+          "legendFormat": "{{instance}} heartbeats",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Heartbeats",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "WAL Index Diff",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 8,
+        "y": 159
+      },
+      "id": 49,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": false
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "multi",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_replication_wal_last_wal{instance=\"127.0.0.5:8200\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "{{instance}} last_wal",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "vault_replication_fsm_last_remote_wal{instance=\"127.0.0.5:8200\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "secondary last_remote_wal",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "editorMode": "code",
+          "expr": "vault_replication_wal_last_performance_wal{instance=\"127.0.0.2:8200\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "primary last_performance_wal",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "editorMode": "code",
+          "expr": "sum(vault_replication_wal_last_performance_wal{instance=\"127.0.0.2:8200\"}) - sum(vault_replication_fsm_last_remote_wal{instance=\"127.0.0.5:8200\"})",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "D"
+        }
+      ],
+      "title": "Replication Lag",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          }
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 7,
+        "w": 8,
+        "x": 16,
+        "y": 159
+      },
+      "id": 47,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_identity_entity_count",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Entities",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 166
+      },
+      "id": 10,
+      "panels": [],
+      "title": "Raft Internals",
+      "type": "row"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 167
+      },
+      "id": 17,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_commitTime",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_commitTime_sum[5m])/irate(vault_raft_commitTime_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Commit Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 167
+      },
+      "id": 12,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_storage_transaction",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_storage_transaction_sum[5m])/irate(vault_raft_storage_transaction_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Storage Transaction Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 4,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Leader Dispatch Logs 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "super-light-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Leader Dispatch Logs 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.3:8200 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "light-green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.3:8200 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.4:8200 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "super-light-blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.4:8200 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 167
+      },
+      "id": 13,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_leader_dispatchLog{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_rpc_appendEntries_storeLogs_sum[5m])/irate(vault_raft_rpc_appendEntries_storeLogs_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Follower Store Logs {{instance}} mean",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_leader_dispatchLog{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs {{quantile}}",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_leader_dispatchLog_sum[5m])/irate(vault_raft_leader_dispatchLog_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs mean",
+          "range": true,
+          "refId": "D"
+        }
+      ],
+      "title": "Raft Store Logs Latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 173
+      },
+      "id": 29,
+      "panels": [],
+      "title": "WAL Internals",
+      "type": "row"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 174
+      },
+      "id": 26,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_persistWALs",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_persistWALs_sum[5m])/irate(vault_wal_persistWALs_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Persist Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 174
+      },
+      "id": 27,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_wal_persistWALs_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "WAL Flush/s",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 174
+      },
+      "id": 11,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_flushReady",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_sum[5m])/irate(vault_wal_flushReady_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Flush Latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 180
+      },
+      "id": 28,
+      "panels": [],
+      "title": "FSM",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 181
+      },
+      "id": 15,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_fsm_applyBatch{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_fsm_applyBatch_sum[5m])/irate(vault_raft_fsm_applyBatch_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "FSM Apply Latency",
+      "type": "timeseries"
+    }
+  ],
+  "preload": false,
+  "refresh": "5s",
+  "schemaVersion": 41,
+  "tags": [],
+  "templating": {
+    "list": []
+  },
+  "time": {
+    "from": "now-5m",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "Consul IS Benchmarks",
+  "uid": "a223c5ac-a75c-47bf-aea4-3d2e3198132b",
+  "version": 1
+}
\ No newline at end of file
diff --git a/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/vault-write-performance.json b/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/vault-write-performance.json
new file mode 100644
index 00000000000..ffd5b8dacfc
--- /dev/null
+++ b/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/vault-write-performance.json
@@ -0,0 +1,2373 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": 6,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 9,
+      "panels": [],
+      "title": "Throughput",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 1
+      },
+      "id": 1,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "sum (irate(vault_core_handle_request_count[5m])) by (instance)",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Vault HTTP req/s",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 1
+      },
+      "id": 4,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_count{}[5m])",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "WAL Writes/s",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 1
+      },
+      "id": 27,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_persistWALs_count[5m])",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "WAL Flush/s",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 8,
+        "x": 0,
+        "y": 7
+      },
+      "id": 5,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_flushReady_queue_len{}",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_queue_len_sum[5m])/irate(vault_wal_flushReady_queue_len_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Ready Queue Len",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "none"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 8,
+        "x": 8,
+        "y": 7
+      },
+      "id": 3,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "max (vault_wal_flushReady_batch_size) by (quantile)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_batch_size_sum[5m])/irate(vault_wal_flushReady_batch_size_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Batch Size",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 8,
+        "x": 16,
+        "y": 7
+      },
+      "id": 2,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "sum (irate(vault_raft_commitTime_count[5m])) by (instance)",
+          "instant": false,
+          "legendFormat": "__auto",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "Raft commit/s",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 12
+      },
+      "id": 10,
+      "panels": [],
+      "title": "Latencies",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 13
+      },
+      "id": 6,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "max(vault_core_handle_request) by (quantile)",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "avg( irate(vault_core_handle_request_sum[5m])/irate(vault_core_handle_request_count[5m])) by (instance)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Vault HTTP Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 13
+      },
+      "id": 11,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_flushReady",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_sum[5m])/irate(vault_wal_flushReady_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Flush Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 13
+      },
+      "id": 26,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_persistWALs",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_persistWALs_sum[5m])/irate(vault_wal_persistWALs_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Persist Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 0,
+        "y": 19
+      },
+      "id": 17,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_commitTime",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_commitTime_sum[5m])/irate(vault_raft_commitTime_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Commit Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 6,
+        "y": 19
+      },
+      "id": 15,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_fsm_applyBatch{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "{{instance}} {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_fsm_applyBatch_sum[5m])/irate(vault_raft_fsm_applyBatch_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "FSM Apply Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 12,
+        "y": 19
+      },
+      "id": 12,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_storage_transaction",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_storage_transaction_sum[5m])/irate(vault_raft_storage_transaction_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Storage Transaction Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 4,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Leader Dispatch Logs 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "super-light-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Leader Dispatch Logs 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.3:8200 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "light-green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.3:8200 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.4:8200 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "super-light-blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.4:8200 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 18,
+        "y": 19
+      },
+      "id": 13,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_leader_dispatchLog{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_rpc_appendEntries_storeLogs_sum[5m])/irate(vault_raft_rpc_appendEntries_storeLogs_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Follower Store Logs {{instance}} mean",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_leader_dispatchLog{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs {{quantile}}",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_leader_dispatchLog_sum[5m])/irate(vault_raft_leader_dispatchLog_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs mean",
+          "range": true,
+          "refId": "D"
+        }
+      ],
+      "title": "Raft Store Logs Latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 25
+      },
+      "id": 16,
+      "panels": [],
+      "title": "Vault Nodes",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 26
+      },
+      "id": 8,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "1 - avg(irate(node_cpu_seconds_total{mode=\"idle\",instance=~\"vault-.*\"}[5m])) by (instance, mode)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} CPU",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "CPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 26
+      },
+      "id": 18,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "node_memory_MemTotal_bytes{instance=~\"vault-.*\"} - node_memory_MemFree_bytes{instance=~\"vault-.*\"} - node_memory_Buffers_bytes{instance=~\"vault-.*\"} - node_memory_Cached_bytes{instance=~\"vault-.*\"}",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Memory",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 26
+      },
+      "id": 24,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(node_disk_flush_requests_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Flushes/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 32
+      },
+      "id": 19,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(node_disk_writes_completed_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Write Ops/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "Bps"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 32
+      },
+      "id": 20,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(node_disk_written_bytes_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Write Bytes/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 32
+      },
+      "id": 25,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(node_disk_io_time_seconds_total{instance=~\"vault-.*\",device=\"xvda\"}[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Disk Utilization",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 38
+      },
+      "id": 21,
+      "panels": [],
+      "title": "Client Node",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 39
+      },
+      "id": 22,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "1 - avg(irate(node_cpu_seconds_total{mode=\"idle\",instance=\"k6\"}[5m])) by (instance, mode)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} CPU",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "CPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Total"
+            },
+            "properties": [
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "dash": [
+                    10,
+                    10
+                  ],
+                  "fill": "dash"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 39
+      },
+      "id": 23,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "node_memory_MemTotal_bytes{instance=\"k6\"} - node_memory_MemFree_bytes{instance=\"k6\"} - node_memory_Buffers_bytes{instance=\"k6\"} - node_memory_Cached_bytes{instance=\"k6\"}",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "C"
+        }
+      ],
+      "title": "Memory",
+      "type": "timeseries"
+    }
+  ],
+  "preload": false,
+  "refresh": "",
+  "schemaVersion": 41,
+  "tags": [],
+  "templating": {
+    "list": []
+  },
+  "time": {
+    "from": "2023-11-08T13:01:33.986Z",
+    "to": "2023-11-08T13:06:23.709Z"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "Vault Write Performance",
+  "uid": "d6346fbc-bf99-41b2-abf2-456772543eed",
+  "version": 2
+}
\ No newline at end of file
diff --git a/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/vault-writes.json b/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/vault-writes.json
new file mode 100644
index 00000000000..42ef6757bfa
--- /dev/null
+++ b/enos/modules/benchmark/set_up_telemetry_collector/grafana-dashboards/vault-writes.json
@@ -0,0 +1,2054 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {
+          "type": "grafana",
+          "uid": "-- Grafana --"
+        },
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": 2,
+  "links": [],
+  "panels": [
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "id": 30,
+      "panels": [],
+      "title": "HTTP",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 12,
+        "x": 0,
+        "y": 1
+      },
+      "id": 1,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "sum(irate(vault_core_handle_request_count[5m]))",
+          "fullMetaSearch": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "Total",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "Vault HTTP req/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 12,
+        "x": 12,
+        "y": 1
+      },
+      "id": 6,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "max(vault_core_handle_request) by (quantile)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "default-prom"
+          },
+          "editorMode": "code",
+          "expr": "avg( irate(vault_core_handle_request_sum[5m])/irate(vault_core_handle_request_count[5m])) by (instance)",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "D"
+        }
+      ],
+      "title": "Vault HTTP Latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 7
+      },
+      "id": 16,
+      "panels": [],
+      "title": "Vault Nodes",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 8
+      },
+      "id": 31,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "P3D0201A062148A24"
+          },
+          "editorMode": "code",
+          "expr": "1 - avg by(instance, mode) (irate(node_cpu_seconds_total{mode=\"idle\", instance=~\"vault-.*\"}[5m]))",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} CPU",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "CPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 8
+      },
+      "id": 32,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "P3D0201A062148A24"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "node_memory_MemTotal_bytes{instance=~\"vault-.*\"} - node_memory_MemFree_bytes{instance=~\"vault-.*\"} - node_memory_Buffers_bytes{instance=~\"vault-.*\"} - node_memory_Cached_bytes{instance=~\"vault-.*\"}",
+          "fullMetaSearch": false,
+          "hide": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B",
+          "useBackend": false
+        }
+      ],
+      "title": "Memory",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "reqps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 8
+      },
+      "id": 33,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "P3D0201A062148A24"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "irate(node_disk_flush_requests_total{device=\"xvda\", instance=~\"vault-.*\"}[5m])",
+          "fullMetaSearch": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "Disk Flushes/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 14
+      },
+      "id": 34,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "P3D0201A062148A24"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "irate(node_disk_writes_completed_total{device=\"xvda\", instance=~\"vault-.*\"}[5m])",
+          "fullMetaSearch": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "Disk Write Ops/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "Bps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 14
+      },
+      "id": 35,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "P3D0201A062148A24"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "irate(node_disk_written_bytes_total{device=\"xvda\", instance=~\"vault-.*\"}[5m])",
+          "fullMetaSearch": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "interval": "",
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "Disk Write Bytes/s",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 14
+      },
+      "id": 36,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "P3D0201A062148A24"
+          },
+          "disableTextWrap": false,
+          "editorMode": "code",
+          "expr": "irate(node_disk_io_time_seconds_total{device=\"xvda\", instance=~\"vault-.*\"}[5m])",
+          "fullMetaSearch": false,
+          "includeNullMetadata": true,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A",
+          "useBackend": false
+        }
+      ],
+      "title": "Disk Utilization",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 20
+      },
+      "id": 37,
+      "panels": [],
+      "title": "Client Node",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "max": 1,
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "percentunit"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 12,
+        "x": 0,
+        "y": 21
+      },
+      "id": 38,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "P3D0201A062148A24"
+          },
+          "editorMode": "code",
+          "expr": "1 - avg by(instance, mode) (irate(node_cpu_seconds_total{mode=\"idle\", instance=\"k6\"}[5m]))",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} CPU",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "CPU",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "description": "",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 0,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "decbytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 5,
+        "w": 12,
+        "x": 12,
+        "y": 21
+      },
+      "id": 39,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "P3D0201A062148A24"
+          },
+          "editorMode": "code",
+          "expr": "node_memory_MemTotal_bytes{instance=\"k6\"} - node_memory_MemFree_bytes{instance=\"k6\"} - node_memory_Buffers_bytes{instance=\"k6\"} - node_memory_Cached_bytes{instance=\"k6\"}",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Memory",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 26
+      },
+      "id": 10,
+      "panels": [],
+      "title": "Raft Internals",
+      "type": "row"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 0,
+        "y": 27
+      },
+      "id": 17,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_commitTime",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_commitTime_sum[5m])/irate(vault_raft_commitTime_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Commit Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 8,
+        "y": 27
+      },
+      "id": 12,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_storage_transaction",
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_storage_transaction_sum[5m])/irate(vault_raft_storage_transaction_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "Raft Storage Transaction Latency",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 4,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Leader Dispatch Logs 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "super-light-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Leader Dispatch Logs 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-red",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.3:8200 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "light-green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.3:8200 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-green",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.4:8200 0.5"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "super-light-blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Follower Store Logs 127.0.0.4:8200 0.99"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "fixedColor": "dark-blue",
+                  "mode": "fixed"
+                }
+              }
+            ]
+          }
+        ]
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 8,
+        "x": 16,
+        "y": 27
+      },
+      "id": 13,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_leader_dispatchLog{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs {{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_rpc_appendEntries_storeLogs_sum[5m])/irate(vault_raft_rpc_appendEntries_storeLogs_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Follower Store Logs {{instance}} mean",
+          "range": true,
+          "refId": "B"
+        },
+        {
+          "editorMode": "code",
+          "expr": "vault_raft_leader_dispatchLog{quantile!=\"0.9\"}",
+          "hide": true,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs {{quantile}}",
+          "range": true,
+          "refId": "C"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_raft_leader_dispatchLog_sum[5m])/irate(vault_raft_leader_dispatchLog_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "Leader Dispatch Logs mean",
+          "range": true,
+          "refId": "D"
+        }
+      ],
+      "title": "Raft Store Logs Latency",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 33
+      },
+      "id": 29,
+      "panels": [],
+      "title": "WAL Internals",
+      "type": "row"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 0,
+        "y": 34
+      },
+      "id": 26,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_persistWALs",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_persistWALs_sum[5m])/irate(vault_wal_persistWALs_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Persist Latency",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "min": 0,
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 6,
+        "y": 34
+      },
+      "id": 27,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_persistWALs_count[5m])",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "WAL Flush/s",
+      "type": "timeseries"
+    },
+    {
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 12,
+        "y": 34
+      },
+      "id": 11,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "vault_wal_flushReady",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{quantile}}",
+          "range": true,
+          "refId": "A"
+        },
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_sum[5m])/irate(vault_wal_flushReady_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "WAL Flush Latency",
+      "type": "timeseries"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "default-prom"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 38,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "normal"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "wps"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 6,
+        "x": 18,
+        "y": 34
+      },
+      "id": 4,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "editorMode": "code",
+          "expr": "irate(vault_wal_flushReady_count{}[5m])",
+          "instant": false,
+          "legendFormat": "{{instance}}",
+          "range": true,
+          "refId": "A"
+        }
+      ],
+      "title": "WAL Writes/s",
+      "type": "timeseries"
+    },
+    {
+      "collapsed": false,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 40
+      },
+      "id": 28,
+      "panels": [],
+      "title": "FSM",
+      "type": "row"
+    },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "P3D0201A062148A24"
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "custom": {
+            "axisBorderShow": false,
+            "axisCenteredZero": false,
+            "axisColorMode": "text",
+            "axisLabel": "",
+            "axisPlacement": "auto",
+            "barAlignment": 0,
+            "barWidthFactor": 0.6,
+            "drawStyle": "line",
+            "fillOpacity": 7,
+            "gradientMode": "none",
+            "hideFrom": {
+              "legend": false,
+              "tooltip": false,
+              "viz": false
+            },
+            "insertNulls": false,
+            "lineInterpolation": "linear",
+            "lineWidth": 1,
+            "pointSize": 5,
+            "scaleDistribution": {
+              "type": "linear"
+            },
+            "showPoints": "auto",
+            "spanNulls": false,
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            },
+            "thresholdsStyle": {
+              "mode": "off"
+            }
+          },
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {
+                "color": "green"
+              },
+              {
+                "color": "red",
+                "value": 80
+              }
+            ]
+          },
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 6,
+        "w": 7,
+        "x": 0,
+        "y": 41
+      },
+      "id": 15,
+      "options": {
+        "legend": {
+          "calcs": [],
+          "displayMode": "list",
+          "placement": "bottom",
+          "showLegend": true
+        },
+        "tooltip": {
+          "hideZeros": false,
+          "mode": "single",
+          "sort": "none"
+        }
+      },
+      "pluginVersion": "11.6.0",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "P3D0201A062148A24"
+          },
+          "editorMode": "code",
+          "expr": "irate(vault_raft_fsm_applyBatch_sum[5m])/irate(vault_raft_fsm_applyBatch_count[5m])",
+          "hide": false,
+          "instant": false,
+          "legendFormat": "{{instance}} mean",
+          "range": true,
+          "refId": "B"
+        }
+      ],
+      "title": "FSM Apply Latency",
+      "type": "timeseries"
+    }
+  ],
+  "preload": false,
+  "refresh": "5s",
+  "schemaVersion": 41,
+  "tags": [],
+  "templating": {
+    "list": []
+  },
+  "time": {
+    "from": "now-15m",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "Vault Writes",
+  "uid": "8E7265FE-93AD-43F4-9B97-92ED962C3E9C",
+  "version": 1
+}
\ No newline at end of file
diff --git a/enos/modules/benchmark/set_up_telemetry_collector/main.tf b/enos/modules/benchmark/set_up_telemetry_collector/main.tf
new file mode 100644
index 00000000000..ce48d217791
--- /dev/null
+++ b/enos/modules/benchmark/set_up_telemetry_collector/main.tf
@@ -0,0 +1,184 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "cluster_id" {
+  type = string
+}
+
+variable "consul_hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The consul hosts backing the vault cluster instances"
+}
+
+variable "grafana_version" {
+  type = string
+}
+
+variable "grafana_http_port" {
+  type = number
+}
+
+variable "host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+}
+
+variable "k6_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+}
+
+variable "prometheus_version" {
+  type = string
+}
+
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
+variable "timeout" {
+  type        = number
+  description = "The max number of seconds to wait before timing out. This is applied to each step so total timeout will be longer."
+  default     = 120
+}
+
+variable "vault_hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster instances"
+}
+
+resource "random_string" "metrics" {
+  length  = 8
+  numeric = false
+  special = false
+  upper   = false
+}
+
+locals {
+  metrics_id = "${var.cluster_id}-${random_string.metrics.result}"
+  base_prometheus_environment = {
+    PROMETHEUS_VERSION = var.prometheus_version
+    RETRY_INTERVAL     = var.retry_interval
+    TIMEOUT_SECONDS    = var.timeout
+    K6_ADDR            = var.k6_host.private_ip
+  }
+  consul_prometheus_environment = {
+    for k, v in var.consul_hosts : "CONSUL_${k}_ADDR" => var.consul_hosts[k].private_ip if length(var.consul_hosts) > 0
+  }
+  vault_prometheus_environment = {
+    for k, v in var.vault_hosts : "VAULT_${k + 1}_ADDR" => var.vault_hosts[k].private_ip if length(var.vault_hosts) > 0
+  }
+  prometheus_environment = merge(
+    local.base_prometheus_environment,
+    local.consul_prometheus_environment,
+    local.vault_prometheus_environment,
+  )
+}
+
+resource "enos_remote_exec" "install_prometheus" {
+  environment = local.prometheus_environment
+  scripts     = [abspath("${path.module}/scripts/install-prometheus.sh")]
+
+  transport = {
+    ssh = {
+      host = var.host.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "install_grafana" {
+  depends_on = [
+    enos_remote_exec.install_prometheus,
+  ]
+
+  environment = {
+    GRAFANA_VERSION = var.grafana_version
+    RETRY_INTERVAL  = var.retry_interval
+    TIMEOUT_SECONDS = var.timeout
+  }
+
+  scripts = [abspath("${path.module}/scripts/install-grafana.sh")]
+
+  transport = {
+    ssh = {
+      host = var.host.public_ip
+    }
+  }
+}
+
+resource "enos_file" "copy_grafana_dashboards" {
+  depends_on = [
+    enos_remote_exec.install_grafana,
+  ]
+  for_each = fileset(abspath("${path.module}/grafana-dashboards"), "*.json")
+
+  source      = abspath("${path.module}/grafana-dashboards/${each.value}")
+  destination = "/etc/grafana/dashboards/${basename(each.value)}"
+
+  transport = {
+    ssh = {
+      host = var.host.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "run_prometheus" {
+  depends_on = [
+    enos_remote_exec.install_grafana,
+  ]
+
+  scripts = [abspath("${path.module}/scripts/run-prometheus.sh")]
+
+  transport = {
+    ssh = {
+      host = var.host.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "run_grafana" {
+  depends_on = [
+    enos_file.copy_grafana_dashboards,
+  ]
+
+  environment = {
+    RETRY_INTERVAL  = var.retry_interval
+    TIMEOUT_SECONDS = var.timeout
+  }
+
+  scripts = [abspath("${path.module}/scripts/run-grafana.sh")]
+
+  transport = {
+    ssh = {
+      host = var.host.public_ip
+    }
+  }
+}
+
+output "dashboard_url" {
+  value = "http://${var.host.public_ip}:${var.grafana_http_port}"
+}
diff --git a/enos/modules/benchmark/set_up_telemetry_collector/scripts/install-grafana.sh b/enos/modules/benchmark/set_up_telemetry_collector/scripts/install-grafana.sh
new file mode 100755
index 00000000000..1aa2c12e2eb
--- /dev/null
+++ b/enos/modules/benchmark/set_up_telemetry_collector/scripts/install-grafana.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+logger() {
+  DT=$(date '+%Y/%m/%d %H:%M:%S')
+  echo "$DT $0: $1"
+}
+
+[[ -z "${GRAFANA_VERSION}" ]] && fail "GRAFANA_VERSION env variable has not been set"
+[[ -z "${RETRY_INTERVAL}" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "${TIMEOUT_SECONDS}" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+
+install_grafana() {
+  if command -v grafana-server &> /dev/null; then
+    logger "grafana already installed"
+    return 0
+  fi
+
+  logger "installing grafana"
+  cd "$HOME"
+
+  file_name="grafana-enterprise_${GRAFANA_VERSION}_amd64.deb"
+  sudo apt-get update
+  sudo apt-get install -y adduser libfontconfig1 musl
+  wget "https://dl.grafana.com/enterprise/release/$file_name"
+  sudo dpkg -i "$file_name"
+
+  prom_ds="/etc/grafana/provisioning/datasources/prometheus.yaml"
+  dash_config="/etc/grafana/provisioning/dashboards/benchmark.yaml"
+  dash_dir="/etc/grafana/dashboards"
+
+  logger "writing out grafana datasource for prometheus"
+  sudo tee "$prom_ds" << EOF
+  apiVersion: 1
+
+  datasources:
+  - name: default-prom
+    type: prometheus
+    access: proxy
+    orgId: 1
+    url: http://localhost:9090
+    isDefault: true
+    version: 1
+    editable: true
+EOF
+  sudo chown root:grafana "$prom_ds"
+
+  logger "removing sample.yaml dashboard config"
+  sudo rm -f /etc/grafana/provisioning/dashboards/sample.yaml
+
+  logger "writing out grafana dashboard config"
+  sudo mkdir -p "$dash_dir"
+  sudo tee "$dash_config" << EOF
+  apiVersion: 1
+
+  providers:
+  - name: 'vault'
+    orgId: 1
+    folder: 'Vault dashboards'
+    type: file
+    options:
+      path: /etc/grafana/dashboards
+EOF
+  sudo chown root:grafana "$dash_config"
+  sudo chown root:grafana "$dash_dir"
+}
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [[ "$(date +%s)" -lt "${end_time}" ]]; do
+  if install_grafana; then
+    exit 0
+  fi
+
+  sleep "${RETRY_INTERVAL}"
+done
+
+fail "Timed out waiting for grafana to install"
diff --git a/enos/modules/benchmark/set_up_telemetry_collector/scripts/install-prometheus.sh b/enos/modules/benchmark/set_up_telemetry_collector/scripts/install-prometheus.sh
new file mode 100755
index 00000000000..48c389869d1
--- /dev/null
+++ b/enos/modules/benchmark/set_up_telemetry_collector/scripts/install-prometheus.sh
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+logger() {
+  DT=$(date '+%Y/%m/%d %H:%M:%S')
+  echo "$DT $0: $1"
+}
+
+env
+
+[[ -z "${PROMETHEUS_VERSION}" ]] && fail "PROMETHEUS_VERSION env variable has not been set"
+[[ -z "${RETRY_INTERVAL}" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "${TIMEOUT_SECONDS}" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+[[ -z "${VAULT_1_ADDR}" ]] && fail "VAULT_1_ADDR env variable has not been set"
+[[ -z "${VAULT_2_ADDR}" ]] && fail "VAULT_2_ADDR env variable has not been set"
+[[ -z "${VAULT_3_ADDR}" ]] && fail "VAULT_3_ADDR env variable has not been set"
+[[ -z "${K6_ADDR}" ]] && fail "K6_ADDR env variable has not been set"
+
+install_prometheus() {
+  file_name="prometheus-${PROMETHEUS_VERSION}.linux-amd64.tar.gz"
+  dir_name=$(echo "$file_name" | rev | cut -d '.' -f 3- | rev)
+  prom_url="https://github.com/prometheus/prometheus/releases/download/v${PROMETHEUS_VERSION}/$file_name"
+  prom_dir="$HOME/prom"
+
+  if [ -d "$HOME/$prom_dir" ]; then
+    logger "prometheus already downloaded"
+    return 0
+  fi
+
+  logger "downloading prometheus"
+  cd "$HOME"
+  mkdir -p "$prom_dir"
+  wget "$prom_url"
+  tar zxf "$file_name"
+  cp "$dir_name/prometheus" "$prom_dir"
+
+  logger "writing out prometheus config file"
+  tee "$prom_dir/prometheus.yml" << EOF
+global:
+  scrape_interval:     5s
+  evaluation_interval: 5s
+
+scrape_configs:
+  - job_name: 'prometheus'
+    static_configs:
+      - targets: ['localhost:9090']
+  - job_name: 'vault-nodes'
+    static_configs:
+      - targets: ['${VAULT_1_ADDR}:9100']
+        labels:
+          instance: 'vault-1'
+      - targets: ['${VAULT_2_ADDR}:9100']
+        labels:
+          instance: 'vault-2'
+      - targets: ['${VAULT_3_ADDR}:9100']
+        labels:
+          instance: 'vault-3'
+      - targets: ['${K6_ADDR}:9100']
+        labels:
+          instance: 'k6'
+  - job_name: 'vault-metrics'
+    metrics_path: "/v1/sys/metrics"
+    params:
+      format: ['prometheus']
+    static_configs:
+      - targets: ['${VAULT_1_ADDR}:8200']
+        labels:
+          instance: 'vault-1'
+      - targets: ['${VAULT_2_ADDR}:8200']
+        labels:
+          instance: 'vault-2'
+      - targets: ['${VAULT_3_ADDR}:8200']
+        labels:
+          instance: 'vault-3'
+EOF
+
+  if [[ -n "${CONSUL_1_ADDR:-}" && -n "${CONSUL_2_ADDR:-}" && -n "${CONSUL_3_ADDR:-}" ]]; then
+    tee -a "$prom_dir/prometheus.yml" << EOF
+  - job_name: 'consul-nodes'
+    static_configs:
+      - targets: ['${CONSUL_1_ADDR}:9100']
+        labels:
+          instance: 'consul-1'
+      - targets: ['${CONSUL_2_ADDR}:9100']
+        labels:
+          instance: 'consul-2'
+      - targets: ['${CONSUL_3_ADDR}:9100']
+        labels:
+          instance: 'consul-3'
+  - job_name: 'consul-metrics'
+    metrics_path: "/v1/agent/metrics"
+    params:
+      format: ['prometheus']
+    static_configs:
+      - targets: ['${CONSUL_1_ADDR}:8500']
+        labels:
+          instance: 'consul-1'
+      - targets: ['${CONSUL_2_ADDR}:8500']
+        labels:
+          instance: 'consul-2'
+      - targets: ['${CONSUL_3_ADDR}:8500']
+        labels:
+          instance: 'consul-3'
+EOF
+  fi
+}
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [[ "$(date +%s)" -lt "${end_time}" ]]; do
+  if install_prometheus; then
+    exit 0
+  fi
+
+  sleep "${RETRY_INTERVAL}"
+done
+
+fail "Timed out waiting for prometheus to install"
diff --git a/enos/modules/benchmark/set_up_telemetry_collector/scripts/run-grafana.sh b/enos/modules/benchmark/set_up_telemetry_collector/scripts/run-grafana.sh
new file mode 100755
index 00000000000..41c113a5a96
--- /dev/null
+++ b/enos/modules/benchmark/set_up_telemetry_collector/scripts/run-grafana.sh
@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+logger() {
+  DT=$(date '+%Y/%m/%d %H:%M:%S')
+  echo "$DT $0: $1"
+}
+
+[[ -z "${RETRY_INTERVAL}" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "${TIMEOUT_SECONDS}" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+
+sudo systemctl stop grafana-server || true
+sudo systemctl start grafana-server
+
+# let grafana start up
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+started="0"
+while [[ "$(date +%s)" -lt "${end_time}" ]]; do
+  if systemctl is-active grafana-server; then
+    logger "grafana is running"
+    started="1"
+    break
+  fi
+
+  sleep "${RETRY_INTERVAL}"
+done
+
+if [[ "${started}" == "0" ]]; then
+  fail "Error: Grafana did not start after waiting for ${TIMEOUT_SECONDS} seconds"
+fi
+
+# Get the actual UID of the default-prom datasource
+GRAFANA_USER="admin"
+GRAFANA_PASSWORD="admin"  # Or whatever you've set
+AUTH=$(echo -n "$GRAFANA_USER:$GRAFANA_PASSWORD" | base64)
+
+# Use a function to safely handle the API call and potential failure
+get_datasource_uid() {
+  local response
+  response=$(curl -s -H "Authorization: Basic $AUTH" \
+    "http://localhost:3000/api/datasources/name/default-prom")
+
+  # Check if the response contains the UID
+  if echo "$response" | grep -q '"uid"'; then
+    echo "$response" | grep -o '"uid":"[^"]*"' | sed 's/"uid":"//;s/"//'
+    return 0
+  else
+    fail "Error: Failed to get datasource UID. Response: $response"
+  fi
+}
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [[ "$(date +%s)" -lt "${end_time}" ]]; do
+  if DATASOURCE_UID=$(get_datasource_uid); then
+    logger "Datasource UID: $DATASOURCE_UID"
+    break
+  fi
+
+  sleep "${RETRY_INTERVAL}"
+done
+
+if [[ -z "${DATASOURCE_UID:-}" ]]; then
+  fail "Error: Failed to get datasource UID after waiting for ${TIMEOUT_SECONDS} seconds"
+fi
+
+# Directory containing your dashboard templates
+DASHBOARD_DIR="/etc/grafana/dashboards"
+
+# Install jq if needed
+if ! command -v jq &> /dev/null; then
+    logger "Installing jq..."
+    sudo apt-get update
+    sudo apt-get install -y jq
+fi
+
+# Create a function to process each dashboard file
+process_dashboard() {
+  local dashboard_file="$1"
+  local temp_file
+
+  logger "Processing $dashboard_file"
+
+  # Create a temporary file
+  temp_file=$(mktemp)
+
+  # Use jq to update all datasource references
+  # The || clause will only execute if jq fails, due to set -e
+  jq --arg uid "$DATASOURCE_UID" '
+    walk(
+      if type == "object" and .datasource != null and .datasource.type == "prometheus" then
+        .datasource.uid = $uid
+      else
+        .
+      end
+    )
+  ' "$dashboard_file" > "$temp_file" || {
+    rm -f "$temp_file"
+    fail "Error: jq processing failed for $dashboard_file"
+  }
+
+  # Replace the original file with the updated content
+  sudo mv "$temp_file" "$dashboard_file"
+  logger "Updated $dashboard_file with datasource UID: $DATASOURCE_UID"
+  return 0
+}
+
+# Process all JSON files, with error count tracking
+error_count=0
+
+for dashboard_file in "$DASHBOARD_DIR"/*.json; do
+  if ! process_dashboard "$dashboard_file"; then
+    error_count=$((error_count + 1))
+  fi
+done
+
+if [ $error_count -gt 0 ]; then
+  logger "Warning: $error_count files could not be processed"
+else
+  logger "All dashboards processed successfully"
+fi
+
+# Restart Grafana to apply changes
+sudo systemctl restart grafana-server
diff --git a/enos/modules/benchmark/set_up_telemetry_collector/scripts/run-prometheus.sh b/enos/modules/benchmark/set_up_telemetry_collector/scripts/run-prometheus.sh
new file mode 100755
index 00000000000..50339a72455
--- /dev/null
+++ b/enos/modules/benchmark/set_up_telemetry_collector/scripts/run-prometheus.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+pkill prometheus || true
+sleep 2
+prom_dir="$HOME/prom"
+"$prom_dir"/prometheus --web.enable-remote-write-receiver --config.file="$prom_dir/prometheus.yml" >> "$prom_dir"/prom.log 2>&1 &
diff --git a/enos/modules/benchmark/setup/main.tf b/enos/modules/benchmark/setup/main.tf
new file mode 100644
index 00000000000..bafdb3447ba
--- /dev/null
+++ b/enos/modules/benchmark/setup/main.tf
@@ -0,0 +1,70 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "hashicorp-forge/enos"
+    }
+  }
+}
+
+module "set_up_k6" {
+  source = "../set_up_k6"
+
+  cluster_id             = var.vpc_id
+  host                   = var.k6_host
+  leader_addr            = var.leader_addr
+  metrics_collector_host = var.metrics_host
+  retry_interval         = var.retry_interval
+  timeout                = var.timeout
+  vault_token            = var.vault_token
+  vault_hosts            = var.vault_hosts
+}
+
+module "set_up_telemetry_collector" {
+  source = "../set_up_telemetry_collector"
+
+  cluster_id         = var.vpc_id
+  consul_hosts       = var.consul_hosts
+  grafana_version    = var.grafana_version
+  grafana_http_port  = var.grafana_http_port
+  host               = var.metrics_host
+  k6_host            = var.k6_host
+  prometheus_version = var.prometheus_version
+  retry_interval     = var.retry_interval
+  timeout            = var.timeout
+  vault_hosts        = var.vault_hosts
+}
+
+module "enable_telemetry_consul" {
+  source = "../enable_telemetry_consul"
+
+  hosts = var.consul_hosts
+}
+
+locals {
+  vault_hosts = {
+    for k, v in var.vault_hosts : "vault_${k}" => v
+  }
+  consul_hosts = {
+    for k, v in var.consul_hosts : "consul_${k}" => v if length(var.consul_hosts) > 0
+  }
+  all_hosts = merge(local.vault_hosts, local.consul_hosts, module.set_up_k6.hosts)
+}
+
+module "enable_telemetry_node_exporter" {
+  depends_on = [
+    module.set_up_telemetry_collector
+  ]
+  source = "../enable_telemetry_node_exporter"
+
+  hosts                            = local.all_hosts
+  prometheus_node_exporter_version = var.prometheus_node_exporter_version
+  retry_interval                   = var.retry_interval
+  timeout                          = var.timeout
+}
+
+output "dashboard_url" {
+  value = module.set_up_telemetry_collector.dashboard_url
+}
diff --git a/enos/modules/benchmark/setup/variables.tf b/enos/modules/benchmark/setup/variables.tf
new file mode 100644
index 00000000000..0512a6123f1
--- /dev/null
+++ b/enos/modules/benchmark/setup/variables.tf
@@ -0,0 +1,78 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+variable "consul_hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The consul hosts backing the vault cluster instances"
+}
+
+variable "grafana_version" {
+  type = string
+}
+
+variable "grafana_http_port" {
+  type = number
+}
+
+variable "k6_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The k6 target host"
+}
+
+variable "leader_addr" {
+  type = string
+}
+
+variable "metrics_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The metrics target host"
+}
+
+variable "prometheus_node_exporter_version" {
+  type = string
+}
+
+variable "prometheus_version" {
+  type = string
+}
+
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
+variable "timeout" {
+  type        = number
+  description = "The max number of seconds to wait before timing out. This is applied to each step so total timeout will be longer."
+  default     = 120
+}
+
+variable "vault_hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster hosts"
+}
+
+variable "vault_token" {
+  type = string
+}
+
+variable "vpc_id" {
+  type = string
+}
diff --git a/enos/modules/build_artifactory_artifact/main.tf b/enos/modules/build_artifactory_artifact/main.tf
new file mode 100644
index 00000000000..35a741bb021
--- /dev/null
+++ b/enos/modules/build_artifactory_artifact/main.tf
@@ -0,0 +1,94 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source  = "registry.terraform.io/hashicorp-forge/enos"
+      version = ">= 0.2.3"
+    }
+  }
+}
+
+variable "artifactory_token" {
+  type        = string
+  description = "The token to use when connecting to artifactory"
+  default     = null
+  sensitive   = true
+}
+
+variable "artifactory_host" {
+  type        = string
+  description = "The artifactory host to search for vault artifacts"
+  default     = "https://artifactory.hashicorp.engineering/artifactory"
+}
+
+variable "artifactory_repo" {
+  type        = string
+  description = "The artifactory repo to search for vault artifacts"
+  default     = "hashicorp-crt-stable-local*"
+}
+
+variable "arch" {}
+variable "artifact_type" {}
+variable "artifact_path" {}
+variable "distro" {}
+variable "edition" {}
+variable "revision" {}
+variable "product_version" {}
+variable "build_tags" { default = null }
+variable "bundle_path" { default = null }
+variable "goarch" { default = null }
+variable "goos" { default = null }
+
+module "artifact_metadata" {
+  source = "../artifact/metadata"
+
+  arch          = var.arch
+  distro        = var.distro
+  edition       = var.edition
+  package_type  = var.artifact_type
+  vault_version = var.product_version
+}
+
+data "enos_artifactory_item" "vault" {
+  token = var.artifactory_token
+  name  = module.artifact_metadata.artifact_name
+  host  = var.artifactory_host
+  repo  = var.artifactory_repo
+  path  = "${module.artifact_metadata.product_name}/*"
+  properties = tomap({
+    "commit"          = var.revision,
+    "product-name"    = module.artifact_metadata.product_name,
+    "product-version" = module.artifact_metadata.product_version,
+  })
+}
+
+output "url" {
+  value       = data.enos_artifactory_item.vault.results[0].url
+  description = "The artifactory download url for the artifact"
+}
+
+output "sha256" {
+  value       = data.enos_artifactory_item.vault.results[0].sha256
+  description = "The sha256 checksum for the artifact"
+}
+
+output "size" {
+  value       = data.enos_artifactory_item.vault.results[0].size
+  description = "The size in bytes of the artifact"
+}
+
+output "name" {
+  value       = data.enos_artifactory_item.vault.results[0].name
+  description = "The name of the artifact"
+}
+
+output "vault_artifactory_release" {
+  value = {
+    url      = data.enos_artifactory_item.vault.results[0].url
+    sha256   = data.enos_artifactory_item.vault.results[0].sha256
+    token    = var.artifactory_token
+    username = null # username is not an optional value yet
+  }
+}
diff --git a/enos/modules/build_artifactory_package/main.tf b/enos/modules/build_artifactory_package/main.tf
new file mode 100644
index 00000000000..1e85ea01c05
--- /dev/null
+++ b/enos/modules/build_artifactory_package/main.tf
@@ -0,0 +1,110 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source  = "registry.terraform.io/hashicorp-forge/enos"
+      version = ">= 0.6.1"
+    }
+  }
+}
+
+variable "arch" {
+  type        = string
+  description = "The architecture for the desired artifact"
+}
+
+variable "artifactory_token" {
+  type        = string
+  description = "The token to use when connecting to Artifactory"
+  sensitive   = true
+}
+
+variable "artifactory_host" {
+  type        = string
+  description = "The Artifactory host to search for Vault artifacts"
+  default     = "https://artifactory.hashicorp.engineering/artifactory"
+}
+
+variable "distro" {
+  type        = string
+  description = "The distro for the desired artifact (ubuntu or rhel)"
+}
+
+variable "distro_version" {
+  type        = string
+  description = "The RHEL version for .rpm packages"
+}
+
+variable "edition" {
+  type        = string
+  description = "The edition of Vault to use"
+}
+
+variable "product_version" {
+  type        = string
+  description = "The version of Vault to use"
+}
+
+// Shim variables that we don't use but include to satisfy the build module "interface"
+variable "artifact_path" { default = null }
+variable "artifact_type" { default = null }
+variable "artifactory_repo" { default = null }
+variable "build_tags" { default = null }
+variable "build_ui" { default = null }
+variable "bundle_path" { default = null }
+variable "goarch" { default = null }
+variable "goos" { default = null }
+variable "revision" { default = null }
+
+module "artifact_metadata" {
+  source = "../artifact/metadata"
+
+  arch          = var.arch
+  distro        = var.distro
+  edition       = var.edition
+  package_type  = var.artifact_type != null ? var.artifact_type : "package"
+  vault_version = var.product_version
+}
+
+data "enos_artifactory_item" "vault" {
+  token = var.artifactory_token
+  name  = module.artifact_metadata.artifact_name
+  host  = var.artifactory_host
+  repo  = module.artifact_metadata.release_repo
+  path  = module.artifact_metadata.release_paths[var.distro_version]
+}
+
+output "results" {
+  value = data.enos_artifactory_item.vault.results
+}
+
+output "url" {
+  value       = data.enos_artifactory_item.vault.results[0].url
+  description = "The artifactory download url for the artifact"
+}
+
+output "sha256" {
+  value       = data.enos_artifactory_item.vault.results[0].sha256
+  description = "The sha256 checksum for the artifact"
+}
+
+output "size" {
+  value       = data.enos_artifactory_item.vault.results[0].size
+  description = "The size in bytes of the artifact"
+}
+
+output "name" {
+  value       = data.enos_artifactory_item.vault.results[0].name
+  description = "The name of the artifact"
+}
+
+output "release" {
+  value = {
+    url      = data.enos_artifactory_item.vault.results[0].url
+    sha256   = data.enos_artifactory_item.vault.results[0].sha256
+    token    = var.artifactory_token
+    username = null # username is not optional yet
+  }
+}
diff --git a/enos/modules/build_crt/main.tf b/enos/modules/build_crt/main.tf
index 6700cbf78fe..de57075d10e 100644
--- a/enos/modules/build_crt/main.tf
+++ b/enos/modules/build_crt/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 # Shim module since CRT provided things will use the crt_bundle_path variable
@@ -24,26 +24,13 @@ variable "goos" {
 
 variable "artifactory_host" { default = null }
 variable "artifactory_repo" { default = null }
-variable "artifactory_username" { default = null }
 variable "artifactory_token" { default = null }
-variable "arch" {
-  default = null
-}
-variable "artifact_path" {
-  default = null
-}
-variable "artifact_type" {
-  default = null
-}
-variable "distro" {
-  default = null
-}
-variable "edition" {
-  default = null
-}
-variable "revision" {
-  default = null
-}
-variable "product_version" {
-  default = null
-}
+variable "arch" { default = null }
+variable "artifact_path" { default = null }
+variable "artifact_type" { default = null }
+variable "build_ui" { default = null }
+variable "distro" { default = null }
+variable "distro_version" { default = null }
+variable "edition" { default = null }
+variable "revision" { default = null }
+variable "product_version" { default = null }
diff --git a/enos/modules/build_local/main.tf b/enos/modules/build_local/main.tf
index 0f4b71c2998..106157f8a53 100644
--- a/enos/modules/build_local/main.tf
+++ b/enos/modules/build_local/main.tf
@@ -1,19 +1,29 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
+variable "artifact_path" {
+  description = "Where to create the zip bundle of the Vault build"
+}
+
 variable "build_tags" {
   type        = list(string)
   description = "The build tags to pass to the Go compiler"
 }
 
+variable "build_ui" {
+  type        = bool
+  description = "Whether or not we should build the UI when creating the local build"
+  default     = true
+}
+
 variable "goarch" {
   type        = string
   description = "The Go architecture target"
@@ -28,15 +38,11 @@ variable "goos" {
 
 variable "artifactory_host" { default = null }
 variable "artifactory_repo" { default = null }
-variable "artifactory_username" { default = null }
 variable "artifactory_token" { default = null }
 variable "arch" { default = null }
-variable "artifact_path" {
-  type    = string
-  default = "/tmp/vault.zip"
-}
 variable "artifact_type" { default = null }
 variable "distro" { default = null }
+variable "distro_version" { default = null }
 variable "edition" { default = null }
 variable "revision" { default = null }
 variable "product_version" { default = null }
@@ -50,8 +56,9 @@ resource "enos_local_exec" "build" {
 
   environment = {
     BASE_VERSION       = module.local_metadata.version_base
-    BIN_PATH           = "dist"
-    BUNDLE_PATH        = var.artifact_path,
+    BIN_PATH           = abspath("${path.module}/../../../dist")
+    BUILD_UI           = tostring(var.build_ui)
+    BUNDLE_PATH        = abspath(var.artifact_path)
     GO_TAGS            = join(" ", var.build_tags)
     GOARCH             = var.goarch
     GOOS               = var.goos
diff --git a/enos/modules/build_local/scripts/build.sh b/enos/modules/build_local/scripts/build.sh
index ad191807a87..ee6b889ff44 100755
--- a/enos/modules/build_local/scripts/build.sh
+++ b/enos/modules/build_local/scripts/build.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -eux -o pipefail
@@ -11,11 +11,14 @@ export CGO_ENABLED=0
 
 root_dir="$(git rev-parse --show-toplevel)"
 pushd "$root_dir" > /dev/null
-make ci-build-ui ci-build
 
-: "${BIN_PATH:="dist"}"
-: "${BUNDLE_PATH:=$(git rev-parse --show-toplevel)/vault.zip}"
-echo "--> Bundling $BIN_PATH/* to $BUNDLE_PATH"
-zip -r -j "$BUNDLE_PATH" "$BIN_PATH/"
+if [ -n "$BUILD_UI" ] && [ "$BUILD_UI" = "true" ]; then
+  make ci-build-ui
+fi
+
+make ci-build
 
 popd > /dev/null
+
+echo "--> Bundling $BIN_PATH/* to $BUNDLE_PATH"
+zip -r -j "$BUNDLE_PATH" "$BIN_PATH/"
diff --git a/enos/modules/choose_follower_host/main.tf b/enos/modules/choose_follower_host/main.tf
new file mode 100644
index 00000000000..ecb988d36c0
--- /dev/null
+++ b/enos/modules/choose_follower_host/main.tf
@@ -0,0 +1,17 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+variable "followers" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault follower hosts"
+}
+
+output "chosen_follower" {
+  value = {
+    0 : try(var.followers[0], null)
+  }
+}
diff --git a/enos/modules/create_vpc/main.tf b/enos/modules/create_vpc/main.tf
index 2e7c3ebfcf2..f6a838fd1fe 100644
--- a/enos/modules/create_vpc/main.tf
+++ b/enos/modules/create_vpc/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 data "aws_availability_zones" "available" {
@@ -19,9 +19,11 @@ resource "random_string" "cluster_id" {
 }
 
 resource "aws_vpc" "vpc" {
-  cidr_block           = var.cidr
-  enable_dns_hostnames = true
-  enable_dns_support   = true
+  // Always set the ipv4 cidr block as it's required in "dual-stack" VPCs which we create.
+  cidr_block                       = var.ipv4_cidr
+  enable_dns_hostnames             = true
+  enable_dns_support               = true
+  assign_generated_ipv6_cidr_block = var.ip_version == 6
 
   tags = merge(
     var.common_tags,
@@ -32,11 +34,18 @@ resource "aws_vpc" "vpc" {
 }
 
 resource "aws_subnet" "subnet" {
-  count                   = length(data.aws_availability_zones.available.names)
-  vpc_id                  = aws_vpc.vpc.id
-  cidr_block              = cidrsubnet(var.cidr, 8, count.index)
-  availability_zone       = data.aws_availability_zones.available.names[count.index]
+  count             = length(data.aws_availability_zones.available.names)
+  vpc_id            = aws_vpc.vpc.id
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+
+  // IPV4, but since we need to support ipv4 connections from the machine running enos, we're
+  // always going to need ipv4 available.
   map_public_ip_on_launch = true
+  cidr_block              = cidrsubnet(var.ipv4_cidr, 8, count.index)
+
+  // IPV6, only set these when we want to run in ipv6 mode.
+  assign_ipv6_address_on_creation = var.ip_version == 6
+  ipv6_cidr_block                 = var.ip_version == 6 ? cidrsubnet(aws_vpc.vpc.ipv6_cidr_block, 4, count.index) : null
 
   tags = merge(
     var.common_tags,
@@ -46,7 +55,7 @@ resource "aws_subnet" "subnet" {
   )
 }
 
-resource "aws_internet_gateway" "igw" {
+resource "aws_internet_gateway" "ipv4" {
   vpc_id = aws_vpc.vpc.id
 
   tags = merge(
@@ -57,29 +66,43 @@ resource "aws_internet_gateway" "igw" {
   )
 }
 
-resource "aws_route" "igw" {
+resource "aws_egress_only_internet_gateway" "ipv6" {
+  count  = var.ip_version == 6 ? 1 : 0
+  vpc_id = aws_vpc.vpc.id
+}
+
+resource "aws_route" "igw_ipv4" {
   route_table_id         = aws_vpc.vpc.default_route_table_id
   destination_cidr_block = "0.0.0.0/0"
-  gateway_id             = aws_internet_gateway.igw.id
+  gateway_id             = aws_internet_gateway.ipv4.id
+}
+
+resource "aws_route" "igw_ipv6" {
+  count                       = var.ip_version == 6 ? 1 : 0
+  route_table_id              = aws_vpc.vpc.default_route_table_id
+  destination_ipv6_cidr_block = "::/0"
+  egress_only_gateway_id      = aws_egress_only_internet_gateway.ipv6[0].id
 }
 
 resource "aws_security_group" "default" {
   vpc_id = aws_vpc.vpc.id
 
   ingress {
-    description = "allow_ingress_from_all"
-    from_port   = 0
-    to_port     = 0
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
+    description      = "allow_ingress_from_all"
+    from_port        = 0
+    to_port          = 0
+    protocol         = "tcp"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.ip_version == 6 ? ["::/0"] : null
   }
 
   egress {
-    description = "allow_egress_from_all"
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+    description      = "allow_egress_from_all"
+    from_port        = 0
+    to_port          = 0
+    protocol         = "-1"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = var.ip_version == 6 ? ["::/0"] : null
   }
 
   tags = merge(
diff --git a/enos/modules/create_vpc/outputs.tf b/enos/modules/create_vpc/outputs.tf
index a064644d318..4bc5e837207 100644
--- a/enos/modules/create_vpc/outputs.tf
+++ b/enos/modules/create_vpc/outputs.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 output "id" {
@@ -6,9 +6,14 @@ output "id" {
   value       = aws_vpc.vpc.id
 }
 
-output "cidr" {
-  description = "CIDR for whole VPC"
-  value       = var.cidr
+output "ipv4_cidr" {
+  description = "The VPC subnet CIDR for ipv4 mode"
+  value       = var.ipv4_cidr
+}
+
+output "ipv6_cidr" {
+  description = "The VPC subnet CIDR for ipv6 mode"
+  value       = aws_vpc.vpc.ipv6_cidr_block
 }
 
 output "cluster_id" {
diff --git a/enos/modules/create_vpc/variables.tf b/enos/modules/create_vpc/variables.tf
index 19861362293..f4ee84c06cf 100644
--- a/enos/modules/create_vpc/variables.tf
+++ b/enos/modules/create_vpc/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "name" {
@@ -7,10 +7,21 @@ variable "name" {
   description = "The name of the VPC"
 }
 
-variable "cidr" {
+variable "ip_version" {
+  type        = number
+  default     = 4
+  description = "The IP version to use for the default subnet"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "ipv4_cidr" {
   type        = string
   default     = "10.13.0.0/16"
-  description = "CIDR block for the VPC"
+  description = "The CIDR block for the VPC when using IPV4 mode"
 }
 
 variable "environment" {
diff --git a/enos/modules/disable_selinux/main.tf b/enos/modules/disable_selinux/main.tf
new file mode 100644
index 00000000000..0e903896a17
--- /dev/null
+++ b/enos/modules/disable_selinux/main.tf
@@ -0,0 +1,31 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The hosts to install packages on"
+}
+
+resource "enos_remote_exec" "make_selinux_permissive" {
+  for_each = var.hosts
+
+  scripts = [abspath("${path.module}/scripts/make-selinux-permissive.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/disable_selinux/scripts/make-selinux-permissive.sh b/enos/modules/disable_selinux/scripts/make-selinux-permissive.sh
new file mode 100644
index 00000000000..689a3ab0457
--- /dev/null
+++ b/enos/modules/disable_selinux/scripts/make-selinux-permissive.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+if ! type getenforce &> /dev/null; then
+  exit 0
+fi
+
+if sudo getenforce | grep Enforcing; then
+  sudo setenforce 0
+fi
diff --git a/enos/modules/ec2_info/main.tf b/enos/modules/ec2_info/main.tf
index 0b78e2b370b..f3c9d1a16d0 100644
--- a/enos/modules/ec2_info/main.tf
+++ b/enos/modules/ec2_info/main.tf
@@ -1,49 +1,91 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
+# Note: in order to use the openSUSE Leap AMIs, the AWS account in use must "subscribe"
+# and accept SUSE's terms of use. You can do this at the links below. If the AWS account
+# you are using is already subscribed, this confirmation will be displayed on each page.
+# openSUSE Leap arm64 subscription: https://aws.amazon.com/marketplace/server/procurement?productId=a516e959-df54-4035-bb1a-63599b7a6df9
+# openSUSE Leap amd64 subscription: https://aws.amazon.com/marketplace/server/procurement?productId=5535c495-72d4-4355-b169-54ffa874f849
+
 locals {
   architectures      = toset(["arm64", "x86_64"])
+  amazon_owner_id    = "591542846629"
   canonical_owner_id = "099720109477"
-  rhel_owner_id      = "309956199498"
+  suse_owner_id      = "013907871322"
+  opensuse_owner_id  = "679593333241"
+  redhat_owner_id    = "309956199498"
   ids = {
+    // NOTE: If you modify these versions you'll probably also need to update the `softhsm_install`
+    // module to match.
     "arm64" = {
+      "amzn" = {
+        "2"    = data.aws_ami.amzn_2["arm64"].id
+        "2023" = data.aws_ami.amzn_2023["arm64"].id
+      }
+      "leap" = {
+        "15.6" = data.aws_ami.leap_15["arm64"].id
+      }
       "rhel" = {
-        "8.8" = data.aws_ami.rhel_88["arm64"].id
-        "9.1" = data.aws_ami.rhel_91["arm64"].id
+        "8.10" = data.aws_ami.rhel_8["arm64"].id
+        "9.6"  = data.aws_ami.rhel_9["arm64"].id
+        "10.0" = data.aws_ami.rhel_10["arm64"].id
+      }
+      "sles" = {
+        "15.6" = data.aws_ami.sles_15["arm64"].id
       }
       "ubuntu" = {
-        "18.04" = data.aws_ami.ubuntu_1804["arm64"].id
-        "20.04" = data.aws_ami.ubuntu_2004["arm64"].id
         "22.04" = data.aws_ami.ubuntu_2204["arm64"].id
+        "24.04" = data.aws_ami.ubuntu_2404["arm64"].id
       }
     }
     "amd64" = {
+      "amzn" = {
+        "2"    = data.aws_ami.amzn_2["x86_64"].id
+        "2023" = data.aws_ami.amzn_2023["x86_64"].id
+      }
+      "leap" = {
+        "15.6" = data.aws_ami.leap_15["x86_64"].id
+      }
       "rhel" = {
-        "7.9" = data.aws_ami.rhel_79.id
-        "8.8" = data.aws_ami.rhel_88["x86_64"].id
-        "9.1" = data.aws_ami.rhel_91["x86_64"].id
+        "8.10" = data.aws_ami.rhel_8["x86_64"].id
+        "9.6"  = data.aws_ami.rhel_9["x86_64"].id
+        "10.0" = data.aws_ami.rhel_10["x86_64"].id
+      }
+      "sles" = {
+        "15.6" = data.aws_ami.sles_15["x86_64"].id
       }
       "ubuntu" = {
-        "18.04" = data.aws_ami.ubuntu_1804["x86_64"].id
-        "20.04" = data.aws_ami.ubuntu_2004["x86_64"].id
         "22.04" = data.aws_ami.ubuntu_2204["x86_64"].id
+        "24.04" = data.aws_ami.ubuntu_2404["x86_64"].id
       }
     }
   }
 }
 
-data "aws_ami" "ubuntu_1804" {
+data "aws_ami" "amzn_2" {
   most_recent = true
   for_each    = local.architectures
 
   filter {
     name   = "name"
-    values = ["ubuntu/images/hvm-ssd/ubuntu-*-18.04-*-server-*"]
+    values = ["amzn2-ami-ecs-hvm-2.0*"]
   }
 
   filter {
-    name   = "virtualization-type"
-    values = ["hvm"]
+    name   = "architecture"
+    values = [each.value]
+  }
+
+  owners = [local.amazon_owner_id]
+}
+
+data "aws_ami" "amzn_2023" {
+  most_recent = true
+  for_each    = local.architectures
+
+  filter {
+    name   = "name"
+    values = ["al2023-ami-ecs-hvm*"]
   }
 
   filter {
@@ -51,16 +93,33 @@ data "aws_ami" "ubuntu_1804" {
     values = [each.value]
   }
 
-  owners = [local.canonical_owner_id]
+  owners = [local.amazon_owner_id]
 }
 
-data "aws_ami" "ubuntu_2004" {
+data "aws_ami" "leap_15" {
   most_recent = true
   for_each    = local.architectures
 
   filter {
     name   = "name"
-    values = ["ubuntu/images/hvm-ssd/ubuntu-*-20.04-*-server-*"]
+    values = ["openSUSE-Leap-15-6*"]
+  }
+
+  filter {
+    name   = "architecture"
+    values = [each.value]
+  }
+
+  owners = [local.opensuse_owner_id]
+}
+
+data "aws_ami" "rhel_8" {
+  most_recent = true
+  for_each    = local.architectures
+
+  filter {
+    name   = "name"
+    values = ["RHEL-8.10*HVM-20*"]
   }
 
   filter {
@@ -73,16 +132,16 @@ data "aws_ami" "ubuntu_2004" {
     values = [each.value]
   }
 
-  owners = [local.canonical_owner_id]
+  owners = [local.redhat_owner_id]
 }
 
-data "aws_ami" "ubuntu_2204" {
+data "aws_ami" "rhel_9" {
   most_recent = true
   for_each    = local.architectures
 
   filter {
     name   = "name"
-    values = ["ubuntu/images/hvm-ssd/ubuntu-*-22.04-*-server-*"]
+    values = ["RHEL-9.6*HVM-20*"]
   }
 
   filter {
@@ -95,16 +154,16 @@ data "aws_ami" "ubuntu_2204" {
     values = [each.value]
   }
 
-  owners = [local.canonical_owner_id]
+  owners = [local.redhat_owner_id]
 }
 
-data "aws_ami" "rhel_79" {
+data "aws_ami" "rhel_10" {
   most_recent = true
+  for_each    = local.architectures
 
-  # Currently latest latest point release-1
   filter {
     name   = "name"
-    values = ["RHEL-7.9*HVM-20*"]
+    values = ["RHEL-10.0*HVM-20*"]
   }
 
   filter {
@@ -114,20 +173,36 @@ data "aws_ami" "rhel_79" {
 
   filter {
     name   = "architecture"
-    values = ["x86_64"]
+    values = [each.value]
   }
 
-  owners = [local.rhel_owner_id]
+  owners = [local.redhat_owner_id]
 }
 
-data "aws_ami" "rhel_88" {
+data "aws_ami" "sles_15" {
   most_recent = true
   for_each    = local.architectures
 
-  # Currently latest latest point release-1
   filter {
     name   = "name"
-    values = ["RHEL-8.8*HVM-20*"]
+    values = ["suse-sles-15-sp6-v*-hvm-*"]
+  }
+
+  filter {
+    name   = "architecture"
+    values = [each.value]
+  }
+
+  owners = [local.suse_owner_id]
+}
+
+data "aws_ami" "ubuntu_2204" {
+  most_recent = true
+  for_each    = local.architectures
+
+  filter {
+    name   = "name"
+    values = ["ubuntu/images/hvm-ssd/ubuntu-*-22.04-*-server-*"]
   }
 
   filter {
@@ -140,17 +215,16 @@ data "aws_ami" "rhel_88" {
     values = [each.value]
   }
 
-  owners = [local.rhel_owner_id]
+  owners = [local.canonical_owner_id]
 }
 
-data "aws_ami" "rhel_91" {
+data "aws_ami" "ubuntu_2404" {
   most_recent = true
   for_each    = local.architectures
 
-  # Currently latest latest point release-1
   filter {
     name   = "name"
-    values = ["RHEL-9.1*HVM-20*"]
+    values = ["ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-*-server-*"]
   }
 
   filter {
@@ -163,7 +237,7 @@ data "aws_ami" "rhel_91" {
     values = [each.value]
   }
 
-  owners = [local.rhel_owner_id]
+  owners = [local.canonical_owner_id]
 }
 
 data "aws_region" "current" {}
diff --git a/enos/modules/generate_dr_operation_token/main.tf b/enos/modules/generate_dr_operation_token/main.tf
new file mode 100644
index 00000000000..9efa4d08040
--- /dev/null
+++ b/enos/modules/generate_dr_operation_token/main.tf
@@ -0,0 +1,82 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.4.3"
+    }
+  }
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "primary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The primary cluster leader host"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+variable "storage_backend" {
+  type        = string
+  description = "The storage backend to use for the Vault cluster"
+}
+
+locals {
+  token_id           = random_uuid.token_id.id
+  dr_operation_token = enos_remote_exec.fetch_dr_operation_token.stdout
+}
+
+resource "random_uuid" "token_id" {}
+
+resource "enos_remote_exec" "fetch_dr_operation_token" {
+  depends_on = [random_uuid.token_id]
+  environment = {
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
+    STORAGE_BACKEND   = var.storage_backend
+  }
+
+  scripts = [abspath("${path.module}/scripts/configure-vault-dr-primary.sh")]
+
+  transport = {
+    ssh = {
+      host = var.primary_leader_host.public_ip
+    }
+  }
+}
+
+output "dr_operation_token" {
+  value = local.dr_operation_token
+}
diff --git a/enos/modules/generate_dr_operation_token/scripts/configure-vault-dr-primary.sh b/enos/modules/generate_dr_operation_token/scripts/configure-vault-dr-primary.sh
new file mode 100755
index 00000000000..ab185dcfc81
--- /dev/null
+++ b/enos/modules/generate_dr_operation_token/scripts/configure-vault-dr-primary.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+binpath="${VAULT_INSTALL_DIR}/vault"
+
+fail() {
+  echo "$1" >&2
+  exit 1
+}
+
+# Check required environment variables
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$STORAGE_BACKEND" ]] && fail "STORAGE_BACKEND env variable has not been set"
+
+# Define the policy content
+policy_content() {
+  cat << EOF
+path "sys/replication/dr/secondary/promote" {
+  capabilities = [ "update" ]
+}
+
+path "sys/replication/dr/secondary/update-primary" {
+  capabilities = [ "update" ]
+}
+EOF
+  if [ "$STORAGE_BACKEND" = "raft" ]; then
+    cat << EOF
+path "sys/storage/raft/autopilot/state" {
+  capabilities = [ "update", "read" ]
+}
+EOF
+  fi
+}
+
+# Write the policy
+$binpath policy write dr-secondary-promotion - <<< "$(policy_content)"  &> /dev/null
+
+# Configure the failover handler token role
+$binpath write auth/token/roles/failover-handler \
+  allowed_policies=dr-secondary-promotion \
+  orphan=true \
+  renewable=false \
+  token_type=batch &> /dev/null
+
+# Create a token for the failover handler role and output the token only
+$binpath token create -field=token -role=failover-handler -ttl=8h
diff --git a/enos/modules/generate_failover_secondary_token/main.tf b/enos/modules/generate_failover_secondary_token/main.tf
new file mode 100644
index 00000000000..8ec25052fc9
--- /dev/null
+++ b/enos/modules/generate_failover_secondary_token/main.tf
@@ -0,0 +1,98 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.4.3"
+    }
+  }
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "primary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The primary cluster leader host"
+}
+
+variable "retry_interval" {
+  type        = string
+  default     = "2"
+  description = "How long to wait between retries"
+}
+
+variable "secondary_public_key" {
+  type        = string
+  description = "The secondary public key"
+}
+
+variable "timeout" {
+  type        = string
+  default     = "15"
+  description = "How many seconds to wait before timing out"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+locals {
+  primary_leader_addr = var.ip_version == 6 ? var.primary_leader_host.ipv6 : var.primary_leader_host.private_ip
+  token_id            = random_uuid.token_id.id
+  secondary_token     = enos_remote_exec.fetch_secondary_token.stdout
+}
+
+resource "random_uuid" "token_id" {}
+
+resource "enos_remote_exec" "fetch_secondary_token" {
+  depends_on = [random_uuid.token_id]
+  environment = {
+    VAULT_ADDR           = var.vault_addr
+    VAULT_TOKEN          = var.vault_root_token
+    RETRY_INTERVAL       = var.retry_interval
+    TIMEOUT_SECONDS      = var.timeout
+    SECONDARY_PUBLIC_KEY = var.secondary_public_key
+    VAULT_INSTALL_DIR    = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/scripts/generate-failover-secondary-token.sh")]
+
+
+  transport = {
+    ssh = {
+      host = var.primary_leader_host.public_ip
+    }
+  }
+}
+
+output "secondary_token" {
+  value = local.secondary_token
+}
diff --git a/enos/modules/generate_failover_secondary_token/scripts/generate-failover-secondary-token.sh b/enos/modules/generate_failover_secondary_token/scripts/generate-failover-secondary-token.sh
new file mode 100644
index 00000000000..5a338e15f9e
--- /dev/null
+++ b/enos/modules/generate_failover_secondary_token/scripts/generate-failover-secondary-token.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+## Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+[[ -z "${VAULT_INSTALL_DIR}" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "${RETRY_INTERVAL}" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "${TIMEOUT_SECONDS}" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+[[ -z "${VAULT_ADDR}" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "${VAULT_TOKEN}" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "${SECONDARY_PUBLIC_KEY}" ]] && fail "SECONDARY_PUBLIC_KEY env variable has not been set"
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+binpath="${VAULT_INSTALL_DIR}"/vault
+test -x "${binpath}" || fail "unable to locate vault binary at ${binpath}"
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [ "$(date +%s)" -lt "${end_time}" ]; do
+  if secondary_token=$(${binpath} write -field token sys/replication/dr/primary/secondary-token id="${VAULT_TOKEN}" secondary_public_key="${SECONDARY_PUBLIC_KEY}"); then
+    echo "${secondary_token}"
+    exit 0
+  fi
+
+  sleep "${RETRY_INTERVAL}"
+done
+
+fail "Timed out trying to generate secondary token"
diff --git a/enos/modules/generate_secondary_public_key/main.tf b/enos/modules/generate_secondary_public_key/main.tf
new file mode 100644
index 00000000000..b4bd5588ac4
--- /dev/null
+++ b/enos/modules/generate_secondary_public_key/main.tf
@@ -0,0 +1,77 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = ">= 3.4.3"
+    }
+  }
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "primary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The primary cluster leader host"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+locals {
+  primary_leader_addr  = var.ip_version == 6 ? var.primary_leader_host.ipv6 : var.primary_leader_host.private_ip
+  token_id             = random_uuid.token_id.id
+  secondary_public_key = enos_remote_exec.fetch_secondary_public_key.stdout
+}
+
+resource "random_uuid" "token_id" {}
+
+resource "enos_remote_exec" "fetch_secondary_public_key" {
+  depends_on = [random_uuid.token_id]
+  environment = {
+    VAULT_ADDR  = var.vault_addr
+    VAULT_TOKEN = var.vault_root_token
+  }
+
+  inline = ["${var.vault_install_dir}/vault write -field secondary_public_key -f sys/replication/dr/secondary/generate-public-key"]
+
+  transport = {
+    ssh = {
+      host = var.primary_leader_host.public_ip
+    }
+  }
+}
+
+output "secondary_public_key" {
+  value = local.secondary_public_key
+}
diff --git a/enos/modules/generate_secondary_token/main.tf b/enos/modules/generate_secondary_token/main.tf
index d430fb4ddcf..10e750ab3a8 100644
--- a/enos/modules/generate_secondary_token/main.tf
+++ b/enos/modules/generate_secondary_token/main.tf
@@ -1,10 +1,10 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
     random = {
       source  = "hashicorp/random"
@@ -13,14 +13,43 @@ terraform {
   }
 }
 
-variable "vault_install_dir" {
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "primary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The primary cluster leader host"
+}
+
+variable "replication_type" {
   type        = string
-  description = "The directory where the Vault binary will be installed"
+  description = "The type of replication to perform"
+
+  validation {
+    condition     = contains(["dr", "performance"], var.replication_type)
+    error_message = "The replication_type must be either dr or performance"
+  }
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
 }
 
-variable "primary_leader_public_ip" {
+variable "vault_install_dir" {
   type        = string
-  description = "Vault primary cluster leader Public IP address"
+  description = "The directory where the Vault binary will be installed"
 }
 
 variable "vault_root_token" {
@@ -29,23 +58,25 @@ variable "vault_root_token" {
 }
 
 locals {
-  token_id        = random_uuid.token_id.id
-  secondary_token = enos_remote_exec.fetch_secondary_token.stdout
+  primary_leader_addr = var.ip_version == 6 ? var.primary_leader_host.ipv6 : var.primary_leader_host.private_ip
+  token_id            = random_uuid.token_id.id
+  secondary_token     = enos_remote_exec.fetch_secondary_token.stdout
 }
+
 resource "random_uuid" "token_id" {}
 
 resource "enos_remote_exec" "fetch_secondary_token" {
   depends_on = [random_uuid.token_id]
   environment = {
-    VAULT_ADDR  = "http://127.0.0.1:8200"
+    VAULT_ADDR  = var.vault_addr
     VAULT_TOKEN = var.vault_root_token
   }
 
-  inline = ["${var.vault_install_dir}/vault write sys/replication/performance/primary/secondary-token id=${local.token_id} |sed -n '/^wrapping_token:/p' |awk '{print $2}'"]
+  inline = ["${var.vault_install_dir}/vault write sys/replication/${var.replication_type}/primary/secondary-token id=${local.token_id} |sed -n '/^wrapping_token:/p' |awk '{print $2}'"]
 
   transport = {
     ssh = {
-      host = var.primary_leader_public_ip
+      host = var.primary_leader_host.public_ip
     }
   }
 }
diff --git a/enos/modules/get_local_metadata/main.tf b/enos/modules/get_local_metadata/main.tf
index 1cbf0b20332..3f12603e3eb 100644
--- a/enos/modules/get_local_metadata/main.tf
+++ b/enos/modules/get_local_metadata/main.tf
@@ -1,10 +1,10 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
diff --git a/enos/modules/get_local_metadata/scripts/build_date.sh b/enos/modules/get_local_metadata/scripts/build_date.sh
index ea63c74d8ed..d0b1c9cf6dd 100755
--- a/enos/modules/get_local_metadata/scripts/build_date.sh
+++ b/enos/modules/get_local_metadata/scripts/build_date.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -eu -o pipefail
diff --git a/enos/modules/get_local_metadata/scripts/version.sh b/enos/modules/get_local_metadata/scripts/version.sh
index 6b910c404e1..b44b271ac4b 100755
--- a/enos/modules/get_local_metadata/scripts/version.sh
+++ b/enos/modules/get_local_metadata/scripts/version.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -euo pipefail
@@ -75,22 +75,22 @@ function repo_root() {
 # Run Enos local
 function main() {
   case $1 in
-  version)
-    version
-  ;;
-  version-base)
-    version_base
-  ;;
-  version-pre)
-    version_pre
-  ;;
-  version-meta)
-    version_metadata
-  ;;
-  *)
-    echo "unknown sub-command" >&2
-    exit 1
-  ;;
+    version)
+      version
+      ;;
+    version-base)
+      version_base
+      ;;
+    version-pre)
+      version_pre
+      ;;
+    version-meta)
+      version_metadata
+      ;;
+    *)
+      echo "unknown sub-command" >&2
+      exit 1
+      ;;
   esac
 }
 
diff --git a/enos/modules/hcp/create_admin_token/main.tf b/enos/modules/hcp/create_admin_token/main.tf
new file mode 100644
index 00000000000..7396c2cfb23
--- /dev/null
+++ b/enos/modules/hcp/create_admin_token/main.tf
@@ -0,0 +1,23 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+variable "cluster_id" {
+  description = "The ID of the HCP Vault cluster."
+  type        = string
+}
+
+resource "hcp_vault_cluster_admin_token" "token" {
+  cluster_id = var.cluster_id
+}
+
+output "created_at" {
+  value = hcp_vault_cluster_admin_token.token.created_at
+}
+
+output "id" {
+  value = hcp_vault_cluster_admin_token.token.id
+}
+
+output "token" {
+  value = hcp_vault_cluster_admin_token.token.token
+}
diff --git a/enos/modules/hcp/create_vault_cluster/main.tf b/enos/modules/hcp/create_vault_cluster/main.tf
new file mode 100644
index 00000000000..2ec3ee728b1
--- /dev/null
+++ b/enos/modules/hcp/create_vault_cluster/main.tf
@@ -0,0 +1,156 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "cloud_provider" {
+  description = "The cloud provider of the HCP HVN and Vault cluster."
+  type        = string
+  default     = "aws"
+}
+
+variable "cloud_region" {
+  description = "The region of the HCP HVN and Vault cluster."
+  type        = string
+  default     = "us-west-2"
+}
+
+variable "maintenance_window_day" {
+  description = "The maintenance window day"
+  type        = string
+  default     = "FRIDAY"
+}
+
+variable "maintenance_window_time" {
+  description = "The maintenance window time"
+  type        = string
+  default     = "WINDOW_12PM_4PM"
+}
+
+variable "min_vault_version" {
+  description = "The minimum vault version. This also corresponds to the image id"
+  type        = string
+  default     = null
+}
+
+variable "tier" {
+  description = "Tier of the HCP Vault cluster. Valid options for tiers."
+  type        = string
+  // NOTE: we can't use dev for custom images
+  default = "plus_small"
+}
+
+variable "upgrade_type" {
+  description = "The upgrade strategy"
+  type        = string
+  default     = "MANUAL"
+}
+
+data "enos_environment" "localhost" {}
+
+resource "random_string" "id" {
+  length  = 4
+  lower   = true
+  upper   = false
+  numeric = false
+  special = false
+}
+
+locals {
+  // Generate a unique identifier for our scenario. If we've been given a
+  // min_vault_version we'll use that as it will likely be the version and
+  // a SHA of a custom image. Make sure it doesn't have special characters.
+  // Otherwise, just use a random string.
+  id = var.min_vault_version != null ? try(replace(var.min_vault_version, "/[^0-9A-Za-z]/", "-"), random_string.id.result) : random_string.id.result
+}
+
+resource "hcp_hvn" "default" {
+  hvn_id         = local.id
+  cloud_provider = var.cloud_provider
+  region         = var.cloud_region
+}
+
+resource "hcp_vault_cluster" "enos" {
+  depends_on = [
+    hcp_hvn.default,
+  ]
+
+  hvn_id            = local.id
+  cluster_id        = "enos-${local.id}"
+  tier              = var.tier
+  public_endpoint   = true
+  min_vault_version = var.min_vault_version
+
+  dynamic "ip_allowlist" {
+    for_each = data.enos_environment.localhost.public_ipv4_addresses
+    content {
+      address = "${ip_allowlist.value}/32"
+    }
+  }
+
+  /*
+  major_version_upgrade_config {
+    maintenance_window_day  = var.maintenance_window_day
+    maintenance_window_time = var.maintenance_window_time
+    upgrade_type            = var.upgrade_type
+  }
+  */
+}
+
+output "cloud_provider" {
+  value = hcp_vault_cluster.enos.cloud_provider
+}
+
+output "cluster_id" {
+  value = hcp_vault_cluster.enos.cluster_id
+}
+
+output "created_at" {
+  value = hcp_vault_cluster.enos.created_at
+}
+
+output "id" {
+  value = hcp_vault_cluster.enos.id
+}
+
+output "namespace" {
+  value = hcp_vault_cluster.enos.namespace
+}
+
+output "organization_id" {
+  value = hcp_vault_cluster.enos.organization_id
+}
+
+output "region" {
+  value = hcp_vault_cluster.enos.region
+}
+
+output "self_link" {
+  value = hcp_vault_cluster.enos.self_link
+}
+
+output "state" {
+  value = hcp_vault_cluster.enos.state
+}
+
+output "vault_private_endpoint_url" {
+  value = hcp_vault_cluster.enos.vault_private_endpoint_url
+}
+
+output "vault_proxy_endpoint_url" {
+  value = hcp_vault_cluster.enos.vault_proxy_endpoint_url
+}
+
+output "vault_public_endpoint_url" {
+  value = hcp_vault_cluster.enos.vault_public_endpoint_url
+}
+
+output "vault_version" {
+  value = hcp_vault_cluster.enos.vault_version
+}
diff --git a/enos/modules/install_packages/main.tf b/enos/modules/install_packages/main.tf
index a9703cc14f0..9fb59f1a10b 100644
--- a/enos/modules/install_packages/main.tf
+++ b/enos/modules/install_packages/main.tf
@@ -1,10 +1,34 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+locals {
+  arch = {
+    "amd64" = "x86_64"
+    "arm64" = "aarch64"
+  }
+  package_manager = {
+    "amzn"          = "yum"
+    "opensuse-leap" = "zypper"
+    "rhel"          = "dnf"
+    "sles"          = "zypper"
+    "ubuntu"        = "apt"
+  }
+  distro_repos = {
+    "sles" = {
+      "15.6" = "https://download.opensuse.org/repositories/network:utilities/SLE_15_SP6/network:utilities.repo"
+    }
+    "rhel" = {
+      "8.10" = "https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm"
+      "9.6"  = "https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm"
+      "10.0" = "https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm"
     }
   }
 }
@@ -16,6 +40,7 @@ variable "packages" {
 
 variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
@@ -24,7 +49,7 @@ variable "hosts" {
 
 variable "timeout" {
   type        = number
-  description = "The max number of seconds to wait before timing out"
+  description = "The max number of seconds to wait before timing out. This is applied to each step so total timeout will be longer."
   default     = 120
 }
 
@@ -34,10 +59,69 @@ variable "retry_interval" {
   default     = 2
 }
 
+resource "enos_host_info" "hosts" {
+  for_each = var.hosts
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+# Synchronize repositories on remote machines. This does not update packages but only ensures that
+# the remote hosts are configured with default upstream repositories that have been refreshed to
+# the latest metedata.
+resource "enos_remote_exec" "synchronize_repos" {
+  for_each = var.hosts
+
+  environment = {
+    DISTRO          = enos_host_info.hosts[each.key].distro
+    PACKAGE_MANAGER = local.package_manager[enos_host_info.hosts[each.key].distro]
+    RETRY_INTERVAL  = var.retry_interval
+    TIMEOUT_SECONDS = var.timeout
+  }
+
+  scripts = [abspath("${path.module}/scripts/synchronize-repos.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+# Add any additional repositories.
+resource "enos_remote_exec" "add_repos" {
+  for_each   = var.hosts
+  depends_on = [enos_remote_exec.synchronize_repos]
+
+  environment = {
+    DISTRO_REPOS    = try(local.distro_repos[enos_host_info.hosts[each.key].distro][enos_host_info.hosts[each.key].distro_version], "__none")
+    PACKAGE_MANAGER = local.package_manager[enos_host_info.hosts[each.key].distro]
+    RETRY_INTERVAL  = var.retry_interval
+    TIMEOUT_SECONDS = var.timeout
+  }
+
+  scripts = [abspath("${path.module}/scripts/add-repos.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+# Install any required packages.
 resource "enos_remote_exec" "install_packages" {
   for_each = var.hosts
+  depends_on = [
+    enos_remote_exec.synchronize_repos,
+    enos_remote_exec.add_repos,
+  ]
 
   environment = {
+    PACKAGE_MANAGER = local.package_manager[enos_host_info.hosts[each.key].distro]
     PACKAGES        = length(var.packages) >= 1 ? join(" ", var.packages) : "__skip"
     RETRY_INTERVAL  = var.retry_interval
     TIMEOUT_SECONDS = var.timeout
diff --git a/enos/modules/install_packages/scripts/add-repos.sh b/enos/modules/install_packages/scripts/add-repos.sh
new file mode 100644
index 00000000000..9197f6fedbb
--- /dev/null
+++ b/enos/modules/install_packages/scripts/add-repos.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "${PACKAGE_MANAGER}" ]] && fail "PACKAGE_MANAGER env variable has not been set"
+[[ -z "${RETRY_INTERVAL}" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "${TIMEOUT_SECONDS}" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+
+# Add any repositories that have have been passed in
+add_repos() {
+  # If we don't have any repos on the list for this distro, no action needed.
+  if [ ${#DISTRO_REPOS[@]} -lt 1 ]; then
+    echo "DISTRO_REPOS is empty; No repos required for the packages for this Linux distro."
+    return 0
+  fi
+
+  case $PACKAGE_MANAGER in
+    apt)
+      # NOTE: We do not currently add any apt repositories in our scenarios. I suspect if that time
+      # comes we'll need to add support for apt-key here.
+      for repo in ${DISTRO_REPOS}; do
+        if [ "$repo" == "__none" ]; then
+          continue
+        fi
+        sudo add-apt-repository "${repo}"
+      done
+      ;;
+    dnf)
+      for repo in ${DISTRO_REPOS}; do
+        if [ "$repo" == "__none" ]; then
+          continue
+        fi
+        sudo dnf install -y "${repo}"
+        sudo dnf makecache -y
+      done
+      ;;
+    yum)
+      for repo in ${DISTRO_REPOS}; do
+        if [ "$repo" == "__none" ]; then
+          continue
+        fi
+        sudo yum install -y "${repo}"
+        sudo yum makecache -y
+      done
+      ;;
+    zypper)
+      # Add each repo
+      for repo in ${DISTRO_REPOS}; do
+        if [ "$repo" == "__none" ]; then
+          continue
+        fi
+        if sudo zypper lr "${repo}"; then
+          echo "A repo named ${repo} already exists, skipping..."
+          continue
+        fi
+        sudo zypper --gpg-auto-import-keys --non-interactive addrepo "${repo}"
+      done
+      sudo zypper --gpg-auto-import-keys ref
+      sudo zypper --gpg-auto-import-keys refs
+      ;;
+    *)
+      fail "Unsupported package manager: ${PACKAGE_MANAGER}"
+      ;;
+  esac
+}
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [ "$(date +%s)" -lt "$end_time" ]; do
+  if add_repos; then
+    exit 0
+  fi
+
+  sleep "$RETRY_INTERVAL"
+done
+
+fail "Timed out waiting for distro repos to be set up"
diff --git a/enos/modules/install_packages/scripts/install-packages.sh b/enos/modules/install_packages/scripts/install-packages.sh
index 29868cd33d9..29e2abdb0a2 100644
--- a/enos/modules/install_packages/scripts/install-packages.sh
+++ b/enos/modules/install_packages/scripts/install-packages.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
@@ -9,41 +9,97 @@ fail() {
   exit 1
 }
 
-[[ -z "$RETRY_INTERVAL" ]] && fail "RETRY_INTERVAL env variable has not been set"
-[[ -z "$TIMEOUT_SECONDS" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
-[[ -z "$PACKAGES" ]] && fail "PACKAGES env variable has not been set"
+[[ -z "${RETRY_INTERVAL}" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "${TIMEOUT_SECONDS}" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+[[ -z "${PACKAGES}" ]] && fail "PACKAGES env variable has not been set"
+[[ -z "${PACKAGE_MANAGER}" ]] && fail "PACKAGE_MANAGER env variable has not been set"
 
+# Install packages based on the provided packages and package manager. We assume that the repositories
+# have already been synchronized by the repo setup that is a prerequisite for this script.
 install_packages() {
-  if [ "$PACKAGES" = "__skip" ]; then
+  if [[ "${PACKAGES}" = "__skip" ]]; then
     return 0
   fi
 
-  echo "Installing Dependencies: $PACKAGES"
-  if [ -f /etc/debian_version ]; then
-    # Do our best to make sure that we don't race with cloud-init. Wait a reasonable time until we
-    # see ec2 in the sources list. Very rarely cloud-init will take longer than we wait. In that case
-    # we'll just install our packages.
-    grep ec2 /etc/apt/sources.list || true
-
-    cd /tmp
-    sudo apt update
-    # shellcheck disable=2068
-    sudo apt install -y ${PACKAGES[@]}
-  else
-    cd /tmp
-    # shellcheck disable=2068
-    sudo yum -y install ${PACKAGES[@]}
-  fi
+  set -x
+  echo "Installing Dependencies: ${PACKAGES}"
+
+  # Use the default package manager of the current Linux distro to install packages
+  case $PACKAGE_MANAGER in
+    apt)
+      for package in ${PACKAGES}; do
+        if dpkg -s "${package}"; then
+          echo "Skipping installation of ${package} because it is already installed"
+          continue
+        else
+          echo "Installing ${package}"
+          local output
+          if ! output=$(sudo apt install -y "${package}" 2>&1); then
+            echo "Failed to install ${package}: ${output}" 1>&2
+            return 1
+          fi
+        fi
+      done
+      ;;
+    dnf)
+      for package in ${PACKAGES}; do
+        if rpm -q "${package}"; then
+          echo "Skipping installation of ${package} because it is already installed"
+          continue
+        else
+          echo "Installing ${package}"
+          local output
+          if ! output=$(sudo dnf -y install "${package}" 2>&1); then
+            echo "Failed to install ${package}: ${output}" 1>&2
+            return 1
+          fi
+        fi
+      done
+      ;;
+    yum)
+      for package in ${PACKAGES}; do
+        if rpm -q "${package}"; then
+          echo "Skipping installation of ${package} because it is already installed"
+          continue
+        else
+          echo "Installing ${package}"
+          local output
+          if ! output=$(sudo yum -y install "${package}" 2>&1); then
+            echo "Failed to install ${package}: ${output}" 1>&2
+            return 1
+          fi
+        fi
+      done
+      ;;
+    zypper)
+      for package in ${PACKAGES}; do
+        if rpm -q "${package}"; then
+          echo "Skipping installation of ${package} because it is already installed"
+          continue
+        else
+          echo "Installing ${package}"
+          local output
+          if ! output=$(sudo zypper --non-interactive install -y -l --force-resolution "${package}" 2>&1); then
+            echo "Failed to install ${package}: ${output}" 1>&2
+            return 1
+          fi
+        fi
+      done
+      ;;
+    *)
+      fail "No matching package manager provided."
+      ;;
+  esac
 }
 
 begin_time=$(date +%s)
 end_time=$((begin_time + TIMEOUT_SECONDS))
-while [ "$(date +%s)" -lt "$end_time" ]; do
+while [[ "$(date +%s)" -lt "${end_time}" ]]; do
   if install_packages; then
     exit 0
   fi
 
-  sleep "$RETRY_INTERVAL"
+  sleep "${RETRY_INTERVAL}"
 done
 
 fail "Timed out waiting for packages to install"
diff --git a/enos/modules/install_packages/scripts/synchronize-repos.sh b/enos/modules/install_packages/scripts/synchronize-repos.sh
new file mode 100644
index 00000000000..1abff86a0fe
--- /dev/null
+++ b/enos/modules/install_packages/scripts/synchronize-repos.sh
@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "${PACKAGE_MANAGER}" ]] && fail "PACKAGE_MANAGER env variable has not been set"
+[[ -z "${RETRY_INTERVAL}" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "${TIMEOUT_SECONDS}" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+
+# The SLES AMI's do not come configured with Zypper repositories by default. To get them you
+# have to run SUSEConnect to register the instance with SUSE. On the AMI this is handled
+# automatically by a oneshot systemd unit called guestregister.service. This oneshot service needs
+# to complete before any other repo or package steps are completed. At the time of writing it's very
+# unreliable so we have to ensure that it has correctly executed ourselves or restart it. We do this
+# by checking if the guestregister.service has reached the correct "inactive" state that we need.
+# If it hasn't reached that state it's usually in some sort of active state, i.e. running, or it has
+# failed. If it's in one of the active states we need to let it continue and check the status when
+# it completes. If it has completed but is failed we'll restart the service to re-run the script that
+# executes SUSEConnect.
+sles_check_guestregister_service_and_restart_if_failed() {
+  local active_state
+  local failed_state
+
+  # systemctl returns non-zero exit codes. We rely on output here because all states don't have
+  # their own exit code.
+  set +e
+  active_state=$(sudo systemctl is-active guestregister.service)
+  failed_state=$(sudo systemctl is-failed guestregister.service)
+  set -e
+
+  case "$active_state" in
+    active | activating | deactivating)
+      # It's running so we'll return 1 and get retried by the caller
+      echo "the guestregister.service is still in the ${active_state} state" 1>&2
+      return 1
+      ;;
+    *)
+      if [ "$active_state" == "inactive" ] && [ "$failed_state" == "inactive" ]; then
+        # The oneshot has completed and hasn't "failed"
+        echo "the guestregister.service is 'inactive' for both active and failed states"
+        return 0
+      fi
+
+      # Our service is stopped and failed, restart it and hope it works the next time
+      sudo systemctl restart --wait guestregister.service
+      ;;
+  esac
+}
+
+# Check or restart the guestregister service if it has failed. If it passes do another check to make
+# sure that the zypper repositories list isn't empty.
+sles_ensure_suseconnect() {
+  local health_output
+  if ! health_output=$(sles_check_guestregister_service_and_restart_if_failed); then
+    echo "the guestregister.service failed to reach a healthy state: ${health_output}" 1>&2
+    return 1
+  fi
+
+  # Make sure Zypper has repositories.
+  if ! lr_output=$(zypper lr); then
+    echo "The guestregister.service failed. Unable to SUSEConnect and thus have no Zypper repositories: ${lr_output}: ${health_output}." 1>&2
+    return 1
+  fi
+
+  return 0
+}
+
+# Synchronize our repositories so that futher installation steps are working with updated cache
+# and repo metadata.
+synchronize_repos() {
+  case $PACKAGE_MANAGER in
+    apt)
+      sudo apt update
+      ;;
+    dnf)
+      sudo dnf makecache
+      ;;
+    yum)
+      sudo yum makecache
+      ;;
+    zypper)
+      if [ "$DISTRO" == "sles" ]; then
+        if ! sles_ensure_suseconnect; then
+          return 1
+        fi
+      fi
+      sudo zypper --gpg-auto-import-keys --non-interactive ref
+      sudo zypper --gpg-auto-import-keys --non-interactive refs
+      ;;
+    *)
+      return 0
+      ;;
+  esac
+}
+
+# Function to check cloud-init status and retry on failure
+# Before we start to modify repositories and install packages we'll wait for cloud-init to finish
+# so it doesn't race with any of our package installations.
+# We run as sudo because Amazon Linux 2 throws Python 2.7 errors when running `cloud-init status` as
+# non-root user (known bug).
+wait_for_cloud_init() {
+  if output=$(sudo cloud-init status --wait); then
+    return 0
+  else
+    res=$?
+    case $res in
+      2)
+        {
+          echo "WARNING: cloud-init did not complete successfully but recovered."
+          echo "Exit code: $res"
+          echo "Output: $output"
+          echo "Here are the logs for the failure:"
+          cat /var/log/cloud-init-*
+        } 1>&2
+        return 0
+        ;;
+      *)
+        {
+          echo "cloud-init did not complete successfully."
+          echo "Exit code: $res"
+          echo "Output: $output"
+          echo "Here are the logs for the failure:"
+          cat /var/log/cloud-init-*
+        } 1>&2
+        return 1
+        ;;
+    esac
+  fi
+}
+
+# Wait for cloud-init if it exists
+type cloud-init && wait_for_cloud_init
+
+# Synchronizing repos
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [ "$(date +%s)" -lt "$end_time" ]; do
+  if synchronize_repos; then
+    exit 0
+  fi
+
+  sleep "$RETRY_INTERVAL"
+done
+
+fail "Timed out waiting for distro repos to be set up"
diff --git a/enos/modules/k8s_deploy_vault/main.tf b/enos/modules/k8s_deploy_vault/main.tf
index 4ae8611816f..73aee7fa79a 100644
--- a/enos/modules/k8s_deploy_vault/main.tf
+++ b/enos/modules/k8s_deploy_vault/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -6,7 +6,7 @@ terraform {
 
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
 
     helm = {
diff --git a/enos/modules/k8s_deploy_vault/variables.tf b/enos/modules/k8s_deploy_vault/variables.tf
index 9730f87a780..617c7a7b90b 100644
--- a/enos/modules/k8s_deploy_vault/variables.tf
+++ b/enos/modules/k8s_deploy_vault/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "context_name" {
diff --git a/enos/modules/k8s_vault_verify_build_date/main.tf b/enos/modules/k8s_vault_verify_build_date/main.tf
deleted file mode 100644
index 4433c98f6f7..00000000000
--- a/enos/modules/k8s_vault_verify_build_date/main.tf
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-terraform {
-  required_providers {
-    enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
-    }
-  }
-}
-
-locals {
-  vault_instances = toset([for idx in range(var.vault_instance_count) : tostring(idx)])
-}
-
-# Get the date from the vault status command      - status_date
-# Format the original status output with ISO-8601 - formatted_date
-# Format the original status output with awk      - awk_date
-# Compare the formatted outputs                   - date_comparison
-resource "enos_remote_exec" "status_date" {
-  for_each = local.vault_instances
-
-  transport = {
-    kubernetes = {
-      kubeconfig_base64 = var.kubeconfig_base64
-      context_name      = var.context_name
-      pod               = var.vault_pods[each.key].name
-      namespace         = var.vault_pods[each.key].namespace
-    }
-  }
-
-  inline = ["${var.vault_bin_path} status -format=json | grep build_date | cut -d \\\" -f 4"]
-}
-
-resource "enos_remote_exec" "formatted_date" {
-  for_each = local.vault_instances
-
-  transport = {
-    kubernetes = {
-      kubeconfig_base64 = var.kubeconfig_base64
-      context_name      = var.context_name
-      pod               = var.vault_pods[each.key].name
-      namespace         = var.vault_pods[each.key].namespace
-    }
-  }
-
-  inline = ["date -d \"${enos_remote_exec.status_date[each.key].stdout}\" -D '%Y-%m-%dT%H:%M:%SZ' -I"]
-}
-
-resource "enos_local_exec" "awk_date" {
-  for_each = local.vault_instances
-
-  inline = ["echo ${enos_remote_exec.status_date[each.key].stdout} | awk -F\"T\" '{printf $1}'"]
-}
-
-resource "enos_local_exec" "date_comparison" {
-  for_each = local.vault_instances
-
-  inline = ["[[ ${enos_local_exec.awk_date[each.key].stdout} == ${enos_remote_exec.formatted_date[each.key].stdout} ]] && echo \"Verification for build date format ${enos_remote_exec.status_date[each.key].stdout} succeeded\" || \"invalid build_date, must be formatted as RFC 3339: ${enos_remote_exec.status_date[each.key].stdout}\""]
-}
diff --git a/enos/modules/k8s_vault_verify_build_date/variables.tf b/enos/modules/k8s_vault_verify_build_date/variables.tf
deleted file mode 100644
index 4e1754ebe9f..00000000000
--- a/enos/modules/k8s_vault_verify_build_date/variables.tf
+++ /dev/null
@@ -1,36 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "vault_pods" {
-  type = list(object({
-    name      = string
-    namespace = string
-  }))
-  description = "The vault instances for the cluster to verify"
-}
-
-variable "vault_bin_path" {
-  type        = string
-  description = "The path to the vault binary"
-  default     = "/bin/vault"
-}
-
-variable "vault_root_token" {
-  type        = string
-  description = "The vault root token"
-}
-
-variable "kubeconfig_base64" {
-  type        = string
-  description = "The base64 encoded version of the Kubernetes configuration file"
-}
-
-variable "context_name" {
-  type        = string
-  description = "The name of the k8s context for Vault"
-}
diff --git a/enos/modules/k8s_vault_verify_replication/main.tf b/enos/modules/k8s_vault_verify_replication/main.tf
index 1d51135350c..db7e54dfe5a 100644
--- a/enos/modules/k8s_vault_verify_replication/main.tf
+++ b/enos/modules/k8s_vault_verify_replication/main.tf
@@ -1,11 +1,11 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
diff --git a/enos/modules/k8s_vault_verify_replication/scripts/smoke-verify-replication.sh b/enos/modules/k8s_vault_verify_replication/scripts/smoke-verify-replication.sh
index 96fdf6a3203..4f51b119155 100755
--- a/enos/modules/k8s_vault_verify_replication/scripts/smoke-verify-replication.sh
+++ b/enos/modules/k8s_vault_verify_replication/scripts/smoke-verify-replication.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 # The Vault replication smoke test, documented in
 # https://docs.google.com/document/d/16sjIk3hzFDPyY5A9ncxTZV_9gnpYSF1_Vx6UA1iiwgI/edit#heading=h.kgrxf0f1et25
 
diff --git a/enos/modules/k8s_vault_verify_replication/variables.tf b/enos/modules/k8s_vault_verify_replication/variables.tf
index 011ae9cf2b3..05d06ffd29d 100644
--- a/enos/modules/k8s_vault_verify_replication/variables.tf
+++ b/enos/modules/k8s_vault_verify_replication/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "vault_instance_count" {
diff --git a/enos/modules/k8s_vault_verify_ui/main.tf b/enos/modules/k8s_vault_verify_ui/main.tf
index 69165260f4e..525f1c676df 100644
--- a/enos/modules/k8s_vault_verify_ui/main.tf
+++ b/enos/modules/k8s_vault_verify_ui/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
@@ -6,7 +6,7 @@ terraform {
   required_providers {
     enos = {
       version = "> 0.4.0"
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
diff --git a/enos/modules/k8s_vault_verify_ui/scripts/smoke-verify-ui.sh b/enos/modules/k8s_vault_verify_ui/scripts/smoke-verify-ui.sh
index 4372a530865..8f36b57615d 100755
--- a/enos/modules/k8s_vault_verify_ui/scripts/smoke-verify-ui.sh
+++ b/enos/modules/k8s_vault_verify_ui/scripts/smoke-verify-ui.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
 fail() {
diff --git a/enos/modules/k8s_vault_verify_ui/variables.tf b/enos/modules/k8s_vault_verify_ui/variables.tf
index 3f000c54f85..69b143dbb13 100644
--- a/enos/modules/k8s_vault_verify_ui/variables.tf
+++ b/enos/modules/k8s_vault_verify_ui/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "vault_instance_count" {
diff --git a/enos/modules/k8s_vault_verify_version/main.tf b/enos/modules/k8s_vault_verify_version/main.tf
index 3faf497b29a..e7b88f3ba67 100644
--- a/enos/modules/k8s_vault_verify_version/main.tf
+++ b/enos/modules/k8s_vault_verify_version/main.tf
@@ -1,11 +1,11 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
diff --git a/enos/modules/k8s_vault_verify_version/scripts/get-status.sh b/enos/modules/k8s_vault_verify_version/scripts/get-status.sh
index 26c3c0d55d3..f3ae4e1f6da 100755
--- a/enos/modules/k8s_vault_verify_version/scripts/get-status.sh
+++ b/enos/modules/k8s_vault_verify_version/scripts/get-status.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env sh
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
 status=$(${VAULT_BIN_PATH} status -format=json)
diff --git a/enos/modules/k8s_vault_verify_version/scripts/smoke-verify-version.sh b/enos/modules/k8s_vault_verify_version/scripts/smoke-verify-version.sh
index 4e8fc944db9..21372ee8104 100755
--- a/enos/modules/k8s_vault_verify_version/scripts/smoke-verify-version.sh
+++ b/enos/modules/k8s_vault_verify_version/scripts/smoke-verify-version.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 # The Vault smoke test to verify the Vault version installed
 
 set -e
@@ -25,12 +24,12 @@ fi
 vault_expected_version="Vault v${EXPECTED_VERSION} (${VAULT_REVISION})"
 
 case "${VAULT_EDITION}" in
-  ce) version_expected="${vault_expected_version}${expected_build_date}";;
-  ent) version_expected="${vault_expected_version}${expected_build_date}";;
-  ent.hsm) version_expected="${vault_expected_version}${expected_build_date} (cgo)";;
-  ent.fips1402) version_expected="${vault_expected_version}${expected_build_date} (cgo)" ;;
-  ent.hsm.fips1402) version_expected="${vault_expected_version}${expected_build_date} (cgo)" ;;
-  *) fail "(${VAULT_EDITION}) does not match any known Vault editions"
+  ce) version_expected="${vault_expected_version}${expected_build_date}" ;;
+  ent) version_expected="${vault_expected_version}${expected_build_date}" ;;
+  ent.hsm) version_expected="${vault_expected_version}${expected_build_date} (cgo)" ;;
+  ent.fips1403) version_expected="${vault_expected_version}${expected_build_date} (cgo)" ;;
+  ent.hsm.fips1403) version_expected="${vault_expected_version}${expected_build_date} (cgo)" ;;
+  *) fail "(${VAULT_EDITION}) does not match any known Vault editions" ;;
 esac
 
 version_expected_nosha=$(echo "$version_expected" | awk '!($3="")' | sed 's/  / /' | sed -e 's/[[:space:]]*$//')
diff --git a/enos/modules/k8s_vault_verify_version/variables.tf b/enos/modules/k8s_vault_verify_version/variables.tf
index 05ca6608219..2ad663b1acb 100644
--- a/enos/modules/k8s_vault_verify_version/variables.tf
+++ b/enos/modules/k8s_vault_verify_version/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "vault_instance_count" {
diff --git a/enos/modules/k8s_vault_verify_write_data/main.tf b/enos/modules/k8s_vault_verify_write_data/main.tf
index 04a0f56fcf0..47cb2c96492 100644
--- a/enos/modules/k8s_vault_verify_write_data/main.tf
+++ b/enos/modules/k8s_vault_verify_write_data/main.tf
@@ -1,11 +1,11 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
diff --git a/enos/modules/k8s_vault_verify_write_data/variables.tf b/enos/modules/k8s_vault_verify_write_data/variables.tf
index 4e1754ebe9f..1994742d3ef 100644
--- a/enos/modules/k8s_vault_verify_write_data/variables.tf
+++ b/enos/modules/k8s_vault_verify_write_data/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "vault_instance_count" {
diff --git a/enos/modules/load_docker_image/main.tf b/enos/modules/load_docker_image/main.tf
index 76f2c928bea..59dc18bae62 100644
--- a/enos/modules/load_docker_image/main.tf
+++ b/enos/modules/load_docker_image/main.tf
@@ -1,10 +1,10 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
diff --git a/enos/modules/local_kind_cluster/main.tf b/enos/modules/local_kind_cluster/main.tf
index f9e71e487e2..89fc52f4e7b 100644
--- a/enos/modules/local_kind_cluster/main.tf
+++ b/enos/modules/local_kind_cluster/main.tf
@@ -1,10 +1,10 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
     random = {
       source  = "hashicorp/random"
diff --git a/enos/modules/read_license/main.tf b/enos/modules/read_license/main.tf
index 823714f5d0b..f3b7c02c087 100644
--- a/enos/modules/read_license/main.tf
+++ b/enos/modules/read_license/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "file_name" {}
diff --git a/enos/modules/replication_data/main.tf b/enos/modules/replication_data/main.tf
index dec96408373..f119785ffa1 100644
--- a/enos/modules/replication_data/main.tf
+++ b/enos/modules/replication_data/main.tf
@@ -1,70 +1,30 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 // An arithmetic module for calculating inputs and outputs for various replication steps.
 
-// Get the first follower out of the hosts set
-variable "follower_hosts" {
+variable "added_hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
   default = {}
 }
 
-output "follower_host_1" {
-  value = try(var.follower_hosts[0], null)
-}
-
-output "follower_public_ip_1" {
-  value = try(var.follower_hosts[0].public_ip, null)
-}
-
-output "follower_private_ip_1" {
-  value = try(var.follower_hosts[0].private_ip, null)
-}
-
-output "follower_host_2" {
-  value = try(var.follower_hosts[1], null)
-}
-
-output "follower_public_ip_2" {
-  value = try(var.follower_hosts[1].public_ip, null)
-}
-
-output "follower_private_ip_2" {
-  value = try(var.follower_hosts[1].private_ip, null)
-}
-
-// Calculate our remainder hosts after we've added and removed leader
 variable "initial_hosts" {
+  description = "The initial set of Vault cluster hosts before removing and adding hosts"
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
   default = {}
 }
 
-variable "initial_hosts_count" {
-  type    = number
-  default = 0
-}
-
-variable "added_hosts" {
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-  default = {}
-}
-
-variable "added_hosts_count" {
-  type    = number
-  default = 0
-}
-
 variable "removed_primary_host" {
   type = object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   })
@@ -73,6 +33,7 @@ variable "removed_primary_host" {
 
 variable "removed_follower_host" {
   type = object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   })
@@ -80,23 +41,9 @@ variable "removed_follower_host" {
 }
 
 locals {
-  remaining_hosts_count = max((var.initial_hosts_count + var.added_hosts_count - 2), 0)
-  indices               = [for idx in range(local.remaining_hosts_count) : idx]
-  remaining_initial     = setsubtract(values(var.initial_hosts), [var.removed_primary_host, var.removed_follower_host])
-  remaining_hosts_list  = tolist(setunion(values(var.added_hosts), local.remaining_initial))
-  remaining_hosts       = zipmap(local.indices, local.remaining_hosts_list)
-}
-
-output "remaining_initial_count" {
-  value = length(local.remaining_initial)
-}
-
-output "remaining_initial_hosts" {
-  value = local.remaining_initial
-}
-
-output "remaining_hosts_count" {
-  value = local.remaining_hosts_count
+  remaining_initial    = setsubtract(values(var.initial_hosts), [var.removed_primary_host, var.removed_follower_host])
+  remaining_hosts_list = tolist(setunion(values(var.added_hosts), local.remaining_initial))
+  remaining_hosts      = { for idx in range(length(local.remaining_hosts_list)) : idx => local.remaining_hosts_list[idx] }
 }
 
 output "remaining_hosts" {
diff --git a/enos/modules/restart_consul/main.tf b/enos/modules/restart_consul/main.tf
new file mode 100644
index 00000000000..2795d083052
--- /dev/null
+++ b/enos/modules/restart_consul/main.tf
@@ -0,0 +1,35 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The consul hosts"
+}
+
+resource "enos_remote_exec" "restart" {
+  for_each = var.hosts
+
+  scripts = [abspath("${path.module}/scripts/restart-consul.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
diff --git a/enos/modules/restart_consul/scripts/restart-consul.sh b/enos/modules/restart_consul/scripts/restart-consul.sh
new file mode 100755
index 00000000000..276a73c6711
--- /dev/null
+++ b/enos/modules/restart_consul/scripts/restart-consul.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+if ! out=$(sudo systemctl stop consul 2>&1); then
+  fail "failed to stop consul: $out: $(sudo systemctl status consul)"
+fi
+
+if ! out=$(sudo systemctl daemon-reload 2>&1); then
+  fail "failed to daemon-reload systemd: $out" 1>&2
+fi
+
+if ! out=$(sudo systemctl start consul 2>&1); then
+  fail "failed to start consul: $out: $(sudo systemctl status consul)"
+fi
diff --git a/enos/modules/restart_vault/main.tf b/enos/modules/restart_vault/main.tf
new file mode 100644
index 00000000000..5c98f32de41
--- /dev/null
+++ b/enos/modules/restart_vault/main.tf
@@ -0,0 +1,50 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault hosts"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault api address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the vault binary is installed"
+}
+
+resource "enos_remote_exec" "restart" {
+  for_each = var.hosts
+
+  environment = {
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/scripts/restart-vault.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
diff --git a/enos/modules/restart_vault/scripts/restart-vault.sh b/enos/modules/restart_vault/scripts/restart-vault.sh
new file mode 100644
index 00000000000..f91c9810427
--- /dev/null
+++ b/enos/modules/restart_vault/scripts/restart-vault.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+if ! out=$(sudo systemctl stop vault 2>&1); then
+  fail "failed to stop vault: $out: $(sudo systemctl status vault)"
+fi
+
+if ! out=$(sudo systemctl daemon-reload 2>&1); then
+  fail "failed to daemon-reload systemd: $out" 1>&2
+fi
+
+if ! out=$(sudo systemctl start vault 2>&1); then
+  fail "failed to start vault: $out: $(sudo systemctl status vault)"
+fi
+
+count=0
+retries=5
+while :; do
+  # Check the Vault seal status
+  status=$($binpath status)
+  code=$?
+
+  if [ $code == 0 ] || [ $code == 2 ]; then
+    # 0 is unsealed and 2 is running but sealed
+    echo "$status"
+    exit 0
+  fi
+
+  printf "Waiting for Vault cluster to be ready: status code: %s, status:\n%s\n" "$code" "$status" 2>&1
+
+  wait=$((3 ** count))
+  count=$((count + 1))
+  if [ "$count" -lt "$retries" ]; then
+      sleep "$wait"
+  else
+      fail "Timed out waiting for Vault node to be ready after restart"
+  fi
+done
diff --git a/enos/modules/seal_awskms/main.tf b/enos/modules/seal_awskms/main.tf
index fb4ea7eed43..a123f77bc7c 100644
--- a/enos/modules/seal_awskms/main.tf
+++ b/enos/modules/seal_awskms/main.tf
@@ -1,10 +1,10 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
diff --git a/enos/modules/seal_pkcs11/main.tf b/enos/modules/seal_pkcs11/main.tf
index dd308fce200..ecc3dd8717e 100644
--- a/enos/modules/seal_pkcs11/main.tf
+++ b/enos/modules/seal_pkcs11/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 /*
@@ -44,7 +44,7 @@ Now you should be able to configure Vault Enterprise seal stanza.
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
@@ -100,6 +100,13 @@ module "target" {
     amd64 = "t3a.small"
     arm64 = "t4g.small"
   }
+  ports_ingress = [
+    {
+      description = "SSH"
+      port        = 22
+      protocol    = "tcp"
+    },
+  ]
   // Make sure it's not too long as we use this for aws resources that size maximums that are easy
   // to hit.
   project_name = substr("vault-ci-softhsm-${local.id}", 0, 32)
diff --git a/enos/modules/seal_shamir/main.tf b/enos/modules/seal_shamir/main.tf
index afb492b25fd..f75a2aa7276 100644
--- a/enos/modules/seal_shamir/main.tf
+++ b/enos/modules/seal_shamir/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 # A shim seal module for shamir seals. For Shamir seals the enos_vault_init resource will take care
@@ -7,7 +7,7 @@
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
diff --git a/enos/modules/set_up_external_integration_target/main.tf b/enos/modules/set_up_external_integration_target/main.tf
new file mode 100755
index 00000000000..c24c230de7b
--- /dev/null
+++ b/enos/modules/set_up_external_integration_target/main.tf
@@ -0,0 +1,92 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+locals {
+  test_server_address = var.ip_version == "6" ? var.hosts[0].ipv6 : var.hosts[0].public_ip
+  ldap_server = {
+    domain      = "enos.com"
+    org         = "hashicorp"
+    admin_pw    = "password1"
+    version     = var.ldap_version
+    port        = var.ports.ldap.port
+    secure_port = var.ports.ldaps.port
+    ip_version  = var.ip_version
+    host        = var.hosts[0]
+  }
+  kmip_client = {
+    // The KMIP client configuration is used to connect to the KMIP server
+    // uses Percona (MySQL) as the KMIP client.
+    port = var.ports.mysql.port
+    host = var.hosts[0]
+  }
+}
+
+# Outputs
+output "state" {
+  value = {
+    ldap = local.ldap_server
+    kmip = local.kmip_client
+  }
+}
+
+# We run install_packages before we install Vault because for some combinations of
+# certain Linux distros and artifact types (e.g. SLES and RPM packages), there may
+# be packages that are required to perform Vault installation (e.g. openssl).
+module "install_packages" {
+  source   = "../install_packages"
+  hosts    = var.hosts
+  packages = var.packages
+}
+
+# Creating OpenLDAP Server using generic container script
+resource "enos_remote_exec" "setup_openldap" {
+  depends_on = [module.install_packages]
+
+  scripts = [abspath("${path.module}/scripts/start-container.sh")]
+
+  environment = {
+    CONTAINER_IMAGE = "docker.io/osixia/openldap:${local.ldap_server.version}"
+    CONTAINER_NAME  = "openldap"
+    CONTAINER_PORTS = "${local.ldap_server.port},${local.ldap_server.secure_port}"
+    CONTAINER_ENVS  = "LDAP_ORGANISATION=${local.ldap_server.org},LDAP_DOMAIN=${local.ldap_server.domain},LDAP_ADMIN_PASSWORD=${local.ldap_server.admin_pw}"
+  }
+
+  transport = {
+    ssh = {
+      host = local.ldap_server.host.public_ip
+    }
+  }
+}
+
+# Creating KMIP Server using generic container script
+resource "enos_remote_exec" "create_kmip" {
+  depends_on = [module.install_packages]
+
+  inline = [
+    "mkdir -p /tmp/kmip_temp"
+  ]
+
+  scripts = [abspath("${path.module}/scripts/start-container.sh")]
+
+  environment = {
+    CONTAINER_IMAGE   = "docker.io/percona/percona-server:8.0"
+    CONTAINER_NAME    = "kmip"
+    CONTAINER_VOLUMES = "/tmp/kmip_temp:/TEMP_DIR"
+    CONTAINER_ENVS    = "KMIP_ADDR=${local.test_server_address},MYSQL_ROOT_PASSWORD=testpassword"
+    CONTAINER_ARGS    = "--port ${var.ports.kmip.port}"
+  }
+
+  transport = {
+    ssh = {
+      host = local.kmip_client.host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/set_up_external_integration_target/scripts/start-container.sh b/enos/modules/set_up_external_integration_target/scripts/start-container.sh
new file mode 100755
index 00000000000..8fa00c894e3
--- /dev/null
+++ b/enos/modules/set_up_external_integration_target/scripts/start-container.sh
@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+    echo "$1" 1>&2
+    exit 1
+}
+
+show_help() {
+    cat << EOF
+Usage: $0 --image IMAGE [OPTIONS]
+
+Required:
+  --image IMAGE         Docker image to run (e.g., osixia/openldap:latest)
+
+Optional:
+  --name NAME           Container name (default: auto-generated)
+  --port PORT[:HOST_PORT]  Port mapping (can be used multiple times)
+  --env KEY=VALUE       Environment variable (can be used multiple times)
+  --volume SRC:DEST     Volume mount (can be used multiple times)
+  --container-cmd CMD   Container command (default: sudo podman)
+  --args ARGS           Additional arguments to pass to container run command
+  --help               Show this help message
+
+Examples:
+  # Basic LDAP setup
+  $0 --image osixia/openldap:latest --port 389 --port 636 --name openldap \\
+     --env LDAP_ORGANISATION="My Org" --env LDAP_DOMAIN="example.com"
+
+  # KMIP/Percona setup
+  $0 --image percona/percona-server:8.0 --name kmip \\
+     --volume "\$(pwd)":/TEMP_DIR --env MYSQL_ROOT_PASSWORD=testpassword \\
+     --args "--port 3306"
+
+EOF
+}
+
+# Default values
+CONTAINER_CMD="sudo podman"
+NAME=""
+DOCKER_IMAGE=""
+PORTS=()
+ENVS=()
+VOLUMES=()
+ADDITIONAL_ARGS=""
+
+# Check for environment variable configuration (Terraform style)
+if [[ -n "${CONTAINER_IMAGE}" ]]; then
+    DOCKER_IMAGE="${CONTAINER_IMAGE}"
+fi
+
+if [[ -n "${CONTAINER_NAME}" ]]; then
+    NAME="${CONTAINER_NAME}"
+fi
+
+if [[ -n "${CONTAINER_PORTS}" ]]; then
+    IFS=',' read -ra PORT_ARRAY <<< "${CONTAINER_PORTS}"
+    PORTS=("${PORT_ARRAY[@]}")
+fi
+
+if [[ -n "${CONTAINER_ENVS}" ]]; then
+    IFS=',' read -ra ENV_ARRAY <<< "${CONTAINER_ENVS}"
+    ENVS=("${ENV_ARRAY[@]}")
+fi
+
+if [[ -n "${CONTAINER_VOLUMES}" ]]; then
+    IFS=',' read -ra VOL_ARRAY <<< "${CONTAINER_VOLUMES}"
+    VOLUMES=("${VOL_ARRAY[@]}")
+fi
+
+if [[ -n "${CONTAINER_ARGS}" ]]; then
+    ADDITIONAL_ARGS="${CONTAINER_ARGS}"
+fi
+
+# Parse command line arguments (these will override environment variables)
+while [[ $# -gt 0 ]]; do
+    case $1 in
+    --image)
+        DOCKER_IMAGE="$2"
+        shift 2
+        ;;
+    --name)
+        NAME="$2"
+        shift 2
+        ;;
+    --port)
+        PORTS+=("$2")
+        shift 2
+        ;;
+    --env)
+        ENVS+=("$2")
+        shift 2
+        ;;
+    --volume)
+        VOLUMES+=("$2")
+        shift 2
+        ;;
+    --container-cmd)
+        CONTAINER_CMD="$2"
+        shift 2
+        ;;
+    --args)
+        ADDITIONAL_ARGS="$2"
+        shift 2
+        ;;
+    --help | -h)
+        show_help
+        exit 0
+        ;;
+    *)
+        fail "Unknown option: $1. Use --help for usage information."
+        ;;
+  esac
+done
+
+# Validate required parameters
+[[ -z "${DOCKER_IMAGE}" ]] && fail "Docker image is required. Use --image to specify."
+
+# Generate container name if not provided
+if [[ -z "${NAME}" ]]; then
+    NAME=$(echo "${DOCKER_IMAGE}" | sed 's/.*\///' | sed 's/:.*$//')
+    echo "Using auto-generated container name: ${NAME}"
+fi
+
+# Pull the Docker image
+echo "Pulling image: ${DOCKER_IMAGE}"
+${CONTAINER_CMD} pull "${DOCKER_IMAGE}"
+
+# Build the run command
+RUN_CMD="${CONTAINER_CMD} run -d --name ${NAME}"
+
+# Add port mappings
+for port in "${PORTS[@]}"; do
+  if [[ "${port}" == *":"* ]]; then
+        # Port mapping format: host_port:container_port
+        RUN_CMD="${RUN_CMD} -p ${port}"
+  else
+        # Same port for host and container
+        RUN_CMD="${RUN_CMD} -p ${port}:${port}"
+  fi
+done
+
+# Add environment variables
+for env in "${ENVS[@]}"; do
+    RUN_CMD="${RUN_CMD} -e ${env}"
+done
+
+# Add volume mounts
+for volume in "${VOLUMES[@]}"; do
+    RUN_CMD="${RUN_CMD} --volume ${volume}"
+done
+
+# Add the image
+RUN_CMD="${RUN_CMD} ${DOCKER_IMAGE}"
+
+# Add any additional arguments
+if [[ -n "${ADDITIONAL_ARGS}" ]]; then
+    RUN_CMD="${RUN_CMD} ${ADDITIONAL_ARGS}"
+fi
+
+# Execute the run command
+echo "Starting container with command:"
+echo "${RUN_CMD}"
+echo ""
+
+eval "${RUN_CMD}"
+
+echo "${NAME} container is now running!"
diff --git a/enos/modules/set_up_external_integration_target/variables.tf b/enos/modules/set_up_external_integration_target/variables.tf
new file mode 100644
index 00000000000..1a46fe2f4c9
--- /dev/null
+++ b/enos/modules/set_up_external_integration_target/variables.tf
@@ -0,0 +1,37 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+variable "hosts" {
+  description = "The target machines host addresses to use for the Vault cluster"
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+}
+
+variable "ip_version" {
+  type        = string
+  description = "IP Version (4 or 6)"
+  default     = "4"
+}
+
+variable "ports" {
+  description = "Port configuration for services"
+  type = map(object({
+    port        = string
+    description = string
+  }))
+}
+
+variable "ldap_version" {
+  type        = string
+  description = "OpenLDAP Server Version to use"
+  default     = "1.5.0"
+}
+
+variable "packages" {
+  type        = list(string)
+  description = "A list of packages to install via the target host package manager"
+  default     = []
+}
diff --git a/enos/modules/shutdown_multiple_nodes/main.tf b/enos/modules/shutdown_multiple_nodes/main.tf
index bc38030a6b1..819addb0b2f 100644
--- a/enos/modules/shutdown_multiple_nodes/main.tf
+++ b/enos/modules/shutdown_multiple_nodes/main.tf
@@ -1,20 +1,15 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "old_vault_instances" {
+variable "old_hosts" {
   type = map(object({
     private_ip = string
     public_ip  = string
@@ -22,18 +17,9 @@ variable "old_vault_instances" {
   description = "The vault cluster instances to be shutdown"
 }
 
-locals {
-  public_ips = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.old_vault_instances)[idx].public_ip
-      private_ip = values(var.old_vault_instances)[idx].private_ip
-    }
-  }
-}
-
 resource "enos_remote_exec" "shutdown_multiple_nodes" {
-  for_each = local.public_ips
-  inline   = ["sudo shutdown -H --no-wall; exit 0"]
+  for_each = var.old_hosts
+  inline   = ["sudo shutdown -P --no-wall; exit 0"]
 
   transport = {
     ssh = {
diff --git a/enos/modules/shutdown_node/main.tf b/enos/modules/shutdown_node/main.tf
index ab58d1e35e2..6969c0e6b90 100644
--- a/enos/modules/shutdown_node/main.tf
+++ b/enos/modules/shutdown_node/main.tf
@@ -1,25 +1,29 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "node_public_ip" {
-  type        = string
-  description = "Node Public IP address"
+variable "host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The node to shut down"
 }
 
 resource "enos_remote_exec" "shutdown_node" {
-  inline = ["sudo shutdown -H --no-wall; exit 0"]
+  inline = ["sudo shutdown -P --no-wall; exit 0"]
 
   transport = {
     ssh = {
-      host = var.node_public_ip
+      host = var.host.public_ip
     }
   }
 }
diff --git a/enos/modules/softhsm_create_vault_keys/main.tf b/enos/modules/softhsm_create_vault_keys/main.tf
index d43bef8638e..af528e1690e 100644
--- a/enos/modules/softhsm_create_vault_keys/main.tf
+++ b/enos/modules/softhsm_create_vault_keys/main.tf
@@ -1,10 +1,10 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
@@ -15,6 +15,7 @@ variable "cluster_id" {
 
 variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
@@ -22,11 +23,12 @@ variable "hosts" {
 }
 
 locals {
-  pin        = resource.random_string.pin.result
-  aes_label  = "vault_hsm_aes_${local.pin}"
-  hmac_label = "vault_hsm_hmac_${local.pin}"
-  target     = tomap({ "1" = var.hosts[0] })
-  token      = "${var.cluster_id}_${local.pin}"
+  pin             = resource.random_string.pin.result
+  aes_label       = "vault_hsm_aes_${local.pin}"
+  hmac_label      = "vault_hsm_hmac_${local.pin}"
+  seal_attributes = jsondecode(resource.enos_remote_exec.create_keys.stdout)
+  target          = tomap({ "0" = var.hosts[0] })
+  token           = "${var.cluster_id}_${local.pin}"
 }
 
 resource "random_string" "pin" {
@@ -95,10 +97,6 @@ resource "enos_remote_exec" "get_keys" {
   }
 }
 
-locals {
-  seal_attributes = jsondecode(resource.enos_remote_exec.create_keys.stdout)
-}
-
 output "seal_attributes" {
   description = "Seal device specific attributes. Contains all required keys for the seal stanza"
   value       = local.seal_attributes
diff --git a/enos/modules/softhsm_create_vault_keys/scripts/create-keys.sh b/enos/modules/softhsm_create_vault_keys/scripts/create-keys.sh
index 533a2de4efc..3e7e60789a8 100644
--- a/enos/modules/softhsm_create_vault_keys/scripts/create-keys.sh
+++ b/enos/modules/softhsm_create_vault_keys/scripts/create-keys.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
@@ -66,7 +66,7 @@ main() {
   fi
 
   # Return our seal configuration attributes as JSON
-  cat <<EOF
+  cat << EOF
 {
   "lib": "${so}",
   "slot": "${slot}",
diff --git a/enos/modules/softhsm_create_vault_keys/scripts/get-keys.sh b/enos/modules/softhsm_create_vault_keys/scripts/get-keys.sh
index 6409943f51f..31a8df75f77 100644
--- a/enos/modules/softhsm_create_vault_keys/scripts/get-keys.sh
+++ b/enos/modules/softhsm_create_vault_keys/scripts/get-keys.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
diff --git a/enos/modules/softhsm_distribute_vault_keys/main.tf b/enos/modules/softhsm_distribute_vault_keys/main.tf
index d32d36e0d90..3e76d7a9756 100644
--- a/enos/modules/softhsm_distribute_vault_keys/main.tf
+++ b/enos/modules/softhsm_distribute_vault_keys/main.tf
@@ -1,10 +1,10 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.4.9"
     }
   }
@@ -12,6 +12,7 @@ terraform {
 
 variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
@@ -26,6 +27,7 @@ variable "token_base64" {
 locals {
   // The user/group name for softhsm
   softhsm_groups = {
+    "amzn"   = "ods"
     "rhel"   = "ods"
     "ubuntu" = "softhsm"
   }
diff --git a/enos/modules/softhsm_distribute_vault_keys/scripts/distribute-token.sh b/enos/modules/softhsm_distribute_vault_keys/scripts/distribute-token.sh
index 95f896c756d..736884fb5bd 100644
--- a/enos/modules/softhsm_distribute_vault_keys/scripts/distribute-token.sh
+++ b/enos/modules/softhsm_distribute_vault_keys/scripts/distribute-token.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -ex
diff --git a/enos/modules/softhsm_init/main.tf b/enos/modules/softhsm_init/main.tf
index 55537c7eb2e..f00d9e7247b 100644
--- a/enos/modules/softhsm_init/main.tf
+++ b/enos/modules/softhsm_init/main.tf
@@ -1,10 +1,10 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.4.9"
     }
   }
@@ -12,6 +12,7 @@ terraform {
 
 variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
@@ -30,6 +31,7 @@ locals {
 
   // Where the default configuration is
   config_paths = {
+    "amzn"   = "/etc/softhsm2.conf"
     "rhel"   = "/etc/softhsm2.conf"
     "ubuntu" = "/etc/softhsm/softhsm2.conf"
   }
diff --git a/enos/modules/softhsm_init/scripts/init-softhsm.sh b/enos/modules/softhsm_init/scripts/init-softhsm.sh
index 82e620794d7..237d9d2af2d 100644
--- a/enos/modules/softhsm_init/scripts/init-softhsm.sh
+++ b/enos/modules/softhsm_init/scripts/init-softhsm.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
@@ -17,7 +17,7 @@ if [ "$SKIP" == "true" ]; then
   exit 0
 fi
 
-cat <<EOF | sudo tee "$CONFIG_PATH"
+cat << EOF | sudo tee "$CONFIG_PATH"
 directories.tokendir = $TOKEN_DIR
 objectstore.backend = file
 log.level = DEBUG
diff --git a/enos/modules/softhsm_install/main.tf b/enos/modules/softhsm_install/main.tf
index 6e53c613c53..6ce353d9ccf 100644
--- a/enos/modules/softhsm_install/main.tf
+++ b/enos/modules/softhsm_install/main.tf
@@ -1,16 +1,17 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
 variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
@@ -36,14 +37,51 @@ variable "timeout" {
 }
 
 locals {
-  packages = var.include_tools ? ["softhsm", "opensc"] : ["softhsm"]
+  packages = var.include_tools ? {
+    // These packages match the distros that are currently defined in the `ec2_info` module.
+    amzn = {
+      "2023" = ["softhsm", "opensc"]
+    }
+    rhel = {
+      "8.10" = ["softhsm", "opensc"]
+      "9.6"  = ["softhsm", "opensc"]
+      "10.0" = ["softhsm", "opensc"]
+    }
+    ubuntu = {
+      "22.04" = ["softhsm", "opensc"]
+      "24.04" = ["softhsm2", "opensc"]
+    }
+    } : {
+    amzn = {
+      "2023" = ["softhsm"]
+    }
+    rhel = {
+      "8.10" = ["softhsm"]
+      "9.6"  = ["softhsm"]
+      "10.0" = ["softhsm"]
+    }
+    ubuntu = {
+      "22.04" = ["softhsm"]
+      "24.04" = ["softhsm2"]
+    }
+  }
+}
+
+// Get the host information so we can ensure that we install the correct packages depending on the
+// distro and distro version
+resource "enos_host_info" "target" {
+  transport = {
+    ssh = {
+      host = var.hosts["0"].public_ip
+    }
+  }
 }
 
 module "install_softhsm" {
   source = "../install_packages"
 
   hosts    = var.hosts
-  packages = local.packages
+  packages = local.packages[enos_host_info.target.distro][enos_host_info.target.distro_version]
 }
 
 resource "enos_remote_exec" "find_shared_object" {
diff --git a/enos/modules/softhsm_install/scripts/find-shared-object.sh b/enos/modules/softhsm_install/scripts/find-shared-object.sh
index 4afaee8b16b..9dec73c529a 100644
--- a/enos/modules/softhsm_install/scripts/find-shared-object.sh
+++ b/enos/modules/softhsm_install/scripts/find-shared-object.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-## Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+## Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
diff --git a/enos/modules/start_vault/main.tf b/enos/modules/start_vault/main.tf
index 34c68515c7f..673aa5896dc 100644
--- a/enos/modules/start_vault/main.tf
+++ b/enos/modules/start_vault/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -6,23 +6,38 @@ terraform {
     # We need to specify the provider source in each module until we publish it
     # to the public registry
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
-      version = ">= 0.4.8"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
+      version = ">= 0.5.3"
     }
   }
 }
 
 locals {
+  api_addr_localhost = var.ip_version == 4 ? "http://127.0.0.1:${var.listener_port}" : "http://[::1]:${var.listener_port}"
+  api_addrs = tolist([for h in var.hosts : {
+    4 : "http://${h.public_ip}:${var.listener_port}",
+    6 : "http://[${h.ipv6}]:${var.listener_port}",
+  }])
+  api_addrs_internal = tolist([for h in var.hosts : {
+    4 : "http://${h.private_ip}:${var.listener_port}",
+    6 : "http://[${h.ipv6}]:${var.listener_port}",
+  }])
   bin_path = "${var.install_dir}/vault"
-  environment = local.seal_secondary == null ? var.environment : merge(
-    var.environment,
-    { VAULT_ENABLE_SEAL_HA_BETA : tobool(var.seal_ha_beta) },
-  )
+  cluster_addrs = tolist([for h in var.hosts : {
+    4 : "http://${h.public_ip}:${var.cluster_port}",
+    6 : "http://[${h.ipv6}]:${var.cluster_port}",
+  }])
+  cluster_addrs_internal = tolist([for h in var.hosts : {
+    4 : "http://${h.private_ip}:${var.cluster_port}",
+    6 : "http://[${h.ipv6}]:${var.cluster_port}",
+  }])
   // In order to get Terraform to plan we have to use collections with keys that are known at plan
   // time. Here we're creating locals that keep track of index values that point to our target hosts.
-  followers = toset(slice(local.instances, 1, length(local.instances)))
-  instances = [for idx in range(length(var.target_hosts)) : tostring(idx)]
-  leader    = toset(slice(local.instances, 0, 1))
+  followers                 = toset(slice(local.instances, 1, length(local.instances)))
+  instances                 = [for idx in range(length(var.hosts)) : tostring(idx)]
+  leader                    = toset(slice(local.instances, 0, 1))
+  listener_address          = var.ip_version == 4 ? "0.0.0.0:${var.listener_port}" : "[::]:${var.listener_port}"
+  prometheus_retention_time = var.enable_telemetry ? "24h" : "0"
   // Handle cases where we might have to distribute HSM tokens for the pkcs11 seal before starting
   // vault.
   token_base64           = try(lookup(var.seal_attributes, "token_base64", ""), "")
@@ -56,7 +71,9 @@ locals {
         // keys on a machines that have different shared object locations.
         merge(
           try({ for key, val in var.seal_attributes : key => val if key != "token_base64" && key != "token_dir" }, {}),
-          try({ lib = module.maybe_configure_hsm.lib }, {})
+          # Note: the below reference has to point to a specific instance of the maybe_configure_hsm
+          # module (in this case [0]) due to the maybe_configure_hsm module call using `count` to control whether it runs or not.
+          try({ lib = module.maybe_configure_hsm[0].lib }, {})
         ),
       )
     }
@@ -85,7 +102,9 @@ locals {
         },
         merge(
           try({ for key, val in var.seal_attributes_secondary : key => val if key != "token_base64" && key != "token_dir" }, {}),
-          try({ lib = module.maybe_configure_hsm_secondary.lib }, {})
+          # Note: the below reference has to point to a specific instance of the maybe_configure_hsm_secondary
+          # module (in this case [0]) due to the maybe_configure_hsm_secondary module call using `count` to control whether it runs or not.
+          try({ lib = module.maybe_configure_hsm_secondary[0].lib }, {})
         ),
       )
     }
@@ -94,8 +113,9 @@ locals {
       attributes = null
     }
   }
-  seal_secondary = local.seals_secondary[var.seal_type_secondary]
-  storage_config = [for idx, host in var.target_hosts : (var.storage_backend == "raft" ?
+  seal_secondary  = local.seals_secondary[var.seal_type_secondary]
+  storage_address = var.ip_version == 4 ? "0.0.0.0:${var.external_storage_port}" : "[::]:${var.external_storage_port}"
+  storage_attributes = [for idx, host in var.hosts : (var.storage_backend == "raft" ?
     merge(
       {
         node_id = "${var.storage_node_prefix}_${idx}"
@@ -103,10 +123,16 @@ locals {
       var.storage_backend_attrs
     ) :
     {
-      address = "127.0.0.1:8500"
+      address = local.storage_address
       path    = "vault"
     })
   ]
+  storage_retry_join = {
+    "raft" : {
+      auto_join : "provider=aws addr_type=${var.ip_version == 4 ? "private_v4" : "public_v6"} tag_key=${var.cluster_tag_key} tag_value=${var.cluster_name}",
+      auto_join_scheme : "http",
+    },
+  }
 }
 
 # You might be wondering why our start_vault module, which supports shamir, awskms, and pkcs11 seal
@@ -139,16 +165,18 @@ locals {
 # the key data that was passed in via seal attributes.
 module "maybe_configure_hsm" {
   source = "../softhsm_distribute_vault_keys"
+  count  = (var.seal_type == "pkcs11" || var.seal_type_secondary == "pkcs11") ? 1 : 0
 
-  hosts        = var.target_hosts
+  hosts        = var.hosts
   token_base64 = local.token_base64
 }
 
 module "maybe_configure_hsm_secondary" {
   source     = "../softhsm_distribute_vault_keys"
   depends_on = [module.maybe_configure_hsm]
+  count      = (var.seal_type == "pkcs11" || var.seal_type_secondary == "pkcs11") ? 1 : 0
 
-  hosts        = var.target_hosts
+  hosts        = var.hosts
   token_base64 = local.token_base64_secondary
 }
 
@@ -160,25 +188,36 @@ resource "enos_vault_start" "leader" {
 
   bin_path    = local.bin_path
   config_dir  = var.config_dir
-  environment = local.environment
+  config_mode = var.config_mode
+  environment = merge(var.environment, {
+    VAULT_DISABLE_MLOCK = var.disable_mlock
+  })
   config = {
-    api_addr     = "http://${var.target_hosts[each.value].private_ip}:8200"
-    cluster_addr = "http://${var.target_hosts[each.value].private_ip}:8201"
+    api_addr     = local.api_addrs_internal[tonumber(each.value)][var.ip_version]
+    cluster_addr = local.cluster_addrs_internal[tonumber(each.value)][var.ip_version]
     cluster_name = var.cluster_name
     listener = {
       type = "tcp"
       attributes = {
-        address     = "0.0.0.0:8200"
+        address     = local.listener_address
         tls_disable = "true"
       }
+      telemetry = {
+        unauthenticated_metrics_access = var.enable_telemetry
+      }
     }
     log_level = var.log_level
     storage = {
       type       = var.storage_backend
-      attributes = ({ for key, value in local.storage_config[each.key] : key => value })
+      attributes = local.storage_attributes[each.key]
+      retry_join = try(local.storage_retry_join[var.storage_backend], null)
     }
     seals = local.seals
     ui    = true
+    telemetry = {
+      prometheus_retention_time = local.prometheus_retention_time
+      disable_hostname          = true
+    }
   }
   license        = var.license
   manage_service = var.manage_service
@@ -187,7 +226,7 @@ resource "enos_vault_start" "leader" {
 
   transport = {
     ssh = {
-      host = var.target_hosts[each.value].public_ip
+      host = var.hosts[each.value].public_ip
     }
   }
 }
@@ -200,25 +239,36 @@ resource "enos_vault_start" "followers" {
 
   bin_path    = local.bin_path
   config_dir  = var.config_dir
-  environment = local.environment
+  config_mode = var.config_mode
+  environment = merge(var.environment, {
+    VAULT_DISABLE_MLOCK = var.disable_mlock
+  })
   config = {
-    api_addr     = "http://${var.target_hosts[each.value].private_ip}:8200"
-    cluster_addr = "http://${var.target_hosts[each.value].private_ip}:8201"
+    api_addr     = local.api_addrs_internal[tonumber(each.value)][var.ip_version]
+    cluster_addr = local.cluster_addrs_internal[tonumber(each.value)][var.ip_version]
     cluster_name = var.cluster_name
     listener = {
       type = "tcp"
       attributes = {
-        address     = "0.0.0.0:8200"
+        address     = local.listener_address
         tls_disable = "true"
       }
+      telemetry = {
+        unauthenticated_metrics_access = var.enable_telemetry
+      }
     }
     log_level = var.log_level
     storage = {
       type       = var.storage_backend
-      attributes = { for key, value in local.storage_config[each.key] : key => value }
+      attributes = { for key, value in local.storage_attributes[each.key] : key => value }
+      retry_join = try(local.storage_retry_join[var.storage_backend], null)
     }
     seals = local.seals
     ui    = true
+    telemetry = {
+      prometheus_retention_time = local.prometheus_retention_time
+      disable_hostname          = true
+    }
   }
   license        = var.license
   manage_service = var.manage_service
@@ -227,7 +277,7 @@ resource "enos_vault_start" "followers" {
 
   transport = {
     ssh = {
-      host = var.target_hosts[each.value].public_ip
+      host = var.hosts[each.value].public_ip
     }
   }
 }
diff --git a/enos/modules/start_vault/outputs.tf b/enos/modules/start_vault/outputs.tf
index b3107bc9d40..c5458afc813 100644
--- a/enos/modules/start_vault/outputs.tf
+++ b/enos/modules/start_vault/outputs.tf
@@ -1,11 +1,31 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
+output "api_addr_localhost" {
+  description = "The localhost API address"
+  value       = local.api_addr_localhost
+}
+
+output "api_addrs" {
+  description = "The external API addresses of all nodes the cluster"
+  value       = local.api_addrs
+}
+
 output "cluster_name" {
   description = "The Vault cluster name"
   value       = var.cluster_name
 }
 
+output "cluster_port" {
+  description = "The Vault cluster request forwarding listener port"
+  value       = var.cluster_port
+}
+
+output "external_storage_port" {
+  description = "The Vault cluster non-raft external storage port"
+  value       = var.external_storage_port
+}
+
 output "followers" {
   description = "The follower enos_vault_start resources"
   value       = enos_vault_start.followers
@@ -16,18 +36,28 @@ output "leader" {
   value       = enos_vault_start.leader
 }
 
+output "ipv6s" {
+  description = "Vault cluster target host ipv6s"
+  value       = [for host in var.hosts : host.ipv6]
+}
+
+output "listener_port" {
+  description = "The Vault cluster TCP listener port"
+  value       = var.listener_port
+}
+
 output "private_ips" {
   description = "Vault cluster target host private_ips"
-  value       = [for host in var.target_hosts : host.private_ip]
+  value       = [for host in var.hosts : host.private_ip]
 }
 
 output "public_ips" {
   description = "Vault cluster target host public_ips"
-  value       = [for host in var.target_hosts : host.public_ip]
+  value       = [for host in var.hosts : host.public_ip]
 }
 
-output "target_hosts" {
+output "hosts" {
   description = "The vault cluster instances that were created"
 
-  value = var.target_hosts
+  value = var.hosts
 }
diff --git a/enos/modules/start_vault/variables.tf b/enos/modules/start_vault/variables.tf
index 36608d74968..1889f5abcb6 100644
--- a/enos/modules/start_vault/variables.tf
+++ b/enos/modules/start_vault/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "cluster_name" {
@@ -6,24 +6,83 @@ variable "cluster_name" {
   description = "The Vault cluster name"
 }
 
+variable "cluster_port" {
+  type        = number
+  description = "The cluster port for Vault to listen on"
+  default     = 8201
+}
+
+variable "cluster_tag_key" {
+  type        = string
+  description = "The Vault cluster tag key"
+  default     = "retry_join"
+}
+
 variable "config_dir" {
   type        = string
   description = "The directory to use for Vault configuration"
   default     = "/etc/vault.d"
 }
 
+variable "config_mode" {
+  description = "The method to use when configuring Vault. When set to 'env' we will configure Vault using VAULT_ style environment variables if possible. When 'file' we'll use the HCL configuration file for all configuration options."
+  default     = "file"
+
+  validation {
+    condition     = contains(["env", "file"], var.config_mode)
+    error_message = "The config_mode must be either 'env' or 'file'. No other configuration modes are supported."
+  }
+}
+
+variable "disable_mlock" {
+  type        = bool
+  description = "Disable mlock for Vault process."
+  default     = false
+}
+
+variable "enable_telemetry" {
+  type        = bool
+  description = "Enable Vault telemetry"
+  default     = false
+}
+
 variable "environment" {
   description = "Optional Vault configuration environment variables to set starting Vault"
   type        = map(string)
   default     = null
 }
 
+variable "external_storage_port" {
+  type        = number
+  description = "The port to connect to when using external storage"
+  default     = 8500
+}
+
+variable "hosts" {
+  description = "The target machines host addresses to use for the Vault cluster"
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+}
+
 variable "install_dir" {
   type        = string
   description = "The directory where the vault binary will be installed"
   default     = "/opt/vault/bin"
 }
 
+variable "ip_version" {
+  type        = number
+  description = "The IP version to use for the Vault TCP listeners"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
 variable "license" {
   type        = string
   sensitive   = true
@@ -48,9 +107,10 @@ variable "manage_service" {
   default     = true
 }
 
-variable "seal_ha_beta" {
-  description = "Enable using Seal HA on clusters that meet minimum version requirements and are enterprise editions"
-  default     = true
+variable "listener_port" {
+  type        = number
+  description = "The port for Vault to listen on"
+  default     = 8200
 }
 
 variable "seal_alias" {
@@ -137,11 +197,3 @@ variable "storage_node_prefix" {
   description = "A prefix to use for each node in the Vault storage configuration"
   default     = "node"
 }
-
-variable "target_hosts" {
-  description = "The target machines host addresses to use for the Vault cluster"
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-}
diff --git a/enos/modules/stop_vault/main.tf b/enos/modules/stop_vault/main.tf
index 7a2c250818a..c82399ea7ff 100644
--- a/enos/modules/stop_vault/main.tf
+++ b/enos/modules/stop_vault/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -6,7 +6,7 @@ terraform {
     # We need to specify the provider source in each module until we publish it
     # to the public registry
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.4.0"
     }
   }
@@ -18,16 +18,17 @@ variable "service_name" {
   default     = "vault"
 }
 
-variable "target_hosts" {
+variable "hosts" {
   description = "The target machines host addresses to use for the Vault cluster"
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
 }
 
 resource "enos_remote_exec" "shutdown_multiple_nodes" {
-  for_each = var.target_hosts
+  for_each = var.hosts
   inline   = ["sudo systemctl stop ${var.service_name}.service; sleep 5"]
 
   transport = {
diff --git a/enos/modules/target_ec2_fleet/main.tf b/enos/modules/target_ec2_fleet/main.tf
index 983f71cf4e0..c916e042377 100644
--- a/enos/modules/target_ec2_fleet/main.tf
+++ b/enos/modules/target_ec2_fleet/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -6,7 +6,7 @@ terraform {
     # We need to specify the provider source in each module until we publish it
     # to the public registry
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.3.24"
     }
   }
@@ -335,4 +335,5 @@ data "aws_instance" "targets" {
   for_each = local.instances
 
   instance_id = aws_ec2_fleet.targets.fleet_instance_set[0].instance_ids[each.key]
+
 }
diff --git a/enos/modules/target_ec2_fleet/outputs.tf b/enos/modules/target_ec2_fleet/outputs.tf
index 1672a24179a..c5e93d6b144 100644
--- a/enos/modules/target_ec2_fleet/outputs.tf
+++ b/enos/modules/target_ec2_fleet/outputs.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 output "cluster_name" {
@@ -10,5 +10,11 @@ output "hosts" {
   value = { for idx in range(var.instance_count) : idx => {
     public_ip  = data.aws_instance.targets[idx].public_ip
     private_ip = data.aws_instance.targets[idx].private_ip
+    ipv6       = try(data.aws_instance.targets[idx].ipv6_addresses[0], null)
   } }
 }
+
+output "security_group_id" {
+  description = "The target security group ID"
+  value       = aws_security_group.target.id
+}
\ No newline at end of file
diff --git a/enos/modules/target_ec2_fleet/variables.tf b/enos/modules/target_ec2_fleet/variables.tf
index 606cf5c2984..ac26451bdd7 100644
--- a/enos/modules/target_ec2_fleet/variables.tf
+++ b/enos/modules/target_ec2_fleet/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "ami_id" {
@@ -26,6 +26,12 @@ variable "common_tags" {
   }
 }
 
+variable "disable_selinux" {
+  description = "Optionally disable SELinux for certain distros/versions"
+  type        = bool
+  default     = true
+}
+
 variable "instance_mem_min" {
   description = "The minimum amount of memory in mebibytes for each instance in the fleet. (1 MiB = 1024 bytes)"
   type        = number
diff --git a/enos/modules/target_ec2_instances/locals.tf b/enos/modules/target_ec2_instances/locals.tf
new file mode 100644
index 00000000000..0a1b377ef28
--- /dev/null
+++ b/enos/modules/target_ec2_instances/locals.tf
@@ -0,0 +1,11 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+locals {
+  hosts = { for idx in range(var.instance_count) : idx => {
+    ipv6       = try(aws_instance.targets[idx].ipv6_addresses[0], "")
+    public_ip  = aws_instance.targets[idx].public_ip
+    private_ip = aws_instance.targets[idx].private_ip
+    }
+  }
+}
diff --git a/enos/modules/target_ec2_instances/main.tf b/enos/modules/target_ec2_instances/main.tf
index fcc1b254f6f..dbc4fb0787d 100644
--- a/enos/modules/target_ec2_instances/main.tf
+++ b/enos/modules/target_ec2_instances/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -6,7 +6,7 @@ terraform {
     # We need to specify the provider source in each module until we publish it
     # to the public registry
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.3.24"
     }
   }
@@ -141,78 +141,21 @@ resource "aws_security_group" "target" {
   description = "Target instance security group"
   vpc_id      = var.vpc_id
 
-  # SSH traffic
-  ingress {
-    from_port = 22
-    to_port   = 22
-    protocol  = "tcp"
-    cidr_blocks = flatten([
-      formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
-      join(",", data.aws_vpc.vpc.cidr_block_associations.*.cidr_block),
-    ])
-  }
-
-  # Vault traffic
-  ingress {
-    from_port = 8200
-    to_port   = 8201
-    protocol  = "tcp"
-    cidr_blocks = flatten([
-      formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
-      join(",", data.aws_vpc.vpc.cidr_block_associations.*.cidr_block),
-      formatlist("%s/32", var.ssh_allow_ips)
-    ])
-  }
-
-  # Consul traffic
-  ingress {
-    from_port = 8300
-    to_port   = 8302
-    protocol  = "tcp"
-    cidr_blocks = flatten([
-      formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
-      join(",", data.aws_vpc.vpc.cidr_block_associations.*.cidr_block),
-    ])
-  }
-
-  ingress {
-    from_port = 8301
-    to_port   = 8302
-    protocol  = "udp"
-    cidr_blocks = flatten([
-      formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
-      join(",", data.aws_vpc.vpc.cidr_block_associations.*.cidr_block),
-    ])
-  }
-
-  ingress {
-    from_port = 8500
-    to_port   = 8503
-    protocol  = "tcp"
-    cidr_blocks = flatten([
-      formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
-      join(",", data.aws_vpc.vpc.cidr_block_associations.*.cidr_block),
-    ])
-  }
+  # External ingress
+  dynamic "ingress" {
+    for_each = var.ports_ingress
 
-  ingress {
-    from_port = 8600
-    to_port   = 8600
-    protocol  = "tcp"
-    cidr_blocks = flatten([
-      formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
-      join(",", data.aws_vpc.vpc.cidr_block_associations.*.cidr_block),
-    ])
-  }
-
-  ingress {
-    from_port = 8600
-    to_port   = 8600
-    protocol  = "udp"
-    cidr_blocks = flatten([
-      formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
-      join(",", data.aws_vpc.vpc.cidr_block_associations.*.cidr_block),
-    ])
+    content {
+      from_port = ingress.value.port
+      to_port   = ingress.value.port
+      protocol  = ingress.value.protocol
+      cidr_blocks = flatten([
+        formatlist("%s/32", data.enos_environment.localhost.public_ipv4_addresses),
+        join(",", data.aws_vpc.vpc.cidr_block_associations.*.cidr_block),
+        formatlist("%s/32", var.ssh_allow_ips)
+      ])
+      ipv6_cidr_blocks = data.aws_vpc.vpc.ipv6_cidr_block != "" ? [data.aws_vpc.vpc.ipv6_cidr_block] : null
+    }
   }
 
   # Internal traffic
@@ -225,10 +168,11 @@ resource "aws_security_group" "target" {
 
   # External traffic
   egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+    from_port        = 0
+    to_port          = 0
+    protocol         = "-1"
+    cidr_blocks      = ["0.0.0.0/0"]
+    ipv6_cidr_blocks = ["::/0"]
   }
 
   tags = merge(
@@ -242,12 +186,28 @@ resource "aws_security_group" "target" {
 resource "aws_instance" "targets" {
   for_each = local.instances
 
-  ami                    = var.ami_id
-  iam_instance_profile   = aws_iam_instance_profile.target.name
-  instance_type          = local.instance_type
-  key_name               = var.ssh_keypair
-  subnet_id              = data.aws_subnets.vpc.ids[tonumber(each.key) % length(data.aws_subnets.vpc.ids)]
-  vpc_security_group_ids = [aws_security_group.target.id]
+  ami                  = var.ami_id
+  iam_instance_profile = aws_iam_instance_profile.target.name
+  // Some scenarios (autopilot, pr_replication) shutdown instances to simulate failure. In those
+  // cases we should terminate the instance entirely rather than get stuck in stopped limbo.
+  instance_initiated_shutdown_behavior = "terminate"
+  instance_type                        = local.instance_type
+  key_name                             = var.ssh_keypair
+  subnet_id                            = data.aws_subnets.vpc.ids[tonumber(each.key) % length(data.aws_subnets.vpc.ids)]
+  vpc_security_group_ids               = [aws_security_group.target.id]
+  ebs_optimized                        = var.ebs_optimized
+
+  root_block_device {
+    encrypted   = true
+    iops        = var.root_volume_iops
+    volume_size = var.root_volume_size
+    volume_type = var.root_volume_type
+  }
+
+  metadata_options {
+    http_tokens   = "required"
+    http_endpoint = "enabled"
+  }
 
   tags = merge(
     var.common_tags,
@@ -257,3 +217,11 @@ resource "aws_instance" "targets" {
     },
   )
 }
+
+module "disable_selinux" {
+  depends_on = [aws_instance.targets]
+  source     = "../disable_selinux"
+  count      = var.disable_selinux == true ? 1 : 0
+
+  hosts = local.hosts
+}
diff --git a/enos/modules/target_ec2_instances/outputs.tf b/enos/modules/target_ec2_instances/outputs.tf
index b2bc75ce605..8781a1a36f5 100644
--- a/enos/modules/target_ec2_instances/outputs.tf
+++ b/enos/modules/target_ec2_instances/outputs.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 output "cluster_name" {
@@ -7,8 +7,10 @@ output "cluster_name" {
 
 output "hosts" {
   description = "The ec2 instance target hosts"
-  value = { for idx in range(var.instance_count) : idx => {
-    public_ip  = aws_instance.targets[idx].public_ip
-    private_ip = aws_instance.targets[idx].private_ip
-  } }
+  value       = local.hosts
 }
+
+output "security_group_id" {
+  description = "The target security group ID"
+  value       = aws_security_group.target.id
+}
\ No newline at end of file
diff --git a/enos/modules/target_ec2_instances/variables.tf b/enos/modules/target_ec2_instances/variables.tf
index dc4bfc6c273..8b2776d6a38 100644
--- a/enos/modules/target_ec2_instances/variables.tf
+++ b/enos/modules/target_ec2_instances/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "ami_id" {
@@ -24,6 +24,18 @@ variable "common_tags" {
   default     = { "Project" : "vault-ci" }
 }
 
+variable "disable_selinux" {
+  description = "Optionally disable SELinux for certain distros/versions"
+  type        = bool
+  default     = true
+}
+
+variable "ebs_optimized" {
+  description = "Apply EBS optimization and high throughput disks to maximize IO performance"
+  type        = bool
+  default     = false
+}
+
 variable "instance_count" {
   description = "The number of target instances to create"
   type        = number
@@ -42,11 +54,40 @@ variable "instance_types" {
   }
 }
 
+variable "ports_ingress" {
+  description = "Ports mappings to allow for ingress"
+  type = list(object({
+    description = string
+    port        = number
+    protocol    = string
+  }))
+}
+
 variable "project_name" {
   description = "A unique project name"
   type        = string
 }
 
+// These 3 root volume variables all default to null so that, if they're not specified, we use the AMI default
+// Note that for IOPs specifically, the ratio of IOPs to size for io1 disks is 50:1 and for io2 disks it's 1000:1
+variable "root_volume_iops" {
+  description = "The IOPS of the root volume"
+  type        = number
+  default     = null
+}
+
+variable "root_volume_size" {
+  description = "The size of the root volume"
+  type        = number
+  default     = null
+}
+
+variable "root_volume_type" {
+  description = "The type of the root volume"
+  type        = string
+  default     = null
+}
+
 variable "seal_key_names" {
   type        = list(string)
   description = "The key management seal key names"
diff --git a/enos/modules/target_ec2_shim/main.tf b/enos/modules/target_ec2_shim/main.tf
index 13c6f1d4d5c..ebb86409ac0 100644
--- a/enos/modules/target_ec2_shim/main.tf
+++ b/enos/modules/target_ec2_shim/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -6,7 +6,7 @@ terraform {
     # We need to specify the provider source in each module until we publish it
     # to the public registry
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.3.24"
     }
   }
@@ -16,6 +16,8 @@ variable "ami_id" { default = null }
 variable "cluster_name" { default = null }
 variable "cluster_tag_key" { default = null }
 variable "common_tags" { default = null }
+variable "disable_selinux" { default = true }
+variable "ebs_optimized" { default = false }
 variable "instance_count" { default = 3 }
 variable "instance_cpu_max" { default = null }
 variable "instance_cpu_min" { default = null }
@@ -23,7 +25,11 @@ variable "instance_mem_max" { default = null }
 variable "instance_mem_min" { default = null }
 variable "instance_types" { default = null }
 variable "max_price" { default = null }
+variable "ports_ingress" { default = null }
 variable "project_name" { default = null }
+variable "root_volume_iops" { default = null }
+variable "root_volume_size" { default = null }
+variable "root_volume_type" { default = null }
 variable "seal_key_names" { default = null }
 variable "ssh_allow_ips" { default = null }
 variable "ssh_keypair" { default = null }
@@ -45,5 +51,8 @@ output "hosts" {
   value = { for idx in range(var.instance_count) : idx => {
     public_ip  = "null-public-${idx}"
     private_ip = "null-private-${idx}"
+    ipv6       = "null-ipv6-${idx}"
   } }
 }
+
+output "security_group_id" { value = null }
diff --git a/enos/modules/target_ec2_spot_fleet/main.tf b/enos/modules/target_ec2_spot_fleet/main.tf
index 9c14de85c23..d6a2c2694d5 100644
--- a/enos/modules/target_ec2_spot_fleet/main.tf
+++ b/enos/modules/target_ec2_spot_fleet/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -6,7 +6,7 @@ terraform {
     # We need to specify the provider source in each module until we publish it
     # to the public registry
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.3.24"
     }
   }
@@ -454,3 +454,13 @@ data "aws_instance" "targets" {
 
   instance_id = data.aws_instances.targets.ids[each.key]
 }
+
+module "disable_selinux" {
+  source = "../disable_selinux"
+  count  = var.disable_selinux == true ? 1 : 0
+
+  hosts = { for idx in range(var.instance_count) : idx => {
+    public_ip  = aws_instance.targets[idx].public_ip
+    private_ip = aws_instance.targets[idx].private_ip
+  } }
+}
diff --git a/enos/modules/target_ec2_spot_fleet/outputs.tf b/enos/modules/target_ec2_spot_fleet/outputs.tf
index 1672a24179a..c5e93d6b144 100644
--- a/enos/modules/target_ec2_spot_fleet/outputs.tf
+++ b/enos/modules/target_ec2_spot_fleet/outputs.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 output "cluster_name" {
@@ -10,5 +10,11 @@ output "hosts" {
   value = { for idx in range(var.instance_count) : idx => {
     public_ip  = data.aws_instance.targets[idx].public_ip
     private_ip = data.aws_instance.targets[idx].private_ip
+    ipv6       = try(data.aws_instance.targets[idx].ipv6_addresses[0], null)
   } }
 }
+
+output "security_group_id" {
+  description = "The target security group ID"
+  value       = aws_security_group.target.id
+}
\ No newline at end of file
diff --git a/enos/modules/target_ec2_spot_fleet/variables.tf b/enos/modules/target_ec2_spot_fleet/variables.tf
index c2f5bb60926..216238b05c5 100644
--- a/enos/modules/target_ec2_spot_fleet/variables.tf
+++ b/enos/modules/target_ec2_spot_fleet/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "ami_id" {
@@ -26,6 +26,12 @@ variable "common_tags" {
   }
 }
 
+variable "disable_selinux" {
+  description = "Optionally disable SELinux for certain distros/versions"
+  type        = bool
+  default     = true
+}
+
 variable "instance_mem_min" {
   description = "The minimum amount of memory in mebibytes for each instance in the fleet. (1 MiB = 1024 bytes)"
   type        = number
diff --git a/enos/modules/vault_agent/main.tf b/enos/modules/vault_agent/main.tf
index 067781e4f55..d187f464a45 100644
--- a/enos/modules/vault_agent/main.tf
+++ b/enos/modules/vault_agent/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -7,11 +7,32 @@ terraform {
       source = "hashicorp/aws"
     }
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
+variable "ip_version" {
+  type        = number
+  default     = 4
+  description = "The IP version to use for the Vault TCP listeners"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_agent_port" {
+  type        = number
+  description = "The listener port number for the Vault Agent"
+}
+
 variable "vault_agent_template_destination" {
   type        = string
   description = "The destination of the template rendered by Agent"
@@ -27,35 +48,28 @@ variable "vault_root_token" {
   description = "The Vault root token"
 }
 
-variable "vault_instances" {
+variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
   description = "The Vault cluster instances that were created"
 }
 
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
 variable "vault_install_dir" {
   type        = string
   description = "The directory where the Vault binary will be installed"
 }
 
 locals {
-  vault_instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
+  agent_listen_addr = "${var.ip_version == 4 ? "127.0.0.1" : "[::1]"}:${var.vault_agent_port}"
 }
 
 resource "enos_remote_exec" "set_up_approle_auth_and_agent" {
   environment = {
+    AGENT_LISTEN_ADDR                = local.agent_listen_addr,
+    VAULT_ADDR                       = var.vault_addr,
     VAULT_INSTALL_DIR                = var.vault_install_dir,
     VAULT_TOKEN                      = var.vault_root_token,
     VAULT_AGENT_TEMPLATE_DESTINATION = var.vault_agent_template_destination,
@@ -66,7 +80,12 @@ resource "enos_remote_exec" "set_up_approle_auth_and_agent" {
 
   transport = {
     ssh = {
-      host = local.vault_instances[0].public_ip
+      host = var.hosts[0].public_ip
     }
   }
 }
+
+output "vault_agent_listen_addr" {
+  description = "The vault agent listen address"
+  value       = local.agent_listen_addr
+}
diff --git a/enos/modules/vault_agent/scripts/set-up-approle-and-agent.sh b/enos/modules/vault_agent/scripts/set-up-approle-and-agent.sh
index e939ea1d7cd..bd8eac98e32 100644
--- a/enos/modules/vault_agent/scripts/set-up-approle-and-agent.sh
+++ b/enos/modules/vault_agent/scripts/set-up-approle-and-agent.sh
@@ -1,22 +1,24 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
-binpath=${VAULT_INSTALL_DIR}/vault
-
 fail() {
   echo "$1" 1>&2
   return 1
 }
 
-test -x "$binpath" || fail "unable to locate vault binary at $binpath"
-
-export VAULT_ADDR='http://127.0.0.1:8200'
+[[ -z "$AGENT_LISTEN_ADDR" ]] && fail "AGENT_LISTEN_ADDR env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_AGENT_TEMPLATE_CONTENTS" ]] && fail "VAULT_AGENT_TEMPLATE_CONTENTS env variable has not been set"
+[[ -z "$VAULT_AGENT_TEMPLATE_DESTINATION" ]] && fail "VAULT_AGENT_TEMPLATE_DESTINATION env variable has not been set"
 [[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
 
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
 # If approle was already enabled, disable it as we're about to re-enable it (the || true is so we don't fail if it doesn't already exist)
 $binpath auth disable approle || true
 
@@ -43,7 +45,7 @@ cat > /tmp/vault-agent.hcl <<- EOM
 pid_file = "/tmp/pidfile"
 
 vault {
-  address = "http://127.0.0.1:8200"
+  address = "${VAULT_ADDR}"
   tls_skip_verify = true
   retry {
     num_retries = 10
@@ -56,7 +58,7 @@ cache {
 }
 
 listener "tcp" {
-  address = "127.0.0.1:8100"
+  address = "${AGENT_LISTEN_ADDR}"
   tls_disable = true
 }
 
@@ -92,4 +94,6 @@ pkill -F /tmp/pidfile || true
 rm "${VAULT_AGENT_TEMPLATE_DESTINATION}" || true
 
 # Run agent (it will kill itself when it finishes rendering the template)
-$binpath agent -config=/tmp/vault-agent.hcl > /tmp/agent-logs.txt 2>&1
+if ! $binpath agent -config=/tmp/vault-agent.hcl > /tmp/agent-logs.txt 2>&1; then
+  fail "failed to run vault agent: $(cat /tmp/agent-logs.txt)"
+fi
diff --git a/enos/modules/vault_artifactory_artifact/locals.tf b/enos/modules/vault_artifactory_artifact/locals.tf
deleted file mode 100644
index 77b45322791..00000000000
--- a/enos/modules/vault_artifactory_artifact/locals.tf
+++ /dev/null
@@ -1,51 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-locals {
-
-  // file name extensions for the install packages of vault for the various architectures, distributions and editions
-  package_extensions = {
-    amd64 = {
-      ubuntu = "-1_amd64.deb"
-      rhel   = "-1.x86_64.rpm"
-    }
-    arm64 = {
-      ubuntu = "-1_arm64.deb"
-      rhel   = "-1.aarch64.rpm"
-    }
-  }
-
-  // product_version --> artifact_version
-  artifact_version = replace(var.product_version, var.edition, "ent")
-
-  // file name prefixes for the install packages of vault for the various distributions and artifact types (package or bundle)
-  artifact_package_release_names = {
-    ubuntu = {
-      "ce"               = "vault_"
-      "ent"              = "vault-enterprise_",
-      "ent.fips1402"     = "vault-enterprise-fips1402_",
-      "ent.hsm"          = "vault-enterprise-hsm_",
-      "ent.hsm.fips1402" = "vault-enterprise-hsm-fips1402_",
-    },
-    rhel = {
-      "ce"               = "vault-"
-      "ent"              = "vault-enterprise-",
-      "ent.fips1402"     = "vault-enterprise-fips1402-",
-      "ent.hsm"          = "vault-enterprise-hsm-",
-      "ent.hsm.fips1402" = "vault-enterprise-hsm-fips1402-",
-    }
-  }
-
-  // edition --> artifact name edition
-  artifact_name_edition = {
-    "ce"               = ""
-    "ent"              = ""
-    "ent.hsm"          = ".hsm"
-    "ent.fips1402"     = ".fips1402"
-    "ent.hsm.fips1402" = ".hsm.fips1402"
-  }
-
-  artifact_name_prefix    = var.artifact_type == "package" ? local.artifact_package_release_names[var.distro][var.edition] : "vault_"
-  artifact_name_extension = var.artifact_type == "package" ? local.package_extensions[var.arch][var.distro] : "_linux_${var.arch}.zip"
-  artifact_name           = var.artifact_type == "package" ? "${local.artifact_name_prefix}${replace(local.artifact_version, "-", "~")}${local.artifact_name_extension}" : "${local.artifact_name_prefix}${var.product_version}${local.artifact_name_extension}"
-}
diff --git a/enos/modules/vault_artifactory_artifact/main.tf b/enos/modules/vault_artifactory_artifact/main.tf
deleted file mode 100644
index 4fe3ba2ce1c..00000000000
--- a/enos/modules/vault_artifactory_artifact/main.tf
+++ /dev/null
@@ -1,25 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-terraform {
-  required_providers {
-    enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
-      version = ">= 0.2.3"
-    }
-  }
-}
-
-data "enos_artifactory_item" "vault" {
-  username = var.artifactory_username
-  token    = var.artifactory_token
-  name     = local.artifact_name
-  host     = var.artifactory_host
-  repo     = var.artifactory_repo
-  path     = var.edition == "ce" ? "vault/*" : "vault-enterprise/*"
-  properties = tomap({
-    "commit"          = var.revision
-    "product-name"    = var.edition == "ce" ? "vault" : "vault-enterprise"
-    "product-version" = local.artifact_version
-  })
-}
diff --git a/enos/modules/vault_artifactory_artifact/outputs.tf b/enos/modules/vault_artifactory_artifact/outputs.tf
deleted file mode 100644
index d05b5bf7959..00000000000
--- a/enos/modules/vault_artifactory_artifact/outputs.tf
+++ /dev/null
@@ -1,32 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-output "url" {
-  value       = data.enos_artifactory_item.vault.results[0].url
-  description = "The artifactory download url for the artifact"
-}
-
-output "sha256" {
-  value       = data.enos_artifactory_item.vault.results[0].sha256
-  description = "The sha256 checksum for the artifact"
-}
-
-output "size" {
-  value       = data.enos_artifactory_item.vault.results[0].size
-  description = "The size in bytes of the artifact"
-}
-
-output "name" {
-  value       = data.enos_artifactory_item.vault.results[0].name
-  description = "The name of the artifact"
-}
-
-output "vault_artifactory_release" {
-  value = {
-    url      = data.enos_artifactory_item.vault.results[0].url
-    sha256   = data.enos_artifactory_item.vault.results[0].sha256
-    username = var.artifactory_username
-    token    = var.artifactory_token
-  }
-}
diff --git a/enos/modules/vault_artifactory_artifact/variables.tf b/enos/modules/vault_artifactory_artifact/variables.tf
deleted file mode 100644
index a2d9042af53..00000000000
--- a/enos/modules/vault_artifactory_artifact/variables.tf
+++ /dev/null
@@ -1,37 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-variable "artifactory_username" {
-  type        = string
-  description = "The username to use when connecting to artifactory"
-  default     = null
-}
-
-variable "artifactory_token" {
-  type        = string
-  description = "The token to use when connecting to artifactory"
-  default     = null
-  sensitive   = true
-}
-
-variable "artifactory_host" {
-  type        = string
-  description = "The artifactory host to search for vault artifacts"
-  default     = "https://artifactory.hashicorp.engineering/artifactory"
-}
-
-variable "artifactory_repo" {
-  type        = string
-  description = "The artifactory repo to search for vault artifacts"
-  default     = "hashicorp-crt-stable-local*"
-}
-variable "arch" {}
-variable "artifact_type" {}
-variable "artifact_path" {}
-variable "distro" {}
-variable "edition" {}
-variable "revision" {}
-variable "product_version" {}
-variable "build_tags" { default = null }
-variable "bundle_path" { default = null }
-variable "goarch" { default = null }
-variable "goos" { default = null }
diff --git a/enos/modules/vault_cluster/main.tf b/enos/modules/vault_cluster/main.tf
index ee5a7c7696a..7dc349499b2 100644
--- a/enos/modules/vault_cluster/main.tf
+++ b/enos/modules/vault_cluster/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -6,7 +6,7 @@ terraform {
     # We need to specify the provider source in each module until we publish it
     # to the public registry
     enos = {
-      source  = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
       version = ">= 0.4.0"
     }
   }
@@ -20,12 +20,13 @@ locals {
   bin_path               = "${var.install_dir}/vault"
   consul_bin_path        = "${var.consul_install_dir}/consul"
   enable_audit_devices   = var.enable_audit_devices && var.initialize_cluster
+  disable_mlock          = false
   // In order to get Terraform to plan we have to use collections with keys
-  // that are known at plan time. In order for our module to work our var.target_hosts
+  // that are known at plan time. In order for our module to work our var.hosts
   // must be a map with known keys at plan time. Here we're creating locals
   // that keep track of index values that point to our target hosts.
   followers = toset(slice(local.instances, 1, length(local.instances)))
-  instances = [for idx in range(length(var.target_hosts)) : tostring(idx)]
+  instances = [for idx in range(length(var.hosts)) : tostring(idx)]
   key_shares = {
     "awskms" = null
     "shamir" = 5
@@ -37,6 +38,13 @@ locals {
     "pkcs11" = null
   }
   leader = toset(slice(local.instances, 0, 1))
+  netcat_command = {
+    amzn          = "nc"
+    opensuse-leap = "netcat"
+    rhel          = "nc"
+    sles          = "nc"
+    ubuntu        = "netcat"
+  }
   recovery_shares = {
     "awskms" = 5
     "shamir" = null
@@ -50,9 +58,19 @@ locals {
   vault_service_user = "vault"
 }
 
+resource "enos_host_info" "hosts" {
+  for_each = var.hosts
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
 resource "enos_bundle_install" "consul" {
   for_each = {
-    for idx, host in var.target_hosts : idx => var.target_hosts[idx]
+    for idx, host in var.hosts : idx => var.hosts[idx]
     if var.storage_backend == "consul"
   }
 
@@ -66,8 +84,21 @@ resource "enos_bundle_install" "consul" {
   }
 }
 
+# We run install_packages before we install Vault because for some combinations of
+# certain Linux distros and artifact types (e.g. SLES and RPM packages), there may
+# be packages that are required to perform Vault installation (e.g. openssl).
+module "install_packages" {
+  source = "../install_packages"
+
+  hosts    = var.hosts
+  packages = var.packages
+}
+
 resource "enos_bundle_install" "vault" {
-  for_each = var.target_hosts
+  for_each = var.hosts
+  depends_on = [
+    module.install_packages, // Don't race for the package manager locks with install_packages
+  ]
 
   destination = var.install_dir
   release     = var.release == null ? var.release : merge({ product = "vault" }, var.release)
@@ -81,22 +112,17 @@ resource "enos_bundle_install" "vault" {
   }
 }
 
-module "install_packages" {
-  source = "../install_packages"
-  depends_on = [
-    enos_bundle_install.vault, // Don't race for the package manager locks with vault install
-  ]
-
-  hosts    = var.target_hosts
-  packages = var.packages
-}
-
 resource "enos_consul_start" "consul" {
   for_each = enos_bundle_install.consul
 
   bin_path = local.consul_bin_path
   data_dir = var.consul_data_dir
   config = {
+    # GetPrivateInterfaces is a go-sockaddr template that helps Consul get the correct
+    # addr in all of our default cases. This is required in the case of Amazon Linux,
+    # because amzn has a default docker listener that will make Consul try to use the
+    # incorrect addr.
+    bind_addr        = "{{ GetPrivateInterfaces | include \"type\" \"IP\" | sort \"default\" |  limit 1 | attr \"address\"}}"
     data_dir         = var.consul_data_dir
     datacenter       = "dc1"
     retry_join       = ["provider=aws tag_key=${var.backend_cluster_tag_key} tag_value=${var.backend_cluster_name}"]
@@ -112,7 +138,7 @@ resource "enos_consul_start" "consul" {
 
   transport = {
     ssh = {
-      host = var.target_hosts[each.key].public_ip
+      host = var.hosts[each.key].public_ip
     }
   }
 }
@@ -122,25 +148,33 @@ module "start_vault" {
 
   depends_on = [
     enos_consul_start.consul,
+    module.install_packages,
     enos_bundle_install.vault,
   ]
 
   cluster_name              = var.cluster_name
+  cluster_port              = var.cluster_port
+  cluster_tag_key           = var.cluster_tag_key
   config_dir                = var.config_dir
+  config_mode               = var.config_mode
+  disable_mlock             = local.disable_mlock
+  enable_telemetry          = var.enable_telemetry
+  external_storage_port     = var.external_storage_port
+  hosts                     = var.hosts
   install_dir               = var.install_dir
+  ip_version                = var.ip_version
   license                   = var.license
+  listener_port             = var.listener_port
   log_level                 = var.log_level
   manage_service            = var.manage_service
   seal_attributes           = var.seal_attributes
   seal_attributes_secondary = var.seal_attributes_secondary
-  seal_ha_beta              = var.seal_ha_beta
   seal_type                 = var.seal_type
   seal_type_secondary       = var.seal_type_secondary
   service_username          = local.vault_service_user
   storage_backend           = var.storage_backend
   storage_backend_attrs     = var.storage_backend_addl_config
   storage_node_prefix       = var.storage_node_prefix
-  target_hosts              = var.target_hosts
 }
 
 resource "enos_vault_init" "leader" {
@@ -163,7 +197,7 @@ resource "enos_vault_init" "leader" {
 
   transport = {
     ssh = {
-      host = var.target_hosts[each.value].public_ip
+      host = var.hosts[each.value].public_ip
     }
   }
 }
@@ -182,7 +216,7 @@ resource "enos_vault_unseal" "leader" {
 
   transport = {
     ssh = {
-      host = var.target_hosts[tolist(local.leader)[0]].public_ip
+      host = var.hosts[tolist(local.leader)[0]].public_ip
     }
   }
 }
@@ -206,7 +240,7 @@ resource "enos_vault_unseal" "followers" {
 
   transport = {
     ssh = {
-      host = var.target_hosts[each.value].public_ip
+      host = var.hosts[each.value].public_ip
     }
   }
 }
@@ -220,12 +254,12 @@ resource "enos_vault_unseal" "maybe_force_unseal" {
     module.start_vault.followers,
   ]
   for_each = {
-    for idx, host in var.target_hosts : idx => host
+    for idx, host in var.hosts : idx => host
     if var.force_unseal && !var.initialize_cluster
   }
 
   bin_path   = local.bin_path
-  vault_addr = "http://localhost:8200"
+  vault_addr = module.start_vault.api_addr_localhost
   seal_type  = var.seal_type
   unseal_keys = coalesce(
     var.shamir_unseal_keys,
@@ -239,6 +273,61 @@ resource "enos_vault_unseal" "maybe_force_unseal" {
   }
 }
 
+# Add the vault install location to the PATH and set up VAULT_ADDR and VAULT_TOKEN environement
+# variables in the login shell so we don't have to do it if/when we login in to a cluster node.
+resource "enos_remote_exec" "configure_login_shell_profile" {
+  depends_on = [
+    enos_vault_init.leader,
+    enos_vault_unseal.leader,
+  ]
+  for_each = var.hosts
+
+  environment = {
+    VAULT_ADDR        = module.start_vault.api_addr_localhost
+    VAULT_TOKEN       = var.root_token != null ? var.root_token : try(enos_vault_init.leader[0].root_token, "_")
+    VAULT_INSTALL_DIR = var.install_dir
+  }
+
+  scripts = [abspath("${path.module}/scripts/set-up-login-shell-profile.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+# Add a motd to assist people that might be logging in.
+resource "enos_file" "motd" {
+  depends_on = [
+    enos_remote_exec.configure_login_shell_profile
+  ]
+  for_each = var.hosts
+
+  destination = "/etc/motd"
+  content     = <<EOF
+ ▄█    █▄     ▄████████ ███    █▄   ▄█           ███
+███    ███   ███    ███ ███    ███ ███       ▀█████████▄
+███    ███   ███    ███ ███    ███ ███          ▀███▀▀██
+███    ███   ███    ███ ███    ███ ███           ███   ▀
+███    ███ ▀███████████ ███    ███ ███           ███
+███    ███   ███    ███ ███    ███ ███           ███
+███    ███   ███    ███ ███    ███ ███▌    ▄     ███
+ ▀██████▀    ███    █▀  ████████▀  █████▄▄██    ▄████▀
+                                   ▀
+We've added `vault` to the PATH for you and configured
+the VAULT_ADDR and VAULT_TOKEN with the root token.
+
+Have fun!
+EOF
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
 # We need to ensure that the directory used for audit logs is present and accessible to the vault
 # user on all nodes, since logging will only happen on the leader.
 resource "enos_remote_exec" "create_audit_log_dir" {
@@ -262,7 +351,7 @@ resource "enos_remote_exec" "create_audit_log_dir" {
 
   transport = {
     ssh = {
-      host = var.target_hosts[each.value].public_ip
+      host = var.hosts[each.value].public_ip
     }
   }
 }
@@ -283,14 +372,16 @@ resource "enos_remote_exec" "start_audit_socket_listener" {
   ])
 
   environment = {
-    SOCKET_PORT = local.audit_socket_port
+    IP_VERSION     = var.ip_version
+    NETCAT_COMMAND = local.netcat_command[enos_host_info.hosts[each.key].distro]
+    SOCKET_PORT    = local.audit_socket_port
   }
 
   scripts = [abspath("${path.module}/scripts/start-audit-socket-listener.sh")]
 
   transport = {
     ssh = {
-      host = var.target_hosts[each.value].public_ip
+      host = var.hosts[each.value].public_ip
     }
   }
 }
@@ -306,9 +397,10 @@ resource "enos_remote_exec" "enable_audit_devices" {
   ])
 
   environment = {
+    IP_VERSION     = var.ip_version
     LOG_FILE_PATH  = local.audit_device_file_path
     SOCKET_PORT    = local.audit_socket_port
-    VAULT_ADDR     = "http://127.0.0.1:8200"
+    VAULT_ADDR     = module.start_vault.api_addr_localhost
     VAULT_BIN_PATH = local.bin_path
     VAULT_TOKEN    = enos_vault_init.leader[each.key].root_token
   }
@@ -317,7 +409,7 @@ resource "enos_remote_exec" "enable_audit_devices" {
 
   transport = {
     ssh = {
-      host = var.target_hosts[each.key].public_ip
+      host = var.hosts[each.key].public_ip
     }
   }
 }
diff --git a/enos/modules/vault_cluster/outputs.tf b/enos/modules/vault_cluster/outputs.tf
index c76f09ba370..67bea0ff4f8 100644
--- a/enos/modules/vault_cluster/outputs.tf
+++ b/enos/modules/vault_cluster/outputs.tf
@@ -1,6 +1,16 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
+output "api_addr_localhost" {
+  description = "The localhost API address"
+  value       = module.start_vault.api_addr_localhost
+}
+
+output "api_addrs" {
+  description = "The external API addresses of all nodes the cluster"
+  value       = module.start_vault.api_addrs
+}
+
 output "audit_device_file_path" {
   description = "The file path for the audit device, if enabled"
   value       = var.enable_audit_devices ? local.audit_device_file_path : "file audit device not enabled"
@@ -11,14 +21,48 @@ output "cluster_name" {
   value       = var.cluster_name
 }
 
+output "cluster_port" {
+  description = "The Vault cluster request forwarding listener port"
+  value       = module.start_vault.cluster_port
+}
+
+output "external_storage_port" {
+  description = "The Vault cluster non-raft external storage port"
+  value       = module.start_vault.external_storage_port
+}
+
+output "hosts" {
+  description = "The vault cluster instances that were created"
+
+  value = var.hosts
+}
+
+output "ipv6s" {
+  description = "Vault cluster target host ipv6 addresses"
+  value       = [for host in var.hosts : host.ipv6]
+}
+
+output "keys_base64" {
+  value = try(module.start_vault.keys_base64, null)
+}
+
+output "keys_base64_secondary" {
+  value = try(module.start_vault.keys_base64_secondary, null)
+}
+
+output "listener_port" {
+  description = "The Vault cluster TCP listener port"
+  value       = module.start_vault.listener_port
+}
+
 output "private_ips" {
   description = "Vault cluster target host private_ips"
-  value       = [for host in var.target_hosts : host.private_ip]
+  value       = [for host in var.hosts : host.private_ip]
 }
 
 output "public_ips" {
   description = "Vault cluster target host public_ips"
-  value       = [for host in var.target_hosts : host.public_ip]
+  value       = [for host in var.hosts : host.public_ip]
 }
 
 output "recovery_keys_b64" {
@@ -41,12 +85,6 @@ output "root_token" {
   value = coalesce(var.root_token, try(enos_vault_init.leader[0].root_token, null), "none")
 }
 
-output "target_hosts" {
-  description = "The vault cluster instances that were created"
-
-  value = var.target_hosts
-}
-
 output "unseal_keys_b64" {
   value = try(enos_vault_init.leader[0].unseal_keys_b64, [])
 }
@@ -62,11 +100,3 @@ output "unseal_shares" {
 output "unseal_threshold" {
   value = try(enos_vault_init.leader[0].unseal_keys_threshold, -1)
 }
-
-output "keys_base64" {
-  value = try(module.start_vault.keys_base64, null)
-}
-
-output "keys_base64_secondary" {
-  value = try(module.start_vault.keys_base64_secondary, null)
-}
diff --git a/enos/modules/vault_cluster/scripts/create-audit-log-dir.sh b/enos/modules/vault_cluster/scripts/create-audit-log-dir.sh
index 95eeedcc187..16c25b637e0 100755
--- a/enos/modules/vault_cluster/scripts/create-audit-log-dir.sh
+++ b/enos/modules/vault_cluster/scripts/create-audit-log-dir.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -eux
diff --git a/enos/modules/vault_cluster/scripts/enable-audit-devices.sh b/enos/modules/vault_cluster/scripts/enable-audit-devices.sh
index c74601baf15..d0a67c97ed6 100644
--- a/enos/modules/vault_cluster/scripts/enable-audit-devices.sh
+++ b/enos/modules/vault_cluster/scripts/enable-audit-devices.sh
@@ -1,5 +1,5 @@
-#!/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -exo pipefail
@@ -9,6 +9,7 @@ fail() {
   exit 1
 }
 
+[[ -z "$IP_VERSION" ]] && fail "IP_VERSION env variable has not been set"
 [[ -z "$LOG_FILE_PATH" ]] && fail "LOG_FILE_PATH env variable has not been set"
 [[ -z "$SOCKET_PORT" ]] && fail "SOCKET_PORT env variable has not been set"
 [[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
@@ -19,12 +20,16 @@ enable_file_audit_device() {
   $VAULT_BIN_PATH audit enable file file_path="$LOG_FILE_PATH"
 }
 
-enable_syslog_audit_device(){
+enable_syslog_audit_device() {
   $VAULT_BIN_PATH audit enable syslog tag="vault" facility="AUTH"
 }
 
 enable_socket_audit_device() {
-  "$VAULT_BIN_PATH" audit enable socket address="127.0.0.1:$SOCKET_PORT"
+  if [ "$IP_VERSION" = "4" ]; then
+    "$VAULT_BIN_PATH" audit enable socket address="127.0.0.1:$SOCKET_PORT"
+  else
+    "$VAULT_BIN_PATH" audit enable socket address="[::1]:$SOCKET_PORT"
+  fi
 }
 
 main() {
diff --git a/enos/modules/vault_cluster/scripts/set-up-login-shell-profile.sh b/enos/modules/vault_cluster/scripts/set-up-login-shell-profile.sh
new file mode 100644
index 00000000000..4a1e38438be
--- /dev/null
+++ b/enos/modules/vault_cluster/scripts/set-up-login-shell-profile.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+# Determine the profile file we should write to. We only want to affect login shells and bash will
+# only read one of these in ordered of precendence.
+determineProfileFile() {
+  if [ -f "$HOME/.bash_profile" ]; then
+    printf "%s/.bash_profile\n" "$HOME"
+    return 0
+  fi
+
+  if [ -f "$HOME/.bash_login" ]; then
+    printf "%s/.bash_login\n" "$HOME"
+    return 0
+  fi
+
+  printf "%s/.profile\n" "$HOME"
+}
+
+appendVaultProfileInformation() {
+  tee -a "$1" <<< "export PATH=$PATH:$VAULT_INSTALL_DIR
+export VAULT_ADDR=$VAULT_ADDR
+export VAULT_TOKEN=$VAULT_TOKEN"
+}
+
+main() {
+  local profile_file
+  if ! profile_file=$(determineProfileFile); then
+    fail "failed to determine login shell profile file location"
+  fi
+
+  # If vault_cluster is used more than once, eg: autopilot or replication, this module can
+  # be called more than once. Short ciruit here if our profile is already set up.
+  if grep VAULT_ADDR < "$profile_file"; then
+    exit 0
+  fi
+
+  if ! appendVaultProfileInformation "$profile_file"; then
+    fail "failed to write vault configuration to login shell profile"
+  fi
+
+  exit 0
+}
+
+main
diff --git a/enos/modules/vault_cluster/scripts/start-audit-socket-listener.sh b/enos/modules/vault_cluster/scripts/start-audit-socket-listener.sh
index c1364936ecb..8b75a97a267 100644
--- a/enos/modules/vault_cluster/scripts/start-audit-socket-listener.sh
+++ b/enos/modules/vault_cluster/scripts/start-audit-socket-listener.sh
@@ -1,5 +1,5 @@
-#!/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -exo pipefail
@@ -9,18 +9,36 @@ fail() {
   exit 1
 }
 
+[[ -z "$IP_VERSION" ]] && fail "IP_VERSION env variable has not been set"
+[[ -z "$NETCAT_COMMAND" ]] && fail "NETCAT_COMMAND env variable has not been set"
 [[ -z "$SOCKET_PORT" ]] && fail "SOCKET_PORT env variable has not been set"
 
+if [ "$IP_VERSION" = "4" ]; then
+  export SOCKET_ADDR="127.0.0.1"
+else
+  export SOCKET_ADDR="::1"
+fi
+
 socket_listener_procs() {
-  pgrep -x nc
+  pgrep -x "${NETCAT_COMMAND}"
 }
 
 kill_socket_listener() {
-  pkill nc
+  pkill  "${NETCAT_COMMAND}"
 }
 
 test_socket_listener() {
-  nc -zvw 2 127.0.0.1 "$SOCKET_PORT" < /dev/null
+  case $IP_VERSION in
+    4)
+      "${NETCAT_COMMAND}" -zvw 2 "${SOCKET_ADDR}" "$SOCKET_PORT" < /dev/null
+      ;;
+    6)
+      "${NETCAT_COMMAND}" -6 -zvw 2 "${SOCKET_ADDR}" "$SOCKET_PORT" < /dev/null
+      ;;
+    *)
+      fail "unknown IP_VERSION: $IP_VERSION"
+      ;;
+  esac
 }
 
 start_socket_listener() {
@@ -32,7 +50,17 @@ start_socket_listener() {
   # Run nc to listen on port 9090 for the socket auditor. We spawn nc
   # with nohup to ensure that the listener doesn't expect a SIGHUP and
   # thus block the SSH session from exiting or terminating on exit.
-  nohup nc -kl "$SOCKET_PORT" >> /tmp/vault-socket.log 2>&1 < /dev/null &
+  case $IP_VERSION in
+    4)
+      nohup nc -kl "$SOCKET_PORT" >> /tmp/vault-socket.log 2>&1 < /dev/null &
+      ;;
+    6)
+      nohup nc -6 -kl "$SOCKET_PORT" >> /tmp/vault-socket.log 2>&1 < /dev/null &
+      ;;
+    *)
+      fail "unknown IP_VERSION: $IP_VERSION"
+      ;;
+  esac
 }
 
 read_log() {
diff --git a/enos/modules/vault_cluster/variables.tf b/enos/modules/vault_cluster/variables.tf
index 4b6a3ced236..5295b7228ab 100644
--- a/enos/modules/vault_cluster/variables.tf
+++ b/enos/modules/vault_cluster/variables.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "artifactory_release" {
@@ -30,12 +30,34 @@ variable "cluster_name" {
   default     = null
 }
 
+variable "cluster_port" {
+  type        = number
+  description = "The cluster port for Vault to listen on"
+  default     = 8201
+}
+
+variable "cluster_tag_key" {
+  type        = string
+  description = "The Vault cluster tag key"
+  default     = "retry_join"
+}
+
 variable "config_dir" {
   type        = string
   description = "The directory to use for Vault configuration"
   default     = "/etc/vault.d"
 }
 
+variable "config_mode" {
+  description = "The method to use when configuring Vault. When set to 'env' we will configure Vault using VAULT_ style environment variables if possible. When 'file' we'll use the HCL configuration file for all configuration options."
+  default     = "file"
+
+  validation {
+    condition     = contains(["env", "file"], var.config_mode)
+    error_message = "The config_mode must be either 'env' or 'file'. No other configuration modes are supported."
+  }
+}
+
 variable "config_env_vars" {
   description = "Optional Vault configuration environment variables to set starting Vault"
   type        = map(string)
@@ -90,18 +112,45 @@ variable "consul_release" {
   }
 }
 
+variable "distro_version" {
+  type        = string
+  description = "The Linux distro version"
+  default     = null
+}
+
 variable "enable_audit_devices" {
   description = "If true every audit device will be enabled"
   type        = bool
   default     = true
 }
 
+variable "enable_telemetry" {
+  type        = bool
+  description = "Enable Vault telemetry"
+  default     = false
+}
+
+variable "external_storage_port" {
+  type        = number
+  description = "The port to connect to when using external storage"
+  default     = 8500
+}
+
 variable "force_unseal" {
   type        = bool
   description = "Always unseal the Vault cluster even if we're not initializing it"
   default     = false
 }
 
+variable "hosts" {
+  description = "The target machines host addresses to use for the Vault cluster"
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+}
+
 variable "initialize_cluster" {
   type        = bool
   description = "Initialize the Vault cluster"
@@ -110,10 +159,20 @@ variable "initialize_cluster" {
 
 variable "install_dir" {
   type        = string
-  description = "The directory where the vault binary will be installed"
+  description = "The directory where the Vault binary will be installed"
   default     = "/opt/vault/bin"
 }
 
+variable "ip_version" {
+  type        = number
+  description = "The IP version to use for the Vault TCP listeners"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
 variable "license" {
   type        = string
   sensitive   = true
@@ -121,6 +180,12 @@ variable "license" {
   default     = null
 }
 
+variable "listener_port" {
+  type        = number
+  description = "The port for Vault to listen on"
+  default     = 8200
+}
+
 variable "local_artifact_path" {
   type        = string
   description = "The path to a locally built vault artifact to install. It can be a zip archive, RPM, or Debian package"
@@ -161,7 +226,7 @@ variable "release" {
 
 variable "root_token" {
   type        = string
-  description = "The Vault root token that we can use to intialize and configure the cluster"
+  description = "The Vault root token that we can use to initialize and configure the cluster"
   default     = null
 }
 
@@ -230,11 +295,3 @@ variable "storage_node_prefix" {
   description = "A prefix to use for each node in the Vault storage configuration"
   default     = "node"
 }
-
-variable "target_hosts" {
-  description = "The target machines host addresses to use for the Vault cluster"
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-}
diff --git a/enos/modules/vault_failover_demote_dr_primary/main.tf b/enos/modules/vault_failover_demote_dr_primary/main.tf
new file mode 100644
index 00000000000..b2fc4e4342e
--- /dev/null
+++ b/enos/modules/vault_failover_demote_dr_primary/main.tf
@@ -0,0 +1,63 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "primary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The primary cluster leader host"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+locals {
+}
+
+resource "enos_remote_exec" "demote_dr_primary" {
+  environment = {
+    VAULT_ADDR  = var.vault_addr
+    VAULT_TOKEN = var.vault_root_token
+  }
+
+  inline = ["${var.vault_install_dir}/vault write -f sys/replication/dr/primary/demote"]
+
+
+  transport = {
+    ssh = {
+      host = var.primary_leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/vault_failover_promote_dr_secondary/main.tf b/enos/modules/vault_failover_promote_dr_secondary/main.tf
new file mode 100644
index 00000000000..1a4793a9dbb
--- /dev/null
+++ b/enos/modules/vault_failover_promote_dr_secondary/main.tf
@@ -0,0 +1,69 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "secondary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The secondary cluster leader host"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+variable "dr_operation_token" {
+  type        = string
+  description = "The wrapping token created on primary cluster"
+}
+
+locals {
+  dr_operation_token = var.dr_operation_token
+}
+
+resource "enos_remote_exec" "promote_dr_secondary" {
+  environment = {
+    VAULT_ADDR  = var.vault_addr
+    VAULT_TOKEN = var.vault_root_token
+  }
+
+  inline = ["${var.vault_install_dir}/vault write -f sys/replication/dr/secondary/promote dr_operation_token=${local.dr_operation_token}"]
+
+
+  transport = {
+    ssh = {
+      host = var.secondary_leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/vault_failover_update_dr_primary/main.tf b/enos/modules/vault_failover_update_dr_primary/main.tf
new file mode 100644
index 00000000000..3ed3167aa69
--- /dev/null
+++ b/enos/modules/vault_failover_update_dr_primary/main.tf
@@ -0,0 +1,76 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "secondary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The secondary cluster leader host"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+variable "dr_operation_token" {
+  type        = string
+  description = "The wrapping token created on primary cluster"
+}
+
+variable "wrapping_token" {
+  type        = string
+  description = "The wrapping token created on primary cluster"
+}
+
+locals {
+  dr_operation_token = var.dr_operation_token
+  wrapping_token     = var.wrapping_token
+}
+
+resource "enos_remote_exec" "update_dr_primary" {
+  environment = {
+    VAULT_ADDR  = var.vault_addr
+    VAULT_TOKEN = var.vault_root_token
+  }
+
+  inline = ["${var.vault_install_dir}/vault write sys/replication/dr/secondary/update-primary dr_operation_token=${local.dr_operation_token} token=${local.wrapping_token}"]
+
+
+  transport = {
+    ssh = {
+      host = var.secondary_leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/vault_get_cluster_ips/main.tf b/enos/modules/vault_get_cluster_ips/main.tf
index fb809d8916c..eea56cd75e3 100644
--- a/enos/modules/vault_get_cluster_ips/main.tf
+++ b/enos/modules/vault_get_cluster_ips/main.tf
@@ -1,14 +1,45 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
+/*
+
+Given our expected hosts, determine which is currently the leader and verify that all expected
+nodes are either the leader or a follower.
+
+*/
+
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The Vault cluster hosts that are expected to be in the cluster"
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
 variable "vault_install_dir" {
   type        = string
   description = "The directory where the Vault binary will be installed"
@@ -19,73 +50,100 @@ variable "vault_root_token" {
   description = "The vault root token"
 }
 
-variable "vault_instance_count" {
-  type        = number
-  description = "The number of instances in the vault cluster"
-}
-
-variable "vault_hosts" {
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-  description = "The vault cluster hosts. These are required to map private ip addresses to public addresses."
-}
-
 locals {
-  follower_hosts_list = [for idx in range(var.vault_instance_count - 1) : {
-    private_ip = local.follower_private_ips[idx]
-    public_ip  = local.follower_public_ips[idx]
-    }
+  follower_hosts_list = [
+    for idx in range(length(var.hosts)) : var.hosts[idx] if var.ip_version == 6 ?
+    contains(tolist(local.follower_ipv6s), var.hosts[idx].ipv6) :
+    contains(tolist(local.follower_private_ips), var.hosts[idx].private_ip)
   ]
   follower_hosts = {
-    for idx in range(var.vault_instance_count - 1) : idx => try(local.follower_hosts_list[idx], null)
+    for idx in range(local.host_count - 1) : idx => try(local.follower_hosts_list[idx], null)
   }
-  follower_private_ips = jsondecode(enos_remote_exec.get_follower_private_ips.stdout)
-  follower_public_ips = [for idx in range(var.vault_instance_count) : var.vault_hosts[idx].public_ip if contains(
-    local.follower_private_ips, var.vault_hosts[idx].private_ip)
+  follower_ipv6s       = jsondecode(enos_remote_exec.follower_ipv6s.stdout)
+  follower_private_ips = jsondecode(enos_remote_exec.follower_private_ipv4s.stdout)
+  follower_public_ips  = [for host in local.follower_hosts : host.public_ip]
+  host_count           = length(var.hosts)
+  ipv6s                = [for k, v in values(tomap(var.hosts)) : tostring(v["ipv6"])]
+  leader_host_list = [
+    for idx in range(length(var.hosts)) : var.hosts[idx] if var.ip_version == 6 ?
+    var.hosts[idx].ipv6 == local.leader_ipv6 :
+    var.hosts[idx].private_ip == local.leader_private_ip
   ]
-  leader_host = {
-    private_ip = local.leader_private_ip
-    public_ip  = local.leader_public_ip
-  }
-  leader_private_ip = trimspace(enos_remote_exec.get_leader_private_ip.stdout)
-  leader_public_ip = element([
-    for idx in range(var.vault_instance_count) : var.vault_hosts[idx].public_ip if var.vault_hosts[idx].private_ip == local.leader_private_ip
-  ], 0)
-  private_ips = [for k, v in values(tomap(var.vault_hosts)) : tostring(v["private_ip"])]
+  leader_host       = try(local.leader_host_list[0], null)
+  leader_ipv6       = trimspace(enos_remote_exec.leader_ipv6.stdout)
+  leader_private_ip = trimspace(enos_remote_exec.leader_private_ipv4.stdout)
+  leader_public_ip  = try(local.leader_host.public_ip, null)
+  private_ips       = [for k, v in values(tomap(var.hosts)) : tostring(v["private_ip"])]
 }
 
-resource "enos_remote_exec" "get_leader_private_ip" {
+resource "enos_remote_exec" "leader_private_ipv4" {
   environment = {
-    VAULT_ADDR        = "http://127.0.0.1:8200"
+    IP_VERSION        = var.ip_version
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
     VAULT_TOKEN       = var.vault_root_token
+  }
+
+  scripts = [abspath("${path.module}/scripts/get-leader-ipv4.sh")]
+
+  transport = {
+    ssh = {
+      host = var.hosts[0].public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "leader_ipv6" {
+  environment = {
+    IP_VERSION        = var.ip_version
+    VAULT_ADDR        = var.vault_addr
     VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
   }
 
-  scripts = [abspath("${path.module}/scripts/get-leader-private-ip.sh")]
+  scripts = [abspath("${path.module}/scripts/get-leader-ipv6.sh")]
 
   transport = {
     ssh = {
-      host = var.vault_hosts[0].public_ip
+      host = var.hosts[0].public_ip
     }
   }
 }
 
-resource "enos_remote_exec" "get_follower_private_ips" {
+resource "enos_remote_exec" "follower_private_ipv4s" {
   environment = {
-    VAULT_ADDR                 = "http://127.0.0.1:8200"
-    VAULT_TOKEN                = var.vault_root_token
-    VAULT_LEADER_PRIVATE_IP    = local.leader_private_ip
-    VAULT_INSTANCE_PRIVATE_IPS = jsonencode(local.private_ips)
-    VAULT_INSTALL_DIR          = var.vault_install_dir
+    IP_VERSION              = var.ip_version
+    VAULT_ADDR              = var.vault_addr
+    VAULT_INSTALL_DIR       = var.vault_install_dir
+    VAULT_LEADER_PRIVATE_IP = local.leader_private_ip
+    VAULT_PRIVATE_IPS       = jsonencode(local.private_ips)
+    VAULT_TOKEN             = var.vault_root_token
   }
 
-  scripts = [abspath("${path.module}/scripts/get-follower-private-ips.sh")]
+  scripts = [abspath("${path.module}/scripts/get-follower-ipv4s.sh")]
 
   transport = {
     ssh = {
-      host = var.vault_hosts[0].public_ip
+      host = var.hosts[0].public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "follower_ipv6s" {
+  environment = {
+    IP_VERSION        = var.ip_version
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_IPV6S       = jsonencode(local.ipv6s)
+    VAULT_LEADER_IPV6 = local.leader_ipv6
+    VAULT_TOKEN       = var.vault_root_token
+  }
+
+  scripts = [abspath("${path.module}/scripts/get-follower-ipv6s.sh")]
+
+  transport = {
+    ssh = {
+      host = var.hosts[0].public_ip
     }
   }
 }
@@ -94,6 +152,10 @@ output "follower_hosts" {
   value = local.follower_hosts
 }
 
+output "follower_ipv6s" {
+  value = local.follower_ipv6s
+}
+
 output "follower_private_ips" {
   value = local.follower_private_ips
 }
@@ -106,6 +168,14 @@ output "leader_host" {
   value = local.leader_host
 }
 
+output "leader_hosts" {
+  value = { 0 : local.leader_host }
+}
+
+output "leader_ipv6" {
+  value = local.leader_ipv6
+}
+
 output "leader_private_ip" {
   value = local.leader_private_ip
 }
diff --git a/enos/modules/vault_get_cluster_ips/scripts/get-follower-ipv4s.sh b/enos/modules/vault_get_cluster_ips/scripts/get-follower-ipv4s.sh
new file mode 100644
index 00000000000..7ae7e13e4f3
--- /dev/null
+++ b/enos/modules/vault_get_cluster_ips/scripts/get-follower-ipv4s.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+function fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$IP_VERSION" ]] && fail "IP_VERSION env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "Unable to locate vault binary at $binpath"
+
+getFollowerPrivateIPsFromOperatorMembers() {
+  if members=$($binpath operator members -format json); then
+    if followers=$(echo "$members" | jq -e --argjson expected "$VAULT_PRIVATE_IPS" -c '.Nodes | map(select(any(.; .active_node==false)) | .api_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")) as $followers | $expected - ($expected - $followers)'); then
+      # Make sure that we got all the followers
+      if jq -e --argjson expected "$VAULT_PRIVATE_IPS" --argjson followers "$followers" -ne '$expected | length as $el | $followers | length as $fl | $fl == $el-1' > /dev/null; then
+        echo "$followers"
+        return 0
+      fi
+    fi
+  fi
+
+  return 1
+}
+
+removeIP() {
+  local needle
+  local haystack
+  needle=$1
+  haystack=$2
+  if remain=$(jq -e --arg ip "$needle" -c '. | map(select(.!=$ip))' <<< "$haystack"); then
+    if [[ -n "$remain" ]]; then
+      echo "$remain"
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+count=0
+retries=10
+while :; do
+  case $IP_VERSION in
+    4)
+      [[ -z "$VAULT_PRIVATE_IPS" ]] && fail "VAULT_PRIVATE_IPS env variable has not been set"
+      [[ -z "$VAULT_LEADER_PRIVATE_IP" ]] && fail "VAULT_LEADER_PRIVATE_IP env variable has not been set"
+
+      # Vault >= 1.10.x has the operator members. If we have that then we'll use it.
+      if $binpath operator -h 2>&1 | grep members &> /dev/null; then
+        if followers=$(getFollowerPrivateIPsFromOperatorMembers); then
+          echo "$followers"
+          exit 0
+        fi
+      else
+        removeIP "$VAULT_LEADER_PRIVATE_IP" "$VAULT_PRIVATE_IPS"
+
+        return $?
+      fi
+      ;;
+    6)
+      echo '[]'
+      exit 0
+      ;;
+    *)
+      fail "unknown IP_VERSION: $IP_VERSION"
+      ;;
+  esac
+
+  wait=$((2 ** count))
+  count=$((count + 1))
+  if [ "$count" -lt "$retries" ]; then
+    sleep "$wait"
+  else
+    fail "Timed out trying to obtain the cluster followers"
+  fi
+done
diff --git a/enos/modules/vault_get_cluster_ips/scripts/get-follower-ipv6s.sh b/enos/modules/vault_get_cluster_ips/scripts/get-follower-ipv6s.sh
new file mode 100644
index 00000000000..e110b4f8bb9
--- /dev/null
+++ b/enos/modules/vault_get_cluster_ips/scripts/get-follower-ipv6s.sh
@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+function fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$IP_VERSION" ]] && fail "IP_VERSION env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+echo "$VAULT_IPV6S" > /tmp/vaultipv6s
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "Unable to locate vault binary at $binpath"
+
+getFollowerIPV6sFromOperatorMembers() {
+  if members=$($binpath operator members -format json); then
+    if followers=$(echo "$members" | jq -e --argjson expected "$VAULT_IPV6S" -c '.Nodes | map(select(any(.; .active_node==false)) | .api_address | scan("\\[(.+)\\]") | .[0]) as $followers | $expected - ($expected - $followers)'); then
+      # Make sure that we got all the followers
+      if jq -e --argjson expected "$VAULT_IPV6S" --argjson followers "$followers" -ne '$expected | length as $el | $followers | length as $fl | $fl == $el-1' > /dev/null; then
+        echo "$followers"
+        return 0
+      fi
+    fi
+  fi
+
+  return 1
+}
+
+removeIP() {
+  local needle
+  local haystack
+  needle=$1
+  haystack=$2
+  if remain=$(jq -e --arg ip "$needle" -c '. | map(select(.!=$ip))' <<< "$haystack"); then
+    if [[ -n "$remain" ]]; then
+      echo "$remain"
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+count=0
+retries=10
+while :; do
+  case $IP_VERSION in
+    4)
+      echo "[]"
+      exit 0
+      ;;
+    6)
+      [[ -z "$VAULT_IPV6S" ]] && fail "VAULT_IPV6S env variable has not been set"
+      [[ -z "$VAULT_LEADER_IPV6" ]] && fail "VAULT_LEADER_IPV6 env variable has not been set"
+
+      # Vault >= 1.10.x has the operator members. If we have that then we'll use it.
+      if $binpath operator -h 2>&1 | grep members &> /dev/null; then
+        if followers=$(getFollowerIPV6sFromOperatorMembers); then
+          echo "$followers"
+          exit 0
+        fi
+      else
+        [[ -z "$VAULT_LEADER_IPV6" ]] && fail "VAULT_LEADER_IPV6 env variable has not been set"
+        removeIP "$VAULT_LEADER_IPV6" "$VAULT_IPV6S"
+        exit $?
+      fi
+      ;;
+    *)
+      fail "unknown IP_VERSION: $IP_VERSION"
+      ;;
+  esac
+
+  wait=$((2 ** count))
+  count=$((count + 1))
+  if [ "$count" -lt "$retries" ]; then
+    sleep "$wait"
+  else
+    fail "Timed out trying to obtain the cluster followers"
+  fi
+done
diff --git a/enos/modules/vault_get_cluster_ips/scripts/get-follower-private-ips.sh b/enos/modules/vault_get_cluster_ips/scripts/get-follower-private-ips.sh
deleted file mode 100644
index 084a11a35f4..00000000000
--- a/enos/modules/vault_get_cluster_ips/scripts/get-follower-private-ips.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-set -e
-
-function fail() {
-  echo "$1" 1>&2
-  exit 1
-}
-
-[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
-[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
-[[ -z "$VAULT_INSTANCE_PRIVATE_IPS" ]] && fail "VAULT_INSTANCE_PRIVATE_IPS env variable has not been set"
-[[ -z "$VAULT_LEADER_PRIVATE_IP" ]] && fail "VAULT_LEADER_PRIVATE_IP env variable has not been set"
-[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
-
-binpath=${VAULT_INSTALL_DIR}/vault
-test -x "$binpath" || fail "Unable to locate vault binary at $binpath"
-
-count=0
-retries=10
-while :; do
-  # Vault >= 1.10.x has the operator members. If we have that then we'll use it.
-  if $binpath operator -h 2>&1 | grep members &> /dev/null; then
-    # Get the folllowers that are part of our private ips.
-    if members=$($binpath operator members -format json); then
-      if followers=$(echo "$members" | jq --argjson expected "$VAULT_INSTANCE_PRIVATE_IPS" -c '.Nodes | map(select(any(.; .active_node==false)) | .api_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")) as $followers | $expected - ($expected - $followers)'); then
-        # Make sure that we got all the followers
-        if jq --argjson expected "$VAULT_INSTANCE_PRIVATE_IPS" --argjson followers "$followers" -ne '$expected | length as $el | $followers | length as $fl | $fl == $el-1' > /dev/null; then
-          echo "$followers"
-          exit 0
-        fi
-      fi
-    fi
-  else
-    # We're using an old version of vault so we'll just return ips that don't match the leader.
-    # Get the public ip addresses of the followers
-    if followers=$(jq --arg ip "$VAULT_LEADER_PRIVATE_IP" -c '. | map(select(.!=$ip))' <<< "$VAULT_INSTANCE_PRIVATE_IPS"); then
-      if [[ -n "$followers" ]]; then
-        echo "$followers"
-        exit 0
-      fi
-    fi
-  fi
-
-  wait=$((2 ** count))
-  count=$((count + 1))
-  if [ "$count" -lt "$retries" ]; then
-    sleep "$wait"
-  else
-    fail "Timed out trying to obtain the cluster followers"
-  fi
-done
diff --git a/enos/modules/vault_get_cluster_ips/scripts/get-leader-ipv4.sh b/enos/modules/vault_get_cluster_ips/scripts/get-leader-ipv4.sh
new file mode 100644
index 00000000000..a403a415d7d
--- /dev/null
+++ b/enos/modules/vault_get_cluster_ips/scripts/get-leader-ipv4.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+function fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$IP_VERSION" ]] && fail "IP_VERSION env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "Unable to locate vault binary at $binpath"
+
+findLeaderPrivateIP() {
+  # Find the leader private IP address
+  if ip=$($binpath read sys/leader -format=json | jq -r '.data.leader_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")'); then
+    if [[ -n "$ip" ]]; then
+      echo "$ip"
+      return 0
+    fi
+  fi
+
+  # Some older versions of vault don't support reading sys/leader. Try falling back to the cli status.
+  if ip=$($binpath status -format json | jq -r '.leader_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")'); then
+    if [[ -n "$ip" ]]; then
+      echo "$ip"
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+count=0
+retries=5
+while :; do
+  case $IP_VERSION in
+    4)
+      # Find the leader private IP address
+      if ip=$(findLeaderPrivateIP); then
+        echo "$ip"
+        exit 0
+      fi
+      ;;
+    6)
+      exit 0
+      ;;
+    *)
+      fail "unknown IP_VERSION: $IP_VERSION"
+      ;;
+  esac
+
+  wait=$((2 ** count))
+  count=$((count + 1))
+  if [ "$count" -lt "$retries" ]; then
+    sleep "$wait"
+  else
+    fail "Timed out trying to obtain the cluster leader"
+  fi
+done
diff --git a/enos/modules/vault_get_cluster_ips/scripts/get-leader-ipv6.sh b/enos/modules/vault_get_cluster_ips/scripts/get-leader-ipv6.sh
new file mode 100644
index 00000000000..fb15dc51252
--- /dev/null
+++ b/enos/modules/vault_get_cluster_ips/scripts/get-leader-ipv6.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+function fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$IP_VERSION" ]] && fail "IP_VERSION env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "Unable to locate vault binary at $binpath"
+
+findLeaderIPV6() {
+  # Find the leader private IP address
+  if ip=$($binpath read sys/leader -format=json | jq -r '.data.leader_address | scan("\\[(.+)\\]") | .[0]'); then
+    if [[ -n "$ip" ]]; then
+      echo "$ip"
+      return 0
+    fi
+  fi
+
+  # Some older versions of vault don't support reading sys/leader. Try falling back to the cli status.
+  if ip=$($binpath status -format json | jq -r '.leader_address | scan("\\[(.+)\\]") | .[0]'); then
+    if [[ -n "$ip" ]]; then
+      echo "$ip"
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
+count=0
+retries=5
+while :; do
+  # Find the leader private IP address
+  case $IP_VERSION in
+    4)
+      exit 0
+      ;;
+    6)
+      if ip=$(findLeaderIPV6); then
+        echo "$ip"
+        exit 0
+      fi
+      ;;
+    *)
+      fail "unknown IP_VERSION: $IP_VERSION"
+      ;;
+  esac
+
+  wait=$((2 ** count))
+  count=$((count + 1))
+  if [ "$count" -lt "$retries" ]; then
+    sleep "$wait"
+  else
+    fail "Timed out trying to obtain the cluster leader"
+  fi
+done
diff --git a/enos/modules/vault_get_cluster_ips/scripts/get-leader-private-ip.sh b/enos/modules/vault_get_cluster_ips/scripts/get-leader-private-ip.sh
deleted file mode 100644
index ffea30c4622..00000000000
--- a/enos/modules/vault_get_cluster_ips/scripts/get-leader-private-ip.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-set -e
-
-function fail() {
-  echo "$1" 1>&2
-  exit 1
-}
-
-[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
-[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
-[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
-
-binpath=${VAULT_INSTALL_DIR}/vault
-test -x "$binpath" || fail "Unable to locate vault binary at $binpath"
-
-count=0
-retries=5
-while :; do
-  # Find the leader private IP address
-  if ip=$($binpath read sys/leader -format=json | jq -r '.data.leader_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")'); then
-    if [[ -n "$ip" ]]; then
-      echo "$ip"
-      exit 0
-    fi
-  fi
-
-  # Some older versions of vault don't support reading sys/leader. Try falling back to the cli status.
-  if ip=$($binpath status -format json | jq -r '.leader_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")'); then
-    if [[ -n "$ip" ]]; then
-      echo "$ip"
-      exit 0
-    fi
-  fi
-
-  wait=$((2 ** count))
-  count=$((count + 1))
-  if [ "$count" -lt "$retries" ]; then
-    sleep "$wait"
-  else
-    fail "Timed out trying to obtain the cluster leader"
-  fi
-done
diff --git a/enos/modules/vault_proxy/main.tf b/enos/modules/vault_proxy/main.tf
index 70736c5d8db..d50bb4972ba 100644
--- a/enos/modules/vault_proxy/main.tf
+++ b/enos/modules/vault_proxy/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -7,27 +7,33 @@ terraform {
       source = "hashicorp/aws"
     }
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_root_token" {
-  type        = string
-  description = "The Vault root token"
-}
-
-variable "vault_instances" {
+variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
   description = "The Vault cluster instances that were created"
 }
 
-variable "vault_instance_count" {
+variable "ip_version" {
   type        = number
-  description = "How many vault instances are in the cluster"
+  description = "The IP version to use for the Vault TCP listeners"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
 }
 
 variable "vault_install_dir" {
@@ -41,29 +47,34 @@ variable "vault_proxy_pidfile" {
   default     = "/tmp/pidfile"
 }
 
+variable "vault_proxy_port" {
+  type        = number
+  description = "The Vault Proxy listener port"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The Vault root token"
+}
+
 locals {
-  vault_instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
-  vault_proxy_address = "127.0.0.1:8100"
+  vault_proxy_address = "${var.ip_version == 4 ? "127.0.0.1" : "[::1]"}:${var.vault_proxy_port}"
 }
 
 resource "enos_remote_exec" "set_up_approle_auth_and_proxy" {
   environment = {
+    VAULT_ADDR          = var.vault_addr
     VAULT_INSTALL_DIR   = var.vault_install_dir
-    VAULT_TOKEN         = var.vault_root_token
-    VAULT_PROXY_PIDFILE = var.vault_proxy_pidfile
     VAULT_PROXY_ADDRESS = local.vault_proxy_address
+    VAULT_PROXY_PIDFILE = var.vault_proxy_pidfile
+    VAULT_TOKEN         = var.vault_root_token
   }
 
   scripts = [abspath("${path.module}/scripts/set-up-approle-and-proxy.sh")]
 
   transport = {
     ssh = {
-      host = local.vault_instances[0].public_ip
+      host = var.hosts[0].public_ip
     }
   }
 }
@@ -79,7 +90,7 @@ resource "enos_remote_exec" "use_proxy" {
 
   transport = {
     ssh = {
-      host = local.vault_instances[0].public_ip
+      host = var.hosts[0].public_ip
     }
   }
 
diff --git a/enos/modules/vault_proxy/scripts/set-up-approle-and-proxy.sh b/enos/modules/vault_proxy/scripts/set-up-approle-and-proxy.sh
index 556cb82248d..74fe5ad8e31 100644
--- a/enos/modules/vault_proxy/scripts/set-up-approle-and-proxy.sh
+++ b/enos/modules/vault_proxy/scripts/set-up-approle-and-proxy.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
 binpath=${VAULT_INSTALL_DIR}/vault
@@ -14,7 +13,7 @@ fail() {
 
 test -x "$binpath" || fail "unable to locate vault binary at $binpath"
 
-export VAULT_ADDR='http://127.0.0.1:8200'
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
 [[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
 
 # If approle was already enabled, disable it as we're about to re-enable it (the || true is so we don't fail if it doesn't already exist)
@@ -33,20 +32,20 @@ fi
 SECRETID=$($binpath write -f --format=json  auth/approle/role/proxy-role/secret-id  | jq -r '.data.secret_id')
 
 if [[ "$SECRETID" == '' ]]; then
-  fail "expected SECRETID to be nonempty, but it is empty"
+  fail "vault write -f --format=json auth/approle/role/proxy-role/secret-id did not return a .data.secret_id"
 fi
 
 echo "$ROLEID" > /tmp/role-id
 echo "$SECRETID" > /tmp/secret-id
 
 # Write the Vault Proxy's configuration to /tmp/vault-proxy.hcl
-#   The Proxy references the fixed Vault server address of http://127.0.0.1:8200
-#   The Proxy itself listens at the address http://127.0.0.1:8100
+#   The Proxy references the Vault server address passed in as $VAULT_ADDR
+#   The Proxy itself listens at the address passed in as $VAULT_PROXY_ADDRESS
 cat > /tmp/vault-proxy.hcl <<- EOM
 pid_file = "${VAULT_PROXY_PIDFILE}"
 
 vault {
-  address = "http://127.0.0.1:8200"
+  address = "${VAULT_ADDR}"
   tls_skip_verify = true
   retry {
     num_retries = 10
diff --git a/enos/modules/vault_proxy/scripts/use-proxy.sh b/enos/modules/vault_proxy/scripts/use-proxy.sh
index 3e7e543e7a3..73d3346d45f 100644
--- a/enos/modules/vault_proxy/scripts/use-proxy.sh
+++ b/enos/modules/vault_proxy/scripts/use-proxy.sh
@@ -1,17 +1,19 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
-binpath=${VAULT_INSTALL_DIR}/vault
-
 fail() {
   echo "$1" 1>&2
   return 1
 }
 
+[[ -z "$VAULT_PROXY_ADDRESS" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_PROXY_PIDFILE" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
 test -x "$binpath" || fail "unable to locate vault binary at $binpath"
 
 # Will cause the Vault CLI to communicate with the Vault Proxy, since it
@@ -26,7 +28,9 @@ unset VAULT_TOKEN
 # var) to lookup the details of the Proxy's token and make sure that the
 # .data.path field contains 'auth/approle/login', thus confirming that the Proxy
 # automatically authenticated itself.
-$binpath token lookup -format=json | jq -r '.data.path' | grep -q 'auth/approle/login'
+if ! $binpath token lookup -format=json | jq -Mer --arg expected "auth/approle/login" '.data.path == $expected'; then
+  fail "expected proxy to automatically authenticate using 'auth/approle/login', got: '$($binpath token lookup -format=json | jq -r '.data.path')'"
+fi
 
 # Now that we're done, kill the proxy
 pkill -F "${VAULT_PROXY_PIDFILE}" || true
diff --git a/enos/modules/vault_raft_remove_node_and_verify/main.tf b/enos/modules/vault_raft_remove_node_and_verify/main.tf
new file mode 100644
index 00000000000..6d5f9486ad8
--- /dev/null
+++ b/enos/modules/vault_raft_remove_node_and_verify/main.tf
@@ -0,0 +1,125 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster followers"
+}
+
+
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
+variable "timeout" {
+  type        = number
+  description = "The max number of seconds to wait before timing out"
+  default     = 60
+}
+
+variable "listener_port" {
+  type        = number
+  description = "The listener port for vault"
+}
+variable "vault_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The leader's host information"
+}
+variable "vault_addr" {
+  type        = string
+  description = "The local address to use to query vault"
+}
+variable "cluster_port" {
+  type        = number
+  description = "The cluster port for vault"
+}
+variable "ip_version" {
+  type        = number
+  description = "The IP version to use for the Vault TCP listeners"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+variable "vault_seal_type" {
+  type        = string
+  description = "The Vault seal type"
+}
+
+variable "add_back_nodes" {
+  type        = bool
+  description = "whether to add the nodes back"
+}
+
+variable "vault_unseal_keys" {}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the vault binary is installed"
+}
+
+
+module "choose_follower_to_remove" {
+  source    = "../choose_follower_host"
+  followers = var.hosts
+}
+
+module "remove_raft_node" {
+  source     = "../vault_raft_remove_peer"
+  depends_on = [module.choose_follower_to_remove]
+
+
+  hosts                   = module.choose_follower_to_remove.chosen_follower
+  ip_version              = var.ip_version
+  is_voter                = true
+  operator_instance       = var.vault_leader_host.public_ip
+  vault_addr              = var.vault_addr
+  vault_cluster_addr_port = var.cluster_port
+  vault_install_dir       = var.vault_install_dir
+  vault_root_token        = var.vault_root_token
+}
+
+module "verify_removed" {
+  source = "../vault_verify_removed_node"
+  depends_on = [
+    module.remove_raft_node
+  ]
+
+  add_back_nodes    = true
+  cluster_port      = var.cluster_port
+  hosts             = module.choose_follower_to_remove.chosen_follower
+  ip_version        = var.ip_version
+  listener_port     = var.listener_port
+  vault_addr        = var.vault_addr
+  vault_install_dir = var.vault_install_dir
+  vault_leader_host = var.vault_leader_host
+  vault_root_token  = var.vault_root_token
+  vault_seal_type   = var.vault_seal_type
+  vault_unseal_keys = var.vault_seal_type == "shamir" ? var.vault_unseal_keys : null
+}
diff --git a/enos/modules/vault_raft_remove_peer/main.tf b/enos/modules/vault_raft_remove_peer/main.tf
index daf025c471f..5f94bbe8842 100644
--- a/enos/modules/vault_raft_remove_peer/main.tf
+++ b/enos/modules/vault_raft_remove_peer/main.tf
@@ -1,28 +1,31 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_cluster_addr_port" {
-  description = "The Raft cluster address port"
-  type        = string
-  default     = "8201"
-}
-
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The old vault nodes to be removed"
 }
 
-variable "vault_instance_count" {
+variable "ip_version" {
   type        = number
-  description = "How many vault instances are in the cluster"
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
 }
 
 variable "operator_instance" {
@@ -30,12 +33,19 @@ variable "operator_instance" {
   description = "The ip address of the operator (Voter) node"
 }
 
-variable "remove_vault_instances" {
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-  description = "The old vault nodes to be removed"
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_cluster_addr_port" {
+  description = "The Raft cluster address port"
+  type        = string
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
 }
 
 variable "vault_root_token" {
@@ -43,23 +53,21 @@ variable "vault_root_token" {
   description = "The vault root token"
 }
 
-locals {
-  instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.remove_vault_instances)[idx].public_ip
-      private_ip = values(var.remove_vault_instances)[idx].private_ip
-    }
-  }
+variable "is_voter" {
+  type        = bool
+  default     = false
+  description = "Whether the nodes that are going to be removed are voters"
 }
 
 resource "enos_remote_exec" "vault_raft_remove_peer" {
-  for_each = local.instances
+  for_each = var.hosts
 
   environment = {
-    REMOVE_VAULT_CLUSTER_ADDR = "${each.value.private_ip}:${var.vault_cluster_addr_port}"
+    REMOVE_VAULT_CLUSTER_ADDR = "${var.ip_version == 4 ? "${each.value.private_ip}" : "[${each.value.ipv6}]"}:${var.vault_cluster_addr_port}"
     VAULT_TOKEN               = var.vault_root_token
-    VAULT_ADDR                = "http://localhost:8200"
+    VAULT_ADDR                = var.vault_addr
     VAULT_INSTALL_DIR         = var.vault_install_dir
+    REMOVE_NODE_IS_VOTER      = var.is_voter
   }
 
   scripts = [abspath("${path.module}/scripts/raft-remove-peer.sh")]
diff --git a/enos/modules/vault_raft_remove_peer/scripts/raft-remove-peer.sh b/enos/modules/vault_raft_remove_peer/scripts/raft-remove-peer.sh
index 4fcfa513d34..83c1b9e5f51 100644
--- a/enos/modules/vault_raft_remove_peer/scripts/raft-remove-peer.sh
+++ b/enos/modules/vault_raft_remove_peer/scripts/raft-remove-peer.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
 binpath=${VAULT_INSTALL_DIR}/vault
@@ -36,8 +35,8 @@ retry() {
 }
 
 remove_peer() {
-  if ! node_id=$("$binpath" operator raft list-peers -format json | jq -Mr --argjson expected "false" '.data.config.servers[] | select(.address=='\""$node_addr"\"') | select(.voter==$expected) | .node_id'); then
-    fail "failed to get node id of a non-voter node"
+  if ! node_id=$("$binpath" operator raft list-peers -format json | jq -Mr --argjson expected "${REMOVE_NODE_IS_VOTER}" '.data.config.servers[] | select(.address=='\""$node_addr"\"') | select(.voter==$expected) | .node_id'); then
+    fail "failed to get node id of a node with voter status ${REMOVE_NODE_IS_VOTER}"
   fi
 
   $binpath operator raft remove-peer "$node_id"
diff --git a/enos/modules/vault_setup_dr_primary/main.tf b/enos/modules/vault_setup_dr_primary/main.tf
new file mode 100644
index 00000000000..972236b7f54
--- /dev/null
+++ b/enos/modules/vault_setup_dr_primary/main.tf
@@ -0,0 +1,61 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "primary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The primary cluster leader host"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+// Enable DR replication on the primary. This will immediately clear all data in the secondary.
+resource "enos_remote_exec" "enable_dr_replication" {
+  environment = {
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/scripts/enable.sh")]
+
+  transport = {
+    ssh = {
+      host = var.primary_leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/vault_setup_dr_primary/scripts/enable.sh b/enos/modules/vault_setup_dr_primary/scripts/enable.sh
new file mode 100644
index 00000000000..99bc55edae7
--- /dev/null
+++ b/enos/modules/vault_setup_dr_primary/scripts/enable.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+binpath=${VAULT_INSTALL_DIR}/vault
+
+fail() {
+  echo "$1" 1>&2
+  return 1
+}
+
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+# Activate the primary
+$binpath write -f sys/replication/dr/primary/enable
diff --git a/enos/modules/vault_setup_perf_primary/main.tf b/enos/modules/vault_setup_perf_primary/main.tf
index fbcf3676d66..2c91d5cf9e1 100644
--- a/enos/modules/vault_setup_perf_primary/main.tf
+++ b/enos/modules/vault_setup_perf_primary/main.tf
@@ -1,33 +1,41 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_cluster_addr_port" {
-  description = "The Raft cluster address port"
-  type        = string
-  default     = "8201"
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
 }
 
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
+variable "primary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The primary cluster leader host"
 }
 
-variable "primary_leader_public_ip" {
+variable "vault_addr" {
   type        = string
-  description = "Vault primary cluster leader Public IP address"
+  description = "The local vault API listen address"
 }
 
-variable "primary_leader_private_ip" {
+variable "vault_install_dir" {
   type        = string
-  description = "Vault primary cluster leader Private IP address"
+  description = "The directory where the Vault binary will be installed"
 }
 
 variable "vault_root_token" {
@@ -37,7 +45,7 @@ variable "vault_root_token" {
 
 resource "enos_remote_exec" "configure_pr_primary" {
   environment = {
-    VAULT_ADDR        = "http://127.0.0.1:8200"
+    VAULT_ADDR        = var.vault_addr
     VAULT_TOKEN       = var.vault_root_token
     VAULT_INSTALL_DIR = var.vault_install_dir
   }
@@ -46,7 +54,7 @@ resource "enos_remote_exec" "configure_pr_primary" {
 
   transport = {
     ssh = {
-      host = var.primary_leader_public_ip
+      host = var.primary_leader_host.public_ip
     }
   }
 }
diff --git a/enos/modules/vault_setup_perf_primary/scripts/configure-vault-pr-primary.sh b/enos/modules/vault_setup_perf_primary/scripts/configure-vault-pr-primary.sh
index 2ccaf14e4db..39e226da765 100644
--- a/enos/modules/vault_setup_perf_primary/scripts/configure-vault-pr-primary.sh
+++ b/enos/modules/vault_setup_perf_primary/scripts/configure-vault-pr-primary.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
 binpath=${VAULT_INSTALL_DIR}/vault
@@ -14,17 +13,5 @@ fail() {
 
 test -x "$binpath" || fail "unable to locate vault binary at $binpath"
 
-# Create superuser policy
-$binpath policy write superuser -<<EOF
-path "*" {
-  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
-}
-EOF
-
-# The userpass auth method is enabled with the `vault_verify_write_data`,
-# so we do not enable here.
-# Create new user and attach superuser policy
-$binpath write auth/userpass/users/tester password="changeme" policies="superuser"
-
 # Activate the primary
 $binpath write -f sys/replication/performance/primary/enable
diff --git a/enos/modules/vault_setup_perf_secondary/main.tf b/enos/modules/vault_setup_perf_secondary/main.tf
deleted file mode 100644
index 08b412532ec..00000000000
--- a/enos/modules/vault_setup_perf_secondary/main.tf
+++ /dev/null
@@ -1,60 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-terraform {
-  required_providers {
-    enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
-    }
-  }
-}
-
-variable "vault_cluster_addr_port" {
-  description = "The Raft cluster address port"
-  type        = string
-  default     = "8201"
-}
-
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "secondary_leader_public_ip" {
-  type        = string
-  description = "Vault secondary cluster leader Public IP address"
-}
-
-variable "secondary_leader_private_ip" {
-  type        = string
-  description = "Vault secondary cluster leader Private IP address"
-}
-
-variable "vault_root_token" {
-  type        = string
-  description = "The vault root token"
-}
-
-variable "wrapping_token" {
-  type        = string
-  description = "The wrapping token created on primary cluster"
-}
-
-locals {
-  wrapping_token = var.wrapping_token
-}
-
-resource "enos_remote_exec" "configure_pr_secondary" {
-  environment = {
-    VAULT_ADDR  = "http://127.0.0.1:8200"
-    VAULT_TOKEN = var.vault_root_token
-  }
-
-  inline = ["${var.vault_install_dir}/vault write sys/replication/performance/secondary/enable token=${local.wrapping_token}"]
-
-  transport = {
-    ssh = {
-      host = var.secondary_leader_public_ip
-    }
-  }
-}
diff --git a/enos/modules/vault_setup_replication_secondary/main.tf b/enos/modules/vault_setup_replication_secondary/main.tf
new file mode 100644
index 00000000000..8dd32fdcf57
--- /dev/null
+++ b/enos/modules/vault_setup_replication_secondary/main.tf
@@ -0,0 +1,114 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "secondary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The secondary cluster leader host"
+}
+
+variable "replication_type" {
+  type        = string
+  description = "The type of replication to perform"
+
+  validation {
+    condition     = contains(["dr", "performance"], var.replication_type)
+    error_message = "The replication_type must be either dr or performance"
+  }
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+variable "wrapping_token" {
+  type        = string
+  description = "The wrapping token created on primary cluster"
+}
+
+resource "enos_remote_exec" "enable_replication" {
+  environment = {
+    VAULT_ADDR  = var.vault_addr
+    VAULT_TOKEN = var.vault_root_token
+  }
+
+  inline = ["${var.vault_install_dir}/vault write sys/replication/${var.replication_type}/secondary/enable token=${var.wrapping_token}"]
+
+  transport = {
+    ssh = {
+      host = var.secondary_leader_host.public_ip
+    }
+  }
+}
+
+// Wait for our primary host to be the "leader", which means it's running and all "setup" tasks
+// have been completed. We'll have to unseal our follower nodes after this has occurred.
+module "wait_for_leader" {
+  source = "../vault_wait_for_leader"
+
+  depends_on = [
+    enos_remote_exec.enable_replication
+  ]
+
+  hosts             = { "0" : var.secondary_leader_host }
+  ip_version        = var.ip_version
+  vault_addr        = var.vault_addr
+  vault_install_dir = var.vault_install_dir
+  vault_root_token  = var.vault_root_token
+}
+
+// Ensure that our leader is ready to for us to unseal follower nodes.
+resource "enos_remote_exec" "wait_for_leader_ready" {
+  depends_on = [
+    module.wait_for_leader,
+  ]
+
+  environment = {
+    REPLICATION_TYPE  = var.replication_type
+    RETRY_INTERVAL    = 3  // seconds
+    TIMEOUT_SECONDS   = 60 // seconds
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/scripts/wait-for-leader-ready.sh")]
+
+  transport = {
+    ssh = {
+      host = var.secondary_leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/vault_setup_replication_secondary/scripts/wait-for-leader-ready.sh b/enos/modules/vault_setup_replication_secondary/scripts/wait-for-leader-ready.sh
new file mode 100644
index 00000000000..283ec50451a
--- /dev/null
+++ b/enos/modules/vault_setup_replication_secondary/scripts/wait-for-leader-ready.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  return 1
+}
+
+[[ -z "$REPLICATION_TYPE" ]] && fail "REPLICATION_TYPE env variable has not been set"
+[[ -z "$RETRY_INTERVAL" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "$TIMEOUT_SECONDS" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+
+replicationStatus() {
+  $binpath read "sys/replication/${REPLICATION_TYPE}/status" | jq .data
+}
+
+isReady() {
+  # Find the leader private IP address
+  local status
+  if ! status=$(replicationStatus); then
+    return 1
+  fi
+
+  if ! jq -eMc '.state == "stream-wals"' &> /dev/null <<< "$status"; then
+    echo "DR replication state is not yet running" 1>&2
+    echo "DR replication is not yet running, got: $(jq '.state' <<< "$status")" 1>&2
+    return 1
+  fi
+
+  if ! jq -eMc '.mode == "secondary"' &> /dev/null <<< "$status"; then
+    echo "DR replication mode is not yet primary, got: $(jq '.mode' <<< "$status")" 1>&2
+    return 1
+  fi
+
+  if ! jq -eMc '.corrupted_merkle_tree == false' &> /dev/null <<< "$status"; then
+    echo "DR replication merkle is corrupted" 1>&2
+    return 1
+  fi
+
+  echo "${REPLICATION_TYPE} primary is ready for followers to be unsealed!" 1>&2
+  return 0
+}
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [ "$(date +%s)" -lt "$end_time" ]; do
+  if isReady; then
+    exit 0
+  fi
+
+  sleep "$RETRY_INTERVAL"
+done
+
+fail "Timed out waiting for ${REPLICATION_TYPE} primary to ready: $(replicationStatus)"
diff --git a/enos/modules/vault_step_down/main.tf b/enos/modules/vault_step_down/main.tf
new file mode 100644
index 00000000000..49f03b6b0e7
--- /dev/null
+++ b/enos/modules/vault_step_down/main.tf
@@ -0,0 +1,50 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "leader_host" {
+  type = object({
+    private_ip = string
+    public_ip  = string
+  })
+
+  description = "The vault cluster host that can be expected as a leader"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+resource "enos_remote_exec" "vault_operator_step_down" {
+  environment = {
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/scripts/operator-step-down.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/vault_step_down/scripts/operator-step-down.sh b/enos/modules/vault_step_down/scripts/operator-step-down.sh
new file mode 100644
index 00000000000..540e3677f59
--- /dev/null
+++ b/enos/modules/vault_step_down/scripts/operator-step-down.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -eou pipefail
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+eval "$binpath" operator step-down
diff --git a/enos/modules/vault_test_ui/main.tf b/enos/modules/vault_test_ui/main.tf
index 4f9afb4be28..cde05162442 100644
--- a/enos/modules/vault_test_ui/main.tf
+++ b/enos/modules/vault_test_ui/main.tf
@@ -1,10 +1,10 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
diff --git a/enos/modules/vault_test_ui/outputs.tf b/enos/modules/vault_test_ui/outputs.tf
index ae4f926b3f9..c7e5b90ecab 100644
--- a/enos/modules/vault_test_ui/outputs.tf
+++ b/enos/modules/vault_test_ui/outputs.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 output "ui_test_stderr" {
diff --git a/enos/modules/vault_test_ui/scripts/test_ui.sh b/enos/modules/vault_test_ui/scripts/test_ui.sh
index 1913f74732d..3aa04118876 100755
--- a/enos/modules/vault_test_ui/scripts/test_ui.sh
+++ b/enos/modules/vault_test_ui/scripts/test_ui.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -eux -o pipefail
 
 project_root=$(git rev-parse --show-toplevel)
diff --git a/enos/modules/vault_test_ui/variables.tf b/enos/modules/vault_test_ui/variables.tf
index 9dec392d09b..59ac7f1abf2 100644
--- a/enos/modules/vault_test_ui/variables.tf
+++ b/enos/modules/vault_test_ui/variables.tf
@@ -1,8 +1,8 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 variable "vault_addr" {
-  description = "The host address for the vault instance to test"
+  description = "The local vault API listen address"
   type        = string
 }
 
diff --git a/enos/modules/vault_unseal_nodes/main.tf b/enos/modules/vault_unseal_nodes/main.tf
deleted file mode 100644
index 7b39b5c2819..00000000000
--- a/enos/modules/vault_unseal_nodes/main.tf
+++ /dev/null
@@ -1,127 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-# This module unseals the replication secondary follower nodes
-terraform {
-  required_providers {
-    enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
-    }
-  }
-}
-
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "follower_public_ips" {
-  type        = list(string)
-  description = "Vault cluster follower Public IP addresses"
-}
-
-variable "vault_seal_type" {
-  type        = string
-  description = "The Vault seal type"
-}
-
-variable "vault_unseal_keys" {}
-
-locals {
-  followers      = toset([for idx in range(var.vault_instance_count - 1) : tostring(idx)])
-  vault_bin_path = "${var.vault_install_dir}/vault"
-}
-
-# After replication is enabled the secondary follower nodes are expected to be sealed,
-# so we wait for the secondary follower nodes to update the seal status
-resource "enos_remote_exec" "wait_until_sealed" {
-  for_each = {
-    for idx, follower in local.followers : idx => follower
-  }
-  environment = {
-    VAULT_ADDR        = "http://127.0.0.1:8200"
-    VAULT_INSTALL_DIR = var.vault_install_dir
-  }
-
-  scripts = [abspath("${path.module}/scripts/wait-until-sealed.sh")]
-
-  transport = {
-    ssh = {
-      host = element(var.follower_public_ips, each.key)
-    }
-  }
-}
-
-# The follower nodes on secondary replication cluster incorrectly report
-# unseal progress 2/3 (Issue: https://hashicorp.atlassian.net/browse/VAULT-12309),
-# so we restart the followers to clear the status and to autounseal incase of awskms seal type
-resource "enos_remote_exec" "restart_followers" {
-  depends_on = [enos_remote_exec.wait_until_sealed]
-  for_each = {
-    for idx, follower in local.followers : idx => follower
-  }
-
-  inline = ["sudo systemctl restart vault"]
-
-  transport = {
-    ssh = {
-      host = element(var.follower_public_ips, each.key)
-    }
-  }
-}
-
-# We cannot use the vault_unseal resouce due to the known issue
-# (https://hashicorp.atlassian.net/browse/VAULT-12311). We use a custom
-# script to allow retry for unsealing the secondary followers
-resource "enos_remote_exec" "unseal_followers" {
-  depends_on = [enos_remote_exec.restart_followers]
-  # The unseal keys are required only for seal_type shamir
-  for_each = {
-    for idx, follower in local.followers : idx => follower
-    if var.vault_seal_type == "shamir"
-  }
-
-  environment = {
-    VAULT_ADDR        = "http://127.0.0.1:8200"
-    VAULT_INSTALL_DIR = var.vault_install_dir
-    UNSEAL_KEYS       = join(",", var.vault_unseal_keys)
-  }
-
-  scripts = [abspath("${path.module}/scripts/unseal-node.sh")]
-
-  transport = {
-    ssh = {
-      host = element(var.follower_public_ips, each.key)
-    }
-  }
-}
-
-# This is a second attempt needed to unseal the secondary followers
-# using a custom script due to get past the known issue
-# (https://hashicorp.atlassian.net/browse/VAULT-12311)
-resource "enos_remote_exec" "unseal_followers_again" {
-  depends_on = [enos_remote_exec.unseal_followers]
-  for_each = {
-    for idx, follower in local.followers : idx => follower
-    if var.vault_seal_type == "shamir"
-  }
-
-  environment = {
-    VAULT_ADDR        = "http://127.0.0.1:8200"
-    VAULT_INSTALL_DIR = var.vault_install_dir
-    UNSEAL_KEYS       = join(",", var.vault_unseal_keys)
-  }
-
-  scripts = [abspath("${path.module}/scripts/unseal-node.sh")]
-
-  transport = {
-    ssh = {
-      host = element(var.follower_public_ips, each.key)
-    }
-  }
-}
diff --git a/enos/modules/vault_unseal_replication_followers/main.tf b/enos/modules/vault_unseal_replication_followers/main.tf
new file mode 100644
index 00000000000..88f51163809
--- /dev/null
+++ b/enos/modules/vault_unseal_replication_followers/main.tf
@@ -0,0 +1,129 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# This module unseals the replication secondary follower nodes
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The Vault cluster hosts to unseal"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_seal_type" {
+  type        = string
+  description = "The Vault seal type"
+}
+
+variable "vault_unseal_keys" {}
+
+locals {
+  vault_bin_path = "${var.vault_install_dir}/vault"
+}
+
+# After replication is enabled the secondary follower nodes are expected to be sealed,
+# so we wait for the secondary follower nodes to update the seal status
+resource "enos_remote_exec" "wait_until_sealed" {
+  for_each = var.hosts
+  environment = {
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/scripts/wait-until-sealed.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+# The follower nodes on secondary replication cluster incorrectly report
+# unseal progress 2/3 (Issue: https://hashicorp.atlassian.net/browse/VAULT-12309),
+# so we restart the followers to allow them to auto-unseal
+resource "enos_remote_exec" "restart_followers" {
+  depends_on = [enos_remote_exec.wait_until_sealed]
+  for_each = {
+    for idx, host in var.hosts : idx => host
+    if var.vault_seal_type != "shamir"
+  }
+
+  inline = ["sudo systemctl restart vault"]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+# We cannot use the vault_unseal resouce due to the known issue
+# (https://hashicorp.atlassian.net/browse/VAULT-12311). We use a custom
+# script to allow retry for unsealing the secondary followers
+resource "enos_remote_exec" "unseal_followers" {
+  depends_on = [enos_remote_exec.restart_followers]
+  # The unseal keys are required only for seal_type shamir
+  for_each = {
+    for idx, host in var.hosts : idx => host
+    if var.vault_seal_type == "shamir"
+  }
+
+  environment = {
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    UNSEAL_KEYS       = join(",", var.vault_unseal_keys)
+  }
+
+  scripts = [abspath("${path.module}/scripts/unseal-node.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+# This is a second attempt needed to unseal the secondary followers
+# using a custom script due to get past the known issue
+# (https://hashicorp.atlassian.net/browse/VAULT-12311)
+resource "enos_remote_exec" "unseal_followers_again" {
+  depends_on = [enos_remote_exec.unseal_followers]
+  for_each = {
+    for idx, host in var.hosts : idx => host
+    if var.vault_seal_type == "shamir"
+  }
+
+  environment = {
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    UNSEAL_KEYS       = join(",", var.vault_unseal_keys)
+  }
+
+  scripts = [abspath("${path.module}/scripts/unseal-node.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/vault_unseal_nodes/scripts/unseal-node.sh b/enos/modules/vault_unseal_replication_followers/scripts/unseal-node.sh
similarity index 95%
rename from enos/modules/vault_unseal_nodes/scripts/unseal-node.sh
rename to enos/modules/vault_unseal_replication_followers/scripts/unseal-node.sh
index b02ffa52c14..7a2772fb3b3 100755
--- a/enos/modules/vault_unseal_nodes/scripts/unseal-node.sh
+++ b/enos/modules/vault_unseal_replication_followers/scripts/unseal-node.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 binpath=${VAULT_INSTALL_DIR}/vault
 
 IFS="," read -r -a keys <<< "${UNSEAL_KEYS}"
diff --git a/enos/modules/vault_unseal_nodes/scripts/wait-until-sealed.sh b/enos/modules/vault_unseal_replication_followers/scripts/wait-until-sealed.sh
similarity index 93%
rename from enos/modules/vault_unseal_nodes/scripts/wait-until-sealed.sh
rename to enos/modules/vault_unseal_replication_followers/scripts/wait-until-sealed.sh
index 5654629c5cd..ccb59ce627d 100644
--- a/enos/modules/vault_unseal_nodes/scripts/wait-until-sealed.sh
+++ b/enos/modules/vault_unseal_replication_followers/scripts/wait-until-sealed.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 binpath=${VAULT_INSTALL_DIR}/vault
 
 function fail() {
diff --git a/enos/modules/vault_upgrade/main.tf b/enos/modules/vault_upgrade/main.tf
index a2844ab5604..a4d0e81c518 100644
--- a/enos/modules/vault_upgrade/main.tf
+++ b/enos/modules/vault_upgrade/main.tf
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
@@ -7,38 +7,35 @@ terraform {
       source = "hashicorp/aws"
     }
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source  = "registry.terraform.io/hashicorp-forge/enos"
+      version = ">= 0.5.4"
     }
   }
 }
 
-variable "vault_api_addr" {
-  type        = string
-  description = "The API address of the Vault cluster"
-}
-
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "vault_instances" {
+variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
   description = "The vault cluster instances that were created"
 }
 
-variable "vault_local_artifact_path" {
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "vault_addr" {
   type        = string
-  description = "The path to a locally built vault artifact to install"
-  default     = null
+  description = "The local vault API listen address"
 }
 
 variable "vault_artifactory_release" {
@@ -52,6 +49,22 @@ variable "vault_artifactory_release" {
   default     = null
 }
 
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_local_artifact_path" {
+  type        = string
+  description = "The path to a locally built vault artifact to install"
+  default     = null
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
 variable "vault_seal_type" {
   type        = string
   description = "The Vault seal type"
@@ -64,19 +77,15 @@ variable "vault_unseal_keys" {
 }
 
 locals {
-  instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
-  followers      = toset([for idx in range(var.vault_instance_count - 1) : tostring(idx)])
-  follower_ips   = compact(split(" ", enos_remote_exec.get_follower_public_ips.stdout))
   vault_bin_path = "${var.vault_install_dir}/vault"
 }
 
+// Upgrade the Vault artifact in-place. With zip bundles we must use the same path of the original
+// installation so that we can re-use the systemd unit that enos_vault_start created at
+// /etc/systemd/system/vault.service. The path does not matter for package types as the systemd
+// unit for the bianry is included and will be installed.
 resource "enos_bundle_install" "upgrade_vault_binary" {
-  for_each = local.instances
+  for_each = var.hosts
 
   destination = var.vault_install_dir
   artifactory = var.vault_artifactory_release
@@ -89,95 +98,98 @@ resource "enos_bundle_install" "upgrade_vault_binary" {
   }
 }
 
-resource "enos_remote_exec" "get_leader_public_ip" {
+// We assume that our original Vault cluster used a zip bundle from releases.hashicorp.com and as
+// such enos_vault_start will have created a systemd unit for it at /etc/systemd/systemd/vault.service.
+// If we're upgrading to a package that contains its own systemd unit we'll need to remove the
+// old unit file so that when we restart vault we pick up the new unit that points to the updated
+// binary.
+resource "enos_remote_exec" "maybe_remove_old_unit_file" {
+  for_each   = var.hosts
   depends_on = [enos_bundle_install.upgrade_vault_binary]
 
-  scripts = [abspath("${path.module}/scripts/get-leader-public-ip.sh")]
-
   environment = {
-    VAULT_INSTALL_DIR = var.vault_install_dir,
-    VAULT_INSTANCES   = jsonencode(local.instances)
+    ARTIFACT_NAME = enos_bundle_install.upgrade_vault_binary[each.key].name
   }
 
+  scripts = [abspath("${path.module}/scripts/maybe-remove-old-unit-file.sh")]
+
   transport = {
     ssh = {
-      host = local.instances[0].public_ip
+      host = each.value.public_ip
     }
   }
 }
 
-resource "enos_remote_exec" "get_follower_public_ips" {
-  depends_on = [enos_bundle_install.upgrade_vault_binary]
+module "get_ip_addresses" {
+  source = "../vault_get_cluster_ips"
 
-  environment = {
-    VAULT_INSTALL_DIR = var.vault_install_dir,
-    VAULT_INSTANCES   = jsonencode(local.instances)
-  }
+  depends_on = [enos_remote_exec.maybe_remove_old_unit_file]
 
-  scripts = [abspath("${path.module}/scripts/get-follower-public-ips.sh")]
-
-  transport = {
-    ssh = {
-      host = local.instances[0].public_ip
-    }
-  }
+  hosts             = var.hosts
+  ip_version        = var.ip_version
+  vault_addr        = var.vault_addr
+  vault_install_dir = var.vault_install_dir
+  vault_root_token  = var.vault_root_token
 }
 
-resource "enos_remote_exec" "restart_followers" {
-  for_each   = local.followers
-  depends_on = [enos_remote_exec.get_follower_public_ips]
-
-  scripts = [abspath("${path.module}/scripts/restart-vault.sh")]
-
-  transport = {
-    ssh = {
-      host = trimspace(local.follower_ips[tonumber(each.key)])
-    }
-  }
+module "restart_followers" {
+  source            = "../restart_vault"
+  hosts             = module.get_ip_addresses.follower_hosts
+  vault_addr        = var.vault_addr
+  vault_install_dir = var.vault_install_dir
 }
 
 resource "enos_vault_unseal" "followers" {
-  depends_on = [enos_remote_exec.restart_followers]
   for_each = {
-    for idx, follower in local.followers : idx => follower
+    for idx, host in module.get_ip_addresses.follower_hosts : idx => host
     if var.vault_seal_type == "shamir"
   }
+  depends_on = [module.restart_followers]
+
   bin_path    = local.vault_bin_path
-  vault_addr  = var.vault_api_addr
+  vault_addr  = var.vault_addr
   seal_type   = var.vault_seal_type
   unseal_keys = var.vault_unseal_keys
 
   transport = {
     ssh = {
-      host = trimspace(local.follower_ips[each.key])
+      host = each.value.public_ip
     }
   }
 }
 
-resource "enos_remote_exec" "restart_leader" {
-  depends_on = [enos_vault_unseal.followers]
+module "wait_for_followers_unsealed" {
+  source = "../vault_wait_for_cluster_unsealed"
+  depends_on = [
+    module.restart_followers,
+    enos_vault_unseal.followers,
+  ]
 
-  scripts = [abspath("${path.module}/scripts/restart-vault.sh")]
+  hosts             = module.get_ip_addresses.follower_hosts
+  vault_addr        = var.vault_addr
+  vault_install_dir = var.vault_install_dir
+}
 
-  transport = {
-    ssh = {
-      host = trimspace(enos_remote_exec.get_leader_public_ip.stdout)
-    }
-  }
+module "restart_leader" {
+  depends_on        = [module.wait_for_followers_unsealed]
+  source            = "../restart_vault"
+  hosts             = module.get_ip_addresses.leader_hosts
+  vault_addr        = var.vault_addr
+  vault_install_dir = var.vault_install_dir
 }
 
 resource "enos_vault_unseal" "leader" {
   count      = var.vault_seal_type == "shamir" ? 1 : 0
-  depends_on = [enos_remote_exec.restart_leader]
+  depends_on = [module.restart_leader]
 
   bin_path    = local.vault_bin_path
-  vault_addr  = var.vault_api_addr
+  vault_addr  = var.vault_addr
   seal_type   = var.vault_seal_type
   unseal_keys = var.vault_unseal_keys
 
   transport = {
     ssh = {
-      host = trimspace(enos_remote_exec.get_leader_public_ip.stdout)
+      host = module.get_ip_addresses.leader_public_ip
     }
   }
 }
diff --git a/enos/modules/vault_upgrade/scripts/get-follower-public-ips.sh b/enos/modules/vault_upgrade/scripts/get-follower-public-ips.sh
deleted file mode 100644
index 8cfa1b2fa61..00000000000
--- a/enos/modules/vault_upgrade/scripts/get-follower-public-ips.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-set -e
-
-binpath=${VAULT_INSTALL_DIR}/vault
-export VAULT_ADDR="http://localhost:8200"
-
-instances=${VAULT_INSTANCES}
-
-# Find the leader
-leader_address=$($binpath status -format json | jq '.leader_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")')
-
-# Get the public ip addresses of the followers
-follower_ips=$(jq ".[] | select(.private_ip!=$leader_address) | .public_ip" <<< "$instances")
-
-echo "$follower_ips" | sed 's/\"//g' | tr '\n' ' '
diff --git a/enos/modules/vault_upgrade/scripts/get-leader-public-ip.sh b/enos/modules/vault_upgrade/scripts/get-leader-public-ip.sh
deleted file mode 100644
index 40444db7742..00000000000
--- a/enos/modules/vault_upgrade/scripts/get-leader-public-ip.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-set -e
-
-binpath=${VAULT_INSTALL_DIR}/vault
-export VAULT_ADDR="http://localhost:8200"
-
-instances=${VAULT_INSTANCES}
-
-# Find the leader
-leader_address=$($binpath status -format json | jq '.leader_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")')
-
-# Get the public ip address of the leader
-leader_public=$(jq ".[] | select(.private_ip==$leader_address) | .public_ip" <<< "$instances")
-#shellcheck disable=SC2001
-echo "$leader_public" | sed 's/\"//g'
diff --git a/enos/modules/vault_upgrade/scripts/maybe-remove-old-unit-file.sh b/enos/modules/vault_upgrade/scripts/maybe-remove-old-unit-file.sh
new file mode 100644
index 00000000000..510dbcad00f
--- /dev/null
+++ b/enos/modules/vault_upgrade/scripts/maybe-remove-old-unit-file.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$ARTIFACT_NAME" ]] && fail "ARTIFACT_NAME env variable has not been set"
+
+if [ "${ARTIFACT_NAME##*.}" == "zip" ]; then
+  echo "Skipped removing unit file because new artifact is a zip bundle"
+  exit 0
+fi
+
+# Get the unit file for the vault.service that is running. If it's not in /etc/systemd then it
+# should be a package provided unit file so we don't need to delete anything.
+#
+# Note that we use -p instead of -P so that we support ancient amzn 2 systemctl.
+if ! unit_path=$(systemctl show -p FragmentPath vault | cut -d = -f2 2>&1); then
+  echo "Skipped removing unit file because and existing path could not be found: $unit_path"
+  exit 0
+fi
+
+if [[ "$unit_path" == *"/etc/systemd"* ]]; then
+  if [ -f "$unit_path" ]; then
+    echo "Removing old systemd unit file: $unit_path"
+    if ! out=$(sudo rm "$unit_path" 2>&1); then
+      fail "Failed to remove old unit file: $unit_path: $out"
+    fi
+  else
+    echo "Skipped removing old systemd unit file because it no longer exists: $unit_path"
+  fi
+else
+  echo "Skipped removing old systemd unit file because it was not created in /etc/systemd/: $unit_path"
+fi
diff --git a/enos/modules/vault_upgrade/scripts/restart-vault.sh b/enos/modules/vault_upgrade/scripts/restart-vault.sh
deleted file mode 100644
index 981ceadcde4..00000000000
--- a/enos/modules/vault_upgrade/scripts/restart-vault.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-set -eux
-
-sudo systemctl restart vault
diff --git a/enos/modules/vault_verify_agent_output/main.tf b/enos/modules/vault_verify_agent_output/main.tf
index f759f30510a..1debed5e5f8 100644
--- a/enos/modules/vault_verify_agent_output/main.tf
+++ b/enos/modules/vault_verify_agent_output/main.tf
@@ -1,58 +1,44 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_agent_template_destination" {
-  type        = string
-  description = "The destination of the template rendered by Agent"
-}
-
-variable "vault_agent_expected_output" {
-  type        = string
-  description = "The output that's expected in the rendered template at vault_agent_template_destination"
-}
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "vault_instances" {
+variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
   description = "The vault cluster instances that were created"
 }
 
-locals {
-  vault_instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
+variable "vault_agent_expected_output" {
+  type        = string
+  description = "The output that's expected in the rendered template at vault_agent_template_destination"
+}
+
+variable "vault_agent_template_destination" {
+  type        = string
+  description = "The destination of the template rendered by Agent"
 }
 
 resource "enos_remote_exec" "verify_vault_agent_output" {
   environment = {
     VAULT_AGENT_TEMPLATE_DESTINATION = var.vault_agent_template_destination
     VAULT_AGENT_EXPECTED_OUTPUT      = var.vault_agent_expected_output
-    VAULT_INSTANCES                  = jsonencode(local.vault_instances)
   }
 
   scripts = [abspath("${path.module}/scripts/verify-vault-agent-output.sh")]
 
   transport = {
     ssh = {
-      host = local.vault_instances[0].public_ip
+      host = var.hosts[0].public_ip
     }
   }
 }
diff --git a/enos/modules/vault_verify_agent_output/scripts/verify-vault-agent-output.sh b/enos/modules/vault_verify_agent_output/scripts/verify-vault-agent-output.sh
index 044c69130b3..aa92885b260 100644
--- a/enos/modules/vault_verify_agent_output/scripts/verify-vault-agent-output.sh
+++ b/enos/modules/vault_verify_agent_output/scripts/verify-vault-agent-output.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
 fail() {
diff --git a/enos/modules/vault_verify_autopilot/main.tf b/enos/modules/vault_verify_autopilot/main.tf
index 5681e7d848e..aebb9f7eb01 100644
--- a/enos/modules/vault_verify_autopilot/main.tf
+++ b/enos/modules/vault_verify_autopilot/main.tf
@@ -1,35 +1,31 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "vault_instances" {
+variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
   description = "The vault cluster instances that were created"
 }
 
-variable "vault_root_token" {
+variable "vault_addr" {
   type        = string
-  description = "The vault root token"
+  description = "The local vault API listen address"
+}
+
+variable "vault_autopilot_upgrade_status" {
+  type        = string
+  description = "The autopilot upgrade expected status"
 }
 
 variable "vault_autopilot_upgrade_version" {
@@ -37,24 +33,21 @@ variable "vault_autopilot_upgrade_version" {
   description = "The Vault upgraded version"
 }
 
-variable "vault_autopilot_upgrade_status" {
+variable "vault_install_dir" {
   type        = string
-  description = "The autopilot upgrade expected status"
+  description = "The directory where the Vault binary will be installed"
 }
 
-locals {
-  public_ips = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
 }
 
 resource "enos_remote_exec" "smoke-verify-autopilot" {
-  for_each = local.public_ips
+  for_each = var.hosts
 
   environment = {
+    VAULT_ADDR                      = var.vault_addr
     VAULT_INSTALL_DIR               = var.vault_install_dir,
     VAULT_TOKEN                     = var.vault_root_token,
     VAULT_AUTOPILOT_UPGRADE_STATUS  = var.vault_autopilot_upgrade_status,
diff --git a/enos/modules/vault_verify_autopilot/scripts/smoke-verify-autopilot.sh b/enos/modules/vault_verify_autopilot/scripts/smoke-verify-autopilot.sh
index d19f453a071..b6a419f89b9 100755
--- a/enos/modules/vault_verify_autopilot/scripts/smoke-verify-autopilot.sh
+++ b/enos/modules/vault_verify_autopilot/scripts/smoke-verify-autopilot.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 fail() {
@@ -7,8 +7,7 @@ fail() {
   exit 1
 }
 
-export VAULT_ADDR="http://localhost:8200"
-
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
 [[ -z "$VAULT_AUTOPILOT_UPGRADE_STATUS" ]] && fail "VAULT_AUTOPILOT_UPGRADE_STATUS env variable has not been set"
 [[ -z "$VAULT_AUTOPILOT_UPGRADE_VERSION" ]] && fail "VAULT_AUTOPILOT_UPGRADE_VERSION env variable has not been set"
 [[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
diff --git a/enos/modules/vault_verify_billing_start_date/main.tf b/enos/modules/vault_verify_billing_start_date/main.tf
new file mode 100644
index 00000000000..6236bd8c3ba
--- /dev/null
+++ b/enos/modules/vault_verify_billing_start_date/main.tf
@@ -0,0 +1,64 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_cluster_addr_port" {
+  description = "The Raft cluster address port"
+  type        = string
+  default     = "8201"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_instance_count" {
+  type        = number
+  description = "How many vault instances are in the cluster"
+}
+
+variable "hosts" {
+  type = map(object({
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster instances that were created"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+resource "enos_remote_exec" "vault_verify_billing_start_date" {
+  for_each = var.hosts
+
+  environment = {
+    VAULT_ADDR              = var.vault_addr
+    VAULT_CLUSTER_ADDR      = "${each.value.private_ip}:${var.vault_cluster_addr_port}"
+    VAULT_INSTALL_DIR       = var.vault_install_dir
+    VAULT_LOCAL_BINARY_PATH = "${var.vault_install_dir}/vault"
+    VAULT_TOKEN             = var.vault_root_token
+  }
+
+  scripts = [abspath("${path.module}/scripts/verify-billing-start.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/vault_verify_billing_start_date/scripts/verify-billing-start.sh b/enos/modules/vault_verify_billing_start_date/scripts/verify-billing-start.sh
new file mode 100644
index 00000000000..a7d5a82ca3a
--- /dev/null
+++ b/enos/modules/vault_verify_billing_start_date/scripts/verify-billing-start.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+retry() {
+  local retries=$1
+  shift
+  local count=0
+
+  until "$@"; do
+    exit=$?
+    count=$((count + 1))
+    if [ "$count" -lt "$retries" ]; then
+      sleep 30
+    else
+      return "$exit"
+    fi
+  done
+
+  return 0
+}
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+enable_debugging() {
+  echo "Turning debugging on.."
+  export PS4='+(${BASH_SOURCE}:${LINENO})> ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
+  set -x
+}
+
+get_billing_start_date() {
+  "$binpath" read -format=json sys/internal/counters/config  | jq -r ".data.billing_start_timestamp"
+}
+
+get_target_platform() {
+  uname -s
+}
+
+# Given the date as ARGV 1, return 1 year as a unix date
+verify_date_is_in_current_year() {
+  local billing_start_unix
+  local one_year_ago_unix
+
+  # Verify if the billing start date is in the latest billing year
+  case $(get_target_platform) in
+    Linux)
+      billing_start_unix=$(TZ=UTC date -d "$1" +'%s')    # For "now", use $(date +'%s')
+      one_year_ago_unix=$(TZ=UTC date -d "1 year ago" +'%s')
+      ;;
+    Darwin)
+      one_year_ago_unix=$(TZ=UTC date -v -1y +'%s')
+      billing_start_unix=$(TZ=UTC date -j -f "%Y-%m-%dT%H:%M:%SZ" "${1}" +'%s')
+      ;;
+    *)
+      fail "Unsupported target host operating system: $(get_target_platform)" 1>&2
+      ;;
+  esac
+
+  if [ "$billing_start_unix" -gt "$one_year_ago_unix" ]; then
+    echo "Billing start date $1 has successfully rolled over to current year."
+    exit 0
+  else
+    local vault_ps
+    vault_ps=$(pgrep vault | xargs)
+    echo "On version $version, pid $vault_ps, addr $VAULT_ADDR, Billing start date $1 did not roll over to current year" 1>&2
+  fi
+}
+
+verify_billing_start_date() {
+  local billing_start
+  billing_start=$(get_billing_start_date)
+
+  if verify_date_is_in_current_year "$billing_start"; then
+    return 0
+  fi
+
+  local version
+  local vault_ps
+  version=$("$binpath" status -format=json | jq .version)
+  vault_ps=$(pgrep vault | xargs)
+  echo "On version $version, pid $vault_ps, addr $VAULT_ADDR, Billing start date $billing_start did not roll over to current year" 1>&2
+  return 1
+}
+
+enable_debugging
+
+retry 10 verify_billing_start_date
diff --git a/enos/modules/vault_verify_default_lcq/main.tf b/enos/modules/vault_verify_default_lcq/main.tf
index d79fd63d5ed..cac5b44aa02 100644
--- a/enos/modules/vault_verify_default_lcq/main.tf
+++ b/enos/modules/vault_verify_default_lcq/main.tf
@@ -1,35 +1,27 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "vault_instances" {
+variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
   description = "The vault cluster instances that were created"
 }
 
-variable "vault_root_token" {
-  type        = string
-  description = "The vault root token"
-}
-
-variable "vault_autopilot_default_max_leases" {
-  type        = string
-  description = "The autopilot upgrade expected max_leases"
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
 }
 
 variable "timeout" {
@@ -38,28 +30,28 @@ variable "timeout" {
   default     = 60
 }
 
-variable "retry_interval" {
-  type        = number
-  description = "How many seconds to wait between each retry"
-  default     = 2
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
 }
 
-locals {
-  public_ips = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
+variable "vault_autopilot_default_max_leases" {
+  type        = string
+  description = "The autopilot upgrade expected max_leases"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
 }
 
 resource "enos_remote_exec" "smoke_verify_default_lcq" {
-  for_each = local.public_ips
+  for_each = var.hosts
 
   environment = {
     RETRY_INTERVAL  = var.retry_interval
     TIMEOUT_SECONDS = var.timeout
-    VAULT_ADDR      = "http://localhost:8200"
+    VAULT_ADDR      = var.vault_addr
     VAULT_TOKEN     = var.vault_root_token
     DEFAULT_LCQ     = var.vault_autopilot_default_max_leases
   }
diff --git a/enos/modules/vault_verify_default_lcq/scripts/smoke-verify-default-lcq.sh b/enos/modules/vault_verify_default_lcq/scripts/smoke-verify-default-lcq.sh
index 493d8b8ba96..13f7d9090a3 100755
--- a/enos/modules/vault_verify_default_lcq/scripts/smoke-verify-default-lcq.sh
+++ b/enos/modules/vault_verify_default_lcq/scripts/smoke-verify-default-lcq.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 function fail() {
@@ -7,6 +7,9 @@ function fail() {
   exit 1
 }
 
+# Exit early if we haven't been given an expected DEFAULT_LCQ
+[[ -z "$DEFAULT_LCQ" ]] && exit 0
+
 [[ -z "$RETRY_INTERVAL" ]] && fail "RETRY_INTERVAL env variable has not been set"
 [[ -z "$TIMEOUT_SECONDS" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
 [[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
@@ -43,4 +46,4 @@ while [ "$(date +%s)" -lt "$end_time" ]; do
   sleep "$RETRY_INTERVAL"
 done
 
-fail "Timed out waiting for Default LCQ verification to complete. Data:\n\t$(getMaxLeases)"
\ No newline at end of file
+fail "Timed out waiting for Default LCQ verification to complete. Data:\n\t$(getMaxLeases)"
diff --git a/enos/modules/vault_verify_dr_replication/main.tf b/enos/modules/vault_verify_dr_replication/main.tf
new file mode 100644
index 00000000000..547b908fa43
--- /dev/null
+++ b/enos/modules/vault_verify_dr_replication/main.tf
@@ -0,0 +1,117 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "primary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The primary cluster leader host"
+}
+
+variable "secondary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The secondary cluster leader host"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "wrapping_token" {
+  type        = string
+  description = "The wrapping token created on primary cluster"
+  default     = null
+}
+
+locals {
+  primary_leader_addr          = var.ip_version == 6 ? var.primary_leader_host.ipv6 : var.primary_leader_host.private_ip
+  secondary_leader_addr        = var.ip_version == 6 ? var.secondary_leader_host.ipv6 : var.secondary_leader_host.private_ip
+  primary_replication_status   = jsondecode(enos_remote_exec.verify_replication_status_on_primary.stdout)
+  secondary_replication_status = jsondecode(enos_remote_exec.verify_replication_status_on_secondary.stdout)
+}
+
+resource "enos_remote_exec" "verify_replication_status_on_primary" {
+  environment = {
+    IP_VERSION            = var.ip_version
+    PRIMARY_LEADER_ADDR   = local.primary_leader_addr
+    SECONDARY_LEADER_ADDR = local.secondary_leader_addr
+    VAULT_ADDR            = var.vault_addr
+    VAULT_INSTALL_DIR     = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/scripts/verify-replication-status.sh")]
+
+  transport = {
+    ssh = {
+      host = var.primary_leader_host.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "verify_replication_status_on_secondary" {
+  environment = {
+    IP_VERSION            = var.ip_version
+    PRIMARY_LEADER_ADDR   = local.primary_leader_addr
+    SECONDARY_LEADER_ADDR = local.secondary_leader_addr
+    VAULT_ADDR            = var.vault_addr
+    VAULT_INSTALL_DIR     = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/scripts/verify-replication-status.sh")]
+
+  transport = {
+    ssh = {
+      host = var.secondary_leader_host.public_ip
+    }
+  }
+}
+
+output "primary_replication_status" {
+  value = local.primary_replication_status
+}
+
+output "known_primary_cluster_addrs" {
+  value = local.secondary_replication_status.data.known_primary_cluster_addrs
+}
+
+output "secondary_replication_status" {
+  value = local.secondary_replication_status
+}
+
+output "primary_replication_data_secondaries" {
+  value = local.primary_replication_status.data.secondaries
+}
+
+output "secondary_replication_data_primaries" {
+  value = local.secondary_replication_status.data.primaries
+}
diff --git a/enos/modules/vault_verify_dr_replication/scripts/verify-replication-status.sh b/enos/modules/vault_verify_dr_replication/scripts/verify-replication-status.sh
new file mode 100644
index 00000000000..5e446151865
--- /dev/null
+++ b/enos/modules/vault_verify_dr_replication/scripts/verify-replication-status.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# This script waits for the replication status to be established
+# then verifies the dr replication between primary and
+# secondary clusters
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$IP_VERSION" ]] && fail "IP_VERSION env variable has not been set"
+[[ -z "$PRIMARY_LEADER_ADDR" ]] && fail "PRIMARY_LEADER_ADDR env variable has not been set"
+[[ -z "$SECONDARY_LEADER_ADDR" ]] && fail "SECONDARY_LEADER_ADDR env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+retry() {
+  local retries=$1
+  shift
+  local count=0
+
+  until "$@"; do
+    wait=$((2 ** count))
+    count=$((count + 1))
+    if [ "$count" -lt "$retries" ]; then
+      sleep "$wait"
+    else
+      fail "$($binpath read -format=json sys/replication/dr/status)"
+    fi
+  done
+}
+
+check_dr_status() {
+  dr_status=$($binpath read -format=json sys/replication/dr/status)
+  cluster_state=$(jq -r '.data.state' <<< "$dr_status")
+  connection_mode=$(jq -r '.data.mode' <<< "$dr_status")
+
+  if [[ "$cluster_state" == 'idle' ]]; then
+    echo "replication cluster state is idle" 1>&2
+    return 1
+  fi
+
+  if [[ "$connection_mode" == "primary" ]]; then
+    connection_status=$(jq -r '.data.secondaries[0].connection_status' <<< "$dr_status")
+    if [[ "$connection_status" == 'disconnected' ]]; then
+      echo ".data.secondaries[0].connection_status from primary node is 'disconnected'" 1>&2
+      return 1
+    fi
+    # Confirm we are in a "running" state for the primary
+    if [[ "$cluster_state" != "running" ]]; then
+      echo "replication cluster primary state is not running" 1>&2
+      return 1
+    fi
+  else
+    connection_status=$(jq -r '.data.primaries[0].connection_status' <<< "$dr_status")
+    if [[ "$connection_status" == 'disconnected' ]]; then
+      echo ".data.primaries[0].connection_status from secondary node is 'disconnected'" 1>&2
+      return 1
+    fi
+    # Confirm we are in a "stream-wals" state for the secondary
+    if [[ "$cluster_state" != "stream-wals" ]]; then
+      echo "replication cluster primary state is not stream-wals" 1>&2
+      return 1
+    fi
+    known_primary_cluster_addrs=$(jq -r '.data.known_primary_cluster_addrs' <<< "$dr_status")
+    if ! echo "$known_primary_cluster_addrs" | grep -q "$PRIMARY_LEADER_ADDR"; then
+      echo "$PRIMARY_LEADER_ADDR is not in .data.known_primary_cluster_addrs: $known_primary_cluster_addrs" 1>&2
+      return 1
+    fi
+  fi
+
+  echo "$dr_status"
+  return 0
+}
+
+if [ "$IP_VERSION" != 4 ] && [ "$IP_VERSION" != 6 ]; then
+  fail "unsupported IP_VERSION: $IP_VERSION"
+fi
+
+# Retry for a while because it can take some time for replication to sync
+retry 10 check_dr_status
diff --git a/enos/modules/vault_verify_performance_replication/main.tf b/enos/modules/vault_verify_performance_replication/main.tf
index d834fadb6ef..547b908fa43 100644
--- a/enos/modules/vault_verify_performance_replication/main.tf
+++ b/enos/modules/vault_verify_performance_replication/main.tf
@@ -1,43 +1,50 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_cluster_addr_port" {
-  description = "The Raft cluster address port"
-  type        = string
-  default     = "8201"
-}
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
 
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
 }
 
-variable "primary_leader_public_ip" {
-  type        = string
-  description = "Vault primary cluster leader Public IP address"
+variable "primary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The primary cluster leader host"
 }
 
-variable "primary_leader_private_ip" {
-  type        = string
-  description = "Vault primary cluster leader Private IP address"
+variable "secondary_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The secondary cluster leader host"
 }
 
-variable "secondary_leader_public_ip" {
+variable "vault_addr" {
   type        = string
-  description = "Vault secondary cluster leader Public IP address"
+  description = "The local vault API listen address"
 }
 
-variable "secondary_leader_private_ip" {
+variable "vault_install_dir" {
   type        = string
-  description = "Vault secondary cluster leader Private IP address"
+  description = "The directory where the Vault binary will be installed"
 }
 
 variable "wrapping_token" {
@@ -47,40 +54,44 @@ variable "wrapping_token" {
 }
 
 locals {
+  primary_leader_addr          = var.ip_version == 6 ? var.primary_leader_host.ipv6 : var.primary_leader_host.private_ip
+  secondary_leader_addr        = var.ip_version == 6 ? var.secondary_leader_host.ipv6 : var.secondary_leader_host.private_ip
   primary_replication_status   = jsondecode(enos_remote_exec.verify_replication_status_on_primary.stdout)
   secondary_replication_status = jsondecode(enos_remote_exec.verify_replication_status_on_secondary.stdout)
 }
 
 resource "enos_remote_exec" "verify_replication_status_on_primary" {
   environment = {
-    VAULT_ADDR               = "http://127.0.0.1:8200"
-    VAULT_INSTALL_DIR        = var.vault_install_dir
-    PRIMARY_LEADER_PRIV_IP   = var.primary_leader_private_ip
-    SECONDARY_LEADER_PRIV_IP = var.secondary_leader_private_ip
+    IP_VERSION            = var.ip_version
+    PRIMARY_LEADER_ADDR   = local.primary_leader_addr
+    SECONDARY_LEADER_ADDR = local.secondary_leader_addr
+    VAULT_ADDR            = var.vault_addr
+    VAULT_INSTALL_DIR     = var.vault_install_dir
   }
 
   scripts = [abspath("${path.module}/scripts/verify-replication-status.sh")]
 
   transport = {
     ssh = {
-      host = var.primary_leader_public_ip
+      host = var.primary_leader_host.public_ip
     }
   }
 }
 
 resource "enos_remote_exec" "verify_replication_status_on_secondary" {
   environment = {
-    VAULT_ADDR               = "http://127.0.0.1:8200"
-    VAULT_INSTALL_DIR        = var.vault_install_dir
-    PRIMARY_LEADER_PRIV_IP   = var.primary_leader_private_ip
-    SECONDARY_LEADER_PRIV_IP = var.secondary_leader_private_ip
+    IP_VERSION            = var.ip_version
+    PRIMARY_LEADER_ADDR   = local.primary_leader_addr
+    SECONDARY_LEADER_ADDR = local.secondary_leader_addr
+    VAULT_ADDR            = var.vault_addr
+    VAULT_INSTALL_DIR     = var.vault_install_dir
   }
 
   scripts = [abspath("${path.module}/scripts/verify-replication-status.sh")]
 
   transport = {
     ssh = {
-      host = var.secondary_leader_public_ip
+      host = var.secondary_leader_host.public_ip
     }
   }
 }
diff --git a/enos/modules/vault_verify_performance_replication/scripts/verify-replication-status.sh b/enos/modules/vault_verify_performance_replication/scripts/verify-replication-status.sh
index 687ac3eb563..2d29aa9bc33 100644
--- a/enos/modules/vault_verify_performance_replication/scripts/verify-replication-status.sh
+++ b/enos/modules/vault_verify_performance_replication/scripts/verify-replication-status.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 # This script waits for the replication status to be established
 # then verifies the performance replication between primary and
 # secondary clusters
@@ -14,8 +13,9 @@ fail() {
   exit 1
 }
 
-[[ -z "$PRIMARY_LEADER_PRIV_IP" ]] && fail "PRIMARY_LEADER_PRIV_IP env variable has not been set"
-[[ -z "$SECONDARY_LEADER_PRIV_IP" ]] && fail "SECONDARY_LEADER_PRIV_IP env variable has not been set"
+[[ -z "$IP_VERSION" ]] && fail "IP_VERSION env variable has not been set"
+[[ -z "$PRIMARY_LEADER_ADDR" ]] && fail "PRIMARY_LEADER_ADDR env variable has not been set"
+[[ -z "$SECONDARY_LEADER_ADDR" ]] && fail "SECONDARY_LEADER_ADDR env variable has not been set"
 [[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
 [[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
 
@@ -40,8 +40,8 @@ retry() {
 
 check_pr_status() {
   pr_status=$($binpath read -format=json sys/replication/performance/status)
-  cluster_state=$(echo "$pr_status" | jq -r '.data.state')
-  connection_mode=$(echo "$pr_status" | jq -r '.data.mode')
+  cluster_state=$(jq -r '.data.state' <<< "$pr_status")
+  connection_mode=$(jq -r '.data.mode' <<< "$pr_status")
 
   if [[ "$cluster_state" == 'idle' ]]; then
     echo "replication cluster state is idle" 1>&2
@@ -49,30 +49,38 @@ check_pr_status() {
   fi
 
   if [[ "$connection_mode" == "primary" ]]; then
-    connection_status=$(echo "$pr_status" | jq -r '.data.secondaries[0].connection_status')
+    connection_status=$(jq -r '.data.secondaries[0].connection_status' <<< "$pr_status")
     if [[ "$connection_status" == 'disconnected' ]]; then
       echo ".data.secondaries[0].connection_status from primary node is 'disconnected'" 1>&2
       return 1
     fi
-    secondary_cluster_addr=$(echo "$pr_status" | jq -r '.data.secondaries[0].cluster_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")')
-    if [[ "$secondary_cluster_addr" != "$SECONDARY_LEADER_PRIV_IP" ]]; then
-      echo ".data.secondaries[0].cluster_address should have an IP address of $SECONDARY_LEADER_PRIV_IP, got: $secondary_cluster_addr" 1>&2
+    if [ "$IP_VERSION" == 4 ]; then
+      secondary_cluster_addr=$(jq -r '.data.secondaries[0].cluster_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")' <<< "$pr_status")
+    else
+      secondary_cluster_addr=$(jq -r '.data.secondaries[0].cluster_address | scan("\\[(.+)\\]") | .[0]' <<< "$pr_status")
+    fi
+    if [[ "$secondary_cluster_addr" != "$SECONDARY_LEADER_ADDR" ]]; then
+      echo ".data.secondaries[0].cluster_address should have an IP address of $SECONDARY_LEADER_ADDR, got: $secondary_cluster_addr" 1>&2
       return 1
     fi
   else
-    connection_status=$(echo "$pr_status" | jq -r '.data.primaries[0].connection_status')
+    connection_status=$(jq -r '.data.primaries[0].connection_status' <<< "$pr_status")
     if [[ "$connection_status" == 'disconnected' ]]; then
       echo ".data.primaries[0].connection_status from secondary node is 'disconnected'" 1>&2
       return 1
     fi
-    primary_cluster_addr=$(echo "$pr_status" | jq -r '.data.primaries[0].cluster_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")')
-    if [[ "$primary_cluster_addr" != "$PRIMARY_LEADER_PRIV_IP" ]]; then
-      echo ".data.primaries[0].cluster_address should have an IP address of $PRIMARY_LEADER_PRIV_IP, got: $primary_cluster_addr" 1>&2
+    if [ "$IP_VERSION" == 4 ]; then
+      primary_cluster_addr=$(jq -r '.data.primaries[0].cluster_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")' <<< "$pr_status")
+    else
+      primary_cluster_addr=$(jq -r '.data.primaries[0].cluster_address | scan("\\[(.+)\\]") | .[0]' <<< "$pr_status")
+    fi
+    if [[ "$primary_cluster_addr" != "$PRIMARY_LEADER_ADDR" ]]; then
+      echo ".data.primaries[0].cluster_address should have an IP address of $PRIMARY_LEADER_ADDR, got: $primary_cluster_addr" 1>&2
       return 1
     fi
-    known_primary_cluster_addrs=$(echo "$pr_status" | jq -r '.data.known_primary_cluster_addrs')
-    if ! echo "$known_primary_cluster_addrs" | grep -q "$PRIMARY_LEADER_PRIV_IP"; then
-      echo "$PRIMARY_LEADER_PRIV_IP is not in .data.known_primary_cluster_addrs: $known_primary_cluster_addrs" 1>&2
+    known_primary_cluster_addrs=$(jq -r '.data.known_primary_cluster_addrs' <<< "$pr_status")
+    if ! echo "$known_primary_cluster_addrs" | grep -q "$PRIMARY_LEADER_ADDR"; then
+      echo "$PRIMARY_LEADER_ADDR is not in .data.known_primary_cluster_addrs: $known_primary_cluster_addrs" 1>&2
       return 1
     fi
   fi
@@ -81,5 +89,9 @@ check_pr_status() {
   return 0
 }
 
+if [ "$IP_VERSION" != 4 ] && [ "$IP_VERSION" != 6 ]; then
+  fail "unsupported IP_VERSION: $IP_VERSION"
+fi
+
 # Retry for a while because it can take some time for replication to sync
 retry 10 check_pr_status
diff --git a/enos/modules/vault_verify_raft_auto_join_voter/main.tf b/enos/modules/vault_verify_raft_auto_join_voter/main.tf
index 969877713ea..30a28aebe10 100644
--- a/enos/modules/vault_verify_raft_auto_join_voter/main.tf
+++ b/enos/modules/vault_verify_raft_auto_join_voter/main.tf
@@ -1,18 +1,41 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster instances that were created"
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version to use for the Vault TCP listeners"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
 variable "vault_cluster_addr_port" {
   description = "The Raft cluster address port"
   type        = string
-  default     = "8201"
 }
 
 variable "vault_install_dir" {
@@ -20,38 +43,24 @@ variable "vault_install_dir" {
   description = "The directory where the Vault binary will be installed"
 }
 
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "vault_instances" {
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-  description = "The vault cluster instances that were created"
-}
-
 variable "vault_root_token" {
   type        = string
   description = "The vault root token"
 }
 
 locals {
-  instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
+  cluster_addrs = {
+    4 : { for k, v in var.hosts : k => "${v.private_ip}:${var.vault_cluster_addr_port}" },
+    6 : { for k, v in var.hosts : k => "[${v.ipv6}]:${var.vault_cluster_addr_port}" },
   }
 }
 
 resource "enos_remote_exec" "verify_raft_auto_join_voter" {
-  for_each = local.instances
+  for_each = var.hosts
 
   environment = {
-    VAULT_CLUSTER_ADDR      = "${each.value.private_ip}:${var.vault_cluster_addr_port}"
+    VAULT_ADDR              = var.vault_addr
+    VAULT_CLUSTER_ADDR      = local.cluster_addrs[var.ip_version][each.key]
     VAULT_INSTALL_DIR       = var.vault_install_dir
     VAULT_LOCAL_BINARY_PATH = "${var.vault_install_dir}/vault"
     VAULT_TOKEN             = var.vault_root_token
diff --git a/enos/modules/vault_verify_raft_auto_join_voter/scripts/verify-raft-auto-join-voter.sh b/enos/modules/vault_verify_raft_auto_join_voter/scripts/verify-raft-auto-join-voter.sh
index 6512d25876e..64c3b886ae5 100644
--- a/enos/modules/vault_verify_raft_auto_join_voter/scripts/verify-raft-auto-join-voter.sh
+++ b/enos/modules/vault_verify_raft_auto_join_voter/scripts/verify-raft-auto-join-voter.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
 binpath=${VAULT_INSTALL_DIR}/vault
@@ -42,9 +41,9 @@ check_voter_status() {
 
 test -x "$binpath" || fail "unable to locate vault binary at $binpath"
 
-export VAULT_ADDR='http://127.0.0.1:8200'
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
 [[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
 
 # Retry a few times because it can take some time for things to settle after
 # all the nodes are unsealed
-retry 7 check_voter_status
+retry 10 check_voter_status
diff --git a/enos/modules/vault_verify_read_data/main.tf b/enos/modules/vault_verify_read_data/main.tf
deleted file mode 100644
index c1713ac917d..00000000000
--- a/enos/modules/vault_verify_read_data/main.tf
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-terraform {
-  required_providers {
-    enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
-    }
-  }
-}
-
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "node_public_ips" {
-  type        = list(string)
-  description = "Vault cluster node Public IP address"
-}
-
-locals {
-  followers      = toset([for idx in range(var.vault_instance_count - 1) : tostring(idx)])
-  vault_bin_path = "${var.vault_install_dir}/vault"
-}
-
-resource "enos_remote_exec" "verify_kv_on_node" {
-  for_each = {
-    for idx, follower in local.followers : idx => follower
-  }
-  environment = {
-    VAULT_ADDR        = "http://127.0.0.1:8200"
-    VAULT_INSTALL_DIR = var.vault_install_dir
-  }
-
-  scripts = [abspath("${path.module}/scripts/verify-data.sh")]
-
-  transport = {
-    ssh = {
-      host = element(var.node_public_ips, each.key)
-    }
-  }
-}
diff --git a/enos/modules/vault_verify_read_data/scripts/verify-data.sh b/enos/modules/vault_verify_read_data/scripts/verify-data.sh
deleted file mode 100644
index 5919aa04c31..00000000000
--- a/enos/modules/vault_verify_read_data/scripts/verify-data.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-set -e
-
-function retry {
-  local retries=$1
-  shift
-  local count=0
-
-  until "$@"; do
-    exit=$?
-    wait=$((2 ** count))
-    count=$((count + 1))
-    if [ "$count" -lt "$retries" ]; then
-      sleep "$wait"
-    else
-      return "$exit"
-    fi
-  done
-
-  return 0
-}
-
-fail() {
-  echo "$1" 1>&2
-  return 1
-}
-
-binpath="${VAULT_INSTALL_DIR}/vault"
-
-test -x "$binpath" || fail "unable to locate vault binary at $binpath"
-
-# To keep the authentication method and module verification consistent between all
-# Enos scenarios we authenticate using testuser created by vault_verify_write_data module
-retry 5 "$binpath" login -method=userpass username=testuser password=passuser1
-retry 5 "$binpath" kv get secret/test
diff --git a/enos/modules/vault_verify_removed_node/main.tf b/enos/modules/vault_verify_removed_node/main.tf
new file mode 100644
index 00000000000..201fc3f8127
--- /dev/null
+++ b/enos/modules/vault_verify_removed_node/main.tf
@@ -0,0 +1,250 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster instances that were removed"
+}
+
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
+variable "timeout" {
+  type        = number
+  description = "The max number of seconds to wait before timing out"
+  default     = 60
+}
+
+variable "listener_port" {
+  type        = number
+  description = "The listener port for vault"
+}
+variable "vault_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The leader's host information"
+}
+variable "vault_addr" {
+  type        = string
+  description = "The local address to use to query vault"
+}
+variable "cluster_port" {
+  type        = number
+  description = "The cluster port for vault"
+}
+
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version to use for the Vault TCP listeners"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+variable "vault_seal_type" {
+  type        = string
+  description = "The Vault seal type"
+}
+
+variable "add_back_nodes" {
+  type        = bool
+  description = "whether to add the nodes back"
+}
+
+variable "vault_unseal_keys" {}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the vault binary is installed"
+}
+
+resource "enos_remote_exec" "verify_raft_peer_removed" {
+  for_each = var.hosts
+
+  environment = {
+    RETRY_INTERVAL    = var.retry_interval
+    TIMEOUT_SECONDS   = var.timeout
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/scripts/verify_raft_remove_peer.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "verify_unseal_fails" {
+  for_each = {
+    for idx, host in var.hosts : idx => host
+    if var.vault_seal_type == "shamir"
+  }
+
+  environment = {
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    UNSEAL_KEYS       = join(",", var.vault_unseal_keys)
+  }
+
+  scripts = [abspath("${path.module}/scripts/verify_unseal_fails.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "verify_rejoin_fails" {
+  for_each = var.hosts
+
+  environment = {
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    RETRY_INTERVAL    = var.retry_interval
+    TIMEOUT_SECONDS   = var.timeout
+    VAULT_LEADER_ADDR = "${var.ip_version == 4 ? "${var.vault_leader_host.private_ip}" : "[${var.vault_leader_host.ipv6}]"}:${var.listener_port}"
+  }
+
+  scripts = [abspath("${path.module}/scripts/verify_manual_rejoin_fails.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+module "restart" {
+  depends_on = [
+    enos_remote_exec.verify_rejoin_fails,
+    enos_remote_exec.verify_raft_peer_removed,
+    enos_remote_exec.verify_unseal_fails
+  ]
+  source            = "../restart_vault"
+  hosts             = var.hosts
+  vault_addr        = var.vault_addr
+  vault_install_dir = var.vault_install_dir
+}
+
+resource "enos_remote_exec" "verify_removed_after_restart" {
+  depends_on = [module.restart]
+  for_each   = var.hosts
+
+  environment = {
+    RETRY_INTERVAL    = var.retry_interval
+    TIMEOUT_SECONDS   = var.timeout
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+  }
+
+  scripts = [abspath("${path.module}/scripts/verify_raft_remove_peer.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+module "stop" {
+  depends_on = [enos_remote_exec.verify_removed_after_restart]
+  source     = "../stop_vault"
+  count      = var.add_back_nodes ? 1 : 0
+
+  hosts = var.hosts
+}
+
+resource "enos_remote_exec" "delete_data" {
+  depends_on = [module.stop]
+  for_each = {
+    for idx, host in var.hosts : idx => host
+    if var.add_back_nodes
+  }
+
+  inline = ["sudo rm -rf /opt/raft/data/*"]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+
+}
+
+resource "enos_remote_exec" "start" {
+  depends_on = [enos_remote_exec.delete_data]
+  for_each = {
+    for idx, host in var.hosts : idx => host
+    if var.add_back_nodes
+  }
+  inline = ["sudo systemctl start vault; sleep 5"]
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+resource "enos_vault_unseal" "unseal" {
+  depends_on = [
+    enos_remote_exec.start
+  ]
+  for_each = {
+    for idx, host in var.hosts : idx => host
+    if var.vault_seal_type == "shamir" && var.add_back_nodes
+  }
+
+  bin_path    = "${var.vault_install_dir}/vault"
+  vault_addr  = var.vault_addr
+  seal_type   = var.vault_seal_type
+  unseal_keys = var.vault_seal_type != "shamir" ? null : var.vault_unseal_keys
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+module "verify_rejoin_succeeds" {
+  source                  = "../vault_verify_raft_auto_join_voter"
+  depends_on              = [enos_vault_unseal.unseal]
+  count                   = var.add_back_nodes ? 1 : 0
+  hosts                   = var.hosts
+  ip_version              = var.ip_version
+  vault_root_token        = var.vault_root_token
+  vault_install_dir       = var.vault_install_dir
+  vault_addr              = var.vault_addr
+  vault_cluster_addr_port = var.cluster_port
+}
diff --git a/enos/modules/vault_verify_removed_node/scripts/verify_manual_rejoin_fails.sh b/enos/modules/vault_verify_removed_node/scripts/verify_manual_rejoin_fails.sh
new file mode 100644
index 00000000000..d2c51986fde
--- /dev/null
+++ b/enos/modules/vault_verify_removed_node/scripts/verify_manual_rejoin_fails.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+function fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$VAULT_LEADER_ADDR" ]] && fail "VAULT_LEADER_ADDR env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+result=$($binpath operator raft join "$VAULT_LEADER_ADDR")
+output=$?
+if [ $output -ne 2 ]; then
+  fail "Joining did not return code 2, instead $output: $result"
+fi
diff --git a/enos/modules/vault_verify_removed_node/scripts/verify_raft_remove_peer.sh b/enos/modules/vault_verify_removed_node/scripts/verify_raft_remove_peer.sh
new file mode 100755
index 00000000000..74c53c4f1f7
--- /dev/null
+++ b/enos/modules/vault_verify_removed_node/scripts/verify_raft_remove_peer.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+function fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$RETRY_INTERVAL" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "$TIMEOUT_SECONDS" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+getSysHealth() {
+  $binpath read -format=json sys/health sealedcode=299 haunhealthycode=299 removedcode=299 | jq -eMc '.data.removed_from_cluster'
+}
+
+getStatus() {
+  $binpath status --format=json | jq -eMc '.removed_from_cluster'
+}
+
+expectRemoved() {
+  local status
+  if ! status=$(getStatus); then
+    echo "failed to get vault status: $status"
+    return 1
+  fi
+  if [[ "$status" != "true" ]]; then
+    echo "unexpected status $status"
+    return 1
+  fi
+
+  local health
+  health=$(getSysHealth)
+  if ! health=$(getSysHealth); then
+    echo "failed to get health: $health"
+    return 1
+  fi
+  if [[ "$health" != "true" ]]; then
+    echo "unexpected health $health"
+  fi
+
+  return 0
+}
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [ "$(date +%s)" -lt "$end_time" ]; do
+  if expectRemoved; then
+    exit 0
+  fi
+
+  sleep "$RETRY_INTERVAL"
+done
+
+fail "Timed out waiting for raft removed status"
diff --git a/enos/modules/vault_verify_removed_node/scripts/verify_unseal_fails.sh b/enos/modules/vault_verify_removed_node/scripts/verify_unseal_fails.sh
new file mode 100644
index 00000000000..e92745694dc
--- /dev/null
+++ b/enos/modules/vault_verify_removed_node/scripts/verify_unseal_fails.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+function fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+IFS="," read -r -a keys <<< "${UNSEAL_KEYS}"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+result=$($binpath operator unseal "${keys[0]}")
+code=$?
+if [ $code -eq 0 ]; then
+  fail "expected unseal to fail but got exit code $code: $result"
+fi
diff --git a/enos/modules/vault_verify_removed_node_shim/main.tf b/enos/modules/vault_verify_removed_node_shim/main.tf
new file mode 100644
index 00000000000..7b00d2d5aaf
--- /dev/null
+++ b/enos/modules/vault_verify_removed_node_shim/main.tf
@@ -0,0 +1,89 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster followers"
+}
+
+
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
+variable "timeout" {
+  type        = number
+  description = "The max number of seconds to wait before timing out"
+  default     = 60
+}
+
+variable "listener_port" {
+  type        = number
+  description = "The listener port for vault"
+}
+
+variable "vault_leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The leader's host information"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local address to use to query vault"
+}
+
+variable "cluster_port" {
+  type        = number
+  description = "The cluster port for vault"
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version to use for the Vault TCP listeners"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+variable "vault_seal_type" {
+  type        = string
+  description = "The Vault seal type"
+}
+
+variable "add_back_nodes" {
+  type        = bool
+  description = "whether to add the nodes back"
+}
+
+variable "vault_unseal_keys" {}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the vault binary is installed"
+}
\ No newline at end of file
diff --git a/enos/modules/vault_verify_replication/main.tf b/enos/modules/vault_verify_replication/main.tf
index 3d2f11e5451..034d242a1b8 100644
--- a/enos/modules/vault_verify_replication/main.tf
+++ b/enos/modules/vault_verify_replication/main.tf
@@ -1,28 +1,40 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-locals {
-  instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster instances that were created"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_edition" {
+  type        = string
+  description = "The vault product edition"
+  default     = null
 }
 
 resource "enos_remote_exec" "smoke-verify-replication" {
-  for_each = local.instances
+  for_each = var.hosts
 
   environment = {
+    VAULT_ADDR    = var.vault_addr
     VAULT_EDITION = var.vault_edition
   }
 
diff --git a/enos/modules/vault_verify_replication/scripts/smoke-verify-replication.sh b/enos/modules/vault_verify_replication/scripts/smoke-verify-replication.sh
index 5ef9afd8b19..7c5ed1e8386 100644
--- a/enos/modules/vault_verify_replication/scripts/smoke-verify-replication.sh
+++ b/enos/modules/vault_verify_replication/scripts/smoke-verify-replication.sh
@@ -1,11 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
-# The Vault replication smoke test, documented in
-# https://docs.google.com/document/d/16sjIk3hzFDPyY5A9ncxTZV_9gnpYSF1_Vx6UA1iiwgI/edit#heading=h.kgrxf0f1et25
-
 set -e
 
 function fail() {
@@ -13,8 +9,11 @@ function fail() {
   exit 1
 }
 
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_EDITION" ]] && fail "VAULT_EDITION env variable has not been set"
+
 # Replication status endpoint should have data.mode disabled for CE release
-status=$(curl -s http://localhost:8200/v1/sys/replication/status)
+status=$(curl "${VAULT_ADDR}/v1/sys/replication/status")
 if [ "$VAULT_EDITION" == "ce" ]; then
   if [ "$(jq -r '.data.mode' <<< "$status")" != "disabled" ]; then
     fail "replication data mode is not disabled for CE release!"
diff --git a/enos/modules/vault_verify_replication/variables.tf b/enos/modules/vault_verify_replication/variables.tf
deleted file mode 100644
index 158b699bf4b..00000000000
--- a/enos/modules/vault_verify_replication/variables.tf
+++ /dev/null
@@ -1,27 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-variable "vault_edition" {
-  type        = string
-  description = "The vault product edition"
-  default     = null
-}
-
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "vault_instances" {
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-  description = "The vault cluster instances that were created"
-}
diff --git a/enos/modules/vault_verify_ui/main.tf b/enos/modules/vault_verify_ui/main.tf
index 9eddc8f4264..4a699f1239d 100644
--- a/enos/modules/vault_verify_ui/main.tf
+++ b/enos/modules/vault_verify_ui/main.tf
@@ -1,26 +1,31 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-locals {
-  instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster instances that were created"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
 }
 
 resource "enos_remote_exec" "smoke-verify-ui" {
-  for_each = local.instances
+  for_each = var.hosts
 
   environment = {
     VAULT_ADDR = var.vault_addr,
diff --git a/enos/modules/vault_verify_ui/scripts/smoke-verify-ui.sh b/enos/modules/vault_verify_ui/scripts/smoke-verify-ui.sh
index 25ee334ea99..61fd8ab564f 100644
--- a/enos/modules/vault_verify_ui/scripts/smoke-verify-ui.sh
+++ b/enos/modules/vault_verify_ui/scripts/smoke-verify-ui.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
 fail() {
diff --git a/enos/modules/vault_verify_ui/variables.tf b/enos/modules/vault_verify_ui/variables.tf
deleted file mode 100644
index d06d60ac969..00000000000
--- a/enos/modules/vault_verify_ui/variables.tf
+++ /dev/null
@@ -1,21 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-variable "vault_addr" {
-  type        = string
-  description = "The vault cluster address"
-  default     = "http://localhost:8200"
-}
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "vault_instances" {
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-  description = "The vault cluster instances that were created"
-}
diff --git a/enos/modules/vault_verify_undo_logs/main.tf b/enos/modules/vault_verify_undo_logs/main.tf
index 04809e61748..d2e917918d0 100644
--- a/enos/modules/vault_verify_undo_logs/main.tf
+++ b/enos/modules/vault_verify_undo_logs/main.tf
@@ -1,51 +1,68 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_instance_count" {
+variable "expected_state" {
   type        = number
-  description = "How many vault instances are in the cluster"
+  description = "The expected state to have in vault.core.replication.write_undo_logs telemetry. Must be either 1 for enabled or 0 for disabled."
+
+  validation {
+    condition     = contains([0, 1], var.expected_state)
+    error_message = "The expected_state must be either 0 or 1"
+  }
 }
 
-variable "vault_instances" {
+variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
-  description = "The vault cluster instances that were created"
+  description = "The vault cluster target hosts to check"
 }
 
-variable "vault_root_token" {
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
+variable "timeout" {
+  type        = number
+  description = "The max number of seconds to wait before timing out"
+  default     = 60
+}
+
+variable "vault_addr" {
   type        = string
-  description = "The vault root token"
+  description = "The local vault API listen address"
 }
 
-locals {
-  public_ips = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
 }
 
 resource "enos_remote_exec" "smoke-verify-undo-logs" {
-  for_each = local.public_ips
+  for_each = var.hosts
 
   environment = {
-    VAULT_ADDR        = "http://localhost:8200"
+    EXPECTED_STATE    = var.expected_state
+    RETRY_INTERVAL    = var.retry_interval
+    TIMEOUT_SECONDS   = var.timeout
+    VAULT_ADDR        = var.vault_addr
     VAULT_INSTALL_DIR = var.vault_install_dir
     VAULT_TOKEN       = var.vault_root_token
   }
diff --git a/enos/modules/vault_verify_undo_logs/scripts/smoke-verify-undo-logs.sh b/enos/modules/vault_verify_undo_logs/scripts/smoke-verify-undo-logs.sh
index 080ec079a83..7af19f6b72c 100644
--- a/enos/modules/vault_verify_undo_logs/scripts/smoke-verify-undo-logs.sh
+++ b/enos/modules/vault_verify_undo_logs/scripts/smoke-verify-undo-logs.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 function fail() {
@@ -7,6 +7,9 @@ function fail() {
   exit 1
 }
 
+[[ -z "$EXPECTED_STATE" ]] && fail "EXPECTED_STAE env variable has not been set"
+[[ -z "$RETRY_INTERVAL" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "$TIMEOUT_SECONDS" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
 [[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
 [[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
 [[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
@@ -14,23 +17,19 @@ function fail() {
 binpath=${VAULT_INSTALL_DIR}/vault
 test -x "$binpath" || fail "unable to locate vault binary at $binpath"
 
-count=0
-retries=5
-while :; do
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [ "$(date +%s)" -lt "$end_time" ]; do
   state=$($binpath read sys/metrics -format=json | jq -r '.data.Gauges[] | select(.Name == "vault.core.replication.write_undo_logs")')
   target_undo_logs_status="$(jq -r '.Value' <<< "$state")"
 
-  if [ "$target_undo_logs_status" == "1" ]; then
+  if [ "$target_undo_logs_status" == "$EXPECTED_STATE" ]; then
+    echo "vault.core.replication.write_undo_logs has expected Value: \"${EXPECTED_STATE}\""
     exit 0
   fi
 
-  wait=$((2 ** count))
-  count=$((count + 1))
-  if [ "$count" -lt "$retries" ]; then
-    echo "Waiting for vault.core.replication.write_undo_logs to have Value:1"
-    echo "$state"
-    sleep "$wait"
-  else
-    fail "Timed out waiting for vault.core.replication.write_undo_logs to have Value:1"
-  fi
+  echo "Waiting for vault.core.replication.write_undo_logs to have Value: \"${EXPECTED_STATE}\""
+  sleep "$RETRY_INTERVAL"
 done
+
+fail "Timed out waiting for vault.core.replication.write_undo_logs to have Value: \"${EXPECTED_STATE}\""
diff --git a/enos/modules/vault_verify_unsealed/main.tf b/enos/modules/vault_verify_unsealed/main.tf
deleted file mode 100644
index f5550470358..00000000000
--- a/enos/modules/vault_verify_unsealed/main.tf
+++ /dev/null
@@ -1,60 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-terraform {
-  required_providers {
-    enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
-    }
-  }
-}
-
-variable "vault_cluster_addr_port" {
-  description = "The Raft cluster address port"
-  type        = string
-  default     = "8201"
-}
-
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many vault instances are in the cluster"
-}
-
-variable "vault_instances" {
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-  description = "The vault cluster instances that were created"
-}
-
-locals {
-  instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
-}
-
-resource "enos_remote_exec" "verify_node_unsealed" {
-  for_each = local.instances
-
-  scripts = [abspath("${path.module}/scripts/verify-vault-node-unsealed.sh")]
-
-  environment = {
-    VAULT_CLUSTER_ADDR = "${each.value.private_ip}:${var.vault_cluster_addr_port}"
-    VAULT_INSTALL_DIR  = var.vault_install_dir
-  }
-
-  transport = {
-    ssh = {
-      host = each.value.public_ip
-    }
-  }
-}
diff --git a/enos/modules/vault_verify_unsealed/scripts/verify-vault-node-unsealed.sh b/enos/modules/vault_verify_unsealed/scripts/verify-vault-node-unsealed.sh
deleted file mode 100644
index 44523f2fd7b..00000000000
--- a/enos/modules/vault_verify_unsealed/scripts/verify-vault-node-unsealed.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-set -e
-
-binpath=${VAULT_INSTALL_DIR}/vault
-
-fail() {
-  echo "$1" 1>&2
-  exit 1
-}
-
-test -x "$binpath" || fail "unable to locate vault binary at $binpath"
-
-export VAULT_ADDR=http://localhost:8200
-
-count=0
-retries=4
-while :; do
-    health_status=$(curl -s "${VAULT_CLUSTER_ADDR}/v1/sys/health" |jq '.')
-    unseal_status=$($binpath status -format json | jq -Mr --argjson expected "false" '.sealed == $expected')
-    if [[ "$unseal_status" == 'true' ]]; then
-      echo "$health_status"
-      exit 0
-    fi
-
-    wait=$((2 ** count))
-    count=$((count + 1))
-    if [ "$count" -lt "$retries" ]; then
-      sleep "$wait"
-    else
-      fail "expected ${VAULT_CLUSTER_ADDR} to be unsealed, got unseal status: $unseal_status"
-    fi
-done
diff --git a/enos/modules/vault_verify_version/main.tf b/enos/modules/vault_verify_version/main.tf
index a26f0750492..4114945a9f6 100644
--- a/enos/modules/vault_verify_version/main.tf
+++ b/enos/modules/vault_verify_version/main.tf
@@ -1,41 +1,31 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_build_date" {
-  type        = string
-  description = "The Vault artifact build date"
-  default     = null
-}
-
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many Vault instances are in the cluster"
-}
-
-variable "vault_instances" {
+variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
   description = "The Vault cluster instances that were created"
 }
 
-variable "vault_product_version" {
+variable "vault_addr" {
   type        = string
-  description = "The Vault product version"
+  description = "The local vault API listen address"
+}
+
+variable "vault_build_date" {
+  type        = string
+  description = "The Vault artifact build date"
   default     = null
 }
 
@@ -45,6 +35,17 @@ variable "vault_edition" {
   default     = null
 }
 
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_product_version" {
+  type        = string
+  description = "The Vault product version"
+  default     = null
+}
+
 variable "vault_revision" {
   type        = string
   description = "The Vault product revision"
@@ -57,25 +58,36 @@ variable "vault_root_token" {
   default     = null
 }
 
-locals {
-  instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
-}
-
-resource "enos_remote_exec" "verify_all_nodes_have_updated_version" {
-  for_each = local.instances
+resource "enos_remote_exec" "verify_cli_version" {
+  for_each = var.hosts
 
   environment = {
-    VAULT_INSTALL_DIR = var.vault_install_dir,
+    VAULT_ADDR        = var.vault_addr,
     VAULT_BUILD_DATE  = var.vault_build_date,
-    VAULT_VERSION     = var.vault_product_version,
     VAULT_EDITION     = var.vault_edition,
+    VAULT_INSTALL_DIR = var.vault_install_dir,
     VAULT_REVISION    = var.vault_revision,
     VAULT_TOKEN       = var.vault_root_token,
+    VAULT_VERSION     = var.vault_product_version,
+  }
+
+  scripts = [abspath("${path.module}/scripts/verify-cli-version.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "verify_cluster_version" {
+  for_each = var.hosts
+
+  environment = {
+    VAULT_ADDR       = var.vault_addr,
+    VAULT_BUILD_DATE = var.vault_build_date,
+    VAULT_TOKEN      = var.vault_root_token,
+    VAULT_VERSION    = var.vault_product_version,
   }
 
   scripts = [abspath("${path.module}/scripts/verify-cluster-version.sh")]
diff --git a/enos/modules/vault_verify_version/scripts/verify-cli-version.sh b/enos/modules/vault_verify_version/scripts/verify-cli-version.sh
new file mode 100644
index 00000000000..3834b3bbf7b
--- /dev/null
+++ b/enos/modules/vault_verify_version/scripts/verify-cli-version.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Verify the Vault "version" includes the correct base version, build date,
+# revision SHA, and edition metadata.
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_BUILD_DATE" ]] && fail "VAULT_BUILD_DATE env variable has not been set"
+[[ -z "$VAULT_EDITION" ]] && fail "VAULT_EDITION env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_REVISION" ]] && fail "VAULT_REVISION env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$VAULT_VERSION" ]] && fail "VAULT_VERSION env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+edition=${VAULT_EDITION}
+version=${VAULT_VERSION}
+sha=${VAULT_REVISION}
+build_date=${VAULT_BUILD_DATE}
+
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+version_expected="Vault v$version ($sha), built $build_date"
+
+case "$edition" in
+  *ce) ;;
+  *ent) ;;
+  *ent.hsm) version_expected="$version_expected (cgo)" ;;
+  *ent.fips1403) version_expected="$version_expected (cgo)" ;;
+  *ent.hsm.fips1403) version_expected="$version_expected (cgo)" ;;
+  *) fail "Unknown Vault edition: ($edition)" ;;
+esac
+
+version_expected_nosha=$(echo "$version_expected" | awk '!($3="")' | sed 's/  / /' | sed -e 's/[[:space:]]*$//')
+version_output=$("$binpath" version)
+
+if [[ "$version_output" == "$version_expected_nosha" ]] || [[ "$version_output" == "$version_expected" ]]; then
+  echo "Version verification succeeded!"
+else
+  msg="$(printf "\nThe Vault cluster did not match the expected version, expected:\n%s\nor\n%s\ngot:\n%s" "$version_expected" "$version_expected_nosha" "$version_output")"
+  if type diff &> /dev/null; then
+    # Diff exits non-zero if we have a diff, which we want, so we'll guard against failing early.
+    if ! version_diff=$(diff  <(echo "$version_expected")  <(echo "$version_output") -u -L expected -L got); then
+      msg="$(printf "\nThe Vault cluster did not match the expected version:\n%s" "$version_diff")"
+    fi
+  fi
+
+  fail "$msg"
+fi
diff --git a/enos/modules/vault_verify_version/scripts/verify-cluster-version.sh b/enos/modules/vault_verify_version/scripts/verify-cluster-version.sh
index 9ec43876af5..1f131c263a0 100644
--- a/enos/modules/vault_verify_version/scripts/verify-cluster-version.sh
+++ b/enos/modules/vault_verify_version/scripts/verify-cluster-version.sh
@@ -1,45 +1,37 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 # Verify the Vault "version" includes the correct base version, build date,
 # revision SHA, and edition metadata.
 set -e
 
-binpath=${VAULT_INSTALL_DIR}/vault
-edition=${VAULT_EDITION}
-version=${VAULT_VERSION}
-sha=${VAULT_REVISION}
-build_date=${VAULT_BUILD_DATE}
-# VAULT_TOKEN must also be set
-
 fail() {
   echo "$1" 1>&2
   exit 1
 }
 
-test -x "$binpath" || fail "unable to locate vault binary at $binpath"
-
-export VAULT_ADDR='http://127.0.0.1:8200'
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_BUILD_DATE" ]] && fail "VAULT_BUILD_DATE env variable has not been set"
 [[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$VAULT_VERSION" ]] && fail "VAULT_VERSION env variable has not been set"
 
-version_expected="Vault v$version ($sha), built $build_date"
+# The sys/version-history endpoint only includes major.minor.patch, any other semver fields need to
+# be stripped out.
+if ! version=$(cut -d + -f1 <<< "$VAULT_VERSION" | cut -d - -f1); then
+  fail "failed to parse the expected version: $version"
+fi
 
-case "$edition" in
-  *ce) ;;
-  *ent) ;;
-  *ent.hsm) version_expected="$version_expected (cgo)";;
-  *ent.fips1402) version_expected="$version_expected (cgo)" ;;
-  *ent.hsm.fips1402) version_expected="$version_expected (cgo)" ;;
-  *) fail "Unknown Vault edition: ($edition)" ;;
-esac
+if ! vh=$(curl -s -X LIST -H "X-Vault-Token: $VAULT_TOKEN" http://127.0.0.1:8200/v1/sys/version-history | jq -eMc '.data'); then
+  fail "failed to Vault cluster version history: $vh"
+fi
 
-version_expected_nosha=$(echo "$version_expected" | awk '!($3="")' | sed 's/  / /' | sed -e 's/[[:space:]]*$//')
-version_output=$("$binpath" version)
+if ! out=$(jq -eMc --arg version "$version" '.keys | contains([$version])' <<< "$vh"); then
+  fail "cluster version history does not include our expected version: expected: $version, versions: $(jq -eMc '.keys' <<< "$vh"): output: $out"
+fi
 
-if [[ "$version_output" == "$version_expected_nosha" ]] || [[ "$version_output" == "$version_expected" ]]; then
-  echo "Version verification succeeded!"
-else
-  fail "expected Version=$version_expected or $version_expected_nosha, got: $version_output"
+if ! out=$(jq -eMc --arg version "$version" --arg bd "$VAULT_BUILD_DATE" '.key_info[$version].build_date == $bd' <<< "$vh"); then
+  fail "cluster version history build date is not the expected date: expected: true, expected date: $VAULT_BUILD_DATE, key_info: $(jq -eMc '.key_info' <<< "$vh"), output: $out"
 fi
+
+printf "Cluster version information is valid!: %s\n" "$vh"
diff --git a/enos/modules/vault_verify_write_data/main.tf b/enos/modules/vault_verify_write_data/main.tf
deleted file mode 100644
index fcf614bf61a..00000000000
--- a/enos/modules/vault_verify_write_data/main.tf
+++ /dev/null
@@ -1,95 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-terraform {
-  required_providers {
-    enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
-    }
-  }
-}
-
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_instance_count" {
-  type        = number
-  description = "How many Vault instances are in the cluster"
-}
-
-variable "leader_public_ip" {
-  type        = string
-  description = "Vault cluster leader Public IP address"
-}
-
-variable "leader_private_ip" {
-  type        = string
-  description = "Vault cluster leader Private IP address"
-}
-
-variable "vault_instances" {
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-  description = "The Vault cluster instances that were created"
-}
-
-variable "vault_root_token" {
-  type        = string
-  description = "The Vault root token"
-  default     = null
-}
-
-locals {
-  instances = {
-    for idx in range(var.vault_instance_count) : idx => {
-      public_ip  = values(var.vault_instances)[idx].public_ip
-      private_ip = values(var.vault_instances)[idx].private_ip
-    }
-  }
-}
-
-# We use this module to verify write data in all Enos scenarios.  Since we cannot use
-# Vault token to authenticate to secondary clusters in replication scenario we add a regular user
-# here to keep the authentication method and module verification consistent between all scenarios
-resource "enos_remote_exec" "smoke-enable-secrets-kv" {
-  # Only enable the secrets engine on the leader node
-  environment = {
-    VAULT_ADDR        = "http://127.0.0.1:8200"
-    VAULT_TOKEN       = var.vault_root_token
-    VAULT_INSTALL_DIR = var.vault_install_dir
-  }
-
-  scripts = [abspath("${path.module}/scripts/smoke-enable-secrets-kv.sh")]
-
-  transport = {
-    ssh = {
-      host = var.leader_public_ip
-    }
-  }
-}
-
-# Verify that we can enable the k/v secrets engine and write data to it.
-resource "enos_remote_exec" "smoke-write-test-data" {
-  depends_on = [enos_remote_exec.smoke-enable-secrets-kv]
-  for_each   = local.instances
-
-  environment = {
-    VAULT_ADDR        = "http://127.0.0.1:8200"
-    VAULT_TOKEN       = var.vault_root_token
-    VAULT_INSTALL_DIR = var.vault_install_dir
-    TEST_KEY          = "smoke${each.key}"
-    TEST_VALUE        = "fire"
-  }
-
-  scripts = [abspath("${path.module}/scripts/smoke-write-test-data.sh")]
-
-  transport = {
-    ssh = {
-      host = each.value.public_ip
-    }
-  }
-}
diff --git a/enos/modules/vault_verify_write_data/scripts/smoke-enable-secrets-kv.sh b/enos/modules/vault_verify_write_data/scripts/smoke-enable-secrets-kv.sh
deleted file mode 100644
index 2e90a735274..00000000000
--- a/enos/modules/vault_verify_write_data/scripts/smoke-enable-secrets-kv.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-set -e
-
-retry() {
-  local retries=$1
-  shift
-  local count=0
-
-  until "$@"; do
-    exit=$?
-    wait=$((2 ** count))
-    count=$((count + 1))
-    if [ "$count" -lt "$retries" ]; then
-      sleep "$wait"
-    else
-      return "$exit"
-    fi
-  done
-
-  return 0
-}
-
-fail() {
-  echo "$1" 1>&2
-  exit 1
-}
-
-[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
-[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
-[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
-
-binpath=${VAULT_INSTALL_DIR}/vault
-
-test -x "$binpath" || fail "unable to locate vault binary at $binpath"
-
-retry 5 "$binpath" status > /dev/null 2>&1
-
-# Create user policy
-retry 5 "$binpath" policy write reguser -<<EOF
-path "*" {
-  capabilities = ["read", "list"]
-}
-EOF
-
-# Enable the userpass auth method
-retry 5 "$binpath" auth enable userpass > /dev/null 2>&1
-
-# Create new user and attach reguser policy
-retry 5 "$binpath" write auth/userpass/users/testuser password="passuser1" policies="reguser"
-
-retry 5 "$binpath" secrets enable -path="secret" kv
diff --git a/enos/modules/vault_verify_write_data/scripts/smoke-write-test-data.sh b/enos/modules/vault_verify_write_data/scripts/smoke-write-test-data.sh
deleted file mode 100644
index 4bac3b0879a..00000000000
--- a/enos/modules/vault_verify_write_data/scripts/smoke-write-test-data.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-set -e
-
-retry() {
-  local retries=$1
-  shift
-  local count=0
-
-  until "$@"; do
-    exit=$?
-    wait=$((2 ** count))
-    count=$((count + 1))
-    if [ "$count" -lt "$retries" ]; then
-      sleep "$wait"
-    else
-      return "$exit"
-    fi
-  done
-
-  return 0
-}
-
-fail() {
-  echo "$1" 1>&2
-  exit 1
-}
-
-[[ -z "$TEST_KEY" ]] && fail "TEST_KEY env variable has not been set"
-[[ -z "$TEST_VALUE" ]] && fail "TEST_VALUE env variable has not been set"
-[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
-[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
-[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
-
-binpath=${VAULT_INSTALL_DIR}/vault
-
-test -x "$binpath" || fail "unable to locate vault binary at $binpath"
-
-retry 5 "$binpath" kv put secret/test "$TEST_KEY=$TEST_VALUE"
diff --git a/enos/modules/vault_wait_for_cluster_unsealed/main.tf b/enos/modules/vault_wait_for_cluster_unsealed/main.tf
new file mode 100644
index 00000000000..caf6af753c3
--- /dev/null
+++ b/enos/modules/vault_wait_for_cluster_unsealed/main.tf
@@ -0,0 +1,62 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster instances that were created"
+}
+
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
+variable "timeout" {
+  type        = number
+  description = "The max number of seconds to wait before timing out"
+  default     = 60
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+resource "enos_remote_exec" "verify_node_unsealed" {
+  for_each = var.hosts
+
+  scripts = [abspath("${path.module}/scripts/verify-vault-node-unsealed.sh")]
+
+  environment = {
+    HOST_IPV4         = each.value.public_ip
+    HOST_IPV6         = each.value.ipv6
+    RETRY_INTERVAL    = var.retry_interval
+    TIMEOUT_SECONDS   = var.timeout
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/vault_wait_for_cluster_unsealed/scripts/verify-vault-node-unsealed.sh b/enos/modules/vault_wait_for_cluster_unsealed/scripts/verify-vault-node-unsealed.sh
new file mode 100644
index 00000000000..993bef3d3e7
--- /dev/null
+++ b/enos/modules/vault_wait_for_cluster_unsealed/scripts/verify-vault-node-unsealed.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$RETRY_INTERVAL" ]] && fail "RETRY_INTERVAL env variable has not been set"
+[[ -z "$TIMEOUT_SECONDS" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+getStatus() {
+  $binpath status -format json
+}
+
+isUnsealed() {
+  local status
+  if ! status=$(getStatus); then
+    echo "failed to get vault status" 1>&2
+    return 1
+  fi
+
+  if status=$(jq -Mre --argjson expected "false" '.sealed == $expected' <<< "$status"); then
+    echo "vault is unsealed: $status"
+    return 0
+  fi
+
+  echo "vault is sealed" 1>&2
+  return 1
+}
+
+begin_time=$(date +%s)
+end_time=$((begin_time + TIMEOUT_SECONDS))
+while [ "$(date +%s)" -lt "$end_time" ]; do
+  echo "waiting for vault to be unsealed..."
+
+  if isUnsealed; then
+    exit 0
+  fi
+
+  sleep "$RETRY_INTERVAL"
+done
+
+if [ -n "$HOST_IPV6" ]; then
+  fail "timed out waiting for Vault cluster on ${HOST_IPV6} to be unsealed"
+fi
+if [ -n "$HOST_IPV4" ]; then
+  fail "timed out waiting for Vault cluster on ${HOST_IPV4} to be unsealed"
+fi
+fail "timed out waiting for Vault cluster to be unsealed"
diff --git a/enos/modules/vault_wait_for_leader/main.tf b/enos/modules/vault_wait_for_leader/main.tf
index 93468a14d5d..bd82f0e5d50 100644
--- a/enos/modules/vault_wait_for_leader/main.tf
+++ b/enos/modules/vault_wait_for_leader/main.tf
@@ -1,14 +1,38 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The vault cluster hosts that can be expected as a leader"
+}
+
+variable "ip_version" {
+  type        = number
+  description = "The IP version used for the Vault TCP listener"
+
+  validation {
+    condition     = contains([4, 6], var.ip_version)
+    error_message = "The ip_version must be either 4 or 6"
+  }
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
 variable "vault_install_dir" {
   type        = string
   description = "The directory where the Vault binary will be installed"
@@ -19,14 +43,6 @@ variable "vault_root_token" {
   description = "The vault root token"
 }
 
-variable "vault_hosts" {
-  type = map(object({
-    private_ip = string
-    public_ip  = string
-  }))
-  description = "The vault cluster hosts that can be expected as a leader"
-}
-
 variable "timeout" {
   type        = number
   description = "The max number of seconds to wait before timing out"
@@ -40,15 +56,18 @@ variable "retry_interval" {
 }
 
 locals {
-  private_ips = [for k, v in values(tomap(var.vault_hosts)) : tostring(v["private_ip"])]
+  ipv6s       = [for k, v in values(tomap(var.hosts)) : tostring(v["ipv6"])]
+  private_ips = [for k, v in values(tomap(var.hosts)) : tostring(v["private_ip"])]
 }
 
-resource "enos_remote_exec" "wait_for_leader_in_vault_hosts" {
+resource "enos_remote_exec" "wait_for_leader_in_hosts" {
   environment = {
-    RETRY_INTERVAL             = var.retry_interval
+    IP_VERSION                 = var.ip_version
     TIMEOUT_SECONDS            = var.timeout
-    VAULT_ADDR                 = "http://127.0.0.1:8200"
+    RETRY_INTERVAL             = var.retry_interval
+    VAULT_ADDR                 = var.vault_addr
     VAULT_TOKEN                = var.vault_root_token
+    VAULT_INSTANCE_IPV6S       = jsonencode(local.ipv6s)
     VAULT_INSTANCE_PRIVATE_IPS = jsonencode(local.private_ips)
     VAULT_INSTALL_DIR          = var.vault_install_dir
   }
@@ -57,7 +76,7 @@ resource "enos_remote_exec" "wait_for_leader_in_vault_hosts" {
 
   transport = {
     ssh = {
-      host = var.vault_hosts[0].public_ip
+      host = var.hosts[0].public_ip
     }
   }
 }
diff --git a/enos/modules/vault_wait_for_leader/scripts/wait-for-leader.sh b/enos/modules/vault_wait_for_leader/scripts/wait-for-leader.sh
index f993ae8b62b..f0191b76b0a 100644
--- a/enos/modules/vault_wait_for_leader/scripts/wait-for-leader.sh
+++ b/enos/modules/vault_wait_for_leader/scripts/wait-for-leader.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
 fail() {
@@ -14,7 +13,6 @@ fail() {
 [[ -z "$TIMEOUT_SECONDS" ]] && fail "TIMEOUT_SECONDS env variable has not been set"
 [[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
 [[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
-[[ -z "$VAULT_INSTANCE_PRIVATE_IPS" ]] && fail "VAULT_INSTANCE_PRIVATE_IPS env variable has not been set"
 [[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
 
 binpath=${VAULT_INSTALL_DIR}/vault
@@ -23,7 +21,7 @@ test -x "$binpath" || fail "unable to locate vault binary at $binpath"
 findLeaderInPrivateIPs() {
   # Find the leader private IP address
   local leader_private_ip
-  if ! leader_private_ip=$($binpath read sys/leader -format=json | jq -er '.data.leader_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")') ; then
+  if ! leader_private_ip=$($binpath read sys/leader -format=json | jq -er '.data.leader_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")'); then
     # Some older versions of vault don't support reading sys/leader. Fallback to the cli status.
     if ! leader_private_ip=$($binpath status -format json | jq -er '.leader_address | scan("[0-9]+.[0-9]+.[0-9]+.[0-9]+")'); then
       return 1
@@ -40,14 +38,59 @@ findLeaderInPrivateIPs() {
   return 1
 }
 
+findLeaderInIPV6s() {
+  # Find the leader private IP address
+  local leader_ipv6
+  if ! leader_ipv6=$($binpath read sys/leader -format=json | jq -er '.data.leader_address | scan("\\[(.+)\\]") | .[0]'); then
+    # Some older versions of vault don't support reading sys/leader. Fallback to the cli status.
+    if ! leader_ipv6=$($binpath status -format json | jq -er '.leader_address | scan("\\[(.+)\\]") | .[0]'); then
+      return 1
+    fi
+  fi
+
+  if isIn=$(jq -er --arg ip "$leader_ipv6" 'map(select(. == $ip)) | length == 1' <<< "$VAULT_INSTANCE_IPV6S"); then
+    if [[ "$isIn" == "true" ]]; then
+      echo "$leader_ipv6"
+      return 0
+    fi
+  fi
+
+  return 1
+}
+
 begin_time=$(date +%s)
 end_time=$((begin_time + TIMEOUT_SECONDS))
 while [ "$(date +%s)" -lt "$end_time" ]; do
-  if findLeaderInPrivateIPs; then
-    exit 0
-  fi
+  # Use the default package manager of the current Linux distro to install packages
+  case $IP_VERSION in
+    4)
+      [[ -z "$VAULT_INSTANCE_PRIVATE_IPS" ]] && fail "VAULT_INSTANCE_PRIVATE_IPS env variable has not been set"
+      if findLeaderInPrivateIPs; then
+        exit 0
+      fi
+      ;;
+    6)
+      [[ -z "$VAULT_INSTANCE_IPV6S" ]] && fail "VAULT_INSTANCE_IPV6S env variable has not been set"
+      if findLeaderInIPV6s; then
+        exit 0
+      fi
+      ;;
+    *)
+      fail "No matching package manager provided."
+      ;;
+  esac
 
   sleep "$RETRY_INTERVAL"
 done
 
-fail "Timed out waiting for one of $VAULT_INSTANCE_PRIVATE_IPS to be leader."
+case $IP_VERSION in
+  4)
+    fail "Timed out waiting for one of $VAULT_INSTANCE_PRIVATE_IPS to be leader."
+    ;;
+  6)
+    fail "Timed out waiting for one of $VAULT_INSTANCE_IPV6S to be leader."
+    ;;
+  *)
+    fail "Timed out waiting for leader"
+    ;;
+esac
diff --git a/enos/modules/vault_wait_for_seal_rewrap/main.tf b/enos/modules/vault_wait_for_seal_rewrap/main.tf
index fc2cb1ac90e..b5274dbac04 100644
--- a/enos/modules/vault_wait_for_seal_rewrap/main.tf
+++ b/enos/modules/vault_wait_for_seal_rewrap/main.tf
@@ -1,55 +1,61 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_root_token" {
-  type        = string
-  description = "The vault root token"
-}
-
-variable "vault_hosts" {
+variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
   description = "The vault cluster hosts that can be expected as a leader"
 }
 
+variable "retry_interval" {
+  type        = number
+  description = "How many seconds to wait between each retry"
+  default     = 2
+}
+
 variable "timeout" {
   type        = number
   description = "The max number of seconds to wait before timing out"
   default     = 60
 }
 
-variable "retry_interval" {
-  type        = number
-  description = "How many seconds to wait between each retry"
-  default     = 2
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
 }
 
 locals {
-  private_ips = [for k, v in values(tomap(var.vault_hosts)) : tostring(v["private_ip"])]
+  private_ips = [for k, v in values(tomap(var.hosts)) : tostring(v["private_ip"])]
   first_key   = element(keys(enos_remote_exec.wait_for_seal_rewrap_to_be_completed), 0)
 }
 
 resource "enos_remote_exec" "wait_for_seal_rewrap_to_be_completed" {
-  for_each = var.vault_hosts
+  for_each = var.hosts
   environment = {
     RETRY_INTERVAL    = var.retry_interval
     TIMEOUT_SECONDS   = var.timeout
-    VAULT_ADDR        = "http://127.0.0.1:8200"
+    VAULT_ADDR        = var.vault_addr
     VAULT_TOKEN       = var.vault_root_token
     VAULT_INSTALL_DIR = var.vault_install_dir
   }
diff --git a/enos/modules/vault_wait_for_seal_rewrap/scripts/wait-for-seal-rewrap.sh b/enos/modules/vault_wait_for_seal_rewrap/scripts/wait-for-seal-rewrap.sh
index de5abc5f8fe..b3d6d7993c2 100644
--- a/enos/modules/vault_wait_for_seal_rewrap/scripts/wait-for-seal-rewrap.sh
+++ b/enos/modules/vault_wait_for_seal_rewrap/scripts/wait-for-seal-rewrap.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 set -e
 
 fail() {
diff --git a/enos/modules/verify_log_secrets/main.tf b/enos/modules/verify_log_secrets/main.tf
new file mode 100644
index 00000000000..8455afff5fc
--- /dev/null
+++ b/enos/modules/verify_log_secrets/main.tf
@@ -0,0 +1,96 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "audit_log_file_path" {
+  type = string
+}
+
+variable "leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+  description = "The cluster leader host. Only the leader write to the audit log"
+}
+
+variable "radar_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+  default     = "/opt/vault-radar/bin"
+}
+
+variable "radar_license_path" {
+  description = "The path to a vault-radar license file"
+}
+
+variable "radar_version" {
+  description = "The version of Vault Radar to install"
+  default     = "0.29.0" # must be >= 0.17.0
+  // NOTE: A `semverconstraint` validation condition would be very useful here
+  // when we get around to exporting our custom enos funcs in the provider.
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The vault root token"
+}
+
+variable "vault_unit_name" {
+  type        = string
+  description = "The vault unit name"
+  default     = "vault"
+}
+
+resource "enos_bundle_install" "radar" {
+  destination = var.radar_install_dir
+
+  release = {
+    product = "vault-radar"
+    version = var.radar_version
+    // Radar doesn't have CE/Ent editions. CE is equivalent to no edition metadata.
+    edition = "ce"
+  }
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "scan_logs_for_secrets" {
+  depends_on = [
+    enos_bundle_install.radar,
+  ]
+
+  environment = {
+    AUDIT_LOG_FILE_PATH     = var.audit_log_file_path
+    VAULT_ADDR              = var.vault_addr
+    VAULT_RADAR_INSTALL_DIR = var.radar_install_dir
+    VAULT_RADAR_LICENSE     = file(var.radar_license_path)
+    VAULT_TOKEN             = var.vault_root_token
+    VAULT_UNIT_NAME         = var.vault_unit_name
+  }
+
+  scripts = [abspath("${path.module}/scripts/scan_logs_for_secrets.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_log_secrets/scripts/scan_logs_for_secrets.sh b/enos/modules/verify_log_secrets/scripts/scan_logs_for_secrets.sh
new file mode 100644
index 00000000000..ec82ac8de58
--- /dev/null
+++ b/enos/modules/verify_log_secrets/scripts/scan_logs_for_secrets.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+verify_radar_scan_output_file() {
+  # Given a file with a radar scan output, filter out tagged false positives and verify that no
+  # other secrets remain.
+  if ! jq -eMcn '[inputs] | [.[] | select(.type != "aws_access_key_id") | select((.tags == null) or (.tags | contains(["ignore_rule"]) | not ))] | length == 0' < "$2"; then
+    found=$(jq -eMn '[inputs] | [.[] | select(.type != "aws_access_key_id") | select((.tags == null) or (.tags | contains(["ignore_rule"]) | not ))]' < "$2")
+    fail "failed to radar secrets output: vault radar detected secrets in $1!: $found"
+  fi
+}
+
+set -e
+
+[[ -z "$AUDIT_LOG_FILE_PATH" ]] && fail "AUDIT_LOG_FILE_PATH env variable has not been set"
+[[ -z "$VAULT_RADAR_INSTALL_DIR" ]] && fail "VAULT_RADAR_INSTALL_DIR env variable has not been set"
+# Radar implicitly requires the following for creating the index and running radar itself
+[[ -z "$VAULT_RADAR_LICENSE" ]] && fail "VAULT_RADAR_LICENSE env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$VAULT_UNIT_NAME" ]] && fail "VAULT_UNIT_NAME env variable has not been set"
+
+radar_bin_path=${VAULT_RADAR_INSTALL_DIR}/vault-radar
+test -x "$radar_bin_path" || fail "failed to scan vault audit log: unable to locate radar binary at $radar_bin_path"
+
+# Make sure our audit log file exists.
+if [ ! -f "$AUDIT_LOG_FILE_PATH" ]; then
+  fail "failed to scan vault audit log: no audit logifile found at $AUDIT_LOG_FILE_PATH"
+fi
+
+# Create a readable copy of the audit log.
+if ! sudo cp "$AUDIT_LOG_FILE_PATH" audit.log; then
+  fail "failed to scan vault audit log: could not copy audit log for scanning"
+fi
+
+if ! sudo chmod +r audit.log; then
+  fail "failed to scan vault audit log: could not make audit log copy readable"
+fi
+
+# Create a radar index file of our KVv2 secret values.
+if ! out=$($radar_bin_path index vault --offline --disable-ui --outfile index.jsonl 2>&1); then
+  fail "failed to generate vault-radar index of vault cluster: $out"
+fi
+
+# Write our ignore rules to avoid known false positives.
+mkdir -p "$HOME/.hashicorp/vault-radar"
+cat >> "$HOME/.hashicorp/vault-radar/ignore.yaml" << EOF
+- secret_values:
+  - "hmac-sha256:*"
+EOF
+
+# Scan the audit log for known secrets via the audit log and other secrets using radars built-in
+# secret types.
+if ! out=$("$radar_bin_path" scan file --offline --disable-ui -p audit.log --index-file index.jsonl -f json -o audit-secrets.json 2>&1); then
+  fail "failed to scan vault audit log: vault-radar scan file failed: $out"
+fi
+
+verify_radar_scan_output_file vault-audit-log audit-secrets.json
+
+# Scan the vault journal for known secrets via the audit log and other secrets using radars built-in
+# secret types.
+if ! out=$(sudo journalctl --no-pager -u "$VAULT_UNIT_NAME" -a | "$radar_bin_path" scan file --offline --disable-ui --index-file index.jsonl -f json -o journal-secrets.json 2>&1); then
+  fail "failed to scan vault journal: vault-radar scan file failed: $out"
+fi
+
+verify_radar_scan_output_file vault-journal journal-secrets.json
diff --git a/enos/modules/verify_seal_type/main.tf b/enos/modules/verify_seal_type/main.tf
index 22ff05de7cb..18d44662fb7 100644
--- a/enos/modules/verify_seal_type/main.tf
+++ b/enos/modules/verify_seal_type/main.tf
@@ -1,21 +1,17 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 terraform {
   required_providers {
     enos = {
-      source = "app.terraform.io/hashicorp-qti/enos"
+      source = "registry.terraform.io/hashicorp-forge/enos"
     }
   }
 }
 
-variable "vault_install_dir" {
-  type        = string
-  description = "The directory where the Vault binary will be installed"
-}
-
-variable "vault_hosts" {
+variable "hosts" {
   type = map(object({
+    ipv6       = string
     private_ip = string
     public_ip  = string
   }))
@@ -28,13 +24,24 @@ variable "seal_type" {
   default     = "shamir"
 }
 
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
 resource "enos_remote_exec" "verify_seal_type" {
-  for_each = var.vault_hosts
+  for_each = var.hosts
 
   scripts = [abspath("${path.module}/scripts/verify-seal-type.sh")]
 
   environment = {
-    VAULT_ADDR         = "http://127.0.0.1:8200"
+    VAULT_ADDR         = var.vault_addr
     VAULT_INSTALL_DIR  = var.vault_install_dir
     EXPECTED_SEAL_TYPE = var.seal_type
   }
diff --git a/enos/modules/verify_seal_type/scripts/verify-seal-type.sh b/enos/modules/verify_seal_type/scripts/verify-seal-type.sh
index 73ce06fd9e0..3b553efe6ba 100644
--- a/enos/modules/verify_seal_type/scripts/verify-seal-type.sh
+++ b/enos/modules/verify_seal_type/scripts/verify-seal-type.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
diff --git a/enos/modules/verify_secrets_engines/modules/create/auth.tf b/enos/modules/verify_secrets_engines/modules/create/auth.tf
new file mode 100644
index 00000000000..3a13451c045
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/auth.tf
@@ -0,0 +1,147 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+locals {
+  // Variables
+  auth_userpass_path = "userpass"      # auth/userpass
+  user_name          = "testuser"      # auth/userpass/users/testuser
+  user_password      = "passtestuser1" # auth/userpass/login/passtestuser1
+  user_policy_name   = "reguser"       # sys/policy/reguser
+
+  auth_ldap_path = "ldap" # auth/ldap
+
+  // Response data
+  user_login_data = jsondecode(enos_remote_exec.auth_login_testuser.stdout)
+  sys_auth_data   = jsondecode(enos_remote_exec.read_sys_auth.stdout).data
+
+  // Output
+  auth_output = {
+    sys = local.sys_auth_data
+    userpass = {
+      path = local.auth_userpass_path
+      user = {
+        name        = local.user_name
+        password    = local.user_password
+        policy_name = local.user_policy_name
+        login       = local.user_login_data
+      }
+    }
+  }
+}
+
+output "auth" {
+  value = local.auth_output
+}
+
+# Enable userpass auth
+resource "enos_remote_exec" "auth_enable_userpass" {
+  environment = {
+    AUTH_METHOD       = "userpass"
+    AUTH_PATH         = local.auth_userpass_path
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/auth-enable.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Get the sys/auth data after enabling our auth method
+resource "enos_remote_exec" "read_sys_auth" {
+  depends_on = [
+    enos_remote_exec.auth_enable_userpass,
+  ]
+  environment = {
+    REQPATH           = "sys/auth"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/read.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Create a default policy for our users that allows them to read and list.
+resource "enos_remote_exec" "policy_read_reguser" {
+  environment = {
+    POLICY_NAME       = local.user_policy_name
+    POLICY_CONFIG     = <<-EOF
+      path "*" {
+        capabilities = ["read", "list"]
+      }
+    EOF
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/policy-write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Create our user
+resource "enos_remote_exec" "auth_create_testuser" {
+  depends_on = [
+    enos_remote_exec.auth_enable_userpass,
+    enos_remote_exec.policy_read_reguser,
+  ]
+
+  environment = {
+    AUTH_PATH         = local.auth_userpass_path
+    PASSWORD          = local.user_password
+    POLICIES          = local.user_policy_name
+    USERNAME          = local.user_name
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/auth-userpass-write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "auth_login_testuser" {
+  depends_on = [
+    // Don't try to login until created our user and added it to the kv_writers group
+    enos_remote_exec.auth_create_testuser,
+    enos_remote_exec.identity_group_kv_writers,
+  ]
+
+  environment = {
+    AUTH_PATH         = local.auth_userpass_path
+    PASSWORD          = local.user_password
+    USERNAME          = local.user_name
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/auth-userpass-login.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/aws.tf b/enos/modules/verify_secrets_engines/modules/create/aws.tf
new file mode 100644
index 00000000000..42ecde5b356
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/aws.tf
@@ -0,0 +1,21 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+module "create_aws_secrets_engine" {
+  count  = var.aws_enabled ? 1 : 0
+  source = "./aws"
+
+  hosts             = var.hosts
+  leader_host       = var.leader_host
+  vault_addr        = var.vault_addr
+  vault_root_token  = var.vault_root_token
+  vault_install_dir = var.vault_install_dir
+}
+
+locals {
+  aws_state = var.aws_enabled ? module.create_aws_secrets_engine[0].state : null
+}
+
+output "aws" {
+  value = local.aws_state
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/aws/aws.tf b/enos/modules/verify_secrets_engines/modules/create/aws/aws.tf
new file mode 100644
index 00000000000..d60773079a1
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/aws/aws.tf
@@ -0,0 +1,158 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The Vault cluster instances that were created"
+}
+
+variable "leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+
+  description = "Vault cluster leader host"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The Vault root token"
+  default     = null
+}
+
+locals {
+  // Variables
+  aws_mount      = "aws"
+  vault_aws_role = "enos_test_role"
+  my_email       = split("/", data.aws_caller_identity.current.arn)[2]
+
+  // State output
+  state = {
+    aws_role       = data.aws_iam_role.premade_demo_assumed_role.name
+    aws_role_arn   = data.aws_iam_role.premade_demo_assumed_role.arn
+    aws_policy_arn = data.aws_iam_policy.premade_demo_user_policy.arn
+    aws_user_name  = aws_iam_user.aws_enos_test_user.name
+    aws_access_key = aws_iam_access_key.aws_enos_test_user.id
+    aws_secret_key = aws_iam_access_key.aws_enos_test_user.secret
+    mount          = local.aws_mount
+    region         = data.aws_region.current.region
+    vault_aws_role = local.vault_aws_role
+  }
+}
+
+output "state" {
+  value = local.state
+}
+
+resource "random_id" "unique_suffix" {
+  byte_length = 4
+}
+
+data "aws_caller_identity" "current" {}
+
+data "aws_region" "current" {}
+
+# The "DemoUser" policy is a predefined policy created by the security team.
+# This policy grants the necessary AWS permissions required for role generation via Vault.
+# Reference: https://github.com/hashicorp/honeybee-templates/blob/main/templates/iam_policy/DemoUser.yaml
+data "aws_iam_policy" "premade_demo_user_policy" {
+  name = "DemoUser"
+}
+
+# This role was provisioned by the security team using the repository referenced below.
+# This role includes the necessary policies to enable AWS credential generation and rotation via Vault.
+# Reference: https://github.com/hashicorp/honeybee-templates/blob/main/templates/iam_role/vault-assumed-role-credentials-demo.yaml
+data "aws_iam_role" "premade_demo_assumed_role" {
+  name = "vault-assumed-role-credentials-demo"
+}
+
+# Creating new test user
+resource "aws_iam_user" "aws_enos_test_user" {
+  name                 = "demo-${local.my_email}-${random_id.unique_suffix.hex}"
+  permissions_boundary = data.aws_iam_policy.premade_demo_user_policy.arn
+  force_destroy        = true
+}
+
+resource "aws_iam_user_policy_attachment" "aws_enos_test_user" {
+  user       = aws_iam_user.aws_enos_test_user.name
+  policy_arn = data.aws_iam_policy.premade_demo_user_policy.arn
+}
+
+resource "aws_iam_access_key" "aws_enos_test_user" {
+  user = aws_iam_user.aws_enos_test_user.name
+  lifecycle {
+    prevent_destroy = false
+  }
+}
+
+# Enable AWS secrets engine
+resource "enos_remote_exec" "secrets_enable_aws_secret" {
+  environment = {
+    ENGINE            = local.aws_mount
+    MOUNT             = local.aws_mount
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../../scripts/secrets-enable.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Generate AWS Credentials
+resource "enos_remote_exec" "aws_generate_roles" {
+  depends_on = [enos_remote_exec.secrets_enable_aws_secret]
+  for_each   = var.hosts
+
+  environment = {
+    AWS_REGION            = local.state.region
+    ENGINE                = local.aws_mount
+    MOUNT                 = local.aws_mount
+    AWS_USER_NAME         = local.state.aws_user_name
+    AWS_POLICY_ARN        = local.state.aws_policy_arn
+    AWS_ROLE_ARN          = local.state.aws_role_arn
+    AWS_ACCESS_KEY_ID     = local.state.aws_access_key
+    AWS_SECRET_ACCESS_KEY = local.state.aws_secret_key
+    VAULT_AWS_ROLE        = local.vault_aws_role
+    VAULT_ADDR            = var.vault_addr
+    VAULT_TOKEN           = var.vault_root_token
+    VAULT_INSTALL_DIR     = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../../scripts/aws-generate-roles.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/identity.tf b/enos/modules/verify_secrets_engines/modules/create/identity.tf
new file mode 100644
index 00000000000..000e7c9298d
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/identity.tf
@@ -0,0 +1,380 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+locals {
+  // Variables
+  identity_entity_metadata = {
+    "organization" = "vault",
+    "team"         = "qt",
+  }
+  group_name_oidc_readers     = "oidc_token_readers"            // identity/group/name/oidc_token_readers
+  oidc_config_issuer_url      = "https://enos.example.com:1234" // identity/oidc/config
+  oidc_key_algorithms         = ["RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "EdDSA"]
+  oidc_key_algorithm          = local.oidc_key_algorithms[random_integer.oidc_key_algorithm_idx.result]
+  oidc_key_name               = "reguser" // identity/oidc/key/reguser
+  oidc_key_rotation_period    = 86400     // 24h
+  oidc_key_verification_ttl   = 21600     // 6h
+  oidc_role_name              = "reguser" // identity/oidc/role/reguser
+  oidc_role_ttl               = 3600      // 1h
+  oidc_client_id              = "reguser" // optional client ID but required if we want to scope a key and role together without a *
+  oidc_token_read_policy_name = "oidc_token_reader"
+
+  // Response data
+  oidc_token_data               = jsondecode(enos_remote_exec.oidc_token.stdout).data
+  group_oidc_token_readers_data = jsondecode(enos_remote_exec.identity_group_oidc_token_readers.stdout).data
+  initial_oidc_token_data       = jsondecode(enos_remote_exec.initial_oidc_token.stdout).data
+  user_entity_data              = jsondecode(enos_remote_exec.identity_entity_testuser.stdout).data
+  user_entity_alias_data        = jsondecode(enos_remote_exec.identity_entity_alias_testuser.stdout).data
+
+  // Output
+  identity_output = {
+    oidc = {
+      reader_group_name    = local.group_name_oidc_readers
+      reader_policy_name   = local.oidc_token_read_policy_name
+      issuer_url           = local.oidc_config_issuer_url
+      key_algorithm        = local.oidc_key_algorithm
+      key_name             = local.oidc_key_name
+      key_rotation_period  = local.oidc_key_rotation_period
+      key_verification_ttl = local.oidc_key_verification_ttl
+      role_name            = local.oidc_role_name
+      role_ttl             = local.oidc_role_ttl
+      client_id            = local.oidc_client_id
+    }
+    identity_entity_metadata = local.identity_entity_metadata
+    data = {
+      entity                   = local.user_entity_data
+      entity_alias             = local.user_entity_alias_data
+      oidc_token               = local.oidc_token_data
+      group_oidc_token_readers = local.group_oidc_token_readers_data
+    }
+  }
+}
+
+output "identity" {
+  value = local.identity_output
+}
+
+// Get a random index for our algorithms so that we can randomly rotate through the various algorithms
+resource "random_integer" "oidc_key_algorithm_idx" {
+  min = 0
+  max = length(local.oidc_key_algorithms) - 1
+}
+
+// Create identity entity for our user
+resource "enos_remote_exec" "identity_entity_testuser" {
+  depends_on = [
+    enos_remote_exec.auth_create_testuser,
+  ]
+
+  environment = {
+    REQPATH = "identity/entity"
+    PAYLOAD = jsonencode({
+      name     = local.user_name,
+      metadata = local.identity_entity_metadata,
+      policies = [local.user_policy_name],
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Create identity entity alias for our user
+resource "enos_remote_exec" "identity_entity_alias_testuser" {
+  environment = {
+    REQPATH = "identity/entity-alias"
+    PAYLOAD = jsonencode({
+      name           = local.user_name,
+      canonical_id   = local.user_entity_data.id
+      mount_accessor = local.sys_auth_data["${local.auth_userpass_path}/"].accessor
+      policies       = [local.user_policy_name],
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Configure our the oidc token backend
+resource "enos_remote_exec" "oidc_config" {
+  environment = {
+    REQPATH = "identity/oidc/config"
+    PAYLOAD = jsonencode({
+      issuer = local.oidc_config_issuer_url,
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Create a named key that can sign OIDC identity token
+resource "enos_remote_exec" "oidc_key" {
+  environment = {
+    REQPATH = "identity/oidc/key/${local.oidc_key_name}"
+    PAYLOAD = jsonencode({
+      allowed_client_ids = [local.oidc_client_id],
+      algorithm          = local.oidc_key_algorithm,
+      rotation_period    = local.oidc_key_rotation_period,
+      verification_ttl   = local.oidc_key_verification_ttl,
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Create a role with custom template and that uses the named key
+resource "enos_remote_exec" "oidc_role" {
+  depends_on = [
+    enos_remote_exec.oidc_key,
+  ]
+
+  environment = {
+    REQPATH = "identity/oidc/role/${local.oidc_role_name}"
+    PAYLOAD = jsonencode({
+      client_id = local.oidc_client_id,
+      key       = local.oidc_key_name,
+      ttl       = local.oidc_role_ttl
+      template = base64encode(<<-EOF
+        {
+          "team": {{identity.entity.metadata.team}},
+          "organization": {{identity.entity.metadata.organization}},
+          "groups": {{identity.entity.groups.names}}
+        }
+      EOF
+      ),
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Create a group policy that allows "reading" a new signed OIDC token
+resource "enos_remote_exec" "policy_write_oidc_token" {
+  depends_on = [
+    enos_remote_exec.secrets_enable_kv_secret,
+  ]
+  environment = {
+    POLICY_NAME       = local.oidc_token_read_policy_name
+    POLICY_CONFIG     = <<-EOF
+      path "identity/oidc/token/*" {
+        capabilities = ["read"]
+      }
+    EOF
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/policy-write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Create oidc_token_readers group and add our testuser to it
+resource "enos_remote_exec" "identity_group_oidc_token_readers" {
+  environment = {
+    REQPATH = "identity/group"
+    PAYLOAD = jsonencode({
+      member_entity_ids = [local.user_entity_data.id],
+      name              = local.group_name_oidc_readers,
+      policies          = [local.oidc_token_read_policy_name],
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Generate a signed ID token with our test user
+resource "enos_remote_exec" "initial_oidc_token" {
+  depends_on = [
+    enos_remote_exec.oidc_role,
+  ]
+
+  environment = {
+    REQPATH           = "identity/oidc/token/${local.oidc_role_name}"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = local.user_login_data.auth.client_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/read.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Introspect the signed ID and verify it
+resource "enos_remote_exec" "oidc_introspect_initial_token" {
+  environment = {
+    ASSERT_ACTIVE = true // Our token should be "active"
+    PAYLOAD = jsonencode({
+      token     = local.initial_oidc_token_data.token,
+      client_id = local.initial_oidc_token_data.client_id
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/identity-oidc-introspect-token.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Rotate the key with a zero TTL to force expiration
+resource "enos_remote_exec" "oidc_key_rotate" {
+  depends_on = [
+    enos_remote_exec.oidc_introspect_initial_token,
+  ]
+
+  environment = {
+    REQPATH = "identity/oidc/key/${local.oidc_key_name}/rotate"
+    PAYLOAD = jsonencode({
+      verification_ttl = 0,
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Introspect it again to make sure it's no longer active
+resource "enos_remote_exec" "oidc_introspect_initial_token_post_rotate" {
+  depends_on = [
+    enos_remote_exec.oidc_key_rotate,
+  ]
+
+  environment = {
+    ASSERT_ACTIVE = false // Our token should not be "active"
+    PAYLOAD = jsonencode({
+      token     = local.initial_oidc_token_data.token,
+      client_id = local.initial_oidc_token_data.client_id
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/identity-oidc-introspect-token.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Generate a new token that we can use later
+resource "enos_remote_exec" "oidc_token" {
+  depends_on = [
+    enos_remote_exec.oidc_introspect_initial_token_post_rotate,
+  ]
+
+  environment = {
+    REQPATH           = "identity/oidc/token/${local.oidc_role_name}"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = local.user_login_data.auth.client_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/read.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Introspect the new token to ensure it's active before we export it for user later via outputs
+resource "enos_remote_exec" "oidc_introspect_token" {
+  environment = {
+    ASSERT_ACTIVE = true // Our token should be "active"
+    PAYLOAD = jsonencode({
+      token     = local.oidc_token_data.token,
+      client_id = local.oidc_token_data.client_id
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/identity-oidc-introspect-token.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/kmip.tf b/enos/modules/verify_secrets_engines/modules/create/kmip.tf
new file mode 100644
index 00000000000..e824e18013d
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/kmip.tf
@@ -0,0 +1,27 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+module "create_kmip_secret_engine" {
+  depends_on = [
+    enos_remote_exec.policy_write_kv_writer,
+  ]
+  count  = var.kmip_enabled ? 1 : 0
+  source = "./kmip"
+
+  integration_host_state = var.integration_host_state
+  ip_version             = var.ip_version
+  leader_host            = var.leader_host
+  ports                  = var.ports
+  vault_addr             = var.vault_addr
+  vault_edition          = var.vault_edition
+  vault_root_token       = var.vault_root_token
+  vault_install_dir      = var.vault_install_dir
+}
+
+locals {
+  kmip_output = var.kmip_enabled ? module.create_kmip_secret_engine[0].kmip : null
+}
+
+output "kmip" {
+  value = local.kmip_output
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/kmip/kmip.tf b/enos/modules/verify_secrets_engines/modules/create/kmip/kmip.tf
new file mode 100644
index 00000000000..6fa6741ae7a
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/kmip/kmip.tf
@@ -0,0 +1,240 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "kmip_listen_address" {
+  type        = string
+  description = "The KMIP listen address for the Vault server"
+  default     = "0.0.0.0"
+}
+
+variable "leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+
+  description = "Vault cluster leader host"
+}
+
+variable "ports" {
+  description = "Port configuration for services"
+  type = map(object({
+    port        = string
+    description = string
+  }))
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The Vault root token"
+  default     = null
+}
+
+variable "integration_host_state" {
+  description = "The state of the test server from the 'set_up_external_integration' module"
+}
+
+variable "ip_version" {
+  type        = string
+  description = "IP Version (4 or 6)"
+  default     = "4"
+}
+
+variable "vault_edition" {
+  type        = string
+  description = "IP Version (4 or 6)"
+  default     = "4"
+}
+
+locals {
+  kmip_scope_name  = "kmip_scope"
+  kmip_role_name   = "kmip_role"
+  kmip_cert_format = "pem"
+  kmip_mount_path  = "kmip"
+
+  // Response data - only access if Vault Enterprise (count > 0)
+  server_ca   = var.vault_edition == "ce" ? "" : enos_remote_exec.kmip_configure[0].stdout
+  client_cert = var.vault_edition == "ce" ? "" : enos_remote_exec.kmip_generate_certificate[0].stdout
+
+  kmip_output = {
+    server_ca      = local.server_ca
+    client_cert    = local.client_cert
+    test_server_ip = var.integration_host_state.kmip.host.public_ip
+    port           = var.ports.kmip.port
+  }
+}
+
+output "kmip" {
+  value = local.kmip_output
+}
+
+resource "enos_remote_exec" "secrets_enable_kmip_secret" {
+  environment = {
+    ENGINE            = "kmip"
+    MOUNT             = local.kmip_mount_path
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  // Only perform KMIP operations for Vault Enterprise
+  // The KMIP secrets engine is not available in Vault CE
+  count = var.vault_edition == "ce" ? 0 : 1
+
+  scripts = [abspath("${path.module}/../../../scripts/secrets-enable.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "kmip_configure" {
+  depends_on = [enos_remote_exec.secrets_enable_kmip_secret]
+  environment = {
+    MOUNT             = local.kmip_mount_path
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    KMIP_MOUNT        = local.kmip_mount_path
+    KMIP_LISTEN_ADDR  = var.kmip_listen_address
+    KMIP_PORT         = var.ports.kmip.port
+  }
+
+  // Only perform KMIP operations for Vault Enterprise
+  // The KMIP secrets engine is not available in Vault CE
+  count = var.vault_edition == "ce" ? 0 : 1
+
+  scripts = [abspath("${path.module}/../../../scripts/kmip/kmip-configure.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Creating KMIP Scope
+resource "enos_remote_exec" "kmip_create_scope" {
+  depends_on = [enos_remote_exec.kmip_configure]
+
+  environment = {
+    REQPATH           = "${local.kmip_mount_path}/scope/${local.kmip_scope_name}"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
+  }
+
+  // Only perform KMIP operations for Vault Enterprise
+  // The KMIP secrets engine is not available in Vault CE
+  count = var.vault_edition == "ce" ? 0 : 1
+
+  scripts = [abspath("${path.module}/../../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Creating KMIP Role
+resource "enos_remote_exec" "kmip_create_role" {
+  depends_on = [enos_remote_exec.kmip_create_scope]
+
+  environment = {
+    REQPATH = "${local.kmip_mount_path}/scope/${local.kmip_scope_name}/role/${local.kmip_role_name}"
+    PAYLOAD = jsonencode({
+      operation_all = true,
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
+  }
+
+  // Only perform KMIP operations for Vault Enterprise
+  // The KMIP secrets engine is not available in Vault CE
+  count = var.vault_edition == "ce" ? 0 : 1
+
+  scripts = [abspath("${path.module}/../../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Generating KMIP Certificate
+resource "enos_remote_exec" "kmip_generate_certificate" {
+  depends_on = [enos_remote_exec.kmip_create_role]
+
+  environment = {
+    MOUNT             = local.kmip_mount_path
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
+    SCOPE_NAME        = local.kmip_scope_name
+    ROLE_NAME         = local.kmip_role_name
+    CERT_FORMAT       = local.kmip_cert_format
+  }
+
+  // Only perform KMIP operations for Vault Enterprise
+  // The KMIP secrets engine is not available in Vault CE
+  count = var.vault_edition == "ce" ? 0 : 1
+
+  scripts = [abspath("${path.module}/../../../scripts/kmip/kmip-generate-cert.sh")]
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Managing KMIP Roles
+resource "enos_remote_exec" "kmip_manage_roles" {
+  depends_on = [enos_remote_exec.kmip_generate_certificate]
+  environment = {
+    REQPATH = "${local.kmip_mount_path}/scope/${local.kmip_scope_name}/role/${local.kmip_role_name}"
+    PAYLOAD = jsonencode({
+      operation_activate = true,
+      operation_create   = true,
+      operation_get      = true
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
+  }
+
+  // Only perform KMIP operations for Vault Enterprise
+  // The KMIP secrets engine is not available in Vault CE
+  count = var.vault_edition == "ce" ? 0 : 1
+
+  scripts = [abspath("${path.module}/../../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/kv.tf b/enos/modules/verify_secrets_engines/modules/create/kv.tf
new file mode 100644
index 00000000000..6f004da9585
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/kv.tf
@@ -0,0 +1,131 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+locals {
+  // Variables
+  group_name_kv_writers     = "kv_writers" # identity/group/name/kv_writers
+  kv_mount                  = "secret"     # secret
+  kv_write_policy_name      = "kv_writer"  # sys/policy/kv_writer
+  kv_test_data_path_prefix  = "smoke"
+  kv_test_data_value_prefix = "fire"
+  kv_version                = 2
+
+  // Response data
+  identity_group_kv_writers_data = jsondecode(enos_remote_exec.identity_group_kv_writers.stdout).data
+
+  // Output
+  kv_output = {
+    reader_group_name  = local.group_name_kv_writers
+    writer_policy_name = local.kv_write_policy_name
+    mount              = local.kv_mount
+    version            = local.kv_version
+    test = {
+      path_prefix  = local.kv_test_data_path_prefix
+      value_prefix = local.kv_test_data_value_prefix
+    }
+    data = {
+      identity_group_kv_writers = local.identity_group_kv_writers_data
+    }
+  }
+}
+
+output "kv" {
+  value = local.kv_output
+}
+
+# Enable kv secrets engine
+resource "enos_remote_exec" "secrets_enable_kv_secret" {
+  environment = {
+    ENGINE            = "kv"
+    MOUNT             = local.kv_mount
+    SECRETS_META      = "-version=${local.kv_version}"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/secrets-enable.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Create a group policy that allows writing to our kv store
+resource "enos_remote_exec" "policy_write_kv_writer" {
+  depends_on = [
+    enos_remote_exec.secrets_enable_kv_secret,
+  ]
+  environment = {
+    POLICY_NAME       = local.kv_write_policy_name
+    POLICY_CONFIG     = <<-EOF
+      path "${local.kv_mount}/*" {
+        capabilities = ["create", "update", "read", "delete", "list"]
+      }
+    EOF
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/policy-write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Create kv_writers group and add our testuser to it
+resource "enos_remote_exec" "identity_group_kv_writers" {
+  environment = {
+    REQPATH = "identity/group"
+    PAYLOAD = jsonencode({
+      member_entity_ids = [local.user_entity_data.id], // Created in identity.tf
+      name              = local.group_name_kv_writers,
+      policies          = [local.kv_write_policy_name],
+    })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+// Write test data as our user.
+resource "enos_remote_exec" "kv_put_secret_test" {
+  depends_on = [
+    enos_remote_exec.secrets_enable_kv_secret,
+    enos_remote_exec.policy_write_kv_writer,
+    enos_remote_exec.identity_group_kv_writers
+  ]
+  for_each = var.hosts
+
+  environment = {
+    MOUNT             = local.kv_mount
+    SECRET_PATH       = "${local.kv_test_data_path_prefix}-${each.key}"
+    KEY               = "${local.kv_test_data_path_prefix}-${each.key}"
+    VALUE             = "${local.kv_test_data_value_prefix}-${each.key}"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = local.user_login_data.auth.client_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/kv-put.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/ldap.tf b/enos/modules/verify_secrets_engines/modules/create/ldap.tf
new file mode 100644
index 00000000000..cde37bb374b
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/ldap.tf
@@ -0,0 +1,26 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+module "create_ldap_secret_engine" {
+  depends_on = [
+    enos_remote_exec.policy_write_kv_writer,
+  ]
+  count  = var.ldap_enabled ? 1 : 0
+  source = "./ldap"
+
+  integration_host_state = var.integration_host_state
+  ip_version             = var.ip_version
+  leader_host            = var.leader_host
+  ports                  = var.ports
+  vault_addr             = var.vault_addr
+  vault_root_token       = var.vault_root_token
+  vault_install_dir      = var.vault_install_dir
+}
+
+locals {
+  ldap_output = var.ldap_enabled ? module.create_ldap_secret_engine[0].ldap : null
+}
+
+output "ldap" {
+  value = local.ldap_output
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/ldap/ldap.tf b/enos/modules/verify_secrets_engines/modules/create/ldap/ldap.tf
new file mode 100644
index 00000000000..3eda29d95be
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/ldap/ldap.tf
@@ -0,0 +1,120 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+
+  description = "Vault cluster leader host"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The Vault root token"
+  default     = null
+}
+
+variable "ldap_password" {
+  type        = string
+  description = "The LDAP Server admin password"
+  default     = "password1"
+}
+
+variable "integration_host_state" {
+  description = "The state of the test server from the 'set_up_external_integration' module"
+}
+
+variable "ip_version" {
+  type        = string
+  description = "IP Version (4 or 6)"
+  default     = "4"
+}
+
+variable "ports" {
+  description = "Port configuration for services"
+  type = map(object({
+    port        = string
+    description = string
+  }))
+}
+
+locals {
+  ldap_output = {
+    ip_version = var.ip_version
+    ldap_mount = "ldap"
+    host       = var.integration_host_state.ldap.host
+    port       = var.ports.ldap.port
+    username   = "enos"
+    pw         = var.ldap_password
+  }
+}
+
+output "ldap" {
+  value = local.ldap_output
+}
+
+# Enable LDAP secrets engine
+resource "enos_remote_exec" "secrets_enable_ldap_secret" {
+  environment = {
+    ENGINE            = local.ldap_output.ldap_mount
+    MOUNT             = local.ldap_output.ldap_mount
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
+  }
+
+  scripts = [abspath("${path.module}/../../../scripts/secrets-enable.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Configuring Openldap Server and Vault LDAP
+resource "enos_remote_exec" "ldap_configurations" {
+  depends_on = [
+    enos_remote_exec.secrets_enable_ldap_secret
+  ]
+
+  environment = {
+    MOUNT             = local.ldap_output.ldap_mount
+    LDAP_SERVER       = local.ldap_output.host.private_ip
+    LDAP_PORT         = local.ldap_output.port
+    LDAP_USERNAME     = local.ldap_output.username
+    LDAP_ADMIN_PW     = local.ldap_output.pw
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
+  }
+
+  scripts = [abspath("${path.module}/../../../scripts/ldap-configs.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/main.tf b/enos/modules/verify_secrets_engines/modules/create/main.tf
new file mode 100644
index 00000000000..6105bdf5172
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/main.tf
@@ -0,0 +1,113 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "aws_enabled" {
+  type        = bool
+  description = <<-EOF
+    Whether or not we'll verify the AWS secrets engine. Due to the various security requirements in
+    Doormat managed AWS accounts, our implementation of the verification requires us to use a
+    an external 'DemoUser' role and associated policy in order to create additional users. This is
+    configured in vault_ci and vault_enterprise_ci but does not exist in all AWS accounts. As such,
+    it's disabled by default.
+    See: https://github.com/hashicorp/honeybee-templates/blob/main/templates/iam_policy/DemoUser.yaml
+  EOF
+  default     = false
+}
+
+variable "ldap_enabled" {
+  type        = bool
+  description = "Whether or not we'll verify the LDAP secrets engine"
+  default     = false
+}
+
+variable "kmip_enabled" {
+  type        = bool
+  description = "Whether or not we'll verify the KMIP secrets engine"
+  default     = false
+}
+
+variable "ipv4_cidr" {
+  type        = string
+  description = "The CIDR block for the VPC when using IPv4 mode"
+}
+
+variable "ports" {
+  type = map(object({
+    description = string
+    port        = number
+    protocol    = string
+  }))
+  description = "The ports to use for the Vault cluster instances"
+}
+
+variable "integration_host_state" {
+  description = "The state of the test server from the 'backend_test_servers' module"
+  default     = null
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The Vault cluster instances that were created"
+}
+
+variable "ip_version" {
+  type        = string
+  description = "IP Version (4 or 6)"
+  default     = "4"
+}
+
+variable "leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+
+  description = "Vault cluster leader host"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The Vault root token"
+  default     = null
+}
+
+variable "vault_edition" {
+  description = "The Vault binary edition (e.g., 'ce', 'ent', 'ent.fips1403', etc.)"
+  type        = string
+}
+
+output "state" {
+  value = {
+    auth     = local.auth_output
+    identity = local.identity_output
+    kv       = local.kv_output
+    pki      = local.pki_output
+    ssh      = local.ssh_output
+    aws      = local.aws_state
+    ldap     = local.ldap_output
+    kmip     = local.kmip_output
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/pki.tf b/enos/modules/verify_secrets_engines/modules/create/pki.tf
new file mode 100644
index 00000000000..7f74ce470c5
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/pki.tf
@@ -0,0 +1,69 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+locals {
+  // Variables
+  pki_mount       = "pki" # secret
+  pki_issuer_name = "issuer"
+  pki_common_name = "common"
+  pki_default_ttl = "72h"
+  pki_test_dir    = "tmp-test-results"
+
+  // Output
+  pki_output = {
+    common_name = local.pki_common_name
+    issuer_name = local.pki_issuer_name
+    mount       = local.pki_mount
+    ttl         = local.pki_default_ttl
+    test_dir    = local.pki_test_dir
+  }
+
+}
+
+output "pki" {
+  value = local.pki_output
+}
+
+# Enable pki secrets engine
+resource "enos_remote_exec" "secrets_enable_pki_secret" {
+  environment = {
+    ENGINE            = local.pki_mount
+    MOUNT             = local.pki_mount
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/secrets-enable.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Issue RSA Certificate
+resource "enos_remote_exec" "pki_issue_certificates" {
+  depends_on = [enos_remote_exec.secrets_enable_pki_secret]
+  for_each   = var.hosts
+
+  environment = {
+    MOUNT             = local.pki_mount
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
+    COMMON_NAME       = local.pki_common_name
+    ISSUER_NAME       = local.pki_issuer_name
+    TTL               = local.pki_default_ttl
+    TEST_DIR          = local.pki_test_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/pki-issue-certificates.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/create/ssh.tf b/enos/modules/verify_secrets_engines/modules/create/ssh.tf
new file mode 100644
index 00000000000..69696e1a21b
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/create/ssh.tf
@@ -0,0 +1,288 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Current SSH Secrets Engine API Coverage
+# | Method | Route                       | Covered | Notes                                 |
+# |--------|-----------------------------|---------|---------------------------------------|
+# | POST   | /ssh/roles/:name            | ✅      |                                       |
+# | GET    | /ssh/roles/:name            | ✅      |                                       |
+# | LIST   | /ssh/roles                  | ✅      |                                       |
+# | DELETE | /ssh/roles/:name            | 🟡      | Missing successful delete verification|
+# | POST   | /ssh/config/zeroaddress     | ❌      |                                       |
+# | GET    | /ssh/config/zeroaddress     | ❌      |                                       |
+# | DELETE | /ssh/config/zeroaddress     | ❌      |                                       |
+# | POST   | /ssh/creds/:name            | ✅      |                                       |
+# | POST   | /ssh/lookup                 | ❌      |                                       |
+# | POST   | /ssh/verify                 | ✅      |                                       |
+# | POST   | /ssh/config/ca              | ✅      |                                       |
+# | DELETE | /ssh/config/ca              | ❌      |                                       |
+# | GET    | /ssh/config/ca              | ✅      |                                       |
+# | GET    | /ssh/public_key             | ❌      |                                       |
+# | POST   | /ssh/sign                   | 🟡      | Missing parameters                    |
+# | POST   | /ssh/issue                  | ✅      |                                       |
+
+locals {
+  // Variables
+  otp_role_name = "ssh_role_otp"
+  ipv6_cidr     = "fd00:ffff::/64"
+  otp_role_params = {
+    key_type          = "otp"
+    default_user      = local.ssh_test_user
+    allowed_users     = local.ssh_test_user
+    cidr_list         = strcontains(local.ssh_test_ip.address, ":") ? "${local.ssh_test_ip.base}/64" : "${local.ssh_test_ip.base}/32"
+    exclude_cidr_list = strcontains(local.ssh_test_ip.address, ":") ? cidrsubnet(local.ipv6_cidr, 32, 0) : cidrsubnet(var.ipv4_cidr, 8, 1)
+    port              = var.ports.ssh.port
+    ttl               = "1h"
+    max_ttl           = "2h"
+  }
+
+  ca_role_name = "ssh_role_ca"
+  ca_role_params = {
+    key_type                = "ca"
+    default_user            = local.ssh_test_user
+    allow_user_certificates = true
+    allow_host_certificates = true
+    allowed_users           = local.ssh_test_user
+    port                    = var.ports.ssh.port
+    ttl                     = "1h"
+    max_ttl                 = "2h"
+    key_id_format           = "custom-keyid-{{token_display_name}}"
+    allowed_extensions      = "*"
+    default_extensions = {
+      "permit-pty" = ""
+    }
+    allow_user_key_ids     = true
+    allow_empty_principals = false
+    algorithm_signer       = "default"
+  }
+
+  is_fips_1402 = strcontains(lower(var.vault_edition), "fips1402")
+  ssh_mount    = "ssh"
+  ca_key_types = local.is_fips_1402 ? [
+    "ssh-rsa", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521"
+    ] : [
+    "ssh-rsa", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "ssh-ed25519"
+  ]
+  ca_key_type    = local.ca_key_types[random_integer.ca_key_type_idx.result]
+  cert_key_types = ["rsa", "ed25519", "ec"]
+  cert_key_type  = local.cert_key_types[random_integer.cert_key_idx.result]
+  ssh_test_ips   = [{ address : "192.168.1.1", base : "192.168.1.1" }, { address : "2001:db8::1", base : "2001:db8::" }]
+  ssh_test_ip    = local.ssh_test_ips[random_integer.test_ip_idx.result]
+  ssh_test_user  = "testuser"
+  ssh_public_key = tls_private_key.test_ssh_key.public_key_openssh
+
+  # Map ca_key_type to valid Terraform tls_private_key algorithm and curve
+  key_algorithm_map = {
+    "ssh-rsa"             = "RSA"
+    "ecdsa-sha2-nistp256" = "ECDSA"
+    "ecdsa-sha2-nistp384" = "ECDSA"
+    "ecdsa-sha2-nistp521" = "ECDSA"
+    "ssh-ed25519"         = "ED25519"
+  }
+
+  ecdsa_curve_map = {
+    "ecdsa-sha2-nistp256" = "P256"
+    "ecdsa-sha2-nistp384" = "P384"
+    "ecdsa-sha2-nistp521" = "P521"
+  }
+
+  rsa_bit_options = [2048, 3072, 4096, 7680, 15360]
+  rsa_bits        = local.rsa_bit_options[random_integer.rsa_bits_idx.result]
+
+  # Extract the corresponding algorithm and curve
+  key_algorithm = lookup(local.key_algorithm_map, local.ca_key_type, "RSA")
+  ecdsa_curve   = lookup(local.ecdsa_curve_map, local.ca_key_type, null)
+
+  // Response data
+  ssh_sign_key_data      = jsondecode(enos_remote_exec.ssh_sign_key.stdout).data
+  ssh_generate_cert_data = jsondecode(enos_remote_exec.ssh_generate_cert.stdout).data
+
+  // Output
+  ssh_output = {
+    ca_role_name    = local.ca_role_name
+    otp_role_name   = local.otp_role_name
+    mount           = local.ssh_mount
+    ca_key_type     = local.ca_key_type
+    cert_key_type   = local.cert_key_type
+    test_ip         = local.ssh_test_ip.address
+    test_user       = local.ssh_test_user
+    otp_role_params = local.otp_role_params
+    ca_role_params  = local.ca_role_params
+    data = {
+      sign_key      = local.ssh_sign_key_data
+      generate_cert = local.ssh_generate_cert_data
+    }
+  }
+}
+
+resource "tls_private_key" "test_ssh_key" {
+  algorithm = local.key_algorithm
+
+  # Conditionally set ecdsa_curve only for ECDSA keys
+  ecdsa_curve = local.key_algorithm == "ECDSA" ? local.ecdsa_curve : null
+
+  rsa_bits = local.key_algorithm == "RSA" ? local.rsa_bits : null
+}
+
+resource "random_integer" "rsa_bits_idx" {
+  min = 0
+  max = length(local.rsa_bit_options) - 1
+}
+
+resource "random_integer" "ca_key_type_idx" {
+  min = 0
+  max = length(local.ca_key_types) - 1
+}
+
+resource "random_integer" "cert_key_idx" {
+  min = 0
+  max = length(local.cert_key_types) - 1
+}
+
+resource "random_integer" "test_ip_idx" {
+  min = 0
+  max = length(local.ssh_test_ips) - 1
+}
+
+output "ssh" {
+  value = local.ssh_output
+}
+
+# Enable SSH secrets engine
+resource "enos_remote_exec" "secrets_enable_ssh" {
+  environment = {
+    ENGINE            = local.ssh_mount
+    MOUNT             = local.ssh_mount
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/secrets-enable.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Configure SSH CA
+resource "enos_remote_exec" "ssh_configure_ca" {
+  depends_on = [enos_remote_exec.secrets_enable_ssh]
+  environment = {
+    REQPATH           = "ssh/config/ca"
+    PAYLOAD           = jsonencode({ key_type = local.ca_key_type })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "ssh_create_ca_role" {
+  depends_on = [enos_remote_exec.ssh_configure_ca]
+  environment = {
+    REQPATH           = "ssh/roles/${local.ca_role_name}"
+    PAYLOAD           = jsonencode(local.ca_role_params)
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Create SSH OTP role
+resource "enos_remote_exec" "ssh_create_otp_role" {
+  depends_on = [enos_remote_exec.secrets_enable_ssh]
+  environment = {
+    REQPATH           = "ssh/roles/${local.otp_role_name}"
+    PAYLOAD           = jsonencode(local.otp_role_params)
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Sign SSH key
+resource "enos_remote_exec" "ssh_sign_key" {
+  depends_on = [enos_remote_exec.ssh_create_ca_role]
+  environment = {
+    REQPATH           = "ssh/sign/ssh_role_ca"
+    PAYLOAD           = jsonencode({ public_key = local.ssh_public_key })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Generate SSH OTP credential
+resource "enos_remote_exec" "ssh_generate_otp" {
+  depends_on = [enos_remote_exec.ssh_create_otp_role]
+  environment = {
+    REQPATH           = "ssh/creds/ssh_role_otp"
+    PAYLOAD           = jsonencode({ ip = local.ssh_test_ip.address, username = local.ssh_test_user })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Generate SSH Certificate and Key
+resource "enos_remote_exec" "ssh_generate_cert" {
+  depends_on = [enos_remote_exec.ssh_create_ca_role]
+
+  environment = {
+    REQPATH           = "ssh/issue/ssh_role_ca"
+    PAYLOAD           = jsonencode({ key_type = local.cert_key_type })
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/write.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
\ No newline at end of file
diff --git a/enos/modules/verify_secrets_engines/modules/delete/main.tf b/enos/modules/verify_secrets_engines/modules/delete/main.tf
new file mode 100644
index 00000000000..957e7e481dc
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/delete/main.tf
@@ -0,0 +1,55 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The Vault cluster instances that were created"
+}
+
+variable "leader_host" {
+  type = object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  })
+
+  description = "Vault cluster leader host"
+}
+
+variable "create_state" {
+  description = "The state of the secrets engines from the 'create' module"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The Vault root token"
+  default     = null
+}
+
+variable "verify_ssh_secrets" {
+  type        = bool
+  description = "Flag to verify SSH secrets"
+  default     = true
+}
diff --git a/enos/modules/verify_secrets_engines/modules/delete/ssh.tf b/enos/modules/verify_secrets_engines/modules/delete/ssh.tf
new file mode 100644
index 00000000000..0001ec9801e
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/delete/ssh.tf
@@ -0,0 +1,40 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Delete SSH CA role
+resource "enos_remote_exec" "ssh_delete_ca_role" {
+  count = var.verify_ssh_secrets ? 1 : 0
+  environment = {
+    REQPATH           = "ssh/roles/${var.create_state.ssh.ca_role_name}"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/delete.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
+
+# Delete SSH OTP role
+resource "enos_remote_exec" "ssh_delete_otp_role" {
+  count = var.verify_ssh_secrets ? 1 : 0
+  environment = {
+    REQPATH           = "ssh/roles/${var.create_state.ssh.otp_role_name}"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/delete.sh")]
+
+  transport = {
+    ssh = {
+      host = var.leader_host.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/read/auth.tf b/enos/modules/verify_secrets_engines/modules/read/auth.tf
new file mode 100644
index 00000000000..e6755597b97
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/auth.tf
@@ -0,0 +1,24 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+locals {
+  user_login_data = jsondecode(enos_remote_exec.auth_login_testuser.stdout)
+}
+
+resource "enos_remote_exec" "auth_login_testuser" {
+  environment = {
+    AUTH_PATH         = var.create_state.auth.userpass.path
+    PASSWORD          = var.create_state.auth.userpass.user.password
+    USERNAME          = var.create_state.auth.userpass.user.name
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/auth-userpass-login.sh")]
+
+  transport = {
+    ssh = {
+      host = var.hosts[0].public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/read/aws.tf b/enos/modules/verify_secrets_engines/modules/read/aws.tf
new file mode 100644
index 00000000000..ad6e1bc4e8f
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/aws.tf
@@ -0,0 +1,15 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+module "verify_aws_secrets_engine" {
+  count  = var.aws_enabled ? 1 : 0
+  source = "./aws"
+
+  create_state            = var.create_state
+  vault_addr              = var.vault_addr
+  vault_root_token        = var.vault_root_token
+  vault_install_dir       = var.vault_install_dir
+  verify_aws_engine_creds = var.verify_aws_engine_creds
+
+  hosts = var.hosts
+}
diff --git a/enos/modules/verify_secrets_engines/modules/read/aws/aws.tf b/enos/modules/verify_secrets_engines/modules/read/aws/aws.tf
new file mode 100644
index 00000000000..a811a6af727
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/aws/aws.tf
@@ -0,0 +1,69 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The Vault cluster instances that were created"
+}
+
+variable "create_state" {
+  description = "The state of the secrets engines from the 'create' module"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The Vault root token"
+  default     = null
+}
+
+variable "verify_aws_engine_creds" {
+  type = bool
+}
+
+# Verify AWS Engine
+resource "enos_remote_exec" "aws_verify_new_creds" {
+  for_each = var.hosts
+
+  environment = {
+    AWS_REGION              = "${var.create_state.aws.region}"
+    MOUNT                   = "${var.create_state.aws.mount}"
+    AWS_USER_NAME           = "${var.create_state.aws.aws_user_name}"
+    AWS_ACCESS_KEY_ID       = "${var.create_state.aws.aws_access_key}"
+    AWS_SECRET_ACCESS_KEY   = "${var.create_state.aws.aws_secret_key}"
+    VAULT_AWS_ROLE          = "${var.create_state.aws.vault_aws_role}"
+    VAULT_ADDR              = var.vault_addr
+    VAULT_TOKEN             = var.vault_root_token
+    VAULT_INSTALL_DIR       = var.vault_install_dir
+    VERIFY_AWS_ENGINE_CERTS = var.verify_aws_engine_creds
+  }
+
+  scripts = [abspath("${path.module}/../../../scripts/aws-verify-new-creds.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/read/identity.tf b/enos/modules/verify_secrets_engines/modules/read/identity.tf
new file mode 100644
index 00000000000..12859f6fd32
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/identity.tf
@@ -0,0 +1,56 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+// Read our testuser identity entity and verify that it matches our expected alias, groups, policy,
+// and metadata.
+resource "enos_remote_exec" "identity_verify_entity" {
+  for_each = var.hosts
+
+  environment = {
+    ENTITY_ALIAS_ID = var.create_state.identity.data.entity_alias.id
+    ENTITY_GROUP_IDS = jsonencode([
+      var.create_state.kv.data.identity_group_kv_writers.id,
+      var.create_state.identity.data.group_oidc_token_readers.id,
+    ])
+    ENTITY_METADATA   = jsonencode(var.create_state.identity.identity_entity_metadata)
+    ENTITY_NAME       = var.create_state.identity.data.entity.name
+    ENTITY_POLICIES   = jsonencode([var.create_state.auth.userpass.user.policy_name])
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = local.user_login_data.auth.client_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/identity-verify-entity.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+// Read our OIDC key and role and verify that they have the correct configuration, TTLs, and algorithms.
+resource "enos_remote_exec" "identity_verify_oidc" {
+  for_each = var.hosts
+
+  environment = {
+    OIDC_ISSUER_URL           = var.create_state.identity.oidc.issuer_url
+    OIDC_KEY_NAME             = var.create_state.identity.oidc.key_name
+    OIDC_KEY_ROTATION_PERIOD  = var.create_state.identity.oidc.key_rotation_period
+    OIDC_KEY_VERIFICATION_TTL = var.create_state.identity.oidc.key_verification_ttl
+    OIDC_KEY_ALGORITHM        = var.create_state.identity.oidc.key_algorithm
+    OIDC_ROLE_NAME            = var.create_state.identity.oidc.role_name
+    OIDC_ROLE_TTL             = var.create_state.identity.oidc.role_ttl
+    VAULT_ADDR                = var.vault_addr
+    VAULT_TOKEN               = local.user_login_data.auth.client_token
+    VAULT_INSTALL_DIR         = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/identity-verify-oidc.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/read/kmip.tf b/enos/modules/verify_secrets_engines/modules/read/kmip.tf
new file mode 100644
index 00000000000..a3c85a38a94
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/kmip.tf
@@ -0,0 +1,15 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Verifying Vault LDAP Configurations
+module "verify_kmip_secret_engine" {
+  count  = var.kmip_enabled ? 1 : 0
+  source = "./kmip"
+
+  create_state  = var.create_state
+  hosts         = var.hosts
+  ip_version    = var.ip_version
+  vault_addr    = var.vault_addr
+  vault_edition = var.vault_edition
+}
+
diff --git a/enos/modules/verify_secrets_engines/modules/read/kmip/kmip.tf b/enos/modules/verify_secrets_engines/modules/read/kmip/kmip.tf
new file mode 100644
index 00000000000..febf0d8f5e8
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/kmip/kmip.tf
@@ -0,0 +1,71 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "create_state" {
+  description = "The state of the secrets engines from the 'create' module"
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The Vault cluster instances that were created"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "ip_version" {
+  type        = string
+  description = "IP Version (4 or 6)"
+  default     = "4"
+}
+
+variable "vault_edition" {
+  type        = string
+  description = "IP Version (4 or 6)"
+  default     = "4"
+}
+
+locals {
+  kmip_output = {
+    mount      = "kmip"
+    ip_address = var.ip_version == "6" ? var.hosts[0].ipv6 : var.hosts[0].public_ip
+  }
+}
+
+# KMIP Client Configuration
+resource "enos_remote_exec" "kmip_client_configure" {
+
+  environment = {
+    VAULT_ADDR = var.vault_addr
+    SERVER_CA  = var.create_state.kmip.server_ca
+    CLIENT_CA  = var.create_state.kmip.client_cert
+    KMIP_PORT  = var.create_state.kmip.port
+  }
+
+  // Only perform KMIP operations for Vault Enterprise
+  // The KMIP secrets engine is not available in Vault CE
+  count = var.vault_edition == "ce" ? 0 : 1
+
+  scripts = [abspath("${path.module}/../../../scripts/kmip/kmip-client-configure.sh")]
+
+  transport = {
+    ssh = {
+      host = var.create_state.kmip.test_server_ip
+      user = "ubuntu" # Assuming Ubuntu for the test server
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/read/kv.tf b/enos/modules/verify_secrets_engines/modules/read/kv.tf
new file mode 100644
index 00000000000..579650a4a80
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/kv.tf
@@ -0,0 +1,25 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+resource "enos_remote_exec" "kv_get_verify_test_data" {
+  for_each = var.hosts
+
+  environment = {
+    MOUNT             = var.create_state.kv.mount
+    SECRET_PATH       = "${var.create_state.kv.test.path_prefix}-${each.key}"
+    KEY               = "${var.create_state.kv.test.path_prefix}-${each.key}"
+    KV_VERSION        = var.create_state.kv.version
+    VALUE             = "${var.create_state.kv.test.value_prefix}-${each.key}"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = local.user_login_data.auth.client_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/kv-verify-value.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/read/ldap.tf b/enos/modules/verify_secrets_engines/modules/read/ldap.tf
new file mode 100644
index 00000000000..e2d3c13b37f
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/ldap.tf
@@ -0,0 +1,16 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Verifying Vault LDAP Configurations
+module "verify_ldap_secret_engine" {
+  count  = var.ldap_enabled ? 1 : 0
+  source = "./ldap"
+
+  create_state      = var.create_state
+  vault_addr        = var.vault_addr
+  vault_root_token  = var.vault_root_token
+  vault_install_dir = var.vault_install_dir
+
+  hosts = var.hosts
+}
+
diff --git a/enos/modules/verify_secrets_engines/modules/read/ldap/ldap.tf b/enos/modules/verify_secrets_engines/modules/read/ldap/ldap.tf
new file mode 100644
index 00000000000..fbb434f4303
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/ldap/ldap.tf
@@ -0,0 +1,66 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The Vault cluster instances that were created"
+}
+
+variable "create_state" {
+  description = "The state of the secrets engines from the 'create' module"
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The Vault root token"
+  default     = null
+}
+
+locals {
+  ldap_login_data = jsondecode(enos_remote_exec.ldap_verify_configs.stdout)
+}
+
+# Verifying Vault LDAP Configurations
+resource "enos_remote_exec" "ldap_verify_configs" {
+
+  environment = {
+    MOUNT             = "${var.create_state.ldap.ldap_mount}"
+    LDAP_SERVER       = "${var.create_state.ldap.host.private_ip}"
+    LDAP_PORT         = "${var.create_state.ldap.port}"
+    LDAP_USERNAME     = "${var.create_state.ldap.username}"
+    LDAP_ADMIN_PW     = "${var.create_state.ldap.pw}"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
+  }
+
+  scripts = [abspath("${path.module}/../../../scripts/ldap-verify-configs")]
+
+  transport = {
+    ssh = {
+      host = var.hosts[0].public_ip
+    }
+  }
+}
diff --git a/enos/modules/verify_secrets_engines/modules/read/main.tf b/enos/modules/verify_secrets_engines/modules/read/main.tf
new file mode 100644
index 00000000000..dbf3f2403d3
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/main.tf
@@ -0,0 +1,97 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+terraform {
+  required_providers {
+    enos = {
+      source = "registry.terraform.io/hashicorp-forge/enos"
+    }
+  }
+}
+
+variable "hosts" {
+  type = map(object({
+    ipv6       = string
+    private_ip = string
+    public_ip  = string
+  }))
+  description = "The Vault cluster instances that were created"
+}
+
+variable "create_state" {
+  description = "The state of the secrets engines from the 'create' module"
+}
+
+variable "ip_version" {
+  type        = string
+  description = "IP Version (4 or 6)"
+  default     = "4"
+
+}
+
+variable "vault_addr" {
+  type        = string
+  description = "The local vault API listen address"
+}
+
+variable "vault_edition" {
+  type        = string
+  description = "The Vault product edition"
+}
+
+variable "vault_install_dir" {
+  type        = string
+  description = "The directory where the Vault binary will be installed"
+}
+
+variable "vault_root_token" {
+  type        = string
+  description = "The Vault root token"
+  default     = null
+}
+
+variable "aws_enabled" {
+  type        = bool
+  description = <<-EOF
+    Whether or not we'll verify the AWS secrets engine. Due to the various security requirements in
+    Doormat managed AWS accounts, our implementation of the verification requires us to use a
+    an external 'DemoUser' role and associated policy in order to create additional users. This is
+    configured in vault_ci and vault_enterprise_ci but does not exist in all AWS accounts. As such,
+    it's disabled by default.
+    See: https://github.com/hashicorp/honeybee-templates/blob/main/templates/iam_policy/DemoUser.yaml
+  EOF
+  default     = false
+}
+
+variable "kmip_enabled" {
+  type        = bool
+  description = "Whether or not we'll verify the KMIP secrets engine"
+  default     = false
+}
+
+variable "ldap_enabled" {
+  type        = bool
+  description = "Whether or not we'll verify the LDAP secrets engine"
+  default     = false
+}
+
+variable "verify_aws_engine_creds" {
+  type    = bool
+  default = true
+}
+
+variable "verify_pki_certs" {
+  type        = bool
+  description = "Flag to verify pki certificates"
+  default     = true
+}
+
+variable "verify_ssh_secrets" {
+  type        = bool
+  description = "Flag to verify SSH secrets"
+  default     = true
+}
+
+locals {
+  vault_bin_path = "${var.vault_install_dir}/vault"
+}
diff --git a/enos/modules/verify_secrets_engines/modules/read/pki.tf b/enos/modules/verify_secrets_engines/modules/read/pki.tf
new file mode 100644
index 00000000000..67d388cba0b
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/pki.tf
@@ -0,0 +1,31 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Verify PKI Certificate
+resource "enos_remote_exec" "pki_verify_certificates" {
+  for_each = var.hosts
+
+  environment = {
+    MOUNT             = var.create_state.pki.mount
+    AUTH_PATH         = "${var.create_state.auth.userpass.path}"
+    USERNAME          = "${var.create_state.auth.userpass.user.name}"
+    PASSWORD          = "${var.create_state.auth.userpass.user.password}"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_INSTALL_DIR = var.vault_install_dir
+    VAULT_TOKEN       = var.vault_root_token
+    COMMON_NAME       = var.create_state.pki.common_name
+    ISSUER_NAME       = var.create_state.pki.issuer_name
+    TTL               = var.create_state.pki.ttl
+    TEST_DIR          = var.create_state.pki.test_dir
+    VERIFY_PKI_CERTS  = var.verify_pki_certs
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/pki-verify-certificates.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
diff --git a/enos/modules/verify_secrets_engines/modules/read/ssh.tf b/enos/modules/verify_secrets_engines/modules/read/ssh.tf
new file mode 100644
index 00000000000..08fd976e4de
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/modules/read/ssh.tf
@@ -0,0 +1,160 @@
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+
+# List SSH roles
+resource "enos_remote_exec" "ssh_list_roles" {
+  for_each = var.verify_ssh_secrets ? var.hosts : {}
+  environment = {
+    REQPATH           = "ssh/roles"
+    VAULT_ADDR        = var.vault_addr
+    VAULT_TOKEN       = var.vault_root_token
+    VAULT_INSTALL_DIR = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/list.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+# Read and Verify SSH CA Role configuration
+resource "enos_remote_exec" "ssh_verify_ca_role" {
+  for_each = var.hosts
+
+  environment = {
+    VERIFY_SSH_SECRETS      = var.verify_ssh_secrets
+    ROLE_NAME               = var.create_state.ssh.ca_role_name
+    KEY_TYPE                = var.create_state.ssh.ca_role_params.key_type
+    DEFAULT_USER            = var.create_state.ssh.ca_role_params.default_user
+    ALLOWED_USERS           = var.create_state.ssh.ca_role_params.allowed_users
+    PORT                    = tostring(var.create_state.ssh.ca_role_params.port)
+    TTL                     = var.create_state.ssh.ca_role_params.ttl
+    MAX_TTL                 = var.create_state.ssh.ca_role_params.max_ttl
+    ALLOW_USER_CERTIFICATES = tostring(var.create_state.ssh.ca_role_params.allow_user_certificates)
+    ALLOW_HOST_CERTIFICATES = tostring(var.create_state.ssh.ca_role_params.allow_host_certificates)
+    ALLOW_USER_KEY_IDS      = tostring(var.create_state.ssh.ca_role_params.allow_user_key_ids)
+    ALLOW_EMPTY_PRINCIPALS  = tostring(var.create_state.ssh.ca_role_params.allow_empty_principals)
+    ALGORITHM_SIGNER        = var.create_state.ssh.ca_role_params.algorithm_signer
+    KEY_ID_FORMAT           = var.create_state.ssh.ca_role_params.key_id_format
+    VAULT_ADDR              = var.vault_addr
+    VAULT_TOKEN             = var.vault_root_token
+    VAULT_INSTALL_DIR       = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/ssh/ssh-verify-role.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+resource "enos_remote_exec" "ssh_verify_otp_role" {
+  for_each = var.hosts
+
+  environment = {
+    VERIFY_SSH_SECRETS = var.verify_ssh_secrets
+    ROLE_NAME          = var.create_state.ssh.otp_role_name
+    KEY_TYPE           = var.create_state.ssh.otp_role_params.key_type
+    DEFAULT_USER       = var.create_state.ssh.otp_role_params.default_user
+    ALLOWED_USERS      = var.create_state.ssh.otp_role_params.allowed_users
+    CIDR_LIST          = var.create_state.ssh.otp_role_params.cidr_list
+    EXCLUDE_CIDR_LIST  = var.create_state.ssh.otp_role_params.exclude_cidr_list
+    PORT               = tostring(var.create_state.ssh.otp_role_params.port)
+    VAULT_ADDR         = var.vault_addr
+    VAULT_TOKEN        = var.vault_root_token
+    VAULT_INSTALL_DIR  = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/ssh/ssh-verify-role.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+# Read and Verify SSH CA configuration
+resource "enos_remote_exec" "ssh_verify_ca" {
+  for_each = var.hosts
+
+  environment = {
+    VERIFY_SSH_SECRETS = var.verify_ssh_secrets
+    CA_KEY_TYPE        = var.create_state.ssh.ca_key_type
+    VAULT_ADDR         = var.vault_addr
+    VAULT_TOKEN        = var.vault_root_token
+    VAULT_INSTALL_DIR  = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/ssh/ssh-verify-ca.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+// Read and Verify Signed SSH Key
+resource "enos_remote_exec" "ssh_verify_signed_key" {
+  for_each = var.hosts
+
+  environment = {
+    VERIFY_SSH_SECRETS = var.verify_ssh_secrets
+    SIGNED_KEY         = var.create_state.ssh.data.sign_key.signed_key
+    KEY_TYPE           = var.create_state.ssh.ca_key_type
+    VAULT_ADDR         = var.vault_addr
+    VAULT_TOKEN        = var.vault_root_token
+    VAULT_INSTALL_DIR  = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/ssh/ssh-verify-signed-key.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+// Read and Verify OTP Credential
+resource "enos_remote_exec" "ssh_verify_otp" {
+  for_each = var.hosts
+
+  environment = {
+    VERIFY_SSH_SECRETS = var.verify_ssh_secrets
+    IP                 = var.create_state.ssh.test_ip
+    ROLE_NAME          = var.create_state.ssh.otp_role_name
+    USERNAME           = var.create_state.ssh.test_user
+    VAULT_ADDR         = var.vault_addr
+    VAULT_TOKEN        = var.vault_root_token
+    VAULT_INSTALL_DIR  = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/ssh/ssh-verify-otp.sh")]
+
+  transport = {
+    ssh = {
+      host = each.value.public_ip
+    }
+  }
+}
+
+resource "enos_local_exec" "ssh_verify_cert" {
+  environment = {
+    VERIFY_SSH_SECRETS = var.verify_ssh_secrets
+    SIGNED_KEY         = var.create_state.ssh.data.generate_cert.signed_key
+    KEY_TYPE           = var.create_state.ssh.cert_key_type
+    VAULT_ADDR         = var.vault_addr
+    VAULT_TOKEN        = var.vault_root_token
+    VAULT_INSTALL_DIR  = var.vault_install_dir
+  }
+
+  scripts = [abspath("${path.module}/../../scripts/ssh/ssh-verify-signed-key.sh")]
+}
diff --git a/enos/modules/verify_secrets_engines/scripts/auth-enable.sh b/enos/modules/verify_secrets_engines/scripts/auth-enable.sh
new file mode 100644
index 00000000000..9dae8ee2279
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/auth-enable.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$AUTH_METHOD" ]] && fail "AUTH_METHOD env variable has not been set"
+[[ -z "$AUTH_PATH" ]] && fail "AUTH_PATH env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+"$binpath" auth enable -path="$AUTH_PATH" "$AUTH_METHOD"
diff --git a/enos/modules/verify_secrets_engines/scripts/auth-userpass-login.sh b/enos/modules/verify_secrets_engines/scripts/auth-userpass-login.sh
new file mode 100644
index 00000000000..6e908172eff
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/auth-userpass-login.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$AUTH_PATH" ]] && fail "AUTH_PATH env variable has not been set"
+[[ -z "$PASSWORD" ]] && fail "PASSWORD env variable has not been set"
+[[ -z "$USERNAME" ]] && fail "USERNAME env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+"$binpath" write "auth/$AUTH_PATH/login/$USERNAME" password="$PASSWORD"
diff --git a/enos/modules/verify_secrets_engines/scripts/auth-userpass-write.sh b/enos/modules/verify_secrets_engines/scripts/auth-userpass-write.sh
new file mode 100644
index 00000000000..b64069d7dd3
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/auth-userpass-write.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$AUTH_PATH" ]] && fail "AUTH_PATH env variable has not been set"
+[[ -z "$PASSWORD" ]] && fail "PASSWORD env variable has not been set"
+[[ -z "$POLICIES" ]] && fail "POLICIES env variable has not been set"
+[[ -z "$USERNAME" ]] && fail "USERNAME env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+"$binpath" write "auth/$AUTH_PATH/users/$USERNAME" password="$PASSWORD" policies="$POLICIES"
diff --git a/enos/modules/verify_secrets_engines/scripts/aws-generate-roles.sh b/enos/modules/verify_secrets_engines/scripts/aws-generate-roles.sh
new file mode 100755
index 00000000000..f085eab6e2f
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/aws-generate-roles.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$MOUNT" ]] && fail "MOUNT env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$VAULT_AWS_ROLE" ]] && fail "VAULT_AWS_ROLE env variable has not been set"
+[[ -z "$AWS_REGION" ]] && fail "AWS_REGION env variable has not been set"
+[[ -z "$AWS_POLICY_ARN" ]] && fail "AWS_POLICY_ARN env variable has not been set"
+[[ -z "$AWS_ROLE_ARN" ]] && fail "AWS_ROLE_ARN env variable has not been set"
+[[ -z "$AWS_USER_NAME" ]] && fail "AWS_USER_NAME env variable has not been set"
+[[ -z "$AWS_ACCESS_KEY_ID" ]] && fail "AWS_ACCESS_KEY_ID env variable has not been set"
+[[ -z "$AWS_SECRET_ACCESS_KEY" ]] && fail "AWS_SECRET_ACCESS_KEY env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+
+while true; do
+  echo -e "Waiting for IAM user to be done setting up...\n"
+  # Fetch the IAM user creation date and convert it to a Unix timestamp
+  create_timestamp=$(aws iam get-user --user-name "${AWS_USER_NAME}" --query 'User.CreateDate' --output text | sed 's/\([+-][0-9]\{2\}:[0-9]\{2\}\)$//' | date -f - "+%s")
+  if (($(date +%s) - create_timestamp > 75)); then
+    break
+  fi
+  sleep 2
+done
+
+echo -e "Configuring Vault AWS \n"
+USERNAME_TEMPLATE="{{ if (eq .Type \"STS\") }}{{ printf \"${AWS_USER_NAME}-%s-%s\" (random 20) (unix_time) | truncate 32 }}{{ else }}{{ printf \"${AWS_USER_NAME}-%s-%s\" (unix_time) (random 20) | truncate 60 }}{{ end }}"
+"$binpath" write "${MOUNT}/config/root" access_key="${AWS_ACCESS_KEY_ID}" secret_key="${AWS_SECRET_ACCESS_KEY}" region="${AWS_REGION}" username_template="${USERNAME_TEMPLATE}"
+
+echo -e "Creating Role to create user \n"
+"$binpath" write "aws/roles/${VAULT_AWS_ROLE}" \
+    credential_type=iam_user \
+    permissions_boundary_arn="${AWS_POLICY_ARN}" \
+    policy_document=- << EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["ec2:DescribeRegions"],
+      "Resource": ["*"]
+    }
+  ]
+}
+EOF
+
+echo -e "Verifying root config \n"
+"$binpath" read "${MOUNT}/config/root"
+ROOT_USERNAME_TEMPLATE=$("$binpath" read "${MOUNT}/config/root" | jq -r '.data.username_template')
+[[ "$ROOT_USERNAME_TEMPLATE" == *"$AWS_USER_NAME"* ]] || fail "Uername Template does not include the current role"
diff --git a/enos/modules/verify_secrets_engines/scripts/aws-verify-new-creds.sh b/enos/modules/verify_secrets_engines/scripts/aws-verify-new-creds.sh
new file mode 100755
index 00000000000..79662c4b73d
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/aws-verify-new-creds.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$MOUNT" ]] && fail "MOUNT env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$VAULT_AWS_ROLE" ]] && fail "VAULT_AWS_ROLE env variable has not been set"
+[[ -z "$VERIFY_AWS_ENGINE_CERTS" ]] && fail "VERIFY_AWS_ENGINE_CERTS env variable has not been set"
+[[ -z "$AWS_REGION" ]] && fail "AWS_REGION env variable has not been set"
+[[ -z "$AWS_USER_NAME" ]] && fail "AWS_USER_NAME env variable has not been set"
+[[ -z "$AWS_ACCESS_KEY_ID" ]] && fail "AWS_ACCESS_KEY_ID env variable has not been set"
+[[ -z "$AWS_SECRET_ACCESS_KEY" ]] && fail "AWS_SECRET_ACCESS_KEY env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+
+if [ "${VERIFY_AWS_ENGINE_CERTS}" = false ]; then
+  echo "AWS Engine certificate verification is disabled. Skipping verification."
+  exit 0
+fi
+
+echo -e "Configuring Vault AWS \n"
+USERNAME_TEMPLATE="{{ if (eq .Type \"STS\") }}{{ printf \"${AWS_USER_NAME}-%s-%s\" (random 20) (unix_time) | truncate 32 }}{{ else }}{{ printf \"${AWS_USER_NAME}-%s-%s\" (unix_time) (random 20) | truncate 60 }}{{ end }}"
+"$binpath" write "${MOUNT}/config/root" access_key="${AWS_ACCESS_KEY_ID}" secret_key="${AWS_SECRET_ACCESS_KEY}" username_template="${USERNAME_TEMPLATE}"
+
+echo -e "Verifying root config \n"
+"$binpath" read "${MOUNT}/config/root"
+ROOT_USERNAME_TEMPLATE=$("$binpath" read "${MOUNT}/config/root" | jq -r '.data.username_template')
+[[ "$ROOT_USERNAME_TEMPLATE" == *"$AWS_USER_NAME"* ]] || fail "Uername Template does not include the current role"
+
+echo -e "Verifying roles list \n"
+"$binpath" list "${MOUNT}/roles"
+ROLE=$("$binpath" list "${MOUNT}/roles" | jq -r '.[]')
+[[ -z "$ROLE" ]] && fail "No AWS roles created!"
+
+echo -e "Generate New Credentials \n"
+TEMP_IAM_USER=$("$binpath" read "${MOUNT}/creds/${VAULT_AWS_ROLE}") || fail "Failed to generate new credentials for iam user: ${VAULT_AWS_ROLE}"
+TEMP_ACCESS_KEY=$(echo "${TEMP_IAM_USER}" | jq -r '.data.access_key') || fail "Failed to get access key from: ${VAULT_AWS_ROLE}"
+if [[ -z "$TEMP_ACCESS_KEY" && "$TEMP_ACCESS_KEY" != "$AWS_USER_NAME" ]]; then
+  failed "The new access key is empty or is matching the old one: ${TEMP_ACCESS_KEY}"
+fi
diff --git a/enos/modules/verify_secrets_engines/scripts/delete.sh b/enos/modules/verify_secrets_engines/scripts/delete.sh
new file mode 100644
index 00000000000..e0261c5890c
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/delete.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$REQPATH" ]] && fail "REQPATH env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath="${VAULT_INSTALL_DIR}/vault"
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+if output=$("$binpath" delete "$REQPATH" 2>&1); then
+  printf "%s\n" "$output"
+else
+  fail "failed to delete path: $REQPATH out=$output"
+fi
diff --git a/enos/modules/verify_secrets_engines/scripts/identity-oidc-introspect-token.sh b/enos/modules/verify_secrets_engines/scripts/identity-oidc-introspect-token.sh
new file mode 100644
index 00000000000..805d19333d4
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/identity-oidc-introspect-token.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$PAYLOAD" ]] && fail "PAYLOAD env variable has not been set"
+[[ -z "$ASSERT_ACTIVE" ]] && fail "ASSERT_ACTIVE env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+if ! output=$("$binpath" write identity/oidc/introspect - <<< "$PAYLOAD" 2>&1); then
+  # Attempt to write our error on stdout as JSON as our consumers of the script expect it to be JSON
+  printf '{"data":{"error":"%s"}}' "$output"
+  # Fail on stderr with a human readable message
+  fail "failed to write payload to identity/oidc/introspect: payload=$PAYLOAD output=$output"
+fi
+
+printf "%s\n" "$output" # Write our response output JSON to stdout
+if ! jq -Me --argjson ACTIVE "$ASSERT_ACTIVE" '.data.active == $ACTIVE' <<< "$output" &> /dev/null; then
+  # Write a failure message on STDERR
+  fail "token active state is invalid, expected .data.active='$ASSERT_ACTIVE'"
+fi
diff --git a/enos/modules/verify_secrets_engines/scripts/identity-verify-entity.sh b/enos/modules/verify_secrets_engines/scripts/identity-verify-entity.sh
new file mode 100644
index 00000000000..fe176d199b0
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/identity-verify-entity.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$ENTITY_ALIAS_ID" ]] && fail "ENTITY_ALIAS_ID env variable has not been set"
+[[ -z "$ENTITY_GROUP_IDS" ]] && fail "ENTITY_GROUP_IDS env variable has not been set"
+[[ -z "$ENTITY_METADATA" ]] && fail "ENTITY_METADATA env variable has not been set"
+[[ -z "$ENTITY_NAME" ]] && fail "ENTITY_NAME env variable has not been set"
+[[ -z "$ENTITY_POLICIES" ]] && fail "ENTITY_POLICIES env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+if ! output=$("$binpath" read "identity/entity/name/$ENTITY_NAME" 2>&1); then
+  fail "failed to read identity/entity/name/$ENTITY_NAME: $output"
+fi
+
+if ! jq -Mec --arg ALIAS "$ENTITY_ALIAS_ID" '.data.aliases[0].id == $ALIAS' <<< "$output"; then
+  fail "entity alias ID does not match, expected: $ENTITY_ALIAS_ID, got: $(jq -Mrc '.data.aliases' <<< "$output")"
+fi
+
+if ! jq -Mec --argjson GROUPS "$ENTITY_GROUP_IDS" '.data.group_ids | sort as $have | $GROUPS | sort as $want | $have == $want' <<< "$output"; then
+  fail "entity group ID's do not match, expected: $ENTITY_GROUP_IDS, got: $(jq -Mrc '.data.group_ids' <<< "$output")"
+fi
+
+if ! jq -Mec --argjson METADATA "$ENTITY_METADATA" '.data.metadata == $METADATA' <<< "$output"; then
+  fail "entity metadata does not match, expected: $ENTITY_METADATA, got: $(jq -Mrc '.data.metadata' <<< "$output")"
+fi
+
+if ! jq -Mec --argjson POLICIES "$ENTITY_POLICIES" '.data.policies == $POLICIES' <<< "$output"; then
+  fail "entity policies do not match, expected: $ENTITY_POLICIES, got: $(jq -Mrc '.data.policies' <<< "$output")"
+fi
diff --git a/enos/modules/verify_secrets_engines/scripts/identity-verify-oidc.sh b/enos/modules/verify_secrets_engines/scripts/identity-verify-oidc.sh
new file mode 100644
index 00000000000..fc6d2dcc9cc
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/identity-verify-oidc.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$OIDC_ISSUER_URL" ]] && fail "OIDC_ISSUER_URL env variable has not been set"
+[[ -z "$OIDC_KEY_NAME" ]] && fail "OIDC_KEY_NAME env variable has not been set"
+[[ -z "$OIDC_KEY_ROTATION_PERIOD" ]] && fail "OIDC_KEY_ROTATION_PERIOD env variable has not been set"
+[[ -z "$OIDC_KEY_VERIFICATION_TTL" ]] && fail "OIDC_KEY_VERIFICATION_TTL env variable has not been set"
+[[ -z "$OIDC_KEY_ALGORITHM" ]] && fail "OIDC_KEY_ALGORITHM env variable has not been set"
+[[ -z "$OIDC_ROLE_NAME" ]] && fail "OIDC_ROLE_NAME env variable has not been set"
+[[ -z "$OIDC_ROLE_TTL" ]] && fail "OIDC_ROLE_TTL env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+
+# Verify that we have the correct issuer URL
+if ! cfg=$("$binpath" read identity/oidc/config); then
+  fail "failed to read identity/oidc/config: $cfg"
+elif ! jq -Merc --arg URL "$OIDC_ISSUER_URL" '.data.issuer == $URL' <<< "$cfg"; then
+  fail "oidc issuer URL is incorrect, expected: $OIDC_ISSUER_URL, got $(jq -Mrc '.data.issuer' <<< "$cfg")"
+fi
+
+# Verify that our token algorithm, rotation period and verification TTL are correct
+if ! key_res=$("$binpath" read "identity/oidc/key/$OIDC_KEY_NAME"); then
+  fail "failed to read identity/oidc/key/$OIDC_KEY_NAME: $key_res"
+fi
+
+if ! jq -Merc --arg ALG "$OIDC_KEY_ALGORITHM" '.data.algorithm == $ALG' <<< "$key_res"; then
+  fail "oidc token algorithm is incorrect, expected: $OIDC_KEY_ALGORITHM, got $(jq -Mrc '.data.algorithm' <<< "$key_res")"
+fi
+
+if ! jq -Merc --argjson RP "$OIDC_KEY_ROTATION_PERIOD" '.data.rotation_period == $RP' <<< "$key_res"; then
+  fail "oidc token rotation_period is incorrect, expected: $OIDC_KEY_ROTATION_PERIOD, got $(jq -Mrc '.data.rotation_period' <<< "$key_res")"
+fi
+
+if ! jq -Merc --argjson TTL "$OIDC_KEY_VERIFICATION_TTL" '.data.verification_ttl == $TTL' <<< "$key_res"; then
+  fail "oidc token verification_ttl is incorrect, expected: $OIDC_KEY_VERIFICATION_TTL, got $(jq -Mrc '.data.verification_ttl' <<< "$key_res")"
+fi
+
+# Verify that our role key and TTL are correct.
+if ! role_res=$("$binpath" read "identity/oidc/role/$OIDC_ROLE_NAME"); then
+  fail "failed to read identity/oidc/role/$OIDC_ROLE_NAME: $role_res"
+fi
+
+if ! jq -Merc --arg KEY "$OIDC_KEY_NAME" '.data.key == $KEY' <<< "$role_res"; then
+  fail "oidc role key is incorrect, expected: $OIDC_KEY_NAME, got $(jq -Mrc '.data.key' <<< "$role_res")"
+fi
+
+if ! jq -Merc --argjson TTL "$OIDC_ROLE_TTL" '.data.ttl == $TTL' <<< "$role_res"; then
+  fail "oidc role ttl is incorrect, expected: $OIDC_ROLE_TTL, got $(jq -Mrc '.data.ttl' <<< "$role_res")"
+fi
diff --git a/enos/modules/verify_secrets_engines/scripts/kmip/kmip-client-configure.sh b/enos/modules/verify_secrets_engines/scripts/kmip/kmip-client-configure.sh
new file mode 100644
index 00000000000..afa0b715fe0
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/kmip/kmip-client-configure.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "${SERVER_CA}" ]] && fail "SERVER_CA env variable has not been set"
+[[ -z "${CLIENT_CA}" ]] && fail "CLIENT_CA env variable has not been set"
+[[ -z "${VAULT_ADDR}" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "${KMIP_PORT}" ]] && fail "KMIP_PORT env variable has not been set"
+
+cd ~ || fail "Failed to change directory to home"
+TEMP_DIR=/tmp/kmip_temp
+mkdir -p "${TEMP_DIR}" || fail "Failed to create temporary directory"
+
+echo "${SERVER_CA}" > "${TEMP_DIR}"/vault-ca.pem
+echo "${CLIENT_CA}" > "${TEMP_DIR}"/client.pem
+
+# Extract certificate and key from client bundle
+cd "${TEMP_DIR}" || fail "Failed to change directory to ${TEMP_DIR}"
+
+# Assuming CLIENT_CA contains both cert and key, split them
+csplit -f client- client.pem '/-----BEGIN.*PRIVATE KEY-----/' '{*}'
+mv client-00 cert.pem
+mv client-01 key.pem
+
+# Connect to the Percona KMIP Docker container and configure it
+CONTAINER_CMD="sudo podman"
+KMIP_DOCKER_NAME="kmip"
+
+# Create MySQL data directory
+${CONTAINER_CMD} exec -d "${KMIP_DOCKER_NAME}" sh -c 'mkdir -p /var/lib/mysql/testKMIP'
+
+# Start MySQL with KMIP configuration
+${CONTAINER_CMD} exec -d "${KMIP_DOCKER_NAME}" mysqld \
+    --datadir=/var/lib/mysql/testKMIP \
+    --early-plugin-load=keyring_kmip.so \
+    --keyring_kmip_server_name="${VAULT_ADDR}" \
+    --keyring_kmip_server_port="${KMIP_PORT}" \
+    --keyring_kmip_client_ca="${TEMP_DIR}/vault-ca.pem" \
+    --keyring_kmip_client_key="${TEMP_DIR}/key.pem" \
+    --keyring_kmip_client_cert="${TEMP_DIR}/cert.pem"
diff --git a/enos/modules/verify_secrets_engines/scripts/kmip/kmip-configure.sh b/enos/modules/verify_secrets_engines/scripts/kmip/kmip-configure.sh
new file mode 100644
index 00000000000..02247321381
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/kmip/kmip-configure.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+    echo "$1" 1>&2
+    exit 1
+}
+
+[[ -z "${MOUNT}" ]] && fail "MOUNT env variable has not been set"
+[[ -z "${KMIP_LISTEN_ADDR}" ]] && fail "KMIP_LISTEN_ADDR env variable has not been set"
+[[ -z "${KMIP_PORT}" ]] && fail "KMIP_PORT env variable has not been set"
+[[ -z "${VAULT_ADDR}" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "${VAULT_INSTALL_DIR}" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "${VAULT_TOKEN}" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "${binpath}" || fail "unable to locate vault binary at ${binpath}"
+
+export VAULT_FORMAT=json
+
+# Configure KMIP settings - redirect output to stderr to keep stdout clean
+"${binpath}" write "${MOUNT}/config" \
+    listen_addrs="${KMIP_LISTEN_ADDR}":"${KMIP_PORT}" \
+    server_hostnames="${VAULT_ADDR}" >&2
+
+# Read the CA certificate directly to stdout (no intermediate file needed)
+"${binpath}" read "${MOUNT}"/ca -format=json | jq -r '.data | .ca_pem'
diff --git a/enos/modules/verify_secrets_engines/scripts/kmip/kmip-generate-cert.sh b/enos/modules/verify_secrets_engines/scripts/kmip/kmip-generate-cert.sh
new file mode 100644
index 00000000000..45a7319f72f
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/kmip/kmip-generate-cert.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "${MOUNT}" ]] && fail "MOUNT env variable has not been set"
+[[ -z "${VAULT_ADDR}" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "${VAULT_INSTALL_DIR}" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "${VAULT_TOKEN}" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "${SCOPE_NAME}" ]] && fail "SCOPE_NAME env variable has not been set"
+[[ -z "${ROLE_NAME}" ]] && fail "ROLE_NAME env variable has not been set"
+[[ -z "${CERT_FORMAT}" ]] && fail "CERT_FORMAT env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "${binpath}" || fail "unable to locate vault binary at ${binpath}"
+
+export VAULT_FORMAT=json
+
+"${binpath}" write -format=json \
+    "${MOUNT}"/scope/"${SCOPE_NAME}"/role/"${ROLE_NAME}"/credential/generate \
+    format="${CERT_FORMAT}" > credential.json
+
+jq -r .data.certificate < credential.json > cert.pem
+jq -r .data.private_key < credential.json > key.pem
+
+cat cert.pem key.pem > client.pem
+cat client.pem
diff --git a/enos/modules/verify_secrets_engines/scripts/kv-put.sh b/enos/modules/verify_secrets_engines/scripts/kv-put.sh
new file mode 100644
index 00000000000..09c36aa2edb
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/kv-put.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$KEY" ]] && fail "KEY env variable has not been set"
+[[ -z "$MOUNT" ]] && fail "MOUNT env variable has not been set"
+[[ -z "$SECRET_PATH" ]] && fail "SECRET_PATH env variable has not been set"
+[[ -z "$VALUE" ]] && fail "VALUE env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+
+"$binpath" kv put -mount="$MOUNT" "$SECRET_PATH" "$KEY=$VALUE"
diff --git a/enos/modules/verify_secrets_engines/scripts/kv-verify-value.sh b/enos/modules/verify_secrets_engines/scripts/kv-verify-value.sh
new file mode 100644
index 00000000000..a138b6e8bc4
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/kv-verify-value.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$MOUNT" ]] && fail "MOUNT env variable has not been set"
+[[ -z "$SECRET_PATH" ]] && fail "SECRET_PATH env variable has not been set"
+[[ -z "$KEY" ]] && fail "KEY env variable has not been set"
+[[ -z "$VALUE" ]] && fail "VALUE env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+if res=$("$binpath" kv get -mount="$MOUNT" "$SECRET_PATH"); then
+  # Note that this expects KVv2 response payloads. KVv1 does not include doubly nested .data
+  if jq -Merc --arg VALUE "$VALUE" --arg KEY "$KEY" '.data.data[$KEY] == $VALUE' <<< "$res"; then
+    printf "kv %s/%s %s=%s is valid\n" "$MOUNT" "$SECRET_PATH" "$KEY" "$VALUE"
+    exit 0
+  fi
+  fail "kv $MOUNT/$SECRET_PATH $KEY=$VALUE invalid! Got: $(jq -Mrc --arg KEY "$KEY" '.data[$KEY]' <<< "$res")"
+else
+  fail "failed to read kv data for $MOUNT/$SECRET_PATH: $res"
+fi
diff --git a/enos/modules/verify_secrets_engines/scripts/ldap-configs.sh b/enos/modules/verify_secrets_engines/scripts/ldap-configs.sh
new file mode 100755
index 00000000000..567f6192ee6
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/ldap-configs.sh
@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$MOUNT" ]] && fail "MOUNT env variable has not been set"
+[[ -z "$LDAP_SERVER" ]] && fail "LDAP_SERVER env variable has not been set"
+[[ -z "$LDAP_PORT" ]] && fail "LDAP_PORT env variable has not been set"
+[[ -z "$LDAP_USERNAME" ]] && fail "LDAP_USERNAME env variable has not been set"
+[[ -z "$LDAP_ADMIN_PW" ]] && fail "LDAP_ADMIN_PW env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+
+echo "OpenLDAP: Checking for OpenLDAP Server Connection: ${LDAP_SERVER}:${LDAP_PORT}"
+ldapsearch -x -H "ldap://${LDAP_SERVER}:${LDAP_PORT}" -b "dc=${LDAP_USERNAME},dc=com" -D "cn=admin,dc=${LDAP_USERNAME},dc=com" -w "${LDAP_ADMIN_PW}"
+
+# Creating Users Org Unit LDIF file and adding users organizational unit
+echo "OpenLDAP: Creating Users Org Unit LDIF file and adding users organizational unit"
+GROUP_LDIF="group.ldif"
+cat << EOF > ${GROUP_LDIF}
+dn: ou=users,dc=$LDAP_USERNAME,dc=com
+objectClass: organizationalUnit
+ou: users
+
+dn: ou=groups,dc=$LDAP_USERNAME,dc=com
+objectClass: organizationalUnit
+ou: groups
+EOF
+ldapadd -x -H "ldap://${LDAP_SERVER}:${LDAP_PORT}" -D "cn=admin,dc=${LDAP_USERNAME},dc=com" -w "${LDAP_ADMIN_PW}" -f ${GROUP_LDIF}
+
+echo "OpenLDAP: Creating User LDIF file and adding user to LDAP"
+USER_LDIF="user.ldif"
+cat << EOF > ${USER_LDIF}
+# User: enos
+dn: uid=$LDAP_USERNAME,ou=users,dc=$LDAP_USERNAME,dc=com
+objectClass: inetOrgPerson
+sn: $LDAP_USERNAME
+cn: $LDAP_USERNAME user
+uid: $LDAP_USERNAME
+userPassword: $LDAP_ADMIN_PW
+
+# Group: devs
+dn: cn=devs,ou=groups,dc=$LDAP_USERNAME,dc=com
+objectClass: groupOfNames
+cn: devs
+member: uid=$LDAP_USERNAME,ou=users,dc=$LDAP_USERNAME,dc=com
+EOF
+ldapadd -x -H "ldap://${LDAP_SERVER}:${LDAP_PORT}" -D "cn=admin,dc=${LDAP_USERNAME},dc=com" -w "${LDAP_ADMIN_PW}" -f ${USER_LDIF}
+
+echo "Vault: Creating ldap auth and creating auth/ldap/config route"
+"$binpath" auth enable "${MOUNT}" > /dev/null 2>&1 || echo "Warning: Vault ldap auth already enabled"
+"$binpath" write "auth/${MOUNT}/config" \
+  url="ldap://test_${LDAP_SERVER}:${LDAP_PORT}" \
+  binddn="cn=admin,dc=${LDAP_USERNAME},dc=com" \
+  bindpass="${LDAP_ADMIN_PW}" \
+  userdn="ou=users,dc=${LDAP_USERNAME},dc=com" \
+  userattr="uid" \
+  groupdn="ou=groups,dc=${LDAP_USERNAME},dc=com" \
+  groupfilter="(&(objectClass=groupOfNames)(member={{.UserDN}}))" \
+  groupattr="cn" \
+  insecure_tls=true
+
+echo "Vault: Updating ldap auth and creating auth/ldap/config route"
+"$binpath" write "auth/${MOUNT}/config" \
+  url="ldap://${LDAP_SERVER}:${LDAP_PORT}" \
+  binddn="cn=admin,dc=${LDAP_USERNAME},dc=com" \
+  bindpass="${LDAP_ADMIN_PW}" \
+  userdn="ou=users,dc=${LDAP_USERNAME},dc=com" \
+  userattr="uid" \
+  groupdn="ou=groups,dc=${LDAP_USERNAME},dc=com" \
+  groupfilter="(&(objectClass=groupOfNames)(member={{.UserDN}}))" \
+  groupattr="cn" \
+  insecure_tls=true
+
+echo "Vault: Creating Vault Policy for LDAP and assigning user to policy"
+VAULT_LDAP_POLICY="ldap_reader.hcl"
+cat << EOF > ${VAULT_LDAP_POLICY}
+path "secret/data/*" {
+  capabilities = ["read", "list"]
+}
+EOF
+LDAP_READER_POLICY="reader-policy"
+"$binpath" policy write ${LDAP_READER_POLICY} "${VAULT_LDAP_POLICY}"
+"$binpath" write "auth/${MOUNT}/users/${LDAP_USERNAME}" policies="${LDAP_READER_POLICY}"
+
+echo "Vault: Creating Vault Policy for LDAP DEV and assigning user to policy"
+VAULT_LDAP_DEV_POLICY="ldap_dev.hcl"
+cat << EOF > ${VAULT_LDAP_DEV_POLICY}
+path "secret/data/dev/*" {
+  capabilities = ["read", "list"]
+}
+EOF
+LDAP_DEV_POLICY="dev-policy"
+"$binpath" policy write ${LDAP_DEV_POLICY} "${VAULT_LDAP_DEV_POLICY}"
+"$binpath" write "auth/${MOUNT}/groups/devs" policies="${LDAP_DEV_POLICY}"
diff --git a/enos/modules/verify_secrets_engines/scripts/ldap-verify-configs b/enos/modules/verify_secrets_engines/scripts/ldap-verify-configs
new file mode 100644
index 00000000000..d0bfa923cb7
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/ldap-verify-configs
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$MOUNT" ]] && fail "MOUNT env variable has not been set"
+[[ -z "$LDAP_SERVER" ]] && fail "LDAP_SERVER env variable has not been set"
+[[ -z "$LDAP_PORT" ]] && fail "LDAP_PORT env variable has not been set"
+[[ -z "$LDAP_USERNAME" ]] && fail "LDAP_USERNAME env variable has not been set"
+[[ -z "$LDAP_ADMIN_PW" ]] && fail "LDAP_ADMIN_PW env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+
+# Verifying LDAP Server Configs
+LDAP_UID=$(ldapsearch -x -LLL -H "ldap://${LDAP_SERVER}:${LDAP_PORT}" -b "dc=${LDAP_USERNAME},dc=com" -D "cn=admin,dc=${LDAP_USERNAME},dc=com" -w "${LDAP_ADMIN_PW}" "(uid=${LDAP_USERNAME})" 2>/dev/null)
+[[ -z "$LDAP_UID" ]] && fail "Could not search ldap server for uid: ${LDAP_USERNAME}"
+
+# Authenticate Using Vault LDAP login
+VAULT_LDAP_LOGIN=$("$binpath" login -method=${MOUNT} username=${LDAP_USERNAME} password=${LDAP_ADMIN_PW})
+
+# Verifying Vault LDAP Login Token
+VAULT_LDAP_TOKEN=$(echo $VAULT_LDAP_LOGIN | jq -r ".auth.client_token")
+[[ -z "$VAULT_LDAP_TOKEN" ]] && fail "Vault LDAP could not log in correctly: ${VAULT_LDAP_TOKEN}"
+
+# Verifying Vault LDAP Policies
+VAULT_POLICY_COUNT=$(echo $VAULT_LDAP_LOGIN | jq -r ".auth.policies | length")
+[[ -z "$VAULT_POLICY_COUNT" ]] && fail "Vault LDAP number of policies does not look correct: ${VAULT_POLICY_COUNT}"
+
+echo "${VAULT_LDAP_LOGIN}"
diff --git a/enos/modules/verify_secrets_engines/scripts/list.sh b/enos/modules/verify_secrets_engines/scripts/list.sh
new file mode 100644
index 00000000000..871642e0a05
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/list.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$REQPATH" ]] && fail "REQPATH env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+"$binpath" list "$REQPATH"
diff --git a/enos/modules/verify_secrets_engines/scripts/pki-issue-certificates.sh b/enos/modules/verify_secrets_engines/scripts/pki-issue-certificates.sh
new file mode 100755
index 00000000000..f1b5ce57ee3
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/pki-issue-certificates.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$MOUNT" ]] && fail "MOUNT env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$COMMON_NAME" ]] && fail "COMMON_NAME env variable has not been set"
+[[ -z "$ISSUER_NAME" ]] && fail "ISSUER_NAME env variable has not been set"
+[[ -z "$TTL" ]] && fail "TTL env variable has not been set"
+[[ -z "$TEST_DIR" ]] && fail "TEST_DIR env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+export VAULT_FORMAT=json
+
+# ------ Generate and sign certificate ------
+CA_NAME="${MOUNT}-ca.pem"
+ISSUED_CERT_NAME="${MOUNT}-issued.pem"
+ROLE_NAME="${COMMON_NAME}-role"
+SUBJECT="test.${COMMON_NAME}"
+TMP_TTL="1h"
+rm -rf "${TEST_DIR}"
+mkdir "${TEST_DIR}"
+
+## Setting AIA fields for Certificate
+"$binpath" write "${MOUNT}/config/urls" issuing_certificates="${VAULT_ADDR}/v1/pki/ca" crl_distribution_points="${VAULT_ADDR}/v1/pki/crl"
+
+# Generating CA Certificate
+"$binpath" write "${MOUNT}/root/generate/internal" common_name="${COMMON_NAME}.com" issuer_name="${ISSUER_NAME}" ttl="${TTL}" | jq -r '.data.issuing_ca' > "${TEST_DIR}/${CA_NAME}"
+# Creating a role
+"$binpath" write "${MOUNT}/roles/${ROLE_NAME}" allowed_domains="${COMMON_NAME}.com" allow_subdomains=true max_ttl="${TMP_TTL}"
+# Issuing Signed Certificate
+"$binpath" write "${MOUNT}/issue/${ROLE_NAME}" common_name="${SUBJECT}.com" ttl="${TMP_TTL}" | jq -r '.data.certificate' > "${TEST_DIR}/${ISSUED_CERT_NAME}"
+
+# ------ Generate and sign intermediate ------
+INTERMEDIATE_COMMON_NAME="intermediate-${COMMON_NAME}"
+INTERMEDIATE_ISSUER_NAME="intermediate-${ISSUER_NAME}"
+INTERMEDIATE_ROLE_NAME="intermediate-${COMMON_NAME}-role"
+INTERMEDIATE_CA_NAME="${MOUNT}-${INTERMEDIATE_COMMON_NAME}.pem"
+INTERMEDIATE_SIGNED_NAME="${MOUNT}-${INTERMEDIATE_COMMON_NAME}-ca.pem"
+INTERMEDIATE_ISSUED_NAME="${MOUNT}-${INTERMEDIATE_COMMON_NAME}-issued.pem"
+
+# Generate Intermediate CSR
+"$binpath" write "${MOUNT}/intermediate/generate/internal" common_name="${INTERMEDIATE_COMMON_NAME}.com" issuer_name="${INTERMEDIATE_ISSUER_NAME}" ttl="${TTL}" | jq -r '.data.csr' > "${TEST_DIR}/${INTERMEDIATE_CA_NAME}"
+# Creating a intermediate role
+"$binpath" write "${MOUNT}/roles/${INTERMEDIATE_ROLE_NAME}" allowed_domains="${INTERMEDIATE_COMMON_NAME}.com" allow_subdomains=true max_ttl="${TMP_TTL}"
+# Sign Intermediate Certificate
+"$binpath" write "${MOUNT}/root/sign-intermediate" csr="@${TEST_DIR}/${INTERMEDIATE_CA_NAME}" format=pem_bundle ttl="${TMP_TTL}" | jq -r '.data.certificate' > "${TEST_DIR}/${INTERMEDIATE_SIGNED_NAME}"
+# Import Signed Intermediate Certificate into Vault
+"$binpath" write "${MOUNT}/intermediate/set-signed" certificate="@${TEST_DIR}/${INTERMEDIATE_SIGNED_NAME}"
+# Issuing Signed Certificate with the intermediate role
+"$binpath" write "${MOUNT}/issue/${INTERMEDIATE_ROLE_NAME}" common_name="www.${INTERMEDIATE_COMMON_NAME}.com" ttl="${TMP_TTL}" | jq -r '.data.certificate' > "${TEST_DIR}/${INTERMEDIATE_ISSUED_NAME}"
diff --git a/enos/modules/verify_secrets_engines/scripts/pki-verify-certificates.sh b/enos/modules/verify_secrets_engines/scripts/pki-verify-certificates.sh
new file mode 100755
index 00000000000..e8a8979b908
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/pki-verify-certificates.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$AUTH_PATH" ]] && fail "AUTH_PATH env variable has not been set"
+[[ -z "$USERNAME" ]] && fail "USERNAME env variable has not been set"
+[[ -z "$PASSWORD" ]] && fail "PASSWORD env variable has not been set"
+[[ -z "$VERIFY_PKI_CERTS" ]] && fail "VERIFY_CERT_DETAILS env variable has not been set"
+[[ -z "$MOUNT" ]] && fail "MOUNT env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$COMMON_NAME" ]] && fail "COMMON_NAME env variable has not been set"
+[[ -z "$ISSUER_NAME" ]] && fail "ISSUER_NAME env variable has not been set"
+[[ -z "$TTL" ]] && fail "TTL env variable has not been set"
+[[ -z "$TEST_DIR" ]] && fail "TEST_DIR env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath" || fail "The certificate appears to be improperly configured or contains errors"
+export VAULT_FORMAT=json
+
+# Log in so this vault instance have access to the primary pki roles, issuers, and etc
+if [ "${VERIFY_PKI_CERTS}" = false ]; then
+  echo "Logging in Vault with username and password: ${USERNAME}"
+  VAULT_TOKEN=$("$binpath" write "auth/$AUTH_PATH/login/$USERNAME" password="$PASSWORD" | jq -r '.auth.client_token')
+fi
+
+# Verifying List Roles
+ROLE=$("$binpath" list "${MOUNT}/roles" | jq -r '.[]')
+[[ -z "$ROLE" ]] && fail "No roles created!"
+
+# Verifying List Issuer
+ISSUER=$("$binpath" list "${MOUNT}/issuers" | jq -r '.[]')
+[[ -z "$ISSUER" ]] && fail "No issuers created!"
+
+# Verifying Root CA Certificate
+ROOT_CA_CERT=$("$binpath" read pki/cert/ca | jq -r '.data.certificate')
+[[ -z "$ROOT_CA_CERT" ]] && fail "No root ca certificate generated"
+
+# Verifying Certificates
+if [ "${VERIFY_PKI_CERTS}" = true ]; then
+  if [ ! -d "${TEST_DIR}" ]; then
+    echo "Directory does not exist. Creating it now."
+    mkdir -p "${TEST_DIR}" # Need to create this directory for Enterprise test
+  fi
+  TMP_FILE="tmp-vault-cert.pem"
+
+  # Verify List Certificate
+  VAULT_CERTS=$("$binpath" list "${MOUNT}/certs" | jq -r '.[]')
+  [[ -z "$VAULT_CERTS" ]] && fail "VAULT_CERTS should include vault certificates"
+  for CERT in $VAULT_CERTS; do
+    echo "Getting certificate from Vault PKI: ${CERT}"
+    "$binpath" read "${MOUNT}/cert/${CERT}" | jq -r '.data.certificate' > "${TEST_DIR}/${TMP_FILE}"
+    echo "Verifying certificate contents..."
+    openssl x509 -in "${TEST_DIR}/${TMP_FILE}" -text -noout || fail "The certificate appears to be improperly configured or contains errors"
+    CURR_CERT_SERIAL=$(echo "${CERT}" | tr -d ':' | tr '[:lower:]' '[:upper:]')
+    if ! TMP_CERT_SUBJECT=$(openssl x509 -in "${TEST_DIR}/${TMP_FILE}" -noout -subject | cut -d '=' -f2-); then
+      fail "failed to read certificate subject: $TMP_CERT_SUBJECT"
+    fi
+    TMP_CERT_ISSUER=$(openssl x509 -in "${TEST_DIR}/${TMP_FILE}" -noout -issuer | cut -d '=' -f2-)
+    TMP_CERT_SERIAL=$(openssl x509 -in "${TEST_DIR}/${TMP_FILE}" -noout -serial | cut -d '=' -f2-)
+    [[ "${TMP_CERT_SUBJECT}" == *"${COMMON_NAME}.com"* ]] || fail "Subject is incorrect. Actual Subject: ${TMP_CERT_SUBJECT}"
+    [[ "${TMP_CERT_ISSUER}" == *"${COMMON_NAME}.com"* ]] || fail "Issuer is incorrect. Actual Issuer: ${TMP_CERT_ISSUER}"
+    [[ "${TMP_CERT_SERIAL}" == *"${CURR_CERT_SERIAL}"* ]] || fail "Certificate Serial is incorrect. Actual certificate Serial: ${CURR_CERT_SERIAL},${TMP_CERT_SERIAL}"
+    echo "Successfully verified certificate contents."
+
+    # Setting up variables for types of certificates
+    IS_CA=$(openssl x509 -in "${TEST_DIR}/${TMP_FILE}" -text -noout | grep -q "CA:TRUE" && echo "TRUE" || echo "FALSE")
+    if [[ "${IS_CA}" == "TRUE" ]]; then
+      if [[ "${COMMON_NAME}.com" == "${TMP_CERT_SUBJECT}" ]]; then
+        CA_CERT=${CERT}
+      elif [[ "intermediate-${COMMON_NAME}.com" == "${TMP_CERT_SUBJECT}" ]]; then
+        INTERMEDIATE_CA_CERT=${CERT}
+      fi
+    elif [[ "${IS_CA}" == "FALSE" ]]; then
+      INTERMEDIATE_ISSUED_CERT=${CERT}
+    fi
+
+  done
+
+  echo "Verifying that Vault PKI has successfully generated valid certificates for the CA, Intermediate CA, and issued certificates..."
+  if [[ -n "${CA_CERT}" ]] && [[ -n "${INTERMEDIATE_CA_CERT}" ]] && [[ -n "${INTERMEDIATE_ISSUED_CERT}" ]]; then
+    CA_NAME="ca.pem"
+    INTERMEDIATE_CA_NAME="intermediate-ca.pem"
+    ISSUED_NAME="issued.pem"
+    "$binpath" read "${MOUNT}/cert/${CA_CERT}" | jq -r '.data.certificate' > "${TEST_DIR}/${CA_NAME}"
+    "$binpath" read "${MOUNT}/cert/${INTERMEDIATE_CA_CERT}" | jq -r '.data.certificate' > "${TEST_DIR}/${INTERMEDIATE_CA_NAME}"
+    "$binpath" read "${MOUNT}/cert/${INTERMEDIATE_ISSUED_CERT}" | jq -r '.data.certificate' > "${TEST_DIR}/${ISSUED_NAME}"
+    openssl verify --CAfile "${TEST_DIR}/${CA_NAME}" -untrusted "${TEST_DIR}/${INTERMEDIATE_CA_NAME}" "${TEST_DIR}/${ISSUED_NAME}" || fail "One or more Certificate is not valid."
+  else
+    echo "CA Cert: ${CA_CERT}, Intermedidate Cert: ${INTERMEDIATE_CA_CERT}, Issued Cert: ${INTERMEDIATE_ISSUED_CERT}"
+  fi
+
+  echo "Revoking certificate: ${INTERMEDIATE_ISSUED_CERT}"
+  "$binpath" write "${MOUNT}/revoke" serial_number="${INTERMEDIATE_ISSUED_CERT}" || fail "Could not revoke certificate ${INTERMEDIATE_ISSUED_CERT}"
+  echo "Verifying Revoked Certificate"
+  REVOKED_CERT_FROM_LIST=$("$binpath" list "${MOUNT}/certs/revoked" | jq -r '.[0]')
+  [[ "${INTERMEDIATE_ISSUED_CERT}" == "${REVOKED_CERT_FROM_LIST}" ]] || fail "Expected: ${INTERMEDIATE_ISSUED_CERT}, actual: ${REVOKED_CERT_FROM_LIST}"
+  echo "Successfully verified revoked certificate"
+else
+  echo "Skipping verify certificates!"
+fi
diff --git a/enos/modules/verify_secrets_engines/scripts/policy-write.sh b/enos/modules/verify_secrets_engines/scripts/policy-write.sh
new file mode 100644
index 00000000000..d0ebb2804a7
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/policy-write.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$POLICY_NAME" ]] && fail "POLICY_NAME env variable has not been set"
+[[ -z "$POLICY_CONFIG" ]] && fail "POLICY_CONFIG env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+"$binpath" policy write "$POLICY_NAME" - <<< "$POLICY_CONFIG"
diff --git a/enos/modules/verify_secrets_engines/scripts/read.sh b/enos/modules/verify_secrets_engines/scripts/read.sh
new file mode 100644
index 00000000000..52807ff3dba
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/read.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$REQPATH" ]] && fail "REQPATH env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+"$binpath" read "$REQPATH"
diff --git a/enos/modules/verify_secrets_engines/scripts/secrets-enable.sh b/enos/modules/verify_secrets_engines/scripts/secrets-enable.sh
new file mode 100644
index 00000000000..697fb586fb4
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/secrets-enable.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "$MOUNT" ]] && fail "MOUNT env variable has not been set"
+[[ -z "$ENGINE" ]] && fail "MOUNT env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+eval "$binpath" secrets enable -path="$MOUNT" "$SECRETS_META" "$ENGINE"
diff --git a/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-ca.sh b/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-ca.sh
new file mode 100644
index 00000000000..ea5e943c06a
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-ca.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+log() {
+  echo "[DEBUG] $1" >&2
+}
+
+[[ -z "$VERIFY_SSH_SECRETS" ]] && fail "VERIFY_SSH_SECRETS env variable has not been set"
+[[ -z "$CA_KEY_TYPE" ]] && fail "CA_KEY_TYPE env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+
+if [[ "$VERIFY_SSH_SECRETS" == "false" ]]; then
+  log "VERIFY_SSH_SECRETS is false; exiting script"
+  exit 0
+fi
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+
+# Read the SSH CA configuration from Vault
+if ! ca_output=$("$binpath" read "ssh/config/ca" 2>&1); then
+  fail "failed to read ssh/config/ca: $ca_output"
+fi
+
+# Extract the CA public key
+ca_public_key=$(jq -r '.data.public_key' <<< "$ca_output")
+
+# Extract the first word (key type) from the public key
+key_type=$(awk '{print $1}' <<< "$ca_public_key")
+
+# Verify that the key type matches the expected key type
+if [[ "$key_type" != "$CA_KEY_TYPE" ]]; then
+  fail "CA key type mismatch: expected $CA_KEY_TYPE, got $key_type"
+fi
diff --git a/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-otp.sh b/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-otp.sh
new file mode 100644
index 00000000000..0145b1f54f0
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-otp.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+log() {
+  echo "[DEBUG] $1" >&2
+}
+
+[[ -z "$VERIFY_SSH_SECRETS" ]] && fail "VERIFY_SSH_SECRETS env variable has not been set"
+[[ -z "$IP" ]] && fail "IP env variable has not been set"
+[[ -z "$USERNAME" ]] && fail "USERNAME env variable has not been set"
+[[ -z "$ROLE_NAME" ]] && fail "ROLE_NAME env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+
+if [[ "$VERIFY_SSH_SECRETS" == "false" ]]; then
+  log "VERIFY_SSH_SECRETS is false; exiting script"
+  exit 0
+fi
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+
+log "Generating OTP credential from Vault"
+otp_cred=$("$binpath" write -format=json "ssh/creds/$ROLE_NAME" ip="$IP" username="$USERNAME") \
+  || fail "Failed to generate OTP credential"
+
+OTP=$(jq -r '.data.key' <<< "$otp_cred")
+log "Generated OTP: $OTP"
+
+log "Verifying OTP"
+otp_output=$("$binpath" write -format=json ssh/verify otp="$OTP") \
+  || fail "Failed to verify OTP credential for key $OTP"
+
+log "OTP Verification successful"
+ip=$(jq -r '.data.ip' <<< "$otp_output")
+role_name=$(jq -r '.data.role_name' <<< "$otp_output")
+username=$(jq -r '.data.username' <<< "$otp_output")
+
+log "IP: $ip"
+log "Role Name: $role_name"
+log "Username: $username"
+
+[[ "$ip" != "$IP" ]] && fail "IP mismatch: expected $ip, got $IP"
+[[ "$role_name" != "$ROLE_NAME" ]] && fail "Role name mismatch: expected $role_name, got $ROLE_NAME"
+[[ "$username" != "$USERNAME" ]] && fail "Username mismatch: expected $username, got $USERNAME"
+
+log "Completed with no mismatches"
diff --git a/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-role.sh b/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-role.sh
new file mode 100644
index 00000000000..9ce25ee15bc
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-role.sh
@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+normalize_ttl() {
+  case "$1" in
+    null | "") echo 0 ;;
+    *h) echo $((${1%h} * 3600))   ;;
+    *m) echo $((${1%m} * 60))   ;;
+    *s) echo $((${1%s}))   ;;
+    *) echo "$1" ;; # assume already in seconds
+  esac
+}
+
+log() {
+  echo "[DEBUG] $1" >&2
+}
+
+log "Starting env var checks"
+
+# Common required vars
+[[ -z "$VERIFY_SSH_SECRETS" ]] && fail "VERIFY_SSH_SECRETS env variable has not been set"
+[[ -z "$ROLE_NAME" ]] && fail "ROLE_NAME env variable has not been set"
+[[ -z "$KEY_TYPE" ]] && fail "KEY_TYPE env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+
+# Always required for both types
+[[ -z "$DEFAULT_USER" ]] && fail "DEFAULT_USER env variable has not been set"
+[[ -z "$ALLOWED_USERS" ]] && fail "ALLOWED_USERS env variable has not been set"
+
+if [[ "$VERIFY_SSH_SECRETS" == "false" ]]; then
+  log "VERIFY_SSH_SECRETS is false; exiting script"
+  exit 0
+fi
+
+# Type-specific required vars
+case "$KEY_TYPE" in
+  otp)
+    [[ -z "$PORT" ]] && fail "PORT env variable has not been set"
+    [[ -z "$CIDR_LIST" ]] && fail "CIDR_LIST env variable has not been set"
+    [[ -z "$EXCLUDE_CIDR_LIST" ]] && fail "EXCLUDE_CIDR_LIST env variable has not been set"
+    ;;
+  ca)
+    [[ -z "$TTL" ]] && fail "TTL env variable has not been set"
+    [[ -z "$MAX_TTL" ]] && fail "MAX_TTL env variable has not been set"
+    [[ -z "$KEY_ID_FORMAT" ]] && fail "KEY_ID_FORMAT env variable has not been set"
+    [[ -z "$ALLOW_USER_CERTIFICATES" ]] && fail "ALLOW_USER_CERTIFICATES env variable has not been set"
+    [[ -z "$ALLOW_HOST_CERTIFICATES" ]] && fail "ALLOW_HOST_CERTIFICATES env variable has not been set"
+    [[ -z "$ALLOW_USER_KEY_IDS" ]] && fail "ALLOW_USER_KEY_IDS env variable has not been set"
+    [[ -z "$ALLOW_EMPTY_PRINCIPALS" ]] && fail "ALLOW_EMPTY_PRINCIPALS env variable has not been set"
+    [[ -z "$ALGORITHM_SIGNER" ]] && fail "ALGORITHM_SIGNER env variable has not been set"
+    ;;
+  *)
+    fail "Unsupported KEY_TYPE in env check: $KEY_TYPE"
+    ;;
+esac
+
+log "finished env var checks"
+
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "$binpath" || fail "unable to locate vault binary at $binpath"
+
+export VAULT_FORMAT=json
+if ! output=$("$binpath" read "ssh/roles/$ROLE_NAME" 2>&1); then
+  fail "failed to read ssh/roles/$ROLE_NAME: $output"
+fi
+
+log "Successfully read role $ROLE_NAME"
+
+key_type=$(jq -r '.data.key_type' <<< "$output")
+default_user=$(jq -r '.data.default_user' <<< "$output")
+allowed_users=$(jq -r '.data.allowed_users' <<< "$output")
+
+log "extracted common data"
+
+case "$KEY_TYPE" in
+  otp)
+    port=$(jq -r '.data.port' <<< "$output")
+    cidr_list=$(jq -r '.data.cidr_list' <<< "$output")
+    exclude_cidr_list=$(jq -r '.data.exclude_cidr_list' <<< "$output")
+    log "extracted otp specific data"
+    ;;
+  ca)
+    ttl=$(jq -r '.data.ttl' <<< "$output")
+    max_ttl=$(jq -r '.data.max_ttl' <<< "$output")
+    key_id_format=$(jq -r '.data.key_id_format' <<< "$output")
+    allow_user_certificates=$(jq -r '.data.allow_user_certificates' <<< "$output")
+    allow_host_certificates=$(jq -r '.data.allow_host_certificates' <<< "$output")
+    allow_user_key_ids=$(jq -r '.data.allow_user_key_ids' <<< "$output")
+    allow_empty_principals=$(jq -r '.data.allow_empty_principals' <<< "$output")
+    algorithm_signer=$(jq -r '.data.algorithm_signer' <<< "$output")
+    log "extracted ca specific data"
+    ;;
+  *)
+    fail "Unsupported KEY_TYPE: $KEY_TYPE"
+    ;;
+esac
+
+# Verify
+[[ "$key_type" != "$KEY_TYPE" ]] && fail "Key type mismatch: expected $KEY_TYPE, got $key_type"
+[[ "$default_user" != "$DEFAULT_USER" ]] && fail "Default user mismatch: expected $DEFAULT_USER, got $default_user"
+[[ "$allowed_users" != "$ALLOWED_USERS" ]] && fail "Allowed users mismatch: expected $ALLOWED_USERS, got $allowed_users"
+
+log "verified common data"
+
+case "$KEY_TYPE" in
+  otp)
+    [[ "$port" != "$PORT" ]] && fail "Port mismatch: expected $PORT, got $port"
+    [[ "$cidr_list" != "$CIDR_LIST" ]] && fail "CIDR list mismatch: expected $CIDR_LIST, got $cidr_list"
+    [[ "$exclude_cidr_list" != "$EXCLUDE_CIDR_LIST" ]] && fail "Exclude CIDR list mismatch: expected $EXCLUDE_CIDR_LIST, got $exclude_cidr_list"
+    log "verified otp specific data"
+    ;;
+  ca)
+    [[ "$(normalize_ttl "$ttl")" != "$(normalize_ttl "$TTL")" ]] && fail "TTL mismatch: expected $TTL, got $ttl"
+    [[ "$(normalize_ttl "$max_ttl")" != "$(normalize_ttl "$MAX_TTL")" ]] && fail "Max TTL mismatch: expected $MAX_TTL, got $max_ttl"
+    [[ "$key_id_format" != "$KEY_ID_FORMAT" ]] && fail "Key ID format mismatch: expected $KEY_ID_FORMAT, got $key_id_format"
+    [[ "$allow_user_certificates" != "$ALLOW_USER_CERTIFICATES" ]] && fail "Allow user certificates mismatch: expected $ALLOW_USER_CERTIFICATES, got $allow_user_certificates"
+    [[ "$allow_host_certificates" != "$ALLOW_HOST_CERTIFICATES" ]] && fail "Allow host certificates mismatch: expected $ALLOW_HOST_CERTIFICATES, got $allow_host_certificates"
+    [[ "$allow_user_key_ids" != "$ALLOW_USER_KEY_IDS" ]] && fail "Allow user key IDs mismatch: expected $ALLOW_USER_KEY_IDS, got $allow_user_key_ids"
+    [[ "$allow_empty_principals" != "$ALLOW_EMPTY_PRINCIPALS" ]] && fail "Allow empty principals mismatch: expected $ALLOW_EMPTY_PRINCIPALS, got $allow_empty_principals"
+    [[ "$algorithm_signer" != "$ALGORITHM_SIGNER" ]] && fail "Algorithm signer mismatch: expected $ALGORITHM_SIGNER, got $algorithm_signer"
+    log "verified ca specific data"
+    ;;
+  *)
+    fail "Unsupported KEY_TYPE in verification: $KEY_TYPE"
+    ;;
+esac
diff --git a/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-signed-key.sh b/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-signed-key.sh
new file mode 100644
index 00000000000..0812fc95b82
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/ssh/ssh-verify-signed-key.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+log() {
+  echo "[DEBUG] $1" >&2
+}
+
+[[ -z "$VERIFY_SSH_SECRETS" ]] && fail "VERIFY_SSH_SECRETS env variable has not been set"
+[[ -z "$SIGNED_KEY" ]] && fail "SIGNED_KEY env variable has not been set"
+[[ -z "$KEY_TYPE" ]] && fail "KEY_TYPE env variable has not been set"
+[[ -z "$VAULT_ADDR" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "$VAULT_TOKEN" ]] && fail "VAULT_TOKEN env variable has not been set"
+[[ -z "$VAULT_INSTALL_DIR" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+
+if [[ "$VERIFY_SSH_SECRETS" == "false" ]]; then
+  log "VERIFY_SSH_SECRETS is false; exiting script"
+  exit 0
+fi
+
+SIGNED_KEY_PATH=$(mktemp)
+trap 'rm -f "$SIGNED_KEY_PATH"' EXIT
+echo "$SIGNED_KEY" > "$SIGNED_KEY_PATH"
+
+# Inspect the signed key
+if ! ssh_key_info=$(ssh-keygen -Lf "$SIGNED_KEY_PATH"); then
+  fail "Failed to verify signed SSH key"
+fi
+
+# Extract key type
+key_type=$(echo "$ssh_key_info" | grep "Type:" | awk '{print $2}')
+if [[ "$key_type" != *"$KEY_TYPE"* ]]; then
+  fail "Key type mismatch: expected $KEY_TYPE, got $key_type"
+fi
diff --git a/enos/modules/verify_secrets_engines/scripts/write.sh b/enos/modules/verify_secrets_engines/scripts/write.sh
new file mode 100644
index 00000000000..a7bef455b65
--- /dev/null
+++ b/enos/modules/verify_secrets_engines/scripts/write.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+set -e
+
+fail() {
+  echo "$1" 1>&2
+  exit 1
+}
+
+[[ -z "${REQPATH}" ]] && fail "REQPATH env variable has not been set"
+[[ -z "${VAULT_ADDR}" ]] && fail "VAULT_ADDR env variable has not been set"
+[[ -z "${VAULT_INSTALL_DIR}" ]] && fail "VAULT_INSTALL_DIR env variable has not been set"
+[[ -z "${VAULT_TOKEN}" ]] && fail "VAULT_TOKEN env variable has not been set"
+
+# PAYLOAD is optional - if not set or empty, use -f flag instead
+binpath=${VAULT_INSTALL_DIR}/vault
+test -x "${binpath}" || fail "unable to locate vault binary at ${binpath}"
+
+export VAULT_FORMAT=json
+
+# Check if PAYLOAD is empty or unset
+if [[ -z "${PAYLOAD}" ]]; then
+  # Use -f flag for empty payload (force write without data)
+  if output=$("${binpath}" write -f "${REQPATH}" 2>&1); then
+    printf "%s\n" "${output}"
+  else
+    fail "failed to write with empty payload: path=${REQPATH} out=${output}"
+  fi
+else
+  # Use original logic with payload data
+  if output=$("${binpath}" write "${REQPATH}" - <<< "${PAYLOAD}" 2>&1); then
+    printf "%s\n" "${output}"
+  else
+    fail "failed to write payload: path=${REQPATH} payload=${PAYLOAD} out=${output}"
+  fi
+fi
diff --git a/go.mod b/go.mod
index c45e9fd587f..3db31caa657 100644
--- a/go.mod
+++ b/go.mod
@@ -10,9 +10,7 @@ module github.com/hashicorp/vault
 // semantic related to Go module handling), this comment should be updated to explain that.
 //
 // Whenever this value gets updated, sdk/go.mod should be updated to the same value.
-go 1.21
-
-toolchain go1.21.7
+go 1.25.1
 
 replace github.com/hashicorp/vault/api => ./api
 
@@ -24,88 +22,90 @@ replace github.com/hashicorp/vault/api/auth/userpass => ./api/auth/userpass
 
 replace github.com/hashicorp/vault/sdk => ./sdk
 
-// This tag has since been deleted, but it's referenced by sentinel, so we use a replace directive
-// so that the build works and Go does not complain. Note that while an IDE may say that this is an
-// unused dependency, removing this will cause `go list -m all` to fail.
-replace rsc.io/script v0.0.0-00010101000000-000000000000 => rsc.io/script v0.0.2-0.20231205190631-334f6c18cff3
+// The keyring library has an outstanding bug that causes zombie dbus-daemon
+// processes on each execution. Vault has an indirect dependency on keyring via
+// gosnowflake. This replace is a stopgap measure until either gosnowflake or
+// keyring addresses the issue.
+// See https://github.com/99designs/keyring/issues/103 and https://github.com/snowflakedb/gosnowflake/issues/1183
+replace github.com/99designs/keyring => github.com/Jeffail/keyring v1.2.3
 
 require (
 	cloud.google.com/go/cloudsqlconn v1.4.3
-	cloud.google.com/go/monitoring v1.17.0
-	cloud.google.com/go/spanner v1.55.0
-	cloud.google.com/go/storage v1.36.0
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.1
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1
+	cloud.google.com/go/monitoring v1.24.2
+	cloud.google.com/go/spanner v1.85.1
+	cloud.google.com/go/storage v1.56.1
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.12.0
 	github.com/Azure/azure-storage-blob-go v0.15.0
 	github.com/Azure/go-autorest/autorest v0.11.29
-	github.com/Azure/go-autorest/autorest/adal v0.9.23
-	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371
-	github.com/SAP/go-hdb v0.14.1
+	github.com/Azure/go-autorest/autorest/adal v0.9.24
+	github.com/ProtonMail/go-crypto v1.2.0
+	github.com/ProtonMail/gopenpgp/v3 v3.2.1
+	github.com/SAP/go-hdb v1.10.1
 	github.com/Sectorbob/mlab-ns2 v0.0.0-20171030222938-d3aa0c295a8a
 	github.com/aerospike/aerospike-client-go/v5 v5.6.0
-	github.com/aliyun/alibaba-cloud-sdk-go v1.62.676
+	github.com/aliyun/alibaba-cloud-sdk-go v1.63.107
 	github.com/aliyun/aliyun-oss-go-sdk v0.0.0-20190307165228-86c17b95fcd5
 	github.com/apple/foundationdb/bindings/go v0.0.0-20190411004307-cd5c9d91fad2
 	github.com/armon/go-metrics v0.4.1
 	github.com/armon/go-radix v1.0.0
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
-	github.com/aws/aws-sdk-go v1.50.13
-	github.com/aws/aws-sdk-go-v2/config v1.18.19
-	github.com/aws/aws-sdk-go-v2/service/sqs v1.29.1
-	github.com/axiomhq/hyperloglog v0.0.0-20220105174342-98591331716a
-	github.com/cenkalti/backoff/v3 v3.2.2
+	github.com/aws/aws-sdk-go v1.55.8
+	github.com/aws/aws-sdk-go-v2/config v1.29.15
+	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/chrismalek/oktasdk-go v0.0.0-20181212195951-3430665dfaa0
-	github.com/cockroachdb/cockroach-go v0.0.0-20181001143604-e0a95dfd547c
+	github.com/cockroachdb/cockroach-go/v2 v2.3.8
+	github.com/coder/websocket v1.8.12
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/denisenkom/go-mssqldb v0.12.3
-	github.com/docker/docker v25.0.2+incompatible
+	github.com/docker/docker v28.4.0+incompatible
 	github.com/duosecurity/duo_api_golang v0.0.0-20190308151101-6c680f768e74
 	github.com/dustin/go-humanize v1.0.1
-	github.com/fatih/color v1.16.0
+	github.com/fatih/color v1.18.0
 	github.com/fatih/structs v1.1.0
 	github.com/gammazero/workerpool v1.1.3
 	github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32
 	github.com/go-errors/errors v1.5.1
-	github.com/go-git/go-git/v5 v5.11.0
-	github.com/go-jose/go-jose/v3 v3.0.1
-	github.com/go-ldap/ldap/v3 v3.4.4
-	github.com/go-sql-driver/mysql v1.7.1
-	github.com/go-test/deep v1.1.0
+	github.com/go-git/go-git/v5 v5.14.0
+	github.com/go-jose/go-jose/v3 v3.0.4
+	github.com/go-ldap/ldap/v3 v3.4.12
+	github.com/go-sql-driver/mysql v1.9.3
+	github.com/go-test/deep v1.1.1
 	github.com/go-zookeeper/zk v1.0.3
 	github.com/gocql/gocql v1.0.0
-	github.com/golang-jwt/jwt/v4 v4.5.0
-	github.com/golang/protobuf v1.5.3
-	github.com/google/go-cmp v0.6.0
+	github.com/golang-jwt/jwt/v4 v4.5.2
+	github.com/golang/protobuf v1.5.4
+	github.com/google/certificate-transparency-go v1.3.2
+	github.com/google/go-cmp v0.7.0
 	github.com/google/go-github v17.0.0+incompatible
 	github.com/google/go-metrics-stackdriver v0.2.0
-	github.com/google/tink/go v1.7.0
-	github.com/hashicorp-forge/bbolt v1.3.8-hc3
-	github.com/hashicorp/cap v0.5.0
-	github.com/hashicorp/cap/ldap v0.0.0-20230914221201-c4eecc7e31f7
-	github.com/hashicorp/cli v1.1.6
-	github.com/hashicorp/consul-template v0.36.1-0.20240213145952-6c83e89b48af
-	github.com/hashicorp/consul/api v1.27.0
+	github.com/hashicorp/cap v0.11.0
+	github.com/hashicorp/cap/ldap v0.0.0-20250911140431-44d01434c285
+	github.com/hashicorp/cli v1.1.7
+	github.com/hashicorp/consul-template v0.41.1
+	github.com/hashicorp/consul/api v1.32.1
 	github.com/hashicorp/errwrap v1.1.0
-	github.com/hashicorp/eventlogger v0.2.8
+	github.com/hashicorp/eventlogger v0.2.10
 	github.com/hashicorp/go-bexpr v0.1.12
 	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-discover v0.0.0-20210818145131-c573d69da192
-	github.com/hashicorp/go-gcp-common v0.8.0
-	github.com/hashicorp/go-hclog v1.6.2
+	github.com/hashicorp/go-discover v1.1.1-0.20250922102917-55e5010ad859
+	github.com/hashicorp/go-gcp-common v0.9.2
+	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.1
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.16
-	github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2 v2.0.9
-	github.com/hashicorp/go-kms-wrapping/wrappers/alicloudkms/v2 v2.0.3
-	github.com/hashicorp/go-kms-wrapping/wrappers/awskms/v2 v2.0.9
-	github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 v2.0.11
-	github.com/hashicorp/go-kms-wrapping/wrappers/gcpckms/v2 v2.0.11
-	github.com/hashicorp/go-kms-wrapping/wrappers/ocikms/v2 v2.0.7
-	github.com/hashicorp/go-kms-wrapping/wrappers/transit/v2 v2.0.11
-	github.com/hashicorp/go-memdb v1.3.4
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.18
+	github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2 v2.0.10
+	github.com/hashicorp/go-kms-wrapping/wrappers/alicloudkms/v2 v2.0.4
+	github.com/hashicorp/go-kms-wrapping/wrappers/awskms/v2 v2.0.11
+	github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 v2.0.14
+	github.com/hashicorp/go-kms-wrapping/wrappers/gcpckms/v2 v2.0.13
+	github.com/hashicorp/go-kms-wrapping/wrappers/ocikms/v2 v2.0.9
+	github.com/hashicorp/go-kms-wrapping/wrappers/transit/v2 v2.0.13
+	github.com/hashicorp/go-memdb v1.3.5
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-plugin v1.6.0
+	github.com/hashicorp/go-pgmultiauth v1.0.0
+	github.com/hashicorp/go-plugin v1.6.3
 	github.com/hashicorp/go-raftchunking v0.6.3-0.20191002164813-7e9e8525653a
-	github.com/hashicorp/go-retryablehttp v0.7.5
+	github.com/hashicorp/go-retryablehttp v0.7.8
 	github.com/hashicorp/go-rootcerts v1.0.2
 	github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2
@@ -113,154 +113,209 @@ require (
 	github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2
 	github.com/hashicorp/go-secure-stdlib/mlock v0.1.3
 	github.com/hashicorp/go-secure-stdlib/nonceutil v0.1.0
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8
-	github.com/hashicorp/go-secure-stdlib/password v0.1.1
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
+	github.com/hashicorp/go-secure-stdlib/password v0.1.4
+	github.com/hashicorp/go-secure-stdlib/permitpool v1.0.0
+	github.com/hashicorp/go-secure-stdlib/regexp v1.0.0
 	github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2
 	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3
-	github.com/hashicorp/go-sockaddr v1.0.6
+	github.com/hashicorp/go-sockaddr v1.0.7
 	github.com/hashicorp/go-syslog v1.0.0
 	github.com/hashicorp/go-uuid v1.0.3
-	github.com/hashicorp/go-version v1.6.0
+	github.com/hashicorp/go-version v1.7.0
 	github.com/hashicorp/golang-lru v1.0.2
 	github.com/hashicorp/golang-lru/v2 v2.0.7
-	github.com/hashicorp/hcl v1.0.1-vault-5
-	github.com/hashicorp/hcl/v2 v2.16.2
+	github.com/hashicorp/hcl v1.0.1-vault-7
+	github.com/hashicorp/hcl/v2 v2.23.0
 	github.com/hashicorp/hcp-link v0.2.1
 	github.com/hashicorp/hcp-scada-provider v0.2.2
-	github.com/hashicorp/hcp-sdk-go v0.75.0
+	github.com/hashicorp/hcp-sdk-go v0.138.0
 	github.com/hashicorp/nomad/api v0.0.0-20240213164230-c364cb57298d
-	github.com/hashicorp/raft v1.6.1
-	github.com/hashicorp/raft-autopilot v0.2.0
+	github.com/hashicorp/raft v1.7.3
+	github.com/hashicorp/raft-autopilot v0.3.0
 	github.com/hashicorp/raft-boltdb/v2 v2.3.0
 	github.com/hashicorp/raft-snapshot v1.0.4
 	github.com/hashicorp/raft-wal v0.4.0
-	github.com/hashicorp/vault-hcp-lib v0.0.0-20240126195955-473e9a48e7b7
-	github.com/hashicorp/vault-plugin-auth-alicloud v0.17.0
-	github.com/hashicorp/vault-plugin-auth-azure v0.17.0
-	github.com/hashicorp/vault-plugin-auth-centrify v0.15.1
-	github.com/hashicorp/vault-plugin-auth-cf v0.16.0
-	github.com/hashicorp/vault-plugin-auth-gcp v0.16.2
-	github.com/hashicorp/vault-plugin-auth-jwt v0.20.0
-	github.com/hashicorp/vault-plugin-auth-kerberos v0.11.0
-	github.com/hashicorp/vault-plugin-auth-kubernetes v0.18.0
-	github.com/hashicorp/vault-plugin-auth-oci v0.15.1
-	github.com/hashicorp/vault-plugin-database-couchbase v0.10.1
-	github.com/hashicorp/vault-plugin-database-elasticsearch v0.14.0
-	github.com/hashicorp/vault-plugin-database-mongodbatlas v0.11.0
-	github.com/hashicorp/vault-plugin-database-redis v0.2.3
-	github.com/hashicorp/vault-plugin-database-redis-elasticache v0.3.0
-	github.com/hashicorp/vault-plugin-database-snowflake v0.10.0
-	github.com/hashicorp/vault-plugin-mock v0.16.1
-	github.com/hashicorp/vault-plugin-secrets-ad v0.17.0
-	github.com/hashicorp/vault-plugin-secrets-alicloud v0.16.0
-	github.com/hashicorp/vault-plugin-secrets-azure v0.17.0
-	github.com/hashicorp/vault-plugin-secrets-gcp v0.18.0
-	github.com/hashicorp/vault-plugin-secrets-gcpkms v0.16.0
-	github.com/hashicorp/vault-plugin-secrets-kubernetes v0.7.0
-	github.com/hashicorp/vault-plugin-secrets-kv v0.17.0
-	github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.11.0
-	github.com/hashicorp/vault-plugin-secrets-openldap v0.12.1
-	github.com/hashicorp/vault-plugin-secrets-terraform v0.7.5
-	github.com/hashicorp/vault-testing-stepwise v0.1.4
-	github.com/hashicorp/vault/api v1.12.0
+	github.com/hashicorp/vault-hcp-lib v0.0.0-20250306185756-615fe2449b16
+	github.com/hashicorp/vault-plugin-auth-alicloud v0.22.0
+	github.com/hashicorp/vault-plugin-auth-azure v0.22.0
+	github.com/hashicorp/vault-plugin-auth-cf v0.22.0
+	github.com/hashicorp/vault-plugin-auth-gcp v0.22.0
+	github.com/hashicorp/vault-plugin-auth-jwt v0.25.0
+	github.com/hashicorp/vault-plugin-auth-kerberos v0.16.0
+	github.com/hashicorp/vault-plugin-auth-kubernetes v0.23.0
+	github.com/hashicorp/vault-plugin-auth-oci v0.20.0
+	github.com/hashicorp/vault-plugin-database-couchbase v0.15.0
+	github.com/hashicorp/vault-plugin-database-elasticsearch v0.19.0
+	github.com/hashicorp/vault-plugin-database-mongodbatlas v0.16.0
+	github.com/hashicorp/vault-plugin-database-redis v0.7.0
+	github.com/hashicorp/vault-plugin-database-redis-elasticache v0.8.0
+	github.com/hashicorp/vault-plugin-database-snowflake v0.15.0
+	github.com/hashicorp/vault-plugin-secrets-ad v0.21.0
+	github.com/hashicorp/vault-plugin-secrets-alicloud v0.21.0
+	github.com/hashicorp/vault-plugin-secrets-azure v0.23.0
+	github.com/hashicorp/vault-plugin-secrets-gcp v0.23.0
+	github.com/hashicorp/vault-plugin-secrets-gcpkms v0.22.0
+	github.com/hashicorp/vault-plugin-secrets-kubernetes v0.12.0
+	github.com/hashicorp/vault-plugin-secrets-kv v0.25.0
+	github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.16.0
+	github.com/hashicorp/vault-plugin-secrets-openldap v0.17.0
+	github.com/hashicorp/vault-plugin-secrets-terraform v0.13.0
+	github.com/hashicorp/vault-testing-stepwise v0.3.2
+	github.com/hashicorp/vault/api v1.22.0
 	github.com/hashicorp/vault/api/auth/approle v0.1.0
 	github.com/hashicorp/vault/api/auth/userpass v0.1.0
-	github.com/hashicorp/vault/sdk v0.11.0
+	github.com/hashicorp/vault/sdk v0.20.0
 	github.com/hashicorp/vault/vault/hcp_link/proto v0.0.0-20230201201504-b741fa893d77
 	github.com/influxdata/influxdb1-client v0.0.0-20200827194710-b269163b24ab
-	github.com/jackc/pgx/v4 v4.18.1
+	github.com/jackc/pgx/v4 v4.18.3
 	github.com/jcmturner/gokrb5/v8 v8.4.4
 	github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f
-	github.com/jefferai/jsonx v1.0.0
+	github.com/jefferai/jsonx v1.0.1
 	github.com/joyent/triton-go v1.7.1-0.20200416154420-6801d15b779f
-	github.com/klauspost/compress v1.16.7
+	github.com/klauspost/compress v1.18.0
 	github.com/kr/pretty v0.3.1
 	github.com/kr/text v0.2.0
-	github.com/mattn/go-colorable v0.1.13
+	github.com/mattn/go-colorable v0.1.14
 	github.com/mattn/go-isatty v0.0.20
-	github.com/mholt/archiver/v3 v3.5.1
 	github.com/michaelklishin/rabbit-hole/v2 v2.12.0
 	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a
 	github.com/mitchellh/copystructure v1.2.0
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/mitchellh/go-testing-interface v1.14.1
 	github.com/mitchellh/go-wordwrap v1.0.1
-	github.com/mitchellh/mapstructure v1.5.0
+	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
 	github.com/mitchellh/reflectwalk v1.0.2
-	github.com/natefinch/atomic v0.0.0-20150920032501-a62ce929ffcc
 	github.com/ncw/swift v1.0.47
 	github.com/oklog/run v1.1.0
-	github.com/okta/okta-sdk-golang/v2 v2.12.1
+	github.com/okta/okta-sdk-golang/v5 v5.0.2
 	github.com/oracle/oci-go-sdk v24.3.0+incompatible
 	github.com/ory/dockertest v3.3.5+incompatible
-	github.com/ory/dockertest/v3 v3.10.0
+	github.com/ory/dockertest/v3 v3.12.0
 	github.com/patrickmn/go-cache v2.1.0+incompatible
-	github.com/pires/go-proxyproto v0.6.1
+	github.com/pires/go-proxyproto v0.8.0
 	github.com/pkg/errors v0.9.1
-	github.com/platinummonkey/go-concurrency-limits v0.7.0
 	github.com/posener/complete v1.2.3
 	github.com/pquerna/otp v1.2.1-0.20191009055518-468c2dd2b58d
-	github.com/prometheus/client_golang v1.14.0
-	github.com/prometheus/common v0.37.0
-	github.com/rboyer/safeio v0.2.1
+	github.com/prometheus/client_golang v1.22.0
+	github.com/prometheus/common v0.62.0
+	github.com/rboyer/safeio v0.2.3
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/ryanuber/columnize v2.1.2+incompatible
 	github.com/ryanuber/go-glob v1.0.0
-	github.com/sasha-s/go-deadlock v0.2.0
+	github.com/sasha-s/go-deadlock v0.3.5
 	github.com/sethvargo/go-limiter v0.7.1
 	github.com/shirou/gopsutil/v3 v3.22.6
-	github.com/stretchr/testify v1.8.4
-	go.etcd.io/bbolt v1.3.7
-	go.etcd.io/etcd/client/pkg/v3 v3.5.7
-	go.etcd.io/etcd/client/v2 v2.305.5
-	go.etcd.io/etcd/client/v3 v3.5.7
-	go.mongodb.org/atlas v0.36.0
-	go.mongodb.org/mongo-driver v1.13.1
-	go.opentelemetry.io/otel v1.23.1
-	go.opentelemetry.io/otel/sdk v1.23.1
-	go.opentelemetry.io/otel/trace v1.23.1
+	github.com/stretchr/testify v1.11.1
+	github.com/tink-crypto/tink-go/v2 v2.4.0
+	go.etcd.io/bbolt v1.4.0
+	go.etcd.io/etcd/client/pkg/v3 v3.6.0
+	go.etcd.io/etcd/client/v2 v2.305.17
+	go.etcd.io/etcd/client/v3 v3.6.0
+	go.mongodb.org/atlas v0.38.0
+	go.mongodb.org/mongo-driver v1.17.4
+	go.opentelemetry.io/otel v1.37.0
+	go.opentelemetry.io/otel/sdk v1.37.0
+	go.opentelemetry.io/otel/trace v1.37.0
 	go.uber.org/atomic v1.11.0
-	go.uber.org/goleak v1.2.1
-	golang.org/x/crypto v0.19.0
-	golang.org/x/exp v0.0.0-20240213143201-ec583247a57a
-	golang.org/x/net v0.21.0
-	golang.org/x/oauth2 v0.17.0
-	golang.org/x/sync v0.6.0
-	golang.org/x/sys v0.17.0
-	golang.org/x/term v0.17.0
-	golang.org/x/text v0.14.0
-	golang.org/x/tools v0.18.0
-	google.golang.org/api v0.163.0
-	google.golang.org/grpc v1.61.0
-	google.golang.org/protobuf v1.32.0
+	golang.org/x/crypto v0.42.0
+	golang.org/x/exp v0.0.0-20251002181428-27f1f14c8bb9
+	golang.org/x/net v0.44.0
+	golang.org/x/oauth2 v0.31.0
+	golang.org/x/sync v0.17.0
+	golang.org/x/sys v0.36.0
+	golang.org/x/term v0.35.0
+	golang.org/x/text v0.29.0
+	golang.org/x/tools v0.37.0
+	google.golang.org/api v0.251.0
+	google.golang.org/grpc v1.75.1
+	google.golang.org/protobuf v1.36.9
 	gopkg.in/ory-am/dockertest.v3 v3.3.4
-	k8s.io/apimachinery v0.29.1
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b
-	layeh.com/radius v0.0.0-20190322222518-890bc1058917
-	nhooyr.io/websocket v1.8.7
+	k8s.io/apimachinery v0.34.1
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
+	layeh.com/radius v0.0.0-20231213012653-1006025d24f8
+)
+
+require (
+	cel.dev/expr v0.24.0 // indirect
+	cloud.google.com/go/longrunning v0.6.7 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
+	github.com/andybalholm/brotli v1.2.0 // indirect
+	github.com/apache/arrow-go/v18 v18.4.0 // indirect
+	github.com/apache/thrift v0.22.0 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/avast/retry-go/v4 v4.6.1 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.38.1 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.200.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecs v1.53.8 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
+	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
+	github.com/hashicorp/go-discover/provider/gce v0.0.0-20241120163552-5eb1507d16b4 // indirect
+	github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6 // indirect
+	github.com/hashicorp/go-metrics v0.5.4 // indirect
+	github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.1 // indirect
+	github.com/hashicorp/go-secure-stdlib/httputil v0.1.0 // indirect
+	github.com/jackc/pgx/v5 v5.7.6 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/klauspost/asmfmt v1.3.2 // indirect
+	github.com/lestrrat-go/backoff/v2 v2.0.8 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.2 // indirect
+	github.com/lestrrat-go/httpcc v1.0.1 // indirect
+	github.com/lestrrat-go/iter v1.0.2 // indirect
+	github.com/lestrrat-go/jwx v1.2.29 // indirect
+	github.com/lestrrat-go/option v1.0.1 // indirect
+	github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 // indirect
+	github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
+	github.com/std-uritemplate/std-uritemplate/go/v2 v2.0.3 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/telemetry v0.0.0-20250908211612-aef8a434d053 // indirect
+	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 )
 
 require (
-	cloud.google.com/go v0.112.0 // indirect
-	cloud.google.com/go/compute v1.23.3 // indirect
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	cloud.google.com/go/iam v1.1.5 // indirect
-	cloud.google.com/go/kms v1.15.6 // indirect
-	dario.cat/mergo v1.0.0 // indirect
+	cloud.google.com/go v0.121.6 // indirect
+	cloud.google.com/go/auth v0.16.5 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	cloud.google.com/go/iam v1.5.2 // indirect
+	cloud.google.com/go/kms v1.23.0 // indirect; indirect\
+	dario.cat/mergo v1.0.2 // indirect
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
 	github.com/99designs/keyring v1.2.2 // indirect
 	github.com/Azure/azure-pipeline-go v0.2.3 // indirect
 	github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/authorization/armauthorization/v2 v2.2.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute/v4 v4.2.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.2.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 // indirect
 	github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
@@ -270,155 +325,139 @@ require (
 	github.com/Azure/go-autorest/logger v0.2.1 // indirect
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.1 // indirect
-	github.com/BurntSushi/toml v1.3.2 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/DataDog/datadog-go v3.2.0+incompatible // indirect
-	github.com/Jeffail/gabs v1.1.1 // indirect
-	github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c // indirect
+	github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3 // indirect
+	github.com/Jeffail/gabs/v2 v2.1.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
-	github.com/Masterminds/semver/v3 v3.2.1 // indirect
-	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/Masterminds/semver/v3 v3.3.1 // indirect
+	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
-	github.com/agext/levenshtein v1.2.1 // indirect
-	github.com/andybalholm/brotli v1.0.5 // indirect
-	github.com/apache/arrow/go/v14 v14.0.2 // indirect
-	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.23.4 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.18 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.1 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.59 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.7 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.7 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.32 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.26 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.25 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.31.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.12.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.18.7 // indirect
-	github.com/aws/smithy-go v1.18.1 // indirect
+	github.com/agext/levenshtein v1.2.3 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.68 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.80.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.33.20 // indirect
+	github.com/aws/smithy-go v1.22.5 // indirect
 	github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f // indirect
 	github.com/benbjohnson/immutable v0.4.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bgentry/speakeasy v0.1.0 // indirect
+	github.com/bgentry/speakeasy v0.2.0 // indirect
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/boombuler/barcode v1.0.1 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
-	github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
-	github.com/centrify/cloud-golang-sdk v0.0.0-20210923165758-a8c48d049166 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible // indirect
 	github.com/circonus-labs/circonusllhist v0.1.3 // indirect
-	github.com/cjlapao/common-go v0.0.39 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
+	github.com/cloudflare/circl v1.6.2-0.20250618153321-aa837fd1539d // indirect
 	github.com/cloudfoundry-community/go-cfclient v0.0.0-20220930021109-9c4e6c59ccf1 // indirect
-	github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe // indirect
-	github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101 // indirect
-	github.com/containerd/containerd v1.7.12 // indirect
-	github.com/containerd/continuity v0.4.2 // indirect
+	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
+	github.com/containerd/continuity v0.4.5 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/coreos/etcd v3.3.27+incompatible // indirect
-	github.com/coreos/go-oidc v2.2.1+incompatible // indirect
-	github.com/coreos/go-oidc/v3 v3.5.0 // indirect
-	github.com/coreos/go-semver v0.3.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.15.0 // indirect
+	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/coreos/pkg v0.0.0-20220810130054-c7d1c02cb6cf // indirect
-	github.com/couchbase/gocb/v2 v2.6.5 // indirect
-	github.com/couchbase/gocbcore/v10 v10.3.1 // indirect
-	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
-	github.com/danieljoos/wincred v1.1.2 // indirect
+	github.com/couchbase/gocb/v2 v2.11.1 // indirect
+	github.com/couchbase/gocbcore/v10 v10.8.1 // indirect
+	github.com/couchbase/gocbcoreps v0.1.4 // indirect
+	github.com/couchbase/goprotostellar v1.0.2 // indirect
+	github.com/couchbaselabs/gocbconnstr/v2 v2.0.0 // indirect
+	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
+	github.com/danieljoos/wincred v1.2.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba // indirect
-	github.com/dgryski/go-metro v0.0.0-20180109044635-280f6062b5bc // indirect
 	github.com/digitalocean/godo v1.7.5 // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
-	github.com/distribution/reference v0.5.0 // indirect
-	github.com/docker/cli v25.0.1+incompatible // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/cli v27.4.1+incompatible // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 // indirect
 	github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/envoyproxy/go-control-plane v0.11.1 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.0.2 // indirect
-	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
-	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.7 // indirect
 	github.com/gammazero/deque v0.2.1 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.5.0 // indirect
-	github.com/go-ldap/ldif v0.0.0-20200320164324-fd88d9b715b3 // indirect
-	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.2 // indirect
+	github.com/go-ldap/ldif v0.0.0-20250910174327-aa3bc3095c92 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-openapi/analysis v0.21.4 // indirect
-	github.com/go-openapi/errors v0.20.4 // indirect
-	github.com/go-openapi/jsonpointer v0.20.0 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/loads v0.21.2 // indirect
-	github.com/go-openapi/runtime v0.26.0 // indirect
-	github.com/go-openapi/spec v0.20.9 // indirect
-	github.com/go-openapi/strfmt v0.21.7 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/go-openapi/validate v0.22.2 // indirect
+	github.com/go-openapi/analysis v0.23.0 // indirect
+	github.com/go-openapi/errors v0.22.1 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/loads v0.22.0 // indirect
+	github.com/go-openapi/runtime v0.28.0 // indirect
+	github.com/go-openapi/spec v0.21.0 // indirect
+	github.com/go-openapi/strfmt v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-openapi/validate v0.24.0 // indirect
 	github.com/go-ozzo/ozzo-validation v3.6.0+incompatible // indirect
-	github.com/goccy/go-json v0.10.2 // indirect
-	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
-	github.com/gofrs/uuid v4.3.0+incompatible // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.0 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/snappy v0.0.4 // indirect
-	github.com/google/flatbuffers v23.5.26+incompatible // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/snappy v1.0.0 // indirect
+	github.com/google/flatbuffers v25.2.10+incompatible // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
-	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
+	github.com/google/uuid v1.6.0
+	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
+	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
 	github.com/gophercloud/gophercloud v0.1.0 // indirect
-	github.com/gorilla/websocket v1.5.1 // indirect
-	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/hashicorp/cronexpr v1.1.2 // indirect
-	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
-	github.com/hashicorp/go-msgpack/v2 v2.1.1 // indirect
+	github.com/hashicorp/go-immutable-radix v1.3.1
+	github.com/hashicorp/go-msgpack/v2 v2.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/fileutil v0.1.0 // indirect
-	github.com/hashicorp/go-secure-stdlib/plugincontainer v0.3.0 // indirect
-	github.com/hashicorp/go-slug v0.13.4 // indirect
-	github.com/hashicorp/go-tfe v1.44.0 // indirect
-	github.com/hashicorp/jsonapi v1.3.1 // indirect
+	github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.2 // indirect
+	github.com/hashicorp/go-slug v0.16.7 // indirect
+	github.com/hashicorp/go-tfe v1.93.0 // indirect
+	github.com/hashicorp/jsonapi v1.4.3-0.20250220162346-81a76b606f3e // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/mdns v1.0.4 // indirect
 	github.com/hashicorp/net-rpc-msgpackrpc/v2 v2.0.0 // indirect
 	github.com/hashicorp/serf v0.10.1 // indirect
-	github.com/hashicorp/vault/api/auth/kubernetes v0.6.0 // indirect
+	github.com/hashicorp/vault/api/auth/kubernetes v0.10.0 // indirect
 	github.com/hashicorp/vic v1.5.1-0.20190403131502-bbfe86ec9443 // indirect
-	github.com/hashicorp/yamux v0.1.1 // indirect
-	github.com/huandu/xstrings v1.4.0 // indirect
-	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
+	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.14.0 // indirect
+	github.com/jackc/pgconn v1.14.3 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.2 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
-	github.com/jackc/pgtype v1.14.0 // indirect
-	github.com/jackc/pgx v3.3.0+incompatible // indirect
+	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgtype v1.14.3 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
@@ -426,86 +465,80 @@ require (
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
 	github.com/jeffchao/backoff v0.0.0-20140404060208-9d7fd7aa17f2 // indirect
-	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kelseyhightower/envconfig v1.4.0 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
-	github.com/klauspost/pgzip v1.2.5 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/lib/pq v1.10.9 // indirect
 	github.com/linode/linodego v0.7.1 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-ieproxy v0.0.1 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mediocregopher/radix/v4 v4.1.4 // indirect
-	github.com/microsoft/kiota-abstractions-go v1.5.6 // indirect
-	github.com/microsoft/kiota-authentication-azure-go v1.0.1 // indirect
-	github.com/microsoft/kiota-http-go v1.1.1 // indirect
-	github.com/microsoft/kiota-serialization-form-go v1.0.0 // indirect
-	github.com/microsoft/kiota-serialization-json-go v1.0.5 // indirect
-	github.com/microsoft/kiota-serialization-multipart-go v1.0.0 // indirect
-	github.com/microsoft/kiota-serialization-text-go v1.0.0 // indirect
-	github.com/microsoftgraph/msgraph-sdk-go v1.32.0 // indirect
-	github.com/microsoftgraph/msgraph-sdk-go-core v1.0.1 // indirect
-	github.com/miekg/dns v1.1.43 // indirect
+	github.com/microsoft/kiota-abstractions-go v1.9.3 // indirect
+	github.com/microsoft/kiota-authentication-azure-go v1.3.1 // indirect
+	github.com/microsoft/kiota-http-go v1.5.4 // indirect
+	github.com/microsoft/kiota-serialization-form-go v1.1.2 // indirect
+	github.com/microsoft/kiota-serialization-json-go v1.1.2 // indirect
+	github.com/microsoft/kiota-serialization-multipart-go v1.1.2 // indirect
+	github.com/microsoft/kiota-serialization-text-go v1.1.2 // indirect
+	github.com/microsoftgraph/msgraph-sdk-go v1.86.0 // indirect
+	github.com/microsoftgraph/msgraph-sdk-go-core v1.4.0 // indirect
+	github.com/miekg/dns v1.1.50 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/mitchellh/hashstructure v1.1.0 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
-	github.com/moby/patternmatcher v0.5.0 // indirect
-	github.com/moby/sys/sequential v0.5.0 // indirect
-	github.com/moby/sys/user v0.1.0 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/mongodb-forks/digest v1.0.5 // indirect
-	github.com/montanaflynn/stats v0.7.0 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/mongodb-forks/digest v1.1.0 // indirect
+	github.com/montanaflynn/stats v0.7.1 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/natefinch/atomic v1.0.1 // indirect
 	github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2 // indirect
-	github.com/nwaples/rardecode v1.1.2 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b // indirect
-	github.com/opencontainers/runc v1.1.12 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/opencontainers/runc v1.2.6 // indirect
 	github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect
 	github.com/oracle/oci-go-sdk/v59 v59.0.0 // indirect
 	github.com/oracle/oci-go-sdk/v60 v60.0.0 // indirect
 	github.com/packethost/packngo v0.1.1-0.20180711074735-b9cb5096f54c // indirect
-	github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 // indirect
+	github.com/petermattis/goid v0.0.0-20250721140440-ea1c0173183e // indirect
 	github.com/pierrec/lz4 v2.6.1+incompatible // indirect
-	github.com/pierrec/lz4/v4 v4.1.18 // indirect
-	github.com/pjbgf/sha1cd v0.3.0 // indirect
+	github.com/pierrec/lz4/v4 v4.1.22 // indirect
+	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
-	github.com/pquerna/cachecontrol v0.1.0 // indirect
-	github.com/prometheus/client_model v0.4.0 // indirect
-	github.com/prometheus/procfs v0.8.0 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/renier/xmlrpc v0.0.0-20170708154548-ce4a1a486c03 // indirect
-	github.com/rogpeppe/go-internal v1.11.0 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/segmentio/fasthash v1.0.3 // indirect
-	github.com/sergi/go-diff v1.1.0 // indirect
-	github.com/shopspring/decimal v1.3.1 // indirect
+	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.2.1 // indirect
+	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
-	github.com/snowflakedb/gosnowflake v1.7.2 // indirect
+	github.com/snowflakedb/gosnowflake v1.17.0 // indirect
 	github.com/softlayer/softlayer-go v0.0.0-20180806151055-260589d94c7d // indirect
 	github.com/sony/gobreaker v0.5.0 // indirect
-	github.com/spf13/cast v1.6.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/std-uritemplate/std-uritemplate/go v0.0.50 // indirect
-	github.com/stretchr/objx v0.5.0 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
+	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/tencentcloud/tencentcloud-sdk-go v1.0.162 // indirect
 	github.com/tilinna/clock v1.1.0 // indirect
-	github.com/tklauser/go-sysconf v0.3.10 // indirect
-	github.com/tklauser/numcpus v0.4.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.12 // indirect
+	github.com/tklauser/numcpus v0.6.1 // indirect
 	github.com/tv42/httpunix v0.0.0-20191220191345-2ba4b9c3382c // indirect
-	github.com/ulikunitz/xz v0.5.10 // indirect
 	github.com/vmware/govmomi v0.18.0 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
@@ -514,41 +547,36 @@ require (
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
-	github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d // indirect
+	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
 	github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9 // indirect
-	github.com/yusufpapurcu/wmi v1.2.2 // indirect
-	github.com/zclconf/go-cty v1.12.1 // indirect
+	github.com/yusufpapurcu/wmi v1.2.4 // indirect
+	github.com/zclconf/go-cty v1.15.0 // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
-	go.etcd.io/etcd/api/v3 v3.5.7 // indirect
+	go.etcd.io/etcd/api/v3 v3.6.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 // indirect
-	go.opentelemetry.io/otel/metric v1.23.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.26.0 // indirect
-	golang.org/x/mod v0.15.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto v0.0.0-20240125205218-1f4bbc51befe // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/mod v0.28.0 // indirect
+	golang.org/x/time v0.13.0
+	google.golang.org/genproto v0.0.0-20251002232023-7c0ddcbb5797 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250922171735-9219d122eba9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 // indirect; indirect\
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/ini.v1 v1.66.2 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
 	gopkg.in/resty.v1 v1.12.0 // indirect
-	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.29.1 // indirect
-	k8s.io/client-go v0.29.1 // indirect
-	k8s.io/klog/v2 v2.110.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
-	sigs.k8s.io/yaml v1.3.0 // indirect
+	k8s.io/api v0.34.1 // indirect
+	k8s.io/client-go v0.34.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
 
 replace github.com/ma314smith/signedxml v1.1.1 => github.com/moov-io/signedxml v1.1.1
diff --git a/go.sum b/go.sum
index 90ad2b89135..90c5c10b2b8 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-bazil.org/fuse v0.0.0-20160811212531-371fbbdaa898/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8=
-bazil.org/fuse v0.0.0-20200407214033-5883e5a4b512/go.mod h1:FbcW6z/2VytnFDhZfumh8Ss8zxHE6qpMP5sHTRe0EaM=
+cel.dev/expr v0.24.0 h1:56OvJKSH3hDGL0ml5uSxZmz3/3Pq4tJ+fb1unVLAFcY=
+cel.dev/expr v0.24.0/go.mod h1:hLPLo1W4QUmuYdA72RBX06QTs6MXw941piREPl3Yfiw=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -39,75 +39,35 @@ cloud.google.com/go v0.104.0/go.mod h1:OO6xxXdJyvuJPcEPBLN9BJPD+jep5G1+2U5B5gkRY
 cloud.google.com/go v0.105.0/go.mod h1:PrLgOJNe5nfE9UMxKxgXj4mD3voiP+YQ6gdt6KMFOKM=
 cloud.google.com/go v0.107.0/go.mod h1:wpc2eNrD7hXUTy8EKS10jkxpZBjASrORK7goS+3YX2I=
 cloud.google.com/go v0.110.0/go.mod h1:SJnCLqQ0FCFGSZMUNUf84MV3Aia54kn7pi8st7tMzaY=
-cloud.google.com/go v0.110.2/go.mod h1:k04UEeEtb6ZBRTv3dZz4CeJC3jKGxyhl0sAiVVquxiw=
-cloud.google.com/go v0.110.4/go.mod h1:+EYjdK8e5RME/VY/qLCAtuyALQ9q67dvuum8i+H5xsI=
-cloud.google.com/go v0.110.6/go.mod h1:+EYjdK8e5RME/VY/qLCAtuyALQ9q67dvuum8i+H5xsI=
-cloud.google.com/go v0.110.7/go.mod h1:+EYjdK8e5RME/VY/qLCAtuyALQ9q67dvuum8i+H5xsI=
-cloud.google.com/go v0.110.8/go.mod h1:Iz8AkXJf1qmxC3Oxoep8R1T36w8B92yU29PcBhHO5fk=
-cloud.google.com/go v0.110.9/go.mod h1:rpxevX/0Lqvlbc88b7Sc1SPNdyK1riNBTUU6JXhYNpM=
-cloud.google.com/go v0.110.10/go.mod h1:v1OoFqYxiBkUrruItNM3eT4lLByNjxmJSV/xDKJNnic=
-cloud.google.com/go v0.112.0 h1:tpFCD7hpHFlQ8yPwT3x+QeXqc2T6+n6T+hmABHfDUSM=
-cloud.google.com/go v0.112.0/go.mod h1:3jEEVwZ/MHU4djK5t5RHuKOA/GbLddgTdVubX1qnPD4=
+cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c=
+cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI=
 cloud.google.com/go/accessapproval v1.4.0/go.mod h1:zybIuC3KpDOvotz59lFe5qxRZx6C75OtwbisN56xYB4=
 cloud.google.com/go/accessapproval v1.5.0/go.mod h1:HFy3tuiGvMdcd/u+Cu5b9NkO1pEICJ46IR82PoUdplw=
 cloud.google.com/go/accessapproval v1.6.0/go.mod h1:R0EiYnwV5fsRFiKZkPHr6mwyk2wxUJ30nL4j2pcFY2E=
-cloud.google.com/go/accessapproval v1.7.1/go.mod h1:JYczztsHRMK7NTXb6Xw+dwbs/WnOJxbo/2mTI+Kgg68=
-cloud.google.com/go/accessapproval v1.7.2/go.mod h1:/gShiq9/kK/h8T/eEn1BTzalDvk0mZxJlhfw0p+Xuc0=
-cloud.google.com/go/accessapproval v1.7.3/go.mod h1:4l8+pwIxGTNqSf4T3ds8nLO94NQf0W/KnMNuQ9PbnP8=
-cloud.google.com/go/accessapproval v1.7.4/go.mod h1:/aTEh45LzplQgFYdQdwPMR9YdX0UlhBmvB84uAmQKUc=
 cloud.google.com/go/accesscontextmanager v1.3.0/go.mod h1:TgCBehyr5gNMz7ZaH9xubp+CE8dkrszb4oK9CWyvD4o=
 cloud.google.com/go/accesscontextmanager v1.4.0/go.mod h1:/Kjh7BBu/Gh83sv+K60vN9QE5NJcd80sU33vIe2IFPE=
 cloud.google.com/go/accesscontextmanager v1.6.0/go.mod h1:8XCvZWfYw3K/ji0iVnp+6pu7huxoQTLmxAbVjbloTtM=
 cloud.google.com/go/accesscontextmanager v1.7.0/go.mod h1:CEGLewx8dwa33aDAZQujl7Dx+uYhS0eay198wB/VumQ=
-cloud.google.com/go/accesscontextmanager v1.8.0/go.mod h1:uI+AI/r1oyWK99NN8cQ3UK76AMelMzgZCvJfsi2c+ps=
-cloud.google.com/go/accesscontextmanager v1.8.1/go.mod h1:JFJHfvuaTC+++1iL1coPiG1eu5D24db2wXCDWDjIrxo=
-cloud.google.com/go/accesscontextmanager v1.8.2/go.mod h1:E6/SCRM30elQJ2PKtFMs2YhfJpZSNcJyejhuzoId4Zk=
-cloud.google.com/go/accesscontextmanager v1.8.3/go.mod h1:4i/JkF2JiFbhLnnpnfoTX5vRXfhf9ukhU1ANOTALTOQ=
-cloud.google.com/go/accesscontextmanager v1.8.4/go.mod h1:ParU+WbMpD34s5JFEnGAnPBYAgUHozaTmDJU7aCU9+M=
 cloud.google.com/go/aiplatform v1.22.0/go.mod h1:ig5Nct50bZlzV6NvKaTwmplLLddFx0YReh9WfTO5jKw=
 cloud.google.com/go/aiplatform v1.24.0/go.mod h1:67UUvRBKG6GTayHKV8DBv2RtR1t93YRu5B1P3x99mYY=
 cloud.google.com/go/aiplatform v1.27.0/go.mod h1:Bvxqtl40l0WImSb04d0hXFU7gDOiq9jQmorivIiWcKg=
 cloud.google.com/go/aiplatform v1.35.0/go.mod h1:7MFT/vCaOyZT/4IIFfxH4ErVg/4ku6lKv3w0+tFTgXQ=
 cloud.google.com/go/aiplatform v1.36.1/go.mod h1:WTm12vJRPARNvJ+v6P52RDHCNe4AhvjcIZ/9/RRHy/k=
 cloud.google.com/go/aiplatform v1.37.0/go.mod h1:IU2Cv29Lv9oCn/9LkFiiuKfwrRTq+QQMbW+hPCxJGZw=
-cloud.google.com/go/aiplatform v1.45.0/go.mod h1:Iu2Q7sC7QGhXUeOhAj/oCK9a+ULz1O4AotZiqjQ8MYA=
-cloud.google.com/go/aiplatform v1.48.0/go.mod h1:Iu2Q7sC7QGhXUeOhAj/oCK9a+ULz1O4AotZiqjQ8MYA=
-cloud.google.com/go/aiplatform v1.50.0/go.mod h1:IRc2b8XAMTa9ZmfJV1BCCQbieWWvDnP1A8znyz5N7y4=
-cloud.google.com/go/aiplatform v1.51.0/go.mod h1:IRc2b8XAMTa9ZmfJV1BCCQbieWWvDnP1A8znyz5N7y4=
-cloud.google.com/go/aiplatform v1.51.1/go.mod h1:kY3nIMAVQOK2XDqDPHaOuD9e+FdMA6OOpfBjsvaFSOo=
-cloud.google.com/go/aiplatform v1.51.2/go.mod h1:hCqVYB3mY45w99TmetEoe8eCQEwZEp9WHxeZdcv9phw=
-cloud.google.com/go/aiplatform v1.52.0/go.mod h1:pwZMGvqe0JRkI1GWSZCtnAfrR4K1bv65IHILGA//VEU=
 cloud.google.com/go/analytics v0.11.0/go.mod h1:DjEWCu41bVbYcKyvlws9Er60YE4a//bK6mnhWvQeFNI=
 cloud.google.com/go/analytics v0.12.0/go.mod h1:gkfj9h6XRf9+TS4bmuhPEShsh3hH8PAZzm/41OOhQd4=
 cloud.google.com/go/analytics v0.17.0/go.mod h1:WXFa3WSym4IZ+JiKmavYdJwGG/CvpqiqczmL59bTD9M=
 cloud.google.com/go/analytics v0.18.0/go.mod h1:ZkeHGQlcIPkw0R/GW+boWHhCOR43xz9RN/jn7WcqfIE=
 cloud.google.com/go/analytics v0.19.0/go.mod h1:k8liqf5/HCnOUkbawNtrWWc+UAzyDlW89doe8TtoDsE=
-cloud.google.com/go/analytics v0.21.2/go.mod h1:U8dcUtmDmjrmUTnnnRnI4m6zKn/yaA5N9RlEkYFHpQo=
-cloud.google.com/go/analytics v0.21.3/go.mod h1:U8dcUtmDmjrmUTnnnRnI4m6zKn/yaA5N9RlEkYFHpQo=
-cloud.google.com/go/analytics v0.21.4/go.mod h1:zZgNCxLCy8b2rKKVfC1YkC2vTrpfZmeRCySM3aUbskA=
-cloud.google.com/go/analytics v0.21.5/go.mod h1:BQtOBHWTlJ96axpPPnw5CvGJ6i3Ve/qX2fTxR8qWyr8=
-cloud.google.com/go/analytics v0.21.6/go.mod h1:eiROFQKosh4hMaNhF85Oc9WO97Cpa7RggD40e/RBy8w=
 cloud.google.com/go/apigateway v1.3.0/go.mod h1:89Z8Bhpmxu6AmUxuVRg/ECRGReEdiP3vQtk4Z1J9rJk=
 cloud.google.com/go/apigateway v1.4.0/go.mod h1:pHVY9MKGaH9PQ3pJ4YLzoj6U5FUDeDFBllIz7WmzJoc=
 cloud.google.com/go/apigateway v1.5.0/go.mod h1:GpnZR3Q4rR7LVu5951qfXPJCHquZt02jf7xQx7kpqN8=
-cloud.google.com/go/apigateway v1.6.1/go.mod h1:ufAS3wpbRjqfZrzpvLC2oh0MFlpRJm2E/ts25yyqmXA=
-cloud.google.com/go/apigateway v1.6.2/go.mod h1:CwMC90nnZElorCW63P2pAYm25AtQrHfuOkbRSHj0bT8=
-cloud.google.com/go/apigateway v1.6.3/go.mod h1:k68PXWpEs6BVDTtnLQAyG606Q3mz8pshItwPXjgv44Y=
-cloud.google.com/go/apigateway v1.6.4/go.mod h1:0EpJlVGH5HwAN4VF4Iec8TAzGN1aQgbxAWGJsnPCGGY=
 cloud.google.com/go/apigeeconnect v1.3.0/go.mod h1:G/AwXFAKo0gIXkPTVfZDd2qA1TxBXJ3MgMRBQkIi9jc=
 cloud.google.com/go/apigeeconnect v1.4.0/go.mod h1:kV4NwOKqjvt2JYR0AoIWo2QGfoRtn/pkS3QlHp0Ni04=
 cloud.google.com/go/apigeeconnect v1.5.0/go.mod h1:KFaCqvBRU6idyhSNyn3vlHXc8VMDJdRmwDF6JyFRqZ8=
-cloud.google.com/go/apigeeconnect v1.6.1/go.mod h1:C4awq7x0JpLtrlQCr8AzVIzAaYgngRqWf9S5Uhg+wWs=
-cloud.google.com/go/apigeeconnect v1.6.2/go.mod h1:s6O0CgXT9RgAxlq3DLXvG8riw8PYYbU/v25jqP3Dy18=
-cloud.google.com/go/apigeeconnect v1.6.3/go.mod h1:peG0HFQ0si2bN15M6QSjEW/W7Gy3NYkWGz7pFz13cbo=
-cloud.google.com/go/apigeeconnect v1.6.4/go.mod h1:CapQCWZ8TCjnU0d7PobxhpOdVz/OVJ2Hr/Zcuu1xFx0=
 cloud.google.com/go/apigeeregistry v0.4.0/go.mod h1:EUG4PGcsZvxOXAdyEghIdXwAEi/4MEaoqLMLDMIwKXY=
 cloud.google.com/go/apigeeregistry v0.5.0/go.mod h1:YR5+s0BVNZfVOUkMa5pAR2xGd0A473vA5M7j247o1wM=
 cloud.google.com/go/apigeeregistry v0.6.0/go.mod h1:BFNzW7yQVLZ3yj0TKcwzb8n25CFBri51GVGOEUcgQsc=
-cloud.google.com/go/apigeeregistry v0.7.1/go.mod h1:1XgyjZye4Mqtw7T9TsY4NW10U7BojBvG4RMD+vRDrIw=
-cloud.google.com/go/apigeeregistry v0.7.2/go.mod h1:9CA2B2+TGsPKtfi3F7/1ncCCsL62NXBRfM6iPoGSM+8=
-cloud.google.com/go/apigeeregistry v0.8.1/go.mod h1:MW4ig1N4JZQsXmBSwH4rwpgDonocz7FPBSw6XPGHmYw=
-cloud.google.com/go/apigeeregistry v0.8.2/go.mod h1:h4v11TDGdeXJDJvImtgK2AFVvMIgGWjSb0HRnBSjcX8=
 cloud.google.com/go/apikeys v0.4.0/go.mod h1:XATS/yqZbaBK0HOssf+ALHp8jAlNHUgyfprvNcBIszU=
 cloud.google.com/go/apikeys v0.5.0/go.mod h1:5aQfwY4D+ewMMWScd3hm2en3hCj+BROlyrt3ytS7KLI=
 cloud.google.com/go/apikeys v0.6.0/go.mod h1:kbpXu5upyiAlGkKrJgQl8A0rKNNJ7dQ377pdroRSSi8=
@@ -116,18 +76,10 @@ cloud.google.com/go/appengine v1.5.0/go.mod h1:TfasSozdkFI0zeoxW3PTBLiNqRmzraodC
 cloud.google.com/go/appengine v1.6.0/go.mod h1:hg6i0J/BD2cKmDJbaFSYHFyZkgBEfQrDg/X0V5fJn84=
 cloud.google.com/go/appengine v1.7.0/go.mod h1:eZqpbHFCqRGa2aCdope7eC0SWLV1j0neb/QnMJVWx6A=
 cloud.google.com/go/appengine v1.7.1/go.mod h1:IHLToyb/3fKutRysUlFO0BPt5j7RiQ45nrzEJmKTo6E=
-cloud.google.com/go/appengine v1.8.1/go.mod h1:6NJXGLVhZCN9aQ/AEDvmfzKEfoYBlfB80/BHiKVputY=
-cloud.google.com/go/appengine v1.8.2/go.mod h1:WMeJV9oZ51pvclqFN2PqHoGnys7rK0rz6s3Mp6yMvDo=
-cloud.google.com/go/appengine v1.8.3/go.mod h1:2oUPZ1LVZ5EXi+AF1ihNAF+S8JrzQ3till5m9VQkrsk=
-cloud.google.com/go/appengine v1.8.4/go.mod h1:TZ24v+wXBujtkK77CXCpjZbnuTvsFNT41MUaZ28D6vg=
 cloud.google.com/go/area120 v0.5.0/go.mod h1:DE/n4mp+iqVyvxHN41Vf1CR602GiHQjFPusMFW6bGR4=
 cloud.google.com/go/area120 v0.6.0/go.mod h1:39yFJqWVgm0UZqWTOdqkLhjoC7uFfgXRC8g/ZegeAh0=
 cloud.google.com/go/area120 v0.7.0/go.mod h1:a3+8EUD1SX5RUcCs3MY5YasiO1z6yLiNLRiFrykbynY=
 cloud.google.com/go/area120 v0.7.1/go.mod h1:j84i4E1RboTWjKtZVWXPqvK5VHQFJRF2c1Nm69pWm9k=
-cloud.google.com/go/area120 v0.8.1/go.mod h1:BVfZpGpB7KFVNxPiQBuHkX6Ed0rS51xIgmGyjrAfzsg=
-cloud.google.com/go/area120 v0.8.2/go.mod h1:a5qfo+x77SRLXnCynFWPUZhnZGeSgvQ+Y0v1kSItkh4=
-cloud.google.com/go/area120 v0.8.3/go.mod h1:5zj6pMzVTH+SVHljdSKC35sriR/CVvQZzG/Icdyriw0=
-cloud.google.com/go/area120 v0.8.4/go.mod h1:jfawXjxf29wyBXr48+W+GyX/f8fflxp642D/bb9v68M=
 cloud.google.com/go/artifactregistry v1.6.0/go.mod h1:IYt0oBPSAGYj/kprzsBjZ/4LnG/zOcHyFHjWPCi6SAQ=
 cloud.google.com/go/artifactregistry v1.7.0/go.mod h1:mqTOFOnGZx8EtSqK/ZWcsm/4U8B77rbcLP6ruDU2Ixk=
 cloud.google.com/go/artifactregistry v1.8.0/go.mod h1:w3GQXkJX8hiKN0v+at4b0qotwijQbYUqF2GWkZzAhC0=
@@ -136,11 +88,6 @@ cloud.google.com/go/artifactregistry v1.11.1/go.mod h1:lLYghw+Itq9SONbCa1YWBoWs1
 cloud.google.com/go/artifactregistry v1.11.2/go.mod h1:nLZns771ZGAwVLzTX/7Al6R9ehma4WUEhZGWV6CeQNQ=
 cloud.google.com/go/artifactregistry v1.12.0/go.mod h1:o6P3MIvtzTOnmvGagO9v/rOjjA0HmhJ+/6KAXrmYDCI=
 cloud.google.com/go/artifactregistry v1.13.0/go.mod h1:uy/LNfoOIivepGhooAUpL1i30Hgee3Cu0l4VTWHUC08=
-cloud.google.com/go/artifactregistry v1.14.1/go.mod h1:nxVdG19jTaSTu7yA7+VbWL346r3rIdkZ142BSQqhn5E=
-cloud.google.com/go/artifactregistry v1.14.2/go.mod h1:Xk+QbsKEb0ElmyeMfdHAey41B+qBq3q5R5f5xD4XT3U=
-cloud.google.com/go/artifactregistry v1.14.3/go.mod h1:A2/E9GXnsyXl7GUvQ/2CjHA+mVRoWAXC0brg2os+kNI=
-cloud.google.com/go/artifactregistry v1.14.4/go.mod h1:SJJcZTMv6ce0LDMUnihCN7WSrI+kBSFV0KIKo8S8aYU=
-cloud.google.com/go/artifactregistry v1.14.6/go.mod h1:np9LSFotNWHcjnOgh8UVK0RFPCTUGbO0ve3384xyHfE=
 cloud.google.com/go/asset v1.5.0/go.mod h1:5mfs8UvcM5wHhqtSv8J1CtxxaQq3AdBxxQi2jGW/K4o=
 cloud.google.com/go/asset v1.7.0/go.mod h1:YbENsRK4+xTiL+Ofoj5Ckf+O17kJtgp3Y3nn4uzZz5s=
 cloud.google.com/go/asset v1.8.0/go.mod h1:mUNGKhiqIdbr8X7KNayoYvyc4HbbFO9URsjbytpUaW0=
@@ -149,56 +96,31 @@ cloud.google.com/go/asset v1.10.0/go.mod h1:pLz7uokL80qKhzKr4xXGvBQXnzHn5evJAEAt
 cloud.google.com/go/asset v1.11.1/go.mod h1:fSwLhbRvC9p9CXQHJ3BgFeQNM4c9x10lqlrdEUYXlJo=
 cloud.google.com/go/asset v1.12.0/go.mod h1:h9/sFOa4eDIyKmH6QMpm4eUK3pDojWnUhTgJlk762Hg=
 cloud.google.com/go/asset v1.13.0/go.mod h1:WQAMyYek/b7NBpYq/K4KJWcRqzoalEsxz/t/dTk4THw=
-cloud.google.com/go/asset v1.14.1/go.mod h1:4bEJ3dnHCqWCDbWJ/6Vn7GVI9LerSi7Rfdi03hd+WTQ=
-cloud.google.com/go/asset v1.15.0/go.mod h1:tpKafV6mEut3+vN9ScGvCHXHj7FALFVta+okxFECHcg=
-cloud.google.com/go/asset v1.15.1/go.mod h1:yX/amTvFWRpp5rcFq6XbCxzKT8RJUam1UoboE179jU4=
-cloud.google.com/go/asset v1.15.2/go.mod h1:B6H5tclkXvXz7PD22qCA2TDxSVQfasa3iDlM89O2NXs=
-cloud.google.com/go/asset v1.15.3/go.mod h1:yYLfUD4wL4X589A9tYrv4rFrba0QlDeag0CMcM5ggXU=
 cloud.google.com/go/assuredworkloads v1.5.0/go.mod h1:n8HOZ6pff6re5KYfBXcFvSViQjDwxFkAkmUFffJRbbY=
 cloud.google.com/go/assuredworkloads v1.6.0/go.mod h1:yo2YOk37Yc89Rsd5QMVECvjaMKymF9OP+QXWlKXUkXw=
 cloud.google.com/go/assuredworkloads v1.7.0/go.mod h1:z/736/oNmtGAyU47reJgGN+KVoYoxeLBoj4XkKYscNI=
 cloud.google.com/go/assuredworkloads v1.8.0/go.mod h1:AsX2cqyNCOvEQC8RMPnoc0yEarXQk6WEKkxYfL6kGIo=
 cloud.google.com/go/assuredworkloads v1.9.0/go.mod h1:kFuI1P78bplYtT77Tb1hi0FMxM0vVpRC7VVoJC3ZoT0=
 cloud.google.com/go/assuredworkloads v1.10.0/go.mod h1:kwdUQuXcedVdsIaKgKTp9t0UJkE5+PAVNhdQm4ZVq2E=
-cloud.google.com/go/assuredworkloads v1.11.1/go.mod h1:+F04I52Pgn5nmPG36CWFtxmav6+7Q+c5QyJoL18Lry0=
-cloud.google.com/go/assuredworkloads v1.11.2/go.mod h1:O1dfr+oZJMlE6mw0Bp0P1KZSlj5SghMBvTpZqIcUAW4=
-cloud.google.com/go/assuredworkloads v1.11.3/go.mod h1:vEjfTKYyRUaIeA0bsGJceFV2JKpVRgyG2op3jfa59Zs=
-cloud.google.com/go/assuredworkloads v1.11.4/go.mod h1:4pwwGNwy1RP0m+y12ef3Q/8PaiWrIDQ6nD2E8kvWI9U=
+cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
+cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/automl v1.5.0/go.mod h1:34EjfoFGMZ5sgJ9EoLsRtdPSNZLcfflJR39VbVNS2M0=
 cloud.google.com/go/automl v1.6.0/go.mod h1:ugf8a6Fx+zP0D59WLhqgTDsQI9w07o64uf/Is3Nh5p8=
 cloud.google.com/go/automl v1.7.0/go.mod h1:RL9MYCCsJEOmt0Wf3z9uzG0a7adTT1fe+aObgSpkCt8=
 cloud.google.com/go/automl v1.8.0/go.mod h1:xWx7G/aPEe/NP+qzYXktoBSDfjO+vnKMGgsApGJJquM=
 cloud.google.com/go/automl v1.12.0/go.mod h1:tWDcHDp86aMIuHmyvjuKeeHEGq76lD7ZqfGLN6B0NuU=
-cloud.google.com/go/automl v1.13.1/go.mod h1:1aowgAHWYZU27MybSCFiukPO7xnyawv7pt3zK4bheQE=
-cloud.google.com/go/automl v1.13.2/go.mod h1:gNY/fUmDEN40sP8amAX3MaXkxcqPIn7F1UIIPZpy4Mg=
-cloud.google.com/go/automl v1.13.3/go.mod h1:Y8KwvyAZFOsMAPqUCfNu1AyclbC6ivCUF/MTwORymyY=
-cloud.google.com/go/automl v1.13.4/go.mod h1:ULqwX/OLZ4hBVfKQaMtxMSTlPx0GqGbWN8uA/1EqCP8=
 cloud.google.com/go/baremetalsolution v0.3.0/go.mod h1:XOrocE+pvK1xFfleEnShBlNAXf+j5blPPxrhjKgnIFc=
 cloud.google.com/go/baremetalsolution v0.4.0/go.mod h1:BymplhAadOO/eBa7KewQ0Ppg4A4Wplbn+PsFKRLo0uI=
 cloud.google.com/go/baremetalsolution v0.5.0/go.mod h1:dXGxEkmR9BMwxhzBhV0AioD0ULBmuLZI8CdwalUxuss=
-cloud.google.com/go/baremetalsolution v1.1.1/go.mod h1:D1AV6xwOksJMV4OSlWHtWuFNZZYujJknMAP4Qa27QIA=
-cloud.google.com/go/baremetalsolution v1.2.0/go.mod h1:68wi9AwPYkEWIUT4SvSGS9UJwKzNpshjHsH4lzk8iOw=
-cloud.google.com/go/baremetalsolution v1.2.1/go.mod h1:3qKpKIw12RPXStwQXcbhfxVj1dqQGEvcmA+SX/mUR88=
-cloud.google.com/go/baremetalsolution v1.2.2/go.mod h1:O5V6Uu1vzVelYahKfwEWRMaS3AbCkeYHy3145s1FkhM=
-cloud.google.com/go/baremetalsolution v1.2.3/go.mod h1:/UAQ5xG3faDdy180rCUv47e0jvpp3BFxT+Cl0PFjw5g=
 cloud.google.com/go/batch v0.3.0/go.mod h1:TR18ZoAekj1GuirsUsR1ZTKN3FC/4UDnScjT8NXImFE=
 cloud.google.com/go/batch v0.4.0/go.mod h1:WZkHnP43R/QCGQsZ+0JyG4i79ranE2u8xvjq/9+STPE=
 cloud.google.com/go/batch v0.7.0/go.mod h1:vLZN95s6teRUqRQ4s3RLDsH8PvboqBK+rn1oevL159g=
-cloud.google.com/go/batch v1.3.1/go.mod h1:VguXeQKXIYaeeIYbuozUmBR13AfL4SJP7IltNPS+A4A=
-cloud.google.com/go/batch v1.4.1/go.mod h1:KdBmDD61K0ovcxoRHGrN6GmOBWeAOyCgKD0Mugx4Fkk=
-cloud.google.com/go/batch v1.5.0/go.mod h1:KdBmDD61K0ovcxoRHGrN6GmOBWeAOyCgKD0Mugx4Fkk=
-cloud.google.com/go/batch v1.5.1/go.mod h1:RpBuIYLkQu8+CWDk3dFD/t/jOCGuUpkpX+Y0n1Xccs8=
-cloud.google.com/go/batch v1.6.1/go.mod h1:urdpD13zPe6YOK+6iZs/8/x2VBRofvblLpx0t57vM98=
-cloud.google.com/go/batch v1.6.3/go.mod h1:J64gD4vsNSA2O5TtDB5AAux3nJ9iV8U3ilg3JDBYejU=
 cloud.google.com/go/beyondcorp v0.2.0/go.mod h1:TB7Bd+EEtcw9PCPQhCJtJGjk/7TC6ckmnSFS+xwTfm4=
 cloud.google.com/go/beyondcorp v0.3.0/go.mod h1:E5U5lcrcXMsCuoDNyGrpyTm/hn7ne941Jz2vmksAxW8=
 cloud.google.com/go/beyondcorp v0.4.0/go.mod h1:3ApA0mbhHx6YImmuubf5pyW8srKnCEPON32/5hj+RmM=
 cloud.google.com/go/beyondcorp v0.5.0/go.mod h1:uFqj9X+dSfrheVp7ssLTaRHd2EHqSL4QZmH4e8WXGGU=
-cloud.google.com/go/beyondcorp v0.6.1/go.mod h1:YhxDWw946SCbmcWo3fAhw3V4XZMSpQ/VYfcKGAEU8/4=
-cloud.google.com/go/beyondcorp v1.0.0/go.mod h1:YhxDWw946SCbmcWo3fAhw3V4XZMSpQ/VYfcKGAEU8/4=
-cloud.google.com/go/beyondcorp v1.0.1/go.mod h1:zl/rWWAFVeV+kx+X2Javly7o1EIQThU4WlkynffL/lk=
-cloud.google.com/go/beyondcorp v1.0.2/go.mod h1:m8cpG7caD+5su+1eZr+TSvF6r21NdLJk4f9u4SP2Ntc=
-cloud.google.com/go/beyondcorp v1.0.3/go.mod h1:HcBvnEd7eYr+HGDd5ZbuVmBYX019C6CEXBonXbCVwJo=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
@@ -212,68 +134,32 @@ cloud.google.com/go/bigquery v1.47.0/go.mod h1:sA9XOgy0A8vQK9+MWhEQTY6Tix87M/Zur
 cloud.google.com/go/bigquery v1.48.0/go.mod h1:QAwSz+ipNgfL5jxiaK7weyOhzdoAy1zFm0Nf1fysJac=
 cloud.google.com/go/bigquery v1.49.0/go.mod h1:Sv8hMmTFFYBlt/ftw2uN6dFdQPzBlREY9yBh7Oy7/4Q=
 cloud.google.com/go/bigquery v1.50.0/go.mod h1:YrleYEh2pSEbgTBZYMJ5SuSr0ML3ypjRB1zgf7pvQLU=
-cloud.google.com/go/bigquery v1.52.0/go.mod h1:3b/iXjRQGU4nKa87cXeg6/gogLjO8C6PmuM8i5Bi/u4=
-cloud.google.com/go/bigquery v1.53.0/go.mod h1:3b/iXjRQGU4nKa87cXeg6/gogLjO8C6PmuM8i5Bi/u4=
-cloud.google.com/go/bigquery v1.55.0/go.mod h1:9Y5I3PN9kQWuid6183JFhOGOW3GcirA5LpsKCUn+2ec=
-cloud.google.com/go/bigquery v1.56.0/go.mod h1:KDcsploXTEY7XT3fDQzMUZlpQLHzE4itubHrnmhUrZA=
-cloud.google.com/go/bigquery v1.57.1/go.mod h1:iYzC0tGVWt1jqSzBHqCr3lrRn0u13E8e+AqowBsDgug=
 cloud.google.com/go/billing v1.4.0/go.mod h1:g9IdKBEFlItS8bTtlrZdVLWSSdSyFUZKXNS02zKMOZY=
 cloud.google.com/go/billing v1.5.0/go.mod h1:mztb1tBc3QekhjSgmpf/CV4LzWXLzCArwpLmP2Gm88s=
 cloud.google.com/go/billing v1.6.0/go.mod h1:WoXzguj+BeHXPbKfNWkqVtDdzORazmCjraY+vrxcyvI=
 cloud.google.com/go/billing v1.7.0/go.mod h1:q457N3Hbj9lYwwRbnlD7vUpyjq6u5U1RAOArInEiD5Y=
 cloud.google.com/go/billing v1.12.0/go.mod h1:yKrZio/eu+okO/2McZEbch17O5CB5NpZhhXG6Z766ss=
 cloud.google.com/go/billing v1.13.0/go.mod h1:7kB2W9Xf98hP9Sr12KfECgfGclsH3CQR0R08tnRlRbc=
-cloud.google.com/go/billing v1.16.0/go.mod h1:y8vx09JSSJG02k5QxbycNRrN7FGZB6F3CAcgum7jvGA=
-cloud.google.com/go/billing v1.17.0/go.mod h1:Z9+vZXEq+HwH7bhJkyI4OQcR6TSbeMrjlpEjO2vzY64=
-cloud.google.com/go/billing v1.17.1/go.mod h1:Z9+vZXEq+HwH7bhJkyI4OQcR6TSbeMrjlpEjO2vzY64=
-cloud.google.com/go/billing v1.17.2/go.mod h1:u/AdV/3wr3xoRBk5xvUzYMS1IawOAPwQMuHgHMdljDg=
-cloud.google.com/go/billing v1.17.3/go.mod h1:z83AkoZ7mZwBGT3yTnt6rSGI1OOsHSIi6a5M3mJ8NaU=
-cloud.google.com/go/billing v1.17.4/go.mod h1:5DOYQStCxquGprqfuid/7haD7th74kyMBHkjO/OvDtk=
 cloud.google.com/go/binaryauthorization v1.1.0/go.mod h1:xwnoWu3Y84jbuHa0zd526MJYmtnVXn0syOjaJgy4+dM=
 cloud.google.com/go/binaryauthorization v1.2.0/go.mod h1:86WKkJHtRcv5ViNABtYMhhNWRrD1Vpi//uKEy7aYEfI=
 cloud.google.com/go/binaryauthorization v1.3.0/go.mod h1:lRZbKgjDIIQvzYQS1p99A7/U1JqvqeZg0wiI5tp6tg0=
 cloud.google.com/go/binaryauthorization v1.4.0/go.mod h1:tsSPQrBd77VLplV70GUhBf/Zm3FsKmgSqgm4UmiDItk=
 cloud.google.com/go/binaryauthorization v1.5.0/go.mod h1:OSe4OU1nN/VswXKRBmciKpo9LulY41gch5c68htf3/Q=
-cloud.google.com/go/binaryauthorization v1.6.1/go.mod h1:TKt4pa8xhowwffiBmbrbcxijJRZED4zrqnwZ1lKH51U=
-cloud.google.com/go/binaryauthorization v1.7.0/go.mod h1:Zn+S6QqTMn6odcMU1zDZCJxPjU2tZPV1oDl45lWY154=
-cloud.google.com/go/binaryauthorization v1.7.1/go.mod h1:GTAyfRWYgcbsP3NJogpV3yeunbUIjx2T9xVeYovtURE=
-cloud.google.com/go/binaryauthorization v1.7.2/go.mod h1:kFK5fQtxEp97m92ziy+hbu+uKocka1qRRL8MVJIgjv0=
-cloud.google.com/go/binaryauthorization v1.7.3/go.mod h1:VQ/nUGRKhrStlGr+8GMS8f6/vznYLkdK5vaKfdCIpvU=
 cloud.google.com/go/certificatemanager v1.3.0/go.mod h1:n6twGDvcUBFu9uBgt4eYvvf3sQ6My8jADcOVwHmzadg=
 cloud.google.com/go/certificatemanager v1.4.0/go.mod h1:vowpercVFyqs8ABSmrdV+GiFf2H/ch3KyudYQEMM590=
 cloud.google.com/go/certificatemanager v1.6.0/go.mod h1:3Hh64rCKjRAX8dXgRAyOcY5vQ/fE1sh8o+Mdd6KPgY8=
-cloud.google.com/go/certificatemanager v1.7.1/go.mod h1:iW8J3nG6SaRYImIa+wXQ0g8IgoofDFRp5UMzaNk1UqI=
-cloud.google.com/go/certificatemanager v1.7.2/go.mod h1:15SYTDQMd00kdoW0+XY5d9e+JbOPjp24AvF48D8BbcQ=
-cloud.google.com/go/certificatemanager v1.7.3/go.mod h1:T/sZYuC30PTag0TLo28VedIRIj1KPGcOQzjWAptHa00=
-cloud.google.com/go/certificatemanager v1.7.4/go.mod h1:FHAylPe/6IIKuaRmHbjbdLhGhVQ+CWHSD5Jq0k4+cCE=
 cloud.google.com/go/channel v1.8.0/go.mod h1:W5SwCXDJsq/rg3tn3oG0LOxpAo6IMxNa09ngphpSlnk=
 cloud.google.com/go/channel v1.9.0/go.mod h1:jcu05W0my9Vx4mt3/rEHpfxc9eKi9XwsdDL8yBMbKUk=
 cloud.google.com/go/channel v1.11.0/go.mod h1:IdtI0uWGqhEeatSB62VOoJ8FSUhJ9/+iGkJVqp74CGE=
 cloud.google.com/go/channel v1.12.0/go.mod h1:VkxCGKASi4Cq7TbXxlaBezonAYpp1GCnKMY6tnMQnLU=
-cloud.google.com/go/channel v1.16.0/go.mod h1:eN/q1PFSl5gyu0dYdmxNXscY/4Fi7ABmeHCJNf/oHmc=
-cloud.google.com/go/channel v1.17.0/go.mod h1:RpbhJsGi/lXWAUM1eF4IbQGbsfVlg2o8Iiy2/YLfVT0=
-cloud.google.com/go/channel v1.17.1/go.mod h1:xqfzcOZAcP4b/hUDH0GkGg1Sd5to6di1HOJn/pi5uBQ=
-cloud.google.com/go/channel v1.17.2/go.mod h1:aT2LhnftnyfQceFql5I/mP8mIbiiJS4lWqgXA815zMk=
-cloud.google.com/go/channel v1.17.3/go.mod h1:QcEBuZLGGrUMm7kNj9IbU1ZfmJq2apotsV83hbxX7eE=
 cloud.google.com/go/cloudbuild v1.3.0/go.mod h1:WequR4ULxlqvMsjDEEEFnOG5ZSRSgWOywXYDb1vPE6U=
 cloud.google.com/go/cloudbuild v1.4.0/go.mod h1:5Qwa40LHiOXmz3386FrjrYM93rM/hdRr7b53sySrTqA=
 cloud.google.com/go/cloudbuild v1.6.0/go.mod h1:UIbc/w9QCbH12xX+ezUsgblrWv+Cv4Tw83GiSMHOn9M=
 cloud.google.com/go/cloudbuild v1.7.0/go.mod h1:zb5tWh2XI6lR9zQmsm1VRA+7OCuve5d8S+zJUul8KTg=
 cloud.google.com/go/cloudbuild v1.9.0/go.mod h1:qK1d7s4QlO0VwfYn5YuClDGg2hfmLZEb4wQGAbIgL1s=
-cloud.google.com/go/cloudbuild v1.10.1/go.mod h1:lyJg7v97SUIPq4RC2sGsz/9tNczhyv2AjML/ci4ulzU=
-cloud.google.com/go/cloudbuild v1.13.0/go.mod h1:lyJg7v97SUIPq4RC2sGsz/9tNczhyv2AjML/ci4ulzU=
-cloud.google.com/go/cloudbuild v1.14.0/go.mod h1:lyJg7v97SUIPq4RC2sGsz/9tNczhyv2AjML/ci4ulzU=
-cloud.google.com/go/cloudbuild v1.14.1/go.mod h1:K7wGc/3zfvmYWOWwYTgF/d/UVJhS4pu+HAy7PL7mCsU=
-cloud.google.com/go/cloudbuild v1.14.2/go.mod h1:Bn6RO0mBYk8Vlrt+8NLrru7WXlQ9/RDWz2uo5KG1/sg=
-cloud.google.com/go/cloudbuild v1.14.3/go.mod h1:eIXYWmRt3UtggLnFGx4JvXcMj4kShhVzGndL1LwleEM=
 cloud.google.com/go/clouddms v1.3.0/go.mod h1:oK6XsCDdW4Ib3jCCBugx+gVjevp2TMXFtgxvPSee3OM=
 cloud.google.com/go/clouddms v1.4.0/go.mod h1:Eh7sUGCC+aKry14O1NRljhjyrr0NFC0G2cjwX0cByRk=
 cloud.google.com/go/clouddms v1.5.0/go.mod h1:QSxQnhikCLUw13iAbffF2CZxAER3xDGNHjsTAkQJcQA=
-cloud.google.com/go/clouddms v1.6.1/go.mod h1:Ygo1vL52Ov4TBZQquhz5fiw2CQ58gvu+PlS6PVXCpZI=
-cloud.google.com/go/clouddms v1.7.0/go.mod h1:MW1dC6SOtI/tPNCciTsXtsGNEM0i0OccykPvv3hiYeM=
-cloud.google.com/go/clouddms v1.7.1/go.mod h1:o4SR8U95+P7gZ/TX+YbJxehOCsM+fe6/brlrFquiszk=
-cloud.google.com/go/clouddms v1.7.2/go.mod h1:Rk32TmWmHo64XqDvW7jgkFQet1tUKNVzs7oajtJT3jU=
-cloud.google.com/go/clouddms v1.7.3/go.mod h1:fkN2HQQNUYInAU3NQ3vRLkV2iWs8lIdmBKOx4nrL6Hc=
 cloud.google.com/go/cloudsqlconn v1.4.3 h1:/WYFbB1NtMtoMxCbqpzzTFPDkxxlLTPme390KEGaEPc=
 cloud.google.com/go/cloudsqlconn v1.4.3/go.mod h1:QL3tuStVOO70txb3rs4G8j5uMfo5ztZii8K3oGD3VYA=
 cloud.google.com/go/cloudtasks v1.5.0/go.mod h1:fD92REy1x5woxkKEkLdvavGnPJGEn8Uic9nWuLzqCpY=
@@ -282,11 +168,6 @@ cloud.google.com/go/cloudtasks v1.7.0/go.mod h1:ImsfdYWwlWNJbdgPIIGJWC+gemEGTBK/
 cloud.google.com/go/cloudtasks v1.8.0/go.mod h1:gQXUIwCSOI4yPVK7DgTVFiiP0ZW/eQkydWzwVMdHxrI=
 cloud.google.com/go/cloudtasks v1.9.0/go.mod h1:w+EyLsVkLWHcOaqNEyvcKAsWp9p29dL6uL9Nst1cI7Y=
 cloud.google.com/go/cloudtasks v1.10.0/go.mod h1:NDSoTLkZ3+vExFEWu2UJV1arUyzVDAiZtdWcsUyNwBs=
-cloud.google.com/go/cloudtasks v1.11.1/go.mod h1:a9udmnou9KO2iulGscKR0qBYjreuX8oHwpmFsKspEvM=
-cloud.google.com/go/cloudtasks v1.12.1/go.mod h1:a9udmnou9KO2iulGscKR0qBYjreuX8oHwpmFsKspEvM=
-cloud.google.com/go/cloudtasks v1.12.2/go.mod h1:A7nYkjNlW2gUoROg1kvJrQGhJP/38UaWwsnuBDOBVUk=
-cloud.google.com/go/cloudtasks v1.12.3/go.mod h1:GPVXhIOSGEaR+3xT4Fp72ScI+HjHffSS4B8+BaBB5Ys=
-cloud.google.com/go/cloudtasks v1.12.4/go.mod h1:BEPu0Gtt2dU6FxZHNqqNdGqIG86qyWKBPGnsb7udGY0=
 cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
 cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJWM7YD99wM=
 cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
@@ -302,48 +183,24 @@ cloud.google.com/go/compute v1.15.1/go.mod h1:bjjoF/NtFUrkD/urWfdHaKuOPDR5nWIs63
 cloud.google.com/go/compute v1.18.0/go.mod h1:1X7yHxec2Ga+Ss6jPyjxRxpu2uu7PLgsOVXvgU0yacs=
 cloud.google.com/go/compute v1.19.0/go.mod h1:rikpw2y+UMidAe9tISo04EHNOIf42RLYF/q8Bs93scU=
 cloud.google.com/go/compute v1.19.1/go.mod h1:6ylj3a05WF8leseCdIf77NK0g1ey+nj5IKd5/kvShxE=
-cloud.google.com/go/compute v1.19.3/go.mod h1:qxvISKp/gYnXkSAD1ppcSOveRAmzxicEv/JlizULFrI=
-cloud.google.com/go/compute v1.20.1/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
-cloud.google.com/go/compute v1.21.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
-cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
-cloud.google.com/go/compute v1.23.1/go.mod h1:CqB3xpmPKKt3OJpW2ndFIXnA9A4xAy/F3Xp1ixncW78=
-cloud.google.com/go/compute v1.23.2/go.mod h1:JJ0atRC0J/oWYiiVBmsSsrRnh92DhZPG4hFDcR04Rns=
-cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
-cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
 cloud.google.com/go/compute/metadata v0.1.0/go.mod h1:Z1VN+bulIf6bt4P/C37K4DyZYZEXYonfTBHHFPO/4UU=
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
+cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
+cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 cloud.google.com/go/contactcenterinsights v1.3.0/go.mod h1:Eu2oemoePuEFc/xKFPjbTuPSj0fYJcPls9TFlPNnHHY=
 cloud.google.com/go/contactcenterinsights v1.4.0/go.mod h1:L2YzkGbPsv+vMQMCADxJoT9YiTTnSEd6fEvCeHTYVck=
 cloud.google.com/go/contactcenterinsights v1.6.0/go.mod h1:IIDlT6CLcDoyv79kDv8iWxMSTZhLxSCofVV5W6YFM/w=
-cloud.google.com/go/contactcenterinsights v1.9.1/go.mod h1:bsg/R7zGLYMVxFFzfh9ooLTruLRCG9fnzhH9KznHhbM=
-cloud.google.com/go/contactcenterinsights v1.10.0/go.mod h1:bsg/R7zGLYMVxFFzfh9ooLTruLRCG9fnzhH9KznHhbM=
-cloud.google.com/go/contactcenterinsights v1.11.0/go.mod h1:hutBdImE4XNZ1NV4vbPJKSFOnQruhC5Lj9bZqWMTKiU=
-cloud.google.com/go/contactcenterinsights v1.11.1/go.mod h1:FeNP3Kg8iteKM80lMwSk3zZZKVxr+PGnAId6soKuXwE=
-cloud.google.com/go/contactcenterinsights v1.11.2/go.mod h1:A9PIR5ov5cRcd28KlDbmmXE8Aay+Gccer2h4wzkYFso=
-cloud.google.com/go/contactcenterinsights v1.11.3/go.mod h1:HHX5wrz5LHVAwfI2smIotQG9x8Qd6gYilaHcLLLmNis=
 cloud.google.com/go/container v1.6.0/go.mod h1:Xazp7GjJSeUYo688S+6J5V+n/t+G5sKBTFkKNudGRxg=
 cloud.google.com/go/container v1.7.0/go.mod h1:Dp5AHtmothHGX3DwwIHPgq45Y8KmNsgN3amoYfxVkLo=
 cloud.google.com/go/container v1.13.1/go.mod h1:6wgbMPeQRw9rSnKBCAJXnds3Pzj03C4JHamr8asWKy4=
 cloud.google.com/go/container v1.14.0/go.mod h1:3AoJMPhHfLDxLvrlVWaK57IXzaPnLaZq63WX59aQBfM=
 cloud.google.com/go/container v1.15.0/go.mod h1:ft+9S0WGjAyjDggg5S06DXj+fHJICWg8L7isCQe9pQA=
-cloud.google.com/go/container v1.22.1/go.mod h1:lTNExE2R7f+DLbAN+rJiKTisauFCaoDq6NURZ83eVH4=
-cloud.google.com/go/container v1.24.0/go.mod h1:lTNExE2R7f+DLbAN+rJiKTisauFCaoDq6NURZ83eVH4=
-cloud.google.com/go/container v1.26.0/go.mod h1:YJCmRet6+6jnYYRS000T6k0D0xUXQgBSaJ7VwI8FBj4=
-cloud.google.com/go/container v1.26.1/go.mod h1:5smONjPRUxeEpDG7bMKWfDL4sauswqEtnBK1/KKpR04=
-cloud.google.com/go/container v1.26.2/go.mod h1:YlO84xCt5xupVbLaMY4s3XNE79MUJ+49VmkInr6HvF4=
-cloud.google.com/go/container v1.27.1/go.mod h1:b1A1gJeTBXVLQ6GGw9/9M4FG94BEGsqJ5+t4d/3N7O4=
 cloud.google.com/go/containeranalysis v0.5.1/go.mod h1:1D92jd8gRR/c0fGMlymRgxWD3Qw9C1ff6/T7mLgVL8I=
 cloud.google.com/go/containeranalysis v0.6.0/go.mod h1:HEJoiEIu+lEXM+k7+qLCci0h33lX3ZqoYFdmPcoO7s4=
 cloud.google.com/go/containeranalysis v0.7.0/go.mod h1:9aUL+/vZ55P2CXfuZjS4UjQ9AgXoSw8Ts6lemfmxBxI=
 cloud.google.com/go/containeranalysis v0.9.0/go.mod h1:orbOANbwk5Ejoom+s+DUCTTJ7IBdBQJDcSylAx/on9s=
-cloud.google.com/go/containeranalysis v0.10.1/go.mod h1:Ya2jiILITMY68ZLPaogjmOMNkwsDrWBSTyBubGXO7j0=
-cloud.google.com/go/containeranalysis v0.11.0/go.mod h1:4n2e99ZwpGxpNcz+YsFT1dfOHPQFGcAC8FN2M2/ne/U=
-cloud.google.com/go/containeranalysis v0.11.1/go.mod h1:rYlUOM7nem1OJMKwE1SadufX0JP3wnXj844EtZAwWLY=
-cloud.google.com/go/containeranalysis v0.11.2/go.mod h1:xibioGBC1MD2j4reTyV1xY1/MvKaz+fyM9ENWhmIeP8=
-cloud.google.com/go/containeranalysis v0.11.3/go.mod h1:kMeST7yWFQMGjiG9K7Eov+fPNQcGhb8mXj/UcTiWw9U=
 cloud.google.com/go/datacatalog v1.3.0/go.mod h1:g9svFY6tuR+j+hrTw3J2dNcmI0dzmSiyOzm8kpLq0a0=
 cloud.google.com/go/datacatalog v1.5.0/go.mod h1:M7GPLNQeLfWqeIm3iuiruhPzkt65+Bx8dAKvScX8jvs=
 cloud.google.com/go/datacatalog v1.6.0/go.mod h1:+aEyF8JKg+uXcIdAmmaMUmZ3q1b/lKLtXCmXdnc0lbc=
@@ -352,98 +209,44 @@ cloud.google.com/go/datacatalog v1.8.0/go.mod h1:KYuoVOv9BM8EYz/4eMFxrr4DUKhGIOX
 cloud.google.com/go/datacatalog v1.8.1/go.mod h1:RJ58z4rMp3gvETA465Vg+ag8BGgBdnRPEMMSTr5Uv+M=
 cloud.google.com/go/datacatalog v1.12.0/go.mod h1:CWae8rFkfp6LzLumKOnmVh4+Zle4A3NXLzVJ1d1mRm0=
 cloud.google.com/go/datacatalog v1.13.0/go.mod h1:E4Rj9a5ZtAxcQJlEBTLgMTphfP11/lNaAshpoBgemX8=
-cloud.google.com/go/datacatalog v1.14.0/go.mod h1:h0PrGtlihoutNMp/uvwhawLQ9+c63Kz65UFqh49Yo+E=
-cloud.google.com/go/datacatalog v1.14.1/go.mod h1:d2CevwTG4yedZilwe+v3E3ZBDRMobQfSG/a6cCCN5R4=
-cloud.google.com/go/datacatalog v1.16.0/go.mod h1:d2CevwTG4yedZilwe+v3E3ZBDRMobQfSG/a6cCCN5R4=
-cloud.google.com/go/datacatalog v1.17.1/go.mod h1:nCSYFHgtxh2MiEktWIz71s/X+7ds/UT9kp0PC7waCzE=
-cloud.google.com/go/datacatalog v1.18.0/go.mod h1:nCSYFHgtxh2MiEktWIz71s/X+7ds/UT9kp0PC7waCzE=
-cloud.google.com/go/datacatalog v1.18.1/go.mod h1:TzAWaz+ON1tkNr4MOcak8EBHX7wIRX/gZKM+yTVsv+A=
-cloud.google.com/go/datacatalog v1.18.2/go.mod h1:SPVgWW2WEMuWHA+fHodYjmxPiMqcOiWfhc9OD5msigk=
-cloud.google.com/go/datacatalog v1.18.3/go.mod h1:5FR6ZIF8RZrtml0VUao22FxhdjkoG+a0866rEnObryM=
 cloud.google.com/go/dataflow v0.6.0/go.mod h1:9QwV89cGoxjjSR9/r7eFDqqjtvbKxAK2BaYU6PVk9UM=
 cloud.google.com/go/dataflow v0.7.0/go.mod h1:PX526vb4ijFMesO1o202EaUmouZKBpjHsTlCtB4parQ=
 cloud.google.com/go/dataflow v0.8.0/go.mod h1:Rcf5YgTKPtQyYz8bLYhFoIV/vP39eL7fWNcSOyFfLJE=
-cloud.google.com/go/dataflow v0.9.1/go.mod h1:Wp7s32QjYuQDWqJPFFlnBKhkAtiFpMTdg00qGbnIHVw=
-cloud.google.com/go/dataflow v0.9.2/go.mod h1:vBfdBZ/ejlTaYIGB3zB4T08UshH70vbtZeMD+urnUSo=
-cloud.google.com/go/dataflow v0.9.3/go.mod h1:HI4kMVjcHGTs3jTHW/kv3501YW+eloiJSLxkJa/vqFE=
-cloud.google.com/go/dataflow v0.9.4/go.mod h1:4G8vAkHYCSzU8b/kmsoR2lWyHJD85oMJPHMtan40K8w=
 cloud.google.com/go/dataform v0.3.0/go.mod h1:cj8uNliRlHpa6L3yVhDOBrUXH+BPAO1+KFMQQNSThKo=
 cloud.google.com/go/dataform v0.4.0/go.mod h1:fwV6Y4Ty2yIFL89huYlEkwUPtS7YZinZbzzj5S9FzCE=
 cloud.google.com/go/dataform v0.5.0/go.mod h1:GFUYRe8IBa2hcomWplodVmUx/iTL0FrsauObOM3Ipr0=
 cloud.google.com/go/dataform v0.6.0/go.mod h1:QPflImQy33e29VuapFdf19oPbE4aYTJxr31OAPV+ulA=
 cloud.google.com/go/dataform v0.7.0/go.mod h1:7NulqnVozfHvWUBpMDfKMUESr+85aJsC/2O0o3jWPDE=
-cloud.google.com/go/dataform v0.8.1/go.mod h1:3BhPSiw8xmppbgzeBbmDvmSWlwouuJkXsXsb8UBih9M=
-cloud.google.com/go/dataform v0.8.2/go.mod h1:X9RIqDs6NbGPLR80tnYoPNiO1w0wenKTb8PxxlhTMKM=
-cloud.google.com/go/dataform v0.8.3/go.mod h1:8nI/tvv5Fso0drO3pEjtowz58lodx8MVkdV2q0aPlqg=
-cloud.google.com/go/dataform v0.9.1/go.mod h1:pWTg+zGQ7i16pyn0bS1ruqIE91SdL2FDMvEYu/8oQxs=
 cloud.google.com/go/datafusion v1.4.0/go.mod h1:1Zb6VN+W6ALo85cXnM1IKiPw+yQMKMhB9TsTSRDo/38=
 cloud.google.com/go/datafusion v1.5.0/go.mod h1:Kz+l1FGHB0J+4XF2fud96WMmRiq/wj8N9u007vyXZ2w=
 cloud.google.com/go/datafusion v1.6.0/go.mod h1:WBsMF8F1RhSXvVM8rCV3AeyWVxcC2xY6vith3iw3S+8=
-cloud.google.com/go/datafusion v1.7.1/go.mod h1:KpoTBbFmoToDExJUso/fcCiguGDk7MEzOWXUsJo0wsI=
-cloud.google.com/go/datafusion v1.7.2/go.mod h1:62K2NEC6DRlpNmI43WHMWf9Vg/YvN6QVi8EVwifElI0=
-cloud.google.com/go/datafusion v1.7.3/go.mod h1:eoLt1uFXKGBq48jy9LZ+Is8EAVLnmn50lNncLzwYokE=
-cloud.google.com/go/datafusion v1.7.4/go.mod h1:BBs78WTOLYkT4GVZIXQCZT3GFpkpDN4aBY4NDX/jVlM=
 cloud.google.com/go/datalabeling v0.5.0/go.mod h1:TGcJ0G2NzcsXSE/97yWjIZO0bXj0KbVlINXMG9ud42I=
 cloud.google.com/go/datalabeling v0.6.0/go.mod h1:WqdISuk/+WIGeMkpw/1q7bK/tFEZxsrFJOJdY2bXvTQ=
 cloud.google.com/go/datalabeling v0.7.0/go.mod h1:WPQb1y08RJbmpM3ww0CSUAGweL0SxByuW2E+FU+wXcM=
-cloud.google.com/go/datalabeling v0.8.1/go.mod h1:XS62LBSVPbYR54GfYQsPXZjTW8UxCK2fkDciSrpRFdY=
-cloud.google.com/go/datalabeling v0.8.2/go.mod h1:cyDvGHuJWu9U/cLDA7d8sb9a0tWLEletStu2sTmg3BE=
-cloud.google.com/go/datalabeling v0.8.3/go.mod h1:tvPhpGyS/V7lqjmb3V0TaDdGvhzgR1JoW7G2bpi2UTI=
-cloud.google.com/go/datalabeling v0.8.4/go.mod h1:Z1z3E6LHtffBGrNUkKwbwbDxTiXEApLzIgmymj8A3S8=
 cloud.google.com/go/dataplex v1.3.0/go.mod h1:hQuRtDg+fCiFgC8j0zV222HvzFQdRd+SVX8gdmFcZzA=
 cloud.google.com/go/dataplex v1.4.0/go.mod h1:X51GfLXEMVJ6UN47ESVqvlsRplbLhcsAt0kZCCKsU0A=
 cloud.google.com/go/dataplex v1.5.2/go.mod h1:cVMgQHsmfRoI5KFYq4JtIBEUbYwc3c7tXmIDhRmNNVQ=
 cloud.google.com/go/dataplex v1.6.0/go.mod h1:bMsomC/aEJOSpHXdFKFGQ1b0TDPIeL28nJObeO1ppRs=
-cloud.google.com/go/dataplex v1.8.1/go.mod h1:7TyrDT6BCdI8/38Uvp0/ZxBslOslP2X2MPDucliyvSE=
-cloud.google.com/go/dataplex v1.9.0/go.mod h1:7TyrDT6BCdI8/38Uvp0/ZxBslOslP2X2MPDucliyvSE=
-cloud.google.com/go/dataplex v1.9.1/go.mod h1:7TyrDT6BCdI8/38Uvp0/ZxBslOslP2X2MPDucliyvSE=
-cloud.google.com/go/dataplex v1.10.1/go.mod h1:1MzmBv8FvjYfc7vDdxhnLFNskikkB+3vl475/XdCDhs=
-cloud.google.com/go/dataplex v1.10.2/go.mod h1:xdC8URdTrCrZMW6keY779ZT1cTOfV8KEPNsw+LTRT1Y=
-cloud.google.com/go/dataplex v1.11.1/go.mod h1:mHJYQQ2VEJHsyoC0OdNyy988DvEbPhqFs5OOLffLX0c=
 cloud.google.com/go/dataproc v1.7.0/go.mod h1:CKAlMjII9H90RXaMpSxQ8EU6dQx6iAYNPcYPOkSbi8s=
 cloud.google.com/go/dataproc v1.8.0/go.mod h1:5OW+zNAH0pMpw14JVrPONsxMQYMBqJuzORhIBfBn9uI=
 cloud.google.com/go/dataproc v1.12.0/go.mod h1:zrF3aX0uV3ikkMz6z4uBbIKyhRITnxvr4i3IjKsKrw4=
-cloud.google.com/go/dataproc/v2 v2.0.1/go.mod h1:7Ez3KRHdFGcfY7GcevBbvozX+zyWGcwLJvvAMwCaoZ4=
-cloud.google.com/go/dataproc/v2 v2.2.0/go.mod h1:lZR7AQtwZPvmINx5J87DSOOpTfof9LVZju6/Qo4lmcY=
-cloud.google.com/go/dataproc/v2 v2.2.1/go.mod h1:QdAJLaBjh+l4PVlVZcmrmhGccosY/omC1qwfQ61Zv/o=
-cloud.google.com/go/dataproc/v2 v2.2.2/go.mod h1:aocQywVmQVF4i8CL740rNI/ZRpsaaC1Wh2++BJ7HEJ4=
-cloud.google.com/go/dataproc/v2 v2.2.3/go.mod h1:G5R6GBc9r36SXv/RtZIVfB8SipI+xVn0bX5SxUzVYbY=
 cloud.google.com/go/dataqna v0.5.0/go.mod h1:90Hyk596ft3zUQ8NkFfvICSIfHFh1Bc7C4cK3vbhkeo=
 cloud.google.com/go/dataqna v0.6.0/go.mod h1:1lqNpM7rqNLVgWBJyk5NF6Uen2PHym0jtVJonplVsDA=
 cloud.google.com/go/dataqna v0.7.0/go.mod h1:Lx9OcIIeqCrw1a6KdO3/5KMP1wAmTc0slZWwP12Qq3c=
-cloud.google.com/go/dataqna v0.8.1/go.mod h1:zxZM0Bl6liMePWsHA8RMGAfmTG34vJMapbHAxQ5+WA8=
-cloud.google.com/go/dataqna v0.8.2/go.mod h1:KNEqgx8TTmUipnQsScOoDpq/VlXVptUqVMZnt30WAPs=
-cloud.google.com/go/dataqna v0.8.3/go.mod h1:wXNBW2uvc9e7Gl5k8adyAMnLush1KVV6lZUhB+rqNu4=
-cloud.google.com/go/dataqna v0.8.4/go.mod h1:mySRKjKg5Lz784P6sCov3p1QD+RZQONRMRjzGNcFd0c=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/datastore v1.10.0/go.mod h1:PC5UzAmDEkAmkfaknstTYbNpgE49HAgW2J1gcgUfmdM=
 cloud.google.com/go/datastore v1.11.0/go.mod h1:TvGxBIHCS50u8jzG+AW/ppf87v1of8nwzFNgEZU1D3c=
-cloud.google.com/go/datastore v1.12.0/go.mod h1:KjdB88W897MRITkvWWJrg2OUtrR5XVj1EoLgSp6/N70=
-cloud.google.com/go/datastore v1.12.1/go.mod h1:KjdB88W897MRITkvWWJrg2OUtrR5XVj1EoLgSp6/N70=
-cloud.google.com/go/datastore v1.13.0/go.mod h1:KjdB88W897MRITkvWWJrg2OUtrR5XVj1EoLgSp6/N70=
-cloud.google.com/go/datastore v1.14.0/go.mod h1:GAeStMBIt9bPS7jMJA85kgkpsMkvseWWXiaHya9Jes8=
-cloud.google.com/go/datastore v1.15.0/go.mod h1:GAeStMBIt9bPS7jMJA85kgkpsMkvseWWXiaHya9Jes8=
 cloud.google.com/go/datastream v1.2.0/go.mod h1:i/uTP8/fZwgATHS/XFu0TcNUhuA0twZxxQ3EyCUQMwo=
 cloud.google.com/go/datastream v1.3.0/go.mod h1:cqlOX8xlyYF/uxhiKn6Hbv6WjwPPuI9W2M9SAXwaLLQ=
 cloud.google.com/go/datastream v1.4.0/go.mod h1:h9dpzScPhDTs5noEMQVWP8Wx8AFBRyS0s8KWPx/9r0g=
 cloud.google.com/go/datastream v1.5.0/go.mod h1:6TZMMNPwjUqZHBKPQ1wwXpb0d5VDVPl2/XoS5yi88q4=
 cloud.google.com/go/datastream v1.6.0/go.mod h1:6LQSuswqLa7S4rPAOZFVjHIG3wJIjZcZrw8JDEDJuIs=
 cloud.google.com/go/datastream v1.7.0/go.mod h1:uxVRMm2elUSPuh65IbZpzJNMbuzkcvu5CjMqVIUHrww=
-cloud.google.com/go/datastream v1.9.1/go.mod h1:hqnmr8kdUBmrnk65k5wNRoHSCYksvpdZIcZIEl8h43Q=
-cloud.google.com/go/datastream v1.10.0/go.mod h1:hqnmr8kdUBmrnk65k5wNRoHSCYksvpdZIcZIEl8h43Q=
-cloud.google.com/go/datastream v1.10.1/go.mod h1:7ngSYwnw95YFyTd5tOGBxHlOZiL+OtpjheqU7t2/s/c=
-cloud.google.com/go/datastream v1.10.2/go.mod h1:W42TFgKAs/om6x/CdXX5E4oiAsKlH+e8MTGy81zdYt0=
-cloud.google.com/go/datastream v1.10.3/go.mod h1:YR0USzgjhqA/Id0Ycu1VvZe8hEWwrkjuXrGbzeDOSEA=
 cloud.google.com/go/deploy v1.4.0/go.mod h1:5Xghikd4VrmMLNaF6FiRFDlHb59VM59YoDQnOUdsH/c=
 cloud.google.com/go/deploy v1.5.0/go.mod h1:ffgdD0B89tToyW/U/D2eL0jN2+IEV/3EMuXHA0l4r+s=
 cloud.google.com/go/deploy v1.6.0/go.mod h1:f9PTHehG/DjCom3QH0cntOVRm93uGBDt2vKzAPwpXQI=
 cloud.google.com/go/deploy v1.8.0/go.mod h1:z3myEJnA/2wnB4sgjqdMfgxCA0EqC3RBTNcVPs93mtQ=
-cloud.google.com/go/deploy v1.11.0/go.mod h1:tKuSUV5pXbn67KiubiUNUejqLs4f5cxxiCNCeyl0F2g=
-cloud.google.com/go/deploy v1.13.0/go.mod h1:tKuSUV5pXbn67KiubiUNUejqLs4f5cxxiCNCeyl0F2g=
-cloud.google.com/go/deploy v1.13.1/go.mod h1:8jeadyLkH9qu9xgO3hVWw8jVr29N1mnW42gRJT8GY6g=
-cloud.google.com/go/deploy v1.14.1/go.mod h1:N8S0b+aIHSEeSr5ORVoC0+/mOPUysVt8ae4QkZYolAw=
-cloud.google.com/go/deploy v1.14.2/go.mod h1:e5XOUI5D+YGldyLNZ21wbp9S8otJbBE4i88PtO9x/2g=
 cloud.google.com/go/dialogflow v1.15.0/go.mod h1:HbHDWs33WOGJgn6rfzBW1Kv807BE3O1+xGbn59zZWI4=
 cloud.google.com/go/dialogflow v1.16.1/go.mod h1:po6LlzGfK+smoSmTBnbkIZY2w8ffjz/RcGSS+sh1el0=
 cloud.google.com/go/dialogflow v1.17.0/go.mod h1:YNP09C/kXA1aZdBgC/VtXX74G/TKn7XVCcVumTflA+8=
@@ -452,79 +255,35 @@ cloud.google.com/go/dialogflow v1.19.0/go.mod h1:JVmlG1TwykZDtxtTXujec4tQ+D8SBFM
 cloud.google.com/go/dialogflow v1.29.0/go.mod h1:b+2bzMe+k1s9V+F2jbJwpHPzrnIyHihAdRFMtn2WXuM=
 cloud.google.com/go/dialogflow v1.31.0/go.mod h1:cuoUccuL1Z+HADhyIA7dci3N5zUssgpBJmCzI6fNRB4=
 cloud.google.com/go/dialogflow v1.32.0/go.mod h1:jG9TRJl8CKrDhMEcvfcfFkkpp8ZhgPz3sBGmAUYJ2qE=
-cloud.google.com/go/dialogflow v1.38.0/go.mod h1:L7jnH+JL2mtmdChzAIcXQHXMvQkE3U4hTaNltEuxXn4=
-cloud.google.com/go/dialogflow v1.40.0/go.mod h1:L7jnH+JL2mtmdChzAIcXQHXMvQkE3U4hTaNltEuxXn4=
-cloud.google.com/go/dialogflow v1.43.0/go.mod h1:pDUJdi4elL0MFmt1REMvFkdsUTYSHq+rTCS8wg0S3+M=
-cloud.google.com/go/dialogflow v1.44.0/go.mod h1:pDUJdi4elL0MFmt1REMvFkdsUTYSHq+rTCS8wg0S3+M=
-cloud.google.com/go/dialogflow v1.44.1/go.mod h1:n/h+/N2ouKOO+rbe/ZnI186xImpqvCVj2DdsWS/0EAk=
-cloud.google.com/go/dialogflow v1.44.2/go.mod h1:QzFYndeJhpVPElnFkUXxdlptx0wPnBWLCBT9BvtC3/c=
-cloud.google.com/go/dialogflow v1.44.3/go.mod h1:mHly4vU7cPXVweuB5R0zsYKPMzy240aQdAu06SqBbAQ=
 cloud.google.com/go/dlp v1.6.0/go.mod h1:9eyB2xIhpU0sVwUixfBubDoRwP+GjeUoxxeueZmqvmM=
 cloud.google.com/go/dlp v1.7.0/go.mod h1:68ak9vCiMBjbasxeVD17hVPxDEck+ExiHavX8kiHG+Q=
 cloud.google.com/go/dlp v1.9.0/go.mod h1:qdgmqgTyReTz5/YNSSuueR8pl7hO0o9bQ39ZhtgkWp4=
-cloud.google.com/go/dlp v1.10.1/go.mod h1:IM8BWz1iJd8njcNcG0+Kyd9OPnqnRNkDV8j42VT5KOI=
-cloud.google.com/go/dlp v1.10.2/go.mod h1:ZbdKIhcnyhILgccwVDzkwqybthh7+MplGC3kZVZsIOQ=
-cloud.google.com/go/dlp v1.10.3/go.mod h1:iUaTc/ln8I+QT6Ai5vmuwfw8fqTk2kaz0FvCwhLCom0=
-cloud.google.com/go/dlp v1.11.1/go.mod h1:/PA2EnioBeXTL/0hInwgj0rfsQb3lpE3R8XUJxqUNKI=
 cloud.google.com/go/documentai v1.7.0/go.mod h1:lJvftZB5NRiFSX4moiye1SMxHx0Bc3x1+p9e/RfXYiU=
 cloud.google.com/go/documentai v1.8.0/go.mod h1:xGHNEB7CtsnySCNrCFdCyyMz44RhFEEX2Q7UD0c5IhU=
 cloud.google.com/go/documentai v1.9.0/go.mod h1:FS5485S8R00U10GhgBC0aNGrJxBP8ZVpEeJ7PQDZd6k=
 cloud.google.com/go/documentai v1.10.0/go.mod h1:vod47hKQIPeCfN2QS/jULIvQTugbmdc0ZvxxfQY1bg4=
 cloud.google.com/go/documentai v1.16.0/go.mod h1:o0o0DLTEZ+YnJZ+J4wNfTxmDVyrkzFvttBXXtYRMHkM=
 cloud.google.com/go/documentai v1.18.0/go.mod h1:F6CK6iUH8J81FehpskRmhLq/3VlwQvb7TvwOceQ2tbs=
-cloud.google.com/go/documentai v1.20.0/go.mod h1:yJkInoMcK0qNAEdRnqY/D5asy73tnPe88I1YTZT+a8E=
-cloud.google.com/go/documentai v1.22.0/go.mod h1:yJkInoMcK0qNAEdRnqY/D5asy73tnPe88I1YTZT+a8E=
-cloud.google.com/go/documentai v1.22.1/go.mod h1:LKs22aDHbJv7ufXuPypzRO7rG3ALLJxzdCXDPutw4Qc=
-cloud.google.com/go/documentai v1.23.0/go.mod h1:LKs22aDHbJv7ufXuPypzRO7rG3ALLJxzdCXDPutw4Qc=
-cloud.google.com/go/documentai v1.23.2/go.mod h1:Q/wcRT+qnuXOpjAkvOV4A+IeQl04q2/ReT7SSbytLSo=
-cloud.google.com/go/documentai v1.23.4/go.mod h1:4MYAaEMnADPN1LPN5xboDR5QVB6AgsaxgFdJhitlE2Y=
-cloud.google.com/go/documentai v1.23.5/go.mod h1:ghzBsyVTiVdkfKaUCum/9bGBEyBjDO4GfooEcYKhN+g=
 cloud.google.com/go/domains v0.6.0/go.mod h1:T9Rz3GasrpYk6mEGHh4rymIhjlnIuB4ofT1wTxDeT4Y=
 cloud.google.com/go/domains v0.7.0/go.mod h1:PtZeqS1xjnXuRPKE/88Iru/LdfoRyEHYA9nFQf4UKpg=
 cloud.google.com/go/domains v0.8.0/go.mod h1:M9i3MMDzGFXsydri9/vW+EWz9sWb4I6WyHqdlAk0idE=
-cloud.google.com/go/domains v0.9.1/go.mod h1:aOp1c0MbejQQ2Pjf1iJvnVyT+z6R6s8pX66KaCSDYfE=
-cloud.google.com/go/domains v0.9.2/go.mod h1:3YvXGYzZG1Temjbk7EyGCuGGiXHJwVNmwIf+E/cUp5I=
-cloud.google.com/go/domains v0.9.3/go.mod h1:29k66YNDLDY9LCFKpGFeh6Nj9r62ZKm5EsUJxAl84KU=
-cloud.google.com/go/domains v0.9.4/go.mod h1:27jmJGShuXYdUNjyDG0SodTfT5RwLi7xmH334Gvi3fY=
 cloud.google.com/go/edgecontainer v0.1.0/go.mod h1:WgkZ9tp10bFxqO8BLPqv2LlfmQF1X8lZqwW4r1BTajk=
 cloud.google.com/go/edgecontainer v0.2.0/go.mod h1:RTmLijy+lGpQ7BXuTDa4C4ssxyXT34NIuHIgKuP4s5w=
 cloud.google.com/go/edgecontainer v0.3.0/go.mod h1:FLDpP4nykgwwIfcLt6zInhprzw0lEi2P1fjO6Ie0qbc=
 cloud.google.com/go/edgecontainer v1.0.0/go.mod h1:cttArqZpBB2q58W/upSG++ooo6EsblxDIolxa3jSjbY=
-cloud.google.com/go/edgecontainer v1.1.1/go.mod h1:O5bYcS//7MELQZs3+7mabRqoWQhXCzenBu0R8bz2rwk=
-cloud.google.com/go/edgecontainer v1.1.2/go.mod h1:wQRjIzqxEs9e9wrtle4hQPSR1Y51kqN75dgF7UllZZ4=
-cloud.google.com/go/edgecontainer v1.1.3/go.mod h1:Ll2DtIABzEfaxaVSbwj3QHFaOOovlDFiWVDu349jSsA=
-cloud.google.com/go/edgecontainer v1.1.4/go.mod h1:AvFdVuZuVGdgaE5YvlL1faAoa1ndRR/5XhXZvPBHbsE=
 cloud.google.com/go/errorreporting v0.3.0/go.mod h1:xsP2yaAp+OAW4OIm60An2bbLpqIhKXdWR/tawvl7QzU=
 cloud.google.com/go/essentialcontacts v1.3.0/go.mod h1:r+OnHa5jfj90qIfZDO/VztSFqbQan7HV75p8sA+mdGI=
 cloud.google.com/go/essentialcontacts v1.4.0/go.mod h1:8tRldvHYsmnBCHdFpvU+GL75oWiBKl80BiqlFh9tp+8=
 cloud.google.com/go/essentialcontacts v1.5.0/go.mod h1:ay29Z4zODTuwliK7SnX8E86aUF2CTzdNtvv42niCX0M=
-cloud.google.com/go/essentialcontacts v1.6.2/go.mod h1:T2tB6tX+TRak7i88Fb2N9Ok3PvY3UNbUsMag9/BARh4=
-cloud.google.com/go/essentialcontacts v1.6.3/go.mod h1:yiPCD7f2TkP82oJEFXFTou8Jl8L6LBRPeBEkTaO0Ggo=
-cloud.google.com/go/essentialcontacts v1.6.4/go.mod h1:iju5Vy3d9tJUg0PYMd1nHhjV7xoCXaOAVabrwLaPBEM=
-cloud.google.com/go/essentialcontacts v1.6.5/go.mod h1:jjYbPzw0x+yglXC890l6ECJWdYeZ5dlYACTFL0U/VuM=
 cloud.google.com/go/eventarc v1.7.0/go.mod h1:6ctpF3zTnaQCxUjHUdcfgcA1A2T309+omHZth7gDfmc=
 cloud.google.com/go/eventarc v1.8.0/go.mod h1:imbzxkyAU4ubfsaKYdQg04WS1NvncblHEup4kvF+4gw=
 cloud.google.com/go/eventarc v1.10.0/go.mod h1:u3R35tmZ9HvswGRBnF48IlYgYeBcPUCjkr4BTdem2Kw=
 cloud.google.com/go/eventarc v1.11.0/go.mod h1:PyUjsUKPWoRBCHeOxZd/lbOOjahV41icXyUY5kSTvVY=
-cloud.google.com/go/eventarc v1.12.1/go.mod h1:mAFCW6lukH5+IZjkvrEss+jmt2kOdYlN8aMx3sRJiAI=
-cloud.google.com/go/eventarc v1.13.0/go.mod h1:mAFCW6lukH5+IZjkvrEss+jmt2kOdYlN8aMx3sRJiAI=
-cloud.google.com/go/eventarc v1.13.1/go.mod h1:EqBxmGHFrruIara4FUQ3RHlgfCn7yo1HYsu2Hpt/C3Y=
-cloud.google.com/go/eventarc v1.13.2/go.mod h1:X9A80ShVu19fb4e5sc/OLV7mpFUKZMwfJFeeWhcIObM=
-cloud.google.com/go/eventarc v1.13.3/go.mod h1:RWH10IAZIRcj1s/vClXkBgMHwh59ts7hSWcqD3kaclg=
 cloud.google.com/go/filestore v1.3.0/go.mod h1:+qbvHGvXU1HaKX2nD0WEPo92TP/8AQuCVEBXNY9z0+w=
 cloud.google.com/go/filestore v1.4.0/go.mod h1:PaG5oDfo9r224f8OYXURtAsY+Fbyq/bLYoINEK8XQAI=
 cloud.google.com/go/filestore v1.5.0/go.mod h1:FqBXDWBp4YLHqRnVGveOkHDf8svj9r5+mUDLupOWEDs=
 cloud.google.com/go/filestore v1.6.0/go.mod h1:di5unNuss/qfZTw2U9nhFqo8/ZDSc466dre85Kydllg=
-cloud.google.com/go/filestore v1.7.1/go.mod h1:y10jsorq40JJnjR/lQ8AfFbbcGlw3g+Dp8oN7i7FjV4=
-cloud.google.com/go/filestore v1.7.2/go.mod h1:TYOlyJs25f/omgj+vY7/tIG/E7BX369triSPzE4LdgE=
-cloud.google.com/go/filestore v1.7.3/go.mod h1:Qp8WaEERR3cSkxToxFPHh/b8AACkSut+4qlCjAmKTV0=
-cloud.google.com/go/filestore v1.7.4/go.mod h1:S5JCxIbFjeBhWMTfIYH2Jx24J6BqjwpkkPl+nBA5DlI=
-cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
 cloud.google.com/go/firestore v1.9.0/go.mod h1:HMkjKHNTtRyZNiMzu7YAsLr9K3X2udY2AMwDaMEQiiE=
-cloud.google.com/go/firestore v1.11.0/go.mod h1:b38dKhgzlmNNGTNZZwe7ZRFEuRab1Hay3/DBsIGKKy4=
-cloud.google.com/go/firestore v1.12.0/go.mod h1:b38dKhgzlmNNGTNZZwe7ZRFEuRab1Hay3/DBsIGKKy4=
-cloud.google.com/go/firestore v1.13.0/go.mod h1:QojqqOh8IntInDUSTAh0c8ZsPYAr68Ma8c5DWOy8xb8=
-cloud.google.com/go/firestore v1.14.0/go.mod h1:96MVaHLsEhbvkBEdZgfN+AS/GIkco1LRpH9Xp9YZfzQ=
 cloud.google.com/go/functions v1.6.0/go.mod h1:3H1UA3qiIPRWD7PeZKLvHZ9SaQhR26XIJcC0A5GbvAk=
 cloud.google.com/go/functions v1.7.0/go.mod h1:+d+QBcWM+RsrgZfV9xo6KfA1GlzJfxcfZcRPEhDDfzg=
 cloud.google.com/go/functions v1.8.0/go.mod h1:RTZ4/HsQjIqIYP9a9YPbU+QFoQsAlYgrwOXJWHn1POY=
@@ -532,56 +291,28 @@ cloud.google.com/go/functions v1.9.0/go.mod h1:Y+Dz8yGguzO3PpIjhLTbnqV1CWmgQ5Uwt
 cloud.google.com/go/functions v1.10.0/go.mod h1:0D3hEOe3DbEvCXtYOZHQZmD+SzYsi1YbI7dGvHfldXw=
 cloud.google.com/go/functions v1.12.0/go.mod h1:AXWGrF3e2C/5ehvwYo/GH6O5s09tOPksiKhz+hH8WkA=
 cloud.google.com/go/functions v1.13.0/go.mod h1:EU4O007sQm6Ef/PwRsI8N2umygGqPBS/IZQKBQBcJ3c=
-cloud.google.com/go/functions v1.15.1/go.mod h1:P5yNWUTkyU+LvW/S9O6V+V423VZooALQlqoXdoPz5AE=
-cloud.google.com/go/functions v1.15.2/go.mod h1:CHAjtcR6OU4XF2HuiVeriEdELNcnvRZSk1Q8RMqy4lE=
-cloud.google.com/go/functions v1.15.3/go.mod h1:r/AMHwBheapkkySEhiZYLDBwVJCdlRwsm4ieJu35/Ug=
-cloud.google.com/go/functions v1.15.4/go.mod h1:CAsTc3VlRMVvx+XqXxKqVevguqJpnVip4DdonFsX28I=
 cloud.google.com/go/gaming v1.5.0/go.mod h1:ol7rGcxP/qHTRQE/RO4bxkXq+Fix0j6D4LFPzYTIrDM=
 cloud.google.com/go/gaming v1.6.0/go.mod h1:YMU1GEvA39Qt3zWGyAVA9bpYz/yAhTvaQ1t2sK4KPUA=
 cloud.google.com/go/gaming v1.7.0/go.mod h1:LrB8U7MHdGgFG851iHAfqUdLcKBdQ55hzXy9xBJz0+w=
 cloud.google.com/go/gaming v1.8.0/go.mod h1:xAqjS8b7jAVW0KFYeRUxngo9My3f33kFmua++Pi+ggM=
 cloud.google.com/go/gaming v1.9.0/go.mod h1:Fc7kEmCObylSWLO334NcO+O9QMDyz+TKC4v1D7X+Bc0=
-cloud.google.com/go/gaming v1.10.1/go.mod h1:XQQvtfP8Rb9Rxnxm5wFVpAp9zCQkJi2bLIb7iHGwB3s=
 cloud.google.com/go/gkebackup v0.2.0/go.mod h1:XKvv/4LfG829/B8B7xRkk8zRrOEbKtEam6yNfuQNH60=
 cloud.google.com/go/gkebackup v0.3.0/go.mod h1:n/E671i1aOQvUxT541aTkCwExO/bTer2HDlj4TsBRAo=
 cloud.google.com/go/gkebackup v0.4.0/go.mod h1:byAyBGUwYGEEww7xsbnUTBHIYcOPy/PgUWUtOeRm9Vg=
-cloud.google.com/go/gkebackup v1.3.0/go.mod h1:vUDOu++N0U5qs4IhG1pcOnD1Mac79xWy6GoBFlWCWBU=
-cloud.google.com/go/gkebackup v1.3.1/go.mod h1:vUDOu++N0U5qs4IhG1pcOnD1Mac79xWy6GoBFlWCWBU=
-cloud.google.com/go/gkebackup v1.3.2/go.mod h1:OMZbXzEJloyXMC7gqdSB+EOEQ1AKcpGYvO3s1ec5ixk=
-cloud.google.com/go/gkebackup v1.3.3/go.mod h1:eMk7/wVV5P22KBakhQnJxWSVftL1p4VBFLpv0kIft7I=
-cloud.google.com/go/gkebackup v1.3.4/go.mod h1:gLVlbM8h/nHIs09ns1qx3q3eaXcGSELgNu1DWXYz1HI=
 cloud.google.com/go/gkeconnect v0.5.0/go.mod h1:c5lsNAg5EwAy7fkqX/+goqFsU1Da/jQFqArp+wGNr/o=
 cloud.google.com/go/gkeconnect v0.6.0/go.mod h1:Mln67KyU/sHJEBY8kFZ0xTeyPtzbq9StAVvEULYK16A=
 cloud.google.com/go/gkeconnect v0.7.0/go.mod h1:SNfmVqPkaEi3bF/B3CNZOAYPYdg7sU+obZ+QTky2Myw=
-cloud.google.com/go/gkeconnect v0.8.1/go.mod h1:KWiK1g9sDLZqhxB2xEuPV8V9NYzrqTUmQR9shJHpOZw=
-cloud.google.com/go/gkeconnect v0.8.2/go.mod h1:6nAVhwchBJYgQCXD2pHBFQNiJNyAd/wyxljpaa6ZPrY=
-cloud.google.com/go/gkeconnect v0.8.3/go.mod h1:i9GDTrfzBSUZGCe98qSu1B8YB8qfapT57PenIb820Jo=
-cloud.google.com/go/gkeconnect v0.8.4/go.mod h1:84hZz4UMlDCKl8ifVW8layK4WHlMAFeq8vbzjU0yJkw=
 cloud.google.com/go/gkehub v0.9.0/go.mod h1:WYHN6WG8w9bXU0hqNxt8rm5uxnk8IH+lPY9J2TV7BK0=
 cloud.google.com/go/gkehub v0.10.0/go.mod h1:UIPwxI0DsrpsVoWpLB0stwKCP+WFVG9+y977wO+hBH0=
 cloud.google.com/go/gkehub v0.11.0/go.mod h1:JOWHlmN+GHyIbuWQPl47/C2RFhnFKH38jH9Ascu3n0E=
 cloud.google.com/go/gkehub v0.12.0/go.mod h1:djiIwwzTTBrF5NaXCGv3mf7klpEMcST17VBTVVDcuaw=
-cloud.google.com/go/gkehub v0.14.1/go.mod h1:VEXKIJZ2avzrbd7u+zeMtW00Y8ddk/4V9511C9CQGTY=
-cloud.google.com/go/gkehub v0.14.2/go.mod h1:iyjYH23XzAxSdhrbmfoQdePnlMj2EWcvnR+tHdBQsCY=
-cloud.google.com/go/gkehub v0.14.3/go.mod h1:jAl6WafkHHW18qgq7kqcrXYzN08hXeK/Va3utN8VKg8=
-cloud.google.com/go/gkehub v0.14.4/go.mod h1:Xispfu2MqnnFt8rV/2/3o73SK1snL8s9dYJ9G2oQMfc=
 cloud.google.com/go/gkemulticloud v0.3.0/go.mod h1:7orzy7O0S+5kq95e4Hpn7RysVA7dPs8W/GgfUtsPbrA=
 cloud.google.com/go/gkemulticloud v0.4.0/go.mod h1:E9gxVBnseLWCk24ch+P9+B2CoDFJZTyIgLKSalC7tuI=
 cloud.google.com/go/gkemulticloud v0.5.0/go.mod h1:W0JDkiyi3Tqh0TJr//y19wyb1yf8llHVto2Htf2Ja3Y=
-cloud.google.com/go/gkemulticloud v0.6.1/go.mod h1:kbZ3HKyTsiwqKX7Yw56+wUGwwNZViRnxWK2DVknXWfw=
-cloud.google.com/go/gkemulticloud v1.0.0/go.mod h1:kbZ3HKyTsiwqKX7Yw56+wUGwwNZViRnxWK2DVknXWfw=
-cloud.google.com/go/gkemulticloud v1.0.1/go.mod h1:AcrGoin6VLKT/fwZEYuqvVominLriQBCKmbjtnbMjG8=
-cloud.google.com/go/gkemulticloud v1.0.2/go.mod h1:+ee5VXxKb3H1l4LZAcgWB/rvI16VTNTrInWxDjAGsGo=
-cloud.google.com/go/gkemulticloud v1.0.3/go.mod h1:7NpJBN94U6DY1xHIbsDqB2+TFZUfjLUKLjUX8NGLor0=
 cloud.google.com/go/grafeas v0.2.0/go.mod h1:KhxgtF2hb0P191HlY5besjYm6MqTSTj3LSI+M+ByZHc=
-cloud.google.com/go/grafeas v0.3.0/go.mod h1:P7hgN24EyONOTMyeJH6DxG4zD7fwiYa5Q6GUgyFSOU8=
 cloud.google.com/go/gsuiteaddons v1.3.0/go.mod h1:EUNK/J1lZEZO8yPtykKxLXI6JSVN2rg9bN8SXOa0bgM=
 cloud.google.com/go/gsuiteaddons v1.4.0/go.mod h1:rZK5I8hht7u7HxFQcFei0+AtfS9uSushomRlg+3ua1o=
 cloud.google.com/go/gsuiteaddons v1.5.0/go.mod h1:TFCClYLd64Eaa12sFVmUyG62tk4mdIsI7pAnSXRkcFo=
-cloud.google.com/go/gsuiteaddons v1.6.1/go.mod h1:CodrdOqRZcLp5WOwejHWYBjZvfY0kOphkAKpF/3qdZY=
-cloud.google.com/go/gsuiteaddons v1.6.2/go.mod h1:K65m9XSgs8hTF3X9nNTPi8IQueljSdYo9F+Mi+s4MyU=
-cloud.google.com/go/gsuiteaddons v1.6.3/go.mod h1:sCFJkZoMrLZT3JTb8uJqgKPNshH2tfXeCwTFRebTq48=
-cloud.google.com/go/gsuiteaddons v1.6.4/go.mod h1:rxtstw7Fx22uLOXBpsvb9DUbC+fiXs7rF4U29KHM/pE=
 cloud.google.com/go/iam v0.1.0/go.mod h1:vcUNEa0pEm0qRVpmWepWaFMIAI8/hjB9mO8rNCJtF6c=
 cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
 cloud.google.com/go/iam v0.5.0/go.mod h1:wPU9Vt0P4UmCux7mqtRu6jcpPAb74cP1fh50J3QpkUc=
@@ -591,39 +322,20 @@ cloud.google.com/go/iam v0.8.0/go.mod h1:lga0/y3iH6CX7sYqypWJ33hf7kkfXJag67naqGE
 cloud.google.com/go/iam v0.11.0/go.mod h1:9PiLDanza5D+oWFZiH1uG+RnRCfEGKoyl6yo4cgWZGY=
 cloud.google.com/go/iam v0.12.0/go.mod h1:knyHGviacl11zrtZUoDuYpDgLjvr28sLQaG0YB2GYAY=
 cloud.google.com/go/iam v0.13.0/go.mod h1:ljOg+rcNfzZ5d6f1nAUJ8ZIxOaZUVoS14bKCtaLZ/D0=
-cloud.google.com/go/iam v1.0.1/go.mod h1:yR3tmSL8BcZB4bxByRv2jkSIahVmCtfKZwLYGBalRE8=
-cloud.google.com/go/iam v1.1.0/go.mod h1:nxdHjaKfCr7fNYx/HJMM8LgiMugmveWlkatear5gVyk=
-cloud.google.com/go/iam v1.1.1/go.mod h1:A5avdyVL2tCppe4unb0951eI9jreack+RJ0/d+KUZOU=
-cloud.google.com/go/iam v1.1.2/go.mod h1:A5avdyVL2tCppe4unb0951eI9jreack+RJ0/d+KUZOU=
-cloud.google.com/go/iam v1.1.3/go.mod h1:3khUlaBXfPKKe7huYgEpDn6FtgRyMEqbkvBxrQyY5SE=
-cloud.google.com/go/iam v1.1.4/go.mod h1:l/rg8l1AaA+VFMho/HYx2Vv6xinPSLMF8qfhRPIZ0L8=
-cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
-cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
+cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
+cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE=
 cloud.google.com/go/iap v1.4.0/go.mod h1:RGFwRJdihTINIe4wZ2iCP0zF/qu18ZwyKxrhMhygBEc=
 cloud.google.com/go/iap v1.5.0/go.mod h1:UH/CGgKd4KyohZL5Pt0jSKE4m3FR51qg6FKQ/z/Ix9A=
 cloud.google.com/go/iap v1.6.0/go.mod h1:NSuvI9C/j7UdjGjIde7t7HBz+QTwBcapPE07+sSRcLk=
 cloud.google.com/go/iap v1.7.0/go.mod h1:beqQx56T9O1G1yNPph+spKpNibDlYIiIixiqsQXxLIo=
 cloud.google.com/go/iap v1.7.1/go.mod h1:WapEwPc7ZxGt2jFGB/C/bm+hP0Y6NXzOYGjpPnmMS74=
-cloud.google.com/go/iap v1.8.1/go.mod h1:sJCbeqg3mvWLqjZNsI6dfAtbbV1DL2Rl7e1mTyXYREQ=
-cloud.google.com/go/iap v1.9.0/go.mod h1:01OFxd1R+NFrg78S+hoPV5PxEzv22HXaNqUUlmNHFuY=
-cloud.google.com/go/iap v1.9.1/go.mod h1:SIAkY7cGMLohLSdBR25BuIxO+I4fXJiL06IBL7cy/5Q=
-cloud.google.com/go/iap v1.9.2/go.mod h1:GwDTOs047PPSnwRD0Us5FKf4WDRcVvHg1q9WVkKBhdI=
-cloud.google.com/go/iap v1.9.3/go.mod h1:DTdutSZBqkkOm2HEOTBzhZxh2mwwxshfD/h3yofAiCw=
 cloud.google.com/go/ids v1.1.0/go.mod h1:WIuwCaYVOzHIj2OhN9HAwvW+DBdmUAdcWlFxRl+KubM=
 cloud.google.com/go/ids v1.2.0/go.mod h1:5WXvp4n25S0rA/mQWAg1YEEBBq6/s+7ml1RDCW1IrcY=
 cloud.google.com/go/ids v1.3.0/go.mod h1:JBdTYwANikFKaDP6LtW5JAi4gubs57SVNQjemdt6xV4=
-cloud.google.com/go/ids v1.4.1/go.mod h1:np41ed8YMU8zOgv53MMMoCntLTn2lF+SUzlM+O3u/jw=
-cloud.google.com/go/ids v1.4.2/go.mod h1:3vw8DX6YddRu9BncxuzMyWn0g8+ooUjI2gslJ7FH3vk=
-cloud.google.com/go/ids v1.4.3/go.mod h1:9CXPqI3GedjmkjbMWCUhMZ2P2N7TUMzAkVXYEH2orYU=
-cloud.google.com/go/ids v1.4.4/go.mod h1:z+WUc2eEl6S/1aZWzwtVNWoSZslgzPxAboS0lZX0HjI=
 cloud.google.com/go/iot v1.3.0/go.mod h1:r7RGh2B61+B8oz0AGE+J72AhA0G7tdXItODWsaA2oLs=
 cloud.google.com/go/iot v1.4.0/go.mod h1:dIDxPOn0UvNDUMD8Ger7FIaTuvMkj+aGk94RPP0iV+g=
 cloud.google.com/go/iot v1.5.0/go.mod h1:mpz5259PDl3XJthEmh9+ap0affn/MqNSP4My77Qql9o=
 cloud.google.com/go/iot v1.6.0/go.mod h1:IqdAsmE2cTYYNO1Fvjfzo9po179rAtJeVGUvkLN3rLE=
-cloud.google.com/go/iot v1.7.1/go.mod h1:46Mgw7ev1k9KqK1ao0ayW9h0lI+3hxeanz+L1zmbbbk=
-cloud.google.com/go/iot v1.7.2/go.mod h1:q+0P5zr1wRFpw7/MOgDXrG/HVA+l+cSwdObffkrpnSg=
-cloud.google.com/go/iot v1.7.3/go.mod h1:t8itFchkol4VgNbHnIq9lXoOOtHNR3uAACQMYbN9N4I=
-cloud.google.com/go/iot v1.7.4/go.mod h1:3TWqDVvsddYBG++nHSZmluoCAVGr1hAcabbWZNKEZLk=
 cloud.google.com/go/kms v1.4.0/go.mod h1:fajBHndQ+6ubNw6Ss2sSd+SWvjL26RNo/dr7uxsnnOA=
 cloud.google.com/go/kms v1.5.0/go.mod h1:QJS2YY0eJGBg3mnDfuaCyLauWwBJiHRboYxJ++1xJNg=
 cloud.google.com/go/kms v1.6.0/go.mod h1:Jjy850yySiasBUDi6KFUwUv2n1+o7QZFyuUJg6OgjA0=
@@ -631,205 +343,99 @@ cloud.google.com/go/kms v1.8.0/go.mod h1:4xFEhYFqvW+4VMELtZyxomGSYtSQKzM178ylFW4
 cloud.google.com/go/kms v1.9.0/go.mod h1:qb1tPTgfF9RQP8e1wq4cLFErVuTJv7UsSC915J8dh3w=
 cloud.google.com/go/kms v1.10.0/go.mod h1:ng3KTUtQQU9bPX3+QGLsflZIHlkbn8amFAMY63m8d24=
 cloud.google.com/go/kms v1.10.1/go.mod h1:rIWk/TryCkR59GMC3YtHtXeLzd634lBbKenvyySAyYI=
-cloud.google.com/go/kms v1.11.0/go.mod h1:hwdiYC0xjnWsKQQCQQmIQnS9asjYVSK6jtXm+zFqXLM=
-cloud.google.com/go/kms v1.12.1/go.mod h1:c9J991h5DTl+kg7gi3MYomh12YEENGrf48ee/N/2CDM=
-cloud.google.com/go/kms v1.15.0/go.mod h1:c9J991h5DTl+kg7gi3MYomh12YEENGrf48ee/N/2CDM=
-cloud.google.com/go/kms v1.15.2/go.mod h1:3hopT4+7ooWRCjc2DxgnpESFxhIraaI2IpAVUEhbT/w=
-cloud.google.com/go/kms v1.15.3/go.mod h1:AJdXqHxS2GlPyduM99s9iGqi2nwbviBbhV/hdmt4iOQ=
-cloud.google.com/go/kms v1.15.4/go.mod h1:L3Sdj6QTHK8dfwK5D1JLsAyELsNMnd3tAIwGS4ltKpc=
-cloud.google.com/go/kms v1.15.5/go.mod h1:cU2H5jnp6G2TDpUGZyqTCoy1n16fbubHZjmVXSMtwDI=
-cloud.google.com/go/kms v1.15.6 h1:ktpEMQmsOAYj3VZwH020FcQlm23BVYg8T8O1woG2GcE=
-cloud.google.com/go/kms v1.15.6/go.mod h1:yF75jttnIdHfGBoE51AKsD/Yqf+/jICzB9v1s1acsms=
+cloud.google.com/go/kms v1.23.0 h1:WaqAZsUptyHwOo9II8rFC1Kd2I+yvNsNP2IJ14H2sUw=
+cloud.google.com/go/kms v1.23.0/go.mod h1:rZ5kK0I7Kn9W4erhYVoIRPtpizjunlrfU4fUkumUp8g=
 cloud.google.com/go/language v1.4.0/go.mod h1:F9dRpNFQmJbkaop6g0JhSBXCNlO90e1KWx5iDdxbWic=
 cloud.google.com/go/language v1.6.0/go.mod h1:6dJ8t3B+lUYfStgls25GusK04NLh3eDLQnWM3mdEbhI=
 cloud.google.com/go/language v1.7.0/go.mod h1:DJ6dYN/W+SQOjF8e1hLQXMF21AkH2w9wiPzPCJa2MIE=
 cloud.google.com/go/language v1.8.0/go.mod h1:qYPVHf7SPoNNiCL2Dr0FfEFNil1qi3pQEyygwpgVKB8=
 cloud.google.com/go/language v1.9.0/go.mod h1:Ns15WooPM5Ad/5no/0n81yUetis74g3zrbeJBE+ptUY=
-cloud.google.com/go/language v1.10.1/go.mod h1:CPp94nsdVNiQEt1CNjF5WkTcisLiHPyIbMhvR8H2AW0=
-cloud.google.com/go/language v1.11.0/go.mod h1:uDx+pFDdAKTY8ehpWbiXyQdz8tDSYLJbQcXsCkjYyvQ=
-cloud.google.com/go/language v1.11.1/go.mod h1:Xyid9MG9WOX3utvDbpX7j3tXDmmDooMyMDqgUVpH17U=
-cloud.google.com/go/language v1.12.1/go.mod h1:zQhalE2QlQIxbKIZt54IASBzmZpN/aDASea5zl1l+J4=
-cloud.google.com/go/language v1.12.2/go.mod h1:9idWapzr/JKXBBQ4lWqVX/hcadxB194ry20m/bTrhWc=
 cloud.google.com/go/lifesciences v0.5.0/go.mod h1:3oIKy8ycWGPUyZDR/8RNnTOYevhaMLqh5vLUXs9zvT8=
 cloud.google.com/go/lifesciences v0.6.0/go.mod h1:ddj6tSX/7BOnhxCSd3ZcETvtNr8NZ6t/iPhY2Tyfu08=
 cloud.google.com/go/lifesciences v0.8.0/go.mod h1:lFxiEOMqII6XggGbOnKiyZ7IBwoIqA84ClvoezaA/bo=
-cloud.google.com/go/lifesciences v0.9.1/go.mod h1:hACAOd1fFbCGLr/+weUKRAJas82Y4vrL3O5326N//Wc=
-cloud.google.com/go/lifesciences v0.9.2/go.mod h1:QHEOO4tDzcSAzeJg7s2qwnLM2ji8IRpQl4p6m5Z9yTA=
-cloud.google.com/go/lifesciences v0.9.3/go.mod h1:gNGBOJV80IWZdkd+xz4GQj4mbqaz737SCLHn2aRhQKM=
-cloud.google.com/go/lifesciences v0.9.4/go.mod h1:bhm64duKhMi7s9jR9WYJYvjAFJwRqNj+Nia7hF0Z7JA=
 cloud.google.com/go/logging v1.6.1/go.mod h1:5ZO0mHHbvm8gEmeEUHrmDlTDSu5imF6MUP9OfilNXBw=
 cloud.google.com/go/logging v1.7.0/go.mod h1:3xjP2CjkM3ZkO73aj4ASA5wRPGGCRrPIAeNqVNkzY8M=
-cloud.google.com/go/logging v1.8.1/go.mod h1:TJjR+SimHwuC8MZ9cjByQulAMgni+RkXeI3wwctHJEI=
+cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXHYc=
+cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
 cloud.google.com/go/longrunning v0.1.1/go.mod h1:UUFxuDWkv22EuY93jjmDMFT5GPQKeFVJBIF6QlTqdsE=
 cloud.google.com/go/longrunning v0.3.0/go.mod h1:qth9Y41RRSUE69rDcOn6DdK3HfQfsUI0YSmW3iIlLJc=
 cloud.google.com/go/longrunning v0.4.1/go.mod h1:4iWDqhBZ70CvZ6BfETbvam3T8FMvLK+eFj0E6AaRQTo=
-cloud.google.com/go/longrunning v0.4.2/go.mod h1:OHrnaYyLUV6oqwh0xiS7e5sLQhP1m0QU9R+WhGDMgIQ=
-cloud.google.com/go/longrunning v0.5.0/go.mod h1:0JNuqRShmscVAhIACGtskSAWtqtOoPkwP0YF1oVEchc=
-cloud.google.com/go/longrunning v0.5.1/go.mod h1:spvimkwdz6SPWKEt/XBij79E9fiTkHSQl/fRUUQJYJc=
-cloud.google.com/go/longrunning v0.5.2/go.mod h1:nqo6DQbNV2pXhGDbDMoN2bWz68MjZUzqv2YttZiveCs=
-cloud.google.com/go/longrunning v0.5.3/go.mod h1:y/0ga59EYu58J6SHmmQOvekvND2qODbu8ywBBW7EK7Y=
-cloud.google.com/go/longrunning v0.5.4 h1:w8xEcbZodnA2BbW6sVirkkoC+1gP8wS57EUUgGS0GVg=
-cloud.google.com/go/longrunning v0.5.4/go.mod h1:zqNVncI0BOP8ST6XQD1+VcvuShMmq7+xFSzOL++V0dI=
+cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE=
+cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
 cloud.google.com/go/managedidentities v1.3.0/go.mod h1:UzlW3cBOiPrzucO5qWkNkh0w33KFtBJU281hacNvsdE=
 cloud.google.com/go/managedidentities v1.4.0/go.mod h1:NWSBYbEMgqmbZsLIyKvxrYbtqOsxY1ZrGM+9RgDqInM=
 cloud.google.com/go/managedidentities v1.5.0/go.mod h1:+dWcZ0JlUmpuxpIDfyP5pP5y0bLdRwOS4Lp7gMni/LA=
-cloud.google.com/go/managedidentities v1.6.1/go.mod h1:h/irGhTN2SkZ64F43tfGPMbHnypMbu4RB3yl8YcuEak=
-cloud.google.com/go/managedidentities v1.6.2/go.mod h1:5c2VG66eCa0WIq6IylRk3TBW83l161zkFvCj28X7jn8=
-cloud.google.com/go/managedidentities v1.6.3/go.mod h1:tewiat9WLyFN0Fi7q1fDD5+0N4VUoL0SCX0OTCthZq4=
-cloud.google.com/go/managedidentities v1.6.4/go.mod h1:WgyaECfHmF00t/1Uk8Oun3CQ2PGUtjc3e9Alh79wyiM=
 cloud.google.com/go/maps v0.1.0/go.mod h1:BQM97WGyfw9FWEmQMpZ5T6cpovXXSd1cGmFma94eubI=
 cloud.google.com/go/maps v0.6.0/go.mod h1:o6DAMMfb+aINHz/p/jbcY+mYeXBoZoxTfdSQ8VAJaCw=
 cloud.google.com/go/maps v0.7.0/go.mod h1:3GnvVl3cqeSvgMcpRlQidXsPYuDGQ8naBis7MVzpXsY=
-cloud.google.com/go/maps v1.3.0/go.mod h1:6mWTUv+WhnOwAgjVsSW2QPPECmW+s3PcRyOa9vgG/5s=
-cloud.google.com/go/maps v1.4.0/go.mod h1:6mWTUv+WhnOwAgjVsSW2QPPECmW+s3PcRyOa9vgG/5s=
-cloud.google.com/go/maps v1.4.1/go.mod h1:BxSa0BnW1g2U2gNdbq5zikLlHUuHW0GFWh7sgML2kIY=
-cloud.google.com/go/maps v1.5.1/go.mod h1:NPMZw1LJwQZYCfz4y+EIw+SI+24A4bpdFJqdKVr0lt4=
-cloud.google.com/go/maps v1.6.1/go.mod h1:4+buOHhYXFBp58Zj/K+Lc1rCmJssxxF4pJ5CJnhdz18=
 cloud.google.com/go/mediatranslation v0.5.0/go.mod h1:jGPUhGTybqsPQn91pNXw0xVHfuJ3leR1wj37oU3y1f4=
 cloud.google.com/go/mediatranslation v0.6.0/go.mod h1:hHdBCTYNigsBxshbznuIMFNe5QXEowAuNmmC7h8pu5w=
 cloud.google.com/go/mediatranslation v0.7.0/go.mod h1:LCnB/gZr90ONOIQLgSXagp8XUW1ODs2UmUMvcgMfI2I=
-cloud.google.com/go/mediatranslation v0.8.1/go.mod h1:L/7hBdEYbYHQJhX2sldtTO5SZZ1C1vkapubj0T2aGig=
-cloud.google.com/go/mediatranslation v0.8.2/go.mod h1:c9pUaDRLkgHRx3irYE5ZC8tfXGrMYwNZdmDqKMSfFp8=
-cloud.google.com/go/mediatranslation v0.8.3/go.mod h1:F9OnXTy336rteOEywtY7FOqCk+J43o2RF638hkOQl4Y=
-cloud.google.com/go/mediatranslation v0.8.4/go.mod h1:9WstgtNVAdN53m6TQa5GjIjLqKQPXe74hwSCxUP6nj4=
 cloud.google.com/go/memcache v1.4.0/go.mod h1:rTOfiGZtJX1AaFUrOgsMHX5kAzaTQ8azHiuDoTPzNsE=
 cloud.google.com/go/memcache v1.5.0/go.mod h1:dk3fCK7dVo0cUU2c36jKb4VqKPS22BTkf81Xq617aWM=
 cloud.google.com/go/memcache v1.6.0/go.mod h1:XS5xB0eQZdHtTuTF9Hf8eJkKtR3pVRCcvJwtm68T3rA=
 cloud.google.com/go/memcache v1.7.0/go.mod h1:ywMKfjWhNtkQTxrWxCkCFkoPjLHPW6A7WOTVI8xy3LY=
 cloud.google.com/go/memcache v1.9.0/go.mod h1:8oEyzXCu+zo9RzlEaEjHl4KkgjlNDaXbCQeQWlzNFJM=
-cloud.google.com/go/memcache v1.10.1/go.mod h1:47YRQIarv4I3QS5+hoETgKO40InqzLP6kpNLvyXuyaA=
-cloud.google.com/go/memcache v1.10.2/go.mod h1:f9ZzJHLBrmd4BkguIAa/l/Vle6uTHzHokdnzSWOdQ6A=
-cloud.google.com/go/memcache v1.10.3/go.mod h1:6z89A41MT2DVAW0P4iIRdu5cmRTsbsFn4cyiIx8gbwo=
-cloud.google.com/go/memcache v1.10.4/go.mod h1:v/d8PuC8d1gD6Yn5+I3INzLR01IDn0N4Ym56RgikSI0=
 cloud.google.com/go/metastore v1.5.0/go.mod h1:2ZNrDcQwghfdtCwJ33nM0+GrBGlVuh8rakL3vdPY3XY=
 cloud.google.com/go/metastore v1.6.0/go.mod h1:6cyQTls8CWXzk45G55x57DVQ9gWg7RiH65+YgPsNh9s=
 cloud.google.com/go/metastore v1.7.0/go.mod h1:s45D0B4IlsINu87/AsWiEVYbLaIMeUSoxlKKDqBGFS8=
 cloud.google.com/go/metastore v1.8.0/go.mod h1:zHiMc4ZUpBiM7twCIFQmJ9JMEkDSyZS9U12uf7wHqSI=
 cloud.google.com/go/metastore v1.10.0/go.mod h1:fPEnH3g4JJAk+gMRnrAnoqyv2lpUCqJPWOodSaf45Eo=
-cloud.google.com/go/metastore v1.11.1/go.mod h1:uZuSo80U3Wd4zi6C22ZZliOUJ3XeM/MlYi/z5OAOWRA=
-cloud.google.com/go/metastore v1.12.0/go.mod h1:uZuSo80U3Wd4zi6C22ZZliOUJ3XeM/MlYi/z5OAOWRA=
-cloud.google.com/go/metastore v1.13.0/go.mod h1:URDhpG6XLeh5K+Glq0NOt74OfrPKTwS62gEPZzb5SOk=
-cloud.google.com/go/metastore v1.13.1/go.mod h1:IbF62JLxuZmhItCppcIfzBBfUFq0DIB9HPDoLgWrVOU=
-cloud.google.com/go/metastore v1.13.2/go.mod h1:KS59dD+unBji/kFebVp8XU/quNSyo8b6N6tPGspKszA=
-cloud.google.com/go/metastore v1.13.3/go.mod h1:K+wdjXdtkdk7AQg4+sXS8bRrQa9gcOr+foOMF2tqINE=
 cloud.google.com/go/monitoring v1.7.0/go.mod h1:HpYse6kkGo//7p6sT0wsIC6IBDET0RhIsnmlA53dvEk=
 cloud.google.com/go/monitoring v1.8.0/go.mod h1:E7PtoMJ1kQXWxPjB6mv2fhC5/15jInuulFdYYtlcvT4=
 cloud.google.com/go/monitoring v1.12.0/go.mod h1:yx8Jj2fZNEkL/GYZyTLS4ZtZEZN8WtDEiEqG4kLK50w=
 cloud.google.com/go/monitoring v1.13.0/go.mod h1:k2yMBAB1H9JT/QETjNkgdCGD9bPF712XiLTVr+cBrpw=
-cloud.google.com/go/monitoring v1.15.1/go.mod h1:lADlSAlFdbqQuwwpaImhsJXu1QSdd3ojypXrFSMr2rM=
-cloud.google.com/go/monitoring v1.16.0/go.mod h1:Ptp15HgAyM1fNICAojDMoNc/wUmn67mLHQfyqbw+poY=
-cloud.google.com/go/monitoring v1.16.1/go.mod h1:6HsxddR+3y9j+o/cMJH6q/KJ/CBTvM/38L/1m7bTRJ4=
-cloud.google.com/go/monitoring v1.16.2/go.mod h1:B44KGwi4ZCF8Rk/5n+FWeispDXoKSk9oss2QNlXJBgc=
-cloud.google.com/go/monitoring v1.16.3/go.mod h1:KwSsX5+8PnXv5NJnICZzW2R8pWTis8ypC4zmdRD63Tw=
-cloud.google.com/go/monitoring v1.17.0 h1:blrdvF0MkPPivSO041ihul7rFMhXdVp8Uq7F59DKXTU=
-cloud.google.com/go/monitoring v1.17.0/go.mod h1:KwSsX5+8PnXv5NJnICZzW2R8pWTis8ypC4zmdRD63Tw=
+cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
+cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
 cloud.google.com/go/networkconnectivity v1.4.0/go.mod h1:nOl7YL8odKyAOtzNX73/M5/mGZgqqMeryi6UPZTk/rA=
 cloud.google.com/go/networkconnectivity v1.5.0/go.mod h1:3GzqJx7uhtlM3kln0+x5wyFvuVH1pIBJjhCpjzSt75o=
 cloud.google.com/go/networkconnectivity v1.6.0/go.mod h1:OJOoEXW+0LAxHh89nXd64uGG+FbQoeH8DtxCHVOMlaM=
 cloud.google.com/go/networkconnectivity v1.7.0/go.mod h1:RMuSbkdbPwNMQjB5HBWD5MpTBnNm39iAVpC3TmsExt8=
 cloud.google.com/go/networkconnectivity v1.10.0/go.mod h1:UP4O4sWXJG13AqrTdQCD9TnLGEbtNRqjuaaA7bNjF5E=
 cloud.google.com/go/networkconnectivity v1.11.0/go.mod h1:iWmDD4QF16VCDLXUqvyspJjIEtBR/4zq5hwnY2X3scM=
-cloud.google.com/go/networkconnectivity v1.12.1/go.mod h1:PelxSWYM7Sh9/guf8CFhi6vIqf19Ir/sbfZRUwXh92E=
-cloud.google.com/go/networkconnectivity v1.13.0/go.mod h1:SAnGPes88pl7QRLUen2HmcBSE9AowVAcdug8c0RSBFk=
-cloud.google.com/go/networkconnectivity v1.14.0/go.mod h1:SAnGPes88pl7QRLUen2HmcBSE9AowVAcdug8c0RSBFk=
-cloud.google.com/go/networkconnectivity v1.14.1/go.mod h1:LyGPXR742uQcDxZ/wv4EI0Vu5N6NKJ77ZYVnDe69Zug=
-cloud.google.com/go/networkconnectivity v1.14.2/go.mod h1:5UFlwIisZylSkGG1AdwK/WZUaoz12PKu6wODwIbFzJo=
-cloud.google.com/go/networkconnectivity v1.14.3/go.mod h1:4aoeFdrJpYEXNvrnfyD5kIzs8YtHg945Og4koAjHQek=
 cloud.google.com/go/networkmanagement v1.4.0/go.mod h1:Q9mdLLRn60AsOrPc8rs8iNV6OHXaGcDdsIQe1ohekq8=
 cloud.google.com/go/networkmanagement v1.5.0/go.mod h1:ZnOeZ/evzUdUsnvRt792H0uYEnHQEMaz+REhhzJRcf4=
 cloud.google.com/go/networkmanagement v1.6.0/go.mod h1:5pKPqyXjB/sgtvB5xqOemumoQNB7y95Q7S+4rjSOPYY=
-cloud.google.com/go/networkmanagement v1.8.0/go.mod h1:Ho/BUGmtyEqrttTgWEe7m+8vDdK74ibQc+Be0q7Fof0=
-cloud.google.com/go/networkmanagement v1.9.0/go.mod h1:UTUaEU9YwbCAhhz3jEOHr+2/K/MrBk2XxOLS89LQzFw=
-cloud.google.com/go/networkmanagement v1.9.1/go.mod h1:CCSYgrQQvW73EJawO2QamemYcOb57LvrDdDU51F0mcI=
-cloud.google.com/go/networkmanagement v1.9.2/go.mod h1:iDGvGzAoYRghhp4j2Cji7sF899GnfGQcQRQwgVOWnDw=
-cloud.google.com/go/networkmanagement v1.9.3/go.mod h1:y7WMO1bRLaP5h3Obm4tey+NquUvB93Co1oh4wpL+XcU=
 cloud.google.com/go/networksecurity v0.5.0/go.mod h1:xS6fOCoqpVC5zx15Z/MqkfDwH4+m/61A3ODiDV1xmiQ=
 cloud.google.com/go/networksecurity v0.6.0/go.mod h1:Q5fjhTr9WMI5mbpRYEbiexTzROf7ZbDzvzCrNl14nyU=
 cloud.google.com/go/networksecurity v0.7.0/go.mod h1:mAnzoxx/8TBSyXEeESMy9OOYwo1v+gZ5eMRnsT5bC8k=
 cloud.google.com/go/networksecurity v0.8.0/go.mod h1:B78DkqsxFG5zRSVuwYFRZ9Xz8IcQ5iECsNrPn74hKHU=
-cloud.google.com/go/networksecurity v0.9.1/go.mod h1:MCMdxOKQ30wsBI1eI659f9kEp4wuuAueoC9AJKSPWZQ=
-cloud.google.com/go/networksecurity v0.9.2/go.mod h1:jG0SeAttWzPMUILEHDUvFYdQTl8L/E/KC8iZDj85lEI=
-cloud.google.com/go/networksecurity v0.9.3/go.mod h1:l+C0ynM6P+KV9YjOnx+kk5IZqMSLccdBqW6GUoF4p/0=
-cloud.google.com/go/networksecurity v0.9.4/go.mod h1:E9CeMZ2zDsNBkr8axKSYm8XyTqNhiCHf1JO/Vb8mD1w=
 cloud.google.com/go/notebooks v1.2.0/go.mod h1:9+wtppMfVPUeJ8fIWPOq1UnATHISkGXGqTkxeieQ6UY=
 cloud.google.com/go/notebooks v1.3.0/go.mod h1:bFR5lj07DtCPC7YAAJ//vHskFBxA5JzYlH68kXVdk34=
 cloud.google.com/go/notebooks v1.4.0/go.mod h1:4QPMngcwmgb6uw7Po99B2xv5ufVoIQ7nOGDyL4P8AgA=
 cloud.google.com/go/notebooks v1.5.0/go.mod h1:q8mwhnP9aR8Hpfnrc5iN5IBhrXUy8S2vuYs+kBJ/gu0=
 cloud.google.com/go/notebooks v1.7.0/go.mod h1:PVlaDGfJgj1fl1S3dUwhFMXFgfYGhYQt2164xOMONmE=
 cloud.google.com/go/notebooks v1.8.0/go.mod h1:Lq6dYKOYOWUCTvw5t2q1gp1lAp0zxAxRycayS0iJcqQ=
-cloud.google.com/go/notebooks v1.9.1/go.mod h1:zqG9/gk05JrzgBt4ghLzEepPHNwE5jgPcHZRKhlC1A8=
-cloud.google.com/go/notebooks v1.10.0/go.mod h1:SOPYMZnttHxqot0SGSFSkRrwE29eqnKPBJFqgWmiK2k=
-cloud.google.com/go/notebooks v1.10.1/go.mod h1:5PdJc2SgAybE76kFQCWrTfJolCOUQXF97e+gteUUA6A=
-cloud.google.com/go/notebooks v1.11.1/go.mod h1:V2Zkv8wX9kDCGRJqYoI+bQAaoVeE5kSiz4yYHd2yJwQ=
-cloud.google.com/go/notebooks v1.11.2/go.mod h1:z0tlHI/lREXC8BS2mIsUeR3agM1AkgLiS+Isov3SS70=
 cloud.google.com/go/optimization v1.1.0/go.mod h1:5po+wfvX5AQlPznyVEZjGJTMr4+CAkJf2XSTQOOl9l4=
 cloud.google.com/go/optimization v1.2.0/go.mod h1:Lr7SOHdRDENsh+WXVmQhQTrzdu9ybg0NecjHidBq6xs=
 cloud.google.com/go/optimization v1.3.1/go.mod h1:IvUSefKiwd1a5p0RgHDbWCIbDFgKuEdB+fPPuP0IDLI=
-cloud.google.com/go/optimization v1.4.1/go.mod h1:j64vZQP7h9bO49m2rVaTVoNM0vEBEN5eKPUPbZyXOrk=
-cloud.google.com/go/optimization v1.5.0/go.mod h1:evo1OvTxeBRBu6ydPlrIRizKY/LJKo/drDMMRKqGEUU=
-cloud.google.com/go/optimization v1.5.1/go.mod h1:NC0gnUD5MWVAF7XLdoYVPmYYVth93Q6BUzqAq3ZwtV8=
-cloud.google.com/go/optimization v1.6.1/go.mod h1:hH2RYPTTM9e9zOiTaYPTiGPcGdNZVnBSBxjIAJzUkqo=
-cloud.google.com/go/optimization v1.6.2/go.mod h1:mWNZ7B9/EyMCcwNl1frUGEuY6CPijSkz88Fz2vwKPOY=
 cloud.google.com/go/orchestration v1.3.0/go.mod h1:Sj5tq/JpWiB//X/q3Ngwdl5K7B7Y0KZ7bfv0wL6fqVA=
 cloud.google.com/go/orchestration v1.4.0/go.mod h1:6W5NLFWs2TlniBphAViZEVhrXRSMgUGDfW7vrWKvsBk=
 cloud.google.com/go/orchestration v1.6.0/go.mod h1:M62Bevp7pkxStDfFfTuCOaXgaaqRAga1yKyoMtEoWPQ=
-cloud.google.com/go/orchestration v1.8.1/go.mod h1:4sluRF3wgbYVRqz7zJ1/EUNc90TTprliq9477fGobD8=
-cloud.google.com/go/orchestration v1.8.2/go.mod h1:T1cP+6WyTmh6LSZzeUhvGf0uZVmJyTx7t8z7Vg87+A0=
-cloud.google.com/go/orchestration v1.8.3/go.mod h1:xhgWAYqlbYjlz2ftbFghdyqENYW+JXuhBx9KsjMoGHs=
-cloud.google.com/go/orchestration v1.8.4/go.mod h1:d0lywZSVYtIoSZXb0iFjv9SaL13PGyVOKDxqGxEf/qI=
 cloud.google.com/go/orgpolicy v1.4.0/go.mod h1:xrSLIV4RePWmP9P3tBl8S93lTmlAxjm06NSm2UTmKvE=
 cloud.google.com/go/orgpolicy v1.5.0/go.mod h1:hZEc5q3wzwXJaKrsx5+Ewg0u1LxJ51nNFlext7Tanwc=
 cloud.google.com/go/orgpolicy v1.10.0/go.mod h1:w1fo8b7rRqlXlIJbVhOMPrwVljyuW5mqssvBtU18ONc=
-cloud.google.com/go/orgpolicy v1.11.0/go.mod h1:2RK748+FtVvnfuynxBzdnyu7sygtoZa1za/0ZfpOs1M=
-cloud.google.com/go/orgpolicy v1.11.1/go.mod h1:8+E3jQcpZJQliP+zaFfayC2Pg5bmhuLK755wKhIIUCE=
-cloud.google.com/go/orgpolicy v1.11.2/go.mod h1:biRDpNwfyytYnmCRWZWxrKF22Nkz9eNVj9zyaBdpm1o=
-cloud.google.com/go/orgpolicy v1.11.3/go.mod h1:oKAtJ/gkMjum5icv2aujkP4CxROxPXsBbYGCDbPO8MM=
-cloud.google.com/go/orgpolicy v1.11.4/go.mod h1:0+aNV/nrfoTQ4Mytv+Aw+stBDBjNf4d8fYRA9herfJI=
 cloud.google.com/go/osconfig v1.7.0/go.mod h1:oVHeCeZELfJP7XLxcBGTMBvRO+1nQ5tFG9VQTmYS2Fs=
 cloud.google.com/go/osconfig v1.8.0/go.mod h1:EQqZLu5w5XA7eKizepumcvWx+m8mJUhEwiPqWiZeEdg=
 cloud.google.com/go/osconfig v1.9.0/go.mod h1:Yx+IeIZJ3bdWmzbQU4fxNl8xsZ4amB+dygAwFPlvnNo=
 cloud.google.com/go/osconfig v1.10.0/go.mod h1:uMhCzqC5I8zfD9zDEAfvgVhDS8oIjySWh+l4WK6GnWw=
 cloud.google.com/go/osconfig v1.11.0/go.mod h1:aDICxrur2ogRd9zY5ytBLV89KEgT2MKB2L/n6x1ooPw=
-cloud.google.com/go/osconfig v1.12.0/go.mod h1:8f/PaYzoS3JMVfdfTubkowZYGmAhUCjjwnjqWI7NVBc=
-cloud.google.com/go/osconfig v1.12.1/go.mod h1:4CjBxND0gswz2gfYRCUoUzCm9zCABp91EeTtWXyz0tE=
-cloud.google.com/go/osconfig v1.12.2/go.mod h1:eh9GPaMZpI6mEJEuhEjUJmaxvQ3gav+fFEJon1Y8Iw0=
-cloud.google.com/go/osconfig v1.12.3/go.mod h1:L/fPS8LL6bEYUi1au832WtMnPeQNT94Zo3FwwV1/xGM=
-cloud.google.com/go/osconfig v1.12.4/go.mod h1:B1qEwJ/jzqSRslvdOCI8Kdnp0gSng0xW4LOnIebQomA=
 cloud.google.com/go/oslogin v1.4.0/go.mod h1:YdgMXWRaElXz/lDk1Na6Fh5orF7gvmJ0FGLIs9LId4E=
 cloud.google.com/go/oslogin v1.5.0/go.mod h1:D260Qj11W2qx/HVF29zBg+0fd6YCSjSqLUkY/qEenQU=
 cloud.google.com/go/oslogin v1.6.0/go.mod h1:zOJ1O3+dTU8WPlGEkFSh7qeHPPSoxrcMbbK1Nm2iX70=
 cloud.google.com/go/oslogin v1.7.0/go.mod h1:e04SN0xO1UNJ1M5GP0vzVBFicIe4O53FOfcixIqTyXo=
 cloud.google.com/go/oslogin v1.9.0/go.mod h1:HNavntnH8nzrn8JCTT5fj18FuJLFJc4NaZJtBnQtKFs=
-cloud.google.com/go/oslogin v1.10.1/go.mod h1:x692z7yAue5nE7CsSnoG0aaMbNoRJRXO4sn73R+ZqAs=
-cloud.google.com/go/oslogin v1.11.0/go.mod h1:8GMTJs4X2nOAUVJiPGqIWVcDaF0eniEto3xlOxaboXE=
-cloud.google.com/go/oslogin v1.11.1/go.mod h1:OhD2icArCVNUxKqtK0mcSmKL7lgr0LVlQz+v9s1ujTg=
-cloud.google.com/go/oslogin v1.12.1/go.mod h1:VfwTeFJGbnakxAY236eN8fsnglLiVXndlbcNomY4iZU=
-cloud.google.com/go/oslogin v1.12.2/go.mod h1:CQ3V8Jvw4Qo4WRhNPF0o+HAM4DiLuE27Ul9CX9g2QdY=
 cloud.google.com/go/phishingprotection v0.5.0/go.mod h1:Y3HZknsK9bc9dMi+oE8Bim0lczMU6hrX0UpADuMefr0=
 cloud.google.com/go/phishingprotection v0.6.0/go.mod h1:9Y3LBLgy0kDTcYET8ZH3bq/7qni15yVUoAxiFxnlSUA=
 cloud.google.com/go/phishingprotection v0.7.0/go.mod h1:8qJI4QKHoda/sb/7/YmMQ2omRLSLYSu9bU0EKCNI+Lk=
-cloud.google.com/go/phishingprotection v0.8.1/go.mod h1:AxonW7GovcA8qdEk13NfHq9hNx5KPtfxXNeUxTDxB6I=
-cloud.google.com/go/phishingprotection v0.8.2/go.mod h1:LhJ91uyVHEYKSKcMGhOa14zMMWfbEdxG032oT6ECbC8=
-cloud.google.com/go/phishingprotection v0.8.3/go.mod h1:3B01yO7T2Ra/TMojifn8EoGd4G9jts/6cIO0DgDY9J8=
-cloud.google.com/go/phishingprotection v0.8.4/go.mod h1:6b3kNPAc2AQ6jZfFHioZKg9MQNybDg4ixFd4RPZZ2nE=
 cloud.google.com/go/policytroubleshooter v1.3.0/go.mod h1:qy0+VwANja+kKrjlQuOzmlvscn4RNsAc0e15GGqfMxg=
 cloud.google.com/go/policytroubleshooter v1.4.0/go.mod h1:DZT4BcRw3QoO8ota9xw/LKtPa8lKeCByYeKTIf/vxdE=
 cloud.google.com/go/policytroubleshooter v1.5.0/go.mod h1:Rz1WfV+1oIpPdN2VvvuboLVRsB1Hclg3CKQ53j9l8vw=
 cloud.google.com/go/policytroubleshooter v1.6.0/go.mod h1:zYqaPTsmfvpjm5ULxAyD/lINQxJ0DDsnWOP/GZ7xzBc=
-cloud.google.com/go/policytroubleshooter v1.7.1/go.mod h1:0NaT5v3Ag1M7U5r0GfDCpUFkWd9YqpubBWsQlhanRv0=
-cloud.google.com/go/policytroubleshooter v1.8.0/go.mod h1:tmn5Ir5EToWe384EuboTcVQT7nTag2+DuH3uHmKd1HU=
-cloud.google.com/go/policytroubleshooter v1.9.0/go.mod h1:+E2Lga7TycpeSTj2FsH4oXxTnrbHJGRlKhVZBLGgU64=
-cloud.google.com/go/policytroubleshooter v1.9.1/go.mod h1:MYI8i0bCrL8cW+VHN1PoiBTyNZTstCg2WUw2eVC4c4U=
-cloud.google.com/go/policytroubleshooter v1.10.1/go.mod h1:5C0rhT3TDZVxAu8813bwmTvd57Phbl8mr9F4ipOsxEs=
-cloud.google.com/go/policytroubleshooter v1.10.2/go.mod h1:m4uF3f6LseVEnMV6nknlN2vYGRb+75ylQwJdnOXfnv0=
 cloud.google.com/go/privatecatalog v0.5.0/go.mod h1:XgosMUvvPyxDjAVNDYxJ7wBW8//hLDDYmnsNcMGq1K0=
 cloud.google.com/go/privatecatalog v0.6.0/go.mod h1:i/fbkZR0hLN29eEWiiwue8Pb+GforiEIBnV9yrRUOKI=
 cloud.google.com/go/privatecatalog v0.7.0/go.mod h1:2s5ssIFO69F5csTXcwBP7NPFTZvps26xGzvQ2PQaBYg=
 cloud.google.com/go/privatecatalog v0.8.0/go.mod h1:nQ6pfaegeDAq/Q5lrfCQzQLhubPiZhSaNhIgfJlnIXs=
-cloud.google.com/go/privatecatalog v0.9.1/go.mod h1:0XlDXW2unJXdf9zFz968Hp35gl/bhF4twwpXZAW50JA=
-cloud.google.com/go/privatecatalog v0.9.2/go.mod h1:RMA4ATa8IXfzvjrhhK8J6H4wwcztab+oZph3c6WmtFc=
-cloud.google.com/go/privatecatalog v0.9.3/go.mod h1:K5pn2GrVmOPjXz3T26mzwXLcKivfIJ9R5N79AFCF9UE=
-cloud.google.com/go/privatecatalog v0.9.4/go.mod h1:SOjm93f+5hp/U3PqMZAHTtBtluqLygrDrVO8X8tYtG0=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
@@ -838,12 +444,9 @@ cloud.google.com/go/pubsub v1.26.0/go.mod h1:QgBH3U/jdJy/ftjPhTkyXNj543Tin1pRYcd
 cloud.google.com/go/pubsub v1.27.1/go.mod h1:hQN39ymbV9geqBnfQq6Xf63yNhUAhv9CZhzp5O6qsW0=
 cloud.google.com/go/pubsub v1.28.0/go.mod h1:vuXFpwaVoIPQMGXqRyUQigu/AX1S3IWugR9xznmcXX8=
 cloud.google.com/go/pubsub v1.30.0/go.mod h1:qWi1OPS0B+b5L+Sg6Gmc9zD1Y+HaM0MdUr7LsupY1P4=
-cloud.google.com/go/pubsub v1.32.0/go.mod h1:f+w71I33OMyxf9VpMVcZbnG5KSUkCOUHYpFd5U1GdRc=
-cloud.google.com/go/pubsub v1.33.0/go.mod h1:f+w71I33OMyxf9VpMVcZbnG5KSUkCOUHYpFd5U1GdRc=
 cloud.google.com/go/pubsublite v1.5.0/go.mod h1:xapqNQ1CuLfGi23Yda/9l4bBCKz/wC3KIJ5gKcxveZg=
 cloud.google.com/go/pubsublite v1.6.0/go.mod h1:1eFCS0U11xlOuMFV/0iBqw3zP12kddMeCbj/F3FSj9k=
 cloud.google.com/go/pubsublite v1.7.0/go.mod h1:8hVMwRXfDfvGm3fahVbtDbiLePT3gpoiJYJY+vxWxVM=
-cloud.google.com/go/pubsublite v1.8.1/go.mod h1:fOLdU4f5xldK4RGJrBMm+J7zMWNj/k4PxwEZXy39QS0=
 cloud.google.com/go/recaptchaenterprise v1.3.1/go.mod h1:OdD+q+y4XGeAlxRaMn1Y7/GveP6zmq76byL6tjPE7d4=
 cloud.google.com/go/recaptchaenterprise/v2 v2.1.0/go.mod h1:w9yVqajwroDNTfGuhmOjPDN//rZGySaf6PtFVcSCa7o=
 cloud.google.com/go/recaptchaenterprise/v2 v2.2.0/go.mod h1:/Zu5jisWGeERrd5HnlS3EUGb/D335f9k51B/FVil0jk=
@@ -852,89 +455,46 @@ cloud.google.com/go/recaptchaenterprise/v2 v2.4.0/go.mod h1:Am3LHfOuBstrLrNCBrlI
 cloud.google.com/go/recaptchaenterprise/v2 v2.5.0/go.mod h1:O8LzcHXN3rz0j+LBC91jrwI3R+1ZSZEWrfL7XHgNo9U=
 cloud.google.com/go/recaptchaenterprise/v2 v2.6.0/go.mod h1:RPauz9jeLtB3JVzg6nCbe12qNoaa8pXc4d/YukAmcnA=
 cloud.google.com/go/recaptchaenterprise/v2 v2.7.0/go.mod h1:19wVj/fs5RtYtynAPJdDTb69oW0vNHYDBTbB4NvMD9c=
-cloud.google.com/go/recaptchaenterprise/v2 v2.7.2/go.mod h1:kR0KjsJS7Jt1YSyWFkseQ756D45kaYNTlDPPaRAvDBU=
-cloud.google.com/go/recaptchaenterprise/v2 v2.8.0/go.mod h1:QuE8EdU9dEnesG8/kG3XuJyNsjEqMlMzg3v3scCJ46c=
-cloud.google.com/go/recaptchaenterprise/v2 v2.8.1/go.mod h1:JZYZJOeZjgSSTGP4uz7NlQ4/d1w5hGmksVgM0lbEij0=
-cloud.google.com/go/recaptchaenterprise/v2 v2.8.2/go.mod h1:kpaDBOpkwD4G0GVMzG1W6Doy1tFFC97XAV3xy+Rd/pw=
-cloud.google.com/go/recaptchaenterprise/v2 v2.8.3/go.mod h1:Dak54rw6lC2gBY8FBznpOCAR58wKf+R+ZSJRoeJok4w=
 cloud.google.com/go/recommendationengine v0.5.0/go.mod h1:E5756pJcVFeVgaQv3WNpImkFP8a+RptV6dDLGPILjvg=
 cloud.google.com/go/recommendationengine v0.6.0/go.mod h1:08mq2umu9oIqc7tDy8sx+MNJdLG0fUi3vaSVbztHgJ4=
 cloud.google.com/go/recommendationengine v0.7.0/go.mod h1:1reUcE3GIu6MeBz/h5xZJqNLuuVjNg1lmWMPyjatzac=
-cloud.google.com/go/recommendationengine v0.8.1/go.mod h1:MrZihWwtFYWDzE6Hz5nKcNz3gLizXVIDI/o3G1DLcrE=
-cloud.google.com/go/recommendationengine v0.8.2/go.mod h1:QIybYHPK58qir9CV2ix/re/M//Ty10OxjnnhWdaKS1Y=
-cloud.google.com/go/recommendationengine v0.8.3/go.mod h1:m3b0RZV02BnODE9FeSvGv1qibFo8g0OnmB/RMwYy4V8=
-cloud.google.com/go/recommendationengine v0.8.4/go.mod h1:GEteCf1PATl5v5ZsQ60sTClUE0phbWmo3rQ1Js8louU=
 cloud.google.com/go/recommender v1.5.0/go.mod h1:jdoeiBIVrJe9gQjwd759ecLJbxCDED4A6p+mqoqDvTg=
 cloud.google.com/go/recommender v1.6.0/go.mod h1:+yETpm25mcoiECKh9DEScGzIRyDKpZ0cEhWGo+8bo+c=
 cloud.google.com/go/recommender v1.7.0/go.mod h1:XLHs/W+T8olwlGOgfQenXBTbIseGclClff6lhFVe9Bs=
 cloud.google.com/go/recommender v1.8.0/go.mod h1:PkjXrTT05BFKwxaUxQmtIlrtj0kph108r02ZZQ5FE70=
 cloud.google.com/go/recommender v1.9.0/go.mod h1:PnSsnZY7q+VL1uax2JWkt/UegHssxjUVVCrX52CuEmQ=
-cloud.google.com/go/recommender v1.10.1/go.mod h1:XFvrE4Suqn5Cq0Lf+mCP6oBHD/yRMA8XxP5sb7Q7gpA=
-cloud.google.com/go/recommender v1.11.0/go.mod h1:kPiRQhPyTJ9kyXPCG6u/dlPLbYfFlkwHNRwdzPVAoII=
-cloud.google.com/go/recommender v1.11.1/go.mod h1:sGwFFAyI57v2Hc5LbIj+lTwXipGu9NW015rkaEM5B18=
-cloud.google.com/go/recommender v1.11.2/go.mod h1:AeoJuzOvFR/emIcXdVFkspVXVTYpliRCmKNYDnyBv6Y=
-cloud.google.com/go/recommender v1.11.3/go.mod h1:+FJosKKJSId1MBFeJ/TTyoGQZiEelQQIZMKYYD8ruK4=
 cloud.google.com/go/redis v1.7.0/go.mod h1:V3x5Jq1jzUcg+UNsRvdmsfuFnit1cfe3Z/PGyq/lm4Y=
 cloud.google.com/go/redis v1.8.0/go.mod h1:Fm2szCDavWzBk2cDKxrkmWBqoCiL1+Ctwq7EyqBCA/A=
 cloud.google.com/go/redis v1.9.0/go.mod h1:HMYQuajvb2D0LvMgZmLDZW8V5aOC/WxstZHiy4g8OiA=
 cloud.google.com/go/redis v1.10.0/go.mod h1:ThJf3mMBQtW18JzGgh41/Wld6vnDDc/F/F35UolRZPM=
 cloud.google.com/go/redis v1.11.0/go.mod h1:/X6eicana+BWcUda5PpwZC48o37SiFVTFSs0fWAJ7uQ=
-cloud.google.com/go/redis v1.13.1/go.mod h1:VP7DGLpE91M6bcsDdMuyCm2hIpB6Vp2hI090Mfd1tcg=
-cloud.google.com/go/redis v1.13.2/go.mod h1:0Hg7pCMXS9uz02q+LoEVl5dNHUkIQv+C/3L76fandSA=
-cloud.google.com/go/redis v1.13.3/go.mod h1:vbUpCKUAZSYzFcWKmICnYgRAhTFg9r+djWqFxDYXi4U=
-cloud.google.com/go/redis v1.14.1/go.mod h1:MbmBxN8bEnQI4doZPC1BzADU4HGocHBk2de3SbgOkqs=
 cloud.google.com/go/resourcemanager v1.3.0/go.mod h1:bAtrTjZQFJkiWTPDb1WBjzvc6/kifjj4QBYuKCCoqKA=
 cloud.google.com/go/resourcemanager v1.4.0/go.mod h1:MwxuzkumyTX7/a3n37gmsT3py7LIXwrShilPh3P1tR0=
 cloud.google.com/go/resourcemanager v1.5.0/go.mod h1:eQoXNAiAvCf5PXxWxXjhKQoTMaUSNrEfg+6qdf/wots=
 cloud.google.com/go/resourcemanager v1.6.0/go.mod h1:YcpXGRs8fDzcUl1Xw8uOVmI8JEadvhRIkoXXUNVYcVo=
 cloud.google.com/go/resourcemanager v1.7.0/go.mod h1:HlD3m6+bwhzj9XCouqmeiGuni95NTrExfhoSrkC/3EI=
-cloud.google.com/go/resourcemanager v1.9.1/go.mod h1:dVCuosgrh1tINZ/RwBufr8lULmWGOkPS8gL5gqyjdT8=
-cloud.google.com/go/resourcemanager v1.9.2/go.mod h1:OujkBg1UZg5lX2yIyMo5Vz9O5hf7XQOSV7WxqxxMtQE=
-cloud.google.com/go/resourcemanager v1.9.3/go.mod h1:IqrY+g0ZgLsihcfcmqSe+RKp1hzjXwG904B92AwBz6U=
-cloud.google.com/go/resourcemanager v1.9.4/go.mod h1:N1dhP9RFvo3lUfwtfLWVxfUWq8+KUQ+XLlHLH3BoFJ0=
 cloud.google.com/go/resourcesettings v1.3.0/go.mod h1:lzew8VfESA5DQ8gdlHwMrqZs1S9V87v3oCnKCWoOuQU=
 cloud.google.com/go/resourcesettings v1.4.0/go.mod h1:ldiH9IJpcrlC3VSuCGvjR5of/ezRrOxFtpJoJo5SmXg=
 cloud.google.com/go/resourcesettings v1.5.0/go.mod h1:+xJF7QSG6undsQDfsCJyqWXyBwUoJLhetkRMDRnIoXA=
-cloud.google.com/go/resourcesettings v1.6.1/go.mod h1:M7mk9PIZrC5Fgsu1kZJci6mpgN8o0IUzVx3eJU3y4Jw=
-cloud.google.com/go/resourcesettings v1.6.2/go.mod h1:mJIEDd9MobzunWMeniaMp6tzg4I2GvD3TTmPkc8vBXk=
-cloud.google.com/go/resourcesettings v1.6.3/go.mod h1:pno5D+7oDYkMWZ5BpPsb4SO0ewg3IXcmmrUZaMJrFic=
-cloud.google.com/go/resourcesettings v1.6.4/go.mod h1:pYTTkWdv2lmQcjsthbZLNBP4QW140cs7wqA3DuqErVI=
 cloud.google.com/go/retail v1.8.0/go.mod h1:QblKS8waDmNUhghY2TI9O3JLlFk8jybHeV4BF19FrE4=
 cloud.google.com/go/retail v1.9.0/go.mod h1:g6jb6mKuCS1QKnH/dpu7isX253absFl6iE92nHwlBUY=
 cloud.google.com/go/retail v1.10.0/go.mod h1:2gDk9HsL4HMS4oZwz6daui2/jmKvqShXKQuB2RZ+cCc=
 cloud.google.com/go/retail v1.11.0/go.mod h1:MBLk1NaWPmh6iVFSz9MeKG/Psyd7TAgm6y/9L2B4x9Y=
 cloud.google.com/go/retail v1.12.0/go.mod h1:UMkelN/0Z8XvKymXFbD4EhFJlYKRx1FGhQkVPU5kF14=
-cloud.google.com/go/retail v1.14.1/go.mod h1:y3Wv3Vr2k54dLNIrCzenyKG8g8dhvhncT2NcNjb/6gE=
-cloud.google.com/go/retail v1.14.2/go.mod h1:W7rrNRChAEChX336QF7bnMxbsjugcOCPU44i5kbLiL8=
-cloud.google.com/go/retail v1.14.3/go.mod h1:Omz2akDHeSlfCq8ArPKiBxlnRpKEBjUH386JYFLUvXo=
-cloud.google.com/go/retail v1.14.4/go.mod h1:l/N7cMtY78yRnJqp5JW8emy7MB1nz8E4t2yfOmklYfg=
 cloud.google.com/go/run v0.2.0/go.mod h1:CNtKsTA1sDcnqqIFR3Pb5Tq0usWxJJvsWOCPldRU3Do=
 cloud.google.com/go/run v0.3.0/go.mod h1:TuyY1+taHxTjrD0ZFk2iAR+xyOXEA0ztb7U3UNA0zBo=
 cloud.google.com/go/run v0.8.0/go.mod h1:VniEnuBwqjigv0A7ONfQUaEItaiCRVujlMqerPPiktM=
 cloud.google.com/go/run v0.9.0/go.mod h1:Wwu+/vvg8Y+JUApMwEDfVfhetv30hCG4ZwDR/IXl2Qg=
-cloud.google.com/go/run v1.2.0/go.mod h1:36V1IlDzQ0XxbQjUx6IYbw8H3TJnWvhii963WW3B/bo=
-cloud.google.com/go/run v1.3.0/go.mod h1:S/osX/4jIPZGg+ssuqh6GNgg7syixKe3YnprwehzHKU=
-cloud.google.com/go/run v1.3.1/go.mod h1:cymddtZOzdwLIAsmS6s+Asl4JoXIDm/K1cpZTxV4Q5s=
-cloud.google.com/go/run v1.3.2/go.mod h1:SIhmqArbjdU/D9M6JoHaAqnAMKLFtXaVdNeq04NjnVE=
-cloud.google.com/go/run v1.3.3/go.mod h1:WSM5pGyJ7cfYyYbONVQBN4buz42zFqwG67Q3ch07iK4=
 cloud.google.com/go/scheduler v1.4.0/go.mod h1:drcJBmxF3aqZJRhmkHQ9b3uSSpQoltBPGPxGAWROx6s=
 cloud.google.com/go/scheduler v1.5.0/go.mod h1:ri073ym49NW3AfT6DZi21vLZrG07GXr5p3H1KxN5QlI=
 cloud.google.com/go/scheduler v1.6.0/go.mod h1:SgeKVM7MIwPn3BqtcBntpLyrIJftQISRrYB5ZtT+KOk=
 cloud.google.com/go/scheduler v1.7.0/go.mod h1:jyCiBqWW956uBjjPMMuX09n3x37mtyPJegEWKxRsn44=
 cloud.google.com/go/scheduler v1.8.0/go.mod h1:TCET+Y5Gp1YgHT8py4nlg2Sew8nUHMqcpousDgXJVQc=
 cloud.google.com/go/scheduler v1.9.0/go.mod h1:yexg5t+KSmqu+njTIh3b7oYPheFtBWGcbVUYF1GGMIc=
-cloud.google.com/go/scheduler v1.10.1/go.mod h1:R63Ldltd47Bs4gnhQkmNDse5w8gBRrhObZ54PxgR2Oo=
-cloud.google.com/go/scheduler v1.10.2/go.mod h1:O3jX6HRH5eKCA3FutMw375XHZJudNIKVonSCHv7ropY=
-cloud.google.com/go/scheduler v1.10.3/go.mod h1:8ANskEM33+sIbpJ+R4xRfw/jzOG+ZFE8WVLy7/yGvbc=
-cloud.google.com/go/scheduler v1.10.4/go.mod h1:MTuXcrJC9tqOHhixdbHDFSIuh7xZF2IysiINDuiq6NI=
 cloud.google.com/go/secretmanager v1.6.0/go.mod h1:awVa/OXF6IiyaU1wQ34inzQNc4ISIDIrId8qE5QGgKA=
 cloud.google.com/go/secretmanager v1.8.0/go.mod h1:hnVgi/bN5MYHd3Gt0SPuTPPp5ENina1/LxM+2W9U9J4=
 cloud.google.com/go/secretmanager v1.9.0/go.mod h1:b71qH2l1yHmWQHt9LC80akm86mX8AL6X1MA01dW8ht4=
 cloud.google.com/go/secretmanager v1.10.0/go.mod h1:MfnrdvKMPNra9aZtQFvBcvRU54hbPD8/HayQdlUgJpU=
-cloud.google.com/go/secretmanager v1.11.1/go.mod h1:znq9JlXgTNdBeQk9TBW/FnR/W4uChEKGeqQWAJ8SXFw=
-cloud.google.com/go/secretmanager v1.11.2/go.mod h1:MQm4t3deoSub7+WNwiC4/tRYgDBHJgJPvswqQVB1Vss=
-cloud.google.com/go/secretmanager v1.11.3/go.mod h1:0bA2o6FabmShrEy328i67aV+65XoUFFSmVeLBn/51jI=
-cloud.google.com/go/secretmanager v1.11.4/go.mod h1:wreJlbS9Zdq21lMzWmJ0XhWW2ZxgPeahsqeV/vZoJ3w=
 cloud.google.com/go/security v1.5.0/go.mod h1:lgxGdyOKKjHL4YG3/YwIL2zLqMFCKs0UbQwgyZmfJl4=
 cloud.google.com/go/security v1.7.0/go.mod h1:mZklORHl6Bg7CNnnjLH//0UlAlaXqiG7Lb9PsPXLfD0=
 cloud.google.com/go/security v1.8.0/go.mod h1:hAQOwgmaHhztFhiQ41CjDODdWP0+AE1B3sX4OFlq+GU=
@@ -942,20 +502,12 @@ cloud.google.com/go/security v1.9.0/go.mod h1:6Ta1bO8LXI89nZnmnsZGp9lVoVWXqsVbIq
 cloud.google.com/go/security v1.10.0/go.mod h1:QtOMZByJVlibUT2h9afNDWRZ1G96gVywH8T5GUSb9IA=
 cloud.google.com/go/security v1.12.0/go.mod h1:rV6EhrpbNHrrxqlvW0BWAIawFWq3X90SduMJdFwtLB8=
 cloud.google.com/go/security v1.13.0/go.mod h1:Q1Nvxl1PAgmeW0y3HTt54JYIvUdtcpYKVfIB8AOMZ+0=
-cloud.google.com/go/security v1.15.1/go.mod h1:MvTnnbsWnehoizHi09zoiZob0iCHVcL4AUBj76h9fXA=
-cloud.google.com/go/security v1.15.2/go.mod h1:2GVE/v1oixIRHDaClVbHuPcZwAqFM28mXuAKCfMgYIg=
-cloud.google.com/go/security v1.15.3/go.mod h1:gQ/7Q2JYUZZgOzqKtw9McShH+MjNvtDpL40J1cT+vBs=
-cloud.google.com/go/security v1.15.4/go.mod h1:oN7C2uIZKhxCLiAAijKUCuHLZbIt/ghYEo8MqwD/Ty4=
 cloud.google.com/go/securitycenter v1.13.0/go.mod h1:cv5qNAqjY84FCN6Y9z28WlkKXyWsgLO832YiWwkCWcU=
 cloud.google.com/go/securitycenter v1.14.0/go.mod h1:gZLAhtyKv85n52XYWt6RmeBdydyxfPeTrpToDPw4Auc=
 cloud.google.com/go/securitycenter v1.15.0/go.mod h1:PeKJ0t8MoFmmXLXWm41JidyzI3PJjd8sXWaVqg43WWk=
 cloud.google.com/go/securitycenter v1.16.0/go.mod h1:Q9GMaLQFUD+5ZTabrbujNWLtSLZIZF7SAR0wWECrjdk=
 cloud.google.com/go/securitycenter v1.18.1/go.mod h1:0/25gAzCM/9OL9vVx4ChPeM/+DlfGQJDwBy/UC8AKK0=
 cloud.google.com/go/securitycenter v1.19.0/go.mod h1:LVLmSg8ZkkyaNy4u7HCIshAngSQ8EcIRREP3xBnyfag=
-cloud.google.com/go/securitycenter v1.23.0/go.mod h1:8pwQ4n+Y9WCWM278R8W3nF65QtY172h4S8aXyI9/hsQ=
-cloud.google.com/go/securitycenter v1.23.1/go.mod h1:w2HV3Mv/yKhbXKwOCu2i8bCuLtNP1IMHuiYQn4HJq5s=
-cloud.google.com/go/securitycenter v1.24.1/go.mod h1:3h9IdjjHhVMXdQnmqzVnM7b0wMn/1O/U20eWVpMpZjI=
-cloud.google.com/go/securitycenter v1.24.2/go.mod h1:l1XejOngggzqwr4Fa2Cn+iWZGf+aBLTXtB/vXjy5vXM=
 cloud.google.com/go/servicecontrol v1.4.0/go.mod h1:o0hUSJ1TXJAmi/7fLJAedOovnujSEvjKCAFNXPQ1RaU=
 cloud.google.com/go/servicecontrol v1.5.0/go.mod h1:qM0CnXHhyqKVuiZnGKrIurvVImCs8gmqWsDoqe9sU1s=
 cloud.google.com/go/servicecontrol v1.10.0/go.mod h1:pQvyvSRh7YzUF2efw7H87V92mxU8FnFDawMClGCNuAA=
@@ -967,11 +519,6 @@ cloud.google.com/go/servicedirectory v1.6.0/go.mod h1:pUlbnWsLH9c13yGkxCmfumWEPj
 cloud.google.com/go/servicedirectory v1.7.0/go.mod h1:5p/U5oyvgYGYejufvxhgwjL8UVXjkuw7q5XcG10wx1U=
 cloud.google.com/go/servicedirectory v1.8.0/go.mod h1:srXodfhY1GFIPvltunswqXpVxFPpZjf8nkKQT7XcXaY=
 cloud.google.com/go/servicedirectory v1.9.0/go.mod h1:29je5JjiygNYlmsGz8k6o+OZ8vd4f//bQLtvzkPPT/s=
-cloud.google.com/go/servicedirectory v1.10.1/go.mod h1:Xv0YVH8s4pVOwfM/1eMTl0XJ6bzIOSLDt8f8eLaGOxQ=
-cloud.google.com/go/servicedirectory v1.11.0/go.mod h1:Xv0YVH8s4pVOwfM/1eMTl0XJ6bzIOSLDt8f8eLaGOxQ=
-cloud.google.com/go/servicedirectory v1.11.1/go.mod h1:tJywXimEWzNzw9FvtNjsQxxJ3/41jseeILgwU/QLrGI=
-cloud.google.com/go/servicedirectory v1.11.2/go.mod h1:KD9hCLhncWRV5jJphwIpugKwM5bn1x0GyVVD4NO8mGg=
-cloud.google.com/go/servicedirectory v1.11.3/go.mod h1:LV+cHkomRLr67YoQy3Xq2tUXBGOs5z5bPofdq7qtiAw=
 cloud.google.com/go/servicemanagement v1.4.0/go.mod h1:d8t8MDbezI7Z2R1O/wu8oTggo3BI2GKYbdG4y/SJTco=
 cloud.google.com/go/servicemanagement v1.5.0/go.mod h1:XGaCRe57kfqu4+lRxaFEAuqmjzF0r+gWHjWqKqBvKFo=
 cloud.google.com/go/servicemanagement v1.6.0/go.mod h1:aWns7EeeCOtGEX4OvZUWCCJONRZeFKiptqKf1D0l/Jc=
@@ -983,30 +530,17 @@ cloud.google.com/go/serviceusage v1.6.0/go.mod h1:R5wwQcbOWsyuOfbP9tGdAnCAc6B9DR
 cloud.google.com/go/shell v1.3.0/go.mod h1:VZ9HmRjZBsjLGXusm7K5Q5lzzByZmJHf1d0IWHEN5X4=
 cloud.google.com/go/shell v1.4.0/go.mod h1:HDxPzZf3GkDdhExzD/gs8Grqk+dmYcEjGShZgYa9URw=
 cloud.google.com/go/shell v1.6.0/go.mod h1:oHO8QACS90luWgxP3N9iZVuEiSF84zNyLytb+qE2f9A=
-cloud.google.com/go/shell v1.7.1/go.mod h1:u1RaM+huXFaTojTbW4g9P5emOrrmLE69KrxqQahKn4g=
-cloud.google.com/go/shell v1.7.2/go.mod h1:KqRPKwBV0UyLickMn0+BY1qIyE98kKyI216sH/TuHmc=
-cloud.google.com/go/shell v1.7.3/go.mod h1:cTTEz/JdaBsQAeTQ3B6HHldZudFoYBOqjteev07FbIc=
-cloud.google.com/go/shell v1.7.4/go.mod h1:yLeXB8eKLxw0dpEmXQ/FjriYrBijNsONpwnWsdPqlKM=
 cloud.google.com/go/spanner v1.41.0/go.mod h1:MLYDBJR/dY4Wt7ZaMIQ7rXOTLjYrmxLE/5ve9vFfWos=
 cloud.google.com/go/spanner v1.44.0/go.mod h1:G8XIgYdOK+Fbcpbs7p2fiprDw4CaZX63whnSMLVBxjk=
 cloud.google.com/go/spanner v1.45.0/go.mod h1:FIws5LowYz8YAE1J8fOS7DJup8ff7xJeetWEo5REA2M=
-cloud.google.com/go/spanner v1.47.0/go.mod h1:IXsJwVW2j4UKs0eYDqodab6HgGuA1bViSqW4uH9lfUI=
-cloud.google.com/go/spanner v1.49.0/go.mod h1:eGj9mQGK8+hkgSVbHNQ06pQ4oS+cyc4tXXd6Dif1KoM=
-cloud.google.com/go/spanner v1.50.0/go.mod h1:eGj9mQGK8+hkgSVbHNQ06pQ4oS+cyc4tXXd6Dif1KoM=
-cloud.google.com/go/spanner v1.51.0/go.mod h1:c5KNo5LQ1X5tJwma9rSQZsXNBDNvj4/n8BVc3LNahq0=
-cloud.google.com/go/spanner v1.55.0 h1:YF/A/k73EMYCjp8wcJTpkE+TcrWutHRlsCtlRSfWS64=
-cloud.google.com/go/spanner v1.55.0/go.mod h1:HXEznMUVhC+PC+HDyo9YFG2Ajj5BQDkcbqB9Z2Ffxi0=
+cloud.google.com/go/spanner v1.85.1 h1:cJx1ZD//C2QIfFQl8hSTn4twL8amAXtnayyflRIjj40=
+cloud.google.com/go/spanner v1.85.1/go.mod h1:bbwCXbM+zljwSPLZ44wZOdzcdmy89hbUGmM/r9sD0ws=
 cloud.google.com/go/speech v1.6.0/go.mod h1:79tcr4FHCimOp56lwC01xnt/WPJZc4v3gzyT7FoBkCM=
 cloud.google.com/go/speech v1.7.0/go.mod h1:KptqL+BAQIhMsj1kOP2la5DSEEerPDuOP/2mmkhHhZQ=
 cloud.google.com/go/speech v1.8.0/go.mod h1:9bYIl1/tjsAnMgKGHKmBZzXKEkGgtU+MpdDPTE9f7y0=
 cloud.google.com/go/speech v1.9.0/go.mod h1:xQ0jTcmnRFFM2RfX/U+rk6FQNUF6DQlydUSyoooSpco=
 cloud.google.com/go/speech v1.14.1/go.mod h1:gEosVRPJ9waG7zqqnsHpYTOoAS4KouMRLDFMekpJ0J0=
 cloud.google.com/go/speech v1.15.0/go.mod h1:y6oH7GhqCaZANH7+Oe0BhgIogsNInLlz542tg3VqeYI=
-cloud.google.com/go/speech v1.17.1/go.mod h1:8rVNzU43tQvxDaGvqOhpDqgkJTFowBpDvCJ14kGlJYo=
-cloud.google.com/go/speech v1.19.0/go.mod h1:8rVNzU43tQvxDaGvqOhpDqgkJTFowBpDvCJ14kGlJYo=
-cloud.google.com/go/speech v1.19.1/go.mod h1:WcuaWz/3hOlzPFOVo9DUsblMIHwxP589y6ZMtaG+iAA=
-cloud.google.com/go/speech v1.19.2/go.mod h1:2OYFfj+Ch5LWjsaSINuCZsre/789zlcCI3SY4oAi2oI=
-cloud.google.com/go/speech v1.20.1/go.mod h1:wwolycgONvfz2EDU8rKuHRW3+wc9ILPsAWoikBEWavY=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
@@ -1018,80 +552,45 @@ cloud.google.com/go/storage v1.23.0/go.mod h1:vOEEDNFnciUMhBeT6hsJIn3ieU5cFRmzeL
 cloud.google.com/go/storage v1.27.0/go.mod h1:x9DOL8TK/ygDUMieqwfhdpQryTeEkhGKMi80i/iqR2s=
 cloud.google.com/go/storage v1.28.1/go.mod h1:Qnisd4CqDdo6BGs2AD5LLnEsmSQ80wQ5ogcBBKhU86Y=
 cloud.google.com/go/storage v1.29.0/go.mod h1:4puEjyTKnku6gfKoTfNOU/W+a9JyuVNxjpS5GBrB8h4=
-cloud.google.com/go/storage v1.30.1/go.mod h1:NfxhC0UJE1aXSx7CIIbCf7y9HKT7BiccwkR7+P7gN8E=
-cloud.google.com/go/storage v1.36.0 h1:P0mOkAcaJxhCTvAkMhxMfrTKiNcub4YmmPBtlhAyTr8=
-cloud.google.com/go/storage v1.36.0/go.mod h1:M6M/3V/D3KpzMTJyPOR/HU6n2Si5QdaXYEsng2xgOs8=
+cloud.google.com/go/storage v1.56.1 h1:n6gy+yLnHn0hTwBFzNn8zJ1kqWfR91wzdM8hjRF4wP0=
+cloud.google.com/go/storage v1.56.1/go.mod h1:C9xuCZgFl3buo2HZU/1FncgvvOgTAs/rnh4gF4lMg0s=
 cloud.google.com/go/storagetransfer v1.5.0/go.mod h1:dxNzUopWy7RQevYFHewchb29POFv3/AaBgnhqzqiK0w=
 cloud.google.com/go/storagetransfer v1.6.0/go.mod h1:y77xm4CQV/ZhFZH75PLEXY0ROiS7Gh6pSKrM8dJyg6I=
 cloud.google.com/go/storagetransfer v1.7.0/go.mod h1:8Giuj1QNb1kfLAiWM1bN6dHzfdlDAVC9rv9abHot2W4=
 cloud.google.com/go/storagetransfer v1.8.0/go.mod h1:JpegsHHU1eXg7lMHkvf+KE5XDJ7EQu0GwNJbbVGanEw=
-cloud.google.com/go/storagetransfer v1.10.0/go.mod h1:DM4sTlSmGiNczmV6iZyceIh2dbs+7z2Ayg6YAiQlYfA=
-cloud.google.com/go/storagetransfer v1.10.1/go.mod h1:rS7Sy0BtPviWYTTJVWCSV4QrbBitgPeuK4/FKa4IdLs=
-cloud.google.com/go/storagetransfer v1.10.2/go.mod h1:meIhYQup5rg9juQJdyppnA/WLQCOguxtk1pr3/vBWzA=
-cloud.google.com/go/storagetransfer v1.10.3/go.mod h1:Up8LY2p6X68SZ+WToswpQbQHnJpOty/ACcMafuey8gc=
 cloud.google.com/go/talent v1.1.0/go.mod h1:Vl4pt9jiHKvOgF9KoZo6Kob9oV4lwd/ZD5Cto54zDRw=
 cloud.google.com/go/talent v1.2.0/go.mod h1:MoNF9bhFQbiJ6eFD3uSsg0uBALw4n4gaCaEjBw9zo8g=
 cloud.google.com/go/talent v1.3.0/go.mod h1:CmcxwJ/PKfRgd1pBjQgU6W3YBwiewmUzQYH5HHmSCmM=
 cloud.google.com/go/talent v1.4.0/go.mod h1:ezFtAgVuRf8jRsvyE6EwmbTK5LKciD4KVnHuDEFmOOA=
 cloud.google.com/go/talent v1.5.0/go.mod h1:G+ODMj9bsasAEJkQSzO2uHQWXHHXUomArjWQQYkqK6c=
-cloud.google.com/go/talent v1.6.2/go.mod h1:CbGvmKCG61mkdjcqTcLOkb2ZN1SrQI8MDyma2l7VD24=
-cloud.google.com/go/talent v1.6.3/go.mod h1:xoDO97Qd4AK43rGjJvyBHMskiEf3KulgYzcH6YWOVoo=
-cloud.google.com/go/talent v1.6.4/go.mod h1:QsWvi5eKeh6gG2DlBkpMaFYZYrYUnIpo34f6/V5QykY=
-cloud.google.com/go/talent v1.6.5/go.mod h1:Mf5cma696HmE+P2BWJ/ZwYqeJXEeU0UqjHFXVLadEDI=
 cloud.google.com/go/texttospeech v1.4.0/go.mod h1:FX8HQHA6sEpJ7rCMSfXuzBcysDAuWusNNNvN9FELDd8=
 cloud.google.com/go/texttospeech v1.5.0/go.mod h1:oKPLhR4n4ZdQqWKURdwxMy0uiTS1xU161C8W57Wkea4=
 cloud.google.com/go/texttospeech v1.6.0/go.mod h1:YmwmFT8pj1aBblQOI3TfKmwibnsfvhIBzPXcW4EBovc=
-cloud.google.com/go/texttospeech v1.7.1/go.mod h1:m7QfG5IXxeneGqTapXNxv2ItxP/FS0hCZBwXYqucgSk=
-cloud.google.com/go/texttospeech v1.7.2/go.mod h1:VYPT6aTOEl3herQjFHYErTlSZJ4vB00Q2ZTmuVgluD4=
-cloud.google.com/go/texttospeech v1.7.3/go.mod h1:Av/zpkcgWfXlDLRYob17lqMstGZ3GqlvJXqKMp2u8so=
-cloud.google.com/go/texttospeech v1.7.4/go.mod h1:vgv0002WvR4liGuSd5BJbWy4nDn5Ozco0uJymY5+U74=
 cloud.google.com/go/tpu v1.3.0/go.mod h1:aJIManG0o20tfDQlRIej44FcwGGl/cD0oiRyMKG19IQ=
 cloud.google.com/go/tpu v1.4.0/go.mod h1:mjZaX8p0VBgllCzF6wcU2ovUXN9TONFLd7iz227X2Xg=
 cloud.google.com/go/tpu v1.5.0/go.mod h1:8zVo1rYDFuW2l4yZVY0R0fb/v44xLh3llq7RuV61fPM=
-cloud.google.com/go/tpu v1.6.1/go.mod h1:sOdcHVIgDEEOKuqUoi6Fq53MKHJAtOwtz0GuKsWSH3E=
-cloud.google.com/go/tpu v1.6.2/go.mod h1:NXh3NDwt71TsPZdtGWgAG5ThDfGd32X1mJ2cMaRlVgU=
-cloud.google.com/go/tpu v1.6.3/go.mod h1:lxiueqfVMlSToZY1151IaZqp89ELPSrk+3HIQ5HRkbY=
-cloud.google.com/go/tpu v1.6.4/go.mod h1:NAm9q3Rq2wIlGnOhpYICNI7+bpBebMJbh0yyp3aNw1Y=
 cloud.google.com/go/trace v1.3.0/go.mod h1:FFUE83d9Ca57C+K8rDl/Ih8LwOzWIV1krKgxg6N0G28=
 cloud.google.com/go/trace v1.4.0/go.mod h1:UG0v8UBqzusp+z63o7FK74SdFE+AXpCLdFb1rshXG+Y=
 cloud.google.com/go/trace v1.8.0/go.mod h1:zH7vcsbAhklH8hWFig58HvxcxyQbaIqMarMg9hn5ECA=
 cloud.google.com/go/trace v1.9.0/go.mod h1:lOQqpE5IaWY0Ixg7/r2SjixMuc6lfTFeO4QGM4dQWOk=
-cloud.google.com/go/trace v1.10.1/go.mod h1:gbtL94KE5AJLH3y+WVpfWILmqgc6dXcqgNXdOPAQTYk=
-cloud.google.com/go/trace v1.10.2/go.mod h1:NPXemMi6MToRFcSxRl2uDnu/qAlAQ3oULUphcHGh1vA=
-cloud.google.com/go/trace v1.10.3/go.mod h1:Ke1bgfc73RV3wUFml+uQp7EsDw4dGaETLxB7Iq/r4CY=
-cloud.google.com/go/trace v1.10.4/go.mod h1:Nso99EDIK8Mj5/zmB+iGr9dosS/bzWCJ8wGmE6TXNWY=
+cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
+cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
 cloud.google.com/go/translate v1.3.0/go.mod h1:gzMUwRjvOqj5i69y/LYLd8RrNQk+hOmIXTi9+nb3Djs=
 cloud.google.com/go/translate v1.4.0/go.mod h1:06Dn/ppvLD6WvA5Rhdp029IX2Mi3Mn7fpMRLPvXT5Wg=
 cloud.google.com/go/translate v1.5.0/go.mod h1:29YDSYveqqpA1CQFD7NQuP49xymq17RXNaUDdc0mNu0=
 cloud.google.com/go/translate v1.6.0/go.mod h1:lMGRudH1pu7I3n3PETiOB2507gf3HnfLV8qlkHZEyos=
 cloud.google.com/go/translate v1.7.0/go.mod h1:lMGRudH1pu7I3n3PETiOB2507gf3HnfLV8qlkHZEyos=
-cloud.google.com/go/translate v1.8.1/go.mod h1:d1ZH5aaOA0CNhWeXeC8ujd4tdCFw8XoNWRljklu5RHs=
-cloud.google.com/go/translate v1.8.2/go.mod h1:d1ZH5aaOA0CNhWeXeC8ujd4tdCFw8XoNWRljklu5RHs=
-cloud.google.com/go/translate v1.9.0/go.mod h1:d1ZH5aaOA0CNhWeXeC8ujd4tdCFw8XoNWRljklu5RHs=
-cloud.google.com/go/translate v1.9.1/go.mod h1:TWIgDZknq2+JD4iRcojgeDtqGEp154HN/uL6hMvylS8=
-cloud.google.com/go/translate v1.9.2/go.mod h1:E3Tc6rUTsQkVrXW6avbUhKJSr7ZE3j7zNmqzXKHqRrY=
-cloud.google.com/go/translate v1.9.3/go.mod h1:Kbq9RggWsbqZ9W5YpM94Q1Xv4dshw/gr/SHfsl5yCZ0=
 cloud.google.com/go/video v1.8.0/go.mod h1:sTzKFc0bUSByE8Yoh8X0mn8bMymItVGPfTuUBUyRgxk=
 cloud.google.com/go/video v1.9.0/go.mod h1:0RhNKFRF5v92f8dQt0yhaHrEuH95m068JYOvLZYnJSw=
 cloud.google.com/go/video v1.12.0/go.mod h1:MLQew95eTuaNDEGriQdcYn0dTwf9oWiA4uYebxM5kdg=
 cloud.google.com/go/video v1.13.0/go.mod h1:ulzkYlYgCp15N2AokzKjy7MQ9ejuynOJdf1tR5lGthk=
 cloud.google.com/go/video v1.14.0/go.mod h1:SkgaXwT+lIIAKqWAJfktHT/RbgjSuY6DobxEp0C5yTQ=
 cloud.google.com/go/video v1.15.0/go.mod h1:SkgaXwT+lIIAKqWAJfktHT/RbgjSuY6DobxEp0C5yTQ=
-cloud.google.com/go/video v1.17.1/go.mod h1:9qmqPqw/Ib2tLqaeHgtakU+l5TcJxCJbhFXM7UJjVzU=
-cloud.google.com/go/video v1.19.0/go.mod h1:9qmqPqw/Ib2tLqaeHgtakU+l5TcJxCJbhFXM7UJjVzU=
-cloud.google.com/go/video v1.20.0/go.mod h1:U3G3FTnsvAGqglq9LxgqzOiBc/Nt8zis8S+850N2DUM=
-cloud.google.com/go/video v1.20.1/go.mod h1:3gJS+iDprnj8SY6pe0SwLeC5BUW80NjhwX7INWEuWGU=
-cloud.google.com/go/video v1.20.2/go.mod h1:lrixr5JeKNThsgfM9gqtwb6Okuqzfo4VrY2xynaViTA=
-cloud.google.com/go/video v1.20.3/go.mod h1:TnH/mNZKVHeNtpamsSPygSR0iHtvrR/cW1/GDjN5+GU=
 cloud.google.com/go/videointelligence v1.6.0/go.mod h1:w0DIDlVRKtwPCn/C4iwZIJdvC69yInhW0cfi+p546uU=
 cloud.google.com/go/videointelligence v1.7.0/go.mod h1:k8pI/1wAhjznARtVT9U1llUaFNPh7muw8QyOUpavru4=
 cloud.google.com/go/videointelligence v1.8.0/go.mod h1:dIcCn4gVDdS7yte/w+koiXn5dWVplOZkE+xwG9FgK+M=
 cloud.google.com/go/videointelligence v1.9.0/go.mod h1:29lVRMPDYHikk3v8EdPSaL8Ku+eMzDljjuvRs105XoU=
 cloud.google.com/go/videointelligence v1.10.0/go.mod h1:LHZngX1liVtUhZvi2uNS0VQuOzNi2TkY1OakiuoUOjU=
-cloud.google.com/go/videointelligence v1.11.1/go.mod h1:76xn/8InyQHarjTWsBR058SmlPCwQjgcvoW0aZykOvo=
-cloud.google.com/go/videointelligence v1.11.2/go.mod h1:ocfIGYtIVmIcWk1DsSGOoDiXca4vaZQII1C85qtoplc=
-cloud.google.com/go/videointelligence v1.11.3/go.mod h1:tf0NUaGTjU1iS2KEkGWvO5hRHeCkFK3nPo0/cOZhZAo=
-cloud.google.com/go/videointelligence v1.11.4/go.mod h1:kPBMAYsTPFiQxMLmmjpcZUMklJp3nC9+ipJJtprccD8=
 cloud.google.com/go/vision v1.2.0/go.mod h1:SmNwgObm5DpFBme2xpyOyasvBc1aPdjvMk2bBk0tKD0=
 cloud.google.com/go/vision/v2 v2.2.0/go.mod h1:uCdV4PpN1S0jyCyq8sIM42v2Y6zOLkZs+4R9LrGYwFo=
 cloud.google.com/go/vision/v2 v2.3.0/go.mod h1:UO61abBx9QRMFkNBbf1D8B1LXdS2cGiiCRx0vSpZoUo=
@@ -1099,92 +598,55 @@ cloud.google.com/go/vision/v2 v2.4.0/go.mod h1:VtI579ll9RpVTrdKdkMzckdnwMyX2JILb
 cloud.google.com/go/vision/v2 v2.5.0/go.mod h1:MmaezXOOE+IWa+cS7OhRRLK2cNv1ZL98zhqFFZaaH2E=
 cloud.google.com/go/vision/v2 v2.6.0/go.mod h1:158Hes0MvOS9Z/bDMSFpjwsUrZ5fPrdwuyyvKSGAGMY=
 cloud.google.com/go/vision/v2 v2.7.0/go.mod h1:H89VysHy21avemp6xcf9b9JvZHVehWbET0uT/bcuY/0=
-cloud.google.com/go/vision/v2 v2.7.2/go.mod h1:jKa8oSYBWhYiXarHPvP4USxYANYUEdEsQrloLjrSwJU=
-cloud.google.com/go/vision/v2 v2.7.3/go.mod h1:V0IcLCY7W+hpMKXK1JYE0LV5llEqVmj+UJChjvA1WsM=
-cloud.google.com/go/vision/v2 v2.7.4/go.mod h1:ynDKnsDN/0RtqkKxQZ2iatv3Dm9O+HfRb5djl7l4Vvw=
-cloud.google.com/go/vision/v2 v2.7.5/go.mod h1:GcviprJLFfK9OLf0z8Gm6lQb6ZFUulvpZws+mm6yPLM=
 cloud.google.com/go/vmmigration v1.2.0/go.mod h1:IRf0o7myyWFSmVR1ItrBSFLFD/rJkfDCUTO4vLlJvsE=
 cloud.google.com/go/vmmigration v1.3.0/go.mod h1:oGJ6ZgGPQOFdjHuocGcLqX4lc98YQ7Ygq8YQwHh9A7g=
 cloud.google.com/go/vmmigration v1.5.0/go.mod h1:E4YQ8q7/4W9gobHjQg4JJSgXXSgY21nA5r8swQV+Xxc=
 cloud.google.com/go/vmmigration v1.6.0/go.mod h1:bopQ/g4z+8qXzichC7GW1w2MjbErL54rk3/C843CjfY=
-cloud.google.com/go/vmmigration v1.7.1/go.mod h1:WD+5z7a/IpZ5bKK//YmT9E047AD+rjycCAvyMxGJbro=
-cloud.google.com/go/vmmigration v1.7.2/go.mod h1:iA2hVj22sm2LLYXGPT1pB63mXHhrH1m/ruux9TwWLd8=
-cloud.google.com/go/vmmigration v1.7.3/go.mod h1:ZCQC7cENwmSWlwyTrZcWivchn78YnFniEQYRWQ65tBo=
-cloud.google.com/go/vmmigration v1.7.4/go.mod h1:yBXCmiLaB99hEl/G9ZooNx2GyzgsjKnw5fWcINRgD70=
 cloud.google.com/go/vmwareengine v0.1.0/go.mod h1:RsdNEf/8UDvKllXhMz5J40XxDrNJNN4sagiox+OI208=
 cloud.google.com/go/vmwareengine v0.2.2/go.mod h1:sKdctNJxb3KLZkE/6Oui94iw/xs9PRNC2wnNLXsHvH8=
 cloud.google.com/go/vmwareengine v0.3.0/go.mod h1:wvoyMvNWdIzxMYSpH/R7y2h5h3WFkx6d+1TIsP39WGY=
-cloud.google.com/go/vmwareengine v0.4.1/go.mod h1:Px64x+BvjPZwWuc4HdmVhoygcXqEkGHXoa7uyfTgSI0=
-cloud.google.com/go/vmwareengine v1.0.0/go.mod h1:Px64x+BvjPZwWuc4HdmVhoygcXqEkGHXoa7uyfTgSI0=
-cloud.google.com/go/vmwareengine v1.0.1/go.mod h1:aT3Xsm5sNx0QShk1Jc1B8OddrxAScYLwzVoaiXfdzzk=
-cloud.google.com/go/vmwareengine v1.0.2/go.mod h1:xMSNjIk8/itYrz1JA8nV3Ajg4L4n3N+ugP8JKzk3OaA=
-cloud.google.com/go/vmwareengine v1.0.3/go.mod h1:QSpdZ1stlbfKtyt6Iu19M6XRxjmXO+vb5a/R6Fvy2y4=
 cloud.google.com/go/vpcaccess v1.4.0/go.mod h1:aQHVbTWDYUR1EbTApSVvMq1EnT57ppDmQzZ3imqIk4w=
 cloud.google.com/go/vpcaccess v1.5.0/go.mod h1:drmg4HLk9NkZpGfCmZ3Tz0Bwnm2+DKqViEpeEpOq0m8=
 cloud.google.com/go/vpcaccess v1.6.0/go.mod h1:wX2ILaNhe7TlVa4vC5xce1bCnqE3AeH27RV31lnmZes=
-cloud.google.com/go/vpcaccess v1.7.1/go.mod h1:FogoD46/ZU+JUBX9D606X21EnxiszYi2tArQwLY4SXs=
-cloud.google.com/go/vpcaccess v1.7.2/go.mod h1:mmg/MnRHv+3e8FJUjeSibVFvQF1cCy2MsFaFqxeY1HU=
-cloud.google.com/go/vpcaccess v1.7.3/go.mod h1:YX4skyfW3NC8vI3Fk+EegJnlYFatA+dXK4o236EUCUc=
-cloud.google.com/go/vpcaccess v1.7.4/go.mod h1:lA0KTvhtEOb/VOdnH/gwPuOzGgM+CWsmGu6bb4IoMKk=
 cloud.google.com/go/webrisk v1.4.0/go.mod h1:Hn8X6Zr+ziE2aNd8SliSDWpEnSS1u4R9+xXZmFiHmGE=
 cloud.google.com/go/webrisk v1.5.0/go.mod h1:iPG6fr52Tv7sGk0H6qUFzmL3HHZev1htXuWDEEsqMTg=
 cloud.google.com/go/webrisk v1.6.0/go.mod h1:65sW9V9rOosnc9ZY7A7jsy1zoHS5W9IAXv6dGqhMQMc=
 cloud.google.com/go/webrisk v1.7.0/go.mod h1:mVMHgEYH0r337nmt1JyLthzMr6YxwN1aAIEc2fTcq7A=
 cloud.google.com/go/webrisk v1.8.0/go.mod h1:oJPDuamzHXgUc+b8SiHRcVInZQuybnvEW72PqTc7sSg=
-cloud.google.com/go/webrisk v1.9.1/go.mod h1:4GCmXKcOa2BZcZPn6DCEvE7HypmEJcJkr4mtM+sqYPc=
-cloud.google.com/go/webrisk v1.9.2/go.mod h1:pY9kfDgAqxUpDBOrG4w8deLfhvJmejKB0qd/5uQIPBc=
-cloud.google.com/go/webrisk v1.9.3/go.mod h1:RUYXe9X/wBDXhVilss7EDLW9ZNa06aowPuinUOPCXH8=
-cloud.google.com/go/webrisk v1.9.4/go.mod h1:w7m4Ib4C+OseSr2GL66m0zMBywdrVNTDKsdEsfMl7X0=
 cloud.google.com/go/websecurityscanner v1.3.0/go.mod h1:uImdKm2wyeXQevQJXeh8Uun/Ym1VqworNDlBXQevGMo=
 cloud.google.com/go/websecurityscanner v1.4.0/go.mod h1:ebit/Fp0a+FWu5j4JOmJEV8S8CzdTkAS77oDsiSqYWQ=
 cloud.google.com/go/websecurityscanner v1.5.0/go.mod h1:Y6xdCPy81yi0SQnDY1xdNTNpfY1oAgXUlcfN3B3eSng=
-cloud.google.com/go/websecurityscanner v1.6.1/go.mod h1:Njgaw3rttgRHXzwCB8kgCYqv5/rGpFCsBOvPbYgszpg=
-cloud.google.com/go/websecurityscanner v1.6.2/go.mod h1:7YgjuU5tun7Eg2kpKgGnDuEOXWIrh8x8lWrJT4zfmas=
-cloud.google.com/go/websecurityscanner v1.6.3/go.mod h1:x9XANObUFR+83Cya3g/B9M/yoHVqzxPnFtgF8yYGAXw=
-cloud.google.com/go/websecurityscanner v1.6.4/go.mod h1:mUiyMQ+dGpPPRkHgknIZeCzSHJ45+fY4F52nZFDHm2o=
 cloud.google.com/go/workflows v1.6.0/go.mod h1:6t9F5h/unJz41YqfBmqSASJSXccBLtD1Vwf+KmJENM0=
 cloud.google.com/go/workflows v1.7.0/go.mod h1:JhSrZuVZWuiDfKEFxU0/F1PQjmpnpcoISEXH2bcHC3M=
 cloud.google.com/go/workflows v1.8.0/go.mod h1:ysGhmEajwZxGn1OhGOGKsTXc5PyxOc0vfKf5Af+to4M=
 cloud.google.com/go/workflows v1.9.0/go.mod h1:ZGkj1aFIOd9c8Gerkjjq7OW7I5+l6cSvT3ujaO/WwSA=
 cloud.google.com/go/workflows v1.10.0/go.mod h1:fZ8LmRmZQWacon9UCX1r/g/DfAXx5VcPALq2CxzdePw=
-cloud.google.com/go/workflows v1.11.1/go.mod h1:Z+t10G1wF7h8LgdY/EmRcQY8ptBD/nvofaL6FqlET6g=
-cloud.google.com/go/workflows v1.12.0/go.mod h1:PYhSk2b6DhZ508tj8HXKaBh+OFe+xdl0dHF/tJdzPQM=
-cloud.google.com/go/workflows v1.12.1/go.mod h1:5A95OhD/edtOhQd/O741NSfIMezNTbCwLM1P1tBRGHM=
-cloud.google.com/go/workflows v1.12.2/go.mod h1:+OmBIgNqYJPVggnMo9nqmizW0qEXHhmnAzK/CnBqsHc=
-cloud.google.com/go/workflows v1.12.3/go.mod h1:fmOUeeqEwPzIU81foMjTRQIdwQHADi/vEr1cx9R1m5g=
-dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
-dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
 github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMbk2FiG/kXiLl8BRyzTWDw7gX/Hz7Dd5eDMs=
 github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN7oaIRCjzsZ2dE+yG5k+rsdt3qcwykqK6HVGcKwsw4=
-github.com/99designs/keyring v1.2.2 h1:pZd3neh/EmUzWONb35LxQfvuY7kiSXAq3HQd97+XBn0=
-github.com/99designs/keyring v1.2.2/go.mod h1:wes/FrByc8j7lFOAGLGSNEg8f/PaI3cgTBqhFkHUrPk=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8/go.mod h1:CzsSbkDixRphAF5hS6wbMKq0eI6ccJRb7/A0M6JBnwg=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20221206110420-d395f97c4830/go.mod h1:VzwV+t+dZ9j/H867F1M2ziD+yLHtB46oM35FxxMJ4d0=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
-github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0/go.mod h1:OahwfttHWG6eJ0clwcfBAHoDI6X/LV/15hx/wlMZSrU=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/Azure/azure-pipeline-go v0.2.3 h1:7U9HBg1JFK3jHl5qmo4CTZKFTVgMwdFHMVtCdfBE21U=
 github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=
-github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
-github.com/Azure/azure-sdk-for-go v44.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
-github.com/Azure/azure-sdk-for-go v56.3.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v0.19.0/go.mod h1:h6H6c8enJmmocHUbLiiGY6sx7f9i+X3m1CHdd5c6Rdw=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.6.0/go.mod h1:bjGvMhVMb+EEm3VRNQawDMUyMMjo+S5ewNjflkep/0Q=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.1 h1:lGlwhPtrX6EVml1hO0ivjkUxsSyl4dsiw9qcA1k/3IQ=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.1/go.mod h1:RKUqNu35KJYcVG/fqTRqmuXJZYNhYkBrnC/hX7yGbTA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 h1:5YTBM8QDVIBN3sxBil89WfdAAqDZbyJTgh688DSxX5w=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v0.11.0/go.mod h1:HcM1YX14R7CJcghJGOYCgdezslRSVzqwLf/q+4Y2r/0=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.3.0/go.mod h1:OQeznEEkTZ9OrhHJoDD8ZDq51FHgXjqtP9z6bEwBq9U=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1 h1:sO0/P7g68FrryJzljemN+6GTssUXdANk6aJ7T1ZxnsQ=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1/go.mod h1:h8hyGFDsU5HMivxiS2iYFZsgDbU9OnnJ163x5UGVKYo=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.12.0 h1:wL5IEG5zb7BVv1Kv0Xm92orq+5hB5Nipn3B5tn4Rqfk=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.12.0/go.mod h1:J7MUC/wtRpfGVbQ5sIItY5/FuVWmvzlY21WAOfQnq/I=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8=
 github.com/Azure/azure-sdk-for-go/sdk/internal v0.7.0/go.mod h1:yqy467j36fJxcRV2TzfVZ1pCb5vxm4BtZPUdYWe/Xo8=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.3.0/go.mod h1:okt5dMMTOFjX/aovMlrjvvXoPMBVSPzk9185BT0+eZM=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.1 h1:6oNBlSdi1QqM1PNW7FPA6xOGA5UNsXnkaYZz9vdPGhA=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.1/go.mod h1:s4kgfzA0covAXNicZHDMN58jExvcng2mC/DepXiF1EI=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI=
 github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0 h1:m/sWOGCREuSBqg2htVQTBY8nOZpyajYztF0vUvSZTuM=
 github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0/go.mod h1:Pu5Zksi2KrU7LPbZbNINx6fuVrUp/ffvpxdDj+i8LeE=
 github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 h1:FbH3BbSb4bvGluTesZZ+ttN/MDsnMmQP36OSnDuSXqw=
@@ -1197,88 +659,80 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal v1.1.2 h1:mLY+pNL
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal v1.1.2/go.mod h1:FbdwsQ2EzwvXxOPcMFYO8ogEc9uMMIj3YkmCdXdAFmk=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0 h1:PTFGRSlMKCQelWwxUyYVEUqseBJVemLyqWJjvMyt0do=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0/go.mod h1:LRr2FzBTQlONPPa5HREE5+RjSCTXl7BwOvYOaWTqCaI=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0 h1:2qsIIvxVT+uE6yrNldntJKlLRgxGbZ85kgtz5SNBhMw=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v3 v3.1.0/go.mod h1:AW8VEadnhw9xox+VaVd9sP7NjzOAnaZBLRH6Tq3cJ38=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/managementgroups/armmanagementgroups v1.0.0 h1:pPvTJ1dY0sA35JOeFq6TsY2xj6Z85Yo23Pj4wCCvu4o=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/managementgroups/armmanagementgroups v1.0.0/go.mod h1:mLfWfj8v3jfWKsL9G4eoBoXVcsqcIUTapmdKy7uGOp0=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.2.0 h1:z4YeiSXxnUI+PqB46Yj6MZA3nwb1CcJIkEMDrzUd8Cs=
-github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.2.0/go.mod h1:rko9SzMxcMk0NJsNAxALEGaTYyy79bNRwxgJfrH0Spw=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0 h1:L7G3dExHBgUxsO3qpTGhk/P2dgnYyW48yn7AO33Tbek=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/msi/armmsi v1.3.0/go.mod h1:Ms6gYEy0+A2knfKrwdatsggTXYA2+ICKug8w7STorFw=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork v1.0.0 h1:nBy98uKOIfun5z6wx6jwWLrULcM0+cjBalBFZlEZ7CA=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork v1.0.0/go.mod h1:243D9iHbcQXoFUtgHJwL7gl2zx1aDuDMjvBZVGr2uW0=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 h1:Dd+RhdJn0OTtVGaeDLZpcumkIVCtA/3/Fo42+eoYvVM=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0 h1:u/LLAOFgsMv7HmNL4Qufg58y+qElGOt5qv0z1mURkRY=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.0.0/go.mod h1:2e8rMJtl2+2j+HXbTBwnyGpm5Nou7KhvSfxOq8JpTag=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.6.0 h1:PiSrjRPpkQNjrM8H0WwKMnZUdu1RGMtd/LdGKUrOo+c=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.6.0/go.mod h1:oDrbWx4ewMylP7xHivfgixbfGBT6APAwsSoHRKotnIc=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1 h1:cf+OIKbkmMHBaC3u78AXomweqM0oxQSgBXRZf3WH4yM=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.4.1/go.mod h1:ap1dmS6vQKJxSMNiGJcq4QuUQkOynyD93gLw6MDF7ek=
 github.com/Azure/azure-storage-blob-go v0.15.0 h1:rXtgp8tN1p29GvpGgfJetavIG0V7OgcSXPpwp3tx6qk=
 github.com/Azure/azure-storage-blob-go v0.15.0/go.mod h1:vbjsVbX0dlxnRc4FFMPsS9BsJWPcne7GB7onqlPvz58=
-github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
-github.com/Azure/go-ansiterm v0.0.0-20210608223527-2377c96fe795/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
-github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Azure/go-autorest v10.8.1+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
 github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
-github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
-github.com/Azure/go-autorest/autorest v0.11.0/go.mod h1:JFgpikqFJ/MleTTxwepExTKnFUKKszPS8UavbQYUMuw=
-github.com/Azure/go-autorest/autorest v0.11.1/go.mod h1:JFgpikqFJ/MleTTxwepExTKnFUKKszPS8UavbQYUMuw=
-github.com/Azure/go-autorest/autorest v0.11.18/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
 github.com/Azure/go-autorest/autorest v0.11.24/go.mod h1:G6kyRlFnTuSbEYkQGawPfsCswgme4iYf6rfSKUDzbCc=
 github.com/Azure/go-autorest/autorest v0.11.29 h1:I4+HL/JDvErx2LjyzaVxllw2lRDB5/BT2Bm4g20iqYw=
 github.com/Azure/go-autorest/autorest v0.11.29/go.mod h1:ZtEzC4Jy2JDrZLxvWs8LrBWEBycl1hbT1eknI8MtfAs=
-github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0=
-github.com/Azure/go-autorest/autorest/adal v0.9.0/go.mod h1:/c022QCutn2P7uY+/oQWWNcK9YU+MH96NgK+jErpbcg=
-github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
 github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
 github.com/Azure/go-autorest/autorest/adal v0.9.18/go.mod h1:XVVeme+LZwABT8K5Lc3hA4nAe8LDBVle26gTrguhhPQ=
 github.com/Azure/go-autorest/autorest/adal v0.9.22/go.mod h1:XuAbAEUv2Tta//+voMI038TrJBqjKam0me7qR+L8Cmk=
-github.com/Azure/go-autorest/autorest/adal v0.9.23 h1:Yepx8CvFxwNKpH6ja7RZ+sKX+DWYNldbLiALMC3BTz8=
-github.com/Azure/go-autorest/autorest/adal v0.9.23/go.mod h1:5pcMqFkdPhviJdlEy3kC/v1ZLnQl0MH6XA5YCcMhy4c=
-github.com/Azure/go-autorest/autorest/azure/auth v0.5.0/go.mod h1:QRTvSZQpxqm8mSErhnbI+tANIBAKP7B+UIE2z4ypUO0=
+github.com/Azure/go-autorest/autorest/adal v0.9.24 h1:BHZfgGsGwdkHDyZdtQRQk1WeUdW0m2WPAwuHZwUi5i4=
+github.com/Azure/go-autorest/autorest/adal v0.9.24/go.mod h1:7T1+g0PYFmACYW5LlG2fcoPiPlFHjClyRGL7dRlP5c8=
 github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 h1:wkAZRgT/pn8HhFyzfe9UnqOjJYqlembgCTi72Bm/xKk=
 github.com/Azure/go-autorest/autorest/azure/auth v0.5.12/go.mod h1:84w/uV8E37feW2NCJ08uT9VBfjfUHpgLVnG2InYD6cg=
-github.com/Azure/go-autorest/autorest/azure/cli v0.4.0/go.mod h1:JljT387FplPzBA31vUcvsetLKF3pec5bdAxjVU4kI2s=
 github.com/Azure/go-autorest/autorest/azure/cli v0.4.5/go.mod h1:ADQAXrkgm7acgWVUNamOgh8YNrv4p27l3Wc55oVfpzg=
 github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 h1:w77/uPk80ZET2F+AfQExZyEWtn+0Rk/uw17m9fv5Ajc=
 github.com/Azure/go-autorest/autorest/azure/cli v0.4.6/go.mod h1:piCfgPho7BiIDdEQ1+g4VmKyD5y+p/XtSNqE6Hc4QD0=
-github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA=
 github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
 github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
-github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
-github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
-github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
 github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
 github.com/Azure/go-autorest/autorest/mocks v0.4.2 h1:PGN4EDXnuQbojHbU0UWoNvmu9AGVwYHG9/fkDYhtAfw=
 github.com/Azure/go-autorest/autorest/mocks v0.4.2/go.mod h1:Vy7OitM9Kei0i1Oj+LvyAWMXJHeKH1MVlzFugfVrmyU=
 github.com/Azure/go-autorest/autorest/to v0.4.0 h1:oXVqrxakqqV1UZdSazDOPOLvOIz+XA683u8EctwboHk=
 github.com/Azure/go-autorest/autorest/to v0.4.0/go.mod h1:fE8iZBn7LQR7zH/9XU2NcPR4o9jEImooCeWJcYV/zLE=
-github.com/Azure/go-autorest/autorest/validation v0.3.0/go.mod h1:yhLgjC0Wda5DYXl6JAsWyUe4KVNffhoDhG0zVzUMo3E=
 github.com/Azure/go-autorest/autorest/validation v0.3.1 h1:AgyqjAd94fwNAoTjl/WQXg4VvFeRFpO+UhNyRXqF1ac=
 github.com/Azure/go-autorest/autorest/validation v0.3.1/go.mod h1:yhLgjC0Wda5DYXl6JAsWyUe4KVNffhoDhG0zVzUMo3E=
-github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
-github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
 github.com/Azure/go-autorest/logger v0.2.1 h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg=
 github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
-github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
 github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo=
 github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
-github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.0.0/go.mod h1:kgDmCTgBzIEPFElEF+FK0SdjAor06dRq2Go927dnQ6o=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.2.1 h1:DzHpqpoJVaCgOUdVHxE8QB52S6NiVdDQvGlny1qvPqA=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.2.1/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
+github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 h1:XkkQbfMyuH2jTSjQjSoihryI8GINRcs4xp8lNawg0FI=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
-github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
-github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DataDog/datadog-go v2.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/DataDog/datadog-go v3.2.0+incompatible h1:qSG2N4FghB1He/r2mFrWKCaL7dXCilEuNEeAn20fdD4=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
-github.com/DataDog/datadog-go/v5 v5.0.2/go.mod h1:ZI9JFB4ewXbw1sBnF4sxsR2k1H3xjV+PUAOUsHvKpcU=
+github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3 h1:2afWGsMzkIcN8Qm4mgPJKZWyroE5QBszMiDMYEBrnfw=
+github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3/go.mod h1:dppbR7CwXD4pgtV9t3wD1812RaLDcBjtblcDF5f1vI0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 h1:UQUsRi8WTzhZntp5313l+CHIAT95ojUI2lpP/ExlZa4=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0/go.mod h1:Cz6ft6Dkn3Et6l2v2a9/RpN7epQ1GtDlO6lj8bEcOvw=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 h1:owcC2UnmsZycprQ5RfRgjydWhuoxg71LUfyiQdijZuM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0/go.mod h1:ZPpqegjbE99EPKsu3iUWV22A04wzGPcAY/ziSIQEEgs=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0 h1:4LP6hvB4I5ouTbGgWtixJhgED6xdf67twf9PoY96Tbg=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0/go.mod h1:jUZ5LYlw40WMd07qxcQJD5M40aUxrfwqQX1g7zxYnrQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 h1:Ron4zCA/yk6U7WOBXhTJcDpsUBG9npumK6xw2auFltQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0/go.mod h1:cSgYe11MCNYunTnRXrKiR/tHc0eoKjICUuWpNZoVCOo=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo=
-github.com/Jeffail/gabs v1.1.1 h1:V0uzR08Hj22EX8+8QMhyI9sX2hwRu+/RJhJUmnwda/E=
-github.com/Jeffail/gabs v1.1.1/go.mod h1:6xMvQMK4k33lb7GUUpaAPh6nKMmemQeg5d4gn7/bOXc=
-github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
+github.com/Jeffail/gabs/v2 v2.1.0 h1:6dV9GGOjoQgzWTQEltZPXlJdFloxvIq7DwqgxMCbq30=
+github.com/Jeffail/gabs/v2 v2.1.0/go.mod h1:xCn81vdHKxFUuWWAaD5jCTQDNPBMh5pPs9IJ+NcziBI=
+github.com/Jeffail/keyring v1.2.3 h1:WRmYdGPmHoJqX66KjGXQBALp6mUN00tD0ds5C4pqEsQ=
+github.com/Jeffail/keyring v1.2.3/go.mod h1:xIg4RDmDwDuUFoU4IzDIT3b+HV24JUYlzo6ILZUH3Sc=
 github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
@@ -1286,103 +740,60 @@ github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF0
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
-github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
-github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
-github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
-github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
-github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
-github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
-github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
-github.com/Microsoft/go-winio v0.4.16-0.20201130162521-d1ffc52c7331/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
-github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
-github.com/Microsoft/go-winio v0.4.17-0.20210211115548-6eac466e5fa3/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.4.17-0.20210324224401-5516f17a5958/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.4.17/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.5.0/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
+github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
+github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
-github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
-github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
-github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
-github.com/Microsoft/hcsshim v0.8.6/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
-github.com/Microsoft/hcsshim v0.8.7-0.20190325164909-8abdbb8205e4/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
-github.com/Microsoft/hcsshim v0.8.7/go.mod h1:OHd7sQqRFrYd3RmSgbgji+ctCwkbq2wbEYNSzOYtcBQ=
-github.com/Microsoft/hcsshim v0.8.9/go.mod h1:5692vkUqntj1idxauYlpoINNKeqCiG6Sg38RRsjT5y8=
-github.com/Microsoft/hcsshim v0.8.14/go.mod h1:NtVKoYxQuTLx6gEq0L96c9Ju4JbRJ4nY2ow3VK6a9Lg=
-github.com/Microsoft/hcsshim v0.8.15/go.mod h1:x38A4YbHbdxJtc0sF6oIz+RG0npwSCAvn69iY6URG00=
-github.com/Microsoft/hcsshim v0.8.16/go.mod h1:o5/SZqmR7x9JNKsW3pu+nqHm0MF8vbA+VxGOoXdC600=
-github.com/Microsoft/hcsshim v0.8.20/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
-github.com/Microsoft/hcsshim v0.8.21/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
-github.com/Microsoft/hcsshim v0.8.23/go.mod h1:4zegtUJth7lAvFyc6cH2gGQ5B3OFQim01nnU2M8jKDg=
-github.com/Microsoft/hcsshim v0.9.2/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
-github.com/Microsoft/hcsshim v0.9.3/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
-github.com/Microsoft/hcsshim v0.9.4/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
-github.com/Microsoft/hcsshim v0.9.6/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
-github.com/Microsoft/hcsshim v0.9.10/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
-github.com/Microsoft/hcsshim v0.11.4 h1:68vKo2VN8DE9AdN4tnkWnmdhqdbpUFM8OF3Airm7fz8=
-github.com/Microsoft/hcsshim v0.11.4/go.mod h1:smjE4dvqPX9Zldna+t5FG3rnoHhaB7QYxPRqGcpAD9w=
-github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
-github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
-github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
-github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 h1:kkhsdkhsCvIsutKu5zLMgWtgh9YxGCNAw8Ad8hjwfYg=
-github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
-github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
-github.com/SAP/go-hdb v0.14.1 h1:hkw4ozGZ/i4eak7ZuGkY5e0hxiXFdNUBNhr4AvZVNFE=
-github.com/SAP/go-hdb v0.14.1/go.mod h1:7fdQLVC2lER3urZLjZCm0AuMQfApof92n3aylBPEkMo=
+github.com/ProtonMail/go-crypto v1.2.0 h1:+PhXXn4SPGd+qk76TlEePBfOfivE0zkWFenhGhFLzWs=
+github.com/ProtonMail/go-crypto v1.2.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
+github.com/ProtonMail/gopenpgp/v3 v3.2.1 h1:ohRlKL5YwyIkN5kk7uBvijiMsyA57mK0yBEJg9xButU=
+github.com/ProtonMail/gopenpgp/v3 v3.2.1/go.mod h1:x7RduTo/0n/2PjTFRoEHApaxye/8PFbhoCquwfYBUGM=
+github.com/SAP/go-hdb v1.10.1 h1:c9dGT5xHZNDwPL3NQcRpnNISn3MchwYaGoMZpCAllUs=
+github.com/SAP/go-hdb v1.10.1/go.mod h1:vxYDca44L2eRudZv5JAI6T+IygOfxb7vOCFh/Kj0pug=
 github.com/Sectorbob/mlab-ns2 v0.0.0-20171030222938-d3aa0c295a8a h1:KFHLI4QGttB0i7M3qOkAo8Zn/GSsxwwCnInFqBaYtkM=
 github.com/Sectorbob/mlab-ns2 v0.0.0-20171030222938-d3aa0c295a8a/go.mod h1:D73UAuEPckrDorYZdtlCu2ySOLuPB5W4rhIkmmc/XbI=
-github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
 github.com/abdullin/seq v0.0.0-20160510034733-d5467c17e7af h1:DBNMBMuMiWYu0b+8KMJuWmfCkcxl09JwdlqwDZZ6U14=
 github.com/abdullin/seq v0.0.0-20160510034733-d5467c17e7af/go.mod h1:5Jv4cbFiHJMsVxt52+i0Ha45fjshj6wxYr1r19tB9bw=
 github.com/aerospike/aerospike-client-go/v5 v5.6.0 h1:tRxcUq0HY8fFPQEzF3EgrknF+w1xFO0YDfUb9Nm8yRI=
 github.com/aerospike/aerospike-client-go/v5 v5.6.0/go.mod h1:rJ/KpmClE7kiBPfvAPrGw9WuNOiz8v2uKbQaUyYPXtI=
-github.com/agext/levenshtein v1.2.1 h1:QmvMAjj2aEICytGiWzmxoE0x2KZvE0fvmqMOfy2tjT8=
-github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
-github.com/agnivade/levenshtein v1.0.1/go.mod h1:CURSv5d9Uaml+FovSIICkLbAUZ9S4RqaHDIsdSBg7lM=
+github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
+github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/ajstarks/deck v0.0.0-20200831202436-30c9fc6549a9/go.mod h1:JynElWSGnm/4RlzPXRlREEwqTHAN3T56Bv2ITsFT3gY=
 github.com/ajstarks/deck/generate v0.0.0-20210309230005-c3f852c02e19/go.mod h1:T13YZdzov6OU0A1+RfKZiZN9ca6VeKdBdyDV+BY97Tk=
 github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw=
 github.com/ajstarks/svgo v0.0.0-20211024235047-1546f124cd8b/go.mod h1:1KcenG0jGWcpt8ov532z81sp/kMMUG485J2InIOyADM=
-github.com/akavel/rsrc v0.10.2/go.mod h1:uLoCtb9J+EyAqh+26kdrTgmzRBFPGOolLWKpdxkKq+c=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
-github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:CgnQgUtFrFz9mxFNtED3jI5tLDjKlOM+oUF/sTk6ps0=
-github.com/alexflint/go-filemutex v1.1.0/go.mod h1:7P4iRhttt/nUvUOrYIhcpMzv2G6CY9UnI16Z+UJqRyk=
-github.com/alexflint/go-filemutex v1.2.0/go.mod h1:mYyQSWvw9Tx2/H2n9qXPb52tTYfE0pZAWcBq5mK025c=
-github.com/aliyun/alibaba-cloud-sdk-go v1.62.676 h1:ChWMMr76tXrRh3ximWQyg83EROEfkkXQGkrhnzDCpr8=
-github.com/aliyun/alibaba-cloud-sdk-go v1.62.676/go.mod h1:CJJYa1ZMxjlN/NbXEwmejEnBkhi0DV+Yb3B2lxf+74o=
+github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
+github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/aliyun/alibaba-cloud-sdk-go v1.63.107 h1:qagvUyrgOnBIlVRQWOyCZGVKUIYbMBdGdJ104vBpRFU=
+github.com/aliyun/alibaba-cloud-sdk-go v1.63.107/go.mod h1:SOSDHfe1kX91v3W5QiBsWSLqeLxImobbMX1mxrFHsVQ=
 github.com/aliyun/aliyun-oss-go-sdk v0.0.0-20190307165228-86c17b95fcd5 h1:nWDRPCyCltiTsANwC/n3QZH7Vww33Npq9MKqlwRzI/c=
 github.com/aliyun/aliyun-oss-go-sdk v0.0.0-20190307165228-86c17b95fcd5/go.mod h1:T/Aws4fEfogEE9v+HPhhw+CntffsBHJ8nXQCwKr0/g8=
-github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
-github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y=
 github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
-github.com/andybalholm/brotli v1.0.5 h1:8uQZIdzKmjc/iuPu7O2ioW48L81FgatrcpfFmiq/cCs=
-github.com/andybalholm/brotli v1.0.5/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
+github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
+github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/antlr/antlr4/runtime/Go/antlr v0.0.0-20220418222510-f25a4f6275ed/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY=
-github.com/antlr/antlr4/runtime/Go/antlr v1.4.10/go.mod h1:F7bn7fEU90QkQ3tnmaTx3LTKLEDqnwWODIYppRQ5hnY=
+github.com/apache/arrow-go/v18 v18.4.0 h1:/RvkGqH517iY8bZKc4FD5/kkdwXJGjxf28JIXbJ/oB0=
+github.com/apache/arrow-go/v18 v18.4.0/go.mod h1:Aawvwhj8x2jURIzD9Moy72cF0FyJXOpkYpdmGRHcw14=
 github.com/apache/arrow/go/v10 v10.0.1/go.mod h1:YvhnlEePVnBS4+0z3fhPfUy7W1Ikj0Ih0vcRo/gZ1M0=
 github.com/apache/arrow/go/v11 v11.0.0/go.mod h1:Eg5OsL5H+e299f7u5ssuXsuHQVEGC4xei5aX110hRiI=
-github.com/apache/arrow/go/v12 v12.0.0/go.mod h1:d+tV/eHZZ7Dz7RPrFKtPK02tpr+c9/PEd/zm8mDS9Vg=
-github.com/apache/arrow/go/v14 v14.0.2 h1:N8OkaJEOfI3mEZt07BIkvo4sC6XDbL+48MBPWO5IONw=
-github.com/apache/arrow/go/v14 v14.0.2/go.mod h1:u3fgh3EdgN/YQ8cVQRguVW3R+seMybFg8QBQ5LU+eBY=
 github.com/apache/thrift v0.16.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU=
-github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
-github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
+github.com/apache/thrift v0.22.0 h1:r7mTJdj51TMDe6RtcmNdQxgn9XcyfGDOzegMDRg47uc=
+github.com/apache/thrift v0.22.0/go.mod h1:1e7J/O1Ae6ZQMTYdy9xa3w9k+XHWPfRvdPyJeynQ+/g=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/apple/foundationdb/bindings/go v0.0.0-20190411004307-cd5c9d91fad2 h1:VoHKYIXEQU5LWoambPBOvYxyLqZYHuj+rj5DVnMUc3k=
 github.com/apple/foundationdb/bindings/go v0.0.0-20190411004307-cd5c9d91fad2/go.mod h1:OMVSB21p9+xQUIqlGizHPZfjK+SHws1ht+ZytVDoz9U=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
@@ -1397,84 +808,71 @@ github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
-github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go v1.15.11/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
-github.com/aws/aws-sdk-go v1.25.41/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
+github.com/avast/retry-go/v4 v4.6.1 h1:VkOLRubHdisGrHnTu89g08aQEWEgRU7LVEop3GbIcMk=
+github.com/avast/retry-go/v4 v4.6.1/go.mod h1:V6oF8njAwxJ5gRo1Q7Cxab24xs5NCWZBeaHHBklR8mA=
 github.com/aws/aws-sdk-go v1.34.0/go.mod h1:5zCpMtNQVjRREroY7sYe8lOMRSxkhG6MZveU8YkpAk0=
-github.com/aws/aws-sdk-go v1.36.29/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
-github.com/aws/aws-sdk-go v1.43.16/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go v1.50.13 h1:yeXram2g7q8uKkQkAEeZyk9FmPzxI4UpGwAZGZtEGmM=
-github.com/aws/aws-sdk-go v1.50.13/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
-github.com/aws/aws-sdk-go-v2 v1.17.7/go.mod h1:uzbQtefpm44goOPmdKyAlXSNcwlRgF3ePWVW6EtJvvw=
-github.com/aws/aws-sdk-go-v2 v1.23.4 h1:2P20ZjH0ouSAu/6yZep8oCmTReathLuEu6dwoqEgjts=
-github.com/aws/aws-sdk-go-v2 v1.23.4/go.mod h1:t3szzKfP0NeRU27uBFczDivYJjsmSnqI8kIvKyWb9ds=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10 h1:dK82zF6kkPeCo8J1e+tGx4JdvDIQzj7ygIoLg8WMuGs=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.10/go.mod h1:VeTZetY5KRJLuD/7fkQXMU6Mw7H5m/KP2J5Iy9osMno=
-github.com/aws/aws-sdk-go-v2/config v1.18.19 h1:AqFK6zFNtq4i1EYu+eC7lcKHYnZagMn6SW171la0bGw=
-github.com/aws/aws-sdk-go-v2/config v1.18.19/go.mod h1:XvTmGMY8d52ougvakOv1RpiTLPz9dlG/OQHsKU/cMmY=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.18 h1:EQMdtHwz0ILTW1hoP+EwuWhwCG1hD6l3+RWFQABET4c=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.18/go.mod h1:vnwlwjIe+3XJPBYKu1et30ZPABG3VaXJYr8ryohpIyM=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.1 h1:gt57MN3liKiyGopcqgNzJb2+d9MJaKT/q1OksHNXVE4=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.1/go.mod h1:lfUx8puBRdM5lVVMQlwt2v+ofiG/X6Ms+dy0UkG/kXw=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.59 h1:E3Y+OfzOK1+rmRo/K2G0ml8Vs+Xqk0kOnf4nS0kUtBc=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.59/go.mod h1:1M4PLSBUVfBI0aP+C9XI7SM6kZPCGYyI6izWz0TGprE=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.31/go.mod h1:QT0BqUvX1Bh2ABdTGnjqEjvjzrCfIniM9Sc8zn9Yndo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.7 h1:eMqD7ku6WGdmcWWXPYun9m6yk6feSULLhJlAtN6rYG4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.7/go.mod h1:0oBIfcDV6LScxEW0VgOqxT3e4aqKRp+SYhB9wAd5E3Q=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.25/go.mod h1:zBHOPwhBc3FlQjQJE/D3IfPWiWaQmT06Vq9aNukDo0k=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.7 h1:+XYhWhgWs5F3Zx8oa49CXzNvfXrItaDjZB/M172fcHQ=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.7/go.mod h1:L6tcSRyCGxcKfDWUrmv2jv8G1cLDU7d0FUpEFpG9bVE=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.32 h1:p5luUImdIqywn6JpQsW3tq5GNOxKmOnEpybzPx+d1lk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.32/go.mod h1:XGhIBZDEgfqmFIugclZ6FU7v75nHhBDtzuB4xB/tEi4=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.23 h1:DWYZIsyqagnWL00f8M/SOr9fN063OEQWn9LLTbdYXsk=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.0.23/go.mod h1:uIiFgURZbACBEQJfqTZPb/jxO7R+9LeoHUFudtIdeQI=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11 h1:y2+VQzC6Zh2ojtV2LoC0MNwHWc6qXv/j2vrQtlftkdA=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.11/go.mod h1:iV4q2hsqtNECrfmlXyord9u4zyuFEJX9eLgLpSPzWA8=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.26 h1:CeuSeq/8FnYpPtnuIeLQEEvDv9zUjneuYi8EghMBdwQ=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.26/go.mod h1:2UqAAwMUXKeRkAHIlDJqvMVgOWkUi/AUXPk/YIe+Dg4=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.25 h1:5LHn8JQ0qvjD9L9JhMtylnkcw7j05GDZqM9Oin6hpr0=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.25/go.mod h1:/95IA+0lMnzW6XzqYJRpjjsAbKEORVeO0anQqjd2CNU=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.0 h1:e2ooMhpYGhDnBfSvIyusvAwX7KexuZaHbQY2Dyei7VU=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.14.0/go.mod h1:bh2E0CXKZsQN+faiKVqC40vfNMAWheoULBCnEgO9K+8=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.31.0 h1:B1G2pSPvbAtQjilPq+Y7jLIzCOwKzuVEl+aBBaNG0AQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.31.0/go.mod h1:ncltU6n4Nof5uJttDtcNQ537uNuwYqsZZQcpkd2/GUQ=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.29.1 h1:OZI2aJxnfOZzB0uhyTaYIW6MeRMb1Qd2eLMjh0bFsRg=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.29.1/go.mod h1:GiU88YWgOho2cyEyS2YZo3GYz/j4etRYKWbJdcYgpuQ=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.6 h1:5V7DWLBd7wTELVz5bPpwzYy/sikk0gsgZfj40X+l5OI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.6/go.mod h1:Y1VOmit/Fn6Tz1uFAeCO6Q7M2fmfXSCLeL5INVYsLuY=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.6 h1:B8cauxOH1W1v7rd8RdI/MWnoR4Ze0wIHWrb90qczxj4=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.6/go.mod h1:Lh/bc9XUf8CfOY6Jp5aIkQtN+j1mc+nExc+KXj9jx2s=
-github.com/aws/aws-sdk-go-v2/service/sts v1.18.7 h1:bWNgNdRko2x6gqa0blfATqAZKZokPIeM1vfmQt2pnvM=
-github.com/aws/aws-sdk-go-v2/service/sts v1.18.7/go.mod h1:JuTnSoeePXmMVe9G8NcjjwgOKEfZ4cOjMuT2IBT/2eI=
-github.com/aws/smithy-go v1.13.5/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
-github.com/aws/smithy-go v1.18.1 h1:pOdBTUfXNazOlxLrgeYalVnuTpKreACHtc62xLwIB3c=
-github.com/aws/smithy-go v1.18.1/go.mod h1:NukqUGpCZIILqqiV0NIjeFh24kd/FAa4beRb6nbIUPE=
-github.com/axiomhq/hyperloglog v0.0.0-20220105174342-98591331716a h1:eqjiAL3qooftPm8b9C1GsSSRcmlw7iOva8vdBTmV2PY=
-github.com/axiomhq/hyperloglog v0.0.0-20220105174342-98591331716a/go.mod h1:2stgcRjl6QmW+gU2h5E7BQXg4HU0gzxKWDuT5HviN9s=
+github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
+github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
+github.com/aws/aws-sdk-go-v2 v1.38.1 h1:j7sc33amE74Rz0M/PoCpsZQ6OunLqys/m5antM0J+Z8=
+github.com/aws/aws-sdk-go-v2 v1.38.1/go.mod h1:9Q0OoGQoboYIAJyslFyF1f5K1Ryddop8gqMhWx/n4Wg=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 h1:zAybnyUQXIZ5mok5Jqwlf58/TFE7uvd3IAsa1aF9cXs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10/go.mod h1:qqvMj6gHLR/EXWZw4ZbqlPbQUyenf4h82UQUlKc+l14=
+github.com/aws/aws-sdk-go-v2/config v1.29.15 h1:I5XjesVMpDZXZEZonVfjI12VNMrYa38LtLnw4NtY5Ss=
+github.com/aws/aws-sdk-go-v2/config v1.29.15/go.mod h1:tNIp4JIPonlsgaO5hxO372a6gjhN63aSWl2GVl5QoBQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.68 h1:cFb9yjI02/sWHBSYXAtkamjzCuRymvmeFmt0TC0MbYY=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.68/go.mod h1:H6E+jBzyqUu8u0vGaU6POkK3P0NylYEeRZ6ynBpMqIk=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 h1:x793wxmUWVDhshP8WW2mlnXuFrO4cOd3HLBroh1paFw=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30/go.mod h1:Jpne2tDnYiFascUEs2AWHJL9Yp7A5ZVy3TNyxaAjD6M=
+github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11 h1:qDk85oQdhwP4NR1RpkN+t40aN46/K96hF9J1vDRrkKM=
+github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.5.11/go.mod h1:f3MkXuZsT+wY24nLIP+gFUuIVQkpVopxbpUD/GUZK0Q=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15 h1:7Zwtt/lP3KNRkeZre7soMELMGNoBrutx8nobg1jKWmo=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15/go.mod h1:436h2adoHb57yd+8W+gYPrrA9U/R/SuAuOO42Ushzhw=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 h1:ZK5jHhnrioRkUNOc+hOgQKlUL5JeC3S6JgLxtQ+Rm0Q=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34/go.mod h1:p4VfIceZokChbA9FzMbRGz5OV+lekcVtHlPKEO0gSZY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 h1:SZwFm17ZUNNg5Np0ioo/gq8Mn6u9w19Mri8DnJ15Jf0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34/go.mod h1:dFZsC0BLo346mvKQLWmoJxT+Sjp+qcVR1tRVHQGOH9Q=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 h1:ZNTqv4nIdE/DiBfUUfXcLZ/Spcuz+RjeziUtNJackkM=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.200.0 h1:3hH6o7Z2WeE1twvz44Aitn6Qz8DZN3Dh5IB4Eh2xq7s=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.200.0/go.mod h1:I76S7jN0nfsYTBtuTgTsJtK2Q8yJVDgrLr5eLN64wMA=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.53.8 h1:v1OectQdV/L+KSFSiqK00fXGN8FbaljRfNFysmWB8D0=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.53.8/go.mod h1:F0DbgxpvuSvtYun5poG67EHLvci4SgzsMVO6SsPUqKk=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2 h1:BCG7DCXEXpNCcpwCxg1oi9pkJWH2+eZzTn9MY56MbVw=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15/go.mod h1:SwFBy2vjtA0vZbjjaFtfN045boopadnoVPhu4Fv66vY=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 h1:moLQUoVq91LiqT1nbvzDukyqAlCv89ZmwaHw/ZFlFZg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.80.1 h1:xYEAf/6QHiTZDccKnPMbsMwlau13GsDsTgdue3wmHGw=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.80.1/go.mod h1:qbn305Je/IofWBJ4bJz/Q7pDEtnnoInw/dGt71v6rHE=
+github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 h1:1Gw+9ajCV1jogloEv1RRnvfRFia2cL6c9cuKV2Ps+G8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.25.3/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 h1:hXmVKytPfTy5axZ+fYbR5d0cFmC3JvwLm5kM83luako=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1/go.mod h1:MlYRNmYu/fGPoxBQVvBYr9nyr948aY/WLUvwBMBJubs=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.20 h1:oIaQ1e17CSKaWmUTu62MtraRWVIosn/iONMuZt0gbqc=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.20/go.mod h1:cQnB8CUnxbMU82JvlqjKR2HBOm3fe9pWorWBza6MBJ4=
+github.com/aws/smithy-go v1.22.5 h1:P9ATCXPMb2mPjYBgueqJNCA5S9UfktsW0tTxi+a7eqw=
+github.com/aws/smithy-go v1.22.5/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
 github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f h1:ZNv7On9kyUzm7fvRZumSyy/IUiSC7AzL0I1jKKtwooA=
 github.com/baiyubin/aliyun-sts-go-sdk v0.0.0-20180326062324-cfa1a18b161f/go.mod h1:AuiFmCCPBSrqvVMvuqFuk0qogytodnVFVSN5CeJB8Gc=
-github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/benbjohnson/immutable v0.4.0 h1:CTqXbEerYso8YzVPxmWxh2gnoRQbbB9X1quUC8+vGZA=
 github.com/benbjohnson/immutable v0.4.0/go.mod h1:iAr8OjJGLnLmVUr9MZ/rz4PWUy6Ouc2JLYuMArmvAJM=
-github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bgentry/speakeasy v0.2.0 h1:tgObeVOf8WAvtuAX6DhJ4xks4CFNwPDZiqzGqIHE51E=
+github.com/bgentry/speakeasy v0.2.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932 h1:mXoPYz/Ul5HYEDvkta6I8/rnYM5gSdSV2tJ6XbZuEtY=
 github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=
-github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
-github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
-github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
-github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/boltdb/bolt v1.3.1 h1:JQmyP4ZBrce+ZQu0dY660FMfatumYDLun9hBCUVIkF4=
@@ -1483,73 +881,38 @@ github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
 github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
-github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
-github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
-github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8=
-github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
-github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
-github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
-github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
-github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
-github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
-github.com/bytecodealliance/wasmtime-go v0.36.0/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI=
+github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
+github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
-github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
-github.com/cenkalti/backoff/v3 v3.2.2 h1:cfUAAO3yvKMYKPrvhDuHSwQnhZNk/RMHKdZqKTxfm6M=
-github.com/cenkalti/backoff/v3 v3.2.2/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
-github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
-github.com/cenkalti/backoff/v4 v4.1.2/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
-github.com/cenkalti/backoff/v4 v4.1.3/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
-github.com/cenkalti/backoff/v4 v4.2.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/census-instrumentation/opencensus-proto v0.4.1 h1:iKLQ0xPNFxR/2hzXZMrBo8f1j86j5WHzznCCQxV/b8g=
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
-github.com/centrify/cloud-golang-sdk v0.0.0-20210923165758-a8c48d049166 h1:jQ93fKqb/wRmK/KiHpa7Tk9rmHeKXhp4j+5Sg/tENiY=
-github.com/centrify/cloud-golang-sdk v0.0.0-20210923165758-a8c48d049166/go.mod h1:c/gmvyN8lq6lYtHvrqqoXrg2xyN65N0mBmbikxFWXNE=
-github.com/certifi/gocertifi v0.0.0-20191021191039-0944d244cd40/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
-github.com/certifi/gocertifi v0.0.0-20200922220541-2c3bb06c6054/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/checkpoint-restore/go-criu/v4 v4.1.0/go.mod h1:xUQBLp4RLc5zJtWY++yjOoMoB5lihDt7fai+75m+rGw=
-github.com/checkpoint-restore/go-criu/v5 v5.0.0/go.mod h1:cfwC0EG7HMUenopBsUf9d89JlCLQIfgVcNsNN0t6T2M=
-github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chrismalek/oktasdk-go v0.0.0-20181212195951-3430665dfaa0 h1:CWU8piLyqoi9qXEUwzOh5KFKGgmSU5ZhktJyYcq6ryQ=
 github.com/chrismalek/oktasdk-go v0.0.0-20181212195951-3430665dfaa0/go.mod h1:5d8DqS60xkj9k3aXfL3+mXBH0DPYO0FQjcKosxl+b/Q=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3/go.mod h1:MA5e5Lr8slmEg9bt0VpxxWqJlO4iwu3FBdHUzV7wQVg=
-github.com/cilium/ebpf v0.0.0-20200702112145-1c8d4c9ef775/go.mod h1:7cR51M8ViRLIdUjrmSXlK9pkrsDlLHbO8jiB8X8JnOc=
-github.com/cilium/ebpf v0.2.0/go.mod h1:To2CFviqOWL/M0gIMsvSMlqe7em/l1ALkX1PyjrX2Qs=
-github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
-github.com/cilium/ebpf v0.6.2/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
-github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
-github.com/cilium/ebpf v0.9.1/go.mod h1:+OhNOIXx/Fnu1IE8bJz2dzOA+VSfyTfdNUVdlQnxUFY=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible h1:C29Ae4G5GtYyYMm1aztcyj/J5ckgJm2zwdDajFbx1NY=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3 h1:TJH+oke8D16535+jHExHj4nQvzlZrj7ug5D7I/orNUA=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
-github.com/cjlapao/common-go v0.0.39 h1:bAAUrj2B9v0kMzbAOhzjSmiyDy+rd56r2sy7oEiQLlA=
-github.com/cjlapao/common-go v0.0.39/go.mod h1:M3dzazLjTjEtZJbbxoA5ZDiGCiHmpwqW9l4UWaddwOA=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
-github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
-github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
+github.com/cloudflare/circl v1.6.2-0.20250618153321-aa837fd1539d h1:IiIprFGH6SqstblP0Y9NIo3eaUJGkI/YDOFVSL64Uq4=
+github.com/cloudflare/circl v1.6.2-0.20250618153321-aa837fd1539d/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cloudfoundry-community/go-cfclient v0.0.0-20220930021109-9c4e6c59ccf1 h1:ef0OsiQjSQggHrLFAMDRiu6DfkVSElA5jfG1/Nkyu6c=
 github.com/cloudfoundry-community/go-cfclient v0.0.0-20220930021109-9c4e6c59ccf1/go.mod h1:sgaEj3tRn0hwe7GPdEUwxrdOqjBzyjyvyOCGf1OQyZY=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe h1:QQ3GSy+MqSHxm/d8nCtnAiZdYFd45cYZPs8vOOIYKfk=
 github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
@@ -1558,301 +921,112 @@ github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20220314180256-7f1daf1720fc/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20230310173818-32f1caf87195/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20230428030218-4003588d1b74/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101 h1:7To3pQ+pZo0i3dsWEbinPNFs5gPSBOsJtx3wTT94VBY=
-github.com/cncf/xds/go v0.0.0-20231109132714-523115ebc101/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
+github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
-github.com/cockroachdb/cockroach-go v0.0.0-20181001143604-e0a95dfd547c h1:2zRrJWIt/f9c9HhNHAgrRgq0San5gRRUJTBXLkchal0=
-github.com/cockroachdb/cockroach-go v0.0.0-20181001143604-e0a95dfd547c/go.mod h1:XGLbWH/ujMcbPbhZq52Nv6UrCghb1yGn//133kEsvDk=
-github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
-github.com/cockroachdb/datadriven v0.0.0-20200714090401-bf6692d28da5/go.mod h1:h6jFvWxBdQXxjopDMZyH2UVceIRfR84bdzbkoKrsWNo=
-github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoCr5oaCLELYA=
-github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI=
+github.com/cockroachdb/cockroach-go/v2 v2.3.8 h1:53yoUo4+EtrC1NrAEgnnad4AS3ntNvGup1PAXZ7UmpE=
+github.com/cockroachdb/cockroach-go/v2 v2.3.8/go.mod h1:9uH5jK4yQ3ZQUT9IXe4I2fHzMIF5+JC/oOdzTRgJYJk=
 github.com/codegangsta/inject v0.0.0-20150114235600-33e0aa1cb7c0 h1:sDMmm+q/3+BukdIpxwO365v/Rbspp2Nt5XntgQRXq8Q=
 github.com/codegangsta/inject v0.0.0-20150114235600-33e0aa1cb7c0/go.mod h1:4Zcjuz89kmFXt9morQgcfYZAYZ5n8WHjt81YYWIwtTM=
-github.com/container-orchestrated-devices/container-device-interface v0.6.1/go.mod h1:40T6oW59rFrL/ksiSs7q45GzjGlbvxnA4xaK6cyq+kA=
-github.com/containerd/aufs v0.0.0-20200908144142-dab0cbea06f4/go.mod h1:nukgQABAEopAHvB6j7cnP5zJ+/3aVcE7hCYqvIwAHyE=
-github.com/containerd/aufs v0.0.0-20201003224125-76a6863f2989/go.mod h1:AkGGQs9NM2vtYHaUen+NljV0/baGCAPELGm2q9ZXpWU=
-github.com/containerd/aufs v0.0.0-20210316121734-20793ff83c97/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
-github.com/containerd/aufs v1.0.0/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
-github.com/containerd/btrfs v0.0.0-20201111183144-404b9149801e/go.mod h1:jg2QkJcsabfHugurUvvPhS3E08Oxiuh5W/g1ybB4e0E=
-github.com/containerd/btrfs v0.0.0-20210316141732-918d888fb676/go.mod h1:zMcX3qkXTAi9GI50+0HOeuV8LU2ryCE/V2vG/ZBiTss=
-github.com/containerd/btrfs v1.0.0/go.mod h1:zMcX3qkXTAi9GI50+0HOeuV8LU2ryCE/V2vG/ZBiTss=
-github.com/containerd/btrfs/v2 v2.0.0/go.mod h1:swkD/7j9HApWpzl8OHfrHNxppPd9l44DFZdF94BUj9k=
-github.com/containerd/cgroups v0.0.0-20190717030353-c4b9ac5c7601/go.mod h1:X9rLEHIqSf/wfK8NsPqxJmeZgW4pcfzdXITDrUSJ6uI=
-github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f/go.mod h1:OApqhQ4XNSNC13gXIwDjhOQxjWa/NxkwZXJ1EvqT0ko=
-github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59/go.mod h1:pA0z1pT8KYB3TCXK/ocprsh7MAkoW8bZVzPdih9snmM=
-github.com/containerd/cgroups v0.0.0-20200710171044-318312a37340/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
-github.com/containerd/cgroups v0.0.0-20200824123100-0b889c03f102/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
-github.com/containerd/cgroups v0.0.0-20210114181951-8a68de567b68/go.mod h1:ZJeTFisyysqgcCdecO57Dj79RfL0LNeGiFUqLYQRYLE=
-github.com/containerd/cgroups v1.0.1/go.mod h1:0SJrPIenamHDcZhEcJMNBB85rHcUsw4f25ZfBiPYRkU=
-github.com/containerd/cgroups v1.0.3/go.mod h1:/ofk34relqNjSGyqPrmEULrO4Sc8LJhvJmWbUCUKqj8=
-github.com/containerd/cgroups v1.0.4/go.mod h1:nLNQtsF7Sl2HxNebu77i1R0oDlhiTG+kO4JTrUzo6IA=
-github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
-github.com/containerd/cgroups/v3 v3.0.2/go.mod h1:JUgITrzdFqp42uI2ryGA+ge0ap/nxzYgkGmIcetmErE=
-github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
-github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
-github.com/containerd/console v0.0.0-20191206165004-02ecf6a7291e/go.mod h1:8Pf4gM6VEbTNRIT26AyyU7hxdQU3MvAvxVI0sc00XBE=
-github.com/containerd/console v1.0.1/go.mod h1:XUsP6YE/mKtz6bxc+I8UiKKTP04qjQL4qcS3XoQ5xkw=
-github.com/containerd/console v1.0.2/go.mod h1:ytZPjGgY2oeTkAONYafi2kSj0aYggsf8acV1PGKCbzQ=
-github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
-github.com/containerd/containerd v1.2.10/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.0-beta.2.0.20190828155532-0293cbd26c69/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.0/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.1-0.20191213020239-082f7e3aed57/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.3.2/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.0-beta.2.0.20200729163537-40b22ef07410/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.1/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.3/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.9/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.5.0-beta.1/go.mod h1:5HfvG1V2FsKesEGQ17k5/T7V960Tmcumvqn8Mc+pCYQ=
-github.com/containerd/containerd v1.5.0-beta.3/go.mod h1:/wr9AVtEM7x9c+n0+stptlo/uBBoBORwEx6ardVcmKU=
-github.com/containerd/containerd v1.5.0-beta.4/go.mod h1:GmdgZd2zA2GYIBZ0w09ZvgqEq8EfBp/m3lcVZIvPHhI=
-github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoTJseu1FGOKuoA4nNb2s=
-github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
-github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
-github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
-github.com/containerd/containerd v1.6.1/go.mod h1:1nJz5xCZPusx6jJU8Frfct988y0NpumIq9ODB0kLtoE=
-github.com/containerd/containerd v1.6.6/go.mod h1:ZoP1geJldzCVY3Tonoz7b1IXk8rIX0Nltt5QE4OMNk0=
-github.com/containerd/containerd v1.6.8/go.mod h1:By6p5KqPK0/7/CgO/A6t/Gz+CUYUu2zf1hUaaymVXB0=
-github.com/containerd/containerd v1.6.9/go.mod h1:XVicUvkxOrftE2Q1YWUXgZwkkAxwQYNOFzYWvfVfEfQ=
-github.com/containerd/containerd v1.6.18/go.mod h1:1RdCUu95+gc2v9t3IL+zIlpClSmew7/0YS8O5eQZrOw=
-github.com/containerd/containerd v1.6.23/go.mod h1:UrQOiyzrLi3n4aezYJbQH6Il+YzTvnHFbEuO3yfDrM4=
-github.com/containerd/containerd v1.7.12 h1:+KQsnv4VnzyxWcfO9mlxxELaoztsDEjOuCMPAuPqgU0=
-github.com/containerd/containerd v1.7.12/go.mod h1:/5OMpE1p0ylxtEUGY8kuCYkDRzJm9NO1TFMWjUpdevk=
-github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
-github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
-github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
-github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cECdGN1O8G9bgKTlLhuPJimka6Xb/Gg7vYzCTNVxhvo=
-github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR3BEg7bDFaEddKm54WSmrol1fKWDU1nKYkgrcgZT7Y=
-github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
-github.com/containerd/continuity v0.1.0/go.mod h1:ICJu0PwR54nI0yPEnJ6jcS+J7CZAUXrLh8lPo2knzsM=
-github.com/containerd/continuity v0.2.2/go.mod h1:pWygW9u7LtS1o4N/Tn0FoCFDIXZ7rxcMX7HX1Dmibvk=
-github.com/containerd/continuity v0.3.0/go.mod h1:wJEAIwKOm/pBZuBd0JmeTvnLquTB1Ag8espWhkykbPM=
-github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
-github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
-github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
-github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
-github.com/containerd/fifo v0.0.0-20200410184934-f15a3290365b/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
-github.com/containerd/fifo v0.0.0-20201026212402-0724c46b320c/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
-github.com/containerd/fifo v0.0.0-20210316144830-115abcc95a1d/go.mod h1:ocF/ME1SX5b1AOlWi9r677YJmCPSwwWnQ9O123vzpE4=
-github.com/containerd/fifo v1.0.0/go.mod h1:ocF/ME1SX5b1AOlWi9r677YJmCPSwwWnQ9O123vzpE4=
-github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
-github.com/containerd/go-cni v1.0.1/go.mod h1:+vUpYxKvAF72G9i1WoDOiPGRtQpqsNW/ZHtSlv++smU=
-github.com/containerd/go-cni v1.0.2/go.mod h1:nrNABBHzu0ZwCug9Ije8hL2xBCYh/pjfMb1aZGrrohk=
-github.com/containerd/go-cni v1.1.0/go.mod h1:Rflh2EJ/++BA2/vY5ao3K6WJRR/bZKsX123aPk+kUtA=
-github.com/containerd/go-cni v1.1.3/go.mod h1:Rflh2EJ/++BA2/vY5ao3K6WJRR/bZKsX123aPk+kUtA=
-github.com/containerd/go-cni v1.1.6/go.mod h1:BWtoWl5ghVymxu6MBjg79W9NZrCRyHIdUtk4cauMe34=
-github.com/containerd/go-cni v1.1.9/go.mod h1:XYrZJ1d5W6E2VOvjffL3IZq0Dz6bsVlERHbekNK90PM=
-github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0=
-github.com/containerd/go-runc v0.0.0-20190911050354-e029b79d8cda/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0=
-github.com/containerd/go-runc v0.0.0-20200220073739-7016d3ce2328/go.mod h1:PpyHrqVs8FTi9vpyHwPwiNEGaACDxT/N/pLcvMSRA9g=
-github.com/containerd/go-runc v0.0.0-20201020171139-16b287bc67d0/go.mod h1:cNU0ZbCgCQVZK4lgG3P+9tn9/PaJNmoDXPpoJhDR+Ok=
-github.com/containerd/go-runc v1.0.0/go.mod h1:cNU0ZbCgCQVZK4lgG3P+9tn9/PaJNmoDXPpoJhDR+Ok=
-github.com/containerd/imgcrypt v1.0.1/go.mod h1:mdd8cEPW7TPgNG4FpuP3sGBiQ7Yi/zak9TYCG3juvb0=
-github.com/containerd/imgcrypt v1.0.4-0.20210301171431-0ae5c75f59ba/go.mod h1:6TNsg0ctmizkrOgXRNQjAPFWpMYRWuiB6dSF4Pfa5SA=
-github.com/containerd/imgcrypt v1.1.1-0.20210312161619-7ed62a527887/go.mod h1:5AZJNI6sLHJljKuI9IHnw1pWqo/F0nGDOuR9zgTs7ow=
-github.com/containerd/imgcrypt v1.1.1/go.mod h1:xpLnwiQmEUJPvQoAapeb2SNCxz7Xr6PJrXQb0Dpc4ms=
-github.com/containerd/imgcrypt v1.1.3/go.mod h1:/TPA1GIDXMzbj01yd8pIbQiLdQxed5ue1wb8bP7PQu4=
-github.com/containerd/imgcrypt v1.1.4/go.mod h1:LorQnPtzL/T0IyCeftcsMEO7AqxUDbdO8j/tSUpgxvo=
-github.com/containerd/imgcrypt v1.1.7/go.mod h1:FD8gqIcX5aTotCtOmjeCsi3A1dHmTZpnMISGKSczt4k=
+github.com/coder/websocket v1.8.12 h1:5bUXkEPPIbewrnkU8LTCLVaxi4N4J8ahufH2vlo4NAo=
+github.com/coder/websocket v1.8.12/go.mod h1:LNVeNrXQZfe5qhS9ALED3uA+l5pPqvwXg3CKoDBB2gs=
+github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
+github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/nri v0.0.0-20201007170849-eb1350a75164/go.mod h1:+2wGSDGFYfE5+So4M5syatU0N0f0LbWpuqyMi4/BE8c=
-github.com/containerd/nri v0.0.0-20210316161719-dbaa18c31c14/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
-github.com/containerd/nri v0.1.0/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
-github.com/containerd/nri v0.4.0/go.mod h1:Zw9q2lP16sdg0zYybemZ9yTDy8g7fPCIB3KXOGlggXI=
-github.com/containerd/stargz-snapshotter/estargz v0.4.1/go.mod h1:x7Q9dg9QYb4+ELgxmo4gBUeJB0tl5dqH1Sdz0nJU1QM=
-github.com/containerd/stargz-snapshotter/estargz v0.14.3/go.mod h1:KY//uOCIkSuNAHhJogcZtrNHdKrA99/FCCRjE3HD36o=
-github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
-github.com/containerd/ttrpc v0.0.0-20190828172938-92c8520ef9f8/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
-github.com/containerd/ttrpc v0.0.0-20191028202541-4f1b8fe65a5c/go.mod h1:LPm1u0xBw8r8NOKoOdNMeVHSawSsltak+Ihv+etqsE8=
-github.com/containerd/ttrpc v1.0.1/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
-github.com/containerd/ttrpc v1.0.2/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
-github.com/containerd/ttrpc v1.1.0/go.mod h1:XX4ZTnoOId4HklF4edwc4DcqskFZuvXB1Evzy5KFQpQ=
-github.com/containerd/ttrpc v1.1.1-0.20220420014843-944ef4a40df3/go.mod h1:YYyNVhZrTMiaf51Vj6WhAJqJw+vl/nzABhj8pWrzle4=
-github.com/containerd/ttrpc v1.1.2/go.mod h1:XX4ZTnoOId4HklF4edwc4DcqskFZuvXB1Evzy5KFQpQ=
-github.com/containerd/ttrpc v1.2.2/go.mod h1:sIT6l32Ph/H9cvnJsfXM5drIVzTr5A2flTf1G5tYZak=
-github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd/go.mod h1:Cm3kwCdlkCfMSHURc+r6fwoGH6/F1hH3S4sg0rLFWPc=
-github.com/containerd/typeurl v0.0.0-20190911142611-5eb25027c9fd/go.mod h1:GeKYzf2pQcqv7tJ0AoCuuhtnqhva5LNU3U+OyKxxJpk=
-github.com/containerd/typeurl v1.0.1/go.mod h1:TB1hUtrpaiO88KEK56ijojHS1+NeF0izUACaJW2mdXg=
-github.com/containerd/typeurl v1.0.2/go.mod h1:9trJWW2sRlGub4wZJRTW83VtbOLS6hwcDZXTn6oPz9s=
-github.com/containerd/typeurl/v2 v2.1.1/go.mod h1:IDp2JFvbwZ31H8dQbEIY7sDl2L3o3HZj1hsSQlywkQ0=
-github.com/containerd/zfs v0.0.0-20200918131355-0a33824f23a2/go.mod h1:8IgZOBdv8fAgXddBT4dBXJPtxyRsejFIpXoklgxgEjw=
-github.com/containerd/zfs v0.0.0-20210301145711-11e8f1707f62/go.mod h1:A9zfAbMlQwE+/is6hi0Xw8ktpL+6glmqZYtevJgaB8Y=
-github.com/containerd/zfs v0.0.0-20210315114300-dde8f0fda960/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
-github.com/containerd/zfs v0.0.0-20210324211415-d5c4544f0433/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
-github.com/containerd/zfs v1.0.0/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
-github.com/containerd/zfs v1.1.0/go.mod h1:oZF9wBnrnQjpWLaPKEinrx3TQ9a+W/RJO7Zb41d8YLE=
-github.com/containernetworking/cni v0.7.1/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
-github.com/containernetworking/cni v0.8.0/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
-github.com/containernetworking/cni v0.8.1/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
-github.com/containernetworking/cni v1.0.1/go.mod h1:AKuhXbN5EzmD4yTNtfSsX3tPcmtrBI6QcRV0NiNt15Y=
-github.com/containernetworking/cni v1.1.1/go.mod h1:sDpYKmGVENF3s6uvMvGgldDWeG8dMxakj/u+i9ht9vw=
-github.com/containernetworking/cni v1.1.2/go.mod h1:sDpYKmGVENF3s6uvMvGgldDWeG8dMxakj/u+i9ht9vw=
-github.com/containernetworking/plugins v0.8.6/go.mod h1:qnw5mN19D8fIwkqW7oHHYDHVlzhJpcY6TQxn/fUyDDM=
-github.com/containernetworking/plugins v0.9.1/go.mod h1:xP/idU2ldlzN6m4p5LmGiwRDjeJr6FLK6vuiUwoH7P8=
-github.com/containernetworking/plugins v1.0.1/go.mod h1:QHCfGpaTwYTbbH+nZXKVTxNBDZcxSOplJT5ico8/FLE=
-github.com/containernetworking/plugins v1.1.1/go.mod h1:Sr5TH/eBsGLXK/h71HeLfX19sZPp3ry5uHSkI4LPxV8=
-github.com/containernetworking/plugins v1.2.0/go.mod h1:/VjX4uHecW5vVimFa1wkG4s+r/s9qIfPdqlLF4TW8c4=
-github.com/containers/ocicrypt v1.0.1/go.mod h1:MeJDzk1RJHv89LjsH0Sp5KTY3ZYkjXO/C+bKAeWFIrc=
-github.com/containers/ocicrypt v1.1.0/go.mod h1:b8AOe0YR67uU8OqfVNcznfFpAzu3rdgUV4GP9qXPfu4=
-github.com/containers/ocicrypt v1.1.1/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
-github.com/containers/ocicrypt v1.1.2/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
-github.com/containers/ocicrypt v1.1.3/go.mod h1:xpdkbVAuaH3WzbEabUd5yDsl9SwJA5pABH85425Es2g=
-github.com/containers/ocicrypt v1.1.6/go.mod h1:WgjxPWdTJMqYMjf3M6cuIFFA1/MpyyhIM99YInA+Rvc=
+github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
+github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
-github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/etcd v3.3.27+incompatible h1:QIudLb9KeBsE5zyYxd1mjzRSkzLg9Wf9QlRwFgd6oTA=
 github.com/coreos/etcd v3.3.27+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-etcd v2.0.0+incompatible/go.mod h1:Jez6KQU2B/sWsbdaef3ED8NzMklzPG4d5KIOhIy30Tk=
-github.com/coreos/go-iptables v0.4.5/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
-github.com/coreos/go-iptables v0.5.0/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
-github.com/coreos/go-iptables v0.6.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
-github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
-github.com/coreos/go-oidc v2.2.1+incompatible h1:mh48q/BqXqgjVHpy2ZY7WnWAbenxRjsz9N1i1YxjHAk=
-github.com/coreos/go-oidc v2.2.1+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
-github.com/coreos/go-oidc/v3 v3.5.0 h1:VxKtbccHZxs8juq7RdJntSqtXFtde9YpNpGn0yqgEHw=
-github.com/coreos/go-oidc/v3 v3.5.0/go.mod h1:ecXRtV4romGPeO6ieExAsUK9cb/3fp9hXNz1tlv8PIM=
+github.com/coreos/go-oidc/v3 v3.15.0 h1:R6Oz8Z4bqWR7VFQ+sPSvZPQv4x8M+sJkDO5ojgwlyAg=
+github.com/coreos/go-oidc/v3 v3.15.0/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
-github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-systemd v0.0.0-20161114122254-48702e0da86b/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
+github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd/v22 v22.0.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
-github.com/coreos/go-systemd/v22 v22.1.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
-github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
-github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/coreos/pkg v0.0.0-20220810130054-c7d1c02cb6cf h1:GOPo6vn/vTN+3IwZBvXX0y5doJfSC7My0cdzelyOCsQ=
 github.com/coreos/pkg v0.0.0-20220810130054-c7d1c02cb6cf/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
-github.com/couchbase/gocb/v2 v2.6.5 h1:xaZu29o8UJEV1ZQ3n2s9jcRCUHz/JsQ6+y6JBnVsy5A=
-github.com/couchbase/gocb/v2 v2.6.5/go.mod h1:0vFM09y+VPhnXeNrIb8tS0wKHGpJvjJBrJnriWEiwGs=
-github.com/couchbase/gocbcore/v10 v10.2.9/go.mod h1:lYQIIk+tzoMcwtwU5GzPbDdqEkwkH3isI2rkSpfL0oM=
-github.com/couchbase/gocbcore/v10 v10.3.1 h1:dx+lub02eDYiQXavtF0EwYMppVUcbjCxAAqa6/nQldg=
-github.com/couchbase/gocbcore/v10 v10.3.1/go.mod h1:lYQIIk+tzoMcwtwU5GzPbDdqEkwkH3isI2rkSpfL0oM=
-github.com/couchbaselabs/gocaves/client v0.0.0-20230307083111-cc3960c624b1/go.mod h1:AVekAZwIY2stsJOMWLAS/0uA/+qdp7pjO8EHnl61QkY=
-github.com/couchbaselabs/gocaves/client v0.0.0-20230404095311-05e3ba4f0259 h1:2TXy68EGEzIMHOx9UvczR5ApVecwCfQZ0LjkmwMI6g4=
-github.com/couchbaselabs/gocaves/client v0.0.0-20230404095311-05e3ba4f0259/go.mod h1:AVekAZwIY2stsJOMWLAS/0uA/+qdp7pjO8EHnl61QkY=
+github.com/couchbase/gocb/v2 v2.11.1 h1:xWDco7Qk/XSvGUjbUWRaXi0V35nsMijJnm4vHXN/rqY=
+github.com/couchbase/gocb/v2 v2.11.1/go.mod h1:aSh1Cmd1sPRpYyiBD5iWPehPWaTVF/oYhrtOAITWb/4=
+github.com/couchbase/gocbcore/v10 v10.8.1 h1:i4SnH0DH9APGC4GS2vS2m+3u08V7oJwviamOXdgAZOQ=
+github.com/couchbase/gocbcore/v10 v10.8.1/go.mod h1:OWKfU9R5Nm5V3QZBtfdZl5qCfgxtxTqOgXiNr4pn9/c=
+github.com/couchbase/gocbcoreps v0.1.4 h1:/iZVHMpuEw3lyNz9mIahMQffJOurl/opXyOGads/JbI=
+github.com/couchbase/gocbcoreps v0.1.4/go.mod h1:hBFpDNPnRno6HH5cRXExhqXYRmTsFJlFHQx7vztcXPk=
+github.com/couchbase/goprotostellar v1.0.2 h1:yoPbAL9sCtcyZ5e/DcU5PRMOEFaJrF9awXYu3VPfGls=
+github.com/couchbase/goprotostellar v1.0.2/go.mod h1:5/yqVnZlW2/NSbAWu1hPJCFBEwjxgpe0PFFOlRixnp4=
+github.com/couchbaselabs/gocaves/client v0.0.0-20250107114554-f96479220ae8 h1:MQfvw4BiLTuyR69FuA5Kex+tXUeLkH+/ucJfVL1/hkM=
+github.com/couchbaselabs/gocaves/client v0.0.0-20250107114554-f96479220ae8/go.mod h1:AVekAZwIY2stsJOMWLAS/0uA/+qdp7pjO8EHnl61QkY=
+github.com/couchbaselabs/gocbconnstr/v2 v2.0.0 h1:HU9DlAYYWR69jQnLN6cpg0fh0hxW/8d5hnglCXXjW78=
+github.com/couchbaselabs/gocbconnstr/v2 v2.0.0/go.mod h1:o7T431UOfFVHDNvMBUmUxpHnhivwv7BziUao/nMl81E=
+github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
+github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.1/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
-github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
-github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
-github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
-github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
-github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
-github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjIciD2oAxI7DmWRx6gbeqrkoLqv3MV0vzNad+I=
-github.com/danieljoos/wincred v1.1.0/go.mod h1:XYlo+eRTsVA9aHGp7NGjFkPla4m+DCL7hqDjlFjiygg=
-github.com/danieljoos/wincred v1.1.2 h1:QLdCxFs1/Yl4zduvBdcHB8goaYk9RARS2SgLLRuAyr0=
-github.com/danieljoos/wincred v1.1.2/go.mod h1:GijpziifJoIBfYh+S7BbkdUTU4LfM+QnGqR5Vl2tAx0=
+github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
+github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/danieljoos/wincred v1.2.2 h1:774zMFJrqaeYCK2W57BgAem/MLi6mtSE47MB6BOJ0i0=
+github.com/danieljoos/wincred v1.2.2/go.mod h1:w7w4Utbrz8lqeMbDAK0lkNJUv5sAOkFi7nd/ogr0Uh8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/decred/dcrd/crypto/blake256 v1.0.0/go.mod h1:sQl2p6Y26YV+ZOcSTP6thNdn47hh8kt6rqSlvmrXFAc=
-github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.0-20210816181553-5444fa50b93d/go.mod h1:tmAIfUFEirG/Y8jhZ9M+h36obRZAk/1fcSpXwAVlfqE=
+github.com/decred/dcrd/crypto/blake256 v1.0.1/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etlyjdBU4sfcs2WYQMs=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
 github.com/denisenkom/go-mssqldb v0.12.3 h1:pBSGx9Tq67pBOTLmxNuirNTeB8Vjmf886Kx+8Y+8shw=
 github.com/denisenkom/go-mssqldb v0.12.3/go.mod h1:k0mtMFOnU+AihqFxPMiF05rtiDrorD1Vrm1KEz5hxDo=
-github.com/denverdino/aliyungo v0.0.0-20170926055100-d3308649c661/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=
 github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba h1:p6poVbjHDkKa+wtC8frBMwQtT3BmqGYBjzMwJ63tuR4=
 github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=
-github.com/dgraph-io/badger/v3 v3.2103.2/go.mod h1:RHo4/GmYcKKh5Lxu63wLEMHJ70Pac2JqZRYGhlyAo2M=
-github.com/dgraph-io/ristretto v0.1.0/go.mod h1:fux0lOrBhrVCJd3lcTHsIJhq1T2rokOu6v9Vcb3Q9ug=
-github.com/dgrijalva/jwt-go v0.0.0-20170104182250-a601269ab70c/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
-github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
-github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
-github.com/dgryski/go-metro v0.0.0-20180109044635-280f6062b5bc h1:8WFBn63wegobsYAX0YjD+8suexZDga5CctH4CCTx2+8=
-github.com/dgryski/go-metro v0.0.0-20180109044635-280f6062b5bc/go.mod h1:c9O8+fpSOX1DM8cPNSkX/qsBWdkD4yd2dpciOWQjpBw=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
 github.com/digitalocean/godo v1.7.5 h1:JOQbAO6QT1GGjor0doT0mXefX2FgUDPOpYh2RaXA+ko=
 github.com/digitalocean/godo v1.7.5/go.mod h1:h6faOIcZ8lWIwNQ+DN7b3CgX4Kwby5T+nbpNqkUIozU=
-github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
 github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
-github.com/distribution/distribution/v3 v3.0.0-20220526142353-ffbd94cbe269/go.mod h1:28YO/VJk9/64+sTGNuYaBjWxrXTPrj0C0XmgTIOjxX4=
-github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
-github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
-github.com/dnaeon/go-vcr v1.1.0/go.mod h1:M7tiix8f0r6mKKJ3Yq/kqU1OYf3MnfmBWVbPx/yU9ko=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
 github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
-github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v20.10.17+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v23.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v23.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v25.0.1+incompatible h1:mFpqnrS6Hsm3v1k7Wa/BO23oz0k121MTbTO1lpcGSkU=
-github.com/docker/cli v25.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
-github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/distribution v2.8.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v20.10.17+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v23.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v23.0.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v24.0.9+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v25.0.2+incompatible h1:/OaKeauroa10K4Nqavw4zlhcDq/WBcPMc5DbjOGgozY=
-github.com/docker/docker v25.0.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
-github.com/docker/docker-credential-helpers v0.6.4/go.mod h1:ofX3UI0Gz1TteYBjtgs07O36Pyasyp66D2uKT7H8W1c=
-github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
-github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
-github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
-github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
-github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
-github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
-github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
-github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/cli v27.4.1+incompatible h1:VzPiUlRJ/xh+otB75gva3r05isHMo5wXDfPRi5/b4hI=
+github.com/docker/cli v27.4.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/docker v28.4.0+incompatible h1:KVC7bz5zJY/4AZe/78BIvCnPsLaC9T/zh72xnlrTTOk=
+github.com/docker/docker v28.4.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
-github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 h1:iFaUwBSo5Svw6L7HYpRu/0lE3e0BaElwnNO1qkNQxBY=
-github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
-github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
 github.com/duosecurity/duo_api_golang v0.0.0-20190308151101-6c680f768e74 h1:2MIhn2R6oXQbgW5yHfS+d6YqyMfXiu2L55rFZC4UD/M=
 github.com/duosecurity/duo_api_golang v0.0.0-20190308151101-6c680f768e74/go.mod h1:UqXY1lYT/ERa4OEAywUqdok1T4RCRdArkhic1Opuavo=
-github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/dvsekhvalnov/jose2go v1.6.0 h1:Y9gnSnP4qEI0+/uQkHvFXeD2PLPJeXEL+ySMEA2EjTY=
 github.com/dvsekhvalnov/jose2go v1.6.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
-github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
-github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a h1:mATvB/9r/3gvcejNsXKSkQ6lcIaNec2nyfOdlTBR2lU=
-github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
-github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/emicklei/go-restful/v3 v3.10.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
-github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/ebitengine/purego v0.8.2 h1:jPPGWs2sZ1UgOSgD2bClL0MJIqu58nOmIcBuXr62z1I=
+github.com/ebitengine/purego v0.8.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
+github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -1865,82 +1039,55 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.m
 github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
 github.com/envoyproxy/go-control-plane v0.10.3/go.mod h1:fJJn/j26vwOu972OllsvAgJJM//w9BV6Fxbg2LuVd34=
-github.com/envoyproxy/go-control-plane v0.11.0/go.mod h1:VnHyVMpzcLvCFt9yUz1UnCwHLhwx1WguiVDV7pTG/tI=
 github.com/envoyproxy/go-control-plane v0.11.1-0.20230524094728-9239064ad72f/go.mod h1:sfYdkwUW4BA3PbKjySwjJy+O4Pu0h62rlqCMHNk+K+Q=
-github.com/envoyproxy/go-control-plane v0.11.1 h1:wSUXTlLfiAQRWs2F+p+EKOY9rUyis1MyGqJ2DIk5HpM=
-github.com/envoyproxy/go-control-plane v0.11.1/go.mod h1:uhMcXKCQMEJHiAb0w+YGefQLaTEw+YhGluxZkrTmD0g=
+github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
+github.com/envoyproxy/go-control-plane v0.13.4/go.mod h1:kDfuBlDVsSj2MjrLEtRWtHlsWIFcGyB2RMO44Dc5GZA=
+github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
+github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v0.6.7/go.mod h1:dyJXwwfPK2VSqiB9Klm1J6romD608Ba7Hij42vrOBCo=
 github.com/envoyproxy/protoc-gen-validate v0.9.1/go.mod h1:OKNgG7TCp5pF4d6XftA0++PMirau2/yoOwVac3AbF2w=
-github.com/envoyproxy/protoc-gen-validate v0.10.0/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
 github.com/envoyproxy/protoc-gen-validate v0.10.1/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
-github.com/envoyproxy/protoc-gen-validate v1.0.1/go.mod h1:0vj8bNkYbSTNS2PIyH87KZaeN4x9zpL9Qt8fQC7d+vs=
-github.com/envoyproxy/protoc-gen-validate v1.0.2 h1:QkIBuU5k+x7/QXPvPPnWXWlCdaBFApVqftFV6k087DA=
-github.com/envoyproxy/protoc-gen-validate v1.0.2/go.mod h1:GpiZQP3dDbg4JouG/NNS7QWXpgx6x8QiMKdmN72jogE=
-github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww=
-github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
+github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
+github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
+github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
+github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
-github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
-github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
-github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/felixge/httpsnoop v1.0.2/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
-github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
-github.com/form3tech-oss/jwt-go v3.2.5+incompatible h1:/l4kBbb4/vGSsdtB5nUe8L7B9mImVMaBPw9L/0TBHU8=
-github.com/form3tech-oss/jwt-go v3.2.5+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
-github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
-github.com/foxcpp/go-mockdns v0.0.0-20210729171921-fb145fc6f897/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
-github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
-github.com/frankban/quicktest v1.13.0/go.mod h1:qLE0fzW0VuyUAJgPU19zByoIr0HtCHN/r/VLSOOIySU=
-github.com/frankban/quicktest v1.14.0/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU=
-github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
-github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
-github.com/fxamacker/cbor/v2 v2.4.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
-github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
-github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gabriel-vasile/mimetype v1.4.7 h1:SKFKl7kD0RiPdbht0s7hFtjl489WcQ1VyPW8ZzUMYCA=
+github.com/gabriel-vasile/mimetype v1.4.7/go.mod h1:GDlAgAyIRT27BhFl53XNAFtfjzOkLaF35JdEG0P7LtU=
 github.com/gammazero/deque v0.2.1 h1:qSdsbG6pgp6nL7A0+K/B7s12mcCY/5l5SIUpMOl+dC0=
 github.com/gammazero/deque v0.2.1/go.mod h1:LFroj8x4cMYCukHJDbxFCkT+r9AndaJnFMuZDV34tuU=
 github.com/gammazero/workerpool v1.1.3 h1:WixN4xzukFoN0XSeXF6puqEqFTl2mECI9S6W44HWy9Q=
 github.com/gammazero/workerpool v1.1.3/go.mod h1:wPjyBLDbyKnUn2XwwyD3EEwo9dHutia9/fwNmSHWACc=
-github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
-github.com/getkin/kin-openapi v0.76.0/go.mod h1:660oXbgy5JFMKreazJaQTw7o+X00qeSyhcnluiMv+Xg=
-github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
-github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32 h1:Mn26/9ZMNWSw9C9ERFA1PUxfmGpolnw2v0bKOREu5ew=
 github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32/go.mod h1:GIjDIg/heH5DOkXY3YJ/wNhfHsQHoXGjl8G8amsYQ1I=
-github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
-github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
-github.com/gin-gonic/gin v1.6.3 h1:ahKqKTFpO5KTPHxWZjEdPScmYaGtLo8Y4DMHoEsnp14=
-github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
-github.com/gliderlabs/ssh v0.3.5 h1:OcaySEmAQJgyYcArR+gGGTHCyE7nvhEMTlYY+Dp8CpY=
-github.com/gliderlabs/ssh v0.3.5/go.mod h1:8XB4KraRrX39qHhT6yxPsHedjA08I/uBVwj4xC+/+z4=
-github.com/go-asn1-ber/asn1-ber v1.3.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-asn1-ber/asn1-ber v1.4.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD50WnA=
-github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
+github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-fonts/dejavu v0.1.0/go.mod h1:4Wt4I4OU2Nq9asgDCteaAaWZOV24E+0/Pwo0gppep4g=
@@ -1950,163 +1097,103 @@ github.com/go-fonts/liberation v0.2.0/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2H
 github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmnUIzUY=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
-github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
+github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
+github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.11.0 h1:XIZc1p+8YzypNr34itUfSvYJcv+eYdTnTvOZ2vD3cA4=
-github.com/go-git/go-git/v5 v5.11.0/go.mod h1:6GFcX2P3NM7FPBfpePbpLd21XxsgdAt+lKqXmCUiUCY=
+github.com/go-git/go-git/v5 v5.14.0 h1:/MD3lCrGjCen5WfEAzKg00MJJffKhC8gzS80ycmCi60=
+github.com/go-git/go-git/v5 v5.14.0/go.mod h1:Z5Xhoia5PcWA3NF8vRLURn9E5FRhSl7dGj9ItW3Wk5k=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-ini/ini v1.25.4/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
-github.com/go-ini/ini v1.66.6/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
-github.com/go-jose/go-jose/v3 v3.0.0/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
-github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
-github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
+github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
+github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
+github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI=
+github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-kit/log v0.2.0/go.mod h1:NwTd00d/i8cPZ3xOwwiv2PO5MOcx78fFErGNcVmBjv0=
 github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U=
 github.com/go-latex/latex v0.0.0-20210823091927-c0d11ff05a81/go.mod h1:SX0U8uGpxhq9o2S/CELCSUxEWWAuoCUcVCQWv7G2OCk=
-github.com/go-ldap/ldap/v3 v3.1.7/go.mod h1:5Zun81jBTabRaI8lzN7E1JjyEl1g6zI6u9pd8luAK4Q=
-github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs=
-github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
-github.com/go-ldap/ldif v0.0.0-20200320164324-fd88d9b715b3 h1:sfz1YppV05y4sYaW7kXZtrocU/+vimnIWt4cxAYh7+o=
-github.com/go-ldap/ldif v0.0.0-20200320164324-fd88d9b715b3/go.mod h1:ZXFhGda43Z2TVbfGZefXyMJzsDHhCh0go3bZUcwTx7o=
+github.com/go-ldap/ldap/v3 v3.4.12 h1:1b81mv7MagXZ7+1r7cLTWmyuTqVqdwbtJSjC0DAp9s4=
+github.com/go-ldap/ldap/v3 v3.4.12/go.mod h1:+SPAGcTtOfmGsCb3h1RFiq4xpp4N636G75OEace8lNo=
+github.com/go-ldap/ldif v0.0.0-20250910174327-aa3bc3095c92 h1:Eu8/ko8bvygFvum/PWUg5JrGQuWYNahEph8r3SErkSM=
+github.com/go-ldap/ldif v0.0.0-20250910174327-aa3bc3095c92/go.mod h1:F640vUoSS6Qg4nmesnVfHeZSJ0ArdMJ9eb0xB7wcitU=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
-github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
-github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
-github.com/go-logr/logr v0.4.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
-github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.1/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.0/go.mod h1:YkVgnZu1ZjjL7xTxrfm/LLZBfkhTqSR1ydtm6jTKKwI=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-logr/zapr v1.2.3/go.mod h1:eIauM6P8qSvTw5o2ez6UEAfGjQKrxQTl5EoK+Qa2oG4=
 github.com/go-martini/martini v0.0.0-20170121215854-22fa46961aab h1:xveKWz2iaueeTaUgdetzel+U7exyigDYBryyVfV/rZk=
 github.com/go-martini/martini v0.0.0-20170121215854-22fa46961aab/go.mod h1:/P9AEU963A2AYjv4d1V5eVL1CQbEJq6aCNHDDjibzu8=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
-github.com/go-openapi/analysis v0.21.4 h1:ZDFLvSNxpDaomuCueM0BlSXxpANBlFYiBvr+GXrvIHc=
-github.com/go-openapi/analysis v0.21.4/go.mod h1:4zQ35W4neeZTqh3ol0rv/O8JBbka9QyAgQRPp9y3pfo=
-github.com/go-openapi/errors v0.20.2/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M=
-github.com/go-openapi/errors v0.20.4 h1:unTcVm6PispJsMECE3zWgvG4xTiKda1LIR5rCRWLG6M=
-github.com/go-openapi/errors v0.20.4/go.mod h1:Z3FlZ4I8jEGxjUK+bugx3on2mIAk4txuAOhlsB1FSgk=
-github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
-github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
-github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
-github.com/go-openapi/jsonpointer v0.20.0 h1:ESKJdU9ASRfaPNOPRx12IUyA1vn3R9GiE3KYD14BXdQ=
-github.com/go-openapi/jsonpointer v0.20.0/go.mod h1:6PGzBjjIIumbLYysB73Klnms1mwnU4G3YHOECG3CedA=
-github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
-github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
-github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
-github.com/go-openapi/jsonreference v0.19.5/go.mod h1:RdybgQwPxbL4UEjuAruzK1x3nE69AqPYEJeo/TWfEeg=
-github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo=
-github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
-github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/loads v0.21.2 h1:r2a/xFIYeZ4Qd2TnGpWDIQNcP80dIaZgf704za8enro=
-github.com/go-openapi/loads v0.21.2/go.mod h1:Jq58Os6SSGz0rzh62ptiu8Z31I+OTHqmULx5e/gJbNw=
-github.com/go-openapi/runtime v0.26.0 h1:HYOFtG00FM1UvqrcxbEJg/SwvDRvYLQKGhw2zaQjTcc=
-github.com/go-openapi/runtime v0.26.0/go.mod h1:QgRGeZwrUcSHdeh4Ka9Glvo0ug1LC5WyE+EV88plZrQ=
-github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
-github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
-github.com/go-openapi/spec v0.20.6/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
-github.com/go-openapi/spec v0.20.9 h1:xnlYNQAwKd2VQRRfwTEI0DcK+2cbuvI/0c7jx3gA8/8=
-github.com/go-openapi/spec v0.20.9/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
-github.com/go-openapi/strfmt v0.21.3/go.mod h1:k+RzNO0Da+k3FrrynSNN8F7n/peCmQQqbbXjtDfvmGg=
-github.com/go-openapi/strfmt v0.21.7 h1:rspiXgNWgeUzhjo1YU01do6qsahtJNByjLVbPLNHb8k=
-github.com/go-openapi/strfmt v0.21.7/go.mod h1:adeGTkxE44sPyLk0JV235VQAO/ZXUr8KAzYjclFs3ew=
-github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
-github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.21.1/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
-github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
-github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
-github.com/go-openapi/validate v0.22.2 h1:Lda8nadL/5kIvS5mdXCAIuZ7IVXvKFIppLnw+EZh+n0=
-github.com/go-openapi/validate v0.22.2/go.mod h1:kVxh31KbfsxU8ZyoHaDbLBWU5CnMdqBUEtadQ2G4d5M=
+github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
+github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
+github.com/go-openapi/errors v0.22.1 h1:kslMRRnK7NCb/CvR1q1VWuEQCEIsBGn5GgKD9e+HYhU=
+github.com/go-openapi/errors v0.22.1/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/loads v0.22.0 h1:ECPGd4jX1U6NApCGG1We+uEozOAvXvJSF4nnwHZ8Aco=
+github.com/go-openapi/loads v0.22.0/go.mod h1:yLsaTCS92mnSAZX5WWoxszLj0u+Ojl+Zs5Stn1oF+rs=
+github.com/go-openapi/runtime v0.28.0 h1:gpPPmWSNGo214l6n8hzdXYhPuJcGtziTOgUpvsFWGIQ=
+github.com/go-openapi/runtime v0.28.0/go.mod h1:QN7OzcS+XuYmkQLw05akXk0jRH/eZ3kb18+1KwW9gyc=
+github.com/go-openapi/spec v0.21.0 h1:LTVzPc3p/RzRnkQqLRndbAzjY0d0BCL72A6j3CdL9ZY=
+github.com/go-openapi/spec v0.21.0/go.mod h1:78u6VdPw81XU44qEWGhtr982gJ5BWg2c0I5XwVMotYk=
+github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMgO/c=
+github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
+github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
+github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
 github.com/go-ozzo/ozzo-validation v3.6.0+incompatible h1:msy24VGS42fKO9K1vLz82/GeYW1cILu7Nuuj1N3BBkE=
 github.com/go-ozzo/ozzo-validation v3.6.0+incompatible/go.mod h1:gsEKFIVnabGBt6mXmxK0MoFy+cZoTJY6mu5Ll3LVLBU=
 github.com/go-pdf/fpdf v0.5.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M=
 github.com/go-pdf/fpdf v0.6.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M=
-github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
-github.com/go-playground/locales v0.13.0 h1:HyWk6mgj5qFqCT5fjGBuRArbVDfE4hi8+e8ceBS/t7Q=
-github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
-github.com/go-playground/universal-translator v0.17.0 h1:icxd5fm+REJzpZx7ZfpaD876Lmtgy7VtROAbHHXk8no=
-github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
-github.com/go-playground/validator/v10 v10.2.0 h1:KgJ0snyC2R9VXYN2rneOtQcw5aHQB1Vv0sFl1UcHBOY=
-github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
-github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
+github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
-github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-zookeeper/zk v1.0.3 h1:7M2kwOsc//9VeeFiPtf+uSJlVpU66x9Ba5+8XK7/TDg=
 github.com/go-zookeeper/zk v1.0.3/go.mod h1:nOB03cncLtlp4t+UAkGSV+9beXP/akpekBwL+UX1Qcw=
-github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee h1:s+21KNqlpePfkah2I+gwHF8xmJWRjooY+5248k6m4A0=
-github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
-github.com/gobwas/pool v0.2.0 h1:QEmUOlnSjWtnpRGHF3SauEiOsy82Cup83Vf2LcMlnc8=
-github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.0.2 h1:CoAavW/wd/kulfZmSIBt6p24n4j7tHgNVCjsfHVNUbo=
-github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
-github.com/goccy/go-json v0.9.7/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
-github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/gocql/gocql v1.0.0 h1:UnbTERpP72VZ/viKE1Q1gPtmLvyTZTvuAstvSRydw/c=
 github.com/gocql/gocql v1.0.0/go.mod h1:3gM2c4D3AnkISwBxGnMMsS8Oy4y2lhbPRsH4xnJrHG8=
-github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
-github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
-github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
-github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+Hoeu/iUR3ruzNvZ+yQfO03a0=
-github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
-github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
+github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gofrs/uuid v4.3.0+incompatible h1:CaSVZxm5B+7o45rtab4jC2G37WGYX1zQfuU2i6DSvnc=
 github.com/gofrs/uuid v4.3.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/gogo/googleapis v1.2.0/go.mod h1:Njal3psf3qN6dwBtQfUmBZh2ybovJ0tlu3o/AC7HYjU=
-github.com/gogo/googleapis v1.4.0/go.mod h1:5YRNX2z1oM5gXdAkurHa942MDgEJyk02w4OecKY87+c=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
-github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d/go.mod h1:nnjvkQ9ptGaCkuDUx6wNykzzlUixGxvkme+H/lnzb+A=
 github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
-github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v5 v5.2.0 h1:d/ix8ftRUorsN+5eMIlF4T6J8CAt9rch3My2winC1Jw=
-github.com/golang-jwt/jwt/v5 v5.2.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
@@ -2116,14 +1203,12 @@ github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGw
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
 github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
-github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
-github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
@@ -2132,9 +1217,9 @@ github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
 github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
-github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
-github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/mock v1.7.0-rc.1 h1:YojYx61/OLFsiv6Rw1Z96LpldJIy31o+UHmwAUMJ6/U=
+github.com/golang/mock v1.7.0-rc.1/go.mod h1:s42URUywIqd+OcERslBJvOjepvNymP31m3q8d/GkuRs=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -2152,26 +1237,24 @@ github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/golang/snappy v0.0.2/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/gomodule/redigo v1.8.2/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
+github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
+github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.1 h1:gK4Kx5IaGY9CD5sPJ36FHiBJ6ZXl0kilRiiCj+jdYp4=
-github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
-github.com/google/cel-go v0.12.6/go.mod h1:Jk7ljRzLBhkmiAwBoUxB1sZSCVBAzkqPF25olK/iRDw=
-github.com/google/flatbuffers v1.12.1/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
+github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/certificate-transparency-go v1.3.2 h1:9ahSNZF2o7SYMaKaXhAumVEzXB2QaayzII9C8rv7v+A=
+github.com/google/certificate-transparency-go v1.3.2/go.mod h1:H5FpMUaGa5Ab2+KCYsxg6sELw3Flkl7pGZzWdBoYLXs=
 github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
-github.com/google/flatbuffers v23.5.26+incompatible h1:M9dgRyhJemaM4Sw8+66GHBu8ioaQmyPLg1b8VwK5WJg=
-github.com/google/flatbuffers v23.5.26+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
-github.com/google/gnostic v0.5.7-v3refs/go.mod h1:73MKFl6jIHelAJNaBGFzt3SPtZULs9dYrGFt8OiIsHQ=
-github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
-github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/flatbuffers v25.2.10+incompatible h1:F3vclr7C3HpB1k9mxCGRMXq6FdUalZ6H/pNX4FP1v0Q=
+github.com/google/flatbuffers v25.2.10+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -2187,21 +1270,15 @@ github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-containerregistry v0.5.1/go.mod h1:Ct15B4yir3PLOP5jsy0GNeYVaIZs/MK/Jz5any1wFW0=
-github.com/google/go-containerregistry v0.14.0/go.mod h1:aiJ2fp/SXvkWgmYHioXnbMdlgB8eXiiYOY55gfN91Wk=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-github v17.0.0+incompatible h1:N0LgJ1j65A7kfXrZnUDaYCs/Sf4rEjNlfyDHW9dolSY=
 github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
 github.com/google/go-metrics-stackdriver v0.2.0 h1:rbs2sxHAPn2OtUj9JdR/Gij1YKGl0BTVD0augB+HEjE=
 github.com/google/go-metrics-stackdriver v0.2.0/go.mod h1:KLcPyp3dWJAFD+yHisGlJSZktIsTjb50eB72U2YZ9K0=
-github.com/google/go-pkcs11 v0.2.0/go.mod h1:6eQoGcuNJpa7jnd5pMGdkSaQpNDYvPlXWMcjXXThLlY=
-github.com/google/go-pkcs11 v0.2.1-0.20230907215043-c6f79328ddf9/go.mod h1:6eQoGcuNJpa7jnd5pMGdkSaQpNDYvPlXWMcjXXThLlY=
-github.com/google/go-querystring v0.0.0-20170111101155-53e6ce116135/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
@@ -2209,8 +1286,9 @@ github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXi
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
-github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
 github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
+github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
+github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -2223,29 +1301,19 @@ github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/s2a-go v0.1.0/go.mod h1:OJpEgntRZo8ugHpF9hkoLJbS5dSI20XZeXJ9JVywLlM=
-github.com/google/s2a-go v0.1.3/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
-github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
-github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
-github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
-github.com/google/tink/go v1.6.1/go.mod h1:IGW53kTgag+st5yPhKKwJ6u2l+SSp5/v9XF7spovjlY=
-github.com/google/tink/go v1.7.0 h1:6Eox8zONGebBFcCBqkVmt60LaWZa6xg1cl/DwAh/J1w=
-github.com/google/tink/go v1.7.0/go.mod h1:GAUOd+QE3pgj9q8VKIGTCP33c/B7eb4NhxLcgTJZStM=
-github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
@@ -2253,10 +1321,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.1.0/go.mod h1:17drOmN3MwGY
 github.com/googleapis/enterprise-certificate-proxy v0.2.0/go.mod h1:8C0jb7/mgJe/9KK8Lm7X9ctZC2t60YyIpYEI16jx0Qg=
 github.com/googleapis/enterprise-certificate-proxy v0.2.1/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
 github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
-github.com/googleapis/enterprise-certificate-proxy v0.2.4/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
-github.com/googleapis/enterprise-certificate-proxy v0.2.5/go.mod h1:RxW0N9901Cko1VOCW3SXCpWP+mlIEkk2tP7jnHy9a3w=
-github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
-github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
+github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4=
+github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
@@ -2268,202 +1334,172 @@ github.com/googleapis/gax-go/v2 v2.5.1/go.mod h1:h6B0KMMFNtI2ddbGJn3T3ZbwkeT6yqE
 github.com/googleapis/gax-go/v2 v2.6.0/go.mod h1:1mjbznJAPHFpesgE5ucqfYEscaz5kMdcIDwU/6+DDoY=
 github.com/googleapis/gax-go/v2 v2.7.0/go.mod h1:TEop28CZZQ2y+c0VxMUmu1lV+fQx57QpBWsYpwqHJx8=
 github.com/googleapis/gax-go/v2 v2.7.1/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38/qKbhSAKP6QI=
-github.com/googleapis/gax-go/v2 v2.8.0/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38/qKbhSAKP6QI=
-github.com/googleapis/gax-go/v2 v2.10.0/go.mod h1:4UOEnMCrxsSqQ940WnTiD6qJ63le2ev3xfyagutxiPw=
-github.com/googleapis/gax-go/v2 v2.11.0/go.mod h1:DxmR61SGKkGLa2xigwuZIQpkCI2S5iydzRfb3peWZJI=
-github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
-github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
-github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
-github.com/googleapis/gnostic v0.1.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
-github.com/googleapis/gnostic v0.2.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
-github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg=
-github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU=
-github.com/googleapis/gnostic v0.5.5/go.mod h1:7+EbHbldMins07ALC74bsA81Ovc97DwqyJO1AENw9kA=
+github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
+github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
 github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
 github.com/gophercloud/gophercloud v0.1.0 h1:P/nh25+rzXouhytV2pUHBb65fnds26Ghl8/391+sT5o=
 github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
-github.com/gorilla/handlers v0.0.0-20150720190736-60c7bfde3e33/go.mod h1:Qkdc/uu4tH4g6mTK6auzZ766c4CA0Ng8+o/OAirnOIQ=
-github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q=
-github.com/gorilla/mux v1.7.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
 github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
 github.com/gorilla/sessions v1.2.1 h1:DHd3rPN5lE3Ts3D8rKkQ8x/0kqfeNmBAaiSi+o7FsgI=
 github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
-github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
-github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
-github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/gotestyourself/gotestyourself v2.2.0+incompatible h1:AQwinXlbQR2HvPjQZOmDhRqsv5mZf+Jb1RnSLxcqZcI=
 github.com/gotestyourself/gotestyourself v2.2.0+incompatible/go.mod h1:zZKM6oeNM8k+FRljX1mnzVYeS8wiGgQyvST1/GafPbY=
-github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
-github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
-github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 h1:YBftPWNWd4WwGqtY2yeZL2ef8rHAxPBD8KFhJpmcqms=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9Kz84aCaG7AsGZnLjhHbUqwPg=
-github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c h1:6rhixN/i8ZofjG1Y75iExal34USq5p+wiN1tpie8IrU=
-github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c/go.mod h1:NMPJylDgVpX0MLRlPy15sqSwOFv/U1GZ2m21JhFfek0=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
-github.com/hashicorp-forge/bbolt v1.3.8-hc3 h1:iTWR3RDPj0TGChAvJ8QjHFcNFWAUVgNQV73IE6gAX4E=
-github.com/hashicorp-forge/bbolt v1.3.8-hc3/go.mod h1:sQBu5UIJ+rcUFU4Fo9rpTHNV935jwmGWS3dQ/MV8810=
-github.com/hashicorp/cap v0.5.0 h1:YIlAYxdXXtx2IL1JDvP2OyEl55Ooi0yl573kSB9Orlw=
-github.com/hashicorp/cap v0.5.0/go.mod h1:IAy00Er+ZFpMo+5x6B4bkO2HgpzgrkfsuDWMmHAuKUE=
-github.com/hashicorp/cap/ldap v0.0.0-20230914221201-c4eecc7e31f7 h1:jgVdtp5YMn++PxnYhAFfrURfLf+nlqzBeddbvRG+tTg=
-github.com/hashicorp/cap/ldap v0.0.0-20230914221201-c4eecc7e31f7/go.mod h1:q+c9XV1VqloZFZMu+zdvfb0cm7UrvKbvtmTF5wX5Q9o=
-github.com/hashicorp/cli v1.1.6 h1:CMOV+/LJfL1tXCOKrgAX0uRKnzjj/mpmqNXloRSy2K8=
-github.com/hashicorp/cli v1.1.6/go.mod h1:MPon5QYlgjjo0BSoAiN0ESeT5fRzDjVRp+uioJ0piz4=
-github.com/hashicorp/consul-template v0.36.1-0.20240213145952-6c83e89b48af h1:DrkJy2yiqrHIVEqgtn4X0A7j5wjy5MxrJXvGNVwtSsY=
-github.com/hashicorp/consul-template v0.36.1-0.20240213145952-6c83e89b48af/go.mod h1:bvidXKwpfXzJ1X4wDw68OXnVxy5k7HLOHhOf5gnQr3M=
-github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
-github.com/hashicorp/consul/api v1.27.0 h1:gmJ6DPKQog1426xsdmgk5iqDyoRiNc+ipBdJOqKQFjc=
-github.com/hashicorp/consul/api v1.27.0/go.mod h1:JkekNRSou9lANFdt+4IKx3Za7XY0JzzpQjEb4Ivo1c8=
+github.com/hashicorp/cap v0.11.0 h1:tnMNgIWEdbmyx0fulrlLPNHowsprg34xFWflOEB3t1s=
+github.com/hashicorp/cap v0.11.0/go.mod h1:HKbv27kfps+wONFNyNTHpAQmU/DCjjDuB5HF6mFsqPQ=
+github.com/hashicorp/cap/ldap v0.0.0-20250911140431-44d01434c285 h1:vwg2CDaWTJJkr+5ivc2KUYx877gPAUEgq5QIPA/bKjw=
+github.com/hashicorp/cap/ldap v0.0.0-20250911140431-44d01434c285/go.mod h1:La1zaRmx2oqz79W9SpwQAPMfDUdBxZeoN2IaAQ8D4ow=
+github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
+github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
+github.com/hashicorp/consul-template v0.41.1 h1:6VM6kzyBt7xpHfeSjuSRFO6X0/pPdIy+AJpNlM8PekM=
+github.com/hashicorp/consul-template v0.41.1/go.mod h1:RUPYCBLEnJVxzkJ2O52A20rGEx/K2oz16mPiuRCUWZA=
+github.com/hashicorp/consul/api v1.32.1 h1:0+osr/3t/aZNAdJX558crU3PEjVrG4x6715aZHRgceE=
+github.com/hashicorp/consul/api v1.32.1/go.mod h1:mXUWLnxftwTmDv4W3lzxYCPD199iNLLUyLfLGFJbtl4=
 github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
-github.com/hashicorp/consul/sdk v0.15.1 h1:kKIGxc7CZtflcF5DLfHeq7rOQmRq3vk7kwISN9bif8Q=
-github.com/hashicorp/consul/sdk v0.15.1/go.mod h1:7pxqqhqoaPqnBnzXD1StKed62LqJeClzVsUEy85Zr0A=
+github.com/hashicorp/consul/sdk v0.16.2 h1:cGX/djeEe9r087ARiKVWwVWCF64J+yW0G6ftZMZYbj0=
+github.com/hashicorp/consul/sdk v0.16.2/go.mod h1:onxcZjYVsPx5XMveAC/OtoIsdr32fykB7INFltDoRE8=
 github.com/hashicorp/cronexpr v1.1.2 h1:wG/ZYIKT+RT3QkOdgYc+xsKWVRgnxJ1OJtjjy84fJ9A=
 github.com/hashicorp/cronexpr v1.1.2/go.mod h1:P4wA0KBl9C5q2hABiMO7cp6jcIg96CDh1Efb3g1PWA4=
-github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/eventlogger v0.2.8 h1:WITwN1QGMtxHQE7l69WBwLJIJA5vH5pcvX69peURU14=
-github.com/hashicorp/eventlogger v0.2.8/go.mod h1://CHt6/j+Q2lc0NlUB5af4aS2M0c0aVBg9/JfcpAyhM=
+github.com/hashicorp/eventlogger v0.2.10 h1:Dddth3KVSribGE1rInGToM30tRNblvL0G1OG6N+i2pk=
+github.com/hashicorp/eventlogger v0.2.10/go.mod h1:imHMTfJH4qfb8Knh9nZw4iLfL9J1bX6TJKEurSB4t+U=
 github.com/hashicorp/go-bexpr v0.1.12 h1:XrdVhmwu+9iYxIUWxsGVG7NQwrhzJZ0vR6nbN5bLgrA=
 github.com/hashicorp/go-bexpr v0.1.12/go.mod h1:ACktpcSySkFNpcxWSClFrut7wicd9WzisnvHuw+g9K8=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-discover v0.0.0-20210818145131-c573d69da192 h1:eje2KOX8Sf7aYPiAsLnpWdAIrGRMcpFjN/Go/Exb7Zo=
-github.com/hashicorp/go-discover v0.0.0-20210818145131-c573d69da192/go.mod h1:3/4dzY4lR1Hzt9bBqMhBzG7lngZ0GKx/nL6G/ad62wE=
+github.com/hashicorp/go-discover v1.1.1-0.20250922102917-55e5010ad859 h1:CYvtQfS6WBZdva446zuZEpHxDfI3GTenOM4SCmGWUR8=
+github.com/hashicorp/go-discover v1.1.1-0.20250922102917-55e5010ad859/go.mod h1:NsxyJAVM+f1GYWjoAg1dtKU7I39rOWtUjFSm2Xmuvn4=
+github.com/hashicorp/go-discover/provider/gce v0.0.0-20241120163552-5eb1507d16b4 h1:ywaDsVo7n5ko12YD8uXjuQ8G2mQhC2mxAc4Kj3WW3GE=
+github.com/hashicorp/go-discover/provider/gce v0.0.0-20241120163552-5eb1507d16b4/go.mod h1:yxikfLXA8Y5JA3FcFTR720PfqVEFd0dZY9FBpmcsO54=
 github.com/hashicorp/go-gatedio v0.5.0 h1:Jm1X5yP4yCqqWj5L1TgW7iZwCVPGtVc+mro5r/XX7Tg=
 github.com/hashicorp/go-gatedio v0.5.0/go.mod h1:Lr3t8L6IyxD3DAeaUxGcgl2JnRUpWMCsmBl4Omu/2t4=
-github.com/hashicorp/go-gcp-common v0.8.0 h1:/2vGAbCU1v+BZ3YHXTCzTvxqma9WOJHYtADTfhZixLo=
-github.com/hashicorp/go-gcp-common v0.8.0/go.mod h1:Q7zYRy9ue9SuaEN2s9YLIQs4SoKHdoRmKRcImY3SLgs=
+github.com/hashicorp/go-gcp-common v0.9.2 h1:hUZ46EdGwlbP+Ttrif6hlcfvtQGzJiS6FUbb649yAOQ=
+github.com/hashicorp/go-gcp-common v0.9.2/go.mod h1:STcRASKUYdCtaKbZinoAR/URmkIUGIOTOHUNPrF9xOE=
 github.com/hashicorp/go-hclog v0.9.1/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.14.1/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v1.0.0/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
-github.com/hashicorp/go-hclog v1.4.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-hclog v1.6.2 h1:NOtoftovWkDheyUM/8JW3QMiXyxJK3uHRK7wV04nD2I=
-github.com/hashicorp/go-hclog v1.6.2/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6 h1:kBoJV4Xl5FLtBfnBjDvBxeNSy2IRITSGs73HQsFUEjY=
+github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6/go.mod h1:y+HSOcOGB48PkUxNyLAiCiY6rEENu+E+Ss4LG8QHwf4=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-immutable-radix v1.3.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.0/go.mod h1:xvb32K2keAc+R8DSFG2IwDcydK9DBQE+fGA5fsw6hSk=
 github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.1 h1:KIge4FHZEDb2/xjaWgmBheCTgRL6HV4sgTfDsH876L8=
 github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.1/go.mod h1:aHO1EoFD0kBYLBedqxXgalfFT8lrWfP7kpuSoaqGjH0=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.8/go.mod h1:qTCjxGig/kjuj3hk1z8pOUrzbse/GxB1tGfbrq8tGJg=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.16 h1:WZeXfD26QMWYC35at25KgE021SF9L3u9UMHK8fJAdV0=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.16/go.mod h1:ZiKZctjRTLEppuRwrttWkp71VYMbTTCkazK4xT7U/NQ=
-github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2 v2.0.9 h1:HpGOHc0Vd3aacMAEtAUVe38zMcq7BfYQSjrGCmtRNx0=
-github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2 v2.0.9/go.mod h1:ygxw8l40DbAQQ587OzoB3bsBWVpB0e/BOWKlXgYkfG8=
-github.com/hashicorp/go-kms-wrapping/wrappers/alicloudkms/v2 v2.0.3 h1:36Pxy8BQd7DAJ2Mk6vuJlIjqQ80e20vlO7a4Ep3RTOg=
-github.com/hashicorp/go-kms-wrapping/wrappers/alicloudkms/v2 v2.0.3/go.mod h1:heY2PS1SGU0cMamgv+zId/sKT+XFHaf61bLOSnP1Gb8=
-github.com/hashicorp/go-kms-wrapping/wrappers/awskms/v2 v2.0.9 h1:qdxeZvDMRGZ3YSE4Oz0Pp7WUSUn5S6cWZguEOkEVL50=
-github.com/hashicorp/go-kms-wrapping/wrappers/awskms/v2 v2.0.9/go.mod h1:DcXbvVpgNWbxGmxgmu3QN64bEydMu14Cpe34RRR30HY=
-github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 v2.0.11 h1:/7SKkYIhA8cr3l8m1EKT6Q90bPoSVqqVBuQ6HgoMIkw=
-github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 v2.0.11/go.mod h1:LepS5s6ESGE0qQMpYaui5lX+mQYeiYiy06VzwWRioO8=
-github.com/hashicorp/go-kms-wrapping/wrappers/gcpckms/v2 v2.0.11 h1:qXOa2uFzT8eORzgfLZSp1dvig2l/70LJIr6634f5HMM=
-github.com/hashicorp/go-kms-wrapping/wrappers/gcpckms/v2 v2.0.11/go.mod h1:HSaOaX/lv3ShCdilUYbOTPnSvmoZ9xtQhgw+8hYcZkg=
-github.com/hashicorp/go-kms-wrapping/wrappers/ocikms/v2 v2.0.7 h1:KeG3QGrbxbr2qAqCJdf3NR4ijAYwdcWLTmwSbR0yusM=
-github.com/hashicorp/go-kms-wrapping/wrappers/ocikms/v2 v2.0.7/go.mod h1:rXxYzjjGw4HltEwxPp9zYSRIo6R+rBf1MSPk01bvodc=
-github.com/hashicorp/go-kms-wrapping/wrappers/transit/v2 v2.0.11 h1:hdzSrDJ0CgHgGFx+1toaf7Z5bmQ2EYaFQ/dtWNXxu1I=
-github.com/hashicorp/go-kms-wrapping/wrappers/transit/v2 v2.0.11/go.mod h1:ywjP17x2t88pT3GA8gCc2vEH1vhvU1R9d5XwRQ0d7PQ=
-github.com/hashicorp/go-memdb v1.3.4 h1:XSL3NR682X/cVk2IeV0d70N4DZ9ljI885xAEU8IoK3c=
-github.com/hashicorp/go-memdb v1.3.4/go.mod h1:uBTr1oQbtuMgd1SSGoR8YV27eT3sBHbYiNm53bMpgSg=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.18 h1:DLfC677GfKEpSAFpEWvl1vXsGpEcSHmbhBaPLrdDQHc=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.18/go.mod h1:t/eaR/mi2mw3klfl1WEAuiLKrlZ/Q8cosmsT+RIPLu0=
+github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2 v2.0.10 h1:am7ai27sEGpfOefHhUShbWAOa6EvkBaiMpB7zZ/PUyo=
+github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2 v2.0.10/go.mod h1:sYX07HI7wMCFe9+FmxMOCwJ7q5CD4aq3VI+KoB8FYZY=
+github.com/hashicorp/go-kms-wrapping/wrappers/alicloudkms/v2 v2.0.4 h1:8XgCt3ZDfE0MPBLJsUE4ZnPkFAF4K13Zxqyjx1lA22A=
+github.com/hashicorp/go-kms-wrapping/wrappers/alicloudkms/v2 v2.0.4/go.mod h1:Inx0DLGr58Un5TerS8je0SGZwKKihotqaxqoAKHpSmk=
+github.com/hashicorp/go-kms-wrapping/wrappers/awskms/v2 v2.0.11 h1:J9zGa9SlcOHT3SQTj0Vv3shHo0anWbs58weURGCgChI=
+github.com/hashicorp/go-kms-wrapping/wrappers/awskms/v2 v2.0.11/go.mod h1:iAOCu7/lG5eugg8+k7NVvQt0IpWT8s2Q9wnMtC/guM4=
+github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 v2.0.14 h1:oK4OQ5EPbx/66dAvitksV+OdrQ86SZEj3B6VSZrbdEY=
+github.com/hashicorp/go-kms-wrapping/wrappers/azurekeyvault/v2 v2.0.14/go.mod h1:fWxrv9YkAMqtsISde5mcutoMvuiH4kyg1AlDzzmqRh8=
+github.com/hashicorp/go-kms-wrapping/wrappers/gcpckms/v2 v2.0.13 h1:NGBZnF+yPRZ3gjFl69Y2m58/U0iyB2oH9HaznL9tekA=
+github.com/hashicorp/go-kms-wrapping/wrappers/gcpckms/v2 v2.0.13/go.mod h1:4Xb+6d8VPeDcUNuh4toPqJlDpkajeJyIQeg36TtWhKw=
+github.com/hashicorp/go-kms-wrapping/wrappers/ocikms/v2 v2.0.9 h1:rlKOPHzZ41QeV/H6UIX2wVkPhLzVK+nKhLRIbIAZ0Yc=
+github.com/hashicorp/go-kms-wrapping/wrappers/ocikms/v2 v2.0.9/go.mod h1:pHJfTvq97FAKCWxIJOHZWQmVfRXmUN6tmgEcgj3nC+M=
+github.com/hashicorp/go-kms-wrapping/wrappers/transit/v2 v2.0.13 h1:UuDeq3nr0e+H9CrZM3dvpDGkWFSJYTtuTqVekn2za2k=
+github.com/hashicorp/go-kms-wrapping/wrappers/transit/v2 v2.0.13/go.mod h1:E2dYgXYNkvKe84PIxD9eJqqhFRA4guCTDweJR4i0gds=
+github.com/hashicorp/go-memdb v1.3.5 h1:b3taDMxCBCBVgyRrS1AZVHO14ubMYZB++QpNhBg+Nyo=
+github.com/hashicorp/go-memdb v1.3.5/go.mod h1:8IVKKBkVe+fxFgdFOYxzQQNjz+sWCyHCdIC/+5+Vy1Y=
+github.com/hashicorp/go-metrics v0.5.4 h1:8mmPiIJkTPPEbAiV97IxdAGNdRdaWwVap1BU6elejKY=
+github.com/hashicorp/go-metrics v0.5.4/go.mod h1:CG5yz4NZ/AI/aQt9Ucm/vdBnbh7fvmv4lxZ350i+QQI=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-msgpack v0.5.5/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-msgpack v1.1.5 h1:9byZdVjKTe5mce63pRVNP1L7UAmdHOTEMGehn6KvJWs=
 github.com/hashicorp/go-msgpack v1.1.5/go.mod h1:gWVc3sv/wbDmR3rQsj1CAktEZzoz1YNK9NfGLXJ69/4=
-github.com/hashicorp/go-msgpack/v2 v2.1.1 h1:xQEY9yB2wnHitoSzk/B9UjXWRQ67QKu5AOm8aFp8N3I=
-github.com/hashicorp/go-msgpack/v2 v2.1.1/go.mod h1:upybraOAblm4S7rx0+jeNy+CWWhzywQsSRV5033mMu4=
-github.com/hashicorp/go-multierror v0.0.0-20161216184304-ed905158d874/go.mod h1:JMRHfdO9jKNzS/+BTlxCjKNQHg/jZAft8U7LloJvN7I=
+github.com/hashicorp/go-msgpack/v2 v2.1.2 h1:4Ee8FTp834e+ewB71RDrQ0VKpyFdrKOjvYtnQ/ltVj0=
+github.com/hashicorp/go-msgpack/v2 v2.1.2/go.mod h1:upybraOAblm4S7rx0+jeNy+CWWhzywQsSRV5033mMu4=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.6.0 h1:wgd4KxHJTVGGqWBq4QPB1i5BZNEx9BR8+OFmHDmTk8A=
-github.com/hashicorp/go-plugin v1.6.0/go.mod h1:lBS5MtSSBZk0SHc66KACcjjlU6WzEVP/8pwz68aMkCI=
+github.com/hashicorp/go-pgmultiauth v1.0.0 h1:dJzw5y45y04Z3ThX/0DaNTrOrrt6Fe+jiuJzJ9r2M0g=
+github.com/hashicorp/go-pgmultiauth v1.0.0/go.mod h1:+wRFKBbDws/LM7hcxuclEUGDzzUgescGbdYo4EceYjc=
+github.com/hashicorp/go-plugin v1.6.3 h1:xgHB+ZUSYeuJi96WtxEjzi23uh7YQpznjGh0U0UUrwg=
+github.com/hashicorp/go-plugin v1.6.3/go.mod h1:MRobyh+Wc/nYy1V4KAXUiYfzxoYhs7V1mlH1Z7iY2h0=
 github.com/hashicorp/go-raftchunking v0.6.3-0.20191002164813-7e9e8525653a h1:FmnBDwGwlTgugDGbVxwV8UavqSMACbGrUpfc98yFLR4=
 github.com/hashicorp/go-raftchunking v0.6.3-0.20191002164813-7e9e8525653a/go.mod h1:xbXnmKqX9/+RhPkJ4zrEx4738HacP72aaUPlT2RZ4sU=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
-github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
-github.com/hashicorp/go-retryablehttp v0.7.1/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
-github.com/hashicorp/go-retryablehttp v0.7.5 h1:bJj+Pj19UZMIweq/iie+1u5YCdGrnxCT9yvm0e+Nd5M=
-github.com/hashicorp/go-retryablehttp v0.7.5/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
-github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
 github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0 h1:I8bynUKMh9I7JdwtW9voJ0xmHvBpxQtLjrMFDYmhOxY=
 github.com/hashicorp/go-secure-stdlib/awsutil v0.3.0/go.mod h1:oKHSQs4ivIfZ3fbXGQOop1XuDfdSb8RIsWTGaAanSfg=
-github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
+github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.1 h1:VaLXp47MqD1Y2K6QVrA9RooQiPyCgAbnfeJg44wKuJk=
+github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.1/go.mod h1:hH8rgXHh9fPSDPerG6WzABHsHF+9ZpLhRI1LPk4JZ8c=
 github.com/hashicorp/go-secure-stdlib/fileutil v0.1.0 h1:f2mwVgMJjXuX/+eWD6ZW30+oIRgCofL+XMWknFkB1WM=
 github.com/hashicorp/go-secure-stdlib/fileutil v0.1.0/go.mod h1:uwcr2oga9pN5+OkHZyTN5MDk3+1YHOuMukhpnPaQAoI=
 github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 h1:9um9R8i0+HbRHS9d64kdvWR0/LJvo12sIonvR9zr1+U=
 github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1/go.mod h1:6RoRTSMDK2H/rKh3P/JIsk1tK8aatKTt3JyvIopi3GQ=
+github.com/hashicorp/go-secure-stdlib/httputil v0.1.0 h1:0cT/LmCfurGE6/MOq8ig3meKYS32YDh0sTE9g86ANgg=
+github.com/hashicorp/go-secure-stdlib/httputil v0.1.0/go.mod h1:Md+jfeLf7CjGjTmgBWzFyc4vznsIb8yEiX7/CGAJvkI=
 github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2 h1:NS6BHieb/pDfx3M9jDdaPpGyyVp+aD4A3DjX3dgRmzs=
 github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2/go.mod h1:rf5JPE13wi+NwjgsmGkbg4b2CgHq8v7Htn/F0nDe/hg=
-github.com/hashicorp/go-secure-stdlib/mlock v0.1.2/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=
 github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 h1:kH3Rhiht36xhAfhuHyWJDgdXXEx9IIZhDGRk24CDhzg=
 github.com/hashicorp/go-secure-stdlib/mlock v0.1.3/go.mod h1:ov1Q0oEDjC3+A4BwsG2YdKltrmEw8sf9Pau4V9JQ4Vo=
 github.com/hashicorp/go-secure-stdlib/nonceutil v0.1.0 h1:iJG9Q3iUme12yH+wzBMGYrw/Am4CfX3sDcA8m5OGfhQ=
 github.com/hashicorp/go-secure-stdlib/nonceutil v0.1.0/go.mod h1:s28ohJ0kU6tersf0it/WsBCyZSdziPlP+G1FRA3ar28=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 h1:iBt4Ew4XEGLfh6/bPk4rSYmuZJGizr6/x/AEizP0CQc=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8/go.mod h1:aiJI+PIApBRQG7FZTEBx5GiiX+HbOHilUdNxUZi4eV0=
-github.com/hashicorp/go-secure-stdlib/password v0.1.1 h1:6JzmBqXprakgFEHwBgdchsjaA9x3GyjdI568bXKxa60=
-github.com/hashicorp/go-secure-stdlib/password v0.1.1/go.mod h1:9hH302QllNwu1o2TGYtSk8I8kTAN0ca1EHpwhm5Mmzo=
-github.com/hashicorp/go-secure-stdlib/plugincontainer v0.3.0 h1:KMWpBsC65ZBXDpoxJ0n2/zVfZaZIW73k2d8cy5Dv/Kk=
-github.com/hashicorp/go-secure-stdlib/plugincontainer v0.3.0/go.mod h1:qKYwSZ2EOpppko5ud+Sh9TrUgiTAZSaQCr8XWIYXsbM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
+github.com/hashicorp/go-secure-stdlib/password v0.1.4 h1:h8gOB6qDRlOMvoMHOqtf4oTdB+goC/hWX0+TXA+VltI=
+github.com/hashicorp/go-secure-stdlib/password v0.1.4/go.mod h1:DeLx56RZZdmwX8Q94fVQUetkXv6zVBfDtGAPJDh69AU=
+github.com/hashicorp/go-secure-stdlib/permitpool v1.0.0 h1:U6y5MXGiDVOOtkWJ6o/tu1TxABnI0yKTQWJr7z6BpNk=
+github.com/hashicorp/go-secure-stdlib/permitpool v1.0.0/go.mod h1:ecDb3o+8D4xtP0nTCufJaAVawHavy5M2eZ64Nq/8/LM=
+github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.2 h1:gCNiM4T5xEc4IpT8vM50CIO+AtElr5kO9l2Rxbq+Sz8=
+github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.2/go.mod h1:6ZM4ZdwClyAsiU2uDBmRHCvq0If/03BMbF9U+U7G5pA=
+github.com/hashicorp/go-secure-stdlib/regexp v1.0.0 h1:08mz6j5MsCG9sf8tvC8Lhboe/ZMiNg41IPSh6unK5T4=
+github.com/hashicorp/go-secure-stdlib/regexp v1.0.0/go.mod h1:n/Gj3sYIEEOYds8uKS55bFf7XiYvWN4e+d+UOA7r/YU=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 h1:SMGUnbpAcat8rIKHkBPjfv81yC46a8eCNZ2hsR2l1EI=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1/go.mod h1:Ch/bf00Qnx77MZd49JRgHYqHQjtEmTgGU2faufpVZb0=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2/go.mod h1:l8slYwnJA26yBz+ErHpp2IRCLr0vuOMGBORIz4rRiAs=
 github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 h1:xbrxd0U9XQW8qL1BAz2XrAjAF/P2vcqUTAues9c24B8=
 github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3/go.mod h1:LWq2Sy8UoKKuK4lFuCNWSjJj57MhNNf2zzBWMtkAIX4=
-github.com/hashicorp/go-slug v0.13.4 h1:dIyjGKFVwbOVAqp0/s7tmONwCNr9D2UvmMuVE4mPfv0=
-github.com/hashicorp/go-slug v0.13.4/go.mod h1:THWVTAXwJEinbsp4/bBRcmbaO5EYNLTqxbG4tZ3gCYQ=
+github.com/hashicorp/go-slug v0.16.7 h1:sBW8y1sX+JKOZKu9a+DQZuWDVaX+U9KFnk6+VDQvKcw=
+github.com/hashicorp/go-slug v0.16.7/go.mod h1:X5fm++dL59cDOX8j48CqHr4KARTQau7isGh0ZVxJB5I=
 github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/go-sockaddr v1.0.6 h1:RSG8rKU28VTUTvEKghe5gIhIQpv8evvNpnDEyqO4u9I=
-github.com/hashicorp/go-sockaddr v1.0.6/go.mod h1:uoUUmtwU7n9Dv3O4SNLeFvg0SxQ3lyjsj6+CCykpaxI=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/go-syslog v1.0.0 h1:KaodqZuhUoZereWVIYmpUgZysurB1kBLX2j0MwMrUAE=
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
-github.com/hashicorp/go-tfe v1.44.0 h1:eQ9n2Ecfel6O5j03UW6B9LNsM1x6KbHErsjwSd9BLmg=
-github.com/hashicorp/go-tfe v1.44.0/go.mod h1:3ZGX+wxeyp/JnP8qEZo8m3s0ggJ7H+L2BvJRpkRdtVU=
+github.com/hashicorp/go-tfe v1.93.0 h1:hJubwn1xNCo1iBO66iQkjyC+skR61cK1AQUj4O9vvuI=
+github.com/hashicorp/go-tfe v1.93.0/go.mod h1:QwqgCD5seztgp76CP7F0POJPflQNSqjIvBpVohg9X50=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
-github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
+github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
+github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
@@ -2472,25 +1508,22 @@ github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uG
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/hcl v1.0.1-vault-5 h1:kI3hhbbyzr4dldA8UdTb7ZlVVlI2DACdCfz31RPDgJM=
-github.com/hashicorp/hcl v1.0.1-vault-5/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
-github.com/hashicorp/hcl/v2 v2.16.2 h1:mpkHZh/Tv+xet3sy3F9Ld4FyI2tUpWe9x3XtPx9f1a0=
-github.com/hashicorp/hcl/v2 v2.16.2/go.mod h1:JRmR89jycNkrrqnMmvPDMd56n1rQJ2Q6KocSLCMCXng=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/hcl/v2 v2.23.0 h1:Fphj1/gCylPxHutVSEOf2fBOh1VE4AuLV7+kbJf3qos=
+github.com/hashicorp/hcl/v2 v2.23.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
 github.com/hashicorp/hcp-link v0.2.1 h1:8w4YVJxRb2C7oXN+hCPSyDbBeo7RQsIYTR6nQXJt6f8=
 github.com/hashicorp/hcp-link v0.2.1/go.mod h1:6otT7bD+nBW1cyzgz8Z4BPziZfwxTtAEkYUrF/MOT8o=
 github.com/hashicorp/hcp-scada-provider v0.2.2 h1:S4Kz+Vc02XOz/5Sm9Gug6ivfyfgchM6qv48cgz0uRls=
 github.com/hashicorp/hcp-scada-provider v0.2.2/go.mod h1:Q0WpS2RyhBKOPD4X/8oW7AJe7jA2HXB09EwDzwRTao0=
-github.com/hashicorp/hcp-sdk-go v0.75.0 h1:5SLvNpcTeZnG7YnwWIaZlqCottFCGKldEIQnaYjOIq8=
-github.com/hashicorp/hcp-sdk-go v0.75.0/go.mod h1:5GwdT+HGhEQsh4n1yK+RADnQkfOo6vHgr2BpYUt2t9U=
-github.com/hashicorp/jsonapi v1.3.1 h1:GtPvnmcWgYwCuDGvYT5VZBHcUyFdq9lSyCzDjn1DdPo=
-github.com/hashicorp/jsonapi v1.3.1/go.mod h1:kWfdn49yCjQvbpnvY1dxxAuAFzISwrrMDQOcu6NsFoM=
+github.com/hashicorp/hcp-sdk-go v0.138.0 h1:AYK2N28zJjHlqzkYVAamwtikTpIMNdl+5ZyBBuuQGDY=
+github.com/hashicorp/hcp-sdk-go v0.138.0/go.mod h1:1HCJgX11KAIccfyKxwqFOMNbCRMaSvCB68EkOnOTRUM=
+github.com/hashicorp/jsonapi v1.4.3-0.20250220162346-81a76b606f3e h1:xwy/1T0cxHWaLx2MM0g4BlaQc1BXn/9835mPrBqwSPU=
+github.com/hashicorp/jsonapi v1.4.3-0.20250220162346-81a76b606f3e/go.mod h1:kWfdn49yCjQvbpnvY1dxxAuAFzISwrrMDQOcu6NsFoM=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
-github.com/hashicorp/mdns v1.0.1/go.mod h1:4gW7WsVCke5TE7EPeYliwHlRUyBtfCwuFwuMg2DmyNY=
 github.com/hashicorp/mdns v1.0.4 h1:sY0CMhFmjIPDMlTB+HfymFHCaYLhgifZ0QhjaYKD/UQ=
 github.com/hashicorp/mdns v1.0.4/go.mod h1:mtBihi+LeNXGtG8L9dX59gAEa12BDtBQSp4v/YAJqrc=
-github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
 github.com/hashicorp/memberlist v0.5.0 h1:EtYPN8DpAURiapus508I4n9CzHs2W+8NZGbmmR/prTM=
 github.com/hashicorp/memberlist v0.5.0/go.mod h1:yvyXLpo0QaGE59Y7hDTsTzDD25JYBZ4mHgHUZ8lrOI0=
 github.com/hashicorp/net-rpc-msgpackrpc/v2 v2.0.0 h1:kBpVVl1sl3MaSrs97e0+pDQhSrqJv9gVbSUrPpVfl1w=
@@ -2499,11 +1532,10 @@ github.com/hashicorp/nomad/api v0.0.0-20240213164230-c364cb57298d h1:nvfutImOr3G
 github.com/hashicorp/nomad/api v0.0.0-20240213164230-c364cb57298d/go.mod h1:ijDwa6o1uG1jFSq6kERiX2PamKGpZzTmo0XOFNeFZgw=
 github.com/hashicorp/raft v1.0.1/go.mod h1:DVSAWItjLjTOkVbSpWQ0j0kUADIvDaCtBxIcbNAQLkI=
 github.com/hashicorp/raft v1.1.2-0.20191002163536-9c6bd3e3eb17/go.mod h1:vPAJM8Asw6u8LxC3eJCUZmRP/E4QmUGE1R7g7k8sG/8=
-github.com/hashicorp/raft v1.2.0/go.mod h1:vPAJM8Asw6u8LxC3eJCUZmRP/E4QmUGE1R7g7k8sG/8=
-github.com/hashicorp/raft v1.6.1 h1:v/jm5fcYHvVkL0akByAp+IDdDSzCNCGhdO6VdB56HIM=
-github.com/hashicorp/raft v1.6.1/go.mod h1:N1sKh6Vn47mrWvEArQgILTyng8GoDRNYlgKyK7PMjs0=
-github.com/hashicorp/raft-autopilot v0.2.0 h1:2/R2RPgamgRKgNWGQioULZvjeKXQZmDuw5Ty+6c+H7Y=
-github.com/hashicorp/raft-autopilot v0.2.0/go.mod h1:q6tZ8UAZ5xio2gv2JvjgmtOlh80M6ic8xQYBe2Egkg8=
+github.com/hashicorp/raft v1.7.3 h1:DxpEqZJysHN0wK+fviai5mFcSYsCkNpFUl1xpAW8Rbo=
+github.com/hashicorp/raft v1.7.3/go.mod h1:DfvCGFxpAUPE0L4Uc8JLlTPtc3GzSbdH0MTJCLgnmJQ=
+github.com/hashicorp/raft-autopilot v0.3.0 h1:KhXCecBFqAMpC0i77qVfuYd937cl2dNatSA/sSNs+2s=
+github.com/hashicorp/raft-autopilot v0.3.0/go.mod h1:pUBzcE8bXIm/NcFZ/xKz7O3aNOU/4T4Zkv11YqdxpUc=
 github.com/hashicorp/raft-boltdb v0.0.0-20171010151810-6e5ba93211ea/go.mod h1:pNv7Wc3ycL6F5oOWn+tPGo2gWD4a5X+yp/ntwdKLjRk=
 github.com/hashicorp/raft-boltdb v0.0.0-20230125174641-2a8082862702 h1:RLKEcCuKcZ+qp2VlaaZsYZfLOmIiuJNpEi48Rl8u9cQ=
 github.com/hashicorp/raft-boltdb v0.0.0-20230125174641-2a8082862702/go.mod h1:nTakvJ4XYq45UXtn0DbwR4aU9ZdjlnIenpbs6Cd+FM0=
@@ -2513,102 +1545,80 @@ github.com/hashicorp/raft-snapshot v1.0.4 h1:EuDuayAJPdiDmVk1ygTDnG2zDzrs0/6/yBu
 github.com/hashicorp/raft-snapshot v1.0.4/go.mod h1:5sL9eUn72lH5DzsFIJ9jaysITbHksSSszImWSOTC8Ic=
 github.com/hashicorp/raft-wal v0.4.0 h1:oHCQLPa3gBTrfuBVHaDg2b/TVXpU0RIyeH/mU9ovk3Y=
 github.com/hashicorp/raft-wal v0.4.0/go.mod h1:A6vP5o8hGOs1LHfC1Okh9xPwWDcmb6Vvuz/QyqUXlOE=
-github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
 github.com/hashicorp/serf v0.10.1 h1:Z1H2J60yRKvfDYAOZLd2MU0ND4AH/WDz7xYHDWQsIPY=
 github.com/hashicorp/serf v0.10.1/go.mod h1:yL2t6BqATOLGc5HF7qbFkTfXoPIY0WZdWHfEvMqbG+4=
-github.com/hashicorp/vault-hcp-lib v0.0.0-20240126195955-473e9a48e7b7 h1:D9XTgYgpQgdZHToRpJQ6fZwWyOOSpLX3Y+D2aMlxQh4=
-github.com/hashicorp/vault-hcp-lib v0.0.0-20240126195955-473e9a48e7b7/go.mod h1:KpSNItDH9ojFPf4UkGCB0vv3cAAwvVxBU2On4EZ0f7c=
-github.com/hashicorp/vault-plugin-auth-alicloud v0.17.0 h1:0SOkYxjMjph3Tbtv37+pANJQnYDvlAdjKpdEbK6zzZs=
-github.com/hashicorp/vault-plugin-auth-alicloud v0.17.0/go.mod h1:79KUWOxY6Ftoad7b+vEmyCmY6eYKdHiADTP0w0TunsE=
-github.com/hashicorp/vault-plugin-auth-azure v0.17.0 h1:nFsWQV+sMEdJCvKpVODNeTPP36n5bi6yiQpBOdBsQWw=
-github.com/hashicorp/vault-plugin-auth-azure v0.17.0/go.mod h1:bkIcQTa19JcR426IkSoGEmXX5Yi7nfLp/6M965zvuww=
-github.com/hashicorp/vault-plugin-auth-centrify v0.15.1 h1:6StAr5tltpySNgyUwWC8czm9ZqkO7NIZfcRmxxtFwQ8=
-github.com/hashicorp/vault-plugin-auth-centrify v0.15.1/go.mod h1:xXs4I5yLxbQ5VHcpvSxkRhShCTXd8Zyrni8qnFrfQ4Y=
-github.com/hashicorp/vault-plugin-auth-cf v0.16.0 h1:t4+0LY6002NQvY6c0c43ikZjxqReCHUiy7+YXiMRbKo=
-github.com/hashicorp/vault-plugin-auth-cf v0.16.0/go.mod h1:q+Lt3FhtFlP+pulKSjrbnR8ecu4vY9TlgPvs+nnBey8=
-github.com/hashicorp/vault-plugin-auth-gcp v0.16.2 h1:HC1PpXxGNzfu7IUfN7Ok7dIMV29R8a/2EJ5uDnrpxz0=
-github.com/hashicorp/vault-plugin-auth-gcp v0.16.2/go.mod h1:8FWNvFElzQBWJGCZ3SBPqsSc/x9bge9Et+JuwVLlJPM=
-github.com/hashicorp/vault-plugin-auth-jwt v0.20.0 h1:8mQLKmoq5ozKWv5Z5IamLtHi5y9mK6b57VRx+vvoge8=
-github.com/hashicorp/vault-plugin-auth-jwt v0.20.0/go.mod h1:eMlA7i4I6UGy6UE0JRqZqup07Y8548XdG27YVY8MY8M=
-github.com/hashicorp/vault-plugin-auth-kerberos v0.11.0 h1:XjdH8nqosqgKeAwBptMS7DoXsdi8IKL2fbBSyvL/HRM=
-github.com/hashicorp/vault-plugin-auth-kerberos v0.11.0/go.mod h1:xupzh9O6Us6bqKLZ6wfRsjqlf1Mb1TRylKpxZPJd5rA=
-github.com/hashicorp/vault-plugin-auth-kubernetes v0.18.0 h1:mGVVdcTI55t/NrMefkLjnenAVunJiQZg5o0opuU7ixw=
-github.com/hashicorp/vault-plugin-auth-kubernetes v0.18.0/go.mod h1:ju7B2fxYr3EtC2jX0ft79mUMuEGozz1Ws/ABpVvtlto=
-github.com/hashicorp/vault-plugin-auth-oci v0.15.1 h1:frikend6vdC09I60qmFkRwBVgXLlBz2qe1869bC5J5s=
-github.com/hashicorp/vault-plugin-auth-oci v0.15.1/go.mod h1:i3KYRLQFpAIJuvbXHBMgXzw0563Sp/2mMpAFU5F6Z9I=
-github.com/hashicorp/vault-plugin-database-couchbase v0.10.1 h1:U+UPB8FIh5UJo8mziK36waZ0o6q8Ik6hgncFTuJ1Bwg=
-github.com/hashicorp/vault-plugin-database-couchbase v0.10.1/go.mod h1:yxvB4Ky2JhtUtZOp+7M8z9jupxfEBKIIyiBNs9qvXpA=
-github.com/hashicorp/vault-plugin-database-elasticsearch v0.14.0 h1:7v7+WTlQKG/ZikiW3Q4Hef6UBw9A2Q4xAB0ytOkXNdU=
-github.com/hashicorp/vault-plugin-database-elasticsearch v0.14.0/go.mod h1:JKcIsHm0bi9tdNnwyOQKGkt8vEz/oO3KjQIsisViu1s=
-github.com/hashicorp/vault-plugin-database-mongodbatlas v0.11.0 h1:DNIwrmviDOq/BdIhFaU6wMYolOl/0N54xYBCy41HN3U=
-github.com/hashicorp/vault-plugin-database-mongodbatlas v0.11.0/go.mod h1:DTrqLTHGxHVPudf4OUnxA3RPFDYwDzvTPuGinok/sH8=
-github.com/hashicorp/vault-plugin-database-redis v0.2.3 h1:Tp/gxLv1XysUgmaufzm9UbP82wZSp8D6nmLw7NqXS8E=
-github.com/hashicorp/vault-plugin-database-redis v0.2.3/go.mod h1:VdBXwRbeN597kcmBptvfPRD55BjrExEFEMPOK+NjH5M=
-github.com/hashicorp/vault-plugin-database-redis-elasticache v0.3.0 h1:8sNYuHOxpUxcq1pxhR4HdYfZIaeEVCiWV5lV25u10ic=
-github.com/hashicorp/vault-plugin-database-redis-elasticache v0.3.0/go.mod h1:IoJwgHiY1vvIbBWO/lidH6wN85jVGnY4k78tZe1jctU=
-github.com/hashicorp/vault-plugin-database-snowflake v0.10.0 h1:XmGY3YsEwhs/LHHO6I9MmiHcI0peL31cQCbHMCniMro=
-github.com/hashicorp/vault-plugin-database-snowflake v0.10.0/go.mod h1:COMbAUyRr1KgNLv0R3n0/olFoy3JkXq57VYd5+9ulPw=
-github.com/hashicorp/vault-plugin-mock v0.16.1 h1:5QQvSUHxDjEEbrd2REOeacqyJnCLPD51IQzy71hx8P0=
-github.com/hashicorp/vault-plugin-mock v0.16.1/go.mod h1:83G4JKlOwUtxVourn5euQfze3ZWyXcUiLj2wqrKSDIM=
-github.com/hashicorp/vault-plugin-secrets-ad v0.17.0 h1:yXyjHkFduORBwI6g9GxIorXXKRb/wTwbMLkFEgnqzso=
-github.com/hashicorp/vault-plugin-secrets-ad v0.17.0/go.mod h1:HXT1QFK8wN+HYhWWPAIVYSXnNuBqUDM2TsRgiJT6qUc=
-github.com/hashicorp/vault-plugin-secrets-alicloud v0.16.0 h1:rkMe/n9/VylQEm7QeNXgdUaESvLz5UjkokMH1WkFiKU=
-github.com/hashicorp/vault-plugin-secrets-alicloud v0.16.0/go.mod h1:xkGzU7LrkgoRhdN2NwLsshqCpjPz2aqkMVzqS6JKJeg=
-github.com/hashicorp/vault-plugin-secrets-azure v0.17.0 h1:49VPjDnMENnX92VdQri+wTFZK2tbETZXID93P657VnU=
-github.com/hashicorp/vault-plugin-secrets-azure v0.17.0/go.mod h1:R4SSIIC5/NPpeV7GO1ZQ9z0cLUNufAAVi+oO7bpguUM=
-github.com/hashicorp/vault-plugin-secrets-gcp v0.18.0 h1:RPKGn6Ai/t4QtdCWg9W7VYTe44cN3jDxgtobTsHHfqE=
-github.com/hashicorp/vault-plugin-secrets-gcp v0.18.0/go.mod h1:b5ZdWNoPDo64g5mp16U6UVPTqCU3gKNIZ7Knc//uypg=
-github.com/hashicorp/vault-plugin-secrets-gcpkms v0.16.0 h1:1wEYeplJl/9FLwBQSmfpqMdKKwmNz/b3e6K9ZOdJK/s=
-github.com/hashicorp/vault-plugin-secrets-gcpkms v0.16.0/go.mod h1:dTyKQItGjGeCnjdWZtO+LPIpzi192uEwk8UxP/R3rMQ=
-github.com/hashicorp/vault-plugin-secrets-kubernetes v0.7.0 h1:IRsrGZyYjecQrAvpKXodQDus4oQRpGDUsQiyJ8Szlmk=
-github.com/hashicorp/vault-plugin-secrets-kubernetes v0.7.0/go.mod h1:StJ4o4D+ChaQ3lKzaWB5CAGDx62ONP9pDFr7iK8i9HU=
-github.com/hashicorp/vault-plugin-secrets-kv v0.17.0 h1:UNYINnuymcGRT+7UA0MciYAz06/6CB3Ll/P32nTXrNk=
-github.com/hashicorp/vault-plugin-secrets-kv v0.17.0/go.mod h1:2U8dr0BrVNIndr1lYrJ3Q92RCrJzpnDCkAmZe/JRyFo=
-github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.11.0 h1:NU7X28xzc/WBY0jMJNnan+elmKFWv/n5zbWXHfKf9/I=
-github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.11.0/go.mod h1:l6kmbSsAVTrzhsliH283dTo9LYZ4ClPMbBgEyWiUtz8=
-github.com/hashicorp/vault-plugin-secrets-openldap v0.12.1 h1:8BSRXpPplF15ZL77vIQFi9+8zUmbVWjHpdEmkIaqVLg=
-github.com/hashicorp/vault-plugin-secrets-openldap v0.12.1/go.mod h1:epAxjKFROBOI5rUg/8UgRmQlboR4l0AMoAPP5Mx9qkI=
-github.com/hashicorp/vault-plugin-secrets-terraform v0.7.5 h1:nyhdeSdkcb5ZT0drFaW3IePL0aUmcVTzuOToG7RjHwY=
-github.com/hashicorp/vault-plugin-secrets-terraform v0.7.5/go.mod h1:mVZiKjHtll1vqOvThL6F29W1DM2DK5FerAmO7SNz/VE=
-github.com/hashicorp/vault-testing-stepwise v0.1.4 h1:Lsv1KdpQyjhvmLgKeH65FG5MmY5hMkF5LoX3xIxurjg=
-github.com/hashicorp/vault-testing-stepwise v0.1.4/go.mod h1:Ym1T/kMM2sT6qgCIIJ3an7uaSWCJ8O7ohsWB9UiB5tI=
+github.com/hashicorp/vault-hcp-lib v0.0.0-20250306185756-615fe2449b16 h1:OYPMX3Td3XTL0Xk5N3Se1KLde630diD1X+v3wgJXDhQ=
+github.com/hashicorp/vault-hcp-lib v0.0.0-20250306185756-615fe2449b16/go.mod h1:v4RnW8isIioLAc11prbTczNCq9TiEWE5MwizMsgY5mE=
+github.com/hashicorp/vault-plugin-auth-alicloud v0.22.0 h1:lukm7hwIDQfDyG6IyvBu2tcT6j2bRuyyo22sWqH4w50=
+github.com/hashicorp/vault-plugin-auth-alicloud v0.22.0/go.mod h1:QCuzE/JFqigUf4DyyWyYKq6bvf2dmRKUW340CTy+HZ0=
+github.com/hashicorp/vault-plugin-auth-azure v0.22.0 h1:xvRYu2Xirn6gl/GvhPei7DJgJDDTEvsxxEHkBxuj/Iw=
+github.com/hashicorp/vault-plugin-auth-azure v0.22.0/go.mod h1:G/wFIXYlPQDXusYD54tlZIb3CDk2cy9OB9hUXyWkqf4=
+github.com/hashicorp/vault-plugin-auth-cf v0.22.0 h1:DTK733vsB2lBVwSLxra3/IuhlGdkQVW11T/q0qdXyis=
+github.com/hashicorp/vault-plugin-auth-cf v0.22.0/go.mod h1:qToMQoW7dX1egtJwEHd21I/7pgzg+DBEwRAytd+Pgtc=
+github.com/hashicorp/vault-plugin-auth-gcp v0.22.0 h1:c5LEJmHNV6VzbKTM9nn05uGLhu0VRnIsacCshj0AJ8M=
+github.com/hashicorp/vault-plugin-auth-gcp v0.22.0/go.mod h1:6WhVeAZUu+67H4tkXsnFoUU3+UaBFLlE6ffUHDkVM0o=
+github.com/hashicorp/vault-plugin-auth-jwt v0.25.0 h1:YdrZ+fGutoaaF/Hiw3+xtmcRalmqGH8sXRKIrkr5dsk=
+github.com/hashicorp/vault-plugin-auth-jwt v0.25.0/go.mod h1:HhfLJxvpYt10mrZoBTa+ToioN9HGOZbWYSR1UHqTMrs=
+github.com/hashicorp/vault-plugin-auth-kerberos v0.16.0 h1:bZpmQS26TorpeensFerDPM7z+NgZjrRj9IbdGRdjaLM=
+github.com/hashicorp/vault-plugin-auth-kerberos v0.16.0/go.mod h1:O6b92icQx0LGuknyVEVP/XgYjoYDNiTR9cJ1pEUuwjw=
+github.com/hashicorp/vault-plugin-auth-kubernetes v0.23.0 h1:OuyLSwuLjgWeZ57T1oroM3r1CBVmou7toWuKCEw3TdE=
+github.com/hashicorp/vault-plugin-auth-kubernetes v0.23.0/go.mod h1:492vjXlgdoUBk+RFIPKpdJPtxAX3aHaGCla/shLyv8E=
+github.com/hashicorp/vault-plugin-auth-oci v0.20.0 h1:R1JXapvFsuxE8+jYBSQvkIwWHSpKpHpUbAX5K+6pbO4=
+github.com/hashicorp/vault-plugin-auth-oci v0.20.0/go.mod h1:XOhAs74HS6cSKWm2zQodRBxTFDhu/ApNpiw5Tfz9J4k=
+github.com/hashicorp/vault-plugin-database-couchbase v0.15.0 h1:6gLCOwwErqMgo9pJvsrOkg4tL7HmE95r3JVc14hSFSY=
+github.com/hashicorp/vault-plugin-database-couchbase v0.15.0/go.mod h1:KpGJp2QKCpMFhzMTdovoZFtx56Q7yQ8oO4fg+UuMGrI=
+github.com/hashicorp/vault-plugin-database-elasticsearch v0.19.0 h1:8vbxtLgvTEyve6mJt6aLuaje7NW3aEkJMjf20QFB0gs=
+github.com/hashicorp/vault-plugin-database-elasticsearch v0.19.0/go.mod h1:K0W2sRQPX2T0Rv4eRba5d048nDF1/XcjaI/IJ5EHD3I=
+github.com/hashicorp/vault-plugin-database-mongodbatlas v0.16.0 h1:/eF3lUTELNWU6NoHDLDdv0waibHHG281q7+RbwujGNU=
+github.com/hashicorp/vault-plugin-database-mongodbatlas v0.16.0/go.mod h1:er08o2cVwPpYbcOwlWDX7IdXzPs3gcgCiuujJ8jy6po=
+github.com/hashicorp/vault-plugin-database-redis v0.7.0 h1:bX7TjGaGehMEWdimbjoIfsXTSQK/uMSsUwwjjvatcDQ=
+github.com/hashicorp/vault-plugin-database-redis v0.7.0/go.mod h1:Hus6qqbgqFxIAJQexX7t/NefW80b0nMXt9BmMQgSnvo=
+github.com/hashicorp/vault-plugin-database-redis-elasticache v0.8.0 h1:WJArG0q8XOmnCqKXON/5i/8d0lOI/bsBSc0vSejpIOo=
+github.com/hashicorp/vault-plugin-database-redis-elasticache v0.8.0/go.mod h1:3NEQYiGDheoN2g73xAWzgHuzsIle+RnIr7qPO6hF+co=
+github.com/hashicorp/vault-plugin-database-snowflake v0.15.0 h1:j1A0JaZvY1aQyxjPQTsW7KA8oS1wCtAe8/m/n1lOCBE=
+github.com/hashicorp/vault-plugin-database-snowflake v0.15.0/go.mod h1:Y1QSlXgGj5j7cYYG6I/h7P4kJPkW1pT9AoTuEH4Il4Y=
+github.com/hashicorp/vault-plugin-secrets-ad v0.21.0 h1:hQ3NmPvlfqjUJOFVPsmLKtVjJLgTGC6svkL2CGoo8zs=
+github.com/hashicorp/vault-plugin-secrets-ad v0.21.0/go.mod h1:+DVIGigIqw63QjP3/3tHQnB8EYzc1YfhKsTr+WJGZns=
+github.com/hashicorp/vault-plugin-secrets-alicloud v0.21.0 h1:ywGi5dHIFAqpuC8NiDxSfKIP0WkomRIZXgG40+eY3Hg=
+github.com/hashicorp/vault-plugin-secrets-alicloud v0.21.0/go.mod h1:4g79uHg6DPsa4k6B6iEUK5vYDIAnkOlJJI5kZK1BAcE=
+github.com/hashicorp/vault-plugin-secrets-azure v0.23.0 h1:oetvEJqXP+2jGM9CfT/LjpJyuViNKdjPKFbDIkRdaPo=
+github.com/hashicorp/vault-plugin-secrets-azure v0.23.0/go.mod h1:QkmR0rnexjc330oUzoiuXFsA6OnxmI56h4jnDb1PKbY=
+github.com/hashicorp/vault-plugin-secrets-gcp v0.23.0 h1:hqZlxS4Ya0DBt+FutW6z6tSEdnwHFusY49x7TLKVrAw=
+github.com/hashicorp/vault-plugin-secrets-gcp v0.23.0/go.mod h1:OmRHszxWAV9MTwFeQKDQmrpRw9q+RMp1vohCuhkkr1k=
+github.com/hashicorp/vault-plugin-secrets-gcpkms v0.22.0 h1:z4loMjsAyTKiT4mYMmPNyVxQpetj9vD6dGEtTRxOV5A=
+github.com/hashicorp/vault-plugin-secrets-gcpkms v0.22.0/go.mod h1:pPaA7AchrBQ2i62x33vPRTux7wKZiKSfU6jayuv9hLI=
+github.com/hashicorp/vault-plugin-secrets-kubernetes v0.12.0 h1:xYuLtQHKvaZtmr6JXPqC4tH9n7zXoOWnpXrHcVTLqbo=
+github.com/hashicorp/vault-plugin-secrets-kubernetes v0.12.0/go.mod h1:k8eNkBBNHJwWKVo+WP/iM5xrlvPt65oPNPGwbgQQf14=
+github.com/hashicorp/vault-plugin-secrets-kv v0.25.0 h1:5Xx8Hub0nAoFLIHZ4d9tMpPG+MACHXLzed5i7hViKTk=
+github.com/hashicorp/vault-plugin-secrets-kv v0.25.0/go.mod h1:Xy3wQwAJxhVZweR2DXBrEgk1erkWKNrhYcuD4Gy4ACo=
+github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.16.0 h1:5/nin7vaRD0GyTCcXtX5cKa5JBuCAAs4e9zbmNbvTPY=
+github.com/hashicorp/vault-plugin-secrets-mongodbatlas v0.16.0/go.mod h1:1qO/1BrVkvKSuQm8cOtwLKN27TE0uu5PXxYRrTnpf2s=
+github.com/hashicorp/vault-plugin-secrets-openldap v0.17.0 h1:GpgYcuBL66zzFLkf143Q3zFr//BF/4jX/EXXy9wDUOM=
+github.com/hashicorp/vault-plugin-secrets-openldap v0.17.0/go.mod h1:UPWSw0hYY37sC4MeeoG9G8jN88DYi3L4MeJjRauhaBI=
+github.com/hashicorp/vault-plugin-secrets-terraform v0.13.0 h1:Rhahoi3L1dnZjNqlbUh1f59DMdmfdhsfBvaaX1vjejY=
+github.com/hashicorp/vault-plugin-secrets-terraform v0.13.0/go.mod h1:N1fdq0KpTbK/S4Yc4I04JqJ64+mkya4SZ+ychIYd3E4=
+github.com/hashicorp/vault-testing-stepwise v0.3.2 h1:FCe0yrbK/hHiHqzu7utLcvCTTKjghWHyXwOQ2lxfoQM=
+github.com/hashicorp/vault-testing-stepwise v0.3.2/go.mod h1:aI3k4Nu6TjBKxatj8plXKn8LhA9qb2TeeJyz2psHXEw=
 github.com/hashicorp/vault/vault/hcp_link/proto v0.0.0-20230201201504-b741fa893d77 h1:Y/+BtwxmRak3Us9jrByARvYW6uNeqZlEpMylIdXVIjY=
 github.com/hashicorp/vault/vault/hcp_link/proto v0.0.0-20230201201504-b741fa893d77/go.mod h1:a2crHoMWwY6aiL8GWT8hYj7vKD64uX0EdRPbnsHF5wU=
 github.com/hashicorp/vic v1.5.1-0.20190403131502-bbfe86ec9443 h1:O/pT5C1Q3mVXMyuqg7yuAWUg/jMZR1/0QTzTRdNR6Uw=
 github.com/hashicorp/vic v1.5.1-0.20190403131502-bbfe86ec9443/go.mod h1:bEpDU35nTu0ey1EXjwNwPjI9xErAsoOCmcMb9GKvyxo=
-github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
-github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
-github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
-github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
+github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/imdario/mergo v0.3.6/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
-github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
-github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/influxdata/influxdb v1.7.6/go.mod h1:qZna6X/4elxqT3yI9iZYdZrWWdeFOOprn86kgg4+IzY=
 github.com/influxdata/influxdb1-client v0.0.0-20200827194710-b269163b24ab h1:HqW4xhhynfjrtEiiSGcQUd6vrK23iMam1FO8rI7mwig=
 github.com/influxdata/influxdb1-client v0.0.0-20200827194710-b269163b24ab/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
-github.com/intel/goresctrl v0.2.0/go.mod h1:+CZdzouYFn5EsxgqAQTEzMfwKwuc0fVdMrT9FCCAVRQ=
-github.com/intel/goresctrl v0.3.0/go.mod h1:fdz3mD85cmP9sHD8JUlrNWAxvwM86CrbmVXltEKd7zk=
-github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA=
-github.com/j-keck/arping v1.0.2/go.mod h1:aJbELhR92bSk7tp79AWM/ftfc90EfEi2bQJrbBFOsPw=
 github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
 github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
 github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
 github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
-github.com/jackc/fake v0.0.0-20150926172116-812a484cc733 h1:vr3AYkKovP8uR8AvSGGUK1IDqRa5lAAvEkZG1LKaCRc=
 github.com/jackc/fake v0.0.0-20150926172116-812a484cc733/go.mod h1:WrMFNQdiFJ80sQsxDoMokWK1W5TQtxBFNpzWTD84ibQ=
 github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
 github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
@@ -2616,8 +1626,8 @@ github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsU
 github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
 github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
 github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
-github.com/jackc/pgconn v1.14.0 h1:vrbA9Ud87g6JdFWkHTJXppVce58qPIdP7N8y0Ml/A7Q=
-github.com/jackc/pgconn v1.14.0/go.mod h1:9mBNlny0UvkgJdCDvdVHYSjI+8tD2rnKK69Wz8ti++E=
+github.com/jackc/pgconn v1.14.3 h1:bVoTr12EGANZz66nZPkMInAV/KHD2TxH9npjXXgiB3w=
+github.com/jackc/pgconn v1.14.3/go.mod h1:RZbme4uasqzybK2RK5c65VsHxoyaml09lx3tXOcO/VM=
 github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
 github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
 github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
@@ -2633,32 +1643,37 @@ github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvW
 github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
 github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.3.2 h1:7eY55bdBeCz1F2fTzSz69QC+pG46jYq9/jtSPiJ5nn0=
-github.com/jackc/pgproto3/v2 v2.3.2/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.3.3 h1:1HLSx5H+tXR9pW3in3zaztoEwQYRC9SQaYUHjTSUOag=
+github.com/jackc/pgproto3/v2 v2.3.3/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
 github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
 github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
 github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
 github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
-github.com/jackc/pgtype v1.14.0 h1:y+xUdabmyMkJLyApYuPj38mW+aAIqCe5uuBB51rH3Vw=
 github.com/jackc/pgtype v1.14.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
-github.com/jackc/pgx v3.3.0+incompatible h1:Wa90/+qsITBAPkAZjiByeIGHFcj3Ztu+VzrrIpHjL90=
+github.com/jackc/pgtype v1.14.3 h1:h6W9cPuHsRWQFTWUZMAKMgG5jSwQI0Zurzdvlx3Plus=
+github.com/jackc/pgtype v1.14.3/go.mod h1:aKeozOde08iifGosdJpz9MBZonJOUJxqNpPBcMJTlVA=
 github.com/jackc/pgx v3.3.0+incompatible/go.mod h1:0ZGrqGqkRlliWnWB4zKnWtjbSWbGkVEFm4TeybAXq+I=
 github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
 github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
 github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
 github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
-github.com/jackc/pgx/v4 v4.18.1 h1:YP7G1KABtKpB5IHrO9vYwSrCOhs7p3uqhvhhQBptya0=
-github.com/jackc/pgx/v4 v4.18.1/go.mod h1:FydWkUyadDmdNH/mHnGob881GawxeEm7TcMCzkb+qQE=
+github.com/jackc/pgx/v4 v4.18.2/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
+github.com/jackc/pgx/v4 v4.18.3 h1:dE2/TrEsGX3RBprb3qryqSV9Y60iZN1C6i8IrmW9/BA=
+github.com/jackc/pgx/v4 v4.18.3/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
+github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
+github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
 github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jarcoal/httpmock v0.0.0-20180424175123-9c70cfe4a1da/go.mod h1:ks+b9deReOc7jgqp+e7LuFiCBH6Rm5hL32cLcEAArb4=
-github.com/jarcoal/httpmock v1.0.7 h1:d1a2VFpSdm5gtjhCPWsQHSnx8+5V3ms5431YwvmkuNk=
-github.com/jarcoal/httpmock v1.0.7/go.mod h1:ATjnClrvW/3tijVmpL/va5Z3aAyGvqU3gCT8nX0Txik=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jarcoal/httpmock v1.2.0 h1:gSvTxxFR/MEMfsGrvRbdfpRUMBStovlSRLw0Ep1bwwc=
+github.com/jarcoal/httpmock v1.2.0/go.mod h1:oCoTsnAz4+UoOUIf5lJOWV2QQIW5UoeUI6aM2YnWAZk=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
@@ -2677,43 +1692,29 @@ github.com/jeffchao/backoff v0.0.0-20140404060208-9d7fd7aa17f2 h1:mex1izRBCD+7Wj
 github.com/jeffchao/backoff v0.0.0-20140404060208-9d7fd7aa17f2/go.mod h1:xkfESuHriIekR+4RoV+fu91j/CfnYM29Zi2tMFw5iD4=
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f h1:E87tDTVS5W65euzixn7clSzK66puSt1H4I5SC0EmHH4=
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f/go.mod h1:3J2qVK16Lq8V+wfiL2lPeDZ7UWMxk5LemerHa1p6N00=
-github.com/jefferai/jsonx v1.0.0 h1:Xoz0ZbmkpBvED5W9W1B5B/zc3Oiq7oXqiW7iRV3B6EI=
-github.com/jefferai/jsonx v1.0.0/go.mod h1:OGmqmi2tTeI/PS+qQfBDToLHHJIy/RMp24fPo8vFvoQ=
-github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/jhump/gopoet v0.0.0-20190322174617-17282ff210b3/go.mod h1:me9yfT6IJSlOL3FCfrg+L6yzUEZ+5jW6WHt4Sk+UPUI=
-github.com/jhump/gopoet v0.1.0/go.mod h1:me9yfT6IJSlOL3FCfrg+L6yzUEZ+5jW6WHt4Sk+UPUI=
-github.com/jhump/goprotoc v0.5.0/go.mod h1:VrbvcYrQOrTi3i0Vf+m+oqQWk9l72mjkJCYo7UvLHRQ=
-github.com/jhump/protoreflect v1.11.0/go.mod h1:U7aMIjN0NWq9swDP7xDdoMfRHb35uiuTd3Z9nFXJf5E=
-github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
-github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
-github.com/jimlambrt/gldap v0.1.4 h1:PoB5u4ND0E+6W99JtQJvcjGFw+iKi3Gx3M60oOJBOqE=
-github.com/jimlambrt/gldap v0.1.4/go.mod h1:ia/l4Jhm+tdupLvZe7tRCbpv+HyXr1B5QFirsewfWEA=
-github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmespath/go-jmespath v0.0.0-20160803190731-bd40a432e4c7/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
-github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/jefferai/jsonx v1.0.1 h1:GvWkLWihoLqDG0BSP45TUQJH9qsINX50PVrFULgpc/I=
+github.com/jefferai/jsonx v1.0.1/go.mod h1:yFo3l2fcm7cZVHGq3HKLXE+Pd4RWuRjNBDHksM7XekQ=
+github.com/jhump/protoreflect v1.17.0 h1:qOEr613fac2lOuTgWN4tPAtLL7fUSbuJL5X5XumQh94=
+github.com/jhump/protoreflect v1.17.0/go.mod h1:h9+vUUL38jiBzck8ck+6G/aeMX8Z4QUY/NiJPwPNi+8=
+github.com/jimlambrt/gldap v0.1.13 h1:jxmVQn0lfmFbM9jglueoau5LLF/IGRti0SKf0vB753M=
+github.com/jimlambrt/gldap v0.1.13/go.mod h1:nlC30c7xVphjImg6etk7vg7ZewHCCvl1dfAhO3ZJzPg=
 github.com/jmespath/go-jmespath v0.3.0/go.mod h1:9QtRXoHjLGCJ5IBSaohpXITPlowMeeYCZ7fLUTSywik=
-github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 h1:liMMTbpW34dhU4az1GN0pTPADwNmvoRSeoZ6PItiqnY=
+github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
-github.com/joefitzgerald/rainbow-reporter v0.1.0/go.mod h1:481CNgqmVHQZzdIbN52CupLJyoVwB10FQ/IQlF1pdL8=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
-github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
-github.com/josephspurrier/goversioninfo v1.4.0/go.mod h1:JWzv5rKQr+MmW+LvM412ToT/IkYDZjaclF2pKDss8IY=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 h1:hgVxRoDDPtQE68PT4LFvNlPz2nBKd3OMlGKIQ69OmR4=
 github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531/go.mod h1:fqTUQpVYBvhCNIsMXGl2GE9q6z94DIP6NtFKXCSTVbg=
 github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d h1:J8tJzRyiddAFF65YVgxli+TyWBi0f79Sld6rJP6CBcY=
 github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d/go.mod h1:b+Q3v8Yrg5o15d71PSUraUzYb+jWl6wQMSBXSGS/hv0=
-github.com/joyent/triton-go v0.0.0-20180628001255-830d2b111e62/go.mod h1:U+RSyWxWd04xTqnuOQxnai7XGS2PrPY2cfGoDKtMHjA=
 github.com/joyent/triton-go v1.7.1-0.20200416154420-6801d15b779f h1:ENpDacvnr8faw5ugQmEF1QYk+f/Y9lXFvuYmRxykago=
 github.com/joyent/triton-go v1.7.1-0.20200416154420-6801d15b779f/go.mod h1:KDSfL7qe5ZfQqvlDMkVjCztbmcpp/c8M77vhQP8ZPvk=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
-github.com/json-iterator/go v1.1.5/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
-github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -2732,58 +1733,49 @@ github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dv
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
+github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
+github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
-github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/asmfmt v1.3.2 h1:4Ri7ox3EwapiOjCki+hw14RyKk201CN4rzyCJRFLpK4=
 github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE=
-github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
-github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
-github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
 github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
-github.com/klauspost/compress v1.16.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
-github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
-github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I=
-github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
-github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
-github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
-github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
-github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE=
-github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
+github.com/klauspost/cpuid/v2 v2.2.11 h1:0OwqZRYI2rFrjS4kvkDnqJkKHdHaRnCm68/DY4OxRzU=
+github.com/klauspost/cpuid/v2 v2.2.11/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
 github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/leodido/go-urn v1.2.0 h1:hpXL4XnriNwQ/ABnpepYM/1vCLWNDfUNts8dX3xTG6Y=
-github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
+github.com/lestrrat-go/backoff/v2 v2.0.8 h1:oNb5E5isby2kiro9AgdHLv5N5tint1AnDVVf2E2un5A=
 github.com/lestrrat-go/backoff/v2 v2.0.8/go.mod h1:rHP/q/r9aT27n24JQLa7JhSQZCKBBOiM/uP402WwN8Y=
-github.com/lestrrat-go/blackmagic v1.0.0/go.mod h1:TNgH//0vYSs8VXDCfkZLgIrVTTXQELZffUV0tz3MtdQ=
+github.com/lestrrat-go/blackmagic v1.0.2 h1:Cg2gVSc9h7sz9NOByczrbUvLopQmXrfFx//N+AkAr5k=
+github.com/lestrrat-go/blackmagic v1.0.2/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
+github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
 github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
-github.com/lestrrat-go/iter v1.0.1/go.mod h1:zIdgO1mRKhn8l9vrZJZz9TUMMFbQbLeTsbqPDrJ/OJc=
-github.com/lestrrat-go/jwx v1.2.25/go.mod h1:zoNuZymNl5lgdcu6P7K6ie2QRll5HVfF4xwxBBK1NxY=
+github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
+github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
+github.com/lestrrat-go/jwx v1.2.29 h1:QT0utmUJ4/12rmsVQrJ3u55bycPkKqGYuGT4tyRhxSQ=
+github.com/lestrrat-go/jwx v1.2.29/go.mod h1:hU8k2l6WF0ncx20uQdOmik/Gjg6E3/wIRtXSNFeZuB8=
 github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
-github.com/lib/pq v0.0.0-20180327071824-d34b9ff171c2/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
+github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.1/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
@@ -2793,23 +1785,16 @@ github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/linode/linodego v0.7.1 h1:4WZmMpSA2NRwlPZcc0+4Gyn7rr99Evk9bnr0B3gXRKE=
 github.com/linode/linodego v0.7.1/go.mod h1:ga11n3ivecUrPCHN0rANxKmfWBJVkOXfLMZinAbj2sY=
-github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
 github.com/lyft/protoc-gen-star v0.6.1/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
 github.com/lyft/protoc-gen-star/v2 v2.0.1/go.mod h1:RcCdONR2ScXaYnQC5tUzxzlpA3WVYF7/opLeUgcQs/o=
-github.com/lyft/protoc-gen-star/v2 v2.0.3/go.mod h1:amey7yeodaJhXSbf/TlLvWiqQfLOSpEk//mLlc+axEk=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
-github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
-github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
-github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
-github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
+github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
+github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/martini-contrib/render v0.0.0-20150707142108-ec18f8345a11 h1:YFh+sjyJTMQSYjKwM4dFKhJPJC/wfo98tPUc17HdoYw=
 github.com/martini-contrib/render v0.0.0-20150707142108-ec18f8345a11/go.mod h1:Ah2dBMoxZEqk118as2T4u4fjfXarE0pPnMJaArZQZsI=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
@@ -2818,132 +1803,96 @@ github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVc
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-ieproxy v0.0.1 h1:qiyop7gCflfhwCzGyeT0gro3sF9AIg9HU98JORTkqfI=
 github.com/mattn/go-ieproxy v0.0.1/go.mod h1:pYabZ6IHcRpFh7vIaLfK7rdcWgFEb3SFJ6/gNWuh88E=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.3/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
-github.com/mattn/go-shellwords v1.0.6/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
-github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-sqlite3 v1.14.14/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
-github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/matttproud/golang_protobuf_extensions v1.0.2/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
-github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/maxbrunsfeld/counterfeiter/v6 v6.2.2/go.mod h1:eD9eIE7cdwcMi9rYluz88Jz2VyhSmden33/aXg4oVIY=
 github.com/mediocregopher/radix/v4 v4.1.4 h1:Uze6DEbEAvL+VHXUEu/EDBTkUk5CLct5h3nVSGpc6Ts=
 github.com/mediocregopher/radix/v4 v4.1.4/go.mod h1:ajchozX/6ELmydxWeWM6xCFHVpZ4+67LXHOTOVR0nCE=
-github.com/mholt/archiver/v3 v3.5.1 h1:rDjOBX9JSF5BvoJGvjqK479aL70qh9DIpZCl+k7Clwo=
-github.com/mholt/archiver/v3 v3.5.1/go.mod h1:e3dqJ7H78uzsRSEACH1joayhuSyhnonssnDhppzS1L4=
 github.com/michaelklishin/rabbit-hole/v2 v2.12.0 h1:946p6jOYFcVJdtBBX8MwXvuBkpPjwm1Nm2Qg8oX+uFk=
 github.com/michaelklishin/rabbit-hole/v2 v2.12.0/go.mod h1:AN/3zyz7d++OHf+4WUo/LR0+Q5nlPHMaXasIsG/mPY0=
 github.com/microsoft/go-mssqldb v1.5.0 h1:CgENxkwtOBNj3Jg6T1X209y2blCfTTcwuOlznd2k9fk=
 github.com/microsoft/go-mssqldb v1.5.0/go.mod h1:lmWsjHD8XX/Txr0f8ZqgbEZSC+BZjmEQy/Ms+rLrvho=
-github.com/microsoft/kiota-abstractions-go v1.5.6 h1:3hd1sACWB2B9grv8KG1T8g/gGQ4A8kTLv91OUxHSxkE=
-github.com/microsoft/kiota-abstractions-go v1.5.6/go.mod h1:2WX7Oh8V9SAdZ80OGeE53rcbdys54Pd38rAeDUghrpM=
-github.com/microsoft/kiota-authentication-azure-go v1.0.1 h1:F4HH+2QQHSecQg50gVEZaUcxA8/XxCaC2oOMYv2gTIM=
-github.com/microsoft/kiota-authentication-azure-go v1.0.1/go.mod h1:IbifJeoi+sULI0vjnsWYSmDu5atFo/4FZ6WCoAkPjsc=
-github.com/microsoft/kiota-http-go v1.1.1 h1:W4Olo7Z/MwNZCfkcvH/5eLhnn7koRBMMRhLEnf5MPKo=
-github.com/microsoft/kiota-http-go v1.1.1/go.mod h1:QzhhfW5xkoUuT+/ohflpHJvumWeXIxa/Xl0GmQ2M6mY=
-github.com/microsoft/kiota-serialization-form-go v1.0.0 h1:UNdrkMnLFqUCccQZerKjblsyVgifS11b3WCx+eFEsAI=
-github.com/microsoft/kiota-serialization-form-go v1.0.0/go.mod h1:h4mQOO6KVTNciMF6azi1J9QB19ujSw3ULKcSNyXXOMA=
-github.com/microsoft/kiota-serialization-json-go v1.0.5 h1:DKLs/zcRlY+UrcmI8bCprqYeh3UKfbgbzwy/H2elrmM=
-github.com/microsoft/kiota-serialization-json-go v1.0.5/go.mod h1:SgAmhkzRPX1cjnzEWTv988IcBet7wbr4y6y014l5Y1w=
-github.com/microsoft/kiota-serialization-multipart-go v1.0.0 h1:3O5sb5Zj+moLBiJympbXNaeV07K0d46IfuEd5v9+pBs=
-github.com/microsoft/kiota-serialization-multipart-go v1.0.0/go.mod h1:yauLeBTpANk4L03XD985akNysG24SnRJGaveZf+p4so=
-github.com/microsoft/kiota-serialization-text-go v1.0.0 h1:XOaRhAXy+g8ZVpcq7x7a0jlETWnWrEum0RhmbYrTFnA=
-github.com/microsoft/kiota-serialization-text-go v1.0.0/go.mod h1:sM1/C6ecnQ7IquQOGUrUldaO5wj+9+v7G2W3sQ3fy6M=
-github.com/microsoftgraph/msgraph-sdk-go v1.32.0 h1:nWhgHiCYAuctf9j/2S84um23tU1fAg+jBoAF5QefoxE=
-github.com/microsoftgraph/msgraph-sdk-go v1.32.0/go.mod h1:YDj5bLJkl2kMu50iwG5b3PKGmkUsF26Wto5heVGVfNQ=
-github.com/microsoftgraph/msgraph-sdk-go-core v1.0.1 h1:uq4qZD8VXLiNZY0t4NoRpLDoEiNYJvAQK3hc0ZMmdxs=
-github.com/microsoftgraph/msgraph-sdk-go-core v1.0.1/go.mod h1:HUITyuFN556+0QZ/IVfH5K4FyJM7kllV6ExKi2ImKhE=
-github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
-github.com/miekg/dns v1.1.25/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
+github.com/microsoft/kiota-abstractions-go v1.9.3 h1:cqhbqro+VynJ7kObmo7850h3WN2SbvoyhypPn8uJ1SE=
+github.com/microsoft/kiota-abstractions-go v1.9.3/go.mod h1:f06pl3qSyvUHEfVNkiRpXPkafx7khZqQEb71hN/pmuU=
+github.com/microsoft/kiota-authentication-azure-go v1.3.1 h1:AGta92S6IL1E6ZMDb8YYB7NVNTIFUakbtLKUdY5RTuw=
+github.com/microsoft/kiota-authentication-azure-go v1.3.1/go.mod h1:26zylt2/KfKwEWZSnwHaMxaArpbyN/CuzkbotdYXF0g=
+github.com/microsoft/kiota-http-go v1.5.4 h1:wSUmL1J+bTQlAWHjbRkSwr+SPAkMVYeYxxB85Zw0KFs=
+github.com/microsoft/kiota-http-go v1.5.4/go.mod h1:L+5Ri+SzwELnUcNA0cpbFKp/pBbvypLh3Cd1PR6sjx0=
+github.com/microsoft/kiota-serialization-form-go v1.1.2 h1:SD6MATqNw+Dc5beILlsb/D87C36HKC/Zw7l+N9+HY2A=
+github.com/microsoft/kiota-serialization-form-go v1.1.2/go.mod h1:m4tY2JT42jAZmgbqFwPy3zGDF+NPJACuyzmjNXeuHio=
+github.com/microsoft/kiota-serialization-json-go v1.1.2 h1:eJrPWeQ665nbjO0gsHWJ0Bw6V/ZHHU1OfFPaYfRG39k=
+github.com/microsoft/kiota-serialization-json-go v1.1.2/go.mod h1:deaGt7fjZarywyp7TOTiRsjfYiyWxwJJPQZytXwYQn8=
+github.com/microsoft/kiota-serialization-multipart-go v1.1.2 h1:1pUyA1QgIeKslQwbk7/ox1TehjlCUUT3r1f8cNlkvn4=
+github.com/microsoft/kiota-serialization-multipart-go v1.1.2/go.mod h1:j2K7ZyYErloDu7Kuuk993DsvfoP7LPWvAo7rfDpdPio=
+github.com/microsoft/kiota-serialization-text-go v1.1.2 h1:7OfKFlzdjpPygca/+OtqafkEqCWR7+94efUFGC28cLw=
+github.com/microsoft/kiota-serialization-text-go v1.1.2/go.mod h1:QNTcswkBPFY3QVBFmzfk00UMNViKQtV0AQKCrRw5ibM=
+github.com/microsoftgraph/msgraph-sdk-go v1.86.0 h1:kZSIJuRoP9BUD8xsWL6sk82ThsGhZvDonO8waKH5emU=
+github.com/microsoftgraph/msgraph-sdk-go v1.86.0/go.mod h1:h2fx0PGMpIfVX8u5nWTVXmTKTYzIR/uOwZQnX4ixwcM=
+github.com/microsoftgraph/msgraph-sdk-go-core v1.4.0 h1:0SrIoFl7TQnMRrsi5TFaeNe0q8KO5lRzRp4GSCCL2So=
+github.com/microsoftgraph/msgraph-sdk-go-core v1.4.0/go.mod h1:A1iXs+vjsRjzANxF6UeKv2ACExG7fqTwHHbwh1FL+EE=
 github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/miekg/dns v1.1.43 h1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=
-github.com/miekg/dns v1.1.43/go.mod h1:+evo5L0630/F6ca/Z9+GAqzhjGyn8/c+TBaOyfEl0V4=
-github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
-github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/miekg/dns v1.1.50 h1:DQUfb9uc6smULcREF09Uc+/Gd46YWqJd5DbpPE9xkcA=
+github.com/miekg/dns v1.1.50/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
 github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a h1:eU8j/ClY2Ty3qdHnn0TyW3ivFoPC/0F1gQZz8yTxbbE=
 github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a/go.mod h1:v8eSC2SMp9/7FTKUncp7fH9IwPfw+ysMObcEz5FWheQ=
+github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 h1:AMFGa4R4MiIpspGNG7Z948v4n35fFGB3RR3G/ry4FWs=
 github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8/go.mod h1:mC1jAcsrzbxHt8iiaC+zU4b1ylILSosueou12R++wfY=
+github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 h1:+n/aFZefKZp7spd8DFdX7uMikMLXX4oubIzJF4kv/wI=
 github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE=
-github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy5RFepssQM=
-github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
-github.com/mistifyio/go-zfs/v3 v3.0.1/go.mod h1:CzVgeB0RvF2EGzQnytKVvVSDwmKJXxkOTUGbNrTja/k=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
-github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
 github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
-github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
 github.com/mitchellh/hashstructure v1.1.0 h1:P6P1hdjqAAknpY/M1CGipelZgp+4y9ja9kmUZPXP+H0=
 github.com/mitchellh/hashstructure v1.1.0/go.mod h1:xUDAozZz0Wmdiufv0uyhnHkUTN6/6d8ulp4AwfLKrmA=
-github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
-github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
+github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c h1:cqn374mizHuIWj+OSJCajGr/phAmuMug9qIX3l9CflE=
+github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQhoHZAz4x7TIw=
 github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/mndrix/tap-go v0.0.0-20171203230836-629fa407e90b/go.mod h1:pzzDgJWZ34fGzaAZGFW22KVZDfyrYW+QABMrWnJBnSs=
-github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/patternmatcher v0.5.0 h1:YCZgJOeULcxLw1Q+sVR636pmS7sPEn1Qo2iAN6M7DBo=
-github.com/moby/patternmatcher v0.5.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
-github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
-github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
-github.com/moby/sys/mountinfo v0.5.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
-github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
-github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
-github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
-github.com/moby/sys/signal v0.6.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
-github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
-github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
-github.com/moby/sys/symlink v0.2.0/go.mod h1:7uZVF2dqJjG/NsClqul95CqKOBRQyYSNnJ6BMgR/gFs=
-github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg=
-github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU=
-github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
-github.com/moby/term v0.0.0-20201216013528-df9cb8a40635/go.mod h1:FBS0z0QWA44HXygs7VXDUOGoN/1TV3RuWkLO04am3wc=
-github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A=
-github.com/moby/term v0.0.0-20220808134915-39b0c02b01ae/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
+github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
+github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
+github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
 github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -2951,139 +1900,58 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3PzxT8aQXRPkAt8xlV/e7d7w8GM5g0fa5F0D8=
-github.com/mongodb-forks/digest v1.0.5 h1:EJu3wtLZcA0HCvsZpX5yuD193/sW9tHiNvrEM5apXMk=
-github.com/mongodb-forks/digest v1.0.5/go.mod h1:rb+EX8zotClD5Dj4NdgxnJXG9nwrlx3NWKJ8xttz1Dg=
-github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
-github.com/montanaflynn/stats v0.7.0 h1:r3y12KyNxj/Sb/iOE46ws+3mS1+MZca1wlHQFPsY/JU=
-github.com/montanaflynn/stats v0.7.0/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/mongodb-forks/digest v1.1.0 h1:7eUdsR1BtqLv0mdNm4OXs6ddWvR4X2/OsLwdKksrOoc=
+github.com/mongodb-forks/digest v1.1.0/go.mod h1:rb+EX8zotClD5Dj4NdgxnJXG9nwrlx3NWKJ8xttz1Dg=
+github.com/montanaflynn/stats v0.7.1 h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8eaE=
+github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
-github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
-github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
 github.com/mtibben/percent v0.2.1 h1:5gssi8Nqo8QU/r2pynCm+hBQHpkB/uNK7BJCFogWdzs=
 github.com/mtibben/percent v0.2.1/go.mod h1:KG9uO+SZkUp+VkRHsCdYQV3XSZrrSpR3O9ibNBTZrns=
-github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/natefinch/atomic v0.0.0-20150920032501-a62ce929ffcc h1:7xGrl4tTpBQu5Zjll08WupHyq+Sp0Z/adtyf1cfk3Q8=
-github.com/natefinch/atomic v0.0.0-20150920032501-a62ce929ffcc/go.mod h1:1rLVY/DWf3U6vSZgH16S7pymfrhK2lcUlXjgGglw/lY=
+github.com/natefinch/atomic v1.0.1 h1:ZPYKxkqQOx3KZ+RsbnP/YsgvxWQPGxjC0oBt2AhwV0A=
+github.com/natefinch/atomic v1.0.1/go.mod h1:N/D/ELrljoqDyT3rZrsUmtsuzvHkeB/wWjHV22AZRbM=
 github.com/ncw/swift v1.0.47 h1:4DQRPj35Y41WogBxyhOXlrI37nzGlyEcsforeudyYPQ=
 github.com/ncw/swift v1.0.47/go.mod h1:23YIA4yWVnGwv2dQlN4bB7egfYX6YLn0Yo/S6zZO/ZM=
-github.com/networkplumbing/go-nft v0.2.0/go.mod h1:HnnM+tYvlGAsMU7yoYwXEVLLiDW9gdMmb5HoGcwpuQs=
 github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2 h1:BQ1HW7hr4IVovMwWg0E0PYcyW8CzqDcVmaew9cujU4s=
 github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2/go.mod h1:TLb2Sg7HQcgGdloNxkrmtgDNR9uVYF3lfdFIN4Ro6Sk=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/nwaples/rardecode v1.1.0/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
-github.com/nwaples/rardecode v1.1.2 h1:Cj0yZY6T1Zx1R7AhTbyGSALm44/Mmq+BAPc4B/p/d3M=
-github.com/nwaples/rardecode v1.1.2/go.mod h1:5DzqNKiOdpKKBH87u8VlvAnPZMXcGRhxWkRpHbbfGS0=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
 github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
-github.com/okta/okta-sdk-golang/v2 v2.12.1 h1:U+smE7trkHSZO8Mval3Ow85dbxawO+pMAr692VZq9gM=
-github.com/okta/okta-sdk-golang/v2 v2.12.1/go.mod h1:KRoAArk1H216oiRnQT77UN6JAhBOnOWkK27yA1SM7FQ=
-github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
+github.com/okta/okta-sdk-golang/v5 v5.0.2 h1:eecvycE/XDX56IWTsOVhqfj5txCgqryTXzKy7wKEq78=
+github.com/okta/okta-sdk-golang/v5 v5.0.2/go.mod h1:T/vmECtJX33YPZSVD+sorebd8LLhe38Bi/VrFTjgVX0=
 github.com/olekukonko/tablewriter v0.0.0-20180130162743-b8a9be070da4/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
-github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onsi/ginkgo v0.0.0-20151202141238-7f8ab55aaf3b/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
-github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
-github.com/onsi/ginkgo v1.13.0/go.mod h1:+REjRxOmWfHCjfv9TTWB1jD1Frx4XydAD3zm1lskyM0=
-github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
 github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
-github.com/onsi/ginkgo/v2 v2.1.4/go.mod h1:um6tUpWM/cxCK3/FK8BXqEiUMUwRgSM4JXG47RKZmLU=
-github.com/onsi/ginkgo/v2 v2.1.6/go.mod h1:MEH45j8TBi6u9BMogfbp0stKC5cdGjumZj5Y7AG4VIk=
-github.com/onsi/ginkgo/v2 v2.3.0/go.mod h1:Eew0uilEqZmIEZr8JrvYlvOM7Rr6xzTmMV8AyFNU9d0=
-github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
-github.com/onsi/ginkgo/v2 v2.5.0/go.mod h1:Luc4sArBICYCS8THh8v3i3i5CuSZO+RaQRaJoeNwomw=
-github.com/onsi/ginkgo/v2 v2.6.1/go.mod h1:yjiuMwPokqY1XauOgju45q3sJt6VzQ/Fict1LFVcsAo=
-github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
-github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
-github.com/onsi/gomega v0.0.0-20151007035656-2152b45fa28a/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
-github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
-github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
+github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.10.3/go.mod h1:V9xEwhxec5O8UDM77eCW8vLymOMltsqPVYWrpDsH8xc=
 github.com/onsi/gomega v1.15.0/go.mod h1:cIuvLEne0aoVhAgh/O6ac0Op8WWw9H6eYCriF+tEHG0=
 github.com/onsi/gomega v1.16.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
-github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
-github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
-github.com/onsi/gomega v1.20.1/go.mod h1:DtrZpjmvpn2mPm4YWQa0/ALMDj9v4YxLgojwPeREyVo=
-github.com/onsi/gomega v1.21.1/go.mod h1:iYAIXgPSaDHak0LCMA+AWBpIKBr8WZicMxnE8luStNc=
-github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ1tuM=
-github.com/onsi/gomega v1.23.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
-github.com/onsi/gomega v1.24.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
-github.com/onsi/gomega v1.24.1/go.mod h1:3AOiACssS3/MajrniINInwbfOOtfZvplPzuRSmvt1jM=
-github.com/onsi/gomega v1.24.2/go.mod h1:gs3J10IS7Z7r7eXRoNJIrNqU4ToQukCJhFtKrWgHWnk=
-github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
-github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
-github.com/open-policy-agent/opa v0.42.2/go.mod h1:MrmoTi/BsKWT58kXlVayBb+rYVeaMwuBm3nYAN3923s=
-github.com/opencontainers/go-digest v0.0.0-20170106003457-a6d0ee40d420/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
-github.com/opencontainers/go-digest v0.0.0-20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
-github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
-github.com/opencontainers/go-digest v1.0.0-rc1.0.20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
+github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.0.0/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.0.2-0.20211117181255-693428a734f5/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.0.3-0.20211202183452-c5a74bcca799/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.1.0-rc2/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
-github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b h1:YWuSjZCQAPM8UUBLkYUk1e+rZcvWHJmFb6i6rM44Xs8=
-github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
-github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runc v1.0.0-rc93/go.mod h1:3NOsor4w32B2tC0Zbl8Knk4Wg84SM2ImC1fxBuqJ/H0=
-github.com/opencontainers/runc v1.0.2/go.mod h1:aTaHFFwQXuA71CiyxOdFFIorAoemI04suvGRQFzWTD0=
-github.com/opencontainers/runc v1.1.0/go.mod h1:Tj1hFw6eFWp/o33uxGf5yF2BX5yz2Z6iptFpuvbbKqc=
-github.com/opencontainers/runc v1.1.2/go.mod h1:Tj1hFw6eFWp/o33uxGf5yF2BX5yz2Z6iptFpuvbbKqc=
-github.com/opencontainers/runc v1.1.5/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg=
-github.com/opencontainers/runc v1.1.6/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50=
-github.com/opencontainers/runc v1.1.12 h1:BOIssBaW1La0/qbNZHXOOa71dZfZEQOzW7dqQf3phss=
-github.com/opencontainers/runc v1.1.12/go.mod h1:S+lQwSfncpBha7XTy/5lBwWgm5+y5Ma/O44Ekby9FK8=
-github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.2-0.20190207185410-29686dbc5559/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.3-0.20200929063507-e6143ca7d51d/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.0.3-0.20220825212826-86290f6a00fb/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-spec v1.1.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/opencontainers/runtime-tools v0.0.0-20181011054405-1d69bd0f9c39/go.mod h1:r3f7wjNzSs2extwzU3Y+6pKfobzPh+kKFJ3ofN+3nfs=
-github.com/opencontainers/runtime-tools v0.9.0/go.mod h1:r3f7wjNzSs2extwzU3Y+6pKfobzPh+kKFJ3ofN+3nfs=
-github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626/go.mod h1:BRHJJd0E+cx42OybVYSgUvZmU0B8P9gZuRXlZUP7TKI=
-github.com/opencontainers/selinux v1.6.0/go.mod h1:VVGKuOLlE7v4PJyT6h7mNWvq1rzqiriPsEqVhc+svHE=
-github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3ogry1nUQF8Evvo=
-github.com/opencontainers/selinux v1.8.2/go.mod h1:MUIHuUEvKB1wtJjQdOyYRgOnLD2xAPP8dBsCoU0KuF8=
-github.com/opencontainers/selinux v1.9.1/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
-github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
-github.com/opencontainers/selinux v1.10.1/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
-github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/opencontainers/runc v1.2.6 h1:P7Hqg40bsMvQGCS4S7DJYhUZOISMLJOB2iGX5COWiPk=
+github.com/opencontainers/runc v1.2.6/go.mod h1:dOQeFo29xZKBNeRBI0B19mJtfHv68YgCTh1X+YphA+4=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b h1:FfH+VrHHk6Lxt9HdVS0PXzSXFyS2NbZKXv33FYPol0A=
 github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b/go.mod h1:AC62GU6hc0BrNm+9RK9VSiwa/EUe1bkIeFORAMcHvJU=
@@ -3095,8 +1963,8 @@ github.com/oracle/oci-go-sdk/v60 v60.0.0 h1:EJAWjEi4SY5Raha6iUzq4LTQ0uM5YFw/wat/
 github.com/oracle/oci-go-sdk/v60 v60.0.0/go.mod h1:krz+2gkSzlSL/L4PvP0Z9pZpag9HYLNtsMd1PmxlA2w=
 github.com/ory/dockertest v3.3.5+incompatible h1:iLLK6SQwIhcbrG783Dghaaa3WPzGc+4Emza6EbVUUGA=
 github.com/ory/dockertest v3.3.5+incompatible/go.mod h1:1vX4m9wsvi00u5bseYwXaSnhNrne+V0E6LAcBILJdPs=
-github.com/ory/dockertest/v3 v3.10.0 h1:4K3z2VMe8Woe++invjaTB7VRyQXQy5UY+loujO4aNE4=
-github.com/ory/dockertest/v3 v3.10.0/go.mod h1:nr57ZbRWMqfsdGdFNLHz5jjNdDb7VVFnzAeW1n5N1Lg=
+github.com/ory/dockertest/v3 v3.12.0 h1:3oV9d0sDzlSQfHtIaB5k6ghUCVMVLpAY8hwrqoCyRCw=
+github.com/ory/dockertest/v3 v3.12.0/go.mod h1:aKNDTva3cp8dwOWwb9cWuX84aH5akkxXRvO7KCwWVjE=
 github.com/oxtoacart/bpool v0.0.0-20150712133111-4e1c5567d7c2 h1:CXwSGu/LYmbjEab5aMCs5usQRVBGThelUKBNnoSOuso=
 github.com/oxtoacart/bpool v0.0.0-20150712133111-4e1c5567d7c2/go.mod h1:L3UMQOThbttwfYRNFOWLLVXMhk5Lkio4GGOtw5UrxS0=
 github.com/packethost/packngo v0.1.1-0.20180711074735-b9cb5096f54c h1:vwpFWvAO8DeIZfFeqASzZfsxuWPno9ncAebBEP0N3uE=
@@ -3107,41 +1975,33 @@ github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144T
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
-github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
-github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
-github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/peterh/liner v0.0.0-20170211195444-bf27d3ba8e1d/go.mod h1:xIteQHvHuaLYG9IFj6mSxM0fCKrs34IrEQUhOYuGPHc=
-github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5 h1:q2e307iGHPdTGp0hoxKjt1H5pDo6utceo3dQVK3I5XQ=
-github.com/petermattis/goid v0.0.0-20180202154549-b0b1615b78e5/go.mod h1:jvVRKCrJTQWu0XVbaOlby/2lO20uSCHEMzzplHXte1o=
-github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
+github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
+github.com/petermattis/goid v0.0.0-20250721140440-ea1c0173183e h1:D0bJD+4O3G4izvrQUmzCL80zazlN7EwJ0PPDhpJWC/I=
+github.com/petermattis/goid v0.0.0-20250721140440-ea1c0173183e/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2dXMnm1mY=
 github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
 github.com/phpdave11/gofpdi v1.0.13/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
 github.com/pierrec/lz4 v2.6.1+incompatible h1:9UY3+iC23yxF0UfGaYrGplQ+79Rg+h/q9FV9ix19jjM=
 github.com/pierrec/lz4 v2.6.1+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
-github.com/pierrec/lz4/v4 v4.1.2/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pierrec/lz4/v4 v4.1.18 h1:xaKrnTkyoqfh1YItXl56+6KJNVYWlEEPuAQW9xsplYQ=
-github.com/pierrec/lz4/v4 v4.1.18/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pires/go-proxyproto v0.6.1 h1:EBupykFmo22SDjv4fQVQd2J9NOoLPmyZA/15ldOGkPw=
-github.com/pires/go-proxyproto v0.6.1/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY=
-github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
-github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
+github.com/pierrec/lz4/v4 v4.1.22 h1:cKFw6uJDK+/gfw5BcDL0JL5aBsAFdsIT18eRtLj7VIU=
+github.com/pierrec/lz4/v4 v4.1.22/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pires/go-proxyproto v0.8.0 h1:5unRmEAPbHXHuLjDg01CxJWf91cw3lKHc/0xzKpXEe0=
+github.com/pires/go-proxyproto v0.8.0/go.mod h1:iknsfgnH8EkjrMeMyvfKByp9TiBZCKZM0jx2xmKqnVY=
+github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
+github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
-github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
-github.com/platinummonkey/go-concurrency-limits v0.7.0 h1:Bl9E74+67BrlRLBeryHOaFy0e1L3zD9g436/3vo6akQ=
-github.com/platinummonkey/go-concurrency-limits v0.7.0/go.mod h1:Xxr6BywMVH3QyLyd0PanLnkkkmByTTPET3azMpdfmng=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -3150,70 +2010,46 @@ github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXq
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
-github.com/pquerna/cachecontrol v0.1.0 h1:yJMy84ti9h/+OEWa752kBTKv4XC30OtVVHYv/8cTqKc=
-github.com/pquerna/cachecontrol v0.1.0/go.mod h1:NrUG3Z7Rdu85UNR3vm7SOsl1nFIeSiQnrHV5K9mBcUI=
 github.com/pquerna/otp v1.2.1-0.20191009055518-468c2dd2b58d h1:PinQItctnaL2LtkaSM678+ZLLy5TajwOeXzWvYC7tII=
 github.com/pquerna/otp v1.2.1-0.20191009055518-468c2dd2b58d/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
-github.com/prometheus/client_golang v0.0.0-20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.2/go.mod h1:OsXs2jCmiKlQ1lTBmv21f2mNfw4xf/QclQDMrYNZzcM=
 github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
-github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
-github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
-github.com/prometheus/client_golang v1.12.2/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
-github.com/prometheus/client_golang v1.13.0/go.mod h1:vTeo+zgvILHsnnj/39Ou/1fPN5nJFOEMgftOUOmlvYQ=
-github.com/prometheus/client_golang v1.14.0 h1:nJdhIvne2eSX/XRAFV9PcvFFRbrjbcTUj0VP62TMhnw=
-github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y=
-github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
+github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
-github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY=
-github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
-github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
-github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.30.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
-github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
-github.com/prometheus/common v0.37.0 h1:ccBbHCgIiT9uSoFY0vX8H3zsNR5eLt17/RQLUvn8pXE=
-github.com/prometheus/common v0.37.0/go.mod h1:phzohg0JFMnBEFGxTDbfu3QyL5GI8gTQJFhYO5B3mfA=
-github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
+github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.0-20190522114515-bc1a522cf7b1/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
-github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
-github.com/prometheus/procfs v0.0.5/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.8.0 h1:ODq8ZFEaYeCaZOJlZZdJA2AbQR98dSHSM1KW/You5mo=
-github.com/prometheus/procfs v0.8.0/go.mod h1:z7EfXMXOkbkqb9IINtpCn86r/to3BnA0uaxHdg830/4=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
-github.com/rboyer/safeio v0.2.1 h1:05xhhdRNAdS3apYm7JRjOqngf4xruaW959jmRxGDuSU=
-github.com/rboyer/safeio v0.2.1/go.mod h1:Cq/cEPK+YXFn622lsQ0K4KsPZSPtaptHHEldsy7Fmig=
-github.com/rcrowley/go-metrics v0.0.0-20180503174638-e2704e165165/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
-github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/rboyer/safeio v0.2.3 h1:gUybicx1kp8nuM4vO0GA5xTBX58/OBd8MQuErBfDxP8=
+github.com/rboyer/safeio v0.2.3/go.mod h1:d7RMmt7utQBJZ4B7f0H/cU/EdZibQAU1Y8NWepK2dS8=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/renier/xmlrpc v0.0.0-20170708154548-ce4a1a486c03 h1:Wdi9nwnhFNAlseAOekn6B5G/+GMtks9UKbvRU/CMM/o=
 github.com/renier/xmlrpc v0.0.0-20170708154548-ce4a1a486c03/go.mod h1:gRAiPF5C5Nd0eyyRdqIu9qTiFSoZzpTq727b5B8fkkU=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
@@ -3222,133 +2058,97 @@ github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6So
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.8.1/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4nPKWu0nJ5d+o=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
-github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
-github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
 github.com/rs/zerolog v1.4.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
 github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
 github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
 github.com/russross/blackfriday v1.5.2/go.mod h1:JO/DiYxRf+HjHt06OyowR9PTA263kcR/rfWxYHBV53g=
-github.com/russross/blackfriday v1.6.0/go.mod h1:ti0ldHuxg49ri4ksnFxlkCfN+hvslNlmVHqNRXXJNAY=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w=
 github.com/ruudk/golang-pdf417 v0.0.0-20201230142125-a7e3863a1245/go.mod h1:pQAZKsJ8yyVxGRWYNEm9oFB8ieLgKFnamEyDmSA0BRk=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/columnize v2.1.2+incompatible h1:C89EOx/XBWwIXl8wm8OPJBd7kPF25UfsK2X7Ph/zCAk=
 github.com/ryanuber/columnize v2.1.2+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
-github.com/safchain/ethtool v0.0.0-20210803160452-9aa261dae9b1/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
-github.com/safchain/ethtool v0.2.0/go.mod h1:WkKB1DnNtvsMlDmQ50sgwowDJV/hGbJSOvJoEXs1AJQ=
-github.com/sasha-s/go-deadlock v0.2.0 h1:lMqc+fUb7RrFS3gQLtoQsJ7/6TV/pAIFvBsqX73DK8Y=
-github.com/sasha-s/go-deadlock v0.2.0/go.mod h1:StQn567HiB1fF2yJ44N9au7wOhrPS3iZqiDbRupzT10=
+github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb2NsU=
+github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=
 github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/sclevine/agouti v3.0.0+incompatible/go.mod h1:b4WX9W9L1sfQKXeJf1mUTLZKJ48R1S7H23Ji7oFO5Bw=
-github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
 github.com/sean-/conswriter v0.0.0-20180208195008-f5ae3917a627/go.mod h1:7zjs06qF79/FKAJpBvFx3P8Ww4UTIMAe+lpNXDHziac=
 github.com/sean-/pager v0.0.0-20180208200047-666be9bf53b5/go.mod h1:BeybITEsBEg6qbIiqJ6/Bqeq25bCLbL7YFmpaFfJDuM=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUtVbo7ada43DJhG55ua/hjS5I=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
-github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
-github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/segmentio/fasthash v1.0.3 h1:EI9+KE1EwvMLBWwjpRDc+fEM+prwxDYbslddQGtrmhM=
 github.com/segmentio/fasthash v1.0.3/go.mod h1:waKX8l2N8yckOgmSsXJi7x1ZfdKZ4x7KRMzBtS3oedY=
-github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
-github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/sethvargo/go-limiter v0.7.1 h1:wWNhTj0pxjyJ7wuJHpRJpYwJn+bUnjYfw2a85eu5w9U=
 github.com/sethvargo/go-limiter v0.7.1/go.mod h1:C0kbSFbiriE5k2FFOe18M1YZbAR2Fiwf72uGu0CXCcU=
 github.com/shirou/gopsutil/v3 v3.22.6 h1:FnHOFOh+cYAM0C30P+zysPISzlknLC5Z1G4EAElznfQ=
 github.com/shirou/gopsutil/v3 v3.22.6/go.mod h1:EdIubSnZhbAvBS1yJ7Xi+AShB/hxwLHOMz4MCYz7yMs=
+github.com/shirou/gopsutil/v4 v4.25.1 h1:QSWkTc+fu9LTAWfkZwZ6j8MSUk4A2LV7rbH0ZqmLjXs=
+github.com/shirou/gopsutil/v4 v4.25.1/go.mod h1:RoUCUpndaJFtT+2zsZzzmhvbfGoDCJ7nFXKJf8GqJbI=
 github.com/shoenig/test v1.7.0 h1:eWcHtTXa6QLnBvm0jgEabMRN/uJ4DMV3M8xUGgRkZmk=
 github.com/shoenig/test v1.7.0/go.mod h1:UxJ6u/x2v/TNs/LoLxBNJRV9DiwBBKYxXSyczsBHFoI=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
-github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
-github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
-github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
+github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
+github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.2.1 h1:SHWdIUa82uGZz+F+47k8SY4QhhI291cXCpopT1lK2AQ=
-github.com/skeema/knownhosts v1.2.1/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
+github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
+github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a h1:pa8hGb/2YqsZKovtsgrwcDH1RZhVbTKCjLp47XpqCDs=
 github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
-github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/snowflakedb/gosnowflake v1.7.2 h1:HRSwva8YXC64WUppfmHcMNVVzSE1+EwXXaJxgS0EkTo=
-github.com/snowflakedb/gosnowflake v1.7.2/go.mod h1:03tW856vc3ceM4rJuj7KO4dzqN7qoezTm+xw7aPIIFo=
+github.com/snowflakedb/gosnowflake v1.17.0 h1:be50vC0buiOitvneyRHiqNkvPMcunGD3EcTnL2zYATg=
+github.com/snowflakedb/gosnowflake v1.17.0/go.mod h1:TaHvQGh9MA2lopZZMm1AvvENDfwcnKtuskIr1e6Fpic=
 github.com/softlayer/softlayer-go v0.0.0-20180806151055-260589d94c7d h1:bVQRCxQvfjNUeRqaY/uT0tFuvuFY0ulgnczuR684Xic=
 github.com/softlayer/softlayer-go v0.0.0-20180806151055-260589d94c7d/go.mod h1:Cw4GTlQccdRGSEf6KiMju767x0NEHE0YIVPJSaXjlsw=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
-github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/sony/gobreaker v0.4.2-0.20210216022020-dd874f9dd33b/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
 github.com/sony/gobreaker v0.5.0 h1:dRCvqm0P490vZPmy7ppEk2qCnCieBooFJ+YoXGYB+yg=
 github.com/sony/gobreaker v0.5.0/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
 github.com/spf13/afero v1.2.1/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
-github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
 github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
 github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/afero v1.9.2/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
-github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
-github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
+github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
-github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
-github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
-github.com/spf13/cobra v1.4.0/go.mod h1:Wo4iy3BUC+X2Fybo0PDqwJIv3dNRiZLHQymsfxlB84g=
-github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM=
-github.com/spf13/cobra v1.6.0/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
-github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
-github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
 github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
-github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
-github.com/std-uritemplate/std-uritemplate/go v0.0.50 h1:LAE6WYRmLlDXPtEzr152BnD/MHxGCKmcp5D2Pw0NvmU=
-github.com/std-uritemplate/std-uritemplate/go v0.0.50/go.mod h1:CLZ1543WRCuUQQjK0BvPM4QrG2toY8xNZUm8Vbt7vTc=
-github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980/go.mod h1:AO3tvPzVZ/ayst6UlUKUv6rcPQInYe3IknH3jYhAKu8=
-github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
+github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
+github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
+github.com/std-uritemplate/std-uritemplate/go/v2 v2.0.3 h1:7hth9376EoQEd1hH4lAp3vnaLP2UMyxuMMghLKzDHyU=
+github.com/std-uritemplate/std-uritemplate/go/v2 v2.0.3/go.mod h1:Z5KcoM0YLC7INlNhEezeIZ0TZNYf7WSNO0Lvah4DSeQ=
 github.com/streadway/amqp v1.0.0 h1:kuuDrUJFZL1QYL9hUNuCxNObNzB0bV/ZG5jV3RWAQgo=
 github.com/streadway/amqp v1.0.0/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
-github.com/stretchr/objx v0.0.0-20180129172003-8a3f7159479f/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v0.0.0-20180303142811-b89eecf5ca5d/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -3362,27 +2162,28 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
-github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/tchap/go-patricia v2.2.6+incompatible/go.mod h1:bmLyhP68RS6kStMGxByiQ23RP/odRBOTVjwp2cDyi6I=
-github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tencentcloud/tencentcloud-sdk-go v1.0.162 h1:8fDzz4GuVg4skjY2B0nMN7h6uN61EDVkuLyI2+qGHhI=
 github.com/tencentcloud/tencentcloud-sdk-go v1.0.162/go.mod h1:asUz5BPXxgoPGaRgZaVm1iGcUAuHyYUo1nXqKa83cvI=
-github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/testcontainers/testcontainers-go v0.37.0 h1:L2Qc0vkTw2EHWQ08djon0D2uw7Z/PtHS/QzZZ5Ra/hg=
+github.com/testcontainers/testcontainers-go v0.37.0/go.mod h1:QPzbxZhQ6Bclip9igjLFj6z0hs01bU8lrl2dHQmgFGM=
+github.com/testcontainers/testcontainers-go/modules/postgres v0.37.0 h1:hsVwFkS6s+79MbKEO+W7A1wNIw1fmkMtF4fg83m6kbc=
+github.com/testcontainers/testcontainers-go/modules/postgres v0.37.0/go.mod h1:Qj/eGbRbO/rEYdcRLmN+bEojzatP/+NS1y8ojl2PQsc=
 github.com/tilinna/clock v1.0.2/go.mod h1:ZsP7BcY7sEEz7ktc0IVy8Us6boDrK8VradlKRUGfOao=
 github.com/tilinna/clock v1.1.0 h1:6IQQQCo6KoBxVudv6gwtY8o4eDfhHo8ojA5dP0MfhSs=
 github.com/tilinna/clock v1.1.0/go.mod h1:ZsP7BcY7sEEz7ktc0IVy8Us6boDrK8VradlKRUGfOao=
-github.com/tklauser/go-sysconf v0.3.10 h1:IJ1AZGZRWbY8T5Vfk04D9WOA5WSejdflXxP03OUqALw=
+github.com/tink-crypto/tink-go/v2 v2.4.0 h1:8VPZeZI4EeZ8P/vB6SIkhlStrJfivTJn+cQ4dtyHNh0=
+github.com/tink-crypto/tink-go/v2 v2.4.0/go.mod h1:l//evrF2Y3MjdbpNDNGnKgCpo5zSmvUvnQ4MU+yE2sw=
 github.com/tklauser/go-sysconf v0.3.10/go.mod h1:C8XykCvCb+Gn0oNCWPIlcb0RuglQTYaQ2hGm7jmxEFk=
-github.com/tklauser/numcpus v0.4.0 h1:E53Dm1HjH1/R2/aoCtXtPgzmElmn51aOkhCFSuZq//o=
+github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
+github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.4.0/go.mod h1:1+UI3pD8NW14VMwdgJNJ1ESk2UnwhAnz5hMwiKKqXCQ=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
+github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
-github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/tv42/httpunix v0.0.0-20191220191345-2ba4b9c3382c h1:u6SKchux2yDvFQnDHS3lPnIRmfVJ5Sxy3ao2SIdysLQ=
 github.com/tv42/httpunix v0.0.0-20191220191345-2ba4b9c3382c/go.mod h1:hzIxponao9Kjc7aWznkXaL4U4TWaDSs8zcsY4Ka08nM=
@@ -3391,47 +2192,17 @@ github.com/uber/jaeger-client-go v2.30.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMW
 github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVKhn2Um6rjCsSsg=
 github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
-github.com/ugorji/go v1.1.7 h1:/68gy2h+1mWMrwZFeD1kQialdSzAb432dtpeJ42ovdo=
-github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
-github.com/ugorji/go/codec v1.1.7 h1:2SvQaVZ1ouYrrKKwoSk2pzd4A9evlKJb9oTL+OaLUSs=
-github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
-github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.10 h1:t92gobL9l3HE202wg3rlk19F6X+JOxl9BBrCCMYEYd8=
-github.com/ulikunitz/xz v0.5.10/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
-github.com/urfave/cli v1.19.1/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
-github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
-github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/urfave/cli v1.22.4/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/urfave/cli v1.22.12/go.mod h1:sSBEIC79qR6OvcmsD4U3KABeOTxDqQtdDnaFuUN30b8=
-github.com/vbatts/tar-split v0.11.2/go.mod h1:vV3ZuO2yWSVsz+pfFzDG/upWH1JhjOiEaWq6kXyQ3VI=
-github.com/vektah/gqlparser/v2 v2.4.5/go.mod h1:flJWIR04IMQPGz+BXLrORkrARBxv/rtyIAFvd/MceW0=
-github.com/veraison/go-cose v1.0.0-rc.1/go.mod h1:7ziE85vSq4ScFTg6wyoMXjucIGOf4JkFEZi/an96Ct4=
-github.com/vishvananda/netlink v0.0.0-20181108222139-023a6dafdcdf/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
-github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
-github.com/vishvananda/netlink v1.1.1-0.20201029203352-d40f9887b852/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
-github.com/vishvananda/netlink v1.1.1-0.20210330154013-f5de75959ad5/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
-github.com/vishvananda/netlink v1.2.1-beta.2/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
-github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
-github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
-github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
 github.com/vmware/govmomi v0.18.0 h1:f7QxSmP7meCtoAmiKZogvVbLInT+CZx6Px6K5rYsJZo=
 github.com/vmware/govmomi v0.18.0/go.mod h1:URlwyTFZX72RmxtxuaFL2Uj3fD1JTvZdx59bHWk6aFU=
-github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
-github.com/willf/bitset v1.1.11/go.mod h1:83CECat5yLh5zVOf4P1ErAgKA5UDvKtgyUABdr3+MjI=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
 github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
-github.com/xdg-go/scram v1.1.1/go.mod h1:RaEWvsqvNKKvBPvcKeFjrG2cJqOkHTiyTpzz23ni57g=
 github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
 github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
-github.com/xdg-go/stringprep v1.0.3/go.mod h1:W3f5j4i+9rC0kuIEJL0ky1VpHXQU3ocBgklLGvcBnW8=
 github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
 github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
 github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
@@ -3439,16 +2210,14 @@ github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMc
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
-github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
-github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo=
-github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
-github.com/yashtewari/glob-intersection v0.1.0/go.mod h1:LK7pIC3piUjovexikBbJ26Yml7g8xa5bsjfx2v1fwok=
-github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d h1:splanxYIlg+5LfHAM6xpdFEAYOk8iySO56hMFq6uLyA=
-github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
+github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
+github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -3459,53 +2228,33 @@ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5t
 github.com/yuin/gopher-lua v0.0.0-20200816102855-ee81675732da/go.mod h1:E1AXubJBdNmFERAOucpDIxNzeGfLzg0mYh+UfMWdChA=
 github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9 h1:k/gmLsJDWwWqbLCur2yWnJzwQEKRcAHXo6seXGuSwWw=
 github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9/go.mod h1:E1AXubJBdNmFERAOucpDIxNzeGfLzg0mYh+UfMWdChA=
-github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
 github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
-github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
-github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
-github.com/zclconf/go-cty v1.12.1 h1:PcupnljUm9EIvbgSHQnHhUr3fO6oFmkOrvs2BAFNXXY=
-github.com/zclconf/go-cty v1.12.1/go.mod h1:s9IfD1LK5ccNMSWCVFCE2rJfHiZgi7JijgeWIMfhLvA=
+github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
+github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+github.com/zclconf/go-cty v1.15.0 h1:tTCRWxsexYUmtt/wVxgDClUe+uQusuI443uL6e+5sXQ=
+github.com/zclconf/go-cty v1.15.0/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
 github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
 github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
 github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
-go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
-go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
-go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
-go.etcd.io/bbolt v1.3.7 h1:j+zJOnnEjF/kyHlDDgGnVL/AIqIJPq8UoB2GSNfkUfQ=
-go.etcd.io/bbolt v1.3.7/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
-go.etcd.io/etcd v0.5.0-alpha.5.0.20200910180754-dd1b699fc489/go.mod h1:yVHk9ub3CSBatqGNg7GRmsnfLWtoW60w4eDYfh7vHDg=
-go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
-go.etcd.io/etcd/api/v3 v3.5.5/go.mod h1:KFtNaxGDw4Yx/BA4iPPwevUTAuqcsPxzyX8PHydchN8=
-go.etcd.io/etcd/api/v3 v3.5.7 h1:sbcmosSVesNrWOJ58ZQFitHMdncusIifYcrBfwrlJSY=
-go.etcd.io/etcd/api/v3 v3.5.7/go.mod h1:9qew1gCdDDLu+VwmeG+iFpL+QlpHTo7iubavdVDgCAA=
-go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
-go.etcd.io/etcd/client/pkg/v3 v3.5.5/go.mod h1:ggrwbk069qxpKPq8/FKkQ3Xq9y39kbFR4LnKszpRXeQ=
-go.etcd.io/etcd/client/pkg/v3 v3.5.7 h1:y3kf5Gbp4e4q7egZdn5T7W9TSHUvkClN6u+Rq9mEOmg=
-go.etcd.io/etcd/client/pkg/v3 v3.5.7/go.mod h1:o0Abi1MK86iad3YrWhgUsbGx1pmTS+hrORWc2CamuhY=
-go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ=
-go.etcd.io/etcd/client/v2 v2.305.5 h1:DktRP60//JJpnPC0VBymAN/7V71GHMdjDCBt4ZPXDjI=
-go.etcd.io/etcd/client/v2 v2.305.5/go.mod h1:zQjKllfqfBVyVStbt4FaosoX2iYd8fV/GRy/PbowgP4=
-go.etcd.io/etcd/client/v3 v3.5.0/go.mod h1:AIKXXVX/DQXtfTEqBryiLTUXwON+GuvO6Z7lLS/oTh0=
-go.etcd.io/etcd/client/v3 v3.5.5/go.mod h1:aApjR4WGlSumpnJ2kloS75h6aHUmAyaPLjHMxpc7E7c=
-go.etcd.io/etcd/client/v3 v3.5.7 h1:u/OhpiuCgYY8awOHlhIhmGIGpxfBU/GZBUP3m/3/Iz4=
-go.etcd.io/etcd/client/v3 v3.5.7/go.mod h1:sOWmj9DZUMyAngS7QQwCyAXXAL6WhgTOPLNS/NabQgw=
-go.etcd.io/etcd/pkg/v3 v3.5.0/go.mod h1:UzJGatBQ1lXChBkQF0AuAtkRQMYnHubxAEYIrC3MSsE=
-go.etcd.io/etcd/pkg/v3 v3.5.5/go.mod h1:6ksYFxttiUGzC2uxyqiyOEvhAiD0tuIqSZkX3TyPdaE=
-go.etcd.io/etcd/raft/v3 v3.5.0/go.mod h1:UFOHSIvO/nKwd4lhkwabrTD3cqW5yVyYYf/KlD00Szc=
-go.etcd.io/etcd/raft/v3 v3.5.5/go.mod h1:76TA48q03g1y1VpTue92jZLr9lIHKUNcYdZOOGyx8rI=
-go.etcd.io/etcd/server/v3 v3.5.0/go.mod h1:3Ah5ruV+M+7RZr0+Y/5mNLwC+eQlni+mQmOVdCRJoS4=
-go.etcd.io/etcd/server/v3 v3.5.5/go.mod h1:rZ95vDw/jrvsbj9XpTqPrTAB9/kzchVdhRirySPkUBc=
-go.etcd.io/gofail v0.1.0/go.mod h1:VZBCXYGZhHAinaBiiqYvuDynvahNsAyLFwB3kEHKz1M=
-go.mongodb.org/atlas v0.36.0 h1:m05S3AO7zkl+bcG1qaNsEKBnAqnKx2FDwLooHpIG3j4=
-go.mongodb.org/atlas v0.36.0/go.mod h1:nfPldE9dSama6G2IbIzmEza02Ly7yFZjMMVscaM0uEc=
-go.mongodb.org/mongo-driver v1.10.0/go.mod h1:wsihk0Kdgv8Kqu1Anit4sfK+22vSFbUrAVEYRhCXrA8=
-go.mongodb.org/mongo-driver v1.13.1 h1:YIc7HTYsKndGK4RFzJ3covLz1byri52x0IoMB0Pt/vk=
-go.mongodb.org/mongo-driver v1.13.1/go.mod h1:wcDf1JBCXy2mOW0bWHwO/IOYqdca1MPCwDtFu/Z9+eo=
-go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
+go.etcd.io/bbolt v1.4.0 h1:TU77id3TnN/zKr7CO/uk+fBCwF2jGcMuw2B/FMAzYIk=
+go.etcd.io/bbolt v1.4.0/go.mod h1:AsD+OCi/qPN1giOX1aiLAha3o1U8rAz65bvN4j0sRuk=
+go.etcd.io/etcd/api/v3 v3.6.0 h1:vdbkcUBGLf1vfopoGE/uS3Nv0KPyIpUV/HM6w9yx2kM=
+go.etcd.io/etcd/api/v3 v3.6.0/go.mod h1:Wt5yZqEmxgTNJGHob7mTVBJDZNXiHPtXTcPab37iFOw=
+go.etcd.io/etcd/client/pkg/v3 v3.6.0 h1:nchnPqpuxvv3UuGGHaz0DQKYi5EIW5wOYsgUNRc365k=
+go.etcd.io/etcd/client/pkg/v3 v3.6.0/go.mod h1:Jv5SFWMnGvIBn8o3OaBq/PnT0jjsX8iNokAUessNjoA=
+go.etcd.io/etcd/client/v2 v2.305.17 h1:ajFukQfI//xY5VuSeuUw4TJ4WnNR2kAFfV/P0pDdPMs=
+go.etcd.io/etcd/client/v2 v2.305.17/go.mod h1:EttKgEgvwikmXN+b7pkEWxDZr6sEaYsqCiS3k4fa/Vg=
+go.etcd.io/etcd/client/v3 v3.6.0 h1:/yjKzD+HW5v/3DVj9tpwFxzNbu8hjcKID183ug9duWk=
+go.etcd.io/etcd/client/v3 v3.6.0/go.mod h1:Jzk/Knqe06pkOZPHXsQ0+vNDvMQrgIqJ0W8DwPdMJMg=
+go.mongodb.org/atlas v0.38.0 h1:zfwymq20GqivGwxPZfypfUDry+WwMGVui97z1d8V4bU=
+go.mongodb.org/atlas v0.38.0/go.mod h1:DJYtM+vsEpPEMSkQzJnFHrT0sP7ev6cseZc/GGjJYG8=
+go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
+go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -3515,83 +2264,35 @@ go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/contrib v0.20.0/go.mod h1:G/EtFaa6qaN7+LxqfIAT3GiZa7Wv5DTBUzl5H4LY0Kc=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.25.0/go.mod h1:E5NNboN0UqSAki0Atn9kVwaN7I+l25gGxDqBueo/74E=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0/go.mod h1:vEhqr0m4eTc+DWxfsXoXue2GBgV2uUwVznkGIHW/e5w=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.35.0/go.mod h1:h8TWwRAhQpOd0aM5nYsRD8+flnkj+526GEIVlarH7eY=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.45.0/go.mod h1:vsh3ySueQCiKPxFLvjWC4Z135gIa34TQ/NSqkDTZYUM=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 h1:UNQQKPfTDe1J81ViolILjTKPr9WetKW6uei2hFgJmFs=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0/go.mod h1:r9vWsPS/3AQItv3OSlEJ/E4mbrhUbbw18meOjArPtKQ=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0/go.mod h1:2AboqHi0CiIZU0qwhtUfCYD1GeUzvvIXWNkhDt7ZMG4=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.32.0/go.mod h1:5eCOqeGphOyz6TsY3ZDNjE33SM/TFAK3RGuCL2naTgY=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.35.0/go.mod h1:9NiG9I2aHTKkcxqCILhjtyNA1QEiCjdBACv4IvrFQ+c=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0/go.mod h1:62CPTSry9QZtOaSsE3tOzhx6LzDhHnXJ6xHeMNNiM6Q=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 h1:sv9kVfal0MK0wBMCOGr+HeJm9v803BkJxGrk2au7j08=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0/go.mod h1:SK2UL73Zy1quvRPonmOmRDiWk1KBV3LyIeeIxcEApWw=
-go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo=
-go.opentelemetry.io/otel v1.0.1/go.mod h1:OPEOD4jIT2SlZPMmwT6FqZz2C0ZNdQqiWcoK6M0SNFU=
-go.opentelemetry.io/otel v1.3.0/go.mod h1:PWIKzi6JCp7sM0k9yZ43VX+T345uNbAkDKwHVjb2PTs=
-go.opentelemetry.io/otel v1.7.0/go.mod h1:5BdUoMIz5WEs0vt0CUEMtSSaTSHBBVwrhnz7+nrD5xk=
-go.opentelemetry.io/otel v1.8.0/go.mod h1:2pkj+iMj0o03Y+cW6/m8Y4WkRdYN3AvCXCnzRMp9yvM=
-go.opentelemetry.io/otel v1.10.0/go.mod h1:NbvWjCthWHKBEUMpf0/v8ZRZlni86PpGFEMA9pnQSnQ=
-go.opentelemetry.io/otel v1.19.0/go.mod h1:i0QyjOq3UPoTzff0PJB2N66fb4S0+rSbSB15/oyH9fY=
-go.opentelemetry.io/otel v1.23.1 h1:Za4UzOqJYS+MUczKI320AtqZHZb7EqxO00jAHE0jmQY=
-go.opentelemetry.io/otel v1.23.1/go.mod h1:Td0134eafDLcTS4y+zQ26GE8u3dEuRBiBCTUIRHaikA=
-go.opentelemetry.io/otel/exporters/otlp v0.20.0 h1:PTNgq9MRmQqqJY0REVbZFvwkYOA85vbdQU/nVfxDyqg=
-go.opentelemetry.io/otel/exporters/otlp v0.20.0/go.mod h1:YIieizyaN77rtLJra0buKiNBOm9XQfkPEKBeuhoMwAM=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.3.0/go.mod h1:VpP4/RMn8bv8gNo9uK7/IMY4mtWLELsS+JIP0inH0h4=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.7.0/go.mod h1:M1hVZHNxcbkAlcvrOMlpQ4YOO3Awf+4N2dxkZL3xm04=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.10.0/go.mod h1:78XhIg8Ht9vR4tbLNUhXsiOnE2HOuSeKAiAcoVQEpOY=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.0.1/go.mod h1:Kv8liBeVNFkkkbilbgWRpV+wWuu+H5xdOT6HAgd30iw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.3.0/go.mod h1:hO1KLR7jcKaDDKDkvI9dP/FIhpmna5lkqPUQdEjFAM8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.7.0/go.mod h1:ceUgdyfNv4h4gLxHR0WNfDiiVmZFodZhZSbOLhpxqXE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.10.0/go.mod h1:Krqnjl22jUJ0HgMzw5eveuCvFDXY4nSYb4F8t5gdrag=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.0.1/go.mod h1:xOvWoTOrQjxjW61xtOmD/WKGRYb/P4NzRo3bs65U6Rk=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.3.0/go.mod h1:keUU7UfnwWTWpJ+FWnyqmogPa82nuU5VUANFq49hlMY=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.7.0/go.mod h1:E+/KKhwOSw8yoPxSSuUHG6vKppkvhN+S1Jc7Nib3k3o=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.10.0/go.mod h1:OfUCyyIiDvNXHWpcWgbF+MWvqPZiNa3YDEnivcnYsV0=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0/go.mod h1:0+KuTDyKL4gjKCF75pHOX4wuzYDUZYfAQdSu43o+Z2I=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.3.0/go.mod h1:QNX1aly8ehqqX1LEa6YniTU7VY9I6R3X/oPxhGdTceE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.22.0 h1:FyjCyI9jVEfqhUh2MoSkmolPjfh5fp2hnV0b0irxH4Q=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.22.0/go.mod h1:hYwym2nDEeZfG/motx0p7L7J1N1vyzIThemQsb4g2qY=
-go.opentelemetry.io/otel/metric v0.20.0/go.mod h1:598I5tYlH1vzBjn+BTuhzTCSb/9debfNp6R3s7Pr1eU=
-go.opentelemetry.io/otel/metric v0.30.0/go.mod h1:/ShZ7+TS4dHzDFmfi1kSXMhMVubNoP0oIaBp70J6UXU=
-go.opentelemetry.io/otel/metric v0.31.0/go.mod h1:ohmwj9KTSIeBnDBm/ZwH2PSZxZzoOaG2xZeekTRzL5A=
-go.opentelemetry.io/otel/metric v1.19.0/go.mod h1:L5rUsV9kM1IxCj1MmSdS+JQAcVm319EUrDVLrt7jqt8=
-go.opentelemetry.io/otel/metric v1.23.1 h1:PQJmqJ9u2QaJLBOELl1cxIdPcpbwzbkjfEyelTl2rlo=
-go.opentelemetry.io/otel/metric v1.23.1/go.mod h1:mpG2QPlAfnK8yNhNJAxDZruU9Y1/HubbC+KyH8FaCWI=
-go.opentelemetry.io/otel/oteltest v0.20.0/go.mod h1:L7bgKf9ZB7qCwT9Up7i9/pn0PWIa9FqQ2IQ8LoxiGnw=
-go.opentelemetry.io/otel/sdk v0.20.0/go.mod h1:g/IcepuwNsoiX5Byy2nNV0ySUF1em498m7hBWC279Yc=
-go.opentelemetry.io/otel/sdk v1.0.1/go.mod h1:HrdXne+BiwsOHYYkBE5ysIcv2bvdZstxzmCQhxTcZkI=
-go.opentelemetry.io/otel/sdk v1.3.0/go.mod h1:rIo4suHNhQwBIPg9axF8V9CA72Wz2mKF1teNrup8yzs=
-go.opentelemetry.io/otel/sdk v1.7.0/go.mod h1:uTEOTwaqIVuTGiJN7ii13Ibp75wJmYUDe374q6cZwUU=
-go.opentelemetry.io/otel/sdk v1.10.0/go.mod h1:vO06iKzD5baltJz1zarxMCNHFpUlUiOy4s65ECtn6kE=
-go.opentelemetry.io/otel/sdk v1.19.0/go.mod h1:NedEbbS4w3C6zElbLdPJKOpJQOrGUJ+GfzpjUvI0v1A=
-go.opentelemetry.io/otel/sdk v1.23.1 h1:O7JmZw0h76if63LQdsBMKQDWNb5oEcOThG9IrxscV+E=
-go.opentelemetry.io/otel/sdk v1.23.1/go.mod h1:LzdEVR5am1uKOOwfBWFef2DCi1nu3SA8XQxx2IerWFk=
-go.opentelemetry.io/otel/sdk/export/metric v0.20.0/go.mod h1:h7RBNMsDJ5pmI1zExLi+bJK+Dr8NQCh0qGhm1KDnNlE=
-go.opentelemetry.io/otel/sdk/metric v0.20.0/go.mod h1:knxiS8Xd4E/N+ZqKmUPf3gTTZ4/0TjTXukfxjzSTpHE=
-go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16gUEi0Nf1iBdgw=
-go.opentelemetry.io/otel/trace v1.0.1/go.mod h1:5g4i4fKLaX2BQpSBsxw8YYcgKpMMSW3x7ZTuYBr3sUk=
-go.opentelemetry.io/otel/trace v1.3.0/go.mod h1:c/VDhno8888bvQYmbYLqe41/Ldmr/KKunbvWM4/fEjk=
-go.opentelemetry.io/otel/trace v1.7.0/go.mod h1:fzLSB9nqR2eXzxPXb2JW9IKE+ScyXA48yyE4TNvoHqU=
-go.opentelemetry.io/otel/trace v1.8.0/go.mod h1:0Bt3PXY8w+3pheS3hQUt+wow8b1ojPaTBoTCh2zIFI4=
-go.opentelemetry.io/otel/trace v1.10.0/go.mod h1:Sij3YYczqAdz+EhmGhE6TpTxUO5/F/AzrK+kxfGqySM=
-go.opentelemetry.io/otel/trace v1.19.0/go.mod h1:mfaSyvGyEJEI0nyV2I4qhNQnbBOUUmYZpYojqMnX2vo=
-go.opentelemetry.io/otel/trace v1.23.1 h1:4LrmmEd8AU2rFvU1zegmvqW7+kWarxtNOPyeL6HmYY8=
-go.opentelemetry.io/otel/trace v1.23.1/go.mod h1:4IpnpJFwr1mo/6HL8XIPJaE9y0+u1KcVmuW7dwFSVrI=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/detectors/gcp v1.37.0 h1:B+WbN9RPsvobe6q4vP6KgM8/9plR/HNjgGBrfcOlweA=
+go.opentelemetry.io/contrib/detectors/gcp v1.37.0/go.mod h1:K5zQ3TT7p2ru9Qkzk0bKtCql0RGkPj9pRjpXgZJZ+rU=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0 h1:rbRJ8BBoVMsQShESYZ0FkvcITu8X8QNwJogcLUmDNNw=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0/go.mod h1:ru6KHrNtNHxM4nD/vd6QrLVWgKhxPYgblq4VAtNawTQ=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 h1:Hf9xI/XLML9ElpiHVDNwvqI0hIFlzV8dgIr35kV1kRU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0/go.mod h1:NfchwuyNoMcZ5MLHwPrODwUF1HWCXWrL31s8gSAdIKY=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 h1:OeNbIYk/2C15ckl7glBlOBp5+WlYsOElzTNmiPW/x60=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0/go.mod h1:7Bept48yIeqxP2OZ9/AqIpYS94h2or0aB4FypJTc8ZM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 h1:umZgi92IyxfXd/l4kaDhnKgY8rnN/cZcF1LKc6I8OQ8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0/go.mod h1:4lVs6obhSVRb1EW5FhOuBTyiQhtRtAnnva9vD3yRfq8=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 h1:rixTyDGXFxRy1xzhKrotaHy3/KXdPhlWARrCgK+eqUY=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.9.0/go.mod h1:1vKfU9rv61e9EVGthD1zNvUbiwPcimSsOPU9brfSHJg=
-go.opentelemetry.io/proto/otlp v0.11.0/go.mod h1:QpEjXPrNQzrFDZgoTo49dgHR9RYRSrg3NAKnUGl9YpQ=
 go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-go.opentelemetry.io/proto/otlp v0.16.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
 go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
-go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
+go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
@@ -3600,12 +2301,9 @@ go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/automaxprocs v1.5.1/go.mod h1:BF4eumQw0P9GtnuxxovUd06vwm1o18oMzFtK66vU6XU=
-go.uber.org/goleak v1.0.0/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
-go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
-go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
@@ -3616,14 +2314,14 @@ go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9E
 go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.13.0/go.mod h1:zwrFLgMcdUuIBviXEYEH1YKNaOBnKXsx2IPda5bBwHM=
-go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
-go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
-go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
-golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181009213950-7c1a557ab941/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
-golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@@ -3631,49 +2329,29 @@ golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaE
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220427172511-eb4f295cb31f/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
-golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
-golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
-golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
-golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
-golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -3689,8 +2367,8 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
-golang.org/x/exp v0.0.0-20240213143201-ec583247a57a h1:HinSgX1tJRX3KsL//Gxynpw5CTOAIPhgL4W8PNiIpVE=
-golang.org/x/exp v0.0.0-20240213143201-ec583247a57a/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
+golang.org/x/exp v0.0.0-20251002181428-27f1f14c8bb9 h1:TQwNpfvNkxAVlItJf6Cr5JTsVZoC/Sj7K3OZv2Pc14A=
+golang.org/x/exp v0.0.0-20251002181428-27f1f14c8bb9/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -3729,22 +2407,15 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
-golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U=
+golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181011144130-49bb7cea24b1/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181201002055-351d144fa1fc/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181220203305-927f97764cc3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -3757,14 +2428,11 @@ golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190619014844-b5b0513f8c1b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190923162816-aa69164e4478/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -3781,11 +2449,9 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201006153459-a7d1128ccaa0/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
@@ -3795,16 +2461,12 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210520170846-37e1c6afe023/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
@@ -3817,9 +2479,7 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.0.0-20221014081412-f15817d10f9b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
 golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
@@ -3827,15 +2487,9 @@ golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
-golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
-golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
-golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
-golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
+golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190130055435-99b60b757ec1/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -3862,18 +2516,12 @@ golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri
 golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.3.0/go.mod h1:rQrIauxkUhJ6CuwEXwymO2/eh4xz2ZWF1nBkcxS+tGk=
 golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
 golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
 golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
 golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
-golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
-golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
-golang.org/x/oauth2 v0.11.0/go.mod h1:LdF7O/8bLR/qWK9DrpXmbHLTouvRHK0SgJl0GmDBchk=
-golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
-golang.org/x/oauth2 v0.14.0/go.mod h1:lAtNWgaWfL4cm7j2OV8TxGi9Qb7ECORx8DktCY74OwM=
-golang.org/x/oauth2 v0.17.0 h1:6m3ZPmLEFdVxKKWnKq4VqZ60gutO35zm+zrAHVmHyDQ=
-golang.org/x/oauth2 v0.17.0/go.mod h1:OzPDGQiuQMguemayvdylqddI7qcD9lnSDb+1FiwQ5HA=
+golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo=
+golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -3890,18 +2538,12 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20220819030929-7fc1605a5dde/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.2.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -3915,45 +2557,29 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190514135907-3a4b5fb9f71f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190515120540-06a5c4944438/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190522044717-8097e1b27ff5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190523142557-0e01d883c5c5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190602015325-4c4f7f33c9ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190812073006-9eafafc0a87e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191112214154-59a1497f0cea/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191210023423-ac6580df4449/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200120151820-655fe14d7479/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -3961,26 +2587,14 @@ golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200817155316-9781c653f443/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200916030750-2334cc1a136f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200922070232-aee5d888a860/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201112073958-5cba982894dd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201117170446-d9b008d0a637/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201202213521-69691e467435/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -3993,48 +2607,34 @@ golang.org/x/sys v0.0.0-20210304124612-50617c2ba197/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210816183151-1e6c022a8912/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210819135213-f52c844e1c1c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210903071746-97244b99971b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211031064116-611d5d643895/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211213223007-03aa0b5f6827/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220405210540-1e041c57c461/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -4045,7 +2645,6 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220825204002-c680a09ffe64/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220829200755-d48e67d00261/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -4056,21 +2655,18 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/telemetry v0.0.0-20250908211612-aef8a434d053 h1:dHQOQddU4YHS5gY33/6klKjq7Gp3WwMyOXGNp5nzRj8=
+golang.org/x/telemetry v0.0.0-20250908211612-aef8a434d053/go.mod h1:+nZKN+XVh4LCiA9DV3ywrzN4gumyCnKjau3NGb9SGoE=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
 golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
@@ -4078,16 +2674,12 @@ golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo=
-golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
-golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
-golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
+golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
+golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -4104,31 +2696,21 @@ golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.13.0 h1:eUlYslOIt32DgYD6utsuUeHs4d7AsEYLuIAdg7FlYgI=
+golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190206041539-40960b6deb8e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -4141,11 +2723,8 @@ golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190706070813-72ffa07ba3db/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190907020128-2ca718005c18/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -4155,7 +2734,6 @@ golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191112195655-aa38f8e97acc/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -4176,23 +2754,19 @@ golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjs
 golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
 golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
 golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200616133436-c1934b75d054/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20200916195026-c9a70fc28ce3/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201124115921-2c860bdd6e78/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210101214203-2dba1e4ea05c/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
@@ -4202,20 +2776,14 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
+golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
-golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
 golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
-golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
-golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
-golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
-golang.org/x/tools v0.10.0/go.mod h1:UJwyiVBsOA2uwvK/e5OY3GTpDUJriEd+/YlqAwLPmyM=
-golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
-golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
+golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
+golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -4226,19 +2794,18 @@ golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
 golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
 golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
-golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY=
+golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 gonum.org/v1/gonum v0.0.0-20180816165407-929014505bf4/go.mod h1:Y+Yx5eoAFn32cQvJDxZx5Dpnq+c3wtXuadVZAcxbbBo=
 gonum.org/v1/gonum v0.8.2/go.mod h1:oe/vMfY3deqTw+1EZJhuvEW2iwGF1bW9wwu7XCu0+v0=
 gonum.org/v1/gonum v0.9.3/go.mod h1:TZumC3NeyVQskjXqmyWt4S3bINhy7B4eYwW69EbyX+0=
 gonum.org/v1/gonum v0.11.0/go.mod h1:fSG4YDCxxUZQJ7rKsQrj0gMOg00Il0Z96/qMA4bVQhA=
-gonum.org/v1/gonum v0.12.0 h1:xKuo6hzt+gMav00meVPUlXwSdoEJP46BR+wdxQEFK2o=
-gonum.org/v1/gonum v0.12.0/go.mod h1:73TDxJfAAHeA8Mk9mf8NlIppyhQNo5GLTcYeqgo2lvY=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
 gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
 gonum.org/v1/plot v0.0.0-20190515093506-e2840ee46a6b/go.mod h1:Wt8AAjI+ypCyYX3nZBvf6cAIx93T+c/OS2HFAYskSZc=
 gonum.org/v1/plot v0.9.0/go.mod h1:3Pcqqmp6RHvJI72kgb8fThyUnav364FOsdDo2aGW5lY=
 gonum.org/v1/plot v0.10.1/go.mod h1:VZW5OlhkL1mysU9vaqNHnsy86inf6Ot+jB3r+BczCEo=
-google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.5.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
@@ -4256,7 +2823,6 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.32.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
 google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
 google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
 google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
@@ -4298,17 +2864,8 @@ google.golang.org/api v0.108.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/
 google.golang.org/api v0.110.0/go.mod h1:7FC4Vvx1Mooxh8C5HWjzZHcavuS2f6pmJpZx60ca7iI=
 google.golang.org/api v0.111.0/go.mod h1:qtFHvU9mhgTJegR31csQ+rwxyUTHOKFqCKWp1J0fdw0=
 google.golang.org/api v0.114.0/go.mod h1:ifYI2ZsFK6/uGddGfAD5BMxlnkBqCmqHSDUVi45N5Yg=
-google.golang.org/api v0.118.0/go.mod h1:76TtD3vkgmZ66zZzp72bUUklpmQmKlhh6sYtIjYK+5E=
-google.golang.org/api v0.122.0/go.mod h1:gcitW0lvnyWjSp9nKxAbdHKIZ6vF4aajGueeslZOyms=
-google.golang.org/api v0.124.0/go.mod h1:xu2HQurE5gi/3t1aFCvhPD781p0a3p11sdunTJ2BlP4=
-google.golang.org/api v0.125.0/go.mod h1:mBwVAtz+87bEN6CbA1GtZPDOqY2R5ONPqJeIlvyo4Aw=
-google.golang.org/api v0.126.0/go.mod h1:mBwVAtz+87bEN6CbA1GtZPDOqY2R5ONPqJeIlvyo4Aw=
-google.golang.org/api v0.128.0/go.mod h1:Y611qgqaE92On/7g65MQgxYul3c0rEB894kniWLY750=
-google.golang.org/api v0.134.0/go.mod h1:sjRL3UnjTx5UqNQS9EWr9N8p7xbHpy1k0XGRLCf3Spk=
-google.golang.org/api v0.139.0/go.mod h1:CVagp6Eekz9CjGZ718Z+sloknzkDJE7Vc1Ckj9+viBk=
-google.golang.org/api v0.149.0/go.mod h1:Mwn1B7JTXrzXtnvmzQE2BD6bYZQ8DShKZDZbeN9I7qI=
-google.golang.org/api v0.163.0 h1:4BBDpPaSH+H28NhnX+WwjXxbRLQ7TWuEKp4BQyEjxvk=
-google.golang.org/api v0.163.0/go.mod h1:6SulDkfoBIg4NFmCuZ39XeeAgSHCPecfSUuDyYlAHs0=
+google.golang.org/api v0.251.0 h1:6lea5nHRT8RUmpy9kkC2PJYnhnDAB13LqrLSVQlMIE8=
+google.golang.org/api v0.251.0/go.mod h1:Rwy0lPf/TD7+T2VhYcffCHhyyInyuxGjICxdfLqT7KI=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -4316,16 +2873,12 @@ google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
-google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/cloud v0.0.0-20151119220103-975617b05ea8/go.mod h1:0H1ncTHf11KCFhTc/+EFRbzSCOZx+VUbRMk55Yv5MYk=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190508193815-b515fa19cec8/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190522204451-c2c4e71fbf69/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s=
 google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
@@ -4334,7 +2887,6 @@ google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvx
 google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200117163144-32f20d992d24/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
 google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
@@ -4349,15 +2901,12 @@ google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
@@ -4389,7 +2938,6 @@ google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ6
 google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220126215142-9970aeb2e350/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220207164111-0872dc986b00/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
@@ -4458,80 +3006,19 @@ google.golang.org/genproto v0.0.0-20230320184635-7606e756e683/go.mod h1:NWraEVix
 google.golang.org/genproto v0.0.0-20230323212658-478b75c54725/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
 google.golang.org/genproto v0.0.0-20230330154414-c0448cd141ea/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
 google.golang.org/genproto v0.0.0-20230331144136-dcfb400f0633/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
-google.golang.org/genproto v0.0.0-20230403163135-c38d8f061ccd/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak=
 google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
-google.golang.org/genproto v0.0.0-20230525234025-438c736192d0/go.mod h1:9ExIQyXL5hZrHzQceCwuSYwZZ5QZBazOcprJ5rgs3lY=
-google.golang.org/genproto v0.0.0-20230526161137-0005af68ea54/go.mod h1:zqTuNwFlFRsw5zIts5VnzLQxSRqh+CGOTVMlYbY0Eyk=
-google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e/go.mod h1:zqTuNwFlFRsw5zIts5VnzLQxSRqh+CGOTVMlYbY0Eyk=
-google.golang.org/genproto v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:xZnkP7mREFX5MORlOPEzLMr+90PPZQ2QWzrVTWfAq64=
-google.golang.org/genproto v0.0.0-20230629202037-9506855d4529/go.mod h1:xZnkP7mREFX5MORlOPEzLMr+90PPZQ2QWzrVTWfAq64=
-google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:O9kGHb51iE/nOGvQaDUuadVYqovW56s5emA88lQnj6Y=
-google.golang.org/genproto v0.0.0-20230711160842-782d3b101e98/go.mod h1:S7mY02OqCJTD0E1OiQy1F72PWFB4bZJ87cAtLPYgDR0=
-google.golang.org/genproto v0.0.0-20230726155614-23370e0ffb3e/go.mod h1:0ggbjUrZYpy1q+ANUS30SEoGZ53cdfwtbuG7Ptgy108=
-google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5/go.mod h1:oH/ZOT02u4kWEp7oYBGYFFkCdKS/uYR9Z7+0/xuuFp8=
-google.golang.org/genproto v0.0.0-20230821184602-ccc8af3d0e93/go.mod h1:yZTlhN0tQnXo3h00fuXNCxJdLdIdnVFVBaRJ5LWBbw4=
-google.golang.org/genproto v0.0.0-20230822172742-b8732ec3820d/go.mod h1:yZTlhN0tQnXo3h00fuXNCxJdLdIdnVFVBaRJ5LWBbw4=
-google.golang.org/genproto v0.0.0-20230913181813-007df8e322eb/go.mod h1:yZTlhN0tQnXo3h00fuXNCxJdLdIdnVFVBaRJ5LWBbw4=
-google.golang.org/genproto v0.0.0-20230920204549-e6e6cdab5c13/go.mod h1:CCviP9RmpZ1mxVr8MUjCnSiY09IbAXZxhLE6EhHIdPU=
-google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97/go.mod h1:t1VqOqqvce95G3hIDCT5FeO3YUc6Q4Oe24L/+rNMxRk=
-google.golang.org/genproto v0.0.0-20231012201019-e917dd12ba7a/go.mod h1:EMfReVxb80Dq1hhioy0sOsY9jCE46YDgHlJ7fWVUWRE=
-google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:CgAqfJo+Xmu0GwA0411Ht3OU3OntXwsGmrmjI8ioGXI=
-google.golang.org/genproto v0.0.0-20231030173426-d783a09b4405/go.mod h1:3WDQMjmJk36UQhjQ89emUzb1mdaHcPeeAh4SCBKznB4=
-google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:J7XzRzVy1+IPwWHZUzoD0IccYZIrXILAQpc+Qy9CMhY=
-google.golang.org/genproto v0.0.0-20240125205218-1f4bbc51befe h1:USL2DhxfgRchafRvt/wYyyQNzwgL7ZiURcozOE/Pkvo=
-google.golang.org/genproto v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:cc8bqMqtv9gMOr0zHg2Vzff5ULhhL2IXP4sbcn32Dro=
-google.golang.org/genproto/googleapis/api v0.0.0-20230525234020-1aefcd67740a/go.mod h1:ts19tUU+Z0ZShN1y3aPyq2+O3d5FUNNgT6FtOzmrNn8=
-google.golang.org/genproto/googleapis/api v0.0.0-20230525234035-dd9d682886f9/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
-google.golang.org/genproto/googleapis/api v0.0.0-20230526203410-71b5a4ffd15e/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
-google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
-google.golang.org/genproto/googleapis/api v0.0.0-20230629202037-9506855d4529/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
-google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:mPBs5jNgx2GuQGvFwUvVKqtn6HsUw9nP64BedgvqEsQ=
-google.golang.org/genproto/googleapis/api v0.0.0-20230711160842-782d3b101e98/go.mod h1:rsr7RhLuwsDKL7RmgDDCUc6yaGr1iqceVb5Wv6f6YvQ=
-google.golang.org/genproto/googleapis/api v0.0.0-20230726155614-23370e0ffb3e/go.mod h1:rsr7RhLuwsDKL7RmgDDCUc6yaGr1iqceVb5Wv6f6YvQ=
-google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5/go.mod h1:5DZzOUPCLYL3mNkQ0ms0F3EuUNZ7py1Bqeq6sxzI7/Q=
-google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d/go.mod h1:KjSP20unUpOx5kyQUFa7k4OJg0qeJ7DEZflGDu2p6Bk=
-google.golang.org/genproto/googleapis/api v0.0.0-20230913181813-007df8e322eb/go.mod h1:KjSP20unUpOx5kyQUFa7k4OJg0qeJ7DEZflGDu2p6Bk=
-google.golang.org/genproto/googleapis/api v0.0.0-20230920204549-e6e6cdab5c13/go.mod h1:RdyHbowztCGQySiCvQPgWQWgWhGnouTdCflKoDBt32U=
-google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97/go.mod h1:iargEX0SFPm3xcfMI0d1domjg0ZF4Aa0p2awqyxhvF0=
-google.golang.org/genproto/googleapis/api v0.0.0-20231012201019-e917dd12ba7a/go.mod h1:SUBoKXbI1Efip18FClrQVGjWcyd0QZd8KkvdP34t7ww=
-google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:IBQ646DjkDkvUIsVq/cc03FUFQ9wbZu7yE396YcL870=
-google.golang.org/genproto/googleapis/api v0.0.0-20231030173426-d783a09b4405/go.mod h1:oT32Z4o8Zv2xPQTg0pbVaPr0MPOH6f14RgXt7zfIpwg=
-google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe h1:0poefMBYvYbs7g5UkjS6HcxBPaTRAmznle9jnxYoAI8=
-google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
-google.golang.org/genproto/googleapis/bytestream v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:ylj+BE99M198VPbBh6A8d9n3w8fChvyLK3wwBOjXBFA=
-google.golang.org/genproto/googleapis/bytestream v0.0.0-20230720185612-659f7aaaa771/go.mod h1:3QoBVwTHkXbY1oRGzlhwhOykfcATQN43LJ6iT8Wy8kE=
-google.golang.org/genproto/googleapis/bytestream v0.0.0-20230807174057-1744710a1577/go.mod h1:NjCQG/D8JandXxM57PZbAJL1DCNL6EypA0vPPwfsc7c=
-google.golang.org/genproto/googleapis/bytestream v0.0.0-20231030173426-d783a09b4405/go.mod h1:GRUCuLdzVqZte8+Dl/D4N25yLzcGqqWaYkeVOwulFqw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234015-3fc162c6f38a/go.mod h1:xURIpW9ES5+/GZhnV6beoEtxQrnkRGIfP5VQG2tCBLc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230525234030-28d5490b6b19/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230526203410-71b5a4ffd15e/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230629202037-9506855d4529/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:8mL13HKkDa+IuJ8yruA3ci0q+0vsUz4m//+ottjwS5o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230720185612-659f7aaaa771/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230731190214-cbb8c96f2d6d/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230803162519-f966b187b2e5/go.mod h1:zBEcrKX2ZOcEkHWxBPAIvYUWOKKMIhYcmNiUIu2ji3I=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230920183334-c177e329c48b/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13/go.mod h1:KSqppvjFjtoCI+KGd4PELB0qLNxdJHRGqRI09mB6pQA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231002182017-d307bd883b97/go.mod h1:v7nGkzlmW8P3n/bKmWBn2WpBjpOEx8Q6gMueudAmKfY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a/go.mod h1:4cYg8o5yUbm77w8ZX00LhMVNl/YVBFJRYWDc0uYWMs0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:swOH3j0KzcDDgGUWr+SNpyTen5YrXjS3eyPzFYKc6lc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405/go.mod h1:67X1fPuzjcrkymZzZV1vvkFeTn2Rvc6lYF9MYFGCcwE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:oQ5rr10WTTMvP4A36n8JpR1OrO1BEiV4f78CneXZxkA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe h1:bQnxqljG/wqi4NTXu2+DJ3n7APcEA882QZ1JvhQAq9o=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
-google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/genproto v0.0.0-20251002232023-7c0ddcbb5797 h1:06qNPeHxbfl+OJluwQ2zOiTP6di3mvADTHnMYQuOKDQ=
+google.golang.org/genproto v0.0.0-20251002232023-7c0ddcbb5797/go.mod h1:OqVwZqqGV3h7k+YCVWXoTtwC2cs55RnDEUVMMadhxrc=
+google.golang.org/genproto/googleapis/api v0.0.0-20250922171735-9219d122eba9 h1:jm6v6kMRpTYKxBRrDkYAitNJegUeO1Mf3Kt80obv0gg=
+google.golang.org/genproto/googleapis/api v0.0.0-20250922171735-9219d122eba9/go.mod h1:LmwNphe5Afor5V3R5BppOULHOnt2mCIf+NxMd4XiygE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 h1:i8QOKZfYg6AbGVZzUAY3LrNWCKF8O6zFisU9Wl9RER4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.22.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
@@ -4554,9 +3041,7 @@ google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.41.0/go.mod h1:U3l9uK9J0sini8mHphKoXyaqDA/8VyGnDee1zzIUK6k=
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
 google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
@@ -4567,21 +3052,12 @@ google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCD
 google.golang.org/grpc v1.50.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc v1.51.0/go.mod h1:wgNDFcnuBGmxLKI/qn4T+m5BtEBYXJPvibbUPsAIPww=
-google.golang.org/grpc v1.52.0/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
 google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
 google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
 google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
-google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
-google.golang.org/grpc v1.56.1/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
-google.golang.org/grpc v1.56.2/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
-google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
-google.golang.org/grpc v1.57.1/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
-google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
-google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
-google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
-google.golang.org/grpc v1.60.1/go.mod h1:OlCHIeLYqSSsLi6i49B5QGdzaMZK9+M7LXN2FKz4eGM=
-google.golang.org/grpc v1.61.0 h1:TOvOcuXn30kRao+gfcvsebNEa5iZIiLkisYEkf7R7o0=
-google.golang.org/grpc v1.61.0/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
+google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
+google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
+google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -4598,45 +3074,33 @@ google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQ
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.28.2-0.20230222093303-bc1253ad3743/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.29.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
-google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
-gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
+google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
+google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20141024133853-64131543e789/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
-gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
 gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/ini.v1 v1.66.2 h1:XfR1dOYubytKy4Shzc2LHrrGhU0lDCfDGG1yLPmpgsI=
-gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/jcmturner/goidentity.v3 v3.0.0 h1:1duIyWiTaYvVx3YX2CYtpJbUFd7/UuPYCfgXtQ3VTbI=
 gopkg.in/jcmturner/goidentity.v3 v3.0.0/go.mod h1:oG2kH0IvSYNIu80dVAyu/yoefjq1mNfM5bm88whjWx4=
-gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/ory-am/dockertest.v3 v3.3.4 h1:oen8RiwxVNxtQ1pRoV4e4jqh6UjNsOuIZ1NXns6jdcw=
 gopkg.in/ory-am/dockertest.v3 v3.3.4/go.mod h1:s9mmoLkaGeAh97qygnNj4xWkiN7e1SKekYC6CovU+ek=
 gopkg.in/resty.v1 v1.12.0 h1:CuXP0Pjfw9rOuY6EP+UvtNvt5DSqHpIxILZKT/quCZI=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
-gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/square/go-jose.v2 v2.5.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
-gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
@@ -4652,20 +3116,14 @@ gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
-gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
-gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
-gotest.tools/v3 v3.3.0/go.mod h1:Mcr9QNxkg0uMvy/YElmo4SpXgJKWgQvYrT7Kw5RzJ1A=
-gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-gotest.tools/v3 v3.5.0 h1:Ljk6PdHdOhAb5aDMWXjDLMMhph+BpztA4v1QdqEW2eY=
-gotest.tools/v3 v3.5.0/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -4674,108 +3132,31 @@ honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.1.3/go.mod h1:NgwopIslSNH47DimFoV78dnkksY2EFtX0ajyb3K/las=
-k8s.io/api v0.18.2/go.mod h1:SJCWI7OLzhZSvbY7U8zwNl9UA4o1fizoug34OV/2r78=
-k8s.io/api v0.20.1/go.mod h1:KqwcCVogGxQY3nBlRpwt+wpAMF/KjaCc7RpywacvqUo=
-k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ=
-k8s.io/api v0.20.6/go.mod h1:X9e8Qag6JV/bL5G6bU8sdVRltWKmdHsFUGS3eVndqE8=
-k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs=
-k8s.io/api v0.26.2/go.mod h1:1kjMQsFE+QHPfskEcVNgL3+Hp88B80uj0QtSOlj8itU=
-k8s.io/api v0.29.1 h1:DAjwWX/9YT7NQD4INu49ROJuZAAAP/Ijki48GUPzxqw=
-k8s.io/api v0.29.1/go.mod h1:7Kl10vBRUXhnQQI8YR/R327zXC8eJ7887/+Ybta+RoQ=
-k8s.io/apimachinery v0.18.2/go.mod h1:9SnR/e11v5IbyPCGbvJViimtJ0SwHG4nfZFjU77ftcA=
-k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
-k8s.io/apimachinery v0.20.4/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
-k8s.io/apimachinery v0.20.6/go.mod h1:ejZXtW1Ra6V1O5H8xPBGz+T3+4gfkTCeExAHKU57MAc=
-k8s.io/apimachinery v0.22.1/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ0=
-k8s.io/apimachinery v0.22.5/go.mod h1:xziclGKwuuJ2RM5/rSFQSYAj0zdbci3DH8kj+WvyN0U=
-k8s.io/apimachinery v0.25.0/go.mod h1:qMx9eAk0sZQGsXGu86fab8tZdffHbwUfsvzqKn4mfB0=
-k8s.io/apimachinery v0.26.2/go.mod h1:ats7nN1LExKHvJ9TmwootT00Yz05MuYqPXEXaVeOy5I=
-k8s.io/apimachinery v0.29.1 h1:KY4/E6km/wLBguvCZv8cKTeOwwOBqFNjwJIdMkMbbRc=
-k8s.io/apimachinery v0.29.1/go.mod h1:6HVkd1FwxIagpYrHSwJlQqZI3G9LfYWRPAkUvLnXTKU=
-k8s.io/apiserver v0.20.1/go.mod h1:ro5QHeQkgMS7ZGpvf4tSMx6bBOgPfE+f52KwvXfScaU=
-k8s.io/apiserver v0.20.4/go.mod h1:Mc80thBKOyy7tbvFtB4kJv1kbdD0eIH8k8vianJcbFM=
-k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q=
-k8s.io/apiserver v0.22.5/go.mod h1:s2WbtgZAkTKt679sYtSudEQrTGWUSQAPe6MupLnlmaQ=
-k8s.io/apiserver v0.26.2/go.mod h1:GHcozwXgXsPuOJ28EnQ/jXEM9QeG6HT22YxSNmpYNh8=
-k8s.io/client-go v0.18.2/go.mod h1:Xcm5wVGXX9HAA2JJ2sSBUn3tCJ+4SVlCbl2MNNv+CIU=
-k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y=
-k8s.io/client-go v0.20.4/go.mod h1:LiMv25ND1gLUdBeYxBIwKpkSC5IsozMMmOOeSJboP+k=
-k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0=
-k8s.io/client-go v0.22.5/go.mod h1:cs6yf/61q2T1SdQL5Rdcjg9J1ElXSwbjSrW2vFImM4Y=
-k8s.io/client-go v0.26.2/go.mod h1:u5EjOuSyBa09yqqyY7m3abZeovO/7D/WehVVlZ2qcqU=
-k8s.io/client-go v0.29.1 h1:19B/+2NGEwnFLzt0uB5kNJnfTsbV8w6TgQRz9l7ti7A=
-k8s.io/client-go v0.29.1/go.mod h1:TDG/psL9hdet0TI9mGyHJSgRkW3H9JZk2dNEUS7bRks=
-k8s.io/code-generator v0.19.7/go.mod h1:lwEq3YnLYb/7uVXLorOJfxg+cUu2oihFhHZ0n9NIla0=
-k8s.io/component-base v0.20.1/go.mod h1:guxkoJnNoh8LNrbtiQOlyp2Y2XFCZQmrcg2n/DeYNLk=
-k8s.io/component-base v0.20.4/go.mod h1:t4p9EdiagbVCJKrQ1RsA5/V4rFQNDfRlevJajlGwgjI=
-k8s.io/component-base v0.20.6/go.mod h1:6f1MPBAeI+mvuts3sIdtpjljHWBQ2cIy38oBIWMYnrM=
-k8s.io/component-base v0.22.5/go.mod h1:VK3I+TjuF9eaa+Ln67dKxhGar5ynVbwnGrUiNF4MqCI=
-k8s.io/component-base v0.26.2/go.mod h1:DxbuIe9M3IZPRxPIzhch2m1eT7uFrSBJUBuVCQEBivs=
-k8s.io/cri-api v0.17.3/go.mod h1:X1sbHmuXhwaHs9xxYffLqJogVsnI+f6cPRcgPel7ywM=
-k8s.io/cri-api v0.20.1/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
-k8s.io/cri-api v0.20.4/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
-k8s.io/cri-api v0.20.6/go.mod h1:ew44AjNXwyn1s0U4xCKGodU7J1HzBeZ1MpGrpa5r8Yc=
-k8s.io/cri-api v0.23.1/go.mod h1:REJE3PSU0h/LOV1APBrupxrEJqnoxZC8KWzkBUHwrK4=
-k8s.io/cri-api v0.25.0/go.mod h1:J1rAyQkSJ2Q6I+aBMOVgg2/cbbebso6FNa0UagiR0kc=
-k8s.io/cri-api v0.25.3/go.mod h1:riC/P0yOGUf2K1735wW+CXs1aY2ctBgePtnnoFLd0dU=
-k8s.io/cri-api v0.27.1/go.mod h1:+Ts/AVYbIo04S86XbTD73UPp/DkTiYxtsFeOFEu32L0=
-k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
-k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
-k8s.io/gengo v0.0.0-20200428234225-8167cfdcfc14/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
-k8s.io/gengo v0.0.0-20201113003025-83324d819ded/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
-k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
-k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
-k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
-k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
-k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
-k8s.io/klog/v2 v2.4.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
-k8s.io/klog/v2 v2.9.0/go.mod h1:hy9LJ/NvuK+iVyP4Ehqva4HxZG/oXyIS3n3Jmire4Ec=
-k8s.io/klog/v2 v2.30.0/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/klog/v2 v2.70.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
-k8s.io/klog/v2 v2.110.1 h1:U/Af64HJf7FcwMcXyKm2RPM22WZzyR7OSpYj5tg3cL0=
-k8s.io/klog/v2 v2.110.1/go.mod h1:YGtd1984u+GgbuZ7e08/yBuAfKLSO0+uR1Fhi6ExXjo=
-k8s.io/kms v0.26.2/go.mod h1:69qGnf1NsFOQP07fBYqNLZklqEHSJF024JqYCaeVxHg=
-k8s.io/kube-openapi v0.0.0-20200121204235-bf4fb3bd569c/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
-k8s.io/kube-openapi v0.0.0-20200805222855-6aeccd4b50c6/go.mod h1:UuqjUnNftUyPE5H64/qeyjQoUZhGpeFDVdxjTeEVN2o=
-k8s.io/kube-openapi v0.0.0-20201113171705-d219536bb9fd/go.mod h1:WOJ3KddDSol4tAGcJo0Tvi+dK12EcqSLqcWsryKMpfM=
-k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw=
-k8s.io/kube-openapi v0.0.0-20211109043538-20434351676c/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw=
-k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1/go.mod h1:C/N6wCaBHeBHkHUesQOQy2/MZqGgMAFPqGsGQLdbZBU=
-k8s.io/kube-openapi v0.0.0-20221012153701-172d655c2280/go.mod h1:+Axhij7bCpeqhklhUTe3xmOn6bWxolyZEeyaFpjGtl4=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
-k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
-k8s.io/kubernetes v1.13.0/go.mod h1:ocZa8+6APFNC2tX1DZASIbocyYT5jHzqFVsY5aoB7Jk=
-k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
-k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20210802155522-efc7438f0176/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20221107191617-1a15be271d1d/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-layeh.com/radius v0.0.0-20190322222518-890bc1058917 h1:BDXFaFzUt5EIqe/4wrTc4AcYZWP6iC6Ult+jQWLh5eU=
-layeh.com/radius v0.0.0-20190322222518-890bc1058917/go.mod h1:fywZKyu//X7iRzaxLgPWsvc0L26IUpVvE/aeIL2JtIQ=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+layeh.com/radius v0.0.0-20231213012653-1006025d24f8 h1:orYXpi6BJZdvgytfHH4ybOe4wHnLbbS71Cmd8mWdZjs=
+layeh.com/radius v0.0.0-20231213012653-1006025d24f8/go.mod h1:QRf+8aRqXc019kHkpcs/CTgyWXFzf+bxlsyuo2nAl1o=
 lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
 modernc.org/cc/v3 v3.36.2/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
 modernc.org/cc/v3 v3.36.3/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
-modernc.org/cc/v3 v3.37.0/go.mod h1:vtL+3mdHx/wcj3iEGz84rQa8vEqR6XM84v5Lcvfph20=
-modernc.org/cc/v3 v3.40.0/go.mod h1:/bTg4dnWkSXowUO6ssQKnOV0yMVxDYNIsIrzqTFDGH0=
 modernc.org/ccgo/v3 v3.0.0-20220428102840-41399a37e894/go.mod h1:eI31LL8EwEBKPpNpA4bU1/i+sKOwOrQy8D87zWUcRZc=
 modernc.org/ccgo/v3 v3.0.0-20220430103911-bc99d88307be/go.mod h1:bwdAnOoaIt8Ax9YdWGjxWsdkPcZyRPHqrOvJxaKAKGw=
-modernc.org/ccgo/v3 v3.0.0-20220904174949-82d86e1b6d56/go.mod h1:YSXjPL62P2AMSxBphRHPn7IkzhVHqkvOnRKAKh+W6ZI=
 modernc.org/ccgo/v3 v3.16.4/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
 modernc.org/ccgo/v3 v3.16.6/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
 modernc.org/ccgo/v3 v3.16.8/go.mod h1:zNjwkizS+fIFDrDjIAgBSCLkWbJuHF+ar3QRn+Z9aws=
 modernc.org/ccgo/v3 v3.16.9/go.mod h1:zNMzC9A9xeNUepy6KuZBbugn3c0Mc9TeiJO4lgvkJDo=
-modernc.org/ccgo/v3 v3.16.13-0.20221017192402-261537637ce8/go.mod h1:fUB3Vn0nVPReA+7IG7yZDfjv1TMWjhQP8gCxrFAtL5g=
-modernc.org/ccgo/v3 v3.16.13/go.mod h1:2Quk+5YgpImhPjv2Qsob1DnZ/4som1lJTodubIcoUkY=
 modernc.org/ccorpus v1.11.6/go.mod h1:2gEUTrWqdpH2pXsmTM1ZkjeSrUWDpjMu2T6m29L/ErQ=
 modernc.org/httpfs v1.0.6/go.mod h1:7dosgurJGp0sPaRanU53W4xZYKh14wfzX420oZADeHM=
 modernc.org/libc v0.0.0-20220428101251-2d5f3daf273b/go.mod h1:p7Mg4+koNjc8jkqwcoFBJx7tXkpj00G77X7A72jXPXA=
@@ -4785,58 +3166,29 @@ modernc.org/libc v1.16.17/go.mod h1:hYIV5VZczAmGZAnG15Vdngn5HSF5cSkbvfz2B7GRuVU=
 modernc.org/libc v1.16.19/go.mod h1:p7Mg4+koNjc8jkqwcoFBJx7tXkpj00G77X7A72jXPXA=
 modernc.org/libc v1.17.0/go.mod h1:XsgLldpP4aWlPlsjqKRdHPqCxCjISdHfM/yeWC5GyW0=
 modernc.org/libc v1.17.1/go.mod h1:FZ23b+8LjxZs7XtFMbSzL/EhPxNbfZbErxEHc7cbD9s=
-modernc.org/libc v1.17.4/go.mod h1:WNg2ZH56rDEwdropAJeZPQkXmDwh+JCA1s/htl6r2fA=
-modernc.org/libc v1.18.0/go.mod h1:vj6zehR5bfc98ipowQOM2nIDUZnVew/wNC/2tOGS+q0=
-modernc.org/libc v1.20.3/go.mod h1:ZRfIaEkgrYgZDl6pa4W39HgN5G/yDW+NRmNKZBDFrk0=
-modernc.org/libc v1.21.4/go.mod h1:przBsL5RDOZajTVslkugzLBj1evTue36jEomFQOoYuI=
-modernc.org/libc v1.22.2/go.mod h1:uvQavJ1pZ0hIoC/jfqNoMLURIMhKzINIWypNM17puug=
 modernc.org/mathutil v1.2.2/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.4.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.5.0/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/memory v1.1.1/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
 modernc.org/memory v1.2.0/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
 modernc.org/memory v1.2.1/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
-modernc.org/memory v1.3.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
-modernc.org/memory v1.4.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
-modernc.org/memory v1.5.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
 modernc.org/opt v0.1.1/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
 modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
 modernc.org/sqlite v1.18.1/go.mod h1:6ho+Gow7oX5V+OiOQ6Tr4xeqbx13UZ6t+Fw9IRUG4d4=
-modernc.org/sqlite v1.18.2/go.mod h1:kvrTLEWgxUcHa2GfHBQtanR1H9ht3hTJNtKpzH9k1u0=
 modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
 modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
 modernc.org/tcl v1.13.1/go.mod h1:XOLfOwzhkljL4itZkK6T72ckMgvj0BDsnKNdZVUOecw=
-modernc.org/tcl v1.13.2/go.mod h1:7CLiGIPo1M8Rv1Mitpv5akc2+8fxUd2y2UzC/MfMzy0=
 modernc.org/token v1.0.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-modernc.org/token v1.0.1/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/z v1.5.1/go.mod h1:eWFB510QWW5Th9YGZT81s+LwvaAs3Q2yr4sP0rmLkv8=
-mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48=
-mvdan.cc/gofumpt v0.2.1/go.mod h1:a/rvZPhsNaedOJBzqRD9omnwVwHZsBdJirXHa9Gh9Ig=
-nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
-nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
-oras.land/oras-go v1.2.0/go.mod h1:pFNs7oHp2dYsYMSS82HaX5l4mpnGO7hbpPN6EWH2ltc=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.14/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.15/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.22/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
-sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.35/go.mod h1:WxjusMwXlKzfAs4p9km6XJRndVt2FROgMVCE4cdohFo=
-sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
-sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
-sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200116222232-67a7b8c61874/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
-sigs.k8s.io/structured-merge-diff/v3 v3.0.0/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
-sigs.k8s.io/structured-merge-diff/v4 v4.0.1/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
-sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
-sigs.k8s.io/structured-merge-diff/v4 v4.0.3/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
-sigs.k8s.io/structured-merge-diff/v4 v4.1.2/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
-sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
-sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
-sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
-sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
-sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/helper/activationflags/activation_flags.go b/helper/activationflags/activation_flags.go
new file mode 100644
index 00000000000..e4bddedc60c
--- /dev/null
+++ b/helper/activationflags/activation_flags.go
@@ -0,0 +1,212 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package activationflags
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"sync"
+
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+const (
+	storagePathActivationFlags = "activation-flags"
+	IdentityDeduplication      = "force-identity-deduplication"
+	SCIMEnablement             = "enable-scim"
+)
+
+// FeatureActivationFlags stores activation flags in a local map and storage.
+// All operations on internal state need to hold read/write locks for the
+// duration of access.
+type FeatureActivationFlags struct {
+	activationFlagsLock sync.RWMutex
+	storage             logical.Storage
+	activationFlags     map[string]bool
+}
+
+// ActivationManager is a lightweight interface for managing and inspecting
+// feature activation flags.
+type ActivationManager interface {
+	IsActivationFlagEnabled(featureName string) bool
+	SetActivationFlagEnabled(ctx context.Context, featureName string, activate bool) error
+}
+
+// NewFeatureActivationFlags is a constructor for FeatureActivationFlags.
+func NewFeatureActivationFlags() *FeatureActivationFlags {
+	return &FeatureActivationFlags{
+		activationFlags: map[string]bool{},
+	}
+}
+
+// Initialize loads the activation flags from storage into the in-memory cache.
+func (f *FeatureActivationFlags) Initialize(ctx context.Context, storage logical.Storage) error {
+	f.activationFlagsLock.Lock()
+	defer f.activationFlagsLock.Unlock()
+
+	if storage == nil {
+		return fmt.Errorf("unable to access storage")
+	}
+
+	f.storage = storage
+
+	entry, err := f.storage.Get(ctx, storagePathActivationFlags)
+	if err != nil {
+		return fmt.Errorf("failed to get activation flags from storage: %w", err)
+	}
+	if entry == nil {
+		f.activationFlags = map[string]bool{}
+		return nil
+	}
+
+	var activationFlags map[string]bool
+	if err := entry.DecodeJSON(&activationFlags); err != nil {
+		return fmt.Errorf("failed to decode activation flags from storage: %w", err)
+	}
+
+	f.activationFlags = activationFlags
+
+	return nil
+}
+
+// Get is the helper function called by the activation-flags API read endpoint. This reads the
+// actual values from storage, then updates the in-memory cache of the activation-flags. It
+// returns a slice of the feature names which have already been activated.
+func (f *FeatureActivationFlags) Get(ctx context.Context) ([]string, error) {
+	// Don't use nil slice declaration, we want the JSON to show "[]" instead of null
+	activated := []string{}
+
+	_, err := f.ReloadFlagsFromStorage(ctx)
+	if err != nil {
+		return activated, err
+	}
+
+	f.activationFlagsLock.Lock()
+	defer f.activationFlagsLock.Unlock()
+
+	for flag, set := range f.activationFlags {
+		if set {
+			activated = append(activated, flag)
+		}
+	}
+
+	return activated, nil
+}
+
+// ReloadFlagsFromStorage loads the activation flags from storage and updates the in-memory cache.
+func (f *FeatureActivationFlags) ReloadFlagsFromStorage(ctx context.Context) (map[string]bool, error) {
+	f.activationFlagsLock.Lock()
+	defer f.activationFlagsLock.Unlock()
+
+	if f.storage == nil {
+		return map[string]bool{}, nil
+	}
+
+	entry, err := f.storage.Get(ctx, storagePathActivationFlags)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get activation flags from storage: %w", err)
+	}
+	if entry == nil {
+		return map[string]bool{}, nil
+	}
+
+	var storageActivationFlags map[string]bool
+	if err := entry.DecodeJSON(&storageActivationFlags); err != nil {
+		return nil, fmt.Errorf("failed to decode activation flags from storage: %w", err)
+	}
+
+	// State Change Logic for Flags
+	//
+	// This logic determines changes to flags, but it does NOT account for flags that have been deleted.
+	// As of this writing, flag removal is not supported for activation flags.
+	//
+	// Valid State Transitions:
+	// 1. Unset (new flag) -> Active
+	// 2. Active -> Inactive
+	// 3. Inactive -> Active
+	//
+	// Behavior notes:
+	// - If a flag does not exist in-memory (`!ok`), it is treated as a new flag.
+	//   Nodes should only react to the new flag if its state is being set to "Active".
+	// - If a flag exists in-memory, any change in its value (e.g., Active -> Inactive) is considered valid
+	//   and is marked as a state change.
+	//
+	// The resulting `changedFlags` map will store the flags with their new values if they meet the above criteria.
+	changedFlags := map[string]bool{}
+	for flg, v := range storageActivationFlags {
+		oldValue, ok := f.activationFlags[flg]
+
+		switch {
+		// New flag: handle only if transitioning to "Active (true)"
+		case !ok && v:
+			changedFlags[flg] = v
+		default:
+			// Existing flag: detect state change
+			if oldValue != v {
+				changedFlags[flg] = v
+			}
+		}
+	}
+
+	// Update the in-memory flags after loading the latest values from storage
+	f.activationFlags = storageActivationFlags
+
+	return changedFlags, nil
+}
+
+// SetActivationFlagEnabled is the helper function called by the
+// activation-flags API write endpoint. This stores the boolean value for the
+// activation-flag feature name into Vault storage across the cluster and
+// updates the in-memory cache upon success.
+func (f *FeatureActivationFlags) SetActivationFlagEnabled(ctx context.Context, featureName string, activate bool) (err error) {
+	f.activationFlagsLock.Lock()
+	defer f.activationFlagsLock.Unlock()
+
+	if f.storage == nil {
+		return fmt.Errorf("unable to access storage")
+	}
+
+	activationFlags := f.activationFlags
+
+	clonedFlags := maps.Clone(f.activationFlags)
+	clonedFlags[featureName] = activate
+	// The cloned flags are updated but the in-memory state is only updated on success of the storage update.
+	defer func() {
+		if err == nil {
+			activationFlags[featureName] = activate
+		}
+	}()
+
+	entry, err := logical.StorageEntryJSON(storagePathActivationFlags, clonedFlags)
+	if err != nil {
+		return fmt.Errorf("failed to marshal object to JSON: %w", err)
+	}
+
+	err = f.storage.Put(ctx, entry)
+	if err != nil {
+		return fmt.Errorf("failed to save object in storage: %w", err)
+	}
+
+	return nil
+}
+
+// IsActivationFlagEnabled is true if the specified flag is enabled in the core.
+func (f *FeatureActivationFlags) IsActivationFlagEnabled(featureName string) bool {
+	f.activationFlagsLock.RLock()
+	defer f.activationFlagsLock.RUnlock()
+
+	activated, ok := f.activationFlags[featureName]
+
+	return ok && activated
+}
+
+// ActivateInMem is used to set the activation flag in-memory only for a feature
+// in tests
+func (f *FeatureActivationFlags) ActivateInMem(featureName string, activate bool) {
+	f.activationFlagsLock.Lock()
+	defer f.activationFlagsLock.Unlock()
+
+	f.activationFlags[featureName] = activate
+}
diff --git a/helper/benchhelpers/benchhelpers.go b/helper/benchhelpers/benchhelpers.go
deleted file mode 100644
index afb0d4a88a4..00000000000
--- a/helper/benchhelpers/benchhelpers.go
+++ /dev/null
@@ -1,22 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package benchhelpers
-
-import (
-	"testing"
-
-	testinginterface "github.com/mitchellh/go-testing-interface"
-)
-
-type tbWrapper struct {
-	testing.TB
-}
-
-func (b tbWrapper) Parallel() {
-	// no-op
-}
-
-func TBtoT(tb testing.TB) testinginterface.T {
-	return tbWrapper{tb}
-}
diff --git a/helper/builtinplugins/builtinplugins_test.go b/helper/builtinplugins/builtinplugins_test.go
index 8df20209c1d..500663014b2 100644
--- a/helper/builtinplugins/builtinplugins_test.go
+++ b/helper/builtinplugins/builtinplugins_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package builtinplugins
@@ -8,9 +8,7 @@ import (
 
 	logicalKv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/api"
-	"github.com/hashicorp/vault/audit"
 	logicalDb "github.com/hashicorp/vault/builtin/logical/database"
-	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -45,11 +43,6 @@ func TestBuiltinPluginsWork(t *testing.T) {
 				"database": logicalDb.Factory,
 			},
 			PendingRemovalMountsAllowed: true,
-			// Specifying at least one audit backend factory will prevent NewTestCluster
-			// from attempting to enable a noop audit, and audit isn't required for this test.
-			AuditBackends: map[string]audit.Factory{
-				"noop": corehelpers.NoopAuditFactory(nil),
-			},
 		},
 		&vault.TestClusterOptions{
 			HandlerFunc: vaulthttp.Handler,
diff --git a/helper/builtinplugins/registry.go b/helper/builtinplugins/registry.go
index 978321c8ad3..801bc36d3af 100644
--- a/helper/builtinplugins/registry.go
+++ b/helper/builtinplugins/registry.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package builtinplugins
@@ -6,55 +6,14 @@ package builtinplugins
 import (
 	"context"
 
-	credAliCloud "github.com/hashicorp/vault-plugin-auth-alicloud"
-	credAzure "github.com/hashicorp/vault-plugin-auth-azure"
-	credCentrify "github.com/hashicorp/vault-plugin-auth-centrify"
-	credCF "github.com/hashicorp/vault-plugin-auth-cf"
-	credGcp "github.com/hashicorp/vault-plugin-auth-gcp/plugin"
 	credJWT "github.com/hashicorp/vault-plugin-auth-jwt"
-	credKerb "github.com/hashicorp/vault-plugin-auth-kerberos"
-	credKube "github.com/hashicorp/vault-plugin-auth-kubernetes"
-	credOCI "github.com/hashicorp/vault-plugin-auth-oci"
-	dbCouchbase "github.com/hashicorp/vault-plugin-database-couchbase"
-	dbElastic "github.com/hashicorp/vault-plugin-database-elasticsearch"
-	dbMongoAtlas "github.com/hashicorp/vault-plugin-database-mongodbatlas"
-	dbRedis "github.com/hashicorp/vault-plugin-database-redis"
-	dbRedisElastiCache "github.com/hashicorp/vault-plugin-database-redis-elasticache"
-	dbSnowflake "github.com/hashicorp/vault-plugin-database-snowflake"
-	logicalAd "github.com/hashicorp/vault-plugin-secrets-ad/plugin"
-	logicalAlicloud "github.com/hashicorp/vault-plugin-secrets-alicloud"
-	logicalAzure "github.com/hashicorp/vault-plugin-secrets-azure"
-	logicalGcp "github.com/hashicorp/vault-plugin-secrets-gcp/plugin"
-	logicalGcpKms "github.com/hashicorp/vault-plugin-secrets-gcpkms"
-	logicalKube "github.com/hashicorp/vault-plugin-secrets-kubernetes"
 	logicalKv "github.com/hashicorp/vault-plugin-secrets-kv"
-	logicalMongoAtlas "github.com/hashicorp/vault-plugin-secrets-mongodbatlas"
-	logicalLDAP "github.com/hashicorp/vault-plugin-secrets-openldap"
-	logicalTerraform "github.com/hashicorp/vault-plugin-secrets-terraform"
 	credAppRole "github.com/hashicorp/vault/builtin/credential/approle"
-	credAws "github.com/hashicorp/vault/builtin/credential/aws"
 	credCert "github.com/hashicorp/vault/builtin/credential/cert"
-	credGitHub "github.com/hashicorp/vault/builtin/credential/github"
-	credLdap "github.com/hashicorp/vault/builtin/credential/ldap"
-	credOkta "github.com/hashicorp/vault/builtin/credential/okta"
-	credRadius "github.com/hashicorp/vault/builtin/credential/radius"
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
-	logicalAws "github.com/hashicorp/vault/builtin/logical/aws"
-	logicalConsul "github.com/hashicorp/vault/builtin/logical/consul"
-	logicalNomad "github.com/hashicorp/vault/builtin/logical/nomad"
 	logicalPki "github.com/hashicorp/vault/builtin/logical/pki"
-	logicalRabbit "github.com/hashicorp/vault/builtin/logical/rabbitmq"
 	logicalSsh "github.com/hashicorp/vault/builtin/logical/ssh"
-	logicalTotp "github.com/hashicorp/vault/builtin/logical/totp"
 	logicalTransit "github.com/hashicorp/vault/builtin/logical/transit"
-	dbCass "github.com/hashicorp/vault/plugins/database/cassandra"
-	dbHana "github.com/hashicorp/vault/plugins/database/hana"
-	dbInflux "github.com/hashicorp/vault/plugins/database/influxdb"
-	dbMongo "github.com/hashicorp/vault/plugins/database/mongodb"
-	dbMssql "github.com/hashicorp/vault/plugins/database/mssql"
-	dbMysql "github.com/hashicorp/vault/plugins/database/mysql"
-	dbPostgres "github.com/hashicorp/vault/plugins/database/postgresql"
-	dbRedshift "github.com/hashicorp/vault/plugins/database/redshift"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -94,108 +53,29 @@ func removedFactory(ctx context.Context, config *logical.BackendConfig) (logical
 	return removedBackend, nil
 }
 
-func newRegistry() *registry {
-	reg := &registry{
+func newMinimalRegistry() *registry {
+	return &registry{
 		credentialBackends: map[string]credentialBackend{
-			"alicloud": {Factory: credAliCloud.Factory},
-			"app-id": {
-				Factory:           removedFactory,
-				DeprecationStatus: consts.Removed,
-			},
-			"approle": {Factory: credAppRole.Factory},
-			"aws":     {Factory: credAws.Factory},
-			"azure":   {Factory: credAzure.Factory},
-			"centrify": {
-				Factory:           credCentrify.Factory,
-				DeprecationStatus: consts.Deprecated,
-			},
-			"cert":       {Factory: credCert.Factory},
-			"cf":         {Factory: credCF.Factory},
-			"gcp":        {Factory: credGcp.Factory},
-			"github":     {Factory: credGitHub.Factory},
-			"jwt":        {Factory: credJWT.Factory},
-			"kerberos":   {Factory: credKerb.Factory},
-			"kubernetes": {Factory: credKube.Factory},
-			"ldap":       {Factory: credLdap.Factory},
-			"oci":        {Factory: credOCI.Factory},
-			"oidc":       {Factory: credJWT.Factory},
-			"okta":       {Factory: credOkta.Factory},
-			"pcf": {
-				Factory:           credCF.Factory,
-				DeprecationStatus: consts.Deprecated,
-			},
-			"radius":   {Factory: credRadius.Factory},
+			"approle":  {Factory: credAppRole.Factory},
+			"cert":     {Factory: credCert.Factory},
+			"jwt":      {Factory: credJWT.Factory},
+			"oidc":     {Factory: credJWT.Factory},
 			"userpass": {Factory: credUserpass.Factory},
 		},
-		databasePlugins: map[string]databasePlugin{
-			// These four plugins all use the same mysql implementation but with
-			// different username settings passed by the constructor.
-			"mysql-database-plugin":        {Factory: dbMysql.New(dbMysql.DefaultUserNameTemplate)},
-			"mysql-aurora-database-plugin": {Factory: dbMysql.New(dbMysql.DefaultLegacyUserNameTemplate)},
-			"mysql-rds-database-plugin":    {Factory: dbMysql.New(dbMysql.DefaultLegacyUserNameTemplate)},
-			"mysql-legacy-database-plugin": {Factory: dbMysql.New(dbMysql.DefaultLegacyUserNameTemplate)},
-
-			"cassandra-database-plugin":         {Factory: dbCass.New},
-			"couchbase-database-plugin":         {Factory: dbCouchbase.New},
-			"elasticsearch-database-plugin":     {Factory: dbElastic.New},
-			"hana-database-plugin":              {Factory: dbHana.New},
-			"influxdb-database-plugin":          {Factory: dbInflux.New},
-			"mongodb-database-plugin":           {Factory: dbMongo.New},
-			"mongodbatlas-database-plugin":      {Factory: dbMongoAtlas.New},
-			"mssql-database-plugin":             {Factory: dbMssql.New},
-			"postgresql-database-plugin":        {Factory: dbPostgres.New},
-			"redshift-database-plugin":          {Factory: dbRedshift.New},
-			"redis-database-plugin":             {Factory: dbRedis.New},
-			"redis-elasticache-database-plugin": {Factory: dbRedisElastiCache.New},
-			"snowflake-database-plugin":         {Factory: dbSnowflake.New},
-		},
+		databasePlugins: map[string]databasePlugin{},
 		logicalBackends: map[string]logicalBackend{
-			"ad": {
-				Factory:           logicalAd.Factory,
-				DeprecationStatus: consts.Deprecated,
-			},
-			"alicloud": {Factory: logicalAlicloud.Factory},
-			"aws":      {Factory: logicalAws.Factory},
-			"azure":    {Factory: logicalAzure.Factory},
-			"cassandra": {
-				Factory:           removedFactory,
-				DeprecationStatus: consts.Removed,
-			},
-			"consul":     {Factory: logicalConsul.Factory},
-			"gcp":        {Factory: logicalGcp.Factory},
-			"gcpkms":     {Factory: logicalGcpKms.Factory},
-			"kubernetes": {Factory: logicalKube.Factory},
-			"kv":         {Factory: logicalKv.Factory},
-			"mongodb": {
-				Factory:           removedFactory,
-				DeprecationStatus: consts.Removed,
-			},
-			// The mongodbatlas secrets engine is not the same as the database plugin equivalent
-			// (`mongodbatlas-database-plugin`), and thus will not be deprecated at this time.
-			"mongodbatlas": {Factory: logicalMongoAtlas.Factory},
-			"mssql": {
-				Factory:           removedFactory,
-				DeprecationStatus: consts.Removed,
-			},
-			"mysql": {
-				Factory:           removedFactory,
-				DeprecationStatus: consts.Removed,
-			},
-			"nomad":    {Factory: logicalNomad.Factory},
-			"openldap": {Factory: logicalLDAP.Factory},
-			"ldap":     {Factory: logicalLDAP.Factory},
-			"pki":      {Factory: logicalPki.Factory},
-			"postgresql": {
-				Factory:           removedFactory,
-				DeprecationStatus: consts.Removed,
-			},
-			"rabbitmq":  {Factory: logicalRabbit.Factory},
-			"ssh":       {Factory: logicalSsh.Factory},
-			"terraform": {Factory: logicalTerraform.Factory},
-			"totp":      {Factory: logicalTotp.Factory},
-			"transit":   {Factory: logicalTransit.Factory},
+			"kv":      {Factory: logicalKv.Factory},
+			"pki":     {Factory: logicalPki.Factory},
+			"ssh":     {Factory: logicalSsh.Factory},
+			"transit": {Factory: logicalTransit.Factory},
 		},
 	}
+}
+
+func newRegistry() *registry {
+	reg := newMinimalRegistry()
+
+	extendAddonPlugins(reg)
 
 	entAddExtPlugins(reg)
 
diff --git a/helper/builtinplugins/registry_full.go b/helper/builtinplugins/registry_full.go
new file mode 100644
index 00000000000..e6dac4585e3
--- /dev/null
+++ b/helper/builtinplugins/registry_full.go
@@ -0,0 +1,150 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !minimal
+
+package builtinplugins
+
+import (
+	"maps"
+
+	credAliCloud "github.com/hashicorp/vault-plugin-auth-alicloud"
+	credAzure "github.com/hashicorp/vault-plugin-auth-azure"
+	credCF "github.com/hashicorp/vault-plugin-auth-cf"
+	credGcp "github.com/hashicorp/vault-plugin-auth-gcp/plugin"
+	credKerb "github.com/hashicorp/vault-plugin-auth-kerberos"
+	credKube "github.com/hashicorp/vault-plugin-auth-kubernetes"
+	credOCI "github.com/hashicorp/vault-plugin-auth-oci"
+	dbCouchbase "github.com/hashicorp/vault-plugin-database-couchbase"
+	dbElastic "github.com/hashicorp/vault-plugin-database-elasticsearch"
+	dbMongoAtlas "github.com/hashicorp/vault-plugin-database-mongodbatlas"
+	dbRedis "github.com/hashicorp/vault-plugin-database-redis"
+	dbRedisElastiCache "github.com/hashicorp/vault-plugin-database-redis-elasticache"
+	dbSnowflake "github.com/hashicorp/vault-plugin-database-snowflake"
+	logicalAd "github.com/hashicorp/vault-plugin-secrets-ad/plugin"
+	logicalAlicloud "github.com/hashicorp/vault-plugin-secrets-alicloud"
+	logicalAzure "github.com/hashicorp/vault-plugin-secrets-azure"
+	logicalGcp "github.com/hashicorp/vault-plugin-secrets-gcp/plugin"
+	logicalGcpKms "github.com/hashicorp/vault-plugin-secrets-gcpkms"
+	logicalKube "github.com/hashicorp/vault-plugin-secrets-kubernetes"
+	logicalMongoAtlas "github.com/hashicorp/vault-plugin-secrets-mongodbatlas"
+	logicalLDAP "github.com/hashicorp/vault-plugin-secrets-openldap"
+	logicalTerraform "github.com/hashicorp/vault-plugin-secrets-terraform"
+	credAws "github.com/hashicorp/vault/builtin/credential/aws"
+	credGitHub "github.com/hashicorp/vault/builtin/credential/github"
+	credLdap "github.com/hashicorp/vault/builtin/credential/ldap"
+	credOkta "github.com/hashicorp/vault/builtin/credential/okta"
+	credRadius "github.com/hashicorp/vault/builtin/credential/radius"
+	logicalAws "github.com/hashicorp/vault/builtin/logical/aws"
+	logicalConsul "github.com/hashicorp/vault/builtin/logical/consul"
+	logicalNomad "github.com/hashicorp/vault/builtin/logical/nomad"
+	logicalRabbit "github.com/hashicorp/vault/builtin/logical/rabbitmq"
+	logicalTotp "github.com/hashicorp/vault/builtin/logical/totp"
+	"github.com/hashicorp/vault/helper/pluginconsts"
+	dbCass "github.com/hashicorp/vault/plugins/database/cassandra"
+	dbHana "github.com/hashicorp/vault/plugins/database/hana"
+	dbInflux "github.com/hashicorp/vault/plugins/database/influxdb"
+	dbMongo "github.com/hashicorp/vault/plugins/database/mongodb"
+	dbMssql "github.com/hashicorp/vault/plugins/database/mssql"
+	dbMysql "github.com/hashicorp/vault/plugins/database/mysql"
+	dbPostgres "github.com/hashicorp/vault/plugins/database/postgresql"
+	dbRedshift "github.com/hashicorp/vault/plugins/database/redshift"
+	"github.com/hashicorp/vault/sdk/helper/consts"
+)
+
+func newFullAddonRegistry() *registry {
+	return &registry{
+		credentialBackends: map[string]credentialBackend{
+			pluginconsts.AuthTypeAliCloud: {Factory: credAliCloud.Factory},
+			pluginconsts.AuthTypeAppId: {
+				Factory:           removedFactory,
+				DeprecationStatus: consts.Removed,
+			},
+			pluginconsts.AuthTypeAWS:        {Factory: credAws.Factory},
+			pluginconsts.AuthTypeAzure:      {Factory: credAzure.Factory},
+			pluginconsts.AuthTypeCF:         {Factory: credCF.Factory},
+			pluginconsts.AuthTypeGCP:        {Factory: credGcp.Factory},
+			pluginconsts.AuthTypeGitHub:     {Factory: credGitHub.Factory},
+			pluginconsts.AuthTypeKerberos:   {Factory: credKerb.Factory},
+			pluginconsts.AuthTypeKubernetes: {Factory: credKube.Factory},
+			pluginconsts.AuthTypeLDAP:       {Factory: credLdap.Factory},
+			pluginconsts.AuthTypeOCI:        {Factory: credOCI.Factory},
+			pluginconsts.AuthTypeOkta:       {Factory: credOkta.Factory},
+			pluginconsts.AuthTypePCF: {
+				Factory:           credCF.Factory,
+				DeprecationStatus: consts.Deprecated,
+			},
+			pluginconsts.AuthTypeRadius: {Factory: credRadius.Factory},
+		},
+		databasePlugins: map[string]databasePlugin{
+			// These four plugins all use the same mysql implementation but with
+			// different username settings passed by the constructor.
+			"mysql-database-plugin":        {Factory: dbMysql.New(dbMysql.DefaultUserNameTemplate)},
+			"mysql-aurora-database-plugin": {Factory: dbMysql.New(dbMysql.DefaultLegacyUserNameTemplate)},
+			"mysql-rds-database-plugin":    {Factory: dbMysql.New(dbMysql.DefaultLegacyUserNameTemplate)},
+			"mysql-legacy-database-plugin": {Factory: dbMysql.New(dbMysql.DefaultLegacyUserNameTemplate)},
+
+			"cassandra-database-plugin":         {Factory: dbCass.New},
+			"couchbase-database-plugin":         {Factory: dbCouchbase.New},
+			"elasticsearch-database-plugin":     {Factory: dbElastic.New},
+			"hana-database-plugin":              {Factory: dbHana.New},
+			"influxdb-database-plugin":          {Factory: dbInflux.New},
+			"mongodb-database-plugin":           {Factory: dbMongo.New},
+			"mongodbatlas-database-plugin":      {Factory: dbMongoAtlas.New},
+			"mssql-database-plugin":             {Factory: dbMssql.New},
+			"postgresql-database-plugin":        {Factory: dbPostgres.New},
+			"redshift-database-plugin":          {Factory: dbRedshift.New},
+			"redis-database-plugin":             {Factory: dbRedis.New},
+			"redis-elasticache-database-plugin": {Factory: dbRedisElastiCache.New},
+			"snowflake-database-plugin":         {Factory: dbSnowflake.New},
+		},
+		logicalBackends: map[string]logicalBackend{
+			pluginconsts.SecretEngineAD: {
+				Factory:           logicalAd.Factory,
+				DeprecationStatus: consts.Deprecated,
+			},
+			pluginconsts.SecretEngineAlicloud: {Factory: logicalAlicloud.Factory},
+			pluginconsts.SecretEngineAWS:      {Factory: logicalAws.Factory},
+			pluginconsts.SecretEngineAzure:    {Factory: logicalAzure.Factory},
+			pluginconsts.SecretEngineCassandra: {
+				Factory:           removedFactory,
+				DeprecationStatus: consts.Removed,
+			},
+			pluginconsts.SecretEngineConsul:     {Factory: logicalConsul.Factory},
+			pluginconsts.SecretEngineGCP:        {Factory: logicalGcp.Factory},
+			pluginconsts.SecretEngineGCPKMS:     {Factory: logicalGcpKms.Factory},
+			pluginconsts.SecretEngineKubernetes: {Factory: logicalKube.Factory},
+			pluginconsts.SecretEngineMongoDB: {
+				Factory:           removedFactory,
+				DeprecationStatus: consts.Removed,
+			},
+			pluginconsts.SecretEngineMongoDBAtlas: {Factory: logicalMongoAtlas.Factory},
+			pluginconsts.SecretEngineMSSQL: {
+				Factory:           removedFactory,
+				DeprecationStatus: consts.Removed,
+			},
+			pluginconsts.SecretEngineMySQL: {
+				Factory:           removedFactory,
+				DeprecationStatus: consts.Removed,
+			},
+			pluginconsts.SecretEngineNomad:    {Factory: logicalNomad.Factory},
+			pluginconsts.SecretEngineOpenLDAP: {Factory: logicalLDAP.Factory},
+			pluginconsts.SecretEngineLDAP:     {Factory: logicalLDAP.Factory},
+			pluginconsts.SecretEnginePostgresql: {
+				Factory:           removedFactory,
+				DeprecationStatus: consts.Removed,
+			},
+			pluginconsts.SecretEngineRabbitMQ:  {Factory: logicalRabbit.Factory},
+			pluginconsts.SecretEngineTerraform: {Factory: logicalTerraform.Factory},
+			pluginconsts.SecretEngineTOTP:      {Factory: logicalTotp.Factory},
+		},
+	}
+}
+
+func extendAddonPlugins(reg *registry) {
+	addonReg := newFullAddonRegistry()
+
+	maps.Copy(reg.credentialBackends, addonReg.credentialBackends)
+	maps.Copy(reg.databasePlugins, addonReg.databasePlugins)
+	maps.Copy(reg.logicalBackends, addonReg.logicalBackends)
+}
diff --git a/helper/builtinplugins/registry_full_test.go b/helper/builtinplugins/registry_full_test.go
new file mode 100644
index 00000000000..a8667cf7867
--- /dev/null
+++ b/helper/builtinplugins/registry_full_test.go
@@ -0,0 +1,30 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise && !minimal
+
+package builtinplugins
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Test_newRegistry tests that newRegistry() returns a registry with
+// the expected minimal registry extended with full addon registry
+func Test_newRegistry(t *testing.T) {
+	actual := newRegistry()
+	expMinimal := newMinimalRegistry()
+	expFullAddon := newFullAddonRegistry()
+
+	require.Equal(t, len(expMinimal.credentialBackends)+len(expFullAddon.credentialBackends), len(actual.credentialBackends),
+		"newRegistry() total auth backends mismatch total of minimal and full addon registries")
+	require.Equal(t, len(expMinimal.databasePlugins)+len(expFullAddon.databasePlugins), len(actual.databasePlugins),
+		"newRegistry() total database plugins mismatch total of minimal and full addon registries")
+	require.Equal(t, len(expMinimal.logicalBackends)+len(expFullAddon.logicalBackends), len(actual.logicalBackends),
+		"newRegistry() total logical backends mismatch total of minimal and full addon registries")
+
+	assertRegistrySubset(t, actual, expMinimal, "common")
+	assertRegistrySubset(t, actual, expFullAddon, "full addon")
+}
diff --git a/helper/builtinplugins/registry_min.go b/helper/builtinplugins/registry_min.go
new file mode 100644
index 00000000000..a3ef40445b8
--- /dev/null
+++ b/helper/builtinplugins/registry_min.go
@@ -0,0 +1,10 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build minimal
+
+package builtinplugins
+
+func extendAddonPlugins(_ *registry) {
+	// No-op
+}
diff --git a/helper/builtinplugins/registry_stubs_oss.go b/helper/builtinplugins/registry_stubs_oss.go
index fa0dab8b665..f45c7d3760d 100644
--- a/helper/builtinplugins/registry_stubs_oss.go
+++ b/helper/builtinplugins/registry_stubs_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/helper/builtinplugins/registry_test.go b/helper/builtinplugins/registry_test.go
index 0602ec8bee0..67b2e8c7033 100644
--- a/helper/builtinplugins/registry_test.go
+++ b/helper/builtinplugins/registry_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package builtinplugins
@@ -98,8 +98,8 @@ func Test_RegistryKeyCounts(t *testing.T) {
 		{
 			name:       "number of auth plugins",
 			pluginType: consts.PluginTypeCredential,
-			want:       19,
-			entWant:    1,
+			want:       18,
+			entWant:    3,
 		},
 		{
 			name:       "number of database plugins",
diff --git a/helper/builtinplugins/registry_testing_util.go b/helper/builtinplugins/registry_testing_util.go
new file mode 100644
index 00000000000..1531b0ec6a3
--- /dev/null
+++ b/helper/builtinplugins/registry_testing_util.go
@@ -0,0 +1,27 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package builtinplugins
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func assertRegistrySubset(t *testing.T, r, subset *registry, subsetName string) {
+	t.Helper()
+
+	for k := range subset.credentialBackends {
+		require.Contains(t, r.credentialBackends, k, fmt.Sprintf("expected to contain %s auth backend", subsetName))
+	}
+
+	for k := range subset.databasePlugins {
+		require.Contains(t, r.databasePlugins, k, fmt.Sprintf("expected to contain %s database plugin", subsetName))
+	}
+
+	for k := range subset.logicalBackends {
+		require.Contains(t, r.logicalBackends, k, fmt.Sprintf("expected to contain %s logical backend", subsetName))
+	}
+}
diff --git a/helper/builtinplugins/registry_util.go b/helper/builtinplugins/registry_util.go
index 257bc855628..c9255504ccf 100644
--- a/helper/builtinplugins/registry_util.go
+++ b/helper/builtinplugins/registry_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/helper/constants/constants_oss.go b/helper/constants/constants_oss.go
index ac1179cc22e..ef3fed62266 100644
--- a/helper/constants/constants_oss.go
+++ b/helper/constants/constants_oss.go
@@ -1,8 +1,8 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
 
 package constants
 
-var IsEnterprise = false
+const IsEnterprise = false
diff --git a/helper/constants/fips.go b/helper/constants/fips.go
index f5ecc66ce47..75e716da236 100644
--- a/helper/constants/fips.go
+++ b/helper/constants/fips.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !fips
diff --git a/helper/constants/fips_build_check.go b/helper/constants/fips_build_check.go
index cb2bf5edc83..9a27a2d1acd 100644
--- a/helper/constants/fips_build_check.go
+++ b/helper/constants/fips_build_check.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build (!fips && (fips_140_2 || fips_140_3)) || (fips && !fips_140_2 && !fips_140_3) || (fips_140_2 && fips_140_3)
diff --git a/helper/constants/fips_cgo_check.go b/helper/constants/fips_cgo_check.go
index 409b713afdc..f5e346411b4 100644
--- a/helper/constants/fips_cgo_check.go
+++ b/helper/constants/fips_cgo_check.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build (fips || fips_140_2 || fips_140_3) && !cgo
diff --git a/helper/dhutil/dhutil.go b/helper/dhutil/dhutil.go
index 7c14cb29fbc..97ffe25ad37 100644
--- a/helper/dhutil/dhutil.go
+++ b/helper/dhutil/dhutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package dhutil
@@ -30,14 +30,17 @@ type Envelope struct {
 // generatePublicPrivateKey uses curve25519 to generate a public and private key
 // pair.
 func GeneratePublicPrivateKey() ([]byte, []byte, error) {
-	var scalar, public [32]byte
+	scalar := make([]byte, 32)
 
-	if _, err := io.ReadFull(rand.Reader, scalar[:]); err != nil {
+	if _, err := io.ReadFull(rand.Reader, scalar); err != nil {
 		return nil, nil, err
 	}
 
-	curve25519.ScalarBaseMult(&public, &scalar)
-	return public[:], scalar[:], nil
+	public, err := curve25519.X25519(scalar, curve25519.Basepoint)
+	if err != nil {
+		return nil, nil, err
+	}
+	return public, scalar, nil
 }
 
 // GenerateSharedSecret uses the private key and the other party's public key to
diff --git a/helper/dhutil/dhutil_test.go b/helper/dhutil/dhutil_test.go
index 18cd2c064f8..22c4e22594d 100644
--- a/helper/dhutil/dhutil_test.go
+++ b/helper/dhutil/dhutil_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package dhutil
diff --git a/helper/experiments/experiments.go b/helper/experiments/experiments.go
index 7bbe8b6af1e..97746b15dac 100644
--- a/helper/experiments/experiments.go
+++ b/helper/experiments/experiments.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package experiments
diff --git a/helper/fairshare/fairshare_testing_util.go b/helper/fairshare/fairshare_testing_util.go
index 5aae025f5e9..097e60bd042 100644
--- a/helper/fairshare/fairshare_testing_util.go
+++ b/helper/fairshare/fairshare_testing_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package fairshare
diff --git a/helper/fairshare/jobmanager.go b/helper/fairshare/jobmanager.go
index 73a115644be..05eb2616225 100644
--- a/helper/fairshare/jobmanager.go
+++ b/helper/fairshare/jobmanager.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package fairshare
diff --git a/helper/fairshare/jobmanager_test.go b/helper/fairshare/jobmanager_test.go
index 288f0d2f949..e81aea8daaf 100644
--- a/helper/fairshare/jobmanager_test.go
+++ b/helper/fairshare/jobmanager_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package fairshare
diff --git a/helper/fairshare/workerpool.go b/helper/fairshare/workerpool.go
index ef6ee3ad7b5..82126f97d7b 100644
--- a/helper/fairshare/workerpool.go
+++ b/helper/fairshare/workerpool.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package fairshare
diff --git a/helper/fairshare/workerpool_test.go b/helper/fairshare/workerpool_test.go
index d347c673466..0e945c02b21 100644
--- a/helper/fairshare/workerpool_test.go
+++ b/helper/fairshare/workerpool_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package fairshare
diff --git a/helper/flag-kv/flag.go b/helper/flag-kv/flag.go
index f09332c3ff2..184b2fe575a 100644
--- a/helper/flag-kv/flag.go
+++ b/helper/flag-kv/flag.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kvFlag
diff --git a/helper/flag-kv/flag_test.go b/helper/flag-kv/flag_test.go
index 91a34440397..51ab521f0e5 100644
--- a/helper/flag-kv/flag_test.go
+++ b/helper/flag-kv/flag_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kvFlag
diff --git a/helper/flag-slice/flag.go b/helper/flag-slice/flag.go
index 1824fc8477f..06ee66d1e49 100644
--- a/helper/flag-slice/flag.go
+++ b/helper/flag-slice/flag.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package sliceflag
diff --git a/helper/flag-slice/flag_test.go b/helper/flag-slice/flag_test.go
index 6662446df7d..22190207b0e 100644
--- a/helper/flag-slice/flag_test.go
+++ b/helper/flag-slice/flag_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package sliceflag
diff --git a/helper/forwarding/types.pb.go b/helper/forwarding/types.pb.go
index feb855208c3..3d3cc72e5d7 100644
--- a/helper/forwarding/types.pb.go
+++ b/helper/forwarding/types.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: helper/forwarding/types.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -24,29 +25,26 @@ const (
 )
 
 type Request struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Not used right now but reserving in case it turns out that streaming
 	// makes things more economical on the gRPC side
 	// uint64 id = 1;
 	Method           string                  `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"`
 	Url              *URL                    `protobuf:"bytes,3,opt,name=url,proto3" json:"url,omitempty"`
-	HeaderEntries    map[string]*HeaderEntry `protobuf:"bytes,4,rep,name=header_entries,json=headerEntries,proto3" json:"header_entries,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	HeaderEntries    map[string]*HeaderEntry `protobuf:"bytes,4,rep,name=header_entries,json=headerEntries,proto3" json:"header_entries,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	Body             []byte                  `protobuf:"bytes,5,opt,name=body,proto3" json:"body,omitempty"`
 	Host             string                  `protobuf:"bytes,6,opt,name=host,proto3" json:"host,omitempty"`
 	RemoteAddr       string                  `protobuf:"bytes,7,opt,name=remote_addr,json=remoteAddr,proto3" json:"remote_addr,omitempty"`
 	PeerCertificates [][]byte                `protobuf:"bytes,8,rep,name=peer_certificates,json=peerCertificates,proto3" json:"peer_certificates,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *Request) Reset() {
 	*x = Request{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_forwarding_types_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_forwarding_types_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Request) String() string {
@@ -57,7 +55,7 @@ func (*Request) ProtoMessage() {}
 
 func (x *Request) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_forwarding_types_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -122,12 +120,9 @@ func (x *Request) GetPeerCertificates() [][]byte {
 }
 
 type URL struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Scheme string `protobuf:"bytes,1,opt,name=scheme,proto3" json:"scheme,omitempty"`
-	Opaque string `protobuf:"bytes,2,opt,name=opaque,proto3" json:"opaque,omitempty"`
+	state  protoimpl.MessageState `protogen:"open.v1"`
+	Scheme string                 `protobuf:"bytes,1,opt,name=scheme,proto3" json:"scheme,omitempty"`
+	Opaque string                 `protobuf:"bytes,2,opt,name=opaque,proto3" json:"opaque,omitempty"`
 	// This isn't needed now but might be in the future, so we'll skip the
 	// number to keep the ordering in net/url
 	// UserInfo user = 3;
@@ -136,17 +131,17 @@ type URL struct {
 	RawPath string `protobuf:"bytes,6,opt,name=raw_path,json=rawPath,proto3" json:"raw_path,omitempty"`
 	// This also isn't needed right now, but we'll reserve the number
 	// bool force_query = 7;
-	RawQuery string `protobuf:"bytes,8,opt,name=raw_query,json=rawQuery,proto3" json:"raw_query,omitempty"`
-	Fragment string `protobuf:"bytes,9,opt,name=fragment,proto3" json:"fragment,omitempty"`
+	RawQuery      string `protobuf:"bytes,8,opt,name=raw_query,json=rawQuery,proto3" json:"raw_query,omitempty"`
+	Fragment      string `protobuf:"bytes,9,opt,name=fragment,proto3" json:"fragment,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *URL) Reset() {
 	*x = URL{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_forwarding_types_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_forwarding_types_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *URL) String() string {
@@ -157,7 +152,7 @@ func (*URL) ProtoMessage() {}
 
 func (x *URL) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_forwarding_types_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -222,20 +217,17 @@ func (x *URL) GetFragment() string {
 }
 
 type HeaderEntry struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Values        []string               `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Values []string `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *HeaderEntry) Reset() {
 	*x = HeaderEntry{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_forwarding_types_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_forwarding_types_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *HeaderEntry) String() string {
@@ -246,7 +238,7 @@ func (*HeaderEntry) ProtoMessage() {}
 
 func (x *HeaderEntry) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_forwarding_types_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -269,10 +261,7 @@ func (x *HeaderEntry) GetValues() []string {
 }
 
 type Response struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Not used right now but reserving in case it turns out that streaming
 	// makes things more economical on the gRPC side
 	// uint64 id = 1;
@@ -280,17 +269,17 @@ type Response struct {
 	Body       []byte `protobuf:"bytes,3,opt,name=body,proto3" json:"body,omitempty"`
 	// Added in 0.6.2 to ensure that the content-type is set appropriately, as
 	// well as any other information
-	HeaderEntries map[string]*HeaderEntry `protobuf:"bytes,4,rep,name=header_entries,json=headerEntries,proto3" json:"header_entries,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	HeaderEntries map[string]*HeaderEntry `protobuf:"bytes,4,rep,name=header_entries,json=headerEntries,proto3" json:"header_entries,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	LastRemoteWal uint64                  `protobuf:"varint,5,opt,name=last_remote_wal,json=lastRemoteWal,proto3" json:"last_remote_wal,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Response) Reset() {
 	*x = Response{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_forwarding_types_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_forwarding_types_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Response) String() string {
@@ -301,7 +290,7 @@ func (*Response) ProtoMessage() {}
 
 func (x *Response) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_forwarding_types_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -346,7 +335,7 @@ func (x *Response) GetLastRemoteWal() uint64 {
 
 var File_helper_forwarding_types_proto protoreflect.FileDescriptor
 
-var file_helper_forwarding_types_proto_rawDesc = []byte{
+var file_helper_forwarding_types_proto_rawDesc = string([]byte{
 	0x0a, 0x1d, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x2f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
 	0x69, 0x6e, 0x67, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
 	0x0a, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x22, 0xe4, 0x02, 0x0a, 0x07,
@@ -407,22 +396,22 @@ var file_helper_forwarding_types_proto_rawDesc = []byte{
 	0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74,
 	0x2f, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x2f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69,
 	0x6e, 0x67, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_helper_forwarding_types_proto_rawDescOnce sync.Once
-	file_helper_forwarding_types_proto_rawDescData = file_helper_forwarding_types_proto_rawDesc
+	file_helper_forwarding_types_proto_rawDescData []byte
 )
 
 func file_helper_forwarding_types_proto_rawDescGZIP() []byte {
 	file_helper_forwarding_types_proto_rawDescOnce.Do(func() {
-		file_helper_forwarding_types_proto_rawDescData = protoimpl.X.CompressGZIP(file_helper_forwarding_types_proto_rawDescData)
+		file_helper_forwarding_types_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_helper_forwarding_types_proto_rawDesc), len(file_helper_forwarding_types_proto_rawDesc)))
 	})
 	return file_helper_forwarding_types_proto_rawDescData
 }
 
 var file_helper_forwarding_types_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
-var file_helper_forwarding_types_proto_goTypes = []interface{}{
+var file_helper_forwarding_types_proto_goTypes = []any{
 	(*Request)(nil),     // 0: forwarding.Request
 	(*URL)(nil),         // 1: forwarding.URL
 	(*HeaderEntry)(nil), // 2: forwarding.HeaderEntry
@@ -448,61 +437,11 @@ func file_helper_forwarding_types_proto_init() {
 	if File_helper_forwarding_types_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_helper_forwarding_types_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Request); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_forwarding_types_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*URL); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_forwarding_types_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HeaderEntry); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_forwarding_types_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Response); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_helper_forwarding_types_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_helper_forwarding_types_proto_rawDesc), len(file_helper_forwarding_types_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   6,
 			NumExtensions: 0,
@@ -513,7 +452,6 @@ func file_helper_forwarding_types_proto_init() {
 		MessageInfos:      file_helper_forwarding_types_proto_msgTypes,
 	}.Build()
 	File_helper_forwarding_types_proto = out.File
-	file_helper_forwarding_types_proto_rawDesc = nil
 	file_helper_forwarding_types_proto_goTypes = nil
 	file_helper_forwarding_types_proto_depIdxs = nil
 }
diff --git a/helper/forwarding/types.proto b/helper/forwarding/types.proto
index 9dfce583c21..995244096e8 100644
--- a/helper/forwarding/types.proto
+++ b/helper/forwarding/types.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
diff --git a/helper/forwarding/util.go b/helper/forwarding/util.go
index e9d06de0485..cae533ee447 100644
--- a/helper/forwarding/util.go
+++ b/helper/forwarding/util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package forwarding
@@ -26,8 +26,8 @@ func (b bufCloser) Close() error {
 	return nil
 }
 
-// GenerateForwardedRequest generates a new http.Request that contains the
-// original requests's information in the new request's body.
+// GenerateForwardedHTTPRequest generates a new http.Request that contains the
+// original request's information in the new request's body.
 func GenerateForwardedHTTPRequest(req *http.Request, addr string) (*http.Request, error) {
 	fq, err := GenerateForwardedRequest(req)
 	if err != nil {
@@ -101,7 +101,7 @@ func GenerateForwardedRequest(req *http.Request) (*Request, error) {
 	return &fq, nil
 }
 
-// ParseForwardedRequest generates a new http.Request that is comprised of the
+// ParseForwardedHTTPRequest generates a new http.Request that is comprised of the
 // values in the given request's body, assuming it correctly parses into a
 // ForwardedRequest.
 func ParseForwardedHTTPRequest(req *http.Request) (*http.Request, error) {
diff --git a/helper/forwarding/util_test.go b/helper/forwarding/util_test.go
index 0bf4be76945..512a65645dc 100644
--- a/helper/forwarding/util_test.go
+++ b/helper/forwarding/util_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package forwarding
diff --git a/helper/hostutil/hostinfo.go b/helper/hostutil/hostinfo.go
index e892ae8a629..f4890b6f2da 100644
--- a/helper/hostutil/hostinfo.go
+++ b/helper/hostutil/hostinfo.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !openbsd
diff --git a/helper/hostutil/hostinfo_error.go b/helper/hostutil/hostinfo_error.go
index 2cce22cb7d5..62866163914 100644
--- a/helper/hostutil/hostinfo_error.go
+++ b/helper/hostutil/hostinfo_error.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package hostutil
diff --git a/helper/hostutil/hostinfo_openbsd.go b/helper/hostutil/hostinfo_openbsd.go
index a73bb2df16f..db7ae315226 100644
--- a/helper/hostutil/hostinfo_openbsd.go
+++ b/helper/hostutil/hostinfo_openbsd.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build openbsd
diff --git a/helper/hostutil/hostinfo_test.go b/helper/hostutil/hostinfo_test.go
index 6862cacf790..260fb2f17f8 100644
--- a/helper/hostutil/hostinfo_test.go
+++ b/helper/hostutil/hostinfo_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package hostutil
diff --git a/helper/identity/identity.go b/helper/identity/identity.go
index 2d625c4bcc6..98c047a505a 100644
--- a/helper/identity/identity.go
+++ b/helper/identity/identity.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
@@ -58,6 +58,22 @@ func (e *Entity) UpsertAlias(alias *Alias) {
 	e.Aliases = append(e.Aliases, alias)
 }
 
+func (e *Entity) DeleteAliasByID(aliasID string) {
+	idx := -1
+	for i, item := range e.Aliases {
+		if item.ID == aliasID {
+			idx = i
+			break
+		}
+	}
+
+	if idx < 0 {
+		return
+	}
+
+	e.Aliases = append(e.Aliases[:idx], e.Aliases[idx+1:]...)
+}
+
 func (p *Alias) Clone() (*Alias, error) {
 	if p == nil {
 		return nil, fmt.Errorf("nil alias")
diff --git a/helper/identity/mfa/mfa.go b/helper/identity/mfa/mfa.go
index a040563b502..628ed61d21f 100644
--- a/helper/identity/mfa/mfa.go
+++ b/helper/identity/mfa/mfa.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mfa
diff --git a/helper/identity/mfa/sentinel.go b/helper/identity/mfa/sentinel.go
index 02bc857ceb0..2a93db03d6a 100644
--- a/helper/identity/mfa/sentinel.go
+++ b/helper/identity/mfa/sentinel.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mfa
diff --git a/helper/identity/mfa/types.pb.go b/helper/identity/mfa/types.pb.go
index 2773679ff4a..945d5614824 100644
--- a/helper/identity/mfa/types.pb.go
+++ b/helper/identity/mfa/types.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: helper/identity/mfa/types.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -28,10 +29,7 @@ const (
 // Configuration information differs by type. Handler of each type should know
 // what to expect from the Config field.
 type Config struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// @inject_tag: sentinel:"-"
 	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
@@ -44,7 +42,7 @@ type Config struct {
 	UsernameFormat string `protobuf:"bytes,5,opt,name=username_format,json=usernameFormat,proto3" json:"username_format,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
 	//
-	// Types that are assignable to Config:
+	// Types that are valid to be assigned to Config:
 	//
 	//	*Config_TOTPConfig
 	//	*Config_OktaConfig
@@ -52,16 +50,16 @@ type Config struct {
 	//	*Config_PingIDConfig
 	Config isConfig_Config `protobuf_oneof:"config" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
-	NamespaceID string `protobuf:"bytes,10,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty" sentinel:"-"`
+	NamespaceID   string `protobuf:"bytes,10,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty" sentinel:"-"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Config) Reset() {
 	*x = Config{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_mfa_types_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_mfa_types_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Config) String() string {
@@ -72,7 +70,7 @@ func (*Config) ProtoMessage() {}
 
 func (x *Config) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_mfa_types_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -122,37 +120,45 @@ func (x *Config) GetUsernameFormat() string {
 	return ""
 }
 
-func (m *Config) GetConfig() isConfig_Config {
-	if m != nil {
-		return m.Config
+func (x *Config) GetConfig() isConfig_Config {
+	if x != nil {
+		return x.Config
 	}
 	return nil
 }
 
 func (x *Config) GetTOTPConfig() *TOTPConfig {
-	if x, ok := x.GetConfig().(*Config_TOTPConfig); ok {
-		return x.TOTPConfig
+	if x != nil {
+		if x, ok := x.Config.(*Config_TOTPConfig); ok {
+			return x.TOTPConfig
+		}
 	}
 	return nil
 }
 
 func (x *Config) GetOktaConfig() *OktaConfig {
-	if x, ok := x.GetConfig().(*Config_OktaConfig); ok {
-		return x.OktaConfig
+	if x != nil {
+		if x, ok := x.Config.(*Config_OktaConfig); ok {
+			return x.OktaConfig
+		}
 	}
 	return nil
 }
 
 func (x *Config) GetDuoConfig() *DuoConfig {
-	if x, ok := x.GetConfig().(*Config_DuoConfig); ok {
-		return x.DuoConfig
+	if x != nil {
+		if x, ok := x.Config.(*Config_DuoConfig); ok {
+			return x.DuoConfig
+		}
 	}
 	return nil
 }
 
 func (x *Config) GetPingIDConfig() *PingIDConfig {
-	if x, ok := x.GetConfig().(*Config_PingIDConfig); ok {
-		return x.PingIDConfig
+	if x != nil {
+		if x, ok := x.Config.(*Config_PingIDConfig); ok {
+			return x.PingIDConfig
+		}
 	}
 	return nil
 }
@@ -198,10 +204,7 @@ func (*Config_PingIDConfig) isConfig_Config() {}
 // by the information stored in the entity and not from the values in the
 // configuration.
 type TOTPConfig struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// @inject_tag: sentinel:"-"
 	Issuer string `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
@@ -218,15 +221,17 @@ type TOTPConfig struct {
 	QRSize int32 `protobuf:"varint,7,opt,name=qr_size,json=qrSize,proto3" json:"qr_size,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
 	MaxValidationAttempts uint32 `protobuf:"varint,8,opt,name=max_validation_attempts,json=maxValidationAttempts,proto3" json:"max_validation_attempts,omitempty" sentinel:"-"`
+	// @inject_tag: sentinel:"-"
+	EnableSelfEnrollment bool `protobuf:"varint,9,opt,name=enable_self_enrollment,json=enableSelfEnrollment,proto3" json:"enable_self_enrollment,omitempty" sentinel:"-"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
 }
 
 func (x *TOTPConfig) Reset() {
 	*x = TOTPConfig{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_mfa_types_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_mfa_types_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *TOTPConfig) String() string {
@@ -237,7 +242,7 @@ func (*TOTPConfig) ProtoMessage() {}
 
 func (x *TOTPConfig) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_mfa_types_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -308,13 +313,17 @@ func (x *TOTPConfig) GetMaxValidationAttempts() uint32 {
 	return 0
 }
 
+func (x *TOTPConfig) GetEnableSelfEnrollment() bool {
+	if x != nil {
+		return x.EnableSelfEnrollment
+	}
+	return false
+}
+
 // DuoConfig represents the configuration information required to perform
 // Duo authentication.
 type DuoConfig struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// @inject_tag: sentinel:"-"
 	IntegrationKey string `protobuf:"bytes,1,opt,name=integration_key,json=integrationKey,proto3" json:"integration_key,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
@@ -324,16 +333,16 @@ type DuoConfig struct {
 	// @inject_tag: sentinel:"-"
 	PushInfo string `protobuf:"bytes,4,opt,name=push_info,json=pushInfo,proto3" json:"push_info,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
-	UsePasscode bool `protobuf:"varint,5,opt,name=use_passcode,json=usePasscode,proto3" json:"use_passcode,omitempty" sentinel:"-"`
+	UsePasscode   bool `protobuf:"varint,5,opt,name=use_passcode,json=usePasscode,proto3" json:"use_passcode,omitempty" sentinel:"-"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DuoConfig) Reset() {
 	*x = DuoConfig{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_mfa_types_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_mfa_types_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DuoConfig) String() string {
@@ -344,7 +353,7 @@ func (*DuoConfig) ProtoMessage() {}
 
 func (x *DuoConfig) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_mfa_types_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -397,10 +406,7 @@ func (x *DuoConfig) GetUsePasscode() bool {
 // OktaConfig contains Okta configuration parameters required to perform Okta
 // authentication.
 type OktaConfig struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// @inject_tag: sentinel:"-"
 	OrgName string `protobuf:"bytes,1,opt,name=org_name,json=orgName,proto3" json:"org_name,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
@@ -410,16 +416,16 @@ type OktaConfig struct {
 	// @inject_tag: sentinel:"-"
 	BaseURL string `protobuf:"bytes,4,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
-	PrimaryEmail bool `protobuf:"varint,5,opt,name=primary_email,json=primaryEmail,proto3" json:"primary_email,omitempty" sentinel:"-"`
+	PrimaryEmail  bool `protobuf:"varint,5,opt,name=primary_email,json=primaryEmail,proto3" json:"primary_email,omitempty" sentinel:"-"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *OktaConfig) Reset() {
 	*x = OktaConfig{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_mfa_types_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_mfa_types_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *OktaConfig) String() string {
@@ -430,7 +436,7 @@ func (*OktaConfig) ProtoMessage() {}
 
 func (x *OktaConfig) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_mfa_types_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -482,10 +488,7 @@ func (x *OktaConfig) GetPrimaryEmail() bool {
 
 // PingIDConfig contains PingID configuration information
 type PingIDConfig struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// @inject_tag: sentinel:"-"
 	UseBase64Key string `protobuf:"bytes,1,opt,name=use_base64_key,json=useBase64Key,proto3" json:"use_base64_key,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
@@ -500,15 +503,15 @@ type PingIDConfig struct {
 	AdminURL string `protobuf:"bytes,6,opt,name=admin_url,json=adminUrl,proto3" json:"admin_url,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
 	AuthenticatorURL string `protobuf:"bytes,7,opt,name=authenticator_url,json=authenticatorUrl,proto3" json:"authenticator_url,omitempty" sentinel:"-"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *PingIDConfig) Reset() {
 	*x = PingIDConfig{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_mfa_types_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_mfa_types_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *PingIDConfig) String() string {
@@ -519,7 +522,7 @@ func (*PingIDConfig) ProtoMessage() {}
 
 func (x *PingIDConfig) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_mfa_types_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -586,25 +589,22 @@ func (x *PingIDConfig) GetAuthenticatorURL() string {
 // Secret represents all the types of secrets which the entity can hold.
 // Each MFA type should add a secret type to the oneof block in this message.
 type Secret struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// @inject_tag: sentinel:"-"
 	MethodName string `protobuf:"bytes,1,opt,name=method_name,json=methodName,proto3" json:"method_name,omitempty" sentinel:"-"`
-	// Types that are assignable to Value:
+	// Types that are valid to be assigned to Value:
 	//
 	//	*Secret_TOTPSecret
-	Value isSecret_Value `protobuf_oneof:"value"`
+	Value         isSecret_Value `protobuf_oneof:"value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Secret) Reset() {
 	*x = Secret{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_mfa_types_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_mfa_types_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Secret) String() string {
@@ -615,7 +615,7 @@ func (*Secret) ProtoMessage() {}
 
 func (x *Secret) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_mfa_types_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -637,16 +637,18 @@ func (x *Secret) GetMethodName() string {
 	return ""
 }
 
-func (m *Secret) GetValue() isSecret_Value {
-	if m != nil {
-		return m.Value
+func (x *Secret) GetValue() isSecret_Value {
+	if x != nil {
+		return x.Value
 	}
 	return nil
 }
 
 func (x *Secret) GetTOTPSecret() *TOTPSecret {
-	if x, ok := x.GetValue().(*Secret_TOTPSecret); ok {
-		return x.TOTPSecret
+	if x != nil {
+		if x, ok := x.Value.(*Secret_TOTPSecret); ok {
+			return x.TOTPSecret
+		}
 	}
 	return nil
 }
@@ -666,10 +668,7 @@ func (*Secret_TOTPSecret) isSecret_Value() {}
 // particular MFA method. This information is used to validate the MFA
 // credential supplied over the API during request time.
 type TOTPSecret struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// @inject_tag: sentinel:"-"
 	Issuer string `protobuf:"bytes,1,opt,name=issuer,proto3" json:"issuer,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
@@ -686,16 +685,16 @@ type TOTPSecret struct {
 	// @inject_tag: sentinel:"-"
 	AccountName string `protobuf:"bytes,8,opt,name=account_name,json=accountName,proto3" json:"account_name,omitempty" sentinel:"-"`
 	// @inject_tag: sentinel:"-"
-	Key string `protobuf:"bytes,9,opt,name=key,proto3" json:"key,omitempty" sentinel:"-"`
+	Key           string `protobuf:"bytes,9,opt,name=key,proto3" json:"key,omitempty" sentinel:"-"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *TOTPSecret) Reset() {
 	*x = TOTPSecret{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_mfa_types_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_mfa_types_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *TOTPSecret) String() string {
@@ -706,7 +705,7 @@ func (*TOTPSecret) ProtoMessage() {}
 
 func (x *TOTPSecret) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_mfa_types_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -780,27 +779,24 @@ func (x *TOTPSecret) GetKey() string {
 // MFAEnforcementConfig is what the user provides to the
 // mfa/login_enforcement endpoint.
 type MFAEnforcementConfig struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Name                string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	NamespaceID         string   `protobuf:"bytes,2,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
-	MFAMethodIDs        []string `protobuf:"bytes,3,rep,name=mfa_method_ids,json=mfaMethodIds,proto3" json:"mfa_method_ids,omitempty"`
-	AuthMethodAccessors []string `protobuf:"bytes,4,rep,name=auth_method_accessors,json=authMethodAccessors,proto3" json:"auth_method_accessors,omitempty"`
-	AuthMethodTypes     []string `protobuf:"bytes,5,rep,name=auth_method_types,json=authMethodTypes,proto3" json:"auth_method_types,omitempty"`
-	IdentityGroupIds    []string `protobuf:"bytes,6,rep,name=identity_group_ids,json=identityGroupIds,proto3" json:"identity_group_ids,omitempty"`
-	IdentityEntityIDs   []string `protobuf:"bytes,7,rep,name=identity_entity_ids,json=identityEntityIds,proto3" json:"identity_entity_ids,omitempty"`
-	ID                  string   `protobuf:"bytes,8,opt,name=id,proto3" json:"id,omitempty"`
+	state               protoimpl.MessageState `protogen:"open.v1"`
+	Name                string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	NamespaceID         string                 `protobuf:"bytes,2,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	MFAMethodIDs        []string               `protobuf:"bytes,3,rep,name=mfa_method_ids,json=mfaMethodIds,proto3" json:"mfa_method_ids,omitempty"`
+	AuthMethodAccessors []string               `protobuf:"bytes,4,rep,name=auth_method_accessors,json=authMethodAccessors,proto3" json:"auth_method_accessors,omitempty"`
+	AuthMethodTypes     []string               `protobuf:"bytes,5,rep,name=auth_method_types,json=authMethodTypes,proto3" json:"auth_method_types,omitempty"`
+	IdentityGroupIds    []string               `protobuf:"bytes,6,rep,name=identity_group_ids,json=identityGroupIds,proto3" json:"identity_group_ids,omitempty"`
+	IdentityEntityIDs   []string               `protobuf:"bytes,7,rep,name=identity_entity_ids,json=identityEntityIds,proto3" json:"identity_entity_ids,omitempty"`
+	ID                  string                 `protobuf:"bytes,8,opt,name=id,proto3" json:"id,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
 }
 
 func (x *MFAEnforcementConfig) Reset() {
 	*x = MFAEnforcementConfig{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_mfa_types_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_mfa_types_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *MFAEnforcementConfig) String() string {
@@ -811,7 +807,7 @@ func (*MFAEnforcementConfig) ProtoMessage() {}
 
 func (x *MFAEnforcementConfig) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_mfa_types_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -884,7 +880,7 @@ func (x *MFAEnforcementConfig) GetID() string {
 
 var File_helper_identity_mfa_types_proto protoreflect.FileDescriptor
 
-var file_helper_identity_mfa_types_proto_rawDesc = []byte{
+var file_helper_identity_mfa_types_proto_rawDesc = string([]byte{
 	0x0a, 0x1f, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x2f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74,
 	0x79, 0x2f, 0x6d, 0x66, 0x61, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x12, 0x03, 0x6d, 0x66, 0x61, 0x22, 0x90, 0x03, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69,
@@ -912,7 +908,7 @@ var file_helper_identity_mfa_types_proto_rawDesc = []byte{
 	0x70, 0x69, 0x6e, 0x67, 0x69, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x21, 0x0a, 0x0c,
 	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01,
 	0x28, 0x09, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x42,
-	0x08, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xf2, 0x01, 0x0a, 0x0a, 0x54, 0x4f,
+	0x08, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xa8, 0x02, 0x0a, 0x0a, 0x54, 0x4f,
 	0x54, 0x50, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x16, 0x0a, 0x06, 0x69, 0x73, 0x73, 0x75,
 	0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72,
 	0x12, 0x16, 0x0a, 0x06, 0x70, 0x65, 0x72, 0x69, 0x6f, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d,
@@ -927,104 +923,108 @@ var file_helper_identity_mfa_types_proto_rawDesc = []byte{
 	0x71, 0x72, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x36, 0x0a, 0x17, 0x6d, 0x61, 0x78, 0x5f, 0x76, 0x61,
 	0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x74, 0x74, 0x65, 0x6d, 0x70, 0x74,
 	0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x15, 0x6d, 0x61, 0x78, 0x56, 0x61, 0x6c, 0x69,
-	0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x74, 0x74, 0x65, 0x6d, 0x70, 0x74, 0x73, 0x22, 0xb6,
-	0x01, 0x0a, 0x09, 0x44, 0x75, 0x6f, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x27, 0x0a, 0x0f,
-	0x69, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x69, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x5f,
-	0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x63, 0x72, 0x65,
-	0x74, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x70, 0x69, 0x5f, 0x68, 0x6f, 0x73, 0x74,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x70, 0x69, 0x48,
-	0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x73, 0x68, 0x5f,
-	0x69, 0x6e, 0x66, 0x6f, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x75, 0x73, 0x68,
-	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x21, 0x0a, 0x0c, 0x75, 0x73, 0x65, 0x5f, 0x70, 0x61, 0x73, 0x73,
-	0x63, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x75, 0x73, 0x65, 0x50,
-	0x61, 0x73, 0x73, 0x63, 0x6f, 0x64, 0x65, 0x22, 0xa4, 0x01, 0x0a, 0x0a, 0x4f, 0x6b, 0x74, 0x61,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x19, 0x0a, 0x08, 0x6f, 0x72, 0x67, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6f, 0x72, 0x67, 0x4e, 0x61, 0x6d,
-	0x65, 0x12, 0x1b, 0x0a, 0x09, 0x61, 0x70, 0x69, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x70, 0x69, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1e,
-	0x0a, 0x0a, 0x70, 0x72, 0x6f, 0x64, 0x75, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x64, 0x75, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19,
-	0x0a, 0x08, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x07, 0x62, 0x61, 0x73, 0x65, 0x55, 0x72, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x70, 0x72, 0x69,
-	0x6d, 0x61, 0x72, 0x79, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0c, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x22, 0xef,
-	0x01, 0x0a, 0x0c, 0x50, 0x69, 0x6e, 0x67, 0x49, 0x44, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x24, 0x0a, 0x0e, 0x75, 0x73, 0x65, 0x5f, 0x62, 0x61, 0x73, 0x65, 0x36, 0x34, 0x5f, 0x6b, 0x65,
-	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x75, 0x73, 0x65, 0x42, 0x61, 0x73, 0x65,
-	0x36, 0x34, 0x4b, 0x65, 0x79, 0x12, 0x23, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x5f, 0x73, 0x69, 0x67,
-	0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x75, 0x73,
-	0x65, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f,
-	0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
-	0x12, 0x17, 0x0a, 0x07, 0x69, 0x64, 0x70, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x69, 0x64, 0x70, 0x55, 0x72, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x6f, 0x72, 0x67,
-	0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6f, 0x72,
-	0x67, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x61, 0x64, 0x6d, 0x69, 0x6e, 0x5f,
-	0x75, 0x72, 0x6c, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x64, 0x6d, 0x69, 0x6e,
-	0x55, 0x72, 0x6c, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
-	0x61, 0x74, 0x6f, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10,
-	0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x55, 0x72, 0x6c,
-	0x22, 0x66, 0x0a, 0x06, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x6d, 0x65,
-	0x74, 0x68, 0x6f, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0a, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x32, 0x0a, 0x0b, 0x74,
-	0x6f, 0x74, 0x70, 0x5f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x0f, 0x2e, 0x6d, 0x66, 0x61, 0x2e, 0x54, 0x4f, 0x54, 0x50, 0x53, 0x65, 0x63, 0x72, 0x65,
-	0x74, 0x48, 0x00, 0x52, 0x0a, 0x74, 0x6f, 0x74, 0x70, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x42,
-	0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0xd6, 0x01, 0x0a, 0x0a, 0x54, 0x4f, 0x54,
-	0x50, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x69, 0x73, 0x73, 0x75, 0x65,
-	0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x12,
-	0x16, 0x0a, 0x06, 0x70, 0x65, 0x72, 0x69, 0x6f, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52,
-	0x06, 0x70, 0x65, 0x72, 0x69, 0x6f, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72,
-	0x69, 0x74, 0x68, 0x6d, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x61, 0x6c, 0x67, 0x6f,
-	0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x69, 0x67, 0x69, 0x74, 0x73, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x64, 0x69, 0x67, 0x69, 0x74, 0x73, 0x12, 0x12, 0x0a,
-	0x04, 0x73, 0x6b, 0x65, 0x77, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x73, 0x6b, 0x65,
-	0x77, 0x12, 0x19, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x06, 0x20,
-	0x01, 0x28, 0x0d, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x21, 0x0a, 0x0c,
-	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0b, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
-	0x79, 0x22, 0xc1, 0x02, 0x0a, 0x14, 0x4d, 0x46, 0x41, 0x45, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x21,
-	0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49,
-	0x64, 0x12, 0x24, 0x0a, 0x0e, 0x6d, 0x66, 0x61, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f,
-	0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x6d, 0x66, 0x61, 0x4d, 0x65,
-	0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x73, 0x12, 0x32, 0x0a, 0x15, 0x61, 0x75, 0x74, 0x68, 0x5f,
-	0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x73,
-	0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68,
-	0x6f, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x61,
-	0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x73,
-	0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68,
-	0x6f, 0x64, 0x54, 0x79, 0x70, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x69, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x74, 0x79, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x06, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x10, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x47, 0x72, 0x6f,
-	0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74,
-	0x79, 0x5f, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x07, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x11, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x45, 0x6e, 0x74, 0x69,
-	0x74, 0x79, 0x49, 0x64, 0x73, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x02, 0x69, 0x64, 0x42, 0x30, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61,
-	0x75, 0x6c, 0x74, 0x2f, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x2f, 0x69, 0x64, 0x65, 0x6e, 0x74,
-	0x69, 0x74, 0x79, 0x2f, 0x6d, 0x66, 0x61, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+	0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x74, 0x74, 0x65, 0x6d, 0x70, 0x74, 0x73, 0x12, 0x34,
+	0x0a, 0x16, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x73, 0x65, 0x6c, 0x66, 0x5f, 0x65, 0x6e,
+	0x72, 0x6f, 0x6c, 0x6c, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x65, 0x6c, 0x66, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c,
+	0x6d, 0x65, 0x6e, 0x74, 0x22, 0xb6, 0x01, 0x0a, 0x09, 0x44, 0x75, 0x6f, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x27, 0x0a, 0x0f, 0x69, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x69, 0x6e, 0x74,
+	0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x12, 0x1d, 0x0a, 0x0a, 0x73,
+	0x65, 0x63, 0x72, 0x65, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x4b, 0x65, 0x79, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x70,
+	0x69, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0b, 0x61, 0x70, 0x69, 0x48, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a,
+	0x09, 0x70, 0x75, 0x73, 0x68, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x70, 0x75, 0x73, 0x68, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x21, 0x0a, 0x0c, 0x75, 0x73,
+	0x65, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0b, 0x75, 0x73, 0x65, 0x50, 0x61, 0x73, 0x73, 0x63, 0x6f, 0x64, 0x65, 0x22, 0xa4, 0x01,
+	0x0a, 0x0a, 0x4f, 0x6b, 0x74, 0x61, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x19, 0x0a, 0x08,
+	0x6f, 0x72, 0x67, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x6f, 0x72, 0x67, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x61, 0x70, 0x69, 0x5f, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x70, 0x69, 0x54,
+	0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1e, 0x0a, 0x0a, 0x70, 0x72, 0x6f, 0x64, 0x75, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x64, 0x75, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x19, 0x0a, 0x08, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x75, 0x72, 0x6c,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x62, 0x61, 0x73, 0x65, 0x55, 0x72, 0x6c, 0x12,
+	0x23, 0x0a, 0x0d, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x45,
+	0x6d, 0x61, 0x69, 0x6c, 0x22, 0xef, 0x01, 0x0a, 0x0c, 0x50, 0x69, 0x6e, 0x67, 0x49, 0x44, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x24, 0x0a, 0x0e, 0x75, 0x73, 0x65, 0x5f, 0x62, 0x61, 0x73,
+	0x65, 0x36, 0x34, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x75,
+	0x73, 0x65, 0x42, 0x61, 0x73, 0x65, 0x36, 0x34, 0x4b, 0x65, 0x79, 0x12, 0x23, 0x0a, 0x0d, 0x75,
+	0x73, 0x65, 0x5f, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0c, 0x75, 0x73, 0x65, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x17, 0x0a, 0x07, 0x69, 0x64, 0x70, 0x5f, 0x75, 0x72,
+	0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x69, 0x64, 0x70, 0x55, 0x72, 0x6c, 0x12,
+	0x1b, 0x0a, 0x09, 0x6f, 0x72, 0x67, 0x5f, 0x61, 0x6c, 0x69, 0x61, 0x73, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x08, 0x6f, 0x72, 0x67, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x12, 0x1b, 0x0a, 0x09,
+	0x61, 0x64, 0x6d, 0x69, 0x6e, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x61, 0x64, 0x6d, 0x69, 0x6e, 0x55, 0x72, 0x6c, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x75, 0x74,
+	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
+	0x74, 0x6f, 0x72, 0x55, 0x72, 0x6c, 0x22, 0x66, 0x0a, 0x06, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74,
+	0x12, 0x1f, 0x0a, 0x0b, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x32, 0x0a, 0x0b, 0x74, 0x6f, 0x74, 0x70, 0x5f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x6d, 0x66, 0x61, 0x2e, 0x54, 0x4f, 0x54,
+	0x50, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x48, 0x00, 0x52, 0x0a, 0x74, 0x6f, 0x74, 0x70, 0x53,
+	0x65, 0x63, 0x72, 0x65, 0x74, 0x42, 0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0xd6,
+	0x01, 0x0a, 0x0a, 0x54, 0x4f, 0x54, 0x50, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x16, 0x0a,
+	0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x69,
+	0x73, 0x73, 0x75, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x65, 0x72, 0x69, 0x6f, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x06, 0x70, 0x65, 0x72, 0x69, 0x6f, 0x64, 0x12, 0x1c, 0x0a,
+	0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05,
+	0x52, 0x09, 0x61, 0x6c, 0x67, 0x6f, 0x72, 0x69, 0x74, 0x68, 0x6d, 0x12, 0x16, 0x0a, 0x06, 0x64,
+	0x69, 0x67, 0x69, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x64, 0x69, 0x67,
+	0x69, 0x74, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x6b, 0x65, 0x77, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x0d, 0x52, 0x04, 0x73, 0x6b, 0x65, 0x77, 0x12, 0x19, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x73,
+	0x69, 0x7a, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x53, 0x69,
+	0x7a, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e,
+	0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x09, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x22, 0xc1, 0x02, 0x0a, 0x14, 0x4d, 0x46, 0x41, 0x45,
+	0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x61, 0x6d, 0x65,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x24, 0x0a, 0x0e, 0x6d, 0x66, 0x61, 0x5f, 0x6d,
+	0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x0c, 0x6d, 0x66, 0x61, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x64, 0x73, 0x12, 0x32, 0x0a,
+	0x15, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x5f, 0x61, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x6f, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x61, 0x75,
+	0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72,
+	0x73, 0x12, 0x2a, 0x0a, 0x11, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64,
+	0x5f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x61, 0x75,
+	0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x54, 0x79, 0x70, 0x65, 0x73, 0x12, 0x2c, 0x0a,
+	0x12, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
+	0x69, 0x64, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x69, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x74, 0x79, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x69,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x11, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x74, 0x79, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x64, 0x73, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x42, 0x30, 0x5a, 0x2e, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63,
+	0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72,
+	0x2f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x2f, 0x6d, 0x66, 0x61, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
 
 var (
 	file_helper_identity_mfa_types_proto_rawDescOnce sync.Once
-	file_helper_identity_mfa_types_proto_rawDescData = file_helper_identity_mfa_types_proto_rawDesc
+	file_helper_identity_mfa_types_proto_rawDescData []byte
 )
 
 func file_helper_identity_mfa_types_proto_rawDescGZIP() []byte {
 	file_helper_identity_mfa_types_proto_rawDescOnce.Do(func() {
-		file_helper_identity_mfa_types_proto_rawDescData = protoimpl.X.CompressGZIP(file_helper_identity_mfa_types_proto_rawDescData)
+		file_helper_identity_mfa_types_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_helper_identity_mfa_types_proto_rawDesc), len(file_helper_identity_mfa_types_proto_rawDesc)))
 	})
 	return file_helper_identity_mfa_types_proto_rawDescData
 }
 
 var file_helper_identity_mfa_types_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
-var file_helper_identity_mfa_types_proto_goTypes = []interface{}{
+var file_helper_identity_mfa_types_proto_goTypes = []any{
 	(*Config)(nil),               // 0: mfa.Config
 	(*TOTPConfig)(nil),           // 1: mfa.TOTPConfig
 	(*DuoConfig)(nil),            // 2: mfa.DuoConfig
@@ -1052,118 +1052,20 @@ func file_helper_identity_mfa_types_proto_init() {
 	if File_helper_identity_mfa_types_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_helper_identity_mfa_types_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Config); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_mfa_types_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TOTPConfig); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_mfa_types_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DuoConfig); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_mfa_types_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*OktaConfig); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_mfa_types_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PingIDConfig); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_mfa_types_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Secret); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_mfa_types_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TOTPSecret); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_mfa_types_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MFAEnforcementConfig); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	file_helper_identity_mfa_types_proto_msgTypes[0].OneofWrappers = []interface{}{
+	file_helper_identity_mfa_types_proto_msgTypes[0].OneofWrappers = []any{
 		(*Config_TOTPConfig)(nil),
 		(*Config_OktaConfig)(nil),
 		(*Config_DuoConfig)(nil),
 		(*Config_PingIDConfig)(nil),
 	}
-	file_helper_identity_mfa_types_proto_msgTypes[5].OneofWrappers = []interface{}{
+	file_helper_identity_mfa_types_proto_msgTypes[5].OneofWrappers = []any{
 		(*Secret_TOTPSecret)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_helper_identity_mfa_types_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_helper_identity_mfa_types_proto_rawDesc), len(file_helper_identity_mfa_types_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   8,
 			NumExtensions: 0,
@@ -1174,7 +1076,6 @@ func file_helper_identity_mfa_types_proto_init() {
 		MessageInfos:      file_helper_identity_mfa_types_proto_msgTypes,
 	}.Build()
 	File_helper_identity_mfa_types_proto = out.File
-	file_helper_identity_mfa_types_proto_rawDesc = nil
 	file_helper_identity_mfa_types_proto_goTypes = nil
 	file_helper_identity_mfa_types_proto_depIDxs = nil
 }
diff --git a/helper/identity/mfa/types.proto b/helper/identity/mfa/types.proto
index f125a3d2f5f..e7758106626 100644
--- a/helper/identity/mfa/types.proto
+++ b/helper/identity/mfa/types.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
@@ -55,6 +55,8 @@ message TOTPConfig {
   int32 qr_size = 7;
   // @inject_tag: sentinel:"-"
   uint32 max_validation_attempts = 8;
+  // @inject_tag: sentinel:"-"
+  bool enable_self_enrollment = 9;
 }
 
 // DuoConfig represents the configuration information required to perform
diff --git a/helper/identity/sentinel.go b/helper/identity/sentinel.go
index a7ff44c91d7..f1aec42a36b 100644
--- a/helper/identity/sentinel.go
+++ b/helper/identity/sentinel.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
diff --git a/helper/identity/types.pb.go b/helper/identity/types.pb.go
index af46cde4785..4d8ab5007bf 100644
--- a/helper/identity/types.pb.go
+++ b/helper/identity/types.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: helper/identity/types.proto
 
@@ -16,6 +16,7 @@ import (
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -27,10 +28,7 @@ const (
 
 // Group represents an identity group.
 type Group struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// ID is the unique identifier for this group
 	// @inject_tag: sentinel:"-"
 	ID string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" sentinel:"-"`
@@ -51,7 +49,7 @@ type Group struct {
 	MemberEntityIDs []string `protobuf:"bytes,5,rep,name=member_entity_ids,json=memberEntityIDs,proto3" json:"member_entity_ids,omitempty" sentinel:"-"`
 	// Metadata represents the custom data tied with this group
 	// @inject_tag: sentinel:"-"
-	Metadata map[string]string `protobuf:"bytes,6,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3" sentinel:"-"`
+	Metadata map[string]string `protobuf:"bytes,6,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value" sentinel:"-"`
 	// CreationTime is the time at which this group was created
 	// @inject_tag: sentinel:"-"
 	CreationTime *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=creation_time,json=creationTime,proto3" json:"creation_time,omitempty" sentinel:"-"`
@@ -81,16 +79,16 @@ type Group struct {
 	// belongs to. Do not return this value over the API when reading the
 	// group.
 	// @inject_tag: sentinel:"-"
-	NamespaceID string `protobuf:"bytes,13,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty" sentinel:"-"`
+	NamespaceID   string `protobuf:"bytes,13,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty" sentinel:"-"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Group) Reset() {
 	*x = Group{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_types_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_types_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Group) String() string {
@@ -101,7 +99,7 @@ func (*Group) ProtoMessage() {}
 
 func (x *Group) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_types_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -210,20 +208,17 @@ func (x *Group) GetNamespaceID() string {
 // LocalAliases holds the aliases belonging to an entity that are local to the
 // cluster.
 type LocalAliases struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Aliases       []*Alias               `protobuf:"bytes,1,rep,name=aliases,proto3" json:"aliases,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Aliases []*Alias `protobuf:"bytes,1,rep,name=aliases,proto3" json:"aliases,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *LocalAliases) Reset() {
 	*x = LocalAliases{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_types_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_types_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *LocalAliases) String() string {
@@ -234,7 +229,7 @@ func (*LocalAliases) ProtoMessage() {}
 
 func (x *LocalAliases) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_types_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -259,10 +254,7 @@ func (x *LocalAliases) GetAliases() []*Alias {
 // Entity represents an entity that gets persisted and indexed.
 // Entity is fundamentally composed of zero or many aliases.
 type Entity struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Aliases are the identities that this entity is made of. This can be
 	// empty as well to favor being able to create the entity first and then
 	// incrementally adding aliases.
@@ -285,7 +277,7 @@ type Entity struct {
 	// on this explicit metadata. This enables virtual groupings of entities
 	// based on its metadata.
 	// @inject_tag: sentinel:"-"
-	Metadata map[string]string `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3" sentinel:"-"`
+	Metadata map[string]string `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value" sentinel:"-"`
 	// CreationTime is the time at which this entity is first created.
 	// @inject_tag: sentinel:"-"
 	CreationTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=creation_time,json=creationTime,proto3" json:"creation_time,omitempty" sentinel:"-"`
@@ -311,7 +303,7 @@ type Entity struct {
 	// MFASecrets holds the MFA secrets indexed by the identifier of the MFA
 	// method configuration.
 	// @inject_tag: sentinel:"-"
-	MFASecrets map[string]*mfa.Secret `protobuf:"bytes,10,rep,name=mfa_secrets,json=mfaSecrets,proto3" json:"mfa_secrets,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3" sentinel:"-"`
+	MFASecrets map[string]*mfa.Secret `protobuf:"bytes,10,rep,name=mfa_secrets,json=mfaSecrets,proto3" json:"mfa_secrets,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value" sentinel:"-"`
 	// Disabled indicates whether tokens associated with the account should not
 	// be able to be used
 	// @inject_tag: sentinel:"-"
@@ -320,16 +312,16 @@ type Entity struct {
 	// belongs to. Do not return this value over the API when reading the
 	// entity.
 	// @inject_tag: sentinel:"-"
-	NamespaceID string `protobuf:"bytes,12,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty" sentinel:"-"`
+	NamespaceID   string `protobuf:"bytes,12,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty" sentinel:"-"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Entity) Reset() {
 	*x = Entity{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_types_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_types_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Entity) String() string {
@@ -340,7 +332,7 @@ func (*Entity) ProtoMessage() {}
 
 func (x *Entity) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_types_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -443,10 +435,7 @@ func (x *Entity) GetNamespaceID() string {
 // entity object in storage and also represents in an in-memory index of an
 // alias object.
 type Alias struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// ID is the unique identifier that represents this alias
 	// @inject_tag: sentinel:"-"
 	ID string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" sentinel:"-"`
@@ -470,7 +459,7 @@ type Alias struct {
 	// which enables virtual grouping of aliases. Aliases will be indexed
 	// against their metadata.
 	// @inject_tag: sentinel:"-"
-	Metadata map[string]string `protobuf:"bytes,6,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3" sentinel:"-"`
+	Metadata map[string]string `protobuf:"bytes,6,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value" sentinel:"-"`
 	// Name is the identifier of this alias in its authentication source.
 	// This does not uniquely identify an alias in Vault. This in conjunction
 	// with MountAccessor form to be the factors that represent an alias in a
@@ -495,7 +484,7 @@ type Alias struct {
 	NamespaceID string `protobuf:"bytes,11,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty" sentinel:"-"`
 	// Custom Metadata represents the custom data tied to this alias
 	// @inject_tag: sentinel:"-"
-	CustomMetadata map[string]string `protobuf:"bytes,12,rep,name=custom_metadata,json=customMetadata,proto3" json:"custom_metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3" sentinel:"-"`
+	CustomMetadata map[string]string `protobuf:"bytes,12,rep,name=custom_metadata,json=customMetadata,proto3" json:"custom_metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value" sentinel:"-"`
 	// Local indicates if the alias only belongs to the cluster where it was
 	// created. If true, the alias will be stored in a location that is ignored by
 	// the performance replication subsystem.
@@ -506,15 +495,15 @@ type Alias struct {
 	// during invalidation of local aliases in performance standbys.
 	// @inject_tag: sentinel:"-"
 	LocalBucketKey string `protobuf:"bytes,14,opt,name=local_bucket_key,json=localBucketKey,proto3" json:"local_bucket_key,omitempty" sentinel:"-"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *Alias) Reset() {
 	*x = Alias{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_types_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_types_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Alias) String() string {
@@ -525,7 +514,7 @@ func (*Alias) ProtoMessage() {}
 
 func (x *Alias) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_types_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -640,29 +629,26 @@ func (x *Alias) GetLocalBucketKey() string {
 
 // Deprecated. Retained for backwards compatibility.
 type EntityStorageEntry struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state           protoimpl.MessageState `protogen:"open.v1"`
 	Personas        []*PersonaIndexEntry   `protobuf:"bytes,1,rep,name=personas,proto3" json:"personas,omitempty"`
 	ID              string                 `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
 	Name            string                 `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
-	Metadata        map[string]string      `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Metadata        map[string]string      `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	CreationTime    *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=creation_time,json=creationTime,proto3" json:"creation_time,omitempty"`
 	LastUpdateTime  *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=last_update_time,json=lastUpdateTime,proto3" json:"last_update_time,omitempty"`
 	MergedEntityIDs []string               `protobuf:"bytes,7,rep,name=merged_entity_ids,json=mergedEntityIDs,proto3" json:"merged_entity_ids,omitempty"`
 	Policies        []string               `protobuf:"bytes,8,rep,name=policies,proto3" json:"policies,omitempty"`
 	BucketKeyHash   string                 `protobuf:"bytes,9,opt,name=bucket_key_hash,json=bucketKeyHash,proto3" json:"bucket_key_hash,omitempty"`
-	MFASecrets      map[string]*mfa.Secret `protobuf:"bytes,10,rep,name=mfa_secrets,json=mfaSecrets,proto3" json:"mfa_secrets,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	MFASecrets      map[string]*mfa.Secret `protobuf:"bytes,10,rep,name=mfa_secrets,json=mfaSecrets,proto3" json:"mfa_secrets,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *EntityStorageEntry) Reset() {
 	*x = EntityStorageEntry{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_types_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_types_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EntityStorageEntry) String() string {
@@ -673,7 +659,7 @@ func (*EntityStorageEntry) ProtoMessage() {}
 
 func (x *EntityStorageEntry) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_types_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -760,29 +746,26 @@ func (x *EntityStorageEntry) GetMFASecrets() map[string]*mfa.Secret {
 
 // Deprecated. Retained for backwards compatibility.
 type PersonaIndexEntry struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state               protoimpl.MessageState `protogen:"open.v1"`
 	ID                  string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	EntityID            string                 `protobuf:"bytes,2,opt,name=entity_id,json=entityId,proto3" json:"entity_id,omitempty"`
 	MountType           string                 `protobuf:"bytes,3,opt,name=mount_type,json=mountType,proto3" json:"mount_type,omitempty"`
 	MountAccessor       string                 `protobuf:"bytes,4,opt,name=mount_accessor,json=mountAccessor,proto3" json:"mount_accessor,omitempty"`
 	MountPath           string                 `protobuf:"bytes,5,opt,name=mount_path,json=mountPath,proto3" json:"mount_path,omitempty"`
-	Metadata            map[string]string      `protobuf:"bytes,6,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Metadata            map[string]string      `protobuf:"bytes,6,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	Name                string                 `protobuf:"bytes,7,opt,name=name,proto3" json:"name,omitempty"`
 	CreationTime        *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=creation_time,json=creationTime,proto3" json:"creation_time,omitempty"`
 	LastUpdateTime      *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=last_update_time,json=lastUpdateTime,proto3" json:"last_update_time,omitempty"`
 	MergedFromEntityIDs []string               `protobuf:"bytes,10,rep,name=merged_from_entity_ids,json=mergedFromEntityIDs,proto3" json:"merged_from_entity_ids,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
 }
 
 func (x *PersonaIndexEntry) Reset() {
 	*x = PersonaIndexEntry{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_identity_types_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_identity_types_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *PersonaIndexEntry) String() string {
@@ -793,7 +776,7 @@ func (*PersonaIndexEntry) ProtoMessage() {}
 
 func (x *PersonaIndexEntry) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_identity_types_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -880,7 +863,7 @@ func (x *PersonaIndexEntry) GetMergedFromEntityIDs() []string {
 
 var File_helper_identity_types_proto protoreflect.FileDescriptor
 
-var file_helper_identity_types_proto_rawDesc = []byte{
+var file_helper_identity_types_proto_rawDesc = string([]byte{
 	0x0a, 0x1b, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x2f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74,
 	0x79, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x08, 0x69,
 	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
@@ -1091,22 +1074,22 @@ var file_helper_identity_types_proto_rawDesc = []byte{
 	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x68, 0x65, 0x6c, 0x70,
 	0x65, 0x72, 0x2f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x62, 0x06, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_helper_identity_types_proto_rawDescOnce sync.Once
-	file_helper_identity_types_proto_rawDescData = file_helper_identity_types_proto_rawDesc
+	file_helper_identity_types_proto_rawDescData []byte
 )
 
 func file_helper_identity_types_proto_rawDescGZIP() []byte {
 	file_helper_identity_types_proto_rawDescOnce.Do(func() {
-		file_helper_identity_types_proto_rawDescData = protoimpl.X.CompressGZIP(file_helper_identity_types_proto_rawDescData)
+		file_helper_identity_types_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_helper_identity_types_proto_rawDesc), len(file_helper_identity_types_proto_rawDesc)))
 	})
 	return file_helper_identity_types_proto_rawDescData
 }
 
 var file_helper_identity_types_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
-var file_helper_identity_types_proto_goTypes = []interface{}{
+var file_helper_identity_types_proto_goTypes = []any{
 	(*Group)(nil),                 // 0: identity.Group
 	(*LocalAliases)(nil),          // 1: identity.LocalAliases
 	(*Entity)(nil),                // 2: identity.Entity
@@ -1161,85 +1144,11 @@ func file_helper_identity_types_proto_init() {
 	if File_helper_identity_types_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_helper_identity_types_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Group); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_types_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LocalAliases); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_types_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Entity); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_types_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Alias); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_types_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EntityStorageEntry); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_identity_types_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PersonaIndexEntry); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_helper_identity_types_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_helper_identity_types_proto_rawDesc), len(file_helper_identity_types_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   14,
 			NumExtensions: 0,
@@ -1250,7 +1159,6 @@ func file_helper_identity_types_proto_init() {
 		MessageInfos:      file_helper_identity_types_proto_msgTypes,
 	}.Build()
 	File_helper_identity_types_proto = out.File
-	file_helper_identity_types_proto_rawDesc = nil
 	file_helper_identity_types_proto_goTypes = nil
 	file_helper_identity_types_proto_depIDxs = nil
 }
diff --git a/helper/identity/types.proto b/helper/identity/types.proto
index 7c6c49bd605..b5759d012f9 100644
--- a/helper/identity/types.proto
+++ b/helper/identity/types.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
diff --git a/helper/locking/core_locking.go b/helper/locking/core_locking.go
new file mode 100644
index 00000000000..3938ee5a417
--- /dev/null
+++ b/helper/locking/core_locking.go
@@ -0,0 +1,44 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package locking
+
+import (
+	"slices"
+	"strings"
+)
+
+// ParseDetectDeadlockConfigParameter takes the detectDeadlockConfigParameter string
+// and transforms it to a lowercase version of the string, then splits it into
+// a slice of strings by interpreting commas as the element delimiters.
+func ParseDetectDeadlockConfigParameter(detectDeadlockConfigParameter string) []string {
+	if detectDeadlockConfigParameter == "" {
+		// This doesn't seem necessary, since the companion functions that use
+		// this slice can handle an empty slice just the same as a nil slice,
+		// but for the sake of compatibility, this will be introduced for now
+		// until all occurrences that rely on Core.detectDeadlocks have been
+		// switched to using functions from this file to create their locks.
+		return nil
+	}
+
+	result := strings.Split(strings.ToLower(detectDeadlockConfigParameter), ",")
+	for i := range result {
+		result[i] = strings.TrimSpace(result[i])
+	}
+
+	return result
+}
+
+// CreateConfigurableRWMutex determines if the specified lock (identifier) should
+// use a deadlock detecting implementation (DeadlockRWMutex) or simply a basic
+// sync.RWMutex instance. This is done by splitting the deadlockDetectionLocks
+// string into a slice of strings. If the slice contains the specified lock
+// (identifier), then the deadlock detecting implementation is used, otherwise a
+// sync.Mutex is returned.
+func CreateConfigurableRWMutex(deadlockDetectionLocks []string, identifier string) RWMutex {
+	if slices.Contains(deadlockDetectionLocks, strings.ToLower(identifier)) {
+		return &DeadlockRWMutex{}
+	}
+
+	return &SyncRWMutex{}
+}
diff --git a/helper/locking/core_locking_test.go b/helper/locking/core_locking_test.go
new file mode 100644
index 00000000000..c60eb3b2db3
--- /dev/null
+++ b/helper/locking/core_locking_test.go
@@ -0,0 +1,103 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package locking
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestParseDetectDeadlockConfigParameter verifies that all types of strings
+// that could be obtained from the configuration file, are correctly parsed
+// into a slice of string elements.
+func TestParseDetectDeadlockConfigParameter(t *testing.T) {
+	for _, tc := range []struct {
+		name                          string
+		detectDeadlockConfigParameter string
+		expectedResult                []string
+	}{
+		{
+			name: "empty-string",
+		},
+		{
+			name:                          "single-value",
+			detectDeadlockConfigParameter: "bar",
+			expectedResult:                []string{"bar"},
+		},
+		{
+			name:                          "single-value-mixed-case",
+			detectDeadlockConfigParameter: "BaR",
+			expectedResult:                []string{"bar"},
+		},
+		{
+			name:                          "multiple-values",
+			detectDeadlockConfigParameter: "bar,BAZ,fIZ",
+			expectedResult:                []string{"bar", "baz", "fiz"},
+		},
+		{
+			name:                          "non-canonical-string-list",
+			detectDeadlockConfigParameter: "bar  ,  baz, ",
+			expectedResult:                []string{"bar", "baz", ""},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			result := ParseDetectDeadlockConfigParameter(tc.detectDeadlockConfigParameter)
+			assert.ElementsMatch(t, tc.expectedResult, result)
+		})
+	}
+}
+
+// TestCreateConfigurableRWMutex verifies the correct behaviour in determining
+// whether a deadlock detecting RWMutex should be returned or not based on the
+// input arguments for the CreateConfigurableRWMutex function.
+func TestCreateConfigurableRWMutex(t *testing.T) {
+	mutexTypes := map[bool]string{
+		false: "locking.SyncRWMutex",
+		true:  "locking.DeadlockRWMutex",
+	}
+
+	for _, tc := range []struct {
+		name               string
+		detectDeadlocks    []string
+		lock               string
+		expectDeadlockLock bool
+	}{
+		{
+			name: "no-lock-types-specified",
+			lock: "foo",
+		},
+		{
+			name:            "single-lock-specified-no-match",
+			detectDeadlocks: []string{"bar"},
+			lock:            "foo",
+		},
+		{
+			name:               "single-lock-specified-match",
+			detectDeadlocks:    []string{"foo"},
+			lock:               "foo",
+			expectDeadlockLock: true,
+		},
+		{
+			name:            "multiple-locks-specified-no-match",
+			detectDeadlocks: []string{"bar", "baz", "fiz"},
+			lock:            "foo",
+		},
+		{
+			name:               "multiple-locks-specified-match",
+			detectDeadlocks:    []string{"bar", "foo", "baz"},
+			lock:               "foo",
+			expectDeadlockLock: true,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			m := CreateConfigurableRWMutex(tc.detectDeadlocks, tc.lock)
+
+			_, ok := m.(*DeadlockRWMutex)
+			if tc.expectDeadlockLock != ok {
+				t.Fatalf("unexpected RWMutex type returned, expected: %s got %s", mutexTypes[tc.expectDeadlockLock], mutexTypes[ok])
+			}
+		})
+	}
+}
diff --git a/helper/locking/lock.go b/helper/locking/lock.go
index cc2e5034522..ad46e84728c 100644
--- a/helper/locking/lock.go
+++ b/helper/locking/lock.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package locking
diff --git a/helper/logging/logfile.go b/helper/logging/logfile.go
index 2f2eb8fbc46..3099f5a1290 100644
--- a/helper/logging/logfile.go
+++ b/helper/logging/logfile.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package logging
diff --git a/helper/logging/logfile_test.go b/helper/logging/logfile_test.go
index 8cb66693d8e..c3d53738947 100644
--- a/helper/logging/logfile_test.go
+++ b/helper/logging/logfile_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package logging
diff --git a/helper/logging/logger.go b/helper/logging/logger.go
index b37134b93cb..579a3171844 100644
--- a/helper/logging/logger.go
+++ b/helper/logging/logger.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package logging
diff --git a/helper/logging/logger_test.go b/helper/logging/logger_test.go
index c5f7ec50d9b..511bbd3df8e 100644
--- a/helper/logging/logger_test.go
+++ b/helper/logging/logger_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package logging
diff --git a/helper/metricsutil/bucket.go b/helper/metricsutil/bucket.go
index f25df4d2817..156d1eb7029 100644
--- a/helper/metricsutil/bucket.go
+++ b/helper/metricsutil/bucket.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package metricsutil
diff --git a/helper/metricsutil/bucket_test.go b/helper/metricsutil/bucket_test.go
index 19b6636ed40..800bf5dbfc6 100644
--- a/helper/metricsutil/bucket_test.go
+++ b/helper/metricsutil/bucket_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package metricsutil
diff --git a/helper/metricsutil/gauge_process.go b/helper/metricsutil/gauge_process.go
index bb61f24ddc0..64f69a47700 100644
--- a/helper/metricsutil/gauge_process.go
+++ b/helper/metricsutil/gauge_process.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package metricsutil
diff --git a/helper/metricsutil/gauge_process_test.go b/helper/metricsutil/gauge_process_test.go
index e5e1c6145b5..05b63b4df2b 100644
--- a/helper/metricsutil/gauge_process_test.go
+++ b/helper/metricsutil/gauge_process_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package metricsutil
diff --git a/helper/metricsutil/metricsutil.go b/helper/metricsutil/metricsutil.go
index 9654d523427..0635c487e7b 100644
--- a/helper/metricsutil/metricsutil.go
+++ b/helper/metricsutil/metricsutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package metricsutil
@@ -137,7 +137,8 @@ func (m *MetricsHelper) PrometheusResponse() *logical.Response {
 	buf := &bytes.Buffer{}
 	defer buf.Reset()
 
-	e := expfmt.NewEncoder(buf, expfmt.FmtText)
+	format := expfmt.NewFormat(expfmt.TypeTextPlain)
+	e := expfmt.NewEncoder(buf, format)
 	for _, mf := range metricsFamilies {
 		err := e.Encode(mf)
 		if err != nil {
@@ -145,7 +146,7 @@ func (m *MetricsHelper) PrometheusResponse() *logical.Response {
 			return resp
 		}
 	}
-	resp.Data[logical.HTTPContentType] = string(expfmt.FmtText)
+	resp.Data[logical.HTTPContentType] = string(format)
 	resp.Data[logical.HTTPRawBody] = buf.Bytes()
 	resp.Data[logical.HTTPStatusCode] = http.StatusOK
 	return resp
diff --git a/helper/metricsutil/metricsutil_test.go b/helper/metricsutil/metricsutil_test.go
index ffe77b56cb0..ff7b9c4288e 100644
--- a/helper/metricsutil/metricsutil_test.go
+++ b/helper/metricsutil/metricsutil_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package metricsutil
diff --git a/helper/metricsutil/wrapped_metrics.go b/helper/metricsutil/wrapped_metrics.go
index 0cf45312330..198ad9d3b86 100644
--- a/helper/metricsutil/wrapped_metrics.go
+++ b/helper/metricsutil/wrapped_metrics.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package metricsutil
@@ -44,6 +44,7 @@ type TelemetryConstConfig struct {
 }
 
 type Metrics interface {
+	SetGauge(key []string, val float32)
 	SetGaugeWithLabels(key []string, val float32, labels []Label)
 	IncrCounterWithLabels(key []string, val float32, labels []Label)
 	AddSampleWithLabels(key []string, val float32, labels []Label)
diff --git a/helper/metricsutil/wrapped_metrics_test.go b/helper/metricsutil/wrapped_metrics_test.go
index 34c5cdda8c8..e710127745e 100644
--- a/helper/metricsutil/wrapped_metrics_test.go
+++ b/helper/metricsutil/wrapped_metrics_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package metricsutil
diff --git a/helper/monitor/monitor.go b/helper/monitor/monitor.go
index ea4799ff09f..0f47206f4d6 100644
--- a/helper/monitor/monitor.go
+++ b/helper/monitor/monitor.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package monitor
diff --git a/helper/monitor/monitor_test.go b/helper/monitor/monitor_test.go
index e281952fe68..1295829ea3a 100644
--- a/helper/monitor/monitor_test.go
+++ b/helper/monitor/monitor_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package monitor
diff --git a/helper/namespace/namespace.go b/helper/namespace/namespace.go
index 1a2346511dd..52eab8f3e8f 100644
--- a/helper/namespace/namespace.go
+++ b/helper/namespace/namespace.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package namespace
diff --git a/helper/namespace/namespace_test.go b/helper/namespace/namespace_test.go
index 10ee981b91d..dd879325fcb 100644
--- a/helper/namespace/namespace_test.go
+++ b/helper/namespace/namespace_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package namespace
diff --git a/helper/osutil/fileinfo.go b/helper/osutil/fileinfo.go
index dffcc0f0591..c597589e6e5 100644
--- a/helper/osutil/fileinfo.go
+++ b/helper/osutil/fileinfo.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package osutil
diff --git a/helper/osutil/fileinfo_test.go b/helper/osutil/fileinfo_test.go
index edf7c50c9d8..523c6226386 100644
--- a/helper/osutil/fileinfo_test.go
+++ b/helper/osutil/fileinfo_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package osutil
@@ -74,10 +74,10 @@ func TestCheckPathInfo(t *testing.T) {
 
 		err = checkPathInfo(info, "testFile", tc.uid, int(tc.permissions))
 		if tc.expectError && err == nil {
-			t.Errorf("invalid result. expected error")
+			t.Error("invalid result. expected error")
 		}
 		if !tc.expectError && err != nil {
-			t.Errorf(err.Error())
+			t.Error(err.Error())
 		}
 
 		err = os.RemoveAll("testFile")
diff --git a/helper/osutil/fileinfo_unix.go b/helper/osutil/fileinfo_unix.go
index da7b58d61c0..90faee0edcb 100644
--- a/helper/osutil/fileinfo_unix.go
+++ b/helper/osutil/fileinfo_unix.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !windows
@@ -8,6 +8,7 @@ package osutil
 import (
 	"fmt"
 	"io/fs"
+	"os"
 	"os/user"
 	"strconv"
 	"syscall"
@@ -59,3 +60,7 @@ func FileUidMatch(info fs.FileInfo, path string, uid int) (err error) {
 func Umask(newmask int) int {
 	return syscall.Umask(newmask)
 }
+
+func Chown(f *os.File, owner, group int) error {
+	return f.Chown(owner, group)
+}
diff --git a/helper/osutil/fileinfo_unix_test.go b/helper/osutil/fileinfo_unix_test.go
index 65ed863febb..00572ad8f8a 100644
--- a/helper/osutil/fileinfo_unix_test.go
+++ b/helper/osutil/fileinfo_unix_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !windows
diff --git a/helper/osutil/fileinfo_windows.go b/helper/osutil/fileinfo_windows.go
index 9292b4613af..8adf30fe816 100644
--- a/helper/osutil/fileinfo_windows.go
+++ b/helper/osutil/fileinfo_windows.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build windows
@@ -7,6 +7,7 @@ package osutil
 
 import (
 	"io/fs"
+	"os"
 )
 
 func FileUidMatch(info fs.FileInfo, path string, uid int) error {
@@ -17,3 +18,7 @@ func FileUidMatch(info fs.FileInfo, path string, uid int) error {
 func Umask(newmask int) int {
 	return 0
 }
+
+func Chown(f *os.File, owner, group int) error {
+	return nil
+}
diff --git a/helper/parseip/parseip.go b/helper/parseip/parseip.go
index f4e6e0fc3e4..de6216ccc81 100644
--- a/helper/parseip/parseip.go
+++ b/helper/parseip/parseip.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package parseip
diff --git a/helper/parseip/parseip_test.go b/helper/parseip/parseip_test.go
index fd8169a5531..6c96c4c2f20 100644
--- a/helper/parseip/parseip_test.go
+++ b/helper/parseip/parseip_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package parseip
diff --git a/helper/pgpkeys/encrypt_decrypt.go b/helper/pgpkeys/encrypt_decrypt.go
index 44738caa0ea..825df916df5 100644
--- a/helper/pgpkeys/encrypt_decrypt.go
+++ b/helper/pgpkeys/encrypt_decrypt.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pgpkeys
diff --git a/helper/pgpkeys/flag.go b/helper/pgpkeys/flag.go
index 7749e5c8bff..f9760814635 100644
--- a/helper/pgpkeys/flag.go
+++ b/helper/pgpkeys/flag.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pgpkeys
diff --git a/helper/pgpkeys/flag_test.go b/helper/pgpkeys/flag_test.go
index f8447b61c58..4b58b8c1174 100644
--- a/helper/pgpkeys/flag_test.go
+++ b/helper/pgpkeys/flag_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pgpkeys
diff --git a/helper/pgpkeys/keybase.go b/helper/pgpkeys/keybase.go
index 541841720f5..e9f7f563d6c 100644
--- a/helper/pgpkeys/keybase.go
+++ b/helper/pgpkeys/keybase.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pgpkeys
diff --git a/helper/pgpkeys/keybase_test.go b/helper/pgpkeys/keybase_test.go
index 2c8c229cc8c..9505c8f1942 100644
--- a/helper/pgpkeys/keybase_test.go
+++ b/helper/pgpkeys/keybase_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pgpkeys
diff --git a/helper/pgpkeys/test_keys.go b/helper/pgpkeys/test_keys.go
index cccda6e2536..28a1b8fce9c 100644
--- a/helper/pgpkeys/test_keys.go
+++ b/helper/pgpkeys/test_keys.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pgpkeys
diff --git a/helper/pkcs7/ber.go b/helper/pkcs7/ber.go
index eb6b1d0af66..eede997667b 100644
--- a/helper/pkcs7/ber.go
+++ b/helper/pkcs7/ber.go
@@ -5,8 +5,6 @@ import (
 	"errors"
 )
 
-var encodeIndent = 0
-
 type asn1Object interface {
 	EncodeTo(writer *bytes.Buffer) error
 }
@@ -17,8 +15,6 @@ type asn1Structured struct {
 }
 
 func (s asn1Structured) EncodeTo(out *bytes.Buffer) error {
-	// fmt.Printf("%s--> tag: % X\n", strings.Repeat("| ", encodeIndent), s.tagBytes)
-	encodeIndent++
 	inner := new(bytes.Buffer)
 	for _, obj := range s.content {
 		err := obj.EncodeTo(inner)
@@ -26,7 +22,6 @@ func (s asn1Structured) EncodeTo(out *bytes.Buffer) error {
 			return err
 		}
 	}
-	encodeIndent--
 	out.Write(s.tagBytes)
 	encodeLength(out, inner.Len())
 	out.Write(inner.Bytes())
@@ -47,8 +42,6 @@ func (p asn1Primitive) EncodeTo(out *bytes.Buffer) error {
 	if err = encodeLength(out, p.length); err != nil {
 		return err
 	}
-	// fmt.Printf("%s--> tag: % X length: %d\n", strings.Repeat("| ", encodeIndent), p.tagBytes, p.length)
-	// fmt.Printf("%s--> content length: %d\n", strings.Repeat("| ", encodeIndent), len(p.content))
 	out.Write(p.content)
 
 	return nil
@@ -140,25 +133,22 @@ func readObject(ber []byte, offset int) (asn1Object, int, error) {
 	tagStart := offset
 	b := ber[offset]
 	offset++
-	if offset >= berLen {
-		return nil, 0, errors.New("ber2der: cannot move offset forward, end of ber data reached")
-	}
 	tag := b & 0x1F // last 5 bits
 	if tag == 0x1F {
 		tag = 0
+		if offset >= berLen {
+			return nil, 0, errors.New("ber2der: cannot move offset forward, end of ber data reached")
+		}
 		for ber[offset] >= 0x80 {
-			tag = tag*128 + ber[offset] - 0x80
-			offset++
 			if offset >= berLen {
 				return nil, 0, errors.New("ber2der: cannot move offset forward, end of ber data reached")
 			}
+			tag = tag*128 + ber[offset] - 0x80
+			offset++
 		}
 		// jvehent 20170227: this doesn't appear to be used anywhere...
 		// tag = tag*128 + ber[offset] - 0x80
 		offset++
-		if offset >= berLen {
-			return nil, 0, errors.New("ber2der: cannot move offset forward, end of ber data reached")
-		}
 	}
 	tagEnd := offset
 
@@ -170,14 +160,17 @@ func readObject(ber []byte, offset int) (asn1Object, int, error) {
 	}
 	// read length
 	var length int
-	l := ber[offset]
-	offset++
 	if offset >= berLen {
 		return nil, 0, errors.New("ber2der: cannot move offset forward, end of ber data reached")
 	}
+	l := ber[offset]
+	offset++
 	indefinite := false
 	if l > 0x80 {
 		numberOfBytes := (int)(l & 0x7F)
+		if offset >= berLen {
+			return nil, 0, errors.New("ber2der: cannot move offset forward, end of ber data reached")
+		}
 		if numberOfBytes > 4 { // int is only guaranteed to be 32bit
 			return nil, 0, errors.New("ber2der: BER tag length too long")
 		}
@@ -217,6 +210,9 @@ func readObject(ber []byte, offset int) (asn1Object, int, error) {
 		return nil, 0, errors.New("ber2der: Indefinite form tag must have constructed encoding")
 	}
 	if kind == 0 {
+		if offset >= berLen {
+			return nil, 0, errors.New("ber2der: cannot move offset forward, end of ber data reached")
+		}
 		obj = asn1Primitive{
 			tagBytes: ber[tagStart:tagEnd],
 			length:   length,
diff --git a/helper/pkcs7/ber_test.go b/helper/pkcs7/ber_test.go
index d3908f6bc32..d93bcf57b22 100644
--- a/helper/pkcs7/ber_test.go
+++ b/helper/pkcs7/ber_test.go
@@ -80,7 +80,7 @@ func TestBer2Der_Negatives(t *testing.T) {
 		{[]byte{0x30, 0x84, 0x80, 0x0, 0x0, 0x0}, "length is negative"},
 		{[]byte{0x30, 0x82, 0x0, 0x1}, "length has leading zero"},
 		{[]byte{0x30, 0x80, 0x1, 0x2, 0x1, 0x2}, "Invalid BER format"},
-		{[]byte{0x30, 0x80, 0x1, 0x2}, "end of ber data reached"},
+		{[]byte{0x30, 0x80, 0x1, 0x2}, "BER tag length is more than available data"},
 		{[]byte{0x30, 0x03, 0x01, 0x02}, "length is more than available data"},
 		{[]byte{0x30}, "end of ber data reached"},
 		{[]byte("?0"), "end of ber data reached"},
diff --git a/helper/pkcs7/decrypt.go b/helper/pkcs7/decrypt.go
index acedb1ec92a..eae0bb810d0 100644
--- a/helper/pkcs7/decrypt.go
+++ b/helper/pkcs7/decrypt.go
@@ -9,6 +9,7 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
+	"crypto/x509/pkix"
 	"encoding/asn1"
 	"errors"
 	"fmt"
@@ -33,15 +34,70 @@ func (p7 *PKCS7) Decrypt(cert *x509.Certificate, pkey crypto.PrivateKey) ([]byte
 	switch pkey := pkey.(type) {
 	case *rsa.PrivateKey:
 		var contentKey []byte
-		contentKey, err := rsa.DecryptPKCS1v15(rand.Reader, pkey, recipient.EncryptedKey)
-		if err != nil {
-			return nil, err
+		switch {
+		case recipient.KeyEncryptionAlgorithm.Algorithm.Equal(OIDEncryptionAlgorithmRSAOAEP):
+			oaepHash, err := parseRSAOaepParam(recipient.KeyEncryptionAlgorithm.Parameters)
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse RSA OAEP parameter: %w", err)
+			}
+			contentKey, err = rsa.DecryptOAEP(oaepHash.New(), rand.Reader, pkey, recipient.EncryptedKey, []byte{})
+			if err != nil {
+				return nil, fmt.Errorf("failed OAEP decryption of content key: %w", err)
+			}
+		default:
+			var err error
+			contentKey, err = rsa.DecryptPKCS1v15(rand.Reader, pkey, recipient.EncryptedKey)
+			if err != nil {
+				return nil, fmt.Errorf("failed PKCS1v15 decryption of content key: %w", err)
+			}
 		}
 		return data.EncryptedContentInfo.decrypt(contentKey)
 	}
 	return nil, ErrUnsupportedAlgorithm
 }
 
+// parseRSAOaepParam parses the RSA-OAEP parameters as defined in RFC 3447,
+// at the moment we don't support the PSourceAlgorithm (label attribute)
+func parseRSAOaepParam(parameters asn1.RawValue) (crypto.Hash, error) {
+	if len(parameters.Bytes) == 0 {
+		// Based on RFC 3447 Section A.2.1, if the parameter is absent, we assume SHA-1.
+		return crypto.SHA1, nil
+	}
+
+	type rsaOAEPParams struct {
+		HashAlgorithm    pkix.AlgorithmIdentifier `asn1:"tag:0,optional,explicit"`
+		MaskGenAlgorithm pkix.AlgorithmIdentifier `asn1:"tag:1,optional,explicit"`
+		PSourceAlgorithm pkix.AlgorithmIdentifier `asn1:"tag:2,optional,explicit"`
+	}
+
+	var params rsaOAEPParams
+	_, err := asn1.Unmarshal(parameters.FullBytes, &params)
+	if err != nil {
+		return 0, errors.New("failed to parse RSA-OAEP parameters")
+	}
+
+	// Parse the hash algorithm
+	hashOID := params.HashAlgorithm.Algorithm
+	var hash crypto.Hash
+	switch {
+	case hashOID == nil:
+		// If the hash algorithm is not specified, we assume SHA-1.
+		hash = crypto.SHA1
+	case hashOID.Equal(OIDDigestAlgorithmSHA1):
+		hash = crypto.SHA1
+	case hashOID.Equal(OIDDigestAlgorithmSHA256):
+		hash = crypto.SHA256
+	case hashOID.Equal(OIDDigestAlgorithmSHA384):
+		hash = crypto.SHA384
+	case hashOID.Equal(OIDDigestAlgorithmSHA512):
+		hash = crypto.SHA512
+	default:
+		return 0, fmt.Errorf("unsupported hash algorithm in RSA-OAEP parameters: %s", hashOID)
+	}
+
+	return hash, nil
+}
+
 // DecryptUsingPSK decrypts encrypted data using caller provided
 // pre-shared secret
 func (p7 *PKCS7) DecryptUsingPSK(key []byte) ([]byte, error) {
@@ -52,15 +108,40 @@ func (p7 *PKCS7) DecryptUsingPSK(key []byte) ([]byte, error) {
 	return data.EncryptedContentInfo.decrypt(key)
 }
 
+func (p7 *PKCS7) GetEncryptionAlgo() (int, error) {
+	data, ok := p7.raw.(envelopedData)
+	if !ok {
+		return -1, ErrNotEncryptedContent
+	}
+
+	alg := data.EncryptedContentInfo.ContentEncryptionAlgorithm.Algorithm
+	return encryptedAlgoOidToConstant(alg)
+}
+
+// convert the Encrypted Algorithm OID to our internal constants for Encryption Algorithms
+func encryptedAlgoOidToConstant(alg asn1.ObjectIdentifier) (int, error) {
+	switch {
+	case alg.Equal(OIDEncryptionAlgorithmDESCBC):
+		return EncryptionAlgorithmDESCBC, nil
+	case alg.Equal(OIDEncryptionAlgorithmDESEDE3CBC):
+		return EncryptionAlgorithmDESEDE3CBC, nil
+	case alg.Equal(OIDEncryptionAlgorithmAES128CBC):
+		return EncryptionAlgorithmAES128CBC, nil
+	case alg.Equal(OIDEncryptionAlgorithmAES256CBC):
+		return EncryptionAlgorithmAES256CBC, nil
+	case alg.Equal(OIDEncryptionAlgorithmAES128GCM):
+		return EncryptionAlgorithmAES128GCM, nil
+	case alg.Equal(OIDEncryptionAlgorithmAES256GCM):
+		return EncryptionAlgorithmAES256GCM, nil
+	default:
+		return -1, ErrUnsupportedAlgorithm
+	}
+}
+
 func (eci encryptedContentInfo) decrypt(key []byte) ([]byte, error) {
 	alg := eci.ContentEncryptionAlgorithm.Algorithm
-	if !alg.Equal(OIDEncryptionAlgorithmDESCBC) &&
-		!alg.Equal(OIDEncryptionAlgorithmDESEDE3CBC) &&
-		!alg.Equal(OIDEncryptionAlgorithmAES256CBC) &&
-		!alg.Equal(OIDEncryptionAlgorithmAES128CBC) &&
-		!alg.Equal(OIDEncryptionAlgorithmAES128GCM) &&
-		!alg.Equal(OIDEncryptionAlgorithmAES256GCM) {
-		return nil, ErrUnsupportedAlgorithm
+	if _, err := encryptedAlgoOidToConstant(alg); err != nil {
+		return nil, err
 	}
 
 	// EncryptedContent can either be constructed of multple OCTET STRINGs
diff --git a/helper/pkcs7/decrypt_test.go b/helper/pkcs7/decrypt_test.go
index f8d1592c132..fb4d19defcf 100644
--- a/helper/pkcs7/decrypt_test.go
+++ b/helper/pkcs7/decrypt_test.go
@@ -2,7 +2,13 @@ package pkcs7
 
 import (
 	"bytes"
+	"crypto"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"encoding/base64"
 	"testing"
+
+	"github.com/stretchr/testify/require"
 )
 
 func TestDecrypt(t *testing.T) {
@@ -59,3 +65,48 @@ o5FC5Jg2FUfFzZSDmyZ6IONUsdF/i78KDV5nRv1R+hI6/oRlWNCtTNBv/lvBBd6b
 dseUE9QoaQZsn5lpILEvmQJAZ0B+Or1rAYjnbjnUhdVZoy9kC4Zov+4UH3N/BtSy
 KJRWUR0wTWfZBPZ5hAYZjTBEAFULaYCXlQKsODSp0M1aQA==
 -----END PRIVATE KEY-----`
+
+// TestRsaOAEPKeyIdentifier validates that we can parse the RSA-OAEP algo
+// identifier's parameters correctly. See RFC 3447 for the definition
+func TestRsaOAEPKeyIdentifier(t *testing.T) {
+	t.Parallel()
+
+	t.Run("no params", func(t *testing.T) {
+		hash, err := parseRSAOaepParam(asn1.NullRawValue)
+		require.NoError(t, err)
+		require.Equal(t, hash, crypto.SHA1)
+	})
+
+	t.Run("only pSource parameter set", func(t *testing.T) {
+		// This is the base64 encoded key identifier that only has pSource parameter set.
+		// Example pulled from https://github.com/pnwamk/mbedtls/blob/rsaes-oaep/example_tpm_cert.der linked
+		// from https://github.com/Mbed-TLS/mbedtls/issues/1015
+		base64KeyId := "MCIGCSqGSIb3DQEBBzAVohMwEQYJKoZIhvcNAQEJBARUQ1BB"
+		rawKeyId, err := base64.StdEncoding.DecodeString(base64KeyId)
+		require.NoError(t, err)
+
+		var keyId pkix.AlgorithmIdentifier
+		_, err = asn1.Unmarshal(rawKeyId, &keyId)
+		require.NoError(t, err)
+
+		hash, err := parseRSAOaepParam(keyId.Parameters)
+		require.NoError(t, err)
+		require.Equal(t, hash, crypto.SHA1)
+	})
+
+	t.Run("full parameters", func(t *testing.T) {
+		// This is the base64 encoded key identifier that has all parameters set, example pulled from
+		// https://stackoverflow.com/questions/22194359/rsaes-oaep-certificate-public-key-0-bits
+		base64KeyId := "MFIGCSqGSIb3DQEBBzBFoA8wDQYJYIZIAWUDBAIBBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAIBBQCiFDASBgkqhkiG9w0BAQkEBVRDUEEA"
+		rawKeyId, err := base64.StdEncoding.DecodeString(base64KeyId)
+		require.NoError(t, err)
+
+		var keyId pkix.AlgorithmIdentifier
+		_, err = asn1.Unmarshal(rawKeyId, &keyId)
+		require.NoError(t, err)
+
+		hash, err := parseRSAOaepParam(keyId.Parameters)
+		require.NoError(t, err)
+		require.Equal(t, hash, crypto.SHA256)
+	})
+}
diff --git a/helper/pkcs7/encrypt.go b/helper/pkcs7/encrypt.go
index 90da67e4eed..551c121f12a 100644
--- a/helper/pkcs7/encrypt.go
+++ b/helper/pkcs7/encrypt.go
@@ -55,6 +55,9 @@ const (
 
 	// EncryptionAlgorithmAES256GCM is the AES 256 bits with GCM encryption algorithm
 	EncryptionAlgorithmAES256GCM
+
+	// EncryptionAlgorithmDESEDE3CBC is the 3DES CBC encryption algorithm (currently only supported on decrypt)
+	EncryptionAlgorithmDESEDE3CBC
 )
 
 // ContentEncryptionAlgorithm determines the algorithm used to encrypt the
@@ -77,10 +80,10 @@ type aesGCMParameters struct {
 	ICVLen int
 }
 
-func encryptAESGCM(content []byte, key []byte) ([]byte, *encryptedContentInfo, error) {
+func encryptAESGCM(content []byte, key []byte, algo int) ([]byte, *encryptedContentInfo, error) {
 	var keyLen int
 	var algID asn1.ObjectIdentifier
-	switch ContentEncryptionAlgorithm {
+	switch algo {
 	case EncryptionAlgorithmAES128GCM:
 		keyLen = 16
 		algID = OIDEncryptionAlgorithmAES128GCM
@@ -88,7 +91,7 @@ func encryptAESGCM(content []byte, key []byte) ([]byte, *encryptedContentInfo, e
 		keyLen = 32
 		algID = OIDEncryptionAlgorithmAES256GCM
 	default:
-		return nil, nil, fmt.Errorf("invalid ContentEncryptionAlgorithm in encryptAESGCM: %d", ContentEncryptionAlgorithm)
+		return nil, nil, fmt.Errorf("invalid ContentEncryptionAlgorithm in encryptAESGCM: %d", algo)
 	}
 	if key == nil {
 		// Create AES key
@@ -147,10 +150,23 @@ func encryptAESGCM(content []byte, key []byte) ([]byte, *encryptedContentInfo, e
 	return key, &eci, nil
 }
 
-func encryptDESCBC(content []byte, key []byte) ([]byte, *encryptedContentInfo, error) {
+func encryptDESCBC(content []byte, key []byte, algo int) ([]byte, *encryptedContentInfo, error) {
+	var keyLen int
+	var algID asn1.ObjectIdentifier
+	switch algo {
+	case EncryptionAlgorithmDESCBC:
+		keyLen = 8
+		algID = OIDEncryptionAlgorithmDESCBC
+	case EncryptionAlgorithmDESEDE3CBC:
+		keyLen = 24
+		algID = OIDEncryptionAlgorithmDESEDE3CBC
+	default:
+		return nil, nil, fmt.Errorf("invalid ContentEncryptionAlgorithm in encryptDESCBC: %d", algo)
+	}
+
 	if key == nil {
-		// Create DES key
-		key = make([]byte, 8)
+		// Create our key
+		key = make([]byte, keyLen)
 
 		_, err := rand.Read(key)
 		if err != nil {
@@ -166,9 +182,20 @@ func encryptDESCBC(content []byte, key []byte) ([]byte, *encryptedContentInfo, e
 	}
 
 	// Encrypt padded content
-	block, err := des.NewCipher(key)
-	if err != nil {
-		return nil, nil, err
+	var block cipher.Block
+	switch algo {
+	case EncryptionAlgorithmDESCBC:
+		block, err = des.NewCipher(key)
+		if err != nil {
+			return nil, nil, err
+		}
+	case EncryptionAlgorithmDESEDE3CBC:
+		block, err = des.NewTripleDESCipher(key)
+		if err != nil {
+			return nil, nil, err
+		}
+	default:
+		return nil, nil, fmt.Errorf("invalid ContentEncryptionAlgorithm in encryptDESCBC: %d", algo)
 	}
 	mode := cipher.NewCBCEncrypter(block, iv)
 	plaintext, err := pad(content, mode.BlockSize())
@@ -182,7 +209,7 @@ func encryptDESCBC(content []byte, key []byte) ([]byte, *encryptedContentInfo, e
 	eci := encryptedContentInfo{
 		ContentType: OIDData,
 		ContentEncryptionAlgorithm: pkix.AlgorithmIdentifier{
-			Algorithm:  OIDEncryptionAlgorithmDESCBC,
+			Algorithm:  algID,
 			Parameters: asn1.RawValue{Tag: 4, Bytes: iv},
 		},
 		EncryptedContent: marshalEncryptedContent(cyphertext),
@@ -191,10 +218,10 @@ func encryptDESCBC(content []byte, key []byte) ([]byte, *encryptedContentInfo, e
 	return key, &eci, nil
 }
 
-func encryptAESCBC(content []byte, key []byte) ([]byte, *encryptedContentInfo, error) {
+func encryptAESCBC(content []byte, key []byte, algo int) ([]byte, *encryptedContentInfo, error) {
 	var keyLen int
 	var algID asn1.ObjectIdentifier
-	switch ContentEncryptionAlgorithm {
+	switch algo {
 	case EncryptionAlgorithmAES128CBC:
 		keyLen = 16
 		algID = OIDEncryptionAlgorithmAES128CBC
@@ -202,7 +229,7 @@ func encryptAESCBC(content []byte, key []byte) ([]byte, *encryptedContentInfo, e
 		keyLen = 32
 		algID = OIDEncryptionAlgorithmAES256CBC
 	default:
-		return nil, nil, fmt.Errorf("invalid ContentEncryptionAlgorithm in encryptAESCBC: %d", ContentEncryptionAlgorithm)
+		return nil, nil, fmt.Errorf("invalid ContentEncryptionAlgorithm in encryptAESCBC: %d", algo)
 	}
 
 	if key == nil {
@@ -260,22 +287,38 @@ func encryptAESCBC(content []byte, key []byte) ([]byte, *encryptedContentInfo, e
 //
 // TODO(fullsailor): Add support for encrypting content with other algorithms
 func Encrypt(content []byte, recipients []*x509.Certificate) ([]byte, error) {
+	return EncryptWithAlgo(content, recipients, ContentEncryptionAlgorithm)
+}
+
+// EncryptWithAlgo creates and returns an envelope data PKCS7 structure with encrypted
+// recipient keys for each recipient public key using the specified algorithm.
+//
+// The algorithm must be one of the supported encryption algorithms:
+//   - EncryptionAlgorithmDESCBC
+//   - EncryptionAlgorithmDESEDE3CBC
+//   - EncryptionAlgorithmAES128CBC
+//   - EncryptionAlgorithmAES256CBC
+//   - EncryptionAlgorithmAES128GCM
+//   - EncryptionAlgorithmAES256GCM
+func EncryptWithAlgo(content []byte, recipients []*x509.Certificate, algo int) ([]byte, error) {
 	var eci *encryptedContentInfo
 	var key []byte
 	var err error
 
 	// Apply chosen symmetric encryption method
-	switch ContentEncryptionAlgorithm {
+	switch algo {
 	case EncryptionAlgorithmDESCBC:
-		key, eci, err = encryptDESCBC(content, nil)
+		fallthrough
+	case EncryptionAlgorithmDESEDE3CBC:
+		key, eci, err = encryptDESCBC(content, nil, algo)
 	case EncryptionAlgorithmAES128CBC:
 		fallthrough
 	case EncryptionAlgorithmAES256CBC:
-		key, eci, err = encryptAESCBC(content, nil)
+		key, eci, err = encryptAESCBC(content, nil, algo)
 	case EncryptionAlgorithmAES128GCM:
 		fallthrough
 	case EncryptionAlgorithmAES256GCM:
-		key, eci, err = encryptAESGCM(content, nil)
+		key, eci, err = encryptAESGCM(content, nil, algo)
 
 	default:
 		return nil, ErrUnsupportedEncryptionAlgorithm
@@ -330,6 +373,18 @@ func Encrypt(content []byte, recipients []*x509.Certificate) ([]byte, error) {
 // EncryptUsingPSK creates and returns an encrypted data PKCS7 structure,
 // encrypted using caller provided pre-shared secret.
 func EncryptUsingPSK(content []byte, key []byte) ([]byte, error) {
+	return EncryptUsingPSKWithAlgo(content, key, ContentEncryptionAlgorithm)
+}
+
+// EncryptUsingPSKWithAlgo creates and returns an encrypted data PKCS7 structure,
+// encrypted using caller provided pre-shared secret with the specified algorithm.
+//
+// The algorithm must be one of the supported encryption algorithms:
+//   - EncryptionAlgorithmDESCBC
+//   - EncryptionAlgorithmDESEDE3CBC
+//   - EncryptionAlgorithmAES128GCM
+//   - EncryptionAlgorithmAES256GCM
+func EncryptUsingPSKWithAlgo(content []byte, key []byte, algo int) ([]byte, error) {
 	var eci *encryptedContentInfo
 	var err error
 
@@ -338,14 +393,16 @@ func EncryptUsingPSK(content []byte, key []byte) ([]byte, error) {
 	}
 
 	// Apply chosen symmetric encryption method
-	switch ContentEncryptionAlgorithm {
+	switch algo {
 	case EncryptionAlgorithmDESCBC:
-		_, eci, err = encryptDESCBC(content, key)
+		fallthrough
+	case EncryptionAlgorithmDESEDE3CBC:
+		_, eci, err = encryptDESCBC(content, key, algo)
 
 	case EncryptionAlgorithmAES128GCM:
 		fallthrough
 	case EncryptionAlgorithmAES256GCM:
-		_, eci, err = encryptAESGCM(content, key)
+		_, eci, err = encryptAESGCM(content, key, algo)
 
 	default:
 		return nil, ErrUnsupportedEncryptionAlgorithm
diff --git a/helper/pkcs7/encrypt_test.go b/helper/pkcs7/encrypt_test.go
index 7f1bead232b..cf0bb5b347f 100644
--- a/helper/pkcs7/encrypt_test.go
+++ b/helper/pkcs7/encrypt_test.go
@@ -9,6 +9,7 @@ import (
 func TestEncrypt(t *testing.T) {
 	modes := []int{
 		EncryptionAlgorithmDESCBC,
+		EncryptionAlgorithmDESEDE3CBC,
 		EncryptionAlgorithmAES128CBC,
 		EncryptionAlgorithmAES256CBC,
 		EncryptionAlgorithmAES128GCM,
@@ -49,7 +50,9 @@ func TestEncrypt(t *testing.T) {
 func TestEncryptUsingPSK(t *testing.T) {
 	modes := []int{
 		EncryptionAlgorithmDESCBC,
+		EncryptionAlgorithmDESEDE3CBC,
 		EncryptionAlgorithmAES128GCM,
+		EncryptionAlgorithmAES256GCM,
 	}
 
 	for _, mode := range modes {
@@ -60,9 +63,16 @@ func TestEncryptUsingPSK(t *testing.T) {
 		switch mode {
 		case EncryptionAlgorithmDESCBC:
 			key = []byte("64BitKey")
+		case EncryptionAlgorithmDESEDE3CBC:
+			key = []byte("192BitKeyForMoreSecurity")
 		case EncryptionAlgorithmAES128GCM:
 			key = []byte("128BitKey4AESGCM")
+		case EncryptionAlgorithmAES256GCM:
+			key = []byte("256BitKey4AESGCM256BitKey4AESGCM")
+		default:
+			t.Errorf("unsupported mode %d", mode)
 		}
+
 		ciphertext, err := EncryptUsingPSK(plaintext, key)
 		if err != nil {
 			t.Fatal(err)
diff --git a/helper/pkcs7/pkcs7.go b/helper/pkcs7/pkcs7.go
index 69155692e3a..b8a05004884 100644
--- a/helper/pkcs7/pkcs7.go
+++ b/helper/pkcs7/pkcs7.go
@@ -14,6 +14,7 @@ import (
 	"errors"
 	"fmt"
 	"sort"
+	"strings"
 )
 
 // PKCS7 Represents a PKCS7 structure
@@ -63,6 +64,7 @@ var (
 
 	// Signature Algorithms
 	OIDEncryptionAlgorithmRSA       = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 1}
+	OIDEncryptionAlgorithmRSAOAEP   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 7}
 	OIDEncryptionAlgorithmRSASHA1   = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 5}
 	OIDEncryptionAlgorithmRSASHA256 = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 11}
 	OIDEncryptionAlgorithmRSASHA384 = asn1.ObjectIdentifier{1, 2, 840, 113549, 1, 1, 12}
@@ -81,6 +83,10 @@ var (
 	OIDEncryptionAlgorithmAES256GCM  = asn1.ObjectIdentifier{2, 16, 840, 1, 101, 3, 4, 1, 46}
 )
 
+func GetHashForDigestAlgorithm(digestAlg asn1.ObjectIdentifier) (crypto.Hash, error) {
+	return getHashForOID(digestAlg)
+}
+
 func getHashForOID(oid asn1.ObjectIdentifier) (crypto.Hash, error) {
 	switch {
 	case oid.Equal(OIDDigestAlgorithmSHA1), oid.Equal(OIDDigestAlgorithmECDSASHA1),
@@ -210,7 +216,18 @@ func (raw rawCertificates) Parse() ([]*x509.Certificate, error) {
 		return nil, err
 	}
 
-	return x509.ParseCertificates(val.Bytes)
+	stdlibCerts, err := x509.ParseCertificates(val.Bytes)
+	if err == nil {
+		// If the parsing was successful, return the stdlib certs and don't worry about
+		// our workarounds
+		return stdlibCerts, nil
+	}
+
+	if !strings.Contains(err.Error(), "authority key identifier incorrectly marked critical") {
+		return nil, err
+	}
+
+	return CustomParseX509Certificates(val.Bytes)
 }
 
 func isCertMatchForIssuerAndSerial(cert *x509.Certificate, ias issuerAndSerial) bool {
diff --git a/helper/pkcs7/sign_test.go b/helper/pkcs7/sign_test.go
index e08d737563f..2a4829a7e87 100644
--- a/helper/pkcs7/sign_test.go
+++ b/helper/pkcs7/sign_test.go
@@ -256,6 +256,12 @@ func TestDegenerateCertificate(t *testing.T) {
 	}
 	testOpenSSLParse(t, deg)
 	pem.Encode(os.Stdout, &pem.Block{Type: "PKCS7", Bytes: deg})
+
+	// Make sure the library can parse the PKCS7 we generated along with OpenSSL
+	_, err = Parse(deg)
+	if err != nil {
+		t.Fatalf("failed parsing degenerated certificate: %v", err)
+	}
 }
 
 // writes the cert to a temporary file and tests that openssl can read it.
diff --git a/helper/pkcs7/testdata/intune-pkcs7-sample.msg b/helper/pkcs7/testdata/intune-pkcs7-sample.msg
new file mode 100644
index 00000000000..a10616509ab
--- /dev/null
+++ b/helper/pkcs7/testdata/intune-pkcs7-sample.msg
@@ -0,0 +1 @@
+MIIczwYJKoZIhvcNAQcCoIIcwDCCHLwCAQExDzANBglghkgBZQMEAgMFADCCFyIGCSqGSIb3DQEHAaCCFxMEghcPMIIXCwYJKoZIhvcNAQcDoIIW/DCCFvgCAQAxggFPMIIBSwIBADAzMBsxGTAXBgNVBAMTEHJvb3QtZXhhbXBsZS5jb20CFB86as5zGn8V//A8NlvaPTfiYX8cMA0GCSqGSIb3DQEBBzAABIIBAHIcoMZjhZnkniOF/r8SZZiibYKSk9voW9F5gM6w8cuJA9GlNsRRFtZy56FH7iyFX4fQ2FlKlidwhy8JXZLyY2s1GKgL0T1kndUS9jfodmGks1cnedpAKvVek0WyOfMkcoo6fP2u8ChU2TJDPBEPbZx4+Sgeh062gfNPde1lqzqkkuPTek/sWkD2aMvcvcAPL9xh+opPWojLKO0HPeLefgMfRORrtRqyQkiacv2tyXSTPD+o9h6ZxsagsO2bxxUtQ48na7cIQJW6LmOJjUK/IR8Wzp+rclecjaBkU+2z+Vlpz5zS+t8sARaIa/qAMWwmG+mCp/dtipDHOC51tLOtyoQwghWeBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAECBBA7rQT3YywgAOXpnPQBSHUggIIVcMWh/0Md+BVGNZJ2rS8shdVbP8yenWojFFMjLMqLTjTVA4I+81Zio41uF+EUrUI7/WJzlYh0UCR7gVrZ3SxdvxVvM5JvOaMpelgPc8mst2T+G0YOuflCL7P8z5TJHsbm1cvdWC45SUW8KXiubj4Rym0HObMFDkuUlaSrzlRwJ9hjJL6sWiw3yNgDvXtVl8yZV7/hRMU0noNsg75ICkMhbHVMbd+BNnNjTmmTHCHfb/IAwK2NWIh5nSm6mbem4Maoc3m50P61NuV74HQ4fPCLSe/mfB4xHijH5DkFE5DoEMImo8ddf90R1pJ78uZCIOeySsR33uwBNKXQD4AXokabAfZb+Y6LPpailoSNorfMrl9q7Q5U+6ws3kyh1jpjgbr/DChFGZ9pKGZX4LtvNHSblxckXIWTZM/egRpaL0lsC7/KYuFwqmb/bVwBhKU47kqwUe3S29/pu4/QaUbBTGglX5b6lqAEru0AP2CZMvHaFZYQIvZV7ZOfL9OfNzqZD2f+VHjn2gFIPNnJS2VYyluBLFUm2fM4D7SjhU03dTJ1qi1+8k4PZ4TyvXhQFNLcsPnkDW79tSeI7sgkkB1Qnc9XKQVw1NUiWmQOCs6zFmToJav9du3YjECaI+t+w2/DNPsrSGPPEGIehoPT3crt93DktC7iQKdduu5081exQ/XEabQMAIcXNsIUxAAa9NRCMv+LU+Y4uV7sCiop/QOJLwobKmEsSGcj2G64Qco8f0cPXAu+ieJqFTBr70ljh5OS/pgZn2Y3IOckz/avaRmInaRdvW+tjgF5/WtAnpK4qAAz49aFbRNFEkOirTGRjsoUCH5Xhww1dXH+vPbNdE5GYBA3dwhoT9/diaxl3uATGuf5OWcFgU5Xoa5MdP1wBJ5bNN2FGU2XKpNCxM4thBsjKm8G5YEVWhFEnoSfSBCewn00LYdjhk+tQyeFyeDFgYuDgz5k61f1OIsME9Wb5qh6SalS7zpoygUrpp8KVXWqYagFR1PXR1uf/9TZNrYzWaPX+rvuYHQvxWi0TMmrfp/6Aj6pFQoVQekRzV2uXORnXHdtS2GPnqUQgLE+bWLfGe4XD5Bq1e+yST6NNdJCfxIsiyssEOQChmAbWdErbtFrdVRuqpqCIlPoP7oDYmnrgphaosbHcKaap4E0ydLfiufxJgMrailHyx2NafkJiFrLZ3eSjUHHBcD2y1fJR7q50Ghc8ZUzsuUiGZDoIToQBEhtajkoOe85vdIlTn3SlNsbvr0FkSP6EE7LoTf7fWOV4e9gRC5nUk/lfKmEy8yWwwxhTj63gbQZs1OOY9alTzNCnvLKSJYGiXkcxq9in6K/Wm139fMnnuTBJ/DNe8CsacdncgcqXl3TDymgc+F9Amf4rZ0McwmmfT4tR0hCwSv90uJgjbykNZ+qu+c5x2ZrMftPPh1iEojxUztBu9y/3EWbeFjERr7R/w+FL5yQbvSq80hyYNjvihnp5t4czkYCJiMPVy7R81fvZNqDBZNX53b5LllcCGdnggtBFMKSrkQ6osOztG8gxsH4+p3SMRuqL4PEHOctSZXT1U2WrSOvUOjOO7DyZ3Gv9j//KbOtXU/MbrAktKwMaGDmxfH1PSdDU8IBDei6ebPuDGhsO72tCgBmTZK1kwaaC6+bxdgw8t0GSnCbBm2XJmpRCgKx+NC5/VPBGs199Q+x8BunsKRkMW2xhFCS0zz1TUrSiI9DlXz2YuTe8g8jKqbH5boxuCv/IEp03TuFh5K56jkH2WZ6Lb4F2v0L+6bIm7fPtvJMquqAByRy6+I1y2GUXQTWnjwN9KH0pynYZbonrH4q1eijLukNvTrUP792x8S65VMaP0BqfXs2ROa4E4seq0l/FHr5OqqB2O6Zo64ffIo4U1UPI9+d8Hc+iAt6fMhQ0znJh3iKDIEBdgTRlvuu6U0kt+IPtYfuZQG1Hjy/v8ZIYR84g/+5RFNxn+buuCNZsszvUlVTKwPfsSxlJj7kXhz4FFsr1zr5TdRSWNwSBcCtPPotbvOWVj96m2o9kW/fvhP9W1S2R5wnBlOcAY7nFx1w8WmFBFj6ZuIGQsU/82nBJri860veG2POBgay9wIp792vx4rA5ZbT7Tdqn3yHEG4qYWt84uTliGFqBX5bXBrnXV/0xVMKsXD4n9b54FnM2x47nrXSZtYuVeb13+KJjHy9+IPWX81nI/F0paylqny/6ioHK4OENHWBLSj+EbWZob0i6BxTrLoNUb6aFiQvb1DDgLiCjotgKJfyf0FjUFwiCAmllPUb8yWt8oe3K28SsGN0SlVT6CAzCt7NO7CCrI/IWKlycc822XxEv4UBWhVrLTgSkaXHg/Z6BzVsriB+oOHsGV71vjHyghjw9qnxh0wDjf6GYIuuyJ4fWA4Egcbv19+oF607vYztm2lapnNoZkKL8r5dNNn31HxS2ZYwHEfWdlzfYSBBrtpdcbQC0TNBM/A7suXbLNOiMiAzyN6jxdZjC71dJCneaRR10hKF/8DUM46oyFmIsAbKZSBpoC80lfrEu1sU3foNS0zfBzZIbAVAtyetri+rNRaHQWIo4e+UgRWZhuSBx5fuiLztkYQWAq2F+N3vr/mmALo6JU6ICi9AvmTJ6CDjFhwS5EJ8ePH97cNHv60udOwEA2UmqeaBtCouQBenZ4xhf0Hb2KEdaDEUDOXLQ51LjU58C1Ugq5s03kl7W2LmEKgym37DxqrNpiPZfgVd+GuVB9Ulrk7/YVVkrHW2hj5ib+A88Zg86njyXbSs6jcjQqMgyT7+P5m9e1uAKiu/v7tjE3l/ImrqDZhugU16XeNGg8TZsaJhzxy0RRy51dFGLYm85AwwS2bK1LAFfa4y6ZVMtUdpxT4oMnqAP+0hc6Dsy8w1HtFXpkOZAaWMtf7ftnopFrMapxhZLR3IZm+loJ1WsezusSlo0kKhQ/f1ROYd1kFc+nBJlMCbueEyPW8+XK6oFO42NafPQABJ3503Ar0wpgQaj7q7+jQNIFCYXGPcg7qWOPNSZS31U8pu7AHtb1aUPmPFxuViCQes6vYokeO0w1AzqkXC3z3euyZZlX74ANQjMpCN3CCHDgUDtDTZCCnSMjVLLO0chlWNJrp2TKR8MwXCG6uVC4HeGh6z45DPtJO3hXkDlrxQWKbyeYo92wMboslDImNbKhJRiGY1pi/JoBQVubtSZs6oOl33rkLyBxCePxxLY5PSusOGbXMhM7rpK9z2nokqXmgm6mf9y8cVMZEA7JdSwgAcdmmr1GZPgDL3DrAGuOMJ3absLzMp6xKd3ylHrS1Vw0jgn11xl7GVqSeKx50rVDUHtArh46S5CyTEO6rOo1WqG2nj8SQMJUMKjlKrpkawpxGsbM4O2322sL7LYqJP7cvvGZgeo6wfzjLBa9LNHiEpac3aaTOyAHriTl1KAG6hm0UjnKQa/GwlfjcLpUk3MU5jZvaffcpaE9oCbwZeubVuo2Io0maHroFSeBSDEJQrWkIi5pXVdSSqAEdAJdWBTg8u5QtYwYy/udVsUw3hI7d1X+YMAEDcqvjLhxag7R+Nlq1Un9dLFuXVE3i3v295dPdgTQmnm2Yt5frH9yTipfEwYjEVq6H0pOeQWB7NSI8Zv2949Ou8n22Nu86EjVB6lBxEDyM+xwQkOVxVWjulZhc7TkfG/L6bV6Kz2ppqexn9AgU8kCVrTQv9MccVw+gnaHKzGxWILjywweJSlBuzZ1B29avF4gMP7i+FXfN6gI+KfDIlIZuqIcrKgVgEXeFI3XXirZVWvgY9Z4Ciyq6sLY5YQfKQLeLd0LA3XreqIpwuTELr/n6L22UxaAHHRpkfA9Vvuop//68a5kcUI+Xoy1354f/ZI+9xO8Yip53z/z8COSAPt+lsmfv3hNP/y0TBuuNgQOpxt2H72cDuem2AUOZ+hr0Ds3TCDbc0Gr63f4VyluVU7TxjkhONCkFhElp9hLtCQ6IHjd4F8VIamAZ40omQWb1jSgtCGRrmXGnUQBX5Zxkgr/2cCRfwOAiNzskeTBEnvUqz5VleHny2tVWqMvJsxsgAoaN1I7VFShmCbsDqI4qHp7TXgvsN3yEt1DWersspU8X/JPnIpKLk9wUiB64W7yIH5zVHfVpjAECXQM4GWuxQkybxiwzPNV3gA7W0i+O33K+PxKTyMApmmn11BjDoRVprnuz4Mm7FHgkdqjnzVXYJ6W3KFuPZ/gt3j3H7XPJnw731nbaZI10Dp8Zg5ldz7X/1v+Jo/UrR6iw3ZHHbl+2uDQzWuSaSw7aUsH4sUUEf3+452KWWqmdFc7gjldYnF14ZTr6dHDmxjZG+Z7fjBaH0U2L0S84LGsdw/lv1dM3GyYLD0xgEVohkWSqDnmlnV3d+k5BNYAyO1nqwKCqYt5cajoeGVKjL46w6XrFBdHFhZKq6fwdRidlWbsqrUJJ9plvKh9ili/LjAw4ODnMq5wb0eSWu5QRD4zvpy8Rc78vSUroMhg7tSiRxOhXY2rbQPg3JMsLDW15XlZBHs357S/TsngkruU7e+QDjHzArIoX4WgSUQJwuhy8izXX2uzIn0Bvt+/U4XHukQ2VIBAw7Z5w9IYX8KQ0rD3gFr+gcBRB75LPxU2aMN6abBuoZnJ1z2x+2pDtveUpVwKwSnTu2vnGenbbg1oH3om6sfA5R6/HjGV/FfK2ygTtWhZnioSEOAzAW3AqiyrzysKVbjVbDhqH6R4JwYpSiUlBYQ+atIT7f2DNzjHuRMftfkjgAfkvzdDUa6qJ9UBjrBjhOhCQMjg7zoE61ydSZvZFjLu7xLJh+G+1nhPLq+cq+7m+JUok4Pq0NLNBeAZf420JTFIyoAD1NVWRG664FbjGYg1IUxW+AG3rjuChu8voybstVUoXL5aH8FhQ9GmMA/ndWcJ+S9b2m7ICYvSvdpX+UMKu3sinRby1AW0s9+a3DDZcHQz0NrawSFCISRUIveNmUPyqCYFTYF964hoHGjB8iHyOb4HHhIizcOPKKoH8gHGYNQW9GZKn/PcwNRf8XQrXUkFVNsWPXrzpFLTtJarA9KswUmTf434ijgfdJHypR4bwewmnJC6YbBOsENfuXtniN1TfJtUmU8OOms+YquzRJV+GKlvRQySgmk93lG2rE+83ZPTRT7w8W3qmzEr72Trw3Q9AHgTxAM9pwxuCb7fJsBgR15JSh17mMCv9ESg3A9WfMnQKyIvN/UR2hamXyhwlT3JQaUf2GJnCbL3Qj00DN/h7wa8v2CvYogun4eEEIVOs9UqN6Fl7fOwSReUyQW0Y/NpNUA5uJokJLinQD/SDB59AZ20oXy651zAYW3ZYJeXI7teIKqasU9Siy8vGd/9pur/YvjlccWPviDaTThyE4z7oXMOKLXOqdDbaX236GOvVALq2Db3JyX2OqAghPssFXbIwkMMo3mrkOseovq22s/nGB5WtMaSby+NpZfGzq/JGAdlYMglwkXPJxX56ZOpbd8xoLCOqQxxtUKQclT6FGBrh8LDzRkmi0N2geizxVNuTfIANi+s18+nh10z54TYNwXxUzaZXjj0sp+clyLaFMCR9KZQriazMkQqDTF3kx+tyyrRC5qKEIwUeZCDM5wlVs+boHBFD2avG7J5yEDTB7l2UlvQO77ayFLx+qtWp1bIR0lPL6Z8VblDnnIe2lri3SMA4pu6PsZaOLlM6imVUTqNjL4eB9i+YLBuAqbzwhX0GIbUXBe09qFhbcsQf7GZ3jzDTwsL1IWqOHwAJ4ijF6vu74kprgf5zNVrJu9KVPHf7KfURPxuKwlIL+tHWlelDUtvdAitsG9jv6n7h7/s66DWWacWtpO43IWDXHkzA1hVsyCgMuRxw31rL9Ykx34e1JByFZB/NIQ8n0mzScfb3AMnKSzutu4oFwkpGLWOyMd6zMvR0ZtLnFN3NLUEFaGqzrrWVIwvW5Q9Y3wZ2CNPMvwMCoizVg0Yn15V4L4UH4cBqGXVwJn8NoOvnpe0j82eaDw3RwLRORENNq3NjFR5TAhyjHsGEPHmbzY8oD1Cs+lEDRfdVrh5TSaUtbfRnRknrwwajUaGZdzqQ7K6b0jBcMh22ZRT/5kPPBonSasjE0md3HA5lH7u1bqctQr6fhrIcIblX0IkPzn1kF6OjUGvsQ+Hbh6q9tzdQIBQfGs5BlPtbWhypgfutRxH6Q81kqZ1GAcov6lFSVkaChau+gBjuww5lBX4+XzH+nYQQizI1zHGHsW41p8ahge2i83/7EjNshC2ECyrb0nlv2uUOhFUKQYPQk51NghUk3QVxumCI4Kstfi+UTbC6OeiWsnhdXu01CCgnzbgcWuYr3PgKOjvFgc6f3TXWGe3JEiSZS70sHLHJ5hvTq0hJSxw2Iy3E5x2Nrl/WZB1hFs9uW45ty1u52Y7r8HCwQfZ+E7N+llV2CidnWE33T4itG+gf6mFcJnAoUS9KSOmI7gSjp32C13fyYWKjUvKfE6H/fGZ2mMX0W1XeFgIa91CiHwW7qjbUmoBP3qMvvWCNq7YMa+iUuty6xVHhxypV9iTL0ckAgm/kK/LBqPZXtg7FWqM71HNXBRZrwI20uxa03KE4KFfNL4mr8Jeg4hkPxJD/eVrv1ioBWHODVOtUdJFVG37xjQXB/6ldnVP4/7IlLQxBCehuLSrxcXj/MMUUB8+OY7tsYHcQsps8DSOQjacEYzriDV3xM/JNqcR8MvXvntWLnL03CbTF68Vt6W96Jb3jN5+ybVQ+5nU/Df0ts3SWGzu3BbXJ1T3gZO1orCd4Zp6Vd8HZ+uT0c5+WDFezP1+iS/4611OaV5W9orzuVGh13T/RzzpCJfwIWxHUeIFgUPw1SiuD2OfRK+P38aCJpwyuCU9OGGBe7LTbxeBauG0aVsovOk+2KB3sX9Ah5BUEeav4huxbnijH4ecmcXM3dlOH0NQgGnnPt9P6YISwK1cZVS7N6paiEGQDGlqqNetJne7ug+Lav5FTeB6P53nT6AqmMv2gLNRwfmg843FHPKtPHq4Up8RzHI5+f1GMUdHmql/aWvj2AEiXrsW6bgH4phXTKvwp5rLiajCBmyYpW+H/wF6X+WcpIAOxPN3j7soobzHgjemlHez7D+8Gux5j4efs2WawBZfDjJc9GXm1OL+UwbrE9KegN5xctzp/U3c2Qz1WqU5C5rJWrZhg55n774AodCpTV81yty2kZpqX0r/utleNa32OKUhGUEnNFvb4ONSxVZ/WbBl0DU069WDKGvVdGPFcDKKi1lRu2zrTmRefP2lO0cvW+MXcGI7KmwgXEdxUE3xcgx34YB1veKgDB/J9m9HzOkw5EJ8sr0ieA6V0f5hl+lrS2yCmgggMbMIIDFzCCAf+gAwIBAgIQSysOiIOb5apJwiDJHLn1uDANBgkqhkiG9w0BAQ0FADAkMSIwIAYDVQQDDBlTQ0VQIFByb3RvY29sIENlcnRpZmljYXRlMB4XDTI1MDUwOTE0MTAwMloXDTI2MDUwOTE0MzAwMlowJDEiMCAGA1UEAwwZU0NFUCBQcm90b2NvbCBDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANCTIMSMrDAiDEqWt9bPW6eMS+g0AwDwcay4Nyo7uLaXSV7jtAnstzTz1rtYhbDuGzVkTQRBFm+pft1EqoXkpLcgGsyRHp5zNKDkODzU7dGWlw8MKCbrFVQhp7y1qQC0n5qDa7TLHung5sub9+jiHBXStWFusQNbjuLINDjZe4VPVWyvue4AOXRn6SlV9ipPgiVftCs++7UpSj2EeXJDUvh0lq3Kv1UPF45/XHp9nOjx8X/GmT4Ls+yV4JR1b3LvaP4XBbkJgz+YE5vP5eJUj/0x/ipbvxSIvUiDTF4iD515ZyqBl+D4gyEwxzVhC5I49FV69Uotb1C/p7Js9zD5ShkCAwEAAaNFMEMwIgYDVR0jAQH/BBgwFoAUYlW6uEyGca0J6N2Keh5qKkrrnZowHQYDVR0OBBYEFM69DSMAmRxlVFaiRKycs32snfHnMA0GCSqGSIb3DQEBDQUAA4IBAQCwGY6DlZEZU2rU+Zd0niVFT8lzJIhOkkEzF1TLbDFxVHODjnw43jnAgZm2n3dML3r1Rs6GCYDowD0nw0MJtXWLtTuc+VfOR03IzRI2tBNfxsz9/IAHAXiUznevZVe5u6SkFQYIGE5jfMBwwNx8gduX87IrEZHeF10g2oHNgDcBZEJBlkm72//LpWc9aqJt/6LkzTjdZFCDj/YvI5U/dVql6tA5Qo7P8+QVU5krpdRmiqbFMKIAJKH0clEDhJ/bpzcrcSJnG+07LjXGFJYt+WYyeIXnx7KstGcoG8GEuyuuka8/5lCD0u3/nGMkCFBZLpMsDTx7yVortmvIxEGhBwIqMYICXzCCAlsCAQEwODAkMSIwIAYDVQQDDBlTQ0VQIFByb3RvY29sIENlcnRpZmljYXRlAhBLKw6Ig5vlqknCIMkcufW4MA0GCWCGSAFlAwQCAwUAoIH5MBIGCmCGSAGG+EUBCQIxBBMCMTkwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjUwNTA5MTQyMDAzWjAgBgpghkgBhvhFAQkFMRIEEN9UcFGZ87Gm/oXLejFdB4cwOAYKYIZIAYb4RQEJBzEqEygzMDNlZDE2MjA4NmY0ZjRhZWVkNjQ5OGI2OTg4NzZhMWNiOWNiYmI0ME8GCSqGSIb3DQEJBDFCBEAhzBWoN8C4pJAUSqpuxvZtQPfvF6n/xFgcROqnA1jTmMhz5ZvIZ30lfNYAzrMONC5Mu/wi38oggG4pxsIvz5a8MA0GCSqGSIb3DQEBAQUABIIBAGZnm5CqVt7hmjVxiCNdkhUbnodRg/jNuvLOzCBL/K0P1r7mHwSfnndm1hTmzUsKFwSjiaJh+84cYQ8Gybd5kVuDi0hvn1xP/DRpceOj29M4fNZd7bTuX5SKmLNHYvx975qUuLoJ/n0Yf4o1SWM6jwwG+xEQ3M4h8QOcwYeAsaAL2u0LJActiONbd5duOFv7wh+D8FeiJFpXhtpKEvd199nbRwKb9lOYE42Gldun/8Y/iNCJDqYdBRgnUw9PShGOjd2Xur7XqKr8cLRm9qAzdU9NVLC1YGqZnCl0YLpHAcHZh6/gR2h4IdkXKCD92oWPK+FW+21hIKtI6WDl7W1sKP4=
\ No newline at end of file
diff --git a/helper/pkcs7/verify.go b/helper/pkcs7/verify.go
index 8dff1eaecf1..cdc62246d29 100644
--- a/helper/pkcs7/verify.go
+++ b/helper/pkcs7/verify.go
@@ -81,8 +81,9 @@ func verifySignatureAtTime(p7 *PKCS7, signer signerInfo, truststore *x509.CertPo
 		computed := h.Sum(nil)
 		if subtle.ConstantTimeCompare(digest, computed) != 1 {
 			return &MessageDigestMismatchError{
-				ExpectedDigest: digest,
-				ActualDigest:   computed,
+				DigestAlgorithm: signer.DigestAlgorithm.Algorithm,
+				ExpectedDigest:  digest,
+				ActualDigest:    computed,
 			}
 		}
 		signedData, err = marshalAttributes(signer.AuthenticatedAttributes)
@@ -184,8 +185,9 @@ func verifySignature(p7 *PKCS7, signer signerInfo, truststore *x509.CertPool) (e
 		computed := h.Sum(nil)
 		if subtle.ConstantTimeCompare(digest, computed) != 1 {
 			return &MessageDigestMismatchError{
-				ExpectedDigest: digest,
-				ActualDigest:   computed,
+				DigestAlgorithm: signer.DigestAlgorithm.Algorithm,
+				ExpectedDigest:  digest,
+				ActualDigest:    computed,
 			}
 		}
 		signedData, err = marshalAttributes(signer.AuthenticatedAttributes)
@@ -311,12 +313,17 @@ func verifyCertChain(ee *x509.Certificate, certs []*x509.Certificate, truststore
 // MessageDigestMismatchError is returned when the signer data digest does not
 // match the computed digest for the contained content
 type MessageDigestMismatchError struct {
-	ExpectedDigest []byte
-	ActualDigest   []byte
+	ExpectedDigest  []byte
+	ActualDigest    []byte
+	DigestAlgorithm asn1.ObjectIdentifier
 }
 
 func (err *MessageDigestMismatchError) Error() string {
-	return fmt.Sprintf("pkcs7: Message digest mismatch\n\tExpected: %X\n\tActual  : %X", err.ExpectedDigest, err.ActualDigest)
+	digestAlgo := "unknown"
+	if len(err.DigestAlgorithm) > 0 {
+		digestAlgo = err.DigestAlgorithm.String()
+	}
+	return fmt.Sprintf("pkcs7: Message digest mismatch for algo: %s\n\tExpected: %X\n\tActual: %X", digestAlgo, err.ExpectedDigest, err.ActualDigest)
 }
 
 func getSignatureAlgorithm(digestEncryption, digest pkix.AlgorithmIdentifier) (x509.SignatureAlgorithm, error) {
diff --git a/helper/pkcs7/x509_workaround.go b/helper/pkcs7/x509_workaround.go
new file mode 100644
index 00000000000..338461a6650
--- /dev/null
+++ b/helper/pkcs7/x509_workaround.go
@@ -0,0 +1,143 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package pkcs7
+
+import (
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+
+	ctasn "github.com/google/certificate-transparency-go/asn1"
+	ctx509 "github.com/google/certificate-transparency-go/x509"
+	ctpkix "github.com/google/certificate-transparency-go/x509/pkix"
+)
+
+func CustomParseX509Certificates(data []byte) ([]*x509.Certificate, error) {
+	// The Intune client generate a self-signed certificate with a critical authority key extension,
+	// let's try to work-around that
+	certificates, err := ctx509.ParseCertificates(data)
+	if err != nil {
+		return nil, err
+	}
+
+	converted := make([]*x509.Certificate, len(certificates))
+	for i, ctCert := range certificates {
+		converted[i] = convertCtCert(ctCert)
+	}
+
+	return converted, nil
+}
+
+func convertCtCert(ctxCert *ctx509.Certificate) *x509.Certificate {
+	return &x509.Certificate{
+		Raw:                         ctxCert.Raw,
+		RawTBSCertificate:           ctxCert.RawTBSCertificate,
+		RawSubjectPublicKeyInfo:     ctxCert.RawSubjectPublicKeyInfo,
+		RawSubject:                  ctxCert.RawSubject,
+		RawIssuer:                   ctxCert.RawIssuer,
+		Signature:                   ctxCert.Signature,
+		SignatureAlgorithm:          x509.SignatureAlgorithm(ctxCert.SignatureAlgorithm),
+		PublicKeyAlgorithm:          x509.PublicKeyAlgorithm(ctxCert.PublicKeyAlgorithm),
+		PublicKey:                   ctxCert.PublicKey,
+		Version:                     ctxCert.Version,
+		SerialNumber:                ctxCert.SerialNumber,
+		Issuer:                      convertPkixName(ctxCert.Issuer),
+		Subject:                     convertPkixName(ctxCert.Subject),
+		NotBefore:                   ctxCert.NotBefore,
+		NotAfter:                    ctxCert.NotAfter,
+		KeyUsage:                    x509.KeyUsage(ctxCert.KeyUsage),
+		Extensions:                  convertExtensions(ctxCert.Extensions),
+		ExtraExtensions:             convertExtensions(ctxCert.ExtraExtensions),
+		UnhandledCriticalExtensions: convertAsn1ObjectIdentifiers(ctxCert.UnhandledCriticalExtensions),
+		ExtKeyUsage:                 convertExtKeyUsages(ctxCert.ExtKeyUsage),
+		UnknownExtKeyUsage:          nil,
+		BasicConstraintsValid:       ctxCert.BasicConstraintsValid,
+		IsCA:                        ctxCert.IsCA,
+		MaxPathLen:                  ctxCert.MaxPathLen,
+		MaxPathLenZero:              ctxCert.MaxPathLenZero,
+		SubjectKeyId:                ctxCert.SubjectKeyId,
+		AuthorityKeyId:              ctxCert.AuthorityKeyId,
+		OCSPServer:                  ctxCert.OCSPServer,
+		IssuingCertificateURL:       ctxCert.IssuingCertificateURL,
+		DNSNames:                    ctxCert.DNSNames,
+		EmailAddresses:              ctxCert.EmailAddresses,
+		IPAddresses:                 ctxCert.IPAddresses,
+		URIs:                        ctxCert.URIs,
+		PermittedDNSDomainsCritical: ctxCert.PermittedDNSDomainsCritical,
+		PermittedDNSDomains:         ctxCert.PermittedDNSDomains,
+		ExcludedDNSDomains:          ctxCert.ExcludedDNSDomains,
+		PermittedIPRanges:           ctxCert.PermittedIPRanges,
+		ExcludedIPRanges:            ctxCert.ExcludedIPRanges,
+		PermittedEmailAddresses:     ctxCert.PermittedEmailAddresses,
+		ExcludedEmailAddresses:      ctxCert.ExcludedEmailAddresses,
+		PermittedURIDomains:         ctxCert.PermittedURIDomains,
+		ExcludedURIDomains:          ctxCert.ExcludedURIDomains,
+		CRLDistributionPoints:       ctxCert.CRLDistributionPoints,
+		PolicyIdentifiers:           convertAsn1ObjectIdentifiers(ctxCert.PolicyIdentifiers),
+		// Newer fields that are not in Google Transparency
+		Policies:                  nil,
+		InhibitAnyPolicy:          0,
+		InhibitAnyPolicyZero:      false,
+		InhibitPolicyMapping:      0,
+		InhibitPolicyMappingZero:  false,
+		RequireExplicitPolicy:     0,
+		RequireExplicitPolicyZero: false,
+		PolicyMappings:            nil,
+	}
+}
+
+func convertExtKeyUsages(usages []ctx509.ExtKeyUsage) []x509.ExtKeyUsage {
+	converted := make([]x509.ExtKeyUsage, len(usages))
+	for i, extKeyUsage := range usages {
+		converted[i] = x509.ExtKeyUsage(extKeyUsage)
+	}
+	return converted
+}
+
+func convertAsn1ObjectIdentifiers(extensions []ctasn.ObjectIdentifier) []asn1.ObjectIdentifier {
+	converted := make([]asn1.ObjectIdentifier, len(extensions))
+	for i, extension := range extensions {
+		converted[i] = asn1.ObjectIdentifier(extension)
+	}
+	return converted
+}
+
+func convertExtensions(extensions []ctpkix.Extension) []pkix.Extension {
+	converted := make([]pkix.Extension, len(extensions))
+	for i, ext := range extensions {
+		converted[i] = pkix.Extension{
+			Id:       asn1.ObjectIdentifier(ext.Id),
+			Critical: ext.Critical,
+			Value:    ext.Value,
+		}
+	}
+	return converted
+}
+
+func convertPkixName(name ctpkix.Name) pkix.Name {
+	return pkix.Name{
+		Country:            name.Country,
+		Organization:       name.Organization,
+		OrganizationalUnit: name.OrganizationalUnit,
+		Locality:           name.Locality,
+		Province:           name.Province,
+		StreetAddress:      name.StreetAddress,
+		PostalCode:         name.PostalCode,
+		SerialNumber:       name.SerialNumber,
+		CommonName:         name.CommonName,
+		Names:              convertAttributeTypeAndValue(name.Names),
+		ExtraNames:         convertAttributeTypeAndValue(name.ExtraNames),
+	}
+}
+
+func convertAttributeTypeAndValue(names []ctpkix.AttributeTypeAndValue) []pkix.AttributeTypeAndValue {
+	converted := make([]pkix.AttributeTypeAndValue, len(names))
+	for i, name := range names {
+		converted[i] = pkix.AttributeTypeAndValue{
+			Type:  asn1.ObjectIdentifier(name.Type),
+			Value: name.Value,
+		}
+	}
+	return converted
+}
diff --git a/helper/pkcs7/x509_workaround_test.go b/helper/pkcs7/x509_workaround_test.go
new file mode 100644
index 00000000000..6cfbaa3d4ec
--- /dev/null
+++ b/helper/pkcs7/x509_workaround_test.go
@@ -0,0 +1,39 @@
+package pkcs7
+
+import (
+	_ "embed"
+	"encoding/asn1"
+	"encoding/base64"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+//go:embed "testdata/intune-pkcs7-sample.msg"
+var base64msg string
+
+// TestCustomParseX509Certificates tests the custom parsing of X.509 certificates from a PKCS7 message,
+// around the intune PKCS7 message that contains a certificate with a key authority extension
+// that is marked as critical. This is a workaround for the fact that the standard x509 library
+// has a specific check forbidding this
+func TestCustomParseX509Certificates(t *testing.T) {
+	msg, err := base64.StdEncoding.DecodeString(base64msg)
+	require.NoError(t, err)
+
+	myPkcs7, err := Parse(msg)
+	require.NoErrorf(t, err, "CustomParseX509Certificates: %v", err)
+	require.NotNil(t, myPkcs7)
+	require.NotNil(t, myPkcs7.Certificates)
+	require.Equal(t, 1, len(myPkcs7.Certificates))
+
+	OIDExtensionAuthorityKeyId := asn1.ObjectIdentifier{2, 5, 29, 35}
+
+	foundExt := false
+	for _, ext := range myPkcs7.Certificates[0].Extensions {
+		if ext.Id.Equal(OIDExtensionAuthorityKeyId) {
+			require.Equal(t, true, ext.Critical)
+			foundExt = true
+		}
+	}
+	require.True(t, foundExt, "did not find the expected extension")
+}
diff --git a/helper/pluginconsts/plugin_consts.go b/helper/pluginconsts/plugin_consts.go
new file mode 100644
index 00000000000..634841c9cec
--- /dev/null
+++ b/helper/pluginconsts/plugin_consts.go
@@ -0,0 +1,83 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package pluginconsts
+
+// These consts live outside the plugin registry files to prevent import cycles.
+const (
+	AuthTypeAliCloud         = "alicloud"
+	AuthTypeAppId            = "app-id"
+	AuthTypeAWS              = "aws"
+	AuthTypeAzure            = "azure"
+	AuthTypeCF               = "cf"
+	AuthTypeGCP              = "gcp"
+	AuthTypeGitHub           = "github"
+	AuthTypeKerberos         = "kerberos"
+	AuthTypeKubernetes       = "kubernetes"
+	AuthTypeLDAP             = "ldap"
+	AuthTypeOCI              = "oci"
+	AuthTypeOkta             = "okta"
+	AuthTypePCF              = "pcf"
+	AuthTypeRadius           = "radius"
+	AuthTypeToken            = "token"
+	AuthTypeCert             = "cert"
+	AuthTypeOIDC             = "oidc"
+	AuthTypeUserpass         = "userpass"
+	AuthTypeSAML             = "saml"
+	AuthTypeApprole          = "approle"
+	AuthTypeJWT              = "jwt"
+	SecretEngineAD           = "ad"
+	SecretEngineAlicloud     = "alicloud"
+	SecretEngineAWS          = "aws"
+	SecretEngineAzure        = "azure"
+	SecretEngineCassandra    = "cassandra"
+	SecretEngineConsul       = "consul"
+	SecretEngineGCP          = "gcp"
+	SecretEngineGCPKMS       = "gcpkms"
+	SecretEngineKubernetes   = "kubernetes"
+	SecretEngineMongoDB      = "mongodb"
+	SecretEngineMongoDBAtlas = "mongodbatlas"
+	SecretEngineMSSQL        = "mssql"
+	SecretEngineMySQL        = "mysql"
+	SecretEngineNomad        = "nomad"
+	SecretEngineOpenLDAP     = "openldap"
+	SecretEngineLDAP         = "ldap"
+	SecretEnginePostgresql   = "postgresql"
+	SecretEngineRabbitMQ     = "rabbitmq"
+	SecretEngineTerraform    = "terraform"
+	SecretEngineTOTP         = "totp"
+	SecretEngineKV           = "kv"
+	SecretEngineTransform    = "transform"
+	SecretEngineKMIP         = "kmip"
+	SecretEngineKeymgmt      = "keymgmt"
+	SecretEnginePki          = "pki"
+	SecretEngineTransit      = "transit"
+	SecretEngineSsh          = "ssh"
+	SecretEngineCubbyhole    = "cubbyhole"
+	SecretEngineIdentity     = "identity"
+	SecretEngineSystem       = "system"
+	// SecretEngineGeneric is a very old and deprecated version of KV, but is left
+	// for completeness.
+	SecretEngineGeneric = "generic"
+	// SecretEngineDatabase is the entry type for all databases, i.e. this is the combined
+	// database type for every database.
+	SecretEngineDatabase = "database"
+)
+
+// These DB consts match the type returned from database plugin's Type() method.
+const (
+	DbCassandraPluginType        = "cassandra"
+	DbCouchbasePluginType        = "couchbase"
+	DbElasticSearchPluginType    = "elasticsearch"
+	DbHanaPluginType             = "hdb"
+	DbInfluxDBPluginType         = "influxdb"
+	DbMongoDBPluginType          = "mongodb"
+	DbMongoAtlasPluginType       = "mongodbatlas"
+	DbMsSQLPluginType            = "mssql"
+	DbMySQLPluginType            = "mysql"
+	DbPostgresqlPluginType       = "pgx"
+	DbRedshiftPluginType         = "redshift"
+	DbRedisPluginType            = "redis"
+	DbRedisElasticachePluginType = "redisElastiCache"
+	DbSnowflakePluginType        = "snowflake"
+)
diff --git a/helper/policies/policies.go b/helper/policies/policies.go
index ea180b4e90e..c999a5f38e3 100644
--- a/helper/policies/policies.go
+++ b/helper/policies/policies.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package policies
diff --git a/helper/policies/policies_test.go b/helper/policies/policies_test.go
index 09c104d21ea..ab21d76c636 100644
--- a/helper/policies/policies_test.go
+++ b/helper/policies/policies_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package policies
diff --git a/helper/proxyutil/proxyutil.go b/helper/proxyutil/proxyutil.go
index 7724dde2fd3..1f0efc50d42 100644
--- a/helper/proxyutil/proxyutil.go
+++ b/helper/proxyutil/proxyutil.go
@@ -1,18 +1,17 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package proxyutil
 
 import (
-	"errors"
 	"fmt"
 	"net"
 	"sync"
 	"time"
 
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
-	sockaddr "github.com/hashicorp/go-sockaddr"
-	proxyproto "github.com/pires/go-proxyproto"
+	"github.com/hashicorp/go-sockaddr"
+	"github.com/pires/go-proxyproto"
 )
 
 // ProxyProtoConfig contains configuration for the PROXY protocol
@@ -72,7 +71,7 @@ func WrapInProxyProto(listener net.Listener, config *ProxyProtoConfig) (net.List
 					return proxyproto.IGNORE, nil
 				}
 
-				return proxyproto.REJECT, errors.New(`upstream connection not trusted proxy_protocol_behavior is "deny_unauthorized"`)
+				return proxyproto.REJECT, proxyproto.ErrInvalidUpstream
 			},
 		}
 	default:
diff --git a/helper/random/parser.go b/helper/random/parser.go
index f3523226eaf..1e99fd99a44 100644
--- a/helper/random/parser.go
+++ b/helper/random/parser.go
@@ -1,17 +1,53 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
 
 import (
 	"fmt"
+	"os"
 	"reflect"
+	"strconv"
+	"strings"
 	"unicode/utf8"
 
 	"github.com/hashicorp/hcl"
+	"github.com/hashicorp/hcl/hcl/ast"
+	hclParser "github.com/hashicorp/hcl/hcl/parser"
 	"github.com/mitchellh/mapstructure"
 )
 
+// AllowHclDuplicatesEnvVar is an environment variable that allows Vault to revert back to accepting HCL files with
+// duplicate attributes. It's temporary until we finish the deprecation process, at which point this will be removed
+const AllowHclDuplicatesEnvVar = "VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES"
+
+// ParseAndCheckForDuplicateHclAttributes parses the input JSON/HCL file and if it is HCL it also checks
+// for duplicate keys in the HCL file, allowing callers to handle the issue accordingly. In a future release we'll
+// change the behavior to treat duplicate keys as an error and eventually remove this helper altogether.
+// TODO (HCL_DUP_KEYS_DEPRECATION): remove once not used anymore
+func ParseAndCheckForDuplicateHclAttributes(input string) (res *ast.File, duplicate bool, err error) {
+	res, err = hcl.Parse(input)
+	if err != nil && strings.Contains(err.Error(), "Each argument can only be defined once") {
+		allowHclDuplicatesRaw := os.Getenv(AllowHclDuplicatesEnvVar)
+		if allowHclDuplicatesRaw == "" {
+			// default is to not allow duplicates
+			return nil, false, err
+		}
+		allowHclDuplicates, envParseErr := strconv.ParseBool(allowHclDuplicatesRaw)
+		if envParseErr != nil {
+			return nil, false, fmt.Errorf("error parsing %q environment variable: %w", AllowHclDuplicatesEnvVar, err)
+		}
+		if !allowHclDuplicates {
+			return nil, false, err
+		}
+
+		// if allowed by the environment variable, parse again without failing on duplicate attributes
+		duplicate = true
+		res, err = hclParser.ParseDontErrorOnDuplicateKeys([]byte(input))
+	}
+	return res, duplicate, err
+}
+
 // ParsePolicy is a convenience function for parsing HCL into a StringGenerator.
 // See PolicyParser.ParsePolicy for details.
 func ParsePolicy(raw string) (gen StringGenerator, err error) {
diff --git a/helper/random/parser_test.go b/helper/random/parser_test.go
index 7ca05fd00b1..f40c9b4d7a6 100644
--- a/helper/random/parser_test.go
+++ b/helper/random/parser_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
diff --git a/helper/random/random_api.go b/helper/random/random_api.go
index 0dea4a0a656..fc8dbc919e6 100644
--- a/helper/random/random_api.go
+++ b/helper/random/random_api.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
diff --git a/helper/random/registry.go b/helper/random/registry.go
index 59393561a0f..c96a07ad681 100644
--- a/helper/random/registry.go
+++ b/helper/random/registry.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
diff --git a/helper/random/registry_test.go b/helper/random/registry_test.go
index 10e6af0de2c..6509017b9d3 100644
--- a/helper/random/registry_test.go
+++ b/helper/random/registry_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
diff --git a/helper/random/rules.go b/helper/random/rules.go
index 240437a2f86..9c6b7d04593 100644
--- a/helper/random/rules.go
+++ b/helper/random/rules.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
diff --git a/helper/random/rules_test.go b/helper/random/rules_test.go
index 535bac80670..a8c3a2d248f 100644
--- a/helper/random/rules_test.go
+++ b/helper/random/rules_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
diff --git a/helper/random/serializing.go b/helper/random/serializing.go
index d3a51ca2d07..4abab6348f5 100644
--- a/helper/random/serializing.go
+++ b/helper/random/serializing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
diff --git a/helper/random/serializing_test.go b/helper/random/serializing_test.go
index b05afd66029..791209a7d97 100644
--- a/helper/random/serializing_test.go
+++ b/helper/random/serializing_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
diff --git a/helper/random/string_generator.go b/helper/random/string_generator.go
index 62a5ab9061d..e9e3c4f31fc 100644
--- a/helper/random/string_generator.go
+++ b/helper/random/string_generator.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
diff --git a/helper/random/string_generator_test.go b/helper/random/string_generator_test.go
index c8ab3b6ace3..3922e3f2198 100644
--- a/helper/random/string_generator_test.go
+++ b/helper/random/string_generator_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package random
diff --git a/helper/storagepacker/storagepacker.go b/helper/storagepacker/storagepacker.go
index 219049b1bb0..74f92befdfd 100644
--- a/helper/storagepacker/storagepacker.go
+++ b/helper/storagepacker/storagepacker.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package storagepacker
@@ -199,7 +199,8 @@ func (s *StoragePacker) DeleteMultipleItems(ctx context.Context, logger hclog.Lo
 		// Look for a matching storage entries and delete them from the list.
 		for i := 0; i < len(bucket.Items); i++ {
 			if _, ok := itemsToRemove[bucket.Items[i].ID]; ok {
-				bucket.Items[i] = bucket.Items[len(bucket.Items)-1]
+				copy(bucket.Items[i:], bucket.Items[i+1:])
+				bucket.Items[len(bucket.Items)-1] = nil // allow GC
 				bucket.Items = bucket.Items[:len(bucket.Items)-1]
 
 				// Since we just moved a value to position i we need to
diff --git a/helper/storagepacker/storagepacker_test.go b/helper/storagepacker/storagepacker_test.go
index e4799e40ef7..b686af48519 100644
--- a/helper/storagepacker/storagepacker_test.go
+++ b/helper/storagepacker/storagepacker_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package storagepacker
@@ -6,6 +6,7 @@ package storagepacker
 import (
 	"context"
 	"fmt"
+	"math/rand"
 	"testing"
 
 	"github.com/golang/protobuf/proto"
@@ -14,6 +15,7 @@ import (
 	uuid "github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/sdk/logical"
+	"google.golang.org/protobuf/types/known/anypb"
 )
 
 func BenchmarkStoragePacker(b *testing.B) {
@@ -67,6 +69,49 @@ func BenchmarkStoragePacker(b *testing.B) {
 	}
 }
 
+func BenchmarkStoragePacker_DeleteMultiple(b *testing.B) {
+	b.StopTimer()
+	storagePacker, err := NewStoragePacker(&logical.InmemStorage{}, log.New(&log.LoggerOptions{Name: "storagepackertest"}), "")
+	if err != nil {
+		b.Fatal(err)
+	}
+
+	ctx := context.Background()
+
+	// Persist a storage entry
+	for i := 0; i <= 100000; i++ {
+		item := &Item{
+			ID: fmt.Sprintf("item%d", i),
+		}
+
+		err = storagePacker.PutItem(ctx, item)
+		if err != nil {
+			b.Fatal(err)
+		}
+
+		// Verify that it can be read
+		fetchedItem, err := storagePacker.GetItem(item.ID)
+		if err != nil {
+			b.Fatal(err)
+		}
+		if fetchedItem == nil {
+			b.Fatalf("failed to read the stored item")
+		}
+
+		if item.ID != fetchedItem.ID {
+			b.Fatalf("bad: item ID; expected: %q\n actual: %q\n", item.ID, fetchedItem.ID)
+		}
+	}
+	b.StartTimer()
+
+	for i := 0; i < b.N; i++ {
+		err = storagePacker.DeleteItem(ctx, fmt.Sprintf("item%d", rand.Intn(100000)))
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
 func TestStoragePacker(t *testing.T) {
 	storagePacker, err := NewStoragePacker(&logical.InmemStorage{}, log.New(&log.LoggerOptions{Name: "storagepackertest"}), "")
 	if err != nil {
@@ -154,7 +199,7 @@ func TestStoragePacker_SerializeDeserializeComplexItem(t *testing.T) {
 		Policies:        []string{"policy1", "policy2"},
 	}
 
-	marshaledEntity, err := ptypes.MarshalAny(entity)
+	marshaledEntity, err := anypb.New(entity)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/helper/storagepacker/types.pb.go b/helper/storagepacker/types.pb.go
index 3f9f3be1a90..8da7008a22c 100644
--- a/helper/storagepacker/types.pb.go
+++ b/helper/storagepacker/types.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: helper/storagepacker/types.proto
 
@@ -15,6 +15,7 @@ import (
 	anypb "google.golang.org/protobuf/types/known/anypb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -26,10 +27,7 @@ const (
 
 // Item represents an entry that gets inserted into the storage packer
 type Item struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// ID must be provided by the caller; the same value, if used with GetItem,
 	// can be used to fetch the item. However, when iterating through a bucket,
 	// this ID will be an internal ID. In other words, outside of the use-case
@@ -37,16 +35,16 @@ type Item struct {
 	// consistent with what they passed in.
 	ID string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	// message is the contents of the item
-	Message *anypb.Any `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	Message       *anypb.Any `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Item) Reset() {
 	*x = Item{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_storagepacker_types_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_storagepacker_types_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Item) String() string {
@@ -57,7 +55,7 @@ func (*Item) ProtoMessage() {}
 
 func (x *Item) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_storagepacker_types_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -93,25 +91,22 @@ func (x *Item) GetMessage() *anypb.Any {
 // to become independent buckets. Hence, this can grow infinitely in terms of
 // storage space for items that get inserted.
 type Bucket struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Key is the storage path where the bucket gets stored
 	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
 	// Items holds the items contained within this bucket. Used by v1.
 	Items []*Item `protobuf:"bytes,2,rep,name=items,proto3" json:"items,omitempty"`
 	// ItemMap stores a mapping of item ID to message. Used by v2.
-	ItemMap map[string]*anypb.Any `protobuf:"bytes,3,rep,name=item_map,json=itemMap,proto3" json:"item_map,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	ItemMap       map[string]*anypb.Any `protobuf:"bytes,3,rep,name=item_map,json=itemMap,proto3" json:"item_map,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Bucket) Reset() {
 	*x = Bucket{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_helper_storagepacker_types_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_helper_storagepacker_types_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Bucket) String() string {
@@ -122,7 +117,7 @@ func (*Bucket) ProtoMessage() {}
 
 func (x *Bucket) ProtoReflect() protoreflect.Message {
 	mi := &file_helper_storagepacker_types_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -160,7 +155,7 @@ func (x *Bucket) GetItemMap() map[string]*anypb.Any {
 
 var File_helper_storagepacker_types_proto protoreflect.FileDescriptor
 
-var file_helper_storagepacker_types_proto_rawDesc = []byte{
+var file_helper_storagepacker_types_proto_rawDesc = string([]byte{
 	0x0a, 0x20, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
 	0x70, 0x61, 0x63, 0x6b, 0x65, 0x72, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x12, 0x0d, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x70, 0x61, 0x63, 0x6b, 0x65,
@@ -188,22 +183,22 @@ var file_helper_storagepacker_types_proto_rawDesc = []byte{
 	0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x68, 0x65, 0x6c, 0x70,
 	0x65, 0x72, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x72,
 	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_helper_storagepacker_types_proto_rawDescOnce sync.Once
-	file_helper_storagepacker_types_proto_rawDescData = file_helper_storagepacker_types_proto_rawDesc
+	file_helper_storagepacker_types_proto_rawDescData []byte
 )
 
 func file_helper_storagepacker_types_proto_rawDescGZIP() []byte {
 	file_helper_storagepacker_types_proto_rawDescOnce.Do(func() {
-		file_helper_storagepacker_types_proto_rawDescData = protoimpl.X.CompressGZIP(file_helper_storagepacker_types_proto_rawDescData)
+		file_helper_storagepacker_types_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_helper_storagepacker_types_proto_rawDesc), len(file_helper_storagepacker_types_proto_rawDesc)))
 	})
 	return file_helper_storagepacker_types_proto_rawDescData
 }
 
 var file_helper_storagepacker_types_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
-var file_helper_storagepacker_types_proto_goTypes = []interface{}{
+var file_helper_storagepacker_types_proto_goTypes = []any{
 	(*Item)(nil),      // 0: storagepacker.Item
 	(*Bucket)(nil),    // 1: storagepacker.Bucket
 	nil,               // 2: storagepacker.Bucket.ItemMapEntry
@@ -226,37 +221,11 @@ func file_helper_storagepacker_types_proto_init() {
 	if File_helper_storagepacker_types_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_helper_storagepacker_types_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Item); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_helper_storagepacker_types_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Bucket); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_helper_storagepacker_types_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_helper_storagepacker_types_proto_rawDesc), len(file_helper_storagepacker_types_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   3,
 			NumExtensions: 0,
@@ -267,7 +236,6 @@ func file_helper_storagepacker_types_proto_init() {
 		MessageInfos:      file_helper_storagepacker_types_proto_msgTypes,
 	}.Build()
 	File_helper_storagepacker_types_proto = out.File
-	file_helper_storagepacker_types_proto_rawDesc = nil
 	file_helper_storagepacker_types_proto_goTypes = nil
 	file_helper_storagepacker_types_proto_depIDxs = nil
 }
diff --git a/helper/storagepacker/types.proto b/helper/storagepacker/types.proto
index 062f602bf1e..7b3a1859c9d 100644
--- a/helper/storagepacker/types.proto
+++ b/helper/storagepacker/types.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
diff --git a/helper/syncmap/syncmap.go b/helper/syncmap/syncmap.go
index 95fb5eaf2c3..c509fb085ed 100644
--- a/helper/syncmap/syncmap.go
+++ b/helper/syncmap/syncmap.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package syncmap
@@ -62,6 +62,20 @@ func (m *SyncMap[K, V]) Put(k K, v V) V {
 	return oldV
 }
 
+// PutIfEmpty adds the given key-value pair to the map only if there is no value already in it,
+// and returns the new value and true if so.
+// If there is already a value, it returns the existing value and false.
+func (m *SyncMap[K, V]) PutIfEmpty(k K, v V) (V, bool) {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+	oldV, ok := m.data[k]
+	if ok {
+		return oldV, false
+	}
+	m.data[k] = v
+	return v, true
+}
+
 // Clear deletes all entries from the map, and returns the previous map.
 func (m *SyncMap[K, V]) Clear() map[K]V {
 	m.lock.Lock()
diff --git a/helper/syncmap/syncmap_test.go b/helper/syncmap/syncmap_test.go
index c66a131df4c..87de7581deb 100644
--- a/helper/syncmap/syncmap_test.go
+++ b/helper/syncmap/syncmap_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package syncmap
diff --git a/helper/testhelpers/azurite/azurite.go b/helper/testhelpers/azurite/azurite.go
index a9b291744a7..01d5a6ef431 100644
--- a/helper/testhelpers/azurite/azurite.go
+++ b/helper/testhelpers/azurite/azurite.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package azurite
diff --git a/helper/testhelpers/cassandra/cassandrahelper.go b/helper/testhelpers/cassandra/cassandrahelper.go
index b774a1690e7..5ba181a40a6 100644
--- a/helper/testhelpers/cassandra/cassandrahelper.go
+++ b/helper/testhelpers/cassandra/cassandrahelper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cassandra
diff --git a/helper/testhelpers/certhelpers/cert_helpers.go b/helper/testhelpers/certhelpers/cert_helpers.go
index d9c89735c61..0308a939e24 100644
--- a/helper/testhelpers/certhelpers/cert_helpers.go
+++ b/helper/testhelpers/certhelpers/cert_helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package certhelpers
@@ -18,6 +18,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 )
 
 type CertBuilder struct {
@@ -166,7 +168,7 @@ type KeyWrapper struct {
 func NewPrivateKey(t *testing.T) (key KeyWrapper) {
 	t.Helper()
 
-	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	privKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatalf("Unable to generate key for cert: %s", err)
 	}
diff --git a/helper/testhelpers/consul/cluster_storage.go b/helper/testhelpers/consul/cluster_storage.go
index 9ca1080c6f9..ed3c1b4f758 100644
--- a/helper/testhelpers/consul/cluster_storage.go
+++ b/helper/testhelpers/consul/cluster_storage.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/helper/testhelpers/consul/consulhelper.go b/helper/testhelpers/consul/consulhelper.go
index d6ab5d72b5c..eaa0ff9d4ce 100644
--- a/helper/testhelpers/consul/consulhelper.go
+++ b/helper/testhelpers/consul/consulhelper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/helper/testhelpers/corehelpers/corehelpers.go b/helper/testhelpers/corehelpers/corehelpers.go
index 8e252ac2d4f..2b7f9c3079b 100644
--- a/helper/testhelpers/corehelpers/corehelpers.go
+++ b/helper/testhelpers/corehelpers/corehelpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Package corehelpers contains testhelpers that don't depend on package vault,
@@ -7,39 +7,25 @@ package corehelpers
 
 import (
 	"context"
-	"crypto/sha256"
-	"encoding/json"
-	"errors"
-	"fmt"
 	"io"
 	"os"
 	"path/filepath"
-	"sync"
+	"testing"
 	"time"
 
-	"github.com/hashicorp/eventlogger"
 	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/vault/audit"
 	"github.com/hashicorp/vault/builtin/credential/approle"
-	"github.com/hashicorp/vault/internal/observability/event"
 	"github.com/hashicorp/vault/plugins/database/mysql"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/consts"
-	"github.com/hashicorp/vault/sdk/helper/salt"
 	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/mitchellh/go-testing-interface"
-)
-
-var (
-	_ audit.Backend    = (*NoopAudit)(nil)
-	_ eventlogger.Node = (*noopWrapper)(nil)
 )
 
 var externalPlugins = []string{"transform", "kmip", "keymgmt"}
 
 // RetryUntil runs f until it returns a nil result or the timeout is reached.
 // If a nil result hasn't been obtained by timeout, calls t.Fatal.
-func RetryUntil(t testing.T, timeout time.Duration, f func() error) {
+func RetryUntil(t testing.TB, timeout time.Duration, f func() error) {
 	t.Helper()
 	deadline := time.Now().Add(timeout)
 	var err error
@@ -54,7 +40,7 @@ func RetryUntil(t testing.T, timeout time.Duration, f func() error) {
 
 // MakeTestPluginDir creates a temporary directory suitable for holding plugins.
 // This helper also resolves symlinks to make tests happy on OS X.
-func MakeTestPluginDir(t testing.T) string {
+func MakeTestPluginDir(t testing.TB) string {
 	t.Helper()
 
 	dir, err := os.MkdirTemp("", "")
@@ -216,303 +202,6 @@ func (m *mockBuiltinRegistry) DeprecationStatus(name string, pluginType consts.P
 	return consts.Unknown, false
 }
 
-func TestNoopAudit(t testing.T, path string, config map[string]string, opts ...audit.Option) *NoopAudit {
-	cfg := &audit.BackendConfig{
-		Config:    config,
-		MountPath: path,
-		Logger:    NewTestLogger(t),
-	}
-	n, err := NewNoopAudit(cfg, opts...)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return n
-}
-
-// NewNoopAudit should be used to create a NoopAudit as it handles creation of a
-// predictable salt and wraps eventlogger nodes so information can be retrieved on
-// what they've seen or formatted.
-func NewNoopAudit(config *audit.BackendConfig, opts ...audit.Option) (*NoopAudit, error) {
-	view := &logical.InmemStorage{}
-
-	// Create the salt with a known key for predictable hmac values.
-	se := &logical.StorageEntry{Key: "salt", Value: []byte("foo")}
-	err := view.Put(context.Background(), se)
-	if err != nil {
-		return nil, err
-	}
-
-	// Override the salt related config settings.
-	backendConfig := &audit.BackendConfig{
-		SaltView: view,
-		SaltConfig: &salt.Config{
-			HMAC:     sha256.New,
-			HMACType: "hmac-sha256",
-		},
-		Config:    config.Config,
-		MountPath: config.MountPath,
-	}
-
-	noopBackend := &NoopAudit{
-		Config:     backendConfig,
-		nodeIDList: make([]eventlogger.NodeID, 2),
-		nodeMap:    make(map[eventlogger.NodeID]eventlogger.Node, 2),
-	}
-
-	cfg, err := audit.NewFormatterConfig()
-	if err != nil {
-		return nil, err
-	}
-
-	formatterNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return nil, fmt.Errorf("error generating random NodeID for formatter node: %w", err)
-	}
-
-	formatterNode, err := audit.NewEntryFormatter(config.MountPath, cfg, noopBackend, config.Logger, opts...)
-	if err != nil {
-		return nil, fmt.Errorf("error creating formatter: %w", err)
-	}
-
-	// Wrap the formatting node, so we can get any bytes that were formatted etc.
-	wrappedFormatter := &noopWrapper{format: "json", node: formatterNode, backend: noopBackend}
-
-	noopBackend.nodeIDList[0] = formatterNodeID
-	noopBackend.nodeMap[formatterNodeID] = wrappedFormatter
-
-	sinkNode := event.NewNoopSink()
-	sinkNodeID, err := event.GenerateNodeID()
-	if err != nil {
-		return nil, fmt.Errorf("error generating random NodeID for sink node: %w", err)
-	}
-
-	noopBackend.nodeIDList[1] = sinkNodeID
-	noopBackend.nodeMap[sinkNodeID] = sinkNode
-
-	return noopBackend, nil
-}
-
-// NoopAuditFactory should be used when the test needs a way to access bytes that
-// have been formatted by the pipeline during audit requests.
-// The records parameter will be repointed to the one used within the pipeline.
-func NoopAuditFactory(records **[][]byte) audit.Factory {
-	return func(_ context.Context, config *audit.BackendConfig, headerFormatter audit.HeaderFormatter) (audit.Backend, error) {
-		n, err := NewNoopAudit(config, audit.WithHeaderFormatter(headerFormatter))
-		if err != nil {
-			return nil, err
-		}
-		if records != nil {
-			*records = &n.records
-		}
-
-		return n, nil
-	}
-}
-
-// noopWrapper is designed to wrap a formatter node in order to allow access to
-// bytes formatted, headers formatted and parts of the logical.LogInput.
-// Some older tests relied on being able to query this information so while those
-// tests stick around we should look after them.
-type noopWrapper struct {
-	format  string
-	node    eventlogger.Node
-	backend *NoopAudit
-}
-
-// NoopAuditEventListener is a callback used by noopWrapper.Process() to notify
-// of each received audit event.
-type NoopAuditEventListener func(*audit.AuditEvent)
-
-type NoopAudit struct {
-	Config *audit.BackendConfig
-
-	ReqErr         error
-	ReqAuth        []*logical.Auth
-	Req            []*logical.Request
-	ReqHeaders     []map[string][]string
-	ReqNonHMACKeys []string
-	ReqErrs        []error
-
-	RespErr            error
-	RespAuth           []*logical.Auth
-	RespReq            []*logical.Request
-	Resp               []*logical.Response
-	RespNonHMACKeys    [][]string
-	RespReqNonHMACKeys [][]string
-	RespErrs           []error
-	records            [][]byte
-	l                  sync.RWMutex
-	salt               *salt.Salt
-	saltMutex          sync.RWMutex
-
-	nodeIDList []eventlogger.NodeID
-	nodeMap    map[eventlogger.NodeID]eventlogger.Node
-
-	listener NoopAuditEventListener
-}
-
-// Process handles the contortions required by older test code to ensure behavior.
-// It will attempt to do some pre/post processing of the logical.LogInput that should
-// form part of the event's payload data, as well as capturing the resulting headers
-// that were formatted and track the overall bytes that a formatted event uses when
-// it's ready to head down the pipeline to the sink node (a noop for us).
-func (n *noopWrapper) Process(ctx context.Context, e *eventlogger.Event) (*eventlogger.Event, error) {
-	n.backend.l.Lock()
-	defer n.backend.l.Unlock()
-
-	var err error
-
-	// We're expecting audit events since this is an audit device.
-	a, ok := e.Payload.(*audit.AuditEvent)
-	if !ok {
-		return nil, errors.New("cannot parse payload as an audit event")
-	}
-
-	if n.backend.listener != nil {
-		n.backend.listener(a)
-	}
-
-	in := a.Data
-
-	// Depending on the type of the audit event (request or response) we need to
-	// track different things.
-	switch a.Subtype {
-	case audit.RequestType:
-		n.backend.ReqAuth = append(n.backend.ReqAuth, in.Auth)
-		n.backend.Req = append(n.backend.Req, in.Request)
-		n.backend.ReqNonHMACKeys = in.NonHMACReqDataKeys
-		n.backend.ReqErrs = append(n.backend.ReqErrs, in.OuterErr)
-
-		if n.backend.ReqErr != nil {
-			return nil, n.backend.ReqErr
-		}
-	case audit.ResponseType:
-		n.backend.RespAuth = append(n.backend.RespAuth, in.Auth)
-		n.backend.RespReq = append(n.backend.RespReq, in.Request)
-		n.backend.Resp = append(n.backend.Resp, in.Response)
-		n.backend.RespErrs = append(n.backend.RespErrs, in.OuterErr)
-
-		if in.Response != nil {
-			n.backend.RespNonHMACKeys = append(n.backend.RespNonHMACKeys, in.NonHMACRespDataKeys)
-			n.backend.RespReqNonHMACKeys = append(n.backend.RespReqNonHMACKeys, in.NonHMACReqDataKeys)
-		}
-
-		if n.backend.RespErr != nil {
-			return nil, n.backend.RespErr
-		}
-	default:
-		return nil, fmt.Errorf("unknown audit event type: %q", a.Subtype)
-	}
-
-	// Once we've taken note of the relevant properties of the event, we get the
-	// underlying (wrapped) node to process it as normal.
-	e, err = n.node.Process(ctx, e)
-	if err != nil {
-		return nil, fmt.Errorf("error processing wrapped node: %w", err)
-	}
-
-	// Once processing has been carried out, the underlying node (a formatter node)
-	// should contain the output ready for the sink node. We'll get that in order
-	// to track how many bytes we formatted.
-	b, ok := e.Format(n.format)
-	if ok {
-		n.backend.records = append(n.backend.records, b)
-	}
-
-	// Finally, the last bit of post-processing is to make sure that we track the
-	// formatted headers that would have made it to the logs via the sink node.
-	// They only appear in requests.
-	if a.Subtype == audit.RequestType {
-		reqEntry := &audit.RequestEntry{}
-		err = json.Unmarshal(b, &reqEntry)
-		if err != nil {
-			return nil, fmt.Errorf("unable to parse formatted audit entry data: %w", err)
-		}
-
-		n.backend.ReqHeaders = append(n.backend.ReqHeaders, reqEntry.Request.Headers)
-	}
-
-	// Return the event and no error in order to let the pipeline continue on.
-	return e, nil
-}
-
-func (n *noopWrapper) Reopen() error {
-	return n.node.Reopen()
-}
-
-func (n *noopWrapper) Type() eventlogger.NodeType {
-	return n.node.Type()
-}
-
-// LogTestMessage will manually crank the handle on the nodes associated with this backend.
-func (n *NoopAudit) LogTestMessage(ctx context.Context, in *logical.LogInput) error {
-	if len(n.nodeIDList) > 0 {
-		return audit.ProcessManual(ctx, in, n.nodeIDList, n.nodeMap)
-	}
-
-	return nil
-}
-
-func (n *NoopAudit) Salt(ctx context.Context) (*salt.Salt, error) {
-	n.saltMutex.RLock()
-	if n.salt != nil {
-		defer n.saltMutex.RUnlock()
-		return n.salt, nil
-	}
-	n.saltMutex.RUnlock()
-	n.saltMutex.Lock()
-	defer n.saltMutex.Unlock()
-	if n.salt != nil {
-		return n.salt, nil
-	}
-	s, err := salt.NewSalt(ctx, n.Config.SaltView, n.Config.SaltConfig)
-	if err != nil {
-		return nil, err
-	}
-	n.salt = s
-	return s, nil
-}
-
-func (n *NoopAudit) GetHash(ctx context.Context, data string) (string, error) {
-	s, err := n.Salt(ctx)
-	if err != nil {
-		return "", err
-	}
-	return s.GetIdentifiedHMAC(data), nil
-}
-
-func (n *NoopAudit) Reload(_ context.Context) error {
-	return nil
-}
-
-func (n *NoopAudit) Invalidate(_ context.Context) {
-	n.saltMutex.Lock()
-	defer n.saltMutex.Unlock()
-	n.salt = nil
-}
-
-// RegisterNodesAndPipeline registers the nodes and a pipeline as required by
-// the audit.Backend interface.
-func (n *NoopAudit) RegisterNodesAndPipeline(broker *eventlogger.Broker, name string) error {
-	for id, node := range n.nodeMap {
-		if err := broker.RegisterNode(id, node); err != nil {
-			return err
-		}
-	}
-
-	pipeline := eventlogger.Pipeline{
-		PipelineID: eventlogger.PipelineID(name),
-		EventType:  eventlogger.EventType(event.AuditType.String()),
-		NodeIDs:    n.nodeIDList,
-	}
-
-	return broker.RegisterPipeline(pipeline)
-}
-
-func (n *NoopAudit) SetListener(listener NoopAuditEventListener) {
-	n.listener = listener
-}
-
 type TestLogger struct {
 	hclog.InterceptLogger
 	Path string
@@ -520,7 +209,7 @@ type TestLogger struct {
 	sink hclog.SinkAdapter
 }
 
-func NewTestLogger(t testing.T) *TestLogger {
+func NewTestLogger(t testing.TB) *TestLogger {
 	var logFile *os.File
 	var logPath string
 	output := os.Stderr
@@ -576,27 +265,3 @@ func NewTestLogger(t testing.T) *TestLogger {
 func (tl *TestLogger) StopLogging() {
 	tl.InterceptLogger.DeregisterSink(tl.sink)
 }
-
-func (n *NoopAudit) EventType() eventlogger.EventType {
-	return eventlogger.EventType(event.AuditType.String())
-}
-
-func (n *NoopAudit) HasFiltering() bool {
-	return false
-}
-
-func (n *NoopAudit) Name() string {
-	return n.Config.MountPath
-}
-
-func (n *NoopAudit) Nodes() map[eventlogger.NodeID]eventlogger.Node {
-	return n.nodeMap
-}
-
-func (n *NoopAudit) NodeIDs() []eventlogger.NodeID {
-	return n.nodeIDList
-}
-
-func (n *NoopAudit) IsFallback() bool {
-	return false
-}
diff --git a/helper/testhelpers/etcd/etcdhelper.go b/helper/testhelpers/etcd/etcdhelper.go
index dc8f796e156..9ae1ef5750d 100644
--- a/helper/testhelpers/etcd/etcdhelper.go
+++ b/helper/testhelpers/etcd/etcdhelper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package etcd
diff --git a/helper/testhelpers/fakegcsserver/fake-gcs-server.go b/helper/testhelpers/fakegcsserver/fake-gcs-server.go
index e3f6c7021e9..edb6c4f9e44 100644
--- a/helper/testhelpers/fakegcsserver/fake-gcs-server.go
+++ b/helper/testhelpers/fakegcsserver/fake-gcs-server.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package fakegcsserver
diff --git a/helper/testhelpers/generaterootkind_enumer.go b/helper/testhelpers/generaterootkind_enumer.go
new file mode 100644
index 00000000000..496b4eb98e7
--- /dev/null
+++ b/helper/testhelpers/generaterootkind_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=GenerateRootKind -trimprefix=GenerateRoot"; DO NOT EDIT.
+
+package testhelpers
+
+import (
+	"fmt"
+)
+
+const _GenerateRootKindName = "RegularDRGenerateRecovery"
+
+var _GenerateRootKindIndex = [...]uint8{0, 7, 9, 25}
+
+func (i GenerateRootKind) String() string {
+	if i < 0 || i >= GenerateRootKind(len(_GenerateRootKindIndex)-1) {
+		return fmt.Sprintf("GenerateRootKind(%d)", i)
+	}
+	return _GenerateRootKindName[_GenerateRootKindIndex[i]:_GenerateRootKindIndex[i+1]]
+}
+
+var _GenerateRootKindValues = []GenerateRootKind{0, 1, 2}
+
+var _GenerateRootKindNameToValueMap = map[string]GenerateRootKind{
+	_GenerateRootKindName[0:7]:  0,
+	_GenerateRootKindName[7:9]:  1,
+	_GenerateRootKindName[9:25]: 2,
+}
+
+// GenerateRootKindString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func GenerateRootKindString(s string) (GenerateRootKind, error) {
+	if val, ok := _GenerateRootKindNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to GenerateRootKind values", s)
+}
+
+// GenerateRootKindValues returns all values of the enum
+func GenerateRootKindValues() []GenerateRootKind {
+	return _GenerateRootKindValues
+}
+
+// IsAGenerateRootKind returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i GenerateRootKind) IsAGenerateRootKind() bool {
+	for _, v := range _GenerateRootKindValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/helper/testhelpers/ldap/ldaphelper.go b/helper/testhelpers/ldap/ldaphelper.go
index e428dffe22d..4de3e40db0d 100644
--- a/helper/testhelpers/ldap/ldaphelper.go
+++ b/helper/testhelpers/ldap/ldaphelper.go
@@ -1,20 +1,26 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package ldap
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"runtime"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/hashicorp/cap/ldap"
 	"github.com/hashicorp/vault/sdk/helper/docker"
 	"github.com/hashicorp/vault/sdk/helper/ldaputil"
 )
 
+// DefaultVersion is the default version of the container to pull.
+// NOTE: This is currently pinned to a sha instead of "master", see: https://github.com/rroemhild/docker-test-openldap/issues/62
+const DefaultVersion = "sha256:f4d9c5ba97f9662e9aea082b4aa89233994ca6e232abc1952d5d90da7e16b0eb"
+
 func PrepareTestContainer(t *testing.T, version string) (cleanup func(), cfg *ldaputil.ConfigEntry) {
 	// note: this image isn't supported on arm64 architecture in CI.
 	// but if you're running on Apple Silicon, feel free to comment out the code below locally.
@@ -22,14 +28,16 @@ func PrepareTestContainer(t *testing.T, version string) (cleanup func(), cfg *ld
 		t.Skip("Skipping, as this image is not supported on ARM architectures")
 	}
 
+	logsWriter := bytes.NewBuffer([]byte{})
+
 	runner, err := docker.NewServiceRunner(docker.RunOptions{
-		// Currently set to "michelvocks" until https://github.com/rroemhild/docker-test-openldap/pull/14
-		// has been merged.
-		ImageRepo:     "docker.mirror.hashicorp.services/michelvocks/docker-test-openldap",
+		ImageRepo:     "ghcr.io/rroemhild/docker-test-openldap",
 		ImageTag:      version,
 		ContainerName: "ldap",
-		Ports:         []string{"389/tcp"},
+		Ports:         []string{"10389/tcp"},
 		// Env:        []string{"LDAP_DEBUG_LEVEL=384"},
+		LogStderr: logsWriter,
+		LogStdout: logsWriter,
 	})
 	if err != nil {
 		t.Fatalf("could not start local LDAP docker container: %s", err)
@@ -46,27 +54,48 @@ func PrepareTestContainer(t *testing.T, version string) (cleanup func(), cfg *ld
 	cfg.RequestTimeout = 60
 	cfg.MaximumPageSize = 1000
 
-	svc, err := runner.StartService(context.Background(), func(ctx context.Context, host string, port int) (docker.ServiceConfig, error) {
-		connURL := fmt.Sprintf("ldap://%s:%d", host, port)
-		cfg.Url = connURL
+	var started bool
 
-		client, err := ldap.NewClient(ctx, ldaputil.ConvertConfig(cfg))
-		if err != nil {
-			return nil, err
-		}
+	ctx, _ := context.WithTimeout(t.Context(), 1*time.Minute)
+	for i := 0; i < 3; i++ {
+		svc, err := runner.StartService(ctx, func(ctx context.Context, host string, port int) (docker.ServiceConfig, error) {
+			connURL := fmt.Sprintf("ldap://%s:%d", host, port)
+			cfg.Url = connURL
+
+			client, err := ldap.NewClient(ctx, ldaputil.ConvertConfig(cfg))
+			if err != nil {
+				return nil, err
+			}
+
+			defer client.Close(ctx)
 
-		defer client.Close(ctx)
+			_, err = client.Authenticate(ctx, "Philip J. Fry", "fry")
+			if err != nil {
+				return nil, err
+			}
 
-		_, err = client.Authenticate(ctx, "Philip J. Fry", "fry")
+			return docker.NewServiceURLParse(connURL)
+		})
 		if err != nil {
-			return nil, err
+			t.Logf("could not start local LDAP docker container: %s", err)
+			t.Log("Docker container logs: ")
+			t.Log(logsWriter.String())
+			continue
 		}
 
-		return docker.NewServiceURLParse(connURL)
-	})
-	if err != nil {
-		t.Fatalf("could not start local LDAP docker container: %s", err)
+		started = true
+		cleanup = func() {
+			if t.Failed() {
+				t.Log(logsWriter.String())
+			}
+			svc.Cleanup()
+		}
+		break
+	}
+
+	if !started {
+		t.FailNow()
 	}
 
-	return svc.Cleanup, cfg
+	return cleanup, cfg
 }
diff --git a/helper/testhelpers/logical/testing.go b/helper/testhelpers/logical/testing.go
index ad8149c1ec1..d6278b52110 100644
--- a/helper/testhelpers/logical/testing.go
+++ b/helper/testhelpers/logical/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package testing
diff --git a/helper/testhelpers/logical/testing_test.go b/helper/testhelpers/logical/testing_test.go
index a73b91ecd05..1dda8b89a21 100644
--- a/helper/testhelpers/logical/testing_test.go
+++ b/helper/testhelpers/logical/testing_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package testing
diff --git a/helper/testhelpers/minimal/minimal.go b/helper/testhelpers/minimal/minimal.go
index 55e5617f554..5903db136cb 100644
--- a/helper/testhelpers/minimal/minimal.go
+++ b/helper/testhelpers/minimal/minimal.go
@@ -1,14 +1,13 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package minimal
 
 import (
+	"testing"
+
 	logicalKv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/audit"
-	auditFile "github.com/hashicorp/vault/builtin/audit/file"
-	auditSocket "github.com/hashicorp/vault/builtin/audit/socket"
-	auditSyslog "github.com/hashicorp/vault/builtin/audit/syslog"
 	logicalDb "github.com/hashicorp/vault/builtin/logical/database"
 	"github.com/hashicorp/vault/builtin/plugin"
 	"github.com/hashicorp/vault/helper/builtinplugins"
@@ -18,7 +17,6 @@ import (
 	"github.com/hashicorp/vault/sdk/physical/inmem"
 	"github.com/hashicorp/vault/vault"
 	"github.com/mitchellh/copystructure"
-	"github.com/mitchellh/go-testing-interface"
 )
 
 // NewTestSoloCluster is a simpler version of NewTestCluster that only creates
@@ -26,7 +24,7 @@ import (
 // from vault.TestClusterOptions, use NewTestCluster instead.  It should work fine
 // with a nil config argument.  There is no need to call Start or Cleanup or
 // TestWaitActive on the resulting cluster.
-func NewTestSoloCluster(t testing.T, config *vault.CoreConfig) *vault.TestCluster {
+func NewTestSoloCluster(t testing.TB, config *vault.CoreConfig) *vault.TestCluster {
 	logger := corehelpers.NewTestLogger(t)
 
 	mycfg := &vault.CoreConfig{}
@@ -64,9 +62,9 @@ func NewTestSoloCluster(t testing.T, config *vault.CoreConfig) *vault.TestCluste
 	}
 	if mycfg.AuditBackends == nil {
 		mycfg.AuditBackends = map[string]audit.Factory{
-			"file":   auditFile.Factory,
-			"socket": auditSocket.Factory,
-			"syslog": auditSyslog.Factory,
+			"file":   audit.NewFileBackend,
+			"socket": audit.NewSocketBackend,
+			"syslog": audit.NewSyslogBackend,
 		}
 	}
 	if mycfg.BuiltinRegistry == nil {
diff --git a/helper/testhelpers/minio/miniohelper.go b/helper/testhelpers/minio/miniohelper.go
index 67d611e40a4..8d354965e94 100644
--- a/helper/testhelpers/minio/miniohelper.go
+++ b/helper/testhelpers/minio/miniohelper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package minio
diff --git a/helper/testhelpers/mongodb/mongodbhelper.go b/helper/testhelpers/mongodb/mongodbhelper.go
index 7ca214fcc08..b0a8f6f789e 100644
--- a/helper/testhelpers/mongodb/mongodbhelper.go
+++ b/helper/testhelpers/mongodb/mongodbhelper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mongodb
diff --git a/helper/testhelpers/mssql/mssqlhelper.go b/helper/testhelpers/mssql/mssqlhelper.go
index 94b34a4f3d8..3c32635a2be 100644
--- a/helper/testhelpers/mssql/mssqlhelper.go
+++ b/helper/testhelpers/mssql/mssqlhelper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mssqlhelper
@@ -12,7 +12,10 @@ import (
 	"runtime"
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/hashicorp/vault/helper/testhelpers"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/sdk/helper/docker"
 )
 
@@ -32,32 +35,73 @@ func PrepareMSSQLTestContainer(t *testing.T) (cleanup func(), retURL string) {
 		return func() {}, os.Getenv("MSSQL_URL")
 	}
 
-	var err error
-	for i := 0; i < numRetries; i++ {
-		var svc *docker.Service
-		runner, err := docker.NewServiceRunner(docker.RunOptions{
-			ContainerName: "sqlserver",
-			ImageRepo:     "mcr.microsoft.com/mssql/server",
-			ImageTag:      "2017-latest-ubuntu",
-			Env:           []string{"ACCEPT_EULA=Y", "SA_PASSWORD=" + mssqlPassword},
-			Ports:         []string{"1433/tcp"},
-			LogConsumer: func(s string) {
-				if t.Failed() {
-					t.Logf("container logs: %s", s)
-				}
-			},
-		})
+	logger := corehelpers.NewTestLogger(t)
+
+	// Workaround for https://github.com/microsoft/mssql-docker/issues/895 and us temporary seeing
+	// tls: failed to parse certificate from server: x509: negative serial number in test case failures.
+	containerfile := `
+FROM mcr.microsoft.com/mssql/server:2022-latest
+USER root
+ENV MSDIR=/var/opt/mssql
+RUN mkdir -p $MSDIR \
+    && openssl req -x509 -nodes -newkey rsa:2048 -subj '/CN=mssql' -addext "subjectAltName = DNS:mssql" -keyout $MSDIR/mssql.key -out $MSDIR/mssql.pem -days 1 \
+	&& chmod 400 $MSDIR/mssql.key \
+	&& chmod 400 $MSDIR/mssql.pem \
+    && chown -R mssql $MSDIR
+
+RUN echo "[network]" > $MSDIR/mssql.conf \
+	&& echo "tlscert = $MSDIR/mssql.pem" >> $MSDIR/mssql.conf \
+	&& echo "tlskey = $MSDIR/mssql.key" >> $MSDIR/mssql.conf \ 
+	&& echo "tlsprotocols = 1.2" >> $MSDIR/mssql.conf \ 
+	&& echo "forceencryption = 1" >> $MSDIR/mssql.conf 
+
+USER mssql
+`
+	bCtx := docker.NewBuildContext()
+	imageName := "mssql-workaround-895"
+	imageTag := "latest"
+
+	runner, err := docker.NewServiceRunner(docker.RunOptions{
+		ContainerName: "sqlserver",
+		ImageRepo:     imageName,
+		ImageTag:      imageTag,
+		Env:           []string{"ACCEPT_EULA=Y", "SA_PASSWORD=" + mssqlPassword},
+		Ports:         []string{"1433/tcp"},
+		LogConsumer: func(s string) {
+			logger.Info(s)
+		},
+	})
+	if err != nil {
+		t.Fatalf("Could not provision docker service runner: %s", err)
+	}
+
+	// Sometimes we see timeouts and issues pulling the zlint code from GitHub
+	testhelpers.RetryUntil(t, 30*time.Second, func() error {
+		output, err := runner.BuildImage(context.Background(), containerfile, bCtx,
+			docker.BuildRemove(true),
+			docker.BuildForceRemove(true),
+			docker.BuildPullParent(true),
+			docker.BuildTags([]string{imageName + ":" + imageTag}))
 		if err != nil {
-			t.Fatalf("Could not start docker MSSQL: %s", err)
+			return fmt.Errorf("could not build new mssql image: %w", err)
 		}
 
+		t.Logf("Image build output: %v", string(output))
+		return nil
+	})
+
+	for i := 0; i < numRetries; i++ {
+		var svc *docker.Service
+
 		svc, err = runner.StartService(context.Background(), connectMSSQL)
 		if err == nil {
 			return svc.Cleanup, svc.Config.URL().String()
 		}
+
+		logger.Error("failed starting service", "error", err.Error())
 	}
 
-	t.Fatalf("Could not start docker MSSQL: %s", err)
+	t.Fatalf("Could not start docker MSSQL last error: %v", err)
 	return nil, ""
 }
 
diff --git a/helper/testhelpers/mysql/mysqlhelper.go b/helper/testhelpers/mysql/mysqlhelper.go
index 93b2cd551e0..8e7f8421482 100644
--- a/helper/testhelpers/mysql/mysqlhelper.go
+++ b/helper/testhelpers/mysql/mysqlhelper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mysqlhelper
diff --git a/helper/testhelpers/pki/pkihelper.go b/helper/testhelpers/pki/pkihelper.go
new file mode 100644
index 00000000000..b476875ea3a
--- /dev/null
+++ b/helper/testhelpers/pki/pkihelper.go
@@ -0,0 +1,224 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package pki
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	mathrand2 "math/rand/v2"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// This file contains helper functions for generating CA hierarchies for testing
+
+type LeafWithRoot struct {
+	RootCa             GeneratedCert
+	Leaf               GeneratedCert
+	CombinedLeafCaFile string
+}
+
+type LeafWithIntermediary struct {
+	RootCa         GeneratedCert
+	IntCa          GeneratedCert
+	Leaf           GeneratedCert
+	CombinedCaFile string
+}
+
+type GeneratedCert struct {
+	KeyFile  string
+	CertFile string
+	CertPem  *pem.Block
+	Cert     *x509.Certificate
+	Key      *ecdsa.PrivateKey
+}
+
+// GenerateCertWithIntermediaryRoot generates a leaf certificate signed by an intermediary root CA
+func GenerateCertWithIntermediaryRoot(t testing.TB) LeafWithIntermediary {
+	t.Helper()
+	tempDir := t.TempDir()
+	template := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "localhost",
+		},
+		SerialNumber: big.NewInt(mathrand2.Int64()),
+		DNSNames:     []string{"localhost"},
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+		KeyUsage:     x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		NotBefore:    time.Now().Add(-30 * time.Second),
+		NotAfter:     time.Now().Add(60 * 24 * time.Hour),
+	}
+
+	ca := GenerateRootCa(t)
+	caIntTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "Intermediary CA",
+		},
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		SerialNumber:          big.NewInt(mathrand2.Int64()),
+		NotBefore:             time.Now().Add(-30 * time.Second),
+		NotAfter:              time.Now().Add(262980 * time.Hour),
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+	}
+	caInt := generateCertAndSign(t, caIntTemplate, ca, tempDir, "int_")
+	leafCert := generateCertAndSign(t, template, caInt, tempDir, "leaf_")
+
+	combinedCasFile := filepath.Join(tempDir, "cas.pem")
+	err := os.WriteFile(combinedCasFile, append(pem.EncodeToMemory(caInt.CertPem), pem.EncodeToMemory(ca.CertPem)...), 0o644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return LeafWithIntermediary{
+		RootCa:         ca,
+		IntCa:          caInt,
+		Leaf:           leafCert,
+		CombinedCaFile: combinedCasFile,
+	}
+}
+
+// generateCertAndSign generates a certificate and associated key signed by a CA
+func generateCertAndSign(t testing.TB, template *x509.Certificate, ca GeneratedCert, tempDir string, filePrefix string) GeneratedCert {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	certBytes, err := x509.CreateCertificate(rand.Reader, template, ca.Cert, key.Public(), ca.Key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cert, err := x509.ParseCertificate(certBytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	certPEMBlock := &pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: certBytes,
+	}
+	certFile := filepath.Join(tempDir, filePrefix+"cert.pem")
+	err = os.WriteFile(certFile, pem.EncodeToMemory(certPEMBlock), 0o644)
+	if err != nil {
+		t.Fatal(err)
+	}
+	marshaledKey, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keyPEMBlock := &pem.Block{
+		Type:  "EC PRIVATE KEY",
+		Bytes: marshaledKey,
+	}
+	keyFile := filepath.Join(tempDir, filePrefix+"key.pem")
+	err = os.WriteFile(keyFile, pem.EncodeToMemory(keyPEMBlock), 0o644)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return GeneratedCert{
+		KeyFile:  keyFile,
+		CertFile: certFile,
+		CertPem:  certPEMBlock,
+		Cert:     cert,
+		Key:      key,
+	}
+}
+
+// GenerateCertWithRoot generates a leaf certificate signed by a root CA
+func GenerateCertWithRoot(t testing.TB) LeafWithRoot {
+	t.Helper()
+	tempDir := t.TempDir()
+	leafTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "localhost",
+		},
+		SerialNumber: big.NewInt(mathrand2.Int64()),
+		DNSNames:     []string{"localhost"},
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+		KeyUsage:     x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		NotBefore:    time.Now().Add(-30 * time.Second),
+		NotAfter:     time.Now().Add(60 * 24 * time.Hour),
+	}
+
+	ca := GenerateRootCa(t)
+	leafCert := generateCertAndSign(t, leafTemplate, ca, tempDir, "leaf_")
+
+	combinedCaLeafFile := filepath.Join(tempDir, "leaf-ca.pem")
+	err := os.WriteFile(combinedCaLeafFile, append(pem.EncodeToMemory(leafCert.CertPem), pem.EncodeToMemory(ca.CertPem)...), 0o644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return LeafWithRoot{
+		RootCa:             ca,
+		Leaf:               leafCert,
+		CombinedLeafCaFile: combinedCaLeafFile,
+	}
+}
+
+// GenerateRootCa generates a self-signed root CA certificate and key
+func GenerateRootCa(t testing.TB) GeneratedCert {
+	t.Helper()
+	tempDir := t.TempDir()
+
+	caCertTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "Root CA",
+		},
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		SerialNumber:          big.NewInt(mathrand2.Int64()),
+		NotBefore:             time.Now().Add(-30 * time.Second),
+		NotAfter:              time.Now().Add(262980 * time.Hour),
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+	}
+	caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	caBytes, err := x509.CreateCertificate(rand.Reader, caCertTemplate, caCertTemplate, caKey.Public(), caKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	caCert, err := x509.ParseCertificate(caBytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	caCertPEMBlock := &pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: caBytes,
+	}
+	caFile := filepath.Join(tempDir, "ca_root_cert.pem")
+	err = os.WriteFile(caFile, pem.EncodeToMemory(caCertPEMBlock), 0o644)
+	if err != nil {
+		t.Fatal(err)
+	}
+	marshaledCAKey, err := x509.MarshalECPrivateKey(caKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	caKeyPEMBlock := &pem.Block{
+		Type:  "EC PRIVATE KEY",
+		Bytes: marshaledCAKey,
+	}
+	caKeyFile := filepath.Join(tempDir, "ca_root_key.pem")
+	err = os.WriteFile(caKeyFile, pem.EncodeToMemory(caKeyPEMBlock), 0o644)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return GeneratedCert{
+		CertPem:  caCertPEMBlock,
+		CertFile: caFile,
+		KeyFile:  caKeyFile,
+		Cert:     caCert,
+		Key:      caKey,
+	}
+}
diff --git a/helper/testhelpers/pluginhelpers/pluginhelpers.go b/helper/testhelpers/pluginhelpers/pluginhelpers.go
index 40035fc59f3..0f44f679e19 100644
--- a/helper/testhelpers/pluginhelpers/pluginhelpers.go
+++ b/helper/testhelpers/pluginhelpers/pluginhelpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Package pluginhelpers contains testhelpers that don't depend on package
@@ -14,9 +14,10 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
+	"testing"
 
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/helper/consts"
-	"github.com/mitchellh/go-testing-interface"
 )
 
 var (
@@ -34,7 +35,7 @@ type TestPlugin struct {
 	ImageSha256 string
 }
 
-func GetPlugin(t testing.T, typ consts.PluginType) (string, string, string, string) {
+func GetPlugin(t testing.TB, typ consts.PluginType) (string, string, string, string) {
 	t.Helper()
 	var pluginName string
 	var pluginType string
@@ -65,7 +66,7 @@ func GetPlugin(t testing.T, typ consts.PluginType) (string, string, string, stri
 
 // to mount a plugin, we need a working binary plugin, so we compile one here.
 // pluginVersion is used to override the plugin's self-reported version
-func CompilePlugin(t testing.T, typ consts.PluginType, pluginVersion string, pluginDir string) TestPlugin {
+func CompilePlugin(t testing.TB, typ consts.PluginType, pluginVersion string, pluginDir string) TestPlugin {
 	t.Helper()
 
 	pluginName, pluginType, pluginMain, pluginVersionLocation := GetPlugin(t, typ)
@@ -76,18 +77,16 @@ func CompilePlugin(t testing.T, typ consts.PluginType, pluginVersion string, plu
 	var pluginBytes []byte
 
 	dir := ""
-	var err error
-	pluginRootDir := "builtin"
-	if typ == consts.PluginTypeDatabase {
-		pluginRootDir = "plugins"
-	}
 	for {
-		dir, err = os.Getwd()
-		if err != nil {
-			t.Fatal(err)
+		// So that we can assign to dir without overshadowing the other
+		// err variables.
+		var getWdErr error
+		dir, getWdErr = os.Getwd()
+		if getWdErr != nil {
+			t.Fatal(getWdErr)
 		}
 		// detect if we are in a subdirectory or the root directory and compensate
-		if _, err := os.Stat(pluginRootDir); os.IsNotExist(err) {
+		if _, err := os.Stat(pluginMain); os.IsNotExist(err) {
 			err := os.Chdir("..")
 			if err != nil {
 				t.Fatal(err)
@@ -112,6 +111,12 @@ func CompilePlugin(t testing.T, typ consts.PluginType, pluginVersion string, plu
 		if pluginVersion != "" {
 			line = append(line, "-ldflags", fmt.Sprintf("-X %s=%s", pluginVersionLocation, pluginVersion))
 		}
+		if constants.IsEnterprise {
+			// Under VAULT-38008, tokenutil.go got stubs, which means we now need to
+			// set the enterprise tag to avoid compiling both the _ent.go and the _stubs_oss.go
+			// files.
+			line = append(line, "-tags", "enterprise")
+		}
 		line = append(line, "-o", pluginPath, pluginMain)
 		cmd := exec.Command("go", line...)
 		cmd.Env = append(os.Environ(), "CGO_ENABLED=0")
@@ -128,15 +133,20 @@ func CompilePlugin(t testing.T, typ consts.PluginType, pluginVersion string, plu
 	}
 
 	// write the cached plugin if necessary
-	if _, err := os.Stat(pluginPath); os.IsNotExist(err) {
-		err = os.WriteFile(pluginPath, pluginBytes, 0o755)
-	}
-	if err != nil {
-		t.Fatal(err)
+	_, statErr := os.Stat(pluginPath)
+	if os.IsNotExist(statErr) {
+		err := os.WriteFile(pluginPath, pluginBytes, 0o755)
+		if err != nil {
+			t.Fatal(err)
+		}
+	} else {
+		if statErr != nil {
+			t.Fatal(statErr)
+		}
 	}
 
 	sha := sha256.New()
-	_, err = sha.Write(pluginBytes)
+	_, err := sha.Write(pluginBytes)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -149,7 +159,7 @@ func CompilePlugin(t testing.T, typ consts.PluginType, pluginVersion string, plu
 	}
 }
 
-func BuildPluginContainerImage(t testing.T, plugin TestPlugin, pluginDir string) (image string, sha256 string) {
+func BuildPluginContainerImage(t testing.TB, plugin TestPlugin, pluginDir string) (image string, sha256 string) {
 	t.Helper()
 	ref := plugin.Name
 	if plugin.Version != "" {
diff --git a/helper/testhelpers/postgresql/postgresqlhelper.go b/helper/testhelpers/postgresql/postgresqlhelper.go
index 7e5f25c626a..7f428510066 100644
--- a/helper/testhelpers/postgresql/postgresqlhelper.go
+++ b/helper/testhelpers/postgresql/postgresqlhelper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package postgresql
@@ -9,18 +9,53 @@ import (
 	"fmt"
 	"net/url"
 	"os"
+	"strconv"
 	"testing"
+	"time"
 
+	"github.com/hashicorp/vault/helper/testhelpers/certhelpers"
 	"github.com/hashicorp/vault/sdk/helper/docker"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 )
 
-func PrepareTestContainer(t *testing.T, version string) (func(), string) {
-	env := []string{
-		"POSTGRES_PASSWORD=secret",
-		"POSTGRES_DB=database",
+const (
+	defaultPGImage   = "docker.mirror.hashicorp.services/postgres"
+	defaultPGVersion = "13.4-buster"
+	defaultPGPass    = "secret"
+)
+
+func defaultRunOpts(t *testing.T) docker.RunOptions {
+	return docker.RunOptions{
+		ContainerName: "postgres",
+		ImageRepo:     defaultPGImage,
+		ImageTag:      defaultPGVersion,
+		Env: []string{
+			"POSTGRES_PASSWORD=" + defaultPGPass,
+			"POSTGRES_DB=database",
+		},
+		Ports:             []string{"5432/tcp"},
+		DoNotAutoRemove:   false,
+		OmitLogTimestamps: true,
+		LogConsumer: func(s string) {
+			if t.Failed() {
+				t.Logf("container logs: %s", s)
+			}
+		},
 	}
+}
+
+func PrepareTestContainer(t *testing.T) (func(), string) {
+	_, cleanup, url, _ := prepareTestContainer(t, defaultRunOpts(t), defaultPGPass, true, false, false)
+
+	return cleanup, url
+}
+
+func PrepareTestContainerSelfManaged(t *testing.T) (func(), *url.URL) {
+	return prepareTestContainerSelfManaged(t, defaultRunOpts(t), defaultPGPass, true, false, false)
+}
 
-	_, cleanup, url, _ := prepareTestContainer(t, "postgres", "docker.mirror.hashicorp.services/postgres", version, "secret", true, false, false, env)
+func PrepareTestContainerMultiHost(t *testing.T) (func(), string) {
+	_, cleanup, url, _ := prepareTestContainer(t, defaultRunOpts(t), defaultPGPass, true, false, true)
 
 	return cleanup, url
 }
@@ -28,65 +63,149 @@ func PrepareTestContainer(t *testing.T, version string) (func(), string) {
 // PrepareTestContainerWithVaultUser will setup a test container with a Vault
 // admin user configured so that we can safely call rotate-root without
 // rotating the root DB credentials
-func PrepareTestContainerWithVaultUser(t *testing.T, ctx context.Context, version string) (func(), string) {
-	env := []string{
-		"POSTGRES_PASSWORD=secret",
-		"POSTGRES_DB=database",
+func PrepareTestContainerWithVaultUser(t *testing.T, ctx context.Context) (func(), string) {
+	runner, cleanup, url, id := prepareTestContainer(t, defaultRunOpts(t), defaultPGPass, true, false, false)
+
+	cmd := []string{"psql", "-U", "postgres", "-c", "CREATE USER vaultadmin WITH LOGIN PASSWORD 'vaultpass' SUPERUSER"}
+	mustRunCommand(t, ctx, runner, id, cmd)
+
+	return cleanup, url
+}
+
+// PrepareTestContainerWithSSL will setup a test container with SSL enabled so
+// that we can test client certificate authentication.
+func PrepareTestContainerWithSSL(
+	t *testing.T,
+	sslMode string,
+	caCert certhelpers.Certificate,
+	clientCert certhelpers.Certificate,
+	useFallback bool,
+) (func(), string) {
+	runOpts := defaultRunOpts(t)
+	runner, err := docker.NewServiceRunner(runOpts)
+	if err != nil {
+		t.Fatalf("Could not provision docker service runner: %s", err)
 	}
 
-	runner, cleanup, url, id := prepareTestContainer(t, "postgres", "docker.mirror.hashicorp.services/postgres", version, "secret", true, false, false, env)
+	// first we connect with username/password because ssl is not enabled yet
+	svc, id, err := runner.StartNewService(context.Background(), true, false, connectPostgres(defaultPGPass, runOpts.ImageRepo, false))
+	if err != nil {
+		t.Fatalf("Could not start docker Postgres: %s", err)
+	}
 
-	cmd := []string{"psql", "-U", "postgres", "-c", "CREATE USER vaultadmin WITH LOGIN PASSWORD 'vaultpass' SUPERUSER"}
-	_, err := runner.RunCmdInBackground(ctx, id, cmd)
+	// Create certificates for postgres authentication
+	serverCert := certhelpers.NewCert(t,
+		certhelpers.CommonName("server"),
+		certhelpers.DNS("localhost"),
+		certhelpers.Parent(caCert),
+	)
+
+	bCtx := docker.NewBuildContext()
+	bCtx["ca.crt"] = docker.PathContentsFromBytes(caCert.CombinedPEM())
+	bCtx["server.crt"] = docker.PathContentsFromBytes(serverCert.CombinedPEM())
+	bCtx["server.key"] = &docker.FileContents{
+		Data: serverCert.PrivateKeyPEM(),
+		Mode: 0o600,
+		// postgres uid
+		UID: 999,
+	}
+
+	// https://www.postgresql.org/docs/current/auth-pg-hba-conf.html
+	clientAuthConfig := "echo 'hostssl all all all cert clientcert=verify-ca' > /var/lib/postgresql/data/pg_hba.conf"
+	bCtx["ssl-conf.sh"] = docker.PathContentsFromString(clientAuthConfig)
+	pgConfig := `
+cat << EOF > /var/lib/postgresql/data/postgresql.conf
+# PostgreSQL configuration file
+listen_addresses = '*'
+max_connections = 100
+shared_buffers = 128MB
+dynamic_shared_memory_type = posix
+max_wal_size = 1GB
+min_wal_size = 80MB
+ssl = on
+ssl_ca_file = '/var/lib/postgresql/ca.crt'
+ssl_cert_file = '/var/lib/postgresql/server.crt'
+ssl_key_file= '/var/lib/postgresql/server.key'
+EOF
+`
+	bCtx["pg-conf.sh"] = docker.PathContentsFromString(pgConfig)
+
+	err = runner.CopyTo(id, "/var/lib/postgresql/", bCtx)
 	if err != nil {
-		t.Fatalf("Could not run command (%v) in container: %v", cmd, err)
+		t.Fatalf("failed to copy to container: %v", err)
 	}
 
-	return cleanup, url
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	// overwrite the postgresql.conf config file with our ssl settings
+	mustRunCommand(t, ctx, runner, id,
+		[]string{"bash", "/var/lib/postgresql/pg-conf.sh"})
+
+	// overwrite the pg_hba.conf file and set it to require SSL for each connection
+	mustRunCommand(t, ctx, runner, id,
+		[]string{"bash", "/var/lib/postgresql/ssl-conf.sh"})
+
+	// reload so the config changes take effect and ssl is enabled
+	mustRunCommand(t, ctx, runner, id,
+		[]string{"psql", "-U", "postgres", "-c", "SELECT pg_reload_conf()"})
+
+	if sslMode == "disable" {
+		// return non-tls connection url
+		return svc.Cleanup, svc.Config.URL().String()
+	}
+
+	sslConfig := getPostgresSSLConfig(
+		t,
+		svc.Config.URL().Host,
+		sslMode,
+		string(caCert.CombinedPEM()),
+		string(clientCert.CombinedPEM()),
+		string(clientCert.PrivateKeyPEM()),
+		useFallback,
+	)
+	if err != nil {
+		svc.Cleanup()
+		t.Fatalf("failed to connect to postgres container via SSL: %v", err)
+	}
+	return svc.Cleanup, sslConfig.URL().String()
 }
 
-func PrepareTestContainerWithPassword(t *testing.T, version, password string) (func(), string) {
-	env := []string{
+func PrepareTestContainerWithPassword(t *testing.T, password string) (func(), string) {
+	runOpts := defaultRunOpts(t)
+	runOpts.Env = []string{
 		"POSTGRES_PASSWORD=" + password,
 		"POSTGRES_DB=database",
 	}
 
-	_, cleanup, url, _ := prepareTestContainer(t, "postgres", "docker.mirror.hashicorp.services/postgres", version, password, true, false, false, env)
+	_, cleanup, url, _ := prepareTestContainer(t, runOpts, password, true, false, false)
 
 	return cleanup, url
 }
 
-func PrepareTestContainerRepmgr(t *testing.T, name, version string, envVars []string) (*docker.Runner, func(), string, string) {
-	env := append(envVars,
-		"REPMGR_PARTNER_NODES=psql-repl-node-0,psql-repl-node-1",
-		"REPMGR_PRIMARY_HOST=psql-repl-node-0",
-		"REPMGR_PASSWORD=repmgrpass",
-		"POSTGRESQL_PASSWORD=secret")
-
-	return prepareTestContainer(t, name, "docker.mirror.hashicorp.services/bitnami/postgresql-repmgr", version, "secret", false, true, true, env)
-}
-
-func prepareTestContainer(t *testing.T, name, repo, version, password string,
-	addSuffix, forceLocalAddr, doNotAutoRemove bool, envVars []string,
+func prepareTestContainer(t *testing.T, runOpts docker.RunOptions, password string, addSuffix, forceLocalAddr, useFallback bool,
 ) (*docker.Runner, func(), string, string) {
 	if os.Getenv("PG_URL") != "" {
 		return nil, func() {}, "", os.Getenv("PG_URL")
 	}
 
-	if version == "" {
-		version = "11"
+	runner, err := docker.NewServiceRunner(runOpts)
+	if err != nil {
+		t.Fatalf("Could not start docker Postgres: %s", err)
 	}
 
-	runOpts := docker.RunOptions{
-		ContainerName:   name,
-		ImageRepo:       repo,
-		ImageTag:        version,
-		Env:             envVars,
-		Ports:           []string{"5432/tcp"},
-		DoNotAutoRemove: doNotAutoRemove,
+	svc, containerID, err := runner.StartNewService(context.Background(), addSuffix, forceLocalAddr, connectPostgres(password, runOpts.ImageRepo, useFallback))
+	if err != nil {
+		t.Fatalf("Could not start docker Postgres: %s", err)
 	}
-	if repo == "bitnami/postgresql-repmgr" {
-		runOpts.NetworkID = os.Getenv("POSTGRES_MULTIHOST_NET")
+
+	return runner, svc.Cleanup, svc.Config.URL().String(), containerID
+}
+
+func prepareTestContainerSelfManaged(t *testing.T, runOpts docker.RunOptions, password string, addSuffix, forceLocalAddr, useFallback bool,
+) (func(), *url.URL) {
+	if os.Getenv("PG_URL") != "" {
+		return func() {}, nil
 	}
 
 	runner, err := docker.NewServiceRunner(runOpts)
@@ -94,20 +213,61 @@ func prepareTestContainer(t *testing.T, name, repo, version, password string,
 		t.Fatalf("Could not start docker Postgres: %s", err)
 	}
 
-	svc, containerID, err := runner.StartNewService(context.Background(), addSuffix, forceLocalAddr, connectPostgres(password, repo))
+	svc, _, err := runner.StartNewService(context.Background(), addSuffix, forceLocalAddr, connectPostgres(password, runOpts.ImageRepo, useFallback))
 	if err != nil {
 		t.Fatalf("Could not start docker Postgres: %s", err)
 	}
 
-	return runner, svc.Cleanup, svc.Config.URL().String(), containerID
+	return svc.Cleanup, svc.Config.URL()
+}
+
+func getPostgresSSLConfig(t *testing.T, host, sslMode, caCert, clientCert, clientKey string, useFallback bool) docker.ServiceConfig {
+	if useFallback {
+		// set the first host to a bad address so we can test the fallback logic
+		host = "localhost:55," + host
+	}
+
+	u := url.URL{}
+
+	if ok, _ := strconv.ParseBool(os.Getenv(pluginutil.PluginUsePostgresSSLInline)); ok {
+		// TODO: remove this when we remove the underlying feature in a future SDK version
+		u = url.URL{
+			Scheme: "postgres",
+			User:   url.User("postgres"),
+			Host:   host,
+			Path:   "postgres",
+			RawQuery: url.Values{
+				"sslmode":     {sslMode},
+				"sslinline":   {"true"},
+				"sslrootcert": {caCert},
+				"sslcert":     {clientCert},
+				"sslkey":      {clientKey},
+			}.Encode(),
+		}
+	} else {
+		u = url.URL{
+			Scheme:   "postgres",
+			User:     url.User("postgres"),
+			Host:     host,
+			Path:     "postgres",
+			RawQuery: url.Values{"sslmode": {sslMode}}.Encode(),
+		}
+	}
+
+	return docker.NewServiceURL(u)
 }
 
-func connectPostgres(password, repo string) docker.ServiceAdapter {
+func connectPostgres(password, repo string, useFallback bool) docker.ServiceAdapter {
 	return func(ctx context.Context, host string, port int) (docker.ServiceConfig, error) {
+		hostAddr := fmt.Sprintf("%s:%d", host, port)
+		if useFallback {
+			// set the first host to a bad address so we can test the fallback logic
+			hostAddr = "localhost:55," + hostAddr
+		}
 		u := url.URL{
 			Scheme:   "postgres",
 			User:     url.UserPassword("postgres", password),
-			Host:     fmt.Sprintf("%s:%d", host, port),
+			Host:     hostAddr,
 			Path:     "postgres",
 			RawQuery: "sslmode=disable",
 		}
@@ -136,3 +296,14 @@ func RestartContainer(t *testing.T, ctx context.Context, runner *docker.Runner,
 		t.Fatalf("Could not restart docker Postgres: %s", err)
 	}
 }
+
+func mustRunCommand(t *testing.T, ctx context.Context, runner *docker.Runner, containerID string, cmd []string) {
+	t.Helper()
+	_, stderr, retcode, err := runner.RunCmdWithOutput(ctx, containerID, cmd)
+	if err != nil {
+		t.Fatalf("Could not run command (%v) in container: %v", cmd, err)
+	}
+	if retcode != 0 || len(stderr) != 0 {
+		t.Fatalf("exit code: %v, stderr: %v", retcode, string(stderr))
+	}
+}
diff --git a/helper/testhelpers/replication/testcluster.go b/helper/testhelpers/replication/testcluster.go
index 32297c1b7b2..152f35a486e 100644
--- a/helper/testhelpers/replication/testcluster.go
+++ b/helper/testhelpers/replication/testcluster.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package replication
diff --git a/helper/testhelpers/seal/sealhelper.go b/helper/testhelpers/seal/sealhelper.go
index 580f42e9e08..5c5b7e48c55 100644
--- a/helper/testhelpers/seal/sealhelper.go
+++ b/helper/testhelpers/seal/sealhelper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package sealhelper
@@ -6,6 +6,7 @@ package sealhelper
 import (
 	"path"
 	"strconv"
+	"testing"
 
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/builtin/logical/transit"
@@ -16,14 +17,13 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 	"github.com/hashicorp/vault/vault/seal"
-	"github.com/mitchellh/go-testing-interface"
 )
 
 type TransitSealServer struct {
 	*vault.TestCluster
 }
 
-func NewTransitSealServer(t testing.T, idx int) *TransitSealServer {
+func NewTransitSealServer(t testing.TB, idx int) *TransitSealServer {
 	conf := &vault.CoreConfig{
 		LogicalBackends: map[string]logical.Factory{
 			"transit": transit.Factory,
@@ -47,7 +47,7 @@ func NewTransitSealServer(t testing.T, idx int) *TransitSealServer {
 	return &TransitSealServer{cluster}
 }
 
-func (tss *TransitSealServer) MakeKey(t testing.T, key string) {
+func (tss *TransitSealServer) MakeKey(t testing.TB, key string) {
 	client := tss.Cores[0].Client
 	if _, err := client.Logical().Write(path.Join("transit", "keys", key), nil); err != nil {
 		t.Fatal(err)
@@ -59,7 +59,7 @@ func (tss *TransitSealServer) MakeKey(t testing.T, key string) {
 	}
 }
 
-func (tss *TransitSealServer) MakeSeal(t testing.T, key string) (vault.Seal, error) {
+func (tss *TransitSealServer) MakeSeal(t testing.TB, key string) (vault.Seal, error) {
 	client := tss.Cores[0].Client
 	wrapperConfig := map[string]string{
 		"address":     client.Address(),
diff --git a/helper/testhelpers/testhelpers.go b/helper/testhelpers/testhelpers.go
index f589d26fb39..9d708d54d0a 100644
--- a/helper/testhelpers/testhelpers.go
+++ b/helper/testhelpers/testhelpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package testhelpers
@@ -9,10 +9,11 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"math/rand"
 	"os"
 	"strings"
+	"testing"
 	"time"
 
 	"github.com/armon/go-metrics"
@@ -23,9 +24,9 @@ import (
 	"github.com/hashicorp/vault/physical/raft"
 	"github.com/hashicorp/vault/sdk/helper/xor"
 	"github.com/hashicorp/vault/vault"
-	"github.com/mitchellh/go-testing-interface"
 )
 
+//go:generate enumer -type=GenerateRootKind -trimprefix=GenerateRoot
 type GenerateRootKind int
 
 const (
@@ -35,7 +36,7 @@ const (
 )
 
 // GenerateRoot generates a root token on the target cluster.
-func GenerateRoot(t testing.T, cluster *vault.TestCluster, kind GenerateRootKind) string {
+func GenerateRoot(t testing.TB, cluster *vault.TestCluster, kind GenerateRootKind) string {
 	t.Helper()
 	token, err := GenerateRootWithError(t, cluster, kind)
 	if err != nil {
@@ -44,7 +45,7 @@ func GenerateRoot(t testing.T, cluster *vault.TestCluster, kind GenerateRootKind
 	return token
 }
 
-func GenerateRootWithError(t testing.T, cluster *vault.TestCluster, kind GenerateRootKind) (string, error) {
+func GenerateRootWithError(t testing.TB, cluster *vault.TestCluster, kind GenerateRootKind) (string, error) {
 	t.Helper()
 	// If recovery keys supported, use those to perform root token generation instead
 	var keys [][]byte
@@ -117,14 +118,14 @@ func RandomWithPrefix(name string) string {
 	return fmt.Sprintf("%s-%d", name, rand.New(rand.NewSource(time.Now().UnixNano())).Int())
 }
 
-func EnsureCoresSealed(t testing.T, c *vault.TestCluster) {
+func EnsureCoresSealed(t testing.TB, c *vault.TestCluster) {
 	t.Helper()
 	for _, core := range c.Cores {
 		EnsureCoreSealed(t, core)
 	}
 }
 
-func EnsureCoreSealed(t testing.T, core *vault.TestClusterCore) {
+func EnsureCoreSealed(t testing.TB, core *vault.TestClusterCore) {
 	t.Helper()
 	core.Seal(t)
 	timeout := time.Now().Add(60 * time.Second)
@@ -139,7 +140,7 @@ func EnsureCoreSealed(t testing.T, core *vault.TestClusterCore) {
 	}
 }
 
-func EnsureCoresUnsealed(t testing.T, c *vault.TestCluster) {
+func EnsureCoresUnsealed(t testing.TB, c *vault.TestCluster) {
 	t.Helper()
 	for i, core := range c.Cores {
 		err := AttemptUnsealCore(c, core)
@@ -149,7 +150,7 @@ func EnsureCoresUnsealed(t testing.T, c *vault.TestCluster) {
 	}
 }
 
-func EnsureCoreUnsealed(t testing.T, c *vault.TestCluster, core *vault.TestClusterCore) {
+func EnsureCoreUnsealed(t testing.TB, c *vault.TestCluster, core *vault.TestClusterCore) {
 	t.Helper()
 	err := AttemptUnsealCore(c, core)
 	if err != nil {
@@ -207,17 +208,17 @@ func AttemptUnsealCore(c *vault.TestCluster, core *vault.TestClusterCore) error
 	return nil
 }
 
-func EnsureStableActiveNode(t testing.T, cluster *vault.TestCluster) {
+func EnsureStableActiveNode(t testing.TB, cluster *vault.TestCluster) {
 	t.Helper()
 	deriveStableActiveCore(t, cluster)
 }
 
-func DeriveStableActiveCore(t testing.T, cluster *vault.TestCluster) *vault.TestClusterCore {
+func DeriveStableActiveCore(t testing.TB, cluster *vault.TestCluster) *vault.TestClusterCore {
 	t.Helper()
 	return deriveStableActiveCore(t, cluster)
 }
 
-func deriveStableActiveCore(t testing.T, cluster *vault.TestCluster) *vault.TestClusterCore {
+func deriveStableActiveCore(t testing.TB, cluster *vault.TestCluster) *vault.TestClusterCore {
 	t.Helper()
 	activeCore := DeriveActiveCore(t, cluster)
 	minDuration := time.NewTimer(3 * time.Second)
@@ -246,7 +247,7 @@ func deriveStableActiveCore(t testing.T, cluster *vault.TestCluster) *vault.Test
 	return activeCore
 }
 
-func DeriveActiveCore(t testing.T, cluster *vault.TestCluster) *vault.TestClusterCore {
+func DeriveActiveCore(t testing.TB, cluster *vault.TestCluster) *vault.TestClusterCore {
 	t.Helper()
 	for i := 0; i < 60; i++ {
 		for _, core := range cluster.Cores {
@@ -267,7 +268,7 @@ func DeriveActiveCore(t testing.T, cluster *vault.TestCluster) *vault.TestCluste
 	return nil
 }
 
-func DeriveStandbyCores(t testing.T, cluster *vault.TestCluster) []*vault.TestClusterCore {
+func DeriveStandbyCores(t testing.TB, cluster *vault.TestCluster) []*vault.TestClusterCore {
 	t.Helper()
 	cores := make([]*vault.TestClusterCore, 0, 2)
 	for _, core := range cluster.Cores {
@@ -286,7 +287,7 @@ func DeriveStandbyCores(t testing.T, cluster *vault.TestCluster) []*vault.TestCl
 	return cores
 }
 
-func WaitForNCoresUnsealed(t testing.T, cluster *vault.TestCluster, n int) {
+func WaitForNCoresUnsealed(t testing.TB, cluster *vault.TestCluster, n int) {
 	t.Helper()
 	for i := 0; i < 30; i++ {
 		unsealed := 0
@@ -305,7 +306,7 @@ func WaitForNCoresUnsealed(t testing.T, cluster *vault.TestCluster, n int) {
 	t.Fatalf("%d cores were not unsealed", n)
 }
 
-func SealCores(t testing.T, cluster *vault.TestCluster) {
+func SealCores(t testing.TB, cluster *vault.TestCluster) {
 	t.Helper()
 	for _, core := range cluster.Cores {
 		if err := core.Shutdown(); err != nil {
@@ -324,7 +325,7 @@ func SealCores(t testing.T, cluster *vault.TestCluster) {
 	}
 }
 
-func WaitForNCoresSealed(t testing.T, cluster *vault.TestCluster, n int) {
+func WaitForNCoresSealed(t testing.TB, cluster *vault.TestCluster, n int) {
 	t.Helper()
 	for i := 0; i < 60; i++ {
 		sealed := 0
@@ -343,7 +344,7 @@ func WaitForNCoresSealed(t testing.T, cluster *vault.TestCluster, n int) {
 	t.Fatalf("%d cores were not sealed", n)
 }
 
-func WaitForActiveNode(t testing.T, cluster *vault.TestCluster) *vault.TestClusterCore {
+func WaitForActiveNode(t testing.TB, cluster *vault.TestCluster) *vault.TestClusterCore {
 	t.Helper()
 	for i := 0; i < 60; i++ {
 		for _, core := range cluster.Cores {
@@ -359,7 +360,7 @@ func WaitForActiveNode(t testing.T, cluster *vault.TestCluster) *vault.TestClust
 	return nil
 }
 
-func WaitForStandbyNode(t testing.T, core *vault.TestClusterCore) {
+func WaitForStandbyNode(t testing.TB, core *vault.TestClusterCore) {
 	t.Helper()
 	for i := 0; i < 30; i++ {
 		if isLeader, _, clusterAddr, _ := core.Core.Leader(); isLeader != true && clusterAddr != "" {
@@ -375,7 +376,7 @@ func WaitForStandbyNode(t testing.T, core *vault.TestClusterCore) {
 	t.Fatalf("node did not become standby")
 }
 
-func RekeyCluster(t testing.T, cluster *vault.TestCluster, recovery bool) [][]byte {
+func RekeyCluster(t testing.TB, cluster *vault.TestCluster, recovery bool) [][]byte {
 	t.Helper()
 	cluster.Logger.Info("rekeying cluster", "recovery", recovery)
 	client := cluster.Cores[0].Client
@@ -504,7 +505,7 @@ func RaftAppliedIndex(core *vault.TestClusterCore) uint64 {
 	return core.UnderlyingRawStorage.(*raft.RaftBackend).AppliedIndex()
 }
 
-func WaitForRaftApply(t testing.T, core *vault.TestClusterCore, index uint64) {
+func WaitForRaftApply(t testing.TB, core *vault.TestClusterCore, index uint64) {
 	t.Helper()
 
 	backend := core.UnderlyingRawStorage.(*raft.RaftBackend)
@@ -520,7 +521,7 @@ func WaitForRaftApply(t testing.T, core *vault.TestClusterCore, index uint64) {
 }
 
 // AwaitLeader waits for one of the cluster's nodes to become leader.
-func AwaitLeader(t testing.T, cluster *vault.TestCluster) (int, error) {
+func AwaitLeader(t testing.TB, cluster *vault.TestCluster) (int, error) {
 	timeout := time.Now().Add(60 * time.Second)
 	for {
 		if time.Now().After(timeout) {
@@ -544,7 +545,7 @@ func AwaitLeader(t testing.T, cluster *vault.TestCluster) (int, error) {
 	return 0, fmt.Errorf("timeout waiting leader")
 }
 
-func GenerateDebugLogs(t testing.T, client *api.Client) chan struct{} {
+func GenerateDebugLogs(t testing.TB, client *api.Client) chan struct{} {
 	t.Helper()
 
 	stopCh := make(chan struct{})
@@ -583,7 +584,7 @@ func GenerateDebugLogs(t testing.T, client *api.Client) chan struct{} {
 // from the map by removing entries whose keys are in the raft configuration.
 // Remaining entries result in an error return so that the caller can poll for
 // an expected configuration.
-func VerifyRaftPeers(t testing.T, client *api.Client, expected map[string]bool) error {
+func VerifyRaftPeers(t testing.TB, client *api.Client, expected map[string]bool) error {
 	t.Helper()
 
 	resp, err := client.Logical().Read("sys/storage/raft/configuration")
@@ -640,7 +641,7 @@ func SysMetricsReq(client *api.Client, cluster *vault.TestCluster, unauth bool)
 	if err != nil {
 		return nil, err
 	}
-	bodyBytes, err := ioutil.ReadAll(resp.Response.Body)
+	bodyBytes, err := io.ReadAll(resp.Response.Body)
 	if err != nil {
 		return nil, err
 	}
@@ -719,7 +720,18 @@ func SetNonRootToken(client *api.Client) error {
 
 // RetryUntilAtCadence runs f until it returns a nil result or the timeout is reached.
 // If a nil result hasn't been obtained by timeout, calls t.Fatal.
-func RetryUntilAtCadence(t testing.T, timeout, sleepTime time.Duration, f func() error) {
+func RetryUntilAtCadence(t testing.TB, timeout, sleepTime time.Duration, f func() error) {
+	t.Helper()
+	fail := func(err error) {
+		t.Helper()
+		t.Fatalf("did not complete before deadline, err: %v", err)
+	}
+	RetryUntilAtCadenceWithHandler(t, timeout, sleepTime, fail, f)
+}
+
+// RetryUntilAtCadenceWithHandler runs f until it returns a nil result or the timeout is reached.
+// If a nil result hasn't been obtained by timeout, onFailure is called.
+func RetryUntilAtCadenceWithHandler(t testing.TB, timeout, sleepTime time.Duration, onFailure func(error), f func() error) {
 	t.Helper()
 	deadline := time.Now().Add(timeout)
 	var err error
@@ -729,33 +741,28 @@ func RetryUntilAtCadence(t testing.T, timeout, sleepTime time.Duration, f func()
 		}
 		time.Sleep(sleepTime)
 	}
-	t.Fatalf("did not complete before deadline, err: %v", err)
+	onFailure(err)
 }
 
-// RetryUntil runs f until it returns a nil result or the timeout is reached.
+// RetryUntil runs f with a 100ms pause between calls, until f returns a nil result
+// or the timeout is reached.
 // If a nil result hasn't been obtained by timeout, calls t.Fatal.
-func RetryUntil(t testing.T, timeout time.Duration, f func() error) {
+// NOTE: See RetryUntilAtCadence if you want to specify a different wait/sleep
+// duration between calls.
+func RetryUntil(t testing.TB, timeout time.Duration, f func() error) {
 	t.Helper()
-	deadline := time.Now().Add(timeout)
-	var err error
-	for time.Now().Before(deadline) {
-		if err = f(); err == nil {
-			return
-		}
-		time.Sleep(100 * time.Millisecond)
-	}
-	t.Fatalf("did not complete before deadline, err: %v", err)
+	RetryUntilAtCadence(t, timeout, 100*time.Millisecond, f)
 }
 
 // CreateEntityAndAlias clones an existing client and creates an entity/alias, uses userpass mount path
 // It returns the cloned client, entityID, and aliasID.
-func CreateEntityAndAlias(t testing.T, client *api.Client, mountAccessor, entityName, aliasName string) (*api.Client, string, string) {
+func CreateEntityAndAlias(t testing.TB, client *api.Client, mountAccessor, entityName, aliasName string) (*api.Client, string, string) {
 	return CreateEntityAndAliasWithinMount(t, client, mountAccessor, "userpass", entityName, aliasName)
 }
 
 // CreateEntityAndAliasWithinMount clones an existing client and creates an entity/alias, within the specified mountPath
 // It returns the cloned client, entityID, and aliasID.
-func CreateEntityAndAliasWithinMount(t testing.T, client *api.Client, mountAccessor, mountPath, entityName, aliasName string) (*api.Client, string, string) {
+func CreateEntityAndAliasWithinMount(t testing.TB, client *api.Client, mountAccessor, mountPath, entityName, aliasName string) (*api.Client, string, string) {
 	t.Helper()
 	userClient, err := client.Clone()
 	if err != nil {
@@ -796,7 +803,7 @@ func CreateEntityAndAliasWithinMount(t testing.T, client *api.Client, mountAcces
 
 // SetupTOTPMount enables the totp secrets engine by mounting it. This requires
 // that the test cluster has a totp backend available.
-func SetupTOTPMount(t testing.T, client *api.Client) {
+func SetupTOTPMount(t testing.TB, client *api.Client) {
 	t.Helper()
 	// Mount the TOTP backend
 	mountInfo := &api.MountInput{
@@ -808,7 +815,7 @@ func SetupTOTPMount(t testing.T, client *api.Client) {
 }
 
 // SetupTOTPMethod configures the TOTP secrets engine with a provided config map.
-func SetupTOTPMethod(t testing.T, client *api.Client, config map[string]interface{}) string {
+func SetupTOTPMethod(t testing.TB, client *api.Client, config map[string]interface{}) string {
 	t.Helper()
 
 	resp1, err := client.Logical().Write("identity/mfa/method/totp", config)
@@ -827,7 +834,7 @@ func SetupTOTPMethod(t testing.T, client *api.Client, config map[string]interfac
 
 // SetupMFALoginEnforcement configures a single enforcement method using the
 // provided config map. "name" field is required in the config map.
-func SetupMFALoginEnforcement(t testing.T, client *api.Client, config map[string]interface{}) {
+func SetupMFALoginEnforcement(t testing.TB, client *api.Client, config map[string]interface{}) {
 	t.Helper()
 	enfName, ok := config["name"]
 	if !ok {
@@ -842,7 +849,7 @@ func SetupMFALoginEnforcement(t testing.T, client *api.Client, config map[string
 // SetupUserpassMountAccessor sets up userpass auth and returns its mount
 // accessor. This requires that the test cluster has a "userpass" auth method
 // available.
-func SetupUserpassMountAccessor(t testing.T, client *api.Client) string {
+func SetupUserpassMountAccessor(t testing.TB, client *api.Client) string {
 	t.Helper()
 	// Enable Userpass authentication
 	err := client.Sys().EnableAuthWithOptions("userpass", &api.EnableAuthOptions{
@@ -865,7 +872,7 @@ func SetupUserpassMountAccessor(t testing.T, client *api.Client) string {
 
 // RegisterEntityInTOTPEngine registers an entity with a methodID and returns
 // the generated name.
-func RegisterEntityInTOTPEngine(t testing.T, client *api.Client, entityID, methodID string) string {
+func RegisterEntityInTOTPEngine(t testing.TB, client *api.Client, entityID, methodID string) string {
 	t.Helper()
 	totpGenName := fmt.Sprintf("%s-%s", entityID, methodID)
 	secret, err := client.Logical().WriteWithContext(context.Background(), "identity/mfa/method/totp/admin-generate", map[string]interface{}{
@@ -899,7 +906,7 @@ func RegisterEntityInTOTPEngine(t testing.T, client *api.Client, entityID, metho
 }
 
 // GetTOTPCodeFromEngine requests a TOTP code from the specified enginePath.
-func GetTOTPCodeFromEngine(t testing.T, client *api.Client, enginePath string) string {
+func GetTOTPCodeFromEngine(t testing.TB, client *api.Client, enginePath string) string {
 	t.Helper()
 	totpPath := fmt.Sprintf("totp/code/%s", enginePath)
 	secret, err := client.Logical().ReadWithContext(context.Background(), totpPath)
@@ -914,7 +921,7 @@ func GetTOTPCodeFromEngine(t testing.T, client *api.Client, enginePath string) s
 
 // SetupLoginMFATOTP setups up a TOTP MFA using some basic configuration and
 // returns all relevant information to the client.
-func SetupLoginMFATOTP(t testing.T, client *api.Client, methodName string, waitPeriod int) (*api.Client, string, string) {
+func SetupLoginMFATOTP(t testing.TB, client *api.Client, methodName string, waitPeriod int) (*api.Client, string, string) {
 	t.Helper()
 	// Mount the totp secrets engine
 	SetupTOTPMount(t, client)
@@ -950,7 +957,7 @@ func SetupLoginMFATOTP(t testing.T, client *api.Client, methodName string, waitP
 	return entityClient, entityID, methodID
 }
 
-func SkipUnlessEnvVarsSet(t testing.T, envVars []string) {
+func SkipUnlessEnvVarsSet(t testing.TB, envVars []string) {
 	t.Helper()
 
 	for _, i := range envVars {
@@ -968,7 +975,7 @@ func SkipUnlessEnvVarsSet(t testing.T, envVars []string) {
 // The intention/use case for this function is to allow a cluster to start and become active with one
 // or more nodes not joined, so that we can test scenarios where a node joins later.
 // e.g. 4 nodes in the cluster, only 3 nodes in cluster 'active', 1 node can be joined later in tests.
-func WaitForNodesExcludingSelectedStandbys(t testing.T, cluster *vault.TestCluster, indexesToSkip ...int) {
+func WaitForNodesExcludingSelectedStandbys(t testing.TB, cluster *vault.TestCluster, indexesToSkip ...int) {
 	WaitForActiveNode(t, cluster)
 
 	contains := func(elems []int, e int) bool {
@@ -996,3 +1003,15 @@ func WaitForNodesExcludingSelectedStandbys(t testing.T, cluster *vault.TestClust
 func IsLocalOrRegressionTests() bool {
 	return os.Getenv("CI") == "" || os.Getenv("VAULT_REGRESSION_TESTS") == "true"
 }
+
+func RaftDataDir(t testing.TB, core *vault.TestClusterCore) string {
+	t.Helper()
+	r, ok := core.UnderlyingStorage.(*raft.RaftBackend)
+	if !ok {
+		r, ok = core.UnderlyingHAStorage.(*raft.RaftBackend)
+		if !ok {
+			t.Fatal("no raft backend")
+		}
+	}
+	return r.DataDir(t)
+}
diff --git a/helper/testhelpers/testhelpers_oss.go b/helper/testhelpers/testhelpers_oss.go
index 8965ed9169a..f0a42dc194d 100644
--- a/helper/testhelpers/testhelpers_oss.go
+++ b/helper/testhelpers/testhelpers_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -6,13 +6,14 @@
 package testhelpers
 
 import (
+	"testing"
+
 	"github.com/hashicorp/vault/vault"
-	"github.com/mitchellh/go-testing-interface"
 )
 
 // WaitForActiveNodeAndStandbys does nothing more than wait for the active node
 // on OSS. On enterprise it waits for perf standbys to be healthy too.
-func WaitForActiveNodeAndStandbys(t testing.T, cluster *vault.TestCluster) {
+func WaitForActiveNodeAndStandbys(t testing.TB, cluster *vault.TestCluster) {
 	WaitForActiveNode(t, cluster)
 	for _, core := range cluster.Cores {
 		if standby, _ := core.Core.Standby(); standby {
diff --git a/helper/testhelpers/teststorage/consul/consul.go b/helper/testhelpers/teststorage/consul/consul.go
index 26a2175dac2..a3ae41225e4 100644
--- a/helper/testhelpers/teststorage/consul/consul.go
+++ b/helper/testhelpers/teststorage/consul/consul.go
@@ -1,20 +1,20 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
 
 import (
 	"sync"
+	"testing"
 	realtesting "testing"
 
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/helper/testhelpers/consul"
 	physConsul "github.com/hashicorp/vault/physical/consul"
 	"github.com/hashicorp/vault/vault"
-	"github.com/mitchellh/go-testing-interface"
 )
 
-func MakeConsulBackend(t testing.T, logger hclog.Logger) *vault.PhysicalBackendBundle {
+func MakeConsulBackend(t testing.TB, logger hclog.Logger) *vault.PhysicalBackendBundle {
 	cleanup, config := consul.PrepareTestContainer(t.(*realtesting.T), "", false, true)
 
 	consulConf := map[string]string{
@@ -56,7 +56,7 @@ type consulContainerManager struct {
 	current *consulContainerBackendFactory
 }
 
-func (m *consulContainerManager) Backend(t testing.T, coreIdx int,
+func (m *consulContainerManager) Backend(t testing.TB, coreIdx int,
 	logger hclog.Logger, conf map[string]interface{},
 ) *vault.PhysicalBackendBundle {
 	m.mu.Lock()
@@ -77,7 +77,7 @@ type consulContainerBackendFactory struct {
 	config    map[string]string
 }
 
-func (f *consulContainerBackendFactory) Backend(t testing.T, coreIdx int,
+func (f *consulContainerBackendFactory) Backend(t testing.TB, coreIdx int,
 	logger hclog.Logger, conf map[string]interface{},
 ) *vault.PhysicalBackendBundle {
 	f.mu.Lock()
@@ -100,7 +100,7 @@ func (f *consulContainerBackendFactory) Backend(t testing.T, coreIdx int,
 	}
 }
 
-func (f *consulContainerBackendFactory) startContainerLocked(t testing.T) {
+func (f *consulContainerBackendFactory) startContainerLocked(t testing.TB) {
 	cleanup, config := consul.PrepareTestContainer(t.(*realtesting.T), "", false, true)
 	f.config = map[string]string{
 		"address":      config.Address(),
diff --git a/helper/testhelpers/teststorage/teststorage.go b/helper/testhelpers/teststorage/teststorage.go
index c2d30a8f848..f29da2f5981 100644
--- a/helper/testhelpers/teststorage/teststorage.go
+++ b/helper/testhelpers/teststorage/teststorage.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package teststorage
@@ -9,18 +9,15 @@ import (
 	"io/ioutil"
 	"math/rand"
 	"os"
+	"testing"
 	"time"
 
 	"github.com/hashicorp/go-hclog"
 	logicalKv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/audit"
-	auditFile "github.com/hashicorp/vault/builtin/audit/file"
-	auditSocket "github.com/hashicorp/vault/builtin/audit/socket"
-	auditSyslog "github.com/hashicorp/vault/builtin/audit/syslog"
 	logicalDb "github.com/hashicorp/vault/builtin/logical/database"
 	"github.com/hashicorp/vault/builtin/plugin"
 	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/physical/raft"
@@ -29,10 +26,9 @@ import (
 	physFile "github.com/hashicorp/vault/sdk/physical/file"
 	"github.com/hashicorp/vault/sdk/physical/inmem"
 	"github.com/hashicorp/vault/vault"
-	"github.com/mitchellh/go-testing-interface"
 )
 
-func MakeInmemBackend(t testing.T, logger hclog.Logger) *vault.PhysicalBackendBundle {
+func MakeInmemBackend(t testing.TB, logger hclog.Logger) *vault.PhysicalBackendBundle {
 	inm, err := inmem.NewTransactionalInmem(nil, logger)
 	if err != nil {
 		t.Fatal(err)
@@ -48,7 +44,7 @@ func MakeInmemBackend(t testing.T, logger hclog.Logger) *vault.PhysicalBackendBu
 	}
 }
 
-func MakeLatentInmemBackend(t testing.T, logger hclog.Logger) *vault.PhysicalBackendBundle {
+func MakeLatentInmemBackend(t testing.TB, logger hclog.Logger) *vault.PhysicalBackendBundle {
 	r := rand.New(rand.NewSource(time.Now().UnixNano()))
 	jitter := r.Intn(20)
 	latency := time.Duration(r.Intn(15)) * time.Millisecond
@@ -59,7 +55,7 @@ func MakeLatentInmemBackend(t testing.T, logger hclog.Logger) *vault.PhysicalBac
 	return pbb
 }
 
-func MakeInmemNonTransactionalBackend(t testing.T, logger hclog.Logger) *vault.PhysicalBackendBundle {
+func MakeInmemNonTransactionalBackend(t testing.TB, logger hclog.Logger) *vault.PhysicalBackendBundle {
 	inm, err := inmem.NewInmem(nil, logger)
 	if err != nil {
 		t.Fatal(err)
@@ -75,7 +71,7 @@ func MakeInmemNonTransactionalBackend(t testing.T, logger hclog.Logger) *vault.P
 	}
 }
 
-func MakeFileBackend(t testing.T, logger hclog.Logger) *vault.PhysicalBackendBundle {
+func MakeFileBackend(t testing.TB, logger hclog.Logger) *vault.PhysicalBackendBundle {
 	path, err := ioutil.TempDir("", "vault-integ-file-")
 	if err != nil {
 		t.Fatal(err)
@@ -105,7 +101,7 @@ func MakeFileBackend(t testing.T, logger hclog.Logger) *vault.PhysicalBackendBun
 	}
 }
 
-func MakeRaftBackend(t testing.T, coreIdx int, logger hclog.Logger, extraConf map[string]interface{}, bridge *raft.ClusterAddrBridge) *vault.PhysicalBackendBundle {
+func MakeRaftBackend(t testing.TB, coreIdx int, logger hclog.Logger, extraConf map[string]interface{}, bridge *raft.ClusterAddrBridge) *vault.PhysicalBackendBundle {
 	nodeID := fmt.Sprintf("core-%d", coreIdx)
 	raftDir, err := ioutil.TempDir("", "vault-raft-")
 	if err != nil {
@@ -159,8 +155,8 @@ func makeRaftBackend(logger hclog.Logger, nodeID, raftDir string, extraConf map[
 // RaftHAFactory returns a PhysicalBackendBundle with raft set as the HABackend
 // and the physical.Backend provided in PhysicalBackendBundler as the storage
 // backend.
-func RaftHAFactory(f PhysicalBackendBundler) func(t testing.T, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
-	return func(t testing.T, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
+func RaftHAFactory(f PhysicalBackendBundler) func(t testing.TB, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
+	return func(t testing.TB, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
 		// Call the factory func to create the storage backend
 		physFactory := SharedPhysicalFactory(f)
 		bundle := physFactory(t, coreIdx, logger, nil)
@@ -205,10 +201,10 @@ func RaftHAFactory(f PhysicalBackendBundler) func(t testing.T, coreIdx int, logg
 	}
 }
 
-type PhysicalBackendBundler func(t testing.T, logger hclog.Logger) *vault.PhysicalBackendBundle
+type PhysicalBackendBundler func(t testing.TB, logger hclog.Logger) *vault.PhysicalBackendBundle
 
-func SharedPhysicalFactory(f PhysicalBackendBundler) func(t testing.T, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
-	return func(t testing.T, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
+func SharedPhysicalFactory(f PhysicalBackendBundler) func(t testing.TB, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
+	return func(t testing.TB, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
 		if coreIdx == 0 {
 			return f(t, logger)
 		}
@@ -234,7 +230,7 @@ func FileBackendSetup(conf *vault.CoreConfig, opts *vault.TestClusterOptions) {
 	opts.PhysicalFactory = SharedPhysicalFactory(MakeFileBackend)
 }
 
-func RaftClusterJoinNodes(t testing.T, cluster *vault.TestCluster) {
+func RaftClusterJoinNodes(t testing.TB, cluster *vault.TestCluster) {
 	leader := cluster.Cores[0]
 
 	leaderInfos := []*raft.LeaderJoinInfo{
@@ -259,7 +255,7 @@ func RaftClusterJoinNodes(t testing.T, cluster *vault.TestCluster) {
 func RaftBackendSetup(conf *vault.CoreConfig, opts *vault.TestClusterOptions) {
 	opts.KeepStandbysSealed = true
 	var bridge *raft.ClusterAddrBridge
-	opts.PhysicalFactory = func(t testing.T, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
+	opts.PhysicalFactory = func(t testing.TB, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
 		// The same PhysicalFactory can be shared across multiple clusters.
 		// The coreIdx == 0 check ensures that each time a new cluster is setup,
 		// when setting up its first node we create a new ClusterAddrBridge.
@@ -273,7 +269,7 @@ func RaftBackendSetup(conf *vault.CoreConfig, opts *vault.TestClusterOptions) {
 		}
 		return bundle
 	}
-	opts.SetupFunc = func(t testing.T, c *vault.TestCluster) {
+	opts.SetupFunc = func(t testing.TB, c *vault.TestCluster) {
 		if opts.NumCores != 1 {
 			RaftClusterJoinNodes(t, c)
 			time.Sleep(15 * time.Second)
@@ -301,6 +297,10 @@ func ClusterSetup(conf *vault.CoreConfig, opts *vault.TestClusterOptions, setup
 	if opts != nil {
 		localOpts = *opts
 	}
+	if localOpts.HandlerFunc == nil {
+		localOpts.HandlerFunc = vaulthttp.Handler
+	}
+
 	if setup == nil {
 		setup = InmemBackendSetup
 	}
@@ -321,10 +321,10 @@ func ClusterSetup(conf *vault.CoreConfig, opts *vault.TestClusterOptions, setup
 	}
 	if localConf.AuditBackends == nil {
 		localConf.AuditBackends = map[string]audit.Factory{
-			"file":   auditFile.Factory,
-			"socket": auditSocket.Factory,
-			"syslog": auditSyslog.Factory,
-			"noop":   corehelpers.NoopAuditFactory(nil),
+			"file":   audit.NewFileBackend,
+			"socket": audit.NewSocketBackend,
+			"syslog": audit.NewSyslogBackend,
+			"noop":   audit.NoopAuditFactory(nil),
 		}
 	}
 
diff --git a/helper/testhelpers/teststorage/teststorage_reusable.go b/helper/testhelpers/teststorage/teststorage_reusable.go
index 89642cf61fd..160a3d64f79 100644
--- a/helper/testhelpers/teststorage/teststorage_reusable.go
+++ b/helper/testhelpers/teststorage/teststorage_reusable.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package teststorage
@@ -7,12 +7,12 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
+	"testing"
 
 	hclog "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/physical/raft"
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/vault"
-	"github.com/mitchellh/go-testing-interface"
 )
 
 // ReusableStorage is a physical backend that can be re-used across
@@ -29,7 +29,7 @@ type ReusableStorage struct {
 	// Cleanup should be called after a TestCluster is no longer
 	// needed -- generally in a defer, just before the call to
 	// cluster.Cleanup().
-	Cleanup func(t testing.T, cluster *vault.TestCluster)
+	Cleanup func(t testing.TB, cluster *vault.TestCluster)
 }
 
 // StorageCleanup is a function that should be called once -- at the very end
@@ -39,12 +39,12 @@ type StorageCleanup func()
 
 // MakeReusableStorage makes a physical backend that can be re-used across
 // multiple test clusters in sequence.
-func MakeReusableStorage(t testing.T, logger hclog.Logger, bundle *vault.PhysicalBackendBundle) (ReusableStorage, StorageCleanup) {
+func MakeReusableStorage(t testing.TB, logger hclog.Logger, bundle *vault.PhysicalBackendBundle) (ReusableStorage, StorageCleanup) {
 	storage := ReusableStorage{
 		IsRaft: false,
 
 		Setup: func(conf *vault.CoreConfig, opts *vault.TestClusterOptions) {
-			opts.PhysicalFactory = func(t testing.T, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
+			opts.PhysicalFactory = func(t testing.TB, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
 				if coreIdx == 0 {
 					// We intentionally do not clone the backend's Cleanup func,
 					// because we don't want it to be run until the entire test has
@@ -59,7 +59,7 @@ func MakeReusableStorage(t testing.T, logger hclog.Logger, bundle *vault.Physica
 		},
 
 		// No-op
-		Cleanup: func(t testing.T, cluster *vault.TestCluster) {},
+		Cleanup: func(t testing.TB, cluster *vault.TestCluster) {},
 	}
 
 	cleanup := func() {
@@ -73,7 +73,7 @@ func MakeReusableStorage(t testing.T, logger hclog.Logger, bundle *vault.Physica
 
 // MakeReusableRaftStorage makes a physical raft backend that can be re-used
 // across multiple test clusters in sequence.
-func MakeReusableRaftStorage(t testing.T, logger hclog.Logger, numCores int) (ReusableStorage, StorageCleanup) {
+func MakeReusableRaftStorage(t testing.TB, logger hclog.Logger, numCores int) (ReusableStorage, StorageCleanup) {
 	raftDirs := make([]string, numCores)
 	for i := 0; i < numCores; i++ {
 		raftDirs[i] = makeRaftDir(t)
@@ -85,13 +85,13 @@ func MakeReusableRaftStorage(t testing.T, logger hclog.Logger, numCores int) (Re
 		Setup: func(conf *vault.CoreConfig, opts *vault.TestClusterOptions) {
 			conf.DisablePerformanceStandby = true
 			opts.KeepStandbysSealed = true
-			opts.PhysicalFactory = func(t testing.T, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
+			opts.PhysicalFactory = func(t testing.TB, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
 				return makeReusableRaftBackend(t, coreIdx, logger, raftDirs[coreIdx], false)
 			}
 		},
 
 		// Close open files being used by raft.
-		Cleanup: func(t testing.T, cluster *vault.TestCluster) {
+		Cleanup: func(t testing.TB, cluster *vault.TestCluster) {
 			for i := 0; i < len(cluster.Cores); i++ {
 				CloseRaftStorage(t, cluster, i)
 			}
@@ -108,14 +108,14 @@ func MakeReusableRaftStorage(t testing.T, logger hclog.Logger, numCores int) (Re
 }
 
 // CloseRaftStorage closes open files being used by raft.
-func CloseRaftStorage(t testing.T, cluster *vault.TestCluster, idx int) {
+func CloseRaftStorage(t testing.TB, cluster *vault.TestCluster, idx int) {
 	raftStorage := cluster.Cores[idx].UnderlyingRawStorage.(*raft.RaftBackend)
 	if err := raftStorage.Close(); err != nil {
 		t.Fatal(err)
 	}
 }
 
-func MakeReusableRaftHAStorage(t testing.T, logger hclog.Logger, numCores int, bundle *vault.PhysicalBackendBundle) (ReusableStorage, StorageCleanup) {
+func MakeReusableRaftHAStorage(t testing.TB, logger hclog.Logger, numCores int, bundle *vault.PhysicalBackendBundle) (ReusableStorage, StorageCleanup) {
 	raftDirs := make([]string, numCores)
 	for i := 0; i < numCores; i++ {
 		raftDirs[i] = makeRaftDir(t)
@@ -125,7 +125,7 @@ func MakeReusableRaftHAStorage(t testing.T, logger hclog.Logger, numCores int, b
 		Setup: func(conf *vault.CoreConfig, opts *vault.TestClusterOptions) {
 			opts.InmemClusterLayers = true
 			opts.KeepStandbysSealed = true
-			opts.PhysicalFactory = func(t testing.T, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
+			opts.PhysicalFactory = func(t testing.TB, coreIdx int, logger hclog.Logger, conf map[string]interface{}) *vault.PhysicalBackendBundle {
 				haBundle := makeReusableRaftBackend(t, coreIdx, logger, raftDirs[coreIdx], true)
 
 				return &vault.PhysicalBackendBundle{
@@ -136,7 +136,7 @@ func MakeReusableRaftHAStorage(t testing.T, logger hclog.Logger, numCores int, b
 		},
 
 		// Close open files being used by raft.
-		Cleanup: func(t testing.T, cluster *vault.TestCluster) {
+		Cleanup: func(t testing.TB, cluster *vault.TestCluster) {
 			for _, core := range cluster.Cores {
 				raftStorage := core.UnderlyingHAStorage.(*raft.RaftBackend)
 				if err := raftStorage.Close(); err != nil {
@@ -159,7 +159,7 @@ func MakeReusableRaftHAStorage(t testing.T, logger hclog.Logger, numCores int, b
 	return storage, cleanup
 }
 
-func makeRaftDir(t testing.T) string {
+func makeRaftDir(t testing.TB) string {
 	raftDir, err := ioutil.TempDir("", "vault-raft-")
 	if err != nil {
 		t.Fatal(err)
@@ -168,7 +168,7 @@ func makeRaftDir(t testing.T) string {
 	return raftDir
 }
 
-func makeReusableRaftBackend(t testing.T, coreIdx int, logger hclog.Logger, raftDir string, ha bool) *vault.PhysicalBackendBundle {
+func makeReusableRaftBackend(t testing.TB, coreIdx int, logger hclog.Logger, raftDir string, ha bool) *vault.PhysicalBackendBundle {
 	nodeID := fmt.Sprintf("core-%d", coreIdx)
 	backend, err := makeRaftBackend(logger, nodeID, raftDir, nil, nil)
 	if err != nil {
diff --git a/helper/timeutil/timeutil.go b/helper/timeutil/timeutil.go
index 56a20615afd..f78beaa4db5 100644
--- a/helper/timeutil/timeutil.go
+++ b/helper/timeutil/timeutil.go
@@ -1,11 +1,13 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package timeutil
 
 import (
+	"crypto/rand"
 	"errors"
 	"fmt"
+	"math/big"
 	"strconv"
 	"strings"
 	"testing"
@@ -76,8 +78,8 @@ func IsCurrentMonth(t, compare time.Time) bool {
 	return queryMonthStart.Equal(thisMonthStart)
 }
 
-// GetMostRecentContinuousMonths finds the start time of the most
-// recent set of continguous months.
+// GetMostRecentContiguousMonths finds the start time of the most
+// recent set of continuous months.
 //
 // For example, if the most recent start time is Aug 15, then that range is just 1 month
 // If the recent start times are Aug 1 and July 1 and June 15, then that range is
@@ -179,3 +181,57 @@ func (_ DefaultClock) NewTicker(d time.Duration) *time.Ticker {
 func (_ DefaultClock) NewTimer(d time.Duration) *time.Timer {
 	return time.NewTimer(d)
 }
+
+// NormalizeToYear returns date normalized to the latest date
+// within one year of normal. Assumes the date argument is
+// some date before normal.
+func NormalizeToYear(date, normal time.Time) time.Time {
+	for date.AddDate(1, 0, 0).Compare(normal) <= 0 {
+		date = date.AddDate(1, 0, 0)
+	}
+	return date
+}
+
+// GetRandomTimeInMonth gets a random time in same month as input time
+func GetRandomTimeInMonth(inputTime time.Time) (time.Time, error) {
+	firstOfMonth := StartOfMonth(inputTime)
+	year, month, _ := firstOfMonth.Date()
+
+	// Get the last day of the target month
+	_, _, lastDayOfMonth := EndOfMonth(inputTime).Date()
+
+	// Generate random day, hour, minute, and second
+	maxDay := big.NewInt(int64(lastDayOfMonth))
+	randomDayPtr, err := rand.Int(rand.Reader, maxDay)
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	maxHour := big.NewInt(int64(24))
+	randomHourPtr, err := rand.Int(rand.Reader, maxHour)
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	maxMinute := big.NewInt(int64(60))
+	randomMinutePtr, err := rand.Int(rand.Reader, maxMinute)
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	maxSecond := big.NewInt(int64(60))
+	randomSecondPtr, err := rand.Int(rand.Reader, maxSecond)
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	randomDay := int(randomDayPtr.Int64() + 1) // +1 because rand.Int returns [0, n)
+	randomHour := int(randomHourPtr.Int64())
+	randomMinute := int(randomMinutePtr.Int64())
+	randomSecond := int(randomSecondPtr.Int64())
+
+	// Create the random time
+	randomTime := time.Date(year, month, randomDay, randomHour, randomMinute, randomSecond, 0, time.UTC)
+
+	return randomTime, nil
+}
diff --git a/helper/timeutil/timeutil_test.go b/helper/timeutil/timeutil_test.go
index df14a6fd177..351daa8ae77 100644
--- a/helper/timeutil/timeutil_test.go
+++ b/helper/timeutil/timeutil_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package timeutil
@@ -7,6 +7,8 @@ import (
 	"reflect"
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/require"
 )
 
 func TestTimeutil_StartOfPreviousMonth(t *testing.T) {
@@ -367,3 +369,129 @@ func TestTimeUtil_ParseTimeFromPath(t *testing.T) {
 		}
 	}
 }
+
+// TestTimeUtil_NormalizeToYear tests NormalizeToYear function which returns the normalized input date wrt to the normal.
+func TestTimeUtil_NormalizeToYear(t *testing.T) {
+	testCases := []struct {
+		inputDate              time.Time
+		normalDate             time.Time
+		expectedNormalizedDate time.Time
+	}{
+		{
+			inputDate:              time.Date(2024, 9, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2024, 10, 1, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2024, 9, 29, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2024, 9, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2025, 9, 29, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2025, 9, 29, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2024, 9, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2025, 10, 1, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2025, 9, 29, 0, 0, 0, 0, time.UTC),
+		},
+		// inputDate more than 2 years prior to normal date
+		{
+			inputDate:              time.Date(2022, 9, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2024, 6, 15, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2023, 9, 29, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2022, 9, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2024, 9, 28, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2023, 9, 29, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2022, 9, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2024, 9, 29, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2024, 9, 29, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2022, 9, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2024, 9, 30, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2024, 9, 29, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2020, 9, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2024, 12, 1, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2024, 9, 29, 0, 0, 0, 0, time.UTC),
+		},
+		// leap year test cases
+		{
+			inputDate:              time.Date(2020, 9, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2024, 9, 28, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2023, 9, 29, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2024, 2, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2025, 2, 28, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2024, 2, 29, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2024, 2, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2025, 3, 1, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2025, 3, 1, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2024, 2, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2025, 3, 2, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2025, 3, 1, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2024, 2, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2028, 2, 28, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2027, 3, 1, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2024, 2, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2028, 2, 29, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2027, 3, 1, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			inputDate:              time.Date(2024, 2, 29, 0, 0, 0, 0, time.UTC),
+			normalDate:             time.Date(2028, 3, 1, 0, 0, 0, 0, time.UTC),
+			expectedNormalizedDate: time.Date(2028, 3, 1, 0, 0, 0, 0, time.UTC),
+		},
+	}
+	for _, tc := range testCases {
+		normalizedDate := NormalizeToYear(tc.inputDate, tc.normalDate)
+		require.Equal(t, tc.expectedNormalizedDate, normalizedDate)
+	}
+}
+
+// Test_GetRandomTimeInMonth verifies that the random time generated is in the same month of input time.
+func Test_GetRandomTimeInMonth(t *testing.T) {
+	currYear, _, _ := time.Now().Date()
+	middleOfMonth := time.Date(currYear, 8, 15, 1, 2, 3, 0, time.UTC)
+
+	cases := []struct {
+		name      string
+		inputTime time.Time
+	}{
+		{
+			name:      "input time is in the start of a month",
+			inputTime: StartOfMonth(time.Now()),
+		},
+		{
+			name:      "input time is in the middle of a month",
+			inputTime: middleOfMonth,
+		},
+		{
+			name:      "input time is in the last of a month ",
+			inputTime: EndOfMonth(time.Now()),
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			randomTime, err := GetRandomTimeInMonth(tc.inputTime)
+			require.NoError(t, err)
+			startOfMonth := StartOfMonth(tc.inputTime)
+			endOfMonth := EndOfMonth(tc.inputTime)
+			if !((randomTime.After(startOfMonth) || randomTime.Equal(startOfMonth)) && (randomTime.Before(endOfMonth) || randomTime.Equal(endOfMonth))) {
+				t.Fatalf("random time %v is not in the same month as input time %v", randomTime.UTC(), tc.inputTime.UTC())
+			}
+		})
+	}
+}
diff --git a/helper/trace/debug_trace.go b/helper/trace/debug_trace.go
new file mode 100644
index 00000000000..4cc98935697
--- /dev/null
+++ b/helper/trace/debug_trace.go
@@ -0,0 +1,63 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package trace
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime/trace"
+	"time"
+)
+
+func StartDebugTrace(dir string, filePrefix string) (file string, stop func() error, err error) {
+	dirMustExist := true
+	if dir == "" {
+		dirMustExist = false // if a dir is provided it must exist, otherwise we'll create a default one
+		dir = filepath.Join(os.TempDir(), "vault-traces")
+	}
+
+	d, err := os.Stat(dir)
+	if err != nil && !os.IsNotExist(err) {
+		return "", nil, fmt.Errorf("failed to stat trace directory %q: %s", dir, err)
+	}
+
+	if os.IsNotExist(err) && dirMustExist {
+		return "", nil, fmt.Errorf("trace directory %q does not exist", dir)
+	}
+
+	if !os.IsNotExist(err) && !d.IsDir() {
+		return "", nil, fmt.Errorf("trace directory %q is not a directory", dir)
+	}
+
+	if os.IsNotExist(err) {
+		if err := os.Mkdir(dir, 0o700); err != nil {
+			return "", nil, fmt.Errorf("failed to create trace directory %q: %s", dir, err)
+		}
+	}
+
+	// would prefer a more human readable time reference in the file name but the column
+	// character can cause problems in filenames
+	fileName := fmt.Sprintf("%s-%d.trace", filePrefix, time.Now().Unix())
+	traceFile, err := filepath.Abs(filepath.Join(dir, fileName))
+	if err != nil {
+		return "", nil, fmt.Errorf("failed to get absolute path for trace file: %s", err)
+	}
+	f, err := os.Create(traceFile)
+	if err != nil {
+		return "", nil, fmt.Errorf("failed to create trace file %q: %s", traceFile, err)
+	}
+
+	if err := trace.Start(f); err != nil {
+		f.Close()
+		return "", nil, fmt.Errorf("failed to start trace: %s", err)
+	}
+
+	stop = func() error {
+		trace.Stop()
+		return f.Close()
+	}
+
+	return f.Name(), stop, nil
+}
diff --git a/helper/trace/debug_trace_test.go b/helper/trace/debug_trace_test.go
new file mode 100644
index 00000000000..6828f890a6e
--- /dev/null
+++ b/helper/trace/debug_trace_test.go
@@ -0,0 +1,111 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package trace
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestStartDebugTrace tests the debug trace functionality creating real
+// files and traces.
+func TestStartDebugTrace(t *testing.T) {
+	t.Run("error_on_non_existent_dir", func(t *testing.T) {
+		_, _, err := StartDebugTrace("non-existent-dir", "filePrefix")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "does not exist")
+	})
+
+	t.Run("error_on_non_dir", func(t *testing.T) {
+		f, err := os.CreateTemp("", "")
+		require.NoError(t, err)
+		require.NoError(t, f.Close())
+		_, _, err = StartDebugTrace(f.Name(), "")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "is not a directory")
+	})
+
+	t.Run("error_on_failed_to_create_trace_file", func(t *testing.T) {
+		noWriteFolder := filepath.Join(os.TempDir(), "no-write-permissions")
+		// create folder without write permission
+		err := os.Mkdir(noWriteFolder, 0o000)
+		t.Cleanup(func() {
+			os.RemoveAll(noWriteFolder)
+		})
+		require.NoError(t, err)
+		_, _, err = StartDebugTrace(noWriteFolder, "")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "failed to create trace file")
+	})
+
+	t.Run("error_trying_to_start_second_concurrent_trace", func(t *testing.T) {
+		dir, err := os.MkdirTemp("", "")
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			os.RemoveAll(dir)
+		})
+		_, stop, err := StartDebugTrace(dir, "filePrefix")
+		require.NoError(t, err)
+		_, stopNil, err := StartDebugTrace(dir, "filePrefix")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "failed to start trace")
+		require.NoError(t, stop())
+		require.Nil(t, stopNil)
+	})
+
+	t.Run("error_when_stating_tmp_dir_with_restricted_permissions", func(t *testing.T) {
+		// this test relies on setting TMPDIR so skip it if we're not on a Unix system
+		if runtime.GOOS == "windows" {
+			t.Skip("skipping test on Windows")
+		}
+
+		tmpMissingPermissions := filepath.Join(t.TempDir(), "missing_permissions")
+		err := os.Mkdir(tmpMissingPermissions, 0o000)
+		require.NoError(t, err)
+		t.Setenv("TMPDIR", tmpMissingPermissions)
+		_, _, err = StartDebugTrace("", "filePrefix")
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "failed to stat trace directory")
+	})
+
+	t.Run("successful_trace_generates_non_empty_file", func(t *testing.T) {
+		dir, err := os.MkdirTemp("", "")
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			os.RemoveAll(dir)
+		})
+		file, stop, err := StartDebugTrace(dir, "filePrefix")
+		require.NoError(t, err)
+		require.NoError(t, stop())
+		f, err := os.Stat(file)
+		require.NoError(t, err)
+		require.Greater(t, f.Size(), int64(0))
+	})
+
+	t.Run("successful_creation_of_tmp_dir", func(t *testing.T) {
+		os.RemoveAll(filepath.Join(os.TempDir(), "vault-traces"))
+		file, stop, err := StartDebugTrace("", "filePrefix")
+		require.NoError(t, err)
+		require.NoError(t, stop())
+		require.Contains(t, file, filepath.Join(os.TempDir(), "vault-traces", "filePrefix"))
+		f, err := os.Stat(file)
+		require.NoError(t, err)
+		require.Greater(t, f.Size(), int64(0))
+	})
+
+	t.Run("successful_trace_with_existing_tmp_dir", func(t *testing.T) {
+		os.Mkdir(filepath.Join(os.TempDir(), "vault-traces"), 0o700)
+		file, stop, err := StartDebugTrace("", "filePrefix")
+		require.NoError(t, err)
+		require.NoError(t, stop())
+		require.Contains(t, file, filepath.Join(os.TempDir(), "vault-traces", "filePrefix"))
+		f, err := os.Stat(file)
+		require.NoError(t, err)
+		require.Greater(t, f.Size(), int64(0))
+	})
+}
diff --git a/helper/useragent/useragent.go b/helper/useragent/useragent.go
index 0becfe9e9fd..c2070026d29 100644
--- a/helper/useragent/useragent.go
+++ b/helper/useragent/useragent.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package useragent
diff --git a/helper/useragent/useragent_test.go b/helper/useragent/useragent_test.go
index f58363a8e91..152a558ecc2 100644
--- a/helper/useragent/useragent_test.go
+++ b/helper/useragent/useragent_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package useragent
diff --git a/helper/versions/version.go b/helper/versions/version.go
index 590e25ec0ad..7a38a3d4b1b 100644
--- a/helper/versions/version.go
+++ b/helper/versions/version.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package versions
diff --git a/helper/versions/version_test.go b/helper/versions/version_test.go
index c6d31f4dc00..5bfa92ec330 100644
--- a/helper/versions/version_test.go
+++ b/helper/versions/version_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package versions
diff --git a/http/assets.go b/http/assets.go
index f1f080c2728..9c636a3a4cd 100644
--- a/http/assets.go
+++ b/http/assets.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build ui
diff --git a/http/assets_stub.go b/http/assets_stub.go
index de29ee97210..4322f13fe4b 100644
--- a/http/assets_stub.go
+++ b/http/assets_stub.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !ui
diff --git a/http/auth_token_test.go b/http/auth_token_test.go
index 37903a41858..32f5aa5e17f 100644
--- a/http/auth_token_test.go
+++ b/http/auth_token_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -6,9 +6,40 @@ package http
 import (
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/sdk/helper/logging"
+	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	rootLeasePolicies = `
+path "sys/internal/ui/*" {
+capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "auth/token/*" {
+capabilities = ["create", "update", "read", "list"]
+}
+
+path "kv/foo*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+`
+
+	dummy = `
+path "/ns1/sys/leases/*" {
+	capabilities = ["sudo", "create", "read", "update", "delete", "list"]
+}
+
+path "/ns1/auth/token/*" {
+	capabilities = ["sudo", "create", "read", "update", "delete", "list"]
+}
+`
 )
 
 func TestAuthTokenCreate(t *testing.T) {
@@ -207,3 +238,106 @@ func TestAuthTokenRenew(t *testing.T) {
 		t.Error("expected lease to be renewable")
 	}
 }
+
+// TestToken_InvalidTokenError checks that an InvalidToken error is only returned
+// for tokens that have (1) exceeded the token TTL and (2) exceeded the number of uses
+func TestToken_InvalidTokenError(t *testing.T) {
+	coreConfig := &vault.CoreConfig{
+		DisableMlock: true,
+		DisableCache: true,
+		Logger:       logging.NewVaultLogger(hclog.Trace),
+	}
+
+	// Init new test cluster
+	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
+		HandlerFunc: Handler,
+	})
+
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	cores := cluster.Cores
+	vault.TestWaitActive(t, cores[0].Core)
+
+	client := cores[0].Client
+
+	// Add policy
+	if err := client.Sys().PutPolicy("root-lease-policy", rootLeasePolicies); err != nil {
+		t.Fatal(err)
+	}
+	// Add a dummy policy
+	if err := client.Sys().PutPolicy("dummy", dummy); err != nil {
+		t.Fatal(err)
+	}
+
+	rootToken := client.Token()
+
+	// Enable kv secrets and mount initial secrets
+	err := client.Sys().Mount("kv", &api.MountInput{Type: "kv"})
+	require.NoError(t, err)
+
+	writeSecretsToMount(t, client, "kv/foo", map[string]interface{}{
+		"user":     "admin",
+		"password": "password",
+	})
+
+	// Create a token that has a TTL of 5s
+	tokenCreateRequest := &api.TokenCreateRequest{
+		Policies: []string{"root-lease-policy"},
+		TTL:      "5s",
+	}
+	secret, err := client.Auth().Token().CreateOrphan(tokenCreateRequest)
+	token := secret.Auth.ClientToken
+	client.SetToken(token)
+
+	// Verify that token works to read from kv mount
+	_, err = client.Logical().Read("kv/foo")
+	require.NoError(t, err)
+
+	time.Sleep(time.Second * 5)
+
+	// Verify that token is expired and shows an "invalid token" error
+	_, err = client.Logical().Read("kv/foo")
+	require.ErrorContains(t, err, logical.ErrInvalidToken.Error())
+	require.ErrorContains(t, err, logical.ErrPermissionDenied.Error())
+
+	// Create a second approle token with a token use limit
+	client.SetToken(rootToken)
+	tokenCreateRequest = &api.TokenCreateRequest{
+		Policies: []string{"root-lease-policy"},
+		NumUses:  5,
+	}
+
+	secret, err = client.Auth().Token().CreateOrphan(tokenCreateRequest)
+	token = secret.Auth.ClientToken
+	client.SetToken(token)
+
+	for i := 0; i < 5; i++ {
+		_, err = client.Logical().Read("kv/foo")
+		require.NoError(t, err)
+	}
+	// Verify that the number of uses is exceeded so the "invalid token" error is displayed
+	_, err = client.Logical().Read("kv/foo")
+	require.ErrorContains(t, err, logical.ErrInvalidToken.Error())
+	require.ErrorContains(t, err, logical.ErrPermissionDenied.Error())
+
+	// Create a third approle token that will have incorrect policy access to the subsequent request
+	client.SetToken(rootToken)
+	tokenCreateRequest = &api.TokenCreateRequest{
+		Policies: []string{"dummy"},
+	}
+
+	secret, err = client.Auth().Token().CreateOrphan(tokenCreateRequest)
+	token = secret.Auth.ClientToken
+	client.SetToken(token)
+
+	// Incorrect policy access should only return an ErrPermissionDenied error
+	_, err = client.Logical().Read("kv/foo")
+	require.ErrorContains(t, err, logical.ErrPermissionDenied.Error())
+	require.NotContains(t, err.Error(), logical.ErrInvalidToken)
+}
+
+func writeSecretsToMount(t *testing.T, client *api.Client, mountPath string, data map[string]interface{}) {
+	_, err := client.Logical().Write(mountPath, data)
+	require.NoError(t, err)
+}
diff --git a/http/cors.go b/http/cors.go
index 2689a007dbe..c166a1c455b 100644
--- a/http/cors.go
+++ b/http/cors.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/hashicorp/go-secure-stdlib/strutil"
+	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 )
 
@@ -49,6 +50,7 @@ func wrapCORSHandler(h http.Handler, core *vault.Core) http.Handler {
 		}
 
 		if req.Method == http.MethodOptions && !strutil.StrListContains(allowedMethods, requestMethod) {
+			defer logical.IncrementResponseStatusCodeMetric(http.StatusMethodNotAllowed)
 			w.WriteHeader(http.StatusMethodNotAllowed)
 			return
 		}
diff --git a/http/custom_header_test.go b/http/custom_header_test.go
index 36227cc781d..d0f90387e19 100644
--- a/http/custom_header_test.go
+++ b/http/custom_header_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/events_stubs_oss.go b/http/events_stubs_oss.go
index c1a4a673598..801b4c226d9 100644
--- a/http/events_stubs_oss.go
+++ b/http/events_stubs_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/http/forwarded_for_test.go b/http/forwarded_for_test.go
index c0409bab30f..e463b15699d 100644
--- a/http/forwarded_for_test.go
+++ b/http/forwarded_for_test.go
@@ -1,17 +1,20 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
 
 import (
 	"bytes"
+	"encoding/base64"
 	"net/http"
+	"net/url"
 	"strings"
 	"testing"
 
 	sockaddr "github.com/hashicorp/go-sockaddr"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
 )
 
 func getListenerConfigForMarshalerTest(addr sockaddr.IPAddr) *configutil.Listener {
@@ -255,4 +258,217 @@ func TestHandler_XForwardedFor(t *testing.T) {
 			t.Fatalf("bad body: %s", buf.String())
 		}
 	})
+
+	// Next: test an invalid certificate being sent
+	t.Run("reject_bad_cert_in_header", func(t *testing.T) {
+		t.Parallel()
+		testHandler := func(props *vault.HandlerProperties) http.Handler {
+			origHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+				w.Write([]byte(r.RemoteAddr))
+			})
+			listenerConfig := getListenerConfigForMarshalerTest(goodAddr)
+			listenerConfig.XForwardedForClientCertHeader = "X-Forwarded-Tls-Client-Cert"
+			listenerConfig.XForwardedForClientCertHeaderDecoders = "URL,BASE64"
+			return WrapForwardedForHandler(origHandler, listenerConfig)
+		}
+
+		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+			HandlerFunc: HandlerFunc(testHandler),
+		})
+		cluster.Start()
+		defer cluster.Cleanup()
+		client := cluster.Cores[0].Client
+
+		req := client.NewRequest("GET", "/")
+		req.Headers = make(http.Header)
+		req.Headers.Set("x-forwarded-for", "5.6.7.8")
+		req.Headers.Set("x-forwarded-tls-client-cert", `BAD_TEXTMIIDtTCCAp2gAwIBAgIUf%2BjhKTFBnqSs34II0WS1L4QsbbAwDQYJKoZIhvcNAQEL%0ABQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wHhcNMTYwMjI5MDIyNzQxWhcNMjUw%0AMTA1MTAyODExWjAbMRkwFwYDVQQDExBjZXJ0LmV4YW1wbGUuY29tMIIBIjANBgkq%0AhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsZx0Svr82YJpFpIy4fJNW5fKA6B8mhxS%0ATRAVnygAftetT8puHflY0ss7Y6X2OXjsU0PRn%2B1PswtivhKi%2BeLtgWkUF9cFYFGn%0ASgMld6ZWRhNheZhA6ZfQmeM%2FBF2pa5HK2SDF36ljgjL9T%2BnWrru2Uv0BCoHzLAmi%0AYYMiIWplidMmMO5NTRG3k%2B3AN0TkfakB6JVzjLGhTcXdOcVEMXkeQVqJMAuGouU5%0AdonyqtnaHuIJGuUdy54YDnX86txhOQhAv6r7dHXzZxS4pmLvw8UI1rsSf%2FGLcUVG%0AB%2B5%2BAAGF5iuHC3N2DTl4xz3FcN4Cb4w9pbaQ7%2BmCzz%2BanqiJfyr2nwIDAQABo4H1%0AMIHyMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUm%2B%2Be%0AHpyM3p708bgZJuRYEdX1o%2BUwHwYDVR0jBBgwFoAUncSzT%2F6HMexyuiU9%2F7EgHu%2Bo%0Ak5swOwYIKwYBBQUHAQEELzAtMCsGCCsGAQUFBzAChh9odHRwOi8vMTI3LjAuMC4x%0AOjgyMDAvdjEvcGtpL2NhMCEGA1UdEQQaMBiCEGNlcnQuZXhhbXBsZS5jb22HBH8A%0AAAEwMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovLzEyNy4wLjAuMTo4MjAwL3YxL3Br%0AaS9jcmwwDQYJKoZIhvcNAQELBQADggEBABsuvmPSNjjKTVN6itWzdQy%2BSgMIrwfs%0AX1Yb9Lefkkwmp9ovKFNQxa4DucuCuzXcQrbKwWTfHGgR8ct4rf30xCRoA7dbQWq4%0AaYqNKFWrRaBRAaaYZ%2FO1ApRTOrXqRx9Eqr0H1BXLsoAq%2BmWassL8sf6siae%2BCpwA%0AKqBko5G0dNXq5T4i2LQbmoQSVetIrCJEeMrU%2BidkuqfV2h1BQKgSEhFDABjFdTCN%0AQDAHsEHsi2M4%2FjRW9fqEuhHSDfl2n7tkFUI8wTHUUCl7gXwweJ4qtaSXIwKXYzNj%0AxqKHA8Purc1Yfybz4iE1JCROi9fInKlzr5xABq8nb9Qc%2FJ9DIQM%2BXmk%3D`)
+		resp, err := client.RawRequest(req)
+		if err == nil {
+			t.Fatal("expected error")
+		}
+		defer resp.Body.Close()
+		buf := bytes.NewBuffer(nil)
+		buf.ReadFrom(resp.Body)
+		if !strings.Contains(buf.String(), "failed to base64 decode the client certificate: ") {
+			t.Fatalf("bad body: %v", buf.String())
+		}
+	})
+
+	// Next: test a valid (unverified) certificate being sent
+	t.Run("pass_cert", func(t *testing.T) {
+		t.Parallel()
+		testHandler := func(props *vault.HandlerProperties) http.Handler {
+			origHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+				w.Write([]byte(base64.StdEncoding.EncodeToString(r.TLS.PeerCertificates[0].Raw)))
+			})
+			listenerConfig := getListenerConfigForMarshalerTest(goodAddr)
+			listenerConfig.XForwardedForClientCertHeader = "X-Forwarded-Tls-Client-Cert"
+			listenerConfig.XForwardedForClientCertHeaderDecoders = "URL,BASE64"
+			return WrapForwardedForHandler(origHandler, listenerConfig)
+		}
+
+		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+			HandlerFunc: HandlerFunc(testHandler),
+		})
+		cluster.Start()
+		defer cluster.Cleanup()
+		client := cluster.Cores[0].Client
+
+		req := client.NewRequest("GET", "/")
+		req.Headers = make(http.Header)
+		req.Headers.Set("x-forwarded-for", "5.6.7.8")
+		testcertificate := `MIIDtTCCAp2gAwIBAgIUf%2BjhKTFBnqSs34II0WS1L4QsbbAwDQYJKoZIhvcNAQEL%0ABQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wHhcNMTYwMjI5MDIyNzQxWhcNMjUw%0AMTA1MTAyODExWjAbMRkwFwYDVQQDExBjZXJ0LmV4YW1wbGUuY29tMIIBIjANBgkq%0AhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsZx0Svr82YJpFpIy4fJNW5fKA6B8mhxS%0ATRAVnygAftetT8puHflY0ss7Y6X2OXjsU0PRn%2B1PswtivhKi%2BeLtgWkUF9cFYFGn%0ASgMld6ZWRhNheZhA6ZfQmeM%2FBF2pa5HK2SDF36ljgjL9T%2BnWrru2Uv0BCoHzLAmi%0AYYMiIWplidMmMO5NTRG3k%2B3AN0TkfakB6JVzjLGhTcXdOcVEMXkeQVqJMAuGouU5%0AdonyqtnaHuIJGuUdy54YDnX86txhOQhAv6r7dHXzZxS4pmLvw8UI1rsSf%2FGLcUVG%0AB%2B5%2BAAGF5iuHC3N2DTl4xz3FcN4Cb4w9pbaQ7%2BmCzz%2BanqiJfyr2nwIDAQABo4H1%0AMIHyMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUm%2B%2Be%0AHpyM3p708bgZJuRYEdX1o%2BUwHwYDVR0jBBgwFoAUncSzT%2F6HMexyuiU9%2F7EgHu%2Bo%0Ak5swOwYIKwYBBQUHAQEELzAtMCsGCCsGAQUFBzAChh9odHRwOi8vMTI3LjAuMC4x%0AOjgyMDAvdjEvcGtpL2NhMCEGA1UdEQQaMBiCEGNlcnQuZXhhbXBsZS5jb22HBH8A%0AAAEwMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovLzEyNy4wLjAuMTo4MjAwL3YxL3Br%0AaS9jcmwwDQYJKoZIhvcNAQELBQADggEBABsuvmPSNjjKTVN6itWzdQy%2BSgMIrwfs%0AX1Yb9Lefkkwmp9ovKFNQxa4DucuCuzXcQrbKwWTfHGgR8ct4rf30xCRoA7dbQWq4%0AaYqNKFWrRaBRAaaYZ%2FO1ApRTOrXqRx9Eqr0H1BXLsoAq%2BmWassL8sf6siae%2BCpwA%0AKqBko5G0dNXq5T4i2LQbmoQSVetIrCJEeMrU%2BidkuqfV2h1BQKgSEhFDABjFdTCN%0AQDAHsEHsi2M4%2FjRW9fqEuhHSDfl2n7tkFUI8wTHUUCl7gXwweJ4qtaSXIwKXYzNj%0AxqKHA8Purc1Yfybz4iE1JCROi9fInKlzr5xABq8nb9Qc%2FJ9DIQM%2BXmk%3D`
+		req.Headers.Set("x-forwarded-tls-client-cert", testcertificate)
+		resp, err := client.RawRequest(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		buf := bytes.NewBuffer(nil)
+		buf.ReadFrom(resp.Body)
+		testcertificate, _ = url.QueryUnescape(testcertificate)
+		if !strings.Contains(buf.String(), strings.ReplaceAll(testcertificate, "\n", "")) {
+			t.Fatalf("bad body: %v vs %v", buf.String(), testcertificate)
+		}
+	})
+
+	// Test RFC 9440/8941 Structured Headers "byte sequence" format
+	t.Run("pass_cert_rfc9440_format", func(t *testing.T) {
+		t.Parallel()
+		testHandler := func(props *vault.HandlerProperties) http.Handler {
+			origHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+				w.Write([]byte(base64.StdEncoding.EncodeToString(r.TLS.PeerCertificates[0].Raw)))
+			})
+			listenerConfig := getListenerConfigForMarshalerTest(goodAddr)
+			listenerConfig.XForwardedForClientCertHeader = "X-Forwarded-Tls-Client-Cert"
+			listenerConfig.XForwardedForClientCertHeaderDecoders = "BASE64"
+			return WrapForwardedForHandler(origHandler, listenerConfig)
+		}
+
+		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+			HandlerFunc: HandlerFunc(testHandler),
+		})
+		cluster.Start()
+		defer cluster.Cleanup()
+		client := cluster.Cores[0].Client
+
+		req := client.NewRequest("GET", "/")
+		req.Headers = make(http.Header)
+		req.Headers.Set("x-forwarded-for", "5.6.7.8")
+		// Test certificate in RFC 9440/8941 format with leading and trailing colons
+		testcertificate := `:MIIDtTCCAp2gAwIBAgIUf+jhKTFBnqSs34II0WS1L4QsbbAwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wHhcNMTYwMjI5MDIyNzQxWhcNMjUwMTA1MTAyODExWjAbMRkwFwYDVQQDExBjZXJ0LmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsZx0Svr82YJpFpIy4fJNW5fKA6B8mhxSTRAVnygAftetT8puHflY0ss7Y6X2OXjsU0PRn+1PswtivhKi+eLtgWkUF9cFYFGnSgMld6ZWRhNheZhA6ZfQmeM/BF2pa5HK2SDF36ljgjL9T+nWrru2Uv0BCoHzLAmiYYMiIWplidMmMO5NTRG3k+3AN0TkfakB6JVzjLGhTcXdOcVEMXkeQVqJMAuGouU5donyqtnaHuIJGuUdy54YDnX86txhOQhAv6r7dHXzZxS4pmLvw8UI1rsSf/GLcUVGB+5+AAGF5iuHC3N2DTl4xz3FcN4Cb4w9pbaQ7+mCzz+anqiJfyr2nwIDAQABo4H1MIHyMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUm++eHpyM3p708bgZJuRYEdX1o+UwHwYDVR0jBBgwFoAUncSzT/6HMexyuiU9/7EgHu+ok5swOwYIKwYBBQUHAQEELzAtMCsGCCsGAQUFBzAChh9odHRwOi8vMTI3LjAuMC4xOjgyMDAvdjEvcGtpL2NhMCEGA1UdEQQaMBiCEGNlcnQuZXhhbXBsZS5jb22HBH8AAAEwMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovLzEyNy4wLjAuMTo4MjAwL3YxL3BraS9jcmwwDQYJKoZIhvcNAQELBQADggEBABsuvmPSNjjKTVN6itWzdQy+SgMIrwfsX1Yb9Lefkkwmp9ovKFNQxa4DucuCuzXcQrbKwWTfHGgR8ct4rf30xCRoA7dbQWq4aYqNKFWrRaBRAaaYZ/O1ApRTOrXqRx9Eqr0H1BXLsoAq+mWassL8sf6siae+CpwAKqBko5G0dNXq5T4i2LQbmoQSVetIrCJEeMrU+idkuqfV2h1BQKgSEhFDABjFdTCNQDAHsEHsi2M4/jRW9fqEuhHSDfl2n7tkFUI8wTHUUCl7gXwweJ4qtaSXIwKXYzNjxqKHA8Purc1Yfybz4iE1JCROi9fInKlzr5xABq8nb9Qc/J9DIQM+Xmk=:`
+		req.Headers.Set("x-forwarded-tls-client-cert", testcertificate)
+		resp, err := client.RawRequest(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		buf := bytes.NewBuffer(nil)
+		buf.ReadFrom(resp.Body)
+		// Strip the colons for comparison
+		expectedCert := testcertificate[1 : len(testcertificate)-1]
+		if !strings.Contains(buf.String(), expectedCert) {
+			t.Fatalf("bad body: %v vs %v", buf.String(), expectedCert)
+		}
+	})
+
+	// Test that regular base64 without colons still works for compatibility
+	t.Run("pass_cert_regular_base64", func(t *testing.T) {
+		t.Parallel()
+		testHandler := func(props *vault.HandlerProperties) http.Handler {
+			origHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+				w.Write([]byte(base64.StdEncoding.EncodeToString(r.TLS.PeerCertificates[0].Raw)))
+			})
+			listenerConfig := getListenerConfigForMarshalerTest(goodAddr)
+			listenerConfig.XForwardedForClientCertHeader = "X-Forwarded-Tls-Client-Cert"
+			listenerConfig.XForwardedForClientCertHeaderDecoders = "BASE64"
+			return WrapForwardedForHandler(origHandler, listenerConfig)
+		}
+
+		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+			HandlerFunc: HandlerFunc(testHandler),
+		})
+		cluster.Start()
+		defer cluster.Cleanup()
+		client := cluster.Cores[0].Client
+
+		req := client.NewRequest("GET", "/")
+		req.Headers = make(http.Header)
+		req.Headers.Set("x-forwarded-for", "5.6.7.8")
+		// Regular base64 without URL encoding and without colons
+		testcertificate := `MIIDtTCCAp2gAwIBAgIUf+jhKTFBnqSs34II0WS1L4QsbbAwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wHhcNMTYwMjI5MDIyNzQxWhcNMjUwMTA1MTAyODExWjAbMRkwFwYDVQQDExBjZXJ0LmV4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsZx0Svr82YJpFpIy4fJNW5fKA6B8mhxSTRAVnygAftetT8puHflY0ss7Y6X2OXjsU0PRn+1PswtivhKi+eLtgWkUF9cFYFGnSgMld6ZWRhNheZhA6ZfQmeM/BF2pa5HK2SDF36ljgjL9T+nWrru2Uv0BCoHzLAmiYYMiIWplidMmMO5NTRG3k+3AN0TkfakB6JVzjLGhTcXdOcVEMXkeQVqJMAuGouU5donyqtnaHuIJGuUdy54YDnX86txhOQhAv6r7dHXzZxS4pmLvw8UI1rsSf/GLcUVGB+5+AAGF5iuHC3N2DTl4xz3FcN4Cb4w9pbaQ7+mCzz+anqiJfyr2nwIDAQABo4H1MIHyMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUm++eHpyM3p708bgZJuRYEdX1o+UwHwYDVR0jBBgwFoAUncSzT/6HMexyuiU9/7EgHu+ok5swOwYIKwYBBQUHAQEELzAtMCsGCCsGAQUFBzAChh9odHRwOi8vMTI3LjAuMC4xOjgyMDAvdjEvcGtpL2NhMCEGA1UdEQQaMBiCEGNlcnQuZXhhbXBsZS5jb22HBH8AAAEwMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovLzEyNy4wLjAuMTo4MjAwL3YxL3BraS9jcmwwDQYJKoZIhvcNAQELBQADggEBABsuvmPSNjjKTVN6itWzdQy+SgMIrwfsX1Yb9Lefkkwmp9ovKFNQxa4DucuCuzXcQrbKwWTfHGgR8ct4rf30xCRoA7dbQWq4aYqNKFWrRaBRAaaYZ/O1ApRTOrXqRx9Eqr0H1BXLsoAq+mWassL8sf6siae+CpwAKqBko5G0dNXq5T4i2LQbmoQSVetIrCJEeMrU+idkuqfV2h1BQKgSEhFDABjFdTCNQDAHsEHsi2M4/jRW9fqEuhHSDfl2n7tkFUI8wTHUUCl7gXwweJ4qtaSXIwKXYzNjxqKHA8Purc1Yfybz4iE1JCROi9fInKlzr5xABq8nb9Qc/J9DIQM+Xmk=`
+		req.Headers.Set("x-forwarded-tls-client-cert", testcertificate)
+		resp, err := client.RawRequest(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		buf := bytes.NewBuffer(nil)
+		buf.ReadFrom(resp.Body)
+		if !strings.Contains(buf.String(), testcertificate) {
+			t.Fatalf("bad body: %v vs %v", buf.String(), testcertificate)
+		}
+	})
+
+	t.Run("reject invalid IP", func(t *testing.T) {
+		t.Parallel()
+		testHandler := func(props *vault.HandlerProperties) http.Handler {
+			origHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+				w.Write([]byte(r.RemoteAddr))
+			})
+			listenerConfig := getListenerConfigForMarshalerTest(goodAddr)
+			listenerConfig.XForwardedForRejectNotPresent = true
+			listenerConfig.XForwardedForRejectNotAuthorized = true
+			return WrapForwardedForHandler(origHandler, listenerConfig)
+		}
+
+		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+			HandlerFunc: HandlerFunc(testHandler),
+		})
+		cluster.Start()
+		defer cluster.Cleanup()
+		client := cluster.Cores[0].Client
+
+		req := client.NewRequest("GET", "/")
+		req.Headers = make(http.Header)
+		req.Headers.Set("x-forwarded-for", "5.6.7.8, 4.5.6.7, 8.8.8.8")
+		req.Headers.Set("x-forwarded-for", "10.9.8.7, 1.2.3.4, 256.1.1.1")
+		_, err := client.RawRequest(req)
+		require.ErrorContains(t, err, "malformed x-forwarded-for IP address")
+	})
+
+	t.Run("ignore invalid proxy IP", func(t *testing.T) {
+		t.Parallel()
+		testHandler := func(props *vault.HandlerProperties) http.Handler {
+			origHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+				w.Write([]byte(r.RemoteAddr))
+			})
+			listenerConfig := getListenerConfigForMarshalerTest(goodAddr)
+			listenerConfig.XForwardedForRejectNotPresent = true
+			listenerConfig.XForwardedForRejectNotAuthorized = true
+			return WrapForwardedForHandler(origHandler, listenerConfig)
+		}
+
+		cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+			HandlerFunc: HandlerFunc(testHandler),
+		})
+		cluster.Start()
+		defer cluster.Cleanup()
+		client := cluster.Cores[0].Client
+
+		req := client.NewRequest("GET", "/")
+		req.Headers = make(http.Header)
+		req.Headers.Set("x-forwarded-for", "5.6.7.8, 4.5.6.7, 8.8.8.8")
+		req.Headers.Set("x-forwarded-for", "10.9.8.7, 256.1.1.1, 1.2.3.4")
+		resp, err := client.RawRequest(req)
+		require.NoError(t, err)
+		resp.Body.Close()
+	})
 }
diff --git a/http/forwarding_bench_test.go b/http/forwarding_bench_test.go
index 287a6c9ff49..1849791188d 100644
--- a/http/forwarding_bench_test.go
+++ b/http/forwarding_bench_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -14,7 +14,6 @@ import (
 
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/builtin/logical/transit"
-	"github.com/hashicorp/vault/helper/benchhelpers"
 	"github.com/hashicorp/vault/helper/forwarding"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/logging"
@@ -32,7 +31,7 @@ func BenchmarkHTTP_Forwarding_Stress(b *testing.B) {
 		},
 	}
 
-	cluster := vault.NewTestCluster(benchhelpers.TBtoT(b), coreConfig, &vault.TestClusterOptions{
+	cluster := vault.NewTestCluster(b, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 		Logger:      logging.NewVaultLoggerWithWriter(ioutil.Discard, log.Error),
 	})
@@ -42,7 +41,7 @@ func BenchmarkHTTP_Forwarding_Stress(b *testing.B) {
 
 	// make it easy to get access to the active
 	core := cores[0].Core
-	vault.TestWaitActive(benchhelpers.TBtoT(b), core)
+	vault.TestWaitActive(b, core)
 
 	handler := cores[0].Handler
 	host := fmt.Sprintf("https://127.0.0.1:%d/v1/transit/", cores[0].Listeners[0].Address.Port)
diff --git a/http/forwarding_test.go b/http/forwarding_test.go
index 89606b24f2b..1e54a6b5c9c 100644
--- a/http/forwarding_test.go
+++ b/http/forwarding_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/handler.go b/http/handler.go
index a58b4ec8ab7..00d0d138760 100644
--- a/http/handler.go
+++ b/http/handler.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -6,12 +6,14 @@ package http
 import (
 	"bytes"
 	"context"
+	"crypto/x509"
+	"encoding/base64"
 	"encoding/json"
+	"encoding/pem"
 	"errors"
 	"fmt"
 	"io"
 	"io/fs"
-	"io/ioutil"
 	"mime"
 	"net"
 	"net/http"
@@ -29,6 +31,7 @@ import (
 	"github.com/hashicorp/go-sockaddr"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/http/priority"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/limits"
 	"github.com/hashicorp/vault/sdk/helper/consts"
@@ -75,6 +78,67 @@ const (
 	// provided and the server is fed ever more data until it exhausts memory.
 	// Can be overridden per listener.
 	DefaultMaxRequestSize = 32 * 1024 * 1024
+
+	// VaultSnapshotReadParam is the query parameter sent when Vault should read
+	// the data from a loaded snapshot
+	VaultSnapshotReadParam = "read_snapshot_id"
+	// VaultSnapshotRecoverParam is the query parameter sent when Vault should
+	// recover the data from a loaded snapshot
+	// Deprecated: use VaultSnapshotRecoverHeader
+	VaultSnapshotRecoverParam = "recover_snapshot_id"
+	// VaultRecoverSourcePathHeader contains an optional source path
+	// to read the data from when performing a recover operation
+	VaultRecoverSourcePathHeader = consts.RecoverSourcePathHeader
+	// VaultSnapshotRecoverHeader holds the snapshot ID to use for a read, list, or
+	// recover from snapshot operation. This replaces the use of query parameters
+	// to pass the snapshot ID
+	VaultSnapshotRecoverHeader = "X-Vault-Recover-Snapshot-Id"
+
+	// CustomMaxJSONDepth specifies the maximum nesting depth of a JSON object.
+	// This limit is designed to prevent stack exhaustion attacks from deeply
+	// nested JSON payloads, which could otherwise lead to a denial-of-service
+	// (DoS) vulnerability. The default value of 300 is intentionally generous
+	// to support complex but legitimate configurations, while still providing
+	// a safeguard against malicious or malformed input. This value is
+	// configurable to accommodate unique environmental requirements.
+	CustomMaxJSONDepth = 300
+
+	// CustomMaxJSONStringValueLength defines the maximum allowed length for a single
+	// string value within a JSON payload, in bytes. This is a critical defense
+	// against excessive memory allocation attacks where a client might send a
+	// very large string value to exhaust server memory. The default of 1MB
+	// (1024 * 1024 bytes) is chosen to comfortably accommodate large secrets
+	// such as private keys, certificate chains, or detailed configuration data,
+	// without permitting unbounded allocation. This value is configurable.
+	CustomMaxJSONStringValueLength = 1024 * 1024 // 1MB
+
+	// CustomMaxJSONObjectEntryCount sets the maximum number of key-value pairs
+	// allowed in a single JSON object. This limit helps mitigate the risk of
+	// hash-collision denial-of-service (HashDoS) attacks and prevents general
+	// resource exhaustion from parsing objects with an excessive number of
+	// entries. A default of 10,000 entries is well beyond the scope of typical
+	// Vault secrets or configurations, providing a high ceiling for normal
+	// operations while ensuring stability. This value is configurable.
+	CustomMaxJSONObjectEntryCount = 10000
+
+	// CustomMaxJSONArrayElementCount determines the maximum number of elements
+	// permitted in a single JSON array. This is particularly relevant for API
+	// endpoints that can return large lists, such as the result of a `LIST`
+	// operation on a secrets engine path. The default limit of 10,000 elements
+	// prevents a single request from causing excessive memory consumption. While
+	// most environments will fall well below this limit, it is configurable for
+	// systems that require handling larger datasets, though pagination is the
+	// recommended practice for such cases.
+	CustomMaxJSONArrayElementCount = 10000
+
+	// CustomMaxJSONToken sets the maximum total number of tokens (e.g., keys, values,
+	// braces, brackets) permitted in a single JSON payload. This limit is a crucial
+	// defense against complexity-based denial-of-service (DoS) attacks, where a
+	// payload could exhaust CPU and memory with an enormous number of small elements,
+	// even while respecting all other individual limits. The default of 500,000
+	// tokens provides a robust safeguard against malicious inputs without interfering
+	// with legitimate, large-scale API operations. This value is configurable.
+	CustomMaxJSONToken = 500000
 )
 
 var (
@@ -112,7 +176,7 @@ var (
 		"/v1/sys/wrapping/wrap",
 	}
 	websocketRawPaths = []string{
-		"/v1/sys/events/subscribe",
+		"sys/events/subscribe",
 	}
 	oidcProtectedPathRegex = regexp.MustCompile(`^identity/oidc/provider/\w(([\w-.]+)?\w)?/userinfo$`)
 )
@@ -122,11 +186,10 @@ func init() {
 		"sys/storage/raft/snapshot",
 		"sys/storage/raft/snapshot-force",
 		"!sys/storage/raft/snapshot-auto/config",
+		"sys/storage/raft/snapshot-load",
+		"!sys/storage/raft/snapshot-auto/snapshot-load",
 	})
 	websocketPaths.AddPaths(websocketRawPaths)
-	for _, path := range websocketRawPaths {
-		alwaysRedirectPaths.AddPaths([]string{strings.TrimPrefix(path, "/v1/")})
-	}
 }
 
 type HandlerAnchor struct{}
@@ -245,9 +308,12 @@ func handler(props *vault.HandlerProperties) http.Handler {
 	// Build up a chain of wrapping handlers.
 	wrappedHandler := wrapHelpHandler(mux, core)
 	wrappedHandler = wrapCORSHandler(wrappedHandler, core)
+	wrappedHandler = withRoleRateLimitQuotaWrapping(wrappedHandler, core)
+	wrappedHandler = wrapJSONLimitsHandler(wrappedHandler, props)
 	wrappedHandler = rateLimitQuotaWrapping(wrappedHandler, core)
 	wrappedHandler = entWrapGenericHandler(core, wrappedHandler, props)
 	wrappedHandler = wrapMaxRequestSizeHandler(wrappedHandler, props)
+	wrappedHandler = priority.WrapRequestPriorityHandler(wrappedHandler)
 
 	// Add an extra wrapping handler if the DisablePrintableCheck listener
 	// setting isn't true that checks for non-printable characters in the
@@ -263,6 +329,13 @@ func handler(props *vault.HandlerProperties) http.Handler {
 		wrappedHandler = disableReplicationStatusEndpointWrapping(wrappedHandler)
 	}
 
+	// Add an extra wrapping handler if any of the Redaction settings are
+	// true that will create a new request with a context containing the
+	// redaction settings.
+	if props.ListenerConfig != nil && (props.ListenerConfig.RedactAddresses || props.ListenerConfig.RedactClusterName || props.ListenerConfig.RedactVersion) {
+		wrappedHandler = redactionSettingsWrapping(wrappedHandler, props.ListenerConfig.RedactVersion, props.ListenerConfig.RedactAddresses, props.ListenerConfig.RedactClusterName)
+	}
+
 	if props.ListenerConfig != nil && props.ListenerConfig.DisableRequestLimiter {
 		wrappedHandler = wrapRequestLimiterHandler(wrappedHandler, props)
 	}
@@ -303,7 +376,7 @@ func (w *copyResponseWriter) WriteHeader(code int) {
 func handleAuditNonLogical(core *vault.Core, h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		origBody := new(bytes.Buffer)
-		reader := ioutil.NopCloser(io.TeeReader(r.Body, origBody))
+		reader := io.NopCloser(io.TeeReader(r.Body, origBody))
 		r.Body = reader
 		req, _, status, err := buildLogicalRequestNoAuth(core.PerfStandby(), core.RouterAccess(), w, r)
 		if err != nil || status != 0 {
@@ -377,7 +450,9 @@ func wrapGenericHandler(core *vault.Core, h http.Handler, props *vault.HandlerPr
 		ctx := r.Context()
 		var cancelFunc context.CancelFunc
 		// Add our timeout, but not for the monitor or events endpoints, as they are streaming
-		if strings.HasSuffix(r.URL.Path, "sys/monitor") || strings.Contains(r.URL.Path, "sys/events") {
+		// Request URL path for sys/monitor looks like /v1/sys/monitor
+		// Request URL paths for event subscriptions look like /v1/sys/events/subscribe/{eventType}. Example: /v1/sys/events/subscribe/kv*
+		if r.URL.Path == "/v1/sys/monitor" || strings.HasPrefix(r.URL.Path, "/v1/sys/events/subscribe") {
 			ctx, cancelFunc = context.WithCancel(ctx)
 		} else {
 			ctx, cancelFunc = context.WithTimeout(ctx, maxRequestDuration)
@@ -422,7 +497,7 @@ func wrapGenericHandler(core *vault.Core, h http.Handler, props *vault.HandlerPr
 			} else if standby && !perfStandby {
 				// Standby nodes, not performance standbys, don't start plugins
 				// so registration can not happen, instead redirect to active
-				respondStandby(core, w, r.URL)
+				respondStandby(core, w, r)
 				cancelFunc()
 				return
 			} else {
@@ -449,7 +524,12 @@ func wrapGenericHandler(core *vault.Core, h http.Handler, props *vault.HandlerPr
 		// The uuid for the request is going to be generated when a logical
 		// request is generated. But, here we generate one to be able to track
 		// in-flight requests, and use that to update the req data with clientID
-		inFlightReqID, err := uuid.GenerateUUID()
+		reqIDGen := props.RequestIDGenerator
+		if reqIDGen == nil {
+			// By default use a UUID
+			reqIDGen = uuid.GenerateUUID
+		}
+		inFlightReqID, err := reqIDGen()
 		if err != nil {
 			respondError(nw, http.StatusInternalServerError, fmt.Errorf("failed to generate an identifier for the in-flight request"))
 		}
@@ -500,6 +580,8 @@ func WrapForwardedForHandler(h http.Handler, l *configutil.Listener) http.Handle
 	hopSkips := l.XForwardedForHopSkips
 	authorizedAddrs := l.XForwardedForAuthorizedAddrs
 	rejectNotAuthz := l.XForwardedForRejectNotAuthorized
+	clientCertHeader := l.XForwardedForClientCertHeader
+	clientCertHeaderDecoders := l.XForwardedForClientCertHeaderDecoders
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		headers, headersOK := r.Header[textproto.CanonicalMIMEHeaderKey("X-Forwarded-For")]
 		if !headersOK || len(headers) == 0 {
@@ -581,7 +663,74 @@ func WrapForwardedForHandler(h http.Handler, l *configutil.Listener) http.Handle
 			return
 		}
 
-		r.RemoteAddr = net.JoinHostPort(acc[indexToUse], port)
+		// check that the chosen address is a valid IP address
+		remoteAddr := acc[indexToUse]
+		if _, err := sockaddr.NewIPAddr(remoteAddr); err != nil {
+			respondError(w, http.StatusBadRequest, fmt.Errorf("malformed x-forwarded-for IP address %s", remoteAddr))
+			return
+		}
+		r.RemoteAddr = net.JoinHostPort(remoteAddr, port)
+
+		// Import the Client Certificate forwarded by the reverse proxy
+		// There should be only 1 instance of the header, but looping allows for more flexibility
+		clientCertHeaders, clientCertHeadersOK := r.Header[textproto.CanonicalMIMEHeaderKey(clientCertHeader)]
+		if clientCertHeadersOK && len(clientCertHeaders) > 0 {
+			var client_certs []*x509.Certificate
+			for _, header := range clientCertHeaders {
+				// Multiple certs should be comma delimetered
+				vals := strings.Split(header, ",")
+				for _, v := range vals {
+					actions := strings.Split(clientCertHeaderDecoders, ",")
+					for _, action := range actions {
+						switch action {
+						case "URL":
+							decoded, err := url.QueryUnescape(v)
+							if err != nil {
+								respondError(w, http.StatusBadRequest, fmt.Errorf("failed to url unescape the client certificate: %w", err))
+								return
+							}
+							v = decoded
+						case "BASE64":
+							// Support RFC 9440/8941 Structured Headers byte sequence values (":MIIC...==:").
+							// If the value is wrapped in leading/trailing colons, unwrap before decoding.
+							base64Value := v
+							if len(v) >= 2 && v[0] == ':' && v[len(v)-1] == ':' {
+								base64Value = v[1 : len(v)-1]
+							}
+
+							decoded, err := base64.StdEncoding.DecodeString(base64Value)
+							if err != nil {
+								respondError(w, http.StatusBadRequest, fmt.Errorf("failed to base64 decode the client certificate: %w", err))
+								return
+							}
+							v = string(decoded[:])
+						case "DER":
+							decoded, _ := pem.Decode([]byte(v))
+							if decoded == nil {
+								respondError(w, http.StatusBadRequest, fmt.Errorf("failed to convert the client certificate to DER format: %w", err))
+								return
+							}
+							v = string(decoded.Bytes[:])
+						default:
+							respondError(w, http.StatusBadRequest, fmt.Errorf("unknown decode option specified: %s", action))
+							return
+						}
+					}
+
+					cert, err := x509.ParseCertificate([]byte(v))
+					if err != nil {
+						respondError(w, http.StatusBadRequest, fmt.Errorf("failed to parse the client certificate: %w", err))
+						return
+					}
+					client_certs = append(client_certs, cert)
+				}
+			}
+			if r.TLS == nil {
+				respondError(w, http.StatusBadRequest, fmt.Errorf("Server must use TLS for certificate authentication"))
+			} else {
+				r.TLS.PeerCertificates = append(client_certs, r.TLS.PeerCertificates...)
+			}
+		}
 		h.ServeHTTP(w, r)
 	})
 }
@@ -744,14 +893,14 @@ func parseJSONRequest(perfStandby bool, r *http.Request, w http.ResponseWriter,
 		// Since we're checking PerfStandby here we key on origBody being nil
 		// or not later, so we need to always allocate so it's non-nil
 		origBody = new(bytes.Buffer)
-		reader = ioutil.NopCloser(io.TeeReader(reader, origBody))
+		reader = io.NopCloser(io.TeeReader(reader, origBody))
 	}
 	err := jsonutil.DecodeJSONFromReader(reader, out)
 	if err != nil && err != io.EOF {
 		return nil, fmt.Errorf("failed to parse JSON input: %w", err)
 	}
 	if origBody != nil {
-		return ioutil.NopCloser(origBody), err
+		return io.NopCloser(origBody), err
 	}
 	return nil, err
 }
@@ -794,6 +943,7 @@ func forwardBasedOnHeaders(core *vault.Core, r *http.Request) (bool, error) {
 			return false, fmt.Errorf("forwarding via header %s disabled in configuration", VaultForwardHeaderName)
 		}
 		if rawForward == "active-node" {
+			core.Logger().Trace("request will be routed based on the 'active-node' header")
 			return true, nil
 		}
 		return false, nil
@@ -828,6 +978,10 @@ func handleRequestForwarding(core *vault.Core, handler http.Handler) http.Handle
 			return
 		}
 
+		// Check if the request requires a snapshot, which is only on the active
+		// node
+		shouldForward = shouldForward || requiresSnapshot(r)
+
 		// If we are a performance standby we can maybe handle the request.
 		if core.PerfStandby() && !shouldForward {
 			ns, err := namespace.FromContext(r.Context())
@@ -835,7 +989,7 @@ func handleRequestForwarding(core *vault.Core, handler http.Handler) http.Handle
 				respondError(w, http.StatusBadRequest, err)
 				return
 			}
-			path := ns.TrimmedPath(r.URL.Path[len("/v1/"):])
+			path := trimPath(ns, r.URL.Path)
 			if !perfStandbyAlwaysForwardPaths.HasPath(path) && !alwaysRedirectPaths.HasPath(path) {
 				handler.ServeHTTP(w, r)
 				return
@@ -872,14 +1026,14 @@ func handleRequestForwarding(core *vault.Core, handler http.Handler) http.Handle
 
 func forwardRequest(core *vault.Core, w http.ResponseWriter, r *http.Request) {
 	if r.Header.Get(vault.IntNoForwardingHeaderName) != "" {
-		respondStandby(core, w, r.URL)
+		respondStandby(core, w, r)
 		return
 	}
 
 	if r.Header.Get(NoRequestForwardingHeaderName) != "" {
 		// Forwarding explicitly disabled, fall back to previous behavior
 		core.Logger().Debug("handleRequestForwarding: forwarding disabled by client request")
-		respondStandby(core, w, r.URL)
+		respondStandby(core, w, r)
 		return
 	}
 
@@ -888,9 +1042,25 @@ func forwardRequest(core *vault.Core, w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusBadRequest, err)
 		return
 	}
-	path := ns.TrimmedPath(r.URL.Path[len("/v1/"):])
-	if alwaysRedirectPaths.HasPath(path) {
-		respondStandby(core, w, r.URL)
+	path := trimPath(ns, r.URL.Path)
+	redirect := alwaysRedirectPaths.HasPath(path)
+	// websocket paths are special, because they can contain a namespace
+	// in front of them. This isn't an issue on perf standbys where the
+	// namespace manager will know all the namespaces, so we will have
+	// already extracted it from the path. But regular standbys don't have
+	// knowledge of the namespaces, so we need
+	// to add an extra check
+	if !redirect && !core.PerfStandby() {
+		for _, websocketPath := range websocketRawPaths {
+			if strings.Contains(path, websocketPath) {
+				redirect = true
+				break
+			}
+		}
+	}
+	if redirect {
+		core.Logger().Trace("cannot forward request (path included in always redirect paths), falling back to redirection to standby")
+		respondStandby(core, w, r)
 		return
 	}
 
@@ -899,54 +1069,43 @@ func forwardRequest(core *vault.Core, w http.ResponseWriter, r *http.Request) {
 	// ErrCannotForward and we simply fall back
 	statusCode, header, retBytes, err := core.ForwardRequest(r)
 	if err != nil {
-		if err == vault.ErrCannotForward {
-			core.Logger().Debug("cannot forward request (possibly disabled on active node), falling back")
-		} else {
+		switch {
+		case errors.Is(err, vault.ErrCannotForward):
+			core.Logger().Trace("cannot forward request (possibly disabled on active node), falling back to redirection to standby")
+		case errors.Is(err, vault.StatusNotHAMember):
+			core.Logger().Trace("this node is not a member of the HA cluster", "error", err)
+			respondError(w, http.StatusInternalServerError, err)
+			return
+		default:
 			core.Logger().Error("forward request error", "error", err)
 		}
 
 		// Fall back to redirection
-		respondStandby(core, w, r.URL)
+		respondStandby(core, w, r)
 		return
 	}
 
+	core.Logger().Trace("request forwarded", "statusCode", statusCode)
+
 	for k, v := range header {
 		w.Header()[k] = v
 	}
 
 	w.WriteHeader(statusCode)
 	w.Write(retBytes)
-}
 
-func acquireLimiterListener(core *vault.Core, rawReq *http.Request, r *logical.Request) (*limits.RequestListener, bool) {
-	var disable bool
-	disableRequestLimiter := rawReq.Context().Value(logical.CtxKeyDisableRequestLimiter{})
-	if disableRequestLimiter != nil {
-		disable = disableRequestLimiter.(bool)
-	}
-	r.RequestLimiterDisabled = disable
-	if disable {
-		return &limits.RequestListener{}, true
-	}
-
-	lim := &limits.RequestLimiter{}
-	if r.PathLimited {
-		lim = core.GetRequestLimiter(limits.SpecialPathLimiter)
-	} else {
-		switch rawReq.Method {
-		case http.MethodGet, http.MethodHead, http.MethodTrace, http.MethodOptions:
-			// We're only interested in the inverse, so do nothing here.
-		default:
-			lim = core.GetRequestLimiter(limits.WriteLimiter)
-		}
-	}
-	return lim.Acquire(rawReq.Context())
+	logical.IncrementResponseStatusCodeMetric(statusCode)
 }
 
 // request is a helper to perform a request and properly exit in the
 // case of an error.
 func request(core *vault.Core, w http.ResponseWriter, rawReq *http.Request, r *logical.Request) (*logical.Response, bool, bool) {
-	lsnr, ok := acquireLimiterListener(core, rawReq, r)
+	lim := &limits.HTTPLimiter{
+		Method:      rawReq.Method,
+		PathLimited: r.PathLimited,
+		LookupFunc:  core.GetRequestLimiter,
+	}
+	lsnr, ok := lim.Acquire(rawReq.Context())
 	if !ok {
 		resp := &logical.Response{}
 		logical.RespondWithStatusCode(resp, r, http.StatusServiceUnavailable)
@@ -975,8 +1134,20 @@ func request(core *vault.Core, w http.ResponseWriter, rawReq *http.Request, r *l
 		}
 		resp.AddWarning("Timeout hit while waiting for local replicated cluster to apply primary's write; this client may encounter stale reads of values written during this operation.")
 	}
+
+	// We need to rely on string comparison here because the error could be
+	// returned from an RPC client call with a non-ReplicatedResponse return
+	// value (see: PersistAlias). In these cases, the error we get back will
+	// contain the non-wrapped error message string we're looking for. We would
+	// love to clean up all error wrapping to be consistent in Vault but we
+	// considered that too high risk for now.
+	if err != nil && strings.Contains(err.Error(), consts.ErrOverloaded.Error()) {
+		logical.RespondWithStatusCode(resp, r, http.StatusServiceUnavailable)
+		respondError(w, http.StatusServiceUnavailable, err)
+		return resp, false, false
+	}
 	if errwrap.Contains(err, consts.ErrStandby.Error()) {
-		respondStandby(core, w, rawReq.URL)
+		respondStandby(core, w, rawReq)
 		return resp, false, false
 	}
 	if err != nil && errwrap.Contains(err, logical.ErrPerfStandbyPleaseForward.Error()) {
@@ -1025,7 +1196,8 @@ func request(core *vault.Core, w http.ResponseWriter, rawReq *http.Request, r *l
 }
 
 // respondStandby is used to trigger a redirect in the case that this Vault is currently a hot standby
-func respondStandby(core *vault.Core, w http.ResponseWriter, reqURL *url.URL) {
+func respondStandby(core *vault.Core, w http.ResponseWriter, r *http.Request) {
+	reqURL := r.URL
 	// Request the leader address
 	_, redirectAddr, _, err := core.Leader()
 	if err != nil {
@@ -1062,8 +1234,13 @@ func respondStandby(core *vault.Core, w http.ResponseWriter, reqURL *url.URL) {
 		RawQuery: reqURL.RawQuery,
 	}
 
+	ctx := r.Context()
+	ns, err := namespace.FromContext(ctx)
+	if err != nil {
+		respondError(w, http.StatusBadRequest, err)
+	}
 	// WebSockets schemas are ws or wss
-	if websocketPaths.HasPath(reqURL.Path) {
+	if websocketPaths.HasPath(trimPath(ns, reqURL.Path)) {
 		if finalURL.Scheme == "http" {
 			finalURL.Scheme = "ws"
 		} else {
@@ -1071,6 +1248,11 @@ func respondStandby(core *vault.Core, w http.ResponseWriter, reqURL *url.URL) {
 		}
 	}
 
+	originalPath, ok := logical.ContextOriginalRequestPathValue(ctx)
+	if ok {
+		finalURL.Path = originalPath
+	}
+
 	// Ensure there is a scheme, default to https
 	if finalURL.Scheme == "" {
 		finalURL.Scheme = "https"
@@ -1081,6 +1263,8 @@ func respondStandby(core *vault.Core, w http.ResponseWriter, reqURL *url.URL) {
 	// the request method should be preserved.
 	w.Header().Set("Location", finalURL.String())
 	w.WriteHeader(307)
+
+	logical.IncrementResponseStatusCodeMetric(307)
 }
 
 // getTokenFromReq parse headers of the incoming request to extract token if
@@ -1282,8 +1466,10 @@ func respondOk(w http.ResponseWriter, body interface{}) {
 
 	if body == nil {
 		w.WriteHeader(http.StatusNoContent)
+		defer logical.IncrementResponseStatusCodeMetric(http.StatusNoContent)
 	} else {
 		w.WriteHeader(http.StatusOK)
+		defer logical.IncrementResponseStatusCodeMetric(http.StatusOK)
 		enc := json.NewEncoder(w)
 		enc.Encode(body)
 	}
@@ -1307,6 +1493,8 @@ func respondOIDCPermissionDenied(w http.ResponseWriter) {
 	errorCode := "invalid_token"
 	errorDescription := logical.ErrPermissionDenied.Error()
 
+	defer logical.IncrementResponseStatusCodeMetric(http.StatusUnauthorized)
+
 	w.Header().Set("Content-Type", "application/json")
 	w.Header().Set("WWW-Authenticate", fmt.Sprintf("Bearer error=%q,error_description=%q",
 		errorCode, errorDescription))
@@ -1322,3 +1510,27 @@ func respondOIDCPermissionDenied(w http.ResponseWriter) {
 	enc := json.NewEncoder(w)
 	enc.Encode(oidcResponse)
 }
+
+// trimPath removes the /v1/ prefix (if present) and the namespace from the path
+func trimPath(ns *namespace.Namespace, path string) string {
+	const v1Prefix = "/v1/"
+
+	if strings.HasPrefix(path, v1Prefix) {
+		return ns.TrimmedPath(path[len(v1Prefix):])
+	}
+
+	return ns.TrimmedPath(path)
+}
+
+// requiresSnapshot checks if the request requires a loaded snapshot, by
+// checking for the existence of a snapshot query parameter
+func requiresSnapshot(r *http.Request) bool {
+	query := r.URL.Query()
+	switch r.Method {
+	case http.MethodGet, "LIST":
+		return query.Has(VaultSnapshotReadParam)
+	case http.MethodPut, http.MethodPost:
+		return query.Has(VaultSnapshotRecoverParam) || r.Header.Get(VaultSnapshotRecoverParam) != ""
+	}
+	return false
+}
diff --git a/http/handler_stubs_oss.go b/http/handler_stubs_oss.go
index f59a637eb58..ffacec99e0e 100644
--- a/http/handler_stubs_oss.go
+++ b/http/handler_stubs_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/http/handler_test.go b/http/handler_test.go
index ebfee040164..611416064d8 100644
--- a/http/handler_test.go
+++ b/http/handler_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -9,7 +9,7 @@ import (
 	"crypto/tls"
 	"encoding/json"
 	"errors"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/textproto"
@@ -21,6 +21,7 @@ import (
 
 	"github.com/go-test/deep"
 	"github.com/hashicorp/go-cleanhttp"
+	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/versions"
 	"github.com/hashicorp/vault/internalshared/configutil"
@@ -885,7 +886,7 @@ func TestHandler_Parse_Form(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	req.Body = ioutil.NopCloser(strings.NewReader(values.Encode()))
+	req.Body = io.NopCloser(strings.NewReader(values.Encode()))
 	req.Header.Set("x-vault-token", cluster.RootToken)
 	req.Header.Set("content-type", "application/x-www-form-urlencoded")
 	resp, err := c.Do(req)
@@ -938,7 +939,7 @@ func TestHandler_MaxRequestSize(t *testing.T) {
 		"bar": strings.Repeat("a", 1025),
 	})
 
-	require.ErrorContains(t, err, "error parsing JSON")
+	require.ErrorContains(t, err, "http: request body too large")
 }
 
 // TestHandler_MaxRequestSize_Memory sets the max request size to 1024 bytes,
@@ -972,3 +973,259 @@ func TestHandler_MaxRequestSize_Memory(t *testing.T) {
 	runtime.ReadMemStats(&end)
 	require.Less(t, end.TotalAlloc-start.TotalAlloc, uint64(1024*1024))
 }
+
+// Test_requiresSnapshot verifies that a request is marked as requiring a
+// snapshot when it's a read, list, or create/update and has a snapshot query
+// parameter
+func Test_requiresSnapshot(t *testing.T) {
+	testCases := []struct {
+		name        string
+		method      string
+		queryParams map[string][]string
+		expected    bool
+	}{
+		{
+			name:        "get no snapshot",
+			method:      http.MethodGet,
+			queryParams: map[string][]string{"other": {"param"}},
+			expected:    false,
+		},
+		{
+			name:        "options with snapshot",
+			method:      http.MethodOptions,
+			queryParams: map[string][]string{VaultSnapshotRecoverParam: {"param"}},
+			expected:    false,
+		},
+		{
+			name:        "put with read snapshot",
+			method:      http.MethodPut,
+			queryParams: map[string][]string{VaultSnapshotReadParam: {"param"}},
+			expected:    false,
+		},
+		{
+			name:        "put with recover snapshot",
+			method:      http.MethodPut,
+			queryParams: map[string][]string{VaultSnapshotRecoverParam: {"param"}},
+			expected:    true,
+		},
+		{
+			name:        "list with snapshot",
+			method:      "LIST",
+			queryParams: map[string][]string{VaultSnapshotReadParam: {"param"}},
+			expected:    true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := &http.Request{
+				Method: tc.method,
+				URL: &url.URL{
+					RawQuery: url.Values(tc.queryParams).Encode(),
+				},
+			}
+			require.Equal(t, tc.expected, requiresSnapshot(req))
+		})
+	}
+}
+
+// TestHandler_JSONLimitQuotaWrappers verifies that the handler properly orders
+// the normal quota checks, JSON size limits checks, and role-based quota checks
+func TestHandler_JSONLimitQuotaWrappers(t *testing.T) {
+	testCases := []struct {
+		name           string
+		setup          func(t *testing.T, client *api.Client, roleID string)
+		jsonStringSize int
+		wantError      string
+	}{
+		{
+			// set up a role-based rate limit, but don't exceed the rate
+			// because the JSON is too big the request will error with
+			// the JSON size error
+			name: "too big json with role quota",
+			setup: func(t *testing.T, client *api.Client, _ string) {
+				_, err := client.Logical().Write("sys/quotas/rate-limit/my-role-quota", map[string]interface{}{
+					"path": "auth/approle",
+					"role": "my-role",
+					"rate": 5,
+				})
+				require.NoError(t, err)
+			},
+			jsonStringSize: 5001,
+			wantError:      "JSON string value exceeds allowed length",
+		},
+		{
+			// set up a rate limit, but don't exceed the rate
+			// because the JSON is too big the request will error with
+			// the JSON size error
+			name: "too big json with non role quota",
+			setup: func(t *testing.T, client *api.Client, _ string) {
+				_, err := client.Logical().Write("sys/quotas/rate-limit/my-quota", map[string]interface{}{
+					"path": "auth/approle",
+					"rate": 5,
+				})
+				require.NoError(t, err)
+			},
+			jsonStringSize: 5001,
+			wantError:      "JSON string value exceeds allowed length",
+		},
+		{
+			// set up a rate limit without a role and exceed it
+			// even though the JSON is too big, the request will be blocked by
+			// the rate limit first
+			name: "too big json with non role quota blocked",
+			setup: func(t *testing.T, client *api.Client, roleID string) {
+				_, err := client.Logical().Write("sys/quotas/rate-limit/my-quota", map[string]interface{}{
+					"path":     "auth/approle",
+					"rate":     1,
+					"interval": "60",
+				})
+				require.NoError(t, err)
+			},
+			jsonStringSize: 5001,
+			wantError:      "rate limit quota exceeded",
+		},
+		{
+			// set up a rate limit with a role and exceed it
+			// the JSON is too big and the JSON check will trigger before
+			// the role-based quota check, so we'll get a JSON size error
+			name: "too big json with role quota blocked",
+			setup: func(t *testing.T, client *api.Client, roleID string) {
+				_, err := client.Logical().Write("sys/quotas/rate-limit/my-role-quota", map[string]interface{}{
+					"path":     "auth/approle",
+					"role":     "my-role",
+					"rate":     1,
+					"interval": "60",
+				})
+				require.NoError(t, err)
+
+				// log in for the role to use up the quota
+				r, err := client.Logical().Write("auth/approle/role/my-role/secret-id", nil)
+				require.NoError(t, err)
+				secretID := r.Data["secret_id"].(string)
+
+				_, err = client.Logical().Write("auth/approle/login", map[string]interface{}{
+					"role_id":   roleID,
+					"secret_id": secretID,
+				})
+				require.NoError(t, err)
+			},
+			jsonStringSize: 5001,
+			wantError:      "JSON string value exceeds allowed length",
+		},
+		{
+			// set up a rate limit with a role and exceed it
+			// the JSON is an ok size, so the role-based quota check will
+			// trigger
+			name: "normal json with role quota blocked",
+			setup: func(t *testing.T, client *api.Client, roleID string) {
+				_, err := client.Logical().Write("sys/quotas/rate-limit/my-role-quota", map[string]interface{}{
+					"path":     "auth/approle",
+					"role":     "my-role",
+					"rate":     1,
+					"interval": "60",
+				})
+				require.NoError(t, err)
+
+				// log in for the role to use up the quota
+				r, err := client.Logical().Write("auth/approle/role/my-role/secret-id", nil)
+				require.NoError(t, err)
+				secretID := r.Data["secret_id"].(string)
+
+				_, err = client.Logical().Write("auth/approle/login", map[string]interface{}{
+					"role_id":   roleID,
+					"secret_id": secretID,
+				})
+				require.NoError(t, err)
+			},
+			jsonStringSize: 5,
+			wantError:      "rate limit quota exceeded",
+		},
+		{
+			// set up a rate limit with a role but don't exceed it
+			// the JSON is an ok size, so the request will succeed
+			name: "normal json with role quota allowed",
+			setup: func(t *testing.T, client *api.Client, roleID string) {
+				_, err := client.Logical().Write("sys/quotas/rate-limit/my-role-quota", map[string]interface{}{
+					"path":     "auth/approle",
+					"role":     "my-role",
+					"rate":     1,
+					"interval": "60",
+				})
+				require.NoError(t, err)
+			},
+			jsonStringSize: 5,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			cluster := vault.NewTestCluster(t, &vault.CoreConfig{}, &vault.TestClusterOptions{
+				HandlerFunc: Handler,
+				DefaultHandlerProperties: vault.HandlerProperties{
+					ListenerConfig: &configutil.Listener{
+						CustomMaxJSONStringValueLength: 5000,
+					},
+				},
+			})
+			cluster.Start()
+			defer cluster.Cleanup()
+
+			client := cluster.Cores[0].Client
+			client.SetToken(cluster.RootToken)
+
+			err := client.Sys().EnableAuthWithOptions("approle", &api.EnableAuthOptions{
+				Type: "approle",
+			})
+			require.NoError(t, err)
+
+			_, err = client.Logical().Write("auth/approle/role/my-role", map[string]interface{}{
+				"token_policies": "default",
+				"token_ttl":      "1h",
+				"token_max_ttl":  "4h",
+			})
+			r, err := client.Logical().Read("auth/approle/role/my-role/role-id")
+			require.NoError(t, err)
+			roleID := r.Data["role_id"].(string)
+			require.NoError(t, err)
+			if tc.setup != nil {
+				tc.setup(t, client, roleID)
+			}
+			r, err = client.Logical().Write("auth/approle/role/my-role/secret-id", nil)
+			require.NoError(t, err)
+			secretID := r.Data["secret_id"].(string)
+
+			resp, err := client.Logical().Write("auth/approle/login", map[string]interface{}{
+				"role_id":         roleID,
+				"secret_id":       secretID,
+				"additional_data": strings.Repeat("a", tc.jsonStringSize),
+			})
+			if tc.wantError != "" {
+				require.ErrorContains(t, err, tc.wantError)
+				return
+			}
+			require.NoError(t, err)
+			require.NotNil(t, resp)
+		})
+	}
+}
+
+// TestAutoSnapshotLoadForwarded tests that a request to load from a cloud
+// snapshot is forwarded to the active node, rather than being redirected
+func TestAutoSnapshotLoadForwarded(t *testing.T) {
+	cluster := vault.NewTestCluster(t, &vault.CoreConfig{}, &vault.TestClusterOptions{
+		NumCores:    2,
+		HandlerFunc: Handler,
+	})
+
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	client := cluster.Cores[1].Client
+	client.SetToken(cluster.RootToken)
+
+	_, err := client.Logical().Write("sys/storage/raft/snapshot-auto/snapshot-load/cfg1", nil)
+	// the request will fail, but all that we care about is that the error
+	// doesn't indicate a redirect
+	require.Error(t, err)
+	require.NotContains(t, err.Error(), "redirects not allowed in these tests")
+}
diff --git a/http/help.go b/http/help.go
index e4d03b261c9..4f7b91a45b0 100644
--- a/http/help.go
+++ b/http/help.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -40,7 +40,7 @@ func handleHelp(core *vault.Core, w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusNotFound, errors.New("Missing /v1/ prefix in path. Use vault path-help command to retrieve API help for paths"))
 		return
 	}
-	path := ns.TrimmedPath(r.URL.Path[len("/v1/"):])
+	path := trimPath(ns, r.URL.Path)
 
 	req := &logical.Request{
 		Operation:  logical.HelpOperation,
diff --git a/http/help_test.go b/http/help_test.go
index 5fa96e50dda..834f55c18ac 100644
--- a/http/help_test.go
+++ b/http/help_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/http_test.go b/http/http_test.go
index addd423b618..259b23571a6 100644
--- a/http/http_test.go
+++ b/http/http_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -32,6 +32,10 @@ func testHttpDelete(t *testing.T, token string, addr string) *http.Response {
 	return testHttpData(t, "DELETE", token, addr, "", nil, false, 0, false)
 }
 
+func testHttpDeleteData(t *testing.T, token string, addr string, body interface{}) *http.Response {
+	return testHttpData(t, "DELETE", token, addr, "", body, false, 0, false)
+}
+
 // Go 1.8+ clients redirect automatically which breaks our 307 standby testing
 func testHttpDeleteDisableRedirect(t *testing.T, token string, addr string) *http.Response {
 	return testHttpData(t, "DELETE", token, addr, "", nil, true, 0, false)
diff --git a/http/logical.go b/http/logical.go
index cf80df2b0f2..e1c6a7b737f 100644
--- a/http/logical.go
+++ b/http/logical.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -7,7 +7,6 @@ import (
 	"bufio"
 	"encoding/base64"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"mime"
@@ -17,9 +16,9 @@ import (
 	"strings"
 	"time"
 
+	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/limits"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
@@ -51,8 +50,7 @@ func buildLogicalRequestNoAuth(perfStandby bool, ra *vault.RouterAccess, w http.
 	if err != nil {
 		return nil, nil, http.StatusBadRequest, nil
 	}
-	path := ns.TrimmedPath(r.URL.Path[len("/v1/"):])
-
+	path := trimPath(ns, r.URL.Path)
 	var data map[string]interface{}
 	var origBody io.ReadCloser
 	var passHTTPReq bool
@@ -99,8 +97,12 @@ func buildLogicalRequestNoAuth(perfStandby bool, ra *vault.RouterAccess, w http.
 			responseWriter = w
 		}
 
-	case "POST", "PUT":
-		op = logical.UpdateOperation
+	case "POST", "PUT", "RECOVER":
+		if r.Method == "RECOVER" {
+			op = logical.RecoverOperation
+		} else {
+			op = logical.UpdateOperation
+		}
 
 		// Buffer the request body in order to allow us to peek at the beginning
 		// without consuming it. This approach involves no copying.
@@ -113,7 +115,10 @@ func buildLogicalRequestNoAuth(perfStandby bool, ra *vault.RouterAccess, w http.
 		contentType := r.Header.Get("Content-Type")
 
 		if (ra != nil && ra.IsBinaryPath(r.Context(), path)) ||
-			path == "sys/storage/raft/snapshot" || path == "sys/storage/raft/snapshot-force" {
+			path == "sys/storage/raft/snapshot" ||
+			path == "sys/storage/raft/snapshot-force" ||
+			path == "sys/storage/raft/snapshot-load" {
+
 			passHTTPReq = true
 			origBody = r.Body
 		} else {
@@ -146,7 +151,7 @@ func buildLogicalRequestNoAuth(perfStandby bool, ra *vault.RouterAccess, w http.
 				if err != nil {
 					status := http.StatusBadRequest
 					logical.AdjustErrorStatusCode(&status, err)
-					return nil, nil, status, fmt.Errorf("error parsing JSON")
+					return nil, nil, status, fmt.Errorf("error parsing JSON: %w", err)
 				}
 			}
 		}
@@ -204,13 +209,54 @@ func buildLogicalRequestNoAuth(perfStandby bool, ra *vault.RouterAccess, w http.
 		return nil, nil, http.StatusInternalServerError, fmt.Errorf("failed to generate identifier for the request: %w", err)
 	}
 
+	var requiredSnapshotID, recoverSourcePath string
+
+	// check for a read, list, or recover from snapshot request
+	switch op {
+	case logical.ReadOperation, logical.ListOperation:
+		snapshotID, ok := data[VaultSnapshotReadParam]
+		if ok && snapshotID != "" {
+			requiredSnapshotID = snapshotID.(string)
+			delete(data, VaultSnapshotReadParam)
+			if len(data) == 0 {
+				data = nil
+			}
+		}
+	case logical.UpdateOperation, logical.RecoverOperation:
+		snapshotHeaderID := r.Header.Get(VaultSnapshotRecoverHeader)
+		if snapshotHeaderID != "" {
+			requiredSnapshotID = snapshotHeaderID
+		} else {
+			queryVals := r.URL.Query()
+			if queryVals.Has(VaultSnapshotRecoverParam) {
+				snapshotID := queryVals.Get(VaultSnapshotRecoverParam)
+				if snapshotID != "" {
+					requiredSnapshotID = snapshotID
+				}
+			}
+		}
+		if requiredSnapshotID == "" && op == logical.RecoverOperation {
+			return nil, nil, http.StatusBadRequest, fmt.Errorf("missing required snapshot ID")
+		}
+
+		if requiredSnapshotID != "" {
+			op = logical.RecoverOperation
+			sourcePath := r.Header.Get(VaultRecoverSourcePathHeader)
+			if sourcePath != "" {
+				recoverSourcePath = trimPath(ns, sourcePath)
+			}
+		}
+	}
+
 	req := &logical.Request{
-		ID:         requestId,
-		Operation:  op,
-		Path:       path,
-		Data:       data,
-		Connection: getConnection(r),
-		Headers:    r.Header,
+		ID:                 requestId,
+		Operation:          op,
+		Path:               path,
+		Data:               data,
+		Connection:         getConnection(r),
+		Headers:            r.Header,
+		RequiresSnapshotID: requiredSnapshotID,
+		RecoverSourcePath:  recoverSourcePath,
 	}
 
 	if ra != nil && ra.IsLimitedPath(r.Context(), path) {
@@ -362,11 +408,13 @@ func handleLogicalInternal(core *vault.Core, injectDataIntoTopLevel bool, noForw
 			respondError(w, http.StatusInternalServerError, err)
 			return
 		}
+		trimmedPath := trimPath(ns, r.URL.Path)
+
 		nsPath := ns.Path
 		if ns.ID == namespace.RootNamespaceID {
 			nsPath = ""
 		}
-		if strings.HasPrefix(r.URL.Path, fmt.Sprintf("/v1/%ssys/events/subscribe/", nsPath)) {
+		if websocketPaths.HasPath(trimmedPath) {
 			handler := entHandleEventsSubscribe(core, req)
 			if handler != nil {
 				handler.ServeHTTP(w, r)
@@ -386,8 +434,8 @@ func handleLogicalInternal(core *vault.Core, injectDataIntoTopLevel bool, noForw
 		// success.
 		resp, ok, needsForward := request(core, w, r, req)
 		switch {
-		case errors.Is(resp.Error(), limits.ErrCapacity):
-			respondError(w, http.StatusServiceUnavailable, limits.ErrCapacity)
+		case errwrap.Contains(resp.Error(), consts.ErrOverloaded.Error()):
+			respondError(w, http.StatusServiceUnavailable, consts.ErrOverloaded)
 			return
 		case needsForward && noForward:
 			respondError(w, http.StatusBadRequest, vault.ErrCannotForwardLocalOnly)
@@ -473,6 +521,8 @@ func respondLogical(core *vault.Core, w http.ResponseWriter, r *http.Request, re
 // returning the CRL information on the PKI backends.
 func respondRaw(w http.ResponseWriter, r *http.Request, resp *logical.Response) {
 	retErr := func(w http.ResponseWriter, err string) {
+		defer logical.IncrementResponseStatusCodeMetric(http.StatusInternalServerError)
+
 		w.Header().Set("X-Vault-Raw-Error", err)
 		w.WriteHeader(http.StatusInternalServerError)
 		w.Write(nil)
@@ -573,6 +623,8 @@ WRITE_RESPONSE:
 
 	w.WriteHeader(status)
 	w.Write(body)
+
+	logical.IncrementResponseStatusCodeMetric(status)
 }
 
 // getConnection is used to format the connection information for
diff --git a/http/logical_test.go b/http/logical_test.go
index e07815896d8..ad22616e69c 100644
--- a/http/logical_test.go
+++ b/http/logical_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"io"
 	"io/ioutil"
 	"net/http"
@@ -23,7 +24,6 @@ import (
 	kv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/audit"
-	auditFile "github.com/hashicorp/vault/builtin/audit/file"
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
@@ -35,6 +35,7 @@ import (
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/sdk/physical/inmem"
 	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
 )
 
 func TestLogical(t *testing.T) {
@@ -283,12 +284,24 @@ func TestLogical_RequestSizeLimit(t *testing.T) {
 	defer ln.Close()
 	TestServerAuth(t, addr, token)
 
-	// Write a very large object, should fail. This test works because Go will
-	// convert the byte slice to base64, which makes it significantly larger
-	// than the default max request size.
-	resp := testHttpPut(t, token, addr+"/v1/secret/foo", map[string]interface{}{
-		"data": make([]byte, DefaultMaxRequestSize),
-	})
+	// To test the server's max request size limit (which returns 413),
+	// we must create a payload that is larger than the limit in total, but
+	// does not violate any of the JSON parser's individual limits (like max
+	// string length), which would return a 500 error first.
+	//
+	// We do this by creating many key-value pairs, where each value is a
+	// moderately sized string.
+	const valueSize = 4096 // 4KB, well under the 1MB string limit
+	numEntries := (DefaultMaxRequestSize / valueSize) + 1
+	valueString := strings.Repeat("a", valueSize)
+
+	payload := make(map[string]interface{}, numEntries)
+	for i := 0; i < numEntries; i++ {
+		key := fmt.Sprintf("key_%d", i)
+		payload[key] = valueString
+	}
+	resp := testHttpPut(t, token, addr+"/v1/secret/foo", payload)
+
 	testResponseStatus(t, resp, http.StatusRequestEntityTooLarge)
 }
 
@@ -310,8 +323,15 @@ func TestLogical_RequestSizeDisableLimit(t *testing.T) {
 
 	// Write a very large object, should pass as MaxRequestSize set to -1/Negative value
 
+	// Test change: Previously used DefaultMaxRequestSize to create a large payload.
+	// However, after introducing JSON limits, the test successfully disables the first layer (MaxRequestSize),
+	// but its large 32MB payload is then correctly caught by the second layer—specifically,
+	// the CustomMaxStringValueLength limit, which defaults to 1MB.
+	// Create a payload that is larger than a typical small limit (e.g., > 1KB),
+	// but is well within the default JSON string length limit (1MB).
+	// This isolates the test to *only* the MaxRequestSize behavior.
 	resp := testHttpPut(t, token, addr+"/v1/secret/foo", map[string]interface{}{
-		"data": make([]byte, DefaultMaxRequestSize),
+		"data": make([]byte, 2048),
 	})
 	testResponseStatus(t, resp, http.StatusNoContent)
 }
@@ -569,10 +589,10 @@ func TestLogical_RespondWithStatusCode(t *testing.T) {
 
 func TestLogical_Audit_invalidWrappingToken(t *testing.T) {
 	// Create a noop audit backend
-	noop := corehelpers.TestNoopAudit(t, "noop/", nil)
+	noop := audit.TestNoopAudit(t, "noop/", nil)
 	c, _, root := vault.TestCoreUnsealedWithConfig(t, &vault.CoreConfig{
 		AuditBackends: map[string]audit.Factory{
-			"noop": func(ctx context.Context, config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
+			"noop": func(config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
 				return noop, nil
 			},
 		},
@@ -681,7 +701,7 @@ func TestLogical_AuditPort(t *testing.T) {
 			"kv": kv.VersionedKVFactory,
 		},
 		AuditBackends: map[string]audit.Factory{
-			"file": auditFile.Factory,
+			"file": audit.NewFileBackend,
 		},
 	}
 
@@ -745,9 +765,12 @@ func TestLogical_AuditPort(t *testing.T) {
 
 	decoder := json.NewDecoder(auditLogFile)
 
-	var auditRecord map[string]interface{}
 	count := 0
-	for decoder.Decode(&auditRecord) == nil {
+	for decoder.More() {
+		var auditRecord map[string]interface{}
+		err := decoder.Decode(&auditRecord)
+		require.NoError(t, err)
+
 		count += 1
 
 		// Skip the first line
@@ -852,14 +875,25 @@ func TestLogical_ErrRelativePath(t *testing.T) {
 }
 
 func testBuiltinPluginMetadataAuditLog(t *testing.T, log map[string]interface{}, expectedMountClass string) {
+	t.Helper()
+
 	if mountClass, ok := log["mount_class"].(string); !ok {
 		t.Fatalf("mount_class should be a string, not %T", log["mount_class"])
 	} else if mountClass != expectedMountClass {
 		t.Fatalf("bad: mount_class should be %s, not %s", expectedMountClass, mountClass)
 	}
 
-	if _, ok := log["mount_running_version"].(string); !ok {
-		t.Fatalf("mount_running_version should be a string, not %T", log["mount_running_version"])
+	// Requests have 'mount_running_version' but Responses have 'mount_running_plugin_version'
+	runningVersionRaw, runningVersionRawOK := log["mount_running_version"]
+	runningPluginVersionRaw, runningPluginVersionRawOK := log["mount_running_plugin_version"]
+	if !runningVersionRawOK && !runningPluginVersionRawOK {
+		t.Fatalf("mount_running_version/mount_running_plugin_version should be present")
+	} else if runningVersionRawOK {
+		if _, ok := runningVersionRaw.(string); !ok {
+			t.Fatalf("mount_running_version should be string, not %T", runningVersionRaw)
+		}
+	} else if _, ok := runningPluginVersionRaw.(string); !ok {
+		t.Fatalf("mount_running_plugin_version should be string, not %T", runningPluginVersionRaw)
 	}
 
 	if _, ok := log["mount_running_sha256"].(string); ok {
@@ -876,7 +910,7 @@ func testBuiltinPluginMetadataAuditLog(t *testing.T, log map[string]interface{},
 func TestLogical_AuditEnabled_ShouldLogPluginMetadata_Auth(t *testing.T) {
 	coreConfig := &vault.CoreConfig{
 		AuditBackends: map[string]audit.Factory{
-			"file": auditFile.Factory,
+			"file": audit.NewFileBackend,
 		},
 	}
 
@@ -906,38 +940,45 @@ func TestLogical_AuditEnabled_ShouldLogPluginMetadata_Auth(t *testing.T) {
 			"file_path": auditLogFile.Name(),
 		},
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	_, err = c.Logical().Write("auth/token/create", map[string]interface{}{
 		"ttl": "10s",
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
+
+	// Disable audit now we're done performing operations
+	err = c.Sys().DisableAudit("file")
+	require.NoError(t, err)
 
 	// Check the audit trail on request and response
 	decoder := json.NewDecoder(auditLogFile)
-	var auditRecord map[string]interface{}
-	for decoder.Decode(&auditRecord) == nil {
-		auditRequest := map[string]interface{}{}
+	for decoder.More() {
+		var auditRecord map[string]interface{}
+		err := decoder.Decode(&auditRecord)
+		require.NoError(t, err)
+
 		if req, ok := auditRecord["request"]; ok {
-			auditRequest = req.(map[string]interface{})
-			if auditRequest["path"] != "auth/token/create" {
+			auditRequest, ok := req.(map[string]interface{})
+			require.True(t, ok)
+
+			path, ok := auditRequest["path"].(string)
+			require.True(t, ok)
+
+			if path != "auth/token/create" {
 				continue
 			}
+
+			testBuiltinPluginMetadataAuditLog(t, auditRequest, consts.PluginTypeCredential.String())
 		}
-		testBuiltinPluginMetadataAuditLog(t, auditRequest, consts.PluginTypeCredential.String())
 
-		auditResponse := map[string]interface{}{}
-		if req, ok := auditRecord["response"]; ok {
-			auditRequest = req.(map[string]interface{})
-			if auditResponse["path"] != "auth/token/create" {
-				continue
-			}
+		// Should never have a response without a corresponding request.
+		if resp, ok := auditRecord["response"]; ok {
+			auditResponse, ok := resp.(map[string]interface{})
+			require.True(t, ok)
+
+			testBuiltinPluginMetadataAuditLog(t, auditResponse, consts.PluginTypeCredential.String())
 		}
-		testBuiltinPluginMetadataAuditLog(t, auditResponse, consts.PluginTypeCredential.String())
 	}
 }
 
@@ -949,7 +990,7 @@ func TestLogical_AuditEnabled_ShouldLogPluginMetadata_Secret(t *testing.T) {
 			"kv": kv.VersionedKVFactory,
 		},
 		AuditBackends: map[string]audit.Factory{
-			"file": auditFile.Factory,
+			"file": audit.NewFileBackend,
 		},
 	}
 
@@ -975,9 +1016,7 @@ func TestLogical_AuditEnabled_ShouldLogPluginMetadata_Secret(t *testing.T) {
 	// Enable the audit backend
 	tempDir := t.TempDir()
 	auditLogFile, err := os.CreateTemp(tempDir, "")
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	err = c.Sys().EnableAuditWithOptions("file", &api.EnableAuditOptions{
 		Type: "file",
@@ -985,9 +1024,7 @@ func TestLogical_AuditEnabled_ShouldLogPluginMetadata_Secret(t *testing.T) {
 			"file_path": auditLogFile.Name(),
 		},
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
 	{
 		writeData := map[string]interface{}{
@@ -1004,26 +1041,193 @@ func TestLogical_AuditEnabled_ShouldLogPluginMetadata_Secret(t *testing.T) {
 		})
 	}
 
+	// Disable audit now we're done performing operations
+	err = c.Sys().DisableAudit("file")
+	require.NoError(t, err)
+
 	// Check the audit trail on request and response
 	decoder := json.NewDecoder(auditLogFile)
-	var auditRecord map[string]interface{}
-	for decoder.Decode(&auditRecord) == nil {
-		auditRequest := map[string]interface{}{}
+	for decoder.More() {
+		var auditRecord map[string]interface{}
+		err := decoder.Decode(&auditRecord)
+		require.NoError(t, err)
+
 		if req, ok := auditRecord["request"]; ok {
-			auditRequest = req.(map[string]interface{})
-			if auditRequest["path"] != "kv/data/foo" {
+			auditRequest, ok := req.(map[string]interface{})
+			require.True(t, ok)
+
+			path, ok := auditRequest["path"]
+			require.True(t, ok)
+
+			if path != "kv/data/foo" {
 				continue
 			}
+
+			testBuiltinPluginMetadataAuditLog(t, auditRequest, consts.PluginTypeSecrets.String())
 		}
-		testBuiltinPluginMetadataAuditLog(t, auditRequest, consts.PluginTypeSecrets.String())
 
-		auditResponse := map[string]interface{}{}
-		if req, ok := auditRecord["response"]; ok {
-			auditRequest = req.(map[string]interface{})
-			if auditResponse["path"] != "kv/data/foo" {
-				continue
-			}
+		if resp, ok := auditRecord["response"]; ok {
+			auditResponse, ok := resp.(map[string]interface{})
+			require.True(t, ok)
+
+			testBuiltinPluginMetadataAuditLog(t, auditResponse, consts.PluginTypeSecrets.String())
 		}
-		testBuiltinPluginMetadataAuditLog(t, auditResponse, consts.PluginTypeSecrets.String())
+	}
+}
+
+// TestLogical_SnapshotParams checks that a request is converted into a logical
+// request correctly when it contains snapshot query parameters
+func TestLogical_SnapshotParams(t *testing.T) {
+	core, _, rootToken := vault.TestCoreUnsealed(t)
+	testCases := []struct {
+		name                   string
+		method                 string
+		url                    string
+		body                   []byte
+		headers                map[string]string
+		wantData               map[string]interface{}
+		wantOperation          logical.Operation
+		wantRequiresSnapshotID string
+		wantError              bool
+	}{
+		{
+			name:                   "normal get",
+			method:                 http.MethodGet,
+			url:                    "https://example.com",
+			body:                   nil,
+			wantOperation:          logical.ReadOperation,
+			wantRequiresSnapshotID: "",
+		},
+		{
+			name:                   "normal list",
+			method:                 http.MethodGet,
+			url:                    "https://example.com?list=true",
+			body:                   nil,
+			wantOperation:          logical.ListOperation,
+			wantRequiresSnapshotID: "",
+		},
+		{
+			name:                   "snapshot list",
+			method:                 http.MethodGet,
+			url:                    "https://example.com?list=true&read_snapshot_id=1234",
+			body:                   nil,
+			wantData:               nil,
+			wantOperation:          logical.ListOperation,
+			wantRequiresSnapshotID: "1234",
+		},
+		{
+			name:                   "snapshot read",
+			method:                 http.MethodGet,
+			url:                    "https://example.com?read_snapshot_id=1234",
+			body:                   nil,
+			wantData:               nil,
+			wantOperation:          logical.ReadOperation,
+			wantRequiresSnapshotID: "1234",
+		},
+		{
+			name:   "snapshot list header",
+			method: http.MethodGet,
+			url:    "https://example.com?list=true",
+			body:   nil,
+			headers: map[string]string{
+				VaultSnapshotRecoverHeader: "1234",
+			},
+			wantData:               nil,
+			wantOperation:          logical.ListOperation,
+			wantRequiresSnapshotID: "",
+		},
+		{
+			name:   "snapshot read header",
+			method: http.MethodGet,
+			url:    "https://example.com",
+			headers: map[string]string{
+				VaultSnapshotRecoverHeader: "1234",
+			},
+			body:                   nil,
+			wantData:               nil,
+			wantOperation:          logical.ReadOperation,
+			wantRequiresSnapshotID: "",
+		},
+
+		{
+			name:   "normal update",
+			method: http.MethodPost,
+			url:    "https://example.com",
+			body:   []byte(`{"foo":"bar"}`),
+			wantData: map[string]interface{}{
+				"foo": "bar",
+			},
+			wantOperation: logical.UpdateOperation,
+		},
+		{
+			name:   "snapshot update",
+			method: http.MethodPost,
+			url:    "https://example.com?recover_snapshot_id=1234",
+			body:   []byte(`{"other_data":"abcd"}`),
+			wantData: map[string]interface{}{
+				"other_data": "abcd",
+			},
+			wantOperation:          logical.RecoverOperation,
+			wantRequiresSnapshotID: "1234",
+		},
+		{
+			name:   "snapshot update header",
+			method: http.MethodPost,
+			url:    "https://example.com",
+			body:   []byte(`{"other_data":"abcd"}`),
+			headers: map[string]string{
+				VaultSnapshotRecoverHeader: "1234",
+			},
+			wantData: map[string]interface{}{
+				"other_data": "abcd",
+			},
+			wantOperation:          logical.RecoverOperation,
+			wantRequiresSnapshotID: "1234",
+		},
+		{
+			name:   "recover operation no snapshot",
+			method: "RECOVER",
+			url:    "https://example.com",
+			body:   []byte(`{"other_data":"abcd"}`),
+			headers: map[string]string{
+				"other_header": "value",
+			},
+			wantError: true,
+		},
+		{
+			name:   "recover operation with snapshot",
+			method: "RECOVER",
+			url:    "https://example.com",
+			body:   []byte(`{"other_data":"abcd"}`),
+			headers: map[string]string{
+				VaultSnapshotRecoverHeader: "1234",
+			},
+			wantOperation: logical.RecoverOperation,
+			wantData: map[string]interface{}{
+				"other_data": "abcd",
+			},
+			wantRequiresSnapshotID: "1234",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req, _ := http.NewRequest(tc.method, tc.url, bytes.NewReader(tc.body))
+			req = req.WithContext(namespace.RootContext(nil))
+			req.Header.Add(consts.AuthHeaderName, rootToken)
+			for k, v := range tc.headers {
+				req.Header.Add(k, v)
+			}
+			lreq, _, status, err := buildLogicalRequest(core, nil, req, "")
+			if tc.wantError {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, 0, status)
+			require.Equal(t, tc.wantOperation, lreq.Operation)
+			require.Equal(t, tc.wantData, lreq.Data)
+			require.Equal(t, tc.wantRequiresSnapshotID, lreq.RequiresSnapshotID)
+		})
 	}
 }
diff --git a/http/options.go b/http/options.go
index b1200c018e7..f7c3f94786a 100644
--- a/http/options.go
+++ b/http/options.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/options_test.go b/http/options_test.go
index cee30c85c19..382b2a03eab 100644
--- a/http/options_test.go
+++ b/http/options_test.go
@@ -1,11 +1,19 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
 
 import (
+	"net/http"
+	"strings"
 	"testing"
 
+	"github.com/hashicorp/go-cleanhttp"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
+	"github.com/hashicorp/vault/internalshared/configutil"
+	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/vault"
+	"github.com/hashicorp/vault/version"
 	"github.com/stretchr/testify/require"
 )
 
@@ -157,3 +165,109 @@ func TestOptions_WithRedactVersion(t *testing.T) {
 		})
 	}
 }
+
+// TestRedactVersionListener tests that the version will be redacted
+// from e.g. sys/health and the OpenAPI response if `redact_version`
+// is set on the listener.
+func TestRedactVersionListener(t *testing.T) {
+	conf := &vault.CoreConfig{
+		EnableUI:        false,
+		EnableRaw:       true,
+		BuiltinRegistry: corehelpers.NewMockBuiltinRegistry(),
+	}
+	core, _, token := vault.TestCoreUnsealedWithConfig(t, conf)
+
+	// Setup listener without redaction
+	ln, addr := TestListener(t)
+	props := &vault.HandlerProperties{
+		Core: core,
+		ListenerConfig: &configutil.Listener{
+			RedactVersion: false,
+		},
+	}
+	TestServerWithListenerAndProperties(t, ln, addr, core, props)
+	defer ln.Close()
+	TestServerAuth(t, addr, token)
+
+	testRedactVersionEndpoints(t, addr, token, version.Version)
+
+	// Setup listener with redaction
+	ln, addr = TestListener(t)
+	props.ListenerConfig.RedactVersion = true
+	TestServerWithListenerAndProperties(t, ln, addr, core, props)
+	defer ln.Close()
+	TestServerAuth(t, addr, token)
+
+	testRedactVersionEndpoints(t, addr, token, "")
+}
+
+// testRedactVersionEndpoints tests the endpoints containing versions
+// contain the expected version
+func testRedactVersionEndpoints(t *testing.T, addr, token, expectedVersion string) {
+	client := cleanhttp.DefaultClient()
+	req, err := http.NewRequest("GET", addr+"/v1/auth/token?help=1", nil)
+	require.NoError(t, err)
+
+	req.Header.Set(consts.AuthHeaderName, token)
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+
+	testResponseStatus(t, resp, 200)
+
+	var actual map[string]interface{}
+	testResponseBody(t, resp, &actual)
+
+	require.NotNil(t, actual["openapi"])
+	openAPI, ok := actual["openapi"].(map[string]interface{})
+	require.True(t, ok)
+
+	require.NotNil(t, openAPI["info"])
+	info, ok := openAPI["info"].(map[string]interface{})
+	require.True(t, ok)
+
+	require.NotNil(t, info["version"])
+	version, ok := info["version"].(string)
+	require.True(t, ok)
+	require.Equal(t, expectedVersion, version)
+
+	req, err = http.NewRequest("GET", addr+"/v1/sys/internal/specs/openapi", nil)
+	require.NoError(t, err)
+
+	req.Header.Set(consts.AuthHeaderName, "")
+	resp, err = client.Do(req)
+	require.NoError(t, err)
+
+	testResponseStatus(t, resp, 200)
+	testResponseBody(t, resp, &actual)
+
+	require.NotNil(t, actual["info"])
+	info, ok = openAPI["info"].(map[string]interface{})
+	require.True(t, ok)
+
+	require.NotNil(t, info["version"])
+	version, ok = info["version"].(string)
+	require.True(t, ok)
+	require.Equal(t, expectedVersion, version)
+
+	req, err = http.NewRequest("GET", addr+"/v1/sys/health", nil)
+	require.NoError(t, err)
+
+	req.Header.Set(consts.AuthHeaderName, "")
+	resp, err = client.Do(req)
+	require.NoError(t, err)
+
+	testResponseStatus(t, resp, 200)
+	testResponseBody(t, resp, &actual)
+
+	require.NotNil(t, actual["version"])
+	version, ok = actual["version"].(string)
+	require.True(t, ok)
+
+	// sys/health is special and uses a different format to the OpenAPI
+	// version.GetVersion().VersionNumber() instead of version.Version
+	// We use substring to make sure the check works anyway.
+	// In practice, version.GetVersion().VersionNumber() will give something like 1.17.0-beta1
+	// and version.Version gives something like 1.17.0
+	require.Truef(t, strings.HasPrefix(version, expectedVersion), "version was not as expected, version=%s, expectedVersion=%s",
+		version, expectedVersion)
+}
diff --git a/http/plugin_test.go b/http/plugin_test.go
index b215a6b1c6b..29a4e6b1a1d 100644
--- a/http/plugin_test.go
+++ b/http/plugin_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -6,7 +6,7 @@ package http
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"os"
 	"reflect"
 	"sync"
@@ -15,7 +15,6 @@ import (
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/api"
 	bplugin "github.com/hashicorp/vault/builtin/plugin"
-	"github.com/hashicorp/vault/helper/benchhelpers"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/pluginutil"
@@ -48,7 +47,7 @@ func getPluginClusterAndCore(t *testing.T, logger log.Logger) (*vault.TestCluste
 		PluginDirectory: pluginDir,
 	}
 
-	cluster := vault.NewTestCluster(benchhelpers.TBtoT(t), coreConfig, &vault.TestClusterOptions{
+	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: Handler,
 	})
 	cluster.Start()
@@ -56,8 +55,8 @@ func getPluginClusterAndCore(t *testing.T, logger log.Logger) (*vault.TestCluste
 	cores := cluster.Cores
 	core := cores[0]
 
-	vault.TestWaitActive(benchhelpers.TBtoT(t), core.Core)
-	vault.TestAddTestPlugin(benchhelpers.TBtoT(t), core.Core, "mock-plugin", consts.PluginTypeSecrets, "", "TestPlugin_PluginMain",
+	vault.TestWaitActive(t, core.Core)
+	vault.TestAddTestPlugin(t, core.Core, "mock-plugin", consts.PluginTypeSecrets, "", "TestPlugin_PluginMain",
 		[]string{fmt.Sprintf("%s=%s", pluginutil.PluginCACertPEMEnv, cluster.CACertPEMFile)})
 
 	// Mount the mock plugin
@@ -148,7 +147,7 @@ func TestPlugin_MockRawResponse(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer resp.Body.Close()
-	body, err := ioutil.ReadAll(resp.Body)
+	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/http/priority/priority.go b/http/priority/priority.go
new file mode 100644
index 00000000000..c069f6aa1b1
--- /dev/null
+++ b/http/priority/priority.go
@@ -0,0 +1,86 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package priority
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+
+	"github.com/hashicorp/vault/sdk/helper/parseutil"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+const (
+	// VaultAOPForceRejectHeaderName is the name of an HTTP header that is used primarily
+	// for testing (it's not documented publicly). If set to "true" in a request
+	// that is subject to any form of Adaptive Overload Protection, the request
+	// will be rejected as if there is an overload. This is useful for
+	// deterministically testing the error handling plumbing as there are many
+	// possible code paths that need to be tested.
+	VaultAOPForceRejectHeaderName = "X-Vault-AOP-Force-Reject"
+)
+
+// Priorities are limited to 256 levels to keep the state space small making
+// enforcement data structures much more efficient.
+type AOPWritePriority uint8
+
+const (
+	// AlwaysDrop is intended for testing only and will cause the request to be
+	// rejected with a 503 even if the server is not overloaded.
+	AlwaysDrop AOPWritePriority = 0
+
+	// StandardHTTP is the default AOPWritePriority for HTTP requests.
+	StandardHTTP AOPWritePriority = 128
+
+	// NeverDrop is used to mark a request such that it will never be rejected.
+	// This is currently used as an administrative priority used for requests on
+	// paths which require sudo capabilities.
+	NeverDrop AOPWritePriority = 255
+)
+
+// String returns the string representation of the AOPWritePriority.
+func (p AOPWritePriority) String() string {
+	return strconv.FormatUint(uint64(p), 8)
+}
+
+// StringToAOPWritePriority converts a string to an AOPWritePriority.
+func StringToAOPWritePriority(s string) AOPWritePriority {
+	// Just swallow the error and fall back to the standard priority
+	p, err := strconv.ParseUint(s, 8, 8)
+	if err != nil {
+		return StandardHTTP
+	}
+	return AOPWritePriority(p)
+}
+
+// WrapRequestPriorityHandler provides special handling for headers with
+// X-Vault-AOP-Force-Reject set to `true`. This is useful for testing status
+// codes and return values related to Adaptive Overload Protection without
+// overloading Vault.
+func WrapRequestPriorityHandler(handler http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		if raw := req.Header.Get(VaultAOPForceRejectHeaderName); raw != "" {
+			if fail, _ := parseutil.ParseBool(raw); fail {
+				// Make the request fail as if Vault was overloaded. We don't
+				// explicitly error out here, but rather attach some context
+				// indicating that the PID controller should perform a
+				// rejection.  This allows us to test errors propagated from the
+				// WAL backend.
+				req = req.WithContext(ContextWithRequestPriority(req.Context(), AlwaysDrop))
+			}
+		}
+		handler.ServeHTTP(w, req)
+	})
+}
+
+// ContextWithRequestPriority returns a new context derived from ctx with the
+// given priority set.
+func ContextWithRequestPriority(ctx context.Context, priority AOPWritePriority) context.Context {
+	if _, ok := ctx.Value(logical.CtxKeyInFlightRequestPriority{}).(AOPWritePriority); ok {
+		return ctx
+	}
+
+	return context.WithValue(ctx, logical.CtxKeyInFlightRequestPriority{}, priority)
+}
diff --git a/http/sys_audit_test.go b/http/sys_audit_test.go
index d620a291e77..245ee619cb4 100644
--- a/http/sys_audit_test.go
+++ b/http/sys_audit_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_auth_test.go b/http/sys_auth_test.go
index fe6c4e27390..9fe57c7e77b 100644
--- a/http/sys_auth_test.go
+++ b/http/sys_auth_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_config_cors_test.go b/http/sys_config_cors_test.go
index 3f69888f81b..3934b1e1942 100644
--- a/http/sys_config_cors_test.go
+++ b/http/sys_config_cors_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_config_state_test.go b/http/sys_config_state_test.go
index 8081aaf642c..a837911851c 100644
--- a/http/sys_config_state_test.go
+++ b/http/sys_config_state_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -8,7 +8,7 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/go-test/deep"
+	"github.com/google/go-cmp/cmp"
 	"github.com/hashicorp/vault/command/server"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/vault"
@@ -42,6 +42,8 @@ func TestSysConfigState_Sanitized(t *testing.T) {
 				"cluster_addr":       "http://127.0.0.1:8201",
 				"disable_clustering": false,
 				"raft": map[string]interface{}{
+					"path":           "/storage/path/raft",
+					"node_id":        "raft1",
 					"max_entry_size": "2097152",
 				},
 			},
@@ -174,9 +176,13 @@ func TestSysConfigState_Sanitized(t *testing.T) {
 						"type":   "tcp",
 					},
 				},
-				"storage":                       tc.expectedStorageOutput,
-				"administrative_namespace_path": "",
-				"imprecise_lease_role_tracking": false,
+				"storage":                        tc.expectedStorageOutput,
+				"administrative_namespace_path":  "",
+				"imprecise_lease_role_tracking":  false,
+				"enable_post_unseal_trace":       false,
+				"post_unseal_trace_directory":    "",
+				"remove_irrevocable_lease_after": json.Number("0"),
+				"allow_audit_log_prefixing":      false,
 			}
 
 			if tc.expectedHAStorageOutput != nil {
@@ -197,7 +203,7 @@ func TestSysConfigState_Sanitized(t *testing.T) {
 			testResponseBody(t, resp, &actual)
 			expected["request_id"] = actual["request_id"]
 
-			if diff := deep.Equal(actual, expected); len(diff) > 0 {
+			if diff := cmp.Diff(actual, expected); len(diff) > 0 {
 				t.Fatalf("bad mismatch response body: diff: %v", diff)
 			}
 		})
diff --git a/http/sys_feature_flags.go b/http/sys_feature_flags.go
index 9e7244da750..abecd5dfc21 100644
--- a/http/sys_feature_flags.go
+++ b/http/sys_feature_flags.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"os"
 
+	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 )
 
@@ -46,6 +47,7 @@ func handleSysInternalFeatureFlags(core *vault.Core) http.Handler {
 		}
 
 		w.Header().Set("Content-Type", "application/json")
+		defer logical.IncrementResponseStatusCodeMetric(http.StatusOK)
 		w.WriteHeader(http.StatusOK)
 
 		// Generate the response
diff --git a/http/sys_generate_root.go b/http/sys_generate_root.go
index ffe0c14ec15..37bbdf0cd4f 100644
--- a/http/sys_generate_root.go
+++ b/http/sys_generate_root.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_generate_root_test.go b/http/sys_generate_root_test.go
index 8358d18a537..6dce3b361ea 100644
--- a/http/sys_generate_root_test.go
+++ b/http/sys_generate_root_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -231,7 +231,7 @@ func testCoreUnsealedWithAudit(t *testing.T, records **[][]byte) (*vault.Core, [
 	conf := &vault.CoreConfig{
 		BuiltinRegistry: corehelpers.NewMockBuiltinRegistry(),
 		AuditBackends: map[string]audit.Factory{
-			"noop": corehelpers.NoopAuditFactory(records),
+			"noop": audit.NoopAuditFactory(records),
 		},
 	}
 	core, keys, token := vault.TestCoreUnsealedWithConfig(t, conf)
diff --git a/http/sys_health.go b/http/sys_health.go
index 0e1f0ff2472..78438fa74bc 100644
--- a/http/sys_health.go
+++ b/http/sys_health.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -14,6 +14,7 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 	"github.com/hashicorp/vault/version"
 )
@@ -57,17 +58,31 @@ func handleSysHealthGet(core *vault.Core, w http.ResponseWriter, r *http.Request
 		return
 	}
 
-	opts, err := getOpts(opt...)
+	var tokenPresent bool
+	token := r.Header.Get(consts.AuthHeaderName)
 
-	if opts.withRedactVersion {
-		body.Version = opts.withRedactionValue
+	if token != "" {
+		// We don't care about the error, we just want to know if the token exists
+		lock := core.HALock()
+		lock.Lock()
+		tokenEntry, err := core.LookupToken(r.Context(), token)
+		lock.Unlock()
+		tokenPresent = err == nil && tokenEntry != nil
 	}
+	opts, _ := getOpts(opt...)
 
-	if opts.withRedactClusterName {
-		body.ClusterName = opts.withRedactionValue
+	if !tokenPresent {
+		if opts.withRedactVersion {
+			body.Version = opts.withRedactionValue
+		}
+
+		if opts.withRedactClusterName {
+			body.ClusterName = opts.withRedactionValue
+		}
 	}
 
 	w.Header().Set("Content-Type", "application/json")
+	defer logical.IncrementResponseStatusCodeMetric(code)
 	w.WriteHeader(code)
 
 	// Generate the response
@@ -81,6 +96,7 @@ func handleSysHealthHead(core *vault.Core, w http.ResponseWriter, r *http.Reques
 	if body != nil {
 		w.Header().Set("Content-Type", "application/json")
 	}
+	defer logical.IncrementResponseStatusCodeMetric(code)
 	w.WriteHeader(code)
 }
 
@@ -145,6 +161,20 @@ func getSysHealth(core *vault.Core, r *http.Request) (int, *HealthResponse, erro
 		perfStandbyCode = code
 	}
 
+	haUnhealthyCode := 474
+	if code, found, ok := fetchStatusCode(r, "haunhealthycode"); !ok {
+		return http.StatusBadRequest, nil, nil
+	} else if found {
+		haUnhealthyCode = code
+	}
+
+	removedCode := 530
+	if code, found, ok := fetchStatusCode(r, "removedcode"); !ok {
+		return http.StatusBadRequest, nil, nil
+	} else if found {
+		removedCode = code
+	}
+
 	ctx := context.Background()
 
 	// Check system status
@@ -162,13 +192,21 @@ func getSysHealth(core *vault.Core, r *http.Request) (int, *HealthResponse, erro
 		return http.StatusInternalServerError, nil, err
 	}
 
+	removed, shouldIncludeRemoved := core.IsRemovedFromCluster()
+
+	haHealthy, lastHeartbeat := core.GetHAHeartbeatHealth()
+
 	// Determine the status code
 	code := activeCode
 	switch {
 	case !init:
 		code = uninitCode
+	case removed:
+		code = removedCode
 	case sealed:
 		code = sealedCode
+	case !haHealthy && lastHeartbeat != nil:
+		code = haUnhealthyCode
 	case replicationState.HasState(consts.ReplicationDRSecondary):
 		code = drSecondaryCode
 	case perfStandby:
@@ -211,12 +249,24 @@ func getSysHealth(core *vault.Core, r *http.Request) (int, *HealthResponse, erro
 		ClockSkewMillis:            core.ActiveNodeClockSkewMillis(),
 		EchoDurationMillis:         core.EchoDuration().Milliseconds(),
 	}
+	if standby {
+		body.ReplicationPrimaryCanaryAgeMillis = core.GetReplicationLagMillisIgnoreErrs()
+	}
 
 	licenseState, err := core.EntGetLicenseState()
 	if err != nil {
 		return http.StatusInternalServerError, nil, err
 	}
 
+	if shouldIncludeRemoved {
+		body.RemovedFromCluster = &removed
+	}
+
+	if lastHeartbeat != nil {
+		body.LastRequestForwardingHeartbeatMillis = lastHeartbeat.Milliseconds()
+		body.HAConnectionHealthy = &haHealthy
+	}
+
 	if licenseState != nil {
 		body.License = &HealthResponseLicense{
 			State:      licenseState.State,
@@ -241,19 +291,23 @@ type HealthResponseLicense struct {
 }
 
 type HealthResponse struct {
-	Initialized                bool                   `json:"initialized"`
-	Sealed                     bool                   `json:"sealed"`
-	Standby                    bool                   `json:"standby"`
-	PerformanceStandby         bool                   `json:"performance_standby"`
-	ReplicationPerformanceMode string                 `json:"replication_performance_mode"`
-	ReplicationDRMode          string                 `json:"replication_dr_mode"`
-	ServerTimeUTC              int64                  `json:"server_time_utc"`
-	Version                    string                 `json:"version"`
-	Enterprise                 bool                   `json:"enterprise"`
-	ClusterName                string                 `json:"cluster_name,omitempty"`
-	ClusterID                  string                 `json:"cluster_id,omitempty"`
-	LastWAL                    uint64                 `json:"last_wal,omitempty"`
-	License                    *HealthResponseLicense `json:"license,omitempty"`
-	EchoDurationMillis         int64                  `json:"echo_duration_ms"`
-	ClockSkewMillis            int64                  `json:"clock_skew_ms"`
+	Initialized                          bool                   `json:"initialized"`
+	Sealed                               bool                   `json:"sealed"`
+	Standby                              bool                   `json:"standby"`
+	PerformanceStandby                   bool                   `json:"performance_standby"`
+	ReplicationPerformanceMode           string                 `json:"replication_performance_mode"`
+	ReplicationDRMode                    string                 `json:"replication_dr_mode"`
+	ServerTimeUTC                        int64                  `json:"server_time_utc"`
+	Version                              string                 `json:"version"`
+	Enterprise                           bool                   `json:"enterprise"`
+	ClusterName                          string                 `json:"cluster_name,omitempty"`
+	ClusterID                            string                 `json:"cluster_id,omitempty"`
+	LastWAL                              uint64                 `json:"last_wal,omitempty"`
+	License                              *HealthResponseLicense `json:"license,omitempty"`
+	EchoDurationMillis                   int64                  `json:"echo_duration_ms"`
+	ClockSkewMillis                      int64                  `json:"clock_skew_ms"`
+	ReplicationPrimaryCanaryAgeMillis    int64                  `json:"replication_primary_canary_age_ms"`
+	RemovedFromCluster                   *bool                  `json:"removed_from_cluster,omitempty"`
+	HAConnectionHealthy                  *bool                  `json:"ha_connection_healthy,omitempty"`
+	LastRequestForwardingHeartbeatMillis int64                  `json:"last_request_forwarding_heartbeat_ms,omitempty"`
 }
diff --git a/http/sys_health_test.go b/http/sys_health_test.go
index bd64ea85323..9331551564f 100644
--- a/http/sys_health_test.go
+++ b/http/sys_health_test.go
@@ -1,10 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
 
 import (
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
 	"testing"
@@ -15,6 +15,7 @@ import (
 	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
 )
 
 func TestSysHealth_get(t *testing.T) {
@@ -206,7 +207,7 @@ func TestSysHealth_head(t *testing.T) {
 			t.Fatalf("HEAD %v expected code %d, got %d.", queryurl, tt.code, resp.StatusCode)
 		}
 
-		data, err := ioutil.ReadAll(resp.Body)
+		data, err := io.ReadAll(resp.Body)
 		if err != nil {
 			t.Fatalf("err on %v: %s", queryurl, err)
 		}
@@ -215,3 +216,29 @@ func TestSysHealth_head(t *testing.T) {
 		}
 	}
 }
+
+// TestSysHealth_Removed checks that a removed node returns a 530 and sets
+// removed from cluster to be true. The test also checks that the removedcode
+// query parameter is respected.
+func TestSysHealth_Removed(t *testing.T) {
+	core, err := vault.TestCoreWithMockRemovableNodeHABackend(t, true)
+	require.NoError(t, err)
+	vault.TestCoreInit(t, core)
+	ln, addr := TestServer(t, core)
+	defer ln.Close()
+	raw, err := http.Get(addr + "/v1/sys/health")
+	require.NoError(t, err)
+	testResponseStatus(t, raw, 530)
+	healthResp := HealthResponse{}
+	testResponseBody(t, raw, &healthResp)
+	require.NotNil(t, healthResp.RemovedFromCluster)
+	require.True(t, *healthResp.RemovedFromCluster)
+
+	raw, err = http.Get(addr + "/v1/sys/health?removedcode=299")
+	require.NoError(t, err)
+	testResponseStatus(t, raw, 299)
+	secondHealthResp := HealthResponse{}
+	testResponseBody(t, raw, &secondHealthResp)
+	require.NotNil(t, secondHealthResp.RemovedFromCluster)
+	require.True(t, *secondHealthResp.RemovedFromCluster)
+}
diff --git a/http/sys_hostinfo_test.go b/http/sys_hostinfo_test.go
index 2df641ea840..670f2254134 100644
--- a/http/sys_hostinfo_test.go
+++ b/http/sys_hostinfo_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_in_flight_requests.go b/http/sys_in_flight_requests.go
index a31ae2ffc2f..2f265056a7a 100644
--- a/http/sys_in_flight_requests.go
+++ b/http/sys_in_flight_requests.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_in_flight_requests_test.go b/http/sys_in_flight_requests_test.go
index 880a9ad6156..049a4c66011 100644
--- a/http/sys_in_flight_requests_test.go
+++ b/http/sys_in_flight_requests_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_init.go b/http/sys_init.go
index fee10d972a4..481ad5e1233 100644
--- a/http/sys_init.go
+++ b/http/sys_init.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_init_test.go b/http/sys_init_test.go
index e9957f9a8f8..72d9da4926e 100644
--- a/http/sys_init_test.go
+++ b/http/sys_init_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_internal_test.go b/http/sys_internal_test.go
index 0be213672ac..00484f1b9c1 100644
--- a/http/sys_internal_test.go
+++ b/http/sys_internal_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_leader.go b/http/sys_leader.go
index c0c0cfd7d85..46cb0a7ab4e 100644
--- a/http/sys_leader.go
+++ b/http/sys_leader.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -6,6 +6,8 @@ package http
 import (
 	"net/http"
 
+	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 )
 
@@ -15,25 +17,36 @@ func handleSysLeader(core *vault.Core, opt ...ListenerConfigOption) http.Handler
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.Method {
 		case "GET":
-			handleSysLeaderGet(core, w, opt...)
+			handleSysLeaderGet(core, w, r, opt...)
 		default:
 			respondError(w, http.StatusMethodNotAllowed, nil)
 		}
 	})
 }
 
-func handleSysLeaderGet(core *vault.Core, w http.ResponseWriter, opt ...ListenerConfigOption) {
-	resp, err := core.GetLeaderStatus()
+func handleSysLeaderGet(core *vault.Core, w http.ResponseWriter, r *http.Request, opt ...ListenerConfigOption) {
+	var tokenPresent bool
+	token := r.Header.Get(consts.AuthHeaderName)
+	ctx := r.Context()
+
+	if token != "" {
+		// We don't care about the error, we just want to know if token exists
+		lock := core.HALock()
+		lock.Lock()
+		tokenEntry, err := core.LookupToken(ctx, token)
+		lock.Unlock()
+		tokenPresent = err == nil && tokenEntry != nil
+	}
+
+	if tokenPresent {
+		ctx = logical.CreateContextRedactionSettings(r.Context(), false, false, false)
+	}
+
+	resp, err := core.GetLeaderStatus(ctx)
 	if err != nil {
 		respondError(w, http.StatusInternalServerError, err)
 		return
 	}
 
-	opts, err := getOpts(opt...)
-	if opts.withRedactAddresses {
-		resp.LeaderAddress = opts.withRedactionValue
-		resp.LeaderClusterAddress = opts.withRedactionValue
-	}
-
 	respondOk(w, resp)
 }
diff --git a/http/sys_leader_test.go b/http/sys_leader_test.go
index e495e118703..933c21cacba 100644
--- a/http/sys_leader_test.go
+++ b/http/sys_leader_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_lease_test.go b/http/sys_lease_test.go
index 2b1025b06ad..31cc5fc0605 100644
--- a/http/sys_lease_test.go
+++ b/http/sys_lease_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_metrics.go b/http/sys_metrics.go
index 27cb45f2560..481319a88ac 100644
--- a/http/sys_metrics.go
+++ b/http/sys_metrics.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -42,12 +42,15 @@ func handleMetricsUnauthenticated(core *vault.Core) http.Handler {
 		w.Header().Set("Content-Type", resp.Data[logical.HTTPContentType].(string))
 		switch v := resp.Data[logical.HTTPRawBody].(type) {
 		case string:
+			defer logical.IncrementResponseStatusCodeMetric(status)
 			w.WriteHeader(status)
 			w.Write([]byte(v))
 		case []byte:
+			defer logical.IncrementResponseStatusCodeMetric(status)
 			w.WriteHeader(status)
 			w.Write(v)
 		default:
+			defer logical.IncrementResponseStatusCodeMetric(http.StatusInternalServerError)
 			respondError(w, http.StatusInternalServerError, fmt.Errorf("wrong response returned"))
 		}
 	})
diff --git a/http/sys_metrics_test.go b/http/sys_metrics_test.go
index 9500bff031b..3a193df3b62 100644
--- a/http/sys_metrics_test.go
+++ b/http/sys_metrics_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_monitor_test.go b/http/sys_monitor_test.go
index 5e6b49d0d14..91f39052b83 100644
--- a/http/sys_monitor_test.go
+++ b/http/sys_monitor_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -97,7 +97,8 @@ func TestSysMonitorStreamingLogs(t *testing.T) {
 			}
 			jsonLog := &jsonlog{}
 
-			timeCh := time.After(5 * time.Second)
+			// default timeout is 90 seconds
+			timeCh := time.After(120 * time.Second)
 
 			for {
 				select {
@@ -119,7 +120,7 @@ func TestSysMonitorStreamingLogs(t *testing.T) {
 						return
 					}
 				case <-timeCh:
-					t.Fatal("Failed to get a DEBUG message after 5 seconds")
+					t.Fatal("Failed to get a DEBUG message after 120 seconds")
 				}
 			}
 		})
diff --git a/http/sys_mount_test.go b/http/sys_mount_test.go
index 9db7fed3749..23b7ad4e4ab 100644
--- a/http/sys_mount_test.go
+++ b/http/sys_mount_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_mounts_test.go b/http/sys_mounts_test.go
index 4f597f474a2..e5fd4abffd6 100644
--- a/http/sys_mounts_test.go
+++ b/http/sys_mounts_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_policy_test.go b/http/sys_policy_test.go
index bf797cede8c..c6924bc1ff6 100644
--- a/http/sys_policy_test.go
+++ b/http/sys_policy_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_raft.go b/http/sys_raft.go
index e209f0a6f4e..b2055d674c6 100644
--- a/http/sys_raft.go
+++ b/http/sys_raft.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -12,6 +12,7 @@ import (
 	"net/http"
 
 	"github.com/hashicorp/go-secure-stdlib/tlsutil"
+	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/physical/raft"
 	"github.com/hashicorp/vault/vault"
 )
@@ -80,7 +81,7 @@ func handleSysRaftJoinPost(core *vault.Core, w http.ResponseWriter, r *http.Requ
 			AutoJoin:       req.AutoJoin,
 			AutoJoinScheme: req.AutoJoinScheme,
 			AutoJoinPort:   req.AutoJoinPort,
-			LeaderAPIAddr:  req.LeaderAPIAddr,
+			LeaderAPIAddr:  configutil.NormalizeAddr(req.LeaderAPIAddr),
 			TLSConfig:      tlsConfig,
 			Retry:          req.Retry,
 		},
diff --git a/http/sys_rekey.go b/http/sys_rekey.go
index 0968076246c..a9d9618fa5c 100644
--- a/http/sys_rekey.go
+++ b/http/sys_rekey.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -10,6 +10,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"time"
 
 	"github.com/hashicorp/vault/helper/pgpkeys"
 	"github.com/hashicorp/vault/sdk/helper/consts"
@@ -20,7 +21,7 @@ func handleSysRekeyInit(core *vault.Core, recovery bool) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		standby, _ := core.Standby()
 		if standby {
-			respondStandby(core, w, r.URL)
+			respondStandby(core, w, r)
 			return
 		}
 
@@ -134,6 +135,7 @@ func handleSysRekeyInitPut(ctx context.Context, core *vault.Core, recovery bool,
 		PGPKeys:              req.PGPKeys,
 		Backup:               req.Backup,
 		VerificationRequired: req.RequireVerification,
+		Created:              time.Now().UTC(),
 	}, recovery)
 	if err != nil {
 		respondError(w, err.Code(), err)
@@ -144,7 +146,13 @@ func handleSysRekeyInitPut(ctx context.Context, core *vault.Core, recovery bool,
 }
 
 func handleSysRekeyInitDelete(ctx context.Context, core *vault.Core, recovery bool, w http.ResponseWriter, r *http.Request) {
-	if err := core.RekeyCancel(recovery); err != nil {
+	var req RekeyDeleteRequest
+	if _, err := parseJSONRequest(core.PerfStandby(), r, w, &req); err != nil {
+		respondError(w, http.StatusBadRequest, err)
+		return
+	}
+
+	if err := core.RekeyCancel(recovery, req.Nonce, 10*time.Minute); err != nil {
 		respondError(w, err.Code(), err)
 		return
 	}
@@ -155,7 +163,7 @@ func handleSysRekeyUpdate(core *vault.Core, recovery bool) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		standby, _ := core.Standby()
 		if standby {
-			respondStandby(core, w, r.URL)
+			respondStandby(core, w, r)
 			return
 		}
 
@@ -228,7 +236,7 @@ func handleSysRekeyVerify(core *vault.Core, recovery bool) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		standby, _ := core.Standby()
 		if standby {
-			respondStandby(core, w, r.URL)
+			respondStandby(core, w, r)
 			return
 		}
 
@@ -412,3 +420,8 @@ type RekeyVerificationUpdateResponse struct {
 	Nonce    string `json:"nonce"`
 	Complete bool   `json:"complete"`
 }
+
+type RekeyDeleteRequest struct {
+	Nonce string `json:"nonce"`
+	Key   string `json:"key"`
+}
diff --git a/http/sys_rekey_test.go b/http/sys_rekey_test.go
index e3966444769..babe79c1793 100644
--- a/http/sys_rekey_test.go
+++ b/http/sys_rekey_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -149,7 +149,7 @@ func TestSysRekey_Init_Cancel(t *testing.T) {
 		defer cluster.Cleanup()
 		cl := cluster.Cores[0].Client
 
-		_, err := cl.Logical().Write("sys/rekey/init", map[string]interface{}{
+		initResp, err := cl.Logical().Write("sys/rekey/init", map[string]interface{}{
 			"secret_shares":    5,
 			"secret_threshold": 3,
 		})
@@ -157,7 +157,7 @@ func TestSysRekey_Init_Cancel(t *testing.T) {
 			t.Fatalf("err: %s", err)
 		}
 
-		_, err = cl.Logical().Delete("sys/rekey/init")
+		err = cl.Sys().RekeyCancelWithNonce(initResp.Data["nonce"].(string))
 		if err != nil {
 			t.Fatalf("err: %s", err)
 		}
@@ -278,8 +278,12 @@ func TestSysRekey_ReInitUpdate(t *testing.T) {
 		"secret_threshold": 3,
 	})
 	testResponseStatus(t, resp, 200)
+	var initResp map[string]interface{}
+	testResponseBody(t, resp, &initResp)
 
-	resp = testHttpDelete(t, token, addr+"/v1/sys/rekey/init")
+	resp = testHttpDeleteData(t, token, addr+"/v1/sys/rekey/init", map[string]interface{}{
+		"nonce": initResp["nonce"].(string),
+	})
 	testResponseStatus(t, resp, 204)
 
 	resp = testHttpPut(t, token, addr+"/v1/sys/rekey/init", map[string]interface{}{
diff --git a/http/sys_rotate_test.go b/http/sys_rotate_test.go
index 6be03ce3759..f7cadd2e087 100644
--- a/http/sys_rotate_test.go
+++ b/http/sys_rotate_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/sys_seal.go b/http/sys_seal.go
index a17c6eb660b..08f305d9279 100644
--- a/http/sys_seal.go
+++ b/http/sys_seal.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -85,6 +85,14 @@ func handleSysUnseal(core *vault.Core) http.Handler {
 			return
 		}
 
+		// Check if this node was removed from the cluster. If so, respond with an error and return,
+		// since we don't want a removed node to be able to unseal.
+		removed, ok := core.IsRemovedFromCluster()
+		if ok && removed {
+			respondError(w, http.StatusInternalServerError, errors.New("node was removed from a HA cluster"))
+			return
+		}
+
 		// Parse the request
 		var req UnsealRequest
 		if _, err := parseJSONRequest(core.PerfStandby(), r, w, &req); err != nil {
@@ -98,7 +106,7 @@ func handleSysUnseal(core *vault.Core) http.Handler {
 				return
 			}
 			core.ResetUnsealProcess()
-			handleSysSealStatusRaw(core, w)
+			handleSysSealStatusRaw(core, w, r)
 			return
 		}
 
@@ -148,7 +156,7 @@ func handleSysUnseal(core *vault.Core) http.Handler {
 		}
 
 		// Return the seal status
-		handleSysSealStatusRaw(core, w)
+		handleSysSealStatusRaw(core, w, r)
 	})
 }
 
@@ -159,7 +167,7 @@ func handleSysSealStatus(core *vault.Core, opt ...ListenerConfigOption) http.Han
 			return
 		}
 
-		handleSysSealStatusRaw(core, w, opt...)
+		handleSysSealStatusRaw(core, w, r, opt...)
 	})
 }
 
@@ -174,25 +182,30 @@ func handleSysSealBackendStatus(core *vault.Core) http.Handler {
 	})
 }
 
-func handleSysSealStatusRaw(core *vault.Core, w http.ResponseWriter, opt ...ListenerConfigOption) {
-	ctx := context.Background()
-	status, err := core.GetSealStatus(ctx, true)
-	if err != nil {
-		respondError(w, http.StatusInternalServerError, err)
-		return
+func handleSysSealStatusRaw(core *vault.Core, w http.ResponseWriter, r *http.Request, opt ...ListenerConfigOption) {
+	ctx := r.Context()
+
+	var tokenPresent bool
+	token := r.Header.Get(consts.AuthHeaderName)
+	if token != "" {
+		// We don't care about the error, we just want to know if the token exists
+		lock := core.HALock()
+		lock.Lock()
+		tokenEntry, err := core.LookupToken(ctx, token)
+		lock.Unlock()
+		tokenPresent = err == nil && tokenEntry != nil
 	}
 
-	opts, err := getOpts(opt...)
-
-	if opts.withRedactVersion {
-		status.Version = opts.withRedactionValue
-		status.BuildDate = opts.withRedactionValue
+	// If there are is no valid token then we will redact the specified values
+	if tokenPresent {
+		ctx = logical.CreateContextRedactionSettings(ctx, false, false, false)
 	}
 
-	if opts.withRedactClusterName {
-		status.ClusterName = opts.withRedactionValue
+	status, err := core.GetSealStatus(ctx, true)
+	if err != nil {
+		respondError(w, http.StatusInternalServerError, err)
+		return
 	}
-
 	respondOk(w, status)
 }
 
@@ -203,7 +216,6 @@ func handleSysSealBackendStatusRaw(core *vault.Core, w http.ResponseWriter, r *h
 		respondError(w, http.StatusInternalServerError, err)
 		return
 	}
-
 	respondOk(w, status)
 }
 
diff --git a/http/sys_seal_test.go b/http/sys_seal_test.go
index f11335bac52..93a8d18ae6f 100644
--- a/http/sys_seal_test.go
+++ b/http/sys_seal_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -15,11 +15,17 @@ import (
 	"testing"
 
 	"github.com/go-test/deep"
+	"github.com/hashicorp/go-cleanhttp"
+	"github.com/hashicorp/vault/audit"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
+	"github.com/hashicorp/vault/internalshared/configutil"
+	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 	"github.com/hashicorp/vault/vault/seal"
 	"github.com/hashicorp/vault/version"
+	"github.com/stretchr/testify/assert"
 )
 
 func TestSysSealStatus(t *testing.T) {
@@ -433,6 +439,35 @@ func TestSysUnseal_Reset(t *testing.T) {
 	}
 }
 
+// TestSysUnseal_NodeRemovedFromCluster verifies that a call to /sys/unseal fails
+// with an appropriate error when the node has been removed from a cluster.
+func TestSysUnseal_NodeRemovedFromCluster(t *testing.T) {
+	core, err := vault.TestCoreWithMockRemovableNodeHABackend(t, true)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	ln, addr := TestServer(t, core)
+	defer ln.Close()
+
+	// The value of key doesn't matter here, we just need to make a request.
+	resp := testHttpPut(t, "", addr+"/v1/sys/unseal", map[string]interface{}{
+		"key": "foo",
+	})
+
+	testResponseStatus(t, resp, 500)
+	var actual map[string]interface{}
+	testResponseBody(t, resp, &actual)
+
+	errors, ok := actual["errors"].([]interface{})
+	if !ok {
+		t.Fatalf("no errors in the response, request should be invalid")
+	}
+	expectedErrorMsg := "node was removed from a HA cluster"
+	if !strings.Contains(errors[0].(string), expectedErrorMsg) {
+		t.Fatalf("error message should contain %q", expectedErrorMsg)
+	}
+}
+
 // Test Seal's permissions logic, which is slightly different than normal code
 // paths in that it queries the ACL rather than having checkToken do it. This
 // is because it was abusing RootPaths in logical_system, but that caused some
@@ -556,3 +591,64 @@ func TestSysStepDown(t *testing.T) {
 	resp := testHttpPut(t, token, addr+"/v1/sys/step-down", nil)
 	testResponseStatus(t, resp, 204)
 }
+
+// TestSysSealStatusRedaction tests that the response from a
+// a request to sys/seal-status are redacted only if no valid token
+// is provided with the request
+func TestSysSealStatusRedaction(t *testing.T) {
+	conf := &vault.CoreConfig{
+		EnableUI:        false,
+		EnableRaw:       true,
+		BuiltinRegistry: corehelpers.NewMockBuiltinRegistry(),
+		AuditBackends: map[string]audit.Factory{
+			"file": audit.NewFileBackend,
+		},
+	}
+	core, _, token := vault.TestCoreUnsealedWithConfig(t, conf)
+
+	// Setup new custom listener
+	ln, addr := TestListener(t)
+	props := &vault.HandlerProperties{
+		Core: core,
+		ListenerConfig: &configutil.Listener{
+			RedactVersion: true,
+		},
+	}
+	TestServerWithListenerAndProperties(t, ln, addr, core, props)
+	defer ln.Close()
+	TestServerAuth(t, addr, token)
+
+	client := cleanhttp.DefaultClient()
+
+	// Check seal-status
+	req, err := http.NewRequest("GET", addr+"/v1/sys/seal-status", nil)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	req.Header.Set(consts.AuthHeaderName, token)
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	testResponseStatus(t, resp, 200)
+
+	// Verify that version exists when provided a valid token
+	var actual map[string]interface{}
+	testResponseStatus(t, resp, 200)
+	testResponseBody(t, resp, &actual)
+	assert.NotEmpty(t, actual["version"])
+
+	// Verify that version is redacted when no token is provided
+	req, err = http.NewRequest("GET", addr+"/v1/sys/seal-status", nil)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	req.Header.Set(consts.AuthHeaderName, "")
+	resp, err = client.Do(req)
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	testResponseStatus(t, resp, 200)
+	testResponseBody(t, resp, &actual)
+	assert.Empty(t, actual["version"])
+}
diff --git a/http/sys_wrapping_test.go b/http/sys_wrapping_test.go
index d059e5830f4..9d97741dbee 100644
--- a/http/sys_wrapping_test.go
+++ b/http/sys_wrapping_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/testing.go b/http/testing.go
index 5797e4dc5b8..795582ee583 100644
--- a/http/testing.go
+++ b/http/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/unwrapping_raw_body_test.go b/http/unwrapping_raw_body_test.go
index de145486dba..e4b12c8894d 100644
--- a/http/unwrapping_raw_body_test.go
+++ b/http/unwrapping_raw_body_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
diff --git a/http/util.go b/http/util.go
index 88a94f413c1..a0ad5a254ca 100644
--- a/http/util.go
+++ b/http/util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package http
@@ -14,6 +14,8 @@ import (
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/limits"
+	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 	"github.com/hashicorp/vault/vault/quotas"
@@ -21,6 +23,30 @@ import (
 
 var nonVotersAllowed = false
 
+// ctxKeyRoleBasedQuota is used to signal that role-based quota resolution
+// is needed for the request.
+type ctxKeyRoleBasedQuota struct{}
+
+func (c ctxKeyRoleBasedQuota) String() string {
+	return "role-based-quota"
+}
+
+// resetBodyIfRead deals with creating a new body for the request if a portion
+// of it has been read into buf. This function handles both the main body and
+// the full, non-limited original body stored in the context.
+func resetBodyIfRead(r *http.Request, buf *bytes.Buffer) *http.Request {
+	if buf.Len() > 0 {
+		r.Body = newMultiReaderCloser(buf, r.Body)
+		originalBody, ok := logical.ContextOriginalBodyValue(r.Context())
+		if ok {
+			r = r.WithContext(logical.CreateContextOriginalBody(r.Context(), newMultiReaderCloser(buf, originalBody)))
+		}
+	}
+	return r
+}
+
+// wrapMaxRequestSizeHandler limits the size of the request body to the
+// configured size
 func wrapMaxRequestSizeHandler(handler http.Handler, props *vault.HandlerProperties) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		var maxRequestSize int64
@@ -42,12 +68,82 @@ func wrapMaxRequestSizeHandler(handler http.Handler, props *vault.HandlerPropert
 	})
 }
 
+// wrapJSONLimitsHandler enforces limits on JSON request bodies
+func wrapJSONLimitsHandler(handler http.Handler, props *vault.HandlerProperties) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var maxRequestSize, maxJSONDepth, maxStringValueLength, maxObjectEntryCount, maxArrayElementCount, maxToken int64
+
+		if props.ListenerConfig != nil {
+			maxRequestSize = props.ListenerConfig.MaxRequestSize
+			maxJSONDepth = props.ListenerConfig.CustomMaxJSONDepth
+			maxStringValueLength = props.ListenerConfig.CustomMaxJSONStringValueLength
+			maxObjectEntryCount = props.ListenerConfig.CustomMaxJSONObjectEntryCount
+			maxArrayElementCount = props.ListenerConfig.CustomMaxJSONArrayElementCount
+			maxToken = props.ListenerConfig.CustomMaxJSONToken
+		}
+
+		if maxRequestSize == 0 {
+			maxRequestSize = DefaultMaxRequestSize
+		}
+		if maxJSONDepth == 0 {
+			maxJSONDepth = CustomMaxJSONDepth
+		}
+		if maxStringValueLength == 0 {
+			maxStringValueLength = CustomMaxJSONStringValueLength
+		}
+		if maxObjectEntryCount == 0 {
+			maxObjectEntryCount = CustomMaxJSONObjectEntryCount
+		}
+		if maxArrayElementCount == 0 {
+			maxArrayElementCount = CustomMaxJSONArrayElementCount
+		}
+		if maxToken == 0 {
+			maxToken = CustomMaxJSONToken
+		}
+		jsonLimits := jsonutil.JSONLimits{
+			MaxDepth:             int(maxJSONDepth),
+			MaxStringValueLength: int(maxStringValueLength),
+			MaxObjectEntryCount:  int(maxObjectEntryCount),
+			MaxArrayElementCount: int(maxArrayElementCount),
+			MaxTokens:            int(maxToken),
+		}
+
+		// If the payload is JSON, the VerifyMaxDepthStreaming function will perform validations.
+		buf, err := jsonLimitsValidation(r, maxRequestSize, jsonLimits)
+		if err != nil {
+			respondError(w, http.StatusInternalServerError, err)
+			return
+		}
+
+		r = resetBodyIfRead(r, buf)
+
+		handler.ServeHTTP(w, r)
+	})
+}
+
+func jsonLimitsValidation(r *http.Request, maxRequestSize int64, jsonLimits jsonutil.JSONLimits) (*bytes.Buffer, error) {
+	// The TeeReader reads from the original body and writes a copy to our buffer.
+	var limitedTeeReader io.Reader
+	buf := &bytes.Buffer{}
+	bodyReader := r.Body
+	limitedTeeReader = io.TeeReader(bodyReader, buf)
+	var maxSize *int64
+	if maxRequestSize > 0 {
+		maxSize = &maxRequestSize
+	}
+	_, err := jsonutil.VerifyMaxDepthStreaming(limitedTeeReader, jsonLimits, maxSize)
+	if err != nil {
+		return nil, err
+	}
+	return buf, nil
+}
+
 func wrapRequestLimiterHandler(handler http.Handler, props *vault.HandlerProperties) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		request := r.WithContext(
 			context.WithValue(
 				r.Context(),
-				logical.CtxKeyDisableRequestLimiter{},
+				limits.CtxKeyDisableRequestLimiter{},
 				props.ListenerConfig.DisableRequestLimiter,
 			),
 		)
@@ -55,6 +151,44 @@ func wrapRequestLimiterHandler(handler http.Handler, props *vault.HandlerPropert
 	})
 }
 
+// withRoleRateLimitQuotaWrapping performs any quota checking for request
+// that require role resolution
+func withRoleRateLimitQuotaWrapping(handler http.Handler, core *vault.Core) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// if there's a quota that requires role resolution, it will be in the
+		// context
+		// if the context value is nil, then no role-based quota resolution is
+		// needed and we can continue handling the request
+		quotaReqValue := r.Context().Value(ctxKeyRoleBasedQuota{})
+		if quotaReqValue == nil {
+			handler.ServeHTTP(w, r)
+			return
+		}
+
+		quotaReq := quotaReqValue.(*quotas.Request)
+
+		buf := bytes.Buffer{}
+		teeReader := io.TeeReader(r.Body, &buf)
+		role := core.DetermineRoleFromLoginRequestFromReader(r.Context(), quotaReq.MountPath, teeReader, getConnection(r), r.Header)
+
+		// Reset the body if it was read
+		r = resetBodyIfRead(r, &buf)
+
+		// add an entry to the context to prevent recalculating request role unnecessarily
+		r = r.WithContext(context.WithValue(r.Context(), logical.CtxKeyRequestRole{}, role))
+		quotaReq.Role = role
+
+		if hitRateLimitQuota(core, r, quotaReq, w) {
+			return
+		}
+
+		handler.ServeHTTP(w, r)
+	})
+}
+
+// rateLimitQuotaWrapping performs quota checking for requests that do not
+// require role resolution. If the request does require role resolution, the
+// quota request is added to the context and handled by withRoleRateLimitQuotaWrapping
 func rateLimitQuotaWrapping(handler http.Handler, core *vault.Core) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ns, err := namespace.FromContext(r.Context())
@@ -81,6 +215,8 @@ func rateLimitQuotaWrapping(handler http.Handler, core *vault.Core) http.Handler
 			ClientAddress: parseRemoteIPAddress(r),
 		}
 
+		entRlqRequestFields(core, r, quotaReq)
+
 		// This checks if any role based quota is required (LCQ or RLQ).
 		requiresResolveRole, err := core.ResolveRoleForQuotas(r.Context(), quotaReq)
 		if err != nil {
@@ -89,69 +225,71 @@ func rateLimitQuotaWrapping(handler http.Handler, core *vault.Core) http.Handler
 			return
 		}
 
-		// If any role-based quotas are enabled for this namespace/mount, just
-		// do the role resolution once here.
+		// If any role-based quotas are enabled for this namespace/mount, wait until after the
+		// json limits checks to perform it
 		if requiresResolveRole {
-			buf := bytes.Buffer{}
-			teeReader := io.TeeReader(r.Body, &buf)
-			role := core.DetermineRoleFromLoginRequestFromReader(r.Context(), mountPath, teeReader)
-
-			// Reset the body if it was read
-			if buf.Len() > 0 {
-				r.Body = io.NopCloser(&buf)
-				originalBody, ok := logical.ContextOriginalBodyValue(r.Context())
-				if ok {
-					r = r.WithContext(logical.CreateContextOriginalBody(r.Context(), newMultiReaderCloser(&buf, originalBody)))
-				}
-			}
-			// add an entry to the context to prevent recalculating request role unnecessarily
-			r = r.WithContext(context.WithValue(r.Context(), logical.CtxKeyRequestRole{}, role))
-			quotaReq.Role = role
+			// Add a context entry to indicate that role-based quota resolution
+			// is needed downstream
+			r = r.WithContext(context.WithValue(r.Context(), ctxKeyRoleBasedQuota{}, quotaReq))
+			handler.ServeHTTP(w, r)
+			return
 		}
 
-		quotaResp, err := core.ApplyRateLimitQuota(r.Context(), quotaReq)
-		if err != nil {
-			core.Logger().Error("failed to apply quota", "path", path, "error", err)
-			respondError(w, http.StatusInternalServerError, err)
+		if hitRateLimitQuota(core, r, quotaReq, w) {
 			return
 		}
 
-		if core.RateLimitResponseHeadersEnabled() {
-			for h, v := range quotaResp.Headers {
-				w.Header().Set(h, v)
-			}
+		handler.ServeHTTP(w, r)
+		return
+	})
+}
+
+// hitRateLimitQuota checks the applies the rate limit quota and handles writing
+// headers, as well as any auditing and logging if the quota is exceeded. The
+// function returns true if the quota was exceeded and the request should not
+// be processed further.
+func hitRateLimitQuota(core *vault.Core, r *http.Request, quotaReq *quotas.Request, w http.ResponseWriter) bool {
+	path := quotaReq.Path
+	quotaResp, err := core.ApplyRateLimitQuota(r.Context(), quotaReq)
+	if err != nil {
+		core.Logger().Error("failed to apply quota", "path", path, "error", err)
+		respondError(w, http.StatusInternalServerError, err)
+		return true
+	}
+
+	if core.RateLimitResponseHeadersEnabled() {
+		for h, v := range quotaResp.Headers {
+			w.Header().Set(h, v)
 		}
+	}
 
-		if !quotaResp.Allowed {
-			quotaErr := fmt.Errorf("request path %q: %w", path, quotas.ErrRateLimitQuotaExceeded)
-			respondError(w, http.StatusTooManyRequests, quotaErr)
+	if !quotaResp.Allowed {
+		quotaErr := fmt.Errorf("request path %q: %w", path, quotas.ErrRateLimitQuotaExceeded)
+		respondError(w, http.StatusTooManyRequests, quotaErr)
 
-			if core.Logger().IsTrace() {
-				core.Logger().Trace("request rejected due to rate limit quota violation", "request_path", path)
-			}
+		if core.Logger().IsTrace() {
+			core.Logger().Trace("request rejected due to rate limit quota violation", "request_path", path)
+		}
 
-			if core.RateLimitAuditLoggingEnabled() {
-				req, _, status, err := buildLogicalRequestNoAuth(core.PerfStandby(), core.RouterAccess(), w, r)
-				if err != nil || status != 0 {
-					respondError(w, status, err)
-					return
-				}
-
-				err = core.AuditLogger().AuditRequest(r.Context(), &logical.LogInput{
-					Request:  req,
-					OuterErr: quotaErr,
-				})
-				if err != nil {
-					core.Logger().Warn("failed to audit log request rejection caused by rate limit quota violation", "error", err)
-				}
+		if core.RateLimitAuditLoggingEnabled() {
+			req, _, status, err := buildLogicalRequestNoAuth(core.PerfStandby(), core.RouterAccess(), w, r)
+			if err != nil || status != 0 {
+				respondError(w, status, err)
+				return true
 			}
 
-			return
+			err = core.AuditLogger().AuditRequest(r.Context(), &logical.LogInput{
+				Request:  req,
+				OuterErr: quotaErr,
+			})
+			if err != nil {
+				core.Logger().Warn("failed to audit log request rejection caused by rate limit quota violation", "error", err)
+			}
 		}
 
-		handler.ServeHTTP(w, r)
-		return
-	})
+		return true
+	}
+	return false
 }
 
 func disableReplicationStatusEndpointWrapping(h http.Handler) http.Handler {
@@ -162,6 +300,14 @@ func disableReplicationStatusEndpointWrapping(h http.Handler) http.Handler {
 	})
 }
 
+func redactionSettingsWrapping(h http.Handler, redactVersion, redactAddresses, redactClusterName bool) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		request := r.WithContext(logical.CreateContextRedactionSettings(r.Context(), redactVersion, redactAddresses, redactClusterName))
+
+		h.ServeHTTP(w, request)
+	})
+}
+
 func parseRemoteIPAddress(r *http.Request) string {
 	ip, _, err := net.SplitHostPort(r.RemoteAddr)
 	if err != nil {
diff --git a/http/util_oss.go b/http/util_oss.go
new file mode 100644
index 00000000000..d275e1aef29
--- /dev/null
+++ b/http/util_oss.go
@@ -0,0 +1,27 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package http
+
+import (
+	"net/http"
+
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/vault"
+	"github.com/hashicorp/vault/vault/quotas"
+)
+
+func entWrapGenericHandler(core *vault.Core, in http.Handler, props *vault.HandlerProperties) http.Handler {
+	// Wrap the help wrapped handler with another layer with a generic
+	// handler
+	return wrapGenericHandler(core, in, props)
+}
+
+func entAdditionalRoutes(mux *http.ServeMux, core *vault.Core) {}
+
+func entAdjustResponse(core *vault.Core, w http.ResponseWriter, req *logical.Request) {
+}
+
+func entRlqRequestFields(core *vault.Core, r *http.Request, quotaReq *quotas.Request) {}
diff --git a/http/util_stubs_oss.go b/http/util_stubs_oss.go
deleted file mode 100644
index 7bffec7924e..00000000000
--- a/http/util_stubs_oss.go
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-//go:build !enterprise
-
-package http
-
-import (
-	"net/http"
-
-	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/hashicorp/vault/vault"
-)
-
-//go:generate go run github.com/hashicorp/vault/tools/stubmaker
-
-func entWrapGenericHandler(core *vault.Core, in http.Handler, props *vault.HandlerProperties) http.Handler {
-	// Wrap the help wrapped handler with another layer with a generic
-	// handler
-	return wrapGenericHandler(core, in, props)
-}
-
-func entAdditionalRoutes(mux *http.ServeMux, core *vault.Core) {}
-
-func entAdjustResponse(core *vault.Core, w http.ResponseWriter, req *logical.Request) {
-}
diff --git a/internal/observability/event/errors.go b/internal/observability/event/errors.go
index a8ad7516fd7..3c9fd122fe4 100644
--- a/internal/observability/event/errors.go
+++ b/internal/observability/event/errors.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
diff --git a/internal/observability/event/event_type.go b/internal/observability/event/event_type.go
index a6e10e4903c..a68fc5374b1 100644
--- a/internal/observability/event/event_type.go
+++ b/internal/observability/event/event_type.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -19,12 +19,11 @@ const (
 
 // Validate ensures that EventType is one of the set of allowed event types.
 func (t EventType) Validate() error {
-	const op = "event.(EventType).Validate"
 	switch t {
 	case AuditType:
 		return nil
 	default:
-		return fmt.Errorf("%s: '%s' is not a valid event type: %w", op, t, ErrInvalidParameter)
+		return fmt.Errorf("invalid event type %q: %w", t, ErrInvalidParameter)
 	}
 }
 
@@ -40,3 +39,8 @@ func GenerateNodeID() (eventlogger.NodeID, error) {
 func (t EventType) String() string {
 	return string(t)
 }
+
+// AsEventType returns the EventType in a format for eventlogger.
+func (t EventType) AsEventType() eventlogger.EventType {
+	return eventlogger.EventType(t.String())
+}
diff --git a/internal/observability/event/event_type_test.go b/internal/observability/event/event_type_test.go
index 9bc36f99511..2ac8df1aec3 100644
--- a/internal/observability/event/event_type_test.go
+++ b/internal/observability/event/event_type_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -23,12 +23,12 @@ func TestEventType_Validate(t *testing.T) {
 		"empty": {
 			Value:         "",
 			IsValid:       false,
-			ExpectedError: "event.(EventType).Validate: '' is not a valid event type: invalid parameter",
+			ExpectedError: "invalid event type \"\": invalid parameter",
 		},
 		"random": {
 			Value:         "random",
 			IsValid:       false,
-			ExpectedError: "event.(EventType).Validate: 'random' is not a valid event type: invalid parameter",
+			ExpectedError: "invalid event type \"random\": invalid parameter",
 		},
 	}
 
diff --git a/internal/observability/event/node_metrics_counter.go b/internal/observability/event/node_metrics_counter.go
index 1d94ade648c..c08484da7a6 100644
--- a/internal/observability/event/node_metrics_counter.go
+++ b/internal/observability/event/node_metrics_counter.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -31,19 +31,17 @@ type Labeler interface {
 
 // NewMetricsCounter should be used to create the MetricsCounter.
 func NewMetricsCounter(name string, node eventlogger.Node, labeler Labeler) (*MetricsCounter, error) {
-	const op = "event.NewMetricsCounter"
-
 	name = strings.TrimSpace(name)
 	if name == "" {
-		return nil, fmt.Errorf("%s: name is required: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("name is required: %w", ErrInvalidParameter)
 	}
 
 	if node == nil || reflect.ValueOf(node).IsNil() {
-		return nil, fmt.Errorf("%s: node is required: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("node is required: %w", ErrInvalidParameter)
 	}
 
 	if labeler == nil || reflect.ValueOf(labeler).IsNil() {
-		return nil, fmt.Errorf("%s: labeler is required: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("labeler is required: %w", ErrInvalidParameter)
 	}
 
 	return &MetricsCounter{
diff --git a/internal/observability/event/node_metrics_counter_test.go b/internal/observability/event/node_metrics_counter_test.go
index dd6d56db584..c3e0fdf28b0 100644
--- a/internal/observability/event/node_metrics_counter_test.go
+++ b/internal/observability/event/node_metrics_counter_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -39,20 +39,20 @@ func TestNewMetricsCounter(t *testing.T) {
 			node:                 nil,
 			labeler:              nil,
 			isErrorExpected:      true,
-			expectedErrorMessage: "event.NewMetricsCounter: name is required: invalid parameter",
+			expectedErrorMessage: "name is required: invalid parameter",
 		},
 		"no-node": {
 			name:                 "foo",
 			node:                 nil,
 			isErrorExpected:      true,
-			expectedErrorMessage: "event.NewMetricsCounter: node is required: invalid parameter",
+			expectedErrorMessage: "node is required: invalid parameter",
 		},
 		"no-labeler": {
 			name:                 "foo",
 			node:                 &testEventLoggerNode{},
 			labeler:              nil,
 			isErrorExpected:      true,
-			expectedErrorMessage: "event.NewMetricsCounter: labeler is required: invalid parameter",
+			expectedErrorMessage: "labeler is required: invalid parameter",
 		},
 	}
 
diff --git a/internal/observability/event/options.go b/internal/observability/event/options.go
index e788cecb6de..6f8ff175ab4 100644
--- a/internal/observability/event/options.go
+++ b/internal/observability/event/options.go
@@ -1,16 +1,17 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
 
 import (
-	"errors"
 	"fmt"
 	"os"
+	"reflect"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-uuid"
 )
@@ -27,6 +28,7 @@ type options struct {
 	withSocketType  string
 	withMaxDuration time.Duration
 	withFileMode    *os.FileMode
+	withLogger      hclog.Logger
 }
 
 // getDefaultOptions returns Options with their default values.
@@ -59,18 +61,24 @@ func getOpts(opt ...Option) (options, error) {
 	return opts, nil
 }
 
+// ValidateOptions can be used to validate options before they are required.
+func ValidateOptions(opt ...Option) error {
+	_, err := getOpts(opt...)
+
+	return err
+}
+
 // NewID is a bit of a modified NewID has been done to stop a circular
 // dependency with the errors package that is caused by importing
 // boundary/internal/db
 func NewID(prefix string) (string, error) {
-	const op = "event.NewID"
 	if prefix == "" {
-		return "", fmt.Errorf("%s: missing prefix: %w", op, ErrInvalidParameter)
+		return "", fmt.Errorf("missing prefix: %w", ErrInvalidParameter)
 	}
 
 	id, err := uuid.GenerateUUID()
 	if err != nil {
-		return "", fmt.Errorf("%s: unable to generate ID: %w", op, err)
+		return "", fmt.Errorf("unable to generate ID: %w", err)
 	}
 
 	return fmt.Sprintf("%s_%s", prefix, id), nil
@@ -84,7 +92,7 @@ func WithID(id string) Option {
 		id := strings.TrimSpace(id)
 		switch {
 		case id == "":
-			err = errors.New("id cannot be empty")
+			err = fmt.Errorf("id cannot be empty: %w", ErrInvalidParameter)
 		default:
 			o.withID = id
 		}
@@ -100,7 +108,7 @@ func WithNow(now time.Time) Option {
 
 		switch {
 		case now.IsZero():
-			err = errors.New("cannot specify 'now' to be the zero time instant")
+			err = fmt.Errorf("cannot specify 'now' to be the zero time instant: %w", ErrInvalidParameter)
 		default:
 			o.withNow = now
 		}
@@ -159,7 +167,7 @@ func WithMaxDuration(duration string) Option {
 
 		parsed, err := parseutil.ParseDurationSecond(duration)
 		if err != nil {
-			return fmt.Errorf("unable to parse max duration: %w", err)
+			return fmt.Errorf("unable to parse max duration: %w: %w", ErrInvalidParameter, err)
 		}
 
 		o.withMaxDuration = parsed
@@ -187,7 +195,7 @@ func WithFileMode(mode string) Option {
 
 		switch {
 		case err != nil:
-			return fmt.Errorf("unable to parse file mode: %w", err)
+			return fmt.Errorf("unable to parse file mode: %w: %w", ErrInvalidParameter, err)
 		default:
 			m := os.FileMode(raw)
 			o.withFileMode = &m
@@ -196,3 +204,15 @@ func WithFileMode(mode string) Option {
 		return nil
 	}
 }
+
+// WithLogger provides an Option to supply a logger which will be used to write logs.
+// NOTE: If no logger is supplied then logging may not be possible.
+func WithLogger(l hclog.Logger) Option {
+	return func(o *options) error {
+		if l != nil && !reflect.ValueOf(l).IsNil() {
+			o.withLogger = l
+		}
+
+		return nil
+	}
+}
diff --git a/internal/observability/event/options_test.go b/internal/observability/event/options_test.go
index 95f1193f1b7..12dc560e08d 100644
--- a/internal/observability/event/options_test.go
+++ b/internal/observability/event/options_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -8,6 +8,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/hashicorp/go-hclog"
 	"github.com/stretchr/testify/require"
 )
 
@@ -22,7 +23,7 @@ func TestOptions_WithNow(t *testing.T) {
 		"default-time": {
 			Value:                time.Time{},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "cannot specify 'now' to be the zero time instant",
+			ExpectedErrorMessage: "cannot specify 'now' to be the zero time instant: invalid parameter",
 		},
 		"valid-time": {
 			Value:           time.Date(2023, time.July, 4, 12, 3, 0, 0, time.Local),
@@ -63,12 +64,12 @@ func TestOptions_WithID(t *testing.T) {
 		"empty": {
 			Value:                "",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "id cannot be empty",
+			ExpectedErrorMessage: "id cannot be empty: invalid parameter",
 		},
 		"whitespace": {
 			Value:                "     ",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "id cannot be empty",
+			ExpectedErrorMessage: "id cannot be empty: invalid parameter",
 		},
 		"valid": {
 			Value:           "test",
@@ -152,7 +153,7 @@ func TestOptions_Opts(t *testing.T) {
 				WithNow(time.Time{}),
 			},
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "cannot specify 'now' to be the zero time instant",
+			ExpectedErrorMessage: "cannot specify 'now' to be the zero time instant: invalid parameter",
 		},
 		"with-multiple-valid-options": {
 			opts: []Option{
@@ -324,12 +325,12 @@ func TestOptions_WithMaxDuration(t *testing.T) {
 		"bad-value": {
 			Value:                "juan",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "unable to parse max duration: time: invalid duration \"juan\"",
+			ExpectedErrorMessage: "unable to parse max duration: invalid parameter: time: invalid duration \"juan\"",
 		},
 		"bad-spacey-value": {
 			Value:                "   juan   ",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "unable to parse max duration: time: invalid duration \"juan\"",
+			ExpectedErrorMessage: "unable to parse max duration: invalid parameter: time: invalid duration \"juan\"",
 		},
 		"duration-2s": {
 			Value:         "2s",
@@ -383,7 +384,7 @@ func TestOptions_WithFileMode(t *testing.T) {
 		"nonsense": {
 			Value:                "juan",
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "unable to parse file mode: strconv.ParseUint: parsing \"juan\": invalid syntax",
+			ExpectedErrorMessage: "unable to parse file mode: invalid parameter: strconv.ParseUint: parsing \"juan\": invalid syntax",
 		},
 		"zero": {
 			Value:           "0000",
@@ -423,3 +424,37 @@ func TestOptions_WithFileMode(t *testing.T) {
 		})
 	}
 }
+
+// TestOptions_WithLogger exercises WithLogger Option to ensure it performs as expected.
+func TestOptions_WithLogger(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		value         hclog.Logger
+		isNilExpected bool
+	}{
+		"nil-pointer": {
+			value:         nil,
+			isNilExpected: true,
+		},
+		"logger": {
+			value: hclog.NewNullLogger(),
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			opts := &options{}
+			applyOption := WithLogger(tc.value)
+			err := applyOption(opts)
+			require.NoError(t, err)
+			if tc.isNilExpected {
+				require.Nil(t, opts.withLogger)
+			} else {
+				require.NotNil(t, opts.withLogger)
+			}
+		})
+	}
+}
diff --git a/internal/observability/event/pipeline_reader.go b/internal/observability/event/pipeline_reader.go
index f35672f8efa..36692484922 100644
--- a/internal/observability/event/pipeline_reader.go
+++ b/internal/observability/event/pipeline_reader.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
diff --git a/internal/observability/event/sink_file.go b/internal/observability/event/sink_file.go
index bd997b70721..d309327b5cd 100644
--- a/internal/observability/event/sink_file.go
+++ b/internal/observability/event/sink_file.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -14,6 +14,7 @@ import (
 	"sync"
 
 	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/go-hclog"
 )
 
 // defaultFileMode is the default file permissions (read/write for everyone).
@@ -31,22 +32,21 @@ type FileSink struct {
 	fileMode       os.FileMode
 	path           string
 	requiredFormat string
+	logger         hclog.Logger
 }
 
 // NewFileSink should be used to create a new FileSink.
 // Accepted options: WithFileMode.
 func NewFileSink(path string, format string, opt ...Option) (*FileSink, error) {
-	const op = "event.NewFileSink"
-
 	// Parse and check path
 	p := strings.TrimSpace(path)
 	if p == "" {
-		return nil, fmt.Errorf("%s: path is required", op)
+		return nil, fmt.Errorf("path is required: %w", ErrInvalidParameter)
 	}
 
 	opts, err := getOpts(opt...)
 	if err != nil {
-		return nil, fmt.Errorf("%s: error applying options: %w", op, err)
+		return nil, err
 	}
 
 	mode := os.FileMode(defaultFileMode)
@@ -58,7 +58,7 @@ func NewFileSink(path string, format string, opt ...Option) (*FileSink, error) {
 	case *opts.withFileMode == 0: // Maintain the existing file's mode when set to "0000".
 		fileInfo, err := os.Stat(path)
 		if err != nil {
-			return nil, fmt.Errorf("%s: unable to determine existing file mode: %w", op, err)
+			return nil, fmt.Errorf("unable to determine existing file mode: %w", err)
 		}
 		mode = fileInfo.Mode()
 	default:
@@ -71,30 +71,38 @@ func NewFileSink(path string, format string, opt ...Option) (*FileSink, error) {
 		fileMode:       mode,
 		requiredFormat: format,
 		path:           p,
+		logger:         opts.withLogger,
 	}
 
 	// Ensure that the file can be successfully opened for writing;
 	// otherwise it will be too late to catch later without problems
 	// (ref: https://github.com/hashicorp/vault/issues/550)
 	if err := sink.open(); err != nil {
-		return nil, fmt.Errorf("%s: sanity check failed; unable to open %q for writing: %w", op, path, err)
+		return nil, fmt.Errorf("sanity check failed; unable to open %q for writing: %w", sink.path, err)
 	}
 
 	return sink, nil
 }
 
 // Process handles writing the event to the file sink.
-func (s *FileSink) Process(ctx context.Context, e *eventlogger.Event) (*eventlogger.Event, error) {
-	const op = "event.(FileSink).Process"
-
+func (s *FileSink) Process(ctx context.Context, e *eventlogger.Event) (_ *eventlogger.Event, retErr error) {
 	select {
 	case <-ctx.Done():
 		return nil, ctx.Err()
 	default:
 	}
 
+	defer func() {
+		// If the context is errored (cancelled), and we were planning to return
+		// an error, let's also log (if we have a logger) in case the eventlogger's
+		// status channel and errors propagated.
+		if err := ctx.Err(); err != nil && retErr != nil && s.logger != nil {
+			s.logger.Error("file sink error", "context", err, "error", retErr)
+		}
+	}()
+
 	if e == nil {
-		return nil, fmt.Errorf("%s: event is nil: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("event is nil: %w", ErrInvalidParameter)
 	}
 
 	// '/dev/null' path means we just do nothing and pretend we're done.
@@ -104,12 +112,12 @@ func (s *FileSink) Process(ctx context.Context, e *eventlogger.Event) (*eventlog
 
 	formatted, found := e.Format(s.requiredFormat)
 	if !found {
-		return nil, fmt.Errorf("%s: unable to retrieve event formatted as %q", op, s.requiredFormat)
+		return nil, fmt.Errorf("unable to retrieve event formatted as %q: %w", s.requiredFormat, ErrInvalidParameter)
 	}
 
-	err := s.log(formatted)
+	err := s.log(ctx, formatted)
 	if err != nil {
-		return nil, fmt.Errorf("%s: error writing file for sink: %w", op, err)
+		return nil, fmt.Errorf("error writing file for sink %q: %w", s.path, err)
 	}
 
 	// return nil for the event to indicate the pipeline is complete.
@@ -118,8 +126,6 @@ func (s *FileSink) Process(ctx context.Context, e *eventlogger.Event) (*eventlog
 
 // Reopen handles closing and reopening the file.
 func (s *FileSink) Reopen() error {
-	const op = "event.(FileSink).Reopen"
-
 	// '/dev/null' path means we just do nothing and pretend we're done.
 	if s.path == devnull {
 		return nil
@@ -136,7 +142,7 @@ func (s *FileSink) Reopen() error {
 	// Set to nil here so that even if we error out, on the next access open() will be tried.
 	s.file = nil
 	if err != nil {
-		return fmt.Errorf("%s: unable to close file for re-opening on sink: %w", op, err)
+		return fmt.Errorf("unable to close file for re-opening on sink %q: %w", s.path, err)
 	}
 
 	return s.open()
@@ -152,20 +158,18 @@ func (s *FileSink) Type() eventlogger.NodeType {
 // It doesn't have any locking and relies on calling functions of FileSink to
 // handle this (e.g. log and Reopen methods).
 func (s *FileSink) open() error {
-	const op = "event.(FileSink).open"
-
 	if s.file != nil {
 		return nil
 	}
 
 	if err := os.MkdirAll(filepath.Dir(s.path), s.fileMode); err != nil {
-		return fmt.Errorf("%s: unable to create file %q: %w", op, s.path, err)
+		return fmt.Errorf("unable to create file %q: %w", s.path, err)
 	}
 
 	var err error
 	s.file, err = os.OpenFile(s.path, os.O_APPEND|os.O_WRONLY|os.O_CREATE, s.fileMode)
 	if err != nil {
-		return fmt.Errorf("%s: unable to open file for sink: %w", op, err)
+		return fmt.Errorf("unable to open file for sink %q: %w", s.path, err)
 	}
 
 	// Change the file mode in case the log file already existed.
@@ -176,7 +180,7 @@ func (s *FileSink) open() error {
 		if s.fileMode != 0 {
 			err = os.Chmod(s.path, s.fileMode)
 			if err != nil {
-				return fmt.Errorf("%s: unable to change file %q permissions '%v' for sink: %w", op, s.path, s.fileMode, err)
+				return fmt.Errorf("unable to change file permissions '%v' for sink %q: %w", s.fileMode, s.path, err)
 			}
 		}
 	}
@@ -185,17 +189,23 @@ func (s *FileSink) open() error {
 }
 
 // log writes the buffer to the file.
-// It acquires a lock on the file to do this.
-func (s *FileSink) log(data []byte) error {
-	const op = "event.(FileSink).log"
-
+// NOTE: We attempt to acquire a lock on the file in order to write, but will
+// yield if the context is 'done'.
+func (s *FileSink) log(ctx context.Context, data []byte) error {
+	// Wait for the lock, but ensure we check for a cancelled context as soon as
+	// we have it, as there's no point in continuing if we're cancelled.
 	s.fileLock.Lock()
 	defer s.fileLock.Unlock()
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	default:
+	}
 
 	reader := bytes.NewReader(data)
 
 	if err := s.open(); err != nil {
-		return fmt.Errorf("%s: unable to open file for sink: %w", op, err)
+		return fmt.Errorf("unable to open file for sink %q: %w", s.path, err)
 	}
 
 	if _, err := reader.WriteTo(s.file); err == nil {
@@ -205,23 +215,23 @@ func (s *FileSink) log(data []byte) error {
 	// Otherwise, opportunistically try to re-open the FD, once per call (1 retry attempt).
 	err := s.file.Close()
 	if err != nil {
-		return fmt.Errorf("%s: unable to close file for sink: %w", op, err)
+		return fmt.Errorf("unable to close file for sink %q: %w", s.path, err)
 	}
 
 	s.file = nil
 
 	if err := s.open(); err != nil {
-		return fmt.Errorf("%s: unable to re-open file for sink: %w", op, err)
+		return fmt.Errorf("unable to re-open file for sink %q: %w", s.path, err)
 	}
 
 	_, err = reader.Seek(0, io.SeekStart)
 	if err != nil {
-		return fmt.Errorf("%s: unable to seek to start of file for sink: %w", op, err)
+		return fmt.Errorf("unable to seek to start of file for sink %q: %w", s.path, err)
 	}
 
 	_, err = reader.WriteTo(s.file)
 	if err != nil {
-		return fmt.Errorf("%s: unable to re-write to file for sink: %w", op, err)
+		return fmt.Errorf("unable to re-write to file for sink %q: %w", s.path, err)
 	}
 
 	return nil
diff --git a/internal/observability/event/sink_file_test.go b/internal/observability/event/sink_file_test.go
index 17f3b25a941..fbbe21904cf 100644
--- a/internal/observability/event/sink_file_test.go
+++ b/internal/observability/event/sink_file_test.go
@@ -1,16 +1,21 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
 
 import (
+	"context"
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/hashicorp/eventlogger"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/stretchr/testify/require"
 )
 
@@ -40,14 +45,14 @@ func TestNewFileSink(t *testing.T) {
 		"default-values": {
 			ShouldUseAbsolutePath: true,
 			IsErrorExpected:       true,
-			ExpectedErrorMessage:  "event.NewFileSink: path is required",
+			ExpectedErrorMessage:  "path is required: invalid parameter",
 		},
 		"spacey-path": {
 			ShouldUseAbsolutePath: true,
 			Path:                  "     ",
 			Format:                "json",
 			IsErrorExpected:       true,
-			ExpectedErrorMessage:  "event.NewFileSink: path is required",
+			ExpectedErrorMessage:  "path is required: invalid parameter",
 		},
 		"valid-path-and-format": {
 			Path:             "vault.log",
@@ -226,7 +231,7 @@ func TestFileSink_Process(t *testing.T) {
 			Data:                 "foo",
 			ShouldIgnoreFormat:   true,
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "event.(FileSink).Process: unable to retrieve event formatted as \"json\"",
+			ExpectedErrorMessage: "unable to retrieve event formatted as \"json\": invalid parameter",
 		},
 		"nil": {
 			Path:                 "foo.log",
@@ -234,7 +239,14 @@ func TestFileSink_Process(t *testing.T) {
 			Data:                 "foo",
 			ShouldUseNilEvent:    true,
 			IsErrorExpected:      true,
-			ExpectedErrorMessage: "event.(FileSink).Process: event is nil: invalid parameter",
+			ExpectedErrorMessage: "event is nil: invalid parameter",
+		},
+		"happy-path": {
+			Path:             "juan.log",
+			ShouldCreateFile: true,
+			Format:           "json",
+			Data:             "{\"foo\": \"bar\"}",
+			IsErrorExpected:  false,
 		},
 	}
 
@@ -297,3 +309,46 @@ func TestFileSink_Process(t *testing.T) {
 		})
 	}
 }
+
+// TestFileSink_log_cancelledContext tests that 'log' is context aware and won't
+// just wait for the lock on the file sink forever.
+func TestFileSink_log_cancelledContext(t *testing.T) {
+	tempDir := t.TempDir()
+	tempPath := filepath.Join(tempDir, "juan.log")
+	data := []byte("{\"foo\": \"bar\"}")
+
+	sink, err := NewFileSink(tempPath, "json")
+	require.NoError(t, err)
+	require.NotNil(t, sink)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(func() { cancel() })
+
+	// Manually acquire the lock so that the 'log' method cannot.
+	sink.fileLock.Lock()
+
+	var done atomic.Bool
+	go func() {
+		err = sink.log(ctx, data)
+		done.Store(true)
+	}()
+
+	// We shouldn't have an error as 'log' will be trying to acquire the lock.
+	require.NoError(t, err)
+
+	// Manually cancel the context and unlock to let the waiting 'log' in.
+	cancel()
+	sink.fileLock.Unlock()
+
+	// Just a little bit of time to make sure that 'log' returned and err was set.
+	corehelpers.RetryUntil(t, 3*time.Second, func() error {
+		if done.Load() {
+			return nil
+		}
+
+		return fmt.Errorf("logging still not done")
+	})
+
+	// We expect that the error now has context cancelled in it.
+	require.True(t, errors.Is(err, context.Canceled))
+}
diff --git a/internal/observability/event/sink_noop.go b/internal/observability/event/sink_noop.go
index 165fd700f5b..b80200a6b31 100644
--- a/internal/observability/event/sink_noop.go
+++ b/internal/observability/event/sink_noop.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
diff --git a/internal/observability/event/sink_socket.go b/internal/observability/event/sink_socket.go
index 861da0a2012..17e05da4bba 100644
--- a/internal/observability/event/sink_socket.go
+++ b/internal/observability/event/sink_socket.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-multierror"
 )
 
@@ -25,26 +26,25 @@ type SocketSink struct {
 	maxDuration    time.Duration
 	socketLock     sync.RWMutex
 	connection     net.Conn
+	logger         hclog.Logger
 }
 
 // NewSocketSink should be used to create a new SocketSink.
 // Accepted options: WithMaxDuration and WithSocketType.
 func NewSocketSink(address string, format string, opt ...Option) (*SocketSink, error) {
-	const op = "event.NewSocketSink"
-
 	address = strings.TrimSpace(address)
 	if address == "" {
-		return nil, fmt.Errorf("%s: address is required: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("address is required: %w", ErrInvalidParameter)
 	}
 
 	format = strings.TrimSpace(format)
 	if format == "" {
-		return nil, fmt.Errorf("%s: format is required: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("format is required: %w", ErrInvalidParameter)
 	}
 
 	opts, err := getOpts(opt...)
 	if err != nil {
-		return nil, fmt.Errorf("%s: error applying options: %w", op, err)
+		return nil, err
 	}
 
 	sink := &SocketSink{
@@ -54,31 +54,46 @@ func NewSocketSink(address string, format string, opt ...Option) (*SocketSink, e
 		maxDuration:    opts.withMaxDuration,
 		socketLock:     sync.RWMutex{},
 		connection:     nil,
+		logger:         opts.withLogger,
 	}
 
 	return sink, nil
 }
 
 // Process handles writing the event to the socket.
-func (s *SocketSink) Process(ctx context.Context, e *eventlogger.Event) (*eventlogger.Event, error) {
-	const op = "event.(SocketSink).Process"
-
+func (s *SocketSink) Process(ctx context.Context, e *eventlogger.Event) (_ *eventlogger.Event, retErr error) {
 	select {
 	case <-ctx.Done():
 		return nil, ctx.Err()
 	default:
 	}
 
-	s.socketLock.Lock()
-	defer s.socketLock.Unlock()
+	defer func() {
+		// If the context is errored (cancelled), and we were planning to return
+		// an error, let's also log (if we have a logger) in case the eventlogger's
+		// status channel and errors propagated.
+		if err := ctx.Err(); err != nil && retErr != nil && s.logger != nil {
+			s.logger.Error("socket sink error", "context", err, "error", retErr)
+		}
+	}()
 
 	if e == nil {
-		return nil, fmt.Errorf("%s: event is nil: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("event is nil: %w", ErrInvalidParameter)
 	}
 
 	formatted, found := e.Format(s.requiredFormat)
 	if !found {
-		return nil, fmt.Errorf("%s: unable to retrieve event formatted as %q", op, s.requiredFormat)
+		return nil, fmt.Errorf("unable to retrieve event formatted as %q: %w", s.requiredFormat, ErrInvalidParameter)
+	}
+
+	// Wait for the lock, but ensure we check for a cancelled context as soon as
+	// we have it, as there's no point in continuing if we're cancelled.
+	s.socketLock.Lock()
+	defer s.socketLock.Unlock()
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
 	}
 
 	// Try writing and return early if successful.
@@ -99,7 +114,7 @@ func (s *SocketSink) Process(ctx context.Context, e *eventlogger.Event) (*eventl
 
 	// Format the error nicely if we need to return one.
 	if err != nil {
-		err = fmt.Errorf("%s: error writing to socket: %w", op, err)
+		err = fmt.Errorf("error writing to socket %q: %w", s.address, err)
 	}
 
 	// return nil for the event to indicate the pipeline is complete.
@@ -108,14 +123,12 @@ func (s *SocketSink) Process(ctx context.Context, e *eventlogger.Event) (*eventl
 
 // Reopen handles reopening the connection for the socket sink.
 func (s *SocketSink) Reopen() error {
-	const op = "event.(SocketSink).Reopen"
-
 	s.socketLock.Lock()
 	defer s.socketLock.Unlock()
 
 	err := s.reconnect(nil)
 	if err != nil {
-		return fmt.Errorf("%s: error reconnecting: %w", op, err)
+		return fmt.Errorf("error reconnecting %q: %w", s.address, err)
 	}
 
 	return nil
@@ -127,8 +140,13 @@ func (_ *SocketSink) Type() eventlogger.NodeType {
 }
 
 // connect attempts to establish a connection using the socketType and address.
+// NOTE: connect is context aware and will not attempt to connect if the context is 'done'.
 func (s *SocketSink) connect(ctx context.Context) error {
-	const op = "event.(SocketSink).connect"
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	default:
+	}
 
 	// If we're already connected, we should have disconnected first.
 	if s.connection != nil {
@@ -141,7 +159,7 @@ func (s *SocketSink) connect(ctx context.Context) error {
 	dialer := net.Dialer{}
 	conn, err := dialer.DialContext(timeoutContext, s.socketType, s.address)
 	if err != nil {
-		return fmt.Errorf("%s: error connecting to %q address %q: %w", op, s.socketType, s.address, err)
+		return fmt.Errorf("error connecting to %q address %q: %w", s.socketType, s.address, err)
 	}
 
 	s.connection = conn
@@ -151,8 +169,6 @@ func (s *SocketSink) connect(ctx context.Context) error {
 
 // disconnect attempts to close and clear an existing connection.
 func (s *SocketSink) disconnect() error {
-	const op = "event.(SocketSink).disconnect"
-
 	// If we're already disconnected, we can return early.
 	if s.connection == nil {
 		return nil
@@ -160,7 +176,7 @@ func (s *SocketSink) disconnect() error {
 
 	err := s.connection.Close()
 	if err != nil {
-		return fmt.Errorf("%s: error closing connection: %w", op, err)
+		return fmt.Errorf("error closing connection to %q address %q: %w", s.socketType, s.address, err)
 	}
 	s.connection = nil
 
@@ -169,16 +185,14 @@ func (s *SocketSink) disconnect() error {
 
 // reconnect attempts to disconnect and then connect to the configured socketType and address.
 func (s *SocketSink) reconnect(ctx context.Context) error {
-	const op = "event.(SocketSink).reconnect"
-
 	err := s.disconnect()
 	if err != nil {
-		return fmt.Errorf("%s: error disconnecting: %w", op, err)
+		return err
 	}
 
 	err = s.connect(ctx)
 	if err != nil {
-		return fmt.Errorf("%s: error connecting: %w", op, err)
+		return err
 	}
 
 	return nil
@@ -186,22 +200,20 @@ func (s *SocketSink) reconnect(ctx context.Context) error {
 
 // write attempts to write the specified data using the established connection.
 func (s *SocketSink) write(ctx context.Context, data []byte) error {
-	const op = "event.(SocketSink).write"
-
 	// Ensure we're connected.
 	err := s.connect(ctx)
 	if err != nil {
-		return fmt.Errorf("%s: connection error: %w", op, err)
+		return err
 	}
 
 	err = s.connection.SetWriteDeadline(time.Now().Add(s.maxDuration))
 	if err != nil {
-		return fmt.Errorf("%s: unable to set write deadline: %w", op, err)
+		return fmt.Errorf("unable to set write deadline: %w", err)
 	}
 
 	_, err = s.connection.Write(data)
 	if err != nil {
-		return fmt.Errorf("%s: unable to write to socket: %w", op, err)
+		return fmt.Errorf("unable to write to socket: %w", err)
 	}
 
 	return nil
diff --git a/internal/observability/event/sink_socket_test.go b/internal/observability/event/sink_socket_test.go
index c44766780dc..9a743aad804 100644
--- a/internal/observability/event/sink_socket_test.go
+++ b/internal/observability/event/sink_socket_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -26,31 +26,31 @@ func TestNewSocketSink(t *testing.T) {
 		"address-empty": {
 			address:        "",
 			wantErr:        true,
-			expectedErrMsg: "event.NewSocketSink: address is required: invalid parameter",
+			expectedErrMsg: "address is required: invalid parameter",
 		},
 		"address-whitespace": {
 			address:        "    ",
 			wantErr:        true,
-			expectedErrMsg: "event.NewSocketSink: address is required: invalid parameter",
+			expectedErrMsg: "address is required: invalid parameter",
 		},
 		"format-empty": {
 			address:        "addr",
 			format:         "",
 			wantErr:        true,
-			expectedErrMsg: "event.NewSocketSink: format is required: invalid parameter",
+			expectedErrMsg: "format is required: invalid parameter",
 		},
 		"format-whitespace": {
 			address:        "addr",
 			format:         "   ",
 			wantErr:        true,
-			expectedErrMsg: "event.NewSocketSink: format is required: invalid parameter",
+			expectedErrMsg: "format is required: invalid parameter",
 		},
 		"bad-max-duration": {
 			address:        "addr",
 			format:         "json",
 			opts:           []Option{WithMaxDuration("bar")},
 			wantErr:        true,
-			expectedErrMsg: "event.NewSocketSink: error applying options: unable to parse max duration: time: invalid duration \"bar\"",
+			expectedErrMsg: "unable to parse max duration: invalid parameter: time: invalid duration \"bar\"",
 		},
 		"happy": {
 			address: "wss://foo",
diff --git a/internal/observability/event/sink_stdout.go b/internal/observability/event/sink_stdout.go
index 71782695c7a..00852667ea7 100644
--- a/internal/observability/event/sink_stdout.go
+++ b/internal/observability/event/sink_stdout.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -23,11 +23,9 @@ type StdoutSink struct {
 // NewStdoutSinkNode creates a new StdoutSink that will persist the events
 // it processes using the specified expected format.
 func NewStdoutSinkNode(format string) (*StdoutSink, error) {
-	const op = "event.NewStdoutSinkNode"
-
 	format = strings.TrimSpace(format)
 	if format == "" {
-		return nil, fmt.Errorf("%s: format is required: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("format is required: %w", ErrInvalidParameter)
 	}
 
 	return &StdoutSink{
@@ -37,8 +35,6 @@ func NewStdoutSinkNode(format string) (*StdoutSink, error) {
 
 // Process persists the provided eventlogger.Event to the standard output stream.
 func (s *StdoutSink) Process(ctx context.Context, e *eventlogger.Event) (*eventlogger.Event, error) {
-	const op = "event.(StdoutSink).Process"
-
 	select {
 	case <-ctx.Done():
 		return nil, ctx.Err()
@@ -46,17 +42,17 @@ func (s *StdoutSink) Process(ctx context.Context, e *eventlogger.Event) (*eventl
 	}
 
 	if e == nil {
-		return nil, fmt.Errorf("%s: event is nil: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("event is nil: %w", ErrInvalidParameter)
 	}
 
-	formattedBytes, found := e.Format(s.requiredFormat)
+	formatted, found := e.Format(s.requiredFormat)
 	if !found {
-		return nil, fmt.Errorf("%s: unable to retrieve event formatted as %q", op, s.requiredFormat)
+		return nil, fmt.Errorf("unable to retrieve event formatted as %q: %w", s.requiredFormat, ErrInvalidParameter)
 	}
 
-	_, err := os.Stdout.Write(formattedBytes)
+	_, err := os.Stdout.Write(formatted)
 	if err != nil {
-		return nil, fmt.Errorf("%s: error writing to stdout: %w", op, err)
+		return nil, fmt.Errorf("error writing to stdout: %w", err)
 	}
 
 	// Return nil, nil to indicate the pipeline is complete.
diff --git a/internal/observability/event/sink_syslog.go b/internal/observability/event/sink_syslog.go
index 7d0e359ffce..63ba257d93c 100644
--- a/internal/observability/event/sink_syslog.go
+++ b/internal/observability/event/sink_syslog.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/hashicorp/eventlogger"
+	"github.com/hashicorp/go-hclog"
 	gsyslog "github.com/hashicorp/go-syslog"
 )
 
@@ -17,54 +18,66 @@ var _ eventlogger.Node = (*SyslogSink)(nil)
 // SyslogSink is a sink node which handles writing events to syslog.
 type SyslogSink struct {
 	requiredFormat string
-	logger         gsyslog.Syslogger
+	syslogger      gsyslog.Syslogger
+	logger         hclog.Logger
 }
 
 // NewSyslogSink should be used to create a new SyslogSink.
 // Accepted options: WithFacility and WithTag.
 func NewSyslogSink(format string, opt ...Option) (*SyslogSink, error) {
-	const op = "event.NewSyslogSink"
-
 	format = strings.TrimSpace(format)
 	if format == "" {
-		return nil, fmt.Errorf("%s: format is required: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("format is required: %w", ErrInvalidParameter)
 	}
 
 	opts, err := getOpts(opt...)
 	if err != nil {
-		return nil, fmt.Errorf("%s: error applying options: %w", op, err)
+		return nil, err
 	}
 
 	logger, err := gsyslog.NewLogger(gsyslog.LOG_INFO, opts.withFacility, opts.withTag)
 	if err != nil {
-		return nil, fmt.Errorf("%s: error creating syslogger: %w", op, err)
+		return nil, fmt.Errorf("error creating syslogger: %w", err)
+	}
+
+	syslog := &SyslogSink{
+		requiredFormat: format,
+		syslogger:      logger,
+		logger:         opts.withLogger,
 	}
 
-	return &SyslogSink{requiredFormat: format, logger: logger}, nil
+	return syslog, nil
 }
 
 // Process handles writing the event to the syslog.
-func (s *SyslogSink) Process(ctx context.Context, e *eventlogger.Event) (*eventlogger.Event, error) {
-	const op = "event.(SyslogSink).Process"
-
+func (s *SyslogSink) Process(ctx context.Context, e *eventlogger.Event) (_ *eventlogger.Event, retErr error) {
 	select {
 	case <-ctx.Done():
 		return nil, ctx.Err()
 	default:
 	}
 
+	defer func() {
+		// If the context is errored (cancelled), and we were planning to return
+		// an error, let's also log (if we have a logger) in case the eventlogger's
+		// status channel and errors propagated.
+		if err := ctx.Err(); err != nil && retErr != nil && s.logger != nil {
+			s.logger.Error("syslog sink error", "context", err, "error", retErr)
+		}
+	}()
+
 	if e == nil {
-		return nil, fmt.Errorf("%s: event is nil: %w", op, ErrInvalidParameter)
+		return nil, fmt.Errorf("event is nil: %w", ErrInvalidParameter)
 	}
 
 	formatted, found := e.Format(s.requiredFormat)
 	if !found {
-		return nil, fmt.Errorf("%s: unable to retrieve event formatted as %q", op, s.requiredFormat)
+		return nil, fmt.Errorf("unable to retrieve event formatted as %q: %w", s.requiredFormat, ErrInvalidParameter)
 	}
 
-	_, err := s.logger.Write(formatted)
+	_, err := s.syslogger.Write(formatted)
 	if err != nil {
-		return nil, fmt.Errorf("%s: error writing to syslog: %w", op, err)
+		return nil, fmt.Errorf("error writing to syslog: %w", err)
 	}
 
 	// return nil for the event to indicate the pipeline is complete.
diff --git a/internal/observability/event/sink_syslog_test.go b/internal/observability/event/sink_syslog_test.go
index f977a4a5053..18dcbb1ba63 100644
--- a/internal/observability/event/sink_syslog_test.go
+++ b/internal/observability/event/sink_syslog_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package event
@@ -24,12 +24,12 @@ func TestNewSyslogSink(t *testing.T) {
 		"format-empty": {
 			format:         "",
 			wantErr:        true,
-			expectedErrMsg: "event.NewSyslogSink: format is required: invalid parameter",
+			expectedErrMsg: "format is required: invalid parameter",
 		},
 		"format-whitespace": {
 			format:         "   ",
 			wantErr:        true,
-			expectedErrMsg: "event.NewSyslogSink: format is required: invalid parameter",
+			expectedErrMsg: "format is required: invalid parameter",
 		},
 		"happy": {
 			format: "json",
diff --git a/internalshared/configutil/config.go b/internalshared/configutil/config.go
index 751cd421998..5acde97c86f 100644
--- a/internalshared/configutil/config.go
+++ b/internalshared/configutil/config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
@@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/hcl"
 	"github.com/hashicorp/hcl/hcl/ast"
 	"github.com/hashicorp/hcl/hcl/token"
+	"github.com/hashicorp/vault/helper/random"
 )
 
 // SharedConfig contains some shared values
@@ -31,9 +32,9 @@ type SharedConfig struct {
 	DisableMlock    bool        `hcl:"-"`
 	DisableMlockRaw interface{} `hcl:"disable_mlock"`
 
-	Telemetry *Telemetry `hcl:"telemetry"`
+	Telemetry *Telemetry `hcl:"-"`
 
-	HCPLinkConf *HCPLinkConfig `hcl:"cloud"`
+	HCPLinkConf *HCPLinkConfig `hcl:"-"`
 
 	DefaultMaxRequestDuration    time.Duration `hcl:"-"`
 	DefaultMaxRequestDurationRaw interface{}   `hcl:"default_max_request_duration"`
@@ -55,27 +56,31 @@ type SharedConfig struct {
 	ClusterName string `hcl:"cluster_name"`
 
 	AdministrativeNamespacePath string `hcl:"administrative_namespace_path"`
+}
 
-	RequestLimiter *RequestLimiter `hcl:"request_limiter"`
+func ParseConfig(d string) (cfg *SharedConfig, err error) {
+	cfg, _, err = ParseConfigCheckDuplicate(d)
+	return cfg, err
 }
 
-func ParseConfig(d string) (*SharedConfig, error) {
+// TODO (HCL_DUP_KEYS_DEPRECATION): keep only ParseConfig once deprecation is complete
+func ParseConfigCheckDuplicate(d string) (cfg *SharedConfig, duplicate bool, err error) {
 	// Parse!
-	obj, err := hcl.Parse(d)
+	obj, duplicate, err := random.ParseAndCheckForDuplicateHclAttributes(d)
 	if err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
 
 	// Start building the result
 	var result SharedConfig
 
 	if err := hcl.DecodeObject(&result, obj); err != nil {
-		return nil, err
+		return nil, duplicate, err
 	}
 
 	if result.DefaultMaxRequestDurationRaw != nil {
 		if result.DefaultMaxRequestDuration, err = parseutil.ParseDurationSecond(result.DefaultMaxRequestDurationRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 		result.FoundKeys = append(result.FoundKeys, "DefaultMaxRequestDuration")
 		result.DefaultMaxRequestDurationRaw = nil
@@ -83,7 +88,7 @@ func ParseConfig(d string) (*SharedConfig, error) {
 
 	if result.DisableMlockRaw != nil {
 		if result.DisableMlock, err = parseutil.ParseBool(result.DisableMlockRaw); err != nil {
-			return nil, err
+			return nil, duplicate, err
 		}
 		result.FoundKeys = append(result.FoundKeys, "DisableMlock")
 		result.DisableMlockRaw = nil
@@ -91,34 +96,34 @@ func ParseConfig(d string) (*SharedConfig, error) {
 
 	list, ok := obj.Node.(*ast.ObjectList)
 	if !ok {
-		return nil, fmt.Errorf("error parsing: file doesn't contain a root object")
+		return nil, duplicate, fmt.Errorf("error parsing: file doesn't contain a root object")
 	}
 
 	if o := list.Filter("hsm"); len(o.Items) > 0 {
 		result.found("hsm", "hsm")
 		if err := parseKMS(&result.Seals, o, "hsm", 2); err != nil {
-			return nil, fmt.Errorf("error parsing 'hsm': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'hsm': %w", err)
 		}
 	}
 
 	if o := list.Filter("seal"); len(o.Items) > 0 {
 		result.found("seal", "Seal")
 		if err := parseKMS(&result.Seals, o, "seal", 5); err != nil {
-			return nil, fmt.Errorf("error parsing 'seal': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'seal': %w", err)
 		}
 	}
 
 	if o := list.Filter("kms"); len(o.Items) > 0 {
 		result.found("kms", "Seal")
 		if err := parseKMS(&result.Seals, o, "kms", 3); err != nil {
-			return nil, fmt.Errorf("error parsing 'kms': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'kms': %w", err)
 		}
 	}
 
 	if o := list.Filter("entropy"); len(o.Items) > 0 {
 		result.found("entropy", "Entropy")
 		if err := ParseEntropy(&result, o, "entropy"); err != nil {
-			return nil, fmt.Errorf("error parsing 'entropy': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'entropy': %w", err)
 		}
 	}
 
@@ -126,7 +131,7 @@ func ParseConfig(d string) (*SharedConfig, error) {
 		result.found("listener", "Listener")
 		listeners, err := ParseListeners(o)
 		if err != nil {
-			return nil, fmt.Errorf("error parsing 'listener': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'listener': %w", err)
 		}
 		// Update the shared config
 		result.Listeners = listeners
@@ -140,37 +145,30 @@ func ParseConfig(d string) (*SharedConfig, error) {
 	if o := list.Filter("user_lockout"); len(o.Items) > 0 {
 		result.found("user_lockout", "UserLockout")
 		if err := ParseUserLockouts(&result, o); err != nil {
-			return nil, fmt.Errorf("error parsing 'user_lockout': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'user_lockout': %w", err)
 		}
 	}
 
 	if o := list.Filter("telemetry"); len(o.Items) > 0 {
 		result.found("telemetry", "Telemetry")
 		if err := parseTelemetry(&result, o); err != nil {
-			return nil, fmt.Errorf("error parsing 'telemetry': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'telemetry': %w", err)
 		}
 	}
 
 	if o := list.Filter("cloud"); len(o.Items) > 0 {
 		result.found("cloud", "Cloud")
 		if err := parseCloud(&result, o); err != nil {
-			return nil, fmt.Errorf("error parsing 'cloud': %w", err)
-		}
-	}
-
-	if o := list.Filter("request_limiter"); len(o.Items) > 0 {
-		result.found("request_limiter", "RequestLimiter")
-		if err := parseRequestLimiter(&result, o); err != nil {
-			return nil, fmt.Errorf("error parsing 'request_limiter': %w", err)
+			return nil, duplicate, fmt.Errorf("error parsing 'cloud': %w", err)
 		}
 	}
 
 	entConfig := &(result.EntSharedConfig)
 	if err := entConfig.ParseConfig(list); err != nil {
-		return nil, fmt.Errorf("error parsing enterprise config: %w", err)
+		return nil, duplicate, fmt.Errorf("error parsing enterprise config: %w", err)
 	}
 
-	return &result, nil
+	return &result, duplicate, nil
 }
 
 // Sanitized returns a copy of the config with all values that are considered
@@ -293,13 +291,6 @@ func (c *SharedConfig) Sanitized() map[string]interface{} {
 		result["telemetry"] = sanitizedTelemetry
 	}
 
-	if c.RequestLimiter != nil {
-		sanitizedRequestLimiter := map[string]interface{}{
-			"disable": c.RequestLimiter.Disable,
-		}
-		result["request_limiter"] = sanitizedRequestLimiter
-	}
-
 	return result
 }
 
diff --git a/internalshared/configutil/config_test.go b/internalshared/configutil/config_test.go
index 4362f92284e..a9418b58ada 100644
--- a/internalshared/configutil/config_test.go
+++ b/internalshared/configutil/config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
diff --git a/internalshared/configutil/config_util.go b/internalshared/configutil/config_util.go
index 76e2b198a60..f552c0d3ad4 100644
--- a/internalshared/configutil/config_util.go
+++ b/internalshared/configutil/config_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/internalshared/configutil/encrypt_decrypt.go b/internalshared/configutil/encrypt_decrypt.go
index 84ad39fb6a2..d5b6ae4f14d 100644
--- a/internalshared/configutil/encrypt_decrypt.go
+++ b/internalshared/configutil/encrypt_decrypt.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
diff --git a/internalshared/configutil/encrypt_decrypt_test.go b/internalshared/configutil/encrypt_decrypt_test.go
index 3b4609e4549..380f6d5b5b4 100644
--- a/internalshared/configutil/encrypt_decrypt_test.go
+++ b/internalshared/configutil/encrypt_decrypt_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
diff --git a/internalshared/configutil/entropymode_enumer.go b/internalshared/configutil/entropymode_enumer.go
new file mode 100644
index 00000000000..6b804001c48
--- /dev/null
+++ b/internalshared/configutil/entropymode_enumer.go
@@ -0,0 +1,49 @@
+// Code generated by "enumer -type=EntropyMode -trimprefix=Entropy"; DO NOT EDIT.
+
+package configutil
+
+import (
+	"fmt"
+)
+
+const _EntropyModeName = "UnknownAugmentation"
+
+var _EntropyModeIndex = [...]uint8{0, 7, 19}
+
+func (i EntropyMode) String() string {
+	if i < 0 || i >= EntropyMode(len(_EntropyModeIndex)-1) {
+		return fmt.Sprintf("EntropyMode(%d)", i)
+	}
+	return _EntropyModeName[_EntropyModeIndex[i]:_EntropyModeIndex[i+1]]
+}
+
+var _EntropyModeValues = []EntropyMode{0, 1}
+
+var _EntropyModeNameToValueMap = map[string]EntropyMode{
+	_EntropyModeName[0:7]:  0,
+	_EntropyModeName[7:19]: 1,
+}
+
+// EntropyModeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func EntropyModeString(s string) (EntropyMode, error) {
+	if val, ok := _EntropyModeNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to EntropyMode values", s)
+}
+
+// EntropyModeValues returns all values of the enum
+func EntropyModeValues() []EntropyMode {
+	return _EntropyModeValues
+}
+
+// IsAEntropyMode returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i EntropyMode) IsAEntropyMode() bool {
+	for _, v := range _EntropyModeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internalshared/configutil/env_var_util.go b/internalshared/configutil/env_var_util.go
index 4c2986d1840..b37c7553138 100644
--- a/internalshared/configutil/env_var_util.go
+++ b/internalshared/configutil/env_var_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
diff --git a/internalshared/configutil/hcp_link.go b/internalshared/configutil/hcp_link.go
index 0f130961d1a..3d249b8d7df 100644
--- a/internalshared/configutil/hcp_link.go
+++ b/internalshared/configutil/hcp_link.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
diff --git a/internalshared/configutil/http_response_headers.go b/internalshared/configutil/http_response_headers.go
index cbc71bccfac..befd23b67a8 100644
--- a/internalshared/configutil/http_response_headers.go
+++ b/internalshared/configutil/http_response_headers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
diff --git a/internalshared/configutil/kms.go b/internalshared/configutil/kms.go
index aa09d42cb69..dc27d0392c6 100644
--- a/internalshared/configutil/kms.go
+++ b/internalshared/configutil/kms.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
@@ -11,6 +11,7 @@ import (
 	"io"
 	"os"
 	"regexp"
+	"slices"
 	"strings"
 
 	"github.com/hashicorp/errwrap"
@@ -28,6 +29,7 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/hcl"
 	"github.com/hashicorp/hcl/hcl/ast"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/sdk/helper/strutil"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -38,7 +40,9 @@ var (
 	GetEnvConfigFunc             = getEnvConfig
 )
 
-// Entropy contains Entropy configuration for the server
+//go:generate enumer -type=EntropyMode -trimprefix=Entropy
+
+// EntropyMode contains Entropy configuration for the server
 type EntropyMode int
 
 const (
@@ -155,7 +159,10 @@ func parseKMS(result *[]*KMS, list *ast.ObjectList, blockName string, maxKMS int
 			if err != nil {
 				return multierror.Prefix(err, fmt.Sprintf("%s.%s:", blockName, key))
 			}
-			strMap[k] = s
+			strMap[k], err = normalizeKMSSealConfigAddrs(key, k, s)
+			if err != nil {
+				return multierror.Prefix(err, fmt.Sprintf("%s.%s:", blockName, key))
+			}
 		}
 
 		seal := &KMS{
@@ -178,7 +185,9 @@ func parseKMS(result *[]*KMS, list *ast.ObjectList, blockName string, maxKMS int
 
 func ParseKMSes(d string) ([]*KMS, error) {
 	// Parse!
-	obj, err := hcl.Parse(d)
+	// TODO (HCL_DUP_KEYS_DEPRECATION): return to hcl.Parse once deprecation is done. For now just ignore duplicates on
+	// this unused function
+	obj, _, err := random.ParseAndCheckForDuplicateHclAttributes(d)
 	if err != nil {
 		return nil, err
 	}
@@ -212,27 +221,76 @@ func ParseKMSes(d string) ([]*KMS, error) {
 	return result.Seals, nil
 }
 
-func configureWrapper(configKMS *KMS, infoKeys *[]string, info *map[string]string, logger hclog.Logger, opts ...wrapping.Option) (wrapping.Wrapper, error) {
-	var wrapper wrapping.Wrapper
-	var kmsInfo map[string]string
-	var err error
+// kmsSealAddressKeys maps seal key types to corresponding config keys whose
+// values might contain URLs, IP addresses, or host:port addresses. All seal
+// types must contain an entry here, otherwise our normalization check will fail
+// when parsing the seal config. Seal types which do not contain such
+// configurations ought to have an empty array as the value in the map.
+var kmsSealAddressKeys = map[string][]string{
+	wrapping.WrapperTypeAliCloudKms.String():   {"domain"},
+	wrapping.WrapperTypeAwsKms.String():        {"endpoint"},
+	wrapping.WrapperTypeAzureKeyVault.String(): {"resource"},
+	wrapping.WrapperTypeGcpCkms.String():       {},
+	wrapping.WrapperTypeOciKms.String():        {"key_id", "crypto_endpoint", "management_endpoint"},
+	wrapping.WrapperTypePkcs11.String():        {},
+	wrapping.WrapperTypeTransit.String():       {"address"},
+}
 
+// normalizeKMSSealConfigAddrs takes a kms seal type, a config key, and its
+// associated value and will normalize any URLs, IP addresses, or host:port
+// addresses contained in the value if the config key is known in the
+// kmsSealAddressKeys.
+func normalizeKMSSealConfigAddrs(seal string, key string, value string) (string, error) {
+	keys, ok := kmsSealAddressKeys[seal]
+	if !ok {
+		return "", fmt.Errorf("unknown seal type %s", seal)
+	}
+
+	if slices.Contains(keys, key) {
+		return NormalizeAddr(value), nil
+	}
+
+	return value, nil
+}
+
+// mergeKMSEnvConfig takes a KMS and merges any normalized values set via
+// environment variables.
+func mergeKMSEnvConfig(configKMS *KMS) error {
 	envConfig := GetEnvConfigFunc(configKMS)
 	if len(envConfig) > 0 && configKMS.Config == nil {
 		configKMS.Config = make(map[string]string)
 	}
 	// transit is a special case, because some config values take precedence over env vars
 	if configKMS.Type == wrapping.WrapperTypeTransit.String() {
-		mergeTransitConfig(configKMS.Config, envConfig)
+		if err := mergeTransitConfig(configKMS.Config, envConfig); err != nil {
+			return err
+		}
 	} else {
 		for name, val := range envConfig {
-			configKMS.Config[name] = val
+			var err error
+			configKMS.Config[name], err = normalizeKMSSealConfigAddrs(configKMS.Type, name, val)
+			if err != nil {
+				return err
+			}
 		}
 	}
 
+	return nil
+}
+
+func configureWrapper(configKMS *KMS, infoKeys *[]string, info *map[string]string, logger hclog.Logger, opts ...wrapping.Option) (wrapping.Wrapper, error) {
+	var wrapper wrapping.Wrapper
+	var kmsInfo map[string]string
+	var err error
+
+	// Get any seal config set as env variables and merge it into the KMS.
+	if err = mergeKMSEnvConfig(configKMS); err != nil {
+		return nil, err
+	}
+
 	switch wrapping.WrapperType(configKMS.Type) {
 	case wrapping.WrapperTypeShamir:
-		return nil, nil
+		return wrapper, nil
 
 	case wrapping.WrapperTypeAead:
 		wrapper, kmsInfo, err = GetAEADKMSFunc(configKMS, opts...)
@@ -317,7 +375,7 @@ func GetAliCloudKMSFunc(kms *KMS, opts ...wrapping.Option) (wrapping.Wrapper, ma
 
 var GetAWSKMSFunc = func(kms *KMS, opts ...wrapping.Option) (wrapping.Wrapper, map[string]string, error) {
 	wrapper := awskms.NewWrapper()
-	wrapperInfo, err := wrapper.SetConfig(context.Background(), append(opts, wrapping.WithDisallowEnvVars(true), wrapping.WithConfigMap(kms.Config))...)
+	wrapperInfo, err := wrapper.SetConfig(context.Background(), append(opts, awskms.WithDisallowEnvVars(true), wrapping.WithConfigMap(kms.Config))...)
 	if err != nil {
 		// If the error is any other than logical.KeyNotFoundError, return the error
 		if !errwrap.ContainsType(err, new(logical.KeyNotFoundError)) {
@@ -337,7 +395,7 @@ var GetAWSKMSFunc = func(kms *KMS, opts ...wrapping.Option) (wrapping.Wrapper, m
 
 func GetAzureKeyVaultKMSFunc(kms *KMS, opts ...wrapping.Option) (wrapping.Wrapper, map[string]string, error) {
 	wrapper := azurekeyvault.NewWrapper()
-	wrapperInfo, err := wrapper.SetConfig(context.Background(), append(opts, wrapping.WithDisallowEnvVars(true), wrapping.WithConfigMap(kms.Config))...)
+	wrapperInfo, err := wrapper.SetConfig(context.Background(), append(opts, azurekeyvault.WithDisallowEnvVars(true), wrapping.WithConfigMap(kms.Config))...)
 	if err != nil {
 		// If the error is any other than logical.KeyNotFoundError, return the error
 		if !errwrap.ContainsType(err, new(logical.KeyNotFoundError)) {
@@ -454,7 +512,7 @@ func getEnvConfig(kms *KMS) map[string]string {
 	return envValues
 }
 
-func mergeTransitConfig(config map[string]string, envConfig map[string]string) {
+func mergeTransitConfig(config map[string]string, envConfig map[string]string) error {
 	useFileTlsConfig := false
 	for _, varName := range TransitTLSConfigVars {
 		if _, ok := config[varName]; ok {
@@ -469,14 +527,20 @@ func mergeTransitConfig(config map[string]string, envConfig map[string]string) {
 		}
 	}
 
+	var err error
 	for varName, val := range envConfig {
 		// for some values, file config takes precedence
 		if strutil.StrListContains(TransitPrioritizeConfigValues, varName) && config[varName] != "" {
 			continue
 		}
 
-		config[varName] = val
+		config[varName], err = normalizeKMSSealConfigAddrs(wrapping.WrapperTypeTransit.String(), varName, val)
+		if err != nil {
+			return err
+		}
 	}
+
+	return nil
 }
 
 func (k *KMS) Clone() *KMS {
diff --git a/internalshared/configutil/kms_test.go b/internalshared/configutil/kms_test.go
index 9eb19a3e3d7..eb1eded5b20 100644
--- a/internalshared/configutil/kms_test.go
+++ b/internalshared/configutil/kms_test.go
@@ -1,12 +1,14 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
 
 import (
-	"os"
 	"reflect"
 	"testing"
+
+	"github.com/hashicorp/go-kms-wrapping/wrappers/ocikms/v2"
+	"github.com/stretchr/testify/require"
 )
 
 func Test_getEnvConfig(t *testing.T) {
@@ -83,20 +85,377 @@ func Test_getEnvConfig(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			for envName, envVal := range tt.envVars {
-				if err := os.Setenv(envName, envVal); err != nil {
-					t.Errorf("error setting environment vars for test: %s", err)
-				}
+				t.Setenv(envName, envVal)
 			}
 
 			if got := GetEnvConfigFunc(tt.kms); !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("getEnvConfig() = %v, want %v", got, tt.want)
 			}
+		})
+	}
+}
+
+// TestParseKMSesURLConformance tests that all config attrs whose values can be
+// URLs, IP addresses, or host:port addresses, when configured with an IPv6
+// address, the normalized to be conformant with RFC-5942 §4
+// See: https://rfc-editor.org/rfc/rfc5952.html
+func TestParseKMSesURLConformance(t *testing.T) {
+	t.Parallel()
+
+	for name, tc := range map[string]struct {
+		config     string
+		expected   map[string]string
+		shouldFail bool
+	}{
+		"alicloudkms ipv4": {
+			config: `
+seal "alicloudkms" {
+  region     = "us-east-1"
+	domain     = "kms.us-east-1.aliyuncs.com"
+  access_key = "0wNEpMMlzy7szvai"
+  secret_key = "PupkTg8jdmau1cXxYacgE736PJj4cA"
+  kms_key_id = "08c33a6f-4e0a-4a1b-a3fa-7ddfa1d4fb73"
+}`,
+			expected: map[string]string{
+				"region":     "us-east-1",
+				"domain":     "kms.us-east-1.aliyuncs.com",
+				"access_key": "0wNEpMMlzy7szvai",
+				"secret_key": "PupkTg8jdmau1cXxYacgE736PJj4cA",
+				"kms_key_id": "08c33a6f-4e0a-4a1b-a3fa-7ddfa1d4fb73",
+			},
+		},
+		"alicloudkms ipv6": {
+			config: `
+seal "alicloudkms" {
+  region     = "us-east-1"
+	domain     = "2001:db8:0:0:0:0:2:1"
+  access_key = "0wNEpMMlzy7szvai"
+  secret_key = "PupkTg8jdmau1cXxYacgE736PJj4cA"
+  kms_key_id = "08c33a6f-4e0a-4a1b-a3fa-7ddfa1d4fb73"
+}`,
+			expected: map[string]string{
+				"region":     "us-east-1",
+				"domain":     "2001:db8::2:1",
+				"access_key": "0wNEpMMlzy7szvai",
+				"secret_key": "PupkTg8jdmau1cXxYacgE736PJj4cA",
+				"kms_key_id": "08c33a6f-4e0a-4a1b-a3fa-7ddfa1d4fb73",
+			},
+		},
+		"awskms ipv4": {
+			config: `
+seal "awskms" {
+  region     = "us-east-1"
+  access_key = "AKIAIOSFODNN7EXAMPLE"
+  secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+  kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey"
+	endpoint   = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com"
+}`,
+			expected: map[string]string{
+				"region":     "us-east-1",
+				"access_key": "AKIAIOSFODNN7EXAMPLE",
+				"secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+				"kms_key_id": "19ec80b0-dfdd-4d97-8164-c6examplekey",
+				"endpoint":   "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com",
+			},
+		},
+		"awskms ipv6": {
+			config: `
+seal "awskms" {
+  region     = "us-east-1"
+  access_key = "AKIAIOSFODNN7EXAMPLE"
+  secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+  kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey"
+  endpoint   = "https://[2001:db8:0:0:0:0:2:1]:5984/my-aws-endpoint"
+}`,
+			expected: map[string]string{
+				"region":     "us-east-1",
+				"access_key": "AKIAIOSFODNN7EXAMPLE",
+				"secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+				"kms_key_id": "19ec80b0-dfdd-4d97-8164-c6examplekey",
+				"endpoint":   "https://[2001:db8::2:1]:5984/my-aws-endpoint",
+			},
+		},
+		"azurekeyvault ipv4": {
+			config: `
+seal "azurekeyvault" {
+  tenant_id      = "46646709-b63e-4747-be42-516edeaf1e14"
+  client_id      = "03dc33fc-16d9-4b77-8152-3ec568f8af6e"
+  client_secret  = "DUJDS3..."
+  vault_name     = "hc-vault"
+  key_name       = "vault_key"
+	resource       = "vault.azure.net"
+}`,
+			expected: map[string]string{
+				"tenant_id":     "46646709-b63e-4747-be42-516edeaf1e14",
+				"client_id":     "03dc33fc-16d9-4b77-8152-3ec568f8af6e",
+				"client_secret": "DUJDS3...",
+				"vault_name":    "hc-vault",
+				"key_name":      "vault_key",
+				"resource":      "vault.azure.net",
+			},
+		},
+		"azurekeyvault ipv6": {
+			config: `
+seal "azurekeyvault" {
+  tenant_id      = "46646709-b63e-4747-be42-516edeaf1e14"
+  client_id      = "03dc33fc-16d9-4b77-8152-3ec568f8af6e"
+  client_secret  = "DUJDS3..."
+  vault_name     = "hc-vault"
+  key_name       = "vault_key"
+  resource       = "2001:db8:0:0:0:0:2:1",
+}`,
+			expected: map[string]string{
+				"tenant_id":     "46646709-b63e-4747-be42-516edeaf1e14",
+				"client_id":     "03dc33fc-16d9-4b77-8152-3ec568f8af6e",
+				"client_secret": "DUJDS3...",
+				"vault_name":    "hc-vault",
+				"key_name":      "vault_key",
+				"resource":      "2001:db8::2:1",
+			},
+		},
+		"ocikms ipv4": {
+			config: `
+seal "ocikms" {
+	key_id               = "ocid1.key.oc1.iad.afnxza26aag4s.abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx"
+	crypto_endpoint      = "https://afnxza26aag4s-crypto.kms.us-ashburn-1.oraclecloud.com"
+	management_endpoint  = "https://afnxza26aag4s-management.kms.us-ashburn-1.oraclecloud.com"
+	auth_type_api_key    = "true"
+}`,
+			expected: map[string]string{
+				"key_id":              "ocid1.key.oc1.iad.afnxza26aag4s.abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx",
+				"crypto_endpoint":     "https://afnxza26aag4s-crypto.kms.us-ashburn-1.oraclecloud.com",
+				"management_endpoint": "https://afnxza26aag4s-management.kms.us-ashburn-1.oraclecloud.com",
+				"auth_type_api_key":   "true",
+			},
+		},
+		"ocikms ipv6": {
+			config: `
+seal "ocikms" {
+  key_id               = "https://[2001:db8:0:0:0:0:2:1]/abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx"
+  crypto_endpoint      = "https://[2001:db8:0:0:0:0:2:1]/afnxza26aag4s-crypto"
+  management_endpoint  = "https://[2001:db8:0:0:0:0:2:1]/afnxza26aag4s-management"
+  auth_type_api_key    = "true"
+}`,
+			expected: map[string]string{
+				"key_id":              "https://[2001:db8::2:1]/abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx",
+				"crypto_endpoint":     "https://[2001:db8::2:1]/afnxza26aag4s-crypto",
+				"management_endpoint": "https://[2001:db8::2:1]/afnxza26aag4s-management",
+				"auth_type_api_key":   "true",
+			},
+		},
+		"transit ipv4": {
+			config: `
+seal "transit" {
+  address            = "https://vault:8200"
+  token              = "s.Qf1s5zigZ4OX6akYjQXJC1jY"
+  disable_renewal    = "false"
+  key_name           = "transit_key_name"
+  mount_path         = "transit/"
+  namespace          = "ns1/"
+}
+`,
+			expected: map[string]string{
+				"address":         "https://vault:8200",
+				"token":           "s.Qf1s5zigZ4OX6akYjQXJC1jY",
+				"disable_renewal": "false",
+				"key_name":        "transit_key_name",
+				"mount_path":      "transit/",
+				"namespace":       "ns1/",
+			},
+		},
+		"transit ipv6": {
+			config: `
+seal "transit" {
+  address            = "https://[2001:db8:0:0:0:0:2:1]:8200"
+  token              = "s.Qf1s5zigZ4OX6akYjQXJC1jY"
+  disable_renewal    = "false"
+  key_name           = "transit_key_name"
+  mount_path         = "transit/"
+  namespace          = "ns1/"
+}
+`,
+			expected: map[string]string{
+				"address":         "https://[2001:db8::2:1]:8200",
+				"token":           "s.Qf1s5zigZ4OX6akYjQXJC1jY",
+				"disable_renewal": "false",
+				"key_name":        "transit_key_name",
+				"mount_path":      "transit/",
+				"namespace":       "ns1/",
+			},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			kmses, err := ParseKMSes(tc.config)
+			require.NoError(t, err)
+			require.Len(t, kmses, 1)
+			require.EqualValues(t, tc.expected, kmses[0].Config)
+		})
+	}
+}
+
+// TestMergeKMSEnvConfigAddrConformance tests that all env config whose values
+// can be URLs, IP addresses, or host:port addresses, when configured with an
+// an IPv6 address, the normalized to be conformant with RFC-5942 §4
+// See: https://rfc-editor.org/rfc/rfc5952.html
+func TestMergeKMSEnvConfigAddrConformance(t *testing.T) {
+	for name, tc := range map[string]struct {
+		sealType  string // default to name if none given
+		kmsConfig map[string]string
+		envVars   map[string]string
+		expected  map[string]string
+	}{
+		"alicloudkms": {
+			kmsConfig: map[string]string{
+				"region":     "us-east-1",
+				"domain":     "kms.us-east-1.aliyuncs.com",
+				"access_key": "0wNEpMMlzy7szvai",
+				"secret_key": "PupkTg8jdmau1cXxYacgE736PJj4cA",
+				"kms_key_id": "08c33a6f-4e0a-4a1b-a3fa-7ddfa1d4fb73",
+			},
+			envVars: map[string]string{"ALICLOUD_DOMAIN": "2001:db8:0:0:0:0:2:1"},
+			expected: map[string]string{
+				"region":     "us-east-1",
+				"domain":     "2001:db8::2:1",
+				"access_key": "0wNEpMMlzy7szvai",
+				"secret_key": "PupkTg8jdmau1cXxYacgE736PJj4cA",
+				"kms_key_id": "08c33a6f-4e0a-4a1b-a3fa-7ddfa1d4fb73",
+			},
+		},
+		"awskms": {
+			kmsConfig: map[string]string{
+				"region":     "us-east-1",
+				"access_key": "AKIAIOSFODNN7EXAMPLE",
+				"secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+				"kms_key_id": "19ec80b0-dfdd-4d97-8164-c6examplekey",
+				"endpoint":   "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com",
+			},
+			envVars: map[string]string{"AWS_KMS_ENDPOINT": "https://[2001:db8:0:0:0:0:2:1]:5984/my-aws-endpoint"},
+			expected: map[string]string{
+				"region":     "us-east-1",
+				"access_key": "AKIAIOSFODNN7EXAMPLE",
+				"secret_key": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+				"kms_key_id": "19ec80b0-dfdd-4d97-8164-c6examplekey",
+				"endpoint":   "https://[2001:db8::2:1]:5984/my-aws-endpoint",
+			},
+		},
+		"azurekeyvault": {
+			kmsConfig: map[string]string{
+				"tenant_id":     "46646709-b63e-4747-be42-516edeaf1e14",
+				"client_id":     "03dc33fc-16d9-4b77-8152-3ec568f8af6e",
+				"client_secret": "DUJDS3...",
+				"vault_name":    "hc-vault",
+				"key_name":      "vault_key",
+				"resource":      "vault.azure.net",
+			},
+			envVars: map[string]string{"AZURE_AD_RESOURCE": "2001:db8:0:0:0:0:2:1"},
+			expected: map[string]string{
+				"tenant_id":     "46646709-b63e-4747-be42-516edeaf1e14",
+				"client_id":     "03dc33fc-16d9-4b77-8152-3ec568f8af6e",
+				"client_secret": "DUJDS3...",
+				"vault_name":    "hc-vault",
+				"key_name":      "vault_key",
+				"resource":      "2001:db8::2:1",
+			},
+		},
+		"ocikms wrapper env vars": {
+			sealType: "ocikms",
+			kmsConfig: map[string]string{
+				"key_id":              "ocid1.key.oc1.iad.afnxza26aag4s.abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx",
+				"crypto_endpoint":     "https://afnxza26aag4s-crypto.kms.us-ashburn-1.oraclecloud.com",
+				"management_endpoint": "https://afnxza26aag4s-management.kms.us-ashburn-1.oraclecloud.com",
+				"auth_type_api_key":   "true",
+			},
+			envVars: map[string]string{
+				ocikms.EnvOciKmsWrapperKeyId:              "https://[2001:db8:0:0:0:0:2:1]/abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx",
+				ocikms.EnvOciKmsWrapperCryptoEndpoint:     "https://[2001:db8:0:0:0:0:2:1]/afnxza26aag4s-crypto",
+				ocikms.EnvOciKmsWrapperManagementEndpoint: "https://[2001:db8:0:0:0:0:2:1]/afnxza26aag4s-management",
+			},
+			expected: map[string]string{
+				"key_id":              "https://[2001:db8::2:1]/abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx",
+				"crypto_endpoint":     "https://[2001:db8::2:1]/afnxza26aag4s-crypto",
+				"management_endpoint": "https://[2001:db8::2:1]/afnxza26aag4s-management",
+				"auth_type_api_key":   "true",
+			},
+		},
+		"ocikms vault env vars": {
+			sealType: "ocikms",
+			kmsConfig: map[string]string{
+				"key_id":              "ocid1.key.oc1.iad.afnxza26aag4s.abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx",
+				"crypto_endpoint":     "https://afnxza26aag4s-crypto.kms.us-ashburn-1.oraclecloud.com",
+				"management_endpoint": "https://afnxza26aag4s-management.kms.us-ashburn-1.oraclecloud.com",
+				"auth_type_api_key":   "true",
+			},
+			envVars: map[string]string{
+				ocikms.EnvVaultOciKmsSealKeyId:              "https://[2001:db8:0:0:0:0:2:1]/abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx",
+				ocikms.EnvVaultOciKmsSealCryptoEndpoint:     "https://[2001:db8:0:0:0:0:2:1]/afnxza26aag4s-crypto",
+				ocikms.EnvVaultOciKmsSealManagementEndpoint: "https://[2001:db8:0:0:0:0:2:1]/afnxza26aag4s-management",
+			},
+			expected: map[string]string{
+				"key_id":              "https://[2001:db8::2:1]/abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx",
+				"crypto_endpoint":     "https://[2001:db8::2:1]/afnxza26aag4s-crypto",
+				"management_endpoint": "https://[2001:db8::2:1]/afnxza26aag4s-management",
+				"auth_type_api_key":   "true",
+			},
+		},
+		"transit addr not in config": {
+			sealType: "transit",
+			kmsConfig: map[string]string{
+				"token":           "s.Qf1s5zigZ4OX6akYjQXJC1jY",
+				"disable_renewal": "false",
+				"key_name":        "transit_key_name",
+				"mount_path":      "transit/",
+				"namespace":       "ns1/",
+			},
+			envVars: map[string]string{"VAULT_ADDR": "https://[2001:db8:0:0:0:0:2:1]:8200"},
+			expected: map[string]string{
+				// NOTE: If our address has not been configured we'll fall back to VAULT_ADDR for transit.
+				"address":         "https://[2001:db8::2:1]:8200",
+				"token":           "s.Qf1s5zigZ4OX6akYjQXJC1jY",
+				"disable_renewal": "false",
+				"key_name":        "transit_key_name",
+				"mount_path":      "transit/",
+				"namespace":       "ns1/",
+			},
+		},
+		"transit addr in config": {
+			sealType: "transit",
+			kmsConfig: map[string]string{
+				"address":         "https://vault:8200",
+				"token":           "s.Qf1s5zigZ4OX6akYjQXJC1jY",
+				"disable_renewal": "false",
+				"key_name":        "transit_key_name",
+				"mount_path":      "transit/",
+				"namespace":       "ns1/",
+			},
+			envVars: map[string]string{"VAULT_ADDR": "https://[2001:db8:0:0:0:0:2:1]:8200"},
+			expected: map[string]string{
+				// NOTE: If our address has been configured we don't consider VAULT_ADDR
+				"address":         "https://vault:8200",
+				"token":           "s.Qf1s5zigZ4OX6akYjQXJC1jY",
+				"disable_renewal": "false",
+				"key_name":        "transit_key_name",
+				"mount_path":      "transit/",
+				"namespace":       "ns1/",
+			},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			typ := name
+			if tc.sealType != "" {
+				typ = tc.sealType
+			}
+			kms := &KMS{
+				Type:   typ,
+				Config: tc.kmsConfig,
+			}
 
-			for env := range tt.envVars {
-				if err := os.Unsetenv(env); err != nil {
-					t.Errorf("error unsetting environment vars for test: %s", err)
-				}
+			for envName, envVal := range tc.envVars {
+				t.Setenv(envName, envVal)
 			}
+
+			require.NoError(t, mergeKMSEnvConfig(kms))
+			require.EqualValues(t, tc.expected, kms.Config)
 		})
 	}
 }
diff --git a/internalshared/configutil/lint.go b/internalshared/configutil/lint.go
index 3831564549c..227661b5cfc 100644
--- a/internalshared/configutil/lint.go
+++ b/internalshared/configutil/lint.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
diff --git a/internalshared/configutil/listener.go b/internalshared/configutil/listener.go
index 2c526eca9bc..5224778096d 100644
--- a/internalshared/configutil/listener.go
+++ b/internalshared/configutil/listener.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
@@ -94,14 +94,16 @@ type Listener struct {
 	ProxyProtocolAuthorizedAddrs    []*sockaddr.SockAddrMarshaler `hcl:"-"`
 	ProxyProtocolAuthorizedAddrsRaw interface{}                   `hcl:"proxy_protocol_authorized_addrs,alias:ProxyProtocolAuthorizedAddrs"`
 
-	XForwardedForAuthorizedAddrs        []*sockaddr.SockAddrMarshaler `hcl:"-"`
-	XForwardedForAuthorizedAddrsRaw     interface{}                   `hcl:"x_forwarded_for_authorized_addrs,alias:XForwardedForAuthorizedAddrs"`
-	XForwardedForHopSkips               int64                         `hcl:"-"`
-	XForwardedForHopSkipsRaw            interface{}                   `hcl:"x_forwarded_for_hop_skips,alias:XForwardedForHopSkips"`
-	XForwardedForRejectNotPresent       bool                          `hcl:"-"`
-	XForwardedForRejectNotPresentRaw    interface{}                   `hcl:"x_forwarded_for_reject_not_present,alias:XForwardedForRejectNotPresent"`
-	XForwardedForRejectNotAuthorized    bool                          `hcl:"-"`
-	XForwardedForRejectNotAuthorizedRaw interface{}                   `hcl:"x_forwarded_for_reject_not_authorized,alias:XForwardedForRejectNotAuthorized"`
+	XForwardedForAuthorizedAddrs          []*sockaddr.SockAddrMarshaler `hcl:"-"`
+	XForwardedForAuthorizedAddrsRaw       interface{}                   `hcl:"x_forwarded_for_authorized_addrs,alias:XForwardedForAuthorizedAddrs"`
+	XForwardedForHopSkips                 int64                         `hcl:"-"`
+	XForwardedForHopSkipsRaw              interface{}                   `hcl:"x_forwarded_for_hop_skips,alias:XForwardedForHopSkips"`
+	XForwardedForRejectNotPresent         bool                          `hcl:"-"`
+	XForwardedForRejectNotPresentRaw      interface{}                   `hcl:"x_forwarded_for_reject_not_present,alias:XForwardedForRejectNotPresent"`
+	XForwardedForRejectNotAuthorized      bool                          `hcl:"-"`
+	XForwardedForRejectNotAuthorizedRaw   interface{}                   `hcl:"x_forwarded_for_reject_not_authorized,alias:XForwardedForRejectNotAuthorized"`
+	XForwardedForClientCertHeader         string                        `hcl:"x_forwarded_for_client_cert_header,alias:XForwardedForClientCertHeader"`
+	XForwardedForClientCertHeaderDecoders string                        `hcl:"x_forwarded_for_client_cert_header_decoders,alias:XForwardedForClientCertHeaderDecoders"`
 
 	SocketMode  string `hcl:"socket_mode"`
 	SocketUser  string `hcl:"socket_user"`
@@ -147,6 +149,28 @@ type Listener struct {
 	// DisableRequestLimiter allows per-listener disabling of the Request Limiter.
 	DisableRequestLimiterRaw any  `hcl:"disable_request_limiter"`
 	DisableRequestLimiter    bool `hcl:"-"`
+
+	// JSON-specific limits
+
+	// CustomMaxJSONDepth specifies the maximum nesting depth of a JSON object.
+	CustomMaxJSONDepthRaw interface{} `hcl:"max_json_depth"`
+	CustomMaxJSONDepth    int64       `hcl:"-"`
+
+	// CustomMaxJSONStringValueLength defines the maximum allowed length for a string in a JSON payload.
+	CustomMaxJSONStringValueLengthRaw interface{} `hcl:"max_json_string_value_length"`
+	CustomMaxJSONStringValueLength    int64       `hcl:"-"`
+
+	// CustomMaxJSONObjectEntryCount sets the maximum number of key-value pairs in a JSON object.
+	CustomMaxJSONObjectEntryCountRaw interface{} `hcl:"max_json_object_entry_count"`
+	CustomMaxJSONObjectEntryCount    int64       `hcl:"-"`
+
+	// CustomMaxJSONArrayElementCount determines the maximum number of elements in a JSON array.
+	CustomMaxJSONArrayElementCountRaw interface{} `hcl:"max_json_array_element_count"`
+	CustomMaxJSONArrayElementCount    int64       `hcl:"-"`
+
+	// CustomMaxJSONToken determines the maximum number of tokens in a JSON.
+	CustomMaxJSONTokenRaw interface{} `hcl:"max_json_token"`
+	CustomMaxJSONToken    int64       `hcl:"-"`
 }
 
 // AgentAPI allows users to select which parts of the Agent API they want enabled.
@@ -175,7 +199,7 @@ func (l *Listener) Validate(path string) []ConfigError {
 func ParseSingleIPTemplate(ipTmpl string) (string, error) {
 	r := regexp.MustCompile("{{.*?}}")
 	if !r.MatchString(ipTmpl) {
-		return ipTmpl, nil
+		return NormalizeAddr(ipTmpl), nil
 	}
 
 	out, err := template.Parse(ipTmpl)
@@ -466,6 +490,10 @@ func (l *Listener) parseRequestSettings() error {
 		return fmt.Errorf("invalid value for disable_request_limiter: %w", err)
 	}
 
+	if err := l.parseJSONLimitsSettings(); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -560,9 +588,9 @@ func (l *Listener) parseProxySettings() error {
 
 	// Validation/sanity check on allowed settings for behavior.
 	switch l.ProxyProtocolBehavior {
-	case "allow_authorized", "deny_authorized", "use_always", "":
+	case "allow_authorized", "deny_unauthorized", "use_always", "":
 		// Ignore these cases, they're all valid values.
-		// In the case of 'allow_authorized' and 'deny_authorized', we don't need
+		// In the case of 'allow_authorized' and 'deny_unauthorized', we don't need
 		// to check how many addresses we have in ProxyProtocolAuthorizedAddrs
 		// as parseutil.ParseAddrs returns "one or more addresses" (or an error)
 		// so we'd have returned earlier.
@@ -636,7 +664,7 @@ func (l *Listener) parseProfilingSettings() error {
 	return nil
 }
 
-// parseProfilingSettings attempts to parse the raw listener in-flight request logging settings.
+// parseInFlightRequestSettings attempts to parse the raw listener in-flight request logging settings.
 // The state of the listener will be modified, raw data will be cleared upon
 // successful parsing.
 func (l *Listener) parseInFlightRequestSettings() error {
@@ -708,3 +736,42 @@ func (l *Listener) parseRedactionSettings() error {
 
 	return nil
 }
+
+func (l *Listener) parseJSONLimitsSettings() error {
+	if err := parseAndClearInt(&l.CustomMaxJSONDepthRaw, &l.CustomMaxJSONDepth); err != nil {
+		return fmt.Errorf("error parsing max_json_depth: %w", err)
+	}
+	if l.CustomMaxJSONDepth < 0 {
+		return fmt.Errorf("max_json_depth cannot be negative")
+	}
+
+	if err := parseAndClearInt(&l.CustomMaxJSONStringValueLengthRaw, &l.CustomMaxJSONStringValueLength); err != nil {
+		return fmt.Errorf("error parsing max_json_string_value_length: %w", err)
+	}
+	if l.CustomMaxJSONStringValueLength < 0 {
+		return fmt.Errorf("max_json_string_value_length cannot be negative")
+	}
+
+	if err := parseAndClearInt(&l.CustomMaxJSONObjectEntryCountRaw, &l.CustomMaxJSONObjectEntryCount); err != nil {
+		return fmt.Errorf("error parsing max_json_object_entry_count: %w", err)
+	}
+	if l.CustomMaxJSONObjectEntryCount < 0 {
+		return fmt.Errorf("max_json_object_entry_count cannot be negative")
+	}
+
+	if err := parseAndClearInt(&l.CustomMaxJSONArrayElementCountRaw, &l.CustomMaxJSONArrayElementCount); err != nil {
+		return fmt.Errorf("error parsing max_json_array_element_count: %w", err)
+	}
+	if l.CustomMaxJSONArrayElementCount < 0 {
+		return fmt.Errorf("max_json_array_element_count cannot be negative")
+	}
+
+	if err := parseAndClearInt(&l.CustomMaxJSONTokenRaw, &l.CustomMaxJSONToken); err != nil {
+		return fmt.Errorf("error parsing max_json_token: %w", err)
+	}
+	if l.CustomMaxJSONToken < 0 {
+		return fmt.Errorf("max_json_token cannot be negative")
+	}
+
+	return nil
+}
diff --git a/internalshared/configutil/listener_test.go b/internalshared/configutil/listener_test.go
index bfd922faa89..4620f164c6e 100644
--- a/internalshared/configutil/listener_test.go
+++ b/internalshared/configutil/listener_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
@@ -16,17 +16,49 @@ import (
 // ensure that we only attempt to parse templates when the input contains a
 // template placeholder (see: go-sockaddr/template).
 func TestListener_ParseSingleIPTemplate(t *testing.T) {
+	t.Parallel()
+
 	tests := map[string]struct {
 		arg             string
 		want            string
 		isErrorExpected bool
 		errorMessage    string
 	}{
-		"test https addr": {
+		"test hostname": {
 			arg:             "https://vaultproject.io:8200",
 			want:            "https://vaultproject.io:8200",
 			isErrorExpected: false,
 		},
+		"test ipv4": {
+			arg:             "https://10.10.1.10:8200",
+			want:            "https://10.10.1.10:8200",
+			isErrorExpected: false,
+		},
+		"test ipv6 RFC-5952 4.1 conformance leading zeroes": {
+			arg:             "https://[2001:0db8::0001]:8200",
+			want:            "https://[2001:db8::1]:8200",
+			isErrorExpected: false,
+		},
+		"test ipv6 RFC-5952 4.2.2 conformance one 16-bit 0 field": {
+			arg:             "https://[2001:db8:0:1:1:1:1:1]:8200",
+			want:            "https://[2001:db8:0:1:1:1:1:1]:8200",
+			isErrorExpected: false,
+		},
+		"test ipv6 RFC-5952 4.2.3 conformance longest run of 0 bits shortened": {
+			arg:             "https://[2001:0:0:1:0:0:0:1]:8200",
+			want:            "https://[2001:0:0:1::1]:8200",
+			isErrorExpected: false,
+		},
+		"test ipv6 RFC-5952 4.2.3 conformance equal runs of 0 bits shortened": {
+			arg:             "https://[2001:db8:0:0:1:0:0:1]:8200",
+			want:            "https://[2001:db8::1:0:0:1]:8200",
+			isErrorExpected: false,
+		},
+		"test ipv6 RFC-5952 4.3 conformance downcase hex letters": {
+			arg:             "https://[2001:DB8:AC3:FE4::1]:8200",
+			want:            "https://[2001:db8:ac3:fe4::1]:8200",
+			isErrorExpected: false,
+		},
 		"test invalid template func": {
 			arg:             "{{ FooBar }}",
 			want:            "",
@@ -43,6 +75,7 @@ func TestListener_ParseSingleIPTemplate(t *testing.T) {
 		name := name
 		tc := tc
 		t.Run(name, func(t *testing.T) {
+			t.Parallel()
 			got, err := ParseSingleIPTemplate(tc.arg)
 
 			if tc.isErrorExpected {
@@ -181,16 +214,26 @@ func TestListener_parseRequestSettings(t *testing.T) {
 	t.Parallel()
 
 	tests := map[string]struct {
-		rawMaxRequestSize             any
-		expectedMaxRequestSize        int64
-		rawMaxRequestDuration         any
-		expectedDuration              time.Duration
-		rawRequireRequestHeader       any
-		expectedRequireRequestHeader  bool
-		rawDisableRequestLimiter      any
-		expectedDisableRequestLimiter bool
-		isErrorExpected               bool
-		errorMessage                  string
+		rawMaxRequestSize                      any
+		expectedMaxRequestSize                 int64
+		rawMaxRequestDuration                  any
+		expectedDuration                       time.Duration
+		rawRequireRequestHeader                any
+		expectedRequireRequestHeader           bool
+		rawDisableRequestLimiter               any
+		expectedDisableRequestLimiter          bool
+		rawCustomMaxJSONDepth                  any
+		expectedCustomMaxJSONDepth             int64
+		rawCustomMaxJSONStringValueLength      any
+		expectedCustomMaxJSONStringValueLength int64
+		rawCustomMaxJSONObjectEntryCount       any
+		expectedCustomMaxJSONObjectEntryCount  int64
+		rawCustomMaxJSONArrayElementCount      any
+		expectedCustomMaxJSONArrayElementCount int64
+		rawCustomMaxJSONToken                  any
+		expectedCustomMaxJSONToken             int64
+		isErrorExpected                        bool
+		errorMessage                           string
 	}{
 		"nil": {
 			isErrorExpected: false,
@@ -205,37 +248,80 @@ func TestListener_parseRequestSettings(t *testing.T) {
 			expectedMaxRequestSize: 5,
 			isErrorExpected:        false,
 		},
-		"max-request-duration-bad": {
-			rawMaxRequestDuration: "juan",
+		"max-json-depth-bad": {
+			rawCustomMaxJSONDepth: "badvalue",
 			isErrorExpected:       true,
-			errorMessage:          "error parsing max_request_duration",
+			errorMessage:          "error parsing max_json_depth",
 		},
-		"max-request-duration-good": {
-			rawMaxRequestDuration: "30s",
-			expectedDuration:      30 * time.Second,
-			isErrorExpected:       false,
+		"max-json-depth-negative": {
+			rawCustomMaxJSONDepth: "-1",
+			isErrorExpected:       true,
+			errorMessage:          "max_json_depth cannot be negative",
+		},
+		"max-json-depth-good": {
+			rawCustomMaxJSONDepth:      "100",
+			expectedCustomMaxJSONDepth: 100,
+			isErrorExpected:            false,
+		},
+		"max-json-string-value-length-bad": {
+			rawCustomMaxJSONStringValueLength: "badvalue",
+			isErrorExpected:                   true,
+			errorMessage:                      "error parsing max_json_string_value_length",
+		},
+		"max-json-string-value-length-negative": {
+			rawCustomMaxJSONStringValueLength: "-1",
+			isErrorExpected:                   true,
+			errorMessage:                      "max_json_string_value_length cannot be negative",
+		},
+		"max-json-string-value-length-good": {
+			rawCustomMaxJSONStringValueLength:      "2048",
+			expectedCustomMaxJSONStringValueLength: 2048,
+			isErrorExpected:                        false,
+		},
+		"custom-max-json-object-entry-count-bad": {
+			rawCustomMaxJSONObjectEntryCount: "badvalue",
+			isErrorExpected:                  true,
+			errorMessage:                     "error parsing max_json_object_entry_count",
 		},
-		"require-request-header-bad": {
-			rawRequireRequestHeader:      "juan",
-			expectedRequireRequestHeader: false,
-			isErrorExpected:              true,
-			errorMessage:                 "invalid value for require_request_header",
+		"max-json-object-entry-count-negative": {
+			rawCustomMaxJSONObjectEntryCount: "-1",
+			isErrorExpected:                  true,
+			errorMessage:                     "max_json_object_entry_count cannot be negative",
 		},
-		"require-request-header-good": {
-			rawRequireRequestHeader:      "true",
-			expectedRequireRequestHeader: true,
-			isErrorExpected:              false,
+		"max-json-object-entry-count-good": {
+			rawCustomMaxJSONObjectEntryCount:      "500",
+			expectedCustomMaxJSONObjectEntryCount: 500,
+			isErrorExpected:                       false,
 		},
-		"disable-request-limiter-bad": {
-			rawDisableRequestLimiter:      "badvalue",
-			expectedDisableRequestLimiter: false,
-			isErrorExpected:               true,
-			errorMessage:                  "invalid value for disable_request_limiter",
+		"max-json-array-element-count-bad": {
+			rawCustomMaxJSONArrayElementCount: "badvalue",
+			isErrorExpected:                   true,
+			errorMessage:                      "error parsing max_json_array_element_count",
 		},
-		"disable-request-limiter-good": {
-			rawDisableRequestLimiter:      "true",
-			expectedDisableRequestLimiter: true,
-			isErrorExpected:               false,
+		"max-json-array-element-count-negative": {
+			rawCustomMaxJSONArrayElementCount: "-1",
+			isErrorExpected:                   true,
+			errorMessage:                      "max_json_array_element_count cannot be negative",
+		},
+		"max-json-array-element-count-good": {
+			rawCustomMaxJSONArrayElementCount:      "500",
+			expectedCustomMaxJSONArrayElementCount: 500,
+			isErrorExpected:                        false,
+		},
+		"max-json-token-bad": {
+			rawCustomMaxJSONToken: "badvalue",
+			isErrorExpected:       true,
+			errorMessage:          "error parsing max_json_token",
+		},
+		"max-json-token-negative": {
+			rawCustomMaxJSONToken: "-1",
+			isErrorExpected:       true,
+			errorMessage:          "max_json_token cannot be negative",
+		},
+		"max-json-token-good": {
+			rawCustomMaxJSONToken:      "500000",
+			expectedCustomMaxJSONToken: 500000,
+			isErrorExpected:            false,
 		},
 	}
 
@@ -245,12 +331,16 @@ func TestListener_parseRequestSettings(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 
-			// Configure listener with raw values
 			l := &Listener{
-				MaxRequestSizeRaw:        tc.rawMaxRequestSize,
-				MaxRequestDurationRaw:    tc.rawMaxRequestDuration,
-				RequireRequestHeaderRaw:  tc.rawRequireRequestHeader,
-				DisableRequestLimiterRaw: tc.rawDisableRequestLimiter,
+				MaxRequestSizeRaw:                 tc.rawMaxRequestSize,
+				MaxRequestDurationRaw:             tc.rawMaxRequestDuration,
+				RequireRequestHeaderRaw:           tc.rawRequireRequestHeader,
+				DisableRequestLimiterRaw:          tc.rawDisableRequestLimiter,
+				CustomMaxJSONDepthRaw:             tc.rawCustomMaxJSONDepth,
+				CustomMaxJSONStringValueLengthRaw: tc.rawCustomMaxJSONStringValueLength,
+				CustomMaxJSONObjectEntryCountRaw:  tc.rawCustomMaxJSONObjectEntryCount,
+				CustomMaxJSONArrayElementCountRaw: tc.rawCustomMaxJSONArrayElementCount,
+				CustomMaxJSONTokenRaw:             tc.rawCustomMaxJSONToken,
 			}
 
 			err := l.parseRequestSettings()
@@ -260,15 +350,23 @@ func TestListener_parseRequestSettings(t *testing.T) {
 				require.Error(t, err)
 				require.ErrorContains(t, err, tc.errorMessage)
 			default:
-				// Assert we got the relevant values.
 				require.NoError(t, err)
 				require.Equal(t, tc.expectedMaxRequestSize, l.MaxRequestSize)
-				require.Equal(t, tc.expectedDuration, l.MaxRequestDuration)
+				require.Equal(t, tc.expectedCustomMaxJSONDepth, l.CustomMaxJSONDepth)
+				require.Equal(t, tc.expectedCustomMaxJSONStringValueLength, l.CustomMaxJSONStringValueLength)
+				require.Equal(t, tc.expectedCustomMaxJSONObjectEntryCount, l.CustomMaxJSONObjectEntryCount)
+				require.Equal(t, tc.expectedCustomMaxJSONArrayElementCount, l.CustomMaxJSONArrayElementCount)
+				require.Equal(t, tc.expectedCustomMaxJSONToken, l.CustomMaxJSONToken)
 				require.Equal(t, tc.expectedRequireRequestHeader, l.RequireRequestHeader)
 				require.Equal(t, tc.expectedDisableRequestLimiter, l.DisableRequestLimiter)
+				require.Equal(t, tc.expectedDuration, l.MaxRequestDuration)
 
-				// Ensure the state was modified for the raw values.
 				require.Nil(t, l.MaxRequestSizeRaw)
+				require.Nil(t, l.CustomMaxJSONDepthRaw)
+				require.Nil(t, l.CustomMaxJSONStringValueLengthRaw)
+				require.Nil(t, l.CustomMaxJSONObjectEntryCountRaw)
+				require.Nil(t, l.CustomMaxJSONArrayElementCountRaw)
+				require.Nil(t, l.CustomMaxJSONTokenRaw)
 				require.Nil(t, l.MaxRequestDurationRaw)
 				require.Nil(t, l.RequireRequestHeaderRaw)
 				require.Nil(t, l.DisableRequestLimiterRaw)
@@ -529,7 +627,7 @@ func TestListener_parseProxySettings(t *testing.T) {
 		"behavior-deny": {
 			rawProxyProtocolAuthorizedAddrs: "10.0.0.1,10.0.2.1",
 			expectedNumAddrs:                2,
-			proxyBehavior:                   "deny_authorized",
+			proxyBehavior:                   "deny_unauthorized",
 			isErrorExpected:                 false,
 		},
 	}
diff --git a/internalshared/configutil/merge.go b/internalshared/configutil/merge.go
index b1178e314ba..459f30aa049 100644
--- a/internalshared/configutil/merge.go
+++ b/internalshared/configutil/merge.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
@@ -98,10 +98,7 @@ func (c *SharedConfig) Merge(c2 *SharedConfig) *SharedConfig {
 		result.ClusterName = c2.ClusterName
 	}
 
-	result.RequestLimiter = c.RequestLimiter
-	if c2.RequestLimiter != nil {
-		result.RequestLimiter = c2.RequestLimiter
-	}
+	result.FoundKeys = append(c.FoundKeys, c2.FoundKeys...)
 
 	return result
 }
diff --git a/internalshared/configutil/merge_test.go b/internalshared/configutil/merge_test.go
new file mode 100644
index 00000000000..8a5f89b9c3f
--- /dev/null
+++ b/internalshared/configutil/merge_test.go
@@ -0,0 +1,313 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package configutil
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestMerge tests SharedConfig#Merge
+func TestMerge(t *testing.T) {
+	tests := []struct {
+		name   string
+		c1     *SharedConfig
+		c2     *SharedConfig
+		expect *SharedConfig
+	}{
+		{
+			"nil second config",
+			&SharedConfig{},
+			nil,
+			&SharedConfig{},
+		},
+		{
+			"blank configs",
+			&SharedConfig{},
+			&SharedConfig{},
+			&SharedConfig{},
+		},
+		{
+			"combined FoundKeys",
+			&SharedConfig{
+				FoundKeys: []string{
+					"DisableMlock",
+					"ClusterName",
+				},
+			},
+			&SharedConfig{
+				FoundKeys: []string{
+					"PidFile",
+					"DefaultMaxRequestDuration",
+				},
+			},
+			&SharedConfig{
+				FoundKeys: []string{
+					"DisableMlock",
+					"ClusterName",
+					"PidFile",
+					"DefaultMaxRequestDuration",
+				},
+			},
+		},
+		{
+			"Entropy Overwrite",
+			&SharedConfig{
+				Entropy: &Entropy{
+					Mode:     EntropyAugmentation,
+					SealName: "seal-to-be-overwritten",
+				},
+			},
+			&SharedConfig{
+				Entropy: &Entropy{
+					Mode:     EntropyAugmentation,
+					SealName: "new-seal",
+				},
+			},
+			&SharedConfig{
+				Entropy: &Entropy{
+					Mode:     EntropyAugmentation,
+					SealName: "new-seal",
+				},
+			},
+		},
+		{
+			"DisableMlock true overrides false",
+			&SharedConfig{
+				DisableMlock: false,
+			},
+			&SharedConfig{
+				DisableMlock: true,
+			},
+			&SharedConfig{
+				DisableMlock: true,
+			},
+		},
+		{
+			"longer duration overrides shorter",
+			&SharedConfig{
+				DefaultMaxRequestDuration: time.Duration(5 * time.Second),
+			},
+			&SharedConfig{
+				DefaultMaxRequestDuration: time.Duration(10 * time.Second),
+			},
+			&SharedConfig{
+				DefaultMaxRequestDuration: time.Duration(10 * time.Second),
+			},
+		},
+		{
+			"combined listeners",
+			&SharedConfig{
+				Listeners: []*Listener{
+					{
+						Type:    TCP,
+						Address: "127.0.0.1",
+					},
+					{
+						Type:    Unix,
+						Address: "mnt/listener",
+					},
+				},
+			},
+			&SharedConfig{
+				Listeners: []*Listener{
+					{
+						Type:    TCP,
+						Address: "127.0.0.3",
+					},
+					{
+						Type:    Unix,
+						Address: "mnt/listener2",
+					},
+				},
+			},
+			&SharedConfig{
+				Listeners: []*Listener{
+					{
+						Type:    TCP,
+						Address: "127.0.0.1",
+					},
+					{
+						Type:    Unix,
+						Address: "mnt/listener",
+					},
+					{
+						Type:    TCP,
+						Address: "127.0.0.3",
+					},
+					{
+						Type:    Unix,
+						Address: "mnt/listener2",
+					},
+				},
+			},
+		},
+		{
+			"combined user lockouts",
+			&SharedConfig{
+				UserLockouts: []*UserLockout{
+					{
+						Type: "lockout1",
+					},
+				},
+			},
+			&SharedConfig{
+				UserLockouts: []*UserLockout{
+					{
+						Type: "lockout2",
+					},
+				},
+			},
+			&SharedConfig{
+				UserLockouts: []*UserLockout{
+					{
+						Type: "lockout1",
+					},
+					{
+						Type: "lockout2",
+					},
+				},
+			},
+		},
+		{
+			"combined seals",
+			&SharedConfig{
+				Seals: []*KMS{
+					{
+						Purpose: []string{"purpose1"},
+					},
+				},
+			},
+			&SharedConfig{
+				Seals: []*KMS{
+					{
+						Purpose: []string{"purpose2"},
+					},
+				},
+			},
+			&SharedConfig{
+				Seals: []*KMS{
+					{
+						Purpose: []string{"purpose1"},
+					},
+					{
+						Purpose: []string{"purpose2"},
+					},
+				},
+			},
+		},
+		{
+			"telemetry overwrite",
+			&SharedConfig{
+				Telemetry: &Telemetry{
+					StatsiteAddr: "https://example.com",
+				},
+			},
+			&SharedConfig{
+				Telemetry: &Telemetry{},
+			},
+			&SharedConfig{
+				Telemetry: &Telemetry{},
+			},
+		},
+		{
+			"HCPLinkConf overwrite",
+			&SharedConfig{},
+			&SharedConfig{},
+			&SharedConfig{},
+		},
+		{
+			"log fields overwrite",
+			&SharedConfig{
+				LogFile:           "file1.log",
+				LogFormat:         "json",
+				LogLevel:          "warn",
+				LogRotateBytes:    2048,
+				LogRotateDuration: "24h",
+				LogRotateMaxFiles: 32,
+			},
+			&SharedConfig{
+				LogFile:              "file2.log",
+				LogFormat:            "txt",
+				LogLevel:             "error",
+				LogRotateBytes:       1024,
+				LogRotateBytesRaw:    1024,
+				LogRotateDuration:    "12h",
+				LogRotateMaxFiles:    8,
+				LogRotateMaxFilesRaw: 8,
+			},
+			&SharedConfig{
+				LogFile:              "file2.log",
+				LogFormat:            "txt",
+				LogLevel:             "error",
+				LogRotateBytes:       1024,
+				LogRotateBytesRaw:    1024,
+				LogRotateDuration:    "12h",
+				LogRotateMaxFiles:    8,
+				LogRotateMaxFilesRaw: 8,
+			},
+		},
+		{
+			"log fields raw overwrite",
+			&SharedConfig{
+				LogFile:           "file1.log",
+				LogFormat:         "json",
+				LogLevel:          "warn",
+				LogRotateBytes:    2048,
+				LogRotateDuration: "24h",
+				LogRotateMaxFiles: 32,
+			},
+			&SharedConfig{
+				LogRotateBytes:       1024,
+				LogRotateBytesRaw:    1024,
+				LogRotateMaxFiles:    8,
+				LogRotateMaxFilesRaw: 8,
+			},
+			&SharedConfig{
+				LogFile:              "file1.log",
+				LogFormat:            "json",
+				LogLevel:             "warn",
+				LogRotateDuration:    "24h",
+				LogRotateBytes:       1024,
+				LogRotateBytesRaw:    1024,
+				LogRotateMaxFiles:    8,
+				LogRotateMaxFilesRaw: 8,
+			},
+		},
+		{
+			"pidfile overwrite",
+			&SharedConfig{
+				PidFile: "file1.pid",
+			},
+			&SharedConfig{
+				PidFile: "file2.pid",
+			},
+			&SharedConfig{
+				PidFile: "file2.pid",
+			},
+		},
+		{
+			"cluster name overwrite",
+			&SharedConfig{
+				ClusterName: "vault-cluster1",
+			},
+			&SharedConfig{
+				ClusterName: "vault-cluster2",
+			},
+			&SharedConfig{
+				ClusterName: "vault-cluster2",
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			require.True(t, reflect.DeepEqual(tc.expect, tc.c1.Merge(tc.c2)))
+		})
+	}
+}
diff --git a/internalshared/configutil/normalize.go b/internalshared/configutil/normalize.go
new file mode 100644
index 00000000000..3939094e59a
--- /dev/null
+++ b/internalshared/configutil/normalize.go
@@ -0,0 +1,109 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package configutil
+
+import (
+	"net"
+	"net/url"
+	"strings"
+)
+
+// NormalizeAddr takes a string of a Host, Host:Port, URL, or Destination
+// Address and returns a copy where any IP addresses have been normalized to be
+// conformant with RFC 5942 §4. If the input string does not match any of the
+// supported syntaxes, or the "host" section is not an IP address, the input
+// will be returned unchanged. Supported syntaxes are:
+//
+//	Host                 host                                or [host]
+//	Host:Port            host:port                           or [host]:port
+//	URL                  scheme://user@host/path?query#frag  or scheme://user@[host]/path?query#frag
+//	Destination Address  user@host:port                      or user@[host]:port
+//
+// See:
+//
+//	https://rfc-editor.org/rfc/rfc3986.html
+//	https://rfc-editor.org/rfc/rfc5942.html
+//	https://rfc-editor.org/rfc/rfc5952.html
+func NormalizeAddr(addr string) string {
+	if addr == "" {
+		return ""
+	}
+
+	// Host
+	ip := net.ParseIP(addr)
+	if ip != nil {
+		// net.IP.String() is RFC 5942 §4 compliant
+		return ip.String()
+	}
+
+	// [Host]
+	if strings.HasPrefix(addr, "[") && strings.HasSuffix(addr, "]") {
+		if len(addr) < 3 {
+			return addr
+		}
+
+		// If we've been given a bracketed IP address, return the address
+		// normalized without brackets.
+		ip := net.ParseIP(addr[1 : len(addr)-1])
+		if ip != nil {
+			return ip.String()
+		}
+
+		// Our input is not a valid schema.
+		return addr
+	}
+
+	// Host:Port
+	host, port, err := net.SplitHostPort(addr)
+	if err == nil {
+		ip := net.ParseIP(host)
+		if ip == nil {
+			// Our host isn't an IP address so we can return it unchanged
+			return addr
+		}
+
+		// net.JoinHostPort handles bracketing for RFC 5952 §6
+		return net.JoinHostPort(ip.String(), port)
+	}
+
+	// URL
+	u, err := url.Parse(addr)
+	if err == nil {
+		uhost := u.Hostname()
+		ip := net.ParseIP(uhost)
+		if ip == nil {
+			// Our URL doesn't contain an IP address so we can return our input unchanged.
+			return addr
+		} else {
+			uhost = ip.String()
+		}
+
+		if uport := u.Port(); uport != "" {
+			uhost = net.JoinHostPort(uhost, uport)
+		} else {
+			if !strings.HasPrefix(uhost, "[") && !strings.HasSuffix(uhost, "]") {
+				// Ensure the IPv6 URL host is bracketed post-normalization.
+				// When*url.URL.String() reassembles the URL it will not consider
+				// whether or not the  *url.URL.Host is RFC 5952 §6 and RFC 3986 §3.2.2
+				// conformant.
+				uhost = "[" + uhost + "]"
+			}
+		}
+		u.Host = uhost
+
+		return u.String()
+	}
+
+	// Destination Address
+	if idx := strings.LastIndex(addr, "@"); idx > 0 {
+		if idx+1 > len(addr) {
+			return addr
+		}
+
+		return addr[:idx+1] + NormalizeAddr(addr[idx+1:])
+	}
+
+	// Our input did not match our supported schemas. Return it unchanged.
+	return addr
+}
diff --git a/internalshared/configutil/normalize_test.go b/internalshared/configutil/normalize_test.go
new file mode 100644
index 00000000000..4d6dd85b48d
--- /dev/null
+++ b/internalshared/configutil/normalize_test.go
@@ -0,0 +1,213 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package configutil
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestNormalizeAddr ensures that strings that match either an IP address or URL
+// and contain an IPv6 address conform to RFC-5942 §4
+// See: https://rfc-editor.org/rfc/rfc5952.html
+func TestNormalizeAddr(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		addr            string
+		expected        string
+		isErrorExpected bool
+	}{
+		"hostname": {
+			addr:     "vaultproject.io",
+			expected: "vaultproject.io",
+		},
+		"hostname port": {
+			addr:     "vaultproject.io:8200",
+			expected: "vaultproject.io:8200",
+		},
+		"hostname URL": {
+			addr:     "https://vaultproject.io",
+			expected: "https://vaultproject.io",
+		},
+		"hostname port URL": {
+			addr:     "https://vaultproject.io:8200",
+			expected: "https://vaultproject.io:8200",
+		},
+		"hostname destination address": {
+			addr:     "user@vaultproject.io",
+			expected: "user@vaultproject.io",
+		},
+		"hostname destination address URL": {
+			addr:     "http://user@vaultproject.io",
+			expected: "http://user@vaultproject.io",
+		},
+		"hostname destination address URL port": {
+			addr:     "http://user@vaultproject.io:8200",
+			expected: "http://user@vaultproject.io:8200",
+		},
+		"ipv4": {
+			addr:     "10.10.1.10",
+			expected: "10.10.1.10",
+		},
+		"ipv4 invalid bracketed": {
+			addr:     "[10.10.1.10]",
+			expected: "10.10.1.10",
+		},
+		"ipv4 IP:Port addr": {
+			addr:     "10.10.1.10:8500",
+			expected: "10.10.1.10:8500",
+		},
+		"ipv4 invalid IP:Port addr": {
+			addr:     "[10.10.1.10]:8500",
+			expected: "10.10.1.10:8500",
+		},
+		"ipv4 URL": {
+			addr:     "https://10.10.1.10:8200",
+			expected: "https://10.10.1.10:8200",
+		},
+		"ipv4 invalid URL": {
+			addr:     "https://[10.10.1.10]:8200",
+			expected: "https://[10.10.1.10]:8200",
+		},
+		"ipv4 destination address": {
+			addr:     "username@10.10.1.10",
+			expected: "username@10.10.1.10",
+		},
+		"ipv4 invalid destination address": {
+			addr:     "username@10.10.1.10",
+			expected: "username@10.10.1.10",
+		},
+		"ipv4 destination address port": {
+			addr:     "username@10.10.1.10:8200",
+			expected: "username@10.10.1.10:8200",
+		},
+		"ipv4 invalid destination address port": {
+			addr:     "username@[10.10.1.10]:8200",
+			expected: "username@10.10.1.10:8200",
+		},
+		"ipv4 destination address URL": {
+			addr:     "https://username@10.10.1.10",
+			expected: "https://username@10.10.1.10",
+		},
+		"ipv4 destination address URL port": {
+			addr:     "https://username@10.10.1.10:8200",
+			expected: "https://username@10.10.1.10:8200",
+		},
+		"ipv6 invalid address": {
+			addr:     "[2001:0db8::0001]",
+			expected: "2001:db8::1",
+		},
+		"ipv6 IP:Port RFC-5952 4.1 conformance leading zeroes": {
+			addr:     "[2001:0db8::0001]:8500",
+			expected: "[2001:db8::1]:8500",
+		},
+		"ipv6 RFC-5952 4.1 conformance leading zeroes": {
+			addr:     "2001:0db8::0001",
+			expected: "2001:db8::1",
+		},
+		"ipv6 URL RFC-5952 4.1 conformance leading zeroes": {
+			addr:     "https://[2001:0db8::0001]:8200",
+			expected: "https://[2001:db8::1]:8200",
+		},
+		"ipv6 bracketed destination address with port RFC-5952 4.1 conformance leading zeroes": {
+			addr:     "username@[2001:0db8::0001]:8200",
+			expected: "username@[2001:db8::1]:8200",
+		},
+		"ipv6 invalid ambiguous destination address with port": {
+			addr: "username@2001:0db8::0001:8200",
+			// Since the address and port are ambiguous the value appears to be
+			// only an address and as such is normalized as an address only
+			expected: "username@2001:db8::1:8200",
+		},
+		"ipv6 invalid leading zeroes ambiguous destination address with port": {
+			addr: "username@2001:db8:0:1:1:1:1:1:8200",
+			// Since the address and port are ambiguous the value is treated as
+			// a string because it has too many colons to be a valid IPv6 address.
+			expected: "username@2001:db8:0:1:1:1:1:1:8200",
+		},
+		"ipv6 destination address no port RFC-5952 4.1 conformance leading zeroes": {
+			addr:     "username@2001:0db8::0001",
+			expected: "username@2001:db8::1",
+		},
+		"ipv6 RFC-5952 4.2.2 conformance one 16-bit 0 field": {
+			addr:     "2001:db8:0:1:1:1:1:1",
+			expected: "2001:db8:0:1:1:1:1:1",
+		},
+		"ipv6 URL RFC-5952 4.2.2 conformance one 16-bit 0 field": {
+			addr:     "https://[2001:db8:0:1:1:1:1:1]:8200",
+			expected: "https://[2001:db8:0:1:1:1:1:1]:8200",
+		},
+		"ipv6 destination address with port RFC-5952 4.2.2 conformance one 16-bit 0 field": {
+			addr:     "username@[2001:db8:0:1:1:1:1:1]:8200",
+			expected: "username@[2001:db8:0:1:1:1:1:1]:8200",
+		},
+		"ipv6 destination address no port RFC-5952 4.2.2 conformance one 16-bit 0 field": {
+			addr:     "username@2001:db8:0:1:1:1:1:1",
+			expected: "username@2001:db8:0:1:1:1:1:1",
+		},
+		"ipv6 RFC-5952 4.2.3 conformance longest run of 0 bits shortened": {
+			addr:     "2001:0:0:1:0:0:0:1",
+			expected: "2001:0:0:1::1",
+		},
+		"ipv6 URL RFC-5952 4.2.3 conformance longest run of 0 bits shortened": {
+			addr:     "https://[2001:0:0:1:0:0:0:1]:8200",
+			expected: "https://[2001:0:0:1::1]:8200",
+		},
+		"ipv6 destination address with port RFC-5952 4.2.3 conformance longest run of 0 bits shortened": {
+			addr:     "username@[2001:0:0:1:0:0:0:1]:8200",
+			expected: "username@[2001:0:0:1::1]:8200",
+		},
+		"ipv6 destination address no port RFC-5952 4.2.3 conformance longest run of 0 bits shortened": {
+			addr:     "username@2001:0:0:1:0:0:0:1",
+			expected: "username@2001:0:0:1::1",
+		},
+		"ipv6 RFC-5952 4.2.3 conformance equal runs of 0 bits shortened": {
+			addr:     "2001:db8:0:0:1:0:0:1",
+			expected: "2001:db8::1:0:0:1",
+		},
+		"ipv6 URL no port RFC-5952 4.2.3 conformance equal runs of 0 bits shortened": {
+			addr:     "https://[2001:db8:0:0:1:0:0:1]",
+			expected: "https://[2001:db8::1:0:0:1]",
+		},
+		"ipv6 URL with port RFC-5952 4.2.3 conformance equal runs of 0 bits shortened": {
+			addr:     "https://[2001:db8:0:0:1:0:0:1]:8200",
+			expected: "https://[2001:db8::1:0:0:1]:8200",
+		},
+
+		"ipv6 destination address with port RFC-5952 4.2.3 conformance equal runs of 0 bits shortened": {
+			addr:     "username@[2001:db8:0:0:1:0:0:1]:8200",
+			expected: "username@[2001:db8::1:0:0:1]:8200",
+		},
+		"ipv6 destination address no port RFC-5952 4.2.3 conformance equal runs of 0 bits shortened": {
+			addr:     "username@2001:db8:0:0:1:0:0:1",
+			expected: "username@2001:db8::1:0:0:1",
+		},
+		"ipv6 RFC-5952 4.3 conformance downcase hex letters": {
+			addr:     "2001:DB8:AC3:FE4::1",
+			expected: "2001:db8:ac3:fe4::1",
+		},
+		"ipv6 URL RFC-5952 4.3 conformance downcase hex letters": {
+			addr:     "https://[2001:DB8:AC3:FE4::1]:8200",
+			expected: "https://[2001:db8:ac3:fe4::1]:8200",
+		},
+		"ipv6 destination address with port RFC-5952 4.3 conformance downcase hex letters": {
+			addr:     "username@[2001:DB8:AC3:FE4::1]:8200",
+			expected: "username@[2001:db8:ac3:fe4::1]:8200",
+		},
+		"ipv6 destination address no port RFC-5952 4.3 conformance downcase hex letters": {
+			addr:     "username@2001:DB8:AC3:FE4::1",
+			expected: "username@2001:db8:ac3:fe4::1",
+		},
+	}
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, tc.expected, NormalizeAddr(tc.addr))
+		})
+	}
+}
diff --git a/internalshared/configutil/request_limiter.go b/internalshared/configutil/request_limiter.go
deleted file mode 100644
index 1bc97bfada5..00000000000
--- a/internalshared/configutil/request_limiter.go
+++ /dev/null
@@ -1,58 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package configutil
-
-import (
-	"fmt"
-
-	"github.com/hashicorp/go-multierror"
-	"github.com/hashicorp/go-secure-stdlib/parseutil"
-	"github.com/hashicorp/hcl"
-	"github.com/hashicorp/hcl/hcl/ast"
-)
-
-type RequestLimiter struct {
-	UnusedKeys UnusedKeyMap `hcl:",unusedKeyPositions"`
-
-	Disable    bool        `hcl:"-"`
-	DisableRaw interface{} `hcl:"disable"`
-}
-
-func (r *RequestLimiter) Validate(source string) []ConfigError {
-	return ValidateUnusedFields(r.UnusedKeys, source)
-}
-
-func (r *RequestLimiter) GoString() string {
-	return fmt.Sprintf("*%#v", *r)
-}
-
-var DefaultRequestLimiter = &RequestLimiter{
-	Disable: true,
-}
-
-func parseRequestLimiter(result *SharedConfig, list *ast.ObjectList) error {
-	if len(list.Items) > 1 {
-		return fmt.Errorf("only one 'request_limiter' block is permitted")
-	}
-
-	result.RequestLimiter = DefaultRequestLimiter
-
-	// Get our one item
-	item := list.Items[0]
-
-	if err := hcl.DecodeObject(&result.RequestLimiter, item.Val); err != nil {
-		return multierror.Prefix(err, "request_limiter:")
-	}
-
-	result.RequestLimiter.Disable = true
-	if result.RequestLimiter.DisableRaw != nil {
-		var err error
-		if result.RequestLimiter.Disable, err = parseutil.ParseBool(result.RequestLimiter.DisableRaw); err != nil {
-			return err
-		}
-		result.RequestLimiter.DisableRaw = nil
-	}
-
-	return nil
-}
diff --git a/internalshared/configutil/telemetry.go b/internalshared/configutil/telemetry.go
index d00b922b75a..8861bc3a3b9 100644
--- a/internalshared/configutil/telemetry.go
+++ b/internalshared/configutil/telemetry.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
@@ -22,6 +22,7 @@ import (
 	"github.com/hashicorp/hcl"
 	"github.com/hashicorp/hcl/hcl/ast"
 	"github.com/hashicorp/vault/helper/metricsutil"
+	"github.com/hashicorp/vault/sdk/helper/metricregistry"
 	"google.golang.org/api/option"
 )
 
@@ -33,7 +34,7 @@ const (
 	NumLeaseMetricsTimeBucketsDefault = 168
 )
 
-// Telemetry is the telemetry configuration for the server
+// Telemetry is the telemetry configuration for the server.
 type Telemetry struct {
 	FoundKeys    []string     `hcl:",decodedFields"`
 	UnusedKeys   UnusedKeyMap `hcl:",unusedKeyPositions"`
@@ -191,6 +192,11 @@ func parseTelemetry(result *SharedConfig, list *ast.ObjectList) error {
 		return multierror.Prefix(err, "telemetry:")
 	}
 
+	// Make sure addresses conform to RFC-5942 §4. If you've added new fields that
+	// are an address or URL be sure to update normalizeTelemetryAddresses().
+	// See: https://rfc-editor.org/rfc/rfc5952.html
+	normalizeTelemetryAddresses(result.Telemetry)
+
 	if result.Telemetry.PrometheusRetentionTimeRaw != nil {
 		var err error
 		if result.Telemetry.PrometheusRetentionTime, err = parseutil.ParseDurationSecond(result.Telemetry.PrometheusRetentionTimeRaw); err != nil {
@@ -240,6 +246,33 @@ func parseTelemetry(result *SharedConfig, list *ast.ObjectList) error {
 	return nil
 }
 
+// normalizeTelemetryAddresses ensures that any telemetry configuration that can
+// be a URL, IP Address, or host:port address is conformant with RFC-5942 §4
+// See: https://rfc-editor.org/rfc/rfc5952.html
+func normalizeTelemetryAddresses(in *Telemetry) {
+	if in == nil {
+		return
+	}
+
+	// Make sure addresses conform to RFC-5952
+	for _, addr := range []*string{
+		&in.CirconusAPIURL,
+		&in.CirconusCheckSubmissionURL,
+		&in.DogStatsDAddr,
+		&in.StatsdAddr,
+		&in.StatsiteAddr,
+	} {
+		if addr == nil {
+			continue
+		}
+
+		if url := *addr; url != "" {
+			n := NormalizeAddr(url)
+			*addr = n
+		}
+	}
+}
+
 type SetupTelemetryOpts struct {
 	Config      *Telemetry
 	Ui          cli.Ui
@@ -289,6 +322,10 @@ func SetupTelemetry(opts *SetupTelemetryOpts) (*metrics.InmemSink, *metricsutil.
 			Expiration: opts.Config.PrometheusRetentionTime,
 		}
 
+		// Merge in explicit metric definitions so Prometheus always reports those
+		// metrics.
+		metricregistry.MergeDefinitions(&prometheusOpts)
+
 		sink, err := prometheus.NewPrometheusSinkFrom(prometheusOpts)
 		if err != nil {
 			return nil, nil, false, err
diff --git a/internalshared/configutil/telemetry_test.go b/internalshared/configutil/telemetry_test.go
index 285278eeaeb..f0807e5ce19 100644
--- a/internalshared/configutil/telemetry_test.go
+++ b/internalshared/configutil/telemetry_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestParsePrefixFilters(t *testing.T) {
@@ -54,3 +55,47 @@ func TestParsePrefixFilters(t *testing.T) {
 		}
 	})
 }
+
+// TestNormalizeTelemetryAddresses ensures that any telemetry configuration that
+// can be a URL, IP Address, or host:port address is conformant with RFC-5942 §4
+// See: https://rfc-editor.org/rfc/rfc5952.html
+func TestNormalizeTelemetryAddresses(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]struct {
+		given    *Telemetry
+		expected *Telemetry
+	}{
+		"ipv6-conformance": {
+			given: &Telemetry{
+				// RFC-5952 4.1 leading zeroes
+				CirconusAPIURL: "https://[2001:0db8::0001]:443",
+				// RFC-5952 4.2.3 longest run of 0 bits shortened
+				CirconusCheckSubmissionURL: "https://[2001:0:0:1:0:0:0:1]:443",
+				// RFC-5952 4.2.3 equal runs of 0 bits shortened
+				DogStatsDAddr: "https://[2001:db8:0:0:1:0:0:1]:443",
+				// 	RFC-5952 4.3 downcase hex letters
+				StatsdAddr:   "https://[2001:DB8:AC3:FE4::1]:443",
+				StatsiteAddr: "https://[2001:DB8:AC3:FE4::1]:443",
+			},
+			expected: &Telemetry{
+				CirconusAPIURL:             "https://[2001:db8::1]:443",
+				CirconusCheckSubmissionURL: "https://[2001:0:0:1::1]:443",
+				DogStatsDAddr:              "https://[2001:db8::1:0:0:1]:443",
+				StatsdAddr:                 "https://[2001:db8:ac3:fe4::1]:443",
+				StatsiteAddr:               "https://[2001:db8:ac3:fe4::1]:443",
+			},
+		},
+	}
+
+	for name, tc := range tests {
+		name := name
+		tc := tc
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			normalizeTelemetryAddresses(tc.given)
+			require.EqualValues(t, tc.expected, tc.given)
+		})
+	}
+}
diff --git a/internalshared/configutil/userlockout.go b/internalshared/configutil/userlockout.go
index 5e7d4e209b9..0efdfe7b104 100644
--- a/internalshared/configutil/userlockout.go
+++ b/internalshared/configutil/userlockout.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
@@ -117,7 +117,7 @@ func ParseUserLockouts(result *SharedConfig, list *ast.ObjectList) error {
 	// we set values for these fields with defaults
 	// The issue with not being able to use non-raw entries is because of fields lockout threshold
 	// and disable lockout. We cannot differentiate using non-raw entries if the user configured these fields
-	// with values (0 and false) or if the the user did not configure these values in config file at all.
+	// with values (0 and false) or if the user did not configure these values in config file at all.
 	// The raw fields are set to nil after setting missing values in setNilValuesForRawUserLockoutFields function
 	userLockoutsMap = setMissingUserLockoutValuesInMap(userLockoutsMap)
 	for _, userLockoutValues := range userLockoutsMap {
@@ -147,7 +147,7 @@ func setUserLockoutValueAllInMap(userLockoutAll *UserLockout) *UserLockout {
 	return setNilValuesForRawUserLockoutFields(userLockoutAll)
 }
 
-// setDefaultUserLockoutValuesInMap sets missing user lockout fields for auth methods
+// setMissingUserLockoutValuesInMap sets missing user lockout fields for auth methods
 // with default values (from key "all") that are not configured using config file
 func setMissingUserLockoutValuesInMap(userLockoutsMap map[string]*UserLockout) map[string]*UserLockout {
 	// set values for "all" key with default values for "all" user lockout fields that are not configured
diff --git a/internalshared/configutil/userlockout_test.go b/internalshared/configutil/userlockout_test.go
index 0bc5f0dce10..394d8834d9d 100644
--- a/internalshared/configutil/userlockout_test.go
+++ b/internalshared/configutil/userlockout_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package configutil
diff --git a/internalshared/listenerutil/bufconn.go b/internalshared/listenerutil/bufconn.go
index d471ee118fc..5c6c1fcfe8b 100644
--- a/internalshared/listenerutil/bufconn.go
+++ b/internalshared/listenerutil/bufconn.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package listenerutil
diff --git a/internalshared/listenerutil/listener.go b/internalshared/listenerutil/listener.go
index 1f8afe71765..d24b4325f1c 100644
--- a/internalshared/listenerutil/listener.go
+++ b/internalshared/listenerutil/listener.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package listenerutil
diff --git a/internalshared/listenerutil/listener_test.go b/internalshared/listenerutil/listener_test.go
index c315fd24326..984d8682c42 100644
--- a/internalshared/listenerutil/listener_test.go
+++ b/internalshared/listenerutil/listener_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package listenerutil
diff --git a/limits/http_limiter.go b/limits/http_limiter.go
new file mode 100644
index 00000000000..474e01afa02
--- /dev/null
+++ b/limits/http_limiter.go
@@ -0,0 +1,56 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package limits
+
+import (
+	"context"
+	"errors"
+	"net/http"
+)
+
+//lint:ignore ST1005 Vault is the product name
+var ErrCapacity = errors.New("Vault server temporarily overloaded")
+
+const (
+	WriteLimiter       = "write"
+	SpecialPathLimiter = "special-path"
+)
+
+// HTTPLimiter is a convenience struct that we use to wrap some logical request
+// context and prevent dependence on Core.
+type HTTPLimiter struct {
+	Method      string
+	PathLimited bool
+	LookupFunc  func(key string) *RequestLimiter
+}
+
+// CtxKeyDisableRequestLimiter holds the HTTP Listener's disable config if set.
+type CtxKeyDisableRequestLimiter struct{}
+
+func (c CtxKeyDisableRequestLimiter) String() string {
+	return "disable_request_limiter"
+}
+
+// Acquire checks the HTTPLimiter metadata to determine if an HTTP request
+// should be limited, or simply passed through as a no-op.
+func (h *HTTPLimiter) Acquire(ctx context.Context) (*RequestListener, bool) {
+	// If the limiter is disabled, return an empty wrapper so the limiter is a
+	// no-op and indicate that the request can proceed.
+	if disable := ctx.Value(CtxKeyDisableRequestLimiter{}); disable != nil && disable.(bool) {
+		return &RequestListener{}, true
+	}
+
+	lim := &RequestLimiter{}
+	if h.PathLimited {
+		lim = h.LookupFunc(SpecialPathLimiter)
+	} else {
+		switch h.Method {
+		case http.MethodGet, http.MethodHead, http.MethodTrace, http.MethodOptions:
+			// We're only interested in the inverse, so do nothing here.
+		default:
+			lim = h.LookupFunc(WriteLimiter)
+		}
+	}
+	return lim.Acquire(ctx)
+}
diff --git a/limits/limiter.go b/limits/limiter.go
index 15a811ddd96..b339eb9d3ca 100644
--- a/limits/limiter.go
+++ b/limits/limiter.go
@@ -1,189 +1,20 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
 package limits
 
 import (
 	"context"
-	"errors"
-	"fmt"
-	"math"
-	"sync/atomic"
-
-	"github.com/armon/go-metrics"
-	"github.com/hashicorp/go-hclog"
-	"github.com/platinummonkey/go-concurrency-limits/core"
-	"github.com/platinummonkey/go-concurrency-limits/limit"
-	"github.com/platinummonkey/go-concurrency-limits/limiter"
-	"github.com/platinummonkey/go-concurrency-limits/strategy"
-)
-
-var (
-	// ErrCapacity is a new error type to indicate that Vault is not accepting new
-	// requests. This should be handled by callers in request paths to return
-	// http.StatusServiceUnavailable to the client.
-	ErrCapacity = errors.New("Vault server temporarily overloaded")
-
-	// DefaultDebugLogger opts out of the go-concurrency-limits internal Debug
-	// logger, since it's rather noisy. We're generating logs of interest in
-	// Vault.
-	DefaultDebugLogger limit.Logger = nil
-
-	// DefaultMetricsRegistry opts out of the go-concurrency-limits internal
-	// metrics because we're tracking what we care about in Vault.
-	DefaultMetricsRegistry core.MetricRegistry = core.EmptyMetricRegistryInstance
 )
 
-const (
-	// Smoothing adjusts how heavily we weight newer high-latency detection.
-	// Higher values (>1) place more emphasis on recent measurements. We set
-	// this below 1 to better tolerate short-lived spikes in request rate.
-	DefaultSmoothing = .1
-
-	// DefaultLongWindow is chosen as a minimum of 1000 samples. longWindow
-	// defines sliding window size used for the Exponential Moving Average.
-	DefaultLongWindow = 1000
-)
-
-// RequestLimiter is a thin wrapper for limiter.DefaultLimiter.
-type RequestLimiter struct {
-	*limiter.DefaultLimiter
-	Flags LimiterFlags
-}
-
-// Acquire consults the underlying RequestLimiter to see if a new
-// RequestListener can be acquired.
-//
-// The return values are a *RequestListener, which the caller can use to perform
-// latency measurements, and a bool to indicate whether or not a RequestListener
-// was acquired.
-//
-// The returned RequestListener is short-lived and eventually garbage-collected;
-// however, the RequestLimiter keeps track of in-flight concurrency using a
-// token bucket implementation. The caller must release the resulting Limiter
-// token by conducting a measurement.
-//
-// There are three return cases:
-//
-// 1) If Request Limiting is disabled, we return an empty RequestListener so all
-// measurements are no-ops.
-//
-// 2) If the request limit has been exceeded, we will not acquire a
-// RequestListener and instead return nil, false. No measurement is required,
-// since we immediately return from callers with ErrCapacity.
-//
-// 3) If we have not exceeded the request limit, the caller must call one of
-// OnSuccess(), OnDropped(), or OnIgnore() to return a measurement and release
-// the underlying Limiter token.
-func (l *RequestLimiter) Acquire(ctx context.Context) (*RequestListener, bool) {
-	// Transparently handle the case where the limiter is disabled.
-	if l == nil || l.DefaultLimiter == nil {
-		return &RequestListener{}, true
-	}
-
-	lsnr, ok := l.DefaultLimiter.Acquire(ctx)
-	if !ok {
-		metrics.IncrCounter(([]string{"limits", "concurrency", "service_unavailable"}), 1)
-		// If the token acquisition fails, we've reached capacity and we won't
-		// get a listener, so just return nil.
-		return nil, false
-	}
+type RequestLimiter struct{}
 
-	return &RequestListener{
-		DefaultListener: lsnr.(*limiter.DefaultListener),
-		released:        new(atomic.Bool),
-	}, true
+// Acquire is a no-op on CE
+func (l *RequestLimiter) Acquire(_ctx context.Context) (*RequestListener, bool) {
+	return &RequestListener{}, true
 }
 
-// concurrencyChanger adjusts the current allowed concurrency with an
-// exponential backoff as we approach the max limit.
-func concurrencyChanger(limit int) int {
-	change := math.Sqrt(float64(limit))
-	if change < 1.0 {
-		change = 1.0
-	}
-	return int(change)
-}
-
-var DefaultLimiterFlags = map[string]LimiterFlags{
-	// WriteLimiter default flags have a less conservative MinLimit to prevent
-	// over-optimizing the request latency, which would result in
-	// under-utilization and client starvation.
-	WriteLimiter: {
-		MinLimit:     100,
-		MaxLimit:     5000,
-		InitialLimit: 100,
-	},
-
-	// SpecialPathLimiter default flags have a conservative MinLimit to allow
-	// more aggressive concurrency throttling for CPU-bound workloads such as
-	// `pki/issue`.
-	SpecialPathLimiter: {
-		MinLimit:     5,
-		MaxLimit:     5000,
-		InitialLimit: 5,
-	},
-}
-
-// LimiterFlags establish some initial configuration for a new request limiter.
-type LimiterFlags struct {
-	// MinLimit defines the minimum concurrency floor to prevent over-throttling
-	// requests during periods of high traffic.
-	MinLimit int `json:"min_limit,omitempty" mapstructure:"min_limit,omitempty"`
-
-	// MaxLimit defines the maximum concurrency ceiling to prevent skewing to a
-	// point of no return.
-	//
-	// We set this to a high value (5000) with the expectation that systems with
-	// high-performing specs will tolerate higher limits, while the algorithm
-	// will find its own steady-state concurrency well below this threshold in
-	// most cases.
-	MaxLimit int `json:"max_limit,omitempty" mapstructure:"max_limit,omitempty"`
-
-	// InitialLimit defines the starting concurrency limit prior to any
-	// measurements.
-	//
-	// If we start this value off too high, Vault could become
-	// overloaded before the algorithm has a chance to adapt. Setting the value
-	// to the minimum is a safety measure which could result in early request
-	// rejection; however, the adaptive nature of the algorithm will prevent
-	// this from being a prolonged state as the allowed concurrency will
-	// increase during normal operation.
-	InitialLimit int `json:"initial_limit,omitempty" mapstructure:"initial_limit,omitempty"`
-}
-
-// NewRequestLimiter is a basic constructor for the RequestLimiter wrapper. It
-// is responsible for setting up the Gradient2 Limit and instantiating a new
-// wrapped DefaultLimiter.
-func NewRequestLimiter(logger hclog.Logger, name string, flags LimiterFlags) (*RequestLimiter, error) {
-	logger.Info("setting up new request limiter",
-		"initialLimit", flags.InitialLimit,
-		"maxLimit", flags.MaxLimit,
-		"minLimit", flags.MinLimit,
-	)
-
-	// NewGradient2Limit is the algorithm which drives request limiting
-	// decisions. It gathers latency measurements and calculates an Exponential
-	// Moving Average to determine whether latency deviation warrants a change
-	// in the current concurrency limit.
-	lim, err := limit.NewGradient2Limit(name,
-		flags.InitialLimit,
-		flags.MaxLimit,
-		flags.MinLimit,
-		concurrencyChanger,
-		DefaultSmoothing,
-		DefaultLongWindow,
-		DefaultDebugLogger,
-		DefaultMetricsRegistry,
-	)
-	if err != nil {
-		return &RequestLimiter{}, fmt.Errorf("failed to create gradient2 limit: %w", err)
-	}
-
-	strategy := strategy.NewSimpleStrategy(flags.InitialLimit)
-	defLimiter, err := limiter.NewDefaultLimiter(lim, 1e9, 1e9, 10, 100, strategy, nil, DefaultMetricsRegistry)
-	if err != nil {
-		return &RequestLimiter{}, err
-	}
-
-	return &RequestLimiter{Flags: flags, DefaultLimiter: defLimiter}, nil
-}
+// EstimatedLimit is effectively 0, since we're not limiting requests on CE.
+func (l *RequestLimiter) EstimatedLimit() int { return 0 }
diff --git a/limits/listener.go b/limits/listener.go
index 1d27b7d897c..cd72d583d76 100644
--- a/limits/listener.go
+++ b/limits/listener.go
@@ -1,51 +1,14 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
-package limits
 
-import (
-	"sync/atomic"
+//go:build !enterprise
 
-	"github.com/armon/go-metrics"
-	"github.com/platinummonkey/go-concurrency-limits/limiter"
-)
+package limits
 
-// RequestListener is a thin wrapper for limiter.DefaultLimiter to handle the
-// case where request limiting is turned off.
-type RequestListener struct {
-	*limiter.DefaultListener
-	released *atomic.Bool
-}
+type RequestListener struct{}
 
-// OnSuccess is called as a notification that the operation succeeded and
-// internally measured latency should be used as an RTT sample.
-func (l *RequestListener) OnSuccess() {
-	if l.DefaultListener != nil {
-		metrics.IncrCounter(([]string{"limits", "concurrency", "success"}), 1)
-		l.DefaultListener.OnSuccess()
-		l.released.Store(true)
-	}
-}
+func (l *RequestListener) OnSuccess() {}
 
-// OnDropped is called to indicate the request failed and was dropped due to an
-// internal server error. Note that this does not include ErrCapacity.
-func (l *RequestListener) OnDropped() {
-	if l.DefaultListener != nil {
-		metrics.IncrCounter(([]string{"limits", "concurrency", "dropped"}), 1)
-		l.DefaultListener.OnDropped()
-		l.released.Store(true)
-	}
-}
+func (l *RequestListener) OnDropped() {}
 
-// OnIgnore is called to indicate the operation failed before any meaningful RTT
-// measurement could be made and should be ignored to not introduce an
-// artificially low RTT. It also provides an extra layer of protection against
-// leaks of the underlying StrategyToken during recoverable panics in the
-// request handler. We treat these as Ignored, discard the measurement, and mark
-// the listener as released.
-func (l *RequestListener) OnIgnore() {
-	if l.DefaultListener != nil && l.released.Load() != true {
-		metrics.IncrCounter(([]string{"limits", "concurrency", "ignored"}), 1)
-		l.DefaultListener.OnIgnore()
-		l.released.Store(true)
-	}
-}
+func (l *RequestListener) OnIgnore() {}
diff --git a/limits/registry.go b/limits/registry.go
index 8d1cb8bca7f..2ee16ceea6b 100644
--- a/limits/registry.go
+++ b/limits/registry.go
@@ -1,222 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
-package limits
-
-import (
-	"os"
-	"strconv"
-	"sync"
-
-	"github.com/hashicorp/go-hclog"
-)
-
-const (
-	WriteLimiter         = "write"
-	SpecialPathLimiter   = "special-path"
-	LimitsBadEnvVariable = "failed to process limiter environment variable, using default"
-)
-
-// NOTE: Great care should be taken when setting any of these variables to avoid
-// adverse affects in optimal request servicing. It is strongly advised that
-// these variables not be used unless there is a very good reason. These are
-// intentionally undocumented environment variables that may be removed in
-// future versions of Vault.
-const (
-	// EnvVaultDisableWriteLimiter is used to turn off the
-	// RequestLimiter for write-based HTTP methods.
-	EnvVaultDisableWriteLimiter = "VAULT_DISABLE_WRITE_LIMITER"
-
-	// EnvVaultWriteLimiterMin is used to modify the minimum
-	// concurrency limit for write-based HTTP methods.
-	EnvVaultWriteLimiterMin = "VAULT_WRITE_LIMITER_MIN"
-
-	// EnvVaultWriteLimiterMax is used to modify the maximum
-	// concurrency limit for write-based HTTP methods.
-	EnvVaultWriteLimiterMax = "VAULT_WRITE_LIMITER_MAX"
-
-	// EnvVaultDisablePathBasedRequestLimiting is used to turn off the
-	// RequestLimiter for special-cased paths, specified in
-	// Backend.PathsSpecial.
-	EnvVaultDisableSpecialPathLimiter = "VAULT_DISABLE_SPECIAL_PATH_LIMITER"
 
-	// EnvVaultSpecialPathLimiterMin is used to modify the minimum
-	// concurrency limit for write-based HTTP methods.
-	EnvVaultSpecialPathLimiterMin = "VAULT_SPECIAL_PATH_LIMITER_MIN"
+//go:build !enterprise
 
-	// EnvVaultSpecialPathLimiterMax is used to modify the maximum
-	// concurrency limit for write-based HTTP methods.
-	EnvVaultSpecialPathLimiterMax = "VAULT_SPECIAL_PATH_LIMITER_MAX"
-)
+package limits
 
 // LimiterRegistry holds the map of RequestLimiters mapped to keys.
-type LimiterRegistry struct {
-	Limiters map[string]*RequestLimiter
-	Logger   hclog.Logger
-	Enabled  bool
-	sync.RWMutex
-}
-
-// NewLimiterRegistry is a basic LimiterRegistry constructor.
-func NewLimiterRegistry(logger hclog.Logger) *LimiterRegistry {
-	return &LimiterRegistry{
-		Limiters: make(map[string]*RequestLimiter),
-		Logger:   logger,
-	}
-}
-
-// processEnvVars consults Limiter-specific environment variables and tells the
-// caller if the Limiter should be disabled. If not, it adjusts the passed-in
-// limiterFlags as appropriate.
-func (r *LimiterRegistry) processEnvVars(name string, flags *LimiterFlags, envDisabled, envMin, envMax string) bool {
-	envFlagsLogger := r.Logger.With("name", name)
-	if disabledRaw := os.Getenv(envDisabled); disabledRaw != "" {
-		disabled, err := strconv.ParseBool(disabledRaw)
-		if err != nil {
-			envFlagsLogger.Warn(LimitsBadEnvVariable,
-				"env", envDisabled,
-				"val", disabledRaw,
-				"default", false,
-				"error", err,
-			)
-		}
-
-		if disabled {
-			envFlagsLogger.Warn("limiter disabled by environment variable", "env", envDisabled, "val", disabledRaw)
-			return true
-		}
-	}
-
-	envFlags := &LimiterFlags{}
-	if minRaw := os.Getenv(envMin); minRaw != "" {
-		min, err := strconv.Atoi(minRaw)
-		if err != nil {
-			envFlagsLogger.Warn(LimitsBadEnvVariable,
-				"env", envMin,
-				"val", minRaw,
-				"default", flags.MinLimit,
-				"error", err,
-			)
-		} else {
-			envFlags.MinLimit = min
-		}
-	}
-
-	if maxRaw := os.Getenv(envMax); maxRaw != "" {
-		max, err := strconv.Atoi(maxRaw)
-		if err != nil {
-			envFlagsLogger.Warn(LimitsBadEnvVariable,
-				"env", envMax,
-				"val", maxRaw,
-				"default", flags.MaxLimit,
-				"error", err,
-			)
-		} else {
-			envFlags.MaxLimit = max
-		}
-	}
-
-	switch {
-	case envFlags.MinLimit == 0:
-		// Assume no environment variable was provided.
-	case envFlags.MinLimit > 0:
-		flags.MinLimit = envFlags.MinLimit
-	default:
-		r.Logger.Warn("min limit must be greater than zero, falling back to defaults", "minLimit", flags.MinLimit)
-	}
-
-	switch {
-	case envFlags.MaxLimit == 0:
-		// Assume no environment variable was provided.
-	case envFlags.MaxLimit > flags.MinLimit:
-		flags.MaxLimit = envFlags.MaxLimit
-	default:
-		r.Logger.Warn("max limit must be greater than min, falling back to defaults", "maxLimit", flags.MaxLimit)
-	}
-
-	return false
-}
-
-// Enable sets up a new LimiterRegistry and marks it Enabled.
-func (r *LimiterRegistry) Enable() {
-	r.Lock()
-	defer r.Unlock()
-
-	if r.Enabled {
-		return
-	}
-
-	r.Logger.Info("enabling request limiters")
-	r.Limiters = map[string]*RequestLimiter{}
-
-	for name, flags := range DefaultLimiterFlags {
-		r.Register(name, flags)
-	}
-
-	r.Enabled = true
-}
-
-// Register creates a new request limiter and assigns it a slot in the
-// LimiterRegistry. Locking should be done in the caller.
-func (r *LimiterRegistry) Register(name string, flags LimiterFlags) {
-	var disabled bool
-
-	switch name {
-	case WriteLimiter:
-		disabled = r.processEnvVars(name, &flags,
-			EnvVaultDisableWriteLimiter,
-			EnvVaultWriteLimiterMin,
-			EnvVaultWriteLimiterMax,
-		)
-		if disabled {
-			return
-		}
-	case SpecialPathLimiter:
-		disabled = r.processEnvVars(name, &flags,
-			EnvVaultDisableSpecialPathLimiter,
-			EnvVaultSpecialPathLimiterMin,
-			EnvVaultSpecialPathLimiterMax,
-		)
-		if disabled {
-			return
-		}
-	default:
-		r.Logger.Warn("skipping invalid limiter type", "key", name)
-		return
-	}
-
-	// Always set the initial limit to min so the system can find its own
-	// equilibrium, since max might be too high.
-	flags.InitialLimit = flags.MinLimit
-
-	limiter, err := NewRequestLimiter(r.Logger.Named(name), name, flags)
-	if err != nil {
-		r.Logger.Error("failed to register limiter", "name", name, "error", err)
-		return
-	}
-
-	r.Limiters[name] = limiter
-}
-
-// Disable drops its references to underlying limiters.
-func (r *LimiterRegistry) Disable() {
-	r.Lock()
-	defer r.Unlock()
-
-	if !r.Enabled {
-		return
-	}
-
-	r.Logger.Info("disabling request limiters")
-	// Any outstanding tokens will be flushed when their request completes, as
-	// they've already acquired a listener. Just drop the limiter references
-	// here and the garbage-collector should take care of the rest.
-	r.Limiters = map[string]*RequestLimiter{}
-	r.Enabled = false
-}
-
-// GetLimiter looks up a RequestLimiter by key in the LimiterRegistry.
-func (r *LimiterRegistry) GetLimiter(key string) *RequestLimiter {
-	r.RLock()
-	defer r.RUnlock()
-	return r.Limiters[key]
-}
+type LimiterRegistry struct{}
diff --git a/main.go b/main.go
index 35d2f584ee9..7ceceeeeb06 100644
--- a/main.go
+++ b/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main // import "github.com/hashicorp/vault"
diff --git a/main_test.go b/main_test.go
index 78b0e69a6cb..3a686f987cd 100644
--- a/main_test.go
+++ b/main_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main // import "github.com/hashicorp/vault"
diff --git a/physical/aerospike/aerospike.go b/physical/aerospike/aerospike.go
index 4e8aeb782af..752fbefe893 100644
--- a/physical/aerospike/aerospike.go
+++ b/physical/aerospike/aerospike.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aerospike
diff --git a/physical/aerospike/aerospike_test.go b/physical/aerospike/aerospike_test.go
index e519b2da50c..f86491dddc6 100644
--- a/physical/aerospike/aerospike_test.go
+++ b/physical/aerospike/aerospike_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package aerospike
diff --git a/physical/alicloudoss/alicloudoss.go b/physical/alicloudoss/alicloudoss.go
index d82287e2026..32bf3d30a2b 100644
--- a/physical/alicloudoss/alicloudoss.go
+++ b/physical/alicloudoss/alicloudoss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package alicloudoss
@@ -18,6 +18,7 @@ import (
 	"github.com/aliyun/aliyun-oss-go-sdk/oss"
 	"github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/vault/sdk/physical"
 )
 
@@ -39,7 +40,7 @@ type AliCloudOSSBackend struct {
 	bucket     string
 	client     *oss.Client
 	logger     log.Logger
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 }
 
 // NewAliCloudOSSBackend constructs an OSS backend using a pre-existing
@@ -113,7 +114,7 @@ func NewAliCloudOSSBackend(conf map[string]string, logger log.Logger) (physical.
 		client:     client,
 		bucket:     bucket,
 		logger:     logger,
-		permitPool: physical.NewPermitPool(maxParInt),
+		permitPool: permitpool.New(maxParInt),
 	}
 	return a, nil
 }
@@ -122,7 +123,9 @@ func NewAliCloudOSSBackend(conf map[string]string, logger log.Logger) (physical.
 func (a *AliCloudOSSBackend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince([]string{AlibabaMetricKey, "put"}, time.Now())
 
-	a.permitPool.Acquire()
+	if err := a.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer a.permitPool.Release()
 
 	bucket, err := a.client.Bucket(a.bucket)
@@ -137,7 +140,9 @@ func (a *AliCloudOSSBackend) Put(ctx context.Context, entry *physical.Entry) err
 func (a *AliCloudOSSBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{AlibabaMetricKey, "get"}, time.Now())
 
-	a.permitPool.Acquire()
+	if err := a.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer a.permitPool.Release()
 
 	bucket, err := a.client.Bucket(a.bucket)
@@ -174,7 +179,9 @@ func (a *AliCloudOSSBackend) Get(ctx context.Context, key string) (*physical.Ent
 func (a *AliCloudOSSBackend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince([]string{AlibabaMetricKey, "delete"}, time.Now())
 
-	a.permitPool.Acquire()
+	if err := a.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer a.permitPool.Release()
 
 	bucket, err := a.client.Bucket(a.bucket)
@@ -190,7 +197,9 @@ func (a *AliCloudOSSBackend) Delete(ctx context.Context, key string) error {
 func (a *AliCloudOSSBackend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{AlibabaMetricKey, "list"}, time.Now())
 
-	a.permitPool.Acquire()
+	if err := a.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer a.permitPool.Release()
 
 	keys := []string{}
diff --git a/physical/alicloudoss/alicloudoss_test.go b/physical/alicloudoss/alicloudoss_test.go
index b7a94db3a81..b1de0bd1a01 100644
--- a/physical/alicloudoss/alicloudoss_test.go
+++ b/physical/alicloudoss/alicloudoss_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package alicloudoss
diff --git a/physical/azure/azure.go b/physical/azure/azure.go
index 251d2301c0f..f125d87c67a 100644
--- a/physical/azure/azure.go
+++ b/physical/azure/azure.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package azure
@@ -7,9 +7,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/url"
 	"os"
+	"regexp"
 	"sort"
 	"strconv"
 	"strings"
@@ -20,6 +21,7 @@ import (
 	"github.com/Azure/go-autorest/autorest/azure"
 	"github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/sdk/physical"
 )
@@ -36,7 +38,7 @@ const (
 type AzureBackend struct {
 	container  *azblob.ContainerURL
 	logger     log.Logger
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 }
 
 // Verify AzureBackend satisfies the correct interfaces
@@ -56,6 +58,10 @@ func NewAzureBackend(conf map[string]string, logger log.Logger) (physical.Backen
 		}
 	}
 
+	if err := validateContainerName(name); err != nil {
+		return nil, fmt.Errorf("invalid container name %s: %w", name, err)
+	}
+
 	accountName := os.Getenv("AZURE_ACCOUNT_NAME")
 	if accountName == "" {
 		accountName = conf["accountName"]
@@ -63,6 +69,9 @@ func NewAzureBackend(conf map[string]string, logger log.Logger) (physical.Backen
 			return nil, fmt.Errorf("'accountName' must be set")
 		}
 	}
+	if err := validateAccountName(accountName); err != nil {
+		return nil, fmt.Errorf("invalid account name %s: %w", accountName, err)
+	}
 
 	accountKey := os.Getenv("AZURE_ACCOUNT_KEY")
 	if accountKey == "" {
@@ -183,11 +192,40 @@ func NewAzureBackend(conf map[string]string, logger log.Logger) (physical.Backen
 	a := &AzureBackend{
 		container:  &containerURL,
 		logger:     logger,
-		permitPool: physical.NewPermitPool(maxParInt),
+		permitPool: permitpool.New(maxParInt),
 	}
 	return a, nil
 }
 
+// validation rules for containers are defined here:
+// https://learn.microsoft.com/en-us/rest/api/storageservices/Naming-and-Referencing-Containers--Blobs--and-Metadata#container-names
+var containerNameRegex = regexp.MustCompile("^[a-z0-9]+(-[a-z0-9]+)*$")
+
+func validateContainerName(name string) error {
+	if len(name) < 3 || len(name) > 63 {
+		return errors.New("name must be between 3 and 63 characters long")
+	}
+
+	if !containerNameRegex.MatchString(name) {
+		return errors.New("name is invalid")
+	}
+	return nil
+}
+
+// validation rules are defined here:
+// https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-storage-account-name?tabs=bicep#cause
+var accountNameRegex = regexp.MustCompile("^[a-z0-9]+$")
+
+func validateAccountName(name string) error {
+	if len(name) < 3 || len(name) > 24 {
+		return errors.New("name must be between 3 and 24 characters long")
+	}
+	if !accountNameRegex.MatchString(name) {
+		return errors.New("name is invalid")
+	}
+	return nil
+}
+
 // Put is used to insert or update an entry
 func (a *AzureBackend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince([]string{"azure", "put"}, time.Now())
@@ -196,7 +234,9 @@ func (a *AzureBackend) Put(ctx context.Context, entry *physical.Entry) error {
 		return fmt.Errorf("value is bigger than the current supported limit of 4MBytes")
 	}
 
-	a.permitPool.Acquire()
+	if err := a.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer a.permitPool.Release()
 
 	blobURL := a.container.NewBlockBlobURL(entry.Key)
@@ -211,7 +251,9 @@ func (a *AzureBackend) Put(ctx context.Context, entry *physical.Entry) error {
 func (a *AzureBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"azure", "get"}, time.Now())
 
-	a.permitPool.Acquire()
+	if err := a.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer a.permitPool.Release()
 
 	blobURL := a.container.NewBlockBlobURL(key)
@@ -234,7 +276,7 @@ func (a *AzureBackend) Get(ctx context.Context, key string) (*physical.Entry, er
 	reader := res.Body(azblob.RetryReaderOptions{})
 	defer reader.Close()
 
-	data, err := ioutil.ReadAll(reader)
+	data, err := io.ReadAll(reader)
 
 	ent := &physical.Entry{
 		Key:   key,
@@ -248,7 +290,9 @@ func (a *AzureBackend) Get(ctx context.Context, key string) (*physical.Entry, er
 func (a *AzureBackend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince([]string{"azure", "delete"}, time.Now())
 
-	a.permitPool.Acquire()
+	if err := a.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer a.permitPool.Release()
 
 	blobURL := a.container.NewBlockBlobURL(key)
@@ -273,7 +317,9 @@ func (a *AzureBackend) Delete(ctx context.Context, key string) error {
 func (a *AzureBackend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{"azure", "list"}, time.Now())
 
-	a.permitPool.Acquire()
+	if err := a.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer a.permitPool.Release()
 
 	var keys []string
@@ -307,7 +353,7 @@ func (a *AzureBackend) List(ctx context.Context, prefix string) ([]string, error
 // getAuthTokenFromIMDS uses the Azure Instance Metadata Service to retrieve a short-lived credential using OAuth
 // more info on this https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
 func getAuthTokenFromIMDS(resource string) (*adal.ServicePrincipalToken, error) {
-	msiEndpoint, err := adal.GetMSIVMEndpoint()
+	msiEndpoint, err := adal.GetMSIEndpoint()
 	if err != nil {
 		return nil, err
 	}
diff --git a/physical/azure/azure_test.go b/physical/azure/azure_test.go
index 13f4e301cd8..5413a1c1384 100644
--- a/physical/azure/azure_test.go
+++ b/physical/azure/azure_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package azure
@@ -9,6 +9,7 @@ import (
 	"net"
 	"os"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 
@@ -17,6 +18,7 @@ import (
 	"github.com/hashicorp/vault/helper/testhelpers/azurite"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/physical"
+	"github.com/stretchr/testify/require"
 )
 
 /// These tests run against an Azurite docker container, unless AZURE_ACCOUNT_NAME is given.
@@ -33,7 +35,7 @@ func testFixture(t *testing.T) (*AzureBackend, func()) {
 	t.Helper()
 
 	ts := time.Now().UnixNano()
-	name := fmt.Sprintf("vault-test-%d", ts)
+	name := fmt.Sprintf("vlt-%d", ts)
 	_ = os.Setenv("AZURE_BLOB_CONTAINER", name)
 
 	cleanup := func() {}
@@ -128,3 +130,116 @@ func isIMDSReachable(t *testing.T) bool {
 
 	return true
 }
+
+// TestAzureBackend_validateContainerName validates that the given container
+// names meet the Azure restrictions for container names
+func TestAzureBackend_validateContainerName(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name          string
+		containerName string
+		wantError     bool
+	}{
+		{
+			name:          "success",
+			containerName: "abcd-1234-efgh",
+			wantError:     false,
+		},
+		{
+			name:          "uppercase",
+			containerName: "Abcd-1234-efgh",
+			wantError:     true,
+		},
+		{
+			name:          "hyphen start",
+			containerName: "-abcd-1234-efgh",
+			wantError:     true,
+		},
+		{
+			name:          "hyphen end",
+			containerName: "abcd-1234-efgh-",
+			wantError:     true,
+		},
+		{
+			name:          "double hyphen",
+			containerName: "abcd-1234--efgh",
+			wantError:     true,
+		},
+		{
+			name:          "too short",
+			containerName: "ab",
+			wantError:     true,
+		},
+		{
+			name:          "too long",
+			containerName: strings.Repeat("a", 64),
+			wantError:     true,
+		},
+		{
+			name:          "other character",
+			containerName: "abcd-1234-e!gh",
+			wantError:     true,
+		},
+	}
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			err := validateContainerName(tc.containerName)
+			if tc.wantError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+// TestAzureBackend_validateAccountName validates that the given account names
+// meet the Azure restrictions for account names
+func TestAzureBackend_validateAccountName(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		name        string
+		accountName string
+		wantError   bool
+	}{
+		{
+			name:        "success",
+			accountName: "abcd1234",
+			wantError:   false,
+		},
+		{
+			name:        "uppercase",
+			accountName: "Abcd0123",
+			wantError:   true,
+		},
+		{
+			name:        "hyphen",
+			accountName: "abcd-1234",
+			wantError:   true,
+		},
+		{
+			name:        "too short",
+			accountName: "ab",
+			wantError:   true,
+		},
+		{
+			name:        "too long",
+			accountName: strings.Repeat("a", 25),
+			wantError:   true,
+		},
+	}
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			err := validateAccountName(tc.accountName)
+			if tc.wantError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/physical/cassandra/cassandra.go b/physical/cassandra/cassandra.go
index a7f22c468dc..e85c27f80fe 100644
--- a/physical/cassandra/cassandra.go
+++ b/physical/cassandra/cassandra.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cassandra
@@ -150,6 +150,14 @@ func NewCassandraBackend(conf map[string]string, logger log.Logger) (physical.Ba
 		cluster.Timeout = time.Duration(connectionTimeout) * time.Second
 	}
 
+	if disableInitialHostLookupStr, ok := conf["disable_host_initial_lookup"]; ok {
+		disableInitialHostLookup, err := strconv.ParseBool(disableInitialHostLookupStr)
+		if err != nil {
+			return nil, fmt.Errorf("'disable_host_initial_lookup' must be a bool")
+		}
+		cluster.DisableInitialHostLookup = disableInitialHostLookup
+	}
+
 	if err := setupCassandraTLS(conf, cluster); err != nil {
 		return nil, err
 	}
diff --git a/physical/cassandra/cassandra_test.go b/physical/cassandra/cassandra_test.go
index 3370c394796..cc45d74c54e 100644
--- a/physical/cassandra/cassandra_test.go
+++ b/physical/cassandra/cassandra_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cassandra
diff --git a/physical/cockroachdb/cockroachdb.go b/physical/cockroachdb/cockroachdb.go
index bf282e9ac65..d4042b5e8e4 100644
--- a/physical/cockroachdb/cockroachdb.go
+++ b/physical/cockroachdb/cockroachdb.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cockroachdb
@@ -14,9 +14,10 @@ import (
 	"unicode"
 
 	metrics "github.com/armon/go-metrics"
-	"github.com/cockroachdb/cockroach-go/crdb"
+	"github.com/cockroachdb/cockroach-go/v2/crdb"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/sdk/physical"
 	_ "github.com/jackc/pgx/v4/stdlib"
@@ -44,7 +45,7 @@ type CockroachDBBackend struct {
 	rawHAStatements map[string]string
 	haStatements    map[string]*sql.Stmt
 	logger          log.Logger
-	permitPool      *physical.PermitPool
+	permitPool      *permitpool.Pool
 	haEnabled       bool
 }
 
@@ -142,7 +143,7 @@ func NewCockroachDBBackend(conf map[string]string, logger log.Logger) (physical.
 		},
 		haStatements: make(map[string]*sql.Stmt),
 		logger:       logger,
-		permitPool:   physical.NewPermitPool(maxParInt),
+		permitPool:   permitpool.New(maxParInt),
 		haEnabled:    haEnabled,
 	}
 
@@ -176,7 +177,9 @@ func (c *CockroachDBBackend) prepare(statementMap map[string]*sql.Stmt, name, qu
 func (c *CockroachDBBackend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince([]string{"cockroachdb", "put"}, time.Now())
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer c.permitPool.Release()
 
 	_, err := c.statements["put"].Exec(entry.Key, entry.Value)
@@ -190,7 +193,9 @@ func (c *CockroachDBBackend) Put(ctx context.Context, entry *physical.Entry) err
 func (c *CockroachDBBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"cockroachdb", "get"}, time.Now())
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer c.permitPool.Release()
 
 	var result []byte
@@ -213,7 +218,9 @@ func (c *CockroachDBBackend) Get(ctx context.Context, key string) (*physical.Ent
 func (c *CockroachDBBackend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince([]string{"cockroachdb", "delete"}, time.Now())
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer c.permitPool.Release()
 
 	_, err := c.statements["delete"].Exec(key)
@@ -228,7 +235,9 @@ func (c *CockroachDBBackend) Delete(ctx context.Context, key string) error {
 func (c *CockroachDBBackend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{"cockroachdb", "list"}, time.Now())
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer c.permitPool.Release()
 
 	likePrefix := prefix + "%"
@@ -267,7 +276,9 @@ func (c *CockroachDBBackend) Transaction(ctx context.Context, txns []*physical.T
 		return nil
 	}
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer c.permitPool.Release()
 
 	return crdb.ExecuteTx(context.Background(), c.client, nil, func(tx *sql.Tx) error {
diff --git a/physical/cockroachdb/cockroachdb_ha.go b/physical/cockroachdb/cockroachdb_ha.go
index 03728d63c23..46fde5d1757 100644
--- a/physical/cockroachdb/cockroachdb_ha.go
+++ b/physical/cockroachdb/cockroachdb_ha.go
@@ -1,9 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cockroachdb
 
 import (
+	"context"
 	"database/sql"
 	"fmt"
 	"sync"
@@ -106,7 +107,9 @@ func (l *CockroachDBLock) Lock(stopCh <-chan struct{}) (<-chan struct{}, error)
 // CockroachDB table.
 func (l *CockroachDBLock) Unlock() error {
 	c := l.backend
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(context.Background()); err != nil {
+		return err
+	}
 	defer c.permitPool.Release()
 
 	if l.renewTicker != nil {
@@ -121,7 +124,9 @@ func (l *CockroachDBLock) Unlock() error {
 // including this one, and returns the current value.
 func (l *CockroachDBLock) Value() (bool, string, error) {
 	c := l.backend
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(context.Background()); err != nil {
+		return false, "", err
+	}
 	defer c.permitPool.Release()
 	var result string
 	err := c.haStatements["get"].QueryRow(l.key).Scan(&result)
@@ -185,7 +190,9 @@ func (l *CockroachDBLock) periodicallyRenewLock(done chan struct{}) {
 // else has the lock, whereas non-nil means that something unexpected happened.
 func (l *CockroachDBLock) writeItem() (bool, error) {
 	c := l.backend
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(context.Background()); err != nil {
+		return false, err
+	}
 	defer c.permitPool.Release()
 
 	sqlResult, err := c.haStatements["upsert"].Exec(l.identity, l.key, l.value, fmt.Sprintf("%d seconds", l.ttlSeconds))
diff --git a/physical/cockroachdb/cockroachdb_test.go b/physical/cockroachdb/cockroachdb_test.go
index 05d342519c3..1caa6496ff5 100644
--- a/physical/cockroachdb/cockroachdb_test.go
+++ b/physical/cockroachdb/cockroachdb_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cockroachdb
diff --git a/physical/cockroachdb/keywords.go b/physical/cockroachdb/keywords.go
index c57c9eae1a5..8eb151500ad 100644
--- a/physical/cockroachdb/keywords.go
+++ b/physical/cockroachdb/keywords.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cockroachdb
diff --git a/physical/consul/consul.go b/physical/consul/consul.go
index dec3717a020..25fb88c5c8d 100644
--- a/physical/consul/consul.go
+++ b/physical/consul/consul.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
@@ -19,6 +19,7 @@ import (
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-secure-stdlib/tlsutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/physical"
@@ -60,7 +61,7 @@ type ConsulBackend struct {
 	path            string
 	kv              *api.KV
 	txn             *api.Txn
-	permitPool      *physical.PermitPool
+	permitPool      *permitpool.Pool
 	consistencyMode string
 	sessionTTL      string
 	lockWaitTime    time.Duration
@@ -161,7 +162,7 @@ func NewConsulBackend(conf map[string]string, logger log.Logger) (physical.Backe
 		client:          client,
 		kv:              client.KV(),
 		txn:             client.Txn(),
-		permitPool:      physical.NewPermitPool(maxParInt),
+		permitPool:      permitpool.New(maxParInt),
 		consistencyMode: consistencyMode,
 		sessionTTL:      sessionTTL,
 		lockWaitTime:    lockWaitTime,
@@ -253,7 +254,9 @@ func (c *ConsulBackend) ExpandedCapabilitiesAvailable(ctx context.Context) bool
 		}}
 	}
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return false
+	}
 	defer c.permitPool.Release()
 
 	queryOpts := &api.QueryOptions{}
@@ -332,7 +335,9 @@ func (c *ConsulBackend) txnInternal(ctx context.Context, txns []*physical.TxnEnt
 		ops = append(ops, o)
 	}
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer c.permitPool.Release()
 
 	var retErr *multierror.Error
@@ -455,7 +460,9 @@ func (c *ConsulBackend) Put(ctx context.Context, entry *physical.Entry) error {
 func (c *ConsulBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"consul", "get"}, time.Now())
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer c.permitPool.Release()
 
 	queryOpts := &api.QueryOptions{}
@@ -505,7 +512,9 @@ func (c *ConsulBackend) List(ctx context.Context, prefix string) ([]string, erro
 		scan = scan[:len(scan)-1]
 	}
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer c.permitPool.Release()
 
 	queryOpts := &api.QueryOptions{}
diff --git a/physical/consul/consul_test.go b/physical/consul/consul_test.go
index bf1d809afdd..103f2840308 100644
--- a/physical/consul/consul_test.go
+++ b/physical/consul/consul_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/physical/consul/helpers.go b/physical/consul/helpers.go
index 2f6ac574b0b..00110e53162 100644
--- a/physical/consul/helpers.go
+++ b/physical/consul/helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
diff --git a/physical/couchdb/couchdb.go b/physical/couchdb/couchdb.go
index 0a1c379c6ee..888c5553103 100644
--- a/physical/couchdb/couchdb.go
+++ b/physical/couchdb/couchdb.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package couchdb
@@ -8,7 +8,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
 	"os"
@@ -19,6 +19,7 @@ import (
 	metrics "github.com/armon/go-metrics"
 	cleanhttp "github.com/hashicorp/go-cleanhttp"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/vault/sdk/physical"
 )
 
@@ -26,7 +27,7 @@ import (
 type CouchDBBackend struct {
 	logger     log.Logger
 	client     *couchDBClient
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 }
 
 // Verify CouchDBBackend satisfies the correct interfaces
@@ -114,7 +115,7 @@ func (m *couchDBClient) get(key string) (*physical.Entry, error) {
 	} else if resp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("GET returned %q", resp.Status)
 	}
-	bs, err := ioutil.ReadAll(resp.Body)
+	bs, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
@@ -143,7 +144,7 @@ func (m *couchDBClient) list(prefix string) ([]couchDBListItem, error) {
 	}
 	defer resp.Body.Close()
 
-	data, err := ioutil.ReadAll(resp.Body)
+	data, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
@@ -196,7 +197,7 @@ func buildCouchDBBackend(conf map[string]string, logger log.Logger) (*CouchDBBac
 			Client:   cleanhttp.DefaultPooledClient(),
 		},
 		logger:     logger,
-		permitPool: physical.NewPermitPool(maxParInt),
+		permitPool: permitpool.New(maxParInt),
 	}, nil
 }
 
@@ -213,7 +214,9 @@ type couchDBEntry struct {
 
 // Put is used to insert or update an entry
 func (m *CouchDBBackend) Put(ctx context.Context, entry *physical.Entry) error {
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer m.permitPool.Release()
 
 	return m.PutInternal(ctx, entry)
@@ -221,7 +224,9 @@ func (m *CouchDBBackend) Put(ctx context.Context, entry *physical.Entry) error {
 
 // Get is used to fetch an entry
 func (m *CouchDBBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer m.permitPool.Release()
 
 	return m.GetInternal(ctx, key)
@@ -229,7 +234,9 @@ func (m *CouchDBBackend) Get(ctx context.Context, key string) (*physical.Entry,
 
 // Delete is used to permanently delete an entry
 func (m *CouchDBBackend) Delete(ctx context.Context, key string) error {
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer m.permitPool.Release()
 
 	return m.DeleteInternal(ctx, key)
@@ -239,7 +246,9 @@ func (m *CouchDBBackend) Delete(ctx context.Context, key string) error {
 func (m *CouchDBBackend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{"couchdb", "list"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer m.permitPool.Release()
 
 	items, err := m.client.list(prefix)
@@ -276,7 +285,7 @@ func NewTransactionalCouchDBBackend(conf map[string]string, logger log.Logger) (
 	if err != nil {
 		return nil, err
 	}
-	backend.permitPool = physical.NewPermitPool(1)
+	backend.permitPool = permitpool.New(1)
 
 	return &TransactionalCouchDBBackend{
 		CouchDBBackend: *backend,
diff --git a/physical/couchdb/couchdb_test.go b/physical/couchdb/couchdb_test.go
index bc8f6b41dff..f82b1f50905 100644
--- a/physical/couchdb/couchdb_test.go
+++ b/physical/couchdb/couchdb_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package couchdb
@@ -6,7 +6,7 @@ package couchdb
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
 	"os"
@@ -145,7 +145,7 @@ func setupCouchDB(ctx context.Context, host string, port int) (docker.ServiceCon
 		}
 		defer resp.Body.Close()
 		if resp.StatusCode != http.StatusCreated {
-			bs, _ := ioutil.ReadAll(resp.Body)
+			bs, _ := io.ReadAll(resp.Body)
 			return nil, fmt.Errorf("failed to create database: %s %s\n", resp.Status, string(bs))
 		}
 	}
@@ -164,7 +164,7 @@ func setupCouchDB(ctx context.Context, host string, port int) (docker.ServiceCon
 		}
 		defer resp.Body.Close()
 		if resp.StatusCode != http.StatusOK {
-			bs, _ := ioutil.ReadAll(resp.Body)
+			bs, _ := io.ReadAll(resp.Body)
 			return nil, fmt.Errorf("Failed to create admin user: %s %s\n", resp.Status, string(bs))
 		}
 	}
diff --git a/physical/dynamodb/dynamodb.go b/physical/dynamodb/dynamodb.go
index 452b2f7fc35..29f372b586f 100644
--- a/physical/dynamodb/dynamodb.go
+++ b/physical/dynamodb/dynamodb.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package dynamodb
@@ -24,10 +24,11 @@ import (
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/dynamodb"
 	"github.com/aws/aws-sdk-go/service/dynamodb/dynamodbattribute"
-	"github.com/cenkalti/backoff/v3"
+	"github.com/cenkalti/backoff/v4"
 	cleanhttp "github.com/hashicorp/go-cleanhttp"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/awsutil"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	uuid "github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/physical"
@@ -48,6 +49,10 @@ const (
 	// that is used when none is configured explicitly.
 	DefaultDynamoDBWriteCapacity = 5
 
+	// DefaultDynamoDBBillingMode is the default billing mode
+	// that is used when none is configured explicitly.
+	DefaultDynamoDBBillingMode = "PROVISIONED"
+
 	// DynamoDBEmptyPath is the string that is used instead of
 	// empty strings when stored in DynamoDB.
 	DynamoDBEmptyPath = " "
@@ -122,7 +127,7 @@ type DynamoDBLockRecord struct {
 }
 
 type PermitPoolWithMetrics struct {
-	physical.PermitPool
+	permitpool.Pool
 	pendingPermits int32
 	poolSize       int
 }
@@ -167,6 +172,17 @@ func NewDynamoDBBackend(conf map[string]string, logger log.Logger) (physical.Bac
 		writeCapacity = DefaultDynamoDBWriteCapacity
 	}
 
+	billingMode := os.Getenv("AWS_DYNAMODB_BILLING_MODE")
+	if billingMode == "" {
+		billingMode = conf["billing_mode"]
+		if billingMode == "" {
+			billingMode = DefaultDynamoDBBillingMode
+		}
+	}
+	if billingMode != "PROVISIONED" && billingMode != "PAY_PER_REQUEST" {
+		return nil, fmt.Errorf("invalid billing mode: %q", billingMode)
+	}
+
 	endpoint := os.Getenv("AWS_DYNAMODB_ENDPOINT")
 	if endpoint == "" {
 		endpoint = conf["endpoint"]
@@ -198,6 +214,12 @@ func NewDynamoDBBackend(conf map[string]string, logger log.Logger) (physical.Bac
 		}
 	}
 
+	dynamodbAllowUpdates := os.Getenv("AWS_DYNAMODB_ALLOW_UPDATES")
+	if dynamodbAllowUpdates == "" {
+		dynamodbAllowUpdates = conf["dynamodb_allow_updates"]
+	}
+	allowUpdates := dynamodbAllowUpdates != ""
+
 	credsConfig := &awsutil.CredentialsConfig{
 		AccessKey:    conf["access_key"],
 		SecretKey:    conf["secret_key"],
@@ -228,7 +250,7 @@ func NewDynamoDBBackend(conf map[string]string, logger log.Logger) (physical.Bac
 
 	client := dynamodb.New(awsSession)
 
-	if err := ensureTableExists(client, table, readCapacity, writeCapacity); err != nil {
+	if err := ensureTableExists(client, table, readCapacity, writeCapacity, billingMode, allowUpdates); err != nil {
 		return nil, err
 	}
 
@@ -294,17 +316,19 @@ func (d *DynamoDBBackend) Put(ctx context.Context, entry *physical.Entry) error
 		})
 	}
 
-	return d.batchWriteRequests(requests)
+	return d.batchWriteRequests(ctx, requests)
 }
 
 // Get is used to fetch an entry
 func (d *DynamoDBBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"dynamodb", "get"}, time.Now())
 
-	d.permitPool.Acquire()
+	if err := d.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer d.permitPool.Release()
 
-	resp, err := d.client.GetItem(&dynamodb.GetItemInput{
+	resp, err := d.client.GetItemWithContext(ctx, &dynamodb.GetItemInput{
 		TableName:      aws.String(d.table),
 		ConsistentRead: aws.Bool(true),
 		Key: map[string]*dynamodb.AttributeValue{
@@ -363,7 +387,7 @@ func (d *DynamoDBBackend) Delete(ctx context.Context, key string) error {
 			excluded = append(excluded, recordKeyForVaultKey(prefixes[index-1]))
 		}
 
-		hasChildren, err := d.hasChildren(prefix, excluded)
+		hasChildren, err := d.hasChildren(ctx, prefix, excluded)
 		if err != nil {
 			return err
 		}
@@ -387,7 +411,7 @@ func (d *DynamoDBBackend) Delete(ctx context.Context, key string) error {
 		}
 	}
 
-	return d.batchWriteRequests(requests)
+	return d.batchWriteRequests(ctx, requests)
 }
 
 // List is used to list all the keys under a given
@@ -410,12 +434,19 @@ func (d *DynamoDBBackend) List(ctx context.Context, prefix string) ([]string, er
 				}},
 			},
 		},
+		ProjectionExpression: aws.String("#key, #path"),
+		ExpressionAttributeNames: map[string]*string{
+			"#key":  aws.String("Key"),
+			"#path": aws.String("Path"),
+		},
 	}
 
-	d.permitPool.Acquire()
+	if err := d.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer d.permitPool.Release()
 
-	err := d.client.QueryPages(queryInput, func(out *dynamodb.QueryOutput, lastPage bool) bool {
+	err := d.client.QueryPagesWithContext(ctx, queryInput, func(out *dynamodb.QueryOutput, lastPage bool) bool {
 		var record DynamoDBRecord
 		for _, item := range out.Items {
 			dynamodbattribute.UnmarshalMap(item, &record)
@@ -438,7 +469,7 @@ func (d *DynamoDBBackend) List(ctx context.Context, prefix string) ([]string, er
 // before any deletes take place. To account for that hasChildren accepts a slice of
 // strings representing values we expect to find that should NOT be counted as children
 // because they are going to be deleted.
-func (d *DynamoDBBackend) hasChildren(prefix string, exclude []string) (bool, error) {
+func (d *DynamoDBBackend) hasChildren(ctx context.Context, prefix string, exclude []string) (bool, error) {
 	prefix = strings.TrimSuffix(prefix, "/")
 	prefix = escapeEmptyPath(prefix)
 
@@ -453,6 +484,11 @@ func (d *DynamoDBBackend) hasChildren(prefix string, exclude []string) (bool, er
 				}},
 			},
 		},
+		ProjectionExpression: aws.String("#key, #path"),
+		ExpressionAttributeNames: map[string]*string{
+			"#key":  aws.String("Key"),
+			"#path": aws.String("Path"),
+		},
 		// Avoid fetching too many items from DynamoDB for performance reasons.
 		// We want to know if there are any children we don't expect to see.
 		// Answering that question requires fetching a minimum of one more item
@@ -460,10 +496,12 @@ func (d *DynamoDBBackend) hasChildren(prefix string, exclude []string) (bool, er
 		Limit: aws.Int64(int64(len(exclude) + 1)),
 	}
 
-	d.permitPool.Acquire()
+	if err := d.permitPool.Acquire(ctx); err != nil {
+		return false, err
+	}
 	defer d.permitPool.Release()
 
-	out, err := d.client.Query(queryInput)
+	out, err := d.client.QueryWithContext(ctx, queryInput)
 	if err != nil {
 		return false, err
 	}
@@ -509,22 +547,23 @@ func (d *DynamoDBBackend) HAEnabled() bool {
 
 // batchWriteRequests takes a list of write requests and executes them in badges
 // with a maximum size of 25 (which is the limit of BatchWriteItem requests).
-func (d *DynamoDBBackend) batchWriteRequests(requests []*dynamodb.WriteRequest) error {
+func (d *DynamoDBBackend) batchWriteRequests(ctx context.Context, requests []*dynamodb.WriteRequest) error {
 	for len(requests) > 0 {
 		batchSize := int(math.Min(float64(len(requests)), 25))
 		batch := map[string][]*dynamodb.WriteRequest{d.table: requests[:batchSize]}
 		requests = requests[batchSize:]
 
 		var err error
-
-		d.permitPool.Acquire()
+		if err := d.permitPool.Acquire(ctx); err != nil {
+			return err
+		}
 
 		boff := backoff.NewExponentialBackOff()
 		boff.MaxElapsedTime = 600 * time.Second
 
 		for len(batch) > 0 {
 			var output *dynamodb.BatchWriteItemOutput
-			output, err = d.client.BatchWriteItem(&dynamodb.BatchWriteItemInput{
+			output, err = d.client.BatchWriteItemWithContext(ctx, &dynamodb.BatchWriteItemInput{
 				RequestItems: batch,
 			})
 			if err != nil {
@@ -804,21 +843,17 @@ WatchLoop:
 }
 
 // ensureTableExists creates a DynamoDB table with a given
-// DynamoDB client. If the table already exists, it is not
-// being reconfigured.
-func ensureTableExists(client *dynamodb.DynamoDB, table string, readCapacity, writeCapacity int) error {
-	_, err := client.DescribeTable(&dynamodb.DescribeTableInput{
+// DynamoDB client.
+// If the table already exists, it is not being reconfigured unless allowUpdates is true.
+func ensureTableExists(client *dynamodb.DynamoDB, table string, readCapacity, writeCapacity int, billingMode string, allowUpdates bool) error {
+	tableDescription, err := client.DescribeTable(&dynamodb.DescribeTableInput{
 		TableName: aws.String(table),
 	})
 	if err != nil {
 		if awsError, ok := err.(awserr.Error); ok {
 			if awsError.Code() == "ResourceNotFoundException" {
-				_, err := client.CreateTable(&dynamodb.CreateTableInput{
+				createTableRequest := &dynamodb.CreateTableInput{
 					TableName: aws.String(table),
-					ProvisionedThroughput: &dynamodb.ProvisionedThroughput{
-						ReadCapacityUnits:  aws.Int64(int64(readCapacity)),
-						WriteCapacityUnits: aws.Int64(int64(writeCapacity)),
-					},
 					KeySchema: []*dynamodb.KeySchemaElement{{
 						AttributeName: aws.String("Path"),
 						KeyType:       aws.String("HASH"),
@@ -833,7 +868,18 @@ func ensureTableExists(client *dynamodb.DynamoDB, table string, readCapacity, wr
 						AttributeName: aws.String("Key"),
 						AttributeType: aws.String("S"),
 					}},
-				})
+				}
+				if billingMode == "PAY_PER_REQUEST" {
+					// PAY_PER_REQUEST doesn't require setting capacity units
+					createTableRequest.BillingMode = aws.String(billingMode)
+				} else {
+					createTableRequest.BillingMode = aws.String(billingMode)
+					createTableRequest.ProvisionedThroughput = &dynamodb.ProvisionedThroughput{
+						ReadCapacityUnits:  aws.Int64(int64(readCapacity)),
+						WriteCapacityUnits: aws.Int64(int64(writeCapacity)),
+					}
+				}
+				_, err := client.CreateTable(createTableRequest)
 				if err != nil {
 					return err
 				}
@@ -850,13 +896,53 @@ func ensureTableExists(client *dynamodb.DynamoDB, table string, readCapacity, wr
 		}
 		return err
 	}
+	if allowUpdates && shouldUpdateTable(tableDescription.Table, billingMode, readCapacity, writeCapacity) {
+		// this will only change the BillingMode or the read/write capacity
+		updateTableRequest := &dynamodb.UpdateTableInput{
+			TableName: aws.String(table),
+		}
+		if billingMode == "PAY_PER_REQUEST" {
+			// PAY_PER_REQUEST doesn't require setting capacity units
+			updateTableRequest.BillingMode = aws.String(billingMode)
+		} else {
+			updateTableRequest.BillingMode = aws.String(billingMode)
+			updateTableRequest.ProvisionedThroughput = &dynamodb.ProvisionedThroughput{
+				ReadCapacityUnits:  aws.Int64(int64(readCapacity)),
+				WriteCapacityUnits: aws.Int64(int64(writeCapacity)),
+			}
+		}
+		_, err := client.UpdateTable(updateTableRequest)
+		if err != nil {
+			return err
+		}
+	}
 
 	return nil
 }
 
+// shouldUpdateTable compares the billingMode and provisioned capacity of the existing table with the
+// desired billingMode and capacity
+func shouldUpdateTable(tableDescription *dynamodb.TableDescription, billingMode string, readCapacity, writeCapacity int) bool {
+	existingBillingMode := "PROVISIONED"
+	// the dynamodb service returns nil when PROVISIONED is the billingMode
+	// as it is the default
+	billingSummary := tableDescription.BillingModeSummary
+	if billingSummary != nil {
+		existingBillingMode = *(billingSummary.BillingMode)
+	}
+	if existingBillingMode != billingMode {
+		return true
+	}
+	provisionedThroughput := tableDescription.ProvisionedThroughput
+	if int64(readCapacity) != *(provisionedThroughput.ReadCapacityUnits) && int64(writeCapacity) != *(provisionedThroughput.WriteCapacityUnits) {
+		return true
+	}
+	return false
+}
+
 // recordPathForVaultKey transforms a vault key into
 // a value suitable for the `DynamoDBRecord`'s `Path`
-// property. This path equals the the vault key without
+// property. This path equals the vault key without
 // its last component.
 func recordPathForVaultKey(key string) string {
 	if strings.Contains(key, "/") {
@@ -867,7 +953,7 @@ func recordPathForVaultKey(key string) string {
 
 // recordKeyForVaultKey transforms a vault key into
 // a value suitable for the `DynamoDBRecord`'s `Key`
-// property. This path equals the the vault key's
+// property. This path equals the vault key's
 // last component.
 func recordKeyForVaultKey(key string) string {
 	return pkgPath.Base(key)
@@ -918,34 +1004,38 @@ func isConditionCheckFailed(err error) bool {
 // number of permits which emits metrics
 func NewPermitPoolWithMetrics(permits int) *PermitPoolWithMetrics {
 	return &PermitPoolWithMetrics{
-		PermitPool:     *physical.NewPermitPool(permits),
+		Pool:           *permitpool.New(permits),
 		pendingPermits: 0,
 		poolSize:       permits,
 	}
 }
 
 // Acquire returns when a permit has been acquired
-func (c *PermitPoolWithMetrics) Acquire() {
+func (c *PermitPoolWithMetrics) Acquire(ctx context.Context) error {
 	atomic.AddInt32(&c.pendingPermits, 1)
 	c.emitPermitMetrics()
-	c.PermitPool.Acquire()
+	err := c.Pool.Acquire(ctx)
 	atomic.AddInt32(&c.pendingPermits, -1)
 	c.emitPermitMetrics()
+	if err != nil {
+		return err
+	}
+	return nil
 }
 
 // Release returns a permit to the pool
 func (c *PermitPoolWithMetrics) Release() {
-	c.PermitPool.Release()
+	c.Pool.Release()
 	c.emitPermitMetrics()
 }
 
 // Get the number of requests in the permit pool
 func (c *PermitPoolWithMetrics) CurrentPermits() int {
-	return c.PermitPool.CurrentPermits()
+	return c.Pool.CurrentPermits()
 }
 
 func (c *PermitPoolWithMetrics) emitPermitMetrics() {
 	metrics.SetGauge([]string{"dynamodb", "permit_pool", "pending_permits"}, float32(c.pendingPermits))
-	metrics.SetGauge([]string{"dynamodb", "permit_pool", "active_permits"}, float32(c.PermitPool.CurrentPermits()))
+	metrics.SetGauge([]string{"dynamodb", "permit_pool", "active_permits"}, float32(c.Pool.CurrentPermits()))
 	metrics.SetGauge([]string{"dynamodb", "permit_pool", "pool_size"}, float32(c.poolSize))
 }
diff --git a/physical/dynamodb/dynamodb_test.go b/physical/dynamodb/dynamodb_test.go
index 0d6bd5914fc..38965e141c5 100644
--- a/physical/dynamodb/dynamodb_test.go
+++ b/physical/dynamodb/dynamodb_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package dynamodb
@@ -25,6 +25,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/docker"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/physical"
+	"github.com/stretchr/testify/require"
 )
 
 func TestDynamoDBBackend(t *testing.T) {
@@ -176,6 +177,221 @@ func TestDynamoDBHABackend(t *testing.T) {
 	testDynamoDBLockRenewal(t, b.(physical.HABackend))
 }
 
+// TestDynamoDBBackendPayPerRequest tests the DynamoDB backend
+// with the PAY_PER_REQUEST billing mode
+func TestDynamoDBBackendPayPerRequest(t *testing.T) {
+	cleanup, svccfg := prepareDynamoDBTestContainer(t)
+	defer cleanup()
+
+	creds, err := svccfg.Credentials.Get()
+	require.NoError(t, err)
+
+	region := os.Getenv("AWS_DEFAULT_REGION")
+	if region == "" {
+		region = "us-east-1"
+	}
+
+	awsSession, err := session.NewSession(&aws.Config{
+		Credentials: svccfg.Credentials,
+		Endpoint:    aws.String(svccfg.URL().String()),
+		Region:      aws.String(region),
+	})
+	require.NoError(t, err)
+
+	conn := dynamodb.New(awsSession)
+
+	randInt := rand.New(rand.NewSource(time.Now().UnixNano())).Int()
+	table := fmt.Sprintf("vault-dynamodb-testacc-%d", randInt)
+
+	defer func() {
+		conn.DeleteTable(&dynamodb.DeleteTableInput{
+			TableName: aws.String(table),
+		})
+	}()
+
+	logger := logging.NewVaultLogger(log.Debug)
+
+	b, err := NewDynamoDBBackend(map[string]string{
+		"access_key":    creds.AccessKeyID,
+		"secret_key":    creds.SecretAccessKey,
+		"session_token": creds.SessionToken,
+		"table":         table,
+		"region":        region,
+		"endpoint":      svccfg.URL().String(),
+		"billing_mode":  "PAY_PER_REQUEST",
+	}, logger)
+	require.NoError(t, err)
+
+	dynamoTable, err := conn.DescribeTable(&dynamodb.DescribeTableInput{
+		TableName: aws.String(table),
+	})
+	require.NoError(t, err)
+	billingMode := *(dynamoTable.Table.BillingModeSummary.BillingMode)
+	require.Equal(t, "PAY_PER_REQUEST", billingMode)
+
+	physical.ExerciseBackend(t, b)
+	physical.ExerciseBackend_ListPrefix(t, b)
+}
+
+// TestDynamoDBBackendUpdateBillingMode tests the DynamoDB backend
+// and updating the billing mode
+func TestDynamoDBBackendUpdateBillingMode(t *testing.T) {
+	cleanup, svccfg := prepareDynamoDBTestContainer(t)
+	defer cleanup()
+
+	creds, err := svccfg.Credentials.Get()
+	require.NoError(t, err)
+
+	region := os.Getenv("AWS_DEFAULT_REGION")
+	if region == "" {
+		region = "us-east-1"
+	}
+
+	awsSession, err := session.NewSession(&aws.Config{
+		Credentials: svccfg.Credentials,
+		Endpoint:    aws.String(svccfg.URL().String()),
+		Region:      aws.String(region),
+	})
+	require.NoError(t, err)
+
+	conn := dynamodb.New(awsSession)
+
+	randInt := rand.New(rand.NewSource(time.Now().UnixNano())).Int()
+	table := fmt.Sprintf("vault-dynamodb-testacc-%d", randInt)
+
+	defer func() {
+		conn.DeleteTable(&dynamodb.DeleteTableInput{
+			TableName: aws.String(table),
+		})
+	}()
+
+	logger := logging.NewVaultLogger(log.Debug)
+
+	b, err := NewDynamoDBBackend(map[string]string{
+		"access_key":    creds.AccessKeyID,
+		"secret_key":    creds.SecretAccessKey,
+		"session_token": creds.SessionToken,
+		"table":         table,
+		"region":        region,
+		"endpoint":      svccfg.URL().String(),
+	}, logger)
+	require.NoError(t, err)
+
+	dynamoTable, err := conn.DescribeTable(&dynamodb.DescribeTableInput{
+		TableName: aws.String(table),
+	})
+	require.NoError(t, err)
+	billingMode := dynamoTable.Table.BillingModeSummary
+	require.Nil(t, billingMode)
+
+	// now run again, with the same table name but a different billing mode
+	// and setting allow_update
+	b, err = NewDynamoDBBackend(map[string]string{
+		"access_key":             creds.AccessKeyID,
+		"secret_key":             creds.SecretAccessKey,
+		"session_token":          creds.SessionToken,
+		"table":                  table,
+		"region":                 region,
+		"endpoint":               svccfg.URL().String(),
+		"billing_mode":           "PAY_PER_REQUEST",
+		"dynamodb_allow_updates": "true",
+	}, logger)
+	require.NoError(t, err)
+
+	dynamoTable, err = conn.DescribeTable(&dynamodb.DescribeTableInput{
+		TableName: aws.String(table),
+	})
+	require.NoError(t, err)
+	newBillingMode := *(dynamoTable.Table.BillingModeSummary.BillingMode)
+	require.Equal(t, "PAY_PER_REQUEST", newBillingMode)
+
+	physical.ExerciseBackend(t, b)
+	physical.ExerciseBackend_ListPrefix(t, b)
+}
+
+// TestDynamoDBBackendUpdateReadWriteCapacity tests the DynamoDB backend
+// and updating the provisioned read and write capacity
+func TestDynamoDBBackendUpdateReadWriteCapacity(t *testing.T) {
+	cleanup, svccfg := prepareDynamoDBTestContainer(t)
+	defer cleanup()
+
+	creds, err := svccfg.Credentials.Get()
+	require.NoError(t, err)
+
+	region := os.Getenv("AWS_DEFAULT_REGION")
+	if region == "" {
+		region = "us-east-1"
+	}
+
+	awsSession, err := session.NewSession(&aws.Config{
+		Credentials: svccfg.Credentials,
+		Endpoint:    aws.String(svccfg.URL().String()),
+		Region:      aws.String(region),
+	})
+	require.NoError(t, err)
+
+	conn := dynamodb.New(awsSession)
+
+	randInt := rand.New(rand.NewSource(time.Now().UnixNano())).Int()
+	table := fmt.Sprintf("vault-dynamodb-testacc-%d", randInt)
+
+	defer func() {
+		conn.DeleteTable(&dynamodb.DeleteTableInput{
+			TableName: aws.String(table),
+		})
+	}()
+
+	logger := logging.NewVaultLogger(log.Debug)
+
+	b, err := NewDynamoDBBackend(map[string]string{
+		"access_key":    creds.AccessKeyID,
+		"secret_key":    creds.SecretAccessKey,
+		"session_token": creds.SessionToken,
+		"table":         table,
+		"region":        region,
+		"endpoint":      svccfg.URL().String(),
+	}, logger)
+	require.NoError(t, err)
+
+	dynamoTable, err := conn.DescribeTable(&dynamodb.DescribeTableInput{
+		TableName: aws.String(table),
+	})
+	require.NoError(t, err)
+
+	provisionedThroughput := dynamoTable.Table.ProvisionedThroughput
+	require.NotNil(t, provisionedThroughput)
+	require.Equal(t, int64(5), *(provisionedThroughput.ReadCapacityUnits))
+	require.Equal(t, int64(5), *(provisionedThroughput.WriteCapacityUnits))
+
+	// now run again, with the same table name but a capacity of 20
+	// and setting allow_update
+	b, err = NewDynamoDBBackend(map[string]string{
+		"access_key":             creds.AccessKeyID,
+		"secret_key":             creds.SecretAccessKey,
+		"session_token":          creds.SessionToken,
+		"table":                  table,
+		"region":                 region,
+		"endpoint":               svccfg.URL().String(),
+		"read_capacity":          "20",
+		"write_capacity":         "20",
+		"dynamodb_allow_updates": "true",
+	}, logger)
+	require.NoError(t, err)
+
+	dynamoTable, err = conn.DescribeTable(&dynamodb.DescribeTableInput{
+		TableName: aws.String(table),
+	})
+	require.NoError(t, err)
+
+	provisionedThroughput = dynamoTable.Table.ProvisionedThroughput
+	require.NotNil(t, provisionedThroughput)
+	require.Equal(t, int64(20), *(provisionedThroughput.ReadCapacityUnits))
+	require.Equal(t, int64(20), *(provisionedThroughput.WriteCapacityUnits))
+
+	physical.ExerciseBackend(t, b)
+	physical.ExerciseBackend_ListPrefix(t, b)
+}
+
 // Similar to testHABackend, but using internal implementation details to
 // trigger the lock failure scenario by setting the lock renew period for one
 // of the locks to a higher value than the lock TTL.
diff --git a/physical/etcd/etcd.go b/physical/etcd/etcd.go
index 1d332dc9c43..a018a0de9ef 100644
--- a/physical/etcd/etcd.go
+++ b/physical/etcd/etcd.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package etcd
diff --git a/physical/etcd/etcd3.go b/physical/etcd/etcd3.go
index 3182f2d83c9..546f05a7642 100644
--- a/physical/etcd/etcd3.go
+++ b/physical/etcd/etcd3.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package etcd
@@ -17,6 +17,7 @@ import (
 	"github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/sdk/physical"
 	"go.etcd.io/etcd/client/pkg/v3/transport"
@@ -34,7 +35,7 @@ type EtcdBackend struct {
 	lockTimeout    time.Duration
 	requestTimeout time.Duration
 
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 
 	etcd *clientv3.Client
 }
@@ -178,7 +179,7 @@ func newEtcd3Backend(conf map[string]string, logger log.Logger) (physical.Backen
 	return &EtcdBackend{
 		path:           path,
 		etcd:           etcd,
-		permitPool:     physical.NewPermitPool(physical.DefaultParallelOperations),
+		permitPool:     permitpool.New(physical.DefaultParallelOperations),
 		logger:         logger,
 		haEnabled:      haEnabledBool,
 		lockTimeout:    lock,
@@ -189,7 +190,9 @@ func newEtcd3Backend(conf map[string]string, logger log.Logger) (physical.Backen
 func (c *EtcdBackend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince([]string{"etcd", "put"}, time.Now())
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer c.permitPool.Release()
 
 	ctx, cancel := context.WithTimeout(context.Background(), c.requestTimeout)
@@ -201,7 +204,9 @@ func (c *EtcdBackend) Put(ctx context.Context, entry *physical.Entry) error {
 func (c *EtcdBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"etcd", "get"}, time.Now())
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer c.permitPool.Release()
 
 	ctx, cancel := context.WithTimeout(context.Background(), c.requestTimeout)
@@ -226,7 +231,9 @@ func (c *EtcdBackend) Get(ctx context.Context, key string) (*physical.Entry, err
 func (c *EtcdBackend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince([]string{"etcd", "delete"}, time.Now())
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer c.permitPool.Release()
 
 	ctx, cancel := context.WithTimeout(context.Background(), c.requestTimeout)
@@ -241,7 +248,9 @@ func (c *EtcdBackend) Delete(ctx context.Context, key string) error {
 func (c *EtcdBackend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{"etcd", "list"}, time.Now())
 
-	c.permitPool.Acquire()
+	if err := c.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer c.permitPool.Release()
 
 	ctx, cancel := context.WithTimeout(context.Background(), c.requestTimeout)
diff --git a/physical/etcd/etcd3_test.go b/physical/etcd/etcd3_test.go
index 7af1ecd7163..57b724d381a 100644
--- a/physical/etcd/etcd3_test.go
+++ b/physical/etcd/etcd3_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package etcd
diff --git a/physical/foundationdb/fdb-go-install.sh b/physical/foundationdb/fdb-go-install.sh
index 8b56b09b25c..7c0c98d17ee 100755
--- a/physical/foundationdb/fdb-go-install.sh
+++ b/physical/foundationdb/fdb-go-install.sh
@@ -1,5 +1,5 @@
 #!/bin/bash -eu
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 #
diff --git a/physical/foundationdb/foundationdb.go b/physical/foundationdb/foundationdb.go
index de706d1fa94..bd2c81121fe 100644
--- a/physical/foundationdb/foundationdb.go
+++ b/physical/foundationdb/foundationdb.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build foundationdb
diff --git a/physical/foundationdb/foundationdb_test.go b/physical/foundationdb/foundationdb_test.go
index 8bbcbb3ed16..b0f36fd84db 100644
--- a/physical/foundationdb/foundationdb_test.go
+++ b/physical/foundationdb/foundationdb_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build foundationdb
diff --git a/physical/foundationdb/foundationdbstub.go b/physical/foundationdb/foundationdbstub.go
index 288e8f7acf9..862e50682df 100644
--- a/physical/foundationdb/foundationdbstub.go
+++ b/physical/foundationdb/foundationdbstub.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !foundationdb
diff --git a/physical/gcs/gcs.go b/physical/gcs/gcs.go
index eea7a515ac8..a1ee2a7e4b5 100644
--- a/physical/gcs/gcs.go
+++ b/physical/gcs/gcs.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package gcs
@@ -8,7 +8,7 @@ import (
 	"crypto/md5"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"os"
 	"sort"
 	"strconv"
@@ -19,6 +19,7 @@ import (
 	metrics "github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
 	multierror "github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/vault/helper/useragent"
 	"github.com/hashicorp/vault/sdk/physical"
 	"google.golang.org/api/iterator"
@@ -75,7 +76,7 @@ type Backend struct {
 	// client is the API client and permitPool is the allowed concurrent uses of
 	// the client.
 	client     *storage.Client
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 
 	// haEnabled indicates if HA is enabled.
 	haEnabled bool
@@ -171,7 +172,7 @@ func NewBackend(c map[string]string, logger log.Logger) (physical.Backend, error
 		bucket:     bucket,
 		chunkSize:  chunkSize,
 		client:     client,
-		permitPool: physical.NewPermitPool(maxParallel),
+		permitPool: permitpool.New(maxParallel),
 
 		haEnabled: haEnabled,
 		haClient:  haClient,
@@ -185,7 +186,9 @@ func (b *Backend) Put(ctx context.Context, entry *physical.Entry) (retErr error)
 	defer metrics.MeasureSince(metricPut, time.Now())
 
 	// Pooling
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	// Insert
@@ -211,12 +214,14 @@ func (b *Backend) Get(ctx context.Context, key string) (retEntry *physical.Entry
 	defer metrics.MeasureSince(metricGet, time.Now())
 
 	// Pooling
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer b.permitPool.Release()
 
 	// Read
 	r, err := b.client.Bucket(b.bucket).Object(key).NewReader(ctx)
-	if err == storage.ErrObjectNotExist {
+	if errors.Is(err, storage.ErrObjectNotExist) {
 		return nil, nil
 	}
 	if err != nil {
@@ -230,7 +235,7 @@ func (b *Backend) Get(ctx context.Context, key string) (retEntry *physical.Entry
 		}
 	}()
 
-	value, err := ioutil.ReadAll(r)
+	value, err := io.ReadAll(r)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read value into a string: %w", err)
 	}
@@ -246,12 +251,14 @@ func (b *Backend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince(metricDelete, time.Now())
 
 	// Pooling
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	// Delete
 	err := b.client.Bucket(b.bucket).Object(key).Delete(ctx)
-	if err != nil && err != storage.ErrObjectNotExist {
+	if err != nil && !errors.Is(err, storage.ErrObjectNotExist) {
 		return fmt.Errorf("failed to delete key %q: %w", key, err)
 	}
 	return nil
@@ -263,7 +270,9 @@ func (b *Backend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince(metricList, time.Now())
 
 	// Pooling
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer b.permitPool.Release()
 
 	iter := b.client.Bucket(b.bucket).Objects(ctx, &storage.Query{
diff --git a/physical/gcs/gcs_ha.go b/physical/gcs/gcs_ha.go
index 279b79ab1f0..dbb92cd6c04 100644
--- a/physical/gcs/gcs_ha.go
+++ b/physical/gcs/gcs_ha.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package gcs
@@ -398,7 +398,7 @@ func (l *Lock) writeLock() (bool, error) {
 func (l *Lock) get(ctx context.Context) (*LockRecord, error) {
 	// Read
 	attrs, err := l.backend.haClient.Bucket(l.backend.bucket).Object(l.key).Attrs(ctx)
-	if err == storage.ErrObjectNotExist {
+	if errors.Is(err, storage.ErrObjectNotExist) {
 		return nil, nil
 	}
 	if err != nil {
diff --git a/physical/gcs/gcs_ha_test.go b/physical/gcs/gcs_ha_test.go
index ab6ca888a69..9a5c2479258 100644
--- a/physical/gcs/gcs_ha_test.go
+++ b/physical/gcs/gcs_ha_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package gcs
diff --git a/physical/gcs/gcs_test.go b/physical/gcs/gcs_test.go
index 6ee9ab432c8..755eaf0ce84 100644
--- a/physical/gcs/gcs_test.go
+++ b/physical/gcs/gcs_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package gcs
diff --git a/physical/manta/manta.go b/physical/manta/manta.go
index 5ab1c4e0579..ba608214a34 100644
--- a/physical/manta/manta.go
+++ b/physical/manta/manta.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package manta
@@ -17,6 +17,7 @@ import (
 
 	metrics "github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/vault/sdk/physical"
 	triton "github.com/joyent/triton-go"
 	"github.com/joyent/triton-go/authentication"
@@ -28,7 +29,7 @@ const mantaDefaultRootStore = "/stor"
 
 type MantaBackend struct {
 	logger     log.Logger
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 	client     *storage.StorageClient
 	directory  string
 }
@@ -95,7 +96,7 @@ func NewMantaBackend(conf map[string]string, logger log.Logger) (physical.Backen
 		client:     client,
 		directory:  conf["directory"],
 		logger:     logger,
-		permitPool: physical.NewPermitPool(maxParInt),
+		permitPool: permitpool.New(maxParInt),
 	}, nil
 }
 
@@ -103,7 +104,9 @@ func NewMantaBackend(conf map[string]string, logger log.Logger) (physical.Backen
 func (m *MantaBackend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince([]string{"manta", "put"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer m.permitPool.Release()
 
 	r := bytes.NewReader(entry.Value)
@@ -121,7 +124,9 @@ func (m *MantaBackend) Put(ctx context.Context, entry *physical.Entry) error {
 func (m *MantaBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"manta", "get"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer m.permitPool.Release()
 
 	output, err := m.client.Objects().Get(ctx, &storage.GetObjectInput{
@@ -154,7 +159,9 @@ func (m *MantaBackend) Get(ctx context.Context, key string) (*physical.Entry, er
 func (m *MantaBackend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince([]string{"manta", "delete"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer m.permitPool.Release()
 
 	if strings.HasSuffix(key, "/") {
@@ -210,7 +217,9 @@ func tryDeleteDirectory(ctx context.Context, m *MantaBackend, directoryPath stri
 func (m *MantaBackend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{"manta", "list"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer m.permitPool.Release()
 
 	objs, err := m.client.Dir().List(ctx, &storage.ListDirectoryInput{
diff --git a/physical/manta/manta_test.go b/physical/manta/manta_test.go
index 11b024dd918..0c797d32ae0 100644
--- a/physical/manta/manta_test.go
+++ b/physical/manta/manta_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package manta
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/physical"
 	triton "github.com/joyent/triton-go"
@@ -57,7 +58,7 @@ func TestMantaBackend(t *testing.T) {
 		client:     client,
 		directory:  testHarnessBucket,
 		logger:     logger.Named("storage.mantabackend"),
-		permitPool: physical.NewPermitPool(128),
+		permitPool: permitpool.New(128),
 	}
 
 	err = mb.client.Dir().Put(context.Background(), &storage.PutDirectoryInput{
diff --git a/physical/mssql/mssql.go b/physical/mssql/mssql.go
index ef6d54e0f5a..681ac105246 100644
--- a/physical/mssql/mssql.go
+++ b/physical/mssql/mssql.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mssql
@@ -16,6 +16,7 @@ import (
 	metrics "github.com/armon/go-metrics"
 	_ "github.com/denisenkom/go-mssqldb"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/sdk/physical"
 )
@@ -31,7 +32,7 @@ type MSSQLBackend struct {
 	client     *sql.DB
 	statements map[string]*sql.Stmt
 	logger     log.Logger
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 }
 
 func isInvalidIdentifier(name string) bool {
@@ -171,7 +172,7 @@ func NewMSSQLBackend(conf map[string]string, logger log.Logger) (physical.Backen
 		client:     db,
 		statements: make(map[string]*sql.Stmt),
 		logger:     logger,
-		permitPool: physical.NewPermitPool(maxParInt),
+		permitPool: permitpool.New(maxParInt),
 	}
 
 	statements := map[string]string{
@@ -205,7 +206,9 @@ func (m *MSSQLBackend) prepare(name, query string) error {
 func (m *MSSQLBackend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince([]string{"mssql", "put"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer m.permitPool.Release()
 
 	_, err := m.statements["put"].Exec(entry.Key, entry.Value, entry.Key, entry.Key, entry.Value)
@@ -219,7 +222,9 @@ func (m *MSSQLBackend) Put(ctx context.Context, entry *physical.Entry) error {
 func (m *MSSQLBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"mssql", "get"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer m.permitPool.Release()
 
 	var result []byte
@@ -243,7 +248,9 @@ func (m *MSSQLBackend) Get(ctx context.Context, key string) (*physical.Entry, er
 func (m *MSSQLBackend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince([]string{"mssql", "delete"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer m.permitPool.Release()
 
 	_, err := m.statements["delete"].Exec(key)
@@ -257,7 +264,9 @@ func (m *MSSQLBackend) Delete(ctx context.Context, key string) error {
 func (m *MSSQLBackend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{"mssql", "list"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer m.permitPool.Release()
 
 	likePrefix := prefix + "%"
diff --git a/physical/mssql/mssql_test.go b/physical/mssql/mssql_test.go
index 6b794f10bfb..dd488527911 100644
--- a/physical/mssql/mssql_test.go
+++ b/physical/mssql/mssql_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mssql
diff --git a/physical/mysql/mysql.go b/physical/mysql/mysql.go
index 8c4b89e00c7..d178b23ad69 100644
--- a/physical/mysql/mysql.go
+++ b/physical/mysql/mysql.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mysql
@@ -13,6 +13,7 @@ import (
 	"io/ioutil"
 	"math"
 	"net/url"
+	"os"
 	"sort"
 	"strconv"
 	"strings"
@@ -24,6 +25,7 @@ import (
 	mysql "github.com/go-sql-driver/mysql"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/sdk/physical"
 )
@@ -47,7 +49,7 @@ type MySQLBackend struct {
 	client       *sql.DB
 	statements   map[string]*sql.Stmt
 	logger       log.Logger
-	permitPool   *physical.PermitPool
+	permitPool   *permitpool.Pool
 	conf         map[string]string
 	redirectHost string
 	redirectPort int64
@@ -173,7 +175,7 @@ func NewMySQLBackend(conf map[string]string, logger log.Logger) (physical.Backen
 		client:      db,
 		statements:  make(map[string]*sql.Stmt),
 		logger:      logger,
-		permitPool:  physical.NewPermitPool(maxParInt),
+		permitPool:  permitpool.New(maxParInt),
 		conf:        conf,
 		haEnabled:   haEnabled,
 	}
@@ -267,13 +269,22 @@ func NewMySQLClient(conf map[string]string, logger log.Logger) (*sql.DB, error)
 	var err error
 
 	// Get the MySQL credentials to perform read/write operations.
-	username, ok := conf["username"]
-	if !ok || username == "" {
-		return nil, fmt.Errorf("missing username")
+	username := os.Getenv("VAULT_MYSQL_USERNAME")
+	if username == "" {
+		confUsername, ok := conf["username"]
+		if !ok || confUsername == "" {
+			return nil, fmt.Errorf("missing username")
+		}
+		username = confUsername
 	}
-	password, ok := conf["password"]
-	if !ok || password == "" {
-		return nil, fmt.Errorf("missing password")
+
+	password := os.Getenv("VAULT_MYSQL_PASSWORD")
+	if password == "" {
+		confPassword, ok := conf["password"]
+		if !ok || confPassword == "" {
+			return nil, fmt.Errorf("missing password")
+		}
+		password = confPassword
 	}
 
 	// Get or set MySQL server address. Defaults to localhost and default port(3306)
@@ -365,7 +376,9 @@ func (m *MySQLBackend) prepare(name, query string) error {
 func (m *MySQLBackend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince([]string{"mysql", "put"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer m.permitPool.Release()
 
 	_, err := m.statements["put"].Exec(entry.Key, entry.Value)
@@ -379,7 +392,9 @@ func (m *MySQLBackend) Put(ctx context.Context, entry *physical.Entry) error {
 func (m *MySQLBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"mysql", "get"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer m.permitPool.Release()
 
 	var result []byte
@@ -402,7 +417,9 @@ func (m *MySQLBackend) Get(ctx context.Context, key string) (*physical.Entry, er
 func (m *MySQLBackend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince([]string{"mysql", "delete"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer m.permitPool.Release()
 
 	_, err := m.statements["delete"].Exec(key)
@@ -417,7 +434,9 @@ func (m *MySQLBackend) Delete(ctx context.Context, key string) error {
 func (m *MySQLBackend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{"mysql", "list"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer m.permitPool.Release()
 
 	// Add the % wildcard to the prefix to do the prefix search
diff --git a/physical/mysql/mysql_test.go b/physical/mysql/mysql_test.go
index 419966df494..8f00624ad9e 100644
--- a/physical/mysql/mysql_test.go
+++ b/physical/mysql/mysql_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mysql
diff --git a/physical/oci/oci.go b/physical/oci/oci.go
index 3665813d047..60b3dbc5845 100644
--- a/physical/oci/oci.go
+++ b/physical/oci/oci.go
@@ -5,7 +5,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"sort"
 	"strconv"
@@ -14,6 +14,7 @@ import (
 
 	"github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/sdk/physical"
@@ -64,7 +65,7 @@ type Backend struct {
 	client         *objectstorage.ObjectStorageClient
 	bucketName     string
 	logger         log.Logger
-	permitPool     *physical.PermitPool
+	permitPool     *permitpool.Pool
 	namespaceName  string
 	haEnabled      bool
 	lockBucketName string
@@ -141,7 +142,7 @@ func NewBackend(conf map[string]string, logger log.Logger) (physical.Backend, er
 		client:         &objectStorageClient,
 		bucketName:     bucketName,
 		logger:         logger,
-		permitPool:     physical.NewPermitPool(MaxNumberOfPermits),
+		permitPool:     permitpool.New(MaxNumberOfPermits),
 		namespaceName:  namespaceName,
 		haEnabled:      haEnabled,
 		lockBucketName: lockBucketName,
@@ -153,7 +154,9 @@ func (o *Backend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince(metricPutFull, time.Now())
 	startAcquirePool := time.Now()
 	metrics.SetGauge(metricPermitsUsed, float32(o.permitPool.CurrentPermits()))
-	o.permitPool.Acquire()
+	if err := o.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer o.permitPool.Release()
 	metrics.MeasureSince(metricPutAcquirePool, startAcquirePool)
 
@@ -172,7 +175,7 @@ func (o *Backend) Put(ctx context.Context, entry *physical.Entry) error {
 		BucketName:         &o.bucketName,
 		ObjectName:         &entry.Key,
 		ContentLength:      &size,
-		PutObjectBody:      ioutil.NopCloser(bytes.NewReader(entry.Value)),
+		PutObjectBody:      io.NopCloser(bytes.NewReader(entry.Value)),
 		OpcMeta:            nil,
 		OpcClientRequestId: &opcClientRequestId,
 	}
@@ -198,7 +201,9 @@ func (o *Backend) Get(ctx context.Context, key string) (*physical.Entry, error)
 	defer metrics.MeasureSince(metricGetFull, time.Now())
 	metrics.SetGauge(metricPermitsUsed, float32(o.permitPool.CurrentPermits()))
 	startAcquirePool := time.Now()
-	o.permitPool.Acquire()
+	if err := o.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer o.permitPool.Release()
 	metrics.MeasureSince(metricGetAcquirePool, startAcquirePool)
 
@@ -230,7 +235,7 @@ func (o *Backend) Get(ctx context.Context, key string) (*physical.Entry, error)
 		return nil, fmt.Errorf("failed to read Value: %w", err)
 	}
 
-	body, err := ioutil.ReadAll(resp.Content)
+	body, err := io.ReadAll(resp.Content)
 	if err != nil {
 		metrics.IncrCounter(metricGetFailed, 1)
 		return nil, fmt.Errorf("failed to decode Value into bytes: %w", err)
@@ -249,7 +254,9 @@ func (o *Backend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince(metricDeleteFull, time.Now())
 	metrics.SetGauge(metricPermitsUsed, float32(o.permitPool.CurrentPermits()))
 	startAcquirePool := time.Now()
-	o.permitPool.Acquire()
+	if err := o.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer o.permitPool.Release()
 	metrics.MeasureSince(metricDeleteAcquirePool, startAcquirePool)
 
@@ -291,7 +298,9 @@ func (o *Backend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince(metricListFull, time.Now())
 	metrics.SetGauge(metricPermitsUsed, float32(o.permitPool.CurrentPermits()))
 	startAcquirePool := time.Now()
-	o.permitPool.Acquire()
+	if err := o.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer o.permitPool.Release()
 
 	metrics.MeasureSince(metricListAcquirePool, startAcquirePool)
diff --git a/physical/oci/oci_ha.go b/physical/oci/oci_ha.go
index a4c6ad52ea6..cc0e0edc62a 100644
--- a/physical/oci/oci_ha.go
+++ b/physical/oci/oci_ha.go
@@ -7,7 +7,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"sync"
 	"sync/atomic"
@@ -398,7 +398,7 @@ func (l *Lock) get(ctx context.Context) (*LockRecord, string, error) {
 
 	defer response.RawResponse.Body.Close()
 
-	body, err := ioutil.ReadAll(response.Content)
+	body, err := io.ReadAll(response.Content)
 	if err != nil {
 		metrics.IncrCounter(metricGetFailed, 1)
 		l.backend.logger.Error("Error reading content", "err", err)
@@ -487,7 +487,7 @@ func (l *Lock) writeLock() (bool, error) {
 		BucketName:         &l.backend.lockBucketName,
 		ObjectName:         &l.key,
 		ContentLength:      &size,
-		PutObjectBody:      ioutil.NopCloser(bytes.NewReader(newLockRecordJson)),
+		PutObjectBody:      io.NopCloser(bytes.NewReader(newLockRecordJson)),
 		OpcMeta:            nil,
 		OpcClientRequestId: &opcClientRequestId,
 	}
diff --git a/physical/postgresql/postgresql.go b/physical/postgresql/postgresql.go
index 911dfa18f3e..64d45c10d38 100644
--- a/physical/postgresql/postgresql.go
+++ b/physical/postgresql/postgresql.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package postgresql
@@ -15,10 +15,11 @@ import (
 
 	"github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-pgmultiauth"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/sdk/database/helper/dbutil"
 	"github.com/hashicorp/vault/sdk/physical"
-	_ "github.com/jackc/pgx/v4/stdlib"
 )
 
 const (
@@ -64,7 +65,7 @@ type PostgreSQLBackend struct {
 
 	haEnabled  bool
 	logger     log.Logger
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 }
 
 // PostgreSQLLock implements a lock using an PostgreSQL client.
@@ -128,8 +129,14 @@ func NewPostgreSQLBackend(conf map[string]string, logger log.Logger) (physical.B
 		}
 	}
 
+	ctx := context.Background()
+	config, err := getAuthConfig(ctx, connURL, conf, logger)
+	if err != nil {
+		return nil, fmt.Errorf("creating db auth config: %w", err)
+	}
+
 	// Create PostgreSQL handle for the database.
-	db, err := sql.Open("pgx", connURL)
+	db, err := pgmultiauth.Open(ctx, config)
 	if err != nil {
 		return nil, fmt.Errorf("failed to connect to postgres: %w", err)
 	}
@@ -192,7 +199,7 @@ func NewPostgreSQLBackend(conf map[string]string, logger log.Logger) (physical.B
 		// $1=ha_identity $2=ha_key
 		" DELETE FROM " + quoted_ha_table + " WHERE ha_identity=$1 AND ha_key=$2 ",
 		logger:     logger,
-		permitPool: physical.NewPermitPool(maxParInt),
+		permitPool: permitpool.New(maxParInt),
 		haEnabled:  conf["ha_enabled"] == "true",
 	}
 
@@ -212,6 +219,36 @@ func connectionURL(conf map[string]string) string {
 	return connURL
 }
 
+func getAuthConfig(ctx context.Context, url string, conf map[string]string, log log.Logger) (pgmultiauth.Config, error) {
+	authOptions := pgmultiauth.DefaultAuthConfigOptions{
+		AuthMethod: pgmultiauth.StandardAuth,
+	}
+
+	switch conf["auth_mode"] {
+	case "aws_iam":
+		if conf["aws_db_region"] == "" {
+			return pgmultiauth.Config{}, fmt.Errorf("aws_db_region is required when auth_mode is aws_iam")
+		}
+
+		authOptions.AuthMethod = pgmultiauth.AWSAuth
+		authOptions.AWSDBRegion = conf["aws_db_region"]
+	case "azure_msi":
+		authOptions.AuthMethod = pgmultiauth.AzureAuth
+		authOptions.AzureClientID = conf["azure_client_id"]
+	case "gcp_iam":
+		authOptions.AuthMethod = pgmultiauth.GCPAuth
+	default:
+		// Using standard authentication method (default)
+	}
+
+	config, err := pgmultiauth.DefaultConfig(ctx, url, authOptions, pgmultiauth.WithLogger(log))
+	if err != nil {
+		return pgmultiauth.Config{}, fmt.Errorf("creating multi auth config: %w", err)
+	}
+
+	return config, nil
+}
+
 // splitKey is a helper to split a full path key into individual
 // parts: parentPath, path, key
 func (m *PostgreSQLBackend) splitKey(fullPath string) (string, string, string) {
@@ -240,7 +277,9 @@ func (m *PostgreSQLBackend) splitKey(fullPath string) (string, string, string) {
 func (m *PostgreSQLBackend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince([]string{"postgres", "put"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer m.permitPool.Release()
 
 	parentPath, path, key := m.splitKey(entry.Key)
@@ -256,7 +295,9 @@ func (m *PostgreSQLBackend) Put(ctx context.Context, entry *physical.Entry) erro
 func (m *PostgreSQLBackend) Get(ctx context.Context, fullPath string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"postgres", "get"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer m.permitPool.Release()
 
 	_, path, key := m.splitKey(fullPath)
@@ -281,7 +322,9 @@ func (m *PostgreSQLBackend) Get(ctx context.Context, fullPath string) (*physical
 func (m *PostgreSQLBackend) Delete(ctx context.Context, fullPath string) error {
 	defer metrics.MeasureSince([]string{"postgres", "delete"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer m.permitPool.Release()
 
 	_, path, key := m.splitKey(fullPath)
@@ -298,7 +341,9 @@ func (m *PostgreSQLBackend) Delete(ctx context.Context, fullPath string) error {
 func (m *PostgreSQLBackend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{"postgres", "list"}, time.Now())
 
-	m.permitPool.Acquire()
+	if err := m.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer m.permitPool.Release()
 
 	rows, err := m.client.QueryContext(ctx, m.list_query, "/"+prefix)
@@ -377,7 +422,9 @@ func (l *PostgreSQLLock) Lock(stopCh <-chan struct{}) (<-chan struct{}, error) {
 // PostgreSQL table.
 func (l *PostgreSQLLock) Unlock() error {
 	pg := l.backend
-	pg.permitPool.Acquire()
+	if err := pg.permitPool.Acquire(context.Background()); err != nil {
+		return err
+	}
 	defer pg.permitPool.Release()
 
 	if l.renewTicker != nil {
@@ -393,7 +440,9 @@ func (l *PostgreSQLLock) Unlock() error {
 // including this one, and returns the current value.
 func (l *PostgreSQLLock) Value() (bool, string, error) {
 	pg := l.backend
-	pg.permitPool.Acquire()
+	if err := pg.permitPool.Acquire(context.Background()); err != nil {
+		return false, "", err
+	}
 	defer pg.permitPool.Release()
 	var result string
 	err := pg.client.QueryRow(pg.haGetLockValueQuery, l.key).Scan(&result)
@@ -453,7 +502,9 @@ func (l *PostgreSQLLock) periodicallyRenewLock(done chan struct{}) {
 // else has the lock, whereas non-nil means that something unexpected happened.
 func (l *PostgreSQLLock) writeItem() (bool, error) {
 	pg := l.backend
-	pg.permitPool.Acquire()
+	if err := pg.permitPool.Acquire(context.Background()); err != nil {
+		return false, err
+	}
 	defer pg.permitPool.Release()
 
 	// Try steal lock or update expiry on my lock
diff --git a/physical/postgresql/postgresql_test.go b/physical/postgresql/postgresql_test.go
index 70d39ebedbe..7c2f45525ca 100644
--- a/physical/postgresql/postgresql_test.go
+++ b/physical/postgresql/postgresql_test.go
@@ -1,15 +1,17 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package postgresql
 
 import (
+	"context"
 	"fmt"
 	"os"
 	"testing"
 	"time"
 
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-pgmultiauth"
 	"github.com/hashicorp/vault/helper/testhelpers/postgresql"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/physical"
@@ -22,7 +24,7 @@ func TestPostgreSQLBackend(t *testing.T) {
 	// Use docker as pg backend if no url is provided via environment variables
 	connURL := os.Getenv("PGURL")
 	if connURL == "" {
-		cleanup, u := postgresql.PrepareTestContainer(t, "11.1")
+		cleanup, u := postgresql.PrepareTestContainer(t)
 		defer cleanup()
 		connURL = u
 	}
@@ -159,7 +161,7 @@ func TestConnectionURL(t *testing.T) {
 	for name, tt := range cases {
 		t.Run(name, func(t *testing.T) {
 			// This is necessary to avoid always testing the branch where the env is set.
-			// As long the the env is set --- even if the value is "" --- `ok` returns true.
+			// As long the env is set --- even if the value is "" --- `ok` returns true.
 			if tt.input.envar != "" {
 				os.Setenv("VAULT_PG_CONNECTION_URL", tt.input.envar)
 				defer os.Unsetenv("VAULT_PG_CONNECTION_URL")
@@ -174,6 +176,47 @@ func TestConnectionURL(t *testing.T) {
 	}
 }
 
+// TestGetAuthConfig - We only test the standard flow as we would get errors for cloud based auth while fetching token
+func TestGetAuthConfig(t *testing.T) {
+	cases := map[string]struct {
+		url       string
+		conf      map[string]string
+		expectErr bool
+	}{
+		"no_auth_config": {
+			url:  "postgresql://user:password@localhost:5432/dbname",
+			conf: map[string]string{},
+		},
+		"aws with no region": {
+			url: "postgresql://user:password@localhost:5432/dbname",
+			conf: map[string]string{
+				"auth_mode": "aws_iam",
+			},
+			expectErr: true,
+		},
+	}
+
+	for name, tt := range cases {
+		t.Run(name, func(t *testing.T) {
+			cfg, err := getAuthConfig(context.Background(), tt.url, tt.conf, log.Default())
+			if err != nil {
+				if !tt.expectErr {
+					t.Fatalf("Expected no error, got: %v", err)
+				}
+				return
+			}
+
+			db, err := pgmultiauth.Open(context.TODO(), cfg)
+			if err != nil {
+				t.Fatalf("Failed to open db: %v", err)
+				return
+			}
+
+			defer db.Close()
+		})
+	}
+}
+
 // Similar to testHABackend, but using internal implementation details to
 // trigger the lock failure scenario by setting the lock renew period for one
 // of the locks to a higher value than the lock TTL.
diff --git a/physical/raft/bolt_32bit_test.go b/physical/raft/bolt_32bit_test.go
index 4e6aaccacd3..9be40382a34 100644
--- a/physical/raft/bolt_32bit_test.go
+++ b/physical/raft/bolt_32bit_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build 386 || arm
diff --git a/physical/raft/bolt_64bit_test.go b/physical/raft/bolt_64bit_test.go
index f6f1bbd2dee..63d963b0e87 100644
--- a/physical/raft/bolt_64bit_test.go
+++ b/physical/raft/bolt_64bit_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !386 && !arm
@@ -43,3 +43,29 @@ func Test_BoltOptions(t *testing.T) {
 		})
 	}
 }
+
+// TestMmapFlags tests the getMmapFlags function, ensuring it returns the appropriate integer representing the desired mmap flag.
+func TestMmapFlags(t *testing.T) {
+	testCases := []struct {
+		name               string
+		disableMapPopulate bool
+	}{
+		{"MAP_POPULATE is enabled", false},
+		{"MAP_POPULATE disabled by env var", true},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.disableMapPopulate {
+				t.Setenv("VAULT_RAFT_DISABLE_MAP_POPULATE", "true")
+			}
+
+			isEnabled := usingMapPopulate(getMmapFlags(""))
+			if tc.disableMapPopulate && isEnabled {
+				t.Error("expected MAP_POPULATE to be disabled but it was enabled")
+			}
+		})
+	}
+}
diff --git a/physical/raft/bolt_linux.go b/physical/raft/bolt_linux.go
index 811c148a105..d978bec9222 100644
--- a/physical/raft/bolt_linux.go
+++ b/physical/raft/bolt_linux.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
@@ -13,27 +13,49 @@ import (
 
 func init() {
 	getMmapFlags = getMmapFlagsLinux
+	usingMapPopulate = usingMapPopulateLinux
 }
 
 func getMmapFlagsLinux(dbPath string) int {
+	if setMapPopulateFlag(dbPath) {
+		return unix.MAP_POPULATE
+	}
+
+	return 0
+}
+
+// setMapPopulateFlag determines whether we should set the MAP_POPULATE flag, which
+// prepopulates page tables to be mapped in the virtual memory space,
+// helping reduce slowness at runtime caused by page faults.
+// We only want to set this flag if we've determined there's enough memory on the system available to do so.
+func setMapPopulateFlag(dbPath string) bool {
 	if os.Getenv("VAULT_RAFT_DISABLE_MAP_POPULATE") != "" {
-		return 0
+		return false
 	}
 	stat, err := os.Stat(dbPath)
 	if err != nil {
-		return 0
+		return false
 	}
 	size := stat.Size()
 
 	v, err := mem.VirtualMemoryWithContext(context.Background())
 	if err != nil {
-		return 0
+		return false
 	}
 
 	// We won't worry about swap, since we already tell people not to use it.
 	if v.Total > uint64(size) {
-		return unix.MAP_POPULATE
+		return true
 	}
 
-	return 0
+	return false
+}
+
+// the unix.MAP_POPULATE constant only exists on Linux,
+// so reference to this constant can only live in a *_linux.go file
+func usingMapPopulateLinux(mmapFlag int) bool {
+	if mmapFlag == unix.MAP_POPULATE {
+		return true
+	}
+	return false
 }
diff --git a/physical/raft/chunking_test.go b/physical/raft/chunking_test.go
index 0309cdacdfc..cb90f8401fe 100644
--- a/physical/raft/chunking_test.go
+++ b/physical/raft/chunking_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
@@ -34,7 +34,7 @@ func TestRaft_Chunking_Lifecycle(t *testing.T) {
 
 	t.Log("applying configuration")
 
-	b.applyConfigSettings(raft.DefaultConfig())
+	ApplyConfigSettings(b.logger, b.conf, raft.DefaultConfig())
 
 	t.Log("chunking")
 
@@ -119,7 +119,7 @@ func TestFSM_Chunking_TermChange(t *testing.T) {
 
 	t.Log("applying configuration")
 
-	b.applyConfigSettings(raft.DefaultConfig())
+	ApplyConfigSettings(b.logger, b.conf, raft.DefaultConfig())
 
 	t.Log("chunking")
 
diff --git a/physical/raft/config.go b/physical/raft/config.go
new file mode 100644
index 00000000000..aed6b1f4f69
--- /dev/null
+++ b/physical/raft/config.go
@@ -0,0 +1,283 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package raft
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"time"
+
+	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	"github.com/hashicorp/go-uuid"
+	goversion "github.com/hashicorp/go-version"
+	autopilot "github.com/hashicorp/raft-autopilot"
+	bolt "go.etcd.io/bbolt"
+)
+
+type RaftBackendConfig struct {
+	Path                        string
+	NodeId                      string
+	ApplyDelay                  time.Duration
+	RaftWal                     bool
+	RaftLogVerifierEnabled      bool
+	RaftLogVerificationInterval time.Duration
+	SnapshotDelay               time.Duration
+	MaxEntrySize                uint64
+	MaxBatchEntries             int
+	MaxBatchSize                int
+	AutopilotReconcileInterval  time.Duration
+	AutopilotUpdateInterval     time.Duration
+	RetryJoin                   string
+
+	// Enterprise only
+	RaftNonVoter                       bool
+	MaxMountAndNamespaceTableEntrySize uint64
+	AutopilotUpgradeVersion            string
+	AutopilotRedundancyZone            string
+}
+
+func parseRaftBackendConfig(conf map[string]string, logger log.Logger) (*RaftBackendConfig, error) {
+	c := &RaftBackendConfig{}
+
+	c.Path = conf["path"]
+	envPath := os.Getenv(EnvVaultRaftPath)
+	if envPath != "" {
+		c.Path = envPath
+	}
+
+	if c.Path == "" {
+		return nil, fmt.Errorf("'path' must be set")
+	}
+
+	c.NodeId = conf["node_id"]
+	envNodeId := os.Getenv(EnvVaultRaftNodeID)
+	if envNodeId != "" {
+		c.NodeId = envNodeId
+	}
+
+	if c.NodeId == "" {
+		localIDRaw, err := os.ReadFile(filepath.Join(c.Path, "node-id"))
+		if err == nil && len(localIDRaw) > 0 {
+			c.NodeId = string(localIDRaw)
+		}
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			return nil, err
+		}
+	}
+
+	if c.NodeId == "" {
+		id, err := uuid.GenerateUUID()
+		if err != nil {
+			return nil, err
+		}
+
+		if err = os.WriteFile(filepath.Join(c.Path, "node-id"), []byte(id), 0o600); err != nil {
+			return nil, err
+		}
+
+		c.NodeId = id
+	}
+
+	if delayRaw, ok := conf["apply_delay"]; ok {
+		delay, err := parseutil.ParseDurationSecond(delayRaw)
+		if err != nil {
+			return nil, fmt.Errorf("apply_delay does not parse as a duration: %w", err)
+		}
+
+		c.ApplyDelay = delay
+	}
+
+	if walRaw, ok := conf["raft_wal"]; ok {
+		useRaftWal, err := strconv.ParseBool(walRaw)
+		if err != nil {
+			return nil, fmt.Errorf("raft_wal does not parse as a boolean: %w", err)
+		}
+
+		c.RaftWal = useRaftWal
+	}
+
+	if rlveRaw, ok := conf["raft_log_verifier_enabled"]; ok {
+		rlve, err := strconv.ParseBool(rlveRaw)
+		if err != nil {
+			return nil, fmt.Errorf("raft_log_verifier_enabled does not parse as a boolean: %w", err)
+		}
+		c.RaftLogVerifierEnabled = rlve
+
+		c.RaftLogVerificationInterval = defaultRaftLogVerificationInterval
+		if rlviRaw, ok := conf["raft_log_verification_interval"]; ok {
+			rlvi, err := parseutil.ParseDurationSecond(rlviRaw)
+			if err != nil {
+				return nil, fmt.Errorf("raft_log_verification_interval does not parse as a duration: %w", err)
+			}
+
+			// Make sure our interval is capped to a reasonable value, so e.g. people don't use 0s or 1s
+			if rlvi >= minimumRaftLogVerificationInterval {
+				c.RaftLogVerificationInterval = rlvi
+			} else {
+				logger.Warn("raft_log_verification_interval is less than the minimum allowed, using default instead",
+					"given", rlveRaw,
+					"minimum", minimumRaftLogVerificationInterval,
+					"default", defaultRaftLogVerificationInterval)
+			}
+		}
+	}
+
+	if delayRaw, ok := conf["snapshot_delay"]; ok {
+		delay, err := parseutil.ParseDurationSecond(delayRaw)
+		if err != nil {
+			return nil, fmt.Errorf("snapshot_delay does not parse as a duration: %w", err)
+		}
+		c.SnapshotDelay = delay
+	}
+
+	c.MaxEntrySize = defaultMaxEntrySize
+	if maxEntrySizeCfg := conf["max_entry_size"]; len(maxEntrySizeCfg) != 0 {
+		i, err := strconv.Atoi(maxEntrySizeCfg)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse 'max_entry_size': %w", err)
+		}
+
+		c.MaxEntrySize = uint64(i)
+	}
+
+	c.MaxMountAndNamespaceTableEntrySize = c.MaxEntrySize
+	if maxMNTEntrySize := conf["max_mount_and_namespace_table_entry_size"]; len(maxMNTEntrySize) != 0 {
+		i, err := strconv.Atoi(maxMNTEntrySize)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse 'max_mount_and_namespace_table_entry_size': %w", err)
+		}
+		if i < 1024 {
+			return nil, fmt.Errorf("'max_mount_and_namespace_table_entry_size' must be at least 1024 bytes")
+		}
+		if i > 10_485_760 {
+			return nil, fmt.Errorf("'max_mount_and_namespace_table_entry_size' must be at most 10,485,760 bytes (10MiB)")
+		}
+
+		c.MaxMountAndNamespaceTableEntrySize = uint64(i)
+		emitEntWarning(logger, "max_mount_and_namespace_table_entry_size")
+	}
+
+	c.MaxBatchEntries, c.MaxBatchSize = batchLimitsFromEnv(logger)
+
+	if interval := conf["autopilot_reconcile_interval"]; interval != "" {
+		interval, err := parseutil.ParseDurationSecond(interval)
+		if err != nil {
+			return nil, fmt.Errorf("autopilot_reconcile_interval does not parse as a duration: %w", err)
+		}
+		c.AutopilotReconcileInterval = interval
+	}
+
+	if interval := conf["autopilot_update_interval"]; interval != "" {
+		interval, err := parseutil.ParseDurationSecond(interval)
+		if err != nil {
+			return nil, fmt.Errorf("autopilot_update_interval does not parse as a duration: %w", err)
+		}
+		c.AutopilotUpdateInterval = interval
+	}
+
+	effectiveReconcileInterval := autopilot.DefaultReconcileInterval
+	effectiveUpdateInterval := autopilot.DefaultUpdateInterval
+
+	if c.AutopilotReconcileInterval != 0 {
+		effectiveReconcileInterval = c.AutopilotReconcileInterval
+	}
+	if c.AutopilotUpdateInterval != 0 {
+		effectiveUpdateInterval = c.AutopilotUpdateInterval
+	}
+
+	if effectiveReconcileInterval < effectiveUpdateInterval {
+		return nil, fmt.Errorf("autopilot_reconcile_interval (%v) should be larger than autopilot_update_interval (%v)", effectiveReconcileInterval, effectiveUpdateInterval)
+	}
+
+	if uv, ok := conf["autopilot_upgrade_version"]; ok && uv != "" {
+		_, err := goversion.NewVersion(uv)
+		if err != nil {
+			return nil, fmt.Errorf("autopilot_upgrade_version does not parse as a semantic version: %w", err)
+		}
+
+		c.AutopilotUpgradeVersion = uv
+	}
+	if c.AutopilotUpgradeVersion != "" {
+		emitEntWarning(logger, "autopilot_upgrade_version")
+	}
+
+	// Note: historically we've never parsed retry_join here because we have to
+	// wait until we have leader TLS info before we can work out the final retry
+	// join parameters. That happens in JoinConfig. So right now nothing uses
+	// c.RetryJoin because it's not available at that point. But I think it's less
+	// surprising that if the field is present in the returned struct, that it
+	// should actually be populated and makes tests of this function less confusing
+	// too.
+	c.RetryJoin = conf["retry_join"]
+
+	c.RaftNonVoter = false
+	if v := os.Getenv(EnvVaultRaftNonVoter); v != "" {
+		// Consistent with handling of other raft boolean env vars
+		// VAULT_RAFT_AUTOPILOT_DISABLE and VAULT_RAFT_FREELIST_SYNC
+		c.RaftNonVoter = true
+	} else if v, ok := conf[raftNonVoterConfigKey]; ok {
+		nonVoter, err := strconv.ParseBool(v)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse %s config value %q as a boolean: %w", raftNonVoterConfigKey, v, err)
+		}
+
+		c.RaftNonVoter = nonVoter
+	}
+
+	if c.RaftNonVoter && c.RetryJoin == "" {
+		return nil, fmt.Errorf("setting %s to true is only valid if at least one retry_join stanza is specified", raftNonVoterConfigKey)
+	}
+	if c.RaftNonVoter {
+		emitEntWarning(logger, raftNonVoterConfigKey)
+	}
+
+	c.AutopilotRedundancyZone = conf["autopilot_redundancy_zone"]
+	if c.AutopilotRedundancyZone != "" {
+		emitEntWarning(logger, "autopilot_redundancy_zone")
+	}
+
+	return c, nil
+}
+
+// boltOptions returns a bolt.Options struct, suitable for passing to
+// bolt.Open(), pre-configured with all of our preferred defaults.
+func boltOptions(path string) *bolt.Options {
+	o := &bolt.Options{
+		Timeout:        1 * time.Second,
+		FreelistType:   bolt.FreelistMapType,
+		NoFreelistSync: true,
+		MmapFlags:      getMmapFlags(path),
+	}
+
+	if os.Getenv("VAULT_RAFT_FREELIST_TYPE") == "array" {
+		o.FreelistType = bolt.FreelistArrayType
+	}
+
+	if os.Getenv("VAULT_RAFT_FREELIST_SYNC") != "" {
+		o.NoFreelistSync = false
+	}
+
+	// By default, we want to set InitialMmapSize to 100GB, but only on 64bit platforms.
+	// Otherwise, we set it to whatever the value of VAULT_RAFT_INITIAL_MMAP_SIZE
+	// is, assuming it can be parsed as an int. Bolt itself sets this to 0 by default,
+	// so if users are wanting to turn this off, they can also set it to 0. Setting it
+	// to a negative value is the same as not setting it at all.
+	if os.Getenv("VAULT_RAFT_INITIAL_MMAP_SIZE") == "" {
+		o.InitialMmapSize = initialMmapSize
+	} else {
+		imms, err := strconv.Atoi(os.Getenv("VAULT_RAFT_INITIAL_MMAP_SIZE"))
+
+		// If there's an error here, it means they passed something that's not convertible to
+		// a number. Rather than fail startup, just ignore it.
+		if err == nil && imms > 0 {
+			o.InitialMmapSize = imms
+		}
+	}
+
+	return o
+}
diff --git a/physical/raft/config_test.go b/physical/raft/config_test.go
new file mode 100644
index 00000000000..ec586a059b5
--- /dev/null
+++ b/physical/raft/config_test.go
@@ -0,0 +1,430 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package raft
+
+import (
+	"bytes"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/helper/constants"
+	"github.com/stretchr/testify/require"
+)
+
+func ceOnlyWarnings(warns ...string) []string {
+	if !constants.IsEnterprise {
+		return warns
+	}
+	return nil
+}
+
+func TestRaft_ParseConfig(t *testing.T) {
+	// Note some of these can be parallel tests but since we need to setEnv in
+	// some we can't make them all parallel so it's don inside the loop. We assume
+	// if a case doesn't set anything on the Env it's safe to run in parallel.
+	tcs := []struct {
+		name         string
+		conf         map[string]string
+		env          map[string]string
+		wantMutation func(cfg *RaftBackendConfig)
+		wantErr      string
+		wantWarns    []string
+	}{
+		// RAFT WAL --------------------------------------------------------------
+		{
+			name: "WAL backend junk",
+			conf: map[string]string{
+				"raft_wal": "notabooleanlol",
+			},
+			wantErr: "does not parse as a boolean",
+		},
+		{
+			name: "WAL verifier junk",
+			conf: map[string]string{
+				"raft_wal":                  "true",
+				"raft_log_verifier_enabled": "notabooleanlol",
+			},
+			wantErr: "does not parse as a boolean",
+		},
+		{
+			name: "WAL verifier interval, zero",
+			conf: map[string]string{
+				"raft_log_verifier_enabled":      "true",
+				"raft_log_verification_interval": "0s",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RaftLogVerifierEnabled = true
+				cfg.RaftLogVerificationInterval = defaultRaftLogVerificationInterval
+			},
+			wantWarns: []string{"raft_log_verification_interval is less than the minimum allowed"},
+		},
+		{
+			name: "WAL verifier interval, one",
+			conf: map[string]string{
+				"raft_log_verifier_enabled":      "true",
+				"raft_log_verification_interval": "0s",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RaftLogVerifierEnabled = true
+
+				// Below min so should get default
+				cfg.RaftLogVerificationInterval = defaultRaftLogVerificationInterval
+			},
+			wantWarns: []string{"raft_log_verification_interval is less than the minimum allowed"},
+		},
+		{
+			name: "WAL verifier interval, nothing",
+			conf: map[string]string{
+				"raft_log_verifier_enabled":      "true",
+				"raft_log_verification_interval": "",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RaftLogVerifierEnabled = true
+				cfg.RaftLogVerificationInterval = defaultRaftLogVerificationInterval
+			},
+			wantWarns: []string{"raft_log_verification_interval is less than the minimum allowed"},
+		},
+		{
+			name: "WAL verifier interval, valid",
+			conf: map[string]string{
+				"raft_log_verifier_enabled":      "true",
+				"raft_log_verification_interval": "75s",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RaftLogVerifierEnabled = true
+				cfg.RaftLogVerificationInterval = 75 * time.Second
+			},
+		},
+		{
+			name: "WAL verifier interval, junk",
+			conf: map[string]string{
+				"raft_log_verifier_enabled":      "true",
+				"raft_log_verification_interval": "notaduration",
+			},
+			wantErr: "does not parse as a duration",
+		},
+
+		// AUTOPILOT Upgrades ----------------------------------------------------
+		{
+			name: "Autopilot upgrade version, junk",
+			conf: map[string]string{
+				"autopilot_upgrade_version": "hahano",
+			},
+			wantErr: "does not parse",
+		},
+
+		// AUTOPILOT Redundancy Zone ---------------------------------------------
+		{
+			name: "Autopilot redundancy zone, ok",
+			conf: map[string]string{
+				"autopilot_redundancy_zone": "us-east-1a",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.AutopilotRedundancyZone = "us-east-1a"
+			},
+			wantWarns: ceOnlyWarnings("configuration for a Vault Enterprise feature has been ignored: field=autopilot_redundancy_zone"),
+		},
+
+		// Non-voter config ------------------------------------------------------
+		{
+			name: "non-voter, no retry-join, valid false",
+			conf: map[string]string{
+				raftNonVoterConfigKey: "false",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				// Should be default
+			},
+		},
+		{
+			name: "non-voter, retry-join, valid false",
+			conf: map[string]string{
+				"retry_join":          "not-empty",
+				raftNonVoterConfigKey: "false",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RetryJoin = "not-empty"
+			},
+		},
+		{
+			name: "non-voter, no retry-join, valid true",
+			conf: map[string]string{
+				raftNonVoterConfigKey: "true",
+			},
+			wantErr: "only valid if at least one retry_join stanza is specified",
+		},
+		{
+			name: "non-voter, retry-join, valid true",
+			conf: map[string]string{
+				"retry_join":          "not-empty",
+				raftNonVoterConfigKey: "true",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RetryJoin = "not-empty"
+				cfg.RaftNonVoter = true
+			},
+			wantWarns: ceOnlyWarnings("configuration for a Vault Enterprise feature has been ignored: field=retry_join_as_non_voter"),
+		},
+		{
+			name: "non-voter, no retry-join, invalid empty",
+			conf: map[string]string{
+				raftNonVoterConfigKey: "",
+			},
+			wantErr: "failed to parse retry_join_as_non_voter",
+		},
+		{
+			name: "non-voter, retry-join, invalid empty",
+			conf: map[string]string{
+				"retry_join":          "not-empty",
+				raftNonVoterConfigKey: "",
+			},
+			wantErr: "failed to parse retry_join_as_non_voter",
+		},
+		{
+			name: "non-voter, no retry-join, invalid truthy",
+			conf: map[string]string{
+				raftNonVoterConfigKey: "no",
+			},
+			wantErr: "failed to parse retry_join_as_non_voter",
+		},
+		{
+			name: "non-voter, retry-join, invalid truthy",
+			conf: map[string]string{
+				"retry_join":          "not-empty",
+				raftNonVoterConfigKey: "no",
+			},
+			wantErr: "failed to parse retry_join_as_non_voter",
+		},
+		{
+			name: "non-voter, no retry-join, invalid",
+			conf: map[string]string{
+				raftNonVoterConfigKey: "totallywrong",
+			},
+			wantErr: "failed to parse retry_join_as_non_voter",
+		},
+		{
+			name: "non-voter, retry-join, invalid",
+			conf: map[string]string{
+				"retry_join":          "not-empty",
+				raftNonVoterConfigKey: "totallywrong",
+			},
+			wantErr: "failed to parse retry_join_as_non_voter",
+		},
+		{
+			// Note for historical reasons we treat any non-empty value as true in ENV
+			// vars.
+			name: "non-voter, no retry-join, valid env false",
+			env: map[string]string{
+				EnvVaultRaftNonVoter: "false",
+			},
+			wantErr: "only valid if at least one retry_join stanza is specified",
+		},
+		{
+			name: "non-voter, retry-join, valid env false",
+			env: map[string]string{
+				EnvVaultRaftNonVoter: "false",
+			},
+			conf: map[string]string{
+				"retry_join": "not-empty",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RetryJoin = "not-empty"
+				cfg.RaftNonVoter = true // Any non-empty value is true
+			},
+			wantWarns: ceOnlyWarnings("configuration for a Vault Enterprise feature has been ignored: field=retry_join_as_non_voter"),
+		},
+		{
+			name: "non-voter, no retry-join, valid env true",
+			env: map[string]string{
+				EnvVaultRaftNonVoter: "true",
+			},
+			wantErr: "only valid if at least one retry_join stanza is specified",
+		},
+		{
+			name: "non-voter, retry-join, valid env true",
+			env: map[string]string{
+				EnvVaultRaftNonVoter: "true",
+			},
+			conf: map[string]string{
+				"retry_join": "not-empty",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RetryJoin = "not-empty"
+				cfg.RaftNonVoter = true
+			},
+			wantWarns: ceOnlyWarnings("configuration for a Vault Enterprise feature has been ignored: field=retry_join_as_non_voter"),
+		},
+		{
+			name: "non-voter, no retry-join, valid env not-boolean",
+			env: map[string]string{
+				EnvVaultRaftNonVoter: "anything",
+			},
+			wantErr: "only valid if at least one retry_join stanza is specified",
+		},
+		{
+			name: "non-voter, retry-join, valid env not-boolean",
+			env: map[string]string{
+				EnvVaultRaftNonVoter: "anything",
+			},
+			conf: map[string]string{
+				"retry_join": "not-empty",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RetryJoin = "not-empty"
+				cfg.RaftNonVoter = true
+			},
+			wantWarns: ceOnlyWarnings("configuration for a Vault Enterprise feature has been ignored: field=retry_join_as_non_voter"),
+		},
+		{
+			name: "non-voter, no retry-join, valid env empty",
+			env: map[string]string{
+				EnvVaultRaftNonVoter: "",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				// Default
+			},
+		},
+		{
+			name: "non-voter, retry-join, valid env empty",
+			env: map[string]string{
+				EnvVaultRaftNonVoter: "",
+			},
+			conf: map[string]string{
+				"retry_join": "not-empty",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RetryJoin = "not-empty"
+			},
+		},
+		{
+			name: "non-voter, no retry-join, both set env preferred",
+			env: map[string]string{
+				EnvVaultRaftNonVoter: "true",
+			},
+			conf: map[string]string{
+				raftNonVoterConfigKey: "false",
+			},
+			wantErr: "only valid if at least one retry_join stanza is specified",
+		},
+		{
+			name: "non-voter, retry-join, both set env preferred",
+			env: map[string]string{
+				EnvVaultRaftNonVoter: "true",
+			},
+			conf: map[string]string{
+				"retry_join":          "not-empty",
+				raftNonVoterConfigKey: "false",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.RetryJoin = "not-empty"
+				cfg.RaftNonVoter = true // Env should win
+			},
+			wantWarns: ceOnlyWarnings("configuration for a Vault Enterprise feature has been ignored: field=retry_join_as_non_voter"),
+		},
+
+		// Entry Size Limits -----------------------------------------------------
+		{
+			name: "entry size, happy path",
+			conf: map[string]string{
+				"max_entry_size": "123456",
+				"max_mount_and_namespace_table_entry_size": "654321",
+			},
+			wantMutation: func(cfg *RaftBackendConfig) {
+				cfg.MaxEntrySize = 123456
+				cfg.MaxMountAndNamespaceTableEntrySize = 654321
+			},
+			wantWarns: ceOnlyWarnings("configuration for a Vault Enterprise feature has been ignored: field=max_mount_and_namespace_table_entry_size"),
+		},
+		{
+			name: "entry size, junk entry size",
+			conf: map[string]string{
+				"max_entry_size": "sadfsaf",
+				"max_mount_and_namespace_table_entry_size": "654321",
+			},
+			wantErr: "failed to parse 'max_entry_size'",
+		},
+		{
+			name: "entry size, junk mount entry size",
+			conf: map[string]string{
+				"max_entry_size": "123456",
+				"max_mount_and_namespace_table_entry_size": "1MiB",
+			},
+			wantErr: "failed to parse 'max_mount_and_namespace_table_entry_size'",
+		},
+		{
+			name: "entry size, way too small mount entry size",
+			conf: map[string]string{
+				"max_mount_and_namespace_table_entry_size": "1",
+			},
+			wantErr: "'max_mount_and_namespace_table_entry_size' must be at least 1024 bytes",
+		},
+		{
+			name: "entry size, way too big mount entry size",
+			conf: map[string]string{
+				"max_mount_and_namespace_table_entry_size": "20000000",
+			},
+			wantErr: "'max_mount_and_namespace_table_entry_size' must be at most 10,485,760 bytes (10MiB)",
+		},
+	}
+
+	// Set a nodeid and path to remove noise from all the test cases.
+	baseConf := map[string]string{
+		"node_id": "abc123",
+		"path":    "/dummy/path",
+	}
+
+	for _, tc := range tcs {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			if len(tc.env) == 0 {
+				// Only run in parallel if there are no env vars to set.
+				t.Parallel()
+			}
+
+			var logs bytes.Buffer
+			logger := hclog.New(&hclog.LoggerOptions{
+				Level:  hclog.Warn,
+				Output: &logs,
+			})
+
+			if tc.conf == nil {
+				tc.conf = make(map[string]string)
+			}
+
+			for k, v := range baseConf {
+				if _, ok := tc.conf[k]; !ok {
+					tc.conf[k] = v
+				}
+			}
+
+			// Make a default-valued config to compare against later. Note we do this
+			// before setting ENV as that would could change behavior!
+			wantCfg, err := parseRaftBackendConfig(baseConf, hclog.NewNullLogger())
+			require.NoError(t, err)
+
+			for k, v := range tc.env {
+				t.Setenv(k, v)
+			}
+
+			cfg, err := parseRaftBackendConfig(tc.conf, logger)
+
+			if tc.wantErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tc.wantErr)
+				return
+			}
+
+			tc.wantMutation(wantCfg)
+
+			require.Equal(t, wantCfg, cfg)
+			allLogs := logs.String()
+			for _, warn := range tc.wantWarns {
+				require.Contains(t, allLogs, warn)
+			}
+			if len(tc.wantWarns) == 0 {
+				require.NotContains(t, allLogs, "[WARN]", "no warnings expected")
+			}
+		})
+	}
+}
diff --git a/physical/raft/fsm.go b/physical/raft/fsm.go
index 19329b67d5f..3e7bf052e5a 100644
--- a/physical/raft/fsm.go
+++ b/physical/raft/fsm.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
@@ -13,6 +13,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strconv"
 	"strings"
 	"sync"
@@ -21,7 +22,6 @@ import (
 
 	"github.com/armon/go-metrics"
 	"github.com/golang/protobuf/proto"
-	bolt "github.com/hashicorp-forge/bbolt"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/go-raftchunking"
@@ -31,6 +31,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/sdk/plugin/pb"
+	bolt "go.etcd.io/bbolt"
 )
 
 const (
@@ -179,11 +180,20 @@ type FSM struct {
 
 	localID         string
 	desiredSuffrage string
-	unknownOpTypes  sync.Map
+	// metricSuffix should contain a dash, since it will be appended directly to the end of the key string.
+	metricSuffix string
+}
+
+func NewReadOnlyFSM(path string, localID string, logger log.Logger) (*FSM, error) {
+	return newFSM(path, localID, logger, "-readonly")
 }
 
 // NewFSM constructs a FSM using the given directory
 func NewFSM(path string, localID string, logger log.Logger) (*FSM, error) {
+	return newFSM(path, localID, logger, "")
+}
+
+func newFSM(path string, localID string, logger log.Logger, metricSuffix string) (*FSM, error) {
 	// Initialize the latest term, index, and config values
 	latestTerm := new(uint64)
 	latestIndex := new(uint64)
@@ -204,6 +214,7 @@ func NewFSM(path string, localID string, logger log.Logger) (*FSM, error) {
 		// setup if this is already part of a cluster with a desired suffrage.
 		desiredSuffrage: "voter",
 		localID:         localID,
+		metricSuffix:    metricSuffix,
 	}
 
 	f.chunker = &logVerificationChunkingShim{
@@ -247,9 +258,11 @@ func (f *FSM) openDBFile(dbPath string) error {
 		return errors.New("can not open empty filename")
 	}
 
+	vaultDbExists := true
 	st, err := os.Stat(dbPath)
 	switch {
 	case err != nil && os.IsNotExist(err):
+		vaultDbExists = false
 	case err != nil:
 		return fmt.Errorf("error checking raft FSM db file %q: %v", dbPath, err)
 	default:
@@ -261,11 +274,16 @@ func (f *FSM) openDBFile(dbPath string) error {
 	}
 
 	opts := boltOptions(dbPath)
+	if runtime.GOOS == "linux" && vaultDbExists && !usingMapPopulate(opts.MmapFlags) {
+		f.logger.Warn("the MAP_POPULATE mmap flag has not been set before opening the FSM database. This may be due to the database file being larger than the available memory on the system, or due to the VAULT_RAFT_DISABLE_MAP_POPULATE environment variable being set. As a result, Vault may be slower to start up.")
+	}
+
 	start := time.Now()
 	boltDB, err := bolt.Open(dbPath, 0o600, opts)
 	if err != nil {
 		return err
 	}
+
 	elapsed := time.Now().Sub(start)
 	f.logger.Debug("time to open database", "elapsed", elapsed, "path", dbPath)
 	metrics.MeasureSince([]string{"raft_storage", "fsm", "open_db_file"}, start)
@@ -552,8 +570,8 @@ func (f *FSM) DeletePrefix(ctx context.Context, prefix string) error {
 // Get retrieves the value at the given path from the bolt file.
 func (f *FSM) Get(ctx context.Context, path string) (*physical.Entry, error) {
 	// TODO: Remove this outdated metric name in an older release
-	defer metrics.MeasureSince([]string{"raft", "get"}, time.Now())
-	defer metrics.MeasureSince([]string{"raft_storage", "fsm", "get"}, time.Now())
+	defer metrics.MeasureSince([]string{"raft", fmt.Sprintf("get%s", f.metricSuffix)}, time.Now())
+	defer metrics.MeasureSince([]string{"raft_storage", "fsm", fmt.Sprintf("get%s", f.metricSuffix)}, time.Now())
 
 	f.l.RLock()
 	defer f.l.RUnlock()
@@ -600,8 +618,8 @@ func (f *FSM) Put(ctx context.Context, entry *physical.Entry) error {
 // List retrieves the set of keys with the given prefix from the bolt file.
 func (f *FSM) List(ctx context.Context, prefix string) ([]string, error) {
 	// TODO: Remove this outdated metric name in a future release
-	defer metrics.MeasureSince([]string{"raft", "list"}, time.Now())
-	defer metrics.MeasureSince([]string{"raft_storage", "fsm", "list"}, time.Now())
+	defer metrics.MeasureSince([]string{"raft", fmt.Sprintf("list%s", f.metricSuffix)}, time.Now())
+	defer metrics.MeasureSince([]string{"raft_storage", "fsm", fmt.Sprintf("list%s", f.metricSuffix)}, time.Now())
 
 	f.l.RLock()
 	defer f.l.RUnlock()
@@ -763,10 +781,7 @@ func (f *FSM) ApplyBatch(logs []*raft.Log) []interface{} {
 							go f.restoreCb(context.Background())
 						}
 					default:
-						if _, ok := f.unknownOpTypes.Load(op.OpType); !ok {
-							f.logger.Error("unsupported transaction operation", "op", op.OpType)
-							f.unknownOpTypes.Store(op.OpType, struct{}{})
-						}
+						return fmt.Errorf("%q is not a supported transaction operation", op.OpType)
 					}
 					if err != nil {
 						return err
diff --git a/physical/raft/fsm_test.go b/physical/raft/fsm_test.go
index 44557048bd2..e5906b152a7 100644
--- a/physical/raft/fsm_test.go
+++ b/physical/raft/fsm_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
@@ -6,9 +6,7 @@ package raft
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"math/rand"
-	"os"
 	"sort"
 	"testing"
 
@@ -17,13 +15,11 @@ import (
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/raft"
 	"github.com/hashicorp/vault/sdk/physical"
+	"github.com/stretchr/testify/require"
 )
 
-func getFSM(t testing.TB) (*FSM, string) {
-	raftDir, err := ioutil.TempDir("", "vault-raft-")
-	if err != nil {
-		t.Fatal(err)
-	}
+func getFSM(t testing.TB) *FSM {
+	raftDir := t.TempDir()
 	t.Logf("raft dir: %s", raftDir)
 
 	logger := hclog.New(&hclog.LoggerOptions{
@@ -36,12 +32,11 @@ func getFSM(t testing.TB) (*FSM, string) {
 		t.Fatal(err)
 	}
 
-	return fsm, raftDir
+	return fsm
 }
 
 func TestFSM_Batching(t *testing.T) {
-	fsm, dir := getFSM(t)
-	defer func() { _ = os.RemoveAll(dir) }()
+	fsm := getFSM(t)
 
 	var index uint64
 	var term uint64 = 1
@@ -133,8 +128,7 @@ func TestFSM_Batching(t *testing.T) {
 }
 
 func TestFSM_List(t *testing.T) {
-	fsm, dir := getFSM(t)
-	defer func() { _ = os.RemoveAll(dir) }()
+	fsm := getFSM(t)
 
 	ctx := context.Background()
 	count := 100
@@ -162,3 +156,41 @@ func TestFSM_List(t *testing.T) {
 		t.Fatal(diff)
 	}
 }
+
+// TestFSM_UnknownOperation calls ApplyBatch with a batch that has an unknown
+// command operation type. The test verifies that the call panics
+func TestFSM_UnknownOperation(t *testing.T) {
+	fsm := getFSM(t)
+	command := &LogData{
+		Operations: make([]*LogOperation, 5),
+	}
+
+	for i := range command.Operations {
+		op := putOp
+		if i == 4 {
+			// the last operation has an invalid op type
+			op = 0
+		}
+		command.Operations[i] = &LogOperation{
+			OpType: op,
+			Key:    fmt.Sprintf("key-%d", i),
+			Value:  []byte(fmt.Sprintf("value-%d", i)),
+		}
+	}
+	commandBytes, err := proto.Marshal(command)
+	require.NoError(t, err)
+
+	defer func() {
+		r := recover()
+		require.NotNil(t, r)
+		require.Contains(t, r, "failed to store data")
+	}()
+	fsm.ApplyBatch([]*raft.Log{{
+		Index: 0,
+		Term:  1,
+		Type:  raft.LogCommand,
+		Data:  commandBytes,
+	}})
+
+	require.Fail(t, "failed to panic")
+}
diff --git a/physical/raft/raft.go b/physical/raft/raft.go
index 55d6fd3c96f..2f6b946a6aa 100644
--- a/physical/raft/raft.go
+++ b/physical/raft/raft.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
@@ -10,10 +10,12 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"math/rand"
 	"net/url"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strconv"
 	"sync"
 	"sync/atomic"
@@ -21,13 +23,11 @@ import (
 
 	"github.com/armon/go-metrics"
 	"github.com/golang/protobuf/proto"
-	bolt "github.com/hashicorp-forge/bbolt"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-raftchunking"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-secure-stdlib/tlsutil"
-	"github.com/hashicorp/go-uuid"
-	goversion "github.com/hashicorp/go-version"
 	"github.com/hashicorp/raft"
 	autopilot "github.com/hashicorp/raft-autopilot"
 	raftboltdb "github.com/hashicorp/raft-boltdb/v2"
@@ -42,7 +42,7 @@ import (
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/vault/cluster"
 	"github.com/hashicorp/vault/version"
-	etcdbolt "go.etcd.io/bbolt"
+	bolt "go.etcd.io/bbolt"
 )
 
 const (
@@ -76,15 +76,20 @@ const (
 	defaultMaxBatchSize = 128 * 1024
 )
 
-var getMmapFlags = func(string) int { return 0 }
+var (
+	getMmapFlags     = func(string) int { return 0 }
+	usingMapPopulate = func(int) bool { return false }
+)
 
 // Verify RaftBackend satisfies the correct interfaces
 var (
-	_ physical.Backend             = (*RaftBackend)(nil)
-	_ physical.Transactional       = (*RaftBackend)(nil)
-	_ physical.TransactionalLimits = (*RaftBackend)(nil)
-	_ physical.HABackend           = (*RaftBackend)(nil)
-	_ physical.Lock                = (*RaftLock)(nil)
+	_ physical.Backend                   = (*RaftBackend)(nil)
+	_ physical.Transactional             = (*RaftBackend)(nil)
+	_ physical.TransactionalLimits       = (*RaftBackend)(nil)
+	_ physical.HABackend                 = (*RaftBackend)(nil)
+	_ physical.MountTableLimitingBackend = (*RaftBackend)(nil)
+	_ physical.RemovableNodeHABackend    = (*RaftBackend)(nil)
+	_ physical.Lock                      = (*RaftLock)(nil)
 )
 
 var (
@@ -172,13 +177,20 @@ type RaftBackend struct {
 	serverAddressProvider raft.ServerAddressProvider
 
 	// permitPool is used to limit the number of concurrent storage calls.
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 
 	// maxEntrySize imposes a size limit (in bytes) on a raft entry (put or transaction).
 	// It is suggested to use a value of 2x the Raft chunking size for optimal
 	// performance.
 	maxEntrySize uint64
 
+	// maxMountAndNamespaceEntrySize imposes a size limit (in bytes) on a raft
+	// entry (put or transaction) for paths related to mount table and namespace
+	// metadata. The Raft storage doesn't "know" about these paths but Vault can
+	// call RegisterMountTablePath to inform it so that it can apply this
+	// alternate limit if one is configured.
+	maxMountAndNamespaceEntrySize uint64
+
 	// maxBatchEntries is the number of operation entries in each batch. It is set
 	// by default to a value we've tested to work well but may be overridden by
 	// Environment variable VAULT_RAFT_MAX_BATCH_ENTRIES.
@@ -241,6 +253,55 @@ type RaftBackend struct {
 	// it writes checkpoints.
 	raftLogVerifierEnabled      bool
 	raftLogVerificationInterval time.Duration
+
+	// specialPathLimits is a map of special paths to their configured entrySize
+	// limits.
+	specialPathLimits map[string]uint64
+
+	removed              *atomic.Bool
+	removedCallback      func()
+	removedServerCleanup func(context.Context, string) (bool, error)
+}
+
+func (b *RaftBackend) IsNodeRemoved(ctx context.Context, nodeID string) (bool, error) {
+	conf, err := b.GetConfiguration(ctx)
+	if err != nil {
+		return false, err
+	}
+	for _, srv := range conf.Servers {
+		if srv.NodeID == nodeID {
+			return false, nil
+		}
+	}
+	return true, nil
+}
+
+func (b *RaftBackend) IsRemoved() bool {
+	return b.removed.Load()
+}
+
+var removedKey = []byte("removed")
+
+func (b *RaftBackend) RemoveSelf() error {
+	b.removed.Store(true)
+	return b.stableStore.SetUint64(removedKey, 1)
+}
+
+func (b *RaftBackend) SetRemovedServerCleanupFunc(f func(context.Context, string) (bool, error)) {
+	b.l.Lock()
+	b.removedServerCleanup = f
+	b.l.Unlock()
+}
+
+func (b *RaftBackend) RemovedServerCleanup(ctx context.Context, nodeID string) (bool, error) {
+	b.l.RLock()
+	defer b.l.RUnlock()
+
+	if b.removedServerCleanup != nil {
+		return b.removedServerCleanup(ctx, nodeID)
+	}
+
+	return false, nil
 }
 
 // LeaderJoinInfo contains information required by a node to join itself as a
@@ -273,7 +334,7 @@ type LeaderJoinInfo struct {
 	// client authentication during TLS.
 	LeaderClientKey string `json:"leader_client_key"`
 
-	// LeaderCACertFile is the path on disk to the the CA cert file of the
+	// LeaderCACertFile is the path on disk to the CA cert file of the
 	// leader node. This should only be provided via Vault's configuration file.
 	LeaderCACertFile string `json:"leader_ca_cert_file"`
 
@@ -298,25 +359,6 @@ type LeaderJoinInfo struct {
 	TLSConfig *tls.Config `json:"-"`
 }
 
-type RaftBackendConfig struct {
-	Path                        string
-	NodeId                      string
-	ApplyDelay                  time.Duration
-	RaftWal                     bool
-	RaftLogVerifierEnabled      bool
-	RaftLogVerificationInterval time.Duration
-	SnapshotDelay               time.Duration
-	MaxEntrySize                uint64
-	MaxBatchEntries             int
-	MaxBatchSize                int
-	AutopilotReconcileInterval  time.Duration
-	AutopilotUpdateInterval     time.Duration
-	AutopilotUpgradeVersion     string
-	AutopilotRedundancyZone     string
-	RaftNonVoter                bool
-	RetryJoin                   string
-}
-
 // JoinConfig returns a list of information about possible leader nodes that
 // this node can join as a follower
 func (b *RaftBackend) JoinConfig() ([]*LeaderJoinInfo, error) {
@@ -456,6 +498,7 @@ func NewRaftBackend(conf map[string]string, logger log.Logger) (physical.Backend
 		}
 	}
 
+	// Create the log store.
 	// Build an all in-memory setup for dev mode, otherwise prepare a full
 	// disk-based setup.
 	var logStore raft.LogStore
@@ -482,6 +525,7 @@ func NewRaftBackend(conf map[string]string, logger log.Logger) (physical.Backend
 		if err != nil {
 			return nil, fmt.Errorf("failed to check if raft.db already exists: %w", err)
 		}
+
 		if backendConfig.RaftWal && raftDbExists {
 			logger.Warn("raft is configured to use raft-wal for storage but existing raft.db detected. raft-wal config will be ignored.")
 			backendConfig.RaftWal = false
@@ -506,13 +550,17 @@ func NewRaftBackend(conf map[string]string, logger log.Logger) (physical.Backend
 			logStore = wal
 		} else {
 			// use the traditional BoltDB setup
-			opts := etcdboltOptions(dbPath)
+			opts := boltOptions(dbPath)
 			raftOptions := raftboltdb.Options{
 				Path:                    dbPath,
 				BoltOptions:             opts,
 				MsgpackUseNewTimeFormat: true,
 			}
 
+			if runtime.GOOS == "linux" && raftDbExists && !usingMapPopulate(opts.MmapFlags) {
+				logger.Warn("the MAP_POPULATE mmap flag has not been set before opening the log store database. This may be due to the database file being larger than the available memory on the system, or due to the VAULT_RAFT_DISABLE_MAP_POPULATE environment variable being set. As a result, Vault may be slower to start up.")
+			}
+
 			store, err := raftboltdb.New(raftOptions)
 			if err != nil {
 				return nil, err
@@ -567,33 +615,66 @@ func NewRaftBackend(conf map[string]string, logger log.Logger) (physical.Backend
 		snapStore = newSnapshotStoreDelay(snapStore, backendConfig.SnapshotDelay, logger)
 	}
 
+	isRemoved := new(atomic.Bool)
+	removedVal, err := stableStore.GetUint64(removedKey)
+	if err != nil {
+		logger.Debug("error checking if this node is removed. continuing under the assumption that it's not", "error", err)
+	}
+	if removedVal == 1 {
+		isRemoved.Store(true)
+	}
 	return &RaftBackend{
-		logger:                      logger,
-		fsm:                         fsm,
-		raftInitCh:                  make(chan struct{}),
-		conf:                        conf,
-		logStore:                    logStore,
-		stableStore:                 stableStore,
-		snapStore:                   snapStore,
-		closers:                     closers,
-		dataDir:                     backendConfig.Path,
-		localID:                     backendConfig.NodeId,
-		permitPool:                  physical.NewPermitPool(physical.DefaultParallelOperations),
-		maxEntrySize:                backendConfig.MaxEntrySize,
-		maxBatchEntries:             backendConfig.MaxBatchEntries,
-		maxBatchSize:                backendConfig.MaxBatchSize,
-		followerHeartbeatTicker:     time.NewTicker(time.Second),
-		autopilotReconcileInterval:  backendConfig.AutopilotReconcileInterval,
-		autopilotUpdateInterval:     backendConfig.AutopilotUpdateInterval,
-		redundancyZone:              backendConfig.AutopilotRedundancyZone,
-		nonVoter:                    backendConfig.RaftNonVoter,
-		upgradeVersion:              backendConfig.AutopilotUpgradeVersion,
-		failGetInTxn:                new(uint32),
-		raftLogVerifierEnabled:      backendConfig.RaftLogVerifierEnabled,
-		raftLogVerificationInterval: backendConfig.RaftLogVerificationInterval,
+		logger:                        logger,
+		fsm:                           fsm,
+		raftInitCh:                    make(chan struct{}),
+		conf:                          conf,
+		logStore:                      logStore,
+		stableStore:                   stableStore,
+		snapStore:                     snapStore,
+		closers:                       closers,
+		dataDir:                       backendConfig.Path,
+		localID:                       backendConfig.NodeId,
+		permitPool:                    permitpool.New(physical.DefaultParallelOperations),
+		maxEntrySize:                  backendConfig.MaxEntrySize,
+		maxMountAndNamespaceEntrySize: backendConfig.MaxMountAndNamespaceTableEntrySize,
+		maxBatchEntries:               backendConfig.MaxBatchEntries,
+		maxBatchSize:                  backendConfig.MaxBatchSize,
+		followerHeartbeatTicker:       time.NewTicker(time.Second),
+		autopilotReconcileInterval:    backendConfig.AutopilotReconcileInterval,
+		autopilotUpdateInterval:       backendConfig.AutopilotUpdateInterval,
+		redundancyZone:                backendConfig.AutopilotRedundancyZone,
+		nonVoter:                      backendConfig.RaftNonVoter,
+		upgradeVersion:                backendConfig.AutopilotUpgradeVersion,
+		failGetInTxn:                  new(uint32),
+		raftLogVerifierEnabled:        backendConfig.RaftLogVerifierEnabled,
+		raftLogVerificationInterval:   backendConfig.RaftLogVerificationInterval,
+		effectiveSDKVersion:           version.GetVersion().Version,
+		removed:                       isRemoved,
 	}, nil
 }
 
+// RegisterMountTablePath informs the Backend that the given path represents
+// part of the mount tables or related metadata. This allows the backend to
+// apply different limits for this entry if configured to do so.
+func (b *RaftBackend) RegisterMountTablePath(path string) {
+	// We don't need to lock here because this is only called during startup
+
+	if b.maxMountAndNamespaceEntrySize > 0 {
+		// Set up the limit for this special path.
+		if b.specialPathLimits == nil {
+			b.specialPathLimits = make(map[string]uint64)
+		}
+		b.specialPathLimits[path] = b.maxMountAndNamespaceEntrySize
+	}
+}
+
+// GetSpecialPathLimits returns any paths registered with special entry size
+// limits. It's really only used to make integration testing of the plumbing for
+// these paths simpler.
+func (b *RaftBackend) GetSpecialPathLimits() map[string]uint64 {
+	return b.specialPathLimits
+}
+
 type snapshotStoreDelay struct {
 	logger  log.Logger
 	wrapped raft.SnapshotStore
@@ -647,12 +728,6 @@ func (b *RaftBackend) FailGetInTxn(fail bool) {
 	atomic.StoreUint32(b.failGetInTxn, val)
 }
 
-func (b *RaftBackend) SetEffectiveSDKVersion(sdkVersion string) {
-	b.l.Lock()
-	b.effectiveSDKVersion = sdkVersion
-	b.l.Unlock()
-}
-
 func (b *RaftBackend) RedundancyZone() string {
 	b.l.RLock()
 	defer b.l.RUnlock()
@@ -667,7 +742,10 @@ func (b *RaftBackend) NonVoter() bool {
 	return b.nonVoter
 }
 
-func (b *RaftBackend) EffectiveVersion() string {
+// UpgradeVersion returns the string that should be used by autopilot during automated upgrades. We return the
+// specified upgradeVersion if it's present. If it's not, we fall back to effectiveSDKVersion, which is
+// Vault's binary version (though that can be overridden for tests).
+func (b *RaftBackend) UpgradeVersion() string {
 	b.l.RLock()
 	defer b.l.RUnlock()
 
@@ -675,7 +753,13 @@ func (b *RaftBackend) EffectiveVersion() string {
 		return b.upgradeVersion
 	}
 
-	return version.GetVersion().Version
+	return b.effectiveSDKVersion
+}
+
+func (b *RaftBackend) SDKVersion() string {
+	b.l.RLock()
+	defer b.l.RUnlock()
+	return b.effectiveSDKVersion
 }
 
 func (b *RaftBackend) verificationInterval() time.Duration {
@@ -737,7 +821,9 @@ func (b *RaftBackend) applyVerifierCheckpoint() error {
 	data := make([]byte, 1)
 	data[0] = byte(verifierCheckpointOp)
 
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(context.Background()); err != nil {
+		return err
+	}
 	b.l.RLock()
 
 	var err error
@@ -811,7 +897,7 @@ func makeLogVerifyReportFn(logger log.Logger) verifier.ReportFn {
 
 func (b *RaftBackend) CollectMetrics(sink *metricsutil.ClusterMetricSink) {
 	var stats map[string]string
-	var logStoreStats *etcdbolt.Stats
+	var logStoreStats *bolt.Stats
 
 	b.l.RLock()
 	if boltStore, ok := b.stableStore.(*raftboltdb.BoltStore); ok {
@@ -827,7 +913,7 @@ func (b *RaftBackend) CollectMetrics(sink *metricsutil.ClusterMetricSink) {
 	b.l.RUnlock()
 
 	if logStoreStats != nil {
-		b.collectEtcdBoltMetricsWithStats(*logStoreStats, sink, "logstore")
+		b.collectMetricsWithStats(*logStoreStats, sink, "logstore")
 	}
 
 	b.collectMetricsWithStats(fsmStats, sink, "fsm")
@@ -871,29 +957,6 @@ func (b *RaftBackend) collectMetricsWithStats(stats bolt.Stats, sink *metricsuti
 	sink.IncrCounterWithLabels([]string{"raft_storage", "bolt", "write", "time"}, float32(txstats.GetWriteTime().Milliseconds()), labels)
 }
 
-func (b *RaftBackend) collectEtcdBoltMetricsWithStats(stats etcdbolt.Stats, sink *metricsutil.ClusterMetricSink, database string) {
-	txstats := stats.TxStats
-	labels := []metricsutil.Label{{"database", database}}
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "freelist", "free_pages"}, float32(stats.FreePageN), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "freelist", "pending_pages"}, float32(stats.PendingPageN), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "freelist", "allocated_bytes"}, float32(stats.FreeAlloc), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "freelist", "used_bytes"}, float32(stats.FreelistInuse), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "transaction", "started_read_transactions"}, float32(stats.TxN), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "transaction", "currently_open_read_transactions"}, float32(stats.OpenTxN), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "page", "count"}, float32(txstats.GetPageCount()), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "page", "bytes_allocated"}, float32(txstats.GetPageAlloc()), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "cursor", "count"}, float32(txstats.GetCursorCount()), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "node", "count"}, float32(txstats.GetNodeCount()), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "node", "dereferences"}, float32(txstats.GetNodeDeref()), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "rebalance", "count"}, float32(txstats.GetRebalance()), labels)
-	sink.AddSampleWithLabels([]string{"raft_storage", "bolt", "rebalance", "time"}, float32(txstats.GetRebalanceTime().Milliseconds()), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "split", "count"}, float32(txstats.GetSplit()), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "spill", "count"}, float32(txstats.GetSpill()), labels)
-	sink.AddSampleWithLabels([]string{"raft_storage", "bolt", "spill", "time"}, float32(txstats.GetSpillTime().Milliseconds()), labels)
-	sink.SetGaugeWithLabels([]string{"raft_storage", "bolt", "write", "count"}, float32(txstats.GetWrite()), labels)
-	sink.IncrCounterWithLabels([]string{"raft_storage", "bolt", "write", "time"}, float32(txstats.GetWriteTime().Milliseconds()), labels)
-}
-
 // RaftServer has information about a server in the Raft configuration
 type RaftServer struct {
 	// NodeID is the name of the server
@@ -1001,9 +1064,15 @@ func (b *RaftBackend) SetRestoreCallback(restoreCb restoreCallback) {
 	b.fsm.l.Unlock()
 }
 
-func (b *RaftBackend) applyConfigSettings(config *raft.Config) error {
-	config.Logger = b.logger
-	multiplierRaw, ok := b.conf["performance_multiplier"]
+func (b *RaftBackend) SetRemovedCallback(cb func()) {
+	b.l.Lock()
+	defer b.l.Unlock()
+	b.removedCallback = cb
+}
+
+func ApplyConfigSettings(logger log.Logger, parsedConf map[string]string, config *raft.Config) error {
+	config.Logger = logger
+	multiplierRaw, ok := parsedConf["performance_multiplier"]
 	multiplier := 5
 	if ok {
 		var err error
@@ -1016,7 +1085,7 @@ func (b *RaftBackend) applyConfigSettings(config *raft.Config) error {
 	config.HeartbeatTimeout *= time.Duration(multiplier)
 	config.LeaderLeaseTimeout *= time.Duration(multiplier)
 
-	snapThresholdRaw, ok := b.conf["snapshot_threshold"]
+	snapThresholdRaw, ok := parsedConf["snapshot_threshold"]
 	if ok {
 		var err error
 		snapThreshold, err := strconv.Atoi(snapThresholdRaw)
@@ -1026,7 +1095,7 @@ func (b *RaftBackend) applyConfigSettings(config *raft.Config) error {
 		config.SnapshotThreshold = uint64(snapThreshold)
 	}
 
-	trailingLogsRaw, ok := b.conf["trailing_logs"]
+	trailingLogsRaw, ok := parsedConf["trailing_logs"]
 	if ok {
 		var err error
 		trailingLogs, err := strconv.Atoi(trailingLogsRaw)
@@ -1035,7 +1104,7 @@ func (b *RaftBackend) applyConfigSettings(config *raft.Config) error {
 		}
 		config.TrailingLogs = uint64(trailingLogs)
 	}
-	snapshotIntervalRaw, ok := b.conf["snapshot_interval"]
+	snapshotIntervalRaw, ok := parsedConf["snapshot_interval"]
 	if ok {
 		var err error
 		snapshotInterval, err := parseutil.ParseDurationSecond(snapshotIntervalRaw)
@@ -1053,7 +1122,7 @@ func (b *RaftBackend) applyConfigSettings(config *raft.Config) error {
 	// scheduler.
 	config.BatchApplyCh = true
 
-	b.logger.Trace("applying raft config", "inputs", b.conf)
+	logger.Trace("applying raft config", "inputs", parsedConf)
 	return nil
 }
 
@@ -1073,9 +1142,17 @@ type SetupOpts struct {
 	// RecoveryModeConfig is the configuration for the raft cluster in recovery
 	// mode.
 	RecoveryModeConfig *raft.Configuration
+
+	// EffectiveSDKVersion is typically the version string baked into the binary.
+	// We pass it in though because it can be overridden in tests or via ENV in
+	// core.
+	EffectiveSDKVersion string
+
+	// RemovedCallback is the function to call when the node has been removed
+	RemovedCallback func()
 }
 
-func (b *RaftBackend) StartRecoveryCluster(ctx context.Context, peer Peer) error {
+func (b *RaftBackend) StartRecoveryCluster(ctx context.Context, peer Peer, removedCallback func()) error {
 	recoveryModeConfig := &raft.Configuration{
 		Servers: []raft.Server{
 			{
@@ -1088,6 +1165,7 @@ func (b *RaftBackend) StartRecoveryCluster(ctx context.Context, peer Peer) error
 	return b.SetupCluster(context.Background(), SetupOpts{
 		StartAsLeader:      true,
 		RecoveryModeConfig: recoveryModeConfig,
+		RemovedCallback:    removedCallback,
 	})
 }
 
@@ -1116,9 +1194,14 @@ func (b *RaftBackend) SetupCluster(ctx context.Context, opts SetupOpts) error {
 		return errors.New("no local node id configured")
 	}
 
+	if opts.EffectiveSDKVersion != "" {
+		// Override the SDK version
+		b.effectiveSDKVersion = opts.EffectiveSDKVersion
+	}
+
 	// Setup the raft config
 	raftConfig := raft.DefaultConfig()
-	if err := b.applyConfigSettings(raftConfig); err != nil {
+	if err := ApplyConfigSettings(b.logger, b.conf, raftConfig); err != nil {
 		return err
 	}
 
@@ -1352,6 +1435,11 @@ func (b *RaftBackend) SetupCluster(ctx context.Context, opts SetupOpts) error {
 		}
 	}
 
+	if opts.RemovedCallback != nil {
+		b.removedCallback = opts.RemovedCallback
+	}
+	b.StartRemovedChecker(ctx)
+
 	b.logger.Trace("finished setting up raft cluster")
 	return nil
 }
@@ -1385,6 +1473,58 @@ func (b *RaftBackend) TeardownCluster(clusterListener cluster.ClusterHook) error
 	return nil
 }
 
+func (b *RaftBackend) StartRemovedChecker(ctx context.Context) {
+	go func() {
+		ticker := time.NewTicker(time.Second)
+		defer ticker.Stop()
+		hasBeenPresent := false
+
+		logger := b.logger.Named("removed.checker")
+		for {
+			select {
+			case <-ticker.C:
+				// If the raft cluster has been torn down (which will happen on
+				// seal) the raft backend will be uninitialized. We want to exit
+				// the loop in that case. If the cluster unseals, we'll get a
+				// new backend setup and that will have its own removed checker.
+
+				// There is a ctx.Done() check below that will also exit, but
+				// in most (if not all) places we pass in context.Background()
+				// to this function. Checking initialization will prevent this
+				// loop from continuing to run after the raft backend is stopped
+				// regardless of the context.
+				if !b.Initialized() {
+					return
+				}
+				removed, err := b.IsNodeRemoved(ctx, b.localID)
+				if err != nil {
+					logger.Error("failed to check if node is removed", "node ID", b.localID, "error", err)
+					continue
+				}
+				if !removed {
+					hasBeenPresent = true
+				}
+				// the node must have been previously present in the config,
+				// only then should we consider it removed and shutdown
+				if removed && hasBeenPresent {
+					err := b.RemoveSelf()
+					if err != nil {
+						logger.Error("failed to remove self", "node ID", b.localID, "error", err)
+					}
+					b.l.RLock()
+					if b.removedCallback != nil {
+						b.removedCallback()
+					}
+					b.l.RUnlock()
+					return
+				}
+			case <-ctx.Done():
+				return
+			}
+		}
+	}()
+}
+
 // CommittedIndex returns the latest index committed to stable storage
 func (b *RaftBackend) CommittedIndex() uint64 {
 	b.l.RLock()
@@ -1687,7 +1827,9 @@ func (b *RaftBackend) Delete(ctx context.Context, path string) error {
 			},
 		},
 	}
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	b.l.RLock()
@@ -1707,7 +1849,9 @@ func (b *RaftBackend) Get(ctx context.Context, path string) (*physical.Entry, er
 		return nil, err
 	}
 
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer b.permitPool.Release()
 
 	if err := ctx.Err(); err != nil {
@@ -1717,9 +1861,10 @@ func (b *RaftBackend) Get(ctx context.Context, path string) (*physical.Entry, er
 	entry, err := b.fsm.Get(ctx, path)
 	if entry != nil {
 		valueLen := len(entry.Value)
-		if uint64(valueLen) > b.maxEntrySize {
-			b.logger.Warn("retrieved entry value is too large, has raft's max_entry_size been reduced?",
-				"size", valueLen, "max_entry_size", b.maxEntrySize)
+		maxSize := b.entrySizeLimitForPath(path)
+		if uint64(valueLen) > maxSize {
+			b.logger.Warn("retrieved entry value is too large, has raft's max_entry_size or max_mount_and_namespace_table_entry_size been reduced?",
+				"size", valueLen, "max_size", maxSize)
 		}
 	}
 
@@ -1749,7 +1894,9 @@ func (b *RaftBackend) Put(ctx context.Context, entry *physical.Entry) error {
 		},
 	}
 
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	b.l.RLock()
@@ -1769,7 +1916,9 @@ func (b *RaftBackend) List(ctx context.Context, prefix string) ([]string, error)
 		return nil, err
 	}
 
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer b.permitPool.Release()
 
 	if err := ctx.Err(); err != nil {
@@ -1824,7 +1973,9 @@ func (b *RaftBackend) Transaction(ctx context.Context, txns []*physical.TxnEntry
 		command.Operations[i] = op
 	}
 
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	b.l.RLock()
@@ -1847,6 +1998,31 @@ func (b *RaftBackend) TransactionLimits() (int, int) {
 	return b.maxBatchEntries, b.maxBatchSize
 }
 
+// validateCommandEntrySizes is a helper to check the size of each transaction
+// value isn't larger than is allowed. It must take into account the path in
+// case any special limits have been set for mount table paths. Finally it
+// returns the largest limit it needed to use so that calling code can size the
+// overall log entry check correctly. In other words if max_entry_size is 1MB
+// and max_mount_and_namespace_table_entry_size is 2MB, we check each key
+// against the right limit and then return 1MB unless there is at least one
+// mount table key being written in which case we allow the larger limit of 2MB.
+func (b *RaftBackend) validateCommandEntrySizes(command *LogData) (uint64, error) {
+	largestEntryLimit := b.maxEntrySize
+
+	for _, op := range command.Operations {
+		if op.OpType == putOp {
+			entrySize := b.entrySizeLimitForPath(op.Key)
+			if len(op.Value) > int(entrySize) {
+				return 0, fmt.Errorf("%s, max value size for key %s is %d, got %d", physical.ErrValueTooLarge, op.Key, entrySize, len(op.Value))
+			}
+			if entrySize > largestEntryLimit {
+				largestEntryLimit = entrySize
+			}
+		}
+	}
+	return largestEntryLimit, nil
+}
+
 // applyLog will take a given log command and apply it to the raft log. applyLog
 // doesn't return until the log has been applied to a quorum of servers and is
 // persisted to the local FSM. Caller should hold the backend's read lock.
@@ -1858,14 +2034,19 @@ func (b *RaftBackend) applyLog(ctx context.Context, command *LogData) error {
 		return err
 	}
 
+	totalLogSizeLimit, err := b.validateCommandEntrySizes(command)
+	if err != nil {
+		return err
+	}
+
 	commandBytes, err := proto.Marshal(command)
 	if err != nil {
 		return err
 	}
 
 	cmdSize := len(commandBytes)
-	if uint64(cmdSize) > b.maxEntrySize {
-		return fmt.Errorf("%s; got %d bytes, max: %d bytes", physical.ErrValueTooLarge, cmdSize, b.maxEntrySize)
+	if uint64(cmdSize) > totalLogSizeLimit {
+		return fmt.Errorf("%s; got %d bytes, max: %d bytes", physical.ErrValueTooLarge, cmdSize, totalLogSizeLimit)
 	}
 
 	defer metrics.AddSample([]string{"raft-storage", "entry_size"}, float32(cmdSize))
@@ -2120,248 +2301,6 @@ func fileExists(name string) (bool, error) {
 	return false, err
 }
 
-func parseRaftBackendConfig(conf map[string]string, logger log.Logger) (*RaftBackendConfig, error) {
-	c := &RaftBackendConfig{}
-
-	c.Path = conf["path"]
-	envPath := os.Getenv(EnvVaultRaftPath)
-	if envPath != "" {
-		c.Path = envPath
-	}
-
-	if c.Path == "" {
-		return nil, fmt.Errorf("'path' must be set")
-	}
-
-	c.NodeId = conf["node_id"]
-	envNodeId := os.Getenv(EnvVaultRaftNodeID)
-	if envNodeId != "" {
-		c.NodeId = envNodeId
-	}
-
-	if c.NodeId == "" {
-		localIDRaw, err := os.ReadFile(filepath.Join(c.Path, "node-id"))
-		if err == nil && len(localIDRaw) > 0 {
-			c.NodeId = string(localIDRaw)
-		}
-		if err != nil && !errors.Is(err, os.ErrNotExist) {
-			return nil, err
-		}
-	}
-
-	if c.NodeId == "" {
-		id, err := uuid.GenerateUUID()
-		if err != nil {
-			return nil, err
-		}
-
-		if err = os.WriteFile(filepath.Join(c.Path, "node-id"), []byte(id), 0o600); err != nil {
-			return nil, err
-		}
-
-		c.NodeId = id
-	}
-
-	if delayRaw, ok := conf["apply_delay"]; ok {
-		delay, err := parseutil.ParseDurationSecond(delayRaw)
-		if err != nil {
-			return nil, fmt.Errorf("apply_delay does not parse as a duration: %w", err)
-		}
-
-		c.ApplyDelay = delay
-	}
-
-	if walRaw, ok := conf["raft_wal"]; ok {
-		useRaftWal, err := strconv.ParseBool(walRaw)
-		if err != nil {
-			return nil, fmt.Errorf("raft_wal does not parse as a boolean: %w", err)
-		}
-
-		c.RaftWal = useRaftWal
-	}
-
-	if rlveRaw, ok := conf["raft_log_verifier_enabled"]; ok {
-		rlve, err := strconv.ParseBool(rlveRaw)
-		if err != nil {
-			return nil, fmt.Errorf("raft_log_verifier_enabled does not parse as a boolean: %w", err)
-		}
-		c.RaftLogVerifierEnabled = rlve
-
-		c.RaftLogVerificationInterval = defaultRaftLogVerificationInterval
-		if rlviRaw, ok := conf["raft_log_verification_interval"]; ok {
-			rlvi, err := parseutil.ParseDurationSecond(rlviRaw)
-			if err != nil {
-				return nil, fmt.Errorf("raft_log_verification_interval does not parse as a duration: %w", err)
-			}
-
-			// Make sure our interval is capped to a reasonable value, so e.g. people don't use 0s or 1s
-			if rlvi >= minimumRaftLogVerificationInterval {
-				c.RaftLogVerificationInterval = rlvi
-			} else {
-				logger.Warn("raft_log_verification_interval is less than the minimum allowed, using default instead",
-					"given", rlveRaw,
-					"minimum", minimumRaftLogVerificationInterval,
-					"default", defaultRaftLogVerificationInterval)
-			}
-		}
-	}
-
-	if delayRaw, ok := conf["snapshot_delay"]; ok {
-		delay, err := parseutil.ParseDurationSecond(delayRaw)
-		if err != nil {
-			return nil, fmt.Errorf("snapshot_delay does not parse as a duration: %w", err)
-		}
-		c.SnapshotDelay = delay
-	}
-
-	c.MaxEntrySize = defaultMaxEntrySize
-	if maxEntrySizeCfg := conf["max_entry_size"]; len(maxEntrySizeCfg) != 0 {
-		i, err := strconv.Atoi(maxEntrySizeCfg)
-		if err != nil {
-			return nil, fmt.Errorf("failed to parse 'max_entry_size': %w", err)
-		}
-
-		c.MaxEntrySize = uint64(i)
-	}
-
-	c.MaxBatchEntries, c.MaxBatchSize = batchLimitsFromEnv(logger)
-
-	if interval := conf["autopilot_reconcile_interval"]; interval != "" {
-		interval, err := parseutil.ParseDurationSecond(interval)
-		if err != nil {
-			return nil, fmt.Errorf("autopilot_reconcile_interval does not parse as a duration: %w", err)
-		}
-		c.AutopilotReconcileInterval = interval
-	}
-
-	if interval := conf["autopilot_update_interval"]; interval != "" {
-		interval, err := parseutil.ParseDurationSecond(interval)
-		if err != nil {
-			return nil, fmt.Errorf("autopilot_update_interval does not parse as a duration: %w", err)
-		}
-		c.AutopilotUpdateInterval = interval
-	}
-
-	effectiveReconcileInterval := autopilot.DefaultReconcileInterval
-	effectiveUpdateInterval := autopilot.DefaultUpdateInterval
-
-	if c.AutopilotReconcileInterval != 0 {
-		effectiveReconcileInterval = c.AutopilotReconcileInterval
-	}
-	if c.AutopilotUpdateInterval != 0 {
-		effectiveUpdateInterval = c.AutopilotUpdateInterval
-	}
-
-	if effectiveReconcileInterval < effectiveUpdateInterval {
-		return nil, fmt.Errorf("autopilot_reconcile_interval (%v) should be larger than autopilot_update_interval (%v)", effectiveReconcileInterval, effectiveUpdateInterval)
-	}
-
-	if uv, ok := conf["autopilot_upgrade_version"]; ok && uv != "" {
-		_, err := goversion.NewVersion(uv)
-		if err != nil {
-			return nil, fmt.Errorf("autopilot_upgrade_version does not parse as a semantic version: %w", err)
-		}
-
-		c.AutopilotUpgradeVersion = uv
-	}
-
-	c.RaftNonVoter = false
-	if v := os.Getenv(EnvVaultRaftNonVoter); v != "" {
-		// Consistent with handling of other raft boolean env vars
-		// VAULT_RAFT_AUTOPILOT_DISABLE and VAULT_RAFT_FREELIST_SYNC
-		c.RaftNonVoter = true
-	} else if v, ok := conf[raftNonVoterConfigKey]; ok {
-		nonVoter, err := strconv.ParseBool(v)
-		if err != nil {
-			return nil, fmt.Errorf("failed to parse %s config value %q as a boolean: %w", raftNonVoterConfigKey, v, err)
-		}
-
-		c.RaftNonVoter = nonVoter
-	}
-
-	if c.RaftNonVoter && conf["retry_join"] == "" {
-		return nil, fmt.Errorf("setting %s to true is only valid if at least one retry_join stanza is specified", raftNonVoterConfigKey)
-	}
-
-	c.AutopilotRedundancyZone = conf["autopilot_redundancy_zone"]
-
-	return c, nil
-}
-
-// boltOptions returns a bolt.Options struct, suitable for passing to
-// bolt.Open(), pre-configured with all of our preferred defaults.
-func boltOptions(path string) *bolt.Options {
-	o := &bolt.Options{
-		Timeout:        1 * time.Second,
-		FreelistType:   bolt.FreelistMapType,
-		NoFreelistSync: true,
-		MmapFlags:      getMmapFlags(path),
-	}
-
-	if os.Getenv("VAULT_RAFT_FREELIST_TYPE") == "array" {
-		o.FreelistType = bolt.FreelistArrayType
-	}
-
-	if os.Getenv("VAULT_RAFT_FREELIST_SYNC") != "" {
-		o.NoFreelistSync = false
-	}
-
-	// By default, we want to set InitialMmapSize to 100GB, but only on 64bit platforms.
-	// Otherwise, we set it to whatever the value of VAULT_RAFT_INITIAL_MMAP_SIZE
-	// is, assuming it can be parsed as an int. Bolt itself sets this to 0 by default,
-	// so if users are wanting to turn this off, they can also set it to 0. Setting it
-	// to a negative value is the same as not setting it at all.
-	if os.Getenv("VAULT_RAFT_INITIAL_MMAP_SIZE") == "" {
-		o.InitialMmapSize = initialMmapSize
-	} else {
-		imms, err := strconv.Atoi(os.Getenv("VAULT_RAFT_INITIAL_MMAP_SIZE"))
-
-		// If there's an error here, it means they passed something that's not convertible to
-		// a number. Rather than fail startup, just ignore it.
-		if err == nil && imms > 0 {
-			o.InitialMmapSize = imms
-		}
-	}
-
-	return o
-}
-
-func etcdboltOptions(path string) *etcdbolt.Options {
-	o := &etcdbolt.Options{
-		Timeout:        1 * time.Second,
-		FreelistType:   etcdbolt.FreelistMapType,
-		NoFreelistSync: true,
-		MmapFlags:      getMmapFlags(path),
-	}
-
-	if os.Getenv("VAULT_RAFT_FREELIST_TYPE") == "array" {
-		o.FreelistType = etcdbolt.FreelistArrayType
-	}
-
-	if os.Getenv("VAULT_RAFT_FREELIST_SYNC") != "" {
-		o.NoFreelistSync = false
-	}
-
-	// By default, we want to set InitialMmapSize to 100GB, but only on 64bit platforms.
-	// Otherwise, we set it to whatever the value of VAULT_RAFT_INITIAL_MMAP_SIZE
-	// is, assuming it can be parsed as an int. Bolt itself sets this to 0 by default,
-	// so if users are wanting to turn this off, they can also set it to 0. Setting it
-	// to a negative value is the same as not setting it at all.
-	if os.Getenv("VAULT_RAFT_INITIAL_MMAP_SIZE") == "" {
-		o.InitialMmapSize = initialMmapSize
-	} else {
-		imms, err := strconv.Atoi(os.Getenv("VAULT_RAFT_INITIAL_MMAP_SIZE"))
-
-		// If there's an error here, it means they passed something that's not convertible to
-		// a number. Rather than fail startup, just ignore it.
-		if err == nil && imms > 0 {
-			o.InitialMmapSize = imms
-		}
-	}
-
-	return o
-}
-
 func isRaftLogVerifyCheckpoint(l *raft.Log) bool {
 	if !bytes.Equal(l.Data, []byte{byte(verifierCheckpointOp)}) {
 		return false
@@ -2384,3 +2323,24 @@ func isRaftLogVerifyCheckpoint(l *raft.Log) bool {
 	// Must be the last chunk of a chunked object that has chunking meta
 	return false
 }
+
+func (b *RaftBackend) ReloadConfig(config raft.ReloadableConfig) error {
+	b.l.RLock()
+	defer b.l.RUnlock()
+
+	if b.raft != nil {
+		if err := b.raft.ReloadConfig(config); err != nil {
+			return err
+		} else {
+			b.logger.Info("reloaded raft config", "settings", config)
+		}
+	}
+	return nil
+}
+
+// GetStorageConfig returns a map with the raft configuration from the storage stanza in the config file.
+func (b *RaftBackend) GetStorageConfig() map[string]string {
+	storageConfig := make(map[string]string)
+	maps.Copy(storageConfig, b.conf)
+	return storageConfig
+}
diff --git a/physical/raft/raft_autopilot.go b/physical/raft/raft_autopilot.go
index d1a9de6b679..367d632a7a6 100644
--- a/physical/raft/raft_autopilot.go
+++ b/physical/raft/raft_autopilot.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
@@ -31,6 +31,7 @@ const (
 	CleanupDeadServersFalse    CleanupDeadServersValue = 2
 	AutopilotUpgradeVersionTag string                  = "upgrade_version"
 	AutopilotRedundancyZoneTag string                  = "redundancy_zone"
+	emptyRedundancyZone                                = ""
 )
 
 func (c CleanupDeadServersValue) Value() bool {
@@ -89,6 +90,27 @@ type AutopilotConfig struct {
 	UpgradeVersionTag string `mapstructure:"upgrade_version_tag"`
 }
 
+func (ac *AutopilotConfig) String() string {
+	s := "CleanupDeadServers:%t " +
+		"LastContactThreshold:%s " +
+		"DeadServerLastContactThreshold:%s " +
+		"MaxTrailingLogs:%d " +
+		"MinQuorum:%d " +
+		"ServerStabilizationTime:%s " +
+		"DisableUpgradeMigration:%t " +
+		"RedundancyZoneTag:%s " +
+		"UpgradeVersionTag:%s"
+	return fmt.Sprintf(s, ac.CleanupDeadServers,
+		ac.LastContactThreshold,
+		ac.DeadServerLastContactThreshold,
+		ac.MaxTrailingLogs,
+		ac.MinQuorum,
+		ac.ServerStabilizationTime,
+		ac.DisableUpgradeMigration,
+		ac.RedundancyZoneTag,
+		ac.UpgradeVersionTag)
+}
+
 // Merge combines the supplied config with the receiver. Supplied ones take
 // priority.
 func (to *AutopilotConfig) Merge(from *AutopilotConfig) {
@@ -190,6 +212,99 @@ type FollowerState struct {
 	RedundancyZone  string
 }
 
+func (f *FollowerState) neverSentHeartbeat() bool {
+	// We can't use LastHeartbeat to determine if the node has been contacted,
+	// since we set it for every node in the cluster during post-unseal.
+	// Instead, check if the node has reported any applied index or term.
+	// These will both be 0 if the node has never sent an echo.
+	return f.LastTerm == 0 && f.AppliedIndex == 0
+}
+
+// partialCopy returns a partial copy of the follower state.
+// This copy uses the same pointer to the IsDead
+// atomic field. We need to do this to ensure that
+// an update of the IsDead boolean will still be
+// accessible in a copied state.
+func (f *FollowerState) partialCopy() *FollowerState {
+	return &FollowerState{
+		AppliedIndex:    f.AppliedIndex,
+		LastHeartbeat:   f.LastHeartbeat,
+		LastTerm:        f.LastTerm,
+		IsDead:          f.IsDead,
+		DesiredSuffrage: f.DesiredSuffrage,
+		Version:         f.Version,
+		UpgradeVersion:  f.UpgradeVersion,
+		RedundancyZone:  f.RedundancyZone,
+	}
+}
+
+// PersistedFollowerState holds the information that gets persisted to storage
+type PersistedFollowerState struct {
+	Version        string  `json:"version"`
+	UpgradeVersion string  `json:"upgrade_version"`
+	RedundancyZone *string `json:"redundancy_zone"`
+}
+
+type PersistedFollowerStates struct {
+	l      sync.RWMutex
+	States map[string]PersistedFollowerState
+}
+
+// shouldUpdate checks if the persisted state contains the same servers as the
+// current autopilot state. If grabLock is true, a read lock is acquired before
+// accessing the map
+func (p *PersistedFollowerStates) shouldUpdate(state *autopilot.State, grabLock bool) bool {
+	if grabLock {
+		p.l.RLock()
+		defer p.l.RUnlock()
+	}
+	if len(state.Servers) != len(p.States) {
+		return true
+	}
+	for id, server := range state.Servers {
+		persistedServer, found := p.States[string(id)]
+		if !found {
+			return true
+		}
+		if server.Server.Version != persistedServer.Version ||
+			server.Server.Meta[AutopilotUpgradeVersionTag] != persistedServer.UpgradeVersion ||
+			persistedServer.RedundancyZone == nil ||
+			server.Server.Meta[AutopilotRedundancyZoneTag] != *persistedServer.RedundancyZone {
+			return true
+		}
+	}
+	return false
+}
+
+// updatePersistedState checks if the persisted state matches the current
+// autopilot state. If not, the state is replaced and persisted
+func (d *Delegate) updatePersistedState(state *autopilot.State) error {
+	if !d.persistedState.shouldUpdate(state, true) {
+		return nil
+	}
+	newStates := make(map[string]PersistedFollowerState)
+	for id, server := range state.Servers {
+		redundancyZone := server.Server.Meta[AutopilotRedundancyZoneTag]
+		newStates[string(id)] = PersistedFollowerState{
+			Version:        server.Server.Version,
+			UpgradeVersion: server.Server.Meta[AutopilotUpgradeVersionTag],
+			RedundancyZone: &redundancyZone,
+		}
+	}
+	d.persistedState.l.Lock()
+	defer d.persistedState.l.Unlock()
+	if !d.persistedState.shouldUpdate(state, false) {
+		return nil
+	}
+	d.logger.Debug("updating autopilot persisted state")
+	err := d.saveStateFn(newStates)
+	if err != nil {
+		return err
+	}
+	d.persistedState.States = newStates
+	return nil
+}
+
 // EchoRequestUpdate is here to avoid 1) the list of arguments to Update() getting huge 2) an import cycle on the vault package
 type EchoRequestUpdate struct {
 	NodeID          string
@@ -294,13 +409,17 @@ type Delegate struct {
 	dl               sync.RWMutex
 	inflightRemovals map[raft.ServerID]bool
 	emptyVersionLogs map[raft.ServerID]struct{}
+	persistedState   *PersistedFollowerStates
+	saveStateFn      func(p map[string]PersistedFollowerState) error
 }
 
-func NewDelegate(b *RaftBackend) *Delegate {
+func NewDelegate(b *RaftBackend, persistedStates map[string]PersistedFollowerState, savePersistedStates func(p map[string]PersistedFollowerState) error) *Delegate {
 	return &Delegate{
 		RaftBackend:      b,
 		inflightRemovals: make(map[raft.ServerID]bool),
 		emptyVersionLogs: make(map[raft.ServerID]struct{}),
+		persistedState:   &PersistedFollowerStates{States: persistedStates},
+		saveStateFn:      savePersistedStates,
 	}
 }
 
@@ -344,6 +463,13 @@ func (d *Delegate) NotifyState(state *autopilot.State) {
 				metrics.SetGaugeWithLabels([]string{"autopilot", "node", "healthy"}, 0, labels)
 			}
 		}
+
+		// if there is a change in versions or membership, we should update
+		// our persisted state
+		err := d.updatePersistedState(state)
+		if err != nil {
+			d.logger.Error("failed to persist autopilot state", "error", err)
+		}
 	}
 }
 
@@ -399,6 +525,9 @@ func (d *Delegate) KnownServers() map[raft.ServerID]*autopilot.Server {
 	d.followerStates.l.RLock()
 	defer d.followerStates.l.RUnlock()
 
+	d.persistedState.l.RLock()
+	defer d.persistedState.l.RUnlock()
+
 	ret := make(map[raft.ServerID]*autopilot.Server)
 	for id, state := range d.followerStates.followers {
 		// If the server is not in raft configuration, even if we received a follower
@@ -407,22 +536,16 @@ func (d *Delegate) KnownServers() map[raft.ServerID]*autopilot.Server {
 			continue
 		}
 
-		// If version isn't found in the state, fake it using the version from the leader so that autopilot
-		// doesn't demote the node to a non-voter, just because of a missed heartbeat.
 		currentServerID := raft.ServerID(id)
-		followerVersion := state.Version
-		leaderVersion := d.effectiveSDKVersion
-		d.dl.Lock()
-		if followerVersion == "" {
-			if _, ok := d.emptyVersionLogs[currentServerID]; !ok {
-				d.logger.Trace("received empty Vault version in heartbeat state. faking it with the leader version for now", "id", id, "leader version", leaderVersion)
-				d.emptyVersionLogs[currentServerID] = struct{}{}
-			}
-			followerVersion = leaderVersion
-		} else {
-			delete(d.emptyVersionLogs, currentServerID)
+		followerVersion, upgradeVersion := d.determineFollowerVersions(id, state)
+		redundancyZone := d.determineRedundancyZone(id, state)
+		if state.UpgradeVersion != upgradeVersion || state.RedundancyZone != redundancyZone {
+			// We only have a read lock on state, so we can't modify it
+			// safely. Instead, copy it to override the upgrade version
+			state = state.partialCopy()
+			state.UpgradeVersion = upgradeVersion
+			state.RedundancyZone = redundancyZone
 		}
-		d.dl.Unlock()
 
 		server := &autopilot.Server{
 			ID:          currentServerID,
@@ -465,7 +588,7 @@ func (d *Delegate) KnownServers() map[raft.ServerID]*autopilot.Server {
 		NodeStatus:  autopilot.NodeAlive,
 		NodeType:    autopilot.NodeVoter, // The leader must be a voter
 		Meta: d.meta(&FollowerState{
-			UpgradeVersion: d.EffectiveVersion(),
+			UpgradeVersion: d.UpgradeVersion(),
 			RedundancyZone: d.RedundancyZone(),
 		}),
 		Version:  d.effectiveSDKVersion,
@@ -476,6 +599,87 @@ func (d *Delegate) KnownServers() map[raft.ServerID]*autopilot.Server {
 	return ret
 }
 
+// determineRedundancyZone will return the correct redundancy zone to report for
+// the given follower
+func (d *Delegate) determineRedundancyZone(id string, state *FollowerState) string {
+	// If the follower has a non-empty redundancy zone, use that
+	if state.RedundancyZone != emptyRedundancyZone {
+		return state.RedundancyZone
+	}
+
+	// If we don't have any persisted states (which can happen on an upgrade to
+	// 1.18) we don't have any other option; return an empty zone (which is the
+	// same as the follower's reported state)
+	if len(d.persistedState.States) == 0 {
+		return emptyRedundancyZone
+	}
+
+	// If we've ever gotten a heartbeat from this follower, then trust that
+	// it reported its empty zone correctly
+	if !state.neverSentHeartbeat() {
+		return emptyRedundancyZone
+	}
+
+	// Check if we have any persisted state for this follower, and if that
+	// state includes a redundancy zone. If either of these doesn't exist, we
+	// can't know the follower's zone. Assume it's empty.
+	persistedState, ok := d.persistedState.States[id]
+	if !ok || persistedState.RedundancyZone == nil {
+		return emptyRedundancyZone
+	}
+
+	d.logger.Debug("using redundancy zone from persisted states", "id", id, "redundancy_zone", *persistedState.RedundancyZone)
+	return *persistedState.RedundancyZone
+}
+
+// determineFollowerVersions uses the following logic:
+//   - if the version and upgrade version are present in the follower state,
+//     return those.
+//   - if the persisted states map is empty, it means that persisted states
+//     don't exist. This happens on an upgrade to 1.18. Use the leader node's
+//     versions.
+//   - use the versions in the persisted states map
+//
+// This function must be called with a lock on d.followerStates
+// and d.persistedStates.
+func (d *Delegate) determineFollowerVersions(id string, state *FollowerState) (version string, upgradeVersion string) {
+	// if we have both versions in follower states, use those
+	if state.Version != "" && state.UpgradeVersion != "" {
+		return state.Version, state.UpgradeVersion
+	}
+
+	version = state.Version
+	upgradeVersion = state.UpgradeVersion
+
+	// the persistedState map should only be empty on upgrades
+	// to 1.18.x. This is the only case where we'll stub with
+	// the leader's versions
+	if len(d.persistedState.States) == 0 {
+		if version == "" {
+			version = d.effectiveSDKVersion
+			d.logger.Debug("no persisted state, using leader version", "id", id, "version", version)
+		}
+		if upgradeVersion == "" {
+			upgradeVersion = d.upgradeVersion
+			d.logger.Debug("no persisted state, using leader upgrade version version", "id", id, "upgrade_version", upgradeVersion)
+		}
+		return version, upgradeVersion
+	}
+
+	// Use the persistedStates map to fill in the sdk
+	// and upgrade versions
+	pState := d.persistedState.States[id]
+	if version == "" {
+		version = pState.Version
+		d.logger.Debug("using follower version from persisted states", "id", id, "version", version)
+	}
+	if upgradeVersion == "" {
+		upgradeVersion = pState.UpgradeVersion
+		d.logger.Debug("using upgrade version from persisted states", "id", id, "upgrade_version", upgradeVersion)
+	}
+	return version, upgradeVersion
+}
+
 // RemoveFailedServer is called by the autopilot library when it desires a node
 // to be removed from the raft configuration. This function removes the node
 // from the raft cluster and stops tracking its information in follower states.
@@ -511,6 +715,10 @@ func (d *Delegate) RemoveFailedServer(server *autopilot.Server) {
 		}
 
 		d.followerStates.Delete(string(server.ID))
+		_, err := d.RemovedServerCleanup(context.Background(), string(server.ID))
+		if err != nil {
+			d.logger.Error("failed to run cleanup", "error", err)
+		}
 	}()
 }
 
@@ -611,7 +819,8 @@ func (b *RaftBackend) StopAutopilot() {
 	if b.autopilot == nil {
 		return
 	}
-	b.autopilot.Stop()
+	stopCh := b.autopilot.Stop()
+	<-stopCh
 	b.autopilot = nil
 	b.followerHeartbeatTicker.Stop()
 }
@@ -808,11 +1017,19 @@ func (b *RaftBackend) DisableAutopilot() {
 	b.l.Unlock()
 }
 
+type AutopilotSetupOptions struct {
+	StorageConfig       *AutopilotConfig
+	FollowerStates      *FollowerStates
+	Disable             bool
+	PersistedStates     map[string]PersistedFollowerState
+	SavePersistedStates func(p map[string]PersistedFollowerState) error
+}
+
 // SetupAutopilot gathers information required to configure autopilot and starts
 // it. If autopilot is disabled, this function does nothing.
-func (b *RaftBackend) SetupAutopilot(ctx context.Context, storageConfig *AutopilotConfig, followerStates *FollowerStates, disable bool) {
+func (b *RaftBackend) SetupAutopilot(ctx context.Context, opts *AutopilotSetupOptions) {
 	b.l.Lock()
-	if disable || os.Getenv("VAULT_RAFT_AUTOPILOT_DISABLE") != "" {
+	if opts.Disable || os.Getenv("VAULT_RAFT_AUTOPILOT_DISABLE") != "" {
 		b.disableAutopilot = true
 	}
 
@@ -826,7 +1043,9 @@ func (b *RaftBackend) SetupAutopilot(ctx context.Context, storageConfig *Autopil
 	b.autopilotConfig = b.defaultAutopilotConfig()
 
 	// Merge the setting provided over the API
-	b.autopilotConfig.Merge(storageConfig)
+	b.autopilotConfig.Merge(opts.StorageConfig)
+
+	infoArgs := []interface{}{"config", b.autopilotConfig}
 
 	// Create the autopilot instance
 	options := []autopilot.Option{
@@ -835,17 +1054,19 @@ func (b *RaftBackend) SetupAutopilot(ctx context.Context, storageConfig *Autopil
 	}
 	if b.autopilotReconcileInterval != 0 {
 		options = append(options, autopilot.WithReconcileInterval(b.autopilotReconcileInterval))
+		infoArgs = append(infoArgs, []interface{}{"reconcile_interval", b.autopilotReconcileInterval}...)
 	}
 	if b.autopilotUpdateInterval != 0 {
 		options = append(options, autopilot.WithUpdateInterval(b.autopilotUpdateInterval))
+		infoArgs = append(infoArgs, []interface{}{"update_interval", b.autopilotUpdateInterval}...)
 	}
-	b.autopilot = autopilot.New(b.raft, NewDelegate(b), options...)
-	b.followerStates = followerStates
+	delegate := NewDelegate(b, opts.PersistedStates, opts.SavePersistedStates)
+	b.autopilot = autopilot.New(b.raft, delegate, options...)
+	b.followerStates = opts.FollowerStates
 	b.followerHeartbeatTicker = time.NewTicker(1 * time.Second)
-
 	b.l.Unlock()
 
-	b.logger.Info("starting autopilot", "config", b.autopilotConfig, "reconcile_interval", b.autopilotReconcileInterval)
+	b.logger.Info("starting autopilot", infoArgs...)
 	b.autopilot.Start(ctx)
 
 	go b.startFollowerHeartbeatTracker()
diff --git a/physical/raft/raft_test.go b/physical/raft/raft_test.go
index 2222253b7e0..490aa9358f2 100644
--- a/physical/raft/raft_test.go
+++ b/physical/raft/raft_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
@@ -15,20 +15,20 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/go-test/deep"
 	"github.com/golang/protobuf/proto"
-	bolt "github.com/hashicorp-forge/bbolt"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/base62"
-	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/raft"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/stretchr/testify/require"
+	bolt "go.etcd.io/bbolt"
 )
 
 func testBothRaftBackends(t *testing.T, f func(t *testing.T, raftWALValue string)) {
@@ -285,209 +285,6 @@ func TestRaft_VerifierEnabled(t *testing.T) {
 	})
 }
 
-// TestRaft_ParseRaftWalBackend ensures that the raft_wal config option parses correctly and returns an error if not
-func TestRaft_ParseRaftWalBackend(t *testing.T) {
-	raftDir := t.TempDir()
-	conf := map[string]string{
-		"path":     raftDir,
-		"node_id":  "abc123",
-		"raft_wal": "notabooleanlol",
-	}
-
-	_, err := NewRaftBackend(conf, hclog.NewNullLogger())
-	if err == nil {
-		t.Fatal("expected an error but got none")
-	}
-
-	if !strings.Contains(err.Error(), "does not parse as a boolean") {
-		t.Fatal("expected an error about parsing config keys but got none")
-	}
-}
-
-// TestRaft_ParseRaftWalVerifierEnabled checks to make sure we error correctly if raft_log_verifier_enabled is not a boolean
-func TestRaft_ParseRaftWalVerifierEnabled(t *testing.T) {
-	raftDir := t.TempDir()
-	conf := map[string]string{
-		"path":                      raftDir,
-		"node_id":                   "abc123",
-		"raft_wal":                  "true",
-		"raft_log_verifier_enabled": "notabooleanlol",
-	}
-
-	_, err := NewRaftBackend(conf, hclog.NewNullLogger())
-	if err == nil {
-		t.Fatal("expected an error but got none")
-	}
-
-	if !strings.Contains(err.Error(), "does not parse as a boolean") {
-		t.Fatal("expected an error about parsing config keys but got none")
-	}
-}
-
-// TestRaft_ParseRaftWalVerifierInterval checks to make sure we handle various intervals correctly and have a default
-func TestRaft_ParseRaftWalVerifierInterval(t *testing.T) {
-	testCases := []struct {
-		name             string
-		givenInterval    string
-		expectedInterval string
-		shouldError      bool
-	}{
-		{
-			"zero",
-			"0s",
-			defaultRaftLogVerificationInterval.String(),
-			false,
-		},
-		{
-			"one",
-			"1s",
-			defaultRaftLogVerificationInterval.String(),
-			false,
-		},
-		{
-			"nothing",
-			"",
-			defaultRaftLogVerificationInterval.String(),
-			false,
-		},
-		{
-			"default",
-			"60s",
-			defaultRaftLogVerificationInterval.String(),
-			false,
-		},
-		{
-			"more than the default",
-			"75s",
-			"75s",
-			false,
-		},
-		{
-			"obviously wrong",
-			"notadurationlol",
-			"",
-			true,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			raftDir := t.TempDir()
-			conf := map[string]string{
-				"path":                           raftDir,
-				"node_id":                        "abc123",
-				"raft_wal":                       "true",
-				"raft_log_verifier_enabled":      "true",
-				"raft_log_verification_interval": tc.givenInterval,
-			}
-
-			rbRaw, err := NewRaftBackend(conf, hclog.NewNullLogger())
-			if tc.shouldError {
-				if err == nil {
-					t.Fatal("expected an error but got none")
-				}
-
-				// return early, since we got the error we wanted
-				return
-			}
-			if !tc.shouldError && err != nil {
-				t.Fatal(err)
-			}
-
-			rb := rbRaw.(*RaftBackend)
-
-			parsedExpectedInterval, err := parseutil.ParseDurationSecond(tc.expectedInterval)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			if parsedExpectedInterval != rb.verificationInterval() {
-				t.Fatal("expected intervals to match but they didn't")
-			}
-		})
-	}
-}
-
-// TestRaft_ParseAutopilotUpgradeVersion tests that autopilot_upgrade_version parses correctly and returns an error if not
-func TestRaft_ParseAutopilotUpgradeVersion(t *testing.T) {
-	raftDir := t.TempDir()
-	conf := map[string]string{
-		"path":                      raftDir,
-		"node_id":                   "abc123",
-		"autopilot_upgrade_version": "hahano",
-	}
-
-	_, err := NewRaftBackend(conf, hclog.NewNullLogger())
-	if err == nil {
-		t.Fatal("expected an error but got none")
-	}
-
-	if !strings.Contains(err.Error(), "does not parse") {
-		t.Fatal("expected an error about unparseable versions but got none")
-	}
-}
-
-func TestRaft_ParseNonVoter(t *testing.T) {
-	p := func(s string) *string {
-		return &s
-	}
-
-	for _, retryJoinConf := range []string{"", "not-empty"} {
-		t.Run(retryJoinConf, func(t *testing.T) {
-			for name, tc := range map[string]struct {
-				envValue             *string
-				configValue          *string
-				expectNonVoter       bool
-				invalidNonVoterValue bool
-			}{
-				"valid false":                {nil, p("false"), false, false},
-				"valid true":                 {nil, p("true"), true, false},
-				"invalid empty":              {nil, p(""), false, true},
-				"invalid truthy":             {nil, p("no"), false, true},
-				"invalid":                    {nil, p("totallywrong"), false, true},
-				"valid env false":            {p("false"), nil, true, false},
-				"valid env true":             {p("true"), nil, true, false},
-				"valid env not boolean":      {p("anything"), nil, true, false},
-				"valid env empty":            {p(""), nil, false, false},
-				"neither set, default false": {nil, nil, false, false},
-				"both set, env preferred":    {p("true"), p("false"), true, false},
-			} {
-				t.Run(name, func(t *testing.T) {
-					if tc.envValue != nil {
-						t.Setenv(EnvVaultRaftNonVoter, *tc.envValue)
-					}
-					raftDir := t.TempDir()
-					conf := map[string]string{
-						"path":       raftDir,
-						"node_id":    "abc123",
-						"retry_join": retryJoinConf,
-					}
-					if tc.configValue != nil {
-						conf[raftNonVoterConfigKey] = *tc.configValue
-					}
-
-					backend, err := NewRaftBackend(conf, hclog.NewNullLogger())
-					switch {
-					case tc.invalidNonVoterValue || (retryJoinConf == "" && tc.expectNonVoter):
-						if err == nil {
-							t.Fatal("expected an error but got none")
-						}
-					default:
-						if err != nil {
-							t.Fatalf("expected no error but got: %s", err)
-						}
-
-						raftBackend := backend.(*RaftBackend)
-						if tc.expectNonVoter != raftBackend.NonVoter() {
-							t.Fatalf("expected %s %v but got %v", raftNonVoterConfigKey, tc.expectNonVoter, raftBackend.NonVoter())
-						}
-					}
-				})
-			}
-		})
-	}
-}
-
 func TestRaft_Backend_LargeKey(t *testing.T) {
 	t.Parallel()
 
@@ -962,6 +759,47 @@ func TestRaft_TransactionalBackend_ThreeNode(t *testing.T) {
 	})
 }
 
+// TestRaft_Removed creates a 3 node cluster and checks that the nodes are not
+// removed, then verifies that node3 marks itself as removed when it gets
+// removed from the cluster
+func TestRaft_Removed(t *testing.T) {
+	t.Parallel()
+	testBothRaftBackends(t, func(t *testing.T, raftWALValue string) {
+		conf := map[string]string{
+			"trailing_logs": "100",
+			"raft_wal":      raftWALValue,
+		}
+
+		raft1, _ := GetRaftWithConfig(t, true, true, conf)
+		raft2, _ := GetRaftWithConfig(t, false, true, conf)
+		raft3, _ := GetRaftWithConfig(t, false, true, conf)
+
+		addPeer(t, raft1, raft2)
+		addPeer(t, raft1, raft3)
+		physical.ExerciseBackend(t, raft1)
+
+		commitIdx := raft1.CommittedIndex()
+		ensureCommitApplied(t, commitIdx, raft2)
+		ensureCommitApplied(t, commitIdx, raft3)
+
+		require.False(t, raft1.IsRemoved())
+		require.False(t, raft2.IsRemoved())
+		require.False(t, raft3.IsRemoved())
+
+		callbackCalled := atomic.Bool{}
+		raft3.SetRemovedCallback(func() {
+			callbackCalled.Store(true)
+		})
+		err := raft1.RemovePeer(context.Background(), raft3.NodeID())
+		require.NoError(t, err)
+
+		require.Eventually(t, raft3.IsRemoved, 15*time.Second, 500*time.Millisecond)
+		require.True(t, callbackCalled.Load())
+		require.False(t, raft1.IsRemoved())
+		require.False(t, raft2.IsRemoved())
+	})
+}
+
 // TestRaft_TransactionalLimitsEnvOverride ensures the ENV var overrides for
 // transaction size limits are plumbed through as expected.
 func TestRaft_TransactionalLimitsEnvOverride(t *testing.T) {
@@ -1056,7 +894,7 @@ func TestRaft_Backend_Performance(t *testing.T) {
 
 		defaultConfig := raft.DefaultConfig()
 		localConfig := raft.DefaultConfig()
-		err := b.applyConfigSettings(localConfig)
+		err := ApplyConfigSettings(b.logger, b.conf, localConfig)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -1077,7 +915,7 @@ func TestRaft_Backend_Performance(t *testing.T) {
 		}
 
 		localConfig = raft.DefaultConfig()
-		err = b.applyConfigSettings(localConfig)
+		err = ApplyConfigSettings(b.logger, b.conf, localConfig)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -1098,7 +936,7 @@ func TestRaft_Backend_Performance(t *testing.T) {
 		}
 
 		localConfig = raft.DefaultConfig()
-		err = b.applyConfigSettings(localConfig)
+		err = ApplyConfigSettings(b.logger, b.conf, localConfig)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/physical/raft/raft_util.go b/physical/raft/raft_util.go
index 722f8e2fc8d..438dc6872d0 100644
--- a/physical/raft/raft_util.go
+++ b/physical/raft/raft_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/physical/raft/raft_util_stubs_oss.go b/physical/raft/raft_util_stubs_oss.go
new file mode 100644
index 00000000000..dc2e1cc7fad
--- /dev/null
+++ b/physical/raft/raft_util_stubs_oss.go
@@ -0,0 +1,18 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package raft
+
+import "github.com/hashicorp/go-hclog"
+
+//go:generate go run github.com/hashicorp/vault/tools/stubmaker
+
+func (b *RaftBackend) entrySizeLimitForPath(path string) uint64 {
+	return b.maxEntrySize
+}
+
+func emitEntWarning(logger hclog.Logger, field string) {
+	logger.Warn("configuration for a Vault Enterprise feature has been ignored", "field", field)
+}
diff --git a/physical/raft/snapshot.go b/physical/raft/snapshot.go
index b584af7665e..fb93d4f0024 100644
--- a/physical/raft/snapshot.go
+++ b/physical/raft/snapshot.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
@@ -18,11 +18,11 @@ import (
 	"time"
 
 	"github.com/golang/protobuf/proto"
-	bolt "github.com/hashicorp-forge/bbolt"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/raft"
 	"github.com/hashicorp/vault/sdk/plugin/pb"
 	"github.com/rboyer/safeio"
+	bolt "go.etcd.io/bbolt"
 	"go.uber.org/atomic"
 )
 
@@ -149,7 +149,7 @@ func (f *BoltSnapshotStore) List() ([]*raft.SnapshotMeta, error) {
 	return []*raft.SnapshotMeta{meta}, nil
 }
 
-// getBoltSnapshotMeta returns the fsm's latest state and configuration.
+// getMetaFromFSM returns the fsm's latest state and configuration.
 func (f *BoltSnapshotStore) getMetaFromFSM() (*raft.SnapshotMeta, error) {
 	latestIndex, latestConfig := f.fsm.LatestState()
 	meta := &raft.SnapshotMeta{
@@ -267,7 +267,7 @@ func (f *BoltSnapshotStore) openFromFile(id string) (*raft.SnapshotMeta, io.Read
 	filename := filepath.Join(f.path, id, databaseFilename)
 	installer := &boltSnapshotInstaller{
 		meta:       meta,
-		ReadCloser: ioutil.NopCloser(strings.NewReader(filename)),
+		ReadCloser: io.NopCloser(strings.NewReader(filename)),
 		filename:   filename,
 	}
 
@@ -364,49 +364,10 @@ func (s *BoltSnapshotSink) writeBoltDBFile() error {
 		defer close(s.doneWritingCh)
 		defer boltDB.Close()
 
-		// The delimted reader will parse full proto messages from the snapshot
-		// data.
-		protoReader := NewDelimitedReader(reader, math.MaxInt32)
-		defer protoReader.Close()
-
-		var done bool
-		var keys int
-		entry := new(pb.StorageEntry)
-		for !done {
-			err := boltDB.Update(func(tx *bolt.Tx) error {
-				b, err := tx.CreateBucketIfNotExists(dataBucketName)
-				if err != nil {
-					return err
-				}
-
-				// Commit in batches of 50k. Bolt holds all the data in memory and
-				// doesn't split the pages until commit so we do incremental writes.
-				for i := 0; i < 50000; i++ {
-					err := protoReader.ReadMsg(entry)
-					if err != nil {
-						if err == io.EOF {
-							done = true
-							return nil
-						}
-						return err
-					}
-
-					err = b.Put([]byte(entry.Key), entry.Value)
-					if err != nil {
-						return err
-					}
-					keys += 1
-				}
-
-				return nil
-			})
-			if err != nil {
-				s.logger.Error("snapshot write: failed to write transaction", "error", err)
-				s.writeError = err
-				return
-			}
-
-			s.logger.Trace("snapshot write: writing keys", "num_written", keys)
+		err := loadSnapshot(context.Background(), boltDB, s.logger, reader, nil, false)
+		if err != nil {
+			s.writeError = err
+			return
 		}
 	}()
 
@@ -535,3 +496,77 @@ func snapshotName(term, index uint64) string {
 	msec := now.UnixNano() / int64(time.Millisecond)
 	return fmt.Sprintf("%d-%d-%d", term, index, msec)
 }
+
+// LoadReadOnlySnapshot loads a snapshot from a file into the supplied FSM.
+// It sets the fill percent of the underlying boltDB bucket to 1.0. This is a
+// blocking call and will not return until the snapshot has been written to the
+// FSM. The caller is responsible for closing the reader.
+// If pathsToFilter is not nil, the function will filter out any keys that are
+// found in the pathsToFilter tree.
+func LoadReadOnlySnapshot(ctx context.Context, fsm *FSM, snapshotFile io.ReadCloser, filterKey func(key string) bool, logger log.Logger) error {
+	return loadSnapshot(ctx, fsm.db, logger, snapshotFile, filterKey, true)
+}
+
+// loadSnapshot loads a snapshot from a file into the supplied boltDB database.
+// This is a blocking call and will not return until the snapshot has
+// been written to the FSM. The caller is responsible for closing the reader.
+// If readOnly is true, it sets the fill percent of the underlying boltDB bucket
+// to 1.0.
+// If pathsToFilter is not nil, the function will filter out any keys that are
+// found in the pathsToFilter tree.
+func loadSnapshot(ctx context.Context, db *bolt.DB, logger log.Logger, snapshotFile io.ReadCloser, filterKey func(key string) bool, readOnly bool) error {
+	// The delimited reader will parse full proto messages from the snapshot data.
+	protoReader := NewDelimitedReader(snapshotFile, math.MaxInt32)
+	defer protoReader.Close()
+
+	var done bool
+	var keys int
+	entry := new(pb.StorageEntry)
+	for !done {
+		err := db.Update(func(tx *bolt.Tx) error {
+			select {
+			case <-ctx.Done():
+				return fmt.Errorf("context canceled while loading snapshot: %w", ctx.Err())
+			default:
+			}
+			b, err := tx.CreateBucketIfNotExists(dataBucketName)
+			if readOnly {
+				b.FillPercent = 1.0
+			}
+			if err != nil {
+				return err
+			}
+
+			// Commit in batches of 50k. Bolt holds all the data in memory and
+			// doesn't split the pages until commit so we do incremental writes.
+			for i := 0; i < 50000; i++ {
+				err := protoReader.ReadMsg(entry)
+				if err != nil {
+					if err == io.EOF {
+						done = true
+						return nil
+					}
+					return err
+				}
+
+				if filterKey != nil && filterKey(entry.Key) {
+					continue
+				}
+
+				err = b.Put([]byte(entry.Key), entry.Value)
+				if err != nil {
+					return err
+				}
+				keys += 1
+			}
+			return nil
+		})
+		if err != nil {
+			logger.Error("snapshot write: failed to write transaction", "error", err)
+			return err
+		}
+		logger.Trace("snapshot write: writing keys", "num_written", keys)
+	}
+
+	return nil
+}
diff --git a/physical/raft/snapshot_test.go b/physical/raft/snapshot_test.go
index d85af4da5f7..62c173f8294 100644
--- a/physical/raft/snapshot_test.go
+++ b/physical/raft/snapshot_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
@@ -19,10 +19,13 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-hclog"
+	iradix "github.com/hashicorp/go-immutable-radix"
 	"github.com/hashicorp/raft"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/sdk/plugin/pb"
+	"github.com/stretchr/testify/require"
 )
 
 type idAddr struct {
@@ -495,7 +498,7 @@ func TestRaft_Snapshot_Take_Restore(t *testing.T) {
 		}
 	}
 
-	snapFile, cleanup, metadata, err := raft1.WriteSnapshotToTemp(ioutil.NopCloser(recorder.Body), nil)
+	snapFile, cleanup, metadata, err := raft1.WriteSnapshotToTemp(io.NopCloser(recorder.Body), nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -958,3 +961,52 @@ func TestBoltSnapshotStore_CloseFailure(t *testing.T) {
 		t.Fatal("expected write to fail")
 	}
 }
+
+// TestLoadReadOnlySnapshot loads a test snapshot file and verifies that there are no
+// errors, and that the expected paths are excluded from the FSM.
+func TestLoadReadOnlySnapshot(t *testing.T) {
+	t.Parallel()
+	// Load a test snapshot file from the testdata directory.
+	// The snapshot contains the following paths:
+	//   * /different/path/to/exclude
+	//   * /path/to/exclude/1
+	//   * /path/to/exclude/2
+	//   * /path/to/keep
+	testSnapshotFilePath := "testdata/TestLoadReadOnlySnapshot.bin"
+	dir := t.TempDir()
+	logger := corehelpers.NewTestLogger(t)
+	snapshotFile, err := os.Open(testSnapshotFilePath)
+	require.NoError(t, err)
+	defer snapshotFile.Close()
+
+	// Create a radix tree containing paths to exclude.
+	pathsToExclude := iradix.New()
+	txn := pathsToExclude.Txn()
+	_, _ = txn.Insert([]byte("/path/to/exclude"), []byte("value"))
+	_, _ = txn.Insert([]byte("/path/to/exclude/1"), []byte("value"))
+	_, _ = txn.Insert([]byte("/different/path/to/exclude"), []byte("value"))
+	pathsToExclude = txn.Commit()
+	toExclude := func(key string) bool {
+		_, _, ok := pathsToExclude.Root().LongestPrefix([]byte(key))
+		return ok
+	}
+
+	// Create an FSM to load the snapshot data into.
+	fsm, err := NewFSM(dir, "test-fsm", logger)
+
+	err = LoadReadOnlySnapshot(context.Background(), fsm, snapshotFile, toExclude, logger)
+	require.NoError(t, err)
+	value, err := fsm.Get(context.Background(), "/path/to/exclude/1")
+	require.NoError(t, err)
+	require.Nil(t, value)
+	value, err = fsm.Get(context.Background(), "/path/to/exclude/2")
+	require.NoError(t, err)
+	require.Nil(t, value)
+	value, err = fsm.Get(context.Background(), "/different/path/to/exclude")
+	require.NoError(t, err)
+	require.Nil(t, value)
+
+	value, err = fsm.Get(context.Background(), "/path/to/keep")
+	require.NoError(t, err)
+	require.NotNil(t, value)
+}
diff --git a/physical/raft/streamlayer.go b/physical/raft/streamlayer.go
index 861f4f60488..8f4f9e717b2 100644
--- a/physical/raft/streamlayer.go
+++ b/physical/raft/streamlayer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
diff --git a/physical/raft/streamlayer_test.go b/physical/raft/streamlayer_test.go
index bc35eb66ffe..1c78ac6ee90 100644
--- a/physical/raft/streamlayer_test.go
+++ b/physical/raft/streamlayer_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
diff --git a/physical/raft/testdata/TestLoadReadOnlySnapshot.bin b/physical/raft/testdata/TestLoadReadOnlySnapshot.bin
new file mode 100644
index 00000000000..73c31a858de
--- /dev/null
+++ b/physical/raft/testdata/TestLoadReadOnlySnapshot.bin
@@ -0,0 +1,5 @@
+
+/different/path/to/exclude
+/path/to/exclude/1
+/path/to/exclude/2
+
/path/to/keep
\ No newline at end of file
diff --git a/physical/raft/testing.go b/physical/raft/testing.go
index 7250782b086..e9bff408636 100644
--- a/physical/raft/testing.go
+++ b/physical/raft/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft
@@ -13,19 +13,38 @@ import (
 	"github.com/hashicorp/go-uuid"
 )
 
+func (b *RaftBackend) DataDir(t testing.TB) string {
+	t.Helper()
+	return b.dataDir
+}
+
 func GetRaft(t testing.TB, bootstrap bool, noStoreState bool) (*RaftBackend, string) {
-	return getRaftInternal(t, bootstrap, defaultRaftConfig(t, bootstrap, noStoreState), nil)
+	return getRaftInternal(t, bootstrap, defaultRaftConfig(t, bootstrap, noStoreState), nil, nil, nil)
 }
 
 func GetRaftWithConfig(t testing.TB, bootstrap bool, noStoreState bool, conf map[string]string) (*RaftBackend, string) {
 	defaultConf := defaultRaftConfig(t, bootstrap, noStoreState)
 	conf["path"] = defaultConf["path"]
 	conf["doNotStoreLatestState"] = defaultConf["doNotStoreLatestState"]
-	return getRaftInternal(t, bootstrap, conf, nil)
+	return getRaftInternal(t, bootstrap, conf, nil, nil, nil)
+}
+
+func GetRaftWithConfigAndSetupOpts(t testing.TB, bootstrap bool, noStoreState bool, conf map[string]string, setupOpts *SetupOpts) (*RaftBackend, string) {
+	defaultConf := defaultRaftConfig(t, bootstrap, noStoreState)
+	conf["path"] = defaultConf["path"]
+	conf["doNotStoreLatestState"] = defaultConf["doNotStoreLatestState"]
+	return getRaftInternal(t, bootstrap, conf, setupOpts, nil, nil)
+}
+
+func GetRaftWithConfigAndInitFn(t testing.TB, bootstrap bool, noStoreState bool, conf map[string]string, initFn func(b *RaftBackend)) (*RaftBackend, string) {
+	defaultConf := defaultRaftConfig(t, bootstrap, noStoreState)
+	conf["path"] = defaultConf["path"]
+	conf["doNotStoreLatestState"] = defaultConf["doNotStoreLatestState"]
+	return getRaftInternal(t, bootstrap, conf, nil, nil, initFn)
 }
 
 func GetRaftWithLogOutput(t testing.TB, bootstrap bool, noStoreState bool, logOutput io.Writer) (*RaftBackend, string) {
-	return getRaftInternal(t, bootstrap, defaultRaftConfig(t, bootstrap, noStoreState), logOutput)
+	return getRaftInternal(t, bootstrap, defaultRaftConfig(t, bootstrap, noStoreState), nil, logOutput, nil)
 }
 
 func defaultRaftConfig(t testing.TB, bootstrap bool, noStoreState bool) map[string]string {
@@ -44,7 +63,7 @@ func defaultRaftConfig(t testing.TB, bootstrap bool, noStoreState bool) map[stri
 	return conf
 }
 
-func getRaftInternal(t testing.TB, bootstrap bool, conf map[string]string, logOutput io.Writer) (*RaftBackend, string) {
+func getRaftInternal(t testing.TB, bootstrap bool, conf map[string]string, setupOpts *SetupOpts, logOutput io.Writer, initFn func(b *RaftBackend)) (*RaftBackend, string) {
 	id, err := uuid.GenerateUUID()
 	if err != nil {
 		t.Fatal(err)
@@ -63,6 +82,9 @@ func getRaftInternal(t testing.TB, bootstrap bool, conf map[string]string, logOu
 		t.Fatal(err)
 	}
 	backend := backendRaw.(*RaftBackend)
+	if initFn != nil {
+		initFn(backend)
+	}
 
 	if bootstrap {
 		err = backend.Bootstrap([]Peer{
@@ -75,7 +97,12 @@ func getRaftInternal(t testing.TB, bootstrap bool, conf map[string]string, logOu
 			t.Fatal(err)
 		}
 
-		err = backend.SetupCluster(context.Background(), SetupOpts{})
+		so := SetupOpts{}
+		if setupOpts != nil {
+			so = *setupOpts
+		}
+
+		err = backend.SetupCluster(context.Background(), so)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/physical/raft/types.pb.go b/physical/raft/types.pb.go
index 01366c6bc7d..c2734a703c5 100644
--- a/physical/raft/types.pb.go
+++ b/physical/raft/types.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: physical/raft/types.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -24,10 +25,7 @@ const (
 )
 
 type LogOperation struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// OpType is the Operation type
 	OpType uint32 `protobuf:"varint,1,opt,name=op_type,json=opType,proto3" json:"op_type,omitempty"`
 	// Flags is an opaque value, currently unused. Reserved.
@@ -35,16 +33,16 @@ type LogOperation struct {
 	// Key that is being affected
 	Key string `protobuf:"bytes,3,opt,name=key,proto3" json:"key,omitempty"`
 	// Value is optional, corresponds to the key
-	Value []byte `protobuf:"bytes,4,opt,name=value,proto3" json:"value,omitempty"`
+	Value         []byte `protobuf:"bytes,4,opt,name=value,proto3" json:"value,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *LogOperation) Reset() {
 	*x = LogOperation{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_physical_raft_types_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_physical_raft_types_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *LogOperation) String() string {
@@ -55,7 +53,7 @@ func (*LogOperation) ProtoMessage() {}
 
 func (x *LogOperation) ProtoReflect() protoreflect.Message {
 	mi := &file_physical_raft_types_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -99,20 +97,17 @@ func (x *LogOperation) GetValue() []byte {
 }
 
 type LogData struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Operations    []*LogOperation        `protobuf:"bytes,1,rep,name=operations,proto3" json:"operations,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Operations []*LogOperation `protobuf:"bytes,1,rep,name=operations,proto3" json:"operations,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *LogData) Reset() {
 	*x = LogData{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_physical_raft_types_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_physical_raft_types_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *LogData) String() string {
@@ -123,7 +118,7 @@ func (*LogData) ProtoMessage() {}
 
 func (x *LogData) ProtoReflect() protoreflect.Message {
 	mi := &file_physical_raft_types_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -146,21 +141,18 @@ func (x *LogData) GetOperations() []*LogOperation {
 }
 
 type IndexValue struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Term          uint64                 `protobuf:"varint,1,opt,name=term,proto3" json:"term,omitempty"`
+	Index         uint64                 `protobuf:"varint,2,opt,name=index,proto3" json:"index,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Term  uint64 `protobuf:"varint,1,opt,name=term,proto3" json:"term,omitempty"`
-	Index uint64 `protobuf:"varint,2,opt,name=index,proto3" json:"index,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *IndexValue) Reset() {
 	*x = IndexValue{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_physical_raft_types_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_physical_raft_types_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *IndexValue) String() string {
@@ -171,7 +163,7 @@ func (*IndexValue) ProtoMessage() {}
 
 func (x *IndexValue) ProtoReflect() protoreflect.Message {
 	mi := &file_physical_raft_types_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -201,22 +193,19 @@ func (x *IndexValue) GetIndex() uint64 {
 }
 
 type Server struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Suffrage      int32                  `protobuf:"varint,1,opt,name=suffrage,proto3" json:"suffrage,omitempty"`
+	Id            string                 `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	Address       string                 `protobuf:"bytes,3,opt,name=address,proto3" json:"address,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Suffrage int32  `protobuf:"varint,1,opt,name=suffrage,proto3" json:"suffrage,omitempty"`
-	Id       string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
-	Address  string `protobuf:"bytes,3,opt,name=address,proto3" json:"address,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Server) Reset() {
 	*x = Server{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_physical_raft_types_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_physical_raft_types_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Server) String() string {
@@ -227,7 +216,7 @@ func (*Server) ProtoMessage() {}
 
 func (x *Server) ProtoReflect() protoreflect.Message {
 	mi := &file_physical_raft_types_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -264,21 +253,18 @@ func (x *Server) GetAddress() string {
 }
 
 type ConfigurationValue struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Index         uint64                 `protobuf:"varint,1,opt,name=index,proto3" json:"index,omitempty"`
+	Servers       []*Server              `protobuf:"bytes,2,rep,name=servers,proto3" json:"servers,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Index   uint64    `protobuf:"varint,1,opt,name=index,proto3" json:"index,omitempty"`
-	Servers []*Server `protobuf:"bytes,2,rep,name=servers,proto3" json:"servers,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ConfigurationValue) Reset() {
 	*x = ConfigurationValue{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_physical_raft_types_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_physical_raft_types_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ConfigurationValue) String() string {
@@ -289,7 +275,7 @@ func (*ConfigurationValue) ProtoMessage() {}
 
 func (x *ConfigurationValue) ProtoReflect() protoreflect.Message {
 	mi := &file_physical_raft_types_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -319,20 +305,17 @@ func (x *ConfigurationValue) GetServers() []*Server {
 }
 
 type LocalNodeConfigValue struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	DesiredSuffrage string `protobuf:"bytes,1,opt,name=desired_suffrage,json=desiredSuffrage,proto3" json:"desired_suffrage,omitempty"`
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	DesiredSuffrage string                 `protobuf:"bytes,1,opt,name=desired_suffrage,json=desiredSuffrage,proto3" json:"desired_suffrage,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *LocalNodeConfigValue) Reset() {
 	*x = LocalNodeConfigValue{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_physical_raft_types_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_physical_raft_types_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *LocalNodeConfigValue) String() string {
@@ -343,7 +326,7 @@ func (*LocalNodeConfigValue) ProtoMessage() {}
 
 func (x *LocalNodeConfigValue) ProtoReflect() protoreflect.Message {
 	mi := &file_physical_raft_types_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -367,7 +350,7 @@ func (x *LocalNodeConfigValue) GetDesiredSuffrage() string {
 
 var File_physical_raft_types_proto protoreflect.FileDescriptor
 
-var file_physical_raft_types_proto_rawDesc = []byte{
+var file_physical_raft_types_proto_rawDesc = string([]byte{
 	0x0a, 0x19, 0x70, 0x68, 0x79, 0x73, 0x69, 0x63, 0x61, 0x6c, 0x2f, 0x72, 0x61, 0x66, 0x74, 0x2f,
 	0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x04, 0x72, 0x61, 0x66,
 	0x74, 0x22, 0x65, 0x0a, 0x0c, 0x4c, 0x6f, 0x67, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f,
@@ -402,22 +385,22 @@ var file_physical_raft_types_proto_rawDesc = []byte{
 	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76,
 	0x61, 0x75, 0x6c, 0x74, 0x2f, 0x70, 0x68, 0x79, 0x73, 0x69, 0x63, 0x61, 0x6c, 0x2f, 0x72, 0x61,
 	0x66, 0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_physical_raft_types_proto_rawDescOnce sync.Once
-	file_physical_raft_types_proto_rawDescData = file_physical_raft_types_proto_rawDesc
+	file_physical_raft_types_proto_rawDescData []byte
 )
 
 func file_physical_raft_types_proto_rawDescGZIP() []byte {
 	file_physical_raft_types_proto_rawDescOnce.Do(func() {
-		file_physical_raft_types_proto_rawDescData = protoimpl.X.CompressGZIP(file_physical_raft_types_proto_rawDescData)
+		file_physical_raft_types_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_physical_raft_types_proto_rawDesc), len(file_physical_raft_types_proto_rawDesc)))
 	})
 	return file_physical_raft_types_proto_rawDescData
 }
 
 var file_physical_raft_types_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
-var file_physical_raft_types_proto_goTypes = []interface{}{
+var file_physical_raft_types_proto_goTypes = []any{
 	(*LogOperation)(nil),         // 0: raft.LogOperation
 	(*LogData)(nil),              // 1: raft.LogData
 	(*IndexValue)(nil),           // 2: raft.IndexValue
@@ -440,85 +423,11 @@ func file_physical_raft_types_proto_init() {
 	if File_physical_raft_types_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_physical_raft_types_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LogOperation); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_physical_raft_types_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LogData); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_physical_raft_types_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*IndexValue); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_physical_raft_types_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Server); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_physical_raft_types_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ConfigurationValue); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_physical_raft_types_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LocalNodeConfigValue); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_physical_raft_types_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_physical_raft_types_proto_rawDesc), len(file_physical_raft_types_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   6,
 			NumExtensions: 0,
@@ -529,7 +438,6 @@ func file_physical_raft_types_proto_init() {
 		MessageInfos:      file_physical_raft_types_proto_msgTypes,
 	}.Build()
 	File_physical_raft_types_proto = out.File
-	file_physical_raft_types_proto_rawDesc = nil
 	file_physical_raft_types_proto_goTypes = nil
 	file_physical_raft_types_proto_depIdxs = nil
 }
diff --git a/physical/raft/types.proto b/physical/raft/types.proto
index 6e87157051a..b5ec7309453 100644
--- a/physical/raft/types.proto
+++ b/physical/raft/types.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
diff --git a/physical/raft/vars_32bit.go b/physical/raft/vars_32bit.go
index 1b43384726d..b3e23d4c48f 100644
--- a/physical/raft/vars_32bit.go
+++ b/physical/raft/vars_32bit.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build 386 || arm || windows
diff --git a/physical/raft/vars_64bit.go b/physical/raft/vars_64bit.go
index 4c728e23630..f6465297077 100644
--- a/physical/raft/vars_64bit.go
+++ b/physical/raft/vars_64bit.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !386 && !arm && !windows
diff --git a/physical/s3/s3.go b/physical/s3/s3.go
index da82acccd3c..324056e307c 100644
--- a/physical/s3/s3.go
+++ b/physical/s3/s3.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package s3
@@ -25,6 +25,7 @@ import (
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/awsutil"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/physical"
 )
@@ -40,7 +41,7 @@ type S3Backend struct {
 	kmsKeyId   string
 	client     *s3.S3
 	logger     log.Logger
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 }
 
 // NewS3Backend constructs a S3 backend using a pre-existing
@@ -157,7 +158,7 @@ func NewS3Backend(conf map[string]string, logger log.Logger) (physical.Backend,
 		path:       path,
 		kmsKeyId:   kmsKeyId,
 		logger:     logger,
-		permitPool: physical.NewPermitPool(maxParInt),
+		permitPool: permitpool.New(maxParInt),
 	}
 	return s, nil
 }
@@ -166,7 +167,9 @@ func NewS3Backend(conf map[string]string, logger log.Logger) (physical.Backend,
 func (s *S3Backend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince([]string{"s3", "put"}, time.Now())
 
-	s.permitPool.Acquire()
+	if err := s.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer s.permitPool.Release()
 
 	// Setup key
@@ -183,7 +186,7 @@ func (s *S3Backend) Put(ctx context.Context, entry *physical.Entry) error {
 		putObjectInput.SSEKMSKeyId = aws.String(s.kmsKeyId)
 	}
 
-	_, err := s.client.PutObject(putObjectInput)
+	_, err := s.client.PutObjectWithContext(ctx, putObjectInput)
 	if err != nil {
 		return err
 	}
@@ -195,13 +198,15 @@ func (s *S3Backend) Put(ctx context.Context, entry *physical.Entry) error {
 func (s *S3Backend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"s3", "get"}, time.Now())
 
-	s.permitPool.Acquire()
+	if err := s.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer s.permitPool.Release()
 
 	// Setup key
 	key = path.Join(s.path, key)
 
-	resp, err := s.client.GetObject(&s3.GetObjectInput{
+	resp, err := s.client.GetObjectWithContext(ctx, &s3.GetObjectInput{
 		Bucket: aws.String(s.bucket),
 		Key:    aws.String(key),
 	})
@@ -248,13 +253,15 @@ func (s *S3Backend) Get(ctx context.Context, key string) (*physical.Entry, error
 func (s *S3Backend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince([]string{"s3", "delete"}, time.Now())
 
-	s.permitPool.Acquire()
+	if err := s.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer s.permitPool.Release()
 
 	// Setup key
 	key = path.Join(s.path, key)
 
-	_, err := s.client.DeleteObject(&s3.DeleteObjectInput{
+	_, err := s.client.DeleteObjectWithContext(ctx, &s3.DeleteObjectInput{
 		Bucket: aws.String(s.bucket),
 		Key:    aws.String(key),
 	})
@@ -270,7 +277,9 @@ func (s *S3Backend) Delete(ctx context.Context, key string) error {
 func (s *S3Backend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{"s3", "list"}, time.Now())
 
-	s.permitPool.Acquire()
+	if err := s.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer s.permitPool.Release()
 
 	// Setup prefix
@@ -289,7 +298,7 @@ func (s *S3Backend) List(ctx context.Context, prefix string) ([]string, error) {
 
 	keys := []string{}
 
-	err := s.client.ListObjectsV2Pages(params,
+	err := s.client.ListObjectsV2PagesWithContext(ctx, params,
 		func(page *s3.ListObjectsV2Output, lastPage bool) bool {
 			if page != nil {
 				// Add truncated 'folder' paths
diff --git a/physical/s3/s3_test.go b/physical/s3/s3_test.go
index 68b23f12984..310f1e317a6 100644
--- a/physical/s3/s3_test.go
+++ b/physical/s3/s3_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package s3
diff --git a/physical/spanner/spanner.go b/physical/spanner/spanner.go
index 4151d93ba1b..7c4508fd5bf 100644
--- a/physical/spanner/spanner.go
+++ b/physical/spanner/spanner.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package spanner
@@ -15,6 +15,7 @@ import (
 	"cloud.google.com/go/spanner"
 	metrics "github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/helper/useragent"
 	"github.com/hashicorp/vault/sdk/physical"
@@ -85,7 +86,7 @@ type Backend struct {
 	// client is the API client and permitPool is the allowed concurrent uses of
 	// the client.
 	client     *spanner.Client
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 
 	// haTable is the name of the table to use for HA in the database.
 	haTable string
@@ -190,7 +191,7 @@ func NewBackend(c map[string]string, logger log.Logger) (physical.Backend, error
 		database:   database,
 		table:      table,
 		client:     client,
-		permitPool: physical.NewPermitPool(maxParallel),
+		permitPool: permitpool.New(maxParallel),
 
 		haEnabled: haEnabled,
 		haTable:   haTable,
@@ -205,7 +206,9 @@ func (b *Backend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince(metricPut, time.Now())
 
 	// Pooling
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	// Insert
@@ -224,7 +227,9 @@ func (b *Backend) Get(ctx context.Context, key string) (*physical.Entry, error)
 	defer metrics.MeasureSince(metricGet, time.Now())
 
 	// Pooling
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer b.permitPool.Release()
 
 	// Read
@@ -252,7 +257,9 @@ func (b *Backend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince(metricDelete, time.Now())
 
 	// Pooling
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	// Delete
@@ -269,7 +276,9 @@ func (b *Backend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince(metricList, time.Now())
 
 	// Pooling
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer b.permitPool.Release()
 
 	// Sanitize
@@ -347,7 +356,9 @@ func (b *Backend) Transaction(ctx context.Context, txns []*physical.TxnEntry) er
 	}
 
 	// Pooling
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	// Transactivate!
diff --git a/physical/spanner/spanner_ha.go b/physical/spanner/spanner_ha.go
index 377704d571b..e0a6de377ee 100644
--- a/physical/spanner/spanner_ha.go
+++ b/physical/spanner/spanner_ha.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package spanner
diff --git a/physical/spanner/spanner_ha_test.go b/physical/spanner/spanner_ha_test.go
index c6afbd001bc..2991530d41c 100644
--- a/physical/spanner/spanner_ha_test.go
+++ b/physical/spanner/spanner_ha_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package spanner
diff --git a/physical/spanner/spanner_test.go b/physical/spanner/spanner_test.go
index fc761f1e323..ee3de5f6e40 100644
--- a/physical/spanner/spanner_test.go
+++ b/physical/spanner/spanner_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package spanner
diff --git a/physical/swift/swift.go b/physical/swift/swift.go
index 8e53bd2fbe1..c8eec851289 100644
--- a/physical/swift/swift.go
+++ b/physical/swift/swift.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package swift
@@ -15,6 +15,7 @@ import (
 	metrics "github.com/armon/go-metrics"
 	cleanhttp "github.com/hashicorp/go-cleanhttp"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/ncw/swift"
@@ -29,7 +30,7 @@ type SwiftBackend struct {
 	container  string
 	client     *swift.Connection
 	logger     log.Logger
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 }
 
 // NewSwiftBackend constructs a Swift backend using a pre-existing
@@ -148,7 +149,7 @@ func NewSwiftBackend(conf map[string]string, logger log.Logger) (physical.Backen
 		client:     &c,
 		container:  container,
 		logger:     logger,
-		permitPool: physical.NewPermitPool(maxParInt),
+		permitPool: permitpool.New(maxParInt),
 	}
 	return s, nil
 }
@@ -157,7 +158,9 @@ func NewSwiftBackend(conf map[string]string, logger log.Logger) (physical.Backen
 func (s *SwiftBackend) Put(ctx context.Context, entry *physical.Entry) error {
 	defer metrics.MeasureSince([]string{"swift", "put"}, time.Now())
 
-	s.permitPool.Acquire()
+	if err := s.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer s.permitPool.Release()
 
 	err := s.client.ObjectPutBytes(s.container, entry.Key, entry.Value, "")
@@ -172,7 +175,9 @@ func (s *SwiftBackend) Put(ctx context.Context, entry *physical.Entry) error {
 func (s *SwiftBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
 	defer metrics.MeasureSince([]string{"swift", "get"}, time.Now())
 
-	s.permitPool.Acquire()
+	if err := s.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer s.permitPool.Release()
 
 	// Do a list of names with the key first since eventual consistency means
@@ -204,7 +209,9 @@ func (s *SwiftBackend) Get(ctx context.Context, key string) (*physical.Entry, er
 func (s *SwiftBackend) Delete(ctx context.Context, key string) error {
 	defer metrics.MeasureSince([]string{"swift", "delete"}, time.Now())
 
-	s.permitPool.Acquire()
+	if err := s.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer s.permitPool.Release()
 
 	err := s.client.ObjectDelete(s.container, key)
@@ -221,7 +228,9 @@ func (s *SwiftBackend) Delete(ctx context.Context, key string) error {
 func (s *SwiftBackend) List(ctx context.Context, prefix string) ([]string, error) {
 	defer metrics.MeasureSince([]string{"swift", "list"}, time.Now())
 
-	s.permitPool.Acquire()
+	if err := s.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer s.permitPool.Release()
 
 	list, err := s.client.ObjectNamesAll(s.container, &swift.ObjectsOpts{Prefix: prefix})
diff --git a/physical/swift/swift_test.go b/physical/swift/swift_test.go
index 3f192cd3f4a..43c05b89b8a 100644
--- a/physical/swift/swift_test.go
+++ b/physical/swift/swift_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package swift
diff --git a/physical/zookeeper/zookeeper.go b/physical/zookeeper/zookeeper.go
index 32a560472b2..db69feaaa44 100644
--- a/physical/zookeeper/zookeeper.go
+++ b/physical/zookeeper/zookeeper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package zookeeper
diff --git a/physical/zookeeper/zookeeper_test.go b/physical/zookeeper/zookeeper_test.go
index 7c9fe70180f..8004a28b67c 100644
--- a/physical/zookeeper/zookeeper_test.go
+++ b/physical/zookeeper/zookeeper_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package zookeeper
diff --git a/plugins/database/cassandra/cassandra-database-plugin/main.go b/plugins/database/cassandra/cassandra-database-plugin/main.go
index 6f9f7af954f..2ad3e47df69 100644
--- a/plugins/database/cassandra/cassandra-database-plugin/main.go
+++ b/plugins/database/cassandra/cassandra-database-plugin/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/plugins/database/cassandra/cassandra.go b/plugins/database/cassandra/cassandra.go
index 7118e2b55b6..c39a92f8315 100644
--- a/plugins/database/cassandra/cassandra.go
+++ b/plugins/database/cassandra/cassandra.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cassandra
diff --git a/plugins/database/cassandra/cassandra_test.go b/plugins/database/cassandra/cassandra_test.go
index 6382f89c7bc..1009cad9c39 100644
--- a/plugins/database/cassandra/cassandra_test.go
+++ b/plugins/database/cassandra/cassandra_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cassandra
@@ -9,7 +9,7 @@ import (
 	"testing"
 	"time"
 
-	backoff "github.com/cenkalti/backoff/v3"
+	backoff "github.com/cenkalti/backoff/v4"
 	"github.com/gocql/gocql"
 	"github.com/hashicorp/vault/helper/testhelpers/cassandra"
 	dbplugin "github.com/hashicorp/vault/sdk/database/dbplugin/v5"
diff --git a/plugins/database/cassandra/connection_producer.go b/plugins/database/cassandra/connection_producer.go
index 78f8311fbee..ad01d51c1bf 100644
--- a/plugins/database/cassandra/connection_producer.go
+++ b/plugins/database/cassandra/connection_producer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cassandra
diff --git a/plugins/database/cassandra/connection_producer_test.go b/plugins/database/cassandra/connection_producer_test.go
index 306b444f456..05cc394dbef 100644
--- a/plugins/database/cassandra/connection_producer_test.go
+++ b/plugins/database/cassandra/connection_producer_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cassandra
@@ -43,7 +43,7 @@ func TestSelfSignedCA(t *testing.T) {
 
 	host, cleanup := cassandra.PrepareTestContainer(t,
 		cassandra.ContainerName("cassandra"),
-		cassandra.Image("bitnami/cassandra", "3.11.11"),
+		cassandra.Image("bitnamilegacy/cassandra", "3.11.11"),
 		cassandra.CopyFromTo(copyFromTo),
 		cassandra.SslOpts(sslOpts),
 		cassandra.Env("CASSANDRA_KEYSTORE_PASSWORD=cassandra"),
diff --git a/plugins/database/cassandra/test-fixtures/no_tls/cassandra.yaml b/plugins/database/cassandra/test-fixtures/no_tls/cassandra.yaml
index a55afc69309..6a3decf1dd6 100644
--- a/plugins/database/cassandra/test-fixtures/no_tls/cassandra.yaml
+++ b/plugins/database/cassandra/test-fixtures/no_tls/cassandra.yaml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 # Cassandra storage config YAML
diff --git a/plugins/database/cassandra/tls.go b/plugins/database/cassandra/tls.go
index e8ad907235c..fcd17a54771 100644
--- a/plugins/database/cassandra/tls.go
+++ b/plugins/database/cassandra/tls.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cassandra
diff --git a/plugins/database/hana/hana-database-plugin/main.go b/plugins/database/hana/hana-database-plugin/main.go
index 8e4311eeb32..948fb2967b8 100644
--- a/plugins/database/hana/hana-database-plugin/main.go
+++ b/plugins/database/hana/hana-database-plugin/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/plugins/database/hana/hana.go b/plugins/database/hana/hana.go
index 314505c15f1..96345dffa37 100644
--- a/plugins/database/hana/hana.go
+++ b/plugins/database/hana/hana.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package hana
diff --git a/plugins/database/hana/hana_test.go b/plugins/database/hana/hana_test.go
index 894d3a4da16..abb75438651 100644
--- a/plugins/database/hana/hana_test.go
+++ b/plugins/database/hana/hana_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package hana
diff --git a/plugins/database/influxdb/connection_producer.go b/plugins/database/influxdb/connection_producer.go
index 24d03951e01..920c55717d6 100644
--- a/plugins/database/influxdb/connection_producer.go
+++ b/plugins/database/influxdb/connection_producer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package influxdb
diff --git a/plugins/database/influxdb/influxdb-database-plugin/main.go b/plugins/database/influxdb/influxdb-database-plugin/main.go
index 41ed199556c..e674870a33e 100644
--- a/plugins/database/influxdb/influxdb-database-plugin/main.go
+++ b/plugins/database/influxdb/influxdb-database-plugin/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/plugins/database/influxdb/influxdb.go b/plugins/database/influxdb/influxdb.go
index 4df30899763..be4c2070fad 100644
--- a/plugins/database/influxdb/influxdb.go
+++ b/plugins/database/influxdb/influxdb.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package influxdb
diff --git a/plugins/database/influxdb/influxdb_test.go b/plugins/database/influxdb/influxdb_test.go
index 37401c4bc1b..6fb76f8049a 100644
--- a/plugins/database/influxdb/influxdb_test.go
+++ b/plugins/database/influxdb/influxdb_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package influxdb
diff --git a/plugins/database/mongodb/cert_helpers_test.go b/plugins/database/mongodb/cert_helpers_test.go
index 3a8f3afcb84..e6f0bbef778 100644
--- a/plugins/database/mongodb/cert_helpers_test.go
+++ b/plugins/database/mongodb/cert_helpers_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mongodb
@@ -17,6 +17,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 )
 
 type certBuilder struct {
@@ -154,7 +156,7 @@ type keyWrapper struct {
 func newPrivateKey(t *testing.T) (key keyWrapper) {
 	t.Helper()
 
-	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	privKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatalf("Unable to generate key for cert: %s", err)
 	}
diff --git a/plugins/database/mongodb/connection_producer.go b/plugins/database/mongodb/connection_producer.go
index ca6244aa494..cfa448ecdaf 100644
--- a/plugins/database/mongodb/connection_producer.go
+++ b/plugins/database/mongodb/connection_producer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mongodb
@@ -20,6 +20,7 @@ import (
 	"go.mongodb.org/mongo-driver/mongo/options"
 	"go.mongodb.org/mongo-driver/mongo/readpref"
 	"go.mongodb.org/mongo-driver/mongo/writeconcern"
+	"go.mongodb.org/mongo-driver/x/mongo/driver/auth"
 )
 
 // mongoDBConnectionProducer implements ConnectionProducer and provides an
@@ -249,13 +250,20 @@ func (c *mongoDBConnectionProducer) getTLSAuth() (opts *options.ClientOptions, e
 
 	if len(c.TLSCertificateKeyData) > 0 {
 		certificate, err := tls.X509KeyPair(c.TLSCertificateKeyData, c.TLSCertificateKeyData)
+		authMechanism := auth.MongoDBX509
 		if err != nil {
 			return nil, fmt.Errorf("unable to load tls_certificate_key_data: %w", err)
 		}
 
+		// Ensure SCRAM-SHA-256 is explicitly set if username/password auth is provided
+		if c.Username != "" && c.Password != "" {
+			authMechanism = auth.SCRAMSHA256
+		}
+
 		opts.SetAuth(options.Credential{
-			AuthMechanism: "MONGODB-X509",
+			AuthMechanism: authMechanism,
 			Username:      c.Username,
+			Password:      c.Password,
 		})
 
 		tlsConfig.Certificates = append(tlsConfig.Certificates, certificate)
diff --git a/plugins/database/mongodb/connection_producer_test.go b/plugins/database/mongodb/connection_producer_test.go
index e29332b6092..76da2d49b18 100644
--- a/plugins/database/mongodb/connection_producer_test.go
+++ b/plugins/database/mongodb/connection_producer_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mongodb
diff --git a/plugins/database/mongodb/mongodb-database-plugin/main.go b/plugins/database/mongodb/mongodb-database-plugin/main.go
index ab0ff80c3bc..8fb3d84effe 100644
--- a/plugins/database/mongodb/mongodb-database-plugin/main.go
+++ b/plugins/database/mongodb/mongodb-database-plugin/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/plugins/database/mongodb/mongodb.go b/plugins/database/mongodb/mongodb.go
index 7d285b24c5d..89e2848ab6f 100644
--- a/plugins/database/mongodb/mongodb.go
+++ b/plugins/database/mongodb/mongodb.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mongodb
diff --git a/plugins/database/mongodb/mongodb_test.go b/plugins/database/mongodb/mongodb_test.go
index 43a3e8d3c24..aa7b5e547e3 100644
--- a/plugins/database/mongodb/mongodb_test.go
+++ b/plugins/database/mongodb/mongodb_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mongodb
@@ -347,6 +347,7 @@ func TestMongoDB_RotateRoot_NonAdminDB(t *testing.T) {
 	assertCredsExist(t, dbUser, newPassword, connURL)
 }
 
+// TestGetTLS verify the different options of the MongoDB client created based on the multiple parameters given
 func TestGetTLSAuth(t *testing.T) {
 	ca := certhelpers.NewCert(t,
 		certhelpers.CommonName("certificate authority"),
@@ -360,6 +361,7 @@ func TestGetTLSAuth(t *testing.T) {
 
 	type testCase struct {
 		username   string
+		password   string
 		tlsCAData  []byte
 		tlsKeyData []byte
 
@@ -411,12 +413,31 @@ func TestGetTLSAuth(t *testing.T) {
 				}),
 			expectErr: false,
 		},
+		"good key + username/password": {
+			username:   "unittest",
+			password:   "unittest",
+			tlsKeyData: cert.CombinedPEM(),
+
+			expectOpts: options.Client().
+				SetTLSConfig(
+					&tls.Config{
+						Certificates: []tls.Certificate{cert.TLSCert},
+					},
+				).
+				SetAuth(options.Credential{
+					AuthMechanism: "SCRAM-SHA-256",
+					Username:      "unittest",
+					Password:      "unittest",
+				}),
+			expectErr: false,
+		},
 	}
 
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
 			c := new()
 			c.Username = test.username
+			c.Password = test.password
 			c.TLSCAData = test.tlsCAData
 			c.TLSCertificateKeyData = test.tlsKeyData
 
diff --git a/plugins/database/mongodb/util.go b/plugins/database/mongodb/util.go
index ebeebb3f433..1f3f4017be3 100644
--- a/plugins/database/mongodb/util.go
+++ b/plugins/database/mongodb/util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mongodb
diff --git a/plugins/database/mssql/mssql-database-plugin/main.go b/plugins/database/mssql/mssql-database-plugin/main.go
index 1ed6f5d0e3c..3bc4b0f3208 100644
--- a/plugins/database/mssql/mssql-database-plugin/main.go
+++ b/plugins/database/mssql/mssql-database-plugin/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/plugins/database/mssql/mssql.go b/plugins/database/mssql/mssql.go
index 833202b8d40..497619db311 100644
--- a/plugins/database/mssql/mssql.go
+++ b/plugins/database/mssql/mssql.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mssql
@@ -285,7 +285,7 @@ func (m *MSSQL) revokeUserDefault(ctx context.Context, username string) error {
 
 	rows, err := stmt.QueryContext(ctx, username)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to query users: %w", err)
 	}
 	defer rows.Close()
 
@@ -345,8 +345,11 @@ func (m *MSSQL) UpdateUser(ctx context.Context, req dbplugin.UpdateUserRequest)
 
 func (m *MSSQL) updateUserPass(ctx context.Context, username string, changePass *dbplugin.ChangePassword) error {
 	stmts := changePass.Statements.Commands
-	if len(stmts) == 0 && !m.containedDB {
+	if len(stmts) == 0 {
 		stmts = []string{alterLoginSQL}
+		if m.containedDB {
+			stmts = []string{alterUserContainedSQL}
+		}
 	}
 
 	password := changePass.NewPassword
@@ -384,6 +387,11 @@ func (m *MSSQL) updateUserPass(ctx context.Context, username string, changePass
 		_ = tx.Rollback()
 	}()
 
+	if len(stmts) == 0 {
+		// should not happen, but guard against it anyway
+		return errors.New("no statement provided")
+	}
+
 	for _, stmt := range stmts {
 		for _, query := range strutil.ParseArbitraryStringSlice(stmt, ";") {
 			query = strings.TrimSpace(query)
@@ -431,3 +439,7 @@ EXEC (@stmt)`
 const alterLoginSQL = `
 ALTER LOGIN [{{username}}] WITH PASSWORD = '{{password}}'
 `
+
+const alterUserContainedSQL = `
+ALTER USER [{{username}}] WITH PASSWORD = '{{password}}'
+`
diff --git a/plugins/database/mssql/mssql_test.go b/plugins/database/mssql/mssql_test.go
index 6e866fea950..e304bf6b45d 100644
--- a/plugins/database/mssql/mssql_test.go
+++ b/plugins/database/mssql/mssql_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mssql
@@ -20,7 +20,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func TestInitialize(t *testing.T) {
+func TestMSSQLInitialize(t *testing.T) {
 	cleanup, connURL := mssqlhelper.PrepareMSSQLTestContainer(t)
 	defer cleanup()
 
@@ -79,7 +79,7 @@ func TestInitialize(t *testing.T) {
 	}
 }
 
-func TestNewUser(t *testing.T) {
+func TestMSSQLNewUser(t *testing.T) {
 	cleanup, connURL := mssqlhelper.PrepareMSSQLTestContainer(t)
 	defer cleanup()
 
@@ -185,7 +185,7 @@ func TestNewUser(t *testing.T) {
 	}
 }
 
-func TestUpdateUser_password(t *testing.T) {
+func TestMSSQLUpdateUser_password(t *testing.T) {
 	type testCase struct {
 		req              dbplugin.UpdateUserRequest
 		expectErr        bool
@@ -294,7 +294,7 @@ func TestUpdateUser_password(t *testing.T) {
 				Username: dbUser,
 			}
 
-			ctx, cancel = context.WithTimeout(context.Background(), 5*time.Second)
+			ctx, cancel = context.WithTimeout(context.Background(), 20*time.Second)
 			defer cancel()
 			deleteResp, err := db.DeleteUser(ctx, deleteReq)
 			if err != nil {
@@ -312,7 +312,7 @@ func TestUpdateUser_password(t *testing.T) {
 	}
 }
 
-func TestDeleteUser(t *testing.T) {
+func TestMSSQLDeleteUser(t *testing.T) {
 	cleanup, connURL := mssqlhelper.PrepareMSSQLTestContainer(t)
 	defer cleanup()
 
@@ -342,7 +342,7 @@ func TestDeleteUser(t *testing.T) {
 		Username: dbUser,
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
 	defer cancel()
 	deleteResp, err := db.DeleteUser(ctx, deleteReq)
 	if err != nil {
@@ -358,7 +358,7 @@ func TestDeleteUser(t *testing.T) {
 	assertCredsDoNotExist(t, connURL, dbUser, initPassword)
 }
 
-func TestDeleteUserContainedDB(t *testing.T) {
+func TestMSSQLDeleteUserContainedDB(t *testing.T) {
 	cleanup, connURL := mssqlhelper.PrepareMSSQLTestContainer(t)
 	defer cleanup()
 
@@ -405,7 +405,7 @@ func TestDeleteUserContainedDB(t *testing.T) {
 	assertContainedDBCredsDoNotExist(t, connURL, dbUser)
 }
 
-func TestContainedDBSQLSanitization(t *testing.T) {
+func TestMSSQLContainedDBSQLSanitization(t *testing.T) {
 	cleanup, connURL := mssqlhelper.PrepareMSSQLTestContainer(t)
 	defer cleanup()
 
@@ -443,7 +443,7 @@ func TestContainedDBSQLSanitization(t *testing.T) {
 	assert.EqualError(t, err, "mssql: Cannot alter the login 'vaultuser]', because it does not exist or you do not have permission.")
 }
 
-func TestSQLSanitization(t *testing.T) {
+func TestMSSQLSanitization(t *testing.T) {
 	cleanup, connURL := mssqlhelper.PrepareMSSQLTestContainer(t)
 	defer cleanup()
 
@@ -576,3 +576,11 @@ const testMSSQLContainedLogin = `
 CREATE LOGIN [{{name}}] WITH PASSWORD = '{{password}}';
 CREATE USER [{{name}}] FOR LOGIN [{{name}}];
 `
+
+const testMSSQLContainedLoginAdmin = `
+CREATE USER [{{name}}] WITH PASSWORD = '{{password}}';
+
+ALTER ROLE db_datareader ADD MEMBER [{{name}}];
+ALTER ROLE db_datawriter ADD MEMBER [{{name}}];
+ALTER ROLE db_owner ADD MEMBER [{{name}}];
+`
diff --git a/plugins/database/mysql/connection_producer.go b/plugins/database/mysql/connection_producer.go
index 0fb027bb29d..083ea081e2f 100644
--- a/plugins/database/mysql/connection_producer.go
+++ b/plugins/database/mysql/connection_producer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mysql
@@ -37,6 +37,8 @@ type mySQLConnectionProducer struct {
 	Password                 string      `json:"password" mapstructure:"password" structs:"password"`
 	AuthType                 string      `json:"auth_type" mapstructure:"auth_type" structs:"auth_type"`
 	ServiceAccountJSON       string      `json:"service_account_json" mapstructure:"service_account_json" structs:"service_account_json"`
+	UsePrivateIP             bool        `json:"use_private_ip" mapstructure:"use_private_ip" structs:"use_private_ip"`
+	UsePSC                   bool        `json:"use_psc" mapstructure:"use_psc" structs:"use_psc"`
 
 	TLSCertificateKeyData []byte `json:"tls_certificate_key" mapstructure:"tls_certificate_key" structs:"-"`
 	TLSCAData             []byte `json:"tls_ca"              mapstructure:"tls_ca"              structs:"-"`
@@ -140,7 +142,7 @@ func (c *mySQLConnectionProducer) Init(ctx context.Context, conf map[string]inte
 		// however, the driver might store a credentials file, in which case the state stored by the driver is in
 		// fact critical to the proper function of the connection. So it needs to be registered here inside the
 		// ConnectionProducer init.
-		dialerCleanup, err := registerDriverMySQL(c.cloudDriverName, c.ServiceAccountJSON)
+		dialerCleanup, err := registerDriverMySQL(c.cloudDriverName, c.ServiceAccountJSON, c.UsePrivateIP, c.UsePSC)
 		if err != nil {
 			return nil, err
 		}
@@ -321,8 +323,8 @@ func (c *mySQLConnectionProducer) rewriteProtocolForGCP(inDSN string) (string, e
 	return config.FormatDSN(), nil
 }
 
-func registerDriverMySQL(driverName, credentials string) (cleanup func() error, err error) {
-	opts, err := connutil.GetCloudSQLAuthOptions(credentials)
+func registerDriverMySQL(driverName, credentials string, usePrivateIP bool, usePSC bool) (cleanup func() error, err error) {
+	opts, err := connutil.GetCloudSQLAuthOptions(credentials, usePrivateIP, usePSC)
 	if err != nil {
 		return nil, err
 	}
diff --git a/plugins/database/mysql/connection_producer_test.go b/plugins/database/mysql/connection_producer_test.go
index ae6014906f0..02091f3f635 100644
--- a/plugins/database/mysql/connection_producer_test.go
+++ b/plugins/database/mysql/connection_producer_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mysql
diff --git a/plugins/database/mysql/mysql-database-plugin/main.go b/plugins/database/mysql/mysql-database-plugin/main.go
index 2735e082b86..12560230fca 100644
--- a/plugins/database/mysql/mysql-database-plugin/main.go
+++ b/plugins/database/mysql/mysql-database-plugin/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/plugins/database/mysql/mysql-legacy-database-plugin/main.go b/plugins/database/mysql/mysql-legacy-database-plugin/main.go
index 6818cccbf0c..b36f228f6c7 100644
--- a/plugins/database/mysql/mysql-legacy-database-plugin/main.go
+++ b/plugins/database/mysql/mysql-legacy-database-plugin/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/plugins/database/mysql/mysql.go b/plugins/database/mysql/mysql.go
index c938d2be9a7..bf11aea3f30 100644
--- a/plugins/database/mysql/mysql.go
+++ b/plugins/database/mysql/mysql.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mysql
diff --git a/plugins/database/mysql/mysql_test.go b/plugins/database/mysql/mysql_test.go
index 72c2a125a51..6c31e0c273d 100644
--- a/plugins/database/mysql/mysql_test.go
+++ b/plugins/database/mysql/mysql_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mysql
@@ -46,13 +46,16 @@ func TestMySQL_Initialize(t *testing.T) {
 	}
 }
 
-// TestMySQL_Initialize_CloudGCP validates the proper initialization of a MySQL backend pointing
-// to a GCP CloudSQL MySQL instance. This expects some external setup (exact TBD)
-func TestMySQL_Initialize_CloudGCP(t *testing.T) {
-	envConnURL := "CONNECTION_URL"
-	connURL := os.Getenv(envConnURL)
-	if connURL == "" {
-		t.Skipf("env var %s not set, skipping test", envConnURL)
+// TestMySQL_Initialize_CloudGCP_Normal - test initialize in GCP with a normal connection.
+// For the CloudGCP Normal, PrivateIP, and PSC tests, follow the instructions within the
+// README at https://github.com/shinji62/vault-tf-psc-test for environment setup.
+// The Terraform takes care of most steps.
+func TestMySQL_Initialize_CloudGCP_Normal(t *testing.T) {
+	envNormalConnURL := "CLOUDGCP_NORMAL_CONNECTION_URL"
+	normalConnURL := os.Getenv(envNormalConnURL)
+
+	if normalConnURL == "" {
+		t.Skipf("env var %s not set, skipping test", envNormalConnURL)
 	}
 
 	credStr := dbtesting.GetGCPTestCredentials(t)
@@ -65,7 +68,7 @@ func TestMySQL_Initialize_CloudGCP(t *testing.T) {
 		"empty auth type": {
 			req: dbplugin.InitializeRequest{
 				Config: map[string]interface{}{
-					"connection_url": connURL,
+					"connection_url": normalConnURL,
 					"auth_type":      "",
 				},
 			},
@@ -73,7 +76,7 @@ func TestMySQL_Initialize_CloudGCP(t *testing.T) {
 		"invalid auth type": {
 			req: dbplugin.InitializeRequest{
 				Config: map[string]interface{}{
-					"connection_url": connURL,
+					"connection_url": normalConnURL,
 					"auth_type":      "invalid",
 				},
 			},
@@ -83,9 +86,162 @@ func TestMySQL_Initialize_CloudGCP(t *testing.T) {
 		"JSON credentials": {
 			req: dbplugin.InitializeRequest{
 				Config: map[string]interface{}{
-					"connection_url":       connURL,
+					"connection_url":       normalConnURL,
+					"auth_type":            connutil.AuthTypeGCPIAM,
+					"service_account_json": credStr,
+				},
+				VerifyConnection: true,
+			},
+		},
+	}
+
+	for n, tc := range tests {
+		t.Run(n, func(t *testing.T) {
+			db := newMySQL(DefaultUserNameTemplate)
+			defer dbtesting.AssertClose(t, db)
+			_, err := db.Initialize(context.Background(), tc.req)
+
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("expected error but received nil")
+				}
+
+				if !strings.Contains(err.Error(), tc.expectedError) {
+					t.Fatalf("expected error %s, got %s", tc.expectedError, err.Error())
+				}
+			} else {
+				if err != nil {
+					t.Fatalf("expected no error, received %s", err)
+				}
+
+				if !db.Initialized {
+					t.Fatal("Database should be initialized")
+				}
+			}
+		})
+	}
+}
+
+// TestMySQL_Initialize_CloudGCP_PrivateIP - test initialize in GCP with a private IP.
+// For the CloudGCP Normal, PrivateIP, and PSC tests, follow the instructions within the
+// README at https://github.com/shinji62/vault-tf-psc-test for environment setup.
+// The Terraform takes care of most steps.
+func TestMySQL_Initialize_CloudGCP_PrivateIP(t *testing.T) {
+	envPrivateIPConnURL := "CLOUDGCP_PRIVATEIP_CONNECTION_URL"
+	privateIPConnURL := os.Getenv(envPrivateIPConnURL)
+
+	if privateIPConnURL == "" {
+		t.Skipf("env var %s not set, skipping test", envPrivateIPConnURL)
+	}
+	credStr := dbtesting.GetGCPTestCredentials(t)
+
+	tests := map[string]struct {
+		req           dbplugin.InitializeRequest
+		wantErr       bool
+		expectedError string
+	}{
+		"empty auth type": {
+			req: dbplugin.InitializeRequest{
+				Config: map[string]interface{}{
+					"connection_url": privateIPConnURL,
+					"auth_type":      "",
+				},
+			},
+		},
+		"invalid auth type": {
+			req: dbplugin.InitializeRequest{
+				Config: map[string]interface{}{
+					"connection_url": privateIPConnURL,
+					"auth_type":      "invalid",
+				},
+			},
+			wantErr:       true,
+			expectedError: "invalid auth_type",
+		},
+		"JSON credentials Private IP connection": {
+			req: dbplugin.InitializeRequest{
+				Config: map[string]interface{}{
+					"connection_url":       privateIPConnURL,
+					"auth_type":            connutil.AuthTypeGCPIAM,
+					"service_account_json": credStr,
+					"use_private_ip":       true,
+				},
+				VerifyConnection: true,
+			},
+		},
+	}
+
+	for n, tc := range tests {
+		t.Run(n, func(t *testing.T) {
+			db := newMySQL(DefaultUserNameTemplate)
+			defer dbtesting.AssertClose(t, db)
+			_, err := db.Initialize(context.Background(), tc.req)
+
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("expected error but received nil")
+				}
+
+				if !strings.Contains(err.Error(), tc.expectedError) {
+					t.Fatalf("expected error %s, got %s", tc.expectedError, err.Error())
+				}
+			} else {
+				if err != nil {
+					t.Fatalf("expected no error, received %s", err)
+				}
+
+				if !db.Initialized {
+					t.Fatal("Database should be initialized")
+				}
+			}
+		})
+	}
+}
+
+// TestMySQL_Initialize_CloudGCP_PSC - test initialize in GCP with private service connect.
+// For the CloudGCP Normal, PrivateIP, and PSC tests, follow the instructions within the
+// README at https://github.com/shinji62/vault-tf-psc-test for environment setup.
+// The Terraform takes care of most steps.
+func TestMySQL_Initialize_CloudGCP_PSC(t *testing.T) {
+	envPSCConnURL := "CLOUDGCP_PSC_CONNECTION_URL"
+	pscConnURL := os.Getenv(envPSCConnURL)
+
+	if pscConnURL == "" {
+		t.Skipf("env var %s not set, skipping test", pscConnURL)
+	}
+
+	credStr := dbtesting.GetGCPTestCredentials(t)
+
+	tests := map[string]struct {
+		req           dbplugin.InitializeRequest
+		wantErr       bool
+		expectedError string
+	}{
+		"empty auth type": {
+			req: dbplugin.InitializeRequest{
+				Config: map[string]interface{}{
+					"connection_url": pscConnURL,
+					"auth_type":      "",
+				},
+			},
+		},
+		"invalid auth type": {
+			req: dbplugin.InitializeRequest{
+				Config: map[string]interface{}{
+					"connection_url": pscConnURL,
+					"auth_type":      "invalid",
+				},
+			},
+			wantErr:       true,
+			expectedError: "invalid auth_type",
+		},
+		"JSON credentials Private Service Connect connection": {
+			req: dbplugin.InitializeRequest{
+				Config: map[string]interface{}{
+					"connection_url":       pscConnURL,
 					"auth_type":            connutil.AuthTypeGCPIAM,
 					"service_account_json": credStr,
+					"use_psc":              true,
 				},
 				VerifyConnection: true,
 			},
diff --git a/plugins/database/postgresql/passwordauthentication.go b/plugins/database/postgresql/passwordauthentication.go
index a20214dae4d..df10aec3aee 100644
--- a/plugins/database/postgresql/passwordauthentication.go
+++ b/plugins/database/postgresql/passwordauthentication.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package postgresql
diff --git a/plugins/database/postgresql/postgresql-database-plugin/main.go b/plugins/database/postgresql/postgresql-database-plugin/main.go
index 3efc801e9ed..d45d49c25d5 100644
--- a/plugins/database/postgresql/postgresql-database-plugin/main.go
+++ b/plugins/database/postgresql/postgresql-database-plugin/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/plugins/database/postgresql/postgresql.go b/plugins/database/postgresql/postgresql.go
index 0bdd9164124..5153683ca45 100644
--- a/plugins/database/postgresql/postgresql.go
+++ b/plugins/database/postgresql/postgresql.go
@@ -1,11 +1,15 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package postgresql
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"database/sql"
+	"encoding/pem"
+	"errors"
 	"fmt"
 	"regexp"
 	"strings"
@@ -79,11 +83,65 @@ func new() *PostgreSQL {
 type PostgreSQL struct {
 	*connutil.SQLConnectionProducer
 
+	TLSCertificateData []byte `json:"tls_certificate" structs:"-" mapstructure:"tls_certificate"`
+	TLSPrivateKey      []byte `json:"private_key" structs:"-" mapstructure:"private_key"`
+	TLSCAData          []byte `json:"tls_ca" structs:"-" mapstructure:"tls_ca"`
+
 	usernameProducer       template.StringTemplate
 	passwordAuthentication passwordAuthentication
 }
 
 func (p *PostgreSQL) Initialize(ctx context.Context, req dbplugin.InitializeRequest) (dbplugin.InitializeResponse, error) {
+	sslcert, err := strutil.GetString(req.Config, "tls_certificate")
+	if err != nil {
+		return dbplugin.InitializeResponse{}, fmt.Errorf("failed to retrieve tls_certificate: %w", err)
+	}
+
+	sslkey, err := strutil.GetString(req.Config, "private_key")
+	if err != nil {
+		return dbplugin.InitializeResponse{}, fmt.Errorf("failed to retrieve private_key: %w", err)
+	}
+
+	sslrootcert, err := strutil.GetString(req.Config, "tls_ca")
+	if err != nil {
+		return dbplugin.InitializeResponse{}, fmt.Errorf("failed to retrieve tls_ca: %w", err)
+	}
+
+	useTLS := false
+	tlsConfig := &tls.Config{}
+	if sslrootcert != "" {
+		caCertPool := x509.NewCertPool()
+		if !caCertPool.AppendCertsFromPEM([]byte(sslrootcert)) {
+			return dbplugin.InitializeResponse{}, errors.New("unable to add CA to cert pool")
+		}
+
+		tlsConfig.RootCAs = caCertPool
+		tlsConfig.ClientCAs = caCertPool
+		p.TLSConfig = tlsConfig
+		useTLS = true
+	}
+
+	if (sslcert != "" && sslkey == "") || (sslcert == "" && sslkey != "") {
+		return dbplugin.InitializeResponse{}, errors.New(`both "sslcert" and "sslkey" are required`)
+	}
+
+	if sslcert != "" && sslkey != "" {
+		block, _ := pem.Decode([]byte(sslkey))
+
+		cert, err := tls.X509KeyPair([]byte(sslcert), pem.EncodeToMemory(block))
+		if err != nil {
+			return dbplugin.InitializeResponse{}, fmt.Errorf("unable to load cert: %w", err)
+		}
+		tlsConfig.Certificates = []tls.Certificate{cert}
+		p.TLSConfig = tlsConfig
+		useTLS = true
+	}
+
+	if !useTLS {
+		// set to nil to flag that this connection does not use a custom TLS config
+		p.TLSConfig = nil
+	}
+
 	newConf, err := p.SQLConnectionProducer.Init(ctx, req.Config, req.VerifyConnection)
 	if err != nil {
 		return dbplugin.InitializeResponse{}, err
@@ -141,6 +199,15 @@ func (p *PostgreSQL) getConnection(ctx context.Context) (*sql.DB, error) {
 	return db.(*sql.DB), nil
 }
 
+func (p *PostgreSQL) getStaticConnection(ctx context.Context, username, password string) (*sql.DB, error) {
+	db, err := p.StaticConnection(ctx, username, password)
+	if err != nil {
+		return nil, err
+	}
+
+	return db, nil
+}
+
 func (p *PostgreSQL) UpdateUser(ctx context.Context, req dbplugin.UpdateUserRequest) (dbplugin.UpdateUserResponse, error) {
 	if req.Username == "" {
 		return dbplugin.UpdateUserResponse{}, fmt.Errorf("missing username")
@@ -151,17 +218,17 @@ func (p *PostgreSQL) UpdateUser(ctx context.Context, req dbplugin.UpdateUserRequ
 
 	merr := &multierror.Error{}
 	if req.Password != nil {
-		err := p.changeUserPassword(ctx, req.Username, req.Password)
+		err := p.changeUserPassword(ctx, req.Username, req.Password, req.SelfManagedPassword)
 		merr = multierror.Append(merr, err)
 	}
 	if req.Expiration != nil {
-		err := p.changeUserExpiration(ctx, req.Username, req.Expiration)
+		err := p.changeUserExpiration(ctx, req.Username, req.Expiration, req.SelfManagedPassword)
 		merr = multierror.Append(merr, err)
 	}
 	return dbplugin.UpdateUserResponse{}, merr.ErrorOrNil()
 }
 
-func (p *PostgreSQL) changeUserPassword(ctx context.Context, username string, changePass *dbplugin.ChangePassword) error {
+func (p *PostgreSQL) changeUserPassword(ctx context.Context, username string, changePass *dbplugin.ChangePassword, selfManagedPass string) error {
 	stmts := changePass.Statements.Commands
 	if len(stmts) == 0 {
 		stmts = []string{defaultChangePasswordStatement}
@@ -175,9 +242,18 @@ func (p *PostgreSQL) changeUserPassword(ctx context.Context, username string, ch
 	p.Lock()
 	defer p.Unlock()
 
-	db, err := p.getConnection(ctx)
-	if err != nil {
-		return fmt.Errorf("unable to get connection: %w", err)
+	var db *sql.DB
+	var err error
+	if selfManagedPass == "" {
+		db, err = p.getConnection(ctx)
+		if err != nil {
+			return fmt.Errorf("unable to get connection: %w", err)
+		}
+	} else {
+		db, err = p.getStaticConnection(ctx, username, selfManagedPass)
+		if err != nil {
+			return fmt.Errorf("unable to get static connection from cache: %w", err)
+		}
 	}
 
 	// Check if the role exists
@@ -194,6 +270,28 @@ func (p *PostgreSQL) changeUserPassword(ctx context.Context, username string, ch
 	defer tx.Rollback()
 
 	for _, stmt := range stmts {
+		if containsMultilineStatement(stmt) {
+			// Execute it as-is.
+			m := map[string]string{
+				"name":     username,
+				"username": username,
+				"password": password,
+			}
+
+			if p.passwordAuthentication == passwordAuthenticationSCRAMSHA256 {
+				hashedPassword, err := scram.Hash(password)
+				if err != nil {
+					return fmt.Errorf("unable to scram-sha256 password: %w", err)
+				}
+				m["password"] = hashedPassword
+			}
+
+			if err := dbtxn.ExecuteTxQueryDirect(ctx, tx, m, stmt); err != nil {
+				return err
+			}
+			continue
+		}
+		// Otherwise, it's fine to split the statements on the semicolon.
 		for _, query := range strutil.ParseArbitraryStringSlice(stmt, ";") {
 			query = strings.TrimSpace(query)
 			if len(query) == 0 {
@@ -227,7 +325,7 @@ func (p *PostgreSQL) changeUserPassword(ctx context.Context, username string, ch
 	return nil
 }
 
-func (p *PostgreSQL) changeUserExpiration(ctx context.Context, username string, changeExp *dbplugin.ChangeExpiration) error {
+func (p *PostgreSQL) changeUserExpiration(ctx context.Context, username string, changeExp *dbplugin.ChangeExpiration, selfManagedPass string) error {
 	p.Lock()
 	defer p.Unlock()
 
@@ -236,9 +334,18 @@ func (p *PostgreSQL) changeUserExpiration(ctx context.Context, username string,
 		renewStmts = []string{defaultExpirationStatement}
 	}
 
-	db, err := p.getConnection(ctx)
-	if err != nil {
-		return err
+	var db *sql.DB
+	var err error
+	if selfManagedPass == "" {
+		db, err = p.getConnection(ctx)
+		if err != nil {
+			return fmt.Errorf("unable to get connection: %w", err)
+		}
+	} else {
+		db, err = p.getStaticConnection(ctx, username, selfManagedPass)
+		if err != nil {
+			return fmt.Errorf("unable to get static connection from cache: %w", err)
+		}
 	}
 
 	tx, err := db.BeginTx(ctx, nil)
@@ -252,6 +359,19 @@ func (p *PostgreSQL) changeUserExpiration(ctx context.Context, username string,
 	expirationStr := changeExp.NewExpiration.Format(expirationFormat)
 
 	for _, stmt := range renewStmts {
+		if containsMultilineStatement(stmt) {
+			// Execute it as-is.
+			m := map[string]string{
+				"name":       username,
+				"username":   username,
+				"expiration": expirationStr,
+			}
+			if err := dbtxn.ExecuteTxQueryDirect(ctx, tx, m, stmt); err != nil {
+				return err
+			}
+			continue
+		}
+		// Otherwise, it's fine to split the statements on the semicolon.
 		for _, query := range strutil.ParseArbitraryStringSlice(stmt, ";") {
 			query = strings.TrimSpace(query)
 			if len(query) == 0 {
@@ -444,7 +564,7 @@ func (p *PostgreSQL) defaultDeleteUser(ctx context.Context, username string) err
 		}
 		revocationStmts = append(revocationStmts, fmt.Sprintf(
 			`REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA %s FROM %s;`,
-			(schema),
+			dbutil.QuoteIdentifier(schema),
 			dbutil.QuoteIdentifier(username)))
 
 		revocationStmts = append(revocationStmts, fmt.Sprintf(
diff --git a/plugins/database/postgresql/postgresql_test.go b/plugins/database/postgresql/postgresql_test.go
index 90184e10a3e..bab6c354383 100644
--- a/plugins/database/postgresql/postgresql_test.go
+++ b/plugins/database/postgresql/postgresql_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package postgresql
@@ -12,19 +12,21 @@ import (
 	"testing"
 	"time"
 
+	"github.com/hashicorp/vault/helper/constants"
+	"github.com/hashicorp/vault/helper/testhelpers/certhelpers"
 	"github.com/hashicorp/vault/helper/testhelpers/postgresql"
 	"github.com/hashicorp/vault/sdk/database/dbplugin/v5"
 	dbtesting "github.com/hashicorp/vault/sdk/database/dbplugin/v5/testing"
 	"github.com/hashicorp/vault/sdk/database/helper/connutil"
 	"github.com/hashicorp/vault/sdk/database/helper/dbutil"
-	"github.com/hashicorp/vault/sdk/helper/docker"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/helper/template"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func getPostgreSQL(t *testing.T, options map[string]interface{}) (*PostgreSQL, func()) {
-	cleanup, connURL := postgresql.PrepareTestContainer(t, "13.4-buster")
+	cleanup, connURL := postgresql.PrepareTestContainer(t)
 
 	connectionDetails := map[string]interface{}{
 		"connection_url": connURL,
@@ -58,6 +60,463 @@ func TestPostgreSQL_Initialize(t *testing.T) {
 	}
 }
 
+// TestPostgreSQL_InitializeMultiHost tests the functionality of Postgres's
+// multi-host connection strings.
+func TestPostgreSQL_InitializeMultiHost(t *testing.T) {
+	cleanup, connURL := postgresql.PrepareTestContainerMultiHost(t)
+	defer cleanup()
+
+	connectionDetails := map[string]interface{}{
+		"connection_url":       connURL,
+		"max_open_connections": 5,
+	}
+
+	req := dbplugin.InitializeRequest{
+		Config:           connectionDetails,
+		VerifyConnection: true,
+	}
+
+	db := new()
+	dbtesting.AssertInitialize(t, db, req)
+
+	if !db.Initialized {
+		t.Fatal("Database should be initialized")
+	}
+
+	if err := db.Close(); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+}
+
+// TestPostgreSQL_InitializeSSLInlineFeatureFlag tests that the VAULT_PLUGIN_USE_POSTGRES_SSLINLINE
+// flag guards against unwanted usage of the deprecated SSL client authentication path.
+// TODO: remove this when we remove the underlying feature in a future SDK version
+func TestPostgreSQL_InitializeSSLInlineFeatureFlag(t *testing.T) {
+	// set the flag to true so we can call PrepareTestContainerWithSSL
+	// which does a validation check on the connection
+	t.Setenv(pluginutil.PluginUsePostgresSSLInline, "true")
+
+	// Create certificates for postgres authentication
+	caCert := certhelpers.NewCert(t, certhelpers.CommonName("ca"), certhelpers.IsCA(true), certhelpers.SelfSign())
+	clientCert := certhelpers.NewCert(t, certhelpers.CommonName("postgres"), certhelpers.DNS("localhost"), certhelpers.Parent(caCert))
+	cleanup, connURL := postgresql.PrepareTestContainerWithSSL(t, "verify-ca", caCert, clientCert, false)
+	t.Cleanup(cleanup)
+
+	type testCase struct {
+		env           string
+		wantErr       bool
+		expectedError string
+	}
+
+	tests := map[string]testCase{
+		"feature flag is true": {
+			env:           "true",
+			wantErr:       false,
+			expectedError: "",
+		},
+		"feature flag is unset or empty": {
+			env:     "",
+			wantErr: true,
+			// this error is expected because the env var unset means we are
+			// using pgx's native connection string parsing which does not
+			// support inlining of the certificate material in the sslrootcert,
+			// sslcert, and sslkey fields
+			expectedError: "error verifying connection",
+		},
+		"feature flag is false": {
+			env:           "false",
+			wantErr:       true,
+			expectedError: "failed to open postgres connection with deprecated funtion",
+		},
+		"feature flag is invalid": {
+			env:           "foo",
+			wantErr:       true,
+			expectedError: "failed to open postgres connection with deprecated funtion",
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			// update the env var with the value we are testing
+			t.Setenv(pluginutil.PluginUsePostgresSSLInline, test.env)
+
+			connectionDetails := map[string]interface{}{
+				"connection_url":       connURL,
+				"max_open_connections": 5,
+			}
+
+			req := dbplugin.InitializeRequest{
+				Config:           connectionDetails,
+				VerifyConnection: true,
+			}
+
+			db := new()
+			_, err := dbtesting.VerifyInitialize(t, db, req)
+			if test.wantErr && err == nil {
+				t.Fatal("expected error, got nil")
+			} else if test.wantErr && !strings.Contains(err.Error(), test.expectedError) {
+				t.Fatalf("got: %s, want: %s", err.Error(), test.expectedError)
+			}
+
+			if !test.wantErr && !db.Initialized {
+				t.Fatal("Database should be initialized")
+			}
+
+			if err := db.Close(); err != nil {
+				t.Fatalf("err: %s", err)
+			}
+			// unset for the next test case
+			os.Unsetenv(pluginutil.PluginUsePostgresSSLInline)
+		})
+	}
+}
+
+// TestPostgreSQL_InitializeSSLInline tests that we can successfully authenticate
+// with a postgres server via ssl with a URL connection string or DSN (key/value)
+// for each ssl mode.
+// TODO: remove this when we remove the underlying feature in a future SDK version
+func TestPostgreSQL_InitializeSSLInline(t *testing.T) {
+	// required to enable the sslinline custom parsing
+	t.Setenv(pluginutil.PluginUsePostgresSSLInline, "true")
+
+	type testCase struct {
+		sslMode       string
+		useDSN        bool
+		useFallback   bool
+		wantErr       bool
+		expectedError string
+	}
+
+	tests := map[string]testCase{
+		"disable sslmode": {
+			sslMode:       "disable",
+			wantErr:       true,
+			expectedError: "error verifying connection",
+		},
+		"allow sslmode": {
+			sslMode: "allow",
+			wantErr: false,
+		},
+		"prefer sslmode": {
+			sslMode: "prefer",
+			wantErr: false,
+		},
+		"require sslmode": {
+			sslMode: "require",
+			wantErr: false,
+		},
+		"verify-ca sslmode": {
+			sslMode: "verify-ca",
+			wantErr: false,
+		},
+		"disable sslmode with DSN": {
+			sslMode:       "disable",
+			useDSN:        true,
+			wantErr:       true,
+			expectedError: "error verifying connection",
+		},
+		"allow sslmode with DSN": {
+			sslMode: "allow",
+			useDSN:  true,
+			wantErr: false,
+		},
+		"prefer sslmode with DSN": {
+			sslMode: "prefer",
+			useDSN:  true,
+			wantErr: false,
+		},
+		"require sslmode with DSN": {
+			sslMode: "require",
+			useDSN:  true,
+			wantErr: false,
+		},
+		"verify-ca sslmode with DSN": {
+			sslMode: "verify-ca",
+			useDSN:  true,
+			wantErr: false,
+		},
+		"disable sslmode with fallback": {
+			sslMode:       "disable",
+			useFallback:   true,
+			wantErr:       true,
+			expectedError: "error verifying connection",
+		},
+		"allow sslmode with fallback": {
+			sslMode:     "allow",
+			useFallback: true,
+		},
+		"prefer sslmode with fallback": {
+			sslMode:     "prefer",
+			useFallback: true,
+		},
+		"require sslmode with fallback": {
+			sslMode:     "require",
+			useFallback: true,
+		},
+		"verify-ca sslmode with fallback": {
+			sslMode:     "verify-ca",
+			useFallback: true,
+		},
+		"disable sslmode with DSN with fallback": {
+			sslMode:       "disable",
+			useDSN:        true,
+			useFallback:   true,
+			wantErr:       true,
+			expectedError: "error verifying connection",
+		},
+		"allow sslmode with DSN with fallback": {
+			sslMode:     "allow",
+			useDSN:      true,
+			useFallback: true,
+			wantErr:     false,
+		},
+		"prefer sslmode with DSN with fallback": {
+			sslMode:     "prefer",
+			useDSN:      true,
+			useFallback: true,
+			wantErr:     false,
+		},
+		"require sslmode with DSN with fallback": {
+			sslMode:     "require",
+			useDSN:      true,
+			useFallback: true,
+			wantErr:     false,
+		},
+		"verify-ca sslmode with DSN with fallback": {
+			sslMode:     "verify-ca",
+			useDSN:      true,
+			useFallback: true,
+			wantErr:     false,
+		},
+	}
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			// Create certificates for postgres authentication
+			caCert := certhelpers.NewCert(t, certhelpers.CommonName("ca"), certhelpers.IsCA(true), certhelpers.SelfSign())
+			clientCert := certhelpers.NewCert(t, certhelpers.CommonName("postgres"), certhelpers.DNS("localhost"), certhelpers.Parent(caCert))
+			cleanup, connURL := postgresql.PrepareTestContainerWithSSL(t, test.sslMode, caCert, clientCert, test.useFallback)
+			t.Cleanup(cleanup)
+
+			if test.useDSN {
+				var err error
+				connURL, err = dbutil.ParseURL(connURL)
+				if err != nil {
+					t.Fatal(err)
+				}
+			}
+			connectionDetails := map[string]interface{}{
+				"connection_url":       connURL,
+				"max_open_connections": 5,
+			}
+
+			req := dbplugin.InitializeRequest{
+				Config:           connectionDetails,
+				VerifyConnection: true,
+			}
+
+			db := new()
+			_, err := dbtesting.VerifyInitialize(t, db, req)
+			if test.wantErr && err == nil {
+				t.Fatal("expected error, got nil")
+			} else if test.wantErr && !strings.Contains(err.Error(), test.expectedError) {
+				t.Fatalf("got: %s, want: %s", err.Error(), test.expectedError)
+			}
+
+			if !test.wantErr && !db.Initialized {
+				t.Fatal("Database should be initialized")
+			}
+
+			if err := db.Close(); err != nil {
+				t.Fatalf("err: %s", err)
+			}
+		})
+	}
+}
+
+// TestPostgreSQL_InitializeSSL tests that we can successfully authenticate
+// with a postgres server via ssl with a URL connection string or DSN (key/value)
+// for each ssl mode.
+func TestPostgreSQL_InitializeSSL(t *testing.T) {
+	type testCase struct {
+		sslMode       string
+		useDSN        bool
+		useFallback   bool
+		wantErr       bool
+		expectedError string
+	}
+
+	tests := map[string]testCase{
+		"disable sslmode": {
+			sslMode:       "disable",
+			wantErr:       true,
+			expectedError: "error verifying connection",
+		},
+		"allow sslmode": {
+			sslMode: "allow",
+			wantErr: false,
+		},
+		"prefer sslmode": {
+			sslMode: "prefer",
+			wantErr: false,
+		},
+		"require sslmode": {
+			sslMode: "require",
+			wantErr: false,
+		},
+		"verify-ca sslmode": {
+			sslMode: "verify-ca",
+			wantErr: false,
+		},
+		"verify-full sslmode": {
+			sslMode: "verify-full",
+			wantErr: false,
+		},
+		"disable sslmode with DSN": {
+			sslMode:       "disable",
+			useDSN:        true,
+			wantErr:       true,
+			expectedError: "error verifying connection",
+		},
+		"allow sslmode with DSN": {
+			sslMode: "allow",
+			useDSN:  true,
+			wantErr: false,
+		},
+		"prefer sslmode with DSN": {
+			sslMode: "prefer",
+			useDSN:  true,
+			wantErr: false,
+		},
+		"require sslmode with DSN": {
+			sslMode: "require",
+			useDSN:  true,
+			wantErr: false,
+		},
+		"verify-ca sslmode with DSN": {
+			sslMode: "verify-ca",
+			useDSN:  true,
+			wantErr: false,
+		},
+		"verify-full sslmode with DSN": {
+			sslMode: "verify-full",
+			useDSN:  true,
+			wantErr: false,
+		},
+		"disable sslmode with fallback": {
+			sslMode:       "disable",
+			useFallback:   true,
+			wantErr:       true,
+			expectedError: "error verifying connection",
+		},
+		"allow sslmode with fallback": {
+			sslMode:     "allow",
+			useFallback: true,
+		},
+		"prefer sslmode with fallback": {
+			sslMode:     "prefer",
+			useFallback: true,
+		},
+		"require sslmode with fallback": {
+			sslMode:     "require",
+			useFallback: true,
+		},
+		"verify-ca sslmode with fallback": {
+			sslMode:     "verify-ca",
+			useFallback: true,
+		},
+		"verify-full sslmode with fallback": {
+			sslMode:     "verify-full",
+			useFallback: true,
+		},
+		"disable sslmode with DSN with fallback": {
+			sslMode:       "disable",
+			useDSN:        true,
+			useFallback:   true,
+			wantErr:       true,
+			expectedError: "error verifying connection",
+		},
+		"allow sslmode with DSN with fallback": {
+			sslMode:     "allow",
+			useDSN:      true,
+			useFallback: true,
+			wantErr:     false,
+		},
+		"prefer sslmode with DSN with fallback": {
+			sslMode:     "prefer",
+			useDSN:      true,
+			useFallback: true,
+			wantErr:     false,
+		},
+		"require sslmode with DSN with fallback": {
+			sslMode:     "require",
+			useDSN:      true,
+			useFallback: true,
+			wantErr:     false,
+		},
+		"verify-ca sslmode with DSN with fallback": {
+			sslMode:     "verify-ca",
+			useDSN:      true,
+			useFallback: true,
+			wantErr:     false,
+		},
+		"verify-full sslmode with DSN with fallback": {
+			sslMode:     "verify-full",
+			useDSN:      true,
+			useFallback: true,
+			wantErr:     false,
+		},
+	}
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			// Create certificates for postgres authentication
+			caCert := certhelpers.NewCert(t, certhelpers.CommonName("ca"), certhelpers.IsCA(true), certhelpers.SelfSign())
+			clientCert := certhelpers.NewCert(t, certhelpers.CommonName("postgres"), certhelpers.DNS("localhost"), certhelpers.Parent(caCert))
+			cleanup, connURL := postgresql.PrepareTestContainerWithSSL(t, test.sslMode, caCert, clientCert, test.useFallback)
+			t.Cleanup(cleanup)
+
+			if test.useDSN {
+				var err error
+				connURL, err = dbutil.ParseURL(connURL)
+				if err != nil {
+					t.Fatal(err)
+				}
+			}
+			connectionDetails := map[string]interface{}{
+				"connection_url":       connURL,
+				"max_open_connections": 5,
+				"tls_certificate":      string(clientCert.CombinedPEM()),
+				"private_key":          string(clientCert.PrivateKeyPEM()),
+				"tls_ca":               string(caCert.CombinedPEM()),
+			}
+
+			req := dbplugin.InitializeRequest{
+				Config:           connectionDetails,
+				VerifyConnection: true,
+			}
+
+			db := new()
+			_, err := dbtesting.VerifyInitialize(t, db, req)
+			if test.wantErr && err == nil {
+				t.Fatal("expected error, got nil")
+			} else if test.wantErr && !strings.Contains(err.Error(), test.expectedError) {
+				t.Fatalf("got: %s, want: %s", err.Error(), test.expectedError)
+			}
+
+			if !test.wantErr && !db.Initialized {
+				t.Fatal("Database should be initialized")
+			}
+
+			if err := db.Close(); err != nil {
+				t.Fatalf("err: %s", err)
+			}
+		})
+	}
+}
+
 func TestPostgreSQL_InitializeWithStringVals(t *testing.T) {
 	db, cleanup := getPostgreSQL(t, map[string]interface{}{
 		"max_open_connections": "5",
@@ -70,7 +529,7 @@ func TestPostgreSQL_InitializeWithStringVals(t *testing.T) {
 }
 
 func TestPostgreSQL_Initialize_ConnURLWithDSNFormat(t *testing.T) {
-	cleanup, connURL := postgresql.PrepareTestContainer(t, "13.4-buster")
+	cleanup, connURL := postgresql.PrepareTestContainer(t)
 	defer cleanup()
 
 	dsnConnURL, err := dbutil.ParseURL(connURL)
@@ -182,10 +641,102 @@ func TestPostgreSQL_Initialize_CloudGCP(t *testing.T) {
 	}
 }
 
+// TestPostgreSQL_Initialize_SelfManaged_OSS tests the initialization of
+// the self-managed flow and ensures an error is returned on OSS.
+func TestPostgreSQL_Initialize_SelfManaged_OSS(t *testing.T) {
+	if constants.IsEnterprise {
+		t.Skip("this test is only valid on OSS")
+	}
+
+	cleanup, url := postgresql.PrepareTestContainerSelfManaged(t)
+	defer cleanup()
+
+	connURL := fmt.Sprintf("postgresql://{{username}}:{{password}}@%s/postgres?sslmode=disable", url.Host)
+
+	testCases := []struct {
+		name              string
+		connectionDetails map[string]interface{}
+		wantErr           bool
+		errContains       string
+	}{
+		{
+			name: "no parameters set",
+			connectionDetails: map[string]interface{}{
+				"connection_url": connURL,
+				"self_managed":   false,
+				"username":       "",
+				"password":       "",
+			},
+			wantErr:     true,
+			errContains: "must either provide username/password or set self-managed to 'true'",
+		},
+		{
+			name: "both sets of parameters set",
+			connectionDetails: map[string]interface{}{
+				"connection_url": connURL,
+				"self_managed":   true,
+				"username":       "test",
+				"password":       "test",
+			},
+			wantErr:     true,
+			errContains: "cannot use both self-managed and vault-managed workflows",
+		},
+		{
+			name: "either username/password with self-managed",
+			connectionDetails: map[string]interface{}{
+				"connection_url": connURL,
+				"self_managed":   true,
+				"username":       "test",
+				"password":       "",
+			},
+			wantErr:     true,
+			errContains: "cannot use both self-managed and vault-managed workflows",
+		},
+		{
+			name: "cache not implemented",
+			connectionDetails: map[string]interface{}{
+				"connection_url": connURL,
+				"self_managed":   true,
+				"username":       "",
+				"password":       "",
+			},
+			wantErr:     true,
+			errContains: "self-managed static roles only available in Vault Enterprise",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := dbplugin.InitializeRequest{
+				Config:           tc.connectionDetails,
+				VerifyConnection: true,
+			}
+
+			db := new()
+			_, err := dbtesting.VerifyInitialize(t, db, req)
+			if err == nil && tc.wantErr {
+				t.Fatalf("got: %s, wantErr: %t", err, tc.wantErr)
+			}
+
+			if err != nil && !strings.Contains(err.Error(), tc.errContains) {
+				t.Fatalf("expected error: %s, received error: %s", tc.errContains, err)
+			}
+
+			if !tc.wantErr && !db.Initialized {
+				t.Fatal("Database should be initialized")
+			}
+
+			if err := db.Close(); err != nil {
+				t.Fatalf("err closing DB: %s", err)
+			}
+		})
+	}
+}
+
 // TestPostgreSQL_PasswordAuthentication tests that the default "password_authentication" is "none", and that
 // an error is returned if an invalid "password_authentication" is provided.
 func TestPostgreSQL_PasswordAuthentication(t *testing.T) {
-	cleanup, connURL := postgresql.PrepareTestContainer(t, "13.4-buster")
+	cleanup, connURL := postgresql.PrepareTestContainer(t)
 	defer cleanup()
 
 	dsnConnURL, err := dbutil.ParseURL(connURL)
@@ -227,7 +778,7 @@ func TestPostgreSQL_PasswordAuthentication(t *testing.T) {
 // TestPostgreSQL_PasswordAuthentication_SCRAMSHA256 tests that password_authentication works when set to scram-sha-256.
 // When sending an encrypted password, the raw password should still successfully authenticate the user.
 func TestPostgreSQL_PasswordAuthentication_SCRAMSHA256(t *testing.T) {
-	cleanup, connURL := postgresql.PrepareTestContainer(t, "13.4-buster")
+	cleanup, connURL := postgresql.PrepareTestContainer(t)
 	defer cleanup()
 
 	dsnConnURL, err := dbutil.ParseURL(connURL)
@@ -512,6 +1063,17 @@ func TestUpdateUser_Password(t *testing.T) {
 			expectErr:      false,
 			credsAssertion: assertCredsExist,
 		},
+		"multi-line statements": {
+			statements: []string{
+				`DO $$ BEGIN
+				IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname='{{name}}')
+				THEN CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}';
+				ELSE ALTER ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}';
+				END IF; END $$`,
+			},
+			expectErr:      false,
+			credsAssertion: assertCredsExist,
+		},
 		"bad statements": {
 			statements:     []string{`asdofyas8uf77asoiajv`},
 			expectErr:      true,
@@ -587,6 +1149,41 @@ func TestUpdateUser_Password(t *testing.T) {
 	})
 }
 
+// TestUpdateUser_SelfManaged_OSS checks basic validation
+// for self-managed fields and confirms an error is returned on OSS
+func TestUpdateUser_SelfManaged_OSS(t *testing.T) {
+	if constants.IsEnterprise {
+		t.Skip("this test is only valid on OSS")
+	}
+
+	// Shared test container for speed - there should not be any overlap between the tests
+	db, cleanup := getPostgreSQL(t, nil)
+	defer cleanup()
+
+	updateReq := dbplugin.UpdateUserRequest{
+		Username: "static",
+		Password: &dbplugin.ChangePassword{
+			NewPassword: "somenewpassword",
+			Statements: dbplugin.Statements{
+				Commands: nil,
+			},
+		},
+		SelfManagedPassword: "test",
+	}
+
+	expectedErr := "self-managed static roles only available in Vault Enterprise"
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err := db.UpdateUser(ctx, updateReq)
+	if err == nil {
+		t.Fatalf("err expected, got nil")
+	}
+	if !strings.Contains(err.Error(), expectedErr) {
+		t.Fatalf("err expected: %s, got: %s", expectedErr, err)
+	}
+}
+
 func TestUpdateUser_Expiration(t *testing.T) {
 	type testCase struct {
 		initialExpiration  time.Time
@@ -619,6 +1216,17 @@ func TestUpdateUser_Expiration(t *testing.T) {
 			statements:         []string{`ALTER ROLE "{{username}}" VALID UNTIL '{{expiration}}';`},
 			expectErr:          false,
 		},
+		"multi-line statements": {
+			initialExpiration:  now.Add(1 * time.Minute),
+			newExpiration:      now.Add(5 * time.Minute),
+			expectedExpiration: now.Add(5 * time.Minute),
+			statements: []string{
+				`DO $$ BEGIN
+				ALTER ROLE "{{name}}" VALID UNTIL '{{expiration}}';
+				END $$`,
+			},
+			expectErr: false,
+		},
 		"bad statements": {
 			initialExpiration:  now.Add(1 * time.Minute),
 			newExpiration:      now.Add(5 * time.Minute),
@@ -1092,7 +1700,7 @@ func TestUsernameGeneration(t *testing.T) {
 }
 
 func TestNewUser_CustomUsername(t *testing.T) {
-	cleanup, connURL := postgresql.PrepareTestContainer(t, "13.4-buster")
+	cleanup, connURL := postgresql.PrepareTestContainer(t)
 	defer cleanup()
 
 	type testCase struct {
@@ -1268,139 +1876,6 @@ func TestNewUser_CloudGCP(t *testing.T) {
 	}
 }
 
-// This is a long-running integration test which tests the functionality of Postgres's multi-host
-// connection strings. It uses two Postgres containers preconfigured with Replication Manager
-// provided by Bitnami. This test currently does not run in CI and must be run manually. This is
-// due to the test length, as it requires multiple sleep calls to ensure cluster setup and
-// primary node failover occurs before the test steps continue.
-//
-// To run the test, set the environment variable POSTGRES_MULTIHOST_NET to the value of
-// a docker network you've preconfigured, e.g.
-// 'docker network create -d bridge postgres-repmgr'
-// 'export POSTGRES_MULTIHOST_NET=postgres-repmgr'
-func TestPostgreSQL_Repmgr(t *testing.T) {
-	_, exists := os.LookupEnv("POSTGRES_MULTIHOST_NET")
-	if !exists {
-		t.Skipf("POSTGRES_MULTIHOST_NET not set, skipping test")
-	}
-
-	// Run two postgres-repmgr containers in a replication cluster
-	db0, runner0, url0, container0 := testPostgreSQL_Repmgr_Container(t, "psql-repl-node-0")
-	_, _, url1, _ := testPostgreSQL_Repmgr_Container(t, "psql-repl-node-1")
-
-	ctx, cancel := context.WithTimeout(context.Background(), 300*time.Second)
-	defer cancel()
-
-	time.Sleep(10 * time.Second)
-
-	// Write a read role to the cluster
-	_, err := db0.NewUser(ctx, dbplugin.NewUserRequest{
-		Statements: dbplugin.Statements{
-			Commands: []string{
-				`CREATE ROLE "ro" NOINHERIT;
-				GRANT SELECT ON ALL TABLES IN SCHEMA public TO "ro";`,
-			},
-		},
-	})
-	if err != nil {
-		t.Fatalf("no error expected, got: %s", err)
-	}
-
-	// Open a connection to both databases using the multihost connection string
-	connectionDetails := map[string]interface{}{
-		"connection_url": fmt.Sprintf("postgresql://{{username}}:{{password}}@%s,%s/postgres?target_session_attrs=read-write", getHost(url0), getHost(url1)),
-		"username":       "postgres",
-		"password":       "secret",
-	}
-	req := dbplugin.InitializeRequest{
-		Config:           connectionDetails,
-		VerifyConnection: true,
-	}
-
-	db := new()
-	dbtesting.AssertInitialize(t, db, req)
-	if !db.Initialized {
-		t.Fatal("Database should be initialized")
-	}
-	defer db.Close()
-
-	// Add a user to the cluster, then stop the primary container
-	if err = testPostgreSQL_Repmgr_AddUser(ctx, db); err != nil {
-		t.Fatalf("no error expected, got: %s", err)
-	}
-	postgresql.StopContainer(t, ctx, runner0, container0)
-
-	// Try adding a new user immediately - expect failure as the database
-	// cluster is still switching primaries
-	err = testPostgreSQL_Repmgr_AddUser(ctx, db)
-	if !strings.HasSuffix(err.Error(), "ValidateConnect failed (read only connection)") {
-		t.Fatalf("expected error was not received, got: %s", err)
-	}
-
-	time.Sleep(20 * time.Second)
-
-	// Try adding a new user again which should succeed after the sleep
-	// as the primary failover should have finished. Then, restart
-	// the first container which should become a secondary DB.
-	if err = testPostgreSQL_Repmgr_AddUser(ctx, db); err != nil {
-		t.Fatalf("no error expected, got: %s", err)
-	}
-	postgresql.RestartContainer(t, ctx, runner0, container0)
-
-	time.Sleep(10 * time.Second)
-
-	// A final new user to add, which should succeed after the secondary joins.
-	if err = testPostgreSQL_Repmgr_AddUser(ctx, db); err != nil {
-		t.Fatalf("no error expected, got: %s", err)
-	}
-
-	if err := db.Close(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-}
-
-func testPostgreSQL_Repmgr_Container(t *testing.T, name string) (*PostgreSQL, *docker.Runner, string, string) {
-	envVars := []string{
-		"REPMGR_NODE_NAME=" + name,
-		"REPMGR_NODE_NETWORK_NAME=" + name,
-	}
-
-	runner, cleanup, connURL, containerID := postgresql.PrepareTestContainerRepmgr(t, name, "13.4.0", envVars)
-	t.Cleanup(cleanup)
-
-	connectionDetails := map[string]interface{}{
-		"connection_url": connURL,
-	}
-	req := dbplugin.InitializeRequest{
-		Config:           connectionDetails,
-		VerifyConnection: true,
-	}
-	db := new()
-	dbtesting.AssertInitialize(t, db, req)
-	if !db.Initialized {
-		t.Fatal("Database should be initialized")
-	}
-
-	if err := db.Close(); err != nil {
-		t.Fatalf("err: %s", err)
-	}
-
-	return db, runner, connURL, containerID
-}
-
-func testPostgreSQL_Repmgr_AddUser(ctx context.Context, db *PostgreSQL) error {
-	_, err := db.NewUser(ctx, dbplugin.NewUserRequest{
-		Statements: dbplugin.Statements{
-			Commands: []string{
-				`CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}' INHERIT;
-				GRANT ro TO "{{name}}";`,
-			},
-		},
-	})
-
-	return err
-}
-
 func getHost(url string) string {
 	splitCreds := strings.Split(url, "@")[1]
 
diff --git a/plugins/database/redshift/redshift-database-plugin/main.go b/plugins/database/redshift/redshift-database-plugin/main.go
index 010ddb03627..5206f213bb4 100644
--- a/plugins/database/redshift/redshift-database-plugin/main.go
+++ b/plugins/database/redshift/redshift-database-plugin/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/plugins/database/redshift/redshift.go b/plugins/database/redshift/redshift.go
index 1e658edbcf5..8a95c3eb461 100644
--- a/plugins/database/redshift/redshift.go
+++ b/plugins/database/redshift/redshift.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package redshift
diff --git a/plugins/database/redshift/redshift_test.go b/plugins/database/redshift/redshift_test.go
index d68ae4565f7..09e4c00f052 100644
--- a/plugins/database/redshift/redshift_test.go
+++ b/plugins/database/redshift/redshift_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package redshift
diff --git a/plugins/event/event_subscription_plugin.go b/plugins/event/event_subscription_plugin.go
deleted file mode 100644
index 43098663203..00000000000
--- a/plugins/event/event_subscription_plugin.go
+++ /dev/null
@@ -1,95 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package event
-
-import (
-	"context"
-	"time"
-
-	"github.com/hashicorp/vault/sdk/helper/backoff"
-)
-
-type Factory func(context.Context) (SubscriptionPlugin, error)
-
-// SubscriptionPlugin is the interface implemented by plugins that can subscribe to and receive events.
-type SubscriptionPlugin interface {
-	// Subscribe is used to set up a new connection.
-	Subscribe(context.Context, *SubscribeRequest) error
-	// Send is used to send events to a connection.
-	Send(context.Context, *SendRequest) error
-	// Unsubscribe is used to teardown a connection.
-	Unsubscribe(context.Context, *UnsubscribeRequest) error
-	// PluginMetadata returns the name and version for the particular event subscription plugin.
-	// The name is usually set as a constant the backend, e.g., "sqs" for the
-	// AWS SQS backend.
-	PluginMetadata() *PluginMetadata
-	// Close closes all connections.
-	Close(ctx context.Context) error
-}
-
-type Request struct {
-	Subscribe   *SubscribeRequest
-	Unsubscribe *UnsubscribeRequest
-	Event       *SendRequest
-}
-
-type SubscribeRequest struct {
-	SubscriptionID   string
-	Config           map[string]interface{}
-	VerifyConnection bool
-}
-
-type UnsubscribeRequest struct {
-	SubscriptionID string
-}
-
-type SendRequest struct {
-	SubscriptionID string
-	EventJSON      string
-}
-
-type PluginMetadata struct {
-	Name    string
-	Version string
-}
-
-// SubscribeConfigDefaults defines configuration map keys for common default options.
-// Embed this in your own config struct to pick up these default options.
-type SubscribeConfigDefaults struct {
-	Retries         *int           `mapstructure:"retries"`
-	RetryMinBackoff *time.Duration `mapstructure:"retry_min_backoff"`
-	RetryMaxBackoff *time.Duration `mapstructure:"retry_max_backoff"`
-}
-
-// default values for common configuration keys
-const (
-	DefaultRetries         = 3
-	DefaultRetryMinBackoff = 100 * time.Millisecond
-	DefaultRetryMaxBackoff = 5 * time.Second
-)
-
-func (c *SubscribeConfigDefaults) GetRetries() int {
-	if c.Retries == nil {
-		return DefaultRetries
-	}
-	return *c.Retries
-}
-
-func (c *SubscribeConfigDefaults) GetRetryMinBackoff() time.Duration {
-	if c.RetryMinBackoff == nil {
-		return DefaultRetryMinBackoff
-	}
-	return *c.RetryMinBackoff
-}
-
-func (c *SubscribeConfigDefaults) GetRetryMaxBackoff() time.Duration {
-	if c.RetryMaxBackoff == nil {
-		return DefaultRetryMaxBackoff
-	}
-	return *c.RetryMaxBackoff
-}
-
-func (c *SubscribeConfigDefaults) NewRetryBackoff() *backoff.Backoff {
-	return backoff.NewBackoff(c.GetRetries(), c.GetRetryMinBackoff(), c.GetRetryMaxBackoff())
-}
diff --git a/plugins/event/sqs/sqs.go b/plugins/event/sqs/sqs.go
deleted file mode 100644
index e5537caa3e7..00000000000
--- a/plugins/event/sqs/sqs.go
+++ /dev/null
@@ -1,239 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package sqs
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"sync"
-
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/sqs"
-	"github.com/hashicorp/go-secure-stdlib/awsutil"
-	"github.com/hashicorp/vault/plugins/event"
-	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/hashicorp/vault/version"
-	"github.com/mitchellh/mapstructure"
-)
-
-var (
-	_ event.Factory            = New
-	_ event.SubscriptionPlugin = (*sqsBackend)(nil)
-)
-
-const pluginName = "sqs"
-
-// ErrQueueRequired is returned if the required queue parameters are not present.
-var ErrQueueRequired = errors.New("queue_name or queue_url must be specified")
-
-// New returns a new instance of the SQS plugin backend.
-func New(_ context.Context) (event.SubscriptionPlugin, error) {
-	return &sqsBackend{
-		connections: map[string]*sqsConnection{},
-	}, nil
-}
-
-type sqsBackend struct {
-	connections map[string]*sqsConnection
-	clientLock  sync.RWMutex
-}
-
-type sqsConnection struct {
-	client   *sqs.SQS
-	config   *sqsConfig
-	queueURL string
-}
-
-type sqsConfig struct {
-	event.SubscribeConfigDefaults
-	CreateQueue     bool   `mapstructure:"create_queue"`
-	AccessKeyID     string `mapstructure:"access_key_id"`
-	SecretAccessKey string `mapstructure:"secret_access_key"`
-	Region          string `mapstructure:"region"`
-	QueueName       string `mapstructure:"queue_name"`
-	QueueURL        string `mapstructure:"queue_url"`
-}
-
-func newClient(sconfig *sqsConfig) (*sqs.SQS, error) {
-	var options []awsutil.Option
-	if sconfig.AccessKeyID != "" && sconfig.SecretAccessKey != "" {
-		options = append(options, awsutil.WithAccessKey(sconfig.AccessKeyID))
-		options = append(options, awsutil.WithSecretKey(sconfig.SecretAccessKey))
-	}
-	if sconfig.Region != "" {
-		options = append(options, awsutil.WithRegion(sconfig.Region))
-	}
-	options = append(options, awsutil.WithEnvironmentCredentials(true))
-	options = append(options, awsutil.WithSharedCredentials(true))
-	credConfig, err := awsutil.NewCredentialsConfig(options...)
-	if err != nil {
-		return nil, err
-	}
-	session, err := credConfig.GetSession()
-	if err != nil {
-		return nil, err
-	}
-	return sqs.New(session), nil
-}
-
-func (s *sqsBackend) Subscribe(_ context.Context, request *event.SubscribeRequest) error {
-	var sconfig sqsConfig
-	err := mapstructure.Decode(request.Config, &sconfig)
-	if err != nil {
-		return err
-	}
-	if sconfig.QueueName == "" && sconfig.QueueURL == "" {
-		return ErrQueueRequired
-	}
-	client, err := newClient(&sconfig)
-	if err != nil {
-		return err
-	}
-	var queueURL string
-	if sconfig.CreateQueue && sconfig.QueueName != "" {
-		resp, err := client.CreateQueue(&sqs.CreateQueueInput{
-			QueueName: &sconfig.QueueName,
-		})
-		var aerr awserr.Error
-		if errors.As(err, &aerr) {
-			if aerr.Code() == sqs.ErrCodeQueueNameExists {
-				// that's okay
-				err = nil
-			}
-		}
-		if err != nil {
-			return err
-		}
-		if resp == nil || resp.QueueUrl == nil {
-			return fmt.Errorf("invalid response from AWS: missing queue URL")
-		}
-		queueURL = *resp.QueueUrl
-	} else if sconfig.QueueURL != "" {
-		queueURL = sconfig.QueueURL
-	} else {
-		resp, err := client.GetQueueUrl(&sqs.GetQueueUrlInput{
-			QueueName: &sconfig.QueueName,
-		})
-		if err != nil {
-			return err
-		}
-		if resp == nil || resp.QueueUrl == nil {
-			return fmt.Errorf("invalid response from AWS: missing queue URL")
-		}
-		queueURL = *resp.QueueUrl
-	}
-
-	conn := &sqsConnection{
-		client:   client,
-		config:   &sconfig,
-		queueURL: queueURL,
-	}
-	s.clientLock.Lock()
-	defer s.clientLock.Unlock()
-	if _, ok := s.connections[request.SubscriptionID]; ok {
-		s.killConnectionWithLock(request.SubscriptionID)
-	}
-	s.connections[request.SubscriptionID] = conn
-	return nil
-}
-
-func (s *sqsBackend) killConnection(subscriptionID string) {
-	s.clientLock.Lock()
-	defer s.clientLock.Unlock()
-	s.killConnectionWithLock(subscriptionID)
-}
-
-func (s *sqsBackend) killConnectionWithLock(subscriptionID string) {
-	delete(s.connections, subscriptionID)
-}
-
-func (s *sqsBackend) getConn(subscriptionID string) (*sqsConnection, error) {
-	s.clientLock.RLock()
-	defer s.clientLock.RUnlock()
-	conn, ok := s.connections[subscriptionID]
-	if !ok {
-		return nil, fmt.Errorf("invalid subscription_id")
-	}
-	return conn, nil
-}
-
-func (s *sqsBackend) Send(_ context.Context, send *event.SendRequest) error {
-	return s.sendSubscriptionEventInternal(send.SubscriptionID, send.EventJSON, false)
-}
-
-func (s *sqsBackend) refreshClient(subscriptionID string) error {
-	conn, err := s.getConn(subscriptionID)
-	if err != nil {
-		return err
-	}
-	client, err := newClient(conn.config)
-	if err != nil {
-		return err
-	}
-	s.clientLock.Lock()
-	defer s.clientLock.Unlock()
-	conn.client = client
-	// probably not necessary, but just in case
-	s.connections[subscriptionID] = conn
-	return nil
-}
-
-func (s *sqsBackend) sendSubscriptionEventInternal(subscriptionID string, eventJson string, isRetry bool) error {
-	conn, err := s.getConn(subscriptionID)
-	if err != nil {
-		return err
-	}
-	backoff := conn.config.NewRetryBackoff()
-	err = backoff.Retry(func() error {
-		_, err = conn.client.SendMessage(&sqs.SendMessageInput{
-			MessageBody: &eventJson,
-			QueueUrl:    &conn.queueURL,
-		})
-		return err
-	})
-	if err != nil && !isRetry {
-		// refresh client and try again, once
-		err2 := s.refreshClient(subscriptionID)
-		if err2 != nil {
-			return errors.Join(err, err2)
-		}
-		return s.sendSubscriptionEventInternal(subscriptionID, eventJson, true)
-	} else if err != nil && isRetry {
-		s.killConnection(subscriptionID)
-		return err
-	}
-	return nil
-}
-
-func (s *sqsBackend) Unsubscribe(_ context.Context, request *event.UnsubscribeRequest) error {
-	s.killConnection(request.SubscriptionID)
-	return nil
-}
-
-func (s *sqsBackend) PluginMetadata() *event.PluginMetadata {
-	return &event.PluginMetadata{
-		Name:    pluginName,
-		Version: version.GetVersion().Version,
-	}
-}
-
-func (s *sqsBackend) PluginVersion() logical.PluginVersion {
-	return logical.PluginVersion{
-		Version: version.GetVersion().Version,
-	}
-}
-
-func (s *sqsBackend) Close(_ context.Context) error {
-	s.clientLock.Lock()
-	defer s.clientLock.Unlock()
-	var subscriptions []string
-	for k := range s.connections {
-		subscriptions = append(subscriptions, k)
-	}
-	for _, subscription := range subscriptions {
-		s.killConnectionWithLock(subscription)
-	}
-	return nil
-}
diff --git a/plugins/event/sqs/sqs_test.go b/plugins/event/sqs/sqs_test.go
deleted file mode 100644
index 35d91b22f14..00000000000
--- a/plugins/event/sqs/sqs_test.go
+++ /dev/null
@@ -1,118 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package sqs
-
-import (
-	"context"
-	"os"
-	"testing"
-
-	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/service/sqs"
-	"github.com/hashicorp/go-uuid"
-	"github.com/hashicorp/vault/plugins/event"
-	"github.com/stretchr/testify/assert"
-)
-
-func getTestClient(t *testing.T) *sqs.Client {
-	awsConfig, err := config.LoadDefaultConfig(context.Background(), config.WithRegion(os.Getenv("AWS_REGION")))
-	if err != nil {
-		t.Fatal(err)
-	}
-	return sqs.NewFromConfig(awsConfig)
-}
-
-func createQueue(t *testing.T, client *sqs.Client, queueName string) string {
-	resp, err := client.CreateQueue(context.Background(), &sqs.CreateQueueInput{
-		QueueName: &queueName,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return *resp.QueueUrl
-}
-
-func deleteQueue(t *testing.T, client *sqs.Client, queueURL string) {
-	_, err := client.DeleteQueue(context.Background(), &sqs.DeleteQueueInput{
-		QueueUrl: &queueURL,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-}
-
-func receiveMessage(t *testing.T, client *sqs.Client, queueURL string) string {
-	resp, err := client.ReceiveMessage(context.Background(), &sqs.ReceiveMessageInput{
-		QueueUrl:        &queueURL,
-		WaitTimeSeconds: 5,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	assert.Len(t, resp.Messages, 1)
-	msg := resp.Messages[0]
-	_, err = client.DeleteMessage(context.Background(), &sqs.DeleteMessageInput{
-		QueueUrl:      &queueURL,
-		ReceiptHandle: msg.ReceiptHandle,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return *msg.Body
-}
-
-// TestSQS_SendOneMessage tests that the plugin basic flow of subscribe/sendevent/unsubscribe will send a message to SQS.
-func TestSQS_SendOneMessage(t *testing.T) {
-	region := os.Getenv("AWS_REGION")
-	if region == "" {
-		t.Skip("Must set AWS_REGION")
-	}
-	sqsClient := getTestClient(t)
-	temp, err := uuid.GenerateUUID()
-	assert.Nil(t, err)
-	tempQueueName := "event-sqs-test-" + temp
-	tempQueueURL := createQueue(t, sqsClient, tempQueueName)
-	t.Cleanup(func() {
-		deleteQueue(t, sqsClient, tempQueueURL)
-	})
-
-	backend, _ := New(nil)
-	subID, err := uuid.GenerateUUID()
-	assert.Nil(t, err)
-
-	err = backend.Subscribe(nil, &event.SubscribeRequest{
-		SubscriptionID: subID,
-		Config: map[string]interface{}{
-			"queue_name":   tempQueueName,
-			"region":       os.Getenv("AWS_REGION"),
-			"create_queue": true,
-		},
-		VerifyConnection: false,
-	})
-	assert.Nil(t, err)
-
-	// create another subscription with the same queue to make sure we are okay with using an existing queue
-	err = backend.Subscribe(nil, &event.SubscribeRequest{
-		SubscriptionID: subID + "2",
-		Config: map[string]interface{}{
-			"queue_name":   tempQueueName,
-			"region":       os.Getenv("AWS_REGION"),
-			"create_queue": true,
-		},
-		VerifyConnection: false,
-	})
-	assert.Nil(t, err)
-
-	err = backend.Send(nil, &event.SendRequest{
-		SubscriptionID: subID,
-		EventJSON:      "{}",
-	})
-	assert.Nil(t, err)
-
-	msg := receiveMessage(t, sqsClient, tempQueueURL)
-	assert.Equal(t, "{}", msg)
-
-	err = backend.Unsubscribe(nil, &event.UnsubscribeRequest{SubscriptionID: subID})
-	assert.Nil(t, err)
-}
diff --git a/scan.hcl b/scan.hcl
index 6fb499794c7..bca20f15f4d 100644
--- a/scan.hcl
+++ b/scan.hcl
@@ -1,25 +1,33 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 repository {
   go_modules = true
-  osv = true
-  secrets {
-    all = true
-  } 
+  osv        = true
+
   dependabot {
-    required = true
+    required     = true
     check_config = true
   }
-  
+
+  plugin "codeql" {
+    languages = ["go"]
+  }
+
   plugin "semgrep" {
     use_git_ignore = true
-    exclude = ["vendor"]
-    config = ["tools/semgrep/ci", "p/r2c-security-audit"]
+    exclude        = ["vendor"]
+    config = [
+      "tools/semgrep/ci",
+      "p/r2c-security-audit",
+      "r/trailofbits.go.hanging-goroutine.hanging-goroutine",
+      "r/trailofbits.go.racy-append-to-slice.racy-append-to-slice",
+      "r/trailofbits.go.racy-write-to-map.racy-write-to-map",
+    ]
     exclude_rule = ["generic.html-templates.security.unquoted-attribute-var.unquoted-attribute-var"]
   }
-  
-  plugin "codeql" {
-    languages = ["go"]
+
+  secrets {
+    all = true
   }
 }
diff --git a/scripts/assetcheck.sh b/scripts/assetcheck.sh
index 158f5bc4aa7..f7990ad2a60 100755
--- a/scripts/assetcheck.sh
+++ b/scripts/assetcheck.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
diff --git a/scripts/build.sh b/scripts/build.sh
index ae247e636bf..4d90364c1ee 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 #
diff --git a/scripts/ci-helper.sh b/scripts/ci-helper.sh
index a87ba430540..b1440663488 100755
--- a/scripts/ci-helper.sh
+++ b/scripts/ci-helper.sh
@@ -1,8 +1,7 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
-
 # The ci-helper is used to determine build metadata, build Vault binaries,
 # package those binaries into artifacts, and execute tests with those artifacts.
 
@@ -92,7 +91,14 @@ function build() {
   : "${GO_TAGS:=""}"
   : "${REMOVE_SYMBOLS:=""}"
 
-  (unset GOOS; unset GOARCH; go generate ./...)
+  # Generate code but make sure we don't slurp in cross compilation env vars
+  (
+    unset GOOS
+    unset GOARCH
+    unset CC
+    unset CC_FOR_TARGET
+    go generate ./...
+  )
 
   # Build our ldflags
   msg="--> Building Vault revision $revision, built $build_date..."
@@ -118,29 +124,47 @@ function build() {
   mkdir -p out
   set -x
   go env
-  go build -v -tags "$GO_TAGS" -ldflags "$ldflags" -o dist/
+  go build -v -buildvcs=false -tags "$GO_TAGS" -ldflags "$ldflags" -o dist/
   set +x
   popd
 }
 
-# Prepare legal requirements for packaging
-function prepare_legal() {
+# ENT: Prepare legal requirements for packaging
+function prepare_ent_legal() {
+  : "${PKG_NAME:="vault"}"
+
+  if [ -z "${LICENSE_DIR:-}" ]; then
+      echo "You must set LICENSE_DIR; example: export LICENSE_DIR=.release/ibm-pao/license/default" 1>&2
+      return 1
+  fi
+
+  pushd "$(repo_root)"
+  mkdir -p dist
+  cp -R "$LICENSE_DIR" dist/
+  mkdir -p ".release/linux/package/usr/share/doc/$PKG_NAME"
+  cp -R "$LICENSE_DIR" ".release/linux/package/usr/share/doc/$PKG_NAME/"
+  popd
+}
+
+# CE: Prepare legal requirements for packaging
+function prepare_ce_legal() {
   : "${PKG_NAME:="vault"}"
 
   pushd "$(repo_root)"
+
   mkdir -p dist
-  curl -o dist/EULA.txt https://eula.hashicorp.com/EULA.txt
-  curl -o dist/TermsOfEvaluation.txt https://eula.hashicorp.com/TermsOfEvaluation.txt
+  cp LICENSE dist/LICENSE.txt
+
   mkdir -p ".release/linux/package/usr/share/doc/$PKG_NAME"
-  cp dist/EULA.txt ".release/linux/package/usr/share/doc/$PKG_NAME/EULA.txt"
-  cp dist/TermsOfEvaluation.txt ".release/linux/package/usr/share/doc/$PKG_NAME/TermsOfEvaluation.txt"
+  cp LICENSE ".release/linux/package/usr/share/doc/$PKG_NAME/LICENSE.txt"
+
   popd
 }
 
 # Package version converts a vault version string into a compatible representation for system
 # packages.
 function version_package() {
-  awk '{ gsub("-","~",$1); print $1 }' <<< "$VAULT_VERSION"
+  awk '{ gsub("-","~",$1); print $1 }' <<<"$VAULT_VERSION"
 }
 
 # Run the CI Helper
@@ -148,32 +172,35 @@ function main() {
   case $1 in
   artifact-basename)
     artifact_basename
-  ;;
+    ;;
   build)
     build
-  ;;
+    ;;
   build-ui)
     build_ui
-  ;;
+    ;;
   bundle)
     bundle
-  ;;
+    ;;
   date)
     build_date
-  ;;
-  prepare-legal)
-    prepare_legal
-  ;;
+    ;;
+  prepare-ent-legal)
+    prepare_ent_legal
+    ;;
+  prepare-ce-legal)
+    prepare_ce_legal
+    ;;
   revision)
     build_revision
-  ;;
+    ;;
   version-package)
     version_package
-  ;;
+    ;;
   *)
     echo "unknown sub-command" >&2
     exit 1
-  ;;
+    ;;
   esac
 }
 
diff --git a/scripts/copywrite-exceptions.sh b/scripts/copywrite-exceptions.sh
index 0e55acb400d..6343e36cfed 100755
--- a/scripts/copywrite-exceptions.sh
+++ b/scripts/copywrite-exceptions.sh
@@ -1,13 +1,14 @@
 #!/bin/sh
 
 # Used as a stopgap for copywrite bot in MPL-licensed subdirs, detects BUSL licensed
-# headers and deletes them, then runs the copywrite bot to utilize local subdir config
+# headers in only files intended for public users, and deletes them,
+# then runs the copywrite bot to utilize local subdir config
 # to inject correct headers.
 
-find . -type f -name '*.go' | while read line; do
+find . -type f -name '*.go' -not -name '*_ent.go' -not -name '*_ent_test.go' | while read line; do
   if grep "SPDX-License-Identifier: BUSL-1.1" $line; then
     sed -i '/SPDX-License-Identifier: BUSL-1.1/d' $line
-    sed -i '/Copyright (c) HashiCorp, Inc./d' $line
+    sed -i '/Copyright IBM Corp. 2016, 2025/d' $line
   fi
 done
 
diff --git a/scripts/coverage.sh b/scripts/coverage.sh
index 90ade0e2d32..ab68f5db6aa 100755
--- a/scripts/coverage.sh
+++ b/scripts/coverage.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 # Generate test coverage statistics for Go packages.
diff --git a/scripts/cross/Dockerfile b/scripts/cross/Dockerfile
index 030ef9c379f..065f93547bd 100644
--- a/scripts/cross/Dockerfile
+++ b/scripts/cross/Dockerfile
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 FROM debian:buster
@@ -15,7 +15,7 @@ RUN apt-get update -y && apt-get install --no-install-recommends -y -q \
                          libltdl-dev \
                          libltdl7
 
-RUN curl -sL https://deb.nodesource.com/setup_18.x | bash -
+RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
 RUN curl -sL https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
 RUN echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
 
diff --git a/scripts/deprecations-checker.sh b/scripts/deprecations-checker.sh
index b63ab905d77..2fc33d8761c 100755
--- a/scripts/deprecations-checker.sh
+++ b/scripts/deprecations-checker.sh
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 # This script is sourced into the shell running in a Github Actions workflow.
diff --git a/scripts/deps_upgrade.py b/scripts/deps_upgrade.py
deleted file mode 100644
index 88607e34877..00000000000
--- a/scripts/deps_upgrade.py
+++ /dev/null
@@ -1,13 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-import os
-import sys
-
-filename = sys.argv[1]
-with open(filename) as f:
-    content = f.readlines()
-    for l in content:
-        name = l.split()[0]
-        print(name)
-        os.system("go get " + name + "@latest")
\ No newline at end of file
diff --git a/scripts/dist.sh b/scripts/dist.sh
index 0431bcc6128..40351ec165b 100755
--- a/scripts/dist.sh
+++ b/scripts/dist.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
diff --git a/scripts/docker/Dockerfile b/scripts/docker/Dockerfile
index c975e445b49..62ad403f256 100644
--- a/scripts/docker/Dockerfile
+++ b/scripts/docker/Dockerfile
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 # Multi-stage builder to avoid polluting users environment with wrong
diff --git a/scripts/docker/Dockerfile.ui b/scripts/docker/Dockerfile.ui
index f67d04029b7..20f6cd1b175 100644
--- a/scripts/docker/Dockerfile.ui
+++ b/scripts/docker/Dockerfile.ui
@@ -19,7 +19,7 @@ RUN apt-get update -y && apt-get install --no-install-recommends -y -q \
                          libltdl-dev \
                          libltdl7
 
-RUN curl -sL https://deb.nodesource.com/setup_18.x | bash -
+RUN curl -sL https://deb.nodesource.com/setup_20.x | bash -
 RUN curl -sL https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
 RUN echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
 
diff --git a/scripts/docker/docker-entrypoint.sh b/scripts/docker/docker-entrypoint.sh
index a3b581697c3..b43a9fcedda 100755
--- a/scripts/docker/docker-entrypoint.sh
+++ b/scripts/docker/docker-entrypoint.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/dumb-init /bin/sh
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -e
diff --git a/scripts/gen_openapi.sh b/scripts/gen_openapi.sh
index ef2acca0a0b..a2b829a2858 100755
--- a/scripts/gen_openapi.sh
+++ b/scripts/gen_openapi.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
@@ -54,7 +54,6 @@ vault auth enable "alicloud"
 vault auth enable "approle"
 vault auth enable "aws"
 vault auth enable "azure"
-vault auth enable "centrify"
 vault auth enable "cert"
 vault auth enable "cf"
 vault auth enable "gcp"
@@ -90,11 +89,14 @@ vault secrets enable "totp"
 vault secrets enable "transit"
 
 # Enable enterprise features
-if [[ -n "${VAULT_LICENSE:-}" ]]; then
+# Check if vault version contains +ent
+if vault version | grep -q "+ent"; then
     vault secrets enable "keymgmt"
     vault secrets enable "kmip"
     vault secrets enable "transform"
     vault auth enable "saml"
+    vault auth enable "scep"
+    vault auth enable "spiffe"
 fi
 
 # Output OpenAPI, optionally formatted
diff --git a/scripts/go-helper.sh b/scripts/go-helper.sh
index 27fc0151cb5..fed0d7d5756 100755
--- a/scripts/go-helper.sh
+++ b/scripts/go-helper.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -euo pipefail
@@ -8,41 +8,67 @@ set -euo pipefail
 check_fmt() {
   echo "==> Checking code formatting..."
 
-  declare -a malformed=()
+  declare -a malformed_imports=()
+  declare -a malformed_formatting=()
+  local failed=0
   IFS=" " read -r -a files <<< "$(tr '\n' ' ' <<< "$@")"
   if [ -n "${files+set}" ] && [[ "${files[0]}" != "" ]]; then
     echo "--> Checking changed files..."
     for file in "${files[@]}"; do
       if [ ! -f "$file" ]; then
-        echo "--> $file no longer exists ⚠"
+        echo "----> $file no longer exists ⚠"
         continue
       fi
 
       if echo "$file" | grep -v pb.go | grep -v vendor > /dev/null; then
         local output
+        if ! output=$(gosimports -d "$file") || [ "$output" != "" ]; then
+          echo "----> ${file} ✖ (gosimports)"
+          malformed_imports+=("$file")
+          failed=1
+        fi
         if ! output=$(gofumpt -l "$file") || [ "$output" != "" ]; then
-          echo "--> ${file} ✖"
-          malformed+=("$file")
+          echo "----> ${file} ✖ (gofumpt)"
+          malformed_formatting+=("$file")
+          failed=1
+        fi
+
+        if [ "$failed" == 1 ]; then
           continue
         fi
       fi
 
-      echo "--> ${file} ✔"
+      echo "----> ${file} ✔"
     done
   else
     echo "--> Checking all files..."
-    IFS=" " read -r -a malformed <<< "$(find . -name '*.go' | grep -v pb.go | grep -v vendor | xargs gofumpt -l)"
+    IFS=" " read -r -a malformed_imports <<< "$(find . -name '*.go' | grep -v pb.go | grep -v vendor | xargs gosimports -l | tr '\n' ' ')"
+    IFS=" " read -r -a malformed_formatting <<< "$(find . -name '*.go' | grep -v pb.go | grep -v vendor | xargs gofumpt -l)"
   fi
 
-  if [ "${#malformed[@]}" -ne 0 ] && [ -n "${malformed[0]}" ] ; then
+  if [ "${#malformed_imports[@]}" -ne 0 ] && [ -n "${malformed_imports[0]}" ]; then
+    failed=1
+    echo "--> The following files need to be reformatted with gosimports"
+    printf '%s\n' "${malformed_imports[*]}"
+    echo "Run \`make fmt\` to reformat code."
+    for file in "${malformed_imports[@]}"; do
+      gosimports -d "$file"
+    done
+  fi
+
+  if [ "${#malformed_formatting[@]}" -ne 0 ] && [ -n "${malformed_formatting[0]}" ]; then
+    failed=1
     echo "--> The following files need to be reformatted with gofumpt"
-    printf '%s\n' "${malformed[@]}"
+    printf '%s\n' "${malformed_formatting[@]}"
     echo "Run \`make fmt\` to reformat code."
-    for file in "${malformed[@]}"; do
+    for file in "${malformed_formatting[@]}"; do
       gofumpt -w "$file"
-      echo "$(git diff --no-color "$file")"
+      git diff --no-color "$file"
     done
-    exit 1
+  fi
+
+  if [ $failed == 1 ]; then
+    return 1
   fi
 }
 
@@ -62,10 +88,10 @@ check_version() {
     IFS="." read -r -a GO_VERSION_REQ <<< "$GO_VERSION_MIN"
 
     if [[ ${GO_VERSION_ARR[0]} -lt ${GO_VERSION_REQ[0]} ||
-      ( ${GO_VERSION_ARR[0]} -eq ${GO_VERSION_REQ[0]} &&
-      ( ${GO_VERSION_ARR[1]} -lt ${GO_VERSION_REQ[1]} ||
-      ( ${GO_VERSION_ARR[1]} -eq ${GO_VERSION_REQ[1]} && ${GO_VERSION_ARR[2]} -lt ${GO_VERSION_REQ[2]} )))
-    ]]; then
+      (${GO_VERSION_ARR[0]} -eq ${GO_VERSION_REQ[0]} &&
+      (${GO_VERSION_ARR[1]} -lt ${GO_VERSION_REQ[1]} ||
+      (${GO_VERSION_ARR[1]} -eq ${GO_VERSION_REQ[1]} && ${GO_VERSION_ARR[2]} -lt ${GO_VERSION_REQ[2]}))) ]] \
+      ; then
       echo "Vault requires go $GO_VERSION_MIN to build; found $GO_VERSION."
       exit 1
     fi
@@ -79,9 +105,10 @@ mod_download() {
   while IFS= read -r -d '' mod; do
     echo "==> Downloading Go modules for $mod to $(go env GOMODCACHE)..."
     pushd "$(dirname "$mod")" > /dev/null || (echo "failed to push into module dir" && exit 1)
-      GOOS=linux GOARCH=amd64 go mod download -x
+    GOOS=linux GOARCH=amd64 GOPRIVATE=github.com/hashicorp go mod download -x
+    GOOS=linux GOARCH=amd64 GOPRIVATE=github.com/hashicorp go list ./...
     popd > /dev/null || (echo "failed to pop out of module dir" && exit 1)
-  done < <(find . -type f -name go.mod -print0)
+  done < <(find . -type f -name go.mod -not -path "./tools/pipeline/*" -print0)
 }
 
 # Tidy all the go.mod's defined in the project.
@@ -89,29 +116,29 @@ mod_tidy() {
   while IFS= read -r -d '' mod; do
     echo "==> Tidying $mod..."
     pushd "$(dirname "$mod")" > /dev/null || (echo "failed to push into module dir" && exit 1)
-      GOOS=linux GOARCH=amd64 go mod tidy
+    GOOS=linux GOARCH=amd64 GOPRIVATE=github.com/hashicorp go mod tidy
     popd > /dev/null || (echo "failed to pop out of module dir" && exit 1)
   done < <(find . -type f -name go.mod -print0)
 }
 
 main() {
   case $1 in
-  mod-download)
-    mod_download
-  ;;
-  mod-tidy)
-    mod_tidy
-  ;;
-  check-fmt)
-    check_fmt "${@:2}"
-  ;;
-  check-version)
-    check_version "$2"
-  ;;
-  *)
-    echo "unknown sub-command" >&2
-    exit 1
-  ;;
+    mod-download)
+      mod_download
+      ;;
+    mod-tidy)
+      mod_tidy
+      ;;
+    check-fmt)
+      check_fmt "${@:2}"
+      ;;
+    check-version)
+      check_version "$2"
+      ;;
+    *)
+      echo "unknown sub-command" >&2
+      exit 1
+      ;;
   esac
 }
 
diff --git a/scripts/semgrep_plugin_repos.sh b/scripts/semgrep_plugin_repos.sh
index 1f70763feac..2a48a6b2d62 100755
--- a/scripts/semgrep_plugin_repos.sh
+++ b/scripts/semgrep_plugin_repos.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
diff --git a/scripts/testciphers.sh b/scripts/testciphers.sh
index 89c1e930433..2480daa773b 100755
--- a/scripts/testciphers.sh
+++ b/scripts/testciphers.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
diff --git a/scripts/update_plugin_modules.sh b/scripts/update_plugin_modules.sh
index 7d88f04ade7..8e53a03fe03 100755
--- a/scripts/update_plugin_modules.sh
+++ b/scripts/update_plugin_modules.sh
@@ -1,5 +1,5 @@
 #!/bin/sh
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 
diff --git a/scripts/windows/build.bat b/scripts/windows/build.bat
index 79e27605a72..e4928e7b4eb 100644
--- a/scripts/windows/build.bat
+++ b/scripts/windows/build.bat
@@ -63,7 +63,7 @@ del /f "%_GO_ENV_TMP_FILE%" 2>nul
 REM Build!
 echo ==^> Building...
 go build^
- -ldflags "-X github.com/hashicorp/vault/version.GitCommit=%_GIT_COMMIT%%_GIT_DIRTY% -X github.com/hashicorp/vault/version.BuildDate=%_BUILD_DATE%"^
+ -buildvcs=false -ldflags "-X github.com/hashicorp/vault/version.GitCommit=%_GIT_COMMIT%%_GIT_DIRTY% -X github.com/hashicorp/vault/version.BuildDate=%_BUILD_DATE%"^
  -o "bin/vault.exe"^
  .
 
diff --git a/sdk/LICENSE b/sdk/LICENSE
index f4f97ee5853..a32743a27b0 100644
--- a/sdk/LICENSE
+++ b/sdk/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2015 HashiCorp, Inc.
+Copyright IBM Corp. 2016, 2025
 
 Mozilla Public License, version 2.0
 
diff --git a/sdk/README.md b/sdk/README.md
index d1062105350..378d6702b0c 100644
--- a/sdk/README.md
+++ b/sdk/README.md
@@ -10,3 +10,26 @@ such we expect the tag of this module will stay less than `v1.0.0`.
 
 For any major changes we will try to give advance notice in the CHANGES section
 of Vault's CHANGELOG.md.
+
+## Metrics Emission and Compatibility
+
+This module can emit metrics using either `github.com/armon/go-metrics` or `github.com/hashicorp/go-metrics`. Choosing between the libraries is controlled via build tags. 
+
+**Build Tags**
+* `armonmetrics` - Using this tag will cause metrics to be routed to `armon/go-metrics`
+* `hashicorpmetrics` - Using this tag will cause all metrics to be routed to `hashicorp/go-metrics`
+
+If no build tag is specified, the default behavior is to use `armon/go-metrics`. 
+
+**Deprecating `armon/go-metrics`**
+
+Emitting metrics to `armon/go-metrics` is officially deprecated. Usage of `armon/go-metrics` will remain the default until mid-2025 with opt-in support continuing to the end of 2025.
+
+**Migration**
+To migrate an application currently using the older `armon/go-metrics` to instead use `hashicorp/go-metrics` the following should be done.
+
+1. Upgrade libraries using `armon/go-metrics` to consume `hashicorp/go-metrics/compat` instead. This should involve only changing import statements. All repositories in the `hashicorp` namespace will be migrated by February of 2025.
+2. Update the application's library dependencies to those that have the compatibility layer configured.
+3. Update the application to use `hashicorp/go-metrics` for configuring metrics export instead of `armon/go-metrics`
+   * Replace all application imports of `github.com/armon/go-metrics` with `github.com/hashicorp/go-metrics`
+   * Instrument your build system to build with the `hashicorpmetrics` tag.
diff --git a/sdk/database/dbplugin/client.go b/sdk/database/dbplugin/client.go
index 265b46b6108..66decbce436 100644
--- a/sdk/database/dbplugin/client.go
+++ b/sdk/database/dbplugin/client.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
diff --git a/sdk/database/dbplugin/database.pb.go b/sdk/database/dbplugin/database.pb.go
index 7ca8eb7535e..3aa3b090c44 100644
--- a/sdk/database/dbplugin/database.pb.go
+++ b/sdk/database/dbplugin/database.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: sdk/database/dbplugin/database.proto
 
@@ -15,6 +15,7 @@ import (
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -26,21 +27,18 @@ const (
 
 // Deprecated: Marked as deprecated in sdk/database/dbplugin/database.proto.
 type InitializeRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Config           []byte `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
-	VerifyConnection bool   `protobuf:"varint,2,opt,name=verify_connection,json=verifyConnection,proto3" json:"verify_connection,omitempty"`
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	Config           []byte                 `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+	VerifyConnection bool                   `protobuf:"varint,2,opt,name=verify_connection,json=verifyConnection,proto3" json:"verify_connection,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *InitializeRequest) Reset() {
 	*x = InitializeRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *InitializeRequest) String() string {
@@ -51,7 +49,7 @@ func (*InitializeRequest) ProtoMessage() {}
 
 func (x *InitializeRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -81,21 +79,18 @@ func (x *InitializeRequest) GetVerifyConnection() bool {
 }
 
 type InitRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Config           []byte `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
-	VerifyConnection bool   `protobuf:"varint,2,opt,name=verify_connection,json=verifyConnection,proto3" json:"verify_connection,omitempty"`
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	Config           []byte                 `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+	VerifyConnection bool                   `protobuf:"varint,2,opt,name=verify_connection,json=verifyConnection,proto3" json:"verify_connection,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *InitRequest) Reset() {
 	*x = InitRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *InitRequest) String() string {
@@ -106,7 +101,7 @@ func (*InitRequest) ProtoMessage() {}
 
 func (x *InitRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -136,22 +131,19 @@ func (x *InitRequest) GetVerifyConnection() bool {
 }
 
 type CreateUserRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state          protoimpl.MessageState `protogen:"open.v1"`
 	Statements     *Statements            `protobuf:"bytes,1,opt,name=statements,proto3" json:"statements,omitempty"`
 	UsernameConfig *UsernameConfig        `protobuf:"bytes,2,opt,name=username_config,json=usernameConfig,proto3" json:"username_config,omitempty"`
 	Expiration     *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expiration,proto3" json:"expiration,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *CreateUserRequest) Reset() {
 	*x = CreateUserRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CreateUserRequest) String() string {
@@ -162,7 +154,7 @@ func (*CreateUserRequest) ProtoMessage() {}
 
 func (x *CreateUserRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -199,22 +191,19 @@ func (x *CreateUserRequest) GetExpiration() *timestamppb.Timestamp {
 }
 
 type RenewUserRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Statements    *Statements            `protobuf:"bytes,1,opt,name=statements,proto3" json:"statements,omitempty"`
+	Username      string                 `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
+	Expiration    *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expiration,proto3" json:"expiration,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Statements *Statements            `protobuf:"bytes,1,opt,name=statements,proto3" json:"statements,omitempty"`
-	Username   string                 `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
-	Expiration *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expiration,proto3" json:"expiration,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RenewUserRequest) Reset() {
 	*x = RenewUserRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RenewUserRequest) String() string {
@@ -225,7 +214,7 @@ func (*RenewUserRequest) ProtoMessage() {}
 
 func (x *RenewUserRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -262,21 +251,18 @@ func (x *RenewUserRequest) GetExpiration() *timestamppb.Timestamp {
 }
 
 type RevokeUserRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Statements    *Statements            `protobuf:"bytes,1,opt,name=statements,proto3" json:"statements,omitempty"`
+	Username      string                 `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Statements *Statements `protobuf:"bytes,1,opt,name=statements,proto3" json:"statements,omitempty"`
-	Username   string      `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RevokeUserRequest) Reset() {
 	*x = RevokeUserRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RevokeUserRequest) String() string {
@@ -287,7 +273,7 @@ func (*RevokeUserRequest) ProtoMessage() {}
 
 func (x *RevokeUserRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -317,20 +303,17 @@ func (x *RevokeUserRequest) GetUsername() string {
 }
 
 type RotateRootCredentialsRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Statements    []string               `protobuf:"bytes,1,rep,name=statements,proto3" json:"statements,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Statements []string `protobuf:"bytes,1,rep,name=statements,proto3" json:"statements,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RotateRootCredentialsRequest) Reset() {
 	*x = RotateRootCredentialsRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RotateRootCredentialsRequest) String() string {
@@ -341,7 +324,7 @@ func (*RotateRootCredentialsRequest) ProtoMessage() {}
 
 func (x *RotateRootCredentialsRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -364,10 +347,7 @@ func (x *RotateRootCredentialsRequest) GetStatements() []string {
 }
 
 type Statements struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// DEPRECATED, will be removed in 0.12
 	//
 	// Deprecated: Marked as deprecated in sdk/database/dbplugin/database.proto.
@@ -389,15 +369,15 @@ type Statements struct {
 	Rollback        []string `protobuf:"bytes,7,rep,name=rollback,proto3" json:"rollback,omitempty"`
 	Renewal         []string `protobuf:"bytes,8,rep,name=renewal,proto3" json:"renewal,omitempty"`
 	Rotation        []string `protobuf:"bytes,9,rep,name=rotation,proto3" json:"rotation,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *Statements) Reset() {
 	*x = Statements{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Statements) String() string {
@@ -408,7 +388,7 @@ func (*Statements) ProtoMessage() {}
 
 func (x *Statements) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -491,21 +471,18 @@ func (x *Statements) GetRotation() []string {
 }
 
 type UsernameConfig struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	DisplayName   string                 `protobuf:"bytes,1,opt,name=DisplayName,proto3" json:"DisplayName,omitempty"`
+	RoleName      string                 `protobuf:"bytes,2,opt,name=RoleName,proto3" json:"RoleName,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	DisplayName string `protobuf:"bytes,1,opt,name=DisplayName,proto3" json:"DisplayName,omitempty"`
-	RoleName    string `protobuf:"bytes,2,opt,name=RoleName,proto3" json:"RoleName,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *UsernameConfig) Reset() {
 	*x = UsernameConfig{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UsernameConfig) String() string {
@@ -516,7 +493,7 @@ func (*UsernameConfig) ProtoMessage() {}
 
 func (x *UsernameConfig) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -546,20 +523,17 @@ func (x *UsernameConfig) GetRoleName() string {
 }
 
 type InitResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Config        []byte                 `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Config []byte `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *InitResponse) Reset() {
 	*x = InitResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *InitResponse) String() string {
@@ -570,7 +544,7 @@ func (*InitResponse) ProtoMessage() {}
 
 func (x *InitResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -593,21 +567,18 @@ func (x *InitResponse) GetConfig() []byte {
 }
 
 type CreateUserResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Username      string                 `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	Password      string                 `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
-	Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CreateUserResponse) Reset() {
 	*x = CreateUserResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CreateUserResponse) String() string {
@@ -618,7 +589,7 @@ func (*CreateUserResponse) ProtoMessage() {}
 
 func (x *CreateUserResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -648,20 +619,17 @@ func (x *CreateUserResponse) GetPassword() string {
 }
 
 type TypeResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Type          string                 `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *TypeResponse) Reset() {
 	*x = TypeResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[10]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *TypeResponse) String() string {
@@ -672,7 +640,7 @@ func (*TypeResponse) ProtoMessage() {}
 
 func (x *TypeResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[10]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -695,20 +663,17 @@ func (x *TypeResponse) GetType() string {
 }
 
 type RotateRootCredentialsResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Config        []byte                 `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Config []byte `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RotateRootCredentialsResponse) Reset() {
 	*x = RotateRootCredentialsResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[11]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RotateRootCredentialsResponse) String() string {
@@ -719,7 +684,7 @@ func (*RotateRootCredentialsResponse) ProtoMessage() {}
 
 func (x *RotateRootCredentialsResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[11]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -742,18 +707,16 @@ func (x *RotateRootCredentialsResponse) GetConfig() []byte {
 }
 
 type Empty struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Empty) Reset() {
 	*x = Empty{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[12]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Empty) String() string {
@@ -764,7 +727,7 @@ func (*Empty) ProtoMessage() {}
 
 func (x *Empty) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[12]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -780,20 +743,17 @@ func (*Empty) Descriptor() ([]byte, []int) {
 }
 
 type GenerateCredentialsResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Password      string                 `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Password string `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GenerateCredentialsResponse) Reset() {
 	*x = GenerateCredentialsResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[13]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GenerateCredentialsResponse) String() string {
@@ -804,7 +764,7 @@ func (*GenerateCredentialsResponse) ProtoMessage() {}
 
 func (x *GenerateCredentialsResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[13]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -827,22 +787,19 @@ func (x *GenerateCredentialsResponse) GetPassword() string {
 }
 
 type StaticUserConfig struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Username      string                 `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	Password      string                 `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+	Create        bool                   `protobuf:"varint,3,opt,name=create,proto3" json:"create,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
-	Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
-	Create   bool   `protobuf:"varint,3,opt,name=create,proto3" json:"create,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *StaticUserConfig) Reset() {
 	*x = StaticUserConfig{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[14]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StaticUserConfig) String() string {
@@ -853,7 +810,7 @@ func (*StaticUserConfig) ProtoMessage() {}
 
 func (x *StaticUserConfig) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[14]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -890,21 +847,18 @@ func (x *StaticUserConfig) GetCreate() bool {
 }
 
 type SetCredentialsRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Statements       *Statements       `protobuf:"bytes,1,opt,name=statements,proto3" json:"statements,omitempty"`
-	StaticUserConfig *StaticUserConfig `protobuf:"bytes,2,opt,name=static_user_config,json=staticUserConfig,proto3" json:"static_user_config,omitempty"`
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	Statements       *Statements            `protobuf:"bytes,1,opt,name=statements,proto3" json:"statements,omitempty"`
+	StaticUserConfig *StaticUserConfig      `protobuf:"bytes,2,opt,name=static_user_config,json=staticUserConfig,proto3" json:"static_user_config,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *SetCredentialsRequest) Reset() {
 	*x = SetCredentialsRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[15]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *SetCredentialsRequest) String() string {
@@ -915,7 +869,7 @@ func (*SetCredentialsRequest) ProtoMessage() {}
 
 func (x *SetCredentialsRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[15]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -945,21 +899,18 @@ func (x *SetCredentialsRequest) GetStaticUserConfig() *StaticUserConfig {
 }
 
 type SetCredentialsResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Username      string                 `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	Password      string                 `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
-	Password string `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SetCredentialsResponse) Reset() {
 	*x = SetCredentialsResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_database_proto_msgTypes[16]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *SetCredentialsResponse) String() string {
@@ -970,7 +921,7 @@ func (*SetCredentialsResponse) ProtoMessage() {}
 
 func (x *SetCredentialsResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_database_proto_msgTypes[16]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1001,7 +952,7 @@ func (x *SetCredentialsResponse) GetPassword() string {
 
 var File_sdk_database_dbplugin_database_proto protoreflect.FileDescriptor
 
-var file_sdk_database_dbplugin_database_proto_rawDesc = []byte{
+var file_sdk_database_dbplugin_database_proto_rawDesc = string([]byte{
 	0x0a, 0x24, 0x73, 0x64, 0x6b, 0x2f, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x2f, 0x64,
 	0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2f, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65,
 	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x08, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
@@ -1165,22 +1116,22 @@ var file_sdk_database_dbplugin_database_proto_rawDesc = []byte{
 	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x64,
 	0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x2f, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
 	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_sdk_database_dbplugin_database_proto_rawDescOnce sync.Once
-	file_sdk_database_dbplugin_database_proto_rawDescData = file_sdk_database_dbplugin_database_proto_rawDesc
+	file_sdk_database_dbplugin_database_proto_rawDescData []byte
 )
 
 func file_sdk_database_dbplugin_database_proto_rawDescGZIP() []byte {
 	file_sdk_database_dbplugin_database_proto_rawDescOnce.Do(func() {
-		file_sdk_database_dbplugin_database_proto_rawDescData = protoimpl.X.CompressGZIP(file_sdk_database_dbplugin_database_proto_rawDescData)
+		file_sdk_database_dbplugin_database_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sdk_database_dbplugin_database_proto_rawDesc), len(file_sdk_database_dbplugin_database_proto_rawDesc)))
 	})
 	return file_sdk_database_dbplugin_database_proto_rawDescData
 }
 
 var file_sdk_database_dbplugin_database_proto_msgTypes = make([]protoimpl.MessageInfo, 17)
-var file_sdk_database_dbplugin_database_proto_goTypes = []interface{}{
+var file_sdk_database_dbplugin_database_proto_goTypes = []any{
 	(*InitializeRequest)(nil),             // 0: dbplugin.InitializeRequest
 	(*InitRequest)(nil),                   // 1: dbplugin.InitRequest
 	(*CreateUserRequest)(nil),             // 2: dbplugin.CreateUserRequest
@@ -1241,217 +1192,11 @@ func file_sdk_database_dbplugin_database_proto_init() {
 	if File_sdk_database_dbplugin_database_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_sdk_database_dbplugin_database_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*InitializeRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*InitRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateUserRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RenewUserRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RevokeUserRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RotateRootCredentialsRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Statements); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UsernameConfig); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*InitResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateUserResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TypeResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RotateRootCredentialsResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Empty); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GenerateCredentialsResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StaticUserConfig); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetCredentialsRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_database_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetCredentialsResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_sdk_database_dbplugin_database_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_database_dbplugin_database_proto_rawDesc), len(file_sdk_database_dbplugin_database_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   17,
 			NumExtensions: 0,
@@ -1462,7 +1207,6 @@ func file_sdk_database_dbplugin_database_proto_init() {
 		MessageInfos:      file_sdk_database_dbplugin_database_proto_msgTypes,
 	}.Build()
 	File_sdk_database_dbplugin_database_proto = out.File
-	file_sdk_database_dbplugin_database_proto_rawDesc = nil
 	file_sdk_database_dbplugin_database_proto_goTypes = nil
 	file_sdk_database_dbplugin_database_proto_depIdxs = nil
 }
diff --git a/sdk/database/dbplugin/database.proto b/sdk/database/dbplugin/database.proto
index e32f34d221f..e5a6a5d9d6b 100644
--- a/sdk/database/dbplugin/database.proto
+++ b/sdk/database/dbplugin/database.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 syntax = "proto3";
diff --git a/sdk/database/dbplugin/database_grpc.pb.go b/sdk/database/dbplugin/database_grpc.pb.go
index f62de0236ba..0f9669a0369 100644
--- a/sdk/database/dbplugin/database_grpc.pb.go
+++ b/sdk/database/dbplugin/database_grpc.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: sdk/database/dbplugin/database.proto
 
@@ -18,8 +18,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	Database_Type_FullMethodName                  = "/dbplugin.Database/Type"
@@ -60,8 +60,9 @@ func NewDatabaseClient(cc grpc.ClientConnInterface) DatabaseClient {
 }
 
 func (c *databaseClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TypeResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TypeResponse)
-	err := c.cc.Invoke(ctx, Database_Type_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Type_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -69,8 +70,9 @@ func (c *databaseClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallO
 }
 
 func (c *databaseClient) CreateUser(ctx context.Context, in *CreateUserRequest, opts ...grpc.CallOption) (*CreateUserResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateUserResponse)
-	err := c.cc.Invoke(ctx, Database_CreateUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_CreateUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -78,8 +80,9 @@ func (c *databaseClient) CreateUser(ctx context.Context, in *CreateUserRequest,
 }
 
 func (c *databaseClient) RenewUser(ctx context.Context, in *RenewUserRequest, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, Database_RenewUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_RenewUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -87,8 +90,9 @@ func (c *databaseClient) RenewUser(ctx context.Context, in *RenewUserRequest, op
 }
 
 func (c *databaseClient) RevokeUser(ctx context.Context, in *RevokeUserRequest, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, Database_RevokeUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_RevokeUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -96,8 +100,9 @@ func (c *databaseClient) RevokeUser(ctx context.Context, in *RevokeUserRequest,
 }
 
 func (c *databaseClient) RotateRootCredentials(ctx context.Context, in *RotateRootCredentialsRequest, opts ...grpc.CallOption) (*RotateRootCredentialsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RotateRootCredentialsResponse)
-	err := c.cc.Invoke(ctx, Database_RotateRootCredentials_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_RotateRootCredentials_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -105,8 +110,9 @@ func (c *databaseClient) RotateRootCredentials(ctx context.Context, in *RotateRo
 }
 
 func (c *databaseClient) Init(ctx context.Context, in *InitRequest, opts ...grpc.CallOption) (*InitResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(InitResponse)
-	err := c.cc.Invoke(ctx, Database_Init_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Init_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -114,8 +120,9 @@ func (c *databaseClient) Init(ctx context.Context, in *InitRequest, opts ...grpc
 }
 
 func (c *databaseClient) Close(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, Database_Close_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Close_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -123,8 +130,9 @@ func (c *databaseClient) Close(ctx context.Context, in *Empty, opts ...grpc.Call
 }
 
 func (c *databaseClient) SetCredentials(ctx context.Context, in *SetCredentialsRequest, opts ...grpc.CallOption) (*SetCredentialsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SetCredentialsResponse)
-	err := c.cc.Invoke(ctx, Database_SetCredentials_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_SetCredentials_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -132,8 +140,9 @@ func (c *databaseClient) SetCredentials(ctx context.Context, in *SetCredentialsR
 }
 
 func (c *databaseClient) GenerateCredentials(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*GenerateCredentialsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GenerateCredentialsResponse)
-	err := c.cc.Invoke(ctx, Database_GenerateCredentials_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_GenerateCredentials_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -142,8 +151,9 @@ func (c *databaseClient) GenerateCredentials(ctx context.Context, in *Empty, opt
 
 // Deprecated: Do not use.
 func (c *databaseClient) Initialize(ctx context.Context, in *InitializeRequest, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, Database_Initialize_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Initialize_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -152,7 +162,7 @@ func (c *databaseClient) Initialize(ctx context.Context, in *InitializeRequest,
 
 // DatabaseServer is the server API for Database service.
 // All implementations must embed UnimplementedDatabaseServer
-// for forward compatibility
+// for forward compatibility.
 type DatabaseServer interface {
 	Type(context.Context, *Empty) (*TypeResponse, error)
 	CreateUser(context.Context, *CreateUserRequest) (*CreateUserResponse, error)
@@ -168,9 +178,12 @@ type DatabaseServer interface {
 	mustEmbedUnimplementedDatabaseServer()
 }
 
-// UnimplementedDatabaseServer must be embedded to have forward compatible implementations.
-type UnimplementedDatabaseServer struct {
-}
+// UnimplementedDatabaseServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedDatabaseServer struct{}
 
 func (UnimplementedDatabaseServer) Type(context.Context, *Empty) (*TypeResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Type not implemented")
@@ -203,6 +216,7 @@ func (UnimplementedDatabaseServer) Initialize(context.Context, *InitializeReques
 	return nil, status.Errorf(codes.Unimplemented, "method Initialize not implemented")
 }
 func (UnimplementedDatabaseServer) mustEmbedUnimplementedDatabaseServer() {}
+func (UnimplementedDatabaseServer) testEmbeddedByValue()                  {}
 
 // UnsafeDatabaseServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to DatabaseServer will
@@ -212,6 +226,13 @@ type UnsafeDatabaseServer interface {
 }
 
 func RegisterDatabaseServer(s grpc.ServiceRegistrar, srv DatabaseServer) {
+	// If the following call pancis, it indicates UnimplementedDatabaseServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&Database_ServiceDesc, srv)
 }
 
diff --git a/sdk/database/dbplugin/databasemiddleware.go b/sdk/database/dbplugin/databasemiddleware.go
index d7cabafefe2..07b0b1a6a9b 100644
--- a/sdk/database/dbplugin/databasemiddleware.go
+++ b/sdk/database/dbplugin/databasemiddleware.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -11,9 +11,9 @@ import (
 	"sync"
 	"time"
 
-	metrics "github.com/armon/go-metrics"
 	"github.com/hashicorp/errwrap"
 	log "github.com/hashicorp/go-hclog"
+	metrics "github.com/hashicorp/go-metrics/compat"
 	"google.golang.org/grpc/status"
 )
 
diff --git a/sdk/database/dbplugin/grpc_transport.go b/sdk/database/dbplugin/grpc_transport.go
index 456be812d2b..bf974392443 100644
--- a/sdk/database/dbplugin/grpc_transport.go
+++ b/sdk/database/dbplugin/grpc_transport.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
diff --git a/sdk/database/dbplugin/plugin.go b/sdk/database/dbplugin/plugin.go
index 5b9aaae0aec..a3388c76b37 100644
--- a/sdk/database/dbplugin/plugin.go
+++ b/sdk/database/dbplugin/plugin.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -10,7 +10,7 @@ import (
 
 	"github.com/hashicorp/errwrap"
 	log "github.com/hashicorp/go-hclog"
-	plugin "github.com/hashicorp/go-plugin"
+	"github.com/hashicorp/go-plugin"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"google.golang.org/grpc"
diff --git a/sdk/database/dbplugin/server.go b/sdk/database/dbplugin/server.go
index bf96a3bba4d..f3ed2e7884a 100644
--- a/sdk/database/dbplugin/server.go
+++ b/sdk/database/dbplugin/server.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
diff --git a/sdk/database/dbplugin/v5/conversions_test.go b/sdk/database/dbplugin/v5/conversions_test.go
index 5e65c346706..48f6aac3af3 100644
--- a/sdk/database/dbplugin/v5/conversions_test.go
+++ b/sdk/database/dbplugin/v5/conversions_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -116,6 +116,7 @@ func TestConversionsHaveAllFields(t *testing.T) {
 					},
 				},
 			},
+			SelfManagedPassword: "test-password",
 		}
 
 		protoReq, err := updateUserReqToProto(req)
@@ -194,6 +195,7 @@ func TestConversionsHaveAllFields(t *testing.T) {
 					},
 				},
 			},
+			SelfManagedPassword: "test-password",
 		}
 
 		protoReq, err := getUpdateUserRequest(req)
diff --git a/sdk/database/dbplugin/v5/credentialtype_enumer.go b/sdk/database/dbplugin/v5/credentialtype_enumer.go
new file mode 100644
index 00000000000..d61011b718e
--- /dev/null
+++ b/sdk/database/dbplugin/v5/credentialtype_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=CredentialType -trimprefix=CredentialType -transform=snake"; DO NOT EDIT.
+
+package dbplugin
+
+import (
+	"fmt"
+)
+
+const _CredentialTypeName = "passwordrsa_private_keyclient_certificate"
+
+var _CredentialTypeIndex = [...]uint8{0, 8, 23, 41}
+
+func (i CredentialType) String() string {
+	if i < 0 || i >= CredentialType(len(_CredentialTypeIndex)-1) {
+		return fmt.Sprintf("CredentialType(%d)", i)
+	}
+	return _CredentialTypeName[_CredentialTypeIndex[i]:_CredentialTypeIndex[i+1]]
+}
+
+var _CredentialTypeValues = []CredentialType{0, 1, 2}
+
+var _CredentialTypeNameToValueMap = map[string]CredentialType{
+	_CredentialTypeName[0:8]:   0,
+	_CredentialTypeName[8:23]:  1,
+	_CredentialTypeName[23:41]: 2,
+}
+
+// CredentialTypeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func CredentialTypeString(s string) (CredentialType, error) {
+	if val, ok := _CredentialTypeNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to CredentialType values", s)
+}
+
+// CredentialTypeValues returns all values of the enum
+func CredentialTypeValues() []CredentialType {
+	return _CredentialTypeValues
+}
+
+// IsACredentialType returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i CredentialType) IsACredentialType() bool {
+	for _, v := range _CredentialTypeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdk/database/dbplugin/v5/database.go b/sdk/database/dbplugin/v5/database.go
index 065aaefd5a2..9a18352cbb3 100644
--- a/sdk/database/dbplugin/v5/database.go
+++ b/sdk/database/dbplugin/v5/database.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -144,6 +144,8 @@ type NewUserResponse struct {
 	Username string
 }
 
+//go:generate enumer -type=CredentialType -trimprefix=CredentialType -transform=snake
+
 // CredentialType is a type of database credential.
 type CredentialType int
 
@@ -153,19 +155,6 @@ const (
 	CredentialTypeClientCertificate
 )
 
-func (k CredentialType) String() string {
-	switch k {
-	case CredentialTypePassword:
-		return "password"
-	case CredentialTypeRSAPrivateKey:
-		return "rsa_private_key"
-	case CredentialTypeClientCertificate:
-		return "client_certificate"
-	default:
-		return "unknown"
-	}
-}
-
 // ///////////////////////////////////////////////////////
 // UpdateUser()
 // ///////////////////////////////////////////////////////
@@ -192,6 +181,13 @@ type UpdateUserRequest struct {
 	// Expiration indicates the new expiration date to change to.
 	// If nil, no change is requested.
 	Expiration *ChangeExpiration
+
+	// SelfManagedPassword is the password for an externally managed user in the DB.
+	// If this field is supplied, a DB connection is retrieved from the static
+	// account cache for the particular DB plugin and used to update the password of
+	// the self-managed static role.
+	// *ENTERPRISE-ONLY*
+	SelfManagedPassword string
 }
 
 // ChangePublicKey of a given user
diff --git a/sdk/database/dbplugin/v5/grpc_client.go b/sdk/database/dbplugin/v5/grpc_client.go
index 9b0b984f42a..3a5aa51787c 100644
--- a/sdk/database/dbplugin/v5/grpc_client.go
+++ b/sdk/database/dbplugin/v5/grpc_client.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -7,10 +7,13 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"os"
+	"strconv"
 	"time"
 
 	"github.com/golang/protobuf/ptypes"
 	"github.com/hashicorp/vault/sdk/database/dbplugin/v5/proto"
+	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -23,9 +26,13 @@ var (
 )
 
 type gRPCClient struct {
+	entGRPCClient
 	client        proto.DatabaseClient
 	versionClient logical.PluginVersionClient
 	doneCtx       context.Context
+
+	// tier is the plugin tier
+	tier consts.PluginTier
 }
 
 func (c gRPCClient) PluginVersion() logical.PluginVersion {
@@ -199,11 +206,12 @@ func updateUserReqToProto(req UpdateUserRequest) (*proto.UpdateUserRequest, erro
 	}
 
 	rpcReq := &proto.UpdateUserRequest{
-		Username:       req.Username,
-		CredentialType: int32(req.CredentialType),
-		Password:       password,
-		PublicKey:      publicKey,
-		Expiration:     expiration,
+		Username:            req.Username,
+		CredentialType:      int32(req.CredentialType),
+		Password:            password,
+		PublicKey:           publicKey,
+		Expiration:          expiration,
+		SelfManagedPassword: req.SelfManagedPassword,
 	}
 	return rpcReq, nil
 }
@@ -269,7 +277,7 @@ func deleteUserRespFromProto(rpcResp *proto.DeleteUserResponse) (DeleteUserRespo
 }
 
 func (c gRPCClient) Type() (string, error) {
-	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+	ctx, cancel := getContextWithTimeout(pluginutil.PluginGRPCTimeoutType)
 	defer cancel()
 
 	typeResp, err := c.client.Type(ctx, &proto.Empty{})
@@ -282,16 +290,10 @@ func (c gRPCClient) Type() (string, error) {
 	return typeResp.GetType(), nil
 }
 
-func (c gRPCClient) Close() error {
-	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
-	defer cancel()
-
-	_, err := c.client.Close(ctx, &proto.Empty{})
-	if err != nil {
-		if c.doneCtx.Err() != nil {
-			return ErrPluginShutdown
-		}
-		return err
+func getContextWithTimeout(env string) (context.Context, context.CancelFunc) {
+	timeout := 1 // default timeout
+	if envTimeout, err := strconv.Atoi(os.Getenv(env)); err == nil && envTimeout > 0 {
+		timeout = envTimeout
 	}
-	return nil
+	return context.WithTimeout(context.Background(), time.Duration(timeout)*time.Second)
 }
diff --git a/sdk/database/dbplugin/v5/grpc_client_oss.go b/sdk/database/dbplugin/v5/grpc_client_oss.go
new file mode 100644
index 00000000000..33e6e269621
--- /dev/null
+++ b/sdk/database/dbplugin/v5/grpc_client_oss.go
@@ -0,0 +1,27 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package dbplugin
+
+import (
+	"github.com/hashicorp/vault/sdk/database/dbplugin/v5/proto"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
+)
+
+type entGRPCClient struct{}
+
+func (c gRPCClient) Close() error {
+	ctx, cancel := getContextWithTimeout(pluginutil.PluginGRPCTimeoutClose)
+	defer cancel()
+
+	_, err := c.client.Close(ctx, &proto.Empty{})
+	if err != nil {
+		if c.doneCtx.Err() != nil {
+			return ErrPluginShutdown
+		}
+		return err
+	}
+	return nil
+}
diff --git a/sdk/database/dbplugin/v5/grpc_client_oss_test.go b/sdk/database/dbplugin/v5/grpc_client_oss_test.go
new file mode 100644
index 00000000000..39f6dead1a5
--- /dev/null
+++ b/sdk/database/dbplugin/v5/grpc_client_oss_test.go
@@ -0,0 +1,31 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package dbplugin
+
+import (
+	"github.com/hashicorp/vault/sdk/database/dbplugin/v5/proto"
+)
+
+var _ proto.DatabaseClient = fakeClient{}
+
+type fakeClient struct {
+	initResp *proto.InitializeResponse
+	initErr  error
+
+	newUserResp *proto.NewUserResponse
+	newUserErr  error
+
+	updateUserResp *proto.UpdateUserResponse
+	updateUserErr  error
+
+	deleteUserResp *proto.DeleteUserResponse
+	deleteUserErr  error
+
+	typeResp *proto.TypeResponse
+	typeErr  error
+
+	closeErr error
+}
diff --git a/sdk/database/dbplugin/v5/grpc_client_test.go b/sdk/database/dbplugin/v5/grpc_client_test.go
index 05ecb960e60..59657c5fb89 100644
--- a/sdk/database/dbplugin/v5/grpc_client_test.go
+++ b/sdk/database/dbplugin/v5/grpc_client_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -518,26 +518,7 @@ func assertErrEquals(expectedErr error) errorAssertion {
 	}
 }
 
-var _ proto.DatabaseClient = fakeClient{}
-
-type fakeClient struct {
-	initResp *proto.InitializeResponse
-	initErr  error
-
-	newUserResp *proto.NewUserResponse
-	newUserErr  error
-
-	updateUserResp *proto.UpdateUserResponse
-	updateUserErr  error
-
-	deleteUserResp *proto.DeleteUserResponse
-	deleteUserErr  error
-
-	typeResp *proto.TypeResponse
-	typeErr  error
-
-	closeErr error
-}
+// fakeClient methods
 
 func (f fakeClient) Initialize(context.Context, *proto.InitializeRequest, ...grpc.CallOption) (*proto.InitializeResponse, error) {
 	return f.initResp, f.initErr
diff --git a/sdk/database/dbplugin/v5/grpc_database_plugin.go b/sdk/database/dbplugin/v5/grpc_database_plugin.go
index b428d4ce06e..2e4c1786540 100644
--- a/sdk/database/dbplugin/v5/grpc_database_plugin.go
+++ b/sdk/database/dbplugin/v5/grpc_database_plugin.go
@@ -1,16 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
 
 import (
-	"context"
-
 	"github.com/hashicorp/go-plugin"
-	"github.com/hashicorp/vault/sdk/database/dbplugin/v5/proto"
-	"github.com/hashicorp/vault/sdk/helper/pluginutil"
-	"github.com/hashicorp/vault/sdk/logical"
-	"google.golang.org/grpc"
 )
 
 // handshakeConfigs are used to just do a basic handshake between
@@ -37,36 +31,3 @@ var (
 	_ plugin.Plugin     = &GRPCDatabasePlugin{}
 	_ plugin.GRPCPlugin = &GRPCDatabasePlugin{}
 )
-
-func (d GRPCDatabasePlugin) GRPCServer(_ *plugin.GRPCBroker, s *grpc.Server) error {
-	var server gRPCServer
-
-	if d.Impl != nil {
-		server = gRPCServer{singleImpl: d.Impl}
-	} else {
-		// multiplexing is supported
-		server = gRPCServer{
-			factoryFunc: d.FactoryFunc,
-			instances:   make(map[string]Database),
-		}
-
-		// Multiplexing is enabled for this plugin, register the server so we
-		// can tell the client in Vault.
-		pluginutil.RegisterPluginMultiplexingServer(s, pluginutil.PluginMultiplexingServerImpl{
-			Supported: true,
-		})
-	}
-
-	proto.RegisterDatabaseServer(s, &server)
-	logical.RegisterPluginVersionServer(s, &server)
-	return nil
-}
-
-func (GRPCDatabasePlugin) GRPCClient(doneCtx context.Context, _ *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
-	client := gRPCClient{
-		client:        proto.NewDatabaseClient(c),
-		versionClient: logical.NewPluginVersionClient(c),
-		doneCtx:       doneCtx,
-	}
-	return client, nil
-}
diff --git a/sdk/database/dbplugin/v5/grpc_database_plugin_oss.go b/sdk/database/dbplugin/v5/grpc_database_plugin_oss.go
new file mode 100644
index 00000000000..7ccc37ed0ad
--- /dev/null
+++ b/sdk/database/dbplugin/v5/grpc_database_plugin_oss.go
@@ -0,0 +1,55 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package dbplugin
+
+import (
+	"context"
+
+	"github.com/hashicorp/go-plugin"
+	"github.com/hashicorp/vault/sdk/database/dbplugin/v5/proto"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
+	"github.com/hashicorp/vault/sdk/logical"
+	"google.golang.org/grpc"
+)
+
+// GRPCClient (Vault CE edition) initializes and returns a gRPCClient with Database and
+// PluginVersion gRPC clients. It implements GRPCClient() defined
+// by GRPCPlugin interface in go-plugin/plugin.go
+func (GRPCDatabasePlugin) GRPCClient(doneCtx context.Context, _ *plugin.GRPCBroker, c *grpc.ClientConn) (interface{}, error) {
+	client := gRPCClient{
+		client:        proto.NewDatabaseClient(c),
+		versionClient: logical.NewPluginVersionClient(c),
+		doneCtx:       doneCtx,
+	}
+	return client, nil
+}
+
+// GRPCServer (Vault CE edition) registers multiplexing server if the plugin supports it, and
+// registers the Database and PluginVersion gRPC servers. It implements GRPCServer() defined
+// by GRPCPlugin interface in go-plugin/plugin.go
+func (d GRPCDatabasePlugin) GRPCServer(_ *plugin.GRPCBroker, s *grpc.Server) error {
+	var server gRPCServer
+
+	if d.Impl != nil {
+		server = gRPCServer{singleImpl: d.Impl}
+	} else {
+		// multiplexing is supported
+		server = gRPCServer{
+			factoryFunc: d.FactoryFunc,
+			instances:   make(map[string]Database),
+		}
+
+		// Multiplexing is enabled for this plugin, register the server so we
+		// can tell the client in Vault.
+		pluginutil.RegisterPluginMultiplexingServer(s, pluginutil.PluginMultiplexingServerImpl{
+			Supported: true,
+		})
+	}
+
+	proto.RegisterDatabaseServer(s, &server)
+	logical.RegisterPluginVersionServer(s, &server)
+	return nil
+}
diff --git a/sdk/database/dbplugin/v5/grpc_server.go b/sdk/database/dbplugin/v5/grpc_server.go
index 7e1bc3fa1fc..b1f84618911 100644
--- a/sdk/database/dbplugin/v5/grpc_server.go
+++ b/sdk/database/dbplugin/v5/grpc_server.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -7,7 +7,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"sync"
 	"time"
 
 	"github.com/golang/protobuf/ptypes"
@@ -21,21 +20,6 @@ import (
 
 var _ proto.DatabaseServer = &gRPCServer{}
 
-type gRPCServer struct {
-	proto.UnimplementedDatabaseServer
-	logical.UnimplementedPluginVersionServer
-
-	// holds the non-multiplexed Database
-	// when this is set the plugin does not support multiplexing
-	singleImpl Database
-
-	// instances holds the multiplexed Databases
-	instances   map[string]Database
-	factoryFunc func() (interface{}, error)
-
-	sync.RWMutex
-}
-
 func (g *gRPCServer) getOrCreateDatabase(ctx context.Context) (Database, error) {
 	g.Lock()
 	defer g.Unlock()
@@ -171,12 +155,12 @@ func (g *gRPCServer) NewUser(ctx context.Context, req *proto.NewUserRequest) (*p
 
 func (g *gRPCServer) UpdateUser(ctx context.Context, req *proto.UpdateUserRequest) (*proto.UpdateUserResponse, error) {
 	if req.GetUsername() == "" {
-		return &proto.UpdateUserResponse{}, status.Errorf(codes.InvalidArgument, "no username provided")
+		return &proto.UpdateUserResponse{}, status.Error(codes.InvalidArgument, "no username provided")
 	}
 
 	dbReq, err := getUpdateUserRequest(req)
 	if err != nil {
-		return &proto.UpdateUserResponse{}, status.Errorf(codes.InvalidArgument, err.Error())
+		return &proto.UpdateUserResponse{}, status.Error(codes.InvalidArgument, err.Error())
 	}
 
 	impl, err := g.getDatabase(ctx)
@@ -222,11 +206,12 @@ func getUpdateUserRequest(req *proto.UpdateUserRequest) (UpdateUserRequest, erro
 	}
 
 	dbReq := UpdateUserRequest{
-		Username:       req.GetUsername(),
-		CredentialType: CredentialType(req.GetCredentialType()),
-		Password:       password,
-		PublicKey:      publicKey,
-		Expiration:     expiration,
+		Username:            req.GetUsername(),
+		CredentialType:      CredentialType(req.GetCredentialType()),
+		Password:            password,
+		PublicKey:           publicKey,
+		Expiration:          expiration,
+		SelfManagedPassword: req.SelfManagedPassword,
 	}
 
 	if !hasChange(dbReq) {
@@ -289,27 +274,46 @@ func (g *gRPCServer) Type(ctx context.Context, _ *proto.Empty) (*proto.TypeRespo
 
 func (g *gRPCServer) Close(ctx context.Context, _ *proto.Empty) (*proto.Empty, error) {
 	g.Lock()
-	defer g.Unlock()
 
 	impl, err := g.getDatabaseInternal(ctx)
 	if err != nil {
+		g.Unlock()
 		return nil, err
 	}
 
-	err = impl.Close()
-	if err != nil {
-		return &proto.Empty{}, status.Errorf(codes.Internal, "unable to close database plugin: %s", err)
-	}
-
+	var id string
 	if g.singleImpl == nil {
 		// only cleanup instances map when multiplexing is supported
-		id, err := pluginutil.GetMultiplexIDFromContext(ctx)
+		id, err = pluginutil.GetMultiplexIDFromContext(ctx)
 		if err != nil {
+			g.Unlock()
 			return nil, err
 		}
 		delete(g.instances, id)
 	}
 
+	// unlock here so that the subsequent call to Close() does not hold the
+	// lock in case the DB is slow to respond
+	g.Unlock()
+
+	err = impl.Close()
+	if err != nil {
+		// The call to Close failed, so we will put the DB instance back in the
+		// map. This might not be necessary, but we do this in case anything
+		// relies on being able to retry Close.
+		g.Lock()
+		defer g.Unlock()
+		if g.singleImpl == nil {
+			// There is a chance that while we were calling Close another DB
+			// config was created for the old ID. So we only put it back if
+			// it's not set.
+			if _, ok := g.instances[id]; !ok {
+				g.instances[id] = impl
+			}
+		}
+		return &proto.Empty{}, status.Errorf(codes.Internal, "unable to close database plugin: %s", err)
+	}
+
 	return &proto.Empty{}, nil
 }
 
diff --git a/sdk/database/dbplugin/v5/grpc_server_oss.go b/sdk/database/dbplugin/v5/grpc_server_oss.go
new file mode 100644
index 00000000000..53005b42f66
--- /dev/null
+++ b/sdk/database/dbplugin/v5/grpc_server_oss.go
@@ -0,0 +1,28 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package dbplugin
+
+import (
+	"sync"
+
+	"github.com/hashicorp/vault/sdk/database/dbplugin/v5/proto"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+type gRPCServer struct {
+	proto.UnimplementedDatabaseServer
+	logical.UnimplementedPluginVersionServer
+
+	// holds the non-multiplexed Database
+	// when this is set the plugin does not support multiplexing
+	singleImpl Database
+
+	// instances holds the multiplexed Databases
+	instances   map[string]Database
+	factoryFunc func() (interface{}, error)
+
+	sync.RWMutex
+}
diff --git a/sdk/database/dbplugin/v5/grpc_server_oss_test.go b/sdk/database/dbplugin/v5/grpc_server_oss_test.go
new file mode 100644
index 00000000000..70e8fa4bbdb
--- /dev/null
+++ b/sdk/database/dbplugin/v5/grpc_server_oss_test.go
@@ -0,0 +1,54 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package dbplugin
+
+import (
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+var _ Database = fakeDatabase{}
+
+type fakeDatabase struct {
+	initResp InitializeResponse
+	initErr  error
+
+	newUserResp NewUserResponse
+	newUserErr  error
+
+	updateUserResp UpdateUserResponse
+	updateUserErr  error
+
+	deleteUserResp DeleteUserResponse
+	deleteUserErr  error
+
+	typeResp string
+	typeErr  error
+
+	closeErr error
+}
+
+var _ Database = &recordingDatabase{}
+
+type recordingDatabase struct {
+	initializeCalls int
+	newUserCalls    int
+	updateUserCalls int
+	deleteUserCalls int
+	typeCalls       int
+	closeCalls      int
+
+	// recordingDatabase can act as middleware so we can record the calls to other test Database implementations
+	next Database
+}
+
+type fakeDatabaseWithVersion struct {
+	version string
+}
+
+var (
+	_ Database                = (*fakeDatabaseWithVersion)(nil)
+	_ logical.PluginVersioner = (*fakeDatabaseWithVersion)(nil)
+)
diff --git a/sdk/database/dbplugin/v5/grpc_server_test.go b/sdk/database/dbplugin/v5/grpc_server_test.go
index 847a9e770df..2b3376fe7c3 100644
--- a/sdk/database/dbplugin/v5/grpc_server_test.go
+++ b/sdk/database/dbplugin/v5/grpc_server_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -551,6 +551,19 @@ func TestGRPCServer_Close(t *testing.T) {
 				}
 			},
 		},
+		"error path for multiplexed plugin": {
+			db: fakeDatabase{
+				closeErr: errors.New("close error"),
+			},
+			expectErr:     true,
+			expectCode:    codes.Internal,
+			grpcSetupFunc: testGrpcServer,
+			assertFunc: func(t *testing.T, g gRPCServer) {
+				if len(g.instances) != 1 {
+					t.Fatalf("err expected instances map to contain exactly 1 element")
+				}
+			},
+		},
 		"happy path for non-multiplexed plugin": {
 			db:            fakeDatabase{},
 			expectErr:     false,
@@ -693,26 +706,7 @@ func (badJSONValue) UnmarshalJSON([]byte) error {
 	return fmt.Errorf("this cannot be unmarshalled from JSON")
 }
 
-var _ Database = fakeDatabase{}
-
-type fakeDatabase struct {
-	initResp InitializeResponse
-	initErr  error
-
-	newUserResp NewUserResponse
-	newUserErr  error
-
-	updateUserResp UpdateUserResponse
-	updateUserErr  error
-
-	deleteUserResp DeleteUserResponse
-	deleteUserErr  error
-
-	typeResp string
-	typeErr  error
-
-	closeErr error
-}
+// fakeDatabase methods
 
 func (e fakeDatabase) Initialize(ctx context.Context, req InitializeRequest) (InitializeResponse, error) {
 	return e.initResp, e.initErr
@@ -738,19 +732,7 @@ func (e fakeDatabase) Close() error {
 	return e.closeErr
 }
 
-var _ Database = &recordingDatabase{}
-
-type recordingDatabase struct {
-	initializeCalls int
-	newUserCalls    int
-	updateUserCalls int
-	deleteUserCalls int
-	typeCalls       int
-	closeCalls      int
-
-	// recordingDatabase can act as middleware so we can record the calls to other test Database implementations
-	next Database
-}
+// recordingDatabase methods
 
 func (f *recordingDatabase) Initialize(ctx context.Context, req InitializeRequest) (InitializeResponse, error) {
 	f.initializeCalls++
@@ -800,9 +782,7 @@ func (f *recordingDatabase) Close() error {
 	return f.next.Close()
 }
 
-type fakeDatabaseWithVersion struct {
-	version string
-}
+// fakeDatabaseWithVersion methods
 
 func (e fakeDatabaseWithVersion) PluginVersion() logical.PluginVersion {
 	return logical.PluginVersion{Version: e.version}
diff --git a/sdk/database/dbplugin/v5/marshalling.go b/sdk/database/dbplugin/v5/marshalling.go
index 2b3e8cb346a..11ca6d879e3 100644
--- a/sdk/database/dbplugin/v5/marshalling.go
+++ b/sdk/database/dbplugin/v5/marshalling.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
diff --git a/sdk/database/dbplugin/v5/middleware.go b/sdk/database/dbplugin/v5/middleware.go
index 2091e672084..97ea0ef46d3 100644
--- a/sdk/database/dbplugin/v5/middleware.go
+++ b/sdk/database/dbplugin/v5/middleware.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -10,9 +10,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/armon/go-metrics"
 	"github.com/hashicorp/errwrap"
 	log "github.com/hashicorp/go-hclog"
+	metrics "github.com/hashicorp/go-metrics/compat"
 	"github.com/hashicorp/vault/sdk/logical"
 	"google.golang.org/grpc/status"
 )
diff --git a/sdk/database/dbplugin/v5/middleware_test.go b/sdk/database/dbplugin/v5/middleware_test.go
index a2a76336fb7..e83b4a5b2bc 100644
--- a/sdk/database/dbplugin/v5/middleware_test.go
+++ b/sdk/database/dbplugin/v5/middleware_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
diff --git a/sdk/database/dbplugin/v5/plugin_client.go b/sdk/database/dbplugin/v5/plugin_client.go
index b4085ead6cb..323d6a5816d 100644
--- a/sdk/database/dbplugin/v5/plugin_client.go
+++ b/sdk/database/dbplugin/v5/plugin_client.go
@@ -1,14 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
 
 import (
-	"context"
-	"errors"
-
 	"github.com/hashicorp/go-plugin"
-	"github.com/hashicorp/vault/sdk/database/dbplugin/v5/proto"
 	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/logical"
 )
@@ -45,38 +41,3 @@ var PluginSets = map[int]plugin.PluginSet{
 		"database": &GRPCDatabasePlugin{},
 	},
 }
-
-// NewPluginClient returns a databaseRPCClient with a connection to a running
-// plugin.
-func NewPluginClient(ctx context.Context, sys pluginutil.RunnerUtil, config pluginutil.PluginClientConfig) (Database, error) {
-	pluginClient, err := sys.NewPluginClient(ctx, config)
-	if err != nil {
-		return nil, err
-	}
-
-	// Request the plugin
-	raw, err := pluginClient.Dispense("database")
-	if err != nil {
-		return nil, err
-	}
-
-	// We should have a database type now. This feels like a normal interface
-	// implementation but is in fact over an RPC connection.
-	var db Database
-	switch c := raw.(type) {
-	case gRPCClient:
-		// This is an abstraction leak from go-plugin but it is necessary in
-		// order to enable multiplexing on multiplexed plugins
-		c.client = proto.NewDatabaseClient(pluginClient.Conn())
-		c.versionClient = logical.NewPluginVersionClient(pluginClient.Conn())
-
-		db = c
-	default:
-		return nil, errors.New("unsupported client type")
-	}
-
-	return &DatabasePluginClient{
-		client:   pluginClient,
-		Database: db,
-	}, nil
-}
diff --git a/sdk/database/dbplugin/v5/plugin_client_oss.go b/sdk/database/dbplugin/v5/plugin_client_oss.go
new file mode 100644
index 00000000000..dbf984dd479
--- /dev/null
+++ b/sdk/database/dbplugin/v5/plugin_client_oss.go
@@ -0,0 +1,51 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package dbplugin
+
+import (
+	"context"
+	"errors"
+
+	"github.com/hashicorp/vault/sdk/database/dbplugin/v5/proto"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// NewPluginClient returns a databaseRPCClient with a connection to a running
+// plugin.
+func NewPluginClient(ctx context.Context, sys pluginutil.RunnerUtil, config pluginutil.PluginClientConfig) (Database, error) {
+	pluginClient, err := sys.NewPluginClient(ctx, config)
+	if err != nil {
+		return nil, err
+	}
+
+	// Request the plugin
+	raw, err := pluginClient.Dispense("database")
+	if err != nil {
+		return nil, err
+	}
+
+	// We should have a database type now. This feels like a normal interface
+	// implementation but is in fact over an RPC connection.
+	var db Database
+	switch c := raw.(type) {
+	case gRPCClient:
+		// This is an abstraction leak from go-plugin but it is necessary in
+		// order to enable multiplexing on multiplexed plugins
+		c.client = proto.NewDatabaseClient(pluginClient.Conn())
+		c.versionClient = logical.NewPluginVersionClient(pluginClient.Conn())
+		c.tier = config.Tier
+
+		db = c
+	default:
+		return nil, errors.New("unsupported client type")
+	}
+
+	return &DatabasePluginClient{
+		client:   pluginClient,
+		Database: db,
+	}, nil
+}
diff --git a/sdk/database/dbplugin/v5/plugin_client_test.go b/sdk/database/dbplugin/v5/plugin_client_test.go
index fb6852d1a4b..3f962aeef9f 100644
--- a/sdk/database/dbplugin/v5/plugin_client_test.go
+++ b/sdk/database/dbplugin/v5/plugin_client_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -160,3 +160,7 @@ func (m *mockRunnerUtil) MlockEnabled() bool {
 func (m *mockRunnerUtil) ClusterID(ctx context.Context) (string, error) {
 	return "clusterid", nil
 }
+
+func (m *mockRunnerUtil) DownloadExtractVerifyPlugin(_ context.Context, _ *pluginutil.PluginRunner) error {
+	return nil
+}
diff --git a/sdk/database/dbplugin/v5/plugin_factory.go b/sdk/database/dbplugin/v5/plugin_factory.go
index 4b158c319e2..29c1745b17b 100644
--- a/sdk/database/dbplugin/v5/plugin_factory.go
+++ b/sdk/database/dbplugin/v5/plugin_factory.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
@@ -49,6 +49,13 @@ func PluginFactoryVersion(ctx context.Context, pluginName string, pluginVersion
 		transport = "builtin"
 
 	} else {
+		if pluginRunner.Download {
+			if err = sys.DownloadExtractVerifyPlugin(ctx, pluginRunner); err != nil {
+				return nil, fmt.Errorf("failed to extract and verify plugin=%q version=%q: %w",
+					pluginRunner.Name, pluginRunner.Version, err)
+			}
+		}
+
 		config := pluginutil.PluginClientConfig{
 			Name:            pluginName,
 			PluginType:      consts.PluginTypeDatabase,
@@ -59,7 +66,9 @@ func PluginFactoryVersion(ctx context.Context, pluginName string, pluginVersion
 			IsMetadataMode:  false,
 			AutoMTLS:        true,
 			Wrapper:         sys,
+			Tier:            pluginRunner.Tier,
 		}
+
 		// create a DatabasePluginClient instance
 		db, err = NewPluginClient(ctx, sys, config)
 		if err != nil {
diff --git a/sdk/database/dbplugin/v5/plugin_server.go b/sdk/database/dbplugin/v5/plugin_server.go
index 216219df1d7..2e554aad70e 100644
--- a/sdk/database/dbplugin/v5/plugin_server.go
+++ b/sdk/database/dbplugin/v5/plugin_server.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbplugin
diff --git a/sdk/database/dbplugin/v5/proto/database.pb.go b/sdk/database/dbplugin/v5/proto/database.pb.go
index c2e2a351193..67d5189d4ff 100644
--- a/sdk/database/dbplugin/v5/proto/database.pb.go
+++ b/sdk/database/dbplugin/v5/proto/database.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: sdk/database/dbplugin/v5/proto/database.proto
 
@@ -16,6 +16,7 @@ import (
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -29,21 +30,18 @@ const (
 // Initialize()
 // ///////////////
 type InitializeRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	ConfigData       *structpb.Struct `protobuf:"bytes,1,opt,name=config_data,json=configData,proto3" json:"config_data,omitempty"`
-	VerifyConnection bool             `protobuf:"varint,2,opt,name=verify_connection,json=verifyConnection,proto3" json:"verify_connection,omitempty"`
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	ConfigData       *structpb.Struct       `protobuf:"bytes,1,opt,name=config_data,json=configData,proto3" json:"config_data,omitempty"`
+	VerifyConnection bool                   `protobuf:"varint,2,opt,name=verify_connection,json=verifyConnection,proto3" json:"verify_connection,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *InitializeRequest) Reset() {
 	*x = InitializeRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *InitializeRequest) String() string {
@@ -54,7 +52,7 @@ func (*InitializeRequest) ProtoMessage() {}
 
 func (x *InitializeRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -84,20 +82,17 @@ func (x *InitializeRequest) GetVerifyConnection() bool {
 }
 
 type InitializeResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ConfigData    *structpb.Struct       `protobuf:"bytes,1,opt,name=config_data,json=configData,proto3" json:"config_data,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	ConfigData *structpb.Struct `protobuf:"bytes,1,opt,name=config_data,json=configData,proto3" json:"config_data,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *InitializeResponse) Reset() {
 	*x = InitializeResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *InitializeResponse) String() string {
@@ -108,7 +103,7 @@ func (*InitializeResponse) ProtoMessage() {}
 
 func (x *InitializeResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -131,10 +126,7 @@ func (x *InitializeResponse) GetConfigData() *structpb.Struct {
 }
 
 type NewUserRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state              protoimpl.MessageState `protogen:"open.v1"`
 	UsernameConfig     *UsernameConfig        `protobuf:"bytes,1,opt,name=username_config,json=usernameConfig,proto3" json:"username_config,omitempty"`
 	Password           string                 `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
 	Expiration         *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expiration,proto3" json:"expiration,omitempty"`
@@ -143,15 +135,15 @@ type NewUserRequest struct {
 	CredentialType     int32                  `protobuf:"varint,6,opt,name=credential_type,json=credentialType,proto3" json:"credential_type,omitempty"`
 	PublicKey          []byte                 `protobuf:"bytes,7,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
 	Subject            string                 `protobuf:"bytes,8,opt,name=subject,proto3" json:"subject,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }
 
 func (x *NewUserRequest) Reset() {
 	*x = NewUserRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *NewUserRequest) String() string {
@@ -162,7 +154,7 @@ func (*NewUserRequest) ProtoMessage() {}
 
 func (x *NewUserRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -234,21 +226,18 @@ func (x *NewUserRequest) GetSubject() string {
 }
 
 type UsernameConfig struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	DisplayName   string                 `protobuf:"bytes,1,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	RoleName      string                 `protobuf:"bytes,2,opt,name=role_name,json=roleName,proto3" json:"role_name,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	DisplayName string `protobuf:"bytes,1,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
-	RoleName    string `protobuf:"bytes,2,opt,name=role_name,json=roleName,proto3" json:"role_name,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *UsernameConfig) Reset() {
 	*x = UsernameConfig{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UsernameConfig) String() string {
@@ -259,7 +248,7 @@ func (*UsernameConfig) ProtoMessage() {}
 
 func (x *UsernameConfig) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -289,20 +278,17 @@ func (x *UsernameConfig) GetRoleName() string {
 }
 
 type NewUserResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Username      string                 `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Username string `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *NewUserResponse) Reset() {
 	*x = NewUserResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *NewUserResponse) String() string {
@@ -313,7 +299,7 @@ func (*NewUserResponse) ProtoMessage() {}
 
 func (x *NewUserResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -339,24 +325,22 @@ func (x *NewUserResponse) GetUsername() string {
 // UpdateUser()
 // ///////////////
 type UpdateUserRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Username       string            `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
-	Password       *ChangePassword   `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
-	Expiration     *ChangeExpiration `protobuf:"bytes,3,opt,name=expiration,proto3" json:"expiration,omitempty"`
-	PublicKey      *ChangePublicKey  `protobuf:"bytes,4,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
-	CredentialType int32             `protobuf:"varint,5,opt,name=credential_type,json=credentialType,proto3" json:"credential_type,omitempty"`
+	state               protoimpl.MessageState `protogen:"open.v1"`
+	Username            string                 `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	Password            *ChangePassword        `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+	Expiration          *ChangeExpiration      `protobuf:"bytes,3,opt,name=expiration,proto3" json:"expiration,omitempty"`
+	PublicKey           *ChangePublicKey       `protobuf:"bytes,4,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	CredentialType      int32                  `protobuf:"varint,5,opt,name=credential_type,json=credentialType,proto3" json:"credential_type,omitempty"`
+	SelfManagedPassword string                 `protobuf:"bytes,6,opt,name=self_managed_password,json=selfManagedPassword,proto3" json:"self_managed_password,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
 }
 
 func (x *UpdateUserRequest) Reset() {
 	*x = UpdateUserRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UpdateUserRequest) String() string {
@@ -367,7 +351,7 @@ func (*UpdateUserRequest) ProtoMessage() {}
 
 func (x *UpdateUserRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -417,22 +401,26 @@ func (x *UpdateUserRequest) GetCredentialType() int32 {
 	return 0
 }
 
+func (x *UpdateUserRequest) GetSelfManagedPassword() string {
+	if x != nil {
+		return x.SelfManagedPassword
+	}
+	return ""
+}
+
 type ChangePassword struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NewPassword   string                 `protobuf:"bytes,1,opt,name=new_password,json=newPassword,proto3" json:"new_password,omitempty"`
+	Statements    *Statements            `protobuf:"bytes,2,opt,name=statements,proto3" json:"statements,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	NewPassword string      `protobuf:"bytes,1,opt,name=new_password,json=newPassword,proto3" json:"new_password,omitempty"`
-	Statements  *Statements `protobuf:"bytes,2,opt,name=statements,proto3" json:"statements,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ChangePassword) Reset() {
 	*x = ChangePassword{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ChangePassword) String() string {
@@ -443,7 +431,7 @@ func (*ChangePassword) ProtoMessage() {}
 
 func (x *ChangePassword) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -473,21 +461,18 @@ func (x *ChangePassword) GetStatements() *Statements {
 }
 
 type ChangePublicKey struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NewPublicKey  []byte                 `protobuf:"bytes,1,opt,name=new_public_key,json=newPublicKey,proto3" json:"new_public_key,omitempty"`
+	Statements    *Statements            `protobuf:"bytes,2,opt,name=statements,proto3" json:"statements,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	NewPublicKey []byte      `protobuf:"bytes,1,opt,name=new_public_key,json=newPublicKey,proto3" json:"new_public_key,omitempty"`
-	Statements   *Statements `protobuf:"bytes,2,opt,name=statements,proto3" json:"statements,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ChangePublicKey) Reset() {
 	*x = ChangePublicKey{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ChangePublicKey) String() string {
@@ -498,7 +483,7 @@ func (*ChangePublicKey) ProtoMessage() {}
 
 func (x *ChangePublicKey) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -528,21 +513,18 @@ func (x *ChangePublicKey) GetStatements() *Statements {
 }
 
 type ChangeExpiration struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	NewExpiration *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=new_expiration,json=newExpiration,proto3" json:"new_expiration,omitempty"`
 	Statements    *Statements            `protobuf:"bytes,2,opt,name=statements,proto3" json:"statements,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ChangeExpiration) Reset() {
 	*x = ChangeExpiration{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ChangeExpiration) String() string {
@@ -553,7 +535,7 @@ func (*ChangeExpiration) ProtoMessage() {}
 
 func (x *ChangeExpiration) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -583,18 +565,16 @@ func (x *ChangeExpiration) GetStatements() *Statements {
 }
 
 type UpdateUserResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *UpdateUserResponse) Reset() {
 	*x = UpdateUserResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *UpdateUserResponse) String() string {
@@ -605,7 +585,7 @@ func (*UpdateUserResponse) ProtoMessage() {}
 
 func (x *UpdateUserResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -624,21 +604,18 @@ func (*UpdateUserResponse) Descriptor() ([]byte, []int) {
 // DeleteUser()
 // ///////////////
 type DeleteUserRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Username      string                 `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	Statements    *Statements            `protobuf:"bytes,2,opt,name=statements,proto3" json:"statements,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Username   string      `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
-	Statements *Statements `protobuf:"bytes,2,opt,name=statements,proto3" json:"statements,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeleteUserRequest) Reset() {
 	*x = DeleteUserRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[10]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeleteUserRequest) String() string {
@@ -649,7 +626,7 @@ func (*DeleteUserRequest) ProtoMessage() {}
 
 func (x *DeleteUserRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[10]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -679,18 +656,16 @@ func (x *DeleteUserRequest) GetStatements() *Statements {
 }
 
 type DeleteUserResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DeleteUserResponse) Reset() {
 	*x = DeleteUserResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[11]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DeleteUserResponse) String() string {
@@ -701,7 +676,7 @@ func (*DeleteUserResponse) ProtoMessage() {}
 
 func (x *DeleteUserResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[11]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -720,20 +695,17 @@ func (*DeleteUserResponse) Descriptor() ([]byte, []int) {
 // Type()
 // ///////////////
 type TypeResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Type          string                 `protobuf:"bytes,1,opt,name=Type,proto3" json:"Type,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Type string `protobuf:"bytes,1,opt,name=Type,proto3" json:"Type,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *TypeResponse) Reset() {
 	*x = TypeResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[12]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *TypeResponse) String() string {
@@ -744,7 +716,7 @@ func (*TypeResponse) ProtoMessage() {}
 
 func (x *TypeResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[12]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -770,20 +742,17 @@ func (x *TypeResponse) GetType() string {
 // General purpose
 // ///////////////
 type Statements struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Commands      []string               `protobuf:"bytes,1,rep,name=Commands,proto3" json:"Commands,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Commands []string `protobuf:"bytes,1,rep,name=Commands,proto3" json:"Commands,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Statements) Reset() {
 	*x = Statements{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[13]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Statements) String() string {
@@ -794,7 +763,7 @@ func (*Statements) ProtoMessage() {}
 
 func (x *Statements) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[13]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -817,18 +786,16 @@ func (x *Statements) GetCommands() []string {
 }
 
 type Empty struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Empty) Reset() {
 	*x = Empty{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[14]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Empty) String() string {
@@ -839,7 +806,7 @@ func (*Empty) ProtoMessage() {}
 
 func (x *Empty) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[14]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -856,7 +823,7 @@ func (*Empty) Descriptor() ([]byte, []int) {
 
 var File_sdk_database_dbplugin_v5_proto_database_proto protoreflect.FileDescriptor
 
-var file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc = []byte{
+var file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc = string([]byte{
 	0x0a, 0x2d, 0x73, 0x64, 0x6b, 0x2f, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x2f, 0x64,
 	0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2f, 0x76, 0x35, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 	0x2f, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
@@ -910,7 +877,7 @@ var file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc = []byte{
 	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x72, 0x6f, 0x6c, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x22,
 	0x2d, 0x0a, 0x0f, 0x4e, 0x65, 0x77, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
 	0x73, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x8d,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0xc1,
 	0x02, 0x0a, 0x11, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71,
 	0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65,
@@ -927,92 +894,95 @@ var file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc = []byte{
 	0x65, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c,
 	0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x27, 0x0a, 0x0f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74,
 	0x69, 0x61, 0x6c, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0e,
-	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x22, 0x6c,
-	0x0a, 0x0e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
-	0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x77, 0x5f, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x65, 0x77, 0x50, 0x61, 0x73, 0x73, 0x77,
-	0x6f, 0x72, 0x64, 0x12, 0x37, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67,
-	0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73,
-	0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x70, 0x0a, 0x0f,
-	0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12,
-	0x24, 0x0a, 0x0e, 0x6e, 0x65, 0x77, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65,
-	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x6e, 0x65, 0x77, 0x50, 0x75, 0x62, 0x6c,
-	0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x37, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x64, 0x62, 0x70, 0x6c,
-	0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x73, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x8e,
-	0x01, 0x0a, 0x10, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x0e, 0x6e, 0x65, 0x77, 0x5f, 0x65, 0x78, 0x70, 0x69, 0x72,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0d, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x69,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x37, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x64, 0x62, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x73, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x22,
-	0x14, 0x0a, 0x12, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x68, 0x0a, 0x11, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55,
-	0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73,
-	0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73,
-	0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x37, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x64, 0x62, 0x70,
-	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x73, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x22,
-	0x14, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x22, 0x0a, 0x0c, 0x54, 0x79, 0x70, 0x65, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x54, 0x79, 0x70, 0x65, 0x22, 0x28, 0x0a, 0x0a, 0x53, 0x74, 0x61,
-	0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x43, 0x6f, 0x6d, 0x6d, 0x61,
-	0x6e, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x43, 0x6f, 0x6d, 0x6d, 0x61,
-	0x6e, 0x64, 0x73, 0x22, 0x07, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x32, 0xa5, 0x03, 0x0a,
-	0x08, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x12, 0x4d, 0x0a, 0x0a, 0x49, 0x6e, 0x69,
-	0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x12, 0x1e, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67,
-	0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67,
-	0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x44, 0x0a, 0x07, 0x4e, 0x65, 0x77, 0x55,
-	0x73, 0x65, 0x72, 0x12, 0x1b, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76,
-	0x35, 0x2e, 0x4e, 0x65, 0x77, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x1c, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x4e,
-	0x65, 0x77, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4d,
-	0x0a, 0x0a, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1e, 0x2e, 0x64,
-	0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x64,
-	0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4d, 0x0a,
-	0x0a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1e, 0x2e, 0x64, 0x62,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x64, 0x62,
-	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
-	0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x35, 0x0a, 0x04,
-	0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e,
-	0x76, 0x35, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75,
-	0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x2f, 0x0a, 0x05, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x12, 0x12, 0x2e, 0x64,
-	0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
-	0x1a, 0x12, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x45,
-	0x6d, 0x70, 0x74, 0x79, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75,
-	0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x2f,
-	0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2f, 0x76, 0x35, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x54, 0x79, 0x70, 0x65, 0x12, 0x32,
+	0x0a, 0x15, 0x73, 0x65, 0x6c, 0x66, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x64, 0x5f, 0x70,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x73,
+	0x65, 0x6c, 0x66, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x64, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x22, 0x6c, 0x0a, 0x0e, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x65, 0x77, 0x5f, 0x70, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x65, 0x77, 0x50,
+	0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x37, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x64, 0x62,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x73, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73,
+	0x22, 0x70, 0x0a, 0x0f, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63,
+	0x4b, 0x65, 0x79, 0x12, 0x24, 0x0a, 0x0e, 0x6e, 0x65, 0x77, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x6e, 0x65, 0x77,
+	0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x37, 0x0a, 0x0a, 0x73, 0x74, 0x61,
+	0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x53, 0x74, 0x61, 0x74,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x73, 0x22, 0x8e, 0x01, 0x0a, 0x10, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x45, 0x78, 0x70,
+	0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x0e, 0x6e, 0x65, 0x77, 0x5f, 0x65,
+	0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0d, 0x6e, 0x65, 0x77,
+	0x45, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x37, 0x0a, 0x0a, 0x73, 0x74,
+	0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
+	0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x53, 0x74, 0x61,
+	0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x73, 0x22, 0x14, 0x0a, 0x12, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65,
+	0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x68, 0x0a, 0x11, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a,
+	0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x37, 0x0a, 0x0a, 0x73, 0x74,
+	0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17,
+	0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x53, 0x74, 0x61,
+	0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x73, 0x22, 0x14, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65,
+	0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x22, 0x0a, 0x0c, 0x54, 0x79, 0x70,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x54, 0x79, 0x70,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x54, 0x79, 0x70, 0x65, 0x22, 0x28, 0x0a,
+	0x0a, 0x53, 0x74, 0x61, 0x74, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x43,
+	0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x43,
+	0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x73, 0x22, 0x07, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79,
+	0x32, 0xa5, 0x03, 0x0a, 0x08, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x12, 0x4d, 0x0a,
+	0x0a, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x12, 0x1e, 0x2e, 0x64, 0x62,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61,
+	0x6c, 0x69, 0x7a, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x64, 0x62,
+	0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61,
+	0x6c, 0x69, 0x7a, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x44, 0x0a, 0x07,
+	0x4e, 0x65, 0x77, 0x55, 0x73, 0x65, 0x72, 0x12, 0x1b, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67,
+	0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x4e, 0x65, 0x77, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e,
+	0x76, 0x35, 0x2e, 0x4e, 0x65, 0x77, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x4d, 0x0a, 0x0a, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72,
+	0x12, 0x1e, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x1f, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x4d, 0x0a, 0x0a, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x12,
+	0x1e, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1f, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x35, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x64,
+	0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2f, 0x0a, 0x05, 0x43, 0x6c, 0x6f, 0x73, 0x65,
+	0x12, 0x12, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x76, 0x35, 0x2e, 0x45,
+	0x6d, 0x70, 0x74, 0x79, 0x1a, 0x12, 0x2e, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e,
+	0x76, 0x35, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
+	0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x64, 0x61, 0x74, 0x61, 0x62,
+	0x61, 0x73, 0x65, 0x2f, 0x64, 0x62, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2f, 0x76, 0x35, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
 
 var (
 	file_sdk_database_dbplugin_v5_proto_database_proto_rawDescOnce sync.Once
-	file_sdk_database_dbplugin_v5_proto_database_proto_rawDescData = file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc
+	file_sdk_database_dbplugin_v5_proto_database_proto_rawDescData []byte
 )
 
 func file_sdk_database_dbplugin_v5_proto_database_proto_rawDescGZIP() []byte {
 	file_sdk_database_dbplugin_v5_proto_database_proto_rawDescOnce.Do(func() {
-		file_sdk_database_dbplugin_v5_proto_database_proto_rawDescData = protoimpl.X.CompressGZIP(file_sdk_database_dbplugin_v5_proto_database_proto_rawDescData)
+		file_sdk_database_dbplugin_v5_proto_database_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc), len(file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc)))
 	})
 	return file_sdk_database_dbplugin_v5_proto_database_proto_rawDescData
 }
 
 var file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes = make([]protoimpl.MessageInfo, 15)
-var file_sdk_database_dbplugin_v5_proto_database_proto_goTypes = []interface{}{
+var file_sdk_database_dbplugin_v5_proto_database_proto_goTypes = []any{
 	(*InitializeRequest)(nil),     // 0: dbplugin.v5.InitializeRequest
 	(*InitializeResponse)(nil),    // 1: dbplugin.v5.InitializeResponse
 	(*NewUserRequest)(nil),        // 2: dbplugin.v5.NewUserRequest
@@ -1070,193 +1040,11 @@ func file_sdk_database_dbplugin_v5_proto_database_proto_init() {
 	if File_sdk_database_dbplugin_v5_proto_database_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*InitializeRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*InitializeResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NewUserRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UsernameConfig); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NewUserResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpdateUserRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ChangePassword); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ChangePublicKey); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ChangeExpiration); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*UpdateUserResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteUserRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeleteUserResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TypeResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Statements); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Empty); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc), len(file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   15,
 			NumExtensions: 0,
@@ -1267,7 +1055,6 @@ func file_sdk_database_dbplugin_v5_proto_database_proto_init() {
 		MessageInfos:      file_sdk_database_dbplugin_v5_proto_database_proto_msgTypes,
 	}.Build()
 	File_sdk_database_dbplugin_v5_proto_database_proto = out.File
-	file_sdk_database_dbplugin_v5_proto_database_proto_rawDesc = nil
 	file_sdk_database_dbplugin_v5_proto_database_proto_goTypes = nil
 	file_sdk_database_dbplugin_v5_proto_database_proto_depIdxs = nil
 }
diff --git a/sdk/database/dbplugin/v5/proto/database.proto b/sdk/database/dbplugin/v5/proto/database.proto
index 2b0ebde4857..598aa2c5e62 100644
--- a/sdk/database/dbplugin/v5/proto/database.proto
+++ b/sdk/database/dbplugin/v5/proto/database.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 syntax = "proto3";
@@ -53,6 +53,7 @@ message UpdateUserRequest {
   ChangeExpiration expiration = 3;
   ChangePublicKey public_key = 4;
   int32 credential_type = 5;
+  string self_managed_password = 6;
 }
 
 message ChangePassword {
diff --git a/sdk/database/dbplugin/v5/proto/database_grpc.pb.go b/sdk/database/dbplugin/v5/proto/database_grpc.pb.go
index 49610c3b046..4ce7fadcbf7 100644
--- a/sdk/database/dbplugin/v5/proto/database_grpc.pb.go
+++ b/sdk/database/dbplugin/v5/proto/database_grpc.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: sdk/database/dbplugin/v5/proto/database.proto
 
@@ -18,8 +18,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	Database_Initialize_FullMethodName = "/dbplugin.v5.Database/Initialize"
@@ -51,8 +51,9 @@ func NewDatabaseClient(cc grpc.ClientConnInterface) DatabaseClient {
 }
 
 func (c *databaseClient) Initialize(ctx context.Context, in *InitializeRequest, opts ...grpc.CallOption) (*InitializeResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(InitializeResponse)
-	err := c.cc.Invoke(ctx, Database_Initialize_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Initialize_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -60,8 +61,9 @@ func (c *databaseClient) Initialize(ctx context.Context, in *InitializeRequest,
 }
 
 func (c *databaseClient) NewUser(ctx context.Context, in *NewUserRequest, opts ...grpc.CallOption) (*NewUserResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(NewUserResponse)
-	err := c.cc.Invoke(ctx, Database_NewUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_NewUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -69,8 +71,9 @@ func (c *databaseClient) NewUser(ctx context.Context, in *NewUserRequest, opts .
 }
 
 func (c *databaseClient) UpdateUser(ctx context.Context, in *UpdateUserRequest, opts ...grpc.CallOption) (*UpdateUserResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpdateUserResponse)
-	err := c.cc.Invoke(ctx, Database_UpdateUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_UpdateUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -78,8 +81,9 @@ func (c *databaseClient) UpdateUser(ctx context.Context, in *UpdateUserRequest,
 }
 
 func (c *databaseClient) DeleteUser(ctx context.Context, in *DeleteUserRequest, opts ...grpc.CallOption) (*DeleteUserResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeleteUserResponse)
-	err := c.cc.Invoke(ctx, Database_DeleteUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_DeleteUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -87,8 +91,9 @@ func (c *databaseClient) DeleteUser(ctx context.Context, in *DeleteUserRequest,
 }
 
 func (c *databaseClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TypeResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TypeResponse)
-	err := c.cc.Invoke(ctx, Database_Type_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Type_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -96,8 +101,9 @@ func (c *databaseClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallO
 }
 
 func (c *databaseClient) Close(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, Database_Close_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Close_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -106,7 +112,7 @@ func (c *databaseClient) Close(ctx context.Context, in *Empty, opts ...grpc.Call
 
 // DatabaseServer is the server API for Database service.
 // All implementations must embed UnimplementedDatabaseServer
-// for forward compatibility
+// for forward compatibility.
 type DatabaseServer interface {
 	Initialize(context.Context, *InitializeRequest) (*InitializeResponse, error)
 	NewUser(context.Context, *NewUserRequest) (*NewUserResponse, error)
@@ -117,9 +123,12 @@ type DatabaseServer interface {
 	mustEmbedUnimplementedDatabaseServer()
 }
 
-// UnimplementedDatabaseServer must be embedded to have forward compatible implementations.
-type UnimplementedDatabaseServer struct {
-}
+// UnimplementedDatabaseServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedDatabaseServer struct{}
 
 func (UnimplementedDatabaseServer) Initialize(context.Context, *InitializeRequest) (*InitializeResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Initialize not implemented")
@@ -140,6 +149,7 @@ func (UnimplementedDatabaseServer) Close(context.Context, *Empty) (*Empty, error
 	return nil, status.Errorf(codes.Unimplemented, "method Close not implemented")
 }
 func (UnimplementedDatabaseServer) mustEmbedUnimplementedDatabaseServer() {}
+func (UnimplementedDatabaseServer) testEmbeddedByValue()                  {}
 
 // UnsafeDatabaseServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to DatabaseServer will
@@ -149,6 +159,13 @@ type UnsafeDatabaseServer interface {
 }
 
 func RegisterDatabaseServer(s grpc.ServiceRegistrar, srv DatabaseServer) {
+	// If the following call pancis, it indicates UnimplementedDatabaseServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&Database_ServiceDesc, srv)
 }
 
diff --git a/sdk/database/dbplugin/v5/testing/test_helpers.go b/sdk/database/dbplugin/v5/testing/test_helpers.go
index 4ecebe5de08..14696713d0d 100644
--- a/sdk/database/dbplugin/v5/testing/test_helpers.go
+++ b/sdk/database/dbplugin/v5/testing/test_helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbtesting
diff --git a/sdk/database/helper/cacheutil/cache_stubs_oss.go b/sdk/database/helper/cacheutil/cache_stubs_oss.go
new file mode 100644
index 00000000000..ba98886b6e2
--- /dev/null
+++ b/sdk/database/helper/cacheutil/cache_stubs_oss.go
@@ -0,0 +1,16 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package cacheutil
+
+import "errors"
+
+type EvictionFunc func(key interface{}, value interface{})
+
+type Cache struct{}
+
+func NewCache(_ int, _ EvictionFunc) (*Cache, error) {
+	return nil, errors.New("self-managed static roles only available in Vault Enterprise")
+}
diff --git a/sdk/database/helper/connutil/cloudsql.go b/sdk/database/helper/connutil/cloudsql.go
index 5330c1cc22a..a5b2b2d5064 100644
--- a/sdk/database/helper/connutil/cloudsql.go
+++ b/sdk/database/helper/connutil/cloudsql.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package connutil
@@ -10,10 +10,6 @@ import (
 	"cloud.google.com/go/cloudsqlconn/postgres/pgxv4"
 )
 
-var configurableAuthTypes = []string{
-	AuthTypeGCPIAM,
-}
-
 func (c *SQLConnectionProducer) getCloudSQLDriverType() (string, error) {
 	var driverType string
 	// using switch case for future extensibility
@@ -27,13 +23,13 @@ func (c *SQLConnectionProducer) getCloudSQLDriverType() (string, error) {
 	return driverType, nil
 }
 
-func (c *SQLConnectionProducer) registerDrivers(driverName string, credentials string) (func() error, error) {
+func (c *SQLConnectionProducer) registerDrivers(driverName string, credentials string, usePrivateIP bool, usePSC bool) (func() error, error) {
 	typ, err := c.getCloudSQLDriverType()
 	if err != nil {
 		return nil, err
 	}
 
-	opts, err := GetCloudSQLAuthOptions(credentials)
+	opts, err := GetCloudSQLAuthOptions(credentials, usePrivateIP, usePSC)
 	if err != nil {
 		return nil, err
 	}
@@ -49,24 +45,20 @@ func (c *SQLConnectionProducer) registerDrivers(driverName string, credentials s
 
 // GetCloudSQLAuthOptions takes a credentials JSON and returns
 // a set of GCP CloudSQL options - always WithIAMAUthN, and then the appropriate file/JSON option.
-func GetCloudSQLAuthOptions(credentials string) ([]cloudsqlconn.Option, error) {
+func GetCloudSQLAuthOptions(credentials string, usePrivateIP bool, usePSC bool) ([]cloudsqlconn.Option, error) {
 	opts := []cloudsqlconn.Option{cloudsqlconn.WithIAMAuthN()}
 
 	if credentials != "" {
 		opts = append(opts, cloudsqlconn.WithCredentialsJSON([]byte(credentials)))
 	}
 
-	return opts, nil
-}
+	if usePrivateIP {
+		opts = append(opts, cloudsqlconn.WithDefaultDialOptions(cloudsqlconn.WithPrivateIP()))
+	}
 
-func ValidateAuthType(authType string) bool {
-	var valid bool
-	for _, typ := range configurableAuthTypes {
-		if authType == typ {
-			valid = true
-			break
-		}
+	if usePSC {
+		opts = append(opts, cloudsqlconn.WithDefaultDialOptions(cloudsqlconn.WithPSC()))
 	}
 
-	return valid
+	return opts, nil
 }
diff --git a/sdk/database/helper/connutil/connutil.go b/sdk/database/helper/connutil/connutil.go
index 50582aa8196..c7e5f11f67e 100644
--- a/sdk/database/helper/connutil/connutil.go
+++ b/sdk/database/helper/connutil/connutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package connutil
diff --git a/sdk/database/helper/connutil/postgres.go b/sdk/database/helper/connutil/postgres.go
new file mode 100644
index 00000000000..f8ad876c5a5
--- /dev/null
+++ b/sdk/database/helper/connutil/postgres.go
@@ -0,0 +1,466 @@
+// Copyright (c) 2019-2021 Jack Christensen
+
+// MIT License
+
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+// Copied from https://github.com/jackc/pgconn/blob/1860f4e57204614f40d05a5c76a43e8d80fde9da/config.go
+
+package connutil
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"database/sql"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"math"
+	"net"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
+	"github.com/jackc/pgconn"
+	"github.com/jackc/pgx/v4"
+	"github.com/jackc/pgx/v4/stdlib"
+)
+
+// openPostgres parses the connection string and opens a connection to the database.
+//
+// If sslinline is set, strips the connection string of all ssl settings and
+// creates a TLS config based on the settings provided, then uses the
+// RegisterConnConfig function to create a new connection. This is necessary
+// because the pgx driver does not support the sslinline parameter and instead
+// expects to source ssl material from the file system.
+//
+// Deprecated: openPostgres will be removed in a future version of the Vault SDK.
+func openPostgres(driverName, connString string) (*sql.DB, error) {
+	if ok, _ := strconv.ParseBool(os.Getenv(pluginutil.PluginUsePostgresSSLInline)); !ok {
+		return nil, fmt.Errorf("failed to open postgres connection with deprecated funtion, set feature flag to enable")
+	}
+
+	var options pgconn.ParseConfigOptions
+
+	settings := make(map[string]string)
+	if connString != "" {
+		var err error
+		// connString may be a database URL or a DSN
+		if strings.HasPrefix(connString, "postgres://") || strings.HasPrefix(connString, "postgresql://") {
+			settings, err = parsePostgresURLSettings(connString)
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse as URL: %w", err)
+			}
+		} else {
+			settings, err = parsePostgresDSNSettings(connString)
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse as DSN: %w", err)
+			}
+		}
+	}
+
+	// get the inline flag
+	sslInline := settings["sslinline"] == "true"
+
+	// if sslinline is not set, open a regular connection
+	if !sslInline {
+		return sql.Open(driverName, connString)
+	}
+
+	// generate a new DSN without the ssl settings
+	newConnStr := []string{"sslmode=disable"}
+	for k, v := range settings {
+		switch k {
+		case "sslinline", "sslcert", "sslkey", "sslrootcert", "sslmode":
+			continue
+		}
+
+		newConnStr = append(newConnStr, fmt.Sprintf("%s='%s'", k, v))
+	}
+
+	// parse the updated config
+	config, err := pgx.ParseConfig(strings.Join(newConnStr, " "))
+	if err != nil {
+		return nil, err
+	}
+
+	// create a TLS config
+	fallbacks := []*pgconn.FallbackConfig{}
+
+	hosts := strings.Split(settings["host"], ",")
+	ports := strings.Split(settings["port"], ",")
+
+	for i, host := range hosts {
+		var portStr string
+		if i < len(ports) {
+			portStr = ports[i]
+		} else {
+			portStr = ports[0]
+		}
+
+		port, err := parsePort(portStr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid port: %w", err)
+		}
+
+		var tlsConfigs []*tls.Config
+
+		// Ignore TLS settings if Unix domain socket like libpq
+		if network, _ := pgconn.NetworkAddress(host, port); network == "unix" {
+			tlsConfigs = append(tlsConfigs, nil)
+		} else {
+			var err error
+			tlsConfigs, err = configPostgresTLS(settings, host, options)
+			if err != nil {
+				return nil, fmt.Errorf("failed to configure TLS: %w", err)
+			}
+		}
+
+		for _, tlsConfig := range tlsConfigs {
+			fallbacks = append(fallbacks, &pgconn.FallbackConfig{
+				Host:      host,
+				Port:      port,
+				TLSConfig: tlsConfig,
+			})
+		}
+	}
+
+	config.Host = fallbacks[0].Host
+	config.Port = fallbacks[0].Port
+	config.TLSConfig = fallbacks[0].TLSConfig
+	config.Fallbacks = fallbacks[1:]
+
+	return sql.Open(driverName, stdlib.RegisterConnConfig(config))
+}
+
+// configPostgresTLS uses libpq's TLS parameters to construct  []*tls.Config. It is
+// necessary to allow returning multiple TLS configs as sslmode "allow" and
+// "prefer" allow fallback.
+//
+// Copied from https://github.com/jackc/pgconn/blob/1860f4e57204614f40d05a5c76a43e8d80fde9da/config.go
+// and modified to read ssl material by value instead of file location.
+func configPostgresTLS(settings map[string]string, thisHost string, parseConfigOptions pgconn.ParseConfigOptions) ([]*tls.Config, error) {
+	host := thisHost
+	sslmode := settings["sslmode"]
+	sslrootcert := settings["sslrootcert"]
+	sslcert := settings["sslcert"]
+	sslkey := settings["sslkey"]
+	sslpassword := settings["sslpassword"]
+	sslsni := settings["sslsni"]
+
+	// Match libpq default behavior
+	if sslmode == "" {
+		sslmode = "prefer"
+	}
+	if sslsni == "" {
+		sslsni = "1"
+	}
+
+	tlsConfig := &tls.Config{}
+
+	switch sslmode {
+	case "disable":
+		return []*tls.Config{nil}, nil
+	case "allow", "prefer":
+		tlsConfig.InsecureSkipVerify = true
+	case "require":
+		// According to PostgreSQL documentation, if a root CA file exists,
+		// the behavior of sslmode=require should be the same as that of verify-ca
+		//
+		// See https://www.postgresql.org/docs/12/libpq-ssl.html
+		if sslrootcert != "" {
+			goto nextCase
+		}
+		tlsConfig.InsecureSkipVerify = true
+		break
+	nextCase:
+		fallthrough
+	case "verify-ca":
+		// Don't perform the default certificate verification because it
+		// will verify the hostname. Instead, verify the server's
+		// certificate chain ourselves in VerifyPeerCertificate and
+		// ignore the server name. This emulates libpq's verify-ca
+		// behavior.
+		//
+		// See https://github.com/golang/go/issues/21971#issuecomment-332693931
+		// and https://pkg.go.dev/crypto/tls?tab=doc#example-Config-VerifyPeerCertificate
+		// for more info.
+		tlsConfig.InsecureSkipVerify = true
+		tlsConfig.VerifyPeerCertificate = func(certificates [][]byte, _ [][]*x509.Certificate) error {
+			certs := make([]*x509.Certificate, len(certificates))
+			for i, asn1Data := range certificates {
+				cert, err := x509.ParseCertificate(asn1Data)
+				if err != nil {
+					return errors.New("failed to parse certificate from server: " + err.Error())
+				}
+				certs[i] = cert
+			}
+
+			// Leave DNSName empty to skip hostname verification.
+			opts := x509.VerifyOptions{
+				Roots:         tlsConfig.RootCAs,
+				Intermediates: x509.NewCertPool(),
+			}
+			// Skip the first cert because it's the leaf. All others
+			// are intermediates.
+			for _, cert := range certs[1:] {
+				opts.Intermediates.AddCert(cert)
+			}
+			_, err := certs[0].Verify(opts)
+			return err
+		}
+	case "verify-full":
+		tlsConfig.ServerName = host
+	default:
+		return nil, errors.New("sslmode is invalid")
+	}
+
+	if sslrootcert != "" {
+		caCertPool := x509.NewCertPool()
+		if !caCertPool.AppendCertsFromPEM([]byte(sslrootcert)) {
+			return nil, errors.New("unable to add CA to cert pool")
+		}
+
+		tlsConfig.RootCAs = caCertPool
+		tlsConfig.ClientCAs = caCertPool
+	}
+
+	if (sslcert != "" && sslkey == "") || (sslcert == "" && sslkey != "") {
+		return nil, errors.New(`both "sslcert" and "sslkey" are required`)
+	}
+
+	if sslcert != "" && sslkey != "" {
+		block, _ := pem.Decode([]byte(sslkey))
+		var pemKey []byte
+		var decryptedKey []byte
+		var decryptedError error
+		// If PEM is encrypted, attempt to decrypt using pass phrase
+		if x509.IsEncryptedPEMBlock(block) {
+			// Attempt decryption with pass phrase
+			// NOTE: only supports RSA (PKCS#1)
+			if sslpassword != "" {
+				decryptedKey, decryptedError = x509.DecryptPEMBlock(block, []byte(sslpassword))
+			}
+			// if sslpassword not provided or has decryption error when use it
+			// try to find sslpassword with callback function
+			if sslpassword == "" || decryptedError != nil {
+				if parseConfigOptions.GetSSLPassword != nil {
+					sslpassword = parseConfigOptions.GetSSLPassword(context.Background())
+				}
+				if sslpassword == "" {
+					return nil, fmt.Errorf("unable to find sslpassword")
+				}
+			}
+			decryptedKey, decryptedError = x509.DecryptPEMBlock(block, []byte(sslpassword))
+			// Should we also provide warning for PKCS#1 needed?
+			if decryptedError != nil {
+				return nil, fmt.Errorf("unable to decrypt key: %w", decryptedError)
+			}
+
+			pemBytes := pem.Block{
+				Type:  "RSA PRIVATE KEY",
+				Bytes: decryptedKey,
+			}
+			pemKey = pem.EncodeToMemory(&pemBytes)
+		} else {
+			pemKey = pem.EncodeToMemory(block)
+		}
+
+		cert, err := tls.X509KeyPair([]byte(sslcert), pemKey)
+		if err != nil {
+			return nil, fmt.Errorf("unable to load cert: %w", err)
+		}
+		tlsConfig.Certificates = []tls.Certificate{cert}
+	}
+
+	// Set Server Name Indication (SNI), if enabled by connection parameters.
+	// Per RFC 6066, do not set it if the host is a literal IP address (IPv4
+	// or IPv6).
+	if sslsni == "1" && net.ParseIP(host) == nil {
+		tlsConfig.ServerName = host
+	}
+
+	switch sslmode {
+	case "allow":
+		return []*tls.Config{nil, tlsConfig}, nil
+	case "prefer":
+		return []*tls.Config{tlsConfig, nil}, nil
+	case "require", "verify-ca", "verify-full":
+		return []*tls.Config{tlsConfig}, nil
+	default:
+		panic("BUG: bad sslmode should already have been caught")
+	}
+}
+
+func parsePort(s string) (uint16, error) {
+	port, err := strconv.ParseUint(s, 10, 16)
+	if err != nil {
+		return 0, err
+	}
+	if port < 1 || port > math.MaxUint16 {
+		return 0, errors.New("outside range")
+	}
+	return uint16(port), nil
+}
+
+var asciiSpace = [256]uint8{'\t': 1, '\n': 1, '\v': 1, '\f': 1, '\r': 1, ' ': 1}
+
+func parsePostgresURLSettings(connString string) (map[string]string, error) {
+	settings := make(map[string]string)
+
+	url, err := url.Parse(connString)
+	if err != nil {
+		return nil, err
+	}
+
+	if url.User != nil {
+		settings["user"] = url.User.Username()
+		if password, present := url.User.Password(); present {
+			settings["password"] = password
+		}
+	}
+
+	// Handle multiple host:port's in url.Host by splitting them into host,host,host and port,port,port.
+	var hosts []string
+	var ports []string
+	for _, host := range strings.Split(url.Host, ",") {
+		if host == "" {
+			continue
+		}
+		if isIPOnly(host) {
+			hosts = append(hosts, strings.Trim(host, "[]"))
+			continue
+		}
+		h, p, err := net.SplitHostPort(host)
+		if err != nil {
+			return nil, fmt.Errorf("failed to split host:port in '%s', err: %w", host, err)
+		}
+		if h != "" {
+			hosts = append(hosts, h)
+		}
+		if p != "" {
+			ports = append(ports, p)
+		}
+	}
+	if len(hosts) > 0 {
+		settings["host"] = strings.Join(hosts, ",")
+	}
+	if len(ports) > 0 {
+		settings["port"] = strings.Join(ports, ",")
+	}
+
+	database := strings.TrimLeft(url.Path, "/")
+	if database != "" {
+		settings["database"] = database
+	}
+
+	nameMap := map[string]string{
+		"dbname": "database",
+	}
+
+	for k, v := range url.Query() {
+		if k2, present := nameMap[k]; present {
+			k = k2
+		}
+
+		settings[k] = v[0]
+	}
+
+	return settings, nil
+}
+
+func parsePostgresDSNSettings(s string) (map[string]string, error) {
+	settings := make(map[string]string)
+
+	nameMap := map[string]string{
+		"dbname": "database",
+	}
+
+	for len(s) > 0 {
+		var key, val string
+		eqIdx := strings.IndexRune(s, '=')
+		if eqIdx < 0 {
+			return nil, errors.New("invalid dsn")
+		}
+
+		key = strings.Trim(s[:eqIdx], " \t\n\r\v\f")
+		s = strings.TrimLeft(s[eqIdx+1:], " \t\n\r\v\f")
+		if len(s) == 0 {
+		} else if s[0] != '\'' {
+			end := 0
+			for ; end < len(s); end++ {
+				if asciiSpace[s[end]] == 1 {
+					break
+				}
+				if s[end] == '\\' {
+					end++
+					if end == len(s) {
+						return nil, errors.New("invalid backslash")
+					}
+				}
+			}
+			val = strings.Replace(strings.Replace(s[:end], "\\\\", "\\", -1), "\\'", "'", -1)
+			if end == len(s) {
+				s = ""
+			} else {
+				s = s[end+1:]
+			}
+		} else { // quoted string
+			s = s[1:]
+			end := 0
+			for ; end < len(s); end++ {
+				if s[end] == '\'' {
+					break
+				}
+				if s[end] == '\\' {
+					end++
+				}
+			}
+			if end == len(s) {
+				return nil, errors.New("unterminated quoted string in connection info string")
+			}
+			val = strings.Replace(strings.Replace(s[:end], "\\\\", "\\", -1), "\\'", "'", -1)
+			if end == len(s) {
+				s = ""
+			} else {
+				s = s[end+1:]
+			}
+		}
+
+		if k, ok := nameMap[key]; ok {
+			key = k
+		}
+
+		if key == "" {
+			return nil, errors.New("invalid dsn")
+		}
+
+		settings[key] = val
+	}
+
+	return settings, nil
+}
+
+func isIPOnly(host string) bool {
+	return net.ParseIP(strings.Trim(host, "[]")) != nil || !strings.Contains(host, ":")
+}
diff --git a/sdk/database/helper/connutil/sql.go b/sdk/database/helper/connutil/sql.go
index ca3cd489aa7..80ebc7d1343 100644
--- a/sdk/database/helper/connutil/sql.go
+++ b/sdk/database/helper/connutil/sql.go
@@ -1,30 +1,48 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package connutil
 
 import (
 	"context"
+	"crypto/tls"
 	"database/sql"
 	"fmt"
 	"net/url"
+	"os"
+	"reflect"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/hashicorp/errwrap"
+	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/sdk/database/dbplugin"
+	"github.com/hashicorp/vault/sdk/database/helper/cacheutil"
 	"github.com/hashicorp/vault/sdk/database/helper/dbutil"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
+	"github.com/jackc/pgx/v4"
+	"github.com/jackc/pgx/v4/stdlib"
 	"github.com/mitchellh/mapstructure"
 )
 
 const (
-	AuthTypeGCPIAM = "gcp_iam"
+	AuthTypeGCPIAM           = "gcp_iam"
+	AuthTypeCert             = "cert"
+	AuthTypeUsernamePassword = ""
+)
 
+const (
 	dbTypePostgres   = "pgx"
 	cloudSQLPostgres = "cloudsql-postgres"
+
+	// controls the size of the static account cache
+	// as part of the self-managed workflow
+	defaultStaticCacheSize     = 4
+	defaultSelfManagedUsername = "self-managed-user"
+	defaultSelfManagedPassword = "self-managed-password"
 )
 
 var _ ConnectionProducer = &SQLConnectionProducer{}
@@ -35,13 +53,21 @@ type SQLConnectionProducer struct {
 	MaxOpenConnections       int         `json:"max_open_connections" mapstructure:"max_open_connections" structs:"max_open_connections"`
 	MaxIdleConnections       int         `json:"max_idle_connections" mapstructure:"max_idle_connections" structs:"max_idle_connections"`
 	MaxConnectionLifetimeRaw interface{} `json:"max_connection_lifetime" mapstructure:"max_connection_lifetime" structs:"max_connection_lifetime"`
-	Username                 string      `json:"username" mapstructure:"username" structs:"username"`
-	Password                 string      `json:"password" mapstructure:"password" structs:"password"`
-	AuthType                 string      `json:"auth_type" mapstructure:"auth_type" structs:"auth_type"`
-	ServiceAccountJSON       string      `json:"service_account_json" mapstructure:"service_account_json" structs:"service_account_json"`
 	DisableEscaping          bool        `json:"disable_escaping" mapstructure:"disable_escaping" structs:"disable_escaping"`
+	UsePrivateIP             bool        `json:"use_private_ip" mapstructure:"use_private_ip" structs:"use_private_ip"`
+	UsePSC                   bool        `json:"use_psc" mapstructure:"use_psc" structs:"use_psc"`
+	SelfManaged              bool        `json:"self_managed" mapstructure:"self_managed" structs:"self_managed"`
+
+	// Username/Password is the default auth type when AuthType is not set
+	Username string `json:"username" mapstructure:"username" structs:"username"`
+	Password string `json:"password" mapstructure:"password" structs:"password"`
 
-	// cloud options here - cloudDriverName is globally unique, but only needs to be retained for the lifetime
+	// AuthType defines the type of client authenticate used for this connection
+	AuthType           string `json:"auth_type" mapstructure:"auth_type" structs:"auth_type"`
+	ServiceAccountJSON string `json:"service_account_json" mapstructure:"service_account_json" structs:"service_account_json"`
+	TLSConfig          *tls.Config
+
+	// cloudDriverName is globally unique, but only needs to be retained for the lifetime
 	// of driver registration, not across plugin restarts.
 	cloudDriverName    string
 	cloudDialerCleanup func() error
@@ -51,9 +77,23 @@ type SQLConnectionProducer struct {
 	maxConnectionLifetime time.Duration
 	Initialized           bool
 	db                    *sql.DB
+	staticAccountsCache   *cacheutil.Cache
 	sync.Mutex
 }
 
+// This provides the field names for SQLConnectionProducer for field validation in the framework handler.
+func SQLConnectionProducerFieldNames() map[string]any {
+	scp := &SQLConnectionProducer{}
+	rType := reflect.TypeOf(scp).Elem()
+
+	fieldNames := make(map[string]any, rType.NumField())
+	for i := range rType.NumField() {
+		fieldNames[rType.Field(i).Tag.Get("json")] = 1
+	}
+
+	return fieldNames
+}
+
 func (c *SQLConnectionProducer) Initialize(ctx context.Context, conf map[string]interface{}, verifyConnection bool) error {
 	_, err := c.Init(ctx, conf, verifyConnection)
 	return err
@@ -74,6 +114,11 @@ func (c *SQLConnectionProducer) Init(ctx context.Context, conf map[string]interf
 		return nil, fmt.Errorf("connection_url cannot be empty")
 	}
 
+	isTemplatedURL := true
+	if !strings.Contains(c.ConnectionURL, "{{username}}") || !strings.Contains(c.ConnectionURL, "{{password}}") {
+		isTemplatedURL = false
+	}
+
 	// Do not allow the username or password template pattern to be used as
 	// part of the user-supplied username or password
 	if strings.Contains(c.Username, "{{username}}") ||
@@ -84,16 +129,44 @@ func (c *SQLConnectionProducer) Init(ctx context.Context, conf map[string]interf
 		return nil, fmt.Errorf("username and/or password cannot contain the template variables")
 	}
 
-	// Don't escape special characters for MySQL password
-	// Also don't escape special characters for the username and password if
-	// the disable_escaping parameter is set to true
-	username := c.Username
-	password := c.Password
-	if !c.DisableEscaping {
-		username = url.PathEscape(c.Username)
+	// validate that at least one of username/password / self_managed is set
+	if !c.SelfManaged && (c.Username == "" && c.Password == "") && isTemplatedURL {
+		return nil, fmt.Errorf("must either provide username/password or set self-managed to 'true'")
 	}
-	if (c.Type != "mysql") && !c.DisableEscaping {
-		password = url.PathEscape(c.Password)
+
+	// validate that self-managed and username/password are mutually exclusive
+	if c.SelfManaged {
+		if (c.Username != "" || c.Password != "") || !isTemplatedURL {
+			return nil, fmt.Errorf("cannot use both self-managed and vault-managed workflows")
+		}
+	}
+
+	var username string
+	var password string
+
+	if !c.SelfManaged {
+		// Default behavior
+		username = c.Username
+		password = c.Password
+
+		// Don't escape special characters for MySQL password
+		// Also don't escape special characters for the username and password if
+		// the disable_escaping parameter is set to true
+		if !c.DisableEscaping {
+			username = url.PathEscape(c.Username)
+		}
+
+		// The exception for MySQL passwords specifically comes from https://github.com/hashicorp/vault/issues/7834
+		// Due, presumably, to uneveness in the way different sql engines handle the pseudo-URLs of DSNs.
+		if (c.Type != "mysql") && !c.DisableEscaping {
+			password = url.PathEscape(c.Password)
+		}
+
+	} else {
+		// this is added to make middleware happy
+		// these placeholders are replaced when we make the actual static connection
+		username = defaultSelfManagedUsername
+		password = defaultSelfManagedPassword
 	}
 
 	// QueryHelper doesn't do any SQL escaping, but if it starts to do so
@@ -122,15 +195,11 @@ func (c *SQLConnectionProducer) Init(ctx context.Context, conf map[string]interf
 		return nil, errwrap.Wrapf("invalid max_connection_lifetime: {{err}}", err)
 	}
 
-	// validate auth_type if provided
-	authType := c.AuthType
-	if authType != "" {
-		if ok := ValidateAuthType(authType); !ok {
-			return nil, fmt.Errorf("invalid auth_type %s provided", authType)
-		}
+	if ok := ValidateAuthType(c.AuthType); !ok {
+		return nil, fmt.Errorf("invalid auth_type: %s", c.AuthType)
 	}
 
-	if authType == AuthTypeGCPIAM {
+	if c.AuthType == AuthTypeGCPIAM {
 		c.cloudDriverName, err = uuid.GenerateUUID()
 		if err != nil {
 			return nil, fmt.Errorf("unable to generate UUID for IAM configuration: %w", err)
@@ -140,7 +209,7 @@ func (c *SQLConnectionProducer) Init(ctx context.Context, conf map[string]interf
 		// however, the driver might store a credentials file, in which case the state stored by the driver is in
 		// fact critical to the proper function of the connection. So it needs to be registered here inside the
 		// ConnectionProducer init.
-		dialerCleanup, err := c.registerDrivers(c.cloudDriverName, c.ServiceAccountJSON)
+		dialerCleanup, err := c.registerDrivers(c.cloudDriverName, c.ServiceAccountJSON, c.UsePrivateIP, c.UsePSC)
 		if err != nil {
 			return nil, err
 		}
@@ -148,17 +217,41 @@ func (c *SQLConnectionProducer) Init(ctx context.Context, conf map[string]interf
 		c.cloudDialerCleanup = dialerCleanup
 	}
 
+	if c.SelfManaged && c.staticAccountsCache == nil {
+		logger := log.New(&log.LoggerOptions{
+			Level: log.Trace,
+		})
+
+		closer := func(key interface{}, value interface{}) {
+			logger.Trace(fmt.Sprintf("Evicting key %s from static LRU cache", key))
+			conn, ok := value.(*sql.DB)
+			if !ok {
+				logger.Error(fmt.Sprintf("error retrieving connection %s from static LRU cache, err=%s", key, err))
+			}
+
+			if err := conn.Close(); err != nil {
+				logger.Error(fmt.Sprintf("error closing connection for %s, err=%s", key, err))
+			}
+			logger.Trace(fmt.Sprintf("closed DB connection for %s", key))
+		}
+		c.staticAccountsCache, err = cacheutil.NewCache(defaultStaticCacheSize, closer)
+		if err != nil {
+			return nil, fmt.Errorf("error initializing static account cache: %s", err)
+		}
+	}
+
 	// Set initialized to true at this point since all fields are set,
 	// and the connection can be established at a later time.
 	c.Initialized = true
 
-	if verifyConnection {
+	// only verify if not self-managed
+	if verifyConnection && !c.SelfManaged {
 		if _, err := c.Connection(ctx); err != nil {
 			return nil, errwrap.Wrapf("error verifying connection: {{err}}", err)
 		}
 
 		if err := c.db.PingContext(ctx); err != nil {
-			return nil, errwrap.Wrapf("error verifying connection: {{err}}", err)
+			return nil, errwrap.Wrapf("error verifying connection: ping failed: {{err}}", err)
 		}
 	}
 
@@ -199,27 +292,45 @@ func (c *SQLConnectionProducer) Connection(ctx context.Context) (interface{}, er
 	}
 
 	// Otherwise, attempt to make connection
-	conn := c.ConnectionURL
+	// Apply PostgreSQL specific settings if needed
+	conn := applyPostgresSettings(c.ConnectionURL)
 
-	// PostgreSQL specific settings
-	if strings.HasPrefix(conn, "postgres://") || strings.HasPrefix(conn, "postgresql://") {
-		// Ensure timezone is set to UTC for all the connections
-		if strings.Contains(conn, "?") {
-			conn += "&timezone=UTC"
-		} else {
-			conn += "?timezone=UTC"
+	if driverName == dbTypePostgres && c.TLSConfig != nil {
+		config, err := pgx.ParseConfig(conn)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse config: %w", err)
+		}
+		if config.TLSConfig == nil {
+			// handle sslmode=disable
+			config.TLSConfig = &tls.Config{}
 		}
 
-		// Ensure a reasonable application_name is set
-		if !strings.Contains(conn, "application_name") {
-			conn += "&application_name=vault"
+		config.TLSConfig.RootCAs = c.TLSConfig.RootCAs
+		config.TLSConfig.ClientCAs = c.TLSConfig.ClientCAs
+		config.TLSConfig.Certificates = c.TLSConfig.Certificates
+
+		// Ensure there are no stale fallbacks when manually setting TLSConfig
+		for _, fallback := range config.Fallbacks {
+			fallback.TLSConfig = config.TLSConfig
 		}
-	}
 
-	var err error
-	c.db, err = sql.Open(driverName, conn)
-	if err != nil {
-		return nil, err
+		c.db = stdlib.OpenDB(*config)
+		if err != nil {
+			return nil, fmt.Errorf("failed to open connection: %w", err)
+		}
+	} else if driverName == dbTypePostgres && os.Getenv(pluginutil.PluginUsePostgresSSLInline) != "" {
+		var err error
+		// TODO: remove this deprecated function call in a future SDK version
+		c.db, err = openPostgres(driverName, conn)
+		if err != nil {
+			return nil, fmt.Errorf("failed to open connection: %w", err)
+		}
+	} else {
+		var err error
+		c.db, err = sql.Open(driverName, conn)
+		if err != nil {
+			return nil, fmt.Errorf("failed to open connection: %w", err)
+		}
 	}
 
 	// Set some connection pool settings. We don't need much of this,
@@ -268,3 +379,32 @@ func (c *SQLConnectionProducer) Close() error {
 func (c *SQLConnectionProducer) SetCredentials(ctx context.Context, statements dbplugin.Statements, staticUser dbplugin.StaticUserConfig) (username, password string, err error) {
 	return "", "", dbutil.Unimplemented()
 }
+
+func applyPostgresSettings(connURL string) string {
+	res := connURL
+	if strings.HasPrefix(res, "postgres://") || strings.HasPrefix(res, "postgresql://") {
+		// Ensure timezone is set to UTC for all the connections
+		if strings.Contains(res, "?") {
+			res += "&timezone=UTC"
+		} else {
+			res += "?timezone=UTC"
+		}
+
+		// Ensure a reasonable application_name is set
+		if !strings.Contains(res, "application_name") {
+			res += "&application_name=vault"
+		}
+	}
+
+	return res
+}
+
+var configurableAuthTypes = map[string]bool{
+	AuthTypeUsernamePassword: true,
+	AuthTypeCert:             true,
+	AuthTypeGCPIAM:           true,
+}
+
+func ValidateAuthType(authType string) bool {
+	return configurableAuthTypes[authType]
+}
diff --git a/sdk/database/helper/connutil/sql_stubs_oss.go b/sdk/database/helper/connutil/sql_stubs_oss.go
new file mode 100644
index 00000000000..706254af2e0
--- /dev/null
+++ b/sdk/database/helper/connutil/sql_stubs_oss.go
@@ -0,0 +1,16 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package connutil
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+)
+
+func (c *SQLConnectionProducer) StaticConnection(_ context.Context, _, _ string) (*sql.DB, error) {
+	return nil, errors.New("self-managed static roles only available in Vault Enterprise")
+}
diff --git a/sdk/database/helper/connutil/sql_test.go b/sdk/database/helper/connutil/sql_test.go
index 9f29d4ae2c5..e225426a844 100644
--- a/sdk/database/helper/connutil/sql_test.go
+++ b/sdk/database/helper/connutil/sql_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package connutil
diff --git a/sdk/database/helper/credsutil/caseop_enumer.go b/sdk/database/helper/credsutil/caseop_enumer.go
new file mode 100644
index 00000000000..3a96c63222e
--- /dev/null
+++ b/sdk/database/helper/credsutil/caseop_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=CaseOp -transform=snake"; DO NOT EDIT.
+
+package credsutil
+
+import (
+	"fmt"
+)
+
+const _CaseOpName = "keep_caseuppercaselowercase"
+
+var _CaseOpIndex = [...]uint8{0, 9, 18, 27}
+
+func (i CaseOp) String() string {
+	if i < 0 || i >= CaseOp(len(_CaseOpIndex)-1) {
+		return fmt.Sprintf("CaseOp(%d)", i)
+	}
+	return _CaseOpName[_CaseOpIndex[i]:_CaseOpIndex[i+1]]
+}
+
+var _CaseOpValues = []CaseOp{0, 1, 2}
+
+var _CaseOpNameToValueMap = map[string]CaseOp{
+	_CaseOpName[0:9]:   0,
+	_CaseOpName[9:18]:  1,
+	_CaseOpName[18:27]: 2,
+}
+
+// CaseOpString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func CaseOpString(s string) (CaseOp, error) {
+	if val, ok := _CaseOpNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to CaseOp values", s)
+}
+
+// CaseOpValues returns all values of the enum
+func CaseOpValues() []CaseOp {
+	return _CaseOpValues
+}
+
+// IsACaseOp returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i CaseOp) IsACaseOp() bool {
+	for _, v := range _CaseOpValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdk/database/helper/credsutil/credsutil.go b/sdk/database/helper/credsutil/credsutil.go
index 503999c868b..7a47ed83a89 100644
--- a/sdk/database/helper/credsutil/credsutil.go
+++ b/sdk/database/helper/credsutil/credsutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package credsutil
diff --git a/sdk/database/helper/credsutil/credsutil_test.go b/sdk/database/helper/credsutil/credsutil_test.go
index 77e1a2862f3..d09e2cd7e68 100644
--- a/sdk/database/helper/credsutil/credsutil_test.go
+++ b/sdk/database/helper/credsutil/credsutil_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package credsutil
diff --git a/sdk/database/helper/credsutil/sql.go b/sdk/database/helper/credsutil/sql.go
index 2c27adf37cc..8c33210a040 100644
--- a/sdk/database/helper/credsutil/sql.go
+++ b/sdk/database/helper/credsutil/sql.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package credsutil
diff --git a/sdk/database/helper/credsutil/usernames.go b/sdk/database/helper/credsutil/usernames.go
index 962208ac9a6..3f5d05a486f 100644
--- a/sdk/database/helper/credsutil/usernames.go
+++ b/sdk/database/helper/credsutil/usernames.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package credsutil
@@ -9,6 +9,7 @@ import (
 	"time"
 )
 
+//go:generate enumer -type=CaseOp -transform=snake
 type CaseOp int
 
 const (
diff --git a/sdk/database/helper/credsutil/usernames_test.go b/sdk/database/helper/credsutil/usernames_test.go
index a3e883491fc..df8554a2819 100644
--- a/sdk/database/helper/credsutil/usernames_test.go
+++ b/sdk/database/helper/credsutil/usernames_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package credsutil
diff --git a/sdk/database/helper/dbutil/dbutil.go b/sdk/database/helper/dbutil/dbutil.go
index efc7e01e13f..9661abe5792 100644
--- a/sdk/database/helper/dbutil/dbutil.go
+++ b/sdk/database/helper/dbutil/dbutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbutil
diff --git a/sdk/database/helper/dbutil/dbutil_test.go b/sdk/database/helper/dbutil/dbutil_test.go
index 797712b4d90..2ef06e9ad73 100644
--- a/sdk/database/helper/dbutil/dbutil_test.go
+++ b/sdk/database/helper/dbutil/dbutil_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbutil
diff --git a/sdk/framework/backend.go b/sdk/framework/backend.go
index 09a3f85b2da..bf8a58ac480 100644
--- a/sdk/framework/backend.go
+++ b/sdk/framework/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
@@ -24,6 +24,8 @@ import (
 	"github.com/hashicorp/go-kms-wrapping/entropy/v2"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	iRegexp "github.com/hashicorp/go-secure-stdlib/regexp"
+	"github.com/hashicorp/vault/sdk/database/helper/connutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/helper/license"
@@ -108,11 +110,20 @@ type Backend struct {
 	// RunningVersion is the optional version that will be self-reported
 	RunningVersion string
 
-	logger  log.Logger
-	system  logical.SystemView
-	events  logical.EventSender
-	once    sync.Once
-	pathsRe []*regexp.Regexp
+	// RotateCredential is the callback function used by the RotationManager
+	// to communicate with a plugin on when to rotate a credential
+	RotateCredential func(context.Context, *logical.Request) error
+
+	// ActivationFunc is the callback function used by ActivationFlags to
+	// communicate with a plugin to activate a feature.
+	ActivationFunc func(context.Context, *logical.Request, string) error
+
+	logger       log.Logger
+	system       logical.SystemView
+	events       logical.EventSender
+	observations logical.ObservationRecorder
+	once         sync.Once
+	pathsRe      []*regexp.Regexp
 }
 
 // periodicFunc is the callback called when the RollbackManager's timer ticks.
@@ -146,6 +157,10 @@ type PatchPreprocessorFunc func(map[string]interface{}) (map[string]interface{},
 // sender was not passed in during `backend.Setup()`.
 var ErrNoEvents = errors.New("no event sender configured")
 
+// ErrNoObservations is returned when attempting to record an observation, but when
+// the observation system was not passed in during `backend.Setup()`.
+var ErrNoObservations = errors.New("no observation system configured")
+
 // Initialize is the logical.Backend implementation.
 func (b *Backend) Initialize(ctx context.Context, req *logical.InitializationRequest) error {
 	if b.InitializeFunc != nil {
@@ -216,11 +231,13 @@ func (b *Backend) HandleRequest(ctx context.Context, req *logical.Request) (*log
 		return b.handleRevokeRenew(ctx, req)
 	case logical.RollbackOperation:
 		return b.handleRollback(ctx, req)
+	case logical.RotationOperation:
+		return b.handleRotation(ctx, req)
 	}
 
 	// If the path is empty and it is a help operation, handle that.
 	if req.Path == "" && req.Operation == logical.HelpOperation {
-		return b.handleRootHelp(req)
+		return b.handleRootHelp(ctx, req)
 	}
 
 	// Find the matching route
@@ -237,13 +254,18 @@ func (b *Backend) HandleRequest(ctx context.Context, req *logical.Request) (*log
 		}
 	}
 
+	// We need to check SQLConnectionProducer fields separately since they are not top-level Path fields.
+	var sqlFields map[string]any
+	if req.MountType == "database" && strings.HasPrefix(req.Path, "config") {
+		sqlFields = connutil.SQLConnectionProducerFieldNames()
+	}
 	// Build up the data for the route, with the URL taking priority
 	// for the fields over the PUT data.
 	raw := make(map[string]interface{}, len(path.Fields))
 	var ignored []string
 	for k, v := range req.Data {
 		raw[k] = v
-		if !path.TakesArbitraryInput && path.Fields[k] == nil {
+		if !path.TakesArbitraryInput && path.Fields[k] == nil && sqlFields[k] == nil {
 			ignored = append(ignored, k)
 		}
 	}
@@ -417,6 +439,7 @@ func (b *Backend) Setup(ctx context.Context, config *logical.BackendConfig) erro
 	b.logger = config.Logger
 	b.system = config.System
 	b.events = config.EventsSender
+	b.observations = config.ObservationRecorder
 	return nil
 }
 
@@ -464,6 +487,35 @@ func (b *Backend) Route(path string) *Path {
 	return result
 }
 
+// RecoverSourcePathFieldData returns the captures from the recover source path
+// as field data
+func (b *Backend) RecoverSourcePathFieldData(req *logical.Request) (*FieldData, error) {
+	if req.RecoverSourcePath == "" {
+		return nil, fmt.Errorf("request has no recover source path")
+	}
+	newPath, _ := b.route(req.Path)
+	sourcePath, sourceCaptures := b.route(req.RecoverSourcePath)
+	if sourcePath == nil || sourcePath.Pattern != newPath.Pattern {
+		return nil, fmt.Errorf("recover source path %q does not match request path %q", req.RecoverSourcePath, req.Path)
+	}
+
+	raw := make(map[string]interface{}, len(sourceCaptures))
+	for k, v := range sourceCaptures {
+		raw[k] = v
+	}
+	fd := FieldData{
+		Raw:    raw,
+		Schema: sourcePath.Fields,
+	}
+
+	err := fd.Validate()
+	if err != nil {
+		return nil, fmt.Errorf("field validation of recover source path failed: %w", err)
+	}
+
+	return &fd, nil
+}
+
 // Secret is used to look up the secret with the given type.
 func (b *Backend) Secret(k string) *Secret {
 	for _, s := range b.Secrets {
@@ -515,8 +567,10 @@ func (b *Backend) init() {
 			p.Pattern = p.Pattern + "$"
 		}
 
-		// Detect the coding error of an invalid Pattern
-		b.pathsRe[i] = regexp.MustCompile(p.Pattern)
+		// Detect the coding error of an invalid Pattern. We are using an interned
+		// regexps library here to save memory, since we can have many instances of the
+		// same backend.
+		b.pathsRe[i] = iRegexp.MustCompileInterned(p.Pattern)
 	}
 }
 
@@ -548,7 +602,7 @@ func (b *Backend) route(path string) (*Path, map[string]string) {
 	return nil, nil
 }
 
-func (b *Backend) handleRootHelp(req *logical.Request) (*logical.Response, error) {
+func (b *Backend) handleRootHelp(ctx context.Context, req *logical.Request) (*logical.Response, error) {
 	// Build a mapping of the paths and get the paths alphabetized to
 	// make the output prettier.
 	pathsMap := make(map[string]*Path)
@@ -596,6 +650,10 @@ func (b *Backend) handleRootHelp(req *logical.Request) (*logical.Response, error
 		vaultVersion = env.VaultVersion
 	}
 
+	redactVersion, _, _, _ := logical.CtxRedactionSettingsValue(ctx)
+	if redactVersion {
+		vaultVersion = ""
+	}
 	doc := NewOASDocument(vaultVersion)
 	if err := documentPaths(b, requestResponsePrefix, doc); err != nil {
 		b.Logger().Warn("error generating OpenAPI", "error", err)
@@ -661,6 +719,19 @@ func (b *Backend) handleRollback(ctx context.Context, req *logical.Request) (*lo
 	return resp, merr.ErrorOrNil()
 }
 
+// handleRotation invokes the RotateCredential func set on the backend.
+func (b *Backend) handleRotation(ctx context.Context, req *logical.Request) (*logical.Response, error) {
+	if b.RotateCredential == nil {
+		return nil, logical.ErrUnsupportedOperation
+	}
+
+	err := b.RotateCredential(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+	return &logical.Response{}, nil
+}
+
 func (b *Backend) handleAuthRenew(ctx context.Context, req *logical.Request) (*logical.Response, error) {
 	if b.AuthRenew == nil {
 		return logical.ErrorResponse("this auth type doesn't support renew"), nil
@@ -738,6 +809,15 @@ func (b *Backend) SendEvent(ctx context.Context, eventType logical.EventType, ev
 	return b.events.SendEvent(ctx, eventType, event)
 }
 
+// RecordObservation is used to record observations through the plugin's observation system.
+// It returns ErrNoObservations if the observation system has not been configured or enabled.
+func (b *Backend) RecordObservation(ctx context.Context, observationType string, data map[string]interface{}) error {
+	if b.observations == nil {
+		return ErrNoObservations
+	}
+	return b.observations.RecordObservationFromPlugin(ctx, observationType, data)
+}
+
 // FieldSchema is a basic schema to describe the format of a path field.
 type FieldSchema struct {
 	Type        FieldType
diff --git a/sdk/framework/backend_test.go b/sdk/framework/backend_test.go
index dba5b0c0a3d..1988d835823 100644
--- a/sdk/framework/backend_test.go
+++ b/sdk/framework/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
@@ -52,49 +52,86 @@ func TestBackend_impl(t *testing.T) {
 }
 
 func TestBackendHandleRequestFieldWarnings(t *testing.T) {
-	handler := func(ctx context.Context, req *logical.Request, data *FieldData) (*logical.Response, error) {
-		return &logical.Response{
+	t.Run("check replaced and ignored endpoints", func(t *testing.T) {
+		handler := func(ctx context.Context, req *logical.Request, data *FieldData) (*logical.Response, error) {
+			return &logical.Response{
+				Data: map[string]interface{}{
+					"an_int":   data.Get("an_int"),
+					"a_string": data.Get("a_string"),
+					"name":     data.Get("name"),
+				},
+			}, nil
+		}
+
+		backend := &Backend{
+			Paths: []*Path{
+				{
+					Pattern: "foo/bar/(?P<name>.+)",
+					Fields: map[string]*FieldSchema{
+						"an_int":   {Type: TypeInt},
+						"a_string": {Type: TypeString},
+						"name":     {Type: TypeString},
+					},
+					Operations: map[logical.Operation]OperationHandler{
+						logical.UpdateOperation: &PathOperation{Callback: handler},
+					},
+				},
+			},
+		}
+		ctx := context.Background()
+		resp, err := backend.HandleRequest(ctx, &logical.Request{
+			Operation: logical.UpdateOperation,
+			Path:      "foo/bar/baz",
 			Data: map[string]interface{}{
-				"an_int":   data.Get("an_int"),
-				"a_string": data.Get("a_string"),
-				"name":     data.Get("name"),
+				"an_int":        10,
+				"a_string":      "accepted",
+				"unrecognized1": "unrecognized",
+				"unrecognized2": 20.2,
+				"name":          "noop",
 			},
-		}, nil
-	}
+		})
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Len(t, resp.Warnings, 2)
+		require.True(t, strutil.StrListContains(resp.Warnings, "Endpoint ignored these unrecognized parameters: [unrecognized1 unrecognized2]"))
+		require.True(t, strutil.StrListContains(resp.Warnings, "Endpoint replaced the value of these parameters with the values captured from the endpoint's path: [name]"))
+	})
 
-	backend := &Backend{
-		Paths: []*Path{
-			{
-				Pattern: "foo/bar/(?P<name>.+)",
-				Fields: map[string]*FieldSchema{
-					"an_int":   {Type: TypeInt},
-					"a_string": {Type: TypeString},
-					"name":     {Type: TypeString},
-				},
-				Operations: map[logical.Operation]OperationHandler{
-					logical.UpdateOperation: &PathOperation{Callback: handler},
+	t.Run("check ignored DB secrets config ignored fields", func(t *testing.T) {
+		handler := func(ctx context.Context, req *logical.Request, data *FieldData) (*logical.Response, error) {
+			return &logical.Response{
+				Data: map[string]interface{}{},
+			}, nil
+		}
+
+		backend := &Backend{
+			Paths: []*Path{
+				{
+					Pattern: "config/sqldb",
+					Fields:  map[string]*FieldSchema{},
+					Operations: map[logical.Operation]OperationHandler{
+						logical.UpdateOperation: &PathOperation{Callback: handler},
+					},
 				},
 			},
-		},
-	}
-	ctx := context.Background()
-	resp, err := backend.HandleRequest(ctx, &logical.Request{
-		Operation: logical.UpdateOperation,
-		Path:      "foo/bar/baz",
-		Data: map[string]interface{}{
-			"an_int":        10,
-			"a_string":      "accepted",
-			"unrecognized1": "unrecognized",
-			"unrecognized2": 20.2,
-			"name":          "noop",
-		},
+		}
+		ctx := context.Background()
+		resp, err := backend.HandleRequest(ctx, &logical.Request{
+			Operation: logical.UpdateOperation,
+			Path:      "config/sqldb",
+			MountType: "database",
+			Data: map[string]interface{}{
+				"connection_url": "localhost",
+				"username":       "user",
+				"password":       "pass",
+				"unrecognized1":  "unrecognized",
+			},
+		})
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Len(t, resp.Warnings, 1)
+		require.Equal(t, resp.Warnings[0], "Endpoint ignored these unrecognized parameters: [unrecognized1]")
 	})
-	require.NoError(t, err)
-	require.NotNil(t, resp)
-	t.Log(resp.Warnings)
-	require.Len(t, resp.Warnings, 2)
-	require.True(t, strutil.StrListContains(resp.Warnings, "Endpoint ignored these unrecognized parameters: [unrecognized1 unrecognized2]"))
-	require.True(t, strutil.StrListContains(resp.Warnings, "Endpoint replaced the value of these parameters with the values captured from the endpoint's path: [name]"))
 }
 
 func TestBackendHandleRequest(t *testing.T) {
@@ -834,3 +871,98 @@ func TestFieldTypeMethods(t *testing.T) {
 		})
 	}
 }
+
+// TestRecoverSourcePathFieldData verifies that source path data is correctly
+// extracted from the path
+func TestRecoverSourcePathFieldData(t *testing.T) {
+	backend := &Backend{
+		Paths: []*Path{
+			{
+				Pattern: "path/" + GenericNameRegex("name") + "/type/" + GenericNameRegex("type"),
+				Fields: map[string]*FieldSchema{
+					"name": {
+						Type:     TypeString,
+						Required: true,
+					},
+					"type": {
+						Type:     TypeString,
+						Required: true,
+					},
+					// content won't be present in the path
+					"content": {
+						Type:     TypeString,
+						Required: true,
+					},
+				},
+			},
+		},
+	}
+	testCases := []struct {
+		name       string
+		path       string
+		sourcePath string
+		wantName   string
+		wantType   string
+		wantError  bool
+	}{
+		{
+			name:      "no source path errors",
+			path:      "path/foo/type/bar",
+			wantError: true,
+		},
+		{
+			name:       "non matching paths errors",
+			path:       "path/foo/type/bar",
+			sourcePath: "other/baz/type/qux",
+			wantError:  true,
+		},
+		{
+			name:       "missing path element errors",
+			path:       "path/foo/type/bar",
+			sourcePath: "path/foo/type",
+			wantError:  true,
+		},
+		{
+			name:       "different name",
+			path:       "path/foo/type/bar",
+			sourcePath: "path/other/type/bar",
+			wantName:   "other",
+			wantType:   "bar",
+		},
+		{
+			name:       "different type",
+			path:       "path/foo/type/bar",
+			sourcePath: "path/foo/type/other",
+			wantName:   "foo",
+			wantType:   "other",
+		},
+		{
+			name:       "different name and type",
+			path:       "path/foo/type/bar",
+			sourcePath: "path/other/type/qux",
+			wantName:   "other",
+			wantType:   "qux",
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req := &logical.Request{
+				Operation:         logical.RecoverOperation,
+				Path:              tc.path,
+				RecoverSourcePath: tc.sourcePath,
+			}
+			data, err := backend.RecoverSourcePathFieldData(req)
+			if tc.wantError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+			if tc.wantName != "" {
+				require.Equal(t, tc.wantName, data.Get("name"))
+			}
+			if tc.wantType != "" {
+				require.Equal(t, tc.wantType, data.Get("type"))
+			}
+		})
+	}
+}
diff --git a/sdk/framework/field_data.go b/sdk/framework/field_data.go
index e5f69acdb81..a1a27a83b25 100644
--- a/sdk/framework/field_data.go
+++ b/sdk/framework/field_data.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
@@ -33,7 +33,7 @@ type FieldData struct {
 // trying to get data out.  Data not in the schema is not
 // an error at this point, so we don't worry about it.
 func (d *FieldData) Validate() error {
-	for field, value := range d.Raw {
+	for field := range d.Raw {
 
 		schema, ok := d.Schema[field]
 		if !ok {
@@ -46,7 +46,7 @@ func (d *FieldData) Validate() error {
 			TypeKVPairs, TypeCommaIntSlice, TypeHeader, TypeFloat, TypeTime:
 			_, _, err := d.getPrimitive(field, schema)
 			if err != nil {
-				return errwrap.Wrapf(fmt.Sprintf("error converting input %v for field %q: {{err}}", value, field), err)
+				return errwrap.Wrapf(fmt.Sprintf("error converting input for field %q: {{err}}", field), err)
 			}
 		default:
 			return fmt.Errorf("unknown field type %q for field %q", schema.Type, field)
diff --git a/sdk/framework/field_data_test.go b/sdk/framework/field_data_test.go
index 078c6fbcd5b..68fc57e316c 100644
--- a/sdk/framework/field_data_test.go
+++ b/sdk/framework/field_data_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/field_type.go b/sdk/framework/field_type.go
index ee07b6afe86..9919c240890 100644
--- a/sdk/framework/field_type.go
+++ b/sdk/framework/field_type.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/filter.go b/sdk/framework/filter.go
index b9b99799b91..ebe342b245d 100644
--- a/sdk/framework/filter.go
+++ b/sdk/framework/filter.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/identity.go b/sdk/framework/identity.go
index 157f3c193cf..3e4246cfb85 100644
--- a/sdk/framework/identity.go
+++ b/sdk/framework/identity.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/identity_test.go b/sdk/framework/identity_test.go
index 1667fb96063..f671536352a 100644
--- a/sdk/framework/identity_test.go
+++ b/sdk/framework/identity_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/lease.go b/sdk/framework/lease.go
index 24824ca52a2..537973e2b57 100644
--- a/sdk/framework/lease.go
+++ b/sdk/framework/lease.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/lease_test.go b/sdk/framework/lease_test.go
index 5d1f9f091bb..623ff0be7c7 100644
--- a/sdk/framework/lease_test.go
+++ b/sdk/framework/lease_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/openapi.go b/sdk/framework/openapi.go
index 82e7f5fb644..3a232537b11 100644
--- a/sdk/framework/openapi.go
+++ b/sdk/framework/openapi.go
@@ -116,6 +116,7 @@ type OASPathItem struct {
 
 	Get    *OASOperation `json:"get,omitempty"`
 	Post   *OASOperation `json:"post,omitempty"`
+	Patch  *OASOperation `json:"patch,omitempty"`
 	Delete *OASOperation `json:"delete,omitempty"`
 }
 
@@ -244,10 +245,12 @@ func documentPaths(backend *Backend, requestResponsePrefix string, doc *OASDocum
 func documentPath(p *Path, backend *Backend, requestResponsePrefix string, doc *OASDocument) error {
 	var sudoPaths []string
 	var unauthPaths []string
+	var allowSnapshotReadPaths []string
 
 	if backend.PathsSpecial != nil {
 		sudoPaths = backend.PathsSpecial.Root
 		unauthPaths = backend.PathsSpecial.Unauthenticated
+		allowSnapshotReadPaths = backend.PathsSpecial.AllowSnapshotRead
 	}
 
 	// Convert optional parameters into distinct patterns to be processed independently.
@@ -277,6 +280,7 @@ func documentPath(p *Path, backend *Backend, requestResponsePrefix string, doc *
 		pi.Sudo = specialPathMatch(path, sudoPaths)
 		pi.Unauthenticated = specialPathMatch(path, unauthPaths)
 		pi.DisplayAttrs = withoutOperationHints(p.DisplayAttrs)
+		allowSnapshotRead := specialPathMatch(path, allowSnapshotReadPaths)
 
 		// If the newer style Operations map isn't defined, create one from the legacy fields.
 		operations := p.Operations
@@ -328,6 +332,14 @@ func documentPath(p *Path, backend *Backend, requestResponsePrefix string, doc *
 				continue
 			}
 
+			// OpenAPI doesn't allow for multiple operations on the same path and with the same HTTP method, so both
+			// Create, Update and Recover which operate on either POST or PUT methods are folded into Update (under POST
+			// method on OpenAPI). Furthermore, so far there's no use case for a Recover operation on an endpoint that
+			// doesn't support either Create or Update, so we skip it here as well.
+			if opType == logical.RecoverOperation {
+				continue
+			}
+
 			if opType == logical.CreateOperation {
 				pi.CreateSupported = true
 
@@ -354,10 +366,12 @@ func documentPath(p *Path, backend *Backend, requestResponsePrefix string, doc *
 			op.OperationID = operationID
 
 			switch opType {
-			// For the operation types which map to POST/PUT methods, and so allow for request body parameters,
+			// For the operation types which map to POST/PUT/PATCH methods, and so allow for request body parameters,
 			// prepare the request body definition
 			case logical.CreateOperation:
 				fallthrough
+			case logical.PatchOperation:
+				fallthrough
 			case logical.UpdateOperation:
 				s := &OASSchema{
 					Type:       "object",
@@ -377,11 +391,38 @@ func documentPath(p *Path, backend *Backend, requestResponsePrefix string, doc *
 
 				// Contrary to what one might guess, fields marked with "Query: true" are only query fields when the
 				// request method is one which does not allow for a request body - they are still body fields when
-				// dealing with a POST/PUT request.
+				// dealing with a POST/PUT/PATCH request.
 				for name, field := range queryFields {
 					addFieldToOASSchema(s, name, field)
 				}
 
+				// The recover operation is a special case, it's under the same POST/PUT method as Create and
+				// Update, but it's triggered via a query parameter, not a field in the body.
+				if operations[logical.RecoverOperation] != nil && opType != logical.PatchOperation {
+					op.Parameters = append(op.Parameters, OASParameter{
+						Name:        "recover_snapshot_id",
+						Description: "Triggers a recover operation using the given snapshot ID. Request body is ignored when a recover operation is requested.",
+						In:          "query",
+						Deprecated:  true,
+						Schema:      &OASSchema{Type: "string"},
+					}, OASParameter{
+						Name:        "X-Vault-Recover-Snapshot-Id",
+						Description: "Triggers a recover operation using the given snapshot ID. Request body is ignored when a recover operation is requested.",
+						In:          "header",
+						Schema:      &OASSchema{Type: "string"},
+					})
+					// If there are path fields, it will also be possible to recover from a path with
+					// different path field values than the request path.
+					if len(pathFields) > 0 {
+						op.Parameters = append(op.Parameters, OASParameter{
+							Name:        "X-Vault-Recover-Source-Path",
+							Description: "The source path to recover from. Only used if a snapshot ID is also supplied. If not specified, the source path is assumed to be the same as the request path.",
+							In:          "header",
+							Schema:      &OASSchema{Type: "string"},
+						})
+					}
+				}
+
 				// Make the ordering deterministic, so that the generated OpenAPI spec document, observed over several
 				// versions, doesn't contain spurious non-semantic changes.
 				sort.Strings(s.Required)
@@ -463,6 +504,15 @@ func documentPath(p *Path, backend *Backend, requestResponsePrefix string, doc *
 					op.Parameters = append(op.Parameters, p)
 				}
 
+				if allowSnapshotRead && opType != logical.DeleteOperation {
+					op.Parameters = append(op.Parameters, OASParameter{
+						Name:        "read_snapshot_id",
+						Description: "Targets the read operation to the provided loaded snapshot Id",
+						In:          "query",
+						Schema:      &OASSchema{Type: "string"},
+					})
+				}
+
 				// Sort parameters for a stable output
 				sort.Slice(op.Parameters, func(i, j int) bool {
 					return op.Parameters[i].Name < op.Parameters[j].Name
@@ -571,6 +621,8 @@ func documentPath(p *Path, backend *Backend, requestResponsePrefix string, doc *
 				pi.Delete = op
 			case logical.ListOperation:
 				listOperation = op
+			case logical.PatchOperation:
+				pi.Patch = op
 			}
 		}
 
@@ -579,13 +631,14 @@ func documentPath(p *Path, backend *Backend, requestResponsePrefix string, doc *
 		// the two following blocks of code (non-list, and list) write an OpenAPI path to the output document, then the
 		// first one will definitely not have a trailing slash.
 		originalPathHasTrailingSlash := strings.HasSuffix(path, "/")
-		if originalPathHasTrailingSlash && (pi.Get != nil || pi.Post != nil || pi.Delete != nil) {
+		if originalPathHasTrailingSlash && (pi.Get != nil || pi.Post != nil || pi.Delete != nil || pi.Patch != nil) {
 			backend.Logger().Warn(
 				"OpenAPI spec generation: discarding impossible-to-invoke non-list operations from path with "+
 					"required trailing slash; this is a bug in the backend code", "path", path)
 			pi.Get = nil
 			pi.Post = nil
 			pi.Delete = nil
+			pi.Patch = nil
 		}
 
 		// Write the regular, non-list, OpenAPI path to the OpenAPI document, UNLESS we generated a ListOperation, and
@@ -597,7 +650,7 @@ func documentPath(p *Path, backend *Backend, requestResponsePrefix string, doc *
 		// to provide documentation to a human that an endpoint exists, even if it has no invokable OpenAPI operations.
 		// Examples of this include kv-v2's ".*" endpoint (regex cannot be translated to OpenAPI parameters), and the
 		// auth/oci/login endpoint (implements ResolveRoleOperation only, only callable from inside Vault).
-		if listOperation == nil || pi.Get != nil || pi.Post != nil || pi.Delete != nil {
+		if listOperation == nil || pi.Get != nil || pi.Post != nil || pi.Delete != nil || pi.Patch != nil {
 			openAPIPath := "/" + path
 			if doc.Paths[openAPIPath] != nil {
 				backend.Logger().Warn(
@@ -1222,7 +1275,7 @@ func (d *OASDocument) CreateOperationIDs(context string) {
 
 	for _, path := range paths {
 		pi := d.Paths[path]
-		for _, method := range []string{"get", "post", "delete"} {
+		for _, method := range []string{"get", "post", "delete", "patch"} {
 			var oasOperation *OASOperation
 			switch method {
 			case "get":
@@ -1231,6 +1284,8 @@ func (d *OASDocument) CreateOperationIDs(context string) {
 				oasOperation = pi.Post
 			case "delete":
 				oasOperation = pi.Delete
+			case "patch":
+				oasOperation = pi.Patch
 			}
 
 			if oasOperation == nil {
diff --git a/sdk/framework/openapi_test.go b/sdk/framework/openapi_test.go
index 4cb94342ffd..dc4e50fc27f 100644
--- a/sdk/framework/openapi_test.go
+++ b/sdk/framework/openapi_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"reflect"
 	"regexp"
+	"slices"
 	"sort"
 	"strings"
 	"testing"
@@ -246,18 +247,22 @@ func TestOpenAPI_SplitFields(t *testing.T) {
 
 func TestOpenAPI_SpecialPaths(t *testing.T) {
 	tests := map[string]struct {
-		pattern                 string
-		rootPaths               []string
-		rootExpected            bool
-		unauthenticatedPaths    []string
-		unauthenticatedExpected bool
+		pattern                   string
+		rootPaths                 []string
+		rootExpected              bool
+		unauthenticatedPaths      []string
+		unauthenticatedExpected   bool
+		allowSnapshotRead         []string
+		allowSnapshotReadExpected bool
 	}{
 		"empty": {
-			pattern:                 "foo",
-			rootPaths:               []string{},
-			rootExpected:            false,
-			unauthenticatedPaths:    []string{},
-			unauthenticatedExpected: false,
+			pattern:                   "foo",
+			rootPaths:                 []string{},
+			rootExpected:              false,
+			unauthenticatedPaths:      []string{},
+			unauthenticatedExpected:   false,
+			allowSnapshotRead:         []string{},
+			allowSnapshotReadExpected: false,
 		},
 		"exact-match-unauthenticated": {
 			pattern:                 "foo",
@@ -336,17 +341,75 @@ func TestOpenAPI_SpecialPaths(t *testing.T) {
 			unauthenticatedPaths:    []string{"foo/bar"},
 			unauthenticatedExpected: false,
 		},
+		"exact-match-snapshot-read": {
+			pattern:                   "foo",
+			rootPaths:                 []string{},
+			rootExpected:              false,
+			unauthenticatedPaths:      []string{},
+			unauthenticatedExpected:   false,
+			allowSnapshotRead:         []string{"foo"},
+			allowSnapshotReadExpected: true,
+		},
+		"asterisk-match-snapshot-read": {
+			pattern:                   "foo/bar",
+			rootPaths:                 []string{},
+			rootExpected:              false,
+			unauthenticatedPaths:      []string{},
+			unauthenticatedExpected:   false,
+			allowSnapshotRead:         []string{"foo/*"},
+			allowSnapshotReadExpected: true,
+		},
+		"no-match-snapshot-read": {
+			pattern:                   "foo/bar",
+			rootPaths:                 []string{},
+			rootExpected:              false,
+			unauthenticatedPaths:      []string{},
+			unauthenticatedExpected:   false,
+			allowSnapshotRead:         []string{"baz"},
+			allowSnapshotReadExpected: false,
+		},
+		"multiple-snapshot-read-paths": {
+			pattern:                   "foo/bar",
+			rootPaths:                 []string{},
+			rootExpected:              false,
+			unauthenticatedPaths:      []string{},
+			unauthenticatedExpected:   false,
+			allowSnapshotRead:         []string{"foo/*", "baz"},
+			allowSnapshotReadExpected: true,
+		},
+		"plus-match-snapshot-read": {
+			pattern:                   "foo/bar/baz",
+			rootPaths:                 []string{},
+			rootExpected:              false,
+			unauthenticatedPaths:      []string{},
+			unauthenticatedExpected:   false,
+			allowSnapshotRead:         []string{"foo/+/baz"},
+			allowSnapshotReadExpected: true,
+		},
+		"plus-and-asterisk-snapshot-read": {
+			pattern:                   "foo/bar/baz/something",
+			rootPaths:                 []string{},
+			rootExpected:              false,
+			unauthenticatedPaths:      []string{},
+			unauthenticatedExpected:   false,
+			allowSnapshotRead:         []string{"foo/+/baz/*"},
+			allowSnapshotReadExpected: true,
+		},
 	}
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
 			doc := NewOASDocument("version")
 			path := Path{
 				Pattern: test.pattern,
+				Operations: map[logical.Operation]OperationHandler{
+					logical.ReadOperation: &PathOperation{},
+				},
 			}
 			backend := &Backend{
 				PathsSpecial: &logical.Paths{
-					Root:            test.rootPaths,
-					Unauthenticated: test.unauthenticatedPaths,
+					Root:              test.rootPaths,
+					Unauthenticated:   test.unauthenticatedPaths,
+					AllowSnapshotRead: test.allowSnapshotRead,
 				},
 				BackendType: logical.TypeLogical,
 			}
@@ -364,6 +427,16 @@ func TestOpenAPI_SpecialPaths(t *testing.T) {
 			if actual != test.unauthenticatedExpected {
 				t.Fatalf("Test (unauth): expected: %v; got: %v", test.unauthenticatedExpected, actual)
 			}
+
+			var supportsSnapshotId bool
+			if doc.Paths["/"+test.pattern].Get != nil {
+				supportsSnapshotId = slices.ContainsFunc(doc.Paths["/"+test.pattern].Get.Parameters, func(p OASParameter) bool {
+					return p.Name == "read_snapshot_id"
+				})
+			}
+			if supportsSnapshotId != test.allowSnapshotReadExpected {
+				t.Fatalf("Test (allowSnapshotRead): expected: %v; got: %v", test.allowSnapshotReadExpected, actual)
+			}
 		})
 	}
 }
@@ -459,6 +532,10 @@ func TestOpenAPI_Paths(t *testing.T) {
 					Summary:     "Update Summary",
 					Description: "Update Description",
 				},
+				logical.PatchOperation: &PathOperation{
+					Summary:     "Patch Summary",
+					Description: "Patch Description",
+				},
 				logical.CreateOperation: &PathOperation{
 					Summary:     "Create Summary",
 					Description: "Create Description",
@@ -471,6 +548,9 @@ func TestOpenAPI_Paths(t *testing.T) {
 					Summary:     "This shouldn't show up",
 					Unpublished: true,
 				},
+				logical.RecoverOperation: &PathOperation{
+					Summary: "Recover Summary shouldn't show up",
+				},
 			},
 			DisplayAttrs: &DisplayAttributes{
 				Navigation: true,
@@ -478,11 +558,36 @@ func TestOpenAPI_Paths(t *testing.T) {
 		}
 
 		sp := &logical.Paths{
-			Root: []string{"foo*"},
+			Root:              []string{"foo*"},
+			AllowSnapshotRead: []string{"*"},
 		}
 		testPath(t, p, sp, expected("operations"))
 	})
+	t.Run("Operations - Recover no path fields", func(t *testing.T) {
+		p := &Path{
+			Pattern: "foo",
+			Fields: map[string]*FieldSchema{
+				"name": {
+					Type:        TypeNameString,
+					Default:     "Larry",
+					Description: "the name",
+				},
+			},
+			Operations: map[logical.Operation]OperationHandler{
+				logical.RecoverOperation: &PathOperation{},
+				logical.ReadOperation:    &PathOperation{},
+				logical.UpdateOperation:  &PathOperation{},
+			},
+			DisplayAttrs: &DisplayAttributes{
+				Navigation: true,
+			},
+		}
 
+		sp := &logical.Paths{
+			AllowSnapshotRead: []string{"*"},
+		}
+		testPath(t, p, sp, expected("operations_recover"))
+	})
 	t.Run("Operations - List Only", func(t *testing.T) {
 		p := &Path{
 			Pattern: "foo/" + GenericNameRegex("id"),
@@ -712,6 +817,15 @@ func TestOpenAPI_constructOperationID(t *testing.T) {
 			defaultPrefix:       "test",
 			expected:            "test-write-path-to-thing",
 		},
+		"simple-patch": {
+			path:                "path/to/thing",
+			pathIndex:           0,
+			pathAttributes:      nil,
+			operation:           logical.PatchOperation,
+			operationAttributes: nil,
+			defaultPrefix:       "test",
+			expected:            "test-patch-path-to-thing",
+		},
 		"operation-verb": {
 			path:                "path/to/thing",
 			pathIndex:           0,
@@ -917,19 +1031,6 @@ func testPath(t *testing.T, path *Path, sp *logical.Paths, expectedJSON string)
 	}
 }
 
-func getPathOp(pi *OASPathItem, op string) *OASOperation {
-	switch op {
-	case "get":
-		return pi.Get
-	case "post":
-		return pi.Post
-	case "delete":
-		return pi.Delete
-	default:
-		panic("unexpected operation: " + op)
-	}
-}
-
 func expected(name string) string {
 	data, err := ioutil.ReadFile(filepath.Join("testdata", name+".json"))
 	if err != nil {
diff --git a/sdk/framework/path.go b/sdk/framework/path.go
index c951b83a99d..6cd1f5c8417 100644
--- a/sdk/framework/path.go
+++ b/sdk/framework/path.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
@@ -268,6 +268,9 @@ type DisplayAttributes struct {
 	// EditType is the optional type of form field needed for a property
 	// This is only necessary for a "textarea" or "file"
 	EditType string `json:"editType,omitempty"`
+
+	// Identifier is the primary field rendered in the UI (e.g. name, path, url, etc.)
+	Identifier bool `json:"identifier,omitempty"`
 }
 
 // RequestExample is example of request data.
@@ -282,7 +285,7 @@ type RequestExample struct {
 
 // Response describes and optional demonstrations an operation response.
 type Response struct {
-	Description string                  // summary of the the response and should always be provided
+	Description string                  // summary of the response and should always be provided
 	MediaType   string                  // media type of the response, defaulting to "application/json" if empty
 	Fields      map[string]*FieldSchema // the fields present in this response, used to generate openapi response
 	Example     *logical.Response       // example response data
@@ -384,6 +387,10 @@ func (p *Path) helpCallback(b *Backend) OperationFunc {
 				vaultVersion = env.VaultVersion
 			}
 		}
+		redactVersion, _, _, _ := logical.CtxRedactionSettingsValue(ctx)
+		if redactVersion {
+			vaultVersion = ""
+		}
 		doc := NewOASDocument(vaultVersion)
 		if err := documentPath(p, b, requestResponsePrefix, doc); err != nil {
 			b.Logger().Warn("error generating OpenAPI", "error", err)
diff --git a/sdk/framework/path_map.go b/sdk/framework/path_map.go
index 46cf4720e96..feff0c675ba 100644
--- a/sdk/framework/path_map.go
+++ b/sdk/framework/path_map.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/path_map_test.go b/sdk/framework/path_map_test.go
index 3fe6308cbcd..a2489f3f938 100644
--- a/sdk/framework/path_map_test.go
+++ b/sdk/framework/path_map_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/path_struct.go b/sdk/framework/path_struct.go
index cba855065ea..6dcbee32d60 100644
--- a/sdk/framework/path_struct.go
+++ b/sdk/framework/path_struct.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/path_struct_test.go b/sdk/framework/path_struct_test.go
index 88662af5300..81e6a605ea9 100644
--- a/sdk/framework/path_struct_test.go
+++ b/sdk/framework/path_struct_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/path_test.go b/sdk/framework/path_test.go
index 4541930ed59..7a735a558f1 100644
--- a/sdk/framework/path_test.go
+++ b/sdk/framework/path_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/policy_map.go b/sdk/framework/policy_map.go
index 94accf88ae7..96d44e7e0de 100644
--- a/sdk/framework/policy_map.go
+++ b/sdk/framework/policy_map.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/policy_map_test.go b/sdk/framework/policy_map_test.go
index b785fddc783..7d9c690f059 100644
--- a/sdk/framework/policy_map_test.go
+++ b/sdk/framework/policy_map_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/secret.go b/sdk/framework/secret.go
index 095bc12b724..5fd74614e32 100644
--- a/sdk/framework/secret.go
+++ b/sdk/framework/secret.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/secret_test.go b/sdk/framework/secret_test.go
index 29058dc84e3..e47cc2eb31d 100644
--- a/sdk/framework/secret_test.go
+++ b/sdk/framework/secret_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/template.go b/sdk/framework/template.go
index d395c8f8dbd..0c866a34eb7 100644
--- a/sdk/framework/template.go
+++ b/sdk/framework/template.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/testdata/operations.json b/sdk/framework/testdata/operations.json
index 8e9ec9b8d0e..885b3390597 100644
--- a/sdk/framework/testdata/operations.json
+++ b/sdk/framework/testdata/operations.json
@@ -43,6 +43,14 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "name": "read_snapshot_id",
+            "description": "Targets the read operation to the provided loaded snapshot Id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -58,6 +66,33 @@
         "tags": [
           "secrets"
         ],
+        "parameters": [
+          {
+            "name": "recover_snapshot_id",
+            "description": "Triggers a recover operation using the given snapshot ID. Request body is ignored when a recover operation is requested.",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            },
+            "deprecated": true
+          },
+          {
+            "name": "X-Vault-Recover-Snapshot-Id",
+            "description": "Triggers a recover operation using the given snapshot ID. Request body is ignored when a recover operation is requested.",
+            "in": "header",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "X-Vault-Recover-Source-Path",
+            "description": "The source path to recover from. Only used if a snapshot ID is also supplied. If not specified, the source path is assumed to be the same as the request path.",
+            "in": "header",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "requestBody": {
           "required": true,
           "content": {
@@ -73,6 +108,29 @@
             "description": "OK"
           }
         }
+      },
+      "patch": {
+        "summary": "Patch Summary",
+        "description": "Patch Description",
+        "operationId": "kv-patch-foo-id",
+        "tags": [
+          "secrets"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KvPatchFooIdRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
       }
     },
     "/foo/{id}/": {
@@ -119,6 +177,14 @@
               ]
             },
             "required": true
+          },
+          {
+            "name": "read_snapshot_id",
+            "description": "Targets the read operation to the provided loaded snapshot Id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -192,6 +258,60 @@
           "age"
         ]
       },
+      "KvPatchFooIdRequest": {
+        "type": "object",
+        "properties": {
+          "age": {
+            "type": "integer",
+            "description": "the age",
+            "enum": [
+              1,
+              2,
+              3
+            ],
+            "x-vault-displayAttrs": {
+              "name": "Age",
+              "value": 7,
+              "sensitive": true,
+              "group": "Some Group"
+            }
+          },
+          "flavors": {
+            "type": "array",
+            "description": "the flavors",
+            "items": {
+              "type": "string"
+            }
+          },
+          "format": {
+            "type": "string",
+            "description": "a query param"
+          },
+          "maximum": {
+            "type": "integer",
+            "description": "a maximum value",
+            "format": "int64"
+          },
+          "name": {
+            "type": "string",
+            "description": "the name",
+            "pattern": "\\w([\\w-.]*\\w)?",
+            "default": "Larry"
+          },
+          "x-abc-token": {
+            "type": "string",
+            "description": "a header value",
+            "enum": [
+              "a",
+              "b",
+              "c"
+            ]
+          }
+        },
+        "required": [
+          "age"
+        ]
+      },
       "StandardListResponse": {
         "type": "object",
         "properties": {
diff --git a/sdk/framework/testdata/operations_recover.json b/sdk/framework/testdata/operations_recover.json
new file mode 100644
index 00000000000..38ac86ec210
--- /dev/null
+++ b/sdk/framework/testdata/operations_recover.json
@@ -0,0 +1,95 @@
+{
+  "openapi": "3.0.2",
+  "info": {
+    "title": "HashiCorp Vault API",
+    "description": "HTTP API that gives you full access to Vault. All API routes are prefixed with `/v1/`.",
+    "version": "dummyversion",
+    "license": {
+      "name": "Mozilla Public License 2.0",
+      "url": "https://www.mozilla.org/en-US/MPL/2.0"
+    }
+  },
+  "paths": {
+    "/foo": {
+      "x-vault-displayAttrs": {
+        "navigation": true
+      },
+      "get": {
+        "operationId": "kv-read-foo",
+        "tags": [
+          "secrets"
+        ],
+        "parameters": [
+          {
+            "name": "read_snapshot_id",
+            "description": "Targets the read operation to the provided loaded snapshot Id",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      },
+      "post": {
+        "operationId": "kv-write-foo",
+        "tags": [
+          "secrets"
+        ],
+        "parameters": [
+          {
+            "name": "recover_snapshot_id",
+            "deprecated": true,
+            "description": "Triggers a recover operation using the given snapshot ID. Request body is ignored when a recover operation is requested.",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "X-Vault-Recover-Snapshot-Id",
+            "description": "Triggers a recover operation using the given snapshot ID. Request body is ignored when a recover operation is requested.",
+            "in": "header",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/KvWriteFooRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "OK"
+          }
+        }
+      }
+    }
+  },
+  "components": {
+    "schemas": {
+      "KvWriteFooRequest": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "the name",
+            "pattern": "\\w([\\w-.]*\\w)?",
+            "default": "Larry"
+          }
+        }
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/sdk/framework/testing.go b/sdk/framework/testing.go
index d2035d676f0..3304e1b45ec 100644
--- a/sdk/framework/testing.go
+++ b/sdk/framework/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/wal.go b/sdk/framework/wal.go
index b090f03e7bf..8527db4358c 100644
--- a/sdk/framework/wal.go
+++ b/sdk/framework/wal.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/framework/wal_test.go b/sdk/framework/wal_test.go
index 040749239c8..0295a2f3c56 100644
--- a/sdk/framework/wal_test.go
+++ b/sdk/framework/wal_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package framework
diff --git a/sdk/go.mod b/sdk/go.mod
index 0ccf5566769..30c47366f8d 100644
--- a/sdk/go.mod
+++ b/sdk/go.mod
@@ -1,117 +1,148 @@
 module github.com/hashicorp/vault/sdk
 
-go 1.19
+go 1.25.0
 
 require (
 	cloud.google.com/go/cloudsqlconn v1.4.3
-	github.com/armon/go-metrics v0.4.1
 	github.com/armon/go-radix v1.0.0
-	github.com/cenkalti/backoff/v3 v3.2.2
-	github.com/docker/docker v24.0.7+incompatible
-	github.com/docker/go-connections v0.4.0
+	github.com/cenkalti/backoff/v4 v4.3.0
+	github.com/docker/docker v28.3.3+incompatible
+	github.com/docker/go-connections v0.5.0
 	github.com/evanphx/json-patch/v5 v5.6.0
 	github.com/fatih/structs v1.1.0
-	github.com/go-ldap/ldap/v3 v3.4.4
-	github.com/go-test/deep v1.1.0
-	github.com/golang/protobuf v1.5.3
+	github.com/go-ldap/ldap/v3 v3.4.10
+	github.com/go-test/deep v1.1.1
+	github.com/golang/protobuf v1.5.4
 	github.com/golang/snappy v0.0.4
-	github.com/google/tink/go v1.6.1
-	github.com/hashicorp/cap/ldap v0.0.0-20230914221201-c4eecc7e31f7
+	github.com/google/certificate-transparency-go v1.3.1
+	github.com/hashicorp/cap/ldap v0.0.0-20250911140431-44d01434c285
 	github.com/hashicorp/errwrap v1.1.0
 	github.com/hashicorp/go-cleanhttp v0.5.2
-	github.com/hashicorp/go-hclog v1.5.0
+	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-immutable-radix v1.3.1
-	github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.0
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.8
+	github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.1
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.18
+	github.com/hashicorp/go-metrics v0.5.4
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-plugin v1.6.0
-	github.com/hashicorp/go-retryablehttp v0.7.1
+	github.com/hashicorp/go-plugin v1.6.1
+	github.com/hashicorp/go-retryablehttp v0.7.8
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2
-	github.com/hashicorp/go-secure-stdlib/mlock v0.1.2
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7
-	github.com/hashicorp/go-secure-stdlib/password v0.1.1
-	github.com/hashicorp/go-secure-stdlib/plugincontainer v0.3.0
+	github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.1
+	github.com/hashicorp/go-secure-stdlib/mlock v0.1.3
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
+	github.com/hashicorp/go-secure-stdlib/password v0.1.4
+	github.com/hashicorp/go-secure-stdlib/permitpool v1.0.0
+	github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.2
+	github.com/hashicorp/go-secure-stdlib/regexp v1.0.0
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2
-	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2
-	github.com/hashicorp/go-sockaddr v1.0.2
+	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3
+	github.com/hashicorp/go-sockaddr v1.0.7
 	github.com/hashicorp/go-uuid v1.0.3
-	github.com/hashicorp/go-version v1.6.0
-	github.com/hashicorp/golang-lru v0.5.4
-	github.com/hashicorp/hcl v1.0.1-vault-5
-	github.com/hashicorp/vault/api v1.9.1
+	github.com/hashicorp/go-version v1.7.0
+	github.com/hashicorp/golang-lru v1.0.2
+	github.com/hashicorp/hcl v1.0.1-vault-7
+	github.com/hashicorp/vault/api v1.16.0
 	github.com/mitchellh/copystructure v1.2.0
-	github.com/mitchellh/go-testing-interface v1.14.1
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/pierrec/lz4 v2.6.1+incompatible
+	github.com/robfig/cron/v3 v3.0.1
 	github.com/ryanuber/go-glob v1.0.0
-	github.com/stretchr/testify v1.8.4
-	go.uber.org/atomic v1.9.0
-	golang.org/x/crypto v0.17.0
-	golang.org/x/net v0.17.0
-	golang.org/x/text v0.14.0
-	google.golang.org/grpc v1.60.1
-	google.golang.org/protobuf v1.31.0
+	github.com/stretchr/testify v1.10.0
+	github.com/tink-crypto/tink-go/v2 v2.2.0
+	go.uber.org/atomic v1.11.0
+	golang.org/x/crypto v0.40.0
+	golang.org/x/net v0.42.0
+	golang.org/x/text v0.27.0
+	google.golang.org/grpc v1.70.0
+	google.golang.org/protobuf v1.36.5
 )
 
 require (
-	cloud.google.com/go/compute v1.23.0 // indirect
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
+)
+
+require (
+	cloud.google.com/go/auth v0.14.1 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
+	cloud.google.com/go/compute/metadata v0.6.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
-	github.com/containerd/containerd v1.7.12 // indirect
+	github.com/Masterminds/semver/v3 v3.3.1 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/armon/go-metrics v0.4.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/distribution v2.8.2+incompatible // indirect
+	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/fatih/color v1.14.1 // indirect
-	github.com/frankban/quicktest v1.11.3 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/frankban/quicktest v1.14.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect
+	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/gofrs/uuid v4.3.0+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/google/s2a-go v0.1.4 // indirect
-	github.com/google/uuid v1.3.1 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
-	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
+	github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
-	github.com/hashicorp/yamux v0.1.1 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.14.0 // indirect
+	github.com/jackc/pgconn v1.14.3
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.2 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
-	github.com/jackc/pgtype v1.14.0 // indirect
-	github.com/jackc/pgx/v4 v4.18.1 // indirect
+	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgtype v1.14.3 // indirect
+	github.com/jackc/pgx/v4 v4.18.3
 	github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 // indirect
-	github.com/klauspost/compress v1.16.5 // indirect
-	github.com/kr/text v0.2.0 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/patternmatcher v0.5.0 // indirect
-	github.com/moby/sys/sequential v0.5.0 // indirect
-	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/oklog/run v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b // indirect
-	github.com/opencontainers/runc v1.1.6 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
+	github.com/petermattis/goid v0.0.0-20250721140440-ea1c0173183e // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/rogpeppe/go-internal v1.8.1 // indirect
+	github.com/prometheus/client_golang v1.20.5 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.55.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/sasha-s/go-deadlock v0.3.5
+	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/stretchr/objx v0.5.0 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/mod v0.11.0 // indirect
-	golang.org/x/oauth2 v0.13.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
-	golang.org/x/term v0.15.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.10.0 // indirect
-	google.golang.org/api v0.134.0 // indirect
-	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 // indirect
-	gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
-	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
+	go.opentelemetry.io/otel v1.35.0 // indirect
+	go.opentelemetry.io/otel/metric v1.35.0 // indirect
+	go.opentelemetry.io/otel/trace v1.35.0 // indirect
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
+	golang.org/x/oauth2 v0.28.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
+	golang.org/x/term v0.33.0 // indirect
+	golang.org/x/time v0.10.0 // indirect
+	google.golang.org/api v0.221.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250207221924-e9438ea467c6 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/sdk/go.sum b/sdk/go.sum
index b2a4f7a2427..46ada1179d3 100644
--- a/sdk/go.sum
+++ b/sdk/go.sum
@@ -1,94 +1,65 @@
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/auth v0.14.1 h1:AwoJbzUdxA/whv1qj3TLKwh3XX5sikny2fc40wUl+h0=
+cloud.google.com/go/auth v0.14.1/go.mod h1:4JHUxlGXisL0AW8kXPtUF6ztuOksyfUQNFjfsOCXkPM=
+cloud.google.com/go/auth/oauth2adapt v0.2.7 h1:/Lc7xODdqcEw8IrZ9SvwnlLX6j9FHQM74z6cBk9Rw6M=
+cloud.google.com/go/auth/oauth2adapt v0.2.7/go.mod h1:NTbTTzfvPl1Y3V1nPpOgl2w6d/FjO7NNUQaWSox6ZMc=
 cloud.google.com/go/cloudsqlconn v1.4.3 h1:/WYFbB1NtMtoMxCbqpzzTFPDkxxlLTPme390KEGaEPc=
 cloud.google.com/go/cloudsqlconn v1.4.3/go.mod h1:QL3tuStVOO70txb3rs4G8j5uMfo5ztZii8K3oGD3VYA=
-cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY=
-cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
-github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8=
-github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
+cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
+cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
-github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
 github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
-github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
-github.com/Microsoft/hcsshim v0.11.4 h1:68vKo2VN8DE9AdN4tnkWnmdhqdbpUFM8OF3Airm7fz8=
+github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
+github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
+github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
+github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJA=
 github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/aws/aws-sdk-go v1.36.29/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
+github.com/bufbuild/protocompile v0.10.0 h1:+jW/wnLMLxaCEG8AX9lD0bQ5v9h1RUiMKOBOT5ll9dM=
+github.com/bufbuild/protocompile v0.10.0/go.mod h1:G9qQIQo0xZ6Uyj6CMNz0saGmx2so+KONo8/KrELABiY=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
-github.com/cenkalti/backoff/v3 v3.2.2 h1:cfUAAO3yvKMYKPrvhDuHSwQnhZNk/RMHKdZqKTxfm6M=
-github.com/cenkalti/backoff/v3 v3.2.2/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
+github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
-github.com/containerd/containerd v1.7.12 h1:+KQsnv4VnzyxWcfO9mlxxELaoztsDEjOuCMPAuPqgU0=
-github.com/containerd/containerd v1.7.12/go.mod h1:/5OMpE1p0ylxtEUGY8kuCYkDRzJm9NO1TFMWjUpdevk=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
@@ -97,76 +68,69 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
-github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM=
-github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
-github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww=
 github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.14.1 h1:qfhVLaG5s+nCROl1zJsZRxFeYrHLqWroPOQ8BWiNb4w=
-github.com/fatih/color v1.14.1/go.mod h1:2oHN61fhTpgcxD3TSWCgKDiH1+x4OiDVVGH8WlgGZGg=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
-github.com/frankban/quicktest v1.11.3 h1:8sXhOn0uLys67V8EsXLc6eszDs8VXWxL3iRvebPhedY=
-github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
-github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/frankban/quicktest v1.14.0 h1:+cqqvzZV87b4adx/5ayVOaYZ2CrvM4ejQvUdBzPPUss=
+github.com/frankban/quicktest v1.14.0/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og=
+github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk=
+github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
+github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-ldap/ldap v3.0.2+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
-github.com/go-ldap/ldap/v3 v3.4.4 h1:qPjipEpt+qDa6SI/h1fzuGWoRUY+qqQ9sOZq67/PYUs=
-github.com/go-ldap/ldap/v3 v3.4.4/go.mod h1:fe1MsuN5eJJ1FeLT/LEBVdWfNWKh459R7aXgXtJC+aI=
+github.com/go-ldap/ldap/v3 v3.4.10 h1:ot/iwPOhfpNVgB1o+AVXljizWZ9JTp7YF5oeyONmcJU=
+github.com/go-ldap/ldap/v3 v3.4.10/go.mod h1:JXh4Uxgi40P6E9rdsYqpUtbW46D9UTjJ9QSwGRznplY=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-test/deep v1.0.2-0.20181118220953-042da051cf31/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
-github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gofrs/uuid v4.3.0+incompatible h1:CaSVZxm5B+7o45rtab4jC2G37WGYX1zQfuU2i6DSvnc=
+github.com/gofrs/uuid v4.3.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
+github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/sqlexp v0.1.0 h1:ZCD6MBpcuOVfGVqsEmY5/4FtYiKz6tSyUv9LPEDei6A=
+github.com/golang-sql/sqlexp v0.1.0/go.mod h1:J4ad9Vo8ZCWQ2GMrC4UCQy1JpCbwU9m3EOqtpKwwwHI=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
@@ -175,128 +139,107 @@ github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvq
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/certificate-transparency-go v1.3.1 h1:akbcTfQg0iZlANZLn0L9xOeWtyCIdeoYhKrqi5iH3Go=
+github.com/google/certificate-transparency-go v1.3.1/go.mod h1:gg+UQlx6caKEDQ9EElFOujyxEQEfOiQzAt6782Bvi8k=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
-github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
-github.com/google/tink/go v1.6.1 h1:t7JHqO8Ath2w2ig5vjwQYJzhGEZymedQc90lQXUBa4I=
-github.com/google/tink/go v1.6.1/go.mod h1:IGW53kTgag+st5yPhKKwJ6u2l+SSp5/v9XF7spovjlY=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.2.5 h1:UR4rDjcgpgEnqpIEvkiqTYKBCKLNmlge2eVjoZfySzM=
-github.com/googleapis/enterprise-certificate-proxy v0.2.5/go.mod h1:RxW0N9901Cko1VOCW3SXCpWP+mlIEkk2tP7jnHy9a3w=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
-github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/hashicorp/cap/ldap v0.0.0-20230914221201-c4eecc7e31f7 h1:jgVdtp5YMn++PxnYhAFfrURfLf+nlqzBeddbvRG+tTg=
-github.com/hashicorp/cap/ldap v0.0.0-20230914221201-c4eecc7e31f7/go.mod h1:q+c9XV1VqloZFZMu+zdvfb0cm7UrvKbvtmTF5wX5Q9o=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
+github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
+github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
+github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
+github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 h1:/c3QmbOGMGTOumP2iT/rCwB7b0QDGLKzqOmktBjT+Is=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1/go.mod h1:5SN9VR2LTsRFsrEC6FHgRbTWrTHu6tqPeKxEQv15giM=
+github.com/hashicorp/cap/ldap v0.0.0-20250911140431-44d01434c285 h1:vwg2CDaWTJJkr+5ivc2KUYx877gPAUEgq5QIPA/bKjw=
+github.com/hashicorp/cap/ldap v0.0.0-20250911140431-44d01434c285/go.mod h1:La1zaRmx2oqz79W9SpwQAPMfDUdBxZeoN2IaAQ8D4ow=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
-github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v0.0.0-20180709165350-ff2cf002a8dd/go.mod h1:9bjs9uLqI8l75knNv3lV1kA55veR+WUPSiKIWcQHudI=
-github.com/hashicorp/go-hclog v0.8.0/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
-github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
-github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6 h1:kBoJV4Xl5FLtBfnBjDvBxeNSy2IRITSGs73HQsFUEjY=
+github.com/hashicorp/go-hmac-drbg v0.0.0-20210916214228-a6e5a68489f6/go.mod h1:y+HSOcOGB48PkUxNyLAiCiY6rEENu+E+Ss4LG8QHwf4=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.0 h1:pSjQfW3vPtrOTcasTUKgCTQT7OGPPTTMVRrOfU6FJD8=
-github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.0/go.mod h1:xvb32K2keAc+R8DSFG2IwDcydK9DBQE+fGA5fsw6hSk=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.8 h1:9Q2lu1YbbmiAgvYZ7Pr31RdlVonUpX+mmDL7Z7qTA2U=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.8/go.mod h1:qTCjxGig/kjuj3hk1z8pOUrzbse/GxB1tGfbrq8tGJg=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.1 h1:KIge4FHZEDb2/xjaWgmBheCTgRL6HV4sgTfDsH876L8=
+github.com/hashicorp/go-kms-wrapping/entropy/v2 v2.0.1/go.mod h1:aHO1EoFD0kBYLBedqxXgalfFT8lrWfP7kpuSoaqGjH0=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.18 h1:DLfC677GfKEpSAFpEWvl1vXsGpEcSHmbhBaPLrdDQHc=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.18/go.mod h1:t/eaR/mi2mw3klfl1WEAuiLKrlZ/Q8cosmsT+RIPLu0=
+github.com/hashicorp/go-metrics v0.5.4 h1:8mmPiIJkTPPEbAiV97IxdAGNdRdaWwVap1BU6elejKY=
+github.com/hashicorp/go-metrics v0.5.4/go.mod h1:CG5yz4NZ/AI/aQt9Ucm/vdBnbh7fvmv4lxZ350i+QQI=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
-github.com/hashicorp/go-plugin v1.6.0 h1:wgd4KxHJTVGGqWBq4QPB1i5BZNEx9BR8+OFmHDmTk8A=
-github.com/hashicorp/go-plugin v1.6.0/go.mod h1:lBS5MtSSBZk0SHc66KACcjjlU6WzEVP/8pwz68aMkCI=
+github.com/hashicorp/go-plugin v1.6.1 h1:P7MR2UP6gNKGPp+y7EZw2kOiq4IR9WiqLvp0XOsVdwI=
+github.com/hashicorp/go-plugin v1.6.1/go.mod h1:XPHFku2tFo3o3QKFgSYo+cghcUhw1NA1hZyMK0PWAw0=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
-github.com/hashicorp/go-retryablehttp v0.5.4/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
-github.com/hashicorp/go-retryablehttp v0.7.1 h1:sUiuQAnLlbvmExtFQs72iFW/HXeUn8Z1aJLQ4LJJbTQ=
-github.com/hashicorp/go-retryablehttp v0.7.1/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
-github.com/hashicorp/go-rootcerts v1.0.1/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
-github.com/hashicorp/go-secure-stdlib/mlock v0.1.2 h1:p4AKXPPS24tO8Wc8i1gLvSKdmkiSY5xuju57czJ/IJQ=
-github.com/hashicorp/go-secure-stdlib/mlock v0.1.2/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/password v0.1.1 h1:6JzmBqXprakgFEHwBgdchsjaA9x3GyjdI568bXKxa60=
-github.com/hashicorp/go-secure-stdlib/password v0.1.1/go.mod h1:9hH302QllNwu1o2TGYtSk8I8kTAN0ca1EHpwhm5Mmzo=
-github.com/hashicorp/go-secure-stdlib/plugincontainer v0.3.0 h1:KMWpBsC65ZBXDpoxJ0n2/zVfZaZIW73k2d8cy5Dv/Kk=
-github.com/hashicorp/go-secure-stdlib/plugincontainer v0.3.0/go.mod h1:qKYwSZ2EOpppko5ud+Sh9TrUgiTAZSaQCr8XWIYXsbM=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.1 h1:VaLXp47MqD1Y2K6QVrA9RooQiPyCgAbnfeJg44wKuJk=
+github.com/hashicorp/go-secure-stdlib/cryptoutil v0.1.1/go.mod h1:hH8rgXHh9fPSDPerG6WzABHsHF+9ZpLhRI1LPk4JZ8c=
+github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 h1:kH3Rhiht36xhAfhuHyWJDgdXXEx9IIZhDGRk24CDhzg=
+github.com/hashicorp/go-secure-stdlib/mlock v0.1.3/go.mod h1:ov1Q0oEDjC3+A4BwsG2YdKltrmEw8sf9Pau4V9JQ4Vo=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
+github.com/hashicorp/go-secure-stdlib/password v0.1.4 h1:h8gOB6qDRlOMvoMHOqtf4oTdB+goC/hWX0+TXA+VltI=
+github.com/hashicorp/go-secure-stdlib/password v0.1.4/go.mod h1:DeLx56RZZdmwX8Q94fVQUetkXv6zVBfDtGAPJDh69AU=
+github.com/hashicorp/go-secure-stdlib/permitpool v1.0.0 h1:U6y5MXGiDVOOtkWJ6o/tu1TxABnI0yKTQWJr7z6BpNk=
+github.com/hashicorp/go-secure-stdlib/permitpool v1.0.0/go.mod h1:ecDb3o+8D4xtP0nTCufJaAVawHavy5M2eZ64Nq/8/LM=
+github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.2 h1:gCNiM4T5xEc4IpT8vM50CIO+AtElr5kO9l2Rxbq+Sz8=
+github.com/hashicorp/go-secure-stdlib/plugincontainer v0.4.2/go.mod h1:6ZM4ZdwClyAsiU2uDBmRHCvq0If/03BMbF9U+U7G5pA=
+github.com/hashicorp/go-secure-stdlib/regexp v1.0.0 h1:08mz6j5MsCG9sf8tvC8Lhboe/ZMiNg41IPSh6unK5T4=
+github.com/hashicorp/go-secure-stdlib/regexp v1.0.0/go.mod h1:n/Gj3sYIEEOYds8uKS55bFf7XiYvWN4e+d+UOA7r/YU=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 h1:phcbL8urUzF/kxA/Oj6awENaRwfWsjP59GW7u2qlDyY=
-github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2/go.mod h1:l8slYwnJA26yBz+ErHpp2IRCLr0vuOMGBORIz4rRiAs=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 h1:xbrxd0U9XQW8qL1BAz2XrAjAF/P2vcqUTAues9c24B8=
+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3/go.mod h1:LWq2Sy8UoKKuK4lFuCNWSjJj57MhNNf2zzBWMtkAIX4=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-uuid v1.0.1/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.1.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
-github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
+github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/hcl v1.0.1-vault-5 h1:kI3hhbbyzr4dldA8UdTb7ZlVVlI2DACdCfz31RPDgJM=
-github.com/hashicorp/hcl v1.0.1-vault-5/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
-github.com/hashicorp/vault/api v1.0.4/go.mod h1:gDcqh3WGcR1cpF5AJz/B1UFheUEneMoIospckxBxk6Q=
-github.com/hashicorp/vault/api v1.9.1 h1:LtY/I16+5jVGU8rufyyAkwopgq/HpUnxFBg+QLOAV38=
-github.com/hashicorp/vault/api v1.9.1/go.mod h1:78kktNcQYbBGSrOjQfHjXN32OhhxXnbYl3zxpd2uPUs=
-github.com/hashicorp/vault/sdk v0.1.13/go.mod h1:B+hVj7TpuQY1Y/GPbCpffmgd+tSEwvhkWnjtSYCaS2M=
-github.com/hashicorp/yamux v0.0.0-20180604194846-3520598351bb/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
-github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
-github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
-github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
+github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/vault/api v1.16.0 h1:nbEYGJiAPGzT9U4oWgaaB0g+Rj8E59QuHKyA5LhwQN4=
+github.com/hashicorp/vault/api v1.16.0/go.mod h1:KhuUhzOD8lDSk29AtzNjgAu2kxRA9jL9NAbkFlqvkBA=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
 github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
 github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
@@ -307,8 +250,8 @@ github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsU
 github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
 github.com/jackc/pgconn v1.9.0/go.mod h1:YctiPyvzfU11JFxoXokUOOKQXQmDMoJL9vJzHH8/2JY=
 github.com/jackc/pgconn v1.9.1-0.20210724152538-d89c8390a530/go.mod h1:4z2w8XhRbP1hYxkpTuBjTS3ne3J48K83+u0zoyvg2pI=
-github.com/jackc/pgconn v1.14.0 h1:vrbA9Ud87g6JdFWkHTJXppVce58qPIdP7N8y0Ml/A7Q=
-github.com/jackc/pgconn v1.14.0/go.mod h1:9mBNlny0UvkgJdCDvdVHYSjI+8tD2rnKK69Wz8ti++E=
+github.com/jackc/pgconn v1.14.3 h1:bVoTr12EGANZz66nZPkMInAV/KHD2TxH9npjXXgiB3w=
+github.com/jackc/pgconn v1.14.3/go.mod h1:RZbme4uasqzybK2RK5c65VsHxoyaml09lx3tXOcO/VM=
 github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
 github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
 github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
@@ -324,50 +267,70 @@ github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvW
 github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
 github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.1.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.3.2 h1:7eY55bdBeCz1F2fTzSz69QC+pG46jYq9/jtSPiJ5nn0=
-github.com/jackc/pgproto3/v2 v2.3.2/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.3.3 h1:1HLSx5H+tXR9pW3in3zaztoEwQYRC9SQaYUHjTSUOag=
+github.com/jackc/pgproto3/v2 v2.3.3/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
-github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
 github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
 github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
 github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
 github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
 github.com/jackc/pgtype v1.8.1-0.20210724151600-32e20a603178/go.mod h1:C516IlIV9NKqfsMCXTdChteoXmwgUceqaLfjg2e3NlM=
-github.com/jackc/pgtype v1.14.0 h1:y+xUdabmyMkJLyApYuPj38mW+aAIqCe5uuBB51rH3Vw=
 github.com/jackc/pgtype v1.14.0/go.mod h1:LUMuVrfsFfdKGLw+AFFVv6KtHOFMwRgDDzBt76IqCA4=
+github.com/jackc/pgtype v1.14.3 h1:h6W9cPuHsRWQFTWUZMAKMgG5jSwQI0Zurzdvlx3Plus=
+github.com/jackc/pgtype v1.14.3/go.mod h1:aKeozOde08iifGosdJpz9MBZonJOUJxqNpPBcMJTlVA=
 github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
 github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
 github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
 github.com/jackc/pgx/v4 v4.12.1-0.20210724153913-640aa07df17c/go.mod h1:1QD0+tgSXP7iUjYm9C1NxKhny7lq6ee99u/z+IHFcgs=
-github.com/jackc/pgx/v4 v4.18.1 h1:YP7G1KABtKpB5IHrO9vYwSrCOhs7p3uqhvhhQBptya0=
-github.com/jackc/pgx/v4 v4.18.1/go.mod h1:FydWkUyadDmdNH/mHnGob881GawxeEm7TcMCzkb+qQE=
+github.com/jackc/pgx/v4 v4.18.2/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
+github.com/jackc/pgx/v4 v4.18.3 h1:dE2/TrEsGX3RBprb3qryqSV9Y60iZN1C6i8IrmW9/BA=
+github.com/jackc/pgx/v4 v4.18.3/go.mod h1:Ey4Oru5tH5sB6tV7hDmfWFahwF15Eb7DNXlRKx2CkVw=
 github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.3.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
+github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
+github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
+github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
+github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
+github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
-github.com/jimlambrt/gldap v0.1.4 h1:PoB5u4ND0E+6W99JtQJvcjGFw+iKi3Gx3M60oOJBOqE=
-github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
-github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/jhump/protoreflect v1.16.0 h1:54fZg+49widqXYQ0b+usAFHbMkBGR4PpXrsHc8+TBDg=
+github.com/jhump/protoreflect v1.16.0/go.mod h1:oYPd7nPvcBw/5wlDfm/AVmU9zH9BgqGCI469pGxfj/8=
+github.com/jimlambrt/gldap v0.1.13 h1:jxmVQn0lfmFbM9jglueoau5LLF/IGRti0SKf0vB753M=
+github.com/jimlambrt/gldap v0.1.13/go.mod h1:nlC30c7xVphjImg6etk7vg7ZewHCCvl1dfAhO3ZJzPg=
 github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531 h1:hgVxRoDDPtQE68PT4LFvNlPz2nBKd3OMlGKIQ69OmR4=
 github.com/joshlf/go-acl v0.0.0-20200411065538-eae00ae38531/go.mod h1:fqTUQpVYBvhCNIsMXGl2GE9q6z94DIP6NtFKXCSTVbg=
 github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d h1:J8tJzRyiddAFF65YVgxli+TyWBi0f79Sld6rJP6CBcY=
+github.com/joshlf/testutil v0.0.0-20170608050642-b5d8aa79d93d/go.mod h1:b+Q3v8Yrg5o15d71PSUraUzYb+jWl6wQMSBXSGS/hv0=
+github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
-github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
@@ -376,71 +339,73 @@ github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.10.2 h1:AqzbZs4ZoCBp+GtejcpCpcxM3zlSMx29dXbUSeVtJb8=
 github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
-github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/microsoft/go-mssqldb v1.5.0 h1:CgENxkwtOBNj3Jg6T1X209y2blCfTTcwuOlznd2k9fk=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
-github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
+github.com/microsoft/go-mssqldb v1.5.0/go.mod h1:lmWsjHD8XX/Txr0f8ZqgbEZSC+BZjmEQy/Ms+rLrvho=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
-github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
 github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
 github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/moby/patternmatcher v0.5.0 h1:YCZgJOeULcxLw1Q+sVR636pmS7sPEn1Qo2iAN6M7DBo=
-github.com/moby/patternmatcher v0.5.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5lXtc=
-github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
+github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
+github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
+github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
-github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b h1:YWuSjZCQAPM8UUBLkYUk1e+rZcvWHJmFb6i6rM44Xs8=
-github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b/go.mod h1:3OVijpioIKYWTqjiG0zfF6wvoJ4fAXGbjdZuI2NgsRQ=
-github.com/opencontainers/runc v1.1.6 h1:XbhB8IfG/EsnhNvZtNdLB0GBw92GYEFvKlhaJk9jUgA=
-github.com/opencontainers/runc v1.1.6/go.mod h1:CbUumNnWCuTGFukNXahoo/RFBZvDAgRh/smNYNOhA50=
+github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
+github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
-github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
+github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
+github.com/petermattis/goid v0.0.0-20250721140440-ea1c0173183e h1:D0bJD+4O3G4izvrQUmzCL80zazlN7EwJ0PPDhpJWC/I=
+github.com/petermattis/goid v0.0.0-20250721140440-ea1c0173183e/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/pierrec/lz4 v2.6.1+incompatible h1:9UY3+iC23yxF0UfGaYrGplQ+79Rg+h/q9FV9ix19jjM=
 github.com/pierrec/lz4 v2.6.1+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -448,77 +413,109 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
+github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
+github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
+github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
+github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
+github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
+github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
+github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
+github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
+github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
+github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.8.1 h1:geMPLpDpQOgVyCg5z5GoRwLHepNdb71NXb67XFkP+Eg=
-github.com/rogpeppe/go-internal v1.8.1/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4nPKWu0nJ5d+o=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
 github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
 github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/sasha-s/go-deadlock v0.3.5 h1:tNCOEEDG6tBqrNDOX35j/7hL5FcFViG6awUGROb2NsU=
+github.com/sasha-s/go-deadlock v0.3.5/go.mod h1:bugP6EGbdGYObIlx7pUZtWqlvo8k9H6vCBBsiChJQ5U=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
-github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
+github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/tink-crypto/tink-go/v2 v2.2.0 h1:L2Da0F2Udh2agtKztdr69mV/KpnY3/lGTkMgLTVIXlA=
+github.com/tink-crypto/tink-go/v2 v2.2.0/go.mod h1:JJ6PomeNPF3cJpfWC0lgyTES6zpJILkAX0cJNwlS3xU=
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
+go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
+go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.24.0 h1:t6wl9SPayj+c7lEIFgm4ooDBZVb01IhLB4InpomhRw8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.24.0/go.mod h1:iSDOcsnSA5INXzZtwaBPrKp/lWu/V14Dd+llD0oI2EA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0 h1:umZgi92IyxfXd/l4kaDhnKgY8rnN/cZcF1LKc6I8OQ8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.30.0/go.mod h1:4lVs6obhSVRb1EW5FhOuBTyiQhtRtAnnva9vD3yRfq8=
+go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
+go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
+go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
+go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0 h1:rZvFnvmvawYb0alrYkjraqJq0Z4ZUJAiyYCU9snn1CU=
+go.opentelemetry.io/otel/sdk/metric v1.32.0/go.mod h1:PWeZlq0zt9YkYAp3gjKZ0eicRYvOh1Gd+X99x6GHpCQ=
+go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
+go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
+go.opentelemetry.io/proto/otlp v1.1.0 h1:2Di21piLrCqJ3U3eXGCTPHE9R8Nh+0uglSnOyxikMeI=
+go.opentelemetry.io/proto/otlp v1.1.0/go.mod h1:GpBHCBWiqvVLDqmHZsoMM3C5ySeKTC7ej/RNTae6MdY=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
-go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
-go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
@@ -530,53 +527,37 @@ golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnf
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU=
-golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -584,94 +565,65 @@ golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.13.0 h1:jDDenyj+WgFtmV3zYVoi8aE2BwtXFLWOA67ZfNWftiY=
-golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
+golang.org/x/oauth2 v0.28.0 h1:CrgCKl8PPAVtLnU3c+EDw6x11699EWlsDeWNWKdIOkc=
+golang.org/x/oauth2 v0.28.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -680,175 +632,87 @@ golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
+golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg=
+golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20181227161524-e6919f6577db/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
+golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.10.0 h1:tvDr/iQoUqNdohiYm0LmmKcBk+q86lb9EprIUFhHHGg=
-golang.org/x/tools v0.10.0/go.mod h1:UJwyiVBsOA2uwvK/e5OY3GTpDUJriEd+/YlqAwLPmyM=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.32.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.134.0 h1:ktL4Goua+UBgoP1eL1/60LwZJqa1sIzkLmvoR3hR6Gw=
-google.golang.org/api v0.134.0/go.mod h1:sjRL3UnjTx5UqNQS9EWr9N8p7xbHpy1k0XGRLCf3Spk=
+google.golang.org/api v0.221.0 h1:qzaJfLhDsbMeFee8zBRdt/Nc+xmOuafD/dbdgGfutOU=
+google.golang.org/api v0.221.0/go.mod h1:7sOU2+TL4TxUTdbi0gWgAIg7tH5qBXxoyhtL+9x3biQ=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
-google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190404172233-64821d5d2107/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b h1:+YaDE2r2OG8t/z5qmsh7Y+XXwCbvadxxZ0YY6mTdrVA=
-google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97 h1:W18sezcAYs+3tDZX4F80yctqa12jcP1PUS2gQu1zTPU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 h1:AB/lmRny7e2pLhFEYIbl5qkDAUt2h0ZRO4wGPhZf+ik=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405/go.mod h1:67X1fPuzjcrkymZzZV1vvkFeTn2Rvc6lYF9MYFGCcwE=
-google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
+google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 h1:ToEetK57OidYuqD4Q5w+vfEnPvPpuTwedCNVohYJfNk=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 h1:CkkIfIt50+lT6NHAVoRYEyAvQGFM7xEwXUUywFvEb3Q=
+google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576/go.mod h1:1R3kvZ1dtP3+4p4d3G8uJ8rFk/fWlScl38vanWACI08=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250207221924-e9438ea467c6 h1:2duwAxN2+k0xLNpjnHTXoMUgnv6VPSp5fiqTuwSxjmI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250207221924-e9438ea467c6/go.mod h1:8BS3B93F/U1juMFq9+EDk+qOT5CO1R9IzXxG3PTqiRk=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.22.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.60.1 h1:26+wFr+cNqSGFcOXcabYC0lUVJVRa2Sb2ortSK7VrEU=
-google.golang.org/grpc v1.60.1/go.mod h1:OlCHIeLYqSSsLi6i49B5QGdzaMZK9+M7LXN2FKz4eGM=
+google.golang.org/grpc v1.70.0 h1:pWFv03aZoHzlRKHWicjsZytKAiYCtNS0dHbXnIdq7jQ=
+google.golang.org/grpc v1.70.0/go.mod h1:ofIJqVKDXx/JiXrwr2IG4/zwdH9txy3IlF40RmcJSQw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -857,41 +721,28 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
-gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d/go.mod h1:cuepJuh7vyXfUyUwEgHQXw849cJrilpS5NeIjOWESAw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
-gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
-gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
-gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
-gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gotest.tools/v3 v3.5.0 h1:Ljk6PdHdOhAb5aDMWXjDLMMhph+BpztA4v1QdqEW2eY=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
diff --git a/sdk/helper/authmetadata/auth_metadata.go b/sdk/helper/authmetadata/auth_metadata.go
index e490ab359ab..b169cffaa69 100644
--- a/sdk/helper/authmetadata/auth_metadata.go
+++ b/sdk/helper/authmetadata/auth_metadata.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package authmetadata
diff --git a/sdk/helper/authmetadata/auth_metadata_acc_test.go b/sdk/helper/authmetadata/auth_metadata_acc_test.go
index 189c960098d..0f978d75767 100644
--- a/sdk/helper/authmetadata/auth_metadata_acc_test.go
+++ b/sdk/helper/authmetadata/auth_metadata_acc_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package authmetadata
diff --git a/sdk/helper/authmetadata/auth_metadata_test.go b/sdk/helper/authmetadata/auth_metadata_test.go
index a82044f9bc4..b04dc769df9 100644
--- a/sdk/helper/authmetadata/auth_metadata_test.go
+++ b/sdk/helper/authmetadata/auth_metadata_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package authmetadata
diff --git a/sdk/helper/automatedrotationutil/fields.go b/sdk/helper/automatedrotationutil/fields.go
new file mode 100644
index 00000000000..d5513124fe1
--- /dev/null
+++ b/sdk/helper/automatedrotationutil/fields.go
@@ -0,0 +1,150 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package automatedrotationutil
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/rotation"
+)
+
+var (
+	ErrRotationMutuallyExclusiveFields = errors.New("mutually exclusive fields rotation_schedule and rotation_period were both specified; only one of them can be provided")
+	ErrRotationManagerUnsupported      = errors.New("rotation manager capabilities not supported in Vault community edition")
+)
+
+// AutomatedRotationParams contains a set of common parameters that plugins
+// can use for setting automated credential rotation.
+type AutomatedRotationParams struct {
+	// RotationSchedule is the CRON-style rotation schedule.
+	RotationSchedule string `json:"rotation_schedule"`
+	// RotationWindow specifies the amount of time in which the rotation is allowed to
+	// occur starting from a given rotation_schedule.
+	RotationWindow time.Duration `json:"rotation_window"`
+	// RotationPeriod is an alternate choice for simple time-to-live based rotation timing.
+	RotationPeriod time.Duration `json:"rotation_period"`
+
+	// If set, will deregister all registered rotation jobs from the RotationManager for plugin.
+	DisableAutomatedRotation bool `json:"disable_automated_rotation"`
+}
+
+// ParseAutomatedRotationFields provides common field parsing to embedding structs.
+func (p *AutomatedRotationParams) ParseAutomatedRotationFields(d *framework.FieldData) error {
+	rotationScheduleRaw, scheduleOk := d.GetOk("rotation_schedule")
+	rotationWindowSecondsRaw, windowOk := d.GetOk("rotation_window")
+	rotationPeriodSecondsRaw, periodOk := d.GetOk("rotation_period")
+	disableRotation, disableRotationOk := d.GetOk("disable_automated_rotation")
+
+	if scheduleOk {
+		if periodOk && rotationPeriodSecondsRaw.(int) != 0 && rotationScheduleRaw.(string) != "" {
+			return ErrRotationMutuallyExclusiveFields
+		}
+		p.RotationSchedule = rotationScheduleRaw.(string)
+
+		// parse schedule to ensure it is valid
+		if p.RotationSchedule != "" {
+			_, err := rotation.DefaultScheduler.Parse(p.RotationSchedule)
+			if err != nil {
+				return fmt.Errorf("failed to parse provided rotation_schedule: %w", err)
+			}
+		}
+	}
+
+	if windowOk {
+		if periodOk && rotationPeriodSecondsRaw.(int) != 0 && rotationWindowSecondsRaw.(int) != 0 {
+			return fmt.Errorf("rotation_window does not apply to period")
+		}
+		rotationWindowSeconds := rotationWindowSecondsRaw.(int)
+		p.RotationWindow = time.Duration(rotationWindowSeconds) * time.Second
+	}
+
+	if periodOk {
+		rotationPeriodSeconds := rotationPeriodSecondsRaw.(int)
+		p.RotationPeriod = time.Duration(rotationPeriodSeconds) * time.Second
+	}
+
+	if (windowOk && rotationWindowSecondsRaw.(int) != 0) && !scheduleOk {
+		return fmt.Errorf("cannot use rotation_window without rotation_schedule")
+	}
+
+	if disableRotationOk {
+		p.DisableAutomatedRotation = disableRotation.(bool)
+	}
+
+	return nil
+}
+
+// PopulateAutomatedRotationData adds PluginIdentityTokenParams info into the given map.
+func (p *AutomatedRotationParams) PopulateAutomatedRotationData(m map[string]interface{}) {
+	m["rotation_schedule"] = p.RotationSchedule
+	m["rotation_window"] = p.RotationWindow.Seconds()
+	m["rotation_period"] = p.RotationPeriod.Seconds()
+	m["disable_automated_rotation"] = p.DisableAutomatedRotation
+}
+
+func (p *AutomatedRotationParams) ShouldRegisterRotationJob() bool {
+	return p.HasNonzeroRotationValues()
+}
+
+func (p *AutomatedRotationParams) ShouldDeregisterRotationJob() bool {
+	return p.DisableAutomatedRotation || (p.RotationSchedule == "" && p.RotationPeriod == 0)
+}
+
+// HasNonzeroRotationValues returns true if either of the primary rotation values (RotationSchedule or RotationPeriod)
+// are not the zero value.
+func (p *AutomatedRotationParams) HasNonzeroRotationValues() bool {
+	return p.RotationSchedule != "" || p.RotationPeriod != 0
+}
+
+// AddAutomatedRotationFieldsWithGroup adds rotation fields to the given field schema map
+// the fields are associated to the provided display attribute group
+func AddAutomatedRotationFieldsWithGroup(m map[string]*framework.FieldSchema, group string) {
+	fields := map[string]*framework.FieldSchema{
+		"rotation_schedule": {
+			Type:        framework.TypeString,
+			Description: "CRON-style string that will define the schedule on which rotations should occur. Mutually exclusive with rotation_period",
+			DisplayAttrs: &framework.DisplayAttributes{
+				Group: group,
+			},
+		},
+		"rotation_window": {
+			Type:        framework.TypeDurationSecond,
+			Description: "Specifies the amount of time in which the rotation is allowed to occur starting from a given rotation_schedule",
+			DisplayAttrs: &framework.DisplayAttributes{
+				Group: group,
+			},
+		},
+		"rotation_period": {
+			Type:        framework.TypeDurationSecond,
+			Description: "TTL for automatic credential rotation of the given username. Mutually exclusive with rotation_schedule",
+			DisplayAttrs: &framework.DisplayAttributes{
+				Group: group,
+			},
+		},
+		"disable_automated_rotation": {
+			Type:        framework.TypeBool,
+			Description: "If set to true, will deregister all registered rotation jobs from the RotationManager for the plugin.",
+			DisplayAttrs: &framework.DisplayAttributes{
+				Group: group,
+			},
+		},
+	}
+
+	for name, schema := range fields {
+		if _, ok := m[name]; ok {
+			panic(fmt.Sprintf("adding field %q would overwrite existing field", name))
+		}
+		m[name] = schema
+	}
+}
+
+// stubbing original function for compatibility
+// AddAutomatedRotationFieldsWithGroup should be used directly
+// future utils that define fields should include a group parameter
+func AddAutomatedRotationFields(m map[string]*framework.FieldSchema) {
+	AddAutomatedRotationFieldsWithGroup(m, "default")
+}
diff --git a/sdk/helper/automatedrotationutil/fields_test.go b/sdk/helper/automatedrotationutil/fields_test.go
new file mode 100644
index 00000000000..bd9cd515c91
--- /dev/null
+++ b/sdk/helper/automatedrotationutil/fields_test.go
@@ -0,0 +1,438 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package automatedrotationutil
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/stretchr/testify/assert"
+)
+
+var schemaMap = map[string]*framework.FieldSchema{
+	"rotation_schedule": {
+		Type:        framework.TypeString,
+		Description: "CRON-style string that will define the schedule on which rotations should occur. Mutually exclusive with rotation_period",
+		DisplayAttrs: &framework.DisplayAttributes{
+			Group: "default",
+		},
+	},
+	"rotation_window": {
+		Type:        framework.TypeDurationSecond,
+		Description: "Specifies the amount of time in which the rotation is allowed to occur starting from a given rotation_schedule",
+		DisplayAttrs: &framework.DisplayAttributes{
+			Group: "default",
+		},
+	},
+	"rotation_period": {
+		Type:        framework.TypeDurationSecond,
+		Description: "TTL for automatic credential rotation of the given username. Mutually exclusive with rotation_schedule",
+		DisplayAttrs: &framework.DisplayAttributes{
+			Group: "default",
+		},
+	},
+	"disable_automated_rotation": {
+		Type:        framework.TypeBool,
+		Description: "If set to true, will deregister all registered rotation jobs from the RotationManager for the plugin.",
+		DisplayAttrs: &framework.DisplayAttributes{
+			Group: "default",
+		},
+	},
+}
+
+func TestParseAutomatedRotationFields(t *testing.T) {
+	tests := []struct {
+		name           string
+		data           *framework.FieldData
+		expectedParams *AutomatedRotationParams
+		initialParams  *AutomatedRotationParams
+		expectedError  string
+	}{
+		{
+			name: "basic",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_schedule": "*/15 * * * *",
+					"rotation_window":   60,
+				},
+				Schema: schemaMap,
+			},
+			expectedParams: &AutomatedRotationParams{
+				RotationSchedule:         "*/15 * * * *",
+				RotationWindow:           60 * time.Second,
+				RotationPeriod:           0,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name: "mutually-exclusive",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_schedule": "*/15 * * * *",
+					"rotation_period":   15,
+					"rotation_window":   60,
+				},
+				Schema: schemaMap,
+			},
+			expectedError: ErrRotationMutuallyExclusiveFields.Error(),
+		},
+		{
+			name: "bad-schedule",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_schedule": "random string",
+				},
+				Schema: schemaMap,
+			},
+			expectedError: "failed to parse provided rotation_schedule",
+		},
+		{
+			name: "incompatible-fields",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_period": 15,
+					"rotation_window": 60,
+				},
+				Schema: schemaMap,
+			},
+			expectedError: "rotation_window does not apply to period",
+		},
+		{
+			name: "window-without-schedule",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_window": 60,
+				},
+				Schema: schemaMap,
+			},
+			expectedError: "cannot use rotation_window without rotation_schedule",
+		},
+		{
+			name: "rotation-period-duration-seconds",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_period": "2m",
+				},
+				Schema: schemaMap,
+			},
+			expectedParams: &AutomatedRotationParams{
+				RotationSchedule:         "",
+				RotationWindow:           0,
+				RotationPeriod:           120 * time.Second,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name: "rotation-window-duration-seconds",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_window":   "12h",
+					"rotation_schedule": "* */2 * * *",
+				},
+				Schema: schemaMap,
+			},
+			expectedParams: &AutomatedRotationParams{
+				RotationSchedule:         "* */2 * * *",
+				RotationWindow:           12 * time.Hour,
+				RotationPeriod:           0,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name: "period-and-window-ok",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_window": 0,
+					"rotation_period": 10,
+				},
+				Schema: schemaMap,
+			},
+			expectedParams: &AutomatedRotationParams{
+				RotationSchedule:         "",
+				RotationWindow:           0,
+				RotationPeriod:           10 * time.Second,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name: "period-and-window-ok-strings",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_schedule": "* */2 * * *",
+					"rotation_window":   "5h",
+					"rotation_period":   "",
+				},
+				Schema: schemaMap,
+			},
+			expectedParams: &AutomatedRotationParams{
+				RotationSchedule:         "* */2 * * *",
+				RotationWindow:           5 * time.Hour,
+				RotationPeriod:           0,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name: "period-and-schedule-ok",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_schedule": "",
+					"rotation_window":   "",
+					"rotation_period":   "2m",
+				},
+				Schema: schemaMap,
+			},
+			expectedParams: &AutomatedRotationParams{
+				RotationSchedule:         "",
+				RotationWindow:           0,
+				RotationPeriod:           2 * time.Minute,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name: "zero-out-schedule-and-window-set-period",
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"rotation_schedule": "",
+					"rotation_window":   "",
+					"rotation_period":   "2m",
+				},
+				Schema: schemaMap,
+			},
+			expectedParams: &AutomatedRotationParams{
+				RotationSchedule:         "",
+				RotationWindow:           0,
+				RotationPeriod:           2 * time.Minute,
+				DisableAutomatedRotation: false,
+			},
+			initialParams: &AutomatedRotationParams{
+				RotationSchedule:         "*/1 * * * *",
+				RotationWindow:           30 * time.Second,
+				RotationPeriod:           0,
+				DisableAutomatedRotation: false,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			p := &AutomatedRotationParams{}
+			if tt.initialParams != nil {
+				p = tt.initialParams
+			}
+			err := p.ParseAutomatedRotationFields(tt.data)
+			if err != nil {
+				if tt.expectedError == "" {
+					t.Errorf("expected no error but received an error: %s", err)
+				}
+				if !strings.Contains(err.Error(), tt.expectedError) {
+					t.Errorf("ParseAutomatedRotationFields() error = %v, expected %s", err, tt.expectedError)
+				}
+			}
+
+			if err == nil && !reflect.DeepEqual(tt.expectedParams, p) {
+				t.Errorf("ParseAutomatedRotationFields() error comparing params; got %v, expected %v", p, tt.expectedParams)
+			}
+		})
+	}
+}
+
+func TestPopulateAutomatedRotationData(t *testing.T) {
+	tests := []struct {
+		name        string
+		inputParams *AutomatedRotationParams
+		expected    map[string]interface{}
+	}{
+		{
+			name: "basic",
+			expected: map[string]interface{}{
+				"rotation_schedule":          "*/15 * * * *",
+				"rotation_window":            time.Duration(60).Seconds(),
+				"rotation_period":            time.Duration(0).Seconds(),
+				"disable_automated_rotation": false,
+			},
+			inputParams: &AutomatedRotationParams{
+				RotationSchedule:         "*/15 * * * *",
+				RotationWindow:           60,
+				RotationPeriod:           0,
+				DisableAutomatedRotation: false,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			m := make(map[string]interface{})
+
+			tt.inputParams.PopulateAutomatedRotationData(m)
+
+			if !reflect.DeepEqual(m, tt.expected) {
+				t.Errorf("PopulateAutomatedRotationData() error comparing values; got %v, expected %v", m, tt.expected)
+			}
+		})
+	}
+}
+
+func TestShouldRegisterRotationJob(t *testing.T) {
+	tests := []struct {
+		name        string
+		inputParams *AutomatedRotationParams
+		expected    bool
+	}{
+		{
+			name:     "false",
+			expected: false,
+			inputParams: &AutomatedRotationParams{
+				RotationSchedule:         "",
+				RotationWindow:           60,
+				RotationPeriod:           0,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name:     "true-schedule",
+			expected: true,
+			inputParams: &AutomatedRotationParams{
+				RotationSchedule:         "*/15 * * * *",
+				RotationWindow:           0,
+				RotationPeriod:           0,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name:     "true-period",
+			expected: true,
+			inputParams: &AutomatedRotationParams{
+				RotationSchedule:         "",
+				RotationWindow:           0,
+				RotationPeriod:           5,
+				DisableAutomatedRotation: false,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			out := tt.inputParams.ShouldRegisterRotationJob()
+			if out != tt.expected {
+				t.Errorf("ShouldRegisterRotationJob() output = %v, expected: %v", out, tt.expected)
+			}
+		})
+	}
+}
+
+func TestShouldDeregisterRotationJob(t *testing.T) {
+	tests := []struct {
+		name        string
+		inputParams *AutomatedRotationParams
+		expected    bool
+	}{
+		{
+			name:     "zero out schedule and period",
+			expected: true,
+			inputParams: &AutomatedRotationParams{
+				RotationSchedule:         "",
+				RotationWindow:           60,
+				RotationPeriod:           0,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name:     "false-schedule set",
+			expected: false,
+			inputParams: &AutomatedRotationParams{
+				RotationSchedule:         "*/15 * * * *",
+				RotationWindow:           0,
+				RotationPeriod:           0,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name:     "false-period set",
+			expected: false,
+			inputParams: &AutomatedRotationParams{
+				RotationSchedule:         "",
+				RotationWindow:           0,
+				RotationPeriod:           5,
+				DisableAutomatedRotation: false,
+			},
+		},
+		{
+			name:     "true-disable set",
+			expected: true,
+			inputParams: &AutomatedRotationParams{
+				RotationSchedule:         "*/15 * * * *",
+				RotationWindow:           0,
+				RotationPeriod:           0,
+				DisableAutomatedRotation: true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			out := tt.inputParams.ShouldDeregisterRotationJob()
+			if out != tt.expected {
+				t.Errorf("ShouldRegisterRotationJob() output = %v, expected: %v", out, tt.expected)
+			}
+		})
+	}
+}
+
+func TestAddAutomatedRotationFieldsWithGroup(t *testing.T) {
+	expectedSchemaMap := make(map[string]*framework.FieldSchema)
+	for k, v := range schemaMap {
+		newField := *v
+		newDisplayAttrs := *v.DisplayAttrs
+		newDisplayAttrs.Group = "Automated Rotation"
+		newField.DisplayAttrs = &newDisplayAttrs
+		expectedSchemaMap[k] = &newField
+	}
+	testcases := []struct {
+		name  string
+		group string
+		input map[string]*framework.FieldSchema
+		want  map[string]*framework.FieldSchema
+	}{
+		{
+			name:  "basic",
+			input: map[string]*framework.FieldSchema{},
+			group: "Automated Rotation",
+			want:  expectedSchemaMap,
+		},
+	}
+
+	for _, tt := range testcases {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.input
+			AddAutomatedRotationFieldsWithGroup(got, tt.group)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestAddAutomatedRotationFields(t *testing.T) {
+	testcases := []struct {
+		name  string
+		group string
+		input map[string]*framework.FieldSchema
+		want  map[string]*framework.FieldSchema
+	}{
+		{
+			name:  "basic",
+			input: map[string]*framework.FieldSchema{},
+			want:  schemaMap,
+		},
+	}
+
+	for _, tt := range testcases {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.input
+			AddAutomatedRotationFields(got)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/sdk/helper/backoff/backoff.go b/sdk/helper/backoff/backoff.go
index ebf9aaa7e72..0488039f163 100644
--- a/sdk/helper/backoff/backoff.go
+++ b/sdk/helper/backoff/backoff.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package backoff
diff --git a/sdk/helper/backoff/backoff_test.go b/sdk/helper/backoff/backoff_test.go
index 46b85257bad..c452ea8af9d 100644
--- a/sdk/helper/backoff/backoff_test.go
+++ b/sdk/helper/backoff/backoff_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package backoff
diff --git a/sdk/helper/base62/base62.go b/sdk/helper/base62/base62.go
index 7d2c7d5ba15..8fcd70a895b 100644
--- a/sdk/helper/base62/base62.go
+++ b/sdk/helper/base62/base62.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // DEPRECATED: this has been moved to go-secure-stdlib and will be removed
diff --git a/sdk/helper/certutil/cert_verification.go b/sdk/helper/certutil/cert_verification.go
new file mode 100644
index 00000000000..51784289908
--- /dev/null
+++ b/sdk/helper/certutil/cert_verification.go
@@ -0,0 +1,76 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package certutil
+
+import (
+	"bytes"
+	"fmt"
+	"time"
+
+	ctx509 "github.com/google/certificate-transparency-go/x509"
+	"github.com/hashicorp/errwrap"
+)
+
+func VerifyCertificate(parsedBundle *ParsedCertBundle, options ctx509.VerifyOptions) error {
+	// If private key exists, check if it matches the public key of cert
+	if parsedBundle.PrivateKey != nil && parsedBundle.Certificate != nil {
+		equal, err := ComparePublicKeys(parsedBundle.Certificate.PublicKey, parsedBundle.PrivateKey.Public())
+		if err != nil {
+			return errwrap.Wrapf("could not compare public and private keys: {{err}}", err)
+		}
+		if !equal {
+			return fmt.Errorf("public key of certificate does not match private key")
+		}
+	}
+
+	rootCertPool := ctx509.NewCertPool()
+	intermediateCertPool := ctx509.NewCertPool()
+
+	for index, certificate := range parsedBundle.CAChain {
+		cert, err := convertCertificate(certificate.Bytes)
+		if err != nil {
+			return fmt.Errorf("could not parse certificate number %v in chain: %w", index, err)
+		}
+		if index > 0 && !cert.IsCA {
+			// Sometimes the leaf certificate is contained inside the bundle
+			return fmt.Errorf("certificate %v is not a CA certificate", index)
+		}
+		if bytes.Equal(cert.RawIssuer, cert.RawSubject) {
+			// Occasionally verify is called with a self-signed certificate that is not a CA;
+			// We don't break that use case here
+			rootCertPool.AddCert(cert)
+		} else {
+			intermediateCertPool.AddCert(cert)
+		}
+	}
+
+	if len(rootCertPool.Subjects()) < 1 {
+		// Alright, this is weird, since we don't have the root CA, we'll treat the intermediate as
+		// the root, otherwise we'll get a "x509: certificate signed by unknown authority" error.
+		rootCertPool, intermediateCertPool = intermediateCertPool, rootCertPool
+	}
+
+	// Note that we use github.com/google/certificate-transparency-go/x509 to perform certificate verification,
+	// since that library provides options to disable checks that the standard library does not.
+
+	options.Roots = rootCertPool
+	options.Intermediates = intermediateCertPool
+	options.CurrentTime = time.Now()
+
+	certificate, err := convertCertificate(parsedBundle.CertificateBytes)
+	if err != nil {
+		return err
+	}
+
+	_, err = certificate.Verify(options)
+	return err
+}
+
+func convertCertificate(certBytes []byte) (*ctx509.Certificate, error) {
+	ret, err := ctx509.ParseCertificate(certBytes)
+	if err != nil {
+		return nil, fmt.Errorf("cannot convert certificate for validation: %w", err)
+	}
+	return ret, nil
+}
diff --git a/sdk/helper/certutil/certutil_test.go b/sdk/helper/certutil/certutil_test.go
index 8b550946121..5eff1be9e34 100644
--- a/sdk/helper/certutil/certutil_test.go
+++ b/sdk/helper/certutil/certutil_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package certutil
@@ -16,9 +16,11 @@ import (
 	"encoding/asn1"
 	"encoding/json"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"math/big"
 	mathrand "math/rand"
+	"net"
 	"reflect"
 	"strings"
 	"sync"
@@ -26,6 +28,8 @@ import (
 	"time"
 
 	"github.com/fatih/structs"
+	"github.com/go-test/deep"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 )
 
 // Tests converting back and forth between a CertBundle and a ParsedCertBundle.
@@ -57,7 +61,7 @@ func TestCertBundleConversion(t *testing.T) {
 		err = compareCertBundleToParsedCertBundle(cbut, pcbut)
 		if err != nil {
 			t.Logf("Error occurred with bundle %d in test array (index %d).\n", i+1, i)
-			t.Errorf(err.Error())
+			t.Error(err.Error())
 		}
 
 		cbut, err := pcbut.ToCertBundle()
@@ -67,7 +71,7 @@ func TestCertBundleConversion(t *testing.T) {
 
 		err = compareCertBundleToParsedCertBundle(cbut, pcbut)
 		if err != nil {
-			t.Fatalf(err.Error())
+			t.Fatal(err.Error())
 		}
 	}
 }
@@ -131,7 +135,7 @@ func TestCertBundleParsing(t *testing.T) {
 		err = compareCertBundleToParsedCertBundle(cbut, pcbut)
 		if err != nil {
 			t.Logf("Error occurred with bundle %d in test array (index %d).\n", i+1, i)
-			t.Fatalf(err.Error())
+			t.Fatal(err.Error())
 		}
 
 		dataMap := structs.New(cbut).Map()
@@ -143,7 +147,7 @@ func TestCertBundleParsing(t *testing.T) {
 		err = compareCertBundleToParsedCertBundle(cbut, pcbut)
 		if err != nil {
 			t.Logf("Error occurred with bundle %d in test array (index %d).\n", i+1, i)
-			t.Fatalf(err.Error())
+			t.Fatal(err.Error())
 		}
 
 		pcbut, err = ParsePEMBundle(cbut.ToPEMBundle())
@@ -154,14 +158,14 @@ func TestCertBundleParsing(t *testing.T) {
 		err = compareCertBundleToParsedCertBundle(cbut, pcbut)
 		if err != nil {
 			t.Logf("Error occurred with bundle %d in test array (index %d).\n", i+1, i)
-			t.Fatalf(err.Error())
+			t.Fatal(err.Error())
 		}
 	}
 }
 
 func compareCertBundleToParsedCertBundle(cbut *CertBundle, pcbut *ParsedCertBundle) error {
 	if cbut == nil {
-		return fmt.Errorf("got nil bundle")
+		return errors.New("got nil bundle")
 	}
 	if pcbut == nil {
 		return fmt.Errorf("got nil parsed bundle")
@@ -280,7 +284,7 @@ func TestCSRBundleConversion(t *testing.T) {
 
 		err = compareCSRBundleToParsedCSRBundle(csrbut, pcsrbut)
 		if err != nil {
-			t.Fatalf(err.Error())
+			t.Fatal(err.Error())
 		}
 
 		csrbut, err = pcsrbut.ToCSRBundle()
@@ -290,7 +294,7 @@ func TestCSRBundleConversion(t *testing.T) {
 
 		err = compareCSRBundleToParsedCSRBundle(csrbut, pcsrbut)
 		if err != nil {
-			t.Fatalf(err.Error())
+			t.Fatal(err.Error())
 		}
 	}
 }
@@ -465,7 +469,7 @@ vitin0L6nprauWkKO38XgM4T75qKZpqtiOcT
 }
 
 func TestGetPublicKeySize(t *testing.T) {
-	rsa, err := rsa.GenerateKey(rand.Reader, 3072)
+	rsa, err := cryptoutil.GenerateRSAKey(rand.Reader, 3072)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -735,7 +739,7 @@ func setCerts() {
 
 	// RSA generation
 	{
-		key, err := rsa.GenerateKey(rand.Reader, 2048)
+		key, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 		if err != nil {
 			panic(err)
 		}
@@ -864,7 +868,7 @@ func setCerts() {
 
 func TestComparePublicKeysAndType(t *testing.T) {
 	rsa1 := genRsaKey(t).Public()
-	rsa2 := genRsaKey(t).Public()
+	rsa := genRsaKey(t).Public()
 	eddsa1 := genEdDSA(t).Public()
 	eddsa2 := genEdDSA(t).Public()
 	ed25519_1, _ := genEd25519Key(t)
@@ -881,7 +885,7 @@ func TestComparePublicKeysAndType(t *testing.T) {
 		wantErr bool
 	}{
 		{name: "RSA_Equal", args: args{key1Iface: rsa1, key2Iface: rsa1}, want: true, wantErr: false},
-		{name: "RSA_NotEqual", args: args{key1Iface: rsa1, key2Iface: rsa2}, want: false, wantErr: false},
+		{name: "RSA_NotEqual", args: args{key1Iface: rsa1, key2Iface: rsa}, want: false, wantErr: false},
 		{name: "EDDSA_Equal", args: args{key1Iface: eddsa1, key2Iface: eddsa1}, want: true, wantErr: false},
 		{name: "EDDSA_NotEqual", args: args{key1Iface: eddsa1, key2Iface: eddsa2}, want: false, wantErr: false},
 		{name: "ED25519_Equal", args: args{key1Iface: ed25519_1, key2Iface: ed25519_1}, want: true, wantErr: false},
@@ -916,6 +920,10 @@ func TestNotAfterValues(t *testing.T) {
 	if PermitNotAfterBehavior != 2 {
 		t.Fatalf("Expected PermitNotAfterBehavior=%v to have value 2", PermitNotAfterBehavior)
 	}
+
+	if AlwaysEnforceErr != 3 {
+		t.Fatalf("Expected AlwaysEnforceErr=%v to have value 3", AlwaysEnforceErr)
+	}
 }
 
 func TestSignatureAlgorithmRoundTripping(t *testing.T) {
@@ -1006,8 +1014,212 @@ func TestBasicConstraintExtension(t *testing.T) {
 	})
 }
 
+// TestIgnoreCSRSigning Make sure we validate the CSR by default and that we can override
+// the behavior disabling CSR signature checks
+func TestIgnoreCSRSigning(t *testing.T) {
+	t.Parallel()
+
+	caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("failed generating ca key: %v", err)
+	}
+	subjKeyID, err := GetSubjKeyID(caKey)
+	if err != nil {
+		t.Fatalf("failed generating ca subject key id: %v", err)
+	}
+	caCertTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "root.localhost",
+		},
+		SubjectKeyId:          subjKeyID,
+		DNSNames:              []string{"root.localhost"},
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		SerialNumber:          big.NewInt(mathrand.Int63()),
+		NotBefore:             time.Now().Add(-30 * time.Second),
+		NotAfter:              time.Now().Add(262980 * time.Hour),
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+	}
+	caBytes, err := x509.CreateCertificate(rand.Reader, caCertTemplate, caCertTemplate, caKey.Public(), caKey)
+	if err != nil {
+		t.Fatalf("failed creating ca certificate: %v", err)
+	}
+	caCert, err := x509.ParseCertificate(caBytes)
+	if err != nil {
+		t.Fatalf("failed parsing ca certificate: %v", err)
+	}
+
+	signingBundle := &CAInfoBundle{
+		ParsedCertBundle: ParsedCertBundle{
+			PrivateKeyType:   ECPrivateKey,
+			PrivateKey:       caKey,
+			CertificateBytes: caBytes,
+			Certificate:      caCert,
+			CAChain:          nil,
+		},
+		URLs: &URLEntries{},
+	}
+
+	key := genEdDSA(t)
+	csr := &x509.CertificateRequest{
+		PublicKeyAlgorithm: x509.ECDSA,
+		PublicKey:          key.Public(),
+		Subject: pkix.Name{
+			CommonName: "test.dadgarcorp.com",
+		},
+	}
+	t.Run(fmt.Sprintf("ignore-csr-disabled"), func(t *testing.T) {
+		params := &CreationParameters{
+			URLs: &URLEntries{},
+		}
+		data := &CreationBundle{
+			Params:        params,
+			SigningBundle: signingBundle,
+			CSR:           csr,
+		}
+
+		_, err := SignCertificate(data)
+		if err == nil {
+			t.Fatalf("should have failed signing csr with ignore csr signature disabled")
+		}
+		if !strings.Contains(err.Error(), "request signature invalid") {
+			t.Fatalf("expected error to contain 'request signature invalid': got: %v", err)
+		}
+	})
+
+	t.Run(fmt.Sprintf("ignore-csr-enabled"), func(t *testing.T) {
+		params := &CreationParameters{
+			IgnoreCSRSignature: true,
+			URLs:               &URLEntries{},
+			NotAfter:           time.Now().Add(10000 * time.Hour),
+		}
+		data := &CreationBundle{
+			Params:        params,
+			SigningBundle: signingBundle,
+			CSR:           csr,
+		}
+
+		cert, err := SignCertificate(data)
+		if err != nil {
+			t.Fatalf("failed to sign certificate: %v", err)
+		}
+
+		if err := cert.Verify(); err != nil {
+			t.Fatalf("signature verification failed: %v", err)
+		}
+	})
+}
+
+// TestSignIntermediat_name_constraints verifies that all the name constraints extension fields are
+// used when signing a certificate.
+func TestSignCertificate_name_constraints(t *testing.T) {
+	t.Parallel()
+
+	caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatalf("failed generating ca key: %v", err)
+	}
+	subjKeyID, err := GetSubjKeyID(caKey)
+	if err != nil {
+		t.Fatalf("failed generating ca subject key id: %v", err)
+	}
+	caCertTemplate := &x509.Certificate{
+		Subject: pkix.Name{
+			CommonName: "root.localhost",
+		},
+		SubjectKeyId:          subjKeyID,
+		DNSNames:              []string{"root.localhost"},
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,
+		SerialNumber:          big.NewInt(mathrand.Int63()),
+		NotBefore:             time.Now().Add(-30 * time.Second),
+		NotAfter:              time.Now().Add(262980 * time.Hour),
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+	}
+	caBytes, err := x509.CreateCertificate(rand.Reader, caCertTemplate, caCertTemplate, caKey.Public(), caKey)
+	if err != nil {
+		t.Fatalf("failed creating ca certificate: %v", err)
+	}
+	caCert, err := x509.ParseCertificate(caBytes)
+	if err != nil {
+		t.Fatalf("failed parsing ca certificate: %v", err)
+	}
+
+	signingBundle := &CAInfoBundle{
+		ParsedCertBundle: ParsedCertBundle{
+			PrivateKeyType:   ECPrivateKey,
+			PrivateKey:       caKey,
+			CertificateBytes: caBytes,
+			Certificate:      caCert,
+			CAChain:          nil,
+		},
+		URLs: &URLEntries{},
+	}
+
+	key := genEdDSA(t)
+	csr := &x509.CertificateRequest{
+		PublicKeyAlgorithm: x509.ECDSA,
+		PublicKey:          key.Public(),
+		Subject: pkix.Name{
+			CommonName: "test.dadgarcorp.com",
+		},
+	}
+	_, ipnet1, err := net.ParseCIDR("1.2.3.4/32")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, ipnet2, err := net.ParseCIDR("1.2.3.4/16")
+	if err != nil {
+		t.Fatal(err)
+	}
+	params := &CreationParameters{
+		IgnoreCSRSignature:      true,
+		URLs:                    &URLEntries{},
+		NotAfter:                time.Now().Add(10000 * time.Hour),
+		PermittedDNSDomains:     []string{"example.com", ".example.com"},
+		ExcludedDNSDomains:      []string{"bad.example.com"},
+		PermittedIPRanges:       []*net.IPNet{ipnet1},
+		ExcludedIPRanges:        []*net.IPNet{ipnet2},
+		PermittedEmailAddresses: []string{"one@example.com", "two@example.com"},
+		ExcludedEmailAddresses:  []string{"un@example.com", "deux@example.com"},
+		PermittedURIDomains:     []string{"domain1", "domain2"},
+		ExcludedURIDomains:      []string{"domain3", "domain4"},
+	}
+	data := &CreationBundle{
+		Params:        params,
+		SigningBundle: signingBundle,
+		CSR:           csr,
+	}
+
+	parsedBundle, err := SignCertificate(data)
+	if err != nil {
+		t.Fatal("should have failed signing csr with ignore csr signature disabled")
+	}
+
+	var failedChecks []error
+	check := func(fieldName string, expected any, actual any) {
+		diff := deep.Equal(expected, actual)
+		if len(diff) > 0 {
+			failedChecks = append(failedChecks, fmt.Errorf("error in field %q: %v", fieldName, diff))
+		}
+	}
+	cert := parsedBundle.Certificate
+	check("PermittedDNSDomains", params.PermittedDNSDomains, cert.PermittedDNSDomains)
+	check("ExcludedDNSDomains", params.ExcludedDNSDomains, cert.ExcludedDNSDomains)
+	check("PermittedIPRanges", params.PermittedIPRanges, cert.PermittedIPRanges)
+	check("ExcludedIPRanges", params.ExcludedIPRanges, cert.ExcludedIPRanges)
+	check("PermittedEmailAddresses", params.PermittedEmailAddresses, cert.PermittedEmailAddresses)
+	check("ExcludedEmailAddresses", params.ExcludedEmailAddresses, cert.ExcludedEmailAddresses)
+	check("PermittedURIDomains", params.PermittedURIDomains, cert.PermittedURIDomains)
+	check("ExcludedURIDomains", params.ExcludedURIDomains, cert.ExcludedURIDomains)
+
+	if err := errors.Join(failedChecks...); err != nil {
+		t.Error(err)
+	}
+}
+
 func genRsaKey(t *testing.T) *rsa.PrivateKey {
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	key, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/sdk/helper/certutil/cieps.go b/sdk/helper/certutil/cieps.go
index 9943cf3977a..ad6caf0b31f 100644
--- a/sdk/helper/certutil/cieps.go
+++ b/sdk/helper/certutil/cieps.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package certutil
diff --git a/sdk/helper/certutil/helpers.go b/sdk/helper/certutil/helpers.go
index b7fc22db026..f7adf44fb1d 100644
--- a/sdk/helper/certutil/helpers.go
+++ b/sdk/helper/certutil/helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package certutil
@@ -17,13 +17,11 @@ import (
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/asn1"
-	"encoding/binary"
 	"encoding/hex"
 	"encoding/pem"
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/big"
 	"net"
 	"net/url"
@@ -32,6 +30,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/errwrap"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/mitchellh/mapstructure"
@@ -107,13 +106,16 @@ var KeyUsageOID = asn1.ObjectIdentifier([]int{2, 5, 29, 15})
 // id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 }
 var ExtendedKeyUsageOID = asn1.ObjectIdentifier([]int{2, 5, 29, 37})
 
+// OID for Freshest (aka Delta) CRL from RFC 5280: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.15
+var FreshestCrlOid = asn1.ObjectIdentifier([]int{2, 5, 29, 46})
+
 // GetHexFormatted returns the byte buffer formatted in hex with
 // the specified separator between bytes.
 func GetHexFormatted(buf []byte, sep string) string {
 	var ret bytes.Buffer
 	for _, cur := range buf {
 		if ret.Len() > 0 {
-			fmt.Fprintf(&ret, sep)
+			fmt.Fprint(&ret, sep)
 		}
 		fmt.Fprintf(&ret, "%02x", cur)
 	}
@@ -313,8 +315,12 @@ func ParsePEMBundle(pemBundle string) (*ParsedCertBundle, error) {
 		}
 	}
 
-	if err := parsedBundle.Verify(); err != nil {
-		return nil, errutil.UserError{Err: fmt.Sprintf("verification of parsed bundle failed: %s", err)}
+	if len(certPath) > 1 {
+		// Don't validate the certificate chain if no certificate exists eg. only a key is given
+		// And don't validate a chain if it isn't given (eg. only one certificate)
+		if err := parsedBundle.Verify(); err != nil {
+			return nil, errutil.UserError{Err: fmt.Sprintf("verification of parsed bundle failed: %s", err)}
+		}
 	}
 
 	return parsedBundle, nil
@@ -370,7 +376,7 @@ func generatePrivateKey(keyType string, keyBits int, container ParsedPrivateKeyC
 			return errutil.InternalError{Err: fmt.Sprintf("insecure bit length for RSA private key: %d", keyBits)}
 		}
 		privateKeyType = RSAPrivateKey
-		privateKey, err = rsa.GenerateKey(randReader, keyBits)
+		privateKey, err = cryptoutil.GenerateRSAKey(randReader, keyBits)
 		if err != nil {
 			return errutil.InternalError{Err: fmt.Sprintf("error generating RSA private key: %v", err)}
 		}
@@ -533,9 +539,10 @@ func ParsePublicKeyPEM(data []byte) (interface{}, error) {
 func AddPolicyIdentifiers(data *CreationBundle, certTemplate *x509.Certificate) {
 	oidOnly := true
 	for _, oidStr := range data.Params.PolicyIdentifiers {
-		oid, err := StringToOid(oidStr)
+		// Compatible with Go 1.24 and higher only (or 1.22 with x509usepolicies=1)
+		x509Oid, err := x509.ParseOID(oidStr)
 		if err == nil {
-			certTemplate.PolicyIdentifiers = append(certTemplate.PolicyIdentifiers, oid)
+			certTemplate.Policies = append(certTemplate.Policies, x509Oid)
 		}
 		if err != nil {
 			oidOnly = false
@@ -940,10 +947,18 @@ func createCertificate(data *CreationBundle, randReader io.Reader, privateKeyGen
 	}
 
 	// This will only be filled in from the generation paths
-	if len(data.Params.PermittedDNSDomains) > 0 {
-		certTemplate.PermittedDNSDomains = data.Params.PermittedDNSDomains
-		certTemplate.PermittedDNSDomainsCritical = true
-	}
+	certTemplate.PermittedDNSDomains = append(certTemplate.PermittedDNSDomains, data.Params.PermittedDNSDomains...)
+	certTemplate.ExcludedDNSDomains = append(certTemplate.ExcludedDNSDomains, data.Params.ExcludedDNSDomains...)
+	certTemplate.PermittedIPRanges = append(certTemplate.PermittedIPRanges, data.Params.PermittedIPRanges...)
+	certTemplate.ExcludedIPRanges = append(certTemplate.ExcludedIPRanges, data.Params.ExcludedIPRanges...)
+	certTemplate.PermittedEmailAddresses = append(certTemplate.PermittedEmailAddresses, data.Params.PermittedEmailAddresses...)
+	certTemplate.ExcludedEmailAddresses = append(certTemplate.ExcludedEmailAddresses, data.Params.ExcludedEmailAddresses...)
+	certTemplate.PermittedURIDomains = append(certTemplate.PermittedURIDomains, data.Params.PermittedURIDomains...)
+	certTemplate.ExcludedURIDomains = append(certTemplate.ExcludedURIDomains, data.Params.ExcludedURIDomains...)
+	// Note that it is harmless to set PermittedDNSDomainsCritical even if all other
+	// permitted or excluded fields are empty, as the name constraints extension won't be created in
+	// that case
+	certTemplate.PermittedDNSDomainsCritical = true
 
 	AddPolicyIdentifiers(data, certTemplate)
 
@@ -953,6 +968,10 @@ func createCertificate(data *CreationBundle, randReader io.Reader, privateKeyGen
 
 	certTemplate.IssuingCertificateURL = data.Params.URLs.IssuingCertificates
 	certTemplate.CRLDistributionPoints = data.Params.URLs.CRLDistributionPoints
+	err = AddDeltaCRLExtension(data, certTemplate)
+	if err != nil {
+		return nil, err
+	}
 	certTemplate.OCSPServer = data.Params.URLs.OCSPServers
 
 	var certBytes []byte
@@ -1104,6 +1123,7 @@ func createCSR(data *CreationBundle, addBasicConstraints bool, randReader io.Rea
 	}
 
 	// Like many root CAs, other information is ignored
+
 	csrTemplate := &x509.CertificateRequest{
 		Subject:        data.Params.Subject,
 		DNSNames:       data.Params.DNSNames,
@@ -1112,6 +1132,14 @@ func createCSR(data *CreationBundle, addBasicConstraints bool, randReader io.Rea
 		URIs:           data.Params.URIs,
 	}
 
+	if data.Params.KeyUsage != 0 {
+		keyUsageExt, err := marshalKeyUsage(data.Params.KeyUsage)
+		if err != nil {
+			return nil, fmt.Errorf("failed marshalling existing key usage: %w", err)
+		}
+		csrTemplate.ExtraExtensions = []pkix.Extension{keyUsageExt}
+	}
+
 	if err := HandleOtherCSRSANs(csrTemplate, data.Params.OtherSANs); err != nil {
 		return nil, errutil.InternalError{Err: errwrap.Wrapf("error marshaling other SANs: {{err}}", err).Error()}
 	}
@@ -1161,6 +1189,56 @@ func createCSR(data *CreationBundle, addBasicConstraints bool, randReader io.Rea
 	return result, nil
 }
 
+// Marshal Key Usage taken from: https://cs.opensource.google/go/go/+/master:src/crypto/x509/x509.go;drc=370a6959e3edd9d901446661ee9fef3f72d150d4;l=1339
+// It requires the two following functions (reverseBitsInAByte and asn1BitLength) below, taken from the same code base
+// It's used for that code only for certificates; but we need to marshal key usage on CSR (createCSR above) as well
+func marshalKeyUsage(ku x509.KeyUsage) (pkix.Extension, error) {
+	ext := pkix.Extension{Id: KeyUsageOID, Critical: true}
+
+	var a [2]byte
+	a[0] = reverseBitsInAByte(byte(ku))
+	a[1] = reverseBitsInAByte(byte(ku >> 8))
+
+	l := 1
+	if a[1] != 0 {
+		l = 2
+	}
+
+	bitString := a[:l]
+	var err error
+	ext.Value, err = asn1.Marshal(asn1.BitString{Bytes: bitString, BitLength: asn1BitLength(bitString)})
+	return ext, err
+}
+
+// reverseBitsInAByte Taken from: https://cs.opensource.google/go/go/+/master:src/crypto/x509/x509.go;drc=370a6959e3edd9d901446661ee9fef3f72d150d4;l=1011
+// needed for marshalKeyUsage called above
+func reverseBitsInAByte(in byte) byte {
+	b1 := in>>4 | in<<4
+	b2 := b1>>2&0x33 | b1<<2&0xcc
+	b3 := b2>>1&0x55 | b2<<1&0xaa
+	return b3
+}
+
+// asn1BitLength returns the bit-length of bitString by considering the
+// most-significant bit in a byte to be the "first" bit. This convention
+// matches ASN.1, but differs from almost everything else.
+func asn1BitLength(bitString []byte) int {
+	bitLen := len(bitString) * 8
+
+	for i := range bitString {
+		b := bitString[len(bitString)-i-1]
+
+		for bit := uint(0); bit < 8; bit++ {
+			if (b>>bit)&1 == 1 {
+				return bitLen
+			}
+			bitLen--
+		}
+	}
+
+	return 0
+}
+
 // SignCertificate performs the heavy lifting
 // of generating a certificate from a CSR.
 // Returns a ParsedCertBundle sans private keys.
@@ -1187,9 +1265,10 @@ func signCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertBun
 		return nil, errutil.UserError{Err: "nil csr given to signCertificate"}
 	}
 
-	err := data.CSR.CheckSignature()
-	if err != nil {
-		return nil, errutil.UserError{Err: "request signature invalid"}
+	if !data.Params.IgnoreCSRSignature {
+		if err := data.CSR.CheckSignature(); err != nil {
+			return nil, errutil.UserError{Err: "request signature invalid"}
+		}
 	}
 
 	result := &ParsedCertBundle{}
@@ -1273,6 +1352,10 @@ func signCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertBun
 
 	certTemplate.IssuingCertificateURL = data.Params.URLs.IssuingCertificates
 	certTemplate.CRLDistributionPoints = data.Params.URLs.CRLDistributionPoints
+	err = AddDeltaCRLExtension(data, certTemplate)
+	if err != nil {
+		return nil, err
+	}
 	certTemplate.OCSPServer = data.SigningBundle.URLs.OCSPServers
 
 	if data.Params.IsCA {
@@ -1293,10 +1376,16 @@ func signCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertBun
 		certTemplate.IsCA = false
 	}
 
-	if len(data.Params.PermittedDNSDomains) > 0 {
-		certTemplate.PermittedDNSDomains = data.Params.PermittedDNSDomains
-		certTemplate.PermittedDNSDomainsCritical = true
-	}
+	certTemplate.PermittedDNSDomains = append(certTemplate.PermittedDNSDomains, data.Params.PermittedDNSDomains...)
+	certTemplate.ExcludedDNSDomains = append(certTemplate.ExcludedDNSDomains, data.Params.ExcludedDNSDomains...)
+	certTemplate.PermittedIPRanges = append(certTemplate.PermittedIPRanges, data.Params.PermittedIPRanges...)
+	certTemplate.ExcludedIPRanges = append(certTemplate.ExcludedIPRanges, data.Params.ExcludedIPRanges...)
+	certTemplate.PermittedEmailAddresses = append(certTemplate.PermittedEmailAddresses, data.Params.PermittedEmailAddresses...)
+	certTemplate.ExcludedEmailAddresses = append(certTemplate.ExcludedEmailAddresses, data.Params.ExcludedEmailAddresses...)
+	certTemplate.PermittedURIDomains = append(certTemplate.PermittedURIDomains, data.Params.PermittedURIDomains...)
+	certTemplate.ExcludedURIDomains = append(certTemplate.ExcludedURIDomains, data.Params.ExcludedURIDomains...)
+	// Note that it is harmless to set PermittedDNSDomainsCritical even if all other permitted/excluded fields are empty
+	certTemplate.PermittedDNSDomainsCritical = true
 
 	certBytes, err = x509.CreateCertificate(randReader, certTemplate, caCert, data.CSR.PublicKey, data.SigningBundle.PrivateKey)
 	if err != nil {
@@ -1315,7 +1404,7 @@ func signCertificate(data *CreationBundle, randReader io.Reader) (*ParsedCertBun
 }
 
 func NewCertPool(reader io.Reader) (*x509.CertPool, error) {
-	pemBlock, err := ioutil.ReadAll(reader)
+	pemBlock, err := io.ReadAll(reader)
 	if err != nil {
 		return nil, err
 	}
@@ -1637,19 +1726,28 @@ func getKeyUsage(exts []pkix.Extension) (x509.KeyUsage, error) {
 	keyUsage := x509.KeyUsage(0)
 	for _, ext := range exts {
 		if ext.Id.Equal(KeyUsageOID) {
-			// ASN1 is Big Endian
-			// another example of equivalent code: https://cs.opensource.google/go/go/+/master:src/crypto/x509/parser.go;drc=dd84bb682482390bb8465482cb7b13d2e3b17297;l=319
-			buf := bytes.NewReader(ext.Value)
-			err := binary.Read(buf, binary.BigEndian, &keyUsage)
-			if err != nil {
-				return keyUsage, err
-			}
-			return keyUsage, nil
+			return parseKeyUsageExtension(ext.Value)
 		}
 	}
 	return keyUsage, nil
 }
 
+// Taken from: https://cs.opensource.google/go/go/+/master:src/crypto/x509/parser.go;drc=dd84bb682482390bb8465482cb7b13d2e3b17297;l=319
+func parseKeyUsageExtension(der cryptobyte.String) (x509.KeyUsage, error) {
+	var usageBits asn1.BitString
+	if !der.ReadASN1BitString(&usageBits) {
+		return 0, errors.New("x509: invalid key usage")
+	}
+
+	var usage int
+	for i := 0; i < 9; i++ {
+		if usageBits.At(i) != 0 {
+			usage |= 1 << uint(i)
+		}
+	}
+	return x509.KeyUsage(usage), nil
+}
+
 func getExtKeyUsageOids(exts []pkix.Extension) ([]string, error) {
 	keyUsageOidStrings := make([]string, 0)
 	keyUsageOids := make([]asn1.ObjectIdentifier, 0)
@@ -1724,7 +1822,15 @@ func ParseCertificateToCreationParameters(certificate x509.Certificate) (creatio
 		// The following two values are on creation parameters, but are impossible to parse from the certificate
 		// ForceAppendCaChain
 		// UseCSRValues
-		PermittedDNSDomains: certificate.PermittedDNSDomains,
+		PermittedDNSDomains:     certificate.PermittedDNSDomains,
+		ExcludedDNSDomains:      certificate.ExcludedDNSDomains,
+		PermittedIPRanges:       certificate.PermittedIPRanges,
+		ExcludedIPRanges:        certificate.ExcludedIPRanges,
+		PermittedEmailAddresses: certificate.PermittedEmailAddresses,
+		ExcludedEmailAddresses:  certificate.ExcludedEmailAddresses,
+		PermittedURIDomains:     certificate.PermittedURIDomains,
+		ExcludedURIDomains:      certificate.ExcludedURIDomains,
+
 		// URLs: punting on this for now
 		MaxPathLength:     certificate.MaxPathLen,
 		NotBeforeDuration: time.Now().Sub(certificate.NotBefore), // Assumes Certificate was created this moment
@@ -1866,33 +1972,48 @@ func ParseCertificateToFields(certificate x509.Certificate) (map[string]interfac
 	}
 
 	templateData := map[string]interface{}{
-		"common_name":           certificate.Subject.CommonName,
-		"alt_names":             MakeAltNamesCommaSeparatedString(certificate.DNSNames, certificate.EmailAddresses),
-		"ip_sans":               MakeIpAddressCommaSeparatedString(certificate.IPAddresses),
-		"uri_sans":              MakeUriCommaSeparatedString(certificate.URIs),
-		"other_sans":            otherSans,
-		"signature_bits":        FindSignatureBits(certificate.SignatureAlgorithm),
-		"exclude_cn_from_sans":  DetermineExcludeCnFromCertSans(certificate),
-		"ou":                    makeCommaSeparatedString(certificate.Subject.OrganizationalUnit),
-		"organization":          makeCommaSeparatedString(certificate.Subject.Organization),
-		"country":               makeCommaSeparatedString(certificate.Subject.Country),
-		"locality":              makeCommaSeparatedString(certificate.Subject.Locality),
-		"province":              makeCommaSeparatedString(certificate.Subject.Province),
-		"street_address":        makeCommaSeparatedString(certificate.Subject.StreetAddress),
-		"postal_code":           makeCommaSeparatedString(certificate.Subject.PostalCode),
-		"serial_number":         certificate.Subject.SerialNumber,
-		"ttl":                   (certificate.NotAfter.Sub(certificate.NotBefore)).String(),
-		"max_path_length":       certificate.MaxPathLen,
-		"permitted_dns_domains": strings.Join(certificate.PermittedDNSDomains, ","),
-		"use_pss":               IsPSS(certificate.SignatureAlgorithm),
-		"skid":                  hex.EncodeToString(certificate.SubjectKeyId),
-		"key_type":              GetKeyType(certificate.PublicKeyAlgorithm.String()),
-		"key_bits":              FindBitLength(certificate.PublicKey),
+		"common_name":               certificate.Subject.CommonName,
+		"alt_names":                 MakeAltNamesCommaSeparatedString(certificate.DNSNames, certificate.EmailAddresses),
+		"ip_sans":                   MakeIpAddressCommaSeparatedString(certificate.IPAddresses),
+		"uri_sans":                  MakeUriCommaSeparatedString(certificate.URIs),
+		"other_sans":                otherSans,
+		"signature_bits":            FindSignatureBits(certificate.SignatureAlgorithm),
+		"exclude_cn_from_sans":      DetermineExcludeCnFromCertSans(certificate),
+		"ou":                        makeCommaSeparatedString(certificate.Subject.OrganizationalUnit),
+		"organization":              makeCommaSeparatedString(certificate.Subject.Organization),
+		"country":                   makeCommaSeparatedString(certificate.Subject.Country),
+		"locality":                  makeCommaSeparatedString(certificate.Subject.Locality),
+		"province":                  makeCommaSeparatedString(certificate.Subject.Province),
+		"street_address":            makeCommaSeparatedString(certificate.Subject.StreetAddress),
+		"postal_code":               makeCommaSeparatedString(certificate.Subject.PostalCode),
+		"serial_number":             certificate.Subject.SerialNumber,
+		"ttl":                       (certificate.NotAfter.Sub(certificate.NotBefore)).String(),
+		"max_path_length":           certificate.MaxPathLen,
+		"permitted_dns_domains":     strings.Join(certificate.PermittedDNSDomains, ","),
+		"excluded_dns_domains":      strings.Join(certificate.ExcludedDNSDomains, ","),
+		"permitted_ip_ranges":       strings.Join(ipRangesToStrings(certificate.PermittedIPRanges), ","),
+		"excluded_ip_ranges":        strings.Join(ipRangesToStrings(certificate.ExcludedIPRanges), ","),
+		"permitted_email_addresses": strings.Join(certificate.PermittedEmailAddresses, ","),
+		"excluded_email_addresses":  strings.Join(certificate.ExcludedEmailAddresses, ","),
+		"permitted_uri_domains":     strings.Join(certificate.PermittedURIDomains, ","),
+		"excluded_uri_domains":      strings.Join(certificate.ExcludedURIDomains, ","),
+		"use_pss":                   IsPSS(certificate.SignatureAlgorithm),
+		"skid":                      hex.EncodeToString(certificate.SubjectKeyId),
+		"key_type":                  GetKeyType(certificate.PublicKeyAlgorithm.String()),
+		"key_bits":                  FindBitLength(certificate.PublicKey),
 	}
 
 	return templateData, nil
 }
 
+func ipRangesToStrings(ipRanges []*net.IPNet) []string {
+	var ret []string
+	for _, ipRange := range ipRanges {
+		ret = append(ret, ipRange.String())
+	}
+	return ret
+}
+
 func getBasicConstraintsFromExtension(exts []pkix.Extension) (found bool, isCA bool, maxPathLength int, err error) {
 	for _, ext := range exts {
 		if ext.Id.Equal(ExtensionBasicConstraintsOID) {
@@ -2040,3 +2161,99 @@ func IsPSS(algorithm x509.SignatureAlgorithm) bool {
 		return false
 	}
 }
+
+// Per RFC 5280 4.2.1.15; the same as distribution point
+type deltaDistributionPoint struct {
+	DistributionPoint distributionPointName `asn1:"optional,tag:0"`
+	Reason            asn1.BitString        `asn1:"optional,tag:1"`
+	CRLIssuer         asn1.RawValue         `asn1:"optional,tag:2"`
+}
+type distributionPointName struct {
+	FullName     []asn1.RawValue  `asn1:"optional,tag:0"`
+	RelativeName pkix.RDNSequence `asn1:"optional,tag:1"`
+}
+
+func CreateDeltaCRLExtension(deltaUrls []string) (pkix.Extension, error) {
+	if deltaUrls == nil || len(deltaUrls) == 0 {
+		return pkix.Extension{}, fmt.Errorf("since no delta crl distribution points were provided, the extension returned is empty")
+	}
+	var deltaDistributionPoints []deltaDistributionPoint
+	for _, deltaUrl := range deltaUrls {
+		delta := deltaDistributionPoint{
+			DistributionPoint: distributionPointName{
+				FullName: []asn1.RawValue{
+					{
+						Tag:   6,
+						Class: 2,
+						Bytes: []byte(deltaUrl),
+					},
+				},
+			},
+		}
+		deltaDistributionPoints = append(deltaDistributionPoints, delta)
+	}
+	asn1Value, err := asn1.Marshal(deltaDistributionPoints)
+	if err != nil {
+		return pkix.Extension{}, err
+	}
+	return pkix.Extension{
+		Id:       FreshestCrlOid,
+		Value:    asn1Value,
+		Critical: false,
+	}, nil
+}
+
+// Adapted From: https://cs.opensource.google/go/go/+/master:src/crypto/x509/parser.go?q=CRLDistributionPoints&ss=go%2Fgo
+func ParseDeltaCRLExtension(certificate *x509.Certificate) ([]string, error) {
+	urls := []string{}
+	for _, extension := range certificate.Extensions {
+		if extension.Id.Equal(FreshestCrlOid) {
+			val := cryptobyte.String(extension.Value)
+			answer := !val.ReadASN1(&val, asn1.TagSequence|32)
+			if answer { // classConstructed SEQUENCE
+				return urls, errors.New("x509: invalid CRL distribution points")
+			}
+			for !val.Empty() {
+				var dpDER cryptobyte.String
+				if !val.ReadASN1(&dpDER, asn1.TagSequence|32) {
+					return urls, errors.New("x509: invalid CRL distribution point")
+				}
+				var dpNameDER cryptobyte.String
+				var dpNamePresent bool
+				if !dpDER.ReadOptionalASN1(&dpNameDER, &dpNamePresent, asn1.ClassUniversal|32|128) {
+					return urls, errors.New("x509: invalid CRL distribution point")
+				}
+				if !dpNamePresent {
+					continue
+				}
+				if !dpNameDER.ReadASN1(&dpNameDER, asn1.ClassUniversal|32|128) {
+					return urls, errors.New("x509: invalid CRL distribution point")
+				}
+				for !dpNameDER.Empty() {
+					if !dpNameDER.PeekASN1Tag(asn1.TagOID | 128) { // Context is GeneralName
+						break
+					}
+					var uri cryptobyte.String
+					if !dpNameDER.ReadASN1(&uri, asn1.TagOID|128) { // Context is GeneralName
+						return urls, errors.New("x509: invalid CRL distribution point")
+					}
+					urls = append(urls, string(uri))
+				}
+			}
+			return urls, nil
+		}
+	}
+	return urls, nil
+}
+
+func AddDeltaCRLExtension(data *CreationBundle, certTemplate *x509.Certificate) error {
+	if data.Params != nil && data.Params.URLs != nil && data.Params.URLs.DeltaCRLDistributionPoints != nil &&
+		len(data.Params.URLs.DeltaCRLDistributionPoints) > 0 {
+		extension, err := CreateDeltaCRLExtension(data.Params.URLs.DeltaCRLDistributionPoints)
+		if err != nil {
+			return fmt.Errorf("failed to create delta crl extension: %w", err)
+		}
+		certTemplate.ExtraExtensions = append(certTemplate.ExtraExtensions, extension)
+	}
+	return nil
+}
diff --git a/sdk/helper/certutil/types.go b/sdk/helper/certutil/types.go
index ca245d7d420..5c1983bd75c 100644
--- a/sdk/helper/certutil/types.go
+++ b/sdk/helper/certutil/types.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Package certutil contains helper functions that are mostly used
@@ -31,6 +31,7 @@ import (
 	"strings"
 	"time"
 
+	ctx509 "github.com/google/certificate-transparency-go/x509"
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
 )
@@ -171,7 +172,7 @@ func GetPrivateKeyTypeFromPublicKey(pubKey crypto.PublicKey) PrivateKeyType {
 		return RSAPrivateKey
 	case *ecdsa.PublicKey:
 		return ECPrivateKey
-	case *ed25519.PublicKey:
+	case ed25519.PublicKey:
 		return Ed25519PrivateKey
 	default:
 		return UnknownPrivateKey
@@ -372,33 +373,8 @@ func (p *ParsedCertBundle) ToCertBundle() (*CertBundle, error) {
 // key of the certificate to the private key and checks the certificate trust
 // chain for path issues.
 func (p *ParsedCertBundle) Verify() error {
-	// If private key exists, check if it matches the public key of cert
-	if p.PrivateKey != nil && p.Certificate != nil {
-		equal, err := ComparePublicKeys(p.Certificate.PublicKey, p.PrivateKey.Public())
-		if err != nil {
-			return errwrap.Wrapf("could not compare public and private keys: {{err}}", err)
-		}
-		if !equal {
-			return fmt.Errorf("public key of certificate does not match private key")
-		}
-	}
-
-	certPath := p.GetCertificatePath()
-	if len(certPath) > 1 {
-		for i, caCert := range certPath[1:] {
-			if !caCert.Certificate.IsCA {
-				return fmt.Errorf("certificate %d of certificate chain is not a certificate authority", i+1)
-			}
-			if !bytes.Equal(certPath[i].Certificate.AuthorityKeyId, caCert.Certificate.SubjectKeyId) {
-				return fmt.Errorf("certificate %d of certificate chain ca trust path is incorrect (%q/%q) (%X/%X)",
-					i+1,
-					certPath[i].Certificate.Subject.CommonName, caCert.Certificate.Subject.CommonName,
-					certPath[i].Certificate.AuthorityKeyId, caCert.Certificate.SubjectKeyId)
-			}
-		}
-	}
-
-	return nil
+	options := ctx509.VerifyOptions{}
+	return VerifyCertificate(p, options)
 }
 
 // GetCertificatePath returns a slice of certificates making up a path, pulled
@@ -697,9 +673,10 @@ type IssueData struct {
 }
 
 type URLEntries struct {
-	IssuingCertificates   []string `json:"issuing_certificates" structs:"issuing_certificates" mapstructure:"issuing_certificates"`
-	CRLDistributionPoints []string `json:"crl_distribution_points" structs:"crl_distribution_points" mapstructure:"crl_distribution_points"`
-	OCSPServers           []string `json:"ocsp_servers" structs:"ocsp_servers" mapstructure:"ocsp_servers"`
+	IssuingCertificates        []string `json:"issuing_certificates" structs:"issuing_certificates" mapstructure:"issuing_certificates"`
+	CRLDistributionPoints      []string `json:"crl_distribution_points" structs:"crl_distribution_points" mapstructure:"crl_distribution_points"`
+	DeltaCRLDistributionPoints []string `json:"delta_crl_distribution_points" structs:"delta_crl_distribution_points" mapstructure:"delta_crl_distribution_points"`
+	OCSPServers                []string `json:"ocsp_servers" structs:"ocsp_servers" mapstructure:"ocsp_servers"`
 }
 
 type NotAfterBehavior int
@@ -708,9 +685,11 @@ const (
 	ErrNotAfterBehavior NotAfterBehavior = iota
 	TruncateNotAfterBehavior
 	PermitNotAfterBehavior
+	AlwaysEnforceErr
 )
 
 var notAfterBehaviorNames = map[NotAfterBehavior]string{
+	AlwaysEnforceErr:         "always_enforce_err",
 	ErrNotAfterBehavior:      "err",
 	TruncateNotAfterBehavior: "truncate",
 	PermitNotAfterBehavior:   "permit",
@@ -805,8 +784,15 @@ type CreationParameters struct {
 	ForceAppendCaChain            bool
 
 	// Only used when signing a CA cert
-	UseCSRValues        bool
-	PermittedDNSDomains []string
+	UseCSRValues            bool
+	PermittedDNSDomains     []string
+	ExcludedDNSDomains      []string
+	PermittedIPRanges       []*net.IPNet
+	ExcludedIPRanges        []*net.IPNet
+	PermittedEmailAddresses []string
+	ExcludedEmailAddresses  []string
+	PermittedURIDomains     []string
+	ExcludedURIDomains      []string
 
 	// URLs to encode into the certificate
 	URLs *URLEntries
@@ -819,6 +805,11 @@ type CreationParameters struct {
 
 	// The explicit SKID to use; especially useful for cross-signing.
 	SKID []byte
+
+	// Ignore validating the CSR's signature. This should only be enabled if the
+	// sender of the CSR has proven proof of possession of the associated
+	// private key by some other means, otherwise keep this set to false.
+	IgnoreCSRSignature bool
 }
 
 type CreationBundle struct {
@@ -831,7 +822,14 @@ type CreationBundle struct {
 // information
 func AddKeyUsages(data *CreationBundle, certTemplate *x509.Certificate) {
 	if data.Params.IsCA {
-		certTemplate.KeyUsage = x509.KeyUsage(x509.KeyUsageCertSign | x509.KeyUsageCRLSign)
+		// https://cabforum.org/working-groups/server/baseline-requirements/documents/CA-Browser-Forum-TLS-BR-2.1.4.pdf
+		// Per Section 7.1.2.10.7, the only acceptable additional key usage is Digital Signature
+		if data.Params.KeyUsage&x509.KeyUsageDigitalSignature == x509.KeyUsageDigitalSignature {
+			certTemplate.KeyUsage = x509.KeyUsageDigitalSignature
+		} else {
+			certTemplate.KeyUsage = x509.KeyUsage(0)
+		}
+		certTemplate.KeyUsage |= x509.KeyUsageCertSign | x509.KeyUsageCRLSign
 		return
 	}
 
diff --git a/sdk/helper/certutil/types_test.go b/sdk/helper/certutil/types_test.go
new file mode 100644
index 00000000000..26c8379f7d6
--- /dev/null
+++ b/sdk/helper/certutil/types_test.go
@@ -0,0 +1,64 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package certutil
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/elliptic"
+	"crypto/rand"
+	"testing"
+
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
+)
+
+func TestGetPrivateKeyTypeFromPublicKey(t *testing.T) {
+	rsaKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("error generating rsa key: %s", err)
+	}
+
+	ecdsaKey, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
+	if err != nil {
+		t.Fatalf("error generating ecdsa key: %s", err)
+	}
+
+	publicKey, _, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("error generating ed25519 key: %s", err)
+	}
+
+	testCases := map[string]struct {
+		publicKey       crypto.PublicKey
+		expectedKeyType PrivateKeyType
+	}{
+		"rsa": {
+			publicKey:       rsaKey.Public(),
+			expectedKeyType: RSAPrivateKey,
+		},
+		"ecdsa": {
+			publicKey:       ecdsaKey.Public(),
+			expectedKeyType: ECPrivateKey,
+		},
+		"ed25519": {
+			publicKey:       publicKey,
+			expectedKeyType: Ed25519PrivateKey,
+		},
+		"bad key type": {
+			publicKey:       []byte{},
+			expectedKeyType: UnknownPrivateKey,
+		},
+	}
+
+	for name, tt := range testCases {
+		t.Run(name, func(t *testing.T) {
+			keyType := GetPrivateKeyTypeFromPublicKey(tt.publicKey)
+
+			if keyType != tt.expectedKeyType {
+				t.Fatalf("key type mismatch: expected %s, got %s", tt.expectedKeyType, keyType)
+			}
+		})
+	}
+}
diff --git a/sdk/helper/cidrutil/cidr.go b/sdk/helper/cidrutil/cidr.go
index 9d2a41829c4..9668bce8bcd 100644
--- a/sdk/helper/cidrutil/cidr.go
+++ b/sdk/helper/cidrutil/cidr.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package cidrutil
diff --git a/sdk/helper/cidrutil/cidr_test.go b/sdk/helper/cidrutil/cidr_test.go
index e6fc5764452..f6c96dfaefa 100644
--- a/sdk/helper/cidrutil/cidr_test.go
+++ b/sdk/helper/cidrutil/cidr_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package cidrutil
diff --git a/sdk/helper/clientcountutil/clientcountutil.go b/sdk/helper/clientcountutil/clientcountutil.go
index dfafd4bee87..3240c2ddb98 100644
--- a/sdk/helper/clientcountutil/clientcountutil.go
+++ b/sdk/helper/clientcountutil/clientcountutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Package clientcountutil provides a library to generate activity log data for
@@ -267,7 +267,10 @@ func (d *ActivityLogDataGenerator) Segment(opts ...SegmentOption) *ActivityLogDa
 }
 
 // ToJSON returns the JSON representation of the data
-func (d *ActivityLogDataGenerator) ToJSON() ([]byte, error) {
+func (d *ActivityLogDataGenerator) ToJSON(writeOptions ...generation.WriteOptions) ([]byte, error) {
+	if len(writeOptions) > 0 {
+		d.data.Write = writeOptions
+	}
 	return protojson.Marshal(d.data)
 }
 
diff --git a/sdk/helper/clientcountutil/clientcountutil_test.go b/sdk/helper/clientcountutil/clientcountutil_test.go
index 6a5b224bc67..681cde4a32b 100644
--- a/sdk/helper/clientcountutil/clientcountutil_test.go
+++ b/sdk/helper/clientcountutil/clientcountutil_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package clientcountutil
diff --git a/sdk/helper/clientcountutil/generation/generate_data.pb.go b/sdk/helper/clientcountutil/generation/generate_data.pb.go
index 5e64ce9dfb4..b6d2e5b5d07 100644
--- a/sdk/helper/clientcountutil/generation/generate_data.pb.go
+++ b/sdk/helper/clientcountutil/generation/generate_data.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: sdk/helper/clientcountutil/generation/generate_data.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -32,6 +33,7 @@ const (
 	WriteOptions_WRITE_ENTITIES            WriteOptions = 3
 	WriteOptions_WRITE_DIRECT_TOKENS       WriteOptions = 4
 	WriteOptions_WRITE_INTENT_LOGS         WriteOptions = 5
+	WriteOptions_WRITE_CLIENT_IDS_MEMORY   WriteOptions = 6
 )
 
 // Enum value maps for WriteOptions.
@@ -43,6 +45,7 @@ var (
 		3: "WRITE_ENTITIES",
 		4: "WRITE_DIRECT_TOKENS",
 		5: "WRITE_INTENT_LOGS",
+		6: "WRITE_CLIENT_IDS_MEMORY",
 	}
 	WriteOptions_value = map[string]int32{
 		"WRITE_UNKNOWN":             0,
@@ -51,6 +54,7 @@ var (
 		"WRITE_ENTITIES":            3,
 		"WRITE_DIRECT_TOKENS":       4,
 		"WRITE_INTENT_LOGS":         5,
+		"WRITE_CLIENT_IDS_MEMORY":   6,
 	}
 )
 
@@ -82,21 +86,18 @@ func (WriteOptions) EnumDescriptor() ([]byte, []int) {
 }
 
 type ActivityLogMockInput struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Write         []WriteOptions         `protobuf:"varint,1,rep,packed,name=write,proto3,enum=generation.WriteOptions" json:"write,omitempty"`
+	Data          []*Data                `protobuf:"bytes,2,rep,name=data,proto3" json:"data,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Write []WriteOptions `protobuf:"varint,1,rep,packed,name=write,proto3,enum=generation.WriteOptions" json:"write,omitempty"`
-	Data  []*Data        `protobuf:"bytes,2,rep,name=data,proto3" json:"data,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ActivityLogMockInput) Reset() {
 	*x = ActivityLogMockInput{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ActivityLogMockInput) String() string {
@@ -107,7 +108,7 @@ func (*ActivityLogMockInput) ProtoMessage() {}
 
 func (x *ActivityLogMockInput) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -137,16 +138,13 @@ func (x *ActivityLogMockInput) GetData() []*Data {
 }
 
 type Data struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Types that are assignable to Month:
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Types that are valid to be assigned to Month:
 	//
 	//	*Data_CurrentMonth
 	//	*Data_MonthsAgo
 	Month isData_Month `protobuf_oneof:"month"`
-	// Types that are assignable to Clients:
+	// Types that are valid to be assigned to Clients:
 	//
 	//	*Data_All
 	//	*Data_Segments
@@ -154,15 +152,15 @@ type Data struct {
 	EmptySegmentIndexes []int32        `protobuf:"varint,5,rep,packed,name=empty_segment_indexes,json=emptySegmentIndexes,proto3" json:"empty_segment_indexes,omitempty"`
 	SkipSegmentIndexes  []int32        `protobuf:"varint,6,rep,packed,name=skip_segment_indexes,json=skipSegmentIndexes,proto3" json:"skip_segment_indexes,omitempty"`
 	NumSegments         int32          `protobuf:"varint,7,opt,name=num_segments,json=numSegments,proto3" json:"num_segments,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
 }
 
 func (x *Data) Reset() {
 	*x = Data{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Data) String() string {
@@ -173,7 +171,7 @@ func (*Data) ProtoMessage() {}
 
 func (x *Data) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -188,44 +186,52 @@ func (*Data) Descriptor() ([]byte, []int) {
 	return file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDescGZIP(), []int{1}
 }
 
-func (m *Data) GetMonth() isData_Month {
-	if m != nil {
-		return m.Month
+func (x *Data) GetMonth() isData_Month {
+	if x != nil {
+		return x.Month
 	}
 	return nil
 }
 
 func (x *Data) GetCurrentMonth() bool {
-	if x, ok := x.GetMonth().(*Data_CurrentMonth); ok {
-		return x.CurrentMonth
+	if x != nil {
+		if x, ok := x.Month.(*Data_CurrentMonth); ok {
+			return x.CurrentMonth
+		}
 	}
 	return false
 }
 
 func (x *Data) GetMonthsAgo() int32 {
-	if x, ok := x.GetMonth().(*Data_MonthsAgo); ok {
-		return x.MonthsAgo
+	if x != nil {
+		if x, ok := x.Month.(*Data_MonthsAgo); ok {
+			return x.MonthsAgo
+		}
 	}
 	return 0
 }
 
-func (m *Data) GetClients() isData_Clients {
-	if m != nil {
-		return m.Clients
+func (x *Data) GetClients() isData_Clients {
+	if x != nil {
+		return x.Clients
 	}
 	return nil
 }
 
 func (x *Data) GetAll() *Clients {
-	if x, ok := x.GetClients().(*Data_All); ok {
-		return x.All
+	if x != nil {
+		if x, ok := x.Clients.(*Data_All); ok {
+			return x.All
+		}
 	}
 	return nil
 }
 
 func (x *Data) GetSegments() *Segments {
-	if x, ok := x.GetClients().(*Data_Segments); ok {
-		return x.Segments
+	if x != nil {
+		if x, ok := x.Clients.(*Data_Segments); ok {
+			return x.Segments
+		}
 	}
 	return nil
 }
@@ -284,20 +290,17 @@ func (*Data_All) isData_Clients() {}
 func (*Data_Segments) isData_Clients() {}
 
 type Segments struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Segments      []*Segment             `protobuf:"bytes,1,rep,name=segments,proto3" json:"segments,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Segments []*Segment `protobuf:"bytes,1,rep,name=segments,proto3" json:"segments,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Segments) Reset() {
 	*x = Segments{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Segments) String() string {
@@ -308,7 +311,7 @@ func (*Segments) ProtoMessage() {}
 
 func (x *Segments) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -331,21 +334,18 @@ func (x *Segments) GetSegments() []*Segment {
 }
 
 type Segment struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SegmentIndex  *int32                 `protobuf:"varint,1,opt,name=segment_index,json=segmentIndex,proto3,oneof" json:"segment_index,omitempty"`
+	Clients       *Clients               `protobuf:"bytes,2,opt,name=clients,proto3" json:"clients,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	SegmentIndex *int32   `protobuf:"varint,1,opt,name=segment_index,json=segmentIndex,proto3,oneof" json:"segment_index,omitempty"`
-	Clients      *Clients `protobuf:"bytes,2,opt,name=clients,proto3" json:"clients,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Segment) Reset() {
 	*x = Segment{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Segment) String() string {
@@ -356,7 +356,7 @@ func (*Segment) ProtoMessage() {}
 
 func (x *Segment) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -386,20 +386,17 @@ func (x *Segment) GetClients() *Clients {
 }
 
 type Clients struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Clients       []*Client              `protobuf:"bytes,1,rep,name=clients,proto3" json:"clients,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Clients []*Client `protobuf:"bytes,1,rep,name=clients,proto3" json:"clients,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Clients) Reset() {
 	*x = Clients{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Clients) String() string {
@@ -410,7 +407,7 @@ func (*Clients) ProtoMessage() {}
 
 func (x *Clients) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -433,26 +430,23 @@ func (x *Clients) GetClients() []*Client {
 }
 
 type Client struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Id                string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Count             int32  `protobuf:"varint,2,opt,name=count,proto3" json:"count,omitempty"`
-	Repeated          bool   `protobuf:"varint,3,opt,name=repeated,proto3" json:"repeated,omitempty"`
-	RepeatedFromMonth int32  `protobuf:"varint,4,opt,name=repeated_from_month,json=repeatedFromMonth,proto3" json:"repeated_from_month,omitempty"`
-	Namespace         string `protobuf:"bytes,5,opt,name=namespace,proto3" json:"namespace,omitempty"`
-	Mount             string `protobuf:"bytes,6,opt,name=mount,proto3" json:"mount,omitempty"`
-	ClientType        string `protobuf:"bytes,7,opt,name=client_type,json=clientType,proto3" json:"client_type,omitempty"`
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	Id                string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Count             int32                  `protobuf:"varint,2,opt,name=count,proto3" json:"count,omitempty"`
+	Repeated          bool                   `protobuf:"varint,3,opt,name=repeated,proto3" json:"repeated,omitempty"`
+	RepeatedFromMonth int32                  `protobuf:"varint,4,opt,name=repeated_from_month,json=repeatedFromMonth,proto3" json:"repeated_from_month,omitempty"`
+	Namespace         string                 `protobuf:"bytes,5,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	Mount             string                 `protobuf:"bytes,6,opt,name=mount,proto3" json:"mount,omitempty"`
+	ClientType        string                 `protobuf:"bytes,7,opt,name=client_type,json=clientType,proto3" json:"client_type,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *Client) Reset() {
 	*x = Client{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Client) String() string {
@@ -463,7 +457,7 @@ func (*Client) ProtoMessage() {}
 
 func (x *Client) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -529,7 +523,7 @@ func (x *Client) GetClientType() string {
 
 var File_sdk_helper_clientcountutil_generation_generate_data_proto protoreflect.FileDescriptor
 
-var file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc = []byte{
+var file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc = string([]byte{
 	0x0a, 0x39, 0x73, 0x64, 0x6b, 0x2f, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x2f, 0x63, 0x6c, 0x69,
 	0x65, 0x6e, 0x74, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x75, 0x74, 0x69, 0x6c, 0x2f, 0x67, 0x65, 0x6e,
 	0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65,
@@ -589,7 +583,7 @@ var file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc = []b
 	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x6f, 0x75, 0x6e, 0x74,
 	0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x1f, 0x0a,
 	0x0b, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0a, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x2a, 0xa0,
+	0x28, 0x09, 0x52, 0x0a, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x2a, 0xbd,
 	0x01, 0x0a, 0x0c, 0x57, 0x72, 0x69, 0x74, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12,
 	0x11, 0x0a, 0x0d, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e,
 	0x10, 0x00, 0x12, 0x1d, 0x0a, 0x19, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x50, 0x52, 0x45, 0x43,
@@ -600,28 +594,30 @@ var file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc = []b
 	0x03, 0x12, 0x17, 0x0a, 0x13, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x44, 0x49, 0x52, 0x45, 0x43,
 	0x54, 0x5f, 0x54, 0x4f, 0x4b, 0x45, 0x4e, 0x53, 0x10, 0x04, 0x12, 0x15, 0x0a, 0x11, 0x57, 0x52,
 	0x49, 0x54, 0x45, 0x5f, 0x49, 0x4e, 0x54, 0x45, 0x4e, 0x54, 0x5f, 0x4c, 0x4f, 0x47, 0x53, 0x10,
-	0x05, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f,
-	0x73, 0x64, 0x6b, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x75,
-	0x74, 0x69, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+	0x05, 0x12, 0x1b, 0x0a, 0x17, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x43, 0x4c, 0x49, 0x45, 0x4e,
+	0x54, 0x5f, 0x49, 0x44, 0x53, 0x5f, 0x4d, 0x45, 0x4d, 0x4f, 0x52, 0x59, 0x10, 0x06, 0x42, 0x3b,
+	0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b,
+	0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x75, 0x74, 0x69, 0x6c,
+	0x2f, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
+})
 
 var (
 	file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDescOnce sync.Once
-	file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDescData = file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc
+	file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDescData []byte
 )
 
 func file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDescGZIP() []byte {
 	file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDescOnce.Do(func() {
-		file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDescData = protoimpl.X.CompressGZIP(file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDescData)
+		file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc), len(file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc)))
 	})
 	return file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDescData
 }
 
 var file_sdk_helper_clientcountutil_generation_generate_data_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
 var file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
-var file_sdk_helper_clientcountutil_generation_generate_data_proto_goTypes = []interface{}{
+var file_sdk_helper_clientcountutil_generation_generate_data_proto_goTypes = []any{
 	(WriteOptions)(0),            // 0: generation.WriteOptions
 	(*ActivityLogMockInput)(nil), // 1: generation.ActivityLogMockInput
 	(*Data)(nil),                 // 2: generation.Data
@@ -650,92 +646,18 @@ func file_sdk_helper_clientcountutil_generation_generate_data_proto_init() {
 	if File_sdk_helper_clientcountutil_generation_generate_data_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ActivityLogMockInput); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Data); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Segments); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Segment); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Clients); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Client); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[1].OneofWrappers = []interface{}{
+	file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[1].OneofWrappers = []any{
 		(*Data_CurrentMonth)(nil),
 		(*Data_MonthsAgo)(nil),
 		(*Data_All)(nil),
 		(*Data_Segments)(nil),
 	}
-	file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[3].OneofWrappers = []interface{}{}
+	file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes[3].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc), len(file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc)),
 			NumEnums:      1,
 			NumMessages:   6,
 			NumExtensions: 0,
@@ -747,7 +669,6 @@ func file_sdk_helper_clientcountutil_generation_generate_data_proto_init() {
 		MessageInfos:      file_sdk_helper_clientcountutil_generation_generate_data_proto_msgTypes,
 	}.Build()
 	File_sdk_helper_clientcountutil_generation_generate_data_proto = out.File
-	file_sdk_helper_clientcountutil_generation_generate_data_proto_rawDesc = nil
 	file_sdk_helper_clientcountutil_generation_generate_data_proto_goTypes = nil
 	file_sdk_helper_clientcountutil_generation_generate_data_proto_depIdxs = nil
 }
diff --git a/sdk/helper/clientcountutil/generation/generate_data.proto b/sdk/helper/clientcountutil/generation/generate_data.proto
index 0a48b7bcafe..c3c7f99a4f0 100644
--- a/sdk/helper/clientcountutil/generation/generate_data.proto
+++ b/sdk/helper/clientcountutil/generation/generate_data.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 syntax = "proto3";
@@ -13,6 +13,7 @@ enum WriteOptions {
   WRITE_ENTITIES = 3;
   WRITE_DIRECT_TOKENS = 4;
   WRITE_INTENT_LOGS = 5;
+  WRITE_CLIENT_IDS_MEMORY = 6;
 }
 message ActivityLogMockInput {
   repeated WriteOptions write = 1;
diff --git a/sdk/helper/compressutil/compress.go b/sdk/helper/compressutil/compress.go
index 9e96d8dd32e..08c5ff09462 100644
--- a/sdk/helper/compressutil/compress.go
+++ b/sdk/helper/compressutil/compress.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package compressutil
@@ -11,7 +11,6 @@ import (
 	"io"
 
 	"github.com/golang/snappy"
-	"github.com/hashicorp/errwrap"
 	"github.com/pierrec/lz4"
 )
 
@@ -34,7 +33,7 @@ const (
 	CompressionCanaryLZ4 byte = '4'
 )
 
-// SnappyReadCloser embeds the snappy reader which implements the io.Reader
+// CompressUtilReadCloser embeds the snappy reader which implements the io.Reader
 // interface. The decompress procedure in this utility expects an
 // io.ReadCloser. This type implements the io.Closer interface to retain the
 // generic way of decompression.
@@ -98,7 +97,7 @@ func Compress(data []byte, config *CompressionConfig) ([]byte, error) {
 			// These are valid compression levels
 		default:
 			// If compression level is set to NoCompression or to
-			// any invalid value, fallback to Defaultcompression
+			// any invalid value, fallback to DefaultCompression
 			config.GzipCompressionLevel = gzip.DefaultCompression
 		}
 		writer, err = gzip.NewWriterLevel(&buf, config.GzipCompressionLevel)
@@ -116,7 +115,7 @@ func Compress(data []byte, config *CompressionConfig) ([]byte, error) {
 	}
 
 	if err != nil {
-		return nil, errwrap.Wrapf("failed to create a compression writer: {{err}}", err)
+		return nil, fmt.Errorf("failed to create a compression writer: %w", err)
 	}
 
 	if writer == nil {
@@ -126,7 +125,7 @@ func Compress(data []byte, config *CompressionConfig) ([]byte, error) {
 	// Compress the input and place it in the same buffer containing the
 	// canary byte.
 	if _, err = writer.Write(data); err != nil {
-		return nil, errwrap.Wrapf("failed to compress input data: err: {{err}}", err)
+		return nil, fmt.Errorf("failed to compress input data: err: %w", err)
 	}
 
 	// Close the io.WriteCloser
@@ -206,7 +205,7 @@ func DecompressWithCanary(data []byte) ([]byte, string, bool, error) {
 		return nil, "", true, nil
 	}
 	if err != nil {
-		return nil, "", false, errwrap.Wrapf("failed to create a compression reader: {{err}}", err)
+		return nil, "", false, fmt.Errorf("failed to create a compression reader: %w", err)
 	}
 	if reader == nil {
 		return nil, "", false, fmt.Errorf("failed to create a compression reader")
@@ -217,8 +216,18 @@ func DecompressWithCanary(data []byte) ([]byte, string, bool, error) {
 
 	// Read all the compressed data into a buffer
 	var buf bytes.Buffer
-	if _, err = io.Copy(&buf, reader); err != nil {
-		return nil, "", false, err
+
+	// Read the compressed data into a buffer, but do so
+	// slowly to prevent reading all the data into memory
+	// at once (protecting against e.g. zip bombs).
+	for {
+		_, err := io.CopyN(&buf, reader, 1024)
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return nil, "", false, err
+		}
 	}
 
 	return buf.Bytes(), compressionType, false, nil
diff --git a/sdk/helper/compressutil/compress_test.go b/sdk/helper/compressutil/compress_test.go
index 7d90ce87e98..01f5b92e503 100644
--- a/sdk/helper/compressutil/compress_test.go
+++ b/sdk/helper/compressutil/compress_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package compressutil
@@ -116,3 +116,40 @@ func TestCompressUtil_InvalidConfigurations(t *testing.T) {
 		t.Fatal("expected an error")
 	}
 }
+
+// TestDecompressWithCanaryLargeInput tests that DecompressWithCanary works
+// as expected even with large values.
+func TestDecompressWithCanaryLargeInput(t *testing.T) {
+	t.Parallel()
+
+	inputJSON := `{"sample":"data`
+	for i := 0; i < 100000; i++ {
+		inputJSON += " and data"
+	}
+	inputJSON += `"}`
+	inputJSONBytes := []byte(inputJSON)
+
+	compressedJSONBytes, err := Compress(inputJSONBytes, &CompressionConfig{Type: CompressionTypeGzip, GzipCompressionLevel: gzip.BestCompression})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	decompressedJSONBytes, wasNotCompressed, err := Decompress(compressedJSONBytes)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Check if the input for decompress was not compressed in the first place
+	if wasNotCompressed {
+		t.Fatalf("bytes were not compressed as expected")
+	}
+
+	if len(decompressedJSONBytes) == 0 {
+		t.Fatalf("bytes were not compressed as expected")
+	}
+
+	// Compare the value after decompression
+	if !bytes.Equal(inputJSONBytes, decompressedJSONBytes) {
+		t.Fatalf("decompressed value differs: decompressed value;\nexpected: %q\nactual: %q", string(inputJSONBytes), string(decompressedJSONBytes))
+	}
+}
diff --git a/sdk/helper/consts/agent.go b/sdk/helper/consts/agent.go
index ff2b043749f..922f7b5ec11 100644
--- a/sdk/helper/consts/agent.go
+++ b/sdk/helper/consts/agent.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package consts
diff --git a/sdk/helper/consts/consts.go b/sdk/helper/consts/consts.go
index ccc7494a281..6f5c23445b1 100644
--- a/sdk/helper/consts/consts.go
+++ b/sdk/helper/consts/consts.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package consts
@@ -47,4 +47,6 @@ const (
 	PerformanceReplicationPathTarget = "performance"
 
 	DRReplicationPathTarget = "dr"
+
+	RecoverSourcePathHeader = "X-Vault-Recover-Source-Path"
 )
diff --git a/sdk/helper/consts/deprecation_status.go b/sdk/helper/consts/deprecation_status.go
index e72292bee6c..45c6d64010b 100644
--- a/sdk/helper/consts/deprecation_status.go
+++ b/sdk/helper/consts/deprecation_status.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package consts
diff --git a/sdk/helper/consts/error.go b/sdk/helper/consts/error.go
index 5bd3f5e6e26..494e9e764eb 100644
--- a/sdk/helper/consts/error.go
+++ b/sdk/helper/consts/error.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package consts
@@ -25,4 +25,7 @@ var (
 	// ErrInvalidWrappingToken is returned when checking for the validity of
 	// a wrapping token that turns out to be invalid.
 	ErrInvalidWrappingToken = errors.New("wrapping token is not valid or does not exist")
+
+	// ErrOverloaded indicates the Vault server is at capacity.
+	ErrOverloaded = errors.New("overloaded, try again later")
 )
diff --git a/sdk/helper/consts/plugin_runtime_types.go b/sdk/helper/consts/plugin_runtime_types.go
index bf0722dd314..07bcc0e6384 100644
--- a/sdk/helper/consts/plugin_runtime_types.go
+++ b/sdk/helper/consts/plugin_runtime_types.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package consts
@@ -9,11 +9,9 @@ package consts
 
 import "fmt"
 
-var PluginRuntimeTypes = []PluginRuntimeType{
-	PluginRuntimeTypeUnsupported,
-	PluginRuntimeTypeContainer,
-}
+var PluginRuntimeTypes = _PluginRuntimeTypeValues
 
+//go:generate enumer -type=PluginRuntimeType -trimprefix=PluginRuntimeType -transform=snake
 type PluginRuntimeType uint32
 
 // This is a list of PluginRuntimeTypes used by Vault.
@@ -24,20 +22,11 @@ const (
 	PluginRuntimeTypeContainer
 )
 
-func (r PluginRuntimeType) String() string {
-	switch r {
-	case PluginRuntimeTypeContainer:
-		return "container"
-	default:
-		return "unsupported"
-	}
-}
-
+// ParsePluginRuntimeType is a wrapper around PluginRuntimeTypeString kept for backwards compatibility.
 func ParsePluginRuntimeType(PluginRuntimeType string) (PluginRuntimeType, error) {
-	switch PluginRuntimeType {
-	case "container":
-		return PluginRuntimeTypeContainer, nil
-	default:
+	t, err := PluginRuntimeTypeString(PluginRuntimeType)
+	if err != nil {
 		return PluginRuntimeTypeUnsupported, fmt.Errorf("%q is not a supported plugin runtime type", PluginRuntimeType)
 	}
+	return t, nil
 }
diff --git a/sdk/helper/consts/plugin_tiers.go b/sdk/helper/consts/plugin_tiers.go
new file mode 100644
index 00000000000..b2d632cbd93
--- /dev/null
+++ b/sdk/helper/consts/plugin_tiers.go
@@ -0,0 +1,102 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package consts
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+var PluginTiers = []PluginTier{
+	PluginTierUnknown,
+	PluginTierCommunity,
+	PluginTierPartner,
+	PluginTierOfficial,
+}
+
+type PluginTier uint32
+
+const (
+	// PluginTierUnknown defines unknown plugin tier
+	// DO NOT change the order of the enum as it
+	// could cause the wrong plugin tier to be read
+	// from storage for a given underlying number
+	PluginTierUnknown PluginTier = iota
+	// PluginTierCommunity defines community plugin tier
+	// DO NOT change the order of the enum as it
+	// could cause the wrong plugin tier to be read
+	// from storage for a given underlying number
+	PluginTierCommunity
+	// PluginTierPartner defines partner plugin tier
+	// DO NOT change the order of the enum as it
+	// could cause the wrong plugin tier to be read
+	// from storage for a given underlying number
+	PluginTierPartner
+	// PluginTierOfficial defines enterprise plugin tier
+	// DO NOT change the order of the enum as it
+	// could cause the wrong plugin tier to be read
+	// from storage for a given underlying number
+	PluginTierOfficial
+)
+
+func (p PluginTier) String() string {
+	switch p {
+	case PluginTierUnknown:
+		return "unknown"
+	case PluginTierCommunity:
+		return "community"
+	case PluginTierPartner:
+		return "partner"
+	case PluginTierOfficial:
+		return "official"
+	default:
+		return "unsupported"
+	}
+}
+
+func ParsePluginTier(pluginTier string) (PluginTier, error) {
+	switch pluginTier {
+	case "unknown", "":
+		return PluginTierUnknown, nil
+	case "community":
+		return PluginTierCommunity, nil
+	case "partner":
+		return PluginTierPartner, nil
+	case "official":
+		return PluginTierOfficial, nil
+	default:
+		return PluginTierUnknown, fmt.Errorf("%q is not a supported plugin tier", pluginTier)
+	}
+}
+
+// UnmarshalJSON implements json.Unmarshaler. It supports unmarshaling either a
+// string or a uint32. All new serialization will be as a string, but we
+// previously serialized as a uint32 so we need to support that for backwards
+// compatibility.
+func (p *PluginTier) UnmarshalJSON(data []byte) error {
+	var asString string
+	err := json.Unmarshal(data, &asString)
+	if err == nil {
+		*p, err = ParsePluginTier(asString)
+		return err
+	}
+
+	var asUint32 uint32
+	err = json.Unmarshal(data, &asUint32)
+	if err != nil {
+		return err
+	}
+	*p = PluginTier(asUint32)
+	switch *p {
+	case PluginTierUnknown, PluginTierCommunity, PluginTierPartner, PluginTierOfficial:
+		return nil
+	default:
+		return fmt.Errorf("%d is not a supported plugin tier", asUint32)
+	}
+}
+
+// MarshalJSON implements json.Marshaler.
+func (p PluginTier) MarshalJSON() ([]byte, error) {
+	return json.Marshal(p.String())
+}
diff --git a/sdk/helper/consts/plugin_tiers_test.go b/sdk/helper/consts/plugin_tiers_test.go
new file mode 100644
index 00000000000..feb1757d45a
--- /dev/null
+++ b/sdk/helper/consts/plugin_tiers_test.go
@@ -0,0 +1,230 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package consts
+
+import (
+	"encoding/json"
+	"reflect"
+	"testing"
+)
+
+func TestParsePluginTier(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		pluginTier string
+		want       PluginTier
+		wantErr    bool
+	}{
+		{
+			name:       "unknown",
+			pluginTier: "unknown",
+			want:       PluginTierUnknown,
+		},
+		{
+			name:       "empty unknown",
+			pluginTier: "",
+			want:       PluginTierUnknown,
+		},
+		{
+			name:       "community",
+			pluginTier: "community",
+			want:       PluginTierCommunity,
+		},
+		{
+			name:       "partner",
+			pluginTier: "partner",
+			want:       PluginTierPartner,
+		},
+		{
+			name:       "official",
+			pluginTier: "official",
+			want:       PluginTierOfficial,
+		},
+		{
+			name:       "unsupported",
+			pluginTier: "foo",
+			want:       PluginTierUnknown,
+			wantErr:    true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ParsePluginTier(tt.pluginTier)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("ParsePluginTier() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Fatalf("ParsePluginTier() got = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestPluginTier_MarshalJSON(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		p    PluginTier
+		want []byte
+	}{
+		{
+			name: "unknown",
+			p:    PluginTierUnknown,
+			want: []byte(`"unknown"`),
+		},
+		{
+			name: "community",
+			p:    PluginTierCommunity,
+			want: []byte(`"community"`),
+		},
+		{
+			name: "partner",
+			p:    PluginTierPartner,
+			want: []byte(`"partner"`),
+		},
+		{
+			name: "offical",
+			p:    PluginTierOfficial,
+			want: []byte(`"official"`),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := tt.p.MarshalJSON()
+			if err != nil {
+				t.Fatalf("MarshalJSON() error = %v, want nil", err)
+			}
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Fatalf("MarshalJSON() got = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestPluginTier_UnmarshalJSON(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		wantTier PluginTier
+		data     []byte
+		wantErr  bool
+	}{
+		{
+			name:     "unknown",
+			wantTier: PluginTierUnknown,
+			data:     []byte(`"unknown"`),
+		},
+		{
+			name:     "community",
+			wantTier: PluginTierCommunity,
+			data:     []byte(`"community"`),
+		},
+		{
+			name:     "partner",
+			wantTier: PluginTierPartner,
+			data:     []byte(`"partner"`),
+		},
+		{
+			name:     "offical",
+			wantTier: PluginTierOfficial,
+			data:     []byte(`"official"`),
+		},
+		{
+			name:     "unsupported",
+			wantTier: PluginTierUnknown,
+			data:     []byte(`"foo"`),
+			wantErr:  true,
+		},
+		// The following test cases ensures new plugin tiers are added at the end of the enum list
+		// Inserting a new plugin tier in the middle of the enum list will fail
+		// New plugin tiers should be added at the end of the test case list
+		{
+			name:     "0-unknown",
+			wantTier: PluginTierUnknown,
+			data:     []byte(`0`),
+		},
+		{
+			name:     "1-community",
+			wantTier: PluginTierCommunity,
+			data:     []byte(`1`),
+		},
+		{
+			name:     "2-partner",
+			wantTier: PluginTierPartner,
+			data:     []byte(`2`),
+		},
+		{
+			name:     "3-official",
+			wantTier: PluginTierOfficial,
+			data:     []byte(`3`),
+		},
+		{
+			name:    "tier number unsupported",
+			data:    []byte(`2345678`),
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var tier PluginTier
+			err := tier.UnmarshalJSON(tt.data)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("UnmarshalJSON() error = %v, wantErr %v", err, tt.wantErr)
+			}
+			if !tt.wantErr && tier != tt.wantTier {
+				t.Fatalf("UnmarshalJSON() got = %v, want %v", tier, tt.wantTier)
+			}
+		})
+	}
+}
+
+// TestPluginTierJSONRoundTrip tests that PluginTier can be marshaled and unmarshaled
+// to/from JSON in a round trip.
+func TestPluginTierJSONRoundTrip(t *testing.T) {
+	type testTier struct {
+		PluginTier PluginTier `json:"plugin_tier"`
+	}
+
+	for _, tier := range PluginTiers {
+		t.Run(tier.String(), func(t *testing.T) {
+			original := testTier{
+				PluginTier: tier,
+			}
+			asBytes, err := json.Marshal(original)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			var roundTripped testTier
+			err = json.Unmarshal(asBytes, &roundTripped)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			if original != roundTripped {
+				t.Fatalf("expected %v, got %v", original, roundTripped)
+			}
+		})
+	}
+}
+
+func TestUnknownTierExcludedWithOmitEmpty(t *testing.T) {
+	type testTierOmitEmpty struct {
+		Type PluginTier `json:"tier,omitempty"`
+	}
+	bytes, err := json.Marshal(testTierOmitEmpty{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	m := map[string]any{}
+	json.Unmarshal(bytes, &m)
+	if _, exists := m["tier"]; exists {
+		t.Fatal("tier should not be present")
+	}
+}
diff --git a/sdk/helper/consts/plugin_types.go b/sdk/helper/consts/plugin_types.go
index a7a38382731..00788097186 100644
--- a/sdk/helper/consts/plugin_types.go
+++ b/sdk/helper/consts/plugin_types.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package consts
diff --git a/sdk/helper/consts/plugin_types_test.go b/sdk/helper/consts/plugin_types_test.go
index ff1299f2e46..e30c26f80c4 100644
--- a/sdk/helper/consts/plugin_types_test.go
+++ b/sdk/helper/consts/plugin_types_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package consts
diff --git a/sdk/helper/consts/pluginruntimetype_enumer.go b/sdk/helper/consts/pluginruntimetype_enumer.go
new file mode 100644
index 00000000000..337afc29c3e
--- /dev/null
+++ b/sdk/helper/consts/pluginruntimetype_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=PluginRuntimeType -trimprefix=PluginRuntimeType -transform=snake"; DO NOT EDIT.
+
+package consts
+
+import (
+	"fmt"
+)
+
+const _PluginRuntimeTypeName = "unsupportedcontainer"
+
+var _PluginRuntimeTypeIndex = [...]uint8{0, 11, 20}
+
+func (i PluginRuntimeType) String() string {
+	i -= 1
+	if i >= PluginRuntimeType(len(_PluginRuntimeTypeIndex)-1) {
+		return fmt.Sprintf("PluginRuntimeType(%d)", i+1)
+	}
+	return _PluginRuntimeTypeName[_PluginRuntimeTypeIndex[i]:_PluginRuntimeTypeIndex[i+1]]
+}
+
+var _PluginRuntimeTypeValues = []PluginRuntimeType{1, 2}
+
+var _PluginRuntimeTypeNameToValueMap = map[string]PluginRuntimeType{
+	_PluginRuntimeTypeName[0:11]:  1,
+	_PluginRuntimeTypeName[11:20]: 2,
+}
+
+// PluginRuntimeTypeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func PluginRuntimeTypeString(s string) (PluginRuntimeType, error) {
+	if val, ok := _PluginRuntimeTypeNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to PluginRuntimeType values", s)
+}
+
+// PluginRuntimeTypeValues returns all values of the enum
+func PluginRuntimeTypeValues() []PluginRuntimeType {
+	return _PluginRuntimeTypeValues
+}
+
+// IsAPluginRuntimeType returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i PluginRuntimeType) IsAPluginRuntimeType() bool {
+	for _, v := range _PluginRuntimeTypeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdk/helper/consts/proxy.go b/sdk/helper/consts/proxy.go
index 0fc4117ccc1..53227e5fea9 100644
--- a/sdk/helper/consts/proxy.go
+++ b/sdk/helper/consts/proxy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package consts
diff --git a/sdk/helper/consts/replication.go b/sdk/helper/consts/replication.go
index 2a1511a9a93..c356acc6289 100644
--- a/sdk/helper/consts/replication.go
+++ b/sdk/helper/consts/replication.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package consts
@@ -20,6 +20,7 @@ const (
 	// ids to ensure it doesn't collide.
 	CurrentReplicatedSecondaryIdentifier = ".current"
 	CoreFeatureFlagPath                  = "core/cluster/feature-flags"
+	CoreDevelopmentClusterPath           = "core/reporting/development-cluster"
 )
 
 type ReplicationState uint32
diff --git a/sdk/helper/consts/token_consts.go b/sdk/helper/consts/token_consts.go
index 108e7ba42d7..c3d33fe7314 100644
--- a/sdk/helper/consts/token_consts.go
+++ b/sdk/helper/consts/token_consts.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package consts
diff --git a/sdk/helper/cryptoutil/cryptoutil.go b/sdk/helper/cryptoutil/cryptoutil.go
index 956dad34087..fdf41a696a8 100644
--- a/sdk/helper/cryptoutil/cryptoutil.go
+++ b/sdk/helper/cryptoutil/cryptoutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package cryptoutil
diff --git a/sdk/helper/cryptoutil/cryptoutil_test.go b/sdk/helper/cryptoutil/cryptoutil_test.go
index 35799e42a2e..1e1d0cf705b 100644
--- a/sdk/helper/cryptoutil/cryptoutil_test.go
+++ b/sdk/helper/cryptoutil/cryptoutil_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package cryptoutil
diff --git a/sdk/helper/cryptoutil/rsa.go b/sdk/helper/cryptoutil/rsa.go
new file mode 100644
index 00000000000..44f6be4016d
--- /dev/null
+++ b/sdk/helper/cryptoutil/rsa.go
@@ -0,0 +1,34 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package cryptoutil
+
+import (
+	"crypto/rsa"
+	"io"
+	"os"
+
+	"github.com/hashicorp/go-secure-stdlib/cryptoutil"
+	"github.com/hashicorp/vault/sdk/helper/parseutil"
+)
+
+var disabled bool
+
+func init() {
+	s := os.Getenv("VAULT_DISABLE_RSA_DRBG")
+	var err error
+	disabled, err = parseutil.ParseBool(s)
+	if err != nil {
+		// Assume it's a typo and disable
+		disabled = true
+	}
+}
+
+// Uses go-secure-stdlib's GenerateRSAKey routine conditionally.  This exists to be able to disable the feature
+// via an ENV var in a pinch
+func GenerateRSAKey(randomSource io.Reader, bits int) (*rsa.PrivateKey, error) {
+	if disabled {
+		return rsa.GenerateKey(randomSource, bits)
+	}
+	return cryptoutil.GenerateRSAKey(randomSource, bits)
+}
diff --git a/sdk/helper/custommetadata/custom_metadata.go b/sdk/helper/custommetadata/custom_metadata.go
index d33370b510b..1e5d35ce366 100644
--- a/sdk/helper/custommetadata/custom_metadata.go
+++ b/sdk/helper/custommetadata/custom_metadata.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package custommetadata
diff --git a/sdk/helper/custommetadata/custom_metadata_test.go b/sdk/helper/custommetadata/custom_metadata_test.go
index 2b25d991203..d86bac2b2de 100644
--- a/sdk/helper/custommetadata/custom_metadata_test.go
+++ b/sdk/helper/custommetadata/custom_metadata_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package custommetadata
diff --git a/sdk/helper/dbtxn/dbtxn.go b/sdk/helper/dbtxn/dbtxn.go
index 12288d5b37c..19247f4115a 100644
--- a/sdk/helper/dbtxn/dbtxn.go
+++ b/sdk/helper/dbtxn/dbtxn.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package dbtxn
diff --git a/sdk/helper/docker/testhelpers.go b/sdk/helper/docker/testhelpers.go
index 40f269665da..8679180cef1 100644
--- a/sdk/helper/docker/testhelpers.go
+++ b/sdk/helper/docker/testhelpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package docker
@@ -12,7 +12,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"strconv"
@@ -20,10 +19,11 @@ import (
 	"sync"
 	"time"
 
-	"github.com/cenkalti/backoff/v3"
+	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/strslice"
@@ -79,7 +79,7 @@ func NewServiceRunner(opts RunOptions) (*Runner, error) {
 		opts.NetworkName = os.Getenv("TEST_DOCKER_NETWORK_NAME")
 	}
 	if opts.NetworkName != "" {
-		nets, err := dapi.NetworkList(context.TODO(), types.NetworkListOptions{
+		nets, err := dapi.NetworkList(context.TODO(), network.ListOptions{
 			Filters: filters.NewArgs(filters.Arg("name", opts.NetworkName)),
 		})
 		if err != nil {
@@ -207,7 +207,7 @@ var _ io.Writer = &LogConsumerWriter{}
 func (d *Runner) StartNewService(ctx context.Context, addSuffix, forceLocalAddr bool, connect ServiceAdapter) (*Service, string, error) {
 	if d.RunOptions.PreDelete {
 		name := d.RunOptions.ContainerName
-		matches, err := d.DockerAPI.ContainerList(ctx, types.ContainerListOptions{
+		matches, err := d.DockerAPI.ContainerList(ctx, container.ListOptions{
 			All: true,
 			// TODO use labels to ensure we don't delete anything we shouldn't
 			Filters: filters.NewArgs(
@@ -218,7 +218,7 @@ func (d *Runner) StartNewService(ctx context.Context, addSuffix, forceLocalAddr
 			return nil, "", fmt.Errorf("failed to list containers named %q", name)
 		}
 		for _, cont := range matches {
-			err = d.DockerAPI.ContainerRemove(ctx, cont.ID, types.ContainerRemoveOptions{Force: true})
+			err = d.DockerAPI.ContainerRemove(ctx, cont.ID, container.RemoveOptions{Force: true})
 			if err != nil {
 				return nil, "", fmt.Errorf("failed to pre-delete container named %q", name)
 			}
@@ -256,7 +256,7 @@ func (d *Runner) StartNewService(ctx context.Context, addSuffix, forceLocalAddr
 
 	cleanup := func() {
 		for i := 0; i < 10; i++ {
-			err := d.DockerAPI.ContainerRemove(ctx, result.Container.ID, types.ContainerRemoveOptions{Force: true})
+			err := d.DockerAPI.ContainerRemove(ctx, result.Container.ID, container.RemoveOptions{Force: true})
 			if err == nil || client.IsErrNotFound(err) {
 				return
 			}
@@ -328,7 +328,7 @@ func (d *Runner) createLogConsumer(containerId string, wg *sync.WaitGroup) func(
 func (d *Runner) consumeLogs(containerId string, wg *sync.WaitGroup, logStdout, logStderr io.Writer) {
 	// We must run inside a goroutine because we're using Follow:true,
 	// and StdCopy will block until the log stream is closed.
-	stream, err := d.DockerAPI.ContainerLogs(context.Background(), containerId, types.ContainerLogsOptions{
+	stream, err := d.DockerAPI.ContainerLogs(context.Background(), containerId, container.LogsOptions{
 		ShowStdout: true,
 		ShowStderr: true,
 		Timestamps: !d.RunOptions.OmitLogTimestamps,
@@ -369,9 +369,15 @@ func (d *Runner) Start(ctx context.Context, addSuffix, forceLocalAddr bool) (*St
 		name += "-" + suffix
 	}
 
+	ref := fmt.Sprintf("%s:%s", d.RunOptions.ImageRepo, d.RunOptions.ImageTag)
+	if strings.Contains(d.RunOptions.ImageTag, ":") {
+		// Handle "tags" that are actually references with a digest, e.g. repo:sha256:1234abcd...
+		ref = fmt.Sprintf("%s@%s", d.RunOptions.ImageRepo, d.RunOptions.ImageTag)
+	}
+
 	cfg := &container.Config{
 		Hostname: name,
-		Image:    fmt.Sprintf("%s:%s", d.RunOptions.ImageRepo, d.RunOptions.ImageTag),
+		Image:    ref,
 		Env:      d.RunOptions.Env,
 		Cmd:      d.RunOptions.Cmd,
 	}
@@ -401,7 +407,7 @@ func (d *Runner) Start(ctx context.Context, addSuffix, forceLocalAddr bool) (*St
 	}
 
 	// best-effort pull
-	var opts types.ImageCreateOptions
+	var opts image.CreateOptions
 	if d.RunOptions.AuthUsername != "" && d.RunOptions.AuthPassword != "" {
 		var buf bytes.Buffer
 		auth := map[string]string{
@@ -415,7 +421,7 @@ func (d *Runner) Start(ctx context.Context, addSuffix, forceLocalAddr bool) (*St
 	}
 	resp, _ := d.DockerAPI.ImageCreate(ctx, cfg.Image, opts)
 	if resp != nil {
-		_, _ = ioutil.ReadAll(resp)
+		_, _ = io.ReadAll(resp)
 	}
 
 	for vol, mtpt := range d.RunOptions.VolumeNameToMountPoint {
@@ -434,20 +440,20 @@ func (d *Runner) Start(ctx context.Context, addSuffix, forceLocalAddr bool) (*St
 
 	for from, to := range d.RunOptions.CopyFromTo {
 		if err := copyToContainer(ctx, d.DockerAPI, c.ID, from, to); err != nil {
-			_ = d.DockerAPI.ContainerRemove(ctx, c.ID, types.ContainerRemoveOptions{})
+			_ = d.DockerAPI.ContainerRemove(ctx, c.ID, container.RemoveOptions{})
 			return nil, err
 		}
 	}
 
-	err = d.DockerAPI.ContainerStart(ctx, c.ID, types.ContainerStartOptions{})
+	err = d.DockerAPI.ContainerStart(ctx, c.ID, container.StartOptions{})
 	if err != nil {
-		_ = d.DockerAPI.ContainerRemove(ctx, c.ID, types.ContainerRemoveOptions{})
+		_ = d.DockerAPI.ContainerRemove(ctx, c.ID, container.RemoveOptions{})
 		return nil, fmt.Errorf("container start failed: %v", err)
 	}
 
 	inspect, err := d.DockerAPI.ContainerInspect(ctx, c.ID)
 	if err != nil {
-		_ = d.DockerAPI.ContainerRemove(ctx, c.ID, types.ContainerRemoveOptions{})
+		_ = d.DockerAPI.ContainerRemove(ctx, c.ID, container.RemoveOptions{})
 		return nil, err
 	}
 
@@ -492,7 +498,7 @@ func (d *Runner) RefreshFiles(ctx context.Context, containerID string) error {
 	for from, to := range d.RunOptions.CopyFromTo {
 		if err := copyToContainer(ctx, d.DockerAPI, containerID, from, to); err != nil {
 			// TODO too drastic?
-			_ = d.DockerAPI.ContainerRemove(ctx, containerID, types.ContainerRemoveOptions{})
+			_ = d.DockerAPI.ContainerRemove(ctx, containerID, container.RemoveOptions{})
 			return err
 		}
 	}
@@ -534,7 +540,7 @@ func (d *Runner) RestartContainerWithTimeout(ctx context.Context, containerID st
 }
 
 func (d *Runner) Restart(ctx context.Context, containerID string) error {
-	if err := d.DockerAPI.ContainerStart(ctx, containerID, types.ContainerStartOptions{}); err != nil {
+	if err := d.DockerAPI.ContainerStart(ctx, containerID, container.StartOptions{}); err != nil {
 		return err
 	}
 
@@ -564,7 +570,7 @@ func copyToContainer(ctx context.Context, dapi *client.Client, containerID, from
 		return fmt.Errorf("error preparing copy from %q -> %q: %v", from, to, err)
 	}
 	defer content.Close()
-	err = dapi.CopyToContainer(ctx, containerID, dstDir, content, types.CopyToContainerOptions{})
+	err = dapi.CopyToContainer(ctx, containerID, dstDir, content, container.CopyToContainerOptions{})
 	if err != nil {
 		return fmt.Errorf("error copying from %q -> %q: %v", from, to, err)
 	}
@@ -573,14 +579,14 @@ func copyToContainer(ctx context.Context, dapi *client.Client, containerID, from
 }
 
 type RunCmdOpt interface {
-	Apply(cfg *types.ExecConfig) error
+	Apply(cfg *container.ExecOptions) error
 }
 
 type RunCmdUser string
 
 var _ RunCmdOpt = (*RunCmdUser)(nil)
 
-func (u RunCmdUser) Apply(cfg *types.ExecConfig) error {
+func (u RunCmdUser) Apply(cfg *container.ExecOptions) error {
 	cfg.User = string(u)
 	return nil
 }
@@ -589,8 +595,8 @@ func (d *Runner) RunCmdWithOutput(ctx context.Context, container string, cmd []s
 	return RunCmdWithOutput(d.DockerAPI, ctx, container, cmd, opts...)
 }
 
-func RunCmdWithOutput(api *client.Client, ctx context.Context, container string, cmd []string, opts ...RunCmdOpt) ([]byte, []byte, int, error) {
-	runCfg := types.ExecConfig{
+func RunCmdWithOutput(api *client.Client, ctx context.Context, containerID string, cmd []string, opts ...RunCmdOpt) ([]byte, []byte, int, error) {
+	runCfg := container.ExecOptions{
 		AttachStdout: true,
 		AttachStderr: true,
 		Cmd:          cmd,
@@ -602,12 +608,12 @@ func RunCmdWithOutput(api *client.Client, ctx context.Context, container string,
 		}
 	}
 
-	ret, err := api.ContainerExecCreate(ctx, container, runCfg)
+	ret, err := api.ContainerExecCreate(ctx, containerID, runCfg)
 	if err != nil {
 		return nil, nil, -1, fmt.Errorf("error creating execution environment: %v\ncfg: %v\n", err, runCfg)
 	}
 
-	resp, err := api.ContainerExecAttach(ctx, ret.ID, types.ExecStartCheck{})
+	resp, err := api.ContainerExecAttach(ctx, ret.ID, container.ExecAttachOptions{})
 	if err != nil {
 		return nil, nil, -1, fmt.Errorf("error attaching to command execution: %v\ncfg: %v\nret: %v\n", err, runCfg, ret)
 	}
@@ -635,8 +641,8 @@ func (d *Runner) RunCmdInBackground(ctx context.Context, container string, cmd [
 	return RunCmdInBackground(d.DockerAPI, ctx, container, cmd, opts...)
 }
 
-func RunCmdInBackground(api *client.Client, ctx context.Context, container string, cmd []string, opts ...RunCmdOpt) (string, error) {
-	runCfg := types.ExecConfig{
+func RunCmdInBackground(api *client.Client, ctx context.Context, containerID string, cmd []string, opts ...RunCmdOpt) (string, error) {
+	runCfg := container.ExecOptions{
 		AttachStdout: true,
 		AttachStderr: true,
 		Cmd:          cmd,
@@ -648,12 +654,12 @@ func RunCmdInBackground(api *client.Client, ctx context.Context, container strin
 		}
 	}
 
-	ret, err := api.ContainerExecCreate(ctx, container, runCfg)
+	ret, err := api.ContainerExecCreate(ctx, containerID, runCfg)
 	if err != nil {
 		return "", fmt.Errorf("error creating execution environment: %w\ncfg: %v\n", err, runCfg)
 	}
 
-	err = api.ContainerExecStart(ctx, ret.ID, types.ExecStartCheck{})
+	err = api.ContainerExecStart(ctx, ret.ID, container.ExecStartOptions{})
 	if err != nil {
 		return "", fmt.Errorf("error starting command execution: %w\ncfg: %v\nret: %v\n", err, runCfg, ret)
 	}
@@ -880,10 +886,10 @@ func BuildImage(ctx context.Context, api *client.Client, containerfile string, c
 	return output, nil
 }
 
-func (d *Runner) CopyTo(container string, destination string, contents BuildContext) error {
+func (d *Runner) CopyTo(containerID string, destination string, contents BuildContext) error {
 	// XXX: currently we use the default options but we might want to allow
 	// modifying cfg.CopyUIDGID in the future.
-	var cfg types.CopyToContainerOptions
+	var cfg container.CopyToContainerOptions
 
 	// Convert our provided contents to a tarball to ship up.
 	tar, err := contents.ToTarball()
@@ -891,10 +897,10 @@ func (d *Runner) CopyTo(container string, destination string, contents BuildCont
 		return fmt.Errorf("failed to build contents into tarball: %v", err)
 	}
 
-	return d.DockerAPI.CopyToContainer(context.Background(), container, destination, tar, cfg)
+	return d.DockerAPI.CopyToContainer(context.Background(), containerID, destination, tar, cfg)
 }
 
-func (d *Runner) CopyFrom(container string, source string) (BuildContext, *types.ContainerPathStat, error) {
+func (d *Runner) CopyFrom(container string, source string) (BuildContext, *container.PathStat, error) {
 	reader, stat, err := d.DockerAPI.CopyFromContainer(context.Background(), container, source)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to read %v from container: %v", source, err)
diff --git a/sdk/helper/errutil/error.go b/sdk/helper/errutil/error.go
index 1866343b518..71fa43a4359 100644
--- a/sdk/helper/errutil/error.go
+++ b/sdk/helper/errutil/error.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package errutil
diff --git a/sdk/helper/hclutil/hcl.go b/sdk/helper/hclutil/hcl.go
index a78d820087d..fccc55bd604 100644
--- a/sdk/helper/hclutil/hcl.go
+++ b/sdk/helper/hclutil/hcl.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package hclutil
diff --git a/sdk/helper/identitytpl/templating.go b/sdk/helper/identitytpl/templating.go
index 4cbf1e22f07..303a8649a5c 100644
--- a/sdk/helper/identitytpl/templating.go
+++ b/sdk/helper/identitytpl/templating.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package identitytpl
diff --git a/sdk/helper/identitytpl/templating_test.go b/sdk/helper/identitytpl/templating_test.go
index d17409e78ae..269ec6444ed 100644
--- a/sdk/helper/identitytpl/templating_test.go
+++ b/sdk/helper/identitytpl/templating_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package identitytpl
diff --git a/sdk/helper/jsonutil/json.go b/sdk/helper/jsonutil/json.go
index 1abd9fafebd..2bc63a5348b 100644
--- a/sdk/helper/jsonutil/json.go
+++ b/sdk/helper/jsonutil/json.go
@@ -1,20 +1,24 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package jsonutil
 
 import (
+	"bufio"
 	"bytes"
 	"compress/gzip"
 	"encoding/json"
 	"fmt"
 	"io"
+	"strconv"
+	"strings"
+	"unicode"
 
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/vault/sdk/helper/compressutil"
 )
 
-// Encodes/Marshals the given object into JSON
+// EncodeJSON encodes/marshals the given object into JSON
 func EncodeJSON(in interface{}) ([]byte, error) {
 	if in == nil {
 		return nil, fmt.Errorf("input for encoding is nil")
@@ -84,7 +88,7 @@ func DecodeJSON(data []byte, out interface{}) error {
 	return DecodeJSONFromReader(bytes.NewReader(data), out)
 }
 
-// Decodes/Unmarshals the given io.Reader pointing to a JSON, into a desired object
+// DecodeJSONFromReader Decodes/Unmarshals the given io.Reader pointing to a JSON, into a desired object
 func DecodeJSONFromReader(r io.Reader, out interface{}) error {
 	if r == nil {
 		return fmt.Errorf("'io.Reader' being decoded is nil")
@@ -101,3 +105,462 @@ func DecodeJSONFromReader(r io.Reader, out interface{}) error {
 	// Since 'out' is an interface representing a pointer, pass it to the decoder without an '&'
 	return dec.Decode(out)
 }
+
+// containerState holds information about an open JSON container (object or array).
+type containerState struct {
+	// '{' or '['
+	Type json.Delim
+
+	// Number of entries (for objects) or elements for arrays)
+	Count int
+
+	// isKey is true if the next expected token in an object is a key.
+	isKey bool
+
+	// keys tracks the keys seen in an object to detect duplicates.
+	// It is only initialized for objects ('{').
+	keys map[string]struct{}
+}
+
+// JSONLimits defines the configurable limits for JSON validation.
+type JSONLimits struct {
+	MaxDepth             int
+	MaxStringValueLength int
+	MaxObjectEntryCount  int
+	MaxArrayElementCount int
+	MaxTokens            int
+}
+
+// isWhitespace checks if a byte is a JSON whitespace character.
+func isWhitespace(b byte) bool {
+	// Standard JSON whitespace characters (RFC 8259)
+	if b == ' ' || b == '\t' || b == '\n' || b == '\r' {
+		return true
+	}
+	// Custom support for non-standard Unit Separator character (ASCII 31)
+	if b == 31 || b == 139 {
+		return true
+	}
+	return false
+}
+
+// defaultBufferSize is the default size for the bufio.Reader buffer
+const defaultBufferSize = int64(4096)
+
+// VerifyMaxDepthStreaming scans the JSON stream to enforce nesting depth, counts,
+// and other limits without decoding the full structure into memory.
+func VerifyMaxDepthStreaming(jsonReader io.Reader, limits JSONLimits, maxRequestSize *int64) (int, error) {
+	// If the default buffer size is larger than the max request size, use the max request size
+	// for the buffer to avoid over-reading.
+	bufferSize := defaultBufferSize
+	if maxRequestSize != nil && *maxRequestSize < defaultBufferSize {
+		bufferSize = *maxRequestSize
+	}
+	// Use a buffered reader to peek at the stream
+	bufReader := bufio.NewReaderSize(jsonReader, int(bufferSize))
+
+	bom, err := bufReader.Peek(3)
+	if err == nil && bytes.Equal(bom, []byte{0xEF, 0xBB, 0xBF}) {
+		_, _ = bufReader.Discard(3)
+	}
+
+	// We use a manual token loop instead of json.Decoder to gain low-level
+	// control over the stream. This is necessary to fix a vulnerability where
+	// the raw byte length of strings with escape sequences was not correctly limited.
+	var (
+		maxDepth          int
+		currentDepth      int
+		tokenCount        int
+		lastTokenWasComma bool
+	)
+	containerInfoStack := make([]containerState, 0, limits.MaxDepth)
+
+	// Prime the loop by finding the first non-whitespace character.
+	if err := skipWhitespace(bufReader); err != nil {
+		if err == io.EOF {
+			// An empty payload or one with only whitespace is valid. Skip verification.
+			return 0, nil
+		}
+		return 0, err
+	}
+
+	b, err := bufReader.Peek(1)
+	if err != nil {
+		// This can happen if there's an I/O error after skipping whitespace.
+		return 0, err
+	}
+
+	// If the payload doesn't start with a JSON container ('{' or '['), skip
+	// verification. The limits are intended for structured data, not primitives
+	// or other formats.
+	if b[0] != '{' && b[0] != '[' {
+		return 0, nil
+	}
+
+	for {
+		// Check for EOF before peeking.
+		b, err := bufReader.Peek(1)
+		// Any error from the decoder is now considered a real error.
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return 0, fmt.Errorf("error reading JSON token: %w", err)
+		}
+
+		// If the last token was a comma, the next token cannot be a closing delimiter.
+		if lastTokenWasComma && (b[0] == '}' || b[0] == ']') {
+			if b[0] == '}' {
+				return 0, fmt.Errorf("invalid character '}' after object key-value pair")
+			}
+			return 0, fmt.Errorf("invalid character ']' after array element")
+		}
+
+		// After a top-level value, any other character is an error.
+		if len(containerInfoStack) == 0 && maxDepth > 0 {
+			return 0, fmt.Errorf("invalid character '%c' after top-level value", b[0])
+		}
+
+		// Increment and check the total token count limit.
+		if limits.MaxTokens > 0 {
+			tokenCount++
+			if tokenCount > limits.MaxTokens {
+				return 0, fmt.Errorf("JSON payload exceeds allowed token count")
+			}
+		}
+
+		var currentContainer *containerState
+		if len(containerInfoStack) > 0 {
+			currentContainer = &containerInfoStack[len(containerInfoStack)-1]
+		}
+
+		// Before processing the token, reset the comma flag. It will be set
+		// again below if the current token is a comma.
+		lastTokenWasComma = false
+
+		switch b[0] {
+		case '{', '[':
+			delim, _ := bufReader.ReadByte()
+			if currentContainer != nil {
+				if currentContainer.Type == '[' {
+					currentContainer.Count++
+					if currentContainer.Count > limits.MaxArrayElementCount {
+						return 0, fmt.Errorf("JSON array exceeds allowed element count")
+					}
+				} else {
+					currentContainer.isKey = true
+				}
+			}
+
+			// Handle depth checks and tracking together for clarity.
+			currentDepth++
+			if currentDepth > maxDepth {
+				maxDepth = currentDepth
+			}
+			// Check depth limit immediately after incrementing.
+			if limits.MaxDepth > 0 && currentDepth > limits.MaxDepth {
+				return 0, fmt.Errorf("JSON input exceeds allowed nesting depth")
+			}
+
+			// For objects, initialize a map to track keys and prevent duplicates.
+			var keys map[string]struct{}
+			if delim == '{' {
+				keys = make(map[string]struct{})
+			}
+
+			containerInfoStack = append(containerInfoStack, containerState{Type: json.Delim(delim), isKey: delim == '{', keys: keys})
+
+		case '}', ']':
+			// A closing brace cannot follow a colon without a value.
+			if currentContainer != nil && currentContainer.Type == '{' && !currentContainer.isKey {
+				return 0, fmt.Errorf("invalid character '}' after object key")
+			}
+			delim, _ := bufReader.ReadByte()
+			if currentContainer == nil {
+				return 0, fmt.Errorf("malformed JSON: unmatched closing delimiter '%c'", delim)
+			}
+			if (delim == '}' && currentContainer.Type != '{') || (delim == ']' && currentContainer.Type != '[') {
+				return 0, fmt.Errorf("malformed JSON: mismatched closing delimiter '%c'", delim)
+			}
+			containerInfoStack = containerInfoStack[:len(containerInfoStack)-1]
+			currentDepth--
+			if len(containerInfoStack) > 0 && containerInfoStack[len(containerInfoStack)-1].Type == '{' {
+				containerInfoStack[len(containerInfoStack)-1].isKey = true
+			}
+
+		case '"':
+			// Manually scan the string to count its raw byte length and get the value.
+			val, err := scanString(bufReader, limits.MaxStringValueLength)
+			if err != nil {
+				return 0, err
+			}
+
+			if currentContainer == nil {
+				if maxDepth == 0 {
+					maxDepth = 1
+				}
+				break
+			}
+
+			if currentContainer.Type == '{' {
+				if currentContainer.isKey {
+					// Check for duplicate keys.
+					if _, ok := currentContainer.keys[val]; ok {
+						return 0, fmt.Errorf("duplicate key '%s' in object", val)
+					}
+					currentContainer.keys[val] = struct{}{}
+
+					currentContainer.Count++
+					if currentContainer.Count > limits.MaxObjectEntryCount {
+						return 0, fmt.Errorf("JSON object exceeds allowed entry count")
+					}
+					currentContainer.isKey = false
+				} else {
+					currentContainer.isKey = true
+				}
+			} else {
+				currentContainer.Count++
+				if currentContainer.Count > limits.MaxArrayElementCount {
+					return 0, fmt.Errorf("JSON array exceeds allowed element count")
+				}
+			}
+
+		case 't', 'f', 'n': // true, false, null
+			if err := scanLiteral(bufReader); err != nil {
+				return 0, err
+			}
+			if currentContainer == nil {
+				if maxDepth == 0 {
+					maxDepth = 1
+				}
+				break
+			}
+			if currentContainer.Type == '[' {
+				currentContainer.Count++
+				if currentContainer.Count > limits.MaxArrayElementCount {
+					return 0, fmt.Errorf("JSON array exceeds allowed element count")
+				}
+			} else {
+				currentContainer.isKey = true
+			}
+		case '-', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9':
+			if err := scanNumber(bufReader, limits.MaxStringValueLength); err != nil {
+				return 0, err
+			}
+			if currentContainer == nil {
+				if maxDepth == 0 {
+					maxDepth = 1
+				}
+				break
+			}
+			if currentContainer.Type == '[' {
+				currentContainer.Count++
+				if currentContainer.Count > limits.MaxArrayElementCount {
+					return 0, fmt.Errorf("JSON array exceeds allowed element count")
+				}
+			} else {
+				currentContainer.isKey = true
+			}
+
+		case ',':
+			_, _ = bufReader.ReadByte()
+			lastTokenWasComma = true
+			if currentContainer != nil && currentContainer.Type == '{' {
+				currentContainer.isKey = true
+			}
+
+		case ':':
+			_, _ = bufReader.ReadByte()
+
+		default:
+			return 0, fmt.Errorf("invalid character '%c' looking for beginning of value", b[0])
+		}
+
+		if err := skipWhitespace(bufReader); err != nil {
+			if err == io.EOF {
+				break
+			}
+			return 0, err
+		}
+	}
+
+	if len(containerInfoStack) != 0 {
+		return 0, fmt.Errorf("malformed JSON, unclosed containers")
+	}
+
+	return maxDepth, nil
+}
+
+func skipWhitespace(r *bufio.Reader) error {
+	for {
+		b, err := r.Peek(1)
+		if err != nil {
+			return err
+		}
+		if !isWhitespace(b[0]) {
+			return nil
+		}
+		_, _ = r.ReadByte()
+	}
+}
+
+// scanString consumes a JSON string from the reader, ensuring the raw byte
+// length of its content does not exceed the limit. It returns the unescaped
+// string value.
+func scanString(r *bufio.Reader, limit int) (string, error) {
+	if b, _ := r.ReadByte(); b != '"' {
+		return "", fmt.Errorf("expected string")
+	}
+
+	var builder strings.Builder
+	contentByteCount := 0
+	var lastRune rune = -1 // Track the last rune for surrogate pair validation.
+
+	for {
+		b, err := r.ReadByte()
+		if err != nil {
+			if err == io.EOF {
+				return "", fmt.Errorf("malformed JSON, unclosed string")
+			}
+			return "", err
+		}
+
+		if b == '"' {
+			// Before successfully returning, ensure we didn't end on an unpaired high surrogate.
+			if lastRune >= 0xD800 && lastRune <= 0xDBFF {
+				return "", fmt.Errorf("malformed JSON, unterminated surrogate pair in string")
+			}
+			return builder.String(), nil
+		}
+
+		contentByteCount++
+		lastRune = -1 // Reset unless we parse a new rune.
+
+		if b == '\\' {
+			escaped, err := r.ReadByte()
+			if err != nil {
+				return "", fmt.Errorf("malformed JSON, unterminated escape sequence in string")
+			}
+			contentByteCount++
+
+			switch escaped {
+			case '"', '\\', '/':
+				builder.WriteByte(escaped)
+			case 'b':
+				builder.WriteByte('\b')
+			case 'f':
+				builder.WriteByte('\f')
+			case 'n':
+				builder.WriteByte('\n')
+			case 'r':
+				builder.WriteByte('\r')
+			case 't':
+				builder.WriteByte('\t')
+			case 'u':
+				hexChars := make([]byte, 4)
+				if _, err := io.ReadFull(r, hexChars); err != nil {
+					return "", fmt.Errorf("malformed JSON, unterminated unicode escape in string")
+				}
+				contentByteCount += 4
+
+				hexStr := string(hexChars)
+				for _, char := range hexStr {
+					if !((char >= '0' && char <= '9') || (char >= 'a' && char <= 'f') || (char >= 'A' && char <= 'F')) {
+						return "", fmt.Errorf("invalid character '%c' in string escape code", char)
+					}
+				}
+
+				code, _ := strconv.ParseUint(hexStr, 16, 32)
+				if code > unicode.MaxRune {
+					return "", fmt.Errorf("invalid unicode escape sequence: value out of range")
+				}
+
+				r := rune(code)
+				builder.WriteRune(r)
+				lastRune = r
+			default:
+				return "", fmt.Errorf("invalid character '%c' in string escape code", escaped)
+			}
+		} else {
+			builder.WriteByte(b)
+		}
+
+		if limit > 0 && contentByteCount > limit {
+			return "", fmt.Errorf("JSON string value exceeds allowed length")
+		}
+	}
+}
+
+func scanLiteral(r *bufio.Reader) error {
+	for {
+		b, err := r.Peek(1)
+		if err != nil {
+			// If we hit EOF after reading part of a literal, that's a clean end.
+			if err == io.EOF {
+				break
+			}
+			return err
+		}
+		if isWhitespace(b[0]) || b[0] == ',' || b[0] == '}' || b[0] == ']' {
+			return nil
+		}
+		_, _ = r.ReadByte()
+	}
+	return nil
+}
+
+func scanNumber(r *bufio.Reader, limit int) error {
+	var builder strings.Builder
+	byteCount := 0
+
+	// Peek at the first char to check for leading zero issues.
+	peeked, err := r.Peek(2)
+	if err == nil && len(peeked) > 1 {
+		if peeked[0] == '0' && peeked[1] >= '0' && peeked[1] <= '9' {
+			_, _ = r.ReadByte()
+			return fmt.Errorf("invalid character '%c' after top-level value", peeked[1])
+		}
+	}
+
+	for {
+		b, err := r.Peek(1)
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+			return err
+		}
+
+		char := b[0]
+		if isWhitespace(char) || char == ',' || char == '}' || char == ']' {
+			break
+		}
+
+		// A number token can contain only these characters.
+		isNumPart := (char >= '0' && char <= '9') || char == '.' || char == 'e' || char == 'E' || char == '+' || char == '-'
+		if !isNumPart {
+			// If it's not a valid number character, we stop scanning.
+			break
+		}
+
+		_, _ = r.ReadByte()
+		builder.WriteByte(char)
+		byteCount++
+		if limit > 0 && byteCount > limit {
+			return fmt.Errorf("JSON number value exceeds allowed length")
+		}
+	}
+
+	if byteCount == 0 {
+		return fmt.Errorf("malformed JSON, empty number")
+	}
+
+	// Use the standard library for a final, strict validation of the number's syntax.
+	// This correctly rejects malformed inputs like "-" or "123.".
+	numStr := builder.String()
+	if _, err := strconv.ParseFloat(numStr, 64); err != nil {
+		return fmt.Errorf("malformed JSON, invalid number syntax for '%s'", numStr)
+	}
+
+	return nil
+}
diff --git a/sdk/helper/jsonutil/json_test.go b/sdk/helper/jsonutil/json_test.go
index 10aabf1b93e..9db175d8c2a 100644
--- a/sdk/helper/jsonutil/json_test.go
+++ b/sdk/helper/jsonutil/json_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package jsonutil
@@ -7,11 +7,53 @@ import (
 	"bytes"
 	"compress/gzip"
 	"fmt"
+	"io"
+	"net/http"
 	"reflect"
 	"strings"
 	"testing"
 
 	"github.com/hashicorp/vault/sdk/helper/compressutil"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	// CustomMaxJSONDepth specifies the maximum nesting depth of a JSON object.
+	// This limit is designed to prevent stack exhaustion attacks from deeply
+	// nested JSON payloads, which could otherwise lead to a denial-of-service
+	// (DoS) vulnerability. The default value of 500 is intentionally generous
+	// to support complex but legitimate configurations, while still providing
+	// a safeguard against malicious or malformed input. This value is
+	// configurable to accommodate unique environmental requirements.
+	CustomMaxJSONDepth = 500
+
+	// CustomMaxJSONStringValueLength defines the maximum allowed length for a single
+	// string value within a JSON payload, in bytes. This is a critical defense
+	// against excessive memory allocation attacks where a client might send a
+	// very large string value to exhaust server memory. The default of 1MB
+	// (1024 * 1024 bytes) is chosen to comfortably accommodate large secrets
+	// such as private keys, certificate chains, or detailed configuration data,
+	// without permitting unbounded allocation. This value is configurable.
+	CustomMaxJSONStringValueLength = 1024 * 1024 // 1MB
+
+	// CustomMaxJSONObjectEntryCount sets the maximum number of key-value pairs
+	// allowed in a single JSON object. This limit helps mitigate the risk of
+	// hash-collision denial-of-service (HashDoS) attacks and prevents general
+	// resource exhaustion from parsing objects with an excessive number of
+	// entries. A default of 10,000 entries is well beyond the scope of typical
+	// Vault secrets or configurations, providing a high ceiling for normal
+	// operations while ensuring stability. This value is configurable.
+	CustomMaxJSONObjectEntryCount = 10000
+
+	// CustomMaxJSONArrayElementCount determines the maximum number of elements
+	// permitted in a single JSON array. This is particularly relevant for API
+	// endpoints that can return large lists, such as the result of a `LIST`
+	// operation on a secrets engine path. The default limit of 10,000 elements
+	// prevents a single request from causing excessive memory consumption. While
+	// most environments will fall well below this limit, it is configurable for
+	// systems that require handling larger datasets, though pagination is the
+	// recommended practice for such cases.
+	CustomMaxJSONArrayElementCount = 10000
 )
 
 func TestJSONUtil_CompressDecompressJSON(t *testing.T) {
@@ -59,7 +101,7 @@ func TestJSONUtil_CompressDecompressJSON(t *testing.T) {
 		t.Fatalf("expected a failure")
 	}
 
-	// Compress an object
+	// Compress an object with BestSpeed
 	compressedBytes, err = EncodeJSONAndCompress(expected, &compressutil.CompressionConfig{
 		Type:                 compressutil.CompressionTypeGzip,
 		GzipCompressionLevel: gzip.BestSpeed,
@@ -142,3 +184,615 @@ func TestJSONUtil_DecodeJSONFromReader(t *testing.T) {
 		t.Fatalf("bad: expected:%#v\nactual:%#v", expected, actual)
 	}
 }
+
+func TestJSONUtil_Limits_DefaultLimits(t *testing.T) {
+	tests := []struct {
+		name        string
+		jsonInput   string
+		expectError bool
+		errorMsg    string
+	}{
+		// Depth Limits
+		{
+			name:        "JSON exceeding max depth",
+			jsonInput:   generateComplexJSON(CustomMaxJSONDepth + 1),
+			expectError: true,
+			errorMsg:    "JSON input exceeds allowed nesting depth",
+		},
+		{
+			name:        "JSON at max allowed depth",
+			jsonInput:   generateComplexJSON(CustomMaxJSONDepth),
+			expectError: false,
+		},
+		// Malformed JSON
+		{
+			name:        "Malformed - Unmatched opening brace",
+			jsonInput:   `{"a": {`,
+			expectError: true,
+			errorMsg:    "malformed JSON, unclosed containers",
+		},
+		{
+			name:        "Malformed - Unmatched closing brace",
+			jsonInput:   `{}}`,
+			expectError: true,
+			errorMsg:    "invalid character '}' after top-level value",
+		},
+		// String Length Limits
+		{
+			name:        "String value exceeding max length",
+			jsonInput:   fmt.Sprintf(`{"key": "%s"}`, strings.Repeat("a", CustomMaxJSONStringValueLength+1)),
+			expectError: true,
+			errorMsg:    "JSON string value exceeds allowed length",
+		},
+		{
+			name:        "String at max length",
+			jsonInput:   fmt.Sprintf(`{"key": "%s"}`, strings.Repeat("a", CustomMaxJSONStringValueLength)),
+			expectError: false,
+		},
+		// Object Entry Count Limits
+		{
+			name:        "Object exceeding max entry count",
+			jsonInput:   fmt.Sprintf(`{%s}`, generateObjectEntries(CustomMaxJSONObjectEntryCount+1)),
+			expectError: true,
+			errorMsg:    "JSON object exceeds allowed entry count",
+		},
+		{
+			name:        "Object at max entry count",
+			jsonInput:   fmt.Sprintf(`{%s}`, generateObjectEntries(CustomMaxJSONObjectEntryCount)),
+			expectError: false,
+		},
+		// Array Element Count Limits
+		{
+			name:        "Array exceeding max element count",
+			jsonInput:   fmt.Sprintf(`[%s]`, generateArrayElements(CustomMaxJSONArrayElementCount+1)),
+			expectError: true,
+			errorMsg:    "JSON array exceeds allowed element count",
+		},
+		{
+			name:        "Array at max element count",
+			jsonInput:   fmt.Sprintf(`[%s]`, generateArrayElements(CustomMaxJSONArrayElementCount)),
+			expectError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			limits := JSONLimits{
+				MaxDepth:             CustomMaxJSONDepth,
+				MaxStringValueLength: CustomMaxJSONStringValueLength,
+				MaxObjectEntryCount:  CustomMaxJSONObjectEntryCount,
+				MaxArrayElementCount: CustomMaxJSONArrayElementCount,
+			}
+
+			_, err := VerifyMaxDepthStreaming(bytes.NewReader([]byte(tt.jsonInput)), limits, nil)
+
+			if tt.expectError {
+				require.Error(t, err, "expected an error but got nil")
+				require.Contains(t, err.Error(), tt.errorMsg, "error message mismatch")
+			} else {
+				require.NoError(t, err, "did not expect an error but got one")
+			}
+		})
+	}
+}
+
+func TestJSONUtil_Limits_ConfiguredLimits(t *testing.T) {
+	limits := JSONLimits{
+		MaxDepth:             64,
+		MaxStringValueLength: 1024,
+		MaxObjectEntryCount:  3,
+		MaxArrayElementCount: 3,
+		MaxTokens:            20,
+	}
+
+	bom := []byte{0xEF, 0xBB, 0xBF}
+
+	tests := []struct {
+		name     string
+		payload  []byte
+		errorMsg string
+	}{
+		{
+			name:     "object entries with string values",
+			payload:  []byte(`{"k0":"v0","k1":"v1","k2":"v2","k3":"v3"}`),
+			errorMsg: "JSON object exceeds allowed entry count",
+		},
+		{
+			name:     "object entries with array values",
+			payload:  []byte(`{"k0":[],"k1":[],"k2":[],"k3":[]}`),
+			errorMsg: "JSON object exceeds allowed entry count",
+		},
+		{
+			name:     "object entries with object values",
+			payload:  []byte(`{"k0":{},"k1":{},"k2":{},"k3":{}}`),
+			errorMsg: "JSON object exceeds allowed entry count",
+		},
+		{
+			name:     "array elements as objects",
+			payload:  []byte(`[{}, {}, {}, {}]`),
+			errorMsg: "JSON array exceeds allowed element count",
+		},
+		{
+			name:     "BOM-prefixed over-limit object",
+			payload:  append(bom, []byte(`{"k0":"v0","k1":"v1","k2":"v2","k3":"v3"}`)...),
+			errorMsg: "JSON object exceeds allowed entry count",
+		},
+		{
+			name:     "object key exceeds string length limit",
+			payload:  []byte(fmt.Sprintf(`{"%s": 0}`, strings.Repeat("a", limits.MaxStringValueLength+1))),
+			errorMsg: "JSON string value exceeds allowed length",
+		},
+		{
+			name:     "trailing data after valid JSON",
+			payload:  []byte(`{"k0":"v0"} "invalid"`),
+			errorMsg: "invalid character '\"' after top-level value",
+		},
+		{
+			name:     "object with embedded null byte in key",
+			payload:  []byte(`{"k0\u0000":0, "k1":1, "k2":2, "k3":3}`),
+			errorMsg: "JSON object exceeds allowed entry count",
+		},
+		{
+			name:     "incomplete JSON stream",
+			payload:  []byte(`{"k0":"v0",`),
+			errorMsg: "malformed JSON, unclosed containers",
+		},
+		{
+			name:     "deeply nested object exceeds depth limit",
+			payload:  []byte(strings.Repeat(`{"a":`, limits.MaxDepth+1) + "null" + strings.Repeat(`}`, limits.MaxDepth+1)),
+			errorMsg: "JSON payload exceeds allowed token count",
+		},
+		{
+			name:     "payload exceeds token limit",
+			payload:  []byte(`{"a":1,"b":2,"c":3,"d":4,"e":5,"f":6,"g":7,"h":8,"i":9,"j":10}`),
+			errorMsg: "JSON object exceeds allowed entry count",
+		},
+		{
+			name:     "string with many escapes exceeds length limit",
+			payload:  []byte(fmt.Sprintf(`{"k":"%s"}`, strings.Repeat(`\"`, limits.MaxStringValueLength/2+1))),
+			errorMsg: "JSON string value exceeds allowed length",
+		},
+		{
+			name: "deeply nested string exceeds length limit",
+			payload: []byte(fmt.Sprintf(`%s{"key":"%s"}%s`,
+				strings.Repeat(`{"a":`, 60),
+				strings.Repeat("b", limits.MaxStringValueLength+1),
+				strings.Repeat(`}`, 60))),
+			errorMsg: "JSON payload exceeds allowed token count",
+		},
+		{
+			name:     "very long number exceeds length limit",
+			payload:  []byte(fmt.Sprintf(`{"key":%s}`, strings.Repeat("1", limits.MaxStringValueLength+1))),
+			errorMsg: "JSON number value exceeds allowed length",
+		},
+		{
+			name: "string with invalid unicode escape",
+			// 'X' is not a valid hex digit
+			payload:  []byte(`{"key":"\u123X"}`),
+			errorMsg: "invalid character 'X' in string escape code",
+		},
+		{
+			name:     "object with trailing comma",
+			payload:  []byte(`{"k0":"v0",}`),
+			errorMsg: "invalid character '}' after object key-value pair",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := VerifyMaxDepthStreaming(bytes.NewReader(tt.payload), limits, nil)
+			require.Error(t, err)
+			require.Contains(t, err.Error(), tt.errorMsg)
+		})
+	}
+}
+
+func TestVerifyMaxDepthStreaming_MaxTokens(t *testing.T) {
+	t.Run("payload exceeds limit", func(t *testing.T) {
+		limits := JSONLimits{
+			MaxTokens:            5, // Set a small, specific limit.
+			MaxDepth:             CustomMaxJSONDepth,
+			MaxStringValueLength: CustomMaxJSONStringValueLength,
+			MaxObjectEntryCount:  CustomMaxJSONObjectEntryCount,
+			MaxArrayElementCount: CustomMaxJSONArrayElementCount,
+		}
+
+		// This payload contains 6 tokens: {, "k0", "v0", "k1", "v1", }
+		payload := []byte(`{"k0":"v0","k1":"v1"}`)
+		expectedErrorMsg := "JSON payload exceeds allowed token count"
+
+		_, err := VerifyMaxDepthStreaming(bytes.NewReader(payload), limits, nil)
+
+		// We expect an error because the token count (6) is greater than the limit (5).
+		require.Error(t, err)
+		require.Contains(t, err.Error(), expectedErrorMsg)
+	})
+
+	t.Run("payload within limit", func(t *testing.T) {
+		limits := JSONLimits{
+			MaxTokens:            5,
+			MaxDepth:             CustomMaxJSONDepth,
+			MaxStringValueLength: CustomMaxJSONStringValueLength,
+			MaxObjectEntryCount:  CustomMaxJSONObjectEntryCount,
+			MaxArrayElementCount: CustomMaxJSONArrayElementCount,
+		}
+
+		// This payload contains 3 tokens: {, "key", }
+		payload := []byte(`{"key":null}`)
+
+		_, err := VerifyMaxDepthStreaming(bytes.NewReader(payload), limits, nil)
+
+		// We expect no error because the token count (3) is less than the limit (5).
+		require.NoError(t, err)
+	})
+}
+
+// TestJSONUtil_Limits_Strictness adds tests for cases that a lenient parser
+// might accept but a security-focused one should reject.
+func TestJSONUtil_Limits_Strictness(t *testing.T) {
+	limits := JSONLimits{
+		MaxDepth:             64,
+		MaxStringValueLength: 1024,
+		MaxObjectEntryCount:  3,
+		MaxArrayElementCount: 3,
+		MaxTokens:            100,
+	}
+
+	tests := []struct {
+		name     string
+		payload  []byte
+		errorMsg string
+	}{
+		// RFC 8259 states that object key names SHOULD be unique, but doesn't
+		// require it. A strict parser should reject duplicates to prevent ambiguity.
+		{
+			name:     "object with duplicate keys",
+			payload:  []byte(`{"key":"v1", "key":"v2"}`),
+			errorMsg: "duplicate key 'key' in object",
+		},
+		{
+			name:     "array with trailing comma",
+			payload:  []byte(`[1, 2, 3,]`),
+			errorMsg: "invalid character ']' after array element",
+		},
+		// A robust parser should reject any invalid escape sequence, not just unicode.
+		{
+			name:     "string with invalid escape sequence",
+			payload:  []byte(`{"key":"\q"}`),
+			errorMsg: "invalid character 'q' in string escape code",
+		},
+		// A key must be followed by a colon and a value.
+		{
+			name:     "object with missing value after key",
+			payload:  []byte(`{"key":}`),
+			errorMsg: "invalid character '}' after object key",
+		},
+		// Numbers starting with zero (unless they are just "0") are not standard.
+		{
+			name:     "number with leading zero",
+			payload:  []byte(`[0123]`),
+			errorMsg: "invalid character '1' after top-level value",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := VerifyMaxDepthStreaming(bytes.NewReader(tt.payload), limits, nil)
+			require.Error(t, err)
+			require.Contains(t, err.Error(), tt.errorMsg)
+		})
+	}
+}
+
+// TestVerifyMaxDepthStreaming_NonContainerBypass ensures that top-level values
+// that are not objects or arrays are correctly ignored, as the limits are not
+// intended to apply to them.
+func TestVerifyMaxDepthStreaming_NonContainerBypass(t *testing.T) {
+	limits := JSONLimits{MaxDepth: 1, MaxTokens: 1}
+
+	tests := map[string][]byte{
+		"top-level string": []byte(`"this is a string"`),
+		"top-level number": []byte(`12345`),
+		"top-level bool":   []byte(`true`),
+		"top-level null":   []byte(`null`),
+	}
+
+	for name, payload := range tests {
+		t.Run(name, func(t *testing.T) {
+			_, err := VerifyMaxDepthStreaming(bytes.NewReader(payload), limits, nil)
+			require.NoError(t, err, "expected no error for non-container top-level value")
+		})
+	}
+}
+
+// TestVerifyMaxDepthStreaming_ValidVaultPayloads ensures the parser
+// correctly accepts legitimate, common JSON payloads from the Vault ecosystem.
+func TestVerifyMaxDepthStreaming_ValidVaultPayloads(t *testing.T) {
+	// Use reasonable limits that are well above what these payloads require,
+	// ensuring that the parser doesn't fail on valid structures.
+	limits := JSONLimits{
+		MaxDepth:             10,
+		MaxStringValueLength: 4096,
+		MaxObjectEntryCount:  100,
+		MaxArrayElementCount: 100,
+		MaxTokens:            500,
+	}
+
+	tests := map[string]string{
+		"KVv2 secret read response": `{
+			"request_id": "a5a1c058-305f-3576-2f1d-f8f9a46a742c",
+			"lease_id": "",
+			"lease_duration": 0,
+			"renewable": false,
+			"data": {
+				"data": {
+					"foo": "bar"
+				},
+				"metadata": {
+					"created_time": "2025-09-19T08:10:00.123456789Z",
+					"custom_metadata": null,
+					"deletion_time": "",
+					"destroyed": false,
+					"version": 1
+				}
+			},
+			"warnings": null,
+			"wrap_info": null
+		}`,
+		"Auth token lookup response": `{
+			"request_id": "6d1f2b3e-7c3a-4e2b-8c6a-1b7d5f0e3a1b",
+			"data": {
+				"accessor": "St8oY1x3x6z5y9p6q3r8s7t2",
+				"creation_time": 1663242230,
+				"display_name": "userpass-user",
+				"entity_id": "e-12345-67890-abcdef",
+				"expire_time": "2025-10-19T10:10:00.000Z",
+				"explicit_max_ttl": 0,
+				"id": "h.123abcde456fghij789klmno",
+				"identity_policies": ["default", "dev-policy"],
+				"issue_time": "2025-09-19T10:10:00.000Z",
+				"meta": {
+					"username": "test-user"
+				},
+				"num_uses": 0,
+				"orphan": true,
+				"path": "auth/userpass/login/test-user",
+				"policies": ["default", "dev-policy"],
+				"renewable": true,
+				"ttl": 2764799,
+				"type": "service"
+			}
+		}`,
+		"LIST operation response": `{
+			"request_id": "c1a2b3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6",
+			"data": {
+				"keys": [
+					"secret1",
+					"secret2/",
+					"another-secret"
+				]
+			}
+		}`,
+		"Policy write request": `{
+			"policy": "path \"secret/data/foo\" {\n  capabilities = [\"read\", \"list\"]\n}\n\npath \"secret/data/bar\" {\n  capabilities = [\"create\", \"update\"]\n}"
+		}`,
+		"Transit batch encryption request": `{
+			"batch_input": [
+				{
+					"plaintext": "aGVsbG8gd29ybGQ=",
+					"context": "Y29udGV4dDE="
+				},
+				{
+					"plaintext": "dGhpcyBpcyBhIHRlc3Q="
+				}
+			]
+		}`,
+	}
+
+	for name, payload := range tests {
+		t.Run(name, func(t *testing.T) {
+			_, err := VerifyMaxDepthStreaming(bytes.NewReader([]byte(payload)), limits, nil)
+			require.NoError(t, err, "expected valid Vault payload to parse without error")
+		})
+	}
+}
+
+// TestVerifyMaxDepthStreaming_InvalidVaultPayloads ensures the parser correctly
+// rejects real-world Vault payloads that have been crafted to violate specific
+// security limits.
+func TestVerifyMaxDepthStreaming_InvalidVaultPayloads(t *testing.T) {
+	tests := []struct {
+		name     string
+		payload  []byte
+		errorMsg string
+		limits   JSONLimits
+	}{
+		// This KVv2 secret is valid, but the metadata object contains 5 keys.
+		// It should be rejected by the MaxObjectEntryCount limit of 4.
+		{
+			name: "KVv2 secret with too many metadata entries",
+			payload: []byte(`{
+				"data": {
+					"data": {"foo": "bar"},
+					"metadata": {
+						"created_time": "2025-09-19T08:10:00.123456789Z",
+						"custom_metadata": null,
+						"deletion_time": "",
+						"destroyed": false,
+						"version": 1
+					}
+				}
+			}`),
+			errorMsg: "JSON input exceeds allowed nesting depth",
+			limits: JSONLimits{
+				MaxDepth:             2,
+				MaxStringValueLength: 100,
+				MaxObjectEntryCount:  4,
+				MaxArrayElementCount: 2,
+				MaxTokens:            40,
+			},
+		},
+		// This auth token response is flat but contains many key-value pairs,
+		// resulting in over 50 tokens. It should be rejected by the MaxTokens limit of 40.
+		{
+			name: "Auth token response with too many tokens",
+			payload: []byte(`{
+				"data": {
+					"accessor": "St8oY1x3x6z5y9p6q3r8s7t2",
+					"creation_time": 1663242230,
+					"display_name": "userpass-user",
+					"entity_id": "e-12345-67890-abcdef",
+					"expire_time": "2025-10-19T10:10:00.000Z",
+					"explicit_max_ttl": 0,
+					"id": "h.123abcde456fghij789klmno",
+					"identity_policies": ["default", "dev-policy"],
+					"issue_time": "2025-09-19T10:10:00.000Z",
+					"meta": {"username": "test-user"},
+					"num_uses": 0,
+					"orphan": true,
+					"path": "auth/userpass/login/test-user",
+					"policies": ["default", "dev-policy"],
+					"renewable": true,
+					"ttl": 2764799,
+					"type": "service"
+				}
+			}`),
+			errorMsg: "JSON payload exceeds allowed token count",
+			limits: JSONLimits{
+				MaxDepth:             100,
+				MaxStringValueLength: 100,
+				MaxObjectEntryCount:  50,
+				MaxArrayElementCount: 2,
+				MaxTokens:            40,
+			},
+		},
+		// This LIST response is valid but contains 3 elements in the "keys" array.
+		// It should be rejected by the MaxArrayElementCount limit of 2.
+		{
+			name: "LIST response with too many keys in array",
+			payload: []byte(`{
+				"data": {
+					"keys": [
+						"secret1",
+						"secret2/",
+						"another-secret"
+					]
+				}
+			}`),
+			errorMsg: "JSON input exceeds allowed nesting depth",
+			limits: JSONLimits{
+				MaxDepth:             2,
+				MaxStringValueLength: 100,
+				MaxObjectEntryCount:  4,
+				MaxArrayElementCount: 2,
+				MaxTokens:            40,
+			},
+		},
+		// The policy string in this payload is over 100 bytes long.
+		// It should be rejected by the MaxStringValueLength limit of 100.
+		{
+			name: "Policy write request with oversized policy string",
+			payload: []byte(`{
+				"policy": "path \"secret/data/foo\" {\n  capabilities = [\"read\", \"list\"]\n}\n\npath \"secret/data/bar\" {\n  capabilities = [\"create\", \"update\"]\n}"
+			}`),
+			errorMsg: "JSON string value exceeds allowed length",
+			limits: JSONLimits{
+				MaxDepth:             2,
+				MaxStringValueLength: 100,
+				MaxObjectEntryCount:  4,
+				MaxArrayElementCount: 2,
+				MaxTokens:            40,
+			},
+		},
+		// This transit request has a nesting depth of 3 ({ -> [ -> {).
+		// It should be rejected by the MaxDepth limit of 2.
+		{
+			name: "Transit batch request with excessive depth",
+			payload: []byte(`{
+				"batch_input": [
+					{
+						"plaintext": "aGVsbG8gd29ybGQ="
+					}
+				]
+			}`),
+			errorMsg: "JSON input exceeds allowed nesting depth",
+			limits: JSONLimits{
+				MaxDepth:             2,
+				MaxStringValueLength: 100,
+				MaxObjectEntryCount:  4,
+				MaxArrayElementCount: 2,
+				MaxTokens:            40,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := VerifyMaxDepthStreaming(bytes.NewReader(tt.payload), tt.limits, nil)
+			require.Error(t, err)
+			require.Contains(t, err.Error(), tt.errorMsg)
+		})
+	}
+}
+
+// TestVerifyMaxDepthStreaming_MaxRequestSize ensures that the buffered reader
+// used in VerifyMaxDepthStreaming correctly enforces the maxRequestSize limit.
+// The test checks that a non-JSON payload can be processed without error and
+// that no more than the maxRequestSize bytes are read from the reader.
+func TestVerifyMaxDepthStreaming_MaxRequestSize(t *testing.T) {
+	input := `this is test data that isn't json`
+	bodyReader := strings.NewReader(input)
+	read := new(bytes.Buffer)
+	maxRequestSize := new(int64)
+	*maxRequestSize = 16
+	// this is meant to mimic http request body reading
+	// the TeeReader will capture what is read from the bodyReader
+	reader := io.TeeReader(http.MaxBytesReader(nil, io.NopCloser(bodyReader), *maxRequestSize), read)
+	_, err := VerifyMaxDepthStreaming(reader, JSONLimits{MaxDepth: 5, MaxTokens: 5}, maxRequestSize)
+	require.NoError(t, err)
+	// then, check to see that combining the read buffer and the remaining body
+	// results in the original input
+	// if VerifyMaxDepthStreaming tried to read more than the
+	// maxRequestSize, this check will fail because the http.MaxBytesReader will
+	// have read an extra byte without writing it to the read buffer
+	full := io.MultiReader(read, bodyReader)
+	all, err := io.ReadAll(full)
+	require.NoError(t, err)
+	require.Equal(t, input, string(all))
+}
+
+// generateComplexJSON generates a valid JSON string with a specified nesting depth.
+func generateComplexJSON(depth int) string {
+	if depth <= 0 {
+		return "{}"
+	}
+	// Build the nested structure from the inside out.
+	json := "1"
+	for i := 0; i < depth; i++ {
+		json = fmt.Sprintf(`{"a":%s}`, json)
+	}
+	return json
+}
+
+// generateObjectEntries creates a string of object entries for testing.
+func generateObjectEntries(count int) string {
+	var sb strings.Builder
+	for i := 0; i < count; i++ {
+		sb.WriteString(fmt.Sprintf(`"key%d":%d`, i, i))
+		if i < count-1 {
+			sb.WriteString(",")
+		}
+	}
+	return sb.String()
+}
+
+// generateArrayElements creates a string of array elements for testing.
+func generateArrayElements(count int) string {
+	var sb strings.Builder
+	for i := 0; i < count; i++ {
+		sb.WriteString(fmt.Sprintf("%d", i))
+		if i < count-1 {
+			sb.WriteString(",")
+		}
+	}
+	return sb.String()
+}
diff --git a/sdk/helper/kdf/kdf.go b/sdk/helper/kdf/kdf.go
index e9964ba28c4..a398450c21e 100644
--- a/sdk/helper/kdf/kdf.go
+++ b/sdk/helper/kdf/kdf.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // This package is used to implement Key Derivation Functions (KDF)
diff --git a/sdk/helper/kdf/kdf_test.go b/sdk/helper/kdf/kdf_test.go
index ed5c0a13d36..80eb4355e8c 100644
--- a/sdk/helper/kdf/kdf_test.go
+++ b/sdk/helper/kdf/kdf_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package kdf
diff --git a/sdk/helper/keysutil/cache.go b/sdk/helper/keysutil/cache.go
index fb55091e40a..3d8274d9147 100644
--- a/sdk/helper/keysutil/cache.go
+++ b/sdk/helper/keysutil/cache.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package keysutil
diff --git a/sdk/helper/keysutil/consts.go b/sdk/helper/keysutil/consts.go
index b6842324232..715f5706cd5 100644
--- a/sdk/helper/keysutil/consts.go
+++ b/sdk/helper/keysutil/consts.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package keysutil
@@ -28,11 +28,12 @@ const (
 	HashTypeSHA3512
 )
 
+//go:generate enumer -type=MarshalingType -trimprefix=MarshalingType -transform=snake
 type MarshalingType uint32
 
 const (
-	_                                 = iota
-	MarshalingTypeASN1 MarshalingType = iota
+	_ MarshalingType = iota
+	MarshalingTypeASN1
 	MarshalingTypeJWS
 )
 
@@ -76,8 +77,5 @@ var (
 		HashTypeSHA3512: crypto.SHA3_512,
 	}
 
-	MarshalingTypeMap = map[string]MarshalingType{
-		"asn1": MarshalingTypeASN1,
-		"jws":  MarshalingTypeJWS,
-	}
+	MarshalingTypeMap = _MarshalingTypeNameToValueMap
 )
diff --git a/sdk/helper/keysutil/encrypted_key_storage.go b/sdk/helper/keysutil/encrypted_key_storage.go
index 7314758bc16..ed2de125d6a 100644
--- a/sdk/helper/keysutil/encrypted_key_storage.go
+++ b/sdk/helper/keysutil/encrypted_key_storage.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package keysutil
diff --git a/sdk/helper/keysutil/encrypted_key_storage_test.go b/sdk/helper/keysutil/encrypted_key_storage_test.go
index 5147027fc88..f32d1bc9294 100644
--- a/sdk/helper/keysutil/encrypted_key_storage_test.go
+++ b/sdk/helper/keysutil/encrypted_key_storage_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package keysutil
diff --git a/sdk/helper/keysutil/lock_manager.go b/sdk/helper/keysutil/lock_manager.go
index 6d2881e0d8d..254fedeb64a 100644
--- a/sdk/helper/keysutil/lock_manager.go
+++ b/sdk/helper/keysutil/lock_manager.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package keysutil
@@ -68,6 +68,17 @@ type PolicyRequest struct {
 
 	// The UUID of the managed key, if using one
 	ManagedKeyUUID string
+
+	// ParameterSet indicates the parameter set to use with ML-DSA and SLH-DSA keys
+	ParameterSet string
+
+	// HybridConfig contains the key types and parameters for hybrid keys
+	HybridConfig HybridKeyConfig
+}
+
+type HybridKeyConfig struct {
+	PQCKeyType KeyType
+	ECKeyType  KeyType
 }
 
 type LockManager struct {
@@ -266,12 +277,12 @@ func (lm *LockManager) BackupPolicy(ctx context.Context, storage logical.Storage
 			return "", err
 		}
 		if p == nil {
-			return "", fmt.Errorf(fmt.Sprintf("key %q not found", name))
+			return "", fmt.Errorf("key %q not found", name)
 		}
 	}
 
 	if atomic.LoadUint32(&p.deleted) == 1 {
-		return "", fmt.Errorf(fmt.Sprintf("key %q not found", name))
+		return "", fmt.Errorf("key %q not found", name)
 	}
 
 	backup, err := p.Backup(ctx, storage)
@@ -362,7 +373,7 @@ func (lm *LockManager) GetPolicy(ctx context.Context, req PolicyRequest, rand io
 		// because we don't know if the parameters match.
 
 		switch req.KeyType {
-		case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305:
+		case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_AES128_CBC, KeyType_AES256_CBC:
 			if req.Convergent && !req.Derived {
 				cleanup()
 				return nil, false, fmt.Errorf("convergent encryption requires derivation to be enabled")
@@ -397,6 +408,30 @@ func (lm *LockManager) GetPolicy(ctx context.Context, req PolicyRequest, rand io
 				return nil, false, fmt.Errorf("key derivation and convergent encryption not supported for keys of type %v", req.KeyType)
 			}
 
+		case KeyType_AES128_CMAC, KeyType_AES256_CMAC, KeyType_AES192_CMAC:
+			if req.Derived || req.Convergent {
+				cleanup()
+				return nil, false, fmt.Errorf("key derivation and convergent encryption not supported for keys of type %v", req.KeyType)
+			}
+
+		case KeyType_ML_DSA:
+			if req.Derived || req.Convergent {
+				cleanup()
+				return nil, false, fmt.Errorf("key derivation and convergent encryption not supported for keys of type %v", req.KeyType)
+			}
+
+		case KeyType_HYBRID:
+			if req.Derived || req.Convergent {
+				cleanup()
+				return nil, false, fmt.Errorf("key derivation and convergent encryption not supported for keys of type %v", req.KeyType)
+			}
+
+		case KeyType_SLH_DSA:
+			if req.Derived || req.Convergent {
+				cleanup()
+				return nil, false, fmt.Errorf("key derivation and convergent encryption not supported for keys of type %v", req.KeyType)
+			}
+
 		default:
 			cleanup()
 			return nil, false, fmt.Errorf("unsupported key type %v", req.KeyType)
@@ -411,6 +446,8 @@ func (lm *LockManager) GetPolicy(ctx context.Context, req PolicyRequest, rand io
 			AllowPlaintextBackup: req.AllowPlaintextBackup,
 			AutoRotatePeriod:     req.AutoRotatePeriod,
 			KeySize:              req.KeySize,
+			ParameterSet:         req.ParameterSet,
+			HybridConfig:         req.HybridConfig,
 		}
 
 		if req.Derived {
@@ -458,6 +495,13 @@ func (lm *LockManager) GetPolicy(ctx context.Context, req PolicyRequest, rand io
 		}
 	}
 
+	if p.Imported && p.Derived && p.KDF == Kdf_hmac_sha256_counter {
+		if err := p.setKDF(ctx, req.Storage, Kdf_hkdf_sha256); err != nil {
+			cleanup()
+			return nil, false, err
+		}
+	}
+
 	if lm.useCache {
 		lm.cache.Store(req.Name, p)
 	} else {
@@ -514,6 +558,19 @@ func (lm *LockManager) ImportPolicy(ctx context.Context, req PolicyRequest, key
 		}
 	}
 
+	if req.Derived {
+		p.KDF = Kdf_hkdf_sha256
+		if req.Convergent {
+			p.ConvergentEncryption = true
+			// As of version 3 we store the version within each key, so we
+			// set to -1 to indicate that the value in the policy has no
+			// meaning. We still, for backwards compatibility, fall back to
+			// this value if the key doesn't have one, which means it will
+			// only be -1 in the case where every key version is >= 3
+			p.ConvergentVersion = -1
+		}
+	}
+
 	err = p.ImportPublicOrPrivate(ctx, req.Storage, key, req.IsPrivateKey, rand)
 	if err != nil {
 		return fmt.Errorf("error importing key: %s", err)
diff --git a/sdk/helper/keysutil/lock_manager_test.go b/sdk/helper/keysutil/lock_manager_test.go
new file mode 100644
index 00000000000..0857e6dc5f7
--- /dev/null
+++ b/sdk/helper/keysutil/lock_manager_test.go
@@ -0,0 +1,100 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package keysutil
+
+import (
+	"context"
+	"crypto/rand"
+	"testing"
+
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+)
+
+func TestImportPolicy(t *testing.T) {
+	lm, err := NewLockManager(false, 0)
+	require.NoError(t, err)
+
+	ctx := context.Background()
+	storage := &logical.InmemStorage{}
+
+	testKeys, err := generateTestKeys()
+	require.NoError(t, err)
+
+	testCases := map[string]struct {
+		req       PolicyRequest
+		key       []byte
+		expectErr bool
+	}{
+		"import AES key": {
+			req: PolicyRequest{
+				Name:         "test-aes-key",
+				KeyType:      KeyType_AES256_GCM96,
+				Storage:      storage,
+				IsPrivateKey: true,
+			},
+			key: testKeys[KeyType_AES256_GCM96],
+		},
+		"import RSA key": {
+			req: PolicyRequest{
+				Name:         "test-rsa-key",
+				KeyType:      KeyType_RSA2048,
+				Storage:      storage,
+				IsPrivateKey: true,
+			},
+			key: testKeys[KeyType_RSA2048],
+		},
+		"import ECDSA key": {
+			req: PolicyRequest{
+				Name:         "test-ecdsa-key",
+				KeyType:      KeyType_ECDSA_P256,
+				Storage:      storage,
+				IsPrivateKey: true,
+			},
+			key: testKeys[KeyType_ECDSA_P256],
+		},
+		"import ED25519 key": {
+			req: PolicyRequest{
+				Name:         "test-ed25519-key",
+				KeyType:      KeyType_ED25519,
+				Storage:      storage,
+				IsPrivateKey: true,
+			},
+			key: testKeys[KeyType_ED25519],
+		},
+		"import ed25519 with derivation": {
+			req: PolicyRequest{
+				Name:         "ed25519-derived",
+				KeyType:      KeyType_ED25519,
+				Storage:      storage,
+				IsPrivateKey: true,
+				Derived:      true,
+			},
+			key: testKeys[KeyType_ED25519],
+		},
+	}
+
+	for name, tt := range testCases {
+		t.Run(name, func(t *testing.T) {
+			err = lm.ImportPolicy(ctx, tt.req, tt.key, rand.Reader)
+			if tt.expectErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+
+				pol, upserted, err := lm.GetPolicy(ctx, PolicyRequest{Name: tt.req.Name, Storage: storage}, rand.Reader)
+				require.NoError(t, err)
+				require.False(t, upserted)
+
+				defer pol.Unlock()
+
+				require.Equal(t, tt.req.KeyType, pol.Type)
+				if tt.req.Derived {
+					require.True(t, pol.Derived)
+					require.Equal(t, Kdf_hkdf_sha256, pol.KDF)
+				}
+			}
+		})
+	}
+}
diff --git a/sdk/helper/keysutil/managed_key_util.go b/sdk/helper/keysutil/managed_key_util.go
index bb3c0b2968b..4d3d7e70c4a 100644
--- a/sdk/helper/keysutil/managed_key_util.go
+++ b/sdk/helper/keysutil/managed_key_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 //go:build !enterprise
diff --git a/sdk/helper/keysutil/marshalingtype_enumer.go b/sdk/helper/keysutil/marshalingtype_enumer.go
new file mode 100644
index 00000000000..93b5c2f1f94
--- /dev/null
+++ b/sdk/helper/keysutil/marshalingtype_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=MarshalingType -trimprefix=MarshalingType -transform=snake"; DO NOT EDIT.
+
+package keysutil
+
+import (
+	"fmt"
+)
+
+const _MarshalingTypeName = "asn1jws"
+
+var _MarshalingTypeIndex = [...]uint8{0, 4, 7}
+
+func (i MarshalingType) String() string {
+	i -= 1
+	if i >= MarshalingType(len(_MarshalingTypeIndex)-1) {
+		return fmt.Sprintf("MarshalingType(%d)", i+1)
+	}
+	return _MarshalingTypeName[_MarshalingTypeIndex[i]:_MarshalingTypeIndex[i+1]]
+}
+
+var _MarshalingTypeValues = []MarshalingType{1, 2}
+
+var _MarshalingTypeNameToValueMap = map[string]MarshalingType{
+	_MarshalingTypeName[0:4]: 1,
+	_MarshalingTypeName[4:7]: 2,
+}
+
+// MarshalingTypeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func MarshalingTypeString(s string) (MarshalingType, error) {
+	if val, ok := _MarshalingTypeNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to MarshalingType values", s)
+}
+
+// MarshalingTypeValues returns all values of the enum
+func MarshalingTypeValues() []MarshalingType {
+	return _MarshalingTypeValues
+}
+
+// IsAMarshalingType returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i MarshalingType) IsAMarshalingType() bool {
+	for _, v := range _MarshalingTypeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdk/helper/keysutil/policy.go b/sdk/helper/keysutil/policy.go
index 6b9caad9cad..174e8412549 100644
--- a/sdk/helper/keysutil/policy.go
+++ b/sdk/helper/keysutil/policy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package keysutil
@@ -10,6 +10,7 @@ import (
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/ecdsa"
+	stdlibEd25519 "crypto/ed25519"
 	"crypto/elliptic"
 	"crypto/hmac"
 	"crypto/rand"
@@ -32,13 +33,14 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/google/tink/go/kwp/subtle"
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/kdf"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/tink-crypto/tink-go/v2/kwp/subtle"
 	"golang.org/x/crypto/chacha20poly1305"
 	"golang.org/x/crypto/ed25519"
 	"golang.org/x/crypto/hkdf"
@@ -68,6 +70,33 @@ const (
 	KeyType_RSA3072
 	KeyType_MANAGED_KEY
 	KeyType_HMAC
+	KeyType_AES128_CMAC
+	KeyType_AES256_CMAC
+	KeyType_ML_DSA
+	KeyType_HYBRID
+	KeyType_AES192_CMAC
+	KeyType_SLH_DSA
+	KeyType_AES128_CBC
+	KeyType_AES256_CBC
+	// If adding to this list please update allTestKeyTypes in policy_test.go
+)
+
+const (
+	ParameterSet_ML_DSA_44          = "44"
+	ParameterSet_ML_DSA_65          = "65"
+	ParameterSet_ML_DSA_87          = "87"
+	ParameterSet_SLH_DSA_SHA2_128S  = "slh-dsa-sha2-128s"
+	ParameterSet_SLH_DSA_SHAKE_128S = "slh-dsa-shake-128s"
+	ParameterSet_SLH_DSA_SHA2_128F  = "slh-dsa-sha2-128f"
+	ParameterSet_SLH_DSA_SHAKE_128F = "slh-dsa-shake-128f"
+	ParameterSet_SLH_DSA_SHA2_192S  = "slh-dsa-sha2-192s"
+	ParameterSet_SLH_DSA_SHAKE_192S = "slh-dsa-shake-192s"
+	ParameterSet_SLH_DSA_SHA2_192F  = "slh-dsa-sha2-192f"
+	ParameterSet_SLH_DSA_SHAKE_192F = "slh-dsa-shake-192f"
+	ParameterSet_SLH_DSA_SHA2_256S  = "slh-dsa-sha2-256s"
+	ParameterSet_SLH_DSA_SHAKE_256S = "slh-dsa-shake-256s"
+	ParameterSet_SLH_DSA_SHA2_256F  = "slh-dsa-sha2-256f"
+	ParameterSet_SLH_DSA_SHAKE_256F = "slh-dsa-shake-256f"
 )
 
 const (
@@ -79,6 +108,44 @@ const (
 	DefaultVersionTemplate = "vault:v{{version}}:"
 )
 
+type PaddingScheme string
+
+const (
+	PaddingScheme_OAEP     = PaddingScheme("oaep")
+	PaddingScheme_PKCS1v15 = PaddingScheme("pkcs1v15")
+)
+
+var genEd25519Options = func(hashAlgorithm HashType, signatureContext string) (*stdlibEd25519.Options, error) {
+	if signatureContext != "" {
+		return nil, fmt.Errorf("signature context is not supported feature")
+	}
+
+	if hashAlgorithm == HashTypeSHA2512 {
+		return nil, fmt.Errorf("hash algorithm of SHA2 512 is not supported feature")
+	}
+
+	return &stdlibEd25519.Options{
+		Hash: crypto.Hash(0),
+	}, nil
+}
+
+func (p PaddingScheme) String() string {
+	return string(p)
+}
+
+// ParsePaddingScheme expects a lower case string that can be directly compared to
+// a defined padding scheme or returns an error.
+func ParsePaddingScheme(s string) (PaddingScheme, error) {
+	switch s {
+	case PaddingScheme_OAEP.String():
+		return PaddingScheme_OAEP, nil
+	case PaddingScheme_PKCS1v15.String():
+		return PaddingScheme_PKCS1v15, nil
+	default:
+		return "", fmt.Errorf("unknown padding scheme: %s", s)
+	}
+}
+
 type AEADFactory interface {
 	GetAEAD(iv []byte) (cipher.AEAD, error)
 }
@@ -106,9 +173,17 @@ type SigningOptions struct {
 	Marshaling       MarshalingType
 	SaltLength       int
 	SigAlgorithm     string
+	SigContext       string // Provide a context for Ed25519ctx signatures
 	ManagedKeyParams ManagedKeyParameters
 }
 
+type EncryptionOptions struct {
+	KeyVersion int
+	Context    []byte
+	Nonce      []byte
+	IV         []byte
+}
+
 type SigningResult struct {
 	Signature string
 	PublicKey []byte
@@ -122,7 +197,7 @@ type KeyType int
 
 func (kt KeyType) EncryptionSupported() bool {
 	switch kt {
-	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096, KeyType_MANAGED_KEY:
+	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096, KeyType_MANAGED_KEY, KeyType_AES128_CBC, KeyType_AES256_CBC:
 		return true
 	}
 	return false
@@ -130,7 +205,7 @@ func (kt KeyType) EncryptionSupported() bool {
 
 func (kt KeyType) DecryptionSupported() bool {
 	switch kt {
-	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096, KeyType_MANAGED_KEY:
+	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096, KeyType_MANAGED_KEY, KeyType_AES128_CBC, KeyType_AES256_CBC:
 		return true
 	}
 	return false
@@ -138,7 +213,7 @@ func (kt KeyType) DecryptionSupported() bool {
 
 func (kt KeyType) SigningSupported() bool {
 	switch kt {
-	case KeyType_ECDSA_P256, KeyType_ECDSA_P384, KeyType_ECDSA_P521, KeyType_ED25519, KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096, KeyType_MANAGED_KEY:
+	case KeyType_ECDSA_P256, KeyType_ECDSA_P384, KeyType_ECDSA_P521, KeyType_ED25519, KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096, KeyType_MANAGED_KEY, KeyType_ML_DSA, KeyType_HYBRID, KeyType_SLH_DSA:
 		return true
 	}
 	return false
@@ -154,7 +229,7 @@ func (kt KeyType) HashSignatureInput() bool {
 
 func (kt KeyType) DerivationSupported() bool {
 	switch kt {
-	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_ED25519:
+	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_ED25519, KeyType_AES128_CBC, KeyType_AES256_CBC:
 		return true
 	}
 	return false
@@ -168,6 +243,35 @@ func (kt KeyType) AssociatedDataSupported() bool {
 	return false
 }
 
+func (kt KeyType) CMACSupported() bool {
+	switch kt {
+	case KeyType_AES128_CMAC, KeyType_AES256_CMAC, KeyType_AES192_CMAC:
+		return true
+	default:
+		return false
+	}
+}
+
+func (kt KeyType) HMACSupported() bool {
+	switch {
+	case kt.CMACSupported():
+		return false
+	case kt == KeyType_MANAGED_KEY:
+		return false
+	default:
+		return true
+	}
+}
+
+func (kt KeyType) IsEnterpriseOnly() bool {
+	switch kt {
+	case KeyType_MANAGED_KEY, KeyType_AES128_CMAC, KeyType_AES192_CMAC, KeyType_AES256_CMAC, KeyType_ML_DSA, KeyType_HYBRID, KeyType_AES128_CBC, KeyType_AES256_CBC, KeyType_SLH_DSA:
+		return true
+	default:
+		return false
+	}
+}
+
 func (kt KeyType) ImportPublicKeySupported() bool {
 	switch kt {
 	case KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096, KeyType_ECDSA_P256, KeyType_ECDSA_P384, KeyType_ECDSA_P521, KeyType_ED25519:
@@ -176,6 +280,15 @@ func (kt KeyType) ImportPublicKeySupported() bool {
 	return false
 }
 
+func (kt KeyType) PaddingSchemesSupported() bool {
+	switch kt {
+	case KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096:
+		return true
+	default:
+		return false
+	}
+}
+
 func (kt KeyType) String() string {
 	switch kt {
 	case KeyType_AES128_GCM96:
@@ -202,6 +315,22 @@ func (kt KeyType) String() string {
 		return "hmac"
 	case KeyType_MANAGED_KEY:
 		return "managed_key"
+	case KeyType_AES128_CMAC:
+		return "aes128-cmac"
+	case KeyType_AES256_CMAC:
+		return "aes256-cmac"
+	case KeyType_ML_DSA:
+		return "ml-dsa"
+	case KeyType_HYBRID:
+		return "hybrid"
+	case KeyType_AES192_CMAC:
+		return "aes192-cmac"
+	case KeyType_SLH_DSA:
+		return "slh-dsa"
+	case KeyType_AES128_CBC:
+		return "aes128-cbc"
+	case KeyType_AES256_CBC:
+		return "aes256-cbc"
 	}
 
 	return "[unknown]"
@@ -214,6 +343,8 @@ type KeyData struct {
 
 // KeyEntry stores the key and metadata
 type KeyEntry struct {
+	entKeyEntry
+
 	// AES or some other kind that is a pure byte slice like ED25519
 	Key []byte `json:"key"`
 
@@ -223,19 +354,19 @@ type KeyEntry struct {
 	// Time of creation
 	CreationTime time.Time `json:"time"`
 
-	EC_X *big.Int `json:"ec_x"`
-	EC_Y *big.Int `json:"ec_y"`
-	EC_D *big.Int `json:"ec_d"`
+	EC_X *big.Int `json:"ec_x,omitempty"`
+	EC_Y *big.Int `json:"ec_y,omitempty"`
+	EC_D *big.Int `json:"ec_d,omitempty"`
 
-	RSAKey       *rsa.PrivateKey `json:"rsa_key"`
-	RSAPublicKey *rsa.PublicKey  `json:"rsa_public_key"`
+	RSAKey       *rsa.PrivateKey `json:"rsa_key,omitempty"`
+	RSAPublicKey *rsa.PublicKey  `json:"rsa_public_key,omitempty"`
 
 	// The public key in an appropriate format for the type of key
-	FormattedPublicKey string `json:"public_key"`
+	FormattedPublicKey string `json:"public_key,omitempty"`
 
 	// If convergent is enabled, the version (falling back to what's in the
 	// policy)
-	ConvergentVersion int `json:"convergent_version"`
+	ConvergentVersion int `json:"convergent_version,omitempty"`
 
 	// This is deprecated (but still filled) in favor of the value above which
 	// is more precise
@@ -245,11 +376,11 @@ type KeyEntry struct {
 
 	// Key entry certificate chain. If set, leaf certificate key matches the
 	// KeyEntry key
-	CertificateChain [][]byte `json:"certificate_chain"`
+	CertificateChain [][]byte `json:"certificate_chain,omitempty"`
 }
 
 func (ke *KeyEntry) IsPrivateKeyMissing() bool {
-	if ke.RSAKey != nil || ke.EC_D != nil || len(ke.Key) != 0 || len(ke.ManagedKeyUUID) != 0 {
+	if ke.RSAKey != nil || ke.EC_D != nil || len(ke.Key) != 0 || len(ke.ManagedKeyUUID) != 0 || !ke.IsEntPrivateKeyMissing() {
 		return false
 	}
 
@@ -319,6 +450,9 @@ type PolicyConfig struct {
 	// StoragePrefix is used to add a prefix when storing and retrieving the
 	// policy object.
 	StoragePrefix string
+
+	// ParameterSet indicates the parameter set to use with ML-DSA and SLH-DSA keys
+	ParameterSet string
 }
 
 // NewPolicy takes a policy config and returns a Policy with those settings.
@@ -336,6 +470,7 @@ func NewPolicy(config PolicyConfig) *Policy {
 		AllowPlaintextBackup: config.AllowPlaintextBackup,
 		VersionTemplate:      config.VersionTemplate,
 		StoragePrefix:        config.StoragePrefix,
+		ParameterSet:         config.ParameterSet,
 	}
 }
 
@@ -466,6 +601,12 @@ type Policy struct {
 
 	// AllowImportedKeyRotation indicates whether an imported key may be rotated by Vault
 	AllowImportedKeyRotation bool
+
+	// ParameterSet indicates the parameter set to use with ML-DSA and SLH-DSA keys
+	ParameterSet string
+
+	// HybridConfig contains the key types and parameters for hybrid keys
+	HybridConfig HybridKeyConfig
 }
 
 func (p *Policy) Lock(exclusive bool) {
@@ -698,8 +839,10 @@ func (p *Policy) NeedsUpgrade() bool {
 		return true
 	}
 
-	if p.Keys[strconv.Itoa(p.LatestVersion)].HMACKey == nil || len(p.Keys[strconv.Itoa(p.LatestVersion)].HMACKey) == 0 {
-		return true
+	if p.Type.HMACSupported() {
+		if p.Keys[strconv.Itoa(p.LatestVersion)].HMACKey == nil || len(p.Keys[strconv.Itoa(p.LatestVersion)].HMACKey) == 0 {
+			return true
+		}
 	}
 
 	return false
@@ -760,18 +903,20 @@ func (p *Policy) Upgrade(ctx context.Context, storage logical.Storage, randReade
 		persistNeeded = true
 	}
 
-	if p.Keys[strconv.Itoa(p.LatestVersion)].HMACKey == nil || len(p.Keys[strconv.Itoa(p.LatestVersion)].HMACKey) == 0 {
-		entry := p.Keys[strconv.Itoa(p.LatestVersion)]
-		hmacKey, err := uuid.GenerateRandomBytesWithReader(32, randReader)
-		if err != nil {
-			return err
-		}
-		entry.HMACKey = hmacKey
-		p.Keys[strconv.Itoa(p.LatestVersion)] = entry
-		persistNeeded = true
+	if p.Type.HMACSupported() {
+		if p.Keys[strconv.Itoa(p.LatestVersion)].HMACKey == nil || len(p.Keys[strconv.Itoa(p.LatestVersion)].HMACKey) == 0 {
+			entry := p.Keys[strconv.Itoa(p.LatestVersion)]
+			hmacKey, err := uuid.GenerateRandomBytesWithReader(32, randReader)
+			if err != nil {
+				return err
+			}
+			entry.HMACKey = hmacKey
+			p.Keys[strconv.Itoa(p.LatestVersion)] = entry
+			persistNeeded = true
 
-		if p.Type == KeyType_HMAC {
-			entry.HMACKey = entry.Key
+			if p.Type == KeyType_HMAC {
+				entry.HMACKey = entry.Key
+			}
 		}
 	}
 
@@ -863,7 +1008,6 @@ func (p *Policy) DeriveKey(context, salt []byte, ver int, numBytes int) ([]byte,
 				return nil, errutil.InternalError{Err: fmt.Sprintf("error generating derived key: %v", err)}
 			}
 			return pri, nil
-
 		default:
 			return nil, errutil.InternalError{Err: "unsupported key type for derivation"}
 		}
@@ -908,7 +1052,14 @@ func (p *Policy) Decrypt(context, nonce []byte, value string) (string, error) {
 	return p.DecryptWithFactory(context, nonce, value, nil)
 }
 
-func (p *Policy) DecryptWithFactory(context, nonce []byte, value string, factories ...interface{}) (string, error) {
+func (p *Policy) DecryptWithFactory(context, nonce []byte, value string, factories ...any) (string, error) {
+	return p.DecryptWithOptions(EncryptionOptions{
+		Context: context,
+		Nonce:   nonce,
+	}, value, factories...)
+}
+
+func (p *Policy) DecryptWithOptions(opts EncryptionOptions, value string, factories ...any) (string, error) {
 	if !p.Type.DecryptionSupported() {
 		return "", errutil.UserError{Err: fmt.Sprintf("message decryption not supported for key type %v", p.Type)}
 	}
@@ -946,9 +1097,10 @@ func (p *Policy) DecryptWithFactory(context, nonce []byte, value string, factori
 	if p.MinDecryptionVersion > 0 && ver < p.MinDecryptionVersion {
 		return "", errutil.UserError{Err: ErrTooOld}
 	}
+	opts.KeyVersion = ver
 
 	convergentVersion := p.convergentVersion(ver)
-	if convergentVersion == 1 && (nonce == nil || len(nonce) == 0) {
+	if convergentVersion == 1 && (opts.Nonce == nil || len(opts.Nonce) == 0) {
 		return "", errutil.UserError{Err: "invalid convergent nonce supplied"}
 	}
 
@@ -967,7 +1119,7 @@ func (p *Policy) DecryptWithFactory(context, nonce []byte, value string, factori
 			numBytes = 16
 		}
 
-		encKey, err := p.GetKey(context, ver, numBytes)
+		encKey, err := p.GetKey(opts.Context, ver, numBytes)
 		if err != nil {
 			return "", err
 		}
@@ -1003,15 +1155,24 @@ func (p *Policy) DecryptWithFactory(context, nonce []byte, value string, factori
 			return "", err
 		}
 	case KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096:
+		paddingScheme, err := getPaddingScheme(factories)
+		if err != nil {
+			return "", err
+		}
 		keyEntry, err := p.safeGetKeyEntry(ver)
 		if err != nil {
 			return "", err
 		}
 		key := keyEntry.RSAKey
-		if key == nil {
-			return "", errutil.InternalError{Err: fmt.Sprintf("cannot decrypt ciphertext, key version does not have a private counterpart")}
+
+		switch paddingScheme {
+		case PaddingScheme_PKCS1v15:
+			plain, err = rsa.DecryptPKCS1v15(rand.Reader, key, decoded)
+		case PaddingScheme_OAEP:
+			plain, err = rsa.DecryptOAEP(sha256.New(), rand.Reader, key, decoded, nil)
+		default:
+			return "", errutil.InternalError{Err: fmt.Sprintf("unsupported RSA padding scheme %s", paddingScheme)}
 		}
-		plain, err = rsa.DecryptOAEP(sha256.New(), rand.Reader, key, decoded, nil)
 		if err != nil {
 			return "", errutil.InternalError{Err: fmt.Sprintf("failed to RSA decrypt the ciphertext: %v", err)}
 		}
@@ -1038,13 +1199,16 @@ func (p *Policy) DecryptWithFactory(context, nonce []byte, value string, factori
 			return "", errors.New("key type is managed_key, but managed key parameters were not provided")
 		}
 
-		plain, err = p.decryptWithManagedKey(managedKeyFactory.GetManagedKeyParameters(), keyEntry, decoded, nonce, aad)
+		plain, err = p.decryptWithManagedKey(managedKeyFactory.GetManagedKeyParameters(), keyEntry, decoded, opts.Nonce, aad)
 		if err != nil {
 			return "", err
 		}
 
 	default:
-		return "", errutil.InternalError{Err: fmt.Sprintf("unsupported key type %v", p.Type)}
+		plain, err = entDecryptWithOptions(p, opts, decoded)
+		if err != nil {
+			return "", err
+		}
 	}
 
 	return base64.StdEncoding.EncodeToString(plain), nil
@@ -1071,6 +1235,25 @@ func (p *Policy) HMACKey(version int) ([]byte, error) {
 	return keyEntry.HMACKey, nil
 }
 
+func (p *Policy) CMACKey(version int) ([]byte, error) {
+	switch {
+	case version < 0:
+		return nil, fmt.Errorf("key version does not exist (cannot be negative)")
+	case version > p.LatestVersion:
+		return nil, fmt.Errorf("key version does not exist; latest key version is %d", p.LatestVersion)
+	}
+	keyEntry, err := p.safeGetKeyEntry(version)
+	if err != nil {
+		return nil, err
+	}
+
+	if p.Type.CMACSupported() {
+		return keyEntry.Key, nil
+	}
+
+	return nil, fmt.Errorf("key type %s does not support CMAC operations", p.Type)
+}
+
 func (p *Policy) Sign(ver int, context, input []byte, hashAlgorithm HashType, sigAlgorithm string, marshaling MarshalingType) (*SigningResult, error) {
 	return p.SignWithOptions(ver, context, input, &SigningOptions{
 		HashAlgorithm: hashAlgorithm,
@@ -1130,91 +1313,12 @@ func (p *Policy) SignWithOptions(ver int, context, input []byte, options *Signin
 
 	switch p.Type {
 	case KeyType_ECDSA_P256, KeyType_ECDSA_P384, KeyType_ECDSA_P521:
-		var curveBits int
-		var curve elliptic.Curve
-		switch p.Type {
-		case KeyType_ECDSA_P384:
-			curveBits = 384
-			curve = elliptic.P384()
-		case KeyType_ECDSA_P521:
-			curveBits = 521
-			curve = elliptic.P521()
-		default:
-			curveBits = 256
-			curve = elliptic.P256()
-		}
-
-		key := &ecdsa.PrivateKey{
-			PublicKey: ecdsa.PublicKey{
-				Curve: curve,
-				X:     keyParams.EC_X,
-				Y:     keyParams.EC_Y,
-			},
-			D: keyParams.EC_D,
-		}
-
-		r, s, err := ecdsa.Sign(rand.Reader, key, input)
-		if err != nil {
-			return nil, err
-		}
-
-		switch marshaling {
-		case MarshalingTypeASN1:
-			// This is used by openssl and X.509
-			sig, err = asn1.Marshal(ecdsaSignature{
-				R: r,
-				S: s,
-			})
-			if err != nil {
-				return nil, err
-			}
-
-		case MarshalingTypeJWS:
-			// This is used by JWS
-
-			// First we have to get the length of the curve in bytes. Although
-			// we only support 256 now, we'll do this in an agnostic way so we
-			// can reuse this marshaling if we support e.g. 521. Getting the
-			// number of bytes without rounding up would be 65.125 so we need
-			// to add one in that case.
-			keyLen := curveBits / 8
-			if curveBits%8 > 0 {
-				keyLen++
-			}
-
-			// Now create the output array
-			sig = make([]byte, keyLen*2)
-			rb := r.Bytes()
-			sb := s.Bytes()
-			copy(sig[keyLen-len(rb):], rb)
-			copy(sig[2*keyLen-len(sb):], sb)
-
-		default:
-			return nil, errutil.UserError{Err: "requested marshaling type is invalid"}
-		}
-
+		sig, err = signWithECDSA(p.Type, keyParams, input, marshaling)
 	case KeyType_ED25519:
-		var key ed25519.PrivateKey
-
-		if p.Derived {
-			// Derive the key that should be used
-			var err error
-			key, err = p.GetKey(context, ver, 32)
-			if err != nil {
-				return nil, errutil.InternalError{Err: fmt.Sprintf("error deriving key: %v", err)}
-			}
-			pubKey = key.Public().(ed25519.PublicKey)
-		} else {
-			key = ed25519.PrivateKey(keyParams.Key)
-		}
-
-		// Per docs, do not pre-hash ed25519; it does two passes and performs
-		// its own hashing
-		sig, err = key.Sign(rand.Reader, input, crypto.Hash(0))
+		sig, pubKey, err = p.signWithEd25519(ver, input, context, options, keyParams)
 		if err != nil {
 			return nil, err
 		}
-
 	case KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096:
 		key := keyParams.RSAKey
 
@@ -1244,20 +1348,8 @@ func (p *Policy) SignWithOptions(ver int, context, input []byte, options *Signin
 		default:
 			return nil, errutil.InternalError{Err: fmt.Sprintf("unsupported rsa signature algorithm %s", sigAlgorithm)}
 		}
-
-	case KeyType_MANAGED_KEY:
-		keyEntry, err := p.safeGetKeyEntry(ver)
-		if err != nil {
-			return nil, err
-		}
-
-		sig, err = p.signWithManagedKey(options, keyEntry, input)
-		if err != nil {
-			return nil, err
-		}
-
 	default:
-		return nil, fmt.Errorf("unsupported key type %v", p.Type)
+		sig, err = entSignWithOptions(p, input, context, ver, hashAlgorithm, options)
 	}
 
 	// Convert to base64
@@ -1276,6 +1368,103 @@ func (p *Policy) SignWithOptions(ver int, context, input []byte, options *Signin
 	return res, nil
 }
 
+func (p *Policy) signWithEd25519(ver int, input []byte, context []byte, options *SigningOptions, keyParams KeyEntry) ([]byte, []byte, error) {
+	var key ed25519.PrivateKey
+	var pubKey []byte
+	if p.Derived {
+		// Derive the key that should be used
+		var err error
+		key, err = p.GetKey(context, ver, 32)
+		if err != nil {
+			return nil, nil, errutil.InternalError{Err: fmt.Sprintf("error deriving key: %v", err)}
+		}
+		pubKey = key.Public().(ed25519.PublicKey)
+	} else {
+		key = ed25519.PrivateKey(keyParams.Key)
+	}
+
+	opts, err := genEd25519Options(options.HashAlgorithm, options.SigContext)
+	if err != nil {
+		return nil, nil, errutil.UserError{Err: fmt.Sprintf("error generating Ed25519 options: %v", err)}
+	}
+
+	sig, err := key.Sign(rand.Reader, input, opts)
+	if err != nil {
+		return nil, nil, err
+	}
+	return sig, pubKey, nil
+}
+
+func signWithECDSA(keyType KeyType, keyParams KeyEntry, input []byte, marshaling MarshalingType) ([]byte, error) {
+	var curveBits int
+	var curve elliptic.Curve
+	switch keyType {
+	case KeyType_ECDSA_P256:
+		curveBits = 256
+		curve = elliptic.P256()
+	case KeyType_ECDSA_P384:
+		curveBits = 384
+		curve = elliptic.P384()
+	case KeyType_ECDSA_P521:
+		curveBits = 521
+		curve = elliptic.P521()
+	default:
+		return nil, fmt.Errorf("invalid key type %s for ECDSA", keyType)
+	}
+
+	key := &ecdsa.PrivateKey{
+		PublicKey: ecdsa.PublicKey{
+			Curve: curve,
+			X:     keyParams.EC_X,
+			Y:     keyParams.EC_Y,
+		},
+		D: keyParams.EC_D,
+	}
+
+	r, s, err := ecdsa.Sign(rand.Reader, key, input)
+	if err != nil {
+		return nil, err
+	}
+
+	var sig []byte
+	switch marshaling {
+	case MarshalingTypeASN1:
+		// This is used by openssl and X.509
+		sig, err = asn1.Marshal(ecdsaSignature{
+			R: r,
+			S: s,
+		})
+		if err != nil {
+			return nil, err
+		}
+
+	case MarshalingTypeJWS:
+		// This is used by JWS
+
+		// First we have to get the length of the curve in bytes. Although
+		// we only support 256 now, we'll do this in an agnostic way so we
+		// can reuse this marshaling if we support e.g. 521. Getting the
+		// number of bytes without rounding up would be 65.125 so we need
+		// to add one in that case.
+		keyLen := curveBits / 8
+		if curveBits%8 > 0 {
+			keyLen++
+		}
+
+		// Now create the output array
+		sig = make([]byte, keyLen*2)
+		rb := r.Bytes()
+		sb := s.Bytes()
+		copy(sig[keyLen-len(rb):], rb)
+		copy(sig[2*keyLen-len(sb):], sb)
+
+	default:
+		return nil, errutil.UserError{Err: "requested marshaling type is invalid"}
+	}
+
+	return sig, nil
+}
+
 func (p *Policy) VerifySignature(context, input []byte, hashAlgorithm HashType, sigAlgorithm string, marshaling MarshalingType, sig string) (bool, error) {
 	return p.VerifySignatureWithOptions(context, input, sig, &SigningOptions{
 		HashAlgorithm: hashAlgorithm,
@@ -1338,76 +1527,13 @@ func (p *Policy) VerifySignatureWithOptions(context, input []byte, sig string, o
 
 	switch p.Type {
 	case KeyType_ECDSA_P256, KeyType_ECDSA_P384, KeyType_ECDSA_P521:
-		var curve elliptic.Curve
-		switch p.Type {
-		case KeyType_ECDSA_P384:
-			curve = elliptic.P384()
-		case KeyType_ECDSA_P521:
-			curve = elliptic.P521()
-		default:
-			curve = elliptic.P256()
-		}
-
-		var ecdsaSig ecdsaSignature
-
-		switch marshaling {
-		case MarshalingTypeASN1:
-			rest, err := asn1.Unmarshal(sigBytes, &ecdsaSig)
-			if err != nil {
-				return false, errutil.UserError{Err: "supplied signature is invalid"}
-			}
-			if rest != nil && len(rest) != 0 {
-				return false, errutil.UserError{Err: "supplied signature contains extra data"}
-			}
-
-		case MarshalingTypeJWS:
-			paramLen := len(sigBytes) / 2
-			rb := sigBytes[:paramLen]
-			sb := sigBytes[paramLen:]
-			ecdsaSig.R = new(big.Int)
-			ecdsaSig.R.SetBytes(rb)
-			ecdsaSig.S = new(big.Int)
-			ecdsaSig.S.SetBytes(sb)
-		}
-
-		keyParams, err := p.safeGetKeyEntry(ver)
+		key, err := p.safeGetKeyEntry(ver)
 		if err != nil {
 			return false, err
 		}
-		key := &ecdsa.PublicKey{
-			Curve: curve,
-			X:     keyParams.EC_X,
-			Y:     keyParams.EC_Y,
-		}
-
-		return ecdsa.Verify(key, input, ecdsaSig.R, ecdsaSig.S), nil
-
+		return verifyWithECDSA(p.Type, key, input, sigBytes, marshaling)
 	case KeyType_ED25519:
-		var pub ed25519.PublicKey
-
-		if p.Derived {
-			// Derive the key that should be used
-			key, err := p.GetKey(context, ver, 32)
-			if err != nil {
-				return false, errutil.InternalError{Err: fmt.Sprintf("error deriving key: %v", err)}
-			}
-			pub = ed25519.PrivateKey(key).Public().(ed25519.PublicKey)
-		} else {
-			keyEntry, err := p.safeGetKeyEntry(ver)
-			if err != nil {
-				return false, err
-			}
-
-			raw, err := base64.StdEncoding.DecodeString(keyEntry.FormattedPublicKey)
-			if err != nil {
-				return false, err
-			}
-
-			pub = ed25519.PublicKey(raw)
-		}
-
-		return ed25519.Verify(pub, input, sigBytes), nil
-
+		return p.verifyEd25519WithOptions(ver, input, context, options, sigBytes)
 	case KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096:
 		keyEntry, err := p.safeGetKeyEntry(ver)
 		if err != nil {
@@ -1445,17 +1571,95 @@ func (p *Policy) VerifySignatureWithOptions(context, input []byte, sig string, o
 
 		return err == nil, nil
 
-	case KeyType_MANAGED_KEY:
+	default:
+		return entVerifySignatureWithOptions(p, input, context, sigBytes, ver, options)
+	}
+}
+
+func verifyWithECDSA(keyType KeyType, keyParams KeyEntry, input, sigBytes []byte, marshaling MarshalingType) (bool, error) {
+	var curve elliptic.Curve
+	switch keyType {
+	case KeyType_ECDSA_P256:
+		curve = elliptic.P256()
+	case KeyType_ECDSA_P384:
+		curve = elliptic.P384()
+	case KeyType_ECDSA_P521:
+		curve = elliptic.P521()
+	default:
+		return false, fmt.Errorf("invalid key type %s for ECDSA", keyType)
+	}
+
+	var ecdsaSig ecdsaSignature
+
+	switch marshaling {
+	case MarshalingTypeASN1:
+		rest, err := asn1.Unmarshal(sigBytes, &ecdsaSig)
+		if err != nil {
+			return false, errutil.UserError{Err: "supplied signature is invalid"}
+		}
+		if rest != nil && len(rest) != 0 {
+			return false, errutil.UserError{Err: "supplied signature contains extra data"}
+		}
+
+	case MarshalingTypeJWS:
+		paramLen := len(sigBytes) / 2
+		rb := sigBytes[:paramLen]
+		sb := sigBytes[paramLen:]
+		ecdsaSig.R = new(big.Int)
+		ecdsaSig.R.SetBytes(rb)
+		ecdsaSig.S = new(big.Int)
+		ecdsaSig.S.SetBytes(sb)
+	}
+
+	key := &ecdsa.PublicKey{
+		Curve: curve,
+		X:     keyParams.EC_X,
+		Y:     keyParams.EC_Y,
+	}
+
+	return ecdsa.Verify(key, input, ecdsaSig.R, ecdsaSig.S), nil
+}
+
+func (p *Policy) verifyEd25519WithOptions(ver int, input []byte, context []byte, options *SigningOptions, sigBytes []byte) (bool, error) {
+	var pub ed25519.PublicKey
+	if p.Derived {
+		// Derive the key that should be used
+		key, err := p.GetKey(context, ver, 32)
+		if err != nil {
+			return false, errutil.InternalError{Err: fmt.Sprintf("error deriving key: %v", err)}
+		}
+		pub = ed25519.PrivateKey(key).Public().(ed25519.PublicKey)
+	} else {
 		keyEntry, err := p.safeGetKeyEntry(ver)
 		if err != nil {
 			return false, err
 		}
 
-		return p.verifyWithManagedKey(options, keyEntry, input, sigBytes)
+		raw, err := base64.StdEncoding.DecodeString(keyEntry.FormattedPublicKey)
+		if err != nil {
+			return false, err
+		}
 
-	default:
-		return false, errutil.InternalError{Err: fmt.Sprintf("unsupported key type %v", p.Type)}
+		pub = ed25519.PublicKey(raw)
+	}
+
+	return p.verifyEd25519WithPublicKey(input, sigBytes, pub, options)
+}
+
+func (p *Policy) verifyEd25519WithPublicKey(input []byte, sigBytes []byte, pub ed25519.PublicKey, options *SigningOptions) (bool, error) {
+	opts, err := genEd25519Options(options.HashAlgorithm, options.SigContext)
+	if err != nil {
+		return false, errutil.UserError{Err: fmt.Sprintf("error generating Ed25519 options: %v", err)}
+	}
+	if pub == nil {
+		return false, errutil.InternalError{Err: "no Ed25519 public key on policy"}
+	}
+	if err := stdlibEd25519.VerifyWithOptions(pub, input, sigBytes, opts); err != nil {
+		// We drop the error, just report back that we failed signature verification
+		return false, nil
 	}
+
+	return true, nil
 }
 
 func (p *Policy) Import(ctx context.Context, storage logical.Storage, key []byte, randReader io.Reader) error {
@@ -1493,13 +1697,14 @@ func (p *Policy) ImportPublicOrPrivate(ctx context.Context, storage logical.Stor
 		return fmt.Errorf("unable to import only public key for derived Ed25519 key: imported key should not be an Ed25519 key pair but is instead an HKDF key")
 	}
 
-	if (p.Type == KeyType_AES128_GCM96 && len(key) != 16) ||
-		((p.Type == KeyType_AES256_GCM96 || p.Type == KeyType_ChaCha20_Poly1305) && len(key) != 32) ||
+	if ((p.Type == KeyType_AES128_GCM96 || p.Type == KeyType_AES128_CMAC || p.Type == KeyType_AES128_CBC) && len(key) != 16) ||
+		((p.Type == KeyType_AES256_GCM96 || p.Type == KeyType_ChaCha20_Poly1305 || p.Type == KeyType_AES256_CMAC || p.Type == KeyType_AES256_CBC) && len(key) != 32) ||
+		(p.Type == KeyType_AES192_CMAC && len(key) != 24) ||
 		(p.Type == KeyType_HMAC && (len(key) < HmacMinKeySize || len(key) > HmacMaxKeySize)) {
 		return fmt.Errorf("invalid key size %d bytes for key type %s", len(key), p.Type)
 	}
 
-	if p.Type == KeyType_AES128_GCM96 || p.Type == KeyType_AES256_GCM96 || p.Type == KeyType_ChaCha20_Poly1305 || p.Type == KeyType_HMAC {
+	if p.Type == KeyType_AES128_GCM96 || p.Type == KeyType_AES256_GCM96 || p.Type == KeyType_ChaCha20_Poly1305 || p.Type == KeyType_HMAC || p.Type == KeyType_AES128_CMAC || p.Type == KeyType_AES256_CMAC || p.Type == KeyType_AES192_CMAC || p.Type == KeyType_AES128_CBC || p.Type == KeyType_AES256_CBC {
 		entry.Key = key
 		if p.Type == KeyType_HMAC {
 			p.KeySize = len(key)
@@ -1611,18 +1816,23 @@ func (p *Policy) RotateInMemory(randReader io.Reader) (retErr error) {
 		DeprecatedCreationTime: now.Unix(),
 	}
 
-	hmacKey, err := uuid.GenerateRandomBytesWithReader(32, randReader)
-	if err != nil {
-		return err
+	if p.Type != KeyType_AES128_CMAC && p.Type != KeyType_AES256_CMAC && p.Type != KeyType_HMAC && p.Type != KeyType_AES192_CMAC {
+		hmacKey, err := uuid.GenerateRandomBytesWithReader(32, randReader)
+		if err != nil {
+			return err
+		}
+		entry.HMACKey = hmacKey
 	}
-	entry.HMACKey = hmacKey
 
+	var err error
 	switch p.Type {
-	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_HMAC:
+	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_HMAC, KeyType_AES128_CMAC, KeyType_AES256_CMAC, KeyType_AES192_CMAC, KeyType_AES128_CBC, KeyType_AES256_CBC:
 		// Default to 256 bit key
 		numBytes := 32
-		if p.Type == KeyType_AES128_GCM96 {
+		if p.Type == KeyType_AES128_GCM96 || p.Type == KeyType_AES128_CMAC || p.Type == KeyType_AES128_CBC {
 			numBytes = 16
+		} else if p.Type == KeyType_AES192_CMAC {
+			numBytes = 24
 		} else if p.Type == KeyType_HMAC {
 			numBytes = p.KeySize
 			if numBytes < HmacMinKeySize || numBytes > HmacMaxKeySize {
@@ -1641,51 +1851,15 @@ func (p *Policy) RotateInMemory(randReader io.Reader) (retErr error) {
 		}
 
 	case KeyType_ECDSA_P256, KeyType_ECDSA_P384, KeyType_ECDSA_P521:
-		var curve elliptic.Curve
-		switch p.Type {
-		case KeyType_ECDSA_P384:
-			curve = elliptic.P384()
-		case KeyType_ECDSA_P521:
-			curve = elliptic.P521()
-		default:
-			curve = elliptic.P256()
-		}
-
-		privKey, err := ecdsa.GenerateKey(curve, rand.Reader)
-		if err != nil {
+		if err = generateECDSAKey(p.Type, &entry); err != nil {
 			return err
 		}
-		entry.EC_D = privKey.D
-		entry.EC_X = privKey.X
-		entry.EC_Y = privKey.Y
-		derBytes, err := x509.MarshalPKIXPublicKey(privKey.Public())
-		if err != nil {
-			return errwrap.Wrapf("error marshaling public key: {{err}}", err)
-		}
-		pemBlock := &pem.Block{
-			Type:  "PUBLIC KEY",
-			Bytes: derBytes,
-		}
-		pemBytes := pem.EncodeToMemory(pemBlock)
-		if pemBytes == nil || len(pemBytes) == 0 {
-			return fmt.Errorf("error PEM-encoding public key")
-		}
-		entry.FormattedPublicKey = string(pemBytes)
 
 	case KeyType_ED25519:
-		// Go uses a 64-byte private key for Ed25519 keys (private+public, each
-		// 32-bytes long). When we do Key derivation, we still generate a 32-byte
-		// random value (and compute the corresponding Ed25519 public key), but
-		// use this entire 64-byte key as if it was an HKDF key. The corresponding
-		// underlying public key is never returned (which is probably good, because
-		// doing so would leak half of our HKDF key...), but means we cannot import
-		// derived-enabled Ed25519 public key components.
-		pub, pri, err := ed25519.GenerateKey(randReader)
+		err := generateEd25519Key(randReader, &entry.Key, &entry.FormattedPublicKey)
 		if err != nil {
 			return err
 		}
-		entry.Key = pri
-		entry.FormattedPublicKey = base64.StdEncoding.EncodeToString(pub)
 	case KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096:
 		bitSize := 2048
 		if p.Type == KeyType_RSA3072 {
@@ -1695,10 +1869,17 @@ func (p *Policy) RotateInMemory(randReader io.Reader) (retErr error) {
 			bitSize = 4096
 		}
 
-		entry.RSAKey, err = rsa.GenerateKey(randReader, bitSize)
+		entry.RSAKey, err = cryptoutil.GenerateRSAKey(randReader, bitSize)
 		if err != nil {
 			return err
 		}
+
+		entry.RSAPublicKey = entry.RSAKey.Public().(*rsa.PublicKey)
+
+	default:
+		if err := entRotateInMemory(p, &entry, randReader); err != nil {
+			return err
+		}
 	}
 
 	if p.ConvergentEncryption {
@@ -1727,6 +1908,23 @@ func (p *Policy) RotateInMemory(randReader io.Reader) (retErr error) {
 	return nil
 }
 
+func generateEd25519Key(randReader io.Reader, private *[]byte, public *string) error {
+	// Go uses a 64-byte private key for Ed25519 keys (private+public, each
+	// 32-bytes long). When we do Key derivation, we still generate a 32-byte
+	// random value (and compute the corresponding Ed25519 public key), but
+	// use this entire 64-byte key as if it was an HKDF key. The corresponding
+	// underlying public key is never returned (which is probably good, because
+	// doing so would leak half of our HKDF key...), but means we cannot import
+	// derived-enabled Ed25519 public key components.
+	pub, pri, err := ed25519.GenerateKey(randReader)
+	if err != nil {
+		return err
+	}
+	*private = pri
+	*public = base64.StdEncoding.EncodeToString(pub)
+	return nil
+}
+
 func (p *Policy) MigrateKeyToKeysMap() {
 	now := time.Now()
 	p.Keys = keyEntryMap{
@@ -1978,7 +2176,15 @@ func (p *Policy) SymmetricDecryptRaw(encKey, ciphertext []byte, opts SymmetricOp
 	return plain, nil
 }
 
-func (p *Policy) EncryptWithFactory(ver int, context []byte, nonce []byte, value string, factories ...interface{}) (string, error) {
+func (p *Policy) EncryptWithFactory(ver int, context []byte, nonce []byte, value string, factories ...any) (string, error) {
+	return p.EncryptWithOptions(EncryptionOptions{
+		KeyVersion: ver,
+		Context:    context,
+		Nonce:      nonce,
+	}, value, factories...)
+}
+
+func (p *Policy) EncryptWithOptions(opts EncryptionOptions, value string, factories ...any) (string, error) {
 	if !p.Type.EncryptionSupported() {
 		return "", errutil.UserError{Err: fmt.Sprintf("message encryption not supported for key type %v", p.Type)}
 	}
@@ -1990,13 +2196,13 @@ func (p *Policy) EncryptWithFactory(ver int, context []byte, nonce []byte, value
 	}
 
 	switch {
-	case ver == 0:
-		ver = p.LatestVersion
-	case ver < 0:
+	case opts.KeyVersion == 0:
+		opts.KeyVersion = p.LatestVersion
+	case opts.KeyVersion < 0:
 		return "", errutil.UserError{Err: "requested version for encryption is negative"}
-	case ver > p.LatestVersion:
+	case opts.KeyVersion > p.LatestVersion:
 		return "", errutil.UserError{Err: "requested version for encryption is higher than the latest key version"}
-	case ver < p.MinEncryptionVersion:
+	case opts.KeyVersion < p.MinEncryptionVersion:
 		return "", errutil.UserError{Err: "requested version for encryption is less than the minimum encryption key version"}
 	}
 
@@ -2004,51 +2210,15 @@ func (p *Policy) EncryptWithFactory(ver int, context []byte, nonce []byte, value
 
 	switch p.Type {
 	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305:
-		hmacKey := context
-
-		var encKey []byte
-		var deriveHMAC bool
-
-		encBytes := 32
-		hmacBytes := 0
-		convergentVersion := p.convergentVersion(ver)
-		if convergentVersion > 2 {
-			deriveHMAC = true
-			hmacBytes = 32
-			if len(nonce) > 0 {
-				return "", errutil.UserError{Err: "nonce provided when not allowed"}
-			}
-		} else if len(nonce) > 0 && (!p.ConvergentEncryption || convergentVersion != 1) {
-			return "", errutil.UserError{Err: "nonce provided when not allowed"}
-		}
-		if p.Type == KeyType_AES128_GCM96 {
-			encBytes = 16
-		}
-
-		key, err := p.GetKey(context, ver, encBytes+hmacBytes)
+		encKey, hmacKey, err := p.getSymmetricKeys(opts)
 		if err != nil {
 			return "", err
 		}
 
-		if len(key) < encBytes+hmacBytes {
-			return "", errutil.InternalError{Err: "could not derive key, length too small"}
-		}
-
-		encKey = key[:encBytes]
-		if len(encKey) != encBytes {
-			return "", errutil.InternalError{Err: "could not derive enc key, length not correct"}
-		}
-		if deriveHMAC {
-			hmacKey = key[encBytes:]
-			if len(hmacKey) != hmacBytes {
-				return "", errutil.InternalError{Err: "could not derive hmac key, length not correct"}
-			}
-		}
-
 		symopts := SymmetricOpts{
 			Convergent: p.ConvergentEncryption,
 			HMACKey:    hmacKey,
-			Nonce:      nonce,
+			Nonce:      opts.Nonce,
 		}
 		for index, rawFactory := range factories {
 			if rawFactory == nil {
@@ -2068,12 +2238,16 @@ func (p *Policy) EncryptWithFactory(ver int, context []byte, nonce []byte, value
 			}
 		}
 
-		ciphertext, err = p.SymmetricEncryptRaw(ver, encKey, plaintext, symopts)
+		ciphertext, err = p.SymmetricEncryptRaw(opts.KeyVersion, encKey, plaintext, symopts)
 		if err != nil {
 			return "", err
 		}
 	case KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096:
-		keyEntry, err := p.safeGetKeyEntry(ver)
+		paddingScheme, err := getPaddingScheme(factories)
+		if err != nil {
+			return "", err
+		}
+		keyEntry, err := p.safeGetKeyEntry(opts.KeyVersion)
 		if err != nil {
 			return "", err
 		}
@@ -2083,12 +2257,20 @@ func (p *Policy) EncryptWithFactory(ver int, context []byte, nonce []byte, value
 		} else {
 			publicKey = keyEntry.RSAPublicKey
 		}
-		ciphertext, err = rsa.EncryptOAEP(sha256.New(), rand.Reader, publicKey, plaintext, nil)
+		switch paddingScheme {
+		case PaddingScheme_PKCS1v15:
+			ciphertext, err = rsa.EncryptPKCS1v15(rand.Reader, publicKey, plaintext)
+		case PaddingScheme_OAEP:
+			ciphertext, err = rsa.EncryptOAEP(sha256.New(), rand.Reader, publicKey, plaintext, nil)
+		default:
+			return "", errutil.InternalError{Err: fmt.Sprintf("unsupported RSA padding scheme %s", paddingScheme)}
+		}
+
 		if err != nil {
 			return "", errutil.InternalError{Err: fmt.Sprintf("failed to RSA encrypt the plaintext: %v", err)}
 		}
 	case KeyType_MANAGED_KEY:
-		keyEntry, err := p.safeGetKeyEntry(ver)
+		keyEntry, err := p.safeGetKeyEntry(opts.KeyVersion)
 		if err != nil {
 			return "", err
 		}
@@ -2111,24 +2293,86 @@ func (p *Policy) EncryptWithFactory(ver int, context []byte, nonce []byte, value
 			return "", errors.New("key type is managed_key, but managed key parameters were not provided")
 		}
 
-		ciphertext, err = p.encryptWithManagedKey(managedKeyFactory.GetManagedKeyParameters(), keyEntry, plaintext, nonce, aad)
+		ciphertext, err = p.encryptWithManagedKey(managedKeyFactory.GetManagedKeyParameters(), keyEntry, plaintext, opts.Nonce, aad)
 		if err != nil {
 			return "", err
 		}
 
 	default:
-		return "", errutil.InternalError{Err: fmt.Sprintf("unsupported key type %v", p.Type)}
+		ciphertext, err = entEncryptWithOptions(p, opts, plaintext)
+		if err != nil {
+			return "", err
+		}
 	}
 
 	// Convert to base64
 	encoded := base64.StdEncoding.EncodeToString(ciphertext)
 
 	// Prepend some information
-	encoded = p.getVersionPrefix(ver) + encoded
+	encoded = p.getVersionPrefix(opts.KeyVersion) + encoded
 
 	return encoded, nil
 }
 
+func (p *Policy) getSymmetricKeys(opts EncryptionOptions) ([]byte, []byte, error) {
+	hmacKey := opts.Context
+
+	var encKey []byte
+	var deriveHMAC bool
+
+	encBytes := 32
+	hmacBytes := 0
+	convergentVersion := p.convergentVersion(opts.KeyVersion)
+
+	if convergentVersion > 2 {
+		deriveHMAC = true
+		hmacBytes = 32
+		if len(opts.Nonce) > 0 {
+			return nil, nil, errutil.UserError{Err: "nonce provided when not allowed"}
+		}
+	} else if len(opts.Nonce) > 0 && (!p.ConvergentEncryption || convergentVersion != 1) {
+		return nil, nil, errutil.UserError{Err: "nonce provided when not allowed"}
+	}
+	if p.Type == KeyType_AES128_GCM96 || p.Type == KeyType_AES128_CBC {
+		encBytes = 16
+	}
+
+	key, err := p.GetKey(opts.Context, opts.KeyVersion, encBytes+hmacBytes)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if len(key) < encBytes+hmacBytes {
+		return nil, nil, errutil.InternalError{Err: "could not derive key, length too small"}
+	}
+
+	encKey = key[:encBytes]
+	if len(encKey) != encBytes {
+		return nil, nil, errutil.InternalError{Err: "could not derive enc key, length not correct"}
+	}
+	if deriveHMAC {
+		hmacKey = key[encBytes:]
+		if len(hmacKey) != hmacBytes {
+			return nil, nil, errutil.InternalError{Err: "could not derive hmac key, length not correct"}
+		}
+	}
+
+	return encKey, hmacKey, nil
+}
+
+func getPaddingScheme(factories []any) (PaddingScheme, error) {
+	for _, rawFactory := range factories {
+		if rawFactory == nil {
+			continue
+		}
+
+		if p, ok := rawFactory.(PaddingScheme); ok && p != "" {
+			return p, nil
+		}
+	}
+	return PaddingScheme_OAEP, nil
+}
+
 func (p *Policy) KeyVersionCanBeUpdated(keyVersion int, isPrivateKey bool) error {
 	keyEntry, err := p.safeGetKeyEntry(keyVersion)
 	if err != nil {
@@ -2324,7 +2568,7 @@ func (ke *KeyEntry) parseFromKey(PolKeyType KeyType, parsedKey any) error {
 	return nil
 }
 
-func (p *Policy) WrapKey(ver int, targetKey interface{}, targetKeyType KeyType, hash hash.Hash) (string, error) {
+func (p *Policy) WrapKey(ver int, targetKey any, targetKeyType KeyType, hash hash.Hash) (string, error) {
 	if !p.Type.SigningSupported() {
 		return "", fmt.Errorf("message signing not supported for key type %v", p.Type)
 	}
@@ -2348,7 +2592,7 @@ func (p *Policy) WrapKey(ver int, targetKey interface{}, targetKeyType KeyType,
 	return keyEntry.WrapKey(targetKey, targetKeyType, hash)
 }
 
-func (ke *KeyEntry) WrapKey(targetKey interface{}, targetKeyType KeyType, hash hash.Hash) (string, error) {
+func (ke *KeyEntry) WrapKey(targetKey any, targetKeyType KeyType, hash hash.Hash) (string, error) {
 	// Presently this method implements a CKM_RSA_AES_KEY_WRAP-compatible
 	// wrapping interface and only works on RSA keyEntries as a result.
 	if ke.RSAPublicKey == nil {
@@ -2357,7 +2601,7 @@ func (ke *KeyEntry) WrapKey(targetKey interface{}, targetKeyType KeyType, hash h
 
 	var preppedTargetKey []byte
 	switch targetKeyType {
-	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_HMAC:
+	case KeyType_AES128_GCM96, KeyType_AES256_GCM96, KeyType_ChaCha20_Poly1305, KeyType_HMAC, KeyType_AES128_CMAC, KeyType_AES256_CMAC, KeyType_AES192_CMAC, KeyType_AES128_CBC, KeyType_AES256_CBC:
 		var ok bool
 		preppedTargetKey, ok = targetKey.([]byte)
 		if !ok {
@@ -2595,3 +2839,51 @@ func (p *Policy) ValidateAndPersistCertificateChain(ctx context.Context, keyVers
 	p.Keys[strconv.Itoa(keyVersion)] = keyEntry
 	return p.Persist(ctx, storage)
 }
+
+func generateECDSAKey(keyType KeyType, entry *KeyEntry) error {
+	var curve elliptic.Curve
+	switch keyType {
+	case KeyType_ECDSA_P256:
+		curve = elliptic.P256()
+	case KeyType_ECDSA_P384:
+		curve = elliptic.P384()
+	case KeyType_ECDSA_P521:
+		curve = elliptic.P521()
+	default:
+		return fmt.Errorf("invalid key type %s for ECDSA", keyType)
+	}
+
+	privKey, err := ecdsa.GenerateKey(curve, rand.Reader)
+	if err != nil {
+		return err
+	}
+	entry.EC_D = privKey.D
+	entry.EC_X = privKey.X
+	entry.EC_Y = privKey.Y
+	derBytes, err := x509.MarshalPKIXPublicKey(privKey.Public())
+	if err != nil {
+		return errwrap.Wrapf("error marshaling public key: {{err}}", err)
+	}
+	pemBlock := &pem.Block{
+		Type:  "PUBLIC KEY",
+		Bytes: derBytes,
+	}
+	pemBytes := pem.EncodeToMemory(pemBlock)
+	if pemBytes == nil || len(pemBytes) == 0 {
+		return fmt.Errorf("error PEM-encoding public key")
+	}
+	entry.FormattedPublicKey = string(pemBytes)
+
+	return nil
+}
+
+func (p *Policy) setKDF(ctx context.Context, storage logical.Storage, kdf int) error {
+	p.KDF = kdf
+
+	err := p.Persist(ctx, storage)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/sdk/helper/keysutil/policy_ce.go b/sdk/helper/keysutil/policy_ce.go
new file mode 100644
index 00000000000..51101bd1e20
--- /dev/null
+++ b/sdk/helper/keysutil/policy_ce.go
@@ -0,0 +1,39 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package keysutil
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/hashicorp/vault/sdk/helper/errutil"
+)
+
+type entKeyEntry struct{}
+
+func (e entKeyEntry) IsEntPrivateKeyMissing() bool {
+	return true
+}
+
+func entSignWithOptions(p *Policy, input, context []byte, ver int, hashAlgorithm HashType, options *SigningOptions) ([]byte, error) {
+	return nil, fmt.Errorf("unsupported key type %v", p.Type)
+}
+
+func entVerifySignatureWithOptions(p *Policy, input, context []byte, sigBytes []byte, ver int, options *SigningOptions) (bool, error) {
+	return false, errutil.InternalError{Err: fmt.Sprintf("unsupported key type %v", p.Type)}
+}
+
+func entRotateInMemory(p *Policy, entry *KeyEntry, rand io.Reader) error {
+	return fmt.Errorf("unsupported key type %v", p.Type)
+}
+
+func entEncryptWithOptions(p *Policy, opts EncryptionOptions, value []byte) ([]byte, error) {
+	return nil, fmt.Errorf("unsupported key type %v", p.Type)
+}
+
+func entDecryptWithOptions(p *Policy, opts EncryptionOptions, value []byte) ([]byte, error) {
+	return nil, errutil.InternalError{Err: fmt.Sprintf("unsupported key type %v", p.Type)}
+}
diff --git a/sdk/helper/keysutil/policy_test.go b/sdk/helper/keysutil/policy_test.go
index 487804b719d..e6f4ce065ca 100644
--- a/sdk/helper/keysutil/policy_test.go
+++ b/sdk/helper/keysutil/policy_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package keysutil
@@ -11,16 +11,19 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"crypto/x509"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	mathrand "math/rand"
 	"reflect"
+	"runtime"
 	"strconv"
 	"strings"
 	"sync"
 	"testing"
 	"time"
 
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -28,6 +31,121 @@ import (
 	"golang.org/x/crypto/ed25519"
 )
 
+// Ordering of these items needs to match the iota order defined in policy.go. Ordering changes
+// should never occur, as it would lead to a key type change within existing stored policies.
+var allTestKeyTypes = []KeyType{
+	KeyType_AES256_GCM96, KeyType_ECDSA_P256, KeyType_ED25519, KeyType_RSA2048,
+	KeyType_RSA4096, KeyType_ChaCha20_Poly1305, KeyType_ECDSA_P384, KeyType_ECDSA_P521, KeyType_AES128_GCM96,
+	KeyType_RSA3072, KeyType_MANAGED_KEY, KeyType_HMAC, KeyType_AES128_CMAC, KeyType_AES256_CMAC, KeyType_ML_DSA,
+	KeyType_HYBRID, KeyType_AES192_CMAC, KeyType_SLH_DSA, KeyType_AES128_CBC, KeyType_AES256_CBC,
+}
+
+func TestPolicy_KeyTypes(t *testing.T) {
+	// Make sure the iota value never change for key types, as existing storage would be affected
+	for i, keyType := range allTestKeyTypes {
+		if int(keyType) != i {
+			t.Fatalf("iota of keytype %s changed, expected %d got %d", keyType.String(), i, keyType)
+		}
+	}
+
+	// Make sure we have a string presentation for all types
+	for _, keyType := range allTestKeyTypes {
+		if strings.Contains(keyType.String(), "unknown") {
+			t.Fatalf("keytype with iota of %d should not contain 'unknown', missing in String() switch statement", keyType)
+		}
+	}
+}
+
+func TestPolicy_HmacCmacSupported(t *testing.T) {
+	// Test HMAC supported feature
+	for _, keyType := range allTestKeyTypes {
+		switch keyType {
+		case KeyType_MANAGED_KEY:
+			if keyType.HMACSupported() {
+				t.Fatalf("hmac should not have been not be supported for keytype %s", keyType.String())
+			}
+			if keyType.CMACSupported() {
+				t.Fatalf("cmac should not have been be supported for keytype %s", keyType.String())
+			}
+		case KeyType_AES128_CMAC, KeyType_AES256_CMAC, KeyType_AES192_CMAC:
+			if keyType.HMACSupported() {
+				t.Fatalf("hmac should have been not be supported for keytype %s", keyType.String())
+			}
+			if !keyType.CMACSupported() {
+				t.Fatalf("cmac should have been be supported for keytype %s", keyType.String())
+			}
+		default:
+			if !keyType.HMACSupported() {
+				t.Fatalf("hmac should have been supported for keytype %s", keyType.String())
+			}
+			if keyType.CMACSupported() {
+				t.Fatalf("cmac should not have been supported for keytype %s", keyType.String())
+			}
+		}
+	}
+}
+
+func TestPolicy_CMACKeyUpgrade(t *testing.T) {
+	ctx := context.Background()
+	lm, _ := NewLockManager(false, 0)
+	storage := &logical.InmemStorage{}
+	p, upserted, err := lm.GetPolicy(ctx, PolicyRequest{
+		Upsert:  true,
+		Storage: storage,
+		KeyType: KeyType_AES256_CMAC,
+		Name:    "test",
+	}, rand.Reader)
+	if err != nil {
+		t.Fatalf("failed loading policy: %v", err)
+	}
+	if p == nil {
+		t.Fatal("nil policy")
+	}
+	if !upserted {
+		t.Fatal("expected an upsert")
+	}
+
+	// This verifies we don't have a hmac key
+	_, err = p.HMACKey(1)
+	if err == nil {
+		t.Fatal("cmac key should not return an hmac key but did on initial creation")
+	}
+
+	if p.NeedsUpgrade() {
+		t.Fatal("cmac key should not require an upgrade after initial key creation")
+	}
+
+	err = p.Upgrade(ctx, storage, rand.Reader)
+	if err != nil {
+		t.Fatalf("an error was returned from upgrade method: %v", err)
+	}
+	p.Unlock()
+
+	// Now reload our policy from disk and make sure we still don't have a hmac key
+	p, upserted, err = lm.GetPolicy(ctx, PolicyRequest{
+		Upsert:  true,
+		Storage: storage,
+		KeyType: KeyType_AES256_CMAC,
+		Name:    "test",
+	}, rand.Reader)
+	if err != nil {
+		t.Fatalf("failed loading policy: %v", err)
+	}
+	if p == nil {
+		t.Fatal("nil policy")
+	}
+	if upserted {
+		t.Fatal("expected the key to exist but upserted was true")
+	}
+
+	p.Unlock()
+
+	_, err = p.HMACKey(1)
+	if err == nil {
+		t.Fatal("cmac key should not return an hmac key post upgrade")
+	}
+}
+
 func TestPolicy_KeyEntryMapUpgrade(t *testing.T) {
 	now := time.Now()
 	old := map[int]KeyEntry{
@@ -695,7 +813,7 @@ func Test_Import(t *testing.T) {
 func generateTestKeys() (map[KeyType][]byte, error) {
 	keyMap := make(map[KeyType][]byte)
 
-	rsaKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	rsaKey, err := cryptoutil.GenerateRSAKey(rand.Reader, 2048)
 	if err != nil {
 		return nil, err
 	}
@@ -705,7 +823,7 @@ func generateTestKeys() (map[KeyType][]byte, error) {
 	}
 	keyMap[KeyType_RSA2048] = rsaKeyBytes
 
-	rsaKey, err = rsa.GenerateKey(rand.Reader, 3072)
+	rsaKey, err = cryptoutil.GenerateRSAKey(rand.Reader, 3072)
 	if err != nil {
 		return nil, err
 	}
@@ -715,7 +833,7 @@ func generateTestKeys() (map[KeyType][]byte, error) {
 	}
 	keyMap[KeyType_RSA3072] = rsaKeyBytes
 
-	rsaKey, err = rsa.GenerateKey(rand.Reader, 4096)
+	rsaKey, err = cryptoutil.GenerateRSAKey(rand.Reader, 4096)
 	if err != nil {
 		return nil, err
 	}
@@ -819,6 +937,25 @@ func autoVerify(depth int, t *testing.T, p *Policy, input []byte, sig *SigningRe
 	}
 }
 
+func autoVerifyDecrypt(depth int, t *testing.T, p *Policy, input []byte, ct string, factories ...any) {
+	tabs := strings.Repeat("\t", depth)
+	t.Log(tabs, "Automatically decrypting with options:", factories)
+
+	tabs = strings.Repeat("\t", depth+1)
+	ptb64, err := p.DecryptWithOptions(EncryptionOptions{}, ct, factories...)
+	if err != nil {
+		t.Fatal(tabs, "❌ Failed to automatically verify signature:", err)
+	}
+
+	pt, err := base64.StdEncoding.DecodeString(ptb64)
+	if err != nil {
+		t.Fatal(tabs, "❌ Failed decoding plaintext:", err)
+	}
+	if !bytes.Equal(input, pt) {
+		t.Fatal(tabs, "❌ Failed to automatically decrypt")
+	}
+}
+
 func Test_RSA_PSS(t *testing.T) {
 	t.Log("Testing RSA PSS")
 	mathrand.Seed(time.Now().UnixNano())
@@ -969,8 +1106,64 @@ func Test_RSA_PSS(t *testing.T) {
 	}
 }
 
-func Test_RSA_PKCS1(t *testing.T) {
-	t.Log("Testing RSA PKCS#1v1.5")
+func Test_RSA_PKCS1Encryption(t *testing.T) {
+	t.Log("Testing RSA PKCS#1v1.5 padded encryption")
+
+	ctx := context.Background()
+	storage := &logical.InmemStorage{}
+	// https://crypto.stackexchange.com/a/1222
+	pt := []byte("Sphinx of black quartz, judge my vow")
+	input := base64.StdEncoding.EncodeToString(pt)
+
+	tabs := make(map[int]string)
+	for i := 1; i <= 6; i++ {
+		tabs[i] = strings.Repeat("\t", i)
+	}
+
+	test_RSA_PKCS1 := func(t *testing.T, p *Policy, rsaKey *rsa.PrivateKey, padding PaddingScheme) {
+		// 1. Make a signature with the given key size and hash algorithm.
+		t.Log(tabs[3], "Make an automatic signature")
+		ct, err := p.EncryptWithOptions(EncryptionOptions{}, string(input), padding)
+		if err != nil {
+			t.Fatal(tabs[4], "❌ Failed to automatically encrypt:", err)
+		}
+
+		// 1.1 Verify this signature using the *inferred* salt length.
+		autoVerifyDecrypt(4, t, p, pt, ct, padding)
+	}
+
+	rsaKeyTypes := []KeyType{KeyType_RSA2048, KeyType_RSA3072, KeyType_RSA4096}
+	testKeys, err := generateTestKeys()
+	if err != nil {
+		t.Fatalf("error generating test keys: %s", err)
+	}
+
+	// 1. For each standard RSA key size 2048, 3072, and 4096...
+	for _, rsaKeyType := range rsaKeyTypes {
+		t.Log("Key size: ", rsaKeyType)
+		p := &Policy{
+			Name: fmt.Sprint(rsaKeyType), // NOTE: crucial to create a new key per key size
+			Type: rsaKeyType,
+		}
+
+		rsaKeyBytes := testKeys[rsaKeyType]
+		err := p.Import(ctx, storage, rsaKeyBytes, rand.Reader)
+		if err != nil {
+			t.Fatal(tabs[1], "❌ Failed to import key:", err)
+		}
+		rsaKeyAny, err := x509.ParsePKCS8PrivateKey(rsaKeyBytes)
+		if err != nil {
+			t.Fatalf("error parsing test keys: %s", err)
+		}
+		rsaKey := rsaKeyAny.(*rsa.PrivateKey)
+		for _, padding := range []PaddingScheme{PaddingScheme_OAEP, PaddingScheme_PKCS1v15, ""} {
+			t.Run(fmt.Sprintf("%s/%s", rsaKeyType.String(), padding), func(t *testing.T) { test_RSA_PKCS1(t, p, rsaKey, padding) })
+		}
+	}
+}
+
+func Test_RSA_PKCS1Signing(t *testing.T) {
+	t.Log("Testing RSA PKCS#1v1.5 signatures")
 
 	ctx := context.Background()
 	storage := &logical.InmemStorage{}
@@ -1059,9 +1252,13 @@ func Test_RSA_PKCS1(t *testing.T) {
 // FIPS Go build does not support at this time the SHA3 hashes as FIPS 140_2 does
 // not accept them.
 func isUnsupportedGoHashType(hashType HashType, err error) bool {
-	switch hashType {
-	case HashTypeSHA3224, HashTypeSHA3256, HashTypeSHA3384, HashTypeSHA3512:
-		return strings.Contains(err.Error(), "unsupported hash function")
+	// Skip over SHA3 hash tests when running with boringcrypto as it still doesn't support it or hasn't been
+	// validated yet. Wasn't available in FIPS-140-2, but should be in FIPS-140-3 eventually?
+	if strings.Contains(runtime.Version(), "X:boringcrypto") {
+		switch hashType {
+		case HashTypeSHA3224, HashTypeSHA3256, HashTypeSHA3384, HashTypeSHA3512:
+			return strings.Contains(err.Error(), "unsupported hash function")
+		}
 	}
 
 	return false
diff --git a/sdk/helper/keysutil/transit_lru.go b/sdk/helper/keysutil/transit_lru.go
index 66ea66dc74e..bdf36b14b48 100644
--- a/sdk/helper/keysutil/transit_lru.go
+++ b/sdk/helper/keysutil/transit_lru.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package keysutil
diff --git a/sdk/helper/keysutil/transit_syncmap.go b/sdk/helper/keysutil/transit_syncmap.go
index fddcf706b2f..6db208b7d23 100644
--- a/sdk/helper/keysutil/transit_syncmap.go
+++ b/sdk/helper/keysutil/transit_syncmap.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package keysutil
diff --git a/sdk/helper/keysutil/util.go b/sdk/helper/keysutil/util.go
index 94a56d42c57..86f7b4d2a92 100644
--- a/sdk/helper/keysutil/util.go
+++ b/sdk/helper/keysutil/util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package keysutil
@@ -66,7 +66,7 @@ func isEd25519OID(oid asn1.ObjectIdentifier) bool {
 	return oidNSSPKIXEd25519.Equal(oid) || oidRFC8410Ed25519.Equal(oid)
 }
 
-// ParsePKCS8PrivateKey parses an unencrypted private key in PKCS #8, ASN.1 DER form.
+// ParsePKCS8Ed25519PrivateKey parses an unencrypted private key in PKCS #8, ASN.1 DER form.
 //
 // It returns a *rsa.PrivateKey, a *ecdsa.PrivateKey, or a ed25519.PrivateKey.
 // More types might be supported in the future.
@@ -121,7 +121,7 @@ func ParsePKCS8Ed25519PrivateKey(der []byte) (key interface{}, err error) {
 	return ed25519.NewKeyFromSeed(ed25519Key.PrivateKey), nil
 }
 
-// ParsePKCS8PrivateKey parses an unencrypted private key in PKCS #8, ASN.1 DER form.
+// ParsePKCS8RSAPSSPrivateKey parses an unencrypted private key in PKCS #8, ASN.1 DER form.
 //
 // This helper only supports RSA/PSS keys (with OID 1.2.840.113549.1.1.10).
 //
diff --git a/sdk/helper/ldaputil/client.go b/sdk/helper/ldaputil/client.go
index a1901fdcb6d..a1a4fe80c80 100644
--- a/sdk/helper/ldaputil/client.go
+++ b/sdk/helper/ldaputil/client.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package ldaputil
@@ -622,7 +622,7 @@ func (c *Client) GetLdapGroups(cfg *ConfigEntry, conn Connection, userDN string,
 }
 
 // EscapeLDAPValue is exported because a plugin uses it outside this package.
-// EscapeLDAPValue will properly escape the input string as an ldap value
+// EscapeLDAPValue will properly escape the input string as a ldap value
 // rfc4514 states the following must be escaped:
 // - leading space or hash
 // - trailing space
diff --git a/sdk/helper/ldaputil/client_test.go b/sdk/helper/ldaputil/client_test.go
index dcce9c6e0e8..b7d35c1df92 100644
--- a/sdk/helper/ldaputil/client_test.go
+++ b/sdk/helper/ldaputil/client_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package ldaputil
diff --git a/sdk/helper/ldaputil/config.go b/sdk/helper/ldaputil/config.go
index 6e317d7a51e..28e055d54a9 100644
--- a/sdk/helper/ldaputil/config.go
+++ b/sdk/helper/ldaputil/config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package ldaputil
@@ -35,7 +35,8 @@ func ConfigFields() map[string]*framework.FieldSchema {
 			Default:     false,
 			Description: "Use anonymous binds when performing LDAP group searches (if true the initial credentials will still be used for the initial connection test).",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "Anonymous group search",
+				Name:  "Anonymous group search",
+				Group: "LDAP Options",
 			},
 		},
 		"url": {
@@ -43,7 +44,8 @@ func ConfigFields() map[string]*framework.FieldSchema {
 			Default:     "ldap://127.0.0.1",
 			Description: "LDAP URL to connect to (default: ldap://127.0.0.1). Multiple URLs can be specified by concatenating them with commas; they will be tried in-order.",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "URL",
+				Name:       "URL",
+				Identifier: true,
 			},
 		},
 
@@ -51,7 +53,8 @@ func ConfigFields() map[string]*framework.FieldSchema {
 			Type:        framework.TypeString,
 			Description: "LDAP domain to use for users (eg: ou=People,dc=example,dc=org)",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "User DN",
+				Name:  "User DN",
+				Group: "Customize User Search",
 			},
 		},
 
@@ -59,7 +62,8 @@ func ConfigFields() map[string]*framework.FieldSchema {
 			Type:        framework.TypeString,
 			Description: "LDAP DN for searching for the user DN (optional)",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "Name of Object to bind (binddn)",
+				Name:  "Name of Object to bind (binddn)",
+				Group: "Customize User Search",
 			},
 		},
 
@@ -68,6 +72,7 @@ func ConfigFields() map[string]*framework.FieldSchema {
 			Description: "LDAP password for searching for the user DN (optional)",
 			DisplayAttrs: &framework.DisplayAttributes{
 				Sensitive: true,
+				Group:     "Customize User Search",
 			},
 		},
 
@@ -75,7 +80,8 @@ func ConfigFields() map[string]*framework.FieldSchema {
 			Type:        framework.TypeString,
 			Description: "LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org)",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "Group DN",
+				Name:  "Group DN",
+				Group: "Customize Group Membership Search",
 			},
 		},
 
@@ -87,7 +93,8 @@ The template can access the following context variables: UserDN, Username
 Example: (&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))
 Default: (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))`,
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "Group Filter",
+				Name:  "Group Filter",
+				Group: "Customize Group Membership Search",
 			},
 		},
 
@@ -101,6 +108,7 @@ Default: cn`,
 			DisplayAttrs: &framework.DisplayAttributes{
 				Name:  "Group Attribute",
 				Value: "cn",
+				Group: "Customize Group Membership Search",
 			},
 		},
 
@@ -111,7 +119,8 @@ Default: cn`,
 The template can access the following context variables: UserAttr, Username
 Default: ({{.UserAttr}}={{.Username}})`,
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "User Search Filter",
+				Name:  "User Search Filter",
+				Group: "Customize User Search",
 			},
 		},
 
@@ -119,7 +128,8 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			Type:        framework.TypeString,
 			Description: "Enables userPrincipalDomain login with [username]@UPNDomain (optional)",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "User Principal (UPN) Domain",
+				Name:  "User Principal (UPN) Domain",
+				Group: "LDAP Options",
 			},
 		},
 
@@ -136,6 +146,7 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			DisplayAttrs: &framework.DisplayAttributes{
 				Name:  "User Attribute",
 				Value: "cn",
+				Group: "LDAP Options",
 			},
 		},
 
@@ -145,6 +156,7 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			DisplayAttrs: &framework.DisplayAttributes{
 				Name:     "CA certificate",
 				EditType: "file",
+				Group:    "LDAP Options",
 			},
 		},
 
@@ -154,6 +166,7 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			DisplayAttrs: &framework.DisplayAttributes{
 				Name:     "Client certificate",
 				EditType: "file",
+				Group:    "LDAP Options",
 			},
 		},
 
@@ -163,6 +176,7 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			DisplayAttrs: &framework.DisplayAttributes{
 				Name:     "Client key",
 				EditType: "file",
+				Group:    "LDAP Options",
 			},
 		},
 
@@ -170,7 +184,8 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			Type:        framework.TypeBool,
 			Description: "Use anonymous bind to discover the bind DN of a user (optional)",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "Discover DN",
+				Name:  "Discover DN",
+				Group: "LDAP Options",
 			},
 		},
 
@@ -178,7 +193,8 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			Type:        framework.TypeBool,
 			Description: "Skip LDAP server SSL Certificate verification - VERY insecure (optional)",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "Insecure TLS",
+				Name:  "Insecure TLS",
+				Group: "LDAP Options",
 			},
 		},
 
@@ -186,7 +202,8 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			Type:        framework.TypeBool,
 			Description: "Issue a StartTLS command after establishing unencrypted connection (optional)",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "Issue StartTLS",
+				Name:  "Issue StartTLS",
+				Group: "LDAP Options",
 			},
 		},
 
@@ -195,7 +212,8 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			Default:     "tls12",
 			Description: "Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "Minimum TLS Version",
+				Name:  "Minimum TLS Version",
+				Group: "LDAP Options",
 			},
 			AllowedValues: []interface{}{"tls10", "tls11", "tls12", "tls13"},
 		},
@@ -205,7 +223,8 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			Default:     "tls12",
 			Description: "Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'",
 			DisplayAttrs: &framework.DisplayAttributes{
-				Name: "Maximum TLS Version",
+				Name:  "Maximum TLS Version",
+				Group: "LDAP Options",
 			},
 			AllowedValues: []interface{}{"tls10", "tls11", "tls12", "tls13"},
 		},
@@ -214,6 +233,9 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			Type:        framework.TypeBool,
 			Default:     true,
 			Description: "Denies an unauthenticated LDAP bind request if the user's password is empty; defaults to true",
+			DisplayAttrs: &framework.DisplayAttributes{
+				Group: "LDAP Options",
+			},
 		},
 
 		"case_sensitive_names": {
@@ -225,6 +247,9 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			Type:        framework.TypeBool,
 			Default:     false,
 			Description: "If true, use the Active Directory tokenGroups constructed attribute of the user to find the group memberships. This will find all security groups including nested ones.",
+			DisplayAttrs: &framework.DisplayAttributes{
+				Group: "Customize Group Membership Search",
+			},
 		},
 
 		"use_pre111_group_cn_behavior": {
@@ -256,6 +281,11 @@ Default: ({{.UserAttr}}={{.Username}})`,
 			Description: "If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control to request pages of up to the given size. This can be used to avoid hitting the LDAP server's maximum result size limit. Otherwise, the LDAP backend will not use the paged search control.",
 			Default:     0,
 		},
+		"enable_samaccountname_login": {
+			Type:        framework.TypeBool,
+			Description: "If true, matching sAMAccountName attribute values will be allowed to login when upndomain is defined.",
+			Default:     false,
+		},
 	}
 }
 
@@ -434,6 +464,10 @@ func NewConfigEntry(existing *ConfigEntry, d *framework.FieldData) (*ConfigEntry
 		cfg.MaximumPageSize = d.Get("max_page_size").(int)
 	}
 
+	if _, ok := d.Raw["enable_samaccountname_login"]; ok || !hadExisting {
+		cfg.EnableSamaccountnameLogin = d.Get("enable_samaccountname_login").(bool)
+	}
+
 	return cfg, nil
 }
 
@@ -468,9 +502,10 @@ type ConfigEntry struct {
 	// where the tag was being ignored, causing it to be jsonified as "CaseSensitiveNames", etc.
 	// To continue reading in users' previously stored values,
 	// we chose to carry that forward.
-	CaseSensitiveNames *bool  `json:"CaseSensitiveNames,omitempty"`
-	ClientTLSCert      string `json:"ClientTLSCert"`
-	ClientTLSKey       string `json:"ClientTLSKey"`
+	CaseSensitiveNames        *bool  `json:"CaseSensitiveNames,omitempty"`
+	ClientTLSCert             string `json:"ClientTLSCert"`
+	ClientTLSKey              string `json:"ClientTLSKey"`
+	EnableSamaccountnameLogin bool   `json:"EnableSamaccountnameLogin"`
 }
 
 func (c *ConfigEntry) Map() map[string]interface{} {
@@ -481,29 +516,30 @@ func (c *ConfigEntry) Map() map[string]interface{} {
 
 func (c *ConfigEntry) PasswordlessMap() map[string]interface{} {
 	m := map[string]interface{}{
-		"url":                    c.Url,
-		"userdn":                 c.UserDN,
-		"groupdn":                c.GroupDN,
-		"groupfilter":            c.GroupFilter,
-		"groupattr":              c.GroupAttr,
-		"userfilter":             c.UserFilter,
-		"upndomain":              c.UPNDomain,
-		"userattr":               c.UserAttr,
-		"certificate":            c.Certificate,
-		"insecure_tls":           c.InsecureTLS,
-		"starttls":               c.StartTLS,
-		"binddn":                 c.BindDN,
-		"deny_null_bind":         c.DenyNullBind,
-		"discoverdn":             c.DiscoverDN,
-		"tls_min_version":        c.TLSMinVersion,
-		"tls_max_version":        c.TLSMaxVersion,
-		"use_token_groups":       c.UseTokenGroups,
-		"anonymous_group_search": c.AnonymousGroupSearch,
-		"request_timeout":        c.RequestTimeout,
-		"connection_timeout":     c.ConnectionTimeout,
-		"username_as_alias":      c.UsernameAsAlias,
-		"dereference_aliases":    c.DerefAliases,
-		"max_page_size":          c.MaximumPageSize,
+		"url":                         c.Url,
+		"userdn":                      c.UserDN,
+		"groupdn":                     c.GroupDN,
+		"groupfilter":                 c.GroupFilter,
+		"groupattr":                   c.GroupAttr,
+		"userfilter":                  c.UserFilter,
+		"upndomain":                   c.UPNDomain,
+		"userattr":                    c.UserAttr,
+		"certificate":                 c.Certificate,
+		"insecure_tls":                c.InsecureTLS,
+		"starttls":                    c.StartTLS,
+		"binddn":                      c.BindDN,
+		"deny_null_bind":              c.DenyNullBind,
+		"discoverdn":                  c.DiscoverDN,
+		"tls_min_version":             c.TLSMinVersion,
+		"tls_max_version":             c.TLSMaxVersion,
+		"use_token_groups":            c.UseTokenGroups,
+		"anonymous_group_search":      c.AnonymousGroupSearch,
+		"request_timeout":             c.RequestTimeout,
+		"connection_timeout":          c.ConnectionTimeout,
+		"username_as_alias":           c.UsernameAsAlias,
+		"dereference_aliases":         c.DerefAliases,
+		"max_page_size":               c.MaximumPageSize,
+		"enable_samaccountname_login": c.EnableSamaccountnameLogin,
 	}
 	if c.CaseSensitiveNames != nil {
 		m["case_sensitive_names"] = *c.CaseSensitiveNames
@@ -590,9 +626,12 @@ func ConvertConfig(cfg *ConfigEntry) *capldap.ClientConfig {
 		IncludeUserAttributes:                true,
 		ExcludedUserAttributes:               nil,
 		IncludeUserGroups:                    true,
+		LowerUserAttributeKeys:               true,
+		AllowEmptyAnonymousGroupSearch:       true,
 		MaximumPageSize:                      cfg.MaximumPageSize,
 		DerefAliases:                         cfg.DerefAliases,
 		DeprecatedVaultPre111GroupCNBehavior: cfg.UsePre111GroupCNBehavior,
+		EnableSamaccountnameLogin:            cfg.EnableSamaccountnameLogin,
 	}
 
 	if cfg.Certificate != "" {
diff --git a/sdk/helper/ldaputil/config_test.go b/sdk/helper/ldaputil/config_test.go
index b7fd22ccbb2..31bd42359ee 100644
--- a/sdk/helper/ldaputil/config_test.go
+++ b/sdk/helper/ldaputil/config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package ldaputil
@@ -178,6 +178,7 @@ var jsonConfigDefault = []byte(`
   "max_page_size": 0,
   "CaseSensitiveNames": false,
   "ClientTLSCert": "",
-  "ClientTLSKey": ""
+  "ClientTLSKey": "",
+  "enable_samaccountname_login": false
 }
 `)
diff --git a/sdk/helper/ldaputil/connection.go b/sdk/helper/ldaputil/connection.go
index c33ad403f78..4a6537b140f 100644
--- a/sdk/helper/ldaputil/connection.go
+++ b/sdk/helper/ldaputil/connection.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package ldaputil
@@ -14,7 +14,7 @@ import (
 // but through an interface.
 type Connection interface {
 	Bind(username, password string) error
-	Close()
+	Close() error
 	Add(addRequest *ldap.AddRequest) error
 	Modify(modifyRequest *ldap.ModifyRequest) error
 	Del(delRequest *ldap.DelRequest) error
diff --git a/sdk/helper/ldaputil/ldap.go b/sdk/helper/ldaputil/ldap.go
index bdf746e5c8c..53d68d9e7dc 100644
--- a/sdk/helper/ldaputil/ldap.go
+++ b/sdk/helper/ldaputil/ldap.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package ldaputil
diff --git a/sdk/helper/license/feature.go b/sdk/helper/license/feature.go
index b42fcd1fc1a..ed8de5ae863 100644
--- a/sdk/helper/license/feature.go
+++ b/sdk/helper/license/feature.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package license
diff --git a/sdk/helper/locksutil/locks.go b/sdk/helper/locksutil/locks.go
index c7538b63b4f..378cd8f5f0c 100644
--- a/sdk/helper/locksutil/locks.go
+++ b/sdk/helper/locksutil/locks.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package locksutil
@@ -7,12 +7,18 @@ import (
 	"sync"
 
 	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
+	"github.com/sasha-s/go-deadlock"
 )
 
 const (
 	LockCount = 256
 )
 
+// DeadlockRWMutex is the RW version of DeadlockMutex.
+type DeadlockRWMutex struct {
+	deadlock.RWMutex
+}
+
 type LockEntry struct {
 	sync.RWMutex
 }
@@ -36,6 +42,14 @@ func CreateLocks() []*LockEntry {
 	return ret
 }
 
+func CreateLocksWithDeadlockDetection() []*DeadlockRWMutex {
+	ret := make([]*DeadlockRWMutex, LockCount)
+	for i := range ret {
+		ret[i] = new(DeadlockRWMutex)
+	}
+	return ret
+}
+
 func LockIndexForKey(key string) uint8 {
 	return uint8(cryptoutil.Blake2b256Hash(key)[0])
 }
@@ -59,3 +73,23 @@ func LocksForKeys(locks []*LockEntry, keys []string) []*LockEntry {
 
 	return locksToReturn
 }
+
+func LockForKeyWithDeadLockDetection(locks []*DeadlockRWMutex, key string) *DeadlockRWMutex {
+	return locks[LockIndexForKey(key)]
+}
+
+func LocksForKeysWithDeadLockDetection(locks []*DeadlockRWMutex, keys []string) []*DeadlockRWMutex {
+	lockIndexes := make(map[uint8]struct{}, len(keys))
+	for _, k := range keys {
+		lockIndexes[LockIndexForKey(k)] = struct{}{}
+	}
+
+	locksToReturn := make([]*DeadlockRWMutex, 0, len(keys))
+	for i, l := range locks {
+		if _, ok := lockIndexes[uint8(i)]; ok {
+			locksToReturn = append(locksToReturn, l)
+		}
+	}
+
+	return locksToReturn
+}
diff --git a/sdk/helper/locksutil/locks_test.go b/sdk/helper/locksutil/locks_test.go
index 954a46349ea..cf4f6ca3c58 100644
--- a/sdk/helper/locksutil/locks_test.go
+++ b/sdk/helper/locksutil/locks_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package locksutil
diff --git a/sdk/helper/logging/logging.go b/sdk/helper/logging/logging.go
index 37dcefa4778..6c6445806a7 100644
--- a/sdk/helper/logging/logging.go
+++ b/sdk/helper/logging/logging.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logging
diff --git a/sdk/helper/logging/logging_test.go b/sdk/helper/logging/logging_test.go
index 16075524b0b..5d23f7c0cca 100644
--- a/sdk/helper/logging/logging_test.go
+++ b/sdk/helper/logging/logging_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logging
diff --git a/sdk/helper/metricregistry/metricregistry.go b/sdk/helper/metricregistry/metricregistry.go
new file mode 100644
index 00000000000..13227bc48ad
--- /dev/null
+++ b/sdk/helper/metricregistry/metricregistry.go
@@ -0,0 +1,107 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+// Package metricregistry is a helper that allows Vault code or plugins that are
+// compiled into Vault to pre-define any metrics they will emit to go-metrics at
+// init time. Metrics registered this way will always be reported by the
+// go-metrics PrometheusSink if it is used so infrequently updated metrics are
+// always present. It is not required to pre-register metrics to use go-metrics
+// with Prometheus, but it's preferable as it makes them behave more like the
+// Prometheus ecosystem expects, being always present and with a helpful
+// description in the output which some systems use to help operators explore
+// metrics.
+//
+// Note that this will not work for external Vault plugins since they are in a
+// separate process and only started after Vault's metrics sink is already
+// configured.
+package metricregistry
+
+import promsink "github.com/hashicorp/go-metrics/compat/prometheus"
+
+var Registry definitionRegistry
+
+// Re-export these types so that we don't have the whole of Vault depending
+// directly on go-metrics prometheus sink and can buffer changes if needed
+type (
+	// GaugeDefinition provides the name and help text of a gauge metric that will
+	// be exported via go-metrics' Prometheus sink if enabled.
+	GaugeDefinition promsink.GaugeDefinition
+
+	// CounterDefinition provides the name and help text of a counter metric that
+	// will be exported via go-metrics' Prometheus sink if enabled.
+	CounterDefinition promsink.CounterDefinition
+
+	// SummaryDefinition provides the name and help text of a summary metric that
+	// will be exported via go-metrics' Prometheus sink if enabled.
+	SummaryDefinition promsink.SummaryDefinition
+)
+
+// definitionRegistry is a central place for packages to register their metrics
+// definitions during init so that we can correctly report metrics to Prometheus
+// even before they are observed. Typically there is one global instance.
+type definitionRegistry struct {
+	gauges    []GaugeDefinition
+	counters  []CounterDefinition
+	summaries []SummaryDefinition
+}
+
+// RegisterGauges is intended to be called during init. It accesses global state
+// without synchronization. Statically defined definitions should be registered
+// during `init` of a package read to be configured if the prometheus sink is
+// enabled in configuration. Registering metrics is not mandatory but it is
+// strongly preferred as it ensures they are always output even before the are
+// observed which makes dashboards much easier to work with, provides helpful
+// descriptions and matches Prometheus eco system expectations. It also prevents
+// the metrics ever being expired which means users don't need to work around
+// that quirk of go-metrics by setting long prometheus retention times. All
+// registered metrics will report 0 until an actual observation is made.
+func RegisterGauges(defs []GaugeDefinition) {
+	Registry.gauges = append(Registry.gauges, defs...)
+}
+
+// RegisterCounters is intended to be called during init. It accesses global
+// state without synchronization. Statically defined definitions should be
+// registered during `init` of a package read to be configured if the prometheus
+// sink is enabled in configuration. Registering metrics is not mandatory but it
+// is strongly preferred as it ensures they are always output even before the
+// are observed which makes dashboards much easier to work with, provides
+// helpful descriptions and matches Prometheus eco system expectations. It also
+// prevents the metrics ever being expired which means users don't need to work
+// around that quirk of go-metrics by setting long prometheus retention times.
+// All registered metrics will report 0 until an actual observation is made.
+func RegisterCounters(defs []CounterDefinition) {
+	Registry.counters = append(Registry.counters, defs...)
+}
+
+// RegisterSummaries is intended to be called during init. It accesses global
+// state without synchronization. Statically defined definitions should be
+// registered during `init` of a package read to be configured if the prometheus
+// sink is enabled in configuration. Registering metrics is not mandatory but it
+// is strongly preferred as it ensures they are always output even before the
+// are observed which makes dashboards much easier to work with, provides
+// helpful descriptions and matches Prometheus eco system expectations. It also
+// prevents the metrics ever being expired which means users don't need to work
+// around that quirk of go-metrics by setting long prometheus retention times.
+// All registered metrics will report 0 until an actual observation is made.
+func RegisterSummaries(defs []SummaryDefinition) {
+	Registry.summaries = append(Registry.summaries, defs...)
+}
+
+// MergeDefinitions adds all registered metrics to any already present in `cfg`
+// ready to be passed to the go-metrics prometheus sink. Note it is not safe to
+// call this concurrently with registrations or other calls, it's intended this
+// is called once only after all registrations (which should be in init
+// functions) just before the PrometheusSink is created. Calling more than once
+// could result in duplicate metrics definitions being passed unless the cfg is
+// different each time for different Prometheus sinks.
+func MergeDefinitions(cfg *promsink.PrometheusOpts) {
+	for _, g := range Registry.gauges {
+		cfg.GaugeDefinitions = append(cfg.GaugeDefinitions, promsink.GaugeDefinition(g))
+	}
+	for _, c := range Registry.counters {
+		cfg.CounterDefinitions = append(cfg.CounterDefinitions, promsink.CounterDefinition(c))
+	}
+	for _, s := range Registry.summaries {
+		cfg.SummaryDefinitions = append(cfg.SummaryDefinitions, promsink.SummaryDefinition(s))
+	}
+}
diff --git a/sdk/helper/metricregistry/metricregistry_test.go b/sdk/helper/metricregistry/metricregistry_test.go
new file mode 100644
index 00000000000..ebe8d863201
--- /dev/null
+++ b/sdk/helper/metricregistry/metricregistry_test.go
@@ -0,0 +1,122 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package metricregistry
+
+import (
+	"testing"
+
+	promsink "github.com/hashicorp/go-metrics/compat/prometheus"
+	"github.com/stretchr/testify/require"
+)
+
+var testGauges = []GaugeDefinition{
+	{
+		Name: []string{"test_gauge"},
+		Help: "A test gauge",
+	},
+	{
+		Name: []string{"test_gauge2"},
+		Help: "Another test gauge",
+	},
+}
+
+var testCounters = []CounterDefinition{
+	{
+		Name: []string{"test_counter"},
+		Help: "A test counter",
+	},
+	{
+		Name: []string{"test_counter2"},
+		Help: "Another test counter",
+	},
+}
+
+var testSummaries = []SummaryDefinition{
+	{
+		Name: []string{"test_summary"},
+		Help: "A test summary",
+	},
+	{
+		Name: []string{"test_summary2"},
+		Help: "Another test summary",
+	},
+}
+
+func TestMetricRegistry(t *testing.T) {
+	// Register some metrics
+	RegisterGauges(testGauges)
+	RegisterCounters(testCounters)
+	RegisterSummaries(testSummaries)
+
+	var opts promsink.PrometheusOpts
+
+	// Add some pre-existing metrics to ensure merge is really a merge
+	opts.GaugeDefinitions = []promsink.GaugeDefinition{
+		{
+			Name: []string{"preexisting_gauge"},
+			Help: "A pre-existing gauge",
+		},
+	}
+	opts.CounterDefinitions = []promsink.CounterDefinition{
+		{
+			Name: []string{"preexisting_counter"},
+			Help: "A pre-existing counter",
+		},
+	}
+	opts.SummaryDefinitions = []promsink.SummaryDefinition{
+		{
+			Name: []string{"preexisting_summary"},
+			Help: "A pre-existing summary",
+		},
+	}
+
+	MergeDefinitions(&opts)
+
+	require.Len(t, opts.GaugeDefinitions, 3)
+	require.Len(t, opts.CounterDefinitions, 3)
+	require.Len(t, opts.SummaryDefinitions, 3)
+
+	wantGauges := []string{"test_gauge", "test_gauge2", "preexisting_gauge"}
+	wantGaugeHelp := []string{"A test gauge", "Another test gauge", "A pre-existing gauge"}
+	gotGauges := reduce(opts.GaugeDefinitions, nil, func(r []string, d promsink.GaugeDefinition) []string {
+		return append(r, d.Name[0])
+	})
+	gotGaugeHelp := reduce(opts.GaugeDefinitions, nil, func(r []string, d promsink.GaugeDefinition) []string {
+		return append(r, d.Help)
+	})
+
+	require.ElementsMatch(t, wantGauges, gotGauges)
+	require.ElementsMatch(t, wantGaugeHelp, gotGaugeHelp)
+
+	wantCounters := []string{"test_counter", "test_counter2", "preexisting_counter"}
+	wantCounterHelp := []string{"A test counter", "Another test counter", "A pre-existing counter"}
+	gotCounters := reduce(opts.CounterDefinitions, nil, func(r []string, d promsink.CounterDefinition) []string {
+		return append(r, d.Name[0])
+	})
+	gotCounterHelp := reduce(opts.CounterDefinitions, nil, func(r []string, d promsink.CounterDefinition) []string {
+		return append(r, d.Help)
+	})
+
+	require.ElementsMatch(t, wantCounters, gotCounters)
+	require.ElementsMatch(t, wantCounterHelp, gotCounterHelp)
+
+	wantSummaries := []string{"test_summary", "test_summary2", "preexisting_summary"}
+	wantSummaryHelp := []string{"A test summary", "Another test summary", "A pre-existing summary"}
+	gotSummaries := reduce(opts.SummaryDefinitions, nil, func(r []string, d promsink.SummaryDefinition) []string {
+		return append(r, d.Name[0])
+	})
+	gotSummaryHelp := reduce(opts.SummaryDefinitions, nil, func(r []string, d promsink.SummaryDefinition) []string {
+		return append(r, d.Help)
+	})
+
+	require.ElementsMatch(t, wantSummaries, gotSummaries)
+	require.ElementsMatch(t, wantSummaryHelp, gotSummaryHelp)
+}
+
+func reduce[T, R any](s []T, r R, f func(R, T) R) R {
+	for _, v := range s {
+		r = f(r, v)
+	}
+	return r
+}
diff --git a/sdk/helper/mlock/mlock.go b/sdk/helper/mlock/mlock.go
index 5820d15af3c..e56fff575bf 100644
--- a/sdk/helper/mlock/mlock.go
+++ b/sdk/helper/mlock/mlock.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // DEPRECATED: this has been moved to go-secure-stdlib and will be removed
diff --git a/sdk/helper/ocsp/client.go b/sdk/helper/ocsp/client.go
index 8bd9cea4ee8..71f75f168a4 100644
--- a/sdk/helper/ocsp/client.go
+++ b/sdk/helper/ocsp/client.go
@@ -31,6 +31,8 @@ import (
 	"golang.org/x/crypto/ocsp"
 )
 
+//go:generate enumer -type=FailOpenMode -trimprefix=FailOpen
+
 // FailOpenMode is OCSP fail open mode. FailOpenTrue by default and may
 // set to ocspModeFailClosed for fail closed mode
 type FailOpenMode uint32
@@ -76,6 +78,15 @@ const (
 	cacheExpire = float64(24 * 60 * 60)
 )
 
+// ErrOcspIssuerVerification indicates an error verifying the identity of an OCSP response occurred
+type ErrOcspIssuerVerification struct {
+	Err error
+}
+
+func (e *ErrOcspIssuerVerification) Error() string {
+	return fmt.Sprintf("ocsp response verification error: %v", e.Err)
+}
+
 type ocspCachedResponse struct {
 	time       float64
 	producedAt float64
@@ -162,9 +173,27 @@ func (c *Client) getHashAlgorithmFromOID(target pkix.AlgorithmIdentifier) crypto
 	return crypto.SHA1
 }
 
-// isInValidityRange checks the validity
-func isInValidityRange(currTime, nextUpdate time.Time) bool {
-	return !nextUpdate.IsZero() && !currTime.After(nextUpdate)
+// isInValidityRange checks the validity times of the OCSP response making sure
+// that thisUpdate and nextUpdate values are bounded within currTime
+func isInValidityRange(currTime time.Time, ocspRes *ocsp.Response) bool {
+	thisUpdate := ocspRes.ThisUpdate
+
+	// If the thisUpdate value in the OCSP response wasn't set or greater than current time fail this check
+	if thisUpdate.IsZero() || thisUpdate.After(currTime) {
+		return false
+	}
+
+	nextUpdate := ocspRes.NextUpdate
+	if nextUpdate.IsZero() {
+		// We don't have a nextUpdate field set, assume we are okay.
+		return true
+	}
+
+	if currTime.After(nextUpdate) || thisUpdate.After(nextUpdate) {
+		return false
+	}
+
+	return true
 }
 
 func extractCertIDKeyFromRequest(ocspReq []byte) (*certIDKey, *ocspStatus) {
@@ -209,7 +238,7 @@ func (c *Client) encodeCertIDKey(certIDKeyBase64 string) (*certIDKey, error) {
 	}, nil
 }
 
-func (c *Client) checkOCSPResponseCache(encodedCertID *certIDKey, subject, issuer *x509.Certificate) (*ocspStatus, error) {
+func (c *Client) checkOCSPResponseCache(encodedCertID *certIDKey, subject, issuer *x509.Certificate, config *VerifyConfig) (*ocspStatus, error) {
 	c.ocspResponseCacheLock.RLock()
 	var cacheValue *ocspCachedResponse
 	v, ok := c.ocspResponseCache.Get(*encodedCertID)
@@ -218,7 +247,7 @@ func (c *Client) checkOCSPResponseCache(encodedCertID *certIDKey, subject, issue
 	}
 	c.ocspResponseCacheLock.RUnlock()
 
-	status, err := c.extractOCSPCacheResponseValue(cacheValue, subject, issuer)
+	status, err := c.extractOCSPCacheResponseValue(cacheValue, subject, issuer, config)
 	if err != nil {
 		return nil, err
 	}
@@ -235,18 +264,25 @@ func (c *Client) deleteOCSPCache(encodedCertID *certIDKey) {
 	c.ocspResponseCacheLock.Unlock()
 }
 
-func validateOCSP(ocspRes *ocsp.Response) (*ocspStatus, error) {
+func validateOCSP(conf *VerifyConfig, ocspRes *ocsp.Response) (*ocspStatus, error) {
 	curTime := time.Now()
 
 	if ocspRes == nil {
 		return nil, errors.New("OCSP Response is nil")
 	}
-	if !isInValidityRange(curTime, ocspRes.NextUpdate) {
+	if !isInValidityRange(curTime, ocspRes) {
 		return &ocspStatus{
 			code: ocspInvalidValidity,
 			err:  fmt.Errorf("invalid validity: producedAt: %v, thisUpdate: %v, nextUpdate: %v", ocspRes.ProducedAt, ocspRes.ThisUpdate, ocspRes.NextUpdate),
 		}, nil
 	}
+
+	if conf.OcspThisUpdateMaxAge > 0 && curTime.Sub(ocspRes.ThisUpdate) > conf.OcspThisUpdateMaxAge {
+		return &ocspStatus{
+			code: ocspInvalidValidity,
+			err:  fmt.Errorf("invalid validity: thisUpdate: %v is greater than max age: %s", ocspRes.ThisUpdate, conf.OcspThisUpdateMaxAge),
+		}, nil
+	}
 	return returnOCSPStatus(ocspRes), nil
 }
 
@@ -283,7 +319,9 @@ func (c *Client) retryOCSP(
 	ocspHost *url.URL,
 	headers map[string]string,
 	reqBody []byte,
+	subject,
 	issuer *x509.Certificate,
+	extraCas []*x509.Certificate,
 ) (ocspRes *ocsp.Response, ocspResBytes []byte, ocspS *ocspStatus, retErr error) {
 	doRequest := func(request *retryablehttp.Request) (*http.Response, error) {
 		if request != nil {
@@ -354,66 +392,19 @@ func (c *Client) retryOCSP(
 			continue
 		}
 
-		// Above, we use the unsafe issuer=nil parameter to ocsp.ParseResponse
-		// because Go's library does the wrong thing.
-		//
-		// Here, we lack a full chain, but we know we trust the parent issuer,
-		// so if the Go library incorrectly discards useful certificates, we
-		// likely cannot verify this without passing through the full chain
-		// back to the root.
-		//
-		// Instead, take one of two paths: 1. if there is no certificate in
-		// the ocspRes, verify the OCSP response directly with our trusted
-		// issuer certificate, or 2. if there is a certificate, either verify
-		// it directly matches our trusted issuer certificate, or verify it
-		// is signed by our trusted issuer certificate.
-		//
-		// See also: https://github.com/golang/go/issues/59641
-		//
-		// This addresses the !!unsafe!! behavior above.
-		if ocspRes.Certificate == nil {
-			if err := ocspRes.CheckSignatureFrom(issuer); err != nil {
-				err = fmt.Errorf("error directly verifying signature on %v OCSP response: %w", method, err)
-				retErr = multierror.Append(retErr, err)
-				continue
-			}
-		} else {
-			// Because we have at least one certificate here, we know that
-			// Go's ocsp library verified the signature from this certificate
-			// onto the response and it was valid. Now we need to know we trust
-			// this certificate. There's two ways we can do this:
-			//
-			// 1. Via confirming issuer == ocspRes.Certificate, or
-			// 2. Via confirming ocspRes.Certificate.CheckSignatureFrom(issuer).
-			if !bytes.Equal(issuer.Raw, ocspRes.Raw) {
-				// 1 must not hold, so 2 holds; verify the signature.
-				if err := ocspRes.Certificate.CheckSignatureFrom(issuer); err != nil {
-					err = fmt.Errorf("error checking chain of trust on %v OCSP response via %v failed: %w", method, issuer.Subject.String(), err)
-					retErr = multierror.Append(retErr, err)
-					continue
-				}
+		if err := validateOCSPParsedResponse(ocspRes, subject, issuer, extraCas); err != nil {
+			err = fmt.Errorf("error validating %v OCSP response: %w", method, err)
 
-				// Verify the OCSP responder certificate is still valid and
-				// contains the required EKU since it is a delegated OCSP
-				// responder certificate.
-				if ocspRes.Certificate.NotAfter.Before(time.Now()) {
-					err := fmt.Errorf("error checking delegated OCSP responder on %v OCSP response: certificate has expired", method)
-					retErr = multierror.Append(retErr, err)
-					continue
-				}
-				haveEKU := false
-				for _, ku := range ocspRes.Certificate.ExtKeyUsage {
-					if ku == x509.ExtKeyUsageOCSPSigning {
-						haveEKU = true
-						break
-					}
-				}
-				if !haveEKU {
-					err := fmt.Errorf("error checking delegated OCSP responder on %v OCSP response: certificate lacks the OCSP Signing EKU", method)
-					retErr = multierror.Append(retErr, err)
-					continue
-				}
+			if IsOcspVerificationError(err) {
+				// We want to immediately give up on a verification error to a response
+				// and inform the user something isn't correct
+				return nil, nil, nil, err
 			}
+
+			retErr = multierror.Append(retErr, err)
+			// Clear the response out as we can't trust it.
+			ocspRes = nil
+			continue
 		}
 
 		// While we haven't validated the signature on the OCSP response, we
@@ -448,9 +439,143 @@ func (c *Client) retryOCSP(
 	return
 }
 
+func IsOcspVerificationError(err error) bool {
+	errOcspIssuer := &ErrOcspIssuerVerification{}
+	return errors.As(err, &errOcspIssuer)
+}
+
+func validateOCSPParsedResponse(ocspRes *ocsp.Response, subject, issuer *x509.Certificate, extraCas []*x509.Certificate) error {
+	// Above, we use the unsafe issuer=nil parameter to ocsp.ParseResponse
+	// because Go's library does the wrong thing.
+	//
+	// Here, we lack a full chain, but we know we trust the parent issuer,
+	// so if the Go library incorrectly discards useful certificates, we
+	// likely cannot verify this without passing through the full chain
+	// back to the root.
+	//
+	// Instead, take one of two paths: 1. if there is no certificate in
+	// the ocspRes, verify the OCSP response directly with our trusted
+	// issuer certificate, or 2. if there is a certificate, either verify
+	// it directly matches our trusted issuer certificate, or verify it
+	// is signed by our trusted issuer certificate.
+	//
+	// See also: https://github.com/golang/go/issues/59641
+	//
+	// This addresses the !!unsafe!! behavior above.
+	if ocspRes.Certificate == nil {
+		// With no certificate, we need to validate that the response is signed by the issuer or an extra CA
+		if err := ocspRes.CheckSignatureFrom(issuer); err != nil {
+			if len(extraCas) > 0 {
+				// Perhaps it was signed by one of the extra configured OCSP CAs
+				matchedCA, overallErr := verifySignature(ocspRes, extraCas)
+
+				if overallErr != nil {
+					return &ErrOcspIssuerVerification{fmt.Errorf("error checking chain of trust %v failed: %w", issuer.Subject.String(), overallErr)}
+				}
+
+				err := validateSigner(matchedCA)
+				if err != nil {
+					return err
+				}
+			} else {
+				return &ErrOcspIssuerVerification{fmt.Errorf("error directly verifying signature: %w", err)}
+			}
+		}
+	} else {
+		// Because we have at least one certificate here, we know that
+		// Go's ocsp library verified the signature from this certificate
+		// onto the response and it was valid. Now we need to know we trust
+		// this certificate. There are three ways we can do this:
+		//
+		// 1. Via confirming issuer == ocspRes.Certificate, or
+		// 2. Via confirming ocspRes.Certificate.CheckSignatureFrom(issuer).
+		// 3. Trusting extra configured OCSP CAs
+		if !bytes.Equal(issuer.Raw, ocspRes.Raw) {
+			var overallErr error
+			var matchedCA *x509.Certificate
+
+			// Assumption 1 failed, try 2
+			if sigFromIssuerErr := ocspRes.Certificate.CheckSignatureFrom(issuer); sigFromIssuerErr != nil {
+				if len(extraCas) > 0 {
+					// Assumption 2 failed, try 3
+					m, err := verifySignature(ocspRes, extraCas)
+					if err != nil {
+						overallErr = multierror.Append(overallErr, sigFromIssuerErr)
+						overallErr = multierror.Append(overallErr, err)
+					} else {
+						overallErr = nil
+						matchedCA = m
+					}
+				} else {
+					overallErr = multierror.Append(overallErr, sigFromIssuerErr)
+				}
+			} else {
+				matchedCA = ocspRes.Certificate
+			}
+
+			if overallErr != nil {
+				return &ErrOcspIssuerVerification{fmt.Errorf("error checking chain of trust %v failed: %w", issuer.Subject.String(), overallErr)}
+			}
+
+			err := validateSigner(matchedCA)
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	// Verify the response was for our original subject
+	if ocspRes.SerialNumber == nil || subject.SerialNumber == nil {
+		return &ErrOcspIssuerVerification{fmt.Errorf("OCSP response or cert did not contain a serial number")}
+	}
+	if ocspRes.SerialNumber.Cmp(subject.SerialNumber) != 0 {
+		return &ErrOcspIssuerVerification{fmt.Errorf(
+			"OCSP response serial number %s did not match the leaf certificate serial number %s",
+			certutil.GetHexFormatted(ocspRes.SerialNumber.Bytes(), ":"),
+			certutil.GetHexFormatted(subject.SerialNumber.Bytes(), ":"))}
+	}
+
+	return nil
+}
+
+func verifySignature(res *ocsp.Response, extraCas []*x509.Certificate) (*x509.Certificate, error) {
+	var overallErr error
+	var matchedCA *x509.Certificate
+	for _, ca := range extraCas {
+		if err := res.CheckSignatureFrom(ca); err != nil {
+			overallErr = multierror.Append(overallErr, err)
+		} else {
+			matchedCA = ca
+			overallErr = nil
+			break
+		}
+	}
+	return matchedCA, overallErr
+}
+
+func validateSigner(matchedCA *x509.Certificate) error {
+	// Verify the OCSP responder certificate is still valid and
+	// contains the required EKU since it is a delegated OCSP
+	// responder certificate.
+	if matchedCA.NotAfter.Before(time.Now()) {
+		return &ErrOcspIssuerVerification{fmt.Errorf("error checking delegated OCSP responder OCSP response: certificate has expired")}
+	}
+	haveEKU := false
+	for _, ku := range matchedCA.ExtKeyUsage {
+		if ku == x509.ExtKeyUsageOCSPSigning {
+			haveEKU = true
+			break
+		}
+	}
+	if !haveEKU {
+		return &ErrOcspIssuerVerification{fmt.Errorf("error checking delegated OCSP responder: certificate lacks the OCSP Signing EKU")}
+	}
+	return nil
+}
+
 // GetRevocationStatus checks the certificate revocation status for subject using issuer certificate.
 func (c *Client) GetRevocationStatus(ctx context.Context, subject, issuer *x509.Certificate, conf *VerifyConfig) (*ocspStatus, error) {
-	status, ocspReq, encodedCertID, err := c.validateWithCache(subject, issuer)
+	status, ocspReq, encodedCertID, err := c.validateWithCache(subject, issuer, conf)
 	if err != nil {
 		return nil, err
 	}
@@ -491,15 +616,17 @@ func (c *Client) GetRevocationStatus(ctx context.Context, subject, issuer *x509.
 		timeout := defaultOCSPResponderTimeout
 
 		ocspClient := retryablehttp.NewClient()
+		ocspClient.Logger = c.Logger()
+		ocspClient.RetryMax = conf.OcspMaxRetries
 		ocspClient.HTTPClient.Timeout = timeout
 		ocspClient.HTTPClient.Transport = newInsecureOcspTransport(conf.ExtraCas)
 
-		doRequest := func() error {
+		doRequest := func(i int) error {
 			if conf.QueryAllServers {
 				defer wg.Done()
 			}
 			ocspRes, _, ocspS, err := c.retryOCSP(
-				ctx, ocspClient, retryablehttp.NewRequest, u, headers, ocspReq, issuer)
+				ctx, ocspClient, retryablehttp.NewRequest, u, headers, ocspReq, subject, issuer, conf.ExtraCas)
 			ocspResponses[i] = ocspRes
 			if err != nil {
 				errors[i] = err
@@ -510,7 +637,7 @@ func (c *Client) GetRevocationStatus(ctx context.Context, subject, issuer *x509.
 				return nil
 			}
 
-			ret, err := validateOCSP(ocspRes)
+			ret, err := validateOCSP(conf, ocspRes)
 			if err != nil {
 				errors[i] = err
 				return err
@@ -527,9 +654,9 @@ func (c *Client) GetRevocationStatus(ctx context.Context, subject, issuer *x509.
 		}
 		if conf.QueryAllServers {
 			wg.Add(1)
-			go doRequest()
+			go doRequest(i)
 		} else {
-			err = doRequest()
+			err = doRequest(i)
 			if err == nil {
 				break
 			}
@@ -544,6 +671,9 @@ func (c *Client) GetRevocationStatus(ctx context.Context, subject, issuer *x509.
 	var firstError error
 	for i := range ocspHosts {
 		if errors[i] != nil {
+			if IsOcspVerificationError(errors[i]) {
+				return nil, errors[i]
+			}
 			if firstError == nil {
 				firstError = errors[i]
 			}
@@ -569,6 +699,14 @@ func (c *Client) GetRevocationStatus(ctx context.Context, subject, issuer *x509.
 		}
 	}
 
+	// If querying all servers is enabled, and we have an error from a host, we can't trust
+	// a good status from the other as we can't confirm the other server would have returned the
+	// same response, we do allow revoke responses through
+	if conf.QueryAllServers && firstError != nil && (ret != nil && ret.code == ocspStatusGood) {
+		return nil, fmt.Errorf("encountered an error on a server, "+
+			"ignoring good response status as ocsp_query_all_servers is set to true: %w", firstError)
+	}
+
 	// If no server reported the cert revoked, but we did have an error, report it
 	if (ret == nil || ret.code == ocspStatusUnknown) && firstError != nil {
 		return nil, firstError
@@ -582,6 +720,12 @@ func (c *Client) GetRevocationStatus(ctx context.Context, subject, issuer *x509.
 	if !isValidOCSPStatus(ret.code) {
 		return ret, nil
 	}
+
+	if ocspRes.NextUpdate.IsZero() {
+		// We should not cache values with no NextUpdate values
+		return ret, nil
+	}
+
 	v := ocspCachedResponse{
 		status:     ret.code,
 		time:       float64(time.Now().UTC().Unix()),
@@ -602,11 +746,13 @@ func isValidOCSPStatus(status ocspStatusCode) bool {
 }
 
 type VerifyConfig struct {
-	OcspEnabled         bool
-	ExtraCas            []*x509.Certificate
-	OcspServersOverride []string
-	OcspFailureMode     FailOpenMode
-	QueryAllServers     bool
+	OcspEnabled          bool
+	ExtraCas             []*x509.Certificate
+	OcspServersOverride  []string
+	OcspFailureMode      FailOpenMode
+	QueryAllServers      bool
+	OcspThisUpdateMaxAge time.Duration
+	OcspMaxRetries       int
 }
 
 // VerifyLeafCertificate verifies just the subject against it's direct issuer
@@ -618,12 +764,12 @@ func (c *Client) VerifyLeafCertificate(ctx context.Context, subject, issuer *x50
 	if results.code == ocspStatusGood {
 		return nil
 	} else {
-		serial := issuer.SerialNumber
+		serial := subject.SerialNumber
 		serialHex := strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":"))
 		if results.code == ocspStatusRevoked {
 			return fmt.Errorf("certificate with serial number %s has been revoked", serialHex)
 		} else if conf.OcspFailureMode == FailOpenFalse {
-			return fmt.Errorf("unknown OCSP status for cert with serial number %s", strings.TrimSpace(certutil.GetHexFormatted(serial.Bytes(), ":")))
+			return fmt.Errorf("unknown OCSP status for cert with serial number %s", serialHex)
 		} else {
 			c.Logger().Warn("could not validate OCSP status for cert, but continuing in fail open mode", "serial", serialHex)
 		}
@@ -692,12 +838,12 @@ func (c *Client) canEarlyExitForOCSP(results []*ocspStatus, chainSize int, conf
 	return nil
 }
 
-func (c *Client) validateWithCacheForAllCertificates(verifiedChains []*x509.Certificate) (bool, error) {
+func (c *Client) validateWithCacheForAllCertificates(verifiedChains []*x509.Certificate, config *VerifyConfig) (bool, error) {
 	n := len(verifiedChains) - 1
 	for j := 0; j < n; j++ {
 		subject := verifiedChains[j]
 		issuer := verifiedChains[j+1]
-		status, _, _, err := c.validateWithCache(subject, issuer)
+		status, _, _, err := c.validateWithCache(subject, issuer, config)
 		if err != nil {
 			return false, err
 		}
@@ -708,7 +854,7 @@ func (c *Client) validateWithCacheForAllCertificates(verifiedChains []*x509.Cert
 	return true, nil
 }
 
-func (c *Client) validateWithCache(subject, issuer *x509.Certificate) (*ocspStatus, []byte, *certIDKey, error) {
+func (c *Client) validateWithCache(subject, issuer *x509.Certificate, config *VerifyConfig) (*ocspStatus, []byte, *certIDKey, error) {
 	ocspReq, err := ocsp.CreateRequest(subject, issuer, &ocsp.RequestOptions{})
 	if err != nil {
 		return nil, nil, nil, fmt.Errorf("failed to create OCSP request from the certificates: %v", err)
@@ -717,7 +863,7 @@ func (c *Client) validateWithCache(subject, issuer *x509.Certificate) (*ocspStat
 	if ocspS.code != ocspSuccess {
 		return nil, nil, nil, fmt.Errorf("failed to extract CertID from OCSP Request: %v", err)
 	}
-	status, err := c.checkOCSPResponseCache(encodedCertID, subject, issuer)
+	status, err := c.checkOCSPResponseCache(encodedCertID, subject, issuer, config)
 	if err != nil {
 		return nil, nil, nil, err
 	}
@@ -725,7 +871,7 @@ func (c *Client) validateWithCache(subject, issuer *x509.Certificate) (*ocspStat
 }
 
 func (c *Client) GetAllRevocationStatus(ctx context.Context, verifiedChains []*x509.Certificate, conf *VerifyConfig) ([]*ocspStatus, error) {
-	_, err := c.validateWithCacheForAllCertificates(verifiedChains)
+	_, err := c.validateWithCacheForAllCertificates(verifiedChains, conf)
 	if err != nil {
 		return nil, err
 	}
@@ -750,11 +896,11 @@ func (c *Client) verifyPeerCertificateSerial(conf *VerifyConfig) func(_ [][]byte
 	}
 }
 
-func (c *Client) extractOCSPCacheResponseValueWithoutSubject(cacheValue ocspCachedResponse) (*ocspStatus, error) {
-	return c.extractOCSPCacheResponseValue(&cacheValue, nil, nil)
+func (c *Client) extractOCSPCacheResponseValueWithoutSubject(cacheValue ocspCachedResponse, conf *VerifyConfig) (*ocspStatus, error) {
+	return c.extractOCSPCacheResponseValue(&cacheValue, nil, nil, conf)
 }
 
-func (c *Client) extractOCSPCacheResponseValue(cacheValue *ocspCachedResponse, subject, issuer *x509.Certificate) (*ocspStatus, error) {
+func (c *Client) extractOCSPCacheResponseValue(cacheValue *ocspCachedResponse, subject, issuer *x509.Certificate, conf *VerifyConfig) (*ocspStatus, error) {
 	subjectName := "Unknown"
 	if subject != nil {
 		subjectName = subject.Subject.CommonName
@@ -776,14 +922,29 @@ func (c *Client) extractOCSPCacheResponseValue(cacheValue *ocspCachedResponse, s
 		}, nil
 	}
 
-	return validateOCSP(&ocsp.Response{
+	sdkOcspStatus := internalStatusCodeToSDK(cacheValue.status)
+
+	return validateOCSP(conf, &ocsp.Response{
 		ProducedAt: time.Unix(int64(cacheValue.producedAt), 0).UTC(),
 		ThisUpdate: time.Unix(int64(cacheValue.thisUpdate), 0).UTC(),
 		NextUpdate: time.Unix(int64(cacheValue.nextUpdate), 0).UTC(),
-		Status:     int(cacheValue.status),
+		Status:     sdkOcspStatus,
 	})
 }
 
+func internalStatusCodeToSDK(internalStatusCode ocspStatusCode) int {
+	switch internalStatusCode {
+	case ocspStatusGood:
+		return ocsp.Good
+	case ocspStatusRevoked:
+		return ocsp.Revoked
+	case ocspStatusUnknown:
+		return ocsp.Unknown
+	default:
+		return int(internalStatusCode)
+	}
+}
+
 /*
 // writeOCSPCache writes a OCSP Response cache
 func (c *Client) writeOCSPCache(ctx context.Context, storage logical.Storage) error {
diff --git a/sdk/helper/ocsp/failopenmode_enumer.go b/sdk/helper/ocsp/failopenmode_enumer.go
new file mode 100644
index 00000000000..d0cf9f5e924
--- /dev/null
+++ b/sdk/helper/ocsp/failopenmode_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=FailOpenMode -trimprefix=FailOpen"; DO NOT EDIT.
+
+package ocsp
+
+import (
+	"fmt"
+)
+
+const _FailOpenModeName = "ocspFailOpenNotSetTrueFalse"
+
+var _FailOpenModeIndex = [...]uint8{0, 18, 22, 27}
+
+func (i FailOpenMode) String() string {
+	if i >= FailOpenMode(len(_FailOpenModeIndex)-1) {
+		return fmt.Sprintf("FailOpenMode(%d)", i)
+	}
+	return _FailOpenModeName[_FailOpenModeIndex[i]:_FailOpenModeIndex[i+1]]
+}
+
+var _FailOpenModeValues = []FailOpenMode{0, 1, 2}
+
+var _FailOpenModeNameToValueMap = map[string]FailOpenMode{
+	_FailOpenModeName[0:18]:  0,
+	_FailOpenModeName[18:22]: 1,
+	_FailOpenModeName[22:27]: 2,
+}
+
+// FailOpenModeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func FailOpenModeString(s string) (FailOpenMode, error) {
+	if val, ok := _FailOpenModeNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to FailOpenMode values", s)
+}
+
+// FailOpenModeValues returns all values of the enum
+func FailOpenModeValues() []FailOpenMode {
+	return _FailOpenModeValues
+}
+
+// IsAFailOpenMode returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i FailOpenMode) IsAFailOpenMode() bool {
+	for _, v := range _FailOpenModeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdk/helper/ocsp/ocsp_test.go b/sdk/helper/ocsp/ocsp_test.go
index 677dfa85aa5..fcd868e2d61 100644
--- a/sdk/helper/ocsp/ocsp_test.go
+++ b/sdk/helper/ocsp/ocsp_test.go
@@ -15,12 +15,12 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/big"
 	"net"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -50,20 +50,21 @@ func TestOCSP(t *testing.T) {
 	for _, tgt := range targetURL {
 		c.ocspResponseCache, _ = lru.New2Q(10)
 		for _, tr := range transports {
-			c := &http.Client{
-				Transport: tr,
-				Timeout:   30 * time.Second,
-			}
-			req, err := http.NewRequest("GET", tgt, bytes.NewReader(nil))
+			ocspClient := retryablehttp.NewClient()
+			ocspClient.Logger = c.Logger()
+			ocspClient.RetryMax = conf.OcspMaxRetries
+			ocspClient.HTTPClient.Timeout = 30 * time.Second
+			ocspClient.HTTPClient.Transport = tr
+			req, err := retryablehttp.NewRequest("GET", tgt, bytes.NewReader(nil))
 			if err != nil {
 				t.Fatalf("fail to create a request. err: %v", err)
 			}
-			res, err := c.Do(req)
+			res, err := ocspClient.Do(req)
 			if err != nil {
 				t.Fatalf("failed to GET contents. err: %v", err)
 			}
 			defer res.Body.Close()
-			_, err = ioutil.ReadAll(res.Body)
+			_, err = io.ReadAll(res.Body)
 			if err != nil {
 				t.Fatalf("failed to read content body for %v", tgt)
 			}
@@ -112,7 +113,7 @@ func TestMultiOCSP(t *testing.T) {
 			t.Fatalf("failed to GET contents. err: %v", err)
 		}
 		defer res.Body.Close()
-		_, err = ioutil.ReadAll(res.Body)
+		_, err = io.ReadAll(res.Body)
 		if err != nil {
 			t.Fatalf("failed to read content body for %v", tgt)
 		}
@@ -168,6 +169,7 @@ func TestUnitEncodeCertIDGood(t *testing.T) {
 }
 
 func TestUnitCheckOCSPResponseCache(t *testing.T) {
+	conf := &VerifyConfig{OcspEnabled: true}
 	c := New(testLogFactory, 10)
 	dummyKey0 := certIDKey{
 		NameHash:      "dummy0",
@@ -183,7 +185,7 @@ func TestUnitCheckOCSPResponseCache(t *testing.T) {
 	c.ocspResponseCache.Add(dummyKey0, &ocspCachedResponse{time: currentTime})
 	subject := &x509.Certificate{}
 	issuer := &x509.Certificate{}
-	ost, err := c.checkOCSPResponseCache(&dummyKey, subject, issuer)
+	ost, err := c.checkOCSPResponseCache(&dummyKey, subject, issuer, conf)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -192,7 +194,7 @@ func TestUnitCheckOCSPResponseCache(t *testing.T) {
 	}
 	// old timestamp
 	c.ocspResponseCache.Add(dummyKey, &ocspCachedResponse{time: float64(1395054952)})
-	ost, err = c.checkOCSPResponseCache(&dummyKey, subject, issuer)
+	ost, err = c.checkOCSPResponseCache(&dummyKey, subject, issuer, conf)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -202,31 +204,265 @@ func TestUnitCheckOCSPResponseCache(t *testing.T) {
 
 	// invalid validity
 	c.ocspResponseCache.Add(dummyKey, &ocspCachedResponse{time: float64(currentTime - 1000)})
-	ost, err = c.checkOCSPResponseCache(&dummyKey, subject, nil)
+	ost, err = c.checkOCSPResponseCache(&dummyKey, subject, nil, conf)
 	if err == nil && isValidOCSPStatus(ost.code) {
 		t.Fatalf("should have failed.")
 	}
 }
 
-func TestUnitExpiredOCSPResponse(t *testing.T) {
+// TestUnitValidOCSPResponse validates various combinations of acceptable OCSP responses
+func TestUnitValidOCSPResponse(t *testing.T) {
+	rootCaKey, rootCa, leafCert := createCaLeafCerts(t)
+
+	type tests struct {
+		name           string
+		ocspRes        ocsp.Response
+		expectedStatus ocspStatusCode
+	}
+
+	now := time.Now()
+	ctx := context.Background()
+
+	tt := []tests{
+		{
+			name: "normal",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				NextUpdate:   now.Add(30 * time.Minute),
+				Status:       ocsp.Good,
+			},
+			expectedStatus: ocspStatusGood,
+		},
+		{
+			name: "no-next-update",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				Status:       ocsp.Good,
+			},
+			expectedStatus: ocspStatusGood,
+		},
+		{
+			name: "revoked-update",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				Status:       ocsp.Revoked,
+			},
+			expectedStatus: ocspStatusRevoked,
+		},
+		{
+			name: "revoked-update-with-next-update",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				NextUpdate:   now.Add(1 * time.Hour),
+				Status:       ocsp.Revoked,
+			},
+			expectedStatus: ocspStatusRevoked,
+		},
+	}
+	for _, tc := range tt {
+		for _, maxAge := range []time.Duration{time.Duration(0), time.Duration(2 * time.Hour)} {
+			t.Run(tc.name+"-max-age-"+maxAge.String(), func(t *testing.T) {
+				ocspHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					response := buildOcspResponse(t, rootCa, rootCaKey, tc.ocspRes)
+					_, _ = w.Write(response)
+				})
+				ts := httptest.NewServer(ocspHandler)
+				defer ts.Close()
+
+				logFactory := func() hclog.Logger {
+					return hclog.NewNullLogger()
+				}
+				client := New(logFactory, 100)
+				config := &VerifyConfig{
+					OcspEnabled:          true,
+					OcspServersOverride:  []string{ts.URL},
+					OcspFailureMode:      FailOpenFalse,
+					QueryAllServers:      false,
+					OcspThisUpdateMaxAge: maxAge,
+				}
+
+				status, err := client.GetRevocationStatus(ctx, leafCert, rootCa, config)
+				require.NoError(t, err, "ocsp response should have been considered valid")
+				require.NoError(t, status.err, "ocsp status should not contain an error")
+				require.Equal(t, &ocspStatus{code: tc.expectedStatus}, status)
+			})
+		}
+	}
+}
+
+// TestUnitBadOCSPResponses verifies that we fail properly on a bunch of different
+// OCSP response conditions
+func TestUnitBadOCSPResponses(t *testing.T) {
 	rootCaKey, rootCa, leafCert := createCaLeafCerts(t)
+	rootCaKey2, rootCa2, _ := createCaLeafCerts(t)
+
+	type tests struct {
+		name        string
+		ocspRes     ocsp.Response
+		maxAge      time.Duration
+		ca          *x509.Certificate
+		caKey       *ecdsa.PrivateKey
+		errContains string
+	}
+
+	now := time.Now()
+	ctx := context.Background()
+
+	tt := []tests{
+		{
+			name: "bad-signing-issuer",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				NextUpdate:   now.Add(30 * time.Minute),
+				Status:       ocsp.Good,
+			},
+			ca:          rootCa2,
+			caKey:       rootCaKey2,
+			errContains: "error directly verifying signature",
+		},
+		{
+			name: "incorrect-serial-number",
+			ocspRes: ocsp.Response{
+				SerialNumber: big.NewInt(1000),
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				NextUpdate:   now.Add(30 * time.Minute),
+				Status:       ocsp.Good,
+			},
+			ca:          rootCa,
+			caKey:       rootCaKey,
+			errContains: "did not match the leaf certificate serial number",
+		},
+		{
+			name: "expired-next-update",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				NextUpdate:   now.Add(-30 * time.Minute),
+				Status:       ocsp.Good,
+			},
+			errContains: "invalid validity",
+		},
+		{
+			name: "this-update-in-future",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				ThisUpdate:   now.Add(1 * time.Hour),
+				NextUpdate:   now.Add(2 * time.Hour),
+				Status:       ocsp.Good,
+			},
+			errContains: "invalid validity",
+		},
+		{
+			name: "next-update-before-this-update",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				NextUpdate:   now.Add(-2 * time.Hour),
+				Status:       ocsp.Good,
+			},
+			errContains: "invalid validity",
+		},
+		{
+			name: "missing-this-update",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				NextUpdate:   now.Add(2 * time.Hour),
+				Status:       ocsp.Good,
+			},
+			errContains: "invalid validity",
+		},
+		{
+			name: "unknown-status",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				NextUpdate:   now.Add(30 * time.Minute),
+				Status:       ocsp.Unknown,
+			},
+			errContains: "OCSP status unknown",
+		},
+		{
+			name: "over-max-age",
+			ocspRes: ocsp.Response{
+				SerialNumber: leafCert.SerialNumber,
+				ThisUpdate:   now.Add(-1 * time.Hour),
+				NextUpdate:   now.Add(30 * time.Minute),
+				Status:       ocsp.Good,
+			},
+			maxAge:      10 * time.Minute,
+			errContains: "is greater than max age",
+		},
+	}
+	for _, tc := range tt {
+		t.Run(tc.name, func(t *testing.T) {
+			ocspHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				useCa := rootCa
+				useCaKey := rootCaKey
+				if tc.ca != nil {
+					useCa = tc.ca
+				}
+				if tc.caKey != nil {
+					useCaKey = tc.caKey
+				}
+				response := buildOcspResponse(t, useCa, useCaKey, tc.ocspRes)
+				_, _ = w.Write(response)
+			})
+			ts := httptest.NewServer(ocspHandler)
+			defer ts.Close()
+
+			logFactory := func() hclog.Logger {
+				return hclog.NewNullLogger()
+			}
+			client := New(logFactory, 100)
+
+			config := &VerifyConfig{
+				OcspEnabled:          true,
+				OcspServersOverride:  []string{ts.URL},
+				OcspFailureMode:      FailOpenFalse,
+				QueryAllServers:      false,
+				OcspThisUpdateMaxAge: tc.maxAge,
+			}
 
-	expiredOcspResponse := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			status, err := client.GetRevocationStatus(ctx, leafCert, rootCa, config)
+			if err == nil && status == nil || (status != nil && status.err == nil) {
+				t.Fatalf("expected an error got none")
+			}
+			if err != nil {
+				require.ErrorContains(t, err, tc.errContains,
+					"Expected error got response: %v, %v", status, err)
+			}
+			if status != nil && status.err != nil {
+				require.ErrorContains(t, status.err, tc.errContains,
+					"Expected error got response: %v, %v", status, err)
+			}
+		})
+	}
+}
+
+// TestUnitZeroNextUpdateAreNotCached verifies that we are not caching the responses
+// with no NextUpdate field set as according to RFC6960 4.2.2.1
+// "If nextUpdate is not set, the responder is indicating that newer
+// revocation information is available all the time."
+func TestUnitZeroNextUpdateAreNotCached(t *testing.T) {
+	rootCaKey, rootCa, leafCert := createCaLeafCerts(t)
+	numQueries := &atomic.Uint32{}
+	ocspHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		numQueries.Add(1)
 		now := time.Now()
 		ocspRes := ocsp.Response{
-			SerialNumber: big.NewInt(2),
+			SerialNumber: leafCert.SerialNumber,
 			ThisUpdate:   now.Add(-1 * time.Hour),
-			NextUpdate:   now.Add(-30 * time.Minute),
 			Status:       ocsp.Good,
 		}
-		response, err := ocsp.CreateResponse(rootCa, rootCa, ocspRes, rootCaKey)
-		if err != nil {
-			_, _ = w.Write(ocsp.InternalErrorErrorResponse)
-			t.Fatalf("failed generating OCSP response: %v", err)
-		}
+		response := buildOcspResponse(t, rootCa, rootCaKey, ocspRes)
 		_, _ = w.Write(response)
 	})
-	ts := httptest.NewServer(expiredOcspResponse)
+	ts := httptest.NewServer(ocspHandler)
 	defer ts.Close()
 
 	logFactory := func() hclog.Logger {
@@ -234,18 +470,71 @@ func TestUnitExpiredOCSPResponse(t *testing.T) {
 	}
 	client := New(logFactory, 100)
 
-	ctx := context.Background()
-
 	config := &VerifyConfig{
 		OcspEnabled:         true,
 		OcspServersOverride: []string{ts.URL},
-		OcspFailureMode:     FailOpenFalse,
-		QueryAllServers:     false,
 	}
 
-	status, err := client.GetRevocationStatus(ctx, leafCert, rootCa, config)
-	require.ErrorContains(t, err, "invalid validity",
-		"Expected error got response: %v, %v", status, err)
+	_, err := client.GetRevocationStatus(context.Background(), leafCert, rootCa, config)
+	require.NoError(t, err, "Failed fetching revocation status")
+
+	_, err = client.GetRevocationStatus(context.Background(), leafCert, rootCa, config)
+	require.NoError(t, err, "Failed fetching revocation status second time")
+
+	require.Equal(t, uint32(2), numQueries.Load())
+}
+
+// TestUnitResponsesAreCached verify that the OCSP responses are properly cached when
+// querying for the same leaf certificates
+func TestUnitResponsesAreCached(t *testing.T) {
+	rootCaKey, rootCa, leafCert := createCaLeafCerts(t)
+	numQueries := &atomic.Uint32{}
+	ocspHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		numQueries.Add(1)
+		now := time.Now()
+		ocspRes := ocsp.Response{
+			SerialNumber: leafCert.SerialNumber,
+			ThisUpdate:   now.Add(-1 * time.Hour),
+			NextUpdate:   now.Add(1 * time.Hour),
+			Status:       ocsp.Good,
+		}
+		response := buildOcspResponse(t, rootCa, rootCaKey, ocspRes)
+		_, _ = w.Write(response)
+	})
+	ts1 := httptest.NewServer(ocspHandler)
+	ts2 := httptest.NewServer(ocspHandler)
+	defer ts1.Close()
+	defer ts2.Close()
+
+	logFactory := func() hclog.Logger {
+		return hclog.NewNullLogger()
+	}
+	client := New(logFactory, 100)
+
+	config := &VerifyConfig{
+		OcspEnabled:         true,
+		OcspServersOverride: []string{ts1.URL, ts2.URL},
+		QueryAllServers:     true,
+	}
+
+	_, err := client.GetRevocationStatus(context.Background(), leafCert, rootCa, config)
+	require.NoError(t, err, "Failed fetching revocation status")
+	// Make sure that we queried both servers and not the cache
+	require.Equal(t, uint32(2), numQueries.Load())
+
+	// These query should be cached and not influence our counter
+	_, err = client.GetRevocationStatus(context.Background(), leafCert, rootCa, config)
+	require.NoError(t, err, "Failed fetching revocation status second time")
+
+	require.Equal(t, uint32(2), numQueries.Load())
+}
+
+func buildOcspResponse(t *testing.T, ca *x509.Certificate, caKey *ecdsa.PrivateKey, ocspRes ocsp.Response) []byte {
+	response, err := ocsp.CreateResponse(ca, ca, ocspRes, caKey)
+	if err != nil {
+		t.Fatalf("failed generating OCSP response: %v", err)
+	}
+	return response
 }
 
 func createCaLeafCerts(t *testing.T) (*ecdsa.PrivateKey, *x509.Certificate, *x509.Certificate) {
@@ -291,8 +580,9 @@ func createCaLeafCerts(t *testing.T) (*ecdsa.PrivateKey, *x509.Certificate, *x50
 }
 
 func TestUnitValidateOCSP(t *testing.T) {
+	conf := &VerifyConfig{OcspEnabled: true}
 	ocspRes := &ocsp.Response{}
-	ost, err := validateOCSP(ocspRes)
+	ost, err := validateOCSP(conf, ocspRes)
 	if err == nil && isValidOCSPStatus(ost.code) {
 		t.Fatalf("should have failed.")
 	}
@@ -301,7 +591,7 @@ func TestUnitValidateOCSP(t *testing.T) {
 	ocspRes.ThisUpdate = currentTime.Add(-2 * time.Hour)
 	ocspRes.NextUpdate = currentTime.Add(2 * time.Hour)
 	ocspRes.Status = ocsp.Revoked
-	ost, err = validateOCSP(ocspRes)
+	ost, err = validateOCSP(conf, ocspRes)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -310,7 +600,7 @@ func TestUnitValidateOCSP(t *testing.T) {
 		t.Fatalf("should have failed. expected: %v, got: %v", ocspStatusRevoked, ost.code)
 	}
 	ocspRes.Status = ocsp.Good
-	ost, err = validateOCSP(ocspRes)
+	ost, err = validateOCSP(conf, ocspRes)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -319,7 +609,7 @@ func TestUnitValidateOCSP(t *testing.T) {
 		t.Fatalf("should have success. expected: %v, got: %v", ocspStatusGood, ost.code)
 	}
 	ocspRes.Status = ocsp.Unknown
-	ost, err = validateOCSP(ocspRes)
+	ost, err = validateOCSP(conf, ocspRes)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -327,7 +617,7 @@ func TestUnitValidateOCSP(t *testing.T) {
 		t.Fatalf("should have failed. expected: %v, got: %v", ocspStatusUnknown, ost.code)
 	}
 	ocspRes.Status = ocsp.ServerFailed
-	ost, err = validateOCSP(ocspRes)
+	ost, err = validateOCSP(conf, ocspRes)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -388,7 +678,7 @@ func TestOCSPRetry(t *testing.T) {
 		context.TODO(),
 		client, fakeRequestFunc,
 		dummyOCSPHost,
-		make(map[string]string), []byte{0}, certs[len(certs)-1])
+		make(map[string]string), []byte{0}, certs[0], certs[len(certs)-1], nil)
 	if err == nil {
 		fmt.Printf("should fail: %v, %v, %v\n", res, b, st)
 	}
@@ -403,7 +693,7 @@ func TestOCSPRetry(t *testing.T) {
 		context.TODO(),
 		client, fakeRequestFunc,
 		dummyOCSPHost,
-		make(map[string]string), []byte{0}, certs[len(certs)-1])
+		make(map[string]string), []byte{0}, certs[0], certs[len(certs)-1], nil)
 	if err == nil {
 		fmt.Printf("should fail: %v, %v, %v\n", res, b, st)
 	}
diff --git a/sdk/helper/parseutil/parseutil.go b/sdk/helper/parseutil/parseutil.go
index 5bea8909de1..e139a5f1144 100644
--- a/sdk/helper/parseutil/parseutil.go
+++ b/sdk/helper/parseutil/parseutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // DEPRECATED: this has been moved to go-secure-stdlib and will be removed
diff --git a/sdk/helper/password/password.go b/sdk/helper/password/password.go
index 931a72cc8bc..bc65a32fde4 100644
--- a/sdk/helper/password/password.go
+++ b/sdk/helper/password/password.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // DEPRECATED: this has been moved to go-secure-stdlib and will be removed
diff --git a/sdk/helper/pathmanager/pathmanager.go b/sdk/helper/pathmanager/pathmanager.go
index 0d2d60070f7..906445e18e4 100644
--- a/sdk/helper/pathmanager/pathmanager.go
+++ b/sdk/helper/pathmanager/pathmanager.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pathmanager
diff --git a/sdk/helper/pathmanager/pathmanager_test.go b/sdk/helper/pathmanager/pathmanager_test.go
index 515d830324f..013f34ef58d 100644
--- a/sdk/helper/pathmanager/pathmanager_test.go
+++ b/sdk/helper/pathmanager/pathmanager_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pathmanager
diff --git a/sdk/helper/pluginidentityutil/errors.go b/sdk/helper/pluginidentityutil/errors.go
new file mode 100644
index 00000000000..64f9eebb96f
--- /dev/null
+++ b/sdk/helper/pluginidentityutil/errors.go
@@ -0,0 +1,8 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package pluginidentityutil
+
+import "errors"
+
+var ErrPluginWorkloadIdentityUnsupported = errors.New("plugin workload identity not supported in Vault community edition")
diff --git a/sdk/helper/pluginidentityutil/fields.go b/sdk/helper/pluginidentityutil/fields.go
index 3d97537ecc9..8347806b728 100644
--- a/sdk/helper/pluginidentityutil/fields.go
+++ b/sdk/helper/pluginidentityutil/fields.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginidentityutil
@@ -38,19 +38,26 @@ func (p *PluginIdentityTokenParams) PopulatePluginIdentityTokenData(m map[string
 	m["identity_token_audience"] = p.IdentityTokenAudience
 }
 
-// AddPluginIdentityTokenFields adds plugin identity token fields to the given
-// field schema map.
-func AddPluginIdentityTokenFields(m map[string]*framework.FieldSchema) {
+// AddPluginIdentityTokenFields adds plugin identity token fields to the given field schema map
+// the fields are associated to the provided display attribute group
+func AddPluginIdentityTokenFieldsWithGroup(m map[string]*framework.FieldSchema, group string) {
 	fields := map[string]*framework.FieldSchema{
 		"identity_token_audience": {
 			Type:        framework.TypeString,
 			Description: "Audience of plugin identity tokens",
 			Default:     "",
+			DisplayAttrs: &framework.DisplayAttributes{
+				Group: group,
+			},
 		},
 		"identity_token_ttl": {
 			Type:        framework.TypeDurationSecond,
 			Description: "Time-to-live of plugin identity tokens",
 			Default:     3600,
+			DisplayAttrs: &framework.DisplayAttributes{
+				Name:  "Identity token TTL",
+				Group: group,
+			},
 		},
 	}
 
@@ -61,3 +68,10 @@ func AddPluginIdentityTokenFields(m map[string]*framework.FieldSchema) {
 		m[name] = schema
 	}
 }
+
+// stubbing original function for compatibility
+// AddPluginIdentityTokenFieldsWithGroup should be used directly
+// future utils that define fields should include a group parameter
+func AddPluginIdentityTokenFields(m map[string]*framework.FieldSchema) {
+	AddPluginIdentityTokenFieldsWithGroup(m, "default")
+}
diff --git a/sdk/helper/pluginidentityutil/fields_test.go b/sdk/helper/pluginidentityutil/fields_test.go
index a64f1aca439..f726537ece6 100644
--- a/sdk/helper/pluginidentityutil/fields_test.go
+++ b/sdk/helper/pluginidentityutil/fields_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginidentityutil
@@ -115,25 +115,34 @@ func TestPopulatePluginIdentityTokenData(t *testing.T) {
 	}
 }
 
-func TestAddPluginIdentityTokenFields(t *testing.T) {
+func TestAddPluginIdentityTokenFieldsWithGroup(t *testing.T) {
 	testcases := []struct {
 		name  string
+		group string
 		input map[string]*framework.FieldSchema
 		want  map[string]*framework.FieldSchema
 	}{
 		{
 			name:  "basic",
 			input: map[string]*framework.FieldSchema{},
+			group: "Tokens",
 			want: map[string]*framework.FieldSchema{
 				fieldIDTokenAudience: {
 					Type:        framework.TypeString,
 					Description: "Audience of plugin identity tokens",
 					Default:     "",
+					DisplayAttrs: &framework.DisplayAttributes{
+						Group: "Tokens",
+					},
 				},
 				fieldIDTokenTTL: {
 					Type:        framework.TypeDurationSecond,
 					Description: "Time-to-live of plugin identity tokens",
 					Default:     3600,
+					DisplayAttrs: &framework.DisplayAttributes{
+						Name:  "Identity token TTL",
+						Group: "Tokens",
+					},
 				},
 			},
 		},
@@ -146,16 +155,24 @@ func TestAddPluginIdentityTokenFields(t *testing.T) {
 					Default:     "default",
 				},
 			},
+			group: "Token Options",
 			want: map[string]*framework.FieldSchema{
 				fieldIDTokenAudience: {
 					Type:        framework.TypeString,
 					Description: "Audience of plugin identity tokens",
 					Default:     "",
+					DisplayAttrs: &framework.DisplayAttributes{
+						Group: "Token Options",
+					},
 				},
 				fieldIDTokenTTL: {
 					Type:        framework.TypeDurationSecond,
 					Description: "Time-to-live of plugin identity tokens",
 					Default:     3600,
+					DisplayAttrs: &framework.DisplayAttributes{
+						Name:  "Identity token TTL",
+						Group: "Token Options",
+					},
 				},
 				"test": {
 					Type:        framework.TypeString,
@@ -166,6 +183,47 @@ func TestAddPluginIdentityTokenFields(t *testing.T) {
 		},
 	}
 
+	for _, tt := range testcases {
+		t.Run(tt.name, func(t *testing.T) {
+			got := tt.input
+			AddPluginIdentityTokenFieldsWithGroup(got, tt.group)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestAddPluginIdentityTokenFields(t *testing.T) {
+	testcases := []struct {
+		name  string
+		group string
+		input map[string]*framework.FieldSchema
+		want  map[string]*framework.FieldSchema
+	}{
+		{
+			name:  "basic",
+			input: map[string]*framework.FieldSchema{},
+			want: map[string]*framework.FieldSchema{
+				fieldIDTokenAudience: {
+					Type:        framework.TypeString,
+					Description: "Audience of plugin identity tokens",
+					Default:     "",
+					DisplayAttrs: &framework.DisplayAttributes{
+						Group: "default",
+					},
+				},
+				fieldIDTokenTTL: {
+					Type:        framework.TypeDurationSecond,
+					Description: "Time-to-live of plugin identity tokens",
+					Default:     3600,
+					DisplayAttrs: &framework.DisplayAttributes{
+						Name:  "Identity token TTL",
+						Group: "default",
+					},
+				},
+			},
+		},
+	}
+
 	for _, tt := range testcases {
 		t.Run(tt.name, func(t *testing.T) {
 			got := tt.input
diff --git a/sdk/helper/pluginruntimeutil/config.go b/sdk/helper/pluginruntimeutil/config.go
index f674c7df362..cde4ab600fc 100644
--- a/sdk/helper/pluginruntimeutil/config.go
+++ b/sdk/helper/pluginruntimeutil/config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginruntimeutil
@@ -13,5 +13,5 @@ type PluginRuntimeConfig struct {
 	CgroupParent string                   `json:"cgroup_parent" structs:"cgroup_parent"`
 	CPU          int64                    `json:"cpu" structs:"cpu"`
 	Memory       int64                    `json:"memory" structs:"memory"`
-	Rootless     bool                     `json:"rootless" structs:"rootlesss"`
+	Rootless     bool                     `json:"rootless" structs:"rootless"`
 }
diff --git a/sdk/helper/pluginutil/env.go b/sdk/helper/pluginutil/env.go
index 515baa1f761..f9a466a3cad 100644
--- a/sdk/helper/pluginutil/env.go
+++ b/sdk/helper/pluginutil/env.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginutil
@@ -44,6 +44,19 @@ const (
 	// colliding plugin-specific environment variables. Otherwise, plugin-specific
 	// environment variables take precedence over Vault process environment variables.
 	PluginUseLegacyEnvLayering = "VAULT_PLUGIN_USE_LEGACY_ENV_LAYERING"
+
+	// PluginUsePostgresSSLInline enables the usage of a custom sslinline
+	// configuration as a shim to the pgx posgtres library.
+	// Deprecated: VAULT_PLUGIN_USE_POSTGRES_SSLINLINE will be removed in a future version of the Vault SDK.
+	PluginUsePostgresSSLInline = "VAULT_PLUGIN_USE_POSTGRES_SSLINLINE"
+
+	// PluginGRPCTimeoutType is an ENV name used to set the timeout for Vault's
+	// call to the plugin Type() GRPC method
+	PluginGRPCTimeoutType = "VAULT_PLUGIN_GRPC_TIMEOUT_TYPE"
+
+	// PluginGRPCTimeoutClose is an ENV name used to set the timeout for Vault's
+	// call to the plugin Close() GRPC method
+	PluginGRPCTimeoutClose = "VAULT_PLUGIN_GRPC_TIMEOUT_CLOSE"
 )
 
 // OptionallyEnableMlock determines if mlock should be called, and if so enables
diff --git a/sdk/helper/pluginutil/env_test.go b/sdk/helper/pluginutil/env_test.go
index 21f77faba6e..3fe27a69ddc 100644
--- a/sdk/helper/pluginutil/env_test.go
+++ b/sdk/helper/pluginutil/env_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginutil
diff --git a/sdk/helper/pluginutil/identity_token.go b/sdk/helper/pluginutil/identity_token.go
index 7e764bb1e13..10b3a7ce6a4 100644
--- a/sdk/helper/pluginutil/identity_token.go
+++ b/sdk/helper/pluginutil/identity_token.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginutil
diff --git a/sdk/helper/pluginutil/identity_token_test.go b/sdk/helper/pluginutil/identity_token_test.go
index d0c01c390b3..804381d5409 100644
--- a/sdk/helper/pluginutil/identity_token_test.go
+++ b/sdk/helper/pluginutil/identity_token_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginutil
diff --git a/sdk/helper/pluginutil/multiplexing.go b/sdk/helper/pluginutil/multiplexing.go
index 8fc86a4c36c..6ecc478d050 100644
--- a/sdk/helper/pluginutil/multiplexing.go
+++ b/sdk/helper/pluginutil/multiplexing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginutil
diff --git a/sdk/helper/pluginutil/multiplexing.pb.go b/sdk/helper/pluginutil/multiplexing.pb.go
index d7b9529864d..5d878a998f3 100644
--- a/sdk/helper/pluginutil/multiplexing.pb.go
+++ b/sdk/helper/pluginutil/multiplexing.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: sdk/helper/pluginutil/multiplexing.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -24,18 +25,16 @@ const (
 )
 
 type MultiplexingSupportRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *MultiplexingSupportRequest) Reset() {
 	*x = MultiplexingSupportRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_helper_pluginutil_multiplexing_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_helper_pluginutil_multiplexing_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *MultiplexingSupportRequest) String() string {
@@ -46,7 +45,7 @@ func (*MultiplexingSupportRequest) ProtoMessage() {}
 
 func (x *MultiplexingSupportRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_helper_pluginutil_multiplexing_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -62,20 +61,17 @@ func (*MultiplexingSupportRequest) Descriptor() ([]byte, []int) {
 }
 
 type MultiplexingSupportResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Supported     bool                   `protobuf:"varint,1,opt,name=supported,proto3" json:"supported,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Supported bool `protobuf:"varint,1,opt,name=supported,proto3" json:"supported,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *MultiplexingSupportResponse) Reset() {
 	*x = MultiplexingSupportResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_helper_pluginutil_multiplexing_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_helper_pluginutil_multiplexing_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *MultiplexingSupportResponse) String() string {
@@ -86,7 +82,7 @@ func (*MultiplexingSupportResponse) ProtoMessage() {}
 
 func (x *MultiplexingSupportResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_helper_pluginutil_multiplexing_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -110,7 +106,7 @@ func (x *MultiplexingSupportResponse) GetSupported() bool {
 
 var File_sdk_helper_pluginutil_multiplexing_proto protoreflect.FileDescriptor
 
-var file_sdk_helper_pluginutil_multiplexing_proto_rawDesc = []byte{
+var file_sdk_helper_pluginutil_multiplexing_proto_rawDesc = string([]byte{
 	0x0a, 0x28, 0x73, 0x64, 0x6b, 0x2f, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x2f, 0x70, 0x6c, 0x75,
 	0x67, 0x69, 0x6e, 0x75, 0x74, 0x69, 0x6c, 0x2f, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x70, 0x6c, 0x65,
 	0x78, 0x69, 0x6e, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x17, 0x70, 0x6c, 0x75, 0x67,
@@ -135,22 +131,22 @@ var file_sdk_helper_pluginutil_multiplexing_proto_rawDesc = []byte{
 	0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x68, 0x65, 0x6c, 0x70, 0x65,
 	0x72, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x75, 0x74, 0x69, 0x6c, 0x62, 0x06, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_sdk_helper_pluginutil_multiplexing_proto_rawDescOnce sync.Once
-	file_sdk_helper_pluginutil_multiplexing_proto_rawDescData = file_sdk_helper_pluginutil_multiplexing_proto_rawDesc
+	file_sdk_helper_pluginutil_multiplexing_proto_rawDescData []byte
 )
 
 func file_sdk_helper_pluginutil_multiplexing_proto_rawDescGZIP() []byte {
 	file_sdk_helper_pluginutil_multiplexing_proto_rawDescOnce.Do(func() {
-		file_sdk_helper_pluginutil_multiplexing_proto_rawDescData = protoimpl.X.CompressGZIP(file_sdk_helper_pluginutil_multiplexing_proto_rawDescData)
+		file_sdk_helper_pluginutil_multiplexing_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sdk_helper_pluginutil_multiplexing_proto_rawDesc), len(file_sdk_helper_pluginutil_multiplexing_proto_rawDesc)))
 	})
 	return file_sdk_helper_pluginutil_multiplexing_proto_rawDescData
 }
 
 var file_sdk_helper_pluginutil_multiplexing_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_sdk_helper_pluginutil_multiplexing_proto_goTypes = []interface{}{
+var file_sdk_helper_pluginutil_multiplexing_proto_goTypes = []any{
 	(*MultiplexingSupportRequest)(nil),  // 0: pluginutil.multiplexing.MultiplexingSupportRequest
 	(*MultiplexingSupportResponse)(nil), // 1: pluginutil.multiplexing.MultiplexingSupportResponse
 }
@@ -169,37 +165,11 @@ func file_sdk_helper_pluginutil_multiplexing_proto_init() {
 	if File_sdk_helper_pluginutil_multiplexing_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_sdk_helper_pluginutil_multiplexing_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MultiplexingSupportRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_helper_pluginutil_multiplexing_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MultiplexingSupportResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_sdk_helper_pluginutil_multiplexing_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_helper_pluginutil_multiplexing_proto_rawDesc), len(file_sdk_helper_pluginutil_multiplexing_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   2,
 			NumExtensions: 0,
@@ -210,7 +180,6 @@ func file_sdk_helper_pluginutil_multiplexing_proto_init() {
 		MessageInfos:      file_sdk_helper_pluginutil_multiplexing_proto_msgTypes,
 	}.Build()
 	File_sdk_helper_pluginutil_multiplexing_proto = out.File
-	file_sdk_helper_pluginutil_multiplexing_proto_rawDesc = nil
 	file_sdk_helper_pluginutil_multiplexing_proto_goTypes = nil
 	file_sdk_helper_pluginutil_multiplexing_proto_depIdxs = nil
 }
diff --git a/sdk/helper/pluginutil/multiplexing.proto b/sdk/helper/pluginutil/multiplexing.proto
index 3b5d1919841..7fe2b062fcf 100644
--- a/sdk/helper/pluginutil/multiplexing.proto
+++ b/sdk/helper/pluginutil/multiplexing.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 syntax = "proto3";
diff --git a/sdk/helper/pluginutil/multiplexing_grpc.pb.go b/sdk/helper/pluginutil/multiplexing_grpc.pb.go
index 1fc6cba7c62..e716b17488f 100644
--- a/sdk/helper/pluginutil/multiplexing_grpc.pb.go
+++ b/sdk/helper/pluginutil/multiplexing_grpc.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: sdk/helper/pluginutil/multiplexing.proto
 
@@ -18,8 +18,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	PluginMultiplexing_MultiplexingSupport_FullMethodName = "/pluginutil.multiplexing.PluginMultiplexing/MultiplexingSupport"
@@ -41,8 +41,9 @@ func NewPluginMultiplexingClient(cc grpc.ClientConnInterface) PluginMultiplexing
 }
 
 func (c *pluginMultiplexingClient) MultiplexingSupport(ctx context.Context, in *MultiplexingSupportRequest, opts ...grpc.CallOption) (*MultiplexingSupportResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(MultiplexingSupportResponse)
-	err := c.cc.Invoke(ctx, PluginMultiplexing_MultiplexingSupport_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginMultiplexing_MultiplexingSupport_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -51,20 +52,24 @@ func (c *pluginMultiplexingClient) MultiplexingSupport(ctx context.Context, in *
 
 // PluginMultiplexingServer is the server API for PluginMultiplexing service.
 // All implementations must embed UnimplementedPluginMultiplexingServer
-// for forward compatibility
+// for forward compatibility.
 type PluginMultiplexingServer interface {
 	MultiplexingSupport(context.Context, *MultiplexingSupportRequest) (*MultiplexingSupportResponse, error)
 	mustEmbedUnimplementedPluginMultiplexingServer()
 }
 
-// UnimplementedPluginMultiplexingServer must be embedded to have forward compatible implementations.
-type UnimplementedPluginMultiplexingServer struct {
-}
+// UnimplementedPluginMultiplexingServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedPluginMultiplexingServer struct{}
 
 func (UnimplementedPluginMultiplexingServer) MultiplexingSupport(context.Context, *MultiplexingSupportRequest) (*MultiplexingSupportResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method MultiplexingSupport not implemented")
 }
 func (UnimplementedPluginMultiplexingServer) mustEmbedUnimplementedPluginMultiplexingServer() {}
+func (UnimplementedPluginMultiplexingServer) testEmbeddedByValue()                            {}
 
 // UnsafePluginMultiplexingServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to PluginMultiplexingServer will
@@ -74,6 +79,13 @@ type UnsafePluginMultiplexingServer interface {
 }
 
 func RegisterPluginMultiplexingServer(s grpc.ServiceRegistrar, srv PluginMultiplexingServer) {
+	// If the following call pancis, it indicates UnimplementedPluginMultiplexingServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&PluginMultiplexing_ServiceDesc, srv)
 }
 
diff --git a/sdk/helper/pluginutil/multiplexing_test.go b/sdk/helper/pluginutil/multiplexing_test.go
index 3f589ffa7cd..42a62209512 100644
--- a/sdk/helper/pluginutil/multiplexing_test.go
+++ b/sdk/helper/pluginutil/multiplexing_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginutil
diff --git a/sdk/helper/pluginutil/run_config.go b/sdk/helper/pluginutil/run_config.go
index 1af71d09b75..04c9c317f0d 100644
--- a/sdk/helper/pluginutil/run_config.go
+++ b/sdk/helper/pluginutil/run_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginutil
@@ -40,6 +40,7 @@ type PluginClientConfig struct {
 	AutoMTLS        bool
 	MLock           bool
 	Wrapper         RunnerUtil
+	Tier            consts.PluginTier
 }
 
 type runConfig struct {
diff --git a/sdk/helper/pluginutil/run_config_test.go b/sdk/helper/pluginutil/run_config_test.go
index 6bb840f462d..abc0f202a91 100644
--- a/sdk/helper/pluginutil/run_config_test.go
+++ b/sdk/helper/pluginutil/run_config_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginutil
@@ -447,6 +447,10 @@ func (m *mockRunnerUtil) ClusterID(ctx context.Context) (string, error) {
 	return "1234", nil
 }
 
+func (m *mockRunnerUtil) DownloadExtractVerifyPlugin(ctx context.Context, _ *PluginRunner) error {
+	return nil
+}
+
 func TestContainerConfig(t *testing.T) {
 	dummySHA, err := hex.DecodeString("abc123")
 	if err != nil {
diff --git a/sdk/helper/pluginutil/runner.go b/sdk/helper/pluginutil/runner.go
index ebbe110c347..9396768888d 100644
--- a/sdk/helper/pluginutil/runner.go
+++ b/sdk/helper/pluginutil/runner.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginutil
@@ -18,6 +18,13 @@ import (
 	"google.golang.org/grpc"
 )
 
+const (
+	// ConfigPluginTier is the key for the plugin tier for Config of logical.BackendConfig
+	ConfigPluginTier = "plugin_tier"
+	// ConfigPluginVersion is the key for the plugin version for Config of logical.BackendConfig
+	ConfigPluginVersion = "plugin_version"
+)
+
 // ErrPluginNotFound is returned when a plugin does not have a pinned version.
 var ErrPinnedVersionNotFound = errors.New("pinned version not found")
 
@@ -38,6 +45,7 @@ type RunnerUtil interface {
 	MlockEnabled() bool
 	VaultVersion(ctx context.Context) (string, error)
 	ClusterID(ctx context.Context) (string, error)
+	DownloadExtractVerifyPlugin(ctx context.Context, pr *PluginRunner) error
 }
 
 // LookRunnerUtil defines the functions for both Looker and Wrapper
@@ -67,6 +75,8 @@ type PluginRunner struct {
 	Env            []string                    `json:"env" structs:"env"`
 	Sha256         []byte                      `json:"sha256" structs:"sha256"`
 	Builtin        bool                        `json:"builtin" structs:"builtin"`
+	Tier           consts.PluginTier           `json:"tier" structs:"tier"`
+	Download       bool                        `json:"download" structs:"download"`
 	BuiltinFactory func() (interface{}, error) `json:"-" structs:"-"`
 	RuntimeConfig  *prutil.PluginRuntimeConfig `json:"-" structs:"-"`
 	Tmpdir         string                      `json:"-" structs:"-"`
@@ -103,6 +113,8 @@ type SetPluginInput struct {
 	Args     []string
 	Env      []string
 	Sha256   []byte
+	Tier     consts.PluginTier
+	Download bool
 }
 
 // Run takes a wrapper RunnerUtil instance along with the go-plugin parameters and
diff --git a/sdk/helper/pluginutil/tls.go b/sdk/helper/pluginutil/tls.go
index 21b35d910e7..4a7075a737a 100644
--- a/sdk/helper/pluginutil/tls.go
+++ b/sdk/helper/pluginutil/tls.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pluginutil
diff --git a/sdk/helper/pointerutil/pointer.go b/sdk/helper/pointerutil/pointer.go
index a3cb5589820..9cbad31a532 100644
--- a/sdk/helper/pointerutil/pointer.go
+++ b/sdk/helper/pointerutil/pointer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pointerutil
diff --git a/sdk/helper/policyutil/policyutil.go b/sdk/helper/policyutil/policyutil.go
index a5a8082e13c..cff17b7a52c 100644
--- a/sdk/helper/policyutil/policyutil.go
+++ b/sdk/helper/policyutil/policyutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package policyutil
@@ -79,33 +79,25 @@ func SanitizePolicies(policies []string, addDefault bool) []string {
 // EquivalentPolicies checks whether the given policy sets are equivalent, as in,
 // they contain the same values. The benefit of this method is that it leaves
 // the "default" policy out of its comparisons as it may be added later by core
-// after a set of policies has been saved by a backend.
+// after a set of policies has been saved by a backend and performs policy name
+// normalization.
 func EquivalentPolicies(a, b []string) bool {
-	switch {
-	case a == nil && b == nil:
-		return true
-	case a == nil && len(b) == 1 && b[0] == "default":
-		return true
-	case b == nil && len(a) == 1 && a[0] == "default":
-		return true
-	case a == nil || b == nil:
-		return false
-	}
-
 	// First we'll build maps to ensure unique values and filter default
-	mapA := map[string]bool{}
-	mapB := map[string]bool{}
+	mapA := map[string]struct{}{}
+	mapB := map[string]struct{}{}
 	for _, keyA := range a {
+		keyA := strings.ToLower(keyA)
 		if keyA == "default" {
 			continue
 		}
-		mapA[keyA] = true
+		mapA[keyA] = struct{}{}
 	}
 	for _, keyB := range b {
+		keyB := strings.ToLower(keyB)
 		if keyB == "default" {
 			continue
 		}
-		mapB[keyB] = true
+		mapB[keyB] = struct{}{}
 	}
 
 	// Now we'll build our checking slices
diff --git a/sdk/helper/policyutil/policyutil_test.go b/sdk/helper/policyutil/policyutil_test.go
index 2280ba93eed..ad44e6cca46 100644
--- a/sdk/helper/policyutil/policyutil_test.go
+++ b/sdk/helper/policyutil/policyutil_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package policyutil
@@ -56,24 +56,48 @@ func TestParsePolicies(t *testing.T) {
 }
 
 func TestEquivalentPolicies(t *testing.T) {
-	a := []string{"foo", "bar"}
-	var b []string
-	if EquivalentPolicies(a, b) {
-		t.Fatal("bad")
+	testCases := map[string]struct {
+		A        []string
+		B        []string
+		Expected bool
+	}{
+		"nil": {
+			A:        nil,
+			B:        nil,
+			Expected: true,
+		},
+		"empty": {
+			A:        []string{"foo", "bar"},
+			B:        []string{},
+			Expected: false,
+		},
+		"missing": {
+			A:        []string{"foo", "bar"},
+			B:        []string{"foo"},
+			Expected: false,
+		},
+		"equal": {
+			A:        []string{"bar", "foo"},
+			B:        []string{"bar", "foo"},
+			Expected: true,
+		},
+		"default": {
+			A:        []string{"bar", "foo"},
+			B:        []string{"foo", "default", "bar"},
+			Expected: true,
+		},
+		"case-insensitive": {
+			A:        []string{"test"},
+			B:        []string{"Test"},
+			Expected: true,
+		},
 	}
 
-	b = []string{"foo"}
-	if EquivalentPolicies(a, b) {
-		t.Fatal("bad")
-	}
-
-	b = []string{"bar", "foo"}
-	if !EquivalentPolicies(a, b) {
-		t.Fatal("bad")
-	}
-
-	b = []string{"foo", "default", "bar"}
-	if !EquivalentPolicies(a, b) {
-		t.Fatal("bad")
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			if EquivalentPolicies(tc.A, tc.B) != tc.Expected {
+				t.Fatal("bad")
+			}
+		})
 	}
 }
diff --git a/sdk/helper/roottoken/decode.go b/sdk/helper/roottoken/decode.go
index 9939b67f72f..254e1d4442f 100644
--- a/sdk/helper/roottoken/decode.go
+++ b/sdk/helper/roottoken/decode.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package roottoken
diff --git a/sdk/helper/roottoken/encode.go b/sdk/helper/roottoken/encode.go
index dbbc90a2afa..ab9f482c66e 100644
--- a/sdk/helper/roottoken/encode.go
+++ b/sdk/helper/roottoken/encode.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package roottoken
diff --git a/sdk/helper/roottoken/encode_test.go b/sdk/helper/roottoken/encode_test.go
index 269bf65b047..dc9d5ed45aa 100644
--- a/sdk/helper/roottoken/encode_test.go
+++ b/sdk/helper/roottoken/encode_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package roottoken
diff --git a/sdk/helper/roottoken/otp.go b/sdk/helper/roottoken/otp.go
index 4445ec52dc6..6a408bf7278 100644
--- a/sdk/helper/roottoken/otp.go
+++ b/sdk/helper/roottoken/otp.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package roottoken
diff --git a/sdk/helper/roottoken/otp_test.go b/sdk/helper/roottoken/otp_test.go
index 53776ec21c8..a70ebe2ac31 100644
--- a/sdk/helper/roottoken/otp_test.go
+++ b/sdk/helper/roottoken/otp_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package roottoken
diff --git a/sdk/helper/salt/salt.go b/sdk/helper/salt/salt.go
index 84cbd03556c..e764dfd25cc 100644
--- a/sdk/helper/salt/salt.go
+++ b/sdk/helper/salt/salt.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package salt
diff --git a/sdk/helper/salt/salt_test.go b/sdk/helper/salt/salt_test.go
index 3aec9a27b49..ee29647877b 100644
--- a/sdk/helper/salt/salt_test.go
+++ b/sdk/helper/salt/salt_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package salt
diff --git a/sdk/helper/strutil/strutil.go b/sdk/helper/strutil/strutil.go
index a9e506942af..cfe50bb24e6 100644
--- a/sdk/helper/strutil/strutil.go
+++ b/sdk/helper/strutil/strutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // DEPRECATED: this has been moved to go-secure-stdlib and will be removed
diff --git a/sdk/helper/template/funcs.go b/sdk/helper/template/funcs.go
index 6d68cab3a7e..509d3bacd2a 100644
--- a/sdk/helper/template/funcs.go
+++ b/sdk/helper/template/funcs.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package template
diff --git a/sdk/helper/template/funcs_test.go b/sdk/helper/template/funcs_test.go
index 4965115960e..916955be8a6 100644
--- a/sdk/helper/template/funcs_test.go
+++ b/sdk/helper/template/funcs_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package template
diff --git a/sdk/helper/template/template.go b/sdk/helper/template/template.go
index dea65f3f5ed..6be14042d3d 100644
--- a/sdk/helper/template/template.go
+++ b/sdk/helper/template/template.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package template
@@ -129,6 +129,10 @@ func NewTemplate(opts ...Opt) (up StringTemplate, err error) {
 		return StringTemplate{}, fmt.Errorf("missing template")
 	}
 
+	if len(up.rawTemplate) >= 100000 {
+		return StringTemplate{}, fmt.Errorf("template too large, length of template must be less than 100,000")
+	}
+
 	tmpl, err := template.New("template").
 		Funcs(up.funcMap).
 		Parse(up.rawTemplate)
diff --git a/sdk/helper/template/template_test.go b/sdk/helper/template/template_test.go
index 2f66bf36fe0..21d91c75388 100644
--- a/sdk/helper/template/template_test.go
+++ b/sdk/helper/template/template_test.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package template
 
 import (
 	"fmt"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -150,6 +151,16 @@ Some string 6841cf80`,
 			require.Regexp(t, `^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$`, actual)
 		}
 	})
+
+	t.Run("too-large-overflow", func(t *testing.T) {
+		data := "{{" + strings.Repeat("(", 1000000)
+		_, err := NewTemplate(
+			Template(data),
+		)
+		// We expect an error due it being too large,
+		// this test should not fail with an overflow
+		require.Error(t, err)
+	})
 }
 
 func TestBadConstructorArguments(t *testing.T) {
diff --git a/sdk/helper/testcluster/consts.go b/sdk/helper/testcluster/consts.go
index b736b5f88f7..11542b40fd3 100644
--- a/sdk/helper/testcluster/consts.go
+++ b/sdk/helper/testcluster/consts.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package testcluster
diff --git a/sdk/helper/testcluster/docker/cert.go b/sdk/helper/testcluster/docker/cert.go
index 4704030cb52..9c36a887a79 100644
--- a/sdk/helper/testcluster/docker/cert.go
+++ b/sdk/helper/testcluster/docker/cert.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package docker
diff --git a/sdk/helper/testcluster/docker/environment.go b/sdk/helper/testcluster/docker/environment.go
index 84dedbda7a5..eed16d75931 100644
--- a/sdk/helper/testcluster/docker/environment.go
+++ b/sdk/helper/testcluster/docker/environment.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package docker
@@ -33,7 +33,6 @@ import (
 	"time"
 
 	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/volume"
 	docker "github.com/docker/docker/client"
 	"github.com/hashicorp/go-cleanhttp"
@@ -77,7 +76,9 @@ type DockerCluster struct {
 	Logger    log.Logger
 	builtTags map[string]struct{}
 
-	storage testcluster.ClusterStorage
+	storage      testcluster.ClusterStorage
+	disableMlock bool
+	disableTLS   bool
 }
 
 func (dc *DockerCluster) NamedLogger(s string) log.Logger {
@@ -133,6 +134,9 @@ func (dc *DockerCluster) SetRecoveryKeys(keys [][]byte) {
 }
 
 func (dc *DockerCluster) GetCACertPEMFile() string {
+	if dc.disableTLS {
+		return ""
+	}
 	return testcluster.DefaultCAFile
 }
 
@@ -401,7 +405,7 @@ func (n *DockerClusterNode) setupCert(ip string) error {
 
 func NewTestDockerCluster(t *testing.T, opts *DockerClusterOptions) *DockerCluster {
 	if opts == nil {
-		opts = &DockerClusterOptions{}
+		opts = &DockerClusterOptions{DisableMlock: true}
 	}
 	if opts.ClusterName == "" {
 		opts.ClusterName = strings.ReplaceAll(t.Name(), "/", "-")
@@ -431,7 +435,7 @@ func NewDockerCluster(ctx context.Context, opts *DockerClusterOptions) (*DockerC
 	}
 
 	if opts == nil {
-		opts = &DockerClusterOptions{}
+		opts = &DockerClusterOptions{DisableMlock: true}
 	}
 	if opts.Logger == nil {
 		opts.Logger = log.NewNullLogger()
@@ -441,12 +445,14 @@ func NewDockerCluster(ctx context.Context, opts *DockerClusterOptions) (*DockerC
 	}
 
 	dc := &DockerCluster{
-		DockerAPI:   api,
-		ClusterName: opts.ClusterName,
-		Logger:      opts.Logger,
-		builtTags:   map[string]struct{}{},
-		CA:          opts.CA,
-		storage:     opts.Storage,
+		DockerAPI:    api,
+		ClusterName:  opts.ClusterName,
+		Logger:       opts.Logger,
+		builtTags:    map[string]struct{}{},
+		CA:           opts.CA,
+		storage:      opts.Storage,
+		disableMlock: opts.DisableMlock,
+		disableTLS:   opts.DisableTLS,
 	}
 
 	if err := dc.setupDockerCluster(ctx, opts); err != nil {
@@ -555,7 +561,13 @@ func (n *DockerClusterNode) apiConfig() (*api.Config, error) {
 	if config.Error != nil {
 		return nil, config.Error
 	}
-	config.Address = fmt.Sprintf("https://%s", n.HostPort)
+
+	protocol := "https"
+	if n.tlsConfig == nil {
+		protocol = "http"
+	}
+	config.Address = fmt.Sprintf("%s://%s", protocol, n.HostPort)
+
 	config.HttpClient = client
 	config.MaxRetries = 0
 	return config, nil
@@ -618,6 +630,16 @@ func (n *DockerClusterNode) createDefaultListenerConfig() map[string]interface{}
 	}}
 }
 
+func (n *DockerClusterNode) createTLSDisabledListenerConfig() map[string]interface{} {
+	return map[string]interface{}{"tcp": map[string]interface{}{
+		"address": fmt.Sprintf("%s:%d", "0.0.0.0", 8200),
+		"telemetry": map[string]interface{}{
+			"unauthenticated_metrics_access": true,
+		},
+		"tls_disable": true,
+	}}
+}
+
 func (n *DockerClusterNode) Start(ctx context.Context, opts *DockerClusterOptions) error {
 	if n.DataVolumeName == "" {
 		vol, err := n.DockerAPI.VolumeCreate(ctx, volume.CreateOptions{})
@@ -631,7 +653,15 @@ func (n *DockerClusterNode) Start(ctx context.Context, opts *DockerClusterOption
 	}
 	vaultCfg := map[string]interface{}{}
 	var listenerConfig []map[string]interface{}
-	listenerConfig = append(listenerConfig, n.createDefaultListenerConfig())
+
+	var defaultListenerConfig map[string]interface{}
+	if opts.DisableTLS {
+		defaultListenerConfig = n.createTLSDisabledListenerConfig()
+	} else {
+		defaultListenerConfig = n.createDefaultListenerConfig()
+	}
+
+	listenerConfig = append(listenerConfig, defaultListenerConfig)
 	ports := []string{"8200/tcp", "8201/tcp"}
 
 	if opts.VaultNodeConfig != nil && opts.VaultNodeConfig.AdditionalListeners != nil {
@@ -640,6 +670,9 @@ func (n *DockerClusterNode) Start(ctx context.Context, opts *DockerClusterOption
 			listener := cfg["tcp"].(map[string]interface{})
 			listener["address"] = fmt.Sprintf("%s:%d", "0.0.0.0", config.Port)
 			listener["chroot_namespace"] = config.ChrootNamespace
+			listener["redact_addresses"] = config.RedactAddresses
+			listener["redact_cluster_name"] = config.RedactClusterName
+			listener["redact_version"] = config.RedactVersion
 			listenerConfig = append(listenerConfig, cfg)
 			portStr := fmt.Sprintf("%d/tcp", config.Port)
 			if strutil.StrListContains(ports, portStr) {
@@ -679,8 +712,13 @@ func (n *DockerClusterNode) Start(ctx context.Context, opts *DockerClusterOption
 
 	//// disable_mlock is required for working in the Docker environment with
 	//// custom plugins
-	vaultCfg["disable_mlock"] = true
-	vaultCfg["api_addr"] = `https://{{- GetAllInterfaces | exclude "flags" "loopback" | attr "address" -}}:8200`
+	vaultCfg["disable_mlock"] = opts.DisableMlock
+
+	protocol := "https"
+	if opts.DisableTLS {
+		protocol = "http"
+	}
+	vaultCfg["api_addr"] = fmt.Sprintf(`%s://{{- GetAllInterfaces | exclude "flags" "loopback" | attr "address" -}}:8200`, protocol)
 	vaultCfg["cluster_addr"] = `https://{{- GetAllInterfaces | exclude "flags" "loopback" | attr "address" -}}:8201`
 
 	vaultCfg["administrative_namespace_path"] = opts.AdministrativeNamespacePath
@@ -719,10 +757,12 @@ func (n *DockerClusterNode) Start(ctx context.Context, opts *DockerClusterOption
 		}
 	}
 
-	// Create a temporary cert so vault will start up
-	err = n.setupCert("127.0.0.1")
-	if err != nil {
-		return err
+	if !opts.DisableTLS {
+		// Create a temporary cert so vault will start up
+		err = n.setupCert("127.0.0.1")
+		if err != nil {
+			return err
+		}
 	}
 
 	caDir := filepath.Join(n.Cluster.tmpDir, "ca")
@@ -742,48 +782,74 @@ func (n *DockerClusterNode) Start(ctx context.Context, opts *DockerClusterOption
 		}
 		n.Logger.Trace(s)
 	}
+	// If a container gets restarted, and we reissue a ContainerLogs call using
+	// Follow=true, we'll see all the logs already consumed before we start seeing
+	// new ones.  Use lastTS to avoid duplication.
+	lastTS := ""
 	logStdout := &LogConsumerWriter{logConsumer}
 	logStderr := &LogConsumerWriter{func(s string) {
 		if seenLogs.CAS(false, true) {
 			wg.Done()
 		}
-		testcluster.JSONLogNoTimestamp(n.Logger, s)
+		d := json.NewDecoder(strings.NewReader(s))
+		m := map[string]any{}
+		if err := d.Decode(&m); err != nil {
+			n.Logger.Error("failed to decode json output from dev vault", "error", err, "input", s)
+			return
+		}
+
+		lastTS = testcluster.JSONLogNoTimestampFromMap(n.Logger, lastTS, m)
 	}}
 
+	postStartFunc := func(containerID string, realIP string) error {
+		err := n.setupCert(realIP)
+		if err != nil {
+			return err
+		}
+
+		// If we signal Vault before it installs its sighup handler, it'll die.
+		wg.Wait()
+		n.Logger.Trace("running poststart", "containerID", containerID, "IP", realIP)
+		return n.runner.RefreshFiles(ctx, containerID)
+	}
+
+	if opts.DisableTLS {
+		postStartFunc = func(containerID string, realIP string) error {
+			// If we signal Vault before it installs its sighup handler, it'll die.
+			wg.Wait()
+			n.Logger.Trace("running poststart", "containerID", containerID, "IP", realIP)
+			return n.runner.RefreshFiles(ctx, containerID)
+		}
+	}
+
+	envs := []string{
+		// For now we're using disable_mlock, because this is for testing
+		// anyway, and because it prevents us using external plugins.
+		"SKIP_SETCAP=true",
+		"VAULT_LOG_FORMAT=json",
+		"VAULT_LICENSE=" + opts.VaultLicense,
+		"VAULT_DISABLE_MLOCK=" + strconv.FormatBool(opts.DisableMlock),
+	}
+	envs = append(envs, opts.Envs...)
+
 	r, err := dockhelper.NewServiceRunner(dockhelper.RunOptions{
 		ImageRepo: n.ImageRepo,
 		ImageTag:  n.ImageTag,
 		// We don't need to run update-ca-certificates in the container, because
 		// we're providing the CA in the raft join call, and otherwise Vault
 		// servers don't talk to one another on the API port.
-		Cmd: append([]string{"server"}, opts.Args...),
-		Env: []string{
-			// For now we're using disable_mlock, because this is for testing
-			// anyway, and because it prevents us using external plugins.
-			"SKIP_SETCAP=true",
-			"VAULT_LOG_FORMAT=json",
-			"VAULT_LICENSE=" + opts.VaultLicense,
-		},
-		Ports:           ports,
-		ContainerName:   n.Name(),
-		NetworkName:     opts.NetworkName,
-		CopyFromTo:      copyFromTo,
-		LogConsumer:     logConsumer,
-		LogStdout:       logStdout,
-		LogStderr:       logStderr,
-		PreDelete:       true,
-		DoNotAutoRemove: true,
-		PostStart: func(containerID string, realIP string) error {
-			err := n.setupCert(realIP)
-			if err != nil {
-				return err
-			}
-
-			// If we signal Vault before it installs its sighup handler, it'll die.
-			wg.Wait()
-			n.Logger.Trace("running poststart", "containerID", containerID, "IP", realIP)
-			return n.runner.RefreshFiles(ctx, containerID)
-		},
+		Cmd:               append([]string{"server"}, opts.Args...),
+		Env:               envs,
+		Ports:             ports,
+		ContainerName:     n.Name(),
+		NetworkName:       opts.NetworkName,
+		CopyFromTo:        copyFromTo,
+		LogConsumer:       logConsumer,
+		LogStdout:         logStdout,
+		LogStderr:         logStderr,
+		PreDelete:         true,
+		DoNotAutoRemove:   true,
+		PostStart:         postStartFunc,
 		Capabilities:      []string{"NET_ADMIN"},
 		OmitLogTimestamps: true,
 		VolumeNameToMountPoint: map[string]string{
@@ -807,7 +873,7 @@ func (n *DockerClusterNode) Start(ctx context.Context, opts *DockerClusterOption
 		if err != nil {
 			return nil, err
 		}
-		config.Address = fmt.Sprintf("https://%s:%d", host, port)
+		config.Address = fmt.Sprintf("%s://%s:%d", protocol, host, port)
 		client, err := api.NewClient(config)
 		if err != nil {
 			return nil, err
@@ -838,7 +904,7 @@ func (n *DockerClusterNode) Start(ctx context.Context, opts *DockerClusterOption
 	}
 	n.ContainerNetworkName = netName
 	n.ContainerIPAddress = svc.Container.NetworkSettings.Networks[netName].IPAddress
-	n.RealAPIAddr = "https://" + n.ContainerIPAddress + ":8200"
+	n.RealAPIAddr = protocol + "://" + n.ContainerIPAddress + ":8200"
 	n.cleanupContainer = svc.Cleanup
 
 	client, err := n.newAPIClient()
@@ -869,7 +935,7 @@ func (n *DockerClusterNode) Pause(ctx context.Context) error {
 
 func (n *DockerClusterNode) Restart(ctx context.Context) error {
 	timeout := 5
-	err := n.DockerAPI.ContainerRestart(ctx, n.Container.ID, container.StopOptions{Timeout: &timeout})
+	err := n.runner.RestartContainerWithTimeout(ctx, n.Container.ID, timeout)
 	if err != nil {
 		return err
 	}
@@ -963,6 +1029,7 @@ func (n *DockerClusterNode) PartitionFromCluster(ctx context.Context) error {
 		"-xec", strings.Join([]string{
 			fmt.Sprintf("echo partitioning container from network"),
 			"apk add iproute2",
+			"apk add iptables",
 			// Get the gateway address for the bridge so we can allow host to
 			// container traffic still.
 			"GW=$(ip r | grep default | grep eth0 | cut -f 3 -d' ')",
@@ -1036,15 +1103,18 @@ func (l LogConsumerWriter) Write(p []byte) (n int, err error) {
 // DockerClusterOptions has options for setting up the docker cluster
 type DockerClusterOptions struct {
 	testcluster.ClusterOptions
-	CAKey       *ecdsa.PrivateKey
-	NetworkName string
-	ImageRepo   string
-	ImageTag    string
-	CA          *testcluster.CA
-	VaultBinary string
-	Args        []string
-	StartProbe  func(*api.Client) error
-	Storage     testcluster.ClusterStorage
+	CAKey        *ecdsa.PrivateKey
+	NetworkName  string
+	ImageRepo    string
+	ImageTag     string
+	CA           *testcluster.CA
+	VaultBinary  string
+	Args         []string
+	Envs         []string
+	StartProbe   func(*api.Client) error
+	Storage      testcluster.ClusterStorage
+	DisableTLS   bool
+	DisableMlock bool
 }
 
 func ensureLeaderMatches(ctx context.Context, client *api.Client, ready func(response *api.LeaderResponse) error) error {
@@ -1097,13 +1167,15 @@ func (dc *DockerCluster) setupDockerCluster(ctx context.Context, opts *DockerClu
 		numCores = opts.NumCores
 	}
 
-	if dc.CA == nil {
-		if err := dc.setupCA(opts); err != nil {
-			return err
+	if !opts.DisableTLS {
+		if dc.CA == nil {
+			if err := dc.setupCA(opts); err != nil {
+				return err
+			}
 		}
+		dc.RootCAs = x509.NewCertPool()
+		dc.RootCAs.AddCert(dc.CA.CACert)
 	}
-	dc.RootCAs = x509.NewCertPool()
-	dc.RootCAs.AddCert(dc.CA.CACert)
 
 	if dc.storage != nil {
 		if err := dc.storage.Start(ctx, &opts.ClusterOptions); err != nil {
@@ -1206,7 +1278,7 @@ func (dc *DockerCluster) joinNode(ctx context.Context, nodeIdx int, leaderIdx in
 
 func (dc *DockerCluster) setupImage(ctx context.Context, opts *DockerClusterOptions) (string, error) {
 	if opts == nil {
-		opts = &DockerClusterOptions{}
+		opts = &DockerClusterOptions{DisableMlock: true}
 	}
 	sourceTag := opts.ImageTag
 	if sourceTag == "" {
diff --git a/sdk/helper/testcluster/docker/environment_test.go b/sdk/helper/testcluster/docker/environment_test.go
new file mode 100644
index 00000000000..462b3e400b7
--- /dev/null
+++ b/sdk/helper/testcluster/docker/environment_test.go
@@ -0,0 +1,39 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package docker
+
+import (
+	"testing"
+)
+
+func TestSettingEnvsToContainer(t *testing.T) {
+	expectedEnv := "TEST_ENV=value1"
+	expectedEnv2 := "TEST_ENV2=value2"
+	opts := &DockerClusterOptions{
+		ImageRepo:    "hashicorp/vault",
+		ImageTag:     "latest",
+		Envs:         []string{expectedEnv, expectedEnv2},
+		DisableMlock: true,
+	}
+	cluster := NewTestDockerCluster(t, opts)
+	defer cluster.Cleanup()
+
+	envs := cluster.GetActiveClusterNode().Container.Config.Env
+
+	if !findEnv(envs, expectedEnv) {
+		t.Errorf("Missing ENV variable: %s", expectedEnv)
+	}
+	if !findEnv(envs, expectedEnv2) {
+		t.Errorf("Missing ENV variable: %s", expectedEnv2)
+	}
+}
+
+func findEnv(envs []string, env string) bool {
+	for _, e := range envs {
+		if e == env {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdk/helper/testcluster/docker/replication.go b/sdk/helper/testcluster/docker/replication.go
index c313e7af4d8..ddb558b556c 100644
--- a/sdk/helper/testcluster/docker/replication.go
+++ b/sdk/helper/testcluster/docker/replication.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package docker
@@ -27,6 +27,7 @@ func DefaultOptions(t *testing.T) *DockerClusterOptions {
 				LogLevel: "TRACE",
 			},
 		},
+		DisableMlock: true,
 	}
 }
 
diff --git a/sdk/helper/testcluster/exec.go b/sdk/helper/testcluster/exec.go
index d91a3de034a..32ff0924674 100644
--- a/sdk/helper/testcluster/exec.go
+++ b/sdk/helper/testcluster/exec.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package testcluster
@@ -53,7 +53,7 @@ type ExecDevClusterOptions struct {
 	BaseListenAddress string
 }
 
-func NewTestExecDevCluster(t *testing.T, opts *ExecDevClusterOptions) *ExecDevCluster {
+func NewTestExecDevServer(t *testing.T, opts *ExecDevClusterOptions) *ExecDevCluster {
 	if opts == nil {
 		opts = &ExecDevClusterOptions{}
 	}
@@ -141,12 +141,10 @@ func (dc *ExecDevCluster) setupExecDevCluster(ctx context.Context, opts *ExecDev
 	clusterJsonPath := filepath.Join(dc.tmpDir, "cluster.json")
 	args := []string{"server", "-dev", "-dev-cluster-json", clusterJsonPath}
 	switch {
-	case opts.NumCores == 3:
-		args = append(args, "-dev-three-node")
 	case opts.NumCores == 1:
 		args = append(args, "-dev-tls")
 	default:
-		return fmt.Errorf("NumCores=1 and NumCores=3 are the only supported options right now")
+		return fmt.Errorf("NumCores=1 is the only supported option right now")
 	}
 	if opts.BaseListenAddress != "" {
 		args = append(args, "-dev-listen-address", opts.BaseListenAddress)
@@ -223,6 +221,7 @@ func (dc *ExecDevCluster) setupExecDevCluster(ctx context.Context, opts *ExecDev
 		}
 		time.Sleep(500 * time.Millisecond)
 	}
+
 	return ctx.Err()
 }
 
diff --git a/sdk/helper/testcluster/generaterootkind_enumer.go b/sdk/helper/testcluster/generaterootkind_enumer.go
new file mode 100644
index 00000000000..367c1a5df40
--- /dev/null
+++ b/sdk/helper/testcluster/generaterootkind_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=GenerateRootKind -trimprefix=GenerateRoot"; DO NOT EDIT.
+
+package testcluster
+
+import (
+	"fmt"
+)
+
+const _GenerateRootKindName = "RegularDRGenerateRecovery"
+
+var _GenerateRootKindIndex = [...]uint8{0, 7, 9, 25}
+
+func (i GenerateRootKind) String() string {
+	if i < 0 || i >= GenerateRootKind(len(_GenerateRootKindIndex)-1) {
+		return fmt.Sprintf("GenerateRootKind(%d)", i)
+	}
+	return _GenerateRootKindName[_GenerateRootKindIndex[i]:_GenerateRootKindIndex[i+1]]
+}
+
+var _GenerateRootKindValues = []GenerateRootKind{0, 1, 2}
+
+var _GenerateRootKindNameToValueMap = map[string]GenerateRootKind{
+	_GenerateRootKindName[0:7]:  0,
+	_GenerateRootKindName[7:9]:  1,
+	_GenerateRootKindName[9:25]: 2,
+}
+
+// GenerateRootKindString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func GenerateRootKindString(s string) (GenerateRootKind, error) {
+	if val, ok := _GenerateRootKindNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to GenerateRootKind values", s)
+}
+
+// GenerateRootKindValues returns all values of the enum
+func GenerateRootKindValues() []GenerateRootKind {
+	return _GenerateRootKindValues
+}
+
+// IsAGenerateRootKind returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i GenerateRootKind) IsAGenerateRootKind() bool {
+	for _, v := range _GenerateRootKindValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdk/helper/testcluster/logging.go b/sdk/helper/testcluster/logging.go
index dda759c7f84..c11ae252cc0 100644
--- a/sdk/helper/testcluster/logging.go
+++ b/sdk/helper/testcluster/logging.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package testcluster
@@ -17,6 +17,18 @@ func JSONLogNoTimestamp(outlog hclog.Logger, text string) {
 		outlog.Error("failed to decode json output from dev vault", "error", err, "input", text)
 		return
 	}
+	JSONLogNoTimestampFromMap(outlog, "", m)
+}
+
+func JSONLogNoTimestampFromMap(outlog hclog.Logger, min string, m map[string]any) string {
+	timeStamp := ""
+	if ts, ok := m["@timestamp"]; ok {
+		timeStamp = ts.(string)
+		// This works because the time format is ISO8601.
+		if timeStamp < min {
+			return min
+		}
+	}
 
 	delete(m, "@timestamp")
 	message := m["@message"].(string)
@@ -34,4 +46,5 @@ func JSONLogNoTimestamp(outlog hclog.Logger, text string) {
 	}
 
 	outlog.Log(hclog.LevelFromString(level), message, pairs...)
+	return timeStamp
 }
diff --git a/sdk/helper/testcluster/replication.go b/sdk/helper/testcluster/replication.go
index 1ab4485c50f..dc0214a54b2 100644
--- a/sdk/helper/testcluster/replication.go
+++ b/sdk/helper/testcluster/replication.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package testcluster
diff --git a/sdk/helper/testcluster/types.go b/sdk/helper/testcluster/types.go
index 03013d89e3e..3031fe28364 100644
--- a/sdk/helper/testcluster/types.go
+++ b/sdk/helper/testcluster/types.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package testcluster
@@ -41,8 +41,8 @@ type VaultNodeConfig struct {
 	//   ClusterAddr          string      `hcl:"cluster_addr"`
 	//   Storage   *Storage `hcl:"-"`
 	//   HAStorage *Storage `hcl:"-"`
-	//   DisableMlock bool `hcl:"disable_mlock"`
 	//   ClusterName string `hcl:"cluster_name"`
+	// 	 DisableMlock bool  `hcl:"disable_mlock"`
 
 	// Not configurable yet:
 	//   Listeners []*Listener `hcl:"-"`
@@ -105,8 +105,11 @@ type ClusterOptions struct {
 }
 
 type VaultNodeListenerConfig struct {
-	Port            int
-	ChrootNamespace string
+	Port              int
+	ChrootNamespace   string
+	RedactAddresses   bool
+	RedactClusterName bool
+	RedactVersion     bool
 }
 
 type CA struct {
diff --git a/sdk/helper/testcluster/util.go b/sdk/helper/testcluster/util.go
index 1f261057fa7..83d3cb739c8 100644
--- a/sdk/helper/testcluster/util.go
+++ b/sdk/helper/testcluster/util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package testcluster
@@ -8,6 +8,7 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"fmt"
+	"slices"
 	"sync/atomic"
 	"time"
 
@@ -35,12 +36,40 @@ func SealNode(ctx context.Context, cluster VaultCluster, nodeIdx int) error {
 }
 
 func SealAllNodes(ctx context.Context, cluster VaultCluster) error {
-	for i := range cluster.Nodes() {
-		if err := SealNode(ctx, cluster, i); err != nil {
-			return err
+	sealedNodes := make([]bool, len(cluster.Nodes()))
+
+	// Iteratively seal the leader until all nodes are sealed. This is to handle
+	// the case where standbys do not accept seal requests.
+	// We put an arbitrary limit on the number of iterations to avoid infinite
+	// loops in case something goes wrong.
+	var errors error
+	for range len(cluster.Nodes()) * 3 {
+		leaderIdx, err := LeaderNode(ctx, cluster)
+		if err != nil {
+			errors = multierror.Append(errors, err)
+			time.Sleep(500 * time.Millisecond)
+			continue
+		}
+		if err = SealNode(ctx, cluster, leaderIdx); err != nil {
+			errors = multierror.Append(errors, err)
+			time.Sleep(500 * time.Millisecond)
+			continue
+		}
+		sealedNodes[leaderIdx] = true
+
+		if !slices.Contains(sealedNodes, false) {
+			return nil
 		}
 	}
-	return nil
+
+	// If we get here, something is wrong
+	var unsealedNodes []int
+	for i, isSealed := range sealedNodes {
+		if !isSealed {
+			unsealedNodes = append(unsealedNodes, i)
+		}
+	}
+	return fmt.Errorf("not all nodes sealed, unsealed nodes remaining: %v: %w", unsealedNodes, errors)
 }
 
 func UnsealNode(ctx context.Context, cluster VaultCluster, nodeIdx int) error {
@@ -394,6 +423,7 @@ func Clients(vc VaultCluster) []*api.Client {
 	return ret
 }
 
+//go:generate enumer -type=GenerateRootKind -trimprefix=GenerateRoot
 type GenerateRootKind int
 
 const (
diff --git a/sdk/helper/testhelpers/namespaces/namespaces.go b/sdk/helper/testhelpers/namespaces/namespaces.go
index 9981104f2b5..04c23c99827 100644
--- a/sdk/helper/testhelpers/namespaces/namespaces.go
+++ b/sdk/helper/testhelpers/namespaces/namespaces.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package namespaces
diff --git a/sdk/helper/testhelpers/output.go b/sdk/helper/testhelpers/output.go
index c18b1bb6deb..47c3402441e 100644
--- a/sdk/helper/testhelpers/output.go
+++ b/sdk/helper/testhelpers/output.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package testhelpers
@@ -7,8 +7,8 @@ import (
 	"crypto/sha256"
 	"fmt"
 	"reflect"
+	"testing"
 
-	"github.com/mitchellh/go-testing-interface"
 	"github.com/mitchellh/mapstructure"
 )
 
@@ -74,7 +74,7 @@ func ToString(in any) string {
 
 // StringOrDie renders its input using ToMap, and returns a string containing the
 // result.  If rendering yields an error, calls t.Fatal.
-func StringOrDie(t testing.T, in any) string {
+func StringOrDie(t testing.TB, in any) string {
 	t.Helper()
 	m, err := ToMap(in)
 	if err != nil {
diff --git a/sdk/helper/testhelpers/output_test.go b/sdk/helper/testhelpers/output_test.go
index ada51a1fe11..cb4fabc1dc6 100644
--- a/sdk/helper/testhelpers/output_test.go
+++ b/sdk/helper/testhelpers/output_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package testhelpers
diff --git a/sdk/helper/testhelpers/schema/response_validation.go b/sdk/helper/testhelpers/schema/response_validation.go
index 8085b042b6d..a94790be721 100644
--- a/sdk/helper/testhelpers/schema/response_validation.go
+++ b/sdk/helper/testhelpers/schema/response_validation.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package schema
diff --git a/sdk/helper/testhelpers/schema/response_validation_test.go b/sdk/helper/testhelpers/schema/response_validation_test.go
index 4f4aa8b1cc3..7d6bcad7d23 100644
--- a/sdk/helper/testhelpers/schema/response_validation_test.go
+++ b/sdk/helper/testhelpers/schema/response_validation_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package schema
diff --git a/sdk/helper/testhelpers/snapshots/testcase.go b/sdk/helper/testhelpers/snapshots/testcase.go
new file mode 100644
index 00000000000..9170acff9de
--- /dev/null
+++ b/sdk/helper/testhelpers/snapshots/testcase.go
@@ -0,0 +1,190 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package snapshots
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+)
+
+type SnapshotTestCase struct {
+	backend         logical.Backend
+	regularStorage  logical.Storage
+	snapshotStorage logical.Storage
+	storageRouter   logical.Storage
+}
+
+type storageProvider struct {
+	storage logical.Storage
+}
+
+func (s *storageProvider) SnapshotStorage(ctx context.Context, id string) (logical.Storage, error) {
+	return s.storage, nil
+}
+
+var _ logical.SnapshotStorageProvider = (*storageProvider)(nil)
+
+// NewSnapshotTestCase is used to create a snapshot test case for a particular
+// backend. The test case is used to ensure that the backend behaves correctly
+// when it receives snapshot operations, without having to do the end-to-end
+// setup of creating a raft cluster, taking a snapshot, and loading it.
+func NewSnapshotTestCase(t testing.TB, backend logical.Backend) *SnapshotTestCase {
+	return NewSnapshotTestCaseWithStorages(t, backend, &logical.InmemStorage{}, &logical.InmemStorage{})
+}
+
+// NewSnapshotTestCaseWithStorages is used to create a snapshot test case for a
+// particular backend, using the provided storage instances. The test case is
+// used to ensure that the backend behaves correctly when it receives snapshot
+// operations, without having to do the end-to-end setup of creating a raft
+// cluster, taking a snapshot, and loading it.
+func NewSnapshotTestCaseWithStorages(t testing.TB, backend logical.Backend, regularStorage, snapshotStorage logical.Storage) *SnapshotTestCase {
+	s := &SnapshotTestCase{
+		backend:         backend,
+		regularStorage:  regularStorage,
+		snapshotStorage: snapshotStorage,
+	}
+
+	s.storageRouter = logical.NewSnapshotStorageRouter(s.regularStorage, &storageProvider{s.snapshotStorage})
+	return s
+}
+
+func (s *SnapshotTestCase) SnapshotStorage() logical.Storage {
+	return s.snapshotStorage
+}
+
+func (s *SnapshotTestCase) RegularStorage() logical.Storage {
+	return s.regularStorage
+}
+
+func (s *SnapshotTestCase) runCase(t testing.TB, path string, op logical.Operation, additionalOpts ...Option) {
+	opts := options{}
+	for _, opt := range additionalOpts {
+		opt(&opts)
+	}
+	ctx := context.Background()
+	req1 := &logical.Request{
+		Path:      path,
+		Operation: op,
+		Storage:   s.storageRouter,
+	}
+	if opts.modifyRequests != nil {
+		opts.modifyRequests(req1)
+	}
+	normalResp, err := s.backend.HandleRequest(ctx, req1)
+	require.NoError(t, err)
+
+	req2 := &logical.Request{
+		Path:               path,
+		Operation:          op,
+		Storage:            s.storageRouter,
+		RequiresSnapshotID: "snapshot_id",
+	}
+	if opts.modifyRequests != nil {
+		opts.modifyRequests(req2)
+	}
+	_, err = s.backend.HandleRequest(logical.CreateContextWithSnapshotID(ctx, "snapshot_id"), req2)
+	require.NoError(t, err)
+
+	req3 := &logical.Request{
+		Path:      path,
+		Operation: op,
+		Storage:   s.storageRouter,
+	}
+	if opts.modifyRequests != nil {
+		opts.modifyRequests(req3)
+	}
+	normalResp2, err := s.backend.HandleRequest(ctx, req3)
+	require.NoError(t, err)
+	if normalResp == nil || normalResp2 == nil {
+		require.Equal(t, normalResp, normalResp2)
+	} else {
+		require.Equal(t, normalResp.Data, normalResp2.Data)
+	}
+}
+
+// RunList runs a list operation without a snapshot, a list operation from a
+// snapshot, and then another list operation without a snapshot. The test
+// verifies that the list operation from the snapshot does not cause the results
+// to change
+func (s *SnapshotTestCase) RunList(t testing.TB, path string, additionalOpts ...Option) {
+	s.runCase(t, path, logical.ListOperation, additionalOpts...)
+}
+
+// RunRead runs a read operation without a snapshot, a read operation from a
+// snapshot, and then another read operation without a snapshot. The test
+// verifies that the read operation from the snapshot does not cause the results
+// to change
+func (s *SnapshotTestCase) RunRead(t testing.TB, path string, additionalOpts ...Option) {
+	s.runCase(t, path, logical.ReadOperation, additionalOpts...)
+}
+
+// DoRecover performs a read operation from a snapshot, and then a recover. The
+// test returns the results of the recover operation
+func (s *SnapshotTestCase) DoRecover(t testing.TB, path string, additionalOpts ...Option) (*logical.Response, error) {
+	opts := options{}
+	for _, opt := range additionalOpts {
+		opt(&opts)
+	}
+
+	ctx := context.Background()
+	readPath := path
+	if opts.recoverSourcePath != "" {
+		readPath = opts.recoverSourcePath
+	}
+	readReq := &logical.Request{
+		Path:               readPath,
+		Operation:          logical.ReadOperation,
+		Storage:            s.storageRouter,
+		RequiresSnapshotID: "snapshot_id",
+	}
+	if opts.modifyRequests != nil {
+		opts.modifyRequests(readReq)
+	}
+	readResp, err := s.backend.HandleRequest(logical.CreateContextWithSnapshotID(ctx, "snapshot_id"), readReq)
+	require.NoError(t, err)
+	require.NotNil(t, readResp)
+
+	recoverSourcePath := ""
+	if opts.recoverSourcePath != "" {
+		recoverSourcePath = opts.recoverSourcePath
+	}
+	recoverReq := &logical.Request{
+		Path:               path,
+		Operation:          logical.RecoverOperation,
+		Storage:            s.storageRouter,
+		Data:               readResp.Data,
+		RequiresSnapshotID: "snapshot_id",
+		RecoverSourcePath:  recoverSourcePath,
+	}
+	if opts.modifyRequests != nil {
+		opts.modifyRequests(recoverReq)
+	}
+	return s.backend.HandleRequest(ctx, recoverReq)
+}
+
+type options struct {
+	modifyRequests    func(req *logical.Request)
+	recoverSourcePath string
+}
+type Option func(o *options)
+
+// WithModifyRequests allows you to modify the request before it is sent to the
+// backend. This is useful for setting the client token or other request
+// data
+func WithModifyRequests(modify func(req *logical.Request)) Option {
+	return func(o *options) {
+		o.modifyRequests = modify
+	}
+}
+
+// WithRecoverSourcePath allows you to specify a different path to read from when
+// performing a recover operation.
+func WithRecoverSourcePath(recoverSourcePath string) Option {
+	return func(o *options) {
+		o.recoverSourcePath = recoverSourcePath
+	}
+}
diff --git a/sdk/helper/tlsutil/tlsutil.go b/sdk/helper/tlsutil/tlsutil.go
index d91af3679e2..d841b4614aa 100644
--- a/sdk/helper/tlsutil/tlsutil.go
+++ b/sdk/helper/tlsutil/tlsutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // DEPRECATED: this has been moved to go-secure-stdlib and will be removed
diff --git a/sdk/helper/tokenutil/tokenutil.go b/sdk/helper/tokenutil/tokenutil.go
index 4319bd18236..87299e57ce5 100644
--- a/sdk/helper/tokenutil/tokenutil.go
+++ b/sdk/helper/tokenutil/tokenutil.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package tokenutil
@@ -47,6 +47,9 @@ type TokenParams struct {
 
 	// The TTL to user for the token
 	TokenTTL time.Duration `json:"token_ttl" mapstructure:"token_ttl"`
+
+	// The metadata to attach to the alias.
+	AliasMetadata map[string]string `json:"alias_metadata" mapstructure:"alias_metadata"`
 }
 
 // AddTokenFields adds fields to an existing role. It panics if it would
@@ -73,7 +76,7 @@ func AddTokenFieldsWithAllowList(m map[string]*framework.FieldSchema, allowed []
 
 // TokenFields provides a set of field schemas for the parameters
 func TokenFields() map[string]*framework.FieldSchema {
-	return map[string]*framework.FieldSchema{
+	return entTokenFields(map[string]*framework.FieldSchema{
 		"token_bound_cidrs": {
 			Type:        framework.TypeCommaStringSlice,
 			Description: `Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.`,
@@ -157,7 +160,7 @@ func TokenFields() map[string]*framework.FieldSchema {
 				Group: "Tokens",
 			},
 		},
-	}
+	})
 }
 
 // ParseTokenFields provides common field parsing functionality into a TokenFields struct
@@ -238,6 +241,8 @@ func (t *TokenParams) ParseTokenFields(req *logical.Request, d *framework.FieldD
 		return errors.New("'token_ttl' cannot be greater than 'token_max_ttl'")
 	}
 
+	t.entParseTokenFields(d)
+
 	return nil
 }
 
@@ -260,6 +265,8 @@ func (t *TokenParams) PopulateTokenData(m map[string]interface{}) {
 	if len(t.TokenBoundCIDRs) == 0 {
 		m["token_bound_cidrs"] = []string{}
 	}
+
+	t.entPopulateTokenData(m)
 }
 
 // PopulateTokenAuth populates Auth with parameters
@@ -274,6 +281,8 @@ func (t *TokenParams) PopulateTokenAuth(auth *logical.Auth) {
 	auth.TokenType = t.TokenType
 	auth.TTL = t.TokenTTL
 	auth.NumUses = t.TokenNumUses
+
+	t.entPopulateTokenAuth(auth)
 }
 
 func DeprecationText(param string) string {
diff --git a/sdk/helper/tokenutil/tokenutil_stubs_oss.go b/sdk/helper/tokenutil/tokenutil_stubs_oss.go
new file mode 100644
index 00000000000..55ca1714a59
--- /dev/null
+++ b/sdk/helper/tokenutil/tokenutil_stubs_oss.go
@@ -0,0 +1,21 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package tokenutil
+
+import (
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+func entTokenFields(fields map[string]*framework.FieldSchema) map[string]*framework.FieldSchema {
+	return fields
+}
+
+func (t *TokenParams) entParseTokenFields(d *framework.FieldData) {}
+
+func (t *TokenParams) entPopulateTokenData(m map[string]any) {}
+
+func (t *TokenParams) entPopulateTokenAuth(auth *logical.Auth) {}
diff --git a/sdk/helper/useragent/useragent.go b/sdk/helper/useragent/useragent.go
index 53569e910a8..488ed0e4217 100644
--- a/sdk/helper/useragent/useragent.go
+++ b/sdk/helper/useragent/useragent.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package useragent
diff --git a/sdk/helper/useragent/useragent_test.go b/sdk/helper/useragent/useragent_test.go
index 4677bb62fac..bff40c66a7e 100644
--- a/sdk/helper/useragent/useragent_test.go
+++ b/sdk/helper/useragent/useragent_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package useragent
diff --git a/sdk/helper/wrapping/wrapinfo.go b/sdk/helper/wrapping/wrapinfo.go
index 03a70301300..ddba531d9b7 100644
--- a/sdk/helper/wrapping/wrapinfo.go
+++ b/sdk/helper/wrapping/wrapinfo.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package wrapping
diff --git a/sdk/helper/xor/xor.go b/sdk/helper/xor/xor.go
index 098a6731785..e478caa3f96 100644
--- a/sdk/helper/xor/xor.go
+++ b/sdk/helper/xor/xor.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package xor
diff --git a/sdk/helper/xor/xor_test.go b/sdk/helper/xor/xor_test.go
index 143345d9a5b..1ea46ce154c 100644
--- a/sdk/helper/xor/xor_test.go
+++ b/sdk/helper/xor/xor_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package xor
diff --git a/sdk/logical/acme_billing.go b/sdk/logical/acme_billing.go
index 6e4f6ef398b..68e323bd16d 100644
--- a/sdk/logical/acme_billing.go
+++ b/sdk/logical/acme_billing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/audit.go b/sdk/logical/audit.go
index ecd1f5865a4..3e176cadf98 100644
--- a/sdk/logical/audit.go
+++ b/sdk/logical/audit.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/audit_test.go b/sdk/logical/audit_test.go
index 07623daab9e..bf0c86f47ff 100644
--- a/sdk/logical/audit_test.go
+++ b/sdk/logical/audit_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/auth.go b/sdk/logical/auth.go
index 83d9daca12a..86a225b575a 100644
--- a/sdk/logical/auth.go
+++ b/sdk/logical/auth.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -114,6 +114,10 @@ type Auth struct {
 
 	// EntityCreated is set to true if an entity is created as part of a login request
 	EntityCreated bool `json:"entity_created"`
+
+	// HTTPRequestPriority contains potential information about the request
+	// priority based on required path capabilities
+	HTTPRequestPriority *uint8 `json:"http_request_priority"`
 }
 
 func (a *Auth) GoString() string {
diff --git a/sdk/logical/clienttokensource_enumer.go b/sdk/logical/clienttokensource_enumer.go
new file mode 100644
index 00000000000..e930a3a0ddd
--- /dev/null
+++ b/sdk/logical/clienttokensource_enumer.go
@@ -0,0 +1,51 @@
+// Code generated by "enumer -type=ClientTokenSource -trimprefix=ClientTokenFrom -transform=snake"; DO NOT EDIT.
+
+package logical
+
+import (
+	"fmt"
+)
+
+const _ClientTokenSourceName = "no_client_tokenvault_headerauthz_headerinternal_auth"
+
+var _ClientTokenSourceIndex = [...]uint8{0, 15, 27, 39, 52}
+
+func (i ClientTokenSource) String() string {
+	if i >= ClientTokenSource(len(_ClientTokenSourceIndex)-1) {
+		return fmt.Sprintf("ClientTokenSource(%d)", i)
+	}
+	return _ClientTokenSourceName[_ClientTokenSourceIndex[i]:_ClientTokenSourceIndex[i+1]]
+}
+
+var _ClientTokenSourceValues = []ClientTokenSource{0, 1, 2, 3}
+
+var _ClientTokenSourceNameToValueMap = map[string]ClientTokenSource{
+	_ClientTokenSourceName[0:15]:  0,
+	_ClientTokenSourceName[15:27]: 1,
+	_ClientTokenSourceName[27:39]: 2,
+	_ClientTokenSourceName[39:52]: 3,
+}
+
+// ClientTokenSourceString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func ClientTokenSourceString(s string) (ClientTokenSource, error) {
+	if val, ok := _ClientTokenSourceNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to ClientTokenSource values", s)
+}
+
+// ClientTokenSourceValues returns all values of the enum
+func ClientTokenSourceValues() []ClientTokenSource {
+	return _ClientTokenSourceValues
+}
+
+// IsAClientTokenSource returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i ClientTokenSource) IsAClientTokenSource() bool {
+	for _, v := range _ClientTokenSourceValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdk/logical/connection.go b/sdk/logical/connection.go
index e590e6f59ac..a0e979c4b5d 100644
--- a/sdk/logical/connection.go
+++ b/sdk/logical/connection.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/controlgroup.go b/sdk/logical/controlgroup.go
index e166f00d1f8..db6a15f1fc7 100644
--- a/sdk/logical/controlgroup.go
+++ b/sdk/logical/controlgroup.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/error.go b/sdk/logical/error.go
index 18b89b255c8..d18090f1f6c 100644
--- a/sdk/logical/error.go
+++ b/sdk/logical/error.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -23,12 +23,15 @@ var (
 	// ErrPermissionDenied is returned if the client is not authorized
 	ErrPermissionDenied = errors.New("permission denied")
 
+	// ErrInvalidToken is returned if the token is revoked, expired, or non-existent
+	ErrInvalidToken = errors.New("invalid token")
+
 	// ErrInvalidCredentials is returned when the provided credentials are incorrect
 	// This is used internally for user lockout purposes. This is not seen externally.
 	// The status code returned does not change because of this error
 	ErrInvalidCredentials = errors.New("invalid credentials")
 
-	// ErrMultiAuthzPending is returned if the the request needs more
+	// ErrMultiAuthzPending is returned if the request needs more
 	// authorizations
 	ErrMultiAuthzPending = errors.New("request needs further approval")
 
diff --git a/sdk/logical/event.pb.go b/sdk/logical/event.pb.go
index a011cd894c1..5bdcd1d84fb 100644
--- a/sdk/logical/event.pb.go
+++ b/sdk/logical/event.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: sdk/logical/event.proto
 
@@ -15,6 +15,7 @@ import (
 	structpb "google.golang.org/protobuf/types/known/structpb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -26,10 +27,7 @@ const (
 
 // EventPluginInfo contains data related to the plugin that generated an event.
 type EventPluginInfo struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// The type of plugin this event originated from, i.e., "auth" or "secrets.
 	MountClass string `protobuf:"bytes,1,opt,name=mount_class,json=mountClass,proto3" json:"mount_class,omitempty"`
 	// Unique ID of the mount entry, e.g., "kv_957bb7d8"
@@ -41,16 +39,16 @@ type EventPluginInfo struct {
 	// Plugin version of the plugin this event originated from, e.g., "v0.13.3+builtin"
 	PluginVersion string `protobuf:"bytes,5,opt,name=plugin_version,json=pluginVersion,proto3" json:"plugin_version,omitempty"`
 	// Mount version that this event originated from, i.e., if KVv2, then "2". Usually empty.
-	Version string `protobuf:"bytes,6,opt,name=version,proto3" json:"version,omitempty"`
+	Version       string `protobuf:"bytes,6,opt,name=version,proto3" json:"version,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *EventPluginInfo) Reset() {
 	*x = EventPluginInfo{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_event_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_event_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EventPluginInfo) String() string {
@@ -61,7 +59,7 @@ func (*EventPluginInfo) ProtoMessage() {}
 
 func (x *EventPluginInfo) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_event_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -120,10 +118,7 @@ func (x *EventPluginInfo) GetVersion() string {
 
 // EventData contains event data in a CloudEvents container.
 type EventData struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// ID identifies the event. It is required. The combination of
 	// CloudEvents Source (i.e., Vault cluster) + ID must be unique.
 	// Events with the same Source + ID can be assumed to be duplicates
@@ -137,16 +132,16 @@ type EventData struct {
 	// Any IDs that the event relates to, i.e., UUIDs, paths.
 	EntityIds []string `protobuf:"bytes,3,rep,name=entity_ids,json=entityIds,proto3" json:"entity_ids,omitempty"`
 	// Human-readable note.
-	Note string `protobuf:"bytes,4,opt,name=note,proto3" json:"note,omitempty"`
+	Note          string `protobuf:"bytes,4,opt,name=note,proto3" json:"note,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *EventData) Reset() {
 	*x = EventData{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_event_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_event_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EventData) String() string {
@@ -157,7 +152,7 @@ func (*EventData) ProtoMessage() {}
 
 func (x *EventData) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_event_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -203,24 +198,21 @@ func (x *EventData) GetNote() string {
 // EventReceived is used to consume events and includes additional metadata regarding
 // the event type and plugin information.
 type EventReceived struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Event *EventData `protobuf:"bytes,1,opt,name=event,proto3" json:"event,omitempty"`
+	state protoimpl.MessageState `protogen:"open.v1"`
+	Event *EventData             `protobuf:"bytes,1,opt,name=event,proto3" json:"event,omitempty"`
 	// namespace path
-	Namespace  string           `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
-	EventType  string           `protobuf:"bytes,3,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
-	PluginInfo *EventPluginInfo `protobuf:"bytes,4,opt,name=plugin_info,json=pluginInfo,proto3" json:"plugin_info,omitempty"`
+	Namespace     string           `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	EventType     string           `protobuf:"bytes,3,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
+	PluginInfo    *EventPluginInfo `protobuf:"bytes,4,opt,name=plugin_info,json=pluginInfo,proto3" json:"plugin_info,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *EventReceived) Reset() {
 	*x = EventReceived{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_event_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_event_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EventReceived) String() string {
@@ -231,7 +223,7 @@ func (*EventReceived) ProtoMessage() {}
 
 func (x *EventReceived) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_event_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -276,7 +268,7 @@ func (x *EventReceived) GetPluginInfo() *EventPluginInfo {
 
 var File_sdk_logical_event_proto protoreflect.FileDescriptor
 
-var file_sdk_logical_event_proto_rawDesc = []byte{
+var file_sdk_logical_event_proto_rawDesc = string([]byte{
 	0x0a, 0x17, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2f, 0x65, 0x76,
 	0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x6c, 0x6f, 0x67, 0x69, 0x63,
 	0x61, 0x6c, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
@@ -317,22 +309,22 @@ var file_sdk_logical_event_proto_rawDesc = []byte{
 	0x5a, 0x26, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
 	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b,
 	0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_sdk_logical_event_proto_rawDescOnce sync.Once
-	file_sdk_logical_event_proto_rawDescData = file_sdk_logical_event_proto_rawDesc
+	file_sdk_logical_event_proto_rawDescData []byte
 )
 
 func file_sdk_logical_event_proto_rawDescGZIP() []byte {
 	file_sdk_logical_event_proto_rawDescOnce.Do(func() {
-		file_sdk_logical_event_proto_rawDescData = protoimpl.X.CompressGZIP(file_sdk_logical_event_proto_rawDescData)
+		file_sdk_logical_event_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sdk_logical_event_proto_rawDesc), len(file_sdk_logical_event_proto_rawDesc)))
 	})
 	return file_sdk_logical_event_proto_rawDescData
 }
 
 var file_sdk_logical_event_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
-var file_sdk_logical_event_proto_goTypes = []interface{}{
+var file_sdk_logical_event_proto_goTypes = []any{
 	(*EventPluginInfo)(nil), // 0: logical.EventPluginInfo
 	(*EventData)(nil),       // 1: logical.EventData
 	(*EventReceived)(nil),   // 2: logical.EventReceived
@@ -354,49 +346,11 @@ func file_sdk_logical_event_proto_init() {
 	if File_sdk_logical_event_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_sdk_logical_event_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EventPluginInfo); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_logical_event_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EventData); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_logical_event_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EventReceived); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_sdk_logical_event_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_logical_event_proto_rawDesc), len(file_sdk_logical_event_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   3,
 			NumExtensions: 0,
@@ -407,7 +361,6 @@ func file_sdk_logical_event_proto_init() {
 		MessageInfos:      file_sdk_logical_event_proto_msgTypes,
 	}.Build()
 	File_sdk_logical_event_proto = out.File
-	file_sdk_logical_event_proto_rawDesc = nil
 	file_sdk_logical_event_proto_goTypes = nil
 	file_sdk_logical_event_proto_depIdxs = nil
 }
diff --git a/sdk/logical/event.proto b/sdk/logical/event.proto
index 8892412f5f5..0a18a6720bf 100644
--- a/sdk/logical/event.proto
+++ b/sdk/logical/event.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 syntax = "proto3";
diff --git a/sdk/logical/events.go b/sdk/logical/events.go
index 5bd9717f7ff..9a62c4b2c80 100644
--- a/sdk/logical/events.go
+++ b/sdk/logical/events.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -12,10 +12,17 @@ import (
 
 // common event metadata keys
 const (
-	// EventMetadataDataPath is used in event metadata to show the API path that can be used to fetch any underlying
-	// data. For example, the KV plugin would set this to `data/mysecret`. The event system will automatically prepend
-	// the plugin mount to this path, if present, so it would become `secret/data/mysecret`, for example.
+	// EventMetadataPath is used in event metadata to show the API path the client must have the `subscribe` capability
+	// on in order to consume the event. It is recommended that the event path metadata field is the API path that was
+	// invoked in order to generate the event.
+	//
+	// For example, the KV plugin would set this to `data/mysecret`. The event system will automatically prepend the
+	// plugin mount to this path, if present, so it would become `secret/data/mysecret`, for example.
 	// If this is an auth plugin event, this will additionally be prepended with `auth/`.
+	EventMetadataPath = "path"
+	// EventMetadataDataPath is used in event metadata to show the API path that can be used to fetch any underlying
+	// data. Similar to the `path` event metadata, the event system will automatically prepend the plugin mount to the
+	// `data_path`.
 	EventMetadataDataPath = "data_path"
 	// EventMetadataOperation is used in event metadata to express what operation was performed that generated the
 	// event, e.g., `read` or `write`.
diff --git a/sdk/logical/events_mock.go b/sdk/logical/events_mock.go
index 72741163e98..1a0876155c7 100644
--- a/sdk/logical/events_mock.go
+++ b/sdk/logical/events_mock.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/events_test.go b/sdk/logical/events_test.go
index a018b0d312a..0318acb72cf 100644
--- a/sdk/logical/events_test.go
+++ b/sdk/logical/events_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/identity.pb.go b/sdk/logical/identity.pb.go
index c00bfc9c93e..8968db90f3d 100644
--- a/sdk/logical/identity.pb.go
+++ b/sdk/logical/identity.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: sdk/logical/identity.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -24,10 +25,7 @@ const (
 )
 
 type Entity struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// ID is the unique identifier for the entity
 	ID string `protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
 	// Name is the human-friendly unique identifier for the entity
@@ -35,21 +33,21 @@ type Entity struct {
 	// Aliases contains thhe alias mappings for the given entity
 	Aliases []*Alias `protobuf:"bytes,3,rep,name=aliases,proto3" json:"aliases,omitempty"`
 	// Metadata represents the custom data tied to this entity
-	Metadata map[string]string `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Metadata map[string]string `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// Disabled is true if the entity is disabled.
 	Disabled bool `protobuf:"varint,5,opt,name=disabled,proto3" json:"disabled,omitempty"`
 	// NamespaceID is the identifier of the namespace to which this entity
 	// belongs to.
-	NamespaceID string `protobuf:"bytes,6,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	NamespaceID   string `protobuf:"bytes,6,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Entity) Reset() {
 	*x = Entity{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_identity_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_identity_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Entity) String() string {
@@ -60,7 +58,7 @@ func (*Entity) ProtoMessage() {}
 
 func (x *Entity) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_identity_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -118,10 +116,7 @@ func (x *Entity) GetNamespaceID() string {
 }
 
 type Alias struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// MountType is the backend mount's type to which this identity belongs
 	MountType string `protobuf:"bytes,1,opt,name=mount_type,json=mountType,proto3" json:"mount_type,omitempty"`
 	// MountAccessor is the identifier of the mount entry to which this
@@ -135,27 +130,27 @@ type Alias struct {
 	// a significant performance impact at scale. See the SDK's
 	// "aliasmetadata" package for a helper that eases and standardizes
 	// using this safely.
-	Metadata map[string]string `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Metadata map[string]string `protobuf:"bytes,4,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// ID is the unique identifier for the alias
 	ID string `protobuf:"bytes,5,opt,name=ID,proto3" json:"ID,omitempty"`
 	// NamespaceID is the identifier of the namespace to which this alias
 	// belongs.
 	NamespaceID string `protobuf:"bytes,6,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
 	// Custom Metadata represents the custom data tied to this alias
-	CustomMetadata map[string]string `protobuf:"bytes,7,rep,name=custom_metadata,json=customMetadata,proto3" json:"custom_metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	CustomMetadata map[string]string `protobuf:"bytes,7,rep,name=custom_metadata,json=customMetadata,proto3" json:"custom_metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// Local indicates if the alias only belongs to the cluster where it was
 	// created. If true, the alias will be stored in a location that are ignored
 	// by the performance replication subsystem.
-	Local bool `protobuf:"varint,8,opt,name=local,proto3" json:"local,omitempty"`
+	Local         bool `protobuf:"varint,8,opt,name=local,proto3" json:"local,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Alias) Reset() {
 	*x = Alias{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_identity_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_identity_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Alias) String() string {
@@ -166,7 +161,7 @@ func (*Alias) ProtoMessage() {}
 
 func (x *Alias) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_identity_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -238,28 +233,25 @@ func (x *Alias) GetLocal() bool {
 }
 
 type Group struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// ID is the unique identifier for the group
 	ID string `protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
 	// Name is the human-friendly unique identifier for the group
 	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
 	// Metadata represents the custom data tied to this group
-	Metadata map[string]string `protobuf:"bytes,3,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Metadata map[string]string `protobuf:"bytes,3,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// NamespaceID is the identifier of the namespace to which this group
 	// belongs to.
-	NamespaceID string `protobuf:"bytes,4,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	NamespaceID   string `protobuf:"bytes,4,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Group) Reset() {
 	*x = Group{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_identity_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_identity_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Group) String() string {
@@ -270,7 +262,7 @@ func (*Group) ProtoMessage() {}
 
 func (x *Group) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_identity_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -314,23 +306,21 @@ func (x *Group) GetNamespaceID() string {
 }
 
 type MFAMethodID struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Type         string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
-	ID           string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
-	UsesPasscode bool   `protobuf:"varint,3,opt,name=uses_passcode,json=usesPasscode,proto3" json:"uses_passcode,omitempty"`
-	Name         string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
+	state                 protoimpl.MessageState `protogen:"open.v1"`
+	Type                  string                 `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	ID                    string                 `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	UsesPasscode          bool                   `protobuf:"varint,3,opt,name=uses_passcode,json=usesPasscode,proto3" json:"uses_passcode,omitempty"`
+	Name                  string                 `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
+	SelfEnrollmentEnabled bool                   `protobuf:"varint,5,opt,name=self_enrollment_enabled,json=selfEnrollmentEnabled,proto3" json:"self_enrollment_enabled,omitempty"`
+	unknownFields         protoimpl.UnknownFields
+	sizeCache             protoimpl.SizeCache
 }
 
 func (x *MFAMethodID) Reset() {
 	*x = MFAMethodID{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_identity_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_identity_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *MFAMethodID) String() string {
@@ -341,7 +331,7 @@ func (*MFAMethodID) ProtoMessage() {}
 
 func (x *MFAMethodID) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_identity_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -384,21 +374,25 @@ func (x *MFAMethodID) GetName() string {
 	return ""
 }
 
+func (x *MFAMethodID) GetSelfEnrollmentEnabled() bool {
+	if x != nil {
+		return x.SelfEnrollmentEnabled
+	}
+	return false
+}
+
 type MFAConstraintAny struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Any           []*MFAMethodID         `protobuf:"bytes,1,rep,name=any,proto3" json:"any,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Any []*MFAMethodID `protobuf:"bytes,1,rep,name=any,proto3" json:"any,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *MFAConstraintAny) Reset() {
 	*x = MFAConstraintAny{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_identity_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_identity_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *MFAConstraintAny) String() string {
@@ -409,7 +403,7 @@ func (*MFAConstraintAny) ProtoMessage() {}
 
 func (x *MFAConstraintAny) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_identity_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -432,21 +426,18 @@ func (x *MFAConstraintAny) GetAny() []*MFAMethodID {
 }
 
 type MFARequirement struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state          protoimpl.MessageState       `protogen:"open.v1"`
 	MFARequestID   string                       `protobuf:"bytes,1,opt,name=mfa_request_id,json=mfaRequestId,proto3" json:"mfa_request_id,omitempty"`
-	MFAConstraints map[string]*MFAConstraintAny `protobuf:"bytes,2,rep,name=mfa_constraints,json=mfaConstraints,proto3" json:"mfa_constraints,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	MFAConstraints map[string]*MFAConstraintAny `protobuf:"bytes,2,rep,name=mfa_constraints,json=mfaConstraints,proto3" json:"mfa_constraints,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *MFARequirement) Reset() {
 	*x = MFARequirement{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_identity_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_identity_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *MFARequirement) String() string {
@@ -457,7 +448,7 @@ func (*MFARequirement) ProtoMessage() {}
 
 func (x *MFARequirement) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_identity_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -488,7 +479,7 @@ func (x *MFARequirement) GetMFAConstraints() map[string]*MFAConstraintAny {
 
 var File_sdk_logical_identity_proto protoreflect.FileDescriptor
 
-var file_sdk_logical_identity_proto_rawDesc = []byte{
+var file_sdk_logical_identity_proto_rawDesc = string([]byte{
 	0x0a, 0x1a, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2f, 0x69, 0x64,
 	0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x6c, 0x6f,
 	0x67, 0x69, 0x63, 0x61, 0x6c, 0x22, 0x8d, 0x02, 0x0a, 0x06, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79,
@@ -548,51 +539,55 @@ var file_sdk_logical_identity_proto_rawDesc = []byte{
 	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
 	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
 	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x22, 0x6a, 0x0a, 0x0b, 0x4d, 0x46, 0x41, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x44,
-	0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x02, 0x69, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x73, 0x5f, 0x70, 0x61, 0x73,
-	0x73, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x75, 0x73, 0x65,
-	0x73, 0x50, 0x61, 0x73, 0x73, 0x63, 0x6f, 0x64, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x3a, 0x0a,
-	0x10, 0x4d, 0x46, 0x41, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x41, 0x6e,
-	0x79, 0x12, 0x26, 0x0a, 0x03, 0x61, 0x6e, 0x79, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14,
-	0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2e, 0x4d, 0x46, 0x41, 0x4d, 0x65, 0x74, 0x68,
-	0x6f, 0x64, 0x49, 0x44, 0x52, 0x03, 0x61, 0x6e, 0x79, 0x22, 0xea, 0x01, 0x0a, 0x0e, 0x4d, 0x46,
-	0x41, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0e,
-	0x6d, 0x66, 0x61, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6d, 0x66, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x49, 0x64, 0x12, 0x54, 0x0a, 0x0f, 0x6d, 0x66, 0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x74, 0x72,
-	0x61, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x6c, 0x6f,
-	0x67, 0x69, 0x63, 0x61, 0x6c, 0x2e, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x66, 0x61, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69,
-	0x6e, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0e, 0x6d, 0x66, 0x61, 0x43, 0x6f, 0x6e,
-	0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x73, 0x1a, 0x5c, 0x0a, 0x13, 0x4d, 0x66, 0x61, 0x43,
-	0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
-	0x79, 0x12, 0x2f, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x19, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2e, 0x4d, 0x46, 0x41, 0x43, 0x6f,
-	0x6e, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x28, 0x5a, 0x26, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76,
-	0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+	0x01, 0x22, 0xa2, 0x01, 0x0a, 0x0b, 0x4d, 0x46, 0x41, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49,
+	0x44, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x73, 0x5f, 0x70, 0x61,
+	0x73, 0x73, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x75, 0x73,
+	0x65, 0x73, 0x50, 0x61, 0x73, 0x73, 0x63, 0x6f, 0x64, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x36,
+	0x0a, 0x17, 0x73, 0x65, 0x6c, 0x66, 0x5f, 0x65, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x6d, 0x65, 0x6e,
+	0x74, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x15, 0x73, 0x65, 0x6c, 0x66, 0x45, 0x6e, 0x72, 0x6f, 0x6c, 0x6c, 0x6d, 0x65, 0x6e, 0x74, 0x45,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x3a, 0x0a, 0x10, 0x4d, 0x46, 0x41, 0x43, 0x6f, 0x6e,
+	0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x41, 0x6e, 0x79, 0x12, 0x26, 0x0a, 0x03, 0x61, 0x6e,
+	0x79, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61,
+	0x6c, 0x2e, 0x4d, 0x46, 0x41, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x49, 0x44, 0x52, 0x03, 0x61,
+	0x6e, 0x79, 0x22, 0xea, 0x01, 0x0a, 0x0e, 0x4d, 0x46, 0x41, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x24, 0x0a, 0x0e, 0x6d, 0x66, 0x61, 0x5f, 0x72, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6d,
+	0x66, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x64, 0x12, 0x54, 0x0a, 0x0f, 0x6d,
+	0x66, 0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2e, 0x4d,
+	0x46, 0x41, 0x52, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x66,
+	0x61, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x0e, 0x6d, 0x66, 0x61, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6e, 0x74,
+	0x73, 0x1a, 0x5c, 0x0a, 0x13, 0x4d, 0x66, 0x61, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69,
+	0x6e, 0x74, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2f, 0x0a, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6c, 0x6f, 0x67, 0x69,
+	0x63, 0x61, 0x6c, 0x2e, 0x4d, 0x46, 0x41, 0x43, 0x6f, 0x6e, 0x73, 0x74, 0x72, 0x61, 0x69, 0x6e,
+	0x74, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42,
+	0x28, 0x5a, 0x26, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61,
+	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64,
+	0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+})
 
 var (
 	file_sdk_logical_identity_proto_rawDescOnce sync.Once
-	file_sdk_logical_identity_proto_rawDescData = file_sdk_logical_identity_proto_rawDesc
+	file_sdk_logical_identity_proto_rawDescData []byte
 )
 
 func file_sdk_logical_identity_proto_rawDescGZIP() []byte {
 	file_sdk_logical_identity_proto_rawDescOnce.Do(func() {
-		file_sdk_logical_identity_proto_rawDescData = protoimpl.X.CompressGZIP(file_sdk_logical_identity_proto_rawDescData)
+		file_sdk_logical_identity_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sdk_logical_identity_proto_rawDesc), len(file_sdk_logical_identity_proto_rawDesc)))
 	})
 	return file_sdk_logical_identity_proto_rawDescData
 }
 
 var file_sdk_logical_identity_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
-var file_sdk_logical_identity_proto_goTypes = []interface{}{
+var file_sdk_logical_identity_proto_goTypes = []any{
 	(*Entity)(nil),           // 0: logical.Entity
 	(*Alias)(nil),            // 1: logical.Alias
 	(*Group)(nil),            // 2: logical.Group
@@ -626,85 +621,11 @@ func file_sdk_logical_identity_proto_init() {
 	if File_sdk_logical_identity_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_sdk_logical_identity_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Entity); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_logical_identity_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Alias); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_logical_identity_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Group); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_logical_identity_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MFAMethodID); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_logical_identity_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MFAConstraintAny); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_logical_identity_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MFARequirement); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_sdk_logical_identity_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_logical_identity_proto_rawDesc), len(file_sdk_logical_identity_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   11,
 			NumExtensions: 0,
@@ -715,7 +636,6 @@ func file_sdk_logical_identity_proto_init() {
 		MessageInfos:      file_sdk_logical_identity_proto_msgTypes,
 	}.Build()
 	File_sdk_logical_identity_proto = out.File
-	file_sdk_logical_identity_proto_rawDesc = nil
 	file_sdk_logical_identity_proto_goTypes = nil
 	file_sdk_logical_identity_proto_depIDxs = nil
 }
diff --git a/sdk/logical/identity.proto b/sdk/logical/identity.proto
index 8bac5559011..1ecee1e053d 100644
--- a/sdk/logical/identity.proto
+++ b/sdk/logical/identity.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 syntax = "proto3";
@@ -83,6 +83,7 @@ message MFAMethodID {
   string id = 2;
   bool uses_passcode = 3;
   string name = 4;
+  bool self_enrollment_enabled = 5;
 }
 
 message MFAConstraintAny {
diff --git a/sdk/logical/keyusage_enumer.go b/sdk/logical/keyusage_enumer.go
new file mode 100644
index 00000000000..83998c4a2a5
--- /dev/null
+++ b/sdk/logical/keyusage_enumer.go
@@ -0,0 +1,55 @@
+// Code generated by "enumer -type=KeyUsage -trimprefix=KeyUsage -transform=snake"; DO NOT EDIT.
+
+package logical
+
+import (
+	"fmt"
+)
+
+const _KeyUsageName = "encryptdecryptsignverifywrapunwrapgenerate_random"
+
+var _KeyUsageIndex = [...]uint8{0, 7, 14, 18, 24, 28, 34, 49}
+
+func (i KeyUsage) String() string {
+	i -= 1
+	if i < 0 || i >= KeyUsage(len(_KeyUsageIndex)-1) {
+		return fmt.Sprintf("KeyUsage(%d)", i+1)
+	}
+	return _KeyUsageName[_KeyUsageIndex[i]:_KeyUsageIndex[i+1]]
+}
+
+var _KeyUsageValues = []KeyUsage{1, 2, 3, 4, 5, 6, 7}
+
+var _KeyUsageNameToValueMap = map[string]KeyUsage{
+	_KeyUsageName[0:7]:   1,
+	_KeyUsageName[7:14]:  2,
+	_KeyUsageName[14:18]: 3,
+	_KeyUsageName[18:24]: 4,
+	_KeyUsageName[24:28]: 5,
+	_KeyUsageName[28:34]: 6,
+	_KeyUsageName[34:49]: 7,
+}
+
+// KeyUsageString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func KeyUsageString(s string) (KeyUsage, error) {
+	if val, ok := _KeyUsageNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to KeyUsage values", s)
+}
+
+// KeyUsageValues returns all values of the enum
+func KeyUsageValues() []KeyUsage {
+	return _KeyUsageValues
+}
+
+// IsAKeyUsage returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i KeyUsage) IsAKeyUsage() bool {
+	for _, v := range _KeyUsageValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdk/logical/lease.go b/sdk/logical/lease.go
index e00fb52d64b..f1146f1a621 100644
--- a/sdk/logical/lease.go
+++ b/sdk/logical/lease.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/lease_test.go b/sdk/logical/lease_test.go
index aee2bbdbcb3..84f8db80c66 100644
--- a/sdk/logical/lease_test.go
+++ b/sdk/logical/lease_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/logical.go b/sdk/logical/logical.go
index be527ba9e9c..0d82b8584e7 100644
--- a/sdk/logical/logical.go
+++ b/sdk/logical/logical.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -111,6 +111,10 @@ type BackendConfig struct {
 
 	// EventsSender provides a mechanism to interact with Vault events.
 	EventsSender EventSender
+
+	// ObservationsRecorder provides a mechanism to interact with the
+	// Vault Observation System.
+	ObservationRecorder ObservationRecorder
 }
 
 // Factory is the factory function to create a logical backend.
@@ -174,6 +178,14 @@ type Paths struct {
 	//
 	// For more details, consult limits/registry.go.
 	Limited []string
+
+	// AllowSnapshotRead paths are API paths that are allowed to be read from
+	// a loaded snapshot. These can't be regular expressions, it is either an
+	// exact match, a prefix match and/or a wildcard match.
+	// For prefix match, append '*' as a suffix.
+	// For a wildcard match, use '+' in the segment to match any identifier
+	// (e.g. 'foo/+/bar'). Note that '+' can't be adjacent to a non-slash.
+	AllowSnapshotRead []string
 }
 
 type Auditor interface {
@@ -191,4 +203,10 @@ type PluginVersioner interface {
 	PluginVersion() PluginVersion
 }
 
+// MetricsReporter is an optional interface that returns a
+// metric. Currently only implemented by the database backend.
+type MetricsReporter interface {
+	GetConnectionMetrics() (map[string]int, error)
+}
+
 var EmptyPluginVersion = PluginVersion{""}
diff --git a/sdk/logical/logical_storage.go b/sdk/logical/logical_storage.go
index b4fbc2b72fd..16e3b70a402 100644
--- a/sdk/logical/logical_storage.go
+++ b/sdk/logical/logical_storage.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/managed_key.go b/sdk/logical/managed_key.go
index 04727f9d7f4..37540f55670 100644
--- a/sdk/logical/managed_key.go
+++ b/sdk/logical/managed_key.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -11,6 +11,7 @@ import (
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 )
 
+//go:generate enumer -type=KeyUsage -trimprefix=KeyUsage -transform=snake
 type KeyUsage int
 
 const (
diff --git a/sdk/logical/observation.pb.go b/sdk/logical/observation.pb.go
new file mode 100644
index 00000000000..ea7e5b4a4ce
--- /dev/null
+++ b/sdk/logical/observation.pb.go
@@ -0,0 +1,211 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.5
+// 	protoc        (unknown)
+// source: sdk/logical/observation.proto
+
+package logical
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// ObservationPluginInfo contains data related to the plugin that generated an event.
+type ObservationPluginInfo struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The type of plugin this observation originated from, i.e., "auth" or "secrets".
+	MountClass string `protobuf:"bytes,1,opt,name=mount_class,json=mountClass,proto3" json:"mount_class,omitempty"`
+	// Unique ID of the mount entry, e.g., "kv_957bb7d8"
+	MountAccessor string `protobuf:"bytes,2,opt,name=mount_accessor,json=mountAccessor,proto3" json:"mount_accessor,omitempty"`
+	// Mount path of the plugin this observation originated from, e.g., "secret/"
+	MountPath string `protobuf:"bytes,3,opt,name=mount_path,json=mountPath,proto3" json:"mount_path,omitempty"`
+	// Plugin name that this observation originated from, e.g., "kv"
+	Plugin string `protobuf:"bytes,4,opt,name=plugin,proto3" json:"plugin,omitempty"`
+	// Plugin version of the plugin this observation originated from, e.g., "v0.13.3+builtin"
+	PluginVersion string `protobuf:"bytes,5,opt,name=plugin_version,json=pluginVersion,proto3" json:"plugin_version,omitempty"`
+	// Running plugin version of the plugin this observation originated from, e.g., "v0.13.3+builtin"
+	RunningPluginVersion string `protobuf:"bytes,6,opt,name=running_plugin_version,json=runningPluginVersion,proto3" json:"running_plugin_version,omitempty"`
+	// Mount version (i.e. from mount options) that this observation originated from, i.e., if KVv2, then "2". Usually empty
+	Version string `protobuf:"bytes,7,opt,name=version,proto3" json:"version,omitempty"`
+	// Whether or not the mount is local
+	Local         bool `protobuf:"varint,8,opt,name=local,proto3" json:"local,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ObservationPluginInfo) Reset() {
+	*x = ObservationPluginInfo{}
+	mi := &file_sdk_logical_observation_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ObservationPluginInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ObservationPluginInfo) ProtoMessage() {}
+
+func (x *ObservationPluginInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_logical_observation_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ObservationPluginInfo.ProtoReflect.Descriptor instead.
+func (*ObservationPluginInfo) Descriptor() ([]byte, []int) {
+	return file_sdk_logical_observation_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *ObservationPluginInfo) GetMountClass() string {
+	if x != nil {
+		return x.MountClass
+	}
+	return ""
+}
+
+func (x *ObservationPluginInfo) GetMountAccessor() string {
+	if x != nil {
+		return x.MountAccessor
+	}
+	return ""
+}
+
+func (x *ObservationPluginInfo) GetMountPath() string {
+	if x != nil {
+		return x.MountPath
+	}
+	return ""
+}
+
+func (x *ObservationPluginInfo) GetPlugin() string {
+	if x != nil {
+		return x.Plugin
+	}
+	return ""
+}
+
+func (x *ObservationPluginInfo) GetPluginVersion() string {
+	if x != nil {
+		return x.PluginVersion
+	}
+	return ""
+}
+
+func (x *ObservationPluginInfo) GetRunningPluginVersion() string {
+	if x != nil {
+		return x.RunningPluginVersion
+	}
+	return ""
+}
+
+func (x *ObservationPluginInfo) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *ObservationPluginInfo) GetLocal() bool {
+	if x != nil {
+		return x.Local
+	}
+	return false
+}
+
+var File_sdk_logical_observation_proto protoreflect.FileDescriptor
+
+var file_sdk_logical_observation_proto_rawDesc = string([]byte{
+	0x0a, 0x1d, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2f, 0x6f, 0x62,
+	0x73, 0x65, 0x72, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
+	0x07, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x22, 0xa3, 0x02, 0x0a, 0x15, 0x4f, 0x62, 0x73,
+	0x65, 0x72, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x49, 0x6e,
+	0x66, 0x6f, 0x12, 0x1f, 0x0a, 0x0b, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x63, 0x6c, 0x61, 0x73,
+	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x43, 0x6c,
+	0x61, 0x73, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x61, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x6d, 0x6f, 0x75,
+	0x6e, 0x74, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x6f,
+	0x75, 0x6e, 0x74, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x50, 0x61, 0x74, 0x68, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x12, 0x25, 0x0a, 0x0e, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x5f, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x16, 0x72, 0x75, 0x6e, 0x6e,
+	0x69, 0x6e, 0x67, 0x5f, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e,
+	0x67, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x18,
+	0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x6f, 0x63, 0x61,
+	0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x42, 0x28,
+	0x5a, 0x26, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b,
+	0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
+
+var (
+	file_sdk_logical_observation_proto_rawDescOnce sync.Once
+	file_sdk_logical_observation_proto_rawDescData []byte
+)
+
+func file_sdk_logical_observation_proto_rawDescGZIP() []byte {
+	file_sdk_logical_observation_proto_rawDescOnce.Do(func() {
+		file_sdk_logical_observation_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sdk_logical_observation_proto_rawDesc), len(file_sdk_logical_observation_proto_rawDesc)))
+	})
+	return file_sdk_logical_observation_proto_rawDescData
+}
+
+var file_sdk_logical_observation_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_sdk_logical_observation_proto_goTypes = []any{
+	(*ObservationPluginInfo)(nil), // 0: logical.ObservationPluginInfo
+}
+var file_sdk_logical_observation_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_sdk_logical_observation_proto_init() }
+func file_sdk_logical_observation_proto_init() {
+	if File_sdk_logical_observation_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_logical_observation_proto_rawDesc), len(file_sdk_logical_observation_proto_rawDesc)),
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_sdk_logical_observation_proto_goTypes,
+		DependencyIndexes: file_sdk_logical_observation_proto_depIdxs,
+		MessageInfos:      file_sdk_logical_observation_proto_msgTypes,
+	}.Build()
+	File_sdk_logical_observation_proto = out.File
+	file_sdk_logical_observation_proto_goTypes = nil
+	file_sdk_logical_observation_proto_depIdxs = nil
+}
diff --git a/sdk/logical/observation.proto b/sdk/logical/observation.proto
new file mode 100644
index 00000000000..67251d0c3f7
--- /dev/null
+++ b/sdk/logical/observation.proto
@@ -0,0 +1,30 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+syntax = "proto3";
+
+package logical;
+
+// This file is in the SDK package so that consuming applications can use this to determine the
+// format of aspects of observations.
+option go_package = "github.com/hashicorp/vault/sdk/logical";
+
+// ObservationPluginInfo contains data related to the plugin that generated an event.
+message ObservationPluginInfo {
+  // The type of plugin this observation originated from, i.e., "auth" or "secrets".
+  string mount_class = 1;
+  // Unique ID of the mount entry, e.g., "kv_957bb7d8"
+  string mount_accessor = 2;
+  // Mount path of the plugin this observation originated from, e.g., "secret/"
+  string mount_path = 3;
+  // Plugin name that this observation originated from, e.g., "kv"
+  string plugin = 4;
+  // Plugin version of the plugin this observation originated from, e.g., "v0.13.3+builtin"
+  string plugin_version = 5;
+  // Running plugin version of the plugin this observation originated from, e.g., "v0.13.3+builtin"
+  string running_plugin_version = 6;
+  // Mount version (i.e. from mount options) that this observation originated from, i.e., if KVv2, then "2". Usually empty
+  string version = 7;
+  // Whether or not the mount is local
+  bool local = 8;
+}
diff --git a/sdk/logical/observations.go b/sdk/logical/observations.go
new file mode 100644
index 00000000000..13086847d2a
--- /dev/null
+++ b/sdk/logical/observations.go
@@ -0,0 +1,11 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package logical
+
+import "context"
+
+// ObservationRecorder records an observation.
+type ObservationRecorder interface {
+	RecordObservationFromPlugin(ctx context.Context, observationType string, data map[string]interface{}) error
+}
diff --git a/sdk/logical/pki_cert_count_system_view.go b/sdk/logical/pki_cert_count_system_view.go
new file mode 100644
index 00000000000..f2bc5a88e16
--- /dev/null
+++ b/sdk/logical/pki_cert_count_system_view.go
@@ -0,0 +1,33 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package logical
+
+// PkiCertificateCounter is an interface for incrementing the count of issued and stored
+// PKI certificates.
+type PkiCertificateCounter interface {
+	// IncrementCount increments the count of issued and stored certificates.
+	IncrementCount(issuedCerts, storedCerts uint64)
+
+	// AddIssuedCertificate increments the issued certificate count by 1, and also the
+	// stored certificate count if stored is true.
+	AddIssuedCertificate(stored bool)
+}
+
+type PkiCertificateCountSystemView interface {
+	GetPkiCertificateCounter() PkiCertificateCounter
+}
+
+type nullPkiCertificateCounter struct{}
+
+func (n *nullPkiCertificateCounter) IncrementCount(_, _ uint64) {
+}
+
+func (n *nullPkiCertificateCounter) AddIssuedCertificate(_ bool) {
+}
+
+var _ PkiCertificateCounter = (*nullPkiCertificateCounter)(nil)
+
+func NewNullPkiCertificateCounter() PkiCertificateCounter {
+	return &nullPkiCertificateCounter{}
+}
diff --git a/sdk/logical/plugin.pb.go b/sdk/logical/plugin.pb.go
index 3793d0974bd..4fbea6f6759 100644
--- a/sdk/logical/plugin.pb.go
+++ b/sdk/logical/plugin.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: sdk/logical/plugin.proto
 
@@ -12,8 +12,10 @@ package logical
 import (
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -24,25 +26,24 @@ const (
 )
 
 type PluginEnvironment struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// VaultVersion is the version of the Vault server
 	VaultVersion string `protobuf:"bytes,1,opt,name=vault_version,json=vaultVersion,proto3" json:"vault_version,omitempty"`
 	// VaultVersionPrerelease is the prerelease information of the Vault server
 	VaultVersionPrerelease string `protobuf:"bytes,2,opt,name=vault_version_prerelease,json=vaultVersionPrerelease,proto3" json:"vault_version_prerelease,omitempty"`
 	// VaultVersionMetadata is the version metadata of the Vault server
 	VaultVersionMetadata string `protobuf:"bytes,3,opt,name=vault_version_metadata,json=vaultVersionMetadata,proto3" json:"vault_version_metadata,omitempty"`
+	// VaultBuildDate is the build date of the Vault server
+	VaultBuildDate *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=vault_build_date,json=vaultBuildDate,proto3" json:"vault_build_date,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
 }
 
 func (x *PluginEnvironment) Reset() {
 	*x = PluginEnvironment{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_plugin_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_plugin_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *PluginEnvironment) String() string {
@@ -53,7 +54,7 @@ func (*PluginEnvironment) ProtoMessage() {}
 
 func (x *PluginEnvironment) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_plugin_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -89,49 +90,65 @@ func (x *PluginEnvironment) GetVaultVersionMetadata() string {
 	return ""
 }
 
+func (x *PluginEnvironment) GetVaultBuildDate() *timestamppb.Timestamp {
+	if x != nil {
+		return x.VaultBuildDate
+	}
+	return nil
+}
+
 var File_sdk_logical_plugin_proto protoreflect.FileDescriptor
 
-var file_sdk_logical_plugin_proto_rawDesc = []byte{
+var file_sdk_logical_plugin_proto_rawDesc = string([]byte{
 	0x0a, 0x18, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2f, 0x70, 0x6c,
 	0x75, 0x67, 0x69, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x6c, 0x6f, 0x67, 0x69,
-	0x63, 0x61, 0x6c, 0x22, 0xa8, 0x01, 0x0a, 0x11, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x45, 0x6e,
-	0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x76, 0x61, 0x75,
-	0x6c, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0c, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x38,
-	0x0a, 0x18, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
-	0x70, 0x72, 0x65, 0x72, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x16, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x50, 0x72,
-	0x65, 0x72, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x16, 0x76, 0x61, 0x75, 0x6c,
-	0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x56,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x42, 0x28,
-	0x5a, 0x26, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
-	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b,
-	0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+	0x63, 0x61, 0x6c, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x22, 0xee, 0x01, 0x0a, 0x11, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x45,
+	0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x76, 0x61,
+	0x75, 0x6c, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0c, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x38, 0x0a, 0x18, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x5f, 0x70, 0x72, 0x65, 0x72, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x16, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x50,
+	0x72, 0x65, 0x72, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x16, 0x76, 0x61, 0x75,
+	0x6c, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x76, 0x61, 0x75, 0x6c, 0x74,
+	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12,
+	0x44, 0x0a, 0x10, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x5f, 0x64,
+	0x61, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0e, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x42, 0x75, 0x69, 0x6c,
+	0x64, 0x44, 0x61, 0x74, 0x65, 0x42, 0x28, 0x5a, 0x26, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61,
+	0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
 
 var (
 	file_sdk_logical_plugin_proto_rawDescOnce sync.Once
-	file_sdk_logical_plugin_proto_rawDescData = file_sdk_logical_plugin_proto_rawDesc
+	file_sdk_logical_plugin_proto_rawDescData []byte
 )
 
 func file_sdk_logical_plugin_proto_rawDescGZIP() []byte {
 	file_sdk_logical_plugin_proto_rawDescOnce.Do(func() {
-		file_sdk_logical_plugin_proto_rawDescData = protoimpl.X.CompressGZIP(file_sdk_logical_plugin_proto_rawDescData)
+		file_sdk_logical_plugin_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sdk_logical_plugin_proto_rawDesc), len(file_sdk_logical_plugin_proto_rawDesc)))
 	})
 	return file_sdk_logical_plugin_proto_rawDescData
 }
 
 var file_sdk_logical_plugin_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
-var file_sdk_logical_plugin_proto_goTypes = []interface{}{
-	(*PluginEnvironment)(nil), // 0: logical.PluginEnvironment
+var file_sdk_logical_plugin_proto_goTypes = []any{
+	(*PluginEnvironment)(nil),     // 0: logical.PluginEnvironment
+	(*timestamppb.Timestamp)(nil), // 1: google.protobuf.Timestamp
 }
 var file_sdk_logical_plugin_proto_depIdxs = []int32{
-	0, // [0:0] is the sub-list for method output_type
-	0, // [0:0] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
+	1, // 0: logical.PluginEnvironment.vault_build_date:type_name -> google.protobuf.Timestamp
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
 }
 
 func init() { file_sdk_logical_plugin_proto_init() }
@@ -139,25 +156,11 @@ func file_sdk_logical_plugin_proto_init() {
 	if File_sdk_logical_plugin_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_sdk_logical_plugin_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PluginEnvironment); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_sdk_logical_plugin_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_logical_plugin_proto_rawDesc), len(file_sdk_logical_plugin_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   1,
 			NumExtensions: 0,
@@ -168,7 +171,6 @@ func file_sdk_logical_plugin_proto_init() {
 		MessageInfos:      file_sdk_logical_plugin_proto_msgTypes,
 	}.Build()
 	File_sdk_logical_plugin_proto = out.File
-	file_sdk_logical_plugin_proto_rawDesc = nil
 	file_sdk_logical_plugin_proto_goTypes = nil
 	file_sdk_logical_plugin_proto_depIdxs = nil
 }
diff --git a/sdk/logical/plugin.proto b/sdk/logical/plugin.proto
index 5e19274ee2c..776fc002841 100644
--- a/sdk/logical/plugin.proto
+++ b/sdk/logical/plugin.proto
@@ -1,10 +1,12 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 syntax = "proto3";
 
 package logical;
 
+import "google/protobuf/timestamp.proto";
+
 option go_package = "github.com/hashicorp/vault/sdk/logical";
 
 message PluginEnvironment {
@@ -16,4 +18,7 @@ message PluginEnvironment {
 
   // VaultVersionMetadata is the version metadata of the Vault server
   string vault_version_metadata = 3;
+
+  // VaultBuildDate is the build date of the Vault server
+  google.protobuf.Timestamp vault_build_date = 4;
 }
diff --git a/sdk/logical/request.go b/sdk/logical/request.go
index 24fddeff083..11bedc6f5d1 100644
--- a/sdk/logical/request.go
+++ b/sdk/logical/request.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -51,6 +51,7 @@ func (r *RequestWrapInfo) SentinelKeys() []string {
 	}
 }
 
+//go:generate enumer -type=ClientTokenSource -trimprefix=ClientTokenFrom -transform=snake
 type ClientTokenSource uint32
 
 const (
@@ -202,6 +203,10 @@ type Request struct {
 	// X-Vault-MFA header
 	MFACreds MFACreds `json:"mfa_creds" structs:"mfa_creds" mapstructure:"mfa_creds" sentinel:""`
 
+	// RotationID is set by the Rotation Manager
+	// when making rotate requests to plugin backends
+	RotationID string
+
 	// Cached token entry. This avoids another lookup in request handling when
 	// we've already looked it up at http handling time. Note that this token
 	// has not been "used", as in it will not properly take into account use
@@ -258,6 +263,16 @@ type Request struct {
 
 	// RequestLimiterDisabled tells whether the request context has Request Limiter applied.
 	RequestLimiterDisabled bool `json:"request_limiter_disabled,omitempty"`
+
+	// RequiresSnapshotID holds a loaded snapshot ID that the request will use,
+	// for either a read, list, or recover operation
+	RequiresSnapshotID string `json:"snapshot_id,omitempty"`
+
+	// RecoverSourcePath is the path where a recover request should read the data
+	// from. This can be empty if the request is not a recover request, or if the
+	// request is a recover request where the source path is the same as the
+	// destination path
+	RecoverSourcePath string `json:"recover_source_path,omitempty"`
 }
 
 // Clone returns a deep copy (almost) of the request.
@@ -395,6 +410,13 @@ func (r *Request) SetTokenEntry(te *TokenEntry) {
 	r.tokenEntry = te
 }
 
+// IsSnapshotReadOrList checks whether the request reads or lists from a
+// snapshot. When this method returns true, handling the request should not
+// modify any internal caches or state
+func (r *Request) IsSnapshotReadOrList() bool {
+	return (r.Operation == ReadOperation || r.Operation == ListOperation) && r.RequiresSnapshotID != ""
+}
+
 // RenewRequest creates the structure of the renew request.
 func RenewRequest(path string, secret *Secret, data map[string]interface{}) *Request {
 	return &Request{
@@ -450,11 +472,13 @@ const (
 	AliasLookaheadOperation           = "alias-lookahead"
 	ResolveRoleOperation              = "resolve-role"
 	HeaderOperation                   = "header"
+	RecoverOperation                  = "recover"
 
 	// The operations below are called globally, the path is less relevant.
 	RevokeOperation   Operation = "revoke"
 	RenewOperation              = "renew"
 	RollbackOperation           = "rollback"
+	RotationOperation           = "rotate"
 )
 
 type MFACreds map[string][]string
@@ -477,13 +501,36 @@ func (c CtxKeyInFlightRequestID) String() string {
 	return "in-flight-request-ID"
 }
 
+type CtxKeyInFlightRequestPriority struct{}
+
+func (c CtxKeyInFlightRequestPriority) String() string {
+	return "in-flight-request-priority"
+}
+
+// CtxKeyInFlightTraceID is used for passing a trace ID through request
+// forwarding. The CtxKeyInFlightRequestID created at the HTTP layer is
+// propagated on through any forwarded requests using this key.
+//
+// Note that this applies to replication service RPCs (including
+// ForwardingRequest from perf standbys or secondaries). The Forwarding RPC
+// service may propagate the context but the handling on the active node runs
+// back through the `http` package handler which builds a new context from HTTP
+// request properties and creates a fresh request ID. Forwarding RPC is used
+// exclusively in Community Edition but also in some special cases in Enterprise
+// such as when forwarding is forced by an HTTP header.
+type CtxKeyInFlightTraceID struct{}
+
+func (c CtxKeyInFlightTraceID) String() string {
+	return "in-flight-trace-ID"
+}
+
 type CtxKeyRequestRole struct{}
 
 func (c CtxKeyRequestRole) String() string {
 	return "request-role"
 }
 
-// CtxKeyDisableReplicationStatusEndpoints is a custom type used as a key in
+// ctxKeyDisableReplicationStatusEndpoints is a custom type used as a key in
 // context.Context to store the value `true` when the
 // disable_replication_status_endpoints configuration parameter is set to true
 // for the listener through which a request was received.
@@ -552,3 +599,54 @@ type CtxKeyDisableRequestLimiter struct{}
 func (c CtxKeyDisableRequestLimiter) String() string {
 	return "disable_request_limiter"
 }
+
+// ctxKeyRedactionSettings is a custom type used as a key in context.Context to
+// store the value the redaction settings for the listener that received the
+// request.
+type ctxKeyRedactionSettings struct{}
+
+// String returns a string representation of the receiver type.
+func (c ctxKeyRedactionSettings) String() string {
+	return "redaction-settings"
+}
+
+// CtxRedactionSettingsValue examines the provided context.Context for the
+// redaction settings value and returns them as a tuple of bool values if they
+// are found along with the ok return value set to true; otherwise the ok return
+// value is false.
+func CtxRedactionSettingsValue(ctx context.Context) (redactVersion, redactAddresses, redactClusterName, ok bool) {
+	value, ok := ctx.Value(ctxKeyRedactionSettings{}).([]bool)
+	if !ok {
+		return false, false, false, false
+	}
+
+	return value[0], value[1], value[2], true
+}
+
+// CreatecontextRedactionSettings creates a new context.Context based on the
+// provided parent that also includes the provided redaction settings values for
+// the ctxKeyRedactionSettings key.
+func CreateContextRedactionSettings(parent context.Context, redactVersion, redactAddresses, redactClusterName bool) context.Context {
+	return context.WithValue(parent, ctxKeyRedactionSettings{}, []bool{redactVersion, redactAddresses, redactClusterName})
+}
+
+type ctxKeySnapshotID struct{}
+
+func (c ctxKeySnapshotID) String() string {
+	return "snapshot-id"
+}
+
+// CreateContextWithSnapshotID creates a new context indicating that any storage
+// operations should be done using the given snapshot ID. If the value is empty,
+// it means that the request should use the normal storage.
+func CreateContextWithSnapshotID(parent context.Context, value string) context.Context {
+	return context.WithValue(parent, ctxKeySnapshotID{}, value)
+}
+
+// ContextSnapshotIDValue retrieves the snapshot ID value stored in the context.
+// This value can be empty, indicating that the request should use the normal
+// storage.
+func ContextSnapshotIDValue(ctx context.Context) (value string, ok bool) {
+	value, ok = ctx.Value(ctxKeySnapshotID{}).(string)
+	return
+}
diff --git a/sdk/logical/request_test.go b/sdk/logical/request_test.go
index 69663be4e41..9d83a0461a4 100644
--- a/sdk/logical/request_test.go
+++ b/sdk/logical/request_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/response.go b/sdk/logical/response.go
index 721618c76c1..e1f57bba815 100644
--- a/sdk/logical/response.go
+++ b/sdk/logical/response.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -141,6 +141,15 @@ func ErrorResponse(text string, vargs ...interface{}) *Response {
 	}
 }
 
+// ErrorResponseWithData is used to format an error response with additional data returned
+// within the "data" sub-field of the Data field. Useful to return additional information to the client
+// and or appear within audited responses.
+func ErrorResponseWithData(data interface{}, text string, vargs ...interface{}) *Response {
+	resp := ErrorResponse(text, vargs...)
+	resp.Data["data"] = data
+	return resp
+}
+
 // ListResponse is used to format a response to a list operation.
 func ListResponse(keys []string) *Response {
 	resp := &Response{
diff --git a/sdk/logical/response_test.go b/sdk/logical/response_test.go
new file mode 100644
index 00000000000..3db6fbc09d8
--- /dev/null
+++ b/sdk/logical/response_test.go
@@ -0,0 +1,24 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package logical
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestResponse_ErrorResponse validates that our helper functions produce responses
+// that we consider errors.
+func TestResponse_ErrorResponse(t *testing.T) {
+	simpleResp := ErrorResponse("a test %s", "error")
+	assert.True(t, simpleResp.IsError())
+
+	dataMap := map[string]string{
+		"test1": "testing",
+	}
+
+	withDataResp := ErrorResponseWithData(dataMap, "a test %s", "error")
+	assert.True(t, withDataResp.IsError())
+}
diff --git a/sdk/logical/response_util.go b/sdk/logical/response_util.go
index 2aebe3a43be..3408524acaf 100644
--- a/sdk/logical/response_util.go
+++ b/sdk/logical/response_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -8,8 +8,11 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"strconv"
+	"strings"
 
 	"github.com/hashicorp/errwrap"
+	metrics "github.com/hashicorp/go-metrics/compat"
 	multierror "github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 )
@@ -112,6 +115,8 @@ func RespondErrorCommon(req *Request, resp *Response, err error) (int, error) {
 	// appropriate code
 	if err != nil {
 		switch {
+		case errwrap.Contains(err, consts.ErrOverloaded.Error()):
+			statusCode = http.StatusServiceUnavailable
 		case errwrap.ContainsType(err, new(StatusBadRequest)):
 			statusCode = http.StatusBadRequest
 		case errwrap.Contains(err, ErrPermissionDenied.Error()):
@@ -143,8 +148,13 @@ func RespondErrorCommon(req *Request, resp *Response, err error) (int, error) {
 		}
 	}
 
-	if resp != nil && resp.IsError() {
-		err = fmt.Errorf("%s", resp.Data["error"].(string))
+	if respErr := resp.Error(); respErr != nil {
+		err = fmt.Errorf("%s", respErr.Error())
+
+		// Don't let other error codes override the overloaded status code
+		if strings.Contains(respErr.Error(), consts.ErrOverloaded.Error()) {
+			statusCode = http.StatusServiceUnavailable
+		}
 	}
 
 	return statusCode, err
@@ -161,6 +171,11 @@ func AdjustErrorStatusCode(status *int, err error) {
 		}
 	}
 
+	// Adjust status code when overloaded
+	if errwrap.Contains(err, consts.ErrOverloaded.Error()) {
+		*status = http.StatusServiceUnavailable
+	}
+
 	// Adjust status code when sealed
 	if errwrap.Contains(err, consts.ErrSealed.Error()) {
 		*status = http.StatusServiceUnavailable
@@ -184,6 +199,8 @@ func AdjustErrorStatusCode(status *int, err error) {
 func RespondError(w http.ResponseWriter, status int, err error) {
 	AdjustErrorStatusCode(&status, err)
 
+	defer IncrementResponseStatusCodeMetric(status)
+
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)
 
@@ -202,6 +219,8 @@ func RespondError(w http.ResponseWriter, status int, err error) {
 func RespondErrorAndData(w http.ResponseWriter, status int, data interface{}, err error) {
 	AdjustErrorStatusCode(&status, err)
 
+	defer IncrementResponseStatusCodeMetric(status)
+
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)
 
@@ -218,3 +237,14 @@ func RespondErrorAndData(w http.ResponseWriter, status int, data interface{}, er
 	enc := json.NewEncoder(w)
 	enc.Encode(resp)
 }
+
+func IncrementResponseStatusCodeMetric(statusCode int) {
+	statusString := strconv.Itoa(statusCode)
+	statusType := fmt.Sprintf("%cxx", statusString[0])
+	metrics.IncrCounterWithLabels([]string{"core", "response_status_code"},
+		1,
+		[]metrics.Label{
+			{"code", statusString},
+			{"type", statusType},
+		})
+}
diff --git a/sdk/logical/response_util_test.go b/sdk/logical/response_util_test.go
index eafaa2fc761..ec303e7ccb7 100644
--- a/sdk/logical/response_util_test.go
+++ b/sdk/logical/response_util_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -7,6 +7,8 @@ import (
 	"errors"
 	"strings"
 	"testing"
+
+	"github.com/hashicorp/vault/sdk/helper/consts"
 )
 
 func TestResponseUtil_RespondErrorCommon_basic(t *testing.T) {
@@ -83,6 +85,17 @@ func TestResponseUtil_RespondErrorCommon_basic(t *testing.T) {
 			expectedErr:    errors.New("error due to wrong credentials"),
 			expectedStatus: 400,
 		},
+		{
+			title:   "Overloaded error",
+			respErr: consts.ErrOverloaded,
+			resp: &Response{
+				Data: map[string]interface{}{
+					"error": "overloaded, try again later",
+				},
+			},
+			expectedErr:    consts.ErrOverloaded,
+			expectedStatus: 503,
+		},
 	}
 
 	for _, tc := range testCases {
diff --git a/sdk/logical/secret.go b/sdk/logical/secret.go
index e6b4d14d473..532370da557 100644
--- a/sdk/logical/secret.go
+++ b/sdk/logical/secret.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/snapshot_storage.go b/sdk/logical/snapshot_storage.go
new file mode 100644
index 00000000000..1c0b7b44531
--- /dev/null
+++ b/sdk/logical/snapshot_storage.go
@@ -0,0 +1,119 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package logical
+
+import (
+	"context"
+	"errors"
+)
+
+type snapshotStorageView struct {
+	storage    Storage
+	snapshotID string
+}
+
+var readOnlyErr = errors.New("read-only storage view")
+
+func (s *snapshotStorageView) List(ctx context.Context, prefix string) ([]string, error) {
+	return s.storage.List(CreateContextWithSnapshotID(ctx, s.snapshotID), prefix)
+}
+
+func (s *snapshotStorageView) Get(ctx context.Context, key string) (*StorageEntry, error) {
+	return s.storage.Get(CreateContextWithSnapshotID(ctx, s.snapshotID), key)
+}
+
+func (s *snapshotStorageView) Put(_ context.Context, _ *StorageEntry) error {
+	return readOnlyErr
+}
+
+func (s *snapshotStorageView) Delete(_ context.Context, _ string) error {
+	return readOnlyErr
+}
+
+// NewSnapshotStorageView creates a storage view that provides read-only access
+// to the given snapshot's storage.
+func NewSnapshotStorageView(request *Request) (Storage, error) {
+	if request.RequiresSnapshotID == "" {
+		return nil, errors.New("no snapshot in request")
+	}
+	return &snapshotStorageView{
+		storage:    request.Storage,
+		snapshotID: request.RequiresSnapshotID,
+	}, nil
+}
+
+// SnapshotStorageProvider is an interface that provides a method to retrieve
+// the snapshot by ID
+type SnapshotStorageProvider interface {
+	SnapshotStorage(ctx context.Context, id string) (Storage, error)
+}
+
+type SnapshotStorageRouter struct {
+	underlying Storage
+	manager    SnapshotStorageProvider
+}
+
+// NewSnapshotStorageRouter creates a new storage instance that routes to either
+// a snapshot (given the snapshot's ID in the context) or to the underlying
+// storage
+func NewSnapshotStorageRouter(underlying Storage, manager SnapshotStorageProvider) Storage {
+	return &SnapshotStorageRouter{
+		underlying: underlying,
+		manager:    manager,
+	}
+}
+
+var _ Storage = (*SnapshotStorageRouter)(nil)
+
+func (s *SnapshotStorageRouter) getStorageRead(ctx context.Context) (Storage, error) {
+	snapID, ok := ContextSnapshotIDValue(ctx)
+	if ok && snapID != "" {
+		snapshotStorage, err := s.manager.SnapshotStorage(ctx, snapID)
+		if err != nil {
+			return nil, err
+		}
+		return snapshotStorage, nil
+	}
+	return s.underlying, nil
+}
+
+func (s *SnapshotStorageRouter) List(ctx context.Context, key string) ([]string, error) {
+	storage, err := s.getStorageRead(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return storage.List(ctx, key)
+}
+
+func (s *SnapshotStorageRouter) Get(ctx context.Context, key string) (*StorageEntry, error) {
+	storage, err := s.getStorageRead(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return storage.Get(ctx, key)
+}
+
+var WriteErr = errors.New("attempted write operation on snapshot")
+
+func (s *SnapshotStorageRouter) checkWrite(ctx context.Context) error {
+	snapID, ok := ContextSnapshotIDValue(ctx)
+	if ok && snapID != "" {
+		return WriteErr
+	}
+	return nil
+}
+
+func (s *SnapshotStorageRouter) Put(ctx context.Context, entry *StorageEntry) error {
+	if err := s.checkWrite(ctx); err != nil {
+		return err
+	}
+	return s.underlying.Put(ctx, entry)
+}
+
+func (s *SnapshotStorageRouter) Delete(ctx context.Context, key string) error {
+	if err := s.checkWrite(ctx); err != nil {
+		return err
+	}
+	return s.underlying.Delete(ctx, key)
+}
diff --git a/sdk/logical/snapshot_storage_test.go b/sdk/logical/snapshot_storage_test.go
new file mode 100644
index 00000000000..74e0a594c4c
--- /dev/null
+++ b/sdk/logical/snapshot_storage_test.go
@@ -0,0 +1,137 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package logical
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+type checkCtxStorage struct {
+	Storage
+	requiredSnapshotID string
+}
+
+func (c *checkCtxStorage) Get(ctx context.Context, key string) (*StorageEntry, error) {
+	if sID, _ := ContextSnapshotIDValue(ctx); sID != c.requiredSnapshotID {
+		return nil, errors.New("snapshot ID mismatch")
+	}
+	return c.Storage.Get(ctx, key)
+}
+
+// TestSnapshotStorageView_BadRequest verifies that a request without a
+// RequiresSnapshotID results in an error when creating a snapshot storage view.
+func TestSnapshotStorageView_BadRequest(t *testing.T) {
+	req := &Request{
+		Storage: &InmemStorage{},
+	}
+	_, err := NewSnapshotStorageView(req)
+	require.Error(t, err)
+}
+
+// TestSnapshotStorageView verifies that a request with a RequiredSnapshotID
+// creates a read-only storage view. This storage will error on writes, but
+// succeed on reads with the given snapshot ID in the context
+func TestSnapshotStorageView(t *testing.T) {
+	storage := &checkCtxStorage{
+		Storage:            &InmemStorage{},
+		requiredSnapshotID: "abcd",
+	}
+
+	req := &Request{
+		RequiresSnapshotID: "abcd",
+		Storage:            storage,
+	}
+	view, err := NewSnapshotStorageView(req)
+	require.NoError(t, err)
+
+	// write should error
+	require.Error(t, view.Put(context.Background(), &StorageEntry{
+		Key:   "foo",
+		Value: []byte("bar"),
+	}))
+	require.Error(t, view.Delete(context.Background(), "foo"))
+
+	// reads should contain the snapshot ID
+	_, err = view.Get(context.Background(), "foo")
+	require.NoError(t, err)
+
+	_, err = view.List(context.Background(), "foo")
+	require.NoError(t, err)
+}
+
+type storageProvider struct {
+	snapshotStorage Storage
+}
+
+func (s *storageProvider) SnapshotStorage(ctx context.Context, id string) (Storage, error) {
+	return s.snapshotStorage, nil
+}
+
+// TestSnapshotStorageRouter verifies that the snapshot storage router correctly
+// routes requests to the appropriate storage based on the presence of the
+// snapshot ID context key
+func TestSnapshotStorageRouter(t *testing.T) {
+	regularStorage := &InmemStorage{}
+	snapshotStorage := &InmemStorage{}
+
+	router := NewSnapshotStorageRouter(regularStorage, &storageProvider{
+		snapshotStorage: snapshotStorage,
+	})
+
+	snapshotStorage.Put(context.Background(), &StorageEntry{
+		Key:   "key",
+		Value: []byte("bar"),
+	})
+	snapshotStorage.Put(context.Background(), &StorageEntry{
+		Key:   "key2",
+		Value: []byte("baz"),
+	})
+	regularStorage.Put(context.Background(), &StorageEntry{
+		Key:   "key",
+		Value: []byte("foo"),
+	})
+
+	ctx := context.Background()
+	snapshotCtx := CreateContextWithSnapshotID(ctx, "snapshot_id")
+
+	// test get with and without snapshot ID
+	value, err := router.Get(ctx, "key")
+	require.NoError(t, err)
+	require.Equal(t, []byte("foo"), value.Value)
+
+	value, err = router.Get(snapshotCtx, "key")
+	require.NoError(t, err)
+	require.Equal(t, []byte("bar"), value.Value)
+
+	// test list with and without snapshot ID
+	keys, err := router.List(ctx, "key")
+	require.NoError(t, err)
+	require.Len(t, keys, 1)
+
+	keys, err = router.List(snapshotCtx, "key")
+	require.NoError(t, err)
+	require.Len(t, keys, 2)
+
+	// delete with a snapshot ID should fail
+	require.Error(t, router.Delete(snapshotCtx, "key"))
+
+	// delete without a snapshot ID should succeed
+	require.NoError(t, router.Delete(ctx, "key"))
+
+	// put with a snapshot ID should fail
+	require.Error(t, router.Put(snapshotCtx, &StorageEntry{
+		Key:   "key",
+		Value: []byte("new-value"),
+	}))
+
+	// put without a snapshot ID should succeed
+	require.NoError(t, router.Put(ctx, &StorageEntry{
+		Key:   "key",
+		Value: []byte("new-value"),
+	}))
+}
diff --git a/sdk/logical/storage.go b/sdk/logical/storage.go
index 886ad51be78..a4db6a60bfd 100644
--- a/sdk/logical/storage.go
+++ b/sdk/logical/storage.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/storage_inmem.go b/sdk/logical/storage_inmem.go
index 62ec58290a4..5e3c8d35dc5 100644
--- a/sdk/logical/storage_inmem.go
+++ b/sdk/logical/storage_inmem.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/storage_inmem_test.go b/sdk/logical/storage_inmem_test.go
index 2ed776b20c3..61dbe2b6a70 100644
--- a/sdk/logical/storage_inmem_test.go
+++ b/sdk/logical/storage_inmem_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/storage_test.go b/sdk/logical/storage_test.go
index 1d6014dd976..503584d3932 100644
--- a/sdk/logical/storage_test.go
+++ b/sdk/logical/storage_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/storage_view.go b/sdk/logical/storage_view.go
index df40dca4fc5..de075ef69fb 100644
--- a/sdk/logical/storage_view.go
+++ b/sdk/logical/storage_view.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/system_view.go b/sdk/logical/system_view.go
index cecbc261e14..89e71563a5b 100644
--- a/sdk/logical/system_view.go
+++ b/sdk/logical/system_view.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -14,6 +14,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/license"
 	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/helper/wrapping"
+	"github.com/hashicorp/vault/sdk/rotation"
 )
 
 // SystemView exposes system configuration information in a safe way
@@ -100,6 +101,22 @@ type SystemView interface {
 
 	// GenerateIdentityToken returns an identity token for the requesting plugin.
 	GenerateIdentityToken(ctx context.Context, req *pluginutil.IdentityTokenRequest) (*pluginutil.IdentityTokenResponse, error)
+
+	// GetRotationInformation gets rotation information from the system about an established rotation job.
+	GetRotationInformation(ctx context.Context, req *rotation.RotationInfoRequest) (*rotation.RotationInfoResponse, error)
+
+	// RegisterRotationJob returns a rotation ID after registering a
+	// rotation job for the requesting plugin.
+	// NOTE: This method is intended for use only by HashiCorp Vault Enterprise plugins.
+	RegisterRotationJob(ctx context.Context, req *rotation.RotationJobConfigureRequest) (rotationID string, err error)
+
+	// DeregisterRotationJob returns any errors in de-registering a
+	// credential from the Rotation Manager.
+	// NOTE: This method is intended for use only by HashiCorp Vault Enterprise plugins.
+	DeregisterRotationJob(ctx context.Context, req *rotation.RotationJobDeregisterRequest) error
+
+	// ExtractVerifyPlugin extracts and verifies the plugin artifact
+	DownloadExtractVerifyPlugin(ctx context.Context, plugin *pluginutil.PluginRunner) error
 }
 
 type PasswordPolicy interface {
@@ -135,6 +152,7 @@ type ExtendedSystemView interface {
 type PasswordGenerator func() (password string, err error)
 
 type StaticSystemView struct {
+	EntStaticSystemView
 	DefaultLeaseTTLVal           time.Duration
 	MaxLeaseTTLVal               time.Duration
 	SudoPrivilegeVal             bool
@@ -285,3 +303,30 @@ func (d StaticSystemView) GenerateIdentityToken(_ context.Context, _ *pluginutil
 func (d StaticSystemView) APILockShouldBlockRequest() (bool, error) {
 	return d.APILockShouldBlockRequestVal, nil
 }
+
+func (d StaticSystemView) GetRotationInformation(ctx context.Context, req *rotation.RotationInfoRequest) (*rotation.RotationInfoResponse, error) {
+	return nil, errors.New("GetRotationInformation is not implemented in StaticSystemView")
+}
+
+func (d StaticSystemView) RegisterRotationJob(_ context.Context, _ *rotation.RotationJobConfigureRequest) (rotationID string, err error) {
+	return "", errors.New("RegisterRotationJob is not implemented in StaticSystemView")
+}
+
+func (d StaticSystemView) DeregisterRotationJob(_ context.Context, _ *rotation.RotationJobDeregisterRequest) (err error) {
+	return errors.New("DeregisterRotationJob is not implemented in StaticSystemView")
+}
+
+func (d StaticSystemView) DownloadExtractVerifyPlugin(_ context.Context, _ *pluginutil.PluginRunner) error {
+	return errors.New("DownloadExtractVerifyPlugin is not implemented in StaticSystemView")
+}
+
+// PluginLicenseUtil defines the functions needed to request License and PluginEnv
+// by the plugin licensing under github.com/hashicorp/vault-licensing
+// This only should be used by the plugin to get the license and plugin environment
+type PluginLicenseUtil interface {
+	// License returns the raw license of the running Vault instance
+	License() (string, error)
+
+	// PluginEnv returns Vault environment information used by plugins
+	PluginEnv(context.Context) (*PluginEnvironment, error)
+}
diff --git a/sdk/logical/system_view_stubs_oss.go b/sdk/logical/system_view_stubs_oss.go
new file mode 100644
index 00000000000..5ba6396b12f
--- /dev/null
+++ b/sdk/logical/system_view_stubs_oss.go
@@ -0,0 +1,8 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package logical
+
+type EntStaticSystemView struct{}
diff --git a/sdk/logical/testing.go b/sdk/logical/testing.go
index d3795619309..d4a9539ee47 100644
--- a/sdk/logical/testing.go
+++ b/sdk/logical/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -6,15 +6,15 @@ package logical
 import (
 	"context"
 	"reflect"
+	"testing"
 	"time"
 
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/sdk/helper/logging"
-	testing "github.com/mitchellh/go-testing-interface"
 )
 
 // TestRequest is a helper to create a purely in-memory Request struct.
-func TestRequest(t testing.T, op Operation, path string) *Request {
+func TestRequest(t testing.TB, op Operation, path string) *Request {
 	return &Request{
 		Operation:  op,
 		Path:       path,
@@ -26,7 +26,7 @@ func TestRequest(t testing.T, op Operation, path string) *Request {
 
 // TestStorage is a helper that can be used from unit tests to verify
 // the behavior of a Storage impl.
-func TestStorage(t testing.T, s Storage) {
+func TestStorage(t testing.TB, s Storage) {
 	keys, err := s.List(context.Background(), "")
 	if err != nil {
 		t.Fatalf("list error: %s", err)
diff --git a/sdk/logical/token.go b/sdk/logical/token.go
index a27a73a22dc..f2caca9c9da 100644
--- a/sdk/logical/token.go
+++ b/sdk/logical/token.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
@@ -11,9 +11,10 @@ import (
 	"strings"
 	"time"
 
-	sockaddr "github.com/hashicorp/go-sockaddr"
+	"github.com/hashicorp/go-sockaddr"
 )
 
+//go:generate enumer -type=TokenType -trimprefix=TokenType -transform=kebab
 type TokenType uint8
 
 const (
@@ -72,23 +73,6 @@ func (t *TokenType) UnmarshalJSON(b []byte) error {
 	return nil
 }
 
-func (t TokenType) String() string {
-	switch t {
-	case TokenTypeDefault:
-		return "default"
-	case TokenTypeService:
-		return "service"
-	case TokenTypeBatch:
-		return "batch"
-	case TokenTypeDefaultService:
-		return "default-service"
-	case TokenTypeDefaultBatch:
-		return "default-batch"
-	default:
-		panic("unreachable")
-	}
-}
-
 // TokenEntry is used to represent a given token
 type TokenEntry struct {
 	Type TokenType `json:"type" mapstructure:"type" structs:"type" sentinel:""`
diff --git a/sdk/logical/token_test.go b/sdk/logical/token_test.go
index 641d688b9dd..762e884753f 100644
--- a/sdk/logical/token_test.go
+++ b/sdk/logical/token_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/tokentype_enumer.go b/sdk/logical/tokentype_enumer.go
new file mode 100644
index 00000000000..9b350a74d35
--- /dev/null
+++ b/sdk/logical/tokentype_enumer.go
@@ -0,0 +1,52 @@
+// Code generated by "enumer -type=TokenType -trimprefix=TokenType -transform=kebab"; DO NOT EDIT.
+
+package logical
+
+import (
+	"fmt"
+)
+
+const _TokenTypeName = "defaultservicebatchdefault-servicedefault-batch"
+
+var _TokenTypeIndex = [...]uint8{0, 7, 14, 19, 34, 47}
+
+func (i TokenType) String() string {
+	if i >= TokenType(len(_TokenTypeIndex)-1) {
+		return fmt.Sprintf("TokenType(%d)", i)
+	}
+	return _TokenTypeName[_TokenTypeIndex[i]:_TokenTypeIndex[i+1]]
+}
+
+var _TokenTypeValues = []TokenType{0, 1, 2, 3, 4}
+
+var _TokenTypeNameToValueMap = map[string]TokenType{
+	_TokenTypeName[0:7]:   0,
+	_TokenTypeName[7:14]:  1,
+	_TokenTypeName[14:19]: 2,
+	_TokenTypeName[19:34]: 3,
+	_TokenTypeName[34:47]: 4,
+}
+
+// TokenTypeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func TokenTypeString(s string) (TokenType, error) {
+	if val, ok := _TokenTypeNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to TokenType values", s)
+}
+
+// TokenTypeValues returns all values of the enum
+func TokenTypeValues() []TokenType {
+	return _TokenTypeValues
+}
+
+// IsATokenType returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i TokenType) IsATokenType() bool {
+	for _, v := range _TokenTypeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/sdk/logical/translate_response.go b/sdk/logical/translate_response.go
index ca832ebd691..d4505452336 100644
--- a/sdk/logical/translate_response.go
+++ b/sdk/logical/translate_response.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package logical
diff --git a/sdk/logical/version.pb.go b/sdk/logical/version.pb.go
index 8f638ef7c2a..a2410335df2 100644
--- a/sdk/logical/version.pb.go
+++ b/sdk/logical/version.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: sdk/logical/version.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -24,18 +25,16 @@ const (
 )
 
 type Empty struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Empty) Reset() {
 	*x = Empty{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_version_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_version_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Empty) String() string {
@@ -46,7 +45,7 @@ func (*Empty) ProtoMessage() {}
 
 func (x *Empty) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_version_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -63,20 +62,17 @@ func (*Empty) Descriptor() ([]byte, []int) {
 
 // VersionReply is the reply for the Version method.
 type VersionReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	PluginVersion string                 `protobuf:"bytes,1,opt,name=plugin_version,json=pluginVersion,proto3" json:"plugin_version,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	PluginVersion string `protobuf:"bytes,1,opt,name=plugin_version,json=pluginVersion,proto3" json:"plugin_version,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *VersionReply) Reset() {
 	*x = VersionReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_logical_version_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_logical_version_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *VersionReply) String() string {
@@ -87,7 +83,7 @@ func (*VersionReply) ProtoMessage() {}
 
 func (x *VersionReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_logical_version_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -111,7 +107,7 @@ func (x *VersionReply) GetPluginVersion() string {
 
 var File_sdk_logical_version_proto protoreflect.FileDescriptor
 
-var file_sdk_logical_version_proto_rawDesc = []byte{
+var file_sdk_logical_version_proto_rawDesc = string([]byte{
 	0x0a, 0x19, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2f, 0x76, 0x65,
 	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x6c, 0x6f, 0x67,
 	0x69, 0x63, 0x61, 0x6c, 0x22, 0x07, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x35, 0x0a,
@@ -126,22 +122,22 @@ var file_sdk_logical_version_proto_rawDesc = []byte{
 	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f,
 	0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61,
 	0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_sdk_logical_version_proto_rawDescOnce sync.Once
-	file_sdk_logical_version_proto_rawDescData = file_sdk_logical_version_proto_rawDesc
+	file_sdk_logical_version_proto_rawDescData []byte
 )
 
 func file_sdk_logical_version_proto_rawDescGZIP() []byte {
 	file_sdk_logical_version_proto_rawDescOnce.Do(func() {
-		file_sdk_logical_version_proto_rawDescData = protoimpl.X.CompressGZIP(file_sdk_logical_version_proto_rawDescData)
+		file_sdk_logical_version_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sdk_logical_version_proto_rawDesc), len(file_sdk_logical_version_proto_rawDesc)))
 	})
 	return file_sdk_logical_version_proto_rawDescData
 }
 
 var file_sdk_logical_version_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_sdk_logical_version_proto_goTypes = []interface{}{
+var file_sdk_logical_version_proto_goTypes = []any{
 	(*Empty)(nil),        // 0: logical.Empty
 	(*VersionReply)(nil), // 1: logical.VersionReply
 }
@@ -160,37 +156,11 @@ func file_sdk_logical_version_proto_init() {
 	if File_sdk_logical_version_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_sdk_logical_version_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Empty); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_logical_version_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*VersionReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_sdk_logical_version_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_logical_version_proto_rawDesc), len(file_sdk_logical_version_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   2,
 			NumExtensions: 0,
@@ -201,7 +171,6 @@ func file_sdk_logical_version_proto_init() {
 		MessageInfos:      file_sdk_logical_version_proto_msgTypes,
 	}.Build()
 	File_sdk_logical_version_proto = out.File
-	file_sdk_logical_version_proto_rawDesc = nil
 	file_sdk_logical_version_proto_goTypes = nil
 	file_sdk_logical_version_proto_depIdxs = nil
 }
diff --git a/sdk/logical/version.proto b/sdk/logical/version.proto
index 704e212056c..235bb1bd8d1 100644
--- a/sdk/logical/version.proto
+++ b/sdk/logical/version.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 syntax = "proto3";
diff --git a/sdk/logical/version_grpc.pb.go b/sdk/logical/version_grpc.pb.go
index bdb3561449a..0ec03fac1ef 100644
--- a/sdk/logical/version_grpc.pb.go
+++ b/sdk/logical/version_grpc.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: sdk/logical/version.proto
 
@@ -18,8 +18,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	PluginVersion_Version_FullMethodName = "/logical.PluginVersion/Version"
@@ -28,6 +28,8 @@ const (
 // PluginVersionClient is the client API for PluginVersion service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// PluginVersion is an optional RPC service implemented by plugins.
 type PluginVersionClient interface {
 	// Version returns version information for the plugin.
 	Version(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*VersionReply, error)
@@ -42,8 +44,9 @@ func NewPluginVersionClient(cc grpc.ClientConnInterface) PluginVersionClient {
 }
 
 func (c *pluginVersionClient) Version(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*VersionReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VersionReply)
-	err := c.cc.Invoke(ctx, PluginVersion_Version_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginVersion_Version_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -52,21 +55,27 @@ func (c *pluginVersionClient) Version(ctx context.Context, in *Empty, opts ...gr
 
 // PluginVersionServer is the server API for PluginVersion service.
 // All implementations must embed UnimplementedPluginVersionServer
-// for forward compatibility
+// for forward compatibility.
+//
+// PluginVersion is an optional RPC service implemented by plugins.
 type PluginVersionServer interface {
 	// Version returns version information for the plugin.
 	Version(context.Context, *Empty) (*VersionReply, error)
 	mustEmbedUnimplementedPluginVersionServer()
 }
 
-// UnimplementedPluginVersionServer must be embedded to have forward compatible implementations.
-type UnimplementedPluginVersionServer struct {
-}
+// UnimplementedPluginVersionServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedPluginVersionServer struct{}
 
 func (UnimplementedPluginVersionServer) Version(context.Context, *Empty) (*VersionReply, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Version not implemented")
 }
 func (UnimplementedPluginVersionServer) mustEmbedUnimplementedPluginVersionServer() {}
+func (UnimplementedPluginVersionServer) testEmbeddedByValue()                       {}
 
 // UnsafePluginVersionServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to PluginVersionServer will
@@ -76,6 +85,13 @@ type UnsafePluginVersionServer interface {
 }
 
 func RegisterPluginVersionServer(s grpc.ServiceRegistrar, srv PluginVersionServer) {
+	// If the following call pancis, it indicates UnimplementedPluginVersionServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&PluginVersion_ServiceDesc, srv)
 }
 
diff --git a/sdk/physical/cache.go b/sdk/physical/cache.go
index 3816609e2bc..eb190de7064 100644
--- a/sdk/physical/cache.go
+++ b/sdk/physical/cache.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
@@ -7,8 +7,8 @@ import (
 	"context"
 	"sync/atomic"
 
-	metrics "github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
+	metrics "github.com/hashicorp/go-metrics/compat"
 	lru "github.com/hashicorp/golang-lru"
 	"github.com/hashicorp/vault/sdk/helper/locksutil"
 	"github.com/hashicorp/vault/sdk/helper/pathmanager"
diff --git a/sdk/physical/cache_test.go b/sdk/physical/cache_test.go
index 7e9bf3232a0..15fd164901d 100644
--- a/sdk/physical/cache_test.go
+++ b/sdk/physical/cache_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/encoding.go b/sdk/physical/encoding.go
index af581207f9c..f37823b0c0e 100644
--- a/sdk/physical/encoding.go
+++ b/sdk/physical/encoding.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/encoding_test.go b/sdk/physical/encoding_test.go
index e4d9cceaa41..5f25e6d2798 100644
--- a/sdk/physical/encoding_test.go
+++ b/sdk/physical/encoding_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/entry.go b/sdk/physical/entry.go
index 1d907425dc0..3109730f7ac 100644
--- a/sdk/physical/entry.go
+++ b/sdk/physical/entry.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/error.go b/sdk/physical/error.go
index aa7418fd789..1bf0c26b5e8 100644
--- a/sdk/physical/error.go
+++ b/sdk/physical/error.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/error_test.go b/sdk/physical/error_test.go
index 779cd1bc1c9..e9d47a11d32 100644
--- a/sdk/physical/error_test.go
+++ b/sdk/physical/error_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/file/file.go b/sdk/physical/file/file.go
index ced5d9b93da..b527562a46c 100644
--- a/sdk/physical/file/file.go
+++ b/sdk/physical/file/file.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package file
@@ -17,6 +17,7 @@ import (
 
 	"github.com/hashicorp/errwrap"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/physical"
@@ -40,7 +41,7 @@ type FileBackend struct {
 	sync.RWMutex
 	path       string
 	logger     log.Logger
-	permitPool *physical.PermitPool
+	permitPool *permitpool.Pool
 }
 
 type TransactionalFileBackend struct {
@@ -61,7 +62,7 @@ func NewFileBackend(conf map[string]string, logger log.Logger) (physical.Backend
 	return &FileBackend{
 		path:       path,
 		logger:     logger,
-		permitPool: physical.NewPermitPool(physical.DefaultParallelOperations),
+		permitPool: permitpool.New(physical.DefaultParallelOperations),
 	}, nil
 }
 
@@ -76,13 +77,15 @@ func NewTransactionalFileBackend(conf map[string]string, logger log.Logger) (phy
 		FileBackend: FileBackend{
 			path:       path,
 			logger:     logger,
-			permitPool: physical.NewPermitPool(1),
+			permitPool: permitpool.New(1),
 		},
 	}, nil
 }
 
 func (b *FileBackend) Delete(ctx context.Context, path string) error {
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	b.Lock()
@@ -157,7 +160,9 @@ func (b *FileBackend) cleanupLogicalPath(path string) error {
 }
 
 func (b *FileBackend) Get(ctx context.Context, k string) (*physical.Entry, error) {
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer b.permitPool.Release()
 
 	b.RLock()
@@ -216,7 +221,9 @@ func (b *FileBackend) GetInternal(ctx context.Context, k string) (*physical.Entr
 }
 
 func (b *FileBackend) Put(ctx context.Context, entry *physical.Entry) error {
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	b.Lock()
@@ -295,7 +302,9 @@ func (b *FileBackend) PutInternal(ctx context.Context, entry *physical.Entry) er
 }
 
 func (b *FileBackend) List(ctx context.Context, prefix string) ([]string, error) {
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer b.permitPool.Release()
 
 	b.RLock()
@@ -376,7 +385,9 @@ func (b *FileBackend) validatePath(path string) error {
 }
 
 func (b *TransactionalFileBackend) Transaction(ctx context.Context, txns []*physical.TxnEntry) error {
-	b.permitPool.Acquire()
+	if err := b.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer b.permitPool.Release()
 
 	b.Lock()
diff --git a/sdk/physical/file/file_test.go b/sdk/physical/file/file_test.go
index 7fc6398c8df..317333a1ace 100644
--- a/sdk/physical/file/file_test.go
+++ b/sdk/physical/file/file_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package file
diff --git a/sdk/physical/inmem/cache_test.go b/sdk/physical/inmem/cache_test.go
index 3014fc1768d..22f4f170a99 100644
--- a/sdk/physical/inmem/cache_test.go
+++ b/sdk/physical/inmem/cache_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package inmem
@@ -7,8 +7,8 @@ import (
 	"context"
 	"testing"
 
-	"github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
+	metrics "github.com/hashicorp/go-metrics/compat"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/physical"
 )
diff --git a/sdk/physical/inmem/inmem.go b/sdk/physical/inmem/inmem.go
index 5f237e0616d..4365d7ff043 100644
--- a/sdk/physical/inmem/inmem.go
+++ b/sdk/physical/inmem/inmem.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package inmem
@@ -16,19 +16,21 @@ import (
 
 	"github.com/armon/go-radix"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/vault/sdk/physical"
 	uberAtomic "go.uber.org/atomic"
 )
 
 // Verify interfaces are satisfied
 var (
-	_ physical.Backend             = (*InmemBackend)(nil)
-	_ physical.HABackend           = (*InmemHABackend)(nil)
-	_ physical.HABackend           = (*TransactionalInmemHABackend)(nil)
-	_ physical.Lock                = (*InmemLock)(nil)
-	_ physical.Transactional       = (*TransactionalInmemBackend)(nil)
-	_ physical.Transactional       = (*TransactionalInmemHABackend)(nil)
-	_ physical.TransactionalLimits = (*TransactionalInmemBackend)(nil)
+	_ physical.Backend                   = (*InmemBackend)(nil)
+	_ physical.MountTableLimitingBackend = (*InmemBackend)(nil)
+	_ physical.HABackend                 = (*InmemHABackend)(nil)
+	_ physical.HABackend                 = (*TransactionalInmemHABackend)(nil)
+	_ physical.Lock                      = (*InmemLock)(nil)
+	_ physical.Transactional             = (*TransactionalInmemBackend)(nil)
+	_ physical.Transactional             = (*TransactionalInmemHABackend)(nil)
+	_ physical.TransactionalLimits       = (*TransactionalInmemBackend)(nil)
 )
 
 var (
@@ -45,7 +47,7 @@ var (
 type InmemBackend struct {
 	sync.RWMutex
 	root         *radix.Tree
-	permitPool   *physical.PermitPool
+	permitPool   *permitpool.Pool
 	logger       log.Logger
 	failGet      *uint32
 	failPut      *uint32
@@ -55,6 +57,8 @@ type InmemBackend struct {
 	logOps       bool
 	maxValueSize int
 	writeLatency time.Duration
+
+	mountTablePaths map[string]struct{}
 }
 
 type TransactionalInmemBackend struct {
@@ -62,13 +66,15 @@ type TransactionalInmemBackend struct {
 
 	// Using Uber atomic because our SemGrep rules don't like the old pointer
 	// trick we used above any more even though it's fine. The newer sync/atomic
-	// types are almost the same, but lack was to initialize them cleanly in New*
+	// types are almost the same, but lack ways to initialize them cleanly in New*
 	// functions so sticking with what SemGrep likes for now.
 	maxBatchEntries *uberAtomic.Int32
 	maxBatchSize    *uberAtomic.Int32
 
 	largestBatchLen  *uberAtomic.Uint64
 	largestBatchSize *uberAtomic.Uint64
+
+	transactionCompleteCh chan *txnCommitRequest
 }
 
 // NewInmem constructs a new in-memory backend
@@ -85,7 +91,7 @@ func NewInmem(conf map[string]string, logger log.Logger) (physical.Backend, erro
 
 	return &InmemBackend{
 		root:         radix.New(),
-		permitPool:   physical.NewPermitPool(physical.DefaultParallelOperations),
+		permitPool:   permitpool.New(physical.DefaultParallelOperations),
 		logger:       logger,
 		failGet:      new(uint32),
 		failPut:      new(uint32),
@@ -113,7 +119,7 @@ func NewTransactionalInmem(conf map[string]string, logger log.Logger) (physical.
 	return &TransactionalInmemBackend{
 		InmemBackend: InmemBackend{
 			root:         radix.New(),
-			permitPool:   physical.NewPermitPool(1),
+			permitPool:   permitpool.New(1),
 			logger:       logger,
 			failGet:      new(uint32),
 			failPut:      new(uint32),
@@ -144,7 +150,9 @@ func (i *InmemBackend) SetWriteLatency(latency time.Duration) {
 
 // Put is used to insert or update an entry
 func (i *InmemBackend) Put(ctx context.Context, entry *physical.Entry) error {
-	i.permitPool.Acquire()
+	if err := i.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer i.permitPool.Release()
 
 	i.Lock()
@@ -188,7 +196,9 @@ func (i *InmemBackend) FailPut(fail bool) {
 
 // Get is used to fetch an entry
 func (i *InmemBackend) Get(ctx context.Context, key string) (*physical.Entry, error) {
-	i.permitPool.Acquire()
+	if err := i.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer i.permitPool.Release()
 
 	i.RLock()
@@ -238,7 +248,9 @@ func (i *InmemBackend) FailGetInTxn(fail bool) {
 
 // Delete is used to permanently delete an entry
 func (i *InmemBackend) Delete(ctx context.Context, key string) error {
-	i.permitPool.Acquire()
+	if err := i.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer i.permitPool.Release()
 
 	i.Lock()
@@ -278,7 +290,9 @@ func (i *InmemBackend) FailDelete(fail bool) {
 // List is used to list all the keys under a given
 // prefix, up to the next prefix.
 func (i *InmemBackend) List(ctx context.Context, prefix string) ([]string, error) {
-	i.permitPool.Acquire()
+	if err := i.permitPool.Acquire(ctx); err != nil {
+		return nil, err
+	}
 	defer i.permitPool.Release()
 
 	i.RLock()
@@ -330,9 +344,29 @@ func (i *InmemBackend) FailList(fail bool) {
 	atomic.StoreUint32(i.failList, val)
 }
 
+// RegisterMountTablePath implements physical.MountTableLimitingBackend
+func (i *InmemBackend) RegisterMountTablePath(path string) {
+	if i.mountTablePaths == nil {
+		i.mountTablePaths = make(map[string]struct{})
+	}
+	i.mountTablePaths[path] = struct{}{}
+}
+
+// GetMountTablePaths returns any paths registered as mount table or namespace
+// metadata paths. It's intended for testing.
+func (i *InmemBackend) GetMountTablePaths() []string {
+	var paths []string
+	for path := range i.mountTablePaths {
+		paths = append(paths, path)
+	}
+	return paths
+}
+
 // Transaction implements the transaction interface
 func (t *TransactionalInmemBackend) Transaction(ctx context.Context, txns []*physical.TxnEntry) error {
-	t.permitPool.Acquire()
+	if err := t.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer t.permitPool.Release()
 
 	t.Lock()
@@ -341,9 +375,7 @@ func (t *TransactionalInmemBackend) Transaction(ctx context.Context, txns []*phy
 	failGetInTxn := atomic.LoadUint32(t.failGetInTxn)
 	size := uint64(0)
 	for _, t := range txns {
-		// We use 2x key length to match the logic in WALBackend.persistWALs
-		// presumably this is attempting to account for some amount of encoding
-		// overhead.
+		// We use 2x key length to match the logic in WALBackend.persistWALs.
 		size += uint64(2*len(t.Entry.Key) + len(t.Entry.Value))
 		if t.Operation == physical.GetOperation && failGetInTxn != 0 {
 			return GetInTxnDisabledError
@@ -357,7 +389,18 @@ func (t *TransactionalInmemBackend) Transaction(ctx context.Context, txns []*phy
 		t.largestBatchLen.Store(uint64(len(txns)))
 	}
 
-	return physical.GenericTransactionHandler(ctx, t, txns)
+	err := physical.GenericTransactionHandler(ctx, t, txns)
+
+	// If we have a transactionCompleteCh set, we block on it before returning.
+	if t.transactionCompleteCh != nil {
+		req := &txnCommitRequest{
+			txns: txns,
+			ch:   make(chan struct{}),
+		}
+		t.transactionCompleteCh <- req
+		<-req.ch
+	}
+	return err
 }
 
 func (t *TransactionalInmemBackend) SetMaxBatchEntries(entries int) {
@@ -375,3 +418,31 @@ func (t *TransactionalInmemBackend) TransactionLimits() (int, int) {
 func (t *TransactionalInmemBackend) BatchStats() (maxEntries uint64, maxSize uint64) {
 	return t.largestBatchLen.Load(), t.largestBatchSize.Load()
 }
+
+// TxnCommitChan returns a channel that allows deterministic control of when
+// transactions are executed. Each time `Transaction` is called on the backend,
+// a txnCommitRequest is sent on the chan returned and then Transaction will
+// block until Done is called on that request object. This allows tests to
+// deterministically wait until a persist is actually in progress, as well as
+// control when the persist completes. The returned chan is buffered with a
+// length of 5 which should be enough to ensure that test code doesn't deadlock
+// in normal operation since we typically only have one outstanding transaction
+// at at time.
+func (t *TransactionalInmemBackend) TxnCommitChan() <-chan *txnCommitRequest {
+	t.Lock()
+	defer t.Unlock()
+
+	ch := make(chan *txnCommitRequest, 5)
+	t.transactionCompleteCh = ch
+
+	return ch
+}
+
+type txnCommitRequest struct {
+	txns []*physical.TxnEntry
+	ch   chan struct{}
+}
+
+func (r *txnCommitRequest) Commit() {
+	close(r.ch)
+}
diff --git a/sdk/physical/inmem/inmem_ha.go b/sdk/physical/inmem/inmem_ha.go
index 1db26ca7461..6faf2f753af 100644
--- a/sdk/physical/inmem/inmem_ha.go
+++ b/sdk/physical/inmem/inmem_ha.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package inmem
@@ -83,6 +83,13 @@ func (i *InmemHABackend) HAEnabled() bool {
 	return true
 }
 
+func (i *InmemHABackend) Underlying() *InmemBackend {
+	if txBackend, ok := i.Backend.(*TransactionalInmemBackend); ok {
+		return &txBackend.InmemBackend
+	}
+	return i.Backend.(*InmemBackend)
+}
+
 // InmemLock is an in-memory Lock implementation for the HABackend
 type InmemLock struct {
 	in    *InmemHABackend
diff --git a/sdk/physical/inmem/inmem_ha_test.go b/sdk/physical/inmem/inmem_ha_test.go
index bb427a385e9..8d6200002ee 100644
--- a/sdk/physical/inmem/inmem_ha_test.go
+++ b/sdk/physical/inmem/inmem_ha_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package inmem
diff --git a/sdk/physical/inmem/inmem_test.go b/sdk/physical/inmem/inmem_test.go
index 56c029a4330..8e4e64d0095 100644
--- a/sdk/physical/inmem/inmem_test.go
+++ b/sdk/physical/inmem/inmem_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package inmem
diff --git a/sdk/physical/inmem/physical_view_test.go b/sdk/physical/inmem/physical_view_test.go
index 24b47d7ae7e..3d74554351b 100644
--- a/sdk/physical/inmem/physical_view_test.go
+++ b/sdk/physical/inmem/physical_view_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package inmem
diff --git a/sdk/physical/inmem/transactions_test.go b/sdk/physical/inmem/transactions_test.go
index 71a4829f966..22d29670c05 100644
--- a/sdk/physical/inmem/transactions_test.go
+++ b/sdk/physical/inmem/transactions_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package inmem
@@ -12,6 +12,7 @@ import (
 
 	radix "github.com/armon/go-radix"
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/physical"
 )
@@ -59,7 +60,9 @@ func (f *faultyPseudo) List(ctx context.Context, prefix string) ([]string, error
 }
 
 func (f *faultyPseudo) Transaction(ctx context.Context, txns []*physical.TxnEntry) error {
-	f.underlying.permitPool.Acquire()
+	if err := f.underlying.permitPool.Acquire(ctx); err != nil {
+		return err
+	}
 	defer f.underlying.permitPool.Release()
 
 	f.underlying.Lock()
@@ -72,7 +75,7 @@ func newFaultyPseudo(logger log.Logger, faultyPaths []string) *faultyPseudo {
 	out := &faultyPseudo{
 		underlying: InmemBackend{
 			root:       radix.New(),
-			permitPool: physical.NewPermitPool(1),
+			permitPool: permitpool.New(1),
 			logger:     logger.Named("storage.inmembackend"),
 			failGet:    new(uint32),
 			failPut:    new(uint32),
diff --git a/sdk/physical/latency.go b/sdk/physical/latency.go
index 56d045e3026..55b10225e2e 100644
--- a/sdk/physical/latency.go
+++ b/sdk/physical/latency.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/latency_test.go b/sdk/physical/latency_test.go
index 2585a04e0f1..9b00c7e867e 100644
--- a/sdk/physical/latency_test.go
+++ b/sdk/physical/latency_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/physical.go b/sdk/physical/physical.go
index 8a6e4883df7..9baa60795bb 100644
--- a/sdk/physical/physical.go
+++ b/sdk/physical/physical.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/permitpool"
 )
 
 const DefaultParallelOperations = 128
@@ -60,6 +61,25 @@ type HABackend interface {
 	HAEnabled() bool
 }
 
+// RemovableNodeHABackend is used for HA backends that can remove nodes from
+// their cluster
+type RemovableNodeHABackend interface {
+	HABackend
+
+	// IsNodeRemoved checks if the node with the given ID has been removed.
+	// This will only be called on the active node.
+	IsNodeRemoved(ctx context.Context, nodeID string) (bool, error)
+
+	// NodeID returns the ID for this node
+	NodeID() string
+
+	// IsRemoved checks if this node has been removed
+	IsRemoved() bool
+
+	// RemoveSelf marks this node as being removed
+	RemoveSelf() error
+}
+
 // FencingHABackend is an HABackend which provides the additional guarantee that
 // each Lock it returns from LockWith is also a FencingLock. A FencingLock
 // provides a mechanism to retrieve a fencing token that can be included by
@@ -139,6 +159,16 @@ type RedirectDetect interface {
 	DetectHostAddr() (string, error)
 }
 
+// MountTableLimitingBackend is an optional interface a Backend can implement
+// that allows it to support different entry size limits for mount-table-related
+// paths. It will only be called in Vault Enterprise.
+type MountTableLimitingBackend interface {
+	// RegisterMountTablePath informs the Backend that the given path represents
+	// part of the mount tables or related metadata. This allows the backend to
+	// apply different limits for this entry if configured to do so.
+	RegisterMountTablePath(path string)
+}
+
 type Lock interface {
 	// Lock is used to acquire the given lock
 	// The stopCh is optional and if closed should interrupt the lock
@@ -157,34 +187,24 @@ type Lock interface {
 type Factory func(config map[string]string, logger log.Logger) (Backend, error)
 
 // PermitPool is used to limit maximum outstanding requests
+// Deprecated: use permitpool.Pool from go-secure-stdlib.
 type PermitPool struct {
-	sem chan int
+	*permitpool.Pool
 }
 
 // NewPermitPool returns a new permit pool with the provided
-// number of permits
+// number of permits.
+// Deprecated: use permitpool.New from go-secure-stdlib.
 func NewPermitPool(permits int) *PermitPool {
-	if permits < 1 {
-		permits = DefaultParallelOperations
-	}
 	return &PermitPool{
-		sem: make(chan int, permits),
+		Pool: permitpool.New(permits),
 	}
 }
 
 // Acquire returns when a permit has been acquired
+// Deprecated: use permitpool.Acquire from go-secure-stdlib.
 func (c *PermitPool) Acquire() {
-	c.sem <- 1
-}
-
-// Release returns a permit to the pool
-func (c *PermitPool) Release() {
-	<-c.sem
-}
-
-// Get number of requests in the permit pool
-func (c *PermitPool) CurrentPermits() int {
-	return len(c.sem)
+	_ = c.Pool.Acquire(context.Background())
 }
 
 // Prefixes is a shared helper function returns all parent 'folders' for a
diff --git a/sdk/physical/physical_access.go b/sdk/physical/physical_access.go
index 048ee838566..212172fae39 100644
--- a/sdk/physical/physical_access.go
+++ b/sdk/physical/physical_access.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/physical_view.go b/sdk/physical/physical_view.go
index 0369e13778a..a80d41f7623 100644
--- a/sdk/physical/physical_view.go
+++ b/sdk/physical/physical_view.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/testing.go b/sdk/physical/testing.go
index 9b7d339284d..6a7fc905f0b 100644
--- a/sdk/physical/testing.go
+++ b/sdk/physical/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/physical/transactions.go b/sdk/physical/transactions.go
index de91689ffc5..21111b9e5d9 100644
--- a/sdk/physical/transactions.go
+++ b/sdk/physical/transactions.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package physical
diff --git a/sdk/plugin/backend.go b/sdk/plugin/backend.go
index 7ee591657ce..d8f9b6fc3e7 100644
--- a/sdk/plugin/backend.go
+++ b/sdk/plugin/backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/plugin/context.go b/sdk/plugin/context.go
new file mode 100644
index 00000000000..3d8dd76d3be
--- /dev/null
+++ b/sdk/plugin/context.go
@@ -0,0 +1,34 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/logical"
+	"google.golang.org/grpc/metadata"
+)
+
+// pbMetadataCtxToLogicalCtx extracts the snapshot ID key from an incoming GRPC
+// context and adds the logical context key to the returned context
+func pbMetadataCtxToLogicalCtx(ctx context.Context) context.Context {
+	var snapshotID string
+	snapshotIDs := metadata.ValueFromIncomingContext(ctx, snapshotIDCtxKey)
+	if len(snapshotIDs) > 0 {
+		snapshotID = snapshotIDs[0]
+	}
+	return logical.CreateContextWithSnapshotID(ctx, snapshotID)
+}
+
+// logicalCtxToPBMetadataCtx extracts the logical context snapshot ID key from
+// the context and appends it to an outgoing GRPC context
+func logicalCtxToPBMetadataCtx(ctx context.Context) context.Context {
+	snapshotID, ok := logical.ContextSnapshotIDValue(ctx)
+	if !ok {
+		return ctx
+	}
+	return metadata.AppendToOutgoingContext(ctx, snapshotIDCtxKey, snapshotID)
+}
+
+const snapshotIDCtxKey string = "snapshot_id"
diff --git a/sdk/plugin/grpc_backend.go b/sdk/plugin/grpc_backend.go
index f0114b94657..518b3dc2188 100644
--- a/sdk/plugin/grpc_backend.go
+++ b/sdk/plugin/grpc_backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/plugin/grpc_backend_client.go b/sdk/plugin/grpc_backend_client.go
index 4e92ad13ec5..d5d301c50a4 100644
--- a/sdk/plugin/grpc_backend_client.go
+++ b/sdk/plugin/grpc_backend_client.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
@@ -95,7 +95,8 @@ func (b *backendGRPCPluginClient) HandleRequest(ctx context.Context, req *logica
 		return nil, err
 	}
 
-	reply, err := b.client.HandleRequest(ctx, &pb.HandleRequestArgs{
+	reqCtx := logicalCtxToPBMetadataCtx(ctx)
+	reply, err := b.client.HandleRequest(reqCtx, &pb.HandleRequestArgs{
 		Request: protoReq,
 	}, largeMsgGRPCCallOpts...)
 	if err != nil {
@@ -132,6 +133,8 @@ func (b *backendGRPCPluginClient) SpecialPaths() *logical.Paths {
 		LocalStorage:          reply.Paths.LocalStorage,
 		SealWrapStorage:       reply.Paths.SealWrapStorage,
 		WriteForwardedStorage: reply.Paths.WriteForwardedStorage,
+		Limited:               reply.Paths.Limited,
+		AllowSnapshotRead:     reply.Paths.AllowSnapshotRead,
 	}
 }
 
@@ -231,23 +234,25 @@ func (b *backendGRPCPluginClient) Setup(ctx context.Context, config *logical.Bac
 	if b.metadataMode {
 		sysViewImpl = &logical.StaticSystemView{}
 	}
-	sysView := &gRPCSystemViewServer{
-		impl: sysViewImpl,
-	}
 
 	events := &GRPCEventsServer{
 		impl: config.EventsSender,
 	}
 
+	observations := &GRPCObservationsServer{
+		impl: config.ObservationRecorder,
+	}
+
 	// Register the server in this closure.
 	serverFunc := func(opts []grpc.ServerOption) *grpc.Server {
 		opts = append(opts, grpc.MaxRecvMsgSize(math.MaxInt32))
 		opts = append(opts, grpc.MaxSendMsgSize(math.MaxInt32))
 
 		s := grpc.NewServer(opts...)
-		pb.RegisterSystemViewServer(s, sysView)
+		registerSystemViewServer(s, sysViewImpl, config)
 		pb.RegisterStorageServer(s, storage)
 		pb.RegisterEventsServer(s, events)
+		pb.RegisterObservationsServer(s, observations)
 		b.server.Store(s)
 		close(b.cleanupCh)
 		return s
diff --git a/sdk/plugin/grpc_backend_client_stubs_oss.go b/sdk/plugin/grpc_backend_client_stubs_oss.go
new file mode 100644
index 00000000000..8544309fc50
--- /dev/null
+++ b/sdk/plugin/grpc_backend_client_stubs_oss.go
@@ -0,0 +1,20 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package plugin
+
+import (
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/plugin/pb"
+	"google.golang.org/grpc"
+)
+
+// registerSystemViewServer (Vault Community edition) registers the SystemView server
+// to the gRPC service registrar
+func registerSystemViewServer(s *grpc.Server, sysView logical.SystemView, _ *logical.BackendConfig) {
+	pb.RegisterSystemViewServer(s, &gRPCSystemViewServer{
+		impl: sysView,
+	})
+}
diff --git a/sdk/plugin/grpc_backend_server.go b/sdk/plugin/grpc_backend_server.go
index b537d41bb55..aa11b78433d 100644
--- a/sdk/plugin/grpc_backend_server.go
+++ b/sdk/plugin/grpc_backend_server.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
@@ -94,16 +94,17 @@ func (b *backendGRPCPluginServer) Setup(ctx context.Context, args *pb.SetupArgs)
 	}
 
 	storage := newGRPCStorageClient(brokeredClient)
-	sysView := newGRPCSystemView(brokeredClient)
 	events := newGRPCEventsClient(brokeredClient)
+	observations := newGRPCObservationsClient(brokeredClient)
 
 	config := &logical.BackendConfig{
-		StorageView:  storage,
-		Logger:       b.logger,
-		System:       sysView,
-		Config:       args.Config,
-		BackendUUID:  args.BackendUUID,
-		EventsSender: events,
+		StorageView:         storage,
+		Logger:              b.logger,
+		System:              newGRPCSystemViewFromSetupArgs(brokeredClient, args),
+		Config:              args.Config,
+		BackendUUID:         args.BackendUUID,
+		EventsSender:        events,
+		ObservationRecorder: observations,
 	}
 
 	// Call the underlying backend factory after shims have been created
@@ -142,7 +143,8 @@ func (b *backendGRPCPluginServer) HandleRequest(ctx context.Context, args *pb.Ha
 
 	logicalReq.Storage = newGRPCStorageClient(brokeredClient)
 
-	resp, respErr := backend.HandleRequest(ctx, logicalReq)
+	reqCtx := pbMetadataCtxToLogicalCtx(ctx)
+	resp, respErr := backend.HandleRequest(reqCtx, logicalReq)
 
 	pbResp, err := pb.LogicalResponseToProtoResponse(resp)
 	if err != nil {
@@ -198,6 +200,7 @@ func (b *backendGRPCPluginServer) SpecialPaths(ctx context.Context, args *pb.Emp
 			WriteForwardedStorage: paths.WriteForwardedStorage,
 			Binary:                paths.Binary,
 			Limited:               paths.Limited,
+			AllowSnapshotRead:     paths.AllowSnapshotRead,
 		},
 	}, nil
 }
diff --git a/sdk/plugin/grpc_backend_server_stubs_oss.go b/sdk/plugin/grpc_backend_server_stubs_oss.go
new file mode 100644
index 00000000000..ef59fb703bd
--- /dev/null
+++ b/sdk/plugin/grpc_backend_server_stubs_oss.go
@@ -0,0 +1,17 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+//go:build !enterprise
+
+package plugin
+
+import (
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/plugin/pb"
+	"google.golang.org/grpc"
+)
+
+// newGRPCSystemViewFromSetupArgs (Vault Community edition) constructs a gRPC SystemView client.
+func newGRPCSystemViewFromSetupArgs(conn *grpc.ClientConn, _ *pb.SetupArgs) logical.SystemView {
+	return newGRPCSystemView(conn)
+}
diff --git a/sdk/plugin/grpc_backend_test.go b/sdk/plugin/grpc_backend_test.go
index 880f09930fe..07e6b161777 100644
--- a/sdk/plugin/grpc_backend_test.go
+++ b/sdk/plugin/grpc_backend_test.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"testing"
 	"time"
@@ -14,6 +15,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/plugin/mock"
+	"github.com/stretchr/testify/require"
 )
 
 func TestGRPCBackendPlugin_impl(t *testing.T) {
@@ -40,6 +42,8 @@ func TestGRPCBackendPlugin_HandleRequest(t *testing.T) {
 	}
 }
 
+// TestGRPCBackendPlugin_SpecialPaths verifies that the special paths returned
+// by the plugin are not nil and that the AllowSnapshotRead path is not empty.
 func TestGRPCBackendPlugin_SpecialPaths(t *testing.T) {
 	b, cleanup := testGRPCBackend(t)
 	defer cleanup()
@@ -48,6 +52,92 @@ func TestGRPCBackendPlugin_SpecialPaths(t *testing.T) {
 	if paths == nil {
 		t.Fatal("SpecialPaths() returned nil")
 	}
+	if len(paths.AllowSnapshotRead) == 0 {
+		t.Fatalf("SpecialPaths() returned empty AllowSnapshotRead")
+	}
+}
+
+type requireSnapshotCtxStorage struct {
+	logical.Storage
+	snapshotID string
+}
+
+func (r *requireSnapshotCtxStorage) errorIfNoSnapshotID(ctx context.Context) error {
+	if snapshotID, _ := logical.ContextSnapshotIDValue(ctx); snapshotID != r.snapshotID {
+		return fmt.Errorf("missing snapshot ID")
+	}
+	return nil
+}
+
+func (r *requireSnapshotCtxStorage) Get(ctx context.Context, key string) (*logical.StorageEntry, error) {
+	if err := r.errorIfNoSnapshotID(ctx); err != nil {
+		return nil, err
+	}
+	return r.Storage.Get(ctx, key)
+}
+
+func (r *requireSnapshotCtxStorage) List(ctx context.Context, prefix string) ([]string, error) {
+	if err := r.errorIfNoSnapshotID(ctx); err != nil {
+		return nil, err
+	}
+	return r.Storage.List(ctx, prefix)
+}
+
+func (r *requireSnapshotCtxStorage) Delete(ctx context.Context, key string) error {
+	if err := r.errorIfNoSnapshotID(ctx); err != nil {
+		return err
+	}
+	return r.Storage.Delete(ctx, key)
+}
+
+func (r *requireSnapshotCtxStorage) Put(ctx context.Context, entry *logical.StorageEntry) error {
+	if err := r.errorIfNoSnapshotID(ctx); err != nil {
+		return err
+	}
+	return r.Storage.Put(ctx, entry)
+}
+
+// TestGRPCBackendPlugin_SnapshotCtx verifies that the backend plugin correctly
+// parses the snapshot ID context key and passes it to the storage methods.
+func TestGRPCBackendPlugin_SnapshotCtx(t *testing.T) {
+	storage := &requireSnapshotCtxStorage{Storage: &logical.InmemStorage{}, snapshotID: "abcd"}
+	b, cleanup := testGRPCBackendWithStorage(t, storage)
+	defer cleanup()
+	ctx := logical.CreateContextWithSnapshotID(context.Background(), "abcd")
+	// check put storage method
+	resp, err := b.HandleRequest(ctx, &logical.Request{
+		Operation: logical.CreateOperation,
+		Path:      "kv/foo",
+		Data: map[string]interface{}{
+			"value": "bar",
+		},
+	})
+	require.NoError(t, err)
+	require.NoError(t, resp.Error())
+
+	// check get storage method
+	resp, err = b.HandleRequest(ctx, &logical.Request{
+		Operation: logical.ReadOperation,
+		Path:      "kv/foo",
+	})
+	require.NoError(t, err)
+	require.NoError(t, resp.Error())
+
+	// check list storage method
+	resp, err = b.HandleRequest(ctx, &logical.Request{
+		Operation: logical.ListOperation,
+		Path:      "kv",
+	})
+	require.NoError(t, err)
+	require.NoError(t, resp.Error())
+
+	// check delete storage method
+	resp, err = b.HandleRequest(ctx, &logical.Request{
+		Operation: logical.DeleteOperation,
+		Path:      "kv/foo",
+	})
+	require.NoError(t, err)
+	require.NoError(t, resp.Error())
 }
 
 func TestGRPCBackendPlugin_System(t *testing.T) {
@@ -166,6 +256,10 @@ func TestGRPCBackendPlugin_Version(t *testing.T) {
 }
 
 func testGRPCBackend(t *testing.T) (logical.Backend, func()) {
+	return testGRPCBackendWithStorage(t, &logical.InmemStorage{})
+}
+
+func testGRPCBackendWithStorage(t *testing.T, storage logical.Storage) (logical.Backend, func()) {
 	// Create a mock provider
 	pluginMap := map[string]gplugin.Plugin{
 		"backend": &GRPCBackendPlugin{
@@ -195,7 +289,7 @@ func testGRPCBackend(t *testing.T) (logical.Backend, func()) {
 			DefaultLeaseTTLVal: 300 * time.Second,
 			MaxLeaseTTLVal:     1800 * time.Second,
 		},
-		StorageView: &logical.InmemStorage{},
+		StorageView: storage,
 	})
 	if err != nil {
 		t.Fatal(err)
diff --git a/sdk/plugin/grpc_events.go b/sdk/plugin/grpc_events.go
index 3a4d50cc938..664d3e2f82f 100644
--- a/sdk/plugin/grpc_events.go
+++ b/sdk/plugin/grpc_events.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/plugin/grpc_observations.go b/sdk/plugin/grpc_observations.go
new file mode 100644
index 00000000000..bdb8552d6d3
--- /dev/null
+++ b/sdk/plugin/grpc_observations.go
@@ -0,0 +1,55 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/plugin/pb"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func newGRPCObservationsClient(conn *grpc.ClientConn) *GRPCObservationsClient {
+	return &GRPCObservationsClient{
+		client: pb.NewObservationsClient(conn),
+	}
+}
+
+type GRPCObservationsClient struct {
+	client pb.ObservationsClient
+}
+
+var _ logical.ObservationRecorder = (*GRPCObservationsClient)(nil)
+
+func (s *GRPCObservationsClient) RecordObservationFromPlugin(ctx context.Context, observationType string, data map[string]interface{}) error {
+	dataAsPb, err := structpb.NewStruct(data)
+	if err != nil {
+		return err
+	}
+
+	_, err = s.client.RecordObservation(ctx, &pb.RecordObservationRequest{
+		ObservationType: observationType,
+		Data:            dataAsPb,
+	})
+	return err
+}
+
+type GRPCObservationsServer struct {
+	pb.UnimplementedObservationsServer
+	impl logical.ObservationRecorder
+}
+
+func (s *GRPCObservationsServer) RecordObservation(ctx context.Context, req *pb.RecordObservationRequest) (*pb.Empty, error) {
+	if s.impl == nil {
+		return &pb.Empty{}, nil
+	}
+
+	err := s.impl.RecordObservationFromPlugin(ctx, req.ObservationType, req.Data.AsMap())
+	if err != nil {
+		return nil, err
+	}
+	return &pb.Empty{}, nil
+}
diff --git a/sdk/plugin/grpc_storage.go b/sdk/plugin/grpc_storage.go
index 638f4b0dd7a..80286a20cb0 100644
--- a/sdk/plugin/grpc_storage.go
+++ b/sdk/plugin/grpc_storage.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
@@ -27,6 +27,7 @@ type GRPCStorageClient struct {
 }
 
 func (s *GRPCStorageClient) List(ctx context.Context, prefix string) ([]string, error) {
+	ctx = logicalCtxToPBMetadataCtx(ctx)
 	reply, err := s.client.List(ctx, &pb.StorageListArgs{
 		Prefix: prefix,
 	}, largeMsgGRPCCallOpts...)
@@ -40,6 +41,7 @@ func (s *GRPCStorageClient) List(ctx context.Context, prefix string) ([]string,
 }
 
 func (s *GRPCStorageClient) Get(ctx context.Context, key string) (*logical.StorageEntry, error) {
+	ctx = logicalCtxToPBMetadataCtx(ctx)
 	reply, err := s.client.Get(ctx, &pb.StorageGetArgs{
 		Key: key,
 	}, largeMsgGRPCCallOpts...)
@@ -53,6 +55,7 @@ func (s *GRPCStorageClient) Get(ctx context.Context, key string) (*logical.Stora
 }
 
 func (s *GRPCStorageClient) Put(ctx context.Context, entry *logical.StorageEntry) error {
+	ctx = logicalCtxToPBMetadataCtx(ctx)
 	reply, err := s.client.Put(ctx, &pb.StoragePutArgs{
 		Entry: pb.LogicalStorageEntryToProtoStorageEntry(entry),
 	}, largeMsgGRPCCallOpts...)
@@ -66,6 +69,7 @@ func (s *GRPCStorageClient) Put(ctx context.Context, entry *logical.StorageEntry
 }
 
 func (s *GRPCStorageClient) Delete(ctx context.Context, key string) error {
+	ctx = logicalCtxToPBMetadataCtx(ctx)
 	reply, err := s.client.Delete(ctx, &pb.StorageDeleteArgs{
 		Key: key,
 	})
@@ -88,6 +92,7 @@ func (s *GRPCStorageServer) List(ctx context.Context, args *pb.StorageListArgs)
 	if s.impl == nil {
 		return nil, errMissingStorage
 	}
+	ctx = pbMetadataCtxToLogicalCtx(ctx)
 	keys, err := s.impl.List(ctx, args.Prefix)
 	return &pb.StorageListReply{
 		Keys: keys,
@@ -99,6 +104,7 @@ func (s *GRPCStorageServer) Get(ctx context.Context, args *pb.StorageGetArgs) (*
 	if s.impl == nil {
 		return nil, errMissingStorage
 	}
+	ctx = pbMetadataCtxToLogicalCtx(ctx)
 	storageEntry, err := s.impl.Get(ctx, args.Key)
 	if storageEntry == nil {
 		return &pb.StorageGetReply{
@@ -116,6 +122,7 @@ func (s *GRPCStorageServer) Put(ctx context.Context, args *pb.StoragePutArgs) (*
 	if s.impl == nil {
 		return nil, errMissingStorage
 	}
+	ctx = pbMetadataCtxToLogicalCtx(ctx)
 	err := s.impl.Put(ctx, pb.ProtoStorageEntryToLogicalStorageEntry(args.Entry))
 	return &pb.StoragePutReply{
 		Err: pb.ErrToString(err),
@@ -126,6 +133,7 @@ func (s *GRPCStorageServer) Delete(ctx context.Context, args *pb.StorageDeleteAr
 	if s.impl == nil {
 		return nil, errMissingStorage
 	}
+	ctx = pbMetadataCtxToLogicalCtx(ctx)
 	err := s.impl.Delete(ctx, args.Key)
 	return &pb.StorageDeleteReply{
 		Err: pb.ErrToString(err),
diff --git a/sdk/plugin/grpc_system.go b/sdk/plugin/grpc_system.go
index 405d03163a1..9630af0ba1b 100644
--- a/sdk/plugin/grpc_system.go
+++ b/sdk/plugin/grpc_system.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
@@ -16,6 +16,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/wrapping"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/plugin/pb"
+	"github.com/hashicorp/vault/sdk/rotation"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -226,6 +227,55 @@ func (s *gRPCSystemViewClient) GenerateIdentityToken(ctx context.Context, req *p
 	}, nil
 }
 
+func (s *gRPCSystemViewClient) GetRotationInformation(ctx context.Context, req *rotation.RotationInfoRequest) (*rotation.RotationInfoResponse, error) {
+	resp, err := s.client.GetRotationInformation(ctx, &pb.RotationInfoRequest{
+		MountPath: req.ReqPath,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &rotation.RotationInfoResponse{
+		NextVaultRotation: time.Unix(resp.ExpireTime, 0),
+		LastVaultRotation: time.Unix(resp.IssueTime, 0),
+		TTL:               resp.TTL,
+	}, nil
+}
+
+func (s *gRPCSystemViewClient) RegisterRotationJob(ctx context.Context, req *rotation.RotationJobConfigureRequest) (id string, retErr error) {
+	cfgReq := &pb.RegisterRotationJobRequest{
+		Job: &pb.RotationJobInput{
+			Name:             req.Name,
+			MountPoint:       req.MountPoint,
+			Path:             req.ReqPath,
+			RotationSchedule: req.RotationSchedule,
+
+			// on the side outbound from the plugin, we convert duration to seconds, so seconds get sent over the wire
+			RotationWindow: int64(req.RotationWindow.Seconds()),
+			RotationPeriod: int64(req.RotationPeriod.Seconds()),
+		},
+	}
+	resp, err := s.client.RegisterRotationJob(ctx, cfgReq)
+	if err != nil {
+		return "", err
+	}
+	return resp.RotationID, nil
+}
+
+func (s *gRPCSystemViewClient) DeregisterRotationJob(ctx context.Context, req *rotation.RotationJobDeregisterRequest) error {
+	_, err := s.client.DeregisterRotationJob(ctx, &pb.DeregisterRotationJobRequest{
+		Req: &pb.DeregisterRotationRequestInput{
+			MountPoint: req.MountPoint,
+			ReqPath:    req.ReqPath,
+		},
+	})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 type gRPCSystemViewServer struct {
 	pb.UnimplementedSystemViewServer
 
@@ -420,8 +470,7 @@ func (s *gRPCSystemViewServer) GenerateIdentityToken(ctx context.Context, req *p
 		TTL:      time.Duration(req.GetTTL()) * time.Second,
 	})
 	if err != nil {
-		return &pb.GenerateIdentityTokenResponse{}, status.Errorf(codes.Internal,
-			"failed to generate plugin identity token")
+		return &pb.GenerateIdentityTokenResponse{}, status.Error(codes.Internal, err.Error())
 	}
 
 	return &pb.GenerateIdentityTokenResponse{
@@ -429,3 +478,73 @@ func (s *gRPCSystemViewServer) GenerateIdentityToken(ctx context.Context, req *p
 		TTL:   int64(res.TTL.Seconds()),
 	}, nil
 }
+
+func (s *gRPCSystemViewServer) GetRotationInformation(ctx context.Context, req *pb.RotationInfoRequest) (*pb.RotationInfoReply, error) {
+	if s.impl == nil {
+		return nil, errMissingSystemView
+	}
+
+	cfgReq := &rotation.RotationInfoRequest{
+		ReqPath: req.MountPath,
+	}
+
+	resp, err := s.impl.GetRotationInformation(ctx, cfgReq)
+	if err != nil {
+		return &pb.RotationInfoReply{}, status.Error(codes.Internal, err.Error())
+	}
+
+	return &pb.RotationInfoReply{
+		IssueTime:  resp.LastVaultRotation.Unix(),
+		ExpireTime: resp.NextVaultRotation.Unix(),
+		TTL:        resp.TTL,
+	}, nil
+}
+
+func (s *gRPCSystemViewServer) RegisterRotationJob(ctx context.Context, req *pb.RegisterRotationJobRequest) (*pb.RegisterRotationJobResponse, error) {
+	if s.impl == nil {
+		return nil, errMissingSystemView
+	}
+
+	cfgReq := &rotation.RotationJobConfigureRequest{
+		Name:             req.Job.Name,
+		MountPoint:       req.Job.MountPoint,
+		ReqPath:          req.Job.Path,
+		RotationSchedule: req.Job.RotationSchedule,
+		// on the side inbound to vault, we convert seconds back to time.Duration
+		// Note: this value is seconds (as per the outbound client call, despite being int64)
+		// The field is int64 because of gRPC reasons, not time.Duration reasons
+		RotationWindow: time.Duration(req.Job.RotationWindow) * time.Second,
+		RotationPeriod: time.Duration(req.Job.RotationPeriod) * time.Second,
+	}
+
+	rotationID, err := s.impl.RegisterRotationJob(ctx, cfgReq)
+	if err != nil {
+		return &pb.RegisterRotationJobResponse{}, status.Error(codes.Internal, err.Error())
+	}
+
+	return &pb.RegisterRotationJobResponse{
+		RotationID: rotationID,
+	}, nil
+}
+
+func (s *gRPCSystemViewServer) DeregisterRotationJob(ctx context.Context, req *pb.DeregisterRotationJobRequest) (*pb.Empty, error) {
+	if s.impl == nil {
+		return &pb.Empty{}, errMissingSystemView
+	}
+
+	cfgReq := &rotation.RotationJobDeregisterRequest{
+		MountPoint: req.Req.MountPoint,
+		ReqPath:    req.Req.ReqPath,
+	}
+
+	err := s.impl.DeregisterRotationJob(ctx, cfgReq)
+	if err != nil {
+		return &pb.Empty{}, status.Error(codes.Internal, err.Error())
+	}
+
+	return &pb.Empty{}, nil
+}
+
+func (s *gRPCSystemViewClient) DownloadExtractVerifyPlugin(_ context.Context, _ *pluginutil.PluginRunner) error {
+	return fmt.Errorf("cannot call DownloadExtractVerifyPlugin from a plugin backend")
+}
diff --git a/sdk/plugin/grpc_system_test.go b/sdk/plugin/grpc_system_test.go
index 19a5ecbaaee..0997e9e6505 100644
--- a/sdk/plugin/grpc_system_test.go
+++ b/sdk/plugin/grpc_system_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/plugin/logger.go b/sdk/plugin/logger.go
index 1ef4694e9b8..c90ac829094 100644
--- a/sdk/plugin/logger.go
+++ b/sdk/plugin/logger.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/plugin/logger_test.go b/sdk/plugin/logger_test.go
index c47a70b1c57..ccb8fc2fd27 100644
--- a/sdk/plugin/logger_test.go
+++ b/sdk/plugin/logger_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/plugin/middleware.go b/sdk/plugin/middleware.go
index 4411c788297..9c47594f8d1 100644
--- a/sdk/plugin/middleware.go
+++ b/sdk/plugin/middleware.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/plugin/mock/backend.go b/sdk/plugin/mock/backend.go
index b34191b938a..a3016581476 100644
--- a/sdk/plugin/mock/backend.go
+++ b/sdk/plugin/mock/backend.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package mock
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"testing"
@@ -56,6 +57,7 @@ func Backend() *backend {
 			errorPaths(&b),
 			kvPaths(&b),
 			[]*framework.Path{
+				pathConfig(&b),
 				pathInternal(&b),
 				pathSpecial(&b),
 				pathRaw(&b),
@@ -66,10 +68,15 @@ func Backend() *backend {
 			Unauthenticated: []string{
 				"special",
 			},
+			AllowSnapshotRead: []string{
+				"kv/*",
+				"kv",
+			},
 		},
-		Secrets:     []*framework.Secret{},
-		Invalidate:  b.invalidate,
-		BackendType: logical.TypeLogical,
+		Secrets:          []*framework.Secret{},
+		Invalidate:       b.invalidate,
+		BackendType:      logical.TypeLogical,
+		RotateCredential: b.rotateRootCredential,
 	}
 	b.internal = MockPluginDefaultInternalValue
 	b.RunningVersion = "v0.0.0+mock"
@@ -128,3 +135,19 @@ func expectInternalValue(t *testing.T, client *api.Client, mountPath, expected s
 		t.Fatalf("expected %q but got %q", expected, resp.Data["value"].(string))
 	}
 }
+
+func (b *backend) rotateRootCredential(ctx context.Context, req *logical.Request) error {
+	b.Logger().Debug("mock rotateRootCredential")
+
+	cfg, err := b.configEntry(ctx, req.Storage)
+	if err != nil {
+		return err
+	}
+
+	if cfg.FailRotate {
+		return errors.New("mock plugin was asked to fail to rotate")
+	}
+
+	b.internal = "rotated"
+	return nil
+}
diff --git a/sdk/plugin/mock/backend_test.go b/sdk/plugin/mock/backend_test.go
index 640eec11643..41ceaf490f2 100644
--- a/sdk/plugin/mock/backend_test.go
+++ b/sdk/plugin/mock/backend_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package mock
diff --git a/sdk/plugin/mock/path_config.go b/sdk/plugin/mock/path_config.go
new file mode 100644
index 00000000000..43cad0bb372
--- /dev/null
+++ b/sdk/plugin/mock/path_config.go
@@ -0,0 +1,152 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package mock
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/automatedrotationutil"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/rotation"
+)
+
+// pathConfig is used to test auto rotation.
+func pathConfig(b *backend) *framework.Path {
+	p := &framework.Path{
+		Pattern: "config",
+		Fields: map[string]*framework.FieldSchema{
+			"fail_rotate": {
+				Type: framework.TypeBool,
+			},
+		},
+		Callbacks: map[logical.Operation]framework.OperationFunc{
+			logical.CreateOperation: b.pathConfigUpdate,
+			logical.UpdateOperation: b.pathConfigUpdate,
+			logical.ReadOperation:   b.pathConfigRead,
+		},
+		ExistenceCheck: b.pathConfigExistenceCheck,
+	}
+	automatedrotationutil.AddAutomatedRotationFields(p.Fields)
+	return p
+}
+
+func (b *backend) pathConfigUpdate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	conf, err := b.configEntry(ctx, req.Storage)
+	if err != nil {
+		return nil, err
+	}
+	if conf == nil {
+		conf = &config{}
+	}
+
+	if failRotateRaw, ok := data.GetOk("fail_rotate"); ok {
+		conf.FailRotate = failRotateRaw.(bool)
+	}
+
+	if err := conf.ParseAutomatedRotationFields(data); err != nil {
+		return logical.ErrorResponse(err.Error()), nil
+	}
+
+	if conf.ShouldDeregisterRotationJob() {
+		deregisterReq := &rotation.RotationJobDeregisterRequest{
+			MountPoint: req.MountPoint,
+			ReqPath:    req.Path,
+		}
+
+		b.Logger().Debug("Deregistering rotation job", "mount", req.MountPoint+req.Path)
+		if err := b.System().DeregisterRotationJob(ctx, deregisterReq); err != nil {
+			return logical.ErrorResponse("error deregistering rotation job: %s", err), nil
+		}
+	} else if conf.ShouldRegisterRotationJob() {
+		cfgReq := &rotation.RotationJobConfigureRequest{
+			MountPoint:       req.MountPoint,
+			ReqPath:          req.Path,
+			RotationSchedule: conf.RotationSchedule,
+			RotationWindow:   conf.RotationWindow,
+			RotationPeriod:   conf.RotationPeriod,
+		}
+
+		b.Logger().Debug("Registering rotation job", "mount", req.MountPoint+req.Path)
+		if _, err = b.System().RegisterRotationJob(ctx, cfgReq); err != nil {
+			return logical.ErrorResponse("error registering rotation job: %s", err), nil
+		}
+	}
+
+	entry, err := logical.StorageEntryJSON("config", conf)
+	if err != nil {
+		return nil, err
+	}
+	if err := req.Storage.Put(ctx, entry); err != nil {
+		return nil, err
+	}
+	return nil, nil
+}
+
+func (b *backend) pathConfigRead(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	conf, err := b.configEntry(ctx, req.Storage)
+	if err != nil {
+		return nil, err
+	}
+
+	if conf == nil {
+		return nil, nil
+	}
+
+	configData := map[string]interface{}{}
+	conf.PopulateAutomatedRotationData(configData)
+
+	if conf.HasNonzeroRotationValues() {
+		resp, err := b.System().GetRotationInformation(ctx, &rotation.RotationInfoRequest{ReqPath: req.Path})
+		if err != nil {
+			return nil, err
+		}
+		if resp != nil {
+			configData["expire_time"] = resp.NextVaultRotation.Unix()
+			configData["creation_time"] = resp.LastVaultRotation.Unix()
+			configData["ttl"] = int64(resp.TTL)
+		}
+	}
+
+	return &logical.Response{
+		Data: configData,
+	}, nil
+}
+
+func (b *backend) pathConfigDelete(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	if err := req.Storage.Delete(ctx, "config"); err != nil {
+		return nil, err
+	}
+	return nil, nil
+}
+
+func (b *backend) pathConfigExistenceCheck(ctx context.Context, req *logical.Request, data *framework.FieldData) (bool, error) {
+	entry, err := b.configEntry(ctx, req.Storage)
+	if err != nil {
+		return false, err
+	}
+	return entry != nil, nil
+}
+
+// Fetch the client configuration required to access the AWS API.
+func (b *backend) configEntry(ctx context.Context, s logical.Storage) (*config, error) {
+	entry, err := s.Get(ctx, "config")
+	if err != nil {
+		return nil, err
+	}
+	if entry == nil {
+		return nil, nil
+	}
+
+	var result config
+	if err := entry.DecodeJSON(&result); err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
+type config struct {
+	FailRotate bool
+	automatedrotationutil.AutomatedRotationParams
+}
diff --git a/sdk/plugin/mock/path_env.go b/sdk/plugin/mock/path_env.go
index 18b4b71ccc3..699e607c0ce 100644
--- a/sdk/plugin/mock/path_env.go
+++ b/sdk/plugin/mock/path_env.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package mock
diff --git a/sdk/plugin/mock/path_errors.go b/sdk/plugin/mock/path_errors.go
index 9c765c67ad3..2bd3da1a63f 100644
--- a/sdk/plugin/mock/path_errors.go
+++ b/sdk/plugin/mock/path_errors.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package mock
diff --git a/sdk/plugin/mock/path_internal.go b/sdk/plugin/mock/path_internal.go
index 30c2926f5cf..8a76d40cf41 100644
--- a/sdk/plugin/mock/path_internal.go
+++ b/sdk/plugin/mock/path_internal.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package mock
diff --git a/sdk/plugin/mock/path_kv.go b/sdk/plugin/mock/path_kv.go
index fd8080572cd..f0db6e232d8 100644
--- a/sdk/plugin/mock/path_kv.go
+++ b/sdk/plugin/mock/path_kv.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package mock
diff --git a/sdk/plugin/mock/path_raw.go b/sdk/plugin/mock/path_raw.go
index 2a4b77fb731..453e4bf4bc3 100644
--- a/sdk/plugin/mock/path_raw.go
+++ b/sdk/plugin/mock/path_raw.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package mock
diff --git a/sdk/plugin/mock/path_special.go b/sdk/plugin/mock/path_special.go
index 4223f91053d..acae1385c0f 100644
--- a/sdk/plugin/mock/path_special.go
+++ b/sdk/plugin/mock/path_special.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package mock
diff --git a/sdk/plugin/pb/backend.pb.go b/sdk/plugin/pb/backend.pb.go
index cf5839cb1bf..986588161b1 100644
--- a/sdk/plugin/pb/backend.pb.go
+++ b/sdk/plugin/pb/backend.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: sdk/plugin/pb/backend.proto
 
@@ -13,9 +13,11 @@ import (
 	logical "github.com/hashicorp/vault/sdk/logical"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	structpb "google.golang.org/protobuf/types/known/structpb"
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -26,18 +28,16 @@ const (
 )
 
 type Empty struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Empty) Reset() {
 	*x = Empty{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Empty) String() string {
@@ -48,7 +48,7 @@ func (*Empty) ProtoMessage() {}
 
 func (x *Empty) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -64,20 +64,17 @@ func (*Empty) Descriptor() ([]byte, []int) {
 }
 
 type Header struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Header        []string               `protobuf:"bytes,1,rep,name=header,proto3" json:"header,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Header []string `protobuf:"bytes,1,rep,name=header,proto3" json:"header,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Header) Reset() {
 	*x = Header{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Header) String() string {
@@ -88,7 +85,7 @@ func (*Header) ProtoMessage() {}
 
 func (x *Header) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -111,10 +108,7 @@ func (x *Header) GetHeader() []string {
 }
 
 type ProtoError struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Error type can be one of:
 	// ErrTypeUnknown uint32 = iota
 	// ErrTypeUserError
@@ -127,18 +121,18 @@ type ProtoError struct {
 	// ErrTypePermissionDenied
 	// ErrTypeMultiAuthzPending
 	// ErrTypeUnrecoverable
-	ErrType uint32 `protobuf:"varint,1,opt,name=err_type,json=errType,proto3" json:"err_type,omitempty"`
-	ErrMsg  string `protobuf:"bytes,2,opt,name=err_msg,json=errMsg,proto3" json:"err_msg,omitempty"`
-	ErrCode int64  `protobuf:"varint,3,opt,name=err_code,json=errCode,proto3" json:"err_code,omitempty"`
+	ErrType       uint32 `protobuf:"varint,1,opt,name=err_type,json=errType,proto3" json:"err_type,omitempty"`
+	ErrMsg        string `protobuf:"bytes,2,opt,name=err_msg,json=errMsg,proto3" json:"err_msg,omitempty"`
+	ErrCode       int64  `protobuf:"varint,3,opt,name=err_code,json=errCode,proto3" json:"err_code,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ProtoError) Reset() {
 	*x = ProtoError{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ProtoError) String() string {
@@ -149,7 +143,7 @@ func (*ProtoError) ProtoMessage() {}
 
 func (x *ProtoError) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -187,10 +181,7 @@ func (x *ProtoError) GetErrCode() int64 {
 
 // Paths is the structure of special paths that is used for SpecialPaths.
 type Paths struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Root are the paths that require a root token to access
 	Root []string `protobuf:"bytes,1,rep,name=root,proto3" json:"root,omitempty"`
 	// Unauthenticated are the paths that can be accessed without any auth.
@@ -216,15 +207,19 @@ type Paths struct {
 	//
 	// See note in /sdk/logical/logical.go.
 	Limited []string `protobuf:"bytes,7,rep,name=limited,proto3" json:"limited,omitempty"`
+	// AllowSnapshotRead paths are allowed to be read from a loaded snapshot
+	//
+	// See note in /sdk/logical/logical.go
+	AllowSnapshotRead []string `protobuf:"bytes,8,rep,name=allow_snapshot_read,json=allowSnapshotRead,proto3" json:"allow_snapshot_read,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *Paths) Reset() {
 	*x = Paths{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Paths) String() string {
@@ -235,7 +230,7 @@ func (*Paths) ProtoMessage() {}
 
 func (x *Paths) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -299,11 +294,15 @@ func (x *Paths) GetLimited() []string {
 	return nil
 }
 
-type Request struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *Paths) GetAllowSnapshotRead() []string {
+	if x != nil {
+		return x.AllowSnapshotRead
+	}
+	return nil
+}
 
+type Request struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// ID is the uuid associated with each request
 	ID string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
 	// If set, the name given to the replication secondary where this request
@@ -327,7 +326,7 @@ type Request struct {
 	// Headers will contain the http headers from the request. This value will
 	// be used in the audit broker to ensure we are auditing only the allowed
 	// headers.
-	Headers map[string]*Header `protobuf:"bytes,8,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Headers map[string]*Header `protobuf:"bytes,8,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// ClientToken is provided to the core so that the identity
 	// can be verified and ACLs applied. This value is passed
 	// through to the logical backends but after being salted and
@@ -370,15 +369,23 @@ type Request struct {
 	// inspect the connection information and potentially use it for
 	// authentication/protection.
 	Connection *Connection `protobuf:"bytes,20,opt,name=connection,proto3" json:"connection,omitempty"`
+	// RequiresSnapshotID will be present when the request is a list, read, or
+	// recover from snapshot operation
+	RequiresSnapshotID string `protobuf:"bytes,21,opt,name=requires_snapshot_id,json=requiresSnapshotId,proto3" json:"requires_snapshot_id,omitempty"`
+	// RecoverSourcePath is the path where a recover request should read the data
+	// from. This can be empty if the request is not a recover request, or if the
+	// request is a recover request where the source path is the same as the
+	// destination path
+	RecoverSourcePath string `protobuf:"bytes,22,opt,name=recover_source_path,json=recoverSourcePath,proto3" json:"recover_source_path,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *Request) Reset() {
 	*x = Request{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Request) String() string {
@@ -389,7 +396,7 @@ func (*Request) ProtoMessage() {}
 
 func (x *Request) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -544,12 +551,23 @@ func (x *Request) GetConnection() *Connection {
 	return nil
 }
 
-type Auth struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *Request) GetRequiresSnapshotID() string {
+	if x != nil {
+		return x.RequiresSnapshotID
+	}
+	return ""
+}
+
+func (x *Request) GetRecoverSourcePath() string {
+	if x != nil {
+		return x.RecoverSourcePath
+	}
+	return ""
+}
 
-	LeaseOptions *LeaseOptions `protobuf:"bytes,1,opt,name=lease_options,json=leaseOptions,proto3" json:"lease_options,omitempty"`
+type Auth struct {
+	state        protoimpl.MessageState `protogen:"open.v1"`
+	LeaseOptions *LeaseOptions          `protobuf:"bytes,1,opt,name=lease_options,json=leaseOptions,proto3" json:"lease_options,omitempty"`
 	// InternalData is a JSON object that is stored with the auth struct.
 	// This will be sent back during a Renew/Revoke for storing internal data
 	// used for those operations.
@@ -567,7 +585,7 @@ type Auth struct {
 	// Metadata is used to attach arbitrary string-type metadata to
 	// an authenticated user. This metadata will be outputted into the
 	// audit log.
-	Metadata map[string]string `protobuf:"bytes,5,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Metadata map[string]string `protobuf:"bytes,5,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// ClientToken is the token that is generated for the authentication.
 	// This will be filled in by Vault core when an auth structure is
 	// returned. Setting this manually will have no effect.
@@ -609,15 +627,15 @@ type Auth struct {
 	TokenType uint32 `protobuf:"varint,17,opt,name=token_type,json=tokenType,proto3" json:"token_type,omitempty"`
 	// Whether the default policy should be added automatically by core
 	NoDefaultPolicy bool `protobuf:"varint,18,opt,name=no_default_policy,json=noDefaultPolicy,proto3" json:"no_default_policy,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *Auth) Reset() {
 	*x = Auth{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Auth) String() string {
@@ -628,7 +646,7 @@ func (*Auth) ProtoMessage() {}
 
 func (x *Auth) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -770,41 +788,38 @@ func (x *Auth) GetNoDefaultPolicy() bool {
 }
 
 type TokenEntry struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	ID                 string            `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Accessor           string            `protobuf:"bytes,2,opt,name=accessor,proto3" json:"accessor,omitempty"`
-	Parent             string            `protobuf:"bytes,3,opt,name=parent,proto3" json:"parent,omitempty"`
-	Policies           []string          `protobuf:"bytes,4,rep,name=policies,proto3" json:"policies,omitempty"`
-	Path               string            `protobuf:"bytes,5,opt,name=path,proto3" json:"path,omitempty"`
-	Meta               map[string]string `protobuf:"bytes,6,rep,name=meta,proto3" json:"meta,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	DisplayName        string            `protobuf:"bytes,7,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
-	NumUses            int64             `protobuf:"varint,8,opt,name=num_uses,json=numUses,proto3" json:"num_uses,omitempty"`
-	CreationTime       int64             `protobuf:"varint,9,opt,name=creation_time,json=creationTime,proto3" json:"creation_time,omitempty"`
-	TTL                int64             `protobuf:"varint,10,opt,name=ttl,proto3" json:"ttl,omitempty"`
-	ExplicitMaxTTL     int64             `protobuf:"varint,11,opt,name=explicit_max_ttl,json=explicitMaxTtl,proto3" json:"explicit_max_ttl,omitempty"`
-	Role               string            `protobuf:"bytes,12,opt,name=role,proto3" json:"role,omitempty"`
-	Period             int64             `protobuf:"varint,13,opt,name=period,proto3" json:"period,omitempty"`
-	EntityID           string            `protobuf:"bytes,14,opt,name=entity_id,json=entityId,proto3" json:"entity_id,omitempty"`
-	BoundCIDRs         []string          `protobuf:"bytes,15,rep,name=bound_cidrs,json=boundCidrs,proto3" json:"bound_cidrs,omitempty"`
-	NamespaceID        string            `protobuf:"bytes,16,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
-	CubbyholeID        string            `protobuf:"bytes,17,opt,name=cubbyhole_id,json=cubbyholeId,proto3" json:"cubbyhole_id,omitempty"`
-	Type               uint32            `protobuf:"varint,18,opt,name=type,proto3" json:"type,omitempty"`
-	InternalMeta       map[string]string `protobuf:"bytes,19,rep,name=internal_meta,json=internalMeta,proto3" json:"internal_meta,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	InlinePolicy       string            `protobuf:"bytes,20,opt,name=inline_policy,json=inlinePolicy,proto3" json:"inline_policy,omitempty"`
-	NoIdentityPolicies bool              `protobuf:"varint,21,opt,name=no_identity_policies,json=noIdentityPolicies,proto3" json:"no_identity_policies,omitempty"`
-	ExternalID         string            `protobuf:"bytes,22,opt,name=external_id,json=externalId,proto3" json:"external_id,omitempty"`
+	state              protoimpl.MessageState `protogen:"open.v1"`
+	ID                 string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Accessor           string                 `protobuf:"bytes,2,opt,name=accessor,proto3" json:"accessor,omitempty"`
+	Parent             string                 `protobuf:"bytes,3,opt,name=parent,proto3" json:"parent,omitempty"`
+	Policies           []string               `protobuf:"bytes,4,rep,name=policies,proto3" json:"policies,omitempty"`
+	Path               string                 `protobuf:"bytes,5,opt,name=path,proto3" json:"path,omitempty"`
+	Meta               map[string]string      `protobuf:"bytes,6,rep,name=meta,proto3" json:"meta,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	DisplayName        string                 `protobuf:"bytes,7,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	NumUses            int64                  `protobuf:"varint,8,opt,name=num_uses,json=numUses,proto3" json:"num_uses,omitempty"`
+	CreationTime       int64                  `protobuf:"varint,9,opt,name=creation_time,json=creationTime,proto3" json:"creation_time,omitempty"`
+	TTL                int64                  `protobuf:"varint,10,opt,name=ttl,proto3" json:"ttl,omitempty"`
+	ExplicitMaxTTL     int64                  `protobuf:"varint,11,opt,name=explicit_max_ttl,json=explicitMaxTtl,proto3" json:"explicit_max_ttl,omitempty"`
+	Role               string                 `protobuf:"bytes,12,opt,name=role,proto3" json:"role,omitempty"`
+	Period             int64                  `protobuf:"varint,13,opt,name=period,proto3" json:"period,omitempty"`
+	EntityID           string                 `protobuf:"bytes,14,opt,name=entity_id,json=entityId,proto3" json:"entity_id,omitempty"`
+	BoundCIDRs         []string               `protobuf:"bytes,15,rep,name=bound_cidrs,json=boundCidrs,proto3" json:"bound_cidrs,omitempty"`
+	NamespaceID        string                 `protobuf:"bytes,16,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	CubbyholeID        string                 `protobuf:"bytes,17,opt,name=cubbyhole_id,json=cubbyholeId,proto3" json:"cubbyhole_id,omitempty"`
+	Type               uint32                 `protobuf:"varint,18,opt,name=type,proto3" json:"type,omitempty"`
+	InternalMeta       map[string]string      `protobuf:"bytes,19,rep,name=internal_meta,json=internalMeta,proto3" json:"internal_meta,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	InlinePolicy       string                 `protobuf:"bytes,20,opt,name=inline_policy,json=inlinePolicy,proto3" json:"inline_policy,omitempty"`
+	NoIdentityPolicies bool                   `protobuf:"varint,21,opt,name=no_identity_policies,json=noIdentityPolicies,proto3" json:"no_identity_policies,omitempty"`
+	ExternalID         string                 `protobuf:"bytes,22,opt,name=external_id,json=externalId,proto3" json:"external_id,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }
 
 func (x *TokenEntry) Reset() {
 	*x = TokenEntry{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *TokenEntry) String() string {
@@ -815,7 +830,7 @@ func (*TokenEntry) ProtoMessage() {}
 
 func (x *TokenEntry) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -985,24 +1000,21 @@ func (x *TokenEntry) GetExternalID() string {
 }
 
 type LeaseOptions struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	TTL           int64                  `protobuf:"varint,1,opt,name=TTL,proto3" json:"TTL,omitempty"`
+	Renewable     bool                   `protobuf:"varint,2,opt,name=renewable,proto3" json:"renewable,omitempty"`
+	Increment     int64                  `protobuf:"varint,3,opt,name=increment,proto3" json:"increment,omitempty"`
+	IssueTime     *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=issue_time,json=issueTime,proto3" json:"issue_time,omitempty"`
+	MaxTTL        int64                  `protobuf:"varint,5,opt,name=MaxTTL,proto3" json:"MaxTTL,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	TTL       int64                  `protobuf:"varint,1,opt,name=TTL,proto3" json:"TTL,omitempty"`
-	Renewable bool                   `protobuf:"varint,2,opt,name=renewable,proto3" json:"renewable,omitempty"`
-	Increment int64                  `protobuf:"varint,3,opt,name=increment,proto3" json:"increment,omitempty"`
-	IssueTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=issue_time,json=issueTime,proto3" json:"issue_time,omitempty"`
-	MaxTTL    int64                  `protobuf:"varint,5,opt,name=MaxTTL,proto3" json:"MaxTTL,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *LeaseOptions) Reset() {
 	*x = LeaseOptions{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *LeaseOptions) String() string {
@@ -1013,7 +1025,7 @@ func (*LeaseOptions) ProtoMessage() {}
 
 func (x *LeaseOptions) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1064,11 +1076,8 @@ func (x *LeaseOptions) GetMaxTTL() int64 {
 }
 
 type Secret struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	LeaseOptions *LeaseOptions `protobuf:"bytes,1,opt,name=lease_options,json=leaseOptions,proto3" json:"lease_options,omitempty"`
+	state        protoimpl.MessageState `protogen:"open.v1"`
+	LeaseOptions *LeaseOptions          `protobuf:"bytes,1,opt,name=lease_options,json=leaseOptions,proto3" json:"lease_options,omitempty"`
 	// InternalData is a JSON object that is stored with the secret.
 	// This will be sent back during a Renew/Revoke for storing internal data
 	// used for those operations.
@@ -1076,16 +1085,16 @@ type Secret struct {
 	// LeaseID is the ID returned to the user to manage this secret.
 	// This is generated by Vault core. Any set value will be ignored.
 	// For requests, this will always be blank.
-	LeaseID string `protobuf:"bytes,3,opt,name=lease_id,json=leaseId,proto3" json:"lease_id,omitempty"`
+	LeaseID       string `protobuf:"bytes,3,opt,name=lease_id,json=leaseId,proto3" json:"lease_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Secret) Reset() {
 	*x = Secret{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Secret) String() string {
@@ -1096,7 +1105,7 @@ func (*Secret) ProtoMessage() {}
 
 func (x *Secret) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1133,10 +1142,7 @@ func (x *Secret) GetLeaseID() string {
 }
 
 type Response struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Secret, if not nil, denotes that this response represents a secret.
 	Secret *Secret `protobuf:"bytes,1,opt,name=secret,proto3" json:"secret,omitempty"`
 	// Auth, if not nil, contains the authentication information for
@@ -1160,19 +1166,19 @@ type Response struct {
 	// Headers will contain the http headers from the response. This value will
 	// be used in the audit broker to ensure we are auditing only the allowed
 	// headers.
-	Headers map[string]*Header `protobuf:"bytes,7,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Headers map[string]*Header `protobuf:"bytes,7,rep,name=headers,proto3" json:"headers,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// MountType, if non-empty, provides some information about what kind
 	// of mount this secret came from.
-	MountType string `protobuf:"bytes,8,opt,name=mount_type,json=mountType,proto3" json:"mount_type,omitempty"`
+	MountType     string `protobuf:"bytes,8,opt,name=mount_type,json=mountType,proto3" json:"mount_type,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Response) Reset() {
 	*x = Response{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Response) String() string {
@@ -1183,7 +1189,7 @@ func (*Response) ProtoMessage() {}
 
 func (x *Response) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1255,10 +1261,7 @@ func (x *Response) GetMountType() string {
 }
 
 type ResponseWrapInfo struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Setting to non-zero specifies that the response should be wrapped.
 	// Specifies the desired TTL of the wrapping token.
 	TTL int64 `protobuf:"varint,1,opt,name=TTL,proto3" json:"TTL,omitempty"`
@@ -1281,16 +1284,16 @@ type ResponseWrapInfo struct {
 	// the wrapped response.
 	CreationPath string `protobuf:"bytes,8,opt,name=creation_path,json=creationPath,proto3" json:"creation_path,omitempty"`
 	// Controls seal wrapping behavior downstream for specific use cases
-	SealWrap bool `protobuf:"varint,9,opt,name=seal_wrap,json=sealWrap,proto3" json:"seal_wrap,omitempty"`
+	SealWrap      bool `protobuf:"varint,9,opt,name=seal_wrap,json=sealWrap,proto3" json:"seal_wrap,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ResponseWrapInfo) Reset() {
 	*x = ResponseWrapInfo{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[10]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ResponseWrapInfo) String() string {
@@ -1301,7 +1304,7 @@ func (*ResponseWrapInfo) ProtoMessage() {}
 
 func (x *ResponseWrapInfo) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[10]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1380,10 +1383,7 @@ func (x *ResponseWrapInfo) GetSealWrap() bool {
 }
 
 type RequestWrapInfo struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Setting to non-zero specifies that the response should be wrapped.
 	// Specifies the desired TTL of the wrapping token.
 	TTL int64 `protobuf:"varint,1,opt,name=TTL,proto3" json:"TTL,omitempty"`
@@ -1392,16 +1392,16 @@ type RequestWrapInfo struct {
 	Format string `protobuf:"bytes,2,opt,name=format,proto3" json:"format,omitempty"`
 	// A flag to conforming backends that data for a given request should be
 	// seal wrapped
-	SealWrap bool `protobuf:"varint,3,opt,name=seal_wrap,json=sealWrap,proto3" json:"seal_wrap,omitempty"`
+	SealWrap      bool `protobuf:"varint,3,opt,name=seal_wrap,json=sealWrap,proto3" json:"seal_wrap,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RequestWrapInfo) Reset() {
 	*x = RequestWrapInfo{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[11]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RequestWrapInfo) String() string {
@@ -1412,7 +1412,7 @@ func (*RequestWrapInfo) ProtoMessage() {}
 
 func (x *RequestWrapInfo) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[11]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1450,21 +1450,18 @@ func (x *RequestWrapInfo) GetSealWrap() bool {
 
 // HandleRequestArgs is the args for HandleRequest method.
 type HandleRequestArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	StorageID     uint32                 `protobuf:"varint,1,opt,name=storage_id,json=storageId,proto3" json:"storage_id,omitempty"`
+	Request       *Request               `protobuf:"bytes,2,opt,name=request,proto3" json:"request,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	StorageID uint32   `protobuf:"varint,1,opt,name=storage_id,json=storageId,proto3" json:"storage_id,omitempty"`
-	Request   *Request `protobuf:"bytes,2,opt,name=request,proto3" json:"request,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *HandleRequestArgs) Reset() {
 	*x = HandleRequestArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[12]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *HandleRequestArgs) String() string {
@@ -1475,7 +1472,7 @@ func (*HandleRequestArgs) ProtoMessage() {}
 
 func (x *HandleRequestArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[12]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1506,21 +1503,18 @@ func (x *HandleRequestArgs) GetRequest() *Request {
 
 // HandleRequestReply is the reply for HandleRequest method.
 type HandleRequestReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Response      *Response              `protobuf:"bytes,1,opt,name=response,proto3" json:"response,omitempty"`
+	Err           *ProtoError            `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Response *Response   `protobuf:"bytes,1,opt,name=response,proto3" json:"response,omitempty"`
-	Err      *ProtoError `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *HandleRequestReply) Reset() {
 	*x = HandleRequestReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[13]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *HandleRequestReply) String() string {
@@ -1531,7 +1525,7 @@ func (*HandleRequestReply) ProtoMessage() {}
 
 func (x *HandleRequestReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[13]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1562,18 +1556,16 @@ func (x *HandleRequestReply) GetErr() *ProtoError {
 
 // InitializeArgs is the args for Initialize method.
 type InitializeArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *InitializeArgs) Reset() {
 	*x = InitializeArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[14]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *InitializeArgs) String() string {
@@ -1584,7 +1576,7 @@ func (*InitializeArgs) ProtoMessage() {}
 
 func (x *InitializeArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[14]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1601,20 +1593,17 @@ func (*InitializeArgs) Descriptor() ([]byte, []int) {
 
 // InitializeReply is the reply for Initialize method.
 type InitializeReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Err           *ProtoError            `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Err *ProtoError `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *InitializeReply) Reset() {
 	*x = InitializeReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[15]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *InitializeReply) String() string {
@@ -1625,7 +1614,7 @@ func (*InitializeReply) ProtoMessage() {}
 
 func (x *InitializeReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[15]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1649,20 +1638,17 @@ func (x *InitializeReply) GetErr() *ProtoError {
 
 // SpecialPathsReply is the reply for SpecialPaths method.
 type SpecialPathsReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Paths         *Paths                 `protobuf:"bytes,1,opt,name=paths,proto3" json:"paths,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Paths *Paths `protobuf:"bytes,1,opt,name=paths,proto3" json:"paths,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SpecialPathsReply) Reset() {
 	*x = SpecialPathsReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[16]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *SpecialPathsReply) String() string {
@@ -1673,7 +1659,7 @@ func (*SpecialPathsReply) ProtoMessage() {}
 
 func (x *SpecialPathsReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[16]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1697,21 +1683,18 @@ func (x *SpecialPathsReply) GetPaths() *Paths {
 
 // HandleExistenceCheckArgs is the args for HandleExistenceCheck method.
 type HandleExistenceCheckArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	StorageID     uint32                 `protobuf:"varint,1,opt,name=storage_id,json=storageId,proto3" json:"storage_id,omitempty"`
+	Request       *Request               `protobuf:"bytes,2,opt,name=request,proto3" json:"request,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	StorageID uint32   `protobuf:"varint,1,opt,name=storage_id,json=storageId,proto3" json:"storage_id,omitempty"`
-	Request   *Request `protobuf:"bytes,2,opt,name=request,proto3" json:"request,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *HandleExistenceCheckArgs) Reset() {
 	*x = HandleExistenceCheckArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[17]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *HandleExistenceCheckArgs) String() string {
@@ -1722,7 +1705,7 @@ func (*HandleExistenceCheckArgs) ProtoMessage() {}
 
 func (x *HandleExistenceCheckArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[17]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1753,22 +1736,19 @@ func (x *HandleExistenceCheckArgs) GetRequest() *Request {
 
 // HandleExistenceCheckReply is the reply for HandleExistenceCheck method.
 type HandleExistenceCheckReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	CheckFound    bool                   `protobuf:"varint,1,opt,name=check_found,json=checkFound,proto3" json:"check_found,omitempty"`
+	Exists        bool                   `protobuf:"varint,2,opt,name=exists,proto3" json:"exists,omitempty"`
+	Err           *ProtoError            `protobuf:"bytes,3,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	CheckFound bool        `protobuf:"varint,1,opt,name=check_found,json=checkFound,proto3" json:"check_found,omitempty"`
-	Exists     bool        `protobuf:"varint,2,opt,name=exists,proto3" json:"exists,omitempty"`
-	Err        *ProtoError `protobuf:"bytes,3,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *HandleExistenceCheckReply) Reset() {
 	*x = HandleExistenceCheckReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[18]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *HandleExistenceCheckReply) String() string {
@@ -1779,7 +1759,7 @@ func (*HandleExistenceCheckReply) ProtoMessage() {}
 
 func (x *HandleExistenceCheckReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[18]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1817,22 +1797,19 @@ func (x *HandleExistenceCheckReply) GetErr() *ProtoError {
 
 // SetupArgs is the args for Setup method.
 type SetupArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	BrokerID      uint32                 `protobuf:"varint,1,opt,name=broker_id,json=brokerId,proto3" json:"broker_id,omitempty"`
+	Config        map[string]string      `protobuf:"bytes,2,rep,name=Config,proto3" json:"Config,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	BackendUUID   string                 `protobuf:"bytes,3,opt,name=backendUUID,proto3" json:"backendUUID,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	BrokerID    uint32            `protobuf:"varint,1,opt,name=broker_id,json=brokerId,proto3" json:"broker_id,omitempty"`
-	Config      map[string]string `protobuf:"bytes,2,rep,name=Config,proto3" json:"Config,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	BackendUUID string            `protobuf:"bytes,3,opt,name=backendUUID,proto3" json:"backendUUID,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SetupArgs) Reset() {
 	*x = SetupArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[19]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *SetupArgs) String() string {
@@ -1843,7 +1820,7 @@ func (*SetupArgs) ProtoMessage() {}
 
 func (x *SetupArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[19]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1881,20 +1858,17 @@ func (x *SetupArgs) GetBackendUUID() string {
 
 // SetupReply is the reply for Setup method.
 type SetupReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Err           string                 `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Err string `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SetupReply) Reset() {
 	*x = SetupReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[20]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *SetupReply) String() string {
@@ -1905,7 +1879,7 @@ func (*SetupReply) ProtoMessage() {}
 
 func (x *SetupReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[20]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1929,20 +1903,17 @@ func (x *SetupReply) GetErr() string {
 
 // TypeReply is the reply for the Type method.
 type TypeReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Type          uint32                 `protobuf:"varint,1,opt,name=type,proto3" json:"type,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Type uint32 `protobuf:"varint,1,opt,name=type,proto3" json:"type,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *TypeReply) Reset() {
 	*x = TypeReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[21]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[21]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *TypeReply) String() string {
@@ -1953,7 +1924,7 @@ func (*TypeReply) ProtoMessage() {}
 
 func (x *TypeReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[21]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -1976,20 +1947,17 @@ func (x *TypeReply) GetType() uint32 {
 }
 
 type InvalidateKeyArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Key           string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *InvalidateKeyArgs) Reset() {
 	*x = InvalidateKeyArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[22]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[22]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *InvalidateKeyArgs) String() string {
@@ -2000,7 +1968,7 @@ func (*InvalidateKeyArgs) ProtoMessage() {}
 
 func (x *InvalidateKeyArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[22]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2023,22 +1991,19 @@ func (x *InvalidateKeyArgs) GetKey() string {
 }
 
 type StorageEntry struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Key           string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value         []byte                 `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	SealWrap      bool                   `protobuf:"varint,3,opt,name=seal_wrap,json=sealWrap,proto3" json:"seal_wrap,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Key      string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	Value    []byte `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
-	SealWrap bool   `protobuf:"varint,3,opt,name=seal_wrap,json=sealWrap,proto3" json:"seal_wrap,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *StorageEntry) Reset() {
 	*x = StorageEntry{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[23]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[23]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StorageEntry) String() string {
@@ -2049,7 +2014,7 @@ func (*StorageEntry) ProtoMessage() {}
 
 func (x *StorageEntry) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[23]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2086,20 +2051,17 @@ func (x *StorageEntry) GetSealWrap() bool {
 }
 
 type StorageListArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Prefix        string                 `protobuf:"bytes,1,opt,name=prefix,proto3" json:"prefix,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Prefix string `protobuf:"bytes,1,opt,name=prefix,proto3" json:"prefix,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *StorageListArgs) Reset() {
 	*x = StorageListArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[24]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[24]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StorageListArgs) String() string {
@@ -2110,7 +2072,7 @@ func (*StorageListArgs) ProtoMessage() {}
 
 func (x *StorageListArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[24]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2133,21 +2095,18 @@ func (x *StorageListArgs) GetPrefix() string {
 }
 
 type StorageListReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Keys          []string               `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
+	Err           string                 `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Keys []string `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
-	Err  string   `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *StorageListReply) Reset() {
 	*x = StorageListReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[25]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[25]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StorageListReply) String() string {
@@ -2158,7 +2117,7 @@ func (*StorageListReply) ProtoMessage() {}
 
 func (x *StorageListReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[25]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2188,20 +2147,17 @@ func (x *StorageListReply) GetErr() string {
 }
 
 type StorageGetArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Key           string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *StorageGetArgs) Reset() {
 	*x = StorageGetArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[26]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[26]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StorageGetArgs) String() string {
@@ -2212,7 +2168,7 @@ func (*StorageGetArgs) ProtoMessage() {}
 
 func (x *StorageGetArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[26]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2235,21 +2191,18 @@ func (x *StorageGetArgs) GetKey() string {
 }
 
 type StorageGetReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Entry         *StorageEntry          `protobuf:"bytes,1,opt,name=entry,proto3" json:"entry,omitempty"`
+	Err           string                 `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Entry *StorageEntry `protobuf:"bytes,1,opt,name=entry,proto3" json:"entry,omitempty"`
-	Err   string        `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *StorageGetReply) Reset() {
 	*x = StorageGetReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[27]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[27]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StorageGetReply) String() string {
@@ -2260,7 +2213,7 @@ func (*StorageGetReply) ProtoMessage() {}
 
 func (x *StorageGetReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[27]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2290,20 +2243,17 @@ func (x *StorageGetReply) GetErr() string {
 }
 
 type StoragePutArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Entry         *StorageEntry          `protobuf:"bytes,1,opt,name=entry,proto3" json:"entry,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Entry *StorageEntry `protobuf:"bytes,1,opt,name=entry,proto3" json:"entry,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *StoragePutArgs) Reset() {
 	*x = StoragePutArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[28]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[28]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StoragePutArgs) String() string {
@@ -2314,7 +2264,7 @@ func (*StoragePutArgs) ProtoMessage() {}
 
 func (x *StoragePutArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[28]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2337,20 +2287,17 @@ func (x *StoragePutArgs) GetEntry() *StorageEntry {
 }
 
 type StoragePutReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Err           string                 `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Err string `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *StoragePutReply) Reset() {
 	*x = StoragePutReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[29]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[29]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StoragePutReply) String() string {
@@ -2361,7 +2308,7 @@ func (*StoragePutReply) ProtoMessage() {}
 
 func (x *StoragePutReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[29]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2384,20 +2331,17 @@ func (x *StoragePutReply) GetErr() string {
 }
 
 type StorageDeleteArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Key           string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *StorageDeleteArgs) Reset() {
 	*x = StorageDeleteArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[30]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[30]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StorageDeleteArgs) String() string {
@@ -2408,7 +2352,7 @@ func (*StorageDeleteArgs) ProtoMessage() {}
 
 func (x *StorageDeleteArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[30]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2431,20 +2375,17 @@ func (x *StorageDeleteArgs) GetKey() string {
 }
 
 type StorageDeleteReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Err           string                 `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Err string `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *StorageDeleteReply) Reset() {
 	*x = StorageDeleteReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[31]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[31]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *StorageDeleteReply) String() string {
@@ -2455,7 +2396,7 @@ func (*StorageDeleteReply) ProtoMessage() {}
 
 func (x *StorageDeleteReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[31]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2478,20 +2419,17 @@ func (x *StorageDeleteReply) GetErr() string {
 }
 
 type TTLReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	TTL           int64                  `protobuf:"varint,1,opt,name=TTL,proto3" json:"TTL,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	TTL int64 `protobuf:"varint,1,opt,name=TTL,proto3" json:"TTL,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *TTLReply) Reset() {
 	*x = TTLReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[32]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[32]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *TTLReply) String() string {
@@ -2502,7 +2440,7 @@ func (*TTLReply) ProtoMessage() {}
 
 func (x *TTLReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[32]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2525,20 +2463,17 @@ func (x *TTLReply) GetTTL() int64 {
 }
 
 type TaintedReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Tainted       bool                   `protobuf:"varint,1,opt,name=tainted,proto3" json:"tainted,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Tainted bool `protobuf:"varint,1,opt,name=tainted,proto3" json:"tainted,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *TaintedReply) Reset() {
 	*x = TaintedReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[33]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[33]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *TaintedReply) String() string {
@@ -2549,7 +2484,7 @@ func (*TaintedReply) ProtoMessage() {}
 
 func (x *TaintedReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[33]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2572,20 +2507,17 @@ func (x *TaintedReply) GetTainted() bool {
 }
 
 type CachingDisabledReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Disabled      bool                   `protobuf:"varint,1,opt,name=disabled,proto3" json:"disabled,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Disabled bool `protobuf:"varint,1,opt,name=disabled,proto3" json:"disabled,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CachingDisabledReply) Reset() {
 	*x = CachingDisabledReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[34]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[34]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CachingDisabledReply) String() string {
@@ -2596,7 +2528,7 @@ func (*CachingDisabledReply) ProtoMessage() {}
 
 func (x *CachingDisabledReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[34]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2619,20 +2551,17 @@ func (x *CachingDisabledReply) GetDisabled() bool {
 }
 
 type ReplicationStateReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	State         int32                  `protobuf:"varint,1,opt,name=state,proto3" json:"state,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	State int32 `protobuf:"varint,1,opt,name=state,proto3" json:"state,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ReplicationStateReply) Reset() {
 	*x = ReplicationStateReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[35]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[35]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ReplicationStateReply) String() string {
@@ -2643,7 +2572,7 @@ func (*ReplicationStateReply) ProtoMessage() {}
 
 func (x *ReplicationStateReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[35]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2666,22 +2595,19 @@ func (x *ReplicationStateReply) GetState() int32 {
 }
 
 type ResponseWrapDataArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Data          string                 `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+	TTL           int64                  `protobuf:"varint,2,opt,name=TTL,proto3" json:"TTL,omitempty"`
+	JWT           bool                   `protobuf:"varint,3,opt,name=JWT,proto3" json:"JWT,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Data string `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
-	TTL  int64  `protobuf:"varint,2,opt,name=TTL,proto3" json:"TTL,omitempty"`
-	JWT  bool   `protobuf:"varint,3,opt,name=JWT,proto3" json:"JWT,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ResponseWrapDataArgs) Reset() {
 	*x = ResponseWrapDataArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[36]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[36]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ResponseWrapDataArgs) String() string {
@@ -2692,7 +2618,7 @@ func (*ResponseWrapDataArgs) ProtoMessage() {}
 
 func (x *ResponseWrapDataArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[36]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2729,21 +2655,18 @@ func (x *ResponseWrapDataArgs) GetJWT() bool {
 }
 
 type ResponseWrapDataReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	WrapInfo      *ResponseWrapInfo      `protobuf:"bytes,1,opt,name=wrap_info,json=wrapInfo,proto3" json:"wrap_info,omitempty"`
+	Err           string                 `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	WrapInfo *ResponseWrapInfo `protobuf:"bytes,1,opt,name=wrap_info,json=wrapInfo,proto3" json:"wrap_info,omitempty"`
-	Err      string            `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ResponseWrapDataReply) Reset() {
 	*x = ResponseWrapDataReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[37]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[37]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ResponseWrapDataReply) String() string {
@@ -2754,7 +2677,7 @@ func (*ResponseWrapDataReply) ProtoMessage() {}
 
 func (x *ResponseWrapDataReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[37]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2784,20 +2707,17 @@ func (x *ResponseWrapDataReply) GetErr() string {
 }
 
 type MlockEnabledReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Enabled       bool                   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *MlockEnabledReply) Reset() {
 	*x = MlockEnabledReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[38]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[38]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *MlockEnabledReply) String() string {
@@ -2808,7 +2728,7 @@ func (*MlockEnabledReply) ProtoMessage() {}
 
 func (x *MlockEnabledReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[38]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2831,20 +2751,17 @@ func (x *MlockEnabledReply) GetEnabled() bool {
 }
 
 type LocalMountReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Local         bool                   `protobuf:"varint,1,opt,name=local,proto3" json:"local,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Local bool `protobuf:"varint,1,opt,name=local,proto3" json:"local,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *LocalMountReply) Reset() {
 	*x = LocalMountReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[39]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[39]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *LocalMountReply) String() string {
@@ -2855,7 +2772,7 @@ func (*LocalMountReply) ProtoMessage() {}
 
 func (x *LocalMountReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[39]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2878,20 +2795,17 @@ func (x *LocalMountReply) GetLocal() bool {
 }
 
 type EntityInfoArgs struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	EntityID      string                 `protobuf:"bytes,1,opt,name=entity_id,json=entityId,proto3" json:"entity_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	EntityID string `protobuf:"bytes,1,opt,name=entity_id,json=entityId,proto3" json:"entity_id,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *EntityInfoArgs) Reset() {
 	*x = EntityInfoArgs{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[40]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[40]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EntityInfoArgs) String() string {
@@ -2902,7 +2816,7 @@ func (*EntityInfoArgs) ProtoMessage() {}
 
 func (x *EntityInfoArgs) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[40]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2925,21 +2839,18 @@ func (x *EntityInfoArgs) GetEntityID() string {
 }
 
 type EntityInfoReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Entity        *logical.Entity        `protobuf:"bytes,1,opt,name=entity,proto3" json:"entity,omitempty"`
+	Err           string                 `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Entity *logical.Entity `protobuf:"bytes,1,opt,name=entity,proto3" json:"entity,omitempty"`
-	Err    string          `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *EntityInfoReply) Reset() {
 	*x = EntityInfoReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[41]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[41]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EntityInfoReply) String() string {
@@ -2950,7 +2861,7 @@ func (*EntityInfoReply) ProtoMessage() {}
 
 func (x *EntityInfoReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[41]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -2980,21 +2891,18 @@ func (x *EntityInfoReply) GetErr() string {
 }
 
 type GroupsForEntityReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Groups        []*logical.Group       `protobuf:"bytes,1,rep,name=groups,proto3" json:"groups,omitempty"`
+	Err           string                 `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Groups []*logical.Group `protobuf:"bytes,1,rep,name=groups,proto3" json:"groups,omitempty"`
-	Err    string           `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GroupsForEntityReply) Reset() {
 	*x = GroupsForEntityReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[42]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[42]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GroupsForEntityReply) String() string {
@@ -3005,7 +2913,7 @@ func (*GroupsForEntityReply) ProtoMessage() {}
 
 func (x *GroupsForEntityReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[42]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3035,21 +2943,18 @@ func (x *GroupsForEntityReply) GetErr() string {
 }
 
 type PluginEnvReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state             protoimpl.MessageState     `protogen:"open.v1"`
 	PluginEnvironment *logical.PluginEnvironment `protobuf:"bytes,1,opt,name=plugin_environment,json=pluginEnvironment,proto3" json:"plugin_environment,omitempty"`
 	Err               string                     `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *PluginEnvReply) Reset() {
 	*x = PluginEnvReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[43]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[43]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *PluginEnvReply) String() string {
@@ -3060,7 +2965,7 @@ func (*PluginEnvReply) ProtoMessage() {}
 
 func (x *PluginEnvReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[43]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3090,20 +2995,17 @@ func (x *PluginEnvReply) GetErr() string {
 }
 
 type GeneratePasswordFromPolicyRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	PolicyName    string                 `protobuf:"bytes,1,opt,name=policy_name,json=policyName,proto3" json:"policy_name,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	PolicyName string `protobuf:"bytes,1,opt,name=policy_name,json=policyName,proto3" json:"policy_name,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GeneratePasswordFromPolicyRequest) Reset() {
 	*x = GeneratePasswordFromPolicyRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[44]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[44]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GeneratePasswordFromPolicyRequest) String() string {
@@ -3114,7 +3016,7 @@ func (*GeneratePasswordFromPolicyRequest) ProtoMessage() {}
 
 func (x *GeneratePasswordFromPolicyRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[44]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3137,20 +3039,17 @@ func (x *GeneratePasswordFromPolicyRequest) GetPolicyName() string {
 }
 
 type GeneratePasswordFromPolicyReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Password      string                 `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Password string `protobuf:"bytes,1,opt,name=password,proto3" json:"password,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GeneratePasswordFromPolicyReply) Reset() {
 	*x = GeneratePasswordFromPolicyReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[45]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[45]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GeneratePasswordFromPolicyReply) String() string {
@@ -3161,7 +3060,7 @@ func (*GeneratePasswordFromPolicyReply) ProtoMessage() {}
 
 func (x *GeneratePasswordFromPolicyReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[45]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3184,22 +3083,19 @@ func (x *GeneratePasswordFromPolicyReply) GetPassword() string {
 }
 
 type ClusterInfoReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ClusterName   string                 `protobuf:"bytes,1,opt,name=cluster_name,json=clusterName,proto3" json:"cluster_name,omitempty"`
+	ClusterID     string                 `protobuf:"bytes,2,opt,name=cluster_id,json=clusterId,proto3" json:"cluster_id,omitempty"`
+	Err           string                 `protobuf:"bytes,3,opt,name=err,proto3" json:"err,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	ClusterName string `protobuf:"bytes,1,opt,name=cluster_name,json=clusterName,proto3" json:"cluster_name,omitempty"`
-	ClusterID   string `protobuf:"bytes,2,opt,name=cluster_id,json=clusterId,proto3" json:"cluster_id,omitempty"`
-	Err         string `protobuf:"bytes,3,opt,name=err,proto3" json:"err,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ClusterInfoReply) Reset() {
 	*x = ClusterInfoReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[46]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[46]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ClusterInfoReply) String() string {
@@ -3210,7 +3106,7 @@ func (*ClusterInfoReply) ProtoMessage() {}
 
 func (x *ClusterInfoReply) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[46]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3247,21 +3143,18 @@ func (x *ClusterInfoReply) GetErr() string {
 }
 
 type GenerateIdentityTokenRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Audience      string                 `protobuf:"bytes,1,opt,name=audience,proto3" json:"audience,omitempty"`
+	TTL           int64                  `protobuf:"varint,2,opt,name=ttl,proto3" json:"ttl,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Audience string `protobuf:"bytes,1,opt,name=audience,proto3" json:"audience,omitempty"`
-	TTL      int64  `protobuf:"varint,2,opt,name=ttl,proto3" json:"ttl,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GenerateIdentityTokenRequest) Reset() {
 	*x = GenerateIdentityTokenRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[47]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[47]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GenerateIdentityTokenRequest) String() string {
@@ -3272,7 +3165,7 @@ func (*GenerateIdentityTokenRequest) ProtoMessage() {}
 
 func (x *GenerateIdentityTokenRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[47]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3302,21 +3195,18 @@ func (x *GenerateIdentityTokenRequest) GetTTL() int64 {
 }
 
 type GenerateIdentityTokenResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Token         string                 `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
+	TTL           int64                  `protobuf:"varint,2,opt,name=ttl,proto3" json:"ttl,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
-	TTL   int64  `protobuf:"varint,2,opt,name=ttl,proto3" json:"ttl,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GenerateIdentityTokenResponse) Reset() {
 	*x = GenerateIdentityTokenResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[48]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[48]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GenerateIdentityTokenResponse) String() string {
@@ -3327,7 +3217,7 @@ func (*GenerateIdentityTokenResponse) ProtoMessage() {}
 
 func (x *GenerateIdentityTokenResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[48]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3356,11 +3246,388 @@ func (x *GenerateIdentityTokenResponse) GetTTL() int64 {
 	return 0
 }
 
-type Connection struct {
-	state         protoimpl.MessageState
+type RotationInfoRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	MountPath     string                 `protobuf:"bytes,1,opt,name=mount_path,json=mountPath,proto3" json:"mount_path,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RotationInfoRequest) Reset() {
+	*x = RotationInfoRequest{}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[49]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RotationInfoRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RotationInfoRequest) ProtoMessage() {}
+
+func (x *RotationInfoRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[49]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RotationInfoRequest.ProtoReflect.Descriptor instead.
+func (*RotationInfoRequest) Descriptor() ([]byte, []int) {
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{49}
+}
+
+func (x *RotationInfoRequest) GetMountPath() string {
+	if x != nil {
+		return x.MountPath
+	}
+	return ""
+}
+
+type RotationInfoReply struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	IssueTime     int64                  `protobuf:"varint,1,opt,name=issue_time,json=issueTime,proto3" json:"issue_time,omitempty"`
+	ExpireTime    int64                  `protobuf:"varint,2,opt,name=expire_time,json=expireTime,proto3" json:"expire_time,omitempty"`
+	TTL           int64                  `protobuf:"varint,3,opt,name=ttl,proto3" json:"ttl,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RotationInfoReply) Reset() {
+	*x = RotationInfoReply{}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[50]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RotationInfoReply) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RotationInfoReply) ProtoMessage() {}
+
+func (x *RotationInfoReply) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[50]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RotationInfoReply.ProtoReflect.Descriptor instead.
+func (*RotationInfoReply) Descriptor() ([]byte, []int) {
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{50}
+}
+
+func (x *RotationInfoReply) GetIssueTime() int64 {
+	if x != nil {
+		return x.IssueTime
+	}
+	return 0
+}
+
+func (x *RotationInfoReply) GetExpireTime() int64 {
+	if x != nil {
+		return x.ExpireTime
+	}
+	return 0
+}
+
+func (x *RotationInfoReply) GetTTL() int64 {
+	if x != nil {
+		return x.TTL
+	}
+	return 0
+}
+
+type RegisterRotationJobRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Job           *RotationJobInput      `protobuf:"bytes,1,opt,name=job,proto3" json:"job,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RegisterRotationJobRequest) Reset() {
+	*x = RegisterRotationJobRequest{}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[51]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RegisterRotationJobRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RegisterRotationJobRequest) ProtoMessage() {}
+
+func (x *RegisterRotationJobRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[51]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RegisterRotationJobRequest.ProtoReflect.Descriptor instead.
+func (*RegisterRotationJobRequest) Descriptor() ([]byte, []int) {
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{51}
+}
+
+func (x *RegisterRotationJobRequest) GetJob() *RotationJobInput {
+	if x != nil {
+		return x.Job
+	}
+	return nil
+}
+
+type RegisterRotationJobResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RotationID    string                 `protobuf:"bytes,1,opt,name=rotation_id,json=rotationId,proto3" json:"rotation_id,omitempty"`
+	Err           string                 `protobuf:"bytes,2,opt,name=err,proto3" json:"err,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RegisterRotationJobResponse) Reset() {
+	*x = RegisterRotationJobResponse{}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[52]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RegisterRotationJobResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RegisterRotationJobResponse) ProtoMessage() {}
+
+func (x *RegisterRotationJobResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[52]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RegisterRotationJobResponse.ProtoReflect.Descriptor instead.
+func (*RegisterRotationJobResponse) Descriptor() ([]byte, []int) {
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{52}
+}
+
+func (x *RegisterRotationJobResponse) GetRotationID() string {
+	if x != nil {
+		return x.RotationID
+	}
+	return ""
+}
+
+func (x *RegisterRotationJobResponse) GetErr() string {
+	if x != nil {
+		return x.Err
+	}
+	return ""
+}
+
+type RotationJobInput struct {
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	Name             string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	MountPoint       string                 `protobuf:"bytes,2,opt,name=mount_point,json=mountPoint,proto3" json:"mount_point,omitempty"`
+	Path             string                 `protobuf:"bytes,3,opt,name=path,proto3" json:"path,omitempty"`
+	RotationSchedule string                 `protobuf:"bytes,4,opt,name=rotation_schedule,json=rotationSchedule,proto3" json:"rotation_schedule,omitempty"`
+	RotationWindow   int64                  `protobuf:"varint,5,opt,name=rotation_window,json=rotationWindow,proto3" json:"rotation_window,omitempty"`
+	RotationPeriod   int64                  `protobuf:"varint,6,opt,name=rotation_period,json=rotationPeriod,proto3" json:"rotation_period,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *RotationJobInput) Reset() {
+	*x = RotationJobInput{}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[53]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RotationJobInput) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RotationJobInput) ProtoMessage() {}
+
+func (x *RotationJobInput) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[53]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RotationJobInput.ProtoReflect.Descriptor instead.
+func (*RotationJobInput) Descriptor() ([]byte, []int) {
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{53}
+}
+
+func (x *RotationJobInput) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *RotationJobInput) GetMountPoint() string {
+	if x != nil {
+		return x.MountPoint
+	}
+	return ""
+}
+
+func (x *RotationJobInput) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+func (x *RotationJobInput) GetRotationSchedule() string {
+	if x != nil {
+		return x.RotationSchedule
+	}
+	return ""
+}
+
+func (x *RotationJobInput) GetRotationWindow() int64 {
+	if x != nil {
+		return x.RotationWindow
+	}
+	return 0
+}
+
+func (x *RotationJobInput) GetRotationPeriod() int64 {
+	if x != nil {
+		return x.RotationPeriod
+	}
+	return 0
+}
+
+type DeregisterRotationRequestInput struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	MountPoint    string                 `protobuf:"bytes,1,opt,name=mount_point,json=mountPoint,proto3" json:"mount_point,omitempty"`
+	ReqPath       string                 `protobuf:"bytes,2,opt,name=req_path,json=reqPath,proto3" json:"req_path,omitempty"`
+	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeregisterRotationRequestInput) Reset() {
+	*x = DeregisterRotationRequestInput{}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[54]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeregisterRotationRequestInput) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeregisterRotationRequestInput) ProtoMessage() {}
+
+func (x *DeregisterRotationRequestInput) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[54]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeregisterRotationRequestInput.ProtoReflect.Descriptor instead.
+func (*DeregisterRotationRequestInput) Descriptor() ([]byte, []int) {
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{54}
+}
+
+func (x *DeregisterRotationRequestInput) GetMountPoint() string {
+	if x != nil {
+		return x.MountPoint
+	}
+	return ""
+}
+
+func (x *DeregisterRotationRequestInput) GetReqPath() string {
+	if x != nil {
+		return x.ReqPath
+	}
+	return ""
+}
+
+type DeregisterRotationJobRequest struct {
+	state         protoimpl.MessageState          `protogen:"open.v1"`
+	Req           *DeregisterRotationRequestInput `protobuf:"bytes,1,opt,name=req,proto3" json:"req,omitempty"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeregisterRotationJobRequest) Reset() {
+	*x = DeregisterRotationJobRequest{}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[55]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeregisterRotationJobRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeregisterRotationJobRequest) ProtoMessage() {}
+
+func (x *DeregisterRotationJobRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[55]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeregisterRotationJobRequest.ProtoReflect.Descriptor instead.
+func (*DeregisterRotationJobRequest) Descriptor() ([]byte, []int) {
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{55}
+}
 
+func (x *DeregisterRotationJobRequest) GetReq() *DeregisterRotationRequestInput {
+	if x != nil {
+		return x.Req
+	}
+	return nil
+}
+
+type Connection struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// RemoteAddr is the network address that sent the request.
 	RemoteAddr string `protobuf:"bytes,1,opt,name=remote_addr,json=remoteAddr,proto3" json:"remote_addr,omitempty"`
 	// RemotePort is the network port that sent the request.
@@ -3368,15 +3635,15 @@ type Connection struct {
 	// ConnectionState is the marshalled tls.ConnectionState from the original
 	// request
 	ConnectionState *ConnectionState `protobuf:"bytes,2,opt,name=connection_state,json=connectionState,proto3" json:"connection_state,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *Connection) Reset() {
 	*x = Connection{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[49]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[56]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Connection) String() string {
@@ -3386,8 +3653,8 @@ func (x *Connection) String() string {
 func (*Connection) ProtoMessage() {}
 
 func (x *Connection) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[49]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[56]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3399,7 +3666,7 @@ func (x *Connection) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Connection.ProtoReflect.Descriptor instead.
 func (*Connection) Descriptor() ([]byte, []int) {
-	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{49}
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{56}
 }
 
 func (x *Connection) GetRemoteAddr() string {
@@ -3424,31 +3691,28 @@ func (x *Connection) GetConnectionState() *ConnectionState {
 }
 
 type ConnectionState struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Version                     uint32              `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
-	HandshakeComplete           bool                `protobuf:"varint,2,opt,name=handshake_complete,json=handshakeComplete,proto3" json:"handshake_complete,omitempty"`
-	DidResume                   bool                `protobuf:"varint,3,opt,name=did_resume,json=didResume,proto3" json:"did_resume,omitempty"`
-	CipherSuite                 uint32              `protobuf:"varint,4,opt,name=cipher_suite,json=cipherSuite,proto3" json:"cipher_suite,omitempty"`
-	NegotiatedProtocol          string              `protobuf:"bytes,5,opt,name=negotiated_protocol,json=negotiatedProtocol,proto3" json:"negotiated_protocol,omitempty"`
-	NegotiatedProtocolIsMutual  bool                `protobuf:"varint,6,opt,name=negotiated_protocol_is_mutual,json=negotiatedProtocolIsMutual,proto3" json:"negotiated_protocol_is_mutual,omitempty"`
-	ServerName                  string              `protobuf:"bytes,7,opt,name=server_name,json=serverName,proto3" json:"server_name,omitempty"`
-	PeerCertificates            *CertificateChain   `protobuf:"bytes,8,opt,name=peer_certificates,json=peerCertificates,proto3" json:"peer_certificates,omitempty"`
-	VerifiedChains              []*CertificateChain `protobuf:"bytes,9,rep,name=verified_chains,json=verifiedChains,proto3" json:"verified_chains,omitempty"`
-	SignedCertificateTimestamps [][]byte            `protobuf:"bytes,10,rep,name=signed_certificate_timestamps,json=signedCertificateTimestamps,proto3" json:"signed_certificate_timestamps,omitempty"`
-	OcspResponse                []byte              `protobuf:"bytes,11,opt,name=ocsp_response,json=ocspResponse,proto3" json:"ocsp_response,omitempty"`
-	TlsUnique                   []byte              `protobuf:"bytes,12,opt,name=tls_unique,json=tlsUnique,proto3" json:"tls_unique,omitempty"`
+	state                       protoimpl.MessageState `protogen:"open.v1"`
+	Version                     uint32                 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+	HandshakeComplete           bool                   `protobuf:"varint,2,opt,name=handshake_complete,json=handshakeComplete,proto3" json:"handshake_complete,omitempty"`
+	DidResume                   bool                   `protobuf:"varint,3,opt,name=did_resume,json=didResume,proto3" json:"did_resume,omitempty"`
+	CipherSuite                 uint32                 `protobuf:"varint,4,opt,name=cipher_suite,json=cipherSuite,proto3" json:"cipher_suite,omitempty"`
+	NegotiatedProtocol          string                 `protobuf:"bytes,5,opt,name=negotiated_protocol,json=negotiatedProtocol,proto3" json:"negotiated_protocol,omitempty"`
+	NegotiatedProtocolIsMutual  bool                   `protobuf:"varint,6,opt,name=negotiated_protocol_is_mutual,json=negotiatedProtocolIsMutual,proto3" json:"negotiated_protocol_is_mutual,omitempty"`
+	ServerName                  string                 `protobuf:"bytes,7,opt,name=server_name,json=serverName,proto3" json:"server_name,omitempty"`
+	PeerCertificates            *CertificateChain      `protobuf:"bytes,8,opt,name=peer_certificates,json=peerCertificates,proto3" json:"peer_certificates,omitempty"`
+	VerifiedChains              []*CertificateChain    `protobuf:"bytes,9,rep,name=verified_chains,json=verifiedChains,proto3" json:"verified_chains,omitempty"`
+	SignedCertificateTimestamps [][]byte               `protobuf:"bytes,10,rep,name=signed_certificate_timestamps,json=signedCertificateTimestamps,proto3" json:"signed_certificate_timestamps,omitempty"`
+	OcspResponse                []byte                 `protobuf:"bytes,11,opt,name=ocsp_response,json=ocspResponse,proto3" json:"ocsp_response,omitempty"`
+	TlsUnique                   []byte                 `protobuf:"bytes,12,opt,name=tls_unique,json=tlsUnique,proto3" json:"tls_unique,omitempty"`
+	unknownFields               protoimpl.UnknownFields
+	sizeCache                   protoimpl.SizeCache
 }
 
 func (x *ConnectionState) Reset() {
 	*x = ConnectionState{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[50]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[57]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ConnectionState) String() string {
@@ -3458,8 +3722,8 @@ func (x *ConnectionState) String() string {
 func (*ConnectionState) ProtoMessage() {}
 
 func (x *ConnectionState) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[50]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[57]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3471,7 +3735,7 @@ func (x *ConnectionState) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ConnectionState.ProtoReflect.Descriptor instead.
 func (*ConnectionState) Descriptor() ([]byte, []int) {
-	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{50}
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{57}
 }
 
 func (x *ConnectionState) GetVersion() uint32 {
@@ -3559,20 +3823,17 @@ func (x *ConnectionState) GetTlsUnique() []byte {
 }
 
 type Certificate struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Asn1Data      []byte                 `protobuf:"bytes,1,opt,name=asn1_data,json=asn1Data,proto3" json:"asn1_data,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Asn1Data []byte `protobuf:"bytes,1,opt,name=asn1_data,json=asn1Data,proto3" json:"asn1_data,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Certificate) Reset() {
 	*x = Certificate{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[51]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[58]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Certificate) String() string {
@@ -3582,8 +3843,8 @@ func (x *Certificate) String() string {
 func (*Certificate) ProtoMessage() {}
 
 func (x *Certificate) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[51]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[58]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3595,7 +3856,7 @@ func (x *Certificate) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Certificate.ProtoReflect.Descriptor instead.
 func (*Certificate) Descriptor() ([]byte, []int) {
-	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{51}
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{58}
 }
 
 func (x *Certificate) GetAsn1Data() []byte {
@@ -3606,20 +3867,17 @@ func (x *Certificate) GetAsn1Data() []byte {
 }
 
 type CertificateChain struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Certificates  []*Certificate         `protobuf:"bytes,1,rep,name=certificates,proto3" json:"certificates,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Certificates []*Certificate `protobuf:"bytes,1,rep,name=certificates,proto3" json:"certificates,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *CertificateChain) Reset() {
 	*x = CertificateChain{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[52]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[59]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *CertificateChain) String() string {
@@ -3629,8 +3887,8 @@ func (x *CertificateChain) String() string {
 func (*CertificateChain) ProtoMessage() {}
 
 func (x *CertificateChain) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[52]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[59]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3642,7 +3900,7 @@ func (x *CertificateChain) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CertificateChain.ProtoReflect.Descriptor instead.
 func (*CertificateChain) Descriptor() ([]byte, []int) {
-	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{52}
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{59}
 }
 
 func (x *CertificateChain) GetCertificates() []*Certificate {
@@ -3653,21 +3911,18 @@ func (x *CertificateChain) GetCertificates() []*Certificate {
 }
 
 type SendEventRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	EventType     string                 `protobuf:"bytes,1,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
+	Event         *logical.EventData     `protobuf:"bytes,2,opt,name=event,proto3" json:"event,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	EventType string             `protobuf:"bytes,1,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
-	Event     *logical.EventData `protobuf:"bytes,2,opt,name=event,proto3" json:"event,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SendEventRequest) Reset() {
 	*x = SendEventRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_sdk_plugin_pb_backend_proto_msgTypes[53]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[60]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *SendEventRequest) String() string {
@@ -3677,8 +3932,8 @@ func (x *SendEventRequest) String() string {
 func (*SendEventRequest) ProtoMessage() {}
 
 func (x *SendEventRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[53]
-	if protoimpl.UnsafeEnabled && x != nil {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[60]
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -3690,7 +3945,7 @@ func (x *SendEventRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SendEventRequest.ProtoReflect.Descriptor instead.
 func (*SendEventRequest) Descriptor() ([]byte, []int) {
-	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{53}
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{60}
 }
 
 func (x *SendEventRequest) GetEventType() string {
@@ -3707,91 +3962,154 @@ func (x *SendEventRequest) GetEvent() *logical.EventData {
 	return nil
 }
 
+type RecordObservationRequest struct {
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	ObservationType string                 `protobuf:"bytes,1,opt,name=observation_type,json=observationType,proto3" json:"observation_type,omitempty"`
+	Data            *structpb.Struct       `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *RecordObservationRequest) Reset() {
+	*x = RecordObservationRequest{}
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[61]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RecordObservationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RecordObservationRequest) ProtoMessage() {}
+
+func (x *RecordObservationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sdk_plugin_pb_backend_proto_msgTypes[61]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RecordObservationRequest.ProtoReflect.Descriptor instead.
+func (*RecordObservationRequest) Descriptor() ([]byte, []int) {
+	return file_sdk_plugin_pb_backend_proto_rawDescGZIP(), []int{61}
+}
+
+func (x *RecordObservationRequest) GetObservationType() string {
+	if x != nil {
+		return x.ObservationType
+	}
+	return ""
+}
+
+func (x *RecordObservationRequest) GetData() *structpb.Struct {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
 var File_sdk_plugin_pb_backend_proto protoreflect.FileDescriptor
 
-var file_sdk_plugin_pb_backend_proto_rawDesc = []byte{
+var file_sdk_plugin_pb_backend_proto_rawDesc = string([]byte{
 	0x0a, 0x1b, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2f, 0x70, 0x62, 0x2f,
 	0x62, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x02, 0x70,
-	0x62, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x1a, 0x17, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2f,
-	0x65, 0x76, 0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1a, 0x73, 0x64, 0x6b,
-	0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74,
-	0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x18, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67,
-	0x69, 0x63, 0x61, 0x6c, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x22, 0x07, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x20, 0x0a, 0x06, 0x48, 0x65,
-	0x61, 0x64, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x01,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x22, 0x5b, 0x0a, 0x0a,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x72,
-	0x72, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x65, 0x72,
-	0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x65, 0x72, 0x72, 0x5f, 0x6d, 0x73, 0x67,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x65, 0x72, 0x72, 0x4d, 0x73, 0x67, 0x12, 0x19,
-	0x0a, 0x08, 0x65, 0x72, 0x72, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03,
-	0x52, 0x07, 0x65, 0x72, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x22, 0x80, 0x02, 0x0a, 0x05, 0x50, 0x61,
-	0x74, 0x68, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x04, 0x72, 0x6f, 0x6f, 0x74, 0x12, 0x28, 0x0a, 0x0f, 0x75, 0x6e, 0x61, 0x75, 0x74,
-	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x0f, 0x75, 0x6e, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x64, 0x12, 0x23, 0x0a, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x61,
-	0x67, 0x65, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x53,
-	0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x12, 0x2a, 0x0a, 0x11, 0x73, 0x65, 0x61, 0x6c, 0x5f, 0x77,
-	0x72, 0x61, 0x70, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x18, 0x04, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x0f, 0x73, 0x65, 0x61, 0x6c, 0x57, 0x72, 0x61, 0x70, 0x53, 0x74, 0x6f, 0x72, 0x61,
-	0x67, 0x65, 0x12, 0x36, 0x0a, 0x17, 0x77, 0x72, 0x69, 0x74, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x77,
-	0x61, 0x72, 0x64, 0x65, 0x64, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x18, 0x05, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x15, 0x77, 0x72, 0x69, 0x74, 0x65, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72,
-	0x64, 0x65, 0x64, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x69,
-	0x6e, 0x61, 0x72, 0x79, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x62, 0x69, 0x6e, 0x61,
-	0x72, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64, 0x18, 0x07, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64, 0x22, 0xbf, 0x06, 0x0a,
-	0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2e, 0x0a, 0x12, 0x52, 0x65, 0x70, 0x6c,
-	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x52, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x1c, 0x0a, 0x09, 0x6f, 0x70, 0x65, 0x72,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6f, 0x70, 0x65,
-	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x12, 0x22,
-	0x0a, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0a,
-	0x2e, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72,
-	0x65, 0x74, 0x12, 0x1c, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x08, 0x2e, 0x70, 0x62, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68,
-	0x12, 0x32, 0x0a, 0x07, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x18, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x48,
-	0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x68, 0x65, 0x61,
-	0x64, 0x65, 0x72, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x74,
-	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x32, 0x0a, 0x15, 0x63, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72,
-	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x64,
-	0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1f,
-	0x0a, 0x0b, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x0c, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0a, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x50, 0x6f, 0x69, 0x6e, 0x74, 0x12,
-	0x1d, 0x0a, 0x0a, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x0d, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x25,
-	0x0a, 0x0e, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72,
-	0x18, 0x0e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x63, 0x63,
-	0x65, 0x73, 0x73, 0x6f, 0x72, 0x12, 0x30, 0x0a, 0x09, 0x77, 0x72, 0x61, 0x70, 0x5f, 0x69, 0x6e,
-	0x66, 0x6f, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x57, 0x72, 0x61, 0x70, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x77,
-	0x72, 0x61, 0x70, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x72, 0x65, 0x6d, 0x61, 0x69, 0x6e, 0x69, 0x6e,
-	0x67, 0x5f, 0x75, 0x73, 0x65, 0x73, 0x18, 0x10, 0x20, 0x01, 0x28, 0x03, 0x52, 0x18, 0x63, 0x6c,
-	0x69, 0x65, 0x6e, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x6d, 0x61, 0x69, 0x6e, 0x69,
-	0x6e, 0x67, 0x55, 0x73, 0x65, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79,
-	0x5f, 0x69, 0x64, 0x18, 0x11, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x74, 0x69, 0x74,
-	0x79, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5f, 0x6f, 0x76,
-	0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x18, 0x12, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x6f,
-	0x6c, 0x69, 0x63, 0x79, 0x4f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x12, 0x28, 0x0a, 0x0f,
-	0x75, 0x6e, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18,
-	0x13, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f, 0x75, 0x6e, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74,
-	0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x62, 0x2e,
-	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x6e,
-	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0x46, 0x0a, 0x0c, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
+	0x62, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2f, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
+	0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x17, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2f, 0x65, 0x76,
+	0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1a, 0x73, 0x64, 0x6b, 0x2f, 0x6c,
+	0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x18, 0x73, 0x64, 0x6b, 0x2f, 0x6c, 0x6f, 0x67, 0x69, 0x63,
+	0x61, 0x6c, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
+	0x07, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x20, 0x0a, 0x06, 0x48, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x22, 0x5b, 0x0a, 0x0a, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x72, 0x72, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x65, 0x72, 0x72, 0x54,
+	0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x65, 0x72, 0x72, 0x5f, 0x6d, 0x73, 0x67, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x65, 0x72, 0x72, 0x4d, 0x73, 0x67, 0x12, 0x19, 0x0a, 0x08,
+	0x65, 0x72, 0x72, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07,
+	0x65, 0x72, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x22, 0xb0, 0x02, 0x0a, 0x05, 0x50, 0x61, 0x74, 0x68,
+	0x73, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x04, 0x72, 0x6f, 0x6f, 0x74, 0x12, 0x28, 0x0a, 0x0f, 0x75, 0x6e, 0x61, 0x75, 0x74, 0x68, 0x65,
+	0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f,
+	0x75, 0x6e, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12,
+	0x23, 0x0a, 0x0d, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x53, 0x74, 0x6f,
+	0x72, 0x61, 0x67, 0x65, 0x12, 0x2a, 0x0a, 0x11, 0x73, 0x65, 0x61, 0x6c, 0x5f, 0x77, 0x72, 0x61,
+	0x70, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x0f, 0x73, 0x65, 0x61, 0x6c, 0x57, 0x72, 0x61, 0x70, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
+	0x12, 0x36, 0x0a, 0x17, 0x77, 0x72, 0x69, 0x74, 0x65, 0x5f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72,
+	0x64, 0x65, 0x64, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x18, 0x05, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x15, 0x77, 0x72, 0x69, 0x74, 0x65, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65,
+	0x64, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x69, 0x6e, 0x61,
+	0x72, 0x79, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x62, 0x69, 0x6e, 0x61, 0x72, 0x79,
+	0x12, 0x18, 0x0a, 0x07, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64, 0x18, 0x07, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x07, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x13, 0x61, 0x6c,
+	0x6c, 0x6f, 0x77, 0x5f, 0x73, 0x6e, 0x61, 0x70, 0x73, 0x68, 0x6f, 0x74, 0x5f, 0x72, 0x65, 0x61,
+	0x64, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x53, 0x6e,
+	0x61, 0x70, 0x73, 0x68, 0x6f, 0x74, 0x52, 0x65, 0x61, 0x64, 0x22, 0xa1, 0x07, 0x0a, 0x07, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x2e, 0x0a, 0x12, 0x52, 0x65, 0x70, 0x6c, 0x69, 0x63,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x12, 0x52, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x43,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x1c, 0x0a, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x12, 0x22, 0x0a, 0x06,
+	0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0a, 0x2e, 0x70,
+	0x62, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x06, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74,
+	0x12, 0x1c, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x08,
+	0x2e, 0x70, 0x62, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x32,
+	0x0a, 0x07, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x18, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x48, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x68, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x32, 0x0a, 0x15, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x18, 0x0a,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x69, 0x73,
+	0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b,
+	0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x0c, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0a, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x50, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x1d, 0x0a,
+	0x0a, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x09, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x25, 0x0a, 0x0e,
+	0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x18, 0x0e,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x6f, 0x72, 0x12, 0x30, 0x0a, 0x09, 0x77, 0x72, 0x61, 0x70, 0x5f, 0x69, 0x6e, 0x66, 0x6f,
+	0x18, 0x0f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x57, 0x72, 0x61, 0x70, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x08, 0x77, 0x72, 0x61,
+	0x70, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x72, 0x65, 0x6d, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67, 0x5f,
+	0x75, 0x73, 0x65, 0x73, 0x18, 0x10, 0x20, 0x01, 0x28, 0x03, 0x52, 0x18, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x6d, 0x61, 0x69, 0x6e, 0x69, 0x6e, 0x67,
+	0x55, 0x73, 0x65, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x69,
+	0x64, 0x18, 0x11, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49,
+	0x64, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5f, 0x6f, 0x76, 0x65, 0x72,
+	0x72, 0x69, 0x64, 0x65, 0x18, 0x12, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x4f, 0x76, 0x65, 0x72, 0x72, 0x69, 0x64, 0x65, 0x12, 0x28, 0x0a, 0x0f, 0x75, 0x6e,
+	0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18, 0x13, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x0f, 0x75, 0x6e, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x30, 0x0a, 0x14, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73,
+	0x5f, 0x73, 0x6e, 0x61, 0x70, 0x73, 0x68, 0x6f, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x15, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x12, 0x72, 0x65, 0x71, 0x75, 0x69, 0x72, 0x65, 0x73, 0x53, 0x6e, 0x61, 0x70,
+	0x73, 0x68, 0x6f, 0x74, 0x49, 0x64, 0x12, 0x2e, 0x0a, 0x13, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65,
+	0x72, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x16, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x11, 0x72, 0x65, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x53, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x50, 0x61, 0x74, 0x68, 0x1a, 0x46, 0x0a, 0x0c, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
 	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
 	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x20, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
 	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0a, 0x2e, 0x70, 0x62, 0x2e, 0x48, 0x65, 0x61,
@@ -4115,180 +4433,251 @@ var file_sdk_plugin_pb_backend_proto_rawDesc = []byte{
 	0x74, 0x69, 0x74, 0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
 	0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
 	0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x74, 0x74, 0x6c, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x74, 0x74, 0x6c, 0x22, 0x8e, 0x01, 0x0a, 0x0a, 0x43, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x72, 0x65, 0x6d, 0x6f,
-	0x74, 0x65, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x72,
-	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x41, 0x64, 0x64, 0x72, 0x12, 0x1f, 0x0a, 0x0b, 0x72, 0x65, 0x6d,
-	0x6f, 0x74, 0x65, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a,
-	0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x3e, 0x0a, 0x10, 0x63, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-	0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x22, 0xbb, 0x04, 0x0a, 0x0f, 0x43,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x18,
-	0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52,
-	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2d, 0x0a, 0x12, 0x68, 0x61, 0x6e, 0x64,
-	0x73, 0x68, 0x61, 0x6b, 0x65, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x68, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x43,
-	0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x69, 0x64, 0x5f, 0x72,
-	0x65, 0x73, 0x75, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x64, 0x69, 0x64,
-	0x52, 0x65, 0x73, 0x75, 0x6d, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72,
-	0x5f, 0x73, 0x75, 0x69, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0b, 0x63, 0x69,
-	0x70, 0x68, 0x65, 0x72, 0x53, 0x75, 0x69, 0x74, 0x65, 0x12, 0x2f, 0x0a, 0x13, 0x6e, 0x65, 0x67,
-	0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6e, 0x65, 0x67, 0x6f, 0x74, 0x69, 0x61, 0x74,
-	0x65, 0x64, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x41, 0x0a, 0x1d, 0x6e, 0x65,
-	0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f,
-	0x6c, 0x5f, 0x69, 0x73, 0x5f, 0x6d, 0x75, 0x74, 0x75, 0x61, 0x6c, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x1a, 0x6e, 0x65, 0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x64, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x49, 0x73, 0x4d, 0x75, 0x74, 0x75, 0x61, 0x6c, 0x12, 0x1f, 0x0a,
-	0x0b, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x07, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x41,
-	0x0a, 0x11, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
-	0x74, 0x65, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x43,
-	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x52,
-	0x10, 0x70, 0x65, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
-	0x73, 0x12, 0x3d, 0x0a, 0x0f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x63, 0x68,
-	0x61, 0x69, 0x6e, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70, 0x62, 0x2e,
-	0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e,
-	0x52, 0x0e, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x73,
-	0x12, 0x42, 0x0a, 0x1d, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x69,
-	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x1b, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x43,
-	0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
-	0x61, 0x6d, 0x70, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x6f, 0x63, 0x73, 0x70, 0x5f, 0x72, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x6f, 0x63, 0x73,
-	0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6c, 0x73,
-	0x5f, 0x75, 0x6e, 0x69, 0x71, 0x75, 0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x74,
-	0x6c, 0x73, 0x55, 0x6e, 0x69, 0x71, 0x75, 0x65, 0x22, 0x2a, 0x0a, 0x0b, 0x43, 0x65, 0x72, 0x74,
-	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x61, 0x73, 0x6e, 0x31, 0x5f,
-	0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x61, 0x73, 0x6e, 0x31,
-	0x44, 0x61, 0x74, 0x61, 0x22, 0x47, 0x0a, 0x10, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
-	0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x33, 0x0a, 0x0c, 0x63, 0x65, 0x72, 0x74,
-	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f,
-	0x2e, 0x70, 0x62, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52,
-	0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x22, 0x5b, 0x0a,
-	0x10, 0x53, 0x65, 0x6e, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65,
-	0x12, 0x28, 0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x12, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x44,
-	0x61, 0x74, 0x61, 0x52, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x32, 0xa5, 0x03, 0x0a, 0x07, 0x42,
-	0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x12, 0x3e, 0x0a, 0x0d, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x15, 0x2e, 0x70, 0x62, 0x2e, 0x48, 0x61, 0x6e,
-	0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x16,
-	0x2e, 0x70, 0x62, 0x2e, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x30, 0x0a, 0x0c, 0x53, 0x70, 0x65, 0x63, 0x69, 0x61,
-	0x6c, 0x50, 0x61, 0x74, 0x68, 0x73, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74,
-	0x79, 0x1a, 0x15, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x70, 0x65, 0x63, 0x69, 0x61, 0x6c, 0x50, 0x61,
-	0x74, 0x68, 0x73, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x53, 0x0a, 0x14, 0x48, 0x61, 0x6e, 0x64,
-	0x6c, 0x65, 0x45, 0x78, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x63, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b,
-	0x12, 0x1c, 0x2e, 0x70, 0x62, 0x2e, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x73,
-	0x74, 0x65, 0x6e, 0x63, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x1d,
-	0x2e, 0x70, 0x62, 0x2e, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x73, 0x74, 0x65,
-	0x6e, 0x63, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x1f, 0x0a,
-	0x07, 0x43, 0x6c, 0x65, 0x61, 0x6e, 0x75, 0x70, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x1a, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x31,
-	0x0a, 0x0d, 0x49, 0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12,
-	0x15, 0x2e, 0x70, 0x62, 0x2e, 0x49, 0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x4b,
-	0x65, 0x79, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74,
-	0x79, 0x12, 0x26, 0x0a, 0x05, 0x53, 0x65, 0x74, 0x75, 0x70, 0x12, 0x0d, 0x2e, 0x70, 0x62, 0x2e,
-	0x53, 0x65, 0x74, 0x75, 0x70, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x53,
-	0x65, 0x74, 0x75, 0x70, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x35, 0x0a, 0x0a, 0x49, 0x6e, 0x69,
-	0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x12, 0x12, 0x2e, 0x70, 0x62, 0x2e, 0x49, 0x6e, 0x69,
-	0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x13, 0x2e, 0x70, 0x62,
-	0x2e, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a, 0x65, 0x52, 0x65, 0x70, 0x6c, 0x79,
-	0x12, 0x20, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x1a, 0x0d, 0x2e, 0x70, 0x62, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x65, 0x70,
-	0x6c, 0x79, 0x32, 0xd5, 0x01, 0x0a, 0x07, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x12, 0x31,
-	0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x13, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72,
-	0x61, 0x67, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x14, 0x2e, 0x70, 0x62,
-	0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x70, 0x6c,
-	0x79, 0x12, 0x2e, 0x0a, 0x03, 0x47, 0x65, 0x74, 0x12, 0x12, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74,
-	0x6f, 0x72, 0x61, 0x67, 0x65, 0x47, 0x65, 0x74, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x13, 0x2e, 0x70,
-	0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x47, 0x65, 0x74, 0x52, 0x65, 0x70, 0x6c,
-	0x79, 0x12, 0x2e, 0x0a, 0x03, 0x50, 0x75, 0x74, 0x12, 0x12, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74,
-	0x6f, 0x72, 0x61, 0x67, 0x65, 0x50, 0x75, 0x74, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x13, 0x2e, 0x70,
-	0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x50, 0x75, 0x74, 0x52, 0x65, 0x70, 0x6c,
-	0x79, 0x12, 0x37, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x15, 0x2e, 0x70, 0x62,
-	0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x72,
-	0x67, 0x73, 0x1a, 0x16, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x32, 0xbf, 0x06, 0x0a, 0x0a, 0x53,
-	0x79, 0x73, 0x74, 0x65, 0x6d, 0x56, 0x69, 0x65, 0x77, 0x12, 0x2a, 0x0a, 0x0f, 0x44, 0x65, 0x66,
-	0x61, 0x75, 0x6c, 0x74, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x54, 0x54, 0x4c, 0x12, 0x09, 0x2e, 0x70,
-	0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0c, 0x2e, 0x70, 0x62, 0x2e, 0x54, 0x54, 0x4c,
-	0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x26, 0x0a, 0x0b, 0x4d, 0x61, 0x78, 0x4c, 0x65, 0x61, 0x73,
-	0x65, 0x54, 0x54, 0x4c, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a,
-	0x0c, 0x2e, 0x70, 0x62, 0x2e, 0x54, 0x54, 0x4c, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x26, 0x0a,
-	0x07, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x65, 0x64, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x1a, 0x10, 0x2e, 0x70, 0x62, 0x2e, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x65, 0x64,
-	0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x36, 0x0a, 0x0f, 0x43, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x67,
-	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x1a, 0x18, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x67,
-	0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x38, 0x0a,
-	0x10, 0x52, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x70,
-	0x62, 0x2e, 0x52, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61,
-	0x74, 0x65, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x47, 0x0a, 0x10, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x57, 0x72, 0x61, 0x70, 0x44, 0x61, 0x74, 0x61, 0x12, 0x18, 0x2e, 0x70, 0x62,
-	0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x57, 0x72, 0x61, 0x70, 0x44, 0x61, 0x74,
-	0x61, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x19, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x57, 0x72, 0x61, 0x70, 0x44, 0x61, 0x74, 0x61, 0x52, 0x65, 0x70, 0x6c, 0x79,
-	0x12, 0x30, 0x0a, 0x0c, 0x4d, 0x6c, 0x6f, 0x63, 0x6b, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
+	0x20, 0x01, 0x28, 0x03, 0x52, 0x03, 0x74, 0x74, 0x6c, 0x22, 0x34, 0x0a, 0x13, 0x52, 0x6f, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x50, 0x61, 0x74, 0x68, 0x22,
+	0x65, 0x0a, 0x11, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x52,
+	0x65, 0x70, 0x6c, 0x79, 0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x73, 0x73, 0x75, 0x65, 0x5f, 0x74, 0x69,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x69, 0x73, 0x73, 0x75, 0x65, 0x54,
+	0x69, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65, 0x5f, 0x74, 0x69,
+	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x65,
+	0x54, 0x69, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x74, 0x74, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x03, 0x74, 0x74, 0x6c, 0x22, 0x44, 0x0a, 0x1a, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74,
+	0x65, 0x72, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4a, 0x6f, 0x62, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x26, 0x0a, 0x03, 0x6a, 0x6f, 0x62, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4a,
+	0x6f, 0x62, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x52, 0x03, 0x6a, 0x6f, 0x62, 0x22, 0x50, 0x0a, 0x1b,
+	0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x4a, 0x6f, 0x62, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x72,
+	0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0a, 0x72, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x10, 0x0a, 0x03,
+	0x65, 0x72, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x65, 0x72, 0x72, 0x22, 0xda,
+	0x01, 0x0a, 0x10, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4a, 0x6f, 0x62, 0x49, 0x6e,
+	0x70, 0x75, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6d, 0x6f, 0x75, 0x6e, 0x74,
+	0x5f, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6d, 0x6f,
+	0x75, 0x6e, 0x74, 0x50, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x2b, 0x0a, 0x11,
+	0x72, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c,
+	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x72, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x53, 0x63, 0x68, 0x65, 0x64, 0x75, 0x6c, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x72, 0x6f, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x0e, 0x72, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x57, 0x69, 0x6e, 0x64,
+	0x6f, 0x77, 0x12, 0x27, 0x0a, 0x0f, 0x72, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x70,
+	0x65, 0x72, 0x69, 0x6f, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0e, 0x72, 0x6f, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x65, 0x72, 0x69, 0x6f, 0x64, 0x22, 0x5c, 0x0a, 0x1e, 0x44,
+	0x65, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x12, 0x1f, 0x0a,
+	0x0b, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0a, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x50, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x19,
+	0x0a, 0x08, 0x72, 0x65, 0x71, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x72, 0x65, 0x71, 0x50, 0x61, 0x74, 0x68, 0x22, 0x54, 0x0a, 0x1c, 0x44, 0x65, 0x72,
+	0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4a,
+	0x6f, 0x62, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x34, 0x0a, 0x03, 0x72, 0x65, 0x71,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x62, 0x2e, 0x44, 0x65, 0x72, 0x65,
+	0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x52, 0x03, 0x72, 0x65, 0x71, 0x22,
+	0x8e, 0x01, 0x0a, 0x0a, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f,
+	0x0a, 0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0a, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x41, 0x64, 0x64, 0x72, 0x12,
+	0x1f, 0x0a, 0x0b, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x05, 0x52, 0x0a, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x50, 0x6f, 0x72, 0x74,
+	0x12, 0x3e, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73,
+	0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x62, 0x2e,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52,
+	0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65,
+	0x22, 0xbb, 0x04, 0x0a, 0x0f, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2d,
+	0x0a, 0x12, 0x68, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x5f, 0x63, 0x6f, 0x6d, 0x70,
+	0x6c, 0x65, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x68, 0x61, 0x6e, 0x64,
+	0x73, 0x68, 0x61, 0x6b, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x1d, 0x0a,
+	0x0a, 0x64, 0x69, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x75, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x09, 0x64, 0x69, 0x64, 0x52, 0x65, 0x73, 0x75, 0x6d, 0x65, 0x12, 0x21, 0x0a, 0x0c,
+	0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x5f, 0x73, 0x75, 0x69, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x0d, 0x52, 0x0b, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x53, 0x75, 0x69, 0x74, 0x65, 0x12,
+	0x2f, 0x0a, 0x13, 0x6e, 0x65, 0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6e, 0x65,
+	0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x64, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
+	0x12, 0x41, 0x0a, 0x1d, 0x6e, 0x65, 0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x5f, 0x69, 0x73, 0x5f, 0x6d, 0x75, 0x74, 0x75, 0x61,
+	0x6c, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1a, 0x6e, 0x65, 0x67, 0x6f, 0x74, 0x69, 0x61,
+	0x74, 0x65, 0x64, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x49, 0x73, 0x4d, 0x75, 0x74,
+	0x75, 0x61, 0x6c, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x41, 0x0a, 0x11, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x63, 0x65, 0x72,
+	0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x14, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x43, 0x68, 0x61, 0x69, 0x6e, 0x52, 0x10, 0x70, 0x65, 0x65, 0x72, 0x43, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x12, 0x3d, 0x0a, 0x0f, 0x76, 0x65, 0x72, 0x69, 0x66,
+	0x69, 0x65, 0x64, 0x5f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x52, 0x0e, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x65, 0x64,
+	0x43, 0x68, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x42, 0x0a, 0x1d, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64,
+	0x5f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x1b, 0x73,
+	0x69, 0x67, 0x6e, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x6f, 0x63,
+	0x73, 0x70, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x0c, 0x6f, 0x63, 0x73, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x1d, 0x0a, 0x0a, 0x74, 0x6c, 0x73, 0x5f, 0x75, 0x6e, 0x69, 0x71, 0x75, 0x65, 0x18, 0x0c, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x09, 0x74, 0x6c, 0x73, 0x55, 0x6e, 0x69, 0x71, 0x75, 0x65, 0x22, 0x2a,
+	0x0a, 0x0b, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1b, 0x0a,
+	0x09, 0x61, 0x73, 0x6e, 0x31, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x08, 0x61, 0x73, 0x6e, 0x31, 0x44, 0x61, 0x74, 0x61, 0x22, 0x47, 0x0a, 0x10, 0x43, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x33,
+	0x0a, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x73, 0x22, 0x5b, 0x0a, 0x10, 0x53, 0x65, 0x6e, 0x64, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74,
+	0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x65, 0x76, 0x65,
+	0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x28, 0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x6c, 0x6f, 0x67, 0x69, 0x63, 0x61, 0x6c, 0x2e,
+	0x45, 0x76, 0x65, 0x6e, 0x74, 0x44, 0x61, 0x74, 0x61, 0x52, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74,
+	0x22, 0x72, 0x0a, 0x18, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4f, 0x62, 0x73, 0x65, 0x72, 0x76,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x29, 0x0a, 0x10,
+	0x6f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x79, 0x70, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x12, 0x2b, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x04,
+	0x64, 0x61, 0x74, 0x61, 0x32, 0xa5, 0x03, 0x0a, 0x07, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64,
+	0x12, 0x3e, 0x0a, 0x0d, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x15, 0x2e, 0x70, 0x62, 0x2e, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x16, 0x2e, 0x70, 0x62, 0x2e, 0x48, 0x61,
+	0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x52, 0x65, 0x70, 0x6c, 0x79,
+	0x12, 0x30, 0x0a, 0x0c, 0x53, 0x70, 0x65, 0x63, 0x69, 0x61, 0x6c, 0x50, 0x61, 0x74, 0x68, 0x73,
 	0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x15, 0x2e, 0x70, 0x62,
-	0x2e, 0x4d, 0x6c, 0x6f, 0x63, 0x6b, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x65, 0x70,
-	0x6c, 0x79, 0x12, 0x2c, 0x0a, 0x0a, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x4d, 0x6f, 0x75, 0x6e, 0x74,
-	0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x13, 0x2e, 0x70, 0x62,
-	0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x70, 0x6c, 0x79,
-	0x12, 0x35, 0x0a, 0x0a, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x12,
-	0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f, 0x41, 0x72,
-	0x67, 0x73, 0x1a, 0x13, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x6e,
-	0x66, 0x6f, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x2a, 0x0a, 0x09, 0x50, 0x6c, 0x75, 0x67, 0x69,
-	0x6e, 0x45, 0x6e, 0x76, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a,
-	0x12, 0x2e, 0x70, 0x62, 0x2e, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x45, 0x6e, 0x76, 0x52, 0x65,
-	0x70, 0x6c, 0x79, 0x12, 0x3f, 0x0a, 0x0f, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x46, 0x6f, 0x72,
-	0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x12, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6e, 0x74, 0x69,
-	0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x18, 0x2e, 0x70, 0x62, 0x2e,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x46, 0x6f, 0x72, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52,
-	0x65, 0x70, 0x6c, 0x79, 0x12, 0x68, 0x0a, 0x1a, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65,
-	0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x12, 0x25, 0x2e, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65,
-	0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x50, 0x6f, 0x6c, 0x69,
-	0x63, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x62, 0x2e, 0x47,
-	0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x46,
-	0x72, 0x6f, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x2e,
-	0x0a, 0x0b, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x09, 0x2e,
-	0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x6c,
-	0x75, 0x73, 0x74, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x5c,
-	0x0a, 0x15, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69,
-	0x74, 0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x20, 0x2e, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x6e,
-	0x65, 0x72, 0x61, 0x74, 0x65, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x62, 0x2e, 0x47,
-	0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x54,
-	0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0x36, 0x0a, 0x06,
-	0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x09, 0x53, 0x65, 0x6e, 0x64, 0x45, 0x76,
-	0x65, 0x6e, 0x74, 0x12, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x45, 0x76, 0x65,
-	0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45,
+	0x2e, 0x53, 0x70, 0x65, 0x63, 0x69, 0x61, 0x6c, 0x50, 0x61, 0x74, 0x68, 0x73, 0x52, 0x65, 0x70,
+	0x6c, 0x79, 0x12, 0x53, 0x0a, 0x14, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x73,
+	0x74, 0x65, 0x6e, 0x63, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x1c, 0x2e, 0x70, 0x62, 0x2e,
+	0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x63, 0x65, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x1d, 0x2e, 0x70, 0x62, 0x2e, 0x48, 0x61,
+	0x6e, 0x64, 0x6c, 0x65, 0x45, 0x78, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x63, 0x65, 0x43, 0x68, 0x65,
+	0x63, 0x6b, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x1f, 0x0a, 0x07, 0x43, 0x6c, 0x65, 0x61, 0x6e,
+	0x75, 0x70, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x09, 0x2e,
+	0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x31, 0x0a, 0x0d, 0x49, 0x6e, 0x76, 0x61,
+	0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x15, 0x2e, 0x70, 0x62, 0x2e, 0x49,
+	0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x41, 0x72, 0x67, 0x73,
+	0x1a, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x26, 0x0a, 0x05, 0x53,
+	0x65, 0x74, 0x75, 0x70, 0x12, 0x0d, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x74, 0x75, 0x70, 0x41,
+	0x72, 0x67, 0x73, 0x1a, 0x0e, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x74, 0x75, 0x70, 0x52, 0x65,
+	0x70, 0x6c, 0x79, 0x12, 0x35, 0x0a, 0x0a, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a,
+	0x65, 0x12, 0x12, 0x2e, 0x70, 0x62, 0x2e, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x69, 0x7a,
+	0x65, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x13, 0x2e, 0x70, 0x62, 0x2e, 0x49, 0x6e, 0x69, 0x74, 0x69,
+	0x61, 0x6c, 0x69, 0x7a, 0x65, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x20, 0x0a, 0x04, 0x54, 0x79,
+	0x70, 0x65, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0d, 0x2e,
+	0x70, 0x62, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x32, 0xd5, 0x01, 0x0a,
+	0x07, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x12, 0x31, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74,
+	0x12, 0x13, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x4c, 0x69, 0x73,
+	0x74, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61,
+	0x67, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x2e, 0x0a, 0x03, 0x47,
+	0x65, 0x74, 0x12, 0x12, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x47,
+	0x65, 0x74, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x13, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72,
+	0x61, 0x67, 0x65, 0x47, 0x65, 0x74, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x2e, 0x0a, 0x03, 0x50,
+	0x75, 0x74, 0x12, 0x12, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x50,
+	0x75, 0x74, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x13, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72,
+	0x61, 0x67, 0x65, 0x50, 0x75, 0x74, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x37, 0x0a, 0x06, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x15, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61,
+	0x67, 0x65, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x16, 0x2e, 0x70,
+	0x62, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52,
+	0x65, 0x70, 0x6c, 0x79, 0x32, 0xa7, 0x08, 0x0a, 0x0a, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x56,
+	0x69, 0x65, 0x77, 0x12, 0x2a, 0x0a, 0x0f, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x4c, 0x65,
+	0x61, 0x73, 0x65, 0x54, 0x54, 0x4c, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x1a, 0x0c, 0x2e, 0x70, 0x62, 0x2e, 0x54, 0x54, 0x4c, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12,
+	0x26, 0x0a, 0x0b, 0x4d, 0x61, 0x78, 0x4c, 0x65, 0x61, 0x73, 0x65, 0x54, 0x54, 0x4c, 0x12, 0x09,
+	0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0c, 0x2e, 0x70, 0x62, 0x2e, 0x54,
+	0x54, 0x4c, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x26, 0x0a, 0x07, 0x54, 0x61, 0x69, 0x6e, 0x74,
+	0x65, 0x64, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x10, 0x2e,
+	0x70, 0x62, 0x2e, 0x54, 0x61, 0x69, 0x6e, 0x74, 0x65, 0x64, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12,
+	0x36, 0x0a, 0x0f, 0x43, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x18, 0x2e,
+	0x70, 0x62, 0x2e, 0x43, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x67, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x64, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x38, 0x0a, 0x10, 0x52, 0x65, 0x70, 0x6c, 0x69,
+	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x09, 0x2e, 0x70, 0x62,
+	0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x70, 0x6c,
+	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x70, 0x6c,
+	0x79, 0x12, 0x47, 0x0a, 0x10, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x57, 0x72, 0x61,
+	0x70, 0x44, 0x61, 0x74, 0x61, 0x12, 0x18, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x57, 0x72, 0x61, 0x70, 0x44, 0x61, 0x74, 0x61, 0x41, 0x72, 0x67, 0x73, 0x1a,
+	0x19, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x57, 0x72, 0x61,
+	0x70, 0x44, 0x61, 0x74, 0x61, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x30, 0x0a, 0x0c, 0x4d, 0x6c,
+	0x6f, 0x63, 0x6b, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x15, 0x2e, 0x70, 0x62, 0x2e, 0x4d, 0x6c, 0x6f, 0x63, 0x6b,
+	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x2c, 0x0a, 0x0a,
+	0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x13, 0x2e, 0x70, 0x62, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x6c,
+	0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x35, 0x0a, 0x0a, 0x45, 0x6e,
+	0x74, 0x69, 0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x12, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6e,
+	0x74, 0x69, 0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x13, 0x2e, 0x70,
+	0x62, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x70, 0x6c,
+	0x79, 0x12, 0x2a, 0x0a, 0x09, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x45, 0x6e, 0x76, 0x12, 0x09,
+	0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x12, 0x2e, 0x70, 0x62, 0x2e, 0x50,
+	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x45, 0x6e, 0x76, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x3f, 0x0a,
+	0x0f, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x46, 0x6f, 0x72, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79,
+	0x12, 0x12, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f,
+	0x41, 0x72, 0x67, 0x73, 0x1a, 0x18, 0x2e, 0x70, 0x62, 0x2e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73,
+	0x46, 0x6f, 0x72, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x68,
+	0x0a, 0x1a, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x25, 0x2e, 0x70,
+	0x62, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
+	0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74,
+	0x65, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x46, 0x72, 0x6f, 0x6d, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x2e, 0x0a, 0x0b, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x1a, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x49,
+	0x6e, 0x66, 0x6f, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12, 0x5c, 0x0a, 0x15, 0x47, 0x65, 0x6e, 0x65,
+	0x72, 0x61, 0x74, 0x65, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x12, 0x20, 0x2e, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65, 0x49,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74,
+	0x65, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x48, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x52, 0x6f, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x17, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e,
+	0x66, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x70, 0x62, 0x2e, 0x52,
+	0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x65, 0x70, 0x6c, 0x79,
+	0x12, 0x56, 0x0a, 0x13, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x6f, 0x74, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x4a, 0x6f, 0x62, 0x12, 0x1e, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67,
+	0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4a, 0x6f, 0x62,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67,
+	0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4a, 0x6f, 0x62,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x44, 0x0a, 0x15, 0x44, 0x65, 0x72, 0x65,
+	0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4a, 0x6f,
+	0x62, 0x12, 0x20, 0x2e, 0x70, 0x62, 0x2e, 0x44, 0x65, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65,
+	0x72, 0x52, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4a, 0x6f, 0x62, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x32, 0x36,
+	0x0a, 0x06, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x2c, 0x0a, 0x09, 0x53, 0x65, 0x6e, 0x64,
+	0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x14, 0x2e, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x09, 0x2e, 0x70, 0x62,
+	0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x32, 0x4c, 0x0a, 0x0c, 0x4f, 0x62, 0x73, 0x65, 0x72, 0x76,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x3c, 0x0a, 0x11, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x4f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1c, 0x2e, 0x70, 0x62,
+	0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x09, 0x2e, 0x70, 0x62, 0x2e, 0x45,
 	0x6d, 0x70, 0x74, 0x79, 0x42, 0x2a, 0x5a, 0x28, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
 	0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75,
 	0x6c, 0x74, 0x2f, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2f, 0x70, 0x62,
 	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_sdk_plugin_pb_backend_proto_rawDescOnce sync.Once
-	file_sdk_plugin_pb_backend_proto_rawDescData = file_sdk_plugin_pb_backend_proto_rawDesc
+	file_sdk_plugin_pb_backend_proto_rawDescData []byte
 )
 
 func file_sdk_plugin_pb_backend_proto_rawDescGZIP() []byte {
 	file_sdk_plugin_pb_backend_proto_rawDescOnce.Do(func() {
-		file_sdk_plugin_pb_backend_proto_rawDescData = protoimpl.X.CompressGZIP(file_sdk_plugin_pb_backend_proto_rawDescData)
+		file_sdk_plugin_pb_backend_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sdk_plugin_pb_backend_proto_rawDesc), len(file_sdk_plugin_pb_backend_proto_rawDesc)))
 	})
 	return file_sdk_plugin_pb_backend_proto_rawDescData
 }
 
-var file_sdk_plugin_pb_backend_proto_msgTypes = make([]protoimpl.MessageInfo, 60)
-var file_sdk_plugin_pb_backend_proto_goTypes = []interface{}{
+var file_sdk_plugin_pb_backend_proto_msgTypes = make([]protoimpl.MessageInfo, 68)
+var file_sdk_plugin_pb_backend_proto_goTypes = []any{
 	(*Empty)(nil),                             // 0: pb.Empty
 	(*Header)(nil),                            // 1: pb.Header
 	(*ProtoError)(nil),                        // 2: pb.ProtoError
@@ -4338,43 +4727,52 @@ var file_sdk_plugin_pb_backend_proto_goTypes = []interface{}{
 	(*ClusterInfoReply)(nil),                  // 46: pb.ClusterInfoReply
 	(*GenerateIdentityTokenRequest)(nil),      // 47: pb.GenerateIdentityTokenRequest
 	(*GenerateIdentityTokenResponse)(nil),     // 48: pb.GenerateIdentityTokenResponse
-	(*Connection)(nil),                        // 49: pb.Connection
-	(*ConnectionState)(nil),                   // 50: pb.ConnectionState
-	(*Certificate)(nil),                       // 51: pb.Certificate
-	(*CertificateChain)(nil),                  // 52: pb.CertificateChain
-	(*SendEventRequest)(nil),                  // 53: pb.SendEventRequest
-	nil,                                       // 54: pb.Request.HeadersEntry
-	nil,                                       // 55: pb.Auth.MetadataEntry
-	nil,                                       // 56: pb.TokenEntry.MetaEntry
-	nil,                                       // 57: pb.TokenEntry.InternalMetaEntry
-	nil,                                       // 58: pb.Response.HeadersEntry
-	nil,                                       // 59: pb.SetupArgs.ConfigEntry
-	(*logical.Alias)(nil),                     // 60: logical.Alias
-	(*timestamppb.Timestamp)(nil),             // 61: google.protobuf.Timestamp
-	(*logical.Entity)(nil),                    // 62: logical.Entity
-	(*logical.Group)(nil),                     // 63: logical.Group
-	(*logical.PluginEnvironment)(nil),         // 64: logical.PluginEnvironment
-	(*logical.EventData)(nil),                 // 65: logical.EventData
+	(*RotationInfoRequest)(nil),               // 49: pb.RotationInfoRequest
+	(*RotationInfoReply)(nil),                 // 50: pb.RotationInfoReply
+	(*RegisterRotationJobRequest)(nil),        // 51: pb.RegisterRotationJobRequest
+	(*RegisterRotationJobResponse)(nil),       // 52: pb.RegisterRotationJobResponse
+	(*RotationJobInput)(nil),                  // 53: pb.RotationJobInput
+	(*DeregisterRotationRequestInput)(nil),    // 54: pb.DeregisterRotationRequestInput
+	(*DeregisterRotationJobRequest)(nil),      // 55: pb.DeregisterRotationJobRequest
+	(*Connection)(nil),                        // 56: pb.Connection
+	(*ConnectionState)(nil),                   // 57: pb.ConnectionState
+	(*Certificate)(nil),                       // 58: pb.Certificate
+	(*CertificateChain)(nil),                  // 59: pb.CertificateChain
+	(*SendEventRequest)(nil),                  // 60: pb.SendEventRequest
+	(*RecordObservationRequest)(nil),          // 61: pb.RecordObservationRequest
+	nil,                                       // 62: pb.Request.HeadersEntry
+	nil,                                       // 63: pb.Auth.MetadataEntry
+	nil,                                       // 64: pb.TokenEntry.MetaEntry
+	nil,                                       // 65: pb.TokenEntry.InternalMetaEntry
+	nil,                                       // 66: pb.Response.HeadersEntry
+	nil,                                       // 67: pb.SetupArgs.ConfigEntry
+	(*logical.Alias)(nil),                     // 68: logical.Alias
+	(*timestamppb.Timestamp)(nil),             // 69: google.protobuf.Timestamp
+	(*logical.Entity)(nil),                    // 70: logical.Entity
+	(*logical.Group)(nil),                     // 71: logical.Group
+	(*logical.PluginEnvironment)(nil),         // 72: logical.PluginEnvironment
+	(*logical.EventData)(nil),                 // 73: logical.EventData
+	(*structpb.Struct)(nil),                   // 74: google.protobuf.Struct
 }
 var file_sdk_plugin_pb_backend_proto_depIDxs = []int32{
 	8,  // 0: pb.Request.secret:type_name -> pb.Secret
 	5,  // 1: pb.Request.auth:type_name -> pb.Auth
-	54, // 2: pb.Request.headers:type_name -> pb.Request.HeadersEntry
+	62, // 2: pb.Request.headers:type_name -> pb.Request.HeadersEntry
 	11, // 3: pb.Request.wrap_info:type_name -> pb.RequestWrapInfo
-	49, // 4: pb.Request.connection:type_name -> pb.Connection
+	56, // 4: pb.Request.connection:type_name -> pb.Connection
 	7,  // 5: pb.Auth.lease_options:type_name -> pb.LeaseOptions
-	55, // 6: pb.Auth.metadata:type_name -> pb.Auth.MetadataEntry
-	60, // 7: pb.Auth.alias:type_name -> logical.Alias
-	60, // 8: pb.Auth.group_aliases:type_name -> logical.Alias
-	56, // 9: pb.TokenEntry.meta:type_name -> pb.TokenEntry.MetaEntry
-	57, // 10: pb.TokenEntry.internal_meta:type_name -> pb.TokenEntry.InternalMetaEntry
-	61, // 11: pb.LeaseOptions.issue_time:type_name -> google.protobuf.Timestamp
+	63, // 6: pb.Auth.metadata:type_name -> pb.Auth.MetadataEntry
+	68, // 7: pb.Auth.alias:type_name -> logical.Alias
+	68, // 8: pb.Auth.group_aliases:type_name -> logical.Alias
+	64, // 9: pb.TokenEntry.meta:type_name -> pb.TokenEntry.MetaEntry
+	65, // 10: pb.TokenEntry.internal_meta:type_name -> pb.TokenEntry.InternalMetaEntry
+	69, // 11: pb.LeaseOptions.issue_time:type_name -> google.protobuf.Timestamp
 	7,  // 12: pb.Secret.lease_options:type_name -> pb.LeaseOptions
 	8,  // 13: pb.Response.secret:type_name -> pb.Secret
 	5,  // 14: pb.Response.auth:type_name -> pb.Auth
 	10, // 15: pb.Response.wrap_info:type_name -> pb.ResponseWrapInfo
-	58, // 16: pb.Response.headers:type_name -> pb.Response.HeadersEntry
-	61, // 17: pb.ResponseWrapInfo.creation_time:type_name -> google.protobuf.Timestamp
+	66, // 16: pb.Response.headers:type_name -> pb.Response.HeadersEntry
+	69, // 17: pb.ResponseWrapInfo.creation_time:type_name -> google.protobuf.Timestamp
 	4,  // 18: pb.HandleRequestArgs.request:type_name -> pb.Request
 	9,  // 19: pb.HandleRequestReply.response:type_name -> pb.Response
 	2,  // 20: pb.HandleRequestReply.err:type_name -> pb.ProtoError
@@ -4382,79 +4780,90 @@ var file_sdk_plugin_pb_backend_proto_depIDxs = []int32{
 	3,  // 22: pb.SpecialPathsReply.paths:type_name -> pb.Paths
 	4,  // 23: pb.HandleExistenceCheckArgs.request:type_name -> pb.Request
 	2,  // 24: pb.HandleExistenceCheckReply.err:type_name -> pb.ProtoError
-	59, // 25: pb.SetupArgs.Config:type_name -> pb.SetupArgs.ConfigEntry
+	67, // 25: pb.SetupArgs.Config:type_name -> pb.SetupArgs.ConfigEntry
 	23, // 26: pb.StorageGetReply.entry:type_name -> pb.StorageEntry
 	23, // 27: pb.StoragePutArgs.entry:type_name -> pb.StorageEntry
 	10, // 28: pb.ResponseWrapDataReply.wrap_info:type_name -> pb.ResponseWrapInfo
-	62, // 29: pb.EntityInfoReply.entity:type_name -> logical.Entity
-	63, // 30: pb.GroupsForEntityReply.groups:type_name -> logical.Group
-	64, // 31: pb.PluginEnvReply.plugin_environment:type_name -> logical.PluginEnvironment
-	50, // 32: pb.Connection.connection_state:type_name -> pb.ConnectionState
-	52, // 33: pb.ConnectionState.peer_certificates:type_name -> pb.CertificateChain
-	52, // 34: pb.ConnectionState.verified_chains:type_name -> pb.CertificateChain
-	51, // 35: pb.CertificateChain.certificates:type_name -> pb.Certificate
-	65, // 36: pb.SendEventRequest.event:type_name -> logical.EventData
-	1,  // 37: pb.Request.HeadersEntry.value:type_name -> pb.Header
-	1,  // 38: pb.Response.HeadersEntry.value:type_name -> pb.Header
-	12, // 39: pb.Backend.HandleRequest:input_type -> pb.HandleRequestArgs
-	0,  // 40: pb.Backend.SpecialPaths:input_type -> pb.Empty
-	17, // 41: pb.Backend.HandleExistenceCheck:input_type -> pb.HandleExistenceCheckArgs
-	0,  // 42: pb.Backend.Cleanup:input_type -> pb.Empty
-	22, // 43: pb.Backend.InvalidateKey:input_type -> pb.InvalidateKeyArgs
-	19, // 44: pb.Backend.Setup:input_type -> pb.SetupArgs
-	14, // 45: pb.Backend.Initialize:input_type -> pb.InitializeArgs
-	0,  // 46: pb.Backend.Type:input_type -> pb.Empty
-	24, // 47: pb.Storage.List:input_type -> pb.StorageListArgs
-	26, // 48: pb.Storage.Get:input_type -> pb.StorageGetArgs
-	28, // 49: pb.Storage.Put:input_type -> pb.StoragePutArgs
-	30, // 50: pb.Storage.Delete:input_type -> pb.StorageDeleteArgs
-	0,  // 51: pb.SystemView.DefaultLeaseTTL:input_type -> pb.Empty
-	0,  // 52: pb.SystemView.MaxLeaseTTL:input_type -> pb.Empty
-	0,  // 53: pb.SystemView.Tainted:input_type -> pb.Empty
-	0,  // 54: pb.SystemView.CachingDisabled:input_type -> pb.Empty
-	0,  // 55: pb.SystemView.ReplicationState:input_type -> pb.Empty
-	36, // 56: pb.SystemView.ResponseWrapData:input_type -> pb.ResponseWrapDataArgs
-	0,  // 57: pb.SystemView.MlockEnabled:input_type -> pb.Empty
-	0,  // 58: pb.SystemView.LocalMount:input_type -> pb.Empty
-	40, // 59: pb.SystemView.EntityInfo:input_type -> pb.EntityInfoArgs
-	0,  // 60: pb.SystemView.PluginEnv:input_type -> pb.Empty
-	40, // 61: pb.SystemView.GroupsForEntity:input_type -> pb.EntityInfoArgs
-	44, // 62: pb.SystemView.GeneratePasswordFromPolicy:input_type -> pb.GeneratePasswordFromPolicyRequest
-	0,  // 63: pb.SystemView.ClusterInfo:input_type -> pb.Empty
-	47, // 64: pb.SystemView.GenerateIdentityToken:input_type -> pb.GenerateIdentityTokenRequest
-	53, // 65: pb.Events.SendEvent:input_type -> pb.SendEventRequest
-	13, // 66: pb.Backend.HandleRequest:output_type -> pb.HandleRequestReply
-	16, // 67: pb.Backend.SpecialPaths:output_type -> pb.SpecialPathsReply
-	18, // 68: pb.Backend.HandleExistenceCheck:output_type -> pb.HandleExistenceCheckReply
-	0,  // 69: pb.Backend.Cleanup:output_type -> pb.Empty
-	0,  // 70: pb.Backend.InvalidateKey:output_type -> pb.Empty
-	20, // 71: pb.Backend.Setup:output_type -> pb.SetupReply
-	15, // 72: pb.Backend.Initialize:output_type -> pb.InitializeReply
-	21, // 73: pb.Backend.Type:output_type -> pb.TypeReply
-	25, // 74: pb.Storage.List:output_type -> pb.StorageListReply
-	27, // 75: pb.Storage.Get:output_type -> pb.StorageGetReply
-	29, // 76: pb.Storage.Put:output_type -> pb.StoragePutReply
-	31, // 77: pb.Storage.Delete:output_type -> pb.StorageDeleteReply
-	32, // 78: pb.SystemView.DefaultLeaseTTL:output_type -> pb.TTLReply
-	32, // 79: pb.SystemView.MaxLeaseTTL:output_type -> pb.TTLReply
-	33, // 80: pb.SystemView.Tainted:output_type -> pb.TaintedReply
-	34, // 81: pb.SystemView.CachingDisabled:output_type -> pb.CachingDisabledReply
-	35, // 82: pb.SystemView.ReplicationState:output_type -> pb.ReplicationStateReply
-	37, // 83: pb.SystemView.ResponseWrapData:output_type -> pb.ResponseWrapDataReply
-	38, // 84: pb.SystemView.MlockEnabled:output_type -> pb.MlockEnabledReply
-	39, // 85: pb.SystemView.LocalMount:output_type -> pb.LocalMountReply
-	41, // 86: pb.SystemView.EntityInfo:output_type -> pb.EntityInfoReply
-	43, // 87: pb.SystemView.PluginEnv:output_type -> pb.PluginEnvReply
-	42, // 88: pb.SystemView.GroupsForEntity:output_type -> pb.GroupsForEntityReply
-	45, // 89: pb.SystemView.GeneratePasswordFromPolicy:output_type -> pb.GeneratePasswordFromPolicyReply
-	46, // 90: pb.SystemView.ClusterInfo:output_type -> pb.ClusterInfoReply
-	48, // 91: pb.SystemView.GenerateIdentityToken:output_type -> pb.GenerateIdentityTokenResponse
-	0,  // 92: pb.Events.SendEvent:output_type -> pb.Empty
-	66, // [66:93] is the sub-list for method output_type
-	39, // [39:66] is the sub-list for method input_type
-	39, // [39:39] is the sub-list for extension type_name
-	39, // [39:39] is the sub-list for extension extendee
-	0,  // [0:39] is the sub-list for field type_name
+	70, // 29: pb.EntityInfoReply.entity:type_name -> logical.Entity
+	71, // 30: pb.GroupsForEntityReply.groups:type_name -> logical.Group
+	72, // 31: pb.PluginEnvReply.plugin_environment:type_name -> logical.PluginEnvironment
+	53, // 32: pb.RegisterRotationJobRequest.job:type_name -> pb.RotationJobInput
+	54, // 33: pb.DeregisterRotationJobRequest.req:type_name -> pb.DeregisterRotationRequestInput
+	57, // 34: pb.Connection.connection_state:type_name -> pb.ConnectionState
+	59, // 35: pb.ConnectionState.peer_certificates:type_name -> pb.CertificateChain
+	59, // 36: pb.ConnectionState.verified_chains:type_name -> pb.CertificateChain
+	58, // 37: pb.CertificateChain.certificates:type_name -> pb.Certificate
+	73, // 38: pb.SendEventRequest.event:type_name -> logical.EventData
+	74, // 39: pb.RecordObservationRequest.data:type_name -> google.protobuf.Struct
+	1,  // 40: pb.Request.HeadersEntry.value:type_name -> pb.Header
+	1,  // 41: pb.Response.HeadersEntry.value:type_name -> pb.Header
+	12, // 42: pb.Backend.HandleRequest:input_type -> pb.HandleRequestArgs
+	0,  // 43: pb.Backend.SpecialPaths:input_type -> pb.Empty
+	17, // 44: pb.Backend.HandleExistenceCheck:input_type -> pb.HandleExistenceCheckArgs
+	0,  // 45: pb.Backend.Cleanup:input_type -> pb.Empty
+	22, // 46: pb.Backend.InvalidateKey:input_type -> pb.InvalidateKeyArgs
+	19, // 47: pb.Backend.Setup:input_type -> pb.SetupArgs
+	14, // 48: pb.Backend.Initialize:input_type -> pb.InitializeArgs
+	0,  // 49: pb.Backend.Type:input_type -> pb.Empty
+	24, // 50: pb.Storage.List:input_type -> pb.StorageListArgs
+	26, // 51: pb.Storage.Get:input_type -> pb.StorageGetArgs
+	28, // 52: pb.Storage.Put:input_type -> pb.StoragePutArgs
+	30, // 53: pb.Storage.Delete:input_type -> pb.StorageDeleteArgs
+	0,  // 54: pb.SystemView.DefaultLeaseTTL:input_type -> pb.Empty
+	0,  // 55: pb.SystemView.MaxLeaseTTL:input_type -> pb.Empty
+	0,  // 56: pb.SystemView.Tainted:input_type -> pb.Empty
+	0,  // 57: pb.SystemView.CachingDisabled:input_type -> pb.Empty
+	0,  // 58: pb.SystemView.ReplicationState:input_type -> pb.Empty
+	36, // 59: pb.SystemView.ResponseWrapData:input_type -> pb.ResponseWrapDataArgs
+	0,  // 60: pb.SystemView.MlockEnabled:input_type -> pb.Empty
+	0,  // 61: pb.SystemView.LocalMount:input_type -> pb.Empty
+	40, // 62: pb.SystemView.EntityInfo:input_type -> pb.EntityInfoArgs
+	0,  // 63: pb.SystemView.PluginEnv:input_type -> pb.Empty
+	40, // 64: pb.SystemView.GroupsForEntity:input_type -> pb.EntityInfoArgs
+	44, // 65: pb.SystemView.GeneratePasswordFromPolicy:input_type -> pb.GeneratePasswordFromPolicyRequest
+	0,  // 66: pb.SystemView.ClusterInfo:input_type -> pb.Empty
+	47, // 67: pb.SystemView.GenerateIdentityToken:input_type -> pb.GenerateIdentityTokenRequest
+	49, // 68: pb.SystemView.GetRotationInformation:input_type -> pb.RotationInfoRequest
+	51, // 69: pb.SystemView.RegisterRotationJob:input_type -> pb.RegisterRotationJobRequest
+	55, // 70: pb.SystemView.DeregisterRotationJob:input_type -> pb.DeregisterRotationJobRequest
+	60, // 71: pb.Events.SendEvent:input_type -> pb.SendEventRequest
+	61, // 72: pb.Observations.RecordObservation:input_type -> pb.RecordObservationRequest
+	13, // 73: pb.Backend.HandleRequest:output_type -> pb.HandleRequestReply
+	16, // 74: pb.Backend.SpecialPaths:output_type -> pb.SpecialPathsReply
+	18, // 75: pb.Backend.HandleExistenceCheck:output_type -> pb.HandleExistenceCheckReply
+	0,  // 76: pb.Backend.Cleanup:output_type -> pb.Empty
+	0,  // 77: pb.Backend.InvalidateKey:output_type -> pb.Empty
+	20, // 78: pb.Backend.Setup:output_type -> pb.SetupReply
+	15, // 79: pb.Backend.Initialize:output_type -> pb.InitializeReply
+	21, // 80: pb.Backend.Type:output_type -> pb.TypeReply
+	25, // 81: pb.Storage.List:output_type -> pb.StorageListReply
+	27, // 82: pb.Storage.Get:output_type -> pb.StorageGetReply
+	29, // 83: pb.Storage.Put:output_type -> pb.StoragePutReply
+	31, // 84: pb.Storage.Delete:output_type -> pb.StorageDeleteReply
+	32, // 85: pb.SystemView.DefaultLeaseTTL:output_type -> pb.TTLReply
+	32, // 86: pb.SystemView.MaxLeaseTTL:output_type -> pb.TTLReply
+	33, // 87: pb.SystemView.Tainted:output_type -> pb.TaintedReply
+	34, // 88: pb.SystemView.CachingDisabled:output_type -> pb.CachingDisabledReply
+	35, // 89: pb.SystemView.ReplicationState:output_type -> pb.ReplicationStateReply
+	37, // 90: pb.SystemView.ResponseWrapData:output_type -> pb.ResponseWrapDataReply
+	38, // 91: pb.SystemView.MlockEnabled:output_type -> pb.MlockEnabledReply
+	39, // 92: pb.SystemView.LocalMount:output_type -> pb.LocalMountReply
+	41, // 93: pb.SystemView.EntityInfo:output_type -> pb.EntityInfoReply
+	43, // 94: pb.SystemView.PluginEnv:output_type -> pb.PluginEnvReply
+	42, // 95: pb.SystemView.GroupsForEntity:output_type -> pb.GroupsForEntityReply
+	45, // 96: pb.SystemView.GeneratePasswordFromPolicy:output_type -> pb.GeneratePasswordFromPolicyReply
+	46, // 97: pb.SystemView.ClusterInfo:output_type -> pb.ClusterInfoReply
+	48, // 98: pb.SystemView.GenerateIdentityToken:output_type -> pb.GenerateIdentityTokenResponse
+	50, // 99: pb.SystemView.GetRotationInformation:output_type -> pb.RotationInfoReply
+	52, // 100: pb.SystemView.RegisterRotationJob:output_type -> pb.RegisterRotationJobResponse
+	0,  // 101: pb.SystemView.DeregisterRotationJob:output_type -> pb.Empty
+	0,  // 102: pb.Events.SendEvent:output_type -> pb.Empty
+	0,  // 103: pb.Observations.RecordObservation:output_type -> pb.Empty
+	73, // [73:104] is the sub-list for method output_type
+	42, // [42:73] is the sub-list for method input_type
+	42, // [42:42] is the sub-list for extension type_name
+	42, // [42:42] is the sub-list for extension extendee
+	0,  // [0:42] is the sub-list for field type_name
 }
 
 func init() { file_sdk_plugin_pb_backend_proto_init() }
@@ -4462,672 +4871,21 @@ func file_sdk_plugin_pb_backend_proto_init() {
 	if File_sdk_plugin_pb_backend_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_sdk_plugin_pb_backend_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Empty); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Header); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ProtoError); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Paths); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Request); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Auth); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TokenEntry); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LeaseOptions); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Secret); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Response); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ResponseWrapInfo); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RequestWrapInfo); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HandleRequestArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HandleRequestReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*InitializeArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*InitializeReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SpecialPathsReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HandleExistenceCheckArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HandleExistenceCheckReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetupArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetupReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TypeReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*InvalidateKeyArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StorageEntry); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StorageListArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StorageListReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StorageGetArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StorageGetReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StoragePutArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StoragePutReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StorageDeleteArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StorageDeleteReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TTLReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TaintedReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CachingDisabledReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ReplicationStateReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ResponseWrapDataArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ResponseWrapDataReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MlockEnabledReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LocalMountReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EntityInfoArgs); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EntityInfoReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[42].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GroupsForEntityReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[43].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PluginEnvReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[44].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GeneratePasswordFromPolicyRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[45].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GeneratePasswordFromPolicyReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[46].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ClusterInfoReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GenerateIdentityTokenRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GenerateIdentityTokenResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Connection); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ConnectionState); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Certificate); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CertificateChain); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_sdk_plugin_pb_backend_proto_msgTypes[53].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SendEventRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_sdk_plugin_pb_backend_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sdk_plugin_pb_backend_proto_rawDesc), len(file_sdk_plugin_pb_backend_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   60,
+			NumMessages:   68,
 			NumExtensions: 0,
-			NumServices:   4,
+			NumServices:   5,
 		},
 		GoTypes:           file_sdk_plugin_pb_backend_proto_goTypes,
 		DependencyIndexes: file_sdk_plugin_pb_backend_proto_depIDxs,
 		MessageInfos:      file_sdk_plugin_pb_backend_proto_msgTypes,
 	}.Build()
 	File_sdk_plugin_pb_backend_proto = out.File
-	file_sdk_plugin_pb_backend_proto_rawDesc = nil
 	file_sdk_plugin_pb_backend_proto_goTypes = nil
 	file_sdk_plugin_pb_backend_proto_depIDxs = nil
 }
diff --git a/sdk/plugin/pb/backend.proto b/sdk/plugin/pb/backend.proto
index cf0f47d8dbe..2185ae518df 100644
--- a/sdk/plugin/pb/backend.proto
+++ b/sdk/plugin/pb/backend.proto
@@ -1,9 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 syntax = "proto3";
 package pb;
 
+import "google/protobuf/struct.proto";
 import "google/protobuf/timestamp.proto";
 import "sdk/logical/event.proto";
 import "sdk/logical/identity.proto";
@@ -68,6 +69,11 @@ message Paths {
   //
   // See note in /sdk/logical/logical.go.
   repeated string limited = 7;
+
+  // AllowSnapshotRead paths are allowed to be read from a loaded snapshot
+  //
+  // See note in /sdk/logical/logical.go
+  repeated string allow_snapshot_read = 8;
 }
 
 message Request {
@@ -156,6 +162,16 @@ message Request {
   // inspect the connection information and potentially use it for
   // authentication/protection.
   Connection connection = 20;
+
+  // RequiresSnapshotID will be present when the request is a list, read, or
+  // recover from snapshot operation
+  string requires_snapshot_id = 21;
+
+  // RecoverSourcePath is the path where a recover request should read the data
+  // from. This can be empty if the request is not a recover request, or if the
+  // request is a recover request where the source path is the same as the
+  // destination path
+  string recover_source_path = 22;
 }
 
 message Auth {
@@ -607,6 +623,43 @@ message GenerateIdentityTokenResponse {
   int64 ttl = 2;
 }
 
+message RotationInfoRequest {
+  string mount_path = 1;
+}
+
+message RotationInfoReply {
+  int64 issue_time = 1;
+  int64 expire_time = 2;
+  int64 ttl = 3;
+}
+
+message RegisterRotationJobRequest {
+  RotationJobInput job = 1;
+}
+
+message RegisterRotationJobResponse {
+  string rotation_id = 1;
+  string err = 2;
+}
+
+message RotationJobInput {
+  string name = 1;
+  string mount_point = 2;
+  string path = 3;
+  string rotation_schedule = 4;
+  int64 rotation_window = 5;
+  int64 rotation_period = 6;
+}
+
+message DeregisterRotationRequestInput {
+  string mount_point = 1;
+  string req_path = 2;
+}
+
+message DeregisterRotationJobRequest {
+  DeregisterRotationRequestInput req = 1;
+}
+
 // SystemView exposes system configuration information in a safe way for plugins
 // to consume. Plugins should implement the client for this service.
 service SystemView {
@@ -665,6 +718,15 @@ service SystemView {
 
   // GenerateIdentityToken returns an identity token for the requesting plugin.
   rpc GenerateIdentityToken(GenerateIdentityTokenRequest) returns (GenerateIdentityTokenResponse);
+
+  // GetRotationInformation returns the time remaining in a rotation job for the requested credential.
+  rpc GetRotationInformation(RotationInfoRequest) returns (RotationInfoReply);
+
+  // RegisterRotationJob returns a rotation ID for the requested plugin credential.
+  rpc RegisterRotationJob(RegisterRotationJobRequest) returns (RegisterRotationJobResponse);
+
+  // DeregisterRotationJob returns any errors in de-registering a credential from the Rotation Manager.
+  rpc DeregisterRotationJob(DeregisterRotationJobRequest) returns (Empty);
 }
 
 message Connection {
@@ -712,3 +774,12 @@ message SendEventRequest {
 service Events {
   rpc SendEvent(SendEventRequest) returns (Empty);
 }
+
+message RecordObservationRequest {
+  string observation_type = 1;
+  google.protobuf.Struct data = 2;
+}
+
+service Observations {
+  rpc RecordObservation(RecordObservationRequest) returns (Empty);
+}
diff --git a/sdk/plugin/pb/backend_grpc.pb.go b/sdk/plugin/pb/backend_grpc.pb.go
index b0e96cd4a74..a481e71b1b5 100644
--- a/sdk/plugin/pb/backend_grpc.pb.go
+++ b/sdk/plugin/pb/backend_grpc.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: sdk/plugin/pb/backend.proto
 
@@ -18,8 +18,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	Backend_HandleRequest_FullMethodName        = "/pb.Backend/HandleRequest"
@@ -35,6 +35,10 @@ const (
 // BackendClient is the client API for Backend service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// Backend is the interface that plugins must satisfy. The plugin should
+// implement the server for this service. Requests will first run the
+// HandleExistenceCheck rpc then run the HandleRequests rpc.
 type BackendClient interface {
 	// HandleRequest is used to handle a request and generate a response.
 	// The plugins must check the operation type and handle appropriately.
@@ -82,8 +86,9 @@ func NewBackendClient(cc grpc.ClientConnInterface) BackendClient {
 }
 
 func (c *backendClient) HandleRequest(ctx context.Context, in *HandleRequestArgs, opts ...grpc.CallOption) (*HandleRequestReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(HandleRequestReply)
-	err := c.cc.Invoke(ctx, Backend_HandleRequest_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_HandleRequest_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -91,8 +96,9 @@ func (c *backendClient) HandleRequest(ctx context.Context, in *HandleRequestArgs
 }
 
 func (c *backendClient) SpecialPaths(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*SpecialPathsReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SpecialPathsReply)
-	err := c.cc.Invoke(ctx, Backend_SpecialPaths_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_SpecialPaths_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -100,8 +106,9 @@ func (c *backendClient) SpecialPaths(ctx context.Context, in *Empty, opts ...grp
 }
 
 func (c *backendClient) HandleExistenceCheck(ctx context.Context, in *HandleExistenceCheckArgs, opts ...grpc.CallOption) (*HandleExistenceCheckReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(HandleExistenceCheckReply)
-	err := c.cc.Invoke(ctx, Backend_HandleExistenceCheck_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_HandleExistenceCheck_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -109,8 +116,9 @@ func (c *backendClient) HandleExistenceCheck(ctx context.Context, in *HandleExis
 }
 
 func (c *backendClient) Cleanup(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, Backend_Cleanup_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_Cleanup_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -118,8 +126,9 @@ func (c *backendClient) Cleanup(ctx context.Context, in *Empty, opts ...grpc.Cal
 }
 
 func (c *backendClient) InvalidateKey(ctx context.Context, in *InvalidateKeyArgs, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, Backend_InvalidateKey_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_InvalidateKey_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -127,8 +136,9 @@ func (c *backendClient) InvalidateKey(ctx context.Context, in *InvalidateKeyArgs
 }
 
 func (c *backendClient) Setup(ctx context.Context, in *SetupArgs, opts ...grpc.CallOption) (*SetupReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SetupReply)
-	err := c.cc.Invoke(ctx, Backend_Setup_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_Setup_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -136,8 +146,9 @@ func (c *backendClient) Setup(ctx context.Context, in *SetupArgs, opts ...grpc.C
 }
 
 func (c *backendClient) Initialize(ctx context.Context, in *InitializeArgs, opts ...grpc.CallOption) (*InitializeReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(InitializeReply)
-	err := c.cc.Invoke(ctx, Backend_Initialize_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_Initialize_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -145,8 +156,9 @@ func (c *backendClient) Initialize(ctx context.Context, in *InitializeArgs, opts
 }
 
 func (c *backendClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TypeReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TypeReply)
-	err := c.cc.Invoke(ctx, Backend_Type_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_Type_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -155,7 +167,11 @@ func (c *backendClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallOp
 
 // BackendServer is the server API for Backend service.
 // All implementations must embed UnimplementedBackendServer
-// for forward compatibility
+// for forward compatibility.
+//
+// Backend is the interface that plugins must satisfy. The plugin should
+// implement the server for this service. Requests will first run the
+// HandleExistenceCheck rpc then run the HandleRequests rpc.
 type BackendServer interface {
 	// HandleRequest is used to handle a request and generate a response.
 	// The plugins must check the operation type and handle appropriately.
@@ -195,9 +211,12 @@ type BackendServer interface {
 	mustEmbedUnimplementedBackendServer()
 }
 
-// UnimplementedBackendServer must be embedded to have forward compatible implementations.
-type UnimplementedBackendServer struct {
-}
+// UnimplementedBackendServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedBackendServer struct{}
 
 func (UnimplementedBackendServer) HandleRequest(context.Context, *HandleRequestArgs) (*HandleRequestReply, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method HandleRequest not implemented")
@@ -224,6 +243,7 @@ func (UnimplementedBackendServer) Type(context.Context, *Empty) (*TypeReply, err
 	return nil, status.Errorf(codes.Unimplemented, "method Type not implemented")
 }
 func (UnimplementedBackendServer) mustEmbedUnimplementedBackendServer() {}
+func (UnimplementedBackendServer) testEmbeddedByValue()                 {}
 
 // UnsafeBackendServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to BackendServer will
@@ -233,6 +253,13 @@ type UnsafeBackendServer interface {
 }
 
 func RegisterBackendServer(s grpc.ServiceRegistrar, srv BackendServer) {
+	// If the following call pancis, it indicates UnimplementedBackendServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&Backend_ServiceDesc, srv)
 }
 
@@ -434,6 +461,9 @@ const (
 // StorageClient is the client API for Storage service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// Storage is the way that plugins are able read/write data. Plugins should
+// implement the client for this service.
 type StorageClient interface {
 	List(ctx context.Context, in *StorageListArgs, opts ...grpc.CallOption) (*StorageListReply, error)
 	Get(ctx context.Context, in *StorageGetArgs, opts ...grpc.CallOption) (*StorageGetReply, error)
@@ -450,8 +480,9 @@ func NewStorageClient(cc grpc.ClientConnInterface) StorageClient {
 }
 
 func (c *storageClient) List(ctx context.Context, in *StorageListArgs, opts ...grpc.CallOption) (*StorageListReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(StorageListReply)
-	err := c.cc.Invoke(ctx, Storage_List_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Storage_List_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -459,8 +490,9 @@ func (c *storageClient) List(ctx context.Context, in *StorageListArgs, opts ...g
 }
 
 func (c *storageClient) Get(ctx context.Context, in *StorageGetArgs, opts ...grpc.CallOption) (*StorageGetReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(StorageGetReply)
-	err := c.cc.Invoke(ctx, Storage_Get_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Storage_Get_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -468,8 +500,9 @@ func (c *storageClient) Get(ctx context.Context, in *StorageGetArgs, opts ...grp
 }
 
 func (c *storageClient) Put(ctx context.Context, in *StoragePutArgs, opts ...grpc.CallOption) (*StoragePutReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(StoragePutReply)
-	err := c.cc.Invoke(ctx, Storage_Put_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Storage_Put_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -477,8 +510,9 @@ func (c *storageClient) Put(ctx context.Context, in *StoragePutArgs, opts ...grp
 }
 
 func (c *storageClient) Delete(ctx context.Context, in *StorageDeleteArgs, opts ...grpc.CallOption) (*StorageDeleteReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(StorageDeleteReply)
-	err := c.cc.Invoke(ctx, Storage_Delete_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Storage_Delete_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -487,7 +521,10 @@ func (c *storageClient) Delete(ctx context.Context, in *StorageDeleteArgs, opts
 
 // StorageServer is the server API for Storage service.
 // All implementations must embed UnimplementedStorageServer
-// for forward compatibility
+// for forward compatibility.
+//
+// Storage is the way that plugins are able read/write data. Plugins should
+// implement the client for this service.
 type StorageServer interface {
 	List(context.Context, *StorageListArgs) (*StorageListReply, error)
 	Get(context.Context, *StorageGetArgs) (*StorageGetReply, error)
@@ -496,9 +533,12 @@ type StorageServer interface {
 	mustEmbedUnimplementedStorageServer()
 }
 
-// UnimplementedStorageServer must be embedded to have forward compatible implementations.
-type UnimplementedStorageServer struct {
-}
+// UnimplementedStorageServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedStorageServer struct{}
 
 func (UnimplementedStorageServer) List(context.Context, *StorageListArgs) (*StorageListReply, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method List not implemented")
@@ -513,6 +553,7 @@ func (UnimplementedStorageServer) Delete(context.Context, *StorageDeleteArgs) (*
 	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
 }
 func (UnimplementedStorageServer) mustEmbedUnimplementedStorageServer() {}
+func (UnimplementedStorageServer) testEmbeddedByValue()                 {}
 
 // UnsafeStorageServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to StorageServer will
@@ -522,6 +563,13 @@ type UnsafeStorageServer interface {
 }
 
 func RegisterStorageServer(s grpc.ServiceRegistrar, srv StorageServer) {
+	// If the following call pancis, it indicates UnimplementedStorageServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&Storage_ServiceDesc, srv)
 }
 
@@ -640,11 +688,17 @@ const (
 	SystemView_GeneratePasswordFromPolicy_FullMethodName = "/pb.SystemView/GeneratePasswordFromPolicy"
 	SystemView_ClusterInfo_FullMethodName                = "/pb.SystemView/ClusterInfo"
 	SystemView_GenerateIdentityToken_FullMethodName      = "/pb.SystemView/GenerateIdentityToken"
+	SystemView_GetRotationInformation_FullMethodName     = "/pb.SystemView/GetRotationInformation"
+	SystemView_RegisterRotationJob_FullMethodName        = "/pb.SystemView/RegisterRotationJob"
+	SystemView_DeregisterRotationJob_FullMethodName      = "/pb.SystemView/DeregisterRotationJob"
 )
 
 // SystemViewClient is the client API for SystemView service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// SystemView exposes system configuration information in a safe way for plugins
+// to consume. Plugins should implement the client for this service.
 type SystemViewClient interface {
 	// DefaultLeaseTTL returns the default lease TTL set in Vault configuration
 	DefaultLeaseTTL(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TTLReply, error)
@@ -688,6 +742,12 @@ type SystemViewClient interface {
 	ClusterInfo(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ClusterInfoReply, error)
 	// GenerateIdentityToken returns an identity token for the requesting plugin.
 	GenerateIdentityToken(ctx context.Context, in *GenerateIdentityTokenRequest, opts ...grpc.CallOption) (*GenerateIdentityTokenResponse, error)
+	// GetRotationInformation returns the time remaining in a rotation job for the requested credential.
+	GetRotationInformation(ctx context.Context, in *RotationInfoRequest, opts ...grpc.CallOption) (*RotationInfoReply, error)
+	// RegisterRotationJob returns a rotation ID for the requested plugin credential.
+	RegisterRotationJob(ctx context.Context, in *RegisterRotationJobRequest, opts ...grpc.CallOption) (*RegisterRotationJobResponse, error)
+	// DeregisterRotationJob returns any errors in de-registering a credential from the Rotation Manager.
+	DeregisterRotationJob(ctx context.Context, in *DeregisterRotationJobRequest, opts ...grpc.CallOption) (*Empty, error)
 }
 
 type systemViewClient struct {
@@ -699,8 +759,9 @@ func NewSystemViewClient(cc grpc.ClientConnInterface) SystemViewClient {
 }
 
 func (c *systemViewClient) DefaultLeaseTTL(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TTLReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TTLReply)
-	err := c.cc.Invoke(ctx, SystemView_DefaultLeaseTTL_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_DefaultLeaseTTL_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -708,8 +769,9 @@ func (c *systemViewClient) DefaultLeaseTTL(ctx context.Context, in *Empty, opts
 }
 
 func (c *systemViewClient) MaxLeaseTTL(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TTLReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TTLReply)
-	err := c.cc.Invoke(ctx, SystemView_MaxLeaseTTL_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_MaxLeaseTTL_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -717,8 +779,9 @@ func (c *systemViewClient) MaxLeaseTTL(ctx context.Context, in *Empty, opts ...g
 }
 
 func (c *systemViewClient) Tainted(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TaintedReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TaintedReply)
-	err := c.cc.Invoke(ctx, SystemView_Tainted_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_Tainted_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -726,8 +789,9 @@ func (c *systemViewClient) Tainted(ctx context.Context, in *Empty, opts ...grpc.
 }
 
 func (c *systemViewClient) CachingDisabled(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*CachingDisabledReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CachingDisabledReply)
-	err := c.cc.Invoke(ctx, SystemView_CachingDisabled_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_CachingDisabled_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -735,8 +799,9 @@ func (c *systemViewClient) CachingDisabled(ctx context.Context, in *Empty, opts
 }
 
 func (c *systemViewClient) ReplicationState(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ReplicationStateReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ReplicationStateReply)
-	err := c.cc.Invoke(ctx, SystemView_ReplicationState_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_ReplicationState_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -744,8 +809,9 @@ func (c *systemViewClient) ReplicationState(ctx context.Context, in *Empty, opts
 }
 
 func (c *systemViewClient) ResponseWrapData(ctx context.Context, in *ResponseWrapDataArgs, opts ...grpc.CallOption) (*ResponseWrapDataReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ResponseWrapDataReply)
-	err := c.cc.Invoke(ctx, SystemView_ResponseWrapData_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_ResponseWrapData_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -753,8 +819,9 @@ func (c *systemViewClient) ResponseWrapData(ctx context.Context, in *ResponseWra
 }
 
 func (c *systemViewClient) MlockEnabled(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*MlockEnabledReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(MlockEnabledReply)
-	err := c.cc.Invoke(ctx, SystemView_MlockEnabled_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_MlockEnabled_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -762,8 +829,9 @@ func (c *systemViewClient) MlockEnabled(ctx context.Context, in *Empty, opts ...
 }
 
 func (c *systemViewClient) LocalMount(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*LocalMountReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(LocalMountReply)
-	err := c.cc.Invoke(ctx, SystemView_LocalMount_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_LocalMount_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -771,8 +839,9 @@ func (c *systemViewClient) LocalMount(ctx context.Context, in *Empty, opts ...gr
 }
 
 func (c *systemViewClient) EntityInfo(ctx context.Context, in *EntityInfoArgs, opts ...grpc.CallOption) (*EntityInfoReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EntityInfoReply)
-	err := c.cc.Invoke(ctx, SystemView_EntityInfo_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_EntityInfo_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -780,8 +849,9 @@ func (c *systemViewClient) EntityInfo(ctx context.Context, in *EntityInfoArgs, o
 }
 
 func (c *systemViewClient) PluginEnv(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*PluginEnvReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PluginEnvReply)
-	err := c.cc.Invoke(ctx, SystemView_PluginEnv_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_PluginEnv_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -789,8 +859,9 @@ func (c *systemViewClient) PluginEnv(ctx context.Context, in *Empty, opts ...grp
 }
 
 func (c *systemViewClient) GroupsForEntity(ctx context.Context, in *EntityInfoArgs, opts ...grpc.CallOption) (*GroupsForEntityReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GroupsForEntityReply)
-	err := c.cc.Invoke(ctx, SystemView_GroupsForEntity_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_GroupsForEntity_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -798,8 +869,9 @@ func (c *systemViewClient) GroupsForEntity(ctx context.Context, in *EntityInfoAr
 }
 
 func (c *systemViewClient) GeneratePasswordFromPolicy(ctx context.Context, in *GeneratePasswordFromPolicyRequest, opts ...grpc.CallOption) (*GeneratePasswordFromPolicyReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GeneratePasswordFromPolicyReply)
-	err := c.cc.Invoke(ctx, SystemView_GeneratePasswordFromPolicy_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_GeneratePasswordFromPolicy_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -807,8 +879,9 @@ func (c *systemViewClient) GeneratePasswordFromPolicy(ctx context.Context, in *G
 }
 
 func (c *systemViewClient) ClusterInfo(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ClusterInfoReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ClusterInfoReply)
-	err := c.cc.Invoke(ctx, SystemView_ClusterInfo_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_ClusterInfo_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -816,8 +889,39 @@ func (c *systemViewClient) ClusterInfo(ctx context.Context, in *Empty, opts ...g
 }
 
 func (c *systemViewClient) GenerateIdentityToken(ctx context.Context, in *GenerateIdentityTokenRequest, opts ...grpc.CallOption) (*GenerateIdentityTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GenerateIdentityTokenResponse)
-	err := c.cc.Invoke(ctx, SystemView_GenerateIdentityToken_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_GenerateIdentityToken_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *systemViewClient) GetRotationInformation(ctx context.Context, in *RotationInfoRequest, opts ...grpc.CallOption) (*RotationInfoReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RotationInfoReply)
+	err := c.cc.Invoke(ctx, SystemView_GetRotationInformation_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *systemViewClient) RegisterRotationJob(ctx context.Context, in *RegisterRotationJobRequest, opts ...grpc.CallOption) (*RegisterRotationJobResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RegisterRotationJobResponse)
+	err := c.cc.Invoke(ctx, SystemView_RegisterRotationJob_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *systemViewClient) DeregisterRotationJob(ctx context.Context, in *DeregisterRotationJobRequest, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Empty)
+	err := c.cc.Invoke(ctx, SystemView_DeregisterRotationJob_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -826,7 +930,10 @@ func (c *systemViewClient) GenerateIdentityToken(ctx context.Context, in *Genera
 
 // SystemViewServer is the server API for SystemView service.
 // All implementations must embed UnimplementedSystemViewServer
-// for forward compatibility
+// for forward compatibility.
+//
+// SystemView exposes system configuration information in a safe way for plugins
+// to consume. Plugins should implement the client for this service.
 type SystemViewServer interface {
 	// DefaultLeaseTTL returns the default lease TTL set in Vault configuration
 	DefaultLeaseTTL(context.Context, *Empty) (*TTLReply, error)
@@ -870,12 +977,21 @@ type SystemViewServer interface {
 	ClusterInfo(context.Context, *Empty) (*ClusterInfoReply, error)
 	// GenerateIdentityToken returns an identity token for the requesting plugin.
 	GenerateIdentityToken(context.Context, *GenerateIdentityTokenRequest) (*GenerateIdentityTokenResponse, error)
+	// GetRotationInformation returns the time remaining in a rotation job for the requested credential.
+	GetRotationInformation(context.Context, *RotationInfoRequest) (*RotationInfoReply, error)
+	// RegisterRotationJob returns a rotation ID for the requested plugin credential.
+	RegisterRotationJob(context.Context, *RegisterRotationJobRequest) (*RegisterRotationJobResponse, error)
+	// DeregisterRotationJob returns any errors in de-registering a credential from the Rotation Manager.
+	DeregisterRotationJob(context.Context, *DeregisterRotationJobRequest) (*Empty, error)
 	mustEmbedUnimplementedSystemViewServer()
 }
 
-// UnimplementedSystemViewServer must be embedded to have forward compatible implementations.
-type UnimplementedSystemViewServer struct {
-}
+// UnimplementedSystemViewServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedSystemViewServer struct{}
 
 func (UnimplementedSystemViewServer) DefaultLeaseTTL(context.Context, *Empty) (*TTLReply, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DefaultLeaseTTL not implemented")
@@ -919,7 +1035,17 @@ func (UnimplementedSystemViewServer) ClusterInfo(context.Context, *Empty) (*Clus
 func (UnimplementedSystemViewServer) GenerateIdentityToken(context.Context, *GenerateIdentityTokenRequest) (*GenerateIdentityTokenResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GenerateIdentityToken not implemented")
 }
+func (UnimplementedSystemViewServer) GetRotationInformation(context.Context, *RotationInfoRequest) (*RotationInfoReply, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetRotationInformation not implemented")
+}
+func (UnimplementedSystemViewServer) RegisterRotationJob(context.Context, *RegisterRotationJobRequest) (*RegisterRotationJobResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RegisterRotationJob not implemented")
+}
+func (UnimplementedSystemViewServer) DeregisterRotationJob(context.Context, *DeregisterRotationJobRequest) (*Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeregisterRotationJob not implemented")
+}
 func (UnimplementedSystemViewServer) mustEmbedUnimplementedSystemViewServer() {}
+func (UnimplementedSystemViewServer) testEmbeddedByValue()                    {}
 
 // UnsafeSystemViewServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to SystemViewServer will
@@ -929,6 +1055,13 @@ type UnsafeSystemViewServer interface {
 }
 
 func RegisterSystemViewServer(s grpc.ServiceRegistrar, srv SystemViewServer) {
+	// If the following call pancis, it indicates UnimplementedSystemViewServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&SystemView_ServiceDesc, srv)
 }
 
@@ -1184,6 +1317,60 @@ func _SystemView_GenerateIdentityToken_Handler(srv interface{}, ctx context.Cont
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SystemView_GetRotationInformation_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RotationInfoRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SystemViewServer).GetRotationInformation(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SystemView_GetRotationInformation_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SystemViewServer).GetRotationInformation(ctx, req.(*RotationInfoRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SystemView_RegisterRotationJob_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RegisterRotationJobRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SystemViewServer).RegisterRotationJob(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SystemView_RegisterRotationJob_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SystemViewServer).RegisterRotationJob(ctx, req.(*RegisterRotationJobRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SystemView_DeregisterRotationJob_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeregisterRotationJobRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SystemViewServer).DeregisterRotationJob(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SystemView_DeregisterRotationJob_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SystemViewServer).DeregisterRotationJob(ctx, req.(*DeregisterRotationJobRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // SystemView_ServiceDesc is the grpc.ServiceDesc for SystemView service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -1247,6 +1434,18 @@ var SystemView_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GenerateIdentityToken",
 			Handler:    _SystemView_GenerateIdentityToken_Handler,
 		},
+		{
+			MethodName: "GetRotationInformation",
+			Handler:    _SystemView_GetRotationInformation_Handler,
+		},
+		{
+			MethodName: "RegisterRotationJob",
+			Handler:    _SystemView_RegisterRotationJob_Handler,
+		},
+		{
+			MethodName: "DeregisterRotationJob",
+			Handler:    _SystemView_DeregisterRotationJob_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "sdk/plugin/pb/backend.proto",
@@ -1272,8 +1471,9 @@ func NewEventsClient(cc grpc.ClientConnInterface) EventsClient {
 }
 
 func (c *eventsClient) SendEvent(ctx context.Context, in *SendEventRequest, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, Events_SendEvent_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Events_SendEvent_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1282,20 +1482,24 @@ func (c *eventsClient) SendEvent(ctx context.Context, in *SendEventRequest, opts
 
 // EventsServer is the server API for Events service.
 // All implementations must embed UnimplementedEventsServer
-// for forward compatibility
+// for forward compatibility.
 type EventsServer interface {
 	SendEvent(context.Context, *SendEventRequest) (*Empty, error)
 	mustEmbedUnimplementedEventsServer()
 }
 
-// UnimplementedEventsServer must be embedded to have forward compatible implementations.
-type UnimplementedEventsServer struct {
-}
+// UnimplementedEventsServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedEventsServer struct{}
 
 func (UnimplementedEventsServer) SendEvent(context.Context, *SendEventRequest) (*Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method SendEvent not implemented")
 }
 func (UnimplementedEventsServer) mustEmbedUnimplementedEventsServer() {}
+func (UnimplementedEventsServer) testEmbeddedByValue()                {}
 
 // UnsafeEventsServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to EventsServer will
@@ -1305,6 +1509,13 @@ type UnsafeEventsServer interface {
 }
 
 func RegisterEventsServer(s grpc.ServiceRegistrar, srv EventsServer) {
+	// If the following call pancis, it indicates UnimplementedEventsServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&Events_ServiceDesc, srv)
 }
 
@@ -1341,3 +1552,105 @@ var Events_ServiceDesc = grpc.ServiceDesc{
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "sdk/plugin/pb/backend.proto",
 }
+
+const (
+	Observations_RecordObservation_FullMethodName = "/pb.Observations/RecordObservation"
+)
+
+// ObservationsClient is the client API for Observations service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ObservationsClient interface {
+	RecordObservation(ctx context.Context, in *RecordObservationRequest, opts ...grpc.CallOption) (*Empty, error)
+}
+
+type observationsClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewObservationsClient(cc grpc.ClientConnInterface) ObservationsClient {
+	return &observationsClient{cc}
+}
+
+func (c *observationsClient) RecordObservation(ctx context.Context, in *RecordObservationRequest, opts ...grpc.CallOption) (*Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(Empty)
+	err := c.cc.Invoke(ctx, Observations_RecordObservation_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ObservationsServer is the server API for Observations service.
+// All implementations must embed UnimplementedObservationsServer
+// for forward compatibility.
+type ObservationsServer interface {
+	RecordObservation(context.Context, *RecordObservationRequest) (*Empty, error)
+	mustEmbedUnimplementedObservationsServer()
+}
+
+// UnimplementedObservationsServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedObservationsServer struct{}
+
+func (UnimplementedObservationsServer) RecordObservation(context.Context, *RecordObservationRequest) (*Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RecordObservation not implemented")
+}
+func (UnimplementedObservationsServer) mustEmbedUnimplementedObservationsServer() {}
+func (UnimplementedObservationsServer) testEmbeddedByValue()                      {}
+
+// UnsafeObservationsServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ObservationsServer will
+// result in compilation errors.
+type UnsafeObservationsServer interface {
+	mustEmbedUnimplementedObservationsServer()
+}
+
+func RegisterObservationsServer(s grpc.ServiceRegistrar, srv ObservationsServer) {
+	// If the following call pancis, it indicates UnimplementedObservationsServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&Observations_ServiceDesc, srv)
+}
+
+func _Observations_RecordObservation_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RecordObservationRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ObservationsServer).RecordObservation(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Observations_RecordObservation_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ObservationsServer).RecordObservation(ctx, req.(*RecordObservationRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Observations_ServiceDesc is the grpc.ServiceDesc for Observations service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Observations_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "pb.Observations",
+	HandlerType: (*ObservationsServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "RecordObservation",
+			Handler:    _Observations_RecordObservation_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "sdk/plugin/pb/backend.proto",
+}
diff --git a/sdk/plugin/pb/translation.go b/sdk/plugin/pb/translation.go
index 5a349b5b667..80129f98812 100644
--- a/sdk/plugin/pb/translation.go
+++ b/sdk/plugin/pb/translation.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pb
@@ -257,6 +257,8 @@ func LogicalRequestToProtoRequest(r *logical.Request) (*Request, error) {
 		EntityID:                 r.EntityID,
 		PolicyOverride:           r.PolicyOverride,
 		Unauthenticated:          r.Unauthenticated,
+		RequiresSnapshotID:       r.RequiresSnapshotID,
+		RecoverSourcePath:        r.RecoverSourcePath,
 	}, nil
 }
 
@@ -315,6 +317,8 @@ func ProtoRequestToLogicalRequest(r *Request) (*logical.Request, error) {
 		EntityID:                 r.EntityID,
 		PolicyOverride:           r.PolicyOverride,
 		Unauthenticated:          r.Unauthenticated,
+		RequiresSnapshotID:       r.RequiresSnapshotID,
+		RecoverSourcePath:        r.RecoverSourcePath,
 	}, nil
 }
 
diff --git a/sdk/plugin/pb/translation_test.go b/sdk/plugin/pb/translation_test.go
index 4386ae59b21..3e93f0a5db9 100644
--- a/sdk/plugin/pb/translation_test.go
+++ b/sdk/plugin/pb/translation_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package pb
@@ -91,6 +91,8 @@ func TestTranslation_Request(t *testing.T) {
 					PeerCertificates:  certs,
 				},
 			},
+			RequiresSnapshotID: "abcd",
+			RecoverSourcePath:  "path",
 		},
 		{
 			ID:                 "ID",
@@ -170,6 +172,8 @@ func TestTranslation_Request(t *testing.T) {
 			EntityID:                 "tester",
 			PolicyOverride:           true,
 			Unauthenticated:          true,
+			RequiresSnapshotID:       "abcd",
+			RecoverSourcePath:        "path",
 		},
 	}
 
diff --git a/sdk/plugin/plugin.go b/sdk/plugin/plugin.go
index ec58417ec7d..9cea5e68bb4 100644
--- a/sdk/plugin/plugin.go
+++ b/sdk/plugin/plugin.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/plugin/plugin_v5.go b/sdk/plugin/plugin_v5.go
index cc2d1383775..9655950e8b5 100644
--- a/sdk/plugin/plugin_v5.go
+++ b/sdk/plugin/plugin_v5.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/plugin/serve.go b/sdk/plugin/serve.go
index 2fe4af2686a..4c4555b2c1b 100644
--- a/sdk/plugin/serve.go
+++ b/sdk/plugin/serve.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/plugin/storage_test.go b/sdk/plugin/storage_test.go
index f36a6221abe..198d6ded9e5 100644
--- a/sdk/plugin/storage_test.go
+++ b/sdk/plugin/storage_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package plugin
diff --git a/sdk/queue/priority_queue.go b/sdk/queue/priority_queue.go
index 802a538587b..01306a37806 100644
--- a/sdk/queue/priority_queue.go
+++ b/sdk/queue/priority_queue.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 // Package queue  provides Vault plugins with a Priority Queue. It can be used
diff --git a/sdk/queue/priority_queue_test.go b/sdk/queue/priority_queue_test.go
index 108a26cc0ed..b593492b6a7 100644
--- a/sdk/queue/priority_queue_test.go
+++ b/sdk/queue/priority_queue_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package queue
diff --git a/sdk/rotation/rotation_job.go b/sdk/rotation/rotation_job.go
new file mode 100644
index 00000000000..3ae8cbbe30e
--- /dev/null
+++ b/sdk/rotation/rotation_job.go
@@ -0,0 +1,133 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package rotation
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/robfig/cron/v3"
+)
+
+const (
+	PerformedRegistration   = "registration"
+	PerformedDeregistration = "deregistration"
+)
+
+// RotationOptions is an embeddable struct to capture common rotation
+// settings between a Secret and Auth
+type RotationOptions struct {
+	// Schedule holds the info for the framework.Schedule
+	Schedule *RotationSchedule
+}
+
+// RotationJob represents the secret part of a response.
+type RotationJob struct {
+	RotationOptions
+
+	// RotationID is the ID returned to the user to manage this secret.
+	// This is generated by Vault core. Any set value will be ignored.
+	// For requests, this will always be blank.
+	RotationID string `sentinel:""`
+	Path       string
+	MountPoint string
+	Name       string
+}
+
+type RotationJobConfigureRequest struct {
+	Name             string
+	MountPoint       string
+	ReqPath          string
+	RotationSchedule string
+	RotationWindow   time.Duration
+	RotationPeriod   time.Duration
+}
+
+type RotationJobDeregisterRequest struct {
+	MountPoint string
+	ReqPath    string
+}
+
+// RotationInfoRequest is the request struct used by SystemView.GetRotationInformation.
+type RotationInfoRequest struct {
+	// ReqPath is the plugin-local path to the credential, and needs to match the ReqPath value that
+	// was supplied in schedule creation with RegisterRotationJob
+	ReqPath string
+}
+
+// RotationInfoResponse is the response struct returned by SystemView.GetRotationInformation.
+type RotationInfoResponse struct {
+	// NextVaultRotation is the scheduled time of the next rotation.
+	NextVaultRotation time.Time
+
+	// LastVaultRotation is the time of the prior rotation.
+	LastVaultRotation time.Time
+
+	// TTL is integer seconds until next rotation, conventionally clamped to 0 (i.e., will not be negative)
+	TTL int64
+}
+
+func (s *RotationJob) Validate() error {
+	if s.MountPoint == "" {
+		return fmt.Errorf("MountPoint is required")
+	}
+
+	if s.Path == "" {
+		return fmt.Errorf("ReqPath is required")
+	}
+
+	if s.Schedule.RotationSchedule == "" && s.Schedule.RotationPeriod.Seconds() == 0 {
+		return fmt.Errorf("RotationSchedule or RotationPeriod is required to set up rotation job")
+	}
+
+	return nil
+}
+
+func newRotationJob(configRequest *RotationJobConfigureRequest) (*RotationJob, error) {
+	var cronSc *cron.SpecSchedule
+	if configRequest.RotationSchedule != "" {
+		var err error
+		cronSc, err = DefaultScheduler.Parse(configRequest.RotationSchedule)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	rs := &RotationSchedule{
+		Schedule:          cronSc,
+		RotationSchedule:  configRequest.RotationSchedule,
+		RotationWindow:    configRequest.RotationWindow,
+		RotationPeriod:    configRequest.RotationPeriod,
+		NextVaultRotation: time.Time{},
+		LastVaultRotation: time.Time{},
+	}
+
+	return &RotationJob{
+		RotationOptions: RotationOptions{
+			Schedule: rs,
+		},
+		MountPoint: configRequest.MountPoint,
+		Path:       configRequest.ReqPath,
+		Name:       configRequest.Name,
+	}, nil
+}
+
+// ConfigureRotationJob builds and returns a configured RotationJob for the mount and request with the given schedule.
+func ConfigureRotationJob(configRequest *RotationJobConfigureRequest) (*RotationJob, error) {
+	rotationJob, err := newRotationJob(configRequest)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := rotationJob.Validate(); err != nil {
+		return nil, fmt.Errorf("error validating rotation job: %s", err)
+	}
+
+	// Expect rotation job to exist here
+	if rotationJob == nil {
+		return nil, fmt.Errorf("rotation credential was nil; expected non-nil value")
+	}
+
+	return rotationJob, nil
+}
diff --git a/sdk/rotation/rotation_job_test.go b/sdk/rotation/rotation_job_test.go
new file mode 100644
index 00000000000..6b4f79f0458
--- /dev/null
+++ b/sdk/rotation/rotation_job_test.go
@@ -0,0 +1,71 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package rotation
+
+import (
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestConfigureRotationJob(t *testing.T) {
+	tests := []struct {
+		name          string
+		req           *RotationJobConfigureRequest
+		expected      RotationJob
+		expectedError string
+	}{
+		{
+			name: "no rotation params",
+			req: &RotationJobConfigureRequest{
+				MountPoint:       "aws",
+				ReqPath:          "config/root",
+				RotationSchedule: "",
+				RotationWindow:   60,
+				RotationPeriod:   0,
+			},
+			expectedError: "RotationSchedule or RotationPeriod is required to set up rotation job",
+		},
+		{
+			name: "no mount point",
+			req: &RotationJobConfigureRequest{
+				MountPoint:       "",
+				ReqPath:          "config/root",
+				RotationSchedule: "",
+				RotationWindow:   60,
+				RotationPeriod:   5,
+			},
+			expectedError: "MountPoint is required",
+		},
+		{
+			name: "no req path",
+			req: &RotationJobConfigureRequest{
+				MountPoint:       "aws",
+				ReqPath:          "",
+				RotationSchedule: "",
+				RotationWindow:   60,
+				RotationPeriod:   5,
+			},
+			expectedError: "ReqPath is required",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			out, err := ConfigureRotationJob(tt.req)
+			if err != nil {
+				if tt.expectedError == "" {
+					t.Errorf("expected no error but received an error: %s", err)
+				}
+				if !strings.Contains(err.Error(), tt.expectedError) {
+					t.Errorf("TestConfigureRotationJob() error = %v, expected %s", err, tt.expectedError)
+				}
+			}
+
+			if err == nil && !reflect.DeepEqual(tt.expected, out) {
+				t.Errorf("TestConfigureRotationJob() error comparing params; got %v, expected %v", out, tt.expected)
+			}
+		})
+	}
+}
diff --git a/sdk/rotation/schedule.go b/sdk/rotation/schedule.go
new file mode 100644
index 00000000000..bead52de8ea
--- /dev/null
+++ b/sdk/rotation/schedule.go
@@ -0,0 +1,116 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package rotation
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/robfig/cron/v3"
+)
+
+const (
+	// Minimum allowed value for rotation_window
+	minRotationWindowSeconds = 3600
+	parseOptions             = cron.Minute | cron.Hour | cron.Dom | cron.Month | cron.Dow
+)
+
+// RotationSchedule holds the parsed and unparsed versions of the schedule, along with the projected next rotation time.
+type RotationSchedule struct {
+	Schedule          *cron.SpecSchedule `json:"schedule"`
+	RotationWindow    time.Duration      `json:"rotation_window"` // seconds of window
+	RotationSchedule  string             `json:"rotation_schedule"`
+	RotationPeriod    time.Duration      `json:"rotation_period"`
+	NextVaultRotation time.Time          `json:"next_vault_rotation"`
+	LastVaultRotation time.Time          `json:"last_vault_rotation"`
+}
+
+type Scheduler interface {
+	Parse(rotationSchedule string) (*cron.SpecSchedule, error)
+	ValidateRotationWindow(s int) error
+	NextRotationTimeFromInput(rs *RotationSchedule, input time.Time) time.Time
+	IsInsideRotationWindow(rs *RotationSchedule, t time.Time) bool
+	ShouldRotate(rs *RotationSchedule, priority int64, t time.Time) bool
+	NextRotationTime(rs *RotationSchedule) time.Time
+	SetNextVaultRotation(rs *RotationSchedule, t time.Time)
+	UsesTTL(rs *RotationSchedule) bool
+	UsesRotationSchedule(rs *RotationSchedule) bool
+}
+
+var DefaultScheduler Scheduler = &DefaultSchedule{}
+
+type DefaultSchedule struct{}
+
+func (d *DefaultSchedule) Parse(rotationSchedule string) (*cron.SpecSchedule, error) {
+	parser := cron.NewParser(parseOptions)
+	schedule, err := parser.Parse(rotationSchedule)
+	if err != nil {
+		return nil, err
+	}
+	sched, ok := schedule.(*cron.SpecSchedule)
+	if !ok {
+		return nil, fmt.Errorf("invalid rotation schedule")
+	}
+
+	// override the timezone in all cases, even if was set otherwise
+	sched.Location = time.UTC
+
+	return sched, nil
+}
+
+func (d *DefaultSchedule) ValidateRotationWindow(s int) error {
+	if s < minRotationWindowSeconds {
+		return fmt.Errorf("rotation_window must be %d seconds or more", minRotationWindowSeconds)
+	}
+	return nil
+}
+
+func (d *DefaultSchedule) UsesRotationSchedule(rs *RotationSchedule) bool {
+	return rs.RotationSchedule != "" && rs.RotationPeriod == 0
+}
+
+func (d *DefaultSchedule) UsesTTL(rs *RotationSchedule) bool {
+	return rs.RotationPeriod != 0 && rs.RotationSchedule == ""
+}
+
+// NextRotationTime calculates the next scheduled rotation
+func (d *DefaultSchedule) NextRotationTime(rs *RotationSchedule) time.Time {
+	if d.UsesTTL(rs) {
+		return rs.LastVaultRotation.Add(rs.RotationPeriod)
+	}
+	return rs.Schedule.Next(time.Now())
+}
+
+// NextRotationTimeFromInput calculates and returns the next rotation time based on the provided  schedule and input time
+func (d *DefaultSchedule) NextRotationTimeFromInput(rs *RotationSchedule, input time.Time) time.Time {
+	if d.UsesTTL(rs) {
+		return input.Add(rs.RotationPeriod)
+	}
+	return rs.Schedule.Next(input)
+}
+
+// IsInsideRotationWindow checks if the current time is before the calculated end of the rotation window,
+// to make sure that t time is within the specified rotation window
+// It returns true if rotation window is not specified
+func (d *DefaultSchedule) IsInsideRotationWindow(rs *RotationSchedule, t time.Time) bool {
+	if rs.RotationWindow != 0 {
+		return t.Before(rs.NextVaultRotation.Add(rs.RotationWindow))
+	}
+	return true
+}
+
+// ShouldRotate checks if the rotation should occur based on  priority, current time, and rotation window
+// It returns true if the priority is less than or equal to the current time and the current time is within the rotation window
+func (d *DefaultSchedule) ShouldRotate(rs *RotationSchedule, priority int64, t time.Time) bool {
+	return priority <= t.Unix() && d.IsInsideRotationWindow(rs, t)
+}
+
+// SetNextVaultRotation calculates the next rotation time of a given schedule based on the time.
+func (d *DefaultSchedule) SetNextVaultRotation(rs *RotationSchedule, t time.Time) {
+	if d.UsesTTL(rs) {
+		rs.NextVaultRotation = t.Add(rs.RotationPeriod)
+	} else {
+		rs.NextVaultRotation = rs.Schedule.Next(t)
+	}
+}
diff --git a/sdk/rotation/schedule_test.go b/sdk/rotation/schedule_test.go
new file mode 100644
index 00000000000..56235ca0ba5
--- /dev/null
+++ b/sdk/rotation/schedule_test.go
@@ -0,0 +1,48 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package rotation
+
+import (
+	"testing"
+	"time"
+)
+
+func TestParseSchedule(t *testing.T) {
+	// Actual schedule-parsing tests are the responsibility of the library,
+	// (currently robfig/cron), but here are some cases for our specific functionality
+	cases := []struct {
+		name      string
+		in        string
+		shouldErr bool
+		location  *time.Location
+	}{
+		{"force local to utc", "* * * * *", false, time.UTC},
+		{"seconds are invalid", "* * * * * *", true, nil},
+
+		// Specifically override this usage
+		{"custom timezone", "CRON_TZ=Asia/Tokyo * * * * *", false, time.UTC},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			sched, err := DefaultScheduler.Parse(c.in)
+			if c.shouldErr { // should-err tests end here no matter what
+				if err == nil {
+					t.Error("should have errored, but didn't")
+				} else {
+					return
+				}
+			}
+
+			if err != nil {
+				t.Errorf("got unexpected error: %v", err)
+			}
+
+			// check the tz
+			if sched.Location.String() != c.location.String() {
+				t.Errorf("wrong tz, expected %s, got %s", c.location.String(), sched.Location.String())
+			}
+		})
+	}
+}
diff --git a/serviceregistration/consul/consul_service_registration.go b/serviceregistration/consul/consul_service_registration.go
index 17fb246f357..27a9486a820 100644
--- a/serviceregistration/consul/consul_service_registration.go
+++ b/serviceregistration/consul/consul_service_registration.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"math/rand"
@@ -51,7 +52,7 @@ const (
 
 	// reconcileTimeout is how often Vault should query Consul to detect
 	// and fix any state drift.
-	reconcileTimeout = 60 * time.Second
+	DefaultReconcileTimeout = 60 * time.Second
 
 	// metaExternalSource is a metadata value for external-source that can be
 	// used by the Consul UI.
@@ -64,16 +65,20 @@ var hostnameRegex = regexp.MustCompile(`^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*
 // Vault to Consul.
 type serviceRegistration struct {
 	Client *api.Client
+	config *api.Config
 
 	logger              log.Logger
 	serviceLock         sync.RWMutex
+	registeredServiceID string
 	redirectHost        string
 	redirectPort        int64
 	serviceName         string
 	serviceTags         []string
+	serviceMeta         map[string]string
 	serviceAddress      *string
 	disableRegistration bool
 	checkTimeout        time.Duration
+	reconcileTimeout    time.Duration
 
 	notifyActiveCh      chan struct{}
 	notifySealedCh      chan struct{}
@@ -92,90 +97,9 @@ func NewServiceRegistration(conf map[string]string, logger log.Logger, state sr.
 		return nil, errors.New("logger is required")
 	}
 
-	// Allow admins to disable consul integration
-	disableReg, ok := conf["disable_registration"]
-	var disableRegistration bool
-	if ok && disableReg != "" {
-		b, err := parseutil.ParseBool(disableReg)
-		if err != nil {
-			return nil, fmt.Errorf("failed parsing disable_registration parameter: %w", err)
-		}
-		disableRegistration = b
-	}
-	if logger.IsDebug() {
-		logger.Debug("config disable_registration set", "disable_registration", disableRegistration)
-	}
-
-	// Get the service name to advertise in Consul
-	service, ok := conf["service"]
-	if !ok {
-		service = DefaultServiceName
-	}
-	if !hostnameRegex.MatchString(service) {
-		return nil, errors.New("service name must be valid per RFC 1123 and can contain only alphanumeric characters or dashes")
-	}
-	if logger.IsDebug() {
-		logger.Debug("config service set", "service", service)
-	}
-
-	// Get the additional tags to attach to the registered service name
-	tags := conf["service_tags"]
-	if logger.IsDebug() {
-		logger.Debug("config service_tags set", "service_tags", tags)
-	}
-
-	// Get the service-specific address to override the use of the HA redirect address
-	var serviceAddr *string
-	serviceAddrStr, ok := conf["service_address"]
-	if ok {
-		serviceAddr = &serviceAddrStr
-	}
-	if logger.IsDebug() {
-		logger.Debug("config service_address set", "service_address", serviceAddrStr)
-	}
-
-	checkTimeout := defaultCheckTimeout
-	checkTimeoutStr, ok := conf["check_timeout"]
-	if ok {
-		d, err := parseutil.ParseDurationSecond(checkTimeoutStr)
-		if err != nil {
-			return nil, err
-		}
-
-		min, _ := durationMinusBufferDomain(d, checkMinBuffer, checkJitterFactor)
-		if min < checkMinBuffer {
-			return nil, fmt.Errorf("consul check_timeout must be greater than %v", min)
-		}
-
-		checkTimeout = d
-		if logger.IsDebug() {
-			logger.Debug("config check_timeout set", "check_timeout", d)
-		}
-	}
-
-	// Configure the client
-	consulConf := api.DefaultConfig()
-	// Set MaxIdleConnsPerHost to the number of processes used in expiration.Restore
-	consulConf.Transport.MaxIdleConnsPerHost = consts.ExpirationRestoreWorkerCount
-
-	SetupSecureTLS(context.Background(), consulConf, conf, logger, false)
-
-	consulConf.HttpClient = &http.Client{Transport: consulConf.Transport}
-	client, err := api.NewClient(consulConf)
-	if err != nil {
-		return nil, fmt.Errorf("client setup failed: %w", err)
-	}
-
 	// Setup the backend
 	c := &serviceRegistration{
-		Client: client,
-
-		logger:              logger,
-		serviceName:         service,
-		serviceTags:         strutil.ParseDedupAndSortStrings(tags, ","),
-		serviceAddress:      serviceAddr,
-		checkTimeout:        checkTimeout,
-		disableRegistration: disableRegistration,
+		logger: logger,
 
 		notifyActiveCh:      make(chan struct{}),
 		notifySealedCh:      make(chan struct{}),
@@ -187,7 +111,11 @@ func NewServiceRegistration(conf map[string]string, logger log.Logger, state sr.
 		isPerfStandby: atomicB.NewBool(state.IsPerformanceStandby),
 		isInitialized: atomicB.NewBool(state.IsInitialized),
 	}
-	return c, nil
+
+	c.serviceLock.Lock()
+	defer c.serviceLock.Unlock()
+	err := c.merge(conf)
+	return c, err
 }
 
 func SetupSecureTLS(ctx context.Context, consulConf *api.Config, conf map[string]string, logger log.Logger, isDiagnose bool) error {
@@ -270,6 +198,125 @@ func (c *serviceRegistration) Run(shutdownCh <-chan struct{}, wait *sync.WaitGro
 	return nil
 }
 
+func (c *serviceRegistration) merge(conf map[string]string) error {
+	// Allow admins to disable consul integration
+	disableReg, ok := conf["disable_registration"]
+	var disableRegistration bool
+	if ok && disableReg != "" {
+		b, err := parseutil.ParseBool(disableReg)
+		if err != nil {
+			return fmt.Errorf("failed parsing disable_registration parameter: %w", err)
+		}
+		disableRegistration = b
+	}
+	if c.logger.IsDebug() {
+		c.logger.Debug("config disable_registration set", "disable_registration", disableRegistration)
+	}
+
+	// Get the service name to advertise in Consul
+	service, ok := conf["service"]
+	if !ok {
+		service = DefaultServiceName
+	}
+	if !hostnameRegex.MatchString(service) {
+		return errors.New("service name must be valid per RFC 1123 and can contain only alphanumeric characters or dashes")
+	}
+	if c.logger.IsDebug() {
+		c.logger.Debug("config service set", "service", service)
+	}
+
+	// Get the additional tags to attach to the registered service name
+	tags := conf["service_tags"]
+	if c.logger.IsDebug() {
+		c.logger.Debug("config service_tags set", "service_tags", tags)
+	}
+
+	// Get user-defined meta tags to attach to the registered service name
+	metaTags := map[string]string{}
+	if metaTagsJSON, ok := conf["service_meta"]; ok {
+		if err := json.Unmarshal([]byte(metaTagsJSON), &metaTags); err != nil {
+			return errors.New("service tags must be a dictionary of string keys and values")
+		}
+	}
+	metaTags["external-source"] = metaExternalSource
+	if c.logger.IsDebug() {
+		c.logger.Debug("config service_meta set", "service_meta", metaTags)
+	}
+
+	// Get the service-specific address to override the use of the HA redirect address
+	var serviceAddr *string
+	serviceAddrStr, ok := conf["service_address"]
+	if ok {
+		serviceAddr = &serviceAddrStr
+	}
+	if c.logger.IsDebug() {
+		c.logger.Debug("config service_address set", "service_address", serviceAddrStr)
+	}
+
+	checkTimeout := defaultCheckTimeout
+	checkTimeoutStr, ok := conf["check_timeout"]
+	if ok {
+		d, err := parseutil.ParseDurationSecond(checkTimeoutStr)
+		if err != nil {
+			return err
+		}
+
+		min, _ := durationMinusBufferDomain(d, checkMinBuffer, checkJitterFactor)
+		if min < checkMinBuffer {
+			return fmt.Errorf("consul check_timeout must be greater than %v", min)
+		}
+
+		checkTimeout = d
+		if c.logger.IsDebug() {
+			c.logger.Debug("config check_timeout set", "check_timeout", d)
+		}
+	}
+
+	reconcileTimeout := DefaultReconcileTimeout
+	reconcileTimeoutStr, ok := conf["reconcile_timeout"]
+	if ok {
+		d, err := parseutil.ParseDurationSecond(reconcileTimeoutStr)
+		if err != nil {
+			return err
+		}
+
+		min, _ := durationMinusBufferDomain(d, checkMinBuffer, checkJitterFactor)
+		if min < checkMinBuffer {
+			return fmt.Errorf("consul reconcile_timeout must be greater than %v", min)
+		}
+
+		reconcileTimeout = d
+		if c.logger.IsDebug() {
+			c.logger.Debug("config reconcile_timeout set", "reconcile_timeout", d)
+		}
+	}
+
+	// Configure the client
+	consulConf := api.DefaultConfig()
+	// Set MaxIdleConnsPerHost to the number of processes used in expiration.Restore
+	consulConf.Transport.MaxIdleConnsPerHost = consts.ExpirationRestoreWorkerCount
+
+	SetupSecureTLS(context.Background(), consulConf, conf, c.logger, false)
+
+	consulConf.HttpClient = &http.Client{Transport: consulConf.Transport}
+	client, err := api.NewClient(consulConf)
+	if err != nil {
+		return fmt.Errorf("client setup failed: %w", err)
+	}
+
+	c.Client = client
+	c.config = consulConf
+	c.serviceName = service
+	c.serviceTags = strutil.ParseDedupAndSortStrings(tags, ",")
+	c.serviceMeta = metaTags
+	c.serviceAddress = serviceAddr
+	c.checkTimeout = checkTimeout
+	c.disableRegistration = disableRegistration
+	c.reconcileTimeout = reconcileTimeout
+
+	return nil
+}
+
 func (c *serviceRegistration) NotifyActiveStateChange(isActive bool) error {
 	c.isActive.Store(isActive)
 	select {
@@ -322,6 +369,25 @@ func (c *serviceRegistration) NotifyInitializedStateChange(isInitialized bool) e
 	return nil
 }
 
+func (c *serviceRegistration) NotifyConfigurationReload(conf *map[string]string) error {
+	c.serviceLock.Lock()
+	defer c.serviceLock.Unlock()
+	if conf == nil {
+		if c.logger.IsDebug() {
+			c.logger.Debug("registration is now empty, deregistering service from consul")
+		}
+		c.disableRegistration = true
+		err := c.deregisterService()
+		c.Client = nil
+		return err
+	} else {
+		if c.logger.IsDebug() {
+			c.logger.Debug("service registration configuration received, merging with existing configuation")
+		}
+		return c.merge(*conf)
+	}
+}
+
 func (c *serviceRegistration) checkDuration() time.Duration {
 	return durationMinusBuffer(c.checkTimeout, checkMinBuffer, checkJitterFactor)
 }
@@ -363,7 +429,6 @@ func (c *serviceRegistration) runEventDemuxer(waitGroup *sync.WaitGroup, shutdow
 	// and end of a handler's life (or after a handler wakes up from
 	// sleeping during a back-off/retry).
 	var shutdown atomicB.Bool
-	var registeredServiceID string
 	checkLock := new(int32)
 	serviceRegLock := new(int32)
 
@@ -383,16 +448,19 @@ func (c *serviceRegistration) runEventDemuxer(waitGroup *sync.WaitGroup, shutdow
 			checkTimer.Reset(0)
 		case <-reconcileTimer.C:
 			// Unconditionally rearm the reconcileTimer
-			reconcileTimer.Reset(reconcileTimeout - randomStagger(reconcileTimeout/checkJitterFactor))
+			c.serviceLock.RLock()
+			reconcileTimer.Reset(c.reconcileTimeout - randomStagger(c.reconcileTimeout/checkJitterFactor))
+			disableRegistration := c.disableRegistration
+			c.serviceLock.RUnlock()
 
 			// Abort if service discovery is disabled or a
 			// reconcile handler is already active
-			if !c.disableRegistration && atomic.CompareAndSwapInt32(serviceRegLock, 0, 1) {
+			if !disableRegistration && atomic.CompareAndSwapInt32(serviceRegLock, 0, 1) {
 				// Enter handler with serviceRegLock held
 				go func() {
 					defer atomic.CompareAndSwapInt32(serviceRegLock, 1, 0)
 					for !shutdown.Load() {
-						serviceID, err := c.reconcileConsul(registeredServiceID)
+						serviceID, err := c.reconcileConsul()
 						if err != nil {
 							if c.logger.IsWarn() {
 								c.logger.Warn("reconcile unable to talk with Consul backend", "error", err)
@@ -402,28 +470,38 @@ func (c *serviceRegistration) runEventDemuxer(waitGroup *sync.WaitGroup, shutdow
 						}
 
 						c.serviceLock.Lock()
-						defer c.serviceLock.Unlock()
+						c.registeredServiceID = serviceID
+						c.serviceLock.Unlock()
 
-						registeredServiceID = serviceID
 						return
 					}
 				}()
 			}
 		case <-checkTimer.C:
 			checkTimer.Reset(c.checkDuration())
+			c.serviceLock.RLock()
+			disableRegistration := c.disableRegistration
+			c.serviceLock.RUnlock()
+
 			// Abort if service discovery is disabled or a
 			// reconcile handler is active
-			if !c.disableRegistration && atomic.CompareAndSwapInt32(checkLock, 0, 1) {
+			if !disableRegistration && atomic.CompareAndSwapInt32(checkLock, 0, 1) {
 				// Enter handler with checkLock held
 				go func() {
 					defer atomic.CompareAndSwapInt32(checkLock, 1, 0)
 					for !shutdown.Load() {
-						if err := c.runCheck(c.isSealed.Load()); err != nil {
-							if c.logger.IsWarn() {
-								c.logger.Warn("check unable to talk with Consul backend", "error", err)
+						c.serviceLock.RLock()
+						registeredServiceID := c.registeredServiceID
+						c.serviceLock.RUnlock()
+
+						if registeredServiceID != "" {
+							if err := c.runCheck(c.isSealed.Load()); err != nil {
+								if c.logger.IsWarn() {
+									c.logger.Warn("check unable to talk with Consul backend", "error", err)
+								}
+								time.Sleep(consulRetryInterval)
+								continue
 							}
-							time.Sleep(consulRetryInterval)
-							continue
 						}
 						return
 					}
@@ -435,13 +513,23 @@ func (c *serviceRegistration) runEventDemuxer(waitGroup *sync.WaitGroup, shutdow
 		}
 	}
 
-	c.serviceLock.RLock()
-	defer c.serviceLock.RUnlock()
-	if err := c.Client.Agent().ServiceDeregister(registeredServiceID); err != nil {
-		if c.logger.IsWarn() {
-			c.logger.Warn("service deregistration failed", "error", err)
+	c.serviceLock.Lock()
+	defer c.serviceLock.Unlock()
+	c.deregisterService()
+}
+
+func (c *serviceRegistration) deregisterService() error {
+	if c.registeredServiceID != "" {
+		if err := c.Client.Agent().ServiceDeregister(c.registeredServiceID); err != nil {
+			if c.logger.IsWarn() {
+				c.logger.Warn("service deregistration failed", "error", err)
+			}
+			return err
 		}
+		c.registeredServiceID = ""
 	}
+
+	return nil
 }
 
 // checkID returns the ID used for a Consul Check.  Assume at least a read
@@ -458,10 +546,12 @@ func (c *serviceRegistration) serviceID() string {
 
 // reconcileConsul queries the state of Vault Core and Consul and fixes up
 // Consul's state according to what's in Vault.  reconcileConsul is called
-// without any locks held and can be run concurrently, therefore no changes
+// with a read lock and can be run concurrently, therefore no changes
 // to serviceRegistration can be made in this method (i.e. wtb const receiver for
 // compiler enforced safety).
-func (c *serviceRegistration) reconcileConsul(registeredServiceID string) (serviceID string, err error) {
+func (c *serviceRegistration) reconcileConsul() (serviceID string, err error) {
+	c.serviceLock.RLock()
+	defer c.serviceLock.RUnlock()
 	agent := c.Client.Agent()
 	catalog := c.Client.Catalog()
 
@@ -483,7 +573,7 @@ func (c *serviceRegistration) reconcileConsul(registeredServiceID string) (servi
 	var reregister bool
 
 	switch {
-	case currentVaultService == nil, registeredServiceID == "":
+	case currentVaultService == nil, c.registeredServiceID == "":
 		reregister = true
 	default:
 		switch {
@@ -511,12 +601,10 @@ func (c *serviceRegistration) reconcileConsul(registeredServiceID string) (servi
 		ID:                serviceID,
 		Name:              c.serviceName,
 		Tags:              tags,
+		Meta:              c.serviceMeta,
 		Port:              int(c.redirectPort),
 		Address:           serviceAddress,
 		EnableTagOverride: false,
-		Meta: map[string]string{
-			"external-source": metaExternalSource,
-		},
 	}
 
 	checkStatus := api.HealthCritical
diff --git a/serviceregistration/consul/consul_service_registration_test.go b/serviceregistration/consul/consul_service_registration_test.go
index bd41890be8f..e92edfbe027 100644
--- a/serviceregistration/consul/consul_service_registration_test.go
+++ b/serviceregistration/consul/consul_service_registration_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul
@@ -63,6 +63,17 @@ func TestConsul_ServiceRegistration(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	// update the agent's ACL token so that we can successfully deregister the
+	// service later in the test
+	_, err = client.Agent().UpdateAgentACLToken(config.Token, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = client.Agent().UpdateDefaultACLToken(config.Token, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	// waitForServices waits for the services in the Consul catalog to
 	// reach an expected value, returning the delta if that doesn't happen in time.
 	waitForServices := func(t *testing.T, expected map[string][]string) map[string][]string {
@@ -92,10 +103,13 @@ func TestConsul_ServiceRegistration(t *testing.T) {
 
 	// Create a ServiceRegistration that points to our consul instance
 	logger := logging.NewVaultLogger(log.Trace)
-	sd, err := NewServiceRegistration(map[string]string{
+	srConfig := map[string]string{
 		"address": config.Address(),
 		"token":   config.Token,
-	}, logger, sr.State{})
+		// decrease reconcile timeout to make test run faster
+		"reconcile_timeout": "1s",
+	}
+	sd, err := NewServiceRegistration(srConfig, logger, sr.State{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -147,6 +161,58 @@ func TestConsul_ServiceRegistration(t *testing.T) {
 		"consul": {},
 		"vault":  {"active", "initialized"},
 	})
+
+	// change the token and trigger reload
+	if sd.(*serviceRegistration).config.Token == "" {
+		t.Fatal("expected service registration token to not be '' before configuration reload")
+	}
+
+	srConfigWithoutToken := make(map[string]string)
+	for k, v := range srConfig {
+		srConfigWithoutToken[k] = v
+	}
+	srConfigWithoutToken["token"] = ""
+	err = sd.NotifyConfigurationReload(&srConfigWithoutToken)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if sd.(*serviceRegistration).config.Token != "" {
+		t.Fatal("expected service registration token to be '' after configuration reload")
+	}
+
+	// reconfigure the configuration back to its original state and verify vault is registered
+	err = sd.NotifyConfigurationReload(&srConfig)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	waitForServices(t, map[string][]string{
+		"consul": {},
+		"vault":  {"active", "initialized"},
+	})
+
+	// send 'nil' configuration to verify that the service is deregistered
+	err = sd.NotifyConfigurationReload(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	waitForServices(t, map[string][]string{
+		"consul": {},
+	})
+
+	// reconfigure the configuration back to its original state and verify vault
+	// is re-registered
+	err = sd.NotifyConfigurationReload(&srConfig)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	waitForServices(t, map[string][]string{
+		"consul": {},
+		"vault":  {"active", "initialized"},
+	})
 }
 
 func TestConsul_ServiceAddress(t *testing.T) {
@@ -426,6 +492,66 @@ func TestConsul_serviceTags(t *testing.T) {
 	}
 }
 
+// TestConsul_ServiceMeta tests whether consul service meta registration works
+func TestConsul_ServiceMeta(t *testing.T) {
+	tests := []struct {
+		conf   map[string]string
+		pass   bool
+		expect map[string]string
+	}{
+		{
+			conf:   map[string]string{},
+			pass:   true,
+			expect: map[string]string{"external-source": "vault"},
+		},
+		{
+			conf:   map[string]string{"service_meta": "true"},
+			pass:   false,
+			expect: map[string]string{"external-source": "vault"},
+		},
+		{
+			conf:   map[string]string{"service_meta": "{\"key\":\"value\"}"},
+			pass:   true,
+			expect: map[string]string{"key": "value", "external-source": "vault"},
+		},
+		{
+			conf:   map[string]string{"service_meta": "{\"external-source\":\"something-else\"}"},
+			pass:   true,
+			expect: map[string]string{"external-source": "vault"},
+		},
+	}
+
+	for _, test := range tests {
+		logger := logging.NewVaultLogger(log.Debug)
+
+		shutdownCh := make(chan struct{})
+		defer func() {
+			close(shutdownCh)
+		}()
+		sr, err := NewServiceRegistration(test.conf, logger, sr.State{})
+		if !test.pass {
+			if err == nil {
+				t.Fatal("Expected Consul to fail with error")
+			}
+			continue
+		}
+
+		if err != nil && test.pass {
+			t.Fatalf("Expected Consul to initialize: %v", err)
+		}
+
+		c, ok := sr.(*serviceRegistration)
+		if !ok {
+			t.Fatalf("Expected serviceRegistration")
+		}
+
+		if !reflect.DeepEqual(c.serviceMeta, test.expect) {
+			t.Fatalf("Did not produce expected meta: wanted: %v, got %v", test.expect, c.serviceMeta)
+		}
+
+	}
+}
+
 func TestConsul_setRedirectAddr(t *testing.T) {
 	tests := []struct {
 		addr string
diff --git a/serviceregistration/kubernetes/client/client.go b/serviceregistration/kubernetes/client/client.go
index 0fbef7267b0..85c4de8ee7b 100644
--- a/serviceregistration/kubernetes/client/client.go
+++ b/serviceregistration/kubernetes/client/client.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package client
diff --git a/serviceregistration/kubernetes/client/client_test.go b/serviceregistration/kubernetes/client/client_test.go
index a02749e3915..3e9df5331c2 100644
--- a/serviceregistration/kubernetes/client/client_test.go
+++ b/serviceregistration/kubernetes/client/client_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package client
diff --git a/serviceregistration/kubernetes/client/cmd/kubeclient/main.go b/serviceregistration/kubernetes/client/cmd/kubeclient/main.go
index 3110facc809..1dc293bd159 100644
--- a/serviceregistration/kubernetes/client/cmd/kubeclient/main.go
+++ b/serviceregistration/kubernetes/client/cmd/kubeclient/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/serviceregistration/kubernetes/client/config.go b/serviceregistration/kubernetes/client/config.go
index e8210964826..3b343810b21 100644
--- a/serviceregistration/kubernetes/client/config.go
+++ b/serviceregistration/kubernetes/client/config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package client
diff --git a/serviceregistration/kubernetes/retry_handler.go b/serviceregistration/kubernetes/retry_handler.go
index 3a4397c3b70..cc69f12357f 100644
--- a/serviceregistration/kubernetes/retry_handler.go
+++ b/serviceregistration/kubernetes/retry_handler.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kubernetes
diff --git a/serviceregistration/kubernetes/retry_handler_test.go b/serviceregistration/kubernetes/retry_handler_test.go
index 19f1c5b31ce..ff3eb88e505 100644
--- a/serviceregistration/kubernetes/retry_handler_test.go
+++ b/serviceregistration/kubernetes/retry_handler_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kubernetes
diff --git a/serviceregistration/kubernetes/service_registration.go b/serviceregistration/kubernetes/service_registration.go
index 1c22888016a..19c4049b92a 100644
--- a/serviceregistration/kubernetes/service_registration.go
+++ b/serviceregistration/kubernetes/service_registration.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kubernetes
@@ -106,6 +106,10 @@ func (r *serviceRegistration) NotifyInitializedStateChange(isInitialized bool) e
 	return nil
 }
 
+func (c *serviceRegistration) NotifyConfigurationReload(conf *map[string]string) error {
+	return nil
+}
+
 func getRequiredField(logger hclog.Logger, config map[string]string, envVar, configParam string) (string, error) {
 	value := ""
 	switch {
diff --git a/serviceregistration/kubernetes/service_registration_test.go b/serviceregistration/kubernetes/service_registration_test.go
index 808807d1a9d..fe7138790c5 100644
--- a/serviceregistration/kubernetes/service_registration_test.go
+++ b/serviceregistration/kubernetes/service_registration_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kubernetes
diff --git a/serviceregistration/kubernetes/testing/testserver.go b/serviceregistration/kubernetes/testing/testserver.go
index 225431fc1fa..b1e7bde1625 100644
--- a/serviceregistration/kubernetes/testing/testserver.go
+++ b/serviceregistration/kubernetes/testing/testserver.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package testing
diff --git a/serviceregistration/service_registration.go b/serviceregistration/service_registration.go
index 4eb560793d4..c4681d9deb2 100644
--- a/serviceregistration/service_registration.go
+++ b/serviceregistration/service_registration.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package serviceregistration
@@ -96,4 +96,14 @@ type ServiceRegistration interface {
 	// the implementation's responsibility to retry updating state
 	// in the face of errors.
 	NotifyInitializedStateChange(isInitialized bool) error
+
+	// NotifyConfigurationReload is used by Core to notify that the Vault
+	// configuration has been reloaded.
+	// If errors are returned, Vault only logs a warning, so it is
+	// the implementation's responsibility to retry updating state
+	// in the face of errors.
+	//
+	// If the passed in conf is nil, it is assumed that the service registration
+	// configuration no longer exits and should be deregistered.
+	NotifyConfigurationReload(conf *map[string]string) error
 }
diff --git a/shamir/LICENSE b/shamir/LICENSE
index f4f97ee5853..a32743a27b0 100644
--- a/shamir/LICENSE
+++ b/shamir/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2015 HashiCorp, Inc.
+Copyright IBM Corp. 2016, 2025
 
 Mozilla Public License, version 2.0
 
diff --git a/shamir/shamir.go b/shamir/shamir.go
index d9c0271a709..5c5e05a337d 100644
--- a/shamir/shamir.go
+++ b/shamir/shamir.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package shamir
diff --git a/shamir/shamir_test.go b/shamir/shamir_test.go
index 940a34ecf16..159e5ddfd30 100644
--- a/shamir/shamir_test.go
+++ b/shamir/shamir_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: MPL-2.0
 
 package shamir
diff --git a/tools/codechecker/main.go b/tools/codechecker/main.go
index e9c761c369c..1605e1285af 100644
--- a/tools/codechecker/main.go
+++ b/tools/codechecker/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
diff --git a/tools/codechecker/pkg/godoctests/analyzer.go b/tools/codechecker/pkg/godoctests/analyzer.go
index 98b17a111be..d31c255409a 100644
--- a/tools/codechecker/pkg/godoctests/analyzer.go
+++ b/tools/codechecker/pkg/godoctests/analyzer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package godoctests
diff --git a/tools/codechecker/pkg/godoctests/analyzer_test.go b/tools/codechecker/pkg/godoctests/analyzer_test.go
index 65bf6af1ddc..0116918d2ca 100644
--- a/tools/codechecker/pkg/godoctests/analyzer_test.go
+++ b/tools/codechecker/pkg/godoctests/analyzer_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package godoctests
diff --git a/tools/codechecker/pkg/godoctests/testdata/funcs.go b/tools/codechecker/pkg/godoctests/testdata/funcs.go
index ddaf56bfd2a..a014c21b947 100644
--- a/tools/codechecker/pkg/godoctests/testdata/funcs.go
+++ b/tools/codechecker/pkg/godoctests/testdata/funcs.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package testdata
diff --git a/tools/codechecker/pkg/gonilnilfunctions/analyzer.go b/tools/codechecker/pkg/gonilnilfunctions/analyzer.go
index fbb32dcf1f0..4a0a8e3b3b1 100644
--- a/tools/codechecker/pkg/gonilnilfunctions/analyzer.go
+++ b/tools/codechecker/pkg/gonilnilfunctions/analyzer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package gonilnilfunctions
diff --git a/tools/codechecker/pkg/gonilnilfunctions/analyzer_test.go b/tools/codechecker/pkg/gonilnilfunctions/analyzer_test.go
index 4cfac4af482..a93ab578ea3 100644
--- a/tools/codechecker/pkg/gonilnilfunctions/analyzer_test.go
+++ b/tools/codechecker/pkg/gonilnilfunctions/analyzer_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package gonilnilfunctions
diff --git a/tools/codechecker/pkg/gonilnilfunctions/testdata/funcs.go b/tools/codechecker/pkg/gonilnilfunctions/testdata/funcs.go
index 73f3ee9f589..8adae756729 100644
--- a/tools/codechecker/pkg/gonilnilfunctions/testdata/funcs.go
+++ b/tools/codechecker/pkg/gonilnilfunctions/testdata/funcs.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package testdata
diff --git a/tools/pipeline/go.mod b/tools/pipeline/go.mod
new file mode 100644
index 00000000000..845ae0a3f1b
--- /dev/null
+++ b/tools/pipeline/go.mod
@@ -0,0 +1,80 @@
+module github.com/hashicorp/vault/tools/pipeline
+
+go 1.24.0
+
+// We have test modules in here but they ought to be completely ignored
+ignore internal/pkg/golang/fixtures
+
+require (
+	github.com/Masterminds/semver v1.5.0
+	github.com/avast/retry-go/v4 v4.6.1
+	github.com/google/go-github/v74 v74.0.0
+	github.com/hashicorp/hcl/v2 v2.24.0
+	github.com/hashicorp/releases-api v0.2.3
+	github.com/jedib0t/go-pretty/v6 v6.6.8
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
+	github.com/shurcooL/githubv4 v0.0.0-20240727222349-48295856cce7
+	github.com/spf13/cobra v1.9.1
+	github.com/stretchr/testify v1.10.0
+	github.com/veqryn/slog-context v0.8.0
+	github.com/zclconf/go-cty v1.16.4
+	golang.org/x/mod v0.29.0
+	golang.org/x/oauth2 v0.31.0
+)
+
+require (
+	github.com/agext/levenshtein v1.2.3 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/analysis v0.23.0 // indirect
+	github.com/go-openapi/errors v0.22.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.2 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/loads v0.22.0 // indirect
+	github.com/go-openapi/runtime v0.28.0 // indirect
+	github.com/go-openapi/spec v0.21.0 // indirect
+	github.com/go-openapi/strfmt v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-openapi/validate v0.24.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/hashicorp/go-hclog v1.6.3 // indirect
+	github.com/hashicorp/go-uuid v1.0.3 // indirect
+	github.com/hashicorp/go-version v1.7.0 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jessevdk/go-flags v1.6.1 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/hashstructure v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/mitchellh/pointerstructure v1.2.1 // indirect
+	github.com/oklog/ulid v1.3.1 // indirect
+	github.com/oklog/ulid/v2 v2.1.1 // indirect
+	github.com/opentracing/opentracing-go v1.2.0 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
+	go.mongodb.org/mongo-driver v1.17.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	golang.org/x/net v0.44.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/tools v0.37.0 // indirect
+	google.golang.org/protobuf v1.36.8 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/tools/pipeline/go.sum b/tools/pipeline/go.sum
new file mode 100644
index 00000000000..d2aa4c3cd98
--- /dev/null
+++ b/tools/pipeline/go.sum
@@ -0,0 +1,245 @@
+github.com/DataDog/appsec-internal-go v1.6.0 h1:QHvPOv/O0s2fSI/BraZJNpRDAtdlrRm5APJFZNBxjAw=
+github.com/DataDog/appsec-internal-go v1.6.0/go.mod h1:pEp8gjfNLtEOmz+iZqC8bXhu0h4k7NUsW/qiQb34k1U=
+github.com/DataDog/datadog-agent/pkg/obfuscate v0.48.0 h1:bUMSNsw1iofWiju9yc1f+kBd33E3hMJtq9GuU602Iy8=
+github.com/DataDog/datadog-agent/pkg/obfuscate v0.48.0/go.mod h1:HzySONXnAgSmIQfL6gOv9hWprKJkx8CicuXuUbmgWfo=
+github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.48.1 h1:5nE6N3JSs2IG3xzMthNFhXfOaXlrsdgqmJ73lndFf8c=
+github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.48.1/go.mod h1:Vc+snp0Bey4MrrJyiV2tVxxJb6BmLomPvN1RgAvjGaQ=
+github.com/DataDog/datadog-go/v5 v5.3.0 h1:2q2qjFOb3RwAZNU+ez27ZVDwErJv5/VpbBPprz7Z+s8=
+github.com/DataDog/datadog-go/v5 v5.3.0/go.mod h1:XRDJk1pTc00gm+ZDiBKsjh7oOOtJfYfglVCmFb8C2+Q=
+github.com/DataDog/go-libddwaf/v3 v3.2.1 h1:lZPc6UxCOwioHc++nsldKR50FpIrRh1uGnGLuryqnE8=
+github.com/DataDog/go-libddwaf/v3 v3.2.1/go.mod h1:AP+7Atb8ftSsrha35wht7+K3R+xuzfVSQhabSO4w6CY=
+github.com/DataDog/go-tuf v1.0.2-0.5.2 h1:EeZr937eKAWPxJ26IykAdWA4A0jQXJgkhUjqEI/w7+I=
+github.com/DataDog/go-tuf v1.0.2-0.5.2/go.mod h1:zBcq6f654iVqmkk8n2Cx81E1JnNTMOAx1UEO/wZR+P0=
+github.com/DataDog/sketches-go v1.4.5 h1:ki7VfeNz7IcNafq7yI/j5U/YCkO3LJiMDtXz9OMQbyE=
+github.com/DataDog/sketches-go v1.4.5/go.mod h1:7Y8GN8Jf66DLyDhc94zuWA3uHEt/7ttt8jHOBWWrSOg=
+github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
+github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
+github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/avast/retry-go/v4 v4.6.1 h1:VkOLRubHdisGrHnTu89g08aQEWEgRU7LVEop3GbIcMk=
+github.com/avast/retry-go/v4 v4.6.1/go.mod h1:V6oF8njAwxJ5gRo1Q7Cxab24xs5NCWZBeaHHBklR8mA=
+github.com/aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk=
+github.com/aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/ebitengine/purego v0.6.0-alpha.5 h1:EYID3JOAdmQ4SNZYJHu9V6IqOeRQDBYxqKAg9PyoHFY=
+github.com/ebitengine/purego v0.6.0-alpha.5/go.mod h1:ah1In8AOtksoNK6yk5z1HTJeUkC1Ez4Wk2idgGslMwQ=
+github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY=
+github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
+github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
+github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
+github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
+github.com/go-openapi/jsonpointer v0.21.2 h1:AqQaNADVwq/VnkCmQg6ogE+M3FOsKTytwges0JdwVuA=
+github.com/go-openapi/jsonpointer v0.21.2/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
+github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
+github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
+github.com/go-openapi/loads v0.22.0 h1:ECPGd4jX1U6NApCGG1We+uEozOAvXvJSF4nnwHZ8Aco=
+github.com/go-openapi/loads v0.22.0/go.mod h1:yLsaTCS92mnSAZX5WWoxszLj0u+Ojl+Zs5Stn1oF+rs=
+github.com/go-openapi/runtime v0.28.0 h1:gpPPmWSNGo214l6n8hzdXYhPuJcGtziTOgUpvsFWGIQ=
+github.com/go-openapi/runtime v0.28.0/go.mod h1:QN7OzcS+XuYmkQLw05akXk0jRH/eZ3kb18+1KwW9gyc=
+github.com/go-openapi/spec v0.21.0 h1:LTVzPc3p/RzRnkQqLRndbAzjY0d0BCL72A6j3CdL9ZY=
+github.com/go-openapi/spec v0.21.0/go.mod h1:78u6VdPw81XU44qEWGhtr982gJ5BWg2c0I5XwVMotYk=
+github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMgO/c=
+github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
+github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
+github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
+github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
+github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
+github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
+github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/golang-migrate/migrate/v4 v4.14.1 h1:qmRd/rNGjM1r3Ve5gHd5ZplytrD02UcItYNxJ3iUHHE=
+github.com/golang-migrate/migrate/v4 v4.14.1/go.mod h1:l7Ks0Au6fYHuUIxUhQ0rcVX1uLlJg54C/VvW7tvxSz0=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-github/v74 v74.0.0 h1:yZcddTUn8DPbj11GxnMrNiAnXH14gNs559AsUpNpPgM=
+github.com/google/go-github/v74 v74.0.0/go.mod h1:ubn/YdyftV80VPSI26nSJvaEsTOnsjrxG3o9kJhcyak=
+github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
+github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
+github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
+github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
+github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
+github.com/hashicorp/releases-api v0.2.3 h1:mwNR+lKgJtIyeSQXYGM86fZ0u8ed09v7NS2ePKmVvyc=
+github.com/hashicorp/releases-api v0.2.3/go.mod h1:J8AiSwS1Qy/m/RmHskUGDu9YQRLKreBBswc6ZTY5/tI=
+github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
+github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jackc/pgerrcode v0.0.0-20201024163028-a0d42d470451 h1:WAvSpGf7MsFuzAtK4Vk7R4EVe+liW4x83r4oWu0WHKw=
+github.com/jackc/pgerrcode v0.0.0-20201024163028-a0d42d470451/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.7.5 h1:JHGfMnQY+IEtGM63d+NGMjoRpysB2JBwDr5fsngwmJs=
+github.com/jackc/pgx/v5 v5.7.5/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jedib0t/go-pretty/v6 v6.6.8 h1:JnnzQeRz2bACBobIaa/r+nqjvws4yEhcmaZ4n1QzsEc=
+github.com/jedib0t/go-pretty/v6 v6.6.8/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
+github.com/jessevdk/go-flags v1.6.1 h1:Cvu5U8UGrLay1rZfv/zP7iLpSHGUZ/Ou68T0iX1bBK4=
+github.com/jessevdk/go-flags v1.6.1/go.mod h1:Mk8T1hIAWpOiJiHa9rJASDK2UGWji0EuPGBnNLMooyc=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/lib/pq v1.10.2 h1:AqzbZs4ZoCBp+GtejcpCpcxM3zlSMx29dXbUSeVtJb8=
+github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
+github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
+github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
+github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
+github.com/mitchellh/hashstructure v1.1.0 h1:P6P1hdjqAAknpY/M1CGipelZgp+4y9ja9kmUZPXP+H0=
+github.com/mitchellh/hashstructure v1.1.0/go.mod h1:xUDAozZz0Wmdiufv0uyhnHkUTN6/6d8ulp4AwfLKrmA=
+github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQhoHZAz4x7TIw=
+github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
+github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
+github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+github.com/oklog/ulid/v2 v2.1.1 h1:suPZ4ARWLOJLegGFiZZ1dFAkqzhMjL3J1TzI+5wHz8s=
+github.com/oklog/ulid/v2 v2.1.1/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ=
+github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
+github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
+github.com/outcaste-io/ristretto v0.2.3 h1:AK4zt/fJ76kjlYObOeNwh4T3asEuaCmp26pOvUOL9w0=
+github.com/outcaste-io/ristretto v0.2.3/go.mod h1:W8HywhmtlopSB1jeMg3JtdIhf+DYkLAr0VN/s4+MHac=
+github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
+github.com/philhofer/fwd v1.1.2 h1:bnDivRJ1EWPjUIRXV5KfORO897HTbpFAQddBdE8t7Gw=
+github.com/philhofer/fwd v1.1.2/go.mod h1:qkPdfjR2SIEbspLqpe1tO4n5yICnr2DY7mqEx2tUTP0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
+github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/secure-systems-lab/go-securesystemslib v0.7.0 h1:OwvJ5jQf9LnIAS83waAjPbcMsODrTQUpJ02eNLUoxBg=
+github.com/secure-systems-lab/go-securesystemslib v0.7.0/go.mod h1:/2gYnlnHVQ6xeGtfIqFy7Do03K4cdCY0A/GlJLDKLHI=
+github.com/shurcooL/githubv4 v0.0.0-20240727222349-48295856cce7 h1:cYCy18SHPKRkvclm+pWm1Lk4YrREb4IOIb/YdFO0p2M=
+github.com/shurcooL/githubv4 v0.0.0-20240727222349-48295856cce7/go.mod h1:zqMwyHmnN/eDOZOdiTohqIUKUrTFX62PNlu7IJdu0q8=
+github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466 h1:17JxqqJY66GmZVHkmAsGEkcIu0oCe3AM420QDgGwZx0=
+github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466/go.mod h1:9dIRpgIY7hVhoqfe0/FcYp0bpInZaT7dc3BYOprrIUE=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/tinylib/msgp v1.1.8 h1:FCXC1xanKO4I8plpHGH2P7koL/RzZs12l/+r7vakfm0=
+github.com/tinylib/msgp v1.1.8/go.mod h1:qkpG+2ldGg4xRFmx+jfTvZPxfGFhi64BcnL9vkCm/Tw=
+github.com/veqryn/slog-context v0.8.0 h1:lDhwAgjwx52K5StqqQzi5d0Y/F4SNyGZbsXGd8MtucM=
+github.com/veqryn/slog-context v0.8.0/go.mod h1:8rsT72p0kzzN9lmkwtabIhxg7ZkpnKblt9x3Eix8Tc0=
+github.com/zclconf/go-cty v1.16.4 h1:QGXaag7/7dCzb+odlGrgr+YmYZFaOCMW6DEpS+UD1eE=
+github.com/zclconf/go-cty v1.16.4/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
+go.mongodb.org/mongo-driver v1.17.4 h1:jUorfmVzljjr0FLzYQsGP8cgN/qzzxlY9Vh0C9KFXVw=
+go.mongodb.org/mongo-driver v1.17.4/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
+go.opentelemetry.io/otel/sdk v1.24.0 h1:YMPPDNymmQN3ZgczicBY3B6sf9n62Dlj9pWD3ucgoDw=
+go.opentelemetry.io/otel/sdk v1.24.0/go.mod h1:KVrIYw6tEubO9E96HQpcmpTKDVn9gdv35HoYiQWGDFg=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
+golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
+golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo=
+golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
+golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
+golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
+google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+gopkg.in/DataDog/dd-trace-go.v1 v1.66.0 h1:025+lLubGtpiDWrRmSOxoFBPIiVRVYRcqP9oLabVOeg=
+gopkg.in/DataDog/dd-trace-go.v1 v1.66.0/go.mod h1:Av6AXGmQCQAbDnwNoPiuUz1k3GS8TwQjj+vEdwmEpmM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/tools/pipeline/internal/cmd/generate.go b/tools/pipeline/internal/cmd/generate.go
new file mode 100644
index 00000000000..46aafbd47f6
--- /dev/null
+++ b/tools/pipeline/internal/cmd/generate.go
@@ -0,0 +1,18 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import "github.com/spf13/cobra"
+
+func newGenerateCmd() *cobra.Command {
+	generateCmd := &cobra.Command{
+		Use:   "generate",
+		Short: "Pipeline configuration generation tasks",
+		Long:  "Pipeline configuration generation tasks",
+	}
+
+	generateCmd.AddCommand(newGenerateEnosDynamicConfigCmd())
+
+	return generateCmd
+}
diff --git a/tools/pipeline/internal/cmd/generate_enos_dynamic_config.go b/tools/pipeline/internal/cmd/generate_enos_dynamic_config.go
new file mode 100644
index 00000000000..9f5e32eb0df
--- /dev/null
+++ b/tools/pipeline/internal/cmd/generate_enos_dynamic_config.go
@@ -0,0 +1,57 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/generate"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/releases"
+	"github.com/spf13/cobra"
+)
+
+// skipVersionsDefault are versions that we skip by default. This list can grow as necessary.
+var skipVersionsDefault = []string{
+	"1.16.0", // 1.16.0 artifacts were revoked, always skip it if it's in the range
+}
+
+var genEnosDynamicConfigReq = &generate.EnosDynamicConfigReq{
+	VersionLister: releases.NewClient(),
+}
+
+func newGenerateEnosDynamicConfigCmd() *cobra.Command {
+	enosDynCfgCmd := &cobra.Command{
+		Use:   "enos-dynamic-config",
+		Short: "Generate dynamic Enos configuration files",
+		Long: `Create branch specific Enos configuration dynamically. We do this to set the various
+sample attribute variables on per-branch basis.`,
+		RunE: runGenerateEnosDynamicConfig,
+	}
+
+	enosDynCfgCmd.PersistentFlags().StringVarP(&genEnosDynamicConfigReq.VaultVersion, "version", "v", "", "The version of Vault")
+	enosDynCfgCmd.PersistentFlags().StringVarP(&genEnosDynamicConfigReq.VaultEdition, "edition", "e", "", "The edition of Vault. Can either be 'ce' or 'enterprise'")
+	enosDynCfgCmd.PersistentFlags().StringVarP(&genEnosDynamicConfigReq.EnosDir, "dir", "d", ".", "The enos directory to create the configuration in")
+	enosDynCfgCmd.PersistentFlags().UintVarP(&genEnosDynamicConfigReq.NMinus, "nminus", "n", 3, "Instead of setting a dedicated lower bound, calculate N-X from the upper")
+	enosDynCfgCmd.PersistentFlags().StringSliceVarP(&genEnosDynamicConfigReq.Skip, "skip", "s", skipVersionsDefault, "Skip these versions. Can be provided none-to-many times")
+	enosDynCfgCmd.PersistentFlags().StringVar(&genEnosDynamicConfigReq.FileName, "file", "enos-dynamic-config.hcl", "The name of the file to write the configuration into")
+
+	err := enosDynCfgCmd.MarkPersistentFlagRequired("edition")
+	if err != nil {
+		panic(err)
+	}
+	err = enosDynCfgCmd.MarkPersistentFlagRequired("version")
+	if err != nil {
+		panic(err)
+	}
+
+	return enosDynCfgCmd
+}
+
+func runGenerateEnosDynamicConfig(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	_, err := genEnosDynamicConfigReq.Run(context.TODO())
+
+	return err
+}
diff --git a/tools/pipeline/internal/cmd/github.go b/tools/pipeline/internal/cmd/github.go
new file mode 100644
index 00000000000..694a1ac5176
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github.go
@@ -0,0 +1,86 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/google/go-github/v74/github"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/git"
+	"github.com/shurcooL/githubv4"
+	"github.com/spf13/cobra"
+	"golang.org/x/oauth2"
+)
+
+type githubCommandState struct {
+	Git      *git.Client
+	GithubV3 *github.Client
+	GithubV4 *githubv4.Client
+}
+
+var githubCmdState = &githubCommandState{
+	GithubV3: github.NewClient(nil),
+	GithubV4: githubv4.NewClient(nil),
+	Git:      git.NewClient(git.WithLoadTokenFromEnv()),
+}
+
+func newGithubCmd() *cobra.Command {
+	githubCmd := &cobra.Command{
+		Use:   "github",
+		Short: "Github commands",
+		Long:  "Github commands",
+		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+			if token, set := os.LookupEnv("GITHUB_TOKEN"); set {
+				githubCmdState.GithubV3 = githubCmdState.GithubV3.WithAuthToken(token)
+				githubCmdState.GithubV4 = githubv4.NewClient(
+					oauth2.NewClient(context.Background(),
+						oauth2.StaticTokenSource(&oauth2.Token{AccessToken: token}),
+					),
+				)
+			} else {
+				fmt.Println("\x1b[1;33;49mWARNING\x1b[0m: GITHUB_TOKEN has not been set. While not always required for read actions on public repositories you're likely to get throttled without it")
+			}
+
+			return nil
+		},
+	}
+
+	githubCmd.AddCommand(newGithubCheckCmd())
+	githubCmd.AddCommand(newGithubCloseCmd())
+	githubCmd.AddCommand(newGithubCopyCmd())
+	githubCmd.AddCommand(newGithubCreateCmd())
+	githubCmd.AddCommand(newGithubFindCmd())
+	githubCmd.AddCommand(newGithubListCmd())
+	githubCmd.AddCommand(newGithubSyncCmd())
+
+	return githubCmd
+}
+
+func writeToGithubOutput(key string, bytes []byte) error {
+	devPath, ok := os.LookupEnv("GITHUB_OUTPUT")
+	if !ok {
+		return fmt.Errorf("$GITHUB_OUTPUT has not been set. Cannot write %s to it", key)
+	}
+
+	expanded, err := filepath.Abs(devPath)
+	if err != nil {
+		return fmt.Errorf("failed to expand $GITHUB_OUTPUT path: %w", err)
+	}
+
+	dev, err := os.OpenFile(expanded, os.O_APPEND|os.O_WRONLY, 0o644)
+	if err != nil {
+		return fmt.Errorf("failed to open $GITHUB_OUTPUT for writing: %w", err)
+	}
+	defer func() { _ = dev.Close() }()
+
+	_, err = dev.Write(append(append([]byte(key+"="), bytes...), []byte("\n")...))
+	if err != nil {
+		return fmt.Errorf("failed to write key %s to $GITHUB_OUTPUT: %w", key, err)
+	}
+
+	return nil
+}
diff --git a/tools/pipeline/internal/cmd/github_check.go b/tools/pipeline/internal/cmd/github_check.go
new file mode 100644
index 00000000000..a0bb052948a
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_check.go
@@ -0,0 +1,19 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func newGithubCheckCmd() *cobra.Command {
+	checkCmd := &cobra.Command{
+		Use:   "check",
+		Short: "Github check commands",
+		Long:  "Github check commands",
+	}
+	checkCmd.AddCommand(newCheckGithubCommitStatusCmd())
+
+	return checkCmd
+}
diff --git a/tools/pipeline/internal/cmd/github_check_commit_status.go b/tools/pipeline/internal/cmd/github_check_commit_status.go
new file mode 100644
index 00000000000..5c94d6e232a
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_check_commit_status.go
@@ -0,0 +1,65 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/github"
+	"github.com/spf13/cobra"
+)
+
+var checkGithubCommitStatusReq = github.CheckCommitStatusReq{}
+
+func newCheckGithubCommitStatusCmd() *cobra.Command {
+	checkCommitStatusCmd := &cobra.Command{
+		Use:   "commit-status --context <context> --creator <creator> --state <state> [--pr 1234 | --commit 1a61dbe57a7538f22f7fa3fb65900d9d41c2ba14]",
+		Short: "Check a commit status for a PR or commit",
+		Long:  "Check a commit status for a specific context and creator matches an expected state. When given provided the --pr flag the HEAD sha will be used as the commit",
+		RunE:  runCheckGithubCommitStatusCmd,
+	}
+
+	checkCommitStatusCmd.PersistentFlags().StringVarP(&checkGithubCommitStatusReq.Owner, "owner", "o", "hashicorp", "The Github organization")
+	checkCommitStatusCmd.PersistentFlags().StringVarP(&checkGithubCommitStatusReq.Repo, "repo", "r", "vault", "The Github repository. Private repositories require auth via a GITHUB_TOKEN env var")
+	checkCommitStatusCmd.PersistentFlags().StringVarP(&checkGithubCommitStatusReq.Commit, "commit", "c", "", "The commit you wish to list the statuses of")
+	checkCommitStatusCmd.PersistentFlags().IntVarP(&checkGithubCommitStatusReq.PR, "pr", "p", 0, "The Pull Request number you wish to use as the source. The HEAD commit will be used")
+	checkCommitStatusCmd.PersistentFlags().StringVar(&checkGithubCommitStatusReq.Context, "context", "", "The context of the status. This usually maps to the name of the check that shows up in the Pull Request status box")
+	checkCommitStatusCmd.PersistentFlags().StringVar(&checkGithubCommitStatusReq.Creator, "creator", "", "The github login of the creator of the status")
+	checkCommitStatusCmd.PersistentFlags().StringVarP(&checkGithubCommitStatusReq.State, "state", "s", "success", "The expected state of the status. Can be one of 'error', 'failure', 'pending', 'success'")
+
+	err := checkCommitStatusCmd.MarkPersistentFlagRequired("context")
+	if err != nil {
+		panic(err)
+	}
+
+	return checkCommitStatusCmd
+}
+
+func runCheckGithubCommitStatusCmd(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := checkGithubCommitStatusReq.Run(context.TODO(), githubCmdState.GithubV3)
+	if err != nil {
+		return err
+	}
+
+	switch rootCfg.format {
+	case "json":
+		b, err := json.Marshal(res)
+		if err != nil {
+			return fmt.Errorf("marshaling response to JSON: %w", err)
+		}
+		fmt.Println(string(b))
+	default:
+		fmt.Println(res.ToTable().Render())
+	}
+
+	if !res.CheckSuccessful {
+		return fmt.Errorf("no statuses matched expected criteria: %s", res.String())
+	}
+
+	return nil
+}
diff --git a/tools/pipeline/internal/cmd/github_close.go b/tools/pipeline/internal/cmd/github_close.go
new file mode 100644
index 00000000000..6f70fdbe5b4
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_close.go
@@ -0,0 +1,19 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func newGithubCloseCmd() *cobra.Command {
+	closeCmd := &cobra.Command{
+		Use:   "close",
+		Short: "Github close commands",
+		Long:  "Github close commands",
+	}
+	closeCmd.AddCommand(newCloseGithubCopiedPullRequestCmd())
+
+	return closeCmd
+}
diff --git a/tools/pipeline/internal/cmd/github_close_origin_pull_request.go b/tools/pipeline/internal/cmd/github_close_origin_pull_request.go
new file mode 100644
index 00000000000..f5c6bd9c51a
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_close_origin_pull_request.go
@@ -0,0 +1,51 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/github"
+	"github.com/spf13/cobra"
+)
+
+var closeCopiedOriginPullRequestReq = github.CloseCopiedOriginPullRequestReq{}
+
+func newCloseGithubCopiedPullRequestCmd() *cobra.Command {
+	closeCopiedOriginPRCmd := &cobra.Command{
+		Use:   "origin-pull-request [number]",
+		Short: "Close the origin pull request of a copied pull request",
+		RunE:  runCloseGithubCopiedPullRequestCmd,
+		Args:  argsOnlyPRNumber(&closeCopiedOriginPullRequestReq.PullNumber),
+	}
+
+	closeCopiedOriginPRCmd.PersistentFlags().StringVarP(&closeCopiedOriginPullRequestReq.Owner, "owner", "o", "hashicorp", "The Github organization")
+	closeCopiedOriginPRCmd.PersistentFlags().StringVarP(&closeCopiedOriginPullRequestReq.Repo, "repo", "r", "vault-enterprise", "The Github repository. Private repositories require auth via a GITHUB_TOKEN env var")
+
+	return closeCopiedOriginPRCmd
+}
+
+func runCloseGithubCopiedPullRequestCmd(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := closeCopiedOriginPullRequestReq.Run(context.TODO(), githubCmdState.GithubV3, githubCmdState.GithubV4)
+	switch rootCfg.format {
+	case "json":
+		b, err1 := res.ToJSON()
+		if err != nil {
+			return errors.Join(err, err1)
+		}
+		fmt.Println(string(b))
+	case "markdown":
+		tbl := res.ToTable(err)
+		tbl.SetTitle("Close Origin Pull Request")
+		fmt.Println(tbl.RenderMarkdown())
+	default:
+		fmt.Println(res.ToTable(err).Render())
+	}
+
+	return err
+}
diff --git a/tools/pipeline/internal/cmd/github_copy.go b/tools/pipeline/internal/cmd/github_copy.go
new file mode 100644
index 00000000000..9cc102bf25c
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_copy.go
@@ -0,0 +1,19 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func newGithubCopyCmd() *cobra.Command {
+	copyCmd := &cobra.Command{
+		Use:   "copy",
+		Short: "Github copy commands",
+		Long:  "Github copy commands",
+	}
+	copyCmd.AddCommand(newCopyGithubPullRequestCmd())
+
+	return copyCmd
+}
diff --git a/tools/pipeline/internal/cmd/github_copy_pull_request.go b/tools/pipeline/internal/cmd/github_copy_pull_request.go
new file mode 100644
index 00000000000..95b2450f6f3
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_copy_pull_request.go
@@ -0,0 +1,83 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"strconv"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/github"
+	"github.com/spf13/cobra"
+)
+
+var copyGithubPullRequestReq = github.CopyPullRequestReq{}
+
+func newCopyGithubPullRequestCmd() *cobra.Command {
+	copyPRCmd := &cobra.Command{
+		Use:   "pr [number]",
+		Short: "Copy a pull request",
+		Long:  "Copy a pull request from the Community repository to the Enterprise repository",
+		RunE:  runCopyGithubPullRequestCmd,
+		Args:  argsOnlyPRNumber(&copyGithubPullRequestReq.PullNumber),
+	}
+
+	copyPRCmd.PersistentFlags().StringVar(&copyGithubPullRequestReq.FromOrigin, "from-origin", "ce", "The name to use for the base remote origin")
+	copyPRCmd.PersistentFlags().StringVar(&copyGithubPullRequestReq.FromOwner, "from-owner", "hashicorp", "The Github organization")
+	copyPRCmd.PersistentFlags().StringVar(&copyGithubPullRequestReq.FromRepo, "from-repo", "vault", "The CE Github repository to copy the PR from")
+	copyPRCmd.PersistentFlags().StringVar(&copyGithubPullRequestReq.ToOrigin, "to-origin", "origin", "The name to use for the base remote origin")
+	copyPRCmd.PersistentFlags().StringVar(&copyGithubPullRequestReq.ToOwner, "to-owner", "hashicorp", "The Github organization")
+	copyPRCmd.PersistentFlags().StringVar(&copyGithubPullRequestReq.ToRepo, "to-repo", "vault-enterprise", "The Github repository. Private repositories require auth via a GITHUB_TOKEN env var")
+	copyPRCmd.PersistentFlags().StringVarP(&copyGithubPullRequestReq.RepoDir, "repo-dir", "d", "", "The path to the vault repository dir. If not set a temporary directory will be used")
+	copyPRCmd.PersistentFlags().StringVar(&copyGithubPullRequestReq.EntBranchSuffix, "ent-branch-suffix", "+ent", "The release branch suffix for enterprise branches")
+
+	return copyPRCmd
+}
+
+func runCopyGithubPullRequestCmd(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := copyGithubPullRequestReq.Run(context.TODO(), githubCmdState.GithubV3, githubCmdState.Git)
+
+	switch rootCfg.format {
+	case "json":
+		b, err1 := res.ToJSON()
+		if err1 != nil {
+			return errors.Join(err, err1)
+		}
+		fmt.Println(string(b))
+	case "markdown":
+		tbl := res.ToTable(err)
+		tbl.SetTitle("Copy Pull Request")
+		fmt.Println(tbl.RenderMarkdown())
+	default:
+		fmt.Println(res.ToTable(err).Render())
+	}
+
+	return err
+}
+
+func argsOnlyPRNumber(dest *uint) func(cmd *cobra.Command, args []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		switch len(args) {
+		case 1:
+			pr, err := strconv.ParseUint(args[0], 10, 0)
+			if err != nil {
+				return fmt.Errorf("invalid pull number: %s: %w", args[0], err)
+			}
+			if pr <= math.MaxUint32 {
+				*dest = uint(pr)
+			} else {
+				return fmt.Errorf("invalid pull number: %s: number is too large", args[0])
+			}
+			return nil
+		case 0:
+			return errors.New("no pull request number has been provided")
+		default:
+			return fmt.Errorf("invalid arguments: only pull request number is expected, received %d arguments: %v", len(args), args)
+		}
+	}
+}
diff --git a/tools/pipeline/internal/cmd/github_create.go b/tools/pipeline/internal/cmd/github_create.go
new file mode 100644
index 00000000000..20cb7bffd93
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_create.go
@@ -0,0 +1,19 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func newGithubCreateCmd() *cobra.Command {
+	createCmd := &cobra.Command{
+		Use:   "create",
+		Short: "Github create commands",
+		Long:  "Github create commands",
+	}
+	createCmd.AddCommand(newCreateGithubBackportCmd())
+
+	return createCmd
+}
diff --git a/tools/pipeline/internal/cmd/github_create_backport.go b/tools/pipeline/internal/cmd/github_create_backport.go
new file mode 100644
index 00000000000..e4398a09dbf
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_create_backport.go
@@ -0,0 +1,116 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"strconv"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/changed"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/github"
+	"github.com/spf13/cobra"
+)
+
+var createGithubBackportState struct {
+	req             github.CreateBackportReq
+	ceExclude       []string
+	ceAllowInactive []string
+}
+
+func newCreateGithubBackportCmd() *cobra.Command {
+	backportCmd := &cobra.Command{
+		Use:   "backport 1234",
+		Short: "Create a backport pull request from another pull request",
+		Long:  "Create a backport pull request from another pull request",
+		RunE:  runCreateGithubBackportCmd,
+		Args: func(cmd *cobra.Command, args []string) error {
+			switch len(args) {
+			case 1:
+				pr, err := strconv.ParseUint(args[0], 10, 0)
+				if err != nil {
+					return fmt.Errorf("invalid pull number: %s: %w", args[0], err)
+				}
+				if pr <= math.MaxUint32 {
+					createGithubBackportState.req.PullNumber = uint(pr)
+				} else {
+					return fmt.Errorf("invalid pull number: %s: number is too large", args[0])
+				}
+				return nil
+			case 0:
+				return errors.New("no pull request number has been provided")
+			default:
+				return fmt.Errorf("invalid arguments: only pull request number is expected, received %d arguments: %v", len(args), args)
+			}
+		},
+	}
+
+	backportCmd.PersistentFlags().StringSliceVarP(&createGithubBackportState.ceAllowInactive, "ce-allow-inactive-groups", "a", []string{"docs", "changelog", "pipeline"}, "Change file groups that should be allowed to backport to inactive CE branches")
+	backportCmd.PersistentFlags().StringVar(&createGithubBackportState.req.CEBranchPrefix, "ce-branch-prefix", "ce", "The branch name prefix")
+	backportCmd.PersistentFlags().StringSliceVarP(&createGithubBackportState.ceExclude, "ce-exclude-groups", "e", []string{"enterprise"}, "Change file groups that should be excluded from the backporting to CE branches")
+	backportCmd.PersistentFlags().StringVar(&createGithubBackportState.req.BaseOrigin, "base-origin", "origin", "The name to use for the base remote origin")
+	backportCmd.PersistentFlags().StringVarP(&createGithubBackportState.req.Owner, "owner", "o", "hashicorp", "The Github organization")
+	backportCmd.PersistentFlags().StringVarP(&createGithubBackportState.req.Repo, "repo", "r", "vault-enterprise", "The Github repository. Private repositories require auth via a GITHUB_TOKEN env var")
+	backportCmd.PersistentFlags().StringVarP(&createGithubBackportState.req.RepoDir, "repo-dir", "d", "", "The path to the vault repository dir. If not set a temporary directory will be used")
+	backportCmd.PersistentFlags().StringVarP(&createGithubBackportState.req.ReleaseVersionConfigPath, "releases-version-path", "m", "", "The path to .release/versions.hcl")
+	backportCmd.PersistentFlags().UintVar(&createGithubBackportState.req.ReleaseRecurseDepth, "recurse", 3, "If no path to a config file is given, recursively search backwards for it and stop at root or until we've his the configured depth.")
+
+	// NOTE: The following are technically flags but they only for testing testing
+	// the command before we cut over to new utility.
+	backportCmd.PersistentFlags().StringVar(&createGithubBackportState.req.EntBranchPrefix, "ent-branch-prefix", "", "The ent branch name prefix. Only used for testing before migration to the new workflow")
+	backportCmd.PersistentFlags().StringVar(&createGithubBackportState.req.BackportLabelPrefix, "backport-label-prefix", "backport", "The name to use for the base remote origin")
+
+	err := backportCmd.PersistentFlags().MarkHidden("ent-branch-prefix")
+	if err != nil {
+		panic(err)
+	}
+
+	err = backportCmd.PersistentFlags().MarkHidden("backport-label-prefix")
+	if err != nil {
+		panic(err)
+	}
+
+	return backportCmd
+}
+
+func runCreateGithubBackportCmd(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	for i, ig := range createGithubBackportState.ceAllowInactive {
+		if i == 0 && createGithubBackportState.req.CEAllowInactiveGroups == nil {
+			createGithubBackportState.req.CEAllowInactiveGroups = changed.FileGroups{}
+		}
+		createGithubBackportState.req.CEAllowInactiveGroups = createGithubBackportState.req.CEAllowInactiveGroups.Add(changed.FileGroup(ig))
+	}
+
+	for i, eg := range createGithubBackportState.ceExclude {
+		if i == 0 && createGithubBackportState.req.CEExclude == nil {
+			createGithubBackportState.req.CEExclude = changed.FileGroups{}
+		}
+		createGithubBackportState.req.CEExclude = createGithubBackportState.req.CEExclude.Add(changed.FileGroup(eg))
+	}
+
+	res := createGithubBackportState.req.Run(context.TODO(), githubCmdState.GithubV3, githubCmdState.Git)
+	if res == nil {
+		res = &github.CreateBackportRes{}
+	}
+	if err := res.Err(); err != nil {
+		res.ErrorMessage = err.Error()
+	}
+
+	switch rootCfg.format {
+	case "json":
+		b, err := res.ToJSON()
+		if err != nil {
+			return errors.Join(res.Err(), err)
+		}
+		fmt.Println(string(b))
+	default:
+		fmt.Println(res.ToTable().Render())
+	}
+
+	return res.Err()
+}
diff --git a/tools/pipeline/internal/cmd/github_find.go b/tools/pipeline/internal/cmd/github_find.go
new file mode 100644
index 00000000000..aa5a6a15784
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_find.go
@@ -0,0 +1,19 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func newGithubFindCmd() *cobra.Command {
+	findCmd := &cobra.Command{
+		Use:   "find",
+		Short: "Github find commands",
+		Long:  "Github find commands",
+	}
+	findCmd.AddCommand(newGithubFindWorkflowArtifactCmd())
+
+	return findCmd
+}
diff --git a/tools/pipeline/internal/cmd/github_find_workflow_artifact.go b/tools/pipeline/internal/cmd/github_find_workflow_artifact.go
new file mode 100644
index 00000000000..6a784046b1d
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_find_workflow_artifact.go
@@ -0,0 +1,64 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/github"
+	"github.com/spf13/cobra"
+)
+
+var findWorkflowArtifact = &github.FindWorkflowArtifactReq{}
+
+func newGithubFindWorkflowArtifactCmd() *cobra.Command {
+	findWorkflowArtifactCmd := &cobra.Command{
+		Use:   "workflow-artifact [--pr 1234 --workflow build --pattern 'vault_[0-9]'",
+		Short: "Find an artifact associated with a pull requests workflow run",
+		Long:  "Find an artifact associated with a pull requests workflow run",
+		RunE:  runFindGithubWorkflowArtifactCmd,
+	}
+
+	findWorkflowArtifactCmd.PersistentFlags().StringVarP(&findWorkflowArtifact.ArtifactName, "name", "n", "", "The exact artifact name to match")
+	findWorkflowArtifactCmd.PersistentFlags().StringVarP(&findWorkflowArtifact.ArtifactPattern, "pattern", "m", "", "A pattern to match an artifact. Only the first match will be returned")
+	findWorkflowArtifactCmd.PersistentFlags().StringVarP(&findWorkflowArtifact.Owner, "owner", "o", "hashicorp", "The Github organization")
+	findWorkflowArtifactCmd.PersistentFlags().StringVarP(&findWorkflowArtifact.Repo, "repo", "r", "vault", "The Github repository. Private repositories require auth via a GITHUB_TOKEN env var")
+	findWorkflowArtifactCmd.PersistentFlags().IntVarP(&findWorkflowArtifact.PullNumber, "pr", "p", 0, "The pull request to use as the trigger of the workflow")
+	findWorkflowArtifactCmd.PersistentFlags().StringVarP(&findWorkflowArtifact.WorkflowName, "workflow", "w", "", "The name of the workflow the artifact will be associated with")
+	findWorkflowArtifactCmd.PersistentFlags().BoolVar(&findWorkflowArtifact.WriteToGithubOutput, "github-output", false, "Whether or not to write 'workflow-artifact' to $GITHUB_OUTPUT")
+
+	return findWorkflowArtifactCmd
+}
+
+func runFindGithubWorkflowArtifactCmd(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := findWorkflowArtifact.Run(context.TODO(), githubCmdState.GithubV3)
+	if err != nil {
+		return fmt.Errorf("finding workflow artifact: %w", err)
+	}
+
+	switch rootCfg.format {
+	case "json":
+		jsonBytes, err := res.ToJSON()
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(jsonBytes))
+	default:
+		fmt.Println(res.ToTable())
+	}
+
+	if findWorkflowArtifact.WriteToGithubOutput {
+		jsonBytes, err := res.ToGithubOutput()
+		if err != nil {
+			return err
+		}
+
+		return writeToGithubOutput("workflow-artifact", jsonBytes)
+	}
+
+	return nil
+}
diff --git a/tools/pipeline/internal/cmd/github_list.go b/tools/pipeline/internal/cmd/github_list.go
new file mode 100644
index 00000000000..e406ace238d
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_list.go
@@ -0,0 +1,22 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func newGithubListCmd() *cobra.Command {
+	listCmd := &cobra.Command{
+		Use:   "list",
+		Short: "Github list commands",
+		Long:  "Github list commands",
+	}
+
+	listCmd.AddCommand(newGithubListChangedFilesCmd())
+	listCmd.AddCommand(newGithubListCommitStatusesCmd())
+	listCmd.AddCommand(newGithubListWorkflowRunsCmd())
+
+	return listCmd
+}
diff --git a/tools/pipeline/internal/cmd/github_list_changed_files.go b/tools/pipeline/internal/cmd/github_list_changed_files.go
new file mode 100644
index 00000000000..d5220ace112
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_list_changed_files.go
@@ -0,0 +1,63 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/github"
+	"github.com/spf13/cobra"
+)
+
+var listGithubChangedFiles = &github.ListChangedFilesReq{}
+
+func newGithubListChangedFilesCmd() *cobra.Command {
+	changedFilesCmd := &cobra.Command{
+		Use:   "changed-files [--pr 1234 | --commit abcd1234 ]",
+		Short: "List changed files in a pull request or commit",
+		Long:  "List changed files in a pull request or commit",
+		RunE:  runListGithubChangedFilesCmd,
+	}
+
+	changedFilesCmd.PersistentFlags().StringVarP(&listGithubChangedFiles.Owner, "owner", "o", "hashicorp", "The Github organization")
+	changedFilesCmd.PersistentFlags().StringVarP(&listGithubChangedFiles.Repo, "repo", "r", "vault", "The Github repository. Private repositories require auth via a GITHUB_TOKEN env var")
+	changedFilesCmd.PersistentFlags().StringVarP(&listGithubChangedFiles.CommitSHA, "commit", "c", "", "The commit SHA to use as a changed file source")
+	changedFilesCmd.PersistentFlags().IntVarP(&listGithubChangedFiles.PullNumber, "pr", "p", 0, "The pull request to use as a changed file source")
+	changedFilesCmd.PersistentFlags().BoolVarP(&listGithubChangedFiles.GroupFiles, "group", "g", true, "Whether or not to determine changed file groups")
+	changedFilesCmd.PersistentFlags().BoolVar(&listGithubChangedFiles.WriteToGithubOutput, "github-output", false, "Whether or not to write 'changed-files' to $GITHUB_OUTPUT")
+
+	return changedFilesCmd
+}
+
+func runListGithubChangedFilesCmd(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := listGithubChangedFiles.Run(context.TODO(), githubCmdState.GithubV3)
+	if err != nil {
+		return fmt.Errorf("listing changed files: %w", err)
+	}
+
+	switch rootCfg.format {
+	case "json":
+		b, err := res.ToJSON()
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(b))
+	default:
+		fmt.Println(res.ToTable(listGithubChangedFiles.GroupFiles))
+	}
+
+	if listGithubChangedFiles.WriteToGithubOutput {
+		output, err := res.ToGithubOutput()
+		if err != nil {
+			return err
+		}
+
+		return writeToGithubOutput("changed-files", output)
+	}
+
+	return nil
+}
diff --git a/tools/pipeline/internal/cmd/github_list_commit_statuses.go b/tools/pipeline/internal/cmd/github_list_commit_statuses.go
new file mode 100644
index 00000000000..8a920586044
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_list_commit_statuses.go
@@ -0,0 +1,53 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/github"
+	"github.com/spf13/cobra"
+)
+
+var listGithubCommitStatuses = &github.ListCommitStatusesReq{}
+
+func newGithubListCommitStatusesCmd() *cobra.Command {
+	listCommitStatusesCmd := &cobra.Command{
+		Use:   "commit-statuses [--pr 1234 | --commit 1a61dbe57a7538f22f7fa3fb65900d9d41c2ba14]",
+		Short: "List the statuses associated with a commit",
+		Long:  "List the statuses associated with a commit. When given passed the --pr flag it will use the head ref of the PR as the commit",
+		RunE:  runListGithubCommitStatuses,
+	}
+
+	listCommitStatusesCmd.PersistentFlags().StringVarP(&listGithubCommitStatuses.Owner, "owner", "o", "hashicorp", "The Github organization")
+	listCommitStatusesCmd.PersistentFlags().StringVarP(&listGithubCommitStatuses.Repo, "repo", "r", "vault", "The Github repository. Private repositories require auth via a GITHUB_TOKEN env var")
+	listCommitStatusesCmd.PersistentFlags().StringVarP(&listGithubCommitStatuses.Commit, "commit", "c", "", "The commit you wish to list the statuses of")
+	listCommitStatusesCmd.PersistentFlags().IntVarP(&listGithubCommitStatuses.PR, "pr", "p", 0, "The Pull Request number you wish to use as the source. The HEAD commit will be used")
+
+	return listCommitStatusesCmd
+}
+
+func runListGithubCommitStatuses(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := listGithubCommitStatuses.Run(context.TODO(), githubCmdState.GithubV3)
+	if err != nil {
+		return fmt.Errorf("listing github commit statuses: %w", err)
+	}
+
+	switch rootCfg.format {
+	case "json":
+		b, err := json.Marshal(res)
+		if err != nil {
+			return fmt.Errorf("marshaling response to JSON: %w", err)
+		}
+		fmt.Println(string(b))
+	default:
+		fmt.Println(res.ToTable().Render())
+	}
+
+	return err
+}
diff --git a/tools/pipeline/internal/cmd/github_list_runs.go b/tools/pipeline/internal/cmd/github_list_runs.go
new file mode 100644
index 00000000000..14cd1825b67
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_list_runs.go
@@ -0,0 +1,79 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/github"
+	"github.com/spf13/cobra"
+)
+
+var listGithubWorkflowRuns = &github.ListWorkflowRunsReq{}
+
+func newGithubListWorkflowRunsCmd() *cobra.Command {
+	listRunsCmd := &cobra.Command{
+		Use:   "workflow-runs [WORKFLOW_NAME]",
+		Short: "List workflow runs",
+		Long:  "List Github Actions workflow runs for a given workflow. Be sure to use filter arguments to reduce the search, otherwise you'll likely hit your API limit.",
+		RunE:  runListGithubWorkflowsCmd,
+		Args: func(cmd *cobra.Command, args []string) error {
+			switch len(args) {
+			case 1:
+				listGithubWorkflowRuns.WorkflowName = args[0]
+				return nil
+			case 0:
+				return errors.New("no workflow name argument has been provided")
+			default:
+				return fmt.Errorf("expected a single workflow name as an argument, received (%d): %v", len(args), args)
+			}
+		},
+	}
+
+	listRunsCmd.PersistentFlags().StringVarP(&listGithubWorkflowRuns.Actor, "actor", "a", "", "Filter using a specific Github actor")
+	listRunsCmd.PersistentFlags().StringVarP(&listGithubWorkflowRuns.Branch, "branch", "b", "", "Filter using a specific Github branch")
+	listRunsCmd.PersistentFlags().Int64VarP(&listGithubWorkflowRuns.CheckSuiteID, "check-suite-id", "c", 0, "Filter using a specific Github check suite")
+	listRunsCmd.PersistentFlags().BoolVar(&listGithubWorkflowRuns.Compact, "compact", true, "When given a status filter, only fetch data for workflows, jobs, checks, and annotations that match our status and/or conclusion. Disabling compact mode with a large query range might result in Github throttling the requests.")
+	listRunsCmd.PersistentFlags().StringVarP(&listGithubWorkflowRuns.DateQuery, "date-query", "d", fmt.Sprintf("%s..*", time.Now().Add(-168*time.Hour).Format(time.DateOnly)), "Filter using a date range query. It supports the Github ISO8601-ish date range query format. Default is newer than one week ago")
+	listRunsCmd.PersistentFlags().StringVarP(&listGithubWorkflowRuns.Event, "event", "e", "", "Filter using a workflow triggered by an event type. E.g. push, pull_request, issue")
+	listRunsCmd.PersistentFlags().BoolVarP(&listGithubWorkflowRuns.IncludePRs, "include-prs", "p", false, "Include workflow runs triggered via pull requests")
+	listRunsCmd.PersistentFlags().StringVarP(&listGithubWorkflowRuns.Owner, "owner", "o", "hashicorp", "The Github organization")
+	listRunsCmd.PersistentFlags().StringVarP(&listGithubWorkflowRuns.Repo, "repo", "r", "vault", "The Github repository. Private repositories require auth via a GITHUB_TOKEN env var")
+	listRunsCmd.PersistentFlags().StringVar(&listGithubWorkflowRuns.Sha, "sha", "", "Filter based on the HEAD SHA associated with the workflow run")
+	listRunsCmd.PersistentFlags().StringVar(&listGithubWorkflowRuns.Status, "status", "", "Filter by a given run status. For example: completed, cancelled, failure, skipped, success, in_progress")
+
+	return listRunsCmd
+}
+
+func runListGithubWorkflowsCmd(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := listGithubWorkflowRuns.Run(context.TODO(), githubCmdState.GithubV3)
+	if err != nil {
+		return fmt.Errorf("listing github workflow runs: %w", err)
+	}
+
+	switch rootCfg.format {
+	case "json":
+		b, err := json.Marshal(res)
+		if err != nil {
+			return fmt.Errorf("marshaling response to JSON: %w", err)
+		}
+		fmt.Println(string(b))
+	default:
+		for _, run := range res.Runs {
+			summary, err := run.Summary()
+			if err != nil {
+				return fmt.Errorf("generating workflow run response summary: %w", err)
+			}
+			fmt.Println(summary)
+		}
+	}
+
+	return err
+}
diff --git a/tools/pipeline/internal/cmd/github_sync.go b/tools/pipeline/internal/cmd/github_sync.go
new file mode 100644
index 00000000000..49a71c895f4
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_sync.go
@@ -0,0 +1,19 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func newGithubSyncCmd() *cobra.Command {
+	syncCmd := &cobra.Command{
+		Use:   "sync",
+		Short: "Github sync commands",
+		Long:  "Github sync commands",
+	}
+	syncCmd.AddCommand(newSyncGithubBranchCmd())
+
+	return syncCmd
+}
diff --git a/tools/pipeline/internal/cmd/github_sync_branch.go b/tools/pipeline/internal/cmd/github_sync_branch.go
new file mode 100644
index 00000000000..30c57410c04
--- /dev/null
+++ b/tools/pipeline/internal/cmd/github_sync_branch.go
@@ -0,0 +1,64 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/github"
+	"github.com/spf13/cobra"
+)
+
+var syncGithubBranchReq = github.SyncBranchReq{}
+
+func newSyncGithubBranchCmd() *cobra.Command {
+	syncBranchCmd := &cobra.Command{
+		Use:   "branch",
+		Short: "Sync a branch between two repositories",
+		Long:  "Sync a branch between two repositories by merging the --from branch into the --to branch and pushing the result on success",
+		RunE:  runSyncGithubBranchCmd,
+	}
+
+	syncBranchCmd.PersistentFlags().StringVar(&syncGithubBranchReq.FromOrigin, "from-origin", "from", "The origin name to use for the from-branch")
+	syncBranchCmd.PersistentFlags().StringVar(&syncGithubBranchReq.FromOwner, "from-owner", "hashicorp", "The Github organization hosting the from branch")
+	syncBranchCmd.PersistentFlags().StringVar(&syncGithubBranchReq.FromRepo, "from-repo", "vault-enterprise", "The Github repository to sync from")
+	syncBranchCmd.PersistentFlags().StringVar(&syncGithubBranchReq.FromBranch, "from-branch", "", "The name of the branch we want to sync from")
+	syncBranchCmd.PersistentFlags().StringVar(&syncGithubBranchReq.ToOrigin, "to-origin", "to", "The origin name to use for the to-branch")
+	syncBranchCmd.PersistentFlags().StringVar(&syncGithubBranchReq.ToOwner, "to-owner", "hashicorp", "The Github organization hosting the to branch")
+	syncBranchCmd.PersistentFlags().StringVar(&syncGithubBranchReq.ToRepo, "to-repo", "vault", "The Github repository to sync to")
+	syncBranchCmd.PersistentFlags().StringVar(&syncGithubBranchReq.ToBranch, "to-branch", "", "The name of the branch we want to sync to")
+	syncBranchCmd.PersistentFlags().StringVarP(&syncGithubBranchReq.RepoDir, "repo-dir", "d", "", "The path to the vault repository dir. If not set a temporary directory will be used")
+
+	err := syncBranchCmd.MarkPersistentFlagRequired("from-branch")
+	if err != nil {
+		panic(err)
+	}
+	err = syncBranchCmd.MarkPersistentFlagRequired("to-branch")
+	if err != nil {
+		panic(err)
+	}
+
+	return syncBranchCmd
+}
+
+func runSyncGithubBranchCmd(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := syncGithubBranchReq.Run(context.TODO(), githubCmdState.GithubV3, githubCmdState.Git)
+
+	switch rootCfg.format {
+	case "json":
+		b, err1 := res.ToJSON()
+		if err1 != nil {
+			return errors.Join(err, err1)
+		}
+		fmt.Println(string(b))
+	default:
+		fmt.Println(res.ToTable(err).Render())
+	}
+
+	return err
+}
diff --git a/tools/pipeline/internal/cmd/go.go b/tools/pipeline/internal/cmd/go.go
new file mode 100644
index 00000000000..8965e7117b6
--- /dev/null
+++ b/tools/pipeline/internal/cmd/go.go
@@ -0,0 +1,18 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import "github.com/spf13/cobra"
+
+func newGoCmd() *cobra.Command {
+	goCmd := &cobra.Command{
+		Use:   "go",
+		Short: "Go commands",
+		Long:  "Go commands",
+	}
+
+	goCmd.AddCommand(newGoDiffCmd())
+
+	return goCmd
+}
diff --git a/tools/pipeline/internal/cmd/go_diff.go b/tools/pipeline/internal/cmd/go_diff.go
new file mode 100644
index 00000000000..f7459027833
--- /dev/null
+++ b/tools/pipeline/internal/cmd/go_diff.go
@@ -0,0 +1,20 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func newGoDiffCmd() *cobra.Command {
+	goModCmd := &cobra.Command{
+		Use:   "diff",
+		Short: "Go diff commands",
+		Long:  "Go diff commands",
+	}
+
+	goModCmd.AddCommand(newGoDiffModCmd())
+
+	return goModCmd
+}
diff --git a/tools/pipeline/internal/cmd/go_diff_mod.go b/tools/pipeline/internal/cmd/go_diff_mod.go
new file mode 100644
index 00000000000..a04babc16f0
--- /dev/null
+++ b/tools/pipeline/internal/cmd/go_diff_mod.go
@@ -0,0 +1,130 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/golang"
+	"github.com/spf13/cobra"
+)
+
+var goModDiffReq = &golang.DiffModReq{
+	A:    &golang.ModSource{},
+	B:    &golang.ModSource{},
+	Opts: golang.DefaultDiffOpts(),
+}
+
+func newGoDiffModCmd() *cobra.Command {
+	goModDiffCmd := &cobra.Command{
+		Use:   "mod </path/a/go.mod> </path/b/go.mod> [ARGS]",
+		Short: "Diff two local go.mod files",
+		Long:  "Diff two local go.mod files",
+		RunE:  runGoModDiffCmd,
+		Args: func(cmd *cobra.Command, args []string) error {
+			switch len(args) {
+			case 2:
+				err := setUpGoModSourceFromPath(args[0], goModDiffReq.A)
+				if err != nil {
+					return err
+				}
+				return setUpGoModSourceFromPath(args[1], goModDiffReq.B)
+			case 0, 1:
+				return errors.New("invalid arguments: you must provide two local file paths")
+			default:
+				return fmt.Errorf("invalid arguments: expected two paths as arguments, received %d arguments", len(args))
+			}
+		},
+	}
+
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.ParseLax, "lax", false, "Parse the modules in lax mode to ignore newer and unknown directives")
+
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.Module, "module", true, "Compare the module directives in both files")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.Go, "go", true, "Compare the go directives in both files")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.Toolchain, "toolchain", true, "Compare the toolchain directives in both files")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.Godebug, "godebug", true, "Compare the godebug directives in both files")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.Require, "require", true, "Compare the require directives in both files")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.Replace, "replace", true, "Compare the replace directives in both files")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.Retract, "retract", true, "Compare the retract directives in both files")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.Tool, "tool", true, "Compare the tool directives in both files")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.Ignore, "ignore", true, "Compare the ignore directives in both files")
+
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.StrictDiffRequire, "strict-require", true, "Strictly compare the requires directives in both files. When true all requires are compared, otherwise only shared requires are compared")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.StrictDiffExclude, "strict-exclude", true, "Strictly compare the excludes directives in both files. When true all excludes are compared, otherwise only shared excludes are compared")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.StrictDiffReplace, "strict-replace", true, "Strictly compare the replace directives in both files. When true all replaces are compared, otherwise only shared replaces are compared")
+	goModDiffCmd.PersistentFlags().BoolVar(&goModDiffReq.Opts.StrictDiffRetract, "strict-retract", true, "Strictly compare the retract directives in both files. When true all retracts are compared, otherwise only shared retract directives are compared")
+
+	return goModDiffCmd
+}
+
+func runGoModDiffCmd(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := goModDiffReq.Run(context.TODO())
+	if err != nil {
+		return err
+	}
+
+	switch rootCfg.format {
+	case "json":
+		b, err1 := res.ToJSON()
+		if err1 != nil {
+			err = errors.Join(err, err1)
+		} else {
+			fmt.Println(string(b))
+		}
+	case "markdown":
+		tbl, err1 := res.ToTable(err)
+		if err1 != nil {
+			err = errors.Join(err, err1)
+		} else {
+			tbl.SetTitle("Go Mod Diff")
+			fmt.Println(tbl.RenderMarkdown())
+		}
+	default:
+		tbl, err1 := res.ToTable(err)
+		if err1 != nil {
+			err = errors.Join(err, err1)
+		} else {
+			if text := tbl.Render(); text != "" {
+				fmt.Println(text)
+			}
+		}
+	}
+
+	if l := len(res.ModDiff); l > 0 {
+		err = errors.Join(fmt.Errorf("%d differences were found", l), err)
+	}
+
+	return err
+}
+
+func setUpGoModSourceFromPath(path string, source *golang.ModSource) (err error) {
+	if source == nil {
+		return errors.New("you must provide a mod source")
+	}
+
+	aPath, err := filepath.Abs(path)
+	if err != nil {
+		return err
+	}
+
+	f, err := os.Open(aPath)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		err = errors.Join(f.Close())
+	}()
+
+	source.Name = path
+	source.Data, err = io.ReadAll(f)
+
+	return err
+}
diff --git a/tools/pipeline/internal/cmd/hcp.go b/tools/pipeline/internal/cmd/hcp.go
new file mode 100644
index 00000000000..0e3c7f9fc3d
--- /dev/null
+++ b/tools/pipeline/internal/cmd/hcp.go
@@ -0,0 +1,40 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/hcp"
+	"github.com/spf13/cobra"
+)
+
+var hcpCmdState = &struct {
+	client *hcp.Client
+}{}
+
+func newHCPCmd() *cobra.Command {
+	env := ""
+	hcpCmd := &cobra.Command{
+		Use:   "hcp",
+		Short: "HCP commands",
+		Long:  "HCP commands",
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
+			hcpCmdState.client = hcp.NewClient(
+				hcp.WithEnvironment(hcp.Environment(env)),
+				hcp.WithLoadAuthFromEnv(),
+			)
+			if _, set := os.LookupEnv("HCP_PASSWORD"); !set {
+				fmt.Println("\x1b[1;33;49mWARNING\x1b[0m: HCP_PASSWORD has not been set. You probably want to set it and HCP_USERNAME in order to authenticate with the image service")
+			}
+		},
+	}
+	hcpCmd.AddCommand(newHCPShowCmd())
+	hcpCmd.AddCommand(newHCPWaitCmd())
+
+	hcpCmd.PersistentFlags().StringVarP(&env, "environment", "e", "prod", "The HCP environment to use. E.g. dev, int, prod")
+
+	return hcpCmd
+}
diff --git a/tools/pipeline/internal/cmd/hcp_show.go b/tools/pipeline/internal/cmd/hcp_show.go
new file mode 100644
index 00000000000..a51c38a019f
--- /dev/null
+++ b/tools/pipeline/internal/cmd/hcp_show.go
@@ -0,0 +1,17 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import "github.com/spf13/cobra"
+
+func newHCPShowCmd() *cobra.Command {
+	showCmd := &cobra.Command{
+		Use:   "show",
+		Short: "HCP show commands",
+		Long:  "HCP show commands",
+	}
+	showCmd.AddCommand(newHCPShowImageCmd())
+
+	return showCmd
+}
diff --git a/tools/pipeline/internal/cmd/hcp_show_image.go b/tools/pipeline/internal/cmd/hcp_show_image.go
new file mode 100644
index 00000000000..24bc04102b9
--- /dev/null
+++ b/tools/pipeline/internal/cmd/hcp_show_image.go
@@ -0,0 +1,76 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/hcp"
+	"github.com/spf13/cobra"
+)
+
+var showHCPImageReq = &hcp.ShowImageReq{
+	Req: &hcp.GetLatestProductVersionReq{},
+}
+
+func newHCPShowImageCmd() *cobra.Command {
+	availability := ""
+
+	showHCPImage := &cobra.Command{
+		Use:   "image",
+		Short: "Show details of an HCP image",
+		Long:  "Show details of an HCP image",
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
+			showHCPImageReq.Req.Availability = hcp.GetLatestProductVersionAvailability(availability)
+		},
+		RunE: runHCPImageShowLatestCmd,
+	}
+
+	showHCPImage.PersistentFlags().StringVarP(&showHCPImageReq.Req.ProductName, "product-name", "p", "vault", "The product or component of the image")
+	showHCPImage.PersistentFlags().StringVarP(&showHCPImageReq.Req.ProductVersionConstraint, "product-version-constraint", "v", "", "A comma seperated list of constraints. If left unset the latest will be returned")
+	showHCPImage.PersistentFlags().StringVarP(&showHCPImageReq.Req.HostManagerVersionConstraint, "host-manager-version-constraint", "m", "", "A semver string. If left unset the latest will be used")
+	showHCPImage.PersistentFlags().StringVarP(&showHCPImageReq.Req.CloudProvider, "cloud", "c", "aws", "The cloud provider you wish to search. E.g. aws, azure")
+	showHCPImage.PersistentFlags().StringVarP(&showHCPImageReq.Req.CloudRegion, "region", "r", "us-west-2", "The cloud region you wish to search")
+	showHCPImage.PersistentFlags().StringVarP(&availability, "availability", "a", "public", "The image availability")
+	showHCPImage.PersistentFlags().BoolVarP(&showHCPImageReq.Req.ExcludeReleaseCandidates, "exclude-release-candidates", "x", false, "Exclude release candidates")
+	showHCPImage.PersistentFlags().BoolVar(&showHCPImageReq.WriteToGithubOutput, "github-output", false, "Whether or not to write 'show-image' to $GITHUB_OUTPUT")
+
+	return showHCPImage
+}
+
+func runHCPImageShowLatestCmd(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := showHCPImageReq.Run(context.TODO(), hcpCmdState.client)
+	if err != nil {
+		return fmt.Errorf("showing HCP image: %w", err)
+	}
+
+	switch rootCfg.format {
+	case "json":
+		b, err := res.Res.ToJSON()
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(b))
+	case "markdown":
+		tbl := res.Res.ToTable()
+		tbl.SetTitle("HCP Image")
+		fmt.Println(tbl.RenderMarkdown())
+	default:
+		fmt.Println(res.Res.ToTable().Render())
+	}
+
+	if showHCPImageReq.WriteToGithubOutput {
+		output, err := res.ToGithubOutput()
+		if err != nil {
+			return err
+		}
+
+		return writeToGithubOutput("show-image", output)
+	}
+
+	return nil
+}
diff --git a/tools/pipeline/internal/cmd/hcp_wait.go b/tools/pipeline/internal/cmd/hcp_wait.go
new file mode 100644
index 00000000000..b863bf7645f
--- /dev/null
+++ b/tools/pipeline/internal/cmd/hcp_wait.go
@@ -0,0 +1,22 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"errors"
+
+	"github.com/spf13/cobra"
+)
+
+func newHCPWaitCmd() *cobra.Command {
+	waitCmd := &cobra.Command{
+		Use:   "wait",
+		Short: "HCP wait commands",
+		Long:  "HCP wait commands",
+		RunE:  func(*cobra.Command, []string) error { return errors.New("unimplemented") },
+	}
+	waitCmd.AddCommand(newHCPWaitForImageCmd())
+
+	return waitCmd
+}
diff --git a/tools/pipeline/internal/cmd/hcp_wait_image.go b/tools/pipeline/internal/cmd/hcp_wait_image.go
new file mode 100644
index 00000000000..b474febaed6
--- /dev/null
+++ b/tools/pipeline/internal/cmd/hcp_wait_image.go
@@ -0,0 +1,99 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/hcp"
+	"github.com/spf13/cobra"
+)
+
+var waitForHCPImageReq = &hcp.WaitForImageReq{
+	Req: &hcp.GetLatestProductVersionReq{},
+}
+
+func newHCPWaitForImageCmd() *cobra.Command {
+	availability := ""
+	var timeout time.Duration
+
+	waitHCPImage := &cobra.Command{
+		Use:   "image",
+		Short: "Wait for an HCP image",
+		Long:  "Wait for an HCP image",
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
+			waitForHCPImageReq.Req.Availability = hcp.GetLatestProductVersionAvailability(availability)
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cmd.SilenceUsage = true // Don't spam the usage on failure
+
+			ctx, cancelCause := context.WithCancelCause(context.Background())
+			ctx, cancel := context.WithTimeoutCause(ctx, timeout, errors.New("timed out waiting for image"))
+			defer cancel()
+
+			c := make(chan os.Signal, 1)
+			signal.Notify(c, os.Interrupt, syscall.SIGTERM)
+			go func() {
+				select {
+				case <-ctx.Done():
+					return
+				case s := <-c:
+					fmt.Printf("\x1b[1;33;49mWARNING\x1b[0m: received %s signal. Stopping now..\n", s)
+					cancelCause(fmt.Errorf("received signal %s", s))
+					cancel()
+				}
+			}()
+
+			res, err := waitForHCPImageReq.Run(ctx, hcpCmdState.client)
+			if err != nil {
+				return fmt.Errorf("waiting for an HCP image: %w", err)
+			}
+
+			switch rootCfg.format {
+			case "json":
+				b, err := res.Res.ToJSON()
+				if err != nil {
+					return err
+				}
+				fmt.Println(string(b))
+			case "markdown":
+				tbl := res.Res.ToTable()
+				tbl.SetTitle("HCP Image")
+				fmt.Println(tbl.RenderMarkdown())
+			default:
+				fmt.Println(res.Res.ToTable().Render())
+			}
+
+			if waitForHCPImageReq.WriteToGithubOutput {
+				output, err := res.ToGithubOutput()
+				if err != nil {
+					return err
+				}
+
+				return writeToGithubOutput("wait-image", output)
+			}
+
+			return nil
+		},
+	}
+
+	waitHCPImage.PersistentFlags().StringVarP(&waitForHCPImageReq.Req.ProductName, "product-name", "p", "vault", "The product or component of the image")
+	waitHCPImage.PersistentFlags().StringVarP(&waitForHCPImageReq.Req.ProductVersionConstraint, "product-version-constraint", "v", "", "A comma seperated list of constraints. If left unset the latest will be returned")
+	waitHCPImage.PersistentFlags().StringVarP(&waitForHCPImageReq.Req.HostManagerVersionConstraint, "host-manager-version-constraint", "m", "", "A semver string. If left unset the latest will be used")
+	waitHCPImage.PersistentFlags().StringVarP(&waitForHCPImageReq.Req.CloudProvider, "cloud", "c", "aws", "The cloud provider you wish to search. E.g. aws, azure")
+	waitHCPImage.PersistentFlags().StringVarP(&waitForHCPImageReq.Req.CloudRegion, "region", "r", "us-west-2", "The cloud region you wish to search")
+	waitHCPImage.PersistentFlags().StringVarP(&availability, "availability", "a", "public", "The image availability")
+	waitHCPImage.PersistentFlags().BoolVarP(&waitForHCPImageReq.Req.ExcludeReleaseCandidates, "exclude-release-candidates", "x", false, "Exclude release candidates")
+	waitHCPImage.PersistentFlags().DurationVarP(&waitForHCPImageReq.Delay, "delay", "d", 10*time.Second, "the time to wait in-between requests")
+	waitHCPImage.PersistentFlags().DurationVarP(&timeout, "timeout", "t", 30*time.Minute, "the maximum duration to wait for the image")
+	waitHCPImage.PersistentFlags().BoolVar(&waitForHCPImageReq.WriteToGithubOutput, "github-output", false, "Whether or not to write 'wait-image' to $GITHUB_OUTPUT")
+
+	return waitHCPImage
+}
diff --git a/tools/pipeline/internal/cmd/releases.go b/tools/pipeline/internal/cmd/releases.go
new file mode 100644
index 00000000000..29cd735f0f1
--- /dev/null
+++ b/tools/pipeline/internal/cmd/releases.go
@@ -0,0 +1,17 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import "github.com/spf13/cobra"
+
+func newReleasesCmd() *cobra.Command {
+	releasesCmd := &cobra.Command{
+		Use:   "releases",
+		Short: "Releases API related tasks",
+		Long:  "Releases API related tasks",
+	}
+	releasesCmd.AddCommand(newReleasesListCmd())
+
+	return releasesCmd
+}
diff --git a/tools/pipeline/internal/cmd/releases_list.go b/tools/pipeline/internal/cmd/releases_list.go
new file mode 100644
index 00000000000..9068e6c1ecf
--- /dev/null
+++ b/tools/pipeline/internal/cmd/releases_list.go
@@ -0,0 +1,19 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import "github.com/spf13/cobra"
+
+func newReleasesListCmd() *cobra.Command {
+	listCmd := &cobra.Command{
+		Use:   "list",
+		Short: "Releases list commands",
+		Long:  "Releases list commands",
+	}
+
+	listCmd.AddCommand(newReleasesVersionsBetweenCmd())
+	listCmd.AddCommand(newReleasesListActiveVersionsCmd())
+
+	return listCmd
+}
diff --git a/tools/pipeline/internal/cmd/releases_list_active_versions.go b/tools/pipeline/internal/cmd/releases_list_active_versions.go
new file mode 100644
index 00000000000..0b8ce464147
--- /dev/null
+++ b/tools/pipeline/internal/cmd/releases_list_active_versions.go
@@ -0,0 +1,65 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/releases"
+	"github.com/spf13/cobra"
+)
+
+var listReleaseActiveVersionsReq = &releases.ListActiveVersionsReq{}
+
+func newReleasesListActiveVersionsCmd() *cobra.Command {
+	activeVersionsCmd := &cobra.Command{
+		Use:   "active-versions [.release/versions.hcl]",
+		Short: "List the active versions from .release/versions.hcl",
+		Long:  "List the active versions from .release/versions.hcl",
+		RunE:  runListActiveVersionsReq,
+		Args:  cobra.MaximumNArgs(1), // path to .release/versions.hcl
+	}
+
+	activeVersionsCmd.PersistentFlags().UintVarP(&listReleaseActiveVersionsReq.Recurse, "recurse", "r", 0, "If no path to a config file is given, recursively search backwards for it and stop at root or until we've his the configured depth.")
+
+	activeVersionsCmd.PersistentFlags().BoolVar(&listReleaseActiveVersionsReq.WriteToGithubOutput, "github-output", false, "Whether or not to write 'active-versions' to $GITHUB_OUTPUT")
+
+	return activeVersionsCmd
+}
+
+func runListActiveVersionsReq(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	if len(args) > 0 {
+		listReleaseActiveVersionsReq.ReleaseVersionConfigPath = args[0]
+	}
+
+	res, err := listReleaseActiveVersionsReq.Run(context.TODO())
+	if err != nil {
+		return err
+	}
+
+	switch rootCfg.format {
+	case "json":
+		b, err := res.ToJSON()
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(b))
+	default:
+		fmt.Println(res.ToTable())
+	}
+
+	if listReleaseActiveVersionsReq.WriteToGithubOutput {
+		output, err := res.ToGithubOutput()
+		if err != nil {
+			return err
+		}
+
+		return writeToGithubOutput("active-versions", output)
+	}
+
+	return err
+}
diff --git a/tools/pipeline/internal/cmd/releases_list_versions.go b/tools/pipeline/internal/cmd/releases_list_versions.go
new file mode 100644
index 00000000000..4d5fdec6329
--- /dev/null
+++ b/tools/pipeline/internal/cmd/releases_list_versions.go
@@ -0,0 +1,60 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/releases"
+	"github.com/spf13/cobra"
+)
+
+var listReleaseVersionsReq = &releases.ListVersionsReq{
+	VersionLister: releases.NewClient(),
+}
+
+func newReleasesVersionsBetweenCmd() *cobra.Command {
+	versionsCmd := &cobra.Command{
+		Use:   "versions",
+		Short: "Create a list of Vault versions between a lower and upper bound",
+		Long:  "Create a list of Vault versions between a lower and upper bound",
+		RunE:  runListVersionsReq,
+	}
+
+	versionsCmd.PersistentFlags().StringVarP(&listReleaseVersionsReq.UpperBound, "upper", "u", "", "The highest version to include")
+	versionsCmd.PersistentFlags().StringVarP(&listReleaseVersionsReq.LowerBound, "lower", "l", "", "The lowest version to include")
+	versionsCmd.PersistentFlags().UintVarP(&listReleaseVersionsReq.NMinus, "nminus", "n", 0, "Instead of setting a dedicated lower bound, calculate N-X from the upper")
+	versionsCmd.PersistentFlags().StringVarP(&listReleaseVersionsReq.LicenseClass, "edition", "e", "", "The edition of Vault. Can either be 'ce' or 'enterprise'")
+	versionsCmd.PersistentFlags().StringSliceVarP(&listReleaseVersionsReq.Skip, "skip", "s", []string{}, "Skip this version. Can be provided none-to-many times")
+
+	err := versionsCmd.MarkPersistentFlagRequired("upper")
+	if err != nil {
+		panic(err)
+	}
+	err = versionsCmd.MarkPersistentFlagRequired("edition")
+	if err != nil {
+		panic(err)
+	}
+
+	return versionsCmd
+}
+
+func runListVersionsReq(cmd *cobra.Command, args []string) error {
+	cmd.SilenceUsage = true // Don't spam the usage on failure
+
+	res, err := listReleaseVersionsReq.Run(context.TODO())
+	if err != nil {
+		return err
+	}
+
+	b, err := json.Marshal(res)
+	if err != nil {
+		return err
+	}
+	fmt.Println(string(b))
+
+	return err
+}
diff --git a/tools/pipeline/internal/cmd/root.go b/tools/pipeline/internal/cmd/root.go
new file mode 100644
index 00000000000..86b5b586e52
--- /dev/null
+++ b/tools/pipeline/internal/cmd/root.go
@@ -0,0 +1,78 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+// Package cmd defines the pipeline CLI commands.
+package cmd
+
+import (
+	"fmt"
+	"log/slog"
+	"os"
+
+	"github.com/spf13/cobra"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+type rootCmdCfg struct {
+	logLevel string
+	format   string
+}
+
+var rootCfg = &rootCmdCfg{}
+
+func newRootCmd() *cobra.Command {
+	rootCmd := &cobra.Command{
+		Use:   "pipeline",
+		Short: "Execute pipeline tasks",
+		Long:  "Pipeline automation tasks",
+	}
+
+	rootCmd.PersistentFlags().StringVar(&rootCfg.logLevel, "log", "warn", "Set the log level. One of 'debug', 'info', 'warn', 'error'")
+	rootCmd.PersistentFlags().StringVarP(&rootCfg.format, "format", "f", "table", "The output format. Can be 'json', 'table', and sometimes 'markdown'")
+
+	rootCmd.AddCommand(newGenerateCmd())
+	rootCmd.AddCommand(newGithubCmd())
+	rootCmd.AddCommand(newGoCmd())
+	rootCmd.AddCommand(newHCPCmd())
+	rootCmd.AddCommand(newReleasesCmd())
+
+	rootCmd.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {
+		var ll slog.Level
+		switch rootCfg.logLevel {
+		case "debug":
+			ll = slog.LevelDebug
+		case "info":
+			ll = slog.LevelInfo
+		case "warn":
+			ll = slog.LevelWarn
+		case "error":
+			ll = slog.LevelError
+		default:
+			return fmt.Errorf("unsupported log level: %s", rootCfg.logLevel)
+		}
+		h := slogctx.NewHandler(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: ll}), nil)
+		slog.SetDefault(slog.New(h))
+
+		switch rootCfg.format {
+		case "json", "table", "markdown":
+		default:
+			return fmt.Errorf("unsupported format: %s", rootCfg.format)
+		}
+
+		return nil
+	}
+
+	return rootCmd
+}
+
+// Execute executes the root pipeline command.
+func Execute() {
+	cobra.EnableTraverseRunHooks = true // Automatically chain run hooks
+	rootCmd := newRootCmd()
+	rootCmd.SilenceErrors = true // We handle this below
+
+	if err := rootCmd.Execute(); err != nil {
+		slog.Default().Error(err.Error())
+		os.Exit(1)
+	}
+}
diff --git a/tools/pipeline/internal/pkg/changed/checkers.go b/tools/pipeline/internal/pkg/changed/checkers.go
new file mode 100644
index 00000000000..29a28c348dd
--- /dev/null
+++ b/tools/pipeline/internal/pkg/changed/checkers.go
@@ -0,0 +1,288 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package changed
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// FileGroupCheck is a function that takes a reference to a changed file and returns groups that
+// the file belongs to
+type FileGroupCheck func(context.Context, *File) FileGroups
+
+// DefaultFileGroupCheckers are the default file group checkers
+var DefaultFileGroupCheckers = []FileGroupCheck{
+	FileGroupCheckerApp,
+	FileGroupCheckerAutopilot,
+	FileGroupCheckerChangelog,
+	FileGroupCheckerCommunity,
+	FileGroupCheckerDocs,
+	FileGroupCheckerEnos,
+	FileGroupCheckerEnterprise,
+	FileGroupCheckerGithub,
+	FileGroupCheckerGoToolchain,
+	FileGroupCheckerPipeline,
+	FileGroupCheckerProto,
+	FileGroupCheckerWebUI,
+}
+
+// Group takes a context, a file, and one-to-many file group checkers and adds group metadata to
+// the file.
+func Group(ctx context.Context, file *File, checkers ...FileGroupCheck) {
+	if file == nil || len(checkers) < 1 {
+		return
+	}
+
+	for _, check := range checkers {
+		file.Groups = file.Groups.Add(check(ctx, file)...)
+	}
+}
+
+// GroupFiles takes a context, a slice of files, and one-to-many file group checkers and adds group
+// metadata to the files.
+func GroupFiles(ctx context.Context, files []*File, checkers ...FileGroupCheck) {
+	for _, file := range files {
+		Group(ctx, file, checkers...)
+	}
+}
+
+// FileGroupCheckerApp is a file group checker that groups based on the file being part of the Vault
+// Go app
+func FileGroupCheckerApp(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+	ext := filepath.Ext(name)
+
+	switch {
+	case hasBaseDir(name, filepath.Join("tools", "pipeline")):
+		return nil
+	case
+		ext == ".go",
+		strings.HasSuffix(name, "go.mod"),
+		strings.HasSuffix(name, "go.sum"):
+		return FileGroups{FileGroupGoApp}
+	default:
+		return nil
+	}
+}
+
+// FileGroupCheckerAutopilot is a file group checker that groups based on the file being part of the
+// raft autopilot system
+func FileGroupCheckerAutopilot(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+	ext := filepath.Ext(name)
+
+	if ext == ".go" && strings.Contains(name, "raft_autopilot") {
+		return FileGroups{FileGroupAutopilot}
+	}
+
+	return nil
+}
+
+// FileGroupCheckerChangelog is a file group checker that groups based on the file being part of the
+// CHANGELOG
+func FileGroupCheckerChangelog(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+	if strings.HasPrefix(name, "CHANGELOG") || hasBaseDir(name, "changelog") {
+		return FileGroups{FileGroupChangelog}
+	}
+
+	return nil
+}
+
+// FileGroupCheckerCommunity is a file group checker that groups based on the file being part of the
+// Vault App but a community only file.
+func FileGroupCheckerCommunity(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+
+	switch filepath.Ext(name) {
+	case ".go":
+		if strings.HasSuffix(name, "_oss.go") || strings.HasSuffix(name, "_ce.go") {
+			return FileGroups{FileGroupCommunity}
+		}
+	case
+		".hcl",
+		".md",
+		".sh",
+		".yaml",
+		".yml":
+		switch {
+		case
+			strings.Contains(name, "-ce"),
+			strings.Contains(name, "_ce"),
+			strings.Contains(name, "-oss"),
+			strings.Contains(name, "_oss"):
+			return FileGroups{FileGroupCommunity}
+		}
+	}
+
+	return nil
+}
+
+// FileGroupCheckerDocs is a file group checker that groups based on the file being part of the
+// documenation.
+func FileGroupCheckerDocs(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+
+	if strings.HasPrefix(name, "README.md") || hasBaseDir(name, "website") {
+		return FileGroups{FileGroupDocs}
+	}
+
+	return nil
+}
+
+// FileGroupCheckerEnos is a file group checker that groups based on the file being part of the
+// enos testing framework.
+func FileGroupCheckerEnos(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+
+	if strings.Contains(name, "enos") || hasBaseDir(name, "enos") {
+		return FileGroups{FileGroupEnos}
+	}
+
+	return nil
+}
+
+// FileGroupCheckerEnterprise is a file group checker that groups based on the file being part of
+// the Vault App but an enterprise only file. Ideally enterprise only files will use common filename
+// schema or directories to reduce our logic here, but some legacy files have been added here.
+// NOTE: Even if we miss a file or two the sky will not fall, only our automation for CE backports
+// could theoretically miss a file and require the author to extract it out themselves before they
+// merge it. Since such files are created in Vault Enterprise there is little risk.
+func FileGroupCheckerEnterprise(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+
+	// Base directory checks
+	switch {
+	case
+		hasBaseDir(name, "vault_ent"),
+		hasBaseDir(name, filepath.Join("scripts", "dev", "hsm")),
+		hasBaseDir(name, filepath.Join("scripts", "testing")),
+		hasBaseDir(name, filepath.Join("specs")),
+		hasBaseDir(name, filepath.Join(".release", "ibm-pao")):
+		return FileGroups{FileGroupEnterprise}
+	}
+
+	// File name checks
+	switch filepath.Base(name) {
+	case
+		"Dockerfile-ent",
+		"Dockerfile-ent-hsm":
+		return FileGroups{FileGroupEnterprise}
+	}
+
+	// File extension checks
+	switch {
+	case
+		// Short circuit for test and release files
+		hasBaseDir(name, filepath.Join(".release")),
+		hasBaseDir(name, filepath.Join("enos", "modules")),
+		hasBaseDir(name, filepath.Join("scripts", "docker")):
+		return nil
+	}
+
+	switch filepath.Ext(name) {
+	case ".go":
+		switch {
+		case
+			strings.HasSuffix(name, "_ent.go"),
+			strings.HasSuffix(name, "_ent_test.go"),
+			strings.Contains(name, "_ent") && strings.HasSuffix(name, ".pb.go"):
+			return FileGroups{FileGroupEnterprise}
+		}
+	case
+		".proto",
+		".hcl",
+		".md",
+		".sh",
+		".yaml",
+		".yml":
+		switch {
+		case strings.Contains(name, "-ce"): // Skip workflows that might have ce and ent in the name
+		case
+			strings.Contains(name, "-ent"),
+			strings.Contains(name, "_ent"),
+			strings.Contains(name, "hsm"),
+			strings.Contains(name, "merkle-tree"):
+			return FileGroups{FileGroupEnterprise}
+		}
+	}
+
+	return nil
+}
+
+// FileGroupCheckerGithub is a file group checker that groups Github files
+func FileGroupCheckerGithub(ctx context.Context, file *File) FileGroups {
+	if hasBaseDir(file.Name(), ".github") {
+		return FileGroups{FileGroupGithub}
+	}
+
+	return nil
+}
+
+// FileGroupCheckerGoToolchain is a file group checker that groups based on the file modifying the
+// Go toolchain or dependencies.
+func FileGroupCheckerGoToolchain(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+	switch {
+	case
+		name == ".go-version",
+		strings.HasSuffix(name, "go.mod"),
+		strings.HasSuffix(name, "go.sum"):
+		return FileGroups{FileGroupGoToolchain}
+	default:
+		return nil
+	}
+}
+
+// FileGroupCheckerPipeline is a file group checker that groups based on the file is part of the
+// build or CI pipeline.
+func FileGroupCheckerPipeline(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+
+	switch {
+	case
+		hasBaseDir(name, ".build"),
+		hasBaseDir(name, filepath.Join(".github", "workflows")),
+		hasBaseDir(name, filepath.Join(".github", "actions")),
+		hasBaseDir(name, filepath.Join(".github", "scripts")),
+		hasBaseDir(name, ".release"),
+		hasBaseDir(name, "scripts"),
+		hasBaseDir(name, filepath.Join("tools", "pipeline")),
+		name == "Dockerfile",
+		name == "Makefile":
+		return FileGroups{FileGroupPipeline}
+	default:
+		return nil
+	}
+}
+
+// FileGroupCheckerProto is a file group checker that groups based on the files extension being .proto
+func FileGroupCheckerProto(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+
+	ext := filepath.Ext(name)
+	if ext == ".proto" || strings.HasPrefix(name, "buf.") {
+		return FileGroups{FileGroupProto}
+	}
+
+	return nil
+}
+
+// FileGroupCheckerWebUI is a file group checker that groups based on the files being part of the
+// web UI
+func FileGroupCheckerWebUI(ctx context.Context, file *File) FileGroups {
+	name := file.Name()
+	if hasBaseDir(name, "ui") {
+		return FileGroups{FileGroupWebUI}
+	}
+
+	return nil
+}
+
+func hasBaseDir(name, dir string) bool {
+	return strings.HasPrefix(name, dir+string(os.PathSeparator))
+}
diff --git a/tools/pipeline/internal/pkg/changed/checkers_test.go b/tools/pipeline/internal/pkg/changed/checkers_test.go
new file mode 100644
index 00000000000..6df338e480c
--- /dev/null
+++ b/tools/pipeline/internal/pkg/changed/checkers_test.go
@@ -0,0 +1,89 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package changed
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-github/v74/github"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFileGroupDefaultCheckers(t *testing.T) {
+	t.Parallel()
+
+	for filename, groups := range map[string]FileGroups{
+		".build/entrypoint.sh":                           {FileGroupPipeline},
+		".github/actions/changed-files/actions.yml":      {FileGroupGithub, FileGroupPipeline},
+		".github/workflows/build.yml":                    {FileGroupGithub, FileGroupPipeline},
+		".github/workflows/build-artifacts-ce.yml":       {FileGroupCommunity, FileGroupGithub, FileGroupPipeline},
+		".github/workflows/build-artifacts-ent.yml":      {FileGroupEnterprise, FileGroupGithub, FileGroupPipeline},
+		".github/workflows/backport-ce-ent.yml":          {FileGroupCommunity, FileGroupGithub, FileGroupPipeline},
+		".github/scripts/pr_comment.sh":                  {FileGroupGithub, FileGroupPipeline},
+		".github/CODEOWNERS":                             {FileGroupGithub},
+		".go-version":                                    {FileGroupGoToolchain},
+		".release/ibm-pao/eboms/5900-BJ8.essentials.csv": {FileGroupEnterprise, FileGroupPipeline},
+		".release/docker/ubi-docker-entrypoint.sh":       {FileGroupPipeline},
+		"audit/backend_ce.go":                            {FileGroupGoApp, FileGroupCommunity},
+		"audit/backend_config_ent.go":                    {FileGroupGoApp, FileGroupEnterprise},
+		"builtin/logical/transit/something_ent.go":       {FileGroupGoApp, FileGroupEnterprise},
+		"buf.yml":                                                                {FileGroupProto},
+		"changelog/1726.txt":                                                     {FileGroupChangelog},
+		"changelog/_1726.txt":                                                    {FileGroupChangelog},
+		"command/server/config.go":                                               {FileGroupGoApp},
+		"command/operator_raft_autopilot_state.go":                               {FileGroupGoApp, FileGroupAutopilot},
+		"command/agent_ent_test.go":                                              {FileGroupGoApp, FileGroupEnterprise},
+		"enos/enos-samples-ce-build.hcl":                                         {FileGroupCommunity, FileGroupEnos},
+		"enos/enos-samples-ent-build.hcl":                                        {FileGroupEnos, FileGroupEnterprise},
+		"enos/enos-scenario-smoke.hcl":                                           {FileGroupEnos},
+		"enos/enos-scenario-autopilot-ent.hcl":                                   {FileGroupEnos, FileGroupEnterprise},
+		"enos/modules/softhsm_create_vault_keys/scripts/create-keys.sh":          {FileGroupEnos},
+		"enos/modules/softhsm_create_vault_keys/scripts/get-keys.sh":             {FileGroupEnos},
+		"enos/modules/softhsm_distribute_vault_keys/main.tf":                     {FileGroupEnos},
+		"enos/modules/softhsm_distribute_vault_keys/scripts/distribute-token.sh": {FileGroupEnos},
+		"enos/modules/softhsm_init/main.tf":                                      {FileGroupEnos},
+		"enos/modules/softhsm_init/scripts/init-softhsm.sh":                      {FileGroupEnos},
+		"enos/modules/softhsm_install/main.tf":                                   {FileGroupEnos},
+		"enos/modules/softhsm_install/scripts/find-shared-object.sh":             {FileGroupEnos},
+		"enos/modules/verify_secrets_engines/scripts/identity-verify-entity.sh":  {FileGroupEnos},
+		"go.mod":                                            {FileGroupGoApp, FileGroupGoToolchain},
+		"go.sum":                                            {FileGroupGoApp, FileGroupGoToolchain},
+		"helper/identity/mfa/types.proto":                   {FileGroupProto},
+		"http/util_stubs_oss.go":                            {FileGroupGoApp, FileGroupCommunity},
+		"physical/raft/raft_autopilot.go":                   {FileGroupGoApp, FileGroupAutopilot},
+		"physical/raft/types.proto":                         {FileGroupProto},
+		"scripts/ci-helper.sh":                              {FileGroupPipeline},
+		"scripts/cross/Dockerfile-ent":                      {FileGroupEnterprise, FileGroupPipeline},
+		"scripts/cross/Dockerfile-ent-hsm":                  {FileGroupEnterprise, FileGroupPipeline},
+		"scripts/dev/hsm/README.md":                         {FileGroupEnterprise, FileGroupPipeline},
+		"scripts/dist-ent.sh":                               {FileGroupEnterprise, FileGroupPipeline},
+		"scripts/docker/docker-entrypoint.sh":               {FileGroupPipeline},
+		"scripts/testing/test-vault-license.sh":             {FileGroupEnterprise, FileGroupPipeline},
+		"scripts/testing/upgrade/README.md":                 {FileGroupEnterprise, FileGroupPipeline},
+		"sdk/database/dbplugin/v5/proto/database_ent.pb.go": {FileGroupGoApp, FileGroupEnterprise},
+		"sdk/database/dbplugin/v5/proto/database_ent.proto": {FileGroupEnterprise, FileGroupProto},
+		"specs/merkle-tree/spec.md":                         {FileGroupEnterprise},
+		"tools/pipeline/main.go":                            {FileGroupPipeline},
+		"ui/lib/ldap/index.js":                              {FileGroupWebUI},
+		"vault/acl.go":                                      {FileGroupGoApp},
+		"vault/activity_log_util_ent.go":                    {FileGroupGoApp, FileGroupEnterprise},
+		"vault/identity_store_ent_test.go":                  {FileGroupGoApp, FileGroupEnterprise},
+		"vault_ent/go.mod":                                  {FileGroupGoApp, FileGroupEnterprise, FileGroupGoToolchain},
+		"vault_ent/go.sum":                                  {FileGroupGoApp, FileGroupEnterprise, FileGroupGoToolchain},
+		"vault_ent/requires_ent.go":                         {FileGroupGoApp, FileGroupEnterprise},
+		"website/content/api-docs/index.mdx":                {FileGroupDocs},
+		"CHANGELOG.md":                                      {FileGroupChangelog},
+		"Dockerfile":                                        {FileGroupPipeline},
+		"Makefile":                                          {FileGroupPipeline},
+		"README.md":                                         {FileGroupDocs},
+	} {
+		t.Run(filename, func(t *testing.T) {
+			t.Parallel()
+			file := &File{File: &github.CommitFile{Filename: &filename}}
+			Group(context.Background(), file, DefaultFileGroupCheckers...)
+			require.Equal(t, groups, file.Groups)
+		})
+	}
+}
diff --git a/tools/pipeline/internal/pkg/changed/file.go b/tools/pipeline/internal/pkg/changed/file.go
new file mode 100644
index 00000000000..c6cb016054b
--- /dev/null
+++ b/tools/pipeline/internal/pkg/changed/file.go
@@ -0,0 +1,146 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+// Package changed is a package for inspecting and categorizing changed files into groups
+package changed
+
+import (
+	"slices"
+	"strings"
+
+	gh "github.com/google/go-github/v74/github"
+)
+
+type (
+	// File is a changed file in a PR or commit
+	File struct {
+		File   *gh.CommitFile `json:"file,omitempty"`
+		Groups FileGroups     `json:"groups,omitempty"`
+	}
+	// Files is a slice of changed files in a PR or commit
+	Files []*File
+	// FileGroup is group name describing a class of file the changed file belongs to
+	FileGroup string
+	// FileGroups is a set of groups a changed file belongs to. Use FileGroups.Add() instead of append()
+	// to ensure uniqueness and ordering
+	FileGroups []FileGroup
+)
+
+const (
+	FileGroupAutopilot   FileGroup = "autopilot"
+	FileGroupChangelog   FileGroup = "changelog"
+	FileGroupCommunity   FileGroup = "community"
+	FileGroupDocs        FileGroup = "docs"
+	FileGroupEnos        FileGroup = "enos"
+	FileGroupEnterprise  FileGroup = "enterprise"
+	FileGroupGithub      FileGroup = "github"
+	FileGroupGoApp       FileGroup = "app"
+	FileGroupGoToolchain FileGroup = "gotoolchain"
+	FileGroupPipeline    FileGroup = "pipeline"
+	FileGroupProto       FileGroup = "proto"
+	FileGroupTools       FileGroup = "tools"
+	FileGroupWebUI       FileGroup = "ui"
+)
+
+// Name is the file name of the changed file
+func (f *File) Name() string {
+	if f == nil || f.File == nil {
+		return ""
+	}
+
+	return f.File.GetFilename()
+}
+
+// Add takes a variadic set of groups and adds them to the ordered set of groups
+func (g FileGroups) Add(groups ...FileGroup) FileGroups {
+	for _, group := range groups {
+		idx, in := g.In(group)
+		if in {
+			continue
+		}
+
+		g = slices.Insert(g, idx, group)
+	}
+
+	return g
+}
+
+// In takes a group and determines the index and presence of the group in the group set
+func (g FileGroups) In(group FileGroup) (int, bool) {
+	return slices.BinarySearch(g, group)
+}
+
+// All takes another FileGroups and determines whether or not all of the groups in the
+// in group are included in FileGroups.
+func (g FileGroups) All(groups FileGroups) bool {
+	for _, group := range groups {
+		if _, in := g.In(group); !in {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Any takes another FileGroups and determines whether or not any of the groups in the
+// in group are included in FileGroups.
+func (g FileGroups) Any(groups FileGroups) bool {
+	for _, group := range groups {
+		if _, in := g.In(group); in {
+			return true
+		}
+	}
+
+	return false
+}
+
+// Groups returns the FileGroups as a slice of strings
+func (g FileGroups) Groups() []string {
+	groups := []string{}
+	for _, g := range g {
+		groups = append(groups, string(g))
+	}
+
+	return groups
+}
+
+// String is a string representation of all groups a file is in
+func (g FileGroups) String() string {
+	return strings.Join(g.Groups(), ", ")
+}
+
+// Names returns a list of file names
+func (f Files) Names() []string {
+	if len(f) < 1 {
+		return nil
+	}
+	files := []string{}
+	for _, file := range f {
+		files = append(files, file.Name())
+	}
+
+	return files
+}
+
+// EachHasAnyGroup determines whether each file contains the any of the given groups
+func (f Files) EachHasAnyGroup(groups FileGroups) bool {
+	if f == nil {
+		return false
+	}
+
+	if len(groups) == 0 {
+		return true
+	}
+
+	for _, file := range f {
+		if file.Groups == nil {
+			return false
+		}
+
+		if !file.Groups.Any(groups) {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/tools/pipeline/internal/pkg/generate/enos_dynamic_config.go b/tools/pipeline/internal/pkg/generate/enos_dynamic_config.go
new file mode 100644
index 00000000000..44ae97cf3c5
--- /dev/null
+++ b/tools/pipeline/internal/pkg/generate/enos_dynamic_config.go
@@ -0,0 +1,209 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package generate
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"slices"
+
+	"github.com/Masterminds/semver"
+	"github.com/hashicorp/hcl/v2/gohcl"
+	"github.com/hashicorp/hcl/v2/hclwrite"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/metadata"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/releases"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// EnosDynamicConfigReq is a request to generate dynamic enos configuration
+type EnosDynamicConfigReq struct {
+	VaultEdition string
+	VaultVersion string
+	EnosDir      string
+	FileName     string
+	Skip         []string
+	NMinus       uint
+	releases.VersionLister
+}
+
+// EnosDynamicConfigRes is a response from a request to generate dynamic enos configuration
+type EnosDynamicConfigRes struct {
+	Globals *Globals `json:"globals,omitempty" hcl:"globals,block" cty:"globals"`
+}
+
+// Globals are our dynamic globals
+type Globals struct {
+	SampleAttributes *SampleAttrs `json:"sample_attributes,omitempty" hcl:"sample_attributes" cty:"sample_attributes"`
+}
+
+// SampleAttrs are the dynamic sample attributes that we'll write as globals
+type SampleAttrs struct {
+	AWSRegion             []string `json:"aws_region,omitempty" hcl:"aws_region" cty:"aws_region"`
+	DistroVersionAmzn     []string `json:"distro_version_amzn,omitempty" hcl:"distro_version_amzn" cty:"distro_version_amzn"`
+	DistroVersionLeap     []string `json:"distro_version_leap,omitempty" hcl:"distro_version_leap" cty:"distro_version_leap"`
+	DistroVersionRhel     []string `json:"distro_version_rhel,omitempty" hcl:"distro_version_rhel" cty:"distro_version_rhel"`
+	DistroVersionSles     []string `json:"distro_version_sles,omitempty" hcl:"distro_version_sles" cty:"distro_version_sles"`
+	DistroVersionUbuntu   []string `json:"distro_version_ubuntu,omitempty" hcl:"distro_version_ubuntu" cty:"distro_version_ubuntu"`
+	UpgradeInitialVersion []string `json:"upgrade_initial_version,omitempty" hcl:"upgrade_initial_version" cty:"upgrade_initial_version"`
+}
+
+// Validate validates the request parameters
+func (e *EnosDynamicConfigReq) Validate(ctx context.Context) error {
+	if e == nil {
+		return errors.New("enos dynamic config req: validate: uninitialized")
+	}
+
+	slog.Default().DebugContext(ctx, "validating enos dynamic config request")
+
+	if e.FileName == "" {
+		return errors.New("no destination file name set")
+	}
+
+	if e.VersionLister == nil {
+		return errors.New("no version lister set")
+	}
+
+	if !slices.Contains(metadata.Editions, e.VaultEdition) {
+		return fmt.Errorf("unknown edition: %s", e.VaultEdition)
+	}
+
+	_, err := semver.NewVersion(e.VaultVersion)
+	if err != nil {
+		return fmt.Errorf("invalid version: %s: %w", e.VaultVersion, err)
+	}
+
+	s, err := os.Stat(e.EnosDir)
+	if err != nil {
+		return fmt.Errorf("invalid enos dir: %s: %w", e.EnosDir, err)
+	}
+
+	if !s.IsDir() {
+		return fmt.Errorf("invalid enos dir: %s is not a directory", e.EnosDir)
+	}
+
+	return nil
+}
+
+// Run runs the dynamic configuration request
+func (e *EnosDynamicConfigReq) Run(ctx context.Context) (*EnosDynamicConfigRes, error) {
+	if e == nil {
+		return nil, fmt.Errorf("enos-dynamic-config-req uninitialized")
+	}
+
+	ctx = slogctx.Append(ctx,
+		slog.String("vault-edition", e.VaultEdition),
+		slog.String("vault-version", e.VaultVersion),
+		slog.String("file-name", e.FileName),
+		slog.String("dir", e.EnosDir),
+		slog.Uint64("n-minnux", uint64(e.NMinus)),
+		"skip", e.Skip,
+	)
+	slog.Default().DebugContext(ctx, "running enos dynamic config request")
+
+	err := e.Validate(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	res := &EnosDynamicConfigRes{}
+	res.Globals, err = e.getGlobals(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return res, e.writeFile(ctx, res)
+}
+
+func (e *EnosDynamicConfigReq) getGlobals(ctx context.Context) (*Globals, error) {
+	var err error
+	res := &Globals{}
+	res.SampleAttributes, err = e.getSampleAttrs(ctx)
+
+	return res, err
+}
+
+func (e *EnosDynamicConfigReq) getSampleAttrs(ctx context.Context) (*SampleAttrs, error) {
+	// Create our HCL body
+	// TODO: Move this to pipeline config
+	attrs := &SampleAttrs{
+		// Use the cheapest regions
+		AWSRegion: []string{"us-east-1", "us-west-2"},
+		// Current distro defaults
+		DistroVersionAmzn:   []string{"2023"},
+		DistroVersionLeap:   []string{"15.6"},
+		DistroVersionRhel:   []string{"8.10", "9.6", "10.0"},
+		DistroVersionSles:   []string{"15.6"},
+		DistroVersionUbuntu: []string{"22.04", "24.04"},
+	}
+
+	// Create our initial upgrade version list. We'll find all released versions between N-3 -> Current
+	// version, minus any explicitly skipped versions that have been set. Since CE and Ent do not share
+	// the same version lineage now we'll also have to figure that in as well.
+	versionReq := &releases.ListVersionsReq{
+		VersionLister: e.VersionLister,
+		LicenseClass:  e.VaultEdition,
+		UpperBound:    e.VaultVersion,
+		NMinus:        e.NMinus,
+		Skip:          e.Skip,
+	}
+
+	versionRes, err := versionReq.Run(ctx)
+	if err != nil {
+		return nil, err
+	}
+	attrs.UpgradeInitialVersion = versionRes.Versions
+
+	return attrs, nil
+}
+
+// writeFile creates the dynamic config file and writes the dynamic data into it
+func (e *EnosDynamicConfigReq) writeFile(ctx context.Context, res *EnosDynamicConfigRes) error {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	default:
+	}
+
+	slog.Default().DebugContext(ctx, "writing enos dynamic config request")
+
+	// Make sure our path is valid
+	path, err := filepath.Abs(filepath.Join(e.EnosDir, e.FileName))
+	if err != nil {
+		return fmt.Errorf("expanding path dynamic config request path: %w", err)
+	}
+
+	f, err := os.OpenFile(path, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o644)
+	if err != nil {
+		return fmt.Errorf("opening dynamic config request destination file: %w", err)
+	}
+	defer f.Close()
+
+	if _, err = f.WriteString(`# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+# Code generated by pipeline generate enos-dynamic-config DO NOT EDIT.
+
+# This file is overwritten in CI as it contains branch specific and sometimes ever-changing values.
+# It's checked in here so that enos samples and scenarios can be performed, just be aware that this
+# might change out from under you.
+`); err != nil {
+		return err
+	}
+
+	hf := hclwrite.NewEmptyFile()
+	gohcl.EncodeIntoBody(res, hf.Body())
+	bytes := hclwrite.Format(hf.Bytes())
+
+	slog.Default().InfoContext(ctx, "writing enos dynamic config request",
+		"path", path,
+		"hcl", string(bytes),
+	)
+	_, err = f.Write(bytes)
+
+	return err
+}
diff --git a/tools/pipeline/internal/pkg/generate/enos_dynamic_config_test.go b/tools/pipeline/internal/pkg/generate/enos_dynamic_config_test.go
new file mode 100644
index 00000000000..5f27641d21f
--- /dev/null
+++ b/tools/pipeline/internal/pkg/generate/enos_dynamic_config_test.go
@@ -0,0 +1,278 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package generate
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/releases"
+	"github.com/stretchr/testify/require"
+)
+
+var testAPIVersions = []string{
+	"1.16.10+ent.hsm.fips1402",
+	"1.16.10+ent.fips1402",
+	"1.16.10+ent.hsm",
+	"1.16.10+ent",
+	"1.17.6+ent.hsm.fips1402",
+	"1.17.6+ent.fips1402",
+	"1.17.6+ent.hsm",
+	"1.17.6+ent",
+	"1.18.0-rc1+ent.hsm.fips1402",
+	"1.18.0-rc1+ent.fips1402",
+	"1.18.0-rc1+ent.hsm",
+	"1.18.0-rc1+ent",
+	"1.17.5+ent.hsm.fips1402",
+	"1.17.5+ent.fips1402",
+	"1.17.5+ent.hsm",
+	"1.17.5+ent",
+	"1.16.9+ent.hsm.fips1402",
+	"1.16.9+ent.fips1402",
+	"1.16.9+ent.hsm",
+	"1.16.9+ent",
+	"1.17.4+ent.hsm.fips1402",
+	"1.17.4+ent.fips1402",
+	"1.17.4+ent.hsm",
+	"1.17.4+ent",
+	"1.16.8+ent.hsm.fips1402",
+	"1.16.8+ent.fips1402",
+	"1.16.8+ent.hsm",
+	"1.16.8+ent",
+	"1.17.3+ent.hsm.fips1402",
+	"1.17.3+ent.fips1402",
+	"1.17.3+ent.hsm",
+	"1.16.7+ent.hsm.fips1402",
+	"1.17.3+ent",
+	"1.16.7+ent.fips1402",
+	"1.16.7+ent.hsm",
+	"1.16.7+ent",
+	"1.17.2+ent.hsm.fips1402",
+	"1.17.2+ent.fips1402",
+	"1.17.2+ent.hsm",
+	"1.17.2+ent",
+	"1.16.6+ent.hsm.fips1402",
+	"1.16.6+ent.fips1402",
+	"1.16.6+ent.hsm",
+	"1.16.6+ent",
+}
+
+var testAllVersions = []string{
+	"1.16.6",
+	"1.16.7",
+	"1.16.8",
+	"1.16.9",
+	"1.16.10",
+	"1.17.2",
+	"1.17.3",
+	"1.17.4",
+	"1.17.5",
+	"1.17.6",
+	"1.18.0-rc1",
+}
+
+func Test_EnosDynamicConfigReq_Validate(t *testing.T) {
+	t.Parallel()
+
+	for name, test := range map[string]struct {
+		in   *EnosDynamicConfigReq
+		fail bool
+	}{
+		"ce edition": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition:  "ce",
+				VaultVersion:  "1.18.0",
+				EnosDir:       t.TempDir(),
+				FileName:      "test.hcl",
+				VersionLister: releases.NewMockClient(testAPIVersions),
+			},
+		},
+		"oss edition": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition:  "oss",
+				VaultVersion:  "1.18.0",
+				EnosDir:       t.TempDir(),
+				FileName:      "test.hcl",
+				VersionLister: releases.NewMockClient(testAPIVersions),
+			},
+		},
+		"ent edition": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition:  "ent",
+				VaultVersion:  "1.18.0",
+				EnosDir:       t.TempDir(),
+				FileName:      "test.hcl",
+				VersionLister: releases.NewMockClient(testAPIVersions),
+			},
+		},
+		"enterprise edition": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition:  "enterprise",
+				VaultVersion:  "1.18.0",
+				EnosDir:       t.TempDir(),
+				FileName:      "test.hcl",
+				VersionLister: releases.NewMockClient(testAPIVersions),
+			},
+		},
+		"ent.hsm edition": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition:  "ent.hsm",
+				VaultVersion:  "1.18.0",
+				EnosDir:       t.TempDir(),
+				FileName:      "test.hcl",
+				VersionLister: releases.NewMockClient(testAPIVersions),
+			},
+		},
+		"ent.fips1402 edition": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition:  "ent.fips1402",
+				VaultVersion:  "1.18.0",
+				EnosDir:       t.TempDir(),
+				FileName:      "test.hcl",
+				VersionLister: releases.NewMockClient(testAPIVersions),
+			},
+		},
+		"ent.hsm.fips1402 edition": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition:  "ent.hsm.fips1402",
+				VaultVersion:  "1.18.0",
+				EnosDir:       t.TempDir(),
+				FileName:      "test.hcl",
+				VersionLister: releases.NewMockClient(testAPIVersions),
+			},
+		},
+		"unknown edition": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition: "ent.nope",
+				VaultVersion: "1.18.0",
+				EnosDir:      t.TempDir(),
+				FileName:     "test.hcl",
+			},
+			fail: true,
+		},
+		"invalid version": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition: "ent.hsm.fips1402",
+				VaultVersion: "vault-1.18.0",
+				EnosDir:      t.TempDir(),
+				FileName:     "test.hcl",
+			},
+			fail: true,
+		},
+		"target dir doesn't exist": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition: "ent.hsm.fips1402",
+				VaultVersion: "1.18.0",
+			},
+			fail: true,
+		},
+		"no file name": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition: "ent.hsm.fips1402",
+				VaultVersion: "1.18.0",
+				EnosDir:      t.TempDir(),
+			},
+			fail: true,
+		},
+		"no version lister": {
+			in: &EnosDynamicConfigReq{
+				VaultEdition: "ent.hsm.fips1402",
+				VaultVersion: "1.18.0",
+				EnosDir:      t.TempDir(),
+				FileName:     "test.hcl",
+			},
+			fail: true,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			err := test.in.Validate(context.Background())
+			if test.fail {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func Test_EnosDynamicConfigReq_Run(t *testing.T) {
+	t.Parallel()
+
+	for desc, test := range map[string]struct {
+		req  *EnosDynamicConfigReq
+		res  func() *EnosDynamicConfigRes
+		hcl  []byte
+		fail bool
+	}{
+		"default config": {
+			req: &EnosDynamicConfigReq{
+				FileName:      "test.hcl",
+				VaultEdition:  "ent.hsm.fips1402",
+				VaultVersion:  "1.18.0",
+				Skip:          []string{"1.17.2", "1.17.5"},
+				NMinus:        2,
+				EnosDir:       t.TempDir(),
+				VersionLister: releases.NewMockClient(testAPIVersions),
+			},
+			res: func() *EnosDynamicConfigRes {
+				versions := testAllVersions
+				versions = slices.DeleteFunc(versions, func(v string) bool {
+					return v == "1.17.2" || v == "1.17.5"
+				})
+				return &EnosDynamicConfigRes{
+					Globals: &Globals{
+						SampleAttributes: &SampleAttrs{
+							AWSRegion:             []string{"us-east-1", "us-west-2"},
+							DistroVersionAmzn:     []string{"2023"},
+							DistroVersionLeap:     []string{"15.6"},
+							DistroVersionRhel:     []string{"8.10", "9.6", "10.0"},
+							DistroVersionSles:     []string{"15.6"},
+							DistroVersionUbuntu:   []string{"22.04", "24.04"},
+							UpgradeInitialVersion: versions,
+						},
+					},
+				}
+			},
+			hcl: []byte(`# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+# Code generated by pipeline generate enos-dynamic-config DO NOT EDIT.
+
+# This file is overwritten in CI as it contains branch specific and sometimes ever-changing values.
+# It's checked in here so that enos samples and scenarios can be performed, just be aware that this
+# might change out from under you.
+
+globals {
+  sample_attributes = {
+    aws_region              = ["us-east-1", "us-west-2"]
+    distro_version_amzn     = ["2023"]
+    distro_version_leap     = ["15.6"]
+    distro_version_rhel     = ["8.10", "9.6", "10.0"]
+    distro_version_sles     = ["15.6"]
+    distro_version_ubuntu   = ["22.04", "24.04"]
+    upgrade_initial_version = ["1.16.6", "1.16.7", "1.16.8", "1.16.9", "1.16.10", "1.17.3", "1.17.4", "1.17.6", "1.18.0-rc1"]
+  }
+}
+`),
+		},
+	} {
+		t.Run(desc, func(t *testing.T) {
+			t.Parallel()
+			res, err := test.req.Run(context.Background())
+			if test.fail {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.EqualValues(t, test.res(), res)
+			b, err := os.ReadFile(filepath.Join(test.req.EnosDir, test.req.FileName))
+			require.NoError(t, err)
+			require.EqualValuesf(t, test.hcl, b, string(b))
+		})
+	}
+}
diff --git a/tools/pipeline/internal/pkg/git/am.go b/tools/pipeline/internal/pkg/git/am.go
new file mode 100644
index 00000000000..005ba4d2056
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/am.go
@@ -0,0 +1,135 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+// AmOpts are the git am flags and arguments
+// See: https://git-scm.com/docs/git-am
+type AmOpts struct {
+	// Options
+	CommitterDateIsAuthorDate bool                  // --committer-date-is-author-date
+	Empty                     EmptyCommit           // --empty=<mode>
+	Keep                      bool                  // --keep
+	KeepNonPatch              bool                  // --keep-non-patch
+	MessageID                 bool                  // --message-id
+	NoMessageID               bool                  // --no-message-id
+	NoReReReAutoupdate        bool                  // --no-rerere-autoupdate
+	NoVerify                  bool                  // --no-verify
+	Quiet                     bool                  // --quiet
+	ReReReAutoupdate          bool                  // --rerere-autoupdate
+	Signoff                   bool                  // --signoff
+	ThreeWayMerge             bool                  // --3way
+	Whitespace                ApplyWhitespaceAction // --whitespace=<action>
+
+	// Targets, depending on which combination of options you're setting
+	Mbox []string // <mbox|Maildir>
+
+	// Sequences
+	Abort    bool // --abort
+	Continue bool // --continue
+	Quit     bool // --quit
+	Resolved bool // --resolved
+	Retry    bool // --retry
+
+	// Options that are allowed on sequences
+	AllowEmpty bool // --allow-empty
+}
+
+// Am runs the git am command
+func (c *Client) Am(ctx context.Context, opts *AmOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "am", opts)
+}
+
+// String returns the options as a string
+func (o *AmOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *AmOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+
+	switch {
+	case o.Abort:
+		return append(opts, "--abort")
+	case o.Continue:
+		return append(opts, "--continue")
+	case o.Quit:
+		return append(opts, "--quit")
+	case o.Resolved:
+		if o.AllowEmpty {
+			opts = append(opts, "--allow-empty")
+		}
+		return append(opts, "--resolved")
+	case o.Retry:
+		return append(opts, "--retry")
+	}
+
+	if o.CommitterDateIsAuthorDate {
+		opts = append(opts, "--committer-date-is-author-date")
+	}
+
+	if o.Empty != "" {
+		opts = append(opts, fmt.Sprintf("--empty=%s", string(o.Empty)))
+	}
+
+	if o.Keep {
+		opts = append(opts, "--keep")
+	}
+
+	if o.KeepNonPatch {
+		opts = append(opts, "--keep-non-patch")
+	}
+
+	if o.MessageID {
+		opts = append(opts, "--message-id")
+	}
+
+	if o.NoMessageID {
+		opts = append(opts, "--no-message-id")
+	}
+
+	if o.NoReReReAutoupdate {
+		opts = append(opts, "--no-rerere-autoupdate")
+	}
+
+	if o.NoVerify {
+		opts = append(opts, "--no-verify")
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.ReReReAutoupdate {
+		opts = append(opts, "--rerere-autoupdate")
+	}
+
+	if o.Signoff {
+		opts = append(opts, "--signoff")
+	}
+
+	if o.ThreeWayMerge {
+		opts = append(opts, "--3way")
+	}
+
+	if o.Whitespace != "" {
+		opts = append(opts, fmt.Sprintf("--whitespace=%s", string(o.Whitespace)))
+	}
+
+	if len(o.Mbox) > 0 {
+		opts = append(opts, o.Mbox...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/apply.go b/tools/pipeline/internal/pkg/git/apply.go
new file mode 100644
index 00000000000..f06f44ddbe5
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/apply.go
@@ -0,0 +1,115 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+// ApplyWhitespaceAction are actions Git can take when encountering whitespace
+// conflicts during apply.
+type ApplyWhitespaceAction = string
+
+const (
+	ApplyWhitespaceActionNoWarn   ApplyWhitespaceAction = "nowarn"
+	ApplyWhitespaceActionWarn     ApplyWhitespaceAction = "warn"
+	ApplyWhitespaceActionFix      ApplyWhitespaceAction = "fix"
+	ApplyWhitespaceActionError    ApplyWhitespaceAction = "error"
+	ApplyWhitespaceActionErrorAll ApplyWhitespaceAction = "error-all"
+)
+
+// ApplyOpts are the git apply flags and arguments
+// See: https://git-scm.com/docs/git-apply
+type ApplyOpts struct {
+	// Options
+	AllowEmpty    bool                  // --allow-empty
+	Cached        bool                  // --cached
+	Check         bool                  // --check
+	Index         bool                  // --index
+	Ours          bool                  // --ours
+	Recount       bool                  // --recount
+	Stat          bool                  // --stat
+	Summary       bool                  // --summary
+	Theirs        bool                  // --theirs
+	ThreeWayMerge bool                  // -3way
+	Union         bool                  // --union
+	Whitespace    ApplyWhitespaceAction // --whitespace=<action>
+
+	// Targets, depending on which combination of options you're setting
+	Patch []string // <patch>
+}
+
+// Apply runs the git apply command
+func (c *Client) Apply(ctx context.Context, opts *ApplyOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "apply", opts)
+}
+
+// String returns the options as a string
+func (o *ApplyOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *ApplyOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+	if o.AllowEmpty {
+		opts = append(opts, "--allow-empty")
+	}
+
+	if o.Cached {
+		opts = append(opts, "--cached")
+	}
+
+	if o.Check {
+		opts = append(opts, "--check")
+	}
+
+	if o.Index {
+		opts = append(opts, "--index")
+	}
+
+	if o.Ours {
+		opts = append(opts, "--ours")
+	}
+
+	if o.Recount {
+		opts = append(opts, "--recount")
+	}
+
+	if o.Stat {
+		opts = append(opts, "--stat")
+	}
+
+	if o.Summary {
+		opts = append(opts, "--summary")
+	}
+
+	if o.Theirs {
+		opts = append(opts, "--theirs")
+	}
+
+	if o.ThreeWayMerge {
+		opts = append(opts, "--3way")
+	}
+
+	if o.Union {
+		opts = append(opts, "--union")
+	}
+
+	if o.Whitespace != "" {
+		opts = append(opts, fmt.Sprintf("--whitespace=%s", string(o.Whitespace)))
+	}
+
+	if len(o.Patch) > 0 {
+		opts = append(opts, o.Patch...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/branch.go b/tools/pipeline/internal/pkg/git/branch.go
new file mode 100644
index 00000000000..9da3c82567e
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/branch.go
@@ -0,0 +1,216 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+// BranchTrack are supported branch tracking options
+type BranchTrack = string
+
+const (
+	BranchTrackDirect  BranchTrack = "direct"
+	BranchTrackInherit BranchTrack = "inherit"
+)
+
+// BranchOpts are the git branch flags and arguments
+// See: https://git-scm.com/docs/git-branch
+type BranchOpts struct {
+	// Options
+	Abbrev        uint        // --abbrev=<n>
+	All           bool        // --all
+	Contains      string      // --contains <commit>
+	Copy          bool        // --copy
+	CreateReflog  bool        // --create-reflog
+	Delete        bool        // --delete
+	Force         bool        // -f
+	Format        string      // --format <format>
+	IgnoreCase    bool        // --ignore-case
+	List          bool        // --list
+	Merged        string      // --merged <commit>
+	Move          bool        // --move
+	NoAbbrev      bool        // --no-abbrev
+	NoColor       bool        // --no-color
+	NoColumn      bool        // --no-column
+	NoContains    string      // --no-contains <commit>
+	NoMerged      string      // --no-merged <commit>
+	NoTrack       bool        // --no-track
+	OmitEmpty     bool        // --omit-empty
+	PointsAt      string      // --points-at <object>
+	Remotes       bool        // --remotes
+	Quiet         bool        // --quiet
+	SetUpstream   bool        // --set-upstream
+	SetUpstreamTo string      // --set-upstream-to=<upstream>
+	ShowCurrent   bool        // --show-current
+	Sort          string      // --sort=<key>
+	Track         BranchTrack // --track
+	UnsetUpstream bool        // --unset-upstream
+
+	// Targets. The branch command has several different modules. Set the correct
+	// targets depending on which combination of options you're setting.
+	BranchName string   // <branchname>
+	StartPoint string   // <start-point>
+	OldBranch  string   // <oldbranch>
+	NewBranch  string   // <newbranch>
+	Pattern    []string // <pattern>
+}
+
+// Branch runs the git branch command
+func (c *Client) Branch(ctx context.Context, opts *BranchOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "branch", opts)
+}
+
+// String returns the options as a string
+func (o *BranchOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *BranchOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+
+	if o.Abbrev > 0 {
+		opts = append(opts, fmt.Sprintf("--abbrev=%d", o.Abbrev))
+	}
+
+	if o.All {
+		opts = append(opts, "--all")
+	}
+
+	if o.Contains != "" {
+		opts = append(opts, fmt.Sprintf("--contains=%s", string(o.Contains)))
+	}
+
+	if o.Copy {
+		opts = append(opts, "--copy")
+	}
+
+	if o.CreateReflog {
+		opts = append(opts, "--create-reflog")
+	}
+
+	if o.Delete {
+		opts = append(opts, "--delete")
+	}
+
+	if o.Force {
+		opts = append(opts, "--force")
+	}
+
+	if o.Format != "" {
+		opts = append(opts, fmt.Sprintf("--format=%s", string(o.Format)))
+	}
+
+	if o.IgnoreCase {
+		opts = append(opts, "--ignore-case")
+	}
+
+	if o.List {
+		opts = append(opts, "--list")
+	}
+
+	if o.Merged != "" {
+		opts = append(opts, fmt.Sprintf("--merged=%s", string(o.Merged)))
+	}
+
+	if o.Move {
+		opts = append(opts, "--move")
+	}
+
+	if o.NoAbbrev {
+		opts = append(opts, "--no-abbrev")
+	}
+
+	if o.NoColor {
+		opts = append(opts, "--no-color")
+	}
+
+	if o.NoColumn {
+		opts = append(opts, "--no-column")
+	}
+
+	if o.NoTrack {
+		opts = append(opts, "--no-track")
+	}
+
+	if o.NoContains != "" {
+		opts = append(opts, fmt.Sprintf("--no-contains=%s", string(o.NoContains)))
+	}
+
+	if o.NoMerged != "" {
+		opts = append(opts, fmt.Sprintf("--no-merged=%s", string(o.NoMerged)))
+	}
+
+	if o.OmitEmpty {
+		opts = append(opts, "--omit-empty")
+	}
+
+	if o.PointsAt != "" {
+		opts = append(opts, fmt.Sprintf("--points-at=%s", string(o.PointsAt)))
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.Remotes {
+		opts = append(opts, "--remotes")
+	}
+
+	if o.SetUpstream {
+		opts = append(opts, "--set-upstream")
+	}
+
+	if o.SetUpstreamTo != "" {
+		opts = append(opts, fmt.Sprintf("--set-upstream-to=%s", string(o.SetUpstreamTo)))
+	}
+
+	if o.ShowCurrent {
+		opts = append(opts, "--show-current")
+	}
+
+	if o.Sort != "" {
+		opts = append(opts, fmt.Sprintf("--sort=%s", string(o.Sort)))
+	}
+
+	if o.Track != "" {
+		opts = append(opts, fmt.Sprintf("--track=%s", string(o.Track)))
+	}
+
+	if o.UnsetUpstream {
+		opts = append(opts, "--unset-upstream")
+	}
+
+	// Not all of these can be used at once but we try to put them in an order
+	// where we won't cause problems if the correct flags and targets are set.
+
+	if o.BranchName != "" {
+		opts = append(opts, o.BranchName)
+	}
+
+	if o.OldBranch != "" {
+		opts = append(opts, o.OldBranch)
+	}
+
+	if o.NewBranch != "" {
+		opts = append(opts, o.NewBranch)
+	}
+
+	if o.StartPoint != "" {
+		opts = append(opts, o.StartPoint)
+	}
+
+	if len(o.Pattern) > 0 {
+		opts = append(opts, o.Pattern...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/checkout.go b/tools/pipeline/internal/pkg/git/checkout.go
new file mode 100644
index 00000000000..879d3b12fa3
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/checkout.go
@@ -0,0 +1,122 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+// CheckoutOpts are the git checkout flags and arguments
+// See: https://git-scm.com/docs/git-checkout
+type CheckoutOpts struct {
+	// Options
+	NewBranch              string      // -b
+	NewBranchForceCheckout string      // -B
+	Detach                 bool        // --detach
+	Force                  bool        // -f
+	Guess                  bool        // --guess
+	Progress               bool        // --progress
+	NoTrack                bool        // --no-track
+	Orphan                 string      // --orphan
+	Ours                   bool        // --ours
+	Quiet                  bool        // --quiet
+	Theirs                 bool        // --theirs
+	Track                  BranchTrack // --track
+
+	// Targets
+	Branch     string // <new-branch>
+	StartPoint string // <start-point>
+	Treeish    string // <tree-ish>
+
+	// Paths
+	PathSpec []string // -- <pathspec>
+}
+
+// Branch runs the git checkout command
+func (c *Client) Checkout(ctx context.Context, opts *CheckoutOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "checkout", opts)
+}
+
+// String returns the options as a string
+func (o *CheckoutOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *CheckoutOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+	if o.NewBranch != "" {
+		opts = append(opts, "-b", o.NewBranch)
+	}
+
+	if o.NewBranchForceCheckout != "" {
+		opts = append(opts, "-B", o.NewBranchForceCheckout)
+	}
+
+	if o.Detach {
+		opts = append(opts, "--detach")
+	}
+
+	if o.Force {
+		opts = append(opts, "--force")
+	}
+
+	if o.Guess {
+		opts = append(opts, "--guess")
+	}
+
+	if o.NoTrack {
+		opts = append(opts, "--no-track")
+	}
+
+	if o.Orphan != "" {
+		opts = append(opts, "--orphan", string(o.Orphan))
+	}
+
+	if o.Ours {
+		opts = append(opts, "--ours")
+	}
+
+	if o.Progress {
+		opts = append(opts, "--progress")
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.Theirs {
+		opts = append(opts, "--theirs")
+	}
+
+	if o.Track != "" {
+		opts = append(opts, fmt.Sprintf("--track=%s", string(o.Track)))
+	}
+
+	// Do the <branch>, <start-point>, and <tree-ish> before pathspec
+	if o.Branch != "" {
+		opts = append(opts, o.Branch)
+	}
+
+	if o.StartPoint != "" {
+		opts = append(opts, o.StartPoint)
+	}
+
+	if o.Treeish != "" {
+		opts = append(opts, o.Treeish)
+	}
+
+	// If there's a pathspec always set it last
+	if len(o.PathSpec) > 0 {
+		opts = append(append(opts, "--"), o.PathSpec...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/cherry-pick.go b/tools/pipeline/internal/pkg/git/cherry-pick.go
new file mode 100644
index 00000000000..9bad0d5c156
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/cherry-pick.go
@@ -0,0 +1,147 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+// EmptyCommit are supported empty commit handling options
+type EmptyCommit = string
+
+const (
+	EmptyCommitDrop EmptyCommit = "drop"
+	EmptyCommitKeep EmptyCommit = "keep"
+	EmptyCommitStop EmptyCommit = "stop"
+)
+
+// CherryPickOpts are the git cherry-pick flags and arguments
+// See: https://git-scm.com/docs/git-cherry-pick
+type CherryPickOpts struct {
+	// Options
+	AllowEmpty         bool                  // --allow-empty
+	AllowEmptyMessage  bool                  // --allow-empty-message
+	Empty              EmptyCommit           // --empty=
+	FF                 bool                  // --ff
+	GPGSign            bool                  // --gpgsign
+	GPGSignKeyID       string                // --gpgsign=<key-id>
+	Mainline           string                // --mainline
+	NoReReReAutoupdate bool                  // --no-rerere-autoupdate
+	Record             bool                  // -x
+	ReReReAutoupdate   bool                  // --rerere-autoupdate
+	Signoff            bool                  // --signoff
+	Strategy           MergeStrategy         // --strategy
+	StrategyOptions    []MergeStrategyOption // --strategy-option=<option>
+
+	// Target
+	Commit string // <commit>
+
+	// Sequences
+	Continue bool // --continue
+	Abort    bool // --abort
+	Quit     bool // --quit
+}
+
+// CherryPick runs the git cherry-pick command
+func (c *Client) CherryPick(ctx context.Context, opts *CherryPickOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "cherry-pick", opts)
+}
+
+// CherryPickAbort aborts an in-progress cherry-pick
+func (c *Client) CherryPickAbort(ctx context.Context) (*ExecResponse, error) {
+	return c.CherryPick(ctx, &CherryPickOpts{Abort: true})
+}
+
+// CherryPickContinue continues an in-progress cherry-pick
+func (c *Client) CherryPickContinue(ctx context.Context) (*ExecResponse, error) {
+	return c.CherryPick(ctx, &CherryPickOpts{Continue: true})
+}
+
+// CherryPickQuit quits an in-progress cherry-pick
+func (c *Client) CherryPickQuit(ctx context.Context) (*ExecResponse, error) {
+	return c.CherryPick(ctx, &CherryPickOpts{Quit: true})
+}
+
+// String returns the options as a string
+func (o *CherryPickOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *CherryPickOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	switch {
+	case o.Abort:
+		return []string{"--abort"}
+	case o.Continue:
+		return []string{"--continue"}
+	case o.Quit:
+		return []string{"--quit"}
+	}
+
+	opts := []string{}
+
+	if o.AllowEmpty {
+		opts = append(opts, "--allow-empty")
+	}
+
+	if o.AllowEmptyMessage {
+		opts = append(opts, "--allow-empty-message")
+	}
+
+	if o.Empty != "" {
+		opts = append(opts, fmt.Sprintf("--empty=%s", string(o.Empty)))
+	}
+
+	if o.FF {
+		opts = append(opts, "--ff")
+	}
+
+	if o.GPGSign {
+		opts = append(opts, "--gpg-sign")
+	}
+
+	if o.GPGSignKeyID != "" {
+		opts = append(opts, fmt.Sprintf("--gpg-sign=%s", o.GPGSignKeyID))
+	}
+
+	if o.Mainline != "" {
+		opts = append(opts, fmt.Sprintf("--mainline=%s", o.Mainline))
+	}
+
+	if o.NoReReReAutoupdate {
+		opts = append(opts, "--no-rerere-autoupdate")
+	}
+
+	if o.Record {
+		opts = append(opts, "-x")
+	}
+
+	if o.ReReReAutoupdate {
+		opts = append(opts, "--rerere-autoupdate")
+	}
+
+	if o.Signoff {
+		opts = append(opts, "--signoff")
+	}
+
+	if o.Strategy != "" {
+		opts = append(opts, fmt.Sprintf("--strategy=%s", string(o.Strategy)))
+	}
+
+	for _, opt := range o.StrategyOptions {
+		opts = append(opts, fmt.Sprintf("--strategy-option=%s", string(opt)))
+	}
+
+	if o.Commit != "" {
+		opts = append(opts, o.Commit)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/client.go b/tools/pipeline/internal/pkg/git/client.go
new file mode 100644
index 00000000000..8b73b216d54
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/client.go
@@ -0,0 +1,177 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"maps"
+	"net/url"
+	"os"
+	"os/exec"
+	"strings"
+	"sync"
+
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// Client is the local git client.
+type Client struct {
+	Token   string
+	envOnce sync.Once
+	envVal  []string
+	config  map[string]string
+}
+
+// OptStringer is an interface that all sub-command configuration options must
+// implement.
+type OptStringer interface {
+	String() string
+	Strings() []string
+}
+
+// ExecResponse is the response from the client running a sub-command with Exec()
+type ExecResponse struct {
+	Cmd    string
+	Env    []string
+	Stdout []byte
+	Stderr []byte
+}
+
+// NewClientOpt is a NewClient() functional option
+type NewClientOpt func(*Client)
+
+// NewClient takes variable options and returns a default Client.
+func NewClient(opts ...NewClientOpt) *Client {
+	client := &Client{
+		config: map[string]string{
+			"core.pager": "",
+			"user.name":  "hc-github-team-secure-vault-core",
+			"user.email": "github-team-secure-vault-core@hashicorp.com",
+		},
+	}
+
+	for _, opt := range opts {
+		opt(client)
+	}
+
+	return client
+}
+
+// WithToken sets the Token in NewClient()
+func WithToken(token string) NewClientOpt {
+	return func(client *Client) {
+		client.Token = token
+	}
+}
+
+// WithToken sets additional gitconfig in NewClient()
+func WithConfig(config map[string]string) NewClientOpt {
+	return func(client *Client) {
+		maps.Copy(client.config, config)
+	}
+}
+
+// WithLoadTokenFromEnv sets the Token from known env vars in NewClient()
+func WithLoadTokenFromEnv() NewClientOpt {
+	return func(client *Client) {
+		if token, ok := os.LookupEnv("GITHUB_TOKEN"); ok {
+			client.Token = token
+			return
+		}
+		if token, ok := os.LookupEnv("GH_TOKEN"); ok {
+			client.Token = token
+			return
+		}
+	}
+}
+
+// Exec executes a git sub-command.
+func (c *Client) Exec(ctx context.Context, subCmd string, opts OptStringer) (*ExecResponse, error) {
+	env := os.Environ()
+	res := &ExecResponse{Env: os.Environ()}
+	if c.Token != "" {
+		res.Env = c.configEnv()
+		env = append(env, res.Env...)
+	}
+
+	cmd := exec.Command("git", append([]string{subCmd}, opts.Strings()...)...)
+	cmd.Env = env
+	res.Cmd = cmd.String()
+	ctx = slogctx.Append(ctx, slog.String("cmd", cmd.String()))
+	slog.Default().DebugContext(ctx, "executing git command")
+	var err error
+	res.Stdout, err = cmd.Output()
+	if err != nil {
+		slog.Default().ErrorContext(slogctx.Append(ctx,
+			slog.String("error", err.Error()),
+		), "executing git command failed")
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) {
+			res.Stderr = exitErr.Stderr
+		}
+	}
+
+	return res, err
+}
+
+// String returns the ExecResponse command and output as a string
+func (e *ExecResponse) String() string {
+	if e == nil {
+		return ""
+	}
+
+	b := strings.Builder{}
+	b.WriteString(e.Cmd)
+	b.WriteString("\n")
+	b.WriteString(string(e.Stdout))
+	b.WriteString("\n")
+	b.WriteString(string(e.Stderr))
+	b.WriteString("\n")
+
+	return b.String()
+}
+
+// configEnv creates a slice of all git configuration as environment variables
+// to avoid:
+//   - modifying local or global gitconfig
+//   - relying on preconfigured gitconfig
+//   - requiring a credstore
+//   - sensitive values like tokens being passed via flags and thus potentially
+//     bleeding into STDOUT
+//
+// As this is relatively expensive it's only done once and cached so subsequent
+// requests can reuse the same configuration.
+func (c *Client) configEnv() []string {
+	c.envOnce.Do(func() {
+		env := c.config
+
+		if c.Token != "" {
+			// NOTE: This basic auth token probably only works with Github right now,
+			// which is fine because our pipeline only supports Github. Other SCM repos
+			// have different rules around the user in the auth portion of the URL.
+			// Github doesn't care what the username is but requires one to be set so
+			// we always set it to user.
+			token := url.UserPassword("user", c.Token).String()
+			env[fmt.Sprintf("url.https://%s@github.com.insteadOf", token)] = "https://github.com"
+		}
+
+		vars := []string{fmt.Sprintf("GIT_CONFIG_COUNT=%d", len(env))}
+		count := 0
+		for k, v := range env {
+			vars = append(
+				vars,
+				fmt.Sprintf("GIT_CONFIG_KEY_%d=%s", count, k),
+				fmt.Sprintf("GIT_CONFIG_VALUE_%d=%s", count, v),
+			)
+			count++
+		}
+
+		c.envVal = vars
+	})
+
+	return c.envVal
+}
diff --git a/tools/pipeline/internal/pkg/git/clone.go b/tools/pipeline/internal/pkg/git/clone.go
new file mode 100644
index 00000000000..6033041fff9
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/clone.go
@@ -0,0 +1,107 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"strconv"
+	"strings"
+)
+
+// CloneOpts are the git clone flags and arguments
+// See: https://git-scm.com/docs/git-clone
+type CloneOpts struct {
+	// Options
+	Branch       string // --branch
+	Depth        uint   // --depth
+	NoCheckout   bool   // --no-checkout
+	NoTags       bool   // --no-tags
+	Origin       string // --origin
+	Progress     bool   // --progress
+	Quiet        bool   // --quiet
+	Revision     string // --revision
+	SingleBranch bool   // --single-branch
+	Sparse       bool   // --sparse
+	Verbose      bool   // --verbose
+
+	// Targets
+	Repository string // <repository>
+	Directory  string // <directory>
+}
+
+// Clone runs the git clone command
+func (c *Client) Clone(ctx context.Context, opts *CloneOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "clone", opts)
+}
+
+// String returns the options as a string
+func (o *CloneOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *CloneOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+	if o.Branch != "" {
+		opts = append(opts, "--branch", o.Branch)
+	}
+
+	if o.Depth > 0 {
+		opts = append(opts, "--depth", strconv.FormatUint(uint64(o.Depth), 10))
+	}
+
+	if o.NoCheckout {
+		opts = append(opts, "--no-checkout")
+	}
+
+	if o.NoTags {
+		opts = append(opts, "--no-tags")
+	}
+
+	if o.Origin != "" {
+		opts = append(opts, "--origin", o.Origin)
+	}
+
+	if o.Progress {
+		opts = append(opts, "--progress")
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.Revision != "" {
+		opts = append(opts, "--revision", o.Revision)
+	}
+
+	if o.SingleBranch {
+		opts = append(opts, "--single-branch")
+	}
+
+	if o.Sparse {
+		opts = append(opts, "--sparse")
+	}
+
+	if o.Verbose {
+		opts = append(opts, "--verbose")
+	}
+
+	if o.Repository != "" || o.Directory != "" {
+		opts = append(opts, "--")
+
+		if o.Repository != "" {
+			opts = append(opts, o.Repository)
+		}
+
+		if o.Directory != "" {
+			opts = append(opts, o.Directory)
+		}
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/commit.go b/tools/pipeline/internal/pkg/git/commit.go
new file mode 100644
index 00000000000..9424d9bc3da
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/commit.go
@@ -0,0 +1,218 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+type (
+	// Cleanup are cleanup modes
+	Cleanup string
+	// FixupLog configures how to fix up a commit
+	FixupLog string
+	// UntrackedFiles are how to show untracked files
+	UntrackedFiles string
+)
+
+const (
+	CommitCleanupModeString     Cleanup        = "strip"
+	CommitCleanupModeWhitespace Cleanup        = "whitespace"
+	CommitCleanupModeVerbatim   Cleanup        = "verbatim"
+	CommitCleanupModeScissors   Cleanup        = "scissors"
+	CommitCleanupModeDefault    Cleanup        = "default"
+	CommitFixupLogNone          FixupLog       = ""
+	CommitFixupLogAmend         FixupLog       = "amend"
+	CommitFixupLogReword        FixupLog       = "reword"
+	UntrackedFilesNo            UntrackedFiles = "no"
+	UntrackedFilesNormal        UntrackedFiles = "normal"
+	UntrackedFilesAll           UntrackedFiles = "all"
+)
+
+// CommitFixup is how to fixup a commit
+type CommitFixup struct {
+	FixupLog
+	Commit string
+}
+
+// CommitOpts are the git commit flags and arguments
+// See: https://git-scm.com/docs/git-commit
+type CommitOpts struct {
+	// Options
+	All               bool         // --all
+	AllowEmpty        bool         // --allow-empty
+	AllowEmptyMessage bool         // --allow-empty-message
+	Amend             bool         // --amend
+	Author            string       // --author=<author>
+	Branch            bool         // --branch
+	Cleanup           Cleanup      // --cleanup=<mode>
+	Date              string       // --date=<date>
+	DryRun            bool         // --dry-run
+	File              string       // --file=<file>
+	Fixup             *CommitFixup // --fixup=
+	GPGSign           bool         // --gpgsign
+	GPGSignKeyID      string       // --gpgsign=<key-id>
+	Long              bool         // --long
+	Patch             bool         // --patch
+	Porcelain         bool         // --porcelain
+	Message           string       // --message=<message>
+	NoEdit            bool         // --no-edit
+	NoPostRewrite     bool         // --no-post-rewrite
+	NoVerify          bool         // --no-verify
+	Null              bool         // --null
+	Only              bool         // --only
+	Quiet             bool         // --quiet
+	ResetAuthor       bool         // --reset-author
+	ReuseMessage      string       // --reuse-message=<commit>
+	Short             bool         // --short
+	Signoff           bool         // --signoff
+	Status            bool         // --status
+	Verbose           bool         // --verbose
+
+	// Target
+	PathSpec []string // <pathspec>
+}
+
+// Commit runs the git commit command
+func (c *Client) Commit(ctx context.Context, opts *CommitOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "commit", opts)
+}
+
+// String returns the options as a string
+func (o *CommitOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *CommitOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+	if o.All {
+		opts = append(opts, "--all")
+	}
+
+	if o.AllowEmpty {
+		opts = append(opts, "--allow-empty")
+	}
+
+	if o.AllowEmptyMessage {
+		opts = append(opts, "--allow-empty-message")
+	}
+
+	if o.Amend {
+		opts = append(opts, "--amend")
+	}
+
+	if o.Author != "" {
+		opts = append(opts, fmt.Sprintf("--author=%s", o.Author))
+	}
+
+	if o.Branch {
+		opts = append(opts, "--branch")
+	}
+
+	if o.Cleanup != "" {
+		opts = append(opts, fmt.Sprintf("--cleanup=%s", string(o.Cleanup)))
+	}
+
+	if o.Date != "" {
+		opts = append(opts, fmt.Sprintf("--date=%s", o.Date))
+	}
+
+	if o.DryRun {
+		opts = append(opts, "--dry-run")
+	}
+
+	if o.File != "" {
+		opts = append(opts, fmt.Sprintf("--file=%s", o.File))
+	}
+
+	if o.Fixup != nil {
+		if o.Fixup.FixupLog == CommitFixupLogNone {
+			opts = append(opts, fmt.Sprintf("--fixup=%s", string(o.Fixup.Commit)))
+		} else {
+			opts = append(opts, fmt.Sprintf("--fixup=%s:%s", string(o.Fixup.FixupLog), string(o.Fixup.Commit)))
+		}
+	}
+
+	if o.GPGSign {
+		opts = append(opts, "--gpg-sign")
+	}
+
+	if o.GPGSignKeyID != "" {
+		opts = append(opts, fmt.Sprintf("--gpg-sign=%s", o.GPGSignKeyID))
+	}
+
+	if o.Long {
+		opts = append(opts, "--long")
+	}
+
+	if o.Patch {
+		opts = append(opts, "--patch")
+	}
+
+	if o.Porcelain {
+		opts = append(opts, "--porcelain")
+	}
+
+	if o.Message != "" {
+		opts = append(opts, fmt.Sprintf("--message=%s", o.Message))
+	}
+
+	if o.NoEdit {
+		opts = append(opts, "--no-edit")
+	}
+
+	if o.NoPostRewrite {
+		opts = append(opts, "--no-post-rewrite")
+	}
+
+	if o.NoVerify {
+		opts = append(opts, "--no-verify")
+	}
+
+	if o.Null {
+		opts = append(opts, "--null")
+	}
+
+	if o.Only {
+		opts = append(opts, "--only")
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.ResetAuthor {
+		opts = append(opts, "--reset-author")
+	}
+
+	if o.ReuseMessage != "" {
+		opts = append(opts, fmt.Sprintf("--reuse-message=%s", o.ReuseMessage))
+	}
+
+	if o.Short {
+		opts = append(opts, "--short")
+	}
+
+	if o.Status {
+		opts = append(opts, "--status")
+	}
+
+	if o.Verbose {
+		opts = append(opts, "--verbose")
+	}
+
+	// If there's a pathspec, append the paths at the very end
+	if len(o.PathSpec) > 0 {
+		opts = append(append(opts, "--"), o.PathSpec...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/fetch.go b/tools/pipeline/internal/pkg/git/fetch.go
new file mode 100644
index 00000000000..ae2ec2c542f
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/fetch.go
@@ -0,0 +1,123 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"strconv"
+	"strings"
+)
+
+// FetchOpts are the git fetch flags and arguments
+// See: https://git-scm.com/docs/git-fetch
+type FetchOpts struct {
+	// Options
+	All         bool // --all
+	Atomic      bool // --atomic
+	Depth       uint // --depth
+	Deepen      uint // --deepen
+	Force       bool // --force
+	NoTags      bool // --no-tags
+	Porcelain   bool // --porcelain
+	Progress    bool // --progress
+	Prune       bool // --prune
+	PruneTags   bool // --prune-tags
+	Quiet       bool // --quiet
+	SetUpstream bool // --set-upstream
+	Unshallow   bool // --unshallow
+	Verbose     bool // --verbose
+
+	// Targets
+	Repository string   // <repository>
+	Refspec    []string // <refspec>
+}
+
+// Fetch runs the git fetch command
+func (c *Client) Fetch(ctx context.Context, opts *FetchOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "fetch", opts)
+}
+
+// String returns the options as a string
+func (o *FetchOpts) String() string {
+	if o == nil {
+		return ""
+	}
+
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *FetchOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+
+	if o.All {
+		opts = append(opts, "--all")
+	}
+
+	if o.Atomic {
+		opts = append(opts, "--atomic")
+	}
+
+	if o.Depth > 0 {
+		opts = append(opts, "--depth", strconv.FormatUint(uint64(o.Depth), 10))
+	}
+
+	if o.Deepen > 0 {
+		opts = append(opts, "--deepen", strconv.FormatUint(uint64(o.Deepen), 10))
+	}
+
+	if o.Force {
+		opts = append(opts, "--force")
+	}
+
+	if o.NoTags {
+		opts = append(opts, "--no-tags")
+	}
+
+	if o.Porcelain {
+		opts = append(opts, "--porcelain")
+	}
+
+	if o.Progress {
+		opts = append(opts, "--progress")
+	}
+
+	if o.Prune {
+		opts = append(opts, "--prune")
+	}
+
+	if o.PruneTags {
+		opts = append(opts, "--prune-tags")
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.SetUpstream {
+		opts = append(opts, "--set-upstream")
+	}
+
+	if o.Unshallow {
+		opts = append(opts, "--unshallow")
+	}
+
+	if o.Verbose {
+		opts = append(opts, "--verbose")
+	}
+
+	if o.Repository != "" {
+		opts = append(opts, o.Repository)
+	}
+
+	if len(o.Refspec) > 0 {
+		opts = append(opts, o.Refspec...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/merge.go b/tools/pipeline/internal/pkg/git/merge.go
new file mode 100644
index 00000000000..2edd3d5655a
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/merge.go
@@ -0,0 +1,225 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+type (
+	// MergeStrategy are the merge strategy to use
+	MergeStrategy = string
+	// MergeStrategy are merge strategy options
+	MergeStrategyOption = string
+)
+
+const (
+	MergeStrategyORT       MergeStrategy = "ort"
+	MergeStrategyRecursive MergeStrategy = "recursive"
+	MergeStrategyResolve   MergeStrategy = "resolve"
+	MergeStrategyOctopus   MergeStrategy = "octopus"
+	MergeStrategyOurs      MergeStrategy = "ours"
+	MergeStrategySubtree   MergeStrategy = "subtree"
+
+	// Ort
+	MergeStrategyOptionOurs              MergeStrategy = "ours"
+	MergeStrategyOptionTheirs            MergeStrategy = "theirs"
+	MergeStrategyOptionIgnoreSpaceChange MergeStrategy = "ignore-space-change"
+	MergeStrategyOptionIgnoreAllSpace    MergeStrategy = "ignore-all-space"
+	MergeStrategyOptionIgnoreSpaceAtEOL  MergeStrategy = "ignore-space-at-eol"
+	MergeStrategyOptionIgnoreCRAtEOL     MergeStrategy = "ignore-cr-at-eol"
+	MergeStrategyOptionRenormalize       MergeStrategy = "renormalize"
+	MergeStrategyOptionNoRenormalize     MergeStrategy = "no-renormalize"
+	MergeStrategyOptionFindRenames       MergeStrategy = "find-renames"
+
+	// Recursive
+	MergeStrategyOptionDiffAlgorithmPatience  MergeStrategy = "diff-algorithm=patience"
+	MergeStrategyOptionDiffAlgorithmMinimal   MergeStrategy = "diff-algorithm=minimal"
+	MergeStrategyOptionDiffAlgorithmHistogram MergeStrategy = "diff-algorithm=histogram"
+	MergeStrategyOptionDiffAlgorithmMyers     MergeStrategy = "diff-algorithm=myers"
+)
+
+// MergeOpts are the git merge flags and arguments
+// See: https://git-scm.com/docs/git-merge
+type MergeOpts struct {
+	// Options
+	Autostash          bool                  // --autostash
+	DoCommit           bool                  // --commit
+	File               string                // --file=<file>
+	FF                 bool                  // --ff
+	FFOnly             bool                  // --ff-onnly
+	IntoName           string                // --into-name
+	Log                uint                  // --log=<n>
+	Message            string                // -m
+	NoAutostash        bool                  // --no-autostash
+	NoDoCommit         bool                  // --no-commit
+	NoFF               bool                  // --no-ff
+	NoLog              bool                  // --no-log
+	NoOverwrite        bool                  // --no-overwrite
+	NoProgress         bool                  // --no-progress
+	NoRebase           bool                  // --no-rebase
+	NoReReReAutoupdate bool                  // --no-rerere-autoupdate
+	NoSquash           bool                  // --no-squash
+	NoStat             bool                  // --no-stat
+	NoVerify           bool                  // --no-verify
+	Progress           bool                  // --progress
+	Quiet              bool                  // --quiet
+	ReReReAutoupdate   bool                  // --rerere-autoupdate
+	Squash             bool                  // --squash
+	Stat               bool                  // --stat
+	Strategy           MergeStrategy         // --stategy=<strategy>
+	StrategyOptions    []MergeStrategyOption // --strategy-option=<option>
+	Verbose            bool                  // --verbose
+
+	// Targets
+	Commit string // <commit>
+
+	// Sequences
+	Continue bool // --continue
+	Abort    bool // --abort
+	Quit     bool // --quit
+}
+
+// Merge runs the git merge command
+func (c *Client) Merge(ctx context.Context, opts *MergeOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "merge", opts)
+}
+
+// MergeAbort aborts an in-progress merge
+func (c *Client) MergeAbort(ctx context.Context) (*ExecResponse, error) {
+	return c.Merge(ctx, &MergeOpts{Abort: true})
+}
+
+// MergeContinue continues an in-progress merge
+func (c *Client) MergeContinue(ctx context.Context) (*ExecResponse, error) {
+	return c.Merge(ctx, &MergeOpts{Continue: true})
+}
+
+// MergeQuit quits an in-progress merge
+func (c *Client) MergeQuit(ctx context.Context) (*ExecResponse, error) {
+	return c.Merge(ctx, &MergeOpts{Quit: true})
+}
+
+// String returns the options as a string
+func (m *MergeOpts) String() string {
+	return strings.Join(m.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (m *MergeOpts) Strings() []string {
+	if m == nil {
+		return nil
+	}
+
+	switch {
+	case m.Abort:
+		return []string{"--abort"}
+	case m.Continue:
+		return []string{"--continue"}
+	case m.Quit:
+		return []string{"--quit"}
+	}
+
+	opts := []string{}
+
+	if m.Autostash {
+		opts = append(opts, "--autostash")
+	}
+
+	if m.DoCommit {
+		opts = append(opts, "--commit")
+	}
+
+	if m.File != "" {
+		opts = append(opts, fmt.Sprintf("--file=%s", m.File))
+	}
+
+	if m.FF {
+		opts = append(opts, "--ff")
+	}
+
+	if m.FFOnly {
+		opts = append(opts, "--ff-only")
+	}
+
+	if m.IntoName != "" {
+		opts = append(opts, "--into-name", m.IntoName)
+	}
+
+	if m.Log > 0 {
+		opts = append(opts, fmt.Sprintf("--log=%d", m.Log))
+	}
+
+	if m.ReReReAutoupdate {
+		opts = append(opts, "--rerere-autoupdate")
+	}
+
+	if m.Squash {
+		opts = append(opts, "--squash")
+	}
+
+	if m.Stat {
+		opts = append(opts, "--stat")
+	}
+
+	if m.Strategy != "" {
+		opts = append(opts, fmt.Sprintf("--strategy=%s", string(m.Strategy)))
+	}
+
+	for _, opt := range m.StrategyOptions {
+		opts = append(opts, fmt.Sprintf("--strategy-option=%s", string(opt)))
+	}
+
+	if m.NoAutostash {
+		opts = append(opts, "--no-autostash")
+	}
+
+	if m.NoDoCommit {
+		opts = append(opts, "--no-commit")
+	}
+
+	if m.NoFF {
+		opts = append(opts, "--no-ff")
+	}
+
+	if m.NoLog {
+		opts = append(opts, "--no-log")
+	}
+
+	if m.NoProgress {
+		opts = append(opts, "--no-progress")
+	}
+
+	if m.NoRebase {
+		opts = append(opts, "--no-rebase")
+	}
+
+	if m.NoReReReAutoupdate {
+		opts = append(opts, "--no-rerere-autoupdate")
+	}
+
+	if m.NoSquash {
+		opts = append(opts, "--no-squash")
+	}
+
+	if m.NoStat {
+		opts = append(opts, "--no-stat")
+	}
+
+	if m.NoStat {
+		opts = append(opts, "--no-stat")
+	}
+
+	if m.NoVerify {
+		opts = append(opts, "--no-verify")
+	}
+
+	if m.Commit != "" {
+		opts = append(opts, m.Commit)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/opts_test.go b/tools/pipeline/internal/pkg/git/opts_test.go
new file mode 100644
index 00000000000..17c32349050
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/opts_test.go
@@ -0,0 +1,827 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// Test our opts structs ability to render the correct flags in the correct order
+// NOTE: Many of thests use incompatible options but that's not what we care about,
+// we're simply asserting that the rendered string matches what ought to be there
+// give the config.
+// We have chosen not to try and very flag combinations. Instead we render it
+// and execute it and rely on git to handle validation of options.
+func TestOptsStringers(t *testing.T) {
+	t.Parallel()
+
+	for name, expect := range map[string]struct {
+		opts     OptStringer
+		expected string
+	}{
+		"am": {
+			&AmOpts{
+				AllowEmpty:                true, // Only supported for --resolved
+				CommitterDateIsAuthorDate: true,
+				Empty:                     EmptyCommitKeep,
+				Keep:                      true,
+				KeepNonPatch:              true,
+				MessageID:                 true,
+				NoMessageID:               true,
+				NoReReReAutoupdate:        true,
+				NoVerify:                  true,
+				Quiet:                     true,
+				ReReReAutoupdate:          true,
+				Signoff:                   true,
+				ThreeWayMerge:             true,
+				Whitespace:                ApplyWhitespaceActionFix,
+				Mbox:                      []string{"/path/to/my.patch"},
+			},
+			"--committer-date-is-author-date --empty=keep --keep --keep-non-patch --message-id --no-message-id --no-rerere-autoupdate --no-verify --quiet --rerere-autoupdate --signoff --3way --whitespace=fix /path/to/my.patch",
+		},
+		"am --continue": {
+			&AmOpts{
+				// Unallowed options are ignored
+				Empty:      EmptyCommitKeep,
+				AllowEmpty: true,
+				// Sequence
+				Continue: true,
+			},
+			"--continue",
+		},
+		"am --abort": {
+			&AmOpts{
+				// Unallowed options are ignored
+				Empty:      EmptyCommitKeep,
+				AllowEmpty: true,
+				// Sequence
+				Abort: true,
+			},
+			"--abort",
+		},
+		"am --quit": {
+			&AmOpts{
+				// Unallowed options are ignored
+				Empty:      EmptyCommitKeep,
+				AllowEmpty: true,
+				// Sequence
+				Quit: true,
+			},
+			"--quit",
+		},
+		"am --allow-empty --resolved": {
+			&AmOpts{
+				// Unallowed options are ignored
+				Empty: EmptyCommitKeep,
+				// Allowed options are kept
+				AllowEmpty: true,
+				// Sequence
+				Resolved: true,
+			},
+			"--allow-empty --resolved",
+		},
+		"am --retry": {
+			&AmOpts{
+				// Unallowed options are ignored
+				Empty:      EmptyCommitKeep,
+				AllowEmpty: true,
+				// Sequence
+				Retry: true,
+			},
+			"--retry",
+		},
+		"apply": {
+			&ApplyOpts{
+				AllowEmpty:    true,
+				Cached:        true,
+				Check:         true,
+				Index:         true,
+				Ours:          true,
+				Recount:       true,
+				Stat:          true,
+				Summary:       true,
+				Theirs:        true,
+				ThreeWayMerge: true,
+				Union:         true,
+				Whitespace:    ApplyWhitespaceActionFix,
+				Patch:         []string{"/path/to/my.diff"},
+			},
+			"--allow-empty --cached --check --index --ours --recount --stat --summary --theirs --3way --union --whitespace=fix /path/to/my.diff",
+		},
+		"branch copy": {
+			&BranchOpts{
+				Copy:      true,
+				Force:     true,
+				OldBranch: "my-old-branch",
+				NewBranch: "my-new-branch",
+			},
+			"--copy --force my-old-branch my-new-branch",
+		},
+		"branch delete": {
+			&BranchOpts{
+				Delete:     true,
+				Remotes:    true,
+				BranchName: "my-branch",
+			},
+			"--delete --remotes my-branch",
+		},
+		"branch move": {
+			&BranchOpts{
+				Move:      true,
+				OldBranch: "my-old-branch",
+				NewBranch: "my-new-branch",
+			},
+			"--move my-old-branch my-new-branch",
+		},
+		"branch upstream set": {
+			&BranchOpts{
+				SetUpstream:   true,
+				SetUpstreamTo: "my-upstream",
+				BranchName:    "my-branch",
+			},
+			"--set-upstream --set-upstream-to=my-upstream my-branch",
+		},
+		"branch upstream unset": {
+			&BranchOpts{
+				UnsetUpstream: true,
+				BranchName:    "my-branch",
+			},
+			"--unset-upstream my-branch",
+		},
+		"branch track": {
+			&BranchOpts{
+				Track:      BranchTrackInherit,
+				NoTrack:    true,
+				Force:      true,
+				BranchName: "my-branch",
+				StartPoint: "HEAD~2",
+			},
+			"--force --no-track --track=inherit my-branch HEAD~2",
+		},
+		"branch with pattern": {
+			// Everything else in branch..
+			&BranchOpts{
+				Abbrev:      7,
+				All:         true,
+				Contains:    "abcd1234",
+				Format:      "%%",
+				List:        true,
+				Merged:      "1234abcd",
+				NoColor:     true,
+				NoColumn:    true,
+				PointsAt:    "12ab34cd",
+				Remotes:     true,
+				ShowCurrent: true,
+				Sort:        "key",
+				Pattern:     []string{"my/dir", "another/dir"},
+			},
+			"--abbrev=7 --all --contains=abcd1234 --format=%% --list --merged=1234abcd --no-color --no-column --points-at=12ab34cd --remotes --show-current --sort=key my/dir another/dir",
+		},
+		"checkout 1/2 opts": {
+			&CheckoutOpts{
+				Branch:                 "source",
+				NewBranchForceCheckout: "new",
+				Force:                  true,
+				NoTrack:                true,
+				Ours:                   true,
+				Quiet:                  true,
+			},
+			"-B new --force --no-track --ours --quiet source",
+		},
+		"checkout 2/2 opts": {
+			&CheckoutOpts{
+				Branch:     "source",
+				NewBranch:  "new",
+				Guess:      true,
+				Orphan:     "bar",
+				Progress:   true,
+				Theirs:     true,
+				Track:      BranchTrackDirect,
+				StartPoint: "HEAD~1",
+			},
+			"-b new --guess --orphan bar --progress --theirs --track=direct source HEAD~1",
+		},
+		"checkout path spec": {
+			&CheckoutOpts{
+				Branch:     "main",
+				StartPoint: "HEAD~1",
+				PathSpec:   []string{"go.mod", "go.sum"},
+			},
+			"main HEAD~1 -- go.mod go.sum",
+		},
+		"cherry-pick 1/2 opts": {
+			&CherryPickOpts{
+				AllowEmpty:        true,
+				AllowEmptyMessage: true,
+				Empty:             EmptyCommitKeep,
+				FF:                true,
+				GPGSign:           true,
+				Mainline:          "ABCDEFGH",
+				Record:            true,
+				Signoff:           true,
+				Commit:            "1234ABCD",
+			},
+			"--allow-empty --allow-empty-message --empty=keep --ff --gpg-sign --mainline=ABCDEFGH -x --signoff 1234ABCD",
+		},
+		"cherry-pick: 2/2 opts": {
+			&CherryPickOpts{
+				GPGSignKeyID:     "4321DCBA",
+				ReReReAutoupdate: true,
+				Strategy:         MergeStrategyResolve,
+				StrategyOptions: []MergeStrategyOption{
+					MergeStrategyOptionDiffAlgorithmHistogram,
+					MergeStrategyOptionIgnoreSpaceChange,
+				},
+				Commit: "1234ABCD",
+			},
+			"--gpg-sign=4321DCBA --rerere-autoupdate --strategy=resolve --strategy-option=diff-algorithm=histogram --strategy-option=ignore-space-change 1234ABCD",
+		},
+		"cherry-pick --continue": {
+			&CherryPickOpts{
+				Continue: true,
+				// Options are ignored
+				Commit:       "1234ABCD",
+				GPGSignKeyID: "4321DCBA",
+			},
+			"--continue",
+		},
+		"cherry-pick --abort": {
+			&CherryPickOpts{
+				Abort: true,
+				// Options are ignored
+				Commit:       "1234ABCD",
+				GPGSignKeyID: "4321DCBA",
+			},
+			"--abort",
+		},
+		"cherry-pick --quit": {
+			&CherryPickOpts{
+				Quit: true,
+				// Options are ignored
+				Commit:       "1234ABCD",
+				GPGSignKeyID: "4321DCBA",
+			},
+			"--quit",
+		},
+		"clone 1/2 opts": {
+			&CloneOpts{
+				Branch:     "my-branch",
+				Depth:      3,
+				NoCheckout: true,
+				NoTags:     true,
+				Origin:     "my-fork",
+				Quiet:      true,
+				Directory:  "some-dir",
+			},
+			"--branch my-branch --depth 3 --no-checkout --no-tags --origin my-fork --quiet -- some-dir",
+		},
+		"clone 2/2 opts": {
+			&CloneOpts{
+				Branch:       "my-branch",
+				Progress:     true,
+				Sparse:       true,
+				SingleBranch: true,
+				Repository:   "my-repo",
+				Directory:    "some-dir",
+			},
+			"--branch my-branch --progress --single-branch --sparse -- my-repo some-dir",
+		},
+		"commit 1/2 opts": {
+			&CommitOpts{
+				All:               true,
+				AllowEmpty:        true,
+				AllowEmptyMessage: true,
+				Amend:             true,
+				Author:            "example@hashicorp.com",
+				Branch:            true,
+				Cleanup:           CommitCleanupModeWhitespace,
+				Date:              "1 day ago",
+				DryRun:            true,
+				File:              "path/to/message/file",
+				Fixup: &CommitFixup{
+					FixupLog: CommitFixupLogReword,
+					Commit:   "1234ABCD",
+				},
+				GPGSign: true,
+				Long:    true,
+				NoEdit:  true,
+				PathSpec: []string{
+					"file/a",
+					"another/b",
+				},
+			},
+			"--all --allow-empty --allow-empty-message --amend --author=example@hashicorp.com --branch --cleanup=whitespace --date=1 day ago --dry-run --file=path/to/message/file --fixup=reword:1234ABCD --gpg-sign --long --no-edit -- file/a another/b",
+		},
+		"commit 2/2 opts": {
+			&CommitOpts{
+				GPGSignKeyID:  "4321DCBA",
+				Patch:         true,
+				Porcelain:     true,
+				Message:       "my commit message",
+				NoPostRewrite: true,
+				NoVerify:      true,
+				Null:          true,
+				Only:          true,
+				ResetAuthor:   true,
+				ReuseMessage:  "1234ABCD",
+				Short:         true,
+				Signoff:       true,
+				Status:        true,
+				Verbose:       true,
+				PathSpec: []string{
+					"file/a",
+					"another/b",
+				},
+			},
+			"--gpg-sign=4321DCBA --patch --porcelain --message=my commit message --no-post-rewrite --no-verify --null --only --reset-author --reuse-message=1234ABCD --short --status --verbose -- file/a another/b",
+		},
+		"fetch": {
+			&FetchOpts{
+				All:         true,
+				Atomic:      true,
+				Depth:       5,
+				Deepen:      6,
+				Force:       true,
+				NoTags:      true,
+				Porcelain:   true,
+				Progress:    true,
+				Prune:       true,
+				Quiet:       true,
+				SetUpstream: true,
+				Unshallow:   true,
+				Verbose:     true,
+				Repository:  "my-repo",
+				Refspec:     []string{"my-branch"},
+			},
+			"--all --atomic --depth 5 --deepen 6 --force --no-tags --porcelain --progress --prune --quiet --set-upstream --unshallow --verbose my-repo my-branch",
+		},
+		"merge 1/2 opts": {
+			&MergeOpts{
+				Autostash:        true,
+				DoCommit:         true,
+				Commit:           "1234ABCD",
+				File:             "/path/to/file",
+				FF:               true,
+				FFOnly:           true,
+				IntoName:         "my-other-branch",
+				Log:              2,
+				Message:          "merging my branch",
+				Progress:         true,
+				ReReReAutoupdate: true,
+				Squash:           true,
+				Stat:             true,
+				Strategy:         MergeStrategyORT,
+				StrategyOptions: []MergeStrategyOption{
+					MergeStrategyOptionDiffAlgorithmMyers,
+					MergeStrategyOptionFindRenames,
+				},
+				Verbose: true,
+			},
+			"--autostash --commit --file=/path/to/file --ff --ff-only --into-name my-other-branch --log=2 --rerere-autoupdate --squash --stat --strategy=ort --strategy-option=diff-algorithm=myers --strategy-option=find-renames 1234ABCD",
+		},
+		"merge 2/2 opts": {
+			&MergeOpts{
+				NoAutostash:        true,
+				NoDoCommit:         true,
+				NoFF:               true,
+				NoLog:              true,
+				NoProgress:         true,
+				NoRebase:           true,
+				NoReReReAutoupdate: true,
+				NoSquash:           true,
+				NoStat:             true,
+				NoVerify:           true,
+			},
+			"--no-autostash --no-commit --no-ff --no-log --no-progress --no-rebase --no-rerere-autoupdate --no-squash --no-stat --no-stat --no-verify",
+		},
+		"merge --continue": {
+			&MergeOpts{
+				Continue: true,
+				// Options are ignored
+				Commit:  "1234ABCD",
+				Message: "merging my branch",
+			},
+			"--continue",
+		},
+		"merge --abort": {
+			&MergeOpts{
+				Abort: true,
+				// Options are ignored
+				Commit:  "1234ABCD",
+				Message: "merging my branch",
+			},
+			"--abort",
+		},
+		"merge --quit": {
+			&MergeOpts{
+				Quit: true,
+				// Options are ignored
+				Commit:  "1234ABCD",
+				Message: "merging my branch",
+			},
+			"--quit",
+		},
+		"pull 1/3 opts": {
+			&PullOpts{
+				Atomic:        true,
+				Autostash:     true,
+				Depth:         4,
+				DoCommit:      true,
+				FF:            true,
+				GPGSign:       true,
+				NoLog:         true,
+				NoStat:        true,
+				Quiet:         true,
+				Prune:         true,
+				SetUpstream:   true,
+				Squash:        true,
+				Rebase:        RebaseStrategyTrue,
+				Refspec:       []string{"my-branch"},
+				Repository:    "my-repo",
+				UpdateShallow: true,
+			}, "--atomic --autostash --commit --depth 4 --ff --gpg-sign --squash --no-log --no-stat --no-stat --prune --quiet --rebase=true --set-upstream my-repo my-branch",
+		},
+		"pull 2/3 opts": {
+			&PullOpts{
+				AllowUnrelatedHistories: true,
+				Append:                  true,
+				Deepen:                  3,
+				FFOnly:                  true,
+				GPGSignKeyID:            "4321DCBA",
+				Log:                     5,
+				NoRebase:                true,
+				NoRecurseSubmodules:     true,
+				Porcelain:               true,
+				Progress:                true,
+				PruneTags:               true,
+				Refspec:                 []string{"my-branch"},
+				Repository:              "my-repo",
+				Stat:                    true,
+				Strategy:                MergeStrategyOctopus,
+				StrategyOptions: []MergeStrategyOption{
+					MergeStrategyOptionDiffAlgorithmMinimal,
+					MergeStrategyOptionIgnoreCRAtEOL,
+				},
+				Verbose: true,
+				Verify:  true,
+			}, "--deepen 3 --ff-only --gpg-sign=4321DCBA --log=5 --stat -X diff-algorithm=minimal -X ignore-cr-at-eol --no-rebase --no-recurse-submodules --porcelain --progress --prune-tags --verbose my-repo my-branch",
+		},
+		"pull 3/3 opts": {
+			&PullOpts{
+				All:               true,
+				Cleanup:           CommitCleanupModeDefault,
+				Force:             true,
+				NoAutostash:       true,
+				NoDoCommit:        true,
+				NoFF:              true,
+				NoSquash:          true,
+				NoTags:            true,
+				NoVerify:          true,
+				RecurseSubmodules: RecurseSubmodulesOnDemand,
+				Refspec:           []string{"my-branch"},
+				Repository:        "my-repo",
+				Stat:              true,
+				Unshallow:         true,
+			}, "--all --force --stat --no-autostash --no-commit --no-ff --no-squash --no-tags --no-verify --unshallow my-repo my-branch",
+		},
+		"push 1/2 opts": {
+			&PushOpts{
+				All:                 true,
+				Branches:            true,
+				DryRun:              true,
+				FollowTags:          true,
+				ForceIfIncludes:     true,
+				Mirror:              true,
+				NoForceWithLease:    true,
+				NoRecurseSubmodules: true,
+				NoThin:              true,
+				Porcelain:           true,
+				Prune:               true,
+				Quiet:               true,
+				Refspec:             []string{"my-branch"},
+				Repository:          "my-repo",
+				SetUpstream:         true,
+				Tags:                true,
+				Verify:              true,
+			}, "--all --branches --dry-run --follow-tags --force-if-includes --mirror --no-force-with-lease --no-recurse-submodules --no-thin --porcelain --prune --quiet --set-upstream --tags --verify my-repo my-branch",
+		},
+		"push 2/2 opts": {
+			&PushOpts{
+				Atomic:            true,
+				Delete:            true,
+				Exec:              "/path/to/git-receive-pack",
+				Force:             true,
+				ForceWithLease:    "another-branch",
+				NoAtomic:          true,
+				NoForceIfIncludes: true,
+				NoSigned:          true,
+				NoVerify:          true,
+				Progress:          true,
+				PushOption:        "a",
+				RecurseSubmodules: PushRecurseSubmodulesCheck,
+				Refspec:           []string{"my-branch"},
+				Repository:        "my-repo",
+				Signed:            PushSignedTrue,
+				Verbose:           true,
+			}, "--atomic --delete --exec=/path/to/git-receive-pack --force --force-with-lease=another-branch --no-atomic --no-force-if-includes --no-signed --no-verify --progress --push-option=a --recurse-submodules=check --signed=true --verbose my-repo my-branch",
+		},
+		"rebase 1/3 opts": {
+			&RebaseOpts{
+				AllowEmptyMessage:    true,
+				Autosquash:           true,
+				Branch:               "my-branch",
+				Empty:                EmptyCommitDrop,
+				ForkPoint:            true,
+				IgnoreDate:           true,
+				Merge:                true,
+				NoAutostash:          true,
+				NoRebaseMerges:       true,
+				NoReReReAutoupdate:   true,
+				NoVerify:             true,
+				RescheduleFailedExec: true,
+				Root:                 true,
+				UpdateRefs:           true,
+			}, "--allow-empty-message --autosquash --empty=drop --fork-point --ignore-date --merge --no-autostash --no-rebase-merges --no-rerere-autoupdate --no-verify --reschedule-failed-exec --root --update-refs my-branch",
+		},
+		"rebase 2/3 opts": {
+			&RebaseOpts{
+				Apply:                     true,
+				Branch:                    "my-branch",
+				CommitterDateIsAuthorDate: true,
+				Exec:                      "/path/to/git-receive-pack",
+				GPGSign:                   true,
+				IgnoreWhitespace:          true,
+				KeepEmpty:                 true,
+				NoReapplyCherryPicks:      true,
+				NoStat:                    true,
+				Onto:                      "new-base",
+				Quiet:                     true,
+				ResetAuthorDate:           true,
+				Stat:                      true,
+				Whitespace:                WhitespaceActionFix,
+			}, "--apply --committer-date-is-author-date --exec=/path/to/git-receive-pack --gpg-sign --ignore-whitespace --keep-empty --no-reapply-cherry-picks --no-stat --onto=new-base --quiet --reset-author-date --stat --whitespace=fix my-branch",
+		},
+		"rebase 3/3 opts": {
+			&RebaseOpts{
+				Autostash:              true,
+				Branch:                 "my-branch",
+				Context:                3,
+				ForceRebase:            true,
+				GPGSignKeyID:           "4321DCBA",
+				KeepBase:               "another-upstream",
+				NoAutosquash:           true,
+				NoKeepEmpty:            true,
+				NoRescheduleFailedExec: true,
+				NoUpdateRefs:           true,
+				ReapplyCherryPicks:     true,
+				RebaseMerges:           RebaseMergesCousins,
+				ReReReAutoupdate:       true,
+				Strategy:               MergeStrategySubtree,
+				StrategyOptions: []MergeStrategyOption{
+					MergeStrategyOptionDiffAlgorithmPatience,
+					MergeStrategyOptionNoRenormalize,
+				},
+				Verbose: true,
+			}, "--autostash -C 3 --force-rebase --gpg-sign=4321DCBA --keep-base=another-upstream --no-autosquash --no-keep-empty --no-reschedule-failed-exec --no-update-refs --reapply-cherry-picks --rebase-merges=rebase-cousins --rerere-autoupdate --strategy=subtree --strategy-option=diff-algorithm=patience --strategy-option=no-renormalize --verbose my-branch",
+		},
+		"rebase --continue": {
+			&RebaseOpts{
+				Continue: true,
+				// Options are ignored
+				Branch:       "my-branch",
+				GPGSignKeyID: "4321DCBA",
+			},
+			"--continue",
+		},
+		"rebase --abort": {
+			&RebaseOpts{
+				Abort: true,
+				// Options are ignored
+				Branch:       "my-branch",
+				GPGSignKeyID: "4321DCBA",
+			},
+			"--abort",
+		},
+		"rebase --quit": {
+			&RebaseOpts{
+				Quit: true,
+				// Options are ignored
+				Branch:       "my-branch",
+				GPGSignKeyID: "4321DCBA",
+			},
+			"--quit",
+		},
+		"rebase --skip": {
+			&RebaseOpts{
+				Skip: true,
+				// Options are ignored
+				Branch:       "my-branch",
+				GPGSignKeyID: "4321DCBA",
+			},
+			"--skip",
+		},
+		"rebase --show-current-patch": {
+			&RebaseOpts{
+				ShowCurrentPatch: true,
+				// Options are ignored
+				Branch:       "my-branch",
+				GPGSignKeyID: "4321DCBA",
+			},
+			"--show-current-patch",
+		},
+		"remote": {
+			&RemoteOpts{
+				Verbose: true,
+			},
+			"-v",
+		},
+		"remote add": {
+			&RemoteOpts{
+				Command: RemoteCommandAdd,
+				Track:   []string{"branch-a", "branch-b"},
+				Master:  "main",
+				Fetch:   true,
+				Tags:    true,
+				NoTags:  true,
+				Name:    "origin",
+				URL:     "git@github.com:hashicorp/vault.git",
+			},
+			"add -f --tags --no-tags -m main -t branch-a -t branch-b origin git@github.com:hashicorp/vault.git",
+		},
+		"remote rename": {
+			&RemoteOpts{
+				Command:    RemoteCommandRename,
+				Progress:   true,
+				NoProgress: true,
+				Old:        "old-remote",
+				New:        "new-remote",
+			},
+			"rename --progress --no-progress old-remote new-remote",
+		},
+		"remote remove": {
+			&RemoteOpts{
+				Command: RemoteCommandRemove,
+				Name:    "remote",
+			},
+			"remove remote",
+		},
+		"remote set-head": {
+			&RemoteOpts{
+				Command: RemoteCommandSetHead,
+				Name:    "my-remote",
+				Auto:    true,
+				Delete:  true,
+				Branch:  "my-branch",
+			},
+			"set-head my-remote --auto --delete my-branch",
+		},
+		"remote set-branches": {
+			&RemoteOpts{
+				Command:  RemoteCommandSetBranches,
+				Add:      true,
+				Name:     "my-remote",
+				Branch:   "branch-a",
+				Branches: []string{"branch-b", "branch-c"},
+			},
+			"set-branches --add my-remote branch-a branch-b branch-c",
+		},
+		"remote get-url": {
+			&RemoteOpts{
+				Command: RemoteCommandGetURL,
+				Push:    true,
+				All:     true,
+				Name:    "my-remote",
+			},
+			"get-url --push --all my-remote",
+		},
+		"remote set-url oldurl": {
+			&RemoteOpts{
+				Command: RemoteCommandSetURL,
+				Push:    true,
+				Name:    "my-remote",
+				NewURL:  "git@github.com:hashicorp/vault-enterprise.git",
+				OldURL:  "git@github.com:hashicorp/vault.git",
+			},
+			"set-url --push my-remote git@github.com:hashicorp/vault-enterprise.git git@github.com:hashicorp/vault.git",
+		},
+		"remote set-url add": {
+			&RemoteOpts{
+				Command: RemoteCommandSetURL,
+				Add:     true,
+				Push:    true,
+				Name:    "my-remote",
+				NewURL:  "git@github.com:hashicorp/vault-enterprise.git",
+			},
+			"set-url --add --push my-remote git@github.com:hashicorp/vault-enterprise.git",
+		},
+		"remote set-url delete": {
+			&RemoteOpts{
+				Command: RemoteCommandSetURL,
+				Delete:  true,
+				Push:    true,
+				Name:    "my-remote",
+				URL:     "git@github.com:hashicorp/vault-enterprise.git",
+			},
+			"set-url --delete --push my-remote git@github.com:hashicorp/vault-enterprise.git",
+		},
+		"remote show": {
+			&RemoteOpts{
+				Command: RemoteCommandShow,
+				Verbose: true,
+				NoQuery: true,
+				Name:    "my-remote",
+			},
+			"-v show -n my-remote",
+		},
+		"remote prune": {
+			&RemoteOpts{
+				Command: RemoteCommandPrune,
+				NoQuery: true,
+				DryRun:  true,
+				Name:    "branch-a",
+				Names:   []string{"branch-b", "branch-c"},
+			},
+			"prune -n --dry-run branch-a branch-b branch-c",
+		},
+		"remote update": {
+			&RemoteOpts{
+				Command: RemoteCommandUpdate,
+				Verbose: true,
+				Prune:   true,
+			},
+			"-v update --prune",
+		},
+		"reset": {
+			&ResetOpts{
+				Mode:      ResetModeHard,
+				NoRefresh: true,
+				Patch:     true,
+				Quiet:     true,
+				Refresh:   true,
+				Commit:    "abcd1234",
+				Treeish:   "HEAD~2",
+				PathSpec:  []string{"vault/something_ent.go", "vault/cli/another_ent.go"},
+			},
+			"--hard --no-refresh --quiet --refresh --patch abcd1234 HEAD~2 -- vault/something_ent.go vault/cli/another_ent.go",
+		},
+		"rm": {
+			&RmOpts{
+				Cached:          true,
+				DryRun:          true,
+				Force:           true,
+				IgnoreUnmatched: true,
+				Quiet:           true,
+				Recursive:       true,
+				Sparse:          true,
+				PathSpec:        []string{"vault/something_ent.go", "vault/cli/another_ent.go"},
+			},
+			"--cached --dry-run --force --ignore-unmatched --quiet -r --sparse -- vault/something_ent.go vault/cli/another_ent.go",
+		},
+		"show": {
+			&ShowOpts{
+				DiffAlgorithm: DiffAlgorithmHistogram,
+				DiffMerges:    DiffMergeFormatDenseCombined,
+				Format:        "medium",
+				NoColor:       true,
+				NoPatch:       true,
+				Output:        "/path/to/my.diff",
+				Patch:         true,
+				Quiet:         true,
+				Raw:           true,
+				Object:        "HEAD",
+				PathSpec:      []string{"go.mod", "go.sum"},
+			},
+			"--diff-algorithm=histogram --diff-merges=dense-combined --format=medium --no-color --no-patch --output=/path/to/my.diff --patch --quiet --raw HEAD -- go.mod go.sum",
+		},
+		"status": {
+			&StatusOpts{
+				AheadBehind:      true,
+				Branch:           true,
+				Column:           "always",
+				FindRenames:      12,
+				Ignored:          IgnoredModeMatching,
+				IgnoreSubmodules: IgnoreSubmodulesWhenDirty,
+				Long:             true,
+				NoAheadBehind:    true,
+				NoColumn:         true,
+				NoRenames:        true,
+				Porcelain:        true,
+				Renames:          true,
+				Short:            true,
+				ShowStash:        true,
+				UntrackedFiles:   UntrackedFilesAll,
+				Verbose:          true,
+				PathSpec:         []string{"go.mod", "go.sum"},
+			},
+			"--ahead-behind --branch --column=always --find-renames=12 --ignored=matching --ignore-submodules=dirty --long --no-ahead-behind --no-column --no-renames --porcelain --renames --short --show-stash --untracked-files=all --verbose -- go.mod go.sum",
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, expect.expected, expect.opts.String())
+		})
+	}
+}
diff --git a/tools/pipeline/internal/pkg/git/pull.go b/tools/pipeline/internal/pkg/git/pull.go
new file mode 100644
index 00000000000..49ec20db8d5
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/pull.go
@@ -0,0 +1,244 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// RecurseSubmodules is a sub-module recurse mode
+type RecurseSubmodules = string
+
+const (
+	RecurseSubmodulesYes      RecurseSubmodules = "yes"
+	RecurseSubmodulesOnDemand RecurseSubmodules = "on-demand"
+	RecurseSubmodulesNo       RecurseSubmodules = "no"
+)
+
+// PullOpts are the git pull flags and arguments
+// See: https://git-scm.com/docs/git-pull
+type PullOpts struct {
+	// Options
+	Quiet               bool              // --quiet
+	Verbose             bool              // --verbose
+	RecurseSubmodules   RecurseSubmodules // --recurse-submodules=
+	NoRecurseSubmodules bool              // --no-recurse-submodules
+
+	// Merge options
+	Autostash               bool                  // --autostash
+	AllowUnrelatedHistories bool                  // --allow-unrelated-histories
+	DoCommit                bool                  // --commit
+	NoDoCommit              bool                  // --no-commit
+	Cleanup                 Cleanup               // --cleanup=
+	FF                      bool                  // --ff
+	FFOnly                  bool                  // --ff-onnly
+	NoFF                    bool                  // --no-ff
+	GPGSign                 bool                  // --gpgsign
+	GPGSignKeyID            string                // --gpgsign=<key-id>
+	Log                     uint                  // --log=
+	NoAutostash             bool                  // --no-autostash
+	NoLog                   bool                  // --no-log
+	NoRebase                bool                  // --no-rebase
+	NoStat                  bool                  // --no-stat
+	NoSquash                bool                  // --no-squash
+	NoVerify                bool                  // --no-verify
+	Stat                    bool                  // --stat
+	Squash                  bool                  // --squash
+	Strategy                MergeStrategy         // --stategy=
+	StrategyOptions         []MergeStrategyOption // --strategy-option=
+	Rebase                  RebaseStrategy        // --rebase=
+	Verify                  bool                  // --verify
+
+	// Fetch options
+	All           bool // --all
+	Append        bool // --append
+	Atomic        bool // --atomic
+	Depth         uint // --depth
+	Deepen        uint // --deepen
+	Force         bool // --force
+	NoTags        bool // --no-tags
+	Porcelain     bool // --porcelain
+	Progress      bool // --progress
+	Prune         bool // --prune
+	PruneTags     bool // --prune-tags
+	SetUpstream   bool // --set-upstream
+	Unshallow     bool // --unshallow
+	UpdateShallow bool // --update-shallow
+
+	// Targets
+	Repository string   // <repository>
+	Refspec    []string // <refspec>
+}
+
+// Pull runs the git pull command
+func (c *Client) Pull(ctx context.Context, opts *PullOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "pull", opts)
+}
+
+// String returns the options as a string
+func (o *PullOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *PullOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+
+	if o.All {
+		opts = append(opts, "--all")
+	}
+
+	if o.Atomic {
+		opts = append(opts, "--atomic")
+	}
+
+	if o.Autostash {
+		opts = append(opts, "--autostash")
+	}
+
+	if o.DoCommit {
+		opts = append(opts, "--commit")
+	}
+
+	if o.Depth > 0 {
+		opts = append(opts, "--depth", strconv.FormatUint(uint64(o.Depth), 10))
+	}
+
+	if o.Deepen > 0 {
+		opts = append(opts, "--deepen", strconv.FormatUint(uint64(o.Deepen), 10))
+	}
+
+	if o.FF {
+		opts = append(opts, "--ff")
+	}
+
+	if o.FFOnly {
+		opts = append(opts, "--ff-only")
+	}
+
+	if o.Force {
+		opts = append(opts, "--force")
+	}
+
+	if o.GPGSign {
+		opts = append(opts, "--gpg-sign")
+	}
+
+	if o.GPGSignKeyID != "" {
+		opts = append(opts, fmt.Sprintf("--gpg-sign=%s", o.GPGSignKeyID))
+	}
+
+	if o.Log > 0 {
+		opts = append(opts, fmt.Sprintf("--log=%d", o.Log))
+	}
+
+	if o.Squash {
+		opts = append(opts, "--squash")
+	}
+
+	if o.Stat {
+		opts = append(opts, "--stat")
+	}
+
+	for _, opt := range o.StrategyOptions {
+		opts = append(opts, "-X", string(opt))
+	}
+
+	if o.NoAutostash {
+		opts = append(opts, "--no-autostash")
+	}
+
+	if o.NoDoCommit {
+		opts = append(opts, "--no-commit")
+	}
+
+	if o.NoFF {
+		opts = append(opts, "--no-ff")
+	}
+
+	if o.NoLog {
+		opts = append(opts, "--no-log")
+	}
+
+	if o.NoRebase {
+		opts = append(opts, "--no-rebase")
+	}
+
+	if o.NoRecurseSubmodules {
+		opts = append(opts, "--no-recurse-submodules")
+	}
+
+	if o.NoSquash {
+		opts = append(opts, "--no-squash")
+	}
+
+	if o.NoStat {
+		opts = append(opts, "--no-stat")
+	}
+
+	if o.NoStat {
+		opts = append(opts, "--no-stat")
+	}
+
+	if o.NoTags {
+		opts = append(opts, "--no-tags")
+	}
+
+	if o.NoVerify {
+		opts = append(opts, "--no-verify")
+	}
+
+	if o.Porcelain {
+		opts = append(opts, "--porcelain")
+	}
+
+	if o.Progress {
+		opts = append(opts, "--progress")
+	}
+
+	if o.Prune {
+		opts = append(opts, "--prune")
+	}
+
+	if o.PruneTags {
+		opts = append(opts, "--prune-tags")
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.Rebase != "" {
+		opts = append(opts, fmt.Sprintf("--rebase=%s", string(o.Rebase)))
+	}
+
+	if o.SetUpstream {
+		opts = append(opts, "--set-upstream")
+	}
+
+	if o.Unshallow {
+		opts = append(opts, "--unshallow")
+	}
+
+	if o.Verbose {
+		opts = append(opts, "--verbose")
+	}
+
+	if o.Repository != "" {
+		opts = append(opts, o.Repository)
+	}
+
+	if len(o.Refspec) > 0 {
+		opts = append(opts, o.Refspec...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/push.go b/tools/pipeline/internal/pkg/git/push.go
new file mode 100644
index 00000000000..344a1adf646
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/push.go
@@ -0,0 +1,217 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+type (
+	// PushRecurseSubmodules is how to handle recursive sub-modules
+	PushRecurseSubmodules = string
+	// PushSigned sets gpg sign mode
+	PushSigned = string
+)
+
+const (
+	PushRecurseSubmodulesCheck    PushRecurseSubmodules = "check"
+	PushRecurseSubmodulesOnDemand PushRecurseSubmodules = "on-demand"
+	PushRecurseSubmodulesOnly     PushRecurseSubmodules = "only"
+	PushRecurseSubmodulesNo       PushRecurseSubmodules = "no"
+
+	PushSignedTrue    PushSigned = "true"
+	PushSignedFalse   PushSigned = "false"
+	PushSignedIfAsked PushSigned = "if-asked"
+)
+
+// PushOpts are the git push flags and arguments
+// See: https://git-scm.com/docs/git-push
+type PushOpts struct {
+	// Options
+	All                 bool                  // --all
+	Atomic              bool                  // --atomic
+	Branches            bool                  // --branches
+	Delete              bool                  //  --delete
+	DryRun              bool                  // --dry-run
+	Exec                string                // --exec=<git-receive-pack>
+	FollowTags          bool                  //  --follow-tags
+	Force               bool                  // --force
+	ForceIfIncludes     bool                  // --force-if-includes
+	ForceWithLease      string                // --force-with-lease=<refname>
+	Mirror              bool                  // --mirror
+	NoAtomic            bool                  // --no-atomic
+	NoForceIfIncludes   bool                  // --no-force-if-includes
+	NoForceWithLease    bool                  // --no-force-with-lease
+	NoRecurseSubmodules bool                  // --no-recurse-submodules
+	NoSigned            bool                  //  --no-signed
+	NoThin              bool                  // --no-thin
+	NoVerify            bool                  // --no-verify
+	Porcelain           bool                  // --porcelain
+	Progress            bool                  // --progress
+	Prune               bool                  // --prune
+	PushOption          string                // --push-option
+	Quiet               bool                  // --quiet
+	RecurseSubmodules   PushRecurseSubmodules // --recurse-submodules=<mode>
+	SetUpstream         bool                  // --set-upstream
+	Signed              PushSigned            //  --signed=<mode>
+	Tags                bool                  //  --tags
+	Thin                bool                  // --thin
+	Verbose             bool                  // --verbose
+	Verify              bool                  // --verify
+
+	// Targets
+	Repository string   // <repository>
+	Refspec    []string // <refspec>
+}
+
+// Push runs the git push command
+func (c *Client) Push(ctx context.Context, opts *PushOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "push", opts)
+}
+
+// String returns the options as a string
+func (o *PushOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *PushOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+
+	if o.All {
+		opts = append(opts, "--all")
+	}
+
+	if o.Atomic {
+		opts = append(opts, "--atomic")
+	}
+
+	if o.Branches {
+		opts = append(opts, "--branches")
+	}
+
+	if o.Delete {
+		opts = append(opts, "--delete")
+	}
+
+	if o.DryRun {
+		opts = append(opts, "--dry-run")
+	}
+
+	if o.Exec != "" {
+		opts = append(opts, fmt.Sprintf("--exec=%s", o.Exec))
+	}
+
+	if o.FollowTags {
+		opts = append(opts, "--follow-tags")
+	}
+
+	if o.Force {
+		opts = append(opts, "--force")
+	}
+
+	if o.ForceIfIncludes {
+		opts = append(opts, "--force-if-includes")
+	}
+
+	if o.ForceWithLease != "" {
+		opts = append(opts, fmt.Sprintf("--force-with-lease=%s", o.ForceWithLease))
+	}
+
+	if o.Mirror {
+		opts = append(opts, "--mirror")
+	}
+
+	if o.NoAtomic {
+		opts = append(opts, "--no-atomic")
+	}
+
+	if o.NoForceIfIncludes {
+		opts = append(opts, "--no-force-if-includes")
+	}
+
+	if o.NoForceWithLease {
+		opts = append(opts, "--no-force-with-lease")
+	}
+
+	if o.NoRecurseSubmodules {
+		opts = append(opts, "--no-recurse-submodules")
+	}
+
+	if o.NoSigned {
+		opts = append(opts, "--no-signed")
+	}
+
+	if o.NoThin {
+		opts = append(opts, "--no-thin")
+	}
+
+	if o.NoVerify {
+		opts = append(opts, "--no-verify")
+	}
+
+	if o.Porcelain {
+		opts = append(opts, "--porcelain")
+	}
+
+	if o.Progress {
+		opts = append(opts, "--progress")
+	}
+
+	if o.Prune {
+		opts = append(opts, "--prune")
+	}
+
+	if o.PushOption != "" {
+		opts = append(opts, fmt.Sprintf("--push-option=%s", o.PushOption))
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.RecurseSubmodules != "" {
+		opts = append(opts, fmt.Sprintf("--recurse-submodules=%s", string(o.RecurseSubmodules)))
+	}
+
+	if o.SetUpstream {
+		opts = append(opts, "--set-upstream")
+	}
+
+	if o.Signed != "" {
+		opts = append(opts, fmt.Sprintf("--signed=%s", string(o.Signed)))
+	}
+
+	if o.Tags {
+		opts = append(opts, "--tags")
+	}
+
+	if o.Thin {
+		opts = append(opts, "--thin")
+	}
+
+	if o.Verbose {
+		opts = append(opts, "--verbose")
+	}
+
+	if o.Verify {
+		opts = append(opts, "--verify")
+	}
+
+	if o.Repository != "" {
+		opts = append(opts, o.Repository)
+	}
+
+	if len(o.Refspec) > 0 {
+		opts = append(opts, o.Refspec...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/rebase.go b/tools/pipeline/internal/pkg/git/rebase.go
new file mode 100644
index 00000000000..aa74965d175
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/rebase.go
@@ -0,0 +1,324 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+type (
+	// RebaseMerges is the strategy for handling merge commits in rebases
+	RebaseMerges = string
+	// RebaseMerges is the strategy for rebasing
+	RebaseStrategy = string
+	// RebaseMerges is the strategy for handling whitespace during rebasing
+	WhitespaceAction = string
+)
+
+const (
+	RebaseMergesCousins   RebaseMerges = "rebase-cousins"
+	RebaseMergesNoCousins RebaseMerges = "no-rebase-cousins"
+
+	RebaseStrategyTrue        RebaseStrategy = "true"
+	RebaseStrategyFalse       RebaseStrategy = "false"
+	RebaseStrategyMerges      RebaseStrategy = "merges"
+	RebaseStrategyInteractive RebaseStrategy = "interactive"
+
+	WhitespaceActionNoWarn   WhitespaceAction = "nowarn"
+	WhitespaceActionWarn     WhitespaceAction = "warn"
+	WhitespaceActionFix      WhitespaceAction = "fix"
+	WhitespaceActionError    WhitespaceAction = "error"
+	WhitespaceActionErrorAll WhitespaceAction = "error-all"
+)
+
+// RebaseOpts are the git rebase flags and arguments
+// See: https://git-scm.com/docs/git-rebase
+type RebaseOpts struct {
+	// Options
+	AllowEmptyMessage         bool                  // --allow-empty-message
+	Apply                     bool                  // --apply
+	Autosquash                bool                  // --autosquash
+	Autostash                 bool                  // --autostash
+	CommitterDateIsAuthorDate bool                  // --committer-date-is-author-date
+	Context                   uint                  // -C
+	Empty                     EmptyCommit           // --empty=
+	Exec                      string                // --exec=
+	ForceRebase               bool                  // --force-rebase
+	ForkPoint                 bool                  // --fork-point
+	GPGSign                   bool                  // --gpgsign
+	GPGSignKeyID              string                // --gpgsign=<key-id>
+	IgnoreDate                bool                  // --ignore-date
+	IgnoreWhitespace          bool                  // --ignore-whitespace
+	KeepBase                  string                // --keep-base <upstream|branch>
+	KeepEmpty                 bool                  // --keep-empty
+	Merge                     bool                  // --merge
+	NoAutosquash              bool                  // --no-autosquash
+	NoAutostash               bool                  // --no-autostash
+	NoKeepEmpty               bool                  // --no-keep-empty
+	NoReapplyCherryPicks      bool                  // --no-reapply-cherry-picks
+	NoRebaseMerges            bool                  // --no-rebase-merges
+	NoRescheduleFailedExec    bool                  // --no-reschedule-failed-exec
+	NoReReReAutoupdate        bool                  // --no-rerere-autoupdate
+	NoStat                    bool                  // --no-stat
+	NoUpdateRefs              bool                  // --no-update-refs
+	NoVerify                  bool                  // --no-verify
+	Onto                      string                // --onto
+	Quiet                     bool                  // --quiet
+	ReapplyCherryPicks        bool                  // --reapply-cherry-picks
+	RebaseMerges              RebaseMerges          // --rebase-merges=<strategy>
+	RescheduleFailedExec      bool                  // --reschedule-failed-exec
+	ResetAuthorDate           bool                  // --reset-author-date
+	ReReReAutoupdate          bool                  // --rerere-autoupdate
+	Root                      bool                  // --root
+	Stat                      bool                  // --stat
+	Strategy                  MergeStrategy         // --strategy
+	StrategyOptions           []MergeStrategyOption // --strategy-option=<option>
+	UpdateRefs                bool                  // --update-refs
+	Verbose                   bool                  // --verbose
+	Verify                    bool                  // --verify
+	Whitespace                WhitespaceAction      //--whitespace=<handler>
+
+	// Args
+	Branch string // <branch>
+
+	// Mode Options
+	Continue         bool // --continue
+	Skip             bool // --skip
+	Abort            bool // --abort
+	Quit             bool // --quit
+	ShowCurrentPatch bool // --show-current-patch
+}
+
+// Rebase runs the git rebase command
+func (c *Client) Rebase(ctx context.Context, opts *RebaseOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "rebase", opts)
+}
+
+// RebaseAbort aborts an in-progress rebase
+func (c *Client) RebaseAbort(ctx context.Context) (*ExecResponse, error) {
+	return c.Rebase(ctx, &RebaseOpts{Abort: true})
+}
+
+// RebaseContinue continues an in-progress rebase
+func (c *Client) RebaseContinue(ctx context.Context) (*ExecResponse, error) {
+	return c.Rebase(ctx, &RebaseOpts{Continue: true})
+}
+
+// RebaseQuit quits an in-progress rebase
+func (c *Client) RebaseQuit(ctx context.Context) (*ExecResponse, error) {
+	return c.Rebase(ctx, &RebaseOpts{Quit: true})
+}
+
+// RebaseSkip skips an in-progress rebase
+func (c *Client) RebaseSkip(ctx context.Context) (*ExecResponse, error) {
+	return c.Rebase(ctx, &RebaseOpts{Skip: true})
+}
+
+// RebaseShowCurrentPatch shows the current patch an in-progress rebase
+func (c *Client) RebaseShowCurrentPatch(ctx context.Context) (*ExecResponse, error) {
+	return c.Rebase(ctx, &RebaseOpts{ShowCurrentPatch: true})
+}
+
+// String returns the options as a string
+func (o *RebaseOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the set options as a string slice
+func (o *RebaseOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	switch {
+	case o.Abort:
+		return []string{"--abort"}
+	case o.Continue:
+		return []string{"--continue"}
+	case o.Quit:
+		return []string{"--quit"}
+	case o.Skip:
+		return []string{"--skip"}
+	case o.ShowCurrentPatch:
+		return []string{"--show-current-patch"}
+	}
+
+	opts := []string{}
+
+	if o.AllowEmptyMessage {
+		opts = append(opts, "--allow-empty-message")
+	}
+	if o.Apply {
+		opts = append(opts, "--apply")
+	}
+
+	if o.Autosquash {
+		opts = append(opts, "--autosquash")
+	}
+
+	if o.Autostash {
+		opts = append(opts, "--autostash")
+	}
+
+	if o.CommitterDateIsAuthorDate {
+		opts = append(opts, "--committer-date-is-author-date")
+	}
+
+	if o.Context > 0 {
+		opts = append(opts, "-C", strconv.FormatUint(uint64(o.Context), 10))
+	}
+
+	if o.Empty != "" {
+		opts = append(opts, fmt.Sprintf("--empty=%s", string(o.Empty)))
+	}
+
+	if o.Exec != "" {
+		opts = append(opts, fmt.Sprintf("--exec=%s", o.Exec))
+	}
+
+	if o.ForceRebase {
+		opts = append(opts, "--force-rebase")
+	}
+
+	if o.ForkPoint {
+		opts = append(opts, "--fork-point")
+	}
+
+	if o.GPGSign {
+		opts = append(opts, "--gpg-sign")
+	}
+
+	if o.GPGSignKeyID != "" {
+		opts = append(opts, fmt.Sprintf("--gpg-sign=%s", o.GPGSignKeyID))
+	}
+
+	if o.IgnoreDate {
+		opts = append(opts, "--ignore-date")
+	}
+
+	if o.IgnoreWhitespace {
+		opts = append(opts, "--ignore-whitespace")
+	}
+
+	if o.KeepBase != "" {
+		opts = append(opts, fmt.Sprintf("--keep-base=%s", o.KeepBase))
+	}
+
+	if o.KeepEmpty {
+		opts = append(opts, "--keep-empty")
+	}
+
+	if o.Merge {
+		opts = append(opts, "--merge")
+	}
+
+	if o.NoAutosquash {
+		opts = append(opts, "--no-autosquash")
+	}
+
+	if o.NoAutostash {
+		opts = append(opts, "--no-autostash")
+	}
+
+	if o.NoKeepEmpty {
+		opts = append(opts, "--no-keep-empty")
+	}
+
+	if o.NoReapplyCherryPicks {
+		opts = append(opts, "--no-reapply-cherry-picks")
+	}
+
+	if o.NoRebaseMerges {
+		opts = append(opts, "--no-rebase-merges")
+	}
+
+	if o.NoRescheduleFailedExec {
+		opts = append(opts, "--no-reschedule-failed-exec")
+	}
+
+	if o.NoReReReAutoupdate {
+		opts = append(opts, "--no-rerere-autoupdate")
+	}
+
+	if o.NoStat {
+		opts = append(opts, "--no-stat")
+	}
+
+	if o.NoUpdateRefs {
+		opts = append(opts, "--no-update-refs")
+	}
+
+	if o.NoVerify {
+		opts = append(opts, "--no-verify")
+	}
+
+	if o.Onto != "" {
+		opts = append(opts, fmt.Sprintf("--onto=%s", o.Onto))
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.ReapplyCherryPicks {
+		opts = append(opts, "--reapply-cherry-picks")
+	}
+
+	if o.RebaseMerges != "" {
+		opts = append(opts, fmt.Sprintf("--rebase-merges=%s", string(o.RebaseMerges)))
+	}
+
+	if o.RescheduleFailedExec {
+		opts = append(opts, "--reschedule-failed-exec")
+	}
+
+	if o.ResetAuthorDate {
+		opts = append(opts, "--reset-author-date")
+	}
+
+	if o.ReReReAutoupdate {
+		opts = append(opts, "--rerere-autoupdate")
+	}
+
+	if o.Root {
+		opts = append(opts, "--root")
+	}
+
+	if o.Stat {
+		opts = append(opts, "--stat")
+	}
+
+	if o.Strategy != "" {
+		opts = append(opts, fmt.Sprintf("--strategy=%s", string(o.Strategy)))
+	}
+
+	for _, opt := range o.StrategyOptions {
+		opts = append(opts, fmt.Sprintf("--strategy-option=%s", string(opt)))
+	}
+
+	if o.UpdateRefs {
+		opts = append(opts, "--update-refs")
+	}
+
+	if o.Verbose {
+		opts = append(opts, "--verbose")
+	}
+
+	if o.Verify {
+		opts = append(opts, "--verify")
+	}
+
+	if o.Whitespace != "" {
+		opts = append(opts, fmt.Sprintf("--whitespace=%s", string(o.Whitespace)))
+	}
+
+	if o.Branch != "" {
+		opts = append(opts, o.Branch)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/remote.go b/tools/pipeline/internal/pkg/git/remote.go
new file mode 100644
index 00000000000..66a03faec30
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/remote.go
@@ -0,0 +1,209 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"strings"
+)
+
+// RemoteOpts are the git remote sub-commands, flags and arguments
+// See: https://git-scm.com/docs/git-remote
+type RemoteOpts struct {
+	// Sub-command
+	Command RemoteCommand
+
+	// Flags
+	Verbose    bool     // --verbose
+	Fetch      bool     // -f
+	Tags       bool     // --tags
+	NoTags     bool     // --no-tags
+	Master     string   // -m
+	Track      []string // -t
+	Delete     bool     // --delete
+	Auto       bool     // --auto
+	Add        bool     // --add
+	Push       bool     // --push
+	All        bool     // --all
+	NoQuery    bool     // -n
+	DryRun     bool     // --dry-run
+	Prune      bool     // --prune
+	Progress   bool     // --progress
+	NoProgress bool     // --no-progress
+
+	// Targets
+	Old      string   // <old>
+	New      string   // <new>
+	NewURL   string   // <newurl>
+	OldURL   string   // <oldurl>
+	Name     string   // <name>
+	Names    []string // <name>...
+	Branch   string   // <branch>
+	Branches []string // <branch>...
+	URL      string   // <URL>
+}
+
+type RemoteCommand string
+
+const (
+	RemoteCommandAdd         RemoteCommand = "add"
+	RemoteCommandRename      RemoteCommand = "rename"
+	RemoteCommandRemove      RemoteCommand = "remove"
+	RemoteCommandSetHead     RemoteCommand = "set-head"
+	RemoteCommandSetBranches RemoteCommand = "set-branches"
+	RemoteCommandGetURL      RemoteCommand = "get-url"
+	RemoteCommandSetURL      RemoteCommand = "set-url"
+	RemoteCommandShow        RemoteCommand = "show"
+	RemoteCommandPrune       RemoteCommand = "prune"
+	RemoteCommandUpdate      RemoteCommand = "update"
+)
+
+// Remote runs the git rm command
+func (c *Client) Remote(ctx context.Context, opts *RemoteOpts) (*ExecResponse, error) {
+	// TODO: Handle exit code 2 and 3?
+	// https://git-scm.com/docs/git-remote#_exit_status
+	return c.Exec(ctx, "remote", opts)
+}
+
+// String returns the options as a string
+func (o *RemoteOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *RemoteOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+
+	switch o.Command {
+	case RemoteCommandAdd:
+		opts = append(opts, string(o.Command))
+		if o.Fetch {
+			opts = append(opts, "-f")
+		}
+		if o.Tags {
+			opts = append(opts, "--tags")
+		}
+		if o.NoTags {
+			opts = append(opts, "--no-tags")
+		}
+		if o.Master != "" {
+			opts = append(opts, "-m", o.Master)
+		}
+		for _, branch := range o.Track {
+			opts = append(opts, "-t", branch)
+		}
+		opts = append(opts, o.Name, o.URL)
+	case RemoteCommandRename:
+		opts = append(opts, string(o.Command))
+		if o.Progress {
+			opts = append(opts, "--progress")
+		}
+		if o.NoProgress {
+			opts = append(opts, "--no-progress")
+		}
+		opts = append(opts, o.Old, o.New)
+	case RemoteCommandRemove:
+		opts = append(opts, string(o.Command), o.Name)
+	case RemoteCommandSetHead:
+		opts = append(opts, string(o.Command), o.Name)
+		if o.Auto {
+			opts = append(opts, "--auto")
+		}
+		if o.Delete {
+			opts = append(opts, "--delete")
+		}
+		if o.Branch != "" {
+			opts = append(opts, o.Branch)
+		}
+	case RemoteCommandSetBranches:
+		opts = append(opts, string(o.Command))
+		if o.Add {
+			opts = append(opts, "--add")
+		}
+		opts = append(opts, o.Name)
+		if o.Branch != "" {
+			opts = append(opts, o.Branch)
+		}
+		if len(o.Branches) > 0 {
+			opts = append(opts, o.Branches...)
+		}
+	case RemoteCommandGetURL:
+		opts = append(opts, string(o.Command))
+		if o.Push {
+			opts = append(opts, "--push")
+		}
+		if o.All {
+			opts = append(opts, "--all")
+		}
+		opts = append(opts, o.Name)
+	case RemoteCommandSetURL:
+		opts = append(opts, string(o.Command))
+		if o.Add {
+			opts = append(opts, "--add")
+		}
+		if o.Delete {
+			opts = append(opts, "--delete")
+		}
+		if o.Push {
+			opts = append(opts, "--push")
+		}
+		opts = append(opts, o.Name)
+		if o.NewURL != "" {
+			opts = append(opts, o.NewURL)
+		}
+		if o.OldURL != "" {
+			opts = append(opts, o.OldURL)
+		}
+		if o.URL != "" {
+			opts = append(opts, o.URL)
+		}
+	case RemoteCommandShow:
+		if o.Verbose {
+			opts = append(opts, "-v")
+		}
+		opts = append(opts, string(o.Command))
+		if o.NoQuery {
+			opts = append(opts, "-n")
+		}
+		if o.Name != "" {
+			opts = append(opts, o.Name)
+		}
+		if len(o.Names) > 0 {
+			opts = append(opts, o.Names...)
+		}
+	case RemoteCommandPrune:
+		opts = append(opts, string(o.Command))
+		if o.NoQuery {
+			opts = append(opts, "-n")
+		}
+		if o.DryRun {
+			opts = append(opts, "--dry-run")
+		}
+		if o.Name != "" {
+			opts = append(opts, o.Name)
+		}
+		if len(o.Names) > 0 {
+			opts = append(opts, o.Names...)
+		}
+	case RemoteCommandUpdate:
+		if o.Verbose {
+			opts = append(opts, "-v")
+		}
+		opts = append(opts, string(o.Command))
+		if o.Prune {
+			opts = append(opts, "--prune")
+		}
+	default:
+		// git remote
+		if o.Verbose {
+			opts = append(opts, "-v")
+		}
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/reset.go b/tools/pipeline/internal/pkg/git/reset.go
new file mode 100644
index 00000000000..1c54996543b
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/reset.go
@@ -0,0 +1,94 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"strings"
+)
+
+// ResetMode is is mode to use when resetting the repository
+type ResetMode string
+
+const (
+	ResetModeSoft  ResetMode = "soft"
+	ResetModeMixed ResetMode = "mixed"
+	ResetModeHard  ResetMode = "hard"
+	ResetModeMerge ResetMode = "merge"
+	ResetModeKeep  ResetMode = "keep"
+)
+
+// ResetOpts are the git reset flags and arguments
+// See: https://git-scm.com/docs/git-reset
+type ResetOpts struct {
+	// Options
+	Mode      ResetMode // [--soft, --hard, etc..]
+	NoRefresh bool      // --no-refresh
+	Patch     bool      // --patch
+	Quiet     bool      // --quiet
+	Refresh   bool      // --refresh
+
+	// Targets
+	Commit   string   // <commit>
+	Treeish  string   // <tree-ish>
+	PathSpec []string // <pathspec>
+}
+
+// Reset runs the git reset command
+func (c *Client) Reset(ctx context.Context, opts *ResetOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "reset", opts)
+}
+
+// String returns the options as a string
+func (o *ResetOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *ResetOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+
+	// Do mode before flags if it set
+	if o.Mode != "" {
+		opts = append(opts, "--"+string(o.Mode))
+	}
+
+	// Flags
+	if o.NoRefresh {
+		opts = append(opts, "--no-refresh")
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.Refresh {
+		opts = append(opts, "--refresh")
+	}
+
+	// Do Patch after flags but before our targets
+	if o.Patch {
+		opts = append(opts, "--patch")
+	}
+
+	// Do our targets
+	if o.Commit != "" {
+		opts = append(opts, o.Commit)
+	}
+
+	if o.Treeish != "" {
+		opts = append(opts, o.Treeish)
+	}
+
+	// If there's a pathspec, append the paths at the very end
+	if len(o.PathSpec) > 0 {
+		opts = append(append(opts, "--"), o.PathSpec...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/rm.go b/tools/pipeline/internal/pkg/git/rm.go
new file mode 100644
index 00000000000..9fdc40d37dc
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/rm.go
@@ -0,0 +1,76 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"strings"
+)
+
+// RmOpts are the git rm flags and arguments
+// See: https://git-scm.com/docs/git-rm
+type RmOpts struct {
+	Cached          bool // --cached
+	DryRun          bool // --dry-run
+	Force           bool // --force
+	IgnoreUnmatched bool // --ignore-unmatched
+	Quiet           bool // --quiet
+	Recursive       bool // -r
+	Sparse          bool // --sparse
+
+	PathSpec []string // <pathspec>
+}
+
+// Rm runs the git rm command
+func (c *Client) Rm(ctx context.Context, opts *RmOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "rm", opts)
+}
+
+// String returns the options as a string
+func (o *RmOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *RmOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+	if o.Cached {
+		opts = append(opts, "--cached")
+	}
+
+	if o.DryRun {
+		opts = append(opts, "--dry-run")
+	}
+
+	if o.Force {
+		opts = append(opts, "--force")
+	}
+
+	if o.IgnoreUnmatched {
+		opts = append(opts, "--ignore-unmatched")
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.Recursive {
+		opts = append(opts, "-r")
+	}
+
+	if o.Sparse {
+		opts = append(opts, "--sparse")
+	}
+
+	// If there's a pathspec, append the paths at the very end
+	if len(o.PathSpec) > 0 {
+		opts = append(append(opts, "--"), o.PathSpec...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/show.go b/tools/pipeline/internal/pkg/git/show.go
new file mode 100644
index 00000000000..2f7ea4e2d3d
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/show.go
@@ -0,0 +1,113 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+type (
+	DiffAlgorithm   = string
+	DiffMergeFormat = string
+)
+
+const (
+	DiffAlgorithmPatience  DiffAlgorithm = "patience"
+	DiffAlgorithmMinimal   DiffAlgorithm = "minimal"
+	DiffAlgorithmHistogram DiffAlgorithm = "histogram"
+	DiffAlgorithmMyers     DiffAlgorithm = "myers"
+
+	DiffMergeFormatOff           DiffMergeFormat = "off"
+	DiffMergeFormatNone          DiffMergeFormat = "none"
+	DiffMergeFormatFirstParent   DiffMergeFormat = "first-parent"
+	DiffMergeFormatSeparate      DiffMergeFormat = "separate"
+	DiffMergeFormatCombined      DiffMergeFormat = "combined"
+	DiffMergeFormatDenseCombined DiffMergeFormat = "dense-combined"
+	DiffMergeFormatRemerge       DiffMergeFormat = "remerge"
+)
+
+// ShowOpts are the git show flags and arguments
+// See: https://git-scm.com/docs/git-show
+type ShowOpts struct {
+	// Options
+	DiffAlgorithm DiffAlgorithm   // --diff-algorithm=<algo>
+	DiffMerges    DiffMergeFormat // --diff-merges=<format>
+	Format        string          // --format <format>
+	NoColor       bool            // --no-color
+	NoPatch       bool            // --no-patch
+	Patch         bool            // --patch
+	Output        string          // --output=<file>
+	Quiet         bool            // --quiet
+	Raw           bool            // --raw
+
+	// Targets
+	Object   string   // <object>
+	PathSpec []string // <pathspec>
+}
+
+// Show runs the git show command
+func (c *Client) Show(ctx context.Context, opts *ShowOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "show", opts)
+}
+
+// String returns the options as a string
+func (o *ShowOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *ShowOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+
+	if o.DiffAlgorithm != "" {
+		opts = append(opts, fmt.Sprintf("--diff-algorithm=%s", string(o.DiffAlgorithm)))
+	}
+
+	if o.DiffMerges != "" {
+		opts = append(opts, fmt.Sprintf("--diff-merges=%s", string(o.DiffMerges)))
+	}
+
+	if o.Format != "" {
+		opts = append(opts, fmt.Sprintf("--format=%s", string(o.Format)))
+	}
+
+	if o.NoColor {
+		opts = append(opts, "--no-color")
+	}
+
+	if o.NoPatch {
+		opts = append(opts, "--no-patch")
+	}
+
+	if o.Output != "" {
+		opts = append(opts, fmt.Sprintf("--output=%s", o.Output))
+	}
+
+	if o.Patch {
+		opts = append(opts, "--patch")
+	}
+
+	if o.Quiet {
+		opts = append(opts, "--quiet")
+	}
+
+	if o.Raw {
+		opts = append(opts, "--raw")
+	}
+
+	opts = append(opts, o.Object)
+
+	// If there's a pathspec, append the paths at the very end
+	if len(o.PathSpec) > 0 {
+		opts = append(append(opts, "--"), o.PathSpec...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/git/status.go b/tools/pipeline/internal/pkg/git/status.go
new file mode 100644
index 00000000000..88e99284c13
--- /dev/null
+++ b/tools/pipeline/internal/pkg/git/status.go
@@ -0,0 +1,142 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+type (
+	// IgnoredMode determines how to handle ignored files
+	IgnoredMode = string
+	// IgnoredMode determines how to handle changes to submodules
+	IgnoreSubmodulesWhen = string
+)
+
+const (
+	IgnoredModeTraditional IgnoredMode = "traditional"
+	IgnoredModeNo          IgnoredMode = "no"
+	IgnoredModeMatching    IgnoredMode = "matching"
+
+	IgnoreSubmodulesWhenNone      IgnoreSubmodulesWhen = "none"
+	IgnoreSubmodulesWhenUntracked IgnoreSubmodulesWhen = "untracked"
+	IgnoreSubmodulesWhenDirty     IgnoreSubmodulesWhen = "dirty"
+	IgnoreSubmodulesWhenAll       IgnoreSubmodulesWhen = "all"
+)
+
+// StatusOpts are the git status flags and arguments
+// See: https://git-scm.com/docs/git-status
+type StatusOpts struct {
+	// Options
+	AheadBehind      bool                 // --ahead-behind
+	Branch           bool                 // --branch
+	Column           string               // --column=
+	FindRenames      uint                 // --find-renames=
+	Ignored          IgnoredMode          // --ignored=
+	IgnoreSubmodules IgnoreSubmodulesWhen // --ignore-submodules=<when>
+	Long             bool                 // --long
+	NoAheadBehind    bool                 // --no-ahead-behind
+	NoColumn         bool                 // --no-column
+	NoRenames        bool                 // --no-renames
+	Porcelain        bool                 // --porcelain
+	Renames          bool                 // --renames
+	Short            bool                 // --short
+	ShowStash        bool                 // --show-stash
+	UntrackedFiles   UntrackedFiles       // --untracked-files=<mode>
+	Verbose          bool                 // --verbose
+
+	// Targets
+	PathSpec []string // <pathspec>
+}
+
+// Status runs the git status command
+func (c *Client) Status(ctx context.Context, opts *StatusOpts) (*ExecResponse, error) {
+	return c.Exec(ctx, "status", opts)
+}
+
+// String returns the options as a string
+func (o *StatusOpts) String() string {
+	return strings.Join(o.Strings(), " ")
+}
+
+// Strings returns the options as a string slice
+func (o *StatusOpts) Strings() []string {
+	if o == nil {
+		return nil
+	}
+
+	opts := []string{}
+	if o.AheadBehind {
+		opts = append(opts, "--ahead-behind")
+	}
+
+	if o.Branch {
+		opts = append(opts, "--branch")
+	}
+
+	if o.Column != "" {
+		opts = append(opts, fmt.Sprintf("--column=%s", o.Column))
+	}
+
+	if o.FindRenames > 0 {
+		opts = append(opts, fmt.Sprintf("--find-renames=%d", o.FindRenames))
+	}
+
+	if o.Ignored != "" {
+		opts = append(opts, fmt.Sprintf("--ignored=%s", string(o.Ignored)))
+	}
+
+	if o.IgnoreSubmodules != "" {
+		opts = append(opts, fmt.Sprintf("--ignore-submodules=%s", string(o.IgnoreSubmodules)))
+	}
+
+	if o.Long {
+		opts = append(opts, "--long")
+	}
+
+	if o.NoAheadBehind {
+		opts = append(opts, "--no-ahead-behind")
+	}
+
+	if o.NoColumn {
+		opts = append(opts, "--no-column")
+	}
+
+	if o.NoRenames {
+		opts = append(opts, "--no-renames")
+	}
+
+	if o.Porcelain {
+		opts = append(opts, "--porcelain")
+	}
+
+	if o.Renames {
+		opts = append(opts, "--renames")
+	}
+
+	if o.Short {
+		opts = append(opts, "--short")
+	}
+
+	if o.ShowStash {
+		opts = append(opts, "--show-stash")
+	}
+
+	if o.UntrackedFiles != "" {
+		opts = append(opts, fmt.Sprintf("--untracked-files=%s", string(o.UntrackedFiles)))
+	}
+
+	if o.Verbose {
+		opts = append(opts, "--verbose")
+	}
+
+	// If there's a pathspec, append the paths at the very end
+	if len(o.PathSpec) > 0 {
+		opts = append(append(opts, "--"), o.PathSpec...)
+	}
+
+	return opts
+}
diff --git a/tools/pipeline/internal/pkg/github/add_assignees.go b/tools/pipeline/internal/pkg/github/add_assignees.go
new file mode 100644
index 00000000000..fd82d314cbd
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/add_assignees.go
@@ -0,0 +1,37 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"log/slog"
+	"slices"
+
+	libgithub "github.com/google/go-github/v74/github"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// addAssignees assigns the given logins to the issue or pull request
+func addAssignees(
+	ctx context.Context,
+	github *libgithub.Client,
+	owner string,
+	repo string,
+	number int,
+	logins []string,
+) error {
+	logins = slices.Compact(slices.DeleteFunc(logins, func(a string) bool {
+		return a == ""
+	}))
+	ctx = slogctx.Append(ctx, slog.Any("assignee-logins", logins))
+
+	if len(logins) < 1 {
+		slog.Default().InfoContext(ctx, "skipping pull request actor assignments because no logins were provided")
+		return nil
+	}
+
+	slog.Default().DebugContext(ctx, "adding assignees to pull request")
+	_, _, err := github.Issues.AddAssignees(ctx, owner, repo, number, logins)
+	return err
+}
diff --git a/tools/pipeline/internal/pkg/github/check_commit_status.go b/tools/pipeline/internal/pkg/github/check_commit_status.go
new file mode 100644
index 00000000000..df5a55589a8
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/check_commit_status.go
@@ -0,0 +1,159 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+
+	libgithub "github.com/google/go-github/v74/github"
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+// CheckCommitStatusReq is a request to list workflows runs. The fields represent
+// various criteria we can use to filter.
+type CheckCommitStatusReq struct {
+	Owner   string
+	Repo    string
+	Commit  string
+	PR      int
+	Context string
+	Creator string
+	State   string
+}
+
+// CheckCommitStatusRes is a list workflows response.
+type CheckCommitStatusRes struct {
+	CheckSuccessful bool                 `json:"check_success,omitempty"`
+	ExpectedContext string               `json:"expected_context,omitempty"`
+	ExpectedState   string               `json:"expected_state,omitempty"`
+	ExpectedCreator string               `json:"expected_creator,omitempty"`
+	Statuses        []*CheckCommitStatus `json:"statuses,omitempty"`
+}
+
+type CheckCommitStatus struct {
+	Status       *libgithub.RepoStatus `json:"statuses,omitempty"`
+	CheckSuccess bool                  `json:"success,omitempty"`
+}
+
+// String returns the response as a string
+func (r *CheckCommitStatusRes) String() string {
+	b := strings.Builder{}
+	b.WriteString(fmt.Sprintf("success:%t", r.CheckSuccessful))
+	b.WriteString(" context:" + r.ExpectedContext)
+	b.WriteString(" state:" + r.ExpectedState)
+	b.WriteString(" creator:" + r.ExpectedCreator)
+
+	return b.String()
+}
+
+// Run runs the request to gather all instances of the workflow that match
+// our filter criteria.
+func (r *CheckCommitStatusReq) Run(ctx context.Context, client *libgithub.Client) (*CheckCommitStatusRes, error) {
+	var err error
+	res := &CheckCommitStatusRes{
+		CheckSuccessful: false,
+		ExpectedCreator: r.Creator,
+		ExpectedState:   r.State,
+		ExpectedContext: r.Context,
+		Statuses:        []*CheckCommitStatus{},
+	}
+
+	if err = r.validate(); err != nil {
+		return nil, fmt.Errorf("validating request: %w", err)
+	}
+
+	statusesReq := &ListCommitStatusesReq{
+		Owner:  r.Owner,
+		Repo:   r.Repo,
+		Commit: r.Commit,
+		PR:     r.PR,
+	}
+	statuses, err := statusesReq.Run(ctx, client)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, status := range statuses.Statuses {
+		if status.GetContext() != r.Context {
+			continue
+		}
+
+		if r.Creator != "" && status.GetCreator().GetLogin() != r.Creator {
+			continue
+		}
+
+		// There can be many statuses with the same context and creator. Keep track
+		// of them all but only update our success if we get a match.
+		res.Statuses = append(res.Statuses, &CheckCommitStatus{
+			Status:       status,
+			CheckSuccess: status.GetState() == r.State,
+		})
+
+		if status.GetState() == r.State {
+			res.CheckSuccessful = true
+		}
+	}
+
+	return res, nil
+}
+
+// validate ensures that we've been given the minimum filter arguments necessary to complete a
+// request. It is always recommended that additional fitlers be given to reduce the response size
+// and not exhaust API limits.
+func (r *CheckCommitStatusReq) validate() error {
+	if r == nil {
+		return errors.New("failed to initialize request")
+	}
+
+	if r.Owner == "" {
+		return errors.New("no github organization has been provided")
+	}
+
+	if r.Repo == "" {
+		return errors.New("no github repository has been provided")
+	}
+
+	if r.Context == "" {
+		return errors.New("no status context has been provided")
+	}
+
+	if r.PR == 0 && r.Commit == "" {
+		return errors.New("no commit or Pull Request number has been provided")
+	}
+
+	allowedStates := []string{"error", "failure", "pending", "success"}
+	if !slices.Contains(allowedStates, r.State) {
+		return fmt.Errorf("invalid state, got: %s, expected one of: %v+", r.State, allowedStates)
+	}
+
+	return nil
+}
+
+// ToTable marshals the response to a text table.
+func (r *CheckCommitStatusRes) ToTable() table.Writer {
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+	t.AppendHeader(table.Row{"context", "creator", "date", "state", "check success"})
+	for _, status := range r.Statuses {
+		t.AppendRow(table.Row{
+			status.Status.GetContext(),
+			status.Status.GetCreator().GetLogin(),
+			status.Status.GetUpdatedAt(),
+			status.Status.GetState(),
+			status.CheckSuccess,
+		})
+	}
+	t.SuppressEmptyColumns()
+	t.SuppressTrailingSpaces()
+
+	return t
+}
diff --git a/tools/pipeline/internal/pkg/github/close_copied_origin_pull_request.go b/tools/pipeline/internal/pkg/github/close_copied_origin_pull_request.go
new file mode 100644
index 00000000000..b8425241f7f
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/close_copied_origin_pull_request.go
@@ -0,0 +1,366 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"slices"
+	"strings"
+
+	libgithub "github.com/google/go-github/v74/github"
+	"github.com/jedib0t/go-pretty/v6/table"
+	"github.com/shurcooL/githubv4"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// CloseCopiedOriginPullRequestReq is a request to copy a pull request from the CE repo to
+// the Ent repo.
+type CloseCopiedOriginPullRequestReq struct {
+	Owner      string
+	Repo       string
+	PullNumber uint
+}
+
+// CloseCopiedOriginPullRequestRes is a copy pull request response.
+type CloseCopiedOriginPullRequestRes struct {
+	CopiedClosingIssues []*ClosingIssueRef      `json:"copied_closing_issues,omitempty"`
+	CopiedComment       *libgithub.IssueComment `json:"copy_comment,omitempty"`
+	CopiedPullRequest   *libgithub.PullRequest  `json:"copy_pull_request,omitempty"`
+	OriginClosingIssues []*ClosingIssueRef      `json:"origin_associated_issues,omitempty"`
+	OriginComment       *libgithub.IssueComment `json:"origin_comment,omitempty"`
+	OriginPullRequest   *libgithub.PullRequest  `json:"origin_pull_request,omitempty"`
+}
+
+// ClosingIssueRefs represents our Github GraphQL query for finding issues
+// associated with our Pull Request that ought to be automatically closed.
+//
+// The raw query looks something like:
+//
+//		{
+//		  repository(owner: $owner, name: $repo) {
+//		    pullRequest(number: $number) {
+//		      repository {
+//		        nameWithOwner
+//		      }
+//		      number
+//		      closingIssuesReferences(first: 100) {
+//		        edges {
+//		          node {
+//		            url
+//	              number
+//		            title
+//		            closed
+//		            repository {
+//		              nameWithOwner
+//		            }
+//		          }
+//		        }
+//		      }
+//		    }
+//		  }
+//		}
+type ClosingIssueRefs struct {
+	Repository struct {
+		PullRequest struct {
+			Repository struct {
+				NameWithOwner string `json:"name_with_owner,omitempty"`
+			} `json:"repository"`
+			Number                  int `json:"number,omitempty"`
+			ClosingIssuesReferences struct {
+				Edges []struct {
+					Node *ClosingIssueRef `json:"node"`
+				} `json:"edges"`
+			} `json:"closing_issues_references" graphql:"closingIssuesReferences(first: 100)"`
+		} `json:"pull_request" graphql:"pullRequest(number: $number)"`
+	} `json:"repository" graphql:"repository(owner: $owner, name: $repo)"`
+}
+
+// ClosingIssueRef is an issue that is associated with a pull request.
+type ClosingIssueRef struct {
+	URL        string `json:"url,omitempty" graphql:"url"`
+	Number     int    `json:"number,omitempty"`
+	Title      string `json:"title,omitempty"`
+	Closed     bool   `json:"closed,omitempty"`
+	Repository struct {
+		NameWithOwner string `json:"name_with_owner,omitempty"`
+	} `json:"repository"`
+}
+
+// Run runs the request to copy a pull request from the CE repo to the Ent repo.
+func (r *CloseCopiedOriginPullRequestReq) Run(
+	ctx context.Context,
+	githubV3 *libgithub.Client,
+	githubV4 *githubv4.Client,
+) (*CloseCopiedOriginPullRequestRes, error) {
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("owner", r.Owner),
+		slog.String("repo", r.Repo),
+		slog.Uint64("pull-number", uint64(r.PullNumber)),
+	), "closing copied pull request")
+
+	res := &CloseCopiedOriginPullRequestRes{
+		OriginClosingIssues: []*ClosingIssueRef{},
+		CopiedClosingIssues: []*ClosingIssueRef{},
+	}
+	var err error
+	originOwner, originRepo := "", ""
+	var originNumber uint = 0
+
+	// Whenever possible we try to update base pull request with a status update
+	// on how the copying has gone.
+	createComments := func() {
+		// Make sure we return a response even if we fail
+		if res == nil {
+			res = &CloseCopiedOriginPullRequestRes{
+				OriginClosingIssues: []*ClosingIssueRef{},
+				CopiedClosingIssues: []*ClosingIssueRef{},
+			}
+		}
+
+		var err1, err2 error
+		res.CopiedComment, err1 = createPullRequestComment(
+			ctx,
+			githubV3,
+			r.Owner,
+			r.Repo,
+			int(r.PullNumber),
+			res.copiedCommentBody(err),
+		)
+
+		res.OriginComment, err2 = createPullRequestComment(
+			ctx,
+			githubV3,
+			originOwner,
+			originRepo,
+			int(originNumber),
+			res.originCommentBody(err),
+		)
+
+		// Set our finalized error on our response and also update our returned error
+		err = errors.Join(err, err1, err2)
+	}
+	defer createComments()
+
+	err = r.validate()
+	if err != nil {
+		return res, err
+	}
+
+	// Get the pull details of the copied PR
+	res.CopiedPullRequest, err = getPullRequest(ctx, githubV3, r.Owner, r.Repo, int(r.PullNumber))
+	if err != nil {
+		return res, err
+	}
+
+	// Determine the origin PR from the copied PR branch name
+	originOwner, originRepo, originNumber, _, err = decodeCopyPullRequestBranch(res.CopiedPullRequest.GetHead().GetRef())
+	if err != nil {
+		return res, err
+	}
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("origin-owner", originOwner),
+		slog.String("origin-repo", originRepo),
+		slog.Uint64("origin-pull-number", uint64(originNumber)),
+	), "decoded origin pull request information from copied pull request")
+
+	// Get the pull details of the origin PR
+	res.OriginPullRequest, err = getPullRequest(ctx, githubV3, originOwner, originRepo, int(originNumber))
+	if err != nil {
+		return res, err
+	}
+
+	// Close the origin PR if it's not closed already
+	if res.OriginPullRequest.GetState() != "closed" {
+		err = closePullRequest(ctx, githubV3, originOwner, originRepo, int(originNumber))
+		if err != nil {
+			return res, fmt.Errorf("unable to close origin pull request: %w", err)
+		}
+	} else {
+		slog.Default().DebugContext(ctx, "origin pull request has already been closed")
+	}
+
+	// Close any issues associated with either the origin or copied PRs
+	res.OriginClosingIssues, err = listPullRequestClosingIssues(
+		ctx, githubV4, originOwner, originRepo, int(originNumber),
+	)
+	if err != nil {
+		return res, err
+	}
+
+	res.CopiedClosingIssues, err = listPullRequestClosingIssues(
+		ctx, githubV4, r.Owner, r.Repo, int(r.PullNumber),
+	)
+	if err != nil {
+		return res, err
+	}
+
+	slog.Default().DebugContext(ctx, "closing any open associated issues")
+	for _, issue := range slices.CompactFunc(
+		append(res.OriginClosingIssues, res.CopiedClosingIssues...),
+		closingIssueRefEqual,
+	) {
+		if issue.Closed {
+			slog.Default().DebugContext(slogctx.Append(ctx,
+				slog.String("repository", issue.Repository.NameWithOwner),
+				slog.Int("number", issue.Number),
+			), "associated issue is already closed")
+			continue
+		}
+
+		nwo := issue.Repository.NameWithOwner
+		parts := strings.SplitN(nwo, "/", 2)
+		if len(parts) != 2 {
+			return res, fmt.Errorf("could not determine repo and owner from associated issue %d, got: %s",
+				issue.Number,
+				nwo,
+			)
+		}
+
+		err = closeIssue(ctx, githubV3, parts[0], parts[1], issue.Number)
+		if err != nil {
+			return res, fmt.Errorf("unable to close associated issue: %w", err)
+		}
+	}
+
+	return res, nil
+}
+
+// validate ensures that we've been given all required fields necessary to
+// perform the request.
+func (r *CloseCopiedOriginPullRequestReq) validate() error {
+	if r == nil {
+		return errors.New("failed to initialize request")
+	}
+
+	if r.Owner == "" {
+		return errors.New("no github owner has been provided")
+	}
+
+	if r.Repo == "" {
+		return errors.New("no github repository has been provided")
+	}
+
+	if r.PullNumber == 0 {
+		return errors.New("no github pull request number has been provided")
+	}
+
+	return nil
+}
+
+// copiedCommentBody is the markdown comment body that we'll attempt to set on
+// the copied pull request.
+func (r *CloseCopiedOriginPullRequestRes) copiedCommentBody(err error) string {
+	if r == nil {
+		return "no close copied origin pull request response has been initialized"
+	}
+
+	t := r.ToTable(err)
+	if err == nil {
+		t.SetTitle("Origin pull request and all associated issues have been closed!")
+		return t.RenderMarkdown()
+	}
+
+	if t.Length() == 0 {
+		// If we don't have any rows in our table then there's no need to render a
+		// table so we'll just return an error
+		return "## Closing origin pull request failed!\n\nError: " + err.Error()
+	}
+
+	// Render out our table but put the error message in the caption
+	t.SetTitle("Closing origin pull request failed!")
+	// Set the caption to the top-level error only as any attempt errors are
+	// nested in the table.
+	t.SetCaption("Error: " + err.Error())
+
+	return t.RenderMarkdown()
+}
+
+// originCommentBody is the markdown comment body that we'll attempt to set on
+// the origin pull request.
+func (r *CloseCopiedOriginPullRequestRes) originCommentBody(err error) string {
+	if r == nil {
+		return "no close copied origin pull request response has been initialized"
+	}
+
+	t := r.ToTable(err)
+	if err == nil {
+		t.SetTitle("Copied pull request has been merged!")
+		return t.RenderMarkdown()
+	}
+
+	if t.Length() == 0 {
+		// If we don't have any rows in our table then there's no need to render a
+		// table so we'll just return an error
+		return "## Copied pull request has been merged!\n\nError: " + err.Error()
+	}
+
+	// Render out our table but put the error message in the caption
+	t.SetTitle("Copy pull request failed!")
+	// Set the caption to the top-level error only as any attempt errors are
+	// nested in the table.
+	t.SetCaption("Error: " + err.Error())
+
+	return t.RenderMarkdown()
+}
+
+// ToJSON marshals the response to JSON.
+func (r *CloseCopiedOriginPullRequestRes) ToJSON() ([]byte, error) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling list changed files to JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToTable marshals the response to a text table.
+func (r *CloseCopiedOriginPullRequestRes) ToTable(err error) table.Writer {
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+
+	t.AppendHeader(table.Row{
+		"Origin Pull Request", "Copied Pull Request", "Commit SHA", "Error",
+	})
+	row := table.Row{
+		r.OriginPullRequest.GetHTMLURL(),
+		r.CopiedPullRequest.GetHTMLURL(),
+		fmt.Sprintf(
+			"https://github.com/%s/commit/%s",
+			r.CopiedPullRequest.GetHead().GetRepo().GetFullName(),
+			r.CopiedPullRequest.GetMergeCommitSHA(),
+		),
+	}
+	if err != nil {
+		row = append(row, err.Error())
+	}
+
+	t.AppendRow(row)
+
+	closedIssues := slices.CompactFunc(
+		append(r.OriginClosingIssues, r.CopiedClosingIssues...),
+		closingIssueRefEqual,
+	)
+	if len(closedIssues) > 0 {
+		urls := []string{}
+		for _, ci := range closedIssues {
+			urls = append(urls, ci.URL)
+		}
+		t.AppendFooter(table.Row{
+			"", "Closed Issues", strings.Join(urls, "\n"),
+		})
+	}
+
+	t.SuppressEmptyColumns()
+	t.SuppressTrailingSpaces()
+
+	return t
+}
diff --git a/tools/pipeline/internal/pkg/github/close_copied_origin_pull_request_test.go b/tools/pipeline/internal/pkg/github/close_copied_origin_pull_request_test.go
new file mode 100644
index 00000000000..a8c1d153aba
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/close_copied_origin_pull_request_test.go
@@ -0,0 +1,49 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/shurcooL/githubv4"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+)
+
+// TestAcc_AssociatedIssues does an actual request against a known PR to check
+// whether or not or query works as expected.
+func TestAcc_AssociatedIssues(t *testing.T) {
+	t.Parallel()
+
+	token, setToken := os.LookupEnv("GITHUB_TOKEN")
+	_, setACC := os.LookupEnv("PIPELINE_ACC")
+	if !setACC && setToken {
+		t.Skip("GITHUB_TOKEN and PIPELINE_ACC are not set")
+	}
+
+	github := githubv4.NewClient(
+		oauth2.NewClient(context.Background(),
+			oauth2.StaticTokenSource(&oauth2.Token{AccessToken: token}),
+		),
+	)
+
+	ai := &ClosingIssueRefs{}
+	require.NoError(t, github.Query(t.Context(), ai, map[string]any{
+		"owner":  githubv4.String("hashicorp"),
+		"repo":   githubv4.String("vault-enterprise"),
+		"number": githubv4.Int(9484),
+	}))
+
+	require.Equal(t, "hashicorp/vault-enterprise", ai.Repository.PullRequest.Repository.NameWithOwner)
+	require.Equal(t, 9484, ai.Repository.PullRequest.Number)
+	require.Len(t, ai.Repository.PullRequest.ClosingIssuesReferences.Edges, 1)
+	require.True(t, ai.Repository.PullRequest.ClosingIssuesReferences.Edges[0].Node.Closed)
+	require.Equal(t, 31545, ai.Repository.PullRequest.ClosingIssuesReferences.Edges[0].Node.Number)
+	require.Equal(t,
+		"https://github.com/hashicorp/vault/issues/31545",
+		ai.Repository.PullRequest.ClosingIssuesReferences.Edges[0].Node.URL,
+	)
+}
diff --git a/tools/pipeline/internal/pkg/github/commit.go b/tools/pipeline/internal/pkg/github/commit.go
new file mode 100644
index 00000000000..23d641b59ff
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/commit.go
@@ -0,0 +1,44 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"log/slog"
+
+	libgithub "github.com/google/go-github/v74/github"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// listCommitStatuses lists all of the statuses associated with a commit.
+func listCommitStatuses(
+	ctx context.Context,
+	github *libgithub.Client,
+	owner string,
+	repo string,
+	ref string,
+) ([]*libgithub.RepoStatus, error) {
+	ctx = slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.String("commit-ref", ref),
+	)
+	slog.Default().DebugContext(ctx, "listing commit statuses")
+
+	opts := &libgithub.ListOptions{PerPage: PerPageMax}
+	statuses := []*libgithub.RepoStatus{}
+	for {
+		ss, res, err := github.Repositories.ListStatuses(ctx, owner, repo, ref, opts)
+		if err != nil {
+			return nil, err
+		}
+		statuses = append(statuses, ss...)
+
+		if res.NextPage == 0 {
+			return statuses, nil
+		}
+
+		opts.Page = res.NextPage
+	}
+}
diff --git a/tools/pipeline/internal/pkg/github/copy_pull_request.go b/tools/pipeline/internal/pkg/github/copy_pull_request.go
new file mode 100644
index 00000000000..d5eb666e68f
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/copy_pull_request.go
@@ -0,0 +1,504 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"maps"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	libgithub "github.com/google/go-github/v74/github"
+	libgit "github.com/hashicorp/vault/tools/pipeline/internal/pkg/git"
+	"github.com/jedib0t/go-pretty/v6/table"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// CopyPullRequestReq is a request to copy a pull request from the CE repo to
+// the Ent repo.
+type CopyPullRequestReq struct {
+	FromOwner       string
+	FromRepo        string
+	FromOrigin      string
+	ToOwner         string
+	ToRepo          string
+	ToOrigin        string
+	PullNumber      uint
+	RepoDir         string
+	EntBranchSuffix string // add +ent to release/* branches
+}
+
+// CopyPullRequestRes is a copy pull request response.
+type CopyPullRequestRes struct {
+	Error             error                         `json:"error,omitempty"`
+	Request           *CopyPullRequestReq           `json:"request,omitempty"`
+	OriginPullRequest *libgithub.PullRequest        `json:"origin_pull_request,omitempty"`
+	PullRequest       *libgithub.PullRequest        `json:"pull_request,omitempty"`
+	Comment           *libgithub.IssueComment       `json:"comment,omitempty"`
+	SkippedCommits    []*libgithub.RepositoryCommit `json:"skipped_commits,omitempty"`
+}
+
+// Run runs the request to copy a pull request from the CE repo to the Ent repo.
+func (r *CopyPullRequestReq) Run(
+	ctx context.Context,
+	github *libgithub.Client,
+	git *libgit.Client,
+) (*CopyPullRequestRes, error) {
+	var err error
+	res := &CopyPullRequestRes{
+		Request:        r,
+		SkippedCommits: []*libgithub.RepositoryCommit{},
+	}
+
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("from-owner", r.FromOwner),
+		slog.String("from-repo", r.FromRepo),
+		slog.String("from-origin", r.FromOrigin),
+		slog.String("to-owner", r.ToOwner),
+		slog.String("to-repo", r.ToRepo),
+		slog.String("to-origin", r.ToOrigin),
+		slog.String("repo-dir", r.RepoDir),
+		slog.Uint64("pull-number", uint64(r.PullNumber)),
+		slog.String("ent-branch-suffix", r.EntBranchSuffix),
+	), "copying pull request")
+
+	initialDir, err := os.Getwd()
+	if err != nil {
+		return res, fmt.Errorf("getting current working directory: %w", err)
+	}
+
+	// Whenever possible we try to update base pull request with a status update
+	// on how the copying has gone.
+	createComment := func() {
+		// Make sure we return a response even if we fail
+		if res == nil {
+			res = &CopyPullRequestRes{Request: r}
+		}
+
+		// Set any known errors on the response before we create a comment, as the
+		// error will be used in the comment body if present.
+		err = errors.Join(err, os.Chdir(initialDir))
+		var err1 error
+		res.Comment, err1 = createPullRequestComment(
+			ctx,
+			github,
+			r.FromOwner,
+			r.FromRepo,
+			int(r.PullNumber),
+			res.CommentBody(err),
+		)
+
+		// Set our finalized error on our response and also update our returned error
+		err = errors.Join(err, err1)
+	}
+	defer createComment()
+
+	// Make sure we have required and valid fields
+	err = r.Validate(ctx)
+	if err != nil {
+		return res, err
+	}
+
+	// Make sure we've been given a valid location for a repo and/or create a
+	// temporary one
+	var tmpDir bool
+	r.RepoDir, err, tmpDir = ensureGitRepoDir(ctx, r.RepoDir)
+	if err != nil {
+		return res, err
+	}
+	if tmpDir {
+		defer os.RemoveAll(r.RepoDir)
+	}
+
+	// Get our pull request details
+	res.OriginPullRequest, err = getPullRequest(
+		ctx, github, r.FromOwner, r.FromRepo, int(r.PullNumber),
+	)
+	if err != nil {
+		return res, err
+	}
+
+	// Determine our pull request base ref. Handle the fact that enterprise
+	// release branches contain the +ent suffix.
+	baseRef := res.OriginPullRequest.GetBase().GetRef()
+	if strings.HasPrefix(baseRef, "release/") {
+		baseRef = baseRef + r.EntBranchSuffix
+	}
+
+	// Clone the remote repository and fetch the base ref, which is the branch our
+	// pull request was created against. This will change our working directory
+	// into RepoDir
+	_, err = os.Stat(filepath.Join(r.RepoDir, ".git"))
+	if err == nil {
+		err = initializeExistingRepo(
+			ctx, git, r.RepoDir, r.ToOrigin, baseRef,
+		)
+	} else {
+		err = initializeNewRepo(
+			ctx, git, r.RepoDir, r.ToOwner, r.ToRepo, r.ToOrigin, baseRef,
+		)
+	}
+	if err != nil {
+		return res, err
+	}
+
+	prBranch := res.OriginPullRequest.GetHead().GetRef()
+
+	// Add our from upstream as a remote and fetch our PR branch
+	slog.Default().DebugContext(ctx, "adding CE upstream and fetching PR branch")
+	remoteRes, err := git.Remote(ctx, &libgit.RemoteOpts{
+		Command: libgit.RemoteCommandAdd,
+		Track:   []string{prBranch},
+		Fetch:   true,
+		Name:    r.FromOrigin,
+		URL:     res.OriginPullRequest.GetHead().GetRepo().GetCloneURL(),
+	})
+	if err != nil {
+		err = fmt.Errorf("fetching target branch base ref: %s, %w", remoteRes.String(), err)
+		return res, err
+	}
+
+	// Create a new branch for our copied changes. Encode the details of our origin
+	// pull request into the branch name so that future post-merge operations can
+	// determine the origin PR using only the branch name.
+	branchName := encodeCopyPullRequestBranch(r.FromOwner, r.FromRepo, r.PullNumber, prBranch)
+	// We don't have local references so create a new branch from our tracking branch
+	baseBranch := "remotes/" + r.ToOrigin + "/" + baseRef
+	slog.Default().DebugContext(ctx, "checking out new copy branch")
+	checkoutRes, err := git.Checkout(ctx, &libgit.CheckoutOpts{
+		NewBranchForceCheckout: branchName, // -B
+		Branch:                 baseBranch,
+	})
+	if err != nil {
+		return res, fmt.Errorf("checking out new copy branch: %s: %w", checkoutRes.String(), err)
+	}
+
+	// Get a list of commits we're going to cherry-pick into our new branch.
+	commits, err := listPullRequestCommits(ctx, github, r.FromOwner, r.FromRepo, int(r.PullNumber))
+	if err != nil {
+		return res, err
+	}
+
+	// Generate an empty commit message that includes 'Co-Authored-By:' trailers
+	// in the commit message. As we always squash all commits into a single merge
+	// commit this helps to retain attribution for our source author(s).
+	commitMessageFile, err := renderEmbeddedTemplateToTmpFile("copy-pr-commit-message.tmpl", struct {
+		CoAuthoredByTrailers []string
+		OriginPullRequest    *libgithub.PullRequest
+		TargetRef            string
+	}{
+		r.getCoAuthoredByTrailers(commits),
+		res.OriginPullRequest,
+		baseRef,
+	})
+	if err != nil {
+		return res, fmt.Errorf("creating copy attribution commit message: %w", err)
+	}
+	defer func() {
+		commitMessageFile.Close()
+		_ = os.Remove(commitMessageFile.Name())
+	}()
+
+	attrCommitRes, err := git.Commit(ctx, &libgit.CommitOpts{
+		AllowEmpty: true,
+		File:       commitMessageFile.Name(),
+		NoVerify:   true,
+		NoEdit:     true,
+	})
+	if err != nil {
+		return res, fmt.Errorf("committing attribution: %s: %w", attrCommitRes.String(), err)
+	}
+
+	slog.Default().DebugContext(ctx, "cherry-picking CE PR branch commits into new copy branch")
+	var cherryPickErr error
+	var cherryPickRes *libgit.ExecResponse
+	for _, commit := range commits {
+		// We only want to cherry-pick non-merge commits. To determine that we'll
+		// see if the commit has more than one parent and skip it if it does.
+		cherryPickRes, cherryPickErr = git.Show(ctx, &libgit.ShowOpts{
+			Format: "%ph",
+			Quiet:  true,
+			Object: commit.GetSHA(),
+		})
+		if cherryPickErr != nil {
+			break
+		}
+
+		parents := strings.TrimSpace(string(cherryPickRes.Stdout))
+		if len(strings.Split(parents, " ")) > 1 {
+			slog.Default().DebugContext(slogctx.Append(ctx,
+				slog.String("sha", commit.GetSHA()),
+				slog.String("parents", parents),
+			), "skipping merge commit")
+
+			res.SkippedCommits = append(res.SkippedCommits, commit)
+
+			continue
+		}
+
+		cherryPickRes, cherryPickErr = git.CherryPick(ctx, &libgit.CherryPickOpts{
+			FF:       true,
+			Empty:    libgit.EmptyCommitKeep,
+			Commit:   commit.GetSHA(),
+			Strategy: libgit.MergeStrategyORT,
+			StrategyOptions: []libgit.MergeStrategyOption{
+				libgit.MergeStrategyOptionTheirs,
+				libgit.MergeStrategyOptionIgnoreSpaceChange,
+			},
+		})
+		if cherryPickErr != nil {
+			break
+		}
+	}
+
+	if cherryPickErr != nil {
+		cherryPickErr = fmt.Errorf(
+			"cherry-picking CE PR branch commits into new copy branch: %s: %w",
+			cherryPickRes.String(),
+			cherryPickErr,
+		)
+	}
+
+	// If our merge failed we still want to create a pull request for our
+	// failed copy so that a manual fix can be performed.
+	if cherryPickErr != nil {
+		err := resetAndCreateNOOPCommit(ctx, git, baseBranch)
+		if err != nil {
+			err = errors.Join(cherryPickErr, err)
+
+			// Something wen't wrong trying to create our no-op commit. There's
+			// nothing more we can do but return our error at this point.
+			return res, err
+		}
+	}
+
+	slog.Default().DebugContext(ctx, "pushing new branch to enterprise")
+	pushRes, err := git.Push(ctx, &libgit.PushOpts{
+		Repository: r.ToOrigin,
+		Refspec:    []string{branchName},
+	})
+	if err != nil {
+		err = fmt.Errorf("pushing copied branch: %s: %w", pushRes.String(), err)
+		return res, errors.Join(cherryPickErr, err)
+	}
+
+	prTitle := fmt.Sprintf("Copy %s into %s", res.OriginPullRequest.GetTitle(), baseRef)
+	prBody, err := renderEmbeddedTemplate("copy-pr-message.tmpl", struct {
+		Error             error
+		OriginPullRequest *libgithub.PullRequest
+		TargetRef         string
+	}{
+		cherryPickErr,
+		res.OriginPullRequest,
+		baseRef,
+	})
+	if err != nil {
+		err = fmt.Errorf("creating copy pull request body %w", err)
+		return res, errors.Join(cherryPickErr, err)
+	}
+
+	res.PullRequest, _, err = github.PullRequests.Create(
+		ctx, r.ToOwner, r.ToRepo, &libgithub.NewPullRequest{
+			Title:    &prTitle,
+			Head:     &branchName,
+			HeadRepo: &r.ToRepo,
+			Base:     &baseRef,
+			Body:     &prBody,
+		},
+	)
+	if err != nil {
+		err = fmt.Errorf("creating copy pull request %w", err)
+		return res, errors.Join(cherryPickErr, err)
+	}
+
+	// Assign the pull request to the actor that was assigned the original
+	// pull request and anybody that approved it.
+	reviews, err := listPullRequestReviews(ctx, github, r.FromOwner, r.FromRepo, int(r.PullNumber))
+	if err != nil {
+		return res, err
+	}
+	err = addAssignees(
+		ctx,
+		github,
+		r.ToOwner,
+		r.ToRepo,
+		int(res.PullRequest.GetNumber()),
+		append(r.getApproverLogins(reviews), res.OriginPullRequest.GetAssignee().GetLogin()),
+	)
+	if err != nil {
+		err = fmt.Errorf("assigning ownership to copy pull request %w", err)
+		return res, errors.Join(cherryPickErr, err)
+	}
+
+	return res, nil
+}
+
+// Validate ensures that we've been given the minimum filter arguments necessary to complete a
+// request. It is always recommended that additional fitlers be given to reduce the response size
+// and not exhaust API limits.
+func (r *CopyPullRequestReq) Validate(ctx context.Context) error {
+	if r == nil {
+		return errors.New("failed to initialize request")
+	}
+
+	if r.FromOrigin == "" {
+		return errors.New("no github from origin has been provided")
+	}
+
+	if r.FromOwner == "" {
+		return errors.New("no github from owner has been provided")
+	}
+
+	if r.FromRepo == "" {
+		return errors.New("no github from repository has been provided")
+	}
+
+	if r.ToOrigin == "" {
+		return errors.New("no github to origin has been provided")
+	}
+
+	if r.ToOwner == "" {
+		return errors.New("no github to owner has been provided")
+	}
+
+	if r.ToRepo == "" {
+		return errors.New("no github to repository has been provided")
+	}
+
+	if r.PullNumber == 0 {
+		return errors.New("no github pull request number has been provided")
+	}
+
+	return nil
+}
+
+// CommentBody is the markdown comment body that we'll attempt to set on the
+// pull request
+func (r *CopyPullRequestRes) CommentBody(err error) string {
+	if r == nil {
+		return "no copy pull request response has been initialized"
+	}
+
+	t := r.ToTable(err)
+	if err == nil {
+		t.SetTitle("Copy workflow completed!")
+		return t.RenderMarkdown()
+	}
+
+	if t.Length() == 0 {
+		// If we don't have any rows in our table then there's no need to render a
+		// table so we'll just return an error
+		return "## Copying pull request failed!\n\nError: " + err.Error()
+	}
+
+	// Render out our table but put the error message in the caption
+	t.SetTitle("Copy pull request failed!")
+	// Set the caption to the top-level error only as any attempt errors are
+	// nested in the table.
+	t.SetCaption("Error: " + err.Error())
+
+	return t.RenderMarkdown()
+}
+
+// ToJSON marshals the response to JSON.
+func (r *CopyPullRequestRes) ToJSON() ([]byte, error) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling list changed files to JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToTable marshals the response to a text table.
+func (r *CopyPullRequestRes) ToTable(err error) table.Writer {
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+	t.AppendHeader(table.Row{
+		"From", "To", "Skipped Merge Commits", "Error",
+	})
+
+	row := table.Row{nil, nil}
+	if r.Request != nil {
+		from := r.Request.FromOwner + "/" + r.Request.FromRepo
+		if pr := r.OriginPullRequest; pr != nil {
+			from = fmt.Sprintf("[%s#%d](%s)", from, pr.GetNumber(), pr.GetHTMLURL())
+		}
+		to := r.Request.ToOwner + "/" + r.Request.ToRepo
+		if pr := r.PullRequest; pr != nil {
+			to = fmt.Sprintf("[%s#%d](%s)", to, pr.GetNumber(), pr.GetHTMLURL())
+		}
+		row = table.Row{from, to, len(r.SkippedCommits)}
+	}
+	if err != nil {
+		row = append(row, err.Error())
+	} else {
+		row = append(row, nil)
+	}
+	t.AppendRow(row)
+
+	t.SuppressEmptyColumns()
+	t.SuppressTrailingSpaces()
+
+	return t
+}
+
+func (r *CopyPullRequestReq) getCoAuthoredByTrailers(commits []*libgithub.RepositoryCommit) []string {
+	if len(commits) < 1 {
+		return nil
+	}
+
+	seen := map[string]struct{}{}
+	trailers := []string{}
+
+	for _, repoCommit := range commits {
+		commit := repoCommit.GetCommit()
+		if commit == nil {
+			continue
+		}
+		author := commit.GetAuthor()
+		if author == nil {
+			continue
+		}
+		email := author.GetEmail()
+		if email == "" {
+			continue
+		}
+		if _, ok := seen[email]; ok {
+			continue
+		}
+		seen[email] = struct{}{}
+		trailers = append(trailers, fmt.Sprintf("Co-Authored-By: %s <%s>", author.GetName(), email))
+	}
+
+	return trailers
+}
+
+func (r *CopyPullRequestReq) getApproverLogins(reviews []*libgithub.PullRequestReview) []string {
+	if len(reviews) < 1 {
+		return nil
+	}
+
+	logins := map[string]struct{}{}
+	for _, review := range reviews {
+		if review == nil || review.State == nil || *review.State != "APPROVED" {
+			continue
+		}
+		if login := review.GetUser().GetLogin(); login != "" {
+			logins[login] = struct{}{}
+		}
+	}
+
+	return slices.Sorted(maps.Keys(logins))
+}
diff --git a/tools/pipeline/internal/pkg/github/copy_pull_request_branch.go b/tools/pipeline/internal/pkg/github/copy_pull_request_branch.go
new file mode 100644
index 00000000000..baaebb0e2e1
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/copy_pull_request_branch.go
@@ -0,0 +1,126 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// copyBranchPrefix is the prefix for copied pull request branches. It is used
+// both for copying pull requests and for closing copied pull requests.
+const copyBranchPrefix = "copy"
+
+// encodeCopyPullRequestBranch returns the branch name to use for our PR copy operation.
+// The branch name is important because we trigger post-merge automation based
+// on the branch prefix. We also encode origin PR information for use in
+// post-merge operations.
+//
+// The format is: <copy-branch-prefix>/<owner>/<repo>/<pr>/<pr-branch-name>
+// eg: copy/hashicorp/vault/99999/my-feature-branch
+//
+// This informs the post-merge close operations that the Pull Request was originally
+// copied from hashicorp/vault's Pull Request number 99999 and that the branch
+// name of the pull request is my-feature-branch.
+//
+// It's imporant that both the encodeCopyPullRequestBranch and decodeCopyPullRequestBranch
+// stay in sync.
+func encodeCopyPullRequestBranch(
+	owner string,
+	repo string,
+	number uint,
+	prBranch string,
+) string {
+	prNumber := strconv.Itoa(int(number))
+	name := strings.Join([]string{
+		copyBranchPrefix,
+		owner,
+		repo,
+		prNumber,
+		prBranch,
+	}, "/")
+	if len(name) > 250 {
+		// Handle Githubs branch name max length
+		name = name[:250]
+	}
+
+	return name
+}
+
+// decodeCopyPullRequestBranch returns the encoded origin PR details from the
+// copied Pull Request branch name.
+//
+// The format must be the same as what is described in encodeCopyPullRequestBranch()
+func decodeCopyPullRequestBranch(ref string) (
+	owner string,
+	repo string,
+	number uint,
+	branch string,
+	err error,
+) {
+	if ref == "" {
+		err = errors.New("no copy branch provided")
+		return owner, repo, number, branch, err
+	}
+
+	if !strings.HasPrefix(ref, copyBranchPrefix) {
+		err = fmt.Errorf("invalid copy branch: branch does not start with %s", copyBranchPrefix)
+		return owner, repo, number, branch, err
+	}
+
+	// eg: copy/hashicorp/vault/99999/my-feature-branch
+	parts := strings.SplitN(ref, "/", 5)
+	if len(parts) < 5 {
+		err = fmt.Errorf("invalid copy branch: expected 5 parts, got %d", len(parts))
+		return owner, repo, number, branch, err
+	}
+	owner = parts[1]
+	repo = parts[2]
+
+	var signedNumber int
+	signedNumber, err = strconv.Atoi(parts[3])
+	if err != nil {
+		err = fmt.Errorf("invalid copy branch: pull request number is not a number: %w", err)
+		return owner, repo, number, branch, err
+	}
+	if signedNumber < 0 {
+		err = fmt.Errorf("invalid copy branch: number must be positive, got %d", signedNumber)
+		return owner, repo, number, branch, err
+	}
+	number = uint(signedNumber)
+
+	branch = parts[4]
+
+	return owner, repo, number, branch, err
+}
+
+func closingIssueRefEqual(a, b *ClosingIssueRef) bool {
+	if a == nil && b == nil {
+		return true
+	}
+
+	if (a == nil && b != nil) || (a != nil && b == nil) {
+		return false
+	}
+
+	if a.URL != b.URL {
+		return false
+	}
+
+	if a.Number != b.Number {
+		return false
+	}
+
+	if a.Title != b.Title {
+		return false
+	}
+
+	if a.Repository.NameWithOwner != b.Repository.NameWithOwner {
+		return false
+	}
+
+	return true
+}
diff --git a/tools/pipeline/internal/pkg/github/copy_pull_request_test.go b/tools/pipeline/internal/pkg/github/copy_pull_request_test.go
new file mode 100644
index 00000000000..558dbde64aa
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/copy_pull_request_test.go
@@ -0,0 +1,86 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"testing"
+
+	libgithub "github.com/google/go-github/v74/github"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_CopyPullRequest_getCoAuthoredByTrailers(t *testing.T) {
+	t.Parallel()
+
+	for name, test := range map[string]struct {
+		commits  []*libgithub.RepositoryCommit
+		expected []string
+	}{
+		"no commits": {
+			nil,
+			nil,
+		},
+		"one author one commit": {
+			[]*libgithub.RepositoryCommit{
+				{Commit: &libgithub.Commit{Author: &libgithub.CommitAuthor{
+					Name:  libgithub.Ptr("John Doe"),
+					Email: libgithub.Ptr("john@example.com"),
+				}}},
+			},
+			[]string{"Co-Authored-By: John Doe <john@example.com>"},
+		},
+		"one author multiple commits": {
+			[]*libgithub.RepositoryCommit{
+				{Commit: &libgithub.Commit{Author: &libgithub.CommitAuthor{
+					Name:  libgithub.Ptr("John Doe"),
+					Email: libgithub.Ptr("john@example.com"),
+				}}},
+				{Commit: &libgithub.Commit{Author: &libgithub.CommitAuthor{
+					Name:  libgithub.Ptr("John Doe"),
+					Email: libgithub.Ptr("john@example.com"),
+				}}},
+			},
+			[]string{"Co-Authored-By: John Doe <john@example.com>"},
+		},
+		"multiple authors with one commit each": {
+			[]*libgithub.RepositoryCommit{
+				{Commit: &libgithub.Commit{Author: &libgithub.CommitAuthor{
+					Name:  libgithub.Ptr("John Doe"),
+					Email: libgithub.Ptr("john@example.com"),
+				}}},
+				{Commit: &libgithub.Commit{Author: &libgithub.CommitAuthor{
+					Name:  libgithub.Ptr("Jane Doe"),
+					Email: libgithub.Ptr("jane@example.com"),
+				}}},
+			},
+			[]string{"Co-Authored-By: John Doe <john@example.com>", "Co-Authored-By: Jane Doe <jane@example.com>"},
+		},
+		"multiple authors with multiple commits": {
+			[]*libgithub.RepositoryCommit{
+				{Commit: &libgithub.Commit{Author: &libgithub.CommitAuthor{
+					Name:  libgithub.Ptr("John Doe"),
+					Email: libgithub.Ptr("john@example.com"),
+				}}},
+				{Commit: &libgithub.Commit{Author: &libgithub.CommitAuthor{
+					Name:  libgithub.Ptr("Jane Doe"),
+					Email: libgithub.Ptr("jane@example.com"),
+				}}},
+				{Commit: &libgithub.Commit{Author: &libgithub.CommitAuthor{
+					Name:  libgithub.Ptr("Jane Doe"),
+					Email: libgithub.Ptr("jane@example.com"),
+				}}},
+				{Commit: &libgithub.Commit{Author: &libgithub.CommitAuthor{
+					Name:  libgithub.Ptr("John Doe"),
+					Email: libgithub.Ptr("john@example.com"),
+				}}},
+			},
+			[]string{"Co-Authored-By: John Doe <john@example.com>", "Co-Authored-By: Jane Doe <jane@example.com>"},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			req := &CopyPullRequestReq{}
+			require.EqualValues(t, test.expected, req.getCoAuthoredByTrailers(test.commits))
+		})
+	}
+}
diff --git a/tools/pipeline/internal/pkg/github/create_backport.go b/tools/pipeline/internal/pkg/github/create_backport.go
new file mode 100644
index 00000000000..4dc5bf8c243
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/create_backport.go
@@ -0,0 +1,1062 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"maps"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	libgithub "github.com/google/go-github/v74/github"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/changed"
+	libgit "github.com/hashicorp/vault/tools/pipeline/internal/pkg/git"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/releases"
+	"github.com/jedib0t/go-pretty/v6/table"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// CreateBackportReq is a request to create a backport pull request from another
+// pull request. The request has been designed to work when triggered in a
+// Github Actions workflow where the only required values are present in the
+// github event context. That assumes a pull request event:
+//
+//	pull_request_target:
+//	  types: closed
+//
+// The request ought to be guarded so as to nominally trigger only on merges:
+//
+//	if: github.even.pull_request.merged"
+//
+// See Run() for more details around how the request determines which branches
+// to backport to, whether or not the backport commits need to be amended for
+// excluded CE files, or whether or not the backport can be skipped entirely.
+//
+// NOTE: At this time the request only supports a single squashed merge commit.
+type CreateBackportReq struct {
+	// The Github Owner. E.g. "hashicorp"
+	Owner string
+	// The Github Repo. E.g. "vault-enterprise"
+	Repo string
+	// The Pull Request ID Number of the PR that we wish to backport.
+	PullNumber uint
+	// BaseOrigin is the name of the remote for the base ref of the pull request.
+	// E.g. "origin".
+	BaseOrigin string
+
+	// The local directory where to clone the repository:
+	//    https://github.com/<Owner>/<Repo>.git.
+	// If the directory is configured it either must exist. When unset, a
+	// temporary directory will be created and used automatically.
+	RepoDir string
+
+	// ReleaseVersionConfigPath is the path to .release/versions.hcl. We use this
+	// file to determine which branches are active so that we can automatically
+	// determine which origins to backport depending on the given tags.
+	ReleaseVersionConfigPath string
+	// ReleaseRecurseDepth defined how many directories back we're allowed to
+	// scan to search for .release/versions.hcl. This is incompatible with
+	// ReleaseVersionConfigPath.
+	ReleaseRecurseDepth uint
+
+	// CEExclude are changed files groups for files that ought to be excluded
+	// when creating CE backports. E.g. ["enterprise"]
+	CEExclude changed.FileGroups
+	// CEBranchPrefix is the prefix used for CE branches. E.g. "ce"
+	CEBranchPrefix string
+	// CEAllowInactiveGroups are changed file groups for files that ought to be
+	// allowed to be backported to inactive CE branches. Eg. ["docs", "pipeline"]
+	CEAllowInactiveGroups changed.FileGroups
+
+	// NOTE: The following fields are for testing purposes only and might be
+	// removed after the cutover to the new workflow.
+
+	// EntBranchPrefix is an ent branch prefix. This is only used for testing
+	// before we migrate to the tool full time.
+	EntBranchPrefix string
+
+	// BackportLabelPrefix is the backport label prefix. E.g. "backport". This
+	// should only be used for testing before the new workflow is active.
+	BackportLabelPrefix string
+}
+
+// NewCreateBackportReqOpt is a functional option to set fields when calling
+// NewCreateBackportPRReq()
+type NewCreateBackportReqOpt func(*CreateBackportReq)
+
+// CreateBackportRes is a respose of creating a backport pull request
+type CreateBackportRes struct {
+	OriginPullRequest *libgithub.PullRequest            `json:"origin_pull_request,omitempty"`
+	Branch            string                            `json:"branch,omitempty"`
+	Attempts          map[string]*CreateBackportAttempt `json:"attempts,omitempty"`
+	Comment           *libgithub.IssueComment           `json:"comment,omitempty"`
+	Error             error                             `json:"-"`
+	// Use a separate field so we marshal the error message to a string value
+	ErrorMessage string `json:"error,omitempty"`
+}
+
+// Labels are just a collection of github labels that we have created various
+// helper functions for.
+type Labels []*libgithub.Label
+
+// CreateBackportAttempt is an attempt at creating a backport for target
+// branch reference.
+type CreateBackportAttempt struct {
+	BaseRef       string                 `json:"base_ref,omitempty"`
+	TargetRef     string                 `json:"target_ref,omitempty"`
+	Error         error                  `json:"error,omitempty"`
+	Skipped       bool                   `json:"skipped,omitempty"`
+	SkippedReason string                 `json:"skipped_reason,omitempty"`
+	PullRequest   *libgithub.PullRequest `json:"pull_request,omitempty"`
+}
+
+// NewCreateBackportReq takes variable options and returns a new
+// CreateBackportPRReq.
+func NewCreateBackportReq(opts ...NewCreateBackportReqOpt) *CreateBackportReq {
+	req := &CreateBackportReq{
+		Owner:               "hashicorp",
+		Repo:                "vault-enterprise",
+		ReleaseRecurseDepth: 3,
+		CEExclude:           changed.FileGroups{changed.FileGroupEnterprise},
+		CEBranchPrefix:      "ce",
+		CEAllowInactiveGroups: changed.FileGroups{
+			changed.FileGroupChangelog,
+		},
+		BaseOrigin:          "origin",
+		BackportLabelPrefix: "backport",
+	}
+
+	for _, opt := range opts {
+		opt(req)
+	}
+
+	return req
+}
+
+// WithCreateBackportReqOwner sets the Owner
+func WithCreateBackportReqOwner(owner string) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.Owner = owner
+	}
+}
+
+// WithCreateBrackportReqRepo sets the Repo
+func WithCreateBrackportReqRepo(repo string) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.Repo = repo
+	}
+}
+
+// WithCreateBrackportReqRepoDir sets the RepoDir
+func WithCreateBrackportReqRepoDir(dir string) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.RepoDir = dir
+	}
+}
+
+// WithCreateBrackportReqPullNumber sets the PullNumber
+func WithCreateBrackportReqPullNumber(number uint) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.PullNumber = number
+	}
+}
+
+// WithCreateBrackportReqBaseOrigin sets the BaseOrigin
+func WithCreateBrackportReqBaseOrigin(origin string) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.BaseOrigin = origin
+	}
+}
+
+// WithCreateBrackportReqReleaseRecurseDepth sets the ReleaseRecurseDepth
+func WithCreateBrackportReqReleaseRecurseDepth(depth uint) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.ReleaseRecurseDepth = depth
+	}
+}
+
+// WithCreateBrackportReqCEExclude sets the CEExclude
+func WithCreateBrackportReqCEExclude(exclude changed.FileGroups) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.CEExclude = exclude
+	}
+}
+
+// WithCreateBrackportReqCEBranchPrefix sets the CEBranchPrefix
+func WithCreateBrackportReqCEBranchPrefix(prefix string) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.CEBranchPrefix = prefix
+	}
+}
+
+// WithCreateBrackportReqAllowInactiveGroups sets the CEAllowInactiveGroups
+func WithCreateBrackportReqAllowInactiveGroups(groups changed.FileGroups) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.CEAllowInactiveGroups = groups
+	}
+}
+
+// WithCreateBrackportReqEntBranchPrefix sets the EntBranchPrefix
+func WithCreateBrackportReqEntBranchPrefix(prefix string) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.EntBranchPrefix = prefix
+	}
+}
+
+// WithCreateBrackportReqBackportLabelPrefix sets the BackportLabelPrefix
+func WithCreateBrackportReqBackportLabelPrefix(prefix string) NewCreateBackportReqOpt {
+	return func(req *CreateBackportReq) {
+		req.BackportLabelPrefix = prefix
+	}
+}
+
+// Run runs the backport request to create backports for every target branch
+// as needed.
+//
+// If the base references is to an enteprise branch, that is, the base reference
+// branch does not contain the CEBranchPrefix, then a backport to the
+// corresponding CE branch is assumed and will be created.
+//
+// If the base reference is to a CE branch then backports are only created if
+// there are backport labels present.
+//
+// Backport labels should be listed in the same schema as .release/versions.hcl:
+// E.g. "release/1.19.x". The correct backport branches will be used depending
+// on whether or not base branch of the PR is enteprise or CE.
+//
+// Enterprise branches will only ever backport to the corresponding ce branch
+// and to other enterprise branches. When those enterprise branches are merged
+// we'll create the CE backports.
+//
+// There are many factors to conside when backporting to a CE branch. The
+// request will automatically inspect the changed files of a PR to determine
+// if the PR contains non-enterprise files that need to be backported. In the
+// event we've only changed enterprise files we'll skip the CE backport.
+// If we've changed both enterprise and non-enterprise files the backport will
+// automatically remove the enterprise files.
+//
+// We also factor in whether or not a CE branch is "active". If the branch is
+// inactive we'll skip backporting unless the change includes docs, pipeline
+// changes, or README changes. This allows docs authors to write docs against
+// enteprise branches and have them backported without having to do it manually.
+//
+// We also do our best to update the source pull request with a comment that
+// outlines each backport and its status.
+//
+// This request designed to always return a response, even if things go wrong.
+// We will always attempt to run all backport references even if some fail.
+// As such we don't return an error here but do embed them in the response for
+// more control and precise handling. Callers should use Err() on the response
+// to get a singular error, or they can inspect the Error field for each
+// backport attempt.
+func (r *CreateBackportReq) Run(
+	ctx context.Context,
+	github *libgithub.Client,
+	git *libgit.Client,
+) (res *CreateBackportRes) {
+	res = &CreateBackportRes{Attempts: map[string]*CreateBackportAttempt{}}
+
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("owner", r.Owner),
+		slog.String("repo", r.Repo),
+		slog.String("repo-dir", r.RepoDir),
+		slog.Uint64("pull-number", uint64(r.PullNumber)),
+		slog.String("base-origin", r.BaseOrigin),
+		slog.String("config-path", r.ReleaseVersionConfigPath),
+		slog.Uint64("config-path-recurse-depth", uint64(r.ReleaseRecurseDepth)),
+		slog.String("ce-branch-prefix", r.CEBranchPrefix),
+		slog.String("ce-allow-inactive", strings.Join(r.CEAllowInactiveGroups.Groups(), ",")),
+		slog.String("ce-exclude", strings.Join(r.CEExclude.Groups(), ",")),
+		slog.String("ent-branch-prefix", r.EntBranchPrefix),
+		slog.String("backport-label-prefix", r.BackportLabelPrefix),
+	), "running create backport pr request")
+
+	initialDir, err := os.Getwd()
+	if err != nil {
+		res.Error = fmt.Errorf("getting current working directory: %w", err)
+		return res
+	}
+
+	// Whenever possible we try to update base pull request with a status update
+	// on how the backporting has gone.
+	defer func() {
+		// Make sure we return a response even if we fail
+		if res == nil {
+			res = &CreateBackportRes{}
+		}
+
+		// Set any known errors on the response before we create a comment, as the
+		// error will be used in the comment body if present.
+		res.Error = errors.Join(res.Error, os.Chdir(initialDir))
+		var err1 error
+		res.Comment, err1 = createPullRequestComment(
+			ctx, github, r.Owner, r.Repo, int(r.PullNumber), res.CommentBody(),
+		)
+
+		// Set our finalized error on our response and also update our returned error
+		res.Error = errors.Join(res.Error, err1)
+	}()
+
+	// Make sure we have required and valid fields
+	res.Error = r.Validate(ctx)
+	if res.Error != nil {
+		return res
+	}
+
+	// Make sure we've been given a valid location for a repo and/or create a
+	// temporary one
+	var tmpDir bool
+	r.RepoDir, res.Error, tmpDir = ensureGitRepoDir(ctx, r.RepoDir)
+	if res.Error != nil {
+		return res
+	}
+	if tmpDir {
+		defer os.RemoveAll(r.RepoDir)
+	}
+
+	// Get our pull request details
+	res.OriginPullRequest, res.Error = getPullRequest(
+		ctx, github, r.Owner, r.Repo, int(r.PullNumber),
+	)
+	if res.Error != nil {
+		return res
+	}
+
+	// Make sure our PR is merged and has a merge SHA
+	if !res.OriginPullRequest.GetMerged() {
+		res.Error = errors.New("cannot backport unmerged PR")
+		return res
+	}
+	if res.OriginPullRequest.GetMergeCommitSHA() == "" {
+		res.Error = errors.New("no merge commit SHA is associated with the PR")
+		return res
+	}
+
+	// Determine which CE branches are active. Do this before we change our
+	// working directory since the path given could be relative to the original
+	// path.
+	var activeVersions map[string]*releases.Version
+	activeVersions, res.Error = r.getActiveVersions(ctx)
+	if res.Error != nil {
+		return res
+	}
+
+	// Clone the remote repository and fetch the base ref, which is the branch our
+	// pull request was created against. These will change our working directory
+	// into RepoDir
+	baseRef := res.OriginPullRequest.GetBase().GetRef()
+	_, err = os.Stat(filepath.Join(r.RepoDir, ".git"))
+	if err == nil {
+		res.Error = initializeExistingRepo(
+			ctx, git, r.RepoDir, r.BaseOrigin, baseRef,
+		)
+	} else {
+		res.Error = initializeNewRepo(
+			ctx, git, r.RepoDir, r.Owner, r.Repo, r.BaseOrigin, baseRef,
+		)
+	}
+	if res.Error != nil {
+		return res
+	}
+
+	// Get the list of changed files and determine if our PR modified any files
+	// in CEExclude.
+	var changedFiles *ListChangedFilesRes
+	changedFiles, res.Error = r.getChangedFiles(ctx, github)
+	if res.Error != nil {
+		return res
+	}
+
+	// Determine base references we want to backport and create backports for each
+	// reference. In cases where the reference starts with the CEBranchPrefix then
+	// we'll remove any files that are in exclude groups.
+	for _, ref := range r.determineBackportRefs(ctx, baseRef, res.OriginPullRequest.Labels) {
+		res.Attempts[ref] = r.backportRef(
+			ctx, git, github, res.OriginPullRequest, activeVersions, changedFiles, ref,
+		)
+
+		if attempt := res.Attempts[ref]; attempt != nil && attempt.Error != nil {
+			// Something went wrong attempting to backport the reference. Reset our
+			// repository to ensure that our next attempt does not start in a nasty
+			// state.
+			resetRes, err := git.Reset(ctx, &libgit.ResetOpts{
+				Mode:    libgit.ResetModeHard,
+				Treeish: fmt.Sprintf("%s/%s", r.BaseOrigin, baseRef),
+			})
+			if err != nil {
+				res.Error = errors.Join(res.Error, fmt.Errorf(
+					"resetting repository after failed attempt: %s: %w", resetRes.String(), err),
+				)
+				// If we can't reset the repository there's no point in trying further
+				// attempts as we must assume something has gone horribly wrong.
+				break
+			}
+		}
+	}
+
+	return res
+}
+
+// Validate validates the request to ensure that all required fields are present
+func (r *CreateBackportReq) Validate(ctx context.Context) error {
+	if r == nil {
+		return fmt.Errorf("unitialized")
+	}
+
+	var err error
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("validating create backport pr requests: %w", err)
+		}
+	}()
+
+	slog.Default().DebugContext(ctx, "validating create backport pr request")
+
+	if r.Owner == "" {
+		return errors.New("no github organization has been provided")
+	}
+
+	if r.Repo == "" {
+		return errors.New("no github repository has been provided")
+	}
+
+	if r.BaseOrigin == "" {
+		return errors.New("no base origin has been configued")
+	}
+
+	if r.PullNumber == 0 {
+		return errors.New("no pull request number or commit SHA has been provided")
+	}
+
+	if r.CEBranchPrefix == "" {
+		return errors.New("no ce branch prefix has been configured")
+	}
+
+	if r.CEExclude == nil {
+		return errors.New("ce-exclude has not been initialized")
+	}
+
+	if r.CEAllowInactiveGroups == nil {
+		return errors.New("ce inactive-allowed has not been initialized")
+	}
+
+	if r.BackportLabelPrefix == "" {
+		return errors.New("no backport label prefix has been configured")
+	}
+
+	return nil
+}
+
+// AttemptErrors are any potential errors encountered during our backport attempts
+func (r *CreateBackportRes) AttemptErrors() []error {
+	if r == nil || len(r.Attempts) < 1 {
+		return nil
+	}
+
+	errs := []error{}
+	for _, k := range slices.Sorted(maps.Keys(r.Attempts)) {
+		a := r.Attempts[k]
+		if a.Error == nil {
+			continue
+		}
+		errs = append(errs, a.Error)
+	}
+
+	return errs
+}
+
+// CommentBody is the markdown comment body that we'll attempt to set on the
+// pull request
+func (r *CreateBackportRes) CommentBody() string {
+	if r == nil {
+		return "no backport response has been initialized"
+	}
+
+	t := r.ToTable()
+	err := r.Err()
+	if err == nil {
+		t.SetTitle("Backport workflow completed!")
+		return t.RenderMarkdown()
+	}
+
+	if t.Length() == 0 {
+		// If we don't have any rows in our table then we never made it far enough
+		// to have attempts. As such, there's no need to render a table so we'll
+		// just return an error
+		return "## Backport workflow failed!\n\nError: " + err.Error()
+	}
+
+	// Render out our table but put the error message in the caption
+	t.SetTitle("Backport workflow failed!")
+	if r.Error != nil {
+		// Set the caption to the top-level error only as any attempt errors are
+		// nested in the table.
+		t.SetCaption("Error: " + r.Error.Error())
+	}
+
+	return t.RenderMarkdown()
+}
+
+// Err returns a single combined error comprised of any issues that might have
+// arisen during Run() but also that of any individual backport attempt.
+func (r *CreateBackportRes) Err() error {
+	if r == nil {
+		return fmt.Errorf("uninitialized")
+	}
+
+	return errors.Join(r.Error, errors.Join(r.AttemptErrors()...))
+}
+
+// ToJSON marshals the response to JSON.
+func (r *CreateBackportRes) ToJSON() ([]byte, error) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling create backport pr response to JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToTable marshals the response to a text table.
+func (r *CreateBackportRes) ToTable() table.Writer {
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+	t.AppendHeader(table.Row{
+		"Base Branch", "Target Branch", "URL", "Skipped Reason", "Error",
+	})
+
+	for _, version := range slices.Sorted(maps.Keys(r.Attempts)) {
+		values := r.Attempts[version]
+		row := table.Row{values.BaseRef, values.TargetRef}
+		if values.PullRequest != nil {
+			row = append(row, values.PullRequest.GetHTMLURL())
+		} else {
+			row = append(row, nil)
+		}
+		valErr := ""
+		if values.Error != nil {
+			valErr = values.Error.Error()
+		}
+		row = append(row, values.SkippedReason, valErr)
+
+		t.AppendRow(row)
+	}
+
+	t.SuppressEmptyColumns()
+	t.SuppressTrailingSpaces()
+
+	return t
+}
+
+// backportBranchNameForRef returns then branch name to use for our backport,
+// e.g. ce/backport/1.19.x/my-feature-branch
+func (r CreateBackportReq) backportBranchNameForRef(
+	ref string,
+	prBranch string,
+) string {
+	name := fmt.Sprintf("backport/%s/%s", ref, prBranch)
+	if len(name) > 250 {
+		// Handle Githubs branch name max length
+		name = name[:250]
+	}
+
+	return name
+}
+
+func (r *CreateBackportReq) backportRef(
+	ctx context.Context,
+	git *libgit.Client,
+	github *libgithub.Client,
+	pr *libgithub.PullRequest,
+	activeVersions map[string]*releases.Version,
+	changedFiles *ListChangedFilesRes,
+	ref string, // the full base ref of the branch we're backporting to
+) *CreateBackportAttempt {
+	res := &CreateBackportAttempt{BaseRef: ref}
+
+	baseRefVersion := r.baseRefVersion(ref)
+	// Get the name of our PR branch. We'll use this in our backport branch names
+	// to make it easier to find the source.
+	prBranch := pr.GetHead().GetRef()
+	// The branch name for our backport, e.g. ce/backport/1.19.x/my-feature-branch
+	branchName := r.backportBranchNameForRef(ref, prBranch)
+	res.TargetRef = branchName
+	commitSHA := pr.GetMergeCommitSHA()
+	bigCtx := slogctx.Append(ctx,
+		slog.String("target-base-ref", ref),
+		slog.String("target-ref-version", baseRefVersion),
+		slog.String("target-branch", branchName),
+		slog.String("pr-branch", prBranch),
+		slog.String("commit-sha", commitSHA),
+	)
+
+	if reason, shouldSkip := r.shouldSkipRef(
+		ctx, baseRefVersion, ref, activeVersions, changedFiles,
+	); shouldSkip {
+		slog.Default().InfoContext(slogctx.Append(bigCtx,
+			slog.String("base-ref-version", baseRefVersion),
+			slog.String("target-ref", ref),
+			slog.String("reason", reason),
+		), "skipping backport")
+
+		res.Skipped = true
+		res.SkippedReason = reason
+
+		return res
+	}
+
+	slog.Default().DebugContext(bigCtx, "creating backport pull request")
+	slog.Default().DebugContext(ctx, "fetching backport target branch base ref")
+	fetchRes, err := git.Fetch(ctx, &libgit.FetchOpts{
+		// Fetch the ref but also provide a local tracking branch of the same name
+		// e.g. "git fetch origin main:main"
+		Refspec:     []string{r.BaseOrigin, fmt.Sprintf("%s:%s", ref, ref)},
+		SetUpstream: true,
+		Porcelain:   true,
+	})
+	if err != nil {
+		res.Error = fmt.Errorf("fetching target branch base ref: %s, %w", fetchRes.String(), err)
+		return res
+	}
+
+	slog.Default().DebugContext(ctx, "checking out new backport branch")
+	checkoutRes, err := git.Checkout(ctx, &libgit.CheckoutOpts{
+		NewBranchForceCheckout: branchName, // -B
+		Branch:                 ref,
+	})
+	if err != nil {
+		res.Error = fmt.Errorf("checking out new backport branch: %s: %w", checkoutRes.String(), err)
+		return res
+	}
+
+	// Try and backport the commit
+	if r.hasCEPrefix(ref) && changedFiles.Groups.Any(r.CEExclude) {
+		// We're backporting enterprise to CE but the commit has files we don't
+		// want to include. If we try and cherry-pick the commit it will almost
+		// certainly fail unless the enterprise only file is new.
+		res.Error = r.backportCECommitWithPatch(ctx, git, pr, changedFiles, commitSHA)
+	} else {
+		// We're backporting everything else. Simply cherry-pick the commit.
+		slog.Default().DebugContext(ctx, "cherry-picking")
+		cherryPickRes, err := git.CherryPick(ctx, &libgit.CherryPickOpts{
+			FF:       true,
+			Empty:    libgit.EmptyCommitKeep,
+			Commit:   commitSHA,
+			Strategy: libgit.MergeStrategyORT,
+			StrategyOptions: []libgit.MergeStrategyOption{
+				libgit.MergeStrategyOptionTheirs,
+				libgit.MergeStrategyOptionIgnoreSpaceChange,
+			},
+		})
+		if err != nil {
+			res.Error = fmt.Errorf("cherry-picking backport merge commit: %s: %w", cherryPickRes.String(), err)
+		}
+	}
+
+	// If our backport failed we still want to create a pull request for our
+	// failed backport. There's still some debate and the validity of this approach
+	// but our current process for ensuring backports have been merged is auditing
+	// the open pull requests for a branch. Until that changes we'll need to do
+	// this.
+	if res.Error != nil {
+		err = resetAndCreateNOOPCommit(ctx, git, ref)
+		if err != nil {
+			res.Error = errors.Join(res.Error, err)
+		}
+	}
+
+	pushRes, err := git.Push(ctx, &libgit.PushOpts{
+		Repository: r.BaseOrigin,
+		Refspec:    []string{branchName},
+	})
+	if err != nil {
+		res.Error = errors.Join(res.Error, fmt.Errorf("pushing backport branch: %s: %w", pushRes.String(), err))
+
+		// If we didn't successfully push the branch we can't open a PR so it's time
+		// to return.
+		return res
+	}
+
+	prTitle := fmt.Sprintf("Backport %s into %s", pr.GetTitle(), ref)
+	prBody, err := renderEmbeddedTemplate("backport-pr-message.tmpl", struct {
+		OriginPullRequest *libgithub.PullRequest
+		Attempt           *CreateBackportAttempt
+	}{pr, res})
+	if err != nil {
+		res.Error = fmt.Errorf("creating backport pull request body %w", err)
+		return res
+	}
+	res.PullRequest, _, err = github.PullRequests.Create(
+		ctx, r.Owner, r.Repo, &libgithub.NewPullRequest{
+			Title:    &prTitle,
+			Head:     &branchName,
+			HeadRepo: &r.Repo,
+			Base:     &ref,
+			Body:     &prBody,
+		},
+	)
+	if err != nil {
+		res.Error = fmt.Errorf("creating backport pull request %w", err)
+		return res
+	}
+
+	// Assign the pull request to the actor that merged the pull request and/or the
+	// person(s) that it was assigned to.
+	err = addAssignees(
+		ctx,
+		github,
+		r.Owner,
+		r.Repo,
+		int(res.PullRequest.GetNumber()),
+		[]string{pr.GetAssignee().GetLogin(), pr.GetMergedBy().GetLogin()},
+	)
+	if err != nil {
+		res.Error = fmt.Errorf("assigning ownership to backport pull request %w", err)
+		return res
+	}
+
+	return res
+}
+
+// backportCECommitWithPatch backports a commit to the currently checked out
+// branch and will omit and excluded files for CE backports. This commit
+// backport strategy involves creating a new diff patch and applying it rather
+// than a cherry-pick. We do this so as to not require fixing bad cherry-picks
+// when modifying enterprise only files that don't exist on the CE branch.
+func (r *CreateBackportReq) backportCECommitWithPatch(
+	ctx context.Context,
+	git *libgit.Client,
+	pr *libgithub.PullRequest,
+	changedFiles *ListChangedFilesRes,
+	commitSHA string,
+) error {
+	var err error
+	// Get a list of files that do not include excluded groups.
+	files := changed.Files{}
+	for _, file := range changedFiles.Files {
+		if file.Groups.Any(r.CEExclude) {
+			slog.Default().DebugContext(slogctx.Append(ctx,
+				slog.String("file", file.Name()),
+			), "skipping file as it is in one-or-more excluded groups")
+		} else {
+			slog.Default().DebugContext(slogctx.Append(ctx,
+				slog.String("file", file.Name()),
+			), "including changed file")
+			files = append(files, file)
+		}
+	}
+
+	// Create a unified patch of just the files we want to backport.
+	tmpDir, err := os.MkdirTemp("", "ce-backport-patch")
+	if err != nil {
+		return fmt.Errorf("creating temporary directory for CE patches: %w", err)
+	}
+	patchFile := filepath.Join(tmpDir, pr.GetBase().GetSHA()+".patch")
+
+	patchRes, err := git.Show(ctx, &libgit.ShowOpts{
+		DiffAlgorithm: libgit.DiffAlgorithmMyers,
+		// Use mboxrd so that we can we use 'git am' to apply and commit the patch
+		// and inherit all metadata from the source commit.
+		Format:   "mboxrd",
+		NoColor:  true,
+		Output:   patchFile,
+		Object:   commitSHA,
+		Patch:    true,
+		PathSpec: files.Names(),
+	})
+	if err != nil {
+		return fmt.Errorf("creating CE backport patch %s: %w", patchRes.String(), err)
+	}
+
+	// Apply the patch and commit it with the original details
+	amRes, err := git.Am(ctx, &libgit.AmOpts{
+		CommitterDateIsAuthorDate: true,
+		Empty:                     libgit.EmptyCommitKeep,
+		KeepNonPatch:              true,
+		ThreeWayMerge:             true,
+		Whitespace:                libgit.WhitespaceActionFix,
+		Mbox:                      []string{patchFile},
+	})
+	if err != nil {
+		return fmt.Errorf("apply CE backport patch: %s: %w", amRes.String(), err)
+	}
+
+	return nil
+}
+
+// baseRefVersion represents the baseRef as an active branch version. Active
+// branch versions are defined in .release/versions.hcl and ought to be
+// considered the source of truth for which CE branches are active. The output
+// also maps 1:1 to with backport labels. e.g.
+//
+//	ce/main                => main
+//	ent/main               => main
+//	main                   => main
+//	ce/release/1.19.x      => release/1.19.x
+//	release/1.19.x+ent     => release/1.19.x
+//	ent/release/1.19.x+ent => release/1.19.x
+func (r *CreateBackportReq) baseRefVersion(ref string) string {
+	switch {
+	case r.hasCEPrefix(ref):
+		return strings.TrimSuffix(strings.TrimPrefix(ref, r.CEBranchPrefix+"/"), "+ent")
+	case r.hasEntPrefix(ref):
+		return strings.TrimSuffix(strings.TrimPrefix(ref, r.EntBranchPrefix+"/"), "+ent")
+	default:
+		return strings.TrimSuffix(ref, "+ent")
+	}
+}
+
+// determineBackportRefs determines which backport target branches are candidates
+// to backport to depending on a combination of our source pull requests base
+// reference and the labels that are present on the pull request.
+//
+// If the base reference of the original PR is main, we assume we ought to
+// backport to ce/main.
+//
+// Any non-main backport references are derived from the original pull requests
+// labels. The valid labels are translated to the corresponding references
+// that match the source pull requests base reference type: enterprise or
+// community
+func (r *CreateBackportReq) determineBackportRefs(
+	ctx context.Context,
+	baseRef string,
+	labels Labels,
+) (res []string) {
+	baseRefVersion := r.baseRefVersion(baseRef)
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("labels", strings.Join(labels.Names(), " ")),
+		slog.String("base-ref", baseRef),
+		slog.String("base-ref-version", baseRefVersion),
+	), "determining backport base references from pull request labels")
+
+	defer func() {
+		if len(res) < 1 {
+			res = nil
+		}
+	}()
+
+	if r.isEntRef(baseRef) {
+		// We're dealing an enterprise PR. Always backport to the corresponding
+		// CE branch if it's active.
+		if baseRefVersion == "main" {
+			res = append(res, fmt.Sprintf("%s/main", r.CEBranchPrefix))
+		} else {
+			res = append(res, fmt.Sprintf("%s/%s", r.CEBranchPrefix, baseRefVersion))
+		}
+
+		// Backport to all enterprise release branches that match our backport labels
+		for _, label := range labels.Names() {
+			parts := strings.SplitN(label, "/", 2)
+			if len(parts) != 2 || parts[0] != r.BackportLabelPrefix {
+				slog.Default().DebugContext(slogctx.Append(ctx,
+					slog.String("label", label),
+					slog.String("backport-label-prefix", r.BackportLabelPrefix),
+				), "skipping label because it does not match the backport label prefix")
+				continue
+			}
+
+			if parts[1] == baseRefVersion {
+				slog.Default().WarnContext(slogctx.Append(ctx,
+					slog.String("label", label),
+					slog.String("base-ref-version", baseRefVersion),
+				), "skipping label because we cannot backport to the same reference")
+				continue
+			}
+
+			if r.EntBranchPrefix == "" {
+				res = append(res, fmt.Sprintf("release/%s+ent", parts[1]))
+			} else {
+				res = append(res, fmt.Sprintf("%s/release/%s+ent", r.EntBranchPrefix, parts[1]))
+			}
+		}
+	} else {
+		// We're dealing with a CE PR. Backport to all CE release branches that match
+		// our backport labels
+		for _, label := range labels.Names() {
+			parts := strings.SplitN(label, "/", 2)
+			if len(parts) != 2 || parts[0] != r.BackportLabelPrefix {
+				slog.Default().DebugContext(slogctx.Append(ctx,
+					slog.String("label", label),
+					slog.String("backport-label-prefix", r.BackportLabelPrefix),
+				), "skipping label because it does not match the backport label prefix")
+				continue
+			}
+
+			if parts[1] == baseRefVersion {
+				slog.Default().WarnContext(slogctx.Append(ctx,
+					slog.String("label", label),
+					slog.String("base-ref-version", baseRefVersion),
+				), "skipping label because we cannot backport to the same reference")
+
+				continue
+			}
+
+			res = append(res, fmt.Sprintf("%s/release/%s", r.CEBranchPrefix, parts[1]))
+		}
+	}
+
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("refs", strings.Join(res, ",")),
+	), "determined target backport references")
+
+	return res
+}
+
+// getActiveVersions gets the active versions from .release/versions.hcl
+func (r *CreateBackportReq) getActiveVersions(
+	ctx context.Context,
+) (map[string]*releases.Version, error) {
+	req := &releases.ListActiveVersionsReq{
+		Recurse:                  r.ReleaseRecurseDepth,
+		ReleaseVersionConfigPath: r.ReleaseVersionConfigPath,
+	}
+	res, err := req.Run(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return res.VersionsConfig.ActiveVersion.Versions, nil
+}
+
+// getChangedFiles gets a list of files that changed in the PR and determines
+// whether or not we need to worry about excluding some or all of them for CE
+// backports.
+func (r *CreateBackportReq) getChangedFiles(
+	ctx context.Context,
+	github *libgithub.Client,
+) (*ListChangedFilesRes, error) {
+	req := ListChangedFilesReq{
+		Owner:      r.Owner,
+		Repo:       r.Repo,
+		PullNumber: int(r.PullNumber),
+		GroupFiles: true,
+	}
+	res, err := req.Run(ctx, github)
+	if err != nil {
+		return nil, err
+	}
+
+	return res, nil
+}
+
+// Names returns the label names as slice of strings
+func (l Labels) Names() []string {
+	if len(l) < 1 {
+		return nil
+	}
+
+	res := []string{}
+	for label := range slices.Values(l) {
+		if label != nil {
+			res = append(res, label.GetName())
+		}
+	}
+
+	return res
+}
+
+// hasCEPrefix takes a branch reference and determines whether or not it starts
+// with the CEBranchPrefix.
+func (r *CreateBackportReq) hasCEPrefix(ref string) bool {
+	return strings.HasPrefix(ref, r.CEBranchPrefix+"/")
+}
+
+// hasEntPrefix takes a branch reference and determines whether or not it starts
+// with the EntBranchPrefix.
+func (r *CreateBackportReq) hasEntPrefix(ref string) bool {
+	if r.EntBranchPrefix == "" {
+		return false
+	}
+
+	return strings.HasPrefix(ref, r.EntBranchPrefix+"/")
+}
+
+// isEntRef takes a branch reference and determines whether or not it refers to
+// an enterprise branch.
+func (r *CreateBackportReq) isEntRef(ref string) bool {
+	return !r.hasCEPrefix(ref)
+}
+
+// shouldSkipRef determines whether or we ought to backport to a given branch
+// reference. It considers whether or not the base ref is for enterprise or
+// CE, which files have changed and which CE branches are active.
+func (r *CreateBackportReq) shouldSkipRef(
+	ctx context.Context,
+	baseRefVersion string,
+	ref string,
+	activeVersions map[string]*releases.Version,
+	changedFiles *ListChangedFilesRes,
+) (string, bool) {
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("base-ref-version", baseRefVersion),
+		slog.String("target-ref", ref),
+	), "determining whether to skip backport")
+
+	if changedFiles == nil || len(changedFiles.Files) < 1 {
+		return "no files were changed", true
+	}
+
+	if baseRefVersion == "" {
+		return "missing base ref", true
+	}
+
+	if ref == "" {
+		return "missing fef", true
+	}
+
+	if r.isEntRef(ref) {
+		// It's an enterprise backport so we'll always do it.
+		return "references to enterprise branches always backported", false
+	}
+
+	// Check if all of our files belong to excluded groups, i.e. they're all
+	// files in the "enterprise" group.
+	if changedFiles.Files.EachHasAnyGroup(r.CEExclude) {
+		return fmt.Sprintf(
+			"all changed files are in excluded groups: %s", r.CEExclude.String(),
+		), true
+	}
+
+	if ref == r.CEBranchPrefix+"/main" {
+		return "ce/main is always active and there are CE allowed files", false
+	}
+
+	// Check if there are inactive-allowed changed files, i.e. docs or pipeline
+	// files are included so we'll always backport to the CE branch.
+	if r.CEAllowInactiveGroups.Any(changedFiles.Groups) {
+		return fmt.Sprintf(
+			"one or more changed file groups [%s] are included in allowed inactive changed file groups [%s]",
+			changedFiles.Groups.String(), r.CEAllowInactiveGroups.String(),
+		), false
+	}
+
+	// Check if ce branch is active or not
+	prefix := "release/"
+	if r.EntBranchPrefix != "" {
+		prefix = r.EntBranchPrefix + "/"
+	}
+	version, ok := strings.CutPrefix(baseRefVersion, prefix)
+	if ok {
+		if ver, ok := activeVersions[version]; ok {
+			if ver.CEActive {
+				return "CE branch is active", false
+			}
+			return "CE branch is inactive", true
+		}
+	}
+
+	return fmt.Sprintf(
+		"could not find branch in active branches configuration: %s", baseRefVersion,
+	), true
+}
diff --git a/tools/pipeline/internal/pkg/github/create_backport_test.go b/tools/pipeline/internal/pkg/github/create_backport_test.go
new file mode 100644
index 00000000000..d021d1d8d6c
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/create_backport_test.go
@@ -0,0 +1,665 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	libgithub "github.com/google/go-github/v74/github"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/changed"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/releases"
+	"github.com/stretchr/testify/require"
+)
+
+// TestCreateBackportReq_Validate tests validation of the request
+func TestCreateBackportReq_Validate(t *testing.T) {
+	t.Parallel()
+
+	for name, test := range map[string]struct {
+		req   *CreateBackportReq
+		valid bool
+	}{
+		"empty": {nil, false},
+		"valid": {NewCreateBackportReq(WithCreateBrackportReqPullNumber(1234)), true},
+		"no owner": {
+			NewCreateBackportReq(
+				WithCreateBrackportReqPullNumber(1234),
+				WithCreateBackportReqOwner(""),
+			), false,
+		},
+		"no repo": {
+			NewCreateBackportReq(
+				WithCreateBrackportReqPullNumber(1234),
+				WithCreateBrackportReqRepo(""),
+			), false,
+		},
+		"no pull number": {NewCreateBackportReq(), false},
+		"no ce branch prefix": {
+			NewCreateBackportReq(
+				WithCreateBrackportReqPullNumber(1234),
+				WithCreateBrackportReqCEBranchPrefix(""),
+			), false,
+		},
+		"no base origin": {
+			NewCreateBackportReq(
+				WithCreateBrackportReqPullNumber(1234),
+				WithCreateBrackportReqBaseOrigin(""),
+			), false,
+		},
+		"uninitialized exclude groups": {
+			NewCreateBackportReq(
+				WithCreateBrackportReqPullNumber(1234),
+				WithCreateBrackportReqCEExclude(nil),
+			), false,
+		},
+		"uninitialized inactive groups": {
+			NewCreateBackportReq(
+				WithCreateBrackportReqPullNumber(1234),
+				WithCreateBrackportReqAllowInactiveGroups(nil),
+			), false,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			if test.valid {
+				require.NoError(t, test.req.Validate(context.Background()))
+			} else {
+				require.Error(t, test.req.Validate(context.Background()))
+			}
+		})
+	}
+}
+
+// TestCreateBackportReq_backportNameForRef tests generating the backport
+// branch name from branch name ref and the original PR branch name.
+func TestCreateBackportReq_backportNameForRef(t *testing.T) {
+	t.Parallel()
+
+	for name, test := range map[string]struct {
+		ref      string // These should be full branch names
+		prBranch string
+		expected string
+	}{
+		// backporting to ent main should never really happen but we'll test the
+		// logic anyway
+		"ent main": {
+			"main",
+			"my-pr",
+			"backport/main/my-pr",
+		},
+		"ent release branch": {
+			"release/1.19.x+ent",
+			"my-pr",
+			"backport/release/1.19.x+ent/my-pr",
+		},
+		"ce main": {
+			"ce/main",
+			"my-pr",
+			"backport/ce/main/my-pr",
+		},
+		"ce release branch": {
+			"ce/release/1.19.x",
+			"my-pr",
+			"backport/ce/release/1.19.x/my-pr",
+		},
+		"truncates super long branch name": {
+			"main",
+			"my-really-really-long-pr-name-that-must-exceed-two-hundred-and-fifty-characters-when-it-is-appended-to-the-backport-and-base-ref-prefixes-ought-to-be-truncated-so-as-to-not-exceed-the-github-pr-branch-requirements-otherwise-bad-things-happen",
+			"backport/main/my-really-really-long-pr-name-that-must-exceed-two-hundred-and-fifty-characters-when-it-is-appended-to-the-backport-and-base-ref-prefixes-ought-to-be-truncated-so-as-to-not-exceed-the-github-pr-branch-requirements-otherwise-bad-things-h",
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			req := NewCreateBackportReq()
+			require.Equal(t, test.expected, req.backportBranchNameForRef(test.ref, test.prBranch))
+		})
+	}
+}
+
+// TestCreateBackportReq_baseRefVersion tests generating the base ref version
+// from the backport branch reference. The base ref version matches the schema
+// used in .release/versions.hcl.
+func TestCreateBackportReq_baseRefVersion(t *testing.T) {
+	t.Parallel()
+
+	for ref, test := range map[string]struct {
+		req         *CreateBackportReq
+		expectedRef string
+	}{
+		// backporting to ent main should never really happen but we'll test the
+		// logic anyway
+		"main":               {req: NewCreateBackportReq(), expectedRef: "main"},
+		"ce/main":            {req: NewCreateBackportReq(), expectedRef: "main"},
+		"ent/main":           {req: NewCreateBackportReq(WithCreateBrackportReqEntBranchPrefix("ent")), expectedRef: "main"},
+		"release/1.19.x+ent": {req: NewCreateBackportReq(), expectedRef: "release/1.19.x"},
+		"ce/release/1.19.x":  {req: NewCreateBackportReq(), expectedRef: "release/1.19.x"},
+		"ent/release/1.19.x": {req: NewCreateBackportReq(WithCreateBrackportReqEntBranchPrefix("ent")), expectedRef: "release/1.19.x"},
+	} {
+		t.Run(ref, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, test.expectedRef, test.req.baseRefVersion(ref))
+		})
+	}
+}
+
+// TestCreateBackportReq_determineBackportRefs tests generating a list
+// of backport refs when considering the base ref of the PR and any labels
+// that have been applied to it.
+func TestCreateBackportReq_determineBackportRefs(t *testing.T) {
+	t.Parallel()
+
+	for name, test := range map[string]struct {
+		req      *CreateBackportReq
+		baseRef  string
+		labels   Labels
+		expected []string
+	}{
+		"ent main no labels": {
+			NewCreateBackportReq(),
+			"main",
+			nil,
+			[]string{"ce/main"},
+		},
+		"ent main no labels with ent prefix": {
+			NewCreateBackportReq(WithCreateBrackportReqEntBranchPrefix("ent")),
+			"ent/main",
+			nil,
+			[]string{"ce/main"},
+		},
+		"ent main with labels": {
+			NewCreateBackportReq(),
+			"main",
+			Labels{
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.19.x")},
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.18.x")},
+			},
+			[]string{"ce/main", "release/1.19.x+ent", "release/1.18.x+ent"},
+		},
+		"ent main with labels with ent prefix": {
+			NewCreateBackportReq(WithCreateBrackportReqEntBranchPrefix("ent")),
+			"ent/main",
+			Labels{
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.19.x")},
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.18.x")},
+			},
+			[]string{"ce/main", "ent/release/1.19.x+ent", "ent/release/1.18.x+ent"},
+		},
+		"ent release no labels": {
+			NewCreateBackportReq(),
+			"release/1.19.x+ent",
+			nil,
+			[]string{"ce/release/1.19.x"},
+		},
+		"ent release no labels with ent prefix": {
+			NewCreateBackportReq(WithCreateBrackportReqEntBranchPrefix("ent")),
+			"ent/release/1.19.x+ent",
+			nil,
+			[]string{"ce/release/1.19.x"},
+		},
+		"ent release with labels": {
+			NewCreateBackportReq(),
+			"release/1.19.x+ent",
+			Labels{
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.18.x")},
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.17.x")},
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.16.x")},
+			},
+			[]string{
+				"ce/release/1.19.x",
+				"release/1.18.x+ent",
+				"release/1.17.x+ent",
+				"release/1.16.x+ent",
+			},
+		},
+		"ent release with labels with ent prefix": {
+			NewCreateBackportReq(WithCreateBrackportReqEntBranchPrefix("ent")),
+			"ent/release/1.19.x+ent",
+			Labels{
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.18.x")},
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.17.x")},
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.16.x")},
+			},
+			[]string{
+				"ce/release/1.19.x",
+				"ent/release/1.18.x+ent",
+				"ent/release/1.17.x+ent",
+				"ent/release/1.16.x+ent",
+			},
+		},
+		"ce main no labels": {
+			NewCreateBackportReq(),
+			"ce/main",
+			nil,
+			nil,
+		},
+		"ce main with labels": {
+			NewCreateBackportReq(),
+			"ce/main",
+			Labels{
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.19.x")},
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.18.x")},
+			},
+			[]string{"ce/release/1.19.x", "ce/release/1.18.x"},
+		},
+		"ce release no labels": {
+			NewCreateBackportReq(),
+			"ce/release/1.19.x",
+			nil,
+			nil,
+		},
+		"ce release with labels": {
+			NewCreateBackportReq(),
+			"ce/release/1.19.x",
+			Labels{
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.18.x")},
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.17.x")},
+				&libgithub.Label{Name: libgithub.Ptr("backport/1.16.x")},
+			},
+			[]string{"ce/release/1.18.x", "ce/release/1.17.x", "ce/release/1.16.x"},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			require.EqualValues(t, test.expected, test.req.determineBackportRefs(context.Background(), test.baseRef, test.labels))
+		})
+	}
+}
+
+// TestCreateBackportReq_shouldSkipRef tests whether various combinations of
+// base refs, backport refs, changed files, and active CE versions are
+// backportable references or should be skipped.
+func TestCreateBackportReq_shouldSkipRef(t *testing.T) {
+	t.Parallel()
+
+	defaultActiveVersions := map[string]*releases.Version{
+		// main is never going to be in here as it's assumed it's always active
+		"1.20.x": {CEActive: true},
+		"1.19.x": {CEActive: false, LTS: true},
+		"1.18.x": {CEActive: false},
+		"1.16.x": {CEActive: true, LTS: true},
+	}
+
+	noChangedFiles := &ListChangedFilesRes{
+		Files:  changed.Files{},
+		Groups: changed.FileGroups{},
+	}
+
+	allowedInactiveCEChangedFiles := &ListChangedFilesRes{
+		Files: changed.Files{
+			{
+				File: &libgithub.CommitFile{
+					SHA:      libgithub.Ptr("84e0b544965861a7c6373e639cb13755512f84f4"),
+					Filename: libgithub.Ptr("changelog/_2837.md"),
+				},
+				Groups: changed.FileGroups{"changelog"},
+			},
+		},
+		Groups: changed.FileGroups{
+			"changelog",
+		},
+	}
+
+	onlyEnterpriseChangedFiles := &ListChangedFilesRes{
+		Files: changed.Files{
+			{
+				File: &libgithub.CommitFile{
+					SHA:      libgithub.Ptr("84e0b544965861a7c6373e639cb13755512f84f4"),
+					Filename: libgithub.Ptr(".github/workflows/build-artifacts-ent.yml"),
+				},
+				Groups: changed.FileGroups{"enterprise", "pipeline"},
+			},
+			{
+				File: &libgithub.CommitFile{
+					SHA:      libgithub.Ptr("84e0b544965861a7c6373e639cb13755512f84f4"),
+					Filename: libgithub.Ptr("vault/vault_ent/go.mod"),
+				},
+				Groups: changed.FileGroups{"app", "enterprise", "gotoolchain"},
+			},
+		},
+		Groups: changed.FileGroups{
+			"app", "enterprise", "gotoolchain", "pipeline",
+		},
+	}
+
+	mixedCEAndEnterpriseChangedFiles := &ListChangedFilesRes{
+		Files: changed.Files{
+			{
+				File: &libgithub.CommitFile{
+					SHA:      libgithub.Ptr("e1c10eae02e13f5a090b9c29b0b1a3003e8ca7f6"),
+					Filename: libgithub.Ptr("go.mod"),
+				},
+				Groups: changed.FileGroups{"app", "gotoolchain"},
+			},
+			{
+				File: &libgithub.CommitFile{
+					SHA:      libgithub.Ptr("a6397662ea1d5fdde744ff3e4246377cf369197a"),
+					Filename: libgithub.Ptr("vault_ent/go.mod"),
+				},
+				Groups: changed.FileGroups{"app", "enterprise", "gotoolchain"},
+			},
+		},
+		Groups: changed.FileGroups{
+			"app", "enterprise", "gotoolchain",
+		},
+	}
+
+	allCEChangedFiles := &ListChangedFilesRes{
+		Files: changed.Files{
+			{
+				File: &libgithub.CommitFile{
+					SHA:      libgithub.Ptr("84e0b544965861a7c6373e639cb13755512f84f4"),
+					Filename: libgithub.Ptr(".github/workflows/build.yml"),
+				},
+				Groups: changed.FileGroups{"pipeline"},
+			},
+			{
+				File: &libgithub.CommitFile{
+					SHA:      libgithub.Ptr("84e0b544965861a7c6373e639cb13755512f84f4"),
+					Filename: libgithub.Ptr("go.mod"),
+				},
+				Groups: changed.FileGroups{"app", "gotoolchain"},
+			},
+		},
+		Groups: changed.FileGroups{
+			"app", "gotoolchain", "pipeline",
+		},
+	}
+
+	for name, test := range map[string]struct {
+		baseRefVersion string
+		ref            string
+		activeVersions map[string]*releases.Version
+		changedFiles   *ListChangedFilesRes
+		skip           bool
+	}{
+		// main -> ce/main
+		"main to ce/main with no changed files": {
+			baseRefVersion: "main",
+			ref:            "ce/main",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   noChangedFiles,
+			skip:           true,
+		},
+		"main to ce/main with mixed changed files": {
+			baseRefVersion: "main",
+			ref:            "ce/main",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   mixedCEAndEnterpriseChangedFiles,
+			skip:           false,
+		},
+		"main to ce/main with enterprise only changed files": {
+			baseRefVersion: "main",
+			ref:            "ce/main",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   onlyEnterpriseChangedFiles,
+			skip:           true,
+		},
+		"main to ce/main with all CE changed files": {
+			baseRefVersion: "main",
+			ref:            "ce/main",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   allCEChangedFiles,
+			skip:           false,
+		},
+		"main to ce/main with allowed inactive changed files": {
+			baseRefVersion: "main",
+			ref:            "ce/main",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   allowedInactiveCEChangedFiles,
+			skip:           false,
+		},
+		// main -> release branch
+		"main to release with no changed files": {
+			baseRefVersion: "main",
+			ref:            "release/1.20.x+ent",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   noChangedFiles,
+			skip:           true,
+		},
+		"main to release with mixed changed files": {
+			baseRefVersion: "main",
+			ref:            "release/1.20.x+ent",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   mixedCEAndEnterpriseChangedFiles,
+			skip:           false,
+		},
+		"main to release with enterprise only changed files": {
+			baseRefVersion: "main",
+			ref:            "release/1.20.x+ent",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   onlyEnterpriseChangedFiles,
+			skip:           false,
+		},
+		"main to release with all CE changed files": {
+			baseRefVersion: "main",
+			ref:            "release/1.20.x+ent",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   allCEChangedFiles,
+			skip:           false,
+		},
+		"main to release with allowed inactive changed files": {
+			baseRefVersion: "main",
+			ref:            "release/1.20.x+ent",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   allowedInactiveCEChangedFiles,
+			skip:           false,
+		},
+		// release -> active ce/release
+		"release to ce/release with no changed files": {
+			baseRefVersion: "release/1.20.x",
+			ref:            "ce/release/1.20.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   noChangedFiles,
+			skip:           true,
+		},
+		"release to ce/release with mixed changed files": {
+			baseRefVersion: "release/1.20.x",
+			ref:            "ce/release/1.20.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   mixedCEAndEnterpriseChangedFiles,
+			skip:           false,
+		},
+		"release to ce/release with enterprise only changed files": {
+			baseRefVersion: "release/1.20.x",
+			ref:            "ce/release/1.20.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   onlyEnterpriseChangedFiles,
+			skip:           true,
+		},
+		"release to ce/release with all CE changed files": {
+			baseRefVersion: "release/1.20.x",
+			ref:            "ce/release/1.20.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   allCEChangedFiles,
+			skip:           false,
+		},
+		"release to ce/release with allowed inactive changed files": {
+			baseRefVersion: "release/1.20.x",
+			ref:            "ce/release/1.20.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   allowedInactiveCEChangedFiles,
+			skip:           false,
+		},
+		// release -> inactive ce/release
+		"release to inactive ce/release with no changed files": {
+			baseRefVersion: "release/1.19.x",
+			ref:            "ce/release/1.19.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   noChangedFiles,
+			skip:           true,
+		},
+		"release to inactive ce/release with mixed changed files": {
+			baseRefVersion: "release/1.19.x",
+			ref:            "ce/release/1.19.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   mixedCEAndEnterpriseChangedFiles,
+			skip:           true,
+		},
+		"release to inactive ce/release with enterprise only changed files": {
+			baseRefVersion: "release/1.19.x",
+			ref:            "ce/release/1.19.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   onlyEnterpriseChangedFiles,
+			skip:           true,
+		},
+		"release to inactive ce/release with all CE changed files": {
+			baseRefVersion: "release/1.19.x",
+			ref:            "ce/release/1.19.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   allCEChangedFiles,
+			skip:           true,
+		},
+		"release to inactive ce/release with allowed inactive changed files": {
+			baseRefVersion: "release/1.19.x",
+			ref:            "ce/release/1.19.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   allowedInactiveCEChangedFiles,
+			skip:           false,
+		},
+		// Various corner cases
+		"empty changed files list is skipped": {
+			baseRefVersion: "release/1.19.x",
+			ref:            "ce/release/1.19.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   noChangedFiles,
+			skip:           true,
+		},
+		"nil changed files list is skipped": {
+			baseRefVersion: "release/1.19.x",
+			ref:            "ce/release/1.19.x",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   nil,
+			skip:           true,
+		},
+		"release branch with no active versions": {
+			baseRefVersion: "release/1.19.x",
+			ref:            "ce/release/1.19.x",
+			activeVersions: map[string]*releases.Version{},
+			changedFiles:   mixedCEAndEnterpriseChangedFiles,
+			skip:           true,
+		},
+		"release branch with nil active versions": {
+			baseRefVersion: "release/1.19.x",
+			ref:            "ce/release/1.19.x",
+			activeVersions: nil,
+			changedFiles:   mixedCEAndEnterpriseChangedFiles,
+			skip:           true,
+		},
+		"missing base ref version": {
+			baseRefVersion: "",
+			ref:            "ce/main",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   allCEChangedFiles,
+			skip:           true,
+		},
+		"missing ref version": {
+			baseRefVersion: "main",
+			ref:            "",
+			activeVersions: defaultActiveVersions,
+			changedFiles:   allCEChangedFiles,
+			skip:           true,
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			req := NewCreateBackportReq()
+			msg, skip := req.shouldSkipRef(
+				context.Background(),
+				test.baseRefVersion,
+				test.ref,
+				test.activeVersions,
+				test.changedFiles,
+			)
+			require.Equalf(
+				t, test.skip, skip, "should have %t but got %t with %s", test.skip, skip, msg)
+		})
+	}
+}
+
+func TestCreateBackportRes_Err(t *testing.T) {
+	t.Parallel()
+
+	for name, test := range map[string]struct {
+		in     *CreateBackportRes
+		failed error
+	}{
+		"nil": {
+			nil,
+			errors.New("uninitialized"),
+		},
+		"no errors": {
+			&CreateBackportRes{
+				Attempts: map[string]*CreateBackportAttempt{
+					"ce/main":        {},
+					"release/1.18.x": {},
+					"release/1.19.x": {},
+				},
+			},
+			nil,
+		},
+		"top level error no attempt errors": {
+			&CreateBackportRes{
+				Error: errors.New("top-failed"),
+				Attempts: map[string]*CreateBackportAttempt{
+					"ce/main":        {},
+					"release/1.18.x": {},
+					"release/1.19.x": {},
+				},
+			},
+			errors.New("top-failed"),
+		},
+		"no top level error attempt errors": {
+			&CreateBackportRes{
+				Attempts: map[string]*CreateBackportAttempt{
+					"ce/main": {
+						Error: errors.New("child-failed"),
+					},
+					"release/1.18.x": {},
+					"release/1.19.x": {},
+				},
+			},
+			errors.New("child-failed"),
+		},
+		"top level and attempt errors": {
+			&CreateBackportRes{
+				Error: errors.New("top-failed"),
+				Attempts: map[string]*CreateBackportAttempt{
+					"ce/main":        {},
+					"release/1.18.x": {},
+					"release/1.19.x": {
+						Error: errors.New("child-failed"),
+					},
+				},
+			},
+			errors.New("top-failed\nchild-failed"),
+		},
+		"multiple attempt errors": {
+			&CreateBackportRes{
+				Error: errors.New("top-failed"),
+				Attempts: map[string]*CreateBackportAttempt{
+					"ce/main": {},
+					"release/1.18.x": {
+						Error: errors.New("child-2-failed"),
+					},
+					"release/1.19.x": {
+						Error: errors.New("child-3-failed"),
+					},
+				},
+			},
+			// When multiple attempts fail the errros should be stable
+			errors.New("top-failed\nchild-2-failed\nchild-3-failed"),
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if test.failed == nil {
+				require.Nil(t, test.in.Err())
+			} else {
+				require.Equal(t, test.failed.Error(), test.in.Err().Error())
+			}
+		})
+	}
+}
diff --git a/tools/pipeline/internal/pkg/github/doc.go b/tools/pipeline/internal/pkg/github/doc.go
new file mode 100644
index 00000000000..f4facf1d5d2
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/doc.go
@@ -0,0 +1,5 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+// Package github contains our implementation of pipeline sub-command requests that utilize Github
+package github
diff --git a/tools/pipeline/internal/pkg/github/find_workflow_artifact.go b/tools/pipeline/internal/pkg/github/find_workflow_artifact.go
new file mode 100644
index 00000000000..bdb1f05053d
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/find_workflow_artifact.go
@@ -0,0 +1,200 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"cmp"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"slices"
+
+	gh "github.com/google/go-github/v74/github"
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+// FindWorkflowArtifactReq is a request to find an artifact associated with a
+// workflow run.
+type FindWorkflowArtifactReq struct {
+	ArtifactName        string
+	ArtifactPattern     string
+	Owner               string
+	PullNumber          int
+	Repo                string
+	WorkflowName        string
+	WriteToGithubOutput bool
+	compiledPattern     *regexp.Regexp
+}
+
+// FindWorkflowArtifactRes is a FindWorkflowArtifactReq response.
+type FindWorkflowArtifactRes struct {
+	PR       *gh.PullRequest `json:"pr,omitempty"`
+	Workflow *gh.Workflow    `json:"workflow,omitempty"`
+	Run      *WorkflowRun    `json:"runs,omitempty"`
+	Artifact *gh.Artifact    `json:"artifact,omitempty"`
+}
+
+// Run performs the search to find an artifact associated with a workflow.
+func (r *FindWorkflowArtifactReq) Run(ctx context.Context, client *gh.Client) (*FindWorkflowArtifactRes, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	var err error
+	res := &FindWorkflowArtifactRes{}
+
+	// Validate our request. This also ensures that any pattern we've been given
+	// is a valid regex.
+	if err = r.validate(); err != nil {
+		return nil, fmt.Errorf("validating request: %w", err)
+	}
+
+	// Get the workflow details for the repo
+	res.Workflow, err = getWorkflow(ctx, client, r.Owner, r.Repo, r.WorkflowName)
+	if err != nil {
+		return nil, fmt.Errorf("getting workflow: %w", err)
+	}
+
+	// Get the pull request we're searching
+	res.PR, err = getPullRequest(ctx, client, r.Owner, r.Repo, r.PullNumber)
+	if err != nil {
+		return nil, fmt.Errorf("getting pull request: %w", err)
+	}
+
+	// Get the workflow runs associated with the workflow and the PR
+	opts := &gh.ListWorkflowRunsOptions{
+		Branch:              res.PR.GetHead().GetRef(),
+		ExcludePullRequests: false,
+		HeadSHA:             res.PR.GetHead().GetSHA(),
+		ListOptions:         gh.ListOptions{PerPage: PerPageMax},
+		Status:              "success",
+	}
+	runs, err := getWorkflowRuns(ctx, client, r.Owner, r.Repo, res.Workflow.GetID(), opts)
+	if err != nil {
+		return nil, fmt.Errorf("getting workflow runs: %w", err)
+	}
+
+	if len(runs) < 1 {
+		return nil, fmt.Errorf("no matching workflow runs are associated with the pull request")
+	}
+
+	// In instances where we have more than one run we want to get the artifact
+	// from the most recent run if possible. Search our runs in reverse order to
+	// find the most recent artifact.
+	slices.SortFunc(runs, func(a, b *WorkflowRun) int {
+		return cmp.Compare(*b.Run.RunAttempt, *a.Run.RunAttempt)
+	})
+
+	var artifacts gh.ArtifactList
+	for _, run := range runs {
+		artifacts, err = getWorkflowRunArtifacts(ctx, client, r.Owner, r.Repo, *run.Run.ID)
+		if err != nil {
+			return nil, fmt.Errorf("getting artifacts for workflow run %d: %w", *run.Run.ID, err)
+		}
+
+		for _, art := range artifacts.Artifacts {
+			// If we've been given a name locate it by that
+			if r.ArtifactName != "" {
+				if art.GetName() == r.ArtifactName {
+					res.Artifact = art
+
+					return res, nil
+				}
+			} else {
+				// Find it by regex
+				if r.compiledPattern.MatchString(art.GetName()) {
+					res.Artifact = art
+
+					return res, nil
+				}
+			}
+		}
+	}
+
+	return nil, errors.New("unable to find artifact matching given criteria")
+}
+
+// validate ensures that we've been given the request configuration to perform
+// the request.
+func (r *FindWorkflowArtifactReq) validate() error {
+	if r == nil {
+		return errors.New("failed to initialize request")
+	}
+
+	if r.Owner == "" {
+		return errors.New("no github organization has been provided")
+	}
+
+	if r.Repo == "" {
+		return errors.New("no github repository has been provided")
+	}
+
+	if r.PullNumber == 0 {
+		return errors.New("no github pull request number has been provided")
+	}
+
+	if r.WorkflowName == "" {
+		return errors.New("no workflow name has been provided")
+	}
+
+	if r.ArtifactName == "" && r.ArtifactPattern == "" {
+		return errors.New("no artifact name or pattern has been provided")
+	}
+
+	if r.ArtifactName != "" && r.ArtifactPattern != "" {
+		return errors.New("you must provide only an artifact name or pattern")
+	}
+
+	if r.ArtifactPattern != "" {
+		var err error
+		r.compiledPattern, err = regexp.Compile(r.ArtifactPattern)
+		if err != nil {
+			return fmt.Errorf("invalid artifact pattern: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// ToJSON marshals the response to JSON.
+func (r *FindWorkflowArtifactRes) ToJSON() ([]byte, error) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling find workflow artifact to JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToGithubOutput marshals just the artifact response to JSON.
+func (r *FindWorkflowArtifactRes) ToGithubOutput() ([]byte, error) {
+	b, err := json.Marshal(r.Artifact)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling find workflow artifact to GITHUB_OUTPUT JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToTable marshals the response to a text table.
+func (r *FindWorkflowArtifactRes) ToTable() string {
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+	t.AppendHeader(table.Row{"name", "run id", "artifact id", "url"})
+	t.AppendRow(table.Row{
+		r.Artifact.GetName(),
+		r.Artifact.GetWorkflowRun().GetID(),
+		r.Artifact.GetID(),
+		r.Artifact.GetArchiveDownloadURL(),
+	})
+	return t.Render()
+}
diff --git a/tools/pipeline/internal/pkg/github/issue.go b/tools/pipeline/internal/pkg/github/issue.go
new file mode 100644
index 00000000000..8547eabcb35
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/issue.go
@@ -0,0 +1,34 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"log/slog"
+
+	libgithub "github.com/google/go-github/v74/github"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// closeIssue closes an issue.
+func closeIssue(
+	ctx context.Context,
+	github *libgithub.Client,
+	owner string,
+	repo string,
+	issueNumber int,
+) error {
+	ctx = slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.Int("issue-number", issueNumber),
+	)
+	slog.Default().DebugContext(ctx, "closing issue")
+
+	_, _, err := github.Issues.Edit(ctx, owner, repo, issueNumber, &libgithub.IssueRequest{
+		State: libgithub.Ptr("closed"),
+	})
+
+	return err
+}
diff --git a/tools/pipeline/internal/pkg/github/list_changed_files.go b/tools/pipeline/internal/pkg/github/list_changed_files.go
new file mode 100644
index 00000000000..e2a76f2f359
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/list_changed_files.go
@@ -0,0 +1,199 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	gh "github.com/google/go-github/v74/github"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/changed"
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+type (
+	// ListChangedFilesReq is a request to list workflows runs. The fields represent
+	// various criteria we can use to filter.
+	ListChangedFilesReq struct {
+		Owner               string
+		Repo                string
+		PullNumber          int
+		CommitSHA           string
+		GroupFiles          bool
+		WriteToGithubOutput bool
+	}
+
+	// ListChangedFilesRes is a list workflows response.
+	ListChangedFilesRes struct {
+		Files  changed.Files      `json:"files,omitempty"`
+		Groups changed.FileGroups `json:"groups,omitempty"`
+	}
+
+	// ListChangedFilesGithubOutput is out GITHUB_OUTPUT type. It's a slimmed down
+	// type that only include file names and groups.
+	ListChangedFilesGithubOutput struct {
+		Files  []string           `json:"files,omitempty"`
+		Groups changed.FileGroups `json:"groups,omitempty"`
+	}
+)
+
+// Run runs the request to gather all instances of the workflow that match
+// our filter criteria.
+func (r *ListChangedFilesReq) Run(ctx context.Context, client *gh.Client) (*ListChangedFilesRes, error) {
+	var err error
+	res := &ListChangedFilesRes{}
+
+	if err = r.validate(); err != nil {
+		return nil, fmt.Errorf("validating request: %w", err)
+	}
+
+	if r.CommitSHA != "" {
+		files, err := r.getCommitFiles(ctx, client)
+		if err != nil {
+			return nil, err
+		}
+		res.Files = append(res.Files, files...)
+	}
+
+	if r.PullNumber != 0 {
+		files, err := r.getPullFiles(ctx, client)
+		if err != nil {
+			return nil, err
+		}
+		res.Files = append(res.Files, files...)
+	}
+
+	if r.GroupFiles {
+		changed.GroupFiles(ctx, res.Files, changed.DefaultFileGroupCheckers...)
+		res.Groups = changed.FileGroups{}
+		for _, file := range res.Files {
+			for _, group := range file.Groups {
+				res.Groups = res.Groups.Add(group)
+			}
+		}
+	}
+
+	return res, nil
+}
+
+// validate ensures that we've been given the minimum filter arguments necessary to complete a
+// request. It is always recommended that additional fitlers be given to reduce the response size
+// and not exhaust API limits.
+func (r *ListChangedFilesReq) validate() error {
+	if r == nil {
+		return errors.New("failed to initialize request")
+	}
+
+	if r.Owner == "" {
+		return errors.New("no github organization has been provided")
+	}
+
+	if r.Repo == "" {
+		return errors.New("no github repository has been provided")
+	}
+
+	if r.PullNumber == 0 && r.CommitSHA == "" {
+		return errors.New("no pull request number or commit SHA has been provided")
+	}
+
+	return nil
+}
+
+// getCommitFiles attempts to locate the workflow associated with our workflow name.
+func (r *ListChangedFilesReq) getCommitFiles(ctx context.Context, client *gh.Client) (changed.Files, error) {
+	opts := &gh.ListOptions{PerPage: PerPageMax}
+	files := changed.Files{}
+	for {
+		commit, res, err := client.Repositories.GetCommit(ctx, r.Owner, r.Repo, r.CommitSHA, opts)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, f := range commit.Files {
+			files = append(files, &changed.File{File: f})
+		}
+
+		if res.NextPage == 0 {
+			return files, nil
+		}
+
+		opts.Page = res.NextPage
+	}
+}
+
+// getPullFiles attempts to locate the workflow associated with our workflow name.
+func (r *ListChangedFilesReq) getPullFiles(ctx context.Context, client *gh.Client) (changed.Files, error) {
+	opts := &gh.ListOptions{PerPage: PerPageMax}
+	files := changed.Files{}
+	for {
+		fl, res, err := client.PullRequests.ListFiles(ctx, r.Owner, r.Repo, r.PullNumber, opts)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, f := range fl {
+			files = append(files, &changed.File{File: f})
+		}
+
+		if res.NextPage == 0 {
+			return files, nil
+		}
+
+		opts.Page = res.NextPage
+	}
+}
+
+// ToJSON marshals the response to JSON.
+func (r *ListChangedFilesRes) ToJSON() ([]byte, error) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling list changed files to JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToGithubOutput writes a simplified list of changed files to be used $GITHUB_OUTPUT
+func (r ListChangedFilesRes) ToGithubOutput() ([]byte, error) {
+	res := &ListChangedFilesGithubOutput{
+		Groups: r.Groups,
+	}
+	if f := r.Files; f != nil {
+		res.Files = f.Names()
+	}
+
+	b, err := json.Marshal(res)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling list changed files GITHUB_OUTPUT to JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToTable marshals the response to a text table.
+func (r *ListChangedFilesRes) ToTable(groups bool) string {
+	if !groups {
+		w := strings.Builder{}
+		for _, name := range r.Files.Names() {
+			w.WriteString(name + "\n")
+		}
+
+		return w.String()
+	}
+
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+	t.AppendHeader(table.Row{"path", "groups"})
+	for _, file := range r.Files {
+		t.AppendRow(table.Row{file.Name(), file.Groups.String()})
+	}
+	return t.Render()
+}
diff --git a/tools/pipeline/internal/pkg/github/list_commit_statuses.go b/tools/pipeline/internal/pkg/github/list_commit_statuses.go
new file mode 100644
index 00000000000..e0269e28d5f
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/list_commit_statuses.go
@@ -0,0 +1,99 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	libgithub "github.com/google/go-github/v74/github"
+	"github.com/jedib0t/go-pretty/v6/table"
+)
+
+// ListCommitStatusesReq is a request to list workflows runs. The fields represent
+// various criteria we can use to filter.
+type ListCommitStatusesReq struct {
+	Owner  string
+	Repo   string
+	Commit string
+	PR     int
+}
+
+// ListCommitStatusesRes is a list workflows response.
+type ListCommitStatusesRes struct {
+	Statuses []*libgithub.RepoStatus `json:"statuses,omitempty"`
+}
+
+// Run runs the request to gather all instances of the workflow that match
+// our filter criteria.
+func (r *ListCommitStatusesReq) Run(ctx context.Context, client *libgithub.Client) (*ListCommitStatusesRes, error) {
+	var err error
+	res := &ListCommitStatusesRes{}
+
+	if err = r.validate(); err != nil {
+		return nil, fmt.Errorf("validating request: %w", err)
+	}
+
+	if r.Commit == "" {
+		var pr *libgithub.PullRequest
+		pr, err = getPullRequest(ctx, client, r.Owner, r.Repo, r.PR)
+		if err != nil {
+			return nil, fmt.Errorf("getting pull request: %w", err)
+		}
+		r.Commit = pr.GetHead().GetSHA()
+	}
+
+	res.Statuses, err = listCommitStatuses(ctx, client, r.Owner, r.Repo, r.Commit)
+	if err != nil {
+		return nil, fmt.Errorf("getting commit statuses: %w", err)
+	}
+
+	return res, nil
+}
+
+// validate ensures that we've been given the minimum filter arguments necessary to complete a
+// request. It is always recommended that additional fitlers be given to reduce the response size
+// and not exhaust API limits.
+func (r *ListCommitStatusesReq) validate() error {
+	if r == nil {
+		return errors.New("failed to initialize request")
+	}
+
+	if r.Owner == "" {
+		return errors.New("no github organization has been provided")
+	}
+
+	if r.Repo == "" {
+		return errors.New("no github repository has been provided")
+	}
+
+	if r.PR == 0 && r.Commit == "" {
+		return errors.New("no commit or Pull Request number has been provided")
+	}
+
+	return nil
+}
+
+// ToTable marshals the response to a text table.
+func (r *ListCommitStatusesRes) ToTable() table.Writer {
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+	t.AppendHeader(table.Row{"context", "creator", "date", "type", "state"})
+	for _, status := range r.Statuses {
+		t.AppendRow(table.Row{
+			status.GetContext(),
+			status.GetCreator().GetLogin(),
+			status.GetUpdatedAt(),
+			status.GetCreator().GetType(),
+			status.GetState(),
+		})
+	}
+
+	return t
+}
diff --git a/tools/pipeline/internal/pkg/github/list_workflow_runs.go b/tools/pipeline/internal/pkg/github/list_workflow_runs.go
new file mode 100644
index 00000000000..523b2ad6c16
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/list_workflow_runs.go
@@ -0,0 +1,502 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"sync"
+
+	gh "github.com/google/go-github/v74/github"
+)
+
+// PerPageMax is the maximum number of entities to request for enpoints that
+// support pagination. 100 is usually the limit and we use it everywhere.
+// We always request the maximum number of entities so that we we use the fewest
+// possible API requests. There is a per-hour token limit after all.
+const PerPageMax = 100
+
+// ListWorkflowRunsReq is a request to list workflows runs. The fields represent
+// various criteria we can use to filter.
+type ListWorkflowRunsReq struct {
+	Actor        string
+	Branch       string
+	CheckSuiteID int64
+	Compact      bool
+	DateQuery    string
+	Event        string
+	IncludePRs   bool
+	Owner        string
+	Repo         string
+	Sha          string
+	Status       string
+	WorkflowName string
+}
+
+// ListWorkflowRunsRes is a list workflows response.
+type ListWorkflowRunsRes struct {
+	Workflow *gh.Workflow   `json:"workflow,omitempty"`
+	Runs     []*WorkflowRun `json:"runs,omitempty"`
+}
+
+// WorkflowRun represents a Github actions workflow run. We include the raw
+// Github API run response, the workflows jobs, and the associated check suite.
+type WorkflowRun struct {
+	Run       *gh.WorkflowRun `json:"run,omitempty"`
+	Jobs      []*WorkflowJob  `json:"jobs,omitempty"`
+	CheckRuns []*CheckRun     `json:"check_runs,omitempty"`
+	summary   string
+}
+
+// CheckRun represents the run of a check suite for a workflow. We include the
+// check suite annotations.
+type CheckRun struct {
+	Run         *gh.CheckRun             `json:"run,omitempty"`
+	Annotations []*gh.CheckRunAnnotation `json:"annotations,omitempty"`
+}
+
+// WorkflowJob represents a singular job of a workflow. We include the raw
+// Job response from Github along with log entries for any failed steps.
+type WorkflowJob struct {
+	Job        *gh.WorkflowJob `json:"job,omitempty"`
+	LogEntries []*LogEntry     `json:"log_entries,omitempty"`
+}
+
+// Run runs the request to gather all instances of the workflow that match
+// our filter criteria.
+func (r *ListWorkflowRunsReq) Run(ctx context.Context, client *gh.Client) (*ListWorkflowRunsRes, error) {
+	var err error
+	res := &ListWorkflowRunsRes{}
+
+	if err = r.validate(); err != nil {
+		return nil, fmt.Errorf("validating request: %w", err)
+	}
+
+	res.Workflow, err = getWorkflow(ctx, client, r.Owner, r.Repo, r.WorkflowName)
+	if err != nil {
+		return nil, fmt.Errorf("getting workflow: %w", err)
+	}
+
+	res.Runs, err = r.getWorkflowRuns(ctx, client, res.Workflow.GetID())
+	if err != nil {
+		return nil, fmt.Errorf("getting workflow runs: %w", err)
+	}
+
+	if len(res.Runs) < 1 {
+		return nil, fmt.Errorf("fetching workflow runs: no workflow runs match the given filters")
+	}
+
+	err = r.getWorkflowCheckRuns(ctx, client, res.Runs)
+	if err != nil {
+		return nil, fmt.Errorf("fetching workflow check runs: %w", err)
+	}
+
+	err = r.getWorkflowCheckRunAnnotations(ctx, client, res.Runs)
+	if err != nil {
+		return nil, fmt.Errorf("fetching workflow check run annotations: %w", err)
+	}
+
+	err = r.getWorkflowJobs(ctx, client, res.Runs)
+	if err != nil {
+		return nil, fmt.Errorf("fetching workflow run jobs: %w", err)
+	}
+
+	// Logs have to be downloaded and parsed to get the relevant bits. Such
+	// an expensive operation is limited to only failures.
+	err = r.getUnsuccessfulWorkflowJobsLogs(ctx, client, res.Runs)
+	if err != nil {
+		return nil, fmt.Errorf("fetching failed workflow run job logs: %w", err)
+	}
+
+	return res, r.summarizeWorkflowRuns(res.Runs)
+}
+
+// validate ensures that we've been given the minimum filter arguments necessary to complete a
+// request. It is always recommended that additional fitlers be given to reduce the response size
+// and not exhaust API limits.
+func (r *ListWorkflowRunsReq) validate() error {
+	if r == nil {
+		return errors.New("failed to initialize request")
+	}
+
+	if r.Owner == "" {
+		return errors.New("no github organization has been provided")
+	}
+
+	if r.Repo == "" {
+		return errors.New("no github repository has been provided")
+	}
+
+	if r.DateQuery == "" {
+		return errors.New("no date range query has been provided")
+	}
+
+	if r.WorkflowName == "" {
+		return errors.New("no github actions workflow name has been provided")
+	}
+
+	return nil
+}
+
+// getWorkflowRuns gets teh workflow runs associated with a workflow ID.
+func (r *ListWorkflowRunsReq) getWorkflowRuns(ctx context.Context, client *gh.Client, id int64) ([]*WorkflowRun, error) {
+	opts := &gh.ListWorkflowRunsOptions{
+		Actor:               r.Actor,
+		Branch:              r.Branch,
+		CheckSuiteID:        r.CheckSuiteID,
+		Created:             r.DateQuery,
+		ExcludePullRequests: !r.IncludePRs,
+		Event:               r.Event,
+		HeadSHA:             r.Sha,
+		ListOptions:         gh.ListOptions{PerPage: PerPageMax},
+		Status:              r.Status,
+	}
+	if r.CheckSuiteID > 0 {
+		opts.CheckSuiteID = r.CheckSuiteID
+	}
+
+	return getWorkflowRuns(ctx, client, r.Owner, r.Repo, id, opts)
+}
+
+// getWorkflowCheckRuns gets the check suite runs associated with the workflow runs.
+func (r *ListWorkflowRunsReq) getWorkflowCheckRuns(ctx context.Context, client *gh.Client, wfrs []*WorkflowRun) error {
+	filter := "latest"
+	opts := &gh.ListCheckRunsOptions{
+		Filter:      &filter, // "all" for all attemps
+		ListOptions: gh.ListOptions{PerPage: PerPageMax},
+	}
+
+	if len(wfrs) < 1 {
+		return nil
+	}
+
+	wg := sync.WaitGroup{}
+	wg.Add(len(wfrs))
+	errC, resC, cancel := r.startErrorCollector(ctx)
+
+	for _, wfr := range wfrs {
+		go func() {
+			defer wg.Done()
+
+			for {
+				chrs, res, err := client.Checks.ListCheckRunsCheckSuite(ctx, r.Owner, r.Repo, *wfr.Run.CheckSuiteID, opts)
+				if err != nil {
+					errC <- err
+					return
+				}
+
+				if r.Status == "" || !r.Compact {
+					for _, cr := range chrs.CheckRuns {
+						wfr.CheckRuns = append(wfr.CheckRuns, &CheckRun{Run: cr})
+					}
+				} else {
+					for _, cr := range chrs.CheckRuns {
+						if cr.GetConclusion() == r.Status || cr.GetStatus() == r.Status {
+							wfr.CheckRuns = append(wfr.CheckRuns, &CheckRun{Run: cr})
+						}
+					}
+				}
+
+				if res.NextPage == 0 {
+					break
+				}
+
+				opts.ListOptions.Page = res.NextPage
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	return r.stopErrorCollector(errC, resC, cancel)
+}
+
+// getWorkflowCheckRunAnnotations gets the check suite annotations associated with the check suites
+// that are associated with the runs.
+func (r *ListWorkflowRunsReq) getWorkflowCheckRunAnnotations(ctx context.Context, client *gh.Client, wfrs []*WorkflowRun) error {
+	opts := &gh.ListOptions{PerPage: PerPageMax}
+
+	if len(wfrs) < 1 {
+		return nil
+	}
+
+	wg := sync.WaitGroup{}
+	wg.Add(len(wfrs))
+	errC, resC, cancel := r.startErrorCollector(ctx)
+
+	for _, wfr := range wfrs {
+		go func() {
+			defer wg.Done()
+
+			for _, cr := range wfr.CheckRuns {
+				for {
+					ans, res, err := client.Checks.ListCheckRunAnnotations(ctx, r.Owner, r.Repo, cr.Run.GetID(), opts)
+					if err != nil {
+						errC <- err
+						return
+					}
+					cr.Annotations = append(cr.Annotations, ans...)
+
+					if res.NextPage == 0 {
+						break
+					}
+
+					opts.Page = res.NextPage
+				}
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	return r.stopErrorCollector(errC, resC, cancel)
+}
+
+// getWorkflowJobs gets the jobs associated with the workflow runs.
+func (r *ListWorkflowRunsReq) getWorkflowJobs(ctx context.Context, client *gh.Client, wfrs []*WorkflowRun) error {
+	opts := &gh.ListWorkflowJobsOptions{
+		Filter:      "latest", // "all" to include all attempts
+		ListOptions: gh.ListOptions{PerPage: PerPageMax},
+	}
+
+	if len(wfrs) < 1 {
+		return nil
+	}
+
+	wg := sync.WaitGroup{}
+	wg.Add(len(wfrs))
+	errC, resC, cancel := r.startErrorCollector(ctx)
+
+	for _, run := range wfrs {
+		go func() {
+			defer wg.Done()
+
+			for {
+				jobs, res, err := client.Actions.ListWorkflowJobs(ctx, r.Owner, r.Repo, *run.Run.ID, opts)
+				if err != nil {
+					errC <- err
+					return
+				}
+
+				if r.Status == "" || !r.Compact {
+					for _, job := range jobs.Jobs {
+						run.Jobs = append(run.Jobs, &WorkflowJob{Job: job})
+					}
+				} else {
+					for _, job := range jobs.Jobs {
+						if job.GetConclusion() == r.Status || job.GetStatus() == r.Status {
+							run.Jobs = append(run.Jobs, &WorkflowJob{Job: job})
+						}
+					}
+				}
+
+				if res.NextPage == 0 {
+					break
+				}
+
+				opts.ListOptions.Page = res.NextPage
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	return r.stopErrorCollector(errC, resC, cancel)
+}
+
+// getUnsuccessfulWorkflowJobsLogs downloads the job log and parses out the
+// out failed entries for any unsuccesful jobs.
+func (r *ListWorkflowRunsReq) getUnsuccessfulWorkflowJobsLogs(ctx context.Context, client *gh.Client, wfrs []*WorkflowRun) error {
+	if len(wfrs) < 1 {
+		return nil
+	}
+
+	wg := sync.WaitGroup{}
+	wg.Add(len(wfrs))
+	errC, resC, cancel := r.startErrorCollector(ctx)
+
+	for _, run := range wfrs {
+		go func() {
+			defer wg.Done()
+
+			for _, job := range run.Jobs {
+				if job.Job == nil {
+					continue
+				}
+
+				if job.Job.GetStatus() == "completed" && job.Job.GetConclusion() == "successful" {
+					continue
+				}
+
+				url, _, err := client.Actions.GetWorkflowJobLogs(ctx, r.Owner, r.Repo, *job.Job.ID, 3) // last is max redirects
+				if err != nil {
+					errC <- err
+					return
+				}
+
+				req, err := http.NewRequestWithContext(ctx, http.MethodGet, url.String(), nil)
+				if err != nil {
+					errC <- err
+					return
+				}
+
+				res, err := http.DefaultClient.Do(req)
+				if err != nil {
+					errC <- err
+					return
+				}
+
+				defer res.Body.Close()
+				scanner := NewLogScaner(
+					WithLogScannerTruncate(), // truncate the body
+					// Our max size here is a magic number but seems to be a nice sweet
+					// spot where most of failure diagnostic will show up but you don't
+					// get walls of text.
+					WithLogScannerMaxSize(4000),
+					WithLogScannerOnlyUnsuccessful(), // only keep unsuccessful step logs
+				)
+
+				job.LogEntries, err = scanner.Scan(res.Body)
+				if err != nil {
+					errC <- err
+					return
+				}
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	return r.stopErrorCollector(errC, resC, cancel)
+}
+
+// startErrorCollector starts a helper go routine that listens and aggregrates
+// errors passed to it via it's returned channel. When the caller has completed
+// all work that may write errors it can call the stopErrorCollector() method
+// with the channel and cancel func to safely shut down the go routine and
+// receive the aggregrate error.
+func (r *ListWorkflowRunsReq) startErrorCollector(ctx context.Context) (chan error, chan error, context.CancelFunc) {
+	errC := make(chan error)
+	resC := make(chan error)
+	errCtx, cancelCollector := context.WithCancel(ctx)
+
+	go func() {
+		var err error
+
+	LOOP:
+		for {
+			select {
+			case err1 := <-errC:
+				err = errors.Join(err, err1)
+				continue
+			default:
+			}
+
+			select {
+			case err1 := <-errC:
+				err = errors.Join(err, err1)
+				continue
+			case <-errCtx.Done():
+				// Don't bubble up the close signal, only bubble up outer context errors
+				if err1 := ctx.Err(); err1 != nil {
+					err = errors.Join(err, err1)
+				}
+				break LOOP
+			}
+		}
+
+	DRAIN:
+		for {
+			select {
+			case err1 := <-errC:
+				err = errors.Join(err, err1)
+				continue
+			default:
+				break DRAIN
+			}
+		}
+
+		resC <- err
+	}()
+
+	return errC, resC, cancelCollector
+}
+
+// stopErrorCollector stops the error collector and returns the aggregrated error. The given channel
+// is closed. The caller must be sure that all work has concluded prior to calling.
+func (r *ListWorkflowRunsReq) stopErrorCollector(errC chan error, resC chan error, cancel context.CancelFunc) error {
+	cancel()
+	err := <-resC
+	close(errC)
+	close(resC)
+
+	return err
+}
+
+// summarizeWorkflowRuns creates a human readable summary for all workflow runs.
+func (r *ListWorkflowRunsReq) summarizeWorkflowRuns(wrfs []*WorkflowRun) error {
+	if len(wrfs) < 1 {
+		return nil
+	}
+
+	var err error
+	for _, run := range wrfs {
+		_, err = run.Summary()
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// Summary returns the human readable summary of the workflow run.
+func (r *WorkflowRun) Summary() (string, error) {
+	if r == nil {
+		return "", errors.New("uninitialized workflow run")
+	}
+
+	if r.summary != "" {
+		return r.summary, nil
+	}
+
+	var err error
+	r.summary, err = summarizeWorkflowRun(r)
+	return r.summary, err
+}
+
+// UnsuccessfulSteps returns any unsuccesful steps in the workflow job.
+func (j *WorkflowJob) UnsuccessfulSteps() []*gh.TaskStep {
+	if j == nil || j.Job == nil || len(j.Job.Steps) < 1 {
+		return nil
+	}
+
+	res := []*gh.TaskStep{}
+	for _, step := range j.Job.Steps {
+		if step.GetStatus() == "completed" && (step.GetConclusion() == "success" || step.GetConclusion() == "skipped") {
+			continue
+		}
+
+		res = append(res, step)
+	}
+
+	return res
+}
+
+// UnsuccessfulStepNames returns the names of any unsuccesful steps in the workflow job.
+func (j *WorkflowJob) UnsuccessfulStepNames() []string {
+	steps := j.UnsuccessfulSteps()
+	if len(steps) < 1 {
+		return nil
+	}
+
+	res := []string{}
+	for _, step := range steps {
+		res = append(res, step.GetName())
+	}
+
+	return res
+}
diff --git a/tools/pipeline/internal/pkg/github/list_workflow_runs_test.go b/tools/pipeline/internal/pkg/github/list_workflow_runs_test.go
new file mode 100644
index 00000000000..97f3812d72a
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/list_workflow_runs_test.go
@@ -0,0 +1,35 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"encoding/json"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestWorkflowRunSummaryTemplate verifies that we can correctly render a
+// human readable summary from our response test fixture. We don't do strict
+// value checking on rendered template. If you modify the template and/or
+// response struct you'll probably need to update the test fixture.
+func TestWorkflowRunSummaryTemplate(t *testing.T) {
+	f, err := os.Open(filepath.Join("./testfixtures/list_workflow_runs.json"))
+	require.NoError(t, err)
+	bytes, err := io.ReadAll(f)
+	require.NoError(t, err)
+	res := &ListWorkflowRunsRes{}
+	require.NoError(t, json.Unmarshal(bytes, res))
+	for _, run := range res.Runs {
+		require.NotNil(t, run)
+		run.summary = ""
+		summary, err := run.Summary()
+		require.NoErrorf(t, err, summary)
+		require.NotEmpty(t, summary)
+		// t.Log(summary) // useful to see rendered output when modifying
+	}
+}
diff --git a/tools/pipeline/internal/pkg/github/log_scanner.go b/tools/pipeline/internal/pkg/github/log_scanner.go
new file mode 100644
index 00000000000..1e61353b514
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/log_scanner.go
@@ -0,0 +1,253 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// LogScanner it a Github Actions workflow job log scanner and decoder.
+type LogScanner struct {
+	Truncate         bool
+	MaxSizeBytes     int
+	OnlySteps        []string
+	OnlyUnsuccessful bool
+}
+
+// LogScanOpts are scanner options.
+type LogScanOpts func(*LogScanner)
+
+// LogEntry is a job step log entry.
+type LogEntry struct {
+	StepName string `json:"step_name,omitempty"`
+	SetupLog []byte `json:"setup_log,omitempty"`
+	BodyLog  []byte `json:"body_log,omitempty"`
+	ErrorLog []byte `json:"error_log,omitempty"`
+}
+
+// logSection is a section token in the job log.
+type logSection int
+
+const (
+	labelGroup    = "##[group]"
+	labelEndGroup = "##[endgroup]"
+	labelError    = "##[error]"
+)
+
+const (
+	logSectionNone logSection = iota
+	logSectionSetup
+	logSectionBody
+	logSectionError
+)
+
+// NewLogScaner takes none-or-many LogScanOpts and returns a new instance of LogScanner.
+func NewLogScaner(opts ...LogScanOpts) *LogScanner {
+	scanner := &LogScanner{
+		Truncate:         false,
+		OnlySteps:        []string{},
+		OnlyUnsuccessful: false,
+		MaxSizeBytes:     (1 << 20), // 1MiB
+	}
+
+	for _, opt := range opts {
+		opt(scanner)
+	}
+
+	return scanner
+}
+
+// WithLogScannerTruncate enables body log truncation.
+func WithLogScannerTruncate() LogScanOpts {
+	return func(scanner *LogScanner) {
+		scanner.Truncate = true
+	}
+}
+
+// WithLogScannerMaxSize configures the max body log size if truncation is enabled.
+func WithLogScannerMaxSize(max int) LogScanOpts {
+	return func(scanner *LogScanner) {
+		scanner.MaxSizeBytes = max
+	}
+}
+
+// WithLogScannerOnlySteps takes step names and only returns entries for matching steps.
+func WithLogScannerOnlySteps(steps []string) LogScanOpts {
+	return func(scanner *LogScanner) {
+		if scanner.OnlySteps == nil {
+			scanner.OnlySteps = []string{}
+		}
+		for _, g := range steps {
+			scanner.OnlySteps = append(scanner.OnlySteps, strings.TrimSpace(g))
+		}
+	}
+}
+
+// WithLogScannerOnlyUnsuccessful filters any successful log entries.
+func WithLogScannerOnlyUnsuccessful() LogScanOpts {
+	return func(scanner *LogScanner) {
+		scanner.OnlyUnsuccessful = true
+	}
+}
+
+// Scan scans a Github Actions job raw log file and parses it into individual
+// entries for each step that is run.
+func (s *LogScanner) Scan(in io.Reader) ([]*LogEntry, error) {
+	if s == nil {
+		return nil, errors.New("uninitialized scanner")
+	}
+
+	scanner := bufio.NewScanner(in)
+	logBuffer := newLogBuffer(s.Truncate, s.MaxSizeBytes)
+	res := []*LogEntry{}
+	logSec := logSectionNone
+
+	for scanner.Scan() {
+		// ##[group]
+		if strings.Contains(scanner.Text(), labelGroup) {
+			logSec = logSectionSetup
+			// Start parsing a new log group.
+
+			// Before we begin, persist our last log entry and reset our buffer for
+			// our new group.
+			if logBuffer.stepName != "" {
+				res = append(res, logBuffer.entry())
+				logBuffer.reset()
+			}
+
+			parts := strings.SplitN(scanner.Text(), labelGroup, 2)
+			if len(parts) != 2 {
+				return nil, fmt.Errorf("malformed log group line expected %s followed by step name, got: %s", labelGroup, scanner.Text())
+			}
+			logBuffer.stepName = strings.TrimSpace(parts[1])
+			continue
+		}
+
+		// ##[error]
+		if strings.Contains(scanner.Text(), labelError) {
+			logSec = logSectionError
+			// The error label often preceeds the actual first line of the error log.
+			// Make sure we extract it and write it to the log.
+			parts := strings.SplitN(scanner.Text(), labelError, 2)
+			if len(parts) == 2 {
+				logBuffer.write(logSec, parts[0]+parts[1]+"\n")
+			}
+			continue
+		}
+
+		// ##[endgroup]
+		if strings.Contains(scanner.Text(), labelEndGroup) {
+			logSec = logSectionBody
+			continue
+		}
+
+		// Write the line to the buffer
+		logBuffer.write(logSec, scanner.Text()+"\n")
+	}
+
+	if err := scanner.Err(); err != nil {
+		return nil, err
+	}
+
+	// Write our last entry
+	res = append(res, logBuffer.entry())
+
+	if len(s.OnlySteps) == 0 && !s.OnlyUnsuccessful {
+		return res, nil
+	}
+
+	// Filter our respons if necessary
+	var entries []*LogEntry
+	if s.OnlyUnsuccessful {
+		for _, entry := range res {
+			if len(entry.ErrorLog) > 0 {
+				entries = append(entries, entry)
+			}
+		}
+	} else {
+		entries = res
+	}
+
+	if len(s.OnlySteps) < 1 {
+		return entries, nil
+	}
+
+	var filtered []*LogEntry
+	for _, entry := range entries {
+		for _, os := range s.OnlySteps {
+			if strings.Contains(strings.TrimSpace(entry.StepName), os) {
+				filtered = append(filtered, entry)
+			}
+		}
+	}
+
+	return filtered, nil
+}
+
+// logBuffer is a buffer used by the scanner when parsing a raw job log.
+type logBuffer struct {
+	truncate bool
+	maxSize  int
+	stepName string
+	setup    *strings.Builder
+	body     *strings.Builder
+	error    *strings.Builder
+}
+
+func (b *logBuffer) write(lc logSection, in string) {
+	switch lc {
+	case logSectionNone:
+	case logSectionSetup:
+		b.setup.WriteString(in)
+	case logSectionBody:
+		b.body.WriteString(in)
+	case logSectionError:
+		b.error.WriteString(in)
+	}
+}
+
+func (b *logBuffer) entry() *LogEntry {
+	var groupBody string
+	if b.truncate && b.body.Len() > b.maxSize {
+		groupBody = b.body.String()[b.body.Len()-b.maxSize:]
+	} else {
+		groupBody = b.body.String()
+	}
+
+	e := &LogEntry{
+		StepName: b.stepName,
+	}
+	if sl := []byte(strings.TrimSpace(b.setup.String())); len(sl) > 0 {
+		e.SetupLog = sl
+	}
+	if bl := []byte(strings.TrimSpace(groupBody)); len(bl) > 0 {
+		e.BodyLog = bl
+	}
+
+	if el := []byte(strings.TrimSpace(b.error.String())); len(el) > 0 {
+		e.ErrorLog = el
+	}
+
+	return e
+}
+
+func (b *logBuffer) reset() {
+	b.setup.Reset()
+	b.body.Reset()
+	b.error.Reset()
+}
+
+func newLogBuffer(truncate bool, maxSize int) *logBuffer {
+	return &logBuffer{
+		truncate: truncate,
+		maxSize:  maxSize,
+		body:     &strings.Builder{},
+		setup:    &strings.Builder{},
+		error:    &strings.Builder{},
+	}
+}
diff --git a/tools/pipeline/internal/pkg/github/noop_commit.go b/tools/pipeline/internal/pkg/github/noop_commit.go
new file mode 100644
index 00000000000..6d00a71c2dd
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/noop_commit.go
@@ -0,0 +1,38 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+
+	libgit "github.com/hashicorp/vault/tools/pipeline/internal/pkg/git"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+func resetAndCreateNOOPCommit(ctx context.Context, git *libgit.Client, baseRef string) error {
+	ctx = slogctx.Append(ctx, slog.String("base-ref", baseRef))
+	slog.Default().DebugContext(ctx, "hard resetting current checkout and creating no-op commit")
+
+	resetRes, err := git.Reset(ctx, &libgit.ResetOpts{
+		Mode:    libgit.ResetModeHard,
+		Treeish: baseRef,
+	})
+	if err != nil {
+		return fmt.Errorf("resetting back to base reference: %s: %w", resetRes.String(), err)
+	}
+
+	commitRes, err := git.Commit(ctx, &libgit.CommitOpts{
+		AllowEmpty: true,
+		Message:    "no-op commit",
+		NoVerify:   true,
+		NoEdit:     true,
+	})
+	if err != nil {
+		return fmt.Errorf("committing no-op commit: %s: %w", commitRes.String(), err)
+	}
+
+	return nil
+}
diff --git a/tools/pipeline/internal/pkg/github/pull_request.go b/tools/pipeline/internal/pkg/github/pull_request.go
new file mode 100644
index 00000000000..1d0822ff1ed
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/pull_request.go
@@ -0,0 +1,186 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+
+	libgithub "github.com/google/go-github/v74/github"
+	"github.com/shurcooL/githubv4"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// createPullRequestComment creates a comment on a pull request.
+func createPullRequestComment(
+	ctx context.Context,
+	github *libgithub.Client,
+	owner string,
+	repo string,
+	pullNumber int,
+	body string,
+) (*libgithub.IssueComment, error) {
+	ctx = slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.Int("pull-number", pullNumber),
+	)
+	slog.Default().DebugContext(ctx, "creating pull request comment")
+
+	// Always try and write a comment on the pull request
+	comment, _, err := github.Issues.CreateComment(
+		ctx, owner, repo, pullNumber, &libgithub.IssueComment{
+			Body: &body,
+		},
+	)
+	if err != nil {
+		err = fmt.Errorf("creating pull request comment: %w", err)
+	}
+
+	return comment, err
+}
+
+// getPullRequest gets for the pull request details.
+func getPullRequest(
+	ctx context.Context,
+	github *libgithub.Client,
+	owner string,
+	repo string,
+	pullNumber int,
+) (*libgithub.PullRequest, error) {
+	ctx = slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.Int("pull-number", pullNumber),
+	)
+	slog.Default().DebugContext(ctx, "getting pull request details")
+
+	pr, _, err := github.PullRequests.Get(ctx, owner, repo, pullNumber)
+	if err != nil {
+		return nil, err
+	}
+
+	return pr, nil
+}
+
+// closePullRequest closes a pull request.
+func closePullRequest(
+	ctx context.Context,
+	github *libgithub.Client,
+	owner string,
+	repo string,
+	pullNumber int,
+) error {
+	ctx = slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.Int("pull-number", pullNumber),
+	)
+	slog.Default().DebugContext(ctx, "closing pull request")
+
+	_, _, err := github.PullRequests.Edit(ctx, owner, repo, pullNumber, &libgithub.PullRequest{
+		State: libgithub.Ptr("closed"),
+	})
+
+	return err
+}
+
+// listPullRequestCommits lists all of the commits associated with a pull request.
+func listPullRequestCommits(
+	ctx context.Context,
+	github *libgithub.Client,
+	owner string,
+	repo string,
+	pullNumber int,
+) ([]*libgithub.RepositoryCommit, error) {
+	ctx = slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.Int("pull-number", pullNumber),
+	)
+	slog.Default().DebugContext(ctx, "listing pull request commits")
+
+	opts := &libgithub.ListOptions{PerPage: PerPageMax}
+	commits := []*libgithub.RepositoryCommit{}
+	for {
+		cs, res, err := github.PullRequests.ListCommits(ctx, owner, repo, pullNumber, opts)
+		if err != nil {
+			return nil, err
+		}
+		commits = append(commits, cs...)
+
+		if res.NextPage == 0 {
+			return commits, nil
+		}
+
+		opts.Page = res.NextPage
+	}
+}
+
+// listPullRequestReviews lists all of the reviews associated with a pull request.
+func listPullRequestReviews(
+	ctx context.Context,
+	github *libgithub.Client,
+	owner string,
+	repo string,
+	pullNumber int,
+) ([]*libgithub.PullRequestReview, error) {
+	ctx = slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.Int("pull-number", pullNumber),
+	)
+	slog.Default().DebugContext(ctx, "listing pull request reviews")
+
+	opts := &libgithub.ListOptions{PerPage: PerPageMax}
+	reviews := []*libgithub.PullRequestReview{}
+	for {
+		rvs, res, err := github.PullRequests.ListReviews(ctx, owner, repo, pullNumber, opts)
+		if err != nil {
+			return nil, err
+		}
+		reviews = append(reviews, rvs...)
+
+		if res.NextPage == 0 {
+			return reviews, nil
+		}
+
+		opts.Page = res.NextPage
+	}
+}
+
+// listPullRequestClosingIssues lists all "closing issues" associated with
+// a pull request. These can be set using keywords associations or manually
+// using the "development" sidebar on either an issue or pull request.
+func listPullRequestClosingIssues(
+	ctx context.Context,
+	github *githubv4.Client,
+	owner string,
+	repo string,
+	pullNumber int,
+) ([]*ClosingIssueRef, error) {
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.Int("pull-number", pullNumber),
+	), "getting pull request associated issues")
+
+	oai := ClosingIssueRefs{}
+	err := github.Query(ctx, &oai, map[string]any{
+		"owner":  githubv4.String(owner),
+		"repo":   githubv4.String(repo),
+		"number": githubv4.Int(pullNumber),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	ais := []*ClosingIssueRef{}
+	for _, ai := range oai.Repository.PullRequest.ClosingIssuesReferences.Edges {
+		ais = append(ais, ai.Node)
+	}
+
+	return ais, nil
+}
diff --git a/tools/pipeline/internal/pkg/github/pull_request_test.go b/tools/pipeline/internal/pkg/github/pull_request_test.go
new file mode 100644
index 00000000000..63e93558af0
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/pull_request_test.go
@@ -0,0 +1,50 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_encodeCopyPullRequest_Roundtrip(t *testing.T) {
+	t.Parallel()
+
+	for desc, test := range map[string]struct {
+		owner            string
+		repo             string
+		number           uint
+		prBranch         string
+		expectedPRBranch string
+	}{
+		"standard": {
+			owner:            "hashicorp",
+			repo:             "vault",
+			number:           49689,
+			prBranch:         "my-feature-branch",
+			expectedPRBranch: "my-feature-branch",
+		},
+		"super long": {
+			owner:    "hashicorp",
+			repo:     "vault",
+			number:   49689,
+			prBranch: "Lorem-ipsum-dolor-sit-amet--consectetur-adipiscing-elit--Praesent-accumsan-metus-sed-vehicula-accumsan--Nunc-semper-vehicula-tempor--Vestibulum-fringilla-enim-nec-ipsum-tincidunt-viverra--Etiam-iaculis-metus-ultricies-risus-rutrum--et-lobortis-orci-al",
+			// truncated the branch name as we'll hit our max char limit
+			expectedPRBranch: "Lorem-ipsum-dolor-sit-amet--consectetur-adipiscing-elit--Praesent-accumsan-metus-sed-vehicula-accumsan--Nunc-semper-vehicula-tempor--Vestibulum-fringilla-enim-nec-ipsum-tincidunt-viverra--Etiam-iaculis-metus-ultricies-risus",
+		},
+	} {
+		t.Run(desc, func(t *testing.T) {
+			t.Parallel()
+
+			encodedBranch := encodeCopyPullRequestBranch(test.owner, test.repo, test.number, test.prBranch)
+			owner, repo, number, branch, err := decodeCopyPullRequestBranch(encodedBranch)
+			require.NoError(t, err)
+			require.Equal(t, test.owner, owner)
+			require.Equal(t, test.repo, repo)
+			require.Equal(t, test.number, number)
+			require.Equal(t, test.expectedPRBranch, branch)
+		})
+	}
+}
diff --git a/tools/pipeline/internal/pkg/github/repo.go b/tools/pipeline/internal/pkg/github/repo.go
new file mode 100644
index 00000000000..289d9b30d07
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/repo.go
@@ -0,0 +1,156 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"strings"
+
+	libgit "github.com/hashicorp/vault/tools/pipeline/internal/pkg/git"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// ensureGitRepoDir repoDir verifies that the `dir` exists and is a directory.
+// If the `dir` is unset, a temporary directory will be created. A boolean
+// is returned which can be used to determine whether or not the path returned
+// is a temporary directory.
+func ensureGitRepoDir(ctx context.Context, dir string) (string, error, bool) {
+	if dir == "" {
+		slog.Default().DebugContext(ctx, "creating repository directory")
+		dir, err := os.MkdirTemp("", "pipeline-cmd-git-rep-dir")
+		return dir, err, true
+	}
+
+	ctx = slogctx.Append(ctx, slog.String("repo-dir", dir))
+	slog.Default().DebugContext(ctx, "verifying repository directory")
+	info, err := os.Stat(dir)
+	if err != nil {
+		return dir, fmt.Errorf("stating repository directory: %w", err), false
+	}
+
+	if !info.IsDir() {
+		return dir, errors.New("repo dir must be a directory"), false
+	}
+
+	return dir, nil, false
+}
+
+// initializeExistingRepo initializes an existing repository. It assumes that
+// at least one remote origin exists and that some branch is checked out. If
+// the current branch is our baseRef we'll pull in the latest changes, otherwise
+// we'll fetch baseRef.
+func initializeExistingRepo(
+	ctx context.Context,
+	git *libgit.Client,
+	repoDir string,
+	baseOrigin string,
+	baseRef string,
+) error {
+	ctx = slogctx.Append(ctx,
+		slog.String("repo-dir", repoDir),
+		slog.String("base-origin", baseOrigin),
+		slog.String("base-ref", baseRef),
+	)
+	// We've been given an already initialized git directory. We'll have to
+	// assume it's the correct repo that has been cloned.
+	slog.Default().WarnContext(ctx, "using an already initialized git repository")
+
+	slog.Default().DebugContext(ctx, "changing working directory to repository dir")
+	err := os.Chdir(repoDir)
+	if err != nil {
+		return fmt.Errorf("changing directory to the repository dir: %w", err)
+	}
+
+	// Determine if we're on the correct branch. If we are, pull it, otherwise
+	// fetch it.
+	slog.Default().DebugContext(ctx, "getting existing repo current branch")
+	res, err := git.Branch(ctx, &libgit.BranchOpts{
+		NoColor:     true,
+		ShowCurrent: true,
+	})
+	if err != nil {
+		return fmt.Errorf("getting existing repo current branch: %w", err)
+	}
+
+	if strings.TrimSpace(string(res.Stdout)) == baseRef {
+		// Our existing repo is already checked out to correct branch.
+		// Fetch the base ref to make sure our existing repository has the necessary
+		// objects and references we'll need to cherry-pick the commits to our
+		// branch.
+		slog.Default().DebugContext(ctx, "pulling in latest changes")
+		res, err := git.Pull(ctx, &libgit.PullOpts{
+			Refspec:     []string{baseOrigin, baseRef},
+			Autostash:   true,
+			SetUpstream: true,
+			Rebase:      libgit.RebaseStrategyTrue,
+		})
+		if err != nil {
+			return fmt.Errorf("pulling repo current branch: %s: %w", res.String(), err)
+		}
+
+		return nil
+	}
+
+	// Fetch the base ref to make sure our existing repository has the necessary
+	// objects and references.
+	slog.Default().DebugContext(ctx, "fetching repository base ref")
+	res, err = git.Fetch(ctx, &libgit.FetchOpts{
+		// Fetch the ref but also provide a local tracking branch of the same name
+		// e.g. "git fetch origin main:main"
+		Refspec:     []string{baseOrigin, fmt.Sprintf("%s:%s", baseRef, baseRef)},
+		SetUpstream: true,
+		Porcelain:   true,
+	})
+	if err != nil {
+		return fmt.Errorf("fetching base ref: %s: %w", res.String(), err)
+	}
+
+	return nil
+}
+
+// initializeNewRepo initializes a new repository by cloning the repo fetching
+// the `baseRef`.
+func initializeNewRepo(
+	ctx context.Context,
+	git *libgit.Client,
+	repoDir string,
+	owner string,
+	repo string,
+	baseOrigin string,
+	baseRef string,
+) error {
+	cloneURL := fmt.Sprintf("https://github.com/%s/%s.git", owner, repo)
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.String("base-origin", baseOrigin),
+		slog.String("base-ref", baseRef),
+		slog.String("repo-dir", repoDir),
+		slog.String("repo-url", cloneURL),
+	), "initializing new clone of repository")
+
+	res, err := git.Clone(ctx, &libgit.CloneOpts{
+		Repository:   cloneURL,
+		Directory:    repoDir,
+		Origin:       baseOrigin,
+		Branch:       baseRef,
+		SingleBranch: true,
+		NoCheckout:   true,
+	})
+	if err != nil {
+		return fmt.Errorf("cloning repository: %s: %w", res.String(), err)
+	}
+
+	slog.Default().DebugContext(ctx, "changing working directory to repo-dir")
+	err = os.Chdir(repoDir)
+	if err != nil {
+		return fmt.Errorf("changing directory to the repository dir: %w", err)
+	}
+
+	return nil
+}
diff --git a/tools/pipeline/internal/pkg/github/sync_branch_request.go b/tools/pipeline/internal/pkg/github/sync_branch_request.go
new file mode 100644
index 00000000000..13e70661810
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/sync_branch_request.go
@@ -0,0 +1,233 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+
+	libgithub "github.com/google/go-github/v74/github"
+	libgit "github.com/hashicorp/vault/tools/pipeline/internal/pkg/git"
+	"github.com/jedib0t/go-pretty/v6/table"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// SyncBranchReq is a request to synchronize two github hosted branches with
+// a git merge from one into another.
+//
+// NOTE: We require that both branches exist for the operation to succeed.
+type SyncBranchReq struct {
+	FromOwner  string
+	FromRepo   string
+	FromOrigin string
+	FromBranch string
+	ToOwner    string
+	ToRepo     string
+	ToOrigin   string
+	ToBranch   string
+	RepoDir    string
+}
+
+// SyncBranchRes is a copy pull request response.
+type SyncBranchRes struct {
+	Error   error          `json:"error,omitempty"`
+	Request *SyncBranchReq `json:"request,omitempty"`
+}
+
+// Run runs the request to synchronize a branches via a merge.
+func (r *SyncBranchReq) Run(
+	ctx context.Context,
+	github *libgithub.Client,
+	git *libgit.Client,
+) (*SyncBranchRes, error) {
+	var err error
+	res := &SyncBranchRes{Request: r}
+
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("from-owner", r.FromOwner),
+		slog.String("from-repo", r.FromRepo),
+		slog.String("from-origin", r.FromOrigin),
+		slog.String("from-branch", r.FromBranch),
+		slog.String("to-owner", r.ToOwner),
+		slog.String("to-repo", r.ToRepo),
+		slog.String("to-origin", r.ToOrigin),
+		slog.String("to-branch", r.ToBranch),
+		slog.String("to-owner", r.ToOwner),
+		slog.String("repo-dir", r.RepoDir),
+	), "synchronizing branches")
+
+	// Make sure we have required and valid fields
+	err = r.Validate(ctx)
+	if err != nil {
+		return res, err
+	}
+
+	// Make sure we've been given a valid location for a repo and/or create a
+	// temporary one
+	var tmpDir bool
+	r.RepoDir, err, tmpDir = ensureGitRepoDir(ctx, r.RepoDir)
+	if err != nil {
+		return res, err
+	}
+	if tmpDir {
+		defer os.RemoveAll(r.RepoDir)
+	}
+
+	// Clone the remote repository and fetch the branch we're going to merge into.
+	// These will change our working directory into RepoDir.
+	_, err = os.Stat(filepath.Join(r.RepoDir, ".git"))
+	if err == nil {
+		err = initializeExistingRepo(
+			ctx, git, r.RepoDir, r.ToOrigin, r.ToBranch,
+		)
+	} else {
+		err = initializeNewRepo(
+			ctx, git, r.RepoDir, r.ToOwner, r.ToRepo, r.ToOrigin, r.ToBranch,
+		)
+	}
+	if err != nil {
+		return res, err
+	}
+
+	// Check out our branch. Our intialization above will ensure we have a local
+	// reference.
+	slog.Default().DebugContext(ctx, "checking out to-branch")
+	checkoutRes, err := git.Checkout(ctx, &libgit.CheckoutOpts{
+		Branch: r.ToBranch,
+	})
+	if err != nil {
+		return res, fmt.Errorf("checking out to-branch: %s: %w", checkoutRes.String(), err)
+	}
+
+	// Add our from upstream as a remote and fetch our from branch.
+	slog.Default().DebugContext(ctx, "adding from upstream and fetching from-branch")
+	remoteRes, err := git.Remote(ctx, &libgit.RemoteOpts{
+		Command: libgit.RemoteCommandAdd,
+		Track:   []string{r.FromBranch},
+		Fetch:   true,
+		Name:    r.FromOrigin,
+		URL:     fmt.Sprintf("https://github.com/%s/%s.git", r.FromOwner, r.FromRepo),
+	})
+	if err != nil {
+		err = fmt.Errorf("fetching from branch: %s, %w", remoteRes.String(), err)
+		return res, err
+	}
+
+	// Use our remote reference as we haven't created a local reference.
+	fromBranch := "remotes/" + r.FromOrigin + "/" + r.FromBranch
+	slog.Default().DebugContext(ctx, "merging from-branch into to-branch")
+	mergeRes, err := git.Merge(ctx, &libgit.MergeOpts{
+		NoVerify: true,
+		Strategy: libgit.MergeStrategyORT,
+		StrategyOptions: []libgit.MergeStrategyOption{
+			libgit.MergeStrategyOptionTheirs,
+			libgit.MergeStrategyOptionIgnoreSpaceChange,
+		},
+		IntoName: r.ToBranch,
+		Commit:   fromBranch,
+	})
+	if err != nil {
+		return res, fmt.Errorf("merging from-branch into to-branch: %s: %w", mergeRes.String(), err)
+	}
+
+	slog.Default().DebugContext(ctx, "pushing to-branch")
+	pushRes, err := git.Push(ctx, &libgit.PushOpts{
+		Repository: r.ToOrigin,
+		Refspec:    []string{r.ToBranch},
+	})
+	if err != nil {
+		return res, fmt.Errorf("pushing to-branch: %s: %w", pushRes.String(), err)
+	}
+
+	return res, nil
+}
+
+// Validate ensures that we've been given the minimum filter arguments necessary to complete a
+// request. It is always recommended that additional fitlers be given to reduce the response size
+// and not exhaust API limits.
+func (r *SyncBranchReq) Validate(ctx context.Context) error {
+	// TODO
+	if r == nil {
+		return errors.New("failed to initialize request")
+	}
+
+	if r.FromOrigin == "" {
+		return errors.New("no github from origin has been provided")
+	}
+
+	if r.FromOwner == "" {
+		return errors.New("no github from owner has been provided")
+	}
+
+	if r.FromRepo == "" {
+		return errors.New("no github from repository has been provided")
+	}
+
+	if r.FromBranch == "" {
+		return errors.New("no github from branch has been provided")
+	}
+
+	if r.ToOrigin == "" {
+		return errors.New("no github to origin has been provided")
+	}
+
+	if r.ToOwner == "" {
+		return errors.New("no github to owner has been provided")
+	}
+
+	if r.ToRepo == "" {
+		return errors.New("no github to repository has been provided")
+	}
+
+	if r.ToBranch == "" {
+		return errors.New("no github to branch has been provided")
+	}
+
+	return nil
+}
+
+// ToJSON marshals the response to JSON.
+func (r *SyncBranchRes) ToJSON() ([]byte, error) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling list changed files to JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToTable marshals the response to a text table.
+func (r *SyncBranchRes) ToTable(err error) table.Writer {
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+	t.AppendHeader(table.Row{
+		"From", "To", "Error",
+	})
+
+	if r.Request != nil {
+		from := r.Request.FromOwner + "/" + r.Request.FromRepo + "/" + r.Request.FromBranch
+		to := r.Request.ToOwner + "/" + r.Request.ToRepo + "/" + r.Request.ToBranch
+		row := table.Row{from, to}
+		if err != nil {
+			row = append(row, err.Error())
+		} else {
+			row = append(row, nil)
+		}
+		t.AppendRow(row)
+	}
+
+	t.SuppressEmptyColumns()
+	t.SuppressTrailingSpaces()
+
+	return t
+}
diff --git a/tools/pipeline/internal/pkg/github/templates.go b/tools/pipeline/internal/pkg/github/templates.go
new file mode 100644
index 00000000000..da5cfd3409a
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/templates.go
@@ -0,0 +1,73 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"bytes"
+	"embed"
+	"io"
+	"os"
+	"text/template"
+)
+
+//go:embed templates/*
+var templates embed.FS
+
+// renderEmbeddedTemplateToTmpFile renders an embedded template to a temporary
+// file on disk and returns the path. The caller is responsible for handling
+// the file thereafter.
+func renderEmbeddedTemplateToTmpFile(name string, data any) (*os.File, error) {
+	s, err := os.CreateTemp("", name)
+	if err != nil {
+		return nil, err
+	}
+
+	err = renderEmbeddedTemplateTo(name, data, s)
+	if err != nil {
+		return nil, err
+	}
+
+	// Rename the file as it forces writes to be flushed
+	dst := s.Name() + "d"
+	err = os.Rename(s.Name(), dst)
+	if err != nil {
+		return nil, err
+	}
+
+	return os.Open(dst)
+}
+
+// renderEmbeddedTemplateTo renders an embedded template to an io.Writer. The
+// caller is responsible for closing the writer.
+func renderEmbeddedTemplateTo(name string, data any, writer io.Writer) error {
+	body, err := renderEmbeddedTemplate(name, data)
+	if err != nil {
+		return err
+	}
+
+	_, err = io.WriteString(writer, body)
+
+	return err
+}
+
+// renderEmbeddedTemplate renders an embedded template to a string
+func renderEmbeddedTemplate(name string, data any) (string, error) {
+	tmpl, err := templates.ReadFile("templates/" + name)
+	if err != nil {
+		return "", err
+	}
+
+	t, err := template.New(name).Parse(string(tmpl))
+	if err != nil {
+		return "", err
+	}
+
+	buf := bytes.Buffer{}
+	err = t.Execute(&buf, data)
+	if err != nil {
+		return "", err
+	}
+
+	return buf.String(), nil
+}
diff --git a/tools/pipeline/internal/pkg/github/templates/backport-pr-message.tmpl b/tools/pipeline/internal/pkg/github/templates/backport-pr-message.tmpl
new file mode 100644
index 00000000000..0d2cf30dbb2
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/templates/backport-pr-message.tmpl
@@ -0,0 +1,34 @@
+## Backport [#{{ .OriginPullRequest.Number }}]({{ .OriginPullRequest.HTMLURL }}){{ if .Attempt.TargetRef }} into {{ .Attempt.TargetRef }} {{ end }}
+
+{{ if .Attempt.Error }}
+:rotating_light:
+>**Warning** automatic backport of commits failed. If the first commit failed,
+you will see a blank no-op commit below. If at least one commit succeeded, you
+will see the backported commits up to, _but not including_, the commit where
+the merge conflict occurred.
+
+The person who merged in the original PR is: @{{ .OriginPullRequest.GetMergedBy.GetLogin }}
+This person should resolve the merge-conflict(s) by either:
+* Manually completing the backports into this branch
+* Creating a new branch and manually backporting all commits
+
+Error(s) encountered while attempting the backport:
+> {{ .Attempt.Error }}
+
+To continue the backport process, please follow the instructions below:
+
+1. Checkout the branch in this PR locally (or optionally create a new branch off {{ .OriginPullRequest.GetBase.GetRef }})
+1. Manually cherry-pick the missing commits from the original PR into this branch:
+  1. Cherry-pick the commits from the original PR into this branch `git cherry-pick <commit-hash>` (see Overview of unprocessed commits below for the list of commits to cherry-pick)
+  1. Resolve any conflicts that arise
+  1. Remove any CE only files if the backport target branch is to ce
+  1. Push the changes to this branch
+1. Update the PR description to reflect the new commit(s)
+
+{{ end }}
+
+The following text was copied from the body of the original pull request
+
+---
+
+{{ .OriginPullRequest.Body }}
diff --git a/tools/pipeline/internal/pkg/github/templates/copy-pr-commit-message.tmpl b/tools/pipeline/internal/pkg/github/templates/copy-pr-commit-message.tmpl
new file mode 100644
index 00000000000..a7140502b57
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/templates/copy-pr-commit-message.tmpl
@@ -0,0 +1,5 @@
+Copy {{ .OriginPullRequest.HTMLURL }}{{ if .TargetRef }} into {{ .TargetRef }}{{ end }}
+
+{{ range $i, $t := .CoAuthoredByTrailers -}}
+{{ $t }}
+{{ end -}}
diff --git a/tools/pipeline/internal/pkg/github/templates/copy-pr-message.tmpl b/tools/pipeline/internal/pkg/github/templates/copy-pr-message.tmpl
new file mode 100644
index 00000000000..dff441e980b
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/templates/copy-pr-message.tmpl
@@ -0,0 +1,34 @@
+## Copy community pull request [#{{ .OriginPullRequest.Number }}]({{ .OriginPullRequest.HTMLURL }}){{ if .TargetRef }} to {{ .TargetRef }}{{ end }}
+
+{{ if .Error }}
+:rotating_light:
+>**Warning** Copying of a community contributed pull request failed. If the
+first commit failed, you will see a blank no-op commit below. If at least one
+commit succeeded, you will see the copied commits up to, _but not including_,
+the commit where the merge conflict occurred.
+
+The person who merged in the original PR is: @{{ .OriginPullRequest.GetMergedBy.GetLogin }}
+This person should resolve the merge-conflict(s) by either:
+* Manually completing the copy into this branch
+* Creating a new branch and manually copying all commits
+
+Error(s) encountered while attempting the copy:
+> {{ .Error }}
+
+To continue the copy process, please follow the instructions below:
+
+1. Checkout the branch in this PR locally (or optionally create a new branch off {{ .OriginPullRequest.GetBase.GetRef }})
+1. Manually cherry-pick the missing commits from the original PR into this branch:
+  1. Cherry-pick the commits from the original PR into this branch `git cherry-pick <commit-hash>` (see Overview of unprocessed commits below for the list of commits to cherry-pick)
+  1. Resolve any conflicts that arise
+  1. Remove any CE only files if the copy target branch is to ce
+  1. Push the changes to this branch
+1. Update the PR description to reflect the new commit(s)
+
+{{ end }}
+
+The following text was copied from the body of the original pull request
+
+---
+
+{{ .OriginPullRequest.Body }}
diff --git a/tools/pipeline/internal/pkg/github/templates/workflow-run-text.tmpl b/tools/pipeline/internal/pkg/github/templates/workflow-run-text.tmpl
new file mode 100644
index 00000000000..370dce0a5bc
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/templates/workflow-run-text.tmpl
@@ -0,0 +1,62 @@
+{{ .Run.Name }} (ID: {{ .Run.ID }})
+  Title: {{ boldify .Run.DisplayTitle }}
+  URL: {{ .Run.HTMLURL }}
+  HEAD Branch: {{ .Run.HeadBranch }}
+  HEAD SHA: {{ .Run.HeadSHA }}
+  Author: {{ .Run.HeadCommit.Author.Name }}
+  Actor: {{ .Run.Actor.Login }}
+  Attempt: {{ .Run.RunAttempt }}
+  {{- if .CheckRuns }}
+  {{ boldify "Annotations" }}
+    {{- range $cr := .CheckRuns }}
+    {{- range $a := $cr.Annotations }}
+    {{ intensify_annotation $a.AnnotationLevel }}{{- if $a.Title }} {{ boldify $a.Title }}{{- end -}}
+    {{- if $a.Message }}
+    {{- range $am := splitlines $a.Message }}
+      {{ boldify $am }}
+    {{- end -}}
+    {{- end -}}
+    {{- if $a.RawDetails }}
+    {{- range $ad := splitlines $a.RawDetails }}
+      {{ boldify $ad }}
+    {{- end -}}
+    {{- end -}}
+    {{- end -}}
+    {{- end -}}
+  {{- end }}
+  Status: {{ intensify_status .Run.Status }}
+  Conclusion: {{ intensify_status .Run.Conclusion }}
+  {{- if .Jobs -}}
+  {{- range $j := .Jobs }}
+    Job: {{ boldify $j.Job.Name }}
+      URL: {{ $j.Job.HTMLURL }}
+      Status: {{ $j.Job.Status }}
+      Conclusion: {{ $j.Job.Conclusion }}
+      CreatedAt: {{ $j.Job.CreatedAt }}
+      StartedAt: {{ $j.Job.StartedAt }}
+      CompletedAt: {{ $j.Job.CompletedAt }}
+      {{- if .UnsuccessfulSteps }}
+      {{ boldify "Unsuccessful Steps:" }}
+      {{- range $s := .UnsuccessfulSteps }}
+        Step: {{ boldify $s.Name }}
+          Status: {{ intensify_status $s.Status }}
+          Conclusion: {{ intensify_status $s.Conclusion }}
+      {{- end -}}
+      {{- end -}}
+      {{- if .LogEntries }}
+      {{ boldify "Unsuccessful Step Log Summaries:" }}
+      {{- range $l := .LogEntries }}
+        Step: {{ boldify $l.StepName }}
+        {{- range $sl := format_log_lines $l.SetupLog }}
+          {{ $sl }}
+        {{- end -}}
+        {{- range $bl := format_log_lines $l.BodyLog }}
+          {{ $bl }}
+        {{- end -}}
+        {{- range $el := format_log_lines $l.ErrorLog }}
+          {{ redify $el }}
+        {{- end -}}
+      {{- end -}}
+      {{- end -}}
+  {{- end -}}
+  {{- end -}}
diff --git a/tools/pipeline/internal/pkg/github/templates_test.go b/tools/pipeline/internal/pkg/github/templates_test.go
new file mode 100644
index 00000000000..6732ad7ba6c
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/templates_test.go
@@ -0,0 +1,168 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"errors"
+	"io"
+	"testing"
+
+	libgithub "github.com/google/go-github/v74/github"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_renderEmbeddedTemplate_backportPRMessage(t *testing.T) {
+	t.Parallel()
+
+	for name, test := range map[string]struct {
+		expectContains    []string
+		expectNotContains []string
+		origin            *libgithub.PullRequest
+		attempt           *CreateBackportAttempt
+	}{
+		"no error": {
+			expectContains:    []string{"original body"},
+			expectNotContains: []string{"error body"},
+			origin: &libgithub.PullRequest{
+				Body:     libgithub.Ptr("original body"),
+				Number:   libgithub.Ptr(1234),
+				HTMLURL:  libgithub.Ptr("https://github.com/hashicorp/vault-enterprise/pull/1234"),
+				MergedBy: &libgithub.User{Login: libgithub.Ptr("my-login")},
+			},
+			attempt: &CreateBackportAttempt{
+				TargetRef: "release/1.19.x",
+			},
+		},
+		"error": {
+			expectContains: []string{"original body", "error body"},
+			origin: &libgithub.PullRequest{
+				Body:     libgithub.Ptr("original body"),
+				Number:   libgithub.Ptr(1234),
+				HTMLURL:  libgithub.Ptr("https://github.com/hashicorp/vault-enterprise/pull/1234"),
+				MergedBy: &libgithub.User{Login: libgithub.Ptr("my-login")},
+			},
+			attempt: &CreateBackportAttempt{
+				TargetRef: "release/1.19.x",
+				Error:     errors.New("error body"),
+			},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			got, err := renderEmbeddedTemplate("backport-pr-message.tmpl", struct {
+				OriginPullRequest *libgithub.PullRequest
+				Attempt           *CreateBackportAttempt
+			}{test.origin, test.attempt})
+			require.NoError(t, err)
+			for _, c := range test.expectContains {
+				require.Containsf(t, got, c, got)
+			}
+			for _, nc := range test.expectNotContains {
+				require.NotContainsf(t, got, nc, got)
+			}
+		})
+	}
+}
+
+func Test_renderEmbeddedTemplate_copyPRMessage(t *testing.T) {
+	t.Parallel()
+
+	for name, test := range map[string]struct {
+		expectContains    []string
+		expectNotContains []string
+		origin            *libgithub.PullRequest
+		error             error
+		targetRef         string
+	}{
+		"no error": {
+			expectContains:    []string{"original body"},
+			expectNotContains: []string{"error body"},
+			origin: &libgithub.PullRequest{
+				Body:     libgithub.Ptr("original body"),
+				Number:   libgithub.Ptr(1234),
+				HTMLURL:  libgithub.Ptr("https://github.com/hashicorp/vault-enterprise/pull/1234"),
+				MergedBy: &libgithub.User{Login: libgithub.Ptr("my-login")},
+			},
+			targetRef: "release/1.19.x",
+			error:     nil,
+		},
+		"error": {
+			expectContains: []string{"original body", "error body"},
+			origin: &libgithub.PullRequest{
+				Body:     libgithub.Ptr("original body"),
+				Number:   libgithub.Ptr(1234),
+				HTMLURL:  libgithub.Ptr("https://github.com/hashicorp/vault-enterprise/pull/1234"),
+				MergedBy: &libgithub.User{Login: libgithub.Ptr("my-login")},
+			},
+			targetRef: "release/1.19.x",
+			error:     errors.New("error body"),
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			got, err := renderEmbeddedTemplate("copy-pr-message.tmpl", struct {
+				OriginPullRequest *libgithub.PullRequest
+				TargetRef         string
+				Error             error
+			}{
+				test.origin,
+				test.targetRef,
+				test.error,
+			})
+			require.NoError(t, err)
+			for _, c := range test.expectContains {
+				require.Containsf(t, got, c, got)
+			}
+			for _, nc := range test.expectNotContains {
+				require.NotContainsf(t, got, nc, got)
+			}
+		})
+	}
+}
+
+func Test_renderEmbeddedTemplateToTmpFile_copyPRComment(t *testing.T) {
+	t.Parallel()
+
+	for name, test := range map[string]struct {
+		coAuthoredByTrailers []string
+		originPullRequest    *libgithub.PullRequest
+		targetRef            string
+	}{
+		"Co-Authored-By": {
+			coAuthoredByTrailers: []string{
+				"Co-Authored-By: Jane Doe <jane@example.com>",
+				"Co-Authored-By: John Doe <john@example.com>",
+			},
+			originPullRequest: &libgithub.PullRequest{
+				Body:     libgithub.Ptr("original body"),
+				Number:   libgithub.Ptr(1234),
+				HTMLURL:  libgithub.Ptr("https://github.com/hashicorp/vault-enterprise/pull/1234"),
+				MergedBy: &libgithub.User{Login: libgithub.Ptr("my-login")},
+			},
+			targetRef: "release/1.19.x+ent",
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			file, err := renderEmbeddedTemplateToTmpFile("copy-pr-commit-message.tmpl", struct {
+				CoAuthoredByTrailers []string
+				OriginPullRequest    *libgithub.PullRequest
+				TargetRef            string
+			}{
+				test.coAuthoredByTrailers,
+				test.originPullRequest,
+				test.targetRef,
+			})
+
+			require.NoError(t, err)
+			defer file.Close()
+			bytes, err := io.ReadAll(file)
+			require.NoError(t, err)
+			require.NotEmpty(t, bytes)
+			for _, c := range test.coAuthoredByTrailers {
+				require.Contains(t, string(bytes), c)
+			}
+		})
+	}
+}
diff --git a/tools/pipeline/internal/pkg/github/testfixtures/list_workflow_runs.json b/tools/pipeline/internal/pkg/github/testfixtures/list_workflow_runs.json
new file mode 100644
index 00000000000..c4b0a375d20
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/testfixtures/list_workflow_runs.json
@@ -0,0 +1 @@
+{"workflow":{"id":13877638,"node_id":"W_kwDOAd1ufs4A08GG","name":"build","path":".github/workflows/build.yml","state":"active","created_at":"2021-10-05T13:04:37-06:00","updated_at":"2024-10-04T16:55:52-06:00","url":"https://api.github.com/repos/hashicorp/vault/actions/workflows/13877638","html_url":"https://github.com/hashicorp/vault/blob/main/.github/workflows/build.yml","badge_url":"https://github.com/hashicorp/vault/workflows/build/badge.svg"},"runs":[{"run":{"id":12821474724,"name":"build","node_id":"WFR_kwLOAd1ufs8AAAAC_DgtpA","head_branch":"main","head_sha":"e69f2ace060741474a49231bf8330f97547c8b2b","path":".github/workflows/build.yml","run_number":51176,"run_attempt":1,"event":"schedule","display_title":"build","status":"completed","conclusion":"failure","workflow_id":13877638,"check_suite_id":33171639648,"check_suite_node_id":"CS_kwDOAd1ufs8AAAAHuS8NYA","url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12821474724","html_url":"https://github.com/hashicorp/vault/actions/runs/12821474724","created_at":"2025-01-17T02:25:31Z","updated_at":"2025-01-17T02:44:53Z","run_started_at":"2025-01-17T02:25:31Z","jobs_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12821474724/jobs","logs_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12821474724/logs","check_suite_url":"https://api.github.com/repos/hashicorp/vault/check-suites/33171639648","artifacts_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12821474724/artifacts","cancel_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12821474724/cancel","rerun_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12821474724/rerun","head_commit":{"message":"Fix Static Role Name Consistency in PostgreSQL Configuration (#29138)\n\n* Updated the PostgreSQL database creation command to ensure the static role name is consistent.\n\nThe role name specified in allowed_roles=\"my-role\" under the section \"Rootless Configuration and Password Rotation for Static Roles\" should align with the static role name in step #3. Previously, the command incorrectly used \"my-static-role\"; it should be \"my-role\" to match the earlier step.\n\nThe same role name should also be used when reading the static credentials in step #4\n\n* Added the file changelog/29138.txt\n\n* Delete changelog/29138.txt\n\n---------\n\nCo-authored-by: Yoko Hyakuna \u003cyoko@hashicorp.com\u003e\nCo-authored-by: akshya96 \u003c87045294+akshya96@users.noreply.github.com\u003e\nCo-authored-by: Violet Hynes \u003cviolet.hynes@hashicorp.com\u003e","author":{"name":"swati","email":"164215811+swatibourai0560@users.noreply.github.com"},"id":"e69f2ace060741474a49231bf8330f97547c8b2b","tree_id":"6bce64f11c47e1e5ceb9e6c2d0701689a884a453","timestamp":"2025-01-16T21:05:20Z","committer":{"name":"GitHub","email":"noreply@github.com"}},"workflow_url":"https://api.github.com/repos/hashicorp/vault/actions/workflows/13877638","repository":{"id":31288958,"node_id":"MDEwOlJlcG9zaXRvcnkzMTI4ODk1OA==","owner":{"login":"hashicorp","id":761456,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc2MTQ1Ng==","avatar_url":"https://avatars.githubusercontent.com/u/761456?v=4","html_url":"https://github.com/hashicorp","gravatar_id":"","type":"Organization","site_admin":false,"url":"https://api.github.com/users/hashicorp","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","followers_url":"https://api.github.com/users/hashicorp/followers","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","organizations_url":"https://api.github.com/users/hashicorp/orgs","received_events_url":"https://api.github.com/users/hashicorp/received_events","repos_url":"https://api.github.com/users/hashicorp/repos","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions"},"name":"vault","full_name":"hashicorp/vault","description":"A tool for secrets management, encryption as a service, and privileged access management","html_url":"https://github.com/hashicorp/vault","fork":false,"private":false,"url":"https://api.github.com/repos/hashicorp/vault","archive_url":"https://api.github.com/repos/hashicorp/vault/{archive_format}{/ref}","assignees_url":"https://api.github.com/repos/hashicorp/vault/assignees{/user}","blobs_url":"https://api.github.com/repos/hashicorp/vault/git/blobs{/sha}","branches_url":"https://api.github.com/repos/hashicorp/vault/branches{/branch}","collaborators_url":"https://api.github.com/repos/hashicorp/vault/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/hashicorp/vault/comments{/number}","commits_url":"https://api.github.com/repos/hashicorp/vault/commits{/sha}","compare_url":"https://api.github.com/repos/hashicorp/vault/compare/{base}...{head}","contents_url":"https://api.github.com/repos/hashicorp/vault/contents/{+path}","contributors_url":"https://api.github.com/repos/hashicorp/vault/contributors","deployments_url":"https://api.github.com/repos/hashicorp/vault/deployments","downloads_url":"https://api.github.com/repos/hashicorp/vault/downloads","events_url":"https://api.github.com/repos/hashicorp/vault/events","forks_url":"https://api.github.com/repos/hashicorp/vault/forks","git_commits_url":"https://api.github.com/repos/hashicorp/vault/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/vault/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/vault/git/tags{/sha}","hooks_url":"https://api.github.com/repos/hashicorp/vault/hooks","issue_comment_url":"https://api.github.com/repos/hashicorp/vault/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/hashicorp/vault/issues/events{/number}","issues_url":"https://api.github.com/repos/hashicorp/vault/issues{/number}","keys_url":"https://api.github.com/repos/hashicorp/vault/keys{/key_id}","labels_url":"https://api.github.com/repos/hashicorp/vault/labels{/name}","languages_url":"https://api.github.com/repos/hashicorp/vault/languages","merges_url":"https://api.github.com/repos/hashicorp/vault/merges","milestones_url":"https://api.github.com/repos/hashicorp/vault/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/vault/notifications{?since,all,participating}","pulls_url":"https://api.github.com/repos/hashicorp/vault/pulls{/number}","releases_url":"https://api.github.com/repos/hashicorp/vault/releases{/id}","stargazers_url":"https://api.github.com/repos/hashicorp/vault/stargazers","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/{sha}","subscribers_url":"https://api.github.com/repos/hashicorp/vault/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/vault/subscription","tags_url":"https://api.github.com/repos/hashicorp/vault/tags","trees_url":"https://api.github.com/repos/hashicorp/vault/git/trees{/sha}","teams_url":"https://api.github.com/repos/hashicorp/vault/teams"},"head_repository":{"id":31288958,"node_id":"MDEwOlJlcG9zaXRvcnkzMTI4ODk1OA==","owner":{"login":"hashicorp","id":761456,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc2MTQ1Ng==","avatar_url":"https://avatars.githubusercontent.com/u/761456?v=4","html_url":"https://github.com/hashicorp","gravatar_id":"","type":"Organization","site_admin":false,"url":"https://api.github.com/users/hashicorp","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","followers_url":"https://api.github.com/users/hashicorp/followers","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","organizations_url":"https://api.github.com/users/hashicorp/orgs","received_events_url":"https://api.github.com/users/hashicorp/received_events","repos_url":"https://api.github.com/users/hashicorp/repos","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions"},"name":"vault","full_name":"hashicorp/vault","description":"A tool for secrets management, encryption as a service, and privileged access management","html_url":"https://github.com/hashicorp/vault","fork":false,"private":false,"url":"https://api.github.com/repos/hashicorp/vault","archive_url":"https://api.github.com/repos/hashicorp/vault/{archive_format}{/ref}","assignees_url":"https://api.github.com/repos/hashicorp/vault/assignees{/user}","blobs_url":"https://api.github.com/repos/hashicorp/vault/git/blobs{/sha}","branches_url":"https://api.github.com/repos/hashicorp/vault/branches{/branch}","collaborators_url":"https://api.github.com/repos/hashicorp/vault/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/hashicorp/vault/comments{/number}","commits_url":"https://api.github.com/repos/hashicorp/vault/commits{/sha}","compare_url":"https://api.github.com/repos/hashicorp/vault/compare/{base}...{head}","contents_url":"https://api.github.com/repos/hashicorp/vault/contents/{+path}","contributors_url":"https://api.github.com/repos/hashicorp/vault/contributors","deployments_url":"https://api.github.com/repos/hashicorp/vault/deployments","downloads_url":"https://api.github.com/repos/hashicorp/vault/downloads","events_url":"https://api.github.com/repos/hashicorp/vault/events","forks_url":"https://api.github.com/repos/hashicorp/vault/forks","git_commits_url":"https://api.github.com/repos/hashicorp/vault/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/vault/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/vault/git/tags{/sha}","hooks_url":"https://api.github.com/repos/hashicorp/vault/hooks","issue_comment_url":"https://api.github.com/repos/hashicorp/vault/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/hashicorp/vault/issues/events{/number}","issues_url":"https://api.github.com/repos/hashicorp/vault/issues{/number}","keys_url":"https://api.github.com/repos/hashicorp/vault/keys{/key_id}","labels_url":"https://api.github.com/repos/hashicorp/vault/labels{/name}","languages_url":"https://api.github.com/repos/hashicorp/vault/languages","merges_url":"https://api.github.com/repos/hashicorp/vault/merges","milestones_url":"https://api.github.com/repos/hashicorp/vault/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/vault/notifications{?since,all,participating}","pulls_url":"https://api.github.com/repos/hashicorp/vault/pulls{/number}","releases_url":"https://api.github.com/repos/hashicorp/vault/releases{/id}","stargazers_url":"https://api.github.com/repos/hashicorp/vault/stargazers","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/{sha}","subscribers_url":"https://api.github.com/repos/hashicorp/vault/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/vault/subscription","tags_url":"https://api.github.com/repos/hashicorp/vault/tags","trees_url":"https://api.github.com/repos/hashicorp/vault/git/trees{/sha}","teams_url":"https://api.github.com/repos/hashicorp/vault/teams"},"actor":{"login":"ryancragun","id":65058,"node_id":"MDQ6VXNlcjY1MDU4","avatar_url":"https://avatars.githubusercontent.com/u/65058?v=4","html_url":"https://github.com/ryancragun","gravatar_id":"","type":"User","site_admin":false,"url":"https://api.github.com/users/ryancragun","events_url":"https://api.github.com/users/ryancragun/events{/privacy}","following_url":"https://api.github.com/users/ryancragun/following{/other_user}","followers_url":"https://api.github.com/users/ryancragun/followers","gists_url":"https://api.github.com/users/ryancragun/gists{/gist_id}","organizations_url":"https://api.github.com/users/ryancragun/orgs","received_events_url":"https://api.github.com/users/ryancragun/received_events","repos_url":"https://api.github.com/users/ryancragun/repos","starred_url":"https://api.github.com/users/ryancragun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryancragun/subscriptions"},"triggering_actor":{"login":"ryancragun","id":65058,"node_id":"MDQ6VXNlcjY1MDU4","avatar_url":"https://avatars.githubusercontent.com/u/65058?v=4","html_url":"https://github.com/ryancragun","gravatar_id":"","type":"User","site_admin":false,"url":"https://api.github.com/users/ryancragun","events_url":"https://api.github.com/users/ryancragun/events{/privacy}","following_url":"https://api.github.com/users/ryancragun/following{/other_user}","followers_url":"https://api.github.com/users/ryancragun/followers","gists_url":"https://api.github.com/users/ryancragun/gists{/gist_id}","organizations_url":"https://api.github.com/users/ryancragun/orgs","received_events_url":"https://api.github.com/users/ryancragun/received_events","repos_url":"https://api.github.com/users/ryancragun/repos","starred_url":"https://api.github.com/users/ryancragun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryancragun/subscriptions"},"referenced_workflows":[{"path":"hashicorp/vault/.github/workflows/test-run-enos-scenario-containers.yml@e69f2ace060741474a49231bf8330f97547c8b2b","sha":"e69f2ace060741474a49231bf8330f97547c8b2b","ref":"refs/heads/main"},{"path":"hashicorp/vault/.github/workflows/build-artifacts-ce.yml@e69f2ace060741474a49231bf8330f97547c8b2b","sha":"e69f2ace060741474a49231bf8330f97547c8b2b","ref":"refs/heads/main"},{"path":"hashicorp/vault/.github/workflows/test-run-enos-scenario-matrix.yml@e69f2ace060741474a49231bf8330f97547c8b2b","sha":"e69f2ace060741474a49231bf8330f97547c8b2b","ref":"refs/heads/main"}]},"jobs":[{"job":{"id":35753038499,"run_id":12821474724,"run_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12821474724","node_id":"CR_kwDOAd1ufs8AAAAIUwwSow","head_branch":"main","head_sha":"e69f2ace060741474a49231bf8330f97547c8b2b","url":"https://api.github.com/repos/hashicorp/vault/actions/jobs/35753038499","html_url":"https://github.com/hashicorp/vault/actions/runs/12821474724/job/35753038499","status":"completed","conclusion":"failure","created_at":"2025-01-17T02:35:25Z","started_at":"2025-01-17T02:35:31Z","completed_at":"2025-01-17T02:35:45Z","name":"test vault_default_linux_arm64_1.19.0-beta1_e69f2ace060741474a49231bf8330f97547c8b2b.docker.tar / run k8s edition:ce repo:ecr","steps":[{"name":"Set up job","status":"completed","conclusion":"success","number":1,"started_at":"2025-01-17T02:35:30Z","completed_at":"2025-01-17T02:35:31Z"},{"name":"Run actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332","status":"completed","conclusion":"success","number":2,"started_at":"2025-01-17T02:35:31Z","completed_at":"2025-01-17T02:35:35Z"},{"name":"Run hashicorp/setup-terraform@v3","status":"completed","conclusion":"success","number":3,"started_at":"2025-01-17T02:35:35Z","completed_at":"2025-01-17T02:35:35Z"},{"name":"Run hashicorp/action-setup-enos@v1","status":"completed","conclusion":"success","number":4,"started_at":"2025-01-17T02:35:36Z","completed_at":"2025-01-17T02:35:36Z"},{"name":"Download Docker Image","status":"completed","conclusion":"success","number":5,"started_at":"2025-01-17T02:35:36Z","completed_at":"2025-01-17T02:35:39Z"},{"name":"Configure license","status":"completed","conclusion":"skipped","number":6,"started_at":"2025-01-17T02:35:39Z","completed_at":"2025-01-17T02:35:39Z"},{"name":"Run Enos scenario","status":"completed","conclusion":"success","number":7,"started_at":"2025-01-17T02:35:39Z","completed_at":"2025-01-17T02:35:41Z"},{"name":"Retry Enos scenario","status":"completed","conclusion":"failure","number":8,"started_at":"2025-01-17T02:35:42Z","completed_at":"2025-01-17T02:35:42Z"},{"name":"Destroy Enos scenario","status":"completed","conclusion":"success","number":9,"started_at":"2025-01-17T02:35:43Z","completed_at":"2025-01-17T02:35:43Z"},{"name":"Cleanup Enos runtime directories","status":"completed","conclusion":"success","number":10,"started_at":"2025-01-17T02:35:45Z","completed_at":"2025-01-17T02:35:45Z"},{"name":"Post Run actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332","status":"completed","conclusion":"success","number":20,"started_at":"2025-01-17T02:35:45Z","completed_at":"2025-01-17T02:35:45Z"},{"name":"Complete job","status":"completed","conclusion":"success","number":21,"started_at":"2025-01-17T02:35:43Z","completed_at":"2025-01-17T02:35:43Z"}],"check_run_url":"https://api.github.com/repos/hashicorp/vault/check-runs/35753038499","labels":["ubuntu-22.04-arm"],"runner_id":3110,"runner_name":"GitHub Actions 2949","runner_group_id":2,"runner_group_name":"GitHub Actions","run_attempt":1,"workflow_name":"build"},"log_entries":[{"step_name":"Run mkdir -p ./enos/support/terraform-plugin-cache","setup_log":"MjAyNS0wMS0xN1QwMjozNTozOS4zNjYxNjY0WiAbWzM2OzFtbWtkaXIgLXAgLi9lbm9zL3N1cHBvcnQvdGVycmFmb3JtLXBsdWdpbi1jYWNoZRtbMG0KMjAyNS0wMS0xN1QwMjozNTozOS4zNjYyMDU4WiAbWzM2OzFtZW5vcyBzY2VuYXJpbyBydW4gLS10aW1lb3V0IDEwbTBzIC0tY2hkaXIgLi9lbm9zL2s4cyBrOHMgZWRpdGlvbjpjZSByZXBvOmVjchtbMG0KMjAyNS0wMS0xN1QwMjozNTozOS4zNjk2MjYxWiBzaGVsbDogL3Vzci9iaW4vYmFzaCAtZSB7MH0KMjAyNS0wMS0xN1QwMjozNTozOS4zNjk2NDcxWiBlbnY6CjIwMjUtMDEtMTdUMDI6MzU6MzkuMzY5Njg1N1ogICBHSVRIVUJfVE9LRU46ICoqKgoyMDI1LTAxLTE3VDAyOjM1OjM5LjM2OTcxMjdaICAgRU5PU19WQVJfdGVycmFmb3JtX3BsdWdpbl9jYWNoZV9kaXI6IC4uL3N1cHBvcnQvdGVycmFmb3JtLXBsdWdpbi1jYWNoZQoyMDI1LTAxLTE3VDAyOjM1OjM5LjM2OTc0NjZaICAgRU5PU19WQVJfdmF1bHRfYnVpbGRfZGF0ZTogMjAyNS0wMS0xNlQxNjowNToyMFoKMjAyNS0wMS0xN1QwMjozNTozOS4zNjk3NzExWiAgIEVOT1NfVkFSX3ZhdWx0X3ZlcnNpb246IDEuMTkuMC1iZXRhMQoyMDI1LTAxLTE3VDAyOjM1OjM5LjM2OTc5ODdaICAgRU5PU19WQVJfdmF1bHRfcmV2aXNpb246IGU2OWYyYWNlMDYwNzQxNDc0YTQ5MjMxYmY4MzMwZjk3NTQ3YzhiMmIKMjAyNS0wMS0xN1QwMjozNTozOS4zNjk4NzE2WiAgIEVOT1NfVkFSX2NvbnRhaW5lcl9pbWFnZV9hcmNoaXZlOiAvaG9tZS9ydW5uZXIvd29yay92YXVsdC92YXVsdC9lbm9zL3N1cHBvcnQvZG93bmxvYWRzL3ZhdWx0X2RlZmF1bHRfbGludXhfYXJtNjRfMS4xOS4wLWJldGExX2U2OWYyYWNlMDYwNzQxNDc0YTQ5MjMxYmY4MzMwZjk3NTQ3YzhiMmIuZG9ja2VyLnRhcg==","body_log":"MjAyNS0wMS0xN1QwMjozNTozOS4zOTAzMjI1WiBrOHMgW2VkaXRpb246Y2UgcmVwbzplY3JdIGdlbmVyYXRlOiBydW5uaW5nCjIwMjUtMDEtMTdUMDI6MzU6MzkuMzk0NzExNFogazhzIFtlZGl0aW9uOmNlIHJlcG86ZWNyXSBnZW5lcmF0ZTogc3VjY2VzcyEKMjAyNS0wMS0xN1QwMjozNTozOS4zOTQ3NTEyWiBrOHMgW2VkaXRpb246Y2UgcmVwbzplY3JdIGluaXQ6IHJ1bm5pbmcKMjAyNS0wMS0xN1QwMjozNTo0MS4wMzU1OTk2WiBrOHMgW2VkaXRpb246Y2UgcmVwbzplY3JdIHZhbGlkYXRlOiBydW5uaW5nCjIwMjUtMDEtMTdUMDI6MzU6NDEuMzY0ODMwN1ogazhzIFtlZGl0aW9uOmNlIHJlcG86ZWNyXSB2YWxpZGF0ZTogc3VjY2VzcyEKMjAyNS0wMS0xN1QwMjozNTo0MS4zNjQ4NjExWiBrOHMgW2VkaXRpb246Y2UgcmVwbzplY3JdIHBsYW46IHJ1bm5pbmcKMjAyNS0wMS0xN1QwMjozNTo0MS43ODgyNzE5WiAKMjAyNS0wMS0xN1QwMjozNTo0MS43ODgzMTEyWiBTY2VuYXJpbzogazhzIFtlZGl0aW9uOmNlIHJlcG86ZWNyXSBmYWlsZWQhCjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg4MzM4OFogICBJbml0OiBzdWNjZXNzIQoyMDI1LTAxLTE3VDAyOjM1OjQxLjc4ODM1NTlaICAgVmFsaWRhdGU6IHN1Y2Nlc3MhCjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg4Mzc1M1ogRW5vcyBvcGVyYXRpb25zIGZhaWxlZCEKMjAyNS0wMS0xN1QwMjozNTo0MS43ODgzODY5WiAKMjAyNS0wMS0xN1QwMjozNTo0MS43ODg0MDY0WiAgIFBsYW46IGZhaWxlZCEKMjAyNS0wMS0xN1QwMjozNTo0MS43ODg0MTY4WiAKMjAyNS0wMS0xN1QwMjozNTo0MS43ODg0NjU4WiBFcnJvcjogY291bGQgbm90IGNyZWF0ZSBPQ0kgcmVnaXN0cnkgY2xpZW50OiAvaG9tZS9ydW5uZXJhZG1pbi8uY29uZmlnL2hlbG0vcmVnaXN0cnkvY29uZmlnLmpzb246IHN0YXQgL2hvbWUvcnVubmVyYWRtaW4vLmNvbmZpZy9oZWxtL3JlZ2lzdHJ5L2NvbmZpZy5qc29uOiBwZXJtaXNzaW9uIGRlbmllZAoyMDI1LTAxLTE3VDAyOjM1OjQxLjc4ODUyNzdaIAoyMDI1LTAxLTE3VDAyOjM1OjQxLjc4ODUzNzdaICAgd2l0aCBtb2R1bGUuZGVwbG95X3ZhdWx0LmhlbG1fcmVsZWFzZS52YXVsdCwKMjAyNS0wMS0xN1QwMjozNTo0MS43ODg1NzQ5WiAgIG9uIC4uLy4uLy4uL21vZHVsZXMvazhzX2RlcGxveV92YXVsdC9tYWluLnRmIGxpbmUgNDcsIGluIHJlc291cmNlICJoZWxtX3JlbGVhc2UiICJ2YXVsdCI6CjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg4NjA5OVogICA0NzogcmVzb3VyY2UgImhlbG1fcmVsZWFzZSIgInZhdWx0IiB7CjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg4NjI2MVogCjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg4NjI2NVogCjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg4NjgyN1ogG1szMW3ilbcbWzBtCjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg4NzA3MFogG1szMW3ilIIbWzBtIBtbMW0bWzMxbUVycm9yOiAbWzBtG1sxbWV4aXQgc3RhdHVzIDEKMjAyNS0wMS0xN1QwMjozNTo0MS43ODg3MzIwWiAbWzMxbeKUghtbMG0KMjAyNS0wMS0xN1QwMjozNTo0MS43ODg3OTkyWiAbWzMxbeKUghtbMG0gRXJyb3I6IGNvdWxkIG5vdCBjcmVhdGUgT0NJIHJlZ2lzdHJ5IGNsaWVudDogL2hvbWUvcnVubmVyYWRtaW4vLmNvbmZpZy9oZWxtL3JlZ2lzdHJ5L2NvbmZpZy5qc29uOiBzdGF0IC9ob21lL3J1bm5lcmFkbWluLy5jb25maWcvaGVsbS9yZWdpc3RyeS9jb25maWcuanNvbjogcGVybWlzc2lvbiBkZW5pZWQKMjAyNS0wMS0xN1QwMjozNTo0MS43ODg4NjQ5WiAbWzMxbeKUghtbMG0KMjAyNS0wMS0xN1QwMjozNTo0MS43ODg4ODg0WiAbWzMxbeKUghtbMG0gICB3aXRoIG1vZHVsZS5kZXBsb3lfdmF1bHQuaGVsbV9yZWxlYXNlLnZhdWx0LAoyMDI1LTAxLTE3VDAyOjM1OjQxLjc4ODkzNjRaIBtbMzFt4pSCG1swbSAgIG9uIC4uLy4uLy4uL21vZHVsZXMvazhzX2RlcGxveV92YXVsdC9tYWluLnRmIGxpbmUgNDcsIGluIHJlc291cmNlICJoZWxtX3JlbGVhc2UiICJ2YXVsdCI6CjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg4OTc4NFogG1szMW3ilIIbWzBtICAgNDc6IHJlc291cmNlICJoZWxtX3JlbGVhc2UiICJ2YXVsdCIgewoyMDI1LTAxLTE3VDAyOjM1OjQxLjc4OTAwMzBaIBtbMzFt4pSCG1swbQoyMDI1LTAxLTE3VDAyOjM1OjQxLjc4OTAyMTNaIBtbMzFt4pSCG1swbSAbWzBtCjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg5MDM4MVogG1szMW3ilIIbWzBtCjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg5MDU2NlogG1szMW3ilIIbWzBtICAgKHNvdXJjZSBjb2RlIG5vdCBhdmFpbGFibGUpCjIwMjUtMDEtMTdUMDI6MzU6NDEuNzg5MDc5NlogG1szMW3ilbUbWzBt","error_log":"MjAyNS0wMS0xN1QwMjozNTo0MS43OTExNjM2WiBQcm9jZXNzIGNvbXBsZXRlZCB3aXRoIGV4aXQgY29kZSAxLg=="},{"step_name":"Run enos scenario run --timeout 10m0s --chdir ./enos/k8s k8s edition:ce repo:ecr","setup_log":"MjAyNS0wMS0xN1QwMjozNTo0MS43OTU4NjEyWiAbWzM2OzFtZW5vcyBzY2VuYXJpbyBydW4gLS10aW1lb3V0IDEwbTBzIC0tY2hkaXIgLi9lbm9zL2s4cyBrOHMgZWRpdGlvbjpjZSByZXBvOmVjchtbMG0KMjAyNS0wMS0xN1QwMjozNTo0MS43OTgwMTYxWiBzaGVsbDogL3Vzci9iaW4vYmFzaCAtZSB7MH0KMjAyNS0wMS0xN1QwMjozNTo0MS43OTgwMzU5WiBlbnY6CjIwMjUtMDEtMTdUMDI6MzU6NDEuNzk4MDc1NlogICBHSVRIVUJfVE9LRU46ICoqKgoyMDI1LTAxLTE3VDAyOjM1OjQxLjc5ODEwMjRaICAgRU5PU19WQVJfdGVycmFmb3JtX3BsdWdpbl9jYWNoZV9kaXI6IC4uL3N1cHBvcnQvdGVycmFmb3JtLXBsdWdpbi1jYWNoZQoyMDI1LTAxLTE3VDAyOjM1OjQxLjc5ODEzNjJaICAgRU5PU19WQVJfdmF1bHRfYnVpbGRfZGF0ZTogMjAyNS0wMS0xNlQxNjowNToyMFoKMjAyNS0wMS0xN1QwMjozNTo0MS43OTgxNjI3WiAgIEVOT1NfVkFSX3ZhdWx0X3ZlcnNpb246IDEuMTkuMC1iZXRhMQoyMDI1LTAxLTE3VDAyOjM1OjQxLjc5ODE5MDZaICAgRU5PU19WQVJfdmF1bHRfcmV2aXNpb246IGU2OWYyYWNlMDYwNzQxNDc0YTQ5MjMxYmY4MzMwZjk3NTQ3YzhiMmIKMjAyNS0wMS0xN1QwMjozNTo0MS43OTgyNjM1WiAgIEVOT1NfVkFSX2NvbnRhaW5lcl9pbWFnZV9hcmNoaXZlOiAvaG9tZS9ydW5uZXIvd29yay92YXVsdC92YXVsdC9lbm9zL3N1cHBvcnQvZG93bmxvYWRzL3ZhdWx0X2RlZmF1bHRfbGludXhfYXJtNjRfMS4xOS4wLWJldGExX2U2OWYyYWNlMDYwNzQxNDc0YTQ5MjMxYmY4MzMwZjk3NTQ3YzhiMmIuZG9ja2VyLnRhcg==","body_log":"MjAyNS0wMS0xN1QwMjozNTo0MS44MTQ1NzIzWiBrOHMgW2VkaXRpb246Y2UgcmVwbzplY3JdIGdlbmVyYXRlOiBydW5uaW5nCjIwMjUtMDEtMTdUMDI6MzU6NDEuODE4NzE3OVogazhzIFtlZGl0aW9uOmNlIHJlcG86ZWNyXSBpbml0OiBydW5uaW5nCjIwMjUtMDEtMTdUMDI6MzU6NDIuMDg1NzEyMlogazhzIFtlZGl0aW9uOmNlIHJlcG86ZWNyXSB2YWxpZGF0ZTogcnVubmluZwoyMDI1LTAxLTE3VDAyOjM1OjQyLjQxODA3MzVaIGs4cyBbZWRpdGlvbjpjZSByZXBvOmVjcl0gcGxhbjogcnVubmluZwoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NTgwNzFaIAoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NTg0ODZaIFNjZW5hcmlvOiBrOHMgW2VkaXRpb246Y2UgcmVwbzplY3JdIGZhaWxlZCEKMjAyNS0wMS0xN1QwMjozNTo0Mi44NDU4Nzk2WiBFbm9zIG9wZXJhdGlvbnMgZmFpbGVkIQoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NTg5MTZaIAoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NTg5NzhaICAgUGxhbjogZmFpbGVkIQoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NTkwNzhaIAoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NTk1NjdaIEVycm9yOiBjb3VsZCBub3QgY3JlYXRlIE9DSSByZWdpc3RyeSBjbGllbnQ6IC9ob21lL3J1bm5lcmFkbWluLy5jb25maWcvaGVsbS9yZWdpc3RyeS9jb25maWcuanNvbjogc3RhdCAvaG9tZS9ydW5uZXJhZG1pbi8uY29uZmlnL2hlbG0vcmVnaXN0cnkvY29uZmlnLmpzb246IHBlcm1pc3Npb24gZGVuaWVkCjIwMjUtMDEtMTdUMDI6MzU6NDIuODQ2MDU5M1ogCjIwMjUtMDEtMTdUMDI6MzU6NDIuODQ2MDY5MVogICB3aXRoIG1vZHVsZS5kZXBsb3lfdmF1bHQuaGVsbV9yZWxlYXNlLnZhdWx0LAoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NjEwNjVaICAgb24gLi4vLi4vLi4vbW9kdWxlcy9rOHNfZGVwbG95X3ZhdWx0L21haW4udGYgbGluZSA0NywgaW4gcmVzb3VyY2UgImhlbG1fcmVsZWFzZSIgInZhdWx0IjoKMjAyNS0wMS0xN1QwMjozNTo0Mi44NDYxNDIzWiAgIDQ3OiByZXNvdXJjZSAiaGVsbV9yZWxlYXNlIiAidmF1bHQiIHsKMjAyNS0wMS0xN1QwMjozNTo0Mi44NDYxNTc2WiAKMjAyNS0wMS0xN1QwMjozNTo0Mi44NDYxNTk0WiAKMjAyNS0wMS0xN1QwMjozNTo0Mi44NDYxOTE1WiAbWzMxbeKVtxtbMG0KMjAyNS0wMS0xN1QwMjozNTo0Mi44NDYyMTM2WiAbWzMxbeKUghtbMG0gG1sxbRtbMzFtRXJyb3I6IBtbMG0bWzFtZXhpdCBzdGF0dXMgMQoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NjIzODVaIBtbMzFt4pSCG1swbQoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NjMwNTJaIBtbMzFt4pSCG1swbSBFcnJvcjogY291bGQgbm90IGNyZWF0ZSBPQ0kgcmVnaXN0cnkgY2xpZW50OiAvaG9tZS9ydW5uZXJhZG1pbi8uY29uZmlnL2hlbG0vcmVnaXN0cnkvY29uZmlnLmpzb246IHN0YXQgL2hvbWUvcnVubmVyYWRtaW4vLmNvbmZpZy9oZWxtL3JlZ2lzdHJ5L2NvbmZpZy5qc29uOiBwZXJtaXNzaW9uIGRlbmllZAoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NjM3MDVaIBtbMzFt4pSCG1swbQoyMDI1LTAxLTE3VDAyOjM1OjQyLjg0NjM5MzhaIBtbMzFt4pSCG1swbSAgIHdpdGggbW9kdWxlLmRlcGxveV92YXVsdC5oZWxtX3JlbGVhc2UudmF1bHQsCjIwMjUtMDEtMTdUMDI6MzU6NDIuODQ2NDQwNlogG1szMW3ilIIbWzBtICAgb24gLi4vLi4vLi4vbW9kdWxlcy9rOHNfZGVwbG95X3ZhdWx0L21haW4udGYgbGluZSA0NywgaW4gcmVzb3VyY2UgImhlbG1fcmVsZWFzZSIgInZhdWx0IjoKMjAyNS0wMS0xN1QwMjozNTo0Mi44NDY0ODE4WiAbWzMxbeKUghtbMG0gICA0NzogcmVzb3VyY2UgImhlbG1fcmVsZWFzZSIgInZhdWx0IiB7CjIwMjUtMDEtMTdUMDI6MzU6NDIuODQ2NTA2NlogG1szMW3ilIIbWzBtCjIwMjUtMDEtMTdUMDI6MzU6NDIuODQ2NTIyOFogG1szMW3ilIIbWzBtIBtbMG0KMjAyNS0wMS0xN1QwMjozNTo0Mi44NDY1Mzk0WiAbWzMxbeKUghtbMG0KMjAyNS0wMS0xN1QwMjozNTo0Mi44NDY1NTc4WiAbWzMxbeKUghtbMG0gICAoc291cmNlIGNvZGUgbm90IGF2YWlsYWJsZSkKMjAyNS0wMS0xN1QwMjozNTo0Mi44NDY1ODExWiAbWzMxbeKVtRtbMG0KMjAyNS0wMS0xN1QwMjozNTo0Mi44NDY1OTU1WiAgIEluaXQ6IHN1Y2Nlc3MhCjIwMjUtMDEtMTdUMDI6MzU6NDIuODQ2NjEyNFogICBWYWxpZGF0ZTogc3VjY2VzcyE=","error_log":"MjAyNS0wMS0xN1QwMjozNTo0Mi44NDcyNjcyWiBQcm9jZXNzIGNvbXBsZXRlZCB3aXRoIGV4aXQgY29kZSAxLg=="}]},{"job":{"id":35753307080,"run_id":12821474724,"run_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12821474724","node_id":"CR_kwDOAd1ufs8AAAAIUxAryA","head_branch":"main","head_sha":"e69f2ace060741474a49231bf8330f97547c8b2b","url":"https://api.github.com/repos/hashicorp/vault/actions/jobs/35753307080","html_url":"https://github.com/hashicorp/vault/actions/runs/12821474724/job/35753307080","status":"completed","conclusion":"failure","created_at":"2025-01-17T02:44:10Z","started_at":"2025-01-17T02:44:17Z","completed_at":"2025-01-17T02:44:52Z","name":"completed-successfully","steps":[{"name":"Set up job","status":"completed","conclusion":"success","number":1,"started_at":"2025-01-17T02:44:17Z","completed_at":"2025-01-17T02:44:19Z"},{"name":"Build hashicorp/actions-generate-metadata@v1","status":"completed","conclusion":"success","number":2,"started_at":"2025-01-17T02:44:19Z","completed_at":"2025-01-17T02:44:43Z"},{"name":"Run actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332","status":"completed","conclusion":"success","number":3,"started_at":"2025-01-17T02:44:43Z","completed_at":"2025-01-17T02:44:46Z"},{"name":"Determine status","status":"completed","conclusion":"success","number":4,"started_at":"2025-01-17T02:44:46Z","completed_at":"2025-01-17T02:44:46Z"},{"name":"Vault Authenticate","status":"completed","conclusion":"skipped","number":5,"started_at":"2025-01-17T02:44:46Z","completed_at":"2025-01-17T02:44:46Z"},{"name":"Fetch Vault Secrets","status":"completed","conclusion":"skipped","number":6,"started_at":"2025-01-17T02:44:46Z","completed_at":"2025-01-17T02:44:46Z"},{"name":"Run echo \"slackbot-token=***\" \u003e\u003e \"$GITHUB_OUTPUT\"","status":"completed","conclusion":"success","number":7,"started_at":"2025-01-17T02:44:46Z","completed_at":"2025-01-17T02:44:46Z"},{"name":"Create or update a build status comment on the pull request","status":"completed","conclusion":"skipped","number":8,"started_at":"2025-01-17T02:44:46Z","completed_at":"2025-01-17T02:44:46Z"},{"name":"Notify build failures in Slack","status":"completed","conclusion":"success","number":9,"started_at":"2025-01-17T02:44:46Z","completed_at":"2025-01-17T02:44:47Z"},{"name":"Run hashicorp/actions-generate-metadata@v1","status":"completed","conclusion":"success","number":10,"started_at":"2025-01-17T02:44:47Z","completed_at":"2025-01-17T02:44:48Z"},{"name":"Run actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a","status":"completed","conclusion":"success","number":11,"started_at":"2025-01-17T02:44:48Z","completed_at":"2025-01-17T02:44:49Z"},{"name":"Check for failed status","status":"completed","conclusion":"failure","number":12,"started_at":"2025-01-17T02:44:49Z","completed_at":"2025-01-17T02:44:49Z"},{"name":"Post Run actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332","status":"completed","conclusion":"success","number":24,"started_at":"2025-01-17T02:44:49Z","completed_at":"2025-01-17T02:44:49Z"},{"name":"Complete job","status":"completed","conclusion":"success","number":25,"started_at":"2025-01-17T02:44:49Z","completed_at":"2025-01-17T02:44:49Z"}],"check_run_url":"https://api.github.com/repos/hashicorp/vault/check-runs/35753307080","labels":["ubuntu-latest"],"runner_id":1066,"runner_name":"GitHub Actions 906","runner_group_id":2,"runner_group_name":"GitHub Actions","run_attempt":1,"workflow_name":"build"},"log_entries":[{"step_name":"Run echo \"One or more required build workflows failed: [  \"success\",  \"success\",  \"success\",  \"success\",  \"failure\"]\"","setup_log":"MjAyNS0wMS0xN1QwMjo0NDo0OS4yMzkwODQyWiAbWzM2OzFtZWNobyAiT25lIG9yIG1vcmUgcmVxdWlyZWQgYnVpbGQgd29ya2Zsb3dzIGZhaWxlZDogWyAgInN1Y2Nlc3MiLCAgInN1Y2Nlc3MiLCAgInN1Y2Nlc3MiLCAgInN1Y2Nlc3MiLCAgImZhaWx1cmUiXSIbWzBtCjIwMjUtMDEtMTdUMDI6NDQ6NDkuMjM5MTI4MFogG1szNjsxbWV4aXQgMRtbMG0KMjAyNS0wMS0xN1QwMjo0NDo0OS4yNDE3NjM2WiBzaGVsbDogL3Vzci9iaW4vYmFzaCAtZSB7MH0KMjAyNS0wMS0xN1QwMjo0NDo0OS4yNDE3ODU2WiBlbnY6CjIwMjUtMDEtMTdUMDI6NDQ6NDkuMjQxODAzNVogICBmaWxlcGF0aDogbWV0YWRhdGEuanNvbg==","body_log":"MjAyNS0wMS0xN1QwMjo0NDo0OS4yNDYzODAxWiBPbmUgb3IgbW9yZSByZXF1aXJlZCBidWlsZCB3b3JrZmxvd3MgZmFpbGVkOiBbICBzdWNjZXNzLCAgc3VjY2VzcywgIHN1Y2Nlc3MsICBzdWNjZXNzLCAgZmFpbHVyZV0=","error_log":"MjAyNS0wMS0xN1QwMjo0NDo0OS4yNDc0NjY3WiBQcm9jZXNzIGNvbXBsZXRlZCB3aXRoIGV4aXQgY29kZSAxLgoyMDI1LTAxLTE3VDAyOjQ0OjQ5LjI1MzU1NTRaIFBvc3Qgam9iIGNsZWFudXAuCjIwMjUtMDEtMTdUMDI6NDQ6NDkuMzQ2NjQ5NVogW2NvbW1hbmRdL3Vzci9iaW4vZ2l0IHZlcnNpb24KMjAyNS0wMS0xN1QwMjo0NDo0OS4zNTAyNzUwWiBnaXQgdmVyc2lvbiAyLjQ3LjEKMjAyNS0wMS0xN1QwMjo0NDo0OS4zNTQ2MTc5WiBUZW1wb3JhcmlseSBvdmVycmlkaW5nIEhPTUU9Jy9ob21lL3J1bm5lci93b3JrL190ZW1wL2NlYjYwNTVjLWQ0YTYtNGRlOS1iOGJlLWE5ZDYxODAzNTJjMicgYmVmb3JlIG1ha2luZyBnbG9iYWwgZ2l0IGNvbmZpZyBjaGFuZ2VzCjIwMjUtMDEtMTdUMDI6NDQ6NDkuMzU0NzQ2MFogQWRkaW5nIHJlcG9zaXRvcnkgZGlyZWN0b3J5IHRvIHRoZSB0ZW1wb3JhcnkgZ2l0IGdsb2JhbCBjb25maWcgYXMgYSBzYWZlIGRpcmVjdG9yeQoyMDI1LTAxLTE3VDAyOjQ0OjQ5LjM1NTI1MzhaIFtjb21tYW5kXS91c3IvYmluL2dpdCBjb25maWcgLS1nbG9iYWwgLS1hZGQgc2FmZS5kaXJlY3RvcnkgL2hvbWUvcnVubmVyL3dvcmsvdmF1bHQvdmF1bHQKMjAyNS0wMS0xN1QwMjo0NDo0OS4zNTg3OTI5WiBbY29tbWFuZF0vdXNyL2Jpbi9naXQgY29uZmlnIC0tbG9jYWwgLS1uYW1lLW9ubHkgLS1nZXQtcmVnZXhwIGNvcmVcLnNzaENvbW1hbmQKMjAyNS0wMS0xN1QwMjo0NDo0OS4zNjE5NTE4WiBbY29tbWFuZF0vdXNyL2Jpbi9naXQgc3VibW9kdWxlIGZvcmVhY2ggLS1yZWN1cnNpdmUgc2ggLWMgImdpdCBjb25maWcgLS1sb2NhbCAtLW5hbWUtb25seSAtLWdldC1yZWdleHAgJ2NvcmVcLnNzaENvbW1hbmQnICYmIGdpdCBjb25maWcgLS1sb2NhbCAtLXVuc2V0LWFsbCAnY29yZS5zc2hDb21tYW5kJyB8fCA6IgoyMDI1LTAxLTE3VDAyOjQ0OjQ5LjM4NjI3MTFaIFtjb21tYW5kXS91c3IvYmluL2dpdCBjb25maWcgLS1sb2NhbCAtLW5hbWUtb25seSAtLWdldC1yZWdleHAgaHR0cFwuaHR0cHNcOlwvXC9naXRodWJcLmNvbVwvXC5leHRyYWhlYWRlcgoyMDI1LTAxLTE3VDAyOjQ0OjQ5LjM4ODI3NDFaIGh0dHAuaHR0cHM6Ly9naXRodWIuY29tLy5leHRyYWhlYWRlcgoyMDI1LTAxLTE3VDAyOjQ0OjQ5LjM4OTQ5MTlaIFtjb21tYW5kXS91c3IvYmluL2dpdCBjb25maWcgLS1sb2NhbCAtLXVuc2V0LWFsbCBodHRwLmh0dHBzOi8vZ2l0aHViLmNvbS8uZXh0cmFoZWFkZXIKMjAyNS0wMS0xN1QwMjo0NDo0OS4zOTI0NjgwWiBbY29tbWFuZF0vdXNyL2Jpbi9naXQgc3VibW9kdWxlIGZvcmVhY2ggLS1yZWN1cnNpdmUgc2ggLWMgImdpdCBjb25maWcgLS1sb2NhbCAtLW5hbWUtb25seSAtLWdldC1yZWdleHAgJ2h0dHBcLmh0dHBzXDpcL1wvZ2l0aHViXC5jb21cL1wuZXh0cmFoZWFkZXInICYmIGdpdCBjb25maWcgLS1sb2NhbCAtLXVuc2V0LWFsbCAnaHR0cC5odHRwczovL2dpdGh1Yi5jb20vLmV4dHJhaGVhZGVyJyB8fCA6IgoyMDI1LTAxLTE3VDAyOjQ0OjQ5LjQyNjQ2ODNaIENsZWFuaW5nIHVwIG9ycGhhbiBwcm9jZXNzZXM="}]}],"check_runs":[{"run":{"id":35753038499,"node_id":"CR_kwDOAd1ufs8AAAAIUwwSow","head_sha":"e69f2ace060741474a49231bf8330f97547c8b2b","external_id":"0485042a-e01c-5ac3-f80a-c7817c1122cb","url":"https://api.github.com/repos/hashicorp/vault/check-runs/35753038499","html_url":"https://github.com/hashicorp/vault/actions/runs/12821474724/job/35753038499","details_url":"https://github.com/hashicorp/vault/actions/runs/12821474724/job/35753038499","status":"completed","conclusion":"failure","started_at":"2025-01-17T02:35:31Z","completed_at":"2025-01-17T02:35:45Z","output":{"annotations_count":2,"annotations_url":"https://api.github.com/repos/hashicorp/vault/check-runs/35753038499/annotations"},"name":"test vault_default_linux_arm64_1.19.0-beta1_e69f2ace060741474a49231bf8330f97547c8b2b.docker.tar / run k8s edition:ce repo:ecr","check_suite":{"id":33171639648},"app":{"id":15368,"slug":"github-actions","node_id":"MDM6QXBwMTUzNjg=","owner":{"login":"github","id":9919,"node_id":"MDEyOk9yZ2FuaXphdGlvbjk5MTk=","avatar_url":"https://avatars.githubusercontent.com/u/9919?v=4","html_url":"https://github.com/github","gravatar_id":"","type":"Organization","site_admin":false,"url":"https://api.github.com/users/github","events_url":"https://api.github.com/users/github/events{/privacy}","following_url":"https://api.github.com/users/github/following{/other_user}","followers_url":"https://api.github.com/users/github/followers","gists_url":"https://api.github.com/users/github/gists{/gist_id}","organizations_url":"https://api.github.com/users/github/orgs","received_events_url":"https://api.github.com/users/github/received_events","repos_url":"https://api.github.com/users/github/repos","starred_url":"https://api.github.com/users/github/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/github/subscriptions"},"name":"GitHub Actions","description":"Automate your workflow from idea to production","external_url":"https://help.github.com/en/actions","html_url":"https://github.com/apps/github-actions","created_at":"2018-07-30T09:30:17Z","updated_at":"2024-04-10T20:33:16Z","permissions":{"actions":"write","administration":"read","attestations":"write","checks":"write","contents":"write","deployments":"write","discussions":"write","issues":"write","metadata":"read","merge_queues":"write","packages":"write","pages":"write","pull_requests":"write","repository_hooks":"write","repository_projects":"write","security_events":"write","statuses":"write","vulnerability_alerts":"read"},"events":["branch_protection_rule","check_run","check_suite","create","delete","deployment","deployment_status","discussion","discussion_comment","fork","gollum","issues","issue_comment","label","merge_group","milestone","page_build","project","project_card","project_column","public","pull_request","pull_request_review","pull_request_review_comment","push","registry_package","release","repository","repository_dispatch","status","watch","workflow_dispatch","workflow_run"]},"pull_requests":[{"id":2293168667,"number":15,"url":"https://api.github.com/repos/mayocream/vault/pulls/15","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"3fd8a3161435d4705790c743ca6b0d71fe3ffef7","repo":{"id":370211210,"name":"vault","url":"https://api.github.com/repos/mayocream/vault"}}},{"id":2244945995,"number":37,"url":"https://api.github.com/repos/Zezo-Ai/vault/pulls/37","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"f97525926718e9c5d8e06f65eace8db1ed74f04d","repo":{"id":893266971,"name":"vault","url":"https://api.github.com/repos/Zezo-Ai/vault"}}},{"id":2111658258,"number":2,"url":"https://api.github.com/repos/sigtrap/vault/pulls/2","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"6ad78c41029afa4178d2e9df56399ebb9d368b77","repo":{"id":683204772,"name":"vault","url":"https://api.github.com/repos/sigtrap/vault"}}},{"id":1392721573,"number":30,"url":"https://api.github.com/repos/kkpan11/vault/pulls/30","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"89469110784efdb8f9ebc481040e5b779303c04e","repo":{"id":633397509,"name":"vault","url":"https://api.github.com/repos/kkpan11/vault"}}},{"id":1334622221,"number":173,"url":"https://api.github.com/repos/NOUIY/vault/pulls/173","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"21bde241e012028cf9896a3fe4172c23578c4b34","repo":{"id":439348437,"name":"vault","url":"https://api.github.com/repos/NOUIY/vault"}}},{"id":1300925569,"number":1,"url":"https://api.github.com/repos/Bigdawg001/vault/pulls/1","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"a5bba9c7c90d1ae8e3fbb5d6d02043a310519440","repo":{"id":623209292,"name":"vault","url":"https://api.github.com/repos/Bigdawg001/vault"}}},{"id":1262995428,"number":7,"url":"https://api.github.com/repos/ArchiFleKs/vault/pulls/7","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"d2a09ad4536062bd9ecf8569883f0e1de0ff131e","repo":{"id":575331177,"name":"vault","url":"https://api.github.com/repos/ArchiFleKs/vault"}}},{"id":796216871,"number":13,"url":"https://api.github.com/repos/ufo2011/vault/pulls/13","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"1bec99602c311222217c81926640be9154d46b35","repo":{"id":432877981,"name":"vault","url":"https://api.github.com/repos/ufo2011/vault"}}}]},"annotations":[{"path":".github","start_line":47,"end_line":47,"annotation_level":"failure","message":"Process completed with exit code 1.","title":"","raw_details":""},{"path":".github","start_line":44,"end_line":44,"annotation_level":"failure","message":"Process completed with exit code 1.","title":"","raw_details":""}]},{"run":{"id":35753307080,"node_id":"CR_kwDOAd1ufs8AAAAIUxAryA","head_sha":"e69f2ace060741474a49231bf8330f97547c8b2b","external_id":"132652a4-a1fa-5f4f-510c-299967b46f41","url":"https://api.github.com/repos/hashicorp/vault/check-runs/35753307080","html_url":"https://github.com/hashicorp/vault/actions/runs/12821474724/job/35753307080","details_url":"https://github.com/hashicorp/vault/actions/runs/12821474724/job/35753307080","status":"completed","conclusion":"failure","started_at":"2025-01-17T02:44:17Z","completed_at":"2025-01-17T02:44:52Z","output":{"annotations_count":2,"annotations_url":"https://api.github.com/repos/hashicorp/vault/check-runs/35753307080/annotations"},"name":"completed-successfully","check_suite":{"id":33171639648},"app":{"id":15368,"slug":"github-actions","node_id":"MDM6QXBwMTUzNjg=","owner":{"login":"github","id":9919,"node_id":"MDEyOk9yZ2FuaXphdGlvbjk5MTk=","avatar_url":"https://avatars.githubusercontent.com/u/9919?v=4","html_url":"https://github.com/github","gravatar_id":"","type":"Organization","site_admin":false,"url":"https://api.github.com/users/github","events_url":"https://api.github.com/users/github/events{/privacy}","following_url":"https://api.github.com/users/github/following{/other_user}","followers_url":"https://api.github.com/users/github/followers","gists_url":"https://api.github.com/users/github/gists{/gist_id}","organizations_url":"https://api.github.com/users/github/orgs","received_events_url":"https://api.github.com/users/github/received_events","repos_url":"https://api.github.com/users/github/repos","starred_url":"https://api.github.com/users/github/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/github/subscriptions"},"name":"GitHub Actions","description":"Automate your workflow from idea to production","external_url":"https://help.github.com/en/actions","html_url":"https://github.com/apps/github-actions","created_at":"2018-07-30T09:30:17Z","updated_at":"2024-04-10T20:33:16Z","permissions":{"actions":"write","administration":"read","attestations":"write","checks":"write","contents":"write","deployments":"write","discussions":"write","issues":"write","metadata":"read","merge_queues":"write","packages":"write","pages":"write","pull_requests":"write","repository_hooks":"write","repository_projects":"write","security_events":"write","statuses":"write","vulnerability_alerts":"read"},"events":["branch_protection_rule","check_run","check_suite","create","delete","deployment","deployment_status","discussion","discussion_comment","fork","gollum","issues","issue_comment","label","merge_group","milestone","page_build","project","project_card","project_column","public","pull_request","pull_request_review","pull_request_review_comment","push","registry_package","release","repository","repository_dispatch","status","watch","workflow_dispatch","workflow_run"]},"pull_requests":[{"id":2293168667,"number":15,"url":"https://api.github.com/repos/mayocream/vault/pulls/15","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"3fd8a3161435d4705790c743ca6b0d71fe3ffef7","repo":{"id":370211210,"name":"vault","url":"https://api.github.com/repos/mayocream/vault"}}},{"id":2244945995,"number":37,"url":"https://api.github.com/repos/Zezo-Ai/vault/pulls/37","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"f97525926718e9c5d8e06f65eace8db1ed74f04d","repo":{"id":893266971,"name":"vault","url":"https://api.github.com/repos/Zezo-Ai/vault"}}},{"id":2111658258,"number":2,"url":"https://api.github.com/repos/sigtrap/vault/pulls/2","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"6ad78c41029afa4178d2e9df56399ebb9d368b77","repo":{"id":683204772,"name":"vault","url":"https://api.github.com/repos/sigtrap/vault"}}},{"id":1392721573,"number":30,"url":"https://api.github.com/repos/kkpan11/vault/pulls/30","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"89469110784efdb8f9ebc481040e5b779303c04e","repo":{"id":633397509,"name":"vault","url":"https://api.github.com/repos/kkpan11/vault"}}},{"id":1334622221,"number":173,"url":"https://api.github.com/repos/NOUIY/vault/pulls/173","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"21bde241e012028cf9896a3fe4172c23578c4b34","repo":{"id":439348437,"name":"vault","url":"https://api.github.com/repos/NOUIY/vault"}}},{"id":1300925569,"number":1,"url":"https://api.github.com/repos/Bigdawg001/vault/pulls/1","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"a5bba9c7c90d1ae8e3fbb5d6d02043a310519440","repo":{"id":623209292,"name":"vault","url":"https://api.github.com/repos/Bigdawg001/vault"}}},{"id":1262995428,"number":7,"url":"https://api.github.com/repos/ArchiFleKs/vault/pulls/7","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"d2a09ad4536062bd9ecf8569883f0e1de0ff131e","repo":{"id":575331177,"name":"vault","url":"https://api.github.com/repos/ArchiFleKs/vault"}}},{"id":796216871,"number":13,"url":"https://api.github.com/repos/ufo2011/vault/pulls/13","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"1bec99602c311222217c81926640be9154d46b35","repo":{"id":432877981,"name":"vault","url":"https://api.github.com/repos/ufo2011/vault"}}}]},"annotations":[{"path":".github","start_line":1,"end_line":1,"annotation_level":"warning","message":"ubuntu-latest pipelines will use ubuntu-24.04 soon. For more details, see https://github.com/actions/runner-images/issues/10636","title":"","raw_details":""},{"path":".github","start_line":9,"end_line":9,"annotation_level":"failure","message":"Process completed with exit code 1.","title":"","raw_details":""}]}],"summary":"\nbuild (ID: 12821474724)\n  PR: \u001b[1;39mbuild\u001b[0m\n  URL: https://github.com/hashicorp/vault/actions/runs/12821474724\n  HEAD Branch: main\n  HEAD SHA: e69f2ace060741474a49231bf8330f97547c8b2b\n  Author: swati\n  Actor: ryancragun\n  Attempt: 1\n  \u001b[1;39mAnnotations\u001b[0m\n    \u001b[1;31;49mfailure\u001b[0m \u001b[1;39m\u001b[0m\n      \u001b[1;39mProcess completed with exit code 1.\u001b[0m\n    \u001b[1;31;49mfailure\u001b[0m \u001b[1;39m\u001b[0m\n      \u001b[1;39mProcess completed with exit code 1.\u001b[0m\n    \u001b[1;33;49mwarning\u001b[0m \u001b[1;39m\u001b[0m\n      \u001b[1;39mubuntu-latest pipelines will use ubuntu-24.04 soon. For more details, see https://github.com/actions/runner-images/issues/10636\u001b[0m\n    \u001b[1;31;49mfailure\u001b[0m \u001b[1;39m\u001b[0m\n      \u001b[1;39mProcess completed with exit code 1.\u001b[0m\n  Status: \u001b[1;32;49mcompleted\u001b[0m  \n  Conclusion: \u001b[1;31;49mfailure\u001b[0m  \n    Job: \u001b[1;39mtest vault_default_linux_arm64_1.19.0-beta1_e69f2ace060741474a49231bf8330f97547c8b2b.docker.tar / run k8s edition:ce repo:ecr\u001b[0m\n      URL: https://github.com/hashicorp/vault/actions/runs/12821474724/job/35753038499\n      Status: completed\n      Conclusion: failure\n      CreatedAt: 2025-01-17 02:35:25 +0000 UTC\n      StartedAt: 2025-01-17 02:35:31 +0000 UTC\n      CompletedAt: 2025-01-17 02:35:45 +0000 UTC\n      \u001b[1;39mUnsuccessful Steps:\u001b[0m\n        Step: \u001b[1;39mRetry Enos scenario\u001b[0m\n          Status: \u001b[1;32;49mcompleted\u001b[0m  \n          Conclusion: \u001b[1;31;49mfailure\u001b[0m  \n      \u001b[1;39mUnsuccessful Step Log Summaries:\u001b[0m\n        Step: \u001b[1;39mRun mkdir -p ./enos/support/terraform-plugin-cache\u001b[0m\n          2025-01-17T02:35:39.3661664Z \u001b[36;1mmkdir -p ./enos/support/terraform-plugin-cache\u001b[0m\n          2025-01-17T02:35:39.3662058Z \u001b[36;1menos scenario run --timeout 10m0s --chdir ./enos/k8s k8s edition:ce repo:ecr\u001b[0m\n          2025-01-17T02:35:39.3696261Z shell: /usr/bin/bash -e {0}\n          2025-01-17T02:35:39.3696471Z env:\n          2025-01-17T02:35:39.3696857Z   GITHUB_TOKEN: ***\n          2025-01-17T02:35:39.3697127Z   ENOS_VAR_terraform_plugin_cache_dir: ../support/terraform-plugin-cache\n          2025-01-17T02:35:39.3697466Z   ENOS_VAR_vault_build_date: 2025-01-16T16:05:20Z\n          2025-01-17T02:35:39.3697711Z   ENOS_VAR_vault_version: 1.19.0-beta1\n          2025-01-17T02:35:39.3697987Z   ENOS_VAR_vault_revision: e69f2ace060741474a49231bf8330f97547c8b2b\n          2025-01-17T02:35:39.3698716Z   ENOS_VAR_container_image_archive: /home/runner/work/vault/vault/enos/support/downloads/vault_default_linux_arm64_1.19.0-beta1_e69f2ace060741474a49231bf8330f97547c8b2b.docker.tar\n          2025-01-17T02:35:39.3903225Z k8s [edition:ce repo:ecr] generate: running\n          2025-01-17T02:35:39.3947114Z k8s [edition:ce repo:ecr] generate: success!\n          2025-01-17T02:35:39.3947512Z k8s [edition:ce repo:ecr] init: running\n          2025-01-17T02:35:41.0355996Z k8s [edition:ce repo:ecr] validate: running\n          2025-01-17T02:35:41.3648307Z k8s [edition:ce repo:ecr] validate: success!\n          2025-01-17T02:35:41.3648611Z k8s [edition:ce repo:ecr] plan: running\n          2025-01-17T02:35:41.7883112Z Scenario: k8s [edition:ce repo:ecr] failed!\n          2025-01-17T02:35:41.7883388Z   Init: success!\n          2025-01-17T02:35:41.7883559Z   Validate: success!\n          2025-01-17T02:35:41.7883753Z Enos operations failed!\n          2025-01-17T02:35:41.7884064Z   Plan: failed!\n          2025-01-17T02:35:41.7884658Z Error: could not create OCI registry client: /home/runneradmin/.config/helm/registry/config.json: stat /home/runneradmin/.config/helm/registry/config.json: permission denied\n          2025-01-17T02:35:41.7885377Z   with module.deploy_vault.helm_release.vault,\n          2025-01-17T02:35:41.7885749Z   on ../../../modules/k8s_deploy_vault/main.tf line 47, in resource \"helm_release\" \"vault\":\n          2025-01-17T02:35:41.7886099Z   47: resource \"helm_release\" \"vault\" {\n          2025-01-17T02:35:41.7886827Z \u001b[31m╷\u001b[0m\n          2025-01-17T02:35:41.7887070Z \u001b[31m│\u001b[0m \u001b[1m\u001b[31mError: \u001b[0m\u001b[1mexit status 1\n          2025-01-17T02:35:41.7887320Z \u001b[31m│\u001b[0m\n          2025-01-17T02:35:41.7887992Z \u001b[31m│\u001b[0m Error: could not create OCI registry client: /home/runneradmin/.config/helm/registry/config.json: stat /home/runneradmin/.config/helm/registry/config.json: permission denied\n          2025-01-17T02:35:41.7888649Z \u001b[31m│\u001b[0m\n          2025-01-17T02:35:41.7888884Z \u001b[31m│\u001b[0m   with module.deploy_vault.helm_release.vault,\n          2025-01-17T02:35:41.7889364Z \u001b[31m│\u001b[0m   on ../../../modules/k8s_deploy_vault/main.tf line 47, in resource \"helm_release\" \"vault\":\n          2025-01-17T02:35:41.7889784Z \u001b[31m│\u001b[0m   47: resource \"helm_release\" \"vault\" {\n          2025-01-17T02:35:41.7890030Z \u001b[31m│\u001b[0m\n          2025-01-17T02:35:41.7890213Z \u001b[31m│\u001b[0m \u001b[0m\n          2025-01-17T02:35:41.7890381Z \u001b[31m│\u001b[0m\n          2025-01-17T02:35:41.7890566Z \u001b[31m│\u001b[0m   (source code not available)\n          2025-01-17T02:35:41.7890796Z \u001b[31m╵\u001b[0m\n          \u001b[1;31m2025-01-17T02:35:41.7911636Z Process completed with exit code 1.\u001b[0m\n        Step: \u001b[1;39mRun enos scenario run --timeout 10m0s --chdir ./enos/k8s k8s edition:ce repo:ecr\u001b[0m\n          2025-01-17T02:35:41.7958612Z \u001b[36;1menos scenario run --timeout 10m0s --chdir ./enos/k8s k8s edition:ce repo:ecr\u001b[0m\n          2025-01-17T02:35:41.7980161Z shell: /usr/bin/bash -e {0}\n          2025-01-17T02:35:41.7980359Z env:\n          2025-01-17T02:35:41.7980756Z   GITHUB_TOKEN: ***\n          2025-01-17T02:35:41.7981024Z   ENOS_VAR_terraform_plugin_cache_dir: ../support/terraform-plugin-cache\n          2025-01-17T02:35:41.7981362Z   ENOS_VAR_vault_build_date: 2025-01-16T16:05:20Z\n          2025-01-17T02:35:41.7981627Z   ENOS_VAR_vault_version: 1.19.0-beta1\n          2025-01-17T02:35:41.7981906Z   ENOS_VAR_vault_revision: e69f2ace060741474a49231bf8330f97547c8b2b\n          2025-01-17T02:35:41.7982635Z   ENOS_VAR_container_image_archive: /home/runner/work/vault/vault/enos/support/downloads/vault_default_linux_arm64_1.19.0-beta1_e69f2ace060741474a49231bf8330f97547c8b2b.docker.tar\n          2025-01-17T02:35:41.8145723Z k8s [edition:ce repo:ecr] generate: running\n          2025-01-17T02:35:41.8187179Z k8s [edition:ce repo:ecr] init: running\n          2025-01-17T02:35:42.0857122Z k8s [edition:ce repo:ecr] validate: running\n          2025-01-17T02:35:42.4180735Z k8s [edition:ce repo:ecr] plan: running\n          2025-01-17T02:35:42.8458486Z Scenario: k8s [edition:ce repo:ecr] failed!\n          2025-01-17T02:35:42.8458796Z Enos operations failed!\n          2025-01-17T02:35:42.8458978Z   Plan: failed!\n          2025-01-17T02:35:42.8459567Z Error: could not create OCI registry client: /home/runneradmin/.config/helm/registry/config.json: stat /home/runneradmin/.config/helm/registry/config.json: permission denied\n          2025-01-17T02:35:42.8460691Z   with module.deploy_vault.helm_release.vault,\n          2025-01-17T02:35:42.8461065Z   on ../../../modules/k8s_deploy_vault/main.tf line 47, in resource \"helm_release\" \"vault\":\n          2025-01-17T02:35:42.8461423Z   47: resource \"helm_release\" \"vault\" {\n          2025-01-17T02:35:42.8461915Z \u001b[31m╷\u001b[0m\n          2025-01-17T02:35:42.8462136Z \u001b[31m│\u001b[0m \u001b[1m\u001b[31mError: \u001b[0m\u001b[1mexit status 1\n          2025-01-17T02:35:42.8462385Z \u001b[31m│\u001b[0m\n          2025-01-17T02:35:42.8463052Z \u001b[31m│\u001b[0m Error: could not create OCI registry client: /home/runneradmin/.config/helm/registry/config.json: stat /home/runneradmin/.config/helm/registry/config.json: permission denied\n          2025-01-17T02:35:42.8463705Z \u001b[31m│\u001b[0m\n          2025-01-17T02:35:42.8463938Z \u001b[31m│\u001b[0m   with module.deploy_vault.helm_release.vault,\n          2025-01-17T02:35:42.8464406Z \u001b[31m│\u001b[0m   on ../../../modules/k8s_deploy_vault/main.tf line 47, in resource \"helm_release\" \"vault\":\n          2025-01-17T02:35:42.8464818Z \u001b[31m│\u001b[0m   47: resource \"helm_release\" \"vault\" {\n          2025-01-17T02:35:42.8465066Z \u001b[31m│\u001b[0m\n          2025-01-17T02:35:42.8465228Z \u001b[31m│\u001b[0m \u001b[0m\n          2025-01-17T02:35:42.8465394Z \u001b[31m│\u001b[0m\n          2025-01-17T02:35:42.8465578Z \u001b[31m│\u001b[0m   (source code not available)\n          2025-01-17T02:35:42.8465811Z \u001b[31m╵\u001b[0m\n          2025-01-17T02:35:42.8465955Z   Init: success!\n          2025-01-17T02:35:42.8466124Z   Validate: success!\n          \u001b[1;31m2025-01-17T02:35:42.8472672Z Process completed with exit code 1.\u001b[0m\n    Job: \u001b[1;39mcompleted-successfully\u001b[0m\n      URL: https://github.com/hashicorp/vault/actions/runs/12821474724/job/35753307080\n      Status: completed\n      Conclusion: failure\n      CreatedAt: 2025-01-17 02:44:10 +0000 UTC\n      StartedAt: 2025-01-17 02:44:17 +0000 UTC\n      CompletedAt: 2025-01-17 02:44:52 +0000 UTC\n      \u001b[1;39mUnsuccessful Steps:\u001b[0m\n        Step: \u001b[1;39mCheck for failed status\u001b[0m\n          Status: \u001b[1;32;49mcompleted\u001b[0m  \n          Conclusion: \u001b[1;31;49mfailure\u001b[0m  \n      \u001b[1;39mUnsuccessful Step Log Summaries:\u001b[0m\n        Step: \u001b[1;39mRun echo \"One or more required build workflows failed: [  \"success\",  \"success\",  \"success\",  \"success\",  \"failure\"]\"\u001b[0m\n          2025-01-17T02:44:49.2390842Z \u001b[36;1mecho \"One or more required build workflows failed: [  \"success\",  \"success\",  \"success\",  \"success\",  \"failure\"]\"\u001b[0m\n          2025-01-17T02:44:49.2391280Z \u001b[36;1mexit 1\u001b[0m\n          2025-01-17T02:44:49.2417636Z shell: /usr/bin/bash -e {0}\n          2025-01-17T02:44:49.2417856Z env:\n          2025-01-17T02:44:49.2418035Z   filepath: metadata.json\n          2025-01-17T02:44:49.2463801Z One or more required build workflows failed: [  success,  success,  success,  success,  failure]\n          \u001b[1;31m2025-01-17T02:44:49.2474667Z Process completed with exit code 1.\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.2535554Z Post job cleanup.\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3466495Z [command]/usr/bin/git version\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3502750Z git version 2.47.1\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3546179Z Temporarily overriding HOME='/home/runner/work/_temp/ceb6055c-d4a6-4de9-b8be-a9d6180352c2' before making global git config changes\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3547460Z Adding repository directory to the temporary git global config as a safe directory\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3552538Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/vault/vault\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3587929Z [command]/usr/bin/git config --local --name-only --get-regexp core\\.sshCommand\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3619518Z [command]/usr/bin/git submodule foreach --recursive sh -c \"git config --local --name-only --get-regexp 'core\\.sshCommand' \u0026\u0026 git config --local --unset-all 'core.sshCommand' || :\"\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3862711Z [command]/usr/bin/git config --local --name-only --get-regexp http\\.https\\:\\/\\/github\\.com\\/\\.extraheader\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3882741Z http.https://github.com/.extraheader\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3894919Z [command]/usr/bin/git config --local --unset-all http.https://github.com/.extraheader\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.3924680Z [command]/usr/bin/git submodule foreach --recursive sh -c \"git config --local --name-only --get-regexp 'http\\.https\\:\\/\\/github\\.com\\/\\.extraheader' \u0026\u0026 git config --local --unset-all 'http.https://github.com/.extraheader' || :\"\u001b[0m\n          \u001b[1;31m2025-01-17T02:44:49.4264683Z Cleaning up orphan processes\u001b[0m"},{"run":{"id":12800864818,"name":"build","node_id":"WFR_kwLOAd1ufs8AAAAC-v2yMg","head_branch":"main","head_sha":"f503f739de19944537638129f1cb3492f523f937","path":".github/workflows/build.yml","run_number":51157,"run_attempt":1,"event":"schedule","display_title":"build","status":"completed","conclusion":"failure","workflow_id":13877638,"check_suite_id":33120756055,"check_suite_node_id":"CS_kwDOAd1ufs8AAAAHtiahVw","url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12800864818","html_url":"https://github.com/hashicorp/vault/actions/runs/12800864818","created_at":"2025-01-16T02:26:00Z","updated_at":"2025-01-16T02:43:21Z","run_started_at":"2025-01-16T02:26:00Z","jobs_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12800864818/jobs","logs_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12800864818/logs","check_suite_url":"https://api.github.com/repos/hashicorp/vault/check-suites/33120756055","artifacts_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12800864818/artifacts","cancel_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12800864818/cancel","rerun_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12800864818/rerun","head_commit":{"message":"identity: Resolve conflicts with rename (#29356)\n\nThis PR introduces a new type of conflict resolution for duplicate\nEntities and Groups. Renaming provides a way of preventing Vault from\nentering case-sensitive mode, which is the current behavior for any kind\nof duplicate.\n\nRenames append the conflicting identity artifact's UUID to its name and\nupdates a metadata field to indicate the pre-existing artifact's UUID.\n\nThe feature is gated by the force-identity-deduplication activation flag.\n\nIn order to maintain consistent behavior between the reporting resolver\nand the rename operation, we need to adjust the behavior of generated\nreports. Previously, they intentionally preserved existing Group merge\ndeterminism, wherein the last MemDB update would win and all others\nwould be renamed. This approach is more complicated for the rename\nresolver, since we would need to update any duplicated entity in the\ncache while inserting the new duplicate (resulting in two MemDB\noperations). Though we can ensure atomic updates of the two identity\nartifacts with transactions (which we could get for groups with a minor\nadjustment, and we will get along with batching of Entity upserts on \nload), it's far simpler to just rename all but the first insert as proposed\nin the current PR.\n\nSince the feature is gated by an activation flag with appropriate \nwarnings of potential changes via the reporting resolver, we opt\nfor simplicity over maintaining pre-existing behavior. We can revisit\nthis assumption later if we think alignment with existing behavior\noutweighs any potential complexity in the rename operation.\n\nEntity alias resolution is left alone as a destructive merge operation\nto prevent a potentially high-impact change in existing behavior.","author":{"name":"Mike Palmiotto","email":"mike.palmiotto@hashicorp.com"},"id":"f503f739de19944537638129f1cb3492f523f937","tree_id":"3e0149ad01512cf162b6be413cac3d5f29ad168e","timestamp":"2025-01-15T19:24:49Z","committer":{"name":"GitHub","email":"noreply@github.com"}},"workflow_url":"https://api.github.com/repos/hashicorp/vault/actions/workflows/13877638","repository":{"id":31288958,"node_id":"MDEwOlJlcG9zaXRvcnkzMTI4ODk1OA==","owner":{"login":"hashicorp","id":761456,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc2MTQ1Ng==","avatar_url":"https://avatars.githubusercontent.com/u/761456?v=4","html_url":"https://github.com/hashicorp","gravatar_id":"","type":"Organization","site_admin":false,"url":"https://api.github.com/users/hashicorp","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","followers_url":"https://api.github.com/users/hashicorp/followers","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","organizations_url":"https://api.github.com/users/hashicorp/orgs","received_events_url":"https://api.github.com/users/hashicorp/received_events","repos_url":"https://api.github.com/users/hashicorp/repos","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions"},"name":"vault","full_name":"hashicorp/vault","description":"A tool for secrets management, encryption as a service, and privileged access management","html_url":"https://github.com/hashicorp/vault","fork":false,"private":false,"url":"https://api.github.com/repos/hashicorp/vault","archive_url":"https://api.github.com/repos/hashicorp/vault/{archive_format}{/ref}","assignees_url":"https://api.github.com/repos/hashicorp/vault/assignees{/user}","blobs_url":"https://api.github.com/repos/hashicorp/vault/git/blobs{/sha}","branches_url":"https://api.github.com/repos/hashicorp/vault/branches{/branch}","collaborators_url":"https://api.github.com/repos/hashicorp/vault/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/hashicorp/vault/comments{/number}","commits_url":"https://api.github.com/repos/hashicorp/vault/commits{/sha}","compare_url":"https://api.github.com/repos/hashicorp/vault/compare/{base}...{head}","contents_url":"https://api.github.com/repos/hashicorp/vault/contents/{+path}","contributors_url":"https://api.github.com/repos/hashicorp/vault/contributors","deployments_url":"https://api.github.com/repos/hashicorp/vault/deployments","downloads_url":"https://api.github.com/repos/hashicorp/vault/downloads","events_url":"https://api.github.com/repos/hashicorp/vault/events","forks_url":"https://api.github.com/repos/hashicorp/vault/forks","git_commits_url":"https://api.github.com/repos/hashicorp/vault/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/vault/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/vault/git/tags{/sha}","hooks_url":"https://api.github.com/repos/hashicorp/vault/hooks","issue_comment_url":"https://api.github.com/repos/hashicorp/vault/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/hashicorp/vault/issues/events{/number}","issues_url":"https://api.github.com/repos/hashicorp/vault/issues{/number}","keys_url":"https://api.github.com/repos/hashicorp/vault/keys{/key_id}","labels_url":"https://api.github.com/repos/hashicorp/vault/labels{/name}","languages_url":"https://api.github.com/repos/hashicorp/vault/languages","merges_url":"https://api.github.com/repos/hashicorp/vault/merges","milestones_url":"https://api.github.com/repos/hashicorp/vault/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/vault/notifications{?since,all,participating}","pulls_url":"https://api.github.com/repos/hashicorp/vault/pulls{/number}","releases_url":"https://api.github.com/repos/hashicorp/vault/releases{/id}","stargazers_url":"https://api.github.com/repos/hashicorp/vault/stargazers","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/{sha}","subscribers_url":"https://api.github.com/repos/hashicorp/vault/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/vault/subscription","tags_url":"https://api.github.com/repos/hashicorp/vault/tags","trees_url":"https://api.github.com/repos/hashicorp/vault/git/trees{/sha}","teams_url":"https://api.github.com/repos/hashicorp/vault/teams"},"head_repository":{"id":31288958,"node_id":"MDEwOlJlcG9zaXRvcnkzMTI4ODk1OA==","owner":{"login":"hashicorp","id":761456,"node_id":"MDEyOk9yZ2FuaXphdGlvbjc2MTQ1Ng==","avatar_url":"https://avatars.githubusercontent.com/u/761456?v=4","html_url":"https://github.com/hashicorp","gravatar_id":"","type":"Organization","site_admin":false,"url":"https://api.github.com/users/hashicorp","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","followers_url":"https://api.github.com/users/hashicorp/followers","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","organizations_url":"https://api.github.com/users/hashicorp/orgs","received_events_url":"https://api.github.com/users/hashicorp/received_events","repos_url":"https://api.github.com/users/hashicorp/repos","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions"},"name":"vault","full_name":"hashicorp/vault","description":"A tool for secrets management, encryption as a service, and privileged access management","html_url":"https://github.com/hashicorp/vault","fork":false,"private":false,"url":"https://api.github.com/repos/hashicorp/vault","archive_url":"https://api.github.com/repos/hashicorp/vault/{archive_format}{/ref}","assignees_url":"https://api.github.com/repos/hashicorp/vault/assignees{/user}","blobs_url":"https://api.github.com/repos/hashicorp/vault/git/blobs{/sha}","branches_url":"https://api.github.com/repos/hashicorp/vault/branches{/branch}","collaborators_url":"https://api.github.com/repos/hashicorp/vault/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/hashicorp/vault/comments{/number}","commits_url":"https://api.github.com/repos/hashicorp/vault/commits{/sha}","compare_url":"https://api.github.com/repos/hashicorp/vault/compare/{base}...{head}","contents_url":"https://api.github.com/repos/hashicorp/vault/contents/{+path}","contributors_url":"https://api.github.com/repos/hashicorp/vault/contributors","deployments_url":"https://api.github.com/repos/hashicorp/vault/deployments","downloads_url":"https://api.github.com/repos/hashicorp/vault/downloads","events_url":"https://api.github.com/repos/hashicorp/vault/events","forks_url":"https://api.github.com/repos/hashicorp/vault/forks","git_commits_url":"https://api.github.com/repos/hashicorp/vault/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/vault/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/vault/git/tags{/sha}","hooks_url":"https://api.github.com/repos/hashicorp/vault/hooks","issue_comment_url":"https://api.github.com/repos/hashicorp/vault/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/hashicorp/vault/issues/events{/number}","issues_url":"https://api.github.com/repos/hashicorp/vault/issues{/number}","keys_url":"https://api.github.com/repos/hashicorp/vault/keys{/key_id}","labels_url":"https://api.github.com/repos/hashicorp/vault/labels{/name}","languages_url":"https://api.github.com/repos/hashicorp/vault/languages","merges_url":"https://api.github.com/repos/hashicorp/vault/merges","milestones_url":"https://api.github.com/repos/hashicorp/vault/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/vault/notifications{?since,all,participating}","pulls_url":"https://api.github.com/repos/hashicorp/vault/pulls{/number}","releases_url":"https://api.github.com/repos/hashicorp/vault/releases{/id}","stargazers_url":"https://api.github.com/repos/hashicorp/vault/stargazers","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/{sha}","subscribers_url":"https://api.github.com/repos/hashicorp/vault/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/vault/subscription","tags_url":"https://api.github.com/repos/hashicorp/vault/tags","trees_url":"https://api.github.com/repos/hashicorp/vault/git/trees{/sha}","teams_url":"https://api.github.com/repos/hashicorp/vault/teams"},"actor":{"login":"ryancragun","id":65058,"node_id":"MDQ6VXNlcjY1MDU4","avatar_url":"https://avatars.githubusercontent.com/u/65058?v=4","html_url":"https://github.com/ryancragun","gravatar_id":"","type":"User","site_admin":false,"url":"https://api.github.com/users/ryancragun","events_url":"https://api.github.com/users/ryancragun/events{/privacy}","following_url":"https://api.github.com/users/ryancragun/following{/other_user}","followers_url":"https://api.github.com/users/ryancragun/followers","gists_url":"https://api.github.com/users/ryancragun/gists{/gist_id}","organizations_url":"https://api.github.com/users/ryancragun/orgs","received_events_url":"https://api.github.com/users/ryancragun/received_events","repos_url":"https://api.github.com/users/ryancragun/repos","starred_url":"https://api.github.com/users/ryancragun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryancragun/subscriptions"},"triggering_actor":{"login":"ryancragun","id":65058,"node_id":"MDQ6VXNlcjY1MDU4","avatar_url":"https://avatars.githubusercontent.com/u/65058?v=4","html_url":"https://github.com/ryancragun","gravatar_id":"","type":"User","site_admin":false,"url":"https://api.github.com/users/ryancragun","events_url":"https://api.github.com/users/ryancragun/events{/privacy}","following_url":"https://api.github.com/users/ryancragun/following{/other_user}","followers_url":"https://api.github.com/users/ryancragun/followers","gists_url":"https://api.github.com/users/ryancragun/gists{/gist_id}","organizations_url":"https://api.github.com/users/ryancragun/orgs","received_events_url":"https://api.github.com/users/ryancragun/received_events","repos_url":"https://api.github.com/users/ryancragun/repos","starred_url":"https://api.github.com/users/ryancragun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryancragun/subscriptions"},"referenced_workflows":[{"path":"hashicorp/vault/.github/workflows/test-run-enos-scenario-containers.yml@f503f739de19944537638129f1cb3492f523f937","sha":"f503f739de19944537638129f1cb3492f523f937","ref":"refs/heads/main"},{"path":"hashicorp/vault/.github/workflows/test-run-enos-scenario-matrix.yml@f503f739de19944537638129f1cb3492f523f937","sha":"f503f739de19944537638129f1cb3492f523f937","ref":"refs/heads/main"},{"path":"hashicorp/vault/.github/workflows/build-artifacts-ce.yml@f503f739de19944537638129f1cb3492f523f937","sha":"f503f739de19944537638129f1cb3492f523f937","ref":"refs/heads/main"}]},"jobs":[{"job":{"id":35689604952,"run_id":12800864818,"run_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12800864818","node_id":"CR_kwDOAd1ufs8AAAAIT0QnWA","head_branch":"main","head_sha":"f503f739de19944537638129f1cb3492f523f937","url":"https://api.github.com/repos/hashicorp/vault/actions/jobs/35689604952","html_url":"https://github.com/hashicorp/vault/actions/runs/12800864818/job/35689604952","status":"completed","conclusion":"failure","created_at":"2025-01-16T02:34:56Z","started_at":"2025-01-16T02:35:03Z","completed_at":"2025-01-16T02:35:28Z","name":"test vault_default_linux_arm64_1.19.0-beta1_f503f739de19944537638129f1cb3492f523f937.docker.tar / run k8s edition:ce repo:ecr","steps":[{"name":"Set up job","status":"completed","conclusion":"success","number":1,"started_at":"2025-01-16T02:35:02Z","completed_at":"2025-01-16T02:35:04Z"},{"name":"Run actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332","status":"completed","conclusion":"success","number":2,"started_at":"2025-01-16T02:35:04Z","completed_at":"2025-01-16T02:35:09Z"},{"name":"Run hashicorp/setup-terraform@v3","status":"completed","conclusion":"success","number":3,"started_at":"2025-01-16T02:35:09Z","completed_at":"2025-01-16T02:35:10Z"},{"name":"Run hashicorp/action-setup-enos@v1","status":"completed","conclusion":"success","number":4,"started_at":"2025-01-16T02:35:11Z","completed_at":"2025-01-16T02:35:11Z"},{"name":"Download Docker Image","status":"completed","conclusion":"success","number":5,"started_at":"2025-01-16T02:35:12Z","completed_at":"2025-01-16T02:35:19Z"},{"name":"Configure license","status":"completed","conclusion":"skipped","number":6,"started_at":"2025-01-16T02:35:20Z","completed_at":"2025-01-16T02:35:20Z"},{"name":"Run Enos scenario","status":"completed","conclusion":"success","number":7,"started_at":"2025-01-16T02:35:20Z","completed_at":"2025-01-16T02:35:23Z"},{"name":"Retry Enos scenario","status":"completed","conclusion":"failure","number":8,"started_at":"2025-01-16T02:35:23Z","completed_at":"2025-01-16T02:35:24Z"},{"name":"Destroy Enos scenario","status":"completed","conclusion":"success","number":9,"started_at":"2025-01-16T02:35:25Z","completed_at":"2025-01-16T02:35:25Z"},{"name":"Cleanup Enos runtime directories","status":"completed","conclusion":"success","number":10,"started_at":"2025-01-16T02:35:28Z","completed_at":"2025-01-16T02:35:28Z"},{"name":"Post Run actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332","status":"completed","conclusion":"success","number":20,"started_at":"2025-01-16T02:35:28Z","completed_at":"2025-01-16T02:35:28Z"},{"name":"Complete job","status":"completed","conclusion":"success","number":21,"started_at":"2025-01-16T02:35:25Z","completed_at":"2025-01-16T02:35:25Z"}],"check_run_url":"https://api.github.com/repos/hashicorp/vault/check-runs/35689604952","labels":["ubuntu-22.04-arm"],"runner_id":2429,"runner_name":"GitHub Actions 2268","runner_group_id":2,"runner_group_name":"GitHub Actions","run_attempt":1,"workflow_name":"build"},"log_entries":[{"step_name":"Run mkdir -p ./enos/support/terraform-plugin-cache","setup_log":"MjAyNS0wMS0xNlQwMjozNToxOS42NjIxMTM5WiAbWzM2OzFtbWtkaXIgLXAgLi9lbm9zL3N1cHBvcnQvdGVycmFmb3JtLXBsdWdpbi1jYWNoZRtbMG0KMjAyNS0wMS0xNlQwMjozNToxOS42NjIxNTI1WiAbWzM2OzFtZW5vcyBzY2VuYXJpbyBydW4gLS10aW1lb3V0IDEwbTBzIC0tY2hkaXIgLi9lbm9zL2s4cyBrOHMgZWRpdGlvbjpjZSByZXBvOmVjchtbMG0KMjAyNS0wMS0xNlQwMjozNToxOS42NjQ2ODIzWiBzaGVsbDogL3Vzci9iaW4vYmFzaCAtZSB7MH0KMjAyNS0wMS0xNlQwMjozNToxOS42NjQ3MDI2WiBlbnY6CjIwMjUtMDEtMTZUMDI6MzU6MTkuNjY0NzQxMlogICBHSVRIVUJfVE9LRU46ICoqKgoyMDI1LTAxLTE2VDAyOjM1OjE5LjY2NDc2ODJaICAgRU5PU19WQVJfdGVycmFmb3JtX3BsdWdpbl9jYWNoZV9kaXI6IC4uL3N1cHBvcnQvdGVycmFmb3JtLXBsdWdpbi1jYWNoZQoyMDI1LTAxLTE2VDAyOjM1OjE5LjY2NDgwMTdaICAgRU5PU19WQVJfdmF1bHRfYnVpbGRfZGF0ZTogMjAyNS0wMS0xNVQxNDoyNDo0OVoKMjAyNS0wMS0xNlQwMjozNToxOS42NjQ4MjU4WiAgIEVOT1NfVkFSX3ZhdWx0X3ZlcnNpb246IDEuMTkuMC1iZXRhMQoyMDI1LTAxLTE2VDAyOjM1OjE5LjY2NDg1MzBaICAgRU5PU19WQVJfdmF1bHRfcmV2aXNpb246IGY1MDNmNzM5ZGUxOTk0NDUzNzYzODEyOWYxY2IzNDkyZjUyM2Y5MzcKMjAyNS0wMS0xNlQwMjozNToxOS42NjQ5NDE4WiAgIEVOT1NfVkFSX2NvbnRhaW5lcl9pbWFnZV9hcmNoaXZlOiAvaG9tZS9ydW5uZXIvd29yay92YXVsdC92YXVsdC9lbm9zL3N1cHBvcnQvZG93bmxvYWRzL3ZhdWx0X2RlZmF1bHRfbGludXhfYXJtNjRfMS4xOS4wLWJldGExX2Y1MDNmNzM5ZGUxOTk0NDUzNzYzODEyOWYxY2IzNDkyZjUyM2Y5MzcuZG9ja2VyLnRhcg==","body_log":"MjAyNS0wMS0xNlQwMjozNToxOS42ODQ1NjM1WiBrOHMgW2VkaXRpb246Y2UgcmVwbzplY3JdIGdlbmVyYXRlOiBydW5uaW5nCjIwMjUtMDEtMTZUMDI6MzU6MTkuNjg4NTk0NlogazhzIFtlZGl0aW9uOmNlIHJlcG86ZWNyXSBpbml0OiBydW5uaW5nCjIwMjUtMDEtMTZUMDI6MzU6MjIuODU1NTg0M1ogazhzIFtlZGl0aW9uOmNlIHJlcG86ZWNyXSB2YWxpZGF0ZTogcnVubmluZwoyMDI1LTAxLTE2VDAyOjM1OjIzLjE5NjE2ODhaIGs4cyBbZWRpdGlvbjpjZSByZXBvOmVjcl0gcGxhbjogcnVubmluZwoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMTczNjBaIAoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMTc4MjVaIFNjZW5hcmlvOiBrOHMgW2VkaXRpb246Y2UgcmVwbzplY3JdIGZhaWxlZCEKMjAyNS0wMS0xNlQwMjozNToyMy42MjE4MDk5WiAgIEluaXQ6IHN1Y2Nlc3MhCjIwMjUtMDEtMTZUMDI6MzU6MjMuNjIxODI2M1ogICBWYWxpZGF0ZTogc3VjY2VzcyEKMjAyNS0wMS0xNlQwMjozNToyMy42MjE4NjUzWiBFbm9zIG9wZXJhdGlvbnMgZmFpbGVkIQoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMjgyNDZaIAoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMjg1MjNaICAgUGxhbjogZmFpbGVkIQoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMjg2NTVaIAoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMjkxNDdaIEVycm9yOiBjb3VsZCBub3QgY3JlYXRlIE9DSSByZWdpc3RyeSBjbGllbnQ6IC9ob21lL3J1bm5lcmFkbWluLy5jb25maWcvaGVsbS9yZWdpc3RyeS9jb25maWcuanNvbjogc3RhdCAvaG9tZS9ydW5uZXJhZG1pbi8uY29uZmlnL2hlbG0vcmVnaXN0cnkvY29uZmlnLmpzb246IHBlcm1pc3Npb24gZGVuaWVkCjIwMjUtMDEtMTZUMDI6MzU6MjMuNjIyOTc0OFogCjIwMjUtMDEtMTZUMDI6MzU6MjMuNjIyOTg0N1ogICB3aXRoIG1vZHVsZS5kZXBsb3lfdmF1bHQuaGVsbV9yZWxlYXNlLnZhdWx0LAoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMzAzMTZaICAgb24gLi4vLi4vLi4vbW9kdWxlcy9rOHNfZGVwbG95X3ZhdWx0L21haW4udGYgbGluZSA0NywgaW4gcmVzb3VyY2UgImhlbG1fcmVsZWFzZSIgInZhdWx0IjoKMjAyNS0wMS0xNlQwMjozNToyMy42MjMwNjY5WiAgIDQ3OiByZXNvdXJjZSAiaGVsbV9yZWxlYXNlIiAidmF1bHQiIHsKMjAyNS0wMS0xNlQwMjozNToyMy42MjMwODIwWiAKMjAyNS0wMS0xNlQwMjozNToyMy42MjMwODIzWiAKMjAyNS0wMS0xNlQwMjozNToyMy42MjMxMzMxWiAbWzMxbeKVtxtbMG0KMjAyNS0wMS0xNlQwMjozNToyMy42MjMxNTc0WiAbWzMxbeKUghtbMG0gG1sxbRtbMzFtRXJyb3I6IBtbMG0bWzFtZXhpdCBzdGF0dXMgMQoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMzE4MTlaIBtbMzFt4pSCG1swbQoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMzI0OTdaIBtbMzFt4pSCG1swbSBFcnJvcjogY291bGQgbm90IGNyZWF0ZSBPQ0kgcmVnaXN0cnkgY2xpZW50OiAvaG9tZS9ydW5uZXJhZG1pbi8uY29uZmlnL2hlbG0vcmVnaXN0cnkvY29uZmlnLmpzb246IHN0YXQgL2hvbWUvcnVubmVyYWRtaW4vLmNvbmZpZy9oZWxtL3JlZ2lzdHJ5L2NvbmZpZy5qc29uOiBwZXJtaXNzaW9uIGRlbmllZAoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMzMxMzVaIBtbMzFt4pSCG1swbQoyMDI1LTAxLTE2VDAyOjM1OjIzLjYyMzMzNjhaIBtbMzFt4pSCG1swbSAgIHdpdGggbW9kdWxlLmRlcGxveV92YXVsdC5oZWxtX3JlbGVhc2UudmF1bHQsCjIwMjUtMDEtMTZUMDI6MzU6MjMuNjIzMzgzNFogG1szMW3ilIIbWzBtICAgb24gLi4vLi4vLi4vbW9kdWxlcy9rOHNfZGVwbG95X3ZhdWx0L21haW4udGYgbGluZSA0NywgaW4gcmVzb3VyY2UgImhlbG1fcmVsZWFzZSIgInZhdWx0IjoKMjAyNS0wMS0xNlQwMjozNToyMy42MjM0MjQzWiAbWzMxbeKUghtbMG0gICA0NzogcmVzb3VyY2UgImhlbG1fcmVsZWFzZSIgInZhdWx0IiB7CjIwMjUtMDEtMTZUMDI6MzU6MjMuNjIzNDQ5N1ogG1szMW3ilIIbWzBtCjIwMjUtMDEtMTZUMDI6MzU6MjMuNjIzNDY3NlogG1szMW3ilIIbWzBtIBtbMG0KMjAyNS0wMS0xNlQwMjozNToyMy42MjM1MDU4WiAbWzMxbeKUghtbMG0KMjAyNS0wMS0xNlQwMjozNToyMy42MjM1MjcxWiAbWzMxbeKUghtbMG0gICAoc291cmNlIGNvZGUgbm90IGF2YWlsYWJsZSkKMjAyNS0wMS0xNlQwMjozNToyMy42MjM1NDk2WiAbWzMxbeKVtRtbMG0=","error_log":"MjAyNS0wMS0xNlQwMjozNToyMy42MjQ5MDg1WiBQcm9jZXNzIGNvbXBsZXRlZCB3aXRoIGV4aXQgY29kZSAxLg=="},{"step_name":"Run enos scenario run --timeout 10m0s --chdir ./enos/k8s k8s edition:ce repo:ecr","setup_log":"MjAyNS0wMS0xNlQwMjozNToyMy42Mjk4MDQ5WiAbWzM2OzFtZW5vcyBzY2VuYXJpbyBydW4gLS10aW1lb3V0IDEwbTBzIC0tY2hkaXIgLi9lbm9zL2s4cyBrOHMgZWRpdGlvbjpjZSByZXBvOmVjchtbMG0KMjAyNS0wMS0xNlQwMjozNToyMy42MzE5ODQyWiBzaGVsbDogL3Vzci9iaW4vYmFzaCAtZSB7MH0KMjAyNS0wMS0xNlQwMjozNToyMy42MzIwMDQyWiBlbnY6CjIwMjUtMDEtMTZUMDI6MzU6MjMuNjMyMDQyN1ogICBHSVRIVUJfVE9LRU46ICoqKgoyMDI1LTAxLTE2VDAyOjM1OjIzLjYzMjA2OTBaICAgRU5PU19WQVJfdGVycmFmb3JtX3BsdWdpbl9jYWNoZV9kaXI6IC4uL3N1cHBvcnQvdGVycmFmb3JtLXBsdWdpbi1jYWNoZQoyMDI1LTAxLTE2VDAyOjM1OjIzLjYzMjEwMjJaICAgRU5PU19WQVJfdmF1bHRfYnVpbGRfZGF0ZTogMjAyNS0wMS0xNVQxNDoyNDo0OVoKMjAyNS0wMS0xNlQwMjozNToyMy42MzIxMjY1WiAgIEVOT1NfVkFSX3ZhdWx0X3ZlcnNpb246IDEuMTkuMC1iZXRhMQoyMDI1LTAxLTE2VDAyOjM1OjIzLjYzMjE1MzZaICAgRU5PU19WQVJfdmF1bHRfcmV2aXNpb246IGY1MDNmNzM5ZGUxOTk0NDUzNzYzODEyOWYxY2IzNDkyZjUyM2Y5MzcKMjAyNS0wMS0xNlQwMjozNToyMy42MzIyMjY2WiAgIEVOT1NfVkFSX2NvbnRhaW5lcl9pbWFnZV9hcmNoaXZlOiAvaG9tZS9ydW5uZXIvd29yay92YXVsdC92YXVsdC9lbm9zL3N1cHBvcnQvZG93bmxvYWRzL3ZhdWx0X2RlZmF1bHRfbGludXhfYXJtNjRfMS4xOS4wLWJldGExX2Y1MDNmNzM5ZGUxOTk0NDUzNzYzODEyOWYxY2IzNDkyZjUyM2Y5MzcuZG9ja2VyLnRhcg==","body_log":"MjAyNS0wMS0xNlQwMjozNToyMy42NDkyNDY4WiBrOHMgW2VkaXRpb246Y2UgcmVwbzplY3JdIGdlbmVyYXRlOiBydW5uaW5nCjIwMjUtMDEtMTZUMDI6MzU6MjMuNjUyOTcyOVogazhzIFtlZGl0aW9uOmNlIHJlcG86ZWNyXSBpbml0OiBydW5uaW5nCjIwMjUtMDEtMTZUMDI6MzU6MjMuOTU2MDc0N1ogazhzIFtlZGl0aW9uOmNlIHJlcG86ZWNyXSBpbml0OiBzdWNjZXNzIQoyMDI1LTAxLTE2VDAyOjM1OjIzLjk1NjEwMzRaIGs4cyBbZWRpdGlvbjpjZSByZXBvOmVjcl0gdmFsaWRhdGU6IHJ1bm5pbmcKMjAyNS0wMS0xNlQwMjozNToyNC4yOTg1NTYzWiBrOHMgW2VkaXRpb246Y2UgcmVwbzplY3JdIHBsYW46IHJ1bm5pbmcKMjAyNS0wMS0xNlQwMjozNToyNC43Mjc4Mzg4WiAKMjAyNS0wMS0xNlQwMjozNToyNC43Mjc4NzMyWiBTY2VuYXJpbzogazhzIFtlZGl0aW9uOmNlIHJlcG86ZWNyXSBmYWlsZWQhCjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI3OTAyOVogRW5vcyBvcGVyYXRpb25zIGZhaWxlZCEKMjAyNS0wMS0xNlQwMjozNToyNC43Mjc5MTUwWiAKMjAyNS0wMS0xNlQwMjozNToyNC43Mjc5MjEzWiAgIFBsYW46IGZhaWxlZCEKMjAyNS0wMS0xNlQwMjozNToyNC43Mjc5MzExWiAKMjAyNS0wMS0xNlQwMjozNToyNC43Mjc5ODAxWiBFcnJvcjogY291bGQgbm90IGNyZWF0ZSBPQ0kgcmVnaXN0cnkgY2xpZW50OiAvaG9tZS9ydW5uZXJhZG1pbi8uY29uZmlnL2hlbG0vcmVnaXN0cnkvY29uZmlnLmpzb246IHN0YXQgL2hvbWUvcnVubmVyYWRtaW4vLmNvbmZpZy9oZWxtL3JlZ2lzdHJ5L2NvbmZpZy5qc29uOiBwZXJtaXNzaW9uIGRlbmllZAoyMDI1LTAxLTE2VDAyOjM1OjI0LjcyODA4NDhaIAoyMDI1LTAxLTE2VDAyOjM1OjI0LjcyODA5NDhaICAgd2l0aCBtb2R1bGUuZGVwbG95X3ZhdWx0LmhlbG1fcmVsZWFzZS52YXVsdCwKMjAyNS0wMS0xNlQwMjozNToyNC43MjgxMzA3WiAgIG9uIC4uLy4uLy4uL21vZHVsZXMvazhzX2RlcGxveV92YXVsdC9tYWluLnRmIGxpbmUgNDcsIGluIHJlc291cmNlICJoZWxtX3JlbGVhc2UiICJ2YXVsdCI6CjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI4MTY3MFogICA0NzogcmVzb3VyY2UgImhlbG1fcmVsZWFzZSIgInZhdWx0IiB7CjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI4MTgyMFogCjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI4MTgzMVogCjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI4MjE1M1ogG1szMW3ilbcbWzBtCjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI4MjM3MlogG1szMW3ilIIbWzBtIBtbMW0bWzMxbUVycm9yOiAbWzBtG1sxbWV4aXQgc3RhdHVzIDEKMjAyNS0wMS0xNlQwMjozNToyNC43MjgyNjEzWiAbWzMxbeKUghtbMG0KMjAyNS0wMS0xNlQwMjozNToyNC43MjgzMjkyWiAbWzMxbeKUghtbMG0gRXJyb3I6IGNvdWxkIG5vdCBjcmVhdGUgT0NJIHJlZ2lzdHJ5IGNsaWVudDogL2hvbWUvcnVubmVyYWRtaW4vLmNvbmZpZy9oZWxtL3JlZ2lzdHJ5L2NvbmZpZy5qc29uOiBzdGF0IC9ob21lL3J1bm5lcmFkbWluLy5jb25maWcvaGVsbS9yZWdpc3RyeS9jb25maWcuanNvbjogcGVybWlzc2lvbiBkZW5pZWQKMjAyNS0wMS0xNlQwMjozNToyNC43MjgzOTM4WiAbWzMxbeKUghtbMG0KMjAyNS0wMS0xNlQwMjozNToyNC43Mjg0MTY3WiAbWzMxbeKUghtbMG0gICB3aXRoIG1vZHVsZS5kZXBsb3lfdmF1bHQuaGVsbV9yZWxlYXNlLnZhdWx0LAoyMDI1LTAxLTE2VDAyOjM1OjI0LjcyODQ2NDRaIBtbMzFt4pSCG1swbSAgIG9uIC4uLy4uLy4uL21vZHVsZXMvazhzX2RlcGxveV92YXVsdC9tYWluLnRmIGxpbmUgNDcsIGluIHJlc291cmNlICJoZWxtX3JlbGVhc2UiICJ2YXVsdCI6CjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI4NTA3MlogG1szMW3ilIIbWzBtICAgNDc6IHJlc291cmNlICJoZWxtX3JlbGVhc2UiICJ2YXVsdCIgewoyMDI1LTAxLTE2VDAyOjM1OjI0LjcyODUzMTZaIBtbMzFt4pSCG1swbQoyMDI1LTAxLTE2VDAyOjM1OjI0LjcyODU0NzFaIBtbMzFt4pSCG1swbSAbWzBtCjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI4NTYzNVogG1szMW3ilIIbWzBtCjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI4NTgyM1ogG1szMW3ilIIbWzBtICAgKHNvdXJjZSBjb2RlIG5vdCBhdmFpbGFibGUpCjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI4NjA2NVogG1szMW3ilbUbWzBtCjIwMjUtMDEtMTZUMDI6MzU6MjQuNzI4NjIxNVogICBJbml0OiBzdWNjZXNzIQoyMDI1LTAxLTE2VDAyOjM1OjI0LjcyODYzNzdaICAgVmFsaWRhdGU6IHN1Y2Nlc3Mh","error_log":"MjAyNS0wMS0xNlQwMjozNToyNC43Mjk2NjAyWiBQcm9jZXNzIGNvbXBsZXRlZCB3aXRoIGV4aXQgY29kZSAxLg=="}]},{"job":{"id":35689842398,"run_id":12800864818,"run_url":"https://api.github.com/repos/hashicorp/vault/actions/runs/12800864818","node_id":"CR_kwDOAd1ufs8AAAAIT0fG3g","head_branch":"main","head_sha":"f503f739de19944537638129f1cb3492f523f937","url":"https://api.github.com/repos/hashicorp/vault/actions/jobs/35689842398","html_url":"https://github.com/hashicorp/vault/actions/runs/12800864818/job/35689842398","status":"completed","conclusion":"failure","created_at":"2025-01-16T02:42:41Z","started_at":"2025-01-16T02:42:49Z","completed_at":"2025-01-16T02:43:20Z","name":"completed-successfully","steps":[{"name":"Set up job","status":"completed","conclusion":"success","number":1,"started_at":"2025-01-16T02:42:48Z","completed_at":"2025-01-16T02:42:51Z"},{"name":"Build hashicorp/actions-generate-metadata@v1","status":"completed","conclusion":"success","number":2,"started_at":"2025-01-16T02:42:51Z","completed_at":"2025-01-16T02:43:11Z"},{"name":"Run actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332","status":"completed","conclusion":"success","number":3,"started_at":"2025-01-16T02:43:11Z","completed_at":"2025-01-16T02:43:14Z"},{"name":"Determine status","status":"completed","conclusion":"success","number":4,"started_at":"2025-01-16T02:43:14Z","completed_at":"2025-01-16T02:43:14Z"},{"name":"Vault Authenticate","status":"completed","conclusion":"skipped","number":5,"started_at":"2025-01-16T02:43:14Z","completed_at":"2025-01-16T02:43:14Z"},{"name":"Fetch Vault Secrets","status":"completed","conclusion":"skipped","number":6,"started_at":"2025-01-16T02:43:14Z","completed_at":"2025-01-16T02:43:14Z"},{"name":"Run echo \"slackbot-token=***\" \u003e\u003e \"$GITHUB_OUTPUT\"","status":"completed","conclusion":"success","number":7,"started_at":"2025-01-16T02:43:14Z","completed_at":"2025-01-16T02:43:14Z"},{"name":"Create or update a build status comment on the pull request","status":"completed","conclusion":"skipped","number":8,"started_at":"2025-01-16T02:43:14Z","completed_at":"2025-01-16T02:43:14Z"},{"name":"Notify build failures in Slack","status":"completed","conclusion":"success","number":9,"started_at":"2025-01-16T02:43:14Z","completed_at":"2025-01-16T02:43:15Z"},{"name":"Run hashicorp/actions-generate-metadata@v1","status":"completed","conclusion":"success","number":10,"started_at":"2025-01-16T02:43:15Z","completed_at":"2025-01-16T02:43:15Z"},{"name":"Run actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a","status":"completed","conclusion":"success","number":11,"started_at":"2025-01-16T02:43:16Z","completed_at":"2025-01-16T02:43:16Z"},{"name":"Check for failed status","status":"completed","conclusion":"failure","number":12,"started_at":"2025-01-16T02:43:20Z","completed_at":"2025-01-16T02:43:20Z"},{"name":"Post Run actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332","status":"completed","conclusion":"success","number":24,"started_at":"2025-01-16T02:43:20Z","completed_at":"2025-01-16T02:43:20Z"},{"name":"Complete job","status":"completed","conclusion":"success","number":25,"started_at":"2025-01-16T02:43:17Z","completed_at":"2025-01-16T02:43:17Z"}],"check_run_url":"https://api.github.com/repos/hashicorp/vault/check-runs/35689842398","labels":["ubuntu-latest"],"runner_id":3017,"runner_name":"GitHub Actions 2856","runner_group_id":2,"runner_group_name":"GitHub Actions","run_attempt":1,"workflow_name":"build"},"log_entries":[{"step_name":"Run echo \"One or more required build workflows failed: [  \"success\",  \"success\",  \"success\",  \"success\",  \"failure\"]\"","setup_log":"MjAyNS0wMS0xNlQwMjo0MzoxNi45NDI4NzkwWiAbWzM2OzFtZWNobyAiT25lIG9yIG1vcmUgcmVxdWlyZWQgYnVpbGQgd29ya2Zsb3dzIGZhaWxlZDogWyAgInN1Y2Nlc3MiLCAgInN1Y2Nlc3MiLCAgInN1Y2Nlc3MiLCAgInN1Y2Nlc3MiLCAgImZhaWx1cmUiXSIbWzBtCjIwMjUtMDEtMTZUMDI6NDM6MTYuOTQyOTI2MVogG1szNjsxbWV4aXQgMRtbMG0KMjAyNS0wMS0xNlQwMjo0MzoxNi45NDU1MTAzWiBzaGVsbDogL3Vzci9iaW4vYmFzaCAtZSB7MH0KMjAyNS0wMS0xNlQwMjo0MzoxNi45NDU1MzI1WiBlbnY6CjIwMjUtMDEtMTZUMDI6NDM6MTYuOTQ1NTQ5NlogICBmaWxlcGF0aDogbWV0YWRhdGEuanNvbg==","body_log":"MjAyNS0wMS0xNlQwMjo0MzoxNi45NTAxMzU5WiBPbmUgb3IgbW9yZSByZXF1aXJlZCBidWlsZCB3b3JrZmxvd3MgZmFpbGVkOiBbICBzdWNjZXNzLCAgc3VjY2VzcywgIHN1Y2Nlc3MsICBzdWNjZXNzLCAgZmFpbHVyZV0=","error_log":"MjAyNS0wMS0xNlQwMjo0MzoxNi45NTE0ODgzWiBQcm9jZXNzIGNvbXBsZXRlZCB3aXRoIGV4aXQgY29kZSAxLgoyMDI1LTAxLTE2VDAyOjQzOjE2Ljk1Nzg5MzFaIFBvc3Qgam9iIGNsZWFudXAuCjIwMjUtMDEtMTZUMDI6NDM6MTcuMDUwNDM5MFogW2NvbW1hbmRdL3Vzci9iaW4vZ2l0IHZlcnNpb24KMjAyNS0wMS0xNlQwMjo0MzoxNy4wNTM5MzQwWiBnaXQgdmVyc2lvbiAyLjQ3LjEKMjAyNS0wMS0xNlQwMjo0MzoxNy4wNTgwNzYxWiBUZW1wb3JhcmlseSBvdmVycmlkaW5nIEhPTUU9Jy9ob21lL3J1bm5lci93b3JrL190ZW1wL2RiMWY1YTJhLWZmMzAtNDYxYS05MTMxLWVlMDUyNGIzMDZmOScgYmVmb3JlIG1ha2luZyBnbG9iYWwgZ2l0IGNvbmZpZyBjaGFuZ2VzCjIwMjUtMDEtMTZUMDI6NDM6MTcuMDU4MTgxMVogQWRkaW5nIHJlcG9zaXRvcnkgZGlyZWN0b3J5IHRvIHRoZSB0ZW1wb3JhcnkgZ2l0IGdsb2JhbCBjb25maWcgYXMgYSBzYWZlIGRpcmVjdG9yeQoyMDI1LTAxLTE2VDAyOjQzOjE3LjA1ODU5NjlaIFtjb21tYW5kXS91c3IvYmluL2dpdCBjb25maWcgLS1nbG9iYWwgLS1hZGQgc2FmZS5kaXJlY3RvcnkgL2hvbWUvcnVubmVyL3dvcmsvdmF1bHQvdmF1bHQKMjAyNS0wMS0xNlQwMjo0MzoxNy4wNjIwNzMxWiBbY29tbWFuZF0vdXNyL2Jpbi9naXQgY29uZmlnIC0tbG9jYWwgLS1uYW1lLW9ubHkgLS1nZXQtcmVnZXhwIGNvcmVcLnNzaENvbW1hbmQKMjAyNS0wMS0xNlQwMjo0MzoxNy4wNjUyMjIxWiBbY29tbWFuZF0vdXNyL2Jpbi9naXQgc3VibW9kdWxlIGZvcmVhY2ggLS1yZWN1cnNpdmUgc2ggLWMgImdpdCBjb25maWcgLS1sb2NhbCAtLW5hbWUtb25seSAtLWdldC1yZWdleHAgJ2NvcmVcLnNzaENvbW1hbmQnICYmIGdpdCBjb25maWcgLS1sb2NhbCAtLXVuc2V0LWFsbCAnY29yZS5zc2hDb21tYW5kJyB8fCA6IgoyMDI1LTAxLTE2VDAyOjQzOjE3LjA4OTM0MzZaIFtjb21tYW5kXS91c3IvYmluL2dpdCBjb25maWcgLS1sb2NhbCAtLW5hbWUtb25seSAtLWdldC1yZWdleHAgaHR0cFwuaHR0cHNcOlwvXC9naXRodWJcLmNvbVwvXC5leHRyYWhlYWRlcgoyMDI1LTAxLTE2VDAyOjQzOjE3LjA5MTMxNzBaIGh0dHAuaHR0cHM6Ly9naXRodWIuY29tLy5leHRyYWhlYWRlcgoyMDI1LTAxLTE2VDAyOjQzOjE3LjA5MjUyNzdaIFtjb21tYW5kXS91c3IvYmluL2dpdCBjb25maWcgLS1sb2NhbCAtLXVuc2V0LWFsbCBodHRwLmh0dHBzOi8vZ2l0aHViLmNvbS8uZXh0cmFoZWFkZXIKMjAyNS0wMS0xNlQwMjo0MzoxNy4wOTU0ODgyWiBbY29tbWFuZF0vdXNyL2Jpbi9naXQgc3VibW9kdWxlIGZvcmVhY2ggLS1yZWN1cnNpdmUgc2ggLWMgImdpdCBjb25maWcgLS1sb2NhbCAtLW5hbWUtb25seSAtLWdldC1yZWdleHAgJ2h0dHBcLmh0dHBzXDpcL1wvZ2l0aHViXC5jb21cL1wuZXh0cmFoZWFkZXInICYmIGdpdCBjb25maWcgLS1sb2NhbCAtLXVuc2V0LWFsbCAnaHR0cC5odHRwczovL2dpdGh1Yi5jb20vLmV4dHJhaGVhZGVyJyB8fCA6IgoyMDI1LTAxLTE2VDAyOjQzOjE3LjEyODU3ODZaIENsZWFuaW5nIHVwIG9ycGhhbiBwcm9jZXNzZXM="}]}],"check_runs":[{"run":{"id":35689604952,"node_id":"CR_kwDOAd1ufs8AAAAIT0QnWA","head_sha":"f503f739de19944537638129f1cb3492f523f937","external_id":"0485042a-e01c-5ac3-f80a-c7817c1122cb","url":"https://api.github.com/repos/hashicorp/vault/check-runs/35689604952","html_url":"https://github.com/hashicorp/vault/actions/runs/12800864818/job/35689604952","details_url":"https://github.com/hashicorp/vault/actions/runs/12800864818/job/35689604952","status":"completed","conclusion":"failure","started_at":"2025-01-16T02:35:03Z","completed_at":"2025-01-16T02:35:28Z","output":{"annotations_count":2,"annotations_url":"https://api.github.com/repos/hashicorp/vault/check-runs/35689604952/annotations"},"name":"test vault_default_linux_arm64_1.19.0-beta1_f503f739de19944537638129f1cb3492f523f937.docker.tar / run k8s edition:ce repo:ecr","check_suite":{"id":33120756055},"app":{"id":15368,"slug":"github-actions","node_id":"MDM6QXBwMTUzNjg=","owner":{"login":"github","id":9919,"node_id":"MDEyOk9yZ2FuaXphdGlvbjk5MTk=","avatar_url":"https://avatars.githubusercontent.com/u/9919?v=4","html_url":"https://github.com/github","gravatar_id":"","type":"Organization","site_admin":false,"url":"https://api.github.com/users/github","events_url":"https://api.github.com/users/github/events{/privacy}","following_url":"https://api.github.com/users/github/following{/other_user}","followers_url":"https://api.github.com/users/github/followers","gists_url":"https://api.github.com/users/github/gists{/gist_id}","organizations_url":"https://api.github.com/users/github/orgs","received_events_url":"https://api.github.com/users/github/received_events","repos_url":"https://api.github.com/users/github/repos","starred_url":"https://api.github.com/users/github/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/github/subscriptions"},"name":"GitHub Actions","description":"Automate your workflow from idea to production","external_url":"https://help.github.com/en/actions","html_url":"https://github.com/apps/github-actions","created_at":"2018-07-30T09:30:17Z","updated_at":"2024-04-10T20:33:16Z","permissions":{"actions":"write","administration":"read","attestations":"write","checks":"write","contents":"write","deployments":"write","discussions":"write","issues":"write","metadata":"read","merge_queues":"write","packages":"write","pages":"write","pull_requests":"write","repository_hooks":"write","repository_projects":"write","security_events":"write","statuses":"write","vulnerability_alerts":"read"},"events":["branch_protection_rule","check_run","check_suite","create","delete","deployment","deployment_status","discussion","discussion_comment","fork","gollum","issues","issue_comment","label","merge_group","milestone","page_build","project","project_card","project_column","public","pull_request","pull_request_review","pull_request_review_comment","push","registry_package","release","repository","repository_dispatch","status","watch","workflow_dispatch","workflow_run"]},"pull_requests":[{"id":2293168667,"number":15,"url":"https://api.github.com/repos/mayocream/vault/pulls/15","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"3fd8a3161435d4705790c743ca6b0d71fe3ffef7","repo":{"id":370211210,"name":"vault","url":"https://api.github.com/repos/mayocream/vault"}}},{"id":2244945995,"number":37,"url":"https://api.github.com/repos/Zezo-Ai/vault/pulls/37","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"f97525926718e9c5d8e06f65eace8db1ed74f04d","repo":{"id":893266971,"name":"vault","url":"https://api.github.com/repos/Zezo-Ai/vault"}}},{"id":2111658258,"number":2,"url":"https://api.github.com/repos/sigtrap/vault/pulls/2","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"6ad78c41029afa4178d2e9df56399ebb9d368b77","repo":{"id":683204772,"name":"vault","url":"https://api.github.com/repos/sigtrap/vault"}}},{"id":1392721573,"number":30,"url":"https://api.github.com/repos/kkpan11/vault/pulls/30","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"89469110784efdb8f9ebc481040e5b779303c04e","repo":{"id":633397509,"name":"vault","url":"https://api.github.com/repos/kkpan11/vault"}}},{"id":1334622221,"number":173,"url":"https://api.github.com/repos/NOUIY/vault/pulls/173","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"21bde241e012028cf9896a3fe4172c23578c4b34","repo":{"id":439348437,"name":"vault","url":"https://api.github.com/repos/NOUIY/vault"}}},{"id":1300925569,"number":1,"url":"https://api.github.com/repos/Bigdawg001/vault/pulls/1","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"a5bba9c7c90d1ae8e3fbb5d6d02043a310519440","repo":{"id":623209292,"name":"vault","url":"https://api.github.com/repos/Bigdawg001/vault"}}},{"id":1262995428,"number":7,"url":"https://api.github.com/repos/ArchiFleKs/vault/pulls/7","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"d2a09ad4536062bd9ecf8569883f0e1de0ff131e","repo":{"id":575331177,"name":"vault","url":"https://api.github.com/repos/ArchiFleKs/vault"}}},{"id":796216871,"number":13,"url":"https://api.github.com/repos/ufo2011/vault/pulls/13","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"1bec99602c311222217c81926640be9154d46b35","repo":{"id":432877981,"name":"vault","url":"https://api.github.com/repos/ufo2011/vault"}}}]},"annotations":[{"path":".github","start_line":45,"end_line":45,"annotation_level":"failure","message":"Process completed with exit code 1.","title":"","raw_details":""},{"path":".github","start_line":45,"end_line":45,"annotation_level":"failure","message":"Process completed with exit code 1.","title":"","raw_details":""}]},{"run":{"id":35689842398,"node_id":"CR_kwDOAd1ufs8AAAAIT0fG3g","head_sha":"f503f739de19944537638129f1cb3492f523f937","external_id":"132652a4-a1fa-5f4f-510c-299967b46f41","url":"https://api.github.com/repos/hashicorp/vault/check-runs/35689842398","html_url":"https://github.com/hashicorp/vault/actions/runs/12800864818/job/35689842398","details_url":"https://github.com/hashicorp/vault/actions/runs/12800864818/job/35689842398","status":"completed","conclusion":"failure","started_at":"2025-01-16T02:42:49Z","completed_at":"2025-01-16T02:43:20Z","output":{"annotations_count":2,"annotations_url":"https://api.github.com/repos/hashicorp/vault/check-runs/35689842398/annotations"},"name":"completed-successfully","check_suite":{"id":33120756055},"app":{"id":15368,"slug":"github-actions","node_id":"MDM6QXBwMTUzNjg=","owner":{"login":"github","id":9919,"node_id":"MDEyOk9yZ2FuaXphdGlvbjk5MTk=","avatar_url":"https://avatars.githubusercontent.com/u/9919?v=4","html_url":"https://github.com/github","gravatar_id":"","type":"Organization","site_admin":false,"url":"https://api.github.com/users/github","events_url":"https://api.github.com/users/github/events{/privacy}","following_url":"https://api.github.com/users/github/following{/other_user}","followers_url":"https://api.github.com/users/github/followers","gists_url":"https://api.github.com/users/github/gists{/gist_id}","organizations_url":"https://api.github.com/users/github/orgs","received_events_url":"https://api.github.com/users/github/received_events","repos_url":"https://api.github.com/users/github/repos","starred_url":"https://api.github.com/users/github/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/github/subscriptions"},"name":"GitHub Actions","description":"Automate your workflow from idea to production","external_url":"https://help.github.com/en/actions","html_url":"https://github.com/apps/github-actions","created_at":"2018-07-30T09:30:17Z","updated_at":"2024-04-10T20:33:16Z","permissions":{"actions":"write","administration":"read","attestations":"write","checks":"write","contents":"write","deployments":"write","discussions":"write","issues":"write","metadata":"read","merge_queues":"write","packages":"write","pages":"write","pull_requests":"write","repository_hooks":"write","repository_projects":"write","security_events":"write","statuses":"write","vulnerability_alerts":"read"},"events":["branch_protection_rule","check_run","check_suite","create","delete","deployment","deployment_status","discussion","discussion_comment","fork","gollum","issues","issue_comment","label","merge_group","milestone","page_build","project","project_card","project_column","public","pull_request","pull_request_review","pull_request_review_comment","push","registry_package","release","repository","repository_dispatch","status","watch","workflow_dispatch","workflow_run"]},"pull_requests":[{"id":2293168667,"number":15,"url":"https://api.github.com/repos/mayocream/vault/pulls/15","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"3fd8a3161435d4705790c743ca6b0d71fe3ffef7","repo":{"id":370211210,"name":"vault","url":"https://api.github.com/repos/mayocream/vault"}}},{"id":2244945995,"number":37,"url":"https://api.github.com/repos/Zezo-Ai/vault/pulls/37","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"f97525926718e9c5d8e06f65eace8db1ed74f04d","repo":{"id":893266971,"name":"vault","url":"https://api.github.com/repos/Zezo-Ai/vault"}}},{"id":2111658258,"number":2,"url":"https://api.github.com/repos/sigtrap/vault/pulls/2","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"6ad78c41029afa4178d2e9df56399ebb9d368b77","repo":{"id":683204772,"name":"vault","url":"https://api.github.com/repos/sigtrap/vault"}}},{"id":1392721573,"number":30,"url":"https://api.github.com/repos/kkpan11/vault/pulls/30","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"89469110784efdb8f9ebc481040e5b779303c04e","repo":{"id":633397509,"name":"vault","url":"https://api.github.com/repos/kkpan11/vault"}}},{"id":1334622221,"number":173,"url":"https://api.github.com/repos/NOUIY/vault/pulls/173","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"21bde241e012028cf9896a3fe4172c23578c4b34","repo":{"id":439348437,"name":"vault","url":"https://api.github.com/repos/NOUIY/vault"}}},{"id":1300925569,"number":1,"url":"https://api.github.com/repos/Bigdawg001/vault/pulls/1","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"a5bba9c7c90d1ae8e3fbb5d6d02043a310519440","repo":{"id":623209292,"name":"vault","url":"https://api.github.com/repos/Bigdawg001/vault"}}},{"id":1262995428,"number":7,"url":"https://api.github.com/repos/ArchiFleKs/vault/pulls/7","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"d2a09ad4536062bd9ecf8569883f0e1de0ff131e","repo":{"id":575331177,"name":"vault","url":"https://api.github.com/repos/ArchiFleKs/vault"}}},{"id":796216871,"number":13,"url":"https://api.github.com/repos/ufo2011/vault/pulls/13","head":{"ref":"main","sha":"eef8370118f8d5b13fe59d3b01522e2a65b9a951","repo":{"id":31288958,"name":"vault","url":"https://api.github.com/repos/hashicorp/vault"}},"base":{"ref":"main","sha":"1bec99602c311222217c81926640be9154d46b35","repo":{"id":432877981,"name":"vault","url":"https://api.github.com/repos/ufo2011/vault"}}}]},"annotations":[{"path":".github","start_line":1,"end_line":1,"annotation_level":"warning","message":"ubuntu-latest pipelines will use ubuntu-24.04 soon. For more details, see https://github.com/actions/runner-images/issues/10636","title":"","raw_details":""},{"path":".github","start_line":9,"end_line":9,"annotation_level":"failure","message":"Process completed with exit code 1.","title":"","raw_details":""}]}],"summary":"\nbuild (ID: 12800864818)\n  PR: \u001b[1;39mbuild\u001b[0m\n  URL: https://github.com/hashicorp/vault/actions/runs/12800864818\n  HEAD Branch: main\n  HEAD SHA: f503f739de19944537638129f1cb3492f523f937\n  Author: Mike Palmiotto\n  Actor: ryancragun\n  Attempt: 1\n  \u001b[1;39mAnnotations\u001b[0m\n    \u001b[1;31;49mfailure\u001b[0m \u001b[1;39m\u001b[0m\n      \u001b[1;39mProcess completed with exit code 1.\u001b[0m\n    \u001b[1;31;49mfailure\u001b[0m \u001b[1;39m\u001b[0m\n      \u001b[1;39mProcess completed with exit code 1.\u001b[0m\n    \u001b[1;33;49mwarning\u001b[0m \u001b[1;39m\u001b[0m\n      \u001b[1;39mubuntu-latest pipelines will use ubuntu-24.04 soon. For more details, see https://github.com/actions/runner-images/issues/10636\u001b[0m\n    \u001b[1;31;49mfailure\u001b[0m \u001b[1;39m\u001b[0m\n      \u001b[1;39mProcess completed with exit code 1.\u001b[0m\n  Status: \u001b[1;32;49mcompleted\u001b[0m  \n  Conclusion: \u001b[1;31;49mfailure\u001b[0m  \n    Job: \u001b[1;39mtest vault_default_linux_arm64_1.19.0-beta1_f503f739de19944537638129f1cb3492f523f937.docker.tar / run k8s edition:ce repo:ecr\u001b[0m\n      URL: https://github.com/hashicorp/vault/actions/runs/12800864818/job/35689604952\n      Status: completed\n      Conclusion: failure\n      CreatedAt: 2025-01-16 02:34:56 +0000 UTC\n      StartedAt: 2025-01-16 02:35:03 +0000 UTC\n      CompletedAt: 2025-01-16 02:35:28 +0000 UTC\n      \u001b[1;39mUnsuccessful Steps:\u001b[0m\n        Step: \u001b[1;39mRetry Enos scenario\u001b[0m\n          Status: \u001b[1;32;49mcompleted\u001b[0m  \n          Conclusion: \u001b[1;31;49mfailure\u001b[0m  \n      \u001b[1;39mUnsuccessful Step Log Summaries:\u001b[0m\n        Step: \u001b[1;39mRun mkdir -p ./enos/support/terraform-plugin-cache\u001b[0m\n          2025-01-16T02:35:19.6621139Z \u001b[36;1mmkdir -p ./enos/support/terraform-plugin-cache\u001b[0m\n          2025-01-16T02:35:19.6621525Z \u001b[36;1menos scenario run --timeout 10m0s --chdir ./enos/k8s k8s edition:ce repo:ecr\u001b[0m\n          2025-01-16T02:35:19.6646823Z shell: /usr/bin/bash -e {0}\n          2025-01-16T02:35:19.6647026Z env:\n          2025-01-16T02:35:19.6647412Z   GITHUB_TOKEN: ***\n          2025-01-16T02:35:19.6647682Z   ENOS_VAR_terraform_plugin_cache_dir: ../support/terraform-plugin-cache\n          2025-01-16T02:35:19.6648017Z   ENOS_VAR_vault_build_date: 2025-01-15T14:24:49Z\n          2025-01-16T02:35:19.6648258Z   ENOS_VAR_vault_version: 1.19.0-beta1\n          2025-01-16T02:35:19.6648530Z   ENOS_VAR_vault_revision: f503f739de19944537638129f1cb3492f523f937\n          2025-01-16T02:35:19.6649418Z   ENOS_VAR_container_image_archive: /home/runner/work/vault/vault/enos/support/downloads/vault_default_linux_arm64_1.19.0-beta1_f503f739de19944537638129f1cb3492f523f937.docker.tar\n          2025-01-16T02:35:19.6845635Z k8s [edition:ce repo:ecr] generate: running\n          2025-01-16T02:35:19.6885946Z k8s [edition:ce repo:ecr] init: running\n          2025-01-16T02:35:22.8555843Z k8s [edition:ce repo:ecr] validate: running\n          2025-01-16T02:35:23.1961688Z k8s [edition:ce repo:ecr] plan: running\n          2025-01-16T02:35:23.6217825Z Scenario: k8s [edition:ce repo:ecr] failed!\n          2025-01-16T02:35:23.6218099Z   Init: success!\n          2025-01-16T02:35:23.6218263Z   Validate: success!\n          2025-01-16T02:35:23.6218653Z Enos operations failed!\n          2025-01-16T02:35:23.6228523Z   Plan: failed!\n          2025-01-16T02:35:23.6229147Z Error: could not create OCI registry client: /home/runneradmin/.config/helm/registry/config.json: stat /home/runneradmin/.config/helm/registry/config.json: permission denied\n          2025-01-16T02:35:23.6229847Z   with module.deploy_vault.helm_release.vault,\n          2025-01-16T02:35:23.6230316Z   on ../../../modules/k8s_deploy_vault/main.tf line 47, in resource \"helm_release\" \"vault\":\n          2025-01-16T02:35:23.6230669Z   47: resource \"helm_release\" \"vault\" {\n          2025-01-16T02:35:23.6231331Z \u001b[31m╷\u001b[0m\n          2025-01-16T02:35:23.6231574Z \u001b[31m│\u001b[0m \u001b[1m\u001b[31mError: \u001b[0m\u001b[1mexit status 1\n          2025-01-16T02:35:23.6231819Z \u001b[31m│\u001b[0m\n          2025-01-16T02:35:23.6232497Z \u001b[31m│\u001b[0m Error: could not create OCI registry client: /home/runneradmin/.config/helm/registry/config.json: stat /home/runneradmin/.config/helm/registry/config.json: permission denied\n          2025-01-16T02:35:23.6233135Z \u001b[31m│\u001b[0m\n          2025-01-16T02:35:23.6233368Z \u001b[31m│\u001b[0m   with module.deploy_vault.helm_release.vault,\n          2025-01-16T02:35:23.6233834Z \u001b[31m│\u001b[0m   on ../../../modules/k8s_deploy_vault/main.tf line 47, in resource \"helm_release\" \"vault\":\n          2025-01-16T02:35:23.6234243Z \u001b[31m│\u001b[0m   47: resource \"helm_release\" \"vault\" {\n          2025-01-16T02:35:23.6234497Z \u001b[31m│\u001b[0m\n          2025-01-16T02:35:23.6234676Z \u001b[31m│\u001b[0m \u001b[0m\n          2025-01-16T02:35:23.6235058Z \u001b[31m│\u001b[0m\n          2025-01-16T02:35:23.6235271Z \u001b[31m│\u001b[0m   (source code not available)\n          2025-01-16T02:35:23.6235496Z \u001b[31m╵\u001b[0m\n          \u001b[1;31m2025-01-16T02:35:23.6249085Z Process completed with exit code 1.\u001b[0m\n        Step: \u001b[1;39mRun enos scenario run --timeout 10m0s --chdir ./enos/k8s k8s edition:ce repo:ecr\u001b[0m\n          2025-01-16T02:35:23.6298049Z \u001b[36;1menos scenario run --timeout 10m0s --chdir ./enos/k8s k8s edition:ce repo:ecr\u001b[0m\n          2025-01-16T02:35:23.6319842Z shell: /usr/bin/bash -e {0}\n          2025-01-16T02:35:23.6320042Z env:\n          2025-01-16T02:35:23.6320427Z   GITHUB_TOKEN: ***\n          2025-01-16T02:35:23.6320690Z   ENOS_VAR_terraform_plugin_cache_dir: ../support/terraform-plugin-cache\n          2025-01-16T02:35:23.6321022Z   ENOS_VAR_vault_build_date: 2025-01-15T14:24:49Z\n          2025-01-16T02:35:23.6321265Z   ENOS_VAR_vault_version: 1.19.0-beta1\n          2025-01-16T02:35:23.6321536Z   ENOS_VAR_vault_revision: f503f739de19944537638129f1cb3492f523f937\n          2025-01-16T02:35:23.6322266Z   ENOS_VAR_container_image_archive: /home/runner/work/vault/vault/enos/support/downloads/vault_default_linux_arm64_1.19.0-beta1_f503f739de19944537638129f1cb3492f523f937.docker.tar\n          2025-01-16T02:35:23.6492468Z k8s [edition:ce repo:ecr] generate: running\n          2025-01-16T02:35:23.6529729Z k8s [edition:ce repo:ecr] init: running\n          2025-01-16T02:35:23.9560747Z k8s [edition:ce repo:ecr] init: success!\n          2025-01-16T02:35:23.9561034Z k8s [edition:ce repo:ecr] validate: running\n          2025-01-16T02:35:24.2985563Z k8s [edition:ce repo:ecr] plan: running\n          2025-01-16T02:35:24.7278732Z Scenario: k8s [edition:ce repo:ecr] failed!\n          2025-01-16T02:35:24.7279029Z Enos operations failed!\n          2025-01-16T02:35:24.7279213Z   Plan: failed!\n          2025-01-16T02:35:24.7279801Z Error: could not create OCI registry client: /home/runneradmin/.config/helm/registry/config.json: stat /home/runneradmin/.config/helm/registry/config.json: permission denied\n          2025-01-16T02:35:24.7280948Z   with module.deploy_vault.helm_release.vault,\n          2025-01-16T02:35:24.7281307Z   on ../../../modules/k8s_deploy_vault/main.tf line 47, in resource \"helm_release\" \"vault\":\n          2025-01-16T02:35:24.7281670Z   47: resource \"helm_release\" \"vault\" {\n          2025-01-16T02:35:24.7282153Z \u001b[31m╷\u001b[0m\n          2025-01-16T02:35:24.7282372Z \u001b[31m│\u001b[0m \u001b[1m\u001b[31mError: \u001b[0m\u001b[1mexit status 1\n          2025-01-16T02:35:24.7282613Z \u001b[31m│\u001b[0m\n          2025-01-16T02:35:24.7283292Z \u001b[31m│\u001b[0m Error: could not create OCI registry client: /home/runneradmin/.config/helm/registry/config.json: stat /home/runneradmin/.config/helm/registry/config.json: permission denied\n          2025-01-16T02:35:24.7283938Z \u001b[31m│\u001b[0m\n          2025-01-16T02:35:24.7284167Z \u001b[31m│\u001b[0m   with module.deploy_vault.helm_release.vault,\n          2025-01-16T02:35:24.7284644Z \u001b[31m│\u001b[0m   on ../../../modules/k8s_deploy_vault/main.tf line 47, in resource \"helm_release\" \"vault\":\n          2025-01-16T02:35:24.7285072Z \u001b[31m│\u001b[0m   47: resource \"helm_release\" \"vault\" {\n          2025-01-16T02:35:24.7285316Z \u001b[31m│\u001b[0m\n          2025-01-16T02:35:24.7285471Z \u001b[31m│\u001b[0m \u001b[0m\n          2025-01-16T02:35:24.7285635Z \u001b[31m│\u001b[0m\n          2025-01-16T02:35:24.7285823Z \u001b[31m│\u001b[0m   (source code not available)\n          2025-01-16T02:35:24.7286065Z \u001b[31m╵\u001b[0m\n          2025-01-16T02:35:24.7286215Z   Init: success!\n          2025-01-16T02:35:24.7286377Z   Validate: success!\n          \u001b[1;31m2025-01-16T02:35:24.7296602Z Process completed with exit code 1.\u001b[0m\n    Job: \u001b[1;39mcompleted-successfully\u001b[0m\n      URL: https://github.com/hashicorp/vault/actions/runs/12800864818/job/35689842398\n      Status: completed\n      Conclusion: failure\n      CreatedAt: 2025-01-16 02:42:41 +0000 UTC\n      StartedAt: 2025-01-16 02:42:49 +0000 UTC\n      CompletedAt: 2025-01-16 02:43:20 +0000 UTC\n      \u001b[1;39mUnsuccessful Steps:\u001b[0m\n        Step: \u001b[1;39mCheck for failed status\u001b[0m\n          Status: \u001b[1;32;49mcompleted\u001b[0m  \n          Conclusion: \u001b[1;31;49mfailure\u001b[0m  \n      \u001b[1;39mUnsuccessful Step Log Summaries:\u001b[0m\n        Step: \u001b[1;39mRun echo \"One or more required build workflows failed: [  \"success\",  \"success\",  \"success\",  \"success\",  \"failure\"]\"\u001b[0m\n          2025-01-16T02:43:16.9428790Z \u001b[36;1mecho \"One or more required build workflows failed: [  \"success\",  \"success\",  \"success\",  \"success\",  \"failure\"]\"\u001b[0m\n          2025-01-16T02:43:16.9429261Z \u001b[36;1mexit 1\u001b[0m\n          2025-01-16T02:43:16.9455103Z shell: /usr/bin/bash -e {0}\n          2025-01-16T02:43:16.9455325Z env:\n          2025-01-16T02:43:16.9455496Z   filepath: metadata.json\n          2025-01-16T02:43:16.9501359Z One or more required build workflows failed: [  success,  success,  success,  success,  failure]\n          \u001b[1;31m2025-01-16T02:43:16.9514883Z Process completed with exit code 1.\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:16.9578931Z Post job cleanup.\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0504390Z [command]/usr/bin/git version\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0539340Z git version 2.47.1\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0580761Z Temporarily overriding HOME='/home/runner/work/_temp/db1f5a2a-ff30-461a-9131-ee0524b306f9' before making global git config changes\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0581811Z Adding repository directory to the temporary git global config as a safe directory\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0585969Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/vault/vault\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0620731Z [command]/usr/bin/git config --local --name-only --get-regexp core\\.sshCommand\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0652221Z [command]/usr/bin/git submodule foreach --recursive sh -c \"git config --local --name-only --get-regexp 'core\\.sshCommand' \u0026\u0026 git config --local --unset-all 'core.sshCommand' || :\"\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0893436Z [command]/usr/bin/git config --local --name-only --get-regexp http\\.https\\:\\/\\/github\\.com\\/\\.extraheader\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0913170Z http.https://github.com/.extraheader\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0925277Z [command]/usr/bin/git config --local --unset-all http.https://github.com/.extraheader\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.0954882Z [command]/usr/bin/git submodule foreach --recursive sh -c \"git config --local --name-only --get-regexp 'http\\.https\\:\\/\\/github\\.com\\/\\.extraheader' \u0026\u0026 git config --local --unset-all 'http.https://github.com/.extraheader' || :\"\u001b[0m\n          \u001b[1;31m2025-01-16T02:43:17.1285786Z Cleaning up orphan processes\u001b[0m"}]}
diff --git a/tools/pipeline/internal/pkg/github/workflow_run_summary.go b/tools/pipeline/internal/pkg/github/workflow_run_summary.go
new file mode 100644
index 00000000000..99528332a95
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/workflow_run_summary.go
@@ -0,0 +1,123 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"bytes"
+	"errors"
+	"slices"
+	"strings"
+	"text/template"
+)
+
+// workflowRunTemplate is our template for rendering workflow runs in human
+// readable text.
+var workflowRunTemplate = template.Must(template.New("workflow-run-text.tmpl").Funcs(template.FuncMap{
+	"boldify":              boldify,
+	"format_log_lines":     formatLogLines,
+	"intensify_status":     intensifyStatus,
+	"intensify_annotation": intensifyAnnotationLevel,
+	"redify":               redify,
+	"splitlines":           splitLines,
+}).ParseFS(templates, "templates/workflow-run-text.tmpl"))
+
+func summarizeWorkflowRun(r *WorkflowRun) (string, error) {
+	if r == nil {
+		return "", errors.New("uninitialized workflow run")
+	}
+
+	if r.summary != "" {
+		return r.summary, nil
+	}
+
+	b := &bytes.Buffer{}
+	err := workflowRunTemplate.Execute(b, r)
+	if err != nil {
+		return "", err
+	}
+	r.summary = b.String()
+
+	return r.summary, nil
+}
+
+func formatLogLines(log []byte) []string {
+	if len(log) == 0 {
+		return nil
+	}
+
+	lines := []string{}
+	lastLine := ""
+	for _, line := range strings.Split(string(log), "\n") {
+		// Strip out duplicate lines and blank lines so the summaries
+		// are more clear. Log lines include timestamps with microseconds
+		// so we compare for duplicates by comparing line values without
+		// the timestamp.
+		newLineNoTimestamp := ""
+		newLineParts := strings.SplitN(line, " ", 2)
+		if len(newLineParts) < 2 {
+			// blank lines may only have a timestamp
+			continue
+		}
+		newLineNoTimestamp = newLineParts[1]
+		if strings.TrimSpace(newLineNoTimestamp) == "" {
+			// Don't write otherwise blank lines
+			continue
+		}
+		if lastLine == newLineNoTimestamp {
+			continue
+		}
+
+		lines = append(lines, line)
+		lastLine = newLineNoTimestamp
+	}
+
+	return lines
+}
+
+func intensifyStatus(in string) string {
+	switch in {
+	case "completed", "success":
+		return "\x1b[1;32;49m" + in + "\x1b[0m"
+	case "cancelled":
+		return "\x1b[1;33;49m" + in + "\x1b[0m"
+	case "failure":
+		return "\x1b[1;31;49m" + in + "\x1b[0m"
+	case "skipped":
+		return "\x1b[1;37;49m" + in + "\x1b[0m"
+	case "in_progress":
+		return "\x1b[1;37;49m" + in + "\x1b[0m"
+	case "warning":
+		return "\x1b[1;33;49m" + in + "\x1b[0m"
+	default:
+		return in
+	}
+}
+
+func intensifyAnnotationLevel(in string) string {
+	switch in {
+	case "failure":
+		return "\x1b[1;31;49m" + in + "\x1b[0m"
+	case "warning":
+		return "\x1b[1;33;49m" + in + "\x1b[0m"
+	default:
+		return in
+	}
+}
+
+func boldify(in string) string {
+	return "\x1b[1;39m" + in + "\x1b[0m"
+}
+
+func redify(in string) string {
+	return "\x1b[1;31m" + in + "\x1b[0m"
+}
+
+func splitLines(in string) []string {
+	return slices.DeleteFunc(strings.Split(in, "\n"), func(s string) bool {
+		if s == "\n" || s == "" {
+			return true
+		}
+		return false
+	})
+}
diff --git a/tools/pipeline/internal/pkg/github/workflows.go b/tools/pipeline/internal/pkg/github/workflows.go
new file mode 100644
index 00000000000..20cde452cea
--- /dev/null
+++ b/tools/pipeline/internal/pkg/github/workflows.go
@@ -0,0 +1,163 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package github
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+
+	gh "github.com/google/go-github/v74/github"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// getWorkflow attempts to locate the workflow associated with our workflow name.
+func getWorkflow(
+	ctx context.Context,
+	client *gh.Client,
+	owner string,
+	repo string,
+	name string,
+) (*gh.Workflow, error) {
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.String("name", name),
+	), "getting github actions workflow")
+
+	opts := &gh.ListOptions{PerPage: PerPageMax}
+	for {
+		wfs, res, err := client.Actions.ListWorkflows(ctx, owner, repo, opts)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, wf := range wfs.Workflows {
+			if wf.GetName() == name {
+				return wf, nil
+			}
+		}
+
+		if res.NextPage == 0 {
+			return nil, fmt.Errorf("no workflow matching %s could be found", name)
+		}
+
+		opts.Page = res.NextPage
+	}
+}
+
+// getWorkflowRuns gets the workflow runs associated with a workflow ID.
+func getWorkflowRuns(
+	ctx context.Context,
+	client *gh.Client,
+	owner string,
+	repo string,
+	id int64,
+	opts *gh.ListWorkflowRunsOptions,
+) ([]*WorkflowRun, error) {
+	var runs []*WorkflowRun
+	opts.ListOptions = gh.ListOptions{PerPage: PerPageMax}
+
+	// By default our status will be "success" which elimates in_progress runs.
+	// Instead, we'll try both so that we're sure to include what's actually
+	// running along with historical runs.
+	for _, status := range []string{"", "success", "in_progress"} {
+		var runsForStatus []*WorkflowRun
+		for {
+			opts.Status = status
+			slog.Default().DebugContext(slogctx.Append(ctx,
+				slog.String("owner", owner),
+				slog.String("repo", repo),
+				slog.Int64("workflow-id", id),
+				slog.String("query-status", opts.Status),
+			), "getting github actions workflow runs")
+
+			wfrs, res, err := client.Actions.ListWorkflowRunsByID(ctx, owner, repo, id, opts)
+			if err != nil {
+				return nil, err
+			}
+
+			for _, r := range wfrs.WorkflowRuns {
+				runsForStatus = append(runsForStatus, &WorkflowRun{Run: r})
+			}
+
+			if res.NextPage == 0 {
+				if len(runsForStatus) > 0 {
+					slog.Default().DebugContext(slogctx.Append(ctx,
+						slog.String("owner", owner),
+						slog.String("repo", repo),
+						slog.Int64("workflow-id", id),
+						slog.String("query-status", opts.Status),
+						slog.Int("count", len(runsForStatus)),
+					), "found github actions workflow runs")
+				} else {
+					slog.Default().DebugContext(slogctx.Append(ctx,
+						slog.String("owner", owner),
+						slog.String("repo", repo),
+						slog.Int64("workflow-id", id),
+						slog.String("query-status", opts.Status),
+					), "no github actions workflow runs found for status")
+				}
+				runs = append(runs, runsForStatus...)
+				break
+			}
+
+			opts.ListOptions.Page = res.NextPage
+		}
+	}
+
+	return runs, nil
+}
+
+// getWorkflowRunArtifacts gets the artifacts associated with a workflow run
+func getWorkflowRunArtifacts(
+	ctx context.Context,
+	client *gh.Client,
+	owner string,
+	repo string,
+	id int64,
+) (gh.ArtifactList, error) {
+	slog.Default().DebugContext(slogctx.Append(ctx,
+		slog.String("owner", owner),
+		slog.String("repo", repo),
+		slog.Int64("run-id", id),
+	), "getting github actions workflow run artifacts")
+
+	opts := &gh.ListOptions{PerPage: PerPageMax}
+	artifacts := gh.ArtifactList{}
+
+	defer func() {
+		if count := artifacts.GetTotalCount(); count > 0 {
+			slog.Default().DebugContext(slogctx.Append(ctx,
+				slog.String("owner", owner),
+				slog.String("repo", repo),
+				slog.Int64("run-id", id),
+				slog.Int64("count", count),
+			), "found workflow run artifacts")
+		} else {
+			slog.Default().DebugContext(slogctx.Append(ctx,
+				slog.String("owner", owner),
+				slog.String("repo", repo),
+				slog.Int64("run-id", id),
+			), "no workflow run artifacts found")
+		}
+	}()
+
+	for {
+		arts, res, err := client.Actions.ListWorkflowRunArtifacts(ctx, owner, repo, id, opts)
+		if err != nil {
+			return artifacts, err
+		}
+
+		newTotal := artifacts.GetTotalCount() + arts.GetTotalCount()
+		artifacts.TotalCount = &newTotal
+		artifacts.Artifacts = append(artifacts.Artifacts, arts.Artifacts...)
+
+		if res.NextPage == 0 {
+			return artifacts, nil
+		}
+
+		opts.Page = res.NextPage
+	}
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_exclude.go b/tools/pipeline/internal/pkg/golang/diff_exclude.go
new file mode 100644
index 00000000000..fa04c0db10c
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_exclude.go
@@ -0,0 +1,102 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"maps"
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+// diffExclude compares the exclude directives in two module files and returns
+// a slice of *Diff's. When strict parsing is set to true, exclude directives
+// that are ommitted from one or the other modfile will also be included.
+func diffExclude(a *modfile.File, b *modfile.File, strictDiff bool) []*Diff {
+	if (a == nil && b == nil) || (len(a.Exclude) == 0 && len(b.Exclude) == 0) {
+		return nil
+	}
+
+	var diffs []*Diff
+	if strictDiff {
+		diffs = append(diffExcludeFindMissing(a, b), diffExcludeFindMissing(b, a)...)
+	}
+	versionDiffsA := diffExcludeFindDifferent(a, b)
+	versionDiffsB := diffExcludeFindDifferent(b, a)
+	maps.Copy(versionDiffsB, versionDiffsA)
+
+	return slices.DeleteFunc(
+		append(diffs, slices.Collect(maps.Values(versionDiffsB))...),
+		func(d *Diff) bool { return d == nil },
+	)
+}
+
+func diffExcludeFindMissing(a, b *modfile.File) []*Diff {
+	diffs := []*Diff{}
+	for _, needle := range a.Exclude {
+		if needle == nil {
+			continue
+		}
+
+		// See if there's a matching require
+		idx := slices.IndexFunc(b.Exclude, func(hay *modfile.Exclude) bool {
+			if hay == nil {
+				return false
+			}
+
+			return needle.Mod.Path == hay.Mod.Path
+		})
+
+		if idx >= 0 {
+			// We have a matching require
+			continue
+		}
+
+		diff := newDiffFromModFiles(a, b, DirectiveExclude)
+		if needle.Syntax != nil {
+			diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ")}
+		}
+		diffs = append(diffs, diff)
+	}
+
+	return diffs
+}
+
+func diffExcludeFindDifferent(a, b *modfile.File) map[string]*Diff {
+	diffs := map[string]*Diff{}
+	for _, needle := range a.Exclude {
+		if needle == nil {
+			continue
+		}
+
+		// See if there's a matching require
+		idx := slices.IndexFunc(b.Exclude, func(hay *modfile.Exclude) bool {
+			if hay == nil {
+				return false
+			}
+
+			return needle.Mod.Path == hay.Mod.Path
+		})
+
+		if idx < 0 {
+			// We don't have a matching require
+			continue
+		}
+
+		hay := b.Exclude[idx]
+		if needle.Mod.Version != hay.Mod.Version {
+			diff := newDiffFromModFiles(a, b, DirectiveExclude)
+			if needle.Syntax != nil {
+				diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ") + "\n"}
+			}
+			if hay.Syntax != nil {
+				diff.Diff.B = []string{strings.Join(hay.Syntax.Token, " ")}
+			}
+			diffs[needle.Mod.Path] = diff
+		}
+	}
+
+	return diffs
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_go.go b/tools/pipeline/internal/pkg/golang/diff_go.go
new file mode 100644
index 00000000000..06e99dd481c
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_go.go
@@ -0,0 +1,31 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+// diffGo compares the go directives in two modules files and returns
+// a slice of *Diff's.
+func diffGo(a *modfile.File, b *modfile.File) *Diff {
+	if (a == nil && b == nil) ||
+		(a.Go == nil && b.Go == nil) ||
+		((a.Go != nil && b.Go != nil) && (a.Go.Version == b.Go.Version)) {
+
+		return nil
+	}
+
+	diff := newDiffFromModFiles(a, b, DirectiveGo)
+	if a != nil && a.Go != nil && a.Go.Syntax != nil {
+		diff.Diff.A = []string{strings.Join(a.Go.Syntax.Token, " ") + "\n"}
+	}
+	if b != nil && b.Go != nil && b.Go.Syntax != nil {
+		diff.Diff.B = []string{strings.Join(b.Go.Syntax.Token, " ")}
+	}
+
+	return diff
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_godebug.go b/tools/pipeline/internal/pkg/golang/diff_godebug.go
new file mode 100644
index 00000000000..88cdb7b39f1
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_godebug.go
@@ -0,0 +1,92 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+// diffGodebug compares the godebug directives in two modules files and returns
+// a slice of *Diff's. When strict parsing is set to true, godebug directives
+// that are ommitted from one or the other modfile will also be included.
+func diffGodebug(a *modfile.File, b *modfile.File) []*Diff {
+	if (a == nil && b == nil) || (len(a.Godebug) == 0 && len(b.Godebug) == 0) {
+		return nil
+	}
+
+	return slices.DeleteFunc(
+		append(diffGodebugFindDiffs(a, b), diffGodebugFindDiffs(b, a)...),
+		func(d *Diff) bool { return d == nil },
+	)
+}
+
+func diffGodebugFindDiffs(a, b *modfile.File) []*Diff {
+	diffs := []*Diff{}
+	for _, needle := range a.Godebug {
+		idx := slices.IndexFunc(b.Godebug, func(hay *modfile.Godebug) bool {
+			return godebugMatchingKey(needle, hay)
+		})
+
+		if idx < 0 {
+			// We don't have matching godebug with the same key, create a single
+			// sided diff
+			diff := newDiffFromModFiles(a, b, DirectiveGodebug)
+			if needle != nil && needle.Syntax != nil {
+				diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ")}
+			}
+			diffs = append(diffs, diff)
+			continue
+		}
+
+		// We have a matching key
+		hay := b.Godebug[idx]
+		if godebugEqual(needle, hay) {
+			continue
+		}
+
+		// We have differing values. Create a double sided diff
+		diff := newDiffFromModFiles(a, b, DirectiveGodebug)
+		if needle != nil && needle.Syntax != nil {
+			diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ") + "\n"}
+		}
+		if hay != nil && hay.Syntax != nil {
+			diff.Diff.B = []string{strings.Join(hay.Syntax.Token, " ")}
+		}
+
+		diffs = append(diffs, diff)
+	}
+
+	return diffs
+}
+
+func godebugEqual(a *modfile.Godebug, b *modfile.Godebug) bool {
+	if a == nil && b == nil {
+		return true
+	}
+
+	if (a == nil && b != nil) || (a != nil && b == nil) {
+		return false
+	}
+
+	if a.Key != b.Key {
+		return false
+	}
+
+	return a.Value == b.Value
+}
+
+func godebugMatchingKey(a *modfile.Godebug, b *modfile.Godebug) bool {
+	if a == nil && b == nil {
+		return false
+	}
+
+	if (a == nil && b != nil) || (a != nil && b == nil) {
+		return false
+	}
+
+	return a.Key == b.Key
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_ignore.go b/tools/pipeline/internal/pkg/golang/diff_ignore.go
new file mode 100644
index 00000000000..10e9884d88e
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_ignore.go
@@ -0,0 +1,56 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+// diffIgnore compares the ignore directives in two module files and returns
+// a slice of *Diff's. When strict parsing is set to true, ignore directives
+// that are ommitted from one or the other modfile will also be included.
+func diffIgnore(a *modfile.File, b *modfile.File) []*Diff {
+	if (a == nil && b == nil) || (len(a.Ignore) == 0 && len(b.Ignore) == 0) {
+		return nil
+	}
+
+	return slices.DeleteFunc(
+		append(diffIgnoreFindDiffs(a, b), diffIgnoreFindDiffs(b, a)...),
+		func(d *Diff) bool { return d == nil },
+	)
+}
+
+func diffIgnoreFindDiffs(a, b *modfile.File) []*Diff {
+	diffs := []*Diff{}
+	for _, needle := range a.Ignore {
+		if needle == nil {
+			continue
+		}
+
+		// See if there's a matching ignore
+		idx := slices.IndexFunc(b.Ignore, func(hay *modfile.Ignore) bool {
+			if hay == nil {
+				return false
+			}
+
+			return needle.Path == hay.Path
+		})
+
+		if idx >= 0 {
+			// We have a matching ignore
+			continue
+		}
+
+		diff := newDiffFromModFiles(a, b, DirectiveIgnore)
+		if needle.Syntax != nil {
+			diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ")}
+		}
+		diffs = append(diffs, diff)
+	}
+
+	return diffs
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_mod_request.go b/tools/pipeline/internal/pkg/golang/diff_mod_request.go
new file mode 100644
index 00000000000..3f436362b60
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_mod_request.go
@@ -0,0 +1,79 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/jedib0t/go-pretty/v6/table"
+	"github.com/pmezard/go-difflib/difflib"
+)
+
+type DiffModReq struct {
+	A    *ModSource `json:"a,omitempty"`
+	B    *ModSource `json:"b,omitempty"`
+	Opts *DiffOpts  `json:"opts,omitempty"`
+}
+
+func (r *DiffModReq) Run(ctx context.Context) (*DiffModRes, error) {
+	res := &DiffModRes{}
+	var err error
+
+	res.ModDiff, err = DiffModFiles(r.A, r.B, r.Opts)
+
+	return res, err
+}
+
+type DiffModRes struct {
+	ModDiff
+}
+
+func (r *DiffModRes) ToJSON() ([]byte, error) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling latest HCP image response to JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToTable marshals the response to a text table.
+func (r *DiffModRes) ToTable(err error) (table.Writer, error) {
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+
+	if r == nil || r.ModDiff == nil || len(r.ModDiff) == 0 || err != nil {
+		if err != nil {
+			t.AppendHeader(table.Row{"error"})
+			t.AppendRow(table.Row{err.Error()})
+		}
+		return t, err
+	}
+
+	t.AppendHeader(table.Row{"explanation", "diff"})
+	for _, diff := range r.ModDiff {
+		if diff == nil {
+			continue
+		}
+		if diff.Diff == nil {
+			return nil, fmt.Errorf("missing unified diff: %v", diff)
+		}
+
+		diffText, err := difflib.GetUnifiedDiffString(*diff.Diff)
+		if err != nil {
+			return nil, err
+		}
+		t.AppendRow(table.Row{diff.Directive.Explanation(), diffText})
+	}
+	t.SuppressEmptyColumns()
+	t.SuppressTrailingSpaces()
+
+	return t, nil
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_module.go b/tools/pipeline/internal/pkg/golang/diff_module.go
new file mode 100644
index 00000000000..0260134c2ef
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_module.go
@@ -0,0 +1,31 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+// diffModule compares the module directives in two modules files and returns
+// a slice of *Diff's.
+func diffModule(a *modfile.File, b *modfile.File) *Diff {
+	if (a == nil && b == nil) ||
+		(a.Module == nil && b.Module == nil) ||
+		(a.Module.Mod.String() == b.Module.Mod.String()) {
+
+		return nil
+	}
+
+	diff := newDiffFromModFiles(a, b, DirectiveModule)
+	if a != nil && a.Module != nil && a.Module.Syntax != nil {
+		diff.Diff.A = []string{strings.Join(a.Module.Syntax.Token, " ") + "\n"}
+	}
+	if b != nil && b.Module != nil && b.Module.Syntax != nil {
+		diff.Diff.B = []string{strings.Join(b.Module.Syntax.Token, " ")}
+	}
+
+	return diff
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_replace.go b/tools/pipeline/internal/pkg/golang/diff_replace.go
new file mode 100644
index 00000000000..046d23caa9a
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_replace.go
@@ -0,0 +1,125 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"maps"
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+func diffReplace(a *modfile.File, b *modfile.File, strictDiff bool) []*Diff {
+	if (a == nil && b == nil) || (len(a.Replace) == 0 && len(b.Replace) == 0) {
+		return nil
+	}
+
+	var diffs []*Diff
+	if strictDiff {
+		diffs = append(diffReplaceFindMissing(a, b), diffReplaceFindMissing(b, a)...)
+	}
+	versionDiffsA := diffReplaceFindDifferent(a, b)
+	versionDiffsB := diffReplaceFindDifferent(b, a)
+	maps.Copy(versionDiffsB, versionDiffsA)
+
+	return slices.DeleteFunc(
+		append(diffs, slices.Collect(maps.Values(versionDiffsB))...),
+		func(d *Diff) bool { return d == nil },
+	)
+}
+
+func diffReplaceFindMissing(a, b *modfile.File) []*Diff {
+	diffs := []*Diff{}
+	for _, needle := range a.Replace {
+		if needle == nil {
+			continue
+		}
+
+		// See if there's a matching old exclude
+		idx := slices.IndexFunc(b.Replace, func(hay *modfile.Replace) bool {
+			if hay == nil {
+				return false
+			}
+
+			return needle.Old.Path == hay.Old.Path
+		})
+
+		if idx >= 0 {
+			// We have a matching old exclude, we'll handle this in the version diff check
+			continue
+		}
+
+		diff := newDiffFromModFiles(a, b, DirectiveReplace)
+		if needle.Syntax != nil {
+			diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ")}
+		}
+		diffs = append(diffs, diff)
+	}
+
+	return diffs
+}
+
+func diffReplaceFindDifferent(a, b *modfile.File) map[string]*Diff {
+	diffs := map[string]*Diff{}
+	for _, needle := range a.Replace {
+		if needle == nil {
+			continue
+		}
+
+		// See if there's a matching exclude
+		idx := slices.IndexFunc(b.Replace, func(hay *modfile.Replace) bool {
+			if hay == nil {
+				return false
+			}
+
+			return needle.Old.Path == hay.Old.Path
+		})
+
+		if idx < 0 {
+			// We don't have a matching exclude
+			continue
+		}
+
+		hay := b.Replace[idx]
+		if replaceEqual(needle, hay) {
+			continue
+		}
+
+		diff := newDiffFromModFiles(a, b, DirectiveReplace)
+		if needle.Syntax != nil {
+			diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ") + "\n"}
+		}
+		if hay.Syntax != nil {
+			diff.Diff.B = []string{strings.Join(hay.Syntax.Token, " ")}
+		}
+		diffs[needle.Old.Path] = diff
+	}
+
+	return diffs
+}
+
+func replaceEqual(a *modfile.Replace, b *modfile.Replace) bool {
+	if a == nil && b == nil {
+		return true
+	}
+
+	if (a == nil && b != nil) || (a != nil && b == nil) {
+		return false
+	}
+
+	if a.Old.Path != b.Old.Path {
+		return false
+	}
+
+	if a.Old.Version != b.Old.Version {
+		return false
+	}
+
+	if a.New.Path != b.New.Path {
+		return false
+	}
+
+	return a.New.Version == b.New.Version
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_require.go b/tools/pipeline/internal/pkg/golang/diff_require.go
new file mode 100644
index 00000000000..9767317f0b5
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_require.go
@@ -0,0 +1,99 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"maps"
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+func diffRequire(a *modfile.File, b *modfile.File, strictDiff bool) []*Diff {
+	if (a == nil && b == nil) || (len(a.Require) == 0 && len(b.Require) == 0) {
+		return nil
+	}
+
+	var diffs []*Diff
+	if strictDiff {
+		diffs = append(diffRequireFindMissing(a, b), diffRequireFindMissing(b, a)...)
+	}
+	versionDiffsA := diffRequireFindDifferent(a, b)
+	versionDiffsB := diffRequireFindDifferent(b, a)
+	maps.Copy(versionDiffsB, versionDiffsA)
+
+	return slices.DeleteFunc(
+		append(diffs, slices.Collect(maps.Values(versionDiffsB))...),
+		func(d *Diff) bool { return d == nil },
+	)
+}
+
+func diffRequireFindMissing(a, b *modfile.File) []*Diff {
+	diffs := []*Diff{}
+	for _, needle := range a.Require {
+		if needle == nil {
+			continue
+		}
+
+		// See if there's a matching require
+		idx := slices.IndexFunc(b.Require, func(hay *modfile.Require) bool {
+			if hay == nil {
+				return false
+			}
+
+			return needle.Mod.Path == hay.Mod.Path
+		})
+
+		if idx >= 0 {
+			// We have a matching require
+			continue
+		}
+
+		diff := newDiffFromModFiles(a, b, DirectiveRequire)
+		if needle.Syntax != nil {
+			diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ")}
+		}
+		diffs = append(diffs, diff)
+	}
+
+	return diffs
+}
+
+func diffRequireFindDifferent(a, b *modfile.File) map[string]*Diff {
+	diffs := map[string]*Diff{}
+	for _, needle := range a.Require {
+		if needle == nil {
+			continue
+		}
+
+		// See if there's a matching require
+		idx := slices.IndexFunc(b.Require, func(hay *modfile.Require) bool {
+			if hay == nil {
+				return false
+			}
+
+			return needle.Mod.Path == hay.Mod.Path
+		})
+
+		if idx < 0 {
+			// We don't have a matching require
+			continue
+		}
+
+		hay := b.Require[idx]
+		if needle.Mod.Version != hay.Mod.Version {
+			diff := newDiffFromModFiles(a, b, DirectiveRequire)
+			if needle.Syntax != nil {
+				diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ") + "\n"}
+			}
+			if hay.Syntax != nil {
+				diff.Diff.B = []string{strings.Join(hay.Syntax.Token, " ")}
+			}
+			diffs[needle.Mod.Path] = diff
+		}
+	}
+
+	return diffs
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_retract.go b/tools/pipeline/internal/pkg/golang/diff_retract.go
new file mode 100644
index 00000000000..19009335263
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_retract.go
@@ -0,0 +1,121 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"maps"
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+func diffRetract(a *modfile.File, b *modfile.File, strictDiff bool) []*Diff {
+	if (a == nil && b == nil) || (len(a.Retract) == 0 && len(b.Retract) == 0) {
+		return nil
+	}
+
+	var diffs []*Diff
+	if strictDiff {
+		diffs = append(diffRetractFindMissing(a, b), diffRetractFindMissing(b, a)...)
+	}
+	versionDiffsA := diffRetractFindDifferent(a, b)
+	versionDiffsB := diffRetractFindDifferent(b, a)
+	maps.Copy(versionDiffsB, versionDiffsA)
+
+	return slices.DeleteFunc(
+		append(diffs, slices.Collect(maps.Values(versionDiffsB))...),
+		func(d *Diff) bool { return d == nil },
+	)
+}
+
+func diffRetractFindMissing(a, b *modfile.File) []*Diff {
+	diffs := []*Diff{}
+	for _, needle := range a.Retract {
+		if needle == nil {
+			continue
+		}
+
+		// See if there's a matching retract
+		idx := slices.IndexFunc(b.Retract, func(hay *modfile.Retract) bool {
+			if hay == nil {
+				return false
+			}
+
+			return needle.VersionInterval.Low == hay.VersionInterval.Low
+		})
+
+		if idx >= 0 {
+			// We have a matching retract
+			continue
+		}
+
+		diff := newDiffFromModFiles(a, b, DirectiveRetract)
+		if needle.Syntax != nil {
+			diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ")}
+		}
+		diffs = append(diffs, diff)
+	}
+
+	return diffs
+}
+
+func diffRetractFindDifferent(a, b *modfile.File) map[string]*Diff {
+	diffs := map[string]*Diff{}
+	for _, needle := range a.Retract {
+		if needle == nil {
+			continue
+		}
+
+		// See if there's a matching require
+		idx := slices.IndexFunc(b.Retract, func(hay *modfile.Retract) bool {
+			if hay == nil {
+				return false
+			}
+
+			return needle.VersionInterval.Low == hay.VersionInterval.Low
+		})
+
+		if idx < 0 {
+			// We don't have a matching require
+			continue
+		}
+
+		hay := b.Retract[idx]
+		if retractEqual(needle, hay) {
+			continue
+		}
+
+		diff := newDiffFromModFiles(a, b, DirectiveRetract)
+		if needle.Syntax != nil {
+			diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ") + "\n"}
+		}
+		if hay.Syntax != nil {
+			diff.Diff.B = []string{strings.Join(hay.Syntax.Token, " ")}
+		}
+		diffs[needle.VersionInterval.Low] = diff
+	}
+
+	return diffs
+}
+
+func retractEqual(a *modfile.Retract, b *modfile.Retract) bool {
+	if a == nil && b == nil {
+		return true
+	}
+
+	if (a == nil && b != nil) || (a != nil && b == nil) {
+		return false
+	}
+
+	if a.VersionInterval.Low != b.VersionInterval.Low {
+		return false
+	}
+
+	if a.VersionInterval.High != b.VersionInterval.High {
+		return false
+	}
+
+	return a.Rationale == b.Rationale
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_tool.go b/tools/pipeline/internal/pkg/golang/diff_tool.go
new file mode 100644
index 00000000000..abdaa74a7af
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_tool.go
@@ -0,0 +1,53 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+func diffTool(a *modfile.File, b *modfile.File) []*Diff {
+	if (a == nil && b == nil) || (len(a.Tool) == 0 && len(b.Tool) == 0) {
+		return nil
+	}
+
+	return slices.DeleteFunc(
+		append(diffToolFindDiffs(a, b), diffToolFindDiffs(b, a)...),
+		func(d *Diff) bool { return d == nil },
+	)
+}
+
+func diffToolFindDiffs(a, b *modfile.File) []*Diff {
+	diffs := []*Diff{}
+	for _, needle := range a.Tool {
+		if needle == nil {
+			continue
+		}
+
+		// See if there's a matching tool
+		idx := slices.IndexFunc(b.Tool, func(hay *modfile.Tool) bool {
+			if hay == nil {
+				return false
+			}
+
+			return needle.Path == hay.Path
+		})
+
+		if idx >= 0 {
+			// We have a matching tool
+			continue
+		}
+
+		diff := newDiffFromModFiles(a, b, DirectiveTool)
+		if needle.Syntax != nil {
+			diff.Diff.A = []string{strings.Join(needle.Syntax.Token, " ")}
+		}
+		diffs = append(diffs, diff)
+	}
+
+	return diffs
+}
diff --git a/tools/pipeline/internal/pkg/golang/diff_toolchain.go b/tools/pipeline/internal/pkg/golang/diff_toolchain.go
new file mode 100644
index 00000000000..709ed6f1aed
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/diff_toolchain.go
@@ -0,0 +1,29 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+func diffToolchain(a *modfile.File, b *modfile.File) *Diff {
+	if (a == nil && b == nil) ||
+		(a.Toolchain == nil && b.Toolchain == nil) ||
+		((a.Toolchain != nil && b.Toolchain != nil) && (a.Toolchain.Name == b.Toolchain.Name)) {
+
+		return nil
+	}
+
+	diff := newDiffFromModFiles(a, b, DirectiveToolchain)
+	if a != nil && a.Toolchain != nil && a.Toolchain.Syntax != nil {
+		diff.Diff.A = []string{strings.Join(a.Toolchain.Syntax.Token, " ") + "\n"}
+	}
+	if b != nil && b.Toolchain != nil && b.Toolchain.Syntax != nil {
+		diff.Diff.B = []string{strings.Join(b.Toolchain.Syntax.Token, " ")}
+	}
+
+	return diff
+}
diff --git a/tools/pipeline/internal/pkg/golang/doc.go b/tools/pipeline/internal/pkg/golang/doc.go
new file mode 100644
index 00000000000..a94123df578
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/doc.go
@@ -0,0 +1,5 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+// Package golang contains functions and types for Go analysis
+package golang
diff --git a/tools/pipeline/internal/pkg/golang/fixtures/moda/go.mod b/tools/pipeline/internal/pkg/golang/fixtures/moda/go.mod
new file mode 100644
index 00000000000..148e8c98811
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/fixtures/moda/go.mod
@@ -0,0 +1,25 @@
+module github.com/hashicorp/vault/pipeline/golang/moda
+
+go 1.25
+
+require github.com/99designs/keyring v1.2.2
+
+require (
+	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
+	github.com/danieljoos/wincred v1.1.2 // indirect
+	github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
+	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
+	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
+	github.com/mtibben/percent v0.2.1 // indirect
+	golang.org/x/sys v0.37.0 // indirect
+	golang.org/x/term v0.3.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+)
+
+tool golang.org/x/tools/cmd/bisect
+
+ignore (
+	./third_party/javascript
+	content/html
+	static
+)
diff --git a/tools/pipeline/internal/pkg/golang/fixtures/moda/go.sum b/tools/pipeline/internal/pkg/golang/fixtures/moda/go.sum
new file mode 100644
index 00000000000..c4dd84b4eea
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/fixtures/moda/go.sum
@@ -0,0 +1,42 @@
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMbk2FiG/kXiLl8BRyzTWDw7gX/Hz7Dd5eDMs=
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN7oaIRCjzsZ2dE+yG5k+rsdt3qcwykqK6HVGcKwsw4=
+github.com/99designs/keyring v1.2.2 h1:pZd3neh/EmUzWONb35LxQfvuY7kiSXAq3HQd97+XBn0=
+github.com/99designs/keyring v1.2.2/go.mod h1:wes/FrByc8j7lFOAGLGSNEg8f/PaI3cgTBqhFkHUrPk=
+github.com/danieljoos/wincred v1.1.2 h1:QLdCxFs1/Yl4zduvBdcHB8goaYk9RARS2SgLLRuAyr0=
+github.com/danieljoos/wincred v1.1.2/go.mod h1:GijpziifJoIBfYh+S7BbkdUTU4LfM+QnGqR5Vl2tAx0=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dvsekhvalnov/jose2go v1.5.0 h1:3j8ya4Z4kMCwT5nXIKFSV84YS+HdqSSO0VsTQxaLAeM=
+github.com/dvsekhvalnov/jose2go v1.5.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+Hoeu/iUR3ruzNvZ+yQfO03a0=
+github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
+github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c h1:6rhixN/i8ZofjG1Y75iExal34USq5p+wiN1tpie8IrU=
+github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c/go.mod h1:NMPJylDgVpX0MLRlPy15sqSwOFv/U1GZ2m21JhFfek0=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mtibben/percent v0.2.1 h1:5gssi8Nqo8QU/r2pynCm+hBQHpkB/uNK7BJCFogWdzs=
+github.com/mtibben/percent v0.2.1/go.mod h1:KG9uO+SZkUp+VkRHsCdYQV3XSZrrSpR3O9ibNBTZrns=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.3.0 h1:NGXK3lHquSN08v5vWalVI/L8XU9hdzE/G6xsrze47As=
+github.com/stretchr/objx v0.3.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+golang.org/x/sys v0.0.0-20210819135213-f52c844e1c1c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.3.0 h1:qoo4akIqOcDME5bhc/NgxUdovd6BSS2uMsVjB56q1xI=
+golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b h1:QRR6H1YWRnHb4Y/HeNFCTJLFVxaq6wH4YuVdsUOr75U=
+gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/tools/pipeline/internal/pkg/golang/fixtures/moda/main.go b/tools/pipeline/internal/pkg/golang/fixtures/moda/main.go
new file mode 100644
index 00000000000..94038c34fd3
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/fixtures/moda/main.go
@@ -0,0 +1,8 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package main
+
+import (
+	_ "github.com/99designs/keyring"
+)
diff --git a/tools/pipeline/internal/pkg/golang/fixtures/modb/go.mod b/tools/pipeline/internal/pkg/golang/fixtures/modb/go.mod
new file mode 100644
index 00000000000..3a3686438ca
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/fixtures/modb/go.mod
@@ -0,0 +1,36 @@
+module github.com/hashicorp/vault/pipeline/golang/modb
+
+go 1.25.2
+
+godebug (
+	default=go1.21
+	httpcookiemaxnum=4000
+	panicnil=1
+)
+
+exclude golang.org/x/term v0.2.0
+
+replace github.com/99designs/keyring => github.com/Jeffail/keyring v1.2.3
+
+require github.com/99designs/keyring v0.0.0-00010101000000-000000000000
+
+retract (
+	[v1.0.0, v1.9.9]
+	v0.9.0
+)
+
+tool golang.org/x/tools/cmd/stringer
+
+require (
+	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
+	github.com/danieljoos/wincred v1.1.2 // indirect
+	github.com/dvsekhvalnov/jose2go v1.5.0 // indirect
+	github.com/mtibben/percent v0.2.1 // indirect
+	golang.org/x/mod v0.29.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
+	golang.org/x/term v0.3.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
+)
+
+ignore ./node_modules
diff --git a/tools/pipeline/internal/pkg/golang/fixtures/modb/go.sum b/tools/pipeline/internal/pkg/golang/fixtures/modb/go.sum
new file mode 100644
index 00000000000..b6e89f52512
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/fixtures/modb/go.sum
@@ -0,0 +1,44 @@
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMbk2FiG/kXiLl8BRyzTWDw7gX/Hz7Dd5eDMs=
+github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN7oaIRCjzsZ2dE+yG5k+rsdt3qcwykqK6HVGcKwsw4=
+github.com/Jeffail/keyring v1.2.3 h1:WRmYdGPmHoJqX66KjGXQBALp6mUN00tD0ds5C4pqEsQ=
+github.com/Jeffail/keyring v1.2.3/go.mod h1:xIg4RDmDwDuUFoU4IzDIT3b+HV24JUYlzo6ILZUH3Sc=
+github.com/danieljoos/wincred v1.1.2 h1:QLdCxFs1/Yl4zduvBdcHB8goaYk9RARS2SgLLRuAyr0=
+github.com/danieljoos/wincred v1.1.2/go.mod h1:GijpziifJoIBfYh+S7BbkdUTU4LfM+QnGqR5Vl2tAx0=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dvsekhvalnov/jose2go v1.5.0 h1:3j8ya4Z4kMCwT5nXIKFSV84YS+HdqSSO0VsTQxaLAeM=
+github.com/dvsekhvalnov/jose2go v1.5.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mtibben/percent v0.2.1 h1:5gssi8Nqo8QU/r2pynCm+hBQHpkB/uNK7BJCFogWdzs=
+github.com/mtibben/percent v0.2.1/go.mod h1:KG9uO+SZkUp+VkRHsCdYQV3XSZrrSpR3O9ibNBTZrns=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.3.0 h1:NGXK3lHquSN08v5vWalVI/L8XU9hdzE/G6xsrze47As=
+github.com/stretchr/objx v0.3.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20210819135213-f52c844e1c1c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.3.0 h1:qoo4akIqOcDME5bhc/NgxUdovd6BSS2uMsVjB56q1xI=
+golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b h1:QRR6H1YWRnHb4Y/HeNFCTJLFVxaq6wH4YuVdsUOr75U=
+gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/tools/pipeline/internal/pkg/golang/fixtures/modb/main.go b/tools/pipeline/internal/pkg/golang/fixtures/modb/main.go
new file mode 100644
index 00000000000..94038c34fd3
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/fixtures/modb/main.go
@@ -0,0 +1,8 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package main
+
+import (
+	_ "github.com/99designs/keyring"
+)
diff --git a/tools/pipeline/internal/pkg/golang/mod_diff.go b/tools/pipeline/internal/pkg/golang/mod_diff.go
new file mode 100644
index 00000000000..bec1a663992
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/mod_diff.go
@@ -0,0 +1,254 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/pmezard/go-difflib/difflib"
+	"golang.org/x/mod/modfile"
+)
+
+// DiffOpts are options for the module diff.
+type DiffOpts struct {
+	ParseLax bool
+
+	Module    bool
+	Go        bool
+	Toolchain bool
+	Godebug   bool
+	Require   bool
+	Exclude   bool
+	Replace   bool
+	Retract   bool
+	Tool      bool
+	Ignore    bool
+
+	StrictDiffRequire bool
+	StrictDiffExclude bool
+	StrictDiffReplace bool
+	StrictDiffRetract bool
+}
+
+func DefaultDiffOpts() *DiffOpts {
+	return &DiffOpts{
+		ParseLax:          false,
+		Module:            true,
+		Go:                true,
+		Toolchain:         true,
+		Godebug:           true,
+		Require:           true,
+		Exclude:           true,
+		Replace:           true,
+		Retract:           true,
+		Tool:              true,
+		Ignore:            true,
+		StrictDiffRequire: true,
+		StrictDiffExclude: true,
+		StrictDiffReplace: true,
+		StrictDiffRetract: true,
+	}
+}
+
+// ModDiff is the result of comparing two Go modules.
+type ModDiff []*Diff
+
+// ModSource is a go.mod file
+type ModSource struct {
+	Name string
+	Data []byte
+}
+
+type Diff struct {
+	Directive Directive
+	Diff      *difflib.UnifiedDiff
+}
+
+type Directive string
+
+const (
+	DirectiveModule    Directive = "module"
+	DirectiveGo        Directive = "go"
+	DirectiveToolchain Directive = "toolchain"
+	DirectiveGodebug   Directive = "godebug"
+	DirectiveRequire   Directive = "require"
+	DirectiveExclude   Directive = "exclude"
+	DirectiveReplace   Directive = "replace"
+	DirectiveRetract   Directive = "retract"
+	DirectiveTool      Directive = "tool"
+	DirectiveIgnore    Directive = "ignore"
+)
+
+func (d *Diff) Explanation() string {
+	if d == nil || d.Directive == "" {
+		return ""
+	}
+
+	return d.Directive.Explanation()
+}
+
+func (d *Diff) UnifiedText() string {
+	if d == nil || d.Diff == nil {
+		return ""
+	}
+
+	txt, _ := difflib.GetUnifiedDiffString(*d.Diff)
+
+	return txt
+}
+
+func (d Directive) Explanation() string {
+	return fmt.Sprintf("The '%s' directives do not match", d)
+}
+
+// DiffModFiles diffs two go.mod "files" and returns a ModDiff.
+func DiffModFiles(as *ModSource, bs *ModSource, opts *DiffOpts) (ModDiff, error) {
+	if as == nil {
+		return nil, errors.New("missing a mod source")
+	}
+
+	if bs == nil {
+		return nil, errors.New("missing b mod source")
+	}
+
+	var af *modfile.File
+	var bf *modfile.File
+	var err error
+	if opts.ParseLax {
+		af, err = modfile.ParseLax(as.Name, as.Data, nil)
+		if err != nil {
+			return nil, fmt.Errorf("parsing %s contents: %w", as.Name, err)
+		}
+
+		bf, err = modfile.ParseLax(bs.Name, bs.Data, nil)
+		if err != nil {
+			return nil, fmt.Errorf("parsing %s contents: %w", bs.Name, err)
+		}
+	} else {
+		af, err = modfile.Parse(as.Name, as.Data, nil)
+		if err != nil {
+			return nil, fmt.Errorf("parsing %s contents: %w", as.Name, err)
+		}
+
+		bf, err = modfile.Parse(bs.Name, bs.Data, nil)
+		if err != nil {
+			return nil, fmt.Errorf("parsing %s contents: %w", bs.Name, err)
+		}
+	}
+
+	return diffModFiles(af, bf, opts)
+}
+
+func diffModFiles(a *modfile.File, b *modfile.File, opts *DiffOpts) (ModDiff, error) {
+	if a == nil {
+		return nil, errors.New("missing a mod file")
+	}
+
+	if b == nil {
+		return nil, errors.New("missing b mod file")
+	}
+
+	diff := ModDiff{}
+	if opts.Module {
+		diff = append(diff, diffModule(a, b))
+	}
+	if opts.Go {
+		diff = append(diff, diffGo(a, b))
+	}
+	if opts.Toolchain {
+		diff = append(diff, diffToolchain(a, b))
+	}
+	if opts.Godebug {
+		diff = append(diff, diffGodebug(a, b)...)
+	}
+	if opts.Require || opts.StrictDiffRequire {
+		diff = append(diff, diffRequire(a, b, opts.StrictDiffRequire)...)
+	}
+	if opts.Exclude || opts.StrictDiffExclude {
+		diff = append(diff, diffExclude(a, b, opts.StrictDiffExclude)...)
+	}
+	if opts.Replace || opts.StrictDiffReplace {
+		diff = append(diff, diffReplace(a, b, opts.StrictDiffReplace)...)
+	}
+	if opts.Retract || opts.StrictDiffRetract {
+		diff = append(diff, diffRetract(a, b, opts.StrictDiffRetract)...)
+	}
+	if opts.Tool {
+		diff = append(diff, diffTool(a, b)...)
+	}
+	if opts.Ignore {
+		diff = append(diff, diffIgnore(a, b)...)
+	}
+
+	if len(diff) == 0 {
+		return nil, nil
+	}
+
+	diff = slices.DeleteFunc(diff, func(d *Diff) bool { return d == nil })
+	slices.SortStableFunc(diff, func(a *Diff, b *Diff) int {
+		// a < b = 1
+		// a == b = 0
+		// a > b = -1
+		if a == nil && b == nil {
+			return 0
+		}
+
+		if a == nil && b != nil {
+			return 1
+		}
+
+		if a != nil && b == nil {
+			return -1
+		}
+
+		if n := strings.Compare(string(a.Directive), string(b.Directive)); n != 0 {
+			return n
+		}
+
+		if a.Diff == nil && b.Diff == nil {
+			return 0
+		}
+
+		if a.Diff == nil && b.Diff != nil {
+			return 1
+		}
+
+		if a.Diff != nil && b.Diff == nil {
+			return -1
+		}
+
+		atxt, aerr := difflib.GetUnifiedDiffString(*a.Diff)
+		btxt, berr := difflib.GetUnifiedDiffString(*b.Diff)
+
+		if aerr == nil && berr != nil {
+			return 1
+		}
+
+		if aerr != nil && berr == nil {
+			return -1
+		}
+
+		return strings.Compare(atxt, btxt)
+	})
+
+	return diff, nil
+}
+
+func newDiffFromModFiles(a, b *modfile.File, typ Directive) *Diff {
+	res := &Diff{
+		Directive: typ,
+		Diff:      &difflib.UnifiedDiff{Context: 1},
+	}
+	if a != nil && a.Syntax != nil {
+		res.Diff.FromFile = a.Syntax.Name
+	}
+	if b != nil && b.Syntax != nil {
+		res.Diff.ToFile = b.Syntax.Name
+	}
+
+	return res
+}
diff --git a/tools/pipeline/internal/pkg/golang/mod_diff_test.go b/tools/pipeline/internal/pkg/golang/mod_diff_test.go
new file mode 100644
index 00000000000..b0d1f2eca67
--- /dev/null
+++ b/tools/pipeline/internal/pkg/golang/mod_diff_test.go
@@ -0,0 +1,517 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package golang
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_DiffModFiles_Equal(t *testing.T) {
+	t.Parallel()
+
+	modA, err := os.ReadFile("./fixtures/moda/go.mod")
+	require.NoError(t, err)
+
+	modB, err := os.ReadFile("./fixtures/modb/go.mod")
+	require.NoError(t, err)
+
+	for desc, test := range map[string]struct {
+		as   *ModSource
+		bs   *ModSource
+		opts *DiffOpts
+	}{
+		"moda not lax not strict": {
+			&ModSource{Name: "moda-1", Data: modA},
+			&ModSource{Name: "moda-2", Data: modA},
+			&DiffOpts{StrictDiffRequire: false, ParseLax: false},
+		},
+		"moda lax not strict": {
+			&ModSource{Name: "moda-1", Data: modA},
+			&ModSource{Name: "moda-2", Data: modA},
+			&DiffOpts{StrictDiffRequire: false, ParseLax: true},
+		},
+		"moda not lax strict": {
+			&ModSource{Name: "moda-1", Data: modA},
+			&ModSource{Name: "moda-2", Data: modA},
+			&DiffOpts{StrictDiffRequire: true, ParseLax: false},
+		},
+		"moda lax strict": {
+			&ModSource{Name: "moda-1", Data: modA},
+			&ModSource{Name: "moda-2", Data: modA},
+			&DiffOpts{StrictDiffRequire: true, ParseLax: true},
+		},
+		"modb not lax not strict": {
+			&ModSource{Name: "modb-1", Data: modB},
+			&ModSource{Name: "modb-2", Data: modB},
+			&DiffOpts{StrictDiffRequire: false, ParseLax: false},
+		},
+		"modb lax not strict": {
+			&ModSource{Name: "modb-1", Data: modB},
+			&ModSource{Name: "modb-2", Data: modB},
+			&DiffOpts{StrictDiffRequire: false, ParseLax: true},
+		},
+		"modb not lax strict": {
+			&ModSource{Name: "modb-1", Data: modB},
+			&ModSource{Name: "modb-2", Data: modB},
+			&DiffOpts{StrictDiffRequire: true, ParseLax: false},
+		},
+		"modb lax strict": {
+			&ModSource{Name: "modb-1", Data: modB},
+			&ModSource{Name: "modb-2", Data: modB},
+			&DiffOpts{StrictDiffRequire: true, ParseLax: true},
+		},
+	} {
+		t.Run(desc, func(t *testing.T) {
+			t.Parallel()
+			diff, err := DiffModFiles(test.as, test.bs, test.opts)
+			require.NoError(t, err)
+			require.Nil(t, diff, "expected no diff, got:\n%v", printModDiff(diff))
+		})
+	}
+}
+
+func Test_DiffModFiles_Diff(t *testing.T) {
+	t.Parallel()
+
+	modA, err := os.ReadFile("./fixtures/moda/go.mod")
+	require.NoError(t, err)
+
+	modB, err := os.ReadFile("./fixtures/modb/go.mod")
+	require.NoError(t, err)
+
+	as := &ModSource{Name: "moda", Data: modA}
+	bs := &ModSource{Name: "modb", Data: modB}
+
+	for desc, test := range map[string]struct {
+		opts      *DiffOpts
+		condition func(t *testing.T, got ModDiff)
+	}{
+		"strict parse lax diff": {
+			&DiffOpts{
+				ParseLax:          false,
+				Module:            true,
+				Go:                true,
+				Toolchain:         true,
+				Godebug:           true,
+				Require:           true,
+				Exclude:           true,
+				Replace:           true,
+				Retract:           true,
+				Tool:              true,
+				Ignore:            true,
+				StrictDiffRequire: false,
+				StrictDiffExclude: false,
+				StrictDiffReplace: false,
+				StrictDiffRetract: false,
+			},
+			func(t *testing.T, got ModDiff) {
+				hasDiffMatching(t, got, DirectiveModule, []string{
+					"-module github.com/hashicorp/vault/pipeline/golang/moda",
+					"+module github.com/hashicorp/vault/pipeline/golang/modb",
+				})
+				hasDiffMatching(t, got, DirectiveGo, []string{
+					"-go 1.25",
+					"+go 1.25.2",
+				})
+				hasDiffMatching(t, got, DirectiveToolchain, []string{
+					"+toolchain go1.24",
+				})
+				hasDiffMatching(t, got, DirectiveGodebug, []string{
+					"-default=go1.21",
+				})
+				hasDiffMatching(t, got, DirectiveGodebug, []string{
+					"-httpcookiemaxnum=4000",
+				})
+				hasDiffMatching(t, got, DirectiveGodebug, []string{
+					"-panicnil=1",
+				})
+				hasDiffMatching(t, got, DirectiveRequire, []string{
+					"-require github.com/99designs/keyring v1.2.2",
+					"+require github.com/99designs/keyring v0.0.0-00010101000000-000000000000",
+				})
+				noDiffMatching(t, got, DirectiveRequire, []string{
+					"-github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c",
+				})
+				noDiffMatching(t, got, DirectiveExclude, []string{
+					"-exclude golang.org/x/term v0.2.0",
+				})
+				noDiffMatching(t, got, DirectiveReplace, []string{
+					"-replace github.com/99designs/keyring => github.com/Jeffail/keyring v1.2.3",
+				})
+				noDiffMatching(t, got, DirectiveRetract, []string{
+					"-[ v1.0.0 , v1.9.9 ]",
+				})
+				noDiffMatching(t, got, DirectiveRetract, []string{
+					"-v0.9.0",
+				})
+				hasDiffMatching(t, got, DirectiveTool, []string{
+					"-tool golang.org/x/tools/cmd/bisect",
+				})
+				hasDiffMatching(t, got, DirectiveTool, []string{
+					"-tool golang.org/x/tools/cmd/stringer",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-./third_party/javascript",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-content/html",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-static",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-ignore ./node_modules",
+				})
+			},
+		},
+		"lax parse lax diff": {
+			&DiffOpts{
+				ParseLax:          true,
+				Module:            true,
+				Go:                true,
+				Toolchain:         true,
+				Godebug:           true,
+				Require:           true,
+				Exclude:           true,
+				Replace:           true,
+				Retract:           true,
+				Tool:              true,
+				Ignore:            true,
+				StrictDiffRequire: false,
+				StrictDiffExclude: false,
+				StrictDiffReplace: false,
+				StrictDiffRetract: false,
+			},
+			func(t *testing.T, got ModDiff) {
+				hasDiffMatching(t, got, DirectiveModule, []string{
+					"-module github.com/hashicorp/vault/pipeline/golang/moda",
+					"+module github.com/hashicorp/vault/pipeline/golang/modb",
+				})
+				hasDiffMatching(t, got, DirectiveGo, []string{
+					"-go 1.25",
+					"+go 1.25.2",
+				})
+				noDiffMatching(t, got, DirectiveToolchain, []string{
+					"+toolchain go1.24",
+				})
+				noDiffMatching(t, got, DirectiveGodebug, []string{
+					"-default=go1.21",
+				})
+				noDiffMatching(t, got, DirectiveGodebug, []string{
+					"-httpcookiemaxnum=4000",
+				})
+				noDiffMatching(t, got, DirectiveGodebug, []string{
+					"-panicnil=1",
+				})
+				hasDiffMatching(t, got, DirectiveRequire, []string{
+					"-require github.com/99designs/keyring v1.2.2",
+					"+require github.com/99designs/keyring v0.0.0-00010101000000-000000000000",
+				})
+				noDiffMatching(t, got, DirectiveRequire, []string{
+					"-github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c",
+				})
+				noDiffMatching(t, got, DirectiveExclude, []string{
+					"-exclude golang.org/x/term v0.2.0",
+				})
+				noDiffMatching(t, got, DirectiveReplace, []string{
+					"-replace github.com/99designs/keyring => github.com/Jeffail/keyring v1.2.3",
+				})
+				noDiffMatching(t, got, DirectiveRetract, []string{
+					"-[ v1.0.0 , v1.9.9 ]",
+				})
+				noDiffMatching(t, got, DirectiveRetract, []string{
+					"-v0.9.0",
+				})
+				noDiffMatching(t, got, DirectiveTool, []string{
+					"-tool golang.org/x/tools/cmd/bisect",
+				})
+				noDiffMatching(t, got, DirectiveTool, []string{
+					"-tool golang.org/x/tools/cmd/stringer",
+				})
+				noDiffMatching(t, got, DirectiveTool, []string{
+					"-tool golang.org/x/tools/cmd/bisect",
+				})
+				noDiffMatching(t, got, DirectiveTool, []string{
+					"-tool golang.org/x/tools/cmd/stringer",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-./third_party/javascript",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-content/html",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-static",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-ignore ./node_modules",
+				})
+			},
+		},
+		"strict parse strict diff": {
+			&DiffOpts{
+				ParseLax:          false,
+				Module:            true,
+				Go:                true,
+				Toolchain:         true,
+				Godebug:           true,
+				Require:           true,
+				Exclude:           true,
+				Replace:           true,
+				Retract:           true,
+				Tool:              true,
+				Ignore:            true,
+				StrictDiffRequire: true,
+				StrictDiffExclude: true,
+				StrictDiffReplace: true,
+				StrictDiffRetract: true,
+			},
+			func(t *testing.T, got ModDiff) {
+				hasDiffMatching(t, got, DirectiveModule, []string{
+					"-module github.com/hashicorp/vault/pipeline/golang/moda",
+					"+module github.com/hashicorp/vault/pipeline/golang/modb",
+				})
+				hasDiffMatching(t, got, DirectiveGo, []string{
+					"-go 1.25",
+					"+go 1.25.2",
+				})
+				hasDiffMatching(t, got, DirectiveToolchain, []string{
+					"+toolchain go1.24",
+				})
+				hasDiffMatching(t, got, DirectiveGodebug, []string{
+					"-default=go1.21",
+				})
+				hasDiffMatching(t, got, DirectiveGodebug, []string{
+					"-httpcookiemaxnum=4000",
+				})
+				hasDiffMatching(t, got, DirectiveGodebug, []string{
+					"-panicnil=1",
+				})
+				hasDiffMatching(t, got, DirectiveRequire, []string{
+					"-require github.com/99designs/keyring v1.2.2",
+					"+require github.com/99designs/keyring v0.0.0-00010101000000-000000000000",
+				})
+				hasDiffMatching(t, got, DirectiveRequire, []string{
+					"-github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c",
+				})
+				hasDiffMatching(t, got, DirectiveExclude, []string{
+					"-exclude golang.org/x/term v0.2.0",
+				})
+				hasDiffMatching(t, got, DirectiveReplace, []string{
+					"-replace github.com/99designs/keyring => github.com/Jeffail/keyring v1.2.3",
+				})
+				hasDiffMatching(t, got, DirectiveRetract, []string{
+					"-[ v1.0.0 , v1.9.9 ]",
+				})
+				hasDiffMatching(t, got, DirectiveRetract, []string{
+					"-v0.9.0",
+				})
+				hasDiffMatching(t, got, DirectiveTool, []string{
+					"-tool golang.org/x/tools/cmd/bisect",
+				})
+				hasDiffMatching(t, got, DirectiveTool, []string{
+					"-tool golang.org/x/tools/cmd/stringer",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-./third_party/javascript",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-content/html",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-static",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-ignore ./node_modules",
+				})
+			},
+		},
+		"lax parse strict diff": {
+			&DiffOpts{
+				ParseLax:          true,
+				Module:            true,
+				Go:                true,
+				Toolchain:         true,
+				Godebug:           true,
+				Require:           true,
+				Exclude:           true,
+				Replace:           true,
+				Retract:           true,
+				Tool:              true,
+				Ignore:            true,
+				StrictDiffRequire: true,
+				StrictDiffExclude: true,
+				StrictDiffReplace: true,
+				StrictDiffRetract: true,
+			},
+			func(t *testing.T, got ModDiff) {
+				hasDiffMatching(t, got, DirectiveModule, []string{
+					"-module github.com/hashicorp/vault/pipeline/golang/moda",
+					"+module github.com/hashicorp/vault/pipeline/golang/modb",
+				})
+				hasDiffMatching(t, got, DirectiveGo, []string{
+					"-go 1.25",
+					"+go 1.25.2",
+				})
+				noDiffMatching(t, got, DirectiveToolchain, []string{
+					"+toolchain go1.24",
+				})
+				noDiffMatching(t, got, DirectiveGodebug, []string{
+					"-default=go1.21",
+				})
+				noDiffMatching(t, got, DirectiveGodebug, []string{
+					"-httpcookiemaxnum=4000",
+				})
+				noDiffMatching(t, got, DirectiveGodebug, []string{
+					"-panicnil=1",
+				})
+				hasDiffMatching(t, got, DirectiveRequire, []string{
+					"-require github.com/99designs/keyring v1.2.2",
+					"+require github.com/99designs/keyring v0.0.0-00010101000000-000000000000",
+				})
+				hasDiffMatching(t, got, DirectiveRequire, []string{
+					"-github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c",
+				})
+				noDiffMatching(t, got, DirectiveExclude, []string{
+					"-exclude golang.org/x/term v0.2.0",
+				})
+				noDiffMatching(t, got, DirectiveReplace, []string{
+					"-replace github.com/99designs/keyring => github.com/Jeffail/keyring v1.2.3",
+				})
+				hasDiffMatching(t, got, DirectiveRetract, []string{
+					"-[ v1.0.0 , v1.9.9 ]",
+				})
+				hasDiffMatching(t, got, DirectiveRetract, []string{
+					"-v0.9.0",
+				})
+				noDiffMatching(t, got, DirectiveTool, []string{
+					"-tool golang.org/x/tools/cmd/bisect",
+				})
+				noDiffMatching(t, got, DirectiveTool, []string{
+					"-tool golang.org/x/tools/cmd/stringer",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-content/html",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-static",
+				})
+				hasDiffMatching(t, got, DirectiveIgnore, []string{
+					"-ignore ./node_modules",
+				})
+			},
+		},
+	} {
+		t.Run(desc, func(t *testing.T) {
+			t.Parallel()
+			diff, err := DiffModFiles(as, bs, test.opts)
+			require.NoError(t, err)
+			require.NotNil(t, diff, "expected a module diff")
+			test.condition(t, diff)
+		})
+	}
+}
+
+func hasDiffMatching(t *testing.T, diff ModDiff, dir Directive, matches []string) {
+	t.Helper()
+
+	require.NotNil(t, diff)
+	diffs := getDiffsForDirective(dir, diff)
+	require.True(t, len(diffs) > 0, "expected %s matching %v, got diff:\n%s",
+		dir,
+		matches,
+		printModDiff(diff),
+	)
+	for _, df := range diffs {
+		if unifiedTextMatches(df, matches) {
+			return
+		}
+	}
+	t.Fatalf("expected %s diff matching %v, got diff:\n%s",
+		dir,
+		matches,
+		printModDiff(diff),
+	)
+}
+
+func noDiffMatching(t *testing.T, diff ModDiff, dir Directive, matches []string) {
+	t.Helper()
+
+	require.NotNil(t, diff)
+	diffs := getDiffsForDirective(dir, diff)
+	if len(diffs) < 1 {
+		return
+	}
+	for _, df := range diffs {
+		if unifiedTextMatches(df, matches) {
+			t.Fatalf("expected no %s diff matching %v, got diff:\n%s",
+				dir,
+				matches,
+				printModDiff(diff),
+			)
+		}
+	}
+}
+
+func printModDiff(d ModDiff) string {
+	if d == nil {
+		return ""
+	}
+
+	b := strings.Builder{}
+	for _, diff := range d {
+		if exp := diff.Explanation(); exp != "" {
+			b.WriteString(exp + "\n")
+		}
+		if dt := diff.UnifiedText(); dt != "" {
+			b.WriteString(dt + "\n")
+		}
+	}
+
+	return b.String()
+}
+
+func getDiffsForDirective(dir Directive, diff ModDiff) []*Diff {
+	if len(diff) < 1 {
+		return nil
+	}
+
+	diffs := []*Diff{}
+	for _, d := range diff {
+		if d == nil {
+			continue
+		}
+		if d.Directive == dir {
+			diffs = append(diffs, d)
+		}
+	}
+
+	return diffs
+}
+
+func unifiedTextMatches(diff *Diff, matches []string) bool {
+	if diff == nil && len(matches) == 0 {
+		return true
+	}
+
+	if diff == nil && len(matches) > 0 {
+		return false
+	}
+
+	txt := diff.UnifiedText()
+	if txt == "" {
+		return false
+	}
+	for _, m := range matches {
+		if !strings.Contains(txt, m) {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/tools/pipeline/internal/pkg/hcp/client.go b/tools/pipeline/internal/pkg/hcp/client.go
new file mode 100644
index 00000000000..cc99b377206
--- /dev/null
+++ b/tools/pipeline/internal/pkg/hcp/client.go
@@ -0,0 +1,140 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package hcp
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"os"
+	"sync"
+
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// Client is the HCP client.
+type Client struct {
+	Environment Environment
+	HTTPClient  *http.Client
+	// Basic auth
+	Username string
+	Password string
+	once     *sync.Once
+}
+
+// ClientOpt is an option to NewClient.
+type ClientOpt func(*Client)
+
+// Requester is an interface that defines a request that can be configured
+// for an environment.
+type Requester interface {
+	Request(Environment) (*http.Request, error)
+}
+
+// Environment is an HCP portal environment
+type Environment string
+
+const (
+	EnvironmentUnknown Environment = ""
+	EnvironmentDev     Environment = "dev"
+	EnvironmentInt     Environment = "int"
+	EnvironmentProd    Environment = "prod"
+)
+
+// Addr is the URL for each environment
+func (g Environment) Addr() string {
+	switch g {
+	case EnvironmentDev:
+		return "https://api.hcp.dev"
+	case EnvironmentInt:
+		return "https://api.hcp.to"
+	case EnvironmentProd:
+		return "https://api.hashicorp.cloud"
+	default:
+		return ""
+	}
+}
+
+// NewClient takes none-or-more options and returns a new Client.
+func NewClient(opts ...ClientOpt) *Client {
+	c := &Client{
+		HTTPClient: http.DefaultClient,
+	}
+
+	for _, opt := range opts {
+		opt(c)
+	}
+
+	return c
+}
+
+// WithEnvironment sets the client environment.
+func WithEnvironment(env Environment) ClientOpt {
+	return func(c *Client) {
+		c.Environment = env
+	}
+}
+
+// WithHTTPClient sets the client HTTP Client.
+func WithHTTPClient(httpClient *http.Client) ClientOpt {
+	return func(c *Client) {
+		c.HTTPClient = httpClient
+	}
+}
+
+// WithUsername sets the basic auth username for internal APIs.
+func WithUsername(username string) ClientOpt {
+	return func(c *Client) {
+		c.Username = username
+	}
+}
+
+// WithUsername sets the base auth password for internal APIs>
+func WithPassword(password string) ClientOpt {
+	return func(c *Client) {
+		c.Password = password
+	}
+}
+
+// WithLoadTokenFromEnv sets the basic auth username and token from known env
+// vars.
+func WithLoadAuthFromEnv() ClientOpt {
+	return func(client *Client) {
+		if username, ok := os.LookupEnv("HCP_USERNAME"); ok {
+			client.Username = username
+		}
+		if password, ok := os.LookupEnv("HCP_PASSWORD"); ok {
+			client.Password = password
+		}
+	}
+}
+
+// Do takes in a Requester and performs the request. It returns the raw http
+// Response.
+func (c *Client) Do(ctx context.Context, req Requester) (*http.Response, error) {
+	logArgs := []any{
+		slog.String("env", string(c.Environment)),
+		slog.String("api-addr", string(c.Environment.Addr())),
+	}
+	httpReq, err := req.Request(c.Environment)
+	if err != nil {
+		slog.Default().ErrorContext(slogctx.Append(ctx,
+			append(logArgs, slog.String("error", err.Error()))),
+			"performing request",
+		)
+		return nil, err
+	}
+
+	logArgs = append(logArgs,
+		slog.String("method", httpReq.Method),
+		slog.String("url", httpReq.URL.String()),
+	)
+
+	ctx = slogctx.Append(ctx, logArgs...)
+	slog.Default().DebugContext(ctx, "performing request")
+	httpReq.SetBasicAuth(c.Username, c.Password)
+	httpReq.WithContext(ctx)
+
+	return c.HTTPClient.Do(httpReq)
+}
diff --git a/tools/pipeline/internal/pkg/hcp/get_latest_product_version.go b/tools/pipeline/internal/pkg/hcp/get_latest_product_version.go
new file mode 100644
index 00000000000..f6fce28c820
--- /dev/null
+++ b/tools/pipeline/internal/pkg/hcp/get_latest_product_version.go
@@ -0,0 +1,221 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package hcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/jedib0t/go-pretty/v6/table"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// GetLatestProductVersionReq is an HCP image service request to get the latest
+// product version. It can also be used to get information for other images
+// when configured with different constraints.
+type GetLatestProductVersionReq struct {
+	ProductName                  string
+	ProductVersionConstraint     string
+	HostManagerVersionConstraint string
+	CloudProvider                string
+	CloudRegion                  string
+	Availability                 GetLatestProductVersionAvailability
+	ExcludeReleaseCandidates     bool
+}
+
+// GetLatestProductVersionAvailability describes the availability state of an
+// image.
+type GetLatestProductVersionAvailability string
+
+// GetLatestProductVersionRes is a response from a request to get the latest
+// image from the HCP image service.
+type GetLatestProductVersionRes struct {
+	Response *http.Response `json:"-"`
+	Image    *HCPImage      `json:"image,omitempty"`
+}
+
+// HCPRegion is a cloud region for the image.
+type HCPRegion struct {
+	Provider string `json:"provider,omitempty"`
+	Region   string `json:"region,omitempty"`
+}
+
+// HCPImageReference is the image reference information.
+type HCPImageReference struct {
+	ImageID string     `json:"image_id,omitempty"`
+	Region  *HCPRegion `json:"region,omitempty"`
+}
+
+// HCPImage is an image in the HCP image service.
+type HCPImage struct {
+	ID                 string             `json:"id,omitempty"`
+	ProductName        string             `json:"product_name,omitempty"`
+	ProductVersion     string             `json:"product_version,omitempty"`
+	HostManagerVersion string             `json:"host_manager_version,omitempty"`
+	Region             *HCPRegion         `json:"region,omitempty"`
+	Availability       string             `json:"availability,omitempty"`
+	AWS                *HCPImageReference `json:"aws,omitempty"`
+	Azure              *HCPImageReference `json:"azure,omitempty"`
+	OSVersion          string             `json:"os_version,omitempty"`
+	CreatedAt          time.Time          `json:"created_at,omitempty"`
+	UpdatedAt          time.Time          `json:"updated_at,omitempty"`
+}
+
+const (
+	GetLatestProductVersionAvailabilityUnknown  GetLatestProductVersionAvailability = ""
+	GetLatestProductVersionAvailabilityDisabled GetLatestProductVersionAvailability = "disabled"
+	GetLatestProductVersionAvailabilityInternal GetLatestProductVersionAvailability = "internal"
+	GetLatestProductVersionAvailabilityPublic   GetLatestProductVersionAvailability = "public"
+	GetLatestProductVersionAvailabilityBeta     GetLatestProductVersionAvailability = "beta"
+)
+
+// ID returns the availability into the corresponding integer enum.
+func (g GetLatestProductVersionAvailability) ID() string {
+	switch g {
+	case GetLatestProductVersionAvailabilityDisabled:
+		return "1"
+	case GetLatestProductVersionAvailabilityInternal:
+		return "2"
+	case GetLatestProductVersionAvailabilityPublic:
+		return "3"
+	case GetLatestProductVersionAvailabilityBeta:
+		return "4"
+	default:
+		return "0"
+	}
+}
+
+const imageServicePath = "image/2009-12-19/.internal/latestproductversion"
+
+// Request takes an environment and produces an HTTP request that the client
+// can execute.
+func (r *GetLatestProductVersionReq) Request(env Environment) (*http.Request, error) {
+	reqURL, err := url.JoinPath(env.Addr(), imageServicePath)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequest(http.MethodGet, reqURL, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	query := req.URL.Query()
+	if r.ProductName != "" {
+		query.Add("product_name", r.ProductName)
+	}
+	if r.ProductVersionConstraint != "" {
+		query.Add("product_version_constraint", r.ProductVersionConstraint)
+	}
+	if r.HostManagerVersionConstraint != "" {
+		query.Add("host_manager_version_constraint", r.HostManagerVersionConstraint)
+	}
+	if r.CloudProvider != "" {
+		query.Add("region.provider", r.CloudProvider)
+	}
+	if r.CloudRegion != "" {
+		query.Add("region.region", r.CloudRegion)
+	}
+	if r.Availability != "" {
+		query.Add("availability", r.Availability.ID())
+	}
+	if r.ExcludeReleaseCandidates {
+		query.Add("exclude_release_candidates", fmt.Sprintf("%t", r.ExcludeReleaseCandidates))
+	}
+
+	req.URL.RawQuery = query.Encode()
+
+	return req, nil
+}
+
+// Run runs the request to find an HCP image that matches the request criteria.
+func (r *GetLatestProductVersionReq) Run(ctx context.Context, client *Client) (*GetLatestProductVersionRes, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	res := &GetLatestProductVersionRes{}
+
+	ctx = slogctx.Append(ctx,
+		slog.String("availability", string(r.Availability)),
+		slog.String("availability-id", r.Availability.ID()),
+		slog.String("cloud", r.CloudProvider),
+		slog.Bool("exclude-release-candidates", r.ExcludeReleaseCandidates),
+		slog.String("host-manager-version-constraint", r.HostManagerVersionConstraint),
+		slog.String("product", r.ProductName),
+		slog.String("product-version-constraint", r.ProductVersionConstraint),
+		slog.String("region", r.CloudRegion),
+	)
+	slog.Default().DebugContext(ctx, "getting latest HCP product version")
+
+	var err error
+	res.Response, err = client.Do(ctx, r)
+	if err != nil {
+		return res, err
+	}
+
+	defer res.Response.Body.Close()
+	bytes, err := io.ReadAll(res.Response.Body)
+	if err != nil {
+		return res, err
+	}
+
+	if err = json.Unmarshal(bytes, res); err != nil {
+		return res, err
+	}
+
+	if res.Response.StatusCode > 299 {
+		return res, fmt.Errorf("received unexpected http response code: %d", res.Response.StatusCode)
+	}
+
+	return res, nil
+}
+
+// ToJSON marshals the response to JSON.
+func (r *GetLatestProductVersionRes) ToJSON() ([]byte, error) {
+	b, err := json.Marshal(r)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling latest HCP image response to JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToTable marshals the response to a text table.
+func (r *GetLatestProductVersionRes) ToTable() table.Writer {
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+	t.AppendHeader(table.Row{"name", "id", "cloud", "region", "version", "created_at"})
+
+	var imageID string
+	if aws := r.Image.AWS; aws != nil {
+		imageID = aws.ImageID
+	}
+	if azure := r.Image.Azure; azure != nil {
+		imageID = azure.ImageID
+	}
+
+	t.AppendRow(table.Row{
+		r.Image.ProductName,
+		imageID,
+		r.Image.Region.Provider,
+		r.Image.Region.Region,
+		r.Image.ProductVersion,
+		r.Image.CreatedAt.String(),
+	})
+
+	return t
+}
diff --git a/tools/pipeline/internal/pkg/hcp/get_latest_product_version_test.go b/tools/pipeline/internal/pkg/hcp/get_latest_product_version_test.go
new file mode 100644
index 00000000000..c8cb6b40d5a
--- /dev/null
+++ b/tools/pipeline/internal/pkg/hcp/get_latest_product_version_test.go
@@ -0,0 +1,83 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package hcp
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_GetLatestProductVersionReq_Request(t *testing.T) {
+	t.Parallel()
+
+	for name, test := range map[string]struct {
+		req         *GetLatestProductVersionReq
+		expectedURL string
+	}{
+		"no query args": {
+			&GetLatestProductVersionReq{},
+			"https://api.hcp.dev/image/2009-12-19/.internal/latestproductversion",
+		},
+		"all query args": {
+			&GetLatestProductVersionReq{
+				Availability:             GetLatestProductVersionAvailabilityPublic,
+				CloudRegion:              "us-east-1",
+				CloudProvider:            "aws",
+				ExcludeReleaseCandidates: true,
+				ProductName:              "vault",
+				ProductVersionConstraint: "1.21.0-beta1+ent-2cf0b2f",
+			},
+			"https://api.hcp.dev/image/2009-12-19/.internal/latestproductversion?availability=3&exclude_release_candidates=true&product_name=vault&product_version_constraint=1.21.0-beta1%2Bent-2cf0b2f&region.provider=aws&region.region=us-east-1",
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			req, err := test.req.Request(EnvironmentDev)
+			require.NoError(t, err)
+			require.Equal(t, test.expectedURL, req.URL.String())
+		})
+	}
+}
+
+const hcpImageJSON = `{"image":{"id":"c613a76a-7c7f-484d-b21f-f99603dacee7","product_name":"vault","product_version":"v1.21.0-beta1+ent-bf26069","host_manager_version":"0.2.1806001022+1f8c65e9","region":{"provider":"aws","region":"us-west-2"},"availability":"PUBLIC","aws":{"image_id":"ami-037fc9428b5fc8d6a","region":{"provider":"aws","region":"us-west-2"}},"os_version":"","created_at":"2025-07-23T06:45:04.029Z","updated_at":"2025-07-23T06:45:04.008Z"}}`
+
+func Test_GetLatestProductVersionRes_Unmarshal(t *testing.T) {
+	t.Parallel()
+
+	createdAt, err := time.Parse(time.RFC3339, "2025-07-23T06:45:04.029Z")
+	require.NoError(t, err)
+	updatedAt, err := time.Parse(time.RFC3339, "2025-07-23T06:45:04.008Z")
+	require.NoError(t, err)
+
+	res := &GetLatestProductVersionRes{}
+	require.NoError(t, json.Unmarshal([]byte(hcpImageJSON), res))
+	expect := &GetLatestProductVersionRes{
+		Image: &HCPImage{
+			ID:                 "c613a76a-7c7f-484d-b21f-f99603dacee7",
+			ProductName:        "vault",
+			ProductVersion:     "v1.21.0-beta1+ent-bf26069",
+			HostManagerVersion: "0.2.1806001022+1f8c65e9",
+			Region: &HCPRegion{
+				Provider: "aws",
+				Region:   "us-west-2",
+			},
+			Availability: "PUBLIC",
+			AWS: &HCPImageReference{
+				ImageID: "ami-037fc9428b5fc8d6a",
+				Region: &HCPRegion{
+					Provider: "aws",
+					Region:   "us-west-2",
+				},
+			},
+			OSVersion: "",
+			CreatedAt: createdAt,
+			UpdatedAt: updatedAt,
+		},
+	}
+	require.EqualValues(t, expect, res)
+}
diff --git a/tools/pipeline/internal/pkg/hcp/show_image.go b/tools/pipeline/internal/pkg/hcp/show_image.go
new file mode 100644
index 00000000000..2bdad937c22
--- /dev/null
+++ b/tools/pipeline/internal/pkg/hcp/show_image.go
@@ -0,0 +1,54 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package hcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+)
+
+// ShowImageReq is a request to wait for an image to be available in the
+// image service.
+type ShowImageReq struct {
+	Req                 *GetLatestProductVersionReq `json:"req,omitempty"`
+	WriteToGithubOutput bool                        `json:"write_to_github_output,omitempty"`
+}
+
+// ShowImageRes is a response to a ShowImageReq.
+type ShowImageRes struct {
+	Res *GetLatestProductVersionRes `json:"res,omitempty"`
+}
+
+// Run runs the wait for image request.
+func (r *ShowImageReq) Run(ctx context.Context, client *Client) (*ShowImageRes, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	slog.Default().DebugContext(ctx, "showing HCP image")
+
+	res := &ShowImageRes{}
+	var err error
+	res.Res, err = r.Req.Run(ctx, client)
+
+	return res, err
+}
+
+// ToGithubOutput marshals just the artifact response to JSON.
+func (r *ShowImageRes) ToGithubOutput() ([]byte, error) {
+	if r == nil || r.Res == nil {
+		return nil, fmt.Errorf("unable to marshal unitialized response to GITHUB_OUTPUT")
+	}
+
+	b, err := json.Marshal(r.Res.Image)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling show-image to GITHUB_OUTPUT JSON: %w", err)
+	}
+
+	return b, nil
+}
diff --git a/tools/pipeline/internal/pkg/hcp/wait_for_image.go b/tools/pipeline/internal/pkg/hcp/wait_for_image.go
new file mode 100644
index 00000000000..3cffe3f250f
--- /dev/null
+++ b/tools/pipeline/internal/pkg/hcp/wait_for_image.go
@@ -0,0 +1,93 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package hcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/avast/retry-go/v4"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// WaitForImageReq is a request to wait for an image to be available in the
+// image service.
+type WaitForImageReq struct {
+	Req                 *GetLatestProductVersionReq `json:"req,omitempty"`
+	Delay               time.Duration               `json:"delay,omitempty"`
+	WriteToGithubOutput bool                        `json:"write_to_github_output,omitempty"`
+}
+
+// WaitForImageRes is a response to a WaitForImageReq.
+type WaitForImageRes struct {
+	Res *GetLatestProductVersionRes `json:"res,omitempty"`
+}
+
+// Run runs the wait for image request.
+func (r *WaitForImageReq) Run(ctx context.Context, client *Client) (*WaitForImageRes, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	slog.Default().DebugContext(ctx, "waiting for HCP image to be available")
+
+	res := &WaitForImageRes{
+		Res: &GetLatestProductVersionRes{},
+	}
+	attempt := 0
+	err := retry.Do(
+		func() error {
+			attempt++
+			// Limit each request to the image service to 5 seconds max
+			reqCtx, reqCancel := context.WithTimeout(ctx, 5*time.Second)
+			defer reqCancel()
+			reqRes, err := r.Req.Run(reqCtx, client)
+			if reqRes != nil {
+				if reqRes.Response != nil {
+					res.Res.Response = reqRes.Response
+				}
+				if reqRes.Image != nil {
+					res.Res.Image = reqRes.Image
+				}
+			}
+
+			if err != nil {
+				slog.Default().DebugContext(
+					slogctx.Append(ctx,
+						slog.Int("attempt", attempt),
+						slog.String("error", err.Error())),
+					"attempt to get HCP image details failed",
+				)
+			}
+
+			return err
+		},
+		retry.UntilSucceeded(),
+		retry.Context(ctx),
+		retry.WrapContextErrorWithLastError(true),
+		retry.Delay(r.Delay),
+		retry.DelayType(retry.FixedDelay),
+	)
+
+	return res, err
+}
+
+// ToGithubOutput marshals just the artifact response to JSON.
+func (r *WaitForImageRes) ToGithubOutput() ([]byte, error) {
+	if r == nil || r.Res == nil {
+		return nil, fmt.Errorf("unable to marshal unitialized response to GITHUB_OUTPUT")
+	}
+
+	b, err := json.Marshal(r.Res.Image)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling wait-image to GITHUB_OUTPUT JSON: %w", err)
+	}
+
+	return b, nil
+}
diff --git a/tools/pipeline/internal/pkg/metadata/metadata.go b/tools/pipeline/internal/pkg/metadata/metadata.go
new file mode 100644
index 00000000000..a6b37bfb90f
--- /dev/null
+++ b/tools/pipeline/internal/pkg/metadata/metadata.go
@@ -0,0 +1,21 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package metadata
+
+var CeEditions = []string{
+	"ce",
+	"oss",
+}
+
+var EntEditions = []string{
+	"ent",
+	"enterprise",
+	"ent.fips1402",
+	"ent.fips1403",
+	"ent.hsm",
+	"ent.hsm.fips1402",
+	"ent.hsm.fips1403",
+}
+
+var Editions = append(CeEditions, EntEditions...)
diff --git a/tools/pipeline/internal/pkg/releases/client.go b/tools/pipeline/internal/pkg/releases/client.go
new file mode 100644
index 00000000000..d82907e093c
--- /dev/null
+++ b/tools/pipeline/internal/pkg/releases/client.go
@@ -0,0 +1,210 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package releases
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"sort"
+	"time"
+
+	"github.com/Masterminds/semver"
+	"github.com/hashicorp/releases-api/pkg/api"
+	"github.com/hashicorp/releases-api/pkg/client"
+	"github.com/hashicorp/releases-api/pkg/models"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// Client is an api.releases.hashicorp.com API client.
+type Client struct {
+	Addr string
+}
+
+// VersionLister lists versions from the releases API.
+type VersionLister interface {
+	ListVersions(ctx context.Context, product string, edition LicenseClass, ceil, floor *semver.Version) ([]string, error)
+}
+
+var _ VersionLister = (*Client)(nil)
+
+type LicenseClass string
+
+// These map to the licenses classes defined by the releases API.
+const (
+	LicenseClassNone LicenseClass = ""
+	LicenseClassCE   LicenseClass = "oss"
+	LicenseClassEnt  LicenseClass = "enterprise"
+	LicenseClassHCP  LicenseClass = "hcp"
+)
+
+// NewClient returns a new releases API client.
+func NewClient() *Client {
+	return &Client{
+		Addr: "api.releases.hashicorp.com",
+	}
+}
+
+// GetRelease takes a context, product, edition, and version and returns the relase information.
+func (c *Client) GetRelease(ctx context.Context, product string, edition LicenseClass, version string) (*models.Release, error) {
+	ctx = slogctx.Append(ctx,
+		slog.String("product", product),
+		slog.String("edition", string(edition)),
+		slog.String("version", version),
+	)
+	slog.Default().DebugContext(ctx, "getting release")
+
+	rc := client.New(c.Addr, "", api.V1MimeType)
+	lc := string(edition)
+	release, _, err := rc.GetRelease(&client.GetReleaseParams{
+		Version:      version,
+		Product:      product,
+		LicenseClass: &lc,
+	})
+
+	slog.Default().DebugContext(ctx, "got release", "release", release, "error", err)
+
+	return release, err
+}
+
+// ListVersions takes a context, product, edition, a ceiling version and floor version and returns
+// all unique versions between the ceiling and floor range.
+func (c *Client) ListVersions(ctx context.Context, product string, edition LicenseClass, ceil, floor *semver.Version) ([]string, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	ctx = slogctx.Append(ctx,
+		slog.String("product", product),
+		slog.String("edition", string(edition)),
+		slog.String("ceil", ceil.String()),
+		slog.String("floor", floor.String()),
+		slog.String("addr", c.Addr),
+	)
+	slog.Default().DebugContext(ctx, "listing release versions")
+
+	// The releases API lists releases by their upload order starting by most recent, not sequentially
+	// by version. It also uses upload timestamps as a method of pagination. Since version upload
+	// lineages are all mixed up we'll have to start by listing the latest versions and work back
+	// until we've reached an upload timestamp at our floor version. To do so we'll get the created
+	// time of our floor and subtract a day which ought to give us a reasonable time floor.
+	// NOTE: This requires our floor version to actually exist.
+	floorR, err := c.GetRelease(ctx, product, edition, floor.String())
+	if err != nil {
+		return nil, fmt.Errorf("invalid floor version: %s, %w", floor.String(), err)
+	}
+	timeFloor := floorR.TimestampCreated.Add(time.Duration(-24) * time.Hour)
+
+	// We'll do the same for our ceiling but be less restrictive as to allow an infinite ceiling.
+	// If the ceiling versions exists we'll use it as our initial time ceiling, otherwise we'll
+	// set it to the current time.
+	var after time.Time
+	ceilR, err := c.GetRelease(ctx, product, edition, ceil.String())
+	if err == nil {
+		after = ceilR.TimestampCreated
+	} else {
+		after = time.Now()
+	}
+
+	versions := []string{}
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		default:
+		}
+
+		slog.Default().DebugContext(ctx, "listing releases", "after", after, "limit", 20)
+		rc := client.New(c.Addr, "", api.V1MimeType)
+		releases, _, err := rc.ListReleases(&client.ListReleasesParams{
+			Product:        product,
+			AfterTimestamp: after,
+			Limit:          20, // 20 is the max limit
+			LicenseClass:   string(edition),
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		// We've returned all that we can return
+		if len(releases) < 1 {
+			break
+		}
+
+		// Select any release verions that are within our desired range
+		releaseVersions, err := selectReleaseVersions(releases, ceil, floor)
+		if err != nil {
+			return nil, err
+		}
+		versions = append(versions, releaseVersions...)
+
+		// Reset our pagination and do another round
+		after = releases[len(releases)-1].TimestampCreated
+
+		// Short circuit if we've hit our time floor.
+		if timeFloor.After(after) {
+			break
+		}
+	}
+
+	versions, err = sortVersions(versions)
+	slog.Default().DebugContext(ctx, "found release versions", "versions", versions, "error", err)
+
+	return versions, err
+}
+
+func sortVersions(in []string) ([]string, error) {
+	if len(in) < 2 {
+		return in, nil
+	}
+
+	c := semver.Collection{}
+	out := []string{}
+	for _, ver := range in {
+		v, err := semver.NewVersion(ver)
+		if err != nil {
+			return nil, err
+		}
+		c = append(c, v)
+	}
+
+	sort.Sort(c)
+	for _, v := range c {
+		out = append(out, v.String())
+	}
+
+	return out, nil
+}
+
+func selectReleaseVersions(releases []*models.Release, ceil *semver.Version, floor *semver.Version) ([]string, error) {
+	versions := []string{}
+	if len(releases) < 1 {
+		return versions, nil
+	}
+
+	for _, release := range releases {
+		rv, err := semver.NewVersion(release.Version)
+		if err != nil {
+			return nil, err
+		}
+
+		if rv.GreaterThan(ceil) {
+			// We've found releases that are too new
+			continue
+		}
+
+		if rv.LessThan(floor) {
+			// We've found a release after our floor so we can skip it.
+			continue
+		}
+
+		// We're in-between
+		versions = append(versions, rv.String())
+	}
+
+	return versions, nil
+}
diff --git a/tools/pipeline/internal/pkg/releases/client_mock.go b/tools/pipeline/internal/pkg/releases/client_mock.go
new file mode 100644
index 00000000000..b3f4adb8c74
--- /dev/null
+++ b/tools/pipeline/internal/pkg/releases/client_mock.go
@@ -0,0 +1,34 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package releases
+
+import (
+	"context"
+
+	"github.com/Masterminds/semver"
+	"github.com/hashicorp/releases-api/pkg/models"
+)
+
+var _ VersionLister = (*MockClient)(nil)
+
+// MockClient is an in-memory mock of a releases API client for use in testing.
+type MockClient struct {
+	Versions []string
+}
+
+// NewMockClient takes a list of versions and returns a new mock releases API client.
+func NewMockClient(versions []string) *MockClient {
+	return &MockClient{Versions: versions}
+}
+
+// ListVersions takes a context, product, edition, a ceiling version and floor version and returns
+// all unique versions between the ceiling and floor range.
+func (m *MockClient) ListVersions(ctx context.Context, product string, edition LicenseClass, ceil, floor *semver.Version) ([]string, error) {
+	releaseVersions := []*models.Release{}
+	for _, v := range m.Versions {
+		releaseVersions = append(releaseVersions, &models.Release{Version: v})
+	}
+
+	return selectReleaseVersions(releaseVersions, ceil, floor)
+}
diff --git a/tools/pipeline/internal/pkg/releases/client_test.go b/tools/pipeline/internal/pkg/releases/client_test.go
new file mode 100644
index 00000000000..473098fd898
--- /dev/null
+++ b/tools/pipeline/internal/pkg/releases/client_test.go
@@ -0,0 +1,189 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package releases
+
+import (
+	"context"
+	"testing"
+
+	"github.com/Masterminds/semver"
+	"github.com/stretchr/testify/require"
+)
+
+var testAPIVersions = []string{
+	"1.16.10+ent.hsm.fips1402",
+	"1.16.10+ent.fips1402",
+	"1.16.10+ent.hsm",
+	"1.16.10+ent",
+	"1.17.6+ent.hsm.fips1402",
+	"1.17.6+ent.fips1402",
+	"1.17.6+ent.hsm",
+	"1.17.6+ent",
+	"1.18.0-rc1+ent.hsm.fips1402",
+	"1.18.0-rc1+ent.fips1402",
+	"1.18.0-rc1+ent.hsm",
+	"1.18.0-rc1+ent",
+	"1.17.5+ent.hsm.fips1402",
+	"1.17.5+ent.fips1402",
+	"1.17.5+ent.hsm",
+	"1.17.5+ent",
+	"1.16.9+ent.hsm.fips1402",
+	"1.16.9+ent.fips1402",
+	"1.16.9+ent.hsm",
+	"1.16.9+ent",
+	"1.17.4+ent.hsm.fips1402",
+	"1.17.4+ent.fips1402",
+	"1.17.4+ent.hsm",
+	"1.17.4+ent",
+	"1.16.8+ent.hsm.fips1402",
+	"1.16.8+ent.fips1402",
+	"1.16.8+ent.hsm",
+	"1.16.8+ent",
+	"1.17.3+ent.hsm.fips1402",
+	"1.17.3+ent.fips1402",
+	"1.17.3+ent.hsm",
+	"1.16.7+ent.hsm.fips1402",
+	"1.17.3+ent",
+	"1.16.7+ent.fips1402",
+	"1.16.7+ent.hsm",
+	"1.16.7+ent",
+	"1.17.2+ent.hsm.fips1402",
+	"1.17.2+ent.fips1402",
+	"1.17.2+ent.hsm",
+	"1.17.2+ent",
+	"1.16.6+ent.hsm.fips1402",
+	"1.16.6+ent.fips1402",
+	"1.16.6+ent.hsm",
+	"1.16.6+ent",
+}
+
+func Test_Client_ListVersions(t *testing.T) {
+	t.Parallel()
+
+	for desc, test := range map[string]struct {
+		rf func() (*semver.Version, *semver.Version)
+		e  []string
+	}{
+		"all": {
+			rf: func() (*semver.Version, *semver.Version) {
+				ceil, err := semver.NewVersion("1.18.0")
+				require.NoError(t, err)
+				floor, err := semver.NewVersion("1.15.0")
+				require.NoError(t, err)
+				return ceil, floor
+			},
+			e: testAPIVersions,
+		},
+		"high": {
+			rf: func() (*semver.Version, *semver.Version) {
+				ceil, err := semver.NewVersion("1.18.0")
+				require.NoError(t, err)
+				floor, err := semver.NewVersion("1.17.0")
+				require.NoError(t, err)
+				return ceil, floor
+			},
+			e: []string{
+				"1.17.6+ent.hsm.fips1402",
+				"1.17.6+ent.fips1402",
+				"1.17.6+ent.hsm",
+				"1.17.6+ent",
+				"1.18.0-rc1+ent.hsm.fips1402",
+				"1.18.0-rc1+ent.fips1402",
+				"1.18.0-rc1+ent.hsm",
+				"1.18.0-rc1+ent",
+				"1.17.5+ent.hsm.fips1402",
+				"1.17.5+ent.fips1402",
+				"1.17.5+ent.hsm",
+				"1.17.5+ent",
+				"1.17.4+ent.hsm.fips1402",
+				"1.17.4+ent.fips1402",
+				"1.17.4+ent.hsm",
+				"1.17.4+ent",
+				"1.17.3+ent.hsm.fips1402",
+				"1.17.3+ent.fips1402",
+				"1.17.3+ent.hsm",
+				"1.17.3+ent",
+				"1.17.2+ent.hsm.fips1402",
+				"1.17.2+ent.fips1402",
+				"1.17.2+ent.hsm",
+				"1.17.2+ent",
+			},
+		},
+		"middle": {
+			rf: func() (*semver.Version, *semver.Version) {
+				ceil, err := semver.NewVersion("1.17.4")
+				require.NoError(t, err)
+				floor, err := semver.NewVersion("1.16.7")
+				require.NoError(t, err)
+				return ceil, floor
+			},
+			e: []string{
+				"1.16.10+ent.hsm.fips1402",
+				"1.16.10+ent.fips1402",
+				"1.16.10+ent.hsm",
+				"1.16.10+ent",
+				"1.16.9+ent.hsm.fips1402",
+				"1.16.9+ent.fips1402",
+				"1.16.9+ent.hsm",
+				"1.16.9+ent",
+				"1.17.4+ent.hsm.fips1402",
+				"1.17.4+ent.fips1402",
+				"1.17.4+ent.hsm",
+				"1.17.4+ent",
+				"1.16.8+ent.hsm.fips1402",
+				"1.16.8+ent.fips1402",
+				"1.16.8+ent.hsm",
+				"1.16.8+ent",
+				"1.17.3+ent.hsm.fips1402",
+				"1.17.3+ent.fips1402",
+				"1.17.3+ent.hsm",
+				"1.16.7+ent.hsm.fips1402",
+				"1.17.3+ent",
+				"1.16.7+ent.fips1402",
+				"1.16.7+ent.hsm",
+				"1.16.7+ent",
+				"1.17.2+ent.hsm.fips1402",
+				"1.17.2+ent.fips1402",
+				"1.17.2+ent.hsm",
+				"1.17.2+ent",
+			},
+		},
+		"low": {
+			rf: func() (*semver.Version, *semver.Version) {
+				ceil, err := semver.NewVersion("1.16.9")
+				require.NoError(t, err)
+				floor, err := semver.NewVersion("1.15.3")
+				require.NoError(t, err)
+				return ceil, floor
+			},
+			e: []string{
+				"1.16.9+ent.hsm.fips1402",
+				"1.16.9+ent.fips1402",
+				"1.16.9+ent.hsm",
+				"1.16.9+ent",
+				"1.16.8+ent.hsm.fips1402",
+				"1.16.8+ent.fips1402",
+				"1.16.8+ent.hsm",
+				"1.16.8+ent",
+				"1.16.7+ent.hsm.fips1402",
+				"1.16.7+ent.fips1402",
+				"1.16.7+ent.hsm",
+				"1.16.7+ent",
+				"1.16.6+ent.hsm.fips1402",
+				"1.16.6+ent.fips1402",
+				"1.16.6+ent.hsm",
+				"1.16.6+ent",
+			},
+		},
+	} {
+		t.Run(desc, func(t *testing.T) {
+			t.Parallel()
+			client := NewMockClient(testAPIVersions)
+			ceil, floor := test.rf()
+			res, err := client.ListVersions(context.Background(), "vault", "enterprise", ceil, floor)
+			require.NoError(t, err)
+			require.EqualValues(t, test.e, res)
+		})
+	}
+}
diff --git a/tools/pipeline/internal/pkg/releases/list_active_versions.go b/tools/pipeline/internal/pkg/releases/list_active_versions.go
new file mode 100644
index 00000000000..97a6f91f7ba
--- /dev/null
+++ b/tools/pipeline/internal/pkg/releases/list_active_versions.go
@@ -0,0 +1,326 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package releases
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"maps"
+	"os"
+	"path/filepath"
+	"slices"
+
+	"github.com/hashicorp/hcl/v2"
+	"github.com/hashicorp/hcl/v2/hcldec"
+	"github.com/hashicorp/hcl/v2/hclparse"
+	"github.com/jedib0t/go-pretty/v6/table"
+	slogctx "github.com/veqryn/slog-context"
+	"github.com/zclconf/go-cty/cty"
+	"github.com/zclconf/go-cty/cty/gocty"
+)
+
+type (
+	VersionsConfig struct {
+		Schema        int            `json:"schema" cty:"schema" hcl:"schema,optional"`
+		ActiveVersion *ActiveVersion `json:"active_versions" cty:"active_versions" hcl:"active_versions"`
+	}
+	ActiveVersion struct {
+		Versions map[string]*Version `json:"versions"`
+	}
+	Version struct {
+		CEActive bool `json:"ce_active"`
+		LTS      bool `json:"lts"`
+	}
+)
+
+// ListActiveVersionsReq is a request to list the active branch versions from the
+// .release/metadata file
+type ListActiveVersionsReq struct {
+	// ReleaseVersionConfigPath is the path to the .release/versions.hcl file
+	ReleaseVersionConfigPath string
+	// The depth to recursively search backwards for a .release/versions.hcl file
+	Recurse uint
+	// Write the active versions to $GITHUB_OUTPUT
+	WriteToGithubOutput bool
+}
+
+// ListActiveVersionsRes are the active versions and associated metadata for the repo
+type ListActiveVersionsRes struct {
+	VersionsConfig *VersionsConfig `json:"versions_config,omitempty"`
+}
+
+// ListActiveVersionsGithubOutput is our GITHUB_OUTPUT type. While ListActiveVersionsReq is designed to match the schema of the releases source file, this type
+// is designed for maximal utility in Github Actions workflows and their associated built-in functions.
+type ListActiveVersionsGithubOutput struct {
+	VersionsConfig   *VersionsConfig `json:"versions_config,omitempty"`
+	Versions         []string        `json:"versions,omitempty"`
+	CEActiveVersions []string        `json:"ce_active_versions,omitempty"`
+	LTSVersions      []string        `json:"lts_versions,omitempty"`
+}
+
+var v1Schema = hcldec.ObjectSpec{
+	"schema": &hcldec.AttrSpec{
+		Name:     "schema",
+		Type:     cty.Number,
+		Required: false,
+	},
+	"active_versions": &hcldec.BlockSpec{
+		TypeName: "active_versions",
+		Nested: hcldec.ObjectSpec{
+			"version": &hcldec.BlockMapSpec{
+				TypeName:   "version",
+				LabelNames: []string{"name"},
+				Nested: hcldec.ObjectSpec{
+					"ce_active": &hcldec.AttrSpec{
+						Name:     "ce_active",
+						Type:     cty.Bool,
+						Required: false,
+					},
+					"lts": &hcldec.AttrSpec{
+						Name:     "lts",
+						Type:     cty.Bool,
+						Required: false,
+					},
+				},
+			},
+		},
+	},
+}
+
+// Run runs the dynamic configuration request
+func (l *ListActiveVersionsReq) Run(ctx context.Context) (*ListActiveVersionsRes, error) {
+	if l == nil {
+		return nil, fmt.Errorf("list active versions request is uninitialized")
+	}
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	var err error
+	res := &ListActiveVersionsRes{}
+
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("list active release versions: %w", err)
+		}
+	}()
+
+	slog.Default().DebugContext(ctx, "running list active versions request")
+
+	file, err := l.openReleaseVersions(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var bytes []byte
+	bytes, err = io.ReadAll(file)
+	if err != nil {
+		return nil, err
+	}
+
+	res.VersionsConfig, err = l.unmarshalConfig(ctx, bytes)
+
+	return res, err
+}
+
+// ToJSON marshals the response to JSON.
+func (l *ListActiveVersionsRes) ToJSON() ([]byte, error) {
+	b, err := json.Marshal(l)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling list changed files to JSON: %w", err)
+	}
+
+	return b, nil
+}
+
+// ToTable marshals the response to a text table.
+func (l *ListActiveVersionsRes) ToTable() string {
+	t := table.NewWriter()
+	t.Style().Options.DrawBorder = false
+	t.Style().Options.SeparateColumns = false
+	t.Style().Options.SeparateFooter = false
+	t.Style().Options.SeparateHeader = false
+	t.Style().Options.SeparateRows = false
+	t.AppendHeader(table.Row{"version", "ce active", "lts"})
+	for _, version := range slices.Sorted(maps.Keys(l.VersionsConfig.ActiveVersion.Versions)) {
+		values := l.VersionsConfig.ActiveVersion.Versions[version]
+		t.AppendRow(table.Row{version, values.CEActive, values.LTS})
+	}
+	return t.Render()
+}
+
+// unmarshalConfig unmarshals the bytes of version.hcl into a *VersionsConfig
+func (l *ListActiveVersionsReq) unmarshalConfig(ctx context.Context, bytes []byte) (*VersionsConfig, error) {
+	var err error
+	slog.Default().DebugContext(ctx, "unmarshaling versions.hcl")
+
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("unmarhsal versions.hcl bytes: %w", err)
+		}
+	}()
+
+	parser := hclparse.NewParser()
+	var file *hcl.File
+	var diags hcl.Diagnostics
+	file, diags = parser.ParseHCL(bytes, "versions.hcl")
+	if diags != nil && diags.HasErrors() {
+		for _, diag := range diags {
+			err = errors.Join(err, errors.New(diag.Error()))
+		}
+
+		return nil, err
+	}
+
+	val, moreDiags := hcldec.Decode(file.Body, v1Schema, nil)
+	if moreDiags != nil && moreDiags.HasErrors() {
+		for _, diag := range moreDiags {
+			err = errors.Join(err, errors.New(diag.Error()))
+		}
+		return nil, err
+	}
+
+	res := &VersionsConfig{ActiveVersion: &ActiveVersion{Versions: map[string]*Version{}}}
+	if !val.IsWhollyKnown() || !val.CanIterateElements() {
+		err = fmt.Errorf("unexpected version type: %s", val.Type().GoString())
+		return nil, err
+	}
+
+	schema, ok := val.AsValueMap()["schema"]
+	if ok && schema.IsWhollyKnown() && schema.Type().Equals(cty.Number) {
+		err = gocty.FromCtyValue(schema, &res.Schema)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	av, ok := val.AsValueMap()["active_versions"]
+	if !ok {
+		err = errors.New("no active_versions stanza found in decoded value")
+	}
+
+	for _, versions := range av.AsValueSlice() {
+		for version, versionVal := range versions.AsValueMap() {
+			v := &Version{}
+
+			for attr, val := range versionVal.AsValueMap() {
+				switch attr {
+				case "ce_active":
+					v.CEActive = val.True()
+				case "lts":
+					v.LTS = val.True()
+				default:
+					err = fmt.Errorf("unknown value: %s", attr)
+					return nil, err
+				}
+			}
+
+			res.ActiveVersion.Versions[version] = v
+		}
+	}
+
+	return res, err
+}
+
+// openReleaseVersions searches the current path and optionally recursively for
+// .release/versions.hcl and returns a file handle to it.
+func (l *ListActiveVersionsReq) openReleaseVersions(ctx context.Context) (*os.File, error) {
+	var err error
+	var file *os.File
+	var path string
+
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("open release versions: %w", err)
+		}
+	}()
+
+	if l == nil {
+		err = errors.New("uninitialized")
+		return nil, err
+	}
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	slog.Default().DebugContext(ctx, "open .release/versions.hcl")
+	if l.ReleaseVersionConfigPath != "" {
+		slog.Default().DebugContext(
+			slogctx.Append(ctx, slog.String("path", l.ReleaseVersionConfigPath)),
+			"attempting to open versions.hcl",
+		)
+
+		path, err = filepath.Abs(l.ReleaseVersionConfigPath)
+		if err != nil {
+			return nil, err
+		}
+
+		file, err = os.Open(path)
+		return file, err
+	}
+
+	path, err = os.Getwd()
+	if err != nil {
+		return nil, err
+	}
+
+	for depth := uint(0); path != string(os.PathSeparator) && depth <= l.Recurse; depth++ {
+		path = filepath.Join(path, ".release", "versions.hcl")
+		slog.Default().DebugContext(
+			slogctx.Append(ctx, slog.String("path", path), slog.Uint64("recurse", uint64(depth))),
+			"attempting to open versions.hcl",
+		)
+		file, err = os.Open(path)
+		if err == nil {
+			return file, nil
+		}
+		path, err = filepath.Abs(filepath.Dir(filepath.Dir(filepath.Dir(path))))
+		if err != nil {
+			return nil, err
+		}
+	}
+	err = errors.New("unable to locate .release/versions.hcl")
+
+	return nil, err
+}
+
+// ToGithubOutput writes a JSON encoded versions of ListActiveVersionsRes to
+// $GITHUB_OUTPUT. We use an intermediate type to structure the data in a more
+// suitable fashion to make usage within Github Actions easier.
+func (r ListActiveVersionsRes) ToGithubOutput() ([]byte, error) {
+	res := &ListActiveVersionsGithubOutput{
+		VersionsConfig:   r.VersionsConfig,
+		Versions:         slices.Sorted(maps.Keys(r.VersionsConfig.ActiveVersion.Versions)),
+		CEActiveVersions: []string{},
+		LTSVersions:      []string{},
+	}
+
+	for version, cfg := range r.VersionsConfig.ActiveVersion.Versions {
+		if cfg.CEActive {
+			res.CEActiveVersions = append(res.CEActiveVersions, version)
+		}
+		if cfg.LTS {
+			res.LTSVersions = append(res.LTSVersions, version)
+		}
+	}
+	slices.Sort(res.CEActiveVersions)
+	slices.Sort(res.LTSVersions)
+
+	b, err := json.Marshal(res)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling list active versions GITHUB_OUTPUT to JSON: %w", err)
+	}
+
+	return b, nil
+}
diff --git a/tools/pipeline/internal/pkg/releases/list_active_versions_test.go b/tools/pipeline/internal/pkg/releases/list_active_versions_test.go
new file mode 100644
index 00000000000..5b4e69c8723
--- /dev/null
+++ b/tools/pipeline/internal/pkg/releases/list_active_versions_test.go
@@ -0,0 +1,51 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package releases
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+const testVersionConfig = `
+schema = 1
+
+active_versions {
+	version "1.19.x" {
+		ce_active = true
+		lts       = true
+	}
+	version "1.18.x" {
+		ce_active = true
+	}
+	version "1.17.x" {
+		ce_active = false
+	}
+	version "1.16.x" {
+		ce_active = false
+		lts       = true
+	}
+}
+`
+
+func TestListActiveVersionReq_unmarshalConfig(t *testing.T) {
+	t.Parallel()
+
+	req := &ListActiveVersionsReq{}
+	versionsConfig, err := req.unmarshalConfig(context.Background(), []byte(testVersionConfig))
+	require.NoError(t, err)
+	require.EqualValues(t, &VersionsConfig{
+		Schema: 1,
+		ActiveVersion: &ActiveVersion{
+			Versions: map[string]*Version{
+				"1.19.x": {CEActive: true, LTS: true},
+				"1.18.x": {CEActive: true, LTS: false},
+				"1.17.x": {CEActive: false, LTS: false},
+				"1.16.x": {CEActive: false, LTS: true},
+			},
+		},
+	}, versionsConfig)
+}
diff --git a/tools/pipeline/internal/pkg/releases/list_versions.go b/tools/pipeline/internal/pkg/releases/list_versions.go
new file mode 100644
index 00000000000..2e48a347b40
--- /dev/null
+++ b/tools/pipeline/internal/pkg/releases/list_versions.go
@@ -0,0 +1,188 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package releases
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"slices"
+
+	"github.com/Masterminds/semver"
+	"github.com/hashicorp/vault/tools/pipeline/internal/pkg/metadata"
+	slogctx "github.com/veqryn/slog-context"
+)
+
+// ListVersionsReq is a request to list versions from the releases API.
+type ListVersionsReq struct {
+	UpperBound   string
+	LowerBound   string
+	NMinus       uint
+	Skip         []string
+	LicenseClass string
+	VersionLister
+}
+
+// ListVersionsRes is a list versions response.
+type ListVersionsRes struct {
+	Versions []string `json:"versions,omitempty"`
+}
+
+// NewListVersionsReq returns a new releases API version lister request.
+func NewListVersionsReq() *ListVersionsReq {
+	return &ListVersionsReq{}
+}
+
+func (req *ListVersionsReq) Validate(ctx context.Context) error {
+	if req == nil {
+		return errors.New("releases list versions req: unitialized")
+	}
+
+	// Allow callers to pass in "oss" or "ce" but always rewrite it to what the releases API expects.
+	if slices.Contains(metadata.CeEditions, req.LicenseClass) {
+		req.LicenseClass = string(LicenseClassCE)
+	}
+
+	// Allow callers to pass in any enterprise edition but always rewrite it to what the releases API
+	// expects.
+	if slices.Contains(metadata.EntEditions, req.LicenseClass) {
+		req.LicenseClass = string(LicenseClassEnt)
+	}
+
+	if req.LicenseClass != "oss" && req.LicenseClass != "enterprise" {
+		return fmt.Errorf("releases list versions req: validate: invalid license class: %s: must be 'ce' or 'enterprise'", req.LicenseClass)
+	}
+
+	if req.VersionLister == nil {
+		return errors.New("releases list versions req: no version lister has been configured")
+	}
+
+	if req.LowerBound != "" && req.NMinus != 0 {
+		return errors.New("releases list versions req: only one of a lower bound floor or nminus option can be configured")
+	}
+
+	return nil
+}
+
+func (req *ListVersionsReq) VersionRange() (*semver.Version, *semver.Version, error) {
+	ceil, err := semver.NewVersion(req.UpperBound)
+	if err != nil {
+		return nil, nil, fmt.Errorf("releases list versions req: invalid upper bound version: %w", err)
+	}
+
+	var floor *semver.Version
+
+	if req.LowerBound != "" {
+		floor, err = semver.NewVersion(req.LowerBound)
+		if err != nil {
+			return nil, nil, fmt.Errorf("releases list versions req: invalid lower bound version: %w", err)
+		}
+	} else if req.NMinus != 0 {
+		// This is quite naive. We only consider minor versions and pay no attention to whether or not
+		// going backwards should bump us back to a different major/minor version. We also do not
+		// consider preleases here at all so RC's will still go back two minor versions. In the event
+		// that we bump major versions we'll have to revisit this.
+		floor, err = semver.NewVersion(req.UpperBound)
+		if err != nil {
+			return nil, nil, fmt.Errorf("releases list versions req: invalid upper bound version: %w", err)
+		}
+
+		minor := floor.Minor() - int64(req.NMinus)
+		if minor < 0 {
+			return nil, nil, fmt.Errorf("releases list versions req: impossible nminus version, cannot subtract %d from %d", req.NMinus, floor.Minor())
+		}
+
+		// Create a new version with the new minor. Always set the patch to zero to allow for the full
+		// range.
+		nv := fmt.Sprintf("%d.%d.0", floor.Major(), minor)
+		floor, err = semver.NewVersion(nv)
+		if err != nil {
+			return nil, nil, fmt.Errorf("releases list versions req: invalid nminus version: %s", nv)
+		}
+	} else {
+		return nil, nil, fmt.Errorf("releases list versions req: no floor version or nminus has been specified")
+	}
+
+	return floor, ceil, nil
+}
+
+// Run the versions between request by determining our upper and lower version boundaries, using
+// them to get a list of versions from the configured VersionLister, and then filtering out any
+// skipped versions.
+func (req *ListVersionsReq) Run(ctx context.Context) (*ListVersionsRes, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	ctx = slogctx.Append(ctx,
+		slog.String("upper-bound", req.UpperBound),
+		slog.String("lower-bound", req.LowerBound),
+		slog.Uint64("n-minus", uint64(req.NMinus)),
+		slog.String("edition", string(req.LicenseClass)),
+		"skip", req.Skip,
+	)
+	slog.Default().DebugContext(ctx, "running releases list version request")
+
+	err := req.Validate(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	slog.Default().DebugContext(ctx, "determining version request range")
+	floor, ceil, err := req.VersionRange()
+	if err != nil {
+		return nil, err
+	}
+
+	versions, err := req.VersionLister.ListVersions(
+		ctx, "vault", LicenseClass(req.LicenseClass), ceil, floor,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	res := &ListVersionsRes{Versions: []string{}}
+	seen := map[string]struct{}{}
+
+	for _, v := range versions {
+		rv, err := semver.NewVersion(v)
+		if err != nil {
+			return nil, err
+		}
+
+		// The releases API will list all editions as seperate release versions, as it should. However,
+		// we don't make that distinction here. For our purposes we neeed a singular list of all versions
+		// on a license class basis. As such, we'll drop metadata and only focus on major, minor, patch,
+		// and prerelease.
+		nv, err := rv.SetMetadata("")
+		if err != nil {
+			return nil, fmt.Errorf("failed to unset metadata: %v", err)
+		}
+
+		// Since each enterprise version can be listed many times due to the metadata. If we've already
+		// seen this version we can move on.
+		if _, ok := seen[nv.String()]; ok {
+			continue
+		}
+		seen[nv.String()] = struct{}{}
+
+		if len(req.Skip) > 0 {
+			if slices.Contains(req.Skip, nv.String()) || slices.Contains(req.Skip, rv.String()) {
+				// We're skipping this version
+				continue
+			}
+		}
+
+		// Add it to the versions slice
+		res.Versions = append(res.Versions, nv.String())
+	}
+
+	res.Versions, err = sortVersions(res.Versions)
+	slog.Default().DebugContext(ctx, "found versions", "versions", res.Versions)
+
+	return res, err
+}
diff --git a/tools/pipeline/internal/pkg/releases/list_versions_test.go b/tools/pipeline/internal/pkg/releases/list_versions_test.go
new file mode 100644
index 00000000000..cac3689dbcc
--- /dev/null
+++ b/tools/pipeline/internal/pkg/releases/list_versions_test.go
@@ -0,0 +1,170 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package releases
+
+import (
+	"context"
+	"slices"
+	"testing"
+
+	"github.com/Masterminds/semver"
+	"github.com/stretchr/testify/require"
+)
+
+var testAllVersions = []string{
+	"1.16.6",
+	"1.16.7",
+	"1.16.8",
+	"1.16.9",
+	"1.16.10",
+	"1.17.2",
+	"1.17.3",
+	"1.17.4",
+	"1.17.5",
+	"1.17.6",
+	"1.18.0-rc1",
+}
+
+func Test_VersionReq_Run(t *testing.T) {
+	t.Parallel()
+
+	for desc, test := range map[string]struct {
+		req  *ListVersionsReq
+		res  func() *ListVersionsRes
+		fail bool
+	}{
+		"no lister": {
+			req: &ListVersionsReq{
+				LicenseClass: string(LicenseClassCE),
+				UpperBound:   "1.18.0",
+				LowerBound:   "1.15.0",
+			},
+			fail: true,
+		},
+		"all": {
+			req: &ListVersionsReq{
+				LicenseClass:  string(LicenseClassCE),
+				UpperBound:    "1.18.0",
+				LowerBound:    "1.15.0",
+				VersionLister: NewMockClient(testAPIVersions),
+			},
+			res: func() *ListVersionsRes { return &ListVersionsRes{Versions: testAllVersions} },
+		},
+		"skips": {
+			req: &ListVersionsReq{
+				LicenseClass:  string(LicenseClassCE),
+				UpperBound:    "1.18.0",
+				LowerBound:    "1.15.0",
+				Skip:          []string{"1.16.0", "1.17.1"},
+				VersionLister: NewMockClient(testAPIVersions),
+			},
+			res: func() *ListVersionsRes {
+				versions := slices.Clone(testAllVersions)
+				return &ListVersionsRes{Versions: slices.DeleteFunc(versions, func(v string) bool {
+					if v == "1.17.1" || v == "1.16.0" {
+						return true
+					}
+					return false
+				})}
+			},
+		},
+		"correct range upper and lower bound": {
+			req: &ListVersionsReq{
+				LicenseClass:  string(LicenseClassCE),
+				UpperBound:    "1.17.5",
+				LowerBound:    "1.16.4",
+				VersionLister: NewMockClient(testAPIVersions),
+			},
+			res: func() *ListVersionsRes {
+				versions := slices.Clone(testAllVersions)
+				return &ListVersionsRes{Versions: slices.DeleteFunc(versions, func(ver string) bool {
+					u, err := semver.NewVersion("1.17.5")
+					require.NoError(t, err)
+					l, err := semver.NewVersion("1.16.4")
+					require.NoError(t, err)
+					v, err := semver.NewVersion(ver)
+					require.NoError(t, err)
+					if v.GreaterThan(u) || v.LessThan(l) {
+						return true
+					}
+					return false
+				})}
+			},
+		},
+		"correct range nminus 1": {
+			req: &ListVersionsReq{
+				LicenseClass:  string(LicenseClassCE),
+				UpperBound:    "1.18.0",
+				NMinus:        1,
+				VersionLister: NewMockClient(testAPIVersions),
+			},
+			res: func() *ListVersionsRes {
+				versions := slices.Clone(testAllVersions)
+				return &ListVersionsRes{Versions: slices.DeleteFunc(versions, func(ver string) bool {
+					u, err := semver.NewVersion("1.18.0")
+					require.NoError(t, err)
+					l, err := semver.NewVersion("1.17.0")
+					require.NoError(t, err)
+					v, err := semver.NewVersion(ver)
+					require.NoError(t, err)
+					if v.GreaterThan(u) || v.LessThan(l) {
+						return true
+					}
+					return false
+				})}
+			},
+		},
+		"correct range nminus 2": {
+			req: &ListVersionsReq{
+				LicenseClass:  string(LicenseClassCE),
+				UpperBound:    "1.18.0",
+				NMinus:        2,
+				VersionLister: NewMockClient(testAPIVersions),
+			},
+			res: func() *ListVersionsRes { return &ListVersionsRes{Versions: testAllVersions} },
+		},
+		"lower and nminus": {
+			req: &ListVersionsReq{
+				LicenseClass:  string(LicenseClassEnt),
+				UpperBound:    "1.18.0",
+				LowerBound:    "1.15.0",
+				NMinus:        2,
+				VersionLister: NewMockClient(testAPIVersions),
+			},
+			res:  func() *ListVersionsRes { return &ListVersionsRes{Versions: testAllVersions} },
+			fail: true,
+		},
+		"invalid upper": {
+			req: &ListVersionsReq{
+				LicenseClass:  string(LicenseClassEnt),
+				UpperBound:    "1_18_0",
+				LowerBound:    "1.15.0",
+				VersionLister: NewMockClient(testAPIVersions),
+			},
+			res:  func() *ListVersionsRes { return &ListVersionsRes{Versions: testAllVersions} },
+			fail: true,
+		},
+		"invalid lower": {
+			req: &ListVersionsReq{
+				LicenseClass:  string(LicenseClassEnt),
+				UpperBound:    "1.18.0",
+				LowerBound:    "1_15_0",
+				VersionLister: NewMockClient(testAPIVersions),
+			},
+			res:  func() *ListVersionsRes { return &ListVersionsRes{Versions: testAllVersions} },
+			fail: true,
+		},
+	} {
+		t.Run(desc, func(t *testing.T) {
+			t.Parallel()
+			res, err := test.req.Run(context.Background())
+			if test.fail {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.EqualValues(t, test.res().Versions, res.Versions)
+		})
+	}
+}
diff --git a/tools/pipeline/main.go b/tools/pipeline/main.go
new file mode 100644
index 00000000000..75176d655fc
--- /dev/null
+++ b/tools/pipeline/main.go
@@ -0,0 +1,10 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package main
+
+import "github.com/hashicorp/vault/tools/pipeline/internal/cmd"
+
+func main() {
+	cmd.Execute()
+}
diff --git a/tools/semgrep/ci/atomic.yml b/tools/semgrep/ci/atomic.yml
index 97bad1ba858..5819b9a78ae 100644
--- a/tools/semgrep/ci/atomic.yml
+++ b/tools/semgrep/ci/atomic.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/bad-multierror-append.yml b/tools/semgrep/ci/bad-multierror-append.yml
index 166d0564ba7..a2e30d35ff5 100644
--- a/tools/semgrep/ci/bad-multierror-append.yml
+++ b/tools/semgrep/ci/bad-multierror-append.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/bad-nil-guard.yml b/tools/semgrep/ci/bad-nil-guard.yml
index 01e51d29831..ba7a0b0b0e9 100644
--- a/tools/semgrep/ci/bad-nil-guard.yml
+++ b/tools/semgrep/ci/bad-nil-guard.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/error-shadowing.yml b/tools/semgrep/ci/error-shadowing.yml
index 490a6667f5f..afe639d847d 100644
--- a/tools/semgrep/ci/error-shadowing.yml
+++ b/tools/semgrep/ci/error-shadowing.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/fmt-printf.yml b/tools/semgrep/ci/fmt-printf.yml
index 47e298ebf00..2fe673f89eb 100644
--- a/tools/semgrep/ci/fmt-printf.yml
+++ b/tools/semgrep/ci/fmt-printf.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/hashsum.yml b/tools/semgrep/ci/hashsum.yml
index 8ef8ca7f0de..c80e1bbe208 100644
--- a/tools/semgrep/ci/hashsum.yml
+++ b/tools/semgrep/ci/hashsum.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/hmac-bytes.yml b/tools/semgrep/ci/hmac-bytes.yml
index e5ce32ef2d6..e4c06373df1 100644
--- a/tools/semgrep/ci/hmac-bytes.yml
+++ b/tools/semgrep/ci/hmac-bytes.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/hmac-hash.yml b/tools/semgrep/ci/hmac-hash.yml
index 76e1e9e726f..2603ea62310 100644
--- a/tools/semgrep/ci/hmac-hash.yml
+++ b/tools/semgrep/ci/hmac-hash.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/lock-not-unlocked-on-return.yml b/tools/semgrep/ci/lock-not-unlocked-on-return.yml
similarity index 97%
rename from tools/semgrep/lock-not-unlocked-on-return.yml
rename to tools/semgrep/ci/lock-not-unlocked-on-return.yml
index 1b2e884d5f7..33a76f7735d 100644
--- a/tools/semgrep/lock-not-unlocked-on-return.yml
+++ b/tools/semgrep/ci/lock-not-unlocked-on-return.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
@@ -89,6 +89,10 @@ rules:
            ...
            return ...
          }
+      # Another lock object that returns an error
+      - pattern-not: |
+         $ERR = $LOCK.Lock()
+         ...
       # deferred unlock with release function
       - pattern-not: |
          $LOCK.Lock()
@@ -293,4 +297,4 @@ rules:
          if $COND {
            ...
            return ...
-         }    
\ No newline at end of file
+         }    
diff --git a/tools/semgrep/ci/logger-format-string.yml b/tools/semgrep/ci/logger-format-string.yml
index 136c4eb1486..092a2c778e7 100644
--- a/tools/semgrep/ci/logger-format-string.yml
+++ b/tools/semgrep/ci/logger-format-string.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/loop-time-after.yml b/tools/semgrep/ci/loop-time-after.yml
index 4104c9568e0..1f074db58ce 100644
--- a/tools/semgrep/ci/loop-time-after.yml
+++ b/tools/semgrep/ci/loop-time-after.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/loopclosure.yml b/tools/semgrep/ci/loopclosure.yml
index ce358e951b0..aabd22b3978 100644
--- a/tools/semgrep/ci/loopclosure.yml
+++ b/tools/semgrep/ci/loopclosure.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/no-nil-check.yml b/tools/semgrep/ci/no-nil-check.yml
index 00c64c3641b..021abfae0be 100644
--- a/tools/semgrep/ci/no-nil-check.yml
+++ b/tools/semgrep/ci/no-nil-check.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
@@ -99,6 +99,13 @@ rules:
               ...
           }
           ...
+      - pattern-not: |
+          $VAR, $ERR = NamespaceByID(...)
+          ...
+          if !a.includeInResponse(..., $VAR) {
+              ...
+          }
+          ...
     message: missed nil check 
     languages:
       - go
diff --git a/tools/semgrep/ci/oddifsequence.yml b/tools/semgrep/ci/oddifsequence.yml
index 8e4e12d143d..42d8e8cef12 100644
--- a/tools/semgrep/ci/oddifsequence.yml
+++ b/tools/semgrep/ci/oddifsequence.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/return-nil-error.yml b/tools/semgrep/ci/return-nil-error.yml
index 18a8bdff86a..7a5d16d88c3 100644
--- a/tools/semgrep/ci/return-nil-error.yml
+++ b/tools/semgrep/ci/return-nil-error.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/return-nil.yml b/tools/semgrep/ci/return-nil.yml
index 66fd310aa69..1726d9e6e1a 100644
--- a/tools/semgrep/ci/return-nil.yml
+++ b/tools/semgrep/ci/return-nil.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/time-parse-duration.yml b/tools/semgrep/ci/time-parse-duration.yml
index 3c1746d69f0..3dd99148b42 100644
--- a/tools/semgrep/ci/time-parse-duration.yml
+++ b/tools/semgrep/ci/time-parse-duration.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/wrongerrcall.yml b/tools/semgrep/ci/wrongerrcall.yml
index 8de9627b45a..f4b1aaed8d5 100644
--- a/tools/semgrep/ci/wrongerrcall.yml
+++ b/tools/semgrep/ci/wrongerrcall.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/ci/wronglock.yml b/tools/semgrep/ci/wronglock.yml
index 5b408b6a0fe..9054cd4e5ab 100644
--- a/tools/semgrep/ci/wronglock.yml
+++ b/tools/semgrep/ci/wronglock.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/hostport.yml b/tools/semgrep/hostport.yml
index f687ae707f2..769ebecff05 100644
--- a/tools/semgrep/hostport.yml
+++ b/tools/semgrep/hostport.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 # https://github.com/golang/go/issues/28308, from @stapelberg
diff --git a/tools/semgrep/joinpath.yml b/tools/semgrep/joinpath.yml
index bc58134f7ee..5973280f4a4 100644
--- a/tools/semgrep/joinpath.yml
+++ b/tools/semgrep/joinpath.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/logger-sprintf.yml b/tools/semgrep/logger-sprintf.yml
index a478f085b16..2ad4eb08295 100644
--- a/tools/semgrep/logger-sprintf.yml
+++ b/tools/semgrep/logger-sprintf.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/paths-with-callbacks-and-operations.yml b/tools/semgrep/paths-with-callbacks-and-operations.yml
index 33b71001200..4e9f550af2b 100644
--- a/tools/semgrep/paths-with-callbacks-and-operations.yml
+++ b/tools/semgrep/paths-with-callbacks-and-operations.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/paths-with-callbacks.yml b/tools/semgrep/paths-with-callbacks.yml
index d04a85ea3d7..0a0846120ef 100644
--- a/tools/semgrep/paths-with-callbacks.yml
+++ b/tools/semgrep/paths-with-callbacks.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/physical-storage.yml b/tools/semgrep/physical-storage.yml
index 660a7c17943..e10da3a0404 100644
--- a/tools/semgrep/physical-storage.yml
+++ b/tools/semgrep/physical-storage.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/replication-has-state.yml b/tools/semgrep/replication-has-state.yml
index d97bff49369..0b05cb03874 100644
--- a/tools/semgrep/replication-has-state.yml
+++ b/tools/semgrep/replication-has-state.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/semgrep/self-equals.yml b/tools/semgrep/self-equals.yml
index 1e43b253f8b..eccf8819e37 100644
--- a/tools/semgrep/self-equals.yml
+++ b/tools/semgrep/self-equals.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 rules:
diff --git a/tools/stubmaker/main.go b/tools/stubmaker/main.go
index 187ca219e22..72e2a5f99bd 100644
--- a/tools/stubmaker/main.go
+++ b/tools/stubmaker/main.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package main
@@ -50,15 +50,21 @@ func main() {
 		DetectDotGit: true,
 	})
 	if err != nil {
-		fatal(err)
+		if err.Error() != "repository does not exist" {
+			fatal(err)
+		}
+		repo = nil
 	}
 
-	wt, err := repo.Worktree()
-	if err != nil {
-		fatal(err)
-	}
-	if !isEnterprise(wt) {
-		return
+	var wt *git.Worktree
+	if repo != nil {
+		wt, err = repo.Worktree()
+		if err != nil {
+			fatal(err)
+		}
+		if !isEnterprise(wt) {
+			return
+		}
 	}
 
 	// Read the file and figure out if we need to do anything.
@@ -88,26 +94,28 @@ func main() {
 
 	// We'd like to write the file, but first make sure that we're not going
 	// to blow away anyone's work or overwrite a file already in git.
-	head, err := repo.Head()
-	if err != nil {
-		fatal(err)
-	}
-	obj, err := repo.Object(plumbing.AnyObject, head.Hash())
-	if err != nil {
-		fatal(err)
-	}
+	if repo != nil {
+		head, err := repo.Head()
+		if err != nil {
+			fatal(err)
+		}
+		obj, err := repo.Object(plumbing.AnyObject, head.Hash())
+		if err != nil {
+			fatal(err)
+		}
 
-	st, err := wt.Status()
-	if err != nil {
-		fatal(err)
-	}
+		st, err := wt.Status()
+		if err != nil {
+			fatal(err)
+		}
 
-	tracked, err := inGit(wt, st, obj, outputFile)
-	if err != nil {
-		fatal(err)
-	}
-	if tracked {
-		fatal(fmt.Errorf("output file %s exists in git, not overwriting", outputFile))
+		tracked, err := inGit(wt, st, obj, outputFile)
+		if err != nil {
+			fatal(err)
+		}
+		if tracked {
+			fatal(fmt.Errorf("output file %s exists in git, not overwriting", outputFile))
+		}
 	}
 
 	// Now we can finally write the file
diff --git a/tools/tools.go b/tools/tools.go
index 066198c0714..ce38306c9fe 100644
--- a/tools/tools.go
+++ b/tools/tools.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build tools
diff --git a/tools/tools.sh b/tools/tools.sh
index 5cb5717d2a9..be76c172fbf 100755
--- a/tools/tools.sh
+++ b/tools/tools.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 set -euo pipefail
@@ -11,7 +11,11 @@ repo_root() {
 
 # Install an external Go tool.
 go_install() {
-  if go install "$1"; then
+  local tags=""
+  if [ "$(go env GOOS)" == "darwin" ]; then
+    tags="netcgo"
+  fi
+  if eval CGO_ENABLED=0 go install "-tags=${tags}" \"-ldflags=-w -s\" "$1"; then
     echo "--> $1 ✔"
   else
     echo "--> $1 ✖"
@@ -34,19 +38,24 @@ check_tool() {
 install_external() {
   local tools
   # If you update this please update check_external below as well as our external tools
-  # install action ./github/actions/install-external-tools.yml
+  # install action .github/actions/install-external-tools/action.yml
+  #
+  # All tool versions should match the versions in .github/actions/install-external-tools/action.yml
+  # Protobuf tool versions should match what's in Vault's go.mod.
   tools=(
-    github.com/bufbuild/buf/cmd/buf@v1.25.0
-    github.com/favadi/protoc-go-inject-tag@latest
-    github.com/golangci/misspell/cmd/misspell@latest
-    github.com/golangci/revgrep/cmd/revgrep@latest
-    github.com/rinchsan/gosimports/cmd/gosimports@latest
-    golang.org/x/tools/cmd/goimports@latest
-    google.golang.org/protobuf/cmd/protoc-gen-go@latest
-    google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
-    gotest.tools/gotestsum@latest
-    honnef.co/go/tools/cmd/staticcheck@latest
-    mvdan.cc/gofumpt@latest
+    honnef.co/go/tools/cmd/staticcheck@v0.6.0
+    github.com/bufbuild/buf/cmd/buf@v1.45.0
+    github.com/favadi/protoc-go-inject-tag@v1.4.0
+    github.com/golangci/misspell/cmd/misspell@v0.6.0
+    github.com/golangci/revgrep/cmd/revgrep@v0.8.0
+    github.com/stevendpclark/enumer@v0.0.0-20250122154818-a42b666c3cd3
+    github.com/rinchsan/gosimports/cmd/gosimports@v0.3.8
+    golang.org/x/tools/cmd/goimports@v0.30.0
+    google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.5
+    google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
+    gotest.tools/gotestsum@v1.12.3
+    mvdan.cc/gofumpt@v0.8.0
+    mvdan.cc/sh/v3/cmd/shfmt@v3.10.0
   )
 
   echo "==> Installing external tools..."
@@ -64,6 +73,7 @@ check_external() {
   local tools
   tools=(
     buf
+    enumer
     gofumpt
     goimports
     gosimports
@@ -73,6 +83,7 @@ check_external() {
     protoc-gen-go-grpc
     protoc-go-inject-tag
     revgrep
+    shfmt
     staticcheck
   )
 
@@ -92,9 +103,9 @@ install_internal() {
   )
 
   echo "==> Installing internal tools..."
-  pushd "$(repo_root)" &> /dev/null
+  pushd "$(repo_root)/tools" &> /dev/null
   for tool in "${tools[@]}"; do
-    go_install ./tools/"$tool"
+    go_install ./"$tool"
   done
   popd &> /dev/null
 }
@@ -114,6 +125,27 @@ check_internal() {
   done
 }
 
+# Install our pipeline tools. In some cases these may require access to internal repositories so
+# they are excluded from our baseline toolset.
+install_pipeline() {
+  echo "==> Installing pipeline tools..."
+  pushd "$(repo_root)/tools/pipeline" &> /dev/null
+  if env GOPRIVATE=github.com/hashicorp go install ./...; then
+    echo "--> pipeline ✔"
+  else
+    echo "--> pipeline ✖"
+    popd &> /dev/null
+    return 1
+  fi
+  popd &> /dev/null
+}
+
+# Check that all required pipeline tools are installed
+check_pipeline() {
+  echo "==> Checking for pipeline tools..."
+  check_tool pipeline pipeline
+}
+
 # Install tools.
 install() {
   install_internal
@@ -128,28 +160,34 @@ check() {
 
 main() {
   case $1 in
-  install-external)
-    install_external
-  ;;
-  install-internal)
-    install_internal
-  ;;
-  check-external)
-    check_external
-  ;;
-  check-internal)
-    check_internal
-  ;;
-  install)
-    install
-  ;;
-  check)
-    check
-  ;;
-  *)
-    echo "unknown sub-command" >&2
-    exit 1
-  ;;
+    install-external)
+      install_external
+      ;;
+    install-internal)
+      install_internal
+      ;;
+    install-pipeline)
+      install_pipeline
+      ;;
+    check-external)
+      check_external
+      ;;
+    check-internal)
+      check_internal
+      ;;
+    check-pipeline)
+      check_pipeline
+      ;;
+    install)
+      install
+      ;;
+    check)
+      check
+      ;;
+    *)
+      echo "unknown sub-command" >&2
+      exit 1
+      ;;
   esac
 }
 
diff --git a/ui/.eslintignore b/ui/.eslintignore
index c352da9c77b..15e0f49f2f4 100644
--- a/ui/.eslintignore
+++ b/ui/.eslintignore
@@ -1,10 +1,11 @@
 # unconventional js
 /blueprints/*/files/
-/vendor/
 
 # compiled output
 /dist/
 /tmp/
+/vault-reporting/
+/vendor/
 
 # dependencies
 /bower_components/
@@ -15,7 +16,6 @@
 /coverage/
 !.*
 .*/
-.eslintcache
 
 # ember-try
 /.node_modules.ember-try/
@@ -27,4 +27,4 @@
 /tests/helpers/vault-keys.js
 
 # typescript declaration files
-*.d.ts
+*.d.ts
\ No newline at end of file
diff --git a/ui/.eslintrc.js b/ui/.eslintrc.js
index 8ec37474d36..29ad4489ccd 100644
--- a/ui/.eslintrc.js
+++ b/ui/.eslintrc.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -68,6 +68,9 @@ module.exports = {
       // test files
       files: ['tests/**/*-test.{js,ts}'],
       extends: ['plugin:qunit/recommended'],
+      rules: {
+        'qunit/require-expect': 'off',
+      },
     },
     {
       files: ['**/*.ts'],
diff --git a/ui/.gitignore b/ui/.gitignore
index 5ba1567f70f..a2b9fce842d 100644
--- a/ui/.gitignore
+++ b/ui/.gitignore
@@ -1,27 +1,24 @@
-# See https://help.github.com/ignore-files/ for more about ignoring files.
-
 # compiled output
 /dist/
-/tmp/
+/declarations/
 
 # dependencies
-/bower_components/
 /node_modules/
 
 # misc
 /.sass-cache
+/.env*
+/.pnp*
 /.eslintcache
-/connect.lock
 /coverage/
-/libpeerconnection.log
 /npm-debug.log*
 /testem.log
 /yarn-error.log
 package-lock.json
+/docs/components/*
 
 # ember-try
 /.node_modules.ember-try/
-/bower.json.ember-try
 /npm-shrinkwrap.json.ember-try
 /package.json.ember-try
 /package-lock.json.ember-try
@@ -42,3 +39,8 @@ package-lock.json
 # copywrite tool used in pre-commit hook
 .copywrite
 
+# vendor bundle
+vendor/jsondiffpatch.umd.js
+vendor/htmlformatter.umd.js
+
+
diff --git a/ui/.prettierignore b/ui/.prettierignore
index 4178fd571e6..468b6e00d3e 100644
--- a/ui/.prettierignore
+++ b/ui/.prettierignore
@@ -1,25 +1,14 @@
 # unconventional js
 /blueprints/*/files/
-/vendor/
 
 # compiled output
 /dist/
-/tmp/
-
-# dependencies
-/bower_components/
-/node_modules/
+/vault-reporting/
 
 # misc
 /coverage/
 !.*
-.eslintcache
-.lint-todo/
+.*/
 
 # ember-try
 /.node_modules.ember-try/
-/bower.json.ember-try
-/npm-shrinkwrap.json.ember-try
-/package.json.ember-try
-/package-lock.json.ember-try
-/yarn.lock.ember-try
diff --git a/ui/.prettierrc.js b/ui/.prettierrc.js
index 691cad3025e..d73c7e7faae 100644
--- a/ui/.prettierrc.js
+++ b/ui/.prettierrc.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/.stylelintignore b/ui/.stylelintignore
index a0cf71cbd18..675011f00cd 100644
--- a/ui/.stylelintignore
+++ b/ui/.stylelintignore
@@ -3,6 +3,7 @@
 
 # compiled output
 /dist/
+/vault-reporting/
 
 # addons
 /.node_modules.ember-try/
diff --git a/ui/.stylelintrc.js b/ui/.stylelintrc.js
index 4409325c3e7..ffec9ba7fb9 100644
--- a/ui/.stylelintrc.js
+++ b/ui/.stylelintrc.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/.template-lintrc.js b/ui/.template-lintrc.js
index 06692706c97..13bc9f5b373 100644
--- a/ui/.template-lintrc.js
+++ b/ui/.template-lintrc.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,11 +10,13 @@ module.exports = {
 
   rules: {
     'no-action': 'off',
-    'no-implicit-this': {
-      allow: ['supported-auth-backends'],
-    },
     'require-input-label': 'off',
     'no-array-prototype-extensions': 'off',
+    // from bump to ember-template-lint@6.0.0
+    'no-builtin-form-components': 'off',
+    'no-at-ember-render-modifiers': 'off',
+    'no-unnecessary-curly-strings': 'off',
+    'no-unnecessary-curly-parens': 'off',
   },
   overrides: [
     {
diff --git a/ui/.watchmanconfig b/ui/.watchmanconfig
index e7834e3e4f3..f9c3d8f84fb 100644
--- a/ui/.watchmanconfig
+++ b/ui/.watchmanconfig
@@ -1,3 +1,3 @@
 {
-  "ignore_dirs": ["tmp", "dist"]
+  "ignore_dirs": ["dist"]
 }
diff --git a/ui/.yarn/patches/lodash.template-npm-4.5.0-5272df3039.patch b/ui/.yarn/patches/lodash.template-npm-4.5.0-5272df3039.patch
new file mode 100644
index 00000000000..920eeb901f3
--- /dev/null
+++ b/ui/.yarn/patches/lodash.template-npm-4.5.0-5272df3039.patch
@@ -0,0 +1,45 @@
+diff --git a/index.js b/index.js
+index f051141e362679e1cc12f3dca924d8f6e7f5459b..63815c4c53412263de74fd4d779cfd198be87c8e 100644
+--- a/index.js
++++ b/index.js
+@@ -17,6 +17,9 @@ var HOT_COUNT = 800,
+ var INFINITY = 1 / 0,
+     MAX_SAFE_INTEGER = 9007199254740991;
+ 
++/** Error message constants. */
++var INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`';
++
+ /** `Object#toString` result references. */
+ var argsTag = '[object Arguments]',
+     arrayTag = '[object Array]',
+@@ -1343,6 +1346,18 @@ function keysIn(object) {
+   return isArrayLike(object) ? arrayLikeKeys(object, true) : baseKeysIn(object);
+ }
+ 
++/**
++   * Used to validate the `validate` option in `_.template` variable.
++   *
++   * Forbids characters which could potentially change the meaning of the function argument definition:
++   * - "()," (modification of function parameters)
++   * - "=" (default value)
++   * - "[]{}" (destructuring of function parameters)
++   * - "/" (beginning of a comment)
++   * - whitespace
++   */
++var reForbiddenIdentifierChars = /[()=,{}\[\]\/\s]/;
++
+ /**
+  * Creates a compiled template function that can interpolate data properties
+  * in "interpolate" delimiters, HTML-escape interpolated data properties in
+@@ -1522,6 +1537,11 @@ function template(string, options, guard) {
+   if (!variable) {
+     source = 'with (obj) {\n' + source + '\n}\n';
+   }
++  // Throw an error if a forbidden character was found in `variable`, to prevent
++  // potential command injection attacks.
++  else if (reForbiddenIdentifierChars.test(variable)) {
++    throw new Error(INVALID_TEMPL_VAR_ERROR_TEXT);
++  }
+   // Cleanup code by stripping empty strings.
+   source = (isEvaluating ? source.replace(reEmptyStringLeading, '') : source)
+     .replace(reEmptyStringMiddle, '$1')
diff --git a/ui/.yarn/releases/yarn-3.5.0.cjs b/ui/.yarn/releases/yarn-3.5.0.cjs
index 9568253ed9a..4838f1f5b2f 100755
--- a/ui/.yarn/releases/yarn-3.5.0.cjs
+++ b/ui/.yarn/releases/yarn-3.5.0.cjs
@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/.yarnrc b/ui/.yarnrc
deleted file mode 100644
index 65dab0366d6..00000000000
--- a/ui/.yarnrc
+++ /dev/null
@@ -1,6 +0,0 @@
-# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
-# yarn lockfile v1
-
-
-lastUpdateCheck 1664829239911
-yarn-path ".yarn/releases/yarn-1.22.19.js"
diff --git a/ui/.yarnrc.yml b/ui/.yarnrc.yml
index ce7cb418e8f..909a012b75c 100644
--- a/ui/.yarnrc.yml
+++ b/ui/.yarnrc.yml
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 nodeLinker: node-modules
diff --git a/ui/README.md b/ui/README.md
index a0b62150796..3d95b22f2e4 100644
--- a/ui/README.md
+++ b/ui/README.md
@@ -16,7 +16,7 @@
     - [Running Tests](#running-tests)
     - [Linting](#linting)
     - [Contributing / Best Practices](#contributing--best-practices)
-    - [Further Reading / Useful Links](#further-reading--useful-links)
+  - [Further Reading / Useful Links](#further-reading--useful-links)
 
 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
 
@@ -24,19 +24,19 @@
 
 This README outlines the details of collaborating on this Ember application.
 
-## Ember CLI Version Upgrade Matrix
+## Ember Version Upgrade Matrix
 
-| Vault Version | Ember Version |
-| ------------- | ------------- |
-| 1.15.x        | 4.12.0        |
-| 1.14.x        | 4.4.0         |
-| 1.13.x        | 4.4.0         |
-| 1.12.x        | 3.28.5        |
-| 1.11.x        | 3.28.5        |
-| 1.10.x        | 3.28.5        |
-| 1.9.x         | 3.22.0        |
-| 1.8.x         | 3.22.0        |
-| 1.7.x         | 3.11.0        |
+Respective versions for `ember-cli`, `ember-source` and `ember-data` for each version of Vault that contains an upgrade.
+
+| Vault Version | Ember CLI | Ember Source | Ember Data |
+| ------------- | --------- | ------------ | ---------- |
+| 1.19.x        | 5.8.0     | 5.8.0        | 5.3.2      |
+| 1.17.x        | 5.4.2     | 5.4.0        | 4.12.4     |
+| 1.15.x        | 4.12.1    | 4.12.0       | 4.11.3     |
+| 1.13.x        | 4.4.0     | 4.4.4        | 4.5.0      |
+| 1.11.x        | 3.28.5    | 3.28.10      | 3.28.6     |
+| 1.10.x        | 3.24.0    | 3.24.7       | 3.24.0     |
+| 1.9.x         | 3.22.0    | 3.22.0       | 3.22.0     |
 
 ## Prerequisites
 
@@ -54,7 +54,7 @@ in the `.yarn/releases` folder. To update to a different version of `yarn`, use
 ## Running a Vault Server
 
 Before running Vault UI locally, a Vault server must be running. First, ensure
-Vault dev is built according the the instructions in `../README.md`.
+Vault dev is built according the instructions in `../README.md`.
 
 - To start a single local Vault server: `yarn vault`
 - To start a local Vault cluster: `yarn vault:cluster`
@@ -88,10 +88,13 @@ _All of the commands below assume you're in the `ui/` directory._
 [Mirage](https://miragejs.com/docs/getting-started/introduction/) can be helpful for mocking backend endpoints.
 Look in [mirage/handlers](mirage/handlers/) for existing mocked backends.
 
-Run yarn with mirage: `yarn start:mirage handlername`
+Run yarn with mirage: `export MIRAGE_DEV_HANDLER=<handler> && yarn start`
 
 Where `handlername` is one of the options exported in [mirage/handlers/index](mirage/handlers/index.js)
 
+To stop using the handler, kill the yarn process (Ctrl+c) and then unset the environment variable.
+`unset MIRAGE_DEV_HANDLER`
+
 ## Building Vault UI into a Vault Binary
 
 We use the [embed](https://golang.org/pkg/embed/) package from Go >1.20 to build
@@ -109,14 +112,15 @@ setting `VAULT_UI` environment variable.
 
 ### Quick commands
 
-| Command                               | Description                                                             |
-| ------------------------------------- | ----------------------------------------------------------------------- |
-| `yarn start`                          | start the app with live reloading                                       |
-| `yarn start:mirage <handler>`         | start the app with the mocked mirage backend, with handler provided     |
-| `make static-dist && make dev-ui`     | build a Vault binary with UI assets (run from root directory not `/ui`) |
-| `ember g component foo -ir core`      | generate a component in the /addon engine                               |
-| `yarn test:quick -f='<test name>'` -s | run tests in the browser, filtering by test name                        |
-| `yarn lint:js`                        | lint javascript files                                                   |
+| Command                                           | Description                                                             |
+| ------------------------------------------------- | ----------------------------------------------------------------------- |
+| `yarn start`                                      | start the app with live reloading (vault must be running on port :8200) |
+| `export MIRAGE_DEV_HANDLER=<handler>; yarn start` | start the app with the mocked mirage backend, with handler provided     |
+| `make static-dist && make dev-ui`                 | build a Vault binary with UI assets (run from root directory not `/ui`) |
+| `ember g component foo -ir core`                  | generate a component in the /addon engine                               |
+| `yarn test:filter`                                | run non-enterprise in the browser                                       |
+| `yarn test:filter -f='<test name>'`               | run tests in the browser, filtering by test name                        |
+| `yarn lint:js`                                    | lint javascript files                                                   |
 
 ### Code Generators
 
@@ -132,13 +136,13 @@ The above command creates a template-only component by default. If you'd like to
 
 ### Running Tests
 
-Running tests will spin up a Vault dev server on port :9200 via a
-pretest script that testem (the test runner) executes. All of the
-acceptance tests then run, which proxy requests back to that server.
+Running tests will spin up a Vault dev server on port :9200 via a pretest script that testem (the test runner) executes. All of the acceptance tests then run, which proxy requests back to that server. The normal test scripts use `ember-exam` which split into parallel runs, which is excellent for speed but makes it harder to debug. So we have a custom yarn script that automatically opens all the tests in a browser, and we can pass the `-f` flag to target the test(s) we're debugging.
 
-- `yarn run test:oss`
-- `yarn run test:oss -s` to keep the test server running after the initial run.
-- `yarn run test -f="policies"` to filter the tests that are run. `-f` gets passed into
+- `yarn run test` lint & run all the tests (CI uses this)
+- `yarn run test:oss` lint & run all the non-enterprise tests (CI uses this)
+- `yarn run test:quick` run all the tests without linting
+- `yarn run test:quick-oss` run all the non-enterprise tests without linting
+- `yarn run test:filter -f="policies"` run the filtered test in the browser with no splitting. `-f` is set to `!enterprise` by default
   [QUnit's `filter` config](https://api.qunitjs.com/config/QUnit.config#qunitconfigfilter-string--default-undefined)
 
 ### Linting
@@ -161,6 +165,18 @@ Hello and thank you for contributing to the Vault UI! Below is a list of pattern
 - [css](docs/css.md)
 - [ember engines](docs/engines.md)
 
+### Updating @hashicorp-internal/vault-reporting
+
+Code regarding vault-reporting module lives in the [shared-secure-ui](https://github.com/hashicorp/shared-secure-ui) repo, and it is being used as a tarball in this repo.
+
+We use the script [update-vault-reporting-addon.sh](scripts/update-vault-reporting-addon.sh) to fetch the latest tarball from artifactory and update `package.json` accordingly. To run the script, you'll need to have [Doormat CLI](https://docs.prod.secops.hashicorp.services/doormat/cli/) and [jq](https://formulae.brew.sh/formula/jq) installed locally.
+
+Example:
+
+```
+./scripts/update-vault-reporting-addon.sh
+```
+
 ## Further Reading / Useful Links
 
 - [ember.js](https://emberjs.com/)
diff --git a/ui/app/adapters/application.js b/ui/app/adapters/application.js
index 917262d0daf..ba5d08dc331 100644
--- a/ui/app/adapters/application.js
+++ b/ui/app/adapters/application.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,6 @@ import { service } from '@ember/service';
 import { set } from '@ember/object';
 import RSVP from 'rsvp';
 import config from '../config/environment';
-import fetch from 'fetch';
 
 const { APP } = config;
 const { POLLING_URLS, NAMESPACE_ROOT_URLS } = APP;
@@ -92,7 +91,7 @@ export default RESTAdapter.extend({
         controlGroup.deleteControlGroupToken(controlGroupToken.accessor);
       }
       const [resp] = args;
-      if (resp && resp.warnings) {
+      if (resp && resp.warnings && !options.skipWarnings) {
         const flash = this.flashMessages;
         resp.warnings.forEach((message) => {
           flash.info(message);
diff --git a/ui/app/adapters/auth-config/_base.js b/ui/app/adapters/auth-config/_base.js
deleted file mode 100644
index cfb220e2864..00000000000
--- a/ui/app/adapters/auth-config/_base.js
+++ /dev/null
@@ -1,43 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ApplicationAdapter from '../application';
-
-export default ApplicationAdapter.extend({
-  namespace: '/v1/auth',
-
-  pathForType(modelType) {
-    // we want the last part of the path
-    const type = modelType.split('/').pop();
-    if (type === 'identity-accesslist' || type === 'roletag-denylist') {
-      return `tidy/${type}`;
-    }
-    return type;
-  },
-
-  buildURL(modelName, id, snapshot) {
-    const backendId = id ? id : snapshot.belongsTo('backend').id;
-    let url = `${this.namespace}/${backendId}/config`;
-    // aws has a lot more config endpoints
-    if (modelName.includes('aws')) {
-      url = `${url}/${this.pathForType(modelName)}`;
-    }
-    return url;
-  },
-
-  createRecord(store, type, snapshot) {
-    const id = snapshot.belongsTo('backend').id;
-    return this._super(...arguments).then(() => {
-      return { id };
-    });
-  },
-
-  updateRecord(store, type, snapshot) {
-    const id = snapshot.belongsTo('backend').id;
-    return this._super(...arguments).then(() => {
-      return { id };
-    });
-  },
-});
diff --git a/ui/app/adapters/auth-config/aws/client.js b/ui/app/adapters/auth-config/aws/client.js
deleted file mode 100644
index bc73b10f18f..00000000000
--- a/ui/app/adapters/auth-config/aws/client.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from '../_base';
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/aws/identity-accesslist.js b/ui/app/adapters/auth-config/aws/identity-accesslist.js
deleted file mode 100644
index bc73b10f18f..00000000000
--- a/ui/app/adapters/auth-config/aws/identity-accesslist.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from '../_base';
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/aws/roletag-denylist.js b/ui/app/adapters/auth-config/aws/roletag-denylist.js
deleted file mode 100644
index bc73b10f18f..00000000000
--- a/ui/app/adapters/auth-config/aws/roletag-denylist.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from '../_base';
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/azure.js b/ui/app/adapters/auth-config/azure.js
deleted file mode 100644
index 1a1c1a6729a..00000000000
--- a/ui/app/adapters/auth-config/azure.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from './_base';
-
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/gcp.js b/ui/app/adapters/auth-config/gcp.js
deleted file mode 100644
index 1a1c1a6729a..00000000000
--- a/ui/app/adapters/auth-config/gcp.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from './_base';
-
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/github.js b/ui/app/adapters/auth-config/github.js
deleted file mode 100644
index 1a1c1a6729a..00000000000
--- a/ui/app/adapters/auth-config/github.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from './_base';
-
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/jwt.js b/ui/app/adapters/auth-config/jwt.js
deleted file mode 100644
index aed7e4584c3..00000000000
--- a/ui/app/adapters/auth-config/jwt.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from './_base';
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/kubernetes.js b/ui/app/adapters/auth-config/kubernetes.js
deleted file mode 100644
index 1a1c1a6729a..00000000000
--- a/ui/app/adapters/auth-config/kubernetes.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from './_base';
-
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/ldap.js b/ui/app/adapters/auth-config/ldap.js
deleted file mode 100644
index 1a1c1a6729a..00000000000
--- a/ui/app/adapters/auth-config/ldap.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from './_base';
-
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/oidc.js b/ui/app/adapters/auth-config/oidc.js
deleted file mode 100644
index aed7e4584c3..00000000000
--- a/ui/app/adapters/auth-config/oidc.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from './_base';
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/okta.js b/ui/app/adapters/auth-config/okta.js
deleted file mode 100644
index 1a1c1a6729a..00000000000
--- a/ui/app/adapters/auth-config/okta.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from './_base';
-
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-config/radius.js b/ui/app/adapters/auth-config/radius.js
deleted file mode 100644
index 1a1c1a6729a..00000000000
--- a/ui/app/adapters/auth-config/radius.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from './_base';
-
-export default AuthConfig.extend();
diff --git a/ui/app/adapters/auth-method.js b/ui/app/adapters/auth-method.js
deleted file mode 100644
index 449383911bb..00000000000
--- a/ui/app/adapters/auth-method.js
+++ /dev/null
@@ -1,86 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AdapterError from '@ember-data/adapter/error';
-import { set } from '@ember/object';
-import ApplicationAdapter from './application';
-import { encodePath } from 'vault/utils/path-encoding-helpers';
-
-export default ApplicationAdapter.extend({
-  url(path) {
-    const url = `${this.buildURL()}/auth`;
-    return path ? url + '/' + encodePath(path) : url;
-  },
-
-  // used in updateRecord
-  pathForType() {
-    return 'mounts/auth';
-  },
-
-  findAll(store, type, sinceToken, snapshotRecordArray) {
-    const isUnauthenticated = snapshotRecordArray?.adapterOptions?.unauthenticated;
-    if (isUnauthenticated) {
-      const url = `/${this.urlPrefix()}/internal/ui/mounts`;
-      return this.ajax(url, 'GET', {
-        unauthenticated: true,
-      })
-        .then((result) => {
-          return {
-            data: result.data.auth,
-          };
-        })
-        .catch(() => {
-          return {
-            data: {},
-          };
-        });
-    }
-    return this.ajax(this.url(), 'GET').catch((e) => {
-      if (e instanceof AdapterError) {
-        set(e, 'policyPath', 'sys/auth');
-      }
-      throw e;
-    });
-  },
-
-  createRecord(store, type, snapshot) {
-    const serializer = store.serializerFor(type.modelName);
-    const data = serializer.serialize(snapshot);
-    const path = snapshot.attr('path');
-
-    return this.ajax(this.url(path), 'POST', { data }).then(() => {
-      // ember data doesn't like 204s if it's not a DELETE
-      data.config.id = path; // config relationship needs an id so use path for now
-      return {
-        data: { ...data, path: path + '/', id: path },
-      };
-    });
-  },
-
-  urlForDeleteRecord(id, modelName, snapshot) {
-    return this.url(snapshot.id);
-  },
-
-  exchangeOIDC(path, state, code) {
-    return this.ajax(`/v1/auth/${encodePath(path)}/oidc/callback`, 'GET', { data: { state, code } });
-  },
-
-  pollSAMLToken(path, token_poll_id, client_verifier) {
-    return this.ajax(`/v1/auth/${encodePath(path)}/token`, 'PUT', {
-      data: { token_poll_id, client_verifier },
-    });
-  },
-
-  tune(path, data) {
-    const url = `${this.buildURL()}/${this.pathForType()}/${encodePath(path)}tune`;
-    return this.ajax(url, 'POST', { data });
-  },
-
-  resetPassword(backend, username, password) {
-    // For userpass auth types only
-    const url = `/v1/auth/${encodePath(backend)}/users/${encodePath(username)}/password`;
-    return this.ajax(url, 'POST', { data: { password } });
-  },
-});
diff --git a/ui/app/adapters/aws-credential.js b/ui/app/adapters/aws-credential.js
index 948b91a6cb3..baeb85a7bb2 100644
--- a/ui/app/adapters/aws-credential.js
+++ b/ui/app/adapters/aws-credential.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,7 +16,7 @@ export default ApplicationAdapter.extend({
     if (roleType === 'iam_user') {
       method = 'GET';
     } else {
-      if (ttl !== undefined) {
+      if (ttl) {
         data.ttl = ttl;
       }
       if (roleType === 'assumed_role' && roleArn) {
diff --git a/ui/app/adapters/capabilities.js b/ui/app/adapters/capabilities.js
index 2d8a7c2e478..6f6b5a6f52c 100644
--- a/ui/app/adapters/capabilities.js
+++ b/ui/app/adapters/capabilities.js
@@ -1,29 +1,36 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import AdapterError from '@ember-data/adapter/error';
 import { set } from '@ember/object';
 import ApplicationAdapter from './application';
-import { sanitizePath } from 'core/utils/sanitize-path';
+import { sanitizePath, sanitizeStart } from 'core/utils/sanitize-path';
 
-export default ApplicationAdapter.extend({
+export default class CapabilitiesAdapter extends ApplicationAdapter {
   pathForType() {
     return 'capabilities-self';
-  },
+  }
 
-  formatPaths(path) {
+  /* 
+  users don't always have access to the capabilities-self endpoint in the current namespace,
+  this can happen when logging in to a namespace and then navigating to a child namespace.
+  adding "relativeNamespace" to the path and/or "this.namespaceService.userRootNamespace"
+  to the request header ensures we are querying capabilities-self in the user's root namespace,
+  which is where they are most likely to have their policy/permissions.
+  */
+  _formatPath(path) {
     const { relativeNamespace } = this.namespaceService;
     if (!relativeNamespace) {
-      return [path];
+      return path;
     }
     // ensure original path doesn't have leading slash
-    return [`${relativeNamespace}/${path.replace(/^\//, '')}`];
-  },
+    return `${relativeNamespace}/${sanitizeStart(path)}`;
+  }
 
   async findRecord(store, type, id) {
-    const paths = this.formatPaths(id);
+    const paths = [this._formatPath(id)];
     return this.ajax(this.buildURL(type), 'POST', {
       data: { paths },
       namespace: sanitizePath(this.namespaceService.userRootNamespace),
@@ -33,7 +40,7 @@ export default ApplicationAdapter.extend({
       }
       throw e;
     });
-  },
+  }
 
   queryRecord(store, type, query) {
     const { id } = query;
@@ -44,5 +51,33 @@ export default ApplicationAdapter.extend({
       resp.path = id;
       return resp;
     });
-  },
-});
+  }
+
+  query(store, type, query) {
+    const pathMap = query?.paths.reduce((mapping, path) => {
+      const withNs = this._formatPath(path);
+      if (withNs) {
+        mapping[withNs] = path;
+      }
+      return mapping;
+    }, {});
+
+    return this.ajax(this.buildURL(type), 'POST', {
+      data: { paths: Object.keys(pathMap) },
+      namespace: sanitizePath(this.namespaceService.userRootNamespace),
+    })
+      .then((queryResult) => {
+        if (queryResult) {
+          // send the pathMap with the response so the serializer can normalize the paths to be relative to the namespace
+          queryResult.pathMap = pathMap;
+        }
+        return queryResult;
+      })
+      .catch((e) => {
+        if (e instanceof AdapterError) {
+          set(e, 'policyPath', 'sys/capabilities-self');
+        }
+        throw e;
+      });
+  }
+}
diff --git a/ui/app/adapters/clients/activity.js b/ui/app/adapters/clients/activity.js
index 3a3b2b99866..54563f645a4 100644
--- a/ui/app/adapters/clients/activity.js
+++ b/ui/app/adapters/clients/activity.js
@@ -1,31 +1,80 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+import queryParamString from 'vault/utils/query-param-string';
 import ApplicationAdapter from '../application';
-import { formatDateObject } from 'core/utils/client-count-utils';
+import { debug } from '@ember/debug';
+import { parseJSON, isValid } from 'date-fns';
 
 export default class ActivityAdapter extends ApplicationAdapter {
-  // javascript localizes new Date() objects but all activity log data is stored in UTC
-  // create date object from user's input using Date.UTC() then send to backend as unix
-  // time params from the backend are formatted as a zulu timestamp
-  formatQueryParams(queryParams) {
-    let { start_time, end_time } = queryParams;
-    start_time = start_time.timestamp || formatDateObject(start_time);
-    end_time = end_time.timestamp || formatDateObject(end_time, true);
-    return { start_time, end_time };
+  formatQueryParams({ start_time, end_time }) {
+    const query = {};
+
+    if (start_time && isValid(parseJSON(start_time))) {
+      query.start_time = start_time;
+    }
+    if (end_time && isValid(parseJSON(end_time))) {
+      query.end_time = end_time;
+    }
+    return query;
   }
 
   queryRecord(store, type, query) {
     const url = `${this.buildURL()}/internal/counters/activity`;
-    const queryParams = this.formatQueryParams(query);
-    if (queryParams) {
-      return this.ajax(url, 'GET', { data: queryParams }).then((resp) => {
-        const response = resp || {};
-        response.id = response.request_id || 'no-data';
-        return response;
-      });
+    const options = {
+      data: this.formatQueryParams(query),
+    };
+
+    if (query?.namespace) {
+      options.namespace = query.namespace;
     }
+
+    return this.ajax(url, 'GET', options).then((resp) => {
+      const response = resp || {};
+      response.id = response.request_id || 'no-data';
+      return response;
+    });
+  }
+
+  async exportData(query) {
+    const url = `${this.buildURL()}/internal/counters/activity/export${queryParamString({
+      format: query?.format || 'csv',
+      start_time: query?.start_time ?? undefined,
+      end_time: query?.end_time ?? undefined,
+    })}`;
+    let errorMsg, httpStatus;
+    try {
+      const options = query?.namespace ? { namespace: query.namespace } : {};
+      const resp = await this.rawRequest(url, 'GET', options);
+      if (resp.status === 200) {
+        return resp.blob();
+      }
+      // If it's an empty response (eg 204), there's no data so return an error
+      errorMsg = 'No data to export in provided time range.';
+      httpStatus = resp.status;
+    } catch (e) {
+      const { errors } = await e.json();
+      errorMsg = errors?.join('. ');
+      httpStatus = e.status;
+    }
+    // counters/activity/export returns a ReadableStream so we manually handle errors here
+    // hopefully this can be improved when this file is migrated to use the api service.
+    if (errorMsg) {
+      const error = new Error(errorMsg);
+      error.httpStatus = httpStatus;
+      error.path = 'sys/internal/counters/activity/export';
+      throw error;
+    }
+  }
+
+  // Only dashboard uses findRecord, the client count dashboard uses queryRecord
+  findRecord(store, type, id) {
+    if (id !== 'clients/activity') {
+      debug(`findRecord('clients/activity') should pass 'clients/activity' as the id, you passed: '${id}'`);
+    }
+    const url = `${this.buildURL()}/internal/counters/activity`;
+    return this.ajax(url, 'GET', { skipWarnings: true });
   }
 }
diff --git a/ui/app/adapters/clients/config.js b/ui/app/adapters/clients/config.js
index 5f172c62562..4cf576ab2dc 100644
--- a/ui/app/adapters/clients/config.js
+++ b/ui/app/adapters/clients/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/clients/version-history.js b/ui/app/adapters/clients/version-history.js
index 62cf3c1de84..268379043ce 100644
--- a/ui/app/adapters/clients/version-history.js
+++ b/ui/app/adapters/clients/version-history.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/cluster.js b/ui/app/adapters/cluster.js
index 2f914bcf10d..8578a1529a3 100644
--- a/ui/app/adapters/cluster.js
+++ b/ui/app/adapters/cluster.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -21,7 +21,6 @@ const ENDPOINTS = [
   'init',
   'capabilities-self',
   'license',
-  'internal/ui/version',
 ];
 
 const REPLICATION_ENDPOINTS = {
@@ -100,12 +99,8 @@ export default ApplicationAdapter.extend({
     });
   },
 
-  fetchVersion() {
-    return this.ajax(`${this.urlFor('internal/ui/version')}`, 'GET').catch(() => ({}));
-  },
-
-  sealStatus() {
-    return this.ajax(this.urlFor('seal-status'), 'GET', { unauthenticated: true });
+  sealStatus(unauthenticated = true) {
+    return this.ajax(this.urlFor('seal-status'), 'GET', { unauthenticated });
   },
 
   seal() {
@@ -126,28 +121,6 @@ export default ApplicationAdapter.extend({
     });
   },
 
-  authenticate({ backend, data }) {
-    const { role, jwt, token, password, username, path, nonce } = data;
-    const url = this.urlForAuth(backend, username, path);
-    const verb = backend === 'token' ? 'GET' : 'POST';
-    const options = {
-      unauthenticated: true,
-    };
-    if (backend === 'token') {
-      options.headers = {
-        'X-Vault-Token': token,
-      };
-    } else if (backend === 'jwt' || backend === 'oidc') {
-      options.data = { role, jwt };
-    } else if (backend === 'okta') {
-      options.data = { password, nonce };
-    } else {
-      options.data = token ? { token, password } : { password };
-    }
-
-    return this.ajax(url, verb, options);
-  },
-
   mfaValidate({ mfa_request_id, mfa_constraints }) {
     const options = {
       data: {
@@ -174,32 +147,12 @@ export default ApplicationAdapter.extend({
   urlFor(endpoint) {
     if (!ENDPOINTS.includes(endpoint)) {
       throw new Error(
-        `Calls to a ${endpoint} endpoint are not currently allowed in the vault cluster adapater`
+        `Calls to a ${endpoint} endpoint are not currently allowed in the vault cluster adapter`
       );
     }
     return `${this.buildURL()}/${endpoint}`;
   },
 
-  urlForAuth(type, username, path) {
-    const authBackend = type.toLowerCase();
-    const authURLs = {
-      github: 'login',
-      jwt: 'login',
-      oidc: 'login',
-      userpass: `login/${encodeURIComponent(username)}`,
-      ldap: `login/${encodeURIComponent(username)}`,
-      okta: `login/${encodeURIComponent(username)}`,
-      radius: `login/${encodeURIComponent(username)}`,
-      token: 'lookup-self',
-    };
-    const urlSuffix = authURLs[authBackend];
-    const urlPrefix = path && authBackend !== 'token' ? path : authBackend;
-    if (!urlSuffix) {
-      throw new Error(`There is no auth url for ${type}.`);
-    }
-    return `/v1/auth/${urlPrefix}/${urlSuffix}`;
-  },
-
   urlForReplication(replicationMode, clusterMode, endpoint) {
     let suffix;
     const errString = `Calls to replication ${endpoint} endpoint are not currently allowed in the vault cluster adapater`;
diff --git a/ui/app/adapters/config-ui/message.js b/ui/app/adapters/config-ui/message.js
deleted file mode 100644
index 33eb9a05d78..00000000000
--- a/ui/app/adapters/config-ui/message.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ApplicationAdapter from '../application';
-
-export default class MessageAdapter extends ApplicationAdapter {
-  pathForType() {
-    return 'config/ui/custom-messages';
-  }
-
-  query(store, type, query) {
-    const { authenticated, type: messageType, active } = query;
-    const params = { authenticated, list: true };
-    if (messageType) params.type = messageType;
-    if (typeof active === 'boolean') params.active = active;
-    return super.query(store, type, params);
-  }
-
-  queryRecord(store, type, id) {
-    return this.ajax(`${this.buildURL(type)}/${id}`, 'GET');
-  }
-
-  updateRecord(store, type, snapshot) {
-    return this.ajax(`${this.buildURL(type)}/${snapshot.record.id}`, 'POST', {
-      data: this.serialize(snapshot.record),
-    });
-  }
-}
diff --git a/ui/app/adapters/console.js b/ui/app/adapters/console.js
index 6e9e1470868..a0a427ac822 100644
--- a/ui/app/adapters/console.js
+++ b/ui/app/adapters/console.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/control-group-config.js b/ui/app/adapters/control-group-config.js
index 3266777ad62..1e55ed4e64a 100644
--- a/ui/app/adapters/control-group-config.js
+++ b/ui/app/adapters/control-group-config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/control-group.js b/ui/app/adapters/control-group.js
index 1147e815ef4..8e1b6f3aa82 100644
--- a/ui/app/adapters/control-group.js
+++ b/ui/app/adapters/control-group.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/database/connection.js b/ui/app/adapters/database/connection.js
index beea13f36f2..7e673cc096c 100644
--- a/ui/app/adapters/database/connection.js
+++ b/ui/app/adapters/database/connection.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/database/credential.js b/ui/app/adapters/database/credential.js
index fb419e9ff4d..cdc215e324f 100644
--- a/ui/app/adapters/database/credential.js
+++ b/ui/app/adapters/database/credential.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/database/role.js b/ui/app/adapters/database/role.js
index 35f6ea3c4c4..8cde06c0396 100644
--- a/ui/app/adapters/database/role.js
+++ b/ui/app/adapters/database/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -144,7 +144,7 @@ export default ApplicationAdapter.extend({
   async _updateAllowedRoles(store, { role, backend, db, type = 'add' }) {
     const connection = await store.queryRecord('database/connection', { backend, id: db });
     const roles = [...(connection.allowed_roles || [])];
-    const allowedRoles = type === 'add' ? addToArray([roles, role]) : removeFromArray([roles, role]);
+    const allowedRoles = type === 'add' ? addToArray(roles, role) : removeFromArray(roles, role);
     connection.allowed_roles = allowedRoles;
     return connection.save();
   },
@@ -195,10 +195,19 @@ export default ApplicationAdapter.extend({
 
   async updateRecord(store, type, snapshot) {
     const serializer = store.serializerFor(type.modelName);
-    const data = serializer.serialize(snapshot);
+    const serializedData = serializer.serialize(snapshot);
     const roleType = snapshot.attr('type');
     const backend = snapshot.attr('backend');
     const id = snapshot.attr('name');
+    let data = {};
+    if (roleType === 'static') {
+      data = {
+        ...serializedData,
+        username: snapshot.attr('username'), // username is required for updating a static role
+      };
+    } else {
+      data = serializedData;
+    }
 
     return this.ajax(this.urlFor(backend, id, roleType), 'POST', { data }).then(() => data);
   },
diff --git a/ui/app/adapters/generated-item-list.js b/ui/app/adapters/generated-item-list.js
index 5c5d3f2e914..cb9f949fb72 100644
--- a/ui/app/adapters/generated-item-list.js
+++ b/ui/app/adapters/generated-item-list.js
@@ -1,47 +1,118 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ApplicationAdapter from './application';
-import { task } from 'ember-concurrency';
 import { service } from '@ember/service';
+import { sanitizePath } from 'core/utils/sanitize-path';
+import { encodePath } from 'vault/utils/path-encoding-helpers';
+import { tracked } from '@glimmer/tracking';
+import { getOwner } from '@ember/owner';
 
-export default ApplicationAdapter.extend({
-  store: service(),
-  namespace: 'v1',
-  urlForItem() {},
-  dynamicApiPath: '',
+export default class GeneratedItemListAdapter extends ApplicationAdapter {
+  @service store;
+  namespace = 'v1';
 
-  getDynamicApiPath: task(function* (id) {
-    // TODO: remove yield at some point.
-    const result = yield this.store.peekRecord('auth-method', id);
-    this.dynamicApiPath = result.apiPath;
-    return;
-  }),
+  // these items are set by calling getNewAdapter in the path-help service.
+  @tracked apiPath = '';
+  paths = {};
 
-  fetchByQuery: task(function* (store, query, isList) {
+  // These are the paths used for the adapter actions
+  get getPath() {
+    return this.paths.getPath || '';
+  }
+  get createPath() {
+    return this.paths.createPath || '';
+  }
+  get deletePath() {
+    return this.paths.deletePath || '';
+  }
+
+  getDynamicApiPath() {
+    const result = getOwner(this)
+      .lookup('route:vault.cluster.access.method')
+      .modelFor('vault.cluster.access.method');
+    this.apiPath = result.apiPath;
+    return result.apiPath;
+  }
+
+  async fetchByQuery(store, query, isList) {
     const { id } = query;
-    const data = {};
+    const payload = {};
     if (isList) {
-      data.list = true;
-      yield this.getDynamicApiPath.perform(id);
+      payload.list = true;
     }
+    const path = isList ? this.getDynamicApiPath(id) : '';
 
-    return this.ajax(this.urlForItem(id, isList, this.dynamicApiPath), 'GET', { data }).then((resp) => {
-      const data = {
-        id,
-        method: id,
-      };
-      return { ...resp, ...data };
-    });
-  }),
+    const resp = await this.ajax(this.urlForItem(id, isList, path), 'GET', { data: payload });
+    const data = {
+      id,
+      method: id,
+    };
+    return { ...resp, ...data };
+  }
 
   query(store, type, query) {
-    return this.fetchByQuery.perform(store, query, true);
-  },
+    return this.fetchByQuery(store, query, true);
+  }
 
   queryRecord(store, type, query) {
-    return this.fetchByQuery.perform(store, query);
-  },
-});
+    return this.fetchByQuery(store, query);
+  }
+
+  urlForItem(id, isList, dynamicApiPath) {
+    const itemType = sanitizePath(this.getPath);
+    let url;
+    id = encodePath(id);
+    // the apiPath changes when you switch between routes but the apiPath variable does not unless the model is reloaded
+    // overwrite apiPath if dynamicApiPath exist.
+    // dynamicApiPath comes from the model->adapter
+    let apiPath = this.apiPath;
+    if (dynamicApiPath) {
+      apiPath = dynamicApiPath;
+    }
+    // isList indicates whether we are viewing the list page
+    // of a top-level item such as userpass
+    if (isList) {
+      url = `${this.buildURL()}/${apiPath}${itemType}/`;
+    } else {
+      // build the URL for the show page of a nested item
+      // such as a userpass group
+      url = `${this.buildURL()}/${apiPath}${itemType}/${id}`;
+    }
+
+    return url;
+  }
+
+  urlForQueryRecord(id, modelName) {
+    return this.urlForItem(id, modelName);
+  }
+
+  urlForUpdateRecord(id) {
+    const itemType = this.createPath.slice(1, this.createPath.indexOf('{') - 1);
+    return `${this.buildURL()}/${this.apiPath}${itemType}/${id}`;
+  }
+
+  urlForCreateRecord(modelType, snapshot) {
+    const id = snapshot.record.mutableId; // computed property that returns either id or private settable _id value
+    const path = this.createPath.slice(1, this.createPath.indexOf('{') - 1);
+    return `${this.buildURL()}/${this.apiPath}${path}/${id}`;
+  }
+
+  urlForDeleteRecord(id) {
+    const path = this.deletePath.slice(1, this.deletePath.indexOf('{') - 1);
+    return `${this.buildURL()}/${this.apiPath}${path}/${id}`;
+  }
+
+  createRecord(store, type, snapshot) {
+    return super.createRecord(...arguments).then((response) => {
+      // if the server does not return an id and one has not been set on the model we need to set it manually from the mutableId value
+      if (!response?.id && !snapshot.record.id) {
+        snapshot.record.id = snapshot.record.mutableId;
+        snapshot.id = snapshot.record.id;
+      }
+      return response;
+    });
+  }
+}
diff --git a/ui/app/adapters/identity/base.js b/ui/app/adapters/identity/base.js
index b25e6456c4f..14e522e4d5b 100644
--- a/ui/app/adapters/identity/base.js
+++ b/ui/app/adapters/identity/base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/identity/entity-alias.js b/ui/app/adapters/identity/entity-alias.js
index 20d9528c809..37db60da3c8 100644
--- a/ui/app/adapters/identity/entity-alias.js
+++ b/ui/app/adapters/identity/entity-alias.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/identity/entity-merge.js b/ui/app/adapters/identity/entity-merge.js
index c42720ed64e..fbcd198574c 100644
--- a/ui/app/adapters/identity/entity-merge.js
+++ b/ui/app/adapters/identity/entity-merge.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/identity/entity.js b/ui/app/adapters/identity/entity.js
index f2201a95324..7f80235a945 100644
--- a/ui/app/adapters/identity/entity.js
+++ b/ui/app/adapters/identity/entity.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/identity/group-alias.js b/ui/app/adapters/identity/group-alias.js
index 20d9528c809..37db60da3c8 100644
--- a/ui/app/adapters/identity/group-alias.js
+++ b/ui/app/adapters/identity/group-alias.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/identity/group.js b/ui/app/adapters/identity/group.js
index 668ed48a742..bedb45782bd 100644
--- a/ui/app/adapters/identity/group.js
+++ b/ui/app/adapters/identity/group.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/keymgmt/key.js b/ui/app/adapters/keymgmt/key.js
index fa310048db2..d1765a158b9 100644
--- a/ui/app/adapters/keymgmt/key.js
+++ b/ui/app/adapters/keymgmt/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/keymgmt/provider.js b/ui/app/adapters/keymgmt/provider.js
index 3646b7d82e4..4112309c9ac 100644
--- a/ui/app/adapters/keymgmt/provider.js
+++ b/ui/app/adapters/keymgmt/provider.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/kmip/base.js b/ui/app/adapters/kmip/base.js
index afb69040b39..d0aadf23c4f 100644
--- a/ui/app/adapters/kmip/base.js
+++ b/ui/app/adapters/kmip/base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/kmip/ca.js b/ui/app/adapters/kmip/ca.js
index 730f3a70c99..3354fe22072 100644
--- a/ui/app/adapters/kmip/ca.js
+++ b/ui/app/adapters/kmip/ca.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/kmip/config.js b/ui/app/adapters/kmip/config.js
index 2c659c04a6e..a5be5e8f361 100644
--- a/ui/app/adapters/kmip/config.js
+++ b/ui/app/adapters/kmip/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,9 +16,18 @@ export default BaseAdapter.extend({
     return this._url(...arguments);
   },
   urlForCreateRecord(modelName, snapshot) {
-    return this._url(snapshot.id, modelName, snapshot);
+    const id = snapshot.record.mutableId;
+    return this._url(id, modelName, snapshot);
   },
   urlForUpdateRecord() {
     return this._url(...arguments);
   },
+
+  createRecord(store, type, snapshot) {
+    return this._super(...arguments).then(() => {
+      // saving returns a 204, return object with id to please ember-data...
+      const id = snapshot.record.mutableId;
+      return { id };
+    });
+  },
 });
diff --git a/ui/app/adapters/kmip/credential.js b/ui/app/adapters/kmip/credential.js
index a56bcc44b18..c39947eda08 100644
--- a/ui/app/adapters/kmip/credential.js
+++ b/ui/app/adapters/kmip/credential.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/kmip/role.js b/ui/app/adapters/kmip/role.js
index 9779ad67a56..5ca9e3674c8 100644
--- a/ui/app/adapters/kmip/role.js
+++ b/ui/app/adapters/kmip/role.js
@@ -1,15 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import BaseAdapter from './base';
 import { decamelize } from '@ember/string';
 import { getProperties } from '@ember/object';
+import { nonOperationFields } from 'vault/utils/model-helpers/kmip-role-fields';
 
 export default BaseAdapter.extend({
   createRecord(store, type, snapshot) {
-    const name = snapshot.id || snapshot.attr('name');
+    const name = snapshot.id || snapshot.record.role;
     const url = this._url(
       type.modelName,
       {
@@ -18,10 +19,11 @@ export default BaseAdapter.extend({
       },
       name
     );
-    return this.ajax(url, 'POST', { data: this.serialize(snapshot) }).then(() => {
+    const data = this.serialize(snapshot);
+    return this.ajax(url, 'POST', { data }).then(() => {
       return {
         id: name,
-        name,
+        role: name,
         backend: snapshot.record.backend,
         scope: snapshot.record.scope,
       };
@@ -29,7 +31,8 @@ export default BaseAdapter.extend({
   },
 
   deleteRecord(store, type, snapshot) {
-    const name = snapshot.id || snapshot.attr('name');
+    // records must always have IDs
+    const name = snapshot.id;
     const url = this._url(
       type.modelName,
       {
@@ -41,35 +44,35 @@ export default BaseAdapter.extend({
     return this.ajax(url, 'DELETE');
   },
 
+  updateRecord() {
+    return this.createRecord(...arguments);
+  },
+
   serialize(snapshot) {
     // the endpoint here won't allow sending `operation_all` and `operation_none` at the same time or with
     // other operation_ values, so we manually check for them and send an abbreviated object
     const json = snapshot.serialize();
-    const keys = snapshot.record.nonOperationFields.map(decamelize);
-    const nonOperationFields = getProperties(json, keys);
-    for (const field in nonOperationFields) {
-      if (nonOperationFields[field] == null) {
-        delete nonOperationFields[field];
+    const keys = nonOperationFields(snapshot.record.editableFields).map(decamelize);
+    const nonOp = getProperties(json, keys);
+    for (const field in nonOp) {
+      if (nonOp[field] == null) {
+        delete nonOp[field];
       }
     }
     if (json.operation_all) {
       return {
         operation_all: true,
-        ...nonOperationFields,
+        ...nonOp,
       };
     }
     if (json.operation_none) {
       return {
         operation_none: true,
-        ...nonOperationFields,
+        ...nonOp,
       };
     }
     delete json.operation_none;
     delete json.operation_all;
     return json;
   },
-
-  updateRecord() {
-    return this.createRecord(...arguments);
-  },
 });
diff --git a/ui/app/adapters/kmip/scope.js b/ui/app/adapters/kmip/scope.js
index 3f15ec52193..00bb3daf443 100644
--- a/ui/app/adapters/kmip/scope.js
+++ b/ui/app/adapters/kmip/scope.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/kubernetes/config.js b/ui/app/adapters/kubernetes/config.js
index 8175e95720e..2d67a04cb4e 100644
--- a/ui/app/adapters/kubernetes/config.js
+++ b/ui/app/adapters/kubernetes/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/kubernetes/role.js b/ui/app/adapters/kubernetes/role.js
index e41dda1d9ce..a0b0929e749 100644
--- a/ui/app/adapters/kubernetes/role.js
+++ b/ui/app/adapters/kubernetes/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/kv/config.js b/ui/app/adapters/kv/config.js
deleted file mode 100644
index ea3b8699aa4..00000000000
--- a/ui/app/adapters/kv/config.js
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ApplicationAdapter from '../application';
-export default class KvConfigAdapter extends ApplicationAdapter {
-  namespace = 'v1';
-
-  urlForFindRecord(id) {
-    return `${this.buildURL()}/${id}/config`;
-  }
-}
diff --git a/ui/app/adapters/kv/data.js b/ui/app/adapters/kv/data.js
deleted file mode 100644
index 2b68acd5a78..00000000000
--- a/ui/app/adapters/kv/data.js
+++ /dev/null
@@ -1,140 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ApplicationAdapter from '../application';
-import { kvDataPath, kvDeletePath, kvDestroyPath, kvMetadataPath, kvUndeletePath } from 'vault/utils/kv-path';
-import { assert } from '@ember/debug';
-import ControlGroupError from 'vault/lib/control-group-error';
-
-export default class KvDataAdapter extends ApplicationAdapter {
-  namespace = 'v1';
-
-  _url(fullPath) {
-    return `${this.buildURL()}/${fullPath}`;
-  }
-
-  createRecord(store, type, snapshot) {
-    const { backend, path } = snapshot.record;
-    const url = this._url(kvDataPath(backend, path));
-
-    return this.ajax(url, 'POST', { data: this.serialize(snapshot) }).then((res) => {
-      return {
-        data: {
-          id: kvDataPath(backend, path, res.data.version),
-          backend,
-          path,
-          ...res.data,
-        },
-      };
-    });
-  }
-
-  fetchWrapInfo(query) {
-    const { backend, path, version, wrapTTL } = query;
-    const id = kvDataPath(backend, path, version);
-    return this.ajax(this._url(id), 'GET', { wrapTTL }).then((resp) => resp.wrap_info);
-  }
-
-  queryRecord(store, type, query) {
-    const { backend, path, version } = query;
-    // ID is the full path for the data (including version)
-    let id = kvDataPath(backend, path, version);
-    return this.ajax(this._url(id), 'GET')
-      .then((resp) => {
-        // if no version is queried, add version from response to ID
-        // otherwise duplicate ember data models will exist in store
-        // (one with an ID that includes the version and one without)
-        if (!version) {
-          id = kvDataPath(backend, path, resp.data.metadata.version);
-        }
-        return {
-          ...resp,
-          data: {
-            id,
-            backend,
-            path,
-            ...resp.data,
-          },
-        };
-      })
-      .catch((errorOrResponse) => {
-        const baseResponse = { id, backend, path, version };
-        const errorCode = errorOrResponse.httpStatus;
-        // if it's a legitimate error - throw it!
-        if (errorOrResponse instanceof ControlGroupError) {
-          throw errorOrResponse;
-        }
-
-        if (errorCode === 403) {
-          return {
-            data: {
-              ...baseResponse,
-              fail_read_error_code: errorCode,
-            },
-          };
-        }
-
-        if (errorOrResponse.data) {
-          // in the case of a deleted/destroyed secret the API returns a 404 because { data: null }
-          // however, there could be a metadata block with important information like deletion_time
-          // handleResponse below checks 404 status codes for metadata and updates the code to 200 if it exists.
-          // we still end up in the good ol' catch() block, but instead of a 404 adapter error we've "caught"
-          // the metadata that sneakily tried to hide from us
-          return {
-            ...errorOrResponse,
-            data: {
-              ...baseResponse,
-              ...errorOrResponse.data, // includes the { metadata } key we want
-            },
-          };
-        }
-
-        // If we get here, it's probably a 404 because it doesn't exist
-        throw errorOrResponse;
-      });
-  }
-
-  /* Five types of delete operations */
-  deleteRecord(store, type, snapshot) {
-    const { backend, path } = snapshot.record;
-    const { deleteType, deleteVersions } = snapshot.adapterOptions;
-
-    if (!backend || !path) {
-      throw new Error('The request to delete or undelete is missing required attributes.');
-    }
-
-    switch (deleteType) {
-      case 'delete-latest-version':
-        return this.ajax(this._url(kvDataPath(backend, path)), 'DELETE');
-      case 'delete-version':
-        return this.ajax(this._url(kvDeletePath(backend, path)), 'POST', {
-          data: { versions: deleteVersions },
-        });
-      case 'destroy':
-        return this.ajax(this._url(kvDestroyPath(backend, path)), 'PUT', {
-          data: { versions: deleteVersions },
-        });
-      case 'undelete':
-        return this.ajax(this._url(kvUndeletePath(backend, path)), 'POST', {
-          data: { versions: deleteVersions },
-        });
-      case 'destroy-all-versions':
-        return this.ajax(this._url(kvMetadataPath(backend, path)), 'DELETE');
-      default:
-        assert(
-          'deleteType must be one of delete-latest-version, delete-version, destroy, undelete, or destroy-all-versions.'
-        );
-    }
-  }
-
-  handleResponse(status, headers, payload, requestData) {
-    // after deleting a secret version, data is null and the API returns a 404
-    // but there could be relevant metadata
-    if (status === 404 && payload.data?.metadata) {
-      return super.handleResponse(200, headers, payload, requestData);
-    }
-    return super.handleResponse(...arguments);
-  }
-}
diff --git a/ui/app/adapters/kv/metadata.js b/ui/app/adapters/kv/metadata.js
deleted file mode 100644
index ac61daf0163..00000000000
--- a/ui/app/adapters/kv/metadata.js
+++ /dev/null
@@ -1,78 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ApplicationAdapter from '../application';
-import { kvMetadataPath } from 'vault/utils/kv-path';
-
-export default class KvMetadataAdapter extends ApplicationAdapter {
-  namespace = 'v1';
-
-  _url(fullPath) {
-    return `${this.buildURL()}/${fullPath}`;
-  }
-
-  createRecord(store, type, snapshot) {
-    const { backend, path } = snapshot.record;
-    const id = kvMetadataPath(backend, path);
-    const url = this._url(id);
-    const data = this.serialize(snapshot);
-    return this.ajax(url, 'POST', { data }).then(() => {
-      return {
-        id,
-        data,
-      };
-    });
-  }
-
-  updateRecord(store, type, snapshot) {
-    const { backend, path } = snapshot.record;
-    const id = kvMetadataPath(backend, path);
-    const url = this._url(id);
-    const data = this.serialize(snapshot);
-    return this.ajax(url, 'POST', { data }).then(() => {
-      return {
-        id,
-        data,
-      };
-    });
-  }
-
-  query(store, type, query) {
-    const { backend, pathToSecret } = query;
-    // example of pathToSecret: beep/boop/
-    return this.ajax(this._url(kvMetadataPath(backend, pathToSecret)), 'GET', {
-      data: { list: true },
-    }).then((resp) => {
-      resp.backend = backend;
-      resp.path = pathToSecret;
-      return resp;
-    });
-  }
-
-  queryRecord(store, type, query) {
-    const { backend, path } = query;
-    // ID is the full path for the metadata
-    const id = kvMetadataPath(backend, path);
-    return this.ajax(this._url(id), 'GET').then((resp) => {
-      return {
-        id,
-        ...resp,
-        data: {
-          backend,
-          path,
-          ...resp.data,
-        },
-      };
-    });
-  }
-
-  // This method is only called when deleting from the LIST view. Otherwise, delete on kv/data
-  deleteRecord(store, type, snapshot) {
-    const { backend, path, fullSecretPath } = snapshot.record;
-    // fullSecretPath is used when deleting from the LIST view and is defined via the serializer
-    // path is used when deleting from the metadata details view.
-    return this.ajax(this._url(kvMetadataPath(backend, fullSecretPath || path)), 'DELETE');
-  }
-}
diff --git a/ui/app/adapters/ldap/config.js b/ui/app/adapters/ldap/config.js
index eff6205a95f..20d0a025659 100644
--- a/ui/app/adapters/ldap/config.js
+++ b/ui/app/adapters/ldap/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/ldap/library.js b/ui/app/adapters/ldap/library.js
index 66dca68e4f8..c7d460d14c6 100644
--- a/ui/app/adapters/ldap/library.js
+++ b/ui/app/adapters/ldap/library.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,23 +7,28 @@ import NamedPathAdapter from 'vault/adapters/named-path';
 import { encodePath } from 'vault/utils/path-encoding-helpers';
 
 export default class LdapLibraryAdapter extends NamedPathAdapter {
-  getURL(backend, name) {
+  // path could be the library name (full path) or just part of the path i.e. west-account/
+  _getURL(backend, path) {
     const base = `${this.buildURL()}/${encodePath(backend)}/library`;
-    return name ? `${base}/${name}` : base;
+    return path ? `${base}/${path}` : base;
   }
 
   urlForUpdateRecord(name, modelName, snapshot) {
-    return this.getURL(snapshot.attr('backend'), name);
+    // when editing the name IS the full path so we can use "name" instead of "completeLibraryName" here
+    return this._getURL(snapshot.attr('backend'), name);
   }
   urlForDeleteRecord(name, modelName, snapshot) {
-    return this.getURL(snapshot.attr('backend'), name);
+    const { backend, completeLibraryName } = snapshot.record;
+    return this._getURL(backend, completeLibraryName);
   }
 
   query(store, type, query) {
-    const { backend } = query;
-    return this.ajax(this.getURL(backend), 'GET', { data: { list: true } })
+    const { backend, path_to_library } = query;
+    // if we have a path_to_library then we're listing subdirectories at a hierarchical library path (i.e west-account/my-library)
+    const url = this._getURL(backend, path_to_library);
+    return this.ajax(url, 'GET', { data: { list: true } })
       .then((resp) => {
-        return resp.data.keys.map((name) => ({ name, backend }));
+        return resp.data.keys.map((name) => ({ name, backend, path_to_library }));
       })
       .catch((error) => {
         if (error.httpStatus === 404) {
@@ -34,11 +39,11 @@ export default class LdapLibraryAdapter extends NamedPathAdapter {
   }
   queryRecord(store, type, query) {
     const { backend, name } = query;
-    return this.ajax(this.getURL(backend, name), 'GET').then((resp) => ({ ...resp.data, backend, name }));
+    return this.ajax(this._getURL(backend, name), 'GET').then((resp) => ({ ...resp.data, backend, name }));
   }
 
   fetchStatus(backend, name) {
-    const url = `${this.getURL(backend, name)}/status`;
+    const url = `${this._getURL(backend, name)}/status`;
     return this.ajax(url, 'GET').then((resp) => {
       const statuses = [];
       for (const key in resp.data) {
@@ -53,7 +58,7 @@ export default class LdapLibraryAdapter extends NamedPathAdapter {
     });
   }
   checkOutAccount(backend, name, ttl) {
-    const url = `${this.getURL(backend, name)}/check-out`;
+    const url = `${this._getURL(backend, name)}/check-out`;
     return this.ajax(url, 'POST', { data: { ttl } }).then((resp) => {
       const { lease_id, lease_duration, renewable } = resp;
       const { service_account_name: account, password } = resp.data;
@@ -61,7 +66,7 @@ export default class LdapLibraryAdapter extends NamedPathAdapter {
     });
   }
   checkInAccount(backend, name, service_account_names) {
-    const url = `${this.getURL(backend, name)}/check-in`;
+    const url = `${this._getURL(backend, name)}/check-in`;
     return this.ajax(url, 'POST', { data: { service_account_names } }).then((resp) => resp.data);
   }
 }
diff --git a/ui/app/adapters/ldap/role.js b/ui/app/adapters/ldap/role.js
index 436f275a5a5..f80a383a47e 100644
--- a/ui/app/adapters/ldap/role.js
+++ b/ui/app/adapters/ldap/role.js
@@ -1,48 +1,91 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import NamedPathAdapter from 'vault/adapters/named-path';
+import ApplicationAdapter from 'vault/adapters/application';
 import { encodePath } from 'vault/utils/path-encoding-helpers';
 import { service } from '@ember/service';
 import AdapterError from '@ember-data/adapter/error';
+import { addManyToArray } from 'vault/helpers/add-to-array';
+import sortObjects from 'vault/utils/sort-objects';
+
+export const ldapRoleID = (type, name) => `type:${type}::name:${name}`;
+
+export default class LdapRoleAdapter extends ApplicationAdapter {
+  namespace = 'v1';
 
-export default class LdapRoleAdapter extends NamedPathAdapter {
   @service flashMessages;
 
-  getURL(backend, path, name) {
+  // we do this in the adapter because query() requests separate endpoints to fetch static and dynamic roles.
+  // it also handles some error logic and serializing (some of which is for lazyPaginatedQuery)
+  // so for consistency formatting the response here
+  _constructRecord({ backend, name, type }) {
+    // ID cannot just be the 'name' because static and dynamic roles can have identical names
+    return { id: ldapRoleID(type, name), backend, name, type };
+  }
+
+  _getURL(backend, path, name) {
     const base = `${this.buildURL()}/${encodePath(backend)}/${path}`;
     return name ? `${base}/${name}` : base;
   }
-  pathForRoleType(type, isCred) {
+
+  _pathForRoleType(type, isCred) {
     const staticPath = isCred ? 'static-cred' : 'static-role';
     const dynamicPath = isCred ? 'creds' : 'role';
     return type === 'static' ? staticPath : dynamicPath;
   }
 
-  urlForUpdateRecord(name, modelName, snapshot) {
-    const { backend, type } = snapshot.record;
-    return this.getURL(backend, this.pathForRoleType(type), name);
+  _createOrUpdate(store, modelSchema, snapshot) {
+    const { backend, name, type } = snapshot.record;
+    const data = snapshot.serialize();
+    return this.ajax(this._getURL(backend, this._pathForRoleType(type), name), 'POST', {
+      data,
+    }).then(() => {
+      // add ID to response because ember data dislikes 204s...
+      return { data: this._constructRecord({ backend, name, type }) };
+    });
+  }
+
+  createRecord() {
+    return this._createOrUpdate(...arguments);
+  }
+
+  updateRecord() {
+    return this._createOrUpdate(...arguments);
   }
-  urlForDeleteRecord(name, modelName, snapshot) {
-    const { backend, type } = snapshot.record;
-    return this.getURL(backend, this.pathForRoleType(type), name);
+
+  urlForDeleteRecord(id, modelName, snapshot) {
+    const { backend, type, completeRoleName } = snapshot.record;
+    return this._getURL(backend, this._pathForRoleType(type), completeRoleName);
   }
 
+  /* 
+    roleAncestry: { path_to_role: string; type: string };
+  */
   async query(store, type, query, recordArray, options) {
-    const { showPartialError } = options.adapterOptions || {};
+    const { showPartialError, roleAncestry } = options.adapterOptions || {};
     const { backend } = query;
-    const roles = [];
+
+    if (roleAncestry) {
+      return this._querySubdirectory(backend, roleAncestry);
+    }
+
+    return this._queryAll(backend, showPartialError);
+  }
+
+  // LIST request for all roles (static and dynamic)
+  async _queryAll(backend, showPartialError) {
+    let roles = [];
     const errors = [];
 
     for (const roleType of ['static', 'dynamic']) {
-      const url = this.getURL(backend, this.pathForRoleType(roleType));
+      const url = this._getURL(backend, this._pathForRoleType(roleType));
       try {
         const models = await this.ajax(url, 'GET', { data: { list: true } }).then((resp) => {
-          return resp.data.keys.map((name) => ({ id: name, name, backend, type: roleType }));
+          return resp.data.keys.map((name) => this._constructRecord({ backend, name, type: roleType }));
         });
-        roles.addObjects(models);
+        roles = addManyToArray(roles, models);
       } catch (error) {
         if (error.httpStatus !== 404) {
           errors.push(error);
@@ -71,16 +114,34 @@ export default class LdapRoleAdapter extends NamedPathAdapter {
     }
     // must return an object in this shape for lazyPaginatedQuery to function
     // changing the responsePath or providing the extractLazyPaginatedData serializer method causes normalizeResponse to return data: [undefined]
-    return { data: { keys: roles.sortBy('name') } };
+    return { data: { keys: sortObjects(roles, 'name') } };
   }
+
+  // LIST request for children of a hierarchical role
+  async _querySubdirectory(backend, roleAncestry) {
+    // path_to_role is the ancestral path
+    const { path_to_role, type: roleType } = roleAncestry;
+    const url = `${this._getURL(backend, this._pathForRoleType(roleType))}/${path_to_role}`;
+    const roles = await this.ajax(url, 'GET', { data: { list: true } }).then((resp) => {
+      return resp.data.keys.map((name) => ({
+        ...this._constructRecord({ backend, name, type: roleType }),
+        path_to_role, // adds path_to_role attr to ldap/role model
+      }));
+    });
+    return { data: { keys: sortObjects(roles, 'name') } };
+  }
+
   queryRecord(store, type, query) {
     const { backend, name, type: roleType } = query;
-    const url = this.getURL(backend, this.pathForRoleType(roleType), name);
-    return this.ajax(url, 'GET').then((resp) => ({ ...resp.data, backend, name, type: roleType }));
+    const url = this._getURL(backend, this._pathForRoleType(roleType), name);
+    return this.ajax(url, 'GET').then((resp) => ({
+      ...resp.data,
+      ...this._constructRecord({ backend, name, type: roleType }),
+    }));
   }
 
   fetchCredentials(backend, type, name) {
-    const url = this.getURL(backend, this.pathForRoleType(type, true), name);
+    const url = this._getURL(backend, this._pathForRoleType(type, true), name);
     return this.ajax(url, 'GET').then((resp) => {
       if (type === 'dynamic') {
         const { lease_id, lease_duration, renewable } = resp;
@@ -90,7 +151,7 @@ export default class LdapRoleAdapter extends NamedPathAdapter {
     });
   }
   rotateStaticPassword(backend, name) {
-    const url = this.getURL(backend, 'rotate-role', name);
+    const url = this._getURL(backend, 'rotate-role', name);
     return this.ajax(url, 'POST');
   }
 }
diff --git a/ui/app/adapters/lease.js b/ui/app/adapters/lease.js
index 9ccca608619..ccd2b5257c1 100644
--- a/ui/app/adapters/lease.js
+++ b/ui/app/adapters/lease.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/license.js b/ui/app/adapters/license.js
index 184a69d8f16..edba0ea2a67 100644
--- a/ui/app/adapters/license.js
+++ b/ui/app/adapters/license.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/mfa-login-enforcement.js b/ui/app/adapters/mfa-login-enforcement.js
index 8d9e331c0c5..b0103c6fc4e 100644
--- a/ui/app/adapters/mfa-login-enforcement.js
+++ b/ui/app/adapters/mfa-login-enforcement.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/mfa-method.js b/ui/app/adapters/mfa-method.js
index 3afc1f9c0c3..69b78b64caa 100644
--- a/ui/app/adapters/mfa-method.js
+++ b/ui/app/adapters/mfa-method.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/mfa-setup.js b/ui/app/adapters/mfa-setup.js
index 19edcd082f2..5246ab3b194 100644
--- a/ui/app/adapters/mfa-setup.js
+++ b/ui/app/adapters/mfa-setup.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/named-path.js b/ui/app/adapters/named-path.js
index 535cf33e3d9..6206c792429 100644
--- a/ui/app/adapters/named-path.js
+++ b/ui/app/adapters/named-path.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -30,7 +30,7 @@ export default class NamedPathAdapter extends ApplicationAdapter {
     const [store, { modelName }, snapshot] = arguments;
     const name = snapshot.attr('name');
     // throw error if user attempts to create a record with same name, otherwise POST request silently overrides (updates) the existing model
-    if (store.hasRecordForId(modelName, name)) {
+    if (store.peekRecord({ type: modelName, id: name }) !== null) {
       throw new Error(`A record already exists with the name: ${name}`);
     } else {
       return this._saveRecord(...arguments);
diff --git a/ui/app/adapters/namespace.js b/ui/app/adapters/namespace.js
index dd6a2c25c06..f23c9d55d09 100644
--- a/ui/app/adapters/namespace.js
+++ b/ui/app/adapters/namespace.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/node.js b/ui/app/adapters/node.js
index ad54a46c026..6175854c4f7 100644
--- a/ui/app/adapters/node.js
+++ b/ui/app/adapters/node.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/oidc/assignment.js b/ui/app/adapters/oidc/assignment.js
index 6ed97cabe48..a0eb5546300 100644
--- a/ui/app/adapters/oidc/assignment.js
+++ b/ui/app/adapters/oidc/assignment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/oidc/client.js b/ui/app/adapters/oidc/client.js
index 29714c1a814..75a2aaa9291 100644
--- a/ui/app/adapters/oidc/client.js
+++ b/ui/app/adapters/oidc/client.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/oidc/key.js b/ui/app/adapters/oidc/key.js
index 44c7e63c539..654b1648291 100644
--- a/ui/app/adapters/oidc/key.js
+++ b/ui/app/adapters/oidc/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/oidc/provider.js b/ui/app/adapters/oidc/provider.js
index 06bdc85850d..85820b9396d 100644
--- a/ui/app/adapters/oidc/provider.js
+++ b/ui/app/adapters/oidc/provider.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/oidc/scope.js b/ui/app/adapters/oidc/scope.js
index a5cf038f425..fd9960c288f 100644
--- a/ui/app/adapters/oidc/scope.js
+++ b/ui/app/adapters/oidc/scope.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/path-filter-config.js b/ui/app/adapters/path-filter-config.js
index d7f7fb8cf20..ef7561445b0 100644
--- a/ui/app/adapters/path-filter-config.js
+++ b/ui/app/adapters/path-filter-config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/permissions.js b/ui/app/adapters/permissions.js
index 02d9c49a27c..dd3c51df62d 100644
--- a/ui/app/adapters/permissions.js
+++ b/ui/app/adapters/permissions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,7 @@ import ApplicationAdapter from './application';
 
 export default ApplicationAdapter.extend({
   query() {
-    const namespace = this.namespaceService.userRootNamespace || this.namespaceService.path;
+    const namespace = this.namespaceService.userRootNamespace ?? this.namespaceService.path;
     return this.ajax(this.urlForQuery(), 'GET', { namespace });
   },
 
diff --git a/ui/app/adapters/pki/action.js b/ui/app/adapters/pki/action.js
index 50fdf8e595d..840b197ecd1 100644
--- a/ui/app/adapters/pki/action.js
+++ b/ui/app/adapters/pki/action.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/certificate/base.js b/ui/app/adapters/pki/certificate/base.js
index 703136bb1e2..6f05fb42a3f 100644
--- a/ui/app/adapters/pki/certificate/base.js
+++ b/ui/app/adapters/pki/certificate/base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/certificate/generate.js b/ui/app/adapters/pki/certificate/generate.js
index 1d594c0687a..66680257d49 100644
--- a/ui/app/adapters/pki/certificate/generate.js
+++ b/ui/app/adapters/pki/certificate/generate.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/certificate/sign.js b/ui/app/adapters/pki/certificate/sign.js
index 190a4dcfbd9..3443dabdebe 100644
--- a/ui/app/adapters/pki/certificate/sign.js
+++ b/ui/app/adapters/pki/certificate/sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/config/acme.js b/ui/app/adapters/pki/config/acme.js
index 24cb63dfe58..6ae9fe99d1e 100644
--- a/ui/app/adapters/pki/config/acme.js
+++ b/ui/app/adapters/pki/config/acme.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/config/base.js b/ui/app/adapters/pki/config/base.js
index f24559af58d..8692a61c1a8 100644
--- a/ui/app/adapters/pki/config/base.js
+++ b/ui/app/adapters/pki/config/base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/config/cluster.js b/ui/app/adapters/pki/config/cluster.js
index 826f49a5cc3..bcbead77777 100644
--- a/ui/app/adapters/pki/config/cluster.js
+++ b/ui/app/adapters/pki/config/cluster.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/config/crl.js b/ui/app/adapters/pki/config/crl.js
index 05abe63c035..218d7d00f21 100644
--- a/ui/app/adapters/pki/config/crl.js
+++ b/ui/app/adapters/pki/config/crl.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/config/urls.js b/ui/app/adapters/pki/config/urls.js
index a3b6e9e446b..73e7129e511 100644
--- a/ui/app/adapters/pki/config/urls.js
+++ b/ui/app/adapters/pki/config/urls.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/issuer.js b/ui/app/adapters/pki/issuer.js
index a8c2c6ca3f8..2978b4bb022 100644
--- a/ui/app/adapters/pki/issuer.js
+++ b/ui/app/adapters/pki/issuer.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/key.js b/ui/app/adapters/pki/key.js
index 5b5e55ea4a9..121559e06f9 100644
--- a/ui/app/adapters/pki/key.js
+++ b/ui/app/adapters/pki/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/role.js b/ui/app/adapters/pki/role.js
index 09b4d0efe36..07b24508bc2 100644
--- a/ui/app/adapters/pki/role.js
+++ b/ui/app/adapters/pki/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/sign-intermediate.js b/ui/app/adapters/pki/sign-intermediate.js
index 9ca77fd2211..3269e7ebe9e 100644
--- a/ui/app/adapters/pki/sign-intermediate.js
+++ b/ui/app/adapters/pki/sign-intermediate.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/pki/tidy.js b/ui/app/adapters/pki/tidy.js
index 682ecb12b82..2188523a715 100644
--- a/ui/app/adapters/pki/tidy.js
+++ b/ui/app/adapters/pki/tidy.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 import ApplicationAdapter from '../application';
diff --git a/ui/app/adapters/policy.js b/ui/app/adapters/policy.js
index 2a08f408949..aa894f2427c 100644
--- a/ui/app/adapters/policy.js
+++ b/ui/app/adapters/policy.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/policy/acl.js b/ui/app/adapters/policy/acl.js
index 421282ca9dd..c8fce1ddf76 100644
--- a/ui/app/adapters/policy/acl.js
+++ b/ui/app/adapters/policy/acl.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/policy/egp.js b/ui/app/adapters/policy/egp.js
index 421282ca9dd..c8fce1ddf76 100644
--- a/ui/app/adapters/policy/egp.js
+++ b/ui/app/adapters/policy/egp.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/policy/rgp.js b/ui/app/adapters/policy/rgp.js
index 421282ca9dd..c8fce1ddf76 100644
--- a/ui/app/adapters/policy/rgp.js
+++ b/ui/app/adapters/policy/rgp.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/raft-join.js b/ui/app/adapters/raft-join.js
index 3f5a2bcc31e..0e876f16a87 100644
--- a/ui/app/adapters/raft-join.js
+++ b/ui/app/adapters/raft-join.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/replication-mode.js b/ui/app/adapters/replication-mode.js
index 1a592f52269..17502116edd 100644
--- a/ui/app/adapters/replication-mode.js
+++ b/ui/app/adapters/replication-mode.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/role-aws.js b/ui/app/adapters/role-aws.js
index bee15d79212..89bc3247b9e 100644
--- a/ui/app/adapters/role-aws.js
+++ b/ui/app/adapters/role-aws.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -34,7 +34,7 @@ export default ApplicationAdapter.extend({
 
   deleteRecord(store, type, snapshot) {
     const { id } = snapshot;
-    return this.ajax(this.urlForRole(snapshot.record.get('backend'), id), 'DELETE');
+    return this.ajax(this.urlForRole(snapshot.record.backend, id), 'DELETE');
   },
 
   pathForType() {
diff --git a/ui/app/adapters/role-jwt.js b/ui/app/adapters/role-jwt.js
deleted file mode 100644
index 3c45115f4b0..00000000000
--- a/ui/app/adapters/role-jwt.js
+++ /dev/null
@@ -1,38 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ApplicationAdapter from './application';
-import { service } from '@ember/service';
-import { encodePath } from 'vault/utils/path-encoding-helpers';
-
-export default ApplicationAdapter.extend({
-  router: service(),
-
-  findRecord(store, type, id, snapshot) {
-    let [path, role] = JSON.parse(id);
-    path = encodePath(path);
-
-    const namespace = snapshot?.adapterOptions.namespace;
-    const url = `/v1/auth/${path}/oidc/auth_url`;
-    let redirect_uri = `${window.location.origin}${this.router.urlFor('vault.cluster.oidc-callback', {
-      auth_path: path,
-    })}`;
-
-    if (namespace) {
-      redirect_uri = `${window.location.origin}${this.router.urlFor(
-        'vault.cluster.oidc-callback',
-        { auth_path: path },
-        { queryParams: { namespace } }
-      )}`;
-    }
-
-    return this.ajax(url, 'POST', {
-      data: {
-        role,
-        redirect_uri,
-      },
-    });
-  },
-});
diff --git a/ui/app/adapters/role-saml.js b/ui/app/adapters/role-saml.js
deleted file mode 100644
index 095fbdc1a07..00000000000
--- a/ui/app/adapters/role-saml.js
+++ /dev/null
@@ -1,66 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ApplicationAdapter from './application';
-import { service } from '@ember/service';
-import { encodePath } from 'vault/utils/path-encoding-helpers';
-import { v4 as uuidv4 } from 'uuid';
-
-export default ApplicationAdapter.extend({
-  router: service(),
-
-  // generateClientChallenge generates a client challenge from a verifier.
-  // The client challenge is the base64(sha256(verifier)). The verifier is
-  // later presented to the server to obtain the resulting Vault token.
-  async generateClientChallenge(verifier) {
-    const encoder = new TextEncoder();
-    const data = encoder.encode(verifier);
-    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
-    const hashArray = new Uint8Array(hashBuffer);
-    return btoa(String.fromCharCode.apply(null, hashArray));
-  },
-
-  async findRecord(store, type, id, snapshot) {
-    let [path, role] = JSON.parse(id);
-    path = preparePathSegment(path);
-
-    // Create the ACS URL based on the cluster the UI is targeting
-    let acs_url = `${window.location.origin}/v1/`;
-    let namespace = snapshot?.adapterOptions.namespace;
-    if (namespace) {
-      namespace = preparePathSegment(namespace);
-      acs_url = acs_url.concat(namespace, '/');
-    }
-    acs_url = acs_url.concat('auth/', path, '/callback');
-
-    // Create the client verifier and challenge
-    const verifier = uuidv4();
-    const challenge = await this.generateClientChallenge(verifier);
-    // Kick off the authentication flow by generating the SSO service URL
-    // It requires the client challenge generated from the verifier. We'll
-    // later provide the verifier to match up with the challenge on the server
-    // when we poll for the Vault token by its returned token poll ID.
-    const response = await this.ajax(`/v1/auth/${path}/sso_service_url`, 'PUT', {
-      data: {
-        acs_url,
-        role,
-        client_challenge: challenge,
-        client_type: 'browser',
-      },
-    });
-    return {
-      ...response.data,
-      client_verifier: verifier,
-    };
-  },
-});
-
-// preparePathSegment prepares the given segment for being included in a URL
-// path by trimming leading and trailing forward slashes and URL encoding.
-function preparePathSegment(segment) {
-  segment = segment.replace(/^\//, '');
-  segment = segment.replace(/\/$/, '');
-  return encodePath(segment);
-}
diff --git a/ui/app/adapters/role-ssh.js b/ui/app/adapters/role-ssh.js
index 0a368415d12..4fbd56590e8 100644
--- a/ui/app/adapters/role-ssh.js
+++ b/ui/app/adapters/role-ssh.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -34,7 +34,7 @@ export default ApplicationAdapter.extend({
 
   deleteRecord(store, type, snapshot) {
     const { id } = snapshot;
-    return this.ajax(this.urlForRole(snapshot.record.get('backend'), id), 'DELETE');
+    return this.ajax(this.urlForRole(snapshot.record.backend, id), 'DELETE');
   },
 
   pathForType() {
diff --git a/ui/app/adapters/secret-engine.js b/ui/app/adapters/secret-engine.js
index e7715bf00be..174a507d897 100644
--- a/ui/app/adapters/secret-engine.js
+++ b/ui/app/adapters/secret-engine.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -87,23 +87,6 @@ export default ApplicationAdapter.extend({
     }
   },
 
-  findRecord(store, type, path, snapshot) {
-    if (snapshot.attr('type') === 'ssh') {
-      return this.ajax(`/v1/${encodePath(path)}/config/ca`, 'GET');
-    }
-    return;
-  },
-
-  queryRecord(store, type, query) {
-    if (query.type === 'aws') {
-      return this.ajax(`/v1/${encodePath(query.backend)}/config/lease`, 'GET').then((resp) => {
-        resp.path = query.backend + '/';
-        return resp;
-      });
-    }
-    return;
-  },
-
   updateRecord(store, type, snapshot) {
     const { apiPath, options, adapterMethod } = snapshot.adapterOptions;
     if (adapterMethod) {
@@ -117,18 +100,6 @@ export default ApplicationAdapter.extend({
     }
   },
 
-  saveAWSRoot(store, type, snapshot) {
-    const { data } = snapshot.adapterOptions;
-    const path = encodePath(snapshot.id);
-    return this.ajax(`/v1/${path}/config/root`, 'POST', { data });
-  },
-
-  saveAWSLease(store, type, snapshot) {
-    const { data } = snapshot.adapterOptions;
-    const path = encodePath(snapshot.id);
-    return this.ajax(`/v1/${path}/config/lease`, 'POST', { data });
-  },
-
   saveZeroAddressConfig(store, type, snapshot) {
     const path = encodePath(snapshot.id);
     const roles = store
diff --git a/ui/app/adapters/secret.js b/ui/app/adapters/secret.js
index bf47e5eadf3..f25d0a87427 100644
--- a/ui/app/adapters/secret.js
+++ b/ui/app/adapters/secret.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/secrets-engine-path.js b/ui/app/adapters/secrets-engine-path.js
index fb25f6bb4fd..4e32bb6d66b 100644
--- a/ui/app/adapters/secrets-engine-path.js
+++ b/ui/app/adapters/secrets-engine-path.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/server.js b/ui/app/adapters/server.js
index 7a1d4d8a136..afcaa3adba1 100644
--- a/ui/app/adapters/server.js
+++ b/ui/app/adapters/server.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/ssh-otp-credential.js b/ui/app/adapters/ssh-otp-credential.js
index 34839ef772a..8f7a862d2cf 100644
--- a/ui/app/adapters/ssh-otp-credential.js
+++ b/ui/app/adapters/ssh-otp-credential.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/ssh-sign.js b/ui/app/adapters/ssh-sign.js
index eb7db61648a..35522e70819 100644
--- a/ui/app/adapters/ssh-sign.js
+++ b/ui/app/adapters/ssh-sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/ssh.js b/ui/app/adapters/ssh.js
index ceebe558b99..413b752fa7f 100644
--- a/ui/app/adapters/ssh.js
+++ b/ui/app/adapters/ssh.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/sync/association.js b/ui/app/adapters/sync/association.js
index d1419a097aa..116930ce81e 100644
--- a/ui/app/adapters/sync/association.js
+++ b/ui/app/adapters/sync/association.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -76,10 +76,19 @@ export default class SyncAssociationAdapter extends ApplicationAdapter {
     );
     const url = this.buildURL(modelName, null, snapshot);
     const data = snapshot.serialize();
+    const serializer = store.serializerFor('sync/association');
+
     return this.ajax(url, 'POST', { data }).then((resp) => {
-      const id = `${data.mount}/${data.secret_name}`;
+      const association = Object.values(resp.data.associated_secrets).find((association) => {
+        return association.mount === data.mount && association.secret_name === data.secret_name;
+      });
+
+      // generate an id if an association is found
+      // (an association may not be found if the secret is being unsynced)
+      const id = association ? serializer.generateId(association) : undefined;
+
       return {
-        ...resp.data.associated_secrets[id],
+        ...association,
         id,
         destinationName: resp.data.store_name,
         destinationType: resp.data.store_type,
diff --git a/ui/app/adapters/sync/destination.js b/ui/app/adapters/sync/destination.js
index 9a0e124486f..ef4e4e7f752 100644
--- a/ui/app/adapters/sync/destination.js
+++ b/ui/app/adapters/sync/destination.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/sync/destinations/aws-sm.js b/ui/app/adapters/sync/destinations/aws-sm.js
index f046baa915a..6984f995bcf 100644
--- a/ui/app/adapters/sync/destinations/aws-sm.js
+++ b/ui/app/adapters/sync/destinations/aws-sm.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/sync/destinations/azure-kv.js b/ui/app/adapters/sync/destinations/azure-kv.js
index 3b0b61ed935..a35ea29a69d 100644
--- a/ui/app/adapters/sync/destinations/azure-kv.js
+++ b/ui/app/adapters/sync/destinations/azure-kv.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/sync/destinations/gcp-sm.js b/ui/app/adapters/sync/destinations/gcp-sm.js
index 5229562ab13..6fa4035610e 100644
--- a/ui/app/adapters/sync/destinations/gcp-sm.js
+++ b/ui/app/adapters/sync/destinations/gcp-sm.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/sync/destinations/gh.js b/ui/app/adapters/sync/destinations/gh.js
index df83b4229af..e42488c7e85 100644
--- a/ui/app/adapters/sync/destinations/gh.js
+++ b/ui/app/adapters/sync/destinations/gh.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/sync/destinations/vercel-project.js b/ui/app/adapters/sync/destinations/vercel-project.js
index 253ab72c9a2..f0062d55c58 100644
--- a/ui/app/adapters/sync/destinations/vercel-project.js
+++ b/ui/app/adapters/sync/destinations/vercel-project.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/tools.js b/ui/app/adapters/tools.js
deleted file mode 100644
index 3c7e4ab9799..00000000000
--- a/ui/app/adapters/tools.js
+++ /dev/null
@@ -1,28 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ApplicationAdapter from './application';
-
-const WRAPPING_ENDPOINTS = ['lookup', 'wrap', 'unwrap', 'rewrap'];
-const TOOLS_ENDPOINTS = ['random', 'hash'];
-
-export default ApplicationAdapter.extend({
-  toolUrlFor(action) {
-    const isWrapping = WRAPPING_ENDPOINTS.includes(action);
-    const isTool = TOOLS_ENDPOINTS.includes(action);
-    const prefix = isWrapping ? 'wrapping' : 'tools';
-    if (!isWrapping && !isTool) {
-      throw new Error(`Calls to a ${action} endpoint are not currently allowed in the tool adapter`);
-    }
-    return `${this.buildURL()}/${prefix}/${action}`;
-  },
-
-  toolAction(action, data, options = {}) {
-    const { wrapTTL, clientToken } = options;
-    const url = this.toolUrlFor(action);
-    const ajaxOptions = wrapTTL ? { data, wrapTTL, clientToken } : { data, clientToken };
-    return this.ajax(url, 'POST', ajaxOptions);
-  },
-});
diff --git a/ui/app/adapters/totp-key.js b/ui/app/adapters/totp-key.js
new file mode 100644
index 00000000000..c746b953b10
--- /dev/null
+++ b/ui/app/adapters/totp-key.js
@@ -0,0 +1,65 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import ApplicationAdapter from './application';
+import { encodePath } from 'vault/utils/path-encoding-helpers';
+import { isEmpty } from '@ember/utils';
+
+export default class TotpKeyAdapter extends ApplicationAdapter {
+  namespace = 'v1';
+
+  // TOTP keys can only be created, so no need for an update method
+  createRecord(store, type, snapshot) {
+    const { name, backend } = snapshot.record;
+    const serializer = store.serializerFor(type.modelName);
+    const data = serializer.serialize(snapshot);
+    const url = this.urlForKey(backend, name);
+
+    return this.ajax(url, 'POST', { data }).then((resp) => {
+      // Ember data doesn't like 204 responses except for DELETE method
+      const response = resp || { data: {} };
+      response.data.id = name;
+      return response;
+    });
+  }
+
+  deleteRecord(store, type, snapshot) {
+    const { id } = snapshot;
+    return this.ajax(this.urlForKey(snapshot.record.backend, id), 'DELETE');
+  }
+
+  urlForKey(backend, id) {
+    let url = `${this.buildURL()}/${encodePath(backend)}/keys`;
+
+    if (!isEmpty(id)) {
+      url = `${url}/${encodePath(id)}`;
+    }
+
+    return url;
+  }
+
+  query(store, type, query) {
+    const { backend } = query;
+    return this.ajax(this.urlForKey(backend), 'GET', { data: { list: true } }).then((resp) => {
+      resp.backend = backend;
+      return resp;
+    });
+  }
+
+  queryRecord(store, type, query) {
+    const { id, backend } = query;
+    return this.ajax(this.urlForKey(backend, id), 'GET').then((resp) => {
+      resp.id = id;
+      resp.backend = backend;
+      return resp;
+    });
+  }
+
+  generateCode(backend, id) {
+    return this.ajax(`${this.buildURL()}/${encodePath(backend)}/code/${id}`, 'GET').then((res) => {
+      return res.data;
+    });
+  }
+}
diff --git a/ui/app/adapters/transform.js b/ui/app/adapters/transform.js
index 07c90413a53..dec484c9007 100644
--- a/ui/app/adapters/transform.js
+++ b/ui/app/adapters/transform.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -33,7 +33,7 @@ export default ApplicationAdapter.extend({
 
   deleteRecord(store, type, snapshot) {
     const { id } = snapshot;
-    return this.ajax(this.urlForTransformations(snapshot.record.get('backend'), id), 'DELETE');
+    return this.ajax(this.urlForTransformations(snapshot.record.backend, id), 'DELETE');
   },
 
   pathForType() {
diff --git a/ui/app/adapters/transform/alphabet.js b/ui/app/adapters/transform/alphabet.js
index b66bc819467..b48bb4afa53 100644
--- a/ui/app/adapters/transform/alphabet.js
+++ b/ui/app/adapters/transform/alphabet.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/transform/base.js b/ui/app/adapters/transform/base.js
index bd43cbd5f71..d023c83a388 100644
--- a/ui/app/adapters/transform/base.js
+++ b/ui/app/adapters/transform/base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -36,7 +36,7 @@ export default ApplicationAdapter.extend({
 
   deleteRecord(store, type, snapshot) {
     const { id } = snapshot;
-    return this.ajax(this.url(snapshot.record.get('backend'), type.modelName, id), 'DELETE');
+    return this.ajax(this.url(snapshot.record.backend, type.modelName, id), 'DELETE');
   },
 
   url(backend, modelType, id) {
diff --git a/ui/app/adapters/transform/role.js b/ui/app/adapters/transform/role.js
index a161c522745..6a09a36838c 100644
--- a/ui/app/adapters/transform/role.js
+++ b/ui/app/adapters/transform/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/transform/template.js b/ui/app/adapters/transform/template.js
index 21dfa2c5f6c..a116ed94e99 100644
--- a/ui/app/adapters/transform/template.js
+++ b/ui/app/adapters/transform/template.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/transform/transformation.js b/ui/app/adapters/transform/transformation.js
index 0bd7634d808..4f7f3a1fa2e 100644
--- a/ui/app/adapters/transform/transformation.js
+++ b/ui/app/adapters/transform/transformation.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/adapters/transit-key.js b/ui/app/adapters/transit-key.js
index 3009808cf24..2282a11ffc7 100644
--- a/ui/app/adapters/transit-key.js
+++ b/ui/app/adapters/transit-key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,7 +14,7 @@ export default ApplicationAdapter.extend({
     const serializer = store.serializerFor(type.modelName);
     const data = serializer.serialize(snapshot, requestType);
     const name = snapshot.attr('name');
-    let url = this.urlForSecret(snapshot.record.get('backend'), name);
+    let url = this.urlForSecret(snapshot.record.backend, name);
     if (requestType === 'update') {
       url = url + '/config';
     }
@@ -36,7 +36,7 @@ export default ApplicationAdapter.extend({
 
   deleteRecord(store, type, snapshot) {
     const { id } = snapshot;
-    return this.ajax(this.urlForSecret(snapshot.record.get('backend'), id), 'DELETE');
+    return this.ajax(this.urlForSecret(snapshot.record.backend, id), 'DELETE');
   },
 
   pathForType(type) {
diff --git a/ui/app/app.js b/ui/app/app.js
index 38b93d6b042..14731e97e85 100644
--- a/ui/app/app.js
+++ b/ui/app/app.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,24 +13,35 @@ export default class App extends Application {
   podModulePrefix = config.podModulePrefix;
   Resolver = Resolver;
   engines = {
-    configUi: {
+    'config-ui': {
       dependencies: {
-        services: ['auth', 'flash-messages', 'namespace', 'router', 'store', 'version', 'customMessages'],
+        services: [
+          'auth',
+          'flash-messages',
+          'namespace',
+          { 'app-router': 'router' },
+          'pagination',
+          'version',
+          'custom-messages',
+          'api',
+          'capabilities',
+        ],
       },
     },
-    openApiExplorer: {
+    'open-api-explorer': {
       dependencies: {
-        services: ['auth', 'flash-messages', 'namespace', 'router', 'version'],
+        services: ['auth', 'flash-messages', 'namespace', { 'app-router': 'router' }, 'version'],
       },
     },
     replication: {
       dependencies: {
         services: [
           'auth',
+          'capabilities',
           'flash-messages',
           'namespace',
           'replication-mode',
-          'router',
+          { 'app-router': 'router' },
           'store',
           'version',
           '-portal',
@@ -49,8 +60,9 @@ export default class App extends Application {
           'flash-messages',
           'namespace',
           'path-help',
-          'router',
+          { 'app-router': 'router' },
           'store',
+          'pagination',
           'version',
           'secret-mount-path',
         ],
@@ -61,7 +73,7 @@ export default class App extends Application {
     },
     kubernetes: {
       dependencies: {
-        services: ['router', 'store', 'secret-mount-path', 'flash-messages'],
+        services: [{ 'app-router': 'router' }, 'store', 'secret-mount-path', 'flash-messages'],
         externalRoutes: {
           secrets: 'vault.cluster.secrets.backends',
         },
@@ -69,7 +81,14 @@ export default class App extends Application {
     },
     ldap: {
       dependencies: {
-        services: ['router', 'store', 'secret-mount-path', 'flash-messages', 'auth'],
+        services: [
+          { 'app-router': 'router' },
+          'store',
+          'pagination',
+          'secret-mount-path',
+          'flash-messages',
+          'auth',
+        ],
         externalRoutes: {
           secrets: 'vault.cluster.secrets.backends',
         },
@@ -78,13 +97,16 @@ export default class App extends Application {
     kv: {
       dependencies: {
         services: [
+          'api',
+          'capabilities',
+          'control-group',
           'download',
+          'flash-messages',
           'namespace',
-          'router',
-          'store',
+          { 'app-router': 'router' },
           'secret-mount-path',
-          'flash-messages',
-          'control-group',
+          'pagination',
+          'version',
         ],
         externalRoutes: {
           secrets: 'vault.cluster.secrets.backends',
@@ -100,9 +122,10 @@ export default class App extends Application {
           'flash-messages',
           'namespace',
           'path-help',
-          'router',
+          { 'app-router': 'router' },
           'secret-mount-path',
           'store',
+          'pagination',
           'version',
         ],
         externalRoutes: {
@@ -114,9 +137,18 @@ export default class App extends Application {
     },
     sync: {
       dependencies: {
-        services: ['flash-messages', 'router', 'store', 'version'],
+        services: [
+          'flash-messages',
+          'flags',
+          { 'app-router': 'router' },
+          'store',
+          'api',
+          'capabilities',
+          'pagination',
+          'version',
+        ],
         externalRoutes: {
-          kvSecretDetails: 'vault.cluster.secrets.backend.kv.secret.details',
+          kvSecretOverview: 'vault.cluster.secrets.backend.kv.secret.index',
           clientCountOverview: 'vault.cluster.clients',
         },
       },
@@ -125,3 +157,7 @@ export default class App extends Application {
 }
 
 loadInitializers(App, config.modulePrefix);
+
+/**
+ * @typedef {import('ember-source/types')} EmberTypes
+ */
diff --git a/ui/app/breakpoints.js b/ui/app/breakpoints.js
index 00ebc24c1b3..e2c2df59429 100644
--- a/ui/app/breakpoints.js
+++ b/ui/app/breakpoints.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/alphabet-edit.hbs b/ui/app/components/alphabet-edit.hbs
index f35121b10ca..1f91fd49510 100644
--- a/ui/app/components/alphabet-edit.hbs
+++ b/ui/app/components/alphabet-edit.hbs
@@ -1,48 +1,36 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
-    <KeyValueHeader
-      @baseKey={{hash display=this.model.id id=this.model.idForNav}}
-      @path="vault.cluster.secrets.backend.list"
-      @mode={{this.mode}}
-      @root={{this.root}}
-      @showCurrent={{true}}
-    />
+    <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
     <h1 class="title is-3" data-test-secret-header="true">
-      {{#if (eq this.mode "create")}}
+      {{#if (eq @mode "create")}}
         Create Alphabet
-      {{else if (eq this.mode "edit")}}
+      {{else if (eq @mode "edit")}}
         Edit Alphabet
       {{else}}
         Alphabet
-        <code>{{this.model.id}}</code>
+        <code>{{@model.id}}</code>
       {{/if}}
     </h1>
   </p.levelLeft>
 </PageHeader>
 
-{{#if (eq this.mode "show")}}
+{{#if (eq @mode "show")}}
   <Toolbar>
     <ToolbarActions>
-      {{#if this.capabilities.canDelete}}
-        <Hds::Button
-          @text="Delete alphabet"
-          @color="secondary"
-          class="toolbar-button"
-          {{on "click" (action "delete")}}
-          data-test-transformation-alphabet-delete
-        />
+      {{#if @model.updatePath.canDelete}}
+        <Hds::Button @text="Delete alphabet" @color="secondary" class="toolbar-button" {{on "click" this.onDelete}} />
         <div class="toolbar-separator"></div>
       {{/if}}
-      {{#if this.capabilities.canUpdate}}
+      {{#if @model.updatePath.canUpdate}}
         <ToolbarSecretLink
-          @secret={{concat this.model.idPrefix this.model.id}}
+          @secret={{concat @model.idPrefix @model.id}}
           @mode="edit"
           data-test-edit-link={{true}}
           @replace={{true}}
@@ -54,13 +42,13 @@
   </Toolbar>
 {{/if}}
 
-{{#if (or (eq this.mode "edit") (eq this.mode "create"))}}
-  <form onsubmit={{action "createOrUpdate" this.mode}}>
+{{#if (or (eq @mode "edit") (eq @mode "create"))}}
+  <form onsubmit={{this.createOrUpdate}}>
     <div class="box is-sideless is-fullwidth is-marginless">
-      <MessageError @model={{this.model}} />
-      <NamespaceReminder @mode={{this.mode}} @noun="transform alphabet" />
-      {{#each this.model.attrs as |attr|}}
-        {{#if (and (eq attr.name "name") (eq this.mode "edit"))}}
+      <MessageError @errorMessage={{this.errorMessage}} />
+      <NamespaceReminder @mode={{@mode}} @noun="transform alphabet" />
+      {{#each @model.attrs as |attr|}}
+        {{#if (and (eq attr.name "name") (eq @mode "edit"))}}
           <label for={{attr.name}} class="is-label">
             {{attr.options.label}}
           </label>
@@ -72,29 +60,25 @@
             id={{attr.name}}
             autocomplete="off"
             spellcheck="false"
-            value={{or (get this.model attr.name) this.model.id}}
+            value={{or (get @model attr.name) @model.id}}
             readonly
             class="field input is-readOnly"
             type={{attr.type}}
           />
         {{else}}
-          <FormField data-test-field @attr={{attr}} @model={{this.model}} />
+          <FormField data-test-field @attr={{attr}} @model={{@model}} />
         {{/if}}
       {{/each}}
     </div>
     <div class="field is-grouped-split box is-fullwidth is-bottomless">
       <Hds::ButtonSet>
-        <Hds::Button
-          @text={{if (eq this.mode "create") "Create alphabet" "Save"}}
-          type="submit"
-          data-test-alphabet-transform-create
-        />
-        {{#if (eq this.mode "create")}}
+        <Hds::Button @text={{if (eq @mode "create") "Create alphabet" "Save"}} type="submit" data-test-submit />
+        {{#if (eq @mode "create")}}
           <Hds::Button
             @text="Cancel"
             @color="secondary"
             @route="vault.cluster.secrets.backend.list-root"
-            @model={{this.model.backend}}
+            @model={{@model.backend}}
             @query={{hash tab="alphabet"}}
           />
         {{else}}
@@ -102,7 +86,7 @@
             @text="Cancel"
             @color="secondary"
             @route="vault.cluster.secrets.backend.show"
-            @models={{array this.model.backend (concat "alphabet/" this.model.id)}}
+            @models={{array @model.backend (concat "alphabet/" @model.id)}}
             @query={{hash tab="alphabet"}}
           />
         {{/if}}
@@ -110,29 +94,24 @@
     </div>
   </form>
 {{else}}
-  {{#if this.model.displayErrors}}
-    <div class="has-top-margin-s">
-      <MessageError @model={{this.model}} />
-    </div>
-  {{/if}}
   <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
-    {{#each this.model.attrs as |attr|}}
+    {{#each @model.attrs as |attr|}}
       {{#if (eq attr.type "object")}}
         <InfoTableRow
           @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-          @value={{stringify (get this.model attr.name)}}
+          @value={{stringify (get @model attr.name)}}
         />
       {{else if (eq attr.type "array")}}
         <InfoTableRow
           @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-          @value={{get this.model attr.name}}
+          @value={{get @model attr.name}}
           @type={{attr.type}}
           @isLink={{eq attr.name "transformations"}}
         />
       {{else}}
         <InfoTableRow
           @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-          @value={{get this.model attr.name}}
+          @value={{get @model attr.name}}
         />
       {{/if}}
     {{/each}}
diff --git a/ui/app/components/alphabet-edit.js b/ui/app/components/alphabet-edit.js
index 435a814ae35..64fea376f87 100644
--- a/ui/app/components/alphabet-edit.js
+++ b/ui/app/components/alphabet-edit.js
@@ -1,8 +1,84 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import TransformBase from './transform-edit-base';
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import errorMessage from 'vault/utils/error-message';
 
-export default class AlphabetEdit extends TransformBase {}
+/**
+ * @module AlphabetEdit
+ * `AlphabetEdit` is a component that allows you to create/edit or view an alphabet.
+ *
+ * @example
+ * ```js
+ *   <AlphabetEdit @model={{this.model}} @mode={{this.mode}} />
+ * ```
+ * @param {object} model - This is the transform alphabet model.
+ * @param {string} mode - Is either show, create or edit.
+ */
+
+export default class AlphabetEditComponent extends Component {
+  @service flashMessages;
+  @service router;
+
+  @tracked errorMessage = '';
+
+  get breadcrumbs() {
+    // ideally this is created on the controller in the parent route but this is a generic route and adding breadcrumbs to the controller requires a larger refactor.
+    const { backend } = this.args.model;
+    return [
+      {
+        label: backend,
+        route: 'vault.cluster.secrets.backend.list-root',
+        model: backend,
+        query: { tab: 'alphabet' },
+      },
+      { label: 'Alphabet' },
+    ];
+  }
+
+  transition(route = 'show') {
+    this.errorMessage = '';
+    const { backend, id } = this.args.model;
+    if (route === 'list') {
+      this.router.transitionTo('vault.cluster.secrets.backend.list-root', backend, {
+        queryParams: { tab: 'alphabet' },
+      });
+      return;
+    } else {
+      this.router.transitionTo('vault.cluster.secrets.backend.show', `alphabet/${id}`);
+    }
+  }
+
+  @action async createOrUpdate(event) {
+    event.preventDefault();
+
+    if (!this.args.model.hasDirtyAttributes) {
+      this.flashMessages.info('No changes detected.');
+      this.transition();
+      return;
+    }
+
+    try {
+      await this.args.model.save();
+      this.flashMessages.success('Alphabet saved.');
+      this.transition();
+    } catch (e) {
+      this.errorMessage = errorMessage(e);
+    }
+  }
+
+  @action async onDelete() {
+    try {
+      await this.args.model.destroyRecord();
+      this.flashMessages.success('Alphabet deleted.');
+      this.transition('list');
+    } catch (e) {
+      this.errorMessage = errorMessage(e);
+    }
+  }
+}
diff --git a/ui/app/components/app-footer.hbs b/ui/app/components/app-footer.hbs
index 477807626a9..8757f29455d 100644
--- a/ui/app/components/app-footer.hbs
+++ b/ui/app/components/app-footer.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::AppFooter class="has-margin-top-auto" as |AF|>
   <AF.ExtraBefore>
@@ -28,4 +28,16 @@
     Documentation
   </AF.Link>
   <AF.LegalLinks />
+  <AF.ExtraAfter>
+    {{#if this.isDevelopment}}
+      <Hds::Button
+        target="_blank"
+        @text="Contributing docs"
+        @isIconOnly={{true}}
+        @icon="gift"
+        @color="tertiary"
+        @route="docs"
+      />
+    {{/if}}
+  </AF.ExtraAfter>
 </Hds::AppFooter>
\ No newline at end of file
diff --git a/ui/app/components/app-footer.js b/ui/app/components/app-footer.js
index 2a64928d1d6..40605f447ca 100644
--- a/ui/app/components/app-footer.js
+++ b/ui/app/components/app-footer.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/auth-config-form/config.hbs b/ui/app/components/auth-config-form/config.hbs
new file mode 100644
index 00000000000..50a655e2162
--- /dev/null
+++ b/ui/app/components/auth-config-form/config.hbs
@@ -0,0 +1,22 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" (perform this.saveModel)}}>
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <NamespaceReminder @mode="save" @noun="Auth Method" />
+    <MessageError @model={{@form}} @errorMessage={{this.errorMessage}} />
+    <FormFieldGroups @model={{@form}} @groupName="formFieldGroups" />
+  </div>
+
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <Hds::Button
+      @text="Save"
+      @icon={{if this.saveModel.isRunning "loading"}}
+      type="submit"
+      disabled={{this.saveModel.isRunning}}
+      data-test-submit
+    />
+  </div>
+</form>
\ No newline at end of file
diff --git a/ui/app/components/auth-config-form/config.js b/ui/app/components/auth-config-form/config.js
deleted file mode 100644
index c2592f5e749..00000000000
--- a/ui/app/components/auth-config-form/config.js
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AdapterError from '@ember-data/adapter/error';
-import { service } from '@ember/service';
-import Component from '@ember/component';
-import { task } from 'ember-concurrency';
-import { waitFor } from '@ember/test-waiters';
-
-/**
- * @module AuthConfigForm/Config
- * The `AuthConfigForm/Config` is the base form to configure auth methods.
- *
- * @example
- * ```js
- * {{auth-config-form/config model.model}}
- * ```
- *
- * @property model=null {DS.Model} - The corresponding auth model that is being configured.
- *
- */
-
-const AuthConfigBase = Component.extend({
-  tagName: '',
-  model: null,
-
-  flashMessages: service(),
-  router: service(),
-  saveModel: task(
-    waitFor(function* () {
-      try {
-        yield this.model.save();
-      } catch (err) {
-        // AdapterErrors are handled by the error-message component
-        // in the form
-        if (err instanceof AdapterError === false) {
-          throw err;
-        }
-        return;
-      }
-      this.router.transitionTo('vault.cluster.access.methods').followRedirects();
-      this.flashMessages.success('The configuration was saved successfully.');
-    })
-  ),
-});
-
-AuthConfigBase.reopenClass({
-  positionalParams: ['model'],
-});
-
-export default AuthConfigBase;
diff --git a/ui/app/components/auth-config-form/config.ts b/ui/app/components/auth-config-form/config.ts
new file mode 100644
index 00000000000..2c24f43ea83
--- /dev/null
+++ b/ui/app/components/auth-config-form/config.ts
@@ -0,0 +1,130 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { service } from '@ember/service';
+import Component from '@glimmer/component';
+import { task } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+import { tracked } from '@glimmer/tracking';
+
+import type AuthMethodForm from 'vault/forms/auth/method';
+import type RouterService from '@ember/routing/router-service';
+import type FlashMessageService from 'ember-cli-flash/services/flash-messages';
+import type ApiService from 'vault/services/api';
+import type { HTMLElementEvent } from 'vault/forms';
+import {
+  AwsConfigureClientRequest,
+  AwsConfigureIdentityAccessListTidyOperationRequest,
+  AwsConfigureRoleTagDenyListTidyOperationRequest,
+  AzureConfigureAuthRequest,
+  GithubConfigureRequest,
+  GoogleCloudConfigureAuthRequest,
+  JwtConfigureRequest,
+  KubernetesConfigureAuthRequest,
+  LdapConfigureAuthRequest,
+  OktaConfigureRequest,
+  RadiusConfigureRequest,
+} from '@hashicorp/vault-client-typescript';
+import AuthMethodResource from 'vault/resources/auth/method';
+
+/**
+ * @module AuthConfigForm/Config
+ * The `AuthConfigForm/Config` is the form for auth methods that need additional configuration.
+ * AuthConfigForm::Options handle the backend's mount configuration.
+ *
+ * @example
+ * <AuthConfigForm::Config @form={{this.form}} />
+ *
+ * @property form=null {AuthMethodForm} - The corresponding auth method that is being configured.
+ *
+ */
+
+type ConfigPayload =
+  | AwsConfigureClientRequest
+  | AwsConfigureIdentityAccessListTidyOperationRequest
+  | AwsConfigureRoleTagDenyListTidyOperationRequest
+  | AzureConfigureAuthRequest
+  | GithubConfigureRequest
+  | GoogleCloudConfigureAuthRequest
+  | JwtConfigureRequest
+  | KubernetesConfigureAuthRequest
+  | LdapConfigureAuthRequest
+  | OktaConfigureRequest
+  | RadiusConfigureRequest
+  | Record<string, unknown>; // Add other payload types as needed
+
+interface Args {
+  form: AuthMethodForm;
+  section: 'configuration' | 'client' | 'identity-accesslist' | 'roletag-denylist';
+  method: AuthMethodResource;
+}
+
+export default class AuthConfigBase extends Component<Args> {
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly router: RouterService;
+
+  @tracked errorMessage = '';
+
+  configMethod(path: string, payload: ConfigPayload) {
+    const { section, method } = this.args;
+
+    switch (method.methodType) {
+      case 'aws':
+        switch (section) {
+          case 'client':
+            return this.api.auth.awsConfigureClient(path, payload as AwsConfigureClientRequest);
+          case 'identity-accesslist':
+            return this.api.auth.awsConfigureIdentityAccessListTidyOperation(
+              path,
+              payload as AwsConfigureIdentityAccessListTidyOperationRequest
+            );
+          case 'roletag-denylist':
+            return this.api.auth.awsConfigureRoleTagDenyListTidyOperation(
+              path,
+              payload as AwsConfigureRoleTagDenyListTidyOperationRequest
+            );
+          default:
+            throw new Error(`Unsupported AWS section: ${section}`);
+        }
+      case 'azure':
+        return this.api.auth.azureConfigureAuth(path, payload as AzureConfigureAuthRequest);
+      case 'github':
+        return this.api.auth.githubConfigure(path, payload as GithubConfigureRequest);
+      case 'gcp':
+        return this.api.auth.googleCloudConfigureAuth(path, payload as GoogleCloudConfigureAuthRequest);
+      case 'jwt':
+      case 'oidc':
+        return this.api.auth.jwtConfigure(path, payload as JwtConfigureRequest);
+      case 'kubernetes':
+        return this.api.auth.kubernetesConfigureAuth(path, payload as KubernetesConfigureAuthRequest);
+      case 'ldap':
+        return this.api.auth.ldapConfigureAuth(path, payload as LdapConfigureAuthRequest);
+      case 'okta':
+        return this.api.auth.oktaConfigure(path, payload as OktaConfigureRequest);
+      case 'radius':
+        return this.api.auth.radiusConfigure(path, payload as RadiusConfigureRequest);
+      default:
+        throw new Error(`Configuration of the ${method.methodType} method is not supported by the Vault UI.`);
+    }
+  }
+
+  @task
+  @waitFor
+  *saveModel(evt: HTMLElementEvent<HTMLFormElement>) {
+    evt.preventDefault();
+    this.errorMessage = '';
+    try {
+      const { form, method } = this.args;
+      const { data } = form.toJSON();
+      yield this.configMethod(method.path, data as ConfigPayload);
+      this.router.transitionTo('vault.cluster.access.methods').followRedirects();
+      this.flashMessages.success('The configuration was saved successfully.');
+    } catch (err) {
+      const { message } = yield this.api.parseError(err);
+      this.errorMessage = message;
+    }
+  }
+}
diff --git a/ui/app/components/auth-config-form/options.hbs b/ui/app/components/auth-config-form/options.hbs
new file mode 100644
index 00000000000..0dd3345f62f
--- /dev/null
+++ b/ui/app/components/auth-config-form/options.hbs
@@ -0,0 +1,42 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" (perform this.onSubmit)}}>
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <MessageError @model={{@form}} @errorMessage={{this.errorMessage}} />
+    <NamespaceReminder @mode="save" @noun="Auth Method" />
+
+    {{#each @form.tuneFields as |field|}}
+      <FormField data-test-field @attr={{field}} @model={{@form}} />
+      {{#if (and (eq field.name "config.listing_visibility") this.directLoginLink)}}
+        <div class="has-top-margin-negative-s has-bottom-margin-l is-flex-center">
+          <Hds::Text::Body @tag="p" @color="faint">UI login link:</Hds::Text::Body>
+          <Hds::Copy::Snippet @textToCopy={{this.directLoginLink}} />
+        </div>
+      {{/if}}
+    {{/each}}
+
+    {{#if this.supportsUserLockoutConfig}}
+      <hr class="has-top-margin-xl has-bottom-margin-l has-background-gray-200" />
+      <Hds::Text::Display @tag="h2" @size="400" @weight="bold" data-test-user-lockout-section>User lockout configuration</Hds::Text::Display>
+      <Hds::Text::Body @tag="p" @size="100" @color="faint" class="has-bottom-margin-m">
+        Specifies the user lockout settings for this auth mount.
+      </Hds::Text::Body>
+      {{#each @form.userLockoutConfigFields as |field|}}
+        <FormField @attr={{field}} @model={{@form}} />
+      {{/each}}
+    {{/if}}
+  </div>
+
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <Hds::Button
+      @text="Update options"
+      @icon={{if this.onSubmit.isRunning "loading"}}
+      type="submit"
+      disabled={{this.onSubmit.isRunning}}
+      data-test-submit
+    />
+  </div>
+</form>
\ No newline at end of file
diff --git a/ui/app/components/auth-config-form/options.js b/ui/app/components/auth-config-form/options.js
deleted file mode 100644
index da9e9b8f33b..00000000000
--- a/ui/app/components/auth-config-form/options.js
+++ /dev/null
@@ -1,60 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AdapterError from '@ember-data/adapter/error';
-import AuthConfigComponent from './config';
-import { service } from '@ember/service';
-import { task } from 'ember-concurrency';
-import { waitFor } from '@ember/test-waiters';
-
-/**
- * @module AuthConfigForm/Options
- * The `AuthConfigForm/Options` is options portion of the auth config form.
- *
- * @example
- * ```js
- * {{auth-config-form/options model.model}}
- * ```
- *
- * @property model=null {DS.Model} - The corresponding auth model that is being configured.
- *
- */
-
-export default AuthConfigComponent.extend({
-  flashMessages: service(),
-  router: service(),
-
-  saveModel: task(
-    waitFor(function* () {
-      const data = this.model.config.serialize();
-      data.description = this.model.description;
-
-      // token_type should not be tuneable for the token auth method.
-      if (this.model.methodType === 'token') {
-        delete data.token_type;
-      }
-
-      try {
-        yield this.model.tune(data);
-      } catch (err) {
-        // AdapterErrors are handled by the error-message component
-        // in the form
-        if (err instanceof AdapterError === false) {
-          throw err;
-        }
-        // because we're not calling model.save the model never updates with
-        // the error.  Forcing the error message by manually setting the errorMessage
-        try {
-          this.model.set('errorMessage', err.errors?.join(','));
-        } catch {
-          // do nothing
-        }
-        return;
-      }
-      this.router.transitionTo('vault.cluster.access.methods').followRedirects();
-      this.flashMessages.success('The configuration was saved successfully.');
-    })
-  ),
-});
diff --git a/ui/app/components/auth-config-form/options.ts b/ui/app/components/auth-config-form/options.ts
new file mode 100644
index 00000000000..00b2cea22af
--- /dev/null
+++ b/ui/app/components/auth-config-form/options.ts
@@ -0,0 +1,93 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { task } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+import { tracked } from '@glimmer/tracking';
+import { supportedTypes } from 'vault/utils/auth-form-helpers';
+
+import type AuthMethodForm from 'vault/forms/auth/method';
+import type ApiService from 'vault/services/api';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type RouterService from '@ember/routing/router-service';
+import type { HTMLElementEvent } from 'vault/forms';
+import type NamespaceService from 'vault/services/namespace';
+import type VersionService from 'vault/services/version';
+import type { MountsAuthTuneConfigurationParametersRequest } from '@hashicorp/vault-client-typescript';
+
+/**
+ * @module AuthConfigForm/Options
+ * The `AuthConfigForm/Options` is options portion of the auth config form.
+ *
+ * @example
+ * <AuthConfigForm::Options @form={{this.form}} />
+ *
+ * @property form=null {AuthMethodForm} - The corresponding auth method that is being configured.
+ *
+ */
+
+type Args = {
+  form: AuthMethodForm;
+};
+
+export default class AuthConfigOptions extends Component<Args> {
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly router: RouterService;
+  @service declare readonly namespace: NamespaceService;
+  @service declare readonly version: VersionService;
+
+  @tracked errorMessage: string | null = null;
+
+  get directLoginLink() {
+    const ns = this.namespace.path;
+    const nsQueryParam = ns ? `namespace=${encodeURIComponent(ns)}&` : '';
+    const { normalizedType, data } = this.args.form;
+    const isSupported = supportedTypes(this.version.isEnterprise).includes(normalizedType);
+    return isSupported
+      ? `${window.origin}/ui/vault/auth?${nsQueryParam}with=${encodeURIComponent(data.path)}`
+      : '';
+  }
+
+  get supportsUserLockoutConfig() {
+    return ['approle', 'ldap', 'userpass'].includes(this.args.form.normalizedType);
+  }
+
+  onSubmit = task(
+    waitFor(async (evt: HTMLElementEvent<HTMLFormElement>) => {
+      evt.preventDefault();
+      this.errorMessage = null;
+      try {
+        const { form } = this.args;
+        const {
+          data: { description, config, user_lockout_config },
+        } = form.toJSON();
+
+        const payload = {
+          description,
+          ...config,
+        } as MountsAuthTuneConfigurationParametersRequest;
+
+        if (Object.keys(user_lockout_config).length) {
+          payload.user_lockout_config = user_lockout_config;
+        }
+
+        // 'token_type' cannot be set for the 'token' auth mount
+        if (form.normalizedType === 'token' && payload?.token_type) {
+          delete payload.token_type;
+        }
+
+        await this.api.sys.mountsAuthTuneConfigurationParameters(form.data.path, payload);
+        this.router.transitionTo('vault.cluster.access.methods').followRedirects();
+        this.flashMessages.success('The configuration was saved successfully.');
+      } catch (err) {
+        const { message } = await this.api.parseError(err);
+        this.errorMessage = message;
+      }
+    })
+  );
+}
diff --git a/ui/app/components/auth-form-options.js b/ui/app/components/auth-form-options.js
deleted file mode 100644
index 61eb484bb30..00000000000
--- a/ui/app/components/auth-form-options.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@ember/component';
-
-export default Component.extend({});
diff --git a/ui/app/components/auth-form.js b/ui/app/components/auth-form.js
deleted file mode 100644
index 7e5248186ad..00000000000
--- a/ui/app/components/auth-form.js
+++ /dev/null
@@ -1,339 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Ember from 'ember';
-import { next } from '@ember/runloop';
-import { service } from '@ember/service';
-import { match, alias, or } from '@ember/object/computed';
-import { dasherize } from '@ember/string';
-import Component from '@ember/component';
-import { computed } from '@ember/object';
-import { allSupportedAuthBackends, supportedAuthBackends } from 'vault/helpers/supported-auth-backends';
-import { task, timeout } from 'ember-concurrency';
-import { waitFor } from '@ember/test-waiters';
-import { v4 as uuidv4 } from 'uuid';
-
-/**
- * @module AuthForm
- * The `AuthForm` is used to sign users into Vault.
- *
- * @example ```js
- * // All properties are passed in via query params.
- * <AuthForm @wrappedToken={{wrappedToken}} @cluster={{model}} @namespace={{namespaceQueryParam}} @selectedAuth={{authMethod}} @onSuccess={{action this.onSuccess}}/>```
- *
- * @param {string} wrappedToken - The auth method that is currently selected in the dropdown.
- * @param {object} cluster - The auth method that is currently selected in the dropdown. This corresponds to an Ember Model.
- * @param {string} namespace- The currently active namespace.
- * @param {string} selectedAuth - The auth method that is currently selected in the dropdown.
- * @param {function} onSuccess - Fired on auth success.
- * @param {function} [setOktaNumberChallenge] - Sets whether we are waiting for okta number challenge to be used to sign in.
- * @param {boolean} [waitingForOktaNumberChallenge=false] - Determines if we are waiting for the Okta Number Challenge to sign in.
- * @param {function} [setCancellingAuth] - Sets whether we are cancelling or not the login authentication for Okta Number Challenge.
- * @param {boolean} [cancelAuthForOktaNumberChallenge=false] - Determines if we are cancelling the login authentication for the Okta Number Challenge.
- */
-
-const DEFAULTS = {
-  token: null,
-  username: null,
-  password: null,
-  customPath: null,
-};
-
-export default Component.extend(DEFAULTS, {
-  router: service(),
-  auth: service(),
-  flashMessages: service(),
-  store: service(),
-  csp: service('csp-event'),
-  version: service(),
-
-  //  passed in via a query param
-  selectedAuth: null,
-  methods: null,
-  cluster: null,
-  namespace: null,
-  wrappedToken: null,
-  // internal
-  oldNamespace: null,
-
-  // number answer for okta number challenge if applicable
-  oktaNumberChallengeAnswer: null,
-
-  authMethods: computed('version.isEnterprise', function () {
-    return this.version.isEnterprise ? allSupportedAuthBackends() : supportedAuthBackends();
-  }),
-
-  didReceiveAttrs() {
-    this._super(...arguments);
-    const {
-      wrappedToken: token,
-      oldWrappedToken: oldToken,
-      oldNamespace: oldNS,
-      namespace: ns,
-      selectedAuth: newMethod,
-      oldSelectedAuth: oldMethod,
-      cancelAuthForOktaNumberChallenge: cancelAuth,
-    } = this;
-    // if we are cancelling the login then we reset the number challenge answer and cancel the current authenticate and polling tasks
-    if (cancelAuth) {
-      this.set('oktaNumberChallengeAnswer', null);
-      this.authenticate.cancelAll();
-      this.pollForOktaNumberChallenge.cancelAll();
-    }
-    next(() => {
-      if (!token && (oldNS === null || oldNS !== ns)) {
-        this.fetchMethods.perform();
-      }
-      this.set('oldNamespace', ns);
-      // we only want to trigger this once
-      if (token && !oldToken) {
-        this.unwrapToken.perform(token);
-        this.set('oldWrappedToken', token);
-      }
-      if (oldMethod && oldMethod !== newMethod) {
-        this.resetDefaults();
-      }
-      this.set('oldSelectedAuth', newMethod);
-    });
-  },
-
-  didRender() {
-    this._super(...arguments);
-    // on very narrow viewports the active tab may be overflowed, so we scroll it into view here
-    const activeEle = this.element.querySelector('li.is-active');
-    if (activeEle) {
-      activeEle.scrollIntoView();
-    }
-
-    next(() => {
-      const firstMethod = this.firstMethod();
-      // set `with` to the first method
-      if (
-        !this.wrappedToken &&
-        ((this.fetchMethods.isIdle && firstMethod && !this.selectedAuth) ||
-          (this.selectedAuth && !this.selectedAuthBackend))
-      ) {
-        this.set('selectedAuth', firstMethod);
-      }
-    });
-  },
-
-  firstMethod() {
-    const firstMethod = this.methodsToShow[0];
-    if (!firstMethod) return;
-    // prefer backends with a path over those with a type
-    return firstMethod.path || firstMethod.type;
-  },
-
-  resetDefaults() {
-    this.setProperties(DEFAULTS);
-  },
-
-  getAuthBackend(type) {
-    const { wrappedToken, methods, selectedAuth, selectedAuthIsPath: keyIsPath } = this;
-    const selected = type || selectedAuth;
-    if (!methods && !wrappedToken) {
-      return {};
-    }
-    // if type is provided we can ignore path since we are attempting to lookup a specific backend by type
-    if (keyIsPath && !type) {
-      return methods.find((m) => m.path === selected);
-    }
-    return this.authMethods.find((m) => m.type === selected);
-  },
-
-  selectedAuthIsPath: match('selectedAuth', /\/$/),
-  selectedAuthBackend: computed(
-    'wrappedToken',
-    'methods',
-    'methods.[]',
-    'selectedAuth',
-    'selectedAuthIsPath',
-    function () {
-      return this.getAuthBackend();
-    }
-  ),
-
-  providerName: computed('selectedAuthBackend.type', function () {
-    if (!this.selectedAuthBackend) {
-      return;
-    }
-    let type = this.selectedAuthBackend.type || 'token';
-    type = type.toLowerCase();
-    const templateName = dasherize(type);
-    return templateName;
-  }),
-
-  hasCSPError: alias('csp.connectionViolations'),
-
-  cspErrorText: `This is a standby Vault node but can't communicate with the active node via request forwarding. Sign in at the active node to use the Vault UI.`,
-
-  allSupportedMethods: computed('methodsToShow', 'hasMethodsWithPath', 'authMethods', function () {
-    const hasMethodsWithPath = this.hasMethodsWithPath;
-    const methodsToShow = this.methodsToShow;
-    return hasMethodsWithPath ? methodsToShow.concat(this.authMethods) : methodsToShow;
-  }),
-
-  hasMethodsWithPath: computed('methodsToShow', function () {
-    return this.methodsToShow.isAny('path');
-  }),
-  methodsToShow: computed('methods', 'authMethods', function () {
-    const methods = this.methods || [];
-    const shownMethods = methods.filter((m) =>
-      this.authMethods.find((b) => b.type.toLowerCase() === m.type.toLowerCase())
-    );
-    return shownMethods.length ? shownMethods : this.authMethods;
-  }),
-
-  unwrapToken: task(
-    waitFor(function* (token) {
-      // will be using the Token Auth Method, so set it here
-      this.set('selectedAuth', 'token');
-      const adapter = this.store.adapterFor('tools');
-      try {
-        const response = yield adapter.toolAction('unwrap', null, { clientToken: token });
-        this.set('token', response.auth.client_token);
-        this.send('doSubmit');
-      } catch (e) {
-        this.set('error', `Token unwrap failed: ${e.errors[0]}`);
-      }
-    })
-  ),
-
-  fetchMethods: task(
-    waitFor(function* () {
-      const store = this.store;
-      try {
-        const methods = yield store.findAll('auth-method', {
-          adapterOptions: {
-            unauthenticated: true,
-          },
-        });
-        this.set(
-          'methods',
-          methods.map((m) => {
-            const method = m.serialize({ includeId: true });
-            return {
-              ...method,
-              mountDescription: method.description,
-            };
-          })
-        );
-        // without unloading the records there will be an issue where all methods set to list when unauthenticated will appear for all namespaces
-        // if possible, it would be more reliable to add a namespace attr to the model so we could filter against the current namespace rather than unloading all
-        next(() => {
-          store.unloadAll('auth-method');
-        });
-      } catch (e) {
-        this.set('error', `There was an error fetching Auth Methods: ${e.errors[0]}`);
-      }
-    })
-  ),
-
-  showLoading: or('isLoading', 'authenticate.isRunning', 'fetchMethods.isRunning', 'unwrapToken.isRunning'),
-
-  authenticate: task(
-    waitFor(function* (backendType, data) {
-      const {
-        selectedAuth,
-        cluster: { id: clusterId },
-      } = this;
-      try {
-        if (backendType === 'okta') {
-          this.pollForOktaNumberChallenge.perform(data.nonce, data.path);
-        } else {
-          this.delayAuthMessageReminder.perform();
-        }
-        const authResponse = yield this.auth.authenticate({
-          clusterId,
-          backend: backendType,
-          data,
-          selectedAuth,
-        });
-        this.onSuccess(authResponse, backendType, data);
-      } catch (e) {
-        this.set('isLoading', false);
-        if (!this.auth.mfaError) {
-          this.set('error', `Authentication failed: ${this.auth.handleError(e)}`);
-        }
-      }
-    })
-  ),
-
-  pollForOktaNumberChallenge: task(function* (nonce, mount) {
-    // yield for 1s to wait to see if there is a login error before polling
-    yield timeout(1000);
-    if (this.error) {
-      return;
-    }
-    let response = null;
-    this.setOktaNumberChallenge(true);
-    this.setCancellingAuth(false);
-    // keep polling /auth/okta/verify/:nonce API every 1s until a response is given with the correct number for the Okta Number Challenge
-    while (response === null) {
-      // when testing, the polling loop causes promises to be rejected making acceptance tests fail
-      // so disable the poll in tests
-      if (Ember.testing) {
-        return;
-      }
-      yield timeout(1000);
-      response = yield this.auth.getOktaNumberChallengeAnswer(nonce, mount);
-    }
-    this.set('oktaNumberChallengeAnswer', response);
-  }),
-
-  delayAuthMessageReminder: task(function* () {
-    if (Ember.testing) {
-      yield timeout(0);
-    } else {
-      yield timeout(5000);
-    }
-  }),
-
-  actions: {
-    doSubmit(passedData, event, token) {
-      if (event) {
-        event.preventDefault();
-      }
-      if (token) {
-        this.set('token', token);
-      }
-      this.set('error', null);
-      // if callback from oidc, jwt, or saml we have a token at this point
-      const backend = token ? this.getAuthBackend('token') : this.selectedAuthBackend || {};
-      const backendMeta = this.authMethods.find(
-        (b) => (b.type || '').toLowerCase() === (backend.type || '').toLowerCase()
-      );
-      const attributes = (backendMeta || {}).formAttributes || [];
-      const data = this.getProperties(...attributes);
-
-      if (passedData) {
-        Object.assign(data, passedData);
-      }
-      if (this.customPath || backend.id) {
-        data.path = this.customPath || backend.id;
-      }
-      // add nonce field for okta backend
-      if (backend.type === 'okta') {
-        data.nonce = uuidv4();
-        // add a default path of okta if it doesn't exist to be used for Okta Number Challenge
-        if (!data.path) {
-          data.path = 'okta';
-        }
-      }
-      return this.authenticate.unlinked().perform(backend.type, data);
-    },
-    handleError(e) {
-      this.setProperties({
-        isLoading: false,
-        error: e ? this.auth.handleError(e) : null,
-      });
-    },
-    returnToLoginFromOktaNumberChallenge() {
-      this.setOktaNumberChallenge(false);
-      this.set('oktaNumberChallengeAnswer', null);
-    },
-  },
-});
diff --git a/ui/app/components/auth-jwt.js b/ui/app/components/auth-jwt.js
deleted file mode 100644
index b3bcb7bf68d..00000000000
--- a/ui/app/components/auth-jwt.js
+++ /dev/null
@@ -1,208 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { service } from '@ember/service';
-// ARG NOTE: Once you remove outer-html after glimmerizing you can remove the outer-html component
-import Component from './outer-html';
-import { task, timeout, waitForEvent } from 'ember-concurrency';
-import { debounce } from '@ember/runloop';
-
-const WAIT_TIME = 500;
-const ERROR_WINDOW_CLOSED =
-  'The provider window was closed before authentication was complete. Your web browser may have blocked or closed a pop-up window. Please check your settings and click Sign In to try again.';
-const ERROR_MISSING_PARAMS =
-  'The callback from the provider did not supply all of the required parameters.  Please click Sign In to try again. If the problem persists, you may want to contact your administrator.';
-const ERROR_JWT_LOGIN = 'OIDC login is not configured for this mount';
-export { ERROR_WINDOW_CLOSED, ERROR_MISSING_PARAMS, ERROR_JWT_LOGIN };
-
-export default Component.extend({
-  store: service(),
-  featureFlagService: service('featureFlag'),
-
-  selectedAuthPath: null,
-  selectedAuthType: null,
-  roleName: null,
-  role: null,
-  errorMessage: null,
-  isOIDC: true,
-
-  onRoleName() {},
-  onLoading() {},
-  onError() {},
-  onNamespace() {},
-
-  didReceiveAttrs() {
-    this._super(...arguments);
-    // if mount path or type changes we need to check again for JWT configuration
-    const didChangePath = this._authPath !== this.selectedAuthPath;
-    const didChangeType = this._authType !== this.selectedAuthType;
-
-    if (didChangePath || didChangeType) {
-      // path updates as the user types so we need to debounce that event
-      const wait = didChangePath ? 500 : 0;
-      debounce(this, 'fetchRole', wait);
-    }
-    this._authPath = this.selectedAuthPath;
-    this._authType = this.selectedAuthType;
-  },
-
-  getWindow() {
-    return this.window || window;
-  },
-
-  async fetchRole() {
-    const path = this.selectedAuthPath || this.selectedAuthType;
-    const id = JSON.stringify([path, this.roleName]);
-    this.setProperties({ role: null, errorMessage: null, isOIDC: true });
-
-    try {
-      const role = await this.store.findRecord('role-jwt', id, {
-        adapterOptions: { namespace: this.namespace },
-      });
-      this.set('role', role);
-    } catch (e) {
-      const error = (e.errors || [])[0];
-      const errorMessage =
-        e.httpStatus === 400 ? 'Invalid role. Please try again.' : `Error fetching role: ${error}`;
-      // assume OIDC until it's known that the mount is configured for JWT authentication via static keys, JWKS, or OIDC discovery.
-      this.setProperties({ isOIDC: error !== ERROR_JWT_LOGIN, errorMessage });
-    }
-  },
-
-  cancelLogin(oidcWindow, errorMessage) {
-    this.closeWindow(oidcWindow);
-    this.handleOIDCError(errorMessage);
-  },
-
-  closeWindow(oidcWindow) {
-    this.watchPopup.cancelAll();
-    this.watchCurrent.cancelAll();
-    oidcWindow.close();
-  },
-
-  handleOIDCError(err) {
-    this.onLoading(false);
-    this.prepareForOIDC.cancelAll();
-    this.onError(err);
-  },
-
-  prepareForOIDC: task(function* (oidcWindow) {
-    const thisWindow = this.getWindow();
-    // show the loading animation in the parent
-    this.onLoading(true);
-    // start watching the popup window and the current one
-    this.watchPopup.perform(oidcWindow);
-    this.watchCurrent.perform(oidcWindow);
-    // wait for message posted from oidc callback
-    // see issue https://github.com/hashicorp/vault/issues/12436
-    // ensure that postMessage event is from expected source
-    while (true) {
-      const event = yield waitForEvent(thisWindow, 'message');
-      if (event.origin === thisWindow.origin && event.isTrusted && event.data.source === 'oidc-callback') {
-        return this.exchangeOIDC.perform(event.data, oidcWindow);
-      }
-      // continue to wait for the correct message
-    }
-  }),
-
-  watchPopup: task(function* (oidcWindow) {
-    while (true) {
-      yield timeout(WAIT_TIME);
-      if (!oidcWindow || oidcWindow.closed) {
-        return this.handleOIDCError(ERROR_WINDOW_CLOSED);
-      }
-    }
-  }),
-
-  watchCurrent: task(function* (oidcWindow) {
-    // when user is about to change pages, close the popup window
-    yield waitForEvent(this.getWindow(), 'beforeunload');
-    oidcWindow.close();
-  }),
-
-  exchangeOIDC: task(function* (oidcState, oidcWindow) {
-    if (oidcState === null || oidcState === undefined) {
-      return;
-    }
-    this.onLoading(true);
-
-    let { namespace, path, state, code } = oidcState;
-
-    // The namespace can be either be passed as a query parameter, or be embedded
-    // in the state param in the format `<state_id>,ns=<namespace>`. So if
-    // `namespace` is empty, check for namespace in state as well.
-    if (namespace === '' || this.featureFlagService.managedNamespaceRoot) {
-      const i = state.indexOf(',ns=');
-      if (i >= 0) {
-        // ",ns=" is 4 characters
-        namespace = state.substring(i + 4);
-        state = state.substring(0, i);
-      }
-    }
-
-    if (!path || !state || !code) {
-      return this.cancelLogin(oidcWindow, ERROR_MISSING_PARAMS);
-    }
-    const adapter = this.store.adapterFor('auth-method');
-    this.onNamespace(namespace);
-    let resp;
-    // do the OIDC exchange, set the token on the parent component
-    // and submit auth form
-    try {
-      resp = yield adapter.exchangeOIDC(path, state, code);
-      this.closeWindow(oidcWindow);
-    } catch (e) {
-      // If there was an error on Vault's end, close the popup
-      // and show the error on the login screen
-      return this.cancelLogin(oidcWindow, e);
-    }
-    yield this.onSubmit(null, null, resp.auth.client_token);
-  }),
-
-  async startOIDCAuth() {
-    this.onError(null);
-
-    await this.fetchRole();
-
-    const error =
-      this.role && !this.role.authUrl
-        ? 'Missing auth_url. Please check that allowed_redirect_uris for the role include this mount path.'
-        : this.errorMessage || null;
-
-    if (error) {
-      this.onError(error);
-    } else {
-      const win = this.getWindow();
-      const POPUP_WIDTH = 500;
-      const POPUP_HEIGHT = 600;
-      const left = win.screen.width / 2 - POPUP_WIDTH / 2;
-      const top = win.screen.height / 2 - POPUP_HEIGHT / 2;
-      const oidcWindow = win.open(
-        this.role.authUrl,
-        'vaultOIDCWindow',
-        `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},resizable,scrollbars=yes,top=${top},left=${left}`
-      );
-
-      this.prepareForOIDC.perform(oidcWindow);
-    }
-  },
-
-  actions: {
-    onRoleChange(event) {
-      this.onRoleName(event.target.value);
-      debounce(this, 'fetchRole', 500);
-    },
-    signIn(event) {
-      event.preventDefault();
-
-      if (this.isOIDC) {
-        this.startOIDCAuth();
-      } else {
-        const { jwt, roleName: role } = this;
-        this.onSubmit({ role, jwt });
-      }
-    },
-  },
-});
diff --git a/ui/app/components/auth-method/configuration.hbs b/ui/app/components/auth-method/configuration.hbs
new file mode 100644
index 00000000000..e691006de50
--- /dev/null
+++ b/ui/app/components/auth-method/configuration.hbs
@@ -0,0 +1,20 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="box is-fullwidth is-sideless is-paddingless is-marginless">
+  {{#if @method.directLoginLink}}
+    <InfoTableRow @alwaysRender={{true}} @label="UI login link">
+      <Hds::Copy::Snippet @textToCopy={{@method.directLoginLink}} />
+    </InfoTableRow>
+  {{/if}}
+  {{#each this.displayFields as |field|}}
+    <InfoTableRow
+      @alwaysRender={{not (is-empty-value (get @method field))}}
+      @label={{this.label field}}
+      @value={{this.value field}}
+      @formatTtl={{this.isTtl field}}
+    />
+  {{/each}}
+</div>
\ No newline at end of file
diff --git a/ui/app/components/auth-method/configuration.ts b/ui/app/components/auth-method/configuration.ts
new file mode 100644
index 00000000000..6542ce45b7f
--- /dev/null
+++ b/ui/app/components/auth-method/configuration.ts
@@ -0,0 +1,60 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { toLabel } from 'core/helpers/to-label';
+import { get } from '@ember/object';
+
+import type AuthMethodResource from 'vault/resources/auth/method';
+
+interface Args {
+  method: AuthMethodResource;
+}
+export default class AuthMethodConfigurationComponent extends Component<Args> {
+  displayFields = [
+    'type',
+    'path',
+    'description',
+    'accessor',
+    'local',
+    'seal_wrap',
+    'config.listing_visibility',
+    'config.default_lease_ttl',
+    'config.max_lease_ttl',
+    'config.token_type',
+    'config.audit_non_hmac_request_keys',
+    'config.audit_non_hmac_response_keys',
+    'config.passthrough_request_headers',
+    'config.allowed_response_headers',
+    'config.plugin_version',
+  ];
+
+  label = (field: string) => {
+    const key = field.replace('config.', '');
+    const label = toLabel([key]);
+    // map specific fields to custom labels
+    return (
+      {
+        listing_visibility: 'Use as preferred UI login method',
+        default_lease_ttl: 'Default Lease TTL',
+        max_lease_ttl: 'Max Lease TTL',
+        audit_non_hmac_request_keys: 'Request keys excluded from HMACing in audit',
+        audit_non_hmac_response_keys: 'Response keys excluded from HMACing in audit',
+        passthrough_request_headers: 'Allowed passthrough request headers',
+      }[key] || label
+    );
+  };
+  value = (field: string) => {
+    const { method } = this.args;
+    if (field === 'config.listing_visibility') {
+      return method.config.listing_visibility === 'unauth';
+    }
+    return get(method, field);
+  };
+
+  isTtl = (field: string) => {
+    return ['config.default_lease_ttl', 'config.max_lease_ttl'].includes(field);
+  };
+}
diff --git a/ui/app/components/auth-saml.hbs b/ui/app/components/auth-saml.hbs
deleted file mode 100644
index aa87e3770d5..00000000000
--- a/ui/app/components/auth-saml.hbs
+++ /dev/null
@@ -1,56 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if this.canLoginSaml}}
-  <form id="auth-form" {{on "submit" (fn this.startSAMLAuth @onSubmit (hash role=@roleName))}}>
-    <div class="field">
-      <label for="role" class="is-label">Role</label>
-      <div class="control">
-        <input
-          value={{@roleName}}
-          placeholder="Default"
-          {{on "input" this.setRole}}
-          autocomplete="off"
-          spellcheck="false"
-          name="role"
-          id="role"
-          class="input"
-          type="text"
-          data-test-role
-        />
-      </div>
-      <AlertInline
-        class="has-top-padding-s"
-        @type="info"
-        @message="Leave blank to sign in with the default role if one is configured."
-      />
-    </div>
-    <div data-test-yield-content>
-      {{yield}}
-    </div>
-    <Hds::Button
-      @text="Sign in with SAML provider"
-      @icon={{if @disabled "loading"}}
-      data-test-auth-submit={{true}}
-      type="submit"
-      disabled={{@disabled}}
-      id="auth-submit"
-    />
-  </form>
-{{else}}
-  <Hds::Alert @type="inline" @color="warning" data-test-saml-auth-not-allowed as |A|>
-    <A.Title>Nonsecure context detected</A.Title>
-    <A.Description>
-      Logging in with a SAML auth method requires a browser in a secure context.
-    </A.Description>
-    <A.Description class="has-top-margin-xs">
-      <Hds::Link::Standalone
-        @icon="external-link"
-        @text="Read more about secure contexts."
-        @href="https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts"
-      />
-    </A.Description>
-  </Hds::Alert>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/auth-saml.js b/ui/app/components/auth-saml.js
deleted file mode 100644
index 485ed8628b9..00000000000
--- a/ui/app/components/auth-saml.js
+++ /dev/null
@@ -1,154 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { service } from '@ember/service';
-import { task, timeout, waitForEvent } from 'ember-concurrency';
-import Component from '@glimmer/component';
-import { tracked } from '@glimmer/tracking';
-import { action } from '@ember/object';
-
-import errorMessage from 'vault/utils/error-message';
-
-const WAIT_TIME = 500;
-const ERROR_WINDOW_CLOSED =
-  'The provider window was closed before authentication was complete. Your web browser may have blocked or closed a pop-up window. Please check your settings and click Sign In to try again.';
-const ERROR_TIMEOUT = 'The authentication request has timed out. Please click Sign In to try again.';
-const ERROR_MISSING_PARAMS =
-  'The callback from the provider did not supply all of the required parameters. Please click Sign In to try again. If the problem persists, you may want to contact your administrator.';
-export { ERROR_WINDOW_CLOSED, ERROR_MISSING_PARAMS };
-
-export default class AuthSaml extends Component {
-  @service store;
-  @service featureFlag;
-
-  @tracked errorMessage;
-
-  getWindow() {
-    return this.window || window;
-  }
-
-  get canLoginSaml() {
-    return this.getWindow().isSecureContext;
-  }
-
-  async fetchRole(roleName) {
-    const path = this.args.selectedAuthPath || this.args.selectedAuthType;
-    const id = JSON.stringify([path, roleName]);
-    return this.store.findRecord('role-saml', id, {
-      adapterOptions: { namespace: this.args.namespace },
-    });
-  }
-
-  cancelLogin(samlWindow, errorMessage) {
-    this.closeWindow(samlWindow);
-    this.handleSAMLError(errorMessage);
-    this.exchangeSAMLTokenPollID.cancelAll();
-  }
-
-  closeWindow(samlWindow) {
-    this.watchPopup.cancelAll();
-    this.watchCurrent.cancelAll();
-    samlWindow.close();
-  }
-
-  handleSAMLError(err) {
-    this.args.onLoading(false);
-    this.args.onError(err);
-  }
-
-  @task
-  *watchPopup(samlWindow) {
-    while (true) {
-      yield timeout(WAIT_TIME);
-      if (!samlWindow || samlWindow.closed) {
-        this.exchangeSAMLTokenPollID.cancelAll();
-        return this.handleSAMLError(ERROR_WINDOW_CLOSED);
-      }
-    }
-  }
-
-  @task
-  *watchCurrent(samlWindow) {
-    // when user is about to change pages, close the popup window
-    yield waitForEvent(this.getWindow(), 'beforeunload');
-    samlWindow?.close();
-  }
-
-  @task
-  *exchangeSAMLTokenPollID(samlWindow, role) {
-    this.args.onLoading(true);
-
-    // start watching the popup window and the current one
-    this.watchPopup.perform(samlWindow);
-    this.watchCurrent.perform(samlWindow);
-
-    const path = this.args.selectedAuthPath || this.args.selectedAuthType;
-    const adapter = this.store.adapterFor('auth-method');
-    this.args.onNamespace(this.args.namespace);
-
-    // Wait up to 3 minutes for the token to become available
-    let resp;
-    for (let i = 0; i < 180; i++) {
-      yield timeout(WAIT_TIME);
-      try {
-        resp = yield adapter.pollSAMLToken(path, role.tokenPollID, role.clientVerifier);
-        if (!resp?.auth) {
-          continue;
-        }
-        // We've obtained the Vault token for the authentication flow, now log in.
-        yield this.args.onSubmit(null, null, resp.auth.client_token);
-        this.closeWindow(samlWindow);
-        return;
-      } catch (e) {
-        if (e.httpStatus === 401) {
-          // Continue to retry on 401 Unauthorized
-          continue;
-        }
-        return this.cancelLogin(samlWindow, errorMessage(e));
-      }
-    }
-    this.cancelLogin(samlWindow, ERROR_TIMEOUT);
-  }
-
-  @action
-  setRole(event) {
-    this.args.onRoleName(event.target.value);
-  }
-  /* Saml auth flow on login button click:
-   * 1. find role-saml record which returns role info
-   * 2. open popup at url defined returned from role
-   * 3. watch popup window for close (and cancel polling if it closes)
-   * 4. poll vault for 200 token response
-   * 5. close popup, stop polling, and trigger onSubmit with token data
-   */
-  @action async startSAMLAuth(callback, data, e) {
-    this.args.onError(null);
-    this.args.onLoading(true);
-    if (e && e.preventDefault) {
-      e.preventDefault();
-    }
-    const roleName = data.role;
-    let role;
-    try {
-      role = await this.fetchRole(roleName);
-    } catch (error) {
-      this.handleSAMLError(error);
-      return;
-    }
-
-    const win = this.getWindow();
-    const POPUP_WIDTH = 500;
-    const POPUP_HEIGHT = 600;
-    const left = win.screen.width / 2 - POPUP_WIDTH / 2;
-    const top = win.screen.height / 2 - POPUP_HEIGHT / 2;
-    const samlWindow = win.open(
-      role.ssoServiceURL,
-      'vaultSAMLWindow',
-      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},resizable,scrollbars=yes,top=${top},left=${left}`
-    );
-
-    this.exchangeSAMLTokenPollID.perform(samlWindow, role);
-  }
-}
diff --git a/ui/app/components/auth/fields.hbs b/ui/app/components/auth/fields.hbs
new file mode 100644
index 00000000000..4620ddc75c6
--- /dev/null
+++ b/ui/app/components/auth/fields.hbs
@@ -0,0 +1,24 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#each @loginFields as |field|}}
+  {{#let field.name field.label field.helperText as |name label helperText|}}
+    <Hds::Form::TextInput::Field
+      {{! For security, we do not support autocomplete at this time }}
+      autocomplete="off"
+      @type={{this.setInputType name}}
+      name={{name}}
+      class="has-bottom-margin-m"
+      data-test-input={{name}}
+      @value={{or (get @formQueryParams name) ""}}
+      as |F|
+    >
+      <F.Label>{{or label (capitalize name)}}</F.Label>
+      {{#if helperText}}
+        <F.HelperText>{{helperText}}</F.HelperText>
+      {{/if}}
+    </Hds::Form::TextInput::Field>
+  {{/let}}
+{{/each}}
\ No newline at end of file
diff --git a/ui/app/components/auth/fields.ts b/ui/app/components/auth/fields.ts
new file mode 100644
index 00000000000..71bf2c1c0aa
--- /dev/null
+++ b/ui/app/components/auth/fields.ts
@@ -0,0 +1,21 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+
+interface Args {
+  loginFields: Field[];
+}
+
+interface Field {
+  name: string; // sets input name
+  label?: string; // label will be "name" capitalized unless label exists
+  helperText?: string;
+}
+
+export default class AuthFields extends Component<Args> {
+  // token or password should render as "password" types, otherwise render text inputs
+  setInputType = (field: string) => (['token', 'password'].includes(field) ? 'password' : 'text');
+}
diff --git a/ui/app/components/auth/form-template.hbs b/ui/app/components/auth/form-template.hbs
new file mode 100644
index 00000000000..5622f6fbd2b
--- /dev/null
+++ b/ui/app/components/auth/form-template.hbs
@@ -0,0 +1,100 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if this.formComponent}}
+  {{#let (component this.formComponent) as |AuthFormComponent|}}
+    {{! renders Auth::Form::Base or Auth::Form::<Type>}}
+    <AuthFormComponent
+      @authType={{this.selectedAuthMethod}}
+      @cluster={{@cluster}}
+      @formQueryParams={{@formQueryParams}}
+      @handleAuthResponse={{@handleAuthResponse}}
+      @loginTransitionIsRunning={{@loginTransitionIsRunning}}
+      @onError={{this.handleError}}
+    >
+      <:namespace>
+        {{yield}}
+      </:namespace>
+
+      <:back>
+        {{#if this.showAlternateView}}
+          <Hds::Button
+            @text="Back"
+            {{on "click" this.toggleView}}
+            @color="tertiary"
+            @icon="arrow-left"
+            data-test-back-button
+          />
+        {{/if}}
+      </:back>
+
+      {{! DIRECT LINK, TABS OR DROPDOWN }}
+      <:authSelectOptions>
+        <div class="has-bottom-margin-m">
+          {{#if this.tabData}}
+            <Auth::Tabs
+              @authTabData={{this.tabData}}
+              @handleTabClick={{this.setAuthType}}
+              @selectedAuthMethod={{this.selectedAuthMethod}}
+            />
+          {{else}}
+            {{! Fallback is dropdown with all auth methods }}
+            <Hds::Form::Select::Field
+              name="selectedAuthMethod"
+              {{on "input" this.setTypeFromDropdown}}
+              data-test-select="auth type"
+              as |F|
+            >
+              <F.Label class="has-top-margin-m">Method</F.Label>
+              <F.Options>
+                {{#each this.supportedAuthTypes as |type|}}
+                  <option selected={{eq this.selectedAuthMethod type}} value={{type}}>
+                    {{get (engines-display-data type) "displayName"}}
+                  </option>
+                {{/each}}
+              </F.Options>
+            </Hds::Form::Select::Field>
+          {{/if}}
+        </div>
+      </:authSelectOptions>
+
+      <:error>
+        {{#if this.errorMessage}}
+          <MessageError @errorMessage={{this.errorMessage}} />
+        {{/if}}
+      </:error>
+
+      <:advancedSettings>
+        {{! custom auth options render their own mount path inputs and token does not support custom paths }}
+        {{#unless this.hideAdvancedSettings}}
+          <Hds::Reveal @text="Advanced settings" data-test-auth-form-options-toggle class="is-fullwidth">
+            <Hds::Form::TextInput::Field name="path" data-test-input="path" as |F|>
+              <F.Label class="has-top-margin-m">Mount path</F.Label>
+              <F.HelperText>
+                If this authentication method was mounted using a non-default path, input it below. Otherwise Vault will
+                assume the default path
+                <Hds::Text::Code class="code-in-text">{{this.selectedAuthMethod}}</Hds::Text::Code>
+                .</F.HelperText>
+            </Hds::Form::TextInput::Field>
+          </Hds::Reveal>
+        {{/unless}}
+      </:advancedSettings>
+
+      <:footer>
+        {{#if (and @alternateView (not this.showAlternateView))}}
+          <Hds::Button
+            {{on "click" this.toggleView}}
+            @color="tertiary"
+            @icon="arrow-right"
+            @iconPosition="trailing"
+            @isInline={{true}}
+            @text="Sign in with other methods"
+            data-test-button="Sign in with other methods"
+          />
+        {{/if}}
+      </:footer>
+    </AuthFormComponent>
+  {{/let}}
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/auth/form-template.ts b/ui/app/components/auth/form-template.ts
new file mode 100644
index 00000000000..87b5d57c988
--- /dev/null
+++ b/ui/app/components/auth/form-template.ts
@@ -0,0 +1,118 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { supportedTypes } from 'vault/utils/auth-form-helpers';
+
+import type VersionService from 'vault/services/version';
+import type ClusterModel from 'vault/models/cluster';
+import type { UnauthMountsByType } from 'vault/vault/auth/form';
+import type { HTMLElementEvent } from 'vault/forms';
+
+/**
+ * @module Auth::FormTemplate
+ * This component is responsible for managing the layout and display logic for the auth form. When initialized it fetches
+ * the unauthenticated sys/internal/ui/mounts endpoint to check the listing_visibility configuration of available mounts.
+ * If mounts have been configured as listing_visibility="unauth" then tabs render for the corresponding method types,
+ * otherwise all auth methods display in a dropdown list. The endpoint is re-requested anytime the namespace input is updated.
+ *
+ * When auth type changes (by selecting a new one from the dropdown or select a tab), the form component updates and
+ * dynamically renders the corresponding form.
+ *
+ *
+ * @param {object | null} alternateView - if an alternate view exists, this is the `FormView` (see interface below) data to render that view.
+ * @param {string} canceledMfaAuth - saved auth type from a cancelled mfa verification
+ * @param {object} cluster - The route model which is the ember data cluster model. contains information such as cluster id, name and boolean for if the cluster is in standby
+ * @param {object} defaultView - The `FormView` (see the interface below) data to render the initial view.
+ * @param {object} initialFormState - sets selectedAuthMethod and showAlternateView based on the login form configuration computed in parent component
+ * @param {function} handleAuthResponse - callback after the initial authentication request, if an mfaRequirement exists the parent renders the mfa form otherwise it fires the loginAndTransition task in the auth controller
+ * @param {array} visibleMountTypes - array of auth method types that have mounts with listing_visibility="unauth"
+ * */
+
+interface Args {
+  alternateView: FormView | null;
+  cluster: ClusterModel;
+  defaultView: FormView;
+  handleAuthResponse: CallableFunction;
+  initialFormState: { initialAuthType: string; showAlternate: boolean };
+  visibleMountTypes: string[];
+}
+
+interface FormView {
+  view: string; // "dropdown" or "tabs"
+  tabData: UnauthMountsByType | null; // tabs to render if view = "tabs"
+}
+
+export default class AuthFormTemplate extends Component<Args> {
+  @service declare readonly version: VersionService;
+
+  supportedAuthTypes: string[];
+
+  @tracked errorMessage = '';
+  @tracked selectedAuthMethod = '';
+  // true → "Back" button renders, false → "Sign in with other methods→" renders if an alternate view exists
+  @tracked showAlternateView = false;
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+    const { initialAuthType, showAlternate } = this.args.initialFormState;
+    this.selectedAuthMethod = initialAuthType;
+    this.showAlternateView = showAlternate;
+    this.supportedAuthTypes = supportedTypes(this.version.isEnterprise);
+  }
+
+  get tabData() {
+    if (this.showAlternateView) return this.args?.alternateView?.tabData;
+    return this.args?.defaultView?.tabData;
+  }
+
+  get formComponent() {
+    const { selectedAuthMethod } = this;
+    // isSupported means there is a component file defined for that auth type
+    const isSupported = this.supportedAuthTypes.includes(selectedAuthMethod);
+    const formFile = () => (['oidc', 'jwt'].includes(selectedAuthMethod) ? 'oidc-jwt' : selectedAuthMethod);
+    const component = isSupported ? formFile() : 'base';
+
+    // an Auth::Form::<Type> component exists for each method in supported-login-methods
+    return `auth/form/${component}`;
+  }
+
+  get hideAdvancedSettings() {
+    // Token does not support custom paths
+    if (this.selectedAuthMethod === 'token') return true;
+
+    // Always show for dropdown mode
+    if (!this.tabData) return false;
+
+    // For remaining scenarios, hide "Advanced settings" if the selected method has visible mount(s)
+    return this.args.visibleMountTypes?.includes(this.selectedAuthMethod);
+  }
+
+  @action
+  setAuthType(authType: string) {
+    this.selectedAuthMethod = authType;
+  }
+
+  @action
+  setTypeFromDropdown(event: HTMLElementEvent<HTMLInputElement>) {
+    this.selectedAuthMethod = event.target.value;
+  }
+
+  @action
+  toggleView() {
+    this.showAlternateView = !this.showAlternateView;
+    const firstAuthTab = Object.keys(this.tabData || {})[0];
+    const type = firstAuthTab || this.args.initialFormState.initialAuthType;
+    this.setAuthType(type);
+  }
+
+  @action
+  handleError(message: string) {
+    this.errorMessage = message;
+  }
+}
diff --git a/ui/app/components/auth/form/base.hbs b/ui/app/components/auth/form/base.hbs
new file mode 100644
index 00000000000..a862e941738
--- /dev/null
+++ b/ui/app/components/auth/form/base.hbs
@@ -0,0 +1,25 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{! Auth methods with standard login flows use this template. To implement any custom logic, this template should be copied into a new hbs file for that method. }}
+
+<form {{on "submit" this.onSubmit}} data-test-auth-form={{@authType}}>
+
+  {{yield to="namespace"}}
+
+  <div class="has-padding-l">
+    {{yield to="back"}}
+    {{yield to="authSelectOptions"}}
+    {{yield to="error"}}
+
+    <Auth::Fields @loginFields={{this.loginFields}} />
+
+    {{yield to="advancedSettings"}}
+
+    <Auth::SignInButton @text="Sign in" @icon={{if (or this.login.isRunning @loginTransitionIsRunning) "loading"}} />
+
+    {{yield to="footer"}}
+  </div>
+</form>
\ No newline at end of file
diff --git a/ui/app/components/auth/form/base.ts b/ui/app/components/auth/form/base.ts
new file mode 100644
index 00000000000..5e009661d90
--- /dev/null
+++ b/ui/app/components/auth/form/base.ts
@@ -0,0 +1,145 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import { task } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+import { sanitizePath } from 'core/utils/sanitize-path';
+import { POSSIBLE_FIELDS } from 'vault/utils/auth-form-helpers';
+import { ResponseError } from '@hashicorp/vault-client-typescript';
+
+import type { HTMLElementEvent } from 'vault/forms';
+import type { LoginFields, NormalizedAuthData, NormalizeAuthResponseKeys } from 'vault/auth/form';
+import type { AuthResponseAuthKey, AuthResponseDataKey } from 'vault/auth/methods';
+import type ApiService from 'vault/services/api';
+import type ClusterModel from 'vault/models/cluster';
+import type FlagsService from 'vault/services/flags';
+import type VersionService from 'vault/services/version';
+import type AuthService from 'vault/services/auth';
+
+/**
+ * @module Auth::Base
+ *
+ * @param {string} authType - chosen login method type
+ * @param {object} cluster - The cluster model which contains information such as cluster id, name and boolean for if the cluster is in standby
+ * @param {function} onError - callback if there is a login error
+ * @param {function} handleAuthResponse - calls onAuthResponse in auth/page redirects if successful
+ */
+
+interface Args {
+  authType: string;
+  cluster: ClusterModel;
+  handleAuthResponse: CallableFunction;
+  onError: CallableFunction;
+}
+
+// This an "abstract" class because it is not meant to be instantiated directly and should be extended from by each auth method type.
+// If at any point the Vault UI wants to support a dynamic list of login methods (for example, via custom auth plugins) this class can be
+// refactored to handle general auth types, but the Vault UI does not currently support this.
+export default abstract class AuthBase extends Component<Args> {
+  @service declare readonly api: ApiService;
+  @service declare readonly flags: FlagsService;
+  @service declare readonly version: VersionService;
+  @service declare readonly auth: AuthService;
+
+  @action
+  onSubmit(event: HTMLElementEvent<HTMLFormElement>) {
+    event.preventDefault();
+    const formData = new FormData(event.target as HTMLFormElement);
+    const data = this.parseFormData(formData);
+    this.login.unlinked().perform(data);
+  }
+
+  login = task(
+    waitFor(async (formData) => {
+      try {
+        const normalizedAuthData = await this.loginRequest(formData);
+        // calls onAuthResponse in parent auth/page.js component
+        this.args.handleAuthResponse(normalizedAuthData);
+      } catch (error) {
+        this.onError(error as ResponseError);
+      }
+    })
+  );
+
+  // This method must be defined by child components and invokes the relevant login method
+  abstract loginRequest(formData: Record<string, any>): Promise<NormalizedAuthData>;
+
+  // Optional method for canceling any additional login items that may be relevant the
+  // authentication workflow for that method, such as canceling polling tasks.
+  cancelLogin?(): void;
+
+  async onError(error: ResponseError | string) {
+    // Cancel any additional login items that may be relevant to that method.
+    // For example, polling tasks or popup windows.
+    if (this.cancelLogin) {
+      this.cancelLogin();
+    }
+
+    let errorMessage = '';
+    if (typeof error === 'string') {
+      errorMessage = error;
+    } else {
+      // If error has not been parsed already then parse and render error message
+      const { message } = await this.api.parseError(error, 'An error occurred, check the Vault logs.');
+      errorMessage = message;
+    }
+
+    this.args.onError(`Authentication failed: ${errorMessage}`);
+  }
+
+  parseFormData(formData: FormData) {
+    const data: LoginFields = {};
+
+    // iterate over method specific fields
+    for (const field of POSSIBLE_FIELDS) {
+      const value = formData.get(field);
+      if (value) {
+        data[field] = typeof value === 'string' ? value : undefined;
+      }
+    }
+
+    // path is supported by all auth methods except token
+    if (this.args.authType !== 'token') {
+      // strip leading or trailing slashes for consistency.
+      // fallback to auth type which is the default path Vault expects.
+      data['path'] = sanitizePath(formData?.get('path')) || this.args.authType;
+    }
+
+    if (this.version.isEnterprise) {
+      // strip leading or trailing slashes for consistency
+      let namespace = sanitizePath(formData?.get('namespace')) || '';
+
+      const hvdRootNs = this.flags.hvdManagedNamespaceRoot; // if HVD managed, this is "admin"
+      if (hvdRootNs) {
+        // HVD managed clusters can only input child namespaces, manually prepend with the hvd root
+        namespace = namespace ? `${hvdRootNs}/${namespace}` : hvdRootNs;
+      }
+      // The namespace input is only sent because some methods use it for additional login steps (i.e. generating callback URLs).
+      // It is not used to set the header for the actual login request because the API service sets the namespace header using
+      // the namespace service, which is updated when the URL "namespace" query param changes.
+      data['namespace'] = namespace;
+    }
+
+    return data;
+  }
+
+  // normalize auth data so stored token data has the same keys regardless of auth type
+  normalizeAuthResponse = (
+    authResponse: AuthResponseAuthKey | AuthResponseDataKey,
+    { authMountPath, displayName, token, ttl }: NormalizeAuthResponseKeys
+  ) => {
+    // authResponse will include enforcement data in the `mfa_requirement` key - if MFA is configured.
+    return this.auth.normalizeAuthData(authResponse, {
+      authMethodType: this.args.authType,
+      authMountPath,
+      displayName,
+      token,
+      ttl,
+    });
+  };
+}
diff --git a/ui/app/components/auth/form/github.ts b/ui/app/components/auth/form/github.ts
new file mode 100644
index 00000000000..c2c557b46df
--- /dev/null
+++ b/ui/app/components/auth/form/github.ts
@@ -0,0 +1,35 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import AuthBase from './base';
+
+import type { GithubLoginApiResponse } from 'vault/vault/auth/methods';
+
+/**
+ * @module Auth::Form::Github
+ * see Auth::Base
+ */
+
+export default class AuthFormGithub extends AuthBase {
+  loginFields = [{ name: 'token', label: 'Github token' }];
+
+  async loginRequest(formData: { path: string; token: string }) {
+    const { path, token } = formData;
+
+    const { auth } = (await this.api.auth.githubLogin(path, {
+      token,
+    })) as GithubLoginApiResponse;
+
+    const { org, username } = auth?.metadata || {};
+    const displayName = org && username ? `${org}/${username}` : username || org || '';
+
+    return this.normalizeAuthResponse(auth, {
+      authMountPath: path,
+      displayName,
+      token: auth.client_token,
+      ttl: auth.lease_duration,
+    });
+  }
+}
diff --git a/ui/app/components/auth/form/ldap.ts b/ui/app/components/auth/form/ldap.ts
new file mode 100644
index 00000000000..c671a65e304
--- /dev/null
+++ b/ui/app/components/auth/form/ldap.ts
@@ -0,0 +1,32 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import AuthBase from './base';
+
+import type { UsernameLoginResponse } from 'vault/vault/auth/methods';
+
+/**
+ * @module Auth::Form::Ldap
+ * see Auth::Base
+ */
+
+export default class AuthFormLdap extends AuthBase {
+  loginFields = [{ name: 'username' }, { name: 'password' }];
+
+  async loginRequest(formData: { path: string; username: string; password: string }) {
+    const { path, username, password } = formData;
+
+    const { auth } = (await this.api.auth.ldapLogin(username, path, {
+      password,
+    })) as UsernameLoginResponse;
+
+    return this.normalizeAuthResponse(auth, {
+      authMountPath: path,
+      displayName: auth?.metadata?.username,
+      token: auth.client_token,
+      ttl: auth.lease_duration,
+    });
+  }
+}
diff --git a/ui/app/components/auth/form/oidc-jwt.hbs b/ui/app/components/auth/form/oidc-jwt.hbs
new file mode 100644
index 00000000000..2c76ec04e39
--- /dev/null
+++ b/ui/app/components/auth/form/oidc-jwt.hbs
@@ -0,0 +1,41 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form
+  {{did-insert this.initializeFormData}}
+  {{! OIDC and JWT share the same form and so @authType is the only indication a user has switched tabs.
+  Selecting a different type means we need to re-initialize form data and re-request the role }}
+  {{did-update this.initializeFormData @authType}}
+  {{! manage input changes at the <form> level since "path" and "namespace" are yielded }}
+  {{on "input" this.updateFormData}}
+  {{on "submit" this.onSubmit}}
+  data-test-auth-form={{@authType}}
+>
+
+  {{yield to="namespace"}}
+
+  <div class="has-padding-l">
+    {{yield to="back"}}
+    {{yield to="authSelectOptions"}}
+    {{yield to="error"}}
+
+    <Auth::Fields @loginFields={{this.loginFields}} @formQueryParams={{@formQueryParams}} />
+
+    {{#unless this.isOIDC}}
+      <Hds::Form::TextInput::Field @type="password" class="has-bottom-margin-m" name="jwt" data-test-input="jwt" as |F|>
+        <F.Label>JWT Token</F.Label>
+      </Hds::Form::TextInput::Field>
+    {{/unless}}
+
+    {{yield to="advancedSettings"}}
+
+    <Auth::SignInButton
+      @icon={{if (or this.login.isRunning @loginTransitionIsRunning) "loading" this.icon}}
+      @text="Sign in {{if this.isOIDC this.providerName}}"
+    />
+
+    {{yield to="footer"}}
+  </div>
+</form>
\ No newline at end of file
diff --git a/ui/app/components/auth/form/oidc-jwt.ts b/ui/app/components/auth/form/oidc-jwt.ts
new file mode 100644
index 00000000000..3f609b56140
--- /dev/null
+++ b/ui/app/components/auth/form/oidc-jwt.ts
@@ -0,0 +1,291 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import AuthBase from './base';
+import Ember from 'ember';
+import { action } from '@ember/object';
+import { dasherize } from '@ember/string';
+import {
+  DOMAIN_PROVIDER_MAP,
+  ERROR_JWT_LOGIN,
+  ERROR_MISSING_PARAMS,
+  ERROR_POPUP_FAILED,
+  ERROR_WINDOW_CLOSED,
+} from 'vault/utils/auth-form-helpers';
+import { restartableTask, task, timeout, waitForEvent } from 'ember-concurrency';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import parseURL from 'core/utils/parse-url';
+
+import type { HTMLElementEvent } from 'vault/forms';
+import type { JwtOidcAuthUrlResponse, JwtOidcLoginApiResponse } from 'vault/vault/auth/methods';
+import type RouterService from '@ember/routing/router-service';
+
+/**
+ * @module Auth::Form::OidcJwt
+ * see Auth::Base
+ *
+ * OIDC can be configured at 'jwt' or 'oidc', see https://developer.hashicorp.com/vault/docs/auth/jwt
+ * we use the same template because displaying the JWT token input depends on the error message
+ * returned when fetching :path/oidc/auth_url
+ */
+
+interface JwtLoginData {
+  namespace?: string;
+  path: string;
+  role?: string;
+  jwt?: string;
+}
+
+interface UrlParseData {
+  hostname: string;
+}
+
+export default class AuthFormOidcJwt extends AuthBase {
+  @service declare readonly router: RouterService;
+
+  loginFields = [
+    {
+      name: 'role',
+      helperText: 'Vault will use the default role to sign in if this field is left blank.',
+    },
+  ];
+
+  // set by form inputs
+  _formData: FormData = new FormData();
+
+  // set during auth prep and login workflow
+  @tracked authUrl: string | null = null;
+  @tracked errorMessage = '';
+  @tracked isOIDC = true;
+
+  get icon() {
+    // Right now there is a bug in HDS where the name includes a space, this line can be removed when we
+    // upgrade to an HDS version with the corrected icon name
+    if (this.provider === 'Ping Identity') return 'ping-identity ';
+    return this.provider ? dasherize(this.provider.toLowerCase()) : '';
+  }
+
+  get providerName() {
+    return `with ${this.provider || 'OIDC Provider'}`;
+  }
+
+  get provider() {
+    const { hostname } = parseURL(this.authUrl) as UrlParseData;
+    if (hostname) {
+      const firstMatch = Object.keys(DOMAIN_PROVIDER_MAP).find((name) => hostname.includes(name));
+      return firstMatch ? DOMAIN_PROVIDER_MAP[firstMatch as keyof typeof DOMAIN_PROVIDER_MAP] : null;
+    }
+    return null;
+  }
+
+  @action
+  initializeFormData(element: HTMLFormElement) {
+    this._formData = new FormData(element);
+    this.fetchAuthUrl.perform();
+  }
+
+  @action
+  updateFormData(event: HTMLElementEvent<HTMLInputElement>) {
+    const { name, value } = event.target;
+    // the selectedAuthMethod dropdown is unrelated to login data so no need to track it in the form state.
+    if (name === 'selectedAuthMethod') return;
+    this._formData?.set(name, value);
+
+    // re-request auth_url if the following inputs have changed. namespace is not included because
+    // when it changes the route model refreshes and a new component instantiates.
+    if (['path', 'role'].includes(name)) {
+      this.fetchAuthUrl.perform(500);
+    }
+  }
+
+  fetchAuthUrl = restartableTask(async (wait = 0) => {
+    // task is restartable so if the user starts typing again,
+    // it will cancel and restart from the beginning.
+    if (wait) await timeout(wait);
+
+    const { namespace = '', path = '', role = '' } = this.parseFormData(this._formData);
+    const redirect_uri = this.generateRedirectUri(namespace, path);
+
+    // reset state
+    this.authUrl = null;
+    this.errorMessage = '';
+
+    try {
+      const { data } = (await this.api.auth.jwtOidcRequestAuthorizationUrl(path, {
+        role,
+        redirect_uri,
+      })) as JwtOidcAuthUrlResponse;
+      this.authUrl = data.auth_url;
+      this.isOIDC = true;
+    } catch (e) {
+      const { status, message } = await this.api.parseError(e);
+      // errors are tracked here but they only display on submit
+      this.errorMessage =
+        // A 400 is returned if OIDC is configured but does not have a default role set.
+        status === 400 ? 'Invalid role. Please try again.' : `Error fetching role: ${message}`;
+      // If the mount is configured for JWT authentication via static keys, JWKS, or OIDC discovery
+      // this specific error is returned. Flip the isOIDC boolean accordingly, otherwise assume OIDC.
+      this.isOIDC = !message.includes(ERROR_JWT_LOGIN);
+    }
+  });
+
+  generateRedirectUri(namespace = '', path = '') {
+    const origin = window.location.origin;
+    const qp = namespace ? { namespace } : {};
+    const routeUrl = this.router.urlFor(
+      'vault.cluster.oidc-callback',
+      { auth_path: path },
+      { queryParams: qp }
+    );
+    return `${origin}${routeUrl}`;
+  }
+
+  // * LOGIN WORKFLOW BEGINS
+  async loginRequest(formData: JwtLoginData) {
+    if (this.isOIDC) {
+      return await this.loginOidc();
+    } else {
+      return await this.loginJwt(formData);
+    }
+  }
+
+  async loginJwt(formData: JwtLoginData) {
+    const { path, jwt, role } = formData;
+    const { auth } = (await this.api.auth.jwtLogin(path, { jwt, role })) as JwtOidcLoginApiResponse;
+    // displayName is not returned by auth response and is set in persistAuthData
+    return this.normalizeAuthResponse(auth, {
+      authMountPath: path,
+      token: auth.client_token,
+      ttl: auth.lease_duration,
+    });
+  }
+
+  async loginOidc() {
+    const oidcWindow = await this.startOIDCAuth();
+    if (oidcWindow) {
+      try {
+        // Initiate watching for the popup and current window
+        this.watchPopup.perform(oidcWindow);
+        this.watchCurrent.perform(oidcWindow);
+        const eventData = await this.prepareForOIDC();
+        const { auth, path } = await this.exchangeOIDC(eventData);
+        // displayName is not returned by auth response and is set in persistAuthData
+        return this.normalizeAuthResponse(auth, {
+          authMountPath: path,
+          token: auth.client_token,
+          ttl: auth.lease_duration,
+        });
+      } finally {
+        this.closeWindow(oidcWindow);
+      }
+    } else {
+      throw `Failed to open OIDC popup window. ${ERROR_POPUP_FAILED}`;
+    }
+  }
+
+  // * OIDC AUTH PART 1
+  // 1. request oidc/auth_url to check for config errors, if none continue
+  // 2. open popup window at auth_url
+  async startOIDCAuth() {
+    await this.fetchAuthUrl.perform();
+
+    if (!this.authUrl) {
+      const error =
+        // authUrl is an empty string if the request succeeds but a role is not properly configured.
+        this.authUrl === ''
+          ? 'Missing auth_url. Please check that allowed_redirect_uris for the role include this mount path.'
+          : this.errorMessage || 'Unknown OIDC error. Check the Vault logs and try again.';
+      throw error;
+    }
+
+    const win = window;
+    const POPUP_WIDTH = 500;
+    const POPUP_HEIGHT = 600;
+    const left = win.screen.width / 2 - POPUP_WIDTH / 2;
+    const top = win.screen.height / 2 - POPUP_HEIGHT / 2;
+    const oidcWindow = win.open(
+      this.authUrl,
+      'vaultOIDCWindow',
+      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},resizable,scrollbars=yes,top=${top},left=${left}`
+    );
+
+    return oidcWindow;
+  }
+
+  // * OIDC AUTH PART 2
+  // 3. watch popups for premature closure
+  // 4. wait for message event from window.postMessage() in oidc-callback route
+  async prepareForOIDC() {
+    // NOTE TO DEVS: Be careful when updating the OIDC flow and ensure the updates
+    // work with implicit flow. See issue https://github.com/hashicorp/vault-plugin-auth-jwt/pull/192
+    const thisWindow = window;
+
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+      // wait for message posted from oidc callback, see issue https://github.com/hashicorp/vault/issues/12436
+      // ensure that postMessage event is from expected source
+      const event = (await waitForEvent(thisWindow, 'message')) as unknown as MessageEvent;
+      if (event.origin === thisWindow.origin && event.isTrusted && event.data.source === 'oidc-callback') {
+        // event.data are params from the oidc callback url parsed by getParamsForCallback in the oidc-callback route
+        return event.data;
+      }
+    }
+  }
+
+  // * OIDC AUTH PART 3
+  // 5. check parsed url for expected state params
+  // 6. if successful, request client_token from oidc/callback
+  // 7. close popups and continue login with client_token
+
+  async exchangeOIDC(oidcState: { path: string; state: string; code: string }) {
+    const { path, state, code } = oidcState;
+    if (!path || !state || !code) {
+      throw ERROR_MISSING_PARAMS;
+    }
+
+    // do the OIDC exchange, set the token and continue login flow
+    const { auth } = (await this.api.auth.jwtOidcCallback(
+      path,
+      undefined,
+      code,
+      state
+    )) as JwtOidcLoginApiResponse;
+    return { auth, path };
+  }
+  //* END LOGIN METHODS
+
+  // MANAGE POPUPS
+  watchPopup = task(async (oidcWindow) => {
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+      const WAIT_TIME = Ember.testing ? 50 : 500;
+
+      await timeout(WAIT_TIME);
+      if (!oidcWindow || oidcWindow.closed) {
+        // Since watchPopup isn't awaited, errors thrown here won't bubble up
+        // and so we must call onError directly instead.
+        this.onError(ERROR_WINDOW_CLOSED);
+        return;
+      }
+    }
+  });
+
+  watchCurrent = task(async (oidcWindow) => {
+    // when user is about to change pages, close the popup window
+    await waitForEvent(window, 'beforeunload');
+    oidcWindow.close();
+  });
+
+  cancelLogin() {
+    this.login.cancelAll();
+  }
+
+  closeWindow(oidcWindow: Window) {
+    this.watchPopup.cancelAll();
+    this.watchCurrent.cancelAll();
+    oidcWindow.close();
+  }
+}
diff --git a/ui/app/components/auth/form/okta.hbs b/ui/app/components/auth/form/okta.hbs
new file mode 100644
index 00000000000..cfc5146bb5c
--- /dev/null
+++ b/ui/app/components/auth/form/okta.hbs
@@ -0,0 +1,31 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if this.showNumberChallenge}}
+  <OktaNumberChallenge
+    @correctAnswer={{this.challengeAnswer}}
+    @hasError={{this.oktaVerifyError}}
+    @onReturnToLogin={{this.cancelLogin}}
+  />
+{{else}}
+  <form {{on "submit" this.onSubmit}} data-test-auth-form={{@authType}}>
+
+    {{yield to="namespace"}}
+
+    <div class="has-padding-l">
+      {{yield to="back"}}
+      {{yield to="authSelectOptions"}}
+      {{yield to="error"}}
+
+      <Auth::Fields @loginFields={{this.loginFields}} />
+
+      {{yield to="advancedSettings"}}
+
+      <Auth::SignInButton @text="Sign in" @icon={{if (or this.login.isRunning @loginTransitionIsRunning) "loading"}} />
+
+      {{yield to="footer"}}
+    </div>
+  </form>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/auth/form/okta.ts b/ui/app/components/auth/form/okta.ts
new file mode 100644
index 00000000000..0a86bb2be2b
--- /dev/null
+++ b/ui/app/components/auth/form/okta.ts
@@ -0,0 +1,93 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import AuthBase from './base';
+import { action } from '@ember/object';
+import { task, timeout } from 'ember-concurrency';
+import { tracked } from '@glimmer/tracking';
+import { waitFor } from '@ember/test-waiters';
+import uuid from 'core/utils/uuid';
+
+import type { OktaVerifyApiResponse, UsernameLoginResponse } from 'vault/vault/auth/methods';
+
+/**
+ * @module Auth::Form::Okta
+ * see Auth::Base
+ * */
+
+export default class AuthFormOkta extends AuthBase {
+  @tracked challengeAnswer = '';
+  @tracked oktaVerifyError = '';
+  @tracked showNumberChallenge = false;
+
+  loginFields = [{ name: 'username' }, { name: 'password' }];
+
+  async loginRequest(formData: { path: string; username: string; password: string }) {
+    const { path, username, password } = formData;
+    // wait for 1s to wait to see if there is a login error before polling
+    await timeout(1000);
+
+    const nonce = uuid();
+    this.pollForOktaNumberChallenge.perform(nonce, path);
+
+    // If an Okta MFA challenge is configured for the end user this request resolves when it is completed.
+    // If a user fails the MFA challenge (e.g. Okta number challenge) this POST login request fails.
+    const { auth } = (await this.api.auth.oktaLogin(username, path, {
+      nonce,
+      password,
+    })) as UsernameLoginResponse;
+
+    return this.normalizeAuthResponse(auth, {
+      authMountPath: path,
+      displayName: auth?.metadata?.username,
+      token: auth.client_token,
+      ttl: auth.lease_duration,
+    });
+  }
+
+  pollForOktaNumberChallenge = task(
+    waitFor(async (nonce, mountPath) => {
+      this.showNumberChallenge = true;
+
+      // keep polling /auth/okta/verify/:nonce API every 1s until response returns with correct_number
+      let verifyNumber = null;
+      while (verifyNumber === null) {
+        await timeout(1000);
+        verifyNumber = await this.requestOktaVerify(nonce, mountPath);
+      }
+
+      // display correct number so user can select on personal MFA device
+      this.challengeAnswer = verifyNumber?.toString() ?? '';
+    })
+  );
+
+  @action
+  async requestOktaVerify(nonce: string, mountPath: string) {
+    try {
+      const { data } = (await this.api.auth.oktaVerify(nonce, mountPath)) as OktaVerifyApiResponse;
+      return data.correct_answer;
+    } catch (e) {
+      const { status, message } = await this.api.parseError(e);
+      if (status === 404) {
+        // if error status is 404 return null to keep polling for a response
+        return null;
+      } else {
+        // this would be unusual, but handling just in case
+        this.oktaVerifyError = message;
+        return;
+      }
+    }
+  }
+
+  @action
+  cancelLogin() {
+    // reset tracked variables and stop polling tasks
+    this.challengeAnswer = '';
+    this.oktaVerifyError = '';
+    this.showNumberChallenge = false;
+    this.pollForOktaNumberChallenge.cancelAll();
+    this.login.cancelAll();
+  }
+}
diff --git a/ui/app/components/auth/form/radius.ts b/ui/app/components/auth/form/radius.ts
new file mode 100644
index 00000000000..9404926047c
--- /dev/null
+++ b/ui/app/components/auth/form/radius.ts
@@ -0,0 +1,32 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import AuthBase from './base';
+
+import type { UsernameLoginResponse } from 'vault/vault/auth/methods';
+
+/**
+ * @module Auth::Form::Radius
+ * see Auth::Base
+ */
+
+export default class AuthFormRadius extends AuthBase {
+  loginFields = [{ name: 'username' }, { name: 'password' }];
+
+  async loginRequest(formData: { path: string; username: string; password: string }) {
+    const { path, username, password } = formData;
+
+    const { auth } = (await this.api.auth.radiusLoginWithUsername(username, path, {
+      password,
+    })) as UsernameLoginResponse;
+
+    return this.normalizeAuthResponse(auth, {
+      authMountPath: path,
+      displayName: auth?.metadata?.username,
+      token: auth.client_token,
+      ttl: auth.lease_duration,
+    });
+  }
+}
diff --git a/ui/app/components/auth/form/saml.hbs b/ui/app/components/auth/form/saml.hbs
new file mode 100644
index 00000000000..afc8d9afc35
--- /dev/null
+++ b/ui/app/components/auth/form/saml.hbs
@@ -0,0 +1,44 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" this.onSubmit}} data-test-auth-form={{@authType}}>
+
+  {{yield to="namespace"}}
+
+  <div class="has-padding-l">
+    {{yield to="back"}}
+    {{yield to="authSelectOptions"}}
+    {{yield to="error"}}
+
+    {{! Authenticating with SAML requires a secure context }}
+    {{#if this.canLoginSaml}}
+      <Auth::Fields @loginFields={{this.loginFields}} @formQueryParams={{@formQueryParams}} />
+
+      {{yield to="advancedSettings"}}
+
+      <Auth::SignInButton
+        @text="Sign in with SAML provider"
+        @icon={{if (or this.login.isRunning @loginTransitionIsRunning) "loading"}}
+      />
+
+    {{else}}
+      <Hds::Alert @type="inline" @color="warning" data-test-saml-auth-not-allowed class="has-bottom-margin-m" as |A|>
+        <A.Title>Insecure context detected</A.Title>
+        <A.Description>
+          Logging in with a SAML auth method requires a browser in a secure context.
+        </A.Description>
+        <A.Description class="has-top-margin-xs">
+          <Hds::Link::Standalone
+            @icon="external-link"
+            @text="Read more about secure contexts."
+            @href="https://developer.mozilla.org/en-US/docs/Web/Security/Secure_Contexts"
+          />
+        </A.Description>
+      </Hds::Alert>
+    {{/if}}
+
+    {{yield to="footer"}}
+  </div>
+</form>
\ No newline at end of file
diff --git a/ui/app/components/auth/form/saml.ts b/ui/app/components/auth/form/saml.ts
new file mode 100644
index 00000000000..8ec86533313
--- /dev/null
+++ b/ui/app/components/auth/form/saml.ts
@@ -0,0 +1,193 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import AuthBase from './base';
+import Ember from 'ember';
+import { encodePath } from 'vault/utils/path-encoding-helpers';
+import { SamlWriteSsoServiceUrlRequestClientTypeEnum } from '@hashicorp/vault-client-typescript';
+import { sanitizePath } from 'core/utils/sanitize-path';
+import { task, timeout, waitForEvent } from 'ember-concurrency';
+import uuid from 'core/utils/uuid';
+import { ERROR_POPUP_FAILED, ERROR_TIMEOUT, ERROR_WINDOW_CLOSED } from 'vault/utils/auth-form-helpers';
+
+import type { SamlLoginApiResponse, SamlSsoServiceUrlApiResponse } from 'vault/vault/auth/methods';
+
+/**
+ * @module Auth::Form::Saml
+ * see Auth::Base
+ */
+
+interface SamlRole {
+  sso_service_url: string;
+  token_poll_id: string;
+  client_verifier: string;
+}
+export default class AuthFormSaml extends AuthBase {
+  loginFields = [
+    {
+      name: 'role',
+      helperText: 'Vault will use the default role to sign in if this field is left blank.',
+    },
+  ];
+
+  get canLoginSaml() {
+    return window.isSecureContext;
+  }
+
+  /* Saml auth flow on login button click:
+   * 1. find role-saml record which returns role info
+   * 2. open popup at url defined returned from role
+   * 3. watch popup window for close (and cancel polling if it closes)
+   * 4. poll vault for 200 token response
+   * 5. close popup, stop polling, and trigger onSubmit with token data
+   */
+  async loginRequest(formData: { namespace: string; path: string; role: string }) {
+    // submit data is parsed by base.ts and a path will always have a value.
+    // either the default of auth type, or the custom inputted path
+    const { namespace, path, role } = formData;
+    const fetchedRole = await this.fetchSamlRole({ namespace, path, role });
+    const samlWindow = await this.startSAMLAuth(fetchedRole.sso_service_url);
+    if (samlWindow) {
+      try {
+        // start watching the popup window and the current one
+        this.watchPopup.perform(samlWindow);
+        this.watchCurrent.perform(samlWindow);
+
+        const { auth } = await this.exchangeSAMLTokenPollID(fetchedRole, { path });
+
+        // displayName is not included in auth response - it is set in persistAuthData
+        return this.normalizeAuthResponse(auth, {
+          authMountPath: path,
+          token: auth.client_token,
+          ttl: auth.lease_duration,
+        });
+      } finally {
+        this.closeWindow(samlWindow);
+      }
+    } else {
+      throw `Failed to open SAML popup window. ${ERROR_POPUP_FAILED}`;
+    }
+  }
+
+  cancelLogin() {
+    this.login.cancelAll();
+  }
+
+  // Fetch role to get sso_service_url which is where popup is opened
+  async fetchSamlRole({ namespace = '', path = '', role = '' }): Promise<SamlRole> {
+    // Create the client verifier and challenge
+    const verifier = uuid();
+    const client_challenge = await this.generateClientChallenge(verifier);
+    const acs_url = this.generateAcsUrl(path, namespace);
+    const client_type = SamlWriteSsoServiceUrlRequestClientTypeEnum.BROWSER; // 'browser'
+    // Kick off the authentication flow by generating the SSO service URL
+    // It requires the client challenge generated from the verifier. We'll
+    // later provide the verifier to match up with the challenge on the server
+    // when we poll for the Vault token by its returned token poll ID.
+    const { data } = (await this.api.auth.samlWriteSsoServiceUrl(path, {
+      acs_url,
+      client_challenge,
+      client_type,
+      role,
+    })) as SamlSsoServiceUrlApiResponse;
+    return {
+      ...data,
+      client_verifier: verifier,
+    };
+  }
+
+  async startSAMLAuth(ssoServiceUrl: string): Promise<Window | null> {
+    const win = window;
+    const POPUP_WIDTH = 500;
+    const POPUP_HEIGHT = 600;
+    const left = win.screen.width / 2 - POPUP_WIDTH / 2;
+    const top = win.screen.height / 2 - POPUP_HEIGHT / 2;
+    const samlWindow = win.open(
+      ssoServiceUrl,
+      'vaultSAMLWindow',
+      `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},resizable,scrollbars=yes,top=${top},left=${left}`
+    );
+
+    return samlWindow;
+  }
+
+  async exchangeSAMLTokenPollID(fetchedRole: SamlRole, { path = '' }) {
+    const WAIT_TIME = Ember.testing ? 50 : 1000;
+    const MAX_TRIES = Ember.testing ? 3 : 180; // 180 is 3 minutes in seconds
+
+    // Wait up to 3 minutes for a token to become available
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      // Poll every one second for the token to become available
+      await timeout(WAIT_TIME);
+
+      try {
+        const { client_verifier, token_poll_id } = fetchedRole;
+        // Exit loop if there's a response
+        return (await this.api.auth.samlWriteToken(path, {
+          client_verifier,
+          token_poll_id,
+        })) as SamlLoginApiResponse;
+      } catch (e) {
+        const { message, status } = await this.api.parseError(e);
+        if (status === 401) {
+          // Continue to retry on 401 Unauthorized
+          continue;
+        }
+        // Just throw the message string because parent onError method will fail if it attempts to re-parse an error.
+        throw message;
+      }
+    }
+
+    throw ERROR_TIMEOUT;
+  }
+
+  // MANAGE POPUPS
+  watchPopup = task(async (samlWindow) => {
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+      const WAIT_TIME = Ember.testing ? 50 : 500;
+      await timeout(WAIT_TIME);
+
+      if (!samlWindow || samlWindow.closed) {
+        // Since watchPopup isn't awaited, errors thrown here won't bubble up
+        // and so we must call onError directly instead.
+        this.onError(ERROR_WINDOW_CLOSED);
+        return;
+      }
+    }
+  });
+
+  watchCurrent = task(async (samlWindow) => {
+    // when user is about to change pages, close the popup window
+    await waitForEvent(window, 'beforeunload');
+    samlWindow?.close();
+  });
+
+  closeWindow(samlWindow: Window) {
+    this.watchPopup.cancelAll();
+    this.watchCurrent.cancelAll();
+    samlWindow.close();
+  }
+
+  // generates a client challenge from a verifier for PKCE (Proof Key for Code Exchange).
+  // The client challenge is the base64(sha256(verifier)). The verifier is
+  // later presented to the server to obtain the resulting Vault token.
+  async generateClientChallenge(verifier: string) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+    const hashArray = new Uint8Array(hashBuffer);
+    return btoa(String.fromCharCode(...hashArray));
+  }
+
+  generateAcsUrl(path: string, namespace: string) {
+    const baseUrl = `${window.location.origin}/v1`;
+    const ns = namespace ? `${encodePath(sanitizePath(namespace))}/` : '';
+    const mountPath = encodePath(sanitizePath(path));
+    // example with "admin" namespace: '${VAULT_ADDR}/v1/admin/auth/saml/callback';
+    // example with "root" namespace: '${VAULT_ADDR}/v1/auth/saml/callback';
+    return `${baseUrl}/${ns}auth/${mountPath}/callback`;
+  }
+}
diff --git a/ui/app/components/auth/form/token.ts b/ui/app/components/auth/form/token.ts
new file mode 100644
index 00000000000..00953148e35
--- /dev/null
+++ b/ui/app/components/auth/form/token.ts
@@ -0,0 +1,32 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import AuthBase from './base';
+
+import type { TokenLoginApiResponse } from 'vault/vault/auth/methods';
+
+/**
+ * @module Auth::Form::Token
+ * see Auth::Base
+ * */
+
+export default class AuthFormToken extends AuthBase {
+  loginFields = [{ name: 'token' }];
+
+  async loginRequest(formData: { token: string }) {
+    const { token } = formData;
+
+    const { data } = (await this.api.auth.tokenLookUpSelf(
+      this.api.buildHeaders({ token })
+    )) as TokenLoginApiResponse;
+
+    // normalize auth data so stored token data has the same keys regardless of auth type
+    return this.normalizeAuthResponse(data, {
+      authMountPath: '',
+      token: data.id,
+      ttl: data.ttl,
+    });
+  }
+}
diff --git a/ui/app/components/auth/form/userpass.ts b/ui/app/components/auth/form/userpass.ts
new file mode 100644
index 00000000000..f999b498130
--- /dev/null
+++ b/ui/app/components/auth/form/userpass.ts
@@ -0,0 +1,33 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import AuthBase from './base';
+
+import type { UsernameLoginResponse } from 'vault/vault/auth/methods';
+
+/**
+ * @module Auth::Form::Userpass
+ * see Auth::Base
+ * */
+
+export default class AuthFormUserpass extends AuthBase {
+  loginFields = [{ name: 'username' }, { name: 'password' }];
+
+  async loginRequest(formData: { path: string; username: string; password: string }) {
+    const { path, username, password } = formData;
+
+    const { auth } = (await this.api.auth.userpassLogin(username, path, {
+      password,
+    })) as UsernameLoginResponse;
+
+    // normalize auth data so stored token data has the same keys regardless of auth type
+    return this.normalizeAuthResponse(auth, {
+      authMountPath: path,
+      displayName: auth?.metadata?.username,
+      token: auth.client_token,
+      ttl: auth.lease_duration,
+    });
+  }
+}
diff --git a/ui/app/components/auth/namespace-input.hbs b/ui/app/components/auth/namespace-input.hbs
new file mode 100644
index 00000000000..9d2bfa699e3
--- /dev/null
+++ b/ui/app/components/auth/namespace-input.hbs
@@ -0,0 +1,49 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="background-neutral-50 has-padding-l">
+  {{#if this.flags.hvdManagedNamespaceRoot}}
+    <Hds::Form::Field @layout="vertical" disabled={{@disabled}} as |F|>
+      <F.Label>Namespace</F.Label>
+      <F.Control>
+        <Hds::SegmentedGroup class="is-fullwidth" as |SG|>
+          <SG.TextInput
+            @type="text"
+            @value="/{{this.flags.hvdManagedNamespaceRoot}}"
+            aria-label="Root namespace for H-C-P managed cluster"
+            class="one-fourth-width"
+            name="hvd-root-namespace"
+            readonly
+            data-test-managed-namespace-root
+          />
+          <SG.TextInput
+            {{on "input" this.handleInput}}
+            {{did-insert this.maybeRefocus}}
+            @value={{this.namespaceInput}}
+            autocomplete="off"
+            disabled={{@disabled}}
+            name="namespace"
+            placeholder="/ (default)"
+            data-test-input="namespace"
+          />
+        </Hds::SegmentedGroup>
+      </F.Control>
+    </Hds::Form::Field>
+  {{else}}
+    <Hds::Form::TextInput::Field
+      {{on "input" this.handleInput}}
+      {{did-insert this.maybeRefocus}}
+      @value={{this.namespaceInput}}
+      autocomplete="off"
+      disabled={{@disabled}}
+      name="namespace"
+      placeholder="/ (root)"
+      data-test-input="namespace"
+      as |F|
+    >
+      <F.Label>Namespace</F.Label>
+    </Hds::Form::TextInput::Field>
+  {{/if}}
+</div>
\ No newline at end of file
diff --git a/ui/app/components/auth/namespace-input.ts b/ui/app/components/auth/namespace-input.ts
new file mode 100644
index 00000000000..1204bf0cd83
--- /dev/null
+++ b/ui/app/components/auth/namespace-input.ts
@@ -0,0 +1,67 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { getRelativePath } from 'core/utils/sanitize-path';
+import { restartableTask, timeout } from 'ember-concurrency';
+import { service } from '@ember/service';
+
+import type { HTMLElementEvent } from 'vault/forms';
+import type ApiService from 'vault/services/api';
+import type FlagsService from 'vault/services/flags';
+
+/**
+ * @module Auth::NamespaceInput
+ * Renders the namespace input for the login form. As a user types, the updateNamespace callback fires in the controller to update the query param in the URL.
+ * When a namespace is updated, the controller sets `shouldRefocusNamespaceInput = true` which refocuses the input after the route refreshes.
+ * For HVD managed clusters the input prepends the administrative namespace: `admin/`. The input is disabled if the url has an OIDC query param: "?o=someprovider"
+ *
+ * @param {boolean} disabled - determines whether or not the namespace input is disabled
+ * @param {function} handleNamespaceUpdate - fires updateNamespace callback in controller
+ * @param {string} namespaceQueryParam - namespace query param from the url
+ * @param {boolean} shouldRefocusNamespaceInput - if true, refocuses the input on `{{did-insert}}`
+ * */
+
+interface Args {
+  handleNamespaceUpdate: CallableFunction;
+  namespaceQueryParam: string;
+  shouldRefocusNamespaceInput: boolean;
+}
+
+export default class AuthNamespaceInput extends Component<Args> {
+  @service declare readonly api: ApiService;
+  @service declare readonly flags: FlagsService;
+
+  get namespaceInput() {
+    const namespaceQueryParam = this.args.namespaceQueryParam;
+    if (this.flags.hvdManagedNamespaceRoot) {
+      // When managed, the user isn't allowed to edit the prefix `admin/`
+      // so prefill just the relative path in the namespace input
+      const path = getRelativePath(namespaceQueryParam, this.flags.hvdManagedNamespaceRoot);
+      return path ? `/${path}` : '';
+    }
+    return namespaceQueryParam;
+  }
+
+  @action
+  async handleInput(event: HTMLElementEvent<HTMLInputElement>) {
+    // user has typed something, so input should be refocused
+    const value = event.target.value;
+    this.updateNamespace.perform(value);
+  }
+
+  updateNamespace = restartableTask(async (namespace) => {
+    await timeout(500);
+    await this.args.handleNamespaceUpdate(namespace);
+  });
+
+  @action
+  maybeRefocus(element: HTMLElement) {
+    if (this.args.shouldRefocusNamespaceInput) {
+      element.focus();
+    }
+  }
+}
diff --git a/ui/app/components/auth/page.hbs b/ui/app/components/auth/page.hbs
new file mode 100644
index 00000000000..678359ae971
--- /dev/null
+++ b/ui/app/components/auth/page.hbs
@@ -0,0 +1,74 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if this.cspError}}
+  <Hds::Alert @type="page" @color="critical" data-test-page-error as |A|>
+    <A.Description>{{this.cspError}}</A.Description>
+  </Hds::Alert>
+{{/if}}
+
+{{#if this.mfaAuthData}}
+  <Mfa::MfaForm
+    @authData={{this.mfaAuthData}}
+    @clusterId={{@cluster.id}}
+    @loginAndTransition={{@loginAndTransition}}
+    @onCancel={{this.onCancelMfa}}
+  />
+{{else}}
+  <SplashPage>
+    <:header>
+      {{#if @oidcProviderQueryParam}}
+        <div class="box is-shadowless is-flex-v-centered" data-test-auth-logo>
+          <LogoEdition aria-label="Sign in with Hashicorp Vault" role="img" />
+        </div>
+      {{else}}
+        <div class="is-flex-v-centered has-bottom-margin-xxl">
+          <div class="brand-icon-large">
+            <Icon @name="vault" @size="24" @stretched={{true}} />
+          </div>
+        </div>
+        <h1 class="title is-3">
+          Sign in to Vault
+        </h1>
+      {{/if}}
+    </:header>
+
+    <:content>
+      <Auth::FormTemplate
+        @alternateView={{this.formViews.alternateView}}
+        @cluster={{@cluster}}
+        @defaultView={{this.formViews.defaultView}}
+        @formQueryParams={{this.formQueryParams}}
+        @handleAuthResponse={{this.onAuthResponse}}
+        @initialFormState={{this.initialFormState}}
+        @loginTransitionIsRunning={{@loginAndTransition.isRunning}}
+        @visibleMountTypes={{this.visibleMountTypes}}
+      >
+        {{! yielded for accessibility so namespace submits as an input of the <form> element }}
+        {{#if (has-feature "Namespaces")}}
+          <Auth::NamespaceInput
+            @disabled={{if @oidcProviderQueryParam true false}}
+            @handleNamespaceUpdate={{@onNamespaceUpdate}}
+            @namespaceQueryParam={{@namespaceQueryParam}}
+            @shouldRefocusNamespaceInput={{@shouldRefocusNamespaceInput}}
+          />
+        {{/if}}
+      </Auth::FormTemplate>
+    </:content>
+
+    <:footer>
+      <div class="has-short-padding">
+        <p class="help has-text-grey-dark" data-test-auth-helptext>
+          {{#if @oidcProviderQueryParam}}
+            Once you log in, you will be redirected back to your application. If you require login credentials, contact your
+            administrator.
+          {{else}}
+            Contact your administrator for login credentials.
+          {{/if}}
+        </p>
+      </div>
+    </:footer>
+  </SplashPage>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/auth/page.ts b/ui/app/components/auth/page.ts
new file mode 100644
index 00000000000..a3ce5d58c48
--- /dev/null
+++ b/ui/app/components/auth/page.ts
@@ -0,0 +1,274 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+
+import type { AuthSuccessResponse } from 'vault/vault/services/auth';
+import type AuthMethodResource from 'vault/resources/auth/method';
+import type { NormalizedAuthData, UnauthMountsByType } from 'vault/vault/auth/form';
+import type AuthService from 'vault/vault/services/auth';
+import type ClusterModel from 'vault/models/cluster';
+import type CspEventService from 'vault/services/csp-event';
+import type { MfaAuthData } from 'vault/vault/auth/mfa';
+import type { Task } from 'ember-concurrency';
+
+/**
+ * @module AuthPage
+ * Auth::Page renders the Auth::FormTemplate or MFA component if an mfa validation is returned from the auth request.
+ * It receives configuration settings from the route's model hook and determines the possible form states passed to Auth::FormTemplate.
+ * The model hook refreshes when the namespace input updates and re-requests `sys/internal/ui/mounts` and the login settings endpoint (enterprise only).
+ *
+ * ⚙️ CONFIGURATION OVERVIEW:
+ * The login form either renders a `dropdown` or `tabs` depending on specific configuration combinations.
+ * In some scenarios, the component supports toggling between a default view and an alternate view.
+ *
+ * 📋 Dropdown (default view)
+ *   ▸ All supported auth methods show in a dropdown.
+ *   ▸ No alternate view.
+ *
+ * 🗂️ Visible mount tabs
+ *   ▸ Groups visible mounts (`listing_visibility="unauth"`) by type and displays as tabs.
+ *   ▸ Alternate view: full dropdown of all methods.
+ *
+ * 🔗 Direct link (via `?with=` query param)
+ *   ▸ If the param references a visible mount, that method renders by default and the mount path is assumed.
+ *     ↳ Alternate view: full dropdown.
+ *   ▸ If the param references a method type (legacy behavior), the method is preselected in the dropdown or its tab is selected.
+ *     ↳ Alternate view: if other methods have visible mounts, the form can toggle between tabs and dropdown. The initial view depends on whether the chosen type is a tab.
+ *
+ * 🏢 Login settings * enterprise only *
+ *   ▸ A namespace can define a default method and/or preferred methods (i.e. "backups") and enable child namespaces to inherit these preferences.
+ *     ✎ Both set:
+ *       ▸ Default method shown initially.
+ *       ▸ Alternate view: preferred methods in tab layout.
+ *     ✎ Only one set:
+ *       ▸ No alternate view.
+ *
+ * 🛠️ Advanced settings toggle reveals the custom path input:
+ *   🚫 No visible mounts:
+ *     ▸ UI defaults to method type as path.
+ *     ▸ "Advanced settings" shows a path input.
+ *   1️⃣ One visible mount:
+ *     ▸ Path is assumed and hidden.
+ *   🔀 Multiple visible mounts:
+ *     ▸ Path dropdown is shown.
+ *
+ * @example
+ * <Auth::Page
+ *  @cluster={{this.model.clusterModel}}
+ *  @directLinkData={{this.model.directLinkData}}
+ *  @loginSettings={{this.model.loginSettings}}
+ *  @namespaceQueryParam={{this.namespaceQueryParam}}
+ *  @oidcProviderQueryParam={{this.oidcProvider}}
+ *  @loginAndTransition={{this.loginAndTransition}}
+ *  @onNamespaceUpdate={{perform this.updateNamespace}}
+ *  @visibleAuthMounts={{this.model.visibleAuthMounts}}
+ * />
+ *
+ * @param {object} cluster - the ember data cluster model. contains information such as cluster id, name and boolean for if the cluster is in standby
+ * @param {object} directLinkData - mount data built from the "with" query param. If param is a mount path and maps to a visible mount, the login form defaults to this mount. Otherwise the form preselects the passed auth type.
+ * @param {object} loginSettings - * enterprise only * login settings configured for the namespace. If set, specifies a default auth method type and/or backup method types
+ * @param {string} namespaceQueryParam - namespace to login with, updated by typing in to the namespace input
+ * @param {string} oidcProviderQueryParam - oidc provider query param, set in url as "?o=someprovider"
+ * @param {function} loginAndTransition - callback task in controller that receives the auth response (after MFA, if enabled) when login is successful
+ * @param {function} onNamespaceUpdate - callback task that passes user input to the controller to update the login namespace in the url query params
+ * @param {object} visibleAuthMounts - array of AuthMethodResources from unauthenticated request to sys/internal/ui/mounts which returns mount paths tuned with `listing_visibility="unauth"`
+ * */
+
+export const CSP_ERROR =
+  "This is a standby Vault node but can't communicate with the active node via request forwarding. Sign in at the active node to use the Vault UI.";
+
+interface Args {
+  cluster: ClusterModel;
+  directLinkData: { type: string; path?: string } | null; // if "path" key is present then mount data is visible
+  loginAndTransition: Task<AuthSuccessResponse, [AuthSuccessResponse]>;
+  loginSettings: { defaultType: string; backupTypes: string[] | null }; // enterprise only
+  roleQueryParam?: string;
+  visibleAuthMounts: AuthMethodResource[];
+}
+
+enum FormView {
+  DROPDOWN = 'dropdown',
+  TABS = 'tabs',
+}
+
+export default class AuthPage extends Component<Args> {
+  @service declare readonly auth: AuthService;
+  @service('csp-event') declare readonly csp: CspEventService;
+
+  @tracked canceledMfaAuth = '';
+  @tracked mfaAuthData: MfaAuthData | null = null;
+
+  get cspError() {
+    const isStandby = this.args.cluster.standby;
+    const hasConnectionViolations = this.csp.connectionViolations.length;
+    return isStandby && hasConnectionViolations ? CSP_ERROR : '';
+  }
+
+  get visibleMountsByType() {
+    const visibleAuthMounts = this.args.visibleAuthMounts;
+    if (visibleAuthMounts) {
+      return visibleAuthMounts.reduce((obj, authMount) => {
+        const { methodType } = authMount;
+        obj[methodType] ??= []; // if an array doesn't already exist for that methodType, create it
+        obj[methodType].push({ ...authMount });
+        return obj;
+      }, {} as UnauthMountsByType);
+    }
+    return null;
+  }
+
+  get visibleMountTypes(): string[] {
+    return Object.keys(this.visibleMountsByType || {});
+  }
+
+  // AUTH FORM STATE GETTERS
+  get formViews() {
+    const { directLinkData, loginSettings } = this.args;
+
+    if (directLinkData) {
+      return this.directLinkViews;
+    }
+
+    if (loginSettings) {
+      return this.loginSettingsViews;
+    }
+
+    if (this.visibleMountsByType) {
+      return this.visibleMountViews;
+    }
+
+    // If none of the above, the UI renders the standard dropdown with no alternate views
+    return this.standardDropdownView;
+  }
+
+  get initialAuthType(): string {
+    // First, prioritize canceledMfaAuth since it's set by user interaction.
+    // Next, "type" from direct link since the URL query param overrides any login settings.
+    // Then, first tab which is either the default method, first backup method or first visible mount tab.
+    // Finally, fallback to the most recently used auth method in localStorage.
+    // Token is the default otherwise.
+    const directLinkType = this.args.directLinkData?.type;
+    const firstTab = Object.keys(this.formViews.defaultView?.tabData || {})[0];
+    return this.canceledMfaAuth || directLinkType || firstTab || this.auth.getAuthType() || 'token';
+  }
+
+  get directLinkViews() {
+    const { directLinkData } = this.args;
+
+    // If "path" key exists we know the "with" query param references a mount with listing_visibility="unauth"
+    // Treat it as a preferred method and hide all other tabs.
+    if (directLinkData?.path) {
+      const tabData = this.filterVisibleMountsByType([directLinkData.type]);
+      const defaultView = this.constructViews(FormView.TABS, tabData);
+      const alternateView = this.constructViews(FormView.DROPDOWN, null);
+
+      return { defaultView, alternateView };
+    }
+
+    // Otherwise, directLinkData just has a "type" key.
+    // Render either visibleMountViews or dropdown with that type preselected
+    return this.visibleMountsByType ? this.visibleMountViews : this.standardDropdownView;
+  }
+
+  get standardDropdownView() {
+    return {
+      defaultView: this.constructViews(FormView.DROPDOWN, null),
+      alternateView: null,
+    };
+  }
+
+  get loginSettingsViews() {
+    const { loginSettings } = this.args;
+    const defaultType = loginSettings?.defaultType;
+    const backupTypes = loginSettings?.backupTypes;
+
+    // If a default type is not set, render backup methods as the initial view
+    const preferredTypes = defaultType ? [defaultType] : backupTypes;
+    let defaultView;
+    if (preferredTypes) {
+      const tabData = this.filterVisibleMountsByType(preferredTypes);
+      defaultView = this.constructViews(FormView.TABS, tabData);
+    }
+
+    // Both default and backups must be set for an alternate view to exist
+    let alternateView = null;
+    if (defaultType && backupTypes) {
+      const tabData = this.filterVisibleMountsByType(backupTypes);
+      alternateView = this.constructViews(FormView.TABS, tabData);
+    }
+
+    return { defaultView, alternateView };
+  }
+
+  get visibleMountViews() {
+    const defaultView = this.constructViews(FormView.TABS, this.visibleMountsByType);
+    const alternateView = this.constructViews(FormView.DROPDOWN, null);
+    return { defaultView, alternateView };
+  }
+
+  get initialFormState() {
+    const { defaultView, alternateView } = this.formViews;
+    // Helper to check if passed tabs include initialAuthType to render
+    const hasTab = (tabs: object) => Object.keys(tabs).includes(this.initialAuthType);
+    const authIsNotDefaultTab = !hasTab(defaultView?.tabData || {});
+    const hasAlternateView = !!alternateView;
+    const authIsAlternateTab = hasTab(alternateView?.tabData || {});
+
+    // In rare cases, pre-toggle the form to the fallback dropdown or backup tabs, if an alternate view exists.
+    // This is only possible in a couple scenarios:
+    // - The default view renders tabs for visible mounts and the "with" query param references a type that is not a tab.
+    // - Auth type is preset from canceled MFA verification or local storage and it is not in the default (initial) view
+    const showAlternate = authIsNotDefaultTab && (hasAlternateView || authIsAlternateTab);
+
+    return { initialAuthType: this.initialAuthType, showAlternate };
+  }
+
+  get formQueryParams() {
+    return { role: this.args.roleQueryParam };
+  }
+
+  // ACTIONS
+  @action
+  async onAuthResponse(normalizedAuthData: NormalizedAuthData) {
+    const hasMfa = 'mfaRequirement' in normalizedAuthData ? normalizedAuthData.mfaRequirement : undefined;
+
+    if (hasMfa) {
+      // if an mfa requirement exists further action is required
+      const { authMethodType, authMountPath } = normalizedAuthData;
+      const parsedMfaResponse = this.auth.parseMfaResponse(hasMfa);
+      this.mfaAuthData = { mfaRequirement: parsedMfaResponse, authMethodType, authMountPath };
+    } else {
+      // Persist auth data in local storage
+      const resp = await this.auth.authSuccess(this.args.cluster.id, normalizedAuthData);
+      // calls loginAndTransition in auth.js controller
+      this.args.loginAndTransition.perform(resp);
+    }
+  }
+
+  @action
+  onCancelMfa() {
+    // before resetting mfaAuthData, preserve auth type
+    this.canceledMfaAuth = this.mfaAuthData?.authMethodType ?? '';
+    this.mfaAuthData = null;
+  }
+
+  // HELPERS
+  private filterVisibleMountsByType(authTypes: string[]) {
+    const tabs: UnauthMountsByType = {};
+    for (const type of authTypes) {
+      // adds visible mounts for each type, if they exist
+      tabs[type] = this.visibleMountsByType?.[type] || null;
+    }
+    return tabs;
+  }
+
+  private constructViews(view: FormView, tabData: UnauthMountsByType | null) {
+    return { view, tabData };
+  }
+}
diff --git a/ui/app/components/auth/sign-in-button.hbs b/ui/app/components/auth/sign-in-button.hbs
new file mode 100644
index 00000000000..805c395c869
--- /dev/null
+++ b/ui/app/components/auth/sign-in-button.hbs
@@ -0,0 +1,13 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Button
+  @text={{@text}}
+  @icon={{@icon}}
+  @isFullWidth={{true}}
+  type="submit"
+  class="has-top-margin-l has-bottom-margin-l"
+  data-test-submit
+/>
\ No newline at end of file
diff --git a/ui/app/components/auth/tabs.hbs b/ui/app/components/auth/tabs.hbs
new file mode 100644
index 00000000000..3d4170ee92c
--- /dev/null
+++ b/ui/app/components/auth/tabs.hbs
@@ -0,0 +1,50 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Tabs @onClickTab={{this.onClickTab}} @selectedTabIndex={{this.selectedTabIndex}} as |T|>
+  {{#each-in @authTabData as |methodType mounts|}}
+    <T.Tab data-test-auth-tab={{methodType}}>{{get (engines-display-data methodType) "displayName"}}</T.Tab>
+    <T.Panel>
+      <div class="has-top-padding-m">
+        {{! Elements "behind" tabs always render on the DOM and are just superficially hidden/shown. 
+	        However, for accessibility, we only want to render form inputs relevant to the selected method. 
+	        By wrapping the elements in this conditional, it only renders them when the tab is selected. }}
+        {{#if (and mounts (eq @selectedAuthMethod methodType))}}
+          {{#if (gt mounts.length 1)}}
+            {{! DROPDOWN for mount paths }}
+            <Hds::Form::Select::Field name="path" data-test-select="path" {{on "change" this.setMount}} as |F|>
+              <F.Label>Mount path</F.Label>
+              {{#if this.mountDescription}}
+                <F.HelperText data-test-description>{{this.mountDescription}}</F.HelperText>
+              {{/if}}
+              <F.Options>
+                {{#each mounts as |mount|}}
+                  <option value={{mount.path}} selected={{eq mount.path this.selectedMountPath}}>{{mount.path}}</option>
+                {{/each}}
+              </F.Options>
+            </Hds::Form::Select::Field>
+          {{else}}
+            {{! SINGLE mount path }}
+            {{#let (get mounts "0") as |mount|}}
+              {{#if mount.description}}
+                <Hds::Text::Body
+                  @tag="p"
+                  @color="faint"
+                  class="white-space-pre-line"
+                  data-test-description
+                >{{mount.description}}</Hds::Text::Body>
+              {{/if}}
+              {{! the token auth method does't support custom paths so no need to render an input }}
+              {{#if (not-eq @selectedAuthMethod "token")}}
+                {{! path is hidden so it is submitted with FormData but does not clutter the login form }}
+                <input type="hidden" id="path" name="path" value={{mount.path}} data-test-input="path" />
+              {{/if}}
+            {{/let}}
+          {{/if}}
+        {{/if}}
+      </div>
+    </T.Panel>
+  {{/each-in}}
+</Hds::Tabs>
\ No newline at end of file
diff --git a/ui/app/components/auth/tabs.ts b/ui/app/components/auth/tabs.ts
new file mode 100644
index 00000000000..2a5699e92e9
--- /dev/null
+++ b/ui/app/components/auth/tabs.ts
@@ -0,0 +1,62 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+
+import type { UnauthMountsByType } from 'vault/vault/auth/form';
+import type { HTMLElementEvent } from 'vault/forms';
+
+interface Args {
+  authTabData: UnauthMountsByType;
+  handleTabClick: CallableFunction;
+  selectedAuthMethod: string;
+}
+
+export default class AuthTabs extends Component<Args> {
+  @tracked selectedMountPath = '';
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+    this.setSelectedMountPath();
+  }
+
+  get mountDescription() {
+    const selectedAuth = this.args.selectedAuthMethod;
+    const mounts = this.args.authTabData[selectedAuth];
+    const mount = mounts?.find((m) => m.path === this.selectedMountPath);
+    return mount?.description ?? '';
+  }
+
+  get tabTypes() {
+    return this.args.authTabData ? Object.keys(this.args.authTabData) : [];
+  }
+
+  get selectedTabIndex() {
+    const index = this.tabTypes.indexOf(this.args.selectedAuthMethod);
+    // negative index means the selected method isn't a tab, default to first tab
+    return index < 0 ? 0 : index;
+  }
+
+  @action
+  onClickTab(_event: HTMLElementEvent<HTMLInputElement>, idx: number) {
+    const newMethod = this.tabTypes[idx];
+    this.args.handleTabClick(newMethod);
+    // Reset selected mount path when tab changes
+    this.setSelectedMountPath();
+  }
+
+  @action
+  setMount(event: HTMLElementEvent<HTMLInputElement>) {
+    this.selectedMountPath = event.target.value;
+  }
+
+  private setSelectedMountPath() {
+    const mounts = this.args.authTabData[this.args.selectedAuthMethod];
+    const firstMount = mounts?.length ? mounts[0] : null;
+    this.selectedMountPath = firstMount?.path ?? '';
+  }
+}
diff --git a/ui/app/components/b64-toggle.hbs b/ui/app/components/b64-toggle.hbs
new file mode 100644
index 00000000000..3948e70ee8e
--- /dev/null
+++ b/ui/app/components/b64-toggle.hbs
@@ -0,0 +1,17 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<button
+  type="button"
+  class="button b64-toggle {{if @isInput 'is-input' 'is-textarea'}}"
+  {{on "click" this.handleClick}}
+  ...attributes
+>
+  {{#if this.isBase64}}
+    Decode from base64
+  {{else}}
+    Encode to base64
+  {{/if}}
+</button>
\ No newline at end of file
diff --git a/ui/app/components/b64-toggle.js b/ui/app/components/b64-toggle.js
deleted file mode 100644
index 2dbf5671c5f..00000000000
--- a/ui/app/components/b64-toggle.js
+++ /dev/null
@@ -1,136 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { equal } from '@ember/object/computed';
-import { isBlank } from '@ember/utils';
-import Component from '@ember/component';
-import { set, computed } from '@ember/object';
-import { encodeString, decodeString } from 'vault/utils/b64';
-
-const B64 = 'base64';
-const UTF8 = 'utf-8';
-export default Component.extend({
-  tagName: 'button',
-  attributeBindings: ['type', 'data-test-transit-b64-toggle'],
-  type: 'button',
-  classNames: ['button', 'b64-toggle'],
-  classNameBindings: ['isInput:is-input:is-textarea'],
-
-  /*
-   * Whether or not the toggle is associated with an input.
-   * Also bound to `is-input` and `is-textarea` classes
-   * Defaults to true
-   *
-   * @public
-   * @type boolean
-   */
-
-  isInput: true,
-
-  /*
-   * The value that will be mutated when the encoding is toggled
-   *
-   * @public
-   * @type string
-   */
-  value: null,
-
-  /*
-   * The encoding of `value` when the component is initialized.
-   * Defaults to 'utf-8'.
-   * Possible values: 'utf-8' and 'base64'
-   *
-   * @public
-   * @type string
-   */
-  initialEncoding: UTF8,
-
-  /*
-   * A cached version of value - used to determine if the input has changed since encoding.
-   *
-   * @private
-   * @type string
-   */
-  _value: '',
-
-  /*
-   * The current encoding of `value`.
-   * Possible values: 'utf-8' and 'base64'
-   *
-   * @private
-   * @type string
-   */
-  currentEncoding: '',
-
-  /*
-   * The encoding when we last mutated `value`.
-   * Possible values: 'utf-8' and 'base64'
-   *
-   * @private
-   * @type string
-   */
-  lastEncoding: '',
-
-  /*
-   * Is the value known to be base64-encoded.
-   *
-   * @private
-   * @type boolean
-   */
-  isBase64: equal('currentEncoding', B64),
-
-  /*
-   * Does the current value match the cached _value, i.e. has the input been mutated since we encoded.
-   *
-   * @private
-   * @type boolean
-   */
-  valuesMatch: computed('value', '_value', function () {
-    const { value, _value } = this;
-    const anyBlank = isBlank(value) || isBlank(_value);
-    return !anyBlank && value === _value;
-  }),
-
-  init() {
-    this._super(...arguments);
-    const initial = this.initialEncoding;
-    set(this, 'currentEncoding', initial);
-    if (initial === B64) {
-      set(this, '_value', this.value);
-      set(this, 'lastEncoding', B64);
-    }
-  },
-
-  didReceiveAttrs() {
-    this._super();
-    // if there's no value, reset encoding
-    if (this.value === '') {
-      set(this, 'currentEncoding', UTF8);
-      return;
-    }
-    // the value has changed after we transformed it so we reset currentEncoding
-    if (this.isBase64 && !this.valuesMatch) {
-      set(this, 'currentEncoding', UTF8);
-    }
-    // the value changed back to one we previously had transformed
-    if (this.lastEncoding === B64 && this.valuesMatch) {
-      set(this, 'currentEncoding', B64);
-    }
-  },
-
-  click() {
-    const val = this.value;
-    const isUTF8 = this.currentEncoding === UTF8;
-    if (!val) {
-      return;
-    }
-    const newVal = isUTF8 ? encodeString(val) : decodeString(val);
-    const encoding = isUTF8 ? B64 : UTF8;
-    set(this, 'value', newVal);
-    set(this, '_value', newVal);
-    set(this, 'lastEncoding', encoding);
-    set(this, 'currentEncoding', encoding);
-  },
-});
diff --git a/ui/app/components/b64-toggle.ts b/ui/app/components/b64-toggle.ts
new file mode 100644
index 00000000000..e3ff5befc49
--- /dev/null
+++ b/ui/app/components/b64-toggle.ts
@@ -0,0 +1,108 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { isBlank } from '@ember/utils';
+import { encodeString, decodeString } from 'core/utils/b64';
+
+const B64 = 'base64';
+const UTF8 = 'utf-8';
+
+type EncodingType = 'base64' | 'utf-8';
+
+interface B64ToggleSignature {
+  Args: {
+    /**
+     * The value that will be mutated when the encoding is toggled
+     */
+    value: string;
+    /**
+     * The encoding of `value` when the component is initialized.
+     * Defaults to 'utf-8'.
+     * Possible values: 'utf-8' and 'base64'
+     */
+    initialEncoding?: EncodingType;
+    /**
+     * Whether or not the toggle is associated with an input.
+     * Also bound to `is-input` and `is-textarea` classes
+     * Defaults to true
+     */
+    isInput?: boolean;
+    /**
+     * Callback to update the value when encoding is toggled
+     */
+    onUpdate?: (newValue: string) => void;
+  };
+  Element: HTMLButtonElement;
+}
+
+/**
+ * @module B64Toggle
+ * B64Toggle component provides base64 encoding/decoding functionality.
+ * It toggles between UTF-8 and base64 encoding of a value.
+ *
+ * @example
+ * <B64Toggle @value={{this.data}} @initialEncoding="utf-8" @isInput={{true}} />
+ */
+export default class B64Toggle extends Component<B64ToggleSignature> {
+  @tracked _value = '';
+  @tracked _b64Value = '';
+
+  get valuesMatch(): boolean {
+    if (isBlank(this.args.value) || isBlank(this._b64Value)) {
+      return false;
+    }
+    return this.args.value === this._b64Value;
+  }
+
+  get currentEncoding(): EncodingType {
+    return isBlank(this.args.value) ? UTF8 : this.valuesMatch ? B64 : UTF8;
+  }
+
+  constructor(owner: unknown, args: B64ToggleSignature['Args']) {
+    super(owner, args);
+
+    if (this.initialEncoding) {
+      if (this.initialEncoding === B64) {
+        this._b64Value = this.args.value;
+      }
+    }
+  }
+
+  get initialEncoding(): EncodingType {
+    return this.args.initialEncoding || UTF8;
+  }
+
+  /**
+   * Is the value known to be base64-encoded.
+   */
+  get isBase64(): boolean {
+    return this.currentEncoding === B64;
+  }
+
+  @action
+  handleClick(): void {
+    const val = this.args.value;
+    const isUTF8 = this.currentEncoding === UTF8;
+    if (!val) {
+      return;
+    }
+    const newVal = isUTF8 ? encodeString(val) : decodeString(val);
+
+    // if the current value is UTF-8, store the base64 for the newVal which is base64
+    if (isUTF8) {
+      this._b64Value = newVal;
+    }
+    // Update internal state
+    this._value = newVal;
+
+    // Call the update callback if provided
+    if (this.args.onUpdate) {
+      this.args.onUpdate(newVal);
+    }
+  }
+}
diff --git a/ui/app/components/basic-dropdown/trigger.js b/ui/app/components/basic-dropdown/trigger.js
deleted file mode 100644
index 49e420c102a..00000000000
--- a/ui/app/components/basic-dropdown/trigger.js
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Trigger from 'ember-basic-dropdown/components/basic-dropdown/trigger';
-
-export default Trigger.extend({
-  attributeBindings: ['type'],
-});
diff --git a/ui/app/templates/components/calendar-widget.hbs b/ui/app/components/calendar-widget.hbs
similarity index 97%
rename from ui/app/templates/components/calendar-widget.hbs
rename to ui/app/components/calendar-widget.hbs
index cd428c422b5..5c1de68295d 100644
--- a/ui/app/templates/components/calendar-widget.hbs
+++ b/ui/app/components/calendar-widget.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <BasicDropdown @class="popup-menu" @horizontalPosition="auto-right" @verticalPosition="below" as |D|>
   <D.Trigger data-test-calendar-widget-trigger class={{concat "toolbar-link" (if D.isOpen " is-active")}} @htmlTag="button">
@@ -15,7 +15,7 @@
       <Hds::Text::Body class="calendar-title" @color="faint">DATE OPTIONS</Hds::Text::Body>
       {{! TODO Hds::Dropdown swapout }}
       <ul class="menu-list">
-        <li class="action">
+        <li>
           <button
             data-test-current-month
             class="link is-no-underline has-text-weight-semibold is-ghost"
@@ -26,7 +26,7 @@
             Current month
           </button>
         </li>
-        <li class="action">
+        <li>
           <button
             data-test-current-billing-period
             class="link is-no-underline has-text-weight-semibold is-ghost"
@@ -37,7 +37,7 @@
             Current billing period
           </button>
         </li>
-        <li class="action">
+        <li>
           <button
             data-test-show-calendar
             class={{concat "link is-no-underline has-text-weight-semibold is-ghost" (if this.showCalendar " is-active")}}
diff --git a/ui/app/components/calendar-widget.js b/ui/app/components/calendar-widget.js
deleted file mode 100644
index 804c9af1963..00000000000
--- a/ui/app/components/calendar-widget.js
+++ /dev/null
@@ -1,103 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-import { tracked } from '@glimmer/tracking';
-import { ARRAY_OF_MONTHS, parseAPITimestamp } from 'core/utils/date-formatters';
-import { addYears, isSameYear, subYears } from 'date-fns';
-import timestamp from 'core/utils/timestamp';
-/**
- * @module CalendarWidget
- * CalendarWidget component is used in the client counts dashboard to select a month/year to query the /activity endpoint.
- * The component returns an object with selected date info, example: { dateType: 'endDate', monthIdx: 0, monthName: 'January', year: 2022 }
- *
- * @example
- * ```js
- * <CalendarWidget @startTimestamp={{this.startTime}} @endTimestamp={{this.endTime}} @selectMonth={{this.handleSelection}} />
- *
- *    @param {string} startTimestamp - ISO timestamp string of the calendar widget's start time, displays in dropdown trigger
- *    @param {string} endTimestamp - ISO timestamp string for the calendar widget's end time, displays in dropdown trigger
- *    @param {function} selectMonth - callback function from parent - fires when selecting a month or clicking "Current billing period"
- *  />
- * ```
- */
-export default class CalendarWidget extends Component {
-  currentDate = timestamp.now();
-  @tracked calendarDisplayDate = this.currentDate; // init to current date, updates when user clicks on calendar chevrons
-  @tracked showCalendar = false;
-
-  // both date getters return a date object
-  get startDate() {
-    return parseAPITimestamp(this.args.startTimestamp);
-  }
-  get endDate() {
-    return parseAPITimestamp(this.args.endTimestamp);
-  }
-  get displayYear() {
-    return this.calendarDisplayDate.getFullYear();
-  }
-  get disableFutureYear() {
-    return isSameYear(this.calendarDisplayDate, this.currentDate);
-  }
-  get disablePastYear() {
-    // calendar widget should only go as far back as the passed in start time
-    return isSameYear(this.calendarDisplayDate, this.startDate);
-  }
-  get widgetMonths() {
-    const startYear = this.startDate.getFullYear();
-    const startMonthIdx = this.startDate.getMonth();
-    return ARRAY_OF_MONTHS.map((month, index) => {
-      let readonly = false;
-
-      // if widget is showing same year as @startTimestamp year, disable if month is before start month
-      if (startYear === this.displayYear && index < startMonthIdx) {
-        readonly = true;
-      }
-
-      // if widget showing current year, disable if month is later than current month
-      if (this.displayYear === this.currentDate.getFullYear() && index > this.currentDate.getMonth()) {
-        readonly = true;
-      }
-      return {
-        index,
-        year: this.displayYear,
-        name: month,
-        readonly,
-      };
-    });
-  }
-
-  @action
-  addYear() {
-    this.calendarDisplayDate = addYears(this.calendarDisplayDate, 1);
-  }
-
-  @action
-  subYear() {
-    this.calendarDisplayDate = subYears(this.calendarDisplayDate, 1);
-  }
-
-  @action
-  toggleShowCalendar() {
-    this.showCalendar = !this.showCalendar;
-    this.calendarDisplayDate = this.endDate;
-  }
-
-  @action
-  handleDateShortcut(dropdown, { target }) {
-    this.args.selectMonth({ dateType: target.name }); // send clicked shortcut to parent callback
-    this.showCalendar = false;
-    dropdown.close();
-  }
-
-  @action
-  selectMonth(month, dropdown) {
-    const { index, year, name } = month;
-    this.toggleShowCalendar();
-    this.args.selectMonth({ monthIdx: index, monthName: name, year, dateType: 'endDate' });
-    dropdown.close();
-  }
-}
diff --git a/ui/app/components/clients/activity.ts b/ui/app/components/clients/activity.ts
deleted file mode 100644
index 7e57618cc7d..00000000000
--- a/ui/app/components/clients/activity.ts
+++ /dev/null
@@ -1,198 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// base component for counts child routes that can be extended as needed
-// contains getters that filter and extract data from activity model for use in charts
-
-import Component from '@glimmer/component';
-import { isAfter, isBefore, isSameMonth, fromUnixTime } from 'date-fns';
-import { parseAPITimestamp } from 'core/utils/date-formatters';
-import { calculateAverage } from 'vault/utils/chart-helpers';
-
-import type ClientsActivityModel from 'vault/models/clients/activity';
-import type {
-  ClientActivityNewClients,
-  ClientActivityMonthly,
-  ClientActivityResourceByKey,
-} from 'vault/models/clients/activity';
-import type ClientsVersionHistoryModel from 'vault/models/clients/version-history';
-
-interface Args {
-  activity: ClientsActivityModel;
-  versionHistory: ClientsVersionHistoryModel[];
-  startTimestamp: number;
-  endTimestamp: number;
-  namespace: string;
-  mountPath: string;
-}
-
-export default class ClientsActivityComponent extends Component<Args> {
-  average = (
-    data:
-      | ClientActivityMonthly[]
-      | (ClientActivityResourceByKey | undefined)[]
-      | (ClientActivityNewClients | undefined)[]
-      | undefined,
-    key: string
-  ) => {
-    return calculateAverage(data, key);
-  };
-
-  get startTimeISO() {
-    return fromUnixTime(this.args.startTimestamp).toISOString();
-  }
-
-  get endTimeISO() {
-    return fromUnixTime(this.args.endTimestamp).toISOString();
-  }
-
-  get byMonthActivityData() {
-    const { activity, namespace } = this.args;
-    return namespace ? this.filteredActivityByMonth : activity.byMonth;
-  }
-
-  get byMonthNewClients() {
-    return this.byMonthActivityData ? this.byMonthActivityData?.map((m) => m?.new_clients) : [];
-  }
-
-  get filteredActivityByMonth() {
-    const { namespace, mountPath, activity } = this.args;
-    if (!namespace && !mountPath) {
-      return activity.byMonth;
-    }
-    const namespaceData = activity.byMonth
-      .map((m) => m.namespaces_by_key[namespace as keyof typeof m.namespaces_by_key])
-      .filter((d) => d !== undefined);
-
-    if (!mountPath) {
-      return namespaceData.length === 0 ? undefined : namespaceData;
-    }
-
-    const mountData = mountPath
-      ? namespaceData.map((namespace) => namespace?.mounts_by_key[mountPath]).filter((d) => d !== undefined)
-      : namespaceData;
-
-    return mountData.length === 0 ? undefined : mountData;
-  }
-
-  get filteredActivityByNamespace() {
-    const { namespace, activity } = this.args;
-    return activity.byNamespace.find((ns) => ns.label === namespace);
-  }
-
-  get filteredActivityByAuthMount() {
-    return this.filteredActivityByNamespace?.mounts?.find((mount) => mount.label === this.args.mountPath);
-  }
-
-  get filteredActivity() {
-    return this.args.mountPath ? this.filteredActivityByAuthMount : this.filteredActivityByNamespace;
-  }
-
-  get isCurrentMonth() {
-    const { activity } = this.args;
-    const current = parseAPITimestamp(activity.responseTimestamp) as Date;
-    const start = parseAPITimestamp(activity.startTime) as Date;
-    const end = parseAPITimestamp(activity.endTime) as Date;
-    return isSameMonth(start, current) && isSameMonth(end, current);
-  }
-
-  get isDateRange() {
-    const { activity } = this.args;
-    return !isSameMonth(
-      parseAPITimestamp(activity.startTime) as Date,
-      parseAPITimestamp(activity.endTime) as Date
-    );
-  }
-
-  // (object) top level TOTAL client counts for given date range
-  get totalUsageCounts() {
-    const { namespace, activity } = this.args;
-    return namespace ? this.filteredActivity : activity.total;
-  }
-
-  get upgradeDuringActivity() {
-    const { versionHistory, activity } = this.args;
-    if (versionHistory) {
-      // filter for upgrade data of noteworthy upgrades (1.9 and/or 1.10)
-      const upgradeVersionHistory = versionHistory.filter(
-        ({ version }) => version.match('1.9') || version.match('1.10')
-      );
-      if (upgradeVersionHistory.length) {
-        const activityStart = parseAPITimestamp(activity.startTime) as Date;
-        const activityEnd = parseAPITimestamp(activity.endTime) as Date;
-        // filter and return all upgrades that happened within date range of queried activity
-        const upgradesWithinData = upgradeVersionHistory.filter(({ timestampInstalled }) => {
-          const upgradeDate = parseAPITimestamp(timestampInstalled) as Date;
-          return isAfter(upgradeDate, activityStart) && isBefore(upgradeDate, activityEnd);
-        });
-        return upgradesWithinData.length === 0 ? null : upgradesWithinData;
-      }
-    }
-    return null;
-  }
-
-  // (object) single month new client data with total counts + array of namespace breakdown
-  get newClientCounts() {
-    if (this.isDateRange || !this.byMonthActivityData) {
-      return null;
-    }
-    return this.byMonthActivityData[0]?.new_clients;
-  }
-
-  // total client data for horizontal bar chart in attribution component
-  get totalClientAttribution() {
-    const { namespace, activity } = this.args;
-    if (namespace) {
-      return this.filteredActivityByNamespace?.mounts || null;
-    } else {
-      return activity.byNamespace || null;
-    }
-  }
-
-  // new client data for horizontal bar chart
-  get newClientAttribution() {
-    // new client attribution only available in a single, historical month (not a date range or current month)
-    if (this.isDateRange || this.isCurrentMonth) return null;
-
-    if (this.args.namespace) {
-      return this.newClientCounts?.mounts || null;
-    } else {
-      return this.newClientCounts?.namespaces || null;
-    }
-  }
-
-  get hasAttributionData() {
-    const { mountPath, namespace } = this.args;
-    if (!mountPath) {
-      if (namespace) {
-        const mounts = this.filteredActivityByNamespace?.mounts?.map((mount) => ({
-          id: mount.label,
-          name: mount.label,
-        }));
-        return mounts && mounts.length > 0;
-      }
-      return !!this.totalClientAttribution && this.totalUsageCounts && this.totalUsageCounts.clients !== 0;
-    }
-
-    return false;
-  }
-
-  get upgradeExplanation() {
-    if (this.upgradeDuringActivity) {
-      if (this.upgradeDuringActivity.length === 1) {
-        const version = this.upgradeDuringActivity[0]?.version || '';
-        if (version.match('1.9')) {
-          return ' How we count clients changed in 1.9, so keep that in mind when looking at the data.';
-        }
-        if (version.match('1.10')) {
-          return ' We added monthly breakdowns and mount level attribution starting in 1.10, so keep that in mind when looking at the data.';
-        }
-      }
-      // return combined explanation if spans multiple upgrades
-      return ' How we count clients changed in 1.9 and we added monthly breakdowns and mount level attribution starting in 1.10. Keep this in mind when looking at the data.';
-    }
-    return null;
-  }
-}
diff --git a/ui/app/components/clients/attribution.hbs b/ui/app/components/clients/attribution.hbs
deleted file mode 100644
index 92425d9c65c..00000000000
--- a/ui/app/components/clients/attribution.hbs
+++ /dev/null
@@ -1,144 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! only show side-by-side horizontal bar charts if data is from a single, historical month }}
-<div
-  class={{concat "chart-wrapper" (if @isHistoricalMonth " dual-chart-grid" " single-chart-grid")}}
-  data-test-clients-attribution
->
-  <div class="chart-header has-header-link has-bottom-margin-m">
-    <div class="header-left">
-      <h2 class="chart-title">Attribution</h2>
-      <p class="chart-description" data-test-attribution-description>{{this.chartText.description}}</p>
-    </div>
-    <div class="header-right">
-      {{#if this.hasCsvData}}
-        <Hds::Button
-          data-test-attribution-export-button
-          @text="Export attribution data"
-          @color="secondary"
-          {{on "click" (fn (mut this.showCSVDownloadModal) true)}}
-        />
-      {{/if}}
-    </div>
-  </div>
-  {{#if this.barChartTotalClients}}
-    {{#if @isHistoricalMonth}}
-      <div class="chart-container-left" data-test-chart-container="new-clients">
-        <h2 class="chart-title">New clients</h2>
-        <p class="chart-description">{{this.chartText.newCopy}}</p>
-        <Clients::HorizontalBarChart
-          @dataset={{this.barChartNewClients}}
-          @chartLegend={{this.attributionLegend}}
-          @totalCounts={{@newUsageCounts}}
-          @noDataMessage="There are no new clients for this namespace during this time period."
-        />
-      </div>
-
-      <div class="chart-container-right" data-test-chart-container="total-clients">
-        <h2 class="chart-title">Total clients</h2>
-        <p class="chart-description">{{this.chartText.totalCopy}}</p>
-        <Clients::HorizontalBarChart @dataset={{this.barChartTotalClients}} @chartLegend={{this.attributionLegend}} />
-      </div>
-    {{else}}
-      <div
-        class={{concat (unless this.barChartTotalClients "chart-empty-state ") "chart-container-wide"}}
-        data-test-chart-container="single-chart"
-      >
-        <Clients::HorizontalBarChart @dataset={{this.barChartTotalClients}} @chartLegend={{this.attributionLegend}} />
-      </div>
-      <div class="chart-subTitle">
-        <p class="chart-subtext" data-test-attribution-subtext>{{this.chartText.totalCopy}}</p>
-      </div>
-
-      <div class="data-details-top" data-test-top-attribution>
-        <h3 class="data-details">Top {{this.attributionBreakdown}}</h3>
-        <p class="data-details">{{this.topClientCounts.label}}</p>
-      </div>
-
-      <div class="data-details-bottom" data-test-attribution-clients>
-        <h3 class="data-details">Clients in {{this.attributionBreakdown}}</h3>
-        <p class="data-details">{{format-number this.topClientCounts.clients}}</p>
-      </div>
-    {{/if}}
-    <div class="legend">
-      {{#each this.attributionLegend as |legend idx|}}
-        <span class="legend-colors dot-{{idx}}"></span><span class="legend-label">{{capitalize legend.label}}</span>
-      {{/each}}
-    </div>
-  {{else}}
-    <div class="chart-empty-state">
-      <EmptyState @icon="skip" @title="No data found" @bottomBorder={{true}} />
-    </div>
-  {{/if}}
-  <div class="timestamp" data-test-attribution-timestamp>
-    {{#if @responseTimestamp}}
-      Updated
-      {{date-format @responseTimestamp "MMM d yyyy, h:mm:ss aaa" withTimeZone=true}}
-    {{/if}}
-  </div>
-</div>
-
-{{! MODAL FOR CSV DOWNLOAD }}
-{{#if this.showCSVDownloadModal}}
-  <Hds::Modal id="attribution-csv-download-modal" @onClose={{fn (mut this.showCSVDownloadModal) false}} as |M|>
-    <M.Header @icon="info" data-test-export-modal-title>
-      Export attribution data
-    </M.Header>
-    <M.Body>
-      <p class="has-bottom-margin-s">
-        This export will include the namespace path, authentication method path, and the associated total, entity, and
-        non-entity clients for the
-        {{if this.formattedEndDate "date range" "month"}}
-        below.
-      </p>
-      {{!--  * SYNC BETA (1.16.0) - beta removal planned for 1.16.1 release, replace copy above with the following
-      <p class="has-bottom-margin-s">
-        This export will include the namespace path, mount path and associated total, entity, non-entity and secrets sync
-        clients for the
-        {{if this.formattedEndDate "date range" "month"}}
-        below.
-      </p>
-      <p class="has-bottom-margin-s">
-        The
-        <code>mount_path</code>
-        for secrets sync clients is the KV v2 engine path and for entity/non-entity clients is the corresponding
-        authentication method path.
-      </p>
-       --}}
-      <p class="has-bottom-margin-s is-subtitle-gray">SELECTED DATE {{if this.formattedEndDate " RANGE"}}</p>
-      <p class="has-bottom-margin-s" data-test-export-date-range>
-        {{this.formattedStartDate}}
-        {{if this.formattedEndDate "-"}}
-        {{this.formattedEndDate}}</p>
-    </M.Body>
-    <M.Footer as |F|>
-      <Hds::ButtonSet>
-        <Hds::Button @text="Export" {{on "click" (fn this.exportChartData this.formattedCsvFileName)}} />
-        <Hds::Button @text="Cancel" @color="secondary" {{on "click" F.close}} />
-      </Hds::ButtonSet>
-      {{#if @upgradeExplanation}}
-        <Hds::Alert class="has-top-padding-m" @type="compact" @color="warning" as |A|>
-          <A.Description>
-            <strong>Your data contains an upgrade.</strong>
-            {{@upgradeExplanation}}
-            Visit our
-            <Hds::Link::Inline
-              @icon="docs-link"
-              @iconPosition="trailing"
-              @isHrefExternal={{true}}
-              @href={{doc-link
-                "/vault/docs/concepts/client-count/faq#q-which-vault-version-reflects-the-most-accurate-client-counts"
-              }}
-            >
-              Client count FAQ
-            </Hds::Link::Inline>
-            for more information.
-          </A.Description>
-        </Hds::Alert>
-      {{/if}}
-    </M.Footer>
-  </Hds::Modal>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/attribution.js b/ui/app/components/clients/attribution.js
deleted file mode 100644
index 696d70577f4..00000000000
--- a/ui/app/components/clients/attribution.js
+++ /dev/null
@@ -1,223 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-import { tracked } from '@glimmer/tracking';
-import { service } from '@ember/service';
-import { parseAPITimestamp } from 'core/utils/date-formatters';
-import { format, isSameMonth } from 'date-fns';
-
-/**
- * @module Attribution
- * Attribution components display the top 10 total client counts for namespaces or auth methods (mounts) during a billing period.
- * A horizontal bar chart shows on the right, with the top namespace/auth method and respective client totals on the left.
- *
- * @example
- * ```js
- *  <Clients::Attribution
- *    @totalUsageCounts={{this.totalUsageCounts}}
- *    @newUsageCounts={{this.newUsageCounts}}
- *    @totalClientAttribution={{this.totalClientAttribution}}
- *    @newClientAttribution={{this.newClientAttribution}}
- *    @selectedNamespace={{this.selectedNamespace}}
- *    @startTimestamp={{this.startTime}}
- *    @endTimestamp={{this.endTime}}
- *    @isHistoricalMonth={{false}}
- *    @responseTimestamp={{this.responseTimestamp}}
- *    @upgradeExplanation="We added monthly breakdowns and mount level attribution starting in 1.10, so keep that in mind when looking at the data."
- *  />
- * ```
- * @param {object} totalUsageCounts - object with total client counts for chart tooltip text
- * @param {object} newUsageCounts - object with new client counts for chart tooltip text
- * @param {array} totalClientAttribution - array of objects containing a label and breakdown of client counts for total clients
- * @param {array} newClientAttribution - array of objects containing a label and breakdown of client counts for new clients
- * @param {string} selectedNamespace - namespace selected from filter bar
- * @param {string} startTimestamp - timestamp string from activity response to render start date for CSV modal and whether copy reads 'month' or 'date range'
- * @param {string} endTimestamp - timestamp string from activity response to render end date for CSV modal and whether copy reads 'month' or 'date range'
- * @param {string} responseTimestamp -  ISO timestamp created in serializer to timestamp the response, renders in bottom left corner below attribution chart
- * @param {boolean} isHistoricalMonth - when true data is from a single, historical month so side-by-side charts should display for attribution data
- * @param {boolean} upgradeExplanation - if data contains an upgrade, explanation is generated by the parent to be rendered in the export modal
- */
-
-export default class Attribution extends Component {
-  @tracked showCSVDownloadModal = false;
-  @service download;
-  attributionLegend = [
-    { key: 'entity_clients', label: 'entity clients' },
-    { key: 'non_entity_clients', label: 'non-entity clients' },
-    // { key: 'secret_syncs', label: 'secrets sync clients' }, * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-  ];
-
-  get formattedStartDate() {
-    if (!this.args.startTimestamp) return null;
-    return parseAPITimestamp(this.args.startTimestamp, 'MMMM yyyy');
-  }
-  get formattedEndDate() {
-    if (!this.args.startTimestamp && !this.args.endTimestamp) return null;
-    // displays on CSV export modal, no need to display duplicate months and years
-    const startDateObject = parseAPITimestamp(this.args.startTimestamp);
-    const endDateObject = parseAPITimestamp(this.args.endTimestamp);
-    return isSameMonth(startDateObject, endDateObject) ? null : format(endDateObject, 'MMMM yyyy');
-  }
-
-  get hasCsvData() {
-    return this.args.totalClientAttribution ? this.args.totalClientAttribution.length > 0 : false;
-  }
-
-  get isSingleNamespace() {
-    if (!this.args.totalClientAttribution) {
-      return 'no data';
-    }
-    // if a namespace is selected, then we're viewing top 10 auth methods (mounts)
-    return !!this.args.selectedNamespace;
-  }
-
-  // truncate data before sending to chart component
-  get barChartTotalClients() {
-    return this.args.totalClientAttribution?.slice(0, 10);
-  }
-
-  get barChartNewClients() {
-    return this.args.newClientAttribution?.slice(0, 10);
-  }
-
-  get topClientCounts() {
-    // get top namespace or auth method
-    return this.args.totalClientAttribution ? this.args.totalClientAttribution[0] : null;
-  }
-
-  get attributionBreakdown() {
-    // display text for hbs
-    return this.isSingleNamespace ? 'auth method' : 'namespace';
-  }
-
-  get chartText() {
-    const dateText = this.formattedEndDate ? 'date range' : 'month';
-    switch (this.isSingleNamespace) {
-      case true:
-        return {
-          description:
-            'This data shows the top ten authentication methods by client count within this namespace, and can be used to understand where clients are originating. Authentication methods are organized by path.',
-          newCopy: `The new clients used by the auth method for this ${dateText}. This aids in understanding which auth methods create and use new clients${
-            dateText === 'date range' ? ' over time.' : '.'
-          }`,
-          totalCopy: `The total clients used by the auth method for this ${dateText}. This number is useful for identifying overall usage volume. `,
-        };
-      case false:
-        return {
-          description:
-            'This data shows the top ten namespaces by client count and can be used to understand where clients are originating. Namespaces are identified by path. To see all namespaces, export this data.',
-          newCopy: `The new clients in the namespace for this ${dateText}.
-          This aids in understanding which namespaces create and use new clients${
-            dateText === 'date range' ? ' over time.' : '.'
-          }`,
-          totalCopy: `The total clients in the namespace for this ${dateText}. This number is useful for identifying overall usage volume.`,
-        };
-      case 'no data':
-        return {
-          description: 'There is a problem gathering data',
-        };
-      default:
-        return '';
-    }
-  }
-
-  // secrets_syncs unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-  // the three necessary CSV changes to add sync data are commented below
-
-  destructureCountsToArray(object) {
-    // destructure the namespace object  {label: 'some-namespace', entity_clients: 171, non_entity_clients: 20, secret_syncs: 10, clients: 201}
-    // to get integers for CSV file
-    // (1) SYNC BETA - add `secrets_syncs to destructured and returned object below
-    const { clients, entity_clients, non_entity_clients } = object;
-    return [clients, entity_clients, non_entity_clients];
-  }
-
-  constructCsvRow(namespaceColumn, mountColumn = null, totalColumns, newColumns = null) {
-    // if namespaceColumn is a string, then we're at mount level attribution, otherwise it is an object
-    // if constructing a namespace row, mountColumn=null so the column is blank, otherwise it is an object
-    const otherColumns = newColumns ? [...totalColumns, ...newColumns] : [...totalColumns];
-    return [
-      `${typeof namespaceColumn === 'string' ? namespaceColumn : namespaceColumn.label}`,
-      `${mountColumn ? mountColumn.label : '*'}`,
-      ...otherColumns,
-    ];
-  }
-
-  generateCsvData() {
-    const totalAttribution = this.args.totalClientAttribution;
-    const newAttribution = this.barChartNewClients ? this.args.newClientAttribution : null;
-    const csvData = [];
-    // added to clarify that the row of namespace totals without an auth method (blank) are not additional clients
-    // but indicate the total clients for that ns, including its auth methods
-    const upgrade = this.args.upgradeExplanation
-      ? `\n **data contains an upgrade, mount summation may not equal namespace totals`
-      : '';
-    const descriptionOfBlanks = this.isSingleNamespace
-      ? ''
-      : `\n  *namespace totals, inclusive of mount clients ${upgrade}`;
-    const csvHeader = [
-      'Namespace path',
-      `"Mount path ${descriptionOfBlanks}"`,
-      'Total clients',
-      'Entity clients',
-      'Non-entity clients',
-      // 'Secrets sync clients', * (2) SYNC BETA - add 'Secrets sync clients' as the last element of csvHeader
-    ];
-
-    if (newAttribution) {
-      csvHeader.push('Total new clients, New entity clients, New non-entity clients'); // * (3) add 'New secrets sync clients' as last string pushed here
-    }
-
-    totalAttribution.forEach((totalClientsObject) => {
-      const namespace = this.isSingleNamespace ? this.args.selectedNamespace : totalClientsObject;
-      const mount = this.isSingleNamespace ? totalClientsObject : null;
-
-      // find new client data for namespace/mount object we're iterating over
-      const newClientsObject = newAttribution
-        ? newAttribution.find((d) => d.label === totalClientsObject.label)
-        : null;
-
-      const totalClients = this.destructureCountsToArray(totalClientsObject);
-      const newClients = newClientsObject ? this.destructureCountsToArray(newClientsObject) : null;
-
-      csvData.push(this.constructCsvRow(namespace, mount, totalClients, newClients));
-      // constructCsvRow returns an array that corresponds to a row in the csv file:
-      // ['ns label', 'mount label', total client #, entity #, non-entity #, ...new client #'s]
-
-      // only iterate through mounts if NOT viewing a single namespace
-      if (!this.isSingleNamespace && namespace.mounts) {
-        namespace.mounts.forEach((mount) => {
-          const newMountData = newAttribution
-            ? newClientsObject?.mounts.find((m) => m.label === mount.label)
-            : null;
-          const mountTotalClients = this.destructureCountsToArray(mount);
-          const mountNewClients = newMountData ? this.destructureCountsToArray(newMountData) : null;
-          csvData.push(this.constructCsvRow(namespace, mount, mountTotalClients, mountNewClients));
-        });
-      }
-    });
-
-    csvData.unshift(csvHeader);
-    // make each nested array a comma separated string, join each array "row" in csvData with line break (\n)
-    return csvData.map((d) => d.join()).join('\n');
-  }
-
-  get formattedCsvFileName() {
-    const endRange = this.formattedEndDate ? `-${this.formattedEndDate}` : '';
-    const csvDateRange = this.formattedStartDate + endRange;
-    return this.isSingleNamespace
-      ? `clients_by_mount_path_${csvDateRange}`
-      : `clients_by_namespace_${csvDateRange}`;
-  }
-
-  @action
-  exportChartData(filename) {
-    const contents = this.generateCsvData();
-    this.download.csv(filename, contents);
-    this.showCSVDownloadModal = false;
-  }
-}
diff --git a/ui/app/components/clients/chart-container.hbs b/ui/app/components/clients/chart-container.hbs
deleted file mode 100644
index 7a2e6ce229c..00000000000
--- a/ui/app/components/clients/chart-container.hbs
+++ /dev/null
@@ -1,54 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! HBS display template for rendering title, description and stat boxes with a chart on the right }}
-
-<div class="chart-wrapper single-chart-grid" ...attributes>
-  <div class="chart-header has-bottom-margin-xl">
-    <h2 class="chart-title">{{@title}}</h2>
-    <p class="chart-description">
-      {{@description}}
-    </p>
-  </div>
-
-  {{#if @hasChartData}}
-    {{#if (has-block "subTitle")}}
-      <div class="chart-subTitle">
-        {{yield to="subTitle"}}
-      </div>
-    {{/if}}
-
-    {{#if (has-block "stats")}}
-      {{yield to="stats"}}
-    {{/if}}
-
-    {{#if (has-block "chart")}}
-      <div class="chart-container-wide">
-        {{yield to="chart"}}
-      </div>
-    {{/if}}
-
-    {{#if @legend}}
-      <div class="legend" data-test-chart-container-legend>
-        {{#each @legend as |legend idx|}}
-          <span class="legend-colors dot-{{idx}}"></span>
-          <span class="legend-label">{{capitalize legend.label}}</span>
-        {{/each}}
-      </div>
-    {{/if}}
-
-  {{else}}
-    <div class="chart-empty-state chart-container-wide">
-      {{yield to="emptyState"}}
-    </div>
-  {{/if}}
-
-  {{#if @timestamp}}
-    <div class="timestamp" data-test-chart-container-timestamp>
-      Updated
-      {{date-format @timestamp "MMM d yyyy, h:mm:ss aaa" withTimeZone=true}}
-    </div>
-  {{/if}}
-</div>
\ No newline at end of file
diff --git a/ui/app/components/clients/charts/line.hbs b/ui/app/components/clients/charts/line.hbs
deleted file mode 100644
index 2acb916d276..00000000000
--- a/ui/app/components/clients/charts/line.hbs
+++ /dev/null
@@ -1,127 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-<div>
-  {{#if this.data}}
-    <div class="lineal-chart" data-test-chart={{@chartTitle}}>
-      <Lineal::Fluid as |width|>
-        {{#let
-          (scale-time domain=this.timeDomain range=(array 0 width) nice=true)
-          (scale-linear domain=this.yDomain range=(array this.chartHeight 0) nice=true)
-          (scale-linear range=(array 0 this.chartHeight))
-          as |xScale yScale tooltipScale|
-        }}
-          <svg width={{width}} height={{this.chartHeight}} class="chart has-grid" data-test-line-chart>
-            {{#if (and xScale.isValid yScale.isValid)}}
-              <Lineal::Axis
-                @scale={{yScale}}
-                @tickCount="4"
-                @tickPadding={{10}}
-                @tickSizeInner={{concat "-" width}}
-                @tickFormat={{this.formatCount}}
-                @orientation="left"
-                @includeDomain={{false}}
-                class="lineal-axis"
-                data-test-y-axis
-              />
-              <Lineal::Axis
-                @scale={{xScale}}
-                @orientation="bottom"
-                transform="translate(0,{{yScale.range.min}})"
-                @includeDomain={{false}}
-                @tickSize="0"
-                @tickPadding={{10}}
-                @tickFormat={{this.formatMonth}}
-                @tickCount={{this.data.length}}
-                class="lineal-axis"
-                data-test-x-axis
-              />
-              {{#each this.upgradedMonths as |d|}}
-                <circle
-                  class="upgrade-circle"
-                  cx={{xScale.compute d.x}}
-                  cy={{yScale.compute d.y}}
-                  r="10"
-                  fill="#FDEEBA"
-                  stroke="none"
-                  data-test-line-chart="upgrade-{{d.month}}"
-                ></circle>
-              {{/each}}
-            {{/if}}
-            <Lineal::Line
-              @data={{this.data}}
-              @x="x"
-              @y="y"
-              @xScale={{xScale}}
-              @yScale={{yScale}}
-              stroke="#0c56e9"
-              stroke-width="0.5"
-              fill="none"
-            />
-            {{! this is here to qualify the scales }}
-            <Lineal::Line
-              @data={{this.data}}
-              @x="x"
-              @y="y"
-              @xScale={{xScale}}
-              @yScale={{tooltipScale}}
-              stroke="none"
-              fill="none"
-            />
-            {{#if (and xScale.isValid yScale.isValid)}}
-              {{#each this.data as |d|}}
-                {{#if (this.hasValue d.y)}}
-                  <circle
-                    cx={{xScale.compute d.x}}
-                    cy={{yScale.compute d.y}}
-                    r="3.5"
-                    fill="#cce3fe"
-                    stroke="#0c56e9"
-                    stroke-width="1.5"
-                    data-test-line-chart="plot-point"
-                  ></circle>
-                  <circle
-                    role="button"
-                    aria-label="Show exact counts for {{date-format d.x 'MMMM yyyy'}}"
-                    cx={{xScale.compute d.x}}
-                    cy={{yScale.compute d.y}}
-                    r="10"
-                    fill="transparent"
-                    {{on "mouseover" (fn (mut this.activeDatum) d)}}
-                    {{on "mouseout" (fn (mut this.activeDatum) null)}}
-                    data-test-hover-circle={{date-format d.x "M/yy"}}
-                  ></circle>
-                {{/if}}
-              {{/each}}
-            {{/if}}
-
-          </svg>
-          {{#if this.activeDatum}}
-            <div
-              class="lineal-tooltip-position from-top-left chart-tooltip"
-              role="status"
-              {{style
-                --x=(this.tooltipX (xScale.compute this.activeDatum.x))
-                --y=(this.tooltipY (yScale.compute this.activeDatum.y))
-              }}
-              data-test-tooltip
-            >
-
-              <p class="bold" data-test-tooltip-month>{{date-format this.activeDatum.x "MMMM yyyy"}}</p>
-              <p>{{format-number this.activeDatum.y}} total clients</p>
-              <p>{{format-number (or this.activeDatum.new)}} new clients</p>
-              {{#if this.activeDatum.tooltipUpgrade}}
-                <br />
-                <p class="has-text-highlight">{{this.activeDatum.tooltipUpgrade}}</p>
-              {{/if}}
-              <div class="chart-tooltip-arrow"></div>
-            </div>
-          {{/if}}
-        {{/let}}
-      </Lineal::Fluid>
-    </div>
-  {{else}}
-    <EmptyState @subTitle={{or @noDataMessage "No data to display"}} @bottomBorder={{true}} />
-  {{/if}}
-</div>
\ No newline at end of file
diff --git a/ui/app/components/clients/charts/line.ts b/ui/app/components/clients/charts/line.ts
deleted file mode 100644
index d10484e0207..00000000000
--- a/ui/app/components/clients/charts/line.ts
+++ /dev/null
@@ -1,144 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { SVG_DIMENSIONS, formatNumbers } from 'vault/utils/chart-helpers';
-import { parseAPITimestamp } from 'core/utils/date-formatters';
-import { format, isValid } from 'date-fns';
-import { debug } from '@ember/debug';
-
-import type { Count, MonthlyChartData, Timestamp } from 'vault/vault/charts/client-counts';
-import type ClientsVersionHistoryModel from 'vault/models/clients/version-history';
-
-interface Args {
-  dataset: MonthlyChartData[];
-  upgradeData: ClientsVersionHistoryModel[];
-  xKey?: string;
-  yKey?: string;
-  chartHeight?: number;
-}
-
-interface ChartData {
-  x: Date;
-  y: number | null;
-  new: number;
-  tooltipUpgrade: string | null;
-  month: string; // used for test selectors and to match key on upgradeData
-}
-
-interface UpgradeByMonth {
-  [key: string]: ClientsVersionHistoryModel;
-}
-
-/**
- * @module LineChart
- * LineChart components are used to display time-based data in a line plot with accompanying tooltip
- *
- * @example
- * ```js
- * <LineChart @dataset={{dataset}} @upgradeData={{this.versionHistory}}/>
- * ```
- * @param {array} dataset - array of objects containing data to be plotted
- * @param {string} [xKey=clients] - string denoting key for x-axis data of dataset. Should reference a timestamp string.
- * @param {string} [yKey=timestamp] - string denoting key for y-axis data of dataset. Should reference a number or null.
- * @param {array} [upgradeData=null] - array of objects containing version history from the /version-history endpoint
- * @param {number} [chartHeight=190] - height of chart in pixels
- */
-export default class LineChart extends Component<Args> {
-  // Chart settings
-  get yKey() {
-    return this.args.yKey || 'clients';
-  }
-  get xKey() {
-    return this.args.xKey || 'timestamp';
-  }
-  get chartHeight() {
-    return this.args.chartHeight || SVG_DIMENSIONS.height;
-  }
-  // Plot points
-  get data(): ChartData[] {
-    try {
-      return this.args.dataset?.map((datum) => {
-        const timestamp = parseAPITimestamp(datum[this.xKey as keyof Timestamp]) as Date;
-        if (isValid(timestamp) === false)
-          throw new Error(`Unable to parse value "${datum[this.xKey as keyof Timestamp]}" as date`);
-        const upgradeMessage = this.getUpgradeMessage(datum);
-        return {
-          x: timestamp,
-          y: (datum[this.yKey as keyof Count] as number) ?? null,
-          new: this.getNewClients(datum),
-          tooltipUpgrade: upgradeMessage,
-          month: datum.month,
-        };
-      });
-    } catch (e) {
-      debug(e as string);
-      return [];
-    }
-  }
-  get upgradedMonths() {
-    return this.data.filter((datum) => datum.tooltipUpgrade);
-  }
-  // Domains
-  get yDomain() {
-    const counts: number[] = this.data
-      .map((d) => d.y)
-      .flatMap((num) => (typeof num === 'number' ? [num] : []));
-    const max = Math.max(...counts);
-    // if max is <=4, hardcode 4 which is the y-axis tickCount so y-axes are not decimals
-    return [0, max <= 4 ? 4 : max];
-  }
-  get timeDomain() {
-    // assume data is sorted by time
-    const firstTime = this.data[0]?.x;
-    const lastTime = this.data[this.data.length - 1]?.x;
-    return [firstTime, lastTime];
-  }
-
-  get upgradeByMonthYear(): UpgradeByMonth {
-    const empty: UpgradeByMonth = {};
-    if (!Array.isArray(this.args.upgradeData)) return empty;
-    return (
-      this.args.upgradeData?.reduce((acc, upgrade) => {
-        if (upgrade.timestampInstalled) {
-          const key = parseAPITimestamp(upgrade.timestampInstalled, 'M/yy');
-          acc[key as string] = upgrade;
-        }
-        return acc;
-      }, empty) || empty
-    );
-  }
-
-  getUpgradeMessage(datum: MonthlyChartData) {
-    const upgradeInfo = this.upgradeByMonthYear[datum.month as string];
-    if (upgradeInfo) {
-      const { version, previousVersion } = upgradeInfo;
-      return `Vault was upgraded
-        ${previousVersion ? 'from ' + previousVersion : ''} to ${version}`;
-    }
-    return null;
-  }
-  getNewClients(datum: MonthlyChartData) {
-    if (!datum?.new_clients) return 0;
-    return (datum?.new_clients[this.yKey as keyof Count] as number) || 0;
-  }
-
-  hasValue = (count: number | null) => {
-    return typeof count === 'number' ? true : false;
-  };
-  // These functions are used by the tooltip
-  formatCount = (count: number) => {
-    return formatNumbers([count]);
-  };
-  formatMonth = (date: Date) => {
-    return format(date, 'M/yy');
-  };
-  tooltipX = (original: number) => {
-    return original.toString();
-  };
-  tooltipY = (original: number) => {
-    return `${this.chartHeight - original + 15}`;
-  };
-}
diff --git a/ui/app/components/clients/charts/vertical-bar-basic.hbs b/ui/app/components/clients/charts/vertical-bar-basic.hbs
index e2119a2f7ca..b0e59acf58c 100644
--- a/ui/app/components/clients/charts/vertical-bar-basic.hbs
+++ b/ui/app/components/clients/charts/vertical-bar-basic.hbs
@@ -1,9 +1,9 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<div class="lineal-chart" data-test-chart={{@chartTitle}}>
+<div class="lineal-chart" data-test-chart={{or @chartTitle "vertical bar chart"}}>
   <Lineal::Fluid as |width|>
     {{#let
       (scale-band domain=this.xDomain range=(array 0 width) padding=0.1)
@@ -11,10 +11,8 @@
       (scale-linear range=(array 0 this.chartHeight) domain=this.yDomain)
       as |xScale yScale hScale|
     }}
-      <svg width={{width}} height={{this.chartHeight}} data-test-sync-bar-chart>
-        <title>
-          {{@chartTitle}}
-        </title>
+      <svg width={{width}} height={{this.chartHeight}}>
+        <title>{{@chartTitle}}</title>
 
         {{#if (and xScale.isValid yScale.isValid)}}
           <Lineal::Axis
@@ -75,7 +73,7 @@
       </svg>
       {{#if this.activeDatum}}
         <div
-          class="lineal-tooltip-position chart-tooltip"
+          class="chart-tooltip"
           role="status"
           {{style
             --x=(this.tooltipX (xScale.compute this.activeDatum.x) xScale.bandwidth)
@@ -99,7 +97,7 @@
       <:head as |H|>
         <H.Tr>
           <H.Th>Month</H.Th>
-          <H.Th>Count of secret syncs</H.Th>
+          <H.Th>{{if @dataKey (humanize @dataKey)}} Count</H.Th>
         </H.Tr>
       </:head>
       <:body as |B|>
diff --git a/ui/app/components/clients/charts/vertical-bar-basic.ts b/ui/app/components/clients/charts/vertical-bar-basic.ts
index e81ad07a86f..dab1d18b5a0 100644
--- a/ui/app/components/clients/charts/vertical-bar-basic.ts
+++ b/ui/app/components/clients/charts/vertical-bar-basic.ts
@@ -1,15 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { tracked } from '@glimmer/tracking';
-import { BAR_WIDTH, formatNumbers } from 'vault/utils/chart-helpers';
+import { BAR_WIDTH, numericalAxisLabel } from 'vault/utils/chart-helpers';
 import { formatNumber } from 'core/helpers/format-number';
 import { parseAPITimestamp } from 'core/utils/date-formatters';
 
-import type { Count, MonthlyChartData } from 'vault/vault/charts/client-counts';
+import type { MonthlyChartData } from 'vault/vault/client-counts/charts';
+import type { TotalClients } from 'vault/vault/client-counts/activity-api';
 
 interface Args {
   data: MonthlyChartData[];
@@ -51,7 +52,7 @@ export default class VerticalBarBasic extends Component<Args> {
   get chartData() {
     return this.args.data.map((d): ChartData => {
       const xValue = d.timestamp as string;
-      const yValue = (d[this.args.dataKey as keyof Count] as number) ?? null;
+      const yValue = (d[this.args.dataKey as keyof TotalClients] as number) ?? null;
       return {
         x: parseAPITimestamp(xValue, 'M/yy') as string,
         y: yValue,
@@ -92,6 +93,6 @@ export default class VerticalBarBasic extends Component<Args> {
   };
 
   formatTicksY = (num: number): string => {
-    return formatNumbers(num) || num.toString();
+    return numericalAxisLabel(num) || num.toString();
   };
 }
diff --git a/ui/app/components/clients/charts/vertical-bar-stacked.hbs b/ui/app/components/clients/charts/vertical-bar-stacked.hbs
new file mode 100644
index 00000000000..c1a3d9ab0aa
--- /dev/null
+++ b/ui/app/components/clients/charts/vertical-bar-stacked.hbs
@@ -0,0 +1,123 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="lineal-chart" data-test-chart={{or @chartTitle "stacked vertical bar chart"}}>
+  <Lineal::Fluid as |width|>
+    {{#let
+      (scale-band domain=this.xBounds range=(array 0 width) padding=0.1)
+      (scale-linear range=(array this.chartHeight 0) domain=this.yBounds)
+      (scale-linear range=(array 0 this.chartHeight) domain=this.yBounds)
+      as |xScale yScale hScale|
+    }}
+      <svg width={{width}} height={{this.chartHeight}}>
+        <title>{{@chartTitle}}</title>
+
+        {{#if (and xScale.isValid yScale.isValid)}}
+          <Lineal::Axis
+            @includeDomain={{false}}
+            @orientation="left"
+            @scale={{yScale}}
+            @tickCount="4"
+            @tickFormat={{this.formatTicksY}}
+            @tickPadding={{10}}
+            @tickSizeInner={{concat "-" width}}
+            class="lineal-axis"
+            data-test-y-axis
+          />
+          <Lineal::Axis
+            @includeDomain={{false}}
+            @orientation="bottom"
+            @scale={{xScale}}
+            @tickFormat={{this.formatTicksX}}
+            @tickPadding={{10}}
+            @tickSize="0"
+            class="lineal-axis"
+            transform="translate(0,{{yScale.range.min}})"
+            data-test-x-axis
+          />
+        {{/if}}
+
+        <Lineal::VBars
+          @data={{this.chartData}}
+          @x="timestamp"
+          @y="counts"
+          @width={{this.barWidth}}
+          @xScale={{xScale}}
+          @yScale={{yScale}}
+          @color="clientType"
+          @colorScale="stacked-bar"
+          transform="translate({{this.barOffset xScale.bandwidth}},0)"
+          data-test-vertical-bar
+        />
+
+        {{! TOOLTIP target rectangles }}
+        {{#if (and xScale.isValid yScale.isValid)}}
+          {{#each this.aggregatedData as |d|}}
+            <rect
+              role="button"
+              aria-label="Show exact counts for {{d.legendX}}"
+              x="0"
+              y="0"
+              height={{this.chartHeight}}
+              width={{xScale.bandwidth}}
+              fill="transparent"
+              stroke="transparent"
+              transform="translate({{xScale.compute d.x}})"
+              {{on "mouseover" (fn (mut this.activeDatum) d)}}
+              {{on "mouseout" (fn (mut this.activeDatum) null)}}
+              data-test-interactive-area={{d.x}}
+            />
+          {{/each}}
+        {{/if}}
+      </svg>
+
+      {{#if this.activeDatum}}
+        <div
+          class="chart-tooltip"
+          role="status"
+          {{style
+            --x=(this.tooltipX (xScale.compute this.activeDatum.x) xScale.bandwidth)
+            --y=(this.tooltipY (hScale.compute this.activeDatum.y))
+          }}
+        >
+          <div data-test-tooltip>
+            <p class="bold">{{this.activeDatum.legendX}}</p>
+            {{#each this.activeDatum.legendY as |stat|}}
+              <p>{{stat}}</p>
+            {{/each}}
+          </div>
+          <div class="chart-tooltip-arrow"></div>
+        </div>
+      {{/if}}
+
+    {{/let}}
+  </Lineal::Fluid>
+</div>
+
+{{#if @showTable}}
+  <details data-test-underlying-data>
+    <summary>{{@chartTitle}} data</summary>
+    <Hds::Table @caption="Underlying data">
+      <:head as |H|>
+        <H.Tr>
+          <H.Th>Timestamp</H.Th>
+          {{#each this.dataKeys as |key|}}
+            <H.Th>{{humanize key}}</H.Th>
+          {{/each}}
+        </H.Tr>
+      </:head>
+      <:body as |B|>
+        {{#each @data as |row|}}
+          <B.Tr>
+            <B.Td>{{row.timestamp}}</B.Td>
+            {{#each this.dataKeys as |key|}}
+              <B.Td>{{or (get row key) "-"}}</B.Td>
+            {{/each}}
+          </B.Tr>
+        {{/each}}
+      </:body>
+    </Hds::Table>
+  </details>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/charts/vertical-bar-stacked.ts b/ui/app/components/clients/charts/vertical-bar-stacked.ts
new file mode 100644
index 00000000000..66747866cb0
--- /dev/null
+++ b/ui/app/components/clients/charts/vertical-bar-stacked.ts
@@ -0,0 +1,143 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { BAR_WIDTH, numericalAxisLabel } from 'vault/utils/chart-helpers';
+import { formatNumber } from 'core/helpers/format-number';
+import { parseAPITimestamp } from 'core/utils/date-formatters';
+import { flatGroup } from 'd3-array';
+
+import type { MonthlyChartData } from 'vault/vault/client-counts/charts';
+import type { ClientTypes } from 'vault/vault/client-counts/activity-api';
+
+interface Args {
+  chartHeight?: number;
+  chartLegend: Legend[];
+  chartTitle: string;
+  data: MonthlyChartData[];
+}
+
+interface Legend {
+  key: ClientTypes;
+  label: string;
+}
+interface AggregatedDatum {
+  x: string;
+  y: number;
+  legendX: string;
+  legendY: string[];
+}
+
+interface DatumBase {
+  timestamp: string;
+  clientType: string;
+}
+// separated because "A mapped type may not declare properties or methods."
+type ChartDatum = DatumBase & {
+  [key in ClientTypes]?: number | undefined;
+};
+
+/**
+ * @module VerticalBarStacked
+ * Renders a stacked bar chart of counts for different client types over time. Which client types render
+ * is mapped from the "key" values of the @legend arg
+ *
+ * @example
+ * <Clients::Charts::VerticalBarStacked
+ * @chartTitle="Total monthly usage"
+ * @data={{this.byMonthNewClients}}
+ * @chartLegend={{this.legend}}
+ * @chartHeight={{250}}
+ * />
+ */
+export default class VerticalBarStacked extends Component<Args> {
+  barWidth = BAR_WIDTH;
+  @tracked activeDatum: AggregatedDatum | null = null;
+
+  get chartHeight() {
+    return this.args.chartHeight || 190;
+  }
+
+  get dataKeys(): ClientTypes[] {
+    return this.args.chartLegend.map((l: Legend) => l.key);
+  }
+
+  label(legendKey: string) {
+    return this.args.chartLegend.find((l: Legend) => l.key === legendKey)?.label;
+  }
+
+  get chartData() {
+    let dataset: [string, number | undefined, string, ChartDatum[]][] = [];
+    // each datum needs to be its own object
+    for (const key of this.dataKeys) {
+      const chartData: ChartDatum[] = this.args.data.map((d: MonthlyChartData) => ({
+        timestamp: d.timestamp,
+        clientType: key,
+        [key]: d[key],
+      }));
+
+      const group = flatGroup(
+        chartData,
+        // order here must match destructure order in return below
+        (d) => d.timestamp,
+        (d) => d[key],
+        (d) => d.clientType
+      );
+      dataset = [...dataset, ...group];
+    }
+
+    return dataset.map(([timestamp, counts, clientType]) => ({
+      timestamp, // x value
+      counts, // y value
+      clientType, // corresponds to chart's @color arg
+    }));
+  }
+
+  // for yBounds scale, tooltip target area and tooltip text data
+  get aggregatedData(): AggregatedDatum[] {
+    return this.args.data.map((datum: MonthlyChartData) => {
+      const values = this.dataKeys
+        .map((k: string) => datum[k as ClientTypes])
+        .filter((count) => Number.isInteger(count));
+      const sum = values.length ? values.reduce((sum, currentValue) => sum + currentValue, 0) : null;
+      const xValue = datum.timestamp;
+      return {
+        x: xValue,
+        y: sum ?? 0, // y-axis point where tooltip renders
+        legendX: parseAPITimestamp(xValue, 'MMMM yyyy') as string,
+        legendY:
+          sum === null
+            ? ['No data']
+            : this.dataKeys.map((k) => `${formatNumber([datum[k]])} ${this.label(k)}`),
+      };
+    });
+  }
+
+  get yBounds() {
+    const counts: number[] = this.aggregatedData
+      .map((d) => d.y)
+      .flatMap((num) => (typeof num === 'number' ? [num] : []));
+    const max = Math.max(...counts);
+    // if max is <=4, hardcode 4 which is the y-axis tickCount so y-axes are not decimals
+    return [0, max <= 4 ? 4 : max];
+  }
+
+  get xBounds() {
+    const domain = this.chartData.map((d) => d.timestamp);
+    return new Set(domain);
+  }
+
+  // TEMPLATE HELPERS
+  barOffset = (bandwidth: number) => (bandwidth - this.barWidth) / 2;
+
+  tooltipX = (original: number, bandwidth: number) => (original + bandwidth / 2).toString();
+
+  tooltipY = (original: number) => (!original ? '0' : `${original}`);
+
+  formatTicksX = (timestamp: string): string => parseAPITimestamp(timestamp, 'M/yy') as string;
+
+  formatTicksY = (num: number): string => numericalAxisLabel(num) || num.toString();
+}
diff --git a/ui/app/components/clients/config.hbs b/ui/app/components/clients/config.hbs
index a3e180c0803..35694158ace 100644
--- a/ui/app/components/clients/config.hbs
+++ b/ui/app/components/clients/config.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (eq @mode "edit")}}
   <form onsubmit={{action "onSaveChanges"}} data-test-clients-config-form>
@@ -38,7 +38,7 @@
     </div>
     <div class="field is-grouped-split box is-fullwidth is-bottomless">
       <Hds::ButtonSet>
-        <Hds::Button @text="Save" type="submit" disabled={{this.buttonDisabled}} data-test-clients-config-save />
+        <Hds::Button @text="Save" type="submit" disabled={{this.buttonDisabled}} data-test-submit />
         <Hds::Button @text="Cancel" @color="secondary" @route="vault.cluster.clients.config" />
       </Hds::ButtonSet>
     </div>
diff --git a/ui/app/components/clients/config.js b/ui/app/components/clients/config.js
index 237aa1569d3..36b2c2b2f1a 100644
--- a/ui/app/components/clients/config.js
+++ b/ui/app/components/clients/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/clients/counts-card.hbs b/ui/app/components/clients/counts-card.hbs
new file mode 100644
index 00000000000..62f75e90be6
--- /dev/null
+++ b/ui/app/components/clients/counts-card.hbs
@@ -0,0 +1,51 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{! Template displays a title, description and yielded custom subheader (for items like a dropdown or toggle) above a table or data visualizations. 
+Data visualizations render in in a flex row with a 1/3-width left element and a 2/3-width right element (with the @legend centered below, if present).
+ }}
+
+<Hds::Card::Container class="counts-card-container" data-test-card={{@title}} ...attributes>
+  <div class="has-bottom-margin-xl">
+    {{#if @title}}
+      <Hds::Text::Display @tag="h2" @size="300" class="has-bottom-margin-xs">{{@title}}</Hds::Text::Display>
+    {{/if}}
+    {{#if @description}}
+      <Hds::Text::Body @tag="p" @size="100" @color="faint">{{@description}}</Hds::Text::Body>
+    {{/if}}
+    {{#if (has-block "subheader")}}
+      {{yield to="subheader"}}
+    {{/if}}
+  </div>
+
+  {{#if (has-block "table")}}
+    {{yield to="table"}}
+  {{else}}
+    <div class="chart-flex-row">
+      <div class="item-left">
+        {{#if (has-block "dataLeft")}}
+          {{yield to="dataLeft"}}
+        {{/if}}
+      </div>
+
+      <div class="item-right">
+        {{#if (has-block "dataRight")}}
+          {{yield to="dataRight"}}
+        {{/if}}
+
+        {{#if @legend}}
+          <div class="legend-container" data-test-counts-card-legend>
+            {{#each @legend as |l idx|}}
+              <div class="legend-item">
+                <span class="dots legend-dot-{{if (eq l.key 'new_clients') 'new_clients' idx}}"></span>
+                <Hds::Text::Body @tag="p" @size="100">{{l.label}}</Hds::Text::Body>
+              </div>
+            {{/each}}
+          </div>
+        {{/if}}
+      </div>
+    </div>
+  {{/if}}
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/components/clients/counts/error.hbs b/ui/app/components/clients/counts/error.hbs
new file mode 100644
index 00000000000..16cf9758ce3
--- /dev/null
+++ b/ui/app/components/clients/counts/error.hbs
@@ -0,0 +1,39 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::ApplicationState class="has-top-margin-xxl" ...attributes as |A|>
+  <A.Header
+    @title={{or @title (if (eq @error.httpStatus 403) "You are not authorized" "Error")}}
+    data-test-empty-state-title
+  />
+
+  <A.Body data-test-empty-state-message>
+    {{#if (eq @error.httpStatus 403)}}
+      <p>
+        You must be granted permissions to view this page. Ask your administrator if you think you should have access to the
+        <code>{{@error.path}}</code>
+        endpoint.
+      </p>
+    {{else}}
+      <ul>
+        {{#if @error.message}}
+          <li>{{@error.message}}</li>
+          <hr />
+        {{/if}}
+        {{#each @error.errors as |error|}}
+          <li>
+            {{error}}
+          </li>
+        {{/each}}
+      </ul>
+    {{/if}}
+  </A.Body>
+
+  <A.Footer data-test-empty-state-actions>
+    {{#if (has-block "actions")}}
+      {{yield to="actions"}}
+    {{/if}}
+  </A.Footer>
+</Hds::ApplicationState>
\ No newline at end of file
diff --git a/ui/app/components/clients/counts/nav-bar.hbs b/ui/app/components/clients/counts/nav-bar.hbs
new file mode 100644
index 00000000000..c92fa2d469c
--- /dev/null
+++ b/ui/app/components/clients/counts/nav-bar.hbs
@@ -0,0 +1,19 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<nav class="tabs has-bottom-margin-s" aria-label="navigation for managing client counts">
+  <ul>
+    <li>
+      <LinkTo @route="vault.cluster.clients.counts.overview" data-test-tab="overview">
+        Overview
+      </LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="vault.cluster.clients.counts.client-list" data-test-tab="client list">
+        Client list
+      </LinkTo>
+    </li>
+  </ul>
+</nav>
\ No newline at end of file
diff --git a/ui/app/components/clients/date-range.hbs b/ui/app/components/clients/date-range.hbs
new file mode 100644
index 00000000000..0d732aa76e3
--- /dev/null
+++ b/ui/app/components/clients/date-range.hbs
@@ -0,0 +1,120 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div ...attributes>
+  <div class="is-flex-column align-items-end">
+    {{#if this.version.isEnterprise}}
+      <Hds::Text::Display @tag="p" @size="100" class="has-bottom-margin-xs">
+        Change billing period
+      </Hds::Text::Display>
+      <Hds::Dropdown class="has-left-margin-xs" @matchToggleWidth={{true}} as |D|>
+        <D.ToggleButton @text="Billing start date" @color="secondary" data-test-date-range-edit />
+        <D.Description @text="Current period" />
+        <D.Checkmark
+          {{! Pass an empty string to reset query param because the current billing period is the default }}
+          {{on "click" (fn this.updateEnterpriseDateRange "")}}
+          @selected={{this.isSelected @billingStartTime}}
+          data-test-date-range-billing-start="0"
+        >
+          {{this.formatDropdownDate @billingStartTime}}
+        </D.Checkmark>
+        {{#if this.historicalBillingPeriods.length}}
+          <D.Separator class="has-bottom-margin-xs" />
+          <D.Description @text="Historical periods" />
+          {{#each this.historicalBillingPeriods as |period idx|}}
+            <D.Checkmark
+              {{on "click" (fn this.updateEnterpriseDateRange period)}}
+              data-test-date-range-billing-start={{add idx 1}}
+              @selected={{this.isSelected period}}
+            >
+              {{this.formatDropdownDate period}}
+            </D.Checkmark>
+          {{/each}}
+        {{/if}}
+      </Hds::Dropdown>
+    {{else}}
+      {{! Hide if the user has made an initial query because dates can be updated by clicking "Edit" beside the date range }}
+      {{#unless (and @startTimestamp @endTimestamp)}}
+        <Hds::Button
+          class="has-left-margin-xs"
+          @text="Set date range"
+          @icon="edit"
+          {{on "click" (fn @setEditModalVisible true)}}
+          data-test-date-range-edit
+        />
+      {{/unless}}
+    {{/if}}
+  </div>
+
+  {{#if @showEditModal}}
+    <Hds::Modal data-test-date-range-edit-modal @onClose={{this.onClose}} as |M|>
+      <M.Header>
+        Edit date range
+      </M.Header>
+      <M.Body>
+        <Hds::Text::Body @tag="div">
+          <p class="has-bottom-margin-s">
+            Use custom date ranges to query historic client count data. Query results do not include the current month.
+          </p>
+          <ul class="has-bottom-margin-s">
+            <li>
+              <strong>Start</strong>
+              sets the month and year (inclusive) for the first month of client counting.
+            </li>
+            <li>
+              <strong>End</strong>
+              sets the month and year (inclusive) for the final month of client counting.
+            </li>
+          </ul>
+          <p class="has-bottom-margin-s">
+            We recommend setting
+            <strong>Start</strong>
+            to your Vault deploy date to get the most accurate new and total client count estimations.</p>
+
+          <div class="clients-date-range-display">
+            <div>
+              <Hds::Form::TextInput::Field
+                @type="month"
+                @value={{this.modalStart}}
+                max={{this.previousMonth}}
+                id="start-month"
+                name="modalStart"
+                {{on "change" this.updateDate}}
+                data-test-date-edit="start"
+                as |F|
+              >
+                <F.Label>Start</F.Label>
+              </Hds::Form::TextInput::Field>
+            </div>
+            <div>
+              <Hds::Form::TextInput::Field
+                @type="month"
+                @value={{this.modalEnd}}
+                max={{this.previousMonth}}
+                id="end-month"
+                name="modalEnd"
+                {{on "change" this.updateDate}}
+                data-test-date-edit="end"
+                as |F|
+              >
+                <F.Label>End</F.Label>
+              </Hds::Form::TextInput::Field>
+            </div>
+          </div>
+          {{#if this.validationError}}
+            <Hds::Form::Error
+              class="has-top-margin-xs"
+              data-test-date-range-validation
+            >{{this.validationError}}</Hds::Form::Error>
+          {{/if}}
+        </Hds::Text::Body>
+      </M.Body>
+      <M.Footer as |F|>
+        <Hds::Button @text="Save" {{on "click" this.handleSave}} data-test-submit />
+        <Hds::Button @text="Cancel" @color="secondary" {{on "click" F.close}} data-test-cancel />
+      </M.Footer>
+    </Hds::Modal>
+  {{/if}}
+</div>
\ No newline at end of file
diff --git a/ui/app/components/clients/date-range.ts b/ui/app/components/clients/date-range.ts
new file mode 100644
index 00000000000..01c0710ea48
--- /dev/null
+++ b/ui/app/components/clients/date-range.ts
@@ -0,0 +1,152 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { buildISOTimestamp, parseAPITimestamp } from 'core/utils/date-formatters';
+import timestamp from 'core/utils/timestamp';
+import { format } from 'date-fns';
+
+import type VersionService from 'vault/services/version';
+import type { HTMLElementEvent } from 'forms';
+
+interface OnChangeParams {
+  start_time: string;
+  end_time: string;
+}
+
+interface Args {
+  onChange: (callback: OnChangeParams) => void;
+  setEditModalVisible: (visible: boolean) => void;
+  showEditModal: boolean;
+  startTimestamp: string;
+  endTimestamp: string;
+  billingStartTime: string;
+  retentionMonths: number;
+}
+/**
+ * @module ClientsDateRange
+ * ClientsDateRange components are used to display the current date range and provide a modal interface for editing the date range.
+ *
+ * @example
+ *
+ * <Clients::DateRange @startTimestamp="2018-01-01T14:15:30Z" @endTimestamp="2019-01-31T14:15:30Z" @onChange={{this.handleDateChange}} />
+ *
+ * @param {function} onChange - callback when a new range is saved.
+ * @param {function} setEditModalVisible - callback to tell parent header when modal is opened/closed
+ * @param {boolean} showEditModal - boolean for when parent header triggers the modal open
+ * @param {string} [startTimestamp] - ISO string timestamp of the start date for the displayed client count data
+ * @param {string} [endTimestamp] - ISO string timestamp of the end date for the displayed client count data
+ * @param {int} [retentionMonths=48] - number of months for historical billing
+ * @param {string} [billingStartTime] - ISO string timestamp of billing start date
+ */
+
+export default class ClientsDateRangeComponent extends Component<Args> {
+  @service declare readonly version: VersionService;
+
+  @tracked modalStart = ''; // format yyyy-MM
+  @tracked modalEnd = ''; // format yyyy-MM
+
+  currentMonth = timestamp.now();
+  previousMonth = format(
+    new Date(this.currentMonth.getUTCFullYear(), this.currentMonth.getUTCMonth() - 1, 1),
+    'yyyy-MM'
+  );
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+    this.setTrackedFromArgs();
+  }
+
+  get historicalBillingPeriods() {
+    // we want whole billing periods
+    const count = Math.floor(this.args.retentionMonths / 12);
+    const periods: string[] = [];
+
+    for (let i = 1; i <= count; i++) {
+      const startDate = parseAPITimestamp(this.args.billingStartTime) as Date;
+      const utcYear = startDate.getUTCFullYear() - i;
+      startDate.setUTCFullYear(utcYear);
+      periods.push(startDate.toISOString());
+    }
+    return periods;
+  }
+
+  get validationError() {
+    if (!this.modalStart || !this.modalEnd) {
+      return 'You must supply both start and end dates.';
+    }
+    if (this.modalStart > this.modalEnd) {
+      return 'Start date must be before end date.';
+    }
+    if (this.modalStart > this.previousMonth || this.modalEnd > this.previousMonth) {
+      return 'You cannot select the current month or beyond.';
+    }
+    return null;
+  }
+
+  @action onClose() {
+    // since the component never gets torn down, we have to manually re-set this on close
+    this.setTrackedFromArgs();
+    this.args.setEditModalVisible(false);
+  }
+
+  @action updateDate(evt: HTMLElementEvent<HTMLInputElement>) {
+    const { name, value } = evt.target;
+    this[name as 'modalStart' | 'modalEnd'] = value;
+  }
+
+  // used for CE date picker
+  @action handleSave() {
+    if (this.validationError) return;
+    const params: OnChangeParams = { start_time: '', end_time: '' };
+
+    if (this.modalStart) {
+      params.start_time = this.formatModalTimestamp(this.modalStart, false);
+    }
+
+    if (this.modalEnd) {
+      params.end_time = this.formatModalTimestamp(this.modalEnd, true);
+    }
+
+    this.args.onChange(params);
+    this.onClose();
+  }
+
+  @action
+  updateEnterpriseDateRange(start: string) {
+    // We do not send an end_time so the backend handles computing the expected billing period
+    this.args.onChange({ start_time: start, end_time: '' });
+  }
+
+  // HELPERS
+  formatModalTimestamp(modalValue: string, isEndDate: boolean) {
+    const [yearString, month] = modalValue.split('-');
+    const monthIdx = Number(month) - 1;
+    const year = Number(yearString);
+    return buildISOTimestamp({ monthIdx, year, isEndDate });
+  }
+
+  setTrackedFromArgs() {
+    if (this.args.startTimestamp) {
+      this.modalStart = parseAPITimestamp(this.args.startTimestamp, 'yyyy-MM') as string;
+    }
+    if (this.args.endTimestamp) {
+      this.modalEnd = parseAPITimestamp(this.args.endTimestamp, 'yyyy-MM') as string;
+    }
+  }
+
+  // TEMPLATE HELPERS
+  formatDropdownDate = (isoTimestamp: string) => parseAPITimestamp(isoTimestamp, 'MMMM yyyy');
+
+  isSelected = (dropdownTimestamp: string) => {
+    // Compare against this.args.startTimestamp because it's from the URL query param
+    // which is used to query the client count activity API.
+    const selectedStart = this.formatDropdownDate(this.args.startTimestamp);
+    return this.formatDropdownDate(dropdownTimestamp) === selectedStart;
+  };
+}
diff --git a/ui/app/components/clients/error.hbs b/ui/app/components/clients/error.hbs
deleted file mode 100644
index 0c935e1ff43..00000000000
--- a/ui/app/components/clients/error.hbs
+++ /dev/null
@@ -1,30 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<EmptyState
-  @title={{if (eq @error.httpStatus 403) "You are not authorized" "Error"}}
-  @subTitle="Error {{@model.httpStatus}}"
-  @icon="skip"
->
-  {{#if (eq @error.httpStatus 403)}}
-    <p>
-      You must be granted permissions to view this page. Ask your administrator if you think you should have access to the
-      <code>{{@error.path}}</code>
-      endpoint.
-    </p>
-  {{else}}
-    <ul>
-      {{#if @error.message}}
-        <li>{{@error.message}}</li>
-        <hr />
-      {{/if}}
-      {{#each @error.errors as |error|}}
-        <li>
-          {{error}}
-        </li>
-      {{/each}}
-    </ul>
-  {{/if}}
-</EmptyState>
\ No newline at end of file
diff --git a/ui/app/components/clients/filter-toolbar.hbs b/ui/app/components/clients/filter-toolbar.hbs
new file mode 100644
index 00000000000..c4e98773308
--- /dev/null
+++ b/ui/app/components/clients/filter-toolbar.hbs
@@ -0,0 +1,82 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::ButtonSet>
+  <Hds::SegmentedGroup as |SG|>
+    {{! "filterProperty" is the tracked variable in the component class that corresponds to the filter type }}
+    {{#each-in this.dropdownConfig as |filterProperty d|}}
+      {{! "searchProperty" is the tracked variable in the component class that corresponds to the search input }}
+      {{#let d.label d.dropdownItems d.searchProperty as |label dropdownItems searchProperty|}}
+        <SG.Dropdown data-test-dropdown={{filterProperty}} @onClose={{fn this.handleDropdownClose searchProperty}} as |D|>
+          <D.ToggleButton @color="secondary" @text={{capitalize label}} />
+          <D.Header>
+            <Hds::Form::TextInput::Base
+              type="search"
+              placeholder="Search"
+              id={{searchProperty}}
+              autocomplete="off"
+              @value={{get this searchProperty}}
+              {{on "input" this.handleSearch}}
+            />
+          </D.Header>
+          <D.Separator />
+          {{#let (this.searchDropdown dropdownItems searchProperty) as |matchingItems|}}
+            {{#each matchingItems as |item|}}
+              <D.Checkmark
+                {{! Select dropdown item and set as tracked property to update URL query params }}
+                {{on "click" (fn this.handleFilterSelect filterProperty item D.close)}}
+                {{! (get this filterProperty) returns the tracked filter value }}
+                @selected={{eq item (get this filterProperty)}}
+                data-test-dropdown-item={{item}}
+              >
+                {{if (eq filterProperty "month") (this.formatTimestamp item) item}}
+              </D.Checkmark>
+            {{else}}
+              <D.Description
+                class="has-top-padding-xs"
+                {{! (get this searchProperty) returns the tracked search value }}
+                @text={{this.noItemsMessage (get this searchProperty) (pluralize label)}}
+              />
+            {{/each}}
+          {{/let}}
+        </SG.Dropdown>
+      {{/let}}
+    {{/each-in}}
+  </Hds::SegmentedGroup>
+</Hds::ButtonSet>
+
+<Hds::Layout::Flex class="has-top-margin-s" @gap="8" @align="center" data-test-filter-tag-container>
+  <Hds::Text::Body @color="faint">Filters applied:</Hds::Text::Body>
+  {{#if this.anyFilters}}
+    {{#each-in this.filterProps as |filter value|}}
+      {{#if value}}
+        <div>
+          <Hds::Tag
+            @text={{if (eq filter "month") (this.formatTimestamp value) value}}
+            {{! Filter renders in a tooltip if exceeds 20 characters  }}
+            @tooltipPlacement="bottom"
+            @onDismiss={{fn this.clearFilters filter}}
+            data-test-filter-tag="{{filter}} {{value}}"
+          />
+        </div>
+      {{/if}}
+    {{/each-in}}
+    <Hds::Button
+      @icon="x-circle"
+      @text="Clear filters"
+      @color="tertiary"
+      {{on "click" (fn this.clearFilters "")}}
+      data-test-button="Clear filters"
+    />
+  {{else}}
+    <Hds::Text::Body @color="faint">None</Hds::Text::Body>
+  {{/if}}
+</Hds::Layout::Flex>
+
+{{#if this.filterAlert}}
+  <Hds::Alert @type="compact" class="has-top-padding-xs" data-test-inline-alert as |A|>
+    <A.Description>{{this.filterAlert}}</A.Description>
+  </Hds::Alert>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/filter-toolbar.ts b/ui/app/components/clients/filter-toolbar.ts
new file mode 100644
index 00000000000..659d6ab7be0
--- /dev/null
+++ b/ui/app/components/clients/filter-toolbar.ts
@@ -0,0 +1,221 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { cached, tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { debounce } from '@ember/runloop';
+import { capitalize } from '@ember/string';
+import { buildISOTimestamp, parseAPITimestamp } from 'core/utils/date-formatters';
+import { ClientFilters } from 'core/utils/client-count-utils';
+
+import type {
+  ActivityExportData,
+  ClientFilterTypes,
+  MountClients,
+} from 'vault/vault/client-counts/activity-api';
+import type { HTMLElementEvent } from 'vault/forms';
+
+interface Args {
+  dataset: ActivityExportData[] | MountClients[];
+  dropdownMonths?: string[];
+  filterQueryParams: Record<ClientFilterTypes, string>;
+  isExportData?: boolean;
+  onFilter: CallableFunction;
+}
+
+// Correspond to each search input's tracked variable in the component class
+type SearchProperty = 'namespacePathSearch' | 'mountPathSearch' | 'mountTypeSearch' | 'monthSearch';
+
+export default class ClientsFilterToolbar extends Component<Args> {
+  filterTypes = Object.values(ClientFilters);
+
+  // Tracked filter values
+  @tracked namespace_path: string;
+  @tracked mount_path: string;
+  @tracked mount_type: string;
+  @tracked month: string;
+
+  // Tracked search inputs
+  @tracked namespacePathSearch = '';
+  @tracked mountPathSearch = '';
+  @tracked mountTypeSearch = '';
+  @tracked monthSearch = '';
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+    const { namespace_path, mount_path, mount_type, month } = this.args.filterQueryParams;
+    this.namespace_path = namespace_path || '';
+    this.mount_path = mount_path || '';
+    this.mount_type = mount_type || '';
+    this.month = month || '';
+  }
+
+  get anyFilters() {
+    return Object.values(this.filterProps).some((v) => !!v);
+  }
+
+  @cached
+  get dropdownItems() {
+    const namespacePaths = new Set<string>();
+    const mountPaths = new Set<string>();
+    const mountTypes = new Set<string>();
+    const months = new Set<string>();
+
+    if (this.args.dataset) {
+      // iterate over dataset once to get dropdown items
+      this.args.dataset.forEach((d) => {
+        // namespace_path for root is technically an empty string, so convert to 'root'
+        const namespace = d.namespace_path === '' ? 'root' : d.namespace_path;
+        if (namespace) namespacePaths.add(namespace);
+        if (d.mount_path) mountPaths.add(d.mount_path);
+        if (d.mount_type) mountTypes.add(d.mount_type);
+        // `client_first_used_time` only exists for the dataset rendered in the "Client list" tab (ActivityExportData),
+        // and if the client ID was initially used in version 1.21 or later.
+        if ('client_first_used_time' in d && d.client_first_used_time) {
+          // for now, we're only concerned with month granularity so we want the dropdown filter to contain an ISO timestamp
+          // of the first of the month for each client_first_used_time
+          const date = parseAPITimestamp(d.client_first_used_time) as Date;
+          const year = date.getUTCFullYear();
+          const monthIdx = date.getUTCMonth();
+          const timestamp = buildISOTimestamp({ year, monthIdx, isEndDate: false });
+          months.add(timestamp);
+        }
+      });
+    }
+
+    return {
+      [ClientFilters.NAMESPACE]: [...namespacePaths],
+      [ClientFilters.MOUNT_PATH]: [...mountPaths],
+      [ClientFilters.MOUNT_TYPE]: [...mountTypes],
+      // The "Overview tab" manually passes an array of months
+      [ClientFilters.MONTH]: this.args.dropdownMonths || [...months],
+    };
+  }
+
+  @cached
+  get dropdownConfig() {
+    return {
+      [ClientFilters.NAMESPACE]: {
+        label: 'namespace',
+        dropdownItems: this.dropdownItems[ClientFilters.NAMESPACE],
+        searchProperty: 'namespacePathSearch',
+      },
+      [ClientFilters.MOUNT_PATH]: {
+        label: 'mount path',
+        dropdownItems: this.dropdownItems[ClientFilters.MOUNT_PATH],
+        searchProperty: 'mountPathSearch',
+      },
+      [ClientFilters.MOUNT_TYPE]: {
+        label: 'mount type',
+        dropdownItems: this.dropdownItems[ClientFilters.MOUNT_TYPE],
+        searchProperty: 'mountTypeSearch',
+      },
+      [ClientFilters.MONTH]: {
+        label: 'month',
+        dropdownItems: this.dropdownItems[ClientFilters.MONTH],
+        searchProperty: 'monthSearch',
+      },
+    };
+  }
+
+  // It's possible that a query param may not exist in the dropdown, in which case show an alert
+  get filterAlert() {
+    const alert = (label: string, filter: string) =>
+      `${capitalize(label)} "${filter}" not found in the current data.`;
+    return this.filterTypes
+      .flatMap((f: ClientFilters) => {
+        const filterValue = this.filterProps[f];
+        const inDropdown = this.dropdownItems[f].includes(filterValue);
+        // Don't show an alert for the "Month" filter because it doesn't match dataset values one to one
+        if (ClientFilters.MONTH === f) return [];
+        return !inDropdown && filterValue ? [alert(this.dropdownConfig[f].label, filterValue)] : [];
+      })
+      .join(' ');
+  }
+
+  // the cached decorator recomputes this getter every time the tracked properties
+  // update instead of every time it is accessed
+  @cached
+  get filterProps() {
+    return this.filterTypes.reduce(
+      (obj, filterType) => {
+        obj[filterType] = this[filterType];
+        return obj;
+      },
+      {} as Record<ClientFilterTypes, string>
+    );
+  }
+
+  @action
+  handleFilterSelect(filterProperty: ClientFilterTypes, value: string, close: CallableFunction) {
+    this[filterProperty] = value;
+    close();
+  }
+
+  @action
+  handleDropdownClose(searchProperty: SearchProperty) {
+    // reset search input for that dropdown
+    this.updateSearch(searchProperty, '');
+    this.applyFilters();
+  }
+
+  @action
+  clearFilters(filterProperty: ClientFilterTypes | '') {
+    if (filterProperty) {
+      this[filterProperty] = '';
+    } else {
+      this.namespace_path = '';
+      this.mount_path = '';
+      this.mount_type = '';
+      this.month = '';
+    }
+    this.applyFilters();
+  }
+
+  @action
+  applyFilters() {
+    // Fire callback so URL query params match selected filters
+    this.args.onFilter(this.filterProps);
+  }
+
+  @action
+  handleSearch(event: HTMLElementEvent<HTMLInputElement>) {
+    const { value, id: searchProperty } = event.target;
+    debounce(this, this.updateSearch, searchProperty as SearchProperty, value, 50);
+  }
+
+  @action
+  updateSearch(searchProperty: SearchProperty, searchValue: string) {
+    this[searchProperty] = searchValue;
+  }
+
+  // TEMPLATE HELPERS
+  formatTimestamp = (isoTimestamp: string) => parseAPITimestamp(isoTimestamp, 'MMMM yyyy') as string;
+
+  searchDropdown = (dropdownItems: string[], searchProperty: SearchProperty) => {
+    const searchInput = this[searchProperty];
+
+    if (searchInput) {
+      return dropdownItems.filter((i) => {
+        const isMatch = (item: string) => item?.toLowerCase().includes(searchInput.toLowerCase());
+        // For months, search both the ISO timestamp and formatted display value (e.g., "January 2024")
+        return searchProperty === 'monthSearch' ? isMatch(i) || isMatch(this.formatTimestamp(i)) : isMatch(i);
+      });
+    }
+
+    return dropdownItems;
+  };
+
+  noItemsMessage = (searchValue: string, label: string) => {
+    if (searchValue) return `No matching ${label}`;
+
+    // The version upgrade message is only relevant if the toolbar filtering activity export data
+    // because that is when the months dropdown is populated by the `client_first_used_time` key.
+    return label === 'months' && this.args.isExportData
+      ? 'Filtering by month is only available for clients initially used after upgrading to version 1.21.'
+      : `No ${label} to filter`;
+  };
+}
diff --git a/ui/app/components/clients/horizontal-bar-chart.hbs b/ui/app/components/clients/horizontal-bar-chart.hbs
deleted file mode 100644
index c1e6fec64c0..00000000000
--- a/ui/app/components/clients/horizontal-bar-chart.hbs
+++ /dev/null
@@ -1,32 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if @dataset}}
-  <svg
-    data-test-horizontal-bar-chart
-    class="chart is-horizontal"
-    {{on "mouseleave" this.removeTooltip}}
-    {{did-insert this.renderChart @dataset}}
-    {{did-update this.renderChart @dataset}}
-  >
-  </svg>
-{{else}}
-  <EmptyState @subTitle={{or @noDataMessage "No data to display"}} @bottomBorder={{true}} />
-{{/if}}
-{{#if this.tooltipTarget}}
-  {{! Required to set tag name = div https://github.com/yapplabs/ember-modal-dialog/issues/290 }}
-  {{! Component must be in curly bracket notation }}
-  {{! template-lint-disable no-curly-component-invocation }}
-  {{#modal-dialog
-    tagName="div" tetherTarget=this.tooltipTarget targetAttachment="bottom middle" attachment="bottom middle" offset="35px 0"
-  }}
-    <div class="chart-tooltip {{if this.isLabel ' is-label-fit-content'}}">
-      {{#each this.tooltipText as |text|}}
-        <p>{{text}}</p>
-      {{/each}}
-    </div>
-    <div class="chart-tooltip-arrow"></div>
-  {{/modal-dialog}}
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/horizontal-bar-chart.js b/ui/app/components/clients/horizontal-bar-chart.js
deleted file mode 100644
index b21d651610a..00000000000
--- a/ui/app/components/clients/horizontal-bar-chart.js
+++ /dev/null
@@ -1,233 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-import { stack } from 'd3-shape';
-// eslint-disable-next-line no-unused-vars
-import { select, event, selectAll } from 'd3-selection';
-import { scaleLinear, scaleBand } from 'd3-scale';
-import { axisLeft } from 'd3-axis';
-import { max, maxIndex } from 'd3-array';
-import { GREY, BLUE_PALETTE } from 'vault/utils/chart-helpers';
-import { tracked } from '@glimmer/tracking';
-import { formatNumber } from 'core/helpers/format-number';
-
-/**
- * @module HorizontalBarChart
- * HorizontalBarChart components are used to display data in the form of a horizontal, stacked bar chart with accompanying tooltip.
- *
- * @example
- * ```js
- * <HorizontalBarChart @dataset={{@dataset}} @chartLegend={{@chartLegend}}/>
- * ```
- * @param {array} dataset - dataset for the chart, must be an array of flattened objects
- * @param {array} chartLegend - array of objects with key names 'key' and 'label' so data can be stacked
- * @param {string} labelKey - string of key name for label value in chart data
- * @param {string} xKey - string of key name for x value in chart data
- * @param {string} [noDataMessage] - custom empty state message that displays when no dataset is passed to the chart
- */
-
-// SIZING CONSTANTS
-const CHART_MARGIN = { top: 10, left: 95 }; // makes space for y-axis legend
-const TRANSLATE = { down: 14, left: 99 };
-const CHAR_LIMIT = 15; // character count limit for y-axis labels to trigger truncating
-const LINE_HEIGHT = 24; // each bar w/ padding is 24 pixels thick
-
-export default class HorizontalBarChart extends Component {
-  @tracked tooltipTarget = '';
-  @tracked tooltipText = [];
-  @tracked isLabel = null;
-
-  get labelKey() {
-    return this.args.labelKey || 'label';
-  }
-
-  get xKey() {
-    return this.args.xKey || 'clients';
-  }
-
-  get topNamespace() {
-    return this.args.dataset[maxIndex(this.args.dataset, (d) => d[this.xKey])];
-  }
-
-  @action removeTooltip() {
-    this.tooltipTarget = null;
-  }
-
-  @action
-  renderChart(element, [chartData]) {
-    // chart legend tells stackFunction how to stack/organize data
-    // creates an array of data for each key name
-    // each array contains coordinates for each data bar
-    const stackFunction = stack().keys(this.args.chartLegend.map((l) => l.key));
-    const dataset = chartData;
-    const stackedData = stackFunction(dataset);
-    const labelKey = this.labelKey;
-    const xKey = this.xKey;
-    const xScale = scaleLinear()
-      .domain([0, max(dataset.map((d) => d[xKey]))])
-      .range([0, 75]); // 25% reserved for margins
-
-    const yScale = scaleBand()
-      .domain(dataset.map((d) => d[labelKey]))
-      .range([0, dataset.length * LINE_HEIGHT])
-      .paddingInner(0.765); // percent of the total width to reserve for padding between bars
-
-    const chartSvg = select(element);
-    chartSvg.attr('width', '100%').attr('viewBox', `0 0 564 ${(dataset.length + 1) * LINE_HEIGHT}`);
-
-    const dataBarGroup = chartSvg
-      .selectAll('g')
-      .remove()
-      .exit()
-      .data(stackedData)
-      .enter()
-      .append('g')
-      .attr('data-test-group', (d) => `${d.key}`)
-      // shifts chart to accommodate y-axis legend
-      .attr('transform', `translate(${CHART_MARGIN.left}, ${CHART_MARGIN.top})`)
-      .style('fill', (d, i) => BLUE_PALETTE[i]);
-
-    const yAxis = axisLeft(yScale).tickSize(0);
-
-    const yLabelsGroup = chartSvg
-      .append('g')
-      .attr('data-test-group', 'y-labels')
-      .attr('transform', `translate(${CHART_MARGIN.left}, ${CHART_MARGIN.top})`);
-    yAxis(yLabelsGroup);
-
-    chartSvg.select('.domain').remove();
-
-    const truncate = (selection) =>
-      selection.text((string) =>
-        string.length < CHAR_LIMIT ? string : string.slice(0, CHAR_LIMIT - 3) + '...'
-      );
-
-    chartSvg.selectAll('.tick text').call(truncate);
-
-    dataBarGroup
-      .selectAll('rect')
-      .remove()
-      .exit()
-      // iterate through the stacked data and chart respectively
-      .data((stackedData) => stackedData)
-      .enter()
-      .append('rect')
-      .attr('class', 'data-bar')
-      .style('cursor', 'pointer')
-      .attr('width', (chartData) => `${xScale(Math.abs(chartData[1] - chartData[0]))}%`)
-      .attr('height', yScale.bandwidth())
-      .attr('x', (chartData) => `${xScale(chartData[0])}%`)
-      .attr('y', ({ data }) => yScale(data[labelKey]))
-      .attr('rx', 3)
-      .attr('ry', 3);
-
-    const actionBarGroup = chartSvg.append('g').attr('data-test-group', 'action-bars');
-
-    const actionBars = actionBarGroup
-      .selectAll('.action-bar')
-      .remove()
-      .exit()
-      .data(dataset)
-      .enter()
-      .append('rect')
-      .style('cursor', 'pointer')
-      .attr('class', 'action-bar')
-      .attr('width', '100%')
-      .attr('height', `${LINE_HEIGHT}px`)
-      .attr('x', '0')
-      .attr('y', (chartData) => yScale(chartData[labelKey]))
-      .style('fill', `${GREY}`)
-      .style('opacity', '0')
-      .style('mix-blend-mode', 'multiply');
-
-    const labelActionBarGroup = chartSvg.append('g').attr('data-test-group', 'label-action-bars');
-
-    const labelActionBar = labelActionBarGroup
-      .selectAll('.label-action-bar')
-      .remove()
-      .exit()
-      .data(dataset)
-      .enter()
-      .append('rect')
-      .style('cursor', 'pointer')
-      .attr('class', 'label-action-bar')
-      .attr('width', CHART_MARGIN.left)
-      .attr('height', `${LINE_HEIGHT}px`)
-      .attr('x', '0')
-      .attr('y', (chartData) => yScale(chartData[labelKey]))
-      .style('opacity', '0')
-      .style('mix-blend-mode', 'multiply');
-
-    const actionBarSelection = chartSvg.selectAll('rect.action-bar');
-
-    const compareAttributes = (elementA, elementB, attr) =>
-      select(elementA).attr(`${attr}`) === select(elementB).attr(`${attr}`);
-
-    // MOUSE EVENTS FOR DATA BARS
-    actionBars
-      .on('mouseover', (data) => {
-        const hoveredElement = actionBars.filter((bar) => bar[labelKey] === data[labelKey]).node();
-        this.tooltipTarget = hoveredElement;
-        this.isLabel = false;
-        this.tooltipText = []; // clear stats
-        this.args.chartLegend.forEach(({ key, label }) => {
-          this.tooltipText.pushObject(`${formatNumber([data[key]])} ${label}`);
-        });
-
-        select(hoveredElement).style('opacity', 1);
-      })
-      .on('mouseout', function () {
-        select(this).style('opacity', 0);
-      });
-
-    // MOUSE EVENTS FOR Y-AXIS LABELS
-    labelActionBar
-      .on('mouseover', (data) => {
-        if (data[labelKey].length >= CHAR_LIMIT) {
-          const hoveredElement = labelActionBar.filter((bar) => bar[labelKey] === data[labelKey]).node();
-          this.tooltipTarget = hoveredElement;
-          this.isLabel = true;
-          this.tooltipText = [data[labelKey]];
-        } else {
-          this.tooltipTarget = null;
-        }
-        actionBarSelection
-          .filter(function () {
-            return compareAttributes(this, event.target, 'y');
-          })
-          .style('opacity', '1');
-      })
-      .on('mouseout', function () {
-        this.tooltipTarget = null;
-        actionBarSelection
-          .filter(function () {
-            return compareAttributes(this, event.target, 'y');
-          })
-          .style('opacity', '0');
-      });
-
-    // client count total values to the right
-    const totalValueGroup = chartSvg
-      .append('g')
-      .attr('data-test-group', 'total-values')
-      .attr('transform', `translate(${TRANSLATE.left}, ${TRANSLATE.down})`);
-
-    totalValueGroup
-      .selectAll('text')
-      .data(dataset)
-      .enter()
-      .append('text')
-      .text((d) => formatNumber([d[xKey]]))
-      .attr('fill', '#000')
-      .attr('class', 'total-value')
-      .style('font-size', '.8rem')
-      .attr('text-anchor', 'start')
-      .attr('alignment-baseline', 'middle')
-      .attr('x', (chartData) => `${xScale(chartData[xKey])}%`)
-      .attr('y', (chartData) => yScale(chartData[labelKey]));
-  }
-}
diff --git a/ui/app/components/clients/no-data.hbs b/ui/app/components/clients/no-data.hbs
index e988f82440c..29311bb5db7 100644
--- a/ui/app/components/clients/no-data.hbs
+++ b/ui/app/components/clients/no-data.hbs
@@ -1,17 +1,19 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-{{#if (eq @config.enabled "On")}}
+{{#if (or @config.reportingEnabled (eq @config.enabled "On"))}}
   <EmptyState
-    @title="No data received {{if @dateRangeMessage @dateRangeMessage}}"
+    @title="No data received"
     @message="Tracking is turned on and Vault is gathering data. It should appear here within 30 minutes."
+    class="is-shadowless"
   />
-{{else}}
+{{else if @config}}
   <EmptyState
     @title="Data tracking is disabled"
     @message="Tracking is disabled, and no data is being collected. To turn it on, edit the configuration."
+    class="is-shadowless"
   >
     {{#if @config.canEdit}}
       <Hds::Link::Standalone
@@ -22,4 +24,10 @@
       />
     {{/if}}
   </EmptyState>
+{{else}}
+  <EmptyState
+    @title="Activity configuration data is unavailable"
+    @message="Reporting status is unknown and could be enabled or disabled. Check the Vault logs for more information."
+    class="is-shadowless"
+  />
 {{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/page-header.hbs b/ui/app/components/clients/page-header.hbs
new file mode 100644
index 00000000000..39cf720d8f0
--- /dev/null
+++ b/ui/app/components/clients/page-header.hbs
@@ -0,0 +1,175 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::PageHeader class="has-top-padding-l has-bottom-padding-m" as |PH|>
+  <PH.Title>
+    Client Usage
+  </PH.Title>
+
+  {{#if @activityTimestamp}}
+    <PH.Subtitle data-test-activity-timestamp>
+      Dashboard last updated:
+      {{date-format @activityTimestamp "MMM d yyyy, h:mm:ss aaa" withTimeZone=true}}
+      <Hds::Button
+        @color="tertiary"
+        @icon="reload"
+        @isIconOnly={{true}}
+        @size="small"
+        @text="Refresh page"
+        data-test-button="Refresh page"
+        {{on "click" this.refreshRoute}}
+      />
+    </PH.Subtitle>
+  {{/if}}
+  {{#if this.version.isEnterprise}}
+    <PH.Description class="has-text-weight-semibold flex">
+      <p>
+        For billing period:
+        <span data-test-date-range="start">{{this.formattedStartDate}}</span>
+        -
+        <span data-test-date-range="end">{{this.formattedEndDate}}</span>
+      </p>
+    </PH.Description>
+  {{/if}}
+  <PH.Description>
+    {{#if this.showCommunity}}
+      <div class="has-top-padding-m">
+        <Hds::Text::Display @tag="h3">Client counting period</Hds::Text::Display>
+        <Hds::Text::Body @tag="p" class="has-text-grey">Specify a date range to view within that timeframe. Click 'Edit' to
+          choose a different date range.</Hds::Text::Body>
+        <Hds::Text::Body @tag="p">
+          <span data-test-date-range="start">{{this.formattedStartDate}}</span>
+          -
+          <span data-test-date-range="end">{{this.formattedEndDate}}</span>
+          <Hds::Button
+            @size="small"
+            @text="Edit"
+            @isInline="true"
+            @color="tertiary"
+            @icon="edit"
+            @iconPosition="trailing"
+            data-test-date-range-edit
+            {{on "click" (fn (mut this.showEditModal) true)}}
+          />
+        </Hds::Text::Body>
+      </div>
+    {{/if}}
+  </PH.Description>
+
+  <PH.Actions class="align-items-end align-self-end">
+    {{#if this.showExportButton}}
+      <Hds::Button
+        class="has-font-weight-normal"
+        data-test-export-button
+        @text="Export activity data"
+        @color="secondary"
+        @icon="download"
+        {{on "click" (fn (mut this.showExportModal) true)}}
+      />
+    {{/if}}
+    <Clients::DateRange
+      @startTimestamp={{@startTimestamp}}
+      @endTimestamp={{@endTimestamp}}
+      @billingStartTime={{@billingStartTime}}
+      @retentionMonths={{@retentionMonths}}
+      @onChange={{@onChange}}
+      @showEditModal={{this.showEditModal}}
+      @setEditModalVisible={{this.setEditModalVisible}}
+      class={{if (and this.version.isCommunity this.startDate this.endDate) "position-absolute"}}
+    />
+  </PH.Actions>
+
+</Hds::PageHeader>
+
+{{#if this.showExportModal}}
+  <Hds::Modal id="attribution-csv-download-modal" class="has-text-left" @onClose={{this.resetModal}} as |M|>
+    <M.Header @icon="info" data-test-export-modal-title>
+      Export activity data
+    </M.Header>
+    <M.Body>
+      {{#if this.exportChartData.isRunning}}
+        <p class="has-bottom-margin-s">
+          Your export request is being processed. This may take some time; please do not navigate away from this page.
+        </p>
+        <p class="has-bottom-margin-s has-text-centered">
+          <Icon @name="loading" @size="24" />
+        </p>
+      {{else}}
+        <p class="has-bottom-margin-s">
+          This file will include an export of the clients that had activity within the date range below. See the
+          <DocLink @path="/vault/api-docs/system/internal-counters#activity-export">activity export documentation</DocLink>
+          for more details.
+        </p>
+        <p class="has-bottom-margin-s is-subtitle-gray">SELECTED DATE {{if this.formattedEndDate " RANGE"}}</p>
+        <p class="has-bottom-margin-s" data-test-export-date-range>
+          {{this.formattedStartDate}}
+          {{#if this.showEndDate}}
+            {{"-"}}
+            {{this.formattedEndDate}}
+          {{/if}}
+        </p>
+
+        <Hds::Form::Select::Field
+          class="has-bottom-margin-s"
+          {{on "change" this.setExportFormat}}
+          data-test-download-format
+          as |F|
+        >
+          <F.Label>Export format</F.Label>
+          <F.Options>
+            <option value="csv" selected={{eq this.exportFormat "csv"}}>CSV</option>
+            <option value="jsonl" selected={{eq this.exportFormat "jsonl"}}>JSON Lines</option>
+          </F.Options>
+        </Hds::Form::Select::Field>
+      {{/if}}
+
+      {{#if this.downloadError}}
+        <Hds::Alert @type="inline" @color="critical" as |A|>
+          <A.Title>CSV export failed</A.Title>
+          <A.Description data-test-export-error>{{this.downloadError}}</A.Description>
+        </Hds::Alert>
+      {{/if}}
+    </M.Body>
+    <M.Footer as |F|>
+      <Hds::ButtonSet>
+        <Hds::Button
+          @text="Export"
+          {{on "click" (perform this.exportChartData this.formattedCsvFileName)}}
+          data-test-confirm-button
+        />
+        <Hds::Button @text="Cancel" @color="secondary" {{on "click" F.close}} />
+      </Hds::ButtonSet>
+      {{#if @upgradesDuringActivity}}
+        <Hds::Alert class="has-top-padding-m" @type="compact" @color="warning" data-test-export-upgrade-warning as |A|>
+          <A.Description>
+            <strong>Data contains {{pluralize @upgradesDuringActivity.length "upgrade"}}:</strong>
+          </A.Description>
+          <A.Description>
+            <ul class="bullet">
+              {{#each @upgradesDuringActivity as |upgrade|}}
+                <li>
+                  {{upgrade.version}}
+                  {{this.parseAPITimestamp upgrade.timestampInstalled "(MMM d, yyyy)"}}
+                </li>
+              {{/each}}
+            </ul>
+          </A.Description>
+          <A.Description>
+            Visit our
+            <Hds::Link::Inline
+              @isHrefExternal={{true}}
+              @href={{doc-link
+                "/vault/docs/concepts/client-count/faq#q-which-vault-version-reflects-the-most-accurate-client-counts"
+              }}
+            >
+              Client count FAQ
+            </Hds::Link::Inline>
+            for more information.
+          </A.Description>
+        </Hds::Alert>
+      {{/if}}
+    </M.Footer>
+  </Hds::Modal>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/page-header.js b/ui/app/components/clients/page-header.js
new file mode 100644
index 00000000000..874c88969f3
--- /dev/null
+++ b/ui/app/components/clients/page-header.js
@@ -0,0 +1,149 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import { waitFor } from '@ember/test-waiters';
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { parseAPITimestamp } from 'core/utils/date-formatters';
+import { sanitizePath } from 'core/utils/sanitize-path';
+import { isSameMonth } from 'date-fns';
+import { task } from 'ember-concurrency';
+
+/**
+ * @module ClientsPageHeader
+ * ClientsPageHeader components are used to render a header and check for export capabilities before rendering an export button.
+ *
+ * @example
+ * ```js
+ * <Clients::PageHeader @startTimestamp="2022-06-01T23:00:11.050Z" @endTimestamp="2022-12-01T23:00:11.050Z" @namespace="foo" @upgradesDuringActivity={{array (hash version="1.10.1" previousVersion="1.9.1" timestampInstalled= "2021-11-18T10:23:16Z") }} />
+ * ```
+ * @param {string} [billingStartTime] - ISO timestamp of billing start date, to be passed to date picker
+ * @param {string} [activityTimestamp] -  ISO timestamp created in serializer to timestamp the response to be displayed in page header
+ * @param {string} [startTimestamp] - ISO timestamp of start time, to be passed to export request
+ * @param {string} [endTimestamp] - ISO timestamp of end time, to be passed to export request
+ * @param {number} [retentionMonths = 48] - number of months for historical billing, to be passed to date picker
+ * @param {string} [upgradesDuringActivity] - array of objects containing version history upgrade data
+ * @param {boolean} [noData = false] - when true, export button will hide regardless of capabilities
+ * @param {function} [onChange] - callback when a new date range is saved, to be passed to date picker
+ */
+export default class ClientsPageHeaderComponent extends Component {
+  @service download;
+  @service namespace;
+  @service router;
+  @service store;
+  @service version;
+
+  @tracked canDownload = false;
+  @tracked showEditModal = false;
+  @tracked showExportModal = false;
+  @tracked exportFormat = 'csv';
+  @tracked downloadError = '';
+
+  constructor() {
+    super(...arguments);
+    this.getExportCapabilities();
+  }
+
+  get showExportButton() {
+    if (this.args.noData === true) return false;
+    return this.canDownload;
+  }
+
+  @waitFor
+  async getExportCapabilities() {
+    const ns = this.namespace.path;
+    try {
+      // selected namespace usually ends in /
+      const url = ns
+        ? `${sanitizePath(ns)}/sys/internal/counters/activity/export`
+        : 'sys/internal/counters/activity/export';
+      const cap = await this.store.findRecord('capabilities', url);
+      this.canDownload = cap.canSudo;
+    } catch (e) {
+      // if we can't read capabilities, default to show
+      this.canDownload = true;
+    }
+  }
+
+  get formattedStartDate() {
+    if (!this.args.startTimestamp) return null;
+    return parseAPITimestamp(this.args.startTimestamp, 'MMMM yyyy');
+  }
+
+  get formattedEndDate() {
+    if (!this.args.endTimestamp) return null;
+    return parseAPITimestamp(this.args.endTimestamp, 'MMMM yyyy');
+  }
+
+  get showEndDate() {
+    // displays on CSV export modal, no need to display duplicate months and years
+    if (!this.args.endTimestamp) return false;
+    const startDateObject = parseAPITimestamp(this.args.startTimestamp);
+    const endDateObject = parseAPITimestamp(this.args.endTimestamp);
+    return !isSameMonth(startDateObject, endDateObject);
+  }
+
+  get formattedCsvFileName() {
+    const endRange = this.showEndDate ? `-${this.formattedEndDate}` : '';
+    const csvDateRange = this.formattedStartDate ? `_${this.formattedStartDate + endRange}` : '';
+    const ns = this.namespace.path ? `_${this.namespace.path}` : '';
+    return `clients_export${ns}${csvDateRange}`;
+  }
+
+  get showCommunity() {
+    return this.version.isCommunity && !!this.formattedStartDate && !!this.formattedEndDate;
+  }
+
+  async getExportData() {
+    const adapter = this.store.adapterFor('clients/activity');
+    const { startTimestamp, endTimestamp } = this.args;
+    return adapter.exportData({
+      // the API only accepts json or csv
+      format: this.exportFormat === 'jsonl' ? 'json' : 'csv',
+      start_time: startTimestamp,
+      end_time: endTimestamp,
+      namespace: this.namespace.path,
+    });
+  }
+
+  exportChartData = task({ drop: true }, async (filename) => {
+    try {
+      const contents = await this.getExportData();
+      this.download.download(filename, contents, this.exportFormat);
+      this.showExportModal = false;
+    } catch (e) {
+      this.downloadError = e.message;
+    }
+  });
+
+  @action
+  refreshRoute() {
+    this.router.refresh(this.router.currentRoute.parent.name);
+  }
+
+  @action
+  resetModal() {
+    this.showExportModal = false;
+    this.downloadError = '';
+  }
+
+  @action
+  setEditModalVisible(visible) {
+    this.showEditModal = visible;
+  }
+
+  @action
+  setExportFormat(evt) {
+    const { value } = evt.target;
+    this.exportFormat = value;
+  }
+
+  // LOCAL TEMPLATE HELPERS
+  parseAPITimestamp = (timestamp, format) => {
+    return parseAPITimestamp(timestamp, format);
+  };
+}
diff --git a/ui/app/components/clients/page/client-list.hbs b/ui/app/components/clients/page/client-list.hbs
new file mode 100644
index 00000000000..38910769a41
--- /dev/null
+++ b/ui/app/components/clients/page/client-list.hbs
@@ -0,0 +1,90 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Text::Body class="has-top-margin-l has-bottom-margin-m" @tag="p" @size="100" @color="faint">The client list data below
+  comes from the
+  <Hds::Link::Inline
+    @icon="docs-link"
+    @iconPosition="trailing"
+    @isHrefExternal={{true}}
+    @href={{doc-link "/vault/api-docs/system/internal-counters#activity-export"}}
+  >
+    Activity Export API
+  </Hds::Link::Inline>. It may take up to ten minutes for new client IDs to appear in the export data.
+</Hds::Text::Body>
+
+<Clients::CountsCard data-test-card="Export activity data">
+  <:subheader>
+    <Clients::FilterToolbar
+      @dataset={{@exportData}}
+      @onFilter={{this.handleFilter}}
+      @filterQueryParams={{@filterQueryParams}}
+      @isExportData={{true}}
+    />
+  </:subheader>
+
+  <:table>
+    <Hds::Tabs @onClickTab={{this.onClickTab}} @selectedTabIndex={{this.selectedTabIndex}} as |T|>
+      {{#each-in this.exportDataByTab as |tabName exportData|}}
+        {{#let (this.filterData exportData) as |tableData|}}
+          <T.Tab @count={{or tableData.length "0"}} data-test-tab={{tabName}}>{{tabName}}</T.Tab>
+          <T.Panel>
+            <div class="has-top-margin-xs">
+              {{#if this.filtersAreApplied}}
+                <Hds::Text::Body @tag="p" @color="faint" class="has-bottom-margin-xs" data-test-table-summary={{tabName}}>
+                  Summary:
+                  {{pluralize tableData.length "client"}}
+                  {{if (eq tableData.length 1) "matches" "match"}}
+                  the filter criteria.
+                </Hds::Text::Body>
+              {{/if}}
+
+              {{! Elements "behind" tabs always render on the DOM and are just superficially hidden/shown. }}
+              {{! The export data can be many rows so for performance only render the currently selected tab }}
+              {{#if (eq tabName this.selectedTab)}}
+                <Clients::Table
+                  data-test-table="attribution"
+                  @data={{tableData}}
+                  @columns={{this.tableColumns tabName}}
+                  @setPageSize={{50}}
+                  @showPaginationSizeSelector={{true}}
+                >
+
+                  <:emptyState>
+                    {{#if (and (eq tabName "Secret sync") (not this.flags.secretsSyncIsActivated))}}
+                      <Hds::ApplicationState as |A|>
+                        <A.Header @title="No secret sync clients" />
+                        <A.Body @text="No data is available because Secrets Sync has not been activated." />
+                        <A.Body>
+                          <Hds::Link::Standalone
+                            @icon="chevron-right"
+                            @iconPosition="trailing"
+                            @text="Activate Secrets Sync"
+                            @route="vault.cluster.sync.secrets.overview"
+                          />
+                        </A.Body>
+                      </Hds::ApplicationState>
+                    {{else}}
+                      <Hds::ApplicationState as |A|>
+                        <A.Header @title="No data found" />
+                        <A.Body
+                          @text="Select another client type {{if
+                            this.filtersAreApplied
+                            'or update filters'
+                            ''
+                          }} to view client count data."
+                        />
+                      </Hds::ApplicationState>
+                    {{/if}}
+                  </:emptyState>
+                </Clients::Table>
+              {{/if}}
+            </div>
+          </T.Panel>
+        {{/let}}
+      {{/each-in}}
+    </Hds::Tabs>
+  </:table>
+</Clients::CountsCard>
\ No newline at end of file
diff --git a/ui/app/components/clients/page/client-list.ts b/ui/app/components/clients/page/client-list.ts
new file mode 100644
index 00000000000..0be5976eca0
--- /dev/null
+++ b/ui/app/components/clients/page/client-list.ts
@@ -0,0 +1,120 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { HTMLElementEvent } from 'vault/forms';
+import { filterIsSupported, filterTableData } from 'core/utils/client-count-utils';
+import { service } from '@ember/service';
+import FlagsService from 'vault/services/flags';
+
+import type { ActivityExportData, ClientFilterTypes } from 'vault/vault/client-counts/activity-api';
+
+// Define the base mapping to derive types from
+const CLIENT_TYPE_MAP = {
+  entity: 'Entity',
+  'non-entity-token': 'Non-entity',
+  'pki-acme': 'ACME',
+  'secret-sync': 'Secret sync',
+} as const;
+
+// Dynamically derive the tab values from the mapping
+type ClientListTabs = (typeof CLIENT_TYPE_MAP)[keyof typeof CLIENT_TYPE_MAP];
+
+export interface Args {
+  exportData: ActivityExportData[];
+  onFilterChange: CallableFunction;
+  filterQueryParams: Record<ClientFilterTypes, string>;
+}
+
+export default class ClientsClientListPageComponent extends Component<Args> {
+  @service declare readonly flags: FlagsService;
+
+  @tracked selectedTab: ClientListTabs = 'Entity';
+  @tracked exportDataByTab: Record<ClientListTabs, ActivityExportData[]> = {
+    Entity: [],
+    'Non-entity': [],
+    ACME: [],
+    'Secret sync': [],
+  };
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+
+    this.args.exportData.forEach((data: ActivityExportData) => {
+      const tabName = CLIENT_TYPE_MAP[data.client_type];
+      this.exportDataByTab[tabName].push(data);
+    });
+
+    const firstTab = Object.keys(this.exportDataByTab)[0] as ClientListTabs;
+    this.selectedTab = firstTab;
+  }
+
+  get selectedTabIndex() {
+    return Object.keys(this.exportDataByTab).indexOf(this.selectedTab);
+  }
+
+  // Only render tabs for whatever the export data returns
+  get tabs(): ClientListTabs[] {
+    return Object.keys(this.exportDataByTab) as ClientListTabs[];
+  }
+
+  @action
+  handleFilter(filters: Record<ClientFilterTypes, string>) {
+    this.args.onFilterChange(filters);
+  }
+
+  @action
+  onClickTab(_event: HTMLElementEvent<HTMLInputElement>, idx: number) {
+    const tab = this.tabs[idx];
+    this.selectedTab = tab ?? this.tabs[0]!;
+  }
+
+  get filtersAreApplied() {
+    return (
+      Object.keys(this.args.filterQueryParams).every((f) => filterIsSupported(f)) &&
+      Object.values(this.args.filterQueryParams).some((v) => !!v)
+    );
+  }
+
+  // TEMPLATE HELPERS
+  filterData = (dataset: ActivityExportData[]) => filterTableData(dataset, this.args.filterQueryParams);
+
+  tableColumns(tab: ClientListTabs) {
+    // all client types have values for these columns
+    const defaultColumns = [
+      { key: 'client_id', label: 'Client ID' },
+      { key: 'client_type', label: 'Client type' },
+      { key: 'namespace_path', label: 'Namespace path' },
+      { key: 'namespace_id', label: 'Namespace ID' },
+      {
+        key: 'client_first_used_time',
+        label: 'Initial usage',
+        tooltip:
+          'First usage date in the billing period. Vault only provides this data for clients initially used after upgrading to version 1.21.',
+      },
+      { key: 'mount_path', label: 'Mount path' },
+      { key: 'mount_type', label: 'Mount type' },
+      { key: 'mount_accessor', label: 'Mount accessor' },
+    ];
+    // these params only have value for "entity" client types
+    const entityOnly = [
+      {
+        key: 'entity_name',
+        label: 'Entity name',
+        tooltip: 'Entity name will be empty in the case of a deleted entity.',
+      },
+      { key: 'entity_alias_name', label: 'Entity alias name' },
+      { key: 'local_entity_alias', label: 'Local entity alias' },
+      { key: 'policies', label: 'Policies' },
+      { key: 'entity_metadata', label: 'Entity metadata' },
+      { key: 'entity_alias_metadata', label: 'Entity alias metadata' },
+      { key: 'entity_alias_custom_metadata', label: 'Entity alias custom metadata' },
+      { key: 'entity_group_ids', label: 'Entity group IDs' },
+    ];
+    return tab === 'Entity' ? [...defaultColumns, ...entityOnly] : defaultColumns;
+  }
+}
diff --git a/ui/app/components/clients/page/counts.hbs b/ui/app/components/clients/page/counts.hbs
index b6140df84e5..40add64d35f 100644
--- a/ui/app/components/clients/page/counts.hbs
+++ b/ui/app/components/clients/page/counts.hbs
@@ -1,49 +1,32 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="box is-sideless is-fullwidth is-marginless is-bottomless">
-  <p class="has-bottom-margin-xl">
-    This dashboard surfaces Vault client usage over time.
-    <Hds::Link::Inline @href={{doc-link "/vault/docs/concepts/client-count"}}>Documentation is available here</Hds::Link::Inline>.
-    Date queries are sent in UTC.
-  </p>
-
-  <h2 class="title is-6 has-bottom-margin-xs" data-test-counts-start-label>
-    {{this.versionText.label}}
-  </h2>
-
-  <div class="is-flex-align-baseline">
-    {{#if this.formattedStartDate}}
-      <p class="is-size-6" data-test-counts-start-month>{{this.formattedStartDate}}</p>
-      <Hds::Button
-        class="has-left-margin-xs"
-        @text="Edit"
-        @color="tertiary"
-        @icon="edit"
-        @iconPosition="trailing"
-        data-test-counts-start-edit
-        {{on "click" (fn (mut this.showBillingStartModal) true)}}
-      />
-    {{else}}
-      <DateDropdown
-        @handleSubmit={{this.onDateChange}}
-        @dateType="startDate"
-        @submitText="Save"
-        data-test-counts-start-dropdown
-      />
-    {{/if}}
-  </div>
+}}
+<div class="has-border-bottom-light">
+  <Clients::PageHeader
+    @billingStartTime={{this.formattedBillingStartDate}}
+    @retentionMonths={{@config.retentionMonths}}
+    @activityTimestamp={{@activity.responseTimestamp}}
+    @startTimestamp={{@startTimestamp}}
+    @endTimestamp={{@endTimestamp}}
+    @upgradesDuringActivity={{this.upgradesDuringActivity}}
+    @noData={{not @activity.total.clients}}
+    @onChange={{this.onDateChange}}
+  />
+</div>
 
-  <p class="is-8 has-text-grey has-bottom-margin-l" data-test-counts-description>
-    {{this.versionText.description}}
-  </p>
+<div class="has-top-bottom-margin">
+  <Hds::Text::Body @tag="p" @size="100" class="has-bottom-margin-s">
+    This is the dashboard for your overall client count usages. Review Vault's
+    <Hds::Link::Inline @href={{doc-link "/vault/docs/concepts/client-count"}} @isHrefExternal={{true}}>
+      client counting documentation</Hds::Link::Inline>
+    for more information.
+  </Hds::Text::Body>
 
   {{#if (eq @activity.id "no-data")}}
-    <Clients::NoData @config={{@config}} @dateRangeMessage={{this.dateRangeMessage}} />
+    <Clients::NoData @config={{@config}} />
   {{else if @activityError}}
-    <Clients::Error @error={{@activityError}} />
+    <Clients::Counts::Error @error={{@activityError}} />
   {{else}}
     {{#if (eq @config.enabled "Off")}}
       <Hds::Alert @type="inline" @color="warning" class="has-bottom-margin-s" as |A|>
@@ -57,90 +40,57 @@
       </Hds::Alert>
     {{/if}}
 
-    {{#if @startTimestamp}}
-      <div class="is-subtitle-gray has-bottom-margin-m">
-        FILTERS
-        <Toolbar data-test-clients-filter-bar>
-          <ToolbarFilters>
-            <CalendarWidget
-              @startTimestamp={{this.startTimestampISO}}
-              @endTimestamp={{this.endTimestampISO}}
-              @selectMonth={{this.onDateChange}}
-            />
-            {{#if (or @namespace this.namespaces)}}
-              <SearchSelect
-                @id="namespace-search-select"
-                @options={{this.namespaces}}
-                @inputValue={{if @namespace (array @namespace)}}
-                @selectLimit="1"
-                @disallowNewItems={{true}}
-                @fallbackComponent="input-search"
-                @onChange={{fn this.setFilterValue "ns"}}
-                @placeholder="Filter by namespace"
-                @displayInherit={{true}}
-                class="is-marginless"
-                data-test-counts-namespaces
-              />
-            {{/if}}
-            {{#if (or @mountPath this.mountPaths)}}
-              <SearchSelect
-                @id="auth-method-search-select"
-                @options={{this.mountPaths}}
-                @inputValue={{if @mountPath (array @mountPath)}}
-                @selectLimit="1"
-                @disallowNewItems={{true}}
-                @fallbackComponent="input-search"
-                @onChange={{fn this.setFilterValue "mountPath"}}
-                @placeholder="Filter by mount path"
-                @displayInherit={{true}}
-                data-test-counts-auth-mounts
-              />
-            {{/if}}
-          </ToolbarFilters>
-        </Toolbar>
-      </div>
-    {{/if}}
-
-    {{#if this.filteredActivity}}
-      {{#if this.startTimeDiscrepancy}}
-        <Hds::Alert data-test-counts-start-discrepancy @type="inline" @color="warning" class="has-bottom-margin-s" as |A|>
-          <A.Title>Warning</A.Title>
-          <A.Description data-test-counts-start-discrepancy>
-            {{this.startTimeDiscrepancy}}
+    {{#if @activity.total}}
+      {{#if this.upgradeExplanations}}
+        <Hds::Alert data-test-clients-upgrade-warning @type="inline" @color="warning" class="has-bottom-margin-m" as |A|>
+          <A.Title>
+            Client count data contains
+            {{pluralize this.upgradeExplanations.length "upgrade"}}
+          </A.Title>
+          <A.Description>
+            Vault was upgraded during this time period. Keep this in mind while looking at the data. Visit our
+            <Hds::Link::Inline
+              @isHrefExternal={{true}}
+              @href={{doc-link
+                "/vault/docs/concepts/client-count/faq#q-which-vault-version-reflects-the-most-accurate-client-counts"
+              }}
+            >
+              Client count FAQ
+            </Hds::Link::Inline>
+            for more information.
+          </A.Description>
+          <A.Description>
+            <ul class="bullet">
+              {{#each this.upgradeExplanations as |info|}}
+                <li>{{info}}</li>
+              {{/each}}
+            </ul>
           </A.Description>
         </Hds::Alert>
       {{/if}}
 
-      {{yield}}
+      {{#if this.version.isEnterprise}}
+        {{! The "Client list" tab only renders for enterprise versions so there is no need for the nav bar }}
+        <Clients::Counts::NavBar />
+      {{/if}}
 
-    {{else if (and (not @config.billingStartTimestamp) (not @startTimestamp))}}
-      {{! Empty state for no billing/license start date }}
-      <EmptyState @title={{this.versionText.title}} @message={{this.versionText.message}} />
+      {{! CLIENT COUNT PAGE COMPONENTS RENDER HERE }}
+      {{yield}}
+    {{else if (and this.version.isCommunity (or (not @startTimestamp) (not @endTimestamp)))}}
+      {{! Empty state for community without start or end query param }}
+      <EmptyState
+        @title="Input the start and end dates to view client attribution by path."
+        @message="Only historical data may be queried. No data is available for the current month."
+      />
     {{else}}
       <EmptyState
-        @title="No data received {{if this.dateRangeMessage this.dateRangeMessage}}"
-        @message="Update the filter values or click the button to reset them."
-      >
-        <Hds::Button @text="Reset filters" @color="tertiary" @icon="reload" {{on "click" this.resetFilters}} />
-      </EmptyState>
+        @title="No data received"
+        @message={{if
+          this.version.isCommunity
+          "Select a start and end date above to query client count data."
+          "Select a different date range to view client count data."
+        }}
+      />
     {{/if}}
   {{/if}}
-</div>
-
-{{#if this.showBillingStartModal}}
-  <Hds::Modal id="clients-edit-date-modal" @onClose={{fn (mut this.showBillingStartModal) false}} as |M|>
-    <M.Header>
-      Edit start month
-    </M.Header>
-    <M.Body>
-      <p class="has-bottom-margin-s">
-        {{this.versionText.description}}
-      </p>
-      <p><strong>{{this.versionText.label}}</strong></p>
-      <DateDropdown class="has-top-padding-s" @handleSubmit={{this.onDateChange}} @dateType="startDate" @submitText="Save" />
-    </M.Body>
-    <M.Footer as |F|>
-      <Hds::Button data-test-date-dropdown-cancel @text="Cancel" @color="secondary" {{on "click" F.close}} />
-    </M.Footer>
-  </Hds::Modal>
-{{/if}}
\ No newline at end of file
+</div>
\ No newline at end of file
diff --git a/ui/app/components/clients/page/counts.ts b/ui/app/components/clients/page/counts.ts
index 55ccb21e7e1..5a9b19bfb98 100644
--- a/ui/app/components/clients/page/counts.ts
+++ b/ui/app/components/clients/page/counts.ts
@@ -1,58 +1,74 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
-import { fromUnixTime, getUnixTime, isSameMonth, isAfter } from 'date-fns';
 import { parseAPITimestamp } from 'core/utils/date-formatters';
-import { formatDateObject } from 'core/utils/client-count-utils';
+import { filterVersionHistory } from 'core/utils/client-count-utils';
 
+import type AdapterError from '@ember-data/adapter/error';
 import type VersionService from 'vault/services/version';
 import type ClientsActivityModel from 'vault/models/clients/activity';
 import type ClientsConfigModel from 'vault/models/clients/config';
-import type StoreService from 'vault/services/store';
-import timestamp from 'core/utils/timestamp';
+import type ClientsVersionHistoryModel from 'vault/models/clients/version-history';
 
 interface Args {
   activity: ClientsActivityModel;
+  activityError?: AdapterError;
   config: ClientsConfigModel;
-  startTimestamp: number;
-  endTimestamp: number;
-  namespace: string;
-  mountPath: string;
+  endTimestamp: string; // ISO format
   onFilterChange: CallableFunction;
+  startTimestamp: string; // ISO format
+  versionHistory: ClientsVersionHistoryModel[];
 }
 
 export default class ClientsCountsPageComponent extends Component<Args> {
   @service declare readonly version: VersionService;
-  @service declare readonly store: StoreService;
 
-  get startTimestampISO() {
-    return this.args.startTimestamp ? fromUnixTime(this.args.startTimestamp).toISOString() : null;
+  get formattedStartDate() {
+    return this.args.startTimestamp ? parseAPITimestamp(this.args.startTimestamp, 'MMMM yyyy') : null;
   }
 
-  get endTimestampISO() {
-    return this.args.endTimestamp ? fromUnixTime(this.args.endTimestamp).toISOString() : null;
+  get formattedEndDate() {
+    return this.args.endTimestamp ? parseAPITimestamp(this.args.endTimestamp, 'MMMM yyyy') : null;
   }
 
-  get formattedStartDate() {
-    return this.startTimestampISO ? parseAPITimestamp(this.startTimestampISO, 'MMMM yyyy') : null;
+  get formattedBillingStartDate() {
+    return this.args.config.billingStartTimestamp.toISOString();
+  }
+
+  // passed into page-header for the export modal alert
+  get upgradesDuringActivity() {
+    const { versionHistory, activity } = this.args;
+    return filterVersionHistory(versionHistory, activity?.startTime, activity?.endTime);
   }
 
-  // returns text for empty state message if noActivityData
-  get dateRangeMessage() {
-    if (this.startTimestampISO && this.endTimestampISO) {
-      const endMonth = isSameMonth(
-        parseAPITimestamp(this.startTimestampISO) as Date,
-        parseAPITimestamp(this.endTimestampISO) as Date
-      )
-        ? ''
-        : `to ${parseAPITimestamp(this.endTimestampISO, 'MMMM yyyy')}`;
-      // completes the message 'No data received from { dateRangeMessage }'
-      return `from ${parseAPITimestamp(this.startTimestampISO, 'MMMM yyyy')} ${endMonth}`;
+  get upgradeExplanations() {
+    if (this.upgradesDuringActivity.length) {
+      return this.upgradesDuringActivity.map((upgrade: ClientsVersionHistoryModel) => {
+        let explanation;
+        const date = parseAPITimestamp(upgrade.timestampInstalled, 'MMM d, yyyy');
+        const version = upgrade.version || '';
+        switch (true) {
+          case version.includes('1.9'):
+            explanation =
+              '- We introduced changes to non-entity token and local auth mount logic for client counting in 1.9.';
+            break;
+          case version.includes('1.10'):
+            explanation = '- We added monthly breakdowns and mount level attribution starting in 1.10.';
+            break;
+          case version.includes('1.17'):
+            explanation = '- We separated ACME clients from non-entity clients starting in 1.17.';
+            break;
+          default:
+            explanation = '';
+            break;
+        }
+        return `${version} (upgraded on ${date}) ${explanation}`;
+      });
     }
     return null;
   }
@@ -60,117 +76,24 @@ export default class ClientsCountsPageComponent extends Component<Args> {
   get versionText() {
     return this.version.isEnterprise
       ? {
-          label: 'Billing start month',
-          description:
-            'This date comes from your license, and defines when client counting starts. Without this starting point, the data shown is not reliable.',
           title: 'No billing start date found',
           message:
             'In order to get the most from this data, please enter your billing period start month. This will ensure that the resulting data is accurate.',
         }
       : {
-          label: 'Client counting start date',
-          description:
-            'This date is when client counting starts. Without this starting point, the data shown is not reliable.',
           title: 'No start date found',
           message:
             'In order to get the most from this data, please enter a start month above. Vault will calculate new clients starting from that month.',
         };
   }
 
-  get namespaces() {
-    return this.args.activity.byNamespace
-      ? this.args.activity.byNamespace.map((namespace) => ({
-          name: namespace.label,
-          id: namespace.label,
-        }))
-      : [];
-  }
-
-  get mountPaths() {
-    if (this.namespaces.length) {
-      return this.activityForNamespace?.mounts.map((mount) => ({
-        id: mount.label,
-        name: mount.label,
-      }));
-    }
-    return [];
-  }
-
-  get startTimeDiscrepancy() {
-    // show banner if startTime returned from activity log (response) is after the queried startTime
-    const { activity, config } = this.args;
-    const activityStartDateObject = parseAPITimestamp(activity.startTime) as Date;
-    const queryStartDateObject = parseAPITimestamp(this.startTimestampISO) as Date;
-    const isEnterprise =
-      this.startTimestampISO === config.billingStartTimestamp?.toISOString() && this.version.isEnterprise;
-    const message = isEnterprise ? 'Your license start date is' : 'You requested data from';
-
-    if (
-      isAfter(activityStartDateObject, queryStartDateObject) &&
-      !isSameMonth(activityStartDateObject, queryStartDateObject)
-    ) {
-      return `${message} ${this.formattedStartDate}.
-        We only have data from ${parseAPITimestamp(activity.startTime, 'MMMM yyyy')},
-        and that is what is being shown here.`;
-    } else {
-      return null;
-    }
-  }
-
-  get activityForNamespace() {
-    const { activity, namespace } = this.args;
-    return namespace ? activity.byNamespace.find((ns) => ns.label === namespace) : null;
-  }
-
-  get filteredActivity() {
-    // return activity counts based on selected namespace and auth mount values
-    const { namespace, mountPath, activity } = this.args;
-    if (namespace) {
-      return mountPath
-        ? this.activityForNamespace?.mounts.find((mount) => mount.label === mountPath)
-        : this.activityForNamespace;
-    }
-    return activity.total;
+  // the dashboard should show sync tab if the flag is on or there's data
+  get hasSecretsSyncClients(): boolean {
+    return this.args.activity?.total?.secret_syncs > 0;
   }
 
   @action
-  onDateChange(dateObject: { dateType: string; monthIdx: string; year: string }) {
-    const { dateType, monthIdx, year } = dateObject;
-    const { config } = this.args;
-    const currentTimestamp = getUnixTime(timestamp.now());
-
-    // converts the selectedDate to unix timestamp for activity query
-    const selectedDate = formatDateObject({ monthIdx, year }, dateType === 'endDate');
-
-    if (dateType !== 'cancel') {
-      const start_time = {
-        reset: getUnixTime(config?.billingStartTimestamp) || null, // clicked 'Current billing period' in calendar widget -> resets to billing start date
-        currentMonth: currentTimestamp, // clicked 'Current month' from calendar widget -> defaults to currentTimestamp
-        startDate: selectedDate, // from "Edit billing start" modal
-      }[dateType];
-      // endDate type is selection from calendar widget
-      const end_time = dateType === 'endDate' ? selectedDate : currentTimestamp; // defaults to currentTimestamp
-      const params = start_time !== undefined ? { start_time, end_time } : { end_time };
-      this.args.onFilterChange(params);
-    }
-  }
-
-  @action
-  setFilterValue(type: 'ns' | 'mountPath', [value]: [string | undefined]) {
-    const params = { [type]: value };
-    // unset mountPath value when namespace is cleared
-    if (type === 'ns' && !value) {
-      params['mountPath'] = undefined;
-    }
+  onDateChange(params: { start_time: string; end_time: string }) {
     this.args.onFilterChange(params);
   }
-
-  @action resetFilters() {
-    this.args.onFilterChange({
-      start_time: undefined,
-      end_time: undefined,
-      ns: undefined,
-      mountPath: undefined,
-    });
-  }
 }
diff --git a/ui/app/components/clients/page/overview.hbs b/ui/app/components/clients/page/overview.hbs
index 8ab73f43436..1a899a0336a 100644
--- a/ui/app/components/clients/page/overview.hbs
+++ b/ui/app/components/clients/page/overview.hbs
@@ -1,27 +1,52 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Clients::RunningTotal
-  @byMonthActivityData={{this.byMonthActivityData}}
-  @isHistoricalMonth={{and (not this.isCurrentMonth) (not this.isDateRange)}}
-  @isCurrentMonth={{this.isCurrentMonth}}
-  @runningTotals={{this.totalUsageCounts}}
-  @upgradeData={{this.upgradeDuringActivity}}
-  @responseTimestamp={{@activity.responseTimestamp}}
-/>
-{{#if this.hasAttributionData}}
-  <Clients::Attribution
-    @totalUsageCounts={{this.totalUsageCounts}}
-    @newUsageCounts={{this.newClientCounts}}
-    @totalClientAttribution={{this.totalClientAttribution}}
-    @newClientAttribution={{this.newClientAttribution}}
-    @selectedNamespace={{@namespace}}
-    @startTimestamp={{this.startTimeISO}}
-    @endTimestamp={{this.endTimeISO}}
-    @responseTimestamp={{@activity.responseTimestamp}}
-    @isHistoricalMonth={{and (not this.isCurrentMonth) (not this.isDateRange)}}
-    @upgradeExplanation={{this.upgradeExplanation}}
-  />
+<Clients::RunningTotal @byMonthNewClients={{this.byMonthNewClients}} @runningTotals={{@activity.total}} />
+
+{{! by_namespace is an empty array when there is no client count activity data }}
+{{#if @activity.byNamespace}}
+  <Clients::CountsCard
+    @title="Client attribution"
+    @description="Select a month to view the client count per mount for that month."
+  >
+    <:subheader>
+      <Hds::Text::Body class="has-top-margin-l has-bottom-margin-m" @tag="p" @size="100" @color="faint">Use the filters to
+        view the clients attributed by path.
+      </Hds::Text::Body>
+      <Clients::FilterToolbar
+        @dataset={{this.activityData}}
+        @onFilter={{this.handleFilter}}
+        @filterQueryParams={{@filterQueryParams}}
+        @dropdownMonths={{this.months}}
+      />
+    </:subheader>
+
+    <:table>
+      <Clients::Table
+        data-test-table="attribution"
+        @data={{this.tableData}}
+        @columns={{this.tableColumns}}
+        @initiallySortBy={{hash column="clients" direction="desc"}}
+        @setPageSize={{10}}
+        @showPaginationSizeSelector={{true}}
+      >
+        <:emptyState>
+          <Hds::ApplicationState as |A|>
+            <A.Header @title="No data found" />
+            <A.Body @text="Clear or change filters to view client count data." />
+            <A.Footer as |F|>
+              <F.LinkStandalone
+                @icon="file-text"
+                @text="Client count documentation"
+                @href="https://developer.hashicorp.com/vault/docs/concepts/client-count"
+                @iconPosition="trailing"
+              />
+            </A.Footer>
+          </Hds::ApplicationState>
+        </:emptyState>
+      </Clients::Table>
+    </:table>
+  </Clients::CountsCard>
 {{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/page/overview.ts b/ui/app/components/clients/page/overview.ts
index ceaf8870d12..0194795ae89 100644
--- a/ui/app/components/clients/page/overview.ts
+++ b/ui/app/components/clients/page/overview.ts
@@ -1,8 +1,69 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import ActivityComponent from '../activity';
+import Component from '@glimmer/component';
+import { cached, tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { filterTableData, flattenMounts } from 'core/utils/client-count-utils';
 
-export default ActivityComponent;
+import type ClientsActivityModel from 'vault/vault/models/clients/activity';
+import type { ClientFilterTypes } from 'vault/vault/client-counts/activity-api';
+
+export interface Args {
+  activity: ClientsActivityModel;
+  onFilterChange: CallableFunction;
+  filterQueryParams: Record<ClientFilterTypes, string>;
+}
+
+export default class ClientsOverviewPageComponent extends Component<Args> {
+  @tracked selectedMonth = '';
+
+  @cached
+  get byMonthNewClients() {
+    return this.args.activity.byMonth?.map((m) => m?.new_clients) || [];
+  }
+
+  // Supplies data passed to dropdown filters (except months which is computed below )
+  get activityData() {
+    // If no month is selected the table displays all of the activity for the queried date range.
+    const selectedMonth = this.args.filterQueryParams.month;
+    const namespaceData = selectedMonth
+      ? this.byMonthNewClients.find((m) => m.timestamp === selectedMonth)?.namespaces
+      : this.args.activity.byNamespace;
+
+    // Get the array of "mounts" data nested in each namespace object and flatten
+    return flattenMounts(namespaceData || []);
+  }
+
+  @cached
+  get months() {
+    return this.byMonthNewClients.reverse().map((m) => m.timestamp);
+  }
+
+  get tableData() {
+    if (this.activityData?.length) {
+      // Reset the `month` query param because it determines which dataset (see this.activityData)
+      // is passed to the table and is does not filter for key/value pairs within this dataset.
+      const filters = { ...this.args.filterQueryParams };
+      filters.month = '';
+      return filterTableData(this.activityData, filters);
+    }
+    return null;
+  }
+
+  get tableColumns() {
+    return [
+      { key: 'namespace_path', label: 'Namespace', isSortable: true },
+      { key: 'mount_path', label: 'Mount path', isSortable: true },
+      { key: 'mount_type', label: 'Mount type', isSortable: true },
+      { key: 'clients', label: 'Client count', isSortable: true },
+    ];
+  }
+
+  @action
+  handleFilter(filters: Record<ClientFilterTypes, string>) {
+    this.args.onFilterChange(filters);
+  }
+}
diff --git a/ui/app/components/clients/page/sync.hbs b/ui/app/components/clients/page/sync.hbs
deleted file mode 100644
index 6f31a372296..00000000000
--- a/ui/app/components/clients/page/sync.hbs
+++ /dev/null
@@ -1,59 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if this.isDateRange}}
-  <Clients::ChartContainer
-    @title={{this.title}}
-    @description={{this.description}}
-    @timestamp={{@activity.responseTimestamp}}
-    @hasChartData={{this.byMonthActivityData}}
-    class="no-legend"
-  >
-    <:subTitle>
-      <StatText
-        @label="Total sync clients"
-        @subText="The total number of secrets synced from Vault to other destinations during this date range."
-        @value={{this.totalUsageCounts.secret_syncs}}
-        @size="l"
-        data-test-total-sync-clients
-      />
-    </:subTitle>
-
-    <:stats>
-      <StatText
-        @label="Average sync clients per month"
-        @value={{this.average this.byMonthActivityData "secret_syncs"}}
-        @size="m"
-        class="data-details-top has-top-padding-l"
-        data-test-average-sync-clients
-      />
-    </:stats>
-
-    <:chart>
-      <Clients::Charts::VerticalBarBasic
-        @chartTitle={{this.title}}
-        @data={{this.byMonthActivityData}}
-        @dataKey="secret_syncs"
-        @chartHeight={{200}}
-      />
-    </:chart>
-
-    <:emptyState>
-      <EmptyState
-        @title="No monthly secrets sync clients"
-        @subTitle="There is no secrets sync data available for this date range."
-        @bottomBorder={{true}}
-      />
-    </:emptyState>
-  </Clients::ChartContainer>
-{{else}}
-  <div class="chart-wrapper" data-test-usage-stats>
-    <div class="chart-header has-bottom-margin-m">
-      <h2 class="chart-title">{{this.title}}</h2>
-      <p class="chart-description has-bottom-padding-m">{{this.description}}</p>
-    </div>
-    <StatText @label="Total sync clients" @value={{this.totalUsageCounts.secret_syncs}} @size="l" />
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/page/sync.ts b/ui/app/components/clients/page/sync.ts
deleted file mode 100644
index e7238bcd703..00000000000
--- a/ui/app/components/clients/page/sync.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ActivityComponent from '../activity';
-
-export default class SyncComponent extends ActivityComponent {
-  title = 'Secrets sync usage';
-  description =
-    'This data can be used to understand how many secrets sync clients have been used for this date range. A secret with a configured sync destination would qualify as a unique and active client.';
-}
diff --git a/ui/app/components/clients/page/token.hbs b/ui/app/components/clients/page/token.hbs
deleted file mode 100644
index f7e68c2f025..00000000000
--- a/ui/app/components/clients/page/token.hbs
+++ /dev/null
@@ -1,101 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if (and this.byMonthActivityData this.isDateRange)}}
-  <Clients::ChartContainer
-    @title="Entity/Non-entity clients"
-    @description="This data can be used to understand how many entity and non-entity clients are using Vault each month for this date range."
-    @timestamp={{@activity.responseTimestamp}}
-    @legend={{this.legend}}
-    @hasChartData={{true}}
-    data-test-chart="monthly total"
-  >
-    <:subTitle>
-      <h2 class="chart-title">Total monthly clients</h2>
-      <p class="chart-subtext">
-        Each client is counted once per month. This can help with capacity planning.
-      </p>
-    </:subTitle>
-
-    <:stats>
-      <StatText
-        @label="Average total clients per month"
-        @value={{this.averageTotalClients}}
-        @size="m"
-        class="data-details-top has-top-padding-l"
-        data-test-chart-stat="monthly total"
-      />
-
-      <StatText
-        @label="Average new clients per month"
-        @value={{this.averageNewClients}}
-        @size="m"
-        class="data-details-bottom has-top-padding-l"
-        data-test-chart-stat="monthly new"
-      />
-    </:stats>
-
-    <:chart>
-      <Clients::VerticalBarChart @dataset={{this.byMonthActivityData}} @chartLegend={{this.legend}} />
-    </:chart>
-  </Clients::ChartContainer>
-
-  <Clients::ChartContainer
-    @title="Monthly new"
-    @description="Entity or non-entity clients which interacted with Vault for the first time during this date range, displayed per month."
-    @timestamp={{@activity.responseTimestamp}}
-    @legend={{this.legend}}
-    @hasChartData={{this.averageNewClients}}
-    class={{unless this.averageNewClients "no-legend"}}
-    data-test-chart="monthly new"
-  >
-    <:stats>
-      <StatText
-        @label="Average new entity clients per month"
-        @value={{this.average this.byMonthNewClients "entity_clients"}}
-        @size="m"
-        class="chart-subTitle has-top-padding-l"
-        data-test-chart-stat="entity"
-      />
-
-      <StatText
-        @label="Average new non-entity clients per month"
-        @value={{this.average this.byMonthNewClients "non_entity_clients"}}
-        @size="m"
-        class="data-details-top has-top-padding-l"
-        data-test-chart-stat="nonentity"
-      />
-    </:stats>
-
-    <:chart>
-      <Clients::VerticalBarChart @dataset={{this.byMonthNewClients}} @chartLegend={{this.legend}} />
-    </:chart>
-
-    <:emptyState>
-      <EmptyState
-        @title="No new clients"
-        @subTitle="There is no new client data available for this {{if
-          this.countsController.mountPath
-          'auth method'
-          'namespace'
-        }} in this date range."
-        @bottomBorder={{true}}
-      />
-    </:emptyState>
-  </Clients::ChartContainer>
-{{else}}
-  {{! UsageStats render when viewing a single, historical month AND activity data predates new client breakdown (< v1.10.0)
-    or viewing the current month filtered down to auth method }}
-  <Clients::UsageStats
-    @title="Total usage"
-    @description="These totals are within
-    {{or @mountPath 'this namespace and all its children'}}.
-    {{if
-      this.isCurrentMonth
-      "Only totals are available when viewing the current month. To see a breakdown of new and total clients for this month, select the 'Current Billing Period' filter."
-    }}"
-    @totalUsageCounts={{this.tokenUsageCounts}}
-  />
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/page/token.ts b/ui/app/components/clients/page/token.ts
deleted file mode 100644
index fd00b320386..00000000000
--- a/ui/app/components/clients/page/token.ts
+++ /dev/null
@@ -1,52 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ActivityComponent from '../activity';
-
-import type {
-  ClientActivityNewClients,
-  ClientActivityMonthly,
-  ClientActivityResourceByKey,
-} from 'vault/vault/models/clients/activity';
-
-export default class ClientsTokenPageComponent extends ActivityComponent {
-  legend = [
-    { key: 'entity_clients', label: 'entity clients' },
-    { key: 'non_entity_clients', label: 'non-entity clients' },
-  ];
-
-  calculateClientAverages(
-    dataset:
-      | ClientActivityMonthly[]
-      | (ClientActivityResourceByKey | undefined)[]
-      | (ClientActivityNewClients | undefined)[]
-      | undefined
-  ) {
-    return ['entity_clients', 'non_entity_clients'].reduce((count, key) => {
-      const average = this.average(dataset, key);
-      return (count += average || 0);
-    }, 0);
-  }
-
-  get averageTotalClients() {
-    return this.calculateClientAverages(this.byMonthActivityData);
-  }
-
-  get averageNewClients() {
-    return this.calculateClientAverages(this.byMonthNewClients);
-  }
-
-  get tokenUsageCounts() {
-    if (this.totalUsageCounts) {
-      const { entity_clients, non_entity_clients } = this.totalUsageCounts;
-      return {
-        clients: entity_clients + non_entity_clients,
-        entity_clients,
-        non_entity_clients,
-      };
-    }
-    return null;
-  }
-}
diff --git a/ui/app/components/clients/running-total.hbs b/ui/app/components/clients/running-total.hbs
index f73d6e9b416..519669e2f86 100644
--- a/ui/app/components/clients/running-total.hbs
+++ b/ui/app/components/clients/running-total.hbs
@@ -1,126 +1,87 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-{{#if (gt @byMonthActivityData.length 1)}}
-  <Clients::ChartContainer
-    @title="Vault client counts"
-    {{! * add "secrets sync" clients to list here - unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release }}
-    @description="The total clients in the specified date range. This includes entity and non-entity clients. The total client count number is an important consideration for Vault billing."
-    @timestamp={{@responseTimestamp}}
-    @hasChartData={{true}}
-    data-test-chart="running total"
+{{#if @byMonthNewClients.length}}
+  <Clients::CountsCard
+    @title="Client usage trends for selected billing period"
+    @description={{this.chartContainerText}}
+    @legend={{this.chartLegend}}
   >
-    <:subTitle>
-      <StatText
-        @label="Running client total"
-        @subText="The number of clients which interacted with Vault during this date range."
-        @value={{@runningTotals.clients}}
-        @size="l"
-      />
-    </:subTitle>
 
-    <:stats>
-      <div class="data-details-top has-top-padding-l">
-        <div class="is-flex-row">
-          <StatText
-            @label="Entity clients"
-            @value={{@runningTotals.entity_clients}}
-            @size="m"
-            data-test-chart-stat="running total entity"
-          />
-          {{!--  * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-          <StatText
-            @label="Secrets sync clients"
-            @value={{@runningTotals.secret_syncs}}
-            @size="m"
-            class="has-left-margin-l"
-            data-test-chart-stat="running total sync"
-          /> 
-          --}}
-        </div>
-      </div>
-      <StatText
-        @label="Non-entity clients"
-        @value={{@runningTotals.non_entity_clients}}
-        @size="m"
-        class="data-details-bottom"
-        data-test-chart-stat="running total sync"
-      />
-    </:stats>
+    <:dataLeft>
+      <Hds::Text::Body @tag="p">Client count and type distribution</Hds::Text::Body>
+      <VaultReporting::DonutChart @data={{this.donutChartData}} @title="Total Clients" class="donut-chart" />
+    </:dataLeft>
 
-    <:chart>
-      <Clients::Charts::Line @dataset={{@byMonthActivityData}} @upgradeData={{@upgradeData}} @chartHeight="250" />
-    </:chart>
-  </Clients::ChartContainer>
-{{else}}
-  {{#let (get @byMonthActivityData "0") as |singleMonthData|}}
-    {{#if (and @isHistoricalMonth singleMonthData.new_clients.clients)}}
-      <div class="chart-wrapper single-month-grid" data-test-running-total="single-month-stats">
-        <div class="chart-header has-bottom-margin-sm">
-          <h2 class="chart-title">Vault client counts</h2>
-          <p class="chart-description">
-            The total billable clients in the specified date range. This includes entity, non-entity, and secrets sync
-            clients. The total client count number is an important consideration for Vault billing.
-          </p>
-        </div>
-        <div class="single-month-stats" data-test-new>
-          <div class="single-month-section-title">
-            <StatText
-              @label="New clients"
-              @subText="This is the number of clients which were created in Vault for the first time in the selected month."
-              @value={{singleMonthData.new_clients.clients}}
-              @size="l"
-            />
-          </div>
-          <div class="single-month-breakdown-entity">
-            <StatText @label="Entity clients" @value={{singleMonthData.new_clients.entity_clients}} @size="m" />
-          </div>
-          <div class="single-month-breakdown-nonentity">
-            <StatText @label="Non-entity clients" @value={{singleMonthData.new_clients.non_entity_clients}} @size="m" />
-          </div>
-          {{!-- * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-          <div class="single-month-breakdown-sync">
-            <StatText @label="Secrets sync clients" @value={{singleMonthData.new_clients.secret_syncs}} @size="m" />
-          </div>
-           --}}
-        </div>
-        <div class="single-month-stats" data-test-total>
-          <div class="single-month-section-title">
-            <StatText
-              @label="Total monthly clients"
-              @subText="This is the number of total clients which used Vault for the given month, both new and previous."
-              @value={{singleMonthData.clients}}
-              @size="l"
-            />
-          </div>
-          <div class="single-month-breakdown-entity">
-            <StatText @label="Entity clients" @value={{singleMonthData.entity_clients}} @size="m" />
-          </div>
-          <div class="single-month-breakdown-nonentity">
-            <StatText @label="Non-entity clients" @value={{singleMonthData.non_entity_clients}} @size="m" />
-          </div>
-          {{!-- * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-          <div class="single-month-breakdown-sync">
-            <StatText @label="Secrets sync clients" @value={{singleMonthData.secret_syncs}} @size="m" />
-          </div>
-           --}}
-        </div>
+    <:dataRight>
+      <div class="flex space-between has-bottom-margin-xl left-padding-16">
+        <Hds::Text::Body @tag="p">Client usage by month</Hds::Text::Body>
+        <Hds::Form::Toggle::Field
+          data-test-input="toggle view"
+          {{on "change" (fn (mut this.showStacked) (not this.showStacked))}}
+          as |F|
+        >
+          <F.Label>Split by client type</F.Label>
+        </Hds::Form::Toggle::Field>
       </div>
-    {{else}}
-      {{! This renders when either:
-    -> viewing the current month and all namespaces (no filters)
-    -> filtering by a namespace with no month over month data
-    if filtering by a mount with no month over month data <UsageStats> in dashboard.hbs renders }}
-      <Clients::UsageStats
-        @title="Total usage"
-        @description="These totals are within this namespace and all its children. {{if
-          @isCurrentMonth
-          "Only totals are available when viewing the current month. To see a breakdown of new and total clients for this month, select the 'Current billing period' filter."
-        }}"
-        @totalUsageCounts={{@runningTotals}}
+      {{#if this.showStacked}}
+        <Clients::Charts::VerticalBarStacked
+          @chartTitle="Client usage by month"
+          @data={{this.runningTotalData}}
+          @chartLegend={{this.chartLegend}}
+          @chartHeight={{200}}
+        />
+      {{else}}
+        <Clients::Charts::VerticalBarBasic
+          @chartTitle="Client usage by month"
+          @data={{this.runningTotalData}}
+          @dataKey="new_clients"
+          @chartHeight={{200}}
+        />
+      {{/if}}
+    </:dataRight>
+  </Clients::CountsCard>
+{{else}}
+  {{! Renders when viewing activity log data that predates the monthly breakdown added in 1.11 }}
+  <Clients::UsageStats @title="Client usage" @description="Total client usage for the selected billing period.">
+    <StatText
+      class="column"
+      @label="Total clients"
+      @value={{@runningTotals.clients}}
+      @size="l"
+      @subText="The number of clients which interacted with Vault during this month. This is Vault’s primary billing metric."
+    />
+    <StatText
+      class="column"
+      @label="Entity"
+      @value={{@runningTotals.entity_clients}}
+      @size="l"
+      @subText="Representations of a particular user, client, or application that created a token via login."
+    />
+    <StatText
+      class="column"
+      @label="Non-entity"
+      @value={{@runningTotals.non_entity_clients}}
+      @size="l"
+      @subText="Clients created with a shared set of permissions, but not associated with an entity."
+    />
+    <StatText
+      class="column"
+      @label="ACME"
+      @value={{@runningTotals.acme_clients}}
+      @size="l"
+      @subText="Each ACME request counts as one client."
+    />
+    {{#if this.flags.secretsSyncIsActivated}}
+      <StatText
+        class="column"
+        @label="Secret sync"
+        @value={{@runningTotals.secret_syncs}}
+        @size="l"
+        @subText="A secret with a configured sync destination qualifies as a unique and active client."
       />
     {{/if}}
-  {{/let}}
+  </Clients::UsageStats>
 {{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/running-total.ts b/ui/app/components/clients/running-total.ts
new file mode 100644
index 00000000000..d9a14a8777e
--- /dev/null
+++ b/ui/app/components/clients/running-total.ts
@@ -0,0 +1,59 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { service } from '@ember/service';
+
+import type { ByMonthNewClients, TotalClients } from 'vault/vault/client-counts/activity-api';
+import type FlagsService from 'vault/services/flags';
+
+interface Args {
+  byMonthNewClients: ByMonthNewClients[];
+  runningTotals: TotalClients;
+}
+
+export default class RunningTotal extends Component<Args> {
+  @service declare readonly flags: FlagsService;
+
+  @tracked showStacked = false;
+
+  get chartContainerText() {
+    return `The total clients in the specified date range, displayed per month. This includes entity, non-entity${
+      this.flags.secretsSyncIsActivated ? ', ACME and secrets sync clients' : ' and ACME clients'
+    }. The total client count number is an important consideration for Vault billing.`;
+  }
+
+  get runningTotalData() {
+    return this.args.byMonthNewClients.map((monthly) => ({
+      ...monthly,
+      new_clients: monthly.clients,
+    }));
+  }
+
+  get donutChartData() {
+    return [
+      { value: this.args.runningTotals.entity_clients, label: 'Entity clients' },
+      { value: this.args.runningTotals.non_entity_clients, label: 'Non-entity clients' },
+      { value: this.args.runningTotals.acme_clients, label: 'ACME clients' },
+      ...(this.flags.secretsSyncIsActivated
+        ? [{ value: this.args.runningTotals.secret_syncs, label: 'Secret sync clients' }]
+        : []),
+    ];
+  }
+
+  get chartLegend() {
+    if (this.showStacked) {
+      return [
+        { key: 'entity_clients', label: 'Entity clients' },
+        { key: 'non_entity_clients', label: 'Non-entity clients' },
+        { key: 'acme_clients', label: 'ACME clients' },
+        // MUST BE LAST because conditionally renders and legend color mapping for stacked bars will be off otherwise
+        ...(this.flags.secretsSyncIsActivated ? [{ key: 'secret_syncs', label: 'Secret sync clients' }] : []),
+      ];
+    }
+    return [{ key: 'new_clients', label: 'New clients' }];
+  }
+}
diff --git a/ui/app/components/clients/table.hbs b/ui/app/components/clients/table.hbs
new file mode 100644
index 00000000000..eb5b1470c18
--- /dev/null
+++ b/ui/app/components/clients/table.hbs
@@ -0,0 +1,72 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if @data}}
+  <Hds::AdvancedTable
+    @model={{this.paginatedTableData}}
+    @columns={{@columns}}
+    {{! @sortBy and @sortOrder args presets column icon direction but do not handle sorting. 
+    Sorting happens manually because the table is paginated. }}
+    @sortBy={{this.sortColumn}}
+    @sortOrder={{this.sortDirection}}
+    @onSort={{this.updateSort}}
+    {{did-update this.resetPagination @data}}
+    ...attributes
+  >
+    <:body as |B|>
+      <B.Tr data-test-table-row={{B.rowIndex}}>
+        {{#each this.columnKeys as |key|}}
+          {{#let (get B.data key) as |value|}}
+            {{#if (and (eq key "mount_type") (eq value "deleted mount"))}}
+              <B.Td data-test-table-data={{key}}><Hds::Badge @text="Deleted" @type="outlined" /></B.Td>
+            {{else if (eq key "client_id")}}
+              <B.Td data-test-table-data={{key}} class="white-space-nowrap">
+                <Hds::Copy::Snippet @textToCopy={{value}} @color="secondary" />
+              </B.Td>
+            {{else if (and (eq key "clients") this.version.isEnterprise)}}
+              <B.Td data-test-table-data={{key}} class="white-space-nowrap">
+                <Hds::Link::Inline
+                  @route="vault.cluster.clients.counts.client-list"
+                  @query={{this.generateQueryParams B.data}}
+                >{{value}}</Hds::Link::Inline>
+              </B.Td>
+            {{else}}
+              <B.Td class="white-space-nowrap" data-test-table-data={{key}}>
+                {{! stringify value if it is an array or object, otherwise render directly }}
+                {{if (this.isObject value) (stringify value) value}}
+              </B.Td>
+            {{/if}}
+          {{/let}}
+        {{/each}}
+      </B.Tr>
+    </:body>
+  </Hds::AdvancedTable>
+
+  {{! WORKAROUND to manually re-render Hds::Pagination::Numbered to force update @currentPage }}
+  {{#if this.renderPagination}}
+    <Hds::Pagination::Numbered
+      @currentPage={{this.currentPage}}
+      @currentPageSize={{this.pageSize}}
+      @onPageChange={{fn this.handlePaginationChange "currentPage"}}
+      @onPageSizeChange={{fn this.handlePaginationChange "pageSize"}}
+      @pageSizes={{array 5 10 50 100}}
+      @showSizeSelector={{or @showPaginationSizeSelector false}}
+      @totalItems={{@data.length}}
+      data-test-pagination
+      class="has-top-margin-m"
+    />
+  {{/if}}
+
+{{else}}
+  <Hds::Card::Container @level="mid" @hasBorder={{true}} class="has-padding-l" data-test-card="table empty state">
+    {{#if (has-block "emptyState")}}
+      {{yield to="emptyState"}}
+    {{else}}
+      <Hds::ApplicationState as |A|>
+        <A.Header @title="No data to display" />
+      </Hds::ApplicationState>
+    {{/if}}
+  </Hds::Card::Container>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/table.ts b/ui/app/components/clients/table.ts
new file mode 100644
index 00000000000..1d599e658a3
--- /dev/null
+++ b/ui/app/components/clients/table.ts
@@ -0,0 +1,146 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { cached, tracked } from '@glimmer/tracking';
+import { paginate } from 'core/utils/paginate-list';
+import { next } from '@ember/runloop';
+import { service } from '@ember/service';
+
+import type VersionService from 'vault/services/version';
+import type { ClientFilterTypes } from 'vault/vault/client-counts/activity-api';
+
+/**
+ * @module ClientsTable
+ * ClientsTable renders a paginated table for a passed dataset. HDS table components handle basic sorting
+ * but because this table is paginated, all sorting happens manually.
+ * See https://helios.hashicorp.design/components/table/table?tab=code#component-api
+ * for the full component API and list of supported args.
+ *
+ * @example
+ * <Clients::Table
+ *    @data={{this.dataset}}
+ *    @showPaginationSizeSelector={{false}}
+ *    @pageSize={{100}}
+ *    @initiallySortBy={{hash column="clients" direction="desc"}}
+ *    @columns={{array
+ *      (hash key="namespace" label="Namespace" isSortable=true)
+ *      (hash key="label" label="Mount path" isSortable=true)
+ *      (hash key="mount_type" label="Mount type" isSortable=true)
+ *      (hash key="clients" label="Counts" isSortable=true)
+ *    }}
+ *  />
+ */
+
+interface TableColumn {
+  key: string;
+  label: string;
+  isSortable: boolean;
+}
+
+type SortDirection = 'asc' | 'desc';
+
+interface Args {
+  columns: TableColumn[];
+  data: Record<string, any>[];
+  initiallySortBy?: { column?: string; direction?: SortDirection };
+  setPageSize?: number;
+  showPaginationSizeSelector?: boolean;
+}
+
+export default class ClientsTable extends Component<Args> {
+  @service declare readonly version: VersionService;
+
+  @tracked currentPage = 1;
+  @tracked pageSize = 5; // Can be overridden by @setPageSize
+  @tracked sortColumn = '';
+  @tracked sortDirection: SortDirection = 'asc'; // default is 'asc' for consistency with HDS defaults
+
+  //  WORKAROUND to manually re-render Hds::Pagination::Numbered to force update @currentPage
+  @tracked renderPagination = true;
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+
+    const { column, direction } = this.args.initiallySortBy || {};
+    if (column) {
+      this.sortColumn = column;
+    }
+    if (direction) {
+      this.sortDirection = direction;
+    }
+
+    // Override default page size with a custom amount.
+    // pageSize can be updated by the user if @showPaginationSizeSelector is true
+    if (this.args.setPageSize) {
+      this.pageSize = this.args.setPageSize;
+    }
+  }
+
+  @cached
+  get columnKeys() {
+    return this.args.columns.map((k: TableColumn) => k['key']);
+  }
+
+  @cached
+  get paginatedTableData(): Record<string, any>[] {
+    const sorted = this.sortTableData(this.args.data);
+    const paginated = paginate(sorted, {
+      page: this.currentPage,
+      pageSize: this.pageSize,
+    });
+
+    return paginated;
+  }
+
+  // This table is paginated so we cannot use any out of the box filtering
+  // from the HDS component and must manually sort data.
+  sortTableData(data: Record<string, any>[]): Record<string, any>[] {
+    if (this.sortColumn) {
+      return [...data].sort((a, b) => {
+        const valA = a[this.sortColumn];
+        const valB = b[this.sortColumn];
+
+        if (valA < valB) return this.sortDirection === 'asc' ? -1 : 1;
+        if (valA > valB) return this.sortDirection === 'asc' ? 1 : -1;
+        return 0;
+      });
+    }
+    return data;
+  }
+
+  @action
+  handlePaginationChange(action: 'currentPage' | 'pageSize', value: number) {
+    this[action] = value;
+  }
+
+  @action
+  async resetPagination() {
+    // setPageSize is intentionally NOT reset here so user changes to page size
+    // are preserved regardless of whether or not the table data updates.
+    this.renderPagination = false;
+    this.currentPage = 1;
+    //  WORKAROUND to manually re-render Hds::Pagination::Numbered to force update @currentPage
+    next(() => {
+      this.renderPagination = true;
+    });
+  }
+
+  @action
+  updateSort(column: string, direction: SortDirection) {
+    // Update tracked variables so paginatedTableData recomputes
+    this.sortColumn = column;
+    this.sortDirection = direction;
+  }
+
+  // TEMPLATE HELPERS
+  isObject = (value: any) => typeof value === 'object';
+
+  generateQueryParams = (datum: Record<ClientFilterTypes, any>) => {
+    const { namespace_path = '', mount_path = '', mount_type = '' } = datum;
+    return { namespace_path, mount_path, mount_type };
+  };
+}
diff --git a/ui/app/components/clients/usage-stats.hbs b/ui/app/components/clients/usage-stats.hbs
index f9f7522707b..41821e026f1 100644
--- a/ui/app/components/clients/usage-stats.hbs
+++ b/ui/app/components/clients/usage-stats.hbs
@@ -1,65 +1,36 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<div class="chart-wrapper" data-test-usage-stats>
-  <div class="chart-header has-header-link has-bottom-margin-m">
-    <div class="header-left">
-      <h2 class="chart-title">{{@title}}</h2>
-      <p class="chart-description"> {{or @description "These totals are within this namespace and all its children."}}</p>
-    </div>
-    <div class="header-right">
-      <DocLink @path="/vault/tutorials/monitoring/usage-metrics">
-        Learn more
-      </DocLink>
-    </div>
+{{! Display only template that renders yielded components in columns, beneath a title and description }}
+<Hds::Card::Container
+  @level="base"
+  @hasBorder={{true}}
+  data-test-usage-stats={{@title}}
+  class="has-padding-m has-bottom-margin-m"
+>
+  <div class="flex row-wrap space-between">
+    <Hds::Text::Display @tag="h3" @weight="semibold" @size="400">
+      {{@title}}
+    </Hds::Text::Display>
+    <Hds::Link::Standalone
+      @href={{doc-link "/vault/docs/concepts/client-count/client-usage"}}
+      @text="Client usage tutorial"
+      @icon="learn-link"
+      @iconPosition="trailing"
+      class="has-bottom-margin-s"
+    />
   </div>
+  {{#if @description}}
+    <Hds::Text::Body @tag="p">
+      {{@description}}
+    </Hds::Text::Body>
+  {{/if}}
+
+  <hr class="has-background-gray-100 has-bottom-margin-m" />
 
   <div class="columns">
-    <div class="column">
-      <StatText
-        class="column"
-        @label="Total clients"
-        @value={{@totalUsageCounts.clients}}
-        @size="l"
-        @subText="The number of clients which interacted with Vault during this month. This is Vault’s primary billing metric."
-        data-test-stat-text="total-clients"
-      />
-    </div>
-    <div class="column">
-      <StatText
-        class="column"
-        @label="Entity clients"
-        @value={{@totalUsageCounts.entity_clients}}
-        @size="l"
-        @subText="Representations of a particular user, client, or application that created a token via login."
-        data-test-stat-text="entity-clients"
-      />
-    </div>
-    <div class="column">
-      <StatText
-        class="column"
-        @label="Non-entity clients"
-        @value={{@totalUsageCounts.non_entity_clients}}
-        @size="l"
-        @subText="Clients created with a shared set of permissions, but not associated with an entity."
-        data-test-stat-text="non-entity-clients"
-      />
-    </div>
-    {{!-- * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-    {{#if (gte @totalUsageCounts.secret_syncs 0)}}
-      <div class="column">
-        <StatText
-          class="column"
-          @label="Secrets sync clients"
-          @value={{@totalUsageCounts.secret_syncs}}
-          @size="l"
-          @subText="A secret with a configured sync destination qualifies as a unique and active client."
-          data-test-stat-text="secret-syncs"
-        />
-      </div>
-    {{/if}}
-     --}}
+    {{yield}}
   </div>
-</div>
\ No newline at end of file
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/components/clients/vertical-bar-chart.hbs b/ui/app/components/clients/vertical-bar-chart.hbs
deleted file mode 100644
index 50256e585ec..00000000000
--- a/ui/app/components/clients/vertical-bar-chart.hbs
+++ /dev/null
@@ -1,36 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if @dataset}}
-  <svg
-    data-test-vertical-bar-chart
-    class="chart has-grid"
-    {{on "mouseleave" this.removeTooltip}}
-    {{did-insert this.renderChart @dataset}}
-    {{did-update this.renderChart @dataset}}
-  >
-  </svg>
-{{else}}
-  <EmptyState @title={{@noDataTitle}} @subTitle={{or @noDataMessage "No data to display"}} @bottomBorder={{true}} />
-{{/if}}
-
-{{! TOOLTIP }}
-
-{{#if this.tooltipTarget}}
-  {{! Required to set tag name = div https://github.com/yapplabs/ember-modal-dialog/issues/290 }}
-  {{! Component must be in curly bracket notation }}
-  {{! template-lint-disable no-curly-component-invocation }}
-  {{#modal-dialog
-    tagName="div" tetherTarget=this.tooltipTarget targetAttachment="bottom middle" attachment="bottom middle" offset="10px 0"
-  }}
-    <div class="chart-tooltip">
-      <p class="bold">{{this.tooltipTotal}}</p>
-      {{#each this.tooltipStats as |stat|}}
-        <p>{{stat}}</p>
-      {{/each}}
-    </div>
-    <div class="chart-tooltip-arrow"></div>
-  {{/modal-dialog}}
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/clients/vertical-bar-chart.js b/ui/app/components/clients/vertical-bar-chart.js
deleted file mode 100644
index ac6af2dd867..00000000000
--- a/ui/app/components/clients/vertical-bar-chart.js
+++ /dev/null
@@ -1,172 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-import { tracked } from '@glimmer/tracking';
-import { max } from 'd3-array';
-// eslint-disable-next-line no-unused-vars
-import { select, selectAll, node } from 'd3-selection';
-import { axisLeft, axisBottom } from 'd3-axis';
-import { scaleLinear, scalePoint } from 'd3-scale';
-import { stack } from 'd3-shape';
-import {
-  BAR_WIDTH,
-  GREY,
-  BLUE_PALETTE,
-  SVG_DIMENSIONS,
-  TRANSLATE,
-  calculateSum,
-  formatNumbers,
-} from 'vault/utils/chart-helpers';
-import { formatNumber } from 'core/helpers/format-number';
-
-/**
- * @module VerticalBarChart
- * VerticalBarChart components are used to display stacked data in a vertical bar chart with accompanying tooltip
- *
- * @example
- * ```js
- * <VerticalBarChart @dataset={dataset} @chartLegend={chartLegend} />
- * ```
- * @param {array} dataset - dataset for the chart, must be an array of flattened objects
- * @param {array} chartLegend - array of objects with key names 'key' and 'label' so data can be stacked
- * @param {string} xKey - string denoting key for x-axis data (data[xKey]) of dataset
- * @param {string} yKey - string denoting key for y-axis data (data[yKey]) of dataset
- * @param {string} [noDataMessage] - custom empty state message that displays when no dataset is passed to the chart
- */
-
-export default class VerticalBarChart extends Component {
-  @tracked tooltipTarget = '';
-  @tracked tooltipTotal = '';
-  @tracked tooltipStats = [];
-
-  get xKey() {
-    return this.args.xKey || 'month';
-  }
-
-  get yKey() {
-    return this.args.yKey || 'clients';
-  }
-
-  @action
-  renderChart(element, [chartData]) {
-    const dataset = chartData;
-    const filteredData = dataset.filter((e) => Object.keys(e).includes('clients')); // months with data will contain a 'clients' key (otherwise only a timestamp)
-    const stackFunction = stack().keys(this.args.chartLegend.map((l) => l.key));
-    const stackedData = stackFunction(filteredData);
-    const chartSvg = select(element);
-    const domainMax = max(filteredData.map((d) => d[this.yKey]));
-
-    chartSvg.attr('viewBox', `-50 20 600 ${SVG_DIMENSIONS.height}`); // set svg dimensions
-
-    // DEFINE DATA BAR SCALES
-    const yScale = scaleLinear().domain([0, domainMax]).range([0, 100]).nice();
-
-    const xScale = scalePoint()
-      .domain(dataset.map((d) => d[this.xKey]))
-      .range([0, SVG_DIMENSIONS.width]) // set width to fix number of pixels
-      .padding(0.2);
-
-    // clear out DOM before appending anything
-    chartSvg.selectAll('g').remove().exit().data(stackedData).enter();
-    const dataBars = chartSvg
-      .selectAll('g')
-      .data(stackedData)
-      .enter()
-      .append('g')
-      .style('fill', (d, i) => BLUE_PALETTE[i]);
-
-    dataBars
-      .selectAll('rect')
-      .data((stackedData) => stackedData)
-      .enter()
-      .append('rect')
-      .attr('width', `${BAR_WIDTH}px`)
-      .attr('class', 'data-bar')
-      .attr('data-test-vertical-chart', 'data-bar')
-      .attr('height', (stackedData) => `${yScale(stackedData[1] - stackedData[0])}%`)
-      .attr('x', ({ data }) => xScale(data[this.xKey])) // uses destructuring because was data.data.month
-      .attr('y', (data) => `${100 - yScale(data[1])}%`); // subtract higher than 100% to give space for x axis ticks
-
-    const tooltipTether = chartSvg
-      .append('g')
-      .attr('transform', `translate(${BAR_WIDTH / 2})`)
-      .attr('data-test-vertical-chart', 'tooltip-tethers')
-      .selectAll('circle')
-      .data(filteredData)
-      .enter()
-      .append('circle')
-      .style('opacity', '0')
-      .attr('cy', (d) => `${100 - yScale(d[this.yKey])}%`)
-      .attr('cx', (d) => xScale(d[this.xKey]))
-      .attr('r', 1);
-
-    // MAKE AXES //
-    const yAxisScale = scaleLinear()
-      .domain([0, max(filteredData.map((d) => d[this.yKey]))])
-      .range([`${SVG_DIMENSIONS.height}`, 0])
-      .nice();
-
-    const yAxis = axisLeft(yAxisScale)
-      .ticks(4)
-      .tickPadding(10)
-      .tickSizeInner(-SVG_DIMENSIONS.width)
-      .tickFormat(formatNumbers);
-
-    const xAxis = axisBottom(xScale).tickSize(0);
-
-    yAxis(chartSvg.append('g').attr('data-test-vertical-chart', 'y-axis-labels'));
-    xAxis(
-      chartSvg
-        .append('g')
-        .attr('transform', `translate(0, ${SVG_DIMENSIONS.height + 10})`)
-        .attr('data-test-vertical-chart', 'x-axis-labels')
-    );
-
-    chartSvg.selectAll('.domain').remove(); // remove domain lines
-
-    // WIDER SELECTION AREA FOR TOOLTIP HOVER
-    const greyBars = chartSvg
-      .append('g')
-      .attr('transform', `translate(${TRANSLATE.left})`)
-      .style('fill', `${GREY}`)
-      .style('opacity', '0')
-      .style('mix-blend-mode', 'multiply');
-
-    const tooltipRect = greyBars
-      .selectAll('rect')
-      .data(filteredData)
-      .enter()
-      .append('rect')
-      .style('cursor', 'pointer')
-      .attr('class', 'tooltip-rect')
-      .attr('height', '100%')
-      .attr('width', '30px') // three times width
-      .attr('y', '0') // start at bottom
-      .attr('x', (data) => xScale(data[this.xKey])); // not data.data because this is not stacked data
-
-    // MOUSE EVENT FOR TOOLTIP
-    tooltipRect.on('mouseover', (data) => {
-      const hoveredMonth = data[this.xKey];
-      const stackedNumbers = []; // accumulates stacked dataset values to calculate total
-      this.tooltipStats = []; // clear stats
-      this.args.chartLegend.forEach(({ key, label }) => {
-        stackedNumbers.push(data[key]);
-        this.tooltipStats.pushObject(`${formatNumber([data[key]])} ${label}`);
-      });
-      this.tooltipTotal = `${formatNumber([calculateSum(stackedNumbers)])} ${
-        data.new_clients ? 'total' : 'new'
-      } clients`;
-      // filter for the tether point that matches the hoveredMonth
-      const hoveredElement = tooltipTether.filter((data) => data.month === hoveredMonth).node();
-      this.tooltipTarget = hoveredElement; // grab the node from the list of rects
-    });
-  }
-
-  @action removeTooltip() {
-    this.tooltipTarget = null;
-  }
-}
diff --git a/ui/app/components/configure-aws-secret.js b/ui/app/components/configure-aws-secret.js
deleted file mode 100644
index c5639a0d4f4..00000000000
--- a/ui/app/components/configure-aws-secret.js
+++ /dev/null
@@ -1,56 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-
-/**
- * @module ConfigureAwsSecretComponent
- *
- * @example
- * ```js
- * <ConfigureAwsSecret
-    @model={{model}}
-    @tab={{tab}}
-    @accessKey={{accessKey}}
-    @secretKey={{secretKey}}
-    @region={{region}}
-    @iamEndpoint={{iamEndpoint}}
-    @stsEndpoint={{stsEndpoint}}
-    @saveAWSRoot={{action "save" "saveAWSRoot"}}
-    @saveAWSLease={{action "save" "saveAWSLease"}} />
- * ```
- *
- * @param {object} model - aws secret engine model
- * @param {string} tab - current tab selection
- * @param {string} accessKey - AWS access key
- * @param {string} secretKey - AWS secret key
- * @param {string} region - AWS region
- * @param {string} iamEndpoint - IAM endpoint
- * @param {string} stsEndpoint - Sts endpoint
- * @param {Function} saveAWSRoot - parent action which saves AWS root credentials
- * @param {Function} saveAWSLease - parent action which updates AWS lease information
- *
- */
-export default class ConfigureAwsSecretComponent extends Component {
-  @action
-  saveRootCreds(data, event) {
-    event.preventDefault();
-    this.args.saveAWSRoot(data);
-  }
-
-  @action
-  saveLease(data, event) {
-    event.preventDefault();
-    this.args.saveAWSLease(data);
-  }
-
-  @action
-  handleTtlChange(name, ttlObj) {
-    // lease values cannot be undefined, set to 0 to use default
-    const valueToSet = ttlObj.enabled ? ttlObj.goSafeTimeString : 0;
-    this.args.model.set(name, valueToSet);
-  }
-}
diff --git a/ui/app/components/configure-ssh-secret.js b/ui/app/components/configure-ssh-secret.js
deleted file mode 100644
index a6ea08c6f80..00000000000
--- a/ui/app/components/configure-ssh-secret.js
+++ /dev/null
@@ -1,38 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-
-/**
- * @module ConfigureSshSecretComponent
- *
- * @example
- * ```js
- * <ConfigureSshSecret
- *    @model={{this.model}}
- *    @configured={{this.configured}}
- *    @saveConfig={{action "saveConfig"}}
- *    @loading={{this.loading}}
- *  />
- * ```
- *
- * @param {string} model - ssh secret engine model
- * @param {Function} saveConfig - parent action which updates the configuration
- * @param {boolean} loading - property in parent that updates depending on status of parent's action
- *
- */
-export default class ConfigureSshSecretComponent extends Component {
-  @action
-  delete() {
-    this.args.saveConfig({ delete: true });
-  }
-
-  @action
-  saveConfig(event) {
-    event.preventDefault();
-    this.args.saveConfig({ delete: false });
-  }
-}
diff --git a/ui/app/components/console/command-input.hbs b/ui/app/components/console/command-input.hbs
new file mode 100644
index 00000000000..d7eec92d0e7
--- /dev/null
+++ b/ui/app/components/console/command-input.hbs
@@ -0,0 +1,30 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="console-ui-input" data-test-component="console/command-input">
+  {{#if this.isRunning}}
+    <div class="control console-spinner is-loading"></div>
+  {{else}}
+    <Chevron />
+  {{/if}}
+  <input
+    aria-label="web R.E.P.L."
+    aria-describedby="namespace-reminder"
+    onkeyup={{action "handleKeyUp"}}
+    value={{this.value}}
+    autocomplete="off"
+    spellcheck="false"
+    id="console-input"
+  />
+  <Hds::Button
+    class="hds-side-nav__icon-button"
+    {{on "click" (action "fullscreen")}}
+    data-test-dismiss-console-button
+    @icon={{if this.isFullscreen "minimize" "maximize"}}
+    @text={{if this.isFullscreen "Minimize window" "Maximize window"}}
+    @isIconOnly={{true}}
+  />
+</div>
+<NamespaceReminder @class="console-reminder" @mode="execute" @noun="command" />
\ No newline at end of file
diff --git a/ui/app/components/console/command-input.js b/ui/app/components/console/command-input.js
index 5cbb8601982..fb33376123d 100644
--- a/ui/app/components/console/command-input.js
+++ b/ui/app/components/console/command-input.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@ember/component';
-import keys from 'core/utils/key-codes';
+import keys from 'core/utils/keys';
 
 export default Component.extend({
   onExecuteCommand() {},
@@ -16,17 +16,17 @@ export default Component.extend({
 
   actions: {
     handleKeyUp(event) {
-      const keyCode = event.keyCode;
-      switch (keyCode) {
+      const val = event.target.value;
+      switch (event.key) {
         case keys.ENTER:
-          this.onExecuteCommand(event.target.value);
+          this.onExecuteCommand(val);
           break;
         case keys.UP:
         case keys.DOWN:
-          this.onShiftCommand(keyCode);
+          this.onShiftCommand(event.key);
           break;
         default:
-          this.onValueUpdate(event.target.value);
+          this.onValueUpdate(val);
       }
     },
     fullscreen() {
diff --git a/ui/app/templates/components/console/log-command.hbs b/ui/app/components/console/log-command.hbs
similarity index 81%
rename from ui/app/templates/components/console/log-command.hbs
rename to ui/app/components/console/log-command.hbs
index 91f7c76d65d..c86bbf2aa2d 100644
--- a/ui/app/templates/components/console/log-command.hbs
+++ b/ui/app/components/console/log-command.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="is-flex-center">
   <Icon @name="chevron-right" />
diff --git a/ui/app/templates/components/console/log-error-with-html.hbs b/ui/app/components/console/log-error-with-html.hbs
similarity index 85%
rename from ui/app/templates/components/console/log-error-with-html.hbs
rename to ui/app/components/console/log-error-with-html.hbs
index e35a5928ea7..efd38422729 100644
--- a/ui/app/templates/components/console/log-error-with-html.hbs
+++ b/ui/app/components/console/log-error-with-html.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! template-lint-disable no-triple-curlies}}
 <div class="console-ui-alert console-ui-alert--error">
diff --git a/ui/app/templates/components/console/log-error.hbs b/ui/app/components/console/log-error.hbs
similarity index 81%
rename from ui/app/templates/components/console/log-error.hbs
rename to ui/app/components/console/log-error.hbs
index 749d3395914..cc3396a668f 100644
--- a/ui/app/templates/components/console/log-error.hbs
+++ b/ui/app/components/console/log-error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="console-ui-alert console-ui-alert--error">
   <Icon @name="x-circle-fill" />
diff --git a/ui/app/templates/components/console/log-help.hbs b/ui/app/components/console/log-help.hbs
similarity index 88%
rename from ui/app/templates/components/console/log-help.hbs
rename to ui/app/components/console/log-help.hbs
index b85b5a97430..778bfab9ec3 100644
--- a/ui/app/templates/components/console/log-help.hbs
+++ b/ui/app/components/console/log-help.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! template-lint-disable no-whitespace-for-layout }}
 {{! prettier-ignore }}
@@ -25,6 +25,6 @@ Web REPL Commands:
 
 </pre>
   <p class="console-ui-panel-intro is-font-mono has-bottom-margin-s">
-    For more detailed documentation, see the <Hds::Link::Inline @href={{doc-link "/vault/docs/command/web"}}>HashiCorp Developer site</Hds::Link::Inline>.
+    For more detailed documentation, see the <Hds::Link::Inline @href={{doc-link "/vault/docs/ui/web-cli"}}>HashiCorp Developer site</Hds::Link::Inline>.
   </p>
 </div>
\ No newline at end of file
diff --git a/ui/app/components/console/log-json.hbs b/ui/app/components/console/log-json.hbs
new file mode 100644
index 00000000000..6410d4279cd
--- /dev/null
+++ b/ui/app/components/console/log-json.hbs
@@ -0,0 +1,15 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="console-ui-output">
+  <JsonEditor @value={{stringify this.content}} @readOnly={{true}} />
+  <Hds::Copy::Button
+    @text="Copy"
+    @isIconOnly={{true}}
+    @textToCopy={{stringify this.content}}
+    @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+    class="transparent icon-grey-500 top-right-absolute"
+  />
+</div>
\ No newline at end of file
diff --git a/ui/app/components/console/log-json.js b/ui/app/components/console/log-json.js
index 60c915050c6..455ad86ccbf 100644
--- a/ui/app/components/console/log-json.js
+++ b/ui/app/components/console/log-json.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/console/log-list.hbs b/ui/app/components/console/log-list.hbs
new file mode 100644
index 00000000000..193ce981a44
--- /dev/null
+++ b/ui/app/components/console/log-list.hbs
@@ -0,0 +1,21 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="console-ui-output">
+  <pre>
+    Keys
+    {{#each this.list as |item|}}
+      {{item}}
+
+    {{/each}}
+  </pre>
+  <Hds::Copy::Button
+    @text="Copy"
+    @isIconOnly={{true}}
+    @textToCopy={{multi-line-join this.list}}
+    @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+    class="transparent icon-grey-500 top-right-absolute"
+  />
+</div>
\ No newline at end of file
diff --git a/ui/app/components/console/log-list.js b/ui/app/components/console/log-list.js
index 91d6430021e..16cdef91090 100644
--- a/ui/app/components/console/log-list.js
+++ b/ui/app/components/console/log-list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/console/log-object.hbs b/ui/app/components/console/log-object.hbs
new file mode 100644
index 00000000000..d0303588240
--- /dev/null
+++ b/ui/app/components/console/log-object.hbs
@@ -0,0 +1,15 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="console-ui-output">
+  <pre>{{this.columns}}</pre>
+  <Hds::Copy::Button
+    @text="Copy"
+    @isIconOnly={{true}}
+    @textToCopy={{this.columns}}
+    @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+    class="transparent icon-grey-500 top-right-absolute"
+  />
+</div>
\ No newline at end of file
diff --git a/ui/app/components/console/log-object.js b/ui/app/components/console/log-object.js
index 206d48f0410..931019ee891 100644
--- a/ui/app/components/console/log-object.js
+++ b/ui/app/components/console/log-object.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/console/log-success.hbs b/ui/app/components/console/log-success.hbs
similarity index 82%
rename from ui/app/templates/components/console/log-success.hbs
rename to ui/app/components/console/log-success.hbs
index c8e94b144f2..96dedd7cb08 100644
--- a/ui/app/templates/components/console/log-success.hbs
+++ b/ui/app/components/console/log-success.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="console-ui-alert console-ui-alert--success">
   <Icon @name="check-circle-fill" />
diff --git a/ui/app/components/console/log-text.hbs b/ui/app/components/console/log-text.hbs
new file mode 100644
index 00000000000..85418efaf37
--- /dev/null
+++ b/ui/app/components/console/log-text.hbs
@@ -0,0 +1,15 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="console-ui-output">
+  <pre>{{@content}}</pre>
+  <Hds::Copy::Button
+    @text="Copy"
+    @isIconOnly={{true}}
+    @textToCopy={{@content}}
+    @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+    class="transparent icon-grey-500 top-right-absolute"
+  />
+</div>
\ No newline at end of file
diff --git a/ui/app/components/console/log-text.js b/ui/app/components/console/log-text.js
index 9a1a0f3b976..79a1ace56ae 100644
--- a/ui/app/components/console/log-text.js
+++ b/ui/app/components/console/log-text.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/console/output-log.hbs b/ui/app/components/console/output-log.hbs
similarity index 85%
rename from ui/app/templates/components/console/output-log.hbs
rename to ui/app/components/console/output-log.hbs
index 06290e65114..9b01815616a 100644
--- a/ui/app/templates/components/console/output-log.hbs
+++ b/ui/app/components/console/output-log.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each this.outputLog as |message|}}
   {{#unless message.hidden}}
diff --git a/ui/app/components/console/output-log.js b/ui/app/components/console/output-log.js
index 98c03796727..bbbb578f4c8 100644
--- a/ui/app/components/console/output-log.js
+++ b/ui/app/components/console/output-log.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/console/ui-panel.hbs b/ui/app/components/console/ui-panel.hbs
new file mode 100644
index 00000000000..3390b18520f
--- /dev/null
+++ b/ui/app/components/console/ui-panel.hbs
@@ -0,0 +1,50 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="console-ui-panel-content">
+  <div class="content has-bottom-margin-s">
+    <div class="console-close-button">
+      <Hds::Button
+        class="hds-side-nav__icon-button"
+        {{on "click" (action "closeConsole")}}
+        data-test-console-panel-close
+        @text="Close console"
+        @icon="x"
+        @isIconOnly={{true}}
+      />
+    </div>
+  </div>
+  <div class="content has-bottom-margin-l">
+    <p class="console-ui-panel-intro is-font-mono has-bottom-margin-s">
+      The Vault Web REPL provides an easy way to execute common Vault CLI commands, such as write, read, delete, and list. It
+      does not include KV version 2 write or put commands. For guidance, type `help`. For more detailed documentation, see
+      the
+      <Hds::Link::Inline @href={{doc-link "/vault/docs/command/web"}}>HashiCorp Developer site</Hds::Link::Inline>.
+    </p>
+    <p class="console-ui-panel-intro is-font-mono has-bottom-margin-s">Examples:</p>
+    <p class="console-ui-panel-intro is-font-mono">
+      <span aria-hidden="true">→ </span>Write secrets to kv v1: write &lt;mount&gt;/my-secret foo=bar</p>
+    <p class="console-ui-panel-intro is-font-mono">
+      <span aria-hidden="true">→ </span>List kv v1 secret keys: list &lt;mount&gt;/</p>
+    <p class="console-ui-panel-intro is-font-mono">
+      <span aria-hidden="true">→ </span>Read a kv v1 secret: read &lt;mount&gt;/my-secret</p>
+    <p class="console-ui-panel-intro is-font-mono">
+      <span aria-hidden="true">→ </span>Mount a kv v2 secret engine: write sys/mounts/&lt;mount&gt; type=kv options=version=2</p>
+    <p class="console-ui-panel-intro is-font-mono">
+      <span aria-hidden="true">→ </span>Read a kv v2 secret: kv-get &lt;mount&gt;/secret-path</p>
+    <p class="console-ui-panel-intro is-font-mono">
+      <span aria-hidden="true">→ </span>Read a kv v2 secret's metadata: kv-get &lt;mount&gt;/secret-path-metadata</p>
+  </div>
+  <Console::OutputLog @outputLog={{this.cliLog}} />
+  <Console::CommandInput
+    @isFullscreen={{this.isFullscreen}}
+    @isRunning={{this.isRunning}}
+    @value={{this.inputValue}}
+    @onValueUpdate={{action (mut this.inputValue)}}
+    @onFullscreen={{action "toggleFullscreen"}}
+    @onExecuteCommand={{action "executeCommand"}}
+    @onShiftCommand={{action "shiftCommandIndex"}}
+  />
+</div>
\ No newline at end of file
diff --git a/ui/app/components/console/ui-panel.js b/ui/app/components/console/ui-panel.js
index da03b38aea5..8dccc4c40d8 100644
--- a/ui/app/components/console/ui-panel.js
+++ b/ui/app/components/console/ui-panel.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
 import { alias, or } from '@ember/object/computed';
 import Component from '@ember/component';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 import { schedule } from '@ember/runloop';
 import { camelize } from '@ember/string';
 import { task } from 'ember-concurrency';
@@ -28,7 +28,7 @@ export default Component.extend({
   console: service(),
   router: service(),
   controlGroup: service(),
-  store: service(),
+  pagination: service(),
   'data-test-component': 'console/ui-panel',
   attributeBindings: ['data-test-component'],
 
@@ -105,10 +105,10 @@ export default Component.extend({
 
   refreshRoute: task(function* () {
     const owner = getOwner(this);
-    const currentRoute = owner.lookup(`router:main`).get('currentRouteName');
+    const currentRoute = owner.lookup(`router:main`).currentRouteName;
 
     try {
-      this.store.clearAllDatasets();
+      this.pagination.clearDataset();
       yield this.router.transitionTo(currentRoute);
       this.logAndOutput(null, { type: 'success', content: 'The current screen has been refreshed!' });
     } catch (error) {
@@ -146,8 +146,8 @@ export default Component.extend({
     }
   }),
 
-  shiftCommandIndex(keyCode) {
-    this.console.shiftCommandIndex(keyCode, (val) => {
+  shiftCommandIndex(key) {
+    this.console.shiftCommandIndex(key, (val) => {
       this.set('inputValue', val);
     });
   },
diff --git a/ui/app/components/control-group-success.hbs b/ui/app/components/control-group-success.hbs
new file mode 100644
index 00000000000..cfb6a1d2018
--- /dev/null
+++ b/ui/app/components/control-group-success.hbs
@@ -0,0 +1,68 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if (and this.controlGroupResponse.token this.controlGroupResponse.uiParams.url)}}
+  <div class="control-group-success" data-test-navigate-message>
+    You have been granted access to
+    <code>{{this.model.requestPath}}</code>. Be careful, you can only access this data once. If you need access again in the
+    future you will need to get authorized again.
+    <div class="box is-shadowless is-fullwidth is-marginless has-slim-padding">
+      <Hds::Button @text="Visit" data-test-button="Visit" {{on "click" (action (perform this.markAndNavigate))}} />
+    </div>
+  </div>
+{{else}}
+  {{#if this.unwrapData}}
+    <div class="control-group-success is-editor">
+      <div class="is-relative">
+        <JsonEditor data-test-json-viewer @value={{stringify this.unwrapData}} @readOnly={{true}} />
+        <Hds::Copy::Button
+          @text="Copy"
+          @isIconOnly={{true}}
+          @textToCopy={{stringify this.unwrapData}}
+          @onError={{(fn
+            (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
+          )}}
+          class="transparent top-right-absolute"
+        />
+      </div>
+    </div>
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      <Hds::Button
+        @text="Back"
+        @color="secondary"
+        @route="vault.cluster.access.control-groups"
+        @icon="chevron-left"
+        @iconPosition="leading"
+      />
+    </div>
+  {{else}}
+    <div class="control-group-success" data-test-unwrap-form>
+      <form {{action (perform this.unwrap this.token) on="submit"}}>
+        <MessageError @errorMessage={{this.error}} />
+        <p>
+          If you have the token, you can now can access
+          <code>{{this.model.requestPath}}</code>
+        </p>
+        <label for="token" class="is-label">
+          Token to access data
+        </label>
+        <div class="control">
+          <Input
+            data-test-input="token"
+            class="input"
+            autocomplete="off"
+            spellcheck="false"
+            name="token"
+            id="token"
+            @value={{this.token}}
+          />
+        </div>
+        <div class="field is-grouped box is-fullwidth is-bottomless">
+          <Hds::Button @text="Access" type="submit" disabled={{not this.token}} data-test-submit />
+        </div>
+      </form>
+    </div>
+  {{/if}}
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/control-group-success.js b/ui/app/components/control-group-success.js
index 8433b368ce1..83454ec9086 100644
--- a/ui/app/components/control-group-success.js
+++ b/ui/app/components/control-group-success.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,7 +10,7 @@ import { task } from 'ember-concurrency';
 export default Component.extend({
   router: service(),
   controlGroup: service(),
-  store: service(),
+  api: service(),
 
   // public attrs
   model: null,
@@ -21,14 +21,14 @@ export default Component.extend({
   unwrapData: null,
 
   unwrap: task(function* (token) {
-    const adapter = this.store.adapterFor('tools');
     this.set('error', null);
     try {
-      const response = yield adapter.toolAction('unwrap', null, { clientToken: token });
+      const response = yield this.api.sys.unwrap({}, this.api.buildHeaders({ token }));
       this.set('unwrapData', response.auth || response.data);
       this.controlGroup.deleteControlGroupToken(this.model.id);
     } catch (e) {
-      this.set('error', `Token unwrap failed: ${e.errors[0]}`);
+      const { message } = yield this.api.parseError(e);
+      this.error = `Token unwrap failed: ${message}`;
     }
   }).drop(),
 
diff --git a/ui/app/components/control-group.hbs b/ui/app/components/control-group.hbs
new file mode 100644
index 00000000000..630652e2c26
--- /dev/null
+++ b/ui/app/components/control-group.hbs
@@ -0,0 +1,141 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="box is-fullwidth is-bottomless is-sideless">
+  <MessageError @model={{this.model}} />
+  <div class="control-group-header {{if this.isSuccess 'is-success'}}">
+    <p>
+      <Icon @name={{if this.isSuccess "check-circle-fill" "lock-fill"}} />
+      <strong data-test-banner-prefix>{{this.bannerPrefix}}</strong>
+      <span data-test-banner-text>{{this.bannerText}}</span>
+    </p>
+  </div>
+  {{#if
+    (and
+      this.model.approved
+      (not this.currentUserHasAuthorized)
+      (or (not this.model.requestEntity) this.currentUserIsRequesting)
+    )
+  }}
+    <ControlGroupSuccess
+      data-test-control-group-success
+      @model={{this.model}}
+      @controlGroupResponse={{this.controlGroupResponse}}
+    />
+  {{else}}
+    <div class="control-group">
+      <div data-test-requestor-text>
+        {{#if this.model.requestEntity.canRead}}
+          <LinkTo
+            @route="vault.cluster.access.identity.show"
+            @models={{array "entities" this.model.requestEntity.id "details"}}
+          >
+            {{this.requestorName}}
+          </LinkTo>
+        {{else}}
+          {{this.requestorName}}
+        {{/if}}
+        {{#if this.currentUserIsRequesting}}are{{else}}is{{/if}}
+        {{#if this.model.approved}}
+          authorized to access
+          <code>{{this.model.requestPath}}</code>
+        {{else}}
+          requesting access to
+          <code>{{this.model.requestPath}}</code>
+        {{/if}}
+      </div>
+
+      {{#if (or (not this.model.requestEntity) this.currentUserIsRequesting)}}
+        <Hds::Alert
+          @type="inline"
+          @color={{if this.isSuccess "success" "warning"}}
+          @icon={{false}}
+          data-test-inline-alert
+          as |A|
+        >
+          <A.Title>Accessor</A.Title>
+          <A.Description>
+            <Hds::Copy::Snippet
+              @textToCopy={{this.model.id}}
+              @color="secondary"
+              @onError={{(fn
+                (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
+              )}}
+              data-test-accessor-value
+            />
+          </A.Description>
+        </Hds::Alert>
+      {{/if}}
+
+      <div class="authorizations" data-test-authorizations>
+        {{#if (gt this.model.authorizations.length 0)}}
+          <span class="has-text-success">
+            <Icon @name="check-circle" />
+          </span>
+          Already approved by
+          {{#each this.model.authorizations as |authorization index|}}
+            {{~#if authorization.canRead~}}
+              <LinkTo @route="vault.cluster.access.identity.show" @models={{array "entities" authorization.id "details"}}>
+                {{authorization.name}}
+              </LinkTo>
+            {{~else~}}
+              {{authorization.name}}
+            {{~/if~}}{{#if (lt (inc index) this.model.authorizations.length)}},{{/if}}
+          {{/each}}
+        {{else}}
+          <span class="has-text-grey">
+            <Icon @name="check-circle" />
+          </span>
+          Awaiting authorization.
+        {{/if}}
+      </div>
+    </div>
+  {{/if}}
+
+  {{#if this.controlGroupResponse.token}}
+    <div class="has-bottom-margin-m has-top-margin-m" data-test-token>
+      <p class="has-text-grey has-padding-xxs">
+        We’ve saved your request token, but you may want to copy it just in case:
+      </p>
+      <Hds::Copy::Snippet
+        data-test-token-value
+        @textToCopy={{this.controlGroupResponse.token}}
+        @color="secondary"
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+      />
+    </div>
+  {{/if}}
+  {{! template-lint-configure simple-unless "warn" }}
+  {{#unless (and this.model.approved (or (not this.model.requestEntity) this.currentUserIsRequesting))}}
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      {{#if this.model.canAuthorize}}
+        {{#if (or this.model.approved this.currentUserHasAuthorized)}}
+          <Hds::Button
+            @text="Back"
+            @color="secondary"
+            @route="vault.cluster.access.control-groups"
+            @icon="chevron-left"
+            @iconPosition="leading"
+            data-test-back-button
+          />
+        {{else}}
+          <Hds::Button
+            @text="Authorize"
+            @icon={{if this.authorize.isRunning "loading"}}
+            {{on "click" (action (perform this.authorize))}}
+            data-test-button="Authorize"
+          />
+        {{/if}}
+      {{else}}
+        <Hds::Button
+          @text="Refresh"
+          @icon={{if this.refresh.isRunning "loading"}}
+          {{on "click" (action (perform this.refresh))}}
+          data-test-button="Refresh"
+        />
+      {{/if}}
+    </div>
+  {{/unless}}
+</div>
\ No newline at end of file
diff --git a/ui/app/components/control-group.js b/ui/app/components/control-group.js
index c5ff1659226..2c69b569515 100644
--- a/ui/app/components/control-group.js
+++ b/ui/app/components/control-group.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -24,7 +24,7 @@ export default Component.extend({
     this.set('controlGroupResponse', data);
   },
 
-  currentUserEntityId: alias('auth.authData.entity_id'),
+  currentUserEntityId: alias('auth.authData.entityId'),
 
   currentUserIsRequesting: computed('currentUserEntityId', 'model.requestEntity.id', function () {
     if (!this.model.requestEntity) return false;
diff --git a/ui/app/components/dashboard/client-count-card.hbs b/ui/app/components/dashboard/client-count-card.hbs
new file mode 100644
index 00000000000..9e74b1101e3
--- /dev/null
+++ b/ui/app/components/dashboard/client-count-card.hbs
@@ -0,0 +1,46 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Card::Container @hasBorder={{true}} class="has-padding-l" data-test-card="client-count">
+  <div class="is-flex-between">
+    <h2 class="title is-4 has-bottom-margin-xxs" data-test-client-count-title>
+      Client count
+    </h2>
+
+    <LinkTo @route="vault.cluster.clients">Details</LinkTo>
+  </div>
+
+  <hr class="has-background-gray-100" />
+
+  {{#if this.fetchClientActivity.isRunning}}
+    <VaultLogoSpinner />
+  {{else}}
+    {{#if this.activityData}}
+      <div class="is-grid grid-2-columns grid-gap-2 has-top-margin-m grid-align-items-start is-flex-v-centered">
+        <StatText @label="Total" @value={{this.activityData.total.clients}} @size="l" @subText={{this.statSubText.total}} />
+        <StatText @label="New" @value={{this.currentMonthActivityTotalCount}} @size="l" @subText={{this.statSubText.new}} />
+      </div>
+
+      <div class="has-top-margin-l is-flex-center">
+        <Hds::Button
+          @text="Refresh"
+          @isIconOnly={{true}}
+          @color="tertiary"
+          @icon="sync"
+          disabled={{this.fetchClientActivity.isRunning}}
+          class="has-padding-xxs"
+          {{on "click" (perform this.fetchClientActivity)}}
+          data-test-refresh
+        />
+        <small class="has-left-margin-xs has-text-grey" data-test-updated-timestamp>
+          Updated
+          {{date-format this.updatedAt "MMM d yyyy, h:mm:ss aaa" withTimeZone=true}}
+        </small>
+      </div>
+    {{else}}
+      <Clients::NoData @config={{this.activityConfig}} />
+    {{/if}}
+  {{/if}}
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/components/dashboard/client-count-card.js b/ui/app/components/dashboard/client-count-card.js
index 6df142b6eba..184d85de99b 100644
--- a/ui/app/components/dashboard/client-count-card.js
+++ b/ui/app/components/dashboard/client-count-card.js
@@ -1,46 +1,49 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
-import getStorage from 'vault/lib/token-storage';
 import timestamp from 'core/utils/timestamp';
 import { task } from 'ember-concurrency';
 import { waitFor } from '@ember/test-waiters';
 import { tracked } from '@glimmer/tracking';
 import { service } from '@ember/service';
+import { parseAPITimestamp } from 'core/utils/date-formatters';
 
 /**
  * @module DashboardClientCountCard
  * DashboardClientCountCard component are used to display total and new client count information
  *
  * @example
- * ```js
- * <Dashboard::ClientCountCard @license={{@model.license}}  />
- * ```
- *  @param {object} license - license object passed from the parent
+ * <Dashboard::ClientCountCard />
  */
 
 export default class DashboardClientCountCard extends Component {
   @service store;
 
   @tracked activityData = null;
-  @tracked clientConfig = null;
-  @tracked updatedAt = timestamp.now().toISOString();
+  @tracked activityConfig = null;
+  @tracked updatedAt = null;
 
   constructor() {
     super(...arguments);
     this.fetchClientActivity.perform();
-    this.clientConfig = this.store.queryRecord('clients/config', {}).catch(() => {});
   }
 
   get currentMonthActivityTotalCount() {
     return this.activityData?.byMonth?.lastObject?.new_clients.clients;
   }
 
-  get licenseStartTime() {
-    return this.args.license.startTime || getStorage().getItem('vault:ui-inputted-start-date') || null;
+  get statSubText() {
+    const format = (date) => parseAPITimestamp(date, 'MMM yyyy');
+    const { startTime, endTime } = this.activityData;
+    return startTime && endTime
+      ? {
+          total: `The number of clients in this billing period (${format(startTime)} - ${format(endTime)}).`,
+          new: 'The number of clients new to Vault in the current month.',
+        }
+      : { total: 'No total client data available.', new: 'No new client data available.' };
   }
 
   @task
@@ -48,15 +51,12 @@ export default class DashboardClientCountCard extends Component {
   *fetchClientActivity(e) {
     if (e) e.preventDefault();
     this.updatedAt = timestamp.now().toISOString();
-    // only make the network request if we have a start_time
-    if (!this.licenseStartTime) return {};
+
     try {
-      this.activityData = yield this.store.queryRecord('clients/activity', {
-        start_time: { timestamp: this.licenseStartTime },
-        end_time: { timestamp: this.updatedAt },
-      });
-      this.noActivityData = this.activityData.activity.id === 'no-data' ? true : false;
+      this.activityData = yield this.store.findRecord('clients/activity', 'clients/activity');
     } catch (error) {
+      // used for rendering the "No data" empty state, swallow any errors requesting config data
+      this.activityConfig = yield this.store.queryRecord('clients/config', {}).catch(() => null);
       this.error = error;
     }
   }
diff --git a/ui/app/templates/components/dashboard/learn-more-card.hbs b/ui/app/components/dashboard/learn-more-card.hbs
similarity index 88%
rename from ui/app/templates/components/dashboard/learn-more-card.hbs
rename to ui/app/components/dashboard/learn-more-card.hbs
index 61a88248ac2..ded80fcfa6d 100644
--- a/ui/app/templates/components/dashboard/learn-more-card.hbs
+++ b/ui/app/components/dashboard/learn-more-card.hbs
@@ -1,10 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container @hasBorder={{true}} class="has-padding-l" data-test-card="learn-more">
-  <h3 class="title is-4 has-bottom-margin-xxs" data-test-learn-more-title>Learn more</h3>
+  <h2 class="title is-4 has-bottom-margin-xxs" data-test-learn-more-title>Learn more</h2>
   <div class="sub-text" data-test-learn-more-subtext>
     Explore the features of Vault and learn advance practices with the following tutorials and documentation.
   </div>
diff --git a/ui/app/components/dashboard/learn-more-card.ts b/ui/app/components/dashboard/learn-more-card.ts
index ec4ece35e4a..27b7501d086 100644
--- a/ui/app/components/dashboard/learn-more-card.ts
+++ b/ui/app/components/dashboard/learn-more-card.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/dashboard/overview.hbs b/ui/app/components/dashboard/overview.hbs
new file mode 100644
index 00000000000..19ec359bc4a
--- /dev/null
+++ b/ui/app/components/dashboard/overview.hbs
@@ -0,0 +1,52 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Dashboard::VaultVersionTitle @version={{@version}} />
+
+<div class="has-bottom-margin-xl">
+  <div class="is-flex-row gap-24">
+    {{#if @version.isEnterprise}}
+      <div class="is-flex-column is-flex-1 gap-24">
+        {{#if (and (has-permission "clients" routeParams="activity") this.shouldShowClientCount)}}
+          <Dashboard::ClientCountCard />
+        {{/if}}
+        {{#if
+          (and (has-permission "status" routeParams="replication") (not (is-empty-value @replication)) @isRootNamespace)
+        }}
+          <Dashboard::ReplicationCard
+            @replication={{@replication}}
+            @version={{@version}}
+            @refresh={{@refreshModel}}
+            @updatedAt={{@replicationUpdatedAt}}
+          />
+        {{/if}}
+        <Dashboard::SecretsEnginesCard @secretsEngines={{@secretsEngines}} />
+      </div>
+
+      <div class="is-flex-column is-flex-1 gap-24">
+        <Dashboard::QuickActionsCard @secretsEngines={{@secretsEngines}} />
+        {{#if @vaultConfiguration}}
+          <Dashboard::VaultConfigurationDetailsCard @vaultConfiguration={{@vaultConfiguration}} />
+        {{/if}}
+        <div>
+          <Dashboard::LearnMoreCard @isEnterprise={{@version.isEnterprise}} />
+        </div>
+      </div>
+    {{else}}
+      <div class="is-flex-column is-flex-1 gap-24">
+        <Dashboard::SecretsEnginesCard @secretsEngines={{@secretsEngines}} />
+        <div>
+          <Dashboard::LearnMoreCard @isEnterprise={{@version.isEnterprise}} />
+        </div>
+      </div>
+      <div class="is-flex-column is-flex-1 gap-24">
+        <Dashboard::QuickActionsCard @secretsEngines={{@secretsEngines}} />
+        {{#if @vaultConfiguration}}
+          <Dashboard::VaultConfigurationDetailsCard @vaultConfiguration={{@vaultConfiguration}} />
+        {{/if}}
+      </div>
+    {{/if}}
+  </div>
+</div>
\ No newline at end of file
diff --git a/ui/app/components/dashboard/overview.ts b/ui/app/components/dashboard/overview.ts
new file mode 100644
index 00000000000..28eafed29af
--- /dev/null
+++ b/ui/app/components/dashboard/overview.ts
@@ -0,0 +1,44 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+
+import NamespaceService from 'vault/services/namespace';
+
+export type Args = {
+  isRootNamespace: boolean;
+  replication: unknown;
+  secretsEngines: unknown;
+  vaultConfiguration: unknown;
+  version: { isEnterprise: boolean };
+};
+
+export default class OverviewComponent extends Component<Args> {
+  @service declare readonly namespace: NamespaceService;
+
+  /**
+   * the client count card should show in the following conditions
+   * Self Managed clusters that are running enterprise and showing the `root` namespace
+   * Managed clusters that are running enterprise and show the `admin` namespace
+   */
+  // for self managed clusters, this is the `root` namespace
+  // for HVD clusters, this is the `admin` namespace
+  get shouldShowClientCount() {
+    const { version, isRootNamespace } = this.args;
+    const { namespace } = this;
+
+    // don't show client count if this isn't an enterprise cluster
+    if (!version.isEnterprise) return false;
+
+    // HVD clusters
+    if (namespace.inHvdAdminNamespace) return true;
+
+    // SM clusters
+    if (isRootNamespace) return true;
+
+    return false;
+  }
+}
diff --git a/ui/app/templates/components/dashboard/quick-actions-card.hbs b/ui/app/components/dashboard/quick-actions-card.hbs
similarity index 83%
rename from ui/app/templates/components/dashboard/quick-actions-card.hbs
rename to ui/app/components/dashboard/quick-actions-card.hbs
index d936a913c14..7f0b028fe8b 100644
--- a/ui/app/templates/components/dashboard/quick-actions-card.hbs
+++ b/ui/app/components/dashboard/quick-actions-card.hbs
@@ -1,17 +1,17 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container @hasBorder={{true}} class="has-padding-l" data-test-card="quick-actions">
-  <h3 class="title is-4">Quick actions</h3>
+  <h2 class="title is-4">Quick actions</h2>
   {{#if this.filteredSecretEngines}}
     <div class="has-top-margin-m has-bottom-margin-m">
-      <h4 class="title is-marginless is-6" data-test-card-subtitle="secrets-engines">Secrets engines</h4>
+      <h3 class="title is-marginless is-6" data-test-card-subtitle="secrets-engines">Secrets engines</h3>
       <p class="is-size-8 has-top-margin-xxs has-bottom-margin-s has-text-grey">Supported engines include databases, KV
         version 2, and PKI.</p>
       <SearchSelect
-        @id="secrets-engines-select"
+        @id="type-to-select-a-mount"
         @options={{this.mountOptions}}
         @selectLimit="1"
         @disallowNewItems={{true}}
@@ -28,7 +28,7 @@
     </div>
 
     {{#if this.selectedEngine}}
-      <h4 id="action-select-title" class="title is-6" data-test-card-subtitle="secrets-engines">Action</h4>
+      <h3 id="action-select-title" class="title is-6" data-test-card-subtitle="secrets-engines">Action</h3>
       <Select
         @name="action-select"
         @options={{this.actionOptions}}
@@ -39,20 +39,21 @@
         @ariaLabel="Action"
       />
 
-      {{#if this.searchSelectParams.model}}
+      {{#if this.selectedAction}}
         {{! use special input to allow searching for KVv2 secrets inside a directory }}
-        {{#if (eq this.selectedEngine.type "kv")}}
+        {{#if this.searchSelectParams.isKV}}
           <KvSuggestionInput
             @label="Secret Path"
             @value={{this.paramValue}}
             @mountPath={{this.selectedEngine.id}}
             @onChange={{fn (mut this.paramValue)}}
           />
-        {{else}}
-          <h4 class="title is-6" data-test-card-subtitle="param">{{this.searchSelectParams.title}}</h4>
+        {{else if this.searchSelectParams.model}}
+          <h3 class="title is-6" data-test-card-subtitle="param">{{this.searchSelectParams.title}}</h3>
 
           <SearchSelect
             class="is-flex-grow-1"
+            @ariaLabel={{this.searchSelectParams.title}}
             @selectLimit="1"
             @models={{array this.searchSelectParams.model}}
             @placeholder={{this.searchSelectParams.placeholder}}
@@ -96,7 +97,7 @@
         @icon="chevron-right"
         @iconPosition="trailing"
         @text="Enable a secrets engine"
-        @route="vault.cluster.settings.mount-secret-backend"
+        @route="vault.cluster.secrets.enable"
       />
     </EmptyState>
   {{/if}}
diff --git a/ui/app/components/dashboard/quick-actions-card.js b/ui/app/components/dashboard/quick-actions-card.js
index 6c2b8bca05d..f26062eca41 100644
--- a/ui/app/components/dashboard/quick-actions-card.js
+++ b/ui/app/components/dashboard/quick-actions-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -45,14 +45,9 @@ export default class DashboardQuickActionsCard extends Component {
     switch (this.selectedAction) {
       case 'Find KV secrets':
         return {
-          title: 'Secret path',
-          subText: 'Path of the secret you want to read.',
+          isKV: true,
           buttonText: 'Read secrets',
-          model: 'kv/metadata',
-          route: 'vault.cluster.secrets.backend.kv.secret.details',
-          nameKey: 'path',
-          queryObject: { pathToSecret: '', backend: this.selectedEngine.id },
-          objectKeys: ['path', 'id'],
+          route: 'vault.cluster.secrets.backend.kv.secret.index',
         };
       case 'Generate credentials for database':
         return {
@@ -149,7 +144,7 @@ export default class DashboardQuickActionsCard extends Component {
       const path = this.paramValue.path || this.paramValue;
       route = pathIsDirectory(path)
         ? 'vault.cluster.secrets.backend.kv.list-directory'
-        : 'vault.cluster.secrets.backend.kv.secret.details';
+        : 'vault.cluster.secrets.backend.kv.secret.index';
       param = path;
     }
 
diff --git a/ui/app/templates/components/dashboard/replication-card.hbs b/ui/app/components/dashboard/replication-card.hbs
similarity index 86%
rename from ui/app/templates/components/dashboard/replication-card.hbs
rename to ui/app/components/dashboard/replication-card.hbs
index 2aeaaa2444c..f5890d535db 100644
--- a/ui/app/templates/components/dashboard/replication-card.hbs
+++ b/ui/app/components/dashboard/replication-card.hbs
@@ -1,13 +1,13 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 <Hds::Card::Container @hasBorder={{true}} class="has-padding-l" data-test-card="replication">
 
   <div class="is-flex-between">
-    <h3 class="title is-4 has-bottom-margin-xxs" data-test-client-count-title>
-      Replication
-    </h3>
+    <h2 class="title is-4 has-bottom-margin-xxs" data-test-client-count-title>
+      Cluster replication status
+    </h2>
 
     {{#if (or @replication.dr.clusterId @replication.performance.clusterId)}}
       <LinkTo @route="vault.cluster.replication.index">
@@ -26,13 +26,16 @@
         data-test-type="dr-perf"
       >
         <Dashboard::ReplicationStateText
-          @title="DR primary"
+          @title="DR{{if (not-eq @replication.dr.mode 'disabled') (concat ' ' @replication.dr.mode)}}"
           @name="dr"
           @state={{@replication.dr.state}}
           @clusterStates={{cluster-states @replication.dr.state}}
         />
         <Dashboard::ReplicationStateText
-          @title="Performance {{if @replication.performance.isPrimary 'primary' 'secondary'}}"
+          @title="Performance{{if
+            (not-eq @replication.performance.mode 'disabled')
+            (concat ' ' @replication.performance.mode)
+          }}"
           @name="performance"
           @state={{if @replication.performance.clusterId @replication.performance.state "not set up"}}
           @clusterStates={{if @replication.performance.clusterId (cluster-states @replication.performance.state)}}
@@ -79,7 +82,7 @@
       />
       <small class="has-left-margin-xs has-text-grey">
         Updated
-        {{date-format @updatedAt "MMM dd, yyyy hh:mm:ss"}}
+        {{date-format @updatedAt "MMM d yyyy, h:mm:ss aaa" withTimeZone=true}}
       </small>
     </div>
   {{else}}
diff --git a/ui/app/components/dashboard/replication-state-text.hbs b/ui/app/components/dashboard/replication-state-text.hbs
new file mode 100644
index 00000000000..0cd954e334e
--- /dev/null
+++ b/ui/app/components/dashboard/replication-state-text.hbs
@@ -0,0 +1,36 @@
+{{!
+Copyright IBM Corp. 2016, 2025
+SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div ...attributes>
+  <h2 class="is-size-5 has-text-weight-semibold has-bottom-margin-xs" data-test-title={{@title}}>
+    {{@title}}
+  </h2>
+
+  {{#if @subText}}
+    <div class="title is-8 has-font-weight-normal has-text-grey-dark" data-test-subtext={{@title}}>
+      {{@subText}}
+    </div>
+  {{/if}}
+
+  <Hds::TooltipButton @text="The cluster's current operating state" aria-label="The cluster's current operating state">
+    <div class="is-flex-v-centered">
+      <Hds::Text::Display
+        class="title is-4 has-text-weight-semibold has-top-margin-xxs has-bottom-margin-xxs has-right-padding-sm"
+        data-test-replication-status-title={{@title}}
+      >
+        {{or @state "not set up"}}
+      </Hds::Text::Display>
+
+      {{#let (or @clusterStates.glyph "x-circle") as |icon|}}
+        <Hds::Icon
+          @isInline={{true}}
+          @name={{icon}}
+          class={{if @clusterStates.isOk "has-text-success" "has-text-danger"}}
+          data-test-replication-icon={{icon}}
+        />
+      {{/let}}
+    </div>
+  </Hds::TooltipButton>
+</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/dashboard/secrets-engines-card.hbs b/ui/app/components/dashboard/secrets-engines-card.hbs
similarity index 77%
rename from ui/app/templates/components/dashboard/secrets-engines-card.hbs
rename to ui/app/components/dashboard/secrets-engines-card.hbs
index 3eb7756da78..2ca10fc0779 100644
--- a/ui/app/templates/components/dashboard/secrets-engines-card.hbs
+++ b/ui/app/components/dashboard/secrets-engines-card.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container
   @hasBorder={{true}}
@@ -9,10 +9,10 @@
   data-test-card="secrets-engines"
 >
   <div class="is-flex-between">
-    <h3 class="title is-4 has-left-margin-xxs" data-test-dashboard-card-header="Secrets engines">Secrets engines</h3>
+    <h2 class="title is-4 has-left-margin-xxs" data-test-dashboard-card-header="Secrets engines">Secrets engines</h2>
 
     {{#if this.filteredSecretsEngines}}
-      <LinkTo class="has-right-margin-xxs" @route="vault.cluster.secrets.backends">
+      <LinkTo class="has-right-margin-4" @route="vault.cluster.secrets.backends">
         Details
       </LinkTo>
     {{/if}}
@@ -23,29 +23,24 @@
       <:body as |B|>
         {{#each this.firstFiveSecretsEngines as |backend|}}
           <B.Tr data-test-secrets-engines-row={{backend.id}}>
-            <B.Td class="is-flex-between is-flex-center has-gap-m">
+            <B.Td class="is-flex-between is-flex-center gap-16">
               <div>
-                <div class="is-flex-center">
+                <div class="is-grid align-items-center linked-block-title">
                   {{#if backend.icon}}
-                    <Icon
-                      @name={{backend.icon}}
-                      @title="{{or backend.engineType backend.path}} type backend"
-                      title={{or backend.engineType backend.path}}
-                      class={{unless backend.isSupportedBackend "has-text-grey"}}
-                    />
+                    <Hds::Icon @name={{backend.icon}} @title="{{or backend.engineType backend.path}} type backend" />
                   {{/if}}
                   {{#if backend.path}}
                     {{#if backend.isSupportedBackend}}
                       <LinkTo
                         @route={{backend.backendLink}}
                         @model={{backend.id}}
-                        class="has-text-black has-text-weight-semibold"
-                        data-test-secret-path
+                        class="has-text-black has-text-weight-semibold truncate-first-line"
+                        data-test-secret-path={{backend.path}}
                       >
                         {{backend.path}}
                       </LinkTo>
                     {{else}}
-                      <span class="has-text-grey" data-test-secret-path>{{backend.path}}</span>
+                      <span class="has-text-grey" data-test-secret-path={{backend.path}}>{{backend.path}}</span>
                     {{/if}}
                   {{/if}}
                 </div>
@@ -55,7 +50,7 @@
                   </code>
                 {{/if}}
                 {{#if backend.description}}
-                  <div data-test-description class="truncate-first-line">
+                  <div data-test-description class="truncate-first-line overflow-wrap word-break">
                     {{backend.description}}
                   </div>
                 {{/if}}
@@ -92,7 +87,7 @@
         @icon="chevron-right"
         @iconPosition="trailing"
         @text="Enable a secrets engine"
-        @route="vault.cluster.settings.mount-secret-backend"
+        @route="vault.cluster.secrets.enable"
       />
     </EmptyState>
   {{/if}}
diff --git a/ui/app/components/dashboard/secrets-engines-card.ts b/ui/app/components/dashboard/secrets-engines-card.ts
index a8cc282f793..ff675e16bfd 100644
--- a/ui/app/components/dashboard/secrets-engines-card.ts
+++ b/ui/app/components/dashboard/secrets-engines-card.ts
@@ -1,10 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
-import type SecretEngineModel from 'vault/models/secret-engine';
+
+import type SecretsEngineResource from 'vault/resources/secrets/engine';
 
 /**
  * @module DashboardSecretsEnginesCard
@@ -18,7 +19,7 @@ import type SecretEngineModel from 'vault/models/secret-engine';
  */
 
 interface Args {
-  secretsEngines: SecretEngineModel[];
+  secretsEngines: SecretsEngineResource[];
 }
 
 export default class DashboardSecretsEnginesCard extends Component<Args> {
diff --git a/ui/app/templates/components/dashboard/vault-configuration-details-card.hbs b/ui/app/components/dashboard/vault-configuration-details-card.hbs
similarity index 91%
rename from ui/app/templates/components/dashboard/vault-configuration-details-card.hbs
rename to ui/app/components/dashboard/vault-configuration-details-card.hbs
index e0a27c232ba..3d0a5d8cace 100644
--- a/ui/app/templates/components/dashboard/vault-configuration-details-card.hbs
+++ b/ui/app/components/dashboard/vault-configuration-details-card.hbs
@@ -1,10 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container @hasBorder={{true}} class="has-padding-l" data-test-card="configuration-details">
-  <h3 class="title is-4" data-test-dashboard-card-header="configuration">Configuration details</h3>
+  <h2 class="title is-4" data-test-dashboard-card-header="configuration">Configuration details</h2>
 
   <Hds::Table @caption="Vault configuration details" class="is-border-spacing-revert">
     <:body as |B|>
diff --git a/ui/app/components/dashboard/vault-configuration-details-card.js b/ui/app/components/dashboard/vault-configuration-details-card.js
index ac1db07905b..4514bc25840 100644
--- a/ui/app/components/dashboard/vault-configuration-details-card.js
+++ b/ui/app/components/dashboard/vault-configuration-details-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/dashboard/vault-version-title.hbs b/ui/app/components/dashboard/vault-version-title.hbs
similarity index 92%
rename from ui/app/templates/components/dashboard/vault-version-title.hbs
rename to ui/app/components/dashboard/vault-version-title.hbs
index 8509f23eb08..af6b1dc23c5 100644
--- a/ui/app/templates/components/dashboard/vault-version-title.hbs
+++ b/ui/app/components/dashboard/vault-version-title.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/components/dashboard/vault-version-title.js b/ui/app/components/dashboard/vault-version-title.js
index cffa5bedfda..8c38d98213d 100644
--- a/ui/app/components/dashboard/vault-version-title.js
+++ b/ui/app/components/dashboard/vault-version-title.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/database-connection.hbs b/ui/app/components/database-connection.hbs
similarity index 91%
rename from ui/app/templates/components/database-connection.hbs
rename to ui/app/components/database-connection.hbs
index 33fd8336343..9ba8a6ae889 100644
--- a/ui/app/templates/components/database-connection.hbs
+++ b/ui/app/components/database-connection.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -65,15 +65,22 @@
           <ToolbarSecretLink
             @secret=""
             @mode="create"
+            @backend={{@model.backend}}
             @type="add"
             @queryParams={{hash initialKey=@model.name itemType="role"}}
-            data-test-secret-create={{true}}
+            data-test-add-role
           >
             Add role
           </ToolbarSecretLink>
         {{/if}}
         {{#if @model.canEdit}}
-          <ToolbarSecretLink @secret={{@model.id}} @mode="edit" data-test-edit-link={{true}} @replace={{true}}>
+          <ToolbarSecretLink
+            @secret={{@model.id}}
+            @mode="edit"
+            @backend={{@model.backend}}
+            data-test-edit-link={{true}}
+            @replace={{true}}
+          >
             Edit configuration
           </ToolbarSecretLink>
         {{/if}}
@@ -95,7 +102,7 @@
     </Hds::Alert>
   {{/if}}
 
-  <form {{on "submit" this.handleCreateConnection}} aria-label="create connection form">
+  <form {{on "submit" (perform this.handleCreateConnection)}} aria-label="create connection form">
     {{#each @model.fieldAttrs as |attr|}}
       {{#if (not-eq attr.options.readOnly true)}}
         <FormField data-test-field={{true}} @attr={{attr}} @model={{@model}} />
@@ -133,7 +140,7 @@
                     @closedLabel={{group}}
                     @onClick={{fn (mut (get this prop))}}
                     class="is-block"
-                    data-test-toggle-group={{group}}
+                    data-test-button={{group}}
                   />
                   {{#if (get this prop)}}
                     <div class="box is-marginless">
@@ -170,7 +177,12 @@
     <div class="field is-grouped is-grouped-split is-fullwidth box is-bottomless">
       <div class="field is-grouped">
         <Hds::ButtonSet>
-          <Hds::Button @text="Create database" type="submit" data-test-secret-save />
+          <Hds::Button
+            @icon={{if this.handleCreateConnection.isRunning "loading"}}
+            @text="Create database"
+            type="submit"
+            data-test-submit
+          />
           <Hds::Button
             @text="Cancel"
             @color="secondary"
@@ -258,7 +270,7 @@
                   @closedLabel={{group}}
                   @onClick={{fn (mut (get this prop))}}
                   class="is-block"
-                  data-test-toggle-group={{group}}
+                  data-test-button={{group}}
                 />
                 {{#if (get this prop)}}
                   <div class="box is-marginless">
@@ -289,7 +301,7 @@
     <div class="field is-grouped is-grouped-split is-fullwidth box is-bottomless">
       <div class="field is-grouped">
         <Hds::ButtonSet>
-          <Hds::Button @text="Save" type="submit" data-test-secret-save />
+          <Hds::Button @text="Save" type="submit" data-test-submit />
           <Hds::Button
             @text="Cancel"
             @color="secondary"
@@ -336,12 +348,19 @@
           @queryParam="role"
           @type={{attr.type}}
         />
+      {{else if (eq attr.name "skip_static_role_rotation_import")}}
+        <InfoTableRow
+          @alwaysRender={{not (is-empty-value (get @model attr.name) hasDefault=defaultDisplay)}}
+          @defaultShown={{defaultDisplay}}
+          @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+          @value={{not (get @model attr.name)}}
+        />
       {{else}}
         <InfoTableRow
           @alwaysRender={{not (is-empty-value (get @model attr.name) hasDefault=defaultDisplay)}}
           @defaultShown={{defaultDisplay}}
           @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-          @value={{if (eq attr.name "connection_url") (decode-uri (get @model attr.name)) (get @model attr.name)}}
+          @value={{get @model attr.name}}
         />
       {{/if}}
     {{/let}}
@@ -363,7 +382,12 @@
     </M.Body>
     <M.Footer>
       <Hds::ButtonSet>
-        <Hds::Button @text="Rotate and enable" {{on "click" this.continueWithRotate}} data-test-enable-rotate-connection />
+        <Hds::Button
+          @icon={{if this.continueWithRotate.isRunning "loading"}}
+          @text="Rotate and enable"
+          {{on "click" (perform this.continueWithRotate)}}
+          data-test-enable-rotate-connection
+        />
         <Hds::Button
           @text="Enable without rotating"
           @color="secondary"
diff --git a/ui/app/components/database-connection.js b/ui/app/components/database-connection.js
index c1648e1f763..b75a88d29db 100644
--- a/ui/app/components/database-connection.js
+++ b/ui/app/components/database-connection.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,8 @@ import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { tracked } from '@glimmer/tracking';
 import { action } from '@ember/object';
+import { waitFor } from '@ember/test-waiters';
+import { task } from 'ember-concurrency';
 
 const LIST_ROOT_ROUTE = 'vault.cluster.secrets.backend.list-root';
 const SHOW_ROUTE = 'vault.cluster.secrets.backend.show';
@@ -55,42 +57,43 @@ export default class DatabaseConnectionEdit extends Component {
     this.args.model[attr] = value;
   }
 
-  @action
-  async handleCreateConnection(evt) {
-    evt.preventDefault();
-    const secret = this.args.model;
-    secret
-      .save()
-      .then(() => {
+  handleCreateConnection = task(
+    waitFor(async (evt) => {
+      evt.preventDefault();
+      try {
+        const secret = this.args.model;
+        await secret.save();
         this.showSaveModal = true;
-      })
-      .catch((e) => {
+      } catch (e) {
         const errorMessage = getErrorMessage(e.errors);
         this.flashMessages.danger(errorMessage);
-      });
-  }
+      }
+    })
+  );
 
   @action
   continueWithoutRotate() {
+    if (this.continueWithRotate.isRunning) return;
     this.showSaveModal = false;
     const { name } = this.args.model;
     this.transitionToRoute(SHOW_ROUTE, name);
   }
 
-  @action
-  continueWithRotate() {
-    this.showSaveModal = false;
-    const { backend, name } = this.args.model;
-    this.rotateCredentials(backend, name)
-      .then(() => {
+  continueWithRotate = task(
+    waitFor(async () => {
+      const { backend, name } = this.args.model;
+      try {
+        await this.rotateCredentials(backend, name);
         this.flashMessages.success(`Successfully rotated root credentials for connection "${name}"`);
         this.transitionToRoute(SHOW_ROUTE, name);
-      })
-      .catch((e) => {
+      } catch (e) {
         this.flashMessages.danger(`Error rotating root credentials: ${e.errors}`);
         this.transitionToRoute(SHOW_ROUTE, name);
-      });
-  }
+      } finally {
+        this.showSaveModal = false;
+      }
+    })
+  );
 
   @action
   handleUpdateConnection(evt) {
diff --git a/ui/app/components/database-role-edit.hbs b/ui/app/components/database-role-edit.hbs
new file mode 100644
index 00000000000..79368ff6b9c
--- /dev/null
+++ b/ui/app/components/database-role-edit.hbs
@@ -0,0 +1,216 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+<PageHeader as |p|>
+  <p.top>
+    <KeyValueHeader @path="vault.cluster.secrets.backend.show" @mode={{@mode}} @root={{@root}} @showCurrent={{true}} />
+  </p.top>
+  <p.levelLeft>
+    <h1 class="title is-3" data-test-secret-header="true">
+      {{#if (eq @mode "create")}}
+        Create Role
+      {{else if (eq @mode "edit")}}
+        Edit Role
+      {{else}}
+        {{@model.id}}
+      {{/if}}
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+{{#if (eq @mode "show")}}
+  <Toolbar>
+    <ToolbarActions>
+      {{#if @model.canDelete}}
+        <ConfirmAction
+          @buttonText="Delete role"
+          class="toolbar-button"
+          @buttonColor="secondary"
+          @onConfirmAction={{this.delete}}
+          @confirmTitle="Delete role?"
+          @confirmMessage="This role will be permanently deleted. You will need to recreate it to use it again."
+          data-test-database-role-delete
+        />
+        <div class="toolbar-separator"></div>
+      {{/if}}
+      {{#if (and @model.canRotateRoleCredentials (eq @model.type "static"))}}
+        <Hds::Button
+          @text="Rotate credentials"
+          @color="secondary"
+          class="toolbar-button"
+          {{on "click" (fn this.rotateRoleCred @model.id)}}
+        />
+      {{/if}}
+      {{#if
+        (or
+          (and (eq @model.type "static") @model.canGetCredentials)
+          (and (eq @model.type "dynamic") @model.canGenerateCredentials)
+        )
+      }}
+        <Hds::Button
+          @text={{if (eq @model.type "static") "Get credentials" "Generate credentials"}}
+          @color="secondary"
+          class="toolbar-button"
+          {{on "click" (fn this.generateCreds @model.id @model.type)}}
+          data-test-button={{@model.type}}
+        />
+      {{/if}}
+      {{#if @model.canEditRole}}
+        <ToolbarSecretLink
+          @secret={{concat "role/" @model.id}}
+          @mode="edit"
+          @backend={{@model.backend}}
+          @replace={{true}}
+          @queryParams={{hash itemType="role"}}
+          data-test-edit-link={{true}}
+        >
+          Edit role
+        </ToolbarSecretLink>
+      {{/if}}
+    </ToolbarActions>
+  </Toolbar>
+  {{#each @model.showFields as |attr|}}
+    {{#let attr.options.defaultShown as |defaultDisplay|}}
+      {{#if (eq attr.type "object")}}
+        <InfoTableRow
+          @alwaysRender={{true}}
+          @defaultShown={{defaultDisplay}}
+          @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+          @value={{stringify (get @model attr.name)}}
+        />
+      {{else if (eq attr.options.editType "ttl")}}
+        <InfoTableRow
+          @alwaysRender={{true}}
+          @defaultShown={{defaultDisplay}}
+          @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+          @value={{format-duration (get @model attr.name)}}
+          @isLink={{eq attr.name "database"}}
+        />
+      {{else if (eq attr.name "skip_import_rotation")}}
+        <InfoTableRow
+          @alwaysRender={{true}}
+          @defaultShown={{defaultDisplay}}
+          @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+          @value={{not (get @model attr.name)}}
+          @isLink={{eq attr.name "database"}}
+        />
+      {{else}}
+        <InfoTableRow
+          @alwaysRender={{true}}
+          @defaultShown={{defaultDisplay}}
+          @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+          @value={{get @model attr.name}}
+          @isLink={{eq attr.name "database"}}
+        />
+      {{/if}}
+    {{/let}}
+  {{/each}}
+{{else}}
+  {{! Edit or Create }}
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <form {{on "submit" this.handleCreateEditRole}}>
+      <MessageError @errorMessage={{this.errorMessage}} />
+      {{#each @model.fieldAttrs as |attr|}}
+        {{#if (eq @mode "edit")}}
+          <ReadonlyFormField @attr={{attr}} @value={{get @model attr.name}} />
+        {{else if (not-eq attr.options.readOnly true)}}
+          {{#if (eq attr.name "type")}}
+            {{#if @model.database}}
+              <FormField
+                data-test-field={{true}}
+                @attr={{attr}}
+                @model={{@model}}
+                @modelValidations={{this.modelValidations}}
+              />
+            {{/if}}
+          {{else}}
+            <FormField
+              data-test-field={{true}}
+              @attr={{attr}}
+              @model={{@model}}
+              @modelValidations={{this.modelValidations}}
+            />
+          {{/if}}
+          {{! TODO: If database && !updateDB show warning }}
+          {{#if (get this.warningMessages attr.name)}}
+            <Hds::Alert @type="inline" @color="warning" class="has-top-margin-negative-s has-bottom-margin-s" as |A|>
+              <A.Title>Warning</A.Title>
+              <A.Description>{{get this.warningMessages attr.name}}</A.Description>
+            </Hds::Alert>
+          {{/if}}
+        {{/if}}
+      {{/each}}
+      {{#if @model.database}}
+        <DatabaseRoleSettingForm
+          @attrs={{@model.roleSettingAttrs}}
+          @roleType={{@model.type}}
+          @model={{@model}}
+          @mode={{@mode}}
+          @dbParams={{await this.databaseParams}}
+          @modelValidations={{this.modelValidations}}
+        />
+      {{else}}
+        <EmptyState
+          @title="No database connection selected"
+          @message="Choose a connection to be able to configure a role type."
+        />
+      {{/if}}
+      <div class="field is-fullwidth box is-bottomless">
+        <Hds::ButtonSet>
+          <Hds::Button
+            @text={{if (eq @mode "create") "Create role" "Save"}}
+            @icon={{if this.handleCreateEditRole.isRunning "loading"}}
+            type="submit"
+            disabled={{this.handleCreateEditRole.isRunning}}
+            data-test-submit
+          />
+          <Hds::Button
+            @text="Cancel"
+            @color="secondary"
+            @route="vault.cluster.secrets.backend.list-root"
+            @model={{@model.backend}}
+            @query={{hash tab="role"}}
+            data-test-cancel
+          />
+        </Hds::ButtonSet>
+        {{#if this.invalidFormAlert}}
+          <AlertInline
+            data-test-invalid-form-alert
+            class="has-top-padding-s"
+            @type="danger"
+            @message={{this.invalidFormAlert}}
+          />
+        {{/if}}
+        {{#if (not (is-empty-value this.warningMessages))}}
+          <Hds::Alert @type="compact" @color="warning" class="has-left-margin-s" as |A|>
+            <A.Title>Warning</A.Title>
+            <A.Description>
+              You don't have permissions required to
+              {{if (eq @mode "create") "create" "update"}}
+              this role. See form for details.
+            </A.Description>
+          </Hds::Alert>
+        {{/if}}
+      </div>
+    </form>
+  </div>
+{{/if}}
+
+{{#if this.saveIssuerWarning}}
+  <Hds::Modal @color="warning" @onClose={{fn (mut this.saveIssuerWarning) ""}} data-test-issuer-warning as |M|>
+    <M.Header @icon="alert-circle">
+      Are you sure?
+    </M.Header>
+    <M.Body>
+      <p data-test-issuer-warning-message>
+        {{this.saveIssuerWarning}}
+      </p>
+    </M.Body>
+    <M.Footer as |F|>
+      <Hds::ButtonSet>
+        <Hds::Button @text="Continue" {{on "click" this.continueSubmitForm}} data-test-issuer-save />
+        <Hds::Button @text="Cancel" @color="secondary" {{on "click" F.close}} data-test-issuer-cancel />
+      </Hds::ButtonSet>
+    </M.Footer>
+  </Hds::Modal>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/database-role-edit.js b/ui/app/components/database-role-edit.js
index 36ace844ec2..c87fa4a8cb8 100644
--- a/ui/app/components/database-role-edit.js
+++ b/ui/app/components/database-role-edit.js
@@ -1,20 +1,41 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
-
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
+import { waitFor } from '@ember/test-waiters';
+import { task } from 'ember-concurrency';
+import errorMessage from 'vault/utils/error-message';
 
+/**
+ * @module DatabaseRoleEdit component is used to configure a database role.
+ * See secret-edit-layout which uses options for backend to determine which component to render.
+ * @example
+ * <DatabaseRoleEdit
+    @model={{this.model.database.role}}
+    @tab="edit"
+    @model="edit"
+    @initialKey=this.initialKey
+    />
+ *
+ * @param {object} model - The database role model.
+ * @param {string} tab - The tab to render.
+ * @param {string} mode - The mode to render. Either 'create' or 'edit'.
+ * @param {string} [initialKey] - The initial key to set for the database role.
+ */
 const LIST_ROOT_ROUTE = 'vault.cluster.secrets.backend.list-root';
 const SHOW_ROUTE = 'vault.cluster.secrets.backend.show';
-
 export default class DatabaseRoleEdit extends Component {
   @service router;
   @service flashMessages;
   @service store;
+  @tracked modelValidations;
+  @tracked invalidFormAlert;
+  @tracked errorMessage = '';
+  @tracked saveIssuerWarning = '';
 
   constructor() {
     super(...arguments);
@@ -23,20 +44,32 @@ export default class DatabaseRoleEdit extends Component {
     }
   }
 
-  @tracked loading = false;
+  isValid() {
+    const { isValid, state } = this.args.model.validate();
+    this.modelValidations = isValid ? null : state;
+    this.invalidFormAlert = isValid ? '' : 'There was an error submitting this form.';
+    return isValid;
+  }
+
+  resetErrors() {
+    this.flashMessages.clearMessages();
+    this.errorMessage = this.invalidFormAlert = '';
+    this.modelValidations = null;
+  }
 
   get warningMessages() {
     const warnings = {};
+    const { canCreateDynamic, canCreateStatic, type } = this.args.model;
     if (
-      (this.args.model.type === 'dynamic' && this.args.model.canCreateDynamic === false) ||
-      (this.args.model.type === 'static' && this.args.model.canCreateStatic === false)
+      (type === 'dynamic' && canCreateDynamic === false) ||
+      (type === 'static' && canCreateStatic === false)
     ) {
       warnings.type = `You don't have permissions to create this type of role.`;
     }
     return warnings;
   }
 
-  get databaseType() {
+  get databaseParams() {
     const backend = this.args.model?.backend;
     const dbs = this.args.model?.database || [];
     if (!backend || dbs.length === 0) {
@@ -44,10 +77,18 @@ export default class DatabaseRoleEdit extends Component {
     }
     return this.store
       .queryRecord('database/connection', { id: dbs[0], backend })
-      .then((record) => record.plugin_name)
+      .then(({ plugin_name, skip_static_role_rotation_import }) => ({
+        plugin_name,
+        skip_static_role_rotation_import,
+      }))
       .catch(() => null);
   }
 
+  @action continueSubmitForm() {
+    this.saveIssuerWarning = '';
+    this.saveRole.perform();
+  }
+
   @action
   generateCreds(roleId, roleType = '') {
     this.router.transitionTo('vault.cluster.secrets.backend.credentials', roleId, {
@@ -74,35 +115,42 @@ export default class DatabaseRoleEdit extends Component {
   }
 
   @action
-  handleCreateEditRole(evt) {
+  async handleCreateEditRole(evt) {
     evt.preventDefault();
-    this.loading = true;
+    this.resetErrors();
+    const { mode, model } = this.args;
+    if (!this.isValid()) return;
 
-    const mode = this.args.mode;
-    const roleSecret = this.args.model;
-    const secretId = roleSecret.name;
-    if (mode === 'create') {
-      roleSecret.set('id', secretId);
-      const path = roleSecret.type === 'static' ? 'static-roles' : 'roles';
-      roleSecret.set('path', path);
+    // if we're creating and rotating a static role immediately, warn user
+    if (!model.skip_import_rotation && model.type === 'static' && mode === 'create') {
+      this.saveIssuerWarning =
+        "You have enabled 'Rotate immediately' for this static role. Vault will update the password immediately after you save. NOTE: This will disrupt any active use of this role outside of Vault.";
+      return;
     }
-    return roleSecret
-      .save()
-      .then(() => {
-        try {
-          this.router.transitionTo(SHOW_ROUTE, `role/${secretId}`);
-        } catch (e) {
-          console.debug(e); // eslint-disable-line
-        }
-      })
-      .catch((e) => {
-        const errorMessage = e.errors?.join('. ') || e.message;
+    await this.saveRole.perform();
+  }
+
+  saveRole = task(
+    waitFor(async () => {
+      const { mode, model } = this.args;
+
+      if (mode === 'create') {
+        model.id = model.name;
+        const path = model.type === 'static' ? 'static-roles' : 'roles';
+        model.path = path;
+      }
+      try {
+        await model.save();
+        this.router.transitionTo(SHOW_ROUTE, `role/${model.name}`);
+      } catch (e) {
+        this.errorMessage = errorMessage(e);
         this.flashMessages.danger(
-          errorMessage || 'Could not save the role. Please check Vault logs for more information.'
+          this.errorMessage || 'Could not save the role. Please check Vault logs for more information.'
         );
-        this.loading = false;
-      });
-  }
+      }
+    })
+  );
+
   @action
   rotateRoleCred(id) {
     const backend = this.args.model?.backend;
diff --git a/ui/app/components/database-role-setting-form.hbs b/ui/app/components/database-role-setting-form.hbs
new file mode 100644
index 00000000000..da674ca69ef
--- /dev/null
+++ b/ui/app/components/database-role-setting-form.hbs
@@ -0,0 +1,60 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="box is-sideless is-fullwidth is-marginless" data-test-role-settings-section>
+  <h3 class="title is-5">Role settings</h3>
+  {{#if this.settingFields}}
+    <div class="form-section">
+      {{#each this.settingFields as |attr|}}
+        {{#if (and (eq @mode "edit") (includes attr.name (array "skip_import_rotation" "username")))}}
+          {{#if (eq attr.name "skip_import_rotation")}}
+            <ReadonlyFormField @attr={{attr}} @value={{not (get @model attr.name)}} />
+          {{else}}
+            <ReadonlyFormField @attr={{attr}} @value={{get @model attr.name}} />
+          {{/if}}
+        {{else if (and (eq @mode "edit") (eq attr.name "password"))}}
+          <EnableInput
+            data-test-enable-field={{attr.name}}
+            class="field"
+            @attr={{attr}}
+            {{! password field is disabled on edit once password has been rotated }}
+            @disabled={{(not (eq (get @model "last_vault_rotation") undefined))}}
+          >
+            <FormField @attr={{attr}} @model={{@model}} />
+          </EnableInput>
+        {{else}}
+          <FormField data-test-field={{true}} @attr={{attr}} @model={{@model}} @modelValidations={{@modelValidations}} />
+          {{#if (and (eq attr.name "skip_import_rotation") this.isOverridden)}}
+            <Hds::Alert @type="inline" @color="warning" class="has-top-margin-negative-s" as |A|>
+              <A.Title>Warning</A.Title>
+              <A.Description>This will override the connection default for this role.</A.Description>
+            </Hds::Alert>
+          {{/if}}
+        {{/if}}
+
+      {{/each}}
+    </div>
+  {{else}}
+    <EmptyState @title="No role type selected" @message="Select a type of role to be able to configure it" />
+  {{/if}}
+</div>
+{{! template-lint-configure simple-unless "warn"  }}
+{{#unless (and @roleType (not this.statementFields))}}
+  <div class="box is-sideless is-fullwidth is-marginless" data-test-statements-section>
+    <h3 class="title is-5">Statements</h3>
+    {{#if this.statementFields}}
+      <div class="form-section">
+        {{#each this.statementFields as |attr|}}
+          <FormField data-test-field={{true}} @attr={{attr}} @model={{@model}} />
+        {{/each}}
+      </div>
+    {{else}}
+      <EmptyState
+        @title="No role type selected"
+        @message="Select a type of role to be able to add statements for creation, revocation, and/or rotation."
+      />
+    {{/if}}
+  </div>
+{{/unless}}
\ No newline at end of file
diff --git a/ui/app/components/database-role-setting-form.js b/ui/app/components/database-role-setting-form.js
index de49188ff45..f7816d48fc3 100644
--- a/ui/app/components/database-role-setting-form.js
+++ b/ui/app/components/database-role-setting-form.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
-import { getStatementFields, getRoleFields } from '../utils/database-helpers';
+import { getStatementFields, getRoleFields } from '../utils/model-helpers/database-helpers';
 
 /**
  * @module DatabaseRoleSettingForm
@@ -18,25 +18,41 @@ import { getStatementFields, getRoleFields } from '../utils/database-helpers';
  * @param {object} model - ember data model which should be updated on change
  * @param {string} [roleType] - role type controls which attributes are shown
  * @param {string} [mode=create] - mode of the form (eg. create or edit)
- * @param {string} [dbType=default] - type of database, eg 'mongodb-database-plugin'
+ * @param {object} dbParams - holds database config values, { plugin_name: string [eg 'mongodb-database-plugin'], skip_static_role_rotation_import: boolean }
  */
 
 export default class DatabaseRoleSettingForm extends Component {
+  get dbConfig() {
+    return this.args.dbParams;
+  }
+
   get settingFields() {
+    const dbValues = this.args.dbParams;
     if (!this.args.roleType) return null;
     const dbValidFields = getRoleFields(this.args.roleType);
     return this.args.attrs.filter((a) => {
+      // Sets default value for skip_import_rotation based on parent db config value
+      if (a.name === 'skip_import_rotation' && this.args.mode === 'create') {
+        a.options.defaultValue = dbValues?.skip_static_role_rotation_import;
+      }
       return dbValidFields.includes(a.name);
     });
   }
 
   get statementFields() {
     const type = this.args.roleType;
-    const plugin = this.args.dbType;
     if (!type) return null;
-    const dbValidFields = getStatementFields(type, plugin);
+    const dbValidFields = getStatementFields(type, this.dbConfig ? this.dbConfig.plugin_name : null);
     return this.args.attrs.filter((a) => {
       return dbValidFields.includes(a.name);
     });
   }
+
+  get isOverridden() {
+    if (this.args.mode !== 'create' || !this.dbConfig) return null;
+
+    const dbSkip = this.dbConfig.skip_static_role_rotation_import;
+    const staticVal = this.args.model.get('skip_import_rotation');
+    return this.args.mode === 'create' && dbSkip !== staticVal;
+  }
 }
diff --git a/ui/app/components/date-dropdown.js b/ui/app/components/date-dropdown.js
deleted file mode 100644
index 7fee2b45510..00000000000
--- a/ui/app/components/date-dropdown.js
+++ /dev/null
@@ -1,78 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-import { tracked } from '@glimmer/tracking';
-import { ARRAY_OF_MONTHS } from 'core/utils/date-formatters';
-import timestamp from 'core/utils/timestamp';
-/**
- * @module DateDropdown
- * DateDropdown components are used to display a dropdown of months and years to handle date selection. Future dates are disabled (current month and year are selectable).
- * The component returns an object with selected date info, example: { dateType: 'start', monthIdx: 0, monthName: 'January', year: 2022 }
- *
- * @example
- * ```js
- * <DateDropdown @handleSubmit={{this.actionFromParent}} @name="startTime" @submitText="Save" />
- * ```
- * @param {function} handleSubmit - callback function from parent that the date picker triggers on submit
- * @param {string} [dateType] - optional argument to give the selected month/year a type
- * @param {string} [submitText] - optional argument to change submit button text
- * @param {function} [validateDate] - parent function to validate date selection, receives date object and returns an error message that's passed to the inline alert
- */
-export default class DateDropdown extends Component {
-  currentDate = timestamp.now();
-  currentYear = this.currentDate.getFullYear(); // integer of year
-  currentMonthIdx = this.currentDate.getMonth(); // integer of month, 0 indexed
-  dropdownMonths = ARRAY_OF_MONTHS.map((m, i) => ({ name: m, index: i }));
-  dropdownYears = Array.from({ length: 5 }, (item, i) => this.currentYear - i);
-
-  @tracked maxMonthIdx = 11; // disables months with index greater than this number, initially all months are selectable
-  @tracked disabledYear = null; // year as integer if current year should be disabled
-  @tracked selectedMonth = null;
-  @tracked selectedYear = null;
-  @tracked invalidDate = null;
-
-  @action
-  selectMonth(month, dropdown) {
-    this.selectedMonth = month;
-    // disable current year if selected month is later than current month
-    this.disabledYear = month.index > this.currentMonthIdx ? this.currentYear : null;
-    dropdown.close();
-  }
-
-  @action
-  selectYear(year, dropdown) {
-    this.selectedYear = year;
-    // disable months after current month if selected year is current year
-    this.maxMonthIdx = year === this.currentYear ? this.currentMonthIdx : 11;
-    dropdown.close();
-  }
-
-  @action
-  handleSubmit() {
-    if (this.args.validateDate) {
-      this.invalidDate = null;
-      this.invalidDate = this.args.validateDate(new Date(this.selectedYear, this.selectedMonth.index));
-      if (this.invalidDate) return;
-    }
-    const { index, name } = this.selectedMonth;
-    this.args.handleSubmit({
-      monthIdx: index,
-      monthName: name,
-      year: this.selectedYear,
-      dateType: this.args.dateType,
-    });
-    this.resetDropdown();
-  }
-
-  resetDropdown() {
-    this.maxMonthIdx = 11;
-    this.disabledYear = null;
-    this.selectedMonth = null;
-    this.selectedYear = null;
-    this.invalidDate = null;
-  }
-}
diff --git a/ui/app/components/disabled-plugin-card.hbs b/ui/app/components/disabled-plugin-card.hbs
new file mode 100644
index 00000000000..4cb5fa17b4e
--- /dev/null
+++ b/ui/app/components/disabled-plugin-card.hbs
@@ -0,0 +1,23 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Card::Container
+  class="selectable-engine-card has-top-padding-l has-bottom-padding-s has-side-padding-8 has-text-centered small-card overflow-wrap"
+  @level="base"
+  @background="neutral-secondary"
+  @hasBorder={{false}}
+  @ariaLabel="{{@type.displayName}} - disabled engine type"
+  tabindex="0"
+  {{on "click" (fn @handleDisabledPluginClick @type)}}
+  {{on "keydown" (fn @handleDisabledPluginKeyDown @type)}}
+  data-test-card-container={{@type.type}}
+>
+  {{#if @type.glyph}}
+    <Icon @name={{@type.glyph}} @size="24" class="has-bottom-margin-xs disabled-icon" />
+  {{/if}}
+  <Hds::Text::Body @tag="h3" @size="300">
+    {{@type.displayName}}
+  </Hds::Text::Body>
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/components/enabled-plugin-card.hbs b/ui/app/components/enabled-plugin-card.hbs
new file mode 100644
index 00000000000..1195f71798e
--- /dev/null
+++ b/ui/app/components/enabled-plugin-card.hbs
@@ -0,0 +1,33 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#let this.isDisabled as |isDisabled|}}
+  <Hds::Card::Container
+    class="selectable-engine-card
+      {{if isDisabled 'disabled'}}
+      has-top-padding-l has-bottom-padding-s has-side-padding-8 has-text-centered small-card overflow-wrap"
+    @level={{if isDisabled "base" "mid"}}
+    @background={{if isDisabled "neutral-secondary" "neutral-primary"}}
+    @hasBorder={{true}}
+    @ariaLabel="{{@type.displayName}} - {{if isDisabled 'disabled' 'enabled'}} engine type"
+    tabindex="0"
+    {{on "click" this.handleSelection}}
+    {{on "keydown" this.handleKeyDown}}
+    data-test-card-container={{@type.type}}
+  >
+    {{#if @type.glyph}}
+      <Icon @name={{@type.glyph}} @size="24" class="has-bottom-margin-xs" />
+    {{/if}}
+    <Hds::Text::Body @tag="h3" @size="300">
+      {{@type.displayName}}
+    </Hds::Text::Body>
+    {{#if this.showDeprecationBadge}}
+      <Hds::Badge @text={{capitalize @type.deprecationStatus}} @size="small" />
+    {{/if}}
+    {{#if this.showEnterpriseBadge}}
+      <Hds::Badge @text="Enterprise" @size="small" />
+    {{/if}}
+  </Hds::Card::Container>
+{{/let}}
\ No newline at end of file
diff --git a/ui/app/components/enabled-plugin-card.js b/ui/app/components/enabled-plugin-card.js
new file mode 100644
index 00000000000..412466cb2aa
--- /dev/null
+++ b/ui/app/components/enabled-plugin-card.js
@@ -0,0 +1,66 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import keys from 'core/utils/keys';
+
+/**
+ * @module EnabledPluginCard
+ * EnabledPluginCard components are used to display available secret and auth engines in the mount backend type form
+ *
+ * @example
+ * ```js
+ * <EnabledPluginCard @type={{type}} @setMountType={{@setMountType}} />
+ * ```
+ * @param {Object} type - The engine metadata object with properties like displayName, requiresEnterprise, requiredFeature, etc.
+ * @param {Function} setMountType - Function to call when the card is clicked to select this mount type
+ */
+
+export default class EnabledPluginCard extends Component {
+  @service version;
+
+  get isDisabled() {
+    const { type } = this.args;
+    return (
+      (type.requiresEnterprise && !this.version.isEnterprise) ||
+      (type.requiredFeature && !this.hasFeature(type.requiredFeature))
+    );
+  }
+
+  get showEnterpriseBadge() {
+    const { type } = this.args;
+    return (
+      (type.requiresEnterprise && !this.version.isEnterprise) ||
+      (type.requiredFeature && !this.hasFeature(type.requiredFeature))
+    );
+  }
+
+  get showDeprecationBadge() {
+    const { type } = this.args;
+    return type.deprecationStatus && type.deprecationStatus !== 'supported';
+  }
+
+  hasFeature(featureName) {
+    return this.version.features?.includes(featureName) || false;
+  }
+
+  @action
+  handleSelection() {
+    if (!this.isDisabled) {
+      this.args.setMountType(this.args.type.type);
+    }
+  }
+
+  @action
+  handleKeyDown(event) {
+    // Only handle Enter and Space keys for accessibility
+    if (event.key === keys.ENTER || event.key === keys.SPACE) {
+      event.preventDefault();
+      this.handleSelection();
+    }
+  }
+}
diff --git a/ui/app/components/file-to-array-buffer.hbs b/ui/app/components/file-to-array-buffer.hbs
new file mode 100644
index 00000000000..77a3969f2bd
--- /dev/null
+++ b/ui/app/components/file-to-array-buffer.hbs
@@ -0,0 +1,25 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+<div class="box is-fullwidth is-marginless is-shadowless">
+  <Hds::Form::FileInput::Field {{on "change" this.pickedFile}} data-test-file-input as |F|>
+    <F.Label>{{@label}}</F.Label>
+    {{#if @fileHelpText}}
+      <F.HelperText>
+        {{@fileHelpText}}
+      </F.HelperText>
+    {{/if}}
+    {{#if @error}}
+      <F.Error data-test-validation-error="file">{{@error}}</F.Error>
+    {{/if}}
+  </Hds::Form::FileInput::Field>
+  {{#if this.filename}}
+    <p class="help has-text-grey">
+      This file is
+      {{this.fileSize}}
+      and was created on
+      {{date-format this.fileLastModified "MMM dd, yyyy hh:mm:ss a"}}.
+    </p>
+  {{/if}}
+</div>
\ No newline at end of file
diff --git a/ui/app/components/file-to-array-buffer.js b/ui/app/components/file-to-array-buffer.js
index 5b6e0728e49..490ce6b2c28 100644
--- a/ui/app/components/file-to-array-buffer.js
+++ b/ui/app/components/file-to-array-buffer.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,9 +15,10 @@ import filesize from 'filesize';
  *
  * @example
  * ```js
- *   <FileToArrayBuffer @onChange={{action (mut file)}} />
+ *   <FileToArrayBuffer @onChange={{fn (mut file)}} />
  * ```
  * @param {function} onChange - The function to call when the file read is complete. Receives the file as a JS ArrayBuffer
+ * @param {string} [error] - Text to use as the error message for the file input
  * @param {string} [label] - Text to use as the label for the file input
  * @param {string} [fileHelpText] - Text to use as help under the file input
  *
diff --git a/ui/app/components/flash-message.js b/ui/app/components/flash-message.js
index c5b45545bef..2f023aaa1e5 100644
--- a/ui/app/components/flash-message.js
+++ b/ui/app/components/flash-message.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/flash-toast.hbs b/ui/app/components/flash-toast.hbs
index a25c338e9d5..bf0d31d9c16 100644
--- a/ui/app/components/flash-toast.hbs
+++ b/ui/app/components/flash-toast.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Toast @color={{this.color}} @onDismiss={{@close}} class="has-bottom-margin-m" data-test-flash-toast as |T|>
   <T.Title data-test-flash-toast-title>{{this.title}}</T.Title>
diff --git a/ui/app/components/flash-toast.js b/ui/app/components/flash-toast.js
index fd971694ce3..c7686966ef5 100644
--- a/ui/app/components/flash-toast.js
+++ b/ui/app/components/flash-toast.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -26,7 +26,7 @@ export default class FlashToastComponent extends Component {
   }
 
   get title() {
-    if (this.args.title) return this.args.title;
+    if (this.args.flash.title) return this.args.flash.title;
     switch (this.args.flash.type) {
       case 'danger':
         return 'Error';
diff --git a/ui/app/templates/components/form-field-from-model.hbs b/ui/app/components/form-field-from-model.hbs
similarity index 87%
rename from ui/app/templates/components/form-field-from-model.hbs
rename to ui/app/components/form-field-from-model.hbs
index 0701210e7c2..19e7d1148a2 100644
--- a/ui/app/templates/components/form-field-from-model.hbs
+++ b/ui/app/components/form-field-from-model.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! template-lint-configure simple-unless "warn"  }}
 <div class="field" data-test-form-field-from-model>
@@ -17,7 +17,9 @@
       <label for={{@attr.name}} class="is-label">
         {{capitalize (or @attr.options.label (humanize (dasherize @attr.name)))}}
         {{#if @attr.options.helpText}}
-          <InfoTooltip>{{@attr.options.helpText}}</InfoTooltip>
+          <Hds::TooltipButton @text={{@attr.options.helpText}} aria-label="More information">
+            <Hds::Icon @name="info" />
+          </Hds::TooltipButton>
         {{/if}}
       </label>
     {{/unless}}
@@ -71,7 +73,9 @@
       <label for={{@attr.name}} class="is-label">
         {{capitalize (or @attr.options.label (humanize (dasherize @attr.name)))}}
         {{#if @attr.options.helpText}}
-          <InfoTooltip>{{@attr.options.helpText}}</InfoTooltip>
+          <Hds::TooltipButton @text={{@attr.options.helpText}} aria-label="More information">
+            <Hds::Icon @name="info" />
+          </Hds::TooltipButton>
         {{/if}}
       </label>
     </div>
@@ -80,7 +84,7 @@
       @title={{capitalize (or @attr.options.label (humanize (dasherize @attr.name)))}}
       @helpText={{@attr.options.helpText}}
       @value={{if (get @model @attr.name) (stringify (get @model @attr.name)) @emptyData}}
-      @valueUpdated={{@codemirrorUpdated}}
+      @valueUpdated={{@editorUpdated}}
     />
   {{/if}}
 </div>
\ No newline at end of file
diff --git a/ui/app/templates/components/generate-credentials-database.hbs b/ui/app/components/generate-credentials-database.hbs
similarity index 95%
rename from ui/app/templates/components/generate-credentials-database.hbs
rename to ui/app/components/generate-credentials-database.hbs
index 14c5b84dbc1..dbd941909ac 100644
--- a/ui/app/templates/components/generate-credentials-database.hbs
+++ b/ui/app/components/generate-credentials-database.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -64,7 +64,7 @@
       @label="Last Vault rotation"
       @value={{date-format @model.lastVaultRotation "MMMM d yyyy, h:mm:ss a"}}
       @tooltipText={{@model.lastVaultRotation}}
-      @isTooltipCopyable={{true}}
+      @addCopyButton={{true}}
     />
     <InfoTableRow @label="Password" @value={{@model.password}}>
       <MaskedInput @value={{@model.password}} @name="Password" @displayOnly={{true}} @allowCopy={{true}} />
@@ -75,5 +75,5 @@
   {{/if}}
 </div>
 <div class="has-top-bottom-margin">
-  <Hds::Button @text="Back" {{on "click" (action "redirectPreviousPage")}} data-test-secret-generate-back="true" />
+  <Hds::Button @text="Back" {{on "click" (action "redirectPreviousPage")}} />
 </div>
\ No newline at end of file
diff --git a/ui/app/components/generate-credentials-database.js b/ui/app/components/generate-credentials-database.js
index ccb2e241368..420253d6a5a 100644
--- a/ui/app/components/generate-credentials-database.js
+++ b/ui/app/components/generate-credentials-database.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/generate-credentials-totp.hbs b/ui/app/components/generate-credentials-totp.hbs
new file mode 100644
index 00000000000..7853338bc10
--- /dev/null
+++ b/ui/app/components/generate-credentials-totp.hbs
@@ -0,0 +1,39 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.top>
+    <Hds::Breadcrumb>
+      <Hds::Breadcrumb::Item
+        @text={{@backendPath}}
+        @route="vault.cluster.secrets.backend"
+        @model={{@backendPath}}
+        data-test-link="role-list"
+      />
+      <Hds::Breadcrumb::Item @text={{@keyName}} @route="vault.cluster.secrets.backend.show" @model={{@keyName}} />
+      <Hds::Breadcrumb::Item @text={{this.title}} @current={{true}} />
+    </Hds::Breadcrumb>
+  </p.top>
+  <p.levelLeft>
+    <h1 data-test-title class="title is-3">
+      {{this.title}}
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+<div class="box is-fullwidth is-sideless is-paddingless is-marginless">
+  <InfoTableRow @label="Code">
+    <MaskedInput @name="code" @value={{this.totpCode}} @displayOnly={{true}} @allowCopy={{true}} />
+    <label class="has-left-padding-s">
+      <div>Valid for {{this.remainingTime}} seconds</div>
+      <progress id="code-validity" value={{this.remainingTime}} max={{@totpCodePeriod}} />
+    </label>
+  </InfoTableRow>
+</div>
+<div class="field is-grouped box is-fullwidth is-bottomless">
+  <div class="control">
+    <Hds::Button @text="Back" @color="secondary" {{on "click" this.redirectPreviousPage}} />
+  </div>
+</div>
\ No newline at end of file
diff --git a/ui/app/components/generate-credentials-totp.js b/ui/app/components/generate-credentials-totp.js
new file mode 100644
index 00000000000..137408a3e3b
--- /dev/null
+++ b/ui/app/components/generate-credentials-totp.js
@@ -0,0 +1,68 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { task, timeout } from 'ember-concurrency';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+
+const SHOW_ROUTE = 'vault.cluster.secrets.backend.show';
+
+export default class GenerateCredentialsTotp extends Component {
+  @tracked elapsedTime = 0;
+  @tracked totpCode = null;
+  @service store;
+  @service router;
+
+  title = 'Generate TOTP code';
+
+  constructor() {
+    super(...arguments);
+    this.startTimer.perform();
+  }
+
+  get remainingTime() {
+    const { totpCodePeriod } = this.args;
+
+    return totpCodePeriod - this.elapsedTime;
+  }
+
+  @task({ restartable: true })
+  *startTimer() {
+    const { backendPath, keyName, totpCodePeriod } = this.args;
+    this.generateTotpCode(backendPath, keyName);
+    while (this.elapsedTime <= totpCodePeriod) {
+      yield timeout(1000);
+      this.elapsedTime += 1;
+    }
+
+    if (this.elapsedTime > totpCodePeriod) {
+      this.elapsedTime = 0;
+      this.generateTotpCode(backendPath, keyName);
+      this.startTimer.perform();
+    }
+  }
+
+  async generateTotpCode(backend, keyName) {
+    // refreshing will generate a new code if the period has expired.
+    try {
+      const totpCode = await this.store.adapterFor('totp-key').generateCode(backend, keyName);
+      this.totpCode = totpCode.code;
+    } catch (e) {
+      // swallow error, non-essential data
+      return;
+    }
+  }
+
+  @action redirectPreviousPage() {
+    const { backRoute, keyName } = this.args;
+    if (backRoute === SHOW_ROUTE) {
+      this.router.transitionTo(this.args.backRoute, keyName);
+    } else {
+      this.router.transitionTo(this.args.backRoute);
+    }
+  }
+}
diff --git a/ui/app/components/generate-credentials.hbs b/ui/app/components/generate-credentials.hbs
new file mode 100644
index 00000000000..161e2251996
--- /dev/null
+++ b/ui/app/components/generate-credentials.hbs
@@ -0,0 +1,142 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.top>
+    <Hds::Breadcrumb>
+      <Hds::Breadcrumb::Item
+        @text={{@backendPath}}
+        @route="vault.cluster.secrets.backend"
+        @model={{@backendPath}}
+        data-test-link="role-list"
+      />
+      <Hds::Breadcrumb::Item @text="Credentials" @route="vault.cluster.secrets.backend" @model={{@backendPath}} />
+      <Hds::Breadcrumb::Item @text={{@roleName}} @route="vault.cluster.secrets.backend.show" @model={{@roleName}} />
+      <Hds::Breadcrumb::Item @text={{this.options.title}} @current={{true}} />
+    </Hds::Breadcrumb>
+  </p.top>
+  <p.levelLeft>
+    <h1 data-test-title class="title is-3">
+      {{this.options.title}}
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+{{#if this.hasGenerated}}
+  <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
+    <MessageError @model={{this.model}} />
+    {{#unless this.model.isError}}
+      <Hds::Alert @type="inline" @color="warning" class="has-top-bottom-margin" data-test-warning as |A|>
+        <A.Title>Warning</A.Title>
+        <A.Description>
+          You will not be able to access this information later, so please copy the information below.
+        </A.Description>
+      </Hds::Alert>
+    {{/unless}}
+    {{#each this.displayFields as |key|}}
+      {{#let (get this.model.allByKey key) as |attr|}}
+        {{#if (eq attr.type "object")}}
+          <InfoTableRow
+            @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+            @value={{stringify (get this.model attr.name)}}
+          />
+        {{else}}
+          {{#if attr.options.masked}}
+            {{#if (get this.model attr.name)}}
+              <InfoTableRow
+                @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+                @value={{get this.model attr.name}}
+              >
+                <MaskedInput
+                  @value={{get this.model attr.name}}
+                  @name={{attr.name}}
+                  @displayOnly={{true}}
+                  @allowCopy={{true}}
+                />
+              </InfoTableRow>
+            {{/if}}
+          {{else if (and (get this.model attr.name) (or (eq attr.name "issueDate") (eq attr.name "expiryDate")))}}
+            <InfoTableRow
+              data-test-table-row
+              @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+              @value={{date-format (get this.model attr.name) "MMM dd, yyyy hh:mm:ss a"}}
+            />
+          {{else}}
+            <InfoTableRow
+              @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+              @value={{get this.model attr.name}}
+            />
+          {{/if}}
+        {{/if}}
+      {{/let}}
+    {{/each}}
+  </div>
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <div class="control">
+      <Hds::Copy::Button
+        @text="Copy credentials"
+        @textToCopy={{this.model.toCreds}}
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+        class="primary"
+      />
+    </div>
+    {{#if this.model.leaseId}}
+      <div class="control">
+        <Hds::Copy::Button
+          @text="Copy Lease ID"
+          @textToCopy={{this.model.leaseId}}
+          @onError={{(fn
+            (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
+          )}}
+          class="secondary"
+        />
+      </div>
+    {{/if}}
+    <div class="control">
+      {{#if this.options.backIsListLink}}
+        <Hds::Button
+          @text="Back"
+          @color="secondary"
+          @route="vault.cluster.secrets.backend.list-root"
+          @model={{@backendPath}}
+          data-test-back-button
+        />
+      {{else}}
+        <Hds::Button @text="Back" @color="secondary" {{on "click" this.reset}} data-test-back-button />
+      {{/if}}
+    </div>
+  </div>
+{{else}}
+  <form {{on "submit" this.create}} data-test-secret-generate-form>
+    <div class="box is-sideless is-fullwidth is-marginless {{if this.helpText 'no-padding-top'}}">
+      <NamespaceReminder @mode="generate" @noun="credential" />
+      <MessageError @model={{this.model}} />
+      {{#if this.helpText}}
+        <p class="is-hint">{{this.helpText}}</p>
+      {{/if}}
+      {{#each this.formFields as |key|}}
+        <FormField data-test-field @attr={{get this.model.allByKey key}} @model={{this.model}} />
+      {{/each}}
+    </div>
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      <Hds::ButtonSet>
+        <Hds::Button
+          @text="Generate"
+          @icon={{if this.loading "loading"}}
+          type="submit"
+          disabled={{this.loading}}
+          data-test-submit
+        />
+        <Hds::Button
+          @text="Cancel"
+          @route="vault.cluster.secrets.backend.list-root"
+          @color="secondary"
+          @model={{@backendPath}}
+          data-test-cancel
+        />
+      </Hds::ButtonSet>
+    </div>
+  </form>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/generate-credentials.js b/ui/app/components/generate-credentials.js
index 7c871cd95b0..b24ec291345 100644
--- a/ui/app/components/generate-credentials.js
+++ b/ui/app/components/generate-credentials.js
@@ -1,80 +1,99 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
-import { computed, set } from '@ember/object';
-import Component from '@ember/component';
+import { action } from '@ember/object';
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
 
-const MODEL_TYPES = {
-  'ssh-sign': {
-    model: 'ssh-sign',
-  },
-  'ssh-creds': {
+const CREDENTIAL_TYPES = {
+  ssh: {
     model: 'ssh-otp-credential',
     title: 'Generate SSH Credentials',
+    formFields: ['username', 'ip'],
+    displayFields: ['username', 'ip', 'key', 'keyType', 'port'],
   },
-  'aws-creds': {
+  aws: {
     model: 'aws-credential',
     title: 'Generate AWS Credentials',
     backIsListLink: true,
+    displayFields: ['accessKey', 'secretKey', 'securityToken', 'leaseId', 'renewable', 'leaseDuration'],
+    // aws form fields are dynamic
+    formFields: (model) => {
+      return {
+        iam_user: ['credentialType'],
+        assumed_role: ['credentialType', 'ttl', 'roleArn'],
+        federation_token: ['credentialType', 'ttl'],
+        session_token: ['credentialType', 'ttl'],
+      }[model.credentialType];
+    },
   },
 };
 
-export default Component.extend({
-  controlGroup: service(),
-  store: service(),
-  router: service(),
-  // set on the component
-  backendType: null,
-  backendPath: null,
-  roleName: null,
-  action: null,
+export default class GenerateCredentials extends Component {
+  @service controlGroup;
+  @service store;
+  @service router;
+
+  @tracked model;
+  @tracked loading = false;
+  @tracked hasGenerated = false;
+  emptyData = '{\n}';
+
+  constructor() {
+    super(...arguments);
+    const modelType = this.modelForType();
+    this.model = this.generateNewModel(modelType);
+  }
 
-  model: null,
-  loading: false,
-  emptyData: '{\n}',
+  willDestroy() {
+    // components are torn down after store is unloaded and will cause an error if attempt to unload record
+    const noTeardown = this.store && !this.store.isDestroying;
+    if (noTeardown && !this.model.isDestroyed && !this.model.isDestroying) {
+      this.model.unloadRecord();
+    }
+    super.willDestroy();
+  }
 
   modelForType() {
     const type = this.options;
     if (type) {
       return type.model;
     }
-    // if we don't have a mode for that type then redirect them back to the backend list
-    this.router.transitionTo('vault.cluster.secrets.backend.list-root', this.backendPath);
-  },
+    // if we don't have a model for that type then redirect them back to the backend list
+    this.router.transitionTo('vault.cluster.secrets.backend.list-root', this.args.backendPath);
+  }
 
-  options: computed('action', 'backendType', function () {
-    const action = this.action || 'creds';
-    return MODEL_TYPES[`${this.backendType}-${action}`];
-  }),
+  get helpText() {
+    if (this.options?.model === 'aws-credential') {
+      return 'For Vault roles of credential type iam_user, there are no inputs, just submit the form. Choose a type to change the input options.';
+    }
+    return '';
+  }
 
-  init() {
-    this._super(...arguments);
-    this.createOrReplaceModel();
-  },
+  get options() {
+    return CREDENTIAL_TYPES[this.args.backendType];
+  }
 
-  willDestroy() {
-    // components are torn down after store is unloaded and will cause an error if attempt to unload record
-    const noTeardown = this.store && !this.store.isDestroying;
-    if (noTeardown && !this.model.isDestroyed && !this.model.isDestroying) {
-      this.model.unloadRecord();
+  get formFields() {
+    const typeOpts = this.options;
+    if (typeof typeOpts.formFields === 'function') {
+      return typeOpts.formFields(this.model);
     }
-    this._super(...arguments);
-  },
+    return typeOpts.formFields;
+  }
 
-  createOrReplaceModel() {
-    const modelType = this.modelForType();
-    const model = this.model;
-    const roleName = this.roleName;
-    const backendPath = this.backendPath;
+  get displayFields() {
+    return this.options.displayFields;
+  }
+
+  generateNewModel(modelType) {
     if (!modelType) {
       return;
     }
-    if (model) {
-      model.unloadRecord();
-    }
+    const { roleName, backendPath, awsRoleType } = this.args;
     const attrs = {
       role: {
         backend: backendPath,
@@ -82,44 +101,60 @@ export default Component.extend({
       },
       id: `${backendPath}-${roleName}`,
     };
-    const newModel = this.store.createRecord(modelType, attrs);
-    this.set('model', newModel);
-  },
+    if (awsRoleType) {
+      // this is only set from route if backendType = aws
+      attrs.credentialType = awsRoleType;
+    }
+    return this.store.createRecord(modelType, attrs);
+  }
 
-  actions: {
-    create() {
-      const model = this.model;
-      this.set('loading', true);
-      this.model
-        .save()
-        .then(() => {
-          model.set('hasGenerated', true);
-        })
-        .catch((error) => {
-          // Handle control group AdapterError
-          if (error.message === 'Control Group encountered') {
-            this.controlGroup.saveTokenFromError(error);
-            const err = this.controlGroup.logFromError(error);
-            error.errors = [err.content];
-          }
-          throw error;
-        })
-        .finally(() => {
-          this.set('loading', false);
-        });
-    },
+  replaceModel() {
+    const modelType = this.modelForType();
+    if (!modelType) {
+      return;
+    }
+    if (this.model) {
+      this.model.unloadRecord();
+    }
+    this.model = this.generateNewModel(modelType);
+  }
 
-    codemirrorUpdated(attr, val, codemirror) {
-      codemirror.performLint();
-      const hasErrors = codemirror.state.lint.marked.length > 0;
+  @action
+  create(evt) {
+    evt.preventDefault();
+    this.loading = true;
+    this.model
+      .save()
+      .then(() => {
+        this.hasGenerated = true;
+      })
+      .catch((error) => {
+        // Handle control group AdapterError
+        if (error.message === 'Control Group encountered') {
+          this.controlGroup.saveTokenFromError(error);
+          const err = this.controlGroup.logFromError(error);
+          error.errors = [err.content];
+        }
+        throw error;
+      })
+      .finally(() => {
+        this.loading = false;
+      });
+  }
 
-      if (!hasErrors) {
-        set(this.model, attr, JSON.parse(val));
-      }
-    },
+  @action
+  editorUpdated(attr, val) {
+    // wont set invalid JSON to the model
+    try {
+      this.model[attr] = JSON.parse(val);
+    } catch {
+      // linting is handled by the component
+    }
+  }
 
-    newModel() {
-      this.createOrReplaceModel();
-    },
-  },
-});
+  @action
+  reset() {
+    this.hasGenerated = false;
+    this.replaceModel();
+  }
+}
diff --git a/ui/app/templates/components/generated-item-list.hbs b/ui/app/components/generated-item-list.hbs
similarity index 76%
rename from ui/app/templates/components/generated-item-list.hbs
rename to ui/app/components/generated-item-list.hbs
index 786ed504285..0ae73d9ba54 100644
--- a/ui/app/templates/components/generated-item-list.hbs
+++ b/ui/app/components/generated-item-list.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -23,7 +23,7 @@
         <ul>
           {{#each tabs as |tab|}}
             <li>
-              <LinkTo @route={{get tab.routeParams 0}} @model={{get tab.routeParams 1}} data-test-auth-section-tab={{true}}>
+              <LinkTo @route={{tab.route}} @models={{tab.routeParams}} data-test-link-to="generated-tab">
                 {{tab.label}}
               </LinkTo>
             </li>
@@ -37,7 +37,7 @@
   <ToolbarActions>
     <ToolbarLink
       @route="vault.cluster.access.method.item.create"
-      @model={{@itemType}}
+      @models={{array @methodModel.id @itemType}}
       @type="add"
       data-test-entity-create-link={{@itemType}}
     >
@@ -46,7 +46,13 @@
     </ToolbarLink>
   </ToolbarActions>
 </Toolbar>
-<ListView @items={{@model}} @itemNoun={{@itemType}} @paginationRouteName="vault.cluster.access.method.item.list" as |list|>
+<ListView
+  @items={{@model}}
+  @itemNoun={{@itemType}}
+  @paginationRouteName="vault.cluster.access.method.item.list"
+  @paginationRouteParams={{array @methodModel.id @itemType}}
+  as |list|
+>
   {{#if list.empty}}
     <list.empty
       @title="No {{pluralize @itemType}} yet"
@@ -56,11 +62,11 @@
         @icon="plus"
         @text="Create {{singularize @itemType}}"
         @route="vault.cluster.access.method.item.create"
-        @model={{@itemType}}
+        @models={{array @methodModel.id @itemType}}
       />
     </list.empty>
   {{else if list.item}}
-    <ListItem @linkParams={{array "vault.cluster.access.method.item.show" @itemType list.item.id}} as |Item|>
+    <ListItem @linkParams={{array "vault.cluster.access.method.item.show" @methodModel.id @itemType list.item.id}} as |Item|>
       <Item.content>
         <Icon @name="folder" class="has-text-grey-light" />{{list.item.id}}
       </Item.content>
@@ -73,20 +79,17 @@
             data-test-popup-menu-trigger
           />
           <dd.Interactive
-            @text="View {{singularize @itemType}}"
             @route="vault.cluster.access.method.item.show"
-            @model={{list.item.id}}
-          />
+            @models={{array @methodModel.id @itemType list.item.id}}
+          >View {{singularize @itemType}}</dd.Interactive>
           <dd.Interactive
-            @text="Edit {{singularize @itemType}}"
             @route="vault.cluster.access.method.item.edit"
-            @model={{list.item.id}}
-          />
-          <dd.Interactive
-            @text="Delete {{singularize @itemType}}"
-            @color="critical"
-            {{on "click" (fn (mut this.itemToDelete) list.item)}}
-          />
+            @models={{array @methodModel.id @itemType list.item.id}}
+          >Edit {{singularize @itemType}}</dd.Interactive>
+          <dd.Interactive @color="critical" {{on "click" (fn (mut this.itemToDelete) list.item)}}>
+            Delete
+            {{singularize @itemType}}
+          </dd.Interactive>
         </Hds::Dropdown>
       </Item.menu>
       {{#if (eq list.item this.itemToDelete)}}
diff --git a/ui/app/components/generated-item-list.js b/ui/app/components/generated-item-list.js
index ca6a09cf2bb..c638ca6300c 100644
--- a/ui/app/components/generated-item-list.js
+++ b/ui/app/components/generated-item-list.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
 import Component from '@glimmer/component';
 import { action } from '@ember/object';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 import { tracked } from '@glimmer/tracking';
 
 /**
@@ -26,13 +26,13 @@ import { tracked } from '@glimmer/tracking';
 
 export default class GeneratedItemList extends Component {
   @service router;
-  @service store;
+  @service pagination;
   @tracked itemToDelete = null;
 
   @action
   refreshItemList() {
     const route = getOwner(this).lookup(`route:${this.router.currentRouteName}`);
-    this.store.clearAllDatasets();
+    this.pagination.clearDataset();
     route.refresh();
   }
 }
diff --git a/ui/app/templates/components/generated-item.hbs b/ui/app/components/generated-item.hbs
similarity index 85%
rename from ui/app/templates/components/generated-item.hbs
rename to ui/app/components/generated-item.hbs
index 60cf6bfa062..4b260006f1d 100644
--- a/ui/app/templates/components/generated-item.hbs
+++ b/ui/app/components/generated-item.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -9,7 +9,7 @@
       <Hds::Breadcrumb::Item
         @text={{pluralize this.itemType}}
         @route="vault.cluster.access.method.item.list"
-        @model={{this.itemType}}
+        @models={{array this.mountPath this.itemType}}
       />
       <Hds::Breadcrumb::Item @text={{if (eq this.mode "show") this.model.id (capitalize this.mode)}} @current={{true}} />
     </Hds::Breadcrumb>
@@ -43,7 +43,7 @@
       <div class="toolbar-separator"></div>
       <ToolbarLink
         @route="vault.cluster.access.method.item.edit"
-        @models={{array this.itemType this.model.id}}
+        @models={{array this.mountPath this.itemType this.model.id}}
         data-test-configure-link="true"
       >
         Edit
@@ -59,12 +59,7 @@
     <div class="box is-sideless is-fullwidth is-marginless">
       <NamespaceReminder @mode="save" @noun={{this.itemType}} />
       <MessageError @model={{this.model}} />
-      <FormFieldGroups
-        @model={{this.model}}
-        @mode={{this.mode}}
-        @onKeyUp={{action "onKeyUp"}}
-        @modelValidations={{this.modelValidations}}
-      />
+      <FormFieldGroups @model={{this.model}} @mode={{this.mode}} @modelValidations={{this.modelValidations}} />
     </div>
     <div class="field is-grouped-split box is-fullwidth is-bottomless">
       <Hds::ButtonSet>
@@ -72,14 +67,15 @@
           @text="Save"
           @icon={{if this.saveModel.isRunning "loading"}}
           type="submit"
-          data-test-save-config="true"
           disabled={{this.saveModel.isRunning}}
+          data-test-submit
         />
         {{#if (eq this.mode "create")}}
           <Hds::Button
             @text="Cancel"
             @color="secondary"
             @route="vault.cluster.access.method.item.list"
+            @models={{array this.mountPath this.itemType}}
             data-test-cancel-link={{true}}
           />
         {{else}}
@@ -87,7 +83,7 @@
             @text="Cancel"
             @color="secondary"
             @route="vault.cluster.access.method.item.show"
-            @model={{this.model.id}}
+            @models={{array this.mountPath this.itemType this.model.id}}
             data-test-cancel-link={{true}}
           />
         {{/if}}
diff --git a/ui/app/components/generated-item.js b/ui/app/components/generated-item.js
index 4b10a55afcb..4f11df0ea41 100644
--- a/ui/app/components/generated-item.js
+++ b/ui/app/components/generated-item.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -35,8 +35,27 @@ export default Component.extend({
   props: computed('model', function () {
     return this.model.serialize();
   }),
+  validateForm() {
+    // Only validate on new models because blank passwords will not be updated
+    // in practice this only happens for userpass users
+    if (this.model.validate && this.model.isNew) {
+      const { isValid, state } = this.model.validate();
+      this.setProperties({
+        modelValidations: state,
+        isFormInvalid: !isValid,
+      });
+      return isValid;
+    } else {
+      this.set('isFormInvalid', false);
+      return true;
+    }
+  },
   saveModel: task(
     waitFor(function* () {
+      const isValid = this.validateForm();
+      if (!isValid) {
+        return;
+      }
       try {
         yield this.model.save();
       } catch (err) {
@@ -71,16 +90,6 @@ export default Component.extend({
   actions: {
     onKeyUp(name, value) {
       this.model.set(name, value);
-      if (this.model.validate) {
-        // Set validation error message for updated attribute
-        const { isValid, state } = this.model.validate();
-        this.setProperties({
-          modelValidations: state,
-          isFormInvalid: !isValid,
-        });
-      } else {
-        this.set('isFormInvalid', false);
-      }
     },
     deleteItem() {
       this.model.destroyRecord().then(() => {
diff --git a/ui/app/components/get-credentials-card.hbs b/ui/app/components/get-credentials-card.hbs
index c2dc6f25030..807dcd268c8 100644
--- a/ui/app/components/get-credentials-card.hbs
+++ b/ui/app/components/get-credentials-card.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container @level="mid" @hasBorder={{true}} class="has-padding-l" ...attributes>
   <form {{on "submit" this.transitionToCredential}}>
@@ -17,14 +17,13 @@
       @fallbackComponent="input-search"
       @onChange={{this.handleInput}}
       @placeholder={{@placeholder}}
-      data-test-search-roles
     />
     <Hds::Button
       @text="Get credentials"
       type="submit"
       @color="secondary"
       disabled={{not this.role}}
-      data-test-get-credentials
+      data-test-button="Get credentials"
     />
   </form>
 </Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/components/get-credentials-card.js b/ui/app/components/get-credentials-card.js
index 452584f448f..e86fcb599d7 100644
--- a/ui/app/components/get-credentials-card.js
+++ b/ui/app/components/get-credentials-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/identity/edit-form.hbs b/ui/app/components/identity/edit-form.hbs
new file mode 100644
index 00000000000..c532a233de0
--- /dev/null
+++ b/ui/app/components/identity/edit-form.hbs
@@ -0,0 +1,86 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if (and (eq this.mode "edit") this.model.canDelete)}}
+  <Toolbar>
+    <ToolbarActions>
+      <ConfirmAction
+        class="toolbar-button"
+        @buttonColor="secondary"
+        @buttonText="Delete {{this.model.identityType}}"
+        @confirmTitle="Delete this {{this.model.identityType}}?"
+        @onConfirmAction={{action "deleteItem" this.model}}
+      />
+    </ToolbarActions>
+  </Toolbar>
+{{/if}}
+
+<form {{action (perform this.save) on="submit"}}>
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <NamespaceReminder @mode={{this.mode}} @noun={{lowercase (humanize this.model.identityType)}} />
+    <MessageError @model={{this.model}} />
+    {{#if (eq this.mode "merge")}}
+      <Hds::Alert @type="inline" @color="warning" class="has-bottom-margin-s" as |A|>
+        <A.Title>Warning</A.Title>
+        <A.Description>Metadata on merged entities is not preserved, you will need to recreate it on the entity you merge to.</A.Description>
+      </Hds::Alert>
+    {{/if}}
+    {{#each this.model.fields as |attr|}}
+      <FormField data-test-field={{true}} @attr={{attr}} @model={{@model}}>
+        <div class="form-section">
+          {{#if this.model.canCreatePolicies}}
+            <SearchSelectWithModal
+              @id="policies"
+              @label="Policies"
+              @labelClass="title is-4"
+              @models={{array "policy/acl" "policy/rgp"}}
+              @inputValue={{@model.policies}}
+              @onChange={{action (mut this.model.policies)}}
+              @fallbackComponent="string-list"
+              @modalFormTemplate="modal-form/policy-template"
+              @excludeOptions={{array "root"}}
+            />
+          {{else}}
+            <SearchSelect
+              @id="policies"
+              @label="Policies"
+              @labelClass="title is-4"
+              @models={{array "policy/acl" "policy/rgp"}}
+              @inputValue={{@model.policies}}
+              @onChange={{action (mut this.model.policies)}}
+              @fallbackComponent="string-list"
+              @disallowNewItems={{true}}
+            />
+          {{/if}}
+        </div>
+      </FormField>
+    {{/each}}
+  </div>
+
+  <div class="field is-grouped is-grouped-split is-fullwidth box is-bottomless">
+    <div class="field is-grouped">
+      <Hds::ButtonSet>
+        <Hds::Button
+          @text={{if (eq this.mode "create") "Create" "Save"}}
+          @icon={{if this.save.isRunning "loading"}}
+          type="submit"
+          disabled={{this.save.isRunning}}
+          data-test-submit
+        />
+        {{#if (or (eq this.mode "merge") (eq this.mode "create"))}}
+          <Hds::Button @text="Cancel" @color="secondary" @route={{this.cancelLink}} data-test-cancel-link />
+        {{else}}
+          <Hds::Button
+            @text="Cancel"
+            @color="secondary"
+            @route={{this.cancelLink}}
+            @models={{array this.model.id "details"}}
+            data-test-cancel-link
+          />
+        {{/if}}
+      </Hds::ButtonSet>
+    </div>
+  </div>
+</form>
\ No newline at end of file
diff --git a/ui/app/components/identity/edit-form.js b/ui/app/components/identity/edit-form.js
index 744cf0c2b36..803be3797da 100644
--- a/ui/app/components/identity/edit-form.js
+++ b/ui/app/components/identity/edit-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -77,7 +77,7 @@ export default Component.extend({
     // components are torn down after store is disconnected and will cause an error if attempt to unload record
     const noTeardown = this.store && !this.store.isDestroying;
     const model = this.model;
-    if (noTeardown && model && model.get('isDirty') && !model.isDestroyed && !model.isDestroying) {
+    if (noTeardown && model && model.isDirty && !model.isDestroyed && !model.isDestroying) {
       model.rollbackAttributes();
     }
     this._super(...arguments);
diff --git a/ui/app/templates/components/identity/entity-nav.hbs b/ui/app/components/identity/entity-nav.hbs
similarity index 97%
rename from ui/app/templates/components/identity/entity-nav.hbs
rename to ui/app/components/identity/entity-nav.hbs
index 1dde6f3d1bc..ed17d823ed3 100644
--- a/ui/app/templates/components/identity/entity-nav.hbs
+++ b/ui/app/components/identity/entity-nav.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/components/identity/entity-nav.js b/ui/app/components/identity/entity-nav.js
index 61eb484bb30..2b674eb0957 100644
--- a/ui/app/components/identity/entity-nav.js
+++ b/ui/app/components/identity/entity-nav.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/identity/item-alias/alias-details.hbs b/ui/app/components/identity/item-alias/alias-details.hbs
similarity index 87%
rename from ui/app/templates/components/identity/item-alias/alias-details.hbs
rename to ui/app/components/identity/item-alias/alias-details.hbs
index 4d76e39367b..cda1f021438 100644
--- a/ui/app/templates/components/identity/item-alias/alias-details.hbs
+++ b/ui/app/components/identity/item-alias/alias-details.hbs
@@ -1,15 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <InfoTableRow @label="Name" @value={{@model.name}} data-test-alias-name={{true}} />
-<InfoTableRow @label="ID" @value={{@model.id}} />
+<InfoTableRow @label="ID" @value={{@model.id}} @addCopyButton={{true}} />
 <InfoTableRow @label={{if (eq @model.identityType "entity-alias") "Entity ID" "Group ID"}} @value={{this.model.canonicalId}}>
   <LinkTo
     @route="vault.cluster.access.identity.show"
     @models={{array (if (eq @model.identityType "entity-alias") "entities" "groups") @model.canonicalId "details"}}
-    class="has-text-black is-font-mono"
   >
     {{@model.canonicalId}}
   </LinkTo>
@@ -19,7 +18,7 @@
   <div>
     {{@model.mountPath}}
     <div>
-      <span class="tag">{{@model.mountType}}</span>
+      <Hds::Badge @text={{@model.mountType}} class="has-right-margin-8" />
       <code class="has-text-grey is-size-8">{{@model.mountAccessor}}</code>
     </div>
   </div>
diff --git a/ui/app/templates/components/identity/item-alias/alias-metadata.hbs b/ui/app/components/identity/item-alias/alias-metadata.hbs
similarity index 93%
rename from ui/app/templates/components/identity/item-alias/alias-metadata.hbs
rename to ui/app/components/identity/item-alias/alias-metadata.hbs
index c41a83d2346..b904e9fadfc 100644
--- a/ui/app/templates/components/identity/item-alias/alias-metadata.hbs
+++ b/ui/app/components/identity/item-alias/alias-metadata.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each-in @model.metadata as |key value|}}
   <div class="info-table-row is-mobile">
diff --git a/ui/app/templates/components/identity/item-aliases.hbs b/ui/app/components/identity/item-aliases.hbs
similarity index 92%
rename from ui/app/templates/components/identity/item-aliases.hbs
rename to ui/app/components/identity/item-aliases.hbs
index f0fffc814c1..503d8df4a50 100644
--- a/ui/app/templates/components/identity/item-aliases.hbs
+++ b/ui/app/components/identity/item-aliases.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each (if @model.alias.id (array @model.alias) @model.aliases) as |item|}}
   <LinkedBlock @params={{array "vault.cluster.access.identity.aliases.show" item.id "details"}} class="list-item-row">
@@ -18,7 +18,7 @@
         <div class="has-text-grey">
           {{item.id}}
         </div>
-        <span class="tag">{{item.mountType}}</span>
+        <Hds::Badge @text={{item.mountType}} />
         <span class="has-text-grey is-size-8">
           {{item.mountAccessor}}
         </span>
diff --git a/ui/app/templates/components/identity/item-details.hbs b/ui/app/components/identity/item-details.hbs
similarity index 93%
rename from ui/app/templates/components/identity/item-details.hbs
rename to ui/app/components/identity/item-details.hbs
index 8783e34be27..ba3ba146186 100644
--- a/ui/app/templates/components/identity/item-details.hbs
+++ b/ui/app/components/identity/item-details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-shadowless is-marginless is-fullwidth">
   {{#if @model.disabled}}
@@ -19,7 +19,7 @@
   {{/if}}
   <InfoTableRow @label="Name" @value={{@model.name}} data-test-identity-item-name={{true}} />
   <InfoTableRow @label="Type" @value={{@model.type}} />
-  <InfoTableRow @label="ID" @value={{@model.id}} />
+  <InfoTableRow @label="ID" @value={{@model.id}} @addCopyButton={{true}} />
   <InfoTableRow @label="Merged Ids" @value={{@model.mergedEntityIds}}>
     <div>
       {{#each @model.mergedEntityIds as |id|}}
diff --git a/ui/app/components/identity/item-details.js b/ui/app/components/identity/item-details.js
index c46f5a55231..4f349beed42 100644
--- a/ui/app/components/identity/item-details.js
+++ b/ui/app/components/identity/item-details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/identity/item-groups.hbs b/ui/app/components/identity/item-groups.hbs
similarity index 88%
rename from ui/app/templates/components/identity/item-groups.hbs
rename to ui/app/components/identity/item-groups.hbs
index 8c08bc40e14..adb0a9472fa 100644
--- a/ui/app/templates/components/identity/item-groups.hbs
+++ b/ui/app/components/identity/item-groups.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @model.groupIds}}
   {{#each @model.directGroupIds as |gid|}}
@@ -14,7 +14,7 @@
       <LinkTo @route="vault.cluster.access.identity.show" @models={{array "groups" gid "details"}} class="has-text-black">
         <Icon @name="folder" class="has-text-grey-light" />{{gid}}
       </LinkTo>
-      <span class="tag has-text-grey is-size-8">inherited</span>
+      <Hds::Badge @text="inherited" />
     </LinkedBlock>
   {{/each}}
 {{else}}
diff --git a/ui/app/templates/components/identity/item-members.hbs b/ui/app/components/identity/item-members.hbs
similarity index 97%
rename from ui/app/templates/components/identity/item-members.hbs
rename to ui/app/components/identity/item-members.hbs
index 3b149199f04..21ce9719aa7 100644
--- a/ui/app/templates/components/identity/item-members.hbs
+++ b/ui/app/components/identity/item-members.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @model.hasMembers}}
   {{#each @model.memberGroupIds as |gid|}}
diff --git a/ui/app/templates/components/identity/item-metadata.hbs b/ui/app/components/identity/item-metadata.hbs
similarity index 96%
rename from ui/app/templates/components/identity/item-metadata.hbs
rename to ui/app/components/identity/item-metadata.hbs
index a9012398ef9..b01dadd881a 100644
--- a/ui/app/templates/components/identity/item-metadata.hbs
+++ b/ui/app/components/identity/item-metadata.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each-in @model.metadata as |key value|}}
   <div class="info-table-row is-mobile">
diff --git a/ui/app/templates/components/identity/item-parent-groups.hbs b/ui/app/components/identity/item-parent-groups.hbs
similarity index 95%
rename from ui/app/templates/components/identity/item-parent-groups.hbs
rename to ui/app/components/identity/item-parent-groups.hbs
index 2cc73de5284..15bcbbbd50d 100644
--- a/ui/app/templates/components/identity/item-parent-groups.hbs
+++ b/ui/app/components/identity/item-parent-groups.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @model.parentGroupIds.length}}
   {{#each @model.parentGroupIds as |gid|}}
diff --git a/ui/app/templates/components/identity/item-policies.hbs b/ui/app/components/identity/item-policies.hbs
similarity index 95%
rename from ui/app/templates/components/identity/item-policies.hbs
rename to ui/app/components/identity/item-policies.hbs
index 98785905990..df51c53e2ba 100644
--- a/ui/app/templates/components/identity/item-policies.hbs
+++ b/ui/app/components/identity/item-policies.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each @model.policies as |policyName|}}
   <LinkedBlock @params={{array "vault.cluster.policy.show" "acl" policyName}} class="list-item-row">
diff --git a/ui/app/components/identity/lookup-input.hbs b/ui/app/components/identity/lookup-input.hbs
new file mode 100644
index 00000000000..aa584119132
--- /dev/null
+++ b/ui/app/components/identity/lookup-input.hbs
@@ -0,0 +1,38 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{action (perform this.lookup) on="submit"}}>
+  <div class="field is-flex">
+    <div class="control">
+      <div class="select is-fullwidth">
+        <select
+          name="param"
+          id="param"
+          onchange={{action (mut this.param) value="target.value"}}
+          aria-label="lookup by alias name"
+          data-test-select="lookup-param-select"
+        >
+          {{#each (array "alias name" "name" "id" "alias id") as |paramOption|}}
+            <option selected={{eq this.param paramOption}} value={{paramOption}}>
+              Lookup by
+              {{paramOption}}
+            </option>
+          {{/each}}
+        </select>
+      </div>
+    </div>
+    <div class="control">
+      {{#if (eq this.param "alias name")}}
+        <MountAccessorSelect @value={{this.aliasMountAccessor}} @onChange={{action (mut this.aliasMountAccessor)}} />
+      {{/if}}
+    </div>
+    <div class="control is-expanded">
+      <Input class="input" @value={{this.paramValue}} placeholder={{capitalize this.param}} data-test-input="param-value" />
+    </div>
+    <div class="control">
+      <Hds::Button @text="Lookup" @color="secondary" class="is-hidden" type="submit" data-test-submit />
+    </div>
+  </div>
+</form>
\ No newline at end of file
diff --git a/ui/app/components/identity/lookup-input.js b/ui/app/components/identity/lookup-input.js
index b683f44001b..83dfb716f53 100644
--- a/ui/app/components/identity/lookup-input.js
+++ b/ui/app/components/identity/lookup-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,11 +7,13 @@ import { service } from '@ember/service';
 import Component from '@ember/component';
 import { task } from 'ember-concurrency';
 import { underscore } from 'vault/helpers/underscore';
+import AuthMethodResource from 'vault/resources/auth/method';
 
 export default Component.extend({
   store: service(),
   flashMessages: service(),
   router: service(),
+  api: service(),
 
   // Public API - either 'entity' or 'group'
   // this will determine which adapter is used to make the lookup call
@@ -25,7 +27,10 @@ export default Component.extend({
 
   init() {
     this._super(...arguments);
-    this.store.findAll('auth-method').then((methods) => {
+    this.api.sys.authListEnabledMethods().then(({ data }) => {
+      const methods = this.api
+        .responseObjectToArray(data, 'path')
+        .map((method) => new AuthMethodResource(method, this));
       this.set('authMethods', methods);
       this.set('aliasMountAccessor', methods[0].accessor);
     });
diff --git a/ui/app/templates/components/identity/popup-alias.hbs b/ui/app/components/identity/popup-alias.hbs
similarity index 87%
rename from ui/app/templates/components/identity/popup-alias.hbs
rename to ui/app/components/identity/popup-alias.hbs
index 3608b13d706..22205917d46 100644
--- a/ui/app/templates/components/identity/popup-alias.hbs
+++ b/ui/app/components/identity/popup-alias.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="has-text-right">
   <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
@@ -9,13 +9,12 @@
       @icon="more-horizontal"
       @text="Alias management options"
       @hasChevron={{false}}
-      data-test-popup-menu-trigger
+      data-test-popup-menu={{@item.name}}
     />
     <dd.Interactive
-      @text="Details"
       @route="vault.cluster.access.identity.aliases.show"
       @models={{array (pluralize @item.parentType) @item.id "details"}}
-    />
+    >Details</dd.Interactive>
     {{#if @item.updatePath.isPending}}
       <dd.Generic class="has-text-center">
         <LoadingDropdownOption />
@@ -23,18 +22,16 @@
     {{else}}
       {{#if @item.canEdit}}
         <dd.Interactive
-          @text="Edit"
           @route="vault.cluster.access.identity.aliases.edit"
           @models={{array (pluralize @item.parentType) @item.id}}
-        />
+        >Edit</dd.Interactive>
       {{/if}}
       {{#if @item.canDelete}}
         <dd.Interactive
-          @text="Remove"
           @color="critical"
           {{on "click" (fn (mut this.showConfirmModal) true)}}
           data-test-popup-menu="delete"
-        />
+        >Remove</dd.Interactive>
       {{/if}}
     {{/if}}
   </Hds::Dropdown>
diff --git a/ui/app/components/identity/popup-alias.js b/ui/app/components/identity/popup-alias.js
index 919cb74ed42..a5baad796f7 100644
--- a/ui/app/components/identity/popup-alias.js
+++ b/ui/app/components/identity/popup-alias.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/identity/popup-members.hbs b/ui/app/components/identity/popup-members.hbs
similarity index 79%
rename from ui/app/templates/components/identity/popup-members.hbs
rename to ui/app/components/identity/popup-members.hbs
index ff2b3044142..b1ce8d0f88c 100644
--- a/ui/app/templates/components/identity/popup-members.hbs
+++ b/ui/app/components/identity/popup-members.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="has-text-right">
   <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
@@ -11,7 +11,7 @@
       @hasChevron={{false}}
       data-test-popup-menu-trigger
     />
-    <dd.Interactive @text="Remove" @color="critical" {{on "click" (fn (mut this.showConfirmModal) true)}} />
+    <dd.Interactive @color="critical" {{on "click" (fn (mut this.showConfirmModal) true)}}>Remove</dd.Interactive>
   </Hds::Dropdown>
 </div>
 
diff --git a/ui/app/components/identity/popup-members.js b/ui/app/components/identity/popup-members.js
index fdafd79dba9..6871355c0c9 100644
--- a/ui/app/components/identity/popup-members.js
+++ b/ui/app/components/identity/popup-members.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/identity/popup-metadata.hbs b/ui/app/components/identity/popup-metadata.hbs
similarity index 78%
rename from ui/app/templates/components/identity/popup-metadata.hbs
rename to ui/app/components/identity/popup-metadata.hbs
index 9954f1c7853..d3062378de8 100644
--- a/ui/app/templates/components/identity/popup-metadata.hbs
+++ b/ui/app/components/identity/popup-metadata.hbs
@@ -1,12 +1,12 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="has-text-right">
   <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
     <dd.ToggleIcon @icon="more-horizontal" @text="Metadata options" @hasChevron={{false}} data-test-popup-menu-trigger />
-    <dd.Interactive @text="Remove" @color="critical" {{on "click" (fn (mut this.showConfirmModal) true)}} />
+    <dd.Interactive @color="critical" {{on "click" (fn (mut this.showConfirmModal) true)}}>Remove</dd.Interactive>
   </Hds::Dropdown>
 </div>
 
diff --git a/ui/app/components/identity/popup-metadata.js b/ui/app/components/identity/popup-metadata.js
index 2089f4a90e9..6acd791dcbc 100644
--- a/ui/app/components/identity/popup-metadata.js
+++ b/ui/app/components/identity/popup-metadata.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/identity/popup-policy.hbs b/ui/app/components/identity/popup-policy.hbs
new file mode 100644
index 00000000000..ddc904e9882
--- /dev/null
+++ b/ui/app/components/identity/popup-policy.hbs
@@ -0,0 +1,31 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="has-text-right">
+  <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
+    <dd.ToggleIcon
+      @icon="more-horizontal"
+      @text="Identity policy management options"
+      @hasChevron={{false}}
+      data-test-popup-menu-trigger
+    />
+    <dd.Interactive @route="vault.cluster.policy.show" @models={{array "acl" @policyName}}>View policy</dd.Interactive>
+    <dd.Interactive @route="vault.cluster.policy.edit" @models={{array "acl" @policyName}}>Edit policy</dd.Interactive>
+    <dd.Interactive @color="critical" {{on "click" (fn (mut this.showConfirmModal) true)}}>
+      Remove from
+      {{@model.identityType}}
+    </dd.Interactive>
+  </Hds::Dropdown>
+</div>
+
+{{#if this.showConfirmModal}}
+  <ConfirmModal
+    @color="critical"
+    @onClose={{fn (mut this.showConfirmModal) false}}
+    @onConfirm={{this.removePolicy}}
+    @confirmTitle="Remove this policy?"
+    @confirmMessage="This policy may affect permissions to access Vault data."
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/identity/popup-policy.js b/ui/app/components/identity/popup-policy.js
index 591e3d17e80..e60ecaf4c7d 100644
--- a/ui/app/components/identity/popup-policy.js
+++ b/ui/app/components/identity/popup-policy.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/key-version-select.hbs b/ui/app/components/key-version-select.hbs
similarity index 96%
rename from ui/app/templates/components/key-version-select.hbs
rename to ui/app/components/key-version-select.hbs
index 001194b1057..d8ad7676327 100644
--- a/ui/app/templates/components/key-version-select.hbs
+++ b/ui/app/components/key-version-select.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (gt this.key.keysForEncryption.length 1)}}
   <div class="field" data-test-transit-key-version-select={{true}}>
diff --git a/ui/app/components/key-version-select.js b/ui/app/components/key-version-select.js
index d99599ac303..0903d3fe550 100644
--- a/ui/app/components/key-version-select.js
+++ b/ui/app/components/key-version-select.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/keymgmt/distribute.hbs b/ui/app/components/keymgmt/distribute.hbs
similarity index 99%
rename from ui/app/templates/components/keymgmt/distribute.hbs
rename to ui/app/components/keymgmt/distribute.hbs
index 06439b8a5a0..68fed818a3f 100644
--- a/ui/app/templates/components/keymgmt/distribute.hbs
+++ b/ui/app/components/keymgmt/distribute.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @backend}}
   {{#if this.formErrors}}
diff --git a/ui/app/components/keymgmt/distribute.js b/ui/app/components/keymgmt/distribute.js
index 3c2cd847396..41bb93d99cb 100644
--- a/ui/app/components/keymgmt/distribute.js
+++ b/ui/app/components/keymgmt/distribute.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -37,6 +37,7 @@ const VALID_TYPES_BY_PROVIDER = {
   azurekeyvault: ['rsa-2048', 'rsa-3072', 'rsa-4096'],
 };
 export default class KeymgmtDistribute extends Component {
+  @service pagination;
   @service store;
   @service flashMessages;
   @service router;
@@ -191,7 +192,7 @@ export default class KeymgmtDistribute extends Component {
       .then(() => {
         this.flashMessages.success(`Successfully distributed key ${key} to ${provider}`);
         // update keys on provider model
-        this.store.clearDataset('keymgmt/key');
+        this.pagination.clearDataset('keymgmt/key');
         const providerModel = this.store.peekRecord('keymgmt/provider', provider);
         providerModel.fetchKeys(providerModel.keys?.meta?.currentPage || 1);
         this.args.onClose();
diff --git a/ui/app/templates/components/keymgmt/key-edit.hbs b/ui/app/components/keymgmt/key-edit.hbs
similarity index 99%
rename from ui/app/templates/components/keymgmt/key-edit.hbs
rename to ui/app/components/keymgmt/key-edit.hbs
index 92f679f1db4..94749fc7960 100644
--- a/ui/app/templates/components/keymgmt/key-edit.hbs
+++ b/ui/app/components/keymgmt/key-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/components/keymgmt/key-edit.js b/ui/app/components/keymgmt/key-edit.js
index f37d68436a4..27dbfde1a39 100644
--- a/ui/app/components/keymgmt/key-edit.js
+++ b/ui/app/components/keymgmt/key-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/keymgmt/provider-edit.hbs b/ui/app/components/keymgmt/provider-edit.hbs
similarity index 99%
rename from ui/app/templates/components/keymgmt/provider-edit.hbs
rename to ui/app/components/keymgmt/provider-edit.hbs
index 20979b9b36b..3e9dd6c1cee 100644
--- a/ui/app/templates/components/keymgmt/provider-edit.hbs
+++ b/ui/app/components/keymgmt/provider-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/components/keymgmt/provider-edit.js b/ui/app/components/keymgmt/provider-edit.js
index d8929e69b96..bb046f8ccea 100644
--- a/ui/app/components/keymgmt/provider-edit.js
+++ b/ui/app/components/keymgmt/provider-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
 import { task } from 'ember-concurrency';
 import { waitFor } from '@ember/test-waiters';
+import { removeFromArray } from 'vault/helpers/remove-from-array';
 
 /**
  * @module KeymgmtProviderEdit
@@ -94,8 +95,9 @@ export default class KeymgmtProviderEdit extends Component {
   @action
   async onDeleteKey(model) {
     try {
+      const providerKeys = removeFromArray(this.args.model.keys, model);
       await model.destroyRecord();
-      this.args.model.keys.removeObject(model);
+      this.args.model.keys = providerKeys;
     } catch (error) {
       this.flashMessages.danger(error.errors.join('. '));
     }
diff --git a/ui/app/templates/components/license-banners.hbs b/ui/app/components/license-banners.hbs
similarity index 97%
rename from ui/app/templates/components/license-banners.hbs
rename to ui/app/components/license-banners.hbs
index 74a71bf4e61..c309a1b5cc6 100644
--- a/ui/app/templates/components/license-banners.hbs
+++ b/ui/app/components/license-banners.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (and this.licenseExpired (not this.expiredDismissed))}}
   <Hds::Alert
diff --git a/ui/app/components/license-banners.js b/ui/app/components/license-banners.js
index 316370be38c..8fc2756a9be 100644
--- a/ui/app/components/license-banners.js
+++ b/ui/app/components/license-banners.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/license-info.hbs b/ui/app/components/license-info.hbs
index 74b7a0dd353..9a59e97a5bc 100644
--- a/ui/app/components/license-info.hbs
+++ b/ui/app/components/license-info.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/components/license-info.js b/ui/app/components/license-info.js
index bffcb16a16e..c62d1869440 100644
--- a/ui/app/components/license-info.js
+++ b/ui/app/components/license-info.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/link-status.hbs b/ui/app/components/link-status.hbs
similarity index 95%
rename from ui/app/templates/components/link-status.hbs
rename to ui/app/components/link-status.hbs
index 7ccd30a99a9..3336e57d353 100644
--- a/ui/app/templates/components/link-status.hbs
+++ b/ui/app/components/link-status.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (and this.state this.version.isEnterprise)}}
   <Hds::Alert @type="page" @color={{if (eq this.state "connected") "neutral" "warning"}} as |A|>
diff --git a/ui/app/components/link-status.js b/ui/app/components/link-status.js
index ab22df6b03a..ef0b1ebb8ec 100644
--- a/ui/app/components/link-status.js
+++ b/ui/app/components/link-status.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/logo-edition.hbs b/ui/app/components/logo-edition.hbs
index b57e2345198..6425272124c 100644
--- a/ui/app/components/logo-edition.hbs
+++ b/ui/app/components/logo-edition.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <svg width="146" height="51" viewBox="0 0 146 51" xmlns="http://www.w3.org/2000/svg">
   <g id="vault-logo-v" fill-rule="nonzero">
diff --git a/ui/app/components/logo-edition.js b/ui/app/components/logo-edition.js
index 527faa02bd1..f0cbf919275 100644
--- a/ui/app/components/logo-edition.js
+++ b/ui/app/components/logo-edition.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/logo-splash.hbs b/ui/app/components/logo-splash.hbs
similarity index 88%
rename from ui/app/templates/components/logo-splash.hbs
rename to ui/app/components/logo-splash.hbs
index 633a4c31a3e..f150da90f4d 100644
--- a/ui/app/templates/components/logo-splash.hbs
+++ b/ui/app/components/logo-splash.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="is-flex-v-centered is-flex-grow-1">
   <div class="columns is-centered">
diff --git a/ui/app/components/mfa/form/choose-method.hbs b/ui/app/components/mfa/form/choose-method.hbs
new file mode 100644
index 00000000000..ff2a38d2a5c
--- /dev/null
+++ b/ui/app/components/mfa/form/choose-method.hbs
@@ -0,0 +1,65 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{! This component renders when there are either multiple constraints with self-enroll methods or a single constraint with multiple methods }}
+<Mfa::SplashCard
+  @header="Verify your identity"
+  @subheader="Multi-factor authentication is enabled for your account."
+  @description={{this.description}}
+  @renderLogo={{true}}
+  data-test-mfa-form
+>
+  <:additionalContent>
+    {{#if this.singleConstraint}}
+      {{#each this.nonSelfEnrollMethods as |method|}}
+        <Hds::Button
+          {{on "click" (fn @onSelect this.singleConstraint method.id)}}
+          @color="secondary"
+          @icon={{this.displayIcon method.type}}
+          @isFullWidth={{true}}
+          @text="Verify with {{this.displayLabel method.type}}"
+          class="has-top-margin-s has-bottom-margin-xs"
+          data-test-button="Verify with {{this.displayLabel method.type}}"
+        />
+      {{/each}}
+
+      {{#if (and this.nonSelfEnrollMethods this.singleConstraint.hasSelfEnrollMethods)}}
+        <Hds::Layout::Flex @gap="16" @justify="center" @align="center">
+          <hr class="has-background-gray-300 is-flex-1" />
+          <Hds::Text::Body @color="faint">
+            Or
+          </Hds::Text::Body>
+          <hr class="has-background-gray-300 is-flex-1" />
+        </Hds::Layout::Flex>
+      {{/if}}
+
+      {{#each this.singleConstraint.selfEnrollMethods as |method|}}
+        <Hds::Button
+          {{on "click" (fn @onSelect this.singleConstraint method.id)}}
+          @color="secondary"
+          @icon={{this.displayIcon method.type}}
+          @isFullWidth={{true}}
+          @text="Setup to verify with {{this.displayLabel method.type}}"
+          class="has-top-margin-xxs has-bottom-margin-xs"
+          data-test-button="Setup to verify with {{this.displayLabel method.type}}"
+        />
+      {{/each}}
+
+    {{else}}
+      {{! If there are multiple constraints that support self-enrollment, the user needs to choose 
+      if they want to verify with a self-enroll method or another method for each one }}
+      {{#each this.selfEnrollConstraints as |constraint index|}}
+        {{#if index}}
+          <hr class="has-background-gray-300" />
+        {{/if}}
+        <Mfa::Form::MfaField @fieldType="select" @constraint={{constraint}} @index={{index}} @onSelect={{@onSelect}} />
+      {{/each}}
+    {{/if}}
+  </:additionalContent>
+
+  <:actions>
+    <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onCancel}} data-test-cancel />
+  </:actions>
+</Mfa::SplashCard>
\ No newline at end of file
diff --git a/ui/app/components/mfa/form/choose-method.ts b/ui/app/components/mfa/form/choose-method.ts
new file mode 100644
index 00000000000..54d6988c253
--- /dev/null
+++ b/ui/app/components/mfa/form/choose-method.ts
@@ -0,0 +1,51 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+
+import type MfaConstraint from 'vault/resources/mfa/constraint';
+
+interface Args {
+  constraints: MfaConstraint[];
+  onSelect: CallableFunction;
+}
+
+const METHOD_MAP = {
+  totp: { label: 'TOTP', icon: 'history' },
+  duo: { label: 'Duo', icon: 'duo-color' },
+  okta: { label: 'Okta', icon: 'okta-color' },
+  pingid: { label: 'PingID', icon: 'ping-identity-color' },
+};
+
+export default class MfaFormChooseMethod extends Component<Args> {
+  get description() {
+    return this.singleConstraint
+      ? 'Choose one of the following methods to continue:'
+      : 'Select a method for each enforcement to continue. Choosing a self-enroll method will redirect you to setup your device.';
+  }
+
+  get nonSelfEnrollMethods() {
+    return this.singleConstraint?.methods.filter((m) => !m.self_enrollment_enabled);
+  }
+
+  get selfEnrollConstraints() {
+    return this.args.constraints.filter((c) => c.hasSelfEnrollMethods);
+  }
+
+  get singleConstraint() {
+    // Prioritize self-enroll constraints so the user can setup TOTP before moving onto validating.
+    if (this.selfEnrollConstraints?.length === 1) {
+      return this.selfEnrollConstraints[0];
+    }
+    if (this.args.constraints.length === 1) {
+      return this.args.constraints[0];
+    }
+    return null;
+  }
+
+  // TEMPLATE HELPERS
+  displayIcon = (methodType: 'duo' | 'okta' | 'totp' | 'pingid') => METHOD_MAP[methodType].icon;
+  displayLabel = (methodType: 'duo' | 'okta' | 'totp' | 'pingid') => METHOD_MAP[methodType].label;
+}
diff --git a/ui/app/components/mfa/form/mfa-field.hbs b/ui/app/components/mfa/form/mfa-field.hbs
new file mode 100644
index 00000000000..994235a8b83
--- /dev/null
+++ b/ui/app/components/mfa/form/mfa-field.hbs
@@ -0,0 +1,80 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if (eq @fieldType "passcode")}}
+  {{! PASSCODE INPUT }}
+  <Hds::Form::TextInput::Field
+    {{on "input" (fn this.setPasscode @constraint)}}
+    @isInvalid={{@isInvalid}}
+    @value={{@constraint.passcode}}
+    autocomplete="off"
+    disabled={{@disabled}}
+    name="passcode"
+    placeholder="Enter passcode"
+    data-test-mfa-passcode={{or @index 0}}
+    as |F|
+  >
+    <F.Label data-test-mfa-label>
+      {{@label}}
+    </F.Label>
+  </Hds::Form::TextInput::Field>
+
+{{else if (eq @fieldType "select")}}
+  {{! SELECT METHOD DROPDOWN }}
+  {{#if (gt @constraint.methods.length 1)}}
+    <Hds::Form::Select::Field
+      {{on "change" (fn this.handleSelect @constraint)}}
+      class="has-bottom-margin-m"
+      name={{@constraint.name}}
+      data-test-mfa-select={{@index}}
+      disabled={{@disabled}}
+      as |F|
+    >
+      <F.Label>Multi-factor Login Enforcement</F.Label>
+      <F.HelperText>Select which method you would like to verify with.</F.HelperText>
+      <F.Options>
+        <option value="">Select one</option>
+        {{#each @constraint.methods as |method|}}
+          <option selected={{eq method.id @constraint.selectedMethod.id}} value={{method.id}}>
+            {{method.label}}
+            {{#if method.self_enrollment_enabled}}
+              (supports self-enrollment)
+            {{/if}}
+          </option>
+        {{/each}}
+      </F.Options>
+    </Hds::Form::Select::Field>
+  {{/if}}
+
+{{else if (eq @fieldType "verified")}}
+  {{! PENDING VERIFICATION }}
+  <Hds::Text::Body @tag="p" @weight="semibold" class="has-top-bottom-margin-xxs" data-test-mfa-verified={{@label}}>
+    {{@label}}
+  </Hds::Text::Body>
+  <Hds::Text::Body @tag="p" @color="faint" @size="100" class="has-top-bottom-margin-xxs">
+    Your recently enrolled device will be verified along with any other MFA methods.
+  </Hds::Text::Body>
+  <Hds::Badge @text="Verification pending" />
+
+{{else if (eq @fieldType "push")}}
+  {{! PUSH NOTIFICATION }}
+  <Hds::Text::Body @tag="p" @weight="semibold" class="has-top-bottom-margin-xxs" data-test-mfa-label>
+    {{@label}}
+  </Hds::Text::Body>
+
+  {{#unless @isInvalid}}
+    <Hds::Text::Body @tag="p" @color="faint" @size="100" class="has-top-bottom-margin-xxs" data-test-mfa-push-instruction>
+      Check device for push notification
+    </Hds::Text::Body>
+  {{/unless}}
+
+{{/if}}
+
+{{! Renders method specific validation error }}
+{{#if @isInvalid}}
+  <Hds::Alert @type="compact" @color="critical" class="has-top-margin-xs" as |A|>
+    <A.Description>Validation failed.</A.Description>
+  </Hds::Alert>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/mfa/form/mfa-field.ts b/ui/app/components/mfa/form/mfa-field.ts
new file mode 100644
index 00000000000..0d091afbf2f
--- /dev/null
+++ b/ui/app/components/mfa/form/mfa-field.ts
@@ -0,0 +1,29 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { action } from '@ember/object';
+import Component from '@glimmer/component';
+
+import type { HTMLElementEvent } from 'vault/forms';
+import type MfaConstraint from 'vault/resources/mfa/constraint';
+
+interface Args {
+  constraint: MfaConstraint;
+  onSelect: CallableFunction;
+}
+
+export default class MfaFormMfaField extends Component<Args> {
+  @action
+  setPasscode(constraint: MfaConstraint, e: HTMLElementEvent<HTMLInputElement>) {
+    const { value } = e.target;
+    constraint.setPasscode(value);
+  }
+
+  @action
+  handleSelect(constraint: MfaConstraint, e: HTMLElementEvent<HTMLInputElement>) {
+    const { value: id } = e.target;
+    this.args.onSelect(constraint, id);
+  }
+}
diff --git a/ui/app/components/mfa/form/self-enroll.hbs b/ui/app/components/mfa/form/self-enroll.hbs
new file mode 100644
index 00000000000..5daa36c80e1
--- /dev/null
+++ b/ui/app/components/mfa/form/self-enroll.hbs
@@ -0,0 +1,44 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Mfa::SplashCard
+  @header="Set up MFA TOTP to continue"
+  @subheader="Your organization has enforced MFA TOTP to protect your accounts. Set up to continue."
+  @subtitle={{unless this.hasScannedQrCode "Scan the QR code to continue"}}
+  @description={{this.description}}
+  @renderLogo={{true}}
+  data-test-mfa-form
+>
+
+  {{! Step One: Scan QR Code }}
+  <:qrCode>
+    {{#unless this.hasScannedQrCode}}
+      <Mfa::QrCodeCard @qrCode={{this.selfEnrollConstraint.qrCode}} />
+    {{/unless}}
+  </:qrCode>
+
+  {{! Step Two: Validate TOTP }}
+  <:additionalContent>
+    {{#if this.hasScannedQrCode}}
+      <form id="mfa-enroll-form" {{on "submit" this.handleSubmit}}>
+        <Mfa::Form::MfaField
+          @fieldType="passcode"
+          @constraint={{this.selfEnrollConstraint}}
+          @label="Enter your one-time code"
+        />
+      </form>
+    {{/if}}
+  </:additionalContent>
+
+  <:actions>
+    {{#if this.hasScannedQrCode}}
+      <Hds::Button @text="Verify" form="mfa-enroll-form" id="validate" type="submit" data-test-button="Verify" />
+    {{else}}
+      <Hds::Button @text="Continue" {{on "click" (fn (mut this.hasScannedQrCode) true)}} data-test-button="Continue" />
+    {{/if}}
+    <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onCancel}} data-test-cancel />
+  </:actions>
+
+</Mfa::SplashCard>
\ No newline at end of file
diff --git a/ui/app/components/mfa/form/self-enroll.ts b/ui/app/components/mfa/form/self-enroll.ts
new file mode 100644
index 00000000000..cd59e7cc64e
--- /dev/null
+++ b/ui/app/components/mfa/form/self-enroll.ts
@@ -0,0 +1,47 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { action } from '@ember/object';
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { HTMLElementEvent } from 'vault/forms';
+
+import type MfaConstraint from 'vault/resources/mfa/constraint';
+
+interface Args {
+  constraints: MfaConstraint[];
+  onVerify: CallableFunction;
+  onCancel: CallableFunction;
+}
+
+export default class MfaFormSelfEnroll extends Component<Args> {
+  @tracked hasScannedQrCode = false;
+
+  get description() {
+    return this.hasScannedQrCode
+      ? 'To verify your device, enter the code generated from your authenticator.'
+      : 'Scan the QR code with your authenticator app. If you currently do not have a device on hand, you can copy the MFA secret below and enter it manually.';
+  }
+
+  get selfEnrollConstraint() {
+    // Find the constraint with the QR code, only one will have one at a time
+    return this.args.constraints.find((c) => !!c.qrCode);
+  }
+
+  @action
+  handleSubmit(e: HTMLElementEvent<HTMLFormElement>) {
+    e.preventDefault();
+    // Clear out the QR Code
+    const constraint = this.findConstraint();
+    if (constraint) {
+      constraint.qrCode = '';
+    }
+
+    this.args.onVerify();
+  }
+
+  private findConstraint = () =>
+    this.args.constraints.find((c) => c.name === this.selfEnrollConstraint?.name);
+}
diff --git a/ui/app/components/mfa/form/verify.hbs b/ui/app/components/mfa/form/verify.hbs
new file mode 100644
index 00000000000..f8c3d38d867
--- /dev/null
+++ b/ui/app/components/mfa/form/verify.hbs
@@ -0,0 +1,101 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Mfa::SplashCard
+  @header="Verify your identity"
+  @subheader="Multi-factor authentication is enabled for your account."
+  @description={{this.description}}
+  @renderLogo={{true}}
+  data-test-mfa-form
+>
+
+  <:alerts>
+    <MessageError @errorMessage={{@error}} />
+  </:alerts>
+
+  <:additionalContent>
+    <form id="mfa-form" {{on "submit" this.handleSubmit}}>
+      {{#each (this.sortConstraints @constraints) as |constraint index|}}
+        {{#if index}}
+          <hr class="has-background-gray-300" />
+        {{/if}}
+        {{! Only render the select if there is more than one constraint
+        because otherwise the method is selected in Mfa::Form::ChooseMethod }}
+        {{#if (gt @constraints.length 1)}}
+          <Mfa::Form::MfaField
+            @fieldType="select"
+            @constraint={{constraint}}
+            @index={{index}}
+            @onSelect={{@onSelect}}
+            @disabled={{@methodAlreadyEnrolled constraint.selectedMethod.id}}
+          />
+        {{/if}}
+
+        {{#if constraint.selectedMethod.uses_passcode}}
+          {{#if (and (@methodAlreadyEnrolled constraint.selectedMethod.id) (not @error))}}
+            <Mfa::Form::MfaField
+              @fieldType="verified"
+              @label={{constraint.selectedMethod.label}}
+              @isInvalid={{this.hasValidationError constraint.selectedMethod.id}}
+            />
+          {{else}}
+            <Mfa::Form::MfaField
+              @fieldType="passcode"
+              @constraint={{constraint}}
+              @disabled={{or @isLoading @countdown}}
+              @index={{index}}
+              @isInvalid={{this.hasValidationError constraint.selectedMethod.id}}
+              @label={{constraint.selectedMethod.label}}
+            />
+          {{/if}}
+        {{else if (or (eq constraint.methods.length 1) @isLoading)}}
+          <Mfa::Form::MfaField
+            @fieldType="push"
+            @label={{constraint.selectedMethod.label}}
+            @isInvalid={{this.hasValidationError constraint.selectedMethod.id}}
+          />
+        {{/if}}
+
+      {{/each}}
+    </form>
+
+    {{#if @countdown}}
+      <AlertInline @type="danger" class="has-top-padding-m" @message={{@codeDelayMessage}} />
+    {{/if}}
+  </:additionalContent>
+
+  <:actions>
+    <Hds::Button
+      @icon={{if @isLoading "loading"}}
+      @text="Verify"
+      disabled={{or @isLoading @countdown}}
+      form="mfa-form"
+      id="validate"
+      type="submit"
+      data-test-button="Verify"
+    />
+
+    {{#if (and (gt this.singleConstraint.methods.length 1) (not @isLoading))}}
+      <Hds::Button
+        {{on "click" (fn @onSelect this.singleConstraint "")}}
+        @color="tertiary"
+        @icon="arrow-right"
+        @iconPosition="trailing"
+        @text="Try another method"
+        disabled={{@countdown}}
+        data-test-button="Try another method"
+      />
+    {{else}}
+      <Hds::Button {{on "click" @onCancel}} @color="secondary" @text="Cancel" disabled={{@countdown}} data-test-cancel />
+    {{/if}}
+
+    {{#if @countdown}}
+      <Hds::Alert @type="compact" @icon="delay" class="align-self-center" as |A|>
+        <A.Description data-test-mfa-countdown>{{@countdown}}</A.Description>
+      </Hds::Alert>
+    {{/if}}
+  </:actions>
+
+</Mfa::SplashCard>
\ No newline at end of file
diff --git a/ui/app/components/mfa/form/verify.ts b/ui/app/components/mfa/form/verify.ts
new file mode 100644
index 00000000000..92fd6c40174
--- /dev/null
+++ b/ui/app/components/mfa/form/verify.ts
@@ -0,0 +1,59 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { numberToWord } from 'vault/helpers/number-to-word';
+
+import type MfaConstraint from 'vault/resources/mfa/constraint';
+import type { HTMLElementEvent } from 'vault/forms';
+
+interface Args {
+  codeDelayMessage: string;
+  constraints: MfaConstraint[];
+  countdown: string;
+  error: string;
+  isLoading: boolean;
+  methodAlreadyEnrolled: CallableFunction;
+  onCancel: CallableFunction;
+  onSelect: CallableFunction;
+  onVerify: CallableFunction;
+}
+
+export default class MfaFormVerify extends Component<Args> {
+  get description() {
+    if (this.args.constraints.length > 1) {
+      const num = numberToWord(this.args.constraints.length, true);
+      return `${num} methods are required for successful authentication.`;
+    }
+    if (this.singleConstraint?.selectedMethod?.uses_passcode) {
+      return 'Enter your authentication code to log in.';
+    }
+    // Otherwise it's a single push notification and we do not need a description.
+    return '';
+  }
+
+  get singleConstraint() {
+    return this.args.constraints.length === 1 ? this.args.constraints[0] : null;
+  }
+
+  @action
+  handleSubmit(e: HTMLElementEvent<HTMLFormElement>) {
+    e.preventDefault();
+    this.args.onVerify();
+  }
+
+  // Template helper
+  sortConstraints = (constraints: MfaConstraint[]) => {
+    const userInteraction = constraints.filter((c) => !c.selectedMethod);
+    const others = constraints.filter((c) => c.selectedMethod);
+    return [...userInteraction, ...others];
+  };
+
+  // Even if multiple methods fail, the API seems to only ever return whichever failed first.
+  // Sample error message:
+  // 'login MFA validation failed for methodID: [9e953c14-9d8e-7443-079e-4b13723e2aef]'
+  hasValidationError = (id: string) => this.args.error?.includes(id);
+}
diff --git a/ui/app/templates/components/mfa/login-enforcement-list-item.hbs b/ui/app/components/mfa/login-enforcement-list-item.hbs
similarity index 91%
rename from ui/app/templates/components/mfa/login-enforcement-list-item.hbs
rename to ui/app/components/mfa/login-enforcement-list-item.hbs
index 1827e60c27b..4d9a0d227f4 100644
--- a/ui/app/templates/components/mfa/login-enforcement-list-item.hbs
+++ b/ui/app/components/mfa/login-enforcement-list-item.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LinkedBlock
   class="list-item-row"
@@ -27,17 +27,15 @@
             data-test-popup-menu-trigger
           />
           <dd.Interactive
-            @text="Details"
             @route="vault.cluster.access.mfa.enforcements.enforcement"
             @model={{@model.name}}
             data-test-list-item-link="details"
-          />
+          >Details</dd.Interactive>
           <dd.Interactive
-            @text="Edit"
             @route="vault.cluster.access.mfa.enforcements.enforcement.edit"
             @model={{@model.name}}
             data-test-list-item-link="edit"
-          />
+          >Edit</dd.Interactive>
         </Hds::Dropdown>
       </div>
     </div>
diff --git a/ui/app/templates/components/mfa/method-form.hbs b/ui/app/components/mfa/method-form.hbs
similarity index 97%
rename from ui/app/templates/components/mfa/method-form.hbs
rename to ui/app/components/mfa/method-form.hbs
index 23b826161d6..31e8bc9da0e 100644
--- a/ui/app/templates/components/mfa/method-form.hbs
+++ b/ui/app/components/mfa/method-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-sideless is-fullwidth is-marginless" ...attributes>
   {{#each @model.attrs as |attr|}}
diff --git a/ui/app/components/mfa/method-form.js b/ui/app/components/mfa/method-form.js
index 1d3fb64b555..575ae038b21 100644
--- a/ui/app/components/mfa/method-form.js
+++ b/ui/app/components/mfa/method-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/mfa/method-list-item.hbs b/ui/app/components/mfa/method-list-item.hbs
new file mode 100644
index 00000000000..b29f269b0c4
--- /dev/null
+++ b/ui/app/components/mfa/method-list-item.hbs
@@ -0,0 +1,54 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<LinkedBlock
+  class="list-item-row"
+  @params={{array "vault.cluster.access.mfa.methods.method" @model.id}}
+  data-test-mfa-method-list-item={{@model.id}}
+>
+  <div class="level is-mobile">
+    <div class="level-left">
+      <div class="is-flex-row">
+        <Hds::Icon @size="24" @name={{@model.icon}} class="has-text-grey" data-test-mfa-method-list-icon={{@model.type}} />
+        <div>
+          <span class="has-text-weight-semibold has-text-black">
+            {{@model.name}}
+          </span>
+          <Hds::Badge @text={{@model.id}} class="has-left-margin-xs" />
+          {{#if @model.namespace_path}}
+            <div class="has-top-margin-xs">
+              <code class="is-size-9">
+                Namespace:
+                {{@model.namespace_path}}
+              </code>
+            </div>
+          {{/if}}
+        </div>
+      </div>
+    </div>
+    <div class="level-right is-flex is-paddingless is-marginless">
+      <div class="level-item">
+        <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
+          <dd.ToggleIcon
+            @icon="more-horizontal"
+            @text="Manage M-F-A method"
+            @hasChevron={{false}}
+            data-test-popup-menu-trigger
+          />
+          <dd.Interactive
+            @route="vault.cluster.access.mfa.methods.method"
+            @model={{@model.id}}
+            data-test-mfa-method-menu-link="details"
+          >Details</dd.Interactive>
+          <dd.Interactive
+            @route="vault.cluster.access.mfa.methods.method.edit"
+            @model={{@model.id}}
+            data-test-mfa-method-menu-link="edit"
+          >Edit</dd.Interactive>
+        </Hds::Dropdown>
+      </div>
+    </div>
+  </div>
+</LinkedBlock>
\ No newline at end of file
diff --git a/ui/app/components/mfa/mfa-form.hbs b/ui/app/components/mfa/mfa-form.hbs
new file mode 100644
index 00000000000..8471f4f1bec
--- /dev/null
+++ b/ui/app/components/mfa/mfa-form.hbs
@@ -0,0 +1,32 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if this.fetchQrCode.isRunning}}
+  <Mfa::SplashCard @header="Redirecting..." @isLoading={{true}} data-test-mfa-form />
+{{else if this.currentSelfEnrollConstraint.qrCode}}
+  {{! Clicking "Continue" clears this.currentSelfEnrollConstraint.qrCode }}
+  <Mfa::Form::SelfEnroll
+    @constraints={{this.constraints}}
+    @onCancel={{@onCancel}}
+    @onVerify={{this.checkStateAndValidate}}
+  />
+{{else if (and (not this.validate.isRunning) this.needsToChoose)}}
+  {{! This component only renders when one enforcement with multiple methods is configured
+  Or there are multiple enforcements and each one has methods that support self-enrollment }}
+  <Mfa::Form::ChooseMethod @constraints={{this.constraints}} @onCancel={{@onCancel}} @onSelect={{this.onSelect}} />
+{{else}}
+  <Mfa::Form::Verify
+    @codeDelayMessage={{this.codeDelayMessage}}
+    @constraints={{this.constraints}}
+    @countdown={{this.countdown}}
+    @error={{this.error}}
+    {{! Only this component renders whenever validate.isRunning (even if the user verified in the SelfEnroll component) }}
+    @isLoading={{or this.validate.isRunning @loginAndTransition.isRunning}}
+    @methodAlreadyEnrolled={{this.methodAlreadyEnrolled}}
+    @onCancel={{@onCancel}}
+    @onSelect={{this.onSelect}}
+    @onVerify={{this.checkStateAndValidate}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/mfa/mfa-form.js b/ui/app/components/mfa/mfa-form.js
deleted file mode 100644
index 20b09ac4f63..00000000000
--- a/ui/app/components/mfa/mfa-form.js
+++ /dev/null
@@ -1,125 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { service } from '@ember/service';
-import { tracked } from '@glimmer/tracking';
-import { action, set } from '@ember/object';
-import { task, timeout } from 'ember-concurrency';
-import { numberToWord } from 'vault/helpers/number-to-word';
-/**
- * @module MfaForm
- * The MfaForm component is used to enter a passcode when mfa is required to login
- *
- * @example
- * ```js
- * <Mfa::MfaForm @clusterId={this.model.id} @authData={this.authData} />
- * ```
- * @param {string} clusterId - id of selected cluster
- * @param {object} authData - data from initial auth request -- { mfa_requirement, backend, data }
- * @param {function} onSuccess - fired when passcode passes validation
- * @param {function} onError - fired for multi-method or non-passcode method validation errors
- */
-
-export const TOTP_VALIDATION_ERROR =
-  'The passcode failed to validate. If you entered the correct passcode, contact your administrator.';
-
-export default class MfaForm extends Component {
-  @service auth;
-
-  @tracked countdown;
-  @tracked error;
-  @tracked codeDelayMessage;
-
-  constructor() {
-    super(...arguments);
-    // trigger validation immediately when passcode is not required
-    const passcodeOrSelect = this.constraints.filter((constraint) => {
-      return constraint.methods.length > 1 || constraint.methods.find((m) => m.uses_passcode);
-    });
-    if (!passcodeOrSelect.length) {
-      this.validate.perform();
-    }
-  }
-
-  get constraints() {
-    return this.args.authData.mfa_requirement.mfa_constraints;
-  }
-  get multiConstraint() {
-    return this.constraints.length > 1;
-  }
-  get singleConstraintMultiMethod() {
-    return !this.isMultiConstraint && this.constraints[0].methods.length > 1;
-  }
-  get singlePasscode() {
-    return (
-      !this.isMultiConstraint &&
-      this.constraints[0].methods.length === 1 &&
-      this.constraints[0].methods[0].uses_passcode
-    );
-  }
-  get description() {
-    let base = 'Multi-factor authentication is enabled for your account.';
-    if (this.singlePasscode) {
-      base += ' Enter your authentication code to log in.';
-    }
-    if (this.singleConstraintMultiMethod) {
-      base += ' Select the MFA method you wish to use.';
-    }
-    if (this.multiConstraint) {
-      const num = this.constraints.length;
-      base += ` ${numberToWord(num, true)} methods are required for successful authentication.`;
-    }
-    return base;
-  }
-
-  @task *validate() {
-    try {
-      this.error = null;
-      const response = yield this.auth.totpValidate({
-        clusterId: this.args.clusterId,
-        ...this.args.authData,
-      });
-      this.args.onSuccess(response);
-    } catch (error) {
-      const errors = error.errors || [];
-      const codeUsed = errors.find((e) => e.includes('code already used'));
-      const rateLimit = errors.find((e) => e.includes('maximum TOTP validation attempts'));
-      const delayMessage = codeUsed || rateLimit;
-
-      if (delayMessage) {
-        const reason = codeUsed ? 'This code has already been used' : 'Maximum validation attempts exceeded';
-        this.codeDelayMessage = `${reason}. Please wait until a new code is available.`;
-        this.newCodeDelay.perform(delayMessage);
-      } else if (this.singlePasscode) {
-        this.error = TOTP_VALIDATION_ERROR;
-      } else {
-        this.args.onError(this.auth.handleError(error));
-      }
-    }
-  }
-
-  @task *newCodeDelay(message) {
-    // parse validity period from error string to initialize countdown
-    this.countdown = parseInt(message.match(/(\d\w seconds)/)[0].split(' ')[0]);
-    while (this.countdown) {
-      yield timeout(1000);
-      this.countdown--;
-    }
-  }
-
-  @action onSelect(constraint, id) {
-    set(constraint, 'selectedId', id);
-    set(
-      constraint,
-      'selectedMethod',
-      constraint.methods.find((m) => m.id === id)
-    );
-  }
-  @action submit(e) {
-    e.preventDefault();
-    this.validate.perform();
-  }
-}
diff --git a/ui/app/components/mfa/mfa-form.ts b/ui/app/components/mfa/mfa-form.ts
new file mode 100644
index 00000000000..ded17a63663
--- /dev/null
+++ b/ui/app/components/mfa/mfa-form.ts
@@ -0,0 +1,215 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Ember from 'ember';
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { task, timeout } from 'ember-concurrency';
+import errorMessage from 'vault/utils/error-message';
+import MfaConstraint from 'vault/resources/mfa/constraint';
+
+import type AuthService from 'vault/vault/services/auth';
+import type Store from '@ember-data/store';
+import type VersionService from 'vault/services/version';
+import type { AuthSuccessResponse } from 'vault/vault/services/auth';
+import type { Task } from 'ember-concurrency';
+import type { MfaAuthData } from 'vault/vault/auth/mfa';
+
+/**
+ * @module MfaForm
+ * The MfaForm component is used to enter a passcode when mfa is required to login
+ *
+ * @example
+ * ```js
+ * <Mfa::MfaForm @clusterId={this.model.id} @authData={this.authData} />
+ * ```
+ * @param {string} clusterId - id of selected cluster
+ * @param {object} authData - data from initial auth request -- { mfaRequirement, backend, data }
+ * @param {function} loginAndTransition - fired when passcode passes validation
+ * @param {function} onCancel - callback that clears @authData which resets MFA and returns to the login form
+ */
+
+export const TOTP_VALIDATION_ERROR =
+  'The passcode failed to validate. If you entered the correct passcode, please wait for a new code and try again. If the problem persists contact your administrator.';
+
+interface Args {
+  authData: MfaAuthData;
+  clusterId: string;
+  loginAndTransition: Task<AuthSuccessResponse, [AuthSuccessResponse]>;
+  onCancel: CallableFunction;
+}
+
+export default class MfaForm extends Component<Args> {
+  @service declare readonly auth: AuthService;
+  @service declare readonly store: Store;
+  @service declare readonly version: VersionService;
+
+  @tracked constraints: MfaConstraint[] = [];
+  @tracked codeDelayMessage = '';
+  @tracked countdown = 0;
+  @tracked error = '';
+  // Self-enrollment is per MFA method, not per login enforcement (constraint)
+  // Track method IDs used to fetch a QR code so we don't re-request if a user just enrolled.
+  @tracked enrolledMethods = new Set<string>();
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+
+    const { mfa_constraints = [] } = this.args.authData.mfaRequirement;
+    this.constraints = mfa_constraints.map((constraint) => new MfaConstraint(constraint));
+
+    // Trigger validation immediately if passcode or user selection is not required
+    this.checkStateAndValidate();
+
+    // Filter for constraints that have only one MFA method and it supports self-enrollment
+    const filteredConstraints = this.constraints.filter(
+      (c) => c.hasSelfEnrollMethods && c.methods.length === 1
+    );
+    // If there is only one then fetch the QR code because self-enrolling is unavoidable.
+    if (filteredConstraints.length === 1 && filteredConstraints[0]) {
+      const [constraint] = filteredConstraints;
+      const method = constraint.selfEnrollMethods[0];
+      if (method) this.fetchQrCode.perform(method.id, constraint);
+    }
+  }
+
+  get everyConstraintSatisfied() {
+    return this.constraints.every((constraint) => constraint.isSatisfied);
+  }
+
+  get currentSelfEnrollConstraint() {
+    return this.constraints.find((c) => c.qrCode !== '');
+  }
+
+  get needsToChoose() {
+    // If any self-enroll constraints are missing selections
+    const missingSelfEnrollSelection = this.constraints
+      .filter((c) => c.hasSelfEnrollMethods)
+      .some((c) => !c.selectedMethod);
+    // If there is only one constraint but it has multiple methods
+    const missingSelection = this.constraints.length === 1 && !this.constraints.some((c) => c.selectedMethod);
+    return missingSelfEnrollSelection || missingSelection;
+  }
+
+  // There is only one login enforcement with only one method configured
+  get singleLoginEnforcement() {
+    if (this.constraints.length === 1) {
+      const loginEnforcement = this.constraints[0];
+      // Return a value if there is only one MFA method configured.
+      return loginEnforcement?.methods.length === 1 ? loginEnforcement : null;
+    }
+    return null;
+  }
+
+  validate = task(async () => {
+    const { authMethodType, authMountPath, mfaRequirement } = this.args.authData;
+    const submitData = {
+      mfa_request_id: mfaRequirement.mfa_request_id,
+      mfa_constraints: this.constraints.map((c) => c.validateData),
+    };
+    try {
+      this.error = '';
+      const response = await this.auth.totpValidate({
+        clusterId: this.args.clusterId,
+        authMethodType,
+        authMountPath,
+        mfaRequirement: submitData,
+      });
+
+      // calls loginAndTransition in auth.js controller
+      await this.args.loginAndTransition.unlinked().perform(response);
+    } catch (error) {
+      // Reset enrolled methods if there's an error
+      this.enrolledMethods = new Set<string>();
+      const errorMsg = errorMessage(error);
+      const codeUsed = errorMsg.includes('code already used');
+      const rateLimit = errorMsg.includes('maximum TOTP validation attempts');
+      const delayMessage = codeUsed || rateLimit ? errorMsg : null;
+      if (delayMessage) {
+        const reason = codeUsed ? 'This code has already been used' : 'Maximum validation attempts exceeded';
+        this.codeDelayMessage = `${reason}. Please wait until a new code is available.`;
+        this.newCodeDelay.perform(delayMessage);
+      } else if (this.singleLoginEnforcement?.selectedMethod?.uses_passcode) {
+        this.error = TOTP_VALIDATION_ERROR;
+      } else {
+        this.error = errorMsg;
+      }
+    }
+  });
+
+  fetchQrCode = task(async (mfa_method_id: string, constraint: MfaConstraint) => {
+    // Self-enrollment is an enterprise only feature
+    if (this.version.isCommunity) return;
+
+    const adapter = this.store.adapterFor('application');
+    const { mfaRequirement } = this.args.authData;
+    try {
+      const { data } = await adapter.ajax('/v1/identity/mfa/method/totp/self-enroll', 'POST', {
+        unauthenticated: true,
+        data: { mfa_method_id, mfa_request_id: mfaRequirement.mfa_request_id },
+      });
+      if (data?.url) {
+        // Set QR code which recomputes currentSelfEnrollConstraint and renders it for the user to scan
+        constraint.qrCode = data.url;
+        // Add mfa_method_id to list of already enrolled methods for client-side tracking
+        this.enrolledMethods.add(mfa_method_id);
+        return;
+      }
+      // Not sure it's realistic to get here without the endpoint throwing an error, but just in case!
+      this.error = 'There was a problem generating the QR code. Please try again.';
+    } catch (error) {
+      this.error = errorMessage(error);
+    }
+  });
+
+  newCodeDelay = task(async (errorMessage) => {
+    let delay;
+
+    // parse validity period from error string to initialize countdown
+    const delayRegExMatches = errorMessage.match(/(\d+\w seconds)/);
+    if (delayRegExMatches && delayRegExMatches.length) {
+      delay = delayRegExMatches[0].split(' ')[0];
+    } else {
+      // default to 30 seconds if error message doesn't specify one
+      delay = 30;
+    }
+    this.countdown = parseInt(delay);
+
+    // skip countdown in testing environment
+    if (Ember.testing) return;
+
+    while (this.countdown > 0) {
+      await timeout(1000);
+      this.countdown--;
+    }
+  });
+
+  @action
+  async onSelect(constraint: MfaConstraint, methodId: string) {
+    // Set selectedMethod on the MfaConstraint class
+    // If id is an empty string, it clears the selected method
+    constraint.setSelectedMethod(methodId);
+
+    const selectedMethod = constraint.selectedMethod;
+    if (selectedMethod?.self_enrollment_enabled && !this.methodAlreadyEnrolled(selectedMethod.id)) {
+      await this.fetchQrCode.perform(selectedMethod.id, constraint);
+    }
+
+    this.checkStateAndValidate();
+  }
+
+  @action
+  checkStateAndValidate() {
+    // Whenever all login enforcements are satisfied perform validation to save the user extra clicks
+    if (this.everyConstraintSatisfied) {
+      this.validate.perform();
+    }
+  }
+
+  // Template helpers
+  methodAlreadyEnrolled = (methodId: string) => this.enrolledMethods.has(methodId);
+}
diff --git a/ui/app/templates/components/mfa/mfa-login-enforcement-form.hbs b/ui/app/components/mfa/mfa-login-enforcement-form.hbs
similarity index 95%
rename from ui/app/templates/components/mfa/mfa-login-enforcement-form.hbs
rename to ui/app/components/mfa/mfa-login-enforcement-form.hbs
index 93b94b06443..063cb2cc771 100644
--- a/ui/app/templates/components/mfa/mfa-login-enforcement-form.hbs
+++ b/ui/app/components/mfa/mfa-login-enforcement-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div ...attributes>
   <FormFieldLabel
@@ -35,8 +35,9 @@
       {{! component only computes inputValue on init -- ensure Ember Data hasMany promise has resolved }}
       {{#if @model.mfa_methods.isFulfilled}}
         <SearchSelect
+          @id="methods"
           @placeholder="Type to search for existing MFA methods"
-          @inputValue={{map-by "id" @model.mfa_methods}}
+          @inputValue={{map-by "id" this.mfaMethods}}
           @shouldRenderName={{true}}
           @disallowNewItems={{true}}
           @models={{array "mfa-method"}}
@@ -62,7 +63,7 @@
         <InfoTableRow @label={{target.label}} class="is-flex-grow-1 has-no-shadow">
           {{#if target.value.id}}
             {{target.value.name}}
-            <span class="tag has-left-margin-s">{{target.value.id}}</span>
+            <Hds::Badge @text={{target.value.id}} class="has-left-margin-s" />
           {{else}}
             {{target.value}}
           {{/if}}
@@ -114,6 +115,7 @@
           />
         {{else}}
           <SearchSelect
+            @id="existing-targets"
             @placeholder="Search for an existing target"
             @options={{this.searchSelect.options}}
             @parentManageSelected={{this.searchSelect.selected}}
diff --git a/ui/app/components/mfa/mfa-login-enforcement-form.js b/ui/app/components/mfa/mfa-login-enforcement-form.js
index 6d9109bda7a..dd8add26a34 100644
--- a/ui/app/components/mfa/mfa-login-enforcement-form.js
+++ b/ui/app/components/mfa/mfa-login-enforcement-form.js
@@ -1,15 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { tracked } from '@glimmer/tracking';
 import { action } from '@ember/object';
-import { A } from '@ember/array';
 import { service } from '@ember/service';
 import { task } from 'ember-concurrency';
-import handleHasManySelection from 'core/utils/search-select-has-many';
+import { addManyToArray, addToArray } from 'vault/helpers/add-to-array';
+import { removeFromArray } from 'vault/helpers/remove-from-array';
+import AuthMethodResource from 'vault/resources/auth/method';
 
 /**
  * @module MfaLoginEnforcementForm
@@ -31,6 +32,7 @@ import handleHasManySelection from 'core/utils/search-select-has-many';
 export default class MfaLoginEnforcementForm extends Component {
   @service store;
   @service flashMessages;
+  @service api;
 
   targetTypes = [
     { label: 'Authentication mount', type: 'accessor', key: 'auth_method_accessors' },
@@ -41,16 +43,18 @@ export default class MfaLoginEnforcementForm extends Component {
   searchSelectOptions = null;
 
   @tracked name;
-  @tracked targets = A([]);
+  @tracked targets = [];
   @tracked selectedTargetType = 'accessor';
   @tracked selectedTargetValue = null;
   @tracked searchSelect = {
     options: [],
     selected: [],
   };
-  @tracked authMethods = A([]);
+  @tracked authMethods = [];
   @tracked modelErrors;
 
+  mfaMethods = []; // does not change after initial fetch, thus not tracked
+
   constructor() {
     super(...arguments);
     // aggregate different target array properties on model into flat list
@@ -59,13 +63,14 @@ export default class MfaLoginEnforcementForm extends Component {
     this.resetTargetState();
     // only auth method types that have mounts can be selected as targets -- fetch from sys/auth and map by type
     this.fetchAuthMethods();
+    this.fetchMfaMethods();
   }
 
   async flattenTargets() {
     for (const { label, key } of this.targetTypes) {
       const targetArray = await this.args.model[key];
       const targets = targetArray.map((value) => ({ label, key, value }));
-      this.targets.addObjects(targets);
+      this.targets = addManyToArray(this.targets, targets);
     }
   }
   async resetTargetState() {
@@ -75,7 +80,7 @@ export default class MfaLoginEnforcementForm extends Component {
       const types = ['identity/group', 'identity/entity'];
       for (const type of types) {
         try {
-          options[type] = (await this.store.query(type, {})).toArray();
+          options[type] = await this.store.query(type, {});
         } catch (error) {
           options[type] = [];
         }
@@ -90,8 +95,16 @@ export default class MfaLoginEnforcementForm extends Component {
     }
   }
   async fetchAuthMethods() {
-    const mounts = (await this.store.findAll('auth-method')).toArray();
-    this.authMethods = mounts.map((auth) => auth.type);
+    const { data } = await this.api.sys.authListEnabledMethods();
+    this.authMethods = this.api
+      .responseObjectToArray(data, 'path')
+      .map((method) => new AuthMethodResource(method, this).methodType)
+      .uniq();
+  }
+
+  async fetchMfaMethods() {
+    // mfa_methods is a hasMany on the model, thus returning a PromiseProxyArray. Before it can be accessed on the template we need to resolve it first.
+    this.mfaMethods = await this.args.model.mfa_methods;
   }
 
   get selectedTarget() {
@@ -103,7 +116,6 @@ export default class MfaLoginEnforcementForm extends Component {
 
   updateModelForKey(key) {
     const newValue = this.targets.filter((t) => t.key === key).map((t) => t.value);
-    // Set the model value directly instead of using Array methods (like .addObject)
     this.args.model[key] = newValue;
   }
 
@@ -127,8 +139,18 @@ export default class MfaLoginEnforcementForm extends Component {
 
   @action
   async onMethodChange(selectedIds) {
+    // first make sure the async relationship is loaded
     const methods = await this.args.model.mfa_methods;
-    handleHasManySelection(selectedIds, methods, this.store, 'mfa-method');
+    // then remove items that are no longer selected
+    const updatedList = methods.filter((model) => {
+      return selectedIds.includes(model.id);
+    });
+    // then add selected items that don't exist in the list already
+    const modelIds = updatedList.map((model) => model.id);
+    const toAdd = selectedIds
+      .filter((id) => !modelIds.includes(id))
+      .map((id) => this.store.peekRecord('mfa-method', id));
+    this.args.model.mfa_methods = addManyToArray(updatedList, toAdd);
   }
 
   @action
@@ -151,7 +173,7 @@ export default class MfaLoginEnforcementForm extends Component {
   addTarget() {
     const { label, key } = this.selectedTarget;
     const value = this.selectedTargetValue;
-    this.targets.addObject({ label, value, key });
+    this.targets = addToArray(this.targets, { label, value, key });
     // recalculate value for appropriate model property
     this.updateModelForKey(key);
     this.selectedTargetValue = null;
@@ -159,7 +181,7 @@ export default class MfaLoginEnforcementForm extends Component {
   }
   @action
   removeTarget(target) {
-    this.targets.removeObject(target);
+    this.targets = removeFromArray(this.targets, target);
     // recalculate value for appropriate model property
     this.updateModelForKey(target.key);
   }
diff --git a/ui/app/templates/components/mfa/mfa-login-enforcement-header.hbs b/ui/app/components/mfa/mfa-login-enforcement-header.hbs
similarity index 98%
rename from ui/app/templates/components/mfa/mfa-login-enforcement-header.hbs
rename to ui/app/components/mfa/mfa-login-enforcement-header.hbs
index 571c6c70dc5..420960fafbc 100644
--- a/ui/app/templates/components/mfa/mfa-login-enforcement-header.hbs
+++ b/ui/app/components/mfa/mfa-login-enforcement-header.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @isInline}}
   <h3 class="title is-5" data-test-mleh-title>Enforcement</h3>
diff --git a/ui/app/components/mfa/mfa-login-enforcement-header.js b/ui/app/components/mfa/mfa-login-enforcement-header.js
index 04ab55106e0..dcae0f350c9 100644
--- a/ui/app/components/mfa/mfa-login-enforcement-header.js
+++ b/ui/app/components/mfa/mfa-login-enforcement-header.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -41,7 +41,7 @@ export default class MfaLoginEnforcementHeaderComponent extends Component {
   async fetchEnforcements() {
     try {
       // cache initial values for lookup in select handler
-      this._enforcements = (await this.store.query('mfa-login-enforcement', {})).toArray();
+      this._enforcements = await this.store.query('mfa-login-enforcement', {});
       this.enforcements = [...this._enforcements];
     } catch (error) {
       this.enforcements = [];
diff --git a/ui/app/components/mfa/mfa-setup-step-one.hbs b/ui/app/components/mfa/mfa-setup-step-one.hbs
new file mode 100644
index 00000000000..5090fe5f4ff
--- /dev/null
+++ b/ui/app/components/mfa/mfa-setup-step-one.hbs
@@ -0,0 +1,44 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Mfa::SplashCard @header={{@header}} @description={{@description}} data-test-step-one>
+
+  <:alerts>
+    <MessageError @errorMessage={{this.error}} />
+  </:alerts>
+
+  <:additionalContent>
+    <form id="mfa-setup-step-one" {{on "submit" this.verifyUUID}}>
+      <label class="is-label">
+        Method ID
+      </label>
+
+      <p class="sub-text">Enter the UUID for your multi-factor authentication method. This can be provided to you by your
+        administrator.</p>
+      <Input
+        id="uuid"
+        name="uuid"
+        class="input"
+        autocomplete="off"
+        spellcheck="false"
+        @value={{this.UUID}}
+        data-test-input="uuid"
+      />
+    </form>
+  </:additionalContent>
+
+  <:actions>
+    <Hds::Button
+      @text="Verify"
+      id="continue"
+      type="submit"
+      form="mfa-setup-step-one"
+      disabled={{is-empty-value this.UUID}}
+      data-test-verify
+    />
+    <Hds::Button @text="Cancel" @color="secondary" id="cancel" {{on "click" this.redirectPreviousPage}} />
+  </:actions>
+
+</Mfa::SplashCard>
\ No newline at end of file
diff --git a/ui/app/components/mfa/mfa-setup-step-one.js b/ui/app/components/mfa/mfa-setup-step-one.js
index 64e30332802..d73bdc643c1 100644
--- a/ui/app/components/mfa/mfa-setup-step-one.js
+++ b/ui/app/components/mfa/mfa-setup-step-one.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/mfa/mfa-setup-step-two.hbs b/ui/app/components/mfa/mfa-setup-step-two.hbs
new file mode 100644
index 00000000000..42cada20c1d
--- /dev/null
+++ b/ui/app/components/mfa/mfa-setup-step-two.hbs
@@ -0,0 +1,29 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Mfa::SplashCard @header={{@header}} @description={{@description}} data-test-step-two>
+
+  <:alerts>
+    <MessageError @errorMessage={{this.error}} />
+    {{#if @warning}}
+      <Hds::Alert @type="inline" @color="highlight" class="has-bottom-margin-s" data-test-mfa-enabled-warning as |A|>
+        <A.Title>MFA enabled</A.Title>
+        <A.Description>{{@warning}}</A.Description>
+      </Hds::Alert>
+    {{/if}}
+  </:alerts>
+
+  <:qrCode>
+    {{#if @qrCode}}
+      <Mfa::QrCodeCard @qrCode={{@qrCode}} />
+    {{/if}}
+  </:qrCode>
+
+  <:actions>
+    <Hds::Button @text="Restart setup" @color="critical" id="restart" {{on "click" this.restartSetup}} data-test-restart />
+    <Hds::Button @text="Done" id="cancel" {{on "click" this.redirectPreviousPage}} data-test-done />
+  </:actions>
+
+</Mfa::SplashCard>
\ No newline at end of file
diff --git a/ui/app/components/mfa/mfa-setup-step-two.js b/ui/app/components/mfa/mfa-setup-step-two.js
index 9e2ac2769fe..99a24fb16b9 100644
--- a/ui/app/components/mfa/mfa-setup-step-two.js
+++ b/ui/app/components/mfa/mfa-setup-step-two.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/mfa/nav.hbs b/ui/app/components/mfa/nav.hbs
similarity index 92%
rename from ui/app/templates/components/mfa/nav.hbs
rename to ui/app/components/mfa/nav.hbs
index b3d9df713de..7e2691593ec 100644
--- a/ui/app/templates/components/mfa/nav.hbs
+++ b/ui/app/components/mfa/nav.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="tabs-container box is-sideless is-fullwidth is-paddingless is-marginless">
   <nav class="tabs" aria-label="navigation for managing MFA">
diff --git a/ui/app/components/mfa/qr-code-card.hbs b/ui/app/components/mfa/qr-code-card.hbs
new file mode 100644
index 00000000000..c48f615a60f
--- /dev/null
+++ b/ui/app/components/mfa/qr-code-card.hbs
@@ -0,0 +1,20 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Layout::Flex @justify="space-between" @align="center">
+  <Hds::Card::Container @hasBorder={{true}} class="has-padding-l">
+    <QrCode @text={{@qrCode}} @colorLight="#F7F7F7" @width={{175}} @height={{175}} @correctLevel="L" data-test-qrcode />
+  </Hds::Card::Container>
+  <Hds::Text::Body @tag="p" @weight="semibold">
+    Or
+  </Hds::Text::Body>
+  <Hds::Copy::Button @text="Copy TOTP setup URL" @textToCopy={{@qrCode}} data-test-copy-button />
+</Hds::Layout::Flex>
+
+<Hds::Alert @color="warning" @type="compact" class="has-top-padding-s" as |A|>
+  <A.Description>
+    For your security, this code is only shown once. Please scan or copy the setup URL into your authenticator app now.
+  </A.Description>
+</Hds::Alert>
\ No newline at end of file
diff --git a/ui/app/components/mfa/splash-card.hbs b/ui/app/components/mfa/splash-card.hbs
new file mode 100644
index 00000000000..a7f834781ad
--- /dev/null
+++ b/ui/app/components/mfa/splash-card.hbs
@@ -0,0 +1,66 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{! Display only template so all MFA steps are styled the same inside the SplashPage component }}
+
+<SplashPage class="wide-content" ...attributes>
+  <:header>
+    {{#if @renderLogo}}
+      <div class="is-flex-v-centered has-bottom-margin-xxl">
+        <div class="brand-icon-large">
+          <Icon @name="vault" @size="24" @stretched={{true}} />
+        </div>
+      </div>
+    {{/if}}
+    <h1 class="title is-4" data-test-page-title>{{@header}}</h1>
+    {{#if @subheader}}
+      <Hds::Text::Body @tag="h2" class="has-top-bottom-margin-xxs" data-test-mfa-subheader>
+        {{@subheader}}
+      </Hds::Text::Body>
+    {{/if}}
+  </:header>
+
+  <:content>
+    <div class="has-padding-l">
+
+      {{#if @isLoading}}
+        <Hds::Layout::Flex @justify="center" @align="center" class="is-medium-height">
+          <VaultLogoSpinner />
+        </Hds::Layout::Flex>
+      {{else}}
+        {{#if @subtitle}}
+          <Hds::Text::Body @tag="p" @weight="semibold" class="has-top-bottom-margin-xxs" data-test-mfa-subtitle>
+            {{@subtitle}}
+          </Hds::Text::Body>
+        {{/if}}
+
+        {{#if @description}}
+          <Hds::Text::Body @tag="p" class="has-bottom-margin-l" data-test-mfa-description>
+            {{@description}}
+          </Hds::Text::Body>
+        {{/if}}
+
+        {{#if (has-block "alerts")}}
+          {{yield to="alerts"}}
+        {{/if}}
+
+        {{#if (has-block "qrCode")}}
+          {{yield to="qrCode"}}
+        {{/if}}
+
+        {{#if (has-block "additionalContent")}}
+          {{yield to="additionalContent"}}
+        {{/if}}
+      {{/if}}
+    </div>
+  </:content>
+
+  <:footer>
+    <Hds::ButtonSet class="has-top-padding-m">
+      {{yield to="actions"}}
+    </Hds::ButtonSet>
+  </:footer>
+
+</SplashPage>
\ No newline at end of file
diff --git a/ui/app/components/modal-form/oidc-assignment-template.hbs b/ui/app/components/modal-form/oidc-assignment-template.hbs
index 14e1d612aa4..cd82ee1a62a 100644
--- a/ui/app/components/modal-form/oidc-assignment-template.hbs
+++ b/ui/app/components/modal-form/oidc-assignment-template.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Oidc::AssignmentForm @onSave={{this.onSave}} @model={{this.assignment}} @onCancel={{@onCancel}} />
\ No newline at end of file
diff --git a/ui/app/components/modal-form/oidc-assignment-template.js b/ui/app/components/modal-form/oidc-assignment-template.js
index e3bc9735da4..34e3fa577e0 100644
--- a/ui/app/components/modal-form/oidc-assignment-template.js
+++ b/ui/app/components/modal-form/oidc-assignment-template.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/modal-form/oidc-key-template.hbs b/ui/app/components/modal-form/oidc-key-template.hbs
new file mode 100644
index 00000000000..baf6e328bd4
--- /dev/null
+++ b/ui/app/components/modal-form/oidc-key-template.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Oidc::KeyForm @onSave={{this.onSave}} @model={{this.key}} @onCancel={{@onCancel}} @isModalForm={{true}} />
\ No newline at end of file
diff --git a/ui/app/components/modal-form/oidc-key-template.js b/ui/app/components/modal-form/oidc-key-template.js
new file mode 100644
index 00000000000..382d2a99639
--- /dev/null
+++ b/ui/app/components/modal-form/oidc-key-template.js
@@ -0,0 +1,41 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+
+/**
+ * @module ModalForm::OidcKeyTemplate
+ * ModalForm::OidcKeyTemplate components render within a modal and create a model using the input from the search select. The model is passed to the oidc/key-form.
+ *
+ * @example
+ *  <ModalForm::OidcKeyTemplate
+ *    @nameInput="new-key-name"
+ *    @onSave={{this.closeModal}}
+ *    @onCancel={{@onCancel}}
+ *  />
+ *
+ * @callback onCancel - callback triggered when cancel button is clicked
+ * @callback onSave - callback triggered when save button is clicked
+ * @param {string} nameInput - the name of the newly created key
+ */
+
+export default class OidcKeyTemplate extends Component {
+  @service store;
+  @tracked key = null; // model record passed to oidc/key-form
+
+  constructor() {
+    super(...arguments);
+    this.key = this.store.createRecord('oidc/key', { name: this.args.nameInput });
+  }
+
+  @action onSave(keyModel) {
+    this.args.onSave(keyModel);
+    // Reset component key for next use
+    this.key = null;
+  }
+}
diff --git a/ui/app/components/modal-form/policy-template.hbs b/ui/app/components/modal-form/policy-template.hbs
index e6fe7a9e239..8973b9d4364 100644
--- a/ui/app/components/modal-form/policy-template.hbs
+++ b/ui/app/components/modal-form/policy-template.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.policy.policyType}}
   <Hds::Tabs as |T|>
@@ -16,7 +16,7 @@
       <PolicyForm @onSave={{this.onSave}} @model={{this.policy}} @onCancel={{@onCancel}} />
     </T.Panel>
     <T.Panel class="has-top-padding-m">
-      <PolicyExample @policyType={{this.policy.policyType}} @container="#search-select-modal" />
+      <PolicyExample @policyType={{this.policy.policyType}} />
     </T.Panel>
   </Hds::Tabs>
 {{else}}
diff --git a/ui/app/components/modal-form/policy-template.js b/ui/app/components/modal-form/policy-template.js
index b5a4d3177db..781dc155cb3 100644
--- a/ui/app/components/modal-form/policy-template.js
+++ b/ui/app/components/modal-form/policy-template.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/mount-accessor-select.hbs b/ui/app/components/mount-accessor-select.hbs
similarity index 90%
rename from ui/app/templates/components/mount-accessor-select.hbs
rename to ui/app/components/mount-accessor-select.hbs
index c349c600ebb..cc428da2f51 100644
--- a/ui/app/templates/components/mount-accessor-select.hbs
+++ b/ui/app/components/mount-accessor-select.hbs
@@ -1,16 +1,16 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div ...attributes>
   {{#if @label}}
     <label for={{@name}} class="is-label">
       {{@label}}
       {{#if @helpText}}
-        <InfoTooltip>
-          <span data-test-help-text>{{@helpText}}</span>
-        </InfoTooltip>
+        <Hds::TooltipButton @text={{@helpText}} aria-label="More information">
+          <Hds::Icon @name="info" />
+        </Hds::TooltipButton>
       {{/if}}
     </label>
   {{/if}}
diff --git a/ui/app/components/mount-accessor-select.js b/ui/app/components/mount-accessor-select.js
index 84b6d344004..98f94676cfb 100644
--- a/ui/app/components/mount-accessor-select.js
+++ b/ui/app/components/mount-accessor-select.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,7 @@ import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { task } from 'ember-concurrency';
 import { action } from '@ember/object';
+import AuthMethodResource from 'vault/resources/auth/method';
 
 /**
  * @module MountAccessorSelect
@@ -27,7 +28,7 @@ import { action } from '@ember/object';
  */
 
 export default class MountAccessorSelect extends Component {
-  @service store;
+  @service api;
 
   get filterToken() {
     return this.args.filterToken || false;
@@ -43,7 +44,11 @@ export default class MountAccessorSelect extends Component {
   }
 
   @task *authMethods() {
-    const methods = yield this.store.findAll('auth-method');
+    const { data } = yield this.api.sys.authListEnabledMethods();
+    const methods = this.api
+      .responseObjectToArray(data, 'path')
+      .map((method) => new AuthMethodResource(method, this));
+
     if (!this.args.value && !this.args.noDefault) {
       const getValue = methods[0].accessor;
       this.args.onChange(getValue);
diff --git a/ui/app/components/mount-backend-form.hbs b/ui/app/components/mount-backend-form.hbs
new file mode 100644
index 00000000000..98c422adb30
--- /dev/null
+++ b/ui/app/components/mount-backend-form.hbs
@@ -0,0 +1,88 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3 title-with-icon" data-test-page-title>
+      {{#if this.showEnable}}
+        {{#let (find-by "type" this.mountForm.type @mountTypes) as |typeInfo|}}
+          {{#if typeInfo.glyph}}
+            <Icon @name={{typeInfo.glyph}} @size="24" class="has-text-grey-light" />
+          {{/if}}
+          {{#if (eq @mountCategory "secret")}}
+            {{concat "Enable " (or typeInfo.displayName this.mountForm.type) " Secrets Engine"}}
+          {{else}}
+            {{concat "Enable " (or typeInfo.displayName this.mountForm.type) " Authentication Method"}}
+          {{/if}}
+        {{/let}}
+      {{else if (eq @mountCategory "secret")}}
+        Enable a Secrets Engine
+      {{else}}
+        Enable an Authentication Method
+      {{/if}}
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+<div class="box is-sideless is-bottomless is-fullwidth is-marginless">
+  <NamespaceReminder @mode="enable" @noun={{if (eq @mountCategory "secret") "Secret Engine" "Auth Method"}} />
+  <MessageError @errorMessage={{this.errorMessage}} />
+  {{#if this.mountForm.type}}
+    <form {{on "submit" (perform this.mountBackend)}}>
+      <FormFieldGroups
+        @model={{this.mountForm}}
+        @groupName="formFieldGroups"
+        @renderGroup="default"
+        @modelValidations={{this.modelValidations}}
+        @onKeyUp={{this.onKeyUp}}
+      />
+
+      <FormFieldGroups @model={{this.mountForm}} @renderGroup="Method Options" @groupName="formFieldGroups">
+        <:identityTokenKey>
+          <SearchSelectWithModal
+            @id="key"
+            @fallbackComponent="input-search"
+            @inputValue={{this.mountForm.data.config.identity_token_key}}
+            @onChange={{this.handleIdentityTokenKeyChange}}
+            @models={{array "oidc/key"}}
+            @selectLimit="1"
+            @modalFormTemplate="modal-form/oidc-key-template"
+            @placeholder="Search for an existing OIDC key, or type a new key name to create it."
+            @fallbackComponentPlaceholder="Input a key name"
+            @modalSubtext="This key will be created in the OIDC key path."
+          />
+        </:identityTokenKey>
+      </FormFieldGroups>
+
+      <div class="field is-grouped box is-fullwidth is-bottomless">
+        <div class="control">
+          <Hds::Button
+            @text={{if (eq @mountCategory "secret") "Enable engine" "Enable method"}}
+            @icon={{if this.mountBackend.isRunning "loading"}}
+            type="submit"
+            data-test-submit
+            disabled={{this.mountBackend.isRunning}}
+          />
+        </div>
+        <div class="control">
+          <Hds::Button @text="Back" @color="secondary" data-test-back-button {{on "click" (fn this.setMountType "")}} />
+        </div>
+        {{#if this.invalidFormAlert}}
+          <div class="control">
+            <AlertInline @type="danger" class="has-top-padding-s" @message={{this.invalidFormAlert}} />
+          </div>
+        {{/if}}
+      </div>
+    </form>
+  {{else}}
+    {{!  Type not yet set, show type options }}
+    <MountBackend::TypeForm
+      @setMountType={{this.setMountType}}
+      @mountCategory={{@mountCategory}}
+      @pluginCatalogData={{@mountModel.pluginCatalogData}}
+      @pluginCatalogError={{@mountModel.pluginCatalogError}}
+    />
+  {{/if}}
+</div>
\ No newline at end of file
diff --git a/ui/app/components/mount-backend-form.js b/ui/app/components/mount-backend-form.js
deleted file mode 100644
index 7af1542dd88..00000000000
--- a/ui/app/components/mount-backend-form.js
+++ /dev/null
@@ -1,179 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { tracked } from '@glimmer/tracking';
-import { service } from '@ember/service';
-import { action } from '@ember/object';
-import { task } from 'ember-concurrency';
-import { waitFor } from '@ember/test-waiters';
-import { methods } from 'vault/helpers/mountable-auth-methods';
-import { isAddonEngine, allEngines } from 'vault/helpers/mountable-secret-engines';
-
-/**
- * @module MountBackendForm
- * The `MountBackendForm` is used to mount either a secret or auth backend.
- *
- * @example ```js
- *   <MountBackendForm @mountType="secret" @onMountSuccess={{this.onMountSuccess}} />```
- *
- * @param {function} onMountSuccess - A function that transitions once the Mount has been successfully posted.
- * @param {string} [mountType=auth] - The type of backend we want to mount.
- *
- */
-
-export default class MountBackendForm extends Component {
-  @service store;
-  @service flashMessages;
-
-  // validation related properties
-  @tracked modelValidations = null;
-  @tracked invalidFormAlert = null;
-
-  @tracked errorMessage = '';
-
-  willDestroy() {
-    // components are torn down after store is unloaded and will cause an error if attempt to unload record
-    const noTeardown = this.store && !this.store.isDestroying;
-    if (noTeardown && this.args?.mountModel?.isNew) {
-      this.args.mountModel.unloadRecord();
-    }
-    super.willDestroy(...arguments);
-  }
-
-  checkPathChange(type) {
-    if (!type) return;
-    const mount = this.args.mountModel;
-    const currentPath = mount.path;
-    const mountTypes =
-      this.args.mountType === 'secret'
-        ? allEngines().map((engine) => engine.type)
-        : methods().map((auth) => auth.type);
-    // if the current path has not been altered by user,
-    // change it here to match the new type
-    if (!currentPath || mountTypes.includes(currentPath)) {
-      mount.path = type;
-    }
-  }
-
-  typeChangeSideEffect(type) {
-    if (!this.args.mountType === 'secret') return;
-    if (type === 'pki') {
-      // If type PKI, set max lease to ~10years
-      this.args.mountModel.config.maxLeaseTtl = '3650d';
-    } else {
-      // otherwise reset
-      this.args.mountModel.config.maxLeaseTtl = 0;
-    }
-  }
-
-  checkModelValidity(model) {
-    const { isValid, state, invalidFormMessage } = model.validate();
-    this.modelValidations = state;
-    this.invalidFormAlert = invalidFormMessage;
-    return isValid;
-  }
-
-  checkModelWarnings() {
-    // check for warnings on change
-    // since we only show errors on submit we need to clear those out and only send warning state
-    const { state } = this.args.mountModel.validate();
-    for (const key in state) {
-      state[key].errors = [];
-    }
-    this.modelValidations = state;
-    this.invalidFormAlert = null;
-  }
-
-  async showWarningsForKvv2() {
-    try {
-      const capabilities = await this.store.findRecord('capabilities', `${this.args.mountModel.path}/config`);
-      if (!capabilities?.canUpdate) {
-        // config error is not thrown from secret-engine adapter, so handling here
-        this.flashMessages.warning(
-          'You do not have access to the config endpoint. The secret engine was mounted, but the configuration settings were not saved.'
-        );
-        // remove the config data from the model otherwise it will persist in the store even though network request failed.
-        [
-          this.args.mountModel.maxVersions,
-          this.args.mountModel.casRequired,
-          this.args.mountModel.deleteVersionAfter,
-        ] = [0, false, 0];
-      }
-    } catch (e) {
-      // Show different warning if we're not sure the config saved
-      this.flashMessages.warning(
-        'You may not have access to the config endpoint. The secret engine was mounted, but the configuration settings may not be saved.'
-      );
-    }
-    return;
-  }
-
-  @task
-  @waitFor
-  *mountBackend(event) {
-    event.preventDefault();
-    const mountModel = this.args.mountModel;
-    const { type, path } = mountModel;
-    // only submit form if validations pass
-    if (!this.checkModelValidity(mountModel)) {
-      return;
-    }
-
-    const changedAttrKeys = Object.keys(mountModel.changedAttributes());
-    const updatesConfig =
-      changedAttrKeys.includes('casRequired') ||
-      changedAttrKeys.includes('deleteVersionAfter') ||
-      changedAttrKeys.includes('maxVersions');
-
-    try {
-      yield mountModel.save();
-    } catch (err) {
-      if (err.httpStatus === 403) {
-        this.flashMessages.danger(
-          'You do not have access to the sys/mounts endpoint. The secret engine was not mounted.'
-        );
-        return;
-      }
-      if (err.errors) {
-        const errors = err.errors.map((e) => {
-          if (typeof e === 'object') return e.title || e.message || JSON.stringify(e);
-          return e;
-        });
-        this.errorMessage = errors;
-      } else if (err.message) {
-        this.errorMessage = err.message;
-      } else {
-        this.errorMessage = 'An error occurred, check the vault logs.';
-      }
-      return;
-    }
-    if (mountModel.isV2KV && updatesConfig) {
-      yield this.showWarningsForKvv2();
-    }
-    this.flashMessages.success(
-      `Successfully mounted the ${type} ${
-        this.args.mountType === 'secret' ? 'secrets engine' : 'auth method'
-      } at ${path}.`
-    );
-    // Check whether to use the engine route, since KV version 1 does not
-    const useEngineRoute = isAddonEngine(mountModel.engineType, mountModel.version);
-    yield this.args.onMountSuccess(type, path, useEngineRoute);
-    return;
-  }
-
-  @action
-  onKeyUp(name, value) {
-    this.args.mountModel[name] = value;
-    this.checkModelWarnings();
-  }
-
-  @action
-  setMountType(value) {
-    this.args.mountModel.type = value;
-    this.typeChangeSideEffect(value);
-    this.checkPathChange(value);
-  }
-}
diff --git a/ui/app/components/mount-backend-form.ts b/ui/app/components/mount-backend-form.ts
new file mode 100644
index 00000000000..cba81cc9b67
--- /dev/null
+++ b/ui/app/components/mount-backend-form.ts
@@ -0,0 +1,156 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { service } from '@ember/service';
+import { action, set } from '@ember/object';
+import { task } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+import { filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
+import { MOUNT_CATEGORIES } from 'vault/utils/plugin-catalog-helpers';
+
+import type FlashMessageService from 'vault/services/flash-messages';
+import type Store from '@ember-data/store';
+import type AuthMethodForm from 'vault/forms/auth/method';
+import type CapabilitiesService from 'vault/services/capabilities';
+import type ApiService from 'vault/services/api';
+import type { ApiError } from '@ember-data/adapter/error';
+import type { ValidationMap } from 'vault/vault/app-types';
+
+/**
+ * @module MountBackendForm
+ * The `MountBackendForm` is used to mount authentication methods.
+ *
+ * @example ```js
+ *   <MountBackendForm @mountModel={{this.model}} @onMountSuccess={{this.onMountSuccess}} />```
+ *
+ * @param {AuthMethodForm} mountModel - The authentication method form.
+ * @param {function} onMountSuccess - A function that transitions once the Mount has been successfully posted.
+ *
+ */
+
+interface Args {
+  mountModel: AuthMethodForm;
+  onMountSuccess: (type: string, path: string, useEngineRoute: boolean) => void;
+}
+
+const AUTH_MOUNT_CATEGORY = MOUNT_CATEGORIES.AUTH;
+
+export default class MountBackendForm extends Component<Args> {
+  @service declare readonly store: Store;
+  @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly capabilities: CapabilitiesService;
+  @service declare readonly api: ApiService;
+
+  // validation related properties
+  @tracked modelValidations: ValidationMap | null = null;
+  @tracked invalidFormAlert: string | null = null;
+
+  @tracked errorMessage: string | string[] = '';
+
+  get mountForm(): AuthMethodForm {
+    return this.args.mountModel;
+  }
+
+  get showEnable(): boolean {
+    return !!this.mountForm.type;
+  }
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+  }
+
+  checkPathChange(backendType: string) {
+    if (!backendType) return;
+    const { data } = this.mountForm;
+    // Always use auth mount category since this component only handles auth methods
+    const mountsByType = filterEnginesByMountCategory({
+      mountCategory: AUTH_MOUNT_CATEGORY,
+      isEnterprise: true,
+    }).map((engine) => engine.type);
+
+    // if the current path has not been altered by user (is empty or matches a default mount type),
+    // change it here to match the new type
+    if (!data.path || mountsByType.includes(data.path)) {
+      data.path = backendType;
+    }
+  }
+
+  checkModelWarnings() {
+    // check for warnings on change
+    // since we only show errors on submit we need to clear those out and only send warning state
+    const mountModel = this.mountForm;
+    const { state } = mountModel.toJSON();
+    for (const key in state) {
+      if (state[key]) {
+        state[key].errors = [];
+      }
+    }
+    this.modelValidations = state;
+    this.invalidFormAlert = null;
+  }
+
+  async onMountError(status: number, errors: ApiError[], message: string) {
+    if (status === 403) {
+      this.flashMessages.danger(
+        'You do not have access to the sys/auth endpoint. The auth method was not mounted.'
+      );
+    } else if (errors) {
+      this.errorMessage = errors.map((e) => {
+        if (typeof e === 'object') return e.title || e.message || JSON.stringify(e);
+        return e;
+      });
+    } else if (message) {
+      this.errorMessage = message;
+    } else {
+      this.errorMessage = 'An error occurred, check the vault logs.';
+    }
+  }
+
+  @task
+  @waitFor
+  *mountBackend(event: Event) {
+    event.preventDefault();
+    const mountModel = this.mountForm;
+    const { type } = mountModel;
+    const { path } = mountModel.data;
+    // only submit form if validations pass
+    const { isValid, state, invalidFormMessage, data } = mountModel.toJSON();
+    if (!isValid) {
+      this.modelValidations = state;
+      this.invalidFormAlert = invalidFormMessage;
+      return;
+    }
+
+    try {
+      yield this.api.sys.authEnableMethod(path, data);
+      this.flashMessages.success(`Successfully mounted the ${mountModel.type} auth method at ${path}.`);
+      this.args.onMountSuccess(type, path, false);
+    } catch (error) {
+      const { status, response, message } = yield this.api.parseError(error);
+      this.onMountError(status, response.errors, message);
+    }
+  }
+
+  @action
+  onKeyUp(name: string, value: string) {
+    set(this.mountForm.data, name, value);
+    this.checkModelWarnings();
+  }
+
+  @action
+  setMountType(value: string) {
+    this.mountForm.type = value;
+    this.checkPathChange(value);
+  }
+
+  @action
+  handleIdentityTokenKeyChange(value: string[] | string): void {
+    // if array, it's coming from the search-select component, otherwise it hit the fallback component and will come in as a string.
+    const { config } = this.mountForm.data;
+    config.identity_token_key = Array.isArray(value) ? value[0] : value;
+  }
+}
diff --git a/ui/app/components/mount-backend/type-form.hbs b/ui/app/components/mount-backend/type-form.hbs
index 48fbd4bd911..e097b9a870a 100644
--- a/ui/app/components/mount-backend/type-form.hbs
+++ b/ui/app/components/mount-backend/type-form.hbs
@@ -1,33 +1,79 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-{{#each (array "generic" "cloud" "infra") as |category|}}
-  <Hds::Text::Display class="has-top-padding-m has-bottom-padding-s" @tag="h2" size="400">
-    {{capitalize category}}
-  </Hds::Text::Display>
-  <div class="flex row-wrap row-gap-8 column-gap-16 has-bottom-padding-m">
-    {{#each (filter-by "category" category this.mountTypes) as |type|}}
-      <SelectableCard
-        id={{type.type}}
-        class="has-top-padding-l has-text-centered small-card"
-        @onClick={{fn @setMountType type.type}}
-        @disabled={{if type.requiredFeature (not (has-feature type.requiredFeature)) false}}
-        data-test-mount-type={{type.type}}
-      >
-        <Icon @name={{type.glyph}} @size="24" class="has-bottom-margin-xs" />
-        <Hds::Text::Body @tag="h3" @size="300">
-          {{type.displayName}}
-        </Hds::Text::Body>
-        {{#if (and type.requiredFeature (not (has-feature type.requiredFeature)))}}
-          <Hds::Badge @text="Enterprise" @icon="enterprise" @size="small" />
-        {{/if}}
-      </SelectableCard>
-    {{/each}}
+{{! TODO: utilize plugin catalog for auth engines (currently only implemented for secret engines) }}
+{{#if (and @pluginCatalogError (eq @mountCategory this.secretMountCategory))}}
+  <div class="has-bottom-padding-m">
+    <Hds::Alert @type="inline" @color="warning" as |A|>
+      <A.Title>Plugin information unavailable</A.Title>
+      <A.Description>
+        Unable to fetch current plugin information. Using static plugin data instead. Some plugins may not show current
+        details.
+      </A.Description>
+    </Hds::Alert>
   </div>
+{{/if}}
+
+{{#each this.pluginCategoriesList as |category|}}
+  {{#let (this.getMountTypesByCategory category) as |categorized|}}
+    {{! Only display the category if it has any enabled or disabled plugins }}
+    {{#if (or categorized.enabled.length categorized.disabled.length)}}
+      <div class="has-top-padding-m has-bottom-padding-s">
+        <Hds::Text::Display @tag="h2" size="400" class="is-flex align-items-center">
+          {{capitalize category}}
+          {{#if (eq category "external")}}
+            <Hds::Button
+              @text=""
+              @color="tertiary"
+              @icon="info"
+              @size="small"
+              @isIconOnly={{true}}
+              @ariaLabel="Information about external plugins"
+              class="has-left-margin-xs"
+              {{on "click" this.openExternalPluginsHelp}}
+            />
+          {{/if}}
+        </Hds::Text::Display>
+      </div>
+      <div class="flex row-wrap row-gap-16 column-gap-16 has-bottom-padding-m">
+        {{! Display enabled plugins first }}
+        {{#each categorized.enabled as |type|}}
+          <EnabledPluginCard @type={{type}} @setMountType={{@setMountType}} />
+        {{/each}}
+
+        {{! Display vertical separator if both enabled and disabled plugins exist }}
+        {{#if (and categorized.enabled.length categorized.disabled.length)}}
+          <div class="selectable-engines-vertical-divider has-top-bottom-margin-12"></div>
+        {{/if}}
+
+        {{! Display disabled plugins at the end }}
+        {{#each categorized.disabled as |type|}}
+          <DisabledPluginCard
+            @type={{type}}
+            @handleDisabledPluginClick={{this.handleDisabledPluginClick}}
+            @handleDisabledPluginKeyDown={{this.handleDisabledPluginKeyDown}}
+          />
+        {{/each}}
+      </div>
+    {{/if}}
+  {{/let}}
 {{/each}}
 
 <div class="field is-grouped box is-fullwidth is-bottomless">
-  <Hds::Button @text="Cancel" @color="secondary" @route="vault.cluster.secrets.backends" />
-</div>
\ No newline at end of file
+  <Hds::Button
+    @text="Cancel"
+    @color="secondary"
+    @route={{if (eq @mountCategory "secret") "vault.cluster.secrets.backends" "vault.cluster.access.methods"}}
+    data-test-cancel
+  />
+</div>
+
+{{! Plugin Documentation Flyout }}
+<PluginDocumentationFlyout
+  @isOpen={{this.showFlyout}}
+  @plugin={{this.flyoutPlugin}}
+  @pluginType={{this.flyoutPluginType}}
+  @onClose={{this.closeFlyout}}
+/>
\ No newline at end of file
diff --git a/ui/app/components/mount-backend/type-form.js b/ui/app/components/mount-backend/type-form.js
index a04d051e470..d1859a3e5ab 100644
--- a/ui/app/components/mount-backend/type-form.js
+++ b/ui/app/components/mount-backend/type-form.js
@@ -1,12 +1,21 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
-import { allMethods, methods } from 'vault/helpers/mountable-auth-methods';
-import { allEngines, mountableEngines } from 'vault/helpers/mountable-secret-engines';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import keys from 'core/utils/keys';
+import { filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
+import {
+  enhanceEnginesWithCatalogData,
+  categorizeEnginesByStatus,
+  MOUNT_CATEGORIES,
+  PLUGIN_TYPES,
+  PLUGIN_CATEGORIES,
+} from 'vault/utils/plugin-catalog-helpers';
 
 /**
  *
@@ -16,24 +25,118 @@ import { allEngines, mountableEngines } from 'vault/helpers/mountable-secret-eng
  *
  * @example
  * ```js
- * <MountBackend::TypeForm @setMountType={{this.setMountType}} @mountType="secret" />
+ * <MountBackend::TypeForm @setMountType={{this.setMountType}} @mountCategory="secret" @pluginCatalogData={{this.pluginCatalogData}} @pluginCatalogError={{this.pluginCatalogError}} />
  * ```
  * @param {CallableFunction} setMountType - function will receive the mount type string. Should update the model type value
- * @param {string} [mountType=auth] - mount type can be `auth` or `secret`
+ * @param {string} [mountCategory=auth] - mount category can be `auth` or `secret`
+ * @param {object} [pluginCatalogData] - plugin catalog data fetched from the route model
+ * @param {boolean} [pluginCatalogError] - indicates if there was an error fetching plugin catalog data
  */
 
 export default class MountBackendTypeForm extends Component {
   @service version;
 
+  @tracked showFlyout = false;
+  @tracked flyoutPlugin = null;
+  @tracked flyoutPluginType = null;
+
   get secretEngines() {
-    return this.version.isEnterprise ? allEngines() : mountableEngines();
+    // If an enterprise license is present, return all secret engines;
+    // otherwise, return only the secret engines supported in OSS.
+    const staticEngines = filterEnginesByMountCategory({
+      mountCategory: MOUNT_CATEGORIES.SECRET,
+      isEnterprise: !!this.version?.isEnterprise,
+    });
+
+    // If we have plugin catalog data, merge it with static engines to add catalog info
+    if (this.args.pluginCatalogData) {
+      const secretEnginesDetailed =
+        this.args.pluginCatalogData?.detailed?.filter((plugin) => plugin?.type === PLUGIN_TYPES.SECRET) || [];
+      const databasePluginsDetailed =
+        this.args.pluginCatalogData?.detailed?.filter((plugin) => plugin?.type === PLUGIN_TYPES.DATABASE) ||
+        [];
+
+      return enhanceEnginesWithCatalogData(staticEngines, secretEnginesDetailed, databasePluginsDetailed);
+    }
+
+    return staticEngines;
   }
 
   get authMethods() {
-    return this.version.isEnterprise ? allMethods() : methods();
+    // If an enterprise license is present, return all auth methods;
+    // otherwise, return only the auth methods supported in OSS.
+    return filterEnginesByMountCategory({
+      mountCategory: MOUNT_CATEGORIES.AUTH,
+      isEnterprise: !!this.version?.isEnterprise,
+    });
   }
 
   get mountTypes() {
-    return this.args.mountType === 'secret' ? this.secretEngines : this.authMethods;
+    if (this.args.mountCategory === MOUNT_CATEGORIES.SECRET) {
+      return this.secretEngines || [];
+    }
+    return this.authMethods || [];
+  }
+
+  get pluginCategoriesList() {
+    return [
+      PLUGIN_CATEGORIES.GENERIC,
+      PLUGIN_CATEGORIES.CLOUD,
+      PLUGIN_CATEGORIES.INFRA,
+      // PLUGIN_CATEGORIES.EXTERNAL, // TODO: enable external plugins once version selection is available (VAULT-39241)
+    ];
+  }
+
+  get secretMountCategory() {
+    return MOUNT_CATEGORIES.SECRET;
+  }
+
+  @action
+  getMountTypesByCategory(category) {
+    try {
+      if (!this.args) {
+        return { enabled: [], disabled: [] };
+      }
+
+      const mountTypes = this.mountTypes;
+      if (!mountTypes || !Array.isArray(mountTypes)) {
+        return { enabled: [], disabled: [] };
+      }
+
+      const allTypes = mountTypes.filter((type) => type?.pluginCategory === category);
+      return categorizeEnginesByStatus(allTypes);
+    } catch (error) {
+      return { enabled: [], disabled: [] };
+    }
+  }
+
+  @action
+  handleDisabledPluginKeyDown(plugin, event) {
+    // Only handle Enter and Space keys for accessibility
+    if (event.key === keys.ENTER || event.key === keys.SPACE) {
+      event.preventDefault();
+      this.handleDisabledPluginClick(plugin);
+    }
+  }
+
+  @action
+  handleDisabledPluginClick(plugin) {
+    this.showFlyout = true;
+    this.flyoutPlugin = plugin;
+    this.flyoutPluginType = this.args?.mountCategory;
+  }
+
+  @action
+  openExternalPluginsHelp() {
+    this.showFlyout = true;
+    this.flyoutPlugin = null;
+    this.flyoutPluginType = 'secret';
+  }
+
+  @action
+  closeFlyout() {
+    this.showFlyout = false;
+    this.flyoutPlugin = null;
+    this.flyoutPluginType = null;
   }
 }
diff --git a/ui/app/components/mount/secrets-engine-form.hbs b/ui/app/components/mount/secrets-engine-form.hbs
new file mode 100644
index 00000000000..1c3bb0c18ab
--- /dev/null
+++ b/ui/app/components/mount/secrets-engine-form.hbs
@@ -0,0 +1,67 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="box is-sideless is-fullwidth is-marginless is-bottomless">
+
+  <Hds::PageHeader class="page-header" as |PH|>
+    <PH.Breadcrumb>
+      <Hds::Breadcrumb data-test-breadcrumbs>
+        <Hds::Breadcrumb::Item @text="Secrets engines" @route="vault.cluster.secrets.backends" />
+        <Hds::Breadcrumb::Item @text="Enable secrets engine" @route="vault.cluster.secrets.enable" />
+        <Hds::Breadcrumb::Item @text={{capitalize @model.type}} @current={{true}} />
+      </Hds::Breadcrumb>
+    </PH.Breadcrumb>
+  </Hds::PageHeader>
+
+  <MessageError @errorMessage={{this.errorMessage}} />
+
+  <form {{on "submit" (perform this.mountBackend)}}>
+    <FormFieldGroups
+      @model={{@model}}
+      @groupName="formFieldGroups"
+      @renderGroup="default"
+      @modelValidations={{this.modelValidations}}
+      @onKeyUp={{this.onKeyUp}}
+    />
+
+    <FormFieldGroups @model={{@model}} @renderGroup="Method Options" @groupName="formFieldGroups">
+      <:identityTokenKey>
+        <SearchSelectWithModal
+          @id="key"
+          @fallbackComponent="input-search"
+          @inputValue={{@model.data.config.identity_token_key}}
+          @onChange={{this.handleIdentityTokenKeyChange}}
+          @models={{array "oidc/key"}}
+          @selectLimit="1"
+          @modalFormTemplate="modal-form/oidc-key-template"
+          @placeholder="Search for an existing OIDC key, or type a new key name to create it."
+          @fallbackComponentPlaceholder="Input a key name"
+          @modalSubtext="This key will be created in the OIDC key path."
+          data-test-field="config.identity_token_key"
+        />
+      </:identityTokenKey>
+    </FormFieldGroups>
+
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      <div class="control">
+        <Hds::Button
+          @text="Enable engine"
+          @icon={{if this.mountBackend.isRunning "loading"}}
+          type="submit"
+          data-test-submit
+          disabled={{this.mountBackend.isRunning}}
+        />
+      </div>
+      <div class="control">
+        <Hds::Button @text="Back" @color="secondary" {{on "click" this.goBack}} data-test-back-button />
+      </div>
+      {{#if this.invalidFormAlert}}
+        <div class="control">
+          <AlertInline @type="danger" class="has-top-padding-s" @message={{this.invalidFormAlert}} />
+        </div>
+      {{/if}}
+    </div>
+  </form>
+</div>
\ No newline at end of file
diff --git a/ui/app/components/mount/secrets-engine-form.ts b/ui/app/components/mount/secrets-engine-form.ts
new file mode 100644
index 00000000000..06d592b3b42
--- /dev/null
+++ b/ui/app/components/mount/secrets-engine-form.ts
@@ -0,0 +1,158 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { inject as service } from '@ember/service';
+import { task } from 'ember-concurrency';
+import { set } from '@ember/object';
+import type FlashMessagesService from 'ember-cli-flash/services/flash-messages';
+import type ApiService from 'vault/services/api';
+import type CapabilitiesService from 'vault/services/capabilities';
+import type Router from '@ember/routing/router';
+import type SecretsEngineForm from 'vault/forms/secrets/engine';
+import type { ValidationMap } from 'vault/vault/app-types';
+import { isAddonEngine } from 'vault/utils/all-engines-metadata';
+
+interface Args {
+  model: SecretsEngineForm;
+  onMountSuccess?: (type: string, path: string, useEngineRoute: boolean) => void;
+}
+
+/**
+ * @module Mount::SecretsEngineForm
+ * Modern component for mounting secrets engines using the SecretsEngineForm.
+ *
+ * @example
+ * ```hbs
+ * <Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{this.onMountSuccess}} />
+ * ```
+ */
+export default class MountSecretsEngineFormComponent extends Component<Args> {
+  @service declare flashMessages: FlashMessagesService;
+  @service declare api: ApiService;
+  @service declare capabilities: CapabilitiesService;
+  @service declare router: Router;
+
+  @tracked modelValidations: ValidationMap | null = null;
+  @tracked invalidFormAlert: string | null = null;
+  @tracked errorMessage: string | string[] = '';
+
+  get mountForm(): SecretsEngineForm {
+    return this.args.model;
+  }
+
+  @action
+  onKeyUp(name: string, value: string) {
+    set(this.mountForm.data, name, value);
+  }
+
+  async saveKvConfig(path: string, formData: SecretsEngineForm['data']) {
+    const { options, kv_config = {} } = formData;
+    const { max_versions, cas_required, delete_version_after } = kv_config;
+    const isKvV2 = options?.version === 2 && ['kv', 'generic'].includes(this.mountForm.normalizedType);
+    const hasConfig = max_versions || cas_required || delete_version_after;
+
+    if (isKvV2 && hasConfig) {
+      try {
+        const { canUpdate } = await this.capabilities.for('kvConfig', { path });
+        if (canUpdate) {
+          await this.api.secrets.kvV2Configure(path, kv_config);
+        } else {
+          this.flashMessages.warning(
+            'You do not have access to the config endpoint. The secret engine was mounted, but the configuration settings were not saved.'
+          );
+        }
+      } catch (e) {
+        const { message } = await this.api.parseError(e);
+        this.flashMessages.warning(
+          `The secret engine was mounted, but the configuration settings were not saved. ${message}`
+        );
+      }
+    }
+  }
+
+  async onMountError(status: number, errors: unknown[] | undefined, message: string) {
+    if (status === 403) {
+      this.flashMessages.danger(
+        'You do not have access to the sys/mounts endpoint. The secret engine was not mounted.'
+      );
+    } else if (errors) {
+      this.errorMessage = errors.map((e) => {
+        if (typeof e === 'object' && e !== null) {
+          const errorObj = e as { title?: string; message?: string };
+          return errorObj.title || errorObj.message || JSON.stringify(e);
+        }
+        return String(e);
+      });
+    } else if (message) {
+      this.errorMessage = message;
+    } else {
+      this.errorMessage = 'An error occurred, check the vault logs.';
+    }
+  }
+
+  @task
+  *mountBackend(event: Event) {
+    event.preventDefault();
+    const mountModel = this.mountForm;
+    const { type } = mountModel;
+    const { path } = mountModel.data;
+
+    // Only submit form if validations pass
+    const { isValid, state, invalidFormMessage, data } = mountModel.toJSON();
+    if (!isValid) {
+      this.modelValidations = state;
+      this.invalidFormAlert = invalidFormMessage;
+      return;
+    }
+
+    this.errorMessage = '';
+    this.modelValidations = null;
+    this.invalidFormAlert = null;
+
+    try {
+      // Mount the secrets engine
+      yield this.api.sys.mountsEnableSecretsEngine(path, data);
+
+      // Save KV config if applicable
+      yield this.saveKvConfig(path, data);
+
+      this.flashMessages.success(`Successfully mounted the ${mountModel.type} secrets engine at ${path}.`);
+
+      // Determine if we should use engine routes
+      const version = data.options?.version;
+      const useEngineRoute = isAddonEngine(mountModel.normalizedType, Number(version));
+
+      // Call success callback or navigate
+      if (this.args.onMountSuccess) {
+        this.args.onMountSuccess(type, path, useEngineRoute);
+      } else {
+        // Default navigation
+        if (useEngineRoute) {
+          this.router.transitionTo('vault.cluster.secrets.backend.index', path);
+        } else {
+          this.router.transitionTo('vault.cluster.secrets.backend.list-root', path);
+        }
+      }
+    } catch (error) {
+      const { status, response, message } = yield this.api.parseError(error);
+      this.onMountError(status, response.errors, message);
+    }
+  }
+
+  @action
+  handleIdentityTokenKeyChange(value: string[] | string): void {
+    // if array, it's coming from the search-select component, otherwise it hit the fallback component and will come in as a string.
+    const { config } = this.mountForm.data;
+    config.identity_token_key = Array.isArray(value) ? value[0] : value;
+  }
+
+  @action
+  goBack() {
+    this.router.transitionTo('vault.cluster.secrets.enable');
+  }
+}
diff --git a/ui/app/components/namespace-link.js b/ui/app/components/namespace-link.js
deleted file mode 100644
index 20a42773bfa..00000000000
--- a/ui/app/components/namespace-link.js
+++ /dev/null
@@ -1,51 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { service } from '@ember/service';
-import { alias } from '@ember/object/computed';
-import Component from '@ember/component';
-import { computed } from '@ember/object';
-
-export default Component.extend({
-  namespaceService: service('namespace'),
-  currentNamespace: alias('namespaceService.path'),
-
-  tagName: '',
-  //public api
-  targetNamespace: null,
-  showLastSegment: false,
-  // set to true if targetNamespace is passed in unmodified
-  // otherwise, this assumes it is parsed as in namespace-picker
-  unparsed: false,
-
-  normalizedNamespace: computed('targetNamespace', 'unparsed', function () {
-    const ns = this.targetNamespace || '';
-    return this.unparsed ? ns : ns.replace(/\.+/g, '/').replace(/☃/g, '.');
-  }),
-
-  namespaceDisplay: computed('normalizedNamespace', 'showLastSegment', function () {
-    const ns = this.normalizedNamespace;
-    if (!ns) return 'root';
-    const showLastSegment = this.showLastSegment;
-    const parts = ns?.split('/');
-    return showLastSegment ? parts[parts.length - 1] : ns;
-  }),
-
-  isCurrentNamespace: computed('targetNamespace', 'currentNamespace', function () {
-    return this.currentNamespace === this.targetNamespace;
-  }),
-
-  get namespaceLink() {
-    const origin =
-      window.location.protocol +
-      '//' +
-      window.location.hostname +
-      (window.location.port ? ':' + window.location.port : '');
-
-    if (!this.normalizedNamespace) return `${origin}/ui/vault/dashboard`;
-    // The full URL/origin is required so that the page is reloaded.
-    return `${origin}/ui/vault/dashboard?namespace=${encodeURIComponent(this.normalizedNamespace)}`;
-  },
-});
diff --git a/ui/app/components/namespace-picker.hbs b/ui/app/components/namespace-picker.hbs
new file mode 100644
index 00000000000..74486589f92
--- /dev/null
+++ b/ui/app/components/namespace-picker.hbs
@@ -0,0 +1,101 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="namespace-picker side-padding-4" ...attributes>
+  <Hds::Dropdown @enableCollisionDetection={{true}} as |D|>
+
+    <D.ToggleButton
+      @icon="org"
+      {{! Displays the node of the current namespace context in the toggle }}
+      {{! For example, if a user navigates to 'parent/child' the toggle just displays 'child' }}
+      @text={{this.namespace.currentNamespace}}
+      @isFullWidth={{true}}
+      data-test-button="namespace-picker"
+      {{on "click" this.toggleNamespacePicker}}
+    />
+
+    {{#if this.errorLoadingNamespaces}}
+
+      <D.Header>
+        <MessageError @errorMessage={{this.errorLoadingNamespaces}} />
+      </D.Header>
+
+    {{else}}
+
+      <D.Header class="is-paddingless" @hasDivider={{true}}>
+        <div class="has-padding-8">
+          <Hds::Form::TextInput::Field
+            @value={{this.searchInput}}
+            @type="search"
+            aria-label="Search namespaces"
+            placeholder="Search"
+            data-test-input="Search namespaces"
+            {{on "keydown" this.onKeyDown}}
+            {{on "input" this.onSearchInput}}
+            {{did-insert this.focusSearchInput}}
+          />
+        </div>
+      </D.Header>
+
+      <D.Header class="is-paddingless">
+        {{#if (and this.hasSearchInput (not this.showNoNamespacesMessage))}}
+          <div class="sub-text is-marginless has-top-padding-xs left-padding-16" {{did-insert this.adjustElementWidth}}>
+            {{this.searchInputHelpText}}
+          </div>
+        {{/if}}
+
+        <div class="is-size-8 has-text-black has-text-weight-semibold left-padding-16 top-padding-10">
+          {{this.namespaceLabel}}
+          <Hds::BadgeCount @text={{or this.namespaceCount 0}} />
+        </div>
+      </D.Header>
+
+      {{#if this.showNoNamespacesMessage}}
+        <D.Generic class="sub-text is-marginless" {{did-insert this.adjustElementWidth}} data-test-help-text="no namespaces">
+          {{this.noNamespacesMessage}}
+        </D.Generic>
+      {{/if}}
+
+      <div class="is-overflow-y-auto is-max-drawer-height" {{did-insert this.setupScrollListener}}>
+        {{#each this.visibleNamespaceOptions as |option|}}
+          <D.Checkmark
+            @selected={{eq option.path this.selectedNamespace.path}}
+            {{on "click" (fn this.onChange option)}}
+            data-test-button={{option.label}}
+          >
+            <span class="is-fullwidth is-word-break right-padding-4">{{option.label}}</span>
+          </D.Checkmark>
+        {{/each}}
+      </div>
+
+    {{/if}}
+
+    <D.Footer @hasDivider={{true}} class="is-flex-center">
+      <Hds::ButtonSet class="is-fullwidth">
+        <Hds::Button
+          @color="secondary"
+          @text="Refresh list"
+          @isFullWidth={{not this.canManageNamespaces}}
+          @icon="reload"
+          @size="small"
+          {{on "click" this.refreshList}}
+          data-test-button="Refresh list"
+        />
+        {{#if this.canManageNamespaces}}
+          <Hds::Button
+            @color="tertiary"
+            @text="Manage"
+            @icon="settings"
+            @size="small"
+            @route="vault.cluster.access.namespaces"
+            data-test-button="Manage"
+          />
+        {{/if}}
+      </Hds::ButtonSet>
+
+    </D.Footer>
+
+  </Hds::Dropdown>
+</div>
\ No newline at end of file
diff --git a/ui/app/components/namespace-picker.js b/ui/app/components/namespace-picker.js
deleted file mode 100644
index 4ca909fec58..00000000000
--- a/ui/app/components/namespace-picker.js
+++ /dev/null
@@ -1,169 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { service } from '@ember/service';
-import { alias, gt } from '@ember/object/computed';
-import Component from '@ember/component';
-import { computed } from '@ember/object';
-import { task, timeout } from 'ember-concurrency';
-import pathToTree from 'vault/lib/path-to-tree';
-import { ancestorKeysForKey } from 'core/utils/key-utils';
-
-const DOT_REPLACEMENT = '☃';
-const ANIMATION_DURATION = 250;
-
-export default Component.extend({
-  tagName: '',
-  namespaceService: service('namespace'),
-  auth: service(),
-  store: service(),
-  namespace: null,
-  listCapability: null,
-  canList: false,
-
-  init() {
-    this._super(...arguments);
-    this.namespaceService?.findNamespacesForUser.perform();
-  },
-
-  didReceiveAttrs() {
-    this._super(...arguments);
-
-    const ns = this.namespace;
-    const oldNS = this.oldNamespace;
-    if (!oldNS || ns !== oldNS) {
-      this.setForAnimation.perform();
-      this.fetchListCapability.perform();
-    }
-    this.set('oldNamespace', ns);
-  },
-
-  fetchListCapability: task(function* () {
-    try {
-      const capability = yield this.store.findRecord('capabilities', 'sys/namespaces/');
-      this.set('listCapability', capability);
-      this.set('canList', true);
-    } catch (e) {
-      // If error out on findRecord call it's because you don't have permissions
-      // and therefore don't have permission to manage namespaces
-      this.set('canList', false);
-    }
-  }),
-  setForAnimation: task(function* () {
-    const leaves = this.menuLeaves;
-    const lastLeaves = this.lastMenuLeaves;
-    if (!lastLeaves) {
-      this.set('lastMenuLeaves', leaves);
-      yield timeout(0);
-      return;
-    }
-    const isAdding = leaves.length > lastLeaves.length;
-    const changedLeaf = (isAdding ? leaves : lastLeaves).get('lastObject');
-    this.set('isAdding', isAdding);
-    this.set('changedLeaf', changedLeaf);
-
-    // if we're adding we want to render immediately an animate it in
-    // if we're not adding, we need time to move the item out before
-    // a rerender removes it
-    if (isAdding) {
-      this.set('lastMenuLeaves', leaves);
-      yield timeout(0);
-      return;
-    }
-    yield timeout(ANIMATION_DURATION);
-    this.set('lastMenuLeaves', leaves);
-  }).drop(),
-
-  isAnimating: alias('setForAnimation.isRunning'),
-
-  namespacePath: alias('namespaceService.path'),
-
-  // this is an array of namespace paths that the current user
-  // has access to
-  accessibleNamespaces: alias('namespaceService.accessibleNamespaces'),
-  inRootNamespace: alias('namespaceService.inRootNamespace'),
-
-  namespaceTree: computed('accessibleNamespaces', function () {
-    const nsList = this.accessibleNamespaces;
-
-    if (!nsList) {
-      return [];
-    }
-    return pathToTree(nsList);
-  }),
-
-  maybeAddRoot(leaves) {
-    const userRoot = this.auth.authData.userRootNamespace;
-    if (userRoot === '') {
-      leaves.unshift('');
-    }
-
-    return leaves.uniq();
-  },
-
-  pathToLeaf(path) {
-    // dots are allowed in namespace paths
-    // so we need to preserve them, and replace slashes with dots
-    // in order to use Ember's get function on the namespace tree
-    // to pull out the correct level
-    return (
-      path
-        // trim trailing slash
-        .replace(/\/$/, '')
-        // replace dots with snowman
-        .replace(/\.+/g, DOT_REPLACEMENT)
-        // replace slash with dots
-        .replace(/\/+/g, '.')
-    );
-  },
-
-  // an array that keeps track of what additional panels to render
-  // on the menu stack
-  // if you're in  'foo/bar/baz',
-  // this array will be: ['foo', 'foo.bar', 'foo.bar.baz']
-  // the template then iterates over this, and does  Ember.get(namespaceTree, leaf)
-  // to render the nodes of each leaf
-
-  // gets set as  'lastMenuLeaves' in the ember concurrency task above
-  menuLeaves: computed('namespacePath', 'namespaceTree', 'pathToLeaf', function () {
-    let ns = this.namespacePath;
-    ns = (ns || '').replace(/^\//, '');
-    let leaves = ancestorKeysForKey(ns);
-    leaves.push(ns);
-    leaves = this.maybeAddRoot(leaves);
-
-    leaves = leaves.map(this.pathToLeaf);
-    return leaves;
-  }),
-
-  // the nodes at the root of the namespace tree
-  // these will get rendered as the bottom layer
-  rootLeaves: computed('namespaceTree', function () {
-    const tree = this.namespaceTree;
-    const leaves = Object.keys(tree);
-    return leaves;
-  }),
-
-  currentLeaf: alias('lastMenuLeaves.lastObject'),
-  canAccessMultipleNamespaces: gt('accessibleNamespaces.length', 1),
-  isUserRootNamespace: computed('auth.authData.userRootNamespace', 'namespacePath', function () {
-    return this.auth.authData.userRootNamespace === this.namespacePath;
-  }),
-
-  namespaceDisplay: computed('namespacePath', 'accessibleNamespaces', 'accessibleNamespaces.[]', function () {
-    const namespace = this.namespacePath;
-    if (!namespace) {
-      return 'root';
-    }
-    const parts = namespace?.split('/');
-    return parts[parts.length - 1];
-  }),
-
-  actions: {
-    refreshNamespaceList() {
-      this.namespaceService.findNamespacesForUser.perform();
-    },
-  },
-});
diff --git a/ui/app/components/namespace-picker.ts b/ui/app/components/namespace-picker.ts
new file mode 100644
index 00000000000..5aec1726279
--- /dev/null
+++ b/ui/app/components/namespace-picker.ts
@@ -0,0 +1,251 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import { service } from '@ember/service';
+import keys from 'core/utils/keys';
+
+import type CapabilitiesService from 'vault/services/capabilities';
+import type Router from 'vault/router';
+import type NamespaceService from 'vault/services/namespace';
+import type AuthService from 'vault/vault/services/auth';
+import type Store from '@ember-data/store';
+import errorMessage from 'vault/utils/error-message';
+
+interface NamespaceOption {
+  path: string;
+  label: string;
+}
+
+/**
+ * @module NamespacePicker
+ * @description component is used to display a dropdown listing all namespaces that the current user has access to.
+ *  The user can select a namespace from the dropdown to navigate directly to that namespace.
+ *  The "Manage" button directs the user to the namespace management page.
+ *  The "Refresh List" button refreshes the list of namespaces in the dropdown.
+ *
+ * @example
+ * <NamespacePicker class="hds-side-nav-hide-when-minimized" />
+ */
+export default class NamespacePicker extends Component {
+  @service declare auth: AuthService;
+  @service declare capabilities: CapabilitiesService;
+  @service declare namespace: NamespaceService;
+  @service declare router: Router;
+  @service declare store: Store;
+
+  // Load 200 namespaces in the namespace picker at a time
+  @tracked batchSize = 200;
+
+  @tracked canManageNamespaces = false; // Show/hide manage namespaces button
+  @tracked errorLoadingNamespaces = '';
+  @tracked hasNamespaces = false;
+  @tracked searchInput = '';
+  @tracked searchInputHelpText =
+    "Enter a full path in the search bar and hit the 'Enter' ↵ key to navigate faster.";
+
+  constructor(owner: unknown, args: Record<string, never>) {
+    super(owner, args);
+    this.loadOptions();
+    this.fetchManageCapability();
+  }
+
+  get allNamespaces(): NamespaceOption[] {
+    return this.getOptions(this.namespace?.accessibleNamespaces);
+  }
+
+  get selectedNamespace(): NamespaceOption | null {
+    return this.getSelected(this.allNamespaces, this.namespace?.path) ?? null;
+  }
+
+  private matchesPath(option: NamespaceOption, currentPath: string): boolean {
+    return option?.path === currentPath;
+  }
+
+  private getSelected(options: NamespaceOption[], currentPath: string): NamespaceOption | undefined {
+    return options.find((option) => this.matchesPath(option, currentPath));
+  }
+
+  private getOptions(accessibleNamespaces: string[]): NamespaceOption[] {
+    /* Each namespace option has 2 properties: { path and label }
+     *   - path: full namespace path (used to navigate to the namespace)
+     *   - label: text displayed inside the namespace picker dropdown (if root, then path is "", else label = path)
+     *
+     *  Example:
+     *   | path           | label          |
+     *   | ----           | -----          |
+     *   | ''             | 'root'         |
+     *   | 'parent'       | 'parent'       |
+     *   | 'parent/child' | 'parent/child' |
+     */
+    const options = (accessibleNamespaces || []).map((ns: string) => ({ path: ns, label: ns }));
+
+    // Add the user's root namespace because `sys/internal/ui/namespaces` does not include it.
+    const userRootNamespace = this.auth.authData?.userRootNamespace;
+    if (!options?.find((o) => o.path === userRootNamespace)) {
+      // the 'root' namespace is technically an empty string so we manually add the 'root' label.
+      const label = userRootNamespace === '' ? 'root' : userRootNamespace;
+      options.unshift({ path: userRootNamespace, label });
+    }
+
+    // If there are no namespaces returned by the internal endpoint, add the current namespace
+    // to the list of options. This is a fallback for when the user has access to a single namespace.
+    if (options.length === 0) {
+      // 'path' defined in the namespace service is the full namespace path
+      options.push({ path: this.namespace.path, label: this.namespace.path });
+    }
+
+    return options;
+  }
+
+  get hasSearchInput(): boolean {
+    return this.searchInput?.trim().length > 0;
+  }
+
+  get namespaceCount(): number {
+    return this.namespaceOptions.length;
+  }
+
+  get namespaceLabel(): string {
+    return this.searchInput === '' ? 'All namespaces' : 'Matching namespaces';
+  }
+
+  get namespaceOptions(): NamespaceOption[] {
+    if (this.searchInput.trim() === '') {
+      return this.allNamespaces || [];
+    } else {
+      const filtered = this.allNamespaces.filter((ns) =>
+        ns.label.toLowerCase().includes(this.searchInput.toLowerCase())
+      );
+      return filtered || [];
+    }
+  }
+
+  get noNamespacesMessage(): string {
+    const noNamespacesMessage = 'No namespaces found.';
+    const noMatchingNamespacesHelpText =
+      'No matching namespaces found. Try searching for a different namespace.';
+    return this.hasSearchInput ? noMatchingNamespacesHelpText : noNamespacesMessage;
+  }
+
+  get showNoNamespacesMessage(): boolean {
+    const hasError = this.errorLoadingNamespaces !== '';
+    return this.namespaceCount === 0 && !hasError;
+  }
+
+  get visibleNamespaceOptions(): NamespaceOption[] {
+    return this.namespaceOptions.slice(0, this.batchSize);
+  }
+
+  @action
+  adjustElementWidth(element: HTMLElement): void {
+    // Hide the element so that it doesn't affect the layout
+    element.style.display = 'none';
+
+    let maxWidth = 240; // Default minimum width
+    // Calculate the maximum width of the visible namespace options
+    // The namespace is displayed as an HDS::checkmark button, so we need to find the width of the checkmark element
+    this.visibleNamespaceOptions.forEach((namespace: NamespaceOption) => {
+      const checkmarkElement = document.querySelector(`[data-test-button="${namespace.label}"]`);
+
+      const width = (checkmarkElement as HTMLElement).offsetWidth;
+      if (width > maxWidth) {
+        maxWidth = width;
+      }
+    });
+
+    // Set the width of the target element
+    element.style.width = `${maxWidth}px`;
+
+    // Show the element once the width is set
+    element.style.display = '';
+  }
+
+  @action
+  async fetchManageCapability(): Promise<void> {
+    // The namespace picker options are from `sys/internal/ui/namespaces` which all users have permissions to request.
+    // The UI view for managing namespaces (i.e. CRUD actions) calls `sys/namespaces` and DOES require LIST permissions.
+    // This is the capability check to hide/show the button that navigates to that route.
+    const { canList } = await this.capabilities.fetchPathCapabilities('sys/namespaces');
+    this.canManageNamespaces = canList;
+  }
+
+  @action
+  focusSearchInput(element: HTMLInputElement): void {
+    // On mount, cursor should default to the search input field
+    element.focus();
+  }
+
+  @action
+  async loadOptions(): Promise<void> {
+    try {
+      await this.namespace?.findNamespacesForUser?.perform();
+      this.errorLoadingNamespaces = '';
+    } catch (error) {
+      this.errorLoadingNamespaces = errorMessage(error);
+    }
+  }
+
+  @action
+  loadMore(): void {
+    // Increase the batch size to load more items
+    this.batchSize += 200;
+  }
+
+  @action
+  setupScrollListener(element: HTMLElement): void {
+    element.addEventListener('scroll', this.onScroll);
+  }
+
+  @action
+  onScroll(event: Event): void {
+    const element = event.target as HTMLElement;
+
+    // Check if the user has scrolled to the bottom
+    if (element.scrollTop + element.clientHeight >= element.scrollHeight) {
+      this.loadMore();
+    }
+  }
+
+  @action
+  async onChange(selected: NamespaceOption): Promise<void> {
+    this.searchInput = '';
+    this.router.transitionTo('vault.cluster.dashboard', { queryParams: { namespace: selected.path } });
+  }
+
+  @action
+  async onKeyDown(event: KeyboardEvent): Promise<void> {
+    if (event.key === keys.ENTER && this.searchInput?.trim()) {
+      const matchingNamespace = this.allNamespaces.find((ns) => ns.label === this.searchInput.trim());
+
+      if (matchingNamespace) {
+        this.searchInput = '';
+        this.router.transitionTo('vault.cluster.dashboard', {
+          queryParams: { namespace: matchingNamespace.path },
+        });
+      }
+    }
+  }
+
+  @action
+  onSearchInput(event: Event): void {
+    const target = event.target as HTMLInputElement;
+    this.searchInput = target.value;
+  }
+
+  @action
+  async refreshList(): Promise<void> {
+    this.searchInput = '';
+    await this.loadOptions();
+  }
+
+  @action
+  toggleNamespacePicker() {
+    // Reset the search input when the dropdown is toggled
+    this.searchInput = '';
+  }
+}
diff --git a/ui/app/components/not-found.hbs b/ui/app/components/not-found.hbs
index a0b12ce1341..c24a50a7335 100644
--- a/ui/app/components/not-found.hbs
+++ b/ui/app/components/not-found.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-shadowless" data-test-not-found>
   <PageHeader as |p|>
diff --git a/ui/app/components/not-found.js b/ui/app/components/not-found.js
index 1787694a344..23e532703f3 100644
--- a/ui/app/components/not-found.js
+++ b/ui/app/components/not-found.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/oidc-callback-splash.hbs b/ui/app/components/oidc-callback-splash.hbs
similarity index 94%
rename from ui/app/templates/components/oidc-callback-splash.hbs
rename to ui/app/components/oidc-callback-splash.hbs
index 998886f759c..7f7c80dee5d 100644
--- a/ui/app/templates/components/oidc-callback-splash.hbs
+++ b/ui/app/components/oidc-callback-splash.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="splash-page-container section is-flex-v-centered-tablet is-flex-grow-1 is-fullwidth">
   <div class="columns is-centered is-gapless is-fullwidth">
diff --git a/ui/app/templates/components/oidc-consent-block.hbs b/ui/app/components/oidc-consent-block.hbs
similarity index 96%
rename from ui/app/templates/components/oidc-consent-block.hbs
rename to ui/app/components/oidc-consent-block.hbs
index 3b1782438df..3e68e31111b 100644
--- a/ui/app/templates/components/oidc-consent-block.hbs
+++ b/ui/app/components/oidc-consent-block.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.didCancel}}
   <h3 class="title is-3" data-test-consent-title>
diff --git a/ui/app/components/oidc-consent-block.js b/ui/app/components/oidc-consent-block.js
index 4da70aa0ae1..1fea875ffb6 100644
--- a/ui/app/components/oidc-consent-block.js
+++ b/ui/app/components/oidc-consent-block.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/oidc/assignment-form.hbs b/ui/app/components/oidc/assignment-form.hbs
similarity index 95%
rename from ui/app/templates/components/oidc/assignment-form.hbs
rename to ui/app/components/oidc/assignment-form.hbs
index a47a22f9623..b2783b29e00 100644
--- a/ui/app/templates/components/oidc/assignment-form.hbs
+++ b/ui/app/components/oidc/assignment-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form {{on "submit" (perform this.save)}}>
   <div class="box is-sideless is-fullwidth is-marginless">
@@ -24,7 +24,6 @@
       @id="entities"
       @label="Entities"
       @placeholder="Search"
-      @renderInPlace={{true}}
       @models={{array "identity/entity"}}
       @inputValue={{@model.entityIds}}
       @shouldRenderName={{true}}
@@ -37,7 +36,6 @@
       @id="groups"
       @label="Groups"
       @placeholder="Search"
-      @renderInPlace={{true}}
       @models={{array "identity/group"}}
       @inputValue={{@model.groupIds}}
       @shouldRenderName={{true}}
diff --git a/ui/app/components/oidc/assignment-form.js b/ui/app/components/oidc/assignment-form.js
index b0349927d2e..3efe400837b 100644
--- a/ui/app/components/oidc/assignment-form.js
+++ b/ui/app/components/oidc/assignment-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/oidc/client-form.hbs b/ui/app/components/oidc/client-form.hbs
similarity index 98%
rename from ui/app/templates/components/oidc/client-form.hbs
rename to ui/app/components/oidc/client-form.hbs
index 57a8ec5efd3..73480db2f36 100644
--- a/ui/app/templates/components/oidc/client-form.hbs
+++ b/ui/app/components/oidc/client-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/components/oidc/client-form.js b/ui/app/components/oidc/client-form.js
index 12f74c0abfd..4622c4bbe0b 100644
--- a/ui/app/components/oidc/client-form.js
+++ b/ui/app/components/oidc/client-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/oidc/client-list.hbs b/ui/app/components/oidc/client-list.hbs
new file mode 100644
index 00000000000..b4fdaddb836
--- /dev/null
+++ b/ui/app/components/oidc/client-list.hbs
@@ -0,0 +1,55 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#each @model as |client|}}
+  <LinkedBlock
+    class="list-item-row"
+    @params={{array "vault.cluster.access.oidc.clients.client.details" client.name}}
+    data-test-oidc-client-linked-block={{client.name}}
+  >
+    <div class="level is-mobile">
+      <div class="level-left">
+        <div>
+          <Icon @name="code" class="has-text-grey-light" />
+          <span class="has-text-weight-semibold is-underline">
+            {{client.name}}
+          </span>
+          <div class="has-text-grey is-size-8">
+            Client ID:
+            {{client.clientId}}
+          </div>
+        </div>
+      </div>
+      <div class="level-right is-flex is-paddingless is-marginless">
+        <div class="level-item">
+          {{#if (or client.canRead client.canEdit)}}
+            <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
+              <dd.ToggleIcon
+                @icon="more-horizontal"
+                @text="Application nav options"
+                @hasChevron={{false}}
+                data-test-popup-menu-trigger
+              />
+              {{#if client.canRead}}
+                <dd.Interactive
+                  @route="vault.cluster.access.oidc.clients.client.details"
+                  @model={{client.name}}
+                  data-test-oidc-client-menu-link="details"
+                >Details</dd.Interactive>
+              {{/if}}
+              {{#if client.canEdit}}
+                <dd.Interactive
+                  @route="vault.cluster.access.oidc.clients.client.edit"
+                  @model={{client.name}}
+                  data-test-oidc-client-menu-link="edit"
+                >Edit</dd.Interactive>
+              {{/if}}
+            </Hds::Dropdown>
+          {{/if}}
+        </div>
+      </div>
+    </div>
+  </LinkedBlock>
+{{/each}}
\ No newline at end of file
diff --git a/ui/app/components/oidc/key-form.hbs b/ui/app/components/oidc/key-form.hbs
new file mode 100644
index 00000000000..161c28b31f0
--- /dev/null
+++ b/ui/app/components/oidc/key-form.hbs
@@ -0,0 +1,83 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" (perform this.save)}}>
+  <div class="box is-sideless is-fullwidth is-bottomless">
+    <MessageError @errorMessage={{this.errorBanner}} />
+    {{#each @model.formFields as |attr|}}
+      <FormField @attr={{attr}} @model={{@model}} @modelValidations={{this.modelValidations}} />
+    {{/each}}
+  </div>
+  {{#unless @isModalForm}}
+    {{! RADIO CARD + SEARCH SELECT }}
+    <div class="box is-sideless is-fullwidth is-marginless has-top-padding-xxl">
+      <Hds::Text::Display @tag="h2" @size="400">Allowed applications</Hds::Text::Display>
+      <div class="is-flex-row">
+        <RadioCard
+          data-test-oidc-radio="allow-all"
+          @title="Allow every application to use"
+          @description="All applications can use this key for authentication requests."
+          @icon="globe"
+          @value="allow_all"
+          @groupValue={{this.radioCardGroupValue}}
+          @onChange={{this.handleClientSelection}}
+        />
+        <RadioCard
+          data-test-oidc-radio="limited"
+          @title="Limit access to selected application"
+          @description="Only selected applications can use this key for authentication requests."
+          @icon="globe-private"
+          @value="limited"
+          @groupValue={{this.radioCardGroupValue}}
+          @onChange={{this.handleClientSelection}}
+          @disabled={{@model.isNew}}
+          @tooltipMessage={{if
+            @model.isNew
+            "This option has been disabled for now. To limit access, you must first create an application that references this key."
+          }}
+        />
+      </div>
+      {{#if (eq this.radioCardGroupValue "limited")}}
+        <SearchSelect
+          @id="allowedClientIds"
+          @label="Application name"
+          @subText="Select which applications are allowed to use this key. Only applications that currently reference this key will appear in the dropdown."
+          @models={{array "oidc/client"}}
+          @inputValue={{@model.allowedClientIds}}
+          @onChange={{this.handleClientSelection}}
+          @disallowNewItems={{true}}
+          @fallbackComponent="string-list"
+          @passObject={{true}}
+          @objectKeys={{array "clientId"}}
+          @queryObject={{this.filterDropdownOptions}}
+        />
+      {{/if}}
+    </div>
+  {{/unless}}
+  <div class="field box is-fullwidth is-bottomless">
+    <div class="control">
+      <Hds::Button
+        @text={{if @model.isNew "Create" "Update"}}
+        @icon={{if this.save.isRunning "loading"}}
+        type="submit"
+        disabled={{this.save.isRunning}}
+        data-test-oidc-key-save
+      />
+      <Hds::Button
+        @text="Cancel"
+        @color="secondary"
+        class="has-left-margin-s"
+        disabled={{this.save.isRunning}}
+        {{on "click" this.cancel}}
+        data-test-oidc-key-cancel
+      />
+    </div>
+    {{#if this.invalidFormAlert}}
+      <div class="control">
+        <AlertInline @type="danger" class="has-top-padding-s" @message={{this.invalidFormAlert}} />
+      </div>
+    {{/if}}
+  </div>
+</form>
\ No newline at end of file
diff --git a/ui/app/components/oidc/key-form.js b/ui/app/components/oidc/key-form.js
index 9fa7def3718..b00e5e96b72 100644
--- a/ui/app/components/oidc/key-form.js
+++ b/ui/app/components/oidc/key-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -22,6 +22,7 @@ import { task } from 'ember-concurrency';
  * @param {Object} model - oidc client model
  * @param {onCancel} onCancel - callback triggered when cancel button is clicked
  * @param {onSave} onSave - callback triggered on save success
+ * @param {boolean} [isModalForm=false] - if true, hides inputs related to selecting an application which is only relevant to the OIDC provider workflow.
  */
 
 export default class OidcKeyForm extends Component {
@@ -83,7 +84,9 @@ export default class OidcKeyForm extends Component {
           `Successfully ${isNew ? 'created' : 'updated'} the key
           ${name}.`
         );
-        this.args.onSave();
+        // this form is sometimes used in a modal, passing the model notifies
+        // the parent if the save was successful
+        this.args.onSave(this.args.model);
       }
     } catch (error) {
       const message = error.errors ? error.errors.join('. ') : error.message;
diff --git a/ui/app/templates/components/oidc/provider-form.hbs b/ui/app/components/oidc/provider-form.hbs
similarity index 97%
rename from ui/app/templates/components/oidc/provider-form.hbs
rename to ui/app/components/oidc/provider-form.hbs
index d48b5c07a6e..4c1c5cdf5f9 100644
--- a/ui/app/templates/components/oidc/provider-form.hbs
+++ b/ui/app/components/oidc/provider-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -97,7 +97,7 @@
         @fallbackComponent="string-list"
         @passObject={{true}}
         @objectKeys={{array "clientId"}}
-        @renderInfoTooltip={{this.renderInfoTooltip}}
+        @renderTooltip={{this.renderTooltip}}
       />
     {{/if}}
   </div>
diff --git a/ui/app/components/oidc/provider-form.js b/ui/app/components/oidc/provider-form.js
index 96ef58abc54..29e6d3a27e5 100644
--- a/ui/app/components/oidc/provider-form.js
+++ b/ui/app/components/oidc/provider-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -37,7 +37,7 @@ export default class OidcProviderForm extends Component {
       : 'limited';
 
   // function passed to search select
-  renderInfoTooltip(selection, dropdownOptions) {
+  renderTooltip(selection, dropdownOptions) {
     // if a client has been deleted it will not exist in dropdownOptions (response from search select's query)
     const clientExists = !!dropdownOptions.find((opt) => opt.clientId === selection);
     return !clientExists ? 'The application associated with this client_id no longer exists' : false;
diff --git a/ui/app/templates/components/oidc/provider-list.hbs b/ui/app/components/oidc/provider-list.hbs
similarity index 92%
rename from ui/app/templates/components/oidc/provider-list.hbs
rename to ui/app/components/oidc/provider-list.hbs
index d684399fb06..d18b19c06bb 100644
--- a/ui/app/templates/components/oidc/provider-list.hbs
+++ b/ui/app/components/oidc/provider-list.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each @model as |provider|}}
   <LinkedBlock
@@ -34,19 +34,17 @@
               />
               {{#if provider.canRead}}
                 <dd.Interactive
-                  @text="Details"
                   @route="vault.cluster.access.oidc.providers.provider.details"
                   @model={{provider.name}}
                   data-test-oidc-provider-menu-link="details"
-                />
+                >Details</dd.Interactive>
               {{/if}}
               {{#if provider.canEdit}}
                 <dd.Interactive
-                  @text="Edit"
                   @route="vault.cluster.access.oidc.providers.provider.edit"
                   @model={{provider.name}}
                   data-test-oidc-provider-menu-link="edit"
-                />
+                >Edit</dd.Interactive>
               {{/if}}
             </Hds::Dropdown>
           {{/if}}
diff --git a/ui/app/templates/components/oidc/scope-form.hbs b/ui/app/components/oidc/scope-form.hbs
similarity index 88%
rename from ui/app/templates/components/oidc/scope-form.hbs
rename to ui/app/components/oidc/scope-form.hbs
index 5d14013a2fd..7be4c229902 100644
--- a/ui/app/templates/components/oidc/scope-form.hbs
+++ b/ui/app/components/oidc/scope-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -44,10 +44,6 @@
     {{#each @model.formFields as |field|}}
       <FormField @attr={{field}} @model={{@model}} @modelValidations={{this.modelValidations}} />
     {{/each}}
-    <p class="is-size-9 has-text-grey has-bottom-margin-l">
-      You can use Alt+Tab (Option+Tab on MacOS) in the code editor to skip to the next field. Click 'How to write JSON
-      template for scopes' to view an example.
-    </p>
   </div>
   <div class="has-top-margin-l has-bottom-margin-l">
     <Hds::Button
@@ -82,7 +78,7 @@
       <p data-test-scope-modal="text">
         Example of a JSON template for scopes:
       </p>
-      <JsonEditor @value={{this.exampleTemplate}} @mode="ruby" @readOnly={{true}} @container=".hds-modal" />
+      <Hds::CodeBlock @value={{this.exampleTemplate}} @language="ruby" @hasCopyButton={{true}} />
       <p class="has-top-margin-m">
         The full list of template parameters can be found
         <DocLink @path="/vault/docs/concepts/oidc-provider#scopes">
diff --git a/ui/app/components/oidc/scope-form.js b/ui/app/components/oidc/scope-form.js
index cd69b4320c4..6f472e7f31c 100644
--- a/ui/app/components/oidc/scope-form.js
+++ b/ui/app/components/oidc/scope-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/okta-number-challenge.hbs b/ui/app/components/okta-number-challenge.hbs
new file mode 100644
index 00000000000..26ea3569421
--- /dev/null
+++ b/ui/app/components/okta-number-challenge.hbs
@@ -0,0 +1,36 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Card::Container @level="high" @hasBorder={{true}} class="overflow-auto" data-test-okta-number-challenge>
+  <div class="has-padding-l">
+    <p data-test-okta-number-challenge-description>
+      To finish signing in, you will need to complete an additional MFA step.
+    </p>
+    {{#if @hasError}}
+      <MessageError class="has-top-margin-s" @errorMessage={{@hasError}} />
+    {{else if @correctAnswer}}
+      <p class="has-top-margin-s has-text-black has-text-weight-semibold" data-test-verification-type>
+        Okta verification
+      </p>
+      <p data-test-description>Select the following number to complete verification:</p>
+      <h1 class="title has-font-weight-normal has-top-margin-m has-bottom-margin-s" data-test-answer>
+        {{@correctAnswer}}
+      </h1>
+    {{else}}
+      <div class="has-top-margin-l has-bottom-margin-m is-flex-row">
+        <Hds::Icon @name="loading" @isInline={{true}} />
+        <p class="has-left-margin-xs" data-test-loading>Please wait...</p>
+      </div>
+    {{/if}}
+  </div>
+  <Hds::Button
+    @text="Back to login"
+    @icon="arrow-left"
+    @color="tertiary"
+    class="has-bottom-margin-s has-left-margin-s"
+    {{on "click" @onReturnToLogin}}
+    data-test-back-button
+  />
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/components/outer-html.js b/ui/app/components/outer-html.js
deleted file mode 100644
index 251c64a5c5b..00000000000
--- a/ui/app/components/outer-html.js
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// THIS COMPONENT IS ONLY FOR EXTENDING
-// You should use this component if you want to use outerHTML symantics
-// in your components - this is the default for upcoming Glimmer components
-import Component from '@ember/component';
-
-export default Component.extend({
-  tagName: '',
-});
-
-// yep! that's it, it's more of a way to keep track of what components
-// use tagless semantics to make the upgrade to glimmer components easier
diff --git a/ui/app/components/page/userpass-reset-password.hbs b/ui/app/components/page/userpass-reset-password.hbs
index c2aae8f3150..72d7ebfd1a6 100644
--- a/ui/app/components/page/userpass-reset-password.hbs
+++ b/ui/app/components/page/userpass-reset-password.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
@@ -36,7 +36,7 @@
       @icon={{if this.updatePassword.isRunning "loading"}}
       disabled={{this.updatePassword.isRunning}}
       type="submit"
-      data-test-reset-password-save
+      data-test-submit
     />
     {{#if this.error}}
       <Hds::Alert @type="compact" @color="critical" class="has-left-margin-s" data-test-reset-password-error as |A|>
diff --git a/ui/app/components/page/userpass-reset-password.js b/ui/app/components/page/userpass-reset-password.js
index 4a88e316f46..6fcd25c92d6 100644
--- a/ui/app/components/page/userpass-reset-password.js
+++ b/ui/app/components/page/userpass-reset-password.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,11 +7,10 @@ import { service } from '@ember/service';
 import Component from '@glimmer/component';
 import { tracked } from '@glimmer/tracking';
 import { task } from 'ember-concurrency';
-import errorMessage from 'vault/utils/error-message';
 
 export default class PageUserpassResetPasswordComponent extends Component {
-  @service store;
   @service flashMessages;
+  @service api;
 
   @tracked newPassword = '';
   @tracked error = '';
@@ -26,7 +25,6 @@ export default class PageUserpassResetPasswordComponent extends Component {
   *updatePassword(evt) {
     evt.preventDefault();
     this.error = '';
-    const adapter = this.store.adapterFor('auth-method');
     const { backend, username } = this.args;
     if (!backend || !username) return;
     if (!this.newPassword) {
@@ -34,10 +32,11 @@ export default class PageUserpassResetPasswordComponent extends Component {
       return;
     }
     try {
-      yield adapter.resetPassword(backend, username, this.newPassword);
+      yield this.api.auth.userpassResetPassword(username, backend, { password: this.newPassword });
       this.onSuccess();
     } catch (e) {
-      this.error = errorMessage(e, 'Check Vault logs for details');
+      const { message } = yield this.api.parseError(e, 'Check Vault logs for details');
+      this.error = message;
     }
   }
 }
diff --git a/ui/app/templates/components/pgp-file.hbs b/ui/app/components/pgp-file.hbs
similarity index 96%
rename from ui/app/templates/components/pgp-file.hbs
rename to ui/app/components/pgp-file.hbs
index 6dbce8385ce..6d31908a48e 100644
--- a/ui/app/templates/components/pgp-file.hbs
+++ b/ui/app/components/pgp-file.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="level is-mobile">
   <div class="level-left">
@@ -23,7 +23,7 @@
         name={{concat "useText-" this.elementId}}
         class="toggle is-success is-small"
         checked={{this.key.enterAsText}}
-        onchange={{action (toggle "enterAsText" this.key)}}
+        onchange={{action "handleToggle"}}
       />
       <label for={{concat "useText-" this.elementId}} class="has-text-weight-bold is-size-8">
         Enter as text
diff --git a/ui/app/components/pgp-file.js b/ui/app/components/pgp-file.js
index 20f4e54e07e..b3298a89f14 100644
--- a/ui/app/components/pgp-file.js
+++ b/ui/app/components/pgp-file.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -64,6 +64,9 @@ export default Component.extend({
   ),
 
   actions: {
+    handleToggle(e) {
+      set(this.key, 'enterAsText', e.target.checked);
+    },
     pickedFile(e) {
       const { files } = e.target;
       if (!files.length) {
diff --git a/ui/app/templates/components/pgp-list.hbs b/ui/app/components/pgp-list.hbs
similarity index 88%
rename from ui/app/templates/components/pgp-list.hbs
rename to ui/app/components/pgp-list.hbs
index 78769016cd9..1489858b3a2 100644
--- a/ui/app/templates/components/pgp-list.hbs
+++ b/ui/app/components/pgp-list.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each this.listData as |key index|}}
   <PgpFile @key={{key}} @index={{index}} @onChange={{action "setKey"}} />
diff --git a/ui/app/components/pgp-list.js b/ui/app/components/pgp-list.js
index cd68e8b3085..b68c614c9f1 100644
--- a/ui/app/components/pgp-list.js
+++ b/ui/app/components/pgp-list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/plugin-documentation-flyout.hbs b/ui/app/components/plugin-documentation-flyout.hbs
new file mode 100644
index 00000000000..4483cbcb5fa
--- /dev/null
+++ b/ui/app/components/plugin-documentation-flyout.hbs
@@ -0,0 +1,89 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if @isOpen}}
+  <Hds::Flyout @onClose={{@onClose}} data-test-flyout as |F|>
+    <F.Header @icon="info">
+      {{#if this.hasPlugin}}
+        {{this.displayName}}
+        plugin information
+      {{else}}
+        External plugins information
+      {{/if}}
+    </F.Header>
+
+    <F.Body>
+      <div class="has-bottom-margin-m">
+        {{#if this.hasPlugin}}
+          <Hds::Text::Body>
+            The
+            <strong>{{this.displayName}}</strong>
+            {{this.pluginTypeDisplay}}
+            is not currently enabled in this Vault instance. To use this plugin, it needs to be enabled by a Vault
+            administrator.
+          </Hds::Text::Body>
+        {{else}}
+          <Hds::Text::Body>
+            External plugins are plugins found in the plugin catalog that are not part of Vault's built-in engines. These may
+            be custom plugins or third-party plugins that have been registered with your Vault instance.
+          </Hds::Text::Body>
+          <Hds::Text::Body class="has-top-margin-s">
+            External plugins appear in the catalog when they have been registered using the
+            <code aria-label="vault plugin register command">vault plugin register</code>
+            command or through the Vault API. They provide additional functionality beyond Vault's built-in secrets engines
+            and authentication methods.
+          </Hds::Text::Body>
+        {{/if}}
+      </div>
+
+      <div>
+        <Hds::Text::Display @tag="h3" @size="300" class="has-bottom-margin-xs">
+          Documentation
+        </Hds::Text::Display>
+        {{#if this.hasPlugin}}
+          <Hds::Text::Body>
+            For more information about configuring and using the
+            {{this.displayName}}
+            {{this.pluginTypeDisplay}}, visit the official documentation:
+          </Hds::Text::Body>
+        {{else}}
+          <Hds::Text::Body>
+            For more information about registering and managing external plugins, visit the official documentation:
+          </Hds::Text::Body>
+        {{/if}}
+        <div class="has-top-margin-xs">
+          <Hds::Link::Standalone
+            @text="Register and enable external plugins"
+            @href="https://developer.hashicorp.com/vault/docs/plugins/register"
+            @icon="external-link"
+            @iconPosition="trailing"
+            target="_blank"
+            rel="noopener noreferrer"
+            data-test-link-to="Register and enable external plugins"
+          />
+          {{#unless this.hasPlugin}}
+            <div class="has-top-margin-xs">
+              <Hds::Link::Standalone
+                @text="Plugin development guide"
+                @href="https://developer.hashicorp.com/vault/docs/plugins/plugin-development"
+                @icon="external-link"
+                @iconPosition="trailing"
+                target="_blank"
+                rel="noopener noreferrer"
+                data-test-link-to="Plugin development guide"
+              />
+            </div>
+          {{/unless}}
+        </div>
+      </div>
+    </F.Body>
+
+    <F.Footer>
+      <Hds::ButtonSet>
+        <Hds::Button @text="Close" @color="primary" {{on "click" @onClose}} data-test-button="Close" />
+      </Hds::ButtonSet>
+    </F.Footer>
+  </Hds::Flyout>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/plugin-documentation-flyout.js b/ui/app/components/plugin-documentation-flyout.js
new file mode 100644
index 00000000000..6bdd16810f8
--- /dev/null
+++ b/ui/app/components/plugin-documentation-flyout.js
@@ -0,0 +1,51 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+
+/**
+ * Plugin Documentation Flyout Component
+ *
+ * Modal/flyout that opens when disabled plugin is clicked.
+ * Displays information about plugins and links to general Vault plugin documentation.
+ *
+ * @example
+ * ```js
+ * <PluginDocumentationFlyout
+ *   @isOpen={{this.showFlyout}}
+ *   @plugin={{this.flyoutPlugin}}
+ *   @pluginType="secret"
+ *   @onClose={{this.closeFlyout}}
+ * />
+ * ```
+ * @param {boolean} isOpen - Whether the flyout is currently open
+ * @param {Object} plugin - Plugin object containing type, displayName, etc.
+ * @param {string} pluginType - Type of plugin (secret, auth)
+ * @param {Function} onClose - Callback when flyout is closed
+ */
+
+export default class PluginDocumentationFlyoutComponent extends Component {
+  // Get the display name for the plugin
+  get displayName() {
+    // Support both plugin object and direct displayName/pluginName args
+    return (
+      this.args.displayName ||
+      this.args.plugin?.displayName ||
+      this.args.pluginName ||
+      this.args.plugin?.type ||
+      'Plugin'
+    );
+  }
+
+  // Get the plugin type for display
+  get pluginTypeDisplay() {
+    return this.args.pluginType === 'secret' ? 'secrets engine' : 'auth method';
+  }
+
+  // Check if we have plugin-specific data
+  get hasPlugin() {
+    return !!(this.args.plugin || this.args.pluginName || this.args.displayName);
+  }
+}
diff --git a/ui/app/components/policy-form.hbs b/ui/app/components/policy-form.hbs
index 6545348de00..c3b7f42728b 100644
--- a/ui/app/components/policy-form.hbs
+++ b/ui/app/components/policy-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form {{on "submit" (perform this.save)}} data-test-policy-form>
   <div class="box is-shadowless is-fullwidth is-marginless">
@@ -24,7 +24,6 @@
     {{/if}}
     <div class="field">
       <Toolbar aria-label="toolbar for managing {{or @model.name 'new'}} policy">
-        <label class="has-text-weight-bold has-right-margin-xxs">Policy</label>
         {{#if @renderPolicyExampleModal}}
           {{! only true in policy create and edit routes }}
           <ToolbarFilters aria-label="help tools for managing {{or @model.name 'new'}} policy">
@@ -34,13 +33,12 @@
               @size="small"
               @color="tertiary"
               {{on "click" (fn (mut this.showTemplateModal))}}
-              data-test-policy-example-button
+              data-test-button="How to write a policy"
             />
           </ToolbarFilters>
         {{/if}}
-        <ToolbarActions aria-label="actions for managing {{or @model.name 'new'}} policy">
-          <div class="toolbar-separator"></div>
-          {{#if @model.isNew}}
+        {{#if @model.isNew}}
+          <ToolbarActions aria-label="actions for managing {{or @model.name 'new'}} policy">
             <div class="control is-flex">
               <Input
                 id="fileUploadToggle"
@@ -53,27 +51,16 @@
               />
               <label for="fileUploadToggle" class="has-text-weight-bold is-size-8">Upload file</label>
             </div>
-          {{else}}
-            {{! EDITING - no file upload toggle}}
-            <Hds::Copy::Button
-              @text="Copy"
-              @isIconOnly={{true}}
-              @textToCopy={{@model.policy}}
-              @onError={{(fn
-                (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-              )}}
-              class="transparent"
-              data-test-copy-button
-            />
-          {{/if}}
-        </ToolbarActions>
+          </ToolbarActions>
+        {{/if}}
       </Toolbar>
       {{#if this.showFileUpload}}
-        <TextFile @uploadOnly={{true}} @onChange={{this.setPolicyFromFile}} />
+        <div class="has-top-margin-xs">
+          <TextFile @uploadOnly={{true}} @onChange={{this.setPolicyFromFile}} />
+        </div>
       {{else}}
         <JsonEditor
           @title="Policy"
-          @showToolbar={{false}}
           @value={{@model.policy}}
           @valueUpdated={{action (mut @model.policy)}}
           @mode="ruby"
@@ -81,11 +68,6 @@
           data-test-policy-editor
         />
       {{/if}}
-      <div class="has-top-margin-xs">
-        <span class="is-size-9 has-text-grey has-bottom-margin-l">
-          You can use Alt+Tab (Option+Tab on MacOS) in the code editor to skip to the next field.
-        </span>
-      </div>
     </div>
     {{#each @model.additionalAttrs as |attr|}}
       <FormField data-test-field={{true}} @attr={{attr}} @model={{@model}} />
@@ -98,14 +80,14 @@
         @icon={{if this.save.isRunning "loading"}}
         type="submit"
         disabled={{this.save.isRunning}}
-        data-test-policy-save
+        data-test-submit
       />
       <Hds::Button
         @text="Cancel"
         @color="secondary"
         disabled={{this.save.isRunning}}
         {{on "click" this.cancel}}
-        data-test-policy-cancel
+        data-test-cancel
       />
     </Hds::ButtonSet>
   </div>
@@ -126,7 +108,7 @@
       Policy
     </M.Header>
     <M.Body>
-      <PolicyExample @policyType={{@model.policyType}} @container="#policy-example-modal" />
+      <PolicyExample @policyType={{@model.policyType}} />
     </M.Body>
     <M.Footer as |F|>
       <Hds::Button @text="Close" {{on "click" F.close}} data-test-modal-close-button />
diff --git a/ui/app/components/policy-form.js b/ui/app/components/policy-form.js
index ba673cb2d30..5bb01ae8bf4 100644
--- a/ui/app/components/policy-form.js
+++ b/ui/app/components/policy-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/radial-progress.hbs b/ui/app/components/radial-progress.hbs
similarity index 92%
rename from ui/app/templates/components/radial-progress.hbs
rename to ui/app/components/radial-progress.hbs
index 7297135a4a1..4d1ffdde96b 100644
--- a/ui/app/templates/components/radial-progress.hbs
+++ b/ui/app/components/radial-progress.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <circle
   data-test-path
diff --git a/ui/app/components/radial-progress.js b/ui/app/components/radial-progress.js
index b8d2d31b17d..41fb2a7632f 100644
--- a/ui/app/components/radial-progress.js
+++ b/ui/app/components/radial-progress.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/raft-join.hbs b/ui/app/components/raft-join.hbs
similarity index 97%
rename from ui/app/templates/components/raft-join.hbs
rename to ui/app/components/raft-join.hbs
index a727955e9d0..e3982d30b67 100644
--- a/ui/app/templates/components/raft-join.hbs
+++ b/ui/app/components/raft-join.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Alert @type="inline" @color="warning" as |A|>
   <A.Title class="alert-title">Vault is sealed</A.Title>
diff --git a/ui/app/components/raft-join.js b/ui/app/components/raft-join.js
index fd5c57ec869..45de744cd8a 100644
--- a/ui/app/components/raft-join.js
+++ b/ui/app/components/raft-join.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/raft-storage-overview.hbs b/ui/app/components/raft-storage-overview.hbs
similarity index 89%
rename from ui/app/templates/components/raft-storage-overview.hbs
rename to ui/app/components/raft-storage-overview.hbs
index 7c4e00100fc..09c42498ac0 100644
--- a/ui/app/templates/components/raft-storage-overview.hbs
+++ b/ui/app/components/raft-storage-overview.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::PageHeader class="has-top-margin-xl has-bottom-margin-m" as |PH|>
   <PH.Title>Raft Storage</PH.Title>
@@ -12,13 +12,12 @@
         <dd.Interactive
           @href="/v1/sys/storage/raft/snapshot"
           @isHrefExternal={{false}}
-          @text="Download"
           {{on "click" (action "downloadViaServiceWorker")}}
-        />
+        >Download</dd.Interactive>
       {{else}}
-        <dd.Interactive @text="Download" {{on "click" (action "downloadSnapshot")}} />
+        <dd.Interactive {{on "click" (action "downloadSnapshot")}}>Download</dd.Interactive>
       {{/if}}
-      <dd.Interactive @text="Restore" @route="vault.cluster.storage-restore" />
+      <dd.Interactive @route="vault.cluster.storage-restore">Restore</dd.Interactive>
     </Hds::Dropdown>
   </PH.Actions>
 </Hds::PageHeader>
diff --git a/ui/app/components/raft-storage-overview.js b/ui/app/components/raft-storage-overview.js
index 83389d5ef09..cea5cb4b6f6 100644
--- a/ui/app/components/raft-storage-overview.js
+++ b/ui/app/components/raft-storage-overview.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@ember/component';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 import config from '../config/environment';
 import { service } from '@ember/service';
 
diff --git a/ui/app/templates/components/raft-storage-restore.hbs b/ui/app/components/raft-storage-restore.hbs
similarity index 94%
rename from ui/app/templates/components/raft-storage-restore.hbs
rename to ui/app/components/raft-storage-restore.hbs
index 9166fff9522..a1343ebdf1b 100644
--- a/ui/app/templates/components/raft-storage-restore.hbs
+++ b/ui/app/components/raft-storage-restore.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -36,7 +36,7 @@
         <A.Title>This might take a while</A.Title>
         <A.Description>Raft snapshots can be very large files. Uploading the snapshot may take some time.</A.Description>
       </Hds::Alert>
-      <FileToArrayBuffer @onChange={{action (mut this.file)}} />
+      <FileToArrayBuffer @label="Choose a file..." @onChange={{action (mut this.file)}} />
       <div class="b-checkbox">
         <input
           type="checkbox"
diff --git a/ui/app/components/raft-storage-restore.js b/ui/app/components/raft-storage-restore.js
index f086a456b5a..dc9f488aa76 100644
--- a/ui/app/components/raft-storage-restore.js
+++ b/ui/app/components/raft-storage-restore.js
@@ -1,14 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@ember/component';
 import { task } from 'ember-concurrency';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 import { service } from '@ember/service';
 import { alias } from '@ember/object/computed';
-import { AbortController } from 'fetch';
 
 export default Component.extend({
   file: null,
diff --git a/ui/app/components/recovery/page/header.hbs b/ui/app/components/recovery/page/header.hbs
new file mode 100644
index 00000000000..4ce37ec039e
--- /dev/null
+++ b/ui/app/components/recovery/page/header.hbs
@@ -0,0 +1,36 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::PageHeader class="has-top-padding-l has-bottom-padding-m" as |PH|>
+  {{#if @breadcrumbs}}
+    <PH.Breadcrumb>
+      <Page::Breadcrumbs @breadcrumbs={{@breadcrumbs}} />
+    </PH.Breadcrumb>
+  {{/if}}
+
+  <PH.Title>
+    {{@title}}
+    {{#if this.version.isCommunity}}
+      <Hds::Badge @text="Enterprise" @color="highlight" data-test-badge="enterprise" />
+    {{/if}}
+  </PH.Title>
+
+  <PH.Subtitle>
+    {{@subtitle}}
+  </PH.Subtitle>
+
+  {{#if @action}}
+    <PH.Actions>
+      <Hds::Button
+        @text={{@action.text}}
+        @icon={{@action.icon}}
+        @iconPosition={{@action.iconPosition}}
+        @color={{@action.color}}
+        @route={{@action.route}}
+        @models={{@action.models}}
+      />
+    </PH.Actions>
+  {{/if}}
+</Hds::PageHeader>
\ No newline at end of file
diff --git a/ui/app/components/recovery/page/header.ts b/ui/app/components/recovery/page/header.ts
new file mode 100644
index 00000000000..277bf9f213e
--- /dev/null
+++ b/ui/app/components/recovery/page/header.ts
@@ -0,0 +1,18 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import type VersionService from 'vault/services/version';
+
+interface Args {
+  title: string;
+  subtitle?: string;
+  action?: unknown;
+}
+
+export default class Header extends Component<Args> {
+  @service declare readonly version: VersionService;
+}
diff --git a/ui/app/components/recovery/page/snapshots.hbs b/ui/app/components/recovery/page/snapshots.hbs
new file mode 100644
index 00000000000..d4a0774525a
--- /dev/null
+++ b/ui/app/components/recovery/page/snapshots.hbs
@@ -0,0 +1,48 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Recovery::Page::Header
+  @title="Secrets Recovery"
+  @subtitle="Recover lost or deleted data from a raft snapshot. Supported data includes KV v1 and Cubbyhole secrets or Database static roles."
+/>
+
+{{#if @model.showCommunityMessage}}
+  <EmptyState
+    @title="Secrets Recovery is an enterprise feature"
+    @icon="sync-reverse"
+    @message="Secrets Recovery allows you to restore accidentally deleted or lost secrets from a snapshot. The snapshots can be provided via upload or loaded from external storage."
+  >
+    <Hds::Button
+      @text="Learn more about upgrading"
+      @color="tertiary"
+      @icon="docs-link"
+      @iconPosition="trailing"
+      @href={{doc-link "/vault/docs/enterprise"}}
+      @isHrefExternal={{true}}
+    />
+  </EmptyState>
+{{else if (not @model.snapshots)}}
+  {{! Currently, only a single snapshot is supported and the UI automatically redirects users to "recovery.snapshots.snapshot.manage" if one exists.
+  In the future, this may change to support multiple loaded snapshots and a LIST view will be built then. }}
+  {{#let (get this.emptyStateDetails this.state) as |d|}}
+    <EmptyState @title={{d.title}} @icon={{d.icon}} @message={{d.message}}>
+
+      {{#if (eq this.state this.viewState.ALLOW_UPLOAD)}}
+        <Hds::Button @text={{d.buttonText}} @color={{d.buttonColor}} @route="vault.cluster.recovery.snapshots.load" />
+      {{else}}
+        <Hds::Button
+          @text={{d.buttonText}}
+          @color={{d.buttonColor}}
+          @icon={{d.buttonIcon}}
+          @iconPosition="trailing"
+          @route={{d.buttonRoute}}
+          @query={{if d.buttonRoute (hash namespace="")}}
+          @href={{doc-link d.buttonHref}}
+          @isHrefExternal={{if d.buttonHref true}}
+        />
+      {{/if}}
+    </EmptyState>
+  {{/let}}
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/recovery/page/snapshots.ts b/ui/app/components/recovery/page/snapshots.ts
new file mode 100644
index 00000000000..ebe45f80567
--- /dev/null
+++ b/ui/app/components/recovery/page/snapshots.ts
@@ -0,0 +1,68 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+
+import type NamespaceService from 'vault/services/namespace';
+
+enum State {
+  NON_ROOT_NAMESPACE = 'non-root-namespace',
+  ALLOW_UPLOAD = 'default',
+  CANNOT_UPLOAD = 'cannot-upload',
+}
+
+interface Args {
+  model: { canLoadSnapshot: boolean; snapshots: Record<string, unknown>[] };
+}
+
+export default class Snapshots extends Component<Args> {
+  @service declare readonly namespace: NamespaceService;
+
+  viewState = State;
+
+  emptyStateDetails = {
+    [this.viewState.NON_ROOT_NAMESPACE]: {
+      title: 'Snapshot upload is restricted',
+      icon: 'sync-reverse',
+      message:
+        'Snapshot uploading is only available in root namespace. Please navigate to root and upload your snapshot.',
+      buttonText: 'Take me to root namespace',
+      buttonRoute: 'vault.cluster.dashboard',
+      buttonIcon: 'arrow-right',
+      buttonColor: 'tertiary',
+    },
+    [this.viewState.CANNOT_UPLOAD]: {
+      title: 'No snapshot available',
+      icon: 'skip',
+      message:
+        'Ready to restore secrets? Please contact your admin to either upload a snapshot or grant you uploading permissions to get started.',
+      buttonText: 'Learn more about Secrets Recovery',
+      buttonHref: '/vault/docs/sysadmin/snapshots/restore',
+      buttonIcon: 'docs-link',
+      buttonColor: 'tertiary',
+    },
+    [this.viewState.ALLOW_UPLOAD]: {
+      title: 'Upload a snapshot to get started',
+      icon: 'sync-reverse',
+      message:
+        'Secrets Recovery allows you to restore accidentally deleted or lost secrets from a snapshot. The snapshots can be provided via upload or loaded from external storage.',
+      buttonText: 'Upload snapshot',
+      buttonColor: 'primary',
+    },
+  };
+
+  get state() {
+    const { canLoadSnapshot } = this.args.model;
+
+    if (!this.namespace.inRootNamespace) {
+      return this.viewState.NON_ROOT_NAMESPACE;
+    } else if (!canLoadSnapshot) {
+      return this.viewState.CANNOT_UPLOAD;
+    } else {
+      return this.viewState.ALLOW_UPLOAD;
+    }
+  }
+}
diff --git a/ui/app/components/recovery/page/snapshots/load.hbs b/ui/app/components/recovery/page/snapshots/load.hbs
new file mode 100644
index 00000000000..c601d10710c
--- /dev/null
+++ b/ui/app/components/recovery/page/snapshots/load.hbs
@@ -0,0 +1,150 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Recovery::Page::Header @title="Upload Snapshot" @breadcrumbs={{@breadcrumbs}} />
+
+{{#if this.bannerError}}
+  <div class="has-top-padding-m has-bottom-padding-m">
+    <Hds::Alert @type="inline" @color="critical" data-test-inline-alert as |A|>
+      <A.Title>Error</A.Title>
+      <A.Description>{{this.bannerError}}</A.Description>
+    </Hds::Alert>
+  </div>
+{{/if}}
+
+<form {{on "submit" this.loadSnapshot}} class="has-top-margin-xl">
+  <Hds::Form::Radio::Group @name="snapshot-load-method" as |G|>
+    <G.Legend>Choose how to provide the snapshot</G.Legend>
+    <G.RadioField
+      name={{this.loadMethods.AUTOMATED}}
+      checked={{eq this.selectedLoadMethod this.loadMethods.AUTOMATED}}
+      disabled={{eq @model.configError.status 404}}
+      @value={{this.loadMethods.AUTOMATED}}
+      {{on "change" this.selectLoadMethod}}
+      data-test-input="automatic"
+      as |F|
+    >
+      <F.Label>
+        Load from automated snapshots
+        {{#if (eq @model.configError.status 404)}}
+          <Hds::Badge
+            class="has-left-margin-xs"
+            @text="No snapshots available"
+            @size="small"
+            @icon="alert-triangle"
+            @color="warning"
+          />
+        {{/if}}
+      </F.Label>
+      <F.HelperText>
+        Provide the snapshot URL from a configured cloud storage
+      </F.HelperText>
+    </G.RadioField>
+    <G.RadioField
+      name={{this.loadMethods.MANUAL}}
+      checked={{eq this.selectedLoadMethod this.loadMethods.MANUAL}}
+      @value={{this.loadMethods.MANUAL}}
+      {{on "change" this.selectLoadMethod}}
+      data-test-input="manual"
+      as |F|
+    >
+      <F.Label>Manually upload snapshots</F.Label>
+      <F.HelperText>
+        Upload a new snapshot to the disk
+      </F.HelperText>
+    </G.RadioField>
+
+  </Hds::Form::Radio::Group>
+
+  <div class="has-top-margin-l has-left-padding-l">
+
+    {{#if (eq this.selectedLoadMethod this.loadMethods.AUTOMATED)}}
+      <div class="has-bottom-padding-m">
+        {{! Allow manual entry for automated configs if there are no results due to 403}}
+        {{#if this.automatedConfigs}}
+          <Hds::Form::SuperSelect::Single::Field
+            @onChange={{fn (mut this.selectedConfig)}}
+            @selected={{this.selectedConfig}}
+            @options={{this.automatedConfigs}}
+            @isInvalid={{this.configError}}
+            data-test-select="config"
+            as |F|
+          >
+            <F.Label>Snapshot configuration name</F.Label>
+            <F.HelperText>
+              Name of the configuration that created the snapshot. Existing automated snapshots should be configured via the
+              <Hds::Link::Inline
+                @href={{doc-link
+                  "/vault/api-docs/system/storage/raftautosnapshots#create-update-an-automated-snapshots-config"
+                }}
+                @isHrefExternal={{true}}
+              >automated snapshots config</Hds::Link::Inline>
+              endpoint.
+            </F.HelperText>
+            <F.Options>{{F.options}}</F.Options>
+            {{#if this.configError}}
+              <F.Error data-test-validation-error="config">{{this.configError}}</F.Error>
+            {{/if}}
+          </Hds::Form::SuperSelect::Single::Field>
+        {{else}}
+          <Hds::Form::TextInput::Field
+            @isInvalid={{this.configError}}
+            @value={{this.selectedConfig}}
+            {{on "input" (pipe (pick "target.value") (fn (mut this.selectedConfig)))}}
+            data-test-input="manual-config"
+            as |F|
+          >
+            <F.Label>Snapshot configuration name</F.Label>
+            <F.HelperText>
+              Name of the configuration that created the snapshot. Existing automated snapshots should be configured via the
+              <Hds::Link::Inline
+                @href={{doc-link
+                  "/vault/api-docs/system/storage/raftautosnapshots#create-update-an-automated-snapshots-config"
+                }}
+                @isHrefExternal={{true}}
+              >automated snapshots config</Hds::Link::Inline>
+              endpoint.
+            </F.HelperText>
+            {{#if this.configError}}
+              <F.Error data-test-validation-error="config">{{this.configError}}</F.Error>
+            {{/if}}
+          </Hds::Form::TextInput::Field>
+        {{/if}}
+      </div>
+      <div class="has-bottom-padding-m">
+        <Hds::Form::TextInput::Field
+          @isInvalid={{this.urlError}}
+          @value={{this.url}}
+          name="url"
+          {{on "input" this.updateUrl}}
+          data-test-input="url"
+          as |F|
+        >
+          <F.Label>URL</F.Label>
+          <F.HelperText>
+            The URL to the cloud storage bucket
+          </F.HelperText>
+          {{#if this.urlError}}
+            <F.Error data-test-validation-error="url">{{this.urlError}}</F.Error>
+          {{/if}}
+        </Hds::Form::TextInput::Field>
+      </div>
+    {{else}}
+      <FileToArrayBuffer
+        class="has-left-padding-l"
+        @error={{this.fileError}}
+        @label="Please choose a snapshot file"
+        @onChange={{fn (mut this.file)}}
+      />
+    {{/if}}
+  </div>
+
+  <hr class="has-background-gray-300" />
+
+  <Hds::ButtonSet class="has-top-padding-m">
+    <Hds::Button @text="Load snapshot" type="submit" data-test-submit />
+    <Hds::Button @text="Cancel" @color="secondary" @route="vault.cluster.recovery.snapshots" data-test-cancel />
+  </Hds::ButtonSet>
+</form>
\ No newline at end of file
diff --git a/ui/app/components/recovery/page/snapshots/load.ts b/ui/app/components/recovery/page/snapshots/load.ts
new file mode 100644
index 00000000000..9c7a7922e59
--- /dev/null
+++ b/ui/app/components/recovery/page/snapshots/load.ts
@@ -0,0 +1,143 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import { HTMLElementEvent } from 'vault/forms';
+import { SnapshotsLoadModel } from 'vault/routes/vault/cluster/recovery/snapshots/load';
+
+import type ApiService from 'vault/services/api';
+import type RouterService from '@ember/routing/router-service';
+
+interface Args {
+  model: SnapshotsLoadModel;
+}
+
+enum Methods {
+  AUTOMATED = 'automated',
+  MANUAL = 'manual',
+}
+
+export default class SnapshotsLoad extends Component<Args> {
+  @service declare readonly api: ApiService;
+  @service declare readonly router: RouterService;
+
+  @tracked selectedLoadMethod: Methods;
+  @tracked selectedConfig = '';
+  @tracked url = '';
+  @tracked file?: ArrayBuffer;
+
+  @tracked urlError = '';
+  @tracked configError = '';
+  @tracked fileError = '';
+  @tracked bannerError = '';
+
+  loadMethods = Methods;
+  automatedConfigs: string[];
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+    const { configError } = this.args.model;
+
+    if (configError && !this.isExpectedError) {
+      this.bannerError = configError.message;
+    }
+    // We want to default to automated unless it is disabled (which is the case during 404)
+    this.selectedLoadMethod = configError?.status === 404 ? Methods.MANUAL : Methods.AUTOMATED;
+    this.automatedConfigs = this.args.model.configs;
+  }
+
+  // For 403, we'll allow manual entry
+  // For 404, we'll show a badge + disable the input
+  get isExpectedError() {
+    const status = this.args.model.configError?.status;
+    return status === 403 || status === 404;
+  }
+
+  validateFields(): boolean {
+    let hasErrors = false;
+    this.fileError = '';
+    this.urlError = '';
+    this.configError = '';
+
+    switch (this.selectedLoadMethod) {
+      case Methods.MANUAL: {
+        if (!this.file) {
+          this.fileError = 'Please upload a snapshot file';
+          hasErrors = true;
+        }
+        break;
+      }
+      case Methods.AUTOMATED: {
+        if (!this.url) {
+          this.urlError = 'Please enter a url';
+          hasErrors = true;
+        }
+
+        if (!this.selectedConfig) {
+          this.configError = 'Please select a config';
+          hasErrors = true;
+        }
+        break;
+      }
+    }
+
+    return !hasErrors;
+  }
+
+  @action
+  selectLoadMethod(event: HTMLElementEvent<HTMLInputElement>) {
+    this.selectedLoadMethod = event.target.value as Methods;
+
+    const { configError } = this.args.model;
+
+    if (this.selectedLoadMethod === Methods.AUTOMATED && configError && !this.isExpectedError) {
+      this.bannerError = configError.message;
+    } else {
+      this.bannerError = '';
+    }
+  }
+
+  @action
+  updateUrl(event: HTMLElementEvent<HTMLInputElement>) {
+    this.url = event.target.value.trim();
+  }
+
+  @action
+  async loadSnapshot(event: Event) {
+    event.preventDefault();
+
+    const isValid = this.validateFields();
+
+    if (!isValid) return;
+    try {
+      switch (this.selectedLoadMethod) {
+        case Methods.AUTOMATED: {
+          await this.api.sys.systemWriteStorageRaftSnapshotAutoSnapshotLoadName(this.selectedConfig, {
+            url: this.url,
+          });
+
+          break;
+        }
+        case Methods.MANUAL: {
+          await this.api.sys.systemWriteStorageRaftSnapshotLoad({ body: this.file });
+          break;
+        }
+        default: {
+          // This should never be reached, but just in case
+          throw new Error('Unsupported load method');
+        }
+      }
+
+      this.router.transitionTo('vault.cluster.recovery.snapshots');
+    } catch (e) {
+      const error = await this.api.parseError(e);
+
+      this.bannerError = `Snapshot load error: ${error.message}`;
+    }
+  }
+}
diff --git a/ui/app/components/recovery/page/snapshots/snapshot-details.hbs b/ui/app/components/recovery/page/snapshots/snapshot-details.hbs
new file mode 100644
index 00000000000..4358b5cb7fa
--- /dev/null
+++ b/ui/app/components/recovery/page/snapshots/snapshot-details.hbs
@@ -0,0 +1,58 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Recovery::Page::Header
+  @title="Secrets Recovery"
+  @subtitle="Recover lost or deleted data from a raft snapshot. Supported data includes KV v1 and Cubbyhole secrets or Database static roles."
+  @action={{(hash
+    text="Recover secrets"
+    icon="reload"
+    iconPosition="leading"
+    color="primary"
+    route="vault.cluster.recovery.snapshots.snapshot.manage"
+    models=(array @model.snapshot.snapshot_id)
+  )}}
+/>
+
+<Hds::Table data-test-table="details">
+  <:head as |H|>
+    <H.Tr>
+      {{#each this.tableColumns as |col|}}
+        <H.Th>{{col.label}}</H.Th>
+      {{/each}}
+      <H.Th>Status</H.Th>
+      <H.Th>Actions</H.Th>
+    </H.Tr>
+  </:head>
+  <:body as |B|>
+    <B.Tr>
+      {{#each this.tableColumns as |item|}}
+        <B.Td>{{item.value}}</B.Td>
+      {{/each}}
+      <B.Td>
+        <Hds::Badge @text={{this.badge.status}} @color={{this.badge.color}} data-test-badge="status" />
+      </B.Td>
+      <B.Td @align="right">
+        <Hds::Dropdown @isInline={{true}} as |dd|>
+          <dd.ToggleIcon
+            @icon="more-horizontal"
+            @text="Overflow Options"
+            @hasChevron={{false}}
+            @size="small"
+            data-test-button="toggle"
+          />
+          <dd.Interactive
+            @icon="key"
+            @route="vault.cluster.recovery.snapshots.snapshot.manage"
+            @models={{array @model.snapshot.snapshot_id}}
+          >Manage secrets</dd.Interactive>
+          {{#if this.namespace.inRootNamespace}}
+            <dd.Interactive @color="critical" @icon="trash" {{on "click" this.unloadSnapshot}}>Unload snapshot</dd.Interactive>
+          {{/if}}
+        </Hds::Dropdown>
+      </B.Td>
+    </B.Tr>
+  </:body>
+</Hds::Table>
\ No newline at end of file
diff --git a/ui/app/components/recovery/page/snapshots/snapshot-details.ts b/ui/app/components/recovery/page/snapshots/snapshot-details.ts
new file mode 100644
index 00000000000..b2c8d15cfa2
--- /dev/null
+++ b/ui/app/components/recovery/page/snapshots/snapshot-details.ts
@@ -0,0 +1,124 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import {
+  createPollingTask,
+  getSnapshotStatusBadge,
+} from 'vault/components/recovery/page/snapshots/snapshot-utils';
+import { dateFormat } from 'core/helpers/date-format';
+import { tracked } from '@glimmer/tracking';
+
+import type ApiService from 'vault/services/api';
+import type NamespaceService from 'vault/services/namespace';
+import type RouterService from '@ember/routing/router-service';
+import type { SnapshotManageModel } from 'vault/routes/vault/cluster/recovery/snapshots/snapshot/manage';
+import type FlashMessageService from 'vault/services/flash-messages';
+
+interface Args {
+  model: SnapshotManageModel;
+}
+
+export default class SnapshotDetails extends Component<Args> {
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly namespace: NamespaceService;
+  @service declare readonly router: RouterService;
+
+  @tracked snapshotStatus?: string = '';
+
+  private pollingController: { start: () => Promise<void>; cancel: () => void } | null = null;
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+
+    // Create and start polling task
+    this.pollingController = createPollingTask(
+      this.args.model.snapshot.snapshot_id,
+      this.api,
+      this.onPollSuccess,
+      this.onPollError
+    );
+    this.pollingController.start();
+  }
+
+  willDestroy() {
+    super.willDestroy();
+    if (this.pollingController) {
+      this.pollingController.cancel();
+    }
+  }
+
+  get badge() {
+    // Use polled status if available, otherwise fall back to initial model status
+    const status = this.snapshotStatus || this.args.model.snapshot?.status;
+
+    return getSnapshotStatusBadge(status);
+  }
+
+  get tableColumns() {
+    const snapshot = this.args.model.snapshot;
+
+    const columns = [
+      {
+        label: 'Snapshot ID',
+        key: 'snapshot_id',
+        value: snapshot.snapshot_id,
+      },
+      {
+        label: 'Expiring at',
+        key: 'expires_at',
+        value: dateFormat([snapshot.expires_at, 'MMM d, yyyy hh:mm aaa'], {
+          withTimeZone: true,
+        }),
+      },
+    ];
+
+    if (this.args.model.snapshot.auto_snapshot_config) {
+      const automatedSnapshotCols = [
+        {
+          label: 'Auto config name',
+          key: 'auto_config_name',
+          value: snapshot.auto_snapshot_config,
+        },
+        {
+          label: 'URL',
+          key: 'url',
+          value: snapshot.url,
+        },
+      ];
+      columns.splice(1, 0, ...automatedSnapshotCols);
+    }
+
+    return columns;
+  }
+
+  onPollError = async () => {
+    this.snapshotStatus = 'error';
+    // Update the model directly for reactive updates across routes
+    this.args.model.snapshot.status = 'error';
+  };
+
+  onPollSuccess = async (status: string) => {
+    this.snapshotStatus = status;
+    // Update the model directly for reactive updates across routes
+    this.args.model.snapshot.status = status as 'ready' | 'error' | 'loading';
+  };
+
+  @action
+  async unloadSnapshot() {
+    try {
+      const { snapshot_id } = this.args.model.snapshot as { snapshot_id: string };
+      await this.api.sys.systemDeleteStorageRaftSnapshotLoadId(snapshot_id);
+
+      this.router.transitionTo('vault.cluster.recovery.snapshots');
+    } catch (e) {
+      const { message } = await this.api.parseError(e);
+      this.flashMessages.danger(`Snapshot was not unloaded: ${message}`);
+    }
+  }
+}
diff --git a/ui/app/components/recovery/page/snapshots/snapshot-manage.hbs b/ui/app/components/recovery/page/snapshots/snapshot-manage.hbs
new file mode 100644
index 00000000000..64541f7b841
--- /dev/null
+++ b/ui/app/components/recovery/page/snapshots/snapshot-manage.hbs
@@ -0,0 +1,265 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Recovery::Page::Header
+  @title="Secrets Recovery"
+  @subtitle="Recover lost or deleted data from a raft snapshot. Supported data includes KV v1 and Cubbyhole secrets or Database static roles."
+/>
+
+{{#let @model.snapshot as |snapshot|}}
+  <Hds::Card::Container
+    @level="mid"
+    @hasBorder={{true}}
+    class="has-padding-m has-top-margin-s has-bottom-margin-m one-half-width"
+  >
+    <div class="flex space-between">
+      <Hds::Text::Display @tag="h2">Snapshot</Hds::Text::Display>
+      <Hds::Badge @text={{this.badge.status}} @color={{this.badge.color}} data-test-badge="status" />
+    </div>
+    <Hds::Text::Body @tag="p" data-test-expiration>Expiring at
+      {{date-format snapshot.expires_at "MMM d, yyyy, h:mm:ss aaa" withTimeZone=true}}</Hds::Text::Body>
+    <Hds::Link::Standalone
+      @iconPosition="trailing"
+      @icon="arrow-right"
+      @text="View details"
+      @route="vault.cluster.recovery.snapshots.snapshot.details"
+      @model={{snapshot.snapshot_id}}
+      data-test-details-link
+    />
+  </Hds::Card::Container>
+{{/let}}
+
+<hr class="has-background-gray-300" />
+
+<Hds::Text::Display @tag="h3" class="has-top-padding-m has-bottom-margin-l">Recover or read data</Hds::Text::Display>
+{{#if this.recoveryData}}
+  <Hds::Alert @type="inline" @color="success" class="has-top-margin-m has-bottom-margin-m" data-test-inline-alert as |A|>
+    <A.Title>Success</A.Title>
+    {{#let
+      this.recoveryData.query.namespace (get this.recoveryData.models 0) (get this.recoveryData.models 1)
+      as |ns mount resource|
+    }}
+      <A.Description>Secret at
+        <Hds::Link::Inline
+          @route="vault.cluster.secrets.backend.show"
+          @models={{this.recoveryData.models}}
+          @query={{this.recoveryData.query}}
+          data-test-link-to="details"
+        >
+          {{mount}}/{{resource}}</Hds::Link::Inline>
+        has been successfully recovered{{#if ns}} in namespace <strong>{{ns}}</strong>{{/if}}.
+      </A.Description>
+    {{/let}}
+  </Hds::Alert>
+{{/if}}
+
+{{#if this.bannerError}}
+  <div class="has-top-padding-m has-bottom-padding-m">
+    <Hds::Alert @type="inline" @color="critical" data-test-inline-alert as |A|>
+      <A.Title>Error</A.Title>
+      <A.Description>{{this.bannerError}}</A.Description>
+    </Hds::Alert>
+  </div>
+{{/if}}
+
+<Hds::Layout::Flex @gap="24" @align="start" class="has-bottom-padding-m">
+  {{! Selecting a namespace is only available in root, otherwise the namespace context 
+  is assumed as the current namespace for requesting the list of mount options }}
+  {{#if this.namespace.inRootNamespace}}
+    <Hds::Form::SuperSelect::Single::Field
+      @onChange={{this.handleSelectNamespace}}
+      @selected={{this.selectedNamespace}}
+      @options={{this.namespaceOptions}}
+      @searchEnabled={{true}}
+      data-test-select="namespace"
+      as |F|
+    >
+      <F.Label>Namespace</F.Label>
+      <F.Options>
+        {{#let F.options as |option|}}
+          <div data-test-option={{option}}>
+            {{F.options}}
+          </div>
+        {{/let}}
+      </F.Options>
+    </Hds::Form::SuperSelect::Single::Field>
+  {{/if}}
+
+  {{! Allow for manual entry of mount paths if no mounts are returned (such as when the user does not have LIST permissions) }}
+  {{#if (or this.mountOptions this.fetchMounts.isRunning)}}
+    <Hds::Form::SuperSelect::Single::Field
+      @onChange={{this.handleSelectMount}}
+      @selected={{this.selectedMount}}
+      @options={{this.mountOptions}}
+      @searchEnabled={{true}}
+      @searchField="path"
+      @isInvalid={{this.mountError}}
+      @selectedItemComponent={{component "recovery/snapshot-mount-selected-item"}}
+      @placeholder="Select a mount here"
+      data-test-select="mount"
+      as |F|
+    >
+      <F.Label>Secret mount</F.Label>
+      <F.Options>
+        {{#let F.options as |option|}}
+          <div data-test-option={{option.path}}>
+            <strong>{{option.path}}</strong>
+          </div>
+          {{option.type}}
+        {{/let}}
+      </F.Options>
+      {{#if this.mountError}}
+        <F.Error data-test-validation-error="mount">{{this.mountError}}</F.Error>
+      {{/if}}
+    </Hds::Form::SuperSelect::Single::Field>
+  {{else}}
+    <Hds::Form::Field @layout="vertical" as |F|>
+      <F.Label>Mount Path</F.Label>
+      <F.Control>
+        <Hds::SegmentedGroup as |SG|>
+          <SG.Dropdown @listPosition="bottom-left" as |D|>
+            <D.ToggleButton
+              @color="secondary"
+              @text={{or (get this.recoverySupportedEngines this.selectedMount.type) "Type"}}
+              class="white-space-nowrap"
+              data-test-button="Type"
+            />
+            {{#each-in this.recoverySupportedEngines as |type displayName|}}
+              <D.Radio
+                name={{type}}
+                checked={{eq this.selectedMount.type type}}
+                {{on "change" (fn this.handleSelectRadio D.close)}}
+                data-test-radio={{type}}
+              >
+                {{displayName}}
+              </D.Radio>
+            {{/each-in}}
+          </SG.Dropdown>
+          <SG.TextInput
+            @isInvalid={{this.mountError}}
+            @value={{this.selectedMount.path}}
+            id={{F.id}}
+            aria-describedby={{F.ariaDescribedBy}}
+            size="32"
+            placeholder={{if this.selectedMount "Enter mount path..." "Select a type to enter a path"}}
+            disabled={{not this.selectedMount.type}}
+            readonly={{eq this.selectedMount.type "cubbyhole"}}
+            {{on "input" this.handlePathInput}}
+            data-test-input="manual-mount-path"
+          />
+        </Hds::SegmentedGroup>
+      </F.Control>
+      {{#if this.mountError}}
+        <F.Error data-test-validation-error="mount">{{this.mountError}}</F.Error>
+      {{/if}}
+    </Hds::Form::Field>
+  {{/if}}
+
+  <Hds::Form::TextInput::Field
+    @value={{this.resourcePath}}
+    @isInvalid={{this.resourcePathError}}
+    placeholder="Enter the resource path..."
+    {{on "input" this.updateResourcePath}}
+    data-test-input="resourcePath"
+    as |F|
+  >
+    <F.Label>Resource Path</F.Label>
+    {{#if this.resourcePathError}}
+      <F.Error data-test-validation-error="resourcePath">{{this.resourcePathError}}</F.Error>
+    {{/if}}
+  </Hds::Form::TextInput::Field>
+
+  <div class={{if this.resourcePathError "align-self-center" "align-self-end"}}>
+    <Hds::Button
+      @text="Clear"
+      @icon="trash"
+      @color="secondary"
+      {{on "click" this.clearSelections}}
+      data-test-button="clear"
+    />
+  </div>
+</Hds::Layout::Flex>
+
+<Hds::Layout::Flex @align="start" class="has-bottom-padding-m">
+  <Hds::Form::Radio::Group @name="recover-method" as |G|>
+    <G.Legend>Recover options</G.Legend>
+    {{#each this.recoverMethods as |method|}}
+      <G.RadioField
+        @value={{method.value}}
+        {{on "change" this.handleSelectRecoverMethod}}
+        checked={{eq this.recoverMethod method.value}}
+        data-test-input={{method.value}}
+        as |F|
+      >
+        <F.Label>{{method.label}}</F.Label>
+      </G.RadioField>
+    {{/each}}
+  </Hds::Form::Radio::Group>
+</Hds::Layout::Flex>
+
+{{#if (eq this.recoverMethod "copy")}}
+  <Hds::Layout::Flex @align="start" class="has-bottom-padding-m">
+    <Hds::Form::TextInput::Field
+      @value={{this.copyPath}}
+      @isInvalid={{this.copyPathError}}
+      placeholder="Enter new path"
+      {{on "input" this.updateCopyPath}}
+      data-test-input="copyPath"
+      as |F|
+    >
+      <F.Label>Copy Path</F.Label>
+      <F.HelperText>Recover to the new path below. The original resource path will not be affected.</F.HelperText>
+      {{#if this.copyPathError}}
+        <F.Error data-test-validation-error="copyPath">{{this.copyPathError}}</F.Error>
+      {{/if}}
+    </Hds::Form::TextInput::Field>
+
+  </Hds::Layout::Flex>
+{{/if}}
+
+<hr class="has-background-gray-300" />
+
+<Hds::ButtonSet class="has-top-padding-m">
+  <Hds::Button
+    @text="Recover"
+    type="submit"
+    disabled={{not (eq this.badge.status "Ready")}}
+    data-test-button="recover"
+    {{on "click" this.recover}}
+  />
+  <Hds::Button
+    @text="Read"
+    @color="secondary"
+    disabled={{not (eq this.badge.status "Ready")}}
+    data-test-button="read"
+    {{on "click" this.readResource}}
+  />
+</Hds::ButtonSet>
+
+{{#if this.showReadModal}}
+  <Hds::Modal @onClose={{this.closeReadModal}} data-test-read-secrets as |M|>
+    <M.Header>
+      Read secrets
+    </M.Header>
+    <M.Body>
+      <div class="has-bottom-padding-m">
+        <Hds::Form::Toggle::Field
+          checked={{this.showJson}}
+          {{on "change" this.toggleJson}}
+          data-test-toggle-input="snapshot-read-secrets"
+          as |F|
+        >
+          <F.Label>JSON</F.Label>
+          <F.HelperText>Please use the toggle to see your secret value in JSON.</F.HelperText>
+        </Hds::Form::Toggle::Field>
+      </div>
+
+      <SecretFormShow @showAdvancedMode={{this.showJson}} @modelForData={{this.modelForData}} />
+    </M.Body>
+    <M.Footer as |F|>
+      <Hds::Button type="button" @text="Close" {{on "click" F.close}} data-test-button="close" />
+    </M.Footer>
+  </Hds::Modal>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/recovery/page/snapshots/snapshot-manage.ts b/ui/app/components/recovery/page/snapshots/snapshot-manage.ts
new file mode 100644
index 00000000000..656054826d8
--- /dev/null
+++ b/ui/app/components/recovery/page/snapshots/snapshot-manage.ts
@@ -0,0 +1,442 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { restartableTask } from 'ember-concurrency';
+import { sanitizePath } from 'core/utils/sanitize-path';
+import SecretsEngineResource, { RecoverySupportedEngines } from 'vault/resources/secrets/engine';
+import { SupportedSecretBackendsEnum } from 'vault/helpers/supported-secret-backends';
+import { ROOT_NAMESPACE } from 'vault/services/namespace';
+import {
+  createPollingTask,
+  getSnapshotStatusBadge,
+} from 'vault/components/recovery/page/snapshots/snapshot-utils';
+
+import type ApiService from 'vault/services/api';
+import type NamespaceService from 'vault/services/namespace';
+import type { SnapshotManageModel } from 'vault/routes/vault/cluster/recovery/snapshots/snapshot/manage';
+
+interface Args {
+  model: SnapshotManageModel;
+}
+
+type SecretData = { [key: string]: unknown };
+
+type RecoveryData = {
+  models: string[];
+  query?: { [key: string]: string };
+};
+
+type MountOption = { type: RecoverySupportedEngines; path: string };
+type GroupedOption = { groupName: string; options: MountOption[] };
+
+export default class SnapshotManage extends Component<Args> {
+  @service declare readonly api: ApiService;
+  @service declare readonly currentCluster: any;
+  @service declare readonly namespace: NamespaceService;
+
+  @tracked selectedNamespace: string;
+  @tracked selectedMount?: MountOption;
+  @tracked resourcePath = '';
+  @tracked copyPath = '';
+
+  @tracked mountOptions: GroupedOption[] = [];
+  @tracked secretData: SecretData | undefined;
+
+  @tracked mountError = '';
+  @tracked resourcePathError = '';
+  @tracked copyPathError = '';
+  @tracked bannerError = '';
+
+  @tracked showReadModal = false;
+  @tracked showJson = false;
+  @tracked recoveryData?: RecoveryData;
+  @tracked recoverMethod = 'original';
+
+  @tracked snapshotStatus: string | null = null;
+
+  private pollingController: { start: () => Promise<void>; cancel: () => void } | null = null;
+
+  recoverySupportedEngines = {
+    [SupportedSecretBackendsEnum.DATABASE]: 'Database',
+    [SupportedSecretBackendsEnum.CUBBYHOLE]: 'Cubbyhole',
+    [SupportedSecretBackendsEnum.KV]: 'KV v1',
+  };
+
+  recoverMethods = [
+    { label: 'Recover to original path (recover in place)', value: 'original' },
+    { label: 'Recover to a new path (copy)', value: 'copy' },
+  ];
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+    this.selectedNamespace = this.namespace.inRootNamespace ? 'root' : this.namespace.path;
+    this.fetchMounts.perform();
+
+    // Create and start polling task
+    this.pollingController = createPollingTask(
+      this.args.model.snapshot.snapshot_id,
+      this.api,
+      this.onPollSuccess,
+      this.onPollError
+    );
+    this.pollingController.start();
+  }
+
+  willDestroy() {
+    super.willDestroy();
+    if (this.pollingController) {
+      this.pollingController.cancel();
+    }
+  }
+
+  get hasValidationErrors() {
+    return !!(this.mountError || this.resourcePathError);
+  }
+
+  // Form secret data to display in accordance with <SecretFormShow/> expectations
+  get modelForData() {
+    return {
+      secretData: this.secretData,
+      secretKeyAndValue: this.secretKeyAndValue,
+    };
+  }
+
+  get namespaceOptions() {
+    const { namespaces } = this.args.model;
+    // Remove slashes as query param does not expect them
+    const sanitized = namespaces.map((ns) => sanitizePath(ns));
+    // Add the root namespace because `sys/internal/ui/namespaces` does not include it.
+    return ['root', ...sanitized];
+  }
+
+  get recoverToCopy() {
+    return this.recoverMethod === 'copy';
+  }
+
+  get secretKeyAndValue() {
+    if (!this.secretData || typeof this.secretData !== 'object') {
+      return [];
+    }
+
+    return Object.entries(this.secretData).map(([key, value]) => ({
+      key,
+      value: typeof value === 'string' ? value : JSON.stringify(value),
+    }));
+  }
+
+  get badge() {
+    // Use polled status if available, otherwise fall back to initial model status
+    const status = this.snapshotStatus || this.args.model.snapshot?.status;
+    return getSnapshotStatusBadge(status);
+  }
+
+  onPollError = async (e: unknown) => {
+    const error = await this.api.parseError(e);
+    this.bannerError = `Snapshot load error: ${error.message}`;
+    this.snapshotStatus = 'error';
+    // Update the model directly for reactive updates across routes
+    this.args.model.snapshot.status = 'error';
+  };
+
+  onPollSuccess = async (status: string) => {
+    this.snapshotStatus = status;
+    // Update the model directly for reactive updates across routes
+    this.args.model.snapshot.status = status as 'ready' | 'error' | 'loading';
+  };
+
+  fetchMounts = restartableTask(async () => {
+    try {
+      const namespace = this.selectedNamespace === 'root' ? ROOT_NAMESPACE : this.selectedNamespace;
+      const headers = this.api.buildHeaders({ namespace });
+      const { secret } = await this.api.sys.internalUiListEnabledVisibleMounts(headers);
+
+      const supportedMounts = this.api.responseObjectToArray(secret, 'path').flatMap((engine) => {
+        const eng = new SecretsEngineResource(engine);
+
+        // performance secondaries cannot perform snapshot operations on shared paths
+        // operations can still be performed on local mounts
+        if (this.currentCluster?.performance?.isSecondary && !eng.local) return [];
+
+        // Use `engineType` as it is the normalized version of `type`
+        return eng.supportsRecovery
+          ? [{ path: sanitizePath(eng.path), type: eng.engineType } as MountOption]
+          : [];
+      });
+
+      const databases: MountOption[] = supportedMounts.filter(
+        (m) => m.type === SupportedSecretBackendsEnum.DATABASE
+      );
+      const secretEngines: MountOption[] = supportedMounts.filter(
+        (m) => m.type !== SupportedSecretBackendsEnum.DATABASE
+      );
+
+      // Cubbyhole is enabled by default and cannot be disabled so supportedMounts should always
+      // have values if the request was successful, but handling just in case.
+      this.mountOptions = supportedMounts.length
+        ? [
+            ...(databases.length ? [{ groupName: 'Databases', options: databases }] : []),
+            { groupName: 'Secret Engines', options: secretEngines },
+          ]
+        : [];
+    } catch {
+      this.mountOptions = [];
+    }
+  });
+
+  @action
+  clearSelections() {
+    this.selectedNamespace = this.namespace.inRootNamespace ? 'root' : this.namespace.path;
+    this.selectedMount = undefined;
+    this.resourcePath = '';
+    this.copyPath = '';
+    this.mountError = '';
+    this.resourcePathError = '';
+    this.secretData = undefined;
+
+    // Refetch mounts after clearing
+    if (this.namespace.inRootNamespace) {
+      this.fetchMounts.perform();
+    }
+  }
+
+  @action
+  handlePathInput({ target }: { target: HTMLInputElement }) {
+    if (this.selectedMount) {
+      const { type } = this.selectedMount;
+      this.selectedMount = { type, path: target.value };
+    }
+  }
+
+  @action
+  handleSelectNamespace(selection: string) {
+    this.selectedMount = undefined;
+    this.selectedNamespace = selection as string;
+    this.fetchMounts.perform();
+  }
+
+  @action
+  handleSelectMount(selection: MountOption) {
+    this.mountError = '';
+    this.selectedMount = selection;
+
+    // Cubbyhole path is always the same, set for manual path selection when user does not have LIST permissions
+    if (this.selectedMount.type === SupportedSecretBackendsEnum.CUBBYHOLE) {
+      this.selectedMount.path = 'cubbyhole';
+    }
+  }
+
+  @action
+  handleSelectRadio(close: CallableFunction, { target }: { target: HTMLInputElement }) {
+    const selection: MountOption = {
+      type: target.name as RecoverySupportedEngines,
+      path: '', // reset path to an empty string whenever an engine type is selected
+    };
+    this.handleSelectMount(selection);
+    close();
+  }
+
+  @action
+  handleSelectRecoverMethod({ target }: { target: HTMLInputElement }) {
+    this.recoverMethod = target.value;
+    if (this.recoverToCopy && this.resourcePath) {
+      this.copyPath = this.resourcePath + '-copy';
+    }
+  }
+
+  @action
+  updateCopyPath({ target }: { target: HTMLInputElement }) {
+    this.copyPath = target.value.trim();
+  }
+
+  @action
+  updateResourcePath({ target }: { target: HTMLInputElement }) {
+    this.resourcePath = target.value.trim();
+    this.resourcePathError = '';
+  }
+
+  @action
+  async readResource() {
+    const isValid = this.validateFields();
+    if (!isValid) {
+      return;
+    }
+    try {
+      this.bannerError = '';
+      this.recoveryData = undefined;
+
+      const { snapshot_id } = this.args.model.snapshot as { snapshot_id: string };
+      const mountType = this.selectedMount?.type;
+      const mountPath = this.selectedMount?.path as string;
+      const namespace = this.selectedNamespace === 'root' ? ROOT_NAMESPACE : this.selectedNamespace;
+      const headers = this.api.buildHeaders({ namespace });
+
+      switch (mountType) {
+        case SupportedSecretBackendsEnum.KV: {
+          const { data } = await this.api.secrets.kvV1Read(
+            this.resourcePath,
+            mountPath,
+            snapshot_id,
+            headers
+          );
+          this.secretData = data as SecretData;
+          break;
+        }
+        case SupportedSecretBackendsEnum.CUBBYHOLE: {
+          const { data } = await this.api.secrets.cubbyholeRead(this.resourcePath, snapshot_id, headers);
+          this.secretData = data as SecretData;
+          break;
+        }
+        case SupportedSecretBackendsEnum.DATABASE: {
+          const { data } = await this.api.secrets.databaseReadStaticRole(
+            this.resourcePath,
+            mountPath,
+            snapshot_id,
+            headers
+          );
+          this.secretData = data as SecretData;
+          break;
+        }
+        default: {
+          // This should never be reached, but just in case
+          throw new Error('Unsupported recovery engine');
+        }
+      }
+
+      this.showReadModal = true;
+    } catch (e) {
+      const error = await this.api.parseError(e);
+      this.bannerError = `Snapshot read error: ${error.message}`;
+    }
+  }
+
+  @action
+  async recover() {
+    const isValid = this.validateFields(true);
+    if (!isValid) {
+      return;
+    }
+    try {
+      this.bannerError = '';
+      const { snapshot_id } = this.args.model.snapshot as { snapshot_id: string };
+      const namespace = this.selectedNamespace === 'root' ? ROOT_NAMESPACE : this.selectedNamespace;
+      const mountType = this.selectedMount?.type;
+      const mountPath = this.selectedMount?.path as string;
+      // if recovering to a copy, the new path (the copy path input) becomes the target path
+      // and the original path (the resource path input) becomes the source path header
+      const targetPath = this.recoverToCopy ? this.copyPath : this.resourcePath;
+      const recoverSourcePath =
+        mountType === SupportedSecretBackendsEnum.DATABASE
+          ? mountPath + '/static-roles/' + this.resourcePath
+          : mountPath + '/' + this.resourcePath;
+
+      const headers = this.api.buildHeaders({
+        namespace,
+        recoverSnapshotId: snapshot_id,
+        ...(this.recoverToCopy && { recoverSourcePath }),
+      });
+
+      // this query is used to build the recovered resource link in the success message
+      let query: { [key: string]: string } = {};
+      if (namespace && namespace !== this.namespace.path) {
+        query = { namespace };
+      }
+
+      // Certain backends have a prefix which is needed for the recovery link we show to the user
+      let modelPrefix = '';
+
+      switch (mountType) {
+        case SupportedSecretBackendsEnum.KV: {
+          await this.recoverKvv1(targetPath, mountPath, headers);
+          break;
+        }
+        case SupportedSecretBackendsEnum.CUBBYHOLE: {
+          await this.recoverCubbyhole(targetPath, headers);
+          break;
+        }
+        case SupportedSecretBackendsEnum.DATABASE: {
+          await this.recoverDatabaseStaticRoles(targetPath, mountPath, headers);
+          modelPrefix = 'role/';
+          query = { ...query, type: 'static' };
+          break;
+        }
+        default: {
+          // This should never be reached, but just in case
+          throw new Error('Unsupported recovery engine');
+        }
+      }
+
+      this.recoveryData = {
+        models: [mountPath, modelPrefix + targetPath],
+        query,
+      };
+    } catch (e) {
+      const error = await this.api.parseError(e);
+      this.bannerError = `Snapshot recovery error: ${error.message}`;
+      this.recoveryData = undefined;
+    }
+  }
+
+  @action
+  closeReadModal() {
+    this.showReadModal = false;
+  }
+
+  @action
+  toggleJson(event: { target: { checked: boolean } }) {
+    this.showJson = event.target.checked;
+  }
+
+  @action
+  validateFields(isRecover = false): boolean {
+    this.mountError = '';
+    this.resourcePathError = '';
+    this.copyPathError = '';
+
+    let hasErrors = false;
+
+    if (!this.selectedMount) {
+      this.mountError = 'Please select a secret mount';
+      hasErrors = true;
+    }
+
+    if (!this.resourcePath) {
+      this.resourcePathError = 'Please enter a resource path';
+      hasErrors = true;
+    }
+
+    if (isRecover && this.recoverToCopy && !this.copyPath) {
+      this.copyPathError = 'Please enter a copy path';
+      hasErrors = true;
+    }
+
+    return !hasErrors;
+  }
+
+  // The requests below received "undefined" because the typescript client expects those args to be request headers.
+  // However, that is not how our middleware is setup to handle headers and we must pass them in the "headers" object instead.
+  private async recoverCubbyhole(targetPath: string, headers: object) {
+    await this.api.secrets.cubbyholeWrite(targetPath, {}, undefined, undefined, undefined, headers);
+  }
+
+  private async recoverKvv1(targetPath: string, mountPath: string, headers: object) {
+    await this.api.secrets.kvV1Write(targetPath, mountPath, {}, undefined, undefined, undefined, headers);
+  }
+
+  private async recoverDatabaseStaticRoles(targetPath: string, mountPath: string, headers: object) {
+    await this.api.secrets.databaseWriteStaticRole(
+      targetPath,
+      mountPath,
+      {},
+      undefined,
+      undefined,
+      undefined,
+      headers
+    );
+  }
+}
diff --git a/ui/app/components/recovery/page/snapshots/snapshot-utils.ts b/ui/app/components/recovery/page/snapshots/snapshot-utils.ts
new file mode 100644
index 00000000000..595528fb290
--- /dev/null
+++ b/ui/app/components/recovery/page/snapshots/snapshot-utils.ts
@@ -0,0 +1,95 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+import Ember from 'ember';
+import { timeout } from 'ember-concurrency';
+
+import { ROOT_NAMESPACE } from 'vault/services/namespace';
+
+import type ApiService from 'vault/services/api';
+
+export interface BadgeInfo {
+  status: string;
+  color: 'critical' | 'highlight' | 'success' | 'warning';
+}
+
+export function getSnapshotStatusBadge(status: string | undefined): BadgeInfo {
+  switch (status) {
+    case 'error':
+      return {
+        status: 'Error',
+        color: 'critical',
+      };
+    case 'loading':
+      return {
+        status: 'Loading',
+        color: 'highlight',
+      };
+    case 'ready':
+      return {
+        status: 'Ready',
+        color: 'success',
+      };
+    default:
+      return {
+        status: status || 'Unknown',
+        color: 'warning',
+      };
+  }
+}
+
+export function createPollingTask(
+  snapshotId: string | undefined,
+  api: ApiService,
+  onStatus: (status: string) => void,
+  onError: (e: unknown) => void
+) {
+  let cancelled = false;
+
+  const pollingFunction = async () => {
+    if (!snapshotId || cancelled) {
+      return;
+    }
+
+    let wait = Ember.testing ? 0 : 5000;
+
+    while (!cancelled) {
+      await timeout(wait);
+
+      if (cancelled) break;
+
+      try {
+        const response = await api.sys.systemReadStorageRaftSnapshotLoadId(
+          snapshotId,
+          api.buildHeaders({ namespace: ROOT_NAMESPACE })
+        );
+
+        const status = response.status ?? '';
+        onStatus(status);
+
+        // Stop polling if status reaches error state as it won't change again once erroring
+        if (status === 'error') {
+          break;
+        }
+
+        // Just poll once for tests
+        if (Ember.testing) return;
+
+        // We still want to poll occasionally in case of an error
+        wait = 30000;
+      } catch (e) {
+        onError(e);
+        break;
+      }
+    }
+  };
+
+  // Return an object with the function and a cancel method
+  return {
+    start: pollingFunction,
+    cancel: () => {
+      cancelled = true;
+    },
+  };
+}
diff --git a/ui/app/components/recovery/snapshot-mount-selected-item.hbs b/ui/app/components/recovery/snapshot-mount-selected-item.hbs
new file mode 100644
index 00000000000..15c3e45e9cc
--- /dev/null
+++ b/ui/app/components/recovery/snapshot-mount-selected-item.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{@option.path}}
\ No newline at end of file
diff --git a/ui/app/components/regex-validator.hbs b/ui/app/components/regex-validator.hbs
index 5e0e5a7455b..a367b665e73 100644
--- a/ui/app/components/regex-validator.hbs
+++ b/ui/app/components/regex-validator.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @attr}}
   <div class="field" data-test-regex-validator-pattern>
@@ -10,11 +10,9 @@
         <label for={{@attr.name}} class="is-label">
           {{@labelString}}
           {{#if @attr.options.helpText}}
-            <InfoTooltip>
-              <span data-test-help-text>
-                {{@attr.options.helpText}}
-              </span>
-            </InfoTooltip>
+            <Hds::TooltipButton @text={{@attr.options.helpText}} @placement="bottom" aria-label="More information">
+              <Hds::Icon @name="info" />
+            </Hds::TooltipButton>
           {{/if}}
         </label>
         {{#if @attr.options.subText}}
diff --git a/ui/app/components/regex-validator.js b/ui/app/components/regex-validator.js
index 008e0b13453..1631ee3816a 100644
--- a/ui/app/components/regex-validator.js
+++ b/ui/app/components/regex-validator.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/resultant-acl-banner.hbs b/ui/app/components/resultant-acl-banner.hbs
index 923bd4f4350..d44a1843d85 100644
--- a/ui/app/components/resultant-acl-banner.hbs
+++ b/ui/app/components/resultant-acl-banner.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#unless this.hideBanner}}
   <Hds::Alert
@@ -16,7 +16,7 @@
       {{this.message}}
     </A.Description>
     {{#if @isEnterprise}}
-      <A.Link::Standalone
+      <A.LinkStandalone
         @icon="arrow-right"
         @iconPosition="trailing"
         @text={{concat "Log into " this.ns " namespace"}}
diff --git a/ui/app/components/resultant-acl-banner.js b/ui/app/components/resultant-acl-banner.js
index 2862a9c82c2..65187c75487 100644
--- a/ui/app/components/resultant-acl-banner.js
+++ b/ui/app/components/resultant-acl-banner.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/role-aws-edit.hbs b/ui/app/components/role-aws-edit.hbs
similarity index 97%
rename from ui/app/templates/components/role-aws-edit.hbs
rename to ui/app/components/role-aws-edit.hbs
index 732b09fbd8e..90efc322767 100644
--- a/ui/app/templates/components/role-aws-edit.hbs
+++ b/ui/app/components/role-aws-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -76,7 +76,7 @@
     </div>
     <div class="field is-grouped-split box is-fullwidth is-bottomless">
       <Hds::ButtonSet>
-        <Hds::Button @text={{if (eq this.mode "create") "Create role" "Save"}} type="submit" data-test-role-aws-create />
+        <Hds::Button @text={{if (eq this.mode "create") "Create role" "Save"}} type="submit" data-test-submit />
         {{#if (eq this.mode "create")}}
           <Hds::Button
             @text="Cancel"
diff --git a/ui/app/components/role-aws-edit.js b/ui/app/components/role-aws-edit.js
index 5423cc88598..eab1bf040f8 100644
--- a/ui/app/components/role-aws-edit.js
+++ b/ui/app/components/role-aws-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -43,12 +43,12 @@ export default RoleEdit.extend({
       });
     },
 
-    codemirrorUpdated(attr, val, codemirror) {
-      codemirror.performLint();
-      const hasErrors = codemirror.state.lint.marked.length > 0;
-
-      if (!hasErrors) {
-        set(this.model, attr, val);
+    editorUpdated(attr, val) {
+      // wont set invalid JSON to the model
+      try {
+        set(this.model, attr, JSON.parse(val));
+      } catch {
+        // linting is handled by the component
       }
     },
   },
diff --git a/ui/app/components/role-edit.js b/ui/app/components/role-edit.js
index 514cdab619c..c8e90f54656 100644
--- a/ui/app/components/role-edit.js
+++ b/ui/app/components/role-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,11 +10,14 @@ import { task, waitForEvent } from 'ember-concurrency';
 import Component from '@ember/component';
 import { set } from '@ember/object';
 import FocusOnInsertMixin from 'vault/mixins/focus-on-insert';
-import keys from 'core/utils/key-codes';
+import keys from 'core/utils/keys';
 
 const LIST_ROOT_ROUTE = 'vault.cluster.secrets.backend.list-root';
 const SHOW_ROUTE = 'vault.cluster.secrets.backend.show';
 
+/**
+ * @type Class
+ */
 export default Component.extend(FocusOnInsertMixin, {
   router: service(),
 
@@ -46,7 +49,8 @@ export default Component.extend(FocusOnInsertMixin, {
   },
 
   onEscape(e) {
-    if (e.keyCode !== keys.ESC || this.mode !== 'show') {
+    const isEscKeyPressed = keys.ESC.includes(e.key);
+    if (isEscKeyPressed || this.mode !== 'show') {
       return;
     }
     this.transitionToRoute(LIST_ROOT_ROUTE);
@@ -98,12 +102,12 @@ export default Component.extend(FocusOnInsertMixin, {
       });
     },
 
-    codemirrorUpdated(attr, val, codemirror) {
-      codemirror.performLint();
-      const hasErrors = codemirror.state.lint.marked.length > 0;
-
-      if (!hasErrors) {
+    editorUpdated(attr, val) {
+      // wont set invalid JSON to the model
+      try {
         set(this.model, attr, JSON.parse(val));
+      } catch {
+        // linting is handled by the component
       }
     },
   },
diff --git a/ui/app/templates/components/role-ssh-edit.hbs b/ui/app/components/role-ssh-edit.hbs
similarity index 98%
rename from ui/app/templates/components/role-ssh-edit.hbs
rename to ui/app/components/role-ssh-edit.hbs
index 6a70d1cefe6..5f70c165e8b 100644
--- a/ui/app/templates/components/role-ssh-edit.hbs
+++ b/ui/app/components/role-ssh-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/components/role-ssh-edit.js b/ui/app/components/role-ssh-edit.js
index d58c299a047..233019213e2 100644
--- a/ui/app/components/role-ssh-edit.js
+++ b/ui/app/components/role-ssh-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/seal-action.hbs b/ui/app/components/seal-action.hbs
index b01e6b51842..19104874597 100644
--- a/ui/app/components/seal-action.hbs
+++ b/ui/app/components/seal-action.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-sideless is-fullwidth is-marginless">
   {{#if this.error}}
diff --git a/ui/app/components/seal-action.js b/ui/app/components/seal-action.js
index 4a2fd873ae4..b59e81c9898 100644
--- a/ui/app/components/seal-action.js
+++ b/ui/app/components/seal-action.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/secret-create-or-update.hbs b/ui/app/components/secret-create-or-update.hbs
similarity index 91%
rename from ui/app/templates/components/secret-create-or-update.hbs
rename to ui/app/components/secret-create-or-update.hbs
index 8650d73fdab..827f40e9a6c 100644
--- a/ui/app/templates/components/secret-create-or-update.hbs
+++ b/ui/app/components/secret-create-or-update.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (eq @mode "create")}}
   <form
@@ -18,7 +18,7 @@
         <Input
           autocomplete="off"
           spellcheck="false"
-          data-test-secret-path="true"
+          data-test-secret-path="create"
           id="kv-key"
           class="input {{if (get this.validationMessages 'path') 'has-error-border'}}"
           @value={{get @modelForData @modelForData.pathAttr}}
@@ -44,7 +44,7 @@
         >
           <A.Title>Warning</A.Title>
           <A.Description>
-            Your secret path contains whitespace. If this is desired, you'll need to encode it with %20 in API calls.
+            {{this.whitespaceWarning}}
           </A.Description>
         </Hds::Alert>
       {{/if}}
@@ -53,9 +53,9 @@
       <div class="form-section">
         <JsonEditor
           @title="Secret Data"
-          @value={{this.codemirrorString}}
-          @valueUpdated={{this.codemirrorUpdated}}
-          @onFocusOut={{this.formatJSON}}
+          @value={{this.editorString}}
+          @valueUpdated={{this.editorUpdated}}
+          @onBlur={{this.formatJSON}}
         />
       </div>
     {{else}}
@@ -67,7 +67,7 @@
           <div class="info-table-row">
             <div class="column is-one-quarter info-table-row-edit">
               <Input
-                data-test-secret-key={{true}}
+                data-test-secret-key="create"
                 @value={{secret.name}}
                 placeholder="key"
                 {{on "change" this.handleChange}}
@@ -107,7 +107,7 @@
 
     <div class="field is-grouped box is-fullwidth is-bottomless">
       <Hds::ButtonSet>
-        <Hds::Button @text="Save" type="submit" disabled={{@buttonDisabled}} data-test-secret-save={{true}} />
+        <Hds::Button @text="Save" type="submit" disabled={{@buttonDisabled}} data-test-submit />
         {{#if @model.path}}
           <Hds::Button
             @text="Cancel"
@@ -150,9 +150,9 @@
         <div class="form-section">
           <JsonEditor
             @title="Secret Data"
-            @value={{this.codemirrorString}}
-            @valueUpdated={{this.codemirrorUpdated}}
-            @onFocusOut={{this.formatJSON}}
+            @value={{this.editorString}}
+            @valueUpdated={{this.editorUpdated}}
+            @onBlur={{this.formatJSON}}
           />
         </div>
       {{else}}
@@ -164,7 +164,7 @@
             <div class="columns is-variable has-no-shadow">
               <div class="column is-one-quarter">
                 <Input
-                  data-test-secret-key={{true}}
+                  data-test-secret-key="edit"
                   @value={{secret.name}}
                   placeholder="key"
                   {{on "change" this.handleChange}}
@@ -204,9 +204,9 @@
         <Hds::ButtonSet>
           <Hds::Button
             @text="Save"
-            data-test-secret-save
             type="submit"
             disabled={{or @buttonDisabled this.validationErrorCount}}
+            data-test-submit
           />
           <Hds::Button
             @text="Cancel"
diff --git a/ui/app/components/secret-create-or-update.js b/ui/app/components/secret-create-or-update.js
index 298ab3ff1ea..183a38c3a0f 100644
--- a/ui/app/components/secret-create-or-update.js
+++ b/ui/app/components/secret-create-or-update.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -27,21 +27,21 @@
  */
 
 import Component from '@glimmer/component';
-import ControlGroupError from 'vault/lib/control-group-error';
 import Ember from 'ember';
-import keys from 'core/utils/key-codes';
+import keys from 'core/utils/keys';
 import { action, set } from '@ember/object';
 import { service } from '@ember/service';
 import { tracked } from '@glimmer/tracking';
 import { isBlank, isNone } from '@ember/utils';
 import { task, waitForEvent } from 'ember-concurrency';
+import { WHITESPACE_WARNING } from 'vault/utils/forms/validators';
 
 const LIST_ROUTE = 'vault.cluster.secrets.backend.list';
 const LIST_ROOT_ROUTE = 'vault.cluster.secrets.backend.list-root';
 const SHOW_ROUTE = 'vault.cluster.secrets.backend.show';
 
 export default class SecretCreateOrUpdate extends Component {
-  @tracked codemirrorString = null;
+  @tracked editorString = null;
   @tracked error = null;
   @tracked secretPaths = null;
   @tracked pathWhiteSpaceWarning = false;
@@ -53,9 +53,11 @@ export default class SecretCreateOrUpdate extends Component {
   @service router;
   @service store;
 
+  whitespaceWarning = WHITESPACE_WARNING('path');
+
   @action
   setup(elem, [secretData, mode]) {
-    this.codemirrorString = secretData.toJSONString();
+    this.editorString = secretData.toJSONString();
     this.validationMessages = {
       path: '',
     };
@@ -86,7 +88,8 @@ export default class SecretCreateOrUpdate extends Component {
     this.validationErrorCount = values.filter(Boolean).length;
   }
   onEscape(e) {
-    if (e.keyCode !== keys.ESC || this.args.mode !== 'show') {
+    const isEscKeyPressed = keys.ESC.includes(e.key);
+    if (isEscKeyPressed || this.args.mode !== 'show') {
       return;
     }
     const parentKey = this.args.model.parentKey;
@@ -105,7 +108,7 @@ export default class SecretCreateOrUpdate extends Component {
     const secret = this.args.model;
     const secretData = this.args.modelForData;
 
-    let key = secretData.get('path') || secret.id;
+    let key = secretData?.path || secret.id;
 
     if (key.startsWith('/')) {
       key = key.replace(/^\/+/g, '');
@@ -120,10 +123,10 @@ export default class SecretCreateOrUpdate extends Component {
         }
       })
       .catch((error) => {
-        if (error instanceof ControlGroupError) {
+        if (error.isControlGroupError) {
+          this.controlGroup.saveTokenFromError(error);
           const errorMessage = this.controlGroup.logFromError(error);
           this.error = errorMessage.content;
-          this.controlGroup.saveTokenFromError(error);
         }
         throw error;
       });
@@ -156,21 +159,19 @@ export default class SecretCreateOrUpdate extends Component {
     }
     this.checkRows();
   }
+
   @action
-  codemirrorUpdated(val, codemirror) {
-    this.error = null;
-    codemirror.performLint();
-    const noErrors = codemirror.state.lint.marked.length === 0;
-    if (noErrors) {
-      try {
-        this.args.secretData.fromJSONString(val);
-        set(this.args.modelForData, 'secretData', this.args.secretData.toJSON());
-      } catch (e) {
-        this.error = e.message;
-      }
+  editorUpdated(val) {
+    try {
+      this.args.secretData.fromJSONString(val);
+      set(this.args.modelForData, 'secretData', this.args.secretData.toJSON());
+    } catch (e) {
+      this.error = e.message;
     }
-    this.codemirrorString = val;
+
+    this.editorString = val;
   }
+
   @action
   createOrUpdateKey(type, event) {
     event.preventDefault();
@@ -195,25 +196,30 @@ export default class SecretCreateOrUpdate extends Component {
     if (isBlank(item.name)) {
       return;
     }
+    // secretData is a KVObject/ArrayProxy so removeObject is fine here
     data.removeObject(item);
     this.checkRows();
     this.handleChange();
   }
+
   @action
   formatJSON() {
-    this.codemirrorString = this.args.secretData.toJSONString(true);
+    this.editorString = this.args.secretData.toJSONString(true);
   }
+
   @action
   handleMaskedInputChange(secret, index, value) {
     const row = { ...secret, value };
     set(this.args.secretData, index, row);
     this.handleChange();
   }
+
   @action
   handleChange() {
-    this.codemirrorString = this.args.secretData.toJSONString(true);
+    this.editorString = this.args.secretData.toJSONString(true);
     set(this.args.modelForData, 'secretData', this.args.secretData.toJSON());
   }
+
   @action
   updateValidationErrorCount(errorCount) {
     this.validationErrorCount = errorCount;
diff --git a/ui/app/templates/components/secret-edit-toolbar.hbs b/ui/app/components/secret-edit-toolbar.hbs
similarity index 98%
rename from ui/app/templates/components/secret-edit-toolbar.hbs
rename to ui/app/components/secret-edit-toolbar.hbs
index 7873e0564c3..4dd3c0e4d8d 100644
--- a/ui/app/templates/components/secret-edit-toolbar.hbs
+++ b/ui/app/components/secret-edit-toolbar.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! template-lint-configure simple-unless "warn" }}
 <Toolbar aria-label="manage secret">
diff --git a/ui/app/components/secret-edit-toolbar.js b/ui/app/components/secret-edit-toolbar.js
index 977cf33c802..a78ce5068be 100644
--- a/ui/app/components/secret-edit-toolbar.js
+++ b/ui/app/components/secret-edit-toolbar.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/secret-edit.hbs b/ui/app/components/secret-edit.hbs
similarity index 92%
rename from ui/app/templates/components/secret-edit.hbs
rename to ui/app/components/secret-edit.hbs
index 8c875103809..3c9946d66fc 100644
--- a/ui/app/templates/components/secret-edit.hbs
+++ b/ui/app/components/secret-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div {{did-insert this.createKvData @model}}>
   <PageHeader as |p|>
@@ -22,6 +22,7 @@
           Edit Secret
         {{else}}
           {{@key.id}}
+          <Hds::Copy::Button @isIconOnly={{true}} @text="Copy your secret path" @textToCopy={{@key.id}} />
         {{/if}}
       </h1>
     </p.levelLeft>
@@ -50,7 +51,7 @@
       @showAdvancedMode={{this.showAdvancedMode}}
       @modelForData={{this.modelForData}}
       @canUpdateSecret={{this.canUpdateSecret}}
-      @codemirrorString={{this.codemirrorString}}
+      @editorString={{this.editorString}}
       @editActions={{hash toggleAdvanced=(action "toggleAdvanced") refresh=(action "refresh")}}
     />
 
diff --git a/ui/app/components/secret-edit.js b/ui/app/components/secret-edit.js
index efb30584968..15233b6db7d 100644
--- a/ui/app/components/secret-edit.js
+++ b/ui/app/components/secret-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -35,13 +35,13 @@ export default class SecretEdit extends Component {
   @service store;
 
   @tracked secretData = null;
-  @tracked codemirrorString = null;
+  @tracked editorString = null;
 
   // fired on did-insert from render modifier
   @action
   createKvData(elem, [model]) {
     this.secretData = KVObject.create({ content: [] }).fromJSON(model.secretData);
-    this.codemirrorString = this.secretData.toJSONString();
+    this.editorString = this.secretData.toJSONString();
   }
   // TODO move this to the secret model
   @maybeQueryRecord(
diff --git a/ui/app/components/secret-engine/card/metadata.hbs b/ui/app/components/secret-engine/card/metadata.hbs
new file mode 100644
index 00000000000..bbfc6b39899
--- /dev/null
+++ b/ui/app/components/secret-engine/card/metadata.hbs
@@ -0,0 +1,52 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+<Hds::Card::Container
+  @level="mid"
+  @hasBorder={{true}}
+  class="has-padding-m has-top-bottom-margin-12"
+  data-test-card-container="metadata"
+  ...attributes
+>
+  <Hds::Text::Display @size="300" @tag="h2" class="has-bottom-margin-s hds-foreground-strong">Metadata</Hds::Text::Display>
+
+  <div class="flex gap-16 is-flex-column has-top-padding-s">
+    <Hds::Form::Fieldset @layout="vertical" as |F|>
+      <F.Legend>Path</F.Legend>
+      <F.HelperText>The mount path where this secrets engine is accessible.</F.HelperText>
+      <F.Control>
+        <Hds::Layout::Flex @gap="8">
+          <Hds::Copy::Snippet @textToCopy={{@model.secretsEngine.path}} @color="secondary" data-test-copy-snippet="path" />
+        </Hds::Layout::Flex>
+      </F.Control>
+    </Hds::Form::Fieldset>
+
+    <Hds::Form::Fieldset @layout="vertical" as |F|>
+      <F.Legend>Accessor</F.Legend>
+      <F.HelperText>Internal identifier used by Vault to reference this engine.</F.HelperText>
+      <F.Control>
+        <Hds::Layout::Flex @gap="8">
+          <Hds::Copy::Snippet
+            @textToCopy={{@model.secretsEngine.accessor}}
+            @color="secondary"
+            data-test-copy-snippet="accessor"
+          />
+        </Hds::Layout::Flex>
+      </F.Control>
+    </Hds::Form::Fieldset>
+    <Hds::Form::Textarea::Field
+      name="description"
+      @value={{@model.secretsEngine.description}}
+      @isInvalid={{(gt @model.secretsEngine.description.length 500)}}
+      as |F|
+    >
+      <F.Label>Description</F.Label>
+      <F.HelperText>A short description of the secrets engine's purpose.</F.HelperText>
+      <F.CharacterCount @maxLength={{500}} />
+      {{#if (gt @model.secretsEngine.description.length 500)}}
+        <F.Error>Description exceeds character limit.</F.Error>
+      {{/if}}
+    </Hds::Form::Textarea::Field>
+  </div>
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/card/secrets-duration.hbs b/ui/app/components/secret-engine/card/secrets-duration.hbs
new file mode 100644
index 00000000000..2c76f5d5547
--- /dev/null
+++ b/ui/app/components/secret-engine/card/secrets-duration.hbs
@@ -0,0 +1,31 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+<Hds::Card::Container
+  @level="mid"
+  @hasBorder={{true}}
+  class="has-padding-m has-top-bottom-margin"
+  data-test-card-container="secrets duration"
+  ...attributes
+>
+  <Hds::Text::Display @size="300" @tag="h2" class="has-bottom-margin-s hds-foreground-strong">Secrets duration</Hds::Text::Display>
+
+  <Hds::Layout::Flex @align="start" @gap="16" class="has-bottom-margin-m">
+    <Hds::Layout::Flex @direction="column" @gap="4">
+      <Hds::Text::Body @size="200" @tag="p">Time-to-live defines how long secrets issued by this engine remain valid before
+        expiring.</Hds::Text::Body>
+      <Hds::Link::Standalone
+        @icon="external-link"
+        @iconPosition="trailing"
+        @text="TTL in Vault docs"
+        @href="https://developer.hashicorp.com/vault/docs/troubleshoot/tune-lease-ttl"
+      />
+    </Hds::Layout::Flex>
+  </Hds::Layout::Flex>
+
+  <Hds::Layout::Flex @direction="column" @gap="24" @isInline="true" class="has-top-padding-s has-bottom-padding-s">
+    <SecretEngine::TtlPickerV2 @model={{@model}} @initialUnit={{@defaultLeaseUnit}} @ttlKey="default_lease_ttl" />
+    <SecretEngine::TtlPickerV2 @model={{@model}} @initialUnit={{@maxLeaseUnit}} @ttlKey="max_lease_ttl" />
+  </Hds::Layout::Flex>
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/card/security.hbs b/ui/app/components/secret-engine/card/security.hbs
new file mode 100644
index 00000000000..ddc23d96a22
--- /dev/null
+++ b/ui/app/components/secret-engine/card/security.hbs
@@ -0,0 +1,30 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+<Hds::Card::Container
+  @level="mid"
+  @hasBorder={{true}}
+  class="has-padding-m has-top-bottom-margin"
+  data-test-card-container="security"
+  ...attributes
+>
+  <Hds::Form::Toggle::Group as |G|>
+    <G.Legend>
+      <Hds::Text::Display
+        @size="300"
+        @tag="h2"
+        class="has-bottom-margin-s hds-foreground-strong"
+      >Security</Hds::Text::Display>
+    </G.Legend>
+    {{! TODO: Confirm with design to see if we want these two fields to be disabled }}
+    <G.ToggleField name="local" checked={{@model.secretsEngine.local}} disabled data-test-input="local" as |F|>
+      <F.Label data-test-label="local">Local</F.Label>
+      <F.HelperText data-test-helper-text="local">Secrets stay in one cluster and are not replicated.</F.HelperText>
+    </G.ToggleField>
+    <G.ToggleField name="seal-wrap" checked={{@model.secretsEngine.seal_wrap}} disabled data-test-input="seal_wrap" as |F|>
+      <F.Label data-test-label="seal_wrap">Seal wrap</F.Label>
+      <F.HelperText data-test-helper-text="seal_wrap">Wrap secrets with an additional encryption layer using a seal.</F.HelperText>
+    </G.ToggleField>
+  </Hds::Form::Toggle::Group>
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/card/security.ts b/ui/app/components/secret-engine/card/security.ts
new file mode 100644
index 00000000000..c612a356409
--- /dev/null
+++ b/ui/app/components/secret-engine/card/security.ts
@@ -0,0 +1,25 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { action } from '@ember/object';
+import Component from '@glimmer/component';
+import SecretsEngineResource from 'vault/resources/secrets/engine';
+interface Args {
+  model: SecretsEngineResource;
+}
+
+export default class Security extends Component<Args> {
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+  }
+
+  @action toggleSealWrap() {
+    this.args.model.seal_wrap = !this.args.model.seal_wrap;
+  }
+
+  @action toggleLocal() {
+    this.args.model.local = !this.args.model.local;
+  }
+}
diff --git a/ui/app/components/secret-engine/card/version.hbs b/ui/app/components/secret-engine/card/version.hbs
new file mode 100644
index 00000000000..fbd4beda3be
--- /dev/null
+++ b/ui/app/components/secret-engine/card/version.hbs
@@ -0,0 +1,49 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+<Hds::Card::Container
+  @level="mid"
+  @hasBorder={{true}}
+  class="has-padding-m has-top-bottom-margin"
+  data-test-card-container="version"
+  ...attributes
+>
+  <Hds::Text::Display @size="300" @tag="h2" class="has-bottom-margin-s hds-foreground-strong">Version</Hds::Text::Display>
+
+  <Hds::Layout::Grid @columnMinWidth="10%" @gap="12" {{style height="100%" grid-template-rows="min-content"}} as |LG|>
+    <LG.Item @colspan={{2}}>
+      <Hds::Text::Body @tag="h3" class="hds-font-weight-semibold has-bottom-margin-s hds-foreground-strong">Engine type</Hds::Text::Body>
+      <Hds::Text::Body @tag="h3" class="hds-font-weight-semibold has-bottom-margin-s hds-foreground-strong">Current version</Hds::Text::Body>
+    </LG.Item>
+
+    <LG.Item @colspan={{3}}>
+      <Hds::Text::Body
+        @tag="p"
+        class="hds-border-strong has-side-padding-8 border-radius-small is-inline-block has-bottom-margin-s"
+        data-test-engine-type
+      >{{@model.secretsEngine.type}}</Hds::Text::Body>
+      {{! TODO: Verify if we want to display the full version or chop down ie. v0.17.1 vs v0.17.1-0.230942309423094... }}
+      <Hds::Text::Body
+        @tag="p"
+        data-test-engine-current-version
+      >{{@model.secretsEngine.running_plugin_version}}</Hds::Text::Body>
+    </LG.Item>
+  </Hds::Layout::Grid>
+
+  {{#if (gt @model.versions.length 1)}}
+    <Hds::Separator />
+
+    <Hds::Layout::Flex @isInline="true">
+      <Hds::Form::Select::Field name="plugin-version" data-test-versions-dropdown as |F|>
+        <F.Label>Update version to:</F.Label>
+        <F.Options>
+          <option value="">Select version</option>
+          {{#each @model.versions as |version|}}
+            <option value={{version}}>{{version}}</option>
+          {{/each}}
+        </F.Options>
+      </Hds::Form::Select::Field>
+    </Hds::Layout::Flex>
+  {{/if}}
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/configuration-details.hbs b/ui/app/components/secret-engine/configuration-details.hbs
new file mode 100644
index 00000000000..4947ec071c8
--- /dev/null
+++ b/ui/app/components/secret-engine/configuration-details.hbs
@@ -0,0 +1,37 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if @config}}
+  {{#each this.displayFields as |field|}}
+    {{! public key while not sensitive when editing/creating, should be hidden by default on viewing }}
+    {{#if (eq field "public_key")}}
+      <InfoTableRow @label="Public key" @value={{@config.public_key}}>
+        <MaskedInput @value={{@config.public_key}} @name={{field}} @displayOnly={{true}} @allowCopy={{true}} />
+      </InfoTableRow>
+    {{else}}
+      <InfoTableRow
+        @alwaysRender={{not (is-empty-value (get @config field))}}
+        @label={{this.label field}}
+        @value={{get @config field}}
+        @formatTtl={{this.isDuration field}}
+      />
+    {{/if}}
+  {{/each}}
+{{else}}
+  {{! Prompt user to configure the secret engine }}
+  <EmptyState
+    data-test-config-cta
+    @title="{{@typeDisplay}} not configured"
+    @message="Get started by configuring your {{@typeDisplay}} secrets engine."
+  >
+    <Hds::Link::Standalone
+      @icon="chevron-right"
+      @iconPosition="trailing"
+      @text="Configure {{@typeDisplay}}"
+      @route="vault.cluster.secrets.backend.configuration.edit"
+      @model={{@id}}
+    />
+  </EmptyState>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/configuration-details.ts b/ui/app/components/secret-engine/configuration-details.ts
new file mode 100644
index 00000000000..3fb6dade8cd
--- /dev/null
+++ b/ui/app/components/secret-engine/configuration-details.ts
@@ -0,0 +1,93 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { toLabel } from 'core/helpers/to-label';
+
+import type { AwsConfig, AzureConfig, GcpConfig, SshConfig } from 'vault/vault/secrets/engine';
+
+type Args = {
+  config: AwsConfig | AzureConfig | GcpConfig | SshConfig;
+  typeDisplay: string;
+};
+
+export default class ConfigurationDetails extends Component<Args> {
+  awsFields = [
+    'role_arn',
+    'identity_token_audience',
+    'identity_token_ttl',
+    'access_key',
+    'region',
+    'iam_endpoint',
+    'sts_endpoint',
+    'max_retries',
+    'lease',
+    'lease_max',
+    'issuer',
+  ];
+
+  azureFields = [
+    'subscription_id',
+    'tenant_id',
+    'client_id',
+    'identity_token_audience',
+    'identity_token_ttl',
+    'root_password_ttl',
+    'environment',
+    'issuer',
+  ];
+
+  gcpFields = [
+    'service_account_email',
+    'ttl',
+    'max_ttl',
+    'identity_token_audience',
+    'identity_token_ttl',
+    'issuer',
+  ];
+
+  sshFields = ['public_key', 'generate_signing_key'];
+
+  get displayFields() {
+    switch (this.args.typeDisplay) {
+      case 'AWS':
+        return this.awsFields;
+      case 'Azure':
+        return this.azureFields;
+      case 'Google Cloud':
+        return this.gcpFields;
+      case 'SSH':
+        return this.sshFields;
+      default:
+        return [];
+    }
+  }
+
+  label = (field: string) => {
+    const label = toLabel([field]);
+    // convert words like id and ttl to uppercase
+    const formattedLabel = label
+      .split(' ')
+      .map((word: string) => {
+        const acronyms = ['id', 'ttl', 'arn', 'iam', 'sts'];
+        return acronyms.includes(word.toLowerCase()) ? word.toUpperCase() : word;
+      })
+      .join(' ');
+    // map specific fields to custom labels
+    return (
+      {
+        lease: 'Default Lease TTL',
+        lease_max: 'Max Lease TTL',
+        ttl: 'Config TTL',
+      }[field] || formattedLabel
+    );
+  };
+
+  isDuration = (field: string) => {
+    return ['identity_token_ttl', 'root_password_ttl', 'lease', 'lease_max', 'ttl', 'max_ttl'].includes(
+      field
+    );
+  };
+}
diff --git a/ui/app/components/secret-engine/configure-ssh.hbs b/ui/app/components/secret-engine/configure-ssh.hbs
new file mode 100644
index 00000000000..217bae08819
--- /dev/null
+++ b/ui/app/components/secret-engine/configure-ssh.hbs
@@ -0,0 +1,75 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" (perform this.save)}} aria-label="save ssh creds" class="has-top-padding-m" data-test-configure-form>
+  <NamespaceReminder @mode="save" @noun="configuration" />
+  <MessageError @errorMessage={{this.errorMessage}} />
+  {{#if @configForm.isNew}}
+    {{#each @configForm.formFields as |attr|}}
+      <FormField @attr={{attr}} @model={{@configForm}} @modelValidations={{this.modelValidations}} />
+    {{/each}}
+    <hr class="has-background-gray-300" />
+    <Hds::ButtonSet>
+      <Hds::Button
+        @text="Save"
+        @icon={{if this.save.isRunning "loading"}}
+        type="submit"
+        disabled={{this.save.isRunning}}
+        data-test-submit
+      />
+      <Hds::Button
+        @text="Cancel"
+        @color="secondary"
+        disabled={{this.save.isRunning}}
+        {{on "click" this.onCancel}}
+        data-test-cancel
+      />
+    </Hds::ButtonSet>
+    {{#if this.invalidFormAlert}}
+      <AlertInline
+        data-test-invalid-form-alert
+        class="has-top-padding-s"
+        @type="danger"
+        @message={{this.invalidFormAlert}}
+      />
+    {{/if}}
+  {{else}}
+    {{! Form is not new and keys have already been created. Require user deletes the keys before creating new ones }}
+    <p class="has-text-grey-dark has-top-bottom-margin">
+      NOTE: You must delete your existing certificate and key before saving new values.
+    </p>
+
+    <div class="box is-fullwidth is-sideless" data-test-edit-config-section>
+      <label for="publicKey" class="is-label">
+        Public key
+      </label>
+      <div class="control">
+        <MaskedInput
+          @name="publicKey"
+          @id="publicKey"
+          @value={{@configForm.public_key}}
+          @displayOnly={{true}}
+          @allowCopy={{true}}
+          data-test-input="public-key"
+        />
+      </div>
+    </div>
+    <Hds::ButtonSet>
+      <Hds::Copy::Button
+        @text="Copy"
+        @textToCopy={{@configForm.public_key}}
+        @onError={{fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")}}
+        class="primary"
+      />
+      <ConfirmAction
+        @buttonText="Delete"
+        @buttonColor="secondary"
+        @confirmMessage="Confirming will remove the CA certificate information."
+        @onConfirmAction={{this.deleteCaConfig}}
+        data-test-button="delete-public-key"
+      />
+    </Hds::ButtonSet>
+  {{/if}}
+</form>
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/configure-ssh.ts b/ui/app/components/secret-engine/configure-ssh.ts
new file mode 100644
index 00000000000..c2ec83e29a0
--- /dev/null
+++ b/ui/app/components/secret-engine/configure-ssh.ts
@@ -0,0 +1,106 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { task } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { ValidationMap } from 'vault/vault/app-types';
+
+import type SshConfigForm from 'vault/forms/secrets/ssh-config';
+import type Router from '@ember/routing/router';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type ApiService from 'vault/services/api';
+
+/**
+ * @module ConfigureSshComponent is used to configure the SSH secret engine.
+ *
+ * @example
+ * ```js
+ * <SecretEngine::ConfigureSsh
+ *    @configForm={{this.model.configForm}}
+ *    @id={{this.model.id}}
+ *  />
+ * ```
+ *
+ * @param {string} configForm - SSH ca-config form
+ * @param {string} id - name of the SSH secret engine, ex: 'ssh-123'
+ */
+
+interface Args {
+  configForm: SshConfigForm;
+  id: string;
+}
+
+export default class ConfigureSshComponent extends Component<Args> {
+  @service declare readonly router: Router;
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+
+  @tracked errorMessage: string | null = null;
+  @tracked invalidFormAlert: string | null = null;
+  @tracked modelValidations: ValidationMap | null = null;
+
+  save = task(
+    waitFor(async (event: Event) => {
+      event.preventDefault();
+      this.resetErrors();
+
+      const { id, configForm } = this.args;
+      const { isValid, state, invalidFormMessage, data } = configForm.toJSON();
+      this.modelValidations = isValid ? null : state;
+      this.invalidFormAlert = isValid ? '' : invalidFormMessage;
+
+      if (isValid) {
+        try {
+          await this.api.secrets.sshConfigureCa(id, data);
+          this.flashMessages.success(`Successfully saved ${id}'s root configuration.`);
+          this.transition();
+        } catch (error) {
+          const { message } = await this.api.parseError(error);
+          this.errorMessage = message;
+          this.invalidFormAlert = 'There was an error submitting this form.';
+        }
+      }
+    })
+  );
+
+  resetErrors() {
+    this.flashMessages.clearMessages();
+    this.errorMessage = null;
+    this.invalidFormAlert = null;
+  }
+
+  transition(isDelete = false) {
+    // deleting a key is the only case in which we want to stay on the create/edit page.
+    const { id } = this.args;
+    if (isDelete) {
+      this.router.transitionTo('vault.cluster.secrets.backend.configuration.edit', id);
+    } else {
+      this.router.transitionTo('vault.cluster.secrets.backend.configuration', id);
+    }
+  }
+
+  @action
+  onCancel() {
+    // clear errors because they're canceling out of the workflow.
+    this.resetErrors();
+    this.transition();
+  }
+
+  @action
+  async deleteCaConfig() {
+    try {
+      await this.api.secrets.sshDeleteCaConfiguration(this.args.id);
+      this.flashMessages.success('CA information deleted successfully.');
+      this.transition(true);
+    } catch (error) {
+      const { message } = await this.api.parseError(error);
+      this.flashMessages.danger(message);
+    }
+  }
+}
diff --git a/ui/app/components/secret-engine/configure-tabs.hbs b/ui/app/components/secret-engine/configure-tabs.hbs
new file mode 100644
index 00000000000..f677512383e
--- /dev/null
+++ b/ui/app/components/secret-engine/configure-tabs.hbs
@@ -0,0 +1,25 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#let (engines-display-data @secretsEngine.type) as |engineDisplayData|}}
+  <nav class="tabs" aria-label={{engineDisplayData.displayName}}>
+    <ul>
+      <li data-test-tab="general-settings">
+        <LinkTo @route="vault.cluster.secrets.backend.configuration.general-settings" @model={{@secretsEngine.id}}>
+          General settings
+        </LinkTo>
+      </li>
+      {{! If engine is not configurable, hide plugin settings link }}
+      {{#if (get engineDisplayData "isConfigurable")}}
+        <li data-test-tab="plugin-settings">
+          <LinkTo @route="vault.cluster.secrets.backend.configuration.plugin-settings" @model={{@secretsEngine.id}}>
+            {{get engineDisplayData "displayName"}}
+            settings
+          </LinkTo>
+        </li>
+      {{/if}}
+    </ul>
+  </nav>
+{{/let}}
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/configure-wif.hbs b/ui/app/components/secret-engine/configure-wif.hbs
new file mode 100644
index 00000000000..e065d3ce934
--- /dev/null
+++ b/ui/app/components/secret-engine/configure-wif.hbs
@@ -0,0 +1,121 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" (perform this.submitForm)}} aria-label="configure {{@type}} credentials" data-test-configure-form>
+  <NamespaceReminder @mode="save" @noun="configuration" />
+  <MessageError @errorMessage={{this.errorMessage}} />
+  {{! AWS specific note and section header }}
+  {{#if (eq @type "aws")}}
+    <p class="has-text-grey-dark has-top-bottom-margin" data-test-configure-note={{@type}}>
+      Note: the client uses the official AWS SDK and will use the specified credentials, environment credentials, shared file
+      credentials, or IAM role/ECS task credentials in that order.
+    </p>
+    <h2 class="title is-5 has-bottom-padding-s has-top-margin-l" data-test-access-title>
+      Access to AWS
+    </h2>
+  {{/if}}
+  <div class="box is-fullwidth is-sideless">
+    {{! Only enterprise users can change access type from "account" to "wif" }}
+    {{#if this.version.isEnterprise}}
+      <fieldset class="field form-fieldset" id="protection" data-test-access-type-section>
+        <legend class="is-label">Access Type</legend>
+        <p class="sub-text" data-test-access-type-subtext>
+          {{#if this.disableAccessType}}
+            You cannot edit Access Type if you have already saved access credentials.
+          {{else}}
+            Choose the way to configure access to
+            {{@displayName}}. Access can be configured either using
+            {{if (eq @type "aws") "IAM access keys" (concat @displayName " account credentials")}}
+            or with the Plugin Workload Identity Federation (WIF).
+          {{/if}}
+        </p>
+        <div>
+          <RadioButton
+            id="access-type-{{@type}}"
+            name="account"
+            class="radio"
+            data-test-access-type={{@type}}
+            @value="account"
+            @groupValue={{@configForm.accessType}}
+            @onChange={{this.onChangeAccessType}}
+            @disabled={{this.disableAccessType}}
+          />
+          <label for="access-type-{{@type}}">{{@displayName}} account credentials</label>
+          <RadioButton
+            id="access-type-wif"
+            name="wif"
+            class="radio has-left-margin-m"
+            data-test-access-type="wif"
+            @value="wif"
+            @groupValue={{@configForm.accessType}}
+            @onChange={{this.onChangeAccessType}}
+            @disabled={{this.disableAccessType}}
+          />
+          <label for="access-type-wif">Workload Identity Federation</label>
+        </div>
+      </fieldset>
+    {{/if}}
+
+    <FormFieldGroups
+      @model={{@configForm}}
+      @mode={{if @configForm.isNew "create" "edit"}}
+      @useEnableInput={{true}}
+      @groupName="formFieldGroups"
+    />
+    {{! additional config fields show regardless of the vault version or what access type is selected }}
+    {{! these need to be defined as formFields on the form class }}
+    {{#if @configForm.formFields}}
+      <h2 class="title is-5 has-bottom-padding-s has-top-margin-l" data-test-additional-config-model-title>
+        {{if (eq @type "aws") "Lease" "Additional"}}
+        Configuration
+      </h2>
+      <div class="box is-fullwidth is-sideless is-bottomless">
+        {{#each @configForm.formFields as |field|}}
+          <FormField @attr={{field}} @model={{@configForm}} @modelValidations={{this.modelValidations}} />
+        {{/each}}
+      </div>
+    {{/if}}
+  </div>
+
+  <Hds::ButtonSet>
+    <Hds::Button
+      @text="Save"
+      @icon={{if this.save.isRunning "loading"}}
+      type="submit"
+      disabled={{this.save.isRunning}}
+      data-test-submit
+    />
+    <Hds::Button
+      @text="Cancel"
+      @color="secondary"
+      class="has-left-margin-s"
+      disabled={{this.save.isRunning}}
+      {{on "click" this.onCancel}}
+      data-test-cancel
+    />
+  </Hds::ButtonSet>
+  {{#if this.invalidFormAlert}}
+    <AlertInline data-test-invalid-form-alert class="has-top-padding-s" @type="danger" @message={{this.invalidFormAlert}} />
+  {{/if}}
+</form>
+
+{{#if this.saveIssuerWarning}}
+  <Hds::Modal @color="warning" @onClose={{action (mut this.saveIssuerWarning) ""}} data-test-issuer-warning as |M|>
+    <M.Header @icon="alert-circle">
+      Are you sure?
+    </M.Header>
+    <M.Body>
+      <p class="has-bottom-margin-s" data-test-issuer-warning-message>
+        {{this.saveIssuerWarning}}
+      </p>
+    </M.Body>
+    <M.Footer as |F|>
+      <Hds::ButtonSet>
+        <Hds::Button @text="Continue" {{on "click" this.continueSubmitForm}} data-test-issuer-save />
+        <Hds::Button @text="Cancel" @color="secondary" {{on "click" F.close}} data-test-issuer-cancel />
+      </Hds::ButtonSet>
+    </M.Footer>
+  </Hds::Modal>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/configure-wif.ts b/ui/app/components/secret-engine/configure-wif.ts
new file mode 100644
index 00000000000..9f361f1efcd
--- /dev/null
+++ b/ui/app/components/secret-engine/configure-wif.ts
@@ -0,0 +1,202 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { task } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { ValidationMap } from 'vault/vault/app-types';
+import { assert } from '@ember/debug';
+import { next } from '@ember/runloop';
+
+import type Router from '@ember/routing/router';
+import type ApiService from 'vault/services/api';
+import type VersionService from 'vault/services/version';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type Owner from '@ember/owner';
+import type AwsConfigForm from 'vault/forms/secrets/aws-config';
+import type AzureConfigForm from 'vault/forms/secrets/azure-config';
+import type GcpConfigForm from 'vault/forms/secrets/gcp-config';
+
+/**
+ * @module SecretEngineConfigureWif component is used to configure secret engines that allow the WIF (Workload Identity Federation) configuration.
+ * The ability to configure WIF fields is an enterprise only feature.
+ * If the user is configuring WIF attributes they will also have the option to update the global issuer config, which is a separate endpoint named identity/oidc/config.
+ * If a user is on CE, the account configuration fields will display with no ability to select or see wif fields.
+ * 
+ * @example
+ * <SecretEngine::ConfigureWif
+    @backendPath={{this.model.id}}
+    @displayName="AWS"
+    @type="aws"
+    @configForm={{this.model.configForm}}
+    />
+ *
+ * @param {string} backendPath - name of the secret engine, ex: 'azure-123'.
+ * @param {string} displayName - used for flash messages, subText and labels. ex: 'Azure'.
+ * @param {string} type - the type of the engine, ex: 'azure'.
+ * @param {object} configForm - the config form for the engine. The field `isWifPluginConfigured` must be added to the form, otherwise this component will assert an error. `isWifPluginConfigured` should return true if any required wif fields have been set.
+ */
+
+type ConfigForm = AwsConfigForm | AzureConfigForm | GcpConfigForm;
+interface Args {
+  backendPath: string;
+  displayName: string;
+  type: string;
+  configForm: ConfigForm;
+}
+
+export default class ConfigureWif extends Component<Args> {
+  @service declare readonly router: Router;
+  @service declare readonly api: ApiService;
+  @service declare readonly version: VersionService;
+  @service declare readonly flashMessages: FlashMessageService;
+
+  @tracked errorMessage = '';
+  @tracked invalidFormAlert = '';
+  @tracked saveIssuerWarning = '';
+  @tracked modelValidations: ValidationMap | null = null;
+
+  disableAccessType = false;
+  originalIssuer: string | undefined;
+
+  constructor(owner: Owner, args: Args) {
+    super(owner, args);
+    // the following checks are only relevant to existing enterprise configurations
+    const { isNew, data, isWifPluginConfigured, isAccountPluginConfigured } = this.args.configForm;
+
+    if (this.version.isEnterprise && !isNew) {
+      assert(
+        `'isWifPluginConfigured' is required to be defined on the config model. Must return a boolean.`,
+        isWifPluginConfigured !== undefined
+      );
+      next(() => {
+        this.args.configForm.accessType = isWifPluginConfigured ? 'wif' : 'account';
+      });
+      // if wif or account only attributes are defined, disable the user's ability to change the access type
+      this.disableAccessType = isWifPluginConfigured || isAccountPluginConfigured;
+    }
+
+    // cache the issuer to check if it has been changed later
+    this.originalIssuer = data.issuer;
+  }
+
+  @action continueSubmitForm() {
+    this.saveIssuerWarning = '';
+    this.save.perform();
+  }
+
+  // check if the issuer has been changed to show issuer modal
+  // continue saving the configuration
+  submitForm = task(
+    waitFor(async (event: Event) => {
+      event?.preventDefault();
+      this.resetErrors();
+      const { isValid, state, invalidFormMessage, data } = this.args.configForm.toJSON();
+
+      if (!isValid) {
+        this.modelValidations = isValid ? null : state;
+        this.invalidFormAlert = isValid ? '' : invalidFormMessage;
+        return;
+      }
+
+      if (this.originalIssuer !== data.issuer) {
+        // if the issuer has changed show modal with warning that the config will change
+        // if the modal is shown, the user has to click confirm to continue saving
+        this.saveIssuerWarning = `You are updating the global issuer config. This will overwrite Vault's current issuer ${
+          !this.originalIssuer ? 'if it exists ' : ''
+        }and may affect other configurations using this value. Continue?`;
+        // exit task until user confirms
+        return;
+      }
+
+      await this.save.perform();
+    })
+  );
+
+  save = task(
+    waitFor(async () => {
+      try {
+        const { data } = this.args.configForm.toJSON();
+        const { issuer } = data;
+        await this.saveConfig(data);
+        if (this.originalIssuer !== issuer) {
+          await this.updateIssuer(issuer as string);
+        }
+        this.flashMessages.success(`Successfully saved ${this.args.backendPath}'s configuration.`);
+        this.transition();
+      } catch (e) {
+        const { message } = await this.api.parseError(e);
+        this.errorMessage = message;
+        this.invalidFormAlert = 'There was an error submitting this form.';
+      }
+    })
+  );
+
+  async updateIssuer(issuer: string) {
+    try {
+      await this.api.identity.oidcConfigure({ issuer });
+    } catch (e) {
+      const { message } = await this.api.parseError(e, 'Check Vault logs for details.');
+      this.flashMessages.danger(`Issuer was not saved: ${message}`);
+    }
+  }
+
+  async saveConfig(data: ConfigForm['data']) {
+    const { backendPath, type } = this.args;
+    if (type === 'aws') {
+      await this.api.secrets.awsConfigureRootIamCredentials(backendPath, data);
+      try {
+        const { lease, lease_max } = data as { lease: string; lease_max: string };
+        await this.api.secrets.awsConfigureLease(backendPath, { lease, lease_max });
+      } catch (e) {
+        const { message } = await this.api.parseError(e);
+        this.flashMessages.danger(`Error saving lease configuration: ${message}`);
+      }
+    } else if (type === 'azure') {
+      await this.api.secrets.azureConfigure(backendPath, data);
+    } else if (type === 'gcp') {
+      await this.api.secrets.googleCloudConfigure(backendPath, data);
+    }
+  }
+
+  resetErrors() {
+    this.flashMessages.clearMessages();
+    this.errorMessage = this.invalidFormAlert = '';
+    this.modelValidations = null;
+  }
+
+  transition() {
+    this.router.transitionTo('vault.cluster.secrets.backend.configuration', this.args.backendPath);
+  }
+
+  @action
+  onChangeAccessType(accessType: 'account' | 'wif') {
+    const { configForm, type } = this.args;
+    configForm.accessType = accessType;
+
+    if (accessType === 'account') {
+      // reset all "wif" attributes that are mutually exclusive with "account" attributes
+      // these attributes are the same for each engine
+      configForm.data.identity_token_audience = configForm.data.identity_token_ttl = undefined;
+    } else if (accessType === 'wif') {
+      // reset all "account" attributes that are mutually exclusive with "wif" attributes
+      // these attributes are different for each engine
+      if (type === 'azure') {
+        (configForm as AzureConfigForm).data.client_secret = undefined;
+      } else if (type === 'aws') {
+        (configForm as AwsConfigForm).data.access_key = undefined;
+      }
+    }
+  }
+
+  @action
+  onCancel() {
+    this.resetErrors();
+    this.transition();
+  }
+}
diff --git a/ui/app/components/secret-engine/list.hbs b/ui/app/components/secret-engine/list.hbs
new file mode 100644
index 00000000000..0fa021ae35c
--- /dev/null
+++ b/ui/app/components/secret-engine/list.hbs
@@ -0,0 +1,200 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::PageHeader class="page-header" as |PH|>
+  <PH.Breadcrumb>
+    <Hds::Breadcrumb data-test-breadcrumbs>
+      <Hds::Breadcrumb::Item @text="Vault" @route="vault.cluster.dashboard" @icon="vault" />
+      <Hds::Breadcrumb::Item @text="Secrets engines" @current={{true}} />
+    </Hds::Breadcrumb>
+  </PH.Breadcrumb>
+  <PH.IconTile @icon="key" />
+
+  <PH.Title>Secrets engines</PH.Title>
+  <PH.Subtitle>Secrets engines available in {{this.clusterName}}.</PH.Subtitle>
+
+  <PH.Actions>
+    <Hds::Button @text="Enable new engine" @icon="plus" @route="vault.cluster.secrets.enable" data-test-enable-engine />
+  </PH.Actions>
+</Hds::PageHeader>
+
+{{! Filters section }}
+<Hds::SegmentedGroup class="has-top-margin-m" as |SG|>
+  <SG.TextInput
+    @width="300px"
+    @type="search"
+    placeholder="Search by path"
+    aria-label="Search"
+    data-test-input-search="secret-engine-path"
+    {{on "input" (fn this.setSearchText "path")}}
+  />
+  <SG.Dropdown @width="175px" as |D|>
+    <D.Header @hasDivider={{true}}>
+      <SG.TextInput @type="search" placeholder="Search" aria-label="Search" {{on "input" (fn this.setSearchText "type")}} />
+    </D.Header>
+    <D.ToggleButton @color="secondary" @text="Engine type" data-test-toggle-input="filter-by-engine-type" />
+    {{#each this.secretEngineArrayByType as |type|}}
+      <D.Checkbox
+        value={{type.name}}
+        checked={{includes type.name this.engineTypeFilters}}
+        {{on "click" (fn this.filterByEngineType type.name)}}
+        data-test-checkbox={{type.name}}
+      ><Hds::Icon @name={{type.icon}} @isInline={{true}} /> {{type.name}}</D.Checkbox>
+    {{/each}}
+  </SG.Dropdown>
+  <SG.Dropdown @width="250px" as |D|>
+    <D.ToggleButton @color="secondary" @text="Version" data-test-toggle-input="filter-by-engine-version" />
+    {{#if this.engineTypeFilters.length}}
+      <D.Header @hasDivider={{true}}>
+        <SG.TextInput
+          @type="search"
+          placeholder="Search"
+          aria-label="Search"
+          {{on "input" (fn this.setSearchText "version")}}
+        />
+      </D.Header>
+      {{#each this.secretEngineArrayByVersions as |backend|}}
+        <D.Checkbox
+          value={{backend.version}}
+          checked={{includes backend.version this.engineVersionFilters}}
+          {{on "click" (fn this.filterByEngineVersion backend.version)}}
+          data-test-checkbox={{backend.version}}
+        >
+          {{backend.version}}
+        </D.Checkbox>
+      {{/each}}
+    {{else}}
+      <D.Description class="has-top-padding-s" @text="Select an engine type first to filter by versions." />
+    {{/if}}
+  </SG.Dropdown>
+</Hds::SegmentedGroup>
+
+<Hds::Layout::Flex @gap="8" class="has-top-margin-xs has-bottom-margin-xs" @align="center">
+  {{#if (and (not this.engineTypeFilters) (not this.engineVersionFilters))}}
+    <Hds::Text::Body class="has-top-padding-xs">No filters applied.</Hds::Text::Body>
+  {{else}}
+    <Hds::Text::Body>Filters applied:</Hds::Text::Body>
+    {{#each this.engineTypeFilters as |type|}}
+      <Hds::Tag @text={{type}} @onDismiss={{fn this.filterByEngineType type}} data-test-button={{type}} />
+    {{/each}}
+    {{#each this.engineVersionFilters as |version|}}
+      <Hds::Tag @text={{version}} @onDismiss={{fn this.filterByEngineVersion version}} data-test-button={{version}} />
+    {{/each}}
+    <Hds::Button
+      @text="Clear all"
+      @color="tertiary"
+      @icon="x"
+      @size="small"
+      data-test-button="Clear all"
+      {{on "click" this.clearAllFilters}}
+    />
+  {{/if}}
+</Hds::Layout::Flex>
+{{! End Filters Section }}
+
+{{! Table Section }}
+{{#if this.sortedDisplayableBackends}}
+  <ListTable
+    class="has-top-margin-xs"
+    @columns={{this.tableColumns}}
+    @selectionKey="path"
+    @data={{this.sortedDisplayableBackends}}
+    @onSelectionChange={{this.updateSelectedItems}}
+  >
+    <:selectedItems>
+      {{#if this.selectedItems}}
+        <Hds::Layout::Flex
+          @gap="8"
+          @direction="row"
+          @justify="end"
+          @align="center"
+          class="has-bottom-margin-s has-top-margin-negative-xxl"
+          @isInline="true"
+        >
+          <Hds::Text::Body role="status" @tag="p" @size="200" @color="foreground-primary">
+            {{this.selectedItems.length}}
+            selected out of
+            {{this.sortedDisplayableBackends.length}}
+          </Hds::Text::Body>
+          <Hds::Button
+            @text="Disable engines"
+            @color="critical"
+            @icon="trash"
+            {{on "click" (fn (mut this.enginesToDisable) this.selectedItems)}}
+          />
+        </Hds::Layout::Flex>
+      {{/if}}
+    </:selectedItems>
+    <:customTableItem as |itemData|>
+      <Hds::TooltipButton
+        aria-label="Type of backend"
+        @text={{this.generateToolTipText itemData}}
+        data-test-tooltip="Backend type"
+        isInline={{true}}
+        class="is-v-centered"
+      >
+        <Hds::Icon @name={{if itemData.icon itemData.icon "lock"}} />
+      </Hds::TooltipButton>
+      {{#if itemData.isSupportedBackend}}
+        <Hds::Link::Inline
+          @route={{itemData.backendLink}}
+          @model={{itemData.id}}
+          @color="secondary"
+          class="has-text-weight-semibold"
+        >{{itemData.path}}</Hds::Link::Inline>
+      {{else}}
+        {{itemData.path}}
+      {{/if}}
+    </:customTableItem>
+
+    <:popupMenu as |rowData|>
+      <Hds::Dropdown @isInline={{true}} as |dd|>
+        <dd.ToggleIcon
+          @icon="more-horizontal"
+          @text="{{if rowData.isSupportedBackend 'supported' 'unsupported'}} secrets engine menu"
+          @hasChevron={{false}}
+          data-test-popup-menu-trigger
+        />
+        <dd.Interactive
+          @route={{rowData.backendConfigurationLink}}
+          @model={{rowData.id}}
+          data-test-popup-menu="view-configuration"
+          @icon="settings"
+        >View configuration</dd.Interactive>
+        {{#if (not-eq rowData.type "cubbyhole")}}
+          <dd.Interactive
+            @color="critical"
+            {{on "click" (fn (mut this.engineToDisable) rowData)}}
+            data-test-popup-menu="disable-engine"
+            @icon="trash"
+          >Disable</dd.Interactive>
+        {{/if}}
+      </Hds::Dropdown>
+    </:popupMenu>
+  </ListTable>
+{{else}}
+  <EmptyState @title="No Secrets engines found" />
+{{/if}}
+{{! End Table Section }}
+
+{{#if this.engineToDisable}}
+  <ConfirmModal
+    @color="critical"
+    @confirmMessage="Any data in this engine will be permanently deleted."
+    @confirmTitle="Disable engine?"
+    @onClose={{fn (mut this.engineToDisable) null}}
+    @onConfirm={{perform this.disableEngine this.engineToDisable}}
+  />
+{{/if}}
+
+{{#if this.enginesToDisable}}
+  <ConfirmModal
+    @color="critical"
+    @confirmMessage="Any data in these engines will be permanently deleted."
+    @confirmTitle="Disable engines?"
+    @onClose={{fn (mut this.enginesToDisable) null}}
+    @onConfirm={{perform this.disableMultipleEngines this.enginesToDisable}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/list.ts b/ui/app/components/secret-engine/list.ts
new file mode 100644
index 00000000000..b41d8cdd031
--- /dev/null
+++ b/ui/app/components/secret-engine/list.ts
@@ -0,0 +1,277 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { dropTask } from 'ember-concurrency';
+
+import type FlashMessageService from 'vault/services/flash-messages';
+import type SecretsEngineResource from 'vault/resources/secrets/engine';
+import type ApiService from 'vault/services/api';
+import type RouterService from '@ember/routing/router-service';
+import type VersionService from 'vault/services/version';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+
+/**
+ * @module SecretEngineList handles the display of the list of secret engines, including the filtering.
+ * 
+ * @example
+ * <SecretEngine::List
+    @secretEngines={{this.model}}
+    />
+ *
+ * @param {array} secretEngines - An array of Secret Engine models returned from query on the parent route.
+ */
+
+interface Args {
+  secretEngines: Array<SecretsEngineResource>;
+}
+
+export default class SecretEngineList extends Component<Args> {
+  @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly api: ApiService;
+  @service declare readonly router: RouterService;
+  @service declare readonly version: VersionService;
+
+  @tracked secretEngineOptions: Array<string> | [] = [];
+  @tracked engineToDisable: SecretsEngineResource | undefined = undefined;
+  @tracked enginesToDisable: Array<SecretsEngineResource> | null = null;
+
+  @tracked engineTypeFilters: Array<string> = [];
+  @tracked engineVersionFilters: Array<string> = [];
+  @tracked searchText = '';
+
+  // search text for dropdown filters
+  @tracked typeSearchText = '';
+  @tracked versionSearchText = '';
+
+  @tracked selectedItems = Array<string>();
+
+  tableColumns = [
+    {
+      key: 'path',
+      label: 'Engine path',
+      isSortable: true,
+      width: '250px',
+      customTableItem: true,
+    },
+    {
+      key: 'accessor',
+      label: 'Accessor',
+      width: '175px',
+    },
+    {
+      key: 'description',
+      label: 'Description',
+      width: '300px',
+    },
+    {
+      key: 'running_plugin_version',
+      label: 'Version',
+      isSortable: true,
+      width: '150px',
+    },
+    {
+      key: 'popupMenu',
+      label: 'Action',
+      width: '75px',
+    },
+  ];
+
+  get clusterName() {
+    return this.version.clusterName;
+  }
+
+  get displayableBackends() {
+    return this.args.secretEngines.filter((backend) => backend.shouldIncludeInList);
+  }
+
+  get sortedDisplayableBackends() {
+    // show supported secret engines first and then organize those by id.
+    let sortedBackends = this.displayableBackends
+      .slice()
+      .sort(
+        (a, b) => Number(b.isSupportedBackend) - Number(a.isSupportedBackend) || a.id.localeCompare(b.id)
+      );
+
+    // filters by engine type, ex: 'kv'
+    if (this.engineTypeFilters.length > 0) {
+      sortedBackends = sortedBackends.filter((backend) =>
+        this.engineTypeFilters.includes(backend.engineType)
+      );
+    }
+
+    // filters by engine version, ex: 'v1.21.0...'
+    if (this.engineVersionFilters.length > 0) {
+      sortedBackends = sortedBackends.filter((backend) =>
+        this.engineVersionFilters.includes(backend.running_plugin_version)
+      );
+    }
+
+    // if there is search text, filter path name by that
+    if (this.searchText.trim() !== '') {
+      sortedBackends = sortedBackends.filter((backend) =>
+        backend.path.toLowerCase().includes(this.searchText.toLowerCase())
+      );
+    }
+    // no filters, return full sorted list.
+    return sortedBackends;
+  }
+
+  // Returns filter options for engine type dropdown
+  get typeFilterOptions() {
+    // if there is search text, filter types by that
+    if (this.typeSearchText.trim() !== '') {
+      return this.displayableBackends.filter((backend) =>
+        backend.engineType.toLowerCase().includes(this.typeSearchText.toLowerCase())
+      );
+    }
+
+    return this.displayableBackends;
+  }
+
+  // Returns filter options for version dropdown
+  get versionFilterOptions() {
+    // if there is search text, filter versions by that
+    if (this.versionSearchText.trim() !== '') {
+      // filtered by sorted backends array since an engine type filter has to be selected first
+      return this.sortedDisplayableBackends.filter((backend) =>
+        backend.running_plugin_version.toLowerCase().includes(this.versionSearchText.toLowerCase())
+      );
+    }
+    return this.sortedDisplayableBackends;
+  }
+
+  // Returns filtered engines list by type
+  get secretEngineArrayByType() {
+    const arrayOfAllEngineTypes = this.typeFilterOptions.map((modelObject) => modelObject.engineType);
+    // filter out repeated engineTypes (e.g. [kv, kv] => [kv])
+    const arrayOfUniqueEngineTypes = [...new Set(arrayOfAllEngineTypes)];
+
+    return arrayOfUniqueEngineTypes.map((engineType) => ({
+      name: engineType,
+      id: engineType,
+      icon: engineDisplayData(engineType)?.glyph ?? 'lock',
+    }));
+  }
+
+  // Returns filtered engines list by version
+  get secretEngineArrayByVersions() {
+    const arrayOfAllEngineVersions = this.versionFilterOptions.map(
+      (modelObject) => modelObject.running_plugin_version
+    );
+    // filter out repeated engineVersions (e.g. [1.0, 1.0] => [1.0])
+    const arrayOfUniqueEngineVersions = [...new Set(arrayOfAllEngineVersions)];
+    return arrayOfUniqueEngineVersions.map((version) => ({
+      version,
+      id: version,
+    }));
+  }
+
+  generateToolTipText = (backend: SecretsEngineResource) => {
+    const displayData = engineDisplayData(backend.type);
+
+    if (!displayData) {
+      return;
+    } else if (backend.isSupportedBackend) {
+      if (backend.type === 'kv') {
+        // If the backend is a KV engine, include the version in the tooltip.
+        return `${displayData.displayName} version ${backend.version}`;
+      } else {
+        return `${displayData.displayName}`;
+      }
+    } else if (displayData.type === 'unknown') {
+      // If a mounted engine type doesn't match any known type, the type is returned as 'unknown' and set this tooltip.
+      // Handles issue when a user externally mounts an engine that doesn't follow the expected naming conventions for what's in the binary, despite being a valid engine.
+      return `This engine's type is not recognized by the UI. Please use the CLI to manage this engine.`;
+    } else {
+      // If the engine type is recognized but not supported, we only show configuration view and set this tooltip.
+      return 'The UI only supports configuration views for these secret engines. The CLI must be used to manage other engine resources.';
+    }
+  };
+
+  @action
+  setSearchText(type: string, event: Event) {
+    const target = event.target as HTMLInputElement;
+    if (type === 'type') {
+      this.typeSearchText = target.value;
+    } else if (type === 'version') {
+      this.versionSearchText = target.value;
+    } else {
+      this.searchText = target.value;
+    }
+  }
+
+  @action
+  filterByEngineType(type: string) {
+    if (this.engineTypeFilters.includes(type)) {
+      this.engineTypeFilters = this.engineTypeFilters.filter((t) => t !== type);
+    } else {
+      this.engineTypeFilters = [...this.engineTypeFilters, type];
+    }
+  }
+
+  @action
+  filterByEngineVersion(version: string) {
+    if (this.engineVersionFilters.includes(version)) {
+      this.engineVersionFilters = this.engineVersionFilters.filter((v) => v !== version);
+    } else {
+      this.engineVersionFilters = [...this.engineVersionFilters, version];
+    }
+  }
+
+  @action
+  clearAllFilters() {
+    this.engineTypeFilters = [];
+    this.engineVersionFilters = [];
+  }
+
+  @action
+  updateSelectedItems(tableData: { selectedRowsKeys: string[] }) {
+    this.selectedItems = tableData.selectedRowsKeys;
+  }
+
+  async disableSingleEngine(engine: SecretsEngineResource) {
+    const { engineType, id, path } = engine;
+    try {
+      await this.api.sys.mountsDisableSecretsEngine(id);
+      this.flashMessages.success(`The ${engineType} Secrets Engine at ${path} has been disabled.`);
+    } catch (err) {
+      const { message } = await this.api.parseError(err);
+      this.flashMessages.danger(
+        `There was an error disabling the ${engineType} Secrets Engine at ${path}: ${message}.`
+      );
+    }
+  }
+
+  @dropTask
+  *disableMultipleEngines(enginePathsToDisable: Array<string>) {
+    const enginesToDisable = this.displayableBackends.filter((engine: SecretsEngineResource) =>
+      enginePathsToDisable.includes(engine.path)
+    );
+    try {
+      for (const engine of enginesToDisable) {
+        yield this.disableSingleEngine(engine);
+      }
+
+      // Navigate once all operations are complete
+      this.router.transitionTo('vault.cluster.secrets.backends');
+    } finally {
+      this.enginesToDisable = null;
+    }
+  }
+
+  @dropTask
+  *disableEngine(engine: SecretsEngineResource) {
+    try {
+      yield this.disableSingleEngine(engine);
+      this.router.transitionTo('vault.cluster.secrets.backends');
+    } finally {
+      this.engineToDisable = undefined;
+    }
+  }
+}
diff --git a/ui/app/components/secret-engine/page/general-settings.hbs b/ui/app/components/secret-engine/page/general-settings.hbs
new file mode 100644
index 00000000000..133984b6694
--- /dev/null
+++ b/ui/app/components/secret-engine/page/general-settings.hbs
@@ -0,0 +1,70 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+{{#let (engines-display-data @model.secretsEngine.type) as |engineDisplayData|}}
+  <Page::Header
+    @title="{{@model.secretsEngine.id}} configuration"
+    @description={{engineDisplayData.displayName}}
+    @icon={{engineDisplayData.glyph}}
+    @subtitle={{engineDisplayData.typeDisplay}}
+  >
+    <:breadcrumbs>
+      <Page::Breadcrumbs @breadcrumbs={{@breadcrumbs}} />
+    </:breadcrumbs>
+    <:tabs>
+      <SecretEngine::ConfigureTabs @config={{@model.config}} @secretsEngine={{@model.secretsEngine}} />
+    </:tabs>
+  </Page::Header>
+{{/let}}
+
+{{#if this.saveGeneralSettings.isRunning}}
+  {{! TODO: Fix loading state styles }}
+  <Hds::Layout::Flex @gap="24" @direction="column" @justify="center" @align="center">
+    <div class="one-fourth-width">
+      <Hds::Icon @name="loading-static" @size="24" @stretched={{true}} />
+    </div>
+    <Hds::Text::Display @tag="h2">Saving configuration...</Hds::Text::Display>
+  </Hds::Layout::Flex>
+{{else}}
+  <form
+    method="POST"
+    {{on "submit" (perform this.saveGeneralSettings)}}
+    aria-label="general settings form"
+    id="general-settings-form"
+  >
+    <Hds::Text::Body class="has-top-bottom-margin-xxs">
+      Mount parameters that you can tune to fit required engine behavior.
+    </Hds::Text::Body>
+
+    <MessageError @errorMessage={{this.errorMessage}} @errors={{this.errors}} />
+
+    <Hds::Layout::Grid @columnMinWidth="32%" @gap="32" as |LG|>
+      <LG.Item @colspan={{1}}>
+        <SecretEngine::Card::Version @model={{@model}} class="is-fullwidth" />
+        <SecretEngine::Card::Metadata @model={{@model}} class="is-fullwidth" />
+      </LG.Item>
+      <LG.Item @colspan={{1}}>
+        <SecretEngine::Card::SecretsDuration
+          @model={{@model}}
+          @defaultLeaseUnit={{this.defaultLeaseUnit}}
+          @maxLeaseUnit={{this.maxLeaseUnit}}
+          class="is-fullwidth"
+        />
+        <SecretEngine::Card::Security @model={{@model}} class="is-fullwidth" />
+      </LG.Item>
+    </Hds::Layout::Grid>
+    <div class="field is-grouped has-top-bottom-margin">
+      <Hds::ButtonSet>
+        <Hds::Button @text="Save changes" type="submit" disabled={{this.saveGeneralSettings.isRunning}} data-test-submit />
+        <Hds::Button @text="Discard" @color="secondary" {{on "click" this.discardChanges}} data-test-cancel />
+      </Hds::ButtonSet>
+    </div>
+  </form>
+{{/if}}
+
+<UnsavedChangesModal
+  @onSave={{this.saveGeneralSettings}}
+  @onDiscard={{this.discardChanges}}
+  @changedFields={{this.modalChangedFields}}
+/>
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/page/general-settings.ts b/ui/app/components/secret-engine/page/general-settings.ts
new file mode 100644
index 00000000000..80f56e1e416
--- /dev/null
+++ b/ui/app/components/secret-engine/page/general-settings.ts
@@ -0,0 +1,188 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { task } from 'ember-concurrency';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { convertToSeconds } from 'core/utils/duration-utils';
+import { action } from '@ember/object';
+
+import type Router from '@ember/routing/router';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type ApiService from 'vault/services/api';
+import type SecretsEngineResource from 'vault/resources/secrets/engine';
+import type UnsavedChangesService from 'vault/services/unsaved-changes';
+
+const CHARACTER_LIMIT = 500;
+
+/**
+ * @module GeneralSettingsComponent is used to configure the SSH secret engine.
+ *
+ * @example
+ * ```js
+ * <Secrets:Page:GeneralSettings
+ *    @model={{this.model}}
+ *  />
+ * ```
+ *
+ * @param {string} secretsEngine - secrets engine resource
+ * @param {string} versions - list of versions for a given secret engine
+ */
+
+interface Args {
+  model: {
+    secretsEngine: SecretsEngineResource;
+    versions: string[];
+  };
+}
+
+export default class GeneralSettingsComponent extends Component<Args> {
+  @service declare readonly router: Router;
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly unsavedChanges: UnsavedChangesService;
+
+  @tracked errorMessage: string | string[] | null = null;
+  @tracked errors: string[] = [];
+  @tracked invalidFormAlert: string | null = null;
+  @tracked showUnsavedChangesModal = false;
+
+  @tracked defaultLeaseUnit = '';
+  @tracked maxLeaseUnit = '';
+
+  originalModel = JSON.parse(JSON.stringify(this.args.model));
+
+  get modalChangedFields() {
+    const changedFieldsCopy = [...this.unsavedChanges.changedFields];
+    const configIndex = this.unsavedChanges.changedFields.indexOf('config');
+
+    if (configIndex === -1) return this.unsavedChanges.changedFields;
+
+    changedFieldsCopy[configIndex] = 'Secrets duration';
+
+    return changedFieldsCopy;
+  }
+
+  validateTtl(ttlValue: FormDataEntryValue | number | null) {
+    if (isNaN(Number(ttlValue))) {
+      return false;
+    }
+
+    return true;
+  }
+
+  validateDescription(description: FormDataEntryValue | string) {
+    return description?.toString().length <= CHARACTER_LIMIT;
+  }
+
+  validateForm() {
+    const { defaultLeaseTime, maxLeaseTime, description } = this.formData;
+
+    const errorMessages = [];
+
+    if (!this.validateTtl(defaultLeaseTime) || !this.validateTtl(maxLeaseTime)) {
+      errorMessages.push('TTL should only contain numbers.');
+    }
+
+    if (description && !this.validateDescription(description)) {
+      const charactersExceedBy = description?.toString().length - CHARACTER_LIMIT;
+      errorMessages.push(`Engine description exceeds character limit by ${charactersExceedBy}.`);
+    }
+
+    this.errors = errorMessages;
+
+    if (errorMessages.length) return false;
+    return true;
+  }
+
+  hasTtlValueChanged(ttlTime: number, ttlUnit: string, ttlKey: 'max_lease_ttl' | 'default_lease_ttl') {
+    const defaultLeaseInSecs = convertToSeconds(ttlTime, ttlUnit);
+    if (defaultLeaseInSecs === this?.originalModel?.secretsEngine?.config[ttlKey]) {
+      return false;
+    }
+
+    return true;
+  }
+
+  get formData() {
+    const form = document.getElementById('general-settings-form');
+    const fd = new FormData(form as HTMLFormElement);
+    const fdDefaultLeaseTime = Number(fd.get('default_lease_ttl-time'));
+    const fdDefaultLeaseUnit = fd.get('default_lease_ttl-unit')?.toString() || 's';
+    const fdMaxLeaseTime = Number(fd.get('max_lease_ttl-time'));
+    const fdMaxLeaseUnit = fd.get('max_lease_ttl-unit')?.toString() || 's';
+
+    return {
+      defaultLeaseTime: fdDefaultLeaseTime,
+      defaultLeaseUnit: fdDefaultLeaseUnit,
+      maxLeaseTime: fdMaxLeaseTime,
+      maxLeaseUnit: fdMaxLeaseUnit,
+      description: fd.get('description'),
+      version: fd.get('plugin-version'),
+    };
+  }
+
+  formatTuneParams() {
+    const { defaultLeaseTime, defaultLeaseUnit, maxLeaseTime, maxLeaseUnit, description, version } =
+      this.formData;
+
+    const hasDefaultTtlValueChanged = this.hasTtlValueChanged(
+      defaultLeaseTime,
+      defaultLeaseUnit,
+      'default_lease_ttl'
+    );
+
+    const hasMaxTtlValueChanged = this.hasTtlValueChanged(maxLeaseTime, maxLeaseUnit, 'max_lease_ttl');
+    const hasDescriptionChanged = description !== this?.originalModel?.secretsEngine?.description;
+    const hasPluginVersionChanged =
+      version && version !== this?.originalModel?.secretsEngine?.running_plugin_version;
+
+    const defaultLeaseTtl = hasDefaultTtlValueChanged ? `${defaultLeaseTime}${defaultLeaseUnit}` : undefined;
+    const maxLeaseTtl = hasMaxTtlValueChanged ? `${maxLeaseTime}${maxLeaseUnit}` : undefined;
+    const pluginVersion = hasPluginVersionChanged ? version : undefined;
+    const pluginDescription = hasDescriptionChanged ? description : undefined;
+
+    return {
+      defaultLeaseTtl,
+      maxLeaseTtl,
+      pluginVersion,
+      pluginDescription,
+    };
+  }
+
+  saveGeneralSettings = task(async (event?) => {
+    // event is an optional arg because saveGeneralSettings can be called in the closeAndHandle function.
+    // There are instances where we will save in the modal where that doesn't require an event.
+    if (event) event.preventDefault();
+
+    if (!this.validateForm()) return;
+
+    try {
+      const { defaultLeaseTtl, maxLeaseTtl, pluginVersion, pluginDescription } = this.formatTuneParams();
+
+      await this.api.sys.mountsTuneConfigurationParameters(this.args?.model?.secretsEngine?.id, {
+        description: pluginDescription as string | undefined,
+        default_lease_ttl: defaultLeaseTtl,
+        max_lease_ttl: maxLeaseTtl,
+        plugin_version: pluginVersion as string | undefined,
+      });
+
+      this.flashMessages.success('Engine settings successfully updated.', { title: 'Configuration saved' });
+
+      this.unsavedChanges.showModal = false;
+      this.router.transitionTo(this.router.currentRouteName);
+    } catch (e) {
+      const { message } = await this.api.parseError(e);
+      this.errorMessage = message;
+    }
+  });
+
+  @action
+  discardChanges() {
+    const currentRouteName = this.router.currentRouteName;
+    this.router.transitionTo(currentRouteName);
+  }
+}
diff --git a/ui/app/components/secret-engine/page/plugin-settings.hbs b/ui/app/components/secret-engine/page/plugin-settings.hbs
new file mode 100644
index 00000000000..d663e1314ae
--- /dev/null
+++ b/ui/app/components/secret-engine/page/plugin-settings.hbs
@@ -0,0 +1,76 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#let (engines-display-data @model.secretsEngine.type) as |engineDisplayData|}}
+  <Page::Header
+    @title="{{@model.secretsEngine.id}} configuration"
+    @description={{engineDisplayData.displayName}}
+    @icon={{engineDisplayData.glyph}}
+    @subtitle={{engineDisplayData.typeDisplay}}
+  >
+    <:breadcrumbs>
+      <Page::Breadcrumbs @breadcrumbs={{@breadcrumbs}} />
+    </:breadcrumbs>
+    <:tabs>
+      <SecretEngine::ConfigureTabs @secretsEngine={{@model.secretsEngine}} />
+    </:tabs>
+  </Page::Header>
+{{/let}}
+
+{{#if @model.config}}
+  {{#each this.displayFields as |field|}}
+    {{! public key while not sensitive when editing/creating, should be hidden by default on viewing }}
+    {{#if (eq field "public_key")}}
+      <InfoTableRow @label="Public key" @value={{@model.config.public_key}}>
+        <MaskedInput @value={{@model.config.public_key}} @name={{field}} @displayOnly={{true}} @allowCopy={{true}} />
+      </InfoTableRow>
+    {{else}}
+      <InfoTableRow
+        @alwaysRender={{not (is-empty-value (get @model.config field))}}
+        @label={{this.label field}}
+        @value={{get @model.config field}}
+        @formatTtl={{this.isDuration field}}
+      />
+    {{/if}}
+  {{/each}}
+{{else}}
+  {{#if (get (engines-display-data @model.secretsEngine.type) "isConfigurable")}}
+    {{! Prompt user to configure the secret engine }}
+    <EmptyState
+      data-test-config-cta
+      @title="{{get (engines-display-data @model.secretsEngine.type) 'displayName'}} not configured"
+      @message="Get started by configuring your {{get
+        (engines-display-data @model.secretsEngine.type)
+        'displayName'
+      }} secrets engine."
+    >
+      <Hds::Link::Standalone
+        @icon="chevron-right"
+        @iconPosition="trailing"
+        @text="Configure {{get (engines-display-data @model.secretsEngine.type) 'displayName'}}"
+        @route="vault.cluster.secrets.backend.configuration.edit"
+        @model={{@id}}
+      />
+    </EmptyState>
+
+  {{else}}
+    <EmptyState
+      data-test-no-config
+      @title="No configuration details available"
+      @message="{{get
+        (engines-display-data @model.secretsEngine.type)
+        'displayName'
+      }} does not have any plugin specific configuration. All configurable parameters for this engine are under 'General Settings'."
+    >
+      <Hds::Link::Standalone
+        @icon="chevron-right"
+        @iconPosition="trailing"
+        @text="Back to general settings"
+        @route="vault.cluster.secrets.backend.configuration.general-settings"
+        @model={{@id}}
+      />
+    </EmptyState>
+  {{/if}}
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/page/plugin-settings.ts b/ui/app/components/secret-engine/page/plugin-settings.ts
new file mode 100644
index 00000000000..48a61d1ad51
--- /dev/null
+++ b/ui/app/components/secret-engine/page/plugin-settings.ts
@@ -0,0 +1,107 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { toLabel } from 'core/helpers/to-label';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+import SecretsEngineResource from 'vault/resources/secrets/engine';
+
+/**
+ * @module PluginSettingsComponent is used to configure extended plugin level settings for secrets engines.
+ *
+ * @example
+ * ```js
+ * <Secrets:Page:PluginSettings
+ *    @model={{this.model}}
+ *  />
+ * ```
+ *
+ * @param {string} secretsEngine - secrets engine resource
+ */
+
+interface Args {
+  model: {
+    secretsEngine: SecretsEngineResource;
+  };
+}
+
+export default class PluginSettingsComponent extends Component<Args> {
+  awsFields = [
+    'role_arn',
+    'identity_token_audience',
+    'identity_token_ttl',
+    'access_key',
+    'region',
+    'iam_endpoint',
+    'sts_endpoint',
+    'max_retries',
+    'lease',
+    'lease_max',
+    'issuer',
+  ];
+
+  azureFields = [
+    'subscription_id',
+    'tenant_id',
+    'client_id',
+    'identity_token_audience',
+    'identity_token_ttl',
+    'root_password_ttl',
+    'environment',
+    'issuer',
+  ];
+
+  gcpFields = [
+    'service_account_email',
+    'ttl',
+    'max_ttl',
+    'identity_token_audience',
+    'identity_token_ttl',
+    'issuer',
+  ];
+
+  sshFields = ['public_key', 'generate_signing_key'];
+
+  get displayFields() {
+    switch (engineDisplayData(this.args.model.secretsEngine.type)?.displayName) {
+      case 'AWS':
+        return this.awsFields;
+      case 'Azure':
+        return this.azureFields;
+      case 'Google Cloud':
+        return this.gcpFields;
+      case 'SSH':
+        return this.sshFields;
+      default:
+        return [];
+    }
+  }
+
+  label = (field: string) => {
+    const label = toLabel([field]);
+    // convert words like id and ttl to uppercase
+    const formattedLabel = label
+      .split(' ')
+      .map((word: string) => {
+        const acronyms = ['id', 'ttl', 'arn', 'iam', 'sts'];
+        return acronyms.includes(word.toLowerCase()) ? word.toUpperCase() : word;
+      })
+      .join(' ');
+    // map specific fields to custom labels
+    return (
+      {
+        lease: 'Default Lease TTL',
+        lease_max: 'Max Lease TTL',
+        ttl: 'Config TTL',
+      }[field] || formattedLabel
+    );
+  };
+
+  isDuration = (field: string) => {
+    return ['identity_token_ttl', 'root_password_ttl', 'lease', 'lease_max', 'ttl', 'max_ttl'].includes(
+      field
+    );
+  };
+}
diff --git a/ui/app/components/secret-engine/ttl-picker-v2.hbs b/ui/app/components/secret-engine/ttl-picker-v2.hbs
new file mode 100644
index 00000000000..53a552e0d8d
--- /dev/null
+++ b/ui/app/components/secret-engine/ttl-picker-v2.hbs
@@ -0,0 +1,40 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Form::Field @layout="vertical" @isInvalid={{this.errorMessage}} data-test-ttl-picker-v2 as |F|>
+  <F.Label data-test-form-field-label={{@ttlKey}}>{{this.formField.label}}</F.Label>
+  <F.HelperText data-test-help-text={{@ttlKey}}>{{this.formField.helperText}}</F.HelperText>
+  <F.Control>
+    <Hds::SegmentedGroup as |SG|>
+      <SG.TextInput
+        @width="100px"
+        size="32"
+        @value={{this.time}}
+        {{on "input" this.setTtlTime}}
+        name="{{@ttlKey}}-time"
+        aria-label={{concat this.formField.label "time"}}
+        autocomplete="off"
+        data-test-input={{@ttlKey}}
+      />
+      <SG.Select
+        @width="100px"
+        name="{{@ttlKey}}-unit"
+        {{on "input" this.setUnit}}
+        aria-label={{concat this.formField.label "unit"}}
+        data-test-select={{@ttlKey}}
+        as |S|
+      >
+        <S.Options>
+          {{#each this.unitOptions as |unit|}}
+            <option value={{unit.value}} selected={{eq unit.value this.selectedUnit}}>{{unit.label}}</option>
+          {{/each}}
+        </S.Options>
+      </SG.Select>
+    </Hds::SegmentedGroup>
+  </F.Control>
+  {{#if this.errorMessage}}
+    <F.Error data-test-message-error>{{this.errorMessage}}</F.Error>
+  {{/if}}
+</Hds::Form::Field>
\ No newline at end of file
diff --git a/ui/app/components/secret-engine/ttl-picker-v2.ts b/ui/app/components/secret-engine/ttl-picker-v2.ts
new file mode 100644
index 00000000000..233dbc30081
--- /dev/null
+++ b/ui/app/components/secret-engine/ttl-picker-v2.ts
@@ -0,0 +1,118 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { convertFromSeconds, durationToSeconds, largestUnitFromSeconds } from 'core/utils/duration-utils';
+
+import type FlashMessageService from 'vault/services/flash-messages';
+import type SecretsEngineResource from 'vault/resources/secrets/engine';
+import type ApiService from 'vault/services/api';
+import type RouterService from '@ember/routing/router-service';
+import type { HTMLElementEvent } from 'vault/forms';
+
+/**
+ * @module TtlPickerV2 handles the display of the ttl picker fo the lease duration card in general settings.
+ * 
+ * @example
+ * <SecretEngine::TtlPickerV2
+    @model={{this.model}}
+    @isDefaultTtlPicker={{boolean}}
+    />
+ *
+ * @param {object} model - A model contains a secret engine resource, lease config from the sys/internal endpoint.
+ * @param {boolean} isDefaultTtlPicker - isDefaultTtlPicker is a boolean that determines if the picker is default or max ttl.
+ */
+
+interface Args {
+  model: {
+    secretsEngine: SecretsEngineResource;
+  };
+  initialUnit: string;
+  ttlKey: 'default_lease_ttl' | 'max_lease_ttl';
+}
+
+export default class TtlPickerV2 extends Component<Args> {
+  systemDefaultTtl = 0;
+
+  @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly api: ApiService;
+  @service declare readonly router: RouterService;
+
+  @tracked selectedUnit = 's';
+  @tracked time = '';
+  @tracked errorMessage = '';
+
+  constructor(owner: unknown, args: Args) {
+    super(owner, args);
+
+    this.initializeTtl();
+  }
+
+  initializeTtl() {
+    const ttlValue = this.args?.model?.secretsEngine?.config[this.args.ttlKey];
+
+    let seconds = 0;
+
+    if (typeof ttlValue === 'number') {
+      // if the passed value is a number, assume unit is seconds
+      seconds = ttlValue;
+    } else {
+      const parseDuration = durationToSeconds(ttlValue || '');
+      // if parsing fails leave it empty
+      if (parseDuration === null) {
+        this.time = ttlValue || '';
+        this.selectedUnit = this.args.initialUnit;
+        return;
+      }
+      seconds = parseDuration;
+    }
+
+    const unit = largestUnitFromSeconds(seconds);
+    const time = convertFromSeconds(seconds, unit);
+    this.time = time.toString() || '';
+    this.selectedUnit = unit;
+  }
+
+  get unitOptions() {
+    return [
+      { label: 'seconds', value: 's' },
+      { label: 'minutes', value: 'm' },
+      { label: 'hours', value: 'h' },
+      { label: 'days', value: 'd' },
+    ];
+  }
+
+  get formField() {
+    return {
+      label:
+        this.args?.ttlKey === 'default_lease_ttl'
+          ? 'Default time-to-live (TTL)'
+          : 'Maximum time-to-live (TTL)',
+      helperText:
+        this.args?.ttlKey === 'default_lease_ttl'
+          ? 'How long secrets in this engine stay valid.'
+          : 'Maximum extension for the secrets life beyond default.',
+    };
+  }
+
+  @action
+  setTtlTime(event: HTMLElementEvent<HTMLInputElement>) {
+    this.errorMessage = '';
+    if (isNaN(Number(event.target.value))) {
+      this.errorMessage = 'Only use numbers for this setting.';
+      return;
+    }
+    this.time = event.target.value;
+    this.args.model.secretsEngine.config[this.args.ttlKey] = event.target.value;
+  }
+
+  @action
+  setUnit(event: HTMLElementEvent<HTMLSelectElement>) {
+    this.selectedUnit = event.target.value;
+  }
+}
diff --git a/ui/app/components/secret-engines/catalog.hbs b/ui/app/components/secret-engines/catalog.hbs
new file mode 100644
index 00000000000..5b1c4127090
--- /dev/null
+++ b/ui/app/components/secret-engines/catalog.hbs
@@ -0,0 +1,77 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::PageHeader class="page-header" as |PH|>
+  <PH.Breadcrumb>
+    <Hds::Breadcrumb data-test-breadcrumbs>
+      <Hds::Breadcrumb::Item @text="Secrets engines" @route="vault.cluster.secrets.backends" />
+      <Hds::Breadcrumb::Item @text="Enable secrets engine" @current={{true}} />
+    </Hds::Breadcrumb>
+  </PH.Breadcrumb>
+</Hds::PageHeader>
+
+{{#if @pluginCatalogError}}
+  <div class="has-bottom-padding-m">
+    <Hds::Alert @type="inline" @color="warning" data-test-inline-alert as |A|>
+      <A.Title>Plugin information unavailable</A.Title>
+      <A.Description>
+        Unable to fetch current plugin information. Using static plugin data instead. Some plugins may not show current
+        details.
+      </A.Description>
+    </Hds::Alert>
+  </div>
+{{/if}}
+
+{{#each this.pluginCategoriesList as |category|}}
+  {{#let (this.getMountTypesByCategory category) as |categorized|}}
+    {{! Only display the category if it has any enabled or disabled plugins }}
+    {{#if (or categorized.enabled.length categorized.disabled.length)}}
+      <div class="has-top-padding-m has-bottom-padding-s">
+        <Hds::Text::Display @tag="h2" size="400" class="is-flex align-items-center">
+          {{capitalize category}}
+          {{#if (eq category "external")}}
+            <Hds::Button
+              @text=""
+              @color="tertiary"
+              @icon="info"
+              @size="small"
+              @isIconOnly={{true}}
+              @ariaLabel="Information about external plugins"
+              class="has-left-margin-xs"
+              {{on "click" this.openExternalPluginsHelp}}
+            />
+          {{/if}}
+        </Hds::Text::Display>
+      </div>
+      <div class="flex row-wrap row-gap-16 column-gap-16 has-bottom-padding-m">
+        {{! Enabled plugins }}
+        {{#each categorized.enabled as |type|}}
+          <EnabledPluginCard @type={{type}} @setMountType={{@setMountType}} />
+        {{/each}}
+
+        {{! Vertical separator if both enabled and disabled plugins exist }}
+        {{#if (and categorized.enabled.length categorized.disabled.length)}}
+          <div class="selectable-engines-vertical-divider has-top-bottom-margin-12"></div>
+        {{/if}}
+
+        {{! Disabled plugins }}
+        {{#each categorized.disabled as |type|}}
+          <DisabledPluginCard
+            @type={{type}}
+            @handleDisabledPluginClick={{this.handleDisabledPluginClick}}
+            @handleDisabledPluginKeyDown={{this.handleDisabledPluginKeyDown}}
+          />
+        {{/each}}
+      </div>
+    {{/if}}
+  {{/let}}
+{{/each}}
+
+<PluginDocumentationFlyout
+  @isOpen={{this.showFlyout}}
+  @plugin={{this.flyoutPlugin}}
+  @pluginType={{this.flyoutPluginType}}
+  @onClose={{this.closeFlyout}}
+/>
\ No newline at end of file
diff --git a/ui/app/components/secret-engines/catalog.ts b/ui/app/components/secret-engines/catalog.ts
new file mode 100644
index 00000000000..736c5a22ae8
--- /dev/null
+++ b/ui/app/components/secret-engines/catalog.ts
@@ -0,0 +1,130 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import { filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
+import {
+  enhanceEnginesWithCatalogData,
+  categorizeEnginesByStatus,
+  MOUNT_CATEGORIES,
+  PLUGIN_TYPES,
+  PLUGIN_CATEGORIES,
+} from 'vault/utils/plugin-catalog-helpers';
+import type { PluginCatalogData } from 'vault/services/plugin-catalog';
+
+import type VersionService from 'vault/services/version';
+
+/**
+ * @module SecretEnginesCatalog
+ * SecretEnginesCatalog component displays available secret engines in a catalog view
+ * for selection when mounting a new secret engine.
+ *
+ * @example
+ * ```js
+ * <SecretEngines::Catalog @setMountType={{this.setMountType}} @pluginCatalogData={{this.pluginCatalogData}} @pluginCatalogError={{this.pluginCatalogError}} />
+ * ```
+ */
+
+interface Args {
+  setMountType: (type: string) => void;
+  pluginCatalogData?: PluginCatalogData;
+  pluginCatalogError?: boolean;
+}
+
+export default class SecretEnginesCatalogComponent extends Component<Args> {
+  @service declare version: VersionService;
+
+  @tracked showFlyout = false;
+  @tracked flyoutPlugin: unknown = null;
+  @tracked flyoutPluginType: string | null = null;
+
+  get secretEngines() {
+    // If an enterprise license is present, return all secret engines;
+    // otherwise, return only the secret engines supported in OSS.
+    const staticEngines = filterEnginesByMountCategory({
+      mountCategory: MOUNT_CATEGORIES.SECRET,
+      isEnterprise: !!this.version?.isEnterprise,
+    });
+
+    // If we have plugin catalog data, merge it with static engines to add catalog info
+    if (this.args.pluginCatalogData) {
+      const secretEnginesDetailed =
+        this.args.pluginCatalogData.detailed?.filter((plugin) => plugin?.type === PLUGIN_TYPES.SECRET) || [];
+      const databasePluginsDetailed =
+        this.args.pluginCatalogData.detailed?.filter((plugin) => plugin?.type === PLUGIN_TYPES.DATABASE) ||
+        [];
+
+      return enhanceEnginesWithCatalogData(staticEngines, secretEnginesDetailed, databasePluginsDetailed);
+    }
+
+    return staticEngines;
+  }
+
+  get pluginCategoriesList() {
+    return [
+      PLUGIN_CATEGORIES.GENERIC,
+      PLUGIN_CATEGORIES.CLOUD,
+      PLUGIN_CATEGORIES.INFRA,
+
+      // TODO: enable external plugins once version selection is available (VAULT-39241)
+      // PLUGIN_CATEGORIES.EXTERNAL,
+    ];
+  }
+
+  get secretMountCategory() {
+    return MOUNT_CATEGORIES.SECRET;
+  }
+
+  @action
+  getMountTypesByCategory(category: string) {
+    try {
+      const mountTypes = this.secretEngines;
+      if (!mountTypes || !Array.isArray(mountTypes)) {
+        return { enabled: [], disabled: [] };
+      }
+
+      const allTypes = mountTypes.filter((type: unknown) => {
+        const engineType = type as { pluginCategory?: string };
+        return engineType?.pluginCategory === category;
+      });
+      return categorizeEnginesByStatus(allTypes);
+    } catch (error) {
+      return { enabled: [], disabled: [] };
+    }
+  }
+
+  @action
+  handleDisabledPluginClick(plugin: unknown) {
+    this.showFlyout = true;
+    this.flyoutPlugin = plugin;
+    this.flyoutPluginType = 'secret';
+  }
+
+  @action
+  handleDisabledPluginKeyDown(plugin: unknown, event: KeyboardEvent) {
+    // Only handle Enter and Space keys for accessibility
+    if (event.key === 'Enter' || event.key === ' ') {
+      event.preventDefault();
+      this.handleDisabledPluginClick(plugin);
+    }
+  }
+
+  @action
+  openExternalPluginsHelp() {
+    this.showFlyout = true;
+    this.flyoutPlugin = null;
+    this.flyoutPluginType = 'secret';
+  }
+
+  @action
+  closeFlyout() {
+    this.showFlyout = false;
+    this.flyoutPlugin = null;
+    this.flyoutPluginType = null;
+  }
+}
diff --git a/ui/app/templates/components/secret-form-show.hbs b/ui/app/components/secret-form-show.hbs
similarity index 88%
rename from ui/app/templates/components/secret-form-show.hbs
rename to ui/app/components/secret-form-show.hbs
index a9b960703ba..f4c4e3e21b0 100644
--- a/ui/app/templates/components/secret-form-show.hbs
+++ b/ui/app/components/secret-form-show.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @isWriteWithoutRead}}
   <EmptyState
@@ -12,7 +12,7 @@
 {{else}}
   {{#if @showAdvancedMode}}
     <div class="has-top-margin-s">
-      <JsonEditor @title="Secret Data" @value={{@modelForData.dataAsJSONString}} @readOnly={{true}} />
+      <JsonEditor @title="Secret Data" @value={{or (stringify @modelForData.secretData) " "}} @readOnly={{true}} />
     </div>
   {{else}}
     <div class="info-table-row-header">
diff --git a/ui/app/templates/components/secret-link.hbs b/ui/app/components/secret-link.hbs
similarity index 83%
rename from ui/app/templates/components/secret-link.hbs
rename to ui/app/components/secret-link.hbs
index a51541bea26..89f1e87e124 100644
--- a/ui/app/templates/components/secret-link.hbs
+++ b/ui/app/components/secret-link.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LinkTo @route={{this.link.route}} @models={{this.link.models}} @query={{this.query}} @disabled={{@disabled}} ...attributes>
   {{yield}}
diff --git a/ui/app/components/secret-link.js b/ui/app/components/secret-link.js
index 06f70779862..2031f9034ab 100644
--- a/ui/app/components/secret-link.js
+++ b/ui/app/components/secret-link.js
@@ -1,20 +1,46 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { action } from '@ember/object';
 import { encodePath } from 'vault/utils/path-encoding-helpers';
+import { debug } from '@ember/debug';
 
+/**
+ * @module SecretLink
+ *
+ * @example
+ * ```js
+ * <SecretLink
+ *   @mode="edit"
+ *   @backend="backend-path"
+ *   @secret="my/secret path"
+ *   @queryParams={{hash tab="version"}}
+ *   @disabled={{true}}
+ * />
+ *
+ * @param {string} mode - *required* controls the route link. added to the base route vault.cluster.secrets.backend
+ * @param {string} backend - *required* backend path. Is encoded in the component
+ * @param {string} secret - secret path. Is encoded in the component
+ * @param {object} queryParams - params passed to the link
+ * @param {boolean} disabled - passed to LinkTo to disable link
+ * @param {CallableFunction} onLinkClick - side effect when link is clicked
+ */
 export default class SecretLink extends Component {
   get link() {
-    const { mode, secret } = this.args;
+    const { mode, secret, backend } = this.args;
+    if (!backend) {
+      debug(`Arg "backend" missing from secret-link with mode: ${mode} secret: ${secret}`);
+    }
     const route = `vault.cluster.secrets.backend.${mode}`;
+    const models = backend ? [encodePath(backend)] : [];
     if ((mode !== 'versions' && !secret) || secret === ' ') {
-      return { route: `${route}-root`, models: [] };
+      return { route: `${route}-root`, models };
     } else {
-      return { route, models: [encodePath(secret)] };
+      models.push(encodePath(secret));
+      return { route, models };
     }
   }
   get query() {
diff --git a/ui/app/templates/components/secret-list/aws-role-item.hbs b/ui/app/components/secret-list/aws-role-item.hbs
similarity index 91%
rename from ui/app/templates/components/secret-list/aws-role-item.hbs
rename to ui/app/components/secret-list/aws-role-item.hbs
index a995f16e4f1..404874a43f9 100644
--- a/ui/app/templates/components/secret-list/aws-role-item.hbs
+++ b/ui/app/components/secret-list/aws-role-item.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LinkedBlock
   @params={{array (concat "vault.cluster.secrets.backend." "credentials" (unless @item.id "-root")) @item.id}}
@@ -36,11 +36,10 @@
           </dd.Generic>
         {{else if @item.canGenerate}}
           <dd.Interactive
-            @text="Generate credentials"
             @route="vault.cluster.secrets.backend.credentials"
             @model={{@item.id}}
             data-test-role-aws-link="generate"
-          />
+          >Generate credentials</dd.Interactive>
         {{/if}}
         {{#if @item.updatePath.isPending}}
           <dd.Generic class="has-text-center">
@@ -49,27 +48,24 @@
         {{else}}
           {{#if @item.canRead}}
             <dd.Interactive
-              @text="Details"
               @route="vault.cluster.secrets.backend.show"
               @model={{@item.id}}
               data-test-role-ssh-link="show"
-            />
+            >Details</dd.Interactive>
           {{/if}}
           {{#if @item.canEdit}}
             <dd.Interactive
-              @text="Edit"
               @route="vault.cluster.secrets.backend.edit"
               @model={{@item.id}}
               data-test-role-ssh-link="edit"
-            />
+            >Edit</dd.Interactive>
           {{/if}}
           {{#if @item.canDelete}}
             <dd.Interactive
-              @text="Delete"
               @color="critical"
               {{on "click" (fn (mut this.showConfirmModal) true)}}
               data-test-aws-role-delete={{@item.id}}
-            />
+            >Delete</dd.Interactive>
           {{/if}}
         {{/if}}
       </Hds::Dropdown>
diff --git a/ui/app/components/secret-list/aws-role-item.js b/ui/app/components/secret-list/aws-role-item.js
index cd95580a36b..516ccf318f3 100644
--- a/ui/app/components/secret-list/aws-role-item.js
+++ b/ui/app/components/secret-list/aws-role-item.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/secret-list/database-list-item.hbs b/ui/app/components/secret-list/database-list-item.hbs
similarity index 80%
rename from ui/app/templates/components/secret-list/database-list-item.hbs
rename to ui/app/components/secret-list/database-list-item.hbs
index 409429dfd3a..a962e6ee3fa 100644
--- a/ui/app/templates/components/secret-list/database-list-item.hbs
+++ b/ui/app/components/secret-list/database-list-item.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LinkedBlock
   @params={{array "vault.cluster.secrets.backend.show" (if this.keyTypeValue (concat "role/" @item.id) @item.id)}}
@@ -21,7 +21,9 @@
         <Icon @name="user" class="has-text-grey-light is-pulled-left" />
         <div class="role-item-details">
           <span class="is-underline">{{if (eq @item.id " ") "(self)" (or @item.keyWithoutParent @item.id)}}</span>
-          <span class="tag has-text-grey-dark">{{this.keyTypeValue}}</span>
+          {{#if this.keyTypeValue}}
+            <Hds::Badge @text={{this.keyTypeValue}} />
+          {{/if}}
         </div>
       </LinkTo>
     </div>
@@ -34,46 +36,41 @@
           data-test-popup-menu-trigger
         />
         {{#if @item.canEdit}}
-          <dd.Interactive @text="Edit connection" @route="vault.cluster.secrets.backend.edit" @model={{@item.id}} />
+          <dd.Interactive @route="vault.cluster.secrets.backend.edit" @model={{@item.id}}>Edit connection</dd.Interactive>
         {{/if}}
         {{#if @item.canEditRole}}
-          <dd.Interactive @text="Edit Role" @route="vault.cluster.secrets.backend.edit" @model={{concat "role/" @item.id}} />
+          <dd.Interactive @route="vault.cluster.secrets.backend.edit" @model={{concat "role/" @item.id}}>Edit Role</dd.Interactive>
         {{/if}}
         {{#if @item.canReset}}
           <dd.Interactive
-            @text="Reset connection"
             @icon={{if (eq this.actionRunning "reset") "loading"}}
             {{on "click" (fn this.resetConnection @item.id)}}
-          />
+          >Reset connection</dd.Interactive>
         {{/if}}
         {{#if (and (eq @item.type "dynamic") @item.canGenerateCredentials)}}
           <dd.Interactive
-            @text="Generate credentials"
             @route="vault.cluster.secrets.backend.credentials"
             @model={{@item.id}}
             @query={{hash roleType=this.keyTypeValue}}
-          />
+          >Generate credentials</dd.Interactive>
         {{else if (and (eq @item.type "static") @item.canGetCredentials)}}
           <dd.Interactive
-            @text="Get credentials"
             @route="vault.cluster.secrets.backend.credentials"
             @model={{@item.id}}
             @query={{hash roleType=this.keyTypeValue}}
-          />
+          >Get credentials</dd.Interactive>
         {{/if}}
         {{#if (and @item.canRotateRoleCredentials (eq this.keyTypeValue "static"))}}
           <dd.Interactive
-            @text="Rotate credentials"
             @icon={{if (eq this.actionRunning "rotateRole") "loading"}}
             {{on "click" (fn this.rotateRoleCred @item.id)}}
-          />
+          >Rotate credentials</dd.Interactive>
         {{/if}}
         {{#if @item.canRotateRoot}}
           <dd.Interactive
-            @text="Rotate root credentials"
             @icon={{if (eq this.actionRunning "rotateRoot") "loading"}}
             {{on "click" (fn this.rotateRootCred @item.id)}}
-          />
+          >Rotate root credentials</dd.Interactive>
         {{/if}}
       </Hds::Dropdown>
     </div>
diff --git a/ui/app/components/secret-list/database-list-item.js b/ui/app/components/secret-list/database-list-item.js
index d1cd0b246da..b5df3deb270 100644
--- a/ui/app/components/secret-list/database-list-item.js
+++ b/ui/app/components/secret-list/database-list-item.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/secret-list/item.hbs b/ui/app/components/secret-list/item.hbs
similarity index 88%
rename from ui/app/templates/components/secret-list/item.hbs
rename to ui/app/components/secret-list/item.hbs
index 26f7c704fc4..dd9032cea0d 100644
--- a/ui/app/templates/components/secret-list/item.hbs
+++ b/ui/app/components/secret-list/item.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LinkedBlock
   @params={{array
@@ -18,8 +18,10 @@
       <SecretLink
         @mode={{if @item.isFolder "list" "show"}}
         @secret={{@item.id}}
+        @backend={{@backendModel.id}}
         @queryParams={{secret-query-params @backendModel.type @item.type asQueryParams=true}}
         class="has-text-black has-text-weight-semibold"
+        data-test-secret-item-link={{@item.id}}
       >
         {{#if (eq @backendModel.type "transit")}}
           <Icon @name="key" class="has-text-grey-light" />
@@ -38,7 +40,7 @@
           data-test-popup-menu-trigger
         />
         {{#if @item.isFolder}}
-          <dd.Interactive @text="Contents" @route="vault.cluster.secrets.backend.list" @model={{@item.id}} />
+          <dd.Interactive @route="vault.cluster.secrets.backend.list" @model={{@item.id}}>Contents</dd.Interactive>
         {{else}}
           {{#if (or @item.versionPath.isLoading @item.secretPath.isLoading)}}
             <dd.Generic class="has-text-center">
@@ -47,27 +49,24 @@
           {{else}}
             {{#if @item.canRead}}
               <dd.Interactive
-                @text="Details"
                 @route="vault.cluster.secrets.backend.show"
                 @model={{@item.id}}
                 @query={{secret-query-params @backendModel.type @item.type asQueryParams=true}}
-              />
+              >Details</dd.Interactive>
             {{/if}}
             {{#if @item.canEdit}}
               <dd.Interactive
-                @text="Edit"
                 @route="vault.cluster.secrets.backend.edit"
                 @model={{@item.id}}
                 @query={{secret-query-params @backendModel.type @item.type asQueryParams=true}}
-              />
+              >Edit</dd.Interactive>
             {{/if}}
             {{#if @item.canDelete}}
               <dd.Interactive
-                @text="Delete"
                 @color="critical"
                 data-test-confirm-action-trigger
                 {{on "click" (fn (mut this.showConfirmModal) true)}}
-              />
+              >Delete</dd.Interactive>
             {{/if}}
           {{/if}}
         {{/if}}
diff --git a/ui/app/components/secret-list/item.js b/ui/app/components/secret-list/item.js
index db17c97fda8..46d25979108 100644
--- a/ui/app/components/secret-list/item.js
+++ b/ui/app/components/secret-list/item.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/secret-list/ssh-role-item.hbs b/ui/app/components/secret-list/ssh-role-item.hbs
similarity index 87%
rename from ui/app/templates/components/secret-list/ssh-role-item.hbs
rename to ui/app/components/secret-list/ssh-role-item.hbs
index aa6c295704e..712df06a9fb 100644
--- a/ui/app/templates/components/secret-list/ssh-role-item.hbs
+++ b/ui/app/components/secret-list/ssh-role-item.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LinkedBlock
   @params={{array
@@ -27,7 +27,7 @@
         <div class="role-item-details">
           <span class="is-underline">{{if (eq @item.id " ") "(self)" (or @item.keyWithoutParent @item.id)}}</span>
           <br />
-          <span class="tag has-text-grey-dark">{{@item.keyType}}</span>
+          <Hds::Badge @text={{@item.keyType}} />
           {{#if @item.zeroAddress}}
             <span class="has-text-grey is-size-7">Zero-Address</span>
           {{/if}}
@@ -50,11 +50,10 @@
               </dd.Generic>
             {{else if @item.canGenerate}}
               <dd.Interactive
-                @text="Generate credentials"
                 @route="vault.cluster.secrets.backend.credentials"
                 @model={{@item.id}}
                 data-test-role-ssh-link="generate"
-              />
+              >Generate credentials</dd.Interactive>
             {{/if}}
           {{else if (eq @item.keyType "ca")}}
             {{#if @item.signPath.isPending}}
@@ -63,11 +62,10 @@
               </dd.Generic>
             {{else if @item.canGenerate}}
               <dd.Interactive
-                @text="Sign Keys"
                 @route="vault.cluster.secrets.backend.sign"
                 @model={{@item.id}}
                 data-test-role-ssh-link="generate"
-              />
+              >Sign Keys</dd.Interactive>
             {{/if}}
           {{/if}}
           {{#if @loadingToggleZeroAddress}}
@@ -75,10 +73,9 @@
               <LoadingDropdownOption />
             </dd.Generic>
           {{else if @item.canEditZeroAddress}}
-            <dd.Interactive
-              @text={{if @item.zeroAddress "Disable Zero Address" "Enable Zero Address"}}
-              {{on "click" @toggleZeroAddress}}
-            />
+            <dd.Interactive {{on "click" @toggleZeroAddress}}>
+              {{if @item.zeroAddress "Disable Zero Address" "Enable Zero Address"}}
+            </dd.Interactive>
           {{/if}}
           {{#if @item.updatePath.isPending}}
             <dd.Generic class="has-text-center">
@@ -87,27 +84,24 @@
           {{else}}
             {{#if @item.canRead}}
               <dd.Interactive
-                @text="Details"
                 @route="vault.cluster.secrets.backend.show"
                 @model={{@item.id}}
                 data-test-role-ssh-link="show"
-              />
+              >Details</dd.Interactive>
             {{/if}}
             {{#if @item.canEdit}}
               <dd.Interactive
-                @text="Edit"
                 @route="vault.cluster.secrets.backend.edit"
                 @model={{@item.id}}
                 data-test-role-ssh-link="edit"
-              />
+              >Edit</dd.Interactive>
             {{/if}}
             {{#if @item.canDelete}}
               <dd.Interactive
-                @text="Delete"
                 @color="critical"
                 {{on "click" (fn (mut this.showConfirmModal) true)}}
                 data-test-ssh-role-delete
-              />
+              >Delete</dd.Interactive>
             {{/if}}
           {{/if}}
         </Hds::Dropdown>
diff --git a/ui/app/components/secret-list/ssh-role-item.js b/ui/app/components/secret-list/ssh-role-item.js
index d753751d71c..7c99fd07a2e 100644
--- a/ui/app/components/secret-list/ssh-role-item.js
+++ b/ui/app/components/secret-list/ssh-role-item.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/secret-list/totp-list-item.hbs b/ui/app/components/secret-list/totp-list-item.hbs
new file mode 100644
index 00000000000..c69c75bd543
--- /dev/null
+++ b/ui/app/components/secret-list/totp-list-item.hbs
@@ -0,0 +1,65 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<LinkedBlock
+  @params={{array "vault.cluster.secrets.backend.show" @item.id}}
+  class="list-item-row"
+  data-test-secret-link={{@item.id}}
+  @encode={{true}}
+>
+  <div class="columns is-mobile">
+    <div class="column is-10">
+      <LinkTo
+        @route="vault.cluster.secrets.backend.show"
+        @model={{@item.id}}
+        class="has-text-black has-text-weight-semibold"
+      >
+        <Icon @name="user" class="has-text-grey-light is-pulled-left" />
+        <div class="role-item-details">
+          <span class="is-underline">{{if (eq @item.id " ") "(self)" (or @item.keyWithoutParent @item.id)}}</span>
+        </div>
+      </LinkTo>
+    </div>
+    <div class="column has-text-right">
+      <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
+        <dd.ToggleIcon
+          @icon="more-horizontal"
+          @text="Manage key {{@item.id}}"
+          @hasChevron={{false}}
+          data-test-popup-menu-trigger
+        />
+        {{#if @item.canRead}}
+          <dd.Interactive
+            @route="vault.cluster.secrets.backend.show"
+            @model={{@item.id}}
+            data-test-popup-menu="details"
+          >Details</dd.Interactive>
+        {{/if}}
+        <dd.Interactive
+          @route="vault.cluster.secrets.backend.credentials"
+          @model={{@item.id}}
+          data-test-popup-menu="generate code"
+        >Generate Code</dd.Interactive>
+        {{#if @item.canDelete}}
+          <dd.Interactive
+            @color="critical"
+            data-test-confirm-action-trigger
+            {{on "click" (fn (mut this.showConfirmModal) true)}}
+          >Delete</dd.Interactive>
+        {{/if}}
+
+      </Hds::Dropdown>
+    </div>
+  </div>
+</LinkedBlock>
+
+{{#if this.showConfirmModal}}
+  <ConfirmModal
+    @color="critical"
+    @onClose={{fn (mut this.showConfirmModal) false}}
+    @confirmMessage="This will permanently delete this key."
+    @onConfirm={{@delete}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/secret-list/totp-list-item.js b/ui/app/components/secret-list/totp-list-item.js
new file mode 100644
index 00000000000..d8460947964
--- /dev/null
+++ b/ui/app/components/secret-list/totp-list-item.js
@@ -0,0 +1,11 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+
+export default class TotpListItemComponent extends Component {
+  @tracked showConfirmModal = false;
+}
diff --git a/ui/app/templates/components/secret-list/transform-list-item.hbs b/ui/app/components/secret-list/transform-list-item.hbs
similarity index 88%
rename from ui/app/templates/components/secret-list/transform-list-item.hbs
rename to ui/app/components/secret-list/transform-list-item.hbs
index 18c176ac0db..763fe01cb8c 100644
--- a/ui/app/templates/components/secret-list/transform-list-item.hbs
+++ b/ui/app/components/secret-list/transform-list-item.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (and @item.updatePath.canRead (not this.isBuiltin))}}
   <LinkedBlock
@@ -33,10 +33,10 @@
               data-test-popup-menu-trigger
             />
             {{#if @item.updatePath.canRead}}
-              <dd.Interactive @text="Details" @route="vault.cluster.secrets.backend.show" @model={{@itemPath}} />
+              <dd.Interactive @route="vault.cluster.secrets.backend.show" @model={{@itemPath}}>Details</dd.Interactive>
             {{/if}}
             {{#if @item.updatePath.canUpdate}}
-              <dd.Interactive @text="Edit" @route="vault.cluster.secrets.backend.edit" @model={{@itemPath}} />
+              <dd.Interactive @route="vault.cluster.secrets.backend.edit" @model={{@itemPath}}>Edit</dd.Interactive>
             {{/if}}
           </Hds::Dropdown>
         {{/if}}
diff --git a/ui/app/components/secret-list/transform-list-item.js b/ui/app/components/secret-list/transform-list-item.js
index 9434385698d..7110f83c84e 100644
--- a/ui/app/components/secret-list/transform-list-item.js
+++ b/ui/app/components/secret-list/transform-list-item.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -28,7 +28,7 @@ export default Component.extend({
   isBuiltin: computed('item', 'itemType', function () {
     const item = this.item;
     if (this.itemType === 'alphabet' || this.itemType === 'template') {
-      return item.get('id').startsWith('builtin/');
+      return item.id.startsWith('builtin/');
     }
     return false;
   }),
diff --git a/ui/app/templates/components/secret-list/transform-transformation-item.hbs b/ui/app/components/secret-list/transform-transformation-item.hbs
similarity index 80%
rename from ui/app/templates/components/secret-list/transform-transformation-item.hbs
rename to ui/app/components/secret-list/transform-transformation-item.hbs
index 30095e1cb0e..2f475b49403 100644
--- a/ui/app/templates/components/secret-list/transform-transformation-item.hbs
+++ b/ui/app/components/secret-list/transform-transformation-item.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LinkedBlock
   @params={{array "vault.cluster.secrets.backend.show" @item.id}}
@@ -15,6 +15,7 @@
       <SecretLink
         @mode="show"
         @secret={{@item.id}}
+        @backend={{@backendModel.id}}
         @queryParams={{if (eq @backendModel.type "transform") (hash tab="actions") ""}}
         class="has-text-black has-text-weight-semibold"
       >
@@ -32,10 +33,10 @@
             data-test-popup-menu-trigger
           />
           {{#if @item.updatePath.canRead}}
-            <dd.Interactive @text="Details" @route="vault.cluster.secrets.backend.show" @model={{@item.id}} />
+            <dd.Interactive @route="vault.cluster.secrets.backend.show" @model={{@item.id}}>Details</dd.Interactive>
           {{/if}}
           {{#if @item.updatePath.canUpdate}}
-            <dd.Interactive @text="Edit" @route="vault.cluster.secrets.backend.edit" @model={{@item.id}} />
+            <dd.Interactive @route="vault.cluster.secrets.backend.edit" @model={{@item.id}}>Edit</dd.Interactive>
           {{/if}}
         </Hds::Dropdown>
       {{/if}}
diff --git a/ui/app/components/section-tabs.hbs b/ui/app/components/section-tabs.hbs
new file mode 100644
index 00000000000..6da78d35322
--- /dev/null
+++ b/ui/app/components/section-tabs.hbs
@@ -0,0 +1,22 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#let (tabs-for-auth-section @model this.tabType @paths) as |tabs|}}
+  {{#if tabs.length}}
+    <div class="tabs-container box is-sideless is-fullwidth is-paddingless is-marginless">
+      <nav class="tabs" aria-label="navigation to manage {{@model.type}}">
+        <ul>
+          {{#each tabs as |tab|}}
+            <li>
+              <LinkTo @route={{tab.route}} @models={{tab.routeParams}} data-test-link-to="auth-tab">
+                {{tab.label}}
+              </LinkTo>
+            </li>
+          {{/each}}
+        </ul>
+      </nav>
+    </div>
+  {{/if}}
+{{/let}}
\ No newline at end of file
diff --git a/ui/app/components/section-tabs.js b/ui/app/components/section-tabs.js
index 6f2ee95e48f..533fa8d2a32 100644
--- a/ui/app/components/section-tabs.js
+++ b/ui/app/components/section-tabs.js
@@ -1,18 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Component from '@ember/component';
+import Component from '@glimmer/component';
 
-const SectionTabs = Component.extend({
-  tagName: '',
-  model: null,
-  tabType: 'authSettings',
-});
-
-SectionTabs.reopenClass({
-  positionalParams: ['model', 'tabType', 'paths'],
-});
-
-export default SectionTabs;
+export default class SectionTabs extends Component {
+  get tabType() {
+    return this.args.tabType || 'authSettings';
+  }
+}
diff --git a/ui/app/templates/components/shamir-progress.hbs b/ui/app/components/shamir-progress.hbs
similarity index 90%
rename from ui/app/templates/components/shamir-progress.hbs
rename to ui/app/components/shamir-progress.hbs
index 4c233e810c9..faf0d770c87 100644
--- a/ui/app/templates/components/shamir-progress.hbs
+++ b/ui/app/components/shamir-progress.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="level">
   <div class="level-left">
diff --git a/ui/app/components/shamir-progress.js b/ui/app/components/shamir-progress.js
index 9fd010d86d3..7932a7b6556 100644
--- a/ui/app/components/shamir-progress.js
+++ b/ui/app/components/shamir-progress.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/sidebar/frame.hbs b/ui/app/components/sidebar/frame.hbs
index 2139385f3ad..ce7eb524b75 100644
--- a/ui/app/components/sidebar/frame.hbs
+++ b/ui/app/components/sidebar/frame.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::AppFrame @hasSidebar={{@showSidebar}} @hasHeader={{false}} @hasFooter={{false}} as |Frame|>
   <Frame.Sidebar data-test-sidebar-nav>
@@ -18,11 +18,14 @@
             />
           </:logo>
           <:actions>
-            <Hds::SideNav::Header::IconButton
+            <Hds::Button
+              @isIconOnly={{true}}
+              @size="large"
               @icon="terminal-screen"
-              @ariaLabel="Console toggle"
+              @text="Console toggle"
               data-test-console-toggle
               {{on "click" (fn (mut this.console.isOpen) (not this.console.isOpen))}}
+              {{on "click" this.trackReplToggle}}
             />
             <Sidebar::UserMenu />
           </:actions>
@@ -36,10 +39,7 @@
 
       <:footer>
         {{#if (has-feature "Namespaces")}}
-          <NamespacePicker
-            @namespace={{this.clusterController.namespaceQueryParam}}
-            class="hds-side-nav-hide-when-minimized"
-          />
+          <NamespacePicker class="hds-side-nav-hide-when-minimized" />
         {{/if}}
       </:footer>
     </Hds::SideNav>
@@ -49,7 +49,14 @@
     <LinkStatus @status={{this.currentCluster.cluster.hcpLinkStatus}} />
     {{yield}}
     <div data-test-console-panel class={{if this.console.isOpen "panel-open"}}>
-      <Console::UiPanel @isFullscreen={{this.consoleFullscreen}} />
+      {{#if this.console.isOpen}}
+        <Console::UiPanel
+          @isFullscreen={{this.consoleFullscreen}}
+          {{focus-trap
+            focusTrapOptions=(hash initialFocus="#console-input" clickOutsideDeactivates=true onDeactivate=this.closeConsole)
+          }}
+        />
+      {{/if}}
     </div>
   </Frame.Main>
 </Hds::AppFrame>
\ No newline at end of file
diff --git a/ui/app/components/sidebar/frame.js b/ui/app/components/sidebar/frame.js
index 038337f0f20..fa0b3f41efa 100644
--- a/ui/app/components/sidebar/frame.js
+++ b/ui/app/components/sidebar/frame.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,8 +7,15 @@ import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { inject as controller } from '@ember/controller';
 
+import { TOGGLE_WEB_REPL } from 'vault/utils/analytic-events';
+
 export default class SidebarNavComponent extends Component {
+  @service analytics;
   @service currentCluster;
   @service console;
   @controller('vault.cluster') clusterController;
+
+  trackReplToggle = () => {
+    this.analytics.trackEvent(TOGGLE_WEB_REPL);
+  };
 }
diff --git a/ui/app/components/sidebar/nav/access.hbs b/ui/app/components/sidebar/nav/access.hbs
index d2e4b09b8d4..233124dfbd2 100644
--- a/ui/app/components/sidebar/nav/access.hbs
+++ b/ui/app/components/sidebar/nav/access.hbs
@@ -1,9 +1,15 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Hds::SideNav::Portal @ariaLabel="Access Navigation Links" data-test-sidebar-nav-panel="Access" as |Nav|>
+<Hds::SideNav::Portal
+  @ariaLabel="Access Navigation Links"
+  tabindex="0"
+  role="region"
+  data-test-sidebar-nav-panel="Access"
+  as |Nav|
+>
   <Nav.BackLink
     @route="vault.cluster"
     @current-when={{false}}
diff --git a/ui/app/components/sidebar/nav/clients.hbs b/ui/app/components/sidebar/nav/clients.hbs
new file mode 100644
index 00000000000..d3a3eda4343
--- /dev/null
+++ b/ui/app/components/sidebar/nav/clients.hbs
@@ -0,0 +1,31 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::SideNav::Portal @ariaLabel="Client Count Navigation Links" data-test-sidebar-nav-panel="Client Count" as |Nav|>
+  <Nav.BackLink
+    @route="vault.cluster"
+    @current-when={{false}}
+    @icon="arrow-left"
+    @text="Back to main navigation"
+    data-test-sidebar-nav-link="Back to main navigation"
+  />
+
+  <Nav.Title data-test-sidebar-nav-heading="Client Count">Client Count</Nav.Title>
+
+  <Nav.Link
+    @route="vault.cluster.clients.counts.overview"
+    @current-when="vault.cluster.clients.counts"
+    @text="Client Usage"
+    data-test-sidebar-nav-link="Client Usage"
+  />
+  {{#if @canReadConfig}}
+    <Nav.Link
+      @route="vault.cluster.clients.config"
+      @text="Configuration"
+      @current-when="vault.cluster.clients.config vault.cluster.clients.edit"
+      data-test-sidebar-nav-link="Configuration"
+    />
+  {{/if}}
+</Hds::SideNav::Portal>
\ No newline at end of file
diff --git a/ui/app/components/sidebar/nav/cluster.hbs b/ui/app/components/sidebar/nav/cluster.hbs
index 1868e9b0b7b..a1c25041028 100644
--- a/ui/app/components/sidebar/nav/cluster.hbs
+++ b/ui/app/components/sidebar/nav/cluster.hbs
@@ -1,24 +1,29 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::SideNav::Portal @ariaLabel="Cluster Navigation Links" data-test-sidebar-nav-panel="Cluster" as |Nav|>
   <Nav.Title data-test-sidebar-nav-heading="Vault">Vault</Nav.Title>
 
   <Nav.Link @route="vault.cluster.dashboard" @text="Dashboard" data-test-sidebar-nav-link="Dashboard" />
-  <Nav.Link
-    @route="vault.cluster.secrets"
-    @current-when="vault.cluster.secrets vault.cluster.settings.mount-secret-backend vault.cluster.settings.configure-secret-backend"
-    @text="Secrets Engines"
-    data-test-sidebar-nav-link="Secrets Engines"
-  />
-  <Nav.Link
-    @route="vault.cluster.sync"
-    @text="Secrets Sync"
-    @badge={{if this.version.isEnterprise "Beta" "Enterprise"}}
-    data-test-sidebar-nav-link="Secrets Sync"
-  />
+  <Nav.Link @route="vault.cluster.secrets" @text="Secrets Engines" data-test-sidebar-nav-link="Secrets Engines" />
+  {{#if this.showSecretsSync}}
+    <Nav.Link
+      @route="vault.cluster.sync"
+      @text="Secrets Sync"
+      @badge={{if this.flags.isHvdManaged "Plus" ""}}
+      data-test-sidebar-nav-link="Secrets Sync"
+    />
+  {{/if}}
+  {{#unless (or this.cluster.dr.isSecondary this.flags.isHvdManaged)}}
+    <Nav.Link
+      @route="vault.cluster.recovery.snapshots"
+      @text="Secrets Recovery"
+      @badge={{if this.version.isCommunity "Enterprise" ""}}
+      data-test-sidebar-nav-link="Secrets Recovery"
+    />
+  {{/unless}}
   {{#if (has-permission "access")}}
     <Nav.Link
       @route={{get (route-params-for "access") "route"}}
@@ -51,7 +56,7 @@
   {{#if
     (or
       (and this.isRootNamespace (has-permission "status" routeParams=(array "replication" "raft" "license" "seal")))
-      (has-permission "clients" routeParams="activity")
+      (and (has-permission "clients" routeParams="activity") (not this.hasChrootNamespace))
     )
   }}
     <Nav.Title data-test-sidebar-nav-heading="Monitoring">Monitoring</Nav.Title>
@@ -79,8 +84,18 @@
       data-test-sidebar-nav-link="Raft Storage"
     />
   {{/if}}
-  {{#if (and (has-permission "clients" routeParams="activity") (not this.cluster.dr.isSecondary))}}
-    <Nav.Link @route="vault.cluster.clients" @text="Client Count" data-test-sidebar-nav-link="Client Count" />
+  {{#if
+    (and (has-permission "clients" routeParams="activity") (not this.cluster.dr.isSecondary) (not this.hasChrootNamespace))
+  }}
+    <Nav.Link
+      @route="vault.cluster.clients"
+      @text="Client Count"
+      @hasSubItems={{true}}
+      data-test-sidebar-nav-link="Client Count"
+    />
+  {{/if}}
+  {{#if this.canAccessVaultUsageDashboard}}
+    <Nav.Link @route="vault.cluster.usage-reporting" @text="Vault Usage" data-test-sidebar-nav-link="Vault Usage" />
   {{/if}}
   {{#if
     (and
@@ -113,5 +128,12 @@
       @text="Custom Messages"
       data-test-sidebar-nav-link="Custom Messages"
     />
+    {{#if (or this.isRootNamespace this.namespace.isHvdAdminNamespace)}}
+      <Nav.Link
+        @route="vault.cluster.config-ui.login-settings"
+        @text="UI Login Settings"
+        data-test-sidebar-nav-link="UI Login Settings"
+      />
+    {{/if}}
   {{/if}}
 </Hds::SideNav::Portal>
\ No newline at end of file
diff --git a/ui/app/components/sidebar/nav/cluster.js b/ui/app/components/sidebar/nav/cluster.js
index 29241c6e4cd..d7dbd5387c3 100644
--- a/ui/app/components/sidebar/nav/cluster.js
+++ b/ui/app/components/sidebar/nav/cluster.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,16 +8,53 @@ import { service } from '@ember/service';
 
 export default class SidebarNavClusterComponent extends Component {
   @service currentCluster;
+  @service flags;
   @service version;
   @service auth;
   @service namespace;
+  @service permissions;
 
   get cluster() {
     return this.currentCluster.cluster;
   }
 
+  get hasChrootNamespace() {
+    return this.cluster?.hasChrootNamespace;
+  }
+
   get isRootNamespace() {
     // should only return true if we're in the true root namespace
-    return this.namespace.inRootNamespace && !this.cluster?.hasChrootNamespace;
+    return this.namespace.inRootNamespace && !this.hasChrootNamespace;
+  }
+
+  get canAccessVaultUsageDashboard() {
+    /*
+    A user can access Vault Usage if they satisfy the following conditions:
+      1) They have access to sys/v1/utilization-report endpoint
+      2) They are either
+        a) enterprise cluster and root namespace
+        b) hvd cluster and /admin namespace
+    */
+
+    const hasPermission = this.permissions.hasNavPermission('monitoring');
+    const isEnterprise = this.version.isEnterprise;
+    const isCorrectNamespace = this.isRootNamespace || this.namespace.inHvdAdminNamespace;
+
+    return hasPermission && isEnterprise && isCorrectNamespace;
+  }
+
+  get showSecretsSync() {
+    // always show for HVD managed clusters
+    if (this.flags.isHvdManaged) return true;
+
+    if (this.flags.secretsSyncIsActivated) {
+      // activating the feature requires different permissions than using the feature.
+      // we want to show the link to allow activation regardless of permissions to sys/sync
+      // and only check permissions if the feature has been activated
+      return this.permissions.hasNavPermission('sync');
+    }
+
+    // otherwise we show the link depending on whether or not the feature exists
+    return this.version.hasSecretsSync;
   }
 }
diff --git a/ui/app/components/sidebar/nav/policies.hbs b/ui/app/components/sidebar/nav/policies.hbs
index 9627760ef23..6fe744f1012 100644
--- a/ui/app/components/sidebar/nav/policies.hbs
+++ b/ui/app/components/sidebar/nav/policies.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::SideNav::Portal @ariaLabel="Policies Navigation Links" data-test-sidebar-nav-panel="Policies" as |Nav|>
   <Nav.BackLink
diff --git a/ui/app/components/sidebar/nav/tools.hbs b/ui/app/components/sidebar/nav/tools.hbs
index f6ced6c9ce0..69527469d91 100644
--- a/ui/app/components/sidebar/nav/tools.hbs
+++ b/ui/app/components/sidebar/nav/tools.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::SideNav::Portal @ariaLabel="Tools Navigation Links" data-test-sidebar-nav-panel="Tools" as |Nav|>
   <Nav.BackLink
diff --git a/ui/app/components/sidebar/user-menu.hbs b/ui/app/components/sidebar/user-menu.hbs
index c881e952a2d..5072e016fef 100644
--- a/ui/app/components/sidebar/user-menu.hbs
+++ b/ui/app/components/sidebar/user-menu.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <BasicDropdown
   @horizontalPosition="right"
@@ -11,13 +11,13 @@
   data-test-user-menu
   as |Dropdown|
 >
-  <Dropdown.Trigger data-test-user-menu-trigger>
-    <Hds::SideNav::Header::IconButton @icon="user" @ariaLabel="User menu" />
+  <Dropdown.Trigger data-test-button="user-menu-trigger">
+    <Hds::Button @isIconOnly={{true}} @size="large" @icon="user" @text="User menu" />
   </Dropdown.Trigger>
   <Dropdown.Content>
     <div class="popup-menu-content" data-test-user-menu-content>
       <div class="box">
-        <div class="menu-label">
+        <div class="menu-label overflow-wrap">
           {{capitalize this.auth.authData.displayName}}
         </div>
         <nav class="menu">
@@ -32,20 +32,20 @@
               </li>
             {{/if}}
             {{#if this.hasEntityId}}
-              <li class="action">
+              <li>
                 <LinkTo @route="vault.cluster.mfa-setup" data-test-user-menu-item="mfa">
                   Multi-factor authentication
                 </LinkTo>
               </li>
             {{/if}}
             {{#if this.isUserpass}}
-              <li class="action">
+              <li>
                 <LinkTo @route="vault.cluster.access.reset-password" data-test-user-menu-item="reset-password">
                   Reset password
                 </LinkTo>
               </li>
             {{/if}}
-            <li class="action" id="container">
+            <li id="container">
               {{! container is required in navbar collapsed state }}
               <Hds::Copy::Button
                 @text="Copy token"
@@ -55,16 +55,14 @@
                 class="in-dropdown link is-flex-start"
                 @onSuccess={{(fn (set-flash-message "Token copied!"))}}
                 @onError={{(fn
-                  (set-flash-message
-                    "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger"
-                  )
+                  (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
                 )}}
-                data-test-copy-button={{this.auth.currentToken}}
+                data-test-copy-button
               />
             </li>
             {{#if (is-before (now interval=1000) this.auth.tokenExpirationDate)}}
               {{#if this.auth.authData.renewable}}
-                <li class="action">
+                <li>
                   {{! TODO Hds::Button replacement skipped in favor of updating it when there is a Hds::Dropdown swapout }}
                   <button
                     type="button"
@@ -85,7 +83,7 @@
                 data-test-user-menu-item="revoke token"
               />
             {{/if}}
-            <li class="action">
+            <li>
               <LinkTo @route="vault.cluster.logout" @model={{this.currentCluster.cluster.name}} id="logout">
                 Log out
               </LinkTo>
diff --git a/ui/app/components/sidebar/user-menu.js b/ui/app/components/sidebar/user-menu.js
index 0b7305708af..13212bdb6aa 100644
--- a/ui/app/components/sidebar/user-menu.js
+++ b/ui/app/components/sidebar/user-menu.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,10 +19,10 @@ export default class SidebarUserMenuComponent extends Component {
   get hasEntityId() {
     // root users will not have an entity_id because they are not associated with an entity.
     // in order to use the MFA end user setup they need an entity_id
-    return !!this.auth.authData?.entity_id;
+    return !!this.auth.authData?.entityId;
   }
   get isUserpass() {
-    return this.auth.authData?.backend?.type === 'userpass';
+    return this.auth.authData?.authMethodType === 'userpass';
   }
 
   get isRenewing() {
diff --git a/ui/app/components/splash-page.hbs b/ui/app/components/splash-page.hbs
index 187687ac407..2c6fd94e569 100644
--- a/ui/app/components/splash-page.hbs
+++ b/ui/app/components/splash-page.hbs
@@ -1,20 +1,17 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<div class="splash-page-container section is-flex-v-centered-tablet is-flex-grow-1 is-fullwidth">
+<div class="splash-page-container section is-flex-v-centered-tablet is-flex-grow-1 is-fullwidth" ...attributes>
   <div class="columns is-centered is-gapless is-fullwidth">
     <div class="column is-4-desktop is-6-tablet">
       <div class="splash-page-header" data-test-splash-page-header>
         {{yield to="header"}}
       </div>
-      <div class="splash-page-sub-header" data-test-splash-page-sub-header>
-        {{yield to="subHeader"}}
-      </div>
-      <div class="login-form box is-paddingless is-relative" data-test-splash-page-content>
+      <Hds::Card::Container @level="high" @hasBorder={{true}} class="overflow-auto" data-test-splash-page-content>
         {{yield to="content"}}
-      </div>
+      </Hds::Card::Container>
       {{yield to="footer"}}
     </div>
   </div>
diff --git a/ui/app/components/token-expire-warning.hbs b/ui/app/components/token-expire-warning.hbs
index 3d56bd129fb..f70f2a4a2b4 100644
--- a/ui/app/components/token-expire-warning.hbs
+++ b/ui/app/components/token-expire-warning.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (and this.showWarning (is-after (now interval=1000) @expirationDate))}}
   <Hds::Alert @type="page" @color="critical" data-test-token-expired-banner as |A|>
@@ -10,7 +10,7 @@
       Your auth token expired on
       {{date-format @expirationDate "MMMM do yyyy, h:mm:ss a"}}. You will need to re-authenticate.
     </A.Description>
-    <A.Link::Standalone
+    <A.LinkStandalone
       @icon="arrow-right"
       @iconPosition="trailing"
       @text="Reauthenticate"
@@ -46,7 +46,7 @@
             {{on "click" (perform this.renewToken)}}
             data-test-renew-token-button
           />
-          <A.Link::Standalone
+          <A.LinkStandalone
             @icon="arrow-right"
             @iconPosition="trailing"
             @color="secondary"
diff --git a/ui/app/components/token-expire-warning.js b/ui/app/components/token-expire-warning.js
index f527e27804e..7b52b14e796 100644
--- a/ui/app/components/token-expire-warning.js
+++ b/ui/app/components/token-expire-warning.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -46,6 +46,7 @@ export default class TokenExpireWarning extends Component {
     if ('vault.cluster.oidc-provider' === currentRoute) {
       return false;
     }
+
     return !!this.args.expirationDate;
   }
 }
diff --git a/ui/app/components/tool-actions-form.js b/ui/app/components/tool-actions-form.js
deleted file mode 100644
index dc8a06823ff..00000000000
--- a/ui/app/components/tool-actions-form.js
+++ /dev/null
@@ -1,154 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { match } from '@ember/object/computed';
-import { service } from '@ember/service';
-import Component from '@ember/component';
-import { setProperties, computed, set } from '@ember/object';
-import { addSeconds, parseISO } from 'date-fns';
-import { A } from '@ember/array';
-import { capitalize } from '@ember/string';
-
-const DEFAULTS = {
-  token: null,
-  rewrap_token: null,
-  errors: A(),
-  wrap_info: null,
-  creation_time: null,
-  creation_ttl: null,
-  data: '{\n}',
-  unwrap_data: null,
-  details: null,
-  wrapTTL: null,
-  sum: null,
-  random_bytes: null,
-  input: null,
-};
-
-const WRAPPING_ENDPOINTS = ['lookup', 'wrap', 'unwrap', 'rewrap'];
-
-export default Component.extend(DEFAULTS, {
-  flashMessages: service(),
-  store: service(),
-  // putting these attrs here so they don't get reset when you click back
-  //random
-  bytes: 32,
-  //hash
-  format: 'base64',
-  algorithm: 'sha2-256',
-
-  tagName: '',
-
-  didReceiveAttrs() {
-    this._super(...arguments);
-    this.checkAction();
-  },
-
-  selectedAction: null,
-
-  reset() {
-    if (this.isDestroyed || this.isDestroying) {
-      return;
-    }
-    setProperties(this, DEFAULTS);
-  },
-
-  checkAction() {
-    const currentAction = this.selectedAction;
-    const oldAction = this.oldSelectedAction;
-
-    if (currentAction !== oldAction) {
-      this.reset();
-    }
-    set(this, 'oldSelectedAction', currentAction);
-  },
-
-  dataIsEmpty: match('data', new RegExp(DEFAULTS.data)),
-
-  expirationDate: computed('creation_time', 'creation_ttl', function () {
-    const { creation_time, creation_ttl } = this;
-    if (!(creation_time && creation_ttl)) {
-      return null;
-    }
-    // returns new Date with seconds added.
-    return addSeconds(parseISO(creation_time), creation_ttl);
-  }),
-
-  handleError(e) {
-    set(this, 'errors', e.errors);
-  },
-
-  handleSuccess(resp, action) {
-    let props = {};
-    const secret = (resp && resp.data) || resp.auth;
-    if (secret && action === 'unwrap') {
-      const details = {
-        'Request ID': resp.request_id,
-        'Lease ID': resp.lease_id || 'None',
-        Renewable: resp.renewable ? 'Yes' : 'No',
-        'Lease Duration': resp.lease_duration || 'None',
-      };
-      props = { ...props, unwrap_data: secret, details: details };
-    }
-    props = { ...props, ...secret };
-    if (resp && resp.wrap_info) {
-      const keyName = action === 'rewrap' ? 'rewrap_token' : 'token';
-      props = { ...props, [keyName]: resp.wrap_info.token };
-    }
-    setProperties(this, props);
-    this.flashMessages.success(`${capitalize(action)} was successful.`);
-  },
-
-  getData() {
-    const action = this.selectedAction;
-    if (WRAPPING_ENDPOINTS.includes(action)) {
-      return this.dataIsEmpty ? { token: (this.token || '').trim() } : JSON.parse(this.data);
-    }
-    if (action === 'random') {
-      return { bytes: this.bytes, format: this.format };
-    }
-    if (action === 'hash') {
-      return { input: this.input, format: this.format, algorithm: this.algorithm };
-    }
-  },
-
-  actions: {
-    doSubmit(evt) {
-      evt.preventDefault();
-      const action = this.selectedAction;
-      const wrapTTL = action === 'wrap' ? this.wrapTTL : null;
-      const data = this.getData();
-      setProperties(this, {
-        errors: null,
-        wrap_info: null,
-        creation_time: null,
-        creation_ttl: null,
-      });
-
-      this.store
-        .adapterFor('tools')
-        .toolAction(action, data, { wrapTTL })
-        .then(
-          (resp) => this.handleSuccess(resp, action),
-          (...errArgs) => this.handleError(...errArgs)
-        );
-    },
-
-    onClear() {
-      this.reset();
-    },
-
-    updateTtl(ttl) {
-      set(this, 'wrapTTL', ttl);
-    },
-
-    codemirrorUpdated(val, hasErrors) {
-      setProperties(this, {
-        buttonDisabled: hasErrors,
-        data: val,
-      });
-    },
-  },
-});
diff --git a/ui/app/components/tool-hash.js b/ui/app/components/tool-hash.js
deleted file mode 100644
index 6054baba3ab..00000000000
--- a/ui/app/components/tool-hash.js
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-
-/**
- * @module ToolHash
- * ToolHash components are components that sys/wrapping/hash functionality.  Most of the functionality is passed through as actions from the tool-actions-form and then called back with properties.
- *
- * @example
- * ```js
- * <ToolHash
- *  @onClear={{action "onClear"}}
- *  @sum={{sum}}
- *  @algorithm={{algorithm}}
- *  @format={{format}}
- *  @errors={{errors}}/>
- * ```
- * @param onClear {Function} - parent action that is passed through. Must be passed as {{action "onClear"}}
- * @param sum=null {String} - property passed from parent to child and then passed back up to parent.
- * @param algorithm {String} - property returned from parent.
- * @param format {String} - property returned from parent.
- * @param error=null {Object} - errors passed from parent as default then from child back to parent.
- */
-export default class ToolHash extends Component {
-  @action
-  onClear() {
-    this.args.onClear();
-  }
-}
diff --git a/ui/app/components/tool-lookup.js b/ui/app/components/tool-lookup.js
deleted file mode 100644
index e1fca415eb9..00000000000
--- a/ui/app/components/tool-lookup.js
+++ /dev/null
@@ -1,39 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-
-/**
- * @module ToolLookup
- * ToolLookup components are components that sys/wrapping/lookup functionality.  Most of the functionality is passed through as actions from the tool-actions-form and then called back with properties.
- *
- * @example
- * ```js
- * <ToolLookup
- *  @creation_time={{creation_time}}
- *  @creation_ttl={{creation_ttl}}
- *  @creation_path={{creation_path}}
- *  @expirationDate={{expirationDate}}
- *  @selectedAction={{selectedAction}}
- *  @token={{token}}
- *  @onClear={{action "onClear"}}
- *  @errors={{errors}}/>
- * ```
- * @param creation_time {Function} - parent action that is passed through.
- * @param creation_ttl {Function} - parent action that is passed through.
- * @param creation_path {Function} - parent action that is passed through.
- * @param expirationDate='' {String} - value returned from lookup.
- * @param selectedAction="wrap" - passed in from parent.  This is the wrap action, others include hash, etc.
- * @param token=null {String} - property passed from parent to child and then passed back up to parent
- * @param onClear {Function} - parent action that is passed through. Must be passed as {{action "onClear"}}
- * @param error=null {Object} - errors passed from parent as default then from child back to parent.
- */
-export default class ToolLookup extends Component {
-  @action
-  onClear() {
-    this.args.onClear();
-  }
-}
diff --git a/ui/app/components/tool-random.js b/ui/app/components/tool-random.js
deleted file mode 100644
index 6e842284123..00000000000
--- a/ui/app/components/tool-random.js
+++ /dev/null
@@ -1,34 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-
-/**
- * @module ToolRandom
- * ToolRandom components are components that sys/wrapping/random functionality.  Most of the functionality is passed through as actions from the tool-actions-form and then called back with properties.
- *
- * @example
- * ```js
- * <ToolRandom
- *  @onClear={{action "onClear"}}
- *  @format={{format}}
- *  @bytes={{bytes}}
- *  @random_bytes={{random_bytes}}
- *  @errors={{errors}}/>
- * ```
- * @param onClear {Function} - parent action that is passed through. Must be passed as {{action "onClear"}}
- * @param format {String} - property returned from parent.
- * @param bytes {String} - property returned from parent.
- * @param random_bytes {String} - property returned from parent.
- * @param error=null {Object} - errors passed from parent as default then from child back to parent.
- */
-
-export default class ToolRandom extends Component {
-  @action
-  onClear() {
-    this.args.onClear();
-  }
-}
diff --git a/ui/app/components/tool-rewrap.js b/ui/app/components/tool-rewrap.js
deleted file mode 100644
index 985930fde89..00000000000
--- a/ui/app/components/tool-rewrap.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-
-/**
- * @module ToolRewrap
- * ToolRewrap components are components that sys/wrapping/rewrap functionality.  Most of the functionality is passed through as actions from the tool-actions-form and then called back with properties.
- *
- * @example
- * ```js
- * <ToolRewrap
- *  @onClear={{action "onClear"}}
- *  @token={{token}}
- *  @rewrap_token={{rewrap_token}}
- *  @selectedAction={{selectedAction}}
- *  @bytes={{bytes}}
- *  @errors={{errors}}/>
- * ```
- * @param onClear {Function} - parent action that is passed through. Must be passed as {{action "onClear"}}
- * @param token=null {String} - property passed from parent to child and then passed back up to parent
- * @param rewrap_token {String} - property returned from parent.
- * @param selectedAction {String} - property returned from parent.
- * @param bytes {String} - property returned from parent.
- * @param error=null {Object} - errors passed from parent as default then from child back to parent.
- */
-
-export default class ToolRewrap extends Component {
-  @action
-  onClear() {
-    this.args.onClear();
-  }
-}
diff --git a/ui/app/components/tool-unwrap.js b/ui/app/components/tool-unwrap.js
deleted file mode 100644
index 389270e8845..00000000000
--- a/ui/app/components/tool-unwrap.js
+++ /dev/null
@@ -1,34 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-
-/**
- * @module ToolUnwrap
- * ToolUnwrap components are components that sys/wrapping/unwrap functionality.  Most of the functionality is passed through as actions from the tool-actions-form and then called back with properties.
- *
- * @example
- * ```js
- * <ToolUnwrap
- *  @onClear={{action "onClear"}}
- *  @token={{token}}
- *  @unwrap_data={{unwrap_data}}
- *  @details={{details}}
- *  @errors={{errors}}/>
- * ```
- * @param onClear {Function} - parent action that is passed through. Must be passed as {{action "onClear"}}
- * @param token=null {String} - property passed from parent to child and then passed back up to parent
- * @param unwrap_data {String} - property returned from parent.
- * @param details {String} - property returned from parent.
- * @param error=null {Object} - errors passed from parent as default then from child back to parent.
- */
-
-export default class ToolUnwrap extends Component {
-  @action
-  onClear() {
-    this.args.onClear();
-  }
-}
diff --git a/ui/app/components/tool-wrap.js b/ui/app/components/tool-wrap.js
deleted file mode 100644
index 02eb0d6acfd..00000000000
--- a/ui/app/components/tool-wrap.js
+++ /dev/null
@@ -1,56 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-import { tracked } from '@glimmer/tracking';
-
-/**
- * @module ToolWrap
- * ToolWrap components are components that sys/wrapping/wrap functionality.  Most of the functionality is passed through as actions from the tool-actions-form and then called back with properties.
- *
- * @example
- * ```js
- * <ToolWrap
- *  @onClear={{action "onClear"}}
- *  @token={{token}}
- *  @selectedAction="wrap"
- *  @codemirrorUpdated={{action "codemirrorUpdated"}}
- *  @updateTtl={{action "updateTtl"}}
- *  @buttonDisabled={{buttonDisabled}}
- *  @errors={{errors}}/>
- * ```
- * @param onClear {Function} - parent action that is passed through. Must be passed as {{action "onClear"}}
- * @param token=null {String} - property passed from parent to child and then passed back up to parent
- * @param selectedAction="wrap" - passed in from parent.  This is the wrap action, others include hash, etc.
- * @param codemirrorUpdated {Function} - parent action that is passed through. Must be passed as {{action "codemirrorUpdated"}}.
- * @param updateTtl {Function} - parent action that is passed through. Must be passed as {{action "updateTtl"}}
- * @param buttonDisabled=false {Boolean} - false default and if there is an error on codemirror it turns to true.
- * @param error=null {Object} - errors passed from parent as default then from child back to parent.
- */
-
-export default class ToolWrap extends Component {
-  @tracked data = '{\n}';
-  @tracked buttonDisabled = false;
-
-  @action
-  onClear() {
-    this.args.onClear();
-  }
-  @action
-  updateTtl(evt) {
-    if (!evt) return;
-    const ttl = evt.enabled ? `${evt.seconds}s` : '30m';
-    this.args.updateTtl(ttl);
-  }
-  @action
-  codemirrorUpdated(val, codemirror) {
-    codemirror.performLint();
-    const hasErrors = codemirror?.state.lint.marked?.length > 0;
-    this.data = val;
-    this.buttonDisabled = hasErrors;
-    this.args.codemirrorUpdated(val, hasErrors);
-  }
-}
diff --git a/ui/app/templates/components/toolbar-secret-link.hbs b/ui/app/components/toolbar-secret-link.hbs
similarity index 81%
rename from ui/app/templates/components/toolbar-secret-link.hbs
rename to ui/app/components/toolbar-secret-link.hbs
index 04f9989b598..9cbc0269313 100644
--- a/ui/app/templates/components/toolbar-secret-link.hbs
+++ b/ui/app/components/toolbar-secret-link.hbs
@@ -1,11 +1,12 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <SecretLink
   @mode={{@mode}}
   @secret={{@secret}}
+  @backend={{@backend}}
   @replace={{@replace}}
   @queryParams={{@queryParams}}
   @disabled={{@disabled}}
diff --git a/ui/app/components/toolbar-secret-link.js b/ui/app/components/toolbar-secret-link.js
index a98aaf4a115..985aab6df5a 100644
--- a/ui/app/components/toolbar-secret-link.js
+++ b/ui/app/components/toolbar-secret-link.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,14 +13,29 @@ import Component from '@glimmer/component';
  * ```js
  * <Toolbar>
  *   <ToolbarActions>
- *     <ToolbarSecretLink @params={{array 'vault.cluster.policies.create'}} @type="add">
+ *     <ToolbarSecretLink
+ *       @mode="create"
+ *       @type="add"
+ *       @secret="some-secret"
+ *       @backend="mount-path"
+ *       @queryParams={{hash tab="policy"}}
+ *       @replace={{true}}
+ *       @disabled={{false}}
+ *       data-test-custom-tag
+ *     >
  *       Create policy
  *     </ToolbarSecretLink>
  *   </ToolbarActions>
  * </Toolbar>
  * ```
  *
- * @param type="" {String} - Use "add" to change icon
+ * @param {string} type - use "add" to change icon from "chevron-right" to "plus"
+ * @param {string} mode - *required* passed to secret-link, controls route
+ * @param {string} backend - *required* backend path. Passed to secret-link
+ * @param {string} secret - secret path. Passed to secret-link
+ * @param {boolean} replace - passed to secret-link
+ * @param {boolean} disabled - passed to secret-link
+ * @param {object} queryParams - passed to secret-link
  */
 export default class ToolbarSecretLink extends Component {
   get glyph() {
diff --git a/ui/app/components/tools/hash.hbs b/ui/app/components/tools/hash.hbs
new file mode 100644
index 00000000000..47007389b9e
--- /dev/null
+++ b/ui/app/components/tools/hash.hbs
@@ -0,0 +1,91 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      Hash Data
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+{{#if this.sum}}
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <div class="field">
+      <label for="sum" class="is-input">Sum</label>
+      <Hds::Copy::Snippet
+        @textToCopy={{this.sum}}
+        @color="secondary"
+        data-test-tools-input="sum"
+        @onError={{fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")}}
+      />
+    </div>
+  </div>
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <Hds::Button @text="Done" @color="secondary" {{on "click" this.reset}} data-test-button="Done" />
+  </div>
+{{else}}
+  <form {{on "submit" this.handleSubmit}}>
+    <div class="box is-sideless is-fullwidth is-marginless">
+      <MessageError @errorMessage={{this.errorMessage}} />
+      <div class="field">
+        <label for="hash-input" class="is-label">
+          Input
+        </label>
+        <div class="control">
+          <textarea
+            id="hash-input"
+            name="hashData"
+            value={{this.hashData}}
+            {{on "input" this.handleEvent}}
+            class="textarea"
+            data-test-tools-input="hash-input"
+          ></textarea>
+          <B64Toggle
+            @value={{this.hashData}}
+            @isInput={{false}}
+            @onUpdate={{fn (mut this.hashData)}}
+            data-test-tools-input="b64-toggle"
+          />
+        </div>
+      </div>
+      <div class="field is-horizontal">
+        <div class="field-body">
+          <div class="field">
+            <label for="algorithm" class="is-label">Algorithm</label>
+            <div class="control is-expanded">
+              <div class="select is-fullwidth">
+                <select name="algorithm" id="algorithm" {{on "change" this.handleEvent}}>
+                  {{#each (sha2-digest-sizes) as |algo|}}
+                    <option selected={{eq this.algorithm algo}} value={{algo}}>
+                      {{algo}}
+                    </option>
+                  {{/each}}
+                </select>
+              </div>
+            </div>
+          </div>
+          <div class="field">
+            <label for="format" class="is-label"> Output format </label>
+            <div class="control is-expanded">
+              <div class="select is-fullwidth">
+                <select name="format" id="format" {{on "change" this.handleEvent}}>
+                  {{#each (array "base64" "hex") as |formatOption|}}
+                    <option selected={{eq this.format formatOption}} value={{formatOption}}>
+                      {{formatOption}}
+                    </option>
+                  {{/each}}
+                </select>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      <Hds::Button @text="Hash" type="submit" data-test-submit />
+    </div>
+  </form>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/tools/hash.ts b/ui/app/components/tools/hash.ts
new file mode 100644
index 00000000000..a4abb7361e0
--- /dev/null
+++ b/ui/app/components/tools/hash.ts
@@ -0,0 +1,66 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+
+import type ApiService from 'vault/services/api';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type { HTMLElementEvent } from 'vault/forms';
+
+/**
+ * @module ToolsHash
+ * ToolsHash components are components that sys/wrapping/hash functionality.
+ *
+ * @example
+ * <Tools::Hash />
+ */
+export default class ToolsHash extends Component {
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+
+  @tracked algorithm = 'sha2-256';
+  @tracked format = 'base64';
+  @tracked hashData = '';
+  @tracked sum = '';
+  @tracked errorMessage = '';
+
+  @action
+  reset() {
+    this.algorithm = 'sha2-256';
+    this.format = 'base64';
+    this.hashData = '';
+    this.sum = '';
+    this.errorMessage = '';
+  }
+
+  @action
+  handleEvent(evt: HTMLElementEvent<HTMLInputElement>) {
+    const { name, value } = evt.target;
+    const key = name as 'algorithm' | 'format' | 'hashData';
+    this[key] = value;
+  }
+
+  @action
+  async handleSubmit(evt: HTMLElementEvent<HTMLFormElement>) {
+    evt.preventDefault();
+    const data = {
+      input: this.hashData,
+      format: this.format,
+      algorithm: this.algorithm,
+    };
+
+    try {
+      const { sum } = await this.api.sys.generateHash(data);
+      this.sum = sum || '';
+      this.flashMessages.success('Hash was successful.');
+    } catch (error) {
+      const { message } = await this.api.parseError(error);
+      this.errorMessage = message;
+    }
+  }
+}
diff --git a/ui/app/components/tools/lookup.hbs b/ui/app/components/tools/lookup.hbs
new file mode 100644
index 00000000000..98e229d9de1
--- /dev/null
+++ b/ui/app/components/tools/lookup.hbs
@@ -0,0 +1,50 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      Lookup Token
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+{{#if this.lookupData}}
+  <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
+    {{#each-in this.lookupData as |key value|}}
+      {{#let (if (eq key "creation_ttl") "Creation TTL" (to-label key)) as |label|}}
+        <InfoTableRow @label={{label}} @value={{value}} />
+      {{/let}}
+    {{/each-in}}
+    {{#if this.expirationDate}}
+      <InfoTableRow @label="Expiration date" @value={{this.expirationDate}} />
+      <InfoTableRow @label="Expires in" @value={{date-from-now this.expirationDate}} />
+    {{/if}}
+  </div>
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <Hds::Button @text="Done" @color="secondary" {{on "click" this.reset}} data-test-button="Done" />
+  </div>
+{{else}}
+  <form {{on "submit" this.handleSubmit}}>
+    <div class="box is-sideless is-fullwidth is-marginless">
+      <NamespaceReminder @mode="perform" @noun="lookup" />
+      <MessageError @errorMessage={{this.errorMessage}} />
+      <div class="field">
+        <label for="token" class="is-label">Wrapped token</label>
+        <div class="has-text-grey is-size-8 has-bottom-margin-xs">
+          Enter your wrapped token here to display its information.
+        </div>
+        <div class="control">
+          <Input @value={{this.token}} class="input" id="token" name="token" data-test-tools-input="wrapping-token" />
+        </div>
+      </div>
+    </div>
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      <div class="control">
+        <Hds::Button @text="Lookup token" type="submit" data-test-submit />
+      </div>
+    </div>
+  </form>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/tools/lookup.ts b/ui/app/components/tools/lookup.ts
new file mode 100644
index 00000000000..3b2a27c9c1c
--- /dev/null
+++ b/ui/app/components/tools/lookup.ts
@@ -0,0 +1,63 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import { addSeconds } from 'date-fns';
+
+import type ApiService from 'vault/services/api';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type { HTMLElementEvent } from 'vault/forms';
+import type { ReadWrappingPropertiesResponse } from '@hashicorp/vault-client-typescript';
+
+/**
+ * @module ToolsLookup
+ * ToolsLookup components are components that sys/wrapping/lookup functionality.
+ *
+ * @example
+ * <Tools::Lookup />
+ */
+export default class ToolsLookup extends Component {
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+
+  @tracked token = '';
+  @tracked lookupData: ReadWrappingPropertiesResponse | null = null;
+  @tracked errorMessage = '';
+
+  @action
+  reset() {
+    this.token = '';
+    this.lookupData = null;
+    this.errorMessage = '';
+  }
+
+  get expirationDate() {
+    if (this.lookupData) {
+      const { creation_time, creation_ttl } = this.lookupData;
+      if (creation_time && creation_ttl) {
+        // returns new Date with seconds added.
+        return addSeconds(creation_time, Number(creation_ttl));
+      }
+    }
+    return null;
+  }
+
+  @action
+  async handleSubmit(evt: HTMLElementEvent<HTMLFormElement>) {
+    evt.preventDefault();
+    const payload = { token: this.token.trim() };
+    try {
+      const data = await this.api.sys.readWrappingProperties(payload);
+      this.lookupData = data;
+      this.flashMessages.success('Lookup was successful.');
+    } catch (e) {
+      const { message } = await this.api.parseError(e);
+      this.errorMessage = message;
+    }
+  }
+}
diff --git a/ui/app/components/tools/random.hbs b/ui/app/components/tools/random.hbs
new file mode 100644
index 00000000000..df24057c462
--- /dev/null
+++ b/ui/app/components/tools/random.hbs
@@ -0,0 +1,66 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      Random Bytes
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+{{#if this.randomBytes}}
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <label for="rand" class="is-label">Random bytes</label>
+    <Hds::Copy::Snippet
+      @textToCopy={{this.randomBytes}}
+      @color="secondary"
+      data-test-tools-input="random-bytes"
+      @onError={{fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")}}
+    />
+  </div>
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <Hds::Button @text="Done" @color="secondary" {{on "click" this.reset}} data-test-button="Done" />
+  </div>
+{{else}}
+  <form {{on "submit" this.handleSubmit}}>
+    <div class="box is-sideless is-fullwidth is-marginless">
+      <MessageError @errorMessage={{this.errorMessage}} />
+      <div class="field is-horizontal">
+        <div class="field-body">
+          <div class="field">
+            <label for="bytes" class="is-label">
+              Number of bytes
+            </label>
+            <div class="control">
+              <Input id="bytes" class="input" @value={{this.bytes}} @type="number" data-test-tools-input="bytes" />
+            </div>
+          </div>
+          <div class="field">
+            <label for="format" class="is-label">
+              Output format
+            </label>
+            <div class="control is-expanded">
+              <div class="select is-fullwidth">
+                <select name="format" id="format" {{on "input" this.handleSelect}}>
+                  {{#each (array "base64" "hex") as |formatOption|}}
+                    <option selected={{eq this.format formatOption}} value={{formatOption}}>
+                      {{formatOption}}
+                    </option>
+                  {{/each}}
+                </select>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      <div class="control">
+        <Hds::Button @text="Generate" type="submit" data-test-submit />
+      </div>
+    </div>
+  </form>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/tools/random.ts b/ui/app/components/tools/random.ts
new file mode 100644
index 00000000000..490f3670b92
--- /dev/null
+++ b/ui/app/components/tools/random.ts
@@ -0,0 +1,58 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+
+import type ApiService from 'vault/services/api';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type { HTMLElementEvent } from 'vault/forms';
+
+/**
+ * @module ToolsRandom
+ * ToolsRandom components are components that perform sys/wrapping/random functionality.
+ * @example
+ * <Tools::Random />
+ */
+
+export default class ToolsRandom extends Component {
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+
+  @tracked bytes = 32;
+  @tracked format = 'base64';
+  @tracked randomBytes = '';
+  @tracked errorMessage = '';
+
+  @action
+  reset() {
+    this.bytes = 32;
+    this.format = 'base64';
+    this.randomBytes = '';
+    this.errorMessage = '';
+  }
+
+  @action
+  handleSelect(evt: HTMLElementEvent<HTMLSelectElement>) {
+    const { value } = evt.target;
+    this.format = value;
+  }
+
+  @action
+  async handleSubmit(evt: HTMLElementEvent<HTMLFormElement>) {
+    evt.preventDefault();
+    const data = { bytes: Number(this.bytes), format: this.format };
+    try {
+      const { random_bytes } = await this.api.sys.generateRandom(data);
+      this.randomBytes = random_bytes || '';
+      this.flashMessages.success('Generated random bytes successfully.');
+    } catch (error) {
+      const { message } = await this.api.parseError(error);
+      this.errorMessage = message;
+    }
+  }
+}
diff --git a/ui/app/components/tools/rewrap.hbs b/ui/app/components/tools/rewrap.hbs
new file mode 100644
index 00000000000..ab28289a263
--- /dev/null
+++ b/ui/app/components/tools/rewrap.hbs
@@ -0,0 +1,56 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      Rewrap Token
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+{{#if this.rewrappedToken}}
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <div class="field">
+      <label class="is-label">Rewrapped token</label>
+      <Hds::Copy::Snippet
+        @textToCopy={{this.rewrappedToken}}
+        @color="secondary"
+        data-test-tools-input="rewrapped-token"
+        @onError={{fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")}}
+      />
+    </div>
+  </div>
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <Hds::Button @text="Done" @color="secondary" {{on "click" this.reset}} data-test-button="Done" />
+  </div>
+{{else}}
+  <form {{on "submit" this.handleSubmit}}>
+    <div class="box is-sideless is-fullwidth is-marginless">
+      <NamespaceReminder @mode="perform" @noun="rewrap" />
+      <MessageError @errorMessage={{this.errorMessage}} />
+      <div class="field">
+        <label for="token" class="is-label">Wrapped token</label>
+        <div class="has-text-grey is-size-8 has-bottom-margin-xs">
+          Enter your wrapped token here to rewrap it and refresh its TTL.
+        </div>
+        <div class="control">
+          <Input
+            @value={{this.originalToken}}
+            class="input"
+            id="token"
+            name="token"
+            data-test-tools-input="original-token"
+          />
+        </div>
+      </div>
+    </div>
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      <div class="control">
+        <Hds::Button @text="Rewrap token" type="submit" data-test-submit />
+      </div>
+    </div>
+  </form>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/tools/rewrap.ts b/ui/app/components/tools/rewrap.ts
new file mode 100644
index 00000000000..759a7a12141
--- /dev/null
+++ b/ui/app/components/tools/rewrap.ts
@@ -0,0 +1,52 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+
+import type ApiService from 'vault/services/api';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type { HTMLElementEvent } from 'vault/forms';
+
+/**
+ * @module ToolsRewrap
+ * ToolsRewrap components are components that sys/wrapping/rewrap functionality
+ *
+ * @example
+ * <Tools::Rewrap />
+ */
+
+export default class ToolsRewrap extends Component {
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+
+  @tracked originalToken = '';
+  @tracked rewrappedToken = '';
+  @tracked errorMessage = '';
+
+  @action
+  reset() {
+    this.originalToken = '';
+    this.rewrappedToken = '';
+    this.errorMessage = '';
+  }
+
+  @action
+  async handleSubmit(evt: HTMLElementEvent<HTMLFormElement>) {
+    evt.preventDefault();
+    const data = { token: this.originalToken.trim() };
+
+    try {
+      const { wrap_info } = await this.api.sys.rewrap(data);
+      this.rewrappedToken = wrap_info?.token || '';
+      this.flashMessages.success('Rewrap was successful.');
+    } catch (error) {
+      const { message } = await this.api.parseError(error);
+      this.errorMessage = message;
+    }
+  }
+}
diff --git a/ui/app/components/tools/unwrap.hbs b/ui/app/components/tools/unwrap.hbs
new file mode 100644
index 00000000000..d99433e69c3
--- /dev/null
+++ b/ui/app/components/tools/unwrap.hbs
@@ -0,0 +1,72 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      Unwrap Data
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+{{#if this.unwrapData}}
+  <Hds::Tabs as |T|>
+    <T.Tab data-test-tab="data">Data</T.Tab>
+    <T.Tab data-test-tab="details">Wrap Details</T.Tab>
+    <T.Panel>
+      <JsonEditor
+        class="has-top-padding-m"
+        @title="Unwrapped Data"
+        @value={{stringify this.unwrapData}}
+        @readOnly={{true}}
+      />
+    </T.Panel>
+    <T.Panel>
+      <div class="has-top-padding-m">
+        {{#each-in this.unwrapDetails as |key detail|}}
+          <InfoTableRow @label={{key}} @value={{detail}} />
+        {{/each-in}}
+      </div>
+    </T.Panel>
+  </Hds::Tabs>
+  <Hds::ButtonSet class="has-top-padding-m">
+    <Hds::Copy::Button
+      @text="Copy unwrapped data"
+      @textToCopy={{stringify this.unwrapData}}
+      @onError={{fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")}}
+      class="primary"
+    />
+    <Hds::Button {{on "click" this.reset}} @color="secondary" @text="Done" data-test-button="Done" />
+  </Hds::ButtonSet>
+{{else}}
+  <form {{on "submit" this.handleSubmit}}>
+    <div class="box is-sideless is-fullwidth is-marginless">
+      <NamespaceReminder @mode="perform" @noun="unwrap" />
+      <MessageError @errorMessage={{this.errorMessage}} />
+      <div class="field">
+        <label for="token" class="is-label">Wrapped token</label>
+        <div class="has-text-grey is-size-8 has-bottom-margin-xs">
+          Enter your wrapped token here to unwrap it and return its original value.
+        </div>
+        <div class="control">
+          <Input
+            @value={{this.token}}
+            class="input"
+            id="token"
+            name="token"
+            autocomplete="off"
+            spellcheck="false"
+            data-test-tools-input="unwrap-token"
+          />
+        </div>
+      </div>
+    </div>
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      <div class="control">
+        <Hds::Button @text="Unwrap data" type="submit" data-test-submit />
+      </div>
+    </div>
+  </form>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/tools/unwrap.ts b/ui/app/components/tools/unwrap.ts
new file mode 100644
index 00000000000..ff5eeab4269
--- /dev/null
+++ b/ui/app/components/tools/unwrap.ts
@@ -0,0 +1,60 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+
+import type ApiService from 'vault/services/api';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type { HTMLElementEvent } from 'vault/forms';
+
+/**
+ * @module ToolsUnwrap
+ * ToolsUnwrap components are components that sys/wrapping/rewrap functionality
+ *
+ * @example
+ * <Tools::Unwrap />
+ */
+
+export default class ToolsUnwrap extends Component {
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+
+  @tracked token = '';
+  @tracked unwrapData: unknown = '';
+  @tracked unwrapDetails = {};
+  @tracked errorMessage = '';
+
+  @action
+  reset() {
+    this.token = '';
+    this.unwrapData = '';
+    this.unwrapDetails = {};
+    this.errorMessage = '';
+  }
+
+  @action
+  async handleSubmit(evt: HTMLElementEvent<HTMLFormElement>) {
+    evt.preventDefault();
+    const data = { token: this.token.trim() };
+
+    try {
+      const resp = await this.api.sys.unwrap(data);
+      this.unwrapData = (resp && resp.data) || resp.auth;
+      this.unwrapDetails = {
+        'Request ID': resp.request_id,
+        'Lease ID': resp.lease_id || 'None',
+        Renewable: resp.renewable,
+        'Lease Duration': resp.lease_duration || 'None',
+      };
+      this.flashMessages.success('Unwrap was successful.');
+    } catch (error) {
+      const { message } = await this.api.parseError(error);
+      this.errorMessage = message;
+    }
+  }
+}
diff --git a/ui/app/components/tools/wrap.hbs b/ui/app/components/tools/wrap.hbs
new file mode 100644
index 00000000000..f215c8cb9af
--- /dev/null
+++ b/ui/app/components/tools/wrap.hbs
@@ -0,0 +1,89 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      Wrap Data
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+{{#if this.token}}
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <div class="field">
+      <label for="wrap-info" class="is-label">Wrapped token</label>
+      <Hds::Copy::Snippet
+        @textToCopy={{this.token}}
+        @color="secondary"
+        data-test-tools-input="wrapping-token"
+        @onError={{fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")}}
+      />
+    </div>
+  </div>
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <Hds::ButtonSet>
+      <Hds::Button
+        @icon="arrow-left"
+        @text="Back"
+        @color="tertiary"
+        {{on "click" (fn this.reset false)}}
+        data-test-button="Back"
+      />
+      <Hds::Button @text="Done" @color="secondary" {{on "click" this.reset}} data-test-button="Done" />
+    </Hds::ButtonSet>
+  </div>
+{{else}}
+  <form {{on "submit" this.handleSubmit}}>
+    <div class="box is-sideless is-fullwidth is-marginless">
+      <NamespaceReminder @mode="perform" @noun="wrap" />
+      <MessageError @errorMessage={{this.errorMessage}} />
+      <Toolbar>
+        <ToolbarFilters>
+          <Toggle @name="json" @checked={{this.showJson}} @onChange={{this.handleToggle}}>
+            <span class="has-text-grey">JSON</span>
+          </Toggle>
+        </ToolbarFilters>
+      </Toolbar>
+      {{#if this.showJson}}
+        <JsonEditor
+          class="has-top-margin-s"
+          @title="Data to wrap"
+          @helpText="json-formatted"
+          @value={{this.stringifiedWrapData}}
+          @valueUpdated={{this.editorUpdated}}
+        />
+      {{else}}
+        <KvObjectEditor
+          class="has-top-margin-l"
+          @label="Data to wrap"
+          @value={{this.wrapData}}
+          @onChange={{fn (mut this.wrapData)}}
+          @warnNonStringValues={{true}}
+        />
+      {{/if}}
+      <TtlPicker
+        @label="Wrap TTL"
+        @initialValue="30m"
+        @onChange={{this.updateTtl}}
+        @helperTextDisabled="Vault will use the default (30m)"
+        @helperTextEnabled="Wrap will expire after"
+        @changeOnInit={{true}}
+      />
+      {{#if this.hasLintingErrors}}
+        <AlertInline
+          @color="warning"
+          class="has-top-padding-s"
+          @message="JSON is unparsable. Fix linting errors to avoid data discrepancies."
+        />
+      {{/if}}
+    </div>
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      <div class="control">
+        <Hds::Button @text="Wrap data" type="submit" data-test-submit />
+      </div>
+    </div>
+  </form>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/tools/wrap.ts b/ui/app/components/tools/wrap.ts
new file mode 100644
index 00000000000..8d5f327eea2
--- /dev/null
+++ b/ui/app/components/tools/wrap.ts
@@ -0,0 +1,96 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import { stringify } from 'core/helpers/stringify';
+
+import type ApiService from 'vault/services/api';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type { TtlEvent } from 'vault/app-types';
+import type { HTMLElementEvent } from 'vault/forms';
+
+/**
+ * @module ToolsWrap
+ * ToolsWrap components are components that sys/wrapping/wrap functionality.
+ *
+ * @example
+ * <Tools::Wrap />
+ */
+
+export default class ToolsWrap extends Component {
+  @service declare readonly api: ApiService;
+  @service declare readonly flashMessages: FlashMessageService;
+
+  @tracked hasLintingErrors = false;
+  @tracked token = '';
+  @tracked wrapTTL = '';
+  @tracked wrapData = null;
+  @tracked errorMessage = '';
+  @tracked showJson = true;
+
+  get startingValue() {
+    // must pass the third param called "space" in JSON.stringify to structure object with whitespace
+    // otherwise the following codemirror modifier check will pass `this._editor.getValue() !== namedArgs.content` and _setValue will be called.
+    // the method _setValue moves the cursor to the beginning of the text field.
+    // the effect is that the cursor jumps after the first key input.
+    return stringify([{ '': '' }], { skipFormat: false });
+  }
+
+  get stringifiedWrapData() {
+    return this.wrapData ? stringify([this.wrapData], { skipFormat: false }) : this.startingValue;
+  }
+
+  @action
+  handleToggle() {
+    this.showJson = !this.showJson;
+    this.hasLintingErrors = false;
+  }
+
+  @action
+  reset(clearData = true) {
+    this.token = '';
+    this.errorMessage = '';
+    this.wrapTTL = '';
+    this.hasLintingErrors = false;
+    if (clearData) this.wrapData = null;
+  }
+
+  @action
+  updateTtl(evt: TtlEvent) {
+    if (!evt) return;
+    this.wrapTTL = evt.enabled ? `${evt.seconds}s` : '30m';
+  }
+
+  @action
+  editorUpdated(val: string) {
+    this.hasLintingErrors = false;
+
+    try {
+      this.wrapData = JSON.parse(val);
+    } catch {
+      this.hasLintingErrors = true;
+    }
+  }
+
+  @action
+  async handleSubmit(evt: HTMLElementEvent<HTMLFormElement>) {
+    evt.preventDefault();
+
+    const data = this.wrapData || {};
+    const wrap = this.wrapTTL || '';
+
+    try {
+      const { wrap_info } = await this.api.sys.wrap(data, this.api.buildHeaders({ wrap }));
+      this.token = wrap_info?.token || '';
+      this.flashMessages.success('Wrap was successful.');
+    } catch (error) {
+      const { message } = await this.api.parseError(error);
+      this.errorMessage = message;
+    }
+  }
+}
diff --git a/ui/app/components/totp-edit.hbs b/ui/app/components/totp-edit.hbs
new file mode 100644
index 00000000000..3dd1288c096
--- /dev/null
+++ b/ui/app/components/totp-edit.hbs
@@ -0,0 +1,43 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.top>
+    <KeyValueHeader
+      @baseKey={{@model}}
+      @path="vault.cluster.secrets.backend.list"
+      @mode={{@mode}}
+      @root={{@root}}
+      @showCurrent={{true}}
+    />
+  </p.top>
+  <p.levelLeft>
+    <h1 class="title is-3" data-test-secret-header>
+      {{#if (eq @mode "create")}}
+        Create a TOTP key
+      {{else}}
+        TOTP key
+        <code>{{@model.id}}</code>
+      {{/if}}
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+{{#if (eq @mode "show")}}
+  <Totp::KeyDetails @model={{@model}} @onDelete={{this.deleteKey}} />
+{{else if (eq @mode "create")}}
+  {{#if this.hasGenerated}}
+    <Totp::KeyQrCode @model={{@model}} @onReset={{this.reset}} />
+  {{else}}
+    <Totp::KeyCreate
+      @onSubmit={{this.createKey}}
+      @model={{@model}}
+      @defaultKeyFormFields={{this.defaultKeyFormFields}}
+      @groups={{this.groups}}
+      @modelValidations={{this.modelValidations}}
+      @invalidFormAlert={{this.invalidFormAlert}}
+    />
+  {{/if}}
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/totp-edit.js b/ui/app/components/totp-edit.js
new file mode 100644
index 00000000000..bd0621cb219
--- /dev/null
+++ b/ui/app/components/totp-edit.js
@@ -0,0 +1,112 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import { service } from '@ember/service';
+import { task } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+import errorMessage from 'vault/utils/error-message';
+
+/**
+ * @module TotpEdit
+ * `TotpEdit` is a component that allows you to create, view or delete a TOTP key.
+ * When creating a key if `generate` and `exported` are true then after a successful save the UI renders a QR code for the generated key.
+ * @example
+ *   <TotpEdit @model={{this.model}} @mode={{this.mode}} />
+ *
+ * @param {object} model - The totp key ember data model.
+ * @param {string} mode - The mode to render. Either 'create' or 'show'.
+ */
+const LIST_ROOT_ROUTE = 'vault.cluster.secrets.backend.list-root';
+const SHOW_ROUTE = 'vault.cluster.secrets.backend.show';
+
+export default class TotpEdit extends Component {
+  @service router;
+  @service flashMessages;
+
+  @tracked hasGenerated = false;
+  @tracked invalidFormAlert = '';
+  @tracked modelValidations;
+
+  successCallback;
+
+  get defaultKeyFormFields() {
+    const shared = ['name', 'generate', 'issuer', 'accountName'];
+    const generated = [...shared, 'exported'];
+    const nonGenerated = [...shared, 'url', 'key'];
+    return this.args.model.generate ? generated : nonGenerated;
+  }
+
+  get groups() {
+    const { generate } = this.args.model;
+
+    const groups = {
+      'TOTP Code Options': ['algorithm', 'digits', 'period'],
+    };
+
+    if (generate) {
+      groups['Provider Options'] = ['keySize', 'skew', 'qrSize'];
+    }
+
+    return groups;
+  }
+
+  transitionToRoute() {
+    this.router.transitionTo(...arguments);
+  }
+
+  @action
+  reset() {
+    const { name } = this.args.model;
+    this.args.model.unloadRecord();
+    this.transitionToRoute(SHOW_ROUTE, name);
+  }
+
+  @action
+  async deleteKey() {
+    try {
+      const { id } = this.args.model;
+      await this.args.model.destroyRecord();
+      this.transitionToRoute(LIST_ROOT_ROUTE);
+      this.flashMessages.success(`${id} was successfully deleted.`);
+    } catch (err) {
+      this.flashMessages.danger(errorMessage(err));
+    }
+  }
+
+  createKey = task(
+    waitFor(async (event) => {
+      event.preventDefault();
+      const { isValid, state, invalidFormMessage } = this.args.model.validate();
+      this.modelValidations = isValid ? null : state;
+      this.invalidFormAlert = invalidFormMessage;
+
+      if (!isValid) return;
+      try {
+        const allFields = [...this.defaultKeyFormFields, ...Object.values(this.groups).flat()];
+        await this.args.model.save({
+          adapterOptions: {
+            keyFormFields: allFields,
+          },
+        });
+        const { generate, exported } = this.args.model;
+
+        if (generate && exported) {
+          // stay in this template and show QR code returned from response
+          this.hasGenerated = true;
+        } else {
+          // nothing is returned from response, transition to key details route
+          this.transitionToRoute(SHOW_ROUTE, this.args.model.name);
+        }
+      } catch (err) {
+        // err will display via model state
+        return;
+      }
+      this.flashMessages.success('Successfully created key.');
+    })
+  );
+}
diff --git a/ui/app/components/totp/key-create-toggle-groups.hbs b/ui/app/components/totp/key-create-toggle-groups.hbs
new file mode 100644
index 00000000000..75b7df8db71
--- /dev/null
+++ b/ui/app/components/totp/key-create-toggle-groups.hbs
@@ -0,0 +1,31 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#each-in @groups as |group fields|}}
+  <ToggleButton
+    @isOpen={{eq this.showGroup group}}
+    @openLabel={{concat "Hide " group}}
+    @closedLabel={{group}}
+    @onClick={{fn this.toggleGroup group}}
+    class="is-block"
+    data-test-button={{group}}
+  />
+  {{#if (eq this.showGroup group)}}
+    <div class="box is-marginless" data-test-group={{group}}>
+      {{#each fields as |fieldName|}}
+        {{#let (find-by "name" fieldName @model.allFields) as |attr|}}
+          <FormField
+            data-test-field
+            @attr={{attr}}
+            @model={{@model}}
+            @showHelpText={{false}}
+            @modelValidations={{@modelValidations}}
+          />
+        {{/let}}
+      {{/each}}
+
+    </div>
+  {{/if}}
+{{/each-in}}
\ No newline at end of file
diff --git a/ui/app/components/totp/key-create-toggle-groups.js b/ui/app/components/totp/key-create-toggle-groups.js
new file mode 100644
index 00000000000..709556e086c
--- /dev/null
+++ b/ui/app/components/totp/key-create-toggle-groups.js
@@ -0,0 +1,17 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+
+export default class KeyCreateToggleGroupsComponent extends Component {
+  @tracked showGroup = null;
+
+  @action
+  toggleGroup(group, isOpen) {
+    this.showGroup = isOpen ? group : null;
+  }
+}
diff --git a/ui/app/components/totp/key-create.hbs b/ui/app/components/totp/key-create.hbs
new file mode 100644
index 00000000000..f9347cdb4e3
--- /dev/null
+++ b/ui/app/components/totp/key-create.hbs
@@ -0,0 +1,31 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" (perform @onSubmit)}}>
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <MessageError @model={{@model}} />
+    <NamespaceReminder @mode={{"create"}} @noun="TOTP key" />
+    {{#each @defaultKeyFormFields as |field|}}
+      {{#let (find-by "name" field @model.allFields) as |attr|}}
+        <FormField @attr={{attr}} @model={{@model}} @modelValidations={{@modelValidations}} />
+      {{/let}}
+    {{/each}}
+
+    <Totp::KeyCreateToggleGroups @model={{@model}} @modelValidations={{@modelValidations}} @groups={{@groups}} />
+  </div>
+  <Hds::ButtonSet class="has-top-bottom-margin-12">
+    <Hds::Button @text="Create key" type="submit" data-test-submit />
+    <Hds::Button
+      @text="Cancel"
+      @color="secondary"
+      @route="vault.cluster.secrets.backend.list-root"
+      @model={{@model.backend}}
+      @query={{hash tab="key"}}
+    />
+  </Hds::ButtonSet>
+  {{#if @invalidFormAlert}}
+    <AlertInline @type="danger" class="has-top-padding-s" @message={{@invalidFormAlert}} />
+  {{/if}}
+</form>
\ No newline at end of file
diff --git a/ui/app/components/totp/key-details.hbs b/ui/app/components/totp/key-details.hbs
new file mode 100644
index 00000000000..ee93348a1d8
--- /dev/null
+++ b/ui/app/components/totp/key-details.hbs
@@ -0,0 +1,28 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Toolbar>
+  <ToolbarActions>
+    <ToolbarLink @route="vault.cluster.secrets.backend.credentials" @model={{@model.id}}>
+      Generate code
+    </ToolbarLink>
+    {{#if @model.canDelete}}
+      <ConfirmAction
+        @buttonText="Delete key"
+        class="toolbar-button"
+        @buttonColor="secondary"
+        @onConfirmAction={{@onDelete}}
+      />
+    {{/if}}
+  </ToolbarActions>
+</Toolbar>
+<div class="box is-fullwidth is-sideless is-paddingless is-marginless" data-test-totp-key-details>
+  {{#each @model.attrs as |attr|}}
+    <InfoTableRow
+      @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+      @value={{get @model attr.name}}
+    />
+  {{/each}}
+</div>
\ No newline at end of file
diff --git a/ui/app/components/totp/key-qr-code.hbs b/ui/app/components/totp/key-qr-code.hbs
new file mode 100644
index 00000000000..8ddff4db307
--- /dev/null
+++ b/ui/app/components/totp/key-qr-code.hbs
@@ -0,0 +1,42 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="box is-fullwidth is-sideless is-paddingless is-marginless">
+  <MessageError @model={{@model}} />
+  {{#unless @model.isError}}
+    <Hds::Alert @type="inline" @color="warning" class="has-top-bottom-margin" data-test-warning as |A|>
+      <A.Title>Warning</A.Title>
+      <A.Description>
+        You will not be able to access this information later, so please copy the information below.
+      </A.Description>
+    </Hds::Alert>
+  {{/unless}}
+  {{#each @model.generatedAttrs as |attr|}}
+    <InfoTableRow
+      @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
+      @value={{get @model attr.name}}
+    />
+  {{/each}}
+  {{#if (gt @model.qrSize 0)}}
+    <div class="list-item-row">
+      <div class="center-display column">
+        <QrCode
+          @text={{@model.url}}
+          @colorLight="#F7F7F7"
+          @width={{@model.qrSize}}
+          @height={{@model.qrSize}}
+          @correctLevel="L"
+          data-test-qrcode
+        />
+      </div>
+    </div>
+  {{/if}}
+
+</div>
+<div class="field is-grouped box is-fullwidth is-bottomless">
+  <div class="control">
+    <Hds::Button @text="Continue" @color="secondary" {{on "click" @onReset}} data-test-back-button />
+  </div>
+</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/transform-advanced-templating.hbs b/ui/app/components/transform-advanced-templating.hbs
similarity index 98%
rename from ui/app/templates/components/transform-advanced-templating.hbs
rename to ui/app/components/transform-advanced-templating.hbs
index 58416536397..695d930fb65 100644
--- a/ui/app/templates/components/transform-advanced-templating.hbs
+++ b/ui/app/components/transform-advanced-templating.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <ToggleButton
   @isOpen={{this.showForm}}
diff --git a/ui/app/components/transform-advanced-templating.js b/ui/app/components/transform-advanced-templating.js
index 43d01255a52..18d0b923e25 100644
--- a/ui/app/components/transform-advanced-templating.js
+++ b/ui/app/components/transform-advanced-templating.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/transform-create-form.hbs b/ui/app/components/transform-create-form.hbs
similarity index 92%
rename from ui/app/templates/components/transform-create-form.hbs
rename to ui/app/components/transform-create-form.hbs
index e6ff90067c6..b9de8b90e07 100644
--- a/ui/app/templates/components/transform-create-form.hbs
+++ b/ui/app/components/transform-create-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form onsubmit={{action "createOrUpdate" "create"}}>
   <div class="box is-sideless is-fullwidth is-marginless">
@@ -13,7 +13,7 @@
   </div>
   <div class="field is-grouped-split box is-fullwidth is-bottomless">
     <Hds::ButtonSet>
-      <Hds::Button @text="Create transformation" type="submit" data-test-transform-create />
+      <Hds::Button @text="Create transformation" type="submit" data-test-submit />
       <Hds::Button
         @text="Cancel"
         @color="secondary"
diff --git a/ui/app/components/transform-create-form.js b/ui/app/components/transform-create-form.js
index efdd96008f6..480f2f8b1e1 100644
--- a/ui/app/components/transform-create-form.js
+++ b/ui/app/components/transform-create-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/transform-edit-base.js b/ui/app/components/transform-edit-base.js
index dbb182e7795..5dd3154545b 100644
--- a/ui/app/components/transform-edit-base.js
+++ b/ui/app/components/transform-edit-base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -27,6 +27,9 @@ export const removeFromList = (list, itemToRemove) => {
   return newList.uniq();
 };
 
+/**
+ * @type Class
+ */
 export default Component.extend(FocusOnInsertMixin, {
   store: service(),
   flashMessages: service(),
diff --git a/ui/app/templates/components/transform-edit-form.hbs b/ui/app/components/transform-edit-form.hbs
similarity index 93%
rename from ui/app/templates/components/transform-edit-form.hbs
rename to ui/app/components/transform-edit-form.hbs
index 7bc2486e38c..22a81ddd989 100644
--- a/ui/app/templates/components/transform-edit-form.hbs
+++ b/ui/app/components/transform-edit-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form onsubmit={{action "createOrUpdate" "create"}}>
   <div class="box is-sideless is-fullwidth is-marginless">
@@ -44,7 +44,7 @@
   </div>
   <div class="field is-grouped-split box is-fullwidth is-bottomless">
     <Hds::ButtonSet>
-      <Hds::Button @text="Save" type="submit" data-test-transformation-save-button />
+      <Hds::Button @text="Save" type="submit" data-test-submit />
       <Hds::Button
         @text="Cancel"
         @color="secondary"
diff --git a/ui/app/components/transform-edit-form.js b/ui/app/components/transform-edit-form.js
index efdd96008f6..aecf0316fb9 100644
--- a/ui/app/components/transform-edit-form.js
+++ b/ui/app/components/transform-edit-form.js
@@ -1,8 +1,8 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import TransformationEdit from './transformation-edit';
 
-export default TransformationEdit.extend({});
+export default TransformationEdit.extend();
diff --git a/ui/app/templates/components/transform-role-edit.hbs b/ui/app/components/transform-role-edit.hbs
similarity index 92%
rename from ui/app/templates/components/transform-role-edit.hbs
rename to ui/app/components/transform-role-edit.hbs
index 5ac7c69253e..ea7c6bfe870 100644
--- a/ui/app/templates/components/transform-role-edit.hbs
+++ b/ui/app/components/transform-role-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -30,7 +30,7 @@
 {{#if (eq this.mode "show")}}
   <Toolbar>
     <ToolbarActions>
-      {{#if this.capabilities.canDelete}}
+      {{#if this.model.updatePath.canDelete}}
         <ConfirmAction
           @buttonText="Delete role"
           class="toolbar-button"
@@ -41,7 +41,7 @@
         />
         <div class="toolbar-separator"></div>
       {{/if}}
-      {{#if this.capabilities.canUpdate}}
+      {{#if this.model.updatePath.canUpdate}}
         <ToolbarSecretLink
           @secret={{concat this.model.idPrefix this.model.id}}
           @mode="edit"
@@ -70,11 +70,7 @@
     </div>
     <div class="field is-grouped-split box is-fullwidth is-bottomless">
       <Hds::ButtonSet>
-        <Hds::Button
-          @text={{if (eq this.mode "create") "Create role" "Save"}}
-          type="submit"
-          data-test-role-transform-create
-        />
+        <Hds::Button @text={{if (eq this.mode "create") "Create role" "Save"}} type="submit" data-test-submit />
         {{#if (eq this.mode "create")}}
           <Hds::Button
             @text="Cancel"
diff --git a/ui/app/components/transform-role-edit.js b/ui/app/components/transform-role-edit.js
index 9943587e5aa..e839619d3e8 100644
--- a/ui/app/components/transform-role-edit.js
+++ b/ui/app/components/transform-role-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/transform-show-transformation.hbs b/ui/app/components/transform-show-transformation.hbs
similarity index 98%
rename from ui/app/templates/components/transform-show-transformation.hbs
rename to ui/app/components/transform-show-transformation.hbs
index 19c399b0a1c..4676b2715f3 100644
--- a/ui/app/templates/components/transform-show-transformation.hbs
+++ b/ui/app/components/transform-show-transformation.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
   {{#each this.model.transformFieldAttrs as |attr|}}
diff --git a/ui/app/components/transform-show-transformation.js b/ui/app/components/transform-show-transformation.js
index 0a574f35ac9..d5206fc591e 100644
--- a/ui/app/components/transform-show-transformation.js
+++ b/ui/app/components/transform-show-transformation.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/transform-template-edit.hbs b/ui/app/components/transform-template-edit.hbs
new file mode 100644
index 00000000000..7b6cae1517d
--- /dev/null
+++ b/ui/app/components/transform-template-edit.hbs
@@ -0,0 +1,121 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.top>
+    <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
+  </p.top>
+  <p.levelLeft>
+    <h1 class="title is-3" data-test-secret-header="true">
+      {{#if (eq @mode "create")}}
+        Create Template
+      {{else if (eq @mode "edit")}}
+        Edit Template
+      {{else}}
+        Template
+        <code>{{@model.id}}</code>
+      {{/if}}
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+{{#if (eq @mode "show")}}
+  <Toolbar>
+    <ToolbarActions>
+      {{#if @model.updatePath.canDelete}}
+        <Hds::Button @text="Delete template" @color="secondary" class="toolbar-button" {{on "click" this.onDelete}} />
+        <div class="toolbar-separator"></div>
+      {{/if}}
+      {{#if @model.updatePath.canUpdate}}
+        <ToolbarLink @route="vault.cluster.secrets.backend.edit" @model={{concat "template/" @model.id}} data-test-edit-link>
+          Edit template
+        </ToolbarLink>
+      {{/if}}
+    </ToolbarActions>
+  </Toolbar>
+{{/if}}
+
+{{#if (or (eq @mode "edit") (eq @mode "create"))}}
+  <form onsubmit={{this.createOrUpdate}}>
+    <div class="box is-sideless is-fullwidth is-marginless">
+      <NamespaceReminder @mode={{@mode}} @noun="transform template" />
+      <MessageError @errorMessage={{this.errorMessage}} />
+      {{#each @model.writeAttrs as |attr|}}
+        {{#if (and (eq attr.name "name") (eq @mode "edit"))}}
+          <label for={{attr.name}} class="is-label">
+            {{attr.options.label}}
+          </label>
+          {{#if attr.options.subText}}
+            <p class="sub-text">{{attr.options.subText}}</p>
+          {{/if}}
+          <input
+            data-test-input={{attr.name}}
+            id={{attr.name}}
+            autocomplete="off"
+            spellcheck="false"
+            value={{or (get @model attr.name) attr.options.defaultValue}}
+            readonly={{true}}
+            class="field input is-readOnly"
+            type={{attr.type}}
+          />
+        {{else}}
+          {{#if (eq attr.name "alphabet")}}
+            <TransformAdvancedTemplating @model={{@model}} />
+          {{/if}}
+          <FormField data-test-field @attr={{attr}} @model={{@model}} />
+        {{/if}}
+      {{/each}}
+    </div>
+    <div class="field is-grouped-split box is-fullwidth is-bottomless">
+      <Hds::ButtonSet>
+        <Hds::Button @text={{if (eq @mode "create") "Create template" "Save"}} type="submit" data-test-submit />
+        {{#if (eq @mode "create")}}
+          <Hds::Button
+            @text="Cancel"
+            @color="secondary"
+            @route="vault.cluster.secrets.backend.list-root"
+            @model={{@model.backend}}
+            @query={{hash tab="template"}}
+          />
+        {{else}}
+          <Hds::Button
+            @text="Cancel"
+            @color="secondary"
+            @route="vault.cluster.secrets.backend.show"
+            @models={{array @model.backend (concat "template/" @model.id)}}
+            @query={{hash tab="template"}}
+          />
+        {{/if}}
+      </Hds::ButtonSet>
+    </div>
+  </form>
+{{else}}
+  <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
+    {{#each @model.readAttrs as |attr|}}
+      {{#let (capitalize (or attr.options.label (humanize (dasherize attr.name)))) as |label|}}
+        {{#if (eq attr.name "decodeFormats")}}
+          {{#if (not (is-empty-value @model.decodeFormats))}}
+            <InfoTableRow @label={{label}}>
+              <div>
+                {{#each-in @model.decodeFormats as |key value|}}
+                  <div class="transform-decode-formats">
+                    <p class="is-label has-text-grey-light">{{key}}</p>
+                    <p>{{value}}</p>
+                  </div>
+                {{/each-in}}
+              </div>
+            </InfoTableRow>
+          {{/if}}
+        {{else}}
+          <InfoTableRow
+            @label={{label}}
+            @value={{get @model attr.name}}
+            class={{if (eq attr.name "pattern") "transform-pattern-text"}}
+          />
+        {{/if}}
+      {{/let}}
+    {{/each}}
+  </div>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/transform-template-edit.js b/ui/app/components/transform-template-edit.js
index a0c0bda47f2..0ab9c85acb3 100644
--- a/ui/app/components/transform-template-edit.js
+++ b/ui/app/components/transform-template-edit.js
@@ -1,8 +1,84 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import TransformBase from './transform-edit-base';
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import errorMessage from 'vault/utils/error-message';
 
-export default TransformBase.extend({});
+/**
+ * @module TransformTemplateEdit
+ * `TransformTemplateEdit` is a component that allows you to create/edit or view a transform template.
+ *
+ * @example
+ * ```js
+ *   <TransformTemplateEdit }} />
+ * ```
+ * @param {object} model - This is the transform template model.
+ * @param {string} mode - Is either show, create or edit.
+ */
+
+export default class TransformTemplateEditComponent extends Component {
+  @service flashMessages;
+  @service router;
+
+  @tracked errorMessage = '';
+
+  get breadcrumbs() {
+    // ideally this is created on the controller in the parent route but this is a generic route and adding breadcrumbs to the controller requires a larger refactor.
+    const { backend } = this.args.model;
+    return [
+      {
+        label: backend,
+        route: 'vault.cluster.secrets.backend.list-root',
+        model: backend,
+        query: { tab: 'template' },
+      },
+      { label: 'Template' },
+    ];
+  }
+
+  transition(route = 'show') {
+    this.errorMessage = '';
+    const { backend, id } = this.args.model;
+    if (route === 'list') {
+      this.router.transitionTo('vault.cluster.secrets.backend.list-root', backend, {
+        queryParams: { tab: 'template' },
+      });
+      return;
+    } else {
+      this.router.transitionTo('vault.cluster.secrets.backend.show', `template/${id}`);
+    }
+  }
+
+  @action async createOrUpdate(event) {
+    event.preventDefault();
+
+    if (!this.args.model.hasDirtyAttributes) {
+      this.flashMessages.info('No changes detected.');
+      this.transition();
+      return;
+    }
+
+    try {
+      await this.args.model.save();
+      this.flashMessages.success('Transform template saved.');
+      this.transition();
+    } catch (e) {
+      this.errorMessage = errorMessage(e);
+    }
+  }
+
+  @action async onDelete() {
+    try {
+      await this.args.model.destroyRecord();
+      this.flashMessages.success('Transform template deleted.');
+      this.transition('list');
+    } catch (e) {
+      this.errorMessage = errorMessage(e);
+    }
+  }
+}
diff --git a/ui/app/templates/components/transformation-edit.hbs b/ui/app/components/transformation-edit.hbs
similarity index 78%
rename from ui/app/templates/components/transformation-edit.hbs
rename to ui/app/components/transformation-edit.hbs
index c4d54157a14..7951437d2c9 100644
--- a/ui/app/templates/components/transformation-edit.hbs
+++ b/ui/app/components/transformation-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
+Copyright IBM Corp. 2016, 2025
+SPDX-License-Identifier: BUSL-1.1
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -30,24 +30,17 @@
 {{#if (eq this.mode "show")}}
   <Toolbar>
     <ToolbarActions>
-      {{#if this.capabilities.canDelete}}
+      {{#if this.model.updatePath.canDelete}}
         {{#if (gt this.model.allowed_roles.length 0)}}
-          <ToolTip @verticalPosition="above" @horizontalPosition="center" as |T|>
-            <T.Trigger @tabindex="-1">
-              <Hds::Button
-                @text="Delete transformation"
-                @color="secondary"
-                class="toolbar-button"
-                aria-disabled="true"
-                disabled
-              />
-            </T.Trigger>
-            <T.Content @defaultClass="tool-tip">
-              <div class="box">
-                This transformation is in use by a role and can’t be deleted.
-              </div>
-            </T.Content>
-          </ToolTip>
+          <Hds::TooltipButton @text="This transformation is in use by a role and can't be deleted.">
+            <Hds::Button
+              @text="Delete transformation"
+              @color="secondary"
+              class="toolbar-button"
+              aria-disabled="true"
+              disabled
+            />
+          </Hds::TooltipButton>
         {{else}}
           <Hds::Button
             @text="Delete transformation"
@@ -58,7 +51,7 @@
         {{/if}}
         <div class="toolbar-separator"></div>
       {{/if}}
-      {{#if this.capabilities.canUpdate}}
+      {{#if this.model.updatePath.canUpdate}}
         {{#if (gt this.model.allowed_roles.length 0)}}
           <Hds::Button
             @text="Edit transformation"
@@ -109,7 +102,7 @@
     </M.Header>
     <M.Body>
       <p>
-        You’re editing a transformation that is in use by at least one role. Editing it may mean that encode and decode
+        You're editing a transformation that is in use by at least one role. Editing it may mean that encode and decode
         operations stop working. Are you sure?
       </p>
     </M.Body>
diff --git a/ui/app/components/transformation-edit.js b/ui/app/components/transformation-edit.js
index edf33b3e453..0ca9598045d 100644
--- a/ui/app/components/transformation-edit.js
+++ b/ui/app/components/transformation-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,30 +17,12 @@ export default TransformBase.extend({
     this.set('initialRoles', this.model.allowed_roles);
   },
 
-  updateOrCreateRole(role, transformationId, backend) {
-    return this.store
+  async updateOrCreateRole(role, transformationId, backend) {
+    const roleRecord = await this.store
       .queryRecord('transform/role', {
         backend,
         id: role.id,
       })
-      .then((roleStore) => {
-        let transformations = roleStore.transformations;
-        if (role.action === 'ADD') {
-          transformations = addToList(transformations, transformationId);
-        } else if (role.action === 'REMOVE') {
-          transformations = removeFromList(transformations, transformationId);
-        }
-        roleStore.setProperties({
-          backend,
-          transformations,
-        });
-        return roleStore.save().catch((e) => {
-          return {
-            errorStatus: e.httpStatus,
-            ...role,
-          };
-        });
-      })
       .catch((e) => {
         if (e.httpStatus !== 403 && role.action === 'ADD') {
           // If role doesn't yet exist, create it with this transformation attached
@@ -64,29 +46,45 @@ export default TransformBase.extend({
           errorStatus: e.httpStatus,
         };
       });
+    // if an error occurs while querying the role, exit function and return the error
+    if (roleRecord.errorStatus) return roleRecord;
+    // otherwise update the role with the transformation and save
+    let transformations = roleRecord.transformations;
+    if (role.action === 'ADD') {
+      transformations = addToList(transformations, transformationId);
+    } else if (role.action === 'REMOVE') {
+      transformations = removeFromList(transformations, transformationId);
+    }
+    roleRecord.setProperties({
+      backend,
+      transformations,
+    });
+    return roleRecord.save().catch((e) => {
+      return {
+        errorStatus: e.httpStatus,
+        ...role,
+      };
+    });
   },
 
   handleUpdateRoles(updateRoles, transformationId) {
     if (!updateRoles) return;
-    const backend = this.model.backend;
-    const promises = updateRoles.map((r) => this.updateOrCreateRole(r, transformationId, backend));
-
-    Promise.all(promises).then((results) => {
-      const hasError = results.find((role) => !!role.errorStatus);
-
-      if (hasError) {
-        let message =
-          'The edits to this transformation were successful, but transformations for its roles was not edited due to a lack of permissions.';
-        if (results.find((e) => !!e.errorStatus && e.errorStatus !== 403)) {
-          // if the errors weren't all due to permissions show generic message
-          // eg. trying to update a role with empty array as transformations
-          message = `You've edited the allowed_roles for this transformation. However, the corresponding edits to some roles' transformations were not made`;
-        }
-        this.flashMessages.info(message, {
-          sticky: true,
-          priority: 300,
-        });
+    const { backend } = this.model;
+    updateRoles.forEach(async (record) => {
+      // For each role that needs to be updated, update the role with the transformation.
+      const updateOrCreateResponse = await this.updateOrCreateRole(record, transformationId, backend);
+      // If an error was returned, check error type and show a message.
+      const errorStatus = updateOrCreateResponse?.errorStatus;
+      let message;
+      if (errorStatus == 403) {
+        message = `The edits to this transformation were successful, but transformations for the role ${record.id} were not edited due to a lack of permissions.`;
+      } else if (errorStatus) {
+        message = `You've edited the allowed_roles for this transformation. However, there was a problem updating the role: ${record.id}.`;
       }
+      this.flashMessages.info(message, {
+        sticky: true,
+        priority: 300,
+      });
     });
   },
 
diff --git a/ui/app/templates/components/transit-edit.hbs b/ui/app/components/transit-edit.hbs
similarity index 80%
rename from ui/app/templates/components/transit-edit.hbs
rename to ui/app/components/transit-edit.hbs
index 8324e2db488..b2895282e81 100644
--- a/ui/app/templates/components/transit-edit.hbs
+++ b/ui/app/components/transit-edit.hbs
@@ -1,26 +1,20 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
-    <KeyValueHeader
-      @baseKey={{this.key}}
-      @path="vault.cluster.secrets.backend.list"
-      @mode={{this.mode}}
-      @root={{this.root}}
-      @showCurrent={{true}}
-    />
+    <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
     <h1 class="title is-3">
       {{#if (eq this.mode "create")}}
-        Create Encryption Key
+        Create Key
       {{else if (eq this.mode "edit")}}
-        Edit Encryption Key
+        Edit Key
       {{else}}
-        Encryption Key
+        Key
         <code>{{this.key.id}}</code>
       {{/if}}
     </h1>
@@ -35,6 +29,7 @@
     @derivedChange={{action "derivedChange" value="target.checked"}}
     @convergentEncryptionChange={{action "convergentEncryptionChange" value="target.checked"}}
     @key={{this.key}}
+    @errorMessage={{this.errorMessage}}
     @requestInFlight={{this.requestInFlight}}
   />
 {{else if (eq this.mode "edit")}}
@@ -46,14 +41,13 @@
     @deleteKey={{action "deleteKey"}}
     @key={{this.key}}
     @requestInFlight={{this.requestInFlight}}
-    @capabilities={{this.capabilities}}
+    @model={{this.model}}
   />
 {{else if (eq this.mode "show")}}
   <TransitFormShow
     @refresh={{action "refresh"}}
     @tab={{this.tab}}
     @key={{this.key}}
-    @capabilities={{this.capabilities}}
     @mode={{this.mode}}
     @model={{this.model}}
     @backend={{this.backend}}
diff --git a/ui/app/components/transit-edit.js b/ui/app/components/transit-edit.js
index 3c12ab04f6f..2c8183ae639 100644
--- a/ui/app/components/transit-edit.js
+++ b/ui/app/components/transit-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,7 @@ import { task, waitForEvent } from 'ember-concurrency';
 import { set } from '@ember/object';
 
 import FocusOnInsertMixin from 'vault/mixins/focus-on-insert';
-import keys from 'core/utils/key-codes';
+import keys from 'core/utils/keys';
 
 const LIST_ROOT_ROUTE = 'vault.cluster.secrets.backend.list-root';
 const SHOW_ROUTE = 'vault.cluster.secrets.backend.show';
@@ -22,6 +22,7 @@ export default Component.extend(FocusOnInsertMixin, {
   onDataChange() {},
   onRefresh() {},
   key: null,
+  errorMessage: '',
   autoRotateInvalid: false,
   requestInFlight: or('key.isLoading', 'key.isReloading', 'key.isSaving'),
 
@@ -32,6 +33,42 @@ export default Component.extend(FocusOnInsertMixin, {
     this._super(...arguments);
   },
 
+  get breadcrumbs() {
+    const baseCrumbs = [
+      {
+        label: 'Secrets',
+        route: 'vault.cluster.secrets',
+      },
+      {
+        label: this.key.backend,
+        route: 'vault.cluster.secrets.backend.list-root',
+        model: this.key.backend,
+      },
+    ];
+    if (this.mode === 'show') {
+      return [
+        ...baseCrumbs,
+        {
+          label: this.key.id,
+        },
+      ];
+    } else if (this.mode === 'edit') {
+      return [
+        ...baseCrumbs,
+        {
+          label: this.key.id,
+          route: 'vault.cluster.secrets.backend.show',
+          models: [this.key.backend, this.key.id],
+          query: { tab: 'details' },
+        },
+        { label: 'Edit' },
+      ];
+    } else if (this.mode === 'create') {
+      return [...baseCrumbs, { label: 'Create' }];
+    }
+    return baseCrumbs;
+  },
+
   waitForKeyUp: task(function* () {
     while (true) {
       const event = yield waitForEvent(document.body, 'keyup');
@@ -46,7 +83,8 @@ export default Component.extend(FocusOnInsertMixin, {
   },
 
   onEscape(e) {
-    if (e.keyCode !== keys.ESC || this.mode !== 'show') {
+    const isEscKeyPressed = keys.ESC.includes(e.key);
+    if (isEscKeyPressed || this.mode !== 'show') {
       return;
     }
     this.transitionToRoute(LIST_ROOT_ROUTE);
@@ -68,11 +106,14 @@ export default Component.extend(FocusOnInsertMixin, {
   actions: {
     createOrUpdateKey(type, event) {
       event.preventDefault();
+      // reset error message
+      set(this, 'errorMessage', '');
 
       const keyId = this.key.id || this.key.name;
-      // prevent from submitting if there's no key
-      // maybe do something fancier later
+
       if (type === 'create' && isBlank(keyId)) {
+        // manually set error message
+        set(this, 'errorMessage', 'Name is required.');
         return;
       }
 
diff --git a/ui/app/templates/components/transit-form-create.hbs b/ui/app/components/transit-form-create.hbs
similarity index 93%
rename from ui/app/templates/components/transit-form-create.hbs
rename to ui/app/components/transit-form-create.hbs
index 1485de2802c..22c8c5f5b4c 100644
--- a/ui/app/templates/components/transit-form-create.hbs
+++ b/ui/app/components/transit-form-create.hbs
@@ -1,11 +1,11 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form data-test-transit-create-form onsubmit={{@createOrUpdateKey}}>
   <div class="box is-sideless is-fullwidth is-marginless">
-    <MessageError @model={{@key}} />
+    <MessageError @model={{@key}} @errorMessage={{@errorMessage}} />
     <NamespaceReminder @mode="create" @noun="transit key" />
     <div class="field">
       <label for="key-name" class="is-label">Name</label>
@@ -126,13 +126,18 @@
   <div class="field is-grouped box is-fullwidth is-bottomless">
     <Hds::ButtonSet>
       <Hds::Button
-        @text="Create encryption key"
+        @text="Create key"
         @icon={{if @requestInFlight "loading"}}
         data-test-transit-key="create"
         type="submit"
         disabled={{@requestInFlight}}
       />
-      <Hds::Button @text="Cancel" @color="secondary" @route="vault.cluster.secrets.backend.list-root" />
+      <Hds::Button
+        @text="Cancel"
+        @color="secondary"
+        @model={{@key.backend}}
+        @route="vault.cluster.secrets.backend.list-root"
+      />
     </Hds::ButtonSet>
   </div>
 </form>
\ No newline at end of file
diff --git a/ui/app/templates/components/transit-form-edit.hbs b/ui/app/components/transit-form-edit.hbs
similarity index 94%
rename from ui/app/templates/components/transit-form-edit.hbs
rename to ui/app/components/transit-form-edit.hbs
index 1fe6df78ca7..71a42382c40 100644
--- a/ui/app/templates/components/transit-form-edit.hbs
+++ b/ui/app/components/transit-form-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form data-test-transit-edit-form onsubmit={{@createOrUpdateKey}}>
   <div class="box is-sideless is-fullwidth is-marginless">
@@ -50,7 +50,7 @@
         </div>
       </div>
       <p class="help">
-        The minimum decryption version required to reverse transformations performed with the encryption key. Results from
+        The minimum decryption version required to reverse transformations performed with the cryptographic key. Results from
         lower key versions may be rewrapped with the new key version using the
         <code>rewrap</code>
         action.
@@ -89,7 +89,7 @@
   </div>
   <div class="field is-grouped is-grouped-split box is-fullwidth is-bottomless">
     <div class="field is-grouped">
-      {{#if @capabilities.canUpdate}}
+      {{#if @model.canUpdate}}
         <div class="control">
           <Hds::Button
             @text="Update transit key"
@@ -104,12 +104,12 @@
           @text="Cancel"
           @color="secondary"
           @route="vault.cluster.secrets.backend.show"
-          @model={{@key.id}}
+          @models={{array @key.backend @key.id}}
           @query={{hash tab="details"}}
         />
       </div>
     </div>
-    {{#if (and @key.canDelete @capabilities.canDelete)}}
+    {{#if @model.canDelete}}
       <ConfirmAction @buttonText="Delete transit key" @onConfirmAction={{@deleteKey}} />
     {{/if}}
   </div>
diff --git a/ui/app/templates/components/transit-form-show.hbs b/ui/app/components/transit-form-show.hbs
similarity index 94%
rename from ui/app/templates/components/transit-form-show.hbs
rename to ui/app/components/transit-form-show.hbs
index a22f1b5162c..c6396de51ef 100644
--- a/ui/app/templates/components/transit-form-show.hbs
+++ b/ui/app/components/transit-form-show.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="tabs-container box is-sideless is-fullwidth is-paddingless is-marginless">
   <nav class="tabs" aria-label="navigation to manage transit backend">
@@ -10,6 +10,7 @@
         <SecretLink
           @secret={{@key.id}}
           @mode="show"
+          @backend={{@key.backend}}
           @replace={{true}}
           @queryParams={{hash tab="actions"}}
           data-test-transit-key-actions-link={{true}}
@@ -22,6 +23,7 @@
         <SecretLink
           @secret={{@key.id}}
           @mode="show"
+          @backend={{@key.backend}}
           @replace={{true}}
           @queryParams={{hash tab="details"}}
           data-test-transit-link="details"
@@ -34,6 +36,7 @@
         <SecretLink
           @secret={{@key.id}}
           @mode="show"
+          @backend={{@key.backend}}
           @replace={{true}}
           @queryParams={{hash tab="versions"}}
           data-test-transit-link="versions"
@@ -49,7 +52,7 @@
     <ToolbarActions>
       {{#if (and (eq @tab "versions") @key.canRotate)}}
         <ConfirmAction
-          @buttonText="Rotate encryption key"
+          @buttonText="Rotate key"
           class="toolbar-button"
           @buttonColor="secondary"
           @confirmTitle="Rotate this key?"
@@ -60,9 +63,9 @@
         />
       {{/if}}
       {{#if (eq @mode "show")}}
-        {{#if (or @capabilities.canUpdate @capabilities.canDelete)}}
-          <ToolbarSecretLink @secret={{@key.id}} @mode="edit" replace={{true}}>
-            Edit encryption key
+        {{#if (or @model.canUpdate @model.canDelete)}}
+          <ToolbarSecretLink @secret={{@key.id}} @backend={{@key.backend}} @mode="edit" replace={{true}}>
+            Edit key
           </ToolbarSecretLink>
         {{/if}}
       {{/if}}
@@ -74,7 +77,7 @@
   <div class="transit-card-container">
     {{#each @model.supportedActions as |supportedAction|}}
       <LinkedBlock
-        @params={{array "vault.cluster.secrets.backend.actions" @model.id}}
+        @params={{array "vault.cluster.secrets.backend.actions" @model.backend @model.id}}
         @queryParams={{hash action=supportedAction.name}}
         class="transit-card"
         data-test-transit-card={{supportedAction.name}}
diff --git a/ui/app/components/transit-form-show.js b/ui/app/components/transit-form-show.js
index 17e8e831718..b5c297fac64 100644
--- a/ui/app/components/transit-form-show.js
+++ b/ui/app/components/transit-form-show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/transit-key-action/datakey.hbs b/ui/app/components/transit-key-action/datakey.hbs
new file mode 100644
index 00000000000..a2638b435eb
--- /dev/null
+++ b/ui/app/components/transit-key-action/datakey.hbs
@@ -0,0 +1,134 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form
+  {{on "submit" (fn @doSubmit (hash param=@param context=@context padding_scheme=@padding_scheme nonce=@nonce bits=@bits))}}
+  ...attributes
+>
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <NamespaceReminder @mode="perform" @noun="datakey creation" />
+    <div class="content has-bottom-margin-l">
+      <p>Generate a new high-entropy key and value using <code>{{@key.name}}</code> as the cryptographic key.</p>
+    </div>
+    <div class="field">
+      <label for="param" class="is-label">Output format</label>
+      <div class="control is-expanded">
+        <div class="select is-fullwidth">
+          <select name="param" id="param" onchange={{action (mut @param) value="target.value"}}>
+            {{#each (array "plaintext" "wrapped") as |paramOption|}}
+              <option selected={{eq @param paramOption}} value={{paramOption}}>
+                {{paramOption}}
+              </option>
+            {{/each}}
+          </select>
+        </div>
+      </div>
+    </div>
+    {{#if @key.derived}}
+      <div class="field">
+        <label for="context" class="is-label">
+          Context
+        </label>
+        <div class="field has-addons">
+          <div class="control">
+            <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
+          </div>
+          <div class="control">
+            <B64Toggle @value={{@context}} @onUpdate={{@updateContext}} data-test-transit-b64-toggle="context" />
+          </div>
+        </div>
+      </div>
+    {{/if}}
+    {{#if (eq @key.convergentEncryptionVersion 1)}}
+      <div class="field">
+        <label for="nonce" class="is-label">Nonce</label>
+        <div class="field has-addons">
+          <div class="control">
+            <Input @type="text" id="nonce" @value={{@nonce}} class="input" data-test-transit-input="nonce" />
+          </div>
+          <div class="control">
+            <B64Toggle @value={{@nonce}} @onUpdate={{@updateNonce}} data-test-transit-b64-toggle="nonce" />
+          </div>
+        </div>
+      </div>
+    {{/if}}
+    <div class="field">
+      <label for="bits" class="is-label">Bits</label>
+      <div class="control is-expanded">
+        <div class="select is-fullwidth">
+          <select name="bits" id="bits" onchange={{action (mut @bits) value="target.value"}}>
+            {{#each (array 128 256 512) as |bitOption|}}
+              <option selected={{eq @bits bitOption}} value={{bitOption}}>
+                <code>{{bitOption}}</code>
+              </option>
+            {{/each}}
+          </select>
+        </div>
+      </div>
+    </div>
+    {{#if (includes @key.type (array "rsa-2048" "rsa-3072" "rsa-4096"))}}
+      <div class="field">
+        <label for="padding_scheme" class="is-label">Padding scheme</label>
+        <div class="control is-expanded">
+          <div class="select is-fullwidth">
+            <select
+              name="padding_scheme"
+              id="padding_scheme"
+              data-test-padding-scheme
+              onchange={{action (mut @padding_scheme) value="target.value"}}
+            >
+              {{#each (array "oaep" "pkcs1v15") as |scheme|}}
+                <option selected={{eq @padding_scheme scheme}} value={{scheme}}>
+                  {{scheme}}
+                </option>
+              {{/each}}
+            </select>
+          </div>
+        </div>
+      </div>
+    {{/if}}
+  </div>
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <div class="control">
+      <Hds::Button @text="Create datakey" type="submit" />
+    </div>
+  </div>
+</form>
+{{#if @isModalActive}}
+  <Hds::Modal id="transit-datakey-modal" @onClose={{fn (mut @isModalActive) false}} as |M|>
+    <M.Header>
+      Copy your generated key
+    </M.Header>
+    <M.Body>
+      {{#if @plaintext}}
+        <h2 class="has-text-weight-semibold is-6">Plaintext</h2>
+        <p class="sub-text">Plaintext is base64 encoded</p>
+        <Hds::Copy::Snippet
+          class="has-bottom-margin-m"
+          @textToCopy={{@plaintext}}
+          @color="secondary"
+          @container="#transit-datakey-modal"
+          @isFullWidth={{true}}
+          @isTruncated={{true}}
+          @onError={{(fn
+            (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
+          )}}
+        />
+      {{/if}}
+      <h2 class="has-text-weight-semibold is-6">Ciphertext</h2>
+      <Hds::Copy::Snippet
+        @textToCopy={{@ciphertext}}
+        @color="secondary"
+        @container="#transit-datakey-modal"
+        @isFullWidth={{true}}
+        @isTruncated={{true}}
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+      />
+    </M.Body>
+    <M.Footer as |F|>
+      <Hds::Button @text="Close" {{on "click" F.close}} />
+    </M.Footer>
+  </Hds::Modal>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/transit-key-action/decrypt.hbs b/ui/app/components/transit-key-action/decrypt.hbs
new file mode 100644
index 00000000000..f1029ab4cb6
--- /dev/null
+++ b/ui/app/components/transit-key-action/decrypt.hbs
@@ -0,0 +1,102 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form
+  {{on "submit" (fn @doSubmit (hash ciphertext=@ciphertext padding_scheme=@padding_scheme context=@context nonce=@nonce))}}
+  ...attributes
+>
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <div class="content has-bottom-margin-l">
+      <p>You can decrypt ciphertext using <code>{{@key.name}}</code> as the cryptographic key.</p>
+    </div>
+    <div class="field">
+      <div id="ciphertext-control" class="control">
+        <JsonEditor
+          @title="Ciphertext"
+          @valueUpdated={{fn (mut @ciphertext)}}
+          @mode="ruby"
+          @data-test-transit-input="ciphertext"
+        />
+      </div>
+    </div>
+    {{#if @key.derived}}
+      <div class="field">
+        <label for="context" class="is-label">
+          Context
+        </label>
+        <div class="field has-addons">
+          <div class="control">
+            <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
+          </div>
+          <div class="control">
+            <B64Toggle @value={{@context}} @onUpdate={{@updateContext}} data-test-transit-b64-toggle="context" />
+          </div>
+        </div>
+      </div>
+    {{/if}}
+    {{#if (includes @key.type (array "rsa-2048" "rsa-3072" "rsa-4096"))}}
+      <div class="field">
+        <label for="padding_scheme" class="is-label">Padding Scheme</label>
+        <div class="control is-expanded">
+          <div class="select is-fullwidth">
+            <select
+              name="padding_scheme"
+              id="padding_scheme"
+              data-test-padding-scheme
+              onchange={{action (mut @padding_scheme) value="target.value"}}
+            >
+              {{#each (array "oaep" "pkcs1v15") as |scheme|}}
+                <option selected={{eq @padding_scheme scheme}} value={{scheme}}>
+                  {{scheme}}
+                </option>
+              {{/each}}
+            </select>
+          </div>
+        </div>
+      </div>
+    {{/if}}
+    {{#if (eq @key.convergentEncryptionVersion 1)}}
+      <div class="field">
+        <label for="nonce" class="is-label">Nonce</label>
+        <div class="field has-addons">
+          <div class="control">
+            <Input @type="text" id="nonce" @value={{@nonce}} class="input" data-test-transit-input="nonce" />
+          </div>
+          <div class="control">
+            <B64Toggle @value={{@nonce}} @onUpdate={{@updateNonce}} data-test-transit-b64-toggle="nonce" />
+          </div>
+        </div>
+      </div>
+    {{/if}}
+  </div>
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <div class="control">
+      <Hds::Button @text="Decrypt" type="submit" id="decrypt" data-test-submit />
+    </div>
+  </div>
+</form>
+{{#if @isModalActive}}
+  <Hds::Modal id="transit-decrypt-modal" @onClose={{fn (mut @isModalActive) false}} data-test-decrypt-modal as |M|>
+    <M.Header>
+      Copy your unwrapped data
+    </M.Header>
+    <M.Body>
+      <h2 class="has-text-weight-semibold is-6">Plaintext</h2>
+      <p class="sub-text">Plaintext is base64 encoded.</p>
+      <Hds::Copy::Snippet
+        @textToCopy={{@plaintext}}
+        @color="secondary"
+        @container="#transit-decrypt-modal"
+        @isFullWidth={{true}}
+        @isTruncated={{true}}
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+        data-test-encrypted-value="plaintext"
+      />
+    </M.Body>
+    <M.Footer as |F|>
+      <Hds::Button @text="Close" {{on "click" F.close}} />
+    </M.Footer>
+  </Hds::Modal>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/transit-key-action/encrypt.hbs b/ui/app/components/transit-key-action/encrypt.hbs
new file mode 100644
index 00000000000..69dee7a72a0
--- /dev/null
+++ b/ui/app/components/transit-key-action/encrypt.hbs
@@ -0,0 +1,122 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form
+  {{on
+    "submit"
+    (fn
+      @doSubmit
+      (hash plaintext=@plaintext padding_scheme=@padding_scheme context=@context nonce=@nonce key_version=@key_version)
+    )
+  }}
+  ...attributes
+>
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <NamespaceReminder @mode="perform" @noun="encryption" />
+    <div class="content has-bottom-margin-l">
+      <p>You can encrypt plaintext data using <code>{{@key.name}}</code> as the cryptographic key.</p>
+    </div>
+    <KeyVersionSelect @key={{@key}} @onVersionChange={{fn (mut @key_version)}} @key_version={{@key_version}} />
+    <div class="field">
+      <div id="plaintext-control" class="control is-relative">
+        <JsonEditor
+          @title="Plaintext"
+          @value={{@plaintext}}
+          @valueUpdated={{fn (mut @plaintext)}}
+          @mode="ruby"
+          @data-test-transit-input="plaintext"
+        />
+      </div>
+    </div>
+    <div class="field">
+      <Input
+        @type="checkbox"
+        id="encodedBase64"
+        @checked={{@encodedBase64}}
+        {{on "change" @toggleEncodeBase64}}
+        data-test-transit-input="encodedBase64"
+      />
+      <label for="encodedBase64">This data is already encoded in base64</label>
+    </div>
+    {{#if @key.derived}}
+      <div class="field">
+        <label for="context" class="is-label">
+          Context
+        </label>
+        <div class="field has-addons">
+          <div class="control">
+            <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
+          </div>
+          <div class="control">
+            <B64Toggle @value={{@context}} @onUpdate={{@updateContext}} data-test-transit-b64-toggle="context" />
+          </div>
+        </div>
+      </div>
+    {{/if}}
+    {{#if (includes @key.type (array "rsa-2048" "rsa-3072" "rsa-4096"))}}
+      <div class="field">
+        <label for="padding_scheme" class="is-label">Padding scheme</label>
+        <div class="control is-expanded">
+          <div class="select is-fullwidth">
+            <select
+              name="padding_scheme"
+              id="padding_scheme"
+              data-test-padding-scheme
+              onchange={{action (mut @padding_scheme) value="target.value"}}
+            >
+              {{#each (array "oaep" "pkcs1v15") as |scheme|}}
+                <option selected={{eq @padding_scheme scheme}} value={{scheme}}>
+                  {{scheme}}
+                </option>
+              {{/each}}
+            </select>
+          </div>
+        </div>
+      </div>
+    {{/if}}
+    {{#if (eq @key.convergentEncryptionVersion 1)}}
+      <div class="field">
+        <div class="level">
+          <div class="level-left">
+            <label for="nonce" class="is-label">Nonce</label>
+          </div>
+          <div class="level-right">
+            <B64Toggle @value={{@nonce}} @onUpdate={{@updateNonce}} data-test-transit-b64-toggle="nonce" />
+          </div>
+        </div>
+        <div class="control">
+          <Input @type="text" id="nonce" @value={{@nonce}} class="input" data-test-transit-input="nonce" />
+        </div>
+      </div>
+    {{/if}}
+  </div>
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <div class="control">
+      <Hds::Button @text="Encrypt" type="submit" data-test-submit />
+    </div>
+  </div>
+</form>
+{{#if @isModalActive}}
+  <Hds::Modal id="transit-encrypt-modal" @onClose={{fn (mut @isModalActive) false}} data-test-encrypt-modal as |M|>
+    <M.Header>
+      Copy your token
+    </M.Header>
+    <M.Body>
+      <h2 class="title is-6">Ciphertext</h2>
+      <Hds::Copy::Snippet
+        @textToCopy={{@ciphertext}}
+        @color="secondary"
+        @container="#transit-encrypt-modal"
+        @isFullWidth={{true}}
+        @isTruncated={{true}}
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+        data-test-encrypted-value="ciphertext"
+      />
+    </M.Body>
+    <M.Footer as |F|>
+      <Hds::Button @text="Close" {{on "click" F.close}} />
+    </M.Footer>
+  </Hds::Modal>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/transit-key-action/export.hbs b/ui/app/components/transit-key-action/export.hbs
similarity index 89%
rename from ui/app/templates/components/transit-key-action/export.hbs
rename to ui/app/components/transit-key-action/export.hbs
index 0dc773fe2ba..9f6ae6921c5 100644
--- a/ui/app/templates/components/transit-key-action/export.hbs
+++ b/ui/app/components/transit-key-action/export.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form
   {{on
@@ -16,7 +16,7 @@
 >
   <div class="box is-sideless is-fullwidth is-marginless">
     <div class="content">
-      <p>Export a key using <code>{{@key.name}}</code> as the encryption key.</p>
+      <p>Export a key using <code>{{@key.name}}</code> as the cryptographic key.</p>
     </div>
     <div class="field">
       <label for="type" class="is-label">Key type</label>
@@ -63,7 +63,7 @@
   </div>
   <div class="field is-grouped box is-fullwidth is-bottomless">
     <div class="control">
-      <Hds::Button @text="Export key" type="submit" />
+      <Hds::Button @text="Export key" type="submit" data-test-submit />
     </div>
   </div>
 </form>
@@ -83,7 +83,7 @@
           @isFullWidth={{true}}
           @isTruncated={{true}}
           @onError={{(fn
-            (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
+            (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
           )}}
           data-test-encrypted-value="export"
         />
@@ -98,7 +98,7 @@
             @textToCopy={{stringify @keys}}
             @container="#transit-export-modal"
             @onError={{(fn
-              (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
+              (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
             )}}
             class="transparent top-right-absolute"
           />
diff --git a/ui/app/components/transit-key-action/export.js b/ui/app/components/transit-key-action/export.js
index bb4bc33d4b4..b52483c8cc3 100644
--- a/ui/app/components/transit-key-action/export.js
+++ b/ui/app/components/transit-key-action/export.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/templates/components/transit-key-action/hmac.hbs b/ui/app/components/transit-key-action/hmac.hbs
similarity index 91%
rename from ui/app/templates/components/transit-key-action/hmac.hbs
rename to ui/app/components/transit-key-action/hmac.hbs
index 1e0523ae61f..51dd443893a 100644
--- a/ui/app/templates/components/transit-key-action/hmac.hbs
+++ b/ui/app/components/transit-key-action/hmac.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form {{on "submit" (fn @doSubmit (hash input=@trackedInput algorithm=@algorithm key_version=@key_version))}} ...attributes>
   <div class="box is-sideless is-fullwidth is-marginless">
@@ -46,7 +46,7 @@
   </div>
   <div class="field is-grouped box is-fullwidth is-bottomless">
     <div class="control">
-      <Hds::Button @text="HMAC" type="submit" />
+      <Hds::Button @text="HMAC" type="submit" data-test-submit />
     </div>
   </div>
 </form>
@@ -63,9 +63,7 @@
         @container="#transit-hmac-modal"
         @isFullWidth={{true}}
         @isTruncated={{true}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
         data-test-encrypted-value="hmac"
       />
     </M.Body>
diff --git a/ui/app/components/transit-key-action/rewrap.hbs b/ui/app/components/transit-key-action/rewrap.hbs
new file mode 100644
index 00000000000..0792bb543e4
--- /dev/null
+++ b/ui/app/components/transit-key-action/rewrap.hbs
@@ -0,0 +1,136 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form
+  {{on
+    "submit"
+    (fn
+      @doSubmit
+      (hash
+        ciphertext=@ciphertext
+        decrypt_padding_scheme=@decrypt_padding_scheme
+        encrypt_padding_scheme=@encrypt_padding_scheme
+        context=@context
+        nonce=@nonce
+        key_version=@key_version
+      )
+    )
+  }}
+  ...attributes
+>
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <NamespaceReminder @mode="perform" @noun="rewrap" />
+    <div class="content has-bottom-margin-l">
+      <p>
+        You can rewrap the provided ciphertext using the latest version of
+        <code>{{@key.name}}</code>
+        as the cryptographic key.
+      </p>
+    </div>
+    <KeyVersionSelect @key={{@key}} @onVersionChange={{fn (mut @key_version)}} @key_version={{@key_version}} />
+    <div class="field">
+      <div class="control is-expanded">
+        <JsonEditor @title="Ciphertext" @valueUpdated={{fn (mut @ciphertext)}} @mode="ruby" />
+      </div>
+    </div>
+    {{#if @key.derived}}
+      <div class="field">
+        <label for="context" class="is-label">
+          Context
+        </label>
+        <div class="field has-addons">
+          <div class="control">
+            <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
+          </div>
+          <div class="control">
+            <B64Toggle @value={{@context}} @onUpdate={{@updateContext}} data-test-transit-b64-toggle="context" />
+          </div>
+        </div>
+      </div>
+    {{/if}}
+    {{#if (includes @key.type (array "rsa-2048" "rsa-3072" "rsa-4096"))}}
+      <div class="field">
+        <label for="decrypt_padding_scheme" class="is-label">Decrypt padding scheme</label>
+        <div class="control is-expanded">
+          <div class="select is-fullwidth">
+            <select
+              name="decrypt_padding_scheme"
+              id="decrypt_padding_scheme"
+              data-test-padding-scheme="decrypt"
+              onchange={{action (mut @decrypt_padding_scheme) value="target.value"}}
+            >
+              {{#each (array "oaep" "pkcs1v15") as |scheme|}}
+                <option selected={{eq @decrypt_padding_scheme scheme}} value={{scheme}}>{{scheme}}</option>
+              {{/each}}
+            </select>
+          </div>
+        </div>
+      </div>
+      <div class="field">
+        <label for="encrypt_padding_scheme" class="is-label">Encrypt padding scheme</label>
+        <div class="control is-expanded">
+          <div class="select is-fullwidth">
+            <select
+              name="encrypt_padding_scheme"
+              id="encrypt_padding_scheme"
+              data-test-padding-scheme="encrypt"
+              onchange={{action (mut @encrypt_padding_scheme) value="target.value"}}
+            >
+              {{#each (array "oaep" "pkcs1v15") as |scheme|}}
+                <option selected={{eq @encrypt_padding_scheme scheme}} value={{scheme}}>{{scheme}}</option>
+              {{/each}}
+            </select>
+          </div>
+        </div>
+      </div>
+    {{/if}}
+    {{#if (eq @key.convergentEncryptionVersion 1)}}
+      <div class="field">
+        <label for="nonce" class="is-label">Nonce</label>
+        <div class="field has-addons">
+          <div class="control">
+            <Input @type="text" id="nonce" @value={{@nonce}} class="input" data-test-transit-input="nonce" />
+          </div>
+          <div class="control">
+            <B64Toggle @value={{@nonce}} @onUpdate={{@updateNonce}} data-test-transit-b64-toggle="nonce" />
+          </div>
+        </div>
+      </div>
+    {{/if}}
+  </div>
+  <div class="field box is-fullwidth is-bottomless">
+    <div class="content has-bottom-margin-l">
+      <p class="help">
+        Submitting this form will update the
+        <code>ciphertext</code>
+        in-place.
+      </p>
+    </div>
+    <div class="control">
+      <Hds::Button @text="Rewrap" type="submit" />
+    </div>
+  </div>
+</form>
+{{#if @isModalActive}}
+  <Hds::Modal id="transit-rewrap-modal" @onClose={{fn (mut @isModalActive) false}} as |M|>
+    <M.Header>
+      Copy your token
+    </M.Header>
+    <M.Body>
+      <h2 class="title is-6">Ciphertext</h2>
+      <Hds::Copy::Snippet
+        @textToCopy={{@ciphertext}}
+        @color="secondary"
+        @container="#transit-rewrap-modal"
+        @isFullWidth={{true}}
+        @isTruncated={{true}}
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+      />
+    </M.Body>
+    <M.Footer as |F|>
+      <Hds::Button @text="Close" {{on "click" F.close}} />
+    </M.Footer>
+  </Hds::Modal>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/transit-key-action/sign.hbs b/ui/app/components/transit-key-action/sign.hbs
similarity index 93%
rename from ui/app/templates/components/transit-key-action/sign.hbs
rename to ui/app/components/transit-key-action/sign.hbs
index 8f583236a90..43a3ff48749 100644
--- a/ui/app/templates/components/transit-key-action/sign.hbs
+++ b/ui/app/components/transit-key-action/sign.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form
   {{on
@@ -27,7 +27,7 @@
       <p>
         Return the cryptographic signature of the given data using
         <code>{{@key.name}}</code>
-        as the encryption key and the specified hash algorithm.
+        as the cryptographic key and the specified hash algorithm.
       </p>
     </div>
     <KeyVersionSelect @key={{@key}} @onVersionChange={{fn (mut @key_version)}} @key_version={{@key_version}} />
@@ -62,7 +62,7 @@
             <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
           </div>
           <div class="control">
-            <B64Toggle @value={{@context}} @data-test-transit-b64-toggle="context" />
+            <B64Toggle @value={{@context}} @onUpdate={{@updateContext}} data-test-transit-b64-toggle="context" />
           </div>
         </div>
       </div>
@@ -141,9 +141,7 @@
         @container="#transit-sign-modal"
         @isFullWidth={{true}}
         @isTruncated={{true}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
         data-test-encrypted-value="signature"
       />
     </M.Body>
diff --git a/ui/app/components/transit-key-action/verify.hbs b/ui/app/components/transit-key-action/verify.hbs
new file mode 100644
index 00000000000..4ba2a801fd1
--- /dev/null
+++ b/ui/app/components/transit-key-action/verify.hbs
@@ -0,0 +1,219 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form
+  {{on
+    "submit"
+    (fn
+      @doSubmit
+      (hash
+        input=@trackedInput
+        signature=@signature
+        signature_algorithm=@signature_algorithm
+        hmac=@hmac
+        hash_algorithm=@hash_algorithm
+        context=@context
+        prehashed=@prehashed
+        encodedBase64=@encodedBase64
+      )
+    )
+  }}
+  ...attributes
+>
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <div class="content has-bottom-margin-l">
+      <p>Check whether the provided signature is valid for the given data.</p>
+    </div>
+    <div class="field">
+      <div class="control is-relative">
+        <JsonEditor
+          @title="Input"
+          @value={{@trackedInput}}
+          @valueUpdated={{fn (mut @trackedInput)}}
+          @mode="ruby"
+          @data-test-transit-input="input"
+        />
+      </div>
+    </div>
+    <div class="field">
+      <Input
+        @type="checkbox"
+        id="encodedBase64"
+        @checked={{@encodedBase64}}
+        {{on "change" @toggleEncodeBase64}}
+        data-test-transit-input="encodedBase64"
+      />
+      <label for="encodedBase64">This data is already encoded in base64</label>
+    </div>
+    {{#if (and @key.supportsSigning @key.derived (not @hmac))}}
+      <div class="field">
+        <label for="context" class="is-label">
+          Context
+        </label>
+        <div class="field has-addons">
+          <div class="control">
+            <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
+          </div>
+          <div class="control">
+            <B64Toggle @value={{@context}} @onUpdate={{@updateContext}} data-test-transit-b64-toggle="context" />
+          </div>
+        </div>
+      </div>
+    {{/if}}
+    {{#if @key.supportsSigning}}
+      <div class="columns is-5">
+        <div class="column is-one-third">
+          <div class="field">
+            <label for="verification" class="is-label">Verification Type</label>
+            <div class="control is-expanded">
+              <div class="select is-fullwidth">
+                <select
+                  name="verification"
+                  id="verification"
+                  onchange={{queue
+                    (action (mut @verification) value="target.value")
+                    (fn @clearSpecificProps (array "hmac" "signature"))
+                  }}
+                >
+                  {{#each (array "Signature" "HMAC") as |type|}}
+                    <option
+                      selected={{if @verification (eq @verification type) (if @hmac (eq type "HMAC") (eq type "Signature"))}}
+                      value={{type}}
+                    >
+                      {{type}}
+                    </option>
+                  {{/each}}
+                </select>
+              </div>
+            </div>
+          </div>
+          <div class="field">
+            <div class="level is-mobile">
+              <div class="level-left">
+                <label for="hash_algorithm" class="is-label">Hash Algorithm</label>
+              </div>
+              <div class="level-right">
+                {{#if (not-eq @verification "HMAC")}}
+                  <div class="control is-flex">
+                    <Input
+                      id="prehashed"
+                      @type="checkbox"
+                      name="prehashed"
+                      class="toggle is-success is-small"
+                      @checked={{@prehashed}}
+                    />
+                    <label for="prehashed" class="has-text-weight-bold is-size-8">Prehashed</label>
+                  </div>
+                {{/if}}
+              </div>
+            </div>
+            <div class="control is-expanded">
+              <div class="select is-fullwidth">
+                <select
+                  name="hash_algorithm"
+                  id="hash_algorithm"
+                  onchange={{action (mut @hash_algorithm) value="target.value"}}
+                >
+                  {{#each (sha2-digest-sizes) as |algo|}}
+                    <option selected={{if @hash_algorithm (eq @hash_algorithm algo) (eq algo "sha2-256")}} value={{algo}}>
+                      <code>{{algo}}</code>
+                    </option>
+                  {{/each}}
+                </select>
+              </div>
+            </div>
+          </div>
+          {{#if (and @keyIsRSA (or (and @verification (eq @verification "Signature")) @signature))}}
+            <div class="field">
+              <label for="signature_algorithm" class="is-label">Signature Algorithm</label>
+              <div class="control is-expanded">
+                <div class="select is-fullwidth">
+                  <select
+                    name="signature_algorithm"
+                    id="signature_algorithm"
+                    data-test-signature-algorithm="true"
+                    onchange={{action (mut @signature_algorithm) value="target.value"}}
+                  >
+                    {{#each (array "pss" "pkcs1v15") as |sigAlgo|}}
+                      <option
+                        selected={{if @signature_algorithm (eq @signature_algorithm sigAlgo) (eq sigAlgo "pss")}}
+                        value={{sigAlgo}}
+                      >
+                        {{sigAlgo}}
+                      </option>
+                    {{/each}}
+                  </select>
+                </div>
+              </div>
+            </div>
+          {{/if}}
+
+        </div>
+        <div class="column is-two-thirds is-flex-column">
+          {{#if (or (and @verification (eq @verification "HMAC")) @hmac)}}
+            <div class="field is-flex-column is-flex-grow-1">
+              <div class="control is-flex-column is-flex-grow-1">
+                <JsonEditor @title="HMAC" @value={{@hmac}} @valueUpdated={{fn (mut @hmac)}} @mode="ruby" />
+              </div>
+            </div>
+          {{else}}
+            <div class="field is-flex-column is-flex-grow-1">
+              <div class="control is-flex-column is-flex-grow-1">
+                <JsonEditor @title="Signature" @value={{@signature}} @valueUpdated={{fn (mut @signature)}} @mode="ruby" />
+              </div>
+            </div>
+          {{/if}}
+        </div>
+      </div>
+    {{else}}
+      <div class="field">
+        <div class="control">
+          <JsonEditor @title="HMAC" @value={{@hmac}} @valueUpdated={{fn (mut @hmac)}} @mode="ruby" />
+        </div>
+      </div>
+      <div class="field">
+        <label for="hash_algorithm" class="is-label">Algorithm</label>
+        <div class="control is-expanded">
+          <div class="select is-fullwidth">
+            <select name="hash_algorithm" id="hash_algorithm" onchange={{action (mut @hash_algorithm) value="target.value"}}>
+              {{#each (array "sha2-224" "sha2-256" "sha2-384" "sha2-512") as |algo|}}
+                <option selected={{if @hash_algorithm (eq @hash_algorithm algo) (eq algo "sha2-256")}} value={{algo}}>
+                  <code>{{algo}}</code>
+                </option>
+              {{/each}}
+            </select>
+          </div>
+        </div>
+      </div>
+    {{/if}}
+  </div>
+  <div class="field is-grouped box is-fullwidth is-bottomless">
+    <div class="control">
+      <Hds::Button @text="Verify" @icon={{if @submitIsRunning "loading"}} type="submit" disabled={{@submitIsRunning}} />
+    </div>
+  </div>
+</form>
+{{#if @isModalActive}}
+  <Hds::Modal id="transit-verify-modal" @size="small" @onClose={{fn (mut @isModalActive) false}} as |M|>
+    <M.Header>
+      Results
+      <Hds::Badge
+        @text={{if @valid "Valid" "Not Valid"}}
+        @size="large"
+        @color={{if @valid "success" "critical"}}
+        @icon={{if @valid "check-circle" "x-circle"}}
+      />
+    </M.Header>
+    <M.Body>
+      The input is
+      {{if @valid "valid" "not valid"}}
+      for the given
+      {{if @signature "signature." "HMAC."}}
+    </M.Body>
+    <M.Footer as |F|>
+      <Hds::Button @text="Close" {{on "click" F.close}} />
+    </M.Footer>
+  </Hds::Modal>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/components/transit-key-actions.hbs b/ui/app/components/transit-key-actions.hbs
index d9070392a9e..d571c53e88e 100644
--- a/ui/app/components/transit-key-actions.hbs
+++ b/ui/app/components/transit-key-actions.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 <div {{did-update this.updateProps @selectedAction}}>
   <MessageError @errorMessage={{this.errors}} />
 
@@ -13,12 +13,15 @@
       @nonce={{this.props.nonce}}
       @bits={{this.props.bits}}
       @key_version={{this.props.key_version}}
+      @padding_scheme={{this.props.padding_scheme}}
       @encodedBase64={{this.props.encodedBase64}}
       @toggleEncodeBase64={{this.toggleEncodeBase64}}
       @plaintext={{this.props.plaintext}}
       @ciphertext={{this.props.ciphertext}}
       @doSubmit={{perform this.doSubmit}}
       @isModalActive={{this.isModalActive}}
+      @updateContext={{this.updateContext}}
+      @updateNonce={{this.updateNonce}}
       data-test-transit-action={{@selectedAction}}
     />
   {{else if (eq @selectedAction "decrypt")}}
@@ -27,9 +30,12 @@
       @ciphertext={{this.props.ciphertext}}
       @context={{this.props.context}}
       @nonce={{this.props.nonce}}
+      @padding_scheme={{this.props.padding_scheme}}
       @isModalActive={{this.isModalActive}}
       @plaintext={{this.props.plaintext}}
       @doSubmit={{perform this.doSubmit}}
+      @updateContext={{this.updateContext}}
+      @updateNonce={{this.updateNonce}}
       data-test-transit-action={{@selectedAction}}
     />
   {{else if (eq @selectedAction "datakey")}}
@@ -40,9 +46,12 @@
       @nonce={{this.props.nonce}}
       @bits={{this.props.bits}}
       @plaintext={{this.props.plaintext}}
+      @padding_scheme={{this.props.padding_scheme}}
       @ciphertext={{this.props.ciphertext}}
       @doSubmit={{perform this.doSubmit}}
       @isModalActive={{this.isModalActive}}
+      @updateContext={{this.updateContext}}
+      @updateNonce={{this.updateNonce}}
       data-test-transit-action={{@selectedAction}}
     />
   {{else if (eq @selectedAction "rewrap")}}
@@ -54,7 +63,11 @@
       @key_version={{this.props.key_version}}
       @ciphertext={{this.props.ciphertext}}
       @isModalActive={{this.isModalActive}}
+      @decrypt_padding_scheme={{this.props.decrypt_padding_scheme}}
+      @encrypt_padding_scheme={{this.props.encrypt_padding_scheme}}
       @doSubmit={{perform this.doSubmit}}
+      @updateContext={{this.updateContext}}
+      @updateNonce={{this.updateNonce}}
       data-test-transit-action={{@selectedAction}}
     />
   {{else if (eq @selectedAction "hmac")}}
@@ -89,6 +102,7 @@
       @doSubmit={{perform this.doSubmit}}
       @submitIsRunning={{this.doSubmit.isRunning}}
       @clearSpecificProps={{this.clearSpecificProps}}
+      @updateContext={{this.updateContext}}
       data-test-transit-action={{@selectedAction}}
     />
   {{else if (eq @selectedAction "sign")}}
@@ -106,6 +120,7 @@
       @isModalActive={{this.isModalActive}}
       @doSubmit={{perform this.doSubmit}}
       @submitIsRunning={{this.doSubmit.isRunning}}
+      @updateContext={{this.updateContext}}
       data-test-transit-action={{@selectedAction}}
     />
   {{else if (or (eq @selectedAction "export") (eq (get @key.supportedActions 0) "export"))}}
diff --git a/ui/app/components/transit-key-actions.js b/ui/app/components/transit-key-actions.js
index 854908bfeee..7ddfd6bd369 100644
--- a/ui/app/components/transit-key-actions.js
+++ b/ui/app/components/transit-key-actions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -31,6 +31,9 @@ const STARTING_TRANSIT_PROPS = {
   hash_algorithm: 'sha2-256',
   algorithm: 'sha2-256',
   signature_algorithm: 'pss',
+  padding_scheme: 'oaep',
+  decrypt_padding_scheme: 'oaep',
+  encrypt_padding_scheme: 'oaep',
   bits: 256,
   bytes: 32,
   ciphertext: null,
@@ -59,12 +62,19 @@ const STARTING_TRANSIT_PROPS = {
 };
 
 const PROPS_TO_KEEP = {
-  encrypt: ['plaintext', 'context', 'nonce', 'key_version'],
-  decrypt: ['ciphertext', 'context', 'nonce'],
+  encrypt: ['plaintext', 'context', 'padding_scheme', 'nonce', 'key_version'],
+  decrypt: ['ciphertext', 'context', 'padding_scheme', 'nonce'],
   sign: ['input', 'hash_algorithm', 'key_version', 'prehashed', 'signature_algorithm'],
   verify: ['input', 'hmac', 'signature', 'hash_algorithm', 'prehashed'],
   hmac: ['input', 'algorithm', 'key_version'],
-  rewrap: ['ciphertext', 'context', 'nonce', 'key_version'],
+  rewrap: [
+    'ciphertext',
+    'context',
+    'decrypt_padding_scheme',
+    'encrypt_padding_scheme',
+    'nonce',
+    'key_version',
+  ],
   datakey: [],
 };
 
@@ -159,6 +169,16 @@ export default class TransitKeyActions extends Component {
     this.props.encodedBase64 = !this.props.encodedBase64;
   }
 
+  @action updateContext(newValue) {
+    this.props.context = newValue;
+    this.props = { ...this.props }; // Trigger reactivity
+  }
+
+  @action updateNonce(newValue) {
+    this.props.nonce = newValue;
+    this.props = { ...this.props }; // Trigger reactivity
+  }
+
   @action clearSpecificProps(arrayToClear) {
     arrayToClear.forEach((prop) => (this.props[prop] = null));
   }
@@ -182,6 +202,12 @@ export default class TransitKeyActions extends Component {
         formData.input = encodeString(formData.input);
       }
     }
+    if (!this.keyIsRSA) {
+      // Remove various rsa specific padding_scheme arguments if we aren't an RSA key
+      delete formData.encrypt_padding_scheme;
+      delete formData.decrypt_padding_scheme;
+      delete formData.padding_scheme;
+    }
     const payload = formData ? this.compactData(formData) : null;
 
     try {
diff --git a/ui/app/components/ui-wizard.js b/ui/app/components/ui-wizard.js
deleted file mode 100644
index 1e14b439171..00000000000
--- a/ui/app/components/ui-wizard.js
+++ /dev/null
@@ -1,58 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { service } from '@ember/service';
-import { alias, or } from '@ember/object/computed';
-import Component from '@ember/component';
-import { matchesState } from 'xstate';
-
-export default Component.extend({
-  classNames: ['ui-wizard-container'],
-  wizard: service(),
-  auth: service(),
-  router: service(),
-
-  shouldRender: or('auth.currentToken', 'wizard.showWhenUnauthenticated'),
-  currentState: alias('wizard.currentState'),
-  featureState: alias('wizard.featureState'),
-  featureComponent: alias('wizard.featureComponent'),
-  tutorialComponent: alias('wizard.tutorialComponent'),
-  componentState: alias('wizard.componentState'),
-  nextFeature: alias('wizard.nextFeature'),
-  nextStep: alias('wizard.nextStep'),
-  currentRouteName: alias('router.currentRouteName'),
-
-  actions: {
-    dismissWizard() {
-      this.wizard.transitionTutorialMachine(this.currentState, 'DISMISS');
-    },
-
-    advanceWizard() {
-      const inInit = matchesState('init', this.wizard.currentState);
-      const event = inInit ? this.wizard.initEvent || 'CONTINUE' : 'CONTINUE';
-      this.wizard.transitionTutorialMachine(this.currentState, event);
-    },
-
-    advanceFeature() {
-      this.wizard.transitionFeatureMachine(this.featureState, 'CONTINUE');
-    },
-
-    finishFeature() {
-      this.wizard.transitionFeatureMachine(this.featureState, 'DONE');
-    },
-
-    repeatStep() {
-      this.wizard.transitionFeatureMachine(this.featureState, 'REPEAT', this.componentState);
-    },
-
-    resetFeature() {
-      this.wizard.transitionFeatureMachine(this.featureState, 'RESET', this.componentState);
-    },
-
-    pauseWizard() {
-      this.wizard.transitionTutorialMachine(this.currentState, 'PAUSE');
-    },
-  },
-});
diff --git a/ui/app/components/usage/page.hbs b/ui/app/components/usage/page.hbs
new file mode 100644
index 00000000000..fe4018f97eb
--- /dev/null
+++ b/ui/app/components/usage/page.hbs
@@ -0,0 +1,10 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<VaultReporting::Views::Dashboard
+  @onFetchUsageData={{this.handleFetchUsageData}}
+  @onFetchNamespaceData={{this.handleFetchNamespaceData}}
+  @isVaultDedicated={{this.flags.isHvdManaged}}
+/>
\ No newline at end of file
diff --git a/ui/app/components/usage/page.ts b/ui/app/components/usage/page.ts
new file mode 100644
index 00000000000..1e541b83fc8
--- /dev/null
+++ b/ui/app/components/usage/page.ts
@@ -0,0 +1,136 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@ember/component';
+import { service } from '@ember/service';
+
+import type FlagsService from 'vault/services/flags';
+import type ApiService from 'vault/services/api';
+import type NamespaceService from 'vault/services/namespace';
+import type AuthService from 'vault/vault/services/auth';
+import type {
+  getUsageDataFunction,
+  getNamespaceDataFunction,
+  UsageDashboardData,
+} from '@hashicorp-internal/vault-reporting/types/index';
+import type { UtilizationReport } from 'vault/usage';
+
+interface NamespaceOption {
+  path: string;
+  label: string;
+}
+
+/**
+ * @module UsagePage
+ * @description This component is responsible for fetching usage data and mounting the vault-reporting dashboard view.
+ * It uses the `api` service to make a request to the sys/utilization-report endpoint to get the usage data.
+ * The data is then processed to replace engine and auth method names with their display names if available.
+ * The component also uses the `flags` service to determine if the cluster is HVD managed or not.
+ *
+ * The logic is self-contained and this component has no args.
+ *
+ * @example ```js
+ *   <Usage::Page />
+ * ```
+ */
+
+export default class UsagePage extends Component {
+  @service declare readonly api: ApiService;
+  @service declare readonly flags: FlagsService;
+  @service declare readonly namespace: NamespaceService;
+  @service declare readonly auth: AuthService;
+
+  handleFetchUsageData: getUsageDataFunction = async (namespace?: string) => {
+    /**
+     * We get a partially typed response from the API client, but only 1 level deep.
+     * Casting the nested types here and falling back to defaults in the mappings.
+     * We should get typescript errors if top level interfaces in the API client or
+     * the vault-reporting addon change.
+     */
+
+    // Convert "root" display value back to empty string for API calls
+    const apiNamespace = namespace === 'root' ? undefined : namespace;
+    const response = (await this.api.sys.generateUtilizationReport(apiNamespace)) as UtilizationReport;
+
+    const { lease_count_quotas, replication_status, pki, secret_sync } = response;
+
+    const data: UsageDashboardData = {
+      authMethods: (response.auth_methods as Record<string, number>) || {},
+      secretEngines: (response.secret_engines as Record<string, number>) || {},
+      leasesByAuthMethod: (response.leases_by_auth_method as Record<string, number>) || {},
+      leaseCountQuotas: {
+        globalLeaseCountQuota: {
+          capacity: lease_count_quotas?.global_lease_count_quota?.capacity || 0,
+          count: lease_count_quotas?.global_lease_count_quota?.count || 0,
+          name: lease_count_quotas?.global_lease_count_quota?.name || '',
+        },
+        totalLeaseCountQuotas: lease_count_quotas?.total_lease_count_quotas || 0,
+      },
+      replicationStatus: {
+        drState: replication_status?.dr_state || 'disabled',
+        prState: replication_status?.pr_state || 'disabled',
+        drPrimary: replication_status?.dr_primary ?? false,
+        prPrimary: replication_status?.pr_primary ?? false,
+      },
+      kvv1Secrets: response.kvv1_secrets || 0,
+      kvv2Secrets: response.kvv2_secrets || 0,
+      namespaces: response.namespaces || 0,
+      pki: {
+        totalIssuers: pki?.total_issuers || 0,
+        totalRoles: pki?.total_roles || 0,
+      },
+      secretSync: {
+        destinations: secret_sync?.destinations || {},
+        totalDestinations: secret_sync?.total_destinations || 0,
+      },
+    };
+    return data;
+  };
+
+  handleFetchNamespaceData: getNamespaceDataFunction = async () => {
+    await this.namespace?.findNamespacesForUser?.perform();
+    const options = this.getOptions(this.namespace?.accessibleNamespaces);
+    const data = {
+      keys: options.map((option) => option.label),
+    };
+    return data;
+  };
+
+  /**
+   * getOptions from ui/app/components/namespace-picker.ts
+   * We might consider moving this into a util function and sharing it across both files
+   */
+  private getOptions(accessibleNamespaces: string[]): NamespaceOption[] {
+    /* Each namespace option has 2 properties: { path and label }
+     *   - path: full namespace path (used to navigate to the namespace)
+     *   - label: text displayed inside the namespace picker dropdown (if root, then path is "", else label = path)
+     *
+     *  Example:
+     *   | path           | label          |
+     *   | ----           | -----          |
+     *   | ''             | 'root'         |
+     *   | 'parent'       | 'parent'       |
+     *   | 'parent/child' | 'parent/child' |
+     */
+    const options = (accessibleNamespaces || []).map((ns: string) => ({ path: ns, label: ns }));
+
+    // Add the user's root namespace because `sys/internal/ui/namespaces` does not include it.
+    const userRootNamespace = this.auth.authData?.userRootNamespace;
+    if (!options?.find((o) => o.path === userRootNamespace)) {
+      // the 'root' namespace is technically an empty string so we manually add the 'root' label.
+      const label = userRootNamespace === '' ? 'root' : userRootNamespace;
+      options.unshift({ path: userRootNamespace, label });
+    }
+
+    // If there are no namespaces returned by the internal endpoint, add the current namespace
+    // to the list of options. This is a fallback for when the user has access to a single namespace.
+    if (options.length === 0) {
+      // 'path' defined in the namespace service is the full namespace path
+      options.push({ path: this.namespace.path, label: this.namespace.path });
+    }
+
+    return options;
+  }
+}
diff --git a/ui/app/components/wizard-content.js b/ui/app/components/wizard-content.js
deleted file mode 100644
index 0cb344d1d57..00000000000
--- a/ui/app/components/wizard-content.js
+++ /dev/null
@@ -1,123 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { alias, reads } from '@ember/object/computed';
-import { service } from '@ember/service';
-import Component from '@ember/component';
-import { computed } from '@ember/object';
-import { FEATURE_MACHINE_STEPS, INIT_STEPS } from 'vault/helpers/wizard-constants';
-
-export default Component.extend({
-  wizard: service(),
-  classNames: ['ui-wizard'],
-  glyph: null,
-  headerText: null,
-  selectProgress: null,
-  currentMachine: alias('wizard.currentMachine'),
-  tutorialState: alias('wizard.currentState'),
-  tutorialComponent: alias('wizard.tutorialComponent'),
-  showProgress: computed(
-    'tutorialComponent',
-    'tutorialState',
-    'wizard.{featureComponent,featureMachineHistory}',
-    function () {
-      if (!this.tutorialComponent) return;
-      return (
-        this.tutorialComponent.includes('active') &&
-        (this.tutorialState.includes('init.active') ||
-          (this.wizard.featureComponent && this.wizard.featureMachineHistory))
-      );
-    }
-  ),
-  featureMachineHistory: alias('wizard.featureMachineHistory'),
-  totalFeatures: reads('wizard.featureList.length'),
-  completedFeatures: computed('wizard.currentMachine', function () {
-    return this.wizard.getCompletedFeatures();
-  }),
-  currentFeatureProgress: computed(
-    'currentMachine',
-    'featureMachineHistory.[]',
-    'tutorialState',
-    function () {
-      if (this.tutorialState.includes('active.feature')) {
-        let totalSteps = FEATURE_MACHINE_STEPS[this.currentMachine];
-        if (this.currentMachine === 'secrets') {
-          if (this.featureMachineHistory.includes('secret')) {
-            totalSteps = totalSteps['secret']['secret'];
-          }
-          if (this.featureMachineHistory.includes('list')) {
-            totalSteps = totalSteps['secret']['list'];
-          }
-          if (this.featureMachineHistory.includes('encryption')) {
-            totalSteps = totalSteps['encryption'];
-          }
-          if (this.featureMachineHistory.includes('role') || typeof totalSteps === 'object') {
-            totalSteps = totalSteps['role'];
-          }
-        }
-        return {
-          percentage: (this.featureMachineHistory.length / totalSteps) * 100,
-          feature: this.currentMachine,
-          text: `Step ${this.featureMachineHistory.length} of ${totalSteps}`,
-        };
-      }
-      return null;
-    }
-  ),
-  currentTutorialProgress: computed('tutorialState', function () {
-    if (this.tutorialState.includes('init.active')) {
-      const currentStepName = this.tutorialState.split('.')[2];
-      const currentStepNumber = INIT_STEPS.indexOf(currentStepName) + 1;
-      return {
-        percentage: (currentStepNumber / INIT_STEPS.length) * 100,
-        text: `Step ${currentStepNumber} of ${INIT_STEPS.length}`,
-      };
-    }
-    return null;
-  }),
-  progressBar: computed(
-    'completedFeatures',
-    'currentFeature',
-    'currentFeatureProgress.percentage',
-    'currentMachine',
-    'currentTutorialProgress.percentage',
-    'wizard.featureList',
-    function () {
-      const bar = [];
-      if (this.currentTutorialProgress) {
-        bar.push({
-          style: `width:${this.currentTutorialProgress.percentage}%;`,
-          completed: false,
-          showIcon: true,
-        });
-      } else {
-        if (this.currentFeatureProgress) {
-          this.completedFeatures.forEach((feature) => {
-            bar.push({ style: 'width:100%;', completed: true, feature: feature, showIcon: true });
-          });
-          this.wizard.featureList.forEach((feature) => {
-            if (feature === this.currentMachine) {
-              bar.push({
-                style: `width:${this.currentFeatureProgress.percentage}%;`,
-                completed: this.currentFeatureProgress.percentage == 100 ? true : false,
-                feature: feature,
-                showIcon: true,
-              });
-            } else {
-              bar.push({ style: 'width:0%;', completed: false, feature: feature, showIcon: true });
-            }
-          });
-        }
-      }
-      return bar;
-    }
-  ),
-
-  actions: {
-    dismissWizard() {
-      this.wizard.transitionTutorialMachine(this.wizard.currentState, 'DISMISS');
-    },
-  },
-});
diff --git a/ui/app/components/wizard/features-selection.js b/ui/app/components/wizard/features-selection.js
deleted file mode 100644
index 25f557f2025..00000000000
--- a/ui/app/components/wizard/features-selection.js
+++ /dev/null
@@ -1,149 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { or, not } from '@ember/object/computed';
-import { service } from '@ember/service';
-import Component from '@ember/component';
-import { computed } from '@ember/object';
-import { FEATURE_MACHINE_TIME } from 'vault/helpers/wizard-constants';
-
-export default Component.extend({
-  wizard: service(),
-  version: service(),
-  permissions: service(),
-
-  init() {
-    this._super(...arguments);
-    this.maybeHideFeatures();
-  },
-
-  maybeHideFeatures() {
-    const features = this.allFeatures;
-    features.forEach((feat) => {
-      feat.disabled = this.doesNotHavePermission(feat.requiredPermissions);
-    });
-
-    if (this.showReplication === false) {
-      const feature = this.allFeatures.find((f) => f.key === 'replication');
-      feature.show = false;
-    }
-  },
-
-  doesNotHavePermission(requiredPermissions) {
-    // requiredPermissions is an object of paths and capabilities defined within allFeatures.
-    // the expected shape is:
-    // {
-    //   'example/path': ['capability'],
-    //   'second/example/path': ['update', 'sudo'],
-    // }
-    return !Object.keys(requiredPermissions).every((path) => {
-      return this.permissions.hasPermission(path, requiredPermissions[path]);
-    });
-  },
-
-  estimatedTime: computed('selectedFeatures', function () {
-    let time = 0;
-    for (const feature of Object.keys(FEATURE_MACHINE_TIME)) {
-      if (this.selectedFeatures.includes(feature)) {
-        time += FEATURE_MACHINE_TIME[feature];
-      }
-    }
-    return time;
-  }),
-  selectProgress: computed('selectedFeatures', function () {
-    let bar = this.selectedFeatures.map((feature) => {
-      return { style: 'width:0%;', completed: false, showIcon: true, feature: feature };
-    });
-    if (bar.length === 0) {
-      bar = [{ style: 'width:0%;', showIcon: false }];
-    }
-    return bar;
-  }),
-  allFeatures: computed(function () {
-    return [
-      {
-        key: 'secrets',
-        name: 'Secrets',
-        steps: ['Enabling a Secrets Engine', 'Adding a secret'],
-        selected: false,
-        show: true,
-        disabled: false,
-        requiredPermissions: {
-          'sys/mounts/example': ['update'],
-        },
-      },
-      {
-        key: 'authentication',
-        name: 'Authentication',
-        steps: ['Enabling an Auth Method', 'Managing your Auth Method'],
-        selected: false,
-        show: true,
-        disabled: false,
-        requiredPermissions: {
-          'sys/auth': ['read'],
-          'sys/auth/foo': ['update', 'sudo'],
-        },
-      },
-      {
-        key: 'policies',
-        name: 'Policies',
-        steps: [
-          'Choosing a policy type',
-          'Creating a policy',
-          'Deleting your policy',
-          'Other types of policies',
-        ],
-        selected: false,
-        show: true,
-        disabled: false,
-        requiredPermissions: {
-          'sys/policies/acl': ['list'],
-        },
-      },
-      {
-        key: 'replication',
-        name: 'Replication',
-        steps: ['Setting up replication', 'Your cluster information'],
-        selected: false,
-        show: true,
-        disabled: false,
-        requiredPermissions: {
-          'sys/replication/performance/primary/enable': ['update'],
-          'sys/replication/dr/primary/enable': ['update'],
-        },
-      },
-      {
-        key: 'tools',
-        name: 'Tools',
-        steps: ['Wrapping data', 'Lookup wrapped data', 'Rewrapping your data', 'Unwrapping your data'],
-        selected: false,
-        show: true,
-        disabled: false,
-        requiredPermissions: {
-          'sys/wrapping/wrap': ['update'],
-          'sys/wrapping/lookup': ['update'],
-          'sys/wrapping/unwrap': ['update'],
-          'sys/wrapping/rewrap': ['update'],
-        },
-      },
-    ];
-  }),
-
-  showReplication: or('version.hasPerfReplication', 'version.hasDRReplication'),
-
-  selectedFeatures: computed('allFeatures.@each.selected', function () {
-    return this.allFeatures.filter((feature) => feature.selected).map((feature) => feature.key);
-  }),
-
-  cannotStartWizard: not('selectedFeatures.length'),
-
-  actions: {
-    saveFeatures() {
-      const wizard = this.wizard;
-      wizard.saveFeatures(this.selectedFeatures);
-      wizard.transitionTutorialMachine('active.select', 'CONTINUE');
-    },
-  },
-});
diff --git a/ui/app/components/wizard/mounts-wizard.js b/ui/app/components/wizard/mounts-wizard.js
deleted file mode 100644
index e1ae26cf6d9..00000000000
--- a/ui/app/components/wizard/mounts-wizard.js
+++ /dev/null
@@ -1,77 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { service } from '@ember/service';
-import { alias, equal } from '@ember/object/computed';
-import Component from '@ember/component';
-import { computed } from '@ember/object';
-import { mountableEngines } from 'vault/helpers/mountable-secret-engines';
-import { methods } from 'vault/helpers/mountable-auth-methods';
-import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
-const supportedSecrets = supportedSecretBackends();
-import { supportedAuthBackends } from 'vault/helpers/supported-auth-backends';
-const supportedAuth = supportedAuthBackends();
-
-export default Component.extend({
-  wizard: service(),
-  featureState: alias('wizard.featureState'),
-  currentState: alias('wizard.currentState'),
-  currentMachine: alias('wizard.currentMachine'),
-  mountSubtype: alias('wizard.componentState'),
-  fullNextStep: alias('wizard.nextStep'),
-  nextFeature: alias('wizard.nextFeature'),
-  nextStep: computed('fullNextStep', function () {
-    return this.fullNextStep.split('.').lastObject;
-  }),
-  needsConnection: equal('mountSubtype', 'database'),
-  needsEncryption: equal('mountSubtype', 'transit'),
-  stepComponent: alias('wizard.stepComponent'),
-  detailsComponent: computed('currentMachine', 'mountSubtype', function () {
-    const suffix = this.currentMachine === 'secrets' ? 'engine' : 'method';
-    return this.mountSubtype ? `wizard/${this.mountSubtype}-${suffix}` : null;
-  }),
-  isSupported: computed('currentMachine', 'mountSubtype', function () {
-    if (this.currentMachine === 'secrets') {
-      return supportedSecrets.includes(this.mountSubtype);
-    } else {
-      return supportedAuth.includes(this.mountSubtype);
-    }
-  }),
-  mountName: computed('currentMachine', 'mountSubtype', function () {
-    if (this.currentMachine === 'secrets') {
-      const secret = mountableEngines().find((engine) => {
-        return engine.type === this.mountSubtype;
-      });
-      if (secret) {
-        return secret.displayName;
-      }
-    } else {
-      var auth = methods().find((method) => {
-        return method.type === this.mountSubtype;
-      });
-      if (auth) {
-        return auth.displayName;
-      }
-    }
-    return null;
-  }),
-  actionText: computed('mountSubtype', function () {
-    switch (this.mountSubtype) {
-      case 'aws':
-        return 'Generate credential';
-      case 'ssh':
-        return 'Sign keys';
-      case 'pki':
-        return 'Generate certificate';
-      default:
-        return null;
-    }
-  }),
-
-  onAdvance() {},
-  onRepeat() {},
-  onReset() {},
-  onDone() {},
-});
diff --git a/ui/app/components/wizard/secrets-keymgmt.js b/ui/app/components/wizard/secrets-keymgmt.js
deleted file mode 100644
index e17b3f80f54..00000000000
--- a/ui/app/components/wizard/secrets-keymgmt.js
+++ /dev/null
@@ -1,32 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-
-export default class WizardSecretsKeymgmtComponent extends Component {
-  get headerText() {
-    return {
-      provider: 'Creating a provider',
-      displayProvider: 'Distributing a key',
-      distribute: 'Creating a key',
-    }[this.args.featureState];
-  }
-
-  get body() {
-    return {
-      provider: 'This process connects an external provider to Vault. You will need its credentials.',
-      displayProvider: 'A key can now be created and distributed to this destination.',
-      distribute: 'This process creates a key and distributes it to your provider.',
-    }[this.args.featureState];
-  }
-
-  get instructions() {
-    return {
-      provider: 'Enter your provider details and click “Create provider“.',
-      displayProvider: 'Click “Distribute key” in the toolbar.',
-      distribute: 'Enter your key details and click “Distribute key”.',
-    }[this.args.featureState];
-  }
-}
diff --git a/ui/app/components/wrap-ttl.hbs b/ui/app/components/wrap-ttl.hbs
index 875470ecc97..e3709cd7cc8 100644
--- a/ui/app/components/wrap-ttl.hbs
+++ b/ui/app/components/wrap-ttl.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="field">
   <TtlPicker
diff --git a/ui/app/components/wrap-ttl.js b/ui/app/components/wrap-ttl.js
index 9c2039bf797..e53e9071dba 100644
--- a/ui/app/components/wrap-ttl.js
+++ b/ui/app/components/wrap-ttl.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/components/z-docfy-filter.hbs b/ui/app/components/z-docfy-filter.hbs
new file mode 100644
index 00000000000..2da09321d49
--- /dev/null
+++ b/ui/app/components/z-docfy-filter.hbs
@@ -0,0 +1,19 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Form::TextInput::Field @type="search" placeholder="Filter components" {{on "input" this.filterComponents}} />
+
+<Hds::Reveal
+  class="docs-collapse-toggle has-top-padding-s"
+  @text="Expand component list"
+  @textWhenOpen="Collapse component list"
+  @isOpen={{true}}
+>
+  {{#each this.componentList as |component|}}
+    <DocfyLink @to={{component.url}} class="hds-side-nav__list-item-link docs-hover">
+      {{component.title}}
+    </DocfyLink>
+  {{/each}}
+</Hds::Reveal>
\ No newline at end of file
diff --git a/ui/app/components/z-docfy-filter.js b/ui/app/components/z-docfy-filter.js
new file mode 100644
index 00000000000..23d27bec352
--- /dev/null
+++ b/ui/app/components/z-docfy-filter.js
@@ -0,0 +1,24 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+
+// DEVELOPMENT ONLY COMPONENT used for filtering docfy components
+export default class ZDocfyFilter extends Component {
+  @tracked filterValue;
+
+  @action
+  filterComponents({ target }) {
+    this.filterValue = target.value;
+  }
+
+  get componentList() {
+    return this.filterValue
+      ? this.args.components.filter((c) => c.title.toLowerCase().includes(this.filterValue.toLowerCase()))
+      : this.args.components;
+  }
+}
diff --git a/ui/app/config/environment.d.ts b/ui/app/config/environment.d.ts
index 0c5887b003c..7a5cc07a6bc 100644
--- a/ui/app/config/environment.d.ts
+++ b/ui/app/config/environment.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,7 +13,16 @@ declare const config: {
   podModulePrefix: string;
   locationType: 'history' | 'hash' | 'none';
   rootURL: string;
-  APP: Record<string, unknown>;
+  APP: {
+    POLLING_URLS: string[];
+    NAMESPACE_ROOT_URLS: string[];
+    DEFAULT_PAGE_SIZE: number;
+    LOG_TRANSITIONS?: boolean;
+    LOG_ACTIVE_GENERATION?: boolean;
+    LOG_VIEW_LOOKUPS?: boolean;
+    rootElement?: string;
+    autoboot?: boolean;
+  };
 };
 
 export default config;
diff --git a/ui/app/controllers/application.js b/ui/app/controllers/application.js
deleted file mode 100644
index 97e5e50bc3f..00000000000
--- a/ui/app/controllers/application.js
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { service } from '@ember/service';
-import Controller from '@ember/controller';
-import config from '../config/environment';
-
-export default Controller.extend({
-  env: config.environment,
-  auth: service(),
-  store: service(),
-});
diff --git a/ui/app/controllers/application.ts b/ui/app/controllers/application.ts
new file mode 100644
index 00000000000..a6cc0ecff58
--- /dev/null
+++ b/ui/app/controllers/application.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { service } from '@ember/service';
+import Controller from '@ember/controller';
+import config from '../config/environment';
+
+import type AuthService from 'vault/vault/services/auth';
+import type Store from '@ember-data/store';
+
+export default class ApplicationController extends Controller {
+  @service declare readonly auth: AuthService;
+  @service declare readonly store: Store;
+  env = config.environment;
+}
diff --git a/ui/app/controllers/vault.js b/ui/app/controllers/vault.js
index 2bfe50c601f..2c83a2cd267 100644
--- a/ui/app/controllers/vault.js
+++ b/ui/app/controllers/vault.js
@@ -1,17 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
 
 export default class VaultController extends Controller {
-  queryParams = [
-    {
-      wrappedToken: 'wrapped_token',
-      redirectTo: 'redirect_to',
-    },
-  ];
-  wrappedToken = '';
+  queryParams = [{ redirectTo: 'redirect_to' }];
   redirectTo = '';
 }
diff --git a/ui/app/controllers/vault/cluster.js b/ui/app/controllers/vault/cluster.js
index 962d8c3e334..cf2ccb1f910 100644
--- a/ui/app/controllers/vault/cluster.js
+++ b/ui/app/controllers/vault/cluster.js
@@ -1,49 +1,23 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-/* eslint-disable ember/no-observers */
-import { service } from '@ember/service';
-import { alias } from '@ember/object/computed';
 import Controller from '@ember/controller';
-import { observer } from '@ember/object';
-export default Controller.extend({
-  auth: service(),
-  store: service(),
-  media: service(),
-  router: service(),
-  permissions: service(),
-  namespaceService: service('namespace'),
-  flashMessages: service(),
-  customMessages: service(),
-
-  vaultVersion: service('version'),
-  console: service(),
-
-  queryParams: [
-    {
-      namespaceQueryParam: {
-        scope: 'controller',
-        as: 'namespace',
-      },
-    },
-  ],
-
-  namespaceQueryParam: '',
-
-  onQPChange: observer('namespaceQueryParam', function () {
-    this.namespaceService.setNamespace(this.namespaceQueryParam);
-  }),
-
-  consoleOpen: alias('console.isOpen'),
-  activeCluster: alias('auth.activeCluster'),
-
-  permissionBanner: alias('permissions.permissionsBanner'),
-
-  actions: {
-    toggleConsole() {
-      this.toggleProperty('consoleOpen');
-    },
-  },
-});
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+
+export default class VaultClusterController extends Controller {
+  @service auth;
+  @service permissions;
+  @service customMessages;
+  @service flashMessages;
+  @service('version') vaultVersion;
+
+  queryParams = [{ namespaceQueryParam: { as: 'namespace' } }];
+  @tracked namespaceQueryParam = '';
+
+  get activeCluster() {
+    return this.auth.activeCluster;
+  }
+}
diff --git a/ui/app/controllers/vault/cluster/access/control-groups-configure.js b/ui/app/controllers/vault/cluster/access/control-groups-configure.js
index 106370b23b7..a3da9830d78 100644
--- a/ui/app/controllers/vault/cluster/access/control-groups-configure.js
+++ b/ui/app/controllers/vault/cluster/access/control-groups-configure.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/identity/aliases/add.js b/ui/app/controllers/vault/cluster/access/identity/aliases/add.js
index b2cf806803f..9c735f54128 100644
--- a/ui/app/controllers/vault/cluster/access/identity/aliases/add.js
+++ b/ui/app/controllers/vault/cluster/access/identity/aliases/add.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/identity/aliases/edit.js b/ui/app/controllers/vault/cluster/access/identity/aliases/edit.js
index 55a6a0a96dc..d681bb8811b 100644
--- a/ui/app/controllers/vault/cluster/access/identity/aliases/edit.js
+++ b/ui/app/controllers/vault/cluster/access/identity/aliases/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/identity/aliases/index.js b/ui/app/controllers/vault/cluster/access/identity/aliases/index.js
index 7f69a355106..f28406947a6 100644
--- a/ui/app/controllers/vault/cluster/access/identity/aliases/index.js
+++ b/ui/app/controllers/vault/cluster/access/identity/aliases/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/identity/create.js b/ui/app/controllers/vault/cluster/access/identity/create.js
index 3f6d1c8bae2..8f56ba2839e 100644
--- a/ui/app/controllers/vault/cluster/access/identity/create.js
+++ b/ui/app/controllers/vault/cluster/access/identity/create.js
@@ -1,11 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
 import { service } from '@ember/service';
 
+/**
+ * @type Class
+ */
 export default Controller.extend({
   router: service(),
   showRoute: 'vault.cluster.access.identity.show',
diff --git a/ui/app/controllers/vault/cluster/access/identity/edit.js b/ui/app/controllers/vault/cluster/access/identity/edit.js
index db47d3a80a1..ab5850286c2 100644
--- a/ui/app/controllers/vault/cluster/access/identity/edit.js
+++ b/ui/app/controllers/vault/cluster/access/identity/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/identity/index.js b/ui/app/controllers/vault/cluster/access/identity/index.js
index 3e647290bce..c8200257e0e 100644
--- a/ui/app/controllers/vault/cluster/access/identity/index.js
+++ b/ui/app/controllers/vault/cluster/access/identity/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -24,7 +24,7 @@ export default Controller.extend(ListController, {
 
   actions: {
     delete(model) {
-      const type = model.get('identityType');
+      const type = model.identityType;
       const id = model.id;
       return model
         .destroyRecord()
@@ -41,8 +41,8 @@ export default Controller.extend(ListController, {
     },
 
     toggleDisabled(model) {
-      const action = model.get('disabled') ? ['enabled', 'enabling'] : ['disabled', 'disabling'];
-      const type = model.get('identityType');
+      const action = model.disabled ? ['enabled', 'enabling'] : ['disabled', 'disabling'];
+      const type = model.identityType;
       const id = model.id;
       model.toggleProperty('disabled');
 
diff --git a/ui/app/controllers/vault/cluster/access/identity/merge.js b/ui/app/controllers/vault/cluster/access/identity/merge.js
index db47d3a80a1..ab5850286c2 100644
--- a/ui/app/controllers/vault/cluster/access/identity/merge.js
+++ b/ui/app/controllers/vault/cluster/access/identity/merge.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/leases/index.js b/ui/app/controllers/vault/cluster/access/leases/index.js
index 6b474a371de..50ec9cdc9fe 100644
--- a/ui/app/controllers/vault/cluster/access/leases/index.js
+++ b/ui/app/controllers/vault/cluster/access/leases/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/leases/list-root.js b/ui/app/controllers/vault/cluster/access/leases/list-root.js
index 426f59f55ac..8ace7710033 100644
--- a/ui/app/controllers/vault/cluster/access/leases/list-root.js
+++ b/ui/app/controllers/vault/cluster/access/leases/list-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/leases/list.js b/ui/app/controllers/vault/cluster/access/leases/list.js
index 12ebef8bdcf..4735c8aa321 100644
--- a/ui/app/controllers/vault/cluster/access/leases/list.js
+++ b/ui/app/controllers/vault/cluster/access/leases/list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -26,8 +26,8 @@ export default Controller.extend(ListController, {
 
   backendCrumb: computed('clusterController.model.name', function () {
     return {
-      label: 'leases',
-      text: 'leases',
+      label: 'Leases',
+      text: 'Leases',
       path: 'vault.cluster.access.leases.list-root',
       model: this.clusterController.model.name,
     };
diff --git a/ui/app/controllers/vault/cluster/access/leases/show.js b/ui/app/controllers/vault/cluster/access/leases/show.js
index 2147fb17fbf..4b84a3b5363 100644
--- a/ui/app/controllers/vault/cluster/access/leases/show.js
+++ b/ui/app/controllers/vault/cluster/access/leases/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,8 +13,8 @@ export default Controller.extend({
 
   backendCrumb: computed('clusterController.model.name', function () {
     return {
-      label: 'leases',
-      text: 'leases',
+      label: 'Leases',
+      text: 'Leases',
       path: 'vault.cluster.access.leases.list-root',
       model: this.clusterController.model.name,
     };
diff --git a/ui/app/controllers/vault/cluster/access/method/item/list.js b/ui/app/controllers/vault/cluster/access/method/item/list.js
index d450e242d07..25d85b695da 100644
--- a/ui/app/controllers/vault/cluster/access/method/item/list.js
+++ b/ui/app/controllers/vault/cluster/access/method/item/list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/methods.js b/ui/app/controllers/vault/cluster/access/methods.js
index 455b1208708..91518662866 100644
--- a/ui/app/controllers/vault/cluster/access/methods.js
+++ b/ui/app/controllers/vault/cluster/access/methods.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,9 +8,12 @@ import { dropTask } from 'ember-concurrency';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
+import sortObjects from 'vault/utils/sort-objects';
 
 export default class VaultClusterAccessMethodsController extends Controller {
   @service flashMessages;
+  @service api;
+  @service router;
 
   @tracked authMethodOptions = [];
   @tracked selectedAuthType = null;
@@ -23,24 +26,26 @@ export default class VaultClusterAccessMethodsController extends Controller {
   pageFilter = null;
   filter = null;
 
+  // list returned by getter is sorted in template
   get authMethodList() {
+    const { methods } = this.model;
     // return an options list to filter by engine type, ex: 'kv'
     if (this.selectedAuthType) {
       // check first if the user has also filtered by name.
       // names are individualized across type so you can't have the same name for an aws auth method and userpass.
       // this means it's fine to filter by first type and then name or just name.
       if (this.selectedAuthName) {
-        return this.model.filter((method) => this.selectedAuthName === method.id);
+        return methods.filter((method) => this.selectedAuthName === method.id);
       }
       // otherwise filter by auth type
-      return this.model.filter((method) => this.selectedAuthType === method.type);
+      return methods.filter((method) => this.selectedAuthType === method.type);
     }
     // return an options list to filter by auth name, ex: 'my-userpass'
     if (this.selectedAuthName) {
-      return this.model.filter((method) => this.selectedAuthName === method.id);
+      return methods.filter((method) => this.selectedAuthName === method.id);
     }
-    // no filters, return full sorted list.
-    return this.model;
+    // no filters, return full list
+    return methods;
   }
 
   get authMethodArrayByType() {
@@ -75,14 +80,21 @@ export default class VaultClusterAccessMethodsController extends Controller {
   *disableMethod(method) {
     const { type, path } = method;
     try {
-      yield method.destroyRecord();
+      yield this.api.sys.authDisableMethod(path);
       this.flashMessages.success(`The ${type} Auth Method at ${path} has been disabled.`);
+      this.router.transitionTo('vault.cluster.access.methods');
     } catch (err) {
-      this.flashMessages.danger(
-        `There was an error disabling Auth Method at ${path}: ${err.errors.join(' ')}.`
-      );
+      const { message } = yield this.api.parseError(err);
+      this.flashMessages.danger(`There was an error disabling Auth Method at ${path}: ${message}.`);
     } finally {
       this.methodToDisable = null;
     }
   }
+
+  // template helper
+  sortMethods = (methods) => {
+    // make sure there are methods to sort otherwise slice with throw an error
+    if (!Array.isArray(methods) || methods.length === 0) return [];
+    return sortObjects(methods.slice(), 'path');
+  };
 }
diff --git a/ui/app/controllers/vault/cluster/access/mfa/enforcements/enforcement/index.js b/ui/app/controllers/vault/cluster/access/mfa/enforcements/enforcement/index.js
index ed5d7101ecb..faf10758300 100644
--- a/ui/app/controllers/vault/cluster/access/mfa/enforcements/enforcement/index.js
+++ b/ui/app/controllers/vault/cluster/access/mfa/enforcements/enforcement/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/mfa/enforcements/index.js b/ui/app/controllers/vault/cluster/access/mfa/enforcements/index.js
index 7b7650f5c01..71b563927f7 100644
--- a/ui/app/controllers/vault/cluster/access/mfa/enforcements/index.js
+++ b/ui/app/controllers/vault/cluster/access/mfa/enforcements/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/mfa/methods.js b/ui/app/controllers/vault/cluster/access/mfa/methods.js
index 926edc10d7b..f46749e69a0 100644
--- a/ui/app/controllers/vault/cluster/access/mfa/methods.js
+++ b/ui/app/controllers/vault/cluster/access/mfa/methods.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/mfa/methods/create.js b/ui/app/controllers/vault/cluster/access/mfa/methods/create.js
index 93cc7fea306..c7b6dc4bec3 100644
--- a/ui/app/controllers/vault/cluster/access/mfa/methods/create.js
+++ b/ui/app/controllers/vault/cluster/access/mfa/methods/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { tracked } from '@glimmer/tracking';
 import { action } from '@ember/object';
 import { capitalize } from '@ember/string';
 import { task } from 'ember-concurrency';
+import { addToArray } from 'vault/helpers/add-to-array';
 
 export default class MfaMethodCreateController extends Controller {
   @service store;
@@ -18,9 +19,9 @@ export default class MfaMethodCreateController extends Controller {
   queryParams = ['type'];
   methods = [
     { name: 'TOTP', icon: 'history' },
-    { name: 'Duo', icon: 'duo' },
+    { name: 'Duo', icon: 'duo-color' },
     { name: 'Okta', icon: 'okta-color' },
-    { name: 'PingID', icon: 'pingid' },
+    { name: 'PingID', icon: 'ping-identity-color' },
   ];
 
   @tracked type = null;
@@ -95,7 +96,9 @@ export default class MfaMethodCreateController extends Controller {
         // first save method
         yield this.method.save();
         if (this.enforcement) {
-          this.enforcement.mfa_methods.addObject(this.method);
+          // mfa_methods is type PromiseManyArray. Array methods like slice are no longer allowed on PromiseManyArray. We must yield the promise first, then call the method.
+          const mfaMethods = yield this.enforcement.mfa_methods;
+          this.enforcement.mfa_methods = addToArray(mfaMethods.slice(), this.method);
           try {
             // now save enforcement and catch error separately
             yield this.enforcement.save();
diff --git a/ui/app/controllers/vault/cluster/access/mfa/methods/method/index.js b/ui/app/controllers/vault/cluster/access/mfa/methods/method/index.js
index c4c3f7d83f2..78c845f90f2 100644
--- a/ui/app/controllers/vault/cluster/access/mfa/methods/method/index.js
+++ b/ui/app/controllers/vault/cluster/access/mfa/methods/method/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/namespaces/create.js b/ui/app/controllers/vault/cluster/access/namespaces/create.js
index 2b150eed7ae..85c0a7a3698 100644
--- a/ui/app/controllers/vault/cluster/access/namespaces/create.js
+++ b/ui/app/controllers/vault/cluster/access/namespaces/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/namespaces/index.js b/ui/app/controllers/vault/cluster/access/namespaces/index.js
index 5eb3e744d82..929b75cdddb 100644
--- a/ui/app/controllers/vault/cluster/access/namespaces/index.js
+++ b/ui/app/controllers/vault/cluster/access/namespaces/index.js
@@ -1,20 +1,100 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
-import { alias } from '@ember/object/computed';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
 import Controller from '@ember/controller';
-export default Controller.extend({
-  namespaceService: service('namespace'),
-  accessibleNamespaces: alias('namespaceService.accessibleNamespaces'),
-  currentNamespace: alias('namespaceService.path'),
-  actions: {
-    refreshNamespaceList() {
-      // fetch new namespaces for the namespace picker
-      this.namespaceService.findNamespacesForUser.perform();
-      this.send('reload');
-    },
-  },
-});
+import keys from 'core/utils/keys';
+
+/**
+ * @module ManageNamespaces
+ * ManageNamespacesController is the controller for the
+ * vault.cluster.access.namespaces.index route.
+ *
+ * @param {object} namespaces - list of namespaces
+ * @param {string} pageFilter - value of queryParam
+ * @param {string} page - value of queryParam
+ */
+export default class ManageNamespacesController extends Controller {
+  queryParams = ['pageFilter', 'page'];
+
+  // Use namespaceService alias to avoid collision with namespaces
+  // input parameter from the route.
+  @service('namespace') namespaceService;
+  @service router;
+  @service flashMessages;
+
+  // The `query` property is used to track the filter
+  // input value seperately from updating the `pageFilter`
+  // browser query param to prevent unnecessary re-renders.
+  @tracked query;
+  @tracked pageFilter = '';
+
+  constructor() {
+    super(...arguments);
+    this.query = this.pageFilter;
+  }
+
+  navigate(pageFilter) {
+    const route = 'vault.cluster.access.namespaces.index';
+    const args = [route, { queryParams: { page: 1, pageFilter: pageFilter || null } }];
+    this.router.transitionTo(...args);
+  }
+
+  @action
+  handleKeyDown(event) {
+    const isEscKeyPressed = keys.ESC.includes(event.key);
+    if (isEscKeyPressed) {
+      // On escape, transition to roles index route.
+      this.navigate();
+    }
+    // ignore all other key events
+  }
+
+  @action handleInput(evt) {
+    this.query = evt.target.value;
+  }
+
+  @action
+  handleSearch(evt) {
+    evt.preventDefault();
+    this.navigate(this.query);
+  }
+
+  @action
+  async deleteNamespace(nsToDelete) {
+    try {
+      // Attempt to destroy the record
+      await nsToDelete.destroyRecord();
+
+      // Log success and optionally update the UI
+      this.flashMessages.success(`Successfully deleted namespace: ${nsToDelete.id}`);
+
+      // Call the refresh method to update the list
+      this.refreshNamespaceList();
+    } catch (error) {
+      this.flashMessages.danger(`There was an error deleting this namespace: ${error.message}`);
+    }
+  }
+
+  @action
+  async refreshNamespaceList() {
+    try {
+      // Await the async operation to complete
+      await this.namespaceService.findNamespacesForUser.perform();
+      this.send('reload'); // Trigger the reload only after the task completes
+    } catch (error) {
+      this.flashMessages.danger('There was an error refreshing the namespace list.');
+    }
+  }
+
+  @action
+  switchNamespace(targetNamespace) {
+    this.router.transitionTo('vault.cluster.dashboard', {
+      queryParams: { namespace: targetNamespace },
+    });
+  }
+}
diff --git a/ui/app/controllers/vault/cluster/access/oidc.js b/ui/app/controllers/vault/cluster/access/oidc.js
index aa5a1b718ae..393e7aaaa94 100644
--- a/ui/app/controllers/vault/cluster/access/oidc.js
+++ b/ui/app/controllers/vault/cluster/access/oidc.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/oidc/assignments/assignment/details.js b/ui/app/controllers/vault/cluster/access/oidc/assignments/assignment/details.js
index 00ae37a0ac7..5e8b3520e5c 100644
--- a/ui/app/controllers/vault/cluster/access/oidc/assignments/assignment/details.js
+++ b/ui/app/controllers/vault/cluster/access/oidc/assignments/assignment/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/oidc/clients/client.js b/ui/app/controllers/vault/cluster/access/oidc/clients/client.js
index e7ac62fb076..afe3098b919 100644
--- a/ui/app/controllers/vault/cluster/access/oidc/clients/client.js
+++ b/ui/app/controllers/vault/cluster/access/oidc/clients/client.js
@@ -1,26 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
 import { service } from '@ember/service';
-import { tracked } from '@glimmer/tracking';
 
 export default class OidcClientController extends Controller {
   @service router;
-  @tracked isEditRoute;
-
-  constructor() {
-    super(...arguments);
-    this.router.on(
-      'routeDidChange',
-      ({ targetName }) => (this.isEditRoute = targetName.includes('edit') ? true : false)
-    );
-  }
-
-  get showHeader() {
-    // hide header when rendering the edit form
-    return !this.isEditRoute;
-  }
 }
diff --git a/ui/app/controllers/vault/cluster/access/oidc/clients/client/details.js b/ui/app/controllers/vault/cluster/access/oidc/clients/client/details.js
index 0a7b1ea927d..64e3f514bba 100644
--- a/ui/app/controllers/vault/cluster/access/oidc/clients/client/details.js
+++ b/ui/app/controllers/vault/cluster/access/oidc/clients/client/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/oidc/keys/key.js b/ui/app/controllers/vault/cluster/access/oidc/keys/key.js
index c66fd874dc6..367c9a3104f 100644
--- a/ui/app/controllers/vault/cluster/access/oidc/keys/key.js
+++ b/ui/app/controllers/vault/cluster/access/oidc/keys/key.js
@@ -1,25 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
 import { service } from '@ember/service';
-import { tracked } from '@glimmer/tracking';
 
 export default class OidcKeyController extends Controller {
   @service router;
-  @tracked isEditRoute;
-
-  constructor() {
-    super(...arguments);
-    this.router.on('routeDidChange', ({ targetName }) => {
-      return (this.isEditRoute = targetName.includes('edit') ? true : false);
-    });
-  }
-
-  get showHeader() {
-    // hide header when rendering the edit form
-    return !this.isEditRoute;
-  }
 }
diff --git a/ui/app/controllers/vault/cluster/access/oidc/keys/key/details.js b/ui/app/controllers/vault/cluster/access/oidc/keys/key/details.js
index e6d46694ee0..8e8514a6de9 100644
--- a/ui/app/controllers/vault/cluster/access/oidc/keys/key/details.js
+++ b/ui/app/controllers/vault/cluster/access/oidc/keys/key/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/oidc/providers/provider.js b/ui/app/controllers/vault/cluster/access/oidc/providers/provider.js
index 1c360e102a7..aa50d8e7d6b 100644
--- a/ui/app/controllers/vault/cluster/access/oidc/providers/provider.js
+++ b/ui/app/controllers/vault/cluster/access/oidc/providers/provider.js
@@ -1,25 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
 import { service } from '@ember/service';
-import { tracked } from '@glimmer/tracking';
 
 export default class OidcProviderController extends Controller {
   @service router;
-  @tracked isEditRoute;
-
-  constructor() {
-    super(...arguments);
-    this.router.on('routeDidChange', ({ targetName }) => {
-      return (this.isEditRoute = targetName.includes('edit') ? true : false);
-    });
-  }
-
-  get showHeader() {
-    // hide header when rendering the edit form
-    return !this.isEditRoute;
-  }
 }
diff --git a/ui/app/controllers/vault/cluster/access/oidc/providers/provider/details.js b/ui/app/controllers/vault/cluster/access/oidc/providers/provider/details.js
index d5360813b75..18b62545892 100644
--- a/ui/app/controllers/vault/cluster/access/oidc/providers/provider/details.js
+++ b/ui/app/controllers/vault/cluster/access/oidc/providers/provider/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/access/oidc/scopes/scope/details.js b/ui/app/controllers/vault/cluster/access/oidc/scopes/scope/details.js
index 6cc9c14efef..e8ada25f673 100644
--- a/ui/app/controllers/vault/cluster/access/oidc/scopes/scope/details.js
+++ b/ui/app/controllers/vault/cluster/access/oidc/scopes/scope/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/auth.js b/ui/app/controllers/vault/cluster/auth.js
index 62f137a2078..09d212ccbd6 100644
--- a/ui/app/controllers/vault/cluster/auth.js
+++ b/ui/app/controllers/vault/cluster/auth.js
@@ -1,11 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 import { service } from '@ember/service';
 import { alias } from '@ember/object/computed';
 import Controller, { inject as controller } from '@ember/controller';
-import { task, timeout } from 'ember-concurrency';
+import { task } from 'ember-concurrency';
 import { sanitizePath } from 'core/utils/sanitize-path';
 
 export default Controller.extend({
@@ -13,97 +13,72 @@ export default Controller.extend({
   clusterController: controller('vault.cluster'),
   flashMessages: service(),
   namespaceService: service('namespace'),
-  featureFlagService: service('featureFlag'),
+  flagsService: service('flags'),
   version: service(),
   auth: service(),
   router: service(),
   customMessages: service(),
-  queryParams: [{ authMethod: 'with', oidcProvider: 'o' }],
+  queryParams: [{ authMount: 'with', oidcProvider: 'o' }, 'role'],
   namespaceQueryParam: alias('clusterController.namespaceQueryParam'),
-  wrappedToken: alias('vaultController.wrappedToken'),
   redirectTo: alias('vaultController.redirectTo'),
-  managedNamespaceRoot: alias('featureFlagService.managedNamespaceRoot'),
-  authMethod: '',
-  oidcProvider: '',
+  hvdManagedNamespaceRoot: alias('flagsService.hvdManagedNamespaceRoot'),
+  shouldRefocusNamespaceInput: false,
 
-  get namespaceInput() {
-    const namespaceQP = this.clusterController.namespaceQueryParam;
-    if (this.managedNamespaceRoot) {
-      // When managed, the user isn't allowed to edit the prefix `admin/` for their nested namespace
-      const split = namespaceQP.split('/');
-      if (split.length > 1) {
-        split.shift();
-        return `/${split.join('/')}`;
-      }
-      return '';
-    }
-    return namespaceQP;
-  },
+  // Query params
+  authMount: '',
+  oidcProvider: '',
+  role: '',
+  unwrapTokenError: '',
 
   fullNamespaceFromInput(value) {
     const strippedNs = sanitizePath(value);
-    if (this.managedNamespaceRoot) {
-      return `${this.managedNamespaceRoot}/${strippedNs}`;
+    if (this.hvdManagedNamespaceRoot) {
+      return `${this.hvdManagedNamespaceRoot}/${strippedNs}`;
     }
     return strippedNs;
   },
 
   updateNamespace: task(function* (value) {
-    // debounce
-    yield timeout(500);
     const ns = this.fullNamespaceFromInput(value);
-    this.namespaceService.setNamespace(ns, true);
-    this.customMessages.fetchMessages(ns);
+    this.namespaceService.setNamespace(ns);
+    yield this.customMessages.fetchMessages();
     this.set('namespaceQueryParam', ns);
+    // if user is inputting a namespace, maintain input focus as the param updates
+    this.set('shouldRefocusNamespaceInput', true);
   }).restartable(),
 
-  authSuccess({ isRoot, namespace }) {
+  // TODO CMB move to auth service?
+  loginAndTransition: task(function* ({ isRoot, namespace }) {
     let transition;
     this.version.fetchVersion();
+
     if (this.redirectTo) {
-      // here we don't need the namespace because it will be encoded in redirectTo
       transition = this.router.transitionTo(this.redirectTo);
-      // reset the value on the controller because it's bound here
       this.set('redirectTo', '');
     } else {
       transition = this.router.transitionTo('vault.cluster', { queryParams: { namespace } });
     }
-    transition.followRedirects().then(() => {
-      if (this.version.isEnterprise) {
-        this.customMessages.fetchMessages(namespace);
-      }
 
-      if (isRoot) {
-        this.auth.set('isRootToken', true);
-        this.flashMessages.warning(
-          'You have logged in with a root token. As a security precaution, this root token will not be stored by your browser and you will need to re-authenticate after the window is closed or refreshed.'
-        );
-      }
-    });
-  },
+    yield transition.followRedirects();
+
+    if (this.version.isEnterprise) {
+      yield this.customMessages.fetchMessages();
+    }
+
+    if (isRoot) {
+      this.auth.set('isRootToken', true);
+      this.flashMessages.warning(
+        'You have logged in with a root token. As a security precaution, this root token will not be stored by your browser and you will need to re-authenticate after the window is closed or refreshed.'
+      );
+    }
+  }),
 
   actions: {
-    onAuthResponse(authResponse, backend, data) {
-      const { mfa_requirement } = authResponse;
-      // if an mfa requirement exists further action is required
-      if (mfa_requirement) {
-        this.set('mfaAuthData', { mfa_requirement, backend, data });
-      } else {
-        this.authSuccess(authResponse);
-      }
-    },
-    onMfaSuccess(authResponse) {
-      this.authSuccess(authResponse);
-    },
-    onMfaErrorDismiss() {
-      this.setProperties({
-        mfaAuthData: null,
-        mfaErrors: null,
-      });
-    },
-    cancelAuthentication() {
-      this.set('cancelAuth', true);
-      this.set('waitingForOktaNumberChallenge', false);
+    backToLogin() {
+      // reset error
+      this.set('unwrapTokenError', '');
+      // reset query params and go back to auth route
+      this.router.replaceWith('vault.cluster.auth', { queryParams: { wrapped_token: null } });
     },
   },
 });
diff --git a/ui/app/controllers/vault/cluster/clients.js b/ui/app/controllers/vault/cluster/clients.js
deleted file mode 100644
index e5034dd8295..00000000000
--- a/ui/app/controllers/vault/cluster/clients.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Controller from '@ember/controller';
-
-export default class ClientsController extends Controller {}
diff --git a/ui/app/controllers/vault/cluster/clients/counts.ts b/ui/app/controllers/vault/cluster/clients/counts.ts
index f9125de2f1f..a054c16734c 100644
--- a/ui/app/controllers/vault/cluster/clients/counts.ts
+++ b/ui/app/controllers/vault/cluster/clients/counts.ts
@@ -1,21 +1,39 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
 import { action, set } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import { ClientFilters } from 'core/utils/client-count-utils';
 
 import type { ClientsCountsRouteParams } from 'vault/routes/vault/cluster/clients/counts';
 
-const queryParamKeys = ['start_time', 'end_time', 'ns', 'mountPath'];
+// these params refire the request to /sys/internal/counters/activity
+const ACTIVITY_QUERY_PARAMS = ['start_time', 'end_time'];
+// these params client-side filter table data
+const DROPDOWN_FILTERS = Object.values(ClientFilters);
+const queryParamKeys = [...ACTIVITY_QUERY_PARAMS, ...DROPDOWN_FILTERS];
 export default class ClientsCountsController extends Controller {
   queryParams = queryParamKeys;
 
-  start_time: string | number | undefined = undefined;
-  end_time: string | number | undefined = undefined;
-  ns: string | undefined = undefined;
-  mountPath: string | undefined = undefined;
+  start_time = '';
+  end_time = '';
+  namespace_path = '';
+  mount_path = '';
+  mount_type = '';
+  // Tracked because clients/page/overview.ts has a getter that needs to recompute when this changes
+  @tracked month = '';
+
+  get filterQueryParams() {
+    return {
+      namespace_path: this.namespace_path,
+      mount_path: this.mount_path,
+      mount_type: this.mount_type,
+      month: this.month,
+    };
+  }
 
   // using router.transitionTo to update the query params results in the model hook firing each time
   // this happens when the queryParams object is not added to the route or refreshModel is explicitly set to false
@@ -23,12 +41,12 @@ export default class ClientsCountsController extends Controller {
   @action
   updateQueryParams(updatedParams: ClientsCountsRouteParams) {
     if (!updatedParams) {
-      this.queryParams.forEach((key) => (this[key as keyof ClientsCountsRouteParams] = undefined));
+      this.queryParams.forEach((key) => (this[key as keyof ClientsCountsRouteParams] = ''));
     } else {
       Object.keys(updatedParams).forEach((key) => {
         if (queryParamKeys.includes(key)) {
           const value = updatedParams[key as keyof ClientsCountsRouteParams];
-          set(this, key as keyof ClientsCountsRouteParams, value as keyof ClientsCountsRouteParams);
+          set(this, key as keyof ClientsCountsRouteParams, value);
         }
       });
     }
diff --git a/ui/app/controllers/vault/cluster/clients/counts/client-list.ts b/ui/app/controllers/vault/cluster/clients/counts/client-list.ts
new file mode 100644
index 00000000000..bc3c7544d66
--- /dev/null
+++ b/ui/app/controllers/vault/cluster/clients/counts/client-list.ts
@@ -0,0 +1,12 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Controller, { inject as controller } from '@ember/controller';
+
+import type ClientsCountsController from '../counts';
+
+export default class ClientsCountsClientListController extends Controller {
+  @controller('vault.cluster.clients.counts') declare readonly countsController: ClientsCountsController;
+}
diff --git a/ui/app/controllers/vault/cluster/clients/counts/overview.ts b/ui/app/controllers/vault/cluster/clients/counts/overview.ts
index b5c60816cef..45986e41177 100644
--- a/ui/app/controllers/vault/cluster/clients/counts/overview.ts
+++ b/ui/app/controllers/vault/cluster/clients/counts/overview.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,5 @@ import Controller, { inject as controller } from '@ember/controller';
 import type ClientsCountsController from '../counts';
 
 export default class ClientsCountsOverviewController extends Controller {
-  // not sure why this needs to be cast to never but this definitely accepts a string to point to the controller
-  @controller('vault.cluster.clients.counts' as never)
-  declare readonly countsController: ClientsCountsController;
+  @controller('vault.cluster.clients.counts') declare readonly countsController: ClientsCountsController;
 }
diff --git a/ui/app/controllers/vault/cluster/clients/counts/sync.ts b/ui/app/controllers/vault/cluster/clients/counts/sync.ts
deleted file mode 100644
index a5acc1037dc..00000000000
--- a/ui/app/controllers/vault/cluster/clients/counts/sync.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Controller, { inject as controller } from '@ember/controller';
-
-import type ClientsCountsController from '../counts';
-
-export default class ClientsCountsSyncController extends Controller {
-  // not sure why this needs to be cast to never but this definitely accepts a string to point to the controller
-  @controller('vault.cluster.clients.counts' as never)
-  declare readonly countsController: ClientsCountsController;
-}
diff --git a/ui/app/controllers/vault/cluster/clients/counts/token.ts b/ui/app/controllers/vault/cluster/clients/counts/token.ts
deleted file mode 100644
index eaa3b3cbc0c..00000000000
--- a/ui/app/controllers/vault/cluster/clients/counts/token.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Controller, { inject as controller } from '@ember/controller';
-
-import type ClientsCountsController from '../counts';
-
-export default class ClientsCountsTokenController extends Controller {
-  // not sure why this needs to be cast to never but this definitely accepts a string to point to the controller
-  @controller('vault.cluster.clients.counts' as never)
-  declare readonly countsController: ClientsCountsController;
-}
diff --git a/ui/app/controllers/vault/cluster/dashboard.js b/ui/app/controllers/vault/cluster/dashboard.js
index 8972fda77b4..310560b4978 100644
--- a/ui/app/controllers/vault/cluster/dashboard.js
+++ b/ui/app/controllers/vault/cluster/dashboard.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/init.js b/ui/app/controllers/vault/cluster/init.js
index 9083f2dddef..91a60fb1ef0 100644
--- a/ui/app/controllers/vault/cluster/init.js
+++ b/ui/app/controllers/vault/cluster/init.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -40,7 +40,8 @@ export default Controller.extend(DEFAULTS, {
   }),
 
   actions: {
-    initCluster(data) {
+    initCluster(payload) {
+      const data = { ...payload };
       const isCloudSeal = !!this.model.sealType && this.model.sealType !== 'shamir';
       if (data.secret_shares) {
         const shares = parseInt(data.secret_shares, 10);
diff --git a/ui/app/controllers/vault/cluster/mfa-setup.js b/ui/app/controllers/vault/cluster/mfa-setup.js
index 65c98d10d43..bc130f24e92 100644
--- a/ui/app/controllers/vault/cluster/mfa-setup.js
+++ b/ui/app/controllers/vault/cluster/mfa-setup.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,8 +15,12 @@ export default class VaultClusterMfaSetupController extends Controller {
   @tracked uuid = '';
   @tracked qrCode = '';
 
+  header = 'MFA Setup';
+  description =
+    'TOTP Multi-factor authentication (MFA) can be enabled here if it is required by your administrator. This will ensure that you are not prevented from logging into Vault in the future, once MFA is fully enforced.';
+
   get entityId() {
-    return this.auth.authData.entity_id;
+    return this.auth.authData.entityId;
   }
 
   @action isUUIDVerified(verified) {
diff --git a/ui/app/controllers/vault/cluster/oidc-callback.js b/ui/app/controllers/vault/cluster/oidc-callback.js
index bc439e409b9..125d85798ea 100644
--- a/ui/app/controllers/vault/cluster/oidc-callback.js
+++ b/ui/app/controllers/vault/cluster/oidc-callback.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/oidc-provider-ns.js b/ui/app/controllers/vault/cluster/oidc-provider-ns.js
index f2b06ea083a..9e41ff5ee32 100644
--- a/ui/app/controllers/vault/cluster/oidc-provider-ns.js
+++ b/ui/app/controllers/vault/cluster/oidc-provider-ns.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/oidc-provider.js b/ui/app/controllers/vault/cluster/oidc-provider.js
index 94151a76cd0..10ff1e3181a 100644
--- a/ui/app/controllers/vault/cluster/oidc-provider.js
+++ b/ui/app/controllers/vault/cluster/oidc-provider.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/policies/index.js b/ui/app/controllers/vault/cluster/policies/index.js
index 34a54a5c1a1..4bab2650750 100644
--- a/ui/app/controllers/vault/cluster/policies/index.js
+++ b/ui/app/controllers/vault/cluster/policies/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -50,7 +50,7 @@ export default Controller.extend({
     return filterMatchesKey
       ? null
       : content.find(function (key) {
-          return re.test(key.get('id'));
+          return re.test(key.id);
         });
   }),
 
@@ -62,7 +62,7 @@ export default Controller.extend({
       this.set('filterFocused', bool);
     },
     deletePolicy(model) {
-      const policyType = model.get('policyType');
+      const { policyType } = model;
       const name = model.id;
       const flash = this.flashMessages;
       model
diff --git a/ui/app/controllers/vault/cluster/policy/edit.js b/ui/app/controllers/vault/cluster/policy/edit.js
index 8d2c26b67c3..050b91b93c3 100644
--- a/ui/app/controllers/vault/cluster/policy/edit.js
+++ b/ui/app/controllers/vault/cluster/policy/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/replication-dr-promote/index.js b/ui/app/controllers/vault/cluster/replication-dr-promote/index.js
index ceba938007a..73bd6c7fed0 100644
--- a/ui/app/controllers/vault/cluster/replication-dr-promote/index.js
+++ b/ui/app/controllers/vault/cluster/replication-dr-promote/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend.js b/ui/app/controllers/vault/cluster/secrets/backend.js
index 6df5a7d5c95..2e6a0f069f2 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/actions-root.js b/ui/app/controllers/vault/cluster/secrets/backend/actions-root.js
index d20b14944cf..8d2074de42c 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/actions-root.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/actions-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/actions.js b/ui/app/controllers/vault/cluster/secrets/backend/actions.js
index d3cc68ea47b..ea08831d7ee 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/actions.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/actions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/configuration.js b/ui/app/controllers/vault/cluster/secrets/backend/configuration.js
deleted file mode 100644
index 771a72f0040..00000000000
--- a/ui/app/controllers/vault/cluster/secrets/backend/configuration.js
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { computed } from '@ember/object';
-import Controller from '@ember/controller';
-
-export default Controller.extend({
-  isConfigurable: computed('model.type', function () {
-    const configurableEngines = ['aws', 'ssh'];
-    return configurableEngines.includes(this.model.type);
-  }),
-});
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/configuration/edit.js b/ui/app/controllers/vault/cluster/secrets/backend/configuration/edit.js
new file mode 100644
index 00000000000..f9fd1895eda
--- /dev/null
+++ b/ui/app/controllers/vault/cluster/secrets/backend/configuration/edit.js
@@ -0,0 +1,16 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Controller from '@ember/controller';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+
+export default class SecretsBackendConfigurationEditController extends Controller {
+  get isWifEngine() {
+    return engineDisplayData(this.model.type)?.isWIF;
+  }
+  get displayName() {
+    return engineDisplayData(this.model.type).displayName;
+  }
+}
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/configuration/index.js b/ui/app/controllers/vault/cluster/secrets/backend/configuration/index.js
new file mode 100644
index 00000000000..4be817bd513
--- /dev/null
+++ b/ui/app/controllers/vault/cluster/secrets/backend/configuration/index.js
@@ -0,0 +1,49 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Controller from '@ember/controller';
+import { toLabel } from 'core/helpers/to-label';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+
+export default class SecretsBackendConfigurationController extends Controller {
+  get displayFields() {
+    const { engineType } = this.model.secretsEngine;
+    const fields = ['type', 'path', 'description', 'accessor', 'local', 'seal_wrap'];
+    // no ttl options for keymgmt
+    if (engineType !== 'keymgmt') {
+      fields.push('config.default_lease_ttl', 'config.max_lease_ttl');
+    }
+    fields.push(
+      'config.allowed_managed_keys',
+      'config.audit_non_hmac_request_keys',
+      'config.audit_non_hmac_response_keys',
+      'config.passthrough_request_headers',
+      'config.allowed_response_headers'
+    );
+    if (engineType === 'kv' || engineType === 'generic') {
+      fields.push('version');
+    }
+    // For WIF Secret engines, allow users to set the identity token key when mounting the engine.
+    if (engineDisplayData(engineType)?.isWIF) {
+      fields.push('config.identity_token_key');
+    }
+    return fields;
+  }
+
+  label = (field) => {
+    const key = field.replace('config.', '');
+    const label = toLabel([key]);
+    // map specific fields to custom labels
+    return (
+      {
+        default_lease_ttl: 'Default Lease TTL',
+        max_lease_ttl: 'Max Lease TTL',
+        audit_non_hmac_request_keys: 'Request keys excluded from HMACing in audit',
+        audit_non_hmac_response_keys: 'Response keys excluded from HMACing in audit',
+        passthrough_request_headers: 'Allowed passthrough request headers',
+      }[key] || label
+    );
+  };
+}
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/create-root.js b/ui/app/controllers/vault/cluster/secrets/backend/create-root.js
index f0edc9d10f8..572c4276648 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/create-root.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/create-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/create.js b/ui/app/controllers/vault/cluster/secrets/backend/create.js
index 5933f5cddde..4281dcb8b15 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/create.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/credentials-root.js b/ui/app/controllers/vault/cluster/secrets/backend/credentials-root.js
index 535f45d7c4a..c4a500c6142 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/credentials-root.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/credentials-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/credentials.js b/ui/app/controllers/vault/cluster/secrets/backend/credentials.js
index a4b9d93ea8e..95208b28898 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/credentials.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/credentials.js
@@ -1,16 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
 
 export default Controller.extend({
-  queryParams: ['action', 'roleType'],
-  action: '',
+  queryParams: ['roleType'],
+  // used for database credentials
   roleType: '',
   reset() {
-    this.set('action', '');
     this.set('roleType', '');
   },
 });
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/edit-root.js b/ui/app/controllers/vault/cluster/secrets/backend/edit-root.js
index 61780f84a1a..3aa0adfcb5b 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/edit-root.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/edit-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/edit.js b/ui/app/controllers/vault/cluster/secrets/backend/edit.js
index 664a8c58e70..6a955c2ae98 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/edit.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/list-root.js b/ui/app/controllers/vault/cluster/secrets/backend/list-root.js
index 426f59f55ac..8ace7710033 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/list-root.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/list-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/list.js b/ui/app/controllers/vault/cluster/secrets/backend/list.js
index e65c09cc8e7..dcce2913dee 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/list.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,16 +8,24 @@ import { computed } from '@ember/object';
 import { service } from '@ember/service';
 import Controller from '@ember/controller';
 import BackendCrumbMixin from 'vault/mixins/backend-crumb';
-import WithNavToNearestAncestor from 'vault/mixins/with-nav-to-nearest-ancestor';
 import ListController from 'core/mixins/list-controller';
 import { keyIsFolder } from 'core/utils/key-utils';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+import { task } from 'ember-concurrency';
 
-export default Controller.extend(ListController, BackendCrumbMixin, WithNavToNearestAncestor, {
+export default Controller.extend(ListController, BackendCrumbMixin, {
   flashMessages: service(),
+  api: service(),
+  router: service(),
   queryParams: ['page', 'pageFilter', 'tab'],
 
   tab: '',
 
+  // Check if the current engine is an old engine - for showing old UI designs
+  get isOldEngine() {
+    return engineDisplayData(this.backendType)?.isOldEngine;
+  },
+
   // callback from HDS pagination to set the queryParams page
   get paginationQueryParams() {
     return (page) => {
@@ -52,16 +60,13 @@ export default Controller.extend(ListController, BackendCrumbMixin, WithNavToNea
         });
     },
 
-    delete(item, type) {
+    delete(item) {
       const name = item.id;
       item
         .destroyRecord()
         .then(() => {
           this.flashMessages.success(`${name} was successfully deleted.`);
           this.send('reload');
-          if (type === 'secret') {
-            this.navToNearestAncestor.perform(name);
-          }
         })
         .catch((e) => {
           const error = e.errors ? e.errors.join('. ') : e.message;
@@ -69,4 +74,20 @@ export default Controller.extend(ListController, BackendCrumbMixin, WithNavToNea
         });
     },
   },
+
+  disableEngine: task(function* (engine) {
+    const { engineType, id, path } = engine;
+    try {
+      yield this.api.sys.mountsDisableSecretsEngine(id);
+      this.flashMessages.success(`The ${engineType} Secrets Engine at ${path} has been disabled.`);
+      this.router.transitionTo('vault.cluster.secrets.backends');
+    } catch (err) {
+      const { message } = yield this.api.parseError(err);
+      this.flashMessages.danger(
+        `There was an error disabling the ${engineType} Secrets Engines at ${path}: ${message}.`
+      );
+    } finally {
+      this.engineToDisable = null;
+    }
+  }).drop(),
 });
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/show-root.js b/ui/app/controllers/vault/cluster/secrets/backend/show-root.js
index 70a89ce202d..1c681931646 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/show-root.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/show-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/show.js b/ui/app/controllers/vault/cluster/secrets/backend/show.js
index c9e89bd0fc8..84693641ff0 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/show.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/sign-root.js b/ui/app/controllers/vault/cluster/secrets/backend/sign-root.js
index f0cce06bb73..b9a463715e4 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/sign-root.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/sign-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/secrets/backend/sign.js b/ui/app/controllers/vault/cluster/secrets/backend/sign.js
index 9f996f6a99c..934c8098e63 100644
--- a/ui/app/controllers/vault/cluster/secrets/backend/sign.js
+++ b/ui/app/controllers/vault/cluster/secrets/backend/sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,12 +19,12 @@ export default Controller.extend({
       });
     },
 
-    codemirrorUpdated(attr, val, codemirror) {
-      codemirror.performLint();
-      const hasErrors = codemirror.state.lint.marked.length > 0;
-
-      if (!hasErrors) {
+    editorUpdated(attr, val) {
+      // wont set invalid JSON to the model
+      try {
         set(this.model, attr, JSON.parse(val));
+      } catch {
+        // linting is handled by the component
       }
     },
 
@@ -36,7 +36,7 @@ export default Controller.extend({
 
     newModel() {
       const model = this.model;
-      const roleModel = model.get('role');
+      const roleModel = model.role;
       model.unloadRecord();
       const newModel = this.store.createRecord('ssh-sign', {
         role: roleModel,
diff --git a/ui/app/controllers/vault/cluster/secrets/backends.js b/ui/app/controllers/vault/cluster/secrets/backends.js
index 17f964a5a5c..a643fd9280e 100644
--- a/ui/app/controllers/vault/cluster/secrets/backends.js
+++ b/ui/app/controllers/vault/cluster/secrets/backends.js
@@ -1,88 +1,7 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
-/* eslint ember/no-computed-properties-in-native-classes: 'warn' */
 import Controller from '@ember/controller';
-import { service } from '@ember/service';
-import { action } from '@ember/object';
-import { tracked } from '@glimmer/tracking';
-import { filterBy } from '@ember/object/computed';
-import { dropTask } from 'ember-concurrency';
 
-export default class VaultClusterSecretsBackendController extends Controller {
-  @service flashMessages;
-  @filterBy('model', 'shouldIncludeInList') displayableBackends;
-
-  @tracked secretEngineOptions = [];
-  @tracked selectedEngineType = null;
-  @tracked selectedEngineName = null;
-  @tracked engineToDisable = null;
-
-  get sortedDisplayableBackends() {
-    // show supported secret engines first and then organize those by id.
-    const sortedBackends = this.displayableBackends.sort(
-      (a, b) => b.isSupportedBackend - a.isSupportedBackend || a.id - b.id
-    );
-
-    // return an options list to filter by engine type, ex: 'kv'
-    if (this.selectedEngineType) {
-      // check first if the user has also filtered by name.
-      if (this.selectedEngineName) {
-        return sortedBackends.filter((backend) => this.selectedEngineName === backend.id);
-      }
-      // otherwise filter by engine type
-      return sortedBackends.filter((backend) => this.selectedEngineType === backend.engineType);
-    }
-
-    // return an options list to filter by engine name, ex: 'secret'
-    if (this.selectedEngineName) {
-      return sortedBackends.filter((backend) => this.selectedEngineName === backend.id);
-    }
-    // no filters, return full sorted list.
-    return sortedBackends;
-  }
-
-  get secretEngineArrayByType() {
-    const arrayOfAllEngineTypes = this.sortedDisplayableBackends.map((modelObject) => modelObject.engineType);
-    // filter out repeated engineTypes (e.g. [kv, kv] => [kv])
-    const arrayOfUniqueEngineTypes = [...new Set(arrayOfAllEngineTypes)];
-
-    return arrayOfUniqueEngineTypes.map((engineType) => ({
-      name: engineType,
-      id: engineType,
-    }));
-  }
-
-  get secretEngineArrayByName() {
-    return this.sortedDisplayableBackends.map((modelObject) => ({
-      name: modelObject.id,
-      id: modelObject.id,
-    }));
-  }
-
-  @action
-  filterEngineType([type]) {
-    this.selectedEngineType = type;
-  }
-
-  @action
-  filterEngineName([name]) {
-    this.selectedEngineName = name;
-  }
-
-  @dropTask
-  *disableEngine(engine) {
-    const { engineType, path } = engine;
-    try {
-      yield engine.destroyRecord();
-      this.flashMessages.success(`The ${engineType} Secrets Engine at ${path} has been disabled.`);
-    } catch (err) {
-      this.flashMessages.danger(
-        `There was an error disabling the ${engineType} Secrets Engine at ${path}: ${err.errors.join(' ')}.`
-      );
-    } finally {
-      this.engineToDisable = null;
-    }
-  }
-}
+export default class VaultClusterSecretsBackendController extends Controller {}
diff --git a/ui/app/controllers/vault/cluster/secrets/enable/create.ts b/ui/app/controllers/vault/cluster/secrets/enable/create.ts
new file mode 100644
index 00000000000..829b1bf79cc
--- /dev/null
+++ b/ui/app/controllers/vault/cluster/secrets/enable/create.ts
@@ -0,0 +1,42 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Controller from '@ember/controller';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+import type SecretsEngineForm from 'vault/forms/secrets/engine';
+import type Router from '@ember/routing/router';
+
+const SUPPORTED_BACKENDS = supportedSecretBackends();
+
+export default class VaultClusterSecretsEnableCreateController extends Controller {
+  @service declare router: Router;
+
+  declare model: SecretsEngineForm;
+
+  @action
+  onMountSuccess(type: string, path: string, useEngineRoute = false) {
+    let transition;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    if (SUPPORTED_BACKENDS.includes(type as any)) {
+      const engineInfo = engineDisplayData(type);
+      if (engineInfo && useEngineRoute) {
+        transition = this.router.transitionTo(
+          `vault.cluster.secrets.backend.${engineInfo.engineRoute}`,
+          path
+        );
+      } else if (engineInfo) {
+        // For keymgmt, we need to land on provider tab by default using query params
+        const queryParams = engineInfo.type === 'keymgmt' ? { tab: 'provider' } : {};
+        transition = this.router.transitionTo('vault.cluster.secrets.backend.index', path, { queryParams });
+      }
+    } else {
+      transition = this.router.transitionTo('vault.cluster.secrets.backends');
+    }
+    return transition?.followRedirects();
+  }
+}
diff --git a/ui/app/controllers/vault/cluster/secrets/enable/index.js b/ui/app/controllers/vault/cluster/secrets/enable/index.js
new file mode 100644
index 00000000000..ecb13b21813
--- /dev/null
+++ b/ui/app/controllers/vault/cluster/secrets/enable/index.js
@@ -0,0 +1,42 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { service } from '@ember/service';
+import Controller from '@ember/controller';
+import { action } from '@ember/object';
+import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+
+const SUPPORTED_BACKENDS = supportedSecretBackends();
+
+export default class SecretEnableController extends Controller {
+  @service router;
+
+  @action
+  setMountType(type) {
+    this.router.transitionTo('vault.cluster.secrets.enable.create', type);
+  }
+
+  @action
+  onMountSuccess(type, path, useEngineRoute = false) {
+    let transition;
+    if (SUPPORTED_BACKENDS.includes(type)) {
+      const engineInfo = engineDisplayData(type);
+      if (useEngineRoute) {
+        transition = this.router.transitionTo(
+          `vault.cluster.secrets.backend.${engineInfo.engineRoute}`,
+          path
+        );
+      } else {
+        // For keymgmt, we need to land on provider tab by default using query params
+        const queryParams = engineInfo.type === 'keymgmt' ? { tab: 'provider' } : {};
+        transition = this.router.transitionTo('vault.cluster.secrets.backend.index', path, { queryParams });
+      }
+    } else {
+      transition = this.router.transitionTo('vault.cluster.secrets.backends');
+    }
+    return transition.followRedirects();
+  }
+}
diff --git a/ui/app/controllers/vault/cluster/settings.js b/ui/app/controllers/vault/cluster/settings.js
index 32e860f7bbb..e900548ae49 100644
--- a/ui/app/controllers/vault/cluster/settings.js
+++ b/ui/app/controllers/vault/cluster/settings.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/settings/auth/enable.js b/ui/app/controllers/vault/cluster/settings/auth/enable.js
index 8003a30e276..4a1b2776a7b 100644
--- a/ui/app/controllers/vault/cluster/settings/auth/enable.js
+++ b/ui/app/controllers/vault/cluster/settings/auth/enable.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/settings/configure-secret-backend.js b/ui/app/controllers/vault/cluster/settings/configure-secret-backend.js
deleted file mode 100644
index c0b629a9fe3..00000000000
--- a/ui/app/controllers/vault/cluster/settings/configure-secret-backend.js
+++ /dev/null
@@ -1,81 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { isPresent } from '@ember/utils';
-import { service } from '@ember/service';
-import Controller from '@ember/controller';
-
-const CONFIG_ATTRS = {
-  // ssh
-  configured: false,
-
-  // aws root config
-  iamEndpoint: null,
-  stsEndpoint: null,
-  accessKey: null,
-  secretKey: null,
-  region: '',
-};
-
-export default Controller.extend(CONFIG_ATTRS, {
-  queryParams: ['tab'],
-  tab: '',
-  flashMessages: service(),
-  loading: false,
-  reset() {
-    this.model.rollbackAttributes();
-    this.setProperties(CONFIG_ATTRS);
-  },
-  actions: {
-    saveConfig(options = { delete: false }) {
-      const isDelete = options.delete;
-      if (this.model.type === 'ssh') {
-        this.set('loading', true);
-        this.model
-          .saveCA({ isDelete })
-          .then(() => {
-            this.send('refreshRoute');
-            this.set('configured', !isDelete);
-            if (isDelete) {
-              this.flashMessages.success('SSH Certificate Authority Configuration deleted!');
-            } else {
-              this.flashMessages.success('SSH Certificate Authority Configuration saved!');
-            }
-          })
-          .catch((error) => {
-            const errorMessage = error.errors ? error.errors.join('. ') : error;
-            this.flashMessages.danger(errorMessage);
-          })
-          .finally(() => {
-            this.set('loading', false);
-          });
-      }
-    },
-
-    save(method, data) {
-      this.set('loading', true);
-      const hasData = Object.keys(data).some((key) => {
-        return isPresent(data[key]);
-      });
-      if (!hasData) {
-        return;
-      }
-      this.model
-        .save({
-          adapterOptions: {
-            adapterMethod: method,
-            data,
-          },
-        })
-        .then(() => {
-          this.reset();
-          this.flashMessages.success('The backend configuration saved successfully!');
-        })
-        .finally(() => {
-          this.set('loading', false);
-        });
-    },
-  },
-});
diff --git a/ui/app/controllers/vault/cluster/settings/mount-secret-backend.js b/ui/app/controllers/vault/cluster/settings/mount-secret-backend.js
deleted file mode 100644
index 8f0715b2a07..00000000000
--- a/ui/app/controllers/vault/cluster/settings/mount-secret-backend.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { service } from '@ember/service';
-import Controller from '@ember/controller';
-import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
-import { allEngines } from 'vault/helpers/mountable-secret-engines';
-import { action } from '@ember/object';
-
-const SUPPORTED_BACKENDS = supportedSecretBackends();
-
-export default class MountSecretBackendController extends Controller {
-  @service router;
-
-  @action
-  onMountSuccess(type, path, useEngineRoute = false) {
-    let transition;
-    if (SUPPORTED_BACKENDS.includes(type)) {
-      const engineInfo = allEngines().find((engine) => engine.type === type);
-      if (useEngineRoute) {
-        transition = this.router.transitionTo(
-          `vault.cluster.secrets.backend.${engineInfo.engineRoute}`,
-          path
-        );
-      } else {
-        const queryParams = engineInfo?.routeQueryParams || {};
-        transition = this.router.transitionTo('vault.cluster.secrets.backend.index', path, { queryParams });
-      }
-    } else {
-      transition = this.router.transitionTo('vault.cluster.secrets.backends');
-    }
-    return transition.followRedirects();
-  }
-}
diff --git a/ui/app/controllers/vault/cluster/settings/seal.js b/ui/app/controllers/vault/cluster/settings/seal.js
index 127d154a6e0..1b3e4dc5a6c 100644
--- a/ui/app/controllers/vault/cluster/settings/seal.js
+++ b/ui/app/controllers/vault/cluster/settings/seal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/controllers/vault/cluster/unseal.js b/ui/app/controllers/vault/cluster/unseal.js
index 112284e2e87..107124f1e3c 100644
--- a/ui/app/controllers/vault/cluster/unseal.js
+++ b/ui/app/controllers/vault/cluster/unseal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/decorators/model-expanded-attributes.js b/ui/app/decorators/model-expanded-attributes.js
index 8a8ce8a0a34..1836dc20cdb 100644
--- a/ui/app/decorators/model-expanded-attributes.js
+++ b/ui/app/decorators/model-expanded-attributes.js
@@ -1,11 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { expandAttributeMeta } from 'vault/utils/field-to-attrs';
 import Model from '@ember-data/model';
-import { assert } from '@ember/debug';
+import { debug } from '@ember/debug';
 
 /**
  * sets allByKey properties on model class. These are all the attributes on the model
@@ -40,7 +40,10 @@ export function withExpandedAttributes() {
         return groups.map((obj) => {
           const [key, stringArray] = Object.entries(obj)[0];
           const expanded = stringArray.map((fieldName) => this.allByKey[fieldName]).filter((f) => !!f);
-          assert(`all fields found in allByKey for group ${key}`, expanded.length === stringArray.length);
+          // if this fails, it might mean there are missing fields in the model or the model must be hydrated via OpenAPI
+          if (expanded.length !== stringArray.length) {
+            debug(`not all model fields found in allByKey for group "${key}"`);
+          }
           return { [key]: expanded };
         });
       }
diff --git a/ui/app/decorators/model-form-fields.js b/ui/app/decorators/model-form-fields.js
index d5b882bf1a3..527b9d68eeb 100644
--- a/ui/app/decorators/model-form-fields.js
+++ b/ui/app/decorators/model-form-fields.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/decorators/model-validations.js b/ui/app/decorators/model-validations.js
index 6be78a132c9..14226b2fd54 100644
--- a/ui/app/decorators/model-validations.js
+++ b/ui/app/decorators/model-validations.js
@@ -1,11 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-/* eslint-disable no-console */
-import validators from 'vault/utils/validators';
-import { get } from '@ember/object';
+import { validate } from 'vault/utils/forms/validate';
 
 // see documentation at ui/docs/model-validations.md for detailed usage information
 export function withModelValidations(validations) {
@@ -22,68 +20,7 @@ export function withModelValidations(validations) {
       }
 
       validate() {
-        let isValid = true;
-        const state = {};
-        let errorCount = 0;
-
-        for (const key in this._validations) {
-          const rules = this._validations[key];
-
-          if (!Array.isArray(rules)) {
-            console.error(
-              `Must provide validations as an array for property "${key}" on ${this.modelName} model`
-            );
-            continue;
-          }
-
-          state[key] = { errors: [], warnings: [] };
-
-          for (const rule of rules) {
-            const { type, options, level, message, validator: customValidator } = rule;
-            // check for custom validator or lookup in validators util by type
-            const useCustomValidator = typeof customValidator === 'function';
-            const validator = useCustomValidator ? customValidator : validators[type];
-            if (!validator) {
-              console.error(
-                !type
-                  ? 'Validator not found. Define either type or pass custom validator function under "validator" key in validations object'
-                  : `Validator type: "${type}" not found. Available validators: ${Object.keys(
-                      validators
-                    ).join(', ')}`
-              );
-              continue;
-            }
-            const passedValidation = useCustomValidator
-              ? validator(this)
-              : validator(get(this, key), options); // dot notation may be used to define key for nested property
-
-            if (!passedValidation) {
-              // message can also be a function
-              const validationMessage = typeof message === 'function' ? message(this) : message;
-              // consider setting a prop like validationErrors directly on the model
-              // for now return an errors object
-              if (level === 'warn') {
-                state[key].warnings.push(validationMessage);
-              } else {
-                state[key].errors.push(validationMessage);
-                if (isValid) {
-                  isValid = false;
-                }
-              }
-            }
-          }
-          errorCount += state[key].errors.length;
-          state[key].isValid = !state[key].errors.length;
-        }
-
-        return { isValid, state, invalidFormMessage: this.generateErrorCountMessage(errorCount) };
-      }
-
-      generateErrorCountMessage(errorCount) {
-        if (errorCount < 1) return null;
-        // returns count specific message: 'There is an error/are N errors with this form.'
-        const isPlural = errorCount > 1 ? `are ${errorCount} errors` : false;
-        return `There ${isPlural ? isPlural : 'is an error'} with this form.`;
+        return validate(this, this._validations);
       }
     };
   };
diff --git a/ui/app/forms/README.md b/ui/app/forms/README.md
new file mode 100644
index 00000000000..c1ca6bbe904
--- /dev/null
+++ b/ui/app/forms/README.md
@@ -0,0 +1,88 @@
+# Background
+
+The `Form` class was created as a replacement for form related functionality
+that previously lived in Ember Data models. Given that the `FormField` component
+was designed around the metadata that was defined on model attributes, it was
+imperative to preserve this pattern while moving the functionality to a dependency-free
+native javascript solution.
+
+# Usage
+
+The `Form` class is intended to be extended by a class that represents a particular form
+in the application.
+
+```ts
+export default class MyForm extends Form {
+  declare data: MyFormData;
+
+  // define form fields
+  name = new FormField('name', 'string');
+  secret = new FormField('secret', 'string', {
+    editType: 'kv',
+    keyPlaceholder: 'Secret key',
+    valuePlaceholder: 'Secret value',
+    label: 'Secret (kv pairs)',
+    isSingleRow: true,
+    allowWhiteSpace: true,
+  });
+
+  // define validations
+  validations: Validations = {
+    name: [{ type: 'presence', message: 'Name is required.' }],
+  };
+
+  // if serialization is needed override toJSON method
+  toJSON() {
+    const trimmedName = this.data.name.trim();
+    return super.toJSON({ ...this.data, name: trimmedName });
+  }
+}
+```
+
+Form data is set to the data object on the class and can be initialized
+with defaults or server data when editing by passing an object into the constructor.
+
+```ts
+// create route
+model() {
+  return new MyForm({ name: 'Default name' });
+}
+
+// edit route
+async model() {
+  const data = await this.api.fetchSomeData();
+  return new MyForm(data);
+}
+```
+
+The route model (`MyForm` instance) can be passed into the form component in
+the same manner as an Ember Data model and the `formFields` can be looped
+to render `FormField` components.
+
+```hbs
+{{#each @form.formFields as |field|}}
+  <FormField @attr={{field}} @model={{@form}} @modelValidations={{this.validations}} />
+{{/each}}
+```
+
+To validate the form and access the data use the toJSON method.
+
+```ts
+// save method of form component
+async save() {
+  try {
+    const { isValid, state, invalidFormMessage, data } = this.args.form.toJSON();
+    this.validations = isValid ? null : state;
+    this.invalidFormMessage = invalidFormMessage;
+
+    if (isValid) {
+      await this.api.saveTheForm(data);
+      this.flashMessages.success('It worked');
+      this.router.transitionTo('another.route');
+    }
+  } catch(error) {
+    const { message } = await this.api.parseError(error);
+    this.errorMessage = message;
+  }
+}
+```
diff --git a/ui/app/forms/auth/method.ts b/ui/app/forms/auth/method.ts
new file mode 100644
index 00000000000..58dbabb9a8f
--- /dev/null
+++ b/ui/app/forms/auth/method.ts
@@ -0,0 +1,74 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import MountForm from 'vault/forms/mount';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+
+import type { AuthMethodFormData } from 'vault/auth/methods';
+
+export default class AuthMethodForm extends MountForm<AuthMethodFormData> {
+  fieldProps = ['tuneFields', 'userLockoutConfigFields'];
+
+  userLockoutConfigFields = [
+    new FormField('user_lockout_config.lockout_threshold', 'string', {
+      label: 'Lockout threshold',
+      subText: 'Specifies the number of failed login attempts after which the user is locked out, e.g. 15.',
+    }),
+    new FormField('user_lockout_config.lockout_duration', undefined, {
+      label: 'Lockout duration',
+      helperTextEnabled: 'The duration for which a user will be locked out, e.g. "5s" or "30m".',
+      editType: 'ttl',
+      helperTextDisabled: 'No lockout duration configured.',
+    }),
+
+    new FormField('user_lockout_config.lockout_counter_reset', undefined, {
+      label: 'Lockout counter reset',
+      helperTextEnabled:
+        'The duration after which the lockout counter is reset with no failed login attempts, e.g. "5s" or "30m".',
+      editType: 'ttl',
+      helperTextDisabled: 'No reset duration configured.',
+    }),
+    new FormField('user_lockout_config.lockout_disable', 'boolean', {
+      label: 'Disable lockout for this mount',
+      subText: 'If checked, disables the user lockout feature for this mount.',
+    }),
+  ];
+
+  get tuneFields() {
+    const readOnly = ['local', 'seal_wrap'];
+    // 'token_type' cannot be set for the 'token' auth method
+    if (this.normalizedType === 'token') {
+      readOnly.push('config.token_type');
+    }
+    return this.formFieldGroups[1]?.['Method Options']?.filter((field) => {
+      return !readOnly.includes(field.name);
+    });
+  }
+
+  formFieldGroups = [
+    new FormFieldGroup('default', [this.fields.path]),
+    new FormFieldGroup('Method Options', [
+      this.fields.description,
+      this.fields.listingVisibility,
+      this.fields.local,
+      this.fields.sealWrap,
+      this.fields.defaultLeaseTtl,
+      this.fields.maxLeaseTtl,
+      new FormField('config.token_type', 'string', {
+        label: 'Token type',
+        helpText:
+          'The type of token that should be generated via this role. For `default-service` and `default-batch` service and batch tokens will be issued respectively, unless the auth method explicitly requests a different type.',
+        possibleValues: ['default-service', 'default-batch', 'batch', 'service'],
+        noDefault: true,
+      }),
+      this.fields.auditNonHmacRequestKeys,
+      this.fields.auditNonHmacResponseKeys,
+      this.fields.passthroughRequestHeaders,
+      this.fields.allowedResponseHeaders,
+      this.fields.pluginVersion,
+    ]),
+  ];
+}
diff --git a/ui/app/forms/custom-message.ts b/ui/app/forms/custom-message.ts
new file mode 100644
index 00000000000..69cadb391d1
--- /dev/null
+++ b/ui/app/forms/custom-message.ts
@@ -0,0 +1,123 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+import Form from './form';
+import FormField from 'vault/utils/forms/field';
+import { isBefore, isAfter } from 'date-fns';
+import { encodeString } from 'core/utils/b64';
+
+import type { CreateCustomMessageRequest } from '@hashicorp/vault-client-typescript';
+import { Validations } from 'vault/vault/app-types';
+
+type CustomMessageFormData = Partial<CreateCustomMessageRequest>;
+
+export default class CustomMessageForm extends Form<CustomMessageFormData> {
+  formFields = [
+    new FormField('authenticated', undefined, {
+      label: 'Where should we display this message?',
+      editType: 'radio',
+      possibleValues: [
+        {
+          label: 'After the user logs in',
+          subText: 'Display to users after they have successfully logged in to Vault.',
+          value: true,
+          id: 'authenticated',
+        },
+        {
+          label: 'On the login page',
+          subText: 'Display to users on the login page before they have authenticated.',
+          value: false,
+          id: 'unauthenticated',
+        },
+      ],
+    }),
+
+    new FormField('type', 'string', {
+      label: 'Type',
+      editType: 'radio',
+      possibleValues: [
+        {
+          label: 'Alert message',
+          subText:
+            'A banner that appears on the top of every page to display brief but high-signal messages like an update or system alert.',
+          value: 'banner',
+        },
+        {
+          label: 'Modal',
+          subText:
+            'A pop-up window used to bring immediate attention for important notifications or actions.',
+          value: 'modal',
+        },
+      ],
+    }),
+
+    new FormField('title', 'string'),
+
+    new FormField('message', 'string', { editType: 'textarea' }),
+
+    new FormField('link', 'string', {
+      editType: 'kv',
+      keyPlaceholder: 'Display text (e.g. Learn more)',
+      valuePlaceholder: 'Link URL (e.g. https://www.hashicorp.com/)',
+      label: 'Link (optional)',
+      isSingleRow: true,
+      allowWhiteSpace: true,
+    }),
+
+    new FormField('start_time', 'dateTimeLocal', {
+      editType: 'dateTimeLocal',
+      label: 'Message starts',
+      subText: 'Defaults to 12:00 a.m. the following day (local timezone).',
+    }),
+
+    new FormField('end_time', 'dateTimeLocal', {
+      editType: 'yield',
+      label: 'Message expires',
+    }),
+  ];
+
+  validations: Validations = {
+    title: [{ type: 'presence', message: 'Title is required.' }],
+    message: [{ type: 'presence', message: 'Message is required.' }],
+    link: [
+      {
+        validator({ link }: CustomMessageFormData) {
+          if (!link) return true;
+          const [title] = Object.keys(link);
+          const [href] = Object.values(link);
+          return title || href ? !!(title && href) : true;
+        },
+        message: 'Link title and url are required.',
+      },
+    ],
+    start_time: [
+      {
+        validator({ start_time, end_time }: CustomMessageFormData) {
+          if (!start_time || !end_time) return true;
+          return isBefore(new Date(start_time), new Date(end_time));
+        },
+        message: 'Start time is after end time.',
+      },
+    ],
+    end_time: [
+      {
+        validator({ start_time, end_time }: CustomMessageFormData) {
+          if (!start_time || !end_time) return true;
+          return isAfter(new Date(end_time), new Date(start_time));
+        },
+        message: 'End time is before start time.',
+      },
+    ],
+  };
+
+  toJSON() {
+    // overriding to do some date serialization
+    // form sets dates as strings but client expects Date objects
+    const start_time = this.data.start_time ? new Date(this.data.start_time as unknown as string) : undefined;
+    const end_time = this.data.end_time ? new Date(this.data.end_time as unknown as string) : undefined;
+    // encode message to base64
+    const message = this.data.message ? encodeString(this.data.message) : undefined;
+    return super.toJSON({ ...this.data, start_time, end_time, message });
+  }
+}
diff --git a/ui/app/forms/form.ts b/ui/app/forms/form.ts
new file mode 100644
index 00000000000..24931001e13
--- /dev/null
+++ b/ui/app/forms/form.ts
@@ -0,0 +1,94 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+import { validate } from 'vault/utils/forms/validate';
+import { set } from '@ember/object';
+
+import type { Validations } from 'vault/app-types';
+import type FormField from 'vault/utils/forms/field';
+import type FormFieldGroup from 'vault/utils/forms/field-group';
+
+export type FormOptions = {
+  isNew?: boolean;
+};
+
+export default class Form<T extends object> {
+  declare data: T;
+  declare validations: Validations;
+  declare isNew: boolean;
+
+  // used by proxy to determine if the property being accessed is a form field
+  // override these in subclasses to define additional/different fields defined on the class
+  fieldProps = ['formFields'];
+  fieldGroupProps = ['formFieldGroups'];
+
+  constructor(data: Partial<T> = {}, options: FormOptions = {}, validations?: Validations) {
+    this.data = { ...data } as T;
+    this.isNew = options.isNew || false;
+    // typically this would be defined on the subclass
+    // if validations are conditional, it may be preferable to define them during instantiation
+    if (validations) {
+      this.validations = validations;
+    }
+    // to ease migration from Ember Data Models, return a proxy that forwards get/set to the data object for form field props
+    // this allows for form field properties to be accessed directly on the class rather than form.data.someField
+    const proxyTarget = (target: this, prop: string) => {
+      try {
+        // check if the property that is being accessed is a form field
+        const fields = this.fieldProps.reduce((fields: FormField[], prop) => {
+          const formFields = target[prop as keyof this];
+          if (Array.isArray(formFields)) {
+            fields.push(...formFields);
+          }
+          return fields;
+        }, []);
+        // in the case of formFieldGroups we need extract the fields out into a flat array
+        const groupFields = this.fieldGroupProps.reduce((groupFields: FormField[], prop) => {
+          const formFieldGroups = target[prop as keyof this];
+          if (Array.isArray(formFieldGroups)) {
+            const fields = formFieldGroups.reduce((arr: FormField[], group: FormFieldGroup) => {
+              const values = Object.values(group)[0] || [];
+              return [...arr, ...values];
+            }, []);
+            groupFields.push(...fields);
+          }
+          return groupFields;
+        }, []);
+        // combine the formFields and formGroupFields into a single array
+        const allFields = [...fields, ...groupFields];
+        const formDataKeys = allFields.map((field) => field.name) || [];
+        // if the property is a form field return the data object as the target, otherwise return the original target (this)
+        // account for nested form data properties like 'config.maxLeaseTtl' when accessing the object like this.config
+        const isDataProp = formDataKeys.some((key) => key === prop || key.split('.').includes(prop));
+        return !Reflect.has(target, prop) && isDataProp ? target.data : target;
+      } catch (e) {
+        // if this fails for any reason return the target object
+        return target;
+      }
+    };
+
+    return new Proxy(this, {
+      get(target, prop: string) {
+        return Reflect.get(proxyTarget(target, prop), prop);
+      },
+      set(target, prop: string, value) {
+        return Reflect.set(proxyTarget(target, prop), prop, value);
+      },
+    });
+  }
+
+  // shim this for now but get away from old Ember patterns!
+  set(key = '', val: unknown) {
+    set(this, key, val);
+  }
+
+  // when overriding in subclass, data can be passed in if serialization of certain values is required
+  // this prevents the underlying data object from being mutated causing potential issues in the view
+  toJSON(data = this.data) {
+    // validate the form
+    // if validations are not defined the util will ignore and return valid state
+    const formValidation = validate(data, this.validations);
+    return { ...formValidation, data };
+  }
+}
diff --git a/ui/app/forms/mount.ts b/ui/app/forms/mount.ts
new file mode 100644
index 00000000000..1ae87b8792c
--- /dev/null
+++ b/ui/app/forms/mount.ts
@@ -0,0 +1,105 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+import { tracked } from '@glimmer/tracking';
+import { WHITESPACE_WARNING } from 'vault/utils/forms/validators';
+
+import type { Validations } from 'vault/app-types';
+import type { SecretsEngineFormData } from 'vault/secrets/engine';
+import type { AuthMethodFormData } from 'vault/vault/auth/methods';
+
+// common fields and validations shared between secrets engine and auth methods (mounts)
+// used in form classes for consistency and to avoid duplication
+export default class MountForm<T extends SecretsEngineFormData | AuthMethodFormData> extends Form<T> {
+  @tracked declare type: string;
+
+  validations: Validations = {
+    path: [
+      { type: 'presence', message: "Path can't be blank." },
+      {
+        type: 'containsWhiteSpace',
+        message: WHITESPACE_WARNING('path'),
+        level: 'warn',
+      },
+    ],
+  };
+
+  fields = {
+    path: new FormField('path', 'string'),
+    description: new FormField('description', 'string', { editType: 'textarea' }),
+    listingVisibility: new FormField('config.listing_visibility', 'boolean', {
+      label: 'Use as preferred UI login method',
+      editType: 'toggleButton',
+      helperTextEnabled:
+        'This mount will be included in the unauthenticated UI login endpoint and display as a preferred login method.',
+      helperTextDisabled:
+        'Turn on the toggle to use this auth mount as a preferred login method during UI login.',
+    }),
+    local: new FormField('local', 'boolean', {
+      helpText:
+        'When Replication is enabled, a local mount will not be replicated across clusters. This can only be specified at mount time.',
+    }),
+    sealWrap: new FormField('seal_wrap', 'boolean', {
+      helpText:
+        'When enabled - if a seal supporting seal wrapping is specified in the configuration, all critical security parameters (CSPs) in this backend will be seal wrapped. (For KV mounts, all values will be seal wrapped.) This can only be specified at mount time.',
+    }),
+    defaultLeaseTtl: new FormField('config.default_lease_ttl', 'string', {
+      label: 'Default Lease TTL',
+      editType: 'ttl',
+    }),
+    maxLeaseTtl: new FormField('config.max_lease_ttl', 'string', { label: 'Max Lease TTL', editType: 'ttl' }),
+    auditNonHmacRequestKeys: new FormField('config.audit_non_hmac_request_keys', 'string', {
+      label: 'Request keys excluded from HMACing in audit',
+      editType: 'stringArray',
+      helpText: "Keys that will not be HMAC'd by audit devices in the request data object.",
+    }),
+    auditNonHmacResponseKeys: new FormField('config.audit_non_hmac_response_keys', 'string', {
+      label: 'Response keys excluded from HMACing in audit',
+      editType: 'stringArray',
+      helpText: "Keys that will not be HMAC'd by audit devices in the response data object.",
+    }),
+    passthroughRequestHeaders: new FormField('config.passthrough_request_headers', 'string', {
+      label: 'Allowed passthrough request headers',
+      helpText: 'Headers to allow and pass from the request to the backend',
+      editType: 'stringArray',
+    }),
+    allowedResponseHeaders: new FormField('config.allowed_response_headers', 'string', {
+      label: 'Allowed response headers',
+      helpText: 'Headers to allow, allowing a plugin to include them in the response.',
+      editType: 'stringArray',
+    }),
+    pluginVersion: new FormField('config.plugin_version', 'string', {
+      label: 'Plugin version',
+      subText:
+        'Specifies the semantic version of the plugin to use, e.g. "v1.0.0". If unspecified, the server will select any matching un-versioned plugin that may have been registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.',
+    }),
+  };
+
+  // namespaces introduced types with a `ns_` prefix for built-in engines so we will strip that out for consistency
+  get normalizedType() {
+    return (this.type || '').replace(/^ns_/, '');
+  }
+
+  toJSON() {
+    const { config } = this.data;
+    const data = {
+      type: this.type,
+      ...this.data,
+      config: {
+        ...(config || {}),
+        force_no_cache: config?.force_no_cache ?? false,
+        listing_visibility: config?.listing_visibility ? 'unauth' : 'hidden',
+      },
+    };
+    // options are only relevant for kv/generic engines
+    if (!['kv', 'generic'].includes(this.type)) {
+      delete data.options;
+    }
+
+    return super.toJSON(data);
+  }
+}
diff --git a/ui/app/forms/open-api.ts b/ui/app/forms/open-api.ts
new file mode 100644
index 00000000000..cdd6ece5b4b
--- /dev/null
+++ b/ui/app/forms/open-api.ts
@@ -0,0 +1,57 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+import { propsForSchema } from 'vault/utils/openapi-helpers';
+
+import type { OpenApiHelpResponse } from 'vault/utils/openapi-helpers';
+
+export default class OpenApiForm<T extends object> extends Form<T> {
+  declare formFieldGroups: FormFieldGroup[];
+
+  constructor(helpResponse: OpenApiHelpResponse, ...formArgs: ConstructorParameters<typeof Form>) {
+    super(...formArgs);
+    // create formFieldGroups from the OpenAPI properties
+    const props = propsForSchema(helpResponse);
+    const groups: { [groupName: string]: FormField[] } = {};
+    // iterate over the properties and organize them into groups
+    for (const [name, prop] of Object.entries(props)) {
+      // disabling lint rule since we need to ignore certain options returned from expandOpenApiProps util
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+      const { fieldGroup, fieldValue, type, defaultValue, ...options } = prop;
+      // groupName from groupsMap takes precedence over fieldGroup from the property
+      const group = fieldGroup || 'default';
+      // organize the form fields so we can create formFieldGroups later
+      if (!(group in groups)) {
+        groups[group] = [];
+      }
+      // create a new FormField for the property and associate it with the appropriate fieldGroup
+      // props marked as `identifier` are primary fields that should be rendered first in the form
+      const arrMethod = options.identifier ? 'unshift' : 'push';
+      groups[group]?.[arrMethod](new FormField(name, type, options));
+      // set the default value on the data object
+      if (defaultValue && this.data[name as keyof typeof this.data] === undefined) {
+        this.data = { ...this.data, [name]: defaultValue };
+      }
+    }
+
+    // ensure default group is the first item in the formFieldGroups
+
+    // create formFieldGroups from the expanded groups
+    this.formFieldGroups = Object.entries(groups).reduce<FormFieldGroup[]>(
+      (formFieldGroups, [groupName, fields]) => {
+        const group = new FormFieldGroup(groupName, fields);
+        // ensure the default group is the first group to render
+        if (groupName === 'default') {
+          return [group, ...formFieldGroups];
+        }
+        return [...formFieldGroups, group];
+      },
+      []
+    );
+  }
+}
diff --git a/ui/app/forms/secrets/aws-config.ts b/ui/app/forms/secrets/aws-config.ts
new file mode 100644
index 00000000000..0fc208c74bd
--- /dev/null
+++ b/ui/app/forms/secrets/aws-config.ts
@@ -0,0 +1,85 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import WifConfigForm from './wif-config';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+import { regions } from 'vault/helpers/aws-regions';
+
+import type { Validations } from 'vault/app-types';
+import type { AwsConfigFormData } from 'vault/secrets/engine';
+
+export default class AwsConfigForm extends WifConfigForm<AwsConfigFormData> {
+  validations: Validations = {
+    lease: [
+      {
+        validator(data: AwsConfigForm['data']) {
+          const { lease, lease_max } = data;
+          return (lease && lease_max) || (!lease && !lease_max) ? true : false;
+        },
+        message: 'Lease TTL and Max Lease TTL are both required if one of them is set.',
+      },
+    ],
+  };
+
+  get isAccountPluginConfigured() {
+    return !!this.data.access_key;
+  }
+
+  get isWifPluginConfigured() {
+    const { identity_token_audience, identity_token_ttl, role_arn } = this.data;
+    return !!identity_token_audience || !!identity_token_ttl || !!role_arn;
+  }
+
+  accountFields = [
+    new FormField('access_key', 'string'),
+    new FormField('secret_key', 'string', { sensitive: true }),
+  ];
+
+  optionFields = [
+    new FormField('region', 'string', {
+      possibleValues: regions(),
+      subText:
+        'Specifies the AWS region. If not set it will use the AWS_REGION env var, AWS_DEFAULT_REGION env var, or us-east-1 in that order.',
+    }),
+    new FormField('iam_endpoint', 'string', { label: 'IAM endpoint' }),
+    new FormField('sts_endpoint', 'string', { label: 'STS endpoint' }),
+    new FormField('max_retries', 'number', {
+      subText: 'Number of max retries the client should use for recoverable errors. Default is -1.',
+    }),
+  ];
+
+  wifFields = [
+    this.commonWifFields.issuer,
+    new FormField('role_arn', 'string', {
+      label: 'Role ARN',
+      subText: 'Role ARN to assume for plugin workload identity federation.',
+    }),
+    this.commonWifFields.identity_token_audience,
+    this.commonWifFields.identity_token_ttl,
+  ];
+
+  // formFieldGroups will render the default and root config option fields
+  // formFields will be used to render the additional lease config fields
+  // this allows for the full form to validated together when submitted
+  get formFieldGroups() {
+    const defaultFields = this.accessType === 'account' ? this.accountFields : this.wifFields;
+    return [
+      new FormFieldGroup('default', defaultFields),
+      new FormFieldGroup('Root config options', this.optionFields),
+    ];
+  }
+
+  formFields = [
+    new FormField('lease', 'string', {
+      label: 'Default Lease TTL',
+      editType: 'ttl',
+    }),
+    new FormField('lease_max', 'string', {
+      label: 'Max Lease TTL',
+      editType: 'ttl',
+    }),
+  ];
+}
diff --git a/ui/app/forms/secrets/azure-config.ts b/ui/app/forms/secrets/azure-config.ts
new file mode 100644
index 00000000000..5de4a7814c8
--- /dev/null
+++ b/ui/app/forms/secrets/azure-config.ts
@@ -0,0 +1,60 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import WifConfigForm from './wif-config';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+
+import type { AzureConfigFormData } from 'vault/vault/secrets/engine';
+
+export default class AzureConfigForm extends WifConfigForm<AzureConfigFormData> {
+  // the "clientSecret" param is not checked because it's never returned by the API.
+  // thus we can never say for sure if the account accessType has been configured so we always return false
+  isAccountPluginConfigured = false;
+
+  get isWifPluginConfigured() {
+    const { identity_token_audience, identity_token_ttl } = this.data;
+    return !!identity_token_audience || !!identity_token_ttl;
+  }
+
+  accountFields = [
+    new FormField('subscription_id', 'string', { label: 'Subscription ID' }),
+    new FormField('tenant_id', 'string', { label: 'Tenant ID' }),
+    new FormField('client_id', 'string', { label: 'Client ID' }),
+    new FormField('client_secret', 'string', { sensitive: true }),
+  ];
+
+  optionFields = [
+    new FormField('environment', 'string', {
+      subText:
+        'This value can also be provided with the AZURE_ENVIRONMENT environment variable. If not specified, Vault will use Azure Public Cloud.',
+    }),
+    new FormField('root_password_ttl', 'string', {
+      label: 'Root password TTL',
+      editType: 'ttl',
+      // default is 15768000 sec. The api docs say 182 days, but this should be updated to 182.5 days.
+      helperTextDisabled: 'Vault will use the default of 182 days.',
+      helperTextEnabled:
+        'Specifies how long the root password is valid for in Azure when rotate-root generates a new client secret.',
+    }),
+  ];
+
+  wifFields = [
+    this.commonWifFields.issuer,
+    this.accountFields[0] as FormField,
+    this.accountFields[1] as FormField,
+    this.accountFields[2] as FormField,
+    this.commonWifFields.identity_token_audience,
+    this.commonWifFields.identity_token_ttl,
+  ];
+
+  get formFieldGroups() {
+    const defaultFields = this.accessType === 'account' ? this.accountFields : this.wifFields;
+    return [
+      new FormFieldGroup('default', defaultFields),
+      new FormFieldGroup('More options', this.optionFields),
+    ];
+  }
+}
diff --git a/ui/app/forms/secrets/engine.ts b/ui/app/forms/secrets/engine.ts
new file mode 100644
index 00000000000..30ed037eb79
--- /dev/null
+++ b/ui/app/forms/secrets/engine.ts
@@ -0,0 +1,134 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import MountForm from 'vault/forms/mount';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+import { ALL_ENGINES } from 'vault/utils/all-engines-metadata';
+
+import type { SecretsEngineFormData } from 'vault/secrets/engine';
+import type Form from 'vault/forms/form';
+
+export default class SecretsEngineForm extends MountForm<SecretsEngineFormData> {
+  constructor(...args: ConstructorParameters<typeof Form>) {
+    super(...args);
+    // path validation is already defined on the MountForm class
+    // add validation for kv max versions
+    this.validations['kv_config.max_versions'] = [
+      { type: 'number', message: 'Maximum versions must be a number.' },
+      { type: 'length', options: { min: 1, max: 16 }, message: 'You cannot go over 16 characters.' },
+    ];
+  }
+
+  // Method to apply type-specific side effects - called when type changes
+  applyTypeSpecificDefaults() {
+    // PKI side effect: set max lease to ~10 years to match PKI certificate lifespans
+    if (this.normalizedType === 'pki') {
+      if (!this.data.config) {
+        this.data.config = {};
+      }
+      // Only set default if not already specified
+      if (!this.data.config.max_lease_ttl) {
+        this.data.config.max_lease_ttl = '3650d';
+      }
+    }
+  }
+
+  coreOptionFields = [this.fields.description, this.fields.local, this.fields.sealWrap];
+
+  leaseConfigFields = [
+    this.fields.defaultLeaseTtl,
+    this.fields.maxLeaseTtl,
+    new FormField('config.allowed_managed_keys', 'string', {
+      label: 'Allowed managed keys',
+      editType: 'stringArray',
+    }),
+  ];
+
+  standardConfigFields = [
+    this.fields.auditNonHmacRequestKeys,
+    this.fields.auditNonHmacResponseKeys,
+    this.fields.passthroughRequestHeaders,
+    this.fields.allowedResponseHeaders,
+  ];
+
+  get defaultFields() {
+    const fields = [this.fields.path];
+    if (this.normalizedType === 'kv') {
+      fields.push(
+        new FormField('kv_config.max_versions', 'number', {
+          label: 'Maximum number of versions',
+          subText:
+            'The number of versions to keep per key. Once the number of keys exceeds the maximum number set here, the oldest version will be permanently deleted. This value applies to all keys, but a key’s metadata settings can overwrite this value. When 0 is used or the value is unset, Vault will keep 10 versions.',
+        }),
+        new FormField('kv_config.cas_required', 'boolean', {
+          label: 'Require Check and Set',
+          subText:
+            'If checked, all keys will require the cas parameter to be set on all write requests. A key’s metadata settings can overwrite this value.',
+        }),
+        new FormField('kv_config.delete_version_after', 'string', {
+          editType: 'ttl',
+          label: 'Automate secret deletion',
+          helperTextDisabled: 'A secret’s version must be manually deleted.',
+          helperTextEnabled: 'Delete all new versions of this secret after',
+        })
+      );
+    } else if (['database', 'pki'].includes(this.normalizedType)) {
+      const [defaultTtl, maxTtl, managedKeys] = this.leaseConfigFields as [FormField, FormField, FormField];
+      fields.push(defaultTtl, maxTtl);
+      if (this.normalizedType === 'pki') {
+        fields.push(managedKeys);
+      }
+    }
+
+    return fields;
+  }
+
+  get optionFields() {
+    const [defaultTtl, maxTtl, managedKeys] = this.leaseConfigFields as [FormField, FormField, FormField];
+
+    if (['database', 'keymgmt'].includes(this.normalizedType)) {
+      return [...this.coreOptionFields, managedKeys, ...this.standardConfigFields];
+    }
+    if (this.normalizedType === 'pki') {
+      return [...this.coreOptionFields, ...this.standardConfigFields];
+    }
+    if (ALL_ENGINES.find((engine) => engine.type === this.normalizedType && engine.isWIF)?.type) {
+      return [
+        ...this.coreOptionFields,
+        defaultTtl,
+        maxTtl,
+        new FormField('config.identity_token_key', undefined, {
+          label: 'Identity token key',
+          subText: `A named key to sign tokens. If not provided, this will default to Vault's OIDC default key.`,
+          editType: 'yield',
+        }),
+        managedKeys,
+        ...this.standardConfigFields,
+      ];
+    }
+
+    const options = [...this.coreOptionFields, ...this.leaseConfigFields, ...this.standardConfigFields];
+    if (['kv', 'generic'].includes(this.normalizedType)) {
+      options.unshift(
+        new FormField('options.version', 'number', {
+          label: 'Version',
+          helpText:
+            'The KV Secrets Engine can operate in different modes. Version 1 is the original generic Secrets Engine the allows for storing of static key/value pairs. Version 2 added more features including data versioning, TTLs, and check and set.',
+          possibleValues: [2, 1],
+        })
+      );
+    }
+
+    return options;
+  }
+
+  get formFieldGroups() {
+    return [
+      new FormFieldGroup('default', this.defaultFields),
+      new FormFieldGroup('Method Options', this.optionFields),
+    ];
+  }
+}
diff --git a/ui/app/forms/secrets/gcp-config.ts b/ui/app/forms/secrets/gcp-config.ts
new file mode 100644
index 00000000000..aa7ac71d29a
--- /dev/null
+++ b/ui/app/forms/secrets/gcp-config.ts
@@ -0,0 +1,67 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import WifConfigForm from './wif-config';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+
+import type { GcpConfigFormData } from 'vault/secrets/engine';
+
+export default class AzureConfigForm extends WifConfigForm<GcpConfigFormData> {
+  // the "credentials" param is not checked for "isAccountPluginConfigured" because it's never return by the API
+  // additionally credentials can be set via GOOGLE_APPLICATION_CREDENTIALS env var so we cannot call it a required field in the ui.
+  // thus we can never say for sure if the account accessType has been configured so we always return false
+  isAccountPluginConfigured = false;
+
+  get isWifPluginConfigured() {
+    const { identity_token_audience, identity_token_ttl, service_account_email } = this.data;
+    return !!identity_token_audience || !!identity_token_ttl || !!service_account_email;
+  }
+
+  accountFields = [
+    new FormField('credentials', 'string', {
+      label: 'JSON credentials',
+      subText:
+        'If empty, Vault will use the GOOGLE_APPLICATION_CREDENTIALS environment variable if configured.',
+      editType: 'file',
+      docLink: '/vault/docs/secrets/gcp#authentication',
+    }),
+  ];
+
+  optionFields = [
+    new FormField('ttl', 'string', {
+      label: 'Config TTL',
+      editType: 'ttl',
+      helperTextDisabled: 'Vault will use the default config TTL (time-to-live) for long-lived credentials.',
+      helperTextEnabled:
+        'The default config TTL (time-to-live) for long-lived credentials (i.e. service account keys).',
+    }),
+    new FormField('max_ttl', 'string', {
+      label: 'Max TTL',
+      editType: 'ttl',
+      helperTextDisabled:
+        'Vault will use the default maximum config TTL (time-to-live) for long-lived credentials.',
+      helperTextEnabled:
+        'The maximum config TTL (time-to-live) for long-lived credentials (i.e. service account keys).',
+    }),
+  ];
+
+  wifFields = [
+    this.commonWifFields.issuer,
+    this.commonWifFields.identity_token_audience,
+    new FormField('service_account_email', 'string', {
+      subText: 'Email ID for the Service Account to impersonate for Workload Identity Federation.',
+    }),
+    this.commonWifFields.identity_token_ttl,
+  ];
+
+  get formFieldGroups() {
+    const defaultFields = this.accessType === 'account' ? this.accountFields : this.wifFields;
+    return [
+      new FormFieldGroup('default', defaultFields),
+      new FormFieldGroup('More options', this.optionFields),
+    ];
+  }
+}
diff --git a/ui/app/forms/secrets/kv.ts b/ui/app/forms/secrets/kv.ts
new file mode 100644
index 00000000000..b7d241b03f8
--- /dev/null
+++ b/ui/app/forms/secrets/kv.ts
@@ -0,0 +1,84 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+import { WHITESPACE_WARNING } from 'vault/utils/forms/validators';
+
+import type { Validations } from 'vault/app-types';
+
+type KvFormData = {
+  path: string;
+  secretData: { [key: string]: string };
+  custom_metadata?: { [key: string]: string };
+  max_versions?: number;
+  cas_required?: boolean;
+  delete_version_after?: string;
+  // readonly options when editing an existing secret
+  options?: {
+    cas: number;
+  };
+};
+
+export default class KvForm extends Form<KvFormData> {
+  fieldProps = ['secretFields', 'metadataFields'];
+
+  validations: Validations = {
+    path: [
+      { type: 'presence', message: `Path can't be blank.` },
+      { type: 'endsInSlash', message: `Path can't end in forward slash '/'.` },
+      {
+        type: 'containsWhiteSpace',
+        message: WHITESPACE_WARNING('path'),
+        level: 'warn',
+      },
+    ],
+    secretData: [
+      {
+        validator: ({ secretData }: KvForm['data']) =>
+          secretData !== undefined && typeof secretData !== 'object' ? false : true,
+        message: 'Vault expects data to be formatted as an JSON object.',
+      },
+    ],
+    max_versions: [
+      { type: 'number', message: 'Maximum versions must be a number.' },
+      { type: 'length', options: { min: 1, max: 16 }, message: 'You cannot go over 16 characters.' },
+    ],
+  };
+
+  secretFields = [
+    new FormField('path', 'string', {
+      label: 'Path for this secret',
+      subText: 'Names with forward slashes define hierarchical path structures.',
+    }),
+  ];
+
+  metadataFields = [
+    new FormField('custom_metadata', 'object', {
+      editType: 'kv',
+      isSectionHeader: true,
+      subText:
+        'An optional set of informational key-value pairs that will be stored with all secret versions.',
+    }),
+    new FormField('max_versions', 'number', {
+      defaultValue: 0,
+      label: 'Maximum number of versions',
+      subText:
+        'The number of versions to keep per key. Once the number of keys exceeds the maximum number set here, the oldest version will be permanently deleted.',
+    }),
+    new FormField('cas_required', 'boolean', {
+      defaultValue: false,
+      label: 'Require Check and Set',
+      subText: `Writes will only be allowed if the key's current version matches the version specified in the cas parameter.`,
+    }),
+    new FormField('delete_version_after', 'boolean', {
+      defaultValue: '0s',
+      editType: 'ttl',
+      label: 'Automate secret deletion',
+      helperTextDisabled: `A secret's version must be manually deleted.`,
+      helperTextEnabled: 'Delete all new versions of this secret after:',
+    }),
+  ];
+}
diff --git a/ui/app/forms/secrets/ssh-config.ts b/ui/app/forms/secrets/ssh-config.ts
new file mode 100644
index 00000000000..cb354b89abf
--- /dev/null
+++ b/ui/app/forms/secrets/ssh-config.ts
@@ -0,0 +1,44 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+
+import type { Validations } from 'vault/app-types';
+import type { SshConfigureCaRequest } from '@hashicorp/vault-client-typescript';
+
+export default class SshConfigForm extends Form<SshConfigureCaRequest> {
+  validations: Validations = {
+    generate_signing_key: [
+      {
+        validator(data: SshConfigForm['data']) {
+          const { public_key, private_key, generate_signing_key } = data;
+          // if generateSigningKey is false, both public and private keys are required
+          if (!generate_signing_key && (!public_key || !private_key)) {
+            return false;
+          }
+          return true;
+        },
+        message: 'Provide a Public and Private key or set "Generate Signing Key" to true.',
+      },
+    ],
+    public_key: [
+      {
+        validator(data: SshConfigForm['data']) {
+          const { public_key, private_key } = data;
+          // regardless of generateSigningKey, if one key is set they both need to be set.
+          return public_key || private_key ? !!(public_key && private_key) : true;
+        },
+        message: 'You must provide a Public and Private keys or leave both unset.',
+      },
+    ],
+  };
+
+  formFields = [
+    new FormField('private_key', 'string', { sensitive: true }),
+    new FormField('public_key', 'string', { sensitive: true }),
+    new FormField('generate_signing_key', 'boolean'),
+  ];
+}
diff --git a/ui/app/forms/secrets/wif-config.ts b/ui/app/forms/secrets/wif-config.ts
new file mode 100644
index 00000000000..5cce07b3b04
--- /dev/null
+++ b/ui/app/forms/secrets/wif-config.ts
@@ -0,0 +1,42 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+import { tracked } from '@glimmer/tracking';
+
+export default class WifConfigForm<T extends object> extends Form<T> {
+  // for community users they will not be able to change this. for enterprise users, they will have the option to select "wif".
+  @tracked accessType: 'account' | 'wif' = 'account';
+
+  declare type: 'aws' | 'azure' | 'gcp';
+
+  commonWifFields = {
+    issuer: new FormField('issuer', 'string', {
+      label: 'Issuer',
+      subText:
+        "The Issuer URL to be used in configuring Vault as an identity provider. If not set, Vault's default issuer will be used.",
+      docLink: '/vault/api-docs/secret/identity/tokens#configure-the-identity-tokens-backend',
+      placeholder: 'https://vault-test.com',
+    }),
+
+    identity_token_audience: new FormField('identity_token_audience', 'string', {
+      subText:
+        'The audience claim value for plugin identity tokens. Must match an allowed audience configured for the target IAM OIDC identity provider.',
+    }),
+
+    identity_token_ttl: new FormField('identity_token_ttl', 'string', {
+      label: 'Identity token TTL',
+      helperTextDisabled:
+        'The TTL of generated tokens. Defaults to 1 hour, turn on the toggle to specify a different value.',
+      helperTextEnabled: 'The TTL of generated tokens.',
+      editType: 'ttl',
+    }),
+
+    service_account_email: new FormField('service_account_email', 'string', {
+      subText: 'Email ID for the Service Account to impersonate for Workload Identity Federation.',
+    }),
+  };
+}
diff --git a/ui/app/forms/sync/aws-sm.ts b/ui/app/forms/sync/aws-sm.ts
new file mode 100644
index 00000000000..5e4ab8a8a8d
--- /dev/null
+++ b/ui/app/forms/sync/aws-sm.ts
@@ -0,0 +1,65 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+import { commonFields, getPayload } from './shared';
+
+import type { SystemWriteSyncDestinationsAwsSmNameRequest } from '@hashicorp/vault-client-typescript';
+
+type AwsSmFormData = SystemWriteSyncDestinationsAwsSmNameRequest & {
+  name: string;
+};
+
+export default class AwsSmForm extends Form<AwsSmFormData> {
+  formFieldGroups = [
+    new FormFieldGroup('default', [
+      commonFields.name,
+      new FormField('region', 'string', {
+        subText:
+          'For AWS secrets manager, the name of the region must be supplied, something like “us-west-1.” If empty, Vault will use the AWS_REGION environment variable if configured.',
+        editDisabled: true,
+      }),
+      new FormField('role_arn', 'string', {
+        label: 'Role ARN',
+        subText:
+          'Specifies a role to assume when connecting to AWS. When assuming a role, Vault uses temporary STS credentials to authenticate.',
+      }),
+      new FormField('external_id', 'string', {
+        label: 'External ID',
+        subText:
+          'Optional extra protection that must match the trust policy granting access to the AWS IAM role ARN. We recommend using a different random UUID per destination.',
+      }),
+    ]),
+    new FormFieldGroup('Credentials', [
+      new FormField('access_key_id', 'string', {
+        label: 'Access key ID',
+        subText:
+          'Access key ID to authenticate against the secrets manager. If empty, Vault will use the AWS_ACCESS_KEY_ID environment variable if configured.',
+        sensitive: true,
+        noCopy: true,
+      }),
+      new FormField('secret_access_key', 'string', {
+        label: 'Secret access key',
+        subText:
+          'Secret access key to authenticate against the secrets manager. If empty, Vault will use the AWS_SECRET_ACCESS_KEY environment variable if configured.',
+        sensitive: true,
+        noCopy: true,
+      }),
+    ]),
+    new FormFieldGroup('Advanced configuration', [
+      commonFields.granularity,
+      commonFields.secretNameTemplate,
+      commonFields.customTags,
+    ]),
+  ];
+
+  toJSON() {
+    const formState = super.toJSON();
+    const data = getPayload<AwsSmFormData>('aws-sm', this.data, this.isNew);
+    return { ...formState, data };
+  }
+}
diff --git a/ui/app/forms/sync/azure-kv.ts b/ui/app/forms/sync/azure-kv.ts
new file mode 100644
index 00000000000..e8052a215b7
--- /dev/null
+++ b/ui/app/forms/sync/azure-kv.ts
@@ -0,0 +1,63 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+import { commonFields, getPayload } from './shared';
+
+import type { SystemWriteSyncDestinationsAzureKvNameRequest } from '@hashicorp/vault-client-typescript';
+
+type AzureKvFormData = SystemWriteSyncDestinationsAzureKvNameRequest & {
+  name: string;
+};
+
+export default class AzureKvForm extends Form<AzureKvFormData> {
+  formFieldGroups = [
+    new FormFieldGroup('default', [
+      commonFields.name,
+      new FormField('key_vault_uri', 'string', {
+        label: 'Key Vault URI',
+        subText:
+          'URI of an existing Azure Key Vault instance. If empty, Vault will use the KEY_VAULT_URI environment variable if configured.',
+        editDisabled: true,
+      }),
+      new FormField('tenant_id', 'string', {
+        label: 'Tenant ID',
+        subText:
+          'ID of the target Azure tenant. If empty, Vault will use the AZURE_TENANT_ID environment variable if configured.',
+        editDisabled: true,
+      }),
+      new FormField('cloud', 'string', {
+        subText: 'Specifies a cloud for the client. The default is Azure Public Cloud.',
+        editDisabled: true,
+      }),
+      new FormField('client_id', 'string', {
+        label: 'Client ID',
+        subText:
+          'Client ID of an Azure app registration. If empty, Vault will use the AZURE_CLIENT_ID environment variable if configured.',
+      }),
+    ]),
+    new FormFieldGroup('Credentials', [
+      new FormField('client_secret', 'string', {
+        subText:
+          'Client secret of an Azure app registration. If empty, Vault will use the AZURE_CLIENT_SECRET environment variable if configured.',
+        sensitive: true,
+        noCopy: true,
+      }),
+    ]),
+    new FormFieldGroup('Advanced configuration', [
+      commonFields.granularity,
+      commonFields.secretNameTemplate,
+      commonFields.customTags,
+    ]),
+  ];
+
+  toJSON() {
+    const formState = super.toJSON();
+    const data = getPayload<AzureKvFormData>('azure-kv', this.data, this.isNew);
+    return { ...formState, data };
+  }
+}
diff --git a/ui/app/forms/sync/gcp-sm.ts b/ui/app/forms/sync/gcp-sm.ts
new file mode 100644
index 00000000000..507e06a3b6e
--- /dev/null
+++ b/ui/app/forms/sync/gcp-sm.ts
@@ -0,0 +1,48 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+import { commonFields, getPayload } from './shared';
+
+import type { SystemWriteSyncDestinationsGcpSmNameRequest } from '@hashicorp/vault-client-typescript';
+
+type GcpSmFormData = SystemWriteSyncDestinationsGcpSmNameRequest & {
+  name: string;
+};
+
+export default class GcpSmForm extends Form<GcpSmFormData> {
+  formFieldGroups = [
+    new FormFieldGroup('default', [
+      commonFields.name,
+      new FormField('project_id', 'string', {
+        label: 'Project ID',
+        subText:
+          'The target project to manage secrets in. If set, overrides the project derived from the service account JSON credentials or application default credentials.',
+      }),
+    ]),
+    new FormFieldGroup('Credentials', [
+      new FormField('credentials', 'string', {
+        label: 'JSON credentials',
+        subText:
+          'If empty, Vault will use the GOOGLE_APPLICATION_CREDENTIALS environment variable if configured.',
+        editType: 'file',
+        docLink: '/vault/docs/secrets/gcp#authentication',
+      }),
+    ]),
+    new FormFieldGroup('Advanced configuration', [
+      commonFields.granularity,
+      commonFields.secretNameTemplate,
+      commonFields.customTags,
+    ]),
+  ];
+
+  toJSON() {
+    const formState = super.toJSON();
+    const data = getPayload<GcpSmFormData>('gcp-sm', this.data, this.isNew);
+    return { ...formState, data };
+  }
+}
diff --git a/ui/app/forms/sync/gh.ts b/ui/app/forms/sync/gh.ts
new file mode 100644
index 00000000000..1f69a222ccb
--- /dev/null
+++ b/ui/app/forms/sync/gh.ts
@@ -0,0 +1,48 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+import { commonFields, getPayload } from './shared';
+
+import type { SystemWriteSyncDestinationsGhNameRequest } from '@hashicorp/vault-client-typescript';
+
+type GhFormData = SystemWriteSyncDestinationsGhNameRequest & {
+  name: string;
+};
+
+export default class GcpSmForm extends Form<GhFormData> {
+  formFieldGroups = [
+    new FormFieldGroup('default', [
+      commonFields.name,
+      new FormField('repository_owner', 'string', {
+        subText:
+          'Github organization or username that owns the repository. If empty, Vault will use the GITHUB_REPOSITORY_OWNER environment variable if configured.',
+        editDisabled: true,
+      }),
+      new FormField('repository_name', 'string', {
+        subText:
+          'The name of the Github repository to connect to. If empty, Vault will use the GITHUB_REPOSITORY_NAME environment variable if configured.',
+        editDisabled: true,
+      }),
+    ]),
+    new FormFieldGroup('Credentials', [
+      new FormField('access_token', 'string', {
+        subText:
+          'Personal access token to authenticate to the GitHub repository. If empty, Vault will use the GITHUB_ACCESS_TOKEN environment variable if configured.',
+        sensitive: true,
+        noCopy: true,
+      }),
+    ]),
+    new FormFieldGroup('Advanced configuration', [commonFields.granularity, commonFields.secretNameTemplate]),
+  ];
+
+  toJSON() {
+    const formState = super.toJSON();
+    const data = getPayload<GhFormData>('gh', this.data, this.isNew);
+    return { ...formState, data };
+  }
+}
diff --git a/ui/app/forms/sync/resolver.ts b/ui/app/forms/sync/resolver.ts
new file mode 100644
index 00000000000..2e832b2a57b
--- /dev/null
+++ b/ui/app/forms/sync/resolver.ts
@@ -0,0 +1,55 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import AwsSmForm from './aws-sm';
+import AzureKvForm from './azure-kv';
+import GcpSmForm from './gcp-sm';
+import GhForm from './gh';
+import VercelProjectForm from './vercel-project';
+
+import type { DestinationType } from 'vault/sync';
+import type { FormOptions } from '../form';
+import type { Validations } from 'vault/app-types';
+
+// given the differences in form fields across destination types, each type has a specific form class
+// to make it easier in routes, this resolver will instantiate a new instance of the correct form class for a given type
+export default function destinationFormResolver(type: DestinationType, data = {}, options?: FormOptions) {
+  const validations: Validations = {
+    name: [
+      { type: 'presence', message: 'Name is required.' },
+      { type: 'containsWhiteSpace', message: 'Name cannot contain whitespace.' },
+    ],
+  };
+
+  if (type === 'aws-sm') {
+    return new AwsSmForm(data, options, validations);
+  }
+  if (type === 'azure-kv') {
+    return new AzureKvForm(data, options, validations);
+  }
+  if (type === 'gcp-sm') {
+    return new GcpSmForm(data, options, validations);
+  }
+  if (type === 'gh') {
+    return new GhForm(data, options, validations);
+  }
+  if (type === 'vercel-project') {
+    const teamId = (data as VercelProjectForm['data'])['team_id'];
+    validations['team_id'] = [
+      {
+        validator: (formData: VercelProjectForm['data']) =>
+          !options?.isNew && formData['team_id'] !== teamId ? false : true,
+        message: 'Team ID should only be updated if the project was transferred to another account.',
+        level: 'warn',
+      },
+    ];
+    validations['deployment_environments'] = [
+      { type: 'presence', message: 'At least one environment is required.' },
+    ];
+    return new VercelProjectForm(data, options, validations);
+  }
+
+  throw new Error(`Unknown destination type: ${type}`);
+}
diff --git a/ui/app/forms/sync/shared.ts b/ui/app/forms/sync/shared.ts
new file mode 100644
index 00000000000..8745b83ee24
--- /dev/null
+++ b/ui/app/forms/sync/shared.ts
@@ -0,0 +1,73 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import FormField from 'vault/utils/forms/field';
+import { findDestination } from 'core/helpers/sync-destinations';
+
+import type { DestinationType } from 'vault/sync';
+
+export const commonFields = {
+  name: new FormField('name', 'string', {
+    subText: 'Specifies the name for this destination.',
+    editDisabled: true,
+  }),
+
+  secretNameTemplate: new FormField('secret_name_template', 'string', {
+    subText:
+      'Go-template string that indicates how to format the secret name at the destination. The default template varies by destination type but is generally in the form of "vault-{{ .MountAccessor }}-{{ .SecretPath }}" e.g. "vault-kv_9a8f68ad-my-secret-1". Optional.',
+  }),
+
+  granularity: new FormField('granularity', 'string', {
+    editType: 'radio',
+    label: 'Secret sync granularity',
+    possibleValues: [
+      {
+        label: 'Secret path',
+        subText: 'Sync entire secret contents as a single entry at the destination.',
+        value: 'secret-path',
+      },
+      {
+        label: 'Secret key',
+        subText: 'Sync each key-value pair of secret data as a distinct entry at the destination.',
+        helpText:
+          'Only top-level keys will be synced and any nested or complex values will be encoded as a JSON string.',
+        value: 'secret-key',
+      },
+    ],
+  }),
+
+  customTags: new FormField('custom_tags', 'object', {
+    subText:
+      'An optional set of informational key-value pairs added as additional metadata on secrets synced to this destination. Custom tags are merged with built-in tags.',
+    editType: 'kv',
+  }),
+};
+
+export function getPayload<T>(type: DestinationType, data: T, isNew: boolean) {
+  const { maskedParams, readonlyParams } = findDestination(type);
+  const payload: T = { ...data };
+
+  // the server returns ****** for sensitive fields
+  // these are represented as maskedParams in the sync-destinations helper
+  // when editing, remove these fields from the payload if they haven't been changed
+  if (!isNew) {
+    maskedParams.forEach((maskedParam) => {
+      const key = maskedParam as keyof T;
+      const value = (payload[key] as string) || '';
+      // if the value is asterisks, remove it from the payload
+      if (value.match(/^\*+$/)) {
+        delete payload[key];
+      }
+    });
+
+    // to preserve the original Ember Data payload structure, remove fields that are not editable
+    // since editing is disabled in the form the value will not change so this is mostly to satisfy existing test conditions
+    readonlyParams.forEach((readonlyParam) => {
+      delete payload[readonlyParam as keyof T];
+    });
+  }
+
+  return payload;
+}
diff --git a/ui/app/forms/sync/vercel-project.ts b/ui/app/forms/sync/vercel-project.ts
new file mode 100644
index 00000000000..102d59a3b18
--- /dev/null
+++ b/ui/app/forms/sync/vercel-project.ts
@@ -0,0 +1,51 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+import FormFieldGroup from 'vault/utils/forms/field-group';
+import { commonFields, getPayload } from './shared';
+
+import type { SystemWriteSyncDestinationsVercelProjectNameRequest } from '@hashicorp/vault-client-typescript';
+
+type VercelProjectFormData = SystemWriteSyncDestinationsVercelProjectNameRequest & {
+  name: string;
+};
+
+export default class VercelProjectForm extends Form<VercelProjectFormData> {
+  formFieldGroups = [
+    new FormFieldGroup('default', [
+      commonFields.name,
+      new FormField('project_id', 'string', {
+        label: 'Project ID',
+        subText: 'Project ID where to manage environment variables.',
+        editDisabled: true,
+      }),
+      new FormField('team_id', 'string', {
+        label: 'Team ID',
+        subText: 'Team ID the project belongs to. Optional.',
+      }),
+      new FormField('deployment_environments', 'string', {
+        subText: 'Deployment environments where the environment variables are available.',
+        editType: 'checkboxList',
+        possibleValues: ['development', 'preview', 'production'],
+      }),
+    ]),
+    new FormFieldGroup('Credentials', [
+      new FormField('access_token', 'string', {
+        subText: 'Vercel API access token with the permissions to manage environment variables.',
+        sensitive: true,
+        noCopy: true,
+      }),
+    ]),
+    new FormFieldGroup('Advanced configuration', [commonFields.granularity, commonFields.secretNameTemplate]),
+  ];
+
+  toJSON() {
+    const formState = super.toJSON();
+    const data = getPayload<VercelProjectFormData>('vercel-project', this.data, this.isNew);
+    return { ...formState, data };
+  }
+}
diff --git a/ui/app/helpers/-date-base.js b/ui/app/helpers/-date-base.js
index 40c55800f48..cf2fdc2469f 100644
--- a/ui/app/helpers/-date-base.js
+++ b/ui/app/helpers/-date-base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -27,9 +27,12 @@ export default Helper.extend({
        * as the run loop queue is never clear so tests will stay locked waiting
        * for queue to clear.
        */
-      this.intervalTimer = setTimeout(() => {
-        run(() => this.recompute());
-      }, parseInt(interval, 10));
+      this.intervalTimer = setTimeout(
+        () => {
+          run(() => this.recompute());
+        },
+        parseInt(interval, 10)
+      );
     }
   },
 
diff --git a/ui/app/helpers/add-to-array.js b/ui/app/helpers/add-to-array.js
index b89a12f2b56..e2637ec2183 100644
--- a/ui/app/helpers/add-to-array.js
+++ b/ui/app/helpers/add-to-array.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,7 +10,13 @@ function dedupe(items) {
   return items.filter((v, i) => items.indexOf(v) === i);
 }
 
-export function addToArray([array, string]) {
+export function addManyToArray(array, otherArray) {
+  assert(`Both values must be an array`, Array.isArray(array) && Array.isArray(otherArray));
+  const newArray = [...array].concat(otherArray);
+  return dedupe(newArray);
+}
+
+export function addToArray(array, string) {
   if (!Array.isArray(array)) {
     assert(`Value provided is not an array`, false);
   }
@@ -19,4 +25,9 @@ export function addToArray([array, string]) {
   return dedupe(newArray);
 }
 
-export default buildHelper(addToArray);
+export default buildHelper(function ([array, string]) {
+  if (Array.isArray(string)) {
+    return addManyToArray(array, string);
+  }
+  return addToArray(array, string);
+});
diff --git a/ui/app/helpers/add.js b/ui/app/helpers/add.js
index 0a7dde6922e..3c832763954 100644
--- a/ui/app/helpers/add.js
+++ b/ui/app/helpers/add.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/all-features.js b/ui/app/helpers/all-features.js
index 98d1285e50c..3bab5d5aaef 100644
--- a/ui/app/helpers/all-features.js
+++ b/ui/app/helpers/all-features.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -18,6 +18,7 @@ const ALL_FEATURES = [
   'KMIP',
   'Entropy Augmentation',
   'Transform Secrets Engine',
+  'Secrets Sync',
 ];
 
 export function allFeatures() {
diff --git a/ui/app/helpers/await.js b/ui/app/helpers/await.js
deleted file mode 100644
index d72c7f909e5..00000000000
--- a/ui/app/helpers/await.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Helper from '@ember/component/helper';
-import { Promise } from 'rsvp';
-
-export default class AwaitHelper extends Helper {
-  compute([promise]) {
-    if (!promise || typeof promise.then !== 'function') {
-      return promise;
-    }
-    if (promise !== this.lastPromise) {
-      this.lastPromise = promise;
-      this.value = null;
-      this.resolve(promise);
-    }
-    return this.value;
-  }
-  async resolve(promise) {
-    let value;
-    try {
-      value = await Promise.resolve(promise);
-    } catch (error) {
-      value = error;
-    } finally {
-      // ensure this promise is still the newest promise
-      // otherwise avoid firing recompute since a newer promise is in flight
-      if (promise === this.lastPromise) {
-        this.value = value;
-        this.recompute();
-      }
-    }
-  }
-}
diff --git a/ui/app/helpers/aws-regions.js b/ui/app/helpers/aws-regions.js
index a8e0ade94d7..0a0467dbf1a 100644
--- a/ui/app/helpers/aws-regions.js
+++ b/ui/app/helpers/aws-regions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,7 @@ import { helper as buildHelper } from '@ember/component/helper';
 
 //list from http://docs.aws.amazon.com/general/latest/gr/rande.html#sts_region
 const REGIONS = [
+  '', // initial region blank
   'us-east-1',
   'us-east-2',
   'us-west-1',
diff --git a/ui/app/helpers/coerce-eq.js b/ui/app/helpers/coerce-eq.js
index ce6b1ec0e37..b30e2418c54 100644
--- a/ui/app/helpers/coerce-eq.js
+++ b/ui/app/helpers/coerce-eq.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/date-from-now.js b/ui/app/helpers/date-from-now.js
deleted file mode 100644
index 3528431318b..00000000000
--- a/ui/app/helpers/date-from-now.js
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { helper } from '@ember/component/helper';
-import { formatDistanceToNow } from 'date-fns';
-
-export function dateFromNow([date], options = {}) {
-  // check first if string. If it is, it could be ISO format or UTC, either way create a new date object
-  // otherwise it's a number or object and just return
-  const newDate = typeof date === 'string' ? new Date(date) : date;
-  return formatDistanceToNow(newDate, { ...options });
-}
-
-export default helper(dateFromNow);
diff --git a/ui/app/helpers/decode-uri.js b/ui/app/helpers/decode-uri.js
deleted file mode 100644
index be4f471770a..00000000000
--- a/ui/app/helpers/decode-uri.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { helper as buildHelper } from '@ember/component/helper';
-
-export function decodeUri(string) {
-  return decodeURI(string);
-}
-
-export default buildHelper(decodeUri);
diff --git a/ui/app/helpers/engines-display-data.ts b/ui/app/helpers/engines-display-data.ts
new file mode 100644
index 00000000000..b9479ec182f
--- /dev/null
+++ b/ui/app/helpers/engines-display-data.ts
@@ -0,0 +1,37 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { ALL_ENGINES, type EngineDisplayData } from 'vault/utils/all-engines-metadata';
+
+/**
+ * Helper function to retrieve engine metadata for a given `methodType`.
+ * It searches the `ALL_ENGINES` array for an engine with a matching type and returns its metadata object.
+ * The `ALL_ENGINES` array includes secret and auth engines, including those supported only in enterprise.
+ * These details (such as mount type and enterprise licensing) are included in the returned engine object.
+ *
+ * Example usage:
+ * const engineMetadata = engineDisplayData('kmip');
+ * if (engineMetadata?.requiresEnterprise) {
+ *   console.log(`This mount: ${engineMetadata.engineType} requires an enterprise license`);
+ * }
+ *
+ * @param {string} methodType - The engine type (sometimes called backend) to look up (e.g., "aws", "azure").
+ * @returns {Object|undefined} - The engine metadata, which includes information about its mount type (e.g., secret or auth)
+ *   and whether it requires an enterprise license. Returns undefined if no match is found.
+ */
+export default function engineDisplayData(methodType: string): EngineDisplayData {
+  const engine = ALL_ENGINES?.find((t) => t.type === methodType);
+  if (!engine) {
+    return {
+      displayName: methodType || 'Unknown plugin',
+      type: 'unknown',
+      isOldEngine: true,
+      glyph: 'lock',
+      mountCategory: ['secret', 'auth'],
+    };
+  }
+
+  return engine;
+}
diff --git a/ui/app/helpers/filter-wildcard.js b/ui/app/helpers/filter-wildcard.js
index 1838b00d549..ca454d63185 100644
--- a/ui/app/helpers/filter-wildcard.js
+++ b/ui/app/helpers/filter-wildcard.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/has-permission.js b/ui/app/helpers/has-permission.js
index 2a64329bac3..c8ff6c52b09 100644
--- a/ui/app/helpers/has-permission.js
+++ b/ui/app/helpers/has-permission.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,19 +10,22 @@ import { observer } from '@ember/object';
 
 export default Helper.extend({
   permissions: service(),
+  namespace: service(),
+
+  // Recompute when either ACL OR namespace path changes
   onPermissionsChange: observer(
     'permissions.exactPaths',
     'permissions.globPaths',
     'permissions.canViewAll',
+    'permissions.chrootNamespace',
+    'namespace.path',
     function () {
       this.recompute();
     }
   ),
 
   compute([route], params) {
-    const { routeParams, requireAll } = params;
-    const permissions = this.permissions;
-
-    return permissions.hasNavPermission(route, routeParams, requireAll);
+    const { routeParams, requireAll } = params || {};
+    return this.permissions.hasNavPermission(route, routeParams, requireAll);
   },
 });
diff --git a/ui/app/helpers/is-after.js b/ui/app/helpers/is-after.js
index e4f0892261d..c176d78f69b 100644
--- a/ui/app/helpers/is-after.js
+++ b/ui/app/helpers/is-after.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/is-before.js b/ui/app/helpers/is-before.js
index d427acb5bec..fb4ed3aec12 100644
--- a/ui/app/helpers/is-before.js
+++ b/ui/app/helpers/is-before.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/is-wildcard-string.js b/ui/app/helpers/is-wildcard-string.js
index 21f0741cbe3..609de816160 100644
--- a/ui/app/helpers/is-wildcard-string.js
+++ b/ui/app/helpers/is-wildcard-string.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/mountable-auth-methods.js b/ui/app/helpers/mountable-auth-methods.js
deleted file mode 100644
index 7871d19b866..00000000000
--- a/ui/app/helpers/mountable-auth-methods.js
+++ /dev/null
@@ -1,127 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { helper as buildHelper } from '@ember/component/helper';
-
-const ENTERPRISE_AUTH_METHODS = [
-  {
-    displayName: 'SAML',
-    value: 'saml',
-    type: 'saml',
-    category: 'generic',
-    glyph: 'saml-color',
-  },
-];
-
-const MOUNTABLE_AUTH_METHODS = [
-  {
-    displayName: 'AliCloud',
-    value: 'alicloud',
-    type: 'alicloud',
-    category: 'cloud',
-    glyph: 'alibaba-color',
-  },
-  {
-    displayName: 'AppRole',
-    value: 'approle',
-    type: 'approle',
-    category: 'generic',
-    glyph: 'cpu',
-  },
-  {
-    displayName: 'AWS',
-    value: 'aws',
-    type: 'aws',
-    category: 'cloud',
-    glyph: 'aws-color',
-  },
-  {
-    displayName: 'Azure',
-    value: 'azure',
-    type: 'azure',
-    category: 'cloud',
-    glyph: 'azure-color',
-  },
-  {
-    displayName: 'Google Cloud',
-    value: 'gcp',
-    type: 'gcp',
-    category: 'cloud',
-    glyph: 'gcp-color',
-  },
-  {
-    displayName: 'GitHub',
-    value: 'github',
-    type: 'github',
-    category: 'cloud',
-    glyph: 'github-color',
-  },
-  {
-    displayName: 'JWT',
-    value: 'jwt',
-    type: 'jwt',
-    glyph: 'jwt',
-    category: 'generic',
-  },
-  {
-    displayName: 'OIDC',
-    value: 'oidc',
-    type: 'oidc',
-    glyph: 'openid-color',
-    category: 'generic',
-  },
-  {
-    displayName: 'Kubernetes',
-    value: 'kubernetes',
-    type: 'kubernetes',
-    category: 'infra',
-    glyph: 'kubernetes-color',
-  },
-  {
-    displayName: 'LDAP',
-    value: 'ldap',
-    type: 'ldap',
-    glyph: 'folder-users',
-    category: 'infra',
-  },
-  {
-    displayName: 'Okta',
-    value: 'okta',
-    type: 'okta',
-    category: 'infra',
-    glyph: 'okta-color',
-  },
-  {
-    displayName: 'RADIUS',
-    value: 'radius',
-    type: 'radius',
-    glyph: 'mainframe',
-    category: 'infra',
-  },
-  {
-    displayName: 'TLS Certificates',
-    value: 'cert',
-    type: 'cert',
-    category: 'generic',
-    glyph: 'certificate',
-  },
-  {
-    displayName: 'Username & Password',
-    value: 'userpass',
-    type: 'userpass',
-    category: 'generic',
-    glyph: 'users',
-  },
-];
-
-export function methods() {
-  return MOUNTABLE_AUTH_METHODS.slice();
-}
-
-export function allMethods() {
-  return [...MOUNTABLE_AUTH_METHODS, ...ENTERPRISE_AUTH_METHODS];
-}
-
-export default buildHelper(methods);
diff --git a/ui/app/helpers/mountable-secret-engines.js b/ui/app/helpers/mountable-secret-engines.js
deleted file mode 100644
index 398ed5e3671..00000000000
--- a/ui/app/helpers/mountable-secret-engines.js
+++ /dev/null
@@ -1,151 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { helper as buildHelper } from '@ember/component/helper';
-
-const ENTERPRISE_SECRET_ENGINES = [
-  {
-    displayName: 'KMIP',
-    type: 'kmip',
-    glyph: 'lock',
-    engineRoute: 'kmip.scopes.index',
-    category: 'generic',
-    requiredFeature: 'KMIP',
-  },
-  {
-    displayName: 'Transform',
-    type: 'transform',
-    category: 'generic',
-    requiredFeature: 'Transform Secrets Engine',
-    glyph: 'transform-data',
-  },
-  {
-    displayName: 'Key Management',
-    type: 'keymgmt',
-    glyph: 'key',
-    category: 'cloud',
-    requiredFeature: 'Key Management Secrets Engine',
-    routeQueryParams: { tab: 'provider' },
-  },
-];
-
-const MOUNTABLE_SECRET_ENGINES = [
-  {
-    displayName: 'AliCloud',
-    type: 'alicloud',
-    glyph: 'alibaba-color',
-    category: 'cloud',
-  },
-  {
-    displayName: 'AWS',
-    type: 'aws',
-    category: 'cloud',
-    glyph: 'aws-color',
-  },
-  {
-    displayName: 'Azure',
-    type: 'azure',
-    category: 'cloud',
-    glyph: 'azure-color',
-  },
-  {
-    displayName: 'Consul',
-    type: 'consul',
-    glyph: 'consul-color',
-    category: 'infra',
-  },
-  {
-    displayName: 'Databases',
-    type: 'database',
-    category: 'infra',
-    glyph: 'database',
-  },
-  {
-    displayName: 'Google Cloud',
-    type: 'gcp',
-    category: 'cloud',
-    glyph: 'gcp-color',
-  },
-  {
-    displayName: 'Google Cloud KMS',
-    type: 'gcpkms',
-    category: 'cloud',
-    glyph: 'gcp-color',
-  },
-  {
-    displayName: 'KV',
-    type: 'kv',
-    glyph: 'key-values',
-    engineRoute: 'kv.list',
-    category: 'generic',
-  },
-  {
-    displayName: 'Nomad',
-    type: 'nomad',
-    glyph: 'nomad-color',
-    category: 'infra',
-  },
-  {
-    displayName: 'PKI Certificates',
-    type: 'pki',
-    glyph: 'certificate',
-    engineRoute: 'pki.overview',
-    category: 'generic',
-  },
-  {
-    displayName: 'RabbitMQ',
-    type: 'rabbitmq',
-    glyph: 'rabbitmq-color',
-    category: 'infra',
-  },
-  {
-    displayName: 'SSH',
-    type: 'ssh',
-    glyph: 'terminal-screen',
-    category: 'generic',
-  },
-  {
-    displayName: 'Transit',
-    type: 'transit',
-    glyph: 'swap-horizontal',
-    category: 'generic',
-  },
-  {
-    displayName: 'TOTP',
-    type: 'totp',
-    glyph: 'history',
-    category: 'generic',
-  },
-  {
-    displayName: 'LDAP',
-    type: 'ldap',
-    engineRoute: 'ldap.overview',
-    category: 'generic',
-    glyph: 'folder-users',
-  },
-  {
-    displayName: 'Kubernetes',
-    type: 'kubernetes',
-    engineRoute: 'kubernetes.overview',
-    category: 'generic',
-    glyph: 'kubernetes-color',
-  },
-];
-
-export function mountableEngines() {
-  return MOUNTABLE_SECRET_ENGINES.slice();
-}
-
-export function allEngines() {
-  return [...MOUNTABLE_SECRET_ENGINES, ...ENTERPRISE_SECRET_ENGINES];
-}
-
-export function isAddonEngine(type, version) {
-  if (type === 'kv' && version === 1) return false;
-  const engineRoute = allEngines().find((engine) => engine.type === type)?.engineRoute;
-  return !!engineRoute;
-}
-
-export default buildHelper(mountableEngines);
diff --git a/ui/app/helpers/multi-line-join.js b/ui/app/helpers/multi-line-join.js
index d2ec9811165..de5ad0e4d78 100644
--- a/ui/app/helpers/multi-line-join.js
+++ b/ui/app/helpers/multi-line-join.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/nav-to-route.js b/ui/app/helpers/nav-to-route.js
index 09f1240592f..cce4beac9e3 100644
--- a/ui/app/helpers/nav-to-route.js
+++ b/ui/app/helpers/nav-to-route.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/now.js b/ui/app/helpers/now.js
index e3670cce5d1..bdee27597e1 100644
--- a/ui/app/helpers/now.js
+++ b/ui/app/helpers/now.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/number-to-word.js b/ui/app/helpers/number-to-word.js
index 86ab87268c8..355f52d5a80 100644
--- a/ui/app/helpers/number-to-word.js
+++ b/ui/app/helpers/number-to-word.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/remove-from-array.js b/ui/app/helpers/remove-from-array.js
index ea62da6de06..13fa14fc05b 100644
--- a/ui/app/helpers/remove-from-array.js
+++ b/ui/app/helpers/remove-from-array.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,10 +10,14 @@ function dedupe(items) {
   return items.filter((v, i) => items.indexOf(v) === i);
 }
 
-export function removeFromArray([array, string]) {
-  if (!Array.isArray(array)) {
-    assert(`Value provided is not an array`, false);
-  }
+export function removeManyFromArray(array, toRemove) {
+  assert(`Both values must be an array`, Array.isArray(array) && Array.isArray(toRemove));
+  const a = [...(array || [])];
+  return a.filter((v) => !toRemove.includes(v));
+}
+
+export function removeFromArray(array, string) {
+  assert(`Value provided is not an array`, Array.isArray(array));
   const newArray = [...array];
   const idx = newArray.indexOf(string);
   if (idx >= 0) {
@@ -22,4 +26,9 @@ export function removeFromArray([array, string]) {
   return dedupe(newArray);
 }
 
-export default buildHelper(removeFromArray);
+export default buildHelper(function ([array, string]) {
+  if (Array.isArray(string)) {
+    return removeManyFromArray(array, string);
+  }
+  return removeFromArray(array, string);
+});
diff --git a/ui/app/helpers/route-params-for.js b/ui/app/helpers/route-params-for.js
index 48480f77ead..fc4dec2a161 100644
--- a/ui/app/helpers/route-params-for.js
+++ b/ui/app/helpers/route-params-for.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/secret-query-params.js b/ui/app/helpers/secret-query-params.js
index c65c44be9b3..f7546e37d19 100644
--- a/ui/app/helpers/secret-query-params.js
+++ b/ui/app/helpers/secret-query-params.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/sha2-digest-sizes.js b/ui/app/helpers/sha2-digest-sizes.js
index 3db1583be83..6feca63eeea 100644
--- a/ui/app/helpers/sha2-digest-sizes.js
+++ b/ui/app/helpers/sha2-digest-sizes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/split-object.js b/ui/app/helpers/split-object.js
index e1f87d54167..b304af361ce 100644
--- a/ui/app/helpers/split-object.js
+++ b/ui/app/helpers/split-object.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/string-array-to-camel.js b/ui/app/helpers/string-array-to-camel.js
new file mode 100644
index 00000000000..9924984691c
--- /dev/null
+++ b/ui/app/helpers/string-array-to-camel.js
@@ -0,0 +1,38 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { helper as buildHelper } from '@ember/component/helper';
+import { assert } from '@ember/debug';
+
+// This helper is similar to the Ember string camelize helper but it does some additional handling:
+// it allows you to pass in an array of strings
+// it lowercases the entire string before converting to camelCase preventing situations like IAM Endpoint  -> iamEndpoint instead of iAMEndpoint
+// it does not handle accented characters so try not use for user inputted strings.
+export function stringArrayToCamelCase(str) {
+  if (!str) return;
+  if (Array.isArray(str)) {
+    return str.map((s) => {
+      assert(`must pass in a string or array of strings`, typeof s === 'string');
+      // lower case the entire string to handle situations like IAM Endpoint  -> iamEndpoint instead of iAMEndpoint
+      s = s.toLowerCase();
+      return s
+        .replace(/(?:^\w|[A-Z]|\b\w)/g, function (word, index) {
+          return index === 0 ? word.toLowerCase() : word.toUpperCase();
+        })
+        .replace(/\s+/g, '');
+    });
+  } else {
+    // lower case the entire string to handle situations like IAM Endpoint  -> iamEndpoint instead of iAMEndpoint
+    assert(`must pass in a string or array of strings`, typeof str === 'string');
+    str = str.toLowerCase();
+    return str
+      .replace(/(?:^\w|[A-Z]|\b\w)/g, function (word, index) {
+        return index === 0 ? word.toLowerCase() : word.toUpperCase();
+      })
+      .replace(/\s+/g, '');
+  }
+}
+
+export default buildHelper(stringArrayToCamelCase);
diff --git a/ui/app/helpers/sub.js b/ui/app/helpers/sub.js
index 2c9909d38c3..e83c2d05545 100644
--- a/ui/app/helpers/sub.js
+++ b/ui/app/helpers/sub.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/supported-auth-backends.js b/ui/app/helpers/supported-auth-backends.js
deleted file mode 100644
index e06cbd3387b..00000000000
--- a/ui/app/helpers/supported-auth-backends.js
+++ /dev/null
@@ -1,94 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { helper as buildHelper } from '@ember/component/helper';
-
-const SUPPORTED_AUTH_BACKENDS = [
-  {
-    type: 'token',
-    typeDisplay: 'Token',
-    description: 'Token authentication.',
-    tokenPath: 'id',
-    displayNamePath: 'display_name',
-    formAttributes: ['token'],
-  },
-  {
-    type: 'userpass',
-    typeDisplay: 'Username',
-    description: 'A simple username and password backend.',
-    tokenPath: 'client_token',
-    displayNamePath: 'metadata.username',
-    formAttributes: ['username', 'password'],
-  },
-  {
-    type: 'ldap',
-    typeDisplay: 'LDAP',
-    description: 'LDAP authentication.',
-    tokenPath: 'client_token',
-    displayNamePath: 'metadata.username',
-    formAttributes: ['username', 'password'],
-  },
-  {
-    type: 'okta',
-    typeDisplay: 'Okta',
-    description: 'Authenticate with your Okta username and password.',
-    tokenPath: 'client_token',
-    displayNamePath: 'metadata.username',
-    formAttributes: ['username', 'password'],
-  },
-  {
-    type: 'jwt',
-    typeDisplay: 'JWT',
-    description: 'Authenticate using JWT or OIDC provider.',
-    tokenPath: 'client_token',
-    displayNamePath: 'display_name',
-    formAttributes: ['role', 'jwt'],
-  },
-  {
-    type: 'oidc',
-    typeDisplay: 'OIDC',
-    description: 'Authenticate using JWT or OIDC provider.',
-    tokenPath: 'client_token',
-    displayNamePath: 'display_name',
-    formAttributes: ['role', 'jwt'],
-  },
-  {
-    type: 'radius',
-    typeDisplay: 'RADIUS',
-    description: 'Authenticate with your RADIUS username and password.',
-    tokenPath: 'client_token',
-    displayNamePath: 'metadata.username',
-    formAttributes: ['username', 'password'],
-  },
-  {
-    type: 'github',
-    typeDisplay: 'GitHub',
-    description: 'GitHub authentication.',
-    tokenPath: 'client_token',
-    displayNamePath: ['metadata.org', 'metadata.username'],
-    formAttributes: ['token'],
-  },
-];
-
-const ENTERPRISE_AUTH_METHODS = [
-  {
-    type: 'saml',
-    typeDisplay: 'SAML',
-    description: 'Authenticate using SAML provider.',
-    tokenPath: 'client_token',
-    displayNamePath: 'display_name',
-    formAttributes: ['role'],
-  },
-];
-
-export function supportedAuthBackends() {
-  return SUPPORTED_AUTH_BACKENDS;
-}
-
-export function allSupportedAuthBackends() {
-  return [...SUPPORTED_AUTH_BACKENDS, ...ENTERPRISE_AUTH_METHODS];
-}
-
-export default buildHelper(supportedAuthBackends);
diff --git a/ui/app/helpers/supported-managed-auth-backends.js b/ui/app/helpers/supported-managed-auth-backends.js
index c8bfdf92946..948330e1b1a 100644
--- a/ui/app/helpers/supported-managed-auth-backends.js
+++ b/ui/app/helpers/supported-managed-auth-backends.js
@@ -1,11 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { helper as buildHelper } from '@ember/component/helper';
 
-const MANAGED_AUTH_BACKENDS = ['cert', 'userpass', 'ldap', 'okta', 'radius'];
+// The UI supports management of these auth methods (i.e. configuring roles or users)
+// otherwise only configuration of the method is supported.
+export const MANAGED_AUTH_BACKENDS = ['cert', 'kubernetes', 'ldap', 'okta', 'radius', 'userpass'];
 
 export function supportedManagedAuthBackends() {
   return MANAGED_AUTH_BACKENDS;
diff --git a/ui/app/helpers/supported-secret-backends.js b/ui/app/helpers/supported-secret-backends.js
deleted file mode 100644
index 144fcf0f00f..00000000000
--- a/ui/app/helpers/supported-secret-backends.js
+++ /dev/null
@@ -1,28 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { helper as buildHelper } from '@ember/component/helper';
-
-const SUPPORTED_SECRET_BACKENDS = [
-  'aws',
-  'database',
-  'cubbyhole',
-  'generic',
-  'kv',
-  'pki',
-  'ssh',
-  'transit',
-  'kmip',
-  'transform',
-  'keymgmt',
-  'kubernetes',
-  'ldap',
-];
-
-export function supportedSecretBackends() {
-  return SUPPORTED_SECRET_BACKENDS;
-}
-
-export default buildHelper(supportedSecretBackends);
diff --git a/ui/app/helpers/supported-secret-backends.ts b/ui/app/helpers/supported-secret-backends.ts
new file mode 100644
index 00000000000..0d335015486
--- /dev/null
+++ b/ui/app/helpers/supported-secret-backends.ts
@@ -0,0 +1,31 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { helper as buildHelper } from '@ember/component/helper';
+
+export enum SupportedSecretBackendsEnum {
+  AWS = 'aws',
+  AZURE = 'azure',
+  CUBBYHOLE = 'cubbyhole',
+  DATABASE = 'database',
+  GCP = 'gcp',
+  GENERIC = 'generic',
+  KEYMGMT = 'keymgmt',
+  KMIP = 'kmip',
+  KUBERNETES = 'kubernetes',
+  KV = 'kv',
+  LDAP = 'ldap',
+  PKI = 'pki',
+  SSH = 'ssh',
+  TRANSFORM = 'transform',
+  TRANSIT = 'transit',
+  TOTP = 'totp',
+}
+
+export function supportedSecretBackends() {
+  return Object.values(SupportedSecretBackendsEnum);
+}
+
+export default buildHelper(supportedSecretBackends);
diff --git a/ui/app/helpers/tabs-for-auth-section.js b/ui/app/helpers/tabs-for-auth-section.js
index 46f95fe65a4..4710b511c82 100644
--- a/ui/app/helpers/tabs-for-auth-section.js
+++ b/ui/app/helpers/tabs-for-auth-section.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,88 +11,101 @@ const TABS_FOR_SETTINGS = {
   aws: [
     {
       label: 'Client',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'client'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['client'],
     },
     {
       label: 'Identity Allow List Tidy',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'identity-accesslist'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['identity-accesslist'],
     },
     {
       label: 'Role Tag Deny List Tidy',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'roletag-denylist'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['roletag-denylist'],
     },
   ],
   azure: [
     {
       label: 'Configuration',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'configuration'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['configuration'],
     },
   ],
   github: [
     {
       label: 'Configuration',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'configuration'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['configuration'],
     },
   ],
   gcp: [
     {
       label: 'Configuration',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'configuration'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['configuration'],
     },
   ],
   jwt: [
     {
       label: 'Configuration',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'configuration'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['configuration'],
     },
   ],
   oidc: [
     {
       label: 'Configuration',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'configuration'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['configuration'],
     },
   ],
   kubernetes: [
     {
       label: 'Configuration',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'configuration'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['configuration'],
     },
   ],
   ldap: [
     {
       label: 'Configuration',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'configuration'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['configuration'],
     },
   ],
   okta: [
     {
       label: 'Configuration',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'configuration'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['configuration'],
     },
   ],
   radius: [
     {
       label: 'Configuration',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'configuration'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: ['configuration'],
     },
   ],
 };
 
 const TABS_FOR_SHOW = {};
 
-export function tabsForAuthSection([model, sectionType = 'authSettings', paths]) {
+export function tabsForAuthSection([authMethodModel, sectionType = 'authSettings', paths]) {
   let tabs;
   if (sectionType === 'authSettings') {
-    tabs = (TABS_FOR_SETTINGS[model.type] || []).slice();
+    tabs = (TABS_FOR_SETTINGS[authMethodModel.type] || []).slice();
     tabs.push({
       label: 'Method Options',
-      routeParams: ['vault.cluster.settings.auth.configure.section', 'options'],
+      route: 'vault.cluster.settings.auth.configure.section',
+      routeParams: [authMethodModel.id, 'options'],
     });
     return tabs;
   }
-  if (paths || model.paths) {
-    if (model.paths) {
-      paths = model.paths.paths.filter((path) => path.navigation);
+  if (paths || authMethodModel.paths) {
+    if (authMethodModel.paths) {
+      paths = authMethodModel.paths.paths.filter((path) => path.navigation);
     }
 
     // TODO: we're unsure if we actually need compact here
@@ -100,18 +113,24 @@ export function tabsForAuthSection([model, sectionType = 'authSettings', paths])
     tabs = paths.compact().map((path) => {
       return {
         label: capitalize(pluralize(path.itemName)),
-        routeParams: ['vault.cluster.access.method.item.list', path.itemType],
+        route: 'vault.cluster.access.method.item.list',
+        routeParams: [path.itemType],
       };
     });
   } else {
-    tabs = (TABS_FOR_SHOW[model.type] || []).slice();
+    tabs = (TABS_FOR_SHOW[authMethodModel.type] || []).slice();
   }
   tabs.push({
     label: 'Configuration',
-    routeParams: ['vault.cluster.access.method.section', 'configuration'],
+    route: 'vault.cluster.access.method.section',
+    routeParams: ['configuration'],
   });
 
-  return tabs;
+  return tabs.map((tab) => ({
+    label: tab.label,
+    route: tab.route,
+    routeParams: [authMethodModel.id, ...tab.routeParams],
+  }));
 }
 
 export default buildHelper(tabsForAuthSection);
diff --git a/ui/app/helpers/tabs-for-identity-show.js b/ui/app/helpers/tabs-for-identity-show.js
index e221f48857d..955336f60a2 100644
--- a/ui/app/helpers/tabs-for-identity-show.js
+++ b/ui/app/helpers/tabs-for-identity-show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/tools-actions.js b/ui/app/helpers/tools-actions.js
index 8e87723e9fc..d7d97c6fa17 100644
--- a/ui/app/helpers/tools-actions.js
+++ b/ui/app/helpers/tools-actions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/helpers/wizard-constants.js b/ui/app/helpers/wizard-constants.js
deleted file mode 100644
index 0b9321f957d..00000000000
--- a/ui/app/helpers/wizard-constants.js
+++ /dev/null
@@ -1,72 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import TutorialMachineConfig from 'vault/machines/tutorial-machine';
-import SecretsMachineConfig from 'vault/machines/secrets-machine';
-import PoliciesMachineConfig from 'vault/machines/policies-machine';
-import ReplicationMachineConfig from 'vault/machines/replication-machine';
-import ToolsMachineConfig from 'vault/machines/tools-machine';
-import AuthMachineConfig from 'vault/machines/auth-machine';
-
-export const STORAGE_KEYS = {
-  TUTORIAL_STATE: 'vault:ui-tutorial-state',
-  FEATURE_LIST: 'vault:ui-feature-list',
-  FEATURE_STATE: 'vault:ui-feature-state',
-  FEATURE_STATE_HISTORY: 'vault:ui-feature-state-history',
-  COMPLETED_FEATURES: 'vault:ui-completed-list',
-  COMPONENT_STATE: 'vault:ui-component-state',
-  RESUME_URL: 'vault:ui-tutorial-resume-url',
-  RESUME_ROUTE: 'vault:ui-tutorial-resume-route',
-};
-
-export const MACHINES = {
-  tutorial: TutorialMachineConfig,
-  secrets: SecretsMachineConfig,
-  policies: PoliciesMachineConfig,
-  replication: ReplicationMachineConfig,
-  tools: ToolsMachineConfig,
-  authentication: AuthMachineConfig,
-};
-
-export const DEFAULTS = {
-  currentState: null,
-  featureList: null,
-  featureState: null,
-  currentMachine: null,
-  tutorialComponent: null,
-  featureComponent: null,
-  stepComponent: null,
-  detailsComponent: null,
-  componentState: null,
-  nextFeature: null,
-  nextStep: null,
-  featureMachineHistory: null,
-};
-
-export const FEATURE_MACHINE_STEPS = {
-  secrets: {
-    encryption: 5,
-    secret: {
-      list: 4,
-      secret: 5,
-    },
-    role: 7,
-    provider: 8,
-  },
-  policies: 5,
-  replication: 2,
-  tools: 8,
-  authentication: 4,
-};
-
-export const INIT_STEPS = ['setup', 'save', 'unseal', 'login'];
-
-export const FEATURE_MACHINE_TIME = {
-  secrets: 7,
-  policies: 5,
-  replication: 5,
-  tools: 8,
-  authentication: 5,
-};
diff --git a/ui/app/index.html b/ui/app/index.html
index a837b9332fb..98e799c1191 100644
--- a/ui/app/index.html
+++ b/ui/app/index.html
@@ -1,6 +1,6 @@
 <!DOCTYPE html>
 <!--
- Copyright (c) HashiCorp, Inc.
+ Copyright IBM Corp. 2016, 2025
  SPDX-License-Identifier: BUSL-1.1
 -->
 
diff --git a/ui/app/initializers/deprecation-filter.js b/ui/app/initializers/deprecation-filter.js
index ec2347caba3..c9953ac28d7 100644
--- a/ui/app/initializers/deprecation-filter.js
+++ b/ui/app/initializers/deprecation-filter.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,7 +10,8 @@ export function initialize() {
   registerDeprecationHandler((message, options, next) => {
     // filter deprecations that are scheduled to be removed in a specific version
     // when upgrading or addressing deprecation warnings be sure to update this or remove if not needed
-    if (options?.until.includes('5.0')) {
+    if (options?.until.includes('6.0')) {
+      // ignore all deprecations for 6+
       return;
     }
     next(message, options);
diff --git a/ui/app/initializers/disable-ember-inspector.js b/ui/app/initializers/disable-ember-inspector.js
index 663b9b235a8..b9db0c3e41a 100644
--- a/ui/app/initializers/disable-ember-inspector.js
+++ b/ui/app/initializers/disable-ember-inspector.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/initializers/ember-data-identifiers.js b/ui/app/initializers/ember-data-identifiers.js
index e9e0ed68437..edb457433b9 100644
--- a/ui/app/initializers/ember-data-identifiers.js
+++ b/ui/app/initializers/ember-data-identifiers.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/initializers/enable-engines.js b/ui/app/initializers/enable-engines.js
index 04c9c90563f..c47ad9cff3a 100644
--- a/ui/app/initializers/enable-engines.js
+++ b/ui/app/initializers/enable-engines.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/instance-initializers/track-csp-event.js b/ui/app/instance-initializers/track-csp-event.js
index d8539e42615..5a9b3b200ba 100644
--- a/ui/app/instance-initializers/track-csp-event.js
+++ b/ui/app/instance-initializers/track-csp-event.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/lib/arg-tokenizer.js b/ui/app/lib/arg-tokenizer.js
index cc52447c843..ed45e3f5758 100644
--- a/ui/app/lib/arg-tokenizer.js
+++ b/ui/app/lib/arg-tokenizer.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/lib/attach-capabilities.js b/ui/app/lib/attach-capabilities.js
deleted file mode 100644
index 1d7430a07e2..00000000000
--- a/ui/app/lib/attach-capabilities.js
+++ /dev/null
@@ -1,87 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { belongsTo } from '@ember-data/model';
-import { assert, debug } from '@ember/debug';
-import { typeOf } from '@ember/utils';
-import { isArray } from '@ember/array';
-
-/*
- *
- * attachCapabilities
- *
- * @param modelClass = An Ember Data model class
- * @param capabilities - an Object whose keys will added to the model class as related 'capabilities' models
- * and whose values should be functions that return the id of the related capabilities model
- *
- * definition of capabilities be done shorthand with the apiPath tagged template function
- *
- *
- * @usage
- *
- * let Model = DS.Model.extend({
- *   backend: attr(),
- *   scope: attr(),
- * });
- *
- * export default attachCapabilities(Model, {
- *   updatePath: apiPath`${'backend'}/scope/${'scope'}/role/${'id'}`,
- * });
- *
- */
-export default function attachCapabilities(modelClass, capabilities) {
-  const capabilityKeys = Object.keys(capabilities);
-  const newRelationships = capabilityKeys.reduce((ret, key) => {
-    ret[key] = belongsTo('capabilities', { async: false, inverse: null });
-    return ret;
-  }, {});
-
-  //TODO: move this to the application serializer and do it JIT instead of on app boot
-  debug(`adding new relationships: ${capabilityKeys.join(', ')} to ${modelClass.toString()}`);
-  modelClass.reopen(newRelationships);
-  modelClass.reopenClass({
-    // relatedCapabilities is called in the application serializer's
-    // normalizeResponse hook to add the capabilities relationships to the
-    // JSON-API document used by Ember Data
-    relatedCapabilities(jsonAPIDoc) {
-      let { data, included } = jsonAPIDoc;
-      if (!data) {
-        data = jsonAPIDoc;
-      }
-      if (isArray(data)) {
-        const newData = data.map(this.relatedCapabilities);
-        return {
-          data: newData,
-          included,
-        };
-      }
-      const context = {
-        id: data.id,
-        ...data.attributes,
-      };
-      for (const newCapability of capabilityKeys) {
-        const templateFn = capabilities[newCapability];
-        const type = typeOf(templateFn);
-        assert(`expected value of ${newCapability} to be a function but found ${type}.`, type === 'function');
-        data.relationships[newCapability] = {
-          data: {
-            type: 'capabilities',
-            id: templateFn(context),
-          },
-        };
-      }
-
-      if (included) {
-        return {
-          data,
-          included,
-        };
-      } else {
-        return data;
-      }
-    },
-  });
-  return modelClass;
-}
diff --git a/ui/app/lib/console-helpers.ts b/ui/app/lib/console-helpers.ts
index 1a76f4775d4..8a28a951b23 100644
--- a/ui/app/lib/console-helpers.ts
+++ b/ui/app/lib/console-helpers.ts
@@ -1,14 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import keys from 'core/utils/key-codes';
-import AdapterError from '@ember-data/adapter/error';
+import keys from 'core/utils/keys';
 import { parse } from 'shell-quote';
-
 import argTokenizer from './arg-tokenizer';
-import { StringMap } from 'vault/vault/app-types';
+
+import type { StringMap } from 'vault/app-types';
+import type AdapterError from '@ember-data/adapter/error';
 
 // Add new commands to `log-help` component for visibility
 const supportedCommands = ['read', 'write', 'list', 'delete', 'kv-get'];
@@ -188,12 +188,7 @@ export function logFromResponse(response: LogResponse, path: string, method: str
   return { type: 'object', content: secret };
 }
 
-interface CustomError extends AdapterError {
-  httpStatus: number;
-  path: string;
-  errors: string[];
-}
-export function logFromError(error: CustomError, vaultPath: string, method: string) {
+export function logFromError(error: AdapterError, vaultPath: string, method: string) {
   let content;
   const { httpStatus, path } = error;
   const verbClause = {
@@ -217,7 +212,7 @@ interface CommandLog {
   type: string;
   content?: string;
 }
-export function shiftCommandIndex(keyCode: number, history: CommandLog[], index: number) {
+export function shiftCommandIndex(key: string, history: CommandLog[], index: number) {
   let newInputValue;
   const commandHistoryLength = history.length;
 
@@ -225,7 +220,7 @@ export function shiftCommandIndex(keyCode: number, history: CommandLog[], index:
     return [];
   }
 
-  if (keyCode === keys.UP) {
+  if (key === keys.UP) {
     index -= 1;
     if (index < 0) {
       index = commandHistoryLength - 1;
@@ -241,7 +236,8 @@ export function shiftCommandIndex(keyCode: number, history: CommandLog[], index:
   }
 
   if (newInputValue !== '') {
-    newInputValue = history.objectAt(index)?.content;
+    const objAt = history[index];
+    newInputValue = objAt?.content;
   }
 
   return [index, newInputValue];
diff --git a/ui/app/lib/control-group-error.js b/ui/app/lib/control-group-error.js
index a1c075560cf..0cf4d9b63d0 100644
--- a/ui/app/lib/control-group-error.js
+++ b/ui/app/lib/control-group-error.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/lib/kv-object.js b/ui/app/lib/kv-object.js
index 0a752095efe..56aed334cfc 100644
--- a/ui/app/lib/kv-object.js
+++ b/ui/app/lib/kv-object.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/lib/local-storage.js b/ui/app/lib/local-storage.js
deleted file mode 100644
index a259c78699b..00000000000
--- a/ui/app/lib/local-storage.js
+++ /dev/null
@@ -1,47 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export default {
-  isLocalStorageSupported() {
-    try {
-      const key = `__storage__test`;
-      window.localStorage.setItem(key, null);
-      window.localStorage.removeItem(key);
-      return true;
-    } catch (e) {
-      // modify the e object so we can customize the error message.
-      // e.message is readOnly.
-      e.errors = [`This is likely due to your browser's cookie settings.`];
-      throw e;
-    }
-  },
-
-  getItem(key) {
-    const item = window.localStorage.getItem(key);
-    return item && JSON.parse(item);
-  },
-
-  setItem(key, val) {
-    window.localStorage.setItem(key, JSON.stringify(val));
-  },
-
-  removeItem(key) {
-    return window.localStorage.removeItem(key);
-  },
-
-  keys() {
-    return Object.keys(window.localStorage);
-  },
-
-  cleanupStorage(string, keyToKeep) {
-    if (!string) return;
-    const relevantKeys = this.keys().filter((str) => str.startsWith(string));
-    relevantKeys?.forEach((key) => {
-      if (key !== keyToKeep) {
-        localStorage.removeItem(key);
-      }
-    });
-  },
-};
diff --git a/ui/app/lib/local-storage.ts b/ui/app/lib/local-storage.ts
new file mode 100644
index 00000000000..d5e46afad80
--- /dev/null
+++ b/ui/app/lib/local-storage.ts
@@ -0,0 +1,51 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export default {
+  isLocalStorageSupported() {
+    try {
+      const key = `__storage__test`;
+      window.localStorage.setItem(key, '');
+      window.localStorage.removeItem(key);
+      return true;
+    } catch (e) {
+      // modify the e object so we can customize the error message.
+      // e.message is readOnly.
+      Object.defineProperty(e, 'errors', {
+        value: [`This is likely due to your browser's cookie settings.`],
+        writable: false,
+      });
+
+      throw e;
+    }
+  },
+
+  getItem(key: string) {
+    const item = window.localStorage.getItem(key);
+    return item && JSON.parse(item);
+  },
+
+  setItem(key: string, val: unknown) {
+    window.localStorage.setItem(key, JSON.stringify(val));
+  },
+
+  removeItem(key: string) {
+    return window.localStorage.removeItem(key);
+  },
+
+  keys() {
+    return Object.keys(window.localStorage);
+  },
+
+  cleanupStorage(string: string, keyToKeep: string) {
+    if (!string) return;
+    const relevantKeys = this.keys().filter((str) => str.startsWith(string));
+    relevantKeys?.forEach((key) => {
+      if (key !== keyToKeep) {
+        localStorage.removeItem(key);
+      }
+    });
+  },
+};
diff --git a/ui/app/lib/memory-storage.js b/ui/app/lib/memory-storage.js
deleted file mode 100644
index bd1cfcc97a0..00000000000
--- a/ui/app/lib/memory-storage.js
+++ /dev/null
@@ -1,25 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-const cache = {};
-
-export default {
-  getItem(key) {
-    var item = cache[key];
-    return item && JSON.parse(item);
-  },
-
-  setItem(key, val) {
-    cache[key] = JSON.stringify(val);
-  },
-
-  removeItem(key) {
-    delete cache[key];
-  },
-
-  keys() {
-    return Object.keys(cache);
-  },
-};
diff --git a/ui/app/lib/memory-storage.ts b/ui/app/lib/memory-storage.ts
new file mode 100644
index 00000000000..53509b061e2
--- /dev/null
+++ b/ui/app/lib/memory-storage.ts
@@ -0,0 +1,25 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+const cache: { [key: string]: string } = {};
+
+export default {
+  getItem(key: string) {
+    const item = cache[key];
+    return item && JSON.parse(item);
+  },
+
+  setItem(key: string, val: unknown) {
+    cache[key] = JSON.stringify(val);
+  },
+
+  removeItem(key: string) {
+    delete cache[key];
+  },
+
+  keys() {
+    return Object.keys(cache);
+  },
+};
diff --git a/ui/app/lib/path-to-tree.js b/ui/app/lib/path-to-tree.js
deleted file mode 100644
index c9f45b808fa..00000000000
--- a/ui/app/lib/path-to-tree.js
+++ /dev/null
@@ -1,57 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import flat from 'flat';
-import deepmerge from 'deepmerge';
-
-const { unflatten } = flat;
-const DOT_REPLACEMENT = '☃';
-
-//function that takes a list of path and returns a deeply nested object
-//representing a tree of all of those paths
-//
-//
-// given ["foo", "bar", "foo1", "foo/bar", "foo/baz", "foo/bar/baz"]
-//
-// returns {
-//    bar: null,
-//    foo: {
-//      bar: {
-//        baz: null
-//      },
-//      baz: null,
-//    },
-//    foo1: null,
-// }
-export default function (paths) {
-  // first sort the list by length, then alphanumeric
-  const list = paths.slice(0).sort((a, b) => b.length - a.length || b.localeCompare(a));
-  // then reduce to an array
-  // and we remove all of the items that have a string
-  // that starts with the same prefix from the list
-  // so if we have "foo/bar/baz", both "foo" and "foo/bar"
-  // won't be included in the list
-  let tree = list.reduce((accumulator, ns) => {
-    const nsWithPrefix = accumulator.find((path) => path.startsWith(ns));
-    // we need to make sure it's a match for the full path part
-    const isFullMatch = nsWithPrefix && nsWithPrefix.charAt(ns.length) === '/';
-    if (!isFullMatch) {
-      accumulator.push(ns);
-    }
-    return accumulator;
-  }, []);
-
-  tree = tree.sort((a, b) => a.localeCompare(b));
-  // after the reduction we're left with an array that contains
-  // strings that represent the longest branches
-  // we'll replace the dots in the paths, then expand the path
-  // to a nested object that we can then query with Ember.get
-  return deepmerge.all(
-    tree.map((p) => {
-      p = p.replace(/\.+/g, DOT_REPLACEMENT);
-      return unflatten({ [p]: null }, { delimiter: '/', object: true });
-    })
-  );
-}
diff --git a/ui/app/lib/route-paths.js b/ui/app/lib/route-paths.js
index 333f71f684f..753a0b3bcf5 100644
--- a/ui/app/lib/route-paths.js
+++ b/ui/app/lib/route-paths.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/lib/token-storage.js b/ui/app/lib/token-storage.js
index ea2b616b55d..d15d2586964 100644
--- a/ui/app/lib/token-storage.js
+++ b/ui/app/lib/token-storage.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/machines/auth-machine.js b/ui/app/machines/auth-machine.js
deleted file mode 100644
index a77f7d7ef7c..00000000000
--- a/ui/app/machines/auth-machine.js
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export default {
-  key: 'auth',
-  initial: 'idle',
-  on: {
-    RESET: 'idle',
-    DONE: 'complete',
-  },
-  states: {
-    idle: {
-      onEntry: [
-        { type: 'routeTransition', params: ['vault.cluster.settings.auth.enable'] },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        { type: 'render', level: 'step', component: 'wizard/auth-idle' },
-      ],
-      on: {
-        CONTINUE: 'enable',
-      },
-    },
-    enable: {
-      onEntry: [
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        { type: 'render', level: 'step', component: 'wizard/auth-enable' },
-      ],
-      on: {
-        CONTINUE: 'config',
-      },
-    },
-    config: {
-      onEntry: [
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        { type: 'render', level: 'step', component: 'wizard/auth-config' },
-      ],
-      on: {
-        CONTINUE: 'details',
-      },
-    },
-    details: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/auth-details' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'complete',
-      },
-    },
-    complete: {
-      onEntry: ['completeFeature'],
-    },
-  },
-};
diff --git a/ui/app/machines/policies-machine.js b/ui/app/machines/policies-machine.js
deleted file mode 100644
index c2473631047..00000000000
--- a/ui/app/machines/policies-machine.js
+++ /dev/null
@@ -1,47 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export default {
-  key: 'policies',
-  initial: 'idle',
-  states: {
-    idle: {
-      onEntry: [
-        { type: 'routeTransition', params: ['vault.cluster.policies.index', 'acl'] },
-        { type: 'render', level: 'feature', component: 'wizard/policies-intro' },
-      ],
-      on: {
-        CONTINUE: 'create',
-      },
-    },
-    create: {
-      on: {
-        CONTINUE: 'details',
-      },
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/policies-create' }],
-    },
-    details: {
-      on: {
-        CONTINUE: 'delete',
-      },
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/policies-details' }],
-    },
-    delete: {
-      on: {
-        CONTINUE: 'others',
-      },
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/policies-delete' }],
-    },
-    others: {
-      on: {
-        CONTINUE: 'complete',
-      },
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/policies-others' }],
-    },
-    complete: {
-      onEntry: ['completeFeature'],
-    },
-  },
-};
diff --git a/ui/app/machines/replication-machine.js b/ui/app/machines/replication-machine.js
deleted file mode 100644
index 4b95e70f780..00000000000
--- a/ui/app/machines/replication-machine.js
+++ /dev/null
@@ -1,29 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export default {
-  key: 'replication',
-  initial: 'setup',
-  states: {
-    setup: {
-      on: {
-        ENABLEREPLICATION: 'details',
-      },
-      onEntry: [
-        { type: 'routeTransition', params: ['vault.cluster.replication'] },
-        { type: 'render', level: 'feature', component: 'wizard/replication-setup' },
-      ],
-    },
-    details: {
-      on: {
-        CONTINUE: 'complete',
-      },
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/replication-details' }],
-    },
-    complete: {
-      onEntry: ['completeFeature'],
-    },
-  },
-};
diff --git a/ui/app/machines/secrets-machine.js b/ui/app/machines/secrets-machine.js
deleted file mode 100644
index b47ce124e62..00000000000
--- a/ui/app/machines/secrets-machine.js
+++ /dev/null
@@ -1,224 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
-const supportedBackends = supportedSecretBackends();
-
-export default {
-  key: 'secrets',
-  initial: 'idle',
-  on: {
-    RESET: 'idle',
-    DONE: 'complete',
-    ERROR: 'error',
-  },
-  states: {
-    idle: {
-      onEntry: [
-        { type: 'routeTransition', params: ['vault.cluster.settings.mount-secret-backend'] },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        { type: 'render', level: 'step', component: 'wizard/secrets-idle' },
-      ],
-      on: {
-        CONTINUE: 'enable',
-      },
-    },
-    enable: {
-      onEntry: [
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        { type: 'render', level: 'step', component: 'wizard/secrets-enable' },
-      ],
-      on: {
-        CONTINUE: {
-          details: { cond: (type) => supportedBackends.includes(type) },
-          list: { cond: (type) => !supportedBackends.includes(type) },
-        },
-      },
-    },
-    details: {
-      onEntry: [
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        { type: 'render', level: 'step', component: 'wizard/secrets-details' },
-      ],
-      on: {
-        CONTINUE: {
-          connection: {
-            cond: (type) => type === 'database',
-          },
-          role: {
-            cond: (type) => ['pki', 'aws', 'ssh'].includes(type),
-          },
-          secret: {
-            cond: (type) => ['kv'].includes(type),
-          },
-          encryption: {
-            cond: (type) => type === 'transit',
-          },
-          provider: {
-            cond: (type) => type === 'keymgmt',
-          },
-        },
-      },
-    },
-    connection: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-connection' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'displayConnection',
-      },
-    },
-    encryption: {
-      onEntry: [
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        { type: 'render', level: 'step', component: 'wizard/secrets-encryption' },
-      ],
-      on: {
-        CONTINUE: 'display',
-      },
-    },
-    credentials: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-credentials' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'display',
-      },
-    },
-    role: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-role' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'displayRole',
-      },
-    },
-    displayRole: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-display-role' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'credentials',
-      },
-    },
-    displayConnection: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-connection-show' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'displayRoleDatabase',
-      },
-    },
-    displayRoleDatabase: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-display-database-role' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'display',
-      },
-    },
-    secret: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-secret' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'display',
-      },
-    },
-    provider: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-keymgmt' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'displayProvider',
-      },
-    },
-    displayProvider: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-keymgmt' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'distribute',
-      },
-    },
-    distribute: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-keymgmt' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'display',
-      },
-    },
-    display: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-display' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        REPEAT: {
-          connection: {
-            cond: (type) => type === 'database',
-            actions: [{ type: 'routeTransition', params: ['vault.cluster.secrets.backend.create-root'] }],
-          },
-          role: {
-            cond: (type) => ['pki', 'aws', 'ssh'].includes(type),
-            actions: [{ type: 'routeTransition', params: ['vault.cluster.secrets.backend.create-root'] }],
-          },
-          secret: {
-            cond: (type) => ['kv'].includes(type),
-            actions: [{ type: 'routeTransition', params: ['vault.cluster.secrets.backend.create-root'] }],
-          },
-          encryption: {
-            cond: (type) => type === 'transit',
-            actions: [{ type: 'routeTransition', params: ['vault.cluster.secrets.backend.create-root'] }],
-          },
-          provider: {
-            cond: (type) => type === 'keymgmt',
-            actions: [
-              {
-                type: 'routeTransition',
-                params: [
-                  'vault.cluster.secrets.backend.create-root',
-                  { queryParams: { itemType: 'provider' } },
-                ],
-              },
-            ],
-          },
-        },
-      },
-    },
-    list: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/secrets-list' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'display',
-      },
-    },
-    error: {
-      onEntry: [
-        { type: 'render', level: 'step', component: 'wizard/tutorial-error' },
-        { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-      ],
-      on: {
-        CONTINUE: 'complete',
-      },
-    },
-    complete: {
-      onEntry: ['completeFeature'],
-    },
-  },
-};
diff --git a/ui/app/machines/tools-machine.js b/ui/app/machines/tools-machine.js
deleted file mode 100644
index 9c76ad8b797..00000000000
--- a/ui/app/machines/tools-machine.js
+++ /dev/null
@@ -1,65 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export default {
-  key: 'tools',
-  initial: 'wrap',
-  states: {
-    wrap: {
-      onEntry: [
-        { type: 'routeTransition', params: ['vault.cluster.tools'] },
-        { type: 'render', level: 'feature', component: 'wizard/tools-wrap' },
-      ],
-      on: {
-        CONTINUE: 'wrapped',
-      },
-    },
-    wrapped: {
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/tools-wrapped' }],
-      on: {
-        LOOKUP: 'lookup',
-      },
-    },
-    lookup: {
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/tools-lookup' }],
-      on: {
-        CONTINUE: 'info',
-      },
-    },
-    info: {
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/tools-info' }],
-      on: {
-        REWRAP: 'rewrap',
-      },
-    },
-    rewrap: {
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/tools-rewrap' }],
-      on: {
-        CONTINUE: 'rewrapped',
-      },
-    },
-    rewrapped: {
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/tools-rewrapped' }],
-      on: {
-        UNWRAP: 'unwrap',
-      },
-    },
-    unwrap: {
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/tools-unwrap' }],
-      on: {
-        CONTINUE: 'unwrapped',
-      },
-    },
-    unwrapped: {
-      onEntry: [{ type: 'render', level: 'feature', component: 'wizard/tools-unwrapped' }],
-      on: {
-        CONTINUE: 'complete',
-      },
-    },
-    complete: {
-      onEntry: ['completeFeature'],
-    },
-  },
-};
diff --git a/ui/app/machines/tutorial-machine.js b/ui/app/machines/tutorial-machine.js
deleted file mode 100644
index 03e8eddf8be..00000000000
--- a/ui/app/machines/tutorial-machine.js
+++ /dev/null
@@ -1,117 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export default {
-  key: 'tutorial',
-  initial: 'idle',
-  on: {
-    DISMISS: 'dismissed',
-    DONE: 'complete',
-    PAUSE: 'paused',
-  },
-  states: {
-    init: {
-      key: 'init',
-      initial: 'idle',
-      on: { INITDONE: 'active.select' },
-      onEntry: [
-        'showTutorialAlways',
-        { type: 'render', level: 'tutorial', component: 'wizard/tutorial-idle' },
-        { type: 'render', level: 'feature', component: null },
-      ],
-      onExit: ['showTutorialWhenAuthenticated', 'clearFeatureData'],
-      states: {
-        idle: {
-          on: {
-            START: 'active.setup',
-            SAVE: 'active.save',
-            UNSEAL: 'active.unseal',
-            LOGIN: 'active.login',
-          },
-        },
-        active: {
-          onEntry: { type: 'render', level: 'tutorial', component: 'wizard/tutorial-active' },
-          states: {
-            setup: {
-              on: { TOSAVE: 'save' },
-              onEntry: { type: 'render', level: 'feature', component: 'wizard/init-setup' },
-            },
-            save: {
-              on: {
-                TOUNSEAL: 'unseal',
-                TOLOGIN: 'login',
-              },
-              onEntry: { type: 'render', level: 'feature', component: 'wizard/init-save-keys' },
-            },
-            unseal: {
-              on: { TOLOGIN: 'login' },
-              onEntry: { type: 'render', level: 'feature', component: 'wizard/init-unseal' },
-            },
-            login: {
-              onEntry: { type: 'render', level: 'feature', component: 'wizard/init-login' },
-            },
-          },
-        },
-      },
-    },
-    active: {
-      key: 'feature',
-      initial: 'select',
-      onEntry: { type: 'render', level: 'tutorial', component: 'wizard/tutorial-active' },
-      states: {
-        select: {
-          on: {
-            CONTINUE: 'feature',
-          },
-          onEntry: { type: 'render', level: 'feature', component: 'wizard/features-selection' },
-        },
-        feature: {},
-      },
-    },
-    idle: {
-      on: {
-        INIT: 'init.idle',
-        AUTH: 'active.select',
-        CONTINUE: 'active',
-      },
-      onEntry: [
-        { type: 'render', level: 'feature', component: null },
-        { type: 'render', level: 'step', component: null },
-        { type: 'render', level: 'detail', component: null },
-        { type: 'render', level: 'tutorial', component: 'wizard/tutorial-idle' },
-      ],
-    },
-    dismissed: {
-      onEntry: [
-        { type: 'render', level: 'tutorial', component: null },
-        { type: 'render', level: 'feature', component: null },
-        { type: 'render', level: 'step', component: null },
-        { type: 'render', level: 'detail', component: null },
-        'handleDismissed',
-      ],
-    },
-    paused: {
-      on: {
-        CONTINUE: 'active.feature',
-      },
-      onEntry: [
-        { type: 'render', level: 'feature', component: null },
-        { type: 'render', level: 'step', component: null },
-        { type: 'render', level: 'detail', component: null },
-        { type: 'render', level: 'tutorial', component: 'wizard/tutorial-paused' },
-        'handlePaused',
-      ],
-      onExit: ['handleResume'],
-    },
-    complete: {
-      onEntry: [
-        { type: 'render', level: 'feature', component: null },
-        { type: 'render', level: 'step', component: null },
-        { type: 'render', level: 'detail', component: null },
-        { type: 'render', level: 'tutorial', component: 'wizard/tutorial-complete' },
-      ],
-    },
-  },
-};
diff --git a/ui/app/macros/identity-capabilities.js b/ui/app/macros/identity-capabilities.js
index dd2f37e1020..659dcd400e2 100644
--- a/ui/app/macros/identity-capabilities.js
+++ b/ui/app/macros/identity-capabilities.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/macros/lazy-capabilities.js b/ui/app/macros/lazy-capabilities.js
index 562d0431fe4..c36a7b14a50 100644
--- a/ui/app/macros/lazy-capabilities.js
+++ b/ui/app/macros/lazy-capabilities.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/macros/maybe-query-record.js b/ui/app/macros/maybe-query-record.js
index bbdb2a76412..6bb8b86e78c 100644
--- a/ui/app/macros/maybe-query-record.js
+++ b/ui/app/macros/maybe-query-record.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/mixins/backend-crumb.js b/ui/app/mixins/backend-crumb.js
index d2be6f4f0a9..ff0b712a346 100644
--- a/ui/app/mixins/backend-crumb.js
+++ b/ui/app/mixins/backend-crumb.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/mixins/cluster-route.js b/ui/app/mixins/cluster-route.js
index 80d3e78910d..5d948cc605f 100644
--- a/ui/app/mixins/cluster-route.js
+++ b/ui/app/mixins/cluster-route.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/mixins/focus-on-insert.js b/ui/app/mixins/focus-on-insert.js
index 1f250187071..1c97b18c990 100644
--- a/ui/app/mixins/focus-on-insert.js
+++ b/ui/app/mixins/focus-on-insert.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/mixins/key-mixin.js b/ui/app/mixins/key-mixin.js
index 069f9224de4..e6a38428024 100644
--- a/ui/app/mixins/key-mixin.js
+++ b/ui/app/mixins/key-mixin.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/mixins/model-boundary-route.js b/ui/app/mixins/model-boundary-route.js
index cae2ebea95e..3cd425839f5 100644
--- a/ui/app/mixins/model-boundary-route.js
+++ b/ui/app/mixins/model-boundary-route.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/mixins/unload-model-route.js b/ui/app/mixins/unload-model-route.js
index 7d9f8865839..bf74d2fb46e 100644
--- a/ui/app/mixins/unload-model-route.js
+++ b/ui/app/mixins/unload-model-route.js
@@ -1,14 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Mixin from '@ember/object/mixin';
 import removeRecord from 'vault/utils/remove-record';
+import { service } from '@ember/service';
 
 // removes Ember Data records from the cache when the model
 // changes or you move away from the current route
 export default Mixin.create({
+  store: service(),
   modelPath: 'model',
   unloadModel() {
     const { modelPath } = this;
diff --git a/ui/app/mixins/unsaved-model-route.js b/ui/app/mixins/unsaved-model-route.js
index 8944b1ddfd1..53b9a026fa2 100644
--- a/ui/app/mixins/unsaved-model-route.js
+++ b/ui/app/mixins/unsaved-model-route.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/mixins/with-nav-to-nearest-ancestor.js b/ui/app/mixins/with-nav-to-nearest-ancestor.js
deleted file mode 100644
index bc48036273a..00000000000
--- a/ui/app/mixins/with-nav-to-nearest-ancestor.js
+++ /dev/null
@@ -1,45 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Mixin from '@ember/object/mixin';
-import { task } from 'ember-concurrency';
-import { ancestorKeysForKey } from 'core/utils/key-utils';
-
-// This mixin is currently used in a controller and a component, but we
-// don't see cancellation of the task as the while loop runs in either
-
-// Controller in Ember are singletons so there's no cancellation there
-// during the loop. For components, it might be expected that the task would
-// be cancelled when we transitioned to a new route and a rerender occured, but this is not
-// the case since we are catching the error. Since Ember's route transitions are lazy
-// and we're catching any 404s, the loop continues until the transtion succeeds, or exhausts
-// the ancestors array and transitions to the root
-export default Mixin.create({
-  navToNearestAncestor: task(function* (key) {
-    const ancestors = ancestorKeysForKey(key);
-    let errored = false;
-    let nearest = ancestors.pop();
-    while (nearest) {
-      try {
-        const transition = this.transitionToRoute('vault.cluster.secrets.backend.list', nearest);
-        transition.data.isDeletion = true;
-        yield transition.promise;
-      } catch (e) {
-        // in the route error event handler, we're only throwing when it's a 404,
-        // other errors will be in the route and will not be caught, so the task will complete
-        errored = true;
-        nearest = ancestors.pop();
-      } finally {
-        if (!errored) {
-          nearest = null;
-          // eslint-disable-next-line
-          return;
-        }
-        errored = false;
-      }
-    }
-    yield this.transitionToRoute('vault.cluster.secrets.backend.list-root');
-  }),
-});
diff --git a/ui/app/models/auth-config.js b/ui/app/models/auth-config.js
deleted file mode 100644
index 95e726c8042..00000000000
--- a/ui/app/models/auth-config.js
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Model, { belongsTo } from '@ember-data/model';
-
-export default Model.extend({
-  backend: belongsTo('auth-method', { inverse: 'authConfigs', readOnly: true, async: false }),
-  getHelpUrl: function (backend) {
-    return `/v1/auth/${backend}/config?help=1`;
-  },
-});
diff --git a/ui/app/models/auth-config/approle.js b/ui/app/models/auth-config/approle.js
deleted file mode 100644
index a1b90981a32..00000000000
--- a/ui/app/models/auth-config/approle.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from '../auth-config';
-export default AuthConfig.extend({});
diff --git a/ui/app/models/auth-config/aws/client.js b/ui/app/models/auth-config/aws/client.js
deleted file mode 100644
index 725b6b86e3f..00000000000
--- a/ui/app/models/auth-config/aws/client.js
+++ /dev/null
@@ -1,35 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import AuthConfig from '../../auth-config';
-import fieldToAttrs from 'vault/utils/field-to-attrs';
-
-export default AuthConfig.extend({
-  secretKey: attr('string'),
-  accessKey: attr('string'),
-  endpoint: attr('string', {
-    label: 'EC2 Endpoint',
-  }),
-  iamEndpoint: attr('string', {
-    label: 'IAM Endpoint',
-  }),
-  stsEndpoint: attr('string', {
-    label: 'STS Endpoint',
-  }),
-  iamServerIdHeaderValue: attr('string', {
-    label: 'IAM Server ID Header Value',
-  }),
-
-  fieldGroups: computed(function () {
-    const groups = [
-      { default: ['accessKey', 'secretKey'] },
-      { 'AWS Options': ['endpoint', 'iamEndpoint', 'stsEndpoint', 'iamServerIdHeaderValue'] },
-    ];
-
-    return fieldToAttrs(this, groups);
-  }),
-});
diff --git a/ui/app/models/auth-config/aws/identity-accesslist.js b/ui/app/models/auth-config/aws/identity-accesslist.js
deleted file mode 100644
index 8a69a64784c..00000000000
--- a/ui/app/models/auth-config/aws/identity-accesslist.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Tidy from './tidy';
-export default Tidy.extend();
diff --git a/ui/app/models/auth-config/aws/roletag-denylist.js b/ui/app/models/auth-config/aws/roletag-denylist.js
deleted file mode 100644
index 8a69a64784c..00000000000
--- a/ui/app/models/auth-config/aws/roletag-denylist.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Tidy from './tidy';
-export default Tidy.extend();
diff --git a/ui/app/models/auth-config/aws/tidy.js b/ui/app/models/auth-config/aws/tidy.js
deleted file mode 100644
index 27c0d62545d..00000000000
--- a/ui/app/models/auth-config/aws/tidy.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import { expandAttributeMeta } from 'vault/utils/field-to-attrs';
-import AuthConfig from '../../auth-config';
-
-export default AuthConfig.extend({
-  safetyBuffer: attr({
-    defaultValue: '72h',
-    editType: 'ttl',
-  }),
-
-  disablePeriodicTidy: attr('boolean', {
-    defaultValue: false,
-  }),
-
-  attrs: computed(function () {
-    return expandAttributeMeta(this, ['safetyBuffer', 'disablePeriodicTidy']);
-  }),
-});
diff --git a/ui/app/models/auth-config/azure.js b/ui/app/models/auth-config/azure.js
deleted file mode 100644
index 338a451b1d2..00000000000
--- a/ui/app/models/auth-config/azure.js
+++ /dev/null
@@ -1,45 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import AuthConfig from '../auth-config';
-import { combineFieldGroups } from 'vault/utils/openapi-to-attrs';
-import fieldToAttrs from 'vault/utils/field-to-attrs';
-
-export default AuthConfig.extend({
-  useOpenAPI: true,
-  tenantId: attr('string', {
-    label: 'Tenant ID',
-    helpText: 'The tenant ID for the Azure Active Directory organization',
-  }),
-  resource: attr('string', {
-    helpText: 'The configured URL for the application registered in Azure Active Directory',
-  }),
-  clientId: attr('string', {
-    label: 'Client ID',
-    helpText:
-      'The client ID for credentials to query the Azure APIs. Currently read permissions to query compute resources are required.',
-  }),
-  clientSecret: attr('string', {
-    helpText: 'The client secret for credentials to query the Azure APIs',
-  }),
-
-  googleCertsEndpoint: attr('string'),
-
-  fieldGroups: computed('newFields', function () {
-    let groups = [
-      { default: ['tenantId', 'resource'] },
-      {
-        'Azure Options': ['clientId', 'clientSecret'],
-      },
-    ];
-    if (this.newFields) {
-      groups = combineFieldGroups(groups, this.newFields, []);
-    }
-
-    return fieldToAttrs(this, groups);
-  }),
-});
diff --git a/ui/app/models/auth-config/cert.js b/ui/app/models/auth-config/cert.js
deleted file mode 100644
index a1b90981a32..00000000000
--- a/ui/app/models/auth-config/cert.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from '../auth-config';
-export default AuthConfig.extend({});
diff --git a/ui/app/models/auth-config/gcp.js b/ui/app/models/auth-config/gcp.js
deleted file mode 100644
index f825fb21e98..00000000000
--- a/ui/app/models/auth-config/gcp.js
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import AuthConfig from '../auth-config';
-import { combineFieldGroups } from 'vault/utils/openapi-to-attrs';
-import fieldToAttrs from 'vault/utils/field-to-attrs';
-
-export default AuthConfig.extend({
-  useOpenAPI: true,
-  // We have to leave this here because the backend doesn't support the file type yet.
-  credentials: attr('string', {
-    editType: 'file',
-  }),
-
-  googleCertsEndpoint: attr('string'),
-
-  fieldGroups: computed('newFields', function () {
-    let groups = [
-      { default: ['credentials'] },
-      {
-        'Google Cloud Options': ['googleCertsEndpoint'],
-      },
-    ];
-    if (this.newFields) {
-      groups = combineFieldGroups(groups, this.newFields, []);
-    }
-    return fieldToAttrs(this, groups);
-  }),
-});
diff --git a/ui/app/models/auth-config/github.js b/ui/app/models/auth-config/github.js
deleted file mode 100644
index 675741c6814..00000000000
--- a/ui/app/models/auth-config/github.js
+++ /dev/null
@@ -1,32 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import AuthConfig from '../auth-config';
-import fieldToAttrs from 'vault/utils/field-to-attrs';
-import { combineFieldGroups } from 'vault/utils/openapi-to-attrs';
-
-export default AuthConfig.extend({
-  useOpenAPI: true,
-  organization: attr('string'),
-  baseUrl: attr('string', {
-    label: 'Base URL',
-  }),
-
-  fieldGroups: computed('newFields', function () {
-    let groups = [
-      { default: ['organization'] },
-      {
-        'GitHub Options': ['baseUrl'],
-      },
-    ];
-    if (this.newFields) {
-      groups = combineFieldGroups(groups, this.newFields, []);
-    }
-
-    return fieldToAttrs(this, groups);
-  }),
-});
diff --git a/ui/app/models/auth-config/jwt.js b/ui/app/models/auth-config/jwt.js
deleted file mode 100644
index 38b8d99ae65..00000000000
--- a/ui/app/models/auth-config/jwt.js
+++ /dev/null
@@ -1,100 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import AuthConfig from '../auth-config';
-import fieldToAttrs from 'vault/utils/field-to-attrs';
-import { combineFieldGroups } from 'vault/utils/openapi-to-attrs';
-
-export default AuthConfig.extend({
-  useOpenAPI: true,
-  oidcDiscoveryUrl: attr('string', {
-    label: 'OIDC discovery URL',
-    helpText:
-      'The OIDC discovery URL, without any .well-known component (base path). Cannot be used with jwt_validation_pubkeys',
-  }),
-
-  oidcClientId: attr('string', {
-    label: 'OIDC client ID',
-  }),
-
-  oidcClientSecret: attr('string', {
-    label: 'OIDC client secret',
-  }),
-
-  oidcDiscoveryCaPem: attr('string', {
-    label: 'OIDC discovery CA PEM',
-    editType: 'file',
-    helpText:
-      'The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used',
-  }),
-
-  jwksCaPem: attr('string', {
-    label: 'JWKS CA PEM',
-    editType: 'file',
-  }),
-
-  jwksUrl: attr('string', {
-    label: 'JWKS URL',
-  }),
-
-  jwksPairs: attr({
-    label: 'JWKS pairs',
-    // This attribute is not shown in the UI
-  }),
-
-  oidcResponseMode: attr('string', {
-    label: 'OIDC response mode',
-  }),
-
-  oidcResponseTypes: attr('string', {
-    label: 'OIDC response types',
-  }),
-
-  jwtValidationPubkeys: attr({
-    label: 'JWT validation public keys',
-    editType: 'stringArray',
-  }),
-
-  jwtSupportedAlgs: attr({
-    label: 'JWT supported algorithms',
-  }),
-
-  boundIssuer: attr('string', {
-    helpText: 'The value against which to match the iss claim in a JWT',
-  }),
-
-  fieldGroups: computed('constructor.modelName', 'newFields', function () {
-    const type = this.constructor.modelName.split('/')[1].toUpperCase();
-    let groups = [
-      {
-        default: [
-          'oidcDiscoveryUrl',
-          'defaultRole',
-          'jwksCaPem',
-          'jwksUrl',
-          'oidcResponseMode',
-          'oidcResponseTypes',
-        ],
-      },
-      {
-        [`${type} Options`]: [
-          'oidcClientId',
-          'oidcClientSecret',
-          'oidcDiscoveryCaPem',
-          'jwtValidationPubkeys',
-          'jwtSupportedAlgs',
-          'boundIssuer',
-        ],
-      },
-    ];
-
-    if (this.newFields) {
-      groups = combineFieldGroups(groups, this.newFields, []);
-    }
-    return fieldToAttrs(this, groups);
-  }),
-});
diff --git a/ui/app/models/auth-config/kubernetes.js b/ui/app/models/auth-config/kubernetes.js
deleted file mode 100644
index 283cff8ff76..00000000000
--- a/ui/app/models/auth-config/kubernetes.js
+++ /dev/null
@@ -1,50 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-
-import AuthConfig from '../auth-config';
-import { combineFieldGroups } from 'vault/utils/openapi-to-attrs';
-import fieldToAttrs from 'vault/utils/field-to-attrs';
-
-export default AuthConfig.extend({
-  useOpenAPI: true,
-  kubernetesHost: attr('string', {
-    helpText:
-      'Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server',
-  }),
-
-  kubernetesCaCert: attr('string', {
-    editType: 'file',
-    helpText: 'PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API',
-  }),
-
-  tokenReviewerJwt: attr('string', {
-    helpText:
-      'A service account JWT used to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API',
-  }),
-  useAnnotationsAsAliasMetadata: attr('boolean'),
-
-  pemKeys: attr({
-    editType: 'stringArray',
-  }),
-
-  fieldGroups: computed('newFields', function () {
-    let groups = [
-      {
-        default: ['kubernetesHost', 'kubernetesCaCert'],
-      },
-      {
-        'Kubernetes Options': ['tokenReviewerJwt', 'pemKeys', 'useAnnotationsAsAliasMetadata'],
-      },
-    ];
-    if (this.newFields) {
-      groups = combineFieldGroups(groups, this.newFields, []);
-    }
-
-    return fieldToAttrs(this, groups);
-  }),
-});
diff --git a/ui/app/models/auth-config/ldap.js b/ui/app/models/auth-config/ldap.js
deleted file mode 100644
index fc7261a0b5a..00000000000
--- a/ui/app/models/auth-config/ldap.js
+++ /dev/null
@@ -1,52 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-
-import AuthConfig from '../auth-config';
-import fieldToAttrs from 'vault/utils/field-to-attrs';
-import { combineFieldGroups } from 'vault/utils/openapi-to-attrs';
-
-export default AuthConfig.extend({
-  useOpenAPI: true,
-  certificate: attr({
-    label: 'Certificate',
-    editType: 'file',
-  }),
-  fieldGroups: computed('newFields', function () {
-    let groups = [
-      {
-        default: ['url'],
-      },
-      {
-        'LDAP Options': [
-          'starttls',
-          'insecureTls',
-          'discoverdn',
-          'denyNullBind',
-          'tlsMinVersion',
-          'tlsMaxVersion',
-          'certificate',
-          'clientTlsCert',
-          'clientTlsKey',
-          'userattr',
-          'upndomain',
-          'anonymousGroupSearch',
-        ],
-      },
-      {
-        'Customize User Search': ['binddn', 'userdn', 'bindpass', 'userfilter'],
-      },
-      {
-        'Customize Group Membership Search': ['groupfilter', 'groupattr', 'groupdn', 'useTokenGroups'],
-      },
-    ];
-    if (this.newFields) {
-      groups = combineFieldGroups(groups, this.newFields, []);
-    }
-    return fieldToAttrs(this, groups);
-  }),
-});
diff --git a/ui/app/models/auth-config/oidc.js b/ui/app/models/auth-config/oidc.js
deleted file mode 100644
index 5f7a39561d6..00000000000
--- a/ui/app/models/auth-config/oidc.js
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export { default } from './jwt';
diff --git a/ui/app/models/auth-config/okta.js b/ui/app/models/auth-config/okta.js
deleted file mode 100644
index 11a18b1e0a3..00000000000
--- a/ui/app/models/auth-config/okta.js
+++ /dev/null
@@ -1,46 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import AuthConfig from '../auth-config';
-import fieldToAttrs from 'vault/utils/field-to-attrs';
-import { combineFieldGroups } from 'vault/utils/openapi-to-attrs';
-
-export default AuthConfig.extend({
-  useOpenAPI: true,
-  orgName: attr('string', {
-    helpText: 'Name of the organization to be used in the Okta API',
-  }),
-  apiToken: attr('string', {
-    helpText:
-      'Okta API token. This is required to query Okta for user group membership. If this is not supplied only locally configured groups will be enabled.',
-  }),
-  baseUrl: attr('string', {
-    helpText:
-      'If set, will be used as the base domain for API requests. Examples are okta.com, oktapreview.com, and okta-emea.com',
-  }),
-  bypassOktaMfa: attr('boolean', {
-    defaultValue: false,
-    helpText:
-      "Useful if using Vault's built-in MFA mechanisms. Will also cause certain other statuses to be ignored, such as PASSWORD_EXPIRED",
-  }),
-
-  fieldGroups: computed('newFields', function () {
-    let groups = [
-      {
-        default: ['orgName'],
-      },
-      {
-        Options: ['apiToken', 'baseUrl', 'bypassOktaMfa'],
-      },
-    ];
-    if (this.newFields) {
-      groups = combineFieldGroups(groups, this.newFields, []);
-    }
-
-    return fieldToAttrs(this, groups);
-  }),
-});
diff --git a/ui/app/models/auth-config/radius.js b/ui/app/models/auth-config/radius.js
deleted file mode 100644
index c38d1fbdc43..00000000000
--- a/ui/app/models/auth-config/radius.js
+++ /dev/null
@@ -1,32 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import AuthConfig from '../auth-config';
-import { combineFieldGroups } from 'vault/utils/openapi-to-attrs';
-import fieldToAttrs from 'vault/utils/field-to-attrs';
-
-export default AuthConfig.extend({
-  useOpenAPI: true,
-  host: attr('string'),
-  secret: attr('string'),
-
-  fieldGroups: computed('newFields', function () {
-    let groups = [
-      {
-        default: ['host', 'secret'],
-      },
-      {
-        'RADIUS Options': ['port', 'nasPort', 'nasIdentifier', 'dialTimeout', 'unregisteredUserPolicies'],
-      },
-    ];
-    if (this.newFields) {
-      groups = combineFieldGroups(groups, this.newFields, []);
-    }
-
-    return fieldToAttrs(this, groups);
-  }),
-});
diff --git a/ui/app/models/auth-config/userpass.js b/ui/app/models/auth-config/userpass.js
deleted file mode 100644
index a1b90981a32..00000000000
--- a/ui/app/models/auth-config/userpass.js
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AuthConfig from '../auth-config';
-export default AuthConfig.extend({});
diff --git a/ui/app/models/auth-method.js b/ui/app/models/auth-method.js
deleted file mode 100644
index 32370df56c4..00000000000
--- a/ui/app/models/auth-method.js
+++ /dev/null
@@ -1,140 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Model, { belongsTo, hasMany, attr } from '@ember-data/model';
-import { service } from '@ember/service';
-import fieldToAttrs, { expandAttributeMeta } from 'vault/utils/field-to-attrs';
-import apiPath from 'vault/utils/api-path';
-import { withModelValidations } from 'vault/decorators/model-validations';
-import { allMethods } from 'vault/helpers/mountable-auth-methods';
-import lazyCapabilities from 'vault/macros/lazy-capabilities';
-import { action } from '@ember/object';
-
-const validations = {
-  path: [
-    { type: 'presence', message: "Path can't be blank." },
-    {
-      type: 'containsWhiteSpace',
-      message:
-        "Path contains whitespace. If this is desired, you'll need to encode it with %20 in API requests.",
-      level: 'warn',
-    },
-  ],
-};
-
-@withModelValidations(validations)
-export default class AuthMethodModel extends Model {
-  @service store;
-
-  @belongsTo('mount-config', { async: false, inverse: null }) config; // one-to-none that replaces former fragment
-  @hasMany('auth-config', { polymorphic: true, inverse: 'backend', async: false }) authConfigs;
-  @attr('string') path;
-  @attr('string') accessor;
-  @attr('string') name;
-  @attr('string') type;
-  // namespaces introduced types with a `ns_` prefix for built-in engines
-  // so we need to strip that to normalize the type
-  get methodType() {
-    return this.type.replace(/^ns_/, '');
-  }
-  get icon() {
-    const authMethods = allMethods().find((backend) => backend.type === this.methodType);
-
-    return authMethods?.glyph || 'users';
-  }
-  @attr('string', {
-    editType: 'textarea',
-  })
-  description;
-  @attr('boolean', {
-    helpText:
-      'When Replication is enabled, a local mount will not be replicated across clusters. This can only be specified at mount time.',
-  })
-  local;
-  @attr('boolean', {
-    helpText:
-      'When enabled - if a seal supporting seal wrapping is specified in the configuration, all critical security parameters (CSPs) in this backend will be seal wrapped. (For KV mounts, all values will be seal wrapped.) This can only be specified at mount time.',
-  })
-  sealWrap;
-
-  // used when the `auth` prefix is important,
-  // currently only when setting perf mount filtering
-  get apiPath() {
-    return `auth/${this.path}`;
-  }
-  get localDisplay() {
-    return this.local ? 'local' : 'replicated';
-  }
-
-  get tuneAttrs() {
-    const { methodType } = this;
-    let tuneAttrs;
-    // token_type should not be tuneable for the token auth method
-    if (methodType === 'token') {
-      tuneAttrs = [
-        'description',
-        'config.{listingVisibility,defaultLeaseTtl,maxLeaseTtl,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders}',
-      ];
-    } else {
-      tuneAttrs = [
-        'description',
-        'config.{listingVisibility,defaultLeaseTtl,maxLeaseTtl,tokenType,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders}',
-      ];
-    }
-    return expandAttributeMeta(this, tuneAttrs);
-  }
-
-  get formFields() {
-    return [
-      'type',
-      'path',
-      'description',
-      'accessor',
-      'local',
-      'sealWrap',
-      'config.{listingVisibility,defaultLeaseTtl,maxLeaseTtl,tokenType,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders}',
-    ];
-  }
-
-  get formFieldGroups() {
-    return [
-      { default: ['path'] },
-      {
-        'Method Options': [
-          'description',
-          'config.listingVisibility',
-          'local',
-          'sealWrap',
-          'config.{defaultLeaseTtl,maxLeaseTtl,tokenType,auditNonHmacRequestKeys,auditNonHmacResponseKeys,passthroughRequestHeaders}',
-        ],
-      },
-    ];
-  }
-
-  get attrs() {
-    return expandAttributeMeta(this, this.formFields);
-  }
-
-  get fieldGroups() {
-    return fieldToAttrs(this, this.formFieldGroups);
-  }
-  @lazyCapabilities(apiPath`sys/auth/${'id'}`, 'id') deletePath;
-  @lazyCapabilities(apiPath`auth/${'id'}/config`, 'id') configPath;
-  @lazyCapabilities(apiPath`auth/${'id'}/config/client`, 'id') awsConfigPath;
-  get canDisable() {
-    return this.deletePath.get('canDelete') !== false;
-  }
-  get canEdit() {
-    return this.configPath.get('canUpdate') !== false;
-  }
-  get canEditAws() {
-    return this.awsConfigPath.get('canUpdate') !== false;
-  }
-
-  @action
-  tune(data) {
-    return this.store.adapterFor('auth-method').tune(this.path, data);
-  }
-}
diff --git a/ui/app/models/aws-credential.js b/ui/app/models/aws-credential.js
index 3dccb192b20..7ba0d74d728 100644
--- a/ui/app/models/aws-credential.js
+++ b/ui/app/models/aws-credential.js
@@ -1,11 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Model, { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import { expandAttributeMeta } from 'vault/utils/field-to-attrs';
+import { withExpandedAttributes } from 'vault/decorators/model-expanded-attributes';
+
 const CREDENTIAL_TYPES = [
   {
     value: 'iam_user',
@@ -25,56 +25,46 @@ const CREDENTIAL_TYPES = [
   },
 ];
 
-const DISPLAY_FIELDS = ['accessKey', 'secretKey', 'securityToken', 'leaseId', 'renewable', 'leaseDuration'];
-export default Model.extend({
-  helpText:
-    'For Vault roles of credential type iam_user, there are no inputs, just submit the form. Choose a type to change the input options.',
-  role: attr('object', {
+@withExpandedAttributes()
+export default class AwsCredential extends Model {
+  @attr('object', {
     readOnly: true,
-  }),
+  })
+  role;
 
-  credentialType: attr('string', {
+  @attr('string', {
     defaultValue: 'iam_user',
     possibleValues: CREDENTIAL_TYPES,
     readOnly: true,
-  }),
+  })
+  credentialType;
 
-  roleArn: attr('string', {
+  @attr('string', {
     label: 'Role ARN',
     helpText:
       'The ARN of the role to assume if credential_type on the Vault role is assumed_role. Optional if the role has a single role ARN; required otherwise.',
-  }),
+  })
+  roleArn;
 
-  ttl: attr({
+  @attr({
     editType: 'ttl',
     defaultValue: '3600s',
     setDefault: true,
+    ttlOffValue: '',
     label: 'TTL',
     helpText:
       'Specifies the TTL for the use of the STS token. Valid only when credential_type is assumed_role, federation_token, or session_token.',
-  }),
-  leaseId: attr('string'),
-  renewable: attr('boolean'),
-  leaseDuration: attr('number'),
-  accessKey: attr('string'),
-  secretKey: attr('string'),
-  securityToken: attr('string'),
+  })
+  ttl;
 
-  attrs: computed('credentialType', 'accessKey', 'securityToken', function () {
-    const type = this.credentialType;
-    const fieldsForType = {
-      iam_user: ['credentialType'],
-      assumed_role: ['credentialType', 'ttl', 'roleArn'],
-      federation_token: ['credentialType', 'ttl'],
-      session_token: ['ttl'],
-    };
-    if (this.accessKey || this.securityToken) {
-      return expandAttributeMeta(this, DISPLAY_FIELDS.slice(0));
-    }
-    return expandAttributeMeta(this, fieldsForType[type].slice(0));
-  }),
+  @attr('string') leaseId;
+  @attr('boolean') renewable;
+  @attr('number') leaseDuration;
+  @attr('string') accessKey;
+  @attr('string', { masked: true }) secretKey;
+  @attr('string', { masked: true }) securityToken;
 
-  toCreds: computed('accessKey', 'secretKey', 'securityToken', 'leaseId', function () {
+  get toCreds() {
     const props = {
       accessKey: this.accessKey,
       secretKey: this.secretKey,
@@ -89,5 +79,5 @@ export default Model.extend({
       return ret;
     }, {});
     return JSON.stringify(propsWithVals, null, 2);
-  }),
-});
+  }
+}
diff --git a/ui/app/models/capabilities.js b/ui/app/models/capabilities.js
index 139d4f194e9..ba1255277ac 100644
--- a/ui/app/models/capabilities.js
+++ b/ui/app/models/capabilities.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -47,12 +47,13 @@ const computedCapability = function (capability) {
 export default Model.extend({
   path: attr('string'),
   capabilities: attr('array'),
-  canSudo: computedCapability('sudo'),
-  canRead: computedCapability('read'),
+  allowedParameters: attr(),
+  deniedParameters: attr(),
   canCreate: computedCapability('create'),
-  canUpdate: computedCapability('update'),
   canDelete: computedCapability('delete'),
   canList: computedCapability('list'),
-  allowedParameters: attr(),
-  deniedParameters: attr(),
+  canPatch: computedCapability('patch'),
+  canRead: computedCapability('read'),
+  canSudo: computedCapability('sudo'),
+  canUpdate: computedCapability('update'),
 });
diff --git a/ui/app/models/clients/activity.js b/ui/app/models/clients/activity.js
index d5046f64942..585d47fb642 100644
--- a/ui/app/models/clients/activity.js
+++ b/ui/app/models/clients/activity.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/clients/config.js b/ui/app/models/clients/config.js
index 801855d791a..c9020abfcfb 100644
--- a/ui/app/models/clients/config.js
+++ b/ui/app/models/clients/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,6 +15,10 @@ const validations = {
       message: (model) =>
         `Retention period must be greater than or equal to ${model.minimumRetentionMonths}.`,
     },
+    {
+      validator: (model) => parseInt(model.retentionMonths) <= 60,
+      message: 'Retention period must be less than or equal to 60.',
+    },
   ],
 };
 
@@ -31,8 +35,10 @@ export default class ClientsConfigModel extends Model {
 
   @attr('number') minimumRetentionMonths;
 
+  // refers specifically to the activitylog and will always be on for enterprise
   @attr('string') enabled;
 
+  // reporting_enabled is for automated reporting and only true of the customer hasn’t opted-out of automated license reporting
   @attr('boolean') reportingEnabled;
 
   @attr('date') billingStartTimestamp;
diff --git a/ui/app/models/clients/version-history.js b/ui/app/models/clients/version-history.js
index ea1f7f19719..15b48d005f1 100644
--- a/ui/app/models/clients/version-history.js
+++ b/ui/app/models/clients/version-history.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/cluster.js b/ui/app/models/cluster.js
index 3ea6ec2ef15..3eee7620c0c 100644
--- a/ui/app/models/cluster.js
+++ b/ui/app/models/cluster.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/config-ui/message.js b/ui/app/models/config-ui/message.js
deleted file mode 100644
index fdab790b54b..00000000000
--- a/ui/app/models/config-ui/message.js
+++ /dev/null
@@ -1,148 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-import Model, { attr } from '@ember-data/model';
-import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
-import { isAfter, addDays, startOfDay, parseISO, isBefore } from 'date-fns';
-import { withModelValidations } from 'vault/decorators/model-validations';
-import { withFormFields } from 'vault/decorators/model-form-fields';
-
-const validations = {
-  title: [{ type: 'presence', message: 'Title is required.' }],
-  message: [{ type: 'presence', message: 'Message is required.' }],
-  link: [
-    {
-      validator(model) {
-        if (!model?.link) return true;
-        const [title] = Object.keys(model.link);
-        const [href] = Object.values(model.link);
-        return title || href ? !!(title && href) : true;
-      },
-      message: 'Link title and url are required.',
-    },
-  ],
-  startTime: [
-    {
-      validator(model) {
-        if (!model.endTime) return true;
-        const start = new Date(model.startTime);
-        const end = new Date(model.endTime);
-        return isBefore(start, end);
-      },
-      message: 'Start time is after end time.',
-    },
-  ],
-  endTime: [
-    {
-      validator(model) {
-        if (!model.endTime) return true;
-        const start = new Date(model.startTime);
-        const end = new Date(model.endTime);
-        return isAfter(end, start);
-      },
-      message: 'End time is before start time.',
-    },
-  ],
-};
-
-@withModelValidations(validations)
-@withFormFields(['authenticated', 'type', 'title', 'message', 'link', 'startTime', 'endTime'])
-export default class MessageModel extends Model {
-  @attr('boolean') active;
-  @attr('string', {
-    label: 'Type',
-    editType: 'radio',
-    possibleValues: [
-      {
-        label: 'Alert message',
-        subText:
-          'A banner that appears on the top of every page to display brief but high-signal messages like an update or system alert.',
-        value: 'banner',
-      },
-      {
-        label: 'Modal',
-        subText: 'A pop-up window used to bring immediate attention for important notifications or actions.',
-        value: 'modal',
-      },
-    ],
-    defaultValue: 'banner',
-  })
-  type;
-  // The authenticated attr is a boolean. The authenticatedString getter and setter is used only in forms to get and set the boolean via
-  // strings values. The server and query params expects the attr to be boolean values.
-  @attr({
-    label: 'Where should we display this message?',
-    editType: 'radio',
-    fieldValue: 'authenticatedString',
-    possibleValues: [
-      {
-        label: 'After the user logs in',
-        subText: 'Display to users after they have successfully logged in to Vault.',
-        value: 'authenticated',
-      },
-      {
-        label: 'On the login page',
-        subText: 'Display to users on the login page before they have authenticated.',
-        value: 'unauthenticated',
-      },
-    ],
-    defaultValue: true,
-  })
-  authenticated;
-
-  get authenticatedString() {
-    return this.authenticated ? 'authenticated' : 'unauthenticated';
-  }
-
-  set authenticatedString(value) {
-    this.authenticated = value === 'authenticated' ? true : false;
-  }
-
-  @attr('string')
-  title;
-  @attr('string', {
-    editType: 'textarea',
-  })
-  message;
-  @attr('dateTimeLocal', {
-    editType: 'dateTimeLocal',
-    label: 'Message starts',
-    subText: 'Defaults to 12:00 a.m. the following day (local timezone).',
-    defaultValue: addDays(startOfDay(new Date()), 1).toISOString(),
-  })
-  startTime;
-  @attr('dateTimeLocal', { editType: 'yield', label: 'Message expires' }) endTime;
-
-  @attr('object', {
-    editType: 'kv',
-    keyPlaceholder: 'Display text (e.g. Learn more)',
-    valuePlaceholder: 'Link URL (e.g. https://www.hashicorp.com/)',
-    label: 'Link (optional)',
-    isSingleRow: true,
-    allowWhiteSpace: true,
-  })
-  link;
-
-  // date helpers
-  get isStartTimeAfterToday() {
-    return isAfter(parseISO(this.startTime), new Date());
-  }
-
-  // capabilities
-  @lazyCapabilities(apiPath`sys/config/ui/custom-messages`) customMessagesPath;
-  @lazyCapabilities(apiPath`sys/config/ui/custom-messages/${'id'}`, 'id') customMessagePath;
-
-  get canCreateCustomMessages() {
-    return this.customMessagesPath.get('canCreate') !== false;
-  }
-  get canReadCustomMessages() {
-    return this.customMessagePath.get('canRead') !== false;
-  }
-  get canEditCustomMessages() {
-    return this.customMessagePath.get('canUpdate') !== false;
-  }
-  get canDeleteCustomMessages() {
-    return this.customMessagePath.get('canDelete') !== false;
-  }
-}
diff --git a/ui/app/models/control-group-config.js b/ui/app/models/control-group-config.js
index 477ea3eccaf..0346323a90b 100644
--- a/ui/app/models/control-group-config.js
+++ b/ui/app/models/control-group-config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/control-group.js b/ui/app/models/control-group.js
index b84974feed3..cfbf03ca6dc 100644
--- a/ui/app/models/control-group.js
+++ b/ui/app/models/control-group.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/database/connection.js b/ui/app/models/database/connection.js
index fc1a595bcc4..c29bef88b98 100644
--- a/ui/app/models/database/connection.js
+++ b/ui/app/models/database/connection.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,8 @@ import { computed } from '@ember/object';
 import { alias, or } from '@ember/object/computed';
 import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
 import fieldToAttrs, { expandAttributeMeta } from 'vault/utils/field-to-attrs';
-import { AVAILABLE_PLUGIN_TYPES } from '../../utils/database-helpers';
+import { AVAILABLE_PLUGIN_TYPES } from '../../utils/model-helpers/database-helpers';
+import { service } from '@ember/service';
 
 /**
  * fieldsToGroups helper fn
@@ -31,6 +32,8 @@ const fieldsToGroups = function (arr, key = 'subgroup') {
 };
 
 export default Model.extend({
+  version: service(),
+
   backend: attr('string', {
     readOnly: true,
   }),
@@ -77,6 +80,11 @@ export default Model.extend({
     subText: 'The password to use when connecting with the above username.',
     editType: 'password',
   }),
+  disable_escaping: attr('boolean', {
+    defaultValue: false,
+    subText: 'Turns off the escaping of special characters inside of the username and password fields.',
+    docLink: '/vault/docs/secrets/databases#disable-character-escaping',
+  }),
 
   // optional
   ca_cert: attr('string', {
@@ -125,16 +133,59 @@ export default Model.extend({
     label: 'Disable SSL verification',
     defaultValue: false,
   }),
+  password_authentication: attr('string', {
+    defaultValue: 'password',
+    editType: 'radio',
+    subText: 'The default is "password."',
+    possibleValues: [
+      {
+        value: 'password',
+        helpText:
+          'Passwords will be sent to PostgreSQL in plaintext format and may appear in PostgreSQL logs as-is.',
+      },
+      {
+        value: 'scram-sha-256',
+        helpText:
+          'When set to "scram-sha-256", passwords will be hashed by Vault and stored as-is by PostgreSQL. Using "scram-sha-256" requires a minimum version of PostgreSQL 10.',
+      },
+    ],
+    docLink: '/vault/api-docs/secret/databases/postgresql#password_authentication',
+  }),
+  auth_type: attr('string', {
+    subText: 'If set to "gcp_iam", will enable IAM authentication to a Google CloudSQL instance.',
+    docLink: '/vault/api-docs/secret/databases/postgresql#auth_type',
+  }),
+  service_account_json: attr('string', {
+    label: 'Service account JSON',
+    subText:
+      'JSON encoded credentials for a GCP Service Account to use for IAM authentication. Requires "auth_type" to be "gcp_iam".',
+    editType: 'file',
+  }),
+  use_private_ip: attr('boolean', {
+    label: 'Use private IP',
+    subText:
+      'Enables the option to connect to CloudSQL Instances with Private IP. Requires auth_type to be "gcp_iam".',
+    defaultValue: false,
+  }),
+  private_key: attr('string', {
+    helpText: 'The secret key used for the x509 client certificate. Must be PEM encoded.',
+    editType: 'file',
+  }),
   tls: attr('string', {
     label: 'TLS Certificate Key',
     helpText:
       'x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.',
     editType: 'file',
   }),
+  tls_certificate: attr('string', {
+    label: 'TLS Certificate Key',
+    helpText: 'The x509 certificate for connecting to the database. Must be PEM encoded.',
+    editType: 'file',
+  }),
   tls_ca: attr('string', {
     label: 'TLS CA',
     helpText:
-      'x509 CA file for validating the certificate presented by the MongoDB server. Must be PEM encoded.',
+      'x509 CA file for validating the certificate presented by the database server. Must be PEM encoded.',
     editType: 'file',
   }),
   tls_server_name: attr('string', {
@@ -147,25 +198,37 @@ export default Model.extend({
     defaultShown: 'Default',
   }),
 
+  // ENTERPRISE ONLY
+  skip_static_role_rotation_import: attr({
+    editType: 'toggleButton',
+    label: 'Rotate static roles immediately',
+    helperTextEnabled: 'Vault automatically rotates static roles upon their initial creation.',
+    helperTextDisabled: 'Vault will not automatically rotate static role passwords upon creation.',
+    defaultValue: false,
+    isOppositeValue: true,
+  }),
+
+  self_managed: attr('boolean', {
+    subText:
+      'Allows onboarding static roles with a rootless connection configuration. Mutually exclusive with username and password. If true, will force verify_connection to be false.',
+    defaultValue: false,
+  }),
+
   isAvailablePlugin: computed('plugin_name', function () {
     return !!AVAILABLE_PLUGIN_TYPES.find((a) => a.value === this.plugin_name);
   }),
 
   showAttrs: computed('plugin_name', function () {
-    const fields = AVAILABLE_PLUGIN_TYPES.find((a) => a.value === this.plugin_name)
-      .fields.filter((f) => f.show !== false)
-      .map((f) => f.attr);
+    const fields = this._filterFields((f) => f.show !== false).map((f) => f.attr);
     fields.push('allowed_roles');
     return expandAttributeMeta(this, fields);
   }),
 
+  // for both create and edit fields
   fieldAttrs: computed('plugin_name', function () {
-    // for both create and edit fields
     let fields = ['plugin_name', 'name', 'connection_url', 'verify_connection', 'password_policy'];
     if (this.plugin_name) {
-      fields = AVAILABLE_PLUGIN_TYPES.find((a) => a.value === this.plugin_name)
-        .fields.filter((f) => !f.group)
-        .map((field) => field.attr);
+      fields = this._filterFields((f) => !f.group).map((f) => f.attr);
     }
     return expandAttributeMeta(this, fields);
   }),
@@ -174,9 +237,7 @@ export default Model.extend({
     if (!this.plugin_name) {
       return null;
     }
-    const pluginFields = AVAILABLE_PLUGIN_TYPES.find((a) => a.value === this.plugin_name).fields.filter(
-      (f) => f.group === 'pluginConfig'
-    );
+    const pluginFields = this._filterFields((f) => f.group === 'pluginConfig');
     const groups = fieldsToGroups(pluginFields, 'subgroup');
     return fieldToAttrs(this, groups);
   }),
@@ -185,12 +246,21 @@ export default Model.extend({
     if (!this.plugin_name) {
       return expandAttributeMeta(this, ['root_rotation_statements']);
     }
-    const fields = AVAILABLE_PLUGIN_TYPES.find((a) => a.value === this.plugin_name)
-      .fields.filter((f) => f.group === 'statements')
-      .map((field) => field.attr);
+    const fields = this._filterFields((f) => f.group === 'statements').map((f) => f.attr);
     return expandAttributeMeta(this, fields);
   }),
 
+  // after checking for enterprise, filter callback fires and returns
+  _filterFields(filterCallback) {
+    const plugin = AVAILABLE_PLUGIN_TYPES.find((a) => a.value === this.plugin_name);
+    return plugin.fields.filter((field) => {
+      // return if attribute is enterprise only and we're on community
+      if (field?.isEnterprise && !this.version.isEnterprise) return false;
+      // filter by group, or if there isn't a group
+      return filterCallback(field);
+    });
+  },
+
   /* CAPABILITIES */
   editConnectionPath: lazyCapabilities(apiPath`${'backend'}/config/${'id'}`, 'backend', 'id'),
   canEdit: alias('editConnectionPath.canUpdate'),
diff --git a/ui/app/models/database/credential.js b/ui/app/models/database/credential.js
index 6512ac941b3..59faad59653 100644
--- a/ui/app/models/database/credential.js
+++ b/ui/app/models/database/credential.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/database/role.js b/ui/app/models/database/role.js
index cbf1facfdb7..517a094f7a4 100644
--- a/ui/app/models/database/role.js
+++ b/ui/app/models/database/role.js
@@ -1,22 +1,39 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
-
 import Model, { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import { alias } from '@ember/object/computed';
+import { service } from '@ember/service';
 import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
+import { getRoleFields } from 'vault/utils/model-helpers/database-helpers';
 import { expandAttributeMeta } from 'vault/utils/field-to-attrs';
-import { getRoleFields } from 'vault/utils/database-helpers';
-
-export default Model.extend({
-  idPrefix: 'role/',
-  backend: attr('string', { readOnly: true }),
-  name: attr('string', {
-    label: 'Role name',
-  }),
-  database: attr('array', {
+import { withModelValidations } from 'vault/decorators/model-validations';
+const validations = {
+  name: [{ type: 'presence', message: 'Role name is required.' }],
+  database: [{ type: 'presence', message: 'Database is required.' }],
+  type: [{ type: 'presence', message: 'Type is required.' }],
+  username: [
+    {
+      validator(model) {
+        const { type, username } = model;
+        if (!type || type === 'dynamic') return true;
+        if (username) return true;
+      },
+      message: 'Username is required.',
+    },
+  ],
+};
+@withModelValidations(validations)
+export default class RoleModel extends Model {
+  @service version;
+
+  idPrefix = 'role/';
+
+  @attr('string', { readOnly: true }) backend;
+
+  @attr('string', { label: 'Role name' }) name;
+
+  @attr('array', {
     label: 'Connection name',
     editType: 'searchSelect',
     fallbackComponent: 'string-list',
@@ -24,75 +41,114 @@ export default Model.extend({
     selectLimit: 1,
     onlyAllowExisting: true,
     subText: 'The database connection for which credentials will be generated.',
-  }),
-  type: attr('string', {
+  })
+  database;
+
+  @attr('string', {
     label: 'Type of role',
     noDefault: true,
     possibleValues: ['static', 'dynamic'],
-  }),
-  default_ttl: attr({
+  })
+  type;
+
+  @attr({
     editType: 'ttl',
     defaultValue: '1h',
     label: 'Generated credentials’s Time-to-Live (TTL)',
     helperTextDisabled: 'Vault will use a TTL of 1 hour.',
     defaultShown: 'Engine default',
-  }),
-  max_ttl: attr({
+  })
+  default_ttl;
+
+  @attr({
     editType: 'ttl',
     defaultValue: '24h',
     label: 'Generated credentials’s maximum Time-to-Live (Max TTL)',
     helperTextDisabled: 'Vault will use a TTL of 24 hours.',
     defaultShown: 'Engine default',
-  }),
-  username: attr('string', {
-    subText: 'The database username that this Vault role corresponds to.',
-  }),
-  rotation_period: attr({
+  })
+  max_ttl;
+
+  @attr('string', { subText: 'The database username that this Vault role corresponds to.' }) username;
+
+  @attr({
     editType: 'ttl',
     defaultValue: '24h',
     helperTextDisabled:
       'Specifies the amount of time Vault should wait before rotating the password. The minimum is 5 seconds. Default is 24 hours.',
-    helperTextEnabled: 'Vault will rotate password after',
-  }),
-  creation_statements: attr('array', {
+    helperTextEnabled: 'Vault will rotate password after.',
+  })
+  rotation_period;
+
+  @attr('array', {
     editType: 'stringArray',
-  }),
-  revocation_statements: attr('array', {
+  })
+  creation_statements;
+
+  @attr('array', {
     editType: 'stringArray',
     defaultShown: 'Default',
-  }),
-  rotation_statements: attr('array', {
+  })
+  revocation_statements;
+
+  @attr('array', {
     editType: 'stringArray',
     defaultShown: 'Default',
-  }),
-  rollback_statements: attr('array', {
+  })
+  rotation_statements;
+
+  @attr('array', {
     editType: 'stringArray',
     defaultShown: 'Default',
-  }),
-  renew_statements: attr('array', {
+  })
+  rollback_statements;
+
+  @attr('array', {
     editType: 'stringArray',
     defaultShown: 'Default',
-  }),
-  creation_statement: attr('string', {
+  })
+  renew_statements;
+
+  @attr('string', {
     editType: 'json',
     allowReset: true,
     theme: 'hashi short',
     defaultShown: 'Default',
-  }),
-  revocation_statement: attr('string', {
+  })
+  creation_statement;
+
+  @attr('string', {
     editType: 'json',
     allowReset: true,
     theme: 'hashi short',
     defaultShown: 'Default',
-  }),
+  })
+  revocation_statement;
+
+  @attr('string', { readOnly: true }) last_vault_rotation;
+
+  // ENTERPRISE ONLY
+  @attr({
+    label: 'Rotate immediately',
+    editType: 'toggleButton',
+    helperTextEnabled: 'Vault will rotate the password for this static role on creation.',
+    helperTextDisabled: "Vault will not rotate this role's password on creation.",
+    isOppositeValue: true,
+  })
+  skip_import_rotation;
+
+  @attr('string', {
+    sensitive: true,
+    subText: 'The database password that this Vault role corresponds to.',
+  })
+  password;
 
   /* FIELD ATTRIBUTES */
   get fieldAttrs() {
     // Main fields on edit/create form
     const fields = ['name', 'database', 'type'];
     return expandAttributeMeta(this, fields);
-  },
-
+  }
   get showFields() {
     let fields = ['name', 'database', 'type'];
     fields = fields.concat(getRoleFields(this.type)).concat(['creation_statements']);
@@ -101,15 +157,16 @@ export default Model.extend({
       fields = fields.concat(['revocation_statements']);
     }
     return expandAttributeMeta(this, fields);
-  },
-
-  roleSettingAttrs: computed(function () {
+  }
+  get roleSettingAttrs() {
     // logic for which get displayed is on DatabaseRoleSettingForm
-    const allRoleSettingFields = [
+    let allRoleSettingFields = [
       'default_ttl',
       'max_ttl',
       'username',
+      'password',
       'rotation_period',
+      'skip_import_rotation',
       'creation_statements',
       'creation_statement', // for editType: JSON
       'revocation_statements',
@@ -118,26 +175,49 @@ export default Model.extend({
       'rollback_statements',
       'renew_statements',
     ];
-    return expandAttributeMeta(this, allRoleSettingFields);
-  }),
 
+    // remove enterprise-only attrs if on community
+    if (!this.version.isEnterprise) {
+      allRoleSettingFields = allRoleSettingFields.filter(
+        (role) => !['skip_import_rotation', 'password'].includes(role)
+      );
+    }
+
+    return expandAttributeMeta(this, allRoleSettingFields);
+  }
   /* CAPABILITIES */
   // only used for secretPath
-  path: attr('string', { readOnly: true }),
-
-  secretPath: lazyCapabilities(apiPath`${'backend'}/${'path'}/${'id'}`, 'backend', 'path', 'id'),
-  canEditRole: alias('secretPath.canUpdate'),
-  canDelete: alias('secretPath.canDelete'),
-  dynamicPath: lazyCapabilities(apiPath`${'backend'}/roles/+`, 'backend'),
-  canCreateDynamic: alias('dynamicPath.canCreate'),
-  staticPath: lazyCapabilities(apiPath`${'backend'}/static-roles/+`, 'backend'),
-  canCreateStatic: alias('staticPath.canCreate'),
-  credentialPath: lazyCapabilities(apiPath`${'backend'}/creds/${'id'}`, 'backend', 'id'),
-  staticCredentialPath: lazyCapabilities(apiPath`${'backend'}/static-creds/${'id'}`, 'backend', 'id'),
-  canGenerateCredentials: alias('credentialPath.canRead'),
-  canGetCredentials: alias('staticCredentialPath.canRead'),
-  databasePath: lazyCapabilities(apiPath`${'backend'}/config/${'database[0]'}`, 'backend', 'database'),
-  canUpdateDb: alias('databasePath.canUpdate'),
-  rotateRolePath: lazyCapabilities(apiPath`${'backend'}/rotate-role/${'id'}`, 'backend', 'id'),
-  canRotateRoleCredentials: alias('rotateRolePath.canUpdate'),
-});
+  @attr('string', { readOnly: true }) path;
+  @lazyCapabilities(apiPath`${'backend'}/${'path'}/${'id'}`, 'backend', 'path', 'id') secretPath;
+  @lazyCapabilities(apiPath`${'backend'}/roles/+`, 'backend') dynamicPath;
+  @lazyCapabilities(apiPath`${'backend'}/static-roles/+`, 'backend') staticPath;
+  @lazyCapabilities(apiPath`${'backend'}/creds/${'id'}`, 'backend', 'id') credentialPath;
+  @lazyCapabilities(apiPath`${'backend'}/static-creds/${'id'}`, 'backend', 'id') staticCredentialPath;
+  @lazyCapabilities(apiPath`${'backend'}/config/${'database[0]'}`, 'backend', 'database') databasePath;
+  @lazyCapabilities(apiPath`${'backend'}/rotate-role/${'id'}`, 'backend', 'id') rotateRolePath;
+
+  get canEditRole() {
+    return this.secretPath.get('canUpdate');
+  }
+  get canDelete() {
+    return this.secretPath.get('canDelete');
+  }
+  get canCreateDynamic() {
+    return this.dynamicPath.get('canCreate');
+  }
+  get canCreateStatic() {
+    return this.staticPath.get('canCreate');
+  }
+  get canGenerateCredentials() {
+    return this.credentialPath.get('canRead');
+  }
+  get canGetCredentials() {
+    return this.staticCredentialPath.get('canRead');
+  }
+  get canUpdateDb() {
+    return this.databasePath.get('canUpdate');
+  }
+  get canRotateRoleCredentials() {
+    return this.rotateRolePath.get('canUpdate');
+  }
+}
diff --git a/ui/app/models/generated-item.js b/ui/app/models/generated-item.js
new file mode 100644
index 00000000000..232bd0384d6
--- /dev/null
+++ b/ui/app/models/generated-item.js
@@ -0,0 +1,44 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Model from '@ember-data/model';
+import { tracked } from '@glimmer/tracking';
+
+// This model is used for OpenApi-generated models in path-help service's getNewModel method
+export default class GeneratedItemModel extends Model {
+  allFields = [];
+
+  @tracked _id;
+  get mutableId() {
+    return this._id || this.id;
+  }
+  set mutableId(value) {
+    this._id = value;
+  }
+
+  get fieldGroups() {
+    const groups = {
+      default: [],
+    };
+    const fieldGroups = [];
+    this.constructor.eachAttribute((name, attr) => {
+      // if the attr comes in with a fieldGroup from OpenAPI,
+      if (attr.options.fieldGroup) {
+        if (groups[attr.options.fieldGroup]) {
+          groups[attr.options.fieldGroup].push(attr);
+        } else {
+          groups[attr.options.fieldGroup] = [attr];
+        }
+      } else {
+        // otherwise just add that attr to the default group
+        groups.default.push(attr);
+      }
+    });
+    for (const group in groups) {
+      fieldGroups.push({ [group]: groups[group] });
+    }
+    return fieldGroups;
+  }
+}
diff --git a/ui/app/models/identity/_base.js b/ui/app/models/identity/_base.js
index b226dfc510c..15d6b3393ad 100644
--- a/ui/app/models/identity/_base.js
+++ b/ui/app/models/identity/_base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/identity/entity-alias.js b/ui/app/models/identity/entity-alias.js
index badd7f28637..07d661eb5c2 100644
--- a/ui/app/models/identity/entity-alias.js
+++ b/ui/app/models/identity/entity-alias.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/identity/entity-merge.js b/ui/app/models/identity/entity-merge.js
index 47fc0d3f9e1..6593b61a566 100644
--- a/ui/app/models/identity/entity-merge.js
+++ b/ui/app/models/identity/entity-merge.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/identity/entity.js b/ui/app/models/identity/entity.js
index d7585d45e34..fdce7d5fe9d 100644
--- a/ui/app/models/identity/entity.js
+++ b/ui/app/models/identity/entity.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/identity/group-alias.js b/ui/app/models/identity/group-alias.js
index 1573de46205..df996c136dc 100644
--- a/ui/app/models/identity/group-alias.js
+++ b/ui/app/models/identity/group-alias.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,7 +14,7 @@ export default IdentityModel.extend({
   formFields: computed(function () {
     return ['name', 'mountAccessor'];
   }),
-  group: belongsTo('identity/group', { readOnly: true, async: false }),
+  group: belongsTo('identity/group', { readOnly: true, async: false, inverse: 'alias' }),
 
   name: attr('string'),
   canonicalId: attr('string'),
diff --git a/ui/app/models/identity/group.js b/ui/app/models/identity/group.js
index 2f25e6ec754..0e2b594853e 100644
--- a/ui/app/models/identity/group.js
+++ b/ui/app/models/identity/group.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/keymgmt/key.js b/ui/app/models/keymgmt/key.js
index 9ea3806e4a4..dca71b43e99 100644
--- a/ui/app/models/keymgmt/key.js
+++ b/ui/app/models/keymgmt/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/keymgmt/provider.js b/ui/app/models/keymgmt/provider.js
index d1e2e11962a..c9f034615be 100644
--- a/ui/app/models/keymgmt/provider.js
+++ b/ui/app/models/keymgmt/provider.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -44,7 +44,7 @@ const validations = {
 
 @withModelValidations(validations)
 export default class KeymgmtProviderModel extends Model {
-  @service store;
+  @service pagination;
   @attr('string') backend;
   @attr('string', {
     label: 'Provider name',
@@ -128,7 +128,7 @@ export default class KeymgmtProviderModel extends Model {
     } else {
       // try unless capabilities returns false
       try {
-        this.keys = await this.store.lazyPaginatedQuery('keymgmt/key', {
+        this.keys = await this.pagination.lazyPaginatedQuery('keymgmt/key', {
           backend: this.backend,
           provider: this.name,
           responsePath: 'data.keys',
diff --git a/ui/app/models/kmip/ca.js b/ui/app/models/kmip/ca.js
index c468530c634..208369a6611 100644
--- a/ui/app/models/kmip/ca.js
+++ b/ui/app/models/kmip/ca.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/kmip/config.js b/ui/app/models/kmip/config.js
index 8a9fedbb2d5..f114724a755 100644
--- a/ui/app/models/kmip/config.js
+++ b/ui/app/models/kmip/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,11 +9,7 @@ import { combineFieldGroups } from 'vault/utils/openapi-to-attrs';
 import fieldToAttrs from 'vault/utils/field-to-attrs';
 
 export default Model.extend({
-  useOpenAPI: true,
   ca: belongsTo('kmip/ca', { async: false, inverse: 'config' }),
-  getHelpUrl(path) {
-    return `/v1/${path}/config?help=1`;
-  },
 
   fieldGroups: computed('newFields', function () {
     let groups = [{ default: ['listenAddrs', 'connectionTimeout'] }];
diff --git a/ui/app/models/kmip/credential.js b/ui/app/models/kmip/credential.js
index 8d08ab5dea6..a025ff116e8 100644
--- a/ui/app/models/kmip/credential.js
+++ b/ui/app/models/kmip/credential.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/kmip/role.js b/ui/app/models/kmip/role.js
index c0379ab4d2a..70d563e07e6 100644
--- a/ui/app/models/kmip/role.js
+++ b/ui/app/models/kmip/role.js
@@ -1,57 +1,42 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Model, { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import fieldToAttrs, { expandAttributeMeta } from 'vault/utils/field-to-attrs';
 import apiPath from 'vault/utils/api-path';
 import lazyCapabilities from 'vault/macros/lazy-capabilities';
+import { withExpandedAttributes } from 'vault/decorators/model-expanded-attributes';
+import {
+  operationFields,
+  operationFieldsWithoutSpecial,
+  tlsFields,
+} from 'vault/utils/model-helpers/kmip-role-fields';
+import { removeManyFromArray } from 'vault/helpers/remove-from-array';
 
-export const COMPUTEDS = {
-  operationFields: computed('newFields', function () {
-    return this.newFields.filter((key) => key.startsWith('operation'));
-  }),
+@withExpandedAttributes()
+export default class KmipRoleModel extends Model {
+  @attr({ readOnly: true }) backend;
+  @attr({ readOnly: true }) scope;
 
-  operationFieldsWithoutSpecial: computed('operationFields', function () {
-    return this.operationFields.slice().removeObjects(['operationAll', 'operationNone']);
-  }),
+  get editableFields() {
+    return Object.keys(this.allByKey).filter((k) => !['backend', 'scope', 'role'].includes(k));
+  }
 
-  tlsFields: computed(function () {
-    return ['tlsClientKeyBits', 'tlsClientKeyType', 'tlsClientTtl'];
-  }),
-
-  // For rendering on the create/edit pages
-  defaultFields: computed('newFields', 'operationFields', 'tlsFields', function () {
-    const excludeFields = ['role'].concat(this.operationFields, this.tlsFields);
-    return this.newFields.slice().removeObjects(excludeFields);
-  }),
-
-  // For adapter/serializer
-  nonOperationFields: computed('newFields', 'operationFields', function () {
-    return this.newFields.slice().removeObjects(this.operationFields);
-  }),
-};
-
-export default Model.extend(COMPUTEDS, {
-  useOpenAPI: true,
-  backend: attr({ readOnly: true }),
-  scope: attr({ readOnly: true }),
-  name: attr({ readOnly: true }),
-  getHelpUrl(path) {
-    return `/v1/${path}/scope/example/role/example?help=1`;
-  },
-  fieldGroups: computed('fields', 'defaultFields.length', 'tlsFields', function () {
-    const groups = [{ TLS: this.tlsFields }];
-    if (this.defaultFields.length) {
-      groups.unshift({ default: this.defaultFields });
+  get fieldGroups() {
+    const tls = tlsFields();
+    const groups = [{ TLS: tls }];
+    // op fields are shown in OperationFieldDisplay
+    const opFields = operationFields(this.editableFields);
+    // not op fields, tls fields, or role/backend/scope
+    const defaultFields = this.editableFields.filter((f) => ![...opFields, ...tls].includes(f));
+    if (defaultFields.length) {
+      groups.unshift({ default: defaultFields });
     }
-    const ret = fieldToAttrs(this, groups);
-    return ret;
-  }),
+    return this._expandGroups(groups);
+  }
 
-  operationFormFields: computed('operationFieldsWithoutSpecial', function () {
+  get operationFormFields() {
     const objects = [
       'operationCreate',
       'operationActivate',
@@ -64,9 +49,11 @@ export default Model.extend(COMPUTEDS, {
 
     const attributes = ['operationAddAttribute', 'operationGetAttributes'];
     const server = ['operationDiscoverVersions'];
-    const others = this.operationFieldsWithoutSpecial
-      .slice()
-      .removeObjects(objects.concat(attributes, server));
+    const others = removeManyFromArray(operationFieldsWithoutSpecial(this.editableFields), [
+      ...objects,
+      ...attributes,
+      ...server,
+    ]);
     const groups = [
       { 'Managed Cryptographic Objects': objects },
       { 'Object Attributes': attributes },
@@ -77,14 +64,8 @@ export default Model.extend(COMPUTEDS, {
         Other: others,
       });
     }
-    return fieldToAttrs(this, groups);
-  }),
-  tlsFormFields: computed('tlsFields', function () {
-    return expandAttributeMeta(this, this.tlsFields);
-  }),
-  fields: computed('defaultFields', function () {
-    return expandAttributeMeta(this, this.defaultFields);
-  }),
+    return this._expandGroups(groups);
+  }
 
-  updatePath: lazyCapabilities(apiPath`${'backend'}/scope/${'scope'}/role/${'id'}`, 'backend', 'scope', 'id'),
-});
+  @lazyCapabilities(apiPath`${'backend'}/scope/${'scope'}/role/${'id'}`, 'backend', 'scope', 'id') updatePath;
+}
diff --git a/ui/app/models/kmip/scope.js b/ui/app/models/kmip/scope.js
index 4b395277297..56152d2a8f6 100644
--- a/ui/app/models/kmip/scope.js
+++ b/ui/app/models/kmip/scope.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/kubernetes/config.js b/ui/app/models/kubernetes/config.js
index 0301e3c24aa..87a9b03a9c4 100644
--- a/ui/app/models/kubernetes/config.js
+++ b/ui/app/models/kubernetes/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/kubernetes/role.js b/ui/app/models/kubernetes/role.js
index 613f6719656..c73e75e4590 100644
--- a/ui/app/models/kubernetes/role.js
+++ b/ui/app/models/kubernetes/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/kv/config.js b/ui/app/models/kv/config.js
deleted file mode 100644
index 0370ce8739c..00000000000
--- a/ui/app/models/kv/config.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Model, { attr } from '@ember-data/model';
-import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
-import { withFormFields } from 'vault/decorators/model-form-fields';
-import { duration } from 'core/helpers/format-duration';
-
-// This model is used only for display only - configuration happens via secret-engine model when an engine is mounted
-@withFormFields(['casRequired', 'deleteVersionAfter', 'maxVersions'])
-export default class KvConfigModel extends Model {
-  @attr backend;
-  @attr('number', { label: 'Maximum number of versions' }) maxVersions;
-
-  @attr('boolean', { label: 'Require check and set' }) casRequired;
-
-  @attr({ label: 'Automate secret deletion' }) deleteVersionAfter;
-
-  @lazyCapabilities(apiPath`${'backend'}/config`, 'backend') configPath;
-
-  get canRead() {
-    return this.configPath.get('canRead') !== false;
-  }
-
-  // used in template to render using this model instead of secret-engine (where these attrs also exist)
-  get displayFields() {
-    return ['casRequired', 'deleteVersionAfter', 'maxVersions'];
-  }
-
-  get displayDeleteTtl() {
-    if (this.deleteVersionAfter === '0s') return 'Never delete';
-    return duration([this.deleteVersionAfter]);
-  }
-}
diff --git a/ui/app/models/kv/data.js b/ui/app/models/kv/data.js
deleted file mode 100644
index 58392bf6b37..00000000000
--- a/ui/app/models/kv/data.js
+++ /dev/null
@@ -1,122 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Model, { attr } from '@ember-data/model';
-import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
-import { withModelValidations } from 'vault/decorators/model-validations';
-import { withFormFields } from 'vault/decorators/model-form-fields';
-import { isDeleted } from 'kv/utils/kv-deleted';
-
-/* sample response
-{
-  "data": {
-    "data": {
-      "foo": "bar"
-    },
-    "metadata": {
-      "created_time": "2018-03-22T02:24:06.945319214Z",
-      "custom_metadata": {
-        "owner": "jdoe",
-        "mission_critical": "false"
-      },
-      "deletion_time": "",
-      "destroyed": false,
-      "version": 2
-    }
-  }
-}
-*/
-
-const validations = {
-  path: [
-    { type: 'presence', message: `Path can't be blank.` },
-    { type: 'endsInSlash', message: `Path can't end in forward slash '/'.` },
-    {
-      type: 'containsWhiteSpace',
-      message:
-        "Path contains whitespace. If this is desired, you'll need to encode it with %20 in API requests.",
-      level: 'warn',
-    },
-  ],
-  secretData: [
-    {
-      validator: (model) =>
-        model.secretData !== undefined && typeof model.secretData !== 'object' ? false : true,
-      message: 'Vault expects data to be formatted as an JSON object.',
-    },
-  ],
-};
-@withModelValidations(validations)
-@withFormFields()
-export default class KvSecretDataModel extends Model {
-  @attr('string') backend; // dynamic path of secret -- set on response from value passed to queryRecord.
-  @attr('string', { label: 'Path for this secret' }) path;
-  @attr('object') secretData; // { key: value } data of the secret version
-
-  // Params returned on the GET response.
-  @attr('string') createdTime;
-  @attr('object') customMetadata;
-  @attr('string') deletionTime;
-  @attr('boolean') destroyed;
-  @attr('number') version;
-  // Set in adapter if read failed
-  @attr('number') failReadErrorCode;
-
-  // if creating a new version this value is set in the edit route's
-  // model hook from metadata or secret version, pending permissions
-  // if the value is not a number, don't send options.cas on payload
-  @attr('number')
-  casVersion;
-
-  get state() {
-    if (this.destroyed) return 'destroyed';
-    if (this.isSecretDeleted) return 'deleted';
-    if (this.createdTime) return 'created';
-    return '';
-  }
-
-  // cannot use isDeleted as model property name because of an ember property conflict
-  get isSecretDeleted() {
-    return isDeleted(this.deletionTime);
-  }
-
-  // Permissions
-  @lazyCapabilities(apiPath`${'backend'}/data/${'path'}`, 'backend', 'path') dataPath;
-  @lazyCapabilities(apiPath`${'backend'}/metadata/${'path'}`, 'backend', 'path') metadataPath;
-  @lazyCapabilities(apiPath`${'backend'}/delete/${'path'}`, 'backend', 'path') deletePath;
-  @lazyCapabilities(apiPath`${'backend'}/destroy/${'path'}`, 'backend', 'path') destroyPath;
-  @lazyCapabilities(apiPath`${'backend'}/undelete/${'path'}`, 'backend', 'path') undeletePath;
-
-  get canDeleteLatestVersion() {
-    return this.dataPath.get('canDelete') !== false;
-  }
-  get canDeleteVersion() {
-    return this.deletePath.get('canUpdate') !== false;
-  }
-  get canUndelete() {
-    return this.undeletePath.get('canUpdate') !== false;
-  }
-  get canDestroyVersion() {
-    return this.destroyPath.get('canUpdate') !== false;
-  }
-  get canEditData() {
-    return this.dataPath.get('canUpdate') !== false;
-  }
-  get canReadData() {
-    return this.dataPath.get('canRead') !== false;
-  }
-  get canReadMetadata() {
-    return this.metadataPath.get('canRead') !== false;
-  }
-  get canUpdateMetadata() {
-    return this.metadataPath.get('canUpdate') !== false;
-  }
-  get canListMetadata() {
-    return this.metadataPath.get('canList') !== false;
-  }
-  get canDeleteMetadata() {
-    return this.metadataPath.get('canDelete') !== false;
-  }
-}
diff --git a/ui/app/models/kv/metadata.js b/ui/app/models/kv/metadata.js
deleted file mode 100644
index 66d1d1b8c0d..00000000000
--- a/ui/app/models/kv/metadata.js
+++ /dev/null
@@ -1,120 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Model, { attr } from '@ember-data/model';
-import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
-import { withModelValidations } from 'vault/decorators/model-validations';
-import { withFormFields } from 'vault/decorators/model-form-fields';
-import { keyIsFolder } from 'core/utils/key-utils';
-import { isDeleted } from 'kv/utils/kv-deleted';
-
-const validations = {
-  maxVersions: [
-    { type: 'number', message: 'Maximum versions must be a number.' },
-    { type: 'length', options: { min: 1, max: 16 }, message: 'You cannot go over 16 characters.' },
-  ],
-};
-const formFieldProps = ['customMetadata', 'maxVersions', 'casRequired', 'deleteVersionAfter'];
-
-@withModelValidations(validations)
-@withFormFields(formFieldProps)
-export default class KvSecretMetadataModel extends Model {
-  @attr('string') backend;
-  @attr('string') path;
-  @attr('string') fullSecretPath;
-
-  @attr('number', {
-    defaultValue: 0,
-    label: 'Maximum number of versions',
-    subText:
-      'The number of versions to keep per key. Once the number of keys exceeds the maximum number set here, the oldest version will be permanently deleted.',
-  })
-  maxVersions;
-
-  @attr('boolean', {
-    defaultValue: false,
-    label: 'Require Check and Set',
-    subText: `Writes will only be allowed if the key's current version matches the version specified in the cas parameter.`,
-  })
-  casRequired;
-
-  @attr('string', {
-    defaultValue: '0s',
-    editType: 'ttl',
-    label: 'Automate secret deletion',
-    helperTextDisabled: `A secret's version must be manually deleted.`,
-    helperTextEnabled: 'Delete all new versions of this secret after:',
-  })
-  deleteVersionAfter;
-
-  @attr('object', {
-    editType: 'kv',
-    isSectionHeader: true,
-    subText: 'An optional set of informational key-value pairs that will be stored with all secret versions.',
-  })
-  customMetadata;
-
-  // Additional Params only returned on the GET response.
-  @attr('string') createdTime;
-  @attr('number') currentVersion;
-  @attr('number') oldestVersion;
-  @attr('string') updatedTime;
-  @attr('object') versions;
-
-  // used for KV list and list-directory view
-  get pathIsDirectory() {
-    // ex: beep/
-    return keyIsFolder(this.path);
-  }
-
-  // cannot use isDeleted due to ember property conflict
-  get isSecretDeleted() {
-    return isDeleted(this.deletionTime);
-  }
-
-  // turns version object into an array for version dropdown menu
-  get sortedVersions() {
-    const array = [];
-    for (const key in this.versions) {
-      this.versions[key].isSecretDeleted = isDeleted(this.versions[key].deletion_time);
-      array.push({ version: key, ...this.versions[key] });
-    }
-    // version keys are in order created with 1 being the oldest, we want newest first
-    return array.reverse();
-  }
-
-  // helps in long logic statements for state of a currentVersion
-  get currentSecret() {
-    if (!this.versions || !this.currentVersion) return false;
-    const data = this.versions[this.currentVersion];
-    const state = data.destroyed ? 'destroyed' : isDeleted(data.deletion_time) ? 'deleted' : 'created';
-    return {
-      state,
-      isDeactivated: state !== 'created',
-    };
-  }
-
-  get permissionsPath() {
-    return this.fullSecretPath || this.path;
-  }
-
-  // permissions needed for the list view where kv/data has not yet been called. Allows us to conditionally show action items in the LinkedBlock popups.
-  @lazyCapabilities(apiPath`${'backend'}/data/${'permissionsPath'}`, 'backend', 'permissionsPath') dataPath;
-  @lazyCapabilities(apiPath`${'backend'}/metadata/${'permissionsPath'}`, 'backend', 'permissionsPath')
-  metadataPath;
-
-  get canDeleteMetadata() {
-    return this.metadataPath.get('canDelete') !== false;
-  }
-  get canReadMetadata() {
-    return this.metadataPath.get('canRead') !== false;
-  }
-  get canUpdateMetadata() {
-    return this.metadataPath.get('canUpdate') !== false;
-  }
-  get canCreateVersionData() {
-    return this.dataPath.get('canUpdate') !== false;
-  }
-}
diff --git a/ui/app/models/ldap/config.js b/ui/app/models/ldap/config.js
index 143debdeacf..f89409742a6 100644
--- a/ui/app/models/ldap/config.js
+++ b/ui/app/models/ldap/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/ldap/library.js b/ui/app/models/ldap/library.js
index e66789a6eb1..ba2177b54d8 100644
--- a/ui/app/models/ldap/library.js
+++ b/ui/app/models/ldap/library.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -18,6 +18,7 @@ const formFields = ['name', 'service_account_names', 'ttl', 'max_ttl', 'disable_
 @withFormFields(formFields)
 export default class LdapLibraryModel extends Model {
   @attr('string') backend; // dynamic path of secret -- set on response from value passed to queryRecord
+  @attr('string') path_to_library; // ancestral path to the library added in the adapter (only exists for nested libraries)
 
   @attr('string', {
     label: 'Library name',
@@ -64,6 +65,12 @@ export default class LdapLibraryModel extends Model {
   })
   disable_check_in_enforcement;
 
+  get completeLibraryName() {
+    // if there is a path_to_library then the name is hierarchical
+    // and we must concat the ancestors with the leaf name to get the full library path
+    return this.path_to_library ? this.path_to_library + this.name : this.name;
+  }
+
   get displayFields() {
     return this.formFields.filter((field) => field.name !== 'service_account_names');
   }
diff --git a/ui/app/models/ldap/role.js b/ui/app/models/ldap/role.js
index bb8ec1c30d7..deb53fdd301 100644
--- a/ui/app/models/ldap/role.js
+++ b/ui/app/models/ldap/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -63,7 +63,8 @@ export const dynamicRoleFields = [
 @withModelValidations(validations)
 @withFormFields()
 export default class LdapRoleModel extends Model {
-  @attr('string') backend; // dynamic path of secret -- set on response from value passed to queryRecord
+  @attr('string') backend; // mount path of ldap engine -- set on response from value passed to queryRecord
+  @attr('string') path_to_role; // ancestral path to the role added in the adapter (only exists for nested roles)
 
   @attr('string', {
     defaultValue: 'static',
@@ -162,6 +163,12 @@ export default class LdapRoleModel extends Model {
   })
   rollback_ldif;
 
+  get completeRoleName() {
+    // if there is a path_to_role then the name is hierarchical
+    // and we must concat the ancestors with the leaf name to get the full role path
+    return this.path_to_role ? this.path_to_role + this.name : this.name;
+  }
+
   get isStatic() {
     return this.type === 'static';
   }
@@ -223,9 +230,11 @@ export default class LdapRoleModel extends Model {
   }
 
   fetchCredentials() {
-    return this.store.adapterFor('ldap/role').fetchCredentials(this.backend, this.type, this.name);
+    return this.store
+      .adapterFor('ldap/role')
+      .fetchCredentials(this.backend, this.type, this.completeRoleName);
   }
   rotateStaticPassword() {
-    return this.store.adapterFor('ldap/role').rotateStaticPassword(this.backend, this.name);
+    return this.store.adapterFor('ldap/role').rotateStaticPassword(this.backend, this.completeRoleName);
   }
 }
diff --git a/ui/app/models/lease.js b/ui/app/models/lease.js
index c79799663d0..1a2dfa0eb09 100644
--- a/ui/app/models/lease.js
+++ b/ui/app/models/lease.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/license.js b/ui/app/models/license.js
index 6739ba91490..a1a8d229603 100644
--- a/ui/app/models/license.js
+++ b/ui/app/models/license.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/mfa-login-enforcement.js b/ui/app/models/mfa-login-enforcement.js
index a78576cd520..9bc2d4bd7d9 100644
--- a/ui/app/models/mfa-login-enforcement.js
+++ b/ui/app/models/mfa-login-enforcement.js
@@ -1,15 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Model, { attr, hasMany } from '@ember-data/model';
 import ArrayProxy from '@ember/array/proxy';
 import PromiseProxyMixin from '@ember/object/promise-proxy-mixin';
-import { methods } from 'vault/helpers/mountable-auth-methods';
 import { withModelValidations } from 'vault/decorators/model-validations';
 import { isPresent } from '@ember/utils';
 import { service } from '@ember/service';
+import { addManyToArray, addToArray } from 'vault/helpers/add-to-array';
+import { filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
 
 const validations = {
   name: [{ type: 'presence', message: 'Name is required' }],
@@ -35,7 +36,8 @@ const validations = {
 
 @withModelValidations(validations)
 export default class MfaLoginEnforcementModel extends Model {
-  @service store;
+  @service api;
+
   @attr('string') name;
   @hasMany('mfa-method', { async: true, inverse: null }) mfa_methods;
   @attr('string') namespace_id;
@@ -52,13 +54,13 @@ export default class MfaLoginEnforcementModel extends Model {
 
   async prepareTargets() {
     let authMethods;
-    const targets = [];
+    let targets = [];
 
     if (this.auth_method_accessors.length || this.auth_method_types.length) {
       // fetch all auth methods and lookup by accessor to get mount path and type
       try {
-        const { data } = await this.store.adapterFor('auth-method').findAll();
-        authMethods = Object.keys(data).map((key) => ({ path: key, ...data[key] }));
+        const { data } = await this.api.sys.authListEnabledMethods();
+        authMethods = this.api.responseObjectToArray(data, 'path');
       } catch (error) {
         // swallow this error
       }
@@ -68,7 +70,8 @@ export default class MfaLoginEnforcementModel extends Model {
       const selectedAuthMethods = authMethods.filter((model) => {
         return this.auth_method_accessors.includes(model.accessor);
       });
-      targets.addObjects(
+      targets = addManyToArray(
+        targets,
         selectedAuthMethods.map((method) => ({
           icon: this.iconForMount(method.type),
           link: 'vault.cluster.access.method',
@@ -82,7 +85,7 @@ export default class MfaLoginEnforcementModel extends Model {
     this.auth_method_types.forEach((type) => {
       const icon = this.iconForMount(type);
       const mountCount = authMethods.filterBy('type', type).length;
-      targets.addObject({
+      targets = addToArray(targets, {
         key: 'auth_method_types',
         icon,
         title: type,
@@ -92,7 +95,7 @@ export default class MfaLoginEnforcementModel extends Model {
 
     for (const key of ['identity_entities', 'identity_groups']) {
       (await this[key]).forEach((model) => {
-        targets.addObject({
+        targets = addToArray(targets, {
           key,
           icon: 'user',
           link: 'vault.cluster.access.identity.show',
@@ -107,7 +110,7 @@ export default class MfaLoginEnforcementModel extends Model {
   }
 
   iconForMount(type) {
-    const mountableMethods = methods();
+    const mountableMethods = filterEnginesByMountCategory({ mountCategory: 'auth', isEnterprise: true });
     const mount = mountableMethods.find((method) => method.type === type);
     return mount ? mount.glyph || mount.type : 'token';
   }
diff --git a/ui/app/models/mfa-method.js b/ui/app/models/mfa-method.js
index 806a87dfd0b..ce7de9f148b 100644
--- a/ui/app/models/mfa-method.js
+++ b/ui/app/models/mfa-method.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,7 +13,17 @@ const METHOD_PROPS = {
   common: [],
   duo: ['username_format', 'secret_key', 'integration_key', 'api_hostname', 'push_info', 'use_passcode'],
   okta: ['username_format', 'mount_accessor', 'org_name', 'api_token', 'base_url', 'primary_email'],
-  totp: ['issuer', 'period', 'key_size', 'qr_size', 'algorithm', 'digits', 'skew', 'max_validation_attempts'],
+  totp: [
+    'issuer',
+    'period',
+    'key_size',
+    'qr_size',
+    'algorithm',
+    'digits',
+    'skew',
+    'max_validation_attempts',
+    'enable_self_enrollment',
+  ],
   pingid: [
     'username_format',
     'settings_file_base64',
@@ -58,7 +68,7 @@ export default class MfaMethod extends Model {
   @attr('string', {
     label: 'Namespace',
   })
-  namespace_id;
+  namespace_path;
   @attr('string') mount_accessor;
 
   // PING ID
@@ -134,11 +144,13 @@ export default class MfaMethod extends Model {
   @attr('number', {
     label: 'Key size',
     subText: 'The size in bytes of the Vault generated key.',
+    helperText: 'Byte size of the generated key.',
   })
   key_size;
   @attr('number', {
     label: 'QR size',
     subText: 'The pixel size of the generated square QR code.',
+    helperText: 'Pixel size of the QR code.',
   })
   qr_size;
   @attr('string', {
@@ -153,6 +165,7 @@ export default class MfaMethod extends Model {
     editType: 'radio',
     possibleValues: [6, 8],
     subText: 'The number digits in the generated TOTP code.',
+    helperText: 'TOTP code length.',
   })
   digits;
   @attr('number', {
@@ -163,6 +176,15 @@ export default class MfaMethod extends Model {
   })
   skew;
   @attr('number') max_validation_attempts;
+  @attr('boolean', {
+    label: 'Enable self-enrollment',
+    editType: 'toggleButton',
+    helperTextEnabled:
+      'Let end users enroll in this MFA method on their own. You still control which auth mounts, groups, or entities it applies to.',
+    helperTextDisabled:
+      'Let end users enroll in this MFA method on their own. You still control which auth mounts, groups, or entities it applies to.',
+  })
+  enable_self_enrollment;
 
   get name() {
     return this.type === 'totp' ? this.type.toUpperCase() : capitalize(this.type);
@@ -172,6 +194,10 @@ export default class MfaMethod extends Model {
     switch (this.type) {
       case 'totp':
         return 'history';
+      case 'pingid':
+        return 'ping-identity-color';
+      case 'duo':
+        return 'duo-color';
       default:
         return this.type;
     }
diff --git a/ui/app/models/mount-config.js b/ui/app/models/mount-config.js
index f8d7d07714a..756a632ecd6 100644
--- a/ui/app/models/mount-config.js
+++ b/ui/app/models/mount-config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -33,8 +33,12 @@ export default class MountConfigModel extends Model {
   auditNonHmacResponseKeys;
 
   @attr('mountVisibility', {
-    editType: 'boolean',
-    label: 'List method when unauthenticated',
+    label: 'Use as preferred UI login method',
+    editType: 'toggleButton',
+    helperTextEnabled:
+      'This mount will be included in the unauthenticated UI login endpoint and display as a preferred login method.',
+    helperTextDisabled:
+      'Turn on the toggle to use this auth mount as a preferred login method during UI login.',
     defaultValue: false,
   })
   listingVisibility;
@@ -54,7 +58,7 @@ export default class MountConfigModel extends Model {
   allowedResponseHeaders;
 
   @attr('string', {
-    label: 'Token Type',
+    label: 'Token type',
     helpText:
       'The type of token that should be generated via this role. For `default-service` and `default-batch` service and batch tokens will be issued respectively, unless the auth method explicitly requests a different type.',
     possibleValues: ['default-service', 'default-batch', 'batch', 'service'],
@@ -66,4 +70,50 @@ export default class MountConfigModel extends Model {
     editType: 'stringArray',
   })
   allowedManagedKeys;
+
+  @attr('string', {
+    label: 'Plugin version',
+    subText:
+      'Specifies the semantic version of the plugin to use, e.g. "v1.0.0". If unspecified, the server will select any matching un-versioned plugin that may have been registered, the latest versioned plugin registered, or a built-in plugin in that order of precedence.',
+  })
+  pluginVersion;
+
+  // identityTokenKey is yielded in a named block on the mount-backend-form component
+  @attr({
+    label: 'Identity token key',
+    subText: `A named key to sign tokens. If not provided, this will default to Vault's OIDC default key.`,
+    editType: 'yield',
+  })
+  identityTokenKey;
+
+  // Auth mount userLockoutConfig params, added to user_lockout_config object in saveModel method
+  @attr('string', {
+    label: 'Lockout threshold',
+    subText: 'Specifies the number of failed login attempts after which the user is locked out, e.g. 15.',
+  })
+  lockoutThreshold;
+
+  @attr({
+    label: 'Lockout duration',
+    helperTextEnabled: 'The duration for which a user will be locked out, e.g. "5s" or "30m".',
+    editType: 'ttl',
+    helperTextDisabled: 'No lockout duration configured.',
+  })
+  lockoutDuration;
+
+  @attr({
+    label: 'Lockout counter reset',
+    helperTextEnabled:
+      'The duration after which the lockout counter is reset with no failed login attempts, e.g. "5s" or "30m".',
+    editType: 'ttl',
+    helperTextDisabled: 'No reset duration configured.',
+  })
+  lockoutCounterReset;
+
+  @attr('boolean', {
+    label: 'Disable lockout for this mount',
+    subText: 'If checked, disables the user lockout feature for this mount.',
+  })
+  lockoutDisable;
+  // end of user_lockout_config params
 }
diff --git a/ui/app/models/namespace.js b/ui/app/models/namespace.js
index 5a2b2174b6f..c254d151b61 100644
--- a/ui/app/models/namespace.js
+++ b/ui/app/models/namespace.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/node.js b/ui/app/models/node.js
index 003d3f7ab99..c9f5ee6bd3e 100644
--- a/ui/app/models/node.js
+++ b/ui/app/models/node.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/oidc/assignment.js b/ui/app/models/oidc/assignment.js
index bbd5be317ec..506ed496ae2 100644
--- a/ui/app/models/oidc/assignment.js
+++ b/ui/app/models/oidc/assignment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/oidc/client.js b/ui/app/models/oidc/client.js
index be4761ed68b..256e92f0a22 100644
--- a/ui/app/models/oidc/client.js
+++ b/ui/app/models/oidc/client.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/oidc/key.js b/ui/app/models/oidc/key.js
index 66817efc233..1502faa0f8e 100644
--- a/ui/app/models/oidc/key.js
+++ b/ui/app/models/oidc/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/oidc/provider.js b/ui/app/models/oidc/provider.js
index 36ed9d9334c..07a58869303 100644
--- a/ui/app/models/oidc/provider.js
+++ b/ui/app/models/oidc/provider.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/oidc/scope.js b/ui/app/models/oidc/scope.js
index 0e31a09a3ae..3596518baf6 100644
--- a/ui/app/models/oidc/scope.js
+++ b/ui/app/models/oidc/scope.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/path-filter-config.js b/ui/app/models/path-filter-config.js
index d040a93ec1a..d3274e2a0e5 100644
--- a/ui/app/models/path-filter-config.js
+++ b/ui/app/models/path-filter-config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/pki/action.js b/ui/app/models/pki/action.js
index 00a9488df80..595ec269629 100644
--- a/ui/app/models/pki/action.js
+++ b/ui/app/models/pki/action.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/pki/certificate/base.js b/ui/app/models/pki/certificate/base.js
index 72125cfab45..33b4d61ee54 100644
--- a/ui/app/models/pki/certificate/base.js
+++ b/ui/app/models/pki/certificate/base.js
@@ -1,10 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Model, { attr } from '@ember-data/model';
-import { assert } from '@ember/debug';
 import { service } from '@ember/service';
 import { withFormFields } from 'vault/decorators/model-form-fields';
 import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
@@ -25,15 +24,9 @@ const certDisplayFields = ['certificate', 'commonName', 'revocationTime', 'seria
 export default class PkiCertificateBaseModel extends Model {
   @service secretMountPath;
 
-  get useOpenAPI() {
-    return true;
-  }
   get backend() {
     return this.secretMountPath.currentPath;
   }
-  getHelpUrl() {
-    assert('You must provide a helpUrl for OpenAPI', true);
-  }
 
   // The attributes parsed from parse-pki-cert util live here
   @attr parsedCertificate;
diff --git a/ui/app/models/pki/certificate/generate.js b/ui/app/models/pki/certificate/generate.js
index 640695d4f85..1e7b80e2bab 100644
--- a/ui/app/models/pki/certificate/generate.js
+++ b/ui/app/models/pki/certificate/generate.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -34,8 +34,5 @@ const certDisplayFields = [
 ];
 @withFormFields(certDisplayFields, generateFromRole)
 export default class PkiCertificateGenerateModel extends PkiCertificateBaseModel {
-  getHelpUrl(backend) {
-    return `/v1/${backend}/issue/example?help=1`;
-  }
   @attr('string') role; // role name to issue certificate against for request URL
 }
diff --git a/ui/app/models/pki/certificate/sign.js b/ui/app/models/pki/certificate/sign.js
index 76fe3156c94..f546d69e8a0 100644
--- a/ui/app/models/pki/certificate/sign.js
+++ b/ui/app/models/pki/certificate/sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,9 +23,6 @@ const generateFromRole = [
 ];
 @withFormFields(null, generateFromRole)
 export default class PkiCertificateSignModel extends PkiCertificateBaseModel {
-  getHelpUrl(backend) {
-    return `/v1/${backend}/sign/example?help=1`;
-  }
   @attr('string') role; // role name to create certificate against for request URL
 
   @attr('string', {
diff --git a/ui/app/models/pki/config/acme.js b/ui/app/models/pki/config/acme.js
index 80531c28b17..5eea3a23931 100644
--- a/ui/app/models/pki/config/acme.js
+++ b/ui/app/models/pki/config/acme.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,16 +10,8 @@ import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
 @withFormFields()
 export default class PkiConfigAcmeModel extends Model {
   // This model uses the backend value as the model ID
-  get useOpenAPI() {
-    return true;
-  }
-
-  getHelpUrl(backendPath) {
-    return `/v1/${backendPath}/config/acme?help=1`;
-  }
 
   // attrs order in the form is determined by order here
-
   @attr('boolean', {
     label: 'ACME enabled',
     subText: 'When ACME is disabled, all requests to ACME directory URLs will return 404.',
@@ -66,6 +58,15 @@ export default class PkiConfigAcmeModel extends Model {
   })
   dnsResolver;
 
+  @attr({
+    label: 'Max TTL',
+    editType: 'ttl',
+    hideToggle: true,
+    helperTextEnabled:
+      'Specify the maximum TTL for ACME certificates. Role TTL values will be limited to this value.',
+  })
+  maxTtl;
+
   @lazyCapabilities(apiPath`${'id'}/config/acme`, 'id')
   acmePath;
 
diff --git a/ui/app/models/pki/config/cluster.js b/ui/app/models/pki/config/cluster.js
index 8b4d49f66de..85889942768 100644
--- a/ui/app/models/pki/config/cluster.js
+++ b/ui/app/models/pki/config/cluster.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,13 +10,6 @@ import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
 @withFormFields()
 export default class PkiConfigClusterModel extends Model {
   // This model uses the backend value as the model ID
-  get useOpenAPI() {
-    return true;
-  }
-
-  getHelpUrl(backendPath) {
-    return `/v1/${backendPath}/config/cluster?help=1`;
-  }
 
   @attr('string', {
     label: "Mount's API path",
diff --git a/ui/app/models/pki/config/crl.js b/ui/app/models/pki/config/crl.js
index b0ecb12e279..c42ab1a9d70 100644
--- a/ui/app/models/pki/config/crl.js
+++ b/ui/app/models/pki/config/crl.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/pki/config/urls.js b/ui/app/models/pki/config/urls.js
index 924d63b223f..e0cee844c73 100644
--- a/ui/app/models/pki/config/urls.js
+++ b/ui/app/models/pki/config/urls.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,12 +10,6 @@ import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
 @withFormFields()
 export default class PkiConfigUrlsModel extends Model {
   // This model uses the backend value as the model ID
-  get useOpenAPI() {
-    return true;
-  }
-  getHelpUrl(backendPath) {
-    return `/v1/${backendPath}/config/urls?help=1`;
-  }
 
   @attr({
     label: 'Issuing certificates',
diff --git a/ui/app/models/pki/issuer.js b/ui/app/models/pki/issuer.js
index 6e51d469d5f..b688e856ee5 100644
--- a/ui/app/models/pki/issuer.js
+++ b/ui/app/models/pki/issuer.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -27,10 +27,7 @@ const displayFields = [
 @withFormFields(inputFields, displayFields)
 export default class PkiIssuerModel extends Model {
   @service secretMountPath;
-  // TODO use openAPI after removing route extension (see pki/roles route for example)
-  get useOpenAPI() {
-    return false;
-  }
+
   get backend() {
     return this.secretMountPath.currentPath;
   }
@@ -66,7 +63,7 @@ export default class PkiIssuerModel extends Model {
       'What happens when a leaf certificate is issued, but its NotAfter field (and therefore its expiry date) exceeds that of this issuer.',
     docLink: '/vault/api-docs/secret/pki#update-issuer',
     editType: 'yield',
-    valueOptions: ['err', 'truncate', 'permit'],
+    valueOptions: ['always_enforce_err', 'err', 'truncate', 'permit'],
   })
   leafNotAfterBehavior;
 
diff --git a/ui/app/models/pki/key.js b/ui/app/models/pki/key.js
index a9495615a46..1e5911c964c 100644
--- a/ui/app/models/pki/key.js
+++ b/ui/app/models/pki/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/pki/role.js b/ui/app/models/pki/role.js
index b7fe845fe69..3c6c6f8d9a4 100644
--- a/ui/app/models/pki/role.js
+++ b/ui/app/models/pki/role.js
@@ -1,20 +1,27 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Model, { attr } from '@ember-data/model';
+import { service } from '@ember/service';
 import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
 import { withModelValidations } from 'vault/decorators/model-validations';
-import { withFormFields } from 'vault/decorators/model-form-fields';
+import { withExpandedAttributes } from 'vault/decorators/model-expanded-attributes';
 
 const validations = {
   name: [{ type: 'presence', message: 'Name is required.' }],
 };
 
-const fieldGroups = [
-  {
-    default: [
+@withExpandedAttributes()
+@withModelValidations(validations)
+export default class PkiRoleModel extends Model {
+  @service version; // noStoreMetadata is enterprise-only, so we need this available
+
+  @attr('string', { readOnly: true }) backend;
+
+  get formFieldGroups() {
+    let defaultArray = [
       'name',
       'issuerRef',
       'customTtl',
@@ -22,68 +29,65 @@ const fieldGroups = [
       'maxTtl',
       'generateLease',
       'noStore',
+      'noStoreMetadata',
       'addBasicConstraints',
-    ],
-  },
-  {
-    'Domain handling': [
-      'allowedDomains',
-      'allowedDomainsTemplate',
-      'allowBareDomains',
-      'allowSubdomains',
-      'allowGlobDomains',
-      'allowWildcardCertificates',
-      'allowLocalhost', // default: true (returned true by OpenApi)
-      'allowAnyName',
-      'enforceHostnames', // default: true (returned true by OpenApi)
-    ],
-  },
-  {
-    'Key parameters': ['keyType', 'keyBits', 'signatureBits'],
-  },
-  {
-    'Key usage': ['keyUsage', 'extKeyUsage', 'extKeyUsageOids'],
-  },
-  { 'Policy identifiers': ['policyIdentifiers'] },
-  {
-    'Subject Alternative Name (SAN) Options': [
-      'allowIpSans',
-      'allowedUriSans',
-      'allowUriSansTemplate',
-      'allowedOtherSans',
-    ],
-  },
-  {
-    'Additional subject fields': [
-      'allowedUserIds',
-      'allowedSerialNumbers',
-      'requireCn',
-      'useCsrCommonName',
-      'useCsrSans',
-      'ou',
-      'organization',
-      'country',
-      'locality',
-      'province',
-      'streetAddress',
-      'postalCode',
-    ],
-  },
-];
-
-@withFormFields(null, fieldGroups)
-@withModelValidations(validations)
-export default class PkiRoleModel extends Model {
-  get useOpenAPI() {
-    // must be a getter so it can be accessed in path-help.js
-    return true;
-  }
-  getHelpUrl(backend) {
-    return `/v1/${backend}/roles/example?help=1`;
+    ];
+    if (this.version.isCommunity) {
+      const entFields = ['noStoreMetadata'];
+      defaultArray = defaultArray.filter((field) => !entFields.includes(field));
+    }
+    return this._expandGroups([
+      {
+        default: defaultArray,
+      },
+      {
+        'Domain handling': [
+          'allowedDomains',
+          'allowedDomainsTemplate',
+          'allowBareDomains',
+          'allowSubdomains',
+          'allowGlobDomains',
+          'allowWildcardCertificates',
+          'allowLocalhost', // default: true (returned true by OpenApi)
+          'allowAnyName',
+          'enforceHostnames', // default: true (returned true by OpenApi)
+        ],
+      },
+      {
+        'Key parameters': ['keyType', 'keyBits', 'signatureBits'],
+      },
+      {
+        'Key usage': ['keyUsage', 'extKeyUsage', 'extKeyUsageOids'],
+      },
+      { 'Policy identifiers': ['policyIdentifiers'] },
+      {
+        'Subject Alternative Name (SAN) Options': [
+          'allowIpSans',
+          'allowedUriSans',
+          'allowUriSansTemplate',
+          'allowedOtherSans',
+        ],
+      },
+      {
+        'Additional subject fields': [
+          'allowedUserIds',
+          'allowedSerialNumbers',
+          'serialNumberSource',
+          'requireCn',
+          'useCsrCommonName',
+          'useCsrSans',
+          'ou',
+          'organization',
+          'country',
+          'locality',
+          'province',
+          'streetAddress',
+          'postalCode',
+        ],
+      },
+    ]);
   }
 
-  @attr('string', { readOnly: true }) backend;
-
   /* Overriding OpenApi default options */
   @attr('string', {
     label: 'Role name',
@@ -146,6 +150,14 @@ export default class PkiRoleModel extends Model {
   })
   noStore;
 
+  @attr('boolean', {
+    label: 'Do not store certificate metadata in storage backend',
+    detailsLabel: 'Store metadata in storage backend', // template reverses value
+    subText:
+      'We don’t recommend storing metadata, since this information creates overhead in storage, and requires clean up.',
+  })
+  noStoreMetadata;
+
   @attr('boolean', {
     label: 'Basic constraints valid for non-CA',
     detailsLabel: 'Add basic constraints',
@@ -233,13 +245,30 @@ export default class PkiRoleModel extends Model {
 
   /* Overriding OpenApi Additional subject field options */
   @attr({
-    label: 'Allowed serial numbers',
     subText:
       'A list of allowed serial numbers to be requested during certificate issuance. Shell-style globbing is supported. If empty, custom-specified serial numbers will be forbidden.',
     editType: 'stringArray',
   })
   allowedSerialNumbers;
 
+  @attr({
+    editType: 'radio',
+    possibleValues: [
+      {
+        value: 'json-csr',
+        subText:
+          'The subject serial number will be taken from the "serial_number" parameter and fall back to the serial number in the CSR.',
+      },
+      {
+        value: 'json',
+        subText:
+          'The subject serial number will be taken from the "serial_number" parameter but will ignore any value in the CSR.',
+      },
+    ],
+    defaultValue: 'json-csr',
+  })
+  serialNumberSource;
+
   @attr('boolean', {
     label: 'Require common name',
     subText: 'If set to false, common name will be optional when generating a certificate.',
diff --git a/ui/app/models/pki/sign-intermediate.js b/ui/app/models/pki/sign-intermediate.js
index 6cc9fc6b576..a3c18b087b0 100644
--- a/ui/app/models/pki/sign-intermediate.js
+++ b/ui/app/models/pki/sign-intermediate.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,15 +19,11 @@ const validations = {
   'excludeCnFromSans',
   'customTtl',
   'notBeforeDuration',
+  'enforceLeafNotAfterBehavior',
   'format',
-  'permittedDnsDomains',
   'maxPathLength',
 ])
 export default class PkiSignIntermediateModel extends PkiCertificateBaseModel {
-  getHelpUrl(backend) {
-    return `/v1/${backend}/issuer/example/sign-intermediate?help=1`;
-  }
-
   @attr issuerRef;
 
   @attr('string', {
@@ -56,12 +52,10 @@ export default class PkiSignIntermediateModel extends PkiCertificateBaseModel {
   })
   notBeforeDuration;
 
-  @attr({
-    label: 'Permitted DNS domains',
-    subText:
-      'DNS domains for which certificates are allowed to be issued or signed by this CA certificate. Enter each value as a new input.',
+  @attr('boolean', {
+    subText: "Do not truncate the NotAfter field, use the issuer's configured leaf_not_after_behavior",
   })
-  permittedDnsDomains;
+  enforceLeafNotAfterBehavior;
 
   @attr({
     subText: 'Specifies the maximum path length to encode in the generated certificate. -1 means no limit',
@@ -69,6 +63,49 @@ export default class PkiSignIntermediateModel extends PkiCertificateBaseModel {
   })
   maxPathLength;
 
+  /* Name constraint overrides */
+  @attr({
+    subText: 'DNS domains for which certificates are allowed to be issued or signed by this CA certificate.',
+  })
+  permittedDnsDomains;
+
+  @attr({
+    subText: 'Domains for which this certificate is not allowed to sign or issue child certificates.',
+  })
+  excludedDnsDomains;
+
+  @attr({
+    subText: 'Email addresses for which this certificate is not allowed to sign or issue child certificates.',
+  })
+  excludedEmailAddresses;
+
+  @attr({
+    subText:
+      'IP ranges for which this certificate is not allowed to sign or issue child certificates. Ranges must be specified in the notation of IP address and prefix length, such as "192.0.2.0/24" or "2001:db8::/32", as defined in RFC 4632 and RFC 4291.',
+  })
+  excludedIpRanges;
+
+  @attr({
+    subText: 'URI domains for which this certificate is not allowed to sign or issue child certificates.',
+  })
+  excludedUriDomains;
+
+  @attr({
+    subText: 'Email addresses for which this certificate is allowed to sign or issue child certificates.',
+  })
+  permittedEmailAddresses;
+
+  @attr({
+    subText:
+      'IP ranges for which this certificate is allowed to sign or issue child certificates. Ranges must be specified in the notation of IP address and prefix length, such as "192.0.2.0/24" or "2001:db8::/32", as defined in RFC 4632 and RFC 4291.',
+  })
+  permittedIpRanges;
+
+  @attr({
+    subText: 'URI domains for which this certificate is allowed to sign or issue child certificates.',
+  })
+  permittedUriDomains;
+
   /* Signing Options overrides */
   @attr({
     label: 'Use PSS',
diff --git a/ui/app/models/pki/tidy.js b/ui/app/models/pki/tidy.js
index 3d632c9a88b..10518c10f20 100644
--- a/ui/app/models/pki/tidy.js
+++ b/ui/app/models/pki/tidy.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,11 +16,12 @@ export default class PkiTidyModel extends Model {
     label: 'Tidy ACME enabled',
     labelDisabled: 'Tidy ACME disabled',
     mapToBoolean: 'tidyAcme',
-    helperTextDisabled: 'Tidying of ACME accounts, orders and authorizations is disabled',
+    helperTextDisabled: 'Tidying of ACME accounts, orders and authorizations is disabled.',
     helperTextEnabled:
       'The amount of time that must pass after creation that an account with no orders is marked revoked, and the amount of time after being marked revoked or deactivated.',
     detailsLabel: 'ACME account safety buffer',
     formatTtl: true,
+    defaultValue: '720h',
   })
   acmeAccountSafetyBuffer;
 
@@ -30,25 +31,45 @@ export default class PkiTidyModel extends Model {
   })
   tidyAcme;
 
+  // * auto tidy only fields
   @attr('boolean', {
     label: 'Automatic tidy enabled',
-    defaultValue: false,
+    labelDisabled: 'Automatic tidy disabled',
+    helperTextDisabled: 'Automatic tidy operations will not run.',
   })
-  enabled; // auto-tidy only
+  enabled; // renders outside FormField loop as a toggle, auto tidy fields only render if enabled
 
   @attr({
-    label: 'Automatic tidy enabled',
-    labelDisabled: 'Automatic tidy disabled',
-    mapToBoolean: 'enabled',
+    editType: 'ttl',
     helperTextEnabled:
       'Sets the interval_duration between automatic tidy operations; note that this is from the end of one operation to the start of the next.',
-    helperTextDisabled: 'Automatic tidy operations will not run.',
-    detailsLabel: 'Automatic tidy duration',
+    hideToggle: true,
     formatTtl: true,
   })
-  intervalDuration; // auto-tidy only
+  intervalDuration;
 
-  @attr('string', {
+  @attr({
+    label: 'Minimum startup backoff duration',
+    editType: 'ttl',
+    helperTextEnabled:
+      'Sets the min_startup_backoff_duration field which forces the minimum delay after Vault startup auto-tidy can run.',
+    hideToggle: true,
+    formatTtl: true,
+  })
+  minStartupBackoffDuration;
+
+  @attr({
+    label: 'Maximum startup backoff duration',
+    editType: 'ttl',
+    helperTextEnabled:
+      'Sets the max_startup_backoff_duration field which forces the maximum delay after Vault startup auto-tidy can run.',
+    hideToggle: true,
+    formatTtl: true,
+  })
+  maxStartupBackoffDuration;
+  // * end of auto-tidy only fields
+
+  @attr({
     editType: 'ttl',
     helperTextEnabled:
       'Specifies a duration that issuers should be kept for, past their NotAfter validity period. Defaults to 365 days (8760 hours).',
@@ -75,7 +96,7 @@ export default class PkiTidyModel extends Model {
   })
   revocationQueueSafetyBuffer; // enterprise only
 
-  @attr('string', {
+  @attr({
     editType: 'ttl',
     helperTextEnabled:
       'For a certificate to be expunged, the time must be after the expiration time of the certificate (according to the local clock) plus the safety buffer. Defaults to 72 hours.',
@@ -87,12 +108,20 @@ export default class PkiTidyModel extends Model {
   @attr('boolean', { label: 'Tidy the certificate store' })
   tidyCertStore;
 
+  @attr('boolean')
+  tidyCertMetadata;
+
   @attr('boolean', {
     label: 'Tidy cross-cluster revoked certificates',
     subText: 'Remove expired, cross-cluster revocation entries.',
   })
   tidyCrossClusterRevokedCerts; // enterprise only
 
+  @attr('boolean', {
+    label: 'Tidy CMPv2 nonce store',
+  })
+  tidyCmpv2NonceStore; // enterprise only
+
   @attr('boolean', {
     subText: 'Automatically remove expired issuers after the issuer safety buffer duration has elapsed.',
   })
@@ -121,25 +150,24 @@ export default class PkiTidyModel extends Model {
   })
   tidyRevokedCerts;
 
-  get useOpenAPI() {
-    return true;
-  }
-
-  getHelpUrl(backend) {
-    return `/v1/${backend}/config/auto-tidy?help=1`;
-  }
-
   get allGroups() {
-    const groups = [{ autoTidy: ['enabled', 'intervalDuration'] }, ...this.sharedFields];
+    const groups = [{ autoTidy: ['enabled', ...this.autoTidyConfigFields] }, ...this.sharedFields];
     return this._expandGroups(groups);
   }
 
+  // fields that are specific to auto-tidy
+  get autoTidyConfigFields() {
+    // 'enabled' is not included here because it is responsible for hiding/showing these params and renders separately in the form
+    return ['intervalDuration', 'minStartupBackoffDuration', 'maxStartupBackoffDuration'];
+  }
+
   // shared between auto and manual tidy operations
   get sharedFields() {
     const groups = [
       {
         'Universal operations': [
           'tidyCertStore',
+          'tidyCertMetadata',
           'tidyRevokedCerts',
           'tidyRevokedCertIssuerAssociations',
           'safetyBuffer',
@@ -158,6 +186,7 @@ export default class PkiTidyModel extends Model {
         'Cross-cluster operations': [
           'tidyRevocationQueue',
           'tidyCrossClusterRevokedCerts',
+          'tidyCmpv2NonceStore',
           'revocationQueueSafetyBuffer',
         ],
       });
diff --git a/ui/app/models/policy.js b/ui/app/models/policy.js
index 663cd3959a4..5616272a772 100644
--- a/ui/app/models/policy.js
+++ b/ui/app/models/policy.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/policy/acl.js b/ui/app/models/policy/acl.js
index c4d3f671265..85b1bcf9837 100644
--- a/ui/app/models/policy/acl.js
+++ b/ui/app/models/policy/acl.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/policy/egp.js b/ui/app/models/policy/egp.js
index 6351615a374..f1959980a3f 100644
--- a/ui/app/models/policy/egp.js
+++ b/ui/app/models/policy/egp.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/policy/rgp.js b/ui/app/models/policy/rgp.js
index f4a06369e6d..c3c6656d07e 100644
--- a/ui/app/models/policy/rgp.js
+++ b/ui/app/models/policy/rgp.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/raft-join.js b/ui/app/models/raft-join.js
index 195ed236f5c..c4a760e230b 100644
--- a/ui/app/models/raft-join.js
+++ b/ui/app/models/raft-join.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/replication-attributes.js b/ui/app/models/replication-attributes.js
index fd314943ca0..ee90bbac5c4 100644
--- a/ui/app/models/replication-attributes.js
+++ b/ui/app/models/replication-attributes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/replication-mode.js b/ui/app/models/replication-mode.js
index 22499f055e4..ccac405300a 100644
--- a/ui/app/models/replication-mode.js
+++ b/ui/app/models/replication-mode.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/role-aws.js b/ui/app/models/role-aws.js
index fc4ae9050ad..a6e0e67ade7 100644
--- a/ui/app/models/role-aws.js
+++ b/ui/app/models/role-aws.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -66,7 +66,7 @@ export default Model.extend({
       iam_user: ['name', 'credentialType', 'policyArns', 'policyDocument'],
       assumed_role: ['name', 'credentialType', 'roleArns', 'policyDocument'],
       federation_token: ['name', 'credentialType', 'policyDocument'],
-      session_token: [],
+      session_token: ['name', 'credentialType'],
     };
 
     return expandAttributeMeta(this, keysForType[credentialType]);
diff --git a/ui/app/models/role-jwt.js b/ui/app/models/role-jwt.js
index 965364848f0..68036f70d85 100644
--- a/ui/app/models/role-jwt.js
+++ b/ui/app/models/role-jwt.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,6 +13,7 @@ const DOMAIN_STRINGS = {
   'ping.com': 'Ping',
   'okta.com': 'Okta',
   'auth0.com': 'Auth0',
+  'login.microsoftonline.com': 'Azure',
 };
 
 const PROVIDER_WITH_LOGO = {
@@ -21,6 +22,7 @@ const PROVIDER_WITH_LOGO = {
   Google: 'google',
   Okta: 'okta',
   Auth0: 'auth0',
+  Azure: 'azure',
 };
 
 export { DOMAIN_STRINGS, PROVIDER_WITH_LOGO };
diff --git a/ui/app/models/role-saml.js b/ui/app/models/role-saml.js
deleted file mode 100644
index 430845b094a..00000000000
--- a/ui/app/models/role-saml.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Model, { attr } from '@ember-data/model';
-
-export default class RoleSamlModel extends Model {
-  @attr('string') ssoServiceURL;
-  @attr('string') tokenPollID;
-  @attr('string') clientVerifier;
-}
diff --git a/ui/app/models/role-ssh.js b/ui/app/models/role-ssh.js
index e8f2293ad76..3e0141cba29 100644
--- a/ui/app/models/role-ssh.js
+++ b/ui/app/models/role-ssh.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -40,6 +40,7 @@ const CA_FIELDS = [
   'defaultExtensions',
   'allowBareDomains',
   'allowSubdomains',
+  'allowEmptyPrincipals',
   'allowUserKeyIds',
   'keyIdFormat',
   'notBeforeDuration',
@@ -47,10 +48,6 @@ const CA_FIELDS = [
 ];
 
 export default Model.extend({
-  useOpenAPI: true,
-  getHelpUrl: function (backend) {
-    return `/v1/${backend}/roles/example?help=1`;
-  },
   zeroAddress: attr('boolean', {
     readOnly: true,
   }),
@@ -122,6 +119,10 @@ export default Model.extend({
     helpText:
       'Specifies if host certificates that are requested are allowed to be subdomains of those listed in Allowed Domains',
   }),
+  allowEmptyPrincipals: attr('boolean', {
+    helpText:
+      'Allow signing certificates with no valid principals (e.g. any valid principal). For backwards compatibility only. The default of false is highly recommended.',
+  }),
   allowUserKeyIds: attr('boolean', {
     helpText: 'Specifies if users can override the key ID for a signed certificate with the "key_id" field',
   }),
diff --git a/ui/app/models/secret-engine.js b/ui/app/models/secret-engine.js
index 694beba449e..716a2d944a1 100644
--- a/ui/app/models/secret-engine.js
+++ b/ui/app/models/secret-engine.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,9 @@ import { equal } from '@ember/object/computed'; // eslint-disable-line
 import { withModelValidations } from 'vault/decorators/model-validations';
 import { withExpandedAttributes } from 'vault/decorators/model-expanded-attributes';
 import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
-import { isAddonEngine, allEngines } from 'vault/helpers/mountable-secret-engines';
+import { WHITESPACE_WARNING } from 'vault/utils/forms/validators';
+import { ALL_ENGINES, isAddonEngine } from 'vault/utils/all-engines-metadata';
+import engineDisplayData from 'vault/helpers/engines-display-data';
 
 const LINKED_BACKENDS = supportedSecretBackends();
 
@@ -22,8 +24,7 @@ const validations = {
     { type: 'presence', message: "Path can't be blank." },
     {
       type: 'containsWhiteSpace',
-      message:
-        "Path contains whitespace. If this is desired, you'll need to encode it with %20 in API requests.",
+      message: WHITESPACE_WARNING('path'),
       level: 'warn',
     },
   ],
@@ -68,14 +69,6 @@ export default class SecretEngineModel extends Model {
   })
   version;
 
-  // SSH specific attributes
-  @attr('string') privateKey;
-  @attr('string') publicKey;
-  @attr('boolean', {
-    defaultValue: true,
-  })
-  generateSigningKey;
-
   // AWS specific attributes
   @attr('string') lease;
   @attr('string') leaseMax;
@@ -107,6 +100,14 @@ export default class SecretEngineModel extends Model {
   })
   deleteVersionAfter;
 
+  // `plugin_version` represents the version specified at mount time (if any), and is only used for external plugins.
+  // For built-in plugins, this field is intentionally left empty to simplify upgrades.
+  //
+  // `running_plugin_version` reflects the actual version of the plugin currently running,
+  // regardless of whether it is built-in or external. This provides a reliable source of truth
+  // and is why we are surfacing it over plugin_version.
+  @attr('string') runningPluginVersion;
+
   /* GETTERS */
   get isV2KV() {
     return this.version === 2 && (this.engineType === 'kv' || this.engineType === 'generic');
@@ -123,7 +124,7 @@ export default class SecretEngineModel extends Model {
   }
 
   get icon() {
-    const engineData = allEngines().find((engine) => engine.type === this.engineType);
+    const engineData = engineDisplayData(this.engineType);
 
     return engineData?.glyph || 'lock';
   }
@@ -145,19 +146,29 @@ export default class SecretEngineModel extends Model {
       return 'vault.cluster.secrets.backend.overview';
     }
     if (isAddonEngine(this.engineType, this.version)) {
-      const { engineRoute } = allEngines().find((engine) => engine.type === this.engineType);
-      return `vault.cluster.secrets.backend.${engineRoute}`;
+      return `vault.cluster.secrets.backend.${engineDisplayData(this.engineType).engineRoute}`;
+    }
+    if (this.isV2KV) {
+      // if it's KV v2 but not registered as an addon, it's type generic
+      return 'vault.cluster.secrets.backend.kv.list';
     }
     return `vault.cluster.secrets.backend.list-root`;
   }
 
+  get backendConfigurationLink() {
+    if (isAddonEngine(this.engineType, this.version)) {
+      return `vault.cluster.secrets.backend.${this.engineType}.configuration`;
+    }
+    return `vault.cluster.secrets.backend.configuration`;
+  }
+
   get localDisplay() {
     return this.local ? 'local' : 'replicated';
   }
 
   get formFields() {
     const type = this.engineType;
-    const fields = ['type', 'path', 'description', 'accessor', 'local', 'sealWrap'];
+    const fields = ['type', 'path', 'description', 'accessor', 'runningPluginVersion', 'local', 'sealWrap'];
     // no ttl options for keymgmt
     if (type !== 'keymgmt') {
       fields.push('config.defaultLeaseTtl', 'config.maxLeaseTtl');
@@ -176,6 +187,10 @@ export default class SecretEngineModel extends Model {
     if (type === 'kv' && parseInt(this.version, 10) === 2) {
       fields.push('casRequired', 'deleteVersionAfter', 'maxVersions');
     }
+    // For WIF Secret engines, allow users to set the identity token key when mounting the engine.
+    if (engineDisplayData(type)?.isWIF) {
+      fields.push('config.identityTokenKey');
+    }
     return fields;
   }
 
@@ -225,6 +240,17 @@ export default class SecretEngineModel extends Model {
         // no ttl options for keymgmt
         optionFields = [...CORE_OPTIONS, 'config.allowedManagedKeys', ...STANDARD_CONFIG];
         break;
+      case ALL_ENGINES.find((engine) => engine.type === this.engineType && engine.isWIF)?.type:
+        defaultFields = ['path'];
+        optionFields = [
+          ...CORE_OPTIONS,
+          'config.defaultLeaseTtl',
+          'config.maxLeaseTtl',
+          'config.identityTokenKey',
+          'config.allowedManagedKeys',
+          ...STANDARD_CONFIG,
+        ];
+        break;
       default:
         defaultFields = ['path'];
         optionFields = [
@@ -246,24 +272,6 @@ export default class SecretEngineModel extends Model {
   }
 
   /* ACTIONS */
-  saveCA(options) {
-    if (this.type !== 'ssh') {
-      return;
-    }
-    if (options.isDelete) {
-      this.privateKey = null;
-      this.publicKey = null;
-      this.generateSigningKey = false;
-    }
-    return this.save({
-      adapterOptions: {
-        options: options,
-        apiPath: 'config/ca',
-        attrsToSend: ['privateKey', 'publicKey', 'generateSigningKey'],
-      },
-    });
-  }
-
   saveZeroAddressConfig() {
     return this.save({
       adapterOptions: {
diff --git a/ui/app/models/secret.js b/ui/app/models/secret.js
index e205c62b226..305ed332942 100644
--- a/ui/app/models/secret.js
+++ b/ui/app/models/secret.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -24,10 +24,6 @@ export default Model.extend(KeyMixin, {
     });
   }),
 
-  dataAsJSONString: computed('secretData', function () {
-    return JSON.stringify(this.secretData, null, 2);
-  }),
-
   isAdvancedFormat: computed('secretData', function () {
     const data = this.secretData;
     return data && Object.keys(data).some((key) => typeof data[key] !== 'string');
diff --git a/ui/app/models/server.js b/ui/app/models/server.js
index b9b5285fb0d..b4797fc8419 100644
--- a/ui/app/models/server.js
+++ b/ui/app/models/server.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/ssh-otp-credential.js b/ui/app/models/ssh-otp-credential.js
index 13b715589d8..eef66abe14c 100644
--- a/ui/app/models/ssh-otp-credential.js
+++ b/ui/app/models/ssh-otp-credential.js
@@ -1,29 +1,27 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { reads } from '@ember/object/computed';
 import Model, { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
-import { expandAttributeMeta } from 'vault/utils/field-to-attrs';
-const CREATE_FIELDS = ['username', 'ip'];
+import { withExpandedAttributes } from 'vault/decorators/model-expanded-attributes';
 
-const DISPLAY_FIELDS = ['username', 'ip', 'key', 'keyType', 'port'];
-export default Model.extend({
-  role: attr('object', {
+@withExpandedAttributes()
+export default class SshOtpCredential extends Model {
+  @attr('object', {
     readOnly: true,
-  }),
-  ip: attr('string', {
+  })
+  role;
+  @attr('string', {
     label: 'IP Address',
-  }),
-  username: attr('string'),
-  key: attr('string'),
-  keyType: attr('string'),
-  port: attr('number'),
-  attrs: computed('key', function () {
-    const keys = this.key ? DISPLAY_FIELDS.slice(0) : CREATE_FIELDS.slice(0);
-    return expandAttributeMeta(this, keys);
-  }),
-  toCreds: reads('key'),
-});
+  })
+  ip;
+  @attr('string') username;
+  @attr('string', { masked: true }) key;
+  @attr('string') keyType;
+  @attr('number') port;
+
+  get toCreds() {
+    return this.key;
+  }
+}
diff --git a/ui/app/models/ssh-sign.js b/ui/app/models/ssh-sign.js
index 260eabf2ce3..65d79680b03 100644
--- a/ui/app/models/ssh-sign.js
+++ b/ui/app/models/ssh-sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -30,7 +30,10 @@ export default Model.extend({
     label: 'TTL',
     editType: 'ttl',
   }),
-  validPrincipals: attr('string'),
+  validPrincipals: attr('string', {
+    helpText:
+      'Specifies valid principals, either usernames or hostnames, that the certificate should be signed for. Required unless the role has specified allow_empty_principals.',
+  }),
   certType: attr('string', {
     defaultValue: 'user',
     label: 'Certificate Type',
diff --git a/ui/app/models/sync/association.js b/ui/app/models/sync/association.js
index d32c2cd29a9..0803753bb20 100644
--- a/ui/app/models/sync/association.js
+++ b/ui/app/models/sync/association.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/sync/destination.js b/ui/app/models/sync/destination.js
index 086bd69e222..858c5a719a1 100644
--- a/ui/app/models/sync/destination.js
+++ b/ui/app/models/sync/destination.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/sync/destinations/aws-sm.js b/ui/app/models/sync/destinations/aws-sm.js
index 4b38875a261..27cfa685560 100644
--- a/ui/app/models/sync/destinations/aws-sm.js
+++ b/ui/app/models/sync/destinations/aws-sm.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,7 @@ import SyncDestinationModel from '../destination';
 import { attr } from '@ember-data/model';
 import { withFormFields } from 'vault/decorators/model-form-fields';
 
+// displayFields are used on the destination details view
 const displayFields = [
   // connection details
   'name',
@@ -20,11 +21,13 @@ const displayFields = [
   'secretNameTemplate',
   'customTags',
 ];
+// formFieldGroups are used on the create-edit destination view
 const formFieldGroups = [
   {
-    default: ['name', 'region', 'roleArn', 'externalId', 'granularity', 'secretNameTemplate', 'customTags'],
+    default: ['name', 'region', 'roleArn', 'externalId'],
   },
   { Credentials: ['accessKeyId', 'secretAccessKey'] },
+  { 'Advanced configuration': ['granularity', 'secretNameTemplate', 'customTags'] },
 ];
 @withFormFields(displayFields, formFieldGroups)
 export default class SyncDestinationsAwsSecretsManagerModel extends SyncDestinationModel {
@@ -32,6 +35,8 @@ export default class SyncDestinationsAwsSecretsManagerModel extends SyncDestinat
     label: 'Access key ID',
     subText:
       'Access key ID to authenticate against the secrets manager. If empty, Vault will use the AWS_ACCESS_KEY_ID environment variable if configured.',
+    sensitive: true,
+    noCopy: true,
   })
   accessKeyId; // obfuscated, never returned by API
 
@@ -39,6 +44,8 @@ export default class SyncDestinationsAwsSecretsManagerModel extends SyncDestinat
     label: 'Secret access key',
     subText:
       'Secret access key to authenticate against the secrets manager. If empty, Vault will use the AWS_SECRET_ACCESS_KEY environment variable if configured.',
+    sensitive: true,
+    noCopy: true,
   })
   secretAccessKey; // obfuscated, never returned by API
 
diff --git a/ui/app/models/sync/destinations/azure-kv.js b/ui/app/models/sync/destinations/azure-kv.js
index 42de9a17300..8290c0824d7 100644
--- a/ui/app/models/sync/destinations/azure-kv.js
+++ b/ui/app/models/sync/destinations/azure-kv.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import SyncDestinationModel from '../destination';
 import { attr } from '@ember-data/model';
 import { withFormFields } from 'vault/decorators/model-form-fields';
-
+// displayFields are used on the destination details view
 const displayFields = [
   // connection details
   'name',
@@ -20,20 +20,13 @@ const displayFields = [
   'secretNameTemplate',
   'customTags',
 ];
+// formFieldGroups are used on the create-edit destination view
 const formFieldGroups = [
   {
-    default: [
-      'name',
-      'keyVaultUri',
-      'tenantId',
-      'cloud',
-      'clientId',
-      'granularity',
-      'secretNameTemplate',
-      'customTags',
-    ],
+    default: ['name', 'keyVaultUri', 'tenantId', 'cloud', 'clientId'],
   },
   { Credentials: ['clientSecret'] },
+  { 'Advanced configuration': ['granularity', 'secretNameTemplate', 'customTags'] },
 ];
 @withFormFields(displayFields, formFieldGroups)
 export default class SyncDestinationsAzureKeyVaultModel extends SyncDestinationModel {
@@ -55,6 +48,8 @@ export default class SyncDestinationsAzureKeyVaultModel extends SyncDestinationM
   @attr('string', {
     subText:
       'Client secret of an Azure app registration. If empty, Vault will use the AZURE_CLIENT_SECRET environment variable if configured.',
+    sensitive: true,
+    noCopy: true,
   })
   clientSecret; // obfuscated, never returned by API
 
diff --git a/ui/app/models/sync/destinations/gcp-sm.js b/ui/app/models/sync/destinations/gcp-sm.js
index 03f70ac6225..09b4025a456 100644
--- a/ui/app/models/sync/destinations/gcp-sm.js
+++ b/ui/app/models/sync/destinations/gcp-sm.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import SyncDestinationModel from '../destination';
 import { attr } from '@ember-data/model';
 import { withFormFields } from 'vault/decorators/model-form-fields';
-
+// displayFields are used on the destination details view
 const displayFields = [
   // connection details
   'name',
@@ -17,9 +17,11 @@ const displayFields = [
   'secretNameTemplate',
   'customTags',
 ];
+// formFieldGroups are used on the create-edit destination view
 const formFieldGroups = [
-  { default: ['name', 'projectId', 'granularity', 'secretNameTemplate', 'customTags'] },
+  { default: ['name', 'projectId'] },
   { Credentials: ['credentials'] },
+  { 'Advanced configuration': ['granularity', 'secretNameTemplate', 'customTags'] },
 ];
 @withFormFields(displayFields, formFieldGroups)
 export default class SyncDestinationsGoogleCloudSecretManagerModel extends SyncDestinationModel {
@@ -37,7 +39,7 @@ export default class SyncDestinationsGoogleCloudSecretManagerModel extends SyncD
     editType: 'file',
     docLink: '/vault/docs/secrets/gcp#authentication',
   })
-  credentials; // obfuscated, never returned by API
+  credentials; // obfuscated, never returned by API. Masking handled by EnableInput component
 
   @attr('object', {
     subText:
diff --git a/ui/app/models/sync/destinations/gh.js b/ui/app/models/sync/destinations/gh.js
index a8db62a9a80..d5a56403034 100644
--- a/ui/app/models/sync/destinations/gh.js
+++ b/ui/app/models/sync/destinations/gh.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import SyncDestinationModel from '../destination';
 import { attr } from '@ember-data/model';
 import { withFormFields } from 'vault/decorators/model-form-fields';
-
+// displayFields are used on the destination details view
 const displayFields = [
   // connection details
   'name',
@@ -17,9 +17,12 @@ const displayFields = [
   'granularity',
   'secretNameTemplate',
 ];
+
+// formFieldGroups are used on the create-edit destination view
 const formFieldGroups = [
-  { default: ['name', 'repositoryOwner', 'repositoryName', 'granularity', 'secretNameTemplate'] },
+  { default: ['name', 'repositoryOwner', 'repositoryName'] },
   { Credentials: ['accessToken'] },
+  { 'Advanced configuration': ['granularity', 'secretNameTemplate'] },
 ];
 
 @withFormFields(displayFields, formFieldGroups)
@@ -27,6 +30,8 @@ export default class SyncDestinationsGithubModel extends SyncDestinationModel {
   @attr('string', {
     subText:
       'Personal access token to authenticate to the GitHub repository. If empty, Vault will use the GITHUB_ACCESS_TOKEN environment variable if configured.',
+    sensitive: true,
+    noCopy: true,
   })
   accessToken; // obfuscated, never returned by API
 
diff --git a/ui/app/models/sync/destinations/vercel-project.js b/ui/app/models/sync/destinations/vercel-project.js
index aaa88f671c6..1454d8e04d8 100644
--- a/ui/app/models/sync/destinations/vercel-project.js
+++ b/ui/app/models/sync/destinations/vercel-project.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -21,7 +21,7 @@ const validations = {
   // getter/setter for the deploymentEnvironments model attribute
   deploymentEnvironmentsArray: [{ type: 'presence', message: 'At least one environment is required.' }],
 };
-
+// displayFields are used on the destination details view
 const displayFields = [
   // connection details
   'name',
@@ -33,15 +33,19 @@ const displayFields = [
   'granularity',
   'secretNameTemplate',
 ];
+// formFieldGroups are used on the create-edit destination view
 const formFieldGroups = [
-  { default: ['name', 'projectId', 'teamId', 'deploymentEnvironments', 'granularity', 'secretNameTemplate'] },
+  { default: ['name', 'projectId', 'teamId', 'deploymentEnvironments'] },
   { Credentials: ['accessToken'] },
+  { 'Advanced configuration': ['granularity', 'secretNameTemplate'] },
 ];
 @withModelValidations(validations)
 @withFormFields(displayFields, formFieldGroups)
 export default class SyncDestinationsVercelProjectModel extends SyncDestinationModel {
   @attr('string', {
     subText: 'Vercel API access token with the permissions to manage environment variables.',
+    sensitive: true,
+    noCopy: true,
   })
   accessToken; // obfuscated, never returned by API
 
diff --git a/ui/app/models/test-form-model.js b/ui/app/models/test-form-model.js
index 97ef9342188..13fcf917dad 100644
--- a/ui/app/models/test-form-model.js
+++ b/ui/app/models/test-form-model.js
@@ -1,14 +1,17 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 // this model is just used for integration tests
 //
 
-import AuthMethodModel from './auth-method';
-import { belongsTo } from '@ember-data/model';
+import Model, { belongsTo, attr } from '@ember-data/model';
 
-export default AuthMethodModel.extend({
-  otherConfig: belongsTo('mount-config', { async: false, inverse: null }),
-});
+export default class TestFormModel extends Model {
+  @belongsTo('mount-config', { async: false, inverse: null }) config;
+  @belongsTo('mount-config', { async: false, inverse: null }) otherConfig;
+
+  @attr('string') path;
+  @attr('string', { editType: 'textarea' }) description;
+}
diff --git a/ui/app/models/totp-key.js b/ui/app/models/totp-key.js
new file mode 100644
index 00000000000..50ec916b65e
--- /dev/null
+++ b/ui/app/models/totp-key.js
@@ -0,0 +1,191 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Model, { attr } from '@ember-data/model';
+import { withFormFields } from 'vault/decorators/model-form-fields';
+import { withModelValidations } from 'vault/decorators/model-validations';
+import { withExpandedAttributes } from 'vault/decorators/model-expanded-attributes';
+import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
+import { isPresent } from '@ember/utils';
+
+const validations = {
+  accountName: [
+    {
+      validator(model) {
+        const { generate, accountName } = model;
+        // this is required when generate is true
+        return generate && !isPresent(accountName) ? false : true;
+      },
+      message: "Account name can't be blank when the key is generated by Vault.",
+    },
+    {
+      type: 'containsWhiteSpace',
+      message:
+        "Account name contains whitespace. If this is desired, you'll need to encode it with %20 in API requests.",
+      level: 'warn',
+    },
+  ],
+  issuer: [
+    {
+      validator(model) {
+        const { generate, issuer } = model;
+        // this is required when generate is true
+        return generate && !isPresent(issuer) ? false : true;
+      },
+      message: "Issuer can't be blank when when the key is generated by Vault.",
+    },
+  ],
+  key: [
+    {
+      validator(model) {
+        const { generate, key, url } = model;
+        // this is required when generate is false and url is blank
+        return !generate && !isPresent(url) && !isPresent(key) ? false : true;
+      },
+      message: "Key can't be blank if key is being passed from another service and the URL is empty.",
+    },
+  ],
+  keySize: [{ type: 'number', message: 'Key size must be a number.' }],
+  name: [
+    { type: 'presence', message: "Name can't be blank." },
+    {
+      type: 'containsWhiteSpace',
+      message:
+        "Name contains whitespace. If this is desired, you'll need to encode it with %20 in API requests.",
+      level: 'warn',
+    },
+  ],
+  qrSize: [{ type: 'number', message: 'QR size must be a number' }],
+};
+
+@withModelValidations(validations)
+@withExpandedAttributes()
+@withFormFields()
+export default class TotpKeyModel extends Model {
+  @attr('string', {
+    readOnly: true,
+  })
+  backend;
+
+  @attr('string', {
+    subText: 'Specifies the name for this key.',
+  })
+  name;
+
+  @attr('string', {
+    subText: 'The name of the account associated with the key. Required for keys generated by Vault.',
+  })
+  accountName;
+
+  @attr('string', {
+    possibleValues: ['SHA1', 'SHA256', 'SHA512'],
+    defaultValue: 'SHA1',
+  })
+  algorithm;
+
+  @attr('number', {
+    possibleValues: [6, 8],
+    defaultValue: 6,
+  })
+  digits;
+
+  @attr('string', {
+    subText: `The name of the key's issuing organization. Required for keys generated by Vault.`,
+  })
+  issuer;
+
+  @attr({
+    editType: 'ttl',
+    helperTextEnabled: 'How long each generated TOTP is valid.',
+    defaultValue: 30, // API accepts both an integer as seconds and string with unit e.g 30 || '30s'
+  })
+  period;
+
+  // The generate attr is a boolean. The generateString getter and setter is used only in forms to get and set the boolean via
+  // strings values. The payload params expect the attr to be a boolean value.
+  @attr({
+    label: 'Key Provider',
+    defaultValue: true,
+    editType: 'radio',
+    possibleValues: ['Vault', 'Other service'],
+    fieldValue: 'generateString',
+    subText: 'Specifies if the key should be generated by Vault or passed from another service.',
+  })
+  generate;
+
+  // Used when generate is true
+  @attr('number', {
+    defaultValue: 20,
+  })
+  keySize;
+
+  @attr('number', {
+    possibleValues: [0, 1],
+    defaultValue: 1,
+  })
+  skew;
+
+  @attr('boolean', {
+    editType: 'toggleButton',
+    defaultValue: true,
+    helperTextDisabled: 'Vault will not return QR code and url upon key creation.',
+    helperTextEnabled: 'QR code and URL will be returned upon generating a key.',
+  })
+  exported;
+
+  @attr('number', {
+    label: 'QR size',
+    defaultValue: 200,
+  })
+  qrSize;
+
+  // Used when generate is false
+  @attr('string', {
+    label: 'URL',
+    helpText:
+      'If a URL is provided the other fields can be left empty. E.g. otpauth://totp/Vault:test@test.com?secret=Y64VEVMBTSXCYIWRSHRNDZW62MPGVU2G&issuer=Vault',
+    subText: 'The TOTP key url string that can be used to configure a key.',
+  })
+  url;
+
+  @attr('string', {
+    subText: 'The root key used to generate a TOTP code.',
+  })
+  key;
+
+  // Returned when a key is created as provider
+  @attr('string', {
+    readOnly: true,
+  })
+  barcode;
+
+  get attrs() {
+    const keys = ['accountName', 'name', 'algorithm', 'digits', 'issuer', 'period'];
+    return keys.map((k) => this.allByKey[k]);
+  }
+
+  get generatedAttrs() {
+    const keys = ['url'];
+    return keys.map((k) => this.allByKey[k]);
+  }
+
+  get generateString() {
+    return this.generate ? 'Vault' : 'Other service';
+  }
+
+  set generateString(value) {
+    this.generate = value === 'Vault' ? true : false;
+  }
+
+  @lazyCapabilities(apiPath`${'backend'}/keys/${'id'}`, 'backend', 'id') keyPath;
+
+  get canDelete() {
+    return this.keyPath.get('canDelete');
+  }
+
+  get canRead() {
+    return this.keyPath.get('canRead');
+  }
+}
diff --git a/ui/app/models/transform.js b/ui/app/models/transform.js
index e60d17f571d..cc7e3e276b1 100644
--- a/ui/app/models/transform.js
+++ b/ui/app/models/transform.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/transform/alphabet.js b/ui/app/models/transform/alphabet.js
index 429fa02754c..23f48f1be3e 100644
--- a/ui/app/models/transform/alphabet.js
+++ b/ui/app/models/transform/alphabet.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,11 +10,6 @@ import { expandAttributeMeta } from 'vault/utils/field-to-attrs';
 export default class Alphabet extends Model {
   idPrefix = 'alphabet/';
 
-  get idForNav() {
-    const modelId = this.id || '';
-    return `${this.idPrefix}${modelId}`;
-  }
-
   @attr('string', {
     readOnly: true,
     subText: 'The alphabet name. Keep in mind that spaces are not allowed and this cannot be edited later.',
diff --git a/ui/app/models/transform/role.js b/ui/app/models/transform/role.js
index b23b2df20c2..b4d62a225cc 100644
--- a/ui/app/models/transform/role.js
+++ b/ui/app/models/transform/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/models/transform/template.js b/ui/app/models/transform/template.js
index 606c0323bab..a159c079c1f 100644
--- a/ui/app/models/transform/template.js
+++ b/ui/app/models/transform/template.js
@@ -1,31 +1,31 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Model, { attr } from '@ember-data/model';
-import { computed } from '@ember/object';
 import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
 import { expandAttributeMeta } from 'vault/utils/field-to-attrs';
 
-export default Model.extend({
-  idPrefix: 'template/',
-  idForNav: computed('id', 'idPrefix', function () {
-    const modelId = this.id || '';
-    return `${this.idPrefix}${modelId}`;
-  }),
+export default class TransformTemplate extends Model {
+  idPrefix = 'template/';
 
-  name: attr('string', {
+  @attr('string', {
     readOnly: true,
     subText:
       'Templates allow Vault to determine what and how to capture the value to be transformed. This cannot be edited later.',
-  }),
-  type: attr('string', { defaultValue: 'regex' }),
-  pattern: attr('string', {
+  })
+  name;
+
+  @attr('string', { defaultValue: 'regex' }) type;
+
+  @attr('string', {
     editType: 'regex',
     subText: 'The template’s pattern defines the data format. Expressed in regex.',
-  }),
-  alphabet: attr('array', {
+  })
+  pattern;
+
+  @attr('array', {
     subText:
       'Alphabet defines a set of characters (UTF-8) that is used for FPE to determine the validity of plaintext and ciphertext values. You can choose a built-in one, or create your own.',
     editType: 'searchSelect',
@@ -34,17 +34,22 @@ export default Model.extend({
     label: 'Alphabet',
     models: ['transform/alphabet'],
     selectLimit: 1,
-  }),
-  encodeFormat: attr('string'),
-  decodeFormats: attr(),
-  backend: attr('string', { readOnly: true }),
+  })
+  alphabet;
+
+  @attr('string') encodeFormat;
+  @attr('') decodeFormats;
 
-  readAttrs: computed(function () {
+  @attr('string', { readOnly: true }) backend;
+
+  get readAttrs() {
     const keys = ['name', 'pattern', 'encodeFormat', 'decodeFormats', 'alphabet'];
     return expandAttributeMeta(this, keys);
-  }),
-  writeAttrs: computed(function () {
+  }
+
+  get writeAttrs() {
     return expandAttributeMeta(this, ['name', 'pattern', 'alphabet']);
-  }),
-  updatePath: lazyCapabilities(apiPath`${'backend'}/template/${'id'}`, 'backend', 'id'),
-});
+  }
+
+  @lazyCapabilities(apiPath`${'backend'}/template/${'id'}`, 'backend') updatePath;
+}
diff --git a/ui/app/models/transit-key.js b/ui/app/models/transit-key.js
index 8cd8b1e4b9d..e8c468f96d7 100644
--- a/ui/app/models/transit-key.js
+++ b/ui/app/models/transit-key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -122,11 +122,6 @@ export default class TransitKeyModel extends Model {
       });
   }
 
-  get canDelete() {
-    const deleteAttrChanged = Boolean(this.changedAttributes().deletionAllowed);
-    return this.deletionAllowed && deleteAttrChanged === false;
-  }
-
   get keyVersions() {
     let maxVersion = Math.max(...this.validKeyVersions);
     const versions = [];
@@ -181,6 +176,17 @@ export default class TransitKeyModel extends Model {
   get canRead() {
     return this.secretPath.get('canUpdate') !== false;
   }
+  get canUpdate() {
+    return this.secretPath.get('canUpdate') !== false;
+  }
+  get canDelete() {
+    // there's more to just a permissions check here.
+    // must also check if there's a property on the key called deletionAllowed that is set to true
+    const deleteAttrChanged = Boolean(this.changedAttributes().deletionAllowed);
+    const keyAllowedDeletion = this.deletionAllowed && deleteAttrChanged === false;
+    return this.secretPath.get('canDelete') !== false && keyAllowedDeletion;
+  }
+
   get canEdit() {
     return this.secretPath.get('canUpdate') !== false;
   }
diff --git a/ui/app/resources/auth/method.ts b/ui/app/resources/auth/method.ts
new file mode 100644
index 00000000000..067605a9b21
--- /dev/null
+++ b/ui/app/resources/auth/method.ts
@@ -0,0 +1,63 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { baseResourceFactory } from 'vault/resources/base-factory';
+import { service } from '@ember/service';
+import { supportedTypes } from 'vault/utils/auth-form-helpers';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+
+import type { Mount } from 'vault/mount';
+import type VersionService from 'vault/services/version';
+import type NamespaceService from 'vault/services/namespace';
+import type { PathInfo } from 'vault/utils/openapi-helpers';
+
+export default class AuthMethodResource extends baseResourceFactory<Mount>() {
+  @service declare readonly version: VersionService;
+  @service declare readonly namespace: NamespaceService;
+
+  id: string;
+  declare paths: PathInfo;
+
+  constructor(data: Mount, context: unknown) {
+    super(data, context);
+    // strip trailing slash from path for id since it is used in routing
+    this.id = data.path.replace(/\/$/, '');
+  }
+
+  // namespaces introduced types with a `ns_` prefix for built-in engines
+  // so we need to strip that to normalize the type
+  get methodType() {
+    return this.type.replace(/^ns_/, '');
+  }
+
+  get icon() {
+    // methodType refers to the backend type (e.g., "aws", "azure")
+    const engineData = engineDisplayData(this.methodType);
+    return engineData?.glyph || 'users';
+  }
+
+  get directLoginLink() {
+    const ns = this.namespace.path;
+    const nsQueryParam = ns ? `namespace=${encodeURIComponent(ns)}&` : '';
+    const isSupported = supportedTypes(this.version.isEnterprise).includes(this.methodType);
+    return isSupported
+      ? `${window.origin}/ui/vault/auth?${nsQueryParam}with=${encodeURIComponent(this.path)}`
+      : '';
+  }
+
+  // used when the `auth` prefix is important,
+  // currently only when setting perf mount filtering
+  get apiPath() {
+    return `auth/${this.path}`;
+  }
+
+  get localDisplay() {
+    return this.local ? 'local' : 'replicated';
+  }
+
+  get supportsUserLockoutConfig() {
+    return ['approle', 'ldap', 'userpass'].includes(this.methodType);
+  }
+}
diff --git a/ui/app/resources/base-factory.ts b/ui/app/resources/base-factory.ts
new file mode 100644
index 00000000000..e456563050b
--- /dev/null
+++ b/ui/app/resources/base-factory.ts
@@ -0,0 +1,29 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { getOwner, setOwner } from '@ember/owner';
+
+import type Owner from '@ember/owner';
+
+abstract class BaseResource<T> {
+  // pass data that the resource should represent (typically from an API response) to constructor
+  // object properties will be assigned to class instance
+  // extending classes can define getters and additional properties/methods that are required widely across the app
+  constructor(data: T, context?: unknown) {
+    Object.assign(this, data) as T;
+    // pass in context (this) of Ember class (route, component etc.) where the resource is being constructed
+    // this will be used to set the owner on the class so that services can be injected (if required)
+    if (context) {
+      setOwner(this, getOwner(context) as Owner);
+    }
+  }
+}
+
+// factory that allows for the BaseResource class to be cast to the specific type provided
+// without this the compiler is not aware of the properties set on the class via Object.assign
+// example usage -> export default class SecretsEngineResource extends baseResourceFactory<Mount>() { ... }
+export function baseResourceFactory<T>() {
+  return BaseResource as new (data: T, context?: unknown) => T;
+}
diff --git a/ui/app/resources/mfa/constraint.ts b/ui/app/resources/mfa/constraint.ts
new file mode 100644
index 00000000000..7888c504e22
--- /dev/null
+++ b/ui/app/resources/mfa/constraint.ts
@@ -0,0 +1,75 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import { ParsedMfaConstraint, ParsedMfaMethod } from 'vault/vault/auth/mfa';
+
+/* 
+There is a slight difference between a login enforcement configuration and the data returned in the `mfa_constraints` key when a user is logging in.
+Although there is overlap, there are slight differences between the two and are referred to as MfaConstraint or MfaLoginEnforcement to differentiate between the two.
+ * "MfaConstraint" refers to the enforcement data in the `mfa_constraints` key
+    - the `self_enrollment_enabled` boolean for example is flipped by the backend if a user has already enrolled, 
+      meaning it doesn't just return the config value but whether or not the UI should enter the self-enroll workflow.
+ * "MfaLoginEnforcement" is reserved for parameters used when configuring the enforcement. (see https://developer.hashicorp.com/vault/api-docs/secret/identity/mfa/login-enforcement#create-a-login-enforcement)
+  (The MfaLoginEnforcement resource will exist when we migrate away from the ember data model mfa-login-enforcement )
+*/
+
+export default class MfaConstraint {
+  @tracked name: string;
+  @tracked methods: ParsedMfaMethod[] = [];
+  @tracked selectedMethod: ParsedMfaMethod | undefined = undefined;
+  // These are set on the login enforcement and not the MFA method
+  // because they only correspond to the selectedMethod.
+  @tracked passcode = '';
+  @tracked qrCode = '';
+
+  constructor(constraint: ParsedMfaConstraint) {
+    const { name, methods } = constraint;
+    this.name = name;
+    this.methods = methods;
+    // Only set selectedMethod if there is only one method.
+    // Otherwise, the user must select which method they want to verify with.
+    this.selectedMethod = this.methods.length === 1 ? methods[0] : undefined;
+  }
+
+  @action
+  setPasscode(value: string) {
+    this.passcode = value;
+  }
+
+  @action
+  setSelectedMethod(id: string) {
+    const method = this.methods.find((m) => m.id === id);
+    this.selectedMethod = method;
+  }
+
+  get hasSelfEnrollMethods(): boolean {
+    return !!this.selfEnrollMethods.length;
+  }
+
+  // To be "true", the login enforcement must have a selected method set
+  // and passcode, if applicable.
+  get isSatisfied() {
+    if (this.selectedMethod) {
+      return this.selectedMethod.uses_passcode ? !!this.passcode : true;
+    }
+    return false;
+  }
+
+  get selfEnrollMethods(): ParsedMfaMethod[] | [] {
+    // Self-enrollment is an enterprise only feature and self_enrollment_enabled will always be false for CE
+    // It also returns false if the user already has an MFA secret (meaning they have already enrolled.)
+    return this.methods.filter((m) => m?.self_enrollment_enabled);
+  }
+
+  get validateData() {
+    return {
+      methods: this.methods,
+      passcode: this.passcode,
+      selectedMethod: this.selectedMethod,
+    };
+  }
+}
diff --git a/ui/app/resources/secrets/engine.ts b/ui/app/resources/secrets/engine.ts
new file mode 100644
index 00000000000..0a63561c3d8
--- /dev/null
+++ b/ui/app/resources/secrets/engine.ts
@@ -0,0 +1,104 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { baseResourceFactory } from 'vault/resources/base-factory';
+import {
+  supportedSecretBackends,
+  SupportedSecretBackendsEnum,
+} from 'vault/helpers/supported-secret-backends';
+import { isAddonEngine } from 'vault/utils/all-engines-metadata';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+
+import type { Mount } from 'vault/mount';
+
+export const SUPPORTS_RECOVERY = [
+  SupportedSecretBackendsEnum.CUBBYHOLE,
+  SupportedSecretBackendsEnum.KV, // only kv v1
+  SupportedSecretBackendsEnum.DATABASE,
+] as const;
+
+export type RecoverySupportedEngines = (typeof SUPPORTS_RECOVERY)[number];
+
+export default class SecretsEngineResource extends baseResourceFactory<Mount>() {
+  id: string;
+
+  #LIST_EXCLUDED_BACKENDS = ['system', 'identity'];
+
+  constructor(data: Mount) {
+    super(data);
+    // strip trailing slash from path for id since it is used in routing
+    this.id = data.path.replace(/\/$/, '');
+  }
+
+  get version() {
+    const { version } = this.options || {};
+    return version ? Number(version) : 1;
+  }
+
+  get engineType() {
+    return (this.type || '').replace(/^ns_/, '');
+  }
+
+  get icon() {
+    const engineData = engineDisplayData(this.engineType);
+
+    return engineData?.glyph || 'lock';
+  }
+
+  get isV2KV() {
+    return (
+      this.version === 2 &&
+      (this.engineType === SupportedSecretBackendsEnum.KV || this.engineType === 'generic')
+    );
+  }
+
+  get shouldIncludeInList() {
+    return !this.#LIST_EXCLUDED_BACKENDS.includes(this.engineType);
+  }
+
+  get isSupportedBackend() {
+    return supportedSecretBackends().includes(this.engineType as SupportedSecretBackendsEnum);
+  }
+
+  get backendLink() {
+    if (this.engineType === 'database') {
+      return 'vault.cluster.secrets.backend.overview';
+    }
+    if (isAddonEngine(this.engineType, this.version)) {
+      const engine = engineDisplayData(this.engineType);
+      if (engine?.engineRoute) {
+        return `vault.cluster.secrets.backend.${engine.engineRoute}`;
+      }
+    }
+    if (this.isV2KV) {
+      // if it's KV v2 but not registered as an addon, it's type generic
+      return 'vault.cluster.secrets.backend.kv.list';
+    }
+    return `vault.cluster.secrets.backend.list-root`;
+  }
+
+  get backendConfigurationLink() {
+    if (isAddonEngine(this.engineType, this.version)) {
+      return `vault.cluster.secrets.backend.${this.engineType}.configuration`;
+    }
+    return `vault.cluster.secrets.backend.configuration`;
+  }
+
+  get localDisplay() {
+    return this.local ? 'local' : 'replicated';
+  }
+
+  get supportsRecovery() {
+    if (!SUPPORTS_RECOVERY.includes(this.engineType as RecoverySupportedEngines)) {
+      return false;
+    }
+
+    if (this.engineType === SupportedSecretBackendsEnum.KV) {
+      return !this.isV2KV;
+    }
+
+    return true;
+  }
+}
diff --git a/ui/app/router.js b/ui/app/router.js
index af1ceca378f..22a5d4843c8 100644
--- a/ui/app/router.js
+++ b/ui/app/router.js
@@ -1,11 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import EmberRouter from '@ember/routing/router';
 import config from 'vault/config/environment';
-
+import { addDocfyRoutes } from '@docfy/ember';
 export default class Router extends EmberRouter {
   location = config.locationType;
   rootURL = config.rootURL;
@@ -17,6 +17,15 @@ Router.map(function () {
       this.route('dashboard');
       this.mount('config-ui');
       this.mount('sync');
+      this.route('recovery', function () {
+        this.route('snapshots', function () {
+          this.route('load');
+          this.route('snapshot', { path: '/:snapshot_id' }, function () {
+            this.route('manage');
+            this.route('details');
+          });
+        });
+      });
       this.route('oidc-provider-ns', { path: '/*namespace/identity/oidc/provider/:provider_name/authorize' });
       this.route('oidc-provider', { path: '/identity/oidc/provider/:provider_name/authorize' });
       this.route('oidc-callback', { path: '/auth/*auth_path/oidc/callback' });
@@ -29,12 +38,12 @@ Router.map(function () {
       this.route('clients', function () {
         this.route('counts', function () {
           this.route('overview');
-          // this.route('sync'); * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-          this.route('token');
+          this.route('client-list');
         });
         this.route('config');
         this.route('edit');
       });
+      this.route('usage-reporting');
       this.route('storage', { path: '/storage/raft' });
       this.route('storage-restore', { path: '/storage/raft/restore' });
       this.route('settings', function () {
@@ -48,11 +57,6 @@ Router.map(function () {
             this.route('section', { path: '/:section_name' });
           });
         });
-        this.route('mount-secret-backend');
-        this.route('configure-secret-backend', { path: '/secrets/configure/:backend' }, function () {
-          this.route('index', { path: '/' });
-          this.route('section', { path: '/:section_name' });
-        });
       });
       this.route('unseal');
       this.route('tools', function () {
@@ -101,6 +105,7 @@ Router.map(function () {
           this.route('show', { path: '/show/*lease_id' });
         });
         // the outer identity route handles group and entity items
+        // the "identity" routes expect :item_type to be plural
         this.route('identity', { path: '/identity/:item_type' }, function () {
           this.route('index', { path: '/' });
           this.route('create');
@@ -162,7 +167,12 @@ Router.map(function () {
           });
         });
       });
-      this.route('secrets', function () {
+      this.route('secrets-redirect', { path: '/secrets' }); // legacy redirect
+      this.route('secrets', { path: '/secrets-engines' }, function () {
+        this.route('enable', function () {
+          // TODO: Revisit path on create once components are separated - should we specify selected type or just keep it generic as /create?
+          this.route('create', { path: '/:mount_type' });
+        });
         this.route('backends', { path: '/' });
         this.route('backend', { path: '/:backend' }, function () {
           this.mount('kmip');
@@ -171,7 +181,13 @@ Router.map(function () {
           this.mount('ldap');
           this.mount('pki');
           this.route('index', { path: '/' });
-          this.route('configuration');
+          this.route('configuration', function () {
+            this.route('index', { path: '/' }); // this is still used by old engines
+            this.route('general-settings');
+            this.route('plugin-settings');
+            // only CONFIGURABLE_SECRET_ENGINES can be configured and access the edit route
+            this.route('edit');
+          });
           // because globs / params can't be empty,
           // we have to special-case ids of '' with their own routes
           this.route('list-root', { path: '/list/' });
@@ -216,4 +232,7 @@ Router.map(function () {
     });
     this.route('not-found', { path: '/*path' });
   });
+  if (config.environment !== 'production') {
+    addDocfyRoutes(this);
+  }
 });
diff --git a/ui/app/routes/application.js b/ui/app/routes/application.js
index 1e3f4d10601..e20aad6f13c 100644
--- a/ui/app/routes/application.js
+++ b/ui/app/routes/application.js
@@ -1,78 +1,91 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
 import Route from '@ember/routing/route';
+import { action } from '@ember/object';
+
+import config from 'vault/config/environment';
+
 import ControlGroupError from 'vault/lib/control-group-error';
 
-export default Route.extend({
-  controlGroup: service(),
-  routing: service('router'),
-  namespaceService: service('namespace'),
-  featureFlagService: service('featureFlag'),
+export default class ApplicationRoute extends Route {
+  @service analytics;
+  @service controlGroup;
+  @service('router') routing;
+  @service('namespace') namespaceService;
+  @service('flags') flagsService;
 
-  actions: {
-    willTransition() {
-      window.scrollTo(0, 0);
-    },
-    error(error, transition) {
-      const controlGroup = this.controlGroup;
-      if (error instanceof ControlGroupError) {
-        return controlGroup.handleError(error);
-      }
-      if (error.path === '/v1/sys/wrapping/unwrap') {
-        controlGroup.unmarkTokenForUnwrap();
-      }
+  @action
+  willTransition() {
+    window.scrollTo(0, 0);
+  }
+  @action
+  error(error, transition) {
+    const controlGroup = this.controlGroup;
+    // support both types of control group errors until Ember Data is removed
+    if (error instanceof ControlGroupError || error.isControlGroupError) {
+      return controlGroup.handleError(error);
+    }
+    if (error.path === '/v1/sys/wrapping/unwrap') {
+      controlGroup.unmarkTokenForUnwrap();
+    }
 
-      const router = this.routing;
-      //FIXME transition.intent likely needs to be replaced
-      let errorURL = transition.intent.url;
-      const { name, contexts, queryParams } = transition.intent;
+    const router = this.routing;
+    //FIXME transition.intent likely needs to be replaced
+    let errorURL = transition.intent.url;
+    const { name, contexts, queryParams } = transition.intent;
 
-      // If the transition is internal to Ember, we need to generate the URL
-      // from the route parameters ourselves
-      if (!errorURL) {
-        try {
-          errorURL = router.urlFor(name, ...(contexts || []), { queryParams });
-        } catch (e) {
-          // If this fails, something weird is happening with URL transitions
-          errorURL = null;
-        }
-      }
-      // because we're using rootURL, we need to trim this from the front to get
-      // the ember-routeable url
-      if (errorURL) {
-        errorURL = errorURL.replace('/ui', '');
+    // If the transition is internal to Ember, we need to generate the URL
+    // from the route parameters ourselves
+    if (!errorURL) {
+      try {
+        errorURL = router.urlFor(name, ...(contexts || []), { queryParams });
+      } catch (e) {
+        // If this fails, something weird is happening with URL transitions
+        errorURL = null;
       }
+    }
+    // because we're using rootURL, we need to trim this from the front to get
+    // the ember-routeable url
+    if (errorURL) {
+      errorURL = errorURL.replace('/ui', '');
+    }
 
-      error.errorURL = errorURL;
+    error.errorURL = errorURL;
 
-      // if we have queryParams, update the namespace so that the observer can fire on the controller
-      if (queryParams) {
-        /* eslint-disable-next-line ember/no-controller-access-in-routes */
-        this.controllerFor('vault.cluster').set('namespaceQueryParam', queryParams.namespace || '');
-      }
+    // if we have queryParams, update the namespace so that the observer can fire on the controller
+    if (queryParams) {
+      /* eslint-disable-next-line ember/no-controller-access-in-routes */
+      this.controllerFor('vault.cluster').set('namespaceQueryParam', queryParams.namespace || '');
+    }
 
-      // Assuming we have a URL, push it into browser history and update the
-      // location bar for the user
-      if (errorURL) {
-        router.get('location').setURL(errorURL);
-      }
+    // Assuming we have a URL, push it into browser history and update the
+    // location bar for the user
+    if (errorURL) {
+      router.location.setURL(errorURL);
+    }
+
+    return true;
+  }
+
+  beforeModel() {
+    return this.flagsService.fetchFeatureFlags();
+  }
 
-      return true;
-    },
-  },
+  afterModel() {
+    const { environment, APP } = config;
+    const { ANALYTICS_CONFIG } = APP;
 
-  async beforeModel() {
-    const result = await fetch('/v1/sys/internal/ui/feature-flags', {
-      method: 'GET',
-    });
-    if (result.status === 200) {
-      const body = await result.json();
-      const flags = body.feature_flags || [];
-      this.featureFlagService.setFeatureFlags(flags);
+    // if the app is built for dev  -> attempt to start the analytics service based on the config setting
+    // if the app is built for prod -> attempt to start the analytics service based on the config setting AND HVD ownership
+    // if the app is built for test -> don't start the analytics service
+    if (environment === 'development') {
+      this.analytics.start('posthog', ANALYTICS_CONFIG);
+    } else if (environment === 'production' && this.flagsService.isHvdManaged) {
+      this.analytics.start('posthog', ANALYTICS_CONFIG);
     }
-  },
-});
+  }
+}
diff --git a/ui/app/routes/loading.js b/ui/app/routes/loading.js
index 211f1feb5b5..ee5e8b5a8d3 100644
--- a/ui/app/routes/loading.js
+++ b/ui/app/routes/loading.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault.js b/ui/app/routes/vault.js
index 69259d49f92..2f691e1fe49 100644
--- a/ui/app/routes/vault.js
+++ b/ui/app/routes/vault.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -42,7 +42,7 @@ export default class VaultRoute extends Route {
   }
 
   redirect(model, transition) {
-    if (model.get('length') === 1 && transition.targetName === 'vault.index') {
+    if (model.length === 1 && transition.targetName === 'vault.index') {
       return this.router.transitionTo('vault.cluster', model[0].name);
     }
   }
diff --git a/ui/app/routes/vault/cluster.js b/ui/app/routes/vault/cluster.js
index a8cd1c42ab9..c2a481f6806 100644
--- a/ui/app/routes/vault/cluster.js
+++ b/ui/app/routes/vault/cluster.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,6 +15,8 @@ import ClusterRoute from 'vault/mixins/cluster-route';
 import ModelBoundaryRoute from 'vault/mixins/model-boundary-route';
 import { assert } from '@ember/debug';
 
+import { v4 as uuidv4 } from 'uuid';
+
 const POLL_INTERVAL_MS = 10000;
 
 export const getManagedNamespace = (nsParam, root) => {
@@ -29,9 +31,11 @@ export const getManagedNamespace = (nsParam, root) => {
 
 export default Route.extend(ModelBoundaryRoute, ClusterRoute, {
   auth: service(),
+  api: service(),
+  analytics: service(),
   currentCluster: service(),
   customMessages: service(),
-  featureFlagService: service('featureFlag'),
+  flagsService: service('flags'),
   namespaceService: service('namespace'),
   permissions: service(),
   router: service(),
@@ -51,18 +55,22 @@ export default Route.extend(ModelBoundaryRoute, ClusterRoute, {
     const { cluster_name } = params;
     const records = this.store.peekAll('cluster');
     const cluster = records.find((record) => record.name === cluster_name);
-    return cluster ? cluster.get('id') : null;
+    return cluster?.id ?? null;
   },
 
   async beforeModel() {
     const params = this.paramsFor(this.routeName);
     let namespace = params.namespaceQueryParam;
-    const currentTokenName = this.auth.get('currentTokenName');
-    const managedRoot = this.featureFlagService.managedNamespaceRoot;
+    const currentTokenName = this.auth.currentTokenName;
+    const managedRoot = this.flagsService.hvdManagedNamespaceRoot;
     assert(
       'Cannot use VAULT_CLOUD_ADMIN_NAMESPACE flag with non-enterprise Vault version',
       !(managedRoot && this.version.isCommunity)
     );
+
+    // activatedFlags are called this high in routing to return a response used to show/hide Secrets sync on sidebar nav.
+    await this.flagsService.fetchActivatedFlags();
+
     if (!namespace && currentTokenName && !Ember.testing) {
       // if no namespace queryParam and user authenticated,
       // use user's root namespace to redirect to properly param'd url
@@ -102,8 +110,10 @@ export default Route.extend(ModelBoundaryRoute, ClusterRoute, {
 
   poll: task(function* () {
     while (true) {
-      // when testing, the polling loop causes promises to never settle so acceptance tests hang
-      // to get around that, we just disable the poll in tests
+      // In test mode, polling causes acceptance tests to hang due to never-settling promises.
+      // To avoid this, polling is disabled during tests.
+      // If your test depends on cluster status changes (e.g., replication mode),
+      // manually trigger polling using pollCluster from 'vault/tests/helpers/poll-cluster'.
       if (Ember.testing) {
         return;
       }
@@ -120,18 +130,66 @@ export default Route.extend(ModelBoundaryRoute, ClusterRoute, {
     .cancelOn('deactivate')
     .keepLatest(),
 
+  // Note: do not make this afterModel hook async, it will break the DR secondary flow.
   afterModel(model, transition) {
     this._super(...arguments);
+
     this.currentCluster.setCluster(model);
+    if (model.needsInit && this.auth.currentToken) {
+      // clear token to prevent infinite load state
+      this.auth.deleteCurrentToken();
+    }
 
     // Check that namespaces is enabled and if not,
     // clear the namespace by transition to this route w/o it
     if (this.namespaceService.path && !this.version.hasNamespaces) {
       return this.router.transitionTo(this.routeName, { queryParams: { namespace: '' } });
     }
+    // Skip analytics initialization if the cluster is a DR secondary:
+    // 1. There is little value in collecting analytics in this state.
+    // 2. The analytics service requires resolving async setup (e.g. await),
+    //   which delays the afterModel hook resolution and breaks the DR secondary flow.
+    if (model.dr?.isSecondary) {
+      return this.transitionToTargetRoute(transition);
+    }
+
+    this.addAnalyticsService(model);
+
     return this.transitionToTargetRoute(transition);
   },
 
+  async addAnalyticsService(model) {
+    // identify user for analytics service
+    if (this.analytics.activated) {
+      let licenseId = '';
+
+      try {
+        const licenseStatus = await this.api.sys.systemReadLicenseStatus();
+        licenseId = licenseStatus?.data?.autoloaded?.licenseId;
+      } catch (e) {
+        // license is not retrievable
+        licenseId = '';
+      }
+
+      try {
+        const entity_id = this.auth.authData?.entityId;
+        const entity = entity_id ? entity_id : `root_${uuidv4()}`;
+
+        this.analytics.identifyUser(entity, {
+          licenseId: licenseId,
+          licenseState: model.license?.state || 'community',
+          version: model.version.version,
+          storageType: model.storageType,
+          replicationMode: model.replicationMode,
+          isEnterprise: Boolean(model.license),
+        });
+      } catch (e) {
+        // eslint-disable-next-line no-console
+        console.log('unable to start analytics', e);
+      }
+    }
+  },
+
   setupController() {
     this._super(...arguments);
     this.poll.perform();
diff --git a/ui/app/routes/vault/cluster/access.js b/ui/app/routes/vault/cluster/access.js
index 42e5843e594..799307b6ced 100644
--- a/ui/app/routes/vault/cluster/access.js
+++ b/ui/app/routes/vault/cluster/access.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/control-group-accessor.js b/ui/app/routes/vault/cluster/access/control-group-accessor.js
index d45372d3661..704fff6c812 100644
--- a/ui/app/routes/vault/cluster/access/control-group-accessor.js
+++ b/ui/app/routes/vault/cluster/access/control-group-accessor.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/control-groups-configure.js b/ui/app/routes/vault/cluster/access/control-groups-configure.js
index 655eabb81d9..accc292e8c0 100644
--- a/ui/app/routes/vault/cluster/access/control-groups-configure.js
+++ b/ui/app/routes/vault/cluster/access/control-groups-configure.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/control-groups.js b/ui/app/routes/vault/cluster/access/control-groups.js
index 1b4dedba407..8b3678daad7 100644
--- a/ui/app/routes/vault/cluster/access/control-groups.js
+++ b/ui/app/routes/vault/cluster/access/control-groups.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/identity.js b/ui/app/routes/vault/cluster/access/identity.js
index 0bfa18a9b61..1f01e3bccfa 100644
--- a/ui/app/routes/vault/cluster/access/identity.js
+++ b/ui/app/routes/vault/cluster/access/identity.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/identity/aliases/add.js b/ui/app/routes/vault/cluster/access/identity/aliases/add.js
index de302750f53..32624d90b46 100644
--- a/ui/app/routes/vault/cluster/access/identity/aliases/add.js
+++ b/ui/app/routes/vault/cluster/access/identity/aliases/add.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/identity/aliases/edit.js b/ui/app/routes/vault/cluster/access/identity/aliases/edit.js
index 746faca1e5f..a6b77bb959d 100644
--- a/ui/app/routes/vault/cluster/access/identity/aliases/edit.js
+++ b/ui/app/routes/vault/cluster/access/identity/aliases/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/identity/aliases/index.js b/ui/app/routes/vault/cluster/access/identity/aliases/index.js
index 31a15e8e886..5ced9530e21 100644
--- a/ui/app/routes/vault/cluster/access/identity/aliases/index.js
+++ b/ui/app/routes/vault/cluster/access/identity/aliases/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,12 +8,12 @@ import ListRoute from 'core/mixins/list-route';
 import { service } from '@ember/service';
 
 export default Route.extend(ListRoute, {
-  store: service(),
+  pagination: service(),
 
   model(params) {
     const itemType = this.modelFor('vault.cluster.access.identity');
     const modelType = `identity/${itemType}-alias`;
-    return this.store
+    return this.pagination
       .lazyPaginatedQuery(modelType, {
         responsePath: 'data.keys',
         page: params.page,
@@ -38,12 +38,12 @@ export default Route.extend(ListRoute, {
     willTransition(transition) {
       window.scrollTo(0, 0);
       if (!transition || transition.targetName !== this.routeName) {
-        this.store.clearAllDatasets();
+        this.pagination.clearDataset();
       }
       return true;
     },
     reload() {
-      this.store.clearAllDatasets();
+      this.pagination.clearDataset();
       this.refresh();
     },
   },
diff --git a/ui/app/routes/vault/cluster/access/identity/aliases/show.js b/ui/app/routes/vault/cluster/access/identity/aliases/show.js
index 04438b11a0b..31e98439872 100644
--- a/ui/app/routes/vault/cluster/access/identity/aliases/show.js
+++ b/ui/app/routes/vault/cluster/access/identity/aliases/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/identity/create.js b/ui/app/routes/vault/cluster/access/identity/create.js
index bd206103d7d..8e5c117046e 100644
--- a/ui/app/routes/vault/cluster/access/identity/create.js
+++ b/ui/app/routes/vault/cluster/access/identity/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/identity/edit.js b/ui/app/routes/vault/cluster/access/identity/edit.js
index 12da60e391a..0a104bb2f52 100644
--- a/ui/app/routes/vault/cluster/access/identity/edit.js
+++ b/ui/app/routes/vault/cluster/access/identity/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/identity/index.js b/ui/app/routes/vault/cluster/access/identity/index.js
index 1dbbd4a48fb..b46df43db9d 100644
--- a/ui/app/routes/vault/cluster/access/identity/index.js
+++ b/ui/app/routes/vault/cluster/access/identity/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,12 +8,12 @@ import ListRoute from 'core/mixins/list-route';
 import { service } from '@ember/service';
 
 export default Route.extend(ListRoute, {
-  store: service(),
+  pagination: service(),
 
   model(params) {
     const itemType = this.modelFor('vault.cluster.access.identity');
     const modelType = `identity/${itemType}`;
-    return this.store
+    return this.pagination
       .lazyPaginatedQuery(modelType, {
         responsePath: 'data.keys',
         page: params.page,
@@ -38,12 +38,12 @@ export default Route.extend(ListRoute, {
     willTransition(transition) {
       window.scrollTo(0, 0);
       if (transition.targetName !== this.routeName) {
-        this.store.clearAllDatasets();
+        this.pagination.clearDataset();
       }
       return true;
     },
     reload() {
-      this.store.clearAllDatasets();
+      this.pagination.clearDataset();
       this.refresh();
     },
   },
diff --git a/ui/app/routes/vault/cluster/access/identity/merge.js b/ui/app/routes/vault/cluster/access/identity/merge.js
index fe598ea8b4c..a634ca1f9af 100644
--- a/ui/app/routes/vault/cluster/access/identity/merge.js
+++ b/ui/app/routes/vault/cluster/access/identity/merge.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/identity/show.js b/ui/app/routes/vault/cluster/access/identity/show.js
index 326bce62abe..6c349f1ff26 100644
--- a/ui/app/routes/vault/cluster/access/identity/show.js
+++ b/ui/app/routes/vault/cluster/access/identity/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -30,7 +30,7 @@ export default Route.extend({
     let model = this.store.peekRecord(modelType, params.item_id);
 
     // if we don't have creationTime, we only have a partial model so reload
-    if (model && !model.get('creationTime')) {
+    if (model && !model?.creationTime) {
       model = model.reload();
     }
 
@@ -51,14 +51,14 @@ export default Route.extend({
     if (this.currentModel) {
       next(() => {
         /* eslint-disable-next-line ember/no-controller-access-in-routes */
-        this.controller.get('model').reload();
+        this.controller.model.reload();
       });
     }
   },
 
   afterModel(resolvedModel) {
     const { section, model } = resolvedModel;
-    if (model.get('identityType') === 'group' && model.get('type') === 'internal' && section === 'aliases') {
+    if (model?.identityType === 'group' && model?.type === 'internal' && section === 'aliases') {
       return this.router.transitionTo('vault.cluster.access.identity.show', model.id, 'details');
     }
   },
diff --git a/ui/app/routes/vault/cluster/access/leases.js b/ui/app/routes/vault/cluster/access/leases.js
index 9b2775e6d9f..4c966d97185 100644
--- a/ui/app/routes/vault/cluster/access/leases.js
+++ b/ui/app/routes/vault/cluster/access/leases.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/leases/index.js b/ui/app/routes/vault/cluster/access/leases/index.js
index 15564fb148b..215e41a3cfc 100644
--- a/ui/app/routes/vault/cluster/access/leases/index.js
+++ b/ui/app/routes/vault/cluster/access/leases/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,10 +10,7 @@ export default class LeasesIndexRoute extends Route {
   @service router;
 
   beforeModel(transition) {
-    if (
-      this.modelFor('vault.cluster.access.leases').get('canList') &&
-      transition.targetName === this.routeName
-    ) {
+    if (this.modelFor('vault.cluster.access.leases').canList && transition.targetName === this.routeName) {
       return this.router.replaceWith('vault.cluster.access.leases.list-root');
     } else {
       return;
diff --git a/ui/app/routes/vault/cluster/access/leases/list-root.js b/ui/app/routes/vault/cluster/access/leases/list-root.js
index 426f59f55ac..8ace7710033 100644
--- a/ui/app/routes/vault/cluster/access/leases/list-root.js
+++ b/ui/app/routes/vault/cluster/access/leases/list-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/leases/list.js b/ui/app/routes/vault/cluster/access/leases/list.js
index 1c28768fc31..5675549cd8b 100644
--- a/ui/app/routes/vault/cluster/access/leases/list.js
+++ b/ui/app/routes/vault/cluster/access/leases/list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
 export default Route.extend({
+  pagination: service(),
   store: service(),
 
   queryParams: {
@@ -24,9 +25,9 @@ export default Route.extend({
 
   model(params) {
     const prefix = params.prefix || '';
-    if (this.modelFor('vault.cluster.access.leases').get('canList')) {
+    if (this.modelFor('vault.cluster.access.leases').canList) {
       return hash({
-        leases: this.store
+        leases: this.pagination
           .lazyPaginatedQuery('lease', {
             prefix,
             responsePath: 'data.keys',
@@ -73,7 +74,7 @@ export default Route.extend({
       }
       controller.setProperties({
         filter: filter || '',
-        page: model.leases.get('meta.currentPage'),
+        page: model.leases?.meta?.currentPage,
       });
     }
   },
@@ -91,7 +92,7 @@ export default Route.extend({
 
       set(error, 'keyId', prefix);
       /* eslint-disable-next-line ember/no-controller-access-in-routes */
-      const hasModel = this.controllerFor(this.routeName).get('hasModel');
+      const hasModel = this.controllerFor(this.routeName).hasModel;
       // only swallow the error if we have a previous model
       if (hasModel && error.httpStatus === 404) {
         this.set('has404', true);
@@ -104,7 +105,7 @@ export default Route.extend({
     willTransition(transition) {
       window.scrollTo(0, 0);
       if (transition.targetName !== this.routeName) {
-        this.store.clearAllDatasets();
+        this.pagination.clearDataset();
       }
       return true;
     },
diff --git a/ui/app/routes/vault/cluster/access/leases/show.js b/ui/app/routes/vault/cluster/access/leases/show.js
index 1dc32a2678b..50ad9735982 100644
--- a/ui/app/routes/vault/cluster/access/leases/show.js
+++ b/ui/app/routes/vault/cluster/access/leases/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/method.js b/ui/app/routes/vault/cluster/access/method.js
deleted file mode 100644
index 5ed006bb458..00000000000
--- a/ui/app/routes/vault/cluster/access/method.js
+++ /dev/null
@@ -1,40 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AdapterError from '@ember-data/adapter/error';
-import { set } from '@ember/object';
-import Route from '@ember/routing/route';
-import { service } from '@ember/service';
-import { supportedManagedAuthBackends } from 'vault/helpers/supported-managed-auth-backends';
-
-export default Route.extend({
-  store: service(),
-  pathHelp: service('path-help'),
-
-  model(params) {
-    const { path } = params;
-    return this.store.findAll('auth-method').then((modelArray) => {
-      const model = modelArray.find((m) => m.id === path);
-      if (!model) {
-        const error = new AdapterError();
-        set(error, 'httpStatus', 404);
-        throw error;
-      }
-      const supportManaged = supportedManagedAuthBackends();
-      if (!supportManaged.includes(model.methodType)) {
-        // do not fetch path-help for unmanaged auth types
-        model.set('paths', {
-          apiPath: model.apiPath,
-          paths: [],
-        });
-        return model;
-      }
-      return this.pathHelp.getPaths(model.apiPath, path).then((paths) => {
-        model.set('paths', paths);
-        return model;
-      });
-    });
-  },
-});
diff --git a/ui/app/routes/vault/cluster/access/method.ts b/ui/app/routes/vault/cluster/access/method.ts
new file mode 100644
index 00000000000..7f27cf6d856
--- /dev/null
+++ b/ui/app/routes/vault/cluster/access/method.ts
@@ -0,0 +1,42 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import { supportedManagedAuthBackends } from 'vault/helpers/supported-managed-auth-backends';
+import AuthMethodResource from 'vault/resources/auth/method';
+
+import type ApiService from 'vault/services/api';
+import type PathHelpService from 'vault/services/path-help';
+
+export default class VaultClusterAccessMethodRoute extends Route {
+  @service declare readonly api: ApiService;
+  @service declare readonly pathHelp: PathHelpService;
+
+  async model(params: { path: string }) {
+    const { path } = params;
+    const { auth } = await this.api.sys.internalUiListEnabledVisibleMounts();
+    const methods = this.api
+      .responseObjectToArray(auth, 'path')
+      .map((method) => new AuthMethodResource(method, this));
+    const method = methods.find((m) => m.id === path);
+    // the user could have entered a random path in the URL that doesn't correspond to an existing method
+    if (method) {
+      const supportManaged = supportedManagedAuthBackends();
+      // do not fetch path-help for unmanaged auth types
+      if (!supportManaged.includes(method.methodType)) {
+        method.paths = { apiPath: method.apiPath, paths: [], itemTypes: [] };
+        return method;
+      }
+      return this.pathHelp.getPaths(method.apiPath, path, '', '').then((pathInfo) => {
+        method.paths = pathInfo;
+        return method;
+      });
+    } else {
+      // throw a 404 if the path doesn't match any of the fetched methods
+      throw { httpStatus: 404, path };
+    }
+  }
+}
diff --git a/ui/app/routes/vault/cluster/access/method/index.js b/ui/app/routes/vault/cluster/access/method/index.js
index 734d49e9a79..61e09ae01f7 100644
--- a/ui/app/routes/vault/cluster/access/method/index.js
+++ b/ui/app/routes/vault/cluster/access/method/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,9 +11,11 @@ export default class AccessMethodIndexRoute extends Route {
   @service router;
 
   beforeModel() {
-    let { methodType, paths } = this.modelFor('vault.cluster.access.method');
-    paths = paths ? paths.paths.filter((path) => path.navigation === true) : null;
-    const activeTab = tabsForAuthSection([methodType, 'authConfig', paths])[0].routeParams;
-    return this.router.transitionTo(...activeTab);
+    const methodModel = this.modelFor('vault.cluster.access.method');
+    const paths = methodModel.paths
+      ? methodModel.paths.paths.filter((path) => path.navigation === true)
+      : null;
+    const activeTab = tabsForAuthSection([methodModel, 'authConfig', paths])[0];
+    return this.router.transitionTo(activeTab.route, ...activeTab.routeParams);
   }
 }
diff --git a/ui/app/routes/vault/cluster/access/method/item.js b/ui/app/routes/vault/cluster/access/method/item.js
index c32c4208d56..36ae490214c 100644
--- a/ui/app/routes/vault/cluster/access/method/item.js
+++ b/ui/app/routes/vault/cluster/access/method/item.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/method/item/create.js b/ui/app/routes/vault/cluster/access/method/item/create.js
index 258415da02b..24121c5a0c0 100644
--- a/ui/app/routes/vault/cluster/access/method/item/create.js
+++ b/ui/app/routes/vault/cluster/access/method/item/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/method/item/edit.js b/ui/app/routes/vault/cluster/access/method/item/edit.js
index 1c143490101..9fa2d7021c9 100644
--- a/ui/app/routes/vault/cluster/access/method/item/edit.js
+++ b/ui/app/routes/vault/cluster/access/method/item/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -22,6 +22,8 @@ export default Route.extend(UnsavedModelRoute, {
   setupController(controller) {
     this._super(...arguments);
     const { item_type: itemType } = this.paramsFor('vault.cluster.access.method.item');
+    const { path: method } = this.paramsFor('vault.cluster.access.method');
     controller.set('itemType', singularize(itemType));
+    controller.set('method', method);
   },
 });
diff --git a/ui/app/routes/vault/cluster/access/method/item/list.js b/ui/app/routes/vault/cluster/access/method/item/list.js
index d2920cb39a9..6145bb8fa33 100644
--- a/ui/app/routes/vault/cluster/access/method/item/list.js
+++ b/ui/app/routes/vault/cluster/access/method/item/list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { singularize } from 'ember-inflector';
 import ListRoute from 'vault/mixins/list-route';
 
 export default Route.extend(ListRoute, {
-  store: service(),
+  pagination: service(),
   pathHelp: service('path-help'),
 
   getMethodAndModelInfo() {
@@ -25,7 +25,7 @@ export default Route.extend(ListRoute, {
     const { page, pageFilter } = this.paramsFor(this.routeName);
     const modelType = `generated-${singularize(itemType)}-${type}`;
 
-    return this.store
+    return this.pagination
       .lazyPaginatedQuery(modelType, {
         responsePath: 'data.keys',
         page: page,
@@ -46,12 +46,12 @@ export default Route.extend(ListRoute, {
     willTransition(transition) {
       window.scrollTo(0, 0);
       if (transition.targetName !== this.routeName) {
-        this.store.clearAllDatasets();
+        this.pagination.clearDataset();
       }
       return true;
     },
     reload() {
-      this.store.clearAllDatasets();
+      this.pagination.clearDataset();
       this.refresh();
     },
   },
diff --git a/ui/app/routes/vault/cluster/access/method/item/show.js b/ui/app/routes/vault/cluster/access/method/item/show.js
index 8d2edac3c25..85bb04d2170 100644
--- a/ui/app/routes/vault/cluster/access/method/item/show.js
+++ b/ui/app/routes/vault/cluster/access/method/item/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -22,6 +22,8 @@ export default Route.extend({
   setupController(controller) {
     this._super(...arguments);
     const { item_type: itemType } = this.paramsFor('vault.cluster.access.method.item');
+    const { path: method } = this.paramsFor('vault.cluster.access.method');
     controller.set('itemType', singularize(itemType));
+    controller.set('method', method);
   },
 });
diff --git a/ui/app/routes/vault/cluster/access/method/section.js b/ui/app/routes/vault/cluster/access/method/section.js
index 7533f7fda4d..f0c4e8ca915 100644
--- a/ui/app/routes/vault/cluster/access/method/section.js
+++ b/ui/app/routes/vault/cluster/access/method/section.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -18,14 +18,13 @@ export default Route.extend({
     return this.modelFor('vault.cluster.access.method');
   },
 
-  setupController(controller) {
+  setupController(controller, model) {
     const { section_name: section } = this.paramsFor(this.routeName);
     this._super(...arguments);
     controller.set('section', section);
-    const method = this.modelFor('vault.cluster.access.method');
     controller.set(
       'paths',
-      method.paths.paths.filter((path) => path.navigation)
+      model.paths.paths.filter((path) => path.navigation)
     );
   },
 });
diff --git a/ui/app/routes/vault/cluster/access/methods.js b/ui/app/routes/vault/cluster/access/methods.js
deleted file mode 100644
index bb7bfe4b005..00000000000
--- a/ui/app/routes/vault/cluster/access/methods.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Route from '@ember/routing/route';
-import { service } from '@ember/service';
-
-export default class VaultClusterAccessMethodsRoute extends Route {
-  @service store;
-
-  queryParams = {
-    page: {
-      refreshModel: true,
-    },
-    pageFilter: {
-      refreshModel: true,
-    },
-  };
-
-  model() {
-    return this.store.findAll('auth-method');
-  }
-}
diff --git a/ui/app/routes/vault/cluster/access/methods.ts b/ui/app/routes/vault/cluster/access/methods.ts
new file mode 100644
index 00000000000..78eda426b02
--- /dev/null
+++ b/ui/app/routes/vault/cluster/access/methods.ts
@@ -0,0 +1,48 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import AuthMethodResource from 'vault/resources/auth/method';
+
+import type ApiService from 'vault/services/api';
+import type Capabilities from 'vault/services/capabilities';
+
+export default class VaultClusterAccessMethodsRoute extends Route {
+  @service declare readonly api: ApiService;
+  @service declare readonly capabilities: Capabilities;
+
+  queryParams = {
+    page: {
+      refreshModel: true,
+    },
+    pageFilter: {
+      refreshModel: true,
+    },
+  };
+
+  async model() {
+    const { auth } = await this.api.sys.internalUiListEnabledVisibleMounts();
+
+    const methods = this.api
+      .responseObjectToArray(auth, 'path')
+      .map((method) => new AuthMethodResource(method, this));
+
+    const paths = methods.reduce((paths: string[], { path, methodType }) => {
+      paths.push(
+        this.capabilities.pathFor('authMethodConfig', { path }),
+        this.capabilities.pathFor('authMethodDelete', { path })
+      );
+      if (methodType === 'aws') {
+        paths.push(this.capabilities.pathFor('authMethodConfigAws', { path }));
+      }
+      return paths;
+    }, []);
+
+    const capabilities = this.capabilities.fetch(paths);
+
+    return { methods, capabilities };
+  }
+}
diff --git a/ui/app/routes/vault/cluster/access/mfa/enforcements/create.js b/ui/app/routes/vault/cluster/access/mfa/enforcements/create.js
index 2b0ea0da8b2..f6bf9b514c2 100644
--- a/ui/app/routes/vault/cluster/access/mfa/enforcements/create.js
+++ b/ui/app/routes/vault/cluster/access/mfa/enforcements/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/mfa/enforcements/enforcement.js b/ui/app/routes/vault/cluster/access/mfa/enforcements/enforcement.js
index 6c4f0030e15..32bb8974fb9 100644
--- a/ui/app/routes/vault/cluster/access/mfa/enforcements/enforcement.js
+++ b/ui/app/routes/vault/cluster/access/mfa/enforcements/enforcement.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/mfa/enforcements/enforcement/edit.js b/ui/app/routes/vault/cluster/access/mfa/enforcements/enforcement/edit.js
index 97e038c1c04..198ce7c7c2a 100644
--- a/ui/app/routes/vault/cluster/access/mfa/enforcements/enforcement/edit.js
+++ b/ui/app/routes/vault/cluster/access/mfa/enforcements/enforcement/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/mfa/enforcements/index.js b/ui/app/routes/vault/cluster/access/mfa/enforcements/index.js
index f44c0b8795f..15fc038a771 100644
--- a/ui/app/routes/vault/cluster/access/mfa/enforcements/index.js
+++ b/ui/app/routes/vault/cluster/access/mfa/enforcements/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/mfa/index.js b/ui/app/routes/vault/cluster/access/mfa/index.js
index 99b03f0c221..b3c84b62485 100644
--- a/ui/app/routes/vault/cluster/access/mfa/index.js
+++ b/ui/app/routes/vault/cluster/access/mfa/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/mfa/methods/create.js b/ui/app/routes/vault/cluster/access/mfa/methods/create.js
index cf9520b919d..3af998d7f39 100644
--- a/ui/app/routes/vault/cluster/access/mfa/methods/create.js
+++ b/ui/app/routes/vault/cluster/access/mfa/methods/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/mfa/methods/index.js b/ui/app/routes/vault/cluster/access/mfa/methods/index.js
index ff885ce269d..4b96acbfb6b 100644
--- a/ui/app/routes/vault/cluster/access/mfa/methods/index.js
+++ b/ui/app/routes/vault/cluster/access/mfa/methods/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/mfa/methods/method.js b/ui/app/routes/vault/cluster/access/mfa/methods/method.js
index 158fb9a5d1c..dbd54e9da37 100644
--- a/ui/app/routes/vault/cluster/access/mfa/methods/method.js
+++ b/ui/app/routes/vault/cluster/access/mfa/methods/method.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/mfa/methods/method/edit.js b/ui/app/routes/vault/cluster/access/mfa/methods/method/edit.js
index 3ec60dc55c9..dd881a641e4 100644
--- a/ui/app/routes/vault/cluster/access/mfa/methods/method/edit.js
+++ b/ui/app/routes/vault/cluster/access/mfa/methods/method/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/namespaces/create.js b/ui/app/routes/vault/cluster/access/namespaces/create.js
index d78a81b66d7..3c416a2bed7 100644
--- a/ui/app/routes/vault/cluster/access/namespaces/create.js
+++ b/ui/app/routes/vault/cluster/access/namespaces/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/namespaces/index.js b/ui/app/routes/vault/cluster/access/namespaces/index.js
index 2a9f87997ae..6f6bbf48cc5 100644
--- a/ui/app/routes/vault/cluster/access/namespaces/index.js
+++ b/ui/app/routes/vault/cluster/access/namespaces/index.js
@@ -1,50 +1,64 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
 import Route from '@ember/routing/route';
-import UnloadModel from 'vault/mixins/unload-model-route';
+import { action } from '@ember/object';
+import { buildWaiter } from '@ember/test-waiters';
+import { hash } from 'rsvp';
 
-export default Route.extend(UnloadModel, {
-  store: service(),
+const waiter = buildWaiter('namespace-list-route');
 
-  queryParams: {
+export default class NamespaceListRoute extends Route {
+  @service pagination;
+  @service store;
+  @service version;
+
+  queryParams = {
+    pageFilter: {
+      refreshModel: true,
+    },
     page: {
       refreshModel: true,
     },
-  },
-
-  version: service(),
+  };
 
   beforeModel() {
     this.store.unloadAll('namespace');
     return this.version.fetchFeatures().then(() => {
-      return this._super(...arguments);
+      return super.beforeModel(...arguments);
     });
-  },
+  }
 
-  model(params) {
-    if (this.version.hasNamespaces) {
-      return this.store
-        .lazyPaginatedQuery('namespace', {
-          responsePath: 'data.keys',
-          page: Number(params?.page) || 1,
-        })
-        .then((model) => {
-          return model;
-        })
-        .catch((err) => {
-          if (err.httpStatus === 404) {
-            return [];
-          } else {
-            throw err;
-          }
-        });
+  async fetchNamespaces(params) {
+    const waiterToken = waiter.beginAsync();
+    try {
+      const model = await this.pagination.lazyPaginatedQuery('namespace', {
+        responsePath: 'data.keys',
+        page: Number(params?.page) || 1,
+        pageFilter: params?.pageFilter,
+      });
+      return model;
+    } catch (err) {
+      if (err.httpStatus === 404) {
+        return [];
+      } else {
+        throw err;
+      }
+    } finally {
+      waiter.endAsync(waiterToken);
     }
-    return null;
-  },
+  }
+
+  model(params) {
+    const { pageFilter } = params;
+    return hash({
+      namespaces: this.fetchNamespaces(params),
+      pageFilter,
+    });
+  }
 
   setupController(controller, model) {
     const has404 = this.has404;
@@ -58,29 +72,32 @@ export default Route.extend(UnloadModel, {
         page: Number(model?.meta?.currentPage) || 1,
       });
     }
-  },
+  }
 
-  actions: {
-    error(error, transition) {
-      /* eslint-disable-next-line ember/no-controller-access-in-routes */
-      const hasModel = this.controllerFor(this.routeName).get('hasModel');
-      if (hasModel && error.httpStatus === 404) {
-        this.set('has404', true);
-        transition.abort();
-      } else {
-        return true;
-      }
-    },
-    willTransition(transition) {
-      window.scrollTo(0, 0);
-      if (!transition || transition.targetName !== this.routeName) {
-        this.store.clearAllDatasets();
-      }
+  @action
+  error(error, transition) {
+    /* eslint-disable-next-line ember/no-controller-access-in-routes */
+    const hasModel = this.controllerFor(this.routeName).hasModel;
+    if (hasModel && error.httpStatus === 404) {
+      this.has404 = true;
+      transition.abort();
+    } else {
       return true;
-    },
-    reload() {
-      this.store.clearAllDatasets();
-      this.refresh();
-    },
-  },
-});
+    }
+  }
+
+  @action
+  willTransition(transition) {
+    window.scrollTo(0, 0);
+    if (!transition || transition.targetName !== this.routeName) {
+      this.pagination.clearDataset();
+    }
+    return true;
+  }
+
+  @action
+  reload() {
+    this.pagination.clearDataset();
+    this.refresh();
+  }
+}
diff --git a/ui/app/routes/vault/cluster/access/oidc.js b/ui/app/routes/vault/cluster/access/oidc.js
index a6f1a2bb922..6a008eea03f 100644
--- a/ui/app/routes/vault/cluster/access/oidc.js
+++ b/ui/app/routes/vault/cluster/access/oidc.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/assignments/assignment.js b/ui/app/routes/vault/cluster/access/oidc/assignments/assignment.js
index 7268fe769dd..e57099ec283 100644
--- a/ui/app/routes/vault/cluster/access/oidc/assignments/assignment.js
+++ b/ui/app/routes/vault/cluster/access/oidc/assignments/assignment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/assignments/assignment/details.js b/ui/app/routes/vault/cluster/access/oidc/assignments/assignment/details.js
index 7ef94bce825..16d1142225a 100644
--- a/ui/app/routes/vault/cluster/access/oidc/assignments/assignment/details.js
+++ b/ui/app/routes/vault/cluster/access/oidc/assignments/assignment/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/assignments/assignment/edit.js b/ui/app/routes/vault/cluster/access/oidc/assignments/assignment/edit.js
index a6d9648720a..bb57ef4f994 100644
--- a/ui/app/routes/vault/cluster/access/oidc/assignments/assignment/edit.js
+++ b/ui/app/routes/vault/cluster/access/oidc/assignments/assignment/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/assignments/create.js b/ui/app/routes/vault/cluster/access/oidc/assignments/create.js
index 4dd753ac0ed..5e8ceeb8e3f 100644
--- a/ui/app/routes/vault/cluster/access/oidc/assignments/create.js
+++ b/ui/app/routes/vault/cluster/access/oidc/assignments/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/assignments/index.js b/ui/app/routes/vault/cluster/access/oidc/assignments/index.js
index 8b08e6aff50..f8ed5ff8ed0 100644
--- a/ui/app/routes/vault/cluster/access/oidc/assignments/index.js
+++ b/ui/app/routes/vault/cluster/access/oidc/assignments/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/clients/client.js b/ui/app/routes/vault/cluster/access/oidc/clients/client.js
index 19158547dd5..d3fae5cb50f 100644
--- a/ui/app/routes/vault/cluster/access/oidc/clients/client.js
+++ b/ui/app/routes/vault/cluster/access/oidc/clients/client.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/clients/client/details.js b/ui/app/routes/vault/cluster/access/oidc/clients/client/details.js
index 1ff9f4df3af..8eab2784324 100644
--- a/ui/app/routes/vault/cluster/access/oidc/clients/client/details.js
+++ b/ui/app/routes/vault/cluster/access/oidc/clients/client/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/clients/client/edit.js b/ui/app/routes/vault/cluster/access/oidc/clients/client/edit.js
index 2ed4f11e0b3..42547506667 100644
--- a/ui/app/routes/vault/cluster/access/oidc/clients/client/edit.js
+++ b/ui/app/routes/vault/cluster/access/oidc/clients/client/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/clients/client/providers.js b/ui/app/routes/vault/cluster/access/oidc/clients/client/providers.js
index cd2e7fb6440..e71e6628e9b 100644
--- a/ui/app/routes/vault/cluster/access/oidc/clients/client/providers.js
+++ b/ui/app/routes/vault/cluster/access/oidc/clients/client/providers.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/clients/create.js b/ui/app/routes/vault/cluster/access/oidc/clients/create.js
index f6b46b4eba0..2c03b11841d 100644
--- a/ui/app/routes/vault/cluster/access/oidc/clients/create.js
+++ b/ui/app/routes/vault/cluster/access/oidc/clients/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/clients/index.js b/ui/app/routes/vault/cluster/access/oidc/clients/index.js
index 2da8f1727a6..e481f36b6c1 100644
--- a/ui/app/routes/vault/cluster/access/oidc/clients/index.js
+++ b/ui/app/routes/vault/cluster/access/oidc/clients/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/index.js b/ui/app/routes/vault/cluster/access/oidc/index.js
index 583a1400a88..6410bcd097d 100644
--- a/ui/app/routes/vault/cluster/access/oidc/index.js
+++ b/ui/app/routes/vault/cluster/access/oidc/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/keys/create.js b/ui/app/routes/vault/cluster/access/oidc/keys/create.js
index ab93d51bfa3..fd277ee688e 100644
--- a/ui/app/routes/vault/cluster/access/oidc/keys/create.js
+++ b/ui/app/routes/vault/cluster/access/oidc/keys/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/keys/index.js b/ui/app/routes/vault/cluster/access/oidc/keys/index.js
index f63542097f0..d0ea0163321 100644
--- a/ui/app/routes/vault/cluster/access/oidc/keys/index.js
+++ b/ui/app/routes/vault/cluster/access/oidc/keys/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/keys/key.js b/ui/app/routes/vault/cluster/access/oidc/keys/key.js
index 5d4e754f1d1..c3e183636b2 100644
--- a/ui/app/routes/vault/cluster/access/oidc/keys/key.js
+++ b/ui/app/routes/vault/cluster/access/oidc/keys/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/keys/key/clients.js b/ui/app/routes/vault/cluster/access/oidc/keys/key/clients.js
index 823e33fa6a5..e446d75c120 100644
--- a/ui/app/routes/vault/cluster/access/oidc/keys/key/clients.js
+++ b/ui/app/routes/vault/cluster/access/oidc/keys/key/clients.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/keys/key/details.js b/ui/app/routes/vault/cluster/access/oidc/keys/key/details.js
index 650b0bc370b..0ddaf1976e4 100644
--- a/ui/app/routes/vault/cluster/access/oidc/keys/key/details.js
+++ b/ui/app/routes/vault/cluster/access/oidc/keys/key/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/keys/key/edit.js b/ui/app/routes/vault/cluster/access/oidc/keys/key/edit.js
index 1b713543144..6306d2b7b40 100644
--- a/ui/app/routes/vault/cluster/access/oidc/keys/key/edit.js
+++ b/ui/app/routes/vault/cluster/access/oidc/keys/key/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/providers/create.js b/ui/app/routes/vault/cluster/access/oidc/providers/create.js
index cfdbcfd967f..115724144f4 100644
--- a/ui/app/routes/vault/cluster/access/oidc/providers/create.js
+++ b/ui/app/routes/vault/cluster/access/oidc/providers/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/providers/index.js b/ui/app/routes/vault/cluster/access/oidc/providers/index.js
index caef02dffee..fab51bf8b67 100644
--- a/ui/app/routes/vault/cluster/access/oidc/providers/index.js
+++ b/ui/app/routes/vault/cluster/access/oidc/providers/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/providers/provider.js b/ui/app/routes/vault/cluster/access/oidc/providers/provider.js
index f7d245acf8f..691090265b2 100644
--- a/ui/app/routes/vault/cluster/access/oidc/providers/provider.js
+++ b/ui/app/routes/vault/cluster/access/oidc/providers/provider.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/providers/provider/clients.js b/ui/app/routes/vault/cluster/access/oidc/providers/provider/clients.js
index 092c12f5c75..a74a5d4fa90 100644
--- a/ui/app/routes/vault/cluster/access/oidc/providers/provider/clients.js
+++ b/ui/app/routes/vault/cluster/access/oidc/providers/provider/clients.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/providers/provider/details.js b/ui/app/routes/vault/cluster/access/oidc/providers/provider/details.js
index 7521dbb4b99..f0cd48a324f 100644
--- a/ui/app/routes/vault/cluster/access/oidc/providers/provider/details.js
+++ b/ui/app/routes/vault/cluster/access/oidc/providers/provider/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/providers/provider/edit.js b/ui/app/routes/vault/cluster/access/oidc/providers/provider/edit.js
index ca29f24eaaf..3b98d8435a3 100644
--- a/ui/app/routes/vault/cluster/access/oidc/providers/provider/edit.js
+++ b/ui/app/routes/vault/cluster/access/oidc/providers/provider/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/scopes/create.js b/ui/app/routes/vault/cluster/access/oidc/scopes/create.js
index 51d961180ed..91db3f0aefd 100644
--- a/ui/app/routes/vault/cluster/access/oidc/scopes/create.js
+++ b/ui/app/routes/vault/cluster/access/oidc/scopes/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/scopes/index.js b/ui/app/routes/vault/cluster/access/oidc/scopes/index.js
index 6c45419d76e..514fe112c60 100644
--- a/ui/app/routes/vault/cluster/access/oidc/scopes/index.js
+++ b/ui/app/routes/vault/cluster/access/oidc/scopes/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/scopes/scope.js b/ui/app/routes/vault/cluster/access/oidc/scopes/scope.js
index 2f5827877fc..f586dbfcc09 100644
--- a/ui/app/routes/vault/cluster/access/oidc/scopes/scope.js
+++ b/ui/app/routes/vault/cluster/access/oidc/scopes/scope.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/scopes/scope/details.js b/ui/app/routes/vault/cluster/access/oidc/scopes/scope/details.js
index 281ac583072..b563287de53 100644
--- a/ui/app/routes/vault/cluster/access/oidc/scopes/scope/details.js
+++ b/ui/app/routes/vault/cluster/access/oidc/scopes/scope/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/oidc/scopes/scope/edit.js b/ui/app/routes/vault/cluster/access/oidc/scopes/scope/edit.js
index b493099142d..339756fb376 100644
--- a/ui/app/routes/vault/cluster/access/oidc/scopes/scope/edit.js
+++ b/ui/app/routes/vault/cluster/access/oidc/scopes/scope/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/access/reset-password.js b/ui/app/routes/vault/cluster/access/reset-password.js
index a44e80bfda7..f66a2ce1507 100644
--- a/ui/app/routes/vault/cluster/access/reset-password.js
+++ b/ui/app/routes/vault/cluster/access/reset-password.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,17 +16,17 @@ export default class VaultClusterAccessResetPasswordRoute extends Route {
 
   async model() {
     // Password reset is only available on userpass type auth mounts
-    if (this.auth.authData?.backend?.type !== 'userpass') {
+    if (this.auth.authData?.authMethodType !== 'userpass') {
       throw new Error(ERROR_UNAVAILABLE);
     }
-    const { backend, displayName } = this.auth.authData;
-    if (!backend.mountPath || !displayName) {
+    const { authMountPath, displayName } = this.auth.authData;
+    if (!authMountPath || !displayName) {
       throw new Error(ERROR_UNAVAILABLE);
     }
     try {
       const capabilities = await this.store.findRecord(
         'capabilities',
-        `auth/${encodePath(backend.mountPath)}/users/${encodePath(displayName)}/password`
+        `auth/${encodePath(authMountPath)}/users/${encodePath(displayName)}/password`
       );
       // Check that the user has ability to update password
       if (!capabilities.canUpdate) {
@@ -36,7 +36,7 @@ export default class VaultClusterAccessResetPasswordRoute extends Route {
       // If capabilities can't be queried, default to letting the API decide
     }
     return {
-      backend: backend.mountPath,
+      backend: authMountPath,
       username: displayName,
     };
   }
diff --git a/ui/app/routes/vault/cluster/auth.js b/ui/app/routes/vault/cluster/auth.js
index ac4c33dc9bb..6422ae00031 100644
--- a/ui/app/routes/vault/cluster/auth.js
+++ b/ui/app/routes/vault/cluster/auth.js
@@ -1,33 +1,54 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
 import ClusterRouteBase from './cluster-route-base';
 import config from 'vault/config/environment';
+import { supportedTypes } from 'vault/utils/auth-form-helpers';
+import { sanitizePath } from 'core/utils/sanitize-path';
+import AuthMethodResource from 'vault/resources/auth/method';
+
+export default class AuthRoute extends ClusterRouteBase {
+  queryParams = {
+    authMount: { replace: true, refreshModel: true },
+    wrapped_token: { refreshModel: true },
+  };
+
+  @service api;
+  @service auth;
+  @service flashMessages;
+  @service namespace;
+  @service store;
+  @service version;
 
-export default ClusterRouteBase.extend({
-  queryParams: {
-    authMethod: {
-      replace: true,
-    },
-  },
-  flashMessages: service(),
-  version: service(),
   beforeModel() {
-    return this._super().then(() => {
+    return super.beforeModel().then(() => {
       return this.version.fetchFeatures();
     });
-  },
-  model() {
-    return this._super(...arguments);
-  },
+  }
+
+  async model(params) {
+    const clusterModel = this.modelFor('vault.cluster');
+    const wrapped_token = params?.wrapped_token;
+    if (wrapped_token) {
+      // log user in directly (i.e. no form interaction) via URL query param
+      const authResponse = await this.unwrapToken(wrapped_token, clusterModel.id);
+      return { clusterModel, unwrapResponse: authResponse };
+    }
+
+    const loginSettings = this.version.isEnterprise ? await this.fetchLoginSettings() : null;
+    const visibleAuthMounts = await this.fetchMounts();
+    const authMount = params?.authMount;
 
-  resetController(controller) {
-    controller.set('wrappedToken', '');
-    controller.set('authMethod', 'token');
-  },
+    return {
+      clusterModel,
+      visibleAuthMounts,
+      directLinkData: this.getDirectLinkData(authMount, visibleAuthMounts),
+      loginSettings,
+    };
+  }
 
   afterModel() {
     if (config.welcomeMessage) {
@@ -36,5 +57,97 @@ export default ClusterRouteBase.extend({
         priority: 300,
       });
     }
-  },
-});
+  }
+
+  redirect(model, transition) {
+    if (model?.unwrapResponse) {
+      // handles the transition
+      return this.controllerFor('vault.cluster.auth').loginAndTransition.perform(model.unwrapResponse);
+    }
+    const hasQueryParam = transition.to?.queryParams?.with;
+    const isInvalid = !model.directLinkData;
+    if (hasQueryParam && isInvalid) {
+      // redirect user and clear out the query param if it's invalid
+      this.router.replaceWith(this.routeName, { queryParams: { authMount: null } });
+    }
+  }
+
+  // authenticates the user if the wrapped_token query param exists
+  async unwrapToken(token, clusterId) {
+    try {
+      const { auth } = await this.api.sys.unwrap({}, this.api.buildHeaders({ token }));
+      const authData = this.auth.normalizeAuthData(auth, { authMethodType: 'token', authMountPath: '' });
+      return await this.auth.authSuccess(clusterId, authData);
+    } catch (e) {
+      const { message } = await this.api.parseError(e);
+      this.controllerFor('vault.cluster.auth').unwrapTokenError = message;
+    }
+  }
+
+  async fetchLoginSettings() {
+    try {
+      const adapter = this.store.adapterFor('application');
+      const response = await adapter.ajax(
+        '/v1/sys/internal/ui/default-auth-methods',
+        'GET',
+        this.api.buildHeaders({ token: '' })
+      );
+
+      if (response?.data) {
+        const { default_auth_type, backup_auth_types } = response.data;
+        return {
+          defaultType: default_auth_type,
+          // TODO WIP backend PR consistently return empty array when no backup_auth_types
+          backupTypes: backup_auth_types?.length ? backup_auth_types : null,
+        };
+      }
+    } catch {
+      // swallow if there's an error and fallback to default login form configuration
+      return null;
+    }
+  }
+
+  async fetchMounts() {
+    try {
+      const resp = await this.api.sys.internalUiListEnabledVisibleMounts(
+        this.api.buildHeaders({ token: '' })
+      );
+      const authMounts = this.api.responseObjectToArray(resp.auth, 'path').flatMap((method) => {
+        const resource = new AuthMethodResource(method, this);
+        return this.isSupported(resource.methodType) ? [resource] : [];
+      });
+      return authMounts.length ? authMounts : null;
+    } catch {
+      // catch error if there's a problem fetching mount data (i.e. invalid namespace)
+      return null;
+    }
+  }
+
+  /*
+    In older versions of Vault, the "with" query param could refer to either the auth mount path or the type
+    (which may be the same, since the default mount path *is* the type). 
+    For backward compatibility, we handle both scenarios.
+    → If `authMount` matches a visible auth mount the method will assume that mount path to login and render as the default in the login form.
+    → If `authMount` matches a supported auth type (and the mount does not have `listing_visibility="unauth"`), that type is preselected in the login form.
+  */
+  getDirectLinkData(authMount, visibleAuthMounts) {
+    if (!authMount) return null;
+
+    const sanitizedParam = sanitizePath(authMount); // strip leading/trailing slashes
+    // mount paths in visibleAuthMounts always end in a slash, so format for consistency
+    const formattedPath = `${sanitizedParam}/`;
+    const mountData = visibleAuthMounts?.find((a) => a.path === formattedPath);
+    if (mountData) {
+      return { path: formattedPath, type: mountData.type };
+    }
+
+    if (this.isSupported(sanitizedParam)) {
+      return { type: sanitizedParam };
+    }
+    // `type` is necessary because it determines which login fields to render.
+    // If we can't safely glean it from the query param, ignore it and return null.
+    return null;
+  }
+
+  isSupported = (type = '') => supportedTypes(this.version.isEnterprise).includes(type);
+}
diff --git a/ui/app/routes/vault/cluster/clients.ts b/ui/app/routes/vault/cluster/clients.ts
index 5b9988933c4..ee8c9d14151 100644
--- a/ui/app/routes/vault/cluster/clients.ts
+++ b/ui/app/routes/vault/cluster/clients.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,19 +7,14 @@ import Route from '@ember/routing/route';
 import { hash } from 'rsvp';
 import { service } from '@ember/service';
 
-import type StoreService from 'vault/services/store';
-import type ClientsConfigModel from 'vault/models/clients/config';
-import type ClientsVersionHistoryModel from 'vault/models/clients/version-history';
-
-export interface ClientsRouteModel {
-  config: ClientsConfigModel;
-  versionHistory: ClientsVersionHistoryModel;
-}
+import type Store from '@ember-data/store';
 
 export default class ClientsRoute extends Route {
-  @service declare readonly store: StoreService;
+  @service declare readonly store: Store;
 
-  getVersionHistory() {
+  getVersionHistory(): Promise<
+    Array<{ version: string; previousVersion: string; timestampInstalled: string }>
+  > {
     return this.store
       .findAll('clients/version-history')
       .then((response) => {
diff --git a/ui/app/routes/vault/cluster/clients/config.js b/ui/app/routes/vault/cluster/clients/config.js
index a1b34e29695..61c98b394fa 100644
--- a/ui/app/routes/vault/cluster/clients/config.js
+++ b/ui/app/routes/vault/cluster/clients/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/clients/counts.ts b/ui/app/routes/vault/cluster/clients/counts.ts
index 904eee27610..1085096b8d3 100644
--- a/ui/app/routes/vault/cluster/clients/counts.ts
+++ b/ui/app/routes/vault/cluster/clients/counts.ts
@@ -1,95 +1,137 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import timestamp from 'core/utils/timestamp';
-import { getUnixTime } from 'date-fns';
-
-import type StoreService from 'vault/services/store';
-import type { ClientsRouteModel } from '../clients';
-import type ClientsConfigModel from 'vault/models/clients/config';
-import type ClientsVersionHistoryModel from 'vault/models/clients/version-history';
-import type ClientsActivityModel from 'vault/models/clients/activity';
-import type Controller from '@ember/controller';
-import type AdapterError from 'ember-data/adapter'; // eslint-disable-line ember/use-ember-data-rfc-395-imports
+import type AdapterError from '@ember-data/adapter/error';
+import type FlagsService from 'vault/services/flags';
+import type NamespaceService from 'vault/services/namespace';
+import type Store from '@ember-data/store';
+import type VersionService from 'vault/services/version';
+import type { ModelFrom } from 'vault/vault/route';
+import type ClientsRoute from '../clients';
+import type ClientsCountsController from 'vault/controllers/vault/cluster/clients/counts';
+import type ClientsActivityModel from 'vault/vault/models/clients/activity';
 
 export interface ClientsCountsRouteParams {
-  start_time?: string | number | undefined;
-  end_time?: string | number | undefined;
-  ns?: string | undefined;
-  mountPath?: string | undefined;
+  start_time?: string;
+  end_time?: string;
+  namespace_path?: string;
+  mount_path?: string;
+  mount_type?: string;
+  month?: string;
 }
 
-interface ClientsCountsRouteModel {
-  config: ClientsConfigModel;
-  versionHistory: ClientsVersionHistoryModel;
-  activity?: ClientsActivityModel;
-  activityError?: AdapterError;
-  startTimestamp: number;
-  endTimestamp: number;
-}
-interface ClientsCountsController extends Controller {
-  model: ClientsCountsRouteModel;
-  start_time: number | undefined;
-  end_time: number | undefined;
-  ns: string | undefined;
-  mountPath: string | undefined;
+interface ActivityAdapterQuery {
+  start_time: string | undefined;
+  end_time: string | undefined;
 }
 
+export type ClientsCountsRouteModel = ModelFrom<ClientsCountsRoute>;
+
 export default class ClientsCountsRoute extends Route {
-  @service declare readonly store: StoreService;
+  @service declare readonly flags: FlagsService;
+  @service declare readonly namespace: NamespaceService;
+  @service declare readonly store: Store;
+  @service declare readonly version: VersionService;
 
   queryParams = {
+    // These query params make a new request to the API
     start_time: { refreshModel: true, replace: true },
     end_time: { refreshModel: true, replace: true },
-    ns: { refreshModel: false, replace: true },
-    mountPath: { refreshModel: false, replace: true },
+    // These query params just filter client-side data
+    namespace_path: { refreshModel: false, replace: true },
+    mount_path: { refreshModel: false, replace: true },
+    mount_type: { refreshModel: false, replace: true },
+    month: { refreshModel: false, replace: true },
   };
 
-  async getActivity(start_time: number, end_time: number) {
+  beforeModel() {
+    return this.flags.fetchActivatedFlags();
+  }
+
+  async getActivity(params: ClientsCountsRouteParams): Promise<{
+    activity?: ClientsActivityModel;
+    activityError?: AdapterError;
+  }> {
     let activity, activityError;
-    // if there is no billingStartTimestamp or selected start date initially we allow the user to manually choose a date
-    // in that case bypass the query so that the user isn't stuck viewing the activity error
-    if (start_time) {
+    // if CE without both start time and end time, we want to skip the activity call
+    // so that the user is forced to choose a date range
+    if (this.version.isEnterprise || (this.version.isCommunity && params.start_time && params.end_time)) {
+      const query: ActivityAdapterQuery = {
+        start_time: params?.start_time,
+        end_time: params?.end_time,
+      };
       try {
-        activity = await this.store.queryRecord('clients/activity', {
-          start_time: { timestamp: start_time },
-          end_time: { timestamp: end_time },
+        activity = await this.store.queryRecord('clients/activity', query);
+      } catch (error) {
+        activityError = error as AdapterError;
+      }
+    }
+    return {
+      activity,
+      activityError,
+    };
+  }
+
+  async fetchAndFormatExportData(startTimestamp: string | undefined, endTimestamp: string | undefined) {
+    // The "Client List" tab is only available on enterprise versions
+    if (this.version.isEnterprise) {
+      const adapter = this.store.adapterFor('clients/activity');
+      let exportData, exportError;
+      try {
+        const resp = await adapter.exportData({
+          // the API only accepts json or csv
+          format: 'json',
+          start_time: startTimestamp,
+          end_time: endTimestamp,
         });
+        const jsonLines = await resp.text();
+        const lines = jsonLines.trim().split('\n');
+        exportData = lines.map((line: string) => JSON.parse(line));
       } catch (error) {
-        activityError = error;
+        // Ideally we would not handle errors manually but this is the pattern the other client.counts
+        // route follow since the sys/internal/counters API doesn't always return helpful error messages.
+        // When these routes are migrated away from ember data we should revisit the error handling.
+        exportError = error as AdapterError;
       }
-      return [activity, activityError];
+      return { exportData, exportError };
     }
-    return [{}, null];
+    return { exportData: null, exportError: null };
   }
 
   async model(params: ClientsCountsRouteParams) {
-    const { config, versionHistory } = this.modelFor('vault.cluster.clients') as ClientsRouteModel;
-    // we could potentially make an additional request to fetch the license and get the start date from there if the config request fails
-    const startTimestamp = Number(params.start_time) || getUnixTime(config.billingStartTimestamp);
-    const endTimestamp = Number(params.end_time) || getUnixTime(timestamp.now());
-    const [activity, activityError] = await this.getActivity(startTimestamp, endTimestamp);
+    const { config, versionHistory } = this.modelFor('vault.cluster.clients') as ModelFrom<ClientsRoute>;
+    const { activity, activityError } = await this.getActivity(params);
+    const { exportData, exportError } = await this.fetchAndFormatExportData(
+      activity?.startTime,
+      activity?.endTime
+    );
     return {
-      config,
-      versionHistory,
       activity,
       activityError,
-      startTimestamp,
-      endTimestamp,
+      config,
+      exportData,
+      exportError,
+      // We always want to return the start and end time from the activity response
+      // so they serve as the source of truth for the time period of the displayed client count data
+      startTimestamp: activity?.startTime,
+      endTimestamp: activity?.endTime,
+      versionHistory,
     };
   }
 
   resetController(controller: ClientsCountsController, isExiting: boolean) {
     if (isExiting) {
       controller.setProperties({
-        start_time: undefined,
-        end_time: undefined,
-        ns: undefined,
-        mountPath: undefined,
+        start_time: '',
+        end_time: '',
+        namespace_path: '',
+        mount_path: '',
+        mount_type: '',
+        month: '',
       });
     }
   }
diff --git a/ui/app/routes/vault/cluster/clients/counts/client-list.ts b/ui/app/routes/vault/cluster/clients/counts/client-list.ts
new file mode 100644
index 00000000000..b98185737ad
--- /dev/null
+++ b/ui/app/routes/vault/cluster/clients/counts/client-list.ts
@@ -0,0 +1,8 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+
+export default class ClientsCountsClientListRoute extends Route {}
diff --git a/ui/app/routes/vault/cluster/clients/counts/index.ts b/ui/app/routes/vault/cluster/clients/counts/index.ts
index dfe50b6f836..2384ef35426 100644
--- a/ui/app/routes/vault/cluster/clients/counts/index.ts
+++ b/ui/app/routes/vault/cluster/clients/counts/index.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/clients/counts/overview.ts b/ui/app/routes/vault/cluster/clients/counts/overview.ts
index 44a3f92f384..f163e955965 100644
--- a/ui/app/routes/vault/cluster/clients/counts/overview.ts
+++ b/ui/app/routes/vault/cluster/clients/counts/overview.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/clients/counts/sync.ts b/ui/app/routes/vault/cluster/clients/counts/sync.ts
deleted file mode 100644
index ef99d44bbaa..00000000000
--- a/ui/app/routes/vault/cluster/clients/counts/sync.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Route from '@ember/routing/route';
-
-export default class ClientsCountsSyncRoute extends Route {}
diff --git a/ui/app/routes/vault/cluster/clients/counts/token.ts b/ui/app/routes/vault/cluster/clients/counts/token.ts
deleted file mode 100644
index 44a3f92f384..00000000000
--- a/ui/app/routes/vault/cluster/clients/counts/token.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Route from '@ember/routing/route';
-
-export default class ClientsCountsOverviewRoute extends Route {}
diff --git a/ui/app/routes/vault/cluster/clients/edit.js b/ui/app/routes/vault/cluster/clients/edit.js
index 068e6efc163..9a3734a9d29 100644
--- a/ui/app/routes/vault/cluster/clients/edit.js
+++ b/ui/app/routes/vault/cluster/clients/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/clients/index.js b/ui/app/routes/vault/cluster/clients/index.js
index 9de7c3bbf79..f161e5a43e9 100644
--- a/ui/app/routes/vault/cluster/clients/index.js
+++ b/ui/app/routes/vault/cluster/clients/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/cluster-route-base.js b/ui/app/routes/vault/cluster/cluster-route-base.js
index b8ceb8a4ed4..427a688df52 100644
--- a/ui/app/routes/vault/cluster/cluster-route-base.js
+++ b/ui/app/routes/vault/cluster/cluster-route-base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,9 @@
 import Route from '@ember/routing/route';
 import ClusterRoute from 'vault/mixins/cluster-route';
 
+/**
+ * @type Class
+ */
 export default Route.extend(ClusterRoute, {
   model() {
     return this.modelFor('vault.cluster');
diff --git a/ui/app/routes/vault/cluster/dashboard.js b/ui/app/routes/vault/cluster/dashboard.js
index a8af612f172..27baf00dacb 100644
--- a/ui/app/routes/vault/cluster/dashboard.js
+++ b/ui/app/routes/vault/cluster/dashboard.js
@@ -1,33 +1,34 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
 // eslint-disable-next-line ember/no-mixins
 import ClusterRoute from 'vault/mixins/cluster-route';
 import { action } from '@ember/object';
+import SecretsEngineResource from 'vault/resources/secrets/engine';
 
 export default class VaultClusterDashboardRoute extends Route.extend(ClusterRoute) {
   @service store;
   @service namespace;
   @service version;
+  @service api;
 
-  async getVaultConfiguration() {
+  async getVaultConfiguration(hasChroot) {
     try {
-      if (!this.namespace.inRootNamespace) return null;
-
-      const adapter = this.store.adapterFor('application');
-      const configState = await adapter.ajax('/v1/sys/config/state/sanitized', 'GET');
-      return configState.data;
+      if (!this.namespace.inRootNamespace || hasChroot) {
+        return null;
+      }
+      const { data } = await this.api.sys.readSanitizedConfigurationState();
+      return data;
     } catch (e) {
       return null;
     }
   }
 
-  model() {
+  async model() {
     const clusterModel = this.modelFor('vault.cluster');
     const hasChroot = clusterModel?.hasChrootNamespace;
     const replication =
@@ -37,14 +38,22 @@ export default class VaultClusterDashboardRoute extends Route.extend(ClusterRout
             dr: clusterModel.dr,
             performance: clusterModel.performance,
           };
-    return hash({
+    const requests = [
+      this.getVaultConfiguration(hasChroot),
+      this.api.sys.internalUiListEnabledVisibleMounts().catch(() => ({})),
+    ];
+    const [vaultConfiguration, { secret }] = await Promise.all(requests);
+    const secretsEngines = this.api
+      .responseObjectToArray(secret, 'path')
+      .map((engine) => new SecretsEngineResource(engine));
+
+    return {
       replication,
-      secretsEngines: this.store.query('secret-engine', {}),
-      license: this.store.queryRecord('license', {}).catch(() => null),
+      secretsEngines,
       isRootNamespace: this.namespace.inRootNamespace && !hasChroot,
       version: this.version,
-      vaultConfiguration: hasChroot ? null : this.getVaultConfiguration(),
-    });
+      vaultConfiguration,
+    };
   }
 
   @action
diff --git a/ui/app/routes/vault/cluster/index.js b/ui/app/routes/vault/cluster/index.js
index aea2b383c2c..c213d6dbcb3 100644
--- a/ui/app/routes/vault/cluster/index.js
+++ b/ui/app/routes/vault/cluster/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/init.js b/ui/app/routes/vault/cluster/init.js
index b9b4b37fb06..edcd34b8d12 100644
--- a/ui/app/routes/vault/cluster/init.js
+++ b/ui/app/routes/vault/cluster/init.js
@@ -1,8 +1,8 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ClusterRoute from './cluster-route-base';
 
-export default ClusterRoute.extend({});
+export default ClusterRoute;
diff --git a/ui/app/routes/vault/cluster/license.js b/ui/app/routes/vault/cluster/license.js
index 65639975f0e..3868c8c77a5 100644
--- a/ui/app/routes/vault/cluster/license.js
+++ b/ui/app/routes/vault/cluster/license.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/logout.js b/ui/app/routes/vault/cluster/logout.js
index 03d386c3619..4d0fbee7d8d 100644
--- a/ui/app/routes/vault/cluster/logout.js
+++ b/ui/app/routes/vault/cluster/logout.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -25,7 +25,6 @@ export default Route.extend(ModelBoundaryRoute, {
   }),
 
   beforeModel({ to: { queryParams } }) {
-    const authType = this.auth.getAuthType();
     const ns = this.namespaceService.path;
     this.auth.deleteCurrentToken();
     this.controlGroup.deleteTokens();
@@ -40,14 +39,12 @@ export default Route.extend(ModelBoundaryRoute, {
       this.customMessages.clearCustomMessages();
     }
 
-    queryParams.with = authType;
     if (ns) {
       queryParams.namespace = ns;
     }
     if (Ember.testing) {
-      // TODO: cleanup this replaceWith instance. Using router.replaceWith causes test failures
       // Don't redirect on the test
-      this.replaceWith('vault.cluster.auth', { queryParams });
+      this.router.replaceWith('vault.cluster.auth', { queryParams });
     } else {
       const { cluster_name } = this.paramsFor('vault.cluster');
       location.assign(this.router.urlFor('vault.cluster.auth', cluster_name, { queryParams }));
diff --git a/ui/app/routes/vault/cluster/mfa-setup.js b/ui/app/routes/vault/cluster/mfa-setup.js
index ccd46256cd3..c5dc71d6c97 100644
--- a/ui/app/routes/vault/cluster/mfa-setup.js
+++ b/ui/app/routes/vault/cluster/mfa-setup.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/oidc-callback.js b/ui/app/routes/vault/cluster/oidc-callback.js
index 45a99802b16..1cdaced63b6 100644
--- a/ui/app/routes/vault/cluster/oidc-callback.js
+++ b/ui/app/routes/vault/cluster/oidc-callback.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/oidc-provider-ns.js b/ui/app/routes/vault/cluster/oidc-provider-ns.js
index d07af8460fe..a17fe25b67c 100644
--- a/ui/app/routes/vault/cluster/oidc-provider-ns.js
+++ b/ui/app/routes/vault/cluster/oidc-provider-ns.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/oidc-provider.js b/ui/app/routes/vault/cluster/oidc-provider.js
index 8630a643281..190695814b1 100644
--- a/ui/app/routes/vault/cluster/oidc-provider.js
+++ b/ui/app/routes/vault/cluster/oidc-provider.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -29,7 +29,7 @@ export default class VaultClusterOidcProviderRoute extends Route {
   }
 
   beforeModel(transition) {
-    const currentToken = this.auth.get('currentTokenName');
+    const currentToken = this.auth.currentTokenName;
     const qp = transition.to.queryParams;
     // remove redirect_to if carried over from auth
     qp.redirect_to = null;
@@ -148,7 +148,12 @@ export default class VaultClusterOidcProviderRoute extends Route {
     } catch (errorRes) {
       const resp = await errorRes.json();
       const code = resp.error;
-      if (code === 'max_age_violation' || resp?.errors?.includes('permission denied')) {
+      // This go-multierror package formats multiple errors as a single string:
+      // https://github.com/hashicorp/go-multierror/blob/main/format.go#L28
+      // Example: '2 errors occurred:\n\t* permission denied\n\t* invalid token\n\n'
+      // So check for substrings of "permission denied" within each full error message.
+      const permissionDenied = resp?.errors?.some((str) => str.includes('permission denied'));
+      if (code === 'max_age_violation' || permissionDenied) {
         this._redirectToAuth({ ...routeParams, qp, logout: true });
       } else if (code === 'invalid_redirect_uri') {
         return {
diff --git a/ui/app/routes/vault/cluster/policies.js b/ui/app/routes/vault/cluster/policies.js
index 265c1ad12ef..a80ee8d840f 100644
--- a/ui/app/routes/vault/cluster/policies.js
+++ b/ui/app/routes/vault/cluster/policies.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/policies/create.js b/ui/app/routes/vault/cluster/policies/create.js
index 9b820eea3d9..2a704762fe5 100644
--- a/ui/app/routes/vault/cluster/policies/create.js
+++ b/ui/app/routes/vault/cluster/policies/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/policies/index.js b/ui/app/routes/vault/cluster/policies/index.js
index 7e1dd9fd24d..79a7f134f14 100644
--- a/ui/app/routes/vault/cluster/policies/index.js
+++ b/ui/app/routes/vault/cluster/policies/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,11 +9,11 @@ import ClusterRoute from 'vault/mixins/cluster-route';
 import ListRoute from 'core/mixins/list-route';
 
 export default Route.extend(ClusterRoute, ListRoute, {
-  store: service(),
+  pagination: service(),
   version: service(),
 
   shouldReturnEmptyModel(policyType, version) {
-    return policyType !== 'acl' && (version.get('isCommunity') || !version.get('hasSentinel'));
+    return policyType !== 'acl' && (version.isCommunity || !version.hasSentinel);
   },
 
   model(params) {
@@ -21,7 +21,7 @@ export default Route.extend(ClusterRoute, ListRoute, {
     if (this.shouldReturnEmptyModel(policyType, this.version)) {
       return;
     }
-    return this.store
+    return this.pagination
       .lazyPaginatedQuery(`policy/${policyType}`, {
         page: params.page,
         pageFilter: params.pageFilter,
@@ -49,7 +49,7 @@ export default Route.extend(ClusterRoute, ListRoute, {
     controller.setProperties({
       model,
       filter: params.pageFilter || '',
-      page: model.get('meta.currentPage') || 1,
+      page: model.meta?.currentPage || 1,
       policyType: this.policyType(),
     });
   },
@@ -65,12 +65,12 @@ export default Route.extend(ClusterRoute, ListRoute, {
     willTransition(transition) {
       window.scrollTo(0, 0);
       if (!transition || transition.targetName !== this.routeName) {
-        this.store.clearAllDatasets();
+        this.pagination.clearDataset();
       }
       return true;
     },
     reload() {
-      this.store.clearAllDatasets();
+      this.pagination.clearDataset();
       this.refresh();
     },
   },
diff --git a/ui/app/routes/vault/cluster/policy.js b/ui/app/routes/vault/cluster/policy.js
index 8959d25a1b1..694683178e8 100644
--- a/ui/app/routes/vault/cluster/policy.js
+++ b/ui/app/routes/vault/cluster/policy.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/policy/edit.js b/ui/app/routes/vault/cluster/policy/edit.js
index 5f80416602b..b0f11cbab3b 100644
--- a/ui/app/routes/vault/cluster/policy/edit.js
+++ b/ui/app/routes/vault/cluster/policy/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/policy/index.js b/ui/app/routes/vault/cluster/policy/index.js
index b180c3e0ec5..1c0ddb0cf2f 100644
--- a/ui/app/routes/vault/cluster/policy/index.js
+++ b/ui/app/routes/vault/cluster/policy/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/policy/show.js b/ui/app/routes/vault/cluster/policy/show.js
index 68c7f0a4b86..15864c4ad96 100644
--- a/ui/app/routes/vault/cluster/policy/show.js
+++ b/ui/app/routes/vault/cluster/policy/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,6 +8,9 @@ import Route from '@ember/routing/route';
 import UnloadModelRoute from 'vault/mixins/unload-model-route';
 import { service } from '@ember/service';
 
+/**
+ * @type Class
+ */
 export default Route.extend(UnloadModelRoute, {
   router: service(),
   store: service(),
@@ -24,7 +27,6 @@ export default Route.extend(UnloadModelRoute, {
     const type = this.policyType();
     return hash({
       policy: this.store.findRecord(`policy/${type}`, params.policy_name),
-      capabilities: this.store.findRecord('capabilities', `sys/policies/${type}/${params.policy_name}`),
     });
   },
 
diff --git a/ui/app/routes/vault/cluster/recovery.js b/ui/app/routes/vault/cluster/recovery.js
new file mode 100644
index 00000000000..d3e45d5ffa6
--- /dev/null
+++ b/ui/app/routes/vault/cluster/recovery.js
@@ -0,0 +1,8 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+
+export default class RecoveryRoute extends Route {}
diff --git a/ui/app/routes/vault/cluster/recovery/snapshots.ts b/ui/app/routes/vault/cluster/recovery/snapshots.ts
new file mode 100644
index 00000000000..2884f7d23ff
--- /dev/null
+++ b/ui/app/routes/vault/cluster/recovery/snapshots.ts
@@ -0,0 +1,68 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import { SystemListStorageRaftSnapshotLoadListEnum } from '@hashicorp/vault-client-typescript';
+
+import type ApiService from 'vault/services/api';
+import type Capabilities from 'vault/services/capabilities';
+import type { ModelFrom } from 'vault/vault/route';
+import type RouterService from '@ember/routing/router-service';
+import type VersionService from 'vault/services/version';
+
+export type SnapshotsRouteModel = ModelFrom<RecoverySnapshotsRoute>;
+
+export default class RecoverySnapshotsRoute extends Route {
+  @service declare readonly api: ApiService;
+  @service declare readonly capabilities: Capabilities;
+  @service declare readonly router: RouterService;
+  @service declare readonly version: VersionService;
+
+  async model() {
+    if (this.version.isEnterprise) {
+      const { canUpdate } = await this.capabilities.fetchPathCapabilities(
+        'sys/storage/raft/snapshot/snapshot-load'
+      );
+
+      const snapshots = await this.fetchSnapshots();
+
+      return {
+        snapshots,
+        canLoadSnapshot: canUpdate,
+      };
+    }
+    return { snapshots: [], showCommunityMessage: true };
+  }
+
+  redirect(model: SnapshotsRouteModel) {
+    if (model.snapshots.length === 1) {
+      const snapshot_id = model.snapshots[0];
+      this.router.transitionTo('vault.cluster.recovery.snapshots.snapshot.manage', snapshot_id);
+    }
+  }
+
+  async fetchSnapshots() {
+    try {
+      // This request needs to be made within the root namespace context to grab loaded snapshot keys as it is unsupported in any other namespace.
+      // By default, the api service uses the current namespace context, so we'll need to specify otherwise.
+      // Snapshot operations do not have this constraint.
+      const { keys } = await this.api.sys.systemListStorageRaftSnapshotLoad(
+        SystemListStorageRaftSnapshotLoadListEnum.TRUE,
+        this.api.buildHeaders({ namespace: '' })
+      );
+      return keys as string[];
+    } catch (e) {
+      const error = await this.api.parseError(e);
+      if (error.status === 404) {
+        return [];
+      }
+      throw {
+        httpStatus: error.status,
+        ...error,
+      };
+    }
+  }
+}
diff --git a/ui/app/routes/vault/cluster/recovery/snapshots/index.ts b/ui/app/routes/vault/cluster/recovery/snapshots/index.ts
new file mode 100644
index 00000000000..aafacf13232
--- /dev/null
+++ b/ui/app/routes/vault/cluster/recovery/snapshots/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+
+import type RouterService from '@ember/routing/router-service';
+export default class RecoverySnapshotsIndexRoute extends Route {
+  @service declare readonly router: RouterService;
+
+  // There is not a recovery.snapshots.index view because currently only one snapshot can be loaded at a time.
+  // Redirect to the parent route so we can reuse its logic and send users to "recovery.snapshots.snapshot.manage"
+  // if a snapshot is loaded.
+  redirect() {
+    this.router.transitionTo('vault.cluster.recovery.snapshots');
+  }
+}
diff --git a/ui/app/routes/vault/cluster/recovery/snapshots/load.ts b/ui/app/routes/vault/cluster/recovery/snapshots/load.ts
new file mode 100644
index 00000000000..4daea8e466c
--- /dev/null
+++ b/ui/app/routes/vault/cluster/recovery/snapshots/load.ts
@@ -0,0 +1,66 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import { SystemListStorageRaftSnapshotAutoConfigListEnum } from '@hashicorp/vault-client-typescript';
+
+import type ApiService from 'vault/services/api';
+import type { Breadcrumb } from 'vault/vault/app-types';
+import type Controller from '@ember/controller';
+import type { ModelFrom } from 'vault/vault/route';
+
+export type SnapshotsLoadModel = ModelFrom<RecoverySnapshotsLoadRoute>;
+
+interface RouteController extends Controller {
+  breadcrumbs: Array<Breadcrumb>;
+}
+
+export default class RecoverySnapshotsLoadRoute extends Route {
+  @service declare readonly api: ApiService;
+
+  async model() {
+    const { configs, configError } = await this.fetchConfigs();
+    return {
+      configs,
+      configError,
+    };
+  }
+
+  async fetchConfigs() {
+    let configs: string[], configError;
+
+    try {
+      const { keys } = await this.api.sys.systemListStorageRaftSnapshotAutoConfig(
+        SystemListStorageRaftSnapshotAutoConfigListEnum.TRUE
+      );
+      configs = keys ?? [];
+    } catch (e) {
+      const error = await this.api.parseError(e);
+
+      configError = error;
+
+      if (!configError.message) {
+        configError.message = 'Something went wrong';
+      }
+
+      configs = [];
+    }
+
+    return {
+      configs,
+      configError,
+    };
+  }
+
+  setupController(controller: RouteController, resolvedModel: SnapshotsLoadModel) {
+    super.setupController(controller, resolvedModel);
+
+    controller.breadcrumbs = [
+      { label: 'Secrets Recovery', route: 'vault.cluster.recovery.snapshots' },
+      { label: 'Upload', route: 'vault.cluster.recovery.snapshots.load' },
+    ];
+  }
+}
diff --git a/ui/app/routes/vault/cluster/recovery/snapshots/snapshot.ts b/ui/app/routes/vault/cluster/recovery/snapshots/snapshot.ts
new file mode 100644
index 00000000000..bd6c5b59527
--- /dev/null
+++ b/ui/app/routes/vault/cluster/recovery/snapshots/snapshot.ts
@@ -0,0 +1,23 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+
+import type ApiService from 'vault/services/api';
+
+export default class RecoverySnapshotsSnapshotRoute extends Route {
+  @service declare readonly api: ApiService;
+
+  model(params: { snapshot_id: string }) {
+    // This request needs to be made within the root namespace context to grab the loaded snapshot as it is unsupported in any other namespace.
+    // By default, the api service uses the current namespace context, so we'll need to specify otherwise.
+    // Snapshot operations do not have this constraint.
+    return this.api.sys.systemReadStorageRaftSnapshotLoadId(
+      params.snapshot_id,
+      this.api.buildHeaders({ namespace: '' })
+    );
+  }
+}
diff --git a/ui/app/routes/vault/cluster/recovery/snapshots/snapshot/details.ts b/ui/app/routes/vault/cluster/recovery/snapshots/snapshot/details.ts
new file mode 100644
index 00000000000..37150fe61f6
--- /dev/null
+++ b/ui/app/routes/vault/cluster/recovery/snapshots/snapshot/details.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+
+import type { ModelFrom } from 'vault/vault/route';
+
+export type SnapshotManageModel = ModelFrom<RecoverySnapshotsSnapshotDetailsRoute>;
+
+export default class RecoverySnapshotsSnapshotDetailsRoute extends Route {
+  async model() {
+    const snapshot = this.modelFor('vault.cluster.recovery.snapshots.snapshot');
+    return {
+      snapshot,
+    };
+  }
+}
diff --git a/ui/app/routes/vault/cluster/recovery/snapshots/snapshot/manage.ts b/ui/app/routes/vault/cluster/recovery/snapshots/snapshot/manage.ts
new file mode 100644
index 00000000000..8ecace3b426
--- /dev/null
+++ b/ui/app/routes/vault/cluster/recovery/snapshots/snapshot/manage.ts
@@ -0,0 +1,49 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+
+import type ApiService from 'vault/services/api';
+import type { ModelFrom } from 'vault/vault/route';
+import type NamespaceService from 'vault/services/namespace';
+
+export type SnapshotManageModel = ModelFrom<RecoverySnapshotsSnapshotManageRoute>;
+
+type SnapshotModel = {
+  auto_snapshot_config: string;
+  cluster_id: string;
+  error: string;
+  expires_at: string;
+  snapshot_id: string;
+  status: 'ready' | 'error' | 'loading';
+  uploader_entity_id: string;
+  url: string;
+};
+
+export default class RecoverySnapshotsSnapshotManageRoute extends Route {
+  @service declare readonly api: ApiService;
+  @service declare readonly namespace: NamespaceService;
+
+  async model() {
+    const snapshot = this.modelFor('vault.cluster.recovery.snapshots.snapshot') as SnapshotModel;
+    const namespaces = this.namespace.inRootNamespace ? await this.fetchNamespaces() : [];
+    return {
+      snapshot,
+      namespaces,
+    };
+  }
+
+  async fetchNamespaces() {
+    try {
+      const { keys } = await this.api.sys.internalUiListNamespaces();
+
+      // Add the root namespace because `sys/internal/ui/namespaces` does not include it.
+      return keys ?? [];
+    } catch {
+      return [];
+    }
+  }
+}
diff --git a/ui/app/routes/vault/cluster/redirect.js b/ui/app/routes/vault/cluster/redirect.js
index 9c07fed8631..9a225deed20 100644
--- a/ui/app/routes/vault/cluster/redirect.js
+++ b/ui/app/routes/vault/cluster/redirect.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/replication-dr-promote/details.js b/ui/app/routes/vault/cluster/replication-dr-promote/details.js
index 0d5f19cf528..36db679ae1b 100644
--- a/ui/app/routes/vault/cluster/replication-dr-promote/details.js
+++ b/ui/app/routes/vault/cluster/replication-dr-promote/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/replication-dr-promote/index.js b/ui/app/routes/vault/cluster/replication-dr-promote/index.js
index 0d5f19cf528..36db679ae1b 100644
--- a/ui/app/routes/vault/cluster/replication-dr-promote/index.js
+++ b/ui/app/routes/vault/cluster/replication-dr-promote/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets-redirect.js b/ui/app/routes/vault/cluster/secrets-redirect.js
new file mode 100644
index 00000000000..b7bb8e3f9ac
--- /dev/null
+++ b/ui/app/routes/vault/cluster/secrets-redirect.js
@@ -0,0 +1,16 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+
+export default class SecretsRedirectRoute extends Route {
+  @service router;
+
+  beforeModel() {
+    // Redirect to secrets page under /secrets-engines
+    // if the user navigates to the legacy path /secrets
+    this.router.replaceWith('vault.cluster.secrets');
+  }
+}
diff --git a/ui/app/routes/vault/cluster/secrets.js b/ui/app/routes/vault/cluster/secrets.js
index 1677e54ee3e..6ba3f5eabfb 100644
--- a/ui/app/routes/vault/cluster/secrets.js
+++ b/ui/app/routes/vault/cluster/secrets.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend.js b/ui/app/routes/vault/cluster/secrets/backend.js
index 5e3a1942e17..6af1d2bced2 100644
--- a/ui/app/routes/vault/cluster/secrets/backend.js
+++ b/ui/app/routes/vault/cluster/secrets/backend.js
@@ -1,33 +1,40 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
 import Route from '@ember/routing/route';
+import SecretsEngineResource from 'vault/resources/secrets/engine';
+
 export default Route.extend({
   flashMessages: service(),
   router: service(),
   secretMountPath: service(),
-  store: service(),
+  api: service(),
+
   oldModel: null,
 
-  model(params) {
+  async model(params) {
     const { backend } = params;
     this.secretMountPath.update(backend);
-    return this.store
-      .query('secret-engine', {
-        path: backend,
-      })
-      .then((model) => {
-        if (model) {
-          return model[0];
-        }
-      });
+
+    try {
+      const secretsEngine = await this.api.sys.internalUiReadMountInformation(backend);
+      return new SecretsEngineResource({ ...secretsEngine, path: `${backend}/` });
+    } catch (e) {
+      // the backend.error template is expecting additional data so for now we will catch and rethrow
+      const error = await this.api.parseError(e);
+      throw {
+        backend,
+        httpStatus: error.status,
+        ...error,
+      };
+    }
   },
 
   afterModel(model, transition) {
-    const path = model && model.get('path');
+    const path = model && model.path;
     if (transition.targetName === this.routeName) {
       return this.router.replaceWith('vault.cluster.secrets.backend.list-root', path);
     }
diff --git a/ui/app/routes/vault/cluster/secrets/backend/actions.js b/ui/app/routes/vault/cluster/secrets/backend/actions.js
index 98a59819216..22633b05c7f 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/actions.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/actions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -31,5 +31,24 @@ export default EditBase.extend({
     this._super(...arguments);
     const { selectedAction } = this.paramsFor(this.routeName);
     controller.set('selectedAction', selectedAction || model.secret.supportedActions[0]);
+    controller.set('breadcrumbs', [
+      {
+        label: 'Secrets',
+        route: 'vault.cluster.secrets',
+      },
+      {
+        label: model.secret.backend,
+        route: 'vault.cluster.secrets.backend.list-root',
+        model: model.secret.backend,
+      },
+      {
+        label: model.secret.id,
+        route: 'vault.cluster.secrets.backend.show',
+        models: [model.secret.backend, model.secret.id],
+      },
+      {
+        label: 'Actions',
+      },
+    ]);
   },
 });
diff --git a/ui/app/routes/vault/cluster/secrets/backend/configuration.js b/ui/app/routes/vault/cluster/secrets/backend/configuration.js
index faaf3e71e63..6f05215204f 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/configuration.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/configuration.js
@@ -1,34 +1,150 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
 import Route from '@ember/routing/route';
 
-export default Route.extend({
-  store: service(),
+/**
+ * This route is responsible for fetching all configuration data.
+ * This includes the configuration attached to the secret engine.
+ * In addition, any configuration data associated with configurable engines (aws, azure, gcp, ssh).
+ */
+
+export default class SecretsBackendConfigurationRoute extends Route {
+  @service api;
+  @service version;
+
   async model() {
-    const backend = this.modelFor('vault.cluster.secrets.backend');
-    if (backend.isV2KV) {
-      const canRead = await this.store
-        .findRecord('capabilities', `${backend.id}/config`)
-        .then((response) => response.canRead);
-      // only set these config params if they can read the config endpoint.
-      if (canRead) {
-        // design wants specific default to show that can't be set in the model
-        backend.set('casRequired', backend.casRequired ? backend.casRequired : 'False');
-        backend.set(
-          'deleteVersionAfter',
-          backend.deleteVersionAfter !== '0s' ? backend.deleteVersionAfter : 'Never delete'
-        );
-      } else {
-        // remove the default values from the model if they don't have read access otherwise it will display the defaults even if they've been set (because they error on returning config data)
-        backend.set('casRequired', null);
-        backend.set('deleteVersionAfter', null);
-        backend.set('maxVersions', null);
+    const secretsEngine = this.modelFor('vault.cluster.secrets.backend');
+    const { type, id } = secretsEngine;
+    return {
+      secretsEngine,
+      config: await this.fetchConfig(type, id), // fetch config for configurable engines (aws, azure, gcp, ssh)
+    };
+  }
+
+  fetchConfig(type, id) {
+    // id is the path where the backend is mounted since there's only one config per engine (often this path is referred to just as backend)
+    switch (type) {
+      case 'aws':
+        return this.fetchAwsConfigs(id);
+      case 'azure':
+        return this.fetchAzureConfig(id);
+      case 'gcp':
+        return this.fetchGcpConfig(id);
+      case 'ssh':
+        return this.fetchSshCaConfig(id);
+    }
+  }
+
+  async fetchAwsConfigs(path) {
+    // AWS has two configuration endpoints root and lease, as well as a separate endpoint for the issuer.
+    const handleError = async (e) => {
+      const error = await this.parseApiError(e);
+      if (error.httpStatus === 404) {
+        // a 404 error is thrown when the lease config hasn't been set yet.
+        return {};
+      }
+      throw error;
+    };
+
+    const { data: configRoot } = await this.api.secrets
+      .awsReadRootIamCredentialsConfiguration(path)
+      .catch(handleError);
+    const { data: configLease } = await this.api.secrets.awsReadLeaseConfiguration(path).catch(handleError);
+
+    const WIF_FIELDS = ['role_arn', 'identity_token_audience', 'identity_token_ttl'];
+    const issuer = await this.checkIssuer(configRoot, WIF_FIELDS);
+
+    if (configRoot) {
+      return Object.assign(configRoot, configLease, issuer);
+    }
+  }
+
+  async fetchAzureConfig(path) {
+    try {
+      const { data: azureConfig } = await this.api.secrets.azureReadConfiguration(path);
+      const WIF_FIELDS = ['identity_token_audience', 'identity_token_ttl'];
+      const issuer = await this.checkIssuer(azureConfig, WIF_FIELDS);
+      // azure config endpoint returns 200 with default values if engine has not been configured yet
+      // all values happen to be falsy so we can just check if any are truthy
+      const isConfigured = Object.values(azureConfig).some((value) => value);
+      if (isConfigured) {
+        return Object.assign({}, azureConfig, issuer);
+      }
+    } catch (e) {
+      const error = await this.parseApiError(e);
+      if (error.httpStatus === 404) {
+        // a 404 error is thrown when Azure's config hasn't been set yet.
+        return;
       }
+      throw error;
     }
-    return backend;
-  },
-});
+  }
+
+  async fetchGcpConfig(path) {
+    try {
+      const { data: gcpConfig } = await this.api.secrets.googleCloudReadConfiguration(path);
+      const WIF_FIELDS = ['identity_token_audience', 'identity_token_ttl', 'service_account_email'];
+      const issuer = await this.checkIssuer(gcpConfig, WIF_FIELDS);
+
+      if (gcpConfig) {
+        return Object.assign(gcpConfig, issuer);
+      }
+    } catch (e) {
+      const error = await this.parseApiError(e);
+      if (error.httpStatus === 404) {
+        // a 404 error is thrown when GCP's config hasn't been set yet.
+        return;
+      }
+      throw error;
+    }
+  }
+
+  async fetchSshCaConfig(path) {
+    try {
+      const { data } = await this.api.secrets.sshReadCaConfiguration(path);
+      return data;
+    } catch (e) {
+      const error = await this.parseApiError(e);
+      if (
+        error.httpStatus === 400 &&
+        error.errors?.some((str) => str.includes(`keys haven't been configured yet`))
+      ) {
+        // When first mounting a SSH engine it throws a 400 error with this specific message.
+        // We want to catch this situation and return nothing so that the component can handle it correctly.
+        return;
+      }
+      throw error;
+    }
+  }
+
+  async checkIssuer(config, fields) {
+    // issuer is an enterprise only related feature
+    // issuer is also a global endpoint that doesn't mean anything in the secret details context if WIF related fields on the engine's config have not been set.
+    if (this.version.isEnterprise && config) {
+      const shouldFetchIssuer = fields.some((field) => config[field]);
+
+      if (shouldFetchIssuer) {
+        try {
+          const { data } = await this.api.identity.oidcReadConfiguration();
+          return data;
+        } catch (e) {
+          // silently fail if the endpoint is not available or the user doesn't have permission to access it.
+        }
+      }
+    }
+  }
+
+  async parseApiError(e) {
+    const { backend } = this.paramsFor('vault.cluster.secrets.backend');
+    const error = await this.api.parseError(e);
+    return {
+      backend,
+      httpStatus: error.status,
+      ...error.response,
+    };
+  }
+}
diff --git a/ui/app/routes/vault/cluster/secrets/backend/configuration/edit.ts b/ui/app/routes/vault/cluster/secrets/backend/configuration/edit.ts
new file mode 100644
index 00000000000..068152ad945
--- /dev/null
+++ b/ui/app/routes/vault/cluster/secrets/backend/configuration/edit.ts
@@ -0,0 +1,60 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import AwsConfigForm from 'vault/forms/secrets/aws-config';
+import AzureConfigForm from 'vault/forms/secrets/azure-config';
+import GcpConfigForm from 'vault/forms/secrets/gcp-config';
+import SshConfigForm from 'vault/forms/secrets/ssh-config';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+
+import type SecretsEngineResource from 'vault/resources/secrets/engine';
+import type ApiService from 'vault/services/api';
+import type VersionService from 'vault/services/version';
+
+type SecretsBackendConfigurationModel = {
+  secretsEngine: SecretsEngineResource;
+  config: Record<string, unknown>;
+};
+
+// This route file is reused for all configurable secret engines.
+// It returns config forms based on the engine type.
+// Saving and updating of form data is done within the engine specific components.
+
+export default class SecretsBackendConfigurationEdit extends Route {
+  @service declare readonly api: ApiService;
+  @service declare readonly version: VersionService;
+
+  async model() {
+    const { backend } = this.paramsFor('vault.cluster.secrets.backend');
+    const { type } = this.modelFor('vault.cluster.secrets.backend') as SecretsEngineResource;
+    const { config } = this.modelFor(
+      'vault.cluster.secrets.backend.configuration'
+    ) as SecretsBackendConfigurationModel;
+
+    const formClass = {
+      aws: AwsConfigForm,
+      azure: AzureConfigForm,
+      gcp: GcpConfigForm,
+      ssh: SshConfigForm,
+    }[type];
+
+    const defaults = {
+      ssh: { generate_signing_key: true, issuer: '' },
+    }[type] || { issuer: '' };
+
+    // if the engine type is not configurable or a form class does not exist for the type return a 404.
+    if (!engineDisplayData(type)?.isConfigurable || !formClass) {
+      throw { httpStatus: 404, backend };
+    }
+
+    return {
+      type,
+      id: backend,
+      configForm: new formClass(config || defaults, { isNew: !config }),
+    };
+  }
+}
diff --git a/ui/app/routes/vault/cluster/secrets/backend/configuration/general-settings.ts b/ui/app/routes/vault/cluster/secrets/backend/configuration/general-settings.ts
new file mode 100644
index 00000000000..7a60261ea3f
--- /dev/null
+++ b/ui/app/routes/vault/cluster/secrets/backend/configuration/general-settings.ts
@@ -0,0 +1,85 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import { getPluginVersionsFromEngineType } from 'vault/utils/plugin-catalog-helpers';
+
+import type SecretsEngineResource from 'vault/resources/secrets/engine';
+import type ApiService from 'vault/services/api';
+import type PluginCatalogService from 'vault/services/plugin-catalog';
+import type UnsavedChangesService from 'vault/services/unsaved-changes';
+import type Controller from '@ember/controller';
+import type Transition from '@ember/routing/transition';
+import type RouterService from '@ember/routing/router-service';
+import type SecretEngineModel from 'vault/models/secret-engine';
+
+interface RouteModel {
+  secretsEngine: SecretEngineModel;
+  versions: string[];
+}
+
+interface RouteController extends Controller {
+  model: Record<string, unknown> | undefined;
+  changedFields: string[];
+}
+
+export default class SecretsBackendConfigurationGeneralSettingsRoute extends Route {
+  @service declare readonly api: ApiService;
+  @service declare readonly router: RouterService;
+  @service declare readonly pluginCatalog: PluginCatalogService;
+  @service declare readonly unsavedChanges: UnsavedChangesService;
+
+  oldModel: Record<string, unknown> | undefined;
+
+  async model() {
+    const secretsEngine = this.modelFor('vault.cluster.secrets.backend') as SecretsEngineResource;
+    const { data } = await this.pluginCatalog.getRawPluginCatalogData();
+    const versions = getPluginVersionsFromEngineType(data?.secret, secretsEngine.type);
+
+    const model = { secretsEngine, versions };
+    this.unsavedChanges.initialState = JSON.parse(JSON.stringify(model.secretsEngine));
+
+    return { secretsEngine, versions };
+  }
+
+  setupController(controller: RouteController, resolvedModel: RouteModel, transition: Transition) {
+    super.setupController(controller, resolvedModel, transition);
+    const { secretsEngine } = resolvedModel;
+
+    const breadcrumbs = [
+      { label: 'Secrets', route: 'vault.cluster.secrets' },
+      { label: secretsEngine.id, route: 'vault.cluster.secrets.backend.list-root', model: secretsEngine.id },
+      { label: 'Configuration' },
+    ];
+
+    controller.set('breadcrumbs', breadcrumbs);
+  }
+
+  @action
+  willTransition(transition: Transition) {
+    // eslint-disable-next-line ember/no-controller-access-in-routes
+    const controller = this.controllerFor(this.routeName) as RouteController;
+
+    const { model } = controller;
+
+    // Only intercept transition if leaving THIS route and there are changes
+    const targetRoute = transition?.to?.name ?? '';
+    // Saving transitions to the index route, so we do not one to intercept the transition then
+    if (this.routeName !== targetRoute && this.oldModel && model) {
+      const oldModel = this.oldModel['secretsEngine'] as Record<string, unknown> | undefined;
+      const currentModel = model['secretsEngine'] as Record<string, unknown> | undefined;
+      this.unsavedChanges.setupProperties(oldModel, currentModel);
+      this.unsavedChanges.getDiff();
+
+      if (this.unsavedChanges.hasChanges) {
+        transition.abort();
+        this.unsavedChanges.showModal = true;
+      }
+    }
+    return true;
+  }
+}
diff --git a/ui/app/routes/vault/cluster/secrets/backend/configuration/index.js b/ui/app/routes/vault/cluster/secrets/backend/configuration/index.js
new file mode 100644
index 00000000000..290c07b2ac7
--- /dev/null
+++ b/ui/app/routes/vault/cluster/secrets/backend/configuration/index.js
@@ -0,0 +1,31 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+
+export default class SecretsBackendConfigurationIndexRoute extends Route {
+  @service router;
+
+  beforeModel() {
+    const {
+      secretsEngine: { type },
+    } = this.modelFor('vault.cluster.secrets.backend.configuration');
+    const engine = engineDisplayData(type);
+
+    if (!engine?.isOldEngine) {
+      return this.router.replaceWith('vault.cluster.secrets.backend.configuration.general-settings');
+    }
+  }
+
+  setupController(controller, resolvedModel) {
+    super.setupController(controller, resolvedModel);
+    const engine = engineDisplayData(resolvedModel.secretsEngine.type);
+    controller.typeDisplay = engine.displayName;
+    controller.isConfigurable = engine.isConfigurable ?? false;
+    controller.modelId = resolvedModel.secretsEngine.id;
+  }
+}
diff --git a/ui/app/routes/vault/cluster/secrets/backend/configuration/plugin-settings.ts b/ui/app/routes/vault/cluster/secrets/backend/configuration/plugin-settings.ts
new file mode 100644
index 00000000000..50b57b6aa0b
--- /dev/null
+++ b/ui/app/routes/vault/cluster/secrets/backend/configuration/plugin-settings.ts
@@ -0,0 +1,52 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+
+import type SecretsEngineResource from 'vault/resources/secrets/engine';
+import type ApiService from 'vault/services/api';
+import type { Breadcrumb } from 'vault/vault/app-types';
+import type Controller from '@ember/controller';
+import type SecretEngineModel from 'vault/models/secret-engine';
+import type Transition from '@ember/routing/transition';
+
+interface RouteModel {
+  secretsEngine: SecretEngineModel;
+  versions: string[];
+  config: Record<string, unknown>;
+}
+
+interface RouteController extends Controller {
+  breadcrumbs: Array<Breadcrumb>;
+  model: RouteModel;
+}
+
+export default class SecretsBackendConfigurationPluginSettingsRoute extends Route {
+  @service declare readonly api: ApiService;
+
+  async model() {
+    const secretsEngine = this.modelFor('vault.cluster.secrets.backend') as SecretsEngineResource;
+    const { config } = this.modelFor('vault.cluster.secrets.backend.configuration') as Record<
+      string,
+      unknown
+    >;
+
+    return { secretsEngine, config };
+  }
+
+  setupController(controller: RouteController, resolvedModel: RouteModel, transition: Transition) {
+    super.setupController(controller, resolvedModel, transition);
+    const { secretsEngine } = resolvedModel;
+
+    const breadcrumbs = [
+      { label: 'Secrets', route: 'vault.cluster.secrets' },
+      { label: secretsEngine.id, route: 'vault.cluster.secrets.backend.list-root', model: secretsEngine.id },
+      { label: 'Configuration' },
+    ];
+
+    controller.set('breadcrumbs', breadcrumbs);
+  }
+}
diff --git a/ui/app/routes/vault/cluster/secrets/backend/create-root.js b/ui/app/routes/vault/cluster/secrets/backend/create-root.js
index 80e6d6ef31f..dc78bc2dfe3 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/create-root.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/create-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/create.js b/ui/app/routes/vault/cluster/secrets/backend/create.js
index a92d9bbed15..dfcb69d331d 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/create.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/credentials-root.js b/ui/app/routes/vault/cluster/secrets/backend/credentials-root.js
index 535f45d7c4a..c4a500c6142 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/credentials-root.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/credentials-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/credentials.js b/ui/app/routes/vault/cluster/secrets/backend/credentials.js
index 4d4c71253b5..c921c53d176 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/credentials.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/credentials.js
@@ -1,14 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { resolve } from 'rsvp';
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 import ControlGroupError from 'vault/lib/control-group-error';
 
-const SUPPORTED_DYNAMIC_BACKENDS = ['database', 'ssh', 'aws'];
+const SUPPORTED_DYNAMIC_BACKENDS = ['database', 'ssh', 'aws', 'totp'];
 
 export default Route.extend({
   templateName: 'vault/cluster/secrets/backend/credentials',
@@ -16,17 +15,22 @@ export default Route.extend({
   router: service(),
   store: service(),
 
-  backendModel() {
-    return this.modelFor('vault.cluster.secrets.backend');
-  },
+  beforeModel(transition) {
+    const { id: backendPath, type: backendType } = this.modelFor('vault.cluster.secrets.backend');
+    // redirect if the backend type does not support credentials
+    if (!SUPPORTED_DYNAMIC_BACKENDS.includes(backendType)) {
+      return this.router.transitionTo('vault.cluster.secrets.backend.list-root', backendPath);
+    }
+    // hydrate model if backend type is ssh
+    if (backendType === 'ssh') {
+      this.pathHelp.hydrateModel('ssh-otp-credential', backendPath);
+    }
 
-  beforeModel() {
-    const { backend } = this.paramsFor('vault.cluster.secrets.backend');
-    if (backend != 'ssh') {
-      return;
+    // assign back button route
+    if (backendType === 'totp') {
+      const previousRoute = transition.from?.name ?? 'vault.cluster.secrets.backend.list-root';
+      this.set('backRoute', previousRoute);
     }
-    const modelType = 'ssh-otp-credential';
-    return this.pathHelp.getNewModel(modelType, backend);
   },
 
   getDatabaseCredential(backend, secret, roleType = '') {
@@ -55,26 +59,49 @@ export default Route.extend({
     });
   },
 
+  async getAwsRole(backend, id) {
+    try {
+      const role = await this.store.queryRecord('role-aws', { backend, id });
+      return role;
+    } catch (e) {
+      // swallow error, non-essential data
+      return;
+    }
+  },
+
+  async getTotpKey(backend, keyName) {
+    try {
+      const key = await this.store.queryRecord('totp-key', { id: keyName, backend });
+      return key;
+    } catch (e) {
+      // swallow error, non-essential data
+      return;
+    }
+  },
+
   async model(params) {
     const role = params.secret;
-    const backendModel = this.backendModel();
-    const backendPath = backendModel.get('id');
-    const backendType = backendModel.get('type');
+    const { id: backendPath, type: backendType } = this.modelFor('vault.cluster.secrets.backend');
+    const backendData = { backendPath, backendType };
     const roleType = params.roleType;
-    let dbCred;
+    let dbCred, awsRole, totpCodePeriod, backRoute;
     if (backendType === 'database') {
       dbCred = await this.getDatabaseCredential(backendPath, role, roleType);
+    } else if (backendType === 'aws') {
+      awsRole = await this.getAwsRole(backendPath, role);
+    } else if (backendType === 'totp') {
+      totpCodePeriod = (await this.getTotpKey(backendPath, role))?.period ?? 30;
+      backRoute = this.backRoute;
+      return { ...backendData, keyName: role, totpCodePeriod, backRoute };
     }
-    if (!SUPPORTED_DYNAMIC_BACKENDS.includes(backendModel.get('type'))) {
-      return this.router.transitionTo('vault.cluster.secrets.backend.list-root', backendPath);
-    }
-    return resolve({
-      backendPath,
-      backendType,
+
+    return {
+      ...backendData,
       roleName: role,
       roleType,
       dbCred,
-    });
+      awsRoleType: awsRole?.credentialType,
+    };
   },
 
   resetController(controller) {
diff --git a/ui/app/routes/vault/cluster/secrets/backend/edit-metadata.js b/ui/app/routes/vault/cluster/secrets/backend/edit-metadata.js
deleted file mode 100644
index 3f3e2d3b287..00000000000
--- a/ui/app/routes/vault/cluster/secrets/backend/edit-metadata.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Metadata from './metadata';
-
-export default class EditMetadataRoute extends Metadata {}
diff --git a/ui/app/routes/vault/cluster/secrets/backend/edit-root.js b/ui/app/routes/vault/cluster/secrets/backend/edit-root.js
index 61780f84a1a..3aa0adfcb5b 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/edit-root.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/edit-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/edit.js b/ui/app/routes/vault/cluster/secrets/backend/edit.js
index 7cde9bd593f..d986dd26934 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/edit.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/index.js b/ui/app/routes/vault/cluster/secrets/backend/index.js
index 2cda402c271..35fb49795e1 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/index.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/list-root.js b/ui/app/routes/vault/cluster/secrets/backend/list-root.js
index 426f59f55ac..8ace7710033 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/list-root.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/list-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/list.js b/ui/app/routes/vault/cluster/secrets/backend/list.js
index c66b8626375..e68454c867c 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/list.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,15 +7,31 @@ import { set } from '@ember/object';
 import { hash } from 'rsvp';
 import Route from '@ember/routing/route';
 import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
-import { allEngines, isAddonEngine } from 'vault/helpers/mountable-secret-engines';
+import { isAddonEngine, filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
 import { service } from '@ember/service';
 import { normalizePath } from 'vault/utils/path-encoding-helpers';
 import { assert } from '@ember/debug';
 import { pathIsDirectory } from 'kv/utils/kv-breadcrumbs';
+import engineDisplayData from 'vault/helpers/engines-display-data';
 
 const SUPPORTED_BACKENDS = supportedSecretBackends();
 
+function getValidPage(pageParam) {
+  if (typeof pageParam === 'number') {
+    return pageParam;
+  }
+  if (typeof pageParam === 'string') {
+    try {
+      return parseInt(pageParam, 10) || 1;
+    } catch (e) {
+      return 1;
+    }
+  }
+  return 1;
+}
+
 export default Route.extend({
+  pagination: service(),
   store: service(),
   templateName: 'vault/cluster/secrets/backend/list',
   pathHelp: service('path-help'),
@@ -66,11 +82,17 @@ export default Route.extend({
     const secret = this.secretParam();
     const backend = this.enginePathParam();
     const { tab } = this.paramsFor('vault.cluster.secrets.backend.list-root');
-    const secretEngine = this.store.peekRecord('secret-engine', backend);
+    const secretEngine = this.modelFor('vault.cluster.secrets.backend');
     const type = secretEngine?.engineType;
     assert('secretEngine.engineType is not defined', !!type);
-    const engineRoute = allEngines().find((engine) => engine.type === type)?.engineRoute;
+    // if configuration only, redirect to configuration route
+    if (engineDisplayData(type)?.isOnlyMountable) {
+      return this.router.transitionTo('vault.cluster.secrets.backend.configuration', backend);
+    }
 
+    const engineRoute = filterEnginesByMountCategory({ mountCategory: 'secret', isEnterprise: true }).find(
+      (engine) => engine.type === type
+    )?.engineRoute;
     if (!type || !SUPPORTED_BACKENDS.includes(type)) {
       return this.router.transitionTo('vault.cluster.secrets');
     }
@@ -82,16 +104,17 @@ export default Route.extend({
         return this.router.transitionTo('vault.cluster.secrets.backend.kv.list-directory', backend, secret);
       }
       return this.router.transitionTo(`vault.cluster.secrets.backend.${engineRoute}`, backend);
+    } else if (secretEngine.isV2KV) {
+      // if it's KV v2 but not registered as an addon, it's type generic
+      return this.router.transitionTo('vault.cluster.secrets.backend.kv.list', backend);
     }
-    const modelType = this.getModelType(backend, tab);
-    return this.pathHelp.getNewModel(modelType, backend).then(() => {
+    const modelType = this.getModelType(type, tab);
+    return this.pathHelp.hydrateModel(modelType, backend).then(() => {
       this.store.unloadAll('capabilities');
     });
   },
 
-  getModelType(backend, tab) {
-    const secretEngine = this.store.peekRecord('secret-engine', backend);
-    const type = secretEngine.engineType;
+  getModelType(type, tab) {
     const types = {
       database: tab === 'role' ? 'database/role' : 'database/connection',
       transit: 'transit-key',
@@ -102,6 +125,7 @@ export default Route.extend({
       kv: 'secret',
       keymgmt: `keymgmt/${tab || 'key'}`,
       generic: 'secret',
+      totp: 'totp-key',
     };
     return types[type];
   },
@@ -110,16 +134,16 @@ export default Route.extend({
     const secret = this.secretParam() || '';
     const backend = this.enginePathParam();
     const backendModel = this.modelFor('vault.cluster.secrets.backend');
-    const modelType = this.getModelType(backend, params.tab);
+    const modelType = this.getModelType(backendModel.engineType, params.tab);
 
     return hash({
       secret,
-      secrets: this.store
+      secrets: this.pagination
         .lazyPaginatedQuery(modelType, {
           id: secret,
           backend,
           responsePath: 'data.keys',
-          page: params.page || 1,
+          page: getValidPage(params.page),
           pageFilter: params.pageFilter,
         })
         .then((model) => {
@@ -127,8 +151,7 @@ export default Route.extend({
           return model;
         })
         .catch((err) => {
-          // if we're at the root we don't want to throw
-          if (backendModel && err.httpStatus === 404 && secret === '') {
+          if (backendModel && err.httpStatus === 404) {
             return [];
           } else {
             // else we're throwing and dealing with this in the error action
@@ -143,11 +166,11 @@ export default Route.extend({
     const secret = resolvedModel.secret;
     const model = resolvedModel.secrets;
     const backend = this.enginePathParam();
-    const backendModel = this.store.peekRecord('secret-engine', backend);
+    const backendModel = this.modelFor('vault.cluster.secrets.backend');
     const has404 = this.has404;
     // only clear store cache if this is a new model
-    if (secret !== controller.get('baseKey.id')) {
-      this.store.clearAllDatasets();
+    if (secret !== controller?.baseKey?.id) {
+      this.pagination.clearDataset();
     }
     controller.set('hasModel', true);
     controller.setProperties({
@@ -156,7 +179,7 @@ export default Route.extend({
       backend,
       backendModel,
       baseKey: { id: secret },
-      backendType: backendModel.get('engineType'),
+      backendType: backendModel.engineType,
     });
     if (!has404) {
       const pageFilter = secretParams.pageFilter;
@@ -187,14 +210,8 @@ export default Route.extend({
       const backend = this.enginePathParam();
       const is404 = error.httpStatus === 404;
       /* eslint-disable-next-line ember/no-controller-access-in-routes */
-      const hasModel = this.controllerFor(this.routeName).get('hasModel');
+      const hasModel = this.controllerFor(this.routeName).hasModel;
 
-      // this will occur if we've deleted something,
-      // and navigate to its parent and the parent doesn't exist -
-      // this if often the case with nested keys in kv-like engines
-      if (transition.data.isDeletion && is404) {
-        throw error;
-      }
       set(error, 'secret', secret);
       set(error, 'isRoot', true);
       set(error, 'backend', backend);
@@ -210,12 +227,12 @@ export default Route.extend({
     willTransition(transition) {
       window.scrollTo(0, 0);
       if (transition.targetName !== this.routeName) {
-        this.store.clearAllDatasets();
+        this.pagination.clearDataset();
       }
       return true;
     },
     reload() {
-      this.store.clearAllDatasets();
+      this.pagination.clearDataset();
       this.refresh();
     },
   },
diff --git a/ui/app/routes/vault/cluster/secrets/backend/overview.js b/ui/app/routes/vault/cluster/secrets/backend/overview.js
index 5058774a3ee..3fa44865412 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/overview.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/overview.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/secret-edit.js b/ui/app/routes/vault/cluster/secrets/backend/secret-edit.js
index 67b96ab6a1c..88640e8a9a7 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/secret-edit.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/secret-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,6 +11,9 @@ import Route from '@ember/routing/route';
 import { encodePath, normalizePath } from 'vault/utils/path-encoding-helpers';
 import { keyIsFolder, parentKeyForKey } from 'core/utils/key-utils';
 
+/**
+ * @type Class
+ */
 export default Route.extend({
   store: service(),
   router: service(),
@@ -68,7 +71,7 @@ export default Route.extend({
   },
 
   backendType() {
-    return this.modelFor('vault.cluster.secrets.backend').get('engineType');
+    return this.modelFor('vault.cluster.secrets.backend').engineType;
   },
 
   templateName: 'vault/cluster/secrets/backend/secretEditLayout',
@@ -81,17 +84,27 @@ export default Route.extend({
       const mode = this.routeName.split('.').pop();
       // for kv v2, redirect users from the old url to the new engine url (1.15.0 +)
       if (secretEngine.type === 'kv' && secretEngine.version === 2) {
-        // if no secret param redirect to the create route
-        // if secret param they are either viewing or editing secret so navigate to the details route
-        if (!secret) {
-          this.router.transitionTo('vault.cluster.secrets.backend.kv.create', secretEngine.id);
-        } else {
-          this.router.transitionTo(
-            'vault.cluster.secrets.backend.kv.secret.details',
-            secretEngine.id,
-            secret
-          );
+        let route, params;
+        switch (true) {
+          case !secret:
+            // if no secret param redirect to the create route
+            route = 'vault.cluster.secrets.backend.kv.create';
+            params = [secretEngine.id];
+            break;
+          case this.routeName === 'vault.cluster.secrets.backend.show':
+            route = 'vault.cluster.secrets.backend.kv.secret.index';
+            params = [secretEngine.id, secret];
+            break;
+          case this.routeName === 'vault.cluster.secrets.backend.edit':
+            route = 'vault.cluster.secrets.backend.kv.secret.details.edit';
+            params = [secretEngine.id, secret];
+            break;
+          default:
+            route = 'vault.cluster.secrets.backend.kv.secret.index';
+            params = [secretEngine.id, secret];
+            break;
         }
+        this.router.transitionTo(route, ...params);
         return;
       }
       if (mode === 'edit' && keyIsFolder(secret)) {
@@ -111,12 +124,12 @@ export default Route.extend({
     if (modelType === 'secret') {
       return resolve();
     }
-    return this.pathHelp.getNewModel(modelType, backend);
+    return this.pathHelp.hydrateModel(modelType, backend);
   },
 
   modelType(backend, secret, options = {}) {
     const backendModel = this.modelFor('vault.cluster.secrets.backend', backend);
-    const type = backendModel.get('engineType');
+    const { engineType } = backendModel;
     const types = {
       database: secret && secret.startsWith('role/') ? 'database/role' : 'database/connection',
       transit: 'transit-key',
@@ -127,13 +140,14 @@ export default Route.extend({
       kv: 'secret',
       keymgmt: `keymgmt/${options.queryParams?.itemType || 'key'}`,
       generic: 'secret',
+      totp: 'totp-key',
     };
-    return types[type];
+    return types[engineType];
   },
 
   handleSecretModelError(capabilities, secretId, modelType, error) {
     // can't read the path and don't have update capability, so re-throw
-    if (!capabilities.get('canUpdate') && modelType === 'secret') {
+    if (!capabilities.canUpdate && modelType === 'secret') {
       throw error;
     }
     this.store.push({
@@ -192,7 +206,7 @@ export default Route.extend({
     const backend = this.enginePathParam();
     const preferAdvancedEdit =
       /* eslint-disable-next-line ember/no-controller-access-in-routes */
-      this.controllerFor('vault.cluster.secrets.backend').get('preferAdvancedEdit') || false;
+      this.controllerFor('vault.cluster.secrets.backend').preferAdvancedEdit || false;
     const backendType = this.backendType();
     model.secret.setProperties({ backend });
     controller.setProperties({
diff --git a/ui/app/routes/vault/cluster/secrets/backend/show-root.js b/ui/app/routes/vault/cluster/secrets/backend/show-root.js
index 70a89ce202d..1c681931646 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/show-root.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/show-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/show.js b/ui/app/routes/vault/cluster/secrets/backend/show.js
index 7cde9bd593f..d986dd26934 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/show.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/sign-root.js b/ui/app/routes/vault/cluster/secrets/backend/sign-root.js
index f0cce06bb73..b9a463715e4 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/sign-root.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/sign-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/secrets/backend/sign.js b/ui/app/routes/vault/cluster/secrets/backend/sign.js
index ee4030ab472..41a44577c73 100644
--- a/ui/app/routes/vault/cluster/secrets/backend/sign.js
+++ b/ui/app/routes/vault/cluster/secrets/backend/sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -29,13 +29,13 @@ export default Route.extend(UnloadModel, {
   model(params) {
     const role = params.secret;
     const backendModel = this.backendModel();
-    const backend = backendModel.get('id');
+    const backend = backendModel.id;
 
-    if (backendModel.get('type') !== 'ssh') {
+    if (backendModel.type !== 'ssh') {
       return this.router.transitionTo('vault.cluster.secrets.backend.list-root', backend);
     }
     return this.store.queryRecord('capabilities', this.pathQuery(role, backend)).then((capabilities) => {
-      if (!capabilities.get('canUpdate')) {
+      if (!capabilities.canUpdate) {
         return this.router.transitionTo('vault.cluster.secrets.backend.list-root', backend);
       }
       return this.store.createRecord('ssh-sign', {
diff --git a/ui/app/routes/vault/cluster/secrets/backends.js b/ui/app/routes/vault/cluster/secrets/backends.js
deleted file mode 100644
index 72fe0fb524d..00000000000
--- a/ui/app/routes/vault/cluster/secrets/backends.js
+++ /dev/null
@@ -1,15 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Route from '@ember/routing/route';
-import { service } from '@ember/service';
-
-export default Route.extend({
-  store: service(),
-
-  model() {
-    return this.store.query('secret-engine', {});
-  },
-});
diff --git a/ui/app/routes/vault/cluster/secrets/backends.ts b/ui/app/routes/vault/cluster/secrets/backends.ts
new file mode 100644
index 00000000000..b792933b15c
--- /dev/null
+++ b/ui/app/routes/vault/cluster/secrets/backends.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import SecretsEngineResource from 'vault/resources/secrets/engine';
+
+import type ApiService from 'vault/services/api';
+
+export default class SecretsBackends extends Route {
+  @service declare readonly api: ApiService;
+
+  async model() {
+    const { secret } = await this.api.sys.internalUiListEnabledVisibleMounts();
+    return this.api.responseObjectToArray(secret, 'path').map((engine) => new SecretsEngineResource(engine));
+  }
+}
diff --git a/ui/app/routes/vault/cluster/secrets/enable/create.ts b/ui/app/routes/vault/cluster/secrets/enable/create.ts
new file mode 100644
index 00000000000..fa9c63694ca
--- /dev/null
+++ b/ui/app/routes/vault/cluster/secrets/enable/create.ts
@@ -0,0 +1,32 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import SecretsEngineForm from 'vault/forms/secrets/engine';
+
+export default class VaultClusterSecretsEnableCreateRoute extends Route {
+  model(params: { mount_type: string }) {
+    const { mount_type } = params;
+
+    const defaults = {
+      path: mount_type, // Default path to match the engine type
+      config: { listing_visibility: false },
+      kv_config: {
+        max_versions: 0,
+        cas_required: false,
+        delete_version_after: undefined,
+      },
+      options: { version: 2 },
+    };
+
+    const form = new SecretsEngineForm(defaults, { isNew: true });
+    // Explicitly set the type on the form after creation
+    form.type = mount_type;
+    // Apply type-specific defaults (e.g., PKI max lease TTL)
+    form.applyTypeSpecificDefaults();
+
+    return form;
+  }
+}
diff --git a/ui/app/routes/vault/cluster/secrets/enable/index.ts b/ui/app/routes/vault/cluster/secrets/enable/index.ts
new file mode 100644
index 00000000000..3e95a20d3dc
--- /dev/null
+++ b/ui/app/routes/vault/cluster/secrets/enable/index.ts
@@ -0,0 +1,42 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import SecretsEngineForm from 'vault/forms/secrets/engine';
+import Router from 'vault/router';
+import type PluginCatalogService from 'vault/services/plugin-catalog';
+
+import type { ModelFrom } from 'vault/vault/route';
+
+export type EnableSecretBackendModel = ModelFrom<VaultClusterSecretsEnableIndexRouter>;
+
+export default class VaultClusterSecretsEnableIndexRouter extends Route {
+  @service declare router: Router;
+  @service('plugin-catalog') declare readonly pluginCatalog: PluginCatalogService;
+
+  async model() {
+    const defaults = {
+      config: { listing_visibility: false },
+      kv_config: {
+        max_versions: 0,
+        cas_required: false,
+        delete_version_after: undefined,
+      },
+      options: { version: 2 },
+    };
+
+    const secretEngineForm = new SecretsEngineForm(defaults, { isNew: true });
+
+    // Fetch plugin catalog data to enhance the secret engines list
+    const pluginCatalogResponse = await this.pluginCatalog.fetchPluginCatalog();
+
+    return {
+      form: secretEngineForm,
+      pluginCatalogData: pluginCatalogResponse.data,
+      pluginCatalogError: pluginCatalogResponse.error,
+    };
+  }
+}
diff --git a/ui/app/routes/vault/cluster/settings.js b/ui/app/routes/vault/cluster/settings.js
index 5ec66d84db6..925101c1daa 100644
--- a/ui/app/routes/vault/cluster/settings.js
+++ b/ui/app/routes/vault/cluster/settings.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/settings/auth/configure.js b/ui/app/routes/vault/cluster/settings/auth/configure.js
deleted file mode 100644
index d5083883a0c..00000000000
--- a/ui/app/routes/vault/cluster/settings/auth/configure.js
+++ /dev/null
@@ -1,18 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Route from '@ember/routing/route';
-import { service } from '@ember/service';
-
-export default Route.extend({
-  store: service(),
-
-  model() {
-    const { method } = this.paramsFor(this.routeName);
-    return this.store.findAll('auth-method').then(() => {
-      return this.store.peekRecord('auth-method', method);
-    });
-  },
-});
diff --git a/ui/app/routes/vault/cluster/settings/auth/configure.ts b/ui/app/routes/vault/cluster/settings/auth/configure.ts
new file mode 100644
index 00000000000..a39a7d82d94
--- /dev/null
+++ b/ui/app/routes/vault/cluster/settings/auth/configure.ts
@@ -0,0 +1,28 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import AuthMethodResource from 'vault/resources/auth/method';
+
+import type ApiService from 'vault/services/api';
+import type { ModelFrom } from 'vault/route';
+import type { Mount } from 'vault/vault/mount';
+
+export type ClusterSettingsAuthConfigureRouteModel = ModelFrom<ClusterSettingsAuthConfigureRoute>;
+
+export default class ClusterSettingsAuthConfigureRoute extends Route {
+  @service declare readonly api: ApiService;
+
+  async model(params: { method: string }) {
+    const path = params.method;
+    const methodOptions = (await this.api.sys.authReadConfiguration(path)) as Mount;
+    const method = new AuthMethodResource({ ...methodOptions, path }, this);
+    return {
+      methodOptions,
+      method,
+    };
+  }
+}
diff --git a/ui/app/routes/vault/cluster/settings/auth/configure/index.js b/ui/app/routes/vault/cluster/settings/auth/configure/index.js
index 67db7cabb63..b4cc8da4bf1 100644
--- a/ui/app/routes/vault/cluster/settings/auth/configure/index.js
+++ b/ui/app/routes/vault/cluster/settings/auth/configure/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,8 +11,8 @@ export default class SettingsAuthConfigureRoute extends Route {
   @service router;
 
   beforeModel() {
-    const model = this.modelFor('vault.cluster.settings.auth.configure');
-    const section = tabsForAuthSection([model])[0].routeParams.lastObject;
+    const { method } = this.modelFor('vault.cluster.settings.auth.configure');
+    const section = tabsForAuthSection([method])[0].routeParams.slice().pop();
     return this.router.transitionTo('vault.cluster.settings.auth.configure.section', section);
   }
 }
diff --git a/ui/app/routes/vault/cluster/settings/auth/configure/section.js b/ui/app/routes/vault/cluster/settings/auth/configure/section.js
deleted file mode 100644
index 38528fbd589..00000000000
--- a/ui/app/routes/vault/cluster/settings/auth/configure/section.js
+++ /dev/null
@@ -1,104 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AdapterError from '@ember-data/adapter/error';
-import { service } from '@ember/service';
-import { set } from '@ember/object';
-import Route from '@ember/routing/route';
-import RSVP from 'rsvp';
-import UnloadModelRoute from 'vault/mixins/unload-model-route';
-
-export default Route.extend(UnloadModelRoute, {
-  modelPath: 'model.model',
-  pathHelp: service('path-help'),
-  store: service(),
-
-  modelType(backendType, section) {
-    const MODELS = {
-      'aws-client': 'auth-config/aws/client',
-      'aws-identity-accesslist': 'auth-config/aws/identity-accesslist',
-      'aws-roletag-denylist': 'auth-config/aws/roletag-denylist',
-      'azure-configuration': 'auth-config/azure',
-      'github-configuration': 'auth-config/github',
-      'gcp-configuration': 'auth-config/gcp',
-      'jwt-configuration': 'auth-config/jwt',
-      'oidc-configuration': 'auth-config/oidc',
-      'kubernetes-configuration': 'auth-config/kubernetes',
-      'ldap-configuration': 'auth-config/ldap',
-      'okta-configuration': 'auth-config/okta',
-      'radius-configuration': 'auth-config/radius',
-    };
-    return MODELS[`${backendType}-${section}`];
-  },
-
-  beforeModel() {
-    const { section_name } = this.paramsFor(this.routeName);
-    if (section_name === 'options') {
-      return;
-    }
-    const { method } = this.paramsFor('vault.cluster.settings.auth.configure');
-    const backend = this.modelFor('vault.cluster.settings.auth.configure');
-    const modelType = this.modelType(backend.type, section_name);
-    return this.pathHelp.getNewModel(modelType, method, backend.apiPath);
-  },
-
-  model(params) {
-    const backend = this.modelFor('vault.cluster.settings.auth.configure');
-    const { section_name: section } = params;
-    if (section === 'options') {
-      return RSVP.hash({
-        model: backend,
-        section,
-      });
-    }
-    const modelType = this.modelType(backend.get('type'), section);
-    if (!modelType) {
-      const error = new AdapterError();
-      set(error, 'httpStatus', 404);
-      throw error;
-    }
-    const model = this.store.peekRecord(modelType, backend.id);
-    if (model) {
-      return RSVP.hash({
-        model,
-        section,
-      });
-    }
-    return this.store
-      .findRecord(modelType, backend.id)
-      .then((config) => {
-        config.set('backend', backend);
-        return RSVP.hash({
-          model: config,
-          section,
-        });
-      })
-      .catch((e) => {
-        let config;
-        // if you haven't saved a config, the API 404s, so create one here to edit and return it
-        if (e.httpStatus === 404) {
-          config = this.store.createRecord(modelType, {
-            id: backend.id,
-          });
-          config.set('backend', backend);
-
-          return RSVP.hash({
-            model: config,
-            section,
-          });
-        }
-        throw e;
-      });
-  },
-
-  actions: {
-    willTransition() {
-      if (this.currentModel.model.constructor.modelName !== 'auth-method') {
-        this.unloadModel();
-        return true;
-      }
-    },
-  },
-});
diff --git a/ui/app/routes/vault/cluster/settings/auth/configure/section.ts b/ui/app/routes/vault/cluster/settings/auth/configure/section.ts
new file mode 100644
index 00000000000..90e2a5f1ec0
--- /dev/null
+++ b/ui/app/routes/vault/cluster/settings/auth/configure/section.ts
@@ -0,0 +1,145 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { service } from '@ember/service';
+import Route from '@ember/routing/route';
+import AuthMethodForm from 'vault/forms/auth/method';
+import OpenApiForm from 'vault/forms/open-api';
+
+import type ApiService from 'vault/services/api';
+import type PathHelpService from 'vault/services/path-help';
+import type Store from '@ember-data/store';
+import type { ClusterSettingsAuthConfigureRouteModel } from '../configure';
+import type { MountConfig } from 'vault/mount';
+import type { HTTPRequestInit, RequestOpts } from '@hashicorp/vault-client-typescript';
+import type { OpenApiHelpResponse } from 'vault/utils/openapi-helpers';
+
+export default class ClusterSettingsAuthConfigureRoute extends Route {
+  @service declare readonly api: ApiService;
+  @service declare readonly pathHelp: PathHelpService;
+  @service declare readonly store: Store;
+
+  get configRouteModel() {
+    return this.modelFor('vault.cluster.settings.auth.configure') as ClusterSettingsAuthConfigureRouteModel;
+  }
+
+  modelForOptions() {
+    const { methodOptions, method } = this.configRouteModel;
+    const config = methodOptions.config as MountConfig;
+    const listing_visibility = config.listing_visibility === 'unauth' ? true : false;
+
+    const form = new AuthMethodForm({
+      ...methodOptions,
+      path: method.id,
+      config: { ...config, listing_visibility },
+      user_lockout_config: {},
+    });
+    // `type` is a tracked property on the form class and not a field param
+    // so we need to set it here even though it is spread in methodOptions above.
+    form.type = methodOptions.type;
+
+    return {
+      form,
+      section: 'options',
+    };
+  }
+
+  get configFieldGroupsMap() {
+    const { method } = this.configRouteModel;
+    return {
+      kubernetes: {
+        default: ['kubernetes_host', 'kubernetes_ca_cert', 'disable_local_ca_jwt'],
+        'Kubernetes Options': ['token_reviewer_jwt', 'pem_keys', 'use_annotations_as_alias_metadata'],
+      },
+    }[method.methodType];
+  }
+
+  fetchConfig(type: string, section: string, path: string, help = false) {
+    const initOverride = help
+      ? (context: { init: HTTPRequestInit; context: RequestOpts }) =>
+          this.api.addQueryParams(context, { help: 1 })
+      : undefined;
+
+    switch (type) {
+      case 'aws': {
+        switch (section) {
+          case 'client':
+            return this.api.auth.awsReadClientConfiguration(path, initOverride);
+          case 'identity-accesslist':
+            return this.api.auth.awsReadIdentityAccessListTidySettings(path, initOverride);
+          case 'roletag-denylist':
+            return this.api.auth.awsReadRoleTagDenyListTidySettings(path, initOverride);
+        }
+        break;
+      }
+      case 'azure':
+        return this.api.auth.azureReadAuthConfiguration(path, initOverride);
+      case 'github':
+        return this.api.auth.githubReadConfiguration(path, initOverride);
+      case 'gcp':
+        return this.api.auth.googleCloudReadAuthConfiguration(path, initOverride);
+      case 'jwt':
+      case 'oidc':
+        return this.api.auth.jwtReadConfiguration(path, initOverride);
+      case 'kubernetes':
+        return this.api.auth.kubernetesReadAuthConfiguration(path, initOverride);
+      case 'ldap':
+        return this.api.auth.ldapReadAuthConfiguration(path, initOverride);
+      case 'okta':
+        return this.api.auth.oktaReadConfiguration(path, initOverride);
+      case 'radius':
+        return this.api.auth.radiusReadConfiguration(path, initOverride);
+    }
+
+    throw { httpStatus: 404 };
+  }
+
+  async modelForConfiguration(section: string) {
+    const { path, methodType } = this.configRouteModel.method;
+
+    const formOptions = { isNew: false };
+    let formData;
+    // make request to fetch configuration data for method
+    try {
+      const { data } = await this.fetchConfig(methodType, section, path);
+      formData = data as object;
+    } catch (e) {
+      const { message, status } = await this.api.parseError(e);
+      if (status === 404) {
+        formOptions.isNew = true;
+      } else {
+        throw { message, httpsStatus: status };
+      }
+    }
+    // make request to fetch OpenAPI properties with help query param
+    const helpResponse = (await this.fetchConfig(
+      methodType,
+      section,
+      path,
+      true
+    )) as unknown as OpenApiHelpResponse;
+    const form = new OpenApiForm(helpResponse, formData, formOptions);
+    // for jwt and oidc types, the jwks_pairs field is not deprecated but we do not render it in the UI
+    // remove the field from the group before rendering the form
+    if (['jwt', 'oidc'].includes(methodType)) {
+      const defaultGroup = form.formFieldGroups[0]?.['default'] || [];
+      const index = defaultGroup.findIndex((field) => field.name === 'jwks_pairs');
+      if (index !== undefined && index >= 0) {
+        defaultGroup.splice(index, 1);
+      }
+    }
+
+    return {
+      form,
+      section,
+      method: this.configRouteModel.method,
+    };
+  }
+
+  model(params: { section_name: 'options' | 'configuration' }) {
+    const { section_name: section } = params;
+    return section === 'options' ? this.modelForOptions() : this.modelForConfiguration(section);
+  }
+}
diff --git a/ui/app/routes/vault/cluster/settings/auth/enable.js b/ui/app/routes/vault/cluster/settings/auth/enable.js
deleted file mode 100644
index 808a908360b..00000000000
--- a/ui/app/routes/vault/cluster/settings/auth/enable.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Route from '@ember/routing/route';
-import { service } from '@ember/service';
-
-export default class VaultClusterSettingsAuthEnableRoute extends Route {
-  @service store;
-
-  model() {
-    const authMethod = this.store.createRecord('auth-method');
-    authMethod.set('config', this.store.createRecord('mount-config'));
-    return authMethod;
-  }
-}
diff --git a/ui/app/routes/vault/cluster/settings/auth/enable.ts b/ui/app/routes/vault/cluster/settings/auth/enable.ts
new file mode 100644
index 00000000000..c36091ef7a0
--- /dev/null
+++ b/ui/app/routes/vault/cluster/settings/auth/enable.ts
@@ -0,0 +1,21 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import AuthMethodForm from 'vault/forms/auth/method';
+
+import type { ModelFrom } from 'vault/vault/route';
+
+export type AuthEnableModel = ModelFrom<VaultClusterSettingsAuthEnableRoute>;
+
+export default class VaultClusterSettingsAuthEnableRoute extends Route {
+  model() {
+    const defaults = {
+      config: { listing_visibility: false },
+      user_lockout_config: {},
+    };
+    return new AuthMethodForm(defaults, { isNew: true });
+  }
+}
diff --git a/ui/app/routes/vault/cluster/settings/auth/index.js b/ui/app/routes/vault/cluster/settings/auth/index.js
index c22810b68d8..435fa86251e 100644
--- a/ui/app/routes/vault/cluster/settings/auth/index.js
+++ b/ui/app/routes/vault/cluster/settings/auth/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/settings/configure-secret-backend.js b/ui/app/routes/vault/cluster/settings/configure-secret-backend.js
deleted file mode 100644
index a320c8104f4..00000000000
--- a/ui/app/routes/vault/cluster/settings/configure-secret-backend.js
+++ /dev/null
@@ -1,70 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import AdapterError from '@ember-data/adapter/error';
-import { set } from '@ember/object';
-import Route from '@ember/routing/route';
-import { service } from '@ember/service';
-const CONFIGURABLE_BACKEND_TYPES = ['aws', 'ssh'];
-
-export default Route.extend({
-  store: service(),
-
-  model() {
-    const { backend } = this.paramsFor(this.routeName);
-    return this.store.query('secret-engine', { path: backend }).then((modelList) => {
-      const model = modelList && modelList[0];
-      if (!model || !CONFIGURABLE_BACKEND_TYPES.includes(model.get('type'))) {
-        const error = new AdapterError();
-        set(error, 'httpStatus', 404);
-        throw error;
-      }
-      return this.store.findRecord('secret-engine', backend).then(
-        () => {
-          return model;
-        },
-        () => {
-          return model;
-        }
-      );
-    });
-  },
-
-  afterModel(model) {
-    const type = model.get('type');
-
-    if (type === 'aws') {
-      return this.store
-        .queryRecord('secret-engine', {
-          backend: model.id,
-          type,
-        })
-        .then(
-          () => model,
-          () => model
-        );
-    }
-    return model;
-  },
-
-  setupController(controller, model) {
-    if (model.get('publicKey')) {
-      controller.set('configured', true);
-    }
-    return this._super(...arguments);
-  },
-
-  resetController(controller, isExiting) {
-    if (isExiting) {
-      controller.reset();
-    }
-  },
-
-  actions: {
-    refreshRoute() {
-      this.refresh();
-    },
-  },
-});
diff --git a/ui/app/routes/vault/cluster/settings/index.js b/ui/app/routes/vault/cluster/settings/index.js
index 8c4421f08f4..13fe5fae6f9 100644
--- a/ui/app/routes/vault/cluster/settings/index.js
+++ b/ui/app/routes/vault/cluster/settings/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,10 +9,7 @@ import { service } from '@ember/service';
 export default class SettingsIndexRouter extends Route {
   @service router;
 
-  beforeModel(transition) {
-    if (transition.targetName === this.routeName) {
-      transition.abort();
-      return this.router.replaceWith('vault.cluster.settings.mount-secret-backend');
-    }
+  redirect() {
+    return this.router.replaceWith('vault.cluster.secrets.enable.index');
   }
 }
diff --git a/ui/app/routes/vault/cluster/settings/mount-secret-backend.js b/ui/app/routes/vault/cluster/settings/mount-secret-backend.js
deleted file mode 100644
index 851a9078c60..00000000000
--- a/ui/app/routes/vault/cluster/settings/mount-secret-backend.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Route from '@ember/routing/route';
-import { service } from '@ember/service';
-
-export default class VaultClusterSettingsMountSecretBackendRoute extends Route {
-  @service store;
-
-  model() {
-    const secretEngine = this.store.createRecord('secret-engine');
-    secretEngine.set('config', this.store.createRecord('mount-config'));
-    return secretEngine;
-  }
-}
diff --git a/ui/app/routes/vault/cluster/settings/seal.js b/ui/app/routes/vault/cluster/settings/seal.js
index 087362bf1d1..37168075b84 100644
--- a/ui/app/routes/vault/cluster/settings/seal.js
+++ b/ui/app/routes/vault/cluster/settings/seal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/storage.js b/ui/app/routes/vault/cluster/storage.js
index 4ae184bb8e1..a312830ccc7 100644
--- a/ui/app/routes/vault/cluster/storage.js
+++ b/ui/app/routes/vault/cluster/storage.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/tools.js b/ui/app/routes/vault/cluster/tools.js
index b2f89d07f72..23ae6296b04 100644
--- a/ui/app/routes/vault/cluster/tools.js
+++ b/ui/app/routes/vault/cluster/tools.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/tools/index.js b/ui/app/routes/vault/cluster/tools/index.js
index 0805f36b176..326b63ebdff 100644
--- a/ui/app/routes/vault/cluster/tools/index.js
+++ b/ui/app/routes/vault/cluster/tools/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/tools/tool.js b/ui/app/routes/vault/cluster/tools/tool.js
index c6b15943e75..dc1598af359 100644
--- a/ui/app/routes/vault/cluster/tools/tool.js
+++ b/ui/app/routes/vault/cluster/tools/tool.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/routes/vault/cluster/unseal.js b/ui/app/routes/vault/cluster/unseal.js
index b9b4b37fb06..0aac55a8afb 100644
--- a/ui/app/routes/vault/cluster/unseal.js
+++ b/ui/app/routes/vault/cluster/unseal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/application.js b/ui/app/serializers/application.js
index da6c5b6f9b5..fbbf12a495f 100644
--- a/ui/app/serializers/application.js
+++ b/ui/app/serializers/application.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/auth-method.js b/ui/app/serializers/auth-method.js
deleted file mode 100644
index bb730a5e38a..00000000000
--- a/ui/app/serializers/auth-method.js
+++ /dev/null
@@ -1,38 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ApplicationSerializer from './application';
-import { EmbeddedRecordsMixin } from '@ember-data/serializer/rest';
-
-export default ApplicationSerializer.extend(EmbeddedRecordsMixin, {
-  attrs: {
-    config: { embedded: 'always' },
-  },
-  normalize(modelClass, data) {
-    // embedded records need a unique value to be stored
-    // use the uuid from the auth-method as the unique id for mount-config
-    if (data.config && !data.config.id) {
-      data.config.id = data.uuid;
-    }
-    return this._super(modelClass, data);
-  },
-  normalizeBackend(path, backend) {
-    const struct = { ...backend };
-    // strip the trailing slash off of the path so we
-    // can navigate to it without getting `//` in the url
-    struct.id = path.slice(0, -1);
-    struct.path = path;
-    return struct;
-  },
-
-  normalizeResponse(store, primaryModelClass, payload, id, requestType) {
-    const isCreate = requestType === 'createRecord';
-    const backends = isCreate
-      ? payload.data
-      : Object.keys(payload.data).map((path) => this.normalizeBackend(path, payload.data[path]));
-
-    return this._super(store, primaryModelClass, backends, id, requestType);
-  },
-});
diff --git a/ui/app/serializers/capabilities.js b/ui/app/serializers/capabilities.js
index 18b2820cb63..37bea0b71d4 100644
--- a/ui/app/serializers/capabilities.js
+++ b/ui/app/serializers/capabilities.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,14 +9,21 @@ export default ApplicationSerializer.extend({
   primaryKey: 'path',
 
   normalizeResponse(store, primaryModelClass, payload, id, requestType) {
-    // queryRecord will already have set this, and we won't have an id here
-    if (id) {
-      payload.path = id;
+    let response;
+    // queryRecord will already have set path, and we won't have an id here
+    if (id) payload.path = id;
+
+    if (requestType === 'query') {
+      // each key on the response is a path with an array of capabilities as its value
+      response = Object.keys(payload.data).map((fullPath) => {
+        // we use pathMap to normalize a namespace-prefixed path back to the relative path
+        // this is okay because we clear capabilities when moving between namespaces
+        const path = payload.pathMap ? payload.pathMap[fullPath] : fullPath;
+        return { capabilities: payload.data[fullPath], path };
+      });
+    } else {
+      response = { ...payload.data, path: payload.path };
     }
-    const response = {
-      ...payload.data,
-      path: payload.path,
-    };
     return this._super(store, primaryModelClass, response, id, requestType);
   },
 
diff --git a/ui/app/serializers/clients/activity.js b/ui/app/serializers/clients/activity.js
index 90996265bad..66a8071f700 100644
--- a/ui/app/serializers/clients/activity.js
+++ b/ui/app/serializers/clients/activity.js
@@ -1,12 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ApplicationSerializer from '../application';
 import { formatISO } from 'date-fns';
-import { formatByMonths, formatByNamespace, homogenizeClientNaming } from 'core/utils/client-count-utils';
+import { formatByMonths, formatByNamespace, destructureClientCounts } from 'core/utils/client-count-utils';
 import timestamp from 'core/utils/timestamp';
+
+// see tests/helpers/clients/client-count-helpers for sample API response (ACTIVITY_RESPONSE_STUB)
+// and transformed by_namespace and by_month examples (SERIALIZED_ACTIVITY_RESPONSE)
 export default class ActivitySerializer extends ApplicationSerializer {
   normalizeResponse(store, primaryModelClass, payload, id, requestType) {
     if (payload.id === 'no-data') {
@@ -18,7 +21,7 @@ export default class ActivitySerializer extends ApplicationSerializer {
       response_timestamp,
       by_namespace: formatByNamespace(payload.data.by_namespace),
       by_month: formatByMonths(payload.data.months),
-      total: homogenizeClientNaming(payload.data.total),
+      total: destructureClientCounts(payload.data.total),
     };
     delete payload.data.by_namespace;
     delete payload.data.months;
@@ -26,47 +29,3 @@ export default class ActivitySerializer extends ApplicationSerializer {
     return super.normalizeResponse(store, primaryModelClass, transformedPayload, id, requestType);
   }
 }
-/*
-SAMPLE PAYLOAD BEFORE/AFTER:
-
-payload.data.by_namespace = [
-  {
-    namespace_id: '5SWT8',
-    namespace_path: 'namespacelonglonglong4/',
-    counts: {
-      entity_clients: 171,
-      non_entity_clients: 20,
-      clients: 191,
-    },
-    mounts: [
-      {
-        mount_path: 'auth/method/uMGBU',
-        "counts":{
-          "distinct_entities":0,
-          "entity_clients":0,
-          "non_entity_tokens":0,
-          "non_entity_clients":10,
-          "clients":10
-        }
-      },
-    ],
-  },
-];
-
-transformedPayload.by_namespace = [
-  {
-    label: 'namespacelonglonglong4/',
-    entity_clients: 171,
-    non_entity_clients: 20,
-    clients: 191,
-    mounts: [
-      {
-        label: 'auth/method/uMGBU',
-        entity_clients: 20,
-        non_entity_clients: 15,
-        clients: 35,
-      },
-    ],
-  },
-]
-*/
diff --git a/ui/app/serializers/clients/config.js b/ui/app/serializers/clients/config.js
index d9b44590ccb..4de338c45fb 100644
--- a/ui/app/serializers/clients/config.js
+++ b/ui/app/serializers/clients/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/clients/version-history.js b/ui/app/serializers/clients/version-history.js
index 055c8b254d1..4f3d6c16fcd 100644
--- a/ui/app/serializers/clients/version-history.js
+++ b/ui/app/serializers/clients/version-history.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/cluster.js b/ui/app/serializers/cluster.js
index ef7177c08e0..ebc599d1ee1 100644
--- a/ui/app/serializers/cluster.js
+++ b/ui/app/serializers/cluster.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/config-ui/message.js b/ui/app/serializers/config-ui/message.js
deleted file mode 100644
index 51479944e5f..00000000000
--- a/ui/app/serializers/config-ui/message.js
+++ /dev/null
@@ -1,56 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { decodeString, encodeString } from 'core/utils/b64';
-import ApplicationSerializer from '../application';
-
-export default class MessageSerializer extends ApplicationSerializer {
-  attrs = {
-    active: { serialize: false },
-  };
-
-  normalizeResponse(store, primaryModelClass, payload, id, requestType) {
-    if (requestType === 'query' && !payload.meta) {
-      const transformed = this.mapPayload(payload);
-      return super.normalizeResponse(store, primaryModelClass, transformed, id, requestType);
-    }
-    if (requestType === 'queryRecord') {
-      const transformed = {
-        ...payload.data,
-        message: decodeString(payload.data.message),
-      };
-      return super.normalizeResponse(store, primaryModelClass, transformed, id, requestType);
-    }
-    return super.normalizeResponse(store, primaryModelClass, payload, id, requestType);
-  }
-
-  serialize() {
-    const json = super.serialize(...arguments);
-    json.message = encodeString(json.message);
-    return json;
-  }
-
-  mapPayload(payload) {
-    if (payload.data) {
-      if (payload.data?.keys && Array.isArray(payload.data.keys)) {
-        return payload.data.keys.map((key) => {
-          const data = {
-            id: key,
-            ...payload.data.key_info[key],
-          };
-          if (data.message) data.message = decodeString(data.message);
-          return data;
-        });
-      }
-      Object.assign(payload, payload.data);
-      delete payload.data;
-    }
-    return payload;
-  }
-
-  extractLazyPaginatedData(payload) {
-    return this.mapPayload(payload);
-  }
-}
diff --git a/ui/app/serializers/config.js b/ui/app/serializers/config.js
index 41d50ec096c..53c71e9c911 100644
--- a/ui/app/serializers/config.js
+++ b/ui/app/serializers/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/control-group.js b/ui/app/serializers/control-group.js
index 144f569034d..064b03c93e1 100644
--- a/ui/app/serializers/control-group.js
+++ b/ui/app/serializers/control-group.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/database/connection.js b/ui/app/serializers/database/connection.js
index 96aaae8a0de..34161ba7ece 100644
--- a/ui/app/serializers/database/connection.js
+++ b/ui/app/serializers/database/connection.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import RESTSerializer from '@ember-data/serializer/rest';
-import { AVAILABLE_PLUGIN_TYPES } from '../../utils/database-helpers';
+import { AVAILABLE_PLUGIN_TYPES } from '../../utils/model-helpers/database-helpers';
 
 export default RESTSerializer.extend({
   primaryKey: 'name',
@@ -29,6 +29,16 @@ export default RESTSerializer.extend({
       ...payload.data,
       ...payload.data.connection_details,
     };
+
+    // connection_details are spread above into the main body of response so we can remove redundant data
+    delete response.connection_details;
+    if (response?.connection_url) {
+      // this url can include interpolated data, such as: "{{username}}/{{password}}@localhost:1521/OraDoc.localhost"
+      // these curly brackets are returned by the API encoded: "%7B%7Busername%7D%7D/%7B%7Bpassword%7D%7D@localhost:1521/OraDoc.localhost"
+      // we decode here so the UI displays and submits the url in the correct format
+      response.connection_url = decodeURI(response.connection_url);
+    }
+
     if (payload.data.root_credentials_rotate_statements) {
       response.root_rotation_statements = payload.data.root_credentials_rotate_statements;
     }
diff --git a/ui/app/serializers/database/credential.js b/ui/app/serializers/database/credential.js
index 790a2cfd8cf..74cc618a693 100644
--- a/ui/app/serializers/database/credential.js
+++ b/ui/app/serializers/database/credential.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/database/role.js b/ui/app/serializers/database/role.js
index fd4ce80f0ee..d934a0c328b 100644
--- a/ui/app/serializers/database/role.js
+++ b/ui/app/serializers/database/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -66,10 +66,7 @@ export default RESTSerializer.extend({
 
   serializeAttribute(snapshot, json, key, attributes) {
     // Don't send values that are undefined
-    if (
-      undefined !== snapshot.attr(key) &&
-      (snapshot.record.get('isNew') || snapshot.changedAttributes()[key])
-    ) {
+    if (snapshot.attr(key) !== undefined && (snapshot.record.isNew || snapshot.changedAttributes()[key])) {
       this._super(snapshot, json, key, attributes);
     }
   },
diff --git a/ui/app/serializers/gcp/config.js b/ui/app/serializers/gcp/config.js
new file mode 100644
index 00000000000..16125fd5509
--- /dev/null
+++ b/ui/app/serializers/gcp/config.js
@@ -0,0 +1,23 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import ApplicationSerializer from '../application';
+
+export default class GcpConfigSerializer extends ApplicationSerializer {
+  normalizeResponse(store, primaryModelClass, payload, id, requestType) {
+    if (!payload.data) {
+      return super.normalizeResponse(...arguments);
+    }
+
+    const normalizedPayload = {
+      id: payload.id,
+      backend: payload.backend,
+      data: {
+        ...payload.data,
+      },
+    };
+    return super.normalizeResponse(store, primaryModelClass, normalizedPayload, id, requestType);
+  }
+}
diff --git a/ui/app/serializers/identity/_base.js b/ui/app/serializers/identity/_base.js
index 40a0af55e76..452cea5a166 100644
--- a/ui/app/serializers/identity/_base.js
+++ b/ui/app/serializers/identity/_base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/identity/entity-alias.js b/ui/app/serializers/identity/entity-alias.js
index 419f3c3d2bd..4fd67bb9938 100644
--- a/ui/app/serializers/identity/entity-alias.js
+++ b/ui/app/serializers/identity/entity-alias.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/identity/entity.js b/ui/app/serializers/identity/entity.js
index 00763251dd2..45eeb33d5ed 100644
--- a/ui/app/serializers/identity/entity.js
+++ b/ui/app/serializers/identity/entity.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/identity/group-alias.js b/ui/app/serializers/identity/group-alias.js
index 4d0b141b6ba..f593bd5158d 100644
--- a/ui/app/serializers/identity/group-alias.js
+++ b/ui/app/serializers/identity/group-alias.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/identity/group.js b/ui/app/serializers/identity/group.js
index 6980655243a..f794fc2f639 100644
--- a/ui/app/serializers/identity/group.js
+++ b/ui/app/serializers/identity/group.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/keymgmt/key.js b/ui/app/serializers/keymgmt/key.js
index 00b243e582b..5a08ee21c4f 100644
--- a/ui/app/serializers/keymgmt/key.js
+++ b/ui/app/serializers/keymgmt/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/keymgmt/provider.js b/ui/app/serializers/keymgmt/provider.js
index 36ad23e0e02..6fb40f8fe9f 100644
--- a/ui/app/serializers/keymgmt/provider.js
+++ b/ui/app/serializers/keymgmt/provider.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/kubernetes/config.js b/ui/app/serializers/kubernetes/config.js
index 7835fbbe2b6..d08831481e5 100644
--- a/ui/app/serializers/kubernetes/config.js
+++ b/ui/app/serializers/kubernetes/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/kubernetes/role.js b/ui/app/serializers/kubernetes/role.js
index 46dbac5d1d5..7e8e3b68c77 100644
--- a/ui/app/serializers/kubernetes/role.js
+++ b/ui/app/serializers/kubernetes/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/kv/data.js b/ui/app/serializers/kv/data.js
deleted file mode 100644
index 1e75ac21aa4..00000000000
--- a/ui/app/serializers/kv/data.js
+++ /dev/null
@@ -1,45 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import ApplicationSerializer from '../application';
-
-export default class KvDataSerializer extends ApplicationSerializer {
-  serialize(snapshot) {
-    const { secretData, casVersion } = snapshot.record;
-    if (typeof casVersion === 'number') {
-      /* if this is a number it is set by one of the following:
-        A) user is creating initial version of a secret
-         -> 0 : default value set in route
-        B) user is creating a new version of a secret:
-         -> metadata.current_version : has metadata read permissions (data permissions are irrelevant)
-         -> secret.version : has data read permissions. without metadata read access a user is unable to navigate,
-                             to older secret versions so we assume creation is from the latest version */
-      return { data: secretData, options: { cas: casVersion } };
-    }
-    // a non-number value means no read permission for both data and metadata
-    return { data: secretData };
-  }
-
-  normalizeKvData(payload) {
-    const { data, metadata } = payload.data;
-    return {
-      ...payload,
-      data: {
-        ...payload.data,
-        // Rename to secret_data so it doesn't get removed by normalizer
-        secret_data: data,
-        ...metadata,
-      },
-    };
-  }
-
-  normalizeResponse(store, primaryModelClass, payload, id, requestType) {
-    if (requestType === 'queryRecord') {
-      const transformed = this.normalizeKvData(payload);
-      return super.normalizeResponse(store, primaryModelClass, transformed, id, requestType);
-    }
-    return super.normalizeResponse(store, primaryModelClass, payload, id, requestType);
-  }
-}
diff --git a/ui/app/serializers/kv/metadata.js b/ui/app/serializers/kv/metadata.js
deleted file mode 100644
index 7d5b4f16b59..00000000000
--- a/ui/app/serializers/kv/metadata.js
+++ /dev/null
@@ -1,39 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { assert } from '@ember/debug';
-import ApplicationSerializer from '../application';
-import { kvMetadataPath } from 'vault/utils/kv-path';
-
-export default class KvMetadataSerializer extends ApplicationSerializer {
-  attrs = {
-    backend: { serialize: false },
-    path: { serialize: false },
-    oldestVersion: { serialize: false },
-    createdTime: { serialize: false },
-    updatedTime: { serialize: false },
-    currentVersion: { serialize: false },
-    versions: { serialize: false },
-  };
-
-  normalizeItems(payload) {
-    if (payload.data.keys) {
-      assert('payload.backend must be provided on kv/metadata list response', !!payload.backend);
-      return payload.data.keys.map((secret) => {
-        // If there is no payload.path then we're either on a "top level" secret or the first level directory of a nested secret.
-        // We set the path to the current secret or pathToSecret. e.g. my-secret or beep/boop/
-        // We add a param called full_secret_path to the model which we use to navigate to the nested secret. e.g. beep/boop/bop.
-        const fullSecretPath = payload.path ? payload.path + secret : secret;
-        return {
-          id: kvMetadataPath(payload.backend, fullSecretPath),
-          path: secret,
-          backend: payload.backend,
-          full_secret_path: fullSecretPath,
-        };
-      });
-    }
-    return super.normalizeItems(payload);
-  }
-}
diff --git a/ui/app/serializers/ldap/config.js b/ui/app/serializers/ldap/config.js
index 40b4821183f..c7eab7baa14 100644
--- a/ui/app/serializers/ldap/config.js
+++ b/ui/app/serializers/ldap/config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/ldap/library.js b/ui/app/serializers/ldap/library.js
index 84370aab23b..8a61243b9d6 100644
--- a/ui/app/serializers/ldap/library.js
+++ b/ui/app/serializers/ldap/library.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/ldap/role.js b/ui/app/serializers/ldap/role.js
index 4d3e76a44ca..63d1d1707ae 100644
--- a/ui/app/serializers/ldap/role.js
+++ b/ui/app/serializers/ldap/role.js
@@ -1,13 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ApplicationSerializer from '../application';
 
 export default class LdapRoleSerializer extends ApplicationSerializer {
-  primaryKey = 'name';
-
   serialize(snapshot) {
     // remove all fields that are not relevant to specified role type
     const { fieldsForType } = snapshot.record;
diff --git a/ui/app/serializers/lease.js b/ui/app/serializers/lease.js
index b58fa483dde..1abd6d45967 100644
--- a/ui/app/serializers/lease.js
+++ b/ui/app/serializers/lease.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/license.js b/ui/app/serializers/license.js
index 534cc9ba330..5e8dceb4909 100644
--- a/ui/app/serializers/license.js
+++ b/ui/app/serializers/license.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/mfa-login-enforcement.js b/ui/app/serializers/mfa-login-enforcement.js
index d1e838107db..f2a45610395 100644
--- a/ui/app/serializers/mfa-login-enforcement.js
+++ b/ui/app/serializers/mfa-login-enforcement.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/mfa-method.js b/ui/app/serializers/mfa-method.js
index e7429e701fe..2d569cf5ab5 100644
--- a/ui/app/serializers/mfa-method.js
+++ b/ui/app/serializers/mfa-method.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/namespace.js b/ui/app/serializers/namespace.js
index c9228601bd3..7e5cc76f607 100644
--- a/ui/app/serializers/namespace.js
+++ b/ui/app/serializers/namespace.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/node.js b/ui/app/serializers/node.js
index 890eef9da41..804658cf377 100644
--- a/ui/app/serializers/node.js
+++ b/ui/app/serializers/node.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/oidc/assignment.js b/ui/app/serializers/oidc/assignment.js
index f02cb6e4a57..9b0f3648edd 100644
--- a/ui/app/serializers/oidc/assignment.js
+++ b/ui/app/serializers/oidc/assignment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/oidc/client.js b/ui/app/serializers/oidc/client.js
index 25cf6c4b060..4d1ecc83d1a 100644
--- a/ui/app/serializers/oidc/client.js
+++ b/ui/app/serializers/oidc/client.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/oidc/key.js b/ui/app/serializers/oidc/key.js
index 37754a999cb..4030fc6fc03 100644
--- a/ui/app/serializers/oidc/key.js
+++ b/ui/app/serializers/oidc/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/oidc/provider.js b/ui/app/serializers/oidc/provider.js
index 09f51722d69..896d23decba 100644
--- a/ui/app/serializers/oidc/provider.js
+++ b/ui/app/serializers/oidc/provider.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/oidc/scope.js b/ui/app/serializers/oidc/scope.js
index 13e4384429c..d279f9372a7 100644
--- a/ui/app/serializers/oidc/scope.js
+++ b/ui/app/serializers/oidc/scope.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/path-filter-config.js b/ui/app/serializers/path-filter-config.js
index d40b9303e0d..217e90f6a91 100644
--- a/ui/app/serializers/path-filter-config.js
+++ b/ui/app/serializers/path-filter-config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/pki/action.js b/ui/app/serializers/pki/action.js
index 8f60392fb53..e9cafcf9bce 100644
--- a/ui/app/serializers/pki/action.js
+++ b/ui/app/serializers/pki/action.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/pki/certificate.js b/ui/app/serializers/pki/certificate.js
index 9e8dc461a32..ae55210000a 100644
--- a/ui/app/serializers/pki/certificate.js
+++ b/ui/app/serializers/pki/certificate.js
@@ -1,8 +1,8 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import CertSerializer from './cert';
+import CertSerializer from './certificate/base';
 
 export default class PkiCertificateSerializer extends CertSerializer {}
diff --git a/ui/app/serializers/pki/certificate/base.js b/ui/app/serializers/pki/certificate/base.js
index d17aafaa282..84502828481 100644
--- a/ui/app/serializers/pki/certificate/base.js
+++ b/ui/app/serializers/pki/certificate/base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/pki/certificate/generate.js b/ui/app/serializers/pki/certificate/generate.js
index ca24f7a8291..9ece8782141 100644
--- a/ui/app/serializers/pki/certificate/generate.js
+++ b/ui/app/serializers/pki/certificate/generate.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/pki/certificate/sign.js b/ui/app/serializers/pki/certificate/sign.js
index ca24f7a8291..9ece8782141 100644
--- a/ui/app/serializers/pki/certificate/sign.js
+++ b/ui/app/serializers/pki/certificate/sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/pki/issuer.js b/ui/app/serializers/pki/issuer.js
index 610ded9af81..f95c5e7773f 100644
--- a/ui/app/serializers/pki/issuer.js
+++ b/ui/app/serializers/pki/issuer.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/pki/key.js b/ui/app/serializers/pki/key.js
index a6550409947..51aecdc026c 100644
--- a/ui/app/serializers/pki/key.js
+++ b/ui/app/serializers/pki/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/pki/role.js b/ui/app/serializers/pki/role.js
index 6b247db480b..1bab18daab3 100644
--- a/ui/app/serializers/pki/role.js
+++ b/ui/app/serializers/pki/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/pki/tidy.js b/ui/app/serializers/pki/tidy.js
index d56c887976c..9c3c90acecd 100644
--- a/ui/app/serializers/pki/tidy.js
+++ b/ui/app/serializers/pki/tidy.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,6 +11,8 @@ export default class PkiTidySerializer extends ApplicationSerializer {
     if (tidyType === 'manual') {
       delete data?.enabled;
       delete data?.intervalDuration;
+      delete data?.minStartupBackoffDuration;
+      delete data?.maxStartupBackoffDuration;
     }
     return data;
   }
diff --git a/ui/app/serializers/policy.js b/ui/app/serializers/policy.js
index 80766dd508d..7f6b65a3e63 100644
--- a/ui/app/serializers/policy.js
+++ b/ui/app/serializers/policy.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/policy/acl.js b/ui/app/serializers/policy/acl.js
index 3294e161147..36480a7bab9 100644
--- a/ui/app/serializers/policy/acl.js
+++ b/ui/app/serializers/policy/acl.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/policy/egp.js b/ui/app/serializers/policy/egp.js
index 3294e161147..36480a7bab9 100644
--- a/ui/app/serializers/policy/egp.js
+++ b/ui/app/serializers/policy/egp.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/policy/rgp.js b/ui/app/serializers/policy/rgp.js
index 3294e161147..36480a7bab9 100644
--- a/ui/app/serializers/policy/rgp.js
+++ b/ui/app/serializers/policy/rgp.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/replication-attributes.js b/ui/app/serializers/replication-attributes.js
index ae67e0da1a1..92ecafbb11e 100644
--- a/ui/app/serializers/replication-attributes.js
+++ b/ui/app/serializers/replication-attributes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/replication-mode.js b/ui/app/serializers/replication-mode.js
index e06341044a9..89156b49a89 100644
--- a/ui/app/serializers/replication-mode.js
+++ b/ui/app/serializers/replication-mode.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/role-aws.js b/ui/app/serializers/role-aws.js
index 49bb7834ed3..31ee736990f 100644
--- a/ui/app/serializers/role-aws.js
+++ b/ui/app/serializers/role-aws.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/role-ssh.js b/ui/app/serializers/role-ssh.js
index 0856be2f173..1aa481c7e9f 100644
--- a/ui/app/serializers/role-ssh.js
+++ b/ui/app/serializers/role-ssh.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/role.js b/ui/app/serializers/role.js
index 7702efb3dca..1f63b3c5638 100644
--- a/ui/app/serializers/role.js
+++ b/ui/app/serializers/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/secret-engine.js b/ui/app/serializers/secret-engine.js
index 95beb100a72..0f87f177c53 100644
--- a/ui/app/serializers/secret-engine.js
+++ b/ui/app/serializers/secret-engine.js
@@ -1,10 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ApplicationSerializer from './application';
 import { EmbeddedRecordsMixin } from '@ember-data/serializer/rest';
+import engineDisplayData from 'vault/helpers/engines-display-data';
 
 export default ApplicationSerializer.extend(EmbeddedRecordsMixin, {
   attrs: {
@@ -78,12 +79,19 @@ export default ApplicationSerializer.extend(EmbeddedRecordsMixin, {
   },
 
   serialize(snapshot) {
-    const type = snapshot.record.get('engineType');
+    const type = snapshot.record.engineType;
     const data = this._super(...arguments);
     // move version back to options
     data.options = data.version ? { version: data.version } : {};
     delete data.version;
 
+    if (!engineDisplayData(type)?.isWIF) {
+      // only send identity_token_key if it's set on a WIF secret engine.
+      // because of issues with the model unloading with a belongsTo relationships
+      // identity_token_key can accidentally carry over if a user backs out of the form and changes the type from WIF to non-WIF.
+      delete data.config.identity_token_key;
+    }
+
     if (type !== 'kv' || data.options.version === 1) {
       // These items are on the model, but used by the kv-v2 config endpoint only
       delete data.max_versions;
diff --git a/ui/app/serializers/secret.js b/ui/app/serializers/secret.js
index 821bafe6857..b4ce57707a3 100644
--- a/ui/app/serializers/secret.js
+++ b/ui/app/serializers/secret.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/server.js b/ui/app/serializers/server.js
index fcca14d8e22..28d68738178 100644
--- a/ui/app/serializers/server.js
+++ b/ui/app/serializers/server.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/ssh.js b/ui/app/serializers/ssh.js
index d02c9702817..5ae7fc070b2 100644
--- a/ui/app/serializers/ssh.js
+++ b/ui/app/serializers/ssh.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/sync/association.js b/ui/app/serializers/sync/association.js
index 695d90df4fe..7fb8f13c2bf 100644
--- a/ui/app/serializers/sync/association.js
+++ b/ui/app/serializers/sync/association.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,13 +15,21 @@ export default class SyncAssociationSerializer extends ApplicationSerializer {
     subKey: { serialize: false },
   };
 
+  generateId(data) {
+    let id = `${data.mount}/${data.secret_name}`;
+    if (data.sub_key) {
+      id += `/${data.sub_key}`;
+    }
+    return id;
+  }
+
   extractLazyPaginatedData(payload) {
     if (payload) {
       const { store_name, store_type, associated_secrets } = payload.data;
       const secrets = [];
       for (const key in associated_secrets) {
         const data = associated_secrets[key];
-        data.id = key;
+        data.id = this.generateId(data);
         const association = {
           destinationName: store_name,
           destinationType: store_type,
diff --git a/ui/app/serializers/sync/destination.js b/ui/app/serializers/sync/destination.js
index 4d40e74ee32..6d6fe9020da 100644
--- a/ui/app/serializers/sync/destination.js
+++ b/ui/app/serializers/sync/destination.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -50,7 +50,7 @@ export default class SyncDestinationSerializer extends ApplicationSerializer {
         const type = key.replace(/\/$/, '');
         const id = `${type}/${name}`;
         // create object with destination's id and attributes, add to payload
-        transformedPayload.pushObject({ id, name, type });
+        transformedPayload.push({ id, name, type });
       });
     }
     return transformedPayload;
diff --git a/ui/app/serializers/sync/destinations/aws-sm.js b/ui/app/serializers/sync/destinations/aws-sm.js
index 9ca35debafc..4155dce2046 100644
--- a/ui/app/serializers/sync/destinations/aws-sm.js
+++ b/ui/app/serializers/sync/destinations/aws-sm.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/sync/destinations/azure-kv.js b/ui/app/serializers/sync/destinations/azure-kv.js
index f733cc2b4f2..e573e00db3f 100644
--- a/ui/app/serializers/sync/destinations/azure-kv.js
+++ b/ui/app/serializers/sync/destinations/azure-kv.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/sync/destinations/gcp-sm.js b/ui/app/serializers/sync/destinations/gcp-sm.js
index d454ee7c779..ae297171d5a 100644
--- a/ui/app/serializers/sync/destinations/gcp-sm.js
+++ b/ui/app/serializers/sync/destinations/gcp-sm.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/sync/destinations/gh.js b/ui/app/serializers/sync/destinations/gh.js
index b5f75ad37e6..8ed542a33f6 100644
--- a/ui/app/serializers/sync/destinations/gh.js
+++ b/ui/app/serializers/sync/destinations/gh.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/sync/destinations/vercel-project.js b/ui/app/serializers/sync/destinations/vercel-project.js
index 38e16e10b2d..5e8f7b6545e 100644
--- a/ui/app/serializers/sync/destinations/vercel-project.js
+++ b/ui/app/serializers/sync/destinations/vercel-project.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/totp-key.js b/ui/app/serializers/totp-key.js
new file mode 100644
index 00000000000..e2a660d2c8e
--- /dev/null
+++ b/ui/app/serializers/totp-key.js
@@ -0,0 +1,44 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import ApplicationSerializer from './application';
+import { camelize } from '@ember/string';
+
+export default class TotpKeySerializer extends ApplicationSerializer {
+  normalizeItems(payload, requestType) {
+    if (
+      requestType !== 'queryRecord' &&
+      payload.data &&
+      payload.data.keys &&
+      Array.isArray(payload.data.keys)
+    ) {
+      // if we have data.keys, it's a list of ids, so we map over that
+      // and create objects with id's
+      return payload.data.keys.map((secret) => ({
+        id: secret,
+        backend: payload.backend,
+      }));
+    }
+
+    Object.assign(payload, payload.data);
+    delete payload.data;
+    return payload;
+  }
+
+  serialize(snapshot) {
+    // remove all fields that are not relevant to specified key provider
+    const { keyFormFields } = snapshot.adapterOptions;
+    const json = super.serialize(...arguments);
+    Object.keys(json).forEach((key) => {
+      if (!keyFormFields.includes(camelize(key))) {
+        delete json[key];
+      }
+    });
+
+    // remove name as it isn't a parameter - it is a part of the request url
+    delete json.name;
+    return json;
+  }
+}
diff --git a/ui/app/serializers/transform.js b/ui/app/serializers/transform.js
index 5928c0634cd..49529289542 100644
--- a/ui/app/serializers/transform.js
+++ b/ui/app/serializers/transform.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/transform/alphabet.js b/ui/app/serializers/transform/alphabet.js
index a08d5c553b0..23aeaf2bb3c 100644
--- a/ui/app/serializers/transform/alphabet.js
+++ b/ui/app/serializers/transform/alphabet.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/transform/role.js b/ui/app/serializers/transform/role.js
index 46961b920c4..0820fa604eb 100644
--- a/ui/app/serializers/transform/role.js
+++ b/ui/app/serializers/transform/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/transform/template.js b/ui/app/serializers/transform/template.js
index c004aaf31aa..af1eaff33ea 100644
--- a/ui/app/serializers/transform/template.js
+++ b/ui/app/serializers/transform/template.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/serializers/transit-key.js b/ui/app/serializers/transit-key.js
index 8e046d63de8..a867f2f8a46 100644
--- a/ui/app/serializers/transit-key.js
+++ b/ui/app/serializers/transit-key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/services/analytics.ts b/ui/app/services/analytics.ts
new file mode 100644
index 00000000000..2ceb42450aa
--- /dev/null
+++ b/ui/app/services/analytics.ts
@@ -0,0 +1,87 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Service, { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+
+import { DummyProvider, PROVIDER_NAME as DummyProviderName } from 'vault/utils/analytics-providers/dummy';
+import {
+  PostHogProvider,
+  PROVIDER_NAME as PostHogProviderName,
+} from 'vault/utils/analytics-providers/posthog';
+
+import type { AnalyticsConfig, AnalyticsProvider } from 'vault/vault/analytics';
+import type RouterService from '@ember/routing/router-service';
+
+import config from 'vault/config/environment';
+
+export default class AnalyticsService extends Service {
+  @service declare readonly router: RouterService;
+
+  @tracked activated = false;
+  @tracked provider: AnalyticsProvider = new DummyProvider();
+
+  debug = config.environment === 'development';
+
+  private log(...args: unknown[]) {
+    if (this.debug) {
+      // eslint-disable-next-line no-console
+      console.log(`[Analytics - ${this.provider.name}]`, ...args);
+    }
+  }
+
+  private setupRouteEventListener() {
+    // on successful route changes...
+    this.router.on('routeDidChange', () => {
+      const { currentRouteName } = this.router;
+
+      this.trackPageView(currentRouteName || 'unknown-route');
+    });
+  }
+
+  identifyUser = (identifer: string, traits: Record<string, string>) => {
+    this.provider.identify(identifer, traits);
+    this.log('identifyUser', identifer, traits);
+  };
+
+  start = (provider: string, config: AnalyticsConfig) => {
+    // fail silently, analytics is nonessential
+    if (!provider) {
+      this.provider = new DummyProvider();
+      this.debug = false;
+      return;
+    }
+
+    // if analytics are not enabled, don't start the service
+    if (config.enabled) {
+      switch (provider) {
+        case DummyProviderName:
+          this.provider = new DummyProvider();
+          break;
+        case PostHogProviderName:
+          this.provider = new PostHogProvider();
+      }
+
+      // only start things once we've confirmed we want to
+      this.provider.start(config);
+      this.activated = true;
+      this.setupRouteEventListener();
+
+      this.log('start');
+    }
+  };
+
+  trackPageView = (routeName: string, metadata?: Record<string, string>) => {
+    this.provider.trackPageView(routeName, metadata || {});
+
+    this.log('$pageview', routeName, metadata);
+  };
+
+  trackEvent = (eventName: string, metadata: Record<string, string>) => {
+    this.provider.trackEvent(eventName, metadata);
+
+    this.log('custom event', eventName, metadata);
+  };
+}
diff --git a/ui/app/services/api.ts b/ui/app/services/api.ts
new file mode 100644
index 00000000000..0b8b2c78714
--- /dev/null
+++ b/ui/app/services/api.ts
@@ -0,0 +1,255 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Service, { service } from '@ember/service';
+import {
+  Configuration,
+  RequestContext,
+  ResponseContext,
+  AuthApi,
+  IdentityApi,
+  SecretsApi,
+  SystemApi,
+  HTTPQuery,
+  HTTPRequestInit,
+  RequestOpts,
+  ResponseError,
+} from '@hashicorp/vault-client-typescript';
+import config from 'vault/config/environment';
+import { waitForPromise, waitFor } from '@ember/test-waiters';
+
+import type AuthService from 'vault/services/auth';
+import type NamespaceService from 'vault/services/namespace';
+import type ControlGroupService from 'vault/services/control-group';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type { HeaderMap, XVaultHeaders } from 'vault/api';
+
+export default class ApiService extends Service {
+  @service('auth') declare readonly authService: AuthService;
+  @service('namespace') declare readonly namespaceService: NamespaceService;
+  @service declare readonly controlGroup: ControlGroupService;
+  @service declare readonly flashMessages: FlashMessageService;
+
+  // -- Pre Request Middleware --
+  setLastFetch = async (context: RequestContext) => {
+    const { url } = context;
+    const isPolling = config.APP.POLLING_URLS.some((str) => url.includes(str));
+
+    if (!isPolling) {
+      this.authService.setLastFetch(Date.now());
+    }
+  };
+
+  getControlGroupToken = async (context: RequestContext) => {
+    const { url, init } = context;
+    const controlGroupToken = this.controlGroup.tokenForUrl(url);
+    let newUrl = url;
+    // if we have a Control Group token that matches the url,
+    // unwrap it and return the unwrapped response as if it were the initial request
+    // to do this, we rewrite the request
+    if (controlGroupToken) {
+      const { token } = controlGroupToken;
+      const { headers } = this.buildHeaders({ token });
+      newUrl = '/v1/sys/wrapping/unwrap';
+      init.method = 'POST';
+      init.headers = headers;
+      init.body = JSON.stringify({ token });
+    }
+    return { url: newUrl, init };
+  };
+
+  setHeaders = async (context: RequestContext) => {
+    const { url, init } = context;
+    const headers = new Headers(init.headers);
+    // unauthenticated or clientToken requests should set the header in initOverrides
+    // unauthenticated value should be empty string, not undefined or null
+    const { currentToken } = this.authService;
+    if (!headers.has('X-Vault-Token') && currentToken) {
+      headers.set('X-Vault-Token', currentToken);
+    }
+    if (init.method === 'PATCH') {
+      headers.set('Content-Type', 'application/merge-patch+json');
+    }
+    // use initOverrides to set the namespace header to something other than path set in the namespace service
+    // for requests that must be made to root namespace pass empty string as value
+    const namespace = this.namespaceService.path;
+    if (!headers.has('X-Vault-Namespace') && namespace) {
+      headers.set('X-Vault-Namespace', namespace);
+    }
+
+    init.headers = headers;
+    return { url, init };
+  };
+
+  // -- Post Request Middleware --
+  showWarnings = waitFor(async (context: ResponseContext) => {
+    const response = context.response.clone();
+    // if the response is empty, don't try to parse it
+    if (response.headers.get('Content-Length')) {
+      const json = await response.json();
+
+      if (json?.warnings) {
+        json.warnings.forEach((message: string) => {
+          this.flashMessages.info(message);
+        });
+      }
+    }
+  });
+
+  checkControlGroup = waitFor(async (context: ResponseContext) => {
+    const response = context.response.clone();
+    const { headers } = response;
+
+    // since control group requests are forwarded to /v1/sys/wrapping/unwrap we cannot use controlGroup.tokenForUrl here
+    // instead, we can check if tokenToUnwrap exists on the service and compare the token value with the request header value
+    if (this.controlGroup.tokenToUnwrap) {
+      const { token, accessor } = this.controlGroup.tokenToUnwrap || {};
+      const requestHeaders = context.init.headers as Headers;
+
+      if (requestHeaders.get('X-Vault-Token') === token) {
+        this.controlGroup.deleteControlGroupToken(accessor);
+      }
+    }
+    // if the requested path is locked by a control group we need to create a new error response
+    if (headers.get('Content-Length')) {
+      const json = await response.json();
+      const wrapTtl = headers.get('X-Vault-Wrap-TTL');
+      const isLockedByControlGroup = this.controlGroup.isRequestedPathLocked(json, wrapTtl);
+
+      if (isLockedByControlGroup) {
+        const error = {
+          message: 'Control Group encountered',
+          isControlGroupError: true,
+          ...json.wrap_info,
+        };
+        return new Response(JSON.stringify(error), { headers, status: 403, statusText: 'Forbidden' });
+      }
+    }
+
+    return;
+  });
+  // --- End Middleware ---
+
+  configuration = new Configuration({
+    basePath: '/v1',
+    middleware: [
+      { pre: this.setLastFetch },
+      { pre: this.getControlGroupToken },
+      { pre: this.setHeaders },
+      { post: this.showWarnings },
+      { post: this.checkControlGroup },
+    ],
+    fetchApi: (...args: [Request]) => {
+      return waitForPromise(window.fetch(...args));
+    },
+  });
+
+  auth = new AuthApi(this.configuration);
+  identity = new IdentityApi(this.configuration);
+  secrets = new SecretsApi(this.configuration);
+  sys = new SystemApi(this.configuration);
+
+  // convenience method for overriding headers for given requests to ensure consistency
+  // eg. this.api.sys.wrap(data, { headers: { 'X-Vault-Wrap-TTL': wrap } });
+  // -> this.api.sys.wrap(data, this.api.buildHeaders({ wrap }));
+  buildHeaders(headerMap: HeaderMap) {
+    const headers = {} as XVaultHeaders;
+
+    for (const key in headerMap) {
+      const headerKey = {
+        namespace: 'X-Vault-Namespace',
+        token: 'X-Vault-Token',
+        wrap: 'X-Vault-Wrap-TTL',
+        recoverSnapshotId: 'X-Vault-Recover-Snapshot-Id',
+        recoverSourcePath: 'X-Vault-Recover-Source-Path',
+      }[key] as keyof XVaultHeaders;
+
+      headers[headerKey] = headerMap[key as keyof HeaderMap];
+    }
+
+    return { headers };
+  }
+
+  // convenience method for updating the query params object on the request context
+  // eg. this.api.sys.uiConfigListCustomMessages(true, ({ context: { query } }) => { query.authenticated = true });
+  // -> this.api.sys.uiConfigListCustomMessages(true, (context) => this.api.addQueryParams(context, { authenticated: true }));
+  async addQueryParams(
+    requestContext: { init: HTTPRequestInit; context: RequestOpts },
+    params: HTTPQuery = {}
+  ) {
+    const { context, init } = requestContext;
+    context.query = { ...context.query, ...params };
+    return init;
+  }
+
+  // accepts an error response and returns { status, message, response, path }
+  // message is built as error.errors joined with a comma, error.message or a fallback message
+  // path is the url of the request, minus the origin -> /v1/sys/wrapping/unwrap
+  parseError = waitFor(async (e: unknown, fallbackMessage = 'An error occurred, please try again') => {
+    if (e instanceof ResponseError) {
+      const { status, url } = e.response;
+      // instances where an error is thrown multiple times could result in the body already being read
+      // this will result in a readable stream failure and we can't parse the body
+      // to avoid this, clone the response so we can access the body consistently
+      const error = await e.response.clone().json();
+      // typically the Vault API error response looks like { errors: ['some error message'] }
+      // but sometimes (eg RespondWithStatusCode) it's { data: { error: 'some error message' } }
+      const errors = error.data?.error && !error.errors ? [error.data.error] : error.errors;
+      const message = errors && typeof errors[0] === 'string' ? errors.join(', ') : error.message;
+
+      return {
+        message: message || fallbackMessage,
+        status,
+        path: decodeURIComponent(url.replace(document.location.origin, '')),
+        response: error,
+      };
+    }
+
+    // log out generic error for ease of debugging in dev env
+    if (config.environment === 'development') {
+      console.log('API Error:', e); // eslint-disable-line no-console
+    }
+
+    return {
+      message: (e as Error)?.message || fallbackMessage,
+    };
+  });
+
+  // accepts a list response as { keyInfo, keys } and returns a flat array of the keyInfo datum
+  // to preserve the keys (unique identifiers) the value will be set on the datum as id
+  keyInfoToArray(response: unknown = {}) {
+    const { key_info, keys } = response as { key_info?: Record<string, unknown>; keys?: string[] };
+    if (!key_info || !keys) {
+      return [];
+    }
+    return keys.reduce(
+      (arr, key) => {
+        const datum = key_info[key];
+        if (datum) {
+          arr.push({ id: key, ...datum });
+        }
+        return arr;
+      },
+      [] as Record<string, unknown>[]
+    );
+  }
+
+  // some responses return an object with a uuid as the key rather than an array
+  // in most cases it is easier to work with an array with the uuid set as a property on the object
+  // for example, internalUiListEnabledVisibleMounts returns an object like: { secret: { '/path/to/secret': { ... } } }
+  // usage for above example -> this.api.objectToArray(response.secret, 'path');
+  // this would return an array of objects like: [{ path: '/path/to/secret', ... }]
+  responseObjectToArray<T extends object>(obj?: T, uuidKey?: string) {
+    if (obj) {
+      return Object.entries(obj).map(([key, value]) => {
+        if (uuidKey) {
+          return { [uuidKey]: key, ...value };
+        }
+        return { ...value };
+      });
+    }
+    return [];
+  }
+}
diff --git a/ui/app/services/auth.js b/ui/app/services/auth.js
index 136f34dc384..d2bccf592cc 100644
--- a/ui/app/services/auth.js
+++ b/ui/app/services/auth.js
@@ -1,27 +1,24 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Ember from 'ember';
 import { task, timeout } from 'ember-concurrency';
-import { getOwner } from '@ember/application';
-import { isArray } from '@ember/array';
-import { computed, get } from '@ember/object';
+import { getOwner } from '@ember/owner';
+import { computed } from '@ember/object';
 import { alias } from '@ember/object/computed';
 import Service, { inject as service } from '@ember/service';
 import { capitalize } from '@ember/string';
-import fetch from 'fetch';
 import { resolve, reject } from 'rsvp';
 
 import getStorage from 'vault/lib/token-storage';
 import ENV from 'vault/config/environment';
-import { allSupportedAuthBackends } from 'vault/helpers/supported-auth-backends';
+import { addToArray } from 'vault/helpers/add-to-array';
 
 const TOKEN_SEPARATOR = '☃';
 const TOKEN_PREFIX = 'vault-';
 const ROOT_PREFIX = '_root_';
-const BACKENDS = allSupportedAuthBackends();
 
 export { TOKEN_SEPARATOR, TOKEN_PREFIX, ROOT_PREFIX };
 
@@ -29,6 +26,7 @@ export default Service.extend({
   permissions: service(),
   currentCluster: service(),
   router: service(),
+  store: service(),
   namespaceService: service('namespace'),
 
   IDLE_TIMEOUT: 3 * 60e3,
@@ -80,8 +78,10 @@ export default Service.extend({
     if (!tokenName) {
       return;
     }
-    const { tokenExpirationEpoch } = this.getTokenData(tokenName);
-    const expirationDate = new Date(0);
+    const tokenData = this.getTokenData(tokenName);
+    const tokenExpirationEpoch = tokenData ? tokenData?.tokenExpirationEpoch : undefined;
+    const expirationDate = new Date(0); // Creates a "zeroed" date object
+
     return tokenExpirationEpoch ? expirationDate.setUTCMilliseconds(tokenExpirationEpoch) : null;
   }),
 
@@ -115,15 +115,8 @@ export default Service.extend({
     if (!token) {
       return;
     }
-    const backend = this.backendFromTokenName(token);
     const stored = this.getTokenData(token);
-    return Object.assign(stored, {
-      backend: {
-        // add mount path for password reset
-        mountPath: stored.backend.mountPath,
-        ...BACKENDS.find((b) => b.type === backend),
-      },
-    });
+    return stored ? Object.assign({}, stored) : null;
   }),
 
   init() {
@@ -208,39 +201,54 @@ export default Service.extend({
     return this.ajax(url, 'POST', { namespace });
   },
 
+  async lookupSelf(token) {
+    return this.store
+      .adapterFor('application')
+      .ajax('/v1/auth/token/lookup-self', 'GET', { headers: { 'X-Vault-Token': token } });
+  },
+
   revokeCurrentToken() {
     const namespace = this.authData.userRootNamespace;
     const url = '/v1/auth/token/revoke-self';
     return this.ajax(url, 'POST', { namespace });
   },
 
-  calculateExpiration(resp) {
-    const now = this.now();
-    const ttl = resp.ttl || resp.lease_duration;
-    const tokenExpirationEpoch = now + ttl * 1e3;
-    this.set('expirationCalcTS', now);
-    return {
-      ttl,
-      tokenExpirationEpoch,
-    };
+  // ttl is originally either the "ttl" or "lease_duration" returned by the auth data response
+  calculateExpiration({ now, ttl, expireTime }) {
+    // First check if the ttl is falsy, including 0, before converting to milliseconds.
+    // Obviously a ttl of zero seconds is not recommended, but root tokens have a `0` ttl because they never expire.
+    // Note - this is different from mount configurations where a `ttl: 0` actually means the value is "unset" and to use system defaults.
+    const convertToMilliseconds = () => (ttl ? now + ttl * 1e3 : null);
+    const tokenExpirationEpoch = expireTime ? new Date(expireTime).getTime() : convertToMilliseconds();
+    // To avoid confusion, if a TTL is `0` return null
+    return { ttl: ttl || null, tokenExpirationEpoch };
   },
 
-  calculateRootNamespace(currentNamespace, namespace_path, backend) {
+  setExpirationSettings(renewable, now) {
+    if (renewable) {
+      this.set('expirationCalcTS', now);
+      this.set('allowExpiration', false);
+    } else {
+      this.set('allowExpiration', true);
+    }
+  },
+
+  calculateRootNamespace(currentNamespace, namespacePath, backend) {
+    // namespace_path is only returned for methods that use a token exchange to authenticate (i.e. token, oidc)
     // here we prefer namespace_path if its defined,
     // else we look and see if there's already a namespace saved
     // and then finally we'll use the current query param if the others
     // haven't set a value yet
     // all of the typeof checks are necessary because the root namespace is ''
-    let userRootNamespace = namespace_path && namespace_path.replace(/\/$/, '');
-    // if we're logging in with token and there's no namespace_path, we can assume
+    let userRootNamespace = namespacePath && namespacePath.replace(/\/$/, '');
+    // renew-self does not return namespace_path, so we manually setting in renew().
+    // so if we're logging in with token and there's no namespace_path, we can assume
     // that the token belongs to the root namespace
     if (backend === 'token' && !userRootNamespace) {
       userRootNamespace = '';
     }
-    if (typeof userRootNamespace === 'undefined') {
-      if (this.authData) {
-        userRootNamespace = this.authData.userRootNamespace;
-      }
+    if (typeof userRootNamespace === 'undefined' && this.authData) {
+      userRootNamespace = this.authData.userRootNamespace;
     }
     if (typeof userRootNamespace === 'undefined') {
       userRootNamespace = currentNamespace;
@@ -248,72 +256,74 @@ export default Service.extend({
     return userRootNamespace;
   },
 
-  persistAuthData() {
-    const [firstArg, resp] = arguments;
-    const tokens = this.tokens;
+  async persistAuthData(clusterId, authResponseData) {
+    // An empty string denotes the "root" namespace
     const currentNamespace = this.namespaceService.path || '';
-    // dropdown vs tab format
-    const mountPath = firstArg?.data?.path || firstArg?.selectedAuth;
-    let tokenName;
-    let options;
-    let backend;
-    if (typeof firstArg === 'string') {
-      tokenName = firstArg;
-      backend = this.backendFromTokenName(tokenName);
-    } else {
-      options = firstArg;
-      backend = options.backend;
-    }
+    // Only pull out the necessary data
+    const { authMethodType, authMountPath, entityId, policies, renewable, token, ttl } = authResponseData;
+
+    // Lookup token for additional data that may be missing from the method's login response
+    const { displayName, expireTime, namespacePath } = await this.lookupTokenData(token, !!currentNamespace, {
+      displayName: authResponseData?.displayName,
+      expireTime: authResponseData?.expireTime,
+      namespacePath: authResponseData?.namespacePath,
+    });
 
-    const currentBackend = {
-      mountPath,
-      ...BACKENDS.find((b) => b.type === backend),
-    };
-    let displayName;
-    if (isArray(currentBackend.displayNamePath)) {
-      displayName = currentBackend.displayNamePath.map((name) => get(resp, name)).join('/');
-    } else {
-      displayName = get(resp, currentBackend.displayNamePath);
-    }
+    const userRootNamespace = this.calculateRootNamespace(currentNamespace, namespacePath, authMethodType);
 
-    const { entity_id, policies, renewable, namespace_path } = resp;
-    const userRootNamespace = this.calculateRootNamespace(currentNamespace, namespace_path, backend);
-    const data = {
-      userRootNamespace,
-      displayName,
-      backend: currentBackend,
-      token: resp.client_token || get(resp, currentBackend.tokenPath),
+    const persistedTokenData = {
+      authMethodType,
+      authMountPath,
+      displayName: displayName || authMethodType,
+      entityId,
       policies,
       renewable,
-      entity_id,
+      token,
+      userRootNamespace,
+      // Only include namespacePath if it exists
+      ...(namespacePath && { namespacePath }),
     };
 
-    tokenName = this.generateTokenName(
-      {
-        backend,
-        clusterId: (options && options.clusterId) || this.activeClusterId,
-      },
-      resp.policies
-    );
-
-    if (resp.renewable) {
-      Object.assign(data, this.calculateExpiration(resp));
-    }
-
-    if (!data.displayName) {
-      data.displayName = (this.getTokenData(tokenName) || {}).displayName;
-    }
-    tokens.addObject(tokenName);
-    this.set('tokens', tokens);
-    this.set('allowExpiration', false);
-    this.setTokenData(tokenName, data);
+    // Set stored ttl and tokenExpirationEpoch
+    const now = this.now();
+    const { ttl: calculatedTtl, tokenExpirationEpoch } = this.calculateExpiration({ now, ttl, expireTime });
+    persistedTokenData.ttl = calculatedTtl;
+    persistedTokenData.tokenExpirationEpoch = tokenExpirationEpoch;
+    this.setExpirationSettings(renewable, now);
+    // ensure we don't call renew-self within tests
+    // this is intentionally not included in setExpirationSettings so we can unit test that method
+    if (Ember.testing) this.set('allowExpiration', false);
+
+    // Set token name and store data
+    const tokenName = this.generateTokenName({ backend: authMethodType, clusterId }, policies);
+    this.set('tokens', addToArray(this.tokens, tokenName));
+    this.setTokenData(tokenName, persistedTokenData);
     return resolve({
-      namespace: currentNamespace || data.userRootNamespace,
+      namespace: currentNamespace || persistedTokenData.userRootNamespace,
       token: tokenName,
-      isRoot: policies.includes('root'),
+      isRoot: (policies || []).includes('root'),
     });
   },
 
+  async lookupTokenData(token, hasNamespace, { displayName, expireTime, namespacePath }) {
+    // Only lookup if we're missing displayName or namespacePath in a non-root namespace
+    if (!displayName || (!namespacePath && hasNamespace)) {
+      try {
+        const { data } = await this.lookupSelf(token);
+        return {
+          displayName: displayName || data?.display_name,
+          namespacePath: namespacePath || data?.namespace_path,
+          expireTime: expireTime || data?.expire_time,
+        };
+      } catch {
+        // It would be unusual for this request to fail, but swallowing it because we're
+        // essentially setting "nice to have" data here.
+      }
+    }
+    // Return original values as fallback
+    return { displayName, namespacePath, expireTime };
+  },
+
   setTokenData(token, data) {
     this.storage(token).setItem(token, data);
   },
@@ -327,16 +337,21 @@ export default Service.extend({
   },
 
   renew() {
-    const tokenName = this.currentTokenName;
     const currentlyRenewing = this.isRenewing;
-    if (currentlyRenewing) {
-      return;
-    }
+    if (currentlyRenewing) return;
+
     this.isRenewing = true;
     return this.renewCurrentToken().then(
-      (resp) => {
+      async (resp) => {
         this.isRenewing = false;
-        return this.persistAuthData(tokenName, resp.data || resp.auth);
+        // If we renewing, authData already exists so all we really need to update are the token and expiration details
+        const { authMethodType, authMountPath, displayName } = this.authData;
+        const normalizedAuthData = this.normalizeAuthData(resp.auth, {
+          authMethodType,
+          authMountPath,
+          displayName,
+        });
+        return await this.persistAuthData(this.activeClusterId, normalizedAuthData);
       },
       (e) => {
         this.isRenewing = false;
@@ -359,6 +374,7 @@ export default Service.extend({
   shouldRenew() {
     const now = this.now();
     const lastFetch = this.lastFetch;
+    // renewAfterEpoch is a unix timestamp of login time + half of ttl
     const renewTime = this.renewAfterEpoch;
     if (!this.currentTokenName || this.tokenExpired || this.allowExpiration || !renewTime) {
       return false;
@@ -377,7 +393,7 @@ export default Service.extend({
     const now = this.now();
     this.set('lastFetch', timestamp);
     // if expiration was allowed and we're over half the ttl we want to go ahead and renew here
-    if (this.allowExpiration && now >= this.renewAfterEpoch) {
+    if (this.allowExpiration && this.renewAfterEpoch && now >= this.renewAfterEpoch) {
       this.renew();
     }
     this.set('allowExpiration', false);
@@ -404,78 +420,47 @@ export default Service.extend({
     });
   },
 
-  _parseMfaResponse(mfa_requirement) {
+  parseMfaResponse(mfaRequirement) {
     // mfa_requirement response comes back in a shape that is not easy to work with
     // convert to array of objects and add necessary properties to satisfy the view
-    if (mfa_requirement) {
-      const { mfa_request_id, mfa_constraints } = mfa_requirement;
+    if (mfaRequirement) {
+      const { mfa_request_id, mfa_constraints } = mfaRequirement;
       const constraints = [];
       for (const key in mfa_constraints) {
         const methods = mfa_constraints[key].any;
-        const isMulti = methods.length > 1;
-
         // friendly label for display in MfaForm
         methods.forEach((m) => {
           const typeFormatted = m.type === 'totp' ? m.type.toUpperCase() : capitalize(m.type);
           m.label = `${typeFormatted} ${m.uses_passcode ? 'passcode' : 'push notification'}`;
         });
-        constraints.push({
-          name: key,
-          methods,
-          selectedMethod: isMulti ? null : methods[0],
-        });
+        constraints.push({ name: key, methods });
       }
-
-      return {
-        mfa_requirement: { mfa_request_id, mfa_constraints: constraints },
-      };
+      return { mfa_request_id, mfa_constraints: constraints };
     }
     return {};
   },
 
-  async authenticate(/*{clusterId, backend, data, selectedAuth}*/) {
-    const [options] = arguments;
-    const adapter = this.clusterAdapter();
-    const resp = await adapter.authenticate(options);
-
-    if (resp.auth?.mfa_requirement) {
-      return this._parseMfaResponse(resp.auth?.mfa_requirement);
-    }
-
-    return this.authSuccess(options, resp.auth || resp.data);
-  },
-
-  async totpValidate({ mfa_requirement, ...options }) {
-    const resp = await this.clusterAdapter().mfaValidate(mfa_requirement);
-    return this.authSuccess(options, resp.auth || resp.data);
+  async totpValidate({ clusterId, mfaRequirement, authMethodType, authMountPath }) {
+    // mfa/validate consistently returns data inside the "auth" key
+    const { auth } = await this.clusterAdapter().mfaValidate(mfaRequirement);
+    const normalizedAuthData = this.normalizeAuthData(auth, { authMethodType, authMountPath });
+    return this.authSuccess(clusterId, normalizedAuthData);
   },
 
-  async authSuccess(options, response) {
+  async authSuccess(clusterId, authResponse) {
     // persist selectedAuth to localStorage to rehydrate auth form on logout
-    localStorage.setItem('selectedAuth', options.selectedAuth);
-    const authData = await this.persistAuthData(options, response, this.namespaceService.path);
-    await this.permissions.getPaths.perform();
+    localStorage.setItem('selectedAuth', authResponse.authMethodType);
+    const authData = await this.persistAuthData(clusterId, authResponse);
+    this.permissions.getPaths.perform();
     return authData;
   },
 
-  handleError(e) {
-    if (e.errors) {
-      return e.errors.map((error) => {
-        if (error.detail) {
-          return error.detail;
-        }
-        return error;
-      });
-    }
-    return [e];
-  },
-
   getAuthType() {
     // check localStorage first
     const selectedAuth = localStorage.getItem('selectedAuth');
     if (selectedAuth) return selectedAuth;
     // fallback to authData which discerns backend type from token
-    return this.authData ? this.authData.backend.type : null;
+    return this.authData ? this.authData.authMethodType : null;
   },
 
   deleteCurrentToken() {
@@ -490,20 +475,30 @@ export default Service.extend({
     this.set('tokens', tokenNames);
   },
 
-  getOktaNumberChallengeAnswer(nonce, mount) {
-    const url = `/v1/auth/${mount}/verify/${nonce}`;
-    return this.ajax(url, 'GET', {}).then(
-      (resp) => {
-        return resp.data.correct_answer;
-      },
-      (e) => {
-        // if error status is 404, return and keep polling for a response
-        if (e.status === 404) {
-          return null;
-        } else {
-          throw e;
-        }
-      }
-    );
+  // Depending on where auth happens (mfa/validate, renew-self or the method's login) the auth data
+  // varies slightly (i.e. "ttl" vs "lease_duration"). Normalize it so stored authData contains consistent keys.
+  // (Also, the API service returns camel cased keys and raw ajax requests return snake cased params.)
+  normalizeAuthData(authData, { authMethodType, authMountPath, displayName, token, ttl }) {
+    const displayNameFromMetadata = (metadata) =>
+      metadata
+        ? ['org', 'username']
+            .map((key) => (key in metadata ? metadata[key] : null))
+            .filter(Boolean)
+            .join('/')
+        : '';
+
+    return {
+      authMethodType,
+      authMountPath,
+      entityId: authData?.entity_id,
+      expireTime: authData?.expire_time,
+      token: token || authData?.client_token,
+      renewable: authData?.renewable,
+      ttl: ttl || authData?.lease_duration,
+      policies: authData?.policies,
+      mfaRequirement: authData?.mfa_requirement,
+      // not all methods return a display name or metadata, if this is still empty it will be gleaned from lookup-self
+      displayName: displayName || displayNameFromMetadata(authData?.metadata),
+    };
   },
 });
diff --git a/ui/app/services/capabilities.ts b/ui/app/services/capabilities.ts
new file mode 100644
index 00000000000..32e9c1db3e9
--- /dev/null
+++ b/ui/app/services/capabilities.ts
@@ -0,0 +1,147 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Service, { service } from '@ember/service';
+import { sanitizePath, sanitizeStart } from 'core/utils/sanitize-path';
+import { PATH_MAP, SUDO_PATHS, SUDO_PATH_PREFIXES } from 'vault/utils/constants/capabilities';
+
+import type ApiService from 'vault/services/api';
+import type NamespaceService from 'vault/services/namespace';
+import type { Capabilities, CapabilitiesMap, CapabilitiesData, CapabilityTypes } from 'vault/app-types';
+
+export default class CapabilitiesService extends Service {
+  @service declare readonly api: ApiService;
+  @service declare readonly namespace: NamespaceService;
+
+  /*
+  Add API paths to the PATH_MAP constant using a friendly key, e.g. 'syncDestinations'.
+  Use the apiPath tagged template literal to build the path with dynamic segments
+  Each path should include placeholders for dynamic values -> apiPath`sys/sync/destinations/${'type'}/${'name'}`
+  Provide the key and an object whose keys match the dynamic segment names
+  The values from the object will be inserted into the placeholders and the fully-resolved path string will be returned.
+  */
+  pathFor<T>(key: keyof typeof PATH_MAP, params?: T) {
+    const path = PATH_MAP[key];
+    if (!path) {
+      throw new Error(`Path not found for key: ${key}`);
+    }
+    return path(params || {});
+  }
+
+  /*
+  Users don't always have access to the capabilities-self endpoint in the current namespace.
+  This can happen when logging in to a namespace and then navigating to a child namespace.
+  The "relativeNamespace" refers to the namespace the user is currently in and attempting to access capabilities for.
+  Prepending "relativeNamespace" to the path while making the request in the "userRootNamespace" context (meaning, "userRootNamespace" is the namespace header)
+  ensures we are querying capabilities-self where the user is most likely to have their policy/permissions.
+  */
+  relativeNamespacePath(path: string) {
+    const { relativeNamespace } = this.namespace;
+    // sanitizeStart ensures original path doesn't have leading slash
+    return relativeNamespace ? `${relativeNamespace}/${sanitizeStart(path)}` : path;
+  }
+
+  // map capabilities to friendly names like canRead, canUpdate, etc.
+  mapCapabilities(paths: string[], capabilitiesData: CapabilitiesData) {
+    // request may not return capabilities for all provided paths
+    // loop provided paths and map capabilities, defaulting to true for missing paths
+    return paths.reduce((mappedCapabilities: CapabilitiesMap, path) => {
+      // key in capabilitiesData includes relativeNamespace if applicable
+      const key = this.relativeNamespacePath(path);
+      const capabilities = capabilitiesData[key];
+
+      const getCapability = (capability: CapabilityTypes) => {
+        if (!(key in capabilitiesData)) {
+          return true;
+        }
+        if (!capabilities?.length || capabilities.includes('deny')) {
+          return false;
+        }
+        if (capabilities.includes('root')) {
+          return true;
+        }
+        // if the path is sudo protected, they'll need sudo + the appropriate capability
+        if (SUDO_PATHS.includes(key) || SUDO_PATH_PREFIXES.find((item) => key.startsWith(item))) {
+          return capabilities.includes('sudo') && capabilities.includes(capability);
+        }
+        return capabilities.includes(capability);
+      };
+      // remove relativeNamespace from the path that was added for the request
+      mappedCapabilities[path] = {
+        canCreate: getCapability('create'),
+        canDelete: getCapability('delete'),
+        canList: getCapability('list'),
+        canPatch: getCapability('patch'),
+        canRead: getCapability('read'),
+        canSudo: getCapability('sudo'),
+        canUpdate: getCapability('update'),
+      };
+      return mappedCapabilities;
+    }, {});
+  }
+
+  async fetch(paths: string[]): Promise<CapabilitiesMap> {
+    const payload = { paths: paths.map((path) => this.relativeNamespacePath(path)) };
+
+    try {
+      const { data } = await this.api.sys.queryTokenSelfCapabilities(
+        payload,
+        this.api.buildHeaders({ namespace: sanitizePath(this.namespace.userRootNamespace) })
+      );
+      return this.mapCapabilities(paths, data as CapabilitiesData);
+    } catch (e) {
+      // default to true if there is a problem fetching the model
+      // we can rely on the API to gate as a fallback
+      return paths.reduce((obj: CapabilitiesMap, path: string) => {
+        obj[path] = {
+          canCreate: true,
+          canDelete: true,
+          canList: true,
+          canPatch: true,
+          canRead: true,
+          canSudo: true,
+          canUpdate: true,
+        };
+        return obj;
+      }, {});
+    }
+  }
+
+  // convenience method for fetching capabilities for a singular path without needing to use pathFor
+  // ex: capabilities.for('syncDestinations', { type: 'github', name: 'org-sync' });
+  async for<T>(key: keyof typeof PATH_MAP, params?: T) {
+    const path = this.pathFor(key, params);
+    return this.fetchPathCapabilities(path);
+  }
+
+  /*
+  this method returns all of the capabilities for a singular path 
+  */
+  async fetchPathCapabilities(path: string) {
+    const capabilities = await this.fetch([path]);
+    return capabilities[path] as Capabilities;
+  }
+
+  /* 
+  internal method for specific capability checks below
+  checks the capability model for the passed capability, ie "canRead"
+  */
+  async _fetchSpecificCapability(path: string, capability: keyof Capabilities) {
+    const capabilities = await this.fetchPathCapabilities(path);
+    return capabilities ? capabilities[capability] : true;
+  }
+
+  canRead(path: string) {
+    return this._fetchSpecificCapability(path, 'canRead');
+  }
+
+  canUpdate(path: string) {
+    return this._fetchSpecificCapability(path, 'canUpdate');
+  }
+
+  canPatch(path: string) {
+    return this._fetchSpecificCapability(path, 'canPatch');
+  }
+}
diff --git a/ui/app/services/console.js b/ui/app/services/console.js
index 8e8d91c91ed..c091f516c34 100644
--- a/ui/app/services/console.js
+++ b/ui/app/services/console.js
@@ -1,19 +1,17 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 // Low level service that allows users to input paths to make requests to vault
 // this service provides the UI synecdote to the cli commands read, write, delete, and list
-import { filterBy } from '@ember/object/computed';
-
 import Service from '@ember/service';
-
-import { getOwner } from '@ember/application';
-import { computed } from '@ember/object';
+import { getOwner } from '@ember/owner';
 import { shiftCommandIndex } from 'vault/lib/console-helpers';
 import { encodePath } from 'vault/utils/path-encoding-helpers';
 import { sanitizePath, ensureTrailingSlash } from 'core/utils/sanitize-path';
+import { tracked } from '@glimmer/tracking';
+import { addManyToArray } from 'vault/helpers/add-to-array';
 
 const VERBS = {
   read: 'GET',
@@ -22,49 +20,51 @@ const VERBS = {
   delete: 'DELETE',
 };
 
-export default Service.extend({
-  isOpen: false,
+export default class ConsoleService extends Service {
+  @tracked isOpen = false;
+  @tracked commandIndex = null;
+  @tracked log = [];
+
+  get commandHistory() {
+    return this.log.filter((log) => log.type === 'command');
+  }
 
+  // Not a getter so it can be stubbed in tests
   adapter() {
     return getOwner(this).lookup('adapter:console');
-  },
-  commandHistory: filterBy('log', 'type', 'command'),
-  log: computed(function () {
-    return [];
-  }),
-  commandIndex: null,
+  }
 
-  shiftCommandIndex(keyCode, setCommandFn = () => {}) {
-    const [newIndex, newCommand] = shiftCommandIndex(keyCode, this.commandHistory, this.commandIndex);
+  shiftCommandIndex(key, setCommandFn = () => {}) {
+    const [newIndex, newCommand] = shiftCommandIndex(key, this.commandHistory, this.commandIndex);
     if (newCommand !== undefined && newIndex !== undefined) {
-      this.set('commandIndex', newIndex);
+      this.commandIndex = newIndex;
       setCommandFn(newCommand);
     }
-  },
+  }
 
   clearLog(clearAll = false) {
-    const log = this.log;
     let history;
     if (!clearAll) {
       history = this.commandHistory.slice();
       history.setEach('hidden', true);
     }
-    log.clear();
+    this.log = [];
     if (history) {
-      log.addObjects(history);
+      this.log = addManyToArray(this.log, history);
     }
-  },
+  }
 
   logAndOutput(command, logContent) {
-    const log = this.log;
+    const log = this.log.slice();
     if (command) {
-      log.pushObject({ type: 'command', content: command });
-      this.set('commandIndex', null);
+      log.push({ type: 'command', content: command });
+      this.commandIndex = null;
     }
     if (logContent) {
-      log.pushObject(logContent);
+      log.push(logContent);
     }
-  },
+    this.log = log;
+  }
 
   ajax(operation, path, options = {}) {
     const verb = VERBS[operation];
@@ -75,7 +75,7 @@ export default Service.extend({
       data,
       wrapTTL,
     });
-  },
+  }
 
   kvGet(path, data, flags = {}) {
     const { wrapTTL, metadata } = flags;
@@ -84,21 +84,21 @@ export default Service.extend({
     const [backend, secretPath] = path.split(/\/(.+)?/);
     const kvPath = `${backend}/${pathSegment}/${secretPath}`;
     return this.ajax('read', sanitizePath(kvPath), { wrapTTL });
-  },
+  }
 
   read(path, data, flags) {
     const wrapTTL = flags?.wrapTTL;
     return this.ajax('read', sanitizePath(path), { wrapTTL });
-  },
+  }
 
   write(path, data, flags) {
     const wrapTTL = flags?.wrapTTL;
     return this.ajax('write', sanitizePath(path), { data, wrapTTL });
-  },
+  }
 
   delete(path) {
     return this.ajax('delete', sanitizePath(path));
-  },
+  }
 
   list(path, data, flags) {
     const wrapTTL = flags?.wrapTTL;
@@ -109,5 +109,5 @@ export default Service.extend({
       },
       wrapTTL,
     });
-  },
-});
+  }
+}
diff --git a/ui/app/services/control-group.js b/ui/app/services/control-group.js
index 7ea218fbfbe..ad0e74c705a 100644
--- a/ui/app/services/control-group.js
+++ b/ui/app/services/control-group.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -77,7 +77,7 @@ export default Service.extend({
       return null;
     }
     let pathForUrl = parseURL(url).pathname;
-    pathForUrl = pathForUrl.replace('/v1/', '');
+    pathForUrl = decodeURIComponent(pathForUrl.replace('/v1/', ''));
     const tokenInfo = this.tokenToUnwrap;
     if (tokenInfo && tokenInfo.creation_path === pathForUrl) {
       const { token, accessor, creation_time } = tokenInfo;
@@ -86,7 +86,7 @@ export default Service.extend({
     return null;
   },
 
-  checkForControlGroup(callbackArgs, response, wasWrapTTLRequested) {
+  isRequestedPathLocked(response, wasWrapTTLRequested) {
     const creationPath = response && response?.wrap_info?.creation_path;
     if (
       this.version.isCommunity ||
@@ -95,10 +95,18 @@ export default Service.extend({
       (creationPath && WRAPPED_RESPONSE_PATHS.includes(creationPath)) ||
       !response.wrap_info
     ) {
-      return RSVP.resolve(...callbackArgs);
+      return false;
+    }
+    return true;
+  },
+
+  checkForControlGroup(callbackArgs, response, wasWrapTTLRequested) {
+    const isLocked = this.isRequestedPathLocked(response, wasWrapTTLRequested);
+    if (isLocked) {
+      const error = new ControlGroupError(response.wrap_info);
+      return RSVP.reject(error);
     }
-    const error = new ControlGroupError(response.wrap_info);
-    return RSVP.reject(error);
+    return RSVP.resolve(...callbackArgs);
   },
 
   handleError(error) {
@@ -135,6 +143,10 @@ export default Service.extend({
     return {
       type: 'error-with-html',
       content: lines.join('\n'),
+      href,
+      token,
+      accessor,
+      creation_path,
     };
   },
 });
diff --git a/ui/app/services/csp-event.js b/ui/app/services/csp-event.js
index b53ccb96817..4e863583b15 100644
--- a/ui/app/services/csp-event.js
+++ b/ui/app/services/csp-event.js
@@ -1,36 +1,37 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-/*eslint-disable no-constant-condition*/
-import { computed } from '@ember/object';
-
 import Service from '@ember/service';
+import { tracked } from '@glimmer/tracking';
 import { task, waitForEvent } from 'ember-concurrency';
+import { addToArray } from 'vault/helpers/add-to-array';
 
-export default Service.extend({
-  events: computed(function () {
-    return [];
-  }),
-  connectionViolations: computed('events.@each.violatedDirective', function () {
-    return this.events.some((e) => e.violatedDirective.startsWith('connect-src'));
-  }),
+export default class CspEventService extends Service {
+  @tracked connectionViolations = [];
 
   attach() {
     this.monitor.perform();
-  },
+  }
 
   remove() {
     this.monitor.cancelAll();
-  },
+  }
+
+  handleEvent(event) {
+    if (event.violatedDirective.startsWith('connect-src')) {
+      this.connectionViolations = addToArray(this.connectionViolations, event);
+    }
+  }
 
-  monitor: task(function* () {
-    this.events.clear();
+  @task
+  *monitor() {
+    this.connectionViolations = [];
 
     while (true) {
       const event = yield waitForEvent(window.document, 'securitypolicyviolation');
-      this.events.addObject(event);
+      this.handleEvent(event);
     }
-  }),
-});
+  }
+}
diff --git a/ui/app/services/current-cluster.js b/ui/app/services/current-cluster.js
index e94e2b5b393..42e56fbb88a 100644
--- a/ui/app/services/current-cluster.js
+++ b/ui/app/services/current-cluster.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/services/custom-messages.js b/ui/app/services/custom-messages.js
index ab7ea565ab2..49b4293ec1f 100644
--- a/ui/app/services/custom-messages.js
+++ b/ui/app/services/custom-messages.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,8 +7,10 @@ import { action } from '@ember/object';
 import Service, { inject as service } from '@ember/service';
 import { tracked } from '@glimmer/tracking';
 import { TrackedObject } from 'tracked-built-ins';
+import { decodeString } from 'core/utils/b64';
+
 export default class CustomMessagesService extends Service {
-  @service store;
+  @service api;
   @service namespace;
   @service auth;
   @tracked messages = [];
@@ -17,38 +19,35 @@ export default class CustomMessagesService extends Service {
 
   constructor() {
     super(...arguments);
-    this.fetchMessages(this.namespace.path);
+    this.fetchMessages();
   }
 
   get bannerMessages() {
-    if (!this.messages || !this.messages.length) return [];
-    return this.messages?.filter((message) => message?.type === 'banner');
+    return this.messages?.filter((message) => message?.type === 'banner') || [];
   }
 
   get modalMessages() {
-    if (!this.messages || !this.messages.length) return [];
-    return this.messages?.filter((message) => message?.type === 'modal');
+    return this.messages?.filter((message) => message?.type === 'modal') || [];
   }
 
-  async fetchMessages(ns) {
+  async fetchMessages() {
     try {
-      const url = this.auth.currentToken
-        ? '/v1/sys/internal/ui/authenticated-messages'
-        : '/v1/sys/internal/ui/unauthenticated-messages';
-      const opts = {
-        method: 'GET',
-        headers: {},
-      };
-      if (this.auth.currentToken) opts.headers['X-Vault-Token'] = this.auth.currentToken;
-      if (ns) opts.headers['X-Vault-Namespace'] = ns;
-      const result = await fetch(url, opts);
-      const body = await result.json();
-      if (body.errors) return (this.messages = []);
-      const serializer = this.store.serializerFor('config-ui/message');
-      this.messages = serializer.mapPayload(body);
+      const type = this.auth.currentToken ? 'Authenticated' : 'Unauthenticated';
+      const method = `internalUiRead${type}ActiveCustomMessages`;
+      const { keys = [], key_info } = await this.api.sys[method]();
+
+      this.messages = keys.map((key) => {
+        const data = key_info[key];
+        return {
+          id: key,
+          ...data,
+          message: data.message ? decodeString(data.message) : data.message,
+        };
+      });
+
       this.bannerMessages?.forEach((bm) => (this.bannerState[bm.id] = true));
     } catch (e) {
-      return e;
+      this.clearCustomMessages();
     }
   }
 
diff --git a/ui/app/services/download.ts b/ui/app/services/download.ts
index 537069da279..e062eabf645 100644
--- a/ui/app/services/download.ts
+++ b/ui/app/services/download.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,6 +11,7 @@ interface Extensions {
   hcl: string;
   sentinel: string;
   json: string;
+  jsonl: string;
   pem: string;
   txt: string;
 }
@@ -21,30 +22,33 @@ const EXTENSION_TO_MIME: Extensions = {
   hcl: 'text/plain',
   sentinel: 'text/plain',
   json: 'application/json',
+  jsonl: 'application/json',
   pem: 'application/x-pem-file',
   txt: 'text/plain',
 };
 
 export default class DownloadService extends Service {
-  download(filename: string, content: string, extension: string) {
-    // replace spaces with hyphens, append extension to filename
-    const formattedFilename =
-      `${filename?.replace(/\s+/g, '-')}.${extension}` ||
-      `vault-data-${timestamp.now().toISOString()}.${extension}`;
+  formatFilename(filename: string, extension: keyof Extensions = 'txt') {
+    const downloadTimestamp = timestamp.now().toISOString();
+    // replace spaces with underscores
+    const name = filename ? filename?.replace(/\s+/g, '_') : 'vault_data';
+    // appends extension to filename
+    return `${name}_${downloadTimestamp}.${extension}`;
+  }
+
+  download(filename: string, content: any, extension: keyof Extensions) {
+    const formattedFilename = this.formatFilename(filename, extension);
 
     // map extension to MIME type or use default
-    const mimetype = EXTENSION_TO_MIME[extension as keyof Extensions] || 'text/plain';
+    const mimetype = EXTENSION_TO_MIME[extension] || 'text/plain';
 
     // commence download
-    const { document, URL } = window;
     const downloadElement = document.createElement('a');
     const data = new File([content], formattedFilename, { type: mimetype });
     downloadElement.download = formattedFilename;
     downloadElement.href = URL.createObjectURL(data);
-    document.body.appendChild(downloadElement);
     downloadElement.click();
     URL.revokeObjectURL(downloadElement.href);
-    downloadElement.remove();
     return formattedFilename;
   }
 
@@ -61,7 +65,7 @@ export default class DownloadService extends Service {
     this.download(filename, content, 'pem');
   }
 
-  miscExtension(filename: string, content: string, extension: string) {
+  miscExtension(filename: string, content: string, extension: keyof Extensions) {
     this.download(filename, content, extension);
   }
 }
diff --git a/ui/app/services/feature-flag.js b/ui/app/services/feature-flag.js
deleted file mode 100644
index f999fcb7ef8..00000000000
--- a/ui/app/services/feature-flag.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Service from '@ember/service';
-
-const FLAGS = {
-  vaultCloudNamespace: 'VAULT_CLOUD_ADMIN_NAMESPACE',
-};
-
-export default Service.extend({
-  featureFlags: null,
-  setFeatureFlags(flags) {
-    this.set('featureFlags', flags);
-  },
-
-  get managedNamespaceRoot() {
-    if (this.featureFlags && this.featureFlags.includes(FLAGS.vaultCloudNamespace)) {
-      return 'admin';
-    }
-    return null;
-  },
-});
diff --git a/ui/app/services/flags.ts b/ui/app/services/flags.ts
new file mode 100644
index 00000000000..ccb3ab6d6a9
--- /dev/null
+++ b/ui/app/services/flags.ts
@@ -0,0 +1,81 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Service, { inject as service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { keepLatestTask } from 'ember-concurrency';
+import { DEBUG } from '@glimmer/env';
+
+import type Store from '@ember-data/store';
+import type VersionService from 'vault/services/version';
+
+const FLAGS = {
+  vaultCloudNamespace: 'VAULT_CLOUD_ADMIN_NAMESPACE',
+};
+
+/**
+ * This service returns information about cluster flags. For now, the two available flags are from sys/internal/ui/feature-flags and sys/activation-flags.
+ * The feature-flags endpoint returns VAULT_CLOUD_ADMIN_NAMESPACE which indicates that the Vault cluster is managed rather than self-managed.
+ * The activation-flags endpoint returns which features are enabled.
+ */
+
+export default class FlagsService extends Service {
+  @service declare readonly version: VersionService;
+  @service declare readonly store: Store;
+
+  @tracked activatedFlags: string[] = [];
+  @tracked featureFlags: string[] = [];
+
+  get isHvdManaged(): boolean {
+    return this.featureFlags?.includes(FLAGS.vaultCloudNamespace);
+  }
+
+  // for non-managed clusters the root namespace path is technically an empty string so we return null
+  get hvdManagedNamespaceRoot(): string | null {
+    return this.isHvdManaged ? 'admin' : null;
+  }
+
+  getFeatureFlags = keepLatestTask(async () => {
+    try {
+      const result = await fetch('/v1/sys/internal/ui/feature-flags', {
+        method: 'GET',
+      });
+
+      if (result.status === 200) {
+        const body = await result.json();
+        this.featureFlags = body.feature_flags || [];
+      }
+    } catch (error) {
+      if (DEBUG) console.error(error); // eslint-disable-line no-console
+    }
+  });
+
+  fetchFeatureFlags() {
+    return this.getFeatureFlags.perform();
+  }
+
+  get secretsSyncIsActivated(): boolean {
+    return this.activatedFlags.includes('secrets-sync');
+  }
+
+  getActivatedFlags = keepLatestTask(async () => {
+    // Response could change between user sessions.
+    // Fire off endpoint without checking if activated features are already set.
+    if (this.version.isCommunity) return;
+    try {
+      const response = await this.store
+        .adapterFor('application')
+        .ajax('/v1/sys/activation-flags', 'GET', { unauthenticated: true, namespace: null });
+      this.activatedFlags = response.data?.activated;
+      return;
+    } catch (error) {
+      if (DEBUG) console.error(error); // eslint-disable-line no-console
+    }
+  });
+
+  fetchActivatedFlags() {
+    return this.getActivatedFlags.perform();
+  }
+}
diff --git a/ui/app/services/flash-messages.js b/ui/app/services/flash-messages.js
index a34cf5ea8de..7939d86fcf3 100644
--- a/ui/app/services/flash-messages.js
+++ b/ui/app/services/flash-messages.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/services/namespace.js b/ui/app/services/namespace.js
index b04da16c3f3..a9816edea3d 100644
--- a/ui/app/services/namespace.js
+++ b/ui/app/services/namespace.js
@@ -1,21 +1,22 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Service, { service } from '@ember/service';
 import { task } from 'ember-concurrency';
-import { getRelativePath } from 'core/utils/sanitize-path';
+import { getRelativePath, sanitizePath } from 'core/utils/sanitize-path';
 import { tracked } from '@glimmer/tracking';
 import { buildWaiter } from '@ember/test-waiters';
 
 const waiter = buildWaiter('namespaces');
-const ROOT_NAMESPACE = '';
+export const ROOT_NAMESPACE = '';
 export default class NamespaceService extends Service {
-  @service store;
   @service auth;
+  @service flags;
+  @service store;
 
-  //populated by the query param on the cluster route
+  // populated by the query param on the cluster route
   @tracked path = '';
   // list of namespaces available to the current user under the
   // current namespace
@@ -29,6 +30,13 @@ export default class NamespaceService extends Service {
     return this.path === ROOT_NAMESPACE;
   }
 
+  // the top-level namespace is "admin" for HVD managed clusters accessing the UI
+  // (similar to "root" for self-managed clusters)
+  // this getter checks if the user is specifically at the administrative namespace level
+  get inHvdAdminNamespace() {
+    return this.flags.isHvdManaged && this.path === 'admin';
+  }
+
   get currentNamespace() {
     if (this.inRootNamespace) return 'root';
 
@@ -44,7 +52,10 @@ export default class NamespaceService extends Service {
   }
 
   setNamespace(path) {
-    if (!path) {
+    // If a user explicitly logs in to the 'root' namespace, the path is set to 'root'.
+    // The root namespace doesn't have a set path, so when verifying the selected namespace, it returns null.
+    // Adding a check here, so if the namespace is 'root', it'll be set to an empty string to match the root namespace.
+    if (!path || sanitizePath(path) === 'root') {
       this.path = '';
       return;
     }
diff --git a/ui/app/services/pagination.js b/ui/app/services/pagination.js
new file mode 100644
index 00000000000..0cee100880d
--- /dev/null
+++ b/ui/app/services/pagination.js
@@ -0,0 +1,191 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Service, { service } from '@ember/service';
+import { schedule } from '@ember/runloop';
+import { resolve, Promise } from 'rsvp';
+import { dasherize } from '@ember/string';
+import { assert } from '@ember/debug';
+import { set, get } from '@ember/object';
+import clamp from 'vault/utils/clamp';
+import config from 'vault/config/environment';
+import sortObjects from 'vault/utils/sort-objects';
+
+const { DEFAULT_PAGE_SIZE } = config.APP;
+
+export function keyForCache(query) {
+  /*eslint no-unused-vars: ["error", { "ignoreRestSiblings": true }]*/
+  // we want to ignore size, page, responsePath, and pageFilter in the cacheKey
+  const { size, page, responsePath, pageFilter, ...queryForCache } = query;
+  const cacheKeyObject = Object.keys(queryForCache)
+    .sort()
+    .reduce((result, key) => {
+      result[key] = queryForCache[key];
+      return result;
+    }, {});
+  return JSON.stringify(cacheKeyObject);
+}
+
+export default class Pagination extends Service {
+  @service store;
+
+  lazyCaches = new Map();
+
+  setLazyCacheForModel(modelName, key, value) {
+    const cacheKey = keyForCache(key);
+    const cache = this.lazyCacheForModel(modelName) || new Map();
+    cache.set(cacheKey, value);
+    const modelKey = dasherize(modelName);
+    this.lazyCaches.set(modelKey, cache);
+  }
+
+  getLazyCacheForModel(modelName, key) {
+    const cacheKey = keyForCache(key);
+    const modelCache = this.lazyCacheForModel(modelName);
+    if (modelCache) {
+      return modelCache.get(cacheKey);
+    }
+  }
+
+  lazyCacheForModel(modelName) {
+    return this.lazyCaches.get(dasherize(modelName));
+  }
+
+  // This is the public interface for the store extension - to be used just
+  // like `Store.query`. Special handling of the response is controlled by
+  // `query.pageFilter`, `query.page`, and `query.size`.
+
+  // Required attributes of the `query` argument are:
+  //   responsePath: a string indicating the location on the response where
+  //     the array of items will be found
+  //   page: the page number to return
+  //   size: the size of the page
+  //   pageFilter: a string that will be used to do a fuzzy match against the results,
+  //     OR a function to be executed that will receive the dataset as the lone arg.
+  //     Filter is done pre-pagination.
+  lazyPaginatedQuery(modelType, query, adapterOptions) {
+    const skipCache = query.skipCache;
+    // We don't want skipCache to be part of the actual query key, so remove it
+    delete query.skipCache;
+    const adapter = this.store.adapterFor(modelType);
+    const modelName = dasherize(modelType);
+    const dataCache = skipCache ? this.clearDataset(modelName) : this.getDataset(modelName, query);
+    const responsePath = query.responsePath;
+    assert('responsePath is required', responsePath);
+    assert('page is required', typeof query.page === 'number');
+    if (!query.size) {
+      query.size = DEFAULT_PAGE_SIZE;
+    }
+
+    if (dataCache) {
+      return resolve(this.fetchPage(modelName, query));
+    }
+    return adapter
+      .query(this.store, { modelName }, query, null, adapterOptions)
+      .then((response) => {
+        const serializer = this.store.serializerFor(modelName);
+        const datasetHelper = serializer.extractLazyPaginatedData;
+        const dataset = datasetHelper
+          ? datasetHelper.call(serializer, response)
+          : get(response, responsePath);
+        set(response, responsePath, null);
+        this.storeDataset(modelName, query, response, dataset);
+        return this.fetchPage(modelName, query);
+      })
+      .catch(function (e) {
+        throw e;
+      });
+  }
+
+  filterData(filter, dataset) {
+    let newData = dataset || [];
+    if (filter) {
+      if (filter instanceof Function) {
+        newData = filter(dataset);
+      } else {
+        newData = dataset.filter((item) => {
+          const id = item.id || item.name || item;
+          return id.toLowerCase().includes(filter.toLowerCase());
+        });
+      }
+    }
+    return newData;
+  }
+
+  // reconstructs the original form of the response from the server
+  // with an additional `meta` block
+  //
+  // the meta block includes:
+  // currentPage, lastPage, nextPage, prevPage, total, filteredTotal
+  constructResponse(modelName, query) {
+    const { pageFilter, responsePath, size, page } = query;
+    const { response, dataset } = this.getDataset(modelName, query);
+    const resp = { ...response };
+    const data = this.filterData(pageFilter, dataset);
+
+    const lastPage = Math.ceil(data.length / size);
+    const currentPage = clamp(page, 1, lastPage);
+    const end = currentPage * size;
+    const start = end - size;
+    const slicedDataSet = data.slice(start, end);
+
+    set(resp, responsePath || '', slicedDataSet);
+    resp.meta = {
+      currentPage,
+      lastPage,
+      nextPage: clamp(currentPage + 1, 1, lastPage),
+      prevPage: clamp(currentPage - 1, 1, lastPage),
+      total: dataset.length || 0,
+      filteredTotal: data.length || 0,
+      pageSize: size,
+    };
+
+    return resp;
+  }
+
+  // pushes records into the store and returns the result
+  fetchPage(modelName, query) {
+    const response = this.constructResponse(modelName, query);
+    this.store.unloadAll(modelName);
+    return new Promise((resolve) => {
+      // push subset of records into the store
+      schedule('destroy', () => {
+        this.store.push(
+          this.store
+            .serializerFor(modelName)
+            .normalizeResponse(this.store, this.store.modelFor(modelName), response, null, 'query')
+        );
+        const model = this.store.peekAll(modelName).slice();
+        model.set('meta', response.meta);
+        resolve(model);
+      });
+    });
+  }
+
+  // get cached data
+  getDataset(modelName, query) {
+    return this.getLazyCacheForModel(modelName, query);
+  }
+
+  // store data cache as { response, dataset}
+  // also populated `lazyCaches` attribute
+  storeDataset(modelName, query, response, array) {
+    const dataset = query.sortBy ? sortObjects(array, query.sortBy) : array;
+    const value = {
+      response,
+      dataset,
+    };
+    this.setLazyCacheForModel(modelName, query, value);
+  }
+
+  clearDataset(modelName) {
+    if (!this.lazyCaches.size) return;
+    if (modelName && this.lazyCaches.has(modelName)) {
+      this.lazyCaches.delete(modelName);
+      return;
+    }
+    this.lazyCaches.clear();
+  }
+}
diff --git a/ui/app/services/path-help.js b/ui/app/services/path-help.js
index 49424b3e2dd..dc0be750449 100644
--- a/ui/app/services/path-help.js
+++ b/ui/app/services/path-help.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,73 +8,132 @@
   shape of data at a specific path to hydrate a model with attrs it
   has less (or no) information about.
 */
-import Model from '@ember-data/model';
+import Model, { attr } from '@ember-data/model';
 import Service from '@ember/service';
-import { encodePath } from 'vault/utils/path-encoding-helpers';
-import { getOwner } from '@ember/application';
-import { expandOpenApiProps, combineAttributes } from 'vault/utils/openapi-to-attrs';
-import fieldToAttrs from 'vault/utils/field-to-attrs';
+import { getOwner } from '@ember/owner';
 import { resolve, reject } from 'rsvp';
 import { debug } from '@ember/debug';
 import { capitalize } from '@ember/string';
 import { computed } from '@ember/object'; // eslint-disable-line
-import { withModelValidations } from 'vault/decorators/model-validations';
 
-import generatedItemAdapter from 'vault/adapters/generated-item-list';
-import { sanitizePath } from 'core/utils/sanitize-path';
 import {
   filterPathsByItemType,
   pathToHelpUrlSegment,
   reducePathsByPathName,
+  getHelpUrlForModel,
+  combineOpenApiAttrs,
+  expandOpenApiProps,
 } from 'vault/utils/openapi-helpers';
+import GeneratedItemModel from 'vault/models/generated-item';
+import GeneratedItemListAdapter from 'vault/adapters/generated-item-list';
 
-export default Service.extend({
-  attrs: null,
-  dynamicApiPath: '',
+export default class PathHelpService extends Service {
   ajax(url, options = {}) {
     const appAdapter = getOwner(this).lookup(`adapter:application`);
     const { data } = options;
     return appAdapter.ajax(url, 'GET', {
       data,
     });
-  },
+  }
 
   /**
-   * getNewModel instantiates models which use OpenAPI fully or partially
+   * Registers new ModelClass at specified model type, and busts cache
+   */
+  _registerModel(owner, NewKlass, modelType, isNew = false) {
+    const store = owner.lookup('service:store');
+    // bust cache in ember's registry
+    if (!isNew) {
+      owner.unregister('model:' + modelType);
+    }
+    owner.register('model:' + modelType, NewKlass);
+
+    // bust cache in EmberData's model lookup
+    delete store._modelFactoryCache[modelType];
+  }
+
+  /**
+   * upgradeModelSchema takes an existing ModelClass and hydrates it with the passed attributes
+   * @param {ModelClass} Klass model class retrieved with store.modelFor(modelType)
+   * @param {Attribute[]} attrs array of attributes {name, type, options}
+   * @returns new ModelClass extended from passed one, with the passed attributes added
+   */
+  _upgradeModelSchema(Klass, attrs, newFields) {
+    // extending the class will ensure that static schema lookups regenerate
+    const NewKlass = class extends Klass {};
+
+    for (const { name, type, options } of attrs) {
+      const decorator = attr(type, options);
+      const descriptor = decorator(NewKlass.prototype, name, {});
+      Object.defineProperty(NewKlass.prototype, name, descriptor);
+    }
+
+    // newFields is used in combineFieldGroups within various models
+    if (newFields) {
+      NewKlass.prototype.newFields = newFields;
+    }
+
+    // Ensure this class doesn't get re-hydrated
+    NewKlass.merged = true;
+
+    return NewKlass;
+  }
+
+  /**
+   * hydrateModel instantiates models which use OpenAPI partially
+   * @param {string} modelType path for model, eg pki/role
+   * @param {string} backend path, which will be used for the generated helpUrl
+   * @returns void - as side effect, re-registers model via upgradeModelSchema
+   */
+  async hydrateModel(modelType, backend) {
+    const owner = getOwner(this);
+    const helpUrl = getHelpUrlForModel(modelType, backend);
+    const store = owner.lookup('service:store');
+    const Klass = store.modelFor(modelType);
+
+    if (Klass?.merged || !helpUrl) {
+      // if the model is already merged, we don't need to do anything
+      return resolve();
+    }
+    debug(`Hydrating model ${modelType} at backend ${backend}`);
+
+    // fetch props from openAPI
+    const props = await this.getProps(helpUrl);
+    // combine existing attributes with openAPI data
+    const { attrs, newFields } = combineOpenApiAttrs(Klass.attributes, props);
+    debug(`${modelType} has ${newFields.length} new fields: ${newFields.join(', ')}`);
+
+    // hydrate model
+    const HydratedKlass = this._upgradeModelSchema(Klass, attrs, newFields);
+
+    this._registerModel(owner, HydratedKlass, modelType);
+  }
+
+  /**
+   * getNewModel instantiates models which use OpenAPI to generate the model fully
    * @param {string} modelType
    * @param {string} backend
-   * @param {string} apiPath (optional) if passed, this method will call getPaths and build submodels for item types
+   * @param {string} apiPath this method will call getPaths and build submodels for item types
    * @param {*} itemType (optional) used in getPaths for additional models
-   * @returns void - as side effect, registers model via registerNewModelWithProps
+   * @returns void - as side effect, registers model via registerNewModelWithAttrs
    */
   getNewModel(modelType, backend, apiPath, itemType) {
     const owner = getOwner(this);
     const modelName = `model:${modelType}`;
 
     const modelFactory = owner.factoryFor(modelName);
-    let newModel, helpUrl;
-    // if we have a factory, we need to take the existing model into account
-    if (modelFactory) {
-      debug(`Model factory found for ${modelType}`);
-      newModel = modelFactory.class;
-      const modelProto = newModel.proto();
-      if (newModel.merged || modelProto.useOpenAPI !== true) {
-        return resolve();
-      }
 
-      helpUrl = modelProto.getHelpUrl(backend);
-      return this.registerNewModelWithProps(helpUrl, backend, newModel, modelName);
-    } else {
-      debug(`Creating new Model for ${modelType}`);
-      newModel = Model.extend({});
-    }
+    if (modelFactory) {
+      // if the modelFactory already exists, it means either this model was already
+      // generated or the model exists in the code already. In either case resolve
 
-    // we don't have an apiPath for dynamic secrets
-    // and we don't need paths for them yet
-    if (!apiPath) {
-      helpUrl = newModel.proto().getHelpUrl(backend);
-      return this.registerNewModelWithProps(helpUrl, backend, newModel, modelName);
+      if (!modelFactory.class.merged) {
+        // no merged flag means this model was not previously generated
+        debug(`Model exists for ${modelType} -- use hydrateModel instead`);
+      }
+      return resolve();
     }
+    debug(`Creating new Model for ${modelType}`);
+    let newModel = Model.extend({});
 
     // use paths to dynamically create our openapi help url
     // if we have a brand new model
@@ -97,16 +156,16 @@ export default Service.extend({
           return reject();
         }
 
-        helpUrl = `/v1/${apiPath}${path.slice(1)}?help=true` || newModel.proto().getHelpUrl(backend);
+        const helpUrl = `/v1/${apiPath}${path.slice(1)}?help=true`;
         pathInfo.paths = paths;
         newModel = newModel.extend({ paths: pathInfo });
-        return this.registerNewModelWithProps(helpUrl, backend, newModel, modelName);
+        return this.registerNewModelWithAttrs(helpUrl, modelType);
       })
       .catch((err) => {
         // TODO: we should handle the error better here
         console.error(err); // eslint-disable-line
       });
-  },
+  }
 
   /**
    * getPaths is used to fetch all the openAPI paths available for an auth method,
@@ -135,16 +194,16 @@ export default Service.extend({
         itemID,
       });
     });
-  },
+  }
 
   // Makes a call to grab the OpenAPI document.
   // Returns relevant information from OpenAPI
   // as determined by the expandOpenApiProps util
-  getProps(helpUrl, backend) {
+  getProps(helpUrl) {
     // add name of thing you want
-    debug(`Fetching schema properties for ${backend} from ${helpUrl}`);
+    debug(`Fetching schema properties from ${helpUrl}`);
 
-    return this.ajax(helpUrl, backend).then((help) => {
+    return this.ajax(helpUrl).then((help) => {
       // paths is an array but it will have a single entry
       // for the scope we're in
       const path = Object.keys(help.openapi.paths)[0]; // do this or look at name
@@ -180,17 +239,16 @@ export default Service.extend({
       } else if (schema.properties) {
         props = schema.properties;
       }
-      // put url params (e.g. {name}, {role})
-      // at the front of the props list
+      // put url params (e.g. {name}, {role}) at the front of the props list
       const newProps = { ...paramProp, ...props };
       return expandOpenApiProps(newProps);
     });
-  },
+  }
 
   getNewAdapter(pathInfo, itemType) {
     // we need list and create paths to set the correct urls for actions
     const paths = filterPathsByItemType(pathInfo, itemType);
-    let { apiPath } = pathInfo;
+    const { apiPath } = pathInfo;
     const getPath = paths.find((path) => path.operations.includes('get'));
 
     // the action might be "Generate" or something like that so we'll grab the first post endpoint if there
@@ -199,136 +257,28 @@ export default Service.extend({
     const createPath = paths.find((path) => path.action === 'Create' || path.operations.includes('post'));
     const deletePath = paths.find((path) => path.operations.includes('delete'));
 
-    return generatedItemAdapter.extend({
-      urlForItem(id, isList, dynamicApiPath) {
-        const itemType = sanitizePath(getPath.path);
-        let url;
-        id = encodePath(id);
-        // the apiPath changes when you switch between routes but the apiPath variable does not unless the model is reloaded
-        // overwrite apiPath if dynamicApiPath exist.
-        // dynamicApiPath comes from the model->adapter
-        if (dynamicApiPath) {
-          apiPath = dynamicApiPath;
-        }
-        // isList indicates whether we are viewing the list page
-        // of a top-level item such as userpass
-        if (isList) {
-          url = `${this.buildURL()}/${apiPath}${itemType}/`;
-        } else {
-          // build the URL for the show page of a nested item
-          // such as a userpass group
-          url = `${this.buildURL()}/${apiPath}${itemType}/${id}`;
-        }
+    return class NewAdapter extends GeneratedItemListAdapter {
+      apiPath = apiPath;
 
-        return url;
-      },
-
-      urlForQueryRecord(id, modelName) {
-        return this.urlForItem(id, modelName);
-      },
-
-      urlForUpdateRecord(id) {
-        const itemType = createPath.path.slice(1, createPath.path.indexOf('{') - 1);
-        return `${this.buildURL()}/${apiPath}${itemType}/${id}`;
-      },
-
-      urlForCreateRecord(modelType, snapshot) {
-        const id = snapshot.record.mutableId; // computed property that returns either id or private settable _id value
-        const path = createPath.path.slice(1, createPath.path.indexOf('{') - 1);
-        return `${this.buildURL()}/${apiPath}${path}/${id}`;
-      },
-
-      urlForDeleteRecord(id) {
-        const path = deletePath.path.slice(1, deletePath.path.indexOf('{') - 1);
-        return `${this.buildURL()}/${apiPath}${path}/${id}`;
-      },
-
-      createRecord(store, type, snapshot) {
-        return this._super(...arguments).then((response) => {
-          // if the server does not return an id and one has not been set on the model we need to set it manually from the mutableId value
-          if (!response?.id && !snapshot.record.id) {
-            snapshot.record.id = snapshot.record.mutableId;
-            snapshot.id = snapshot.record.id;
-          }
-          return response;
-        });
-      },
-    });
-  },
-
-  registerNewModelWithProps(helpUrl, backend, newModel, modelName) {
-    return this.getProps(helpUrl, backend).then((props) => {
-      const { attrs, newFields } = combineAttributes(newModel.attributes, props);
-      const owner = getOwner(this);
-      newModel = newModel.extend(attrs, { newFields });
-      // if our newModel doesn't have fieldGroups already
-      // we need to create them
-      try {
-        // Initialize prototype to access field groups
-        let fieldGroups = newModel.proto().fieldGroups;
-        if (!fieldGroups) {
-          debug(`Constructing fieldGroups for ${backend}`);
-          fieldGroups = this.getFieldGroups(newModel);
-          newModel = newModel.extend({ fieldGroups });
-          // Build and add validations on model
-          // NOTE: For initial phase, initialize validations only for user pass auth
-          if (backend === 'userpass') {
-            const validations = fieldGroups.reduce((obj, element) => {
-              if (element.default) {
-                element.default.forEach((v) => {
-                  const key = v.options.fieldValue || v.name;
-                  obj[key] = [{ type: 'presence', message: `${v.name} can't be blank` }];
-                });
-              }
-              return obj;
-            }, {});
-            @withModelValidations(validations)
-            class GeneratedItemModel extends newModel {}
-            newModel = GeneratedItemModel;
-          }
-        }
-      } catch (err) {
-        // eat the error, fieldGroups is computed in the model definition
-      }
-      // attempting to set the id prop on a model will trigger an error
-      // this computed will be used in place of the the id fieldValue -- see openapi-to-attrs
-      newModel.reopen({
-        mutableId: computed('id', '_id', {
-          get() {
-            return this._id || this.id;
-          },
-          set(key, value) {
-            return (this._id = value);
-          },
-        }),
-      });
-      newModel.reopenClass({ merged: true });
-      owner.unregister(modelName);
-      owner.register(modelName, newModel);
-    });
-  },
-  getFieldGroups(newModel) {
-    const groups = {
-      default: [],
+      paths = {
+        createPath: createPath?.path,
+        deletePath: deletePath?.path,
+        getPath: getPath?.path,
+      };
     };
-    const fieldGroups = [];
-    newModel.attributes.forEach((attr) => {
-      // if the attr comes in with a fieldGroup from OpenAPI,
-      // add it to that group
-      if (attr.options.fieldGroup) {
-        if (groups[attr.options.fieldGroup]) {
-          groups[attr.options.fieldGroup].push(attr.name);
-        } else {
-          groups[attr.options.fieldGroup] = [attr.name];
-        }
-      } else {
-        // otherwise just add that attr to the default group
-        groups.default.push(attr.name);
-      }
-    });
-    for (const group in groups) {
-      fieldGroups.push({ [group]: groups[group] });
-    }
-    return fieldToAttrs(newModel, fieldGroups);
-  },
-});
+  }
+
+  /**
+   * registerNewModelWithAttrs takes the helpUrl of the given model type,
+   * fetches props, and registers the model hydrated with the provided attrs
+   * @param {string} helpUrl like /v1/auth/userpass2/users/example?help=true
+   * @param {string} modelType like generated-user-userpass
+   */
+  async registerNewModelWithAttrs(helpUrl, modelType) {
+    const owner = getOwner(this);
+    const props = await this.getProps(helpUrl);
+    const { attrs, newFields } = combineOpenApiAttrs(new Map(), props);
+    const NewKlass = this._upgradeModelSchema(GeneratedItemModel, attrs, newFields);
+    this._registerModel(owner, NewKlass, modelType, true);
+  }
+}
diff --git a/ui/app/services/permissions.js b/ui/app/services/permissions.js
index c5e8064025d..703a3cdadde 100644
--- a/ui/app/services/permissions.js
+++ b/ui/app/services/permissions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,10 +8,66 @@ import { tracked } from '@glimmer/tracking';
 import { sanitizePath, sanitizeStart } from 'core/utils/sanitize-path';
 import { task } from 'ember-concurrency';
 
+/**
+ * PermissionsService
+ * ---------------------------------------------------------------------------
+ * What it does
+ * - Gates sidebar visibility and the “Resultant ACL” banner.
+ * - Consumes one resultant-acl payload: { exact_paths, glob_paths, root, chroot_namespace }.
+ * - Evaluates permissions against the fully-qualified path:
+ *   <chroot>/<currentNamespace>/<apiPath> (omitting empty parts).
+ *
+ * Policy semantics (brief)
+ * - '+' = exactly one segment; '*' = wildcard; '/' = include base; '/*' = children-only.
+ * - Globpaths return policy paths with * if the path includes a wildcard. Meaning,
+ *  sys/admin/* returns as sys/admin/, but +/sys/admin/* returns as +/sys/admin/*
+ *  the implication is that a plus sign make the * a non-greedy match (e.g. children only), but without a plus
+ *  a policy path is greedy (e.g. base + children)
+ * - Most-specific (longest) match wins; any explicit 'deny' beats allow.
+ *   Docs: https://developer.hashicorp.com/vault/docs/concepts/policies#priority-matching
+ *
+ * Sidebar flow
+ * - Templates → has-permissions → hasNavPermission() → hasPermission() on resolved API paths.
+ *
+ * Banner flow
+ * - permissionsBanner getter computes effective namespace and returns:
+ *   • null if root, read-failed if ACL fetch failed, or if any canary path is allowed here
+ *   • no-ns-access otherwise
+ * - “Canary paths” are a small set of UI-centric endpoints we probe in the current namespace.
+ * - They build off API_PATHS, which also drives sidebar nav items.
+ * - If you ever wanted to add to a canary probe list, either expand API_PATHS
+ * or add to CANARY_PATHS directly.
+ *
+ * Chroot note
+ * - When chroot_namespace is present, backend keys are already prefixed.
+ *   We mirror this by composing fullCurrentNamespace for all checks.
+ *
+ * Example resultant-acl payload:
+ * {
+ *   "exact_paths": {
+ *     "sys/policies/acl": { "capabilities": ["read", "list"] },
+ *     "sys/policies/acl/my-policy": { "capabilities": ["read"] },
+ *     "sys/auth": { "capabilities": ["deny"] }
+ *   },
+ *   "glob_paths": {
+ *     "secret/data/finance/+/payroll": { "capabilities": ["create", "update", "read", "list"] },
+ *     "secret/data/engineering/*": { "capabilities": ["read", "list"] },
+ *     "secret/data/hr/": { "capabilities": ["read", "list"] },
+ *     "+/auth/*": { "capabilities": ["deny"] },
+ *     "": { "capabilities": ["read", "list"] } // baseline allow-all
+ *   },
+ *   "root": false,
+ *   "chroot_namespace": "ns1/child"
+ * }
+ */
+
 export const PERMISSIONS_BANNER_STATES = {
   readFailed: 'read-failed',
   noAccess: 'no-ns-access',
 };
+
+export const RESULTANT_ACL_PATH = 'sys/internal/ui/resultant-acl'; // export for tests
+
 const API_PATHS = {
   access: {
     methods: 'sys/auth',
@@ -49,6 +105,15 @@ const API_PATHS = {
   settings: {
     customMessages: 'sys/config/ui/custom-messages',
   },
+  sync: {
+    destinations: 'sys/sync/destinations',
+    associations: 'sys/sync/associations',
+    config: 'sys/sync/config',
+    github: 'sys/sync/github-apps',
+  },
+  monitoring: {
+    'utilization-report': 'sys/utilization-report',
+  },
 };
 
 const API_PATHS_TO_ROUTE_PARAMS = {
@@ -62,172 +127,357 @@ const API_PATHS_TO_ROUTE_PARAMS = {
   'identity/oidc/client': { route: 'vault.cluster.access.oidc', models: [] },
 };
 
-/*
-  The Permissions service is used to gate top navigation and sidebar items.
-  It fetches a users' policy from the resultant-acl endpoint and stores their
-  allowed exact and glob paths as state. It also has methods for checking whether
-  a user has permission for a given path.
-  The data from the resultant-acl endpoint has the following shape:
-  {
-    exact_paths: {
-      [key: string]: {
-        capabilities: string[];
-      };
-    };
-    glob_paths: {
-      [key: string]: {
-        capabilities: string[];
-      };
-    };
-    root: boolean;
-    chroot_namespace?: string;
-  };
-*/
+// Canary endpoints: quick check for “meaningful UI access” in the *current* namespace.
+// If the token has any non-deny capability on any canary here, we suppress the banner.
+// This does not try to cover all possible paths (e.g. secrets engines only such as `+/kv/data/*`),
+// by design—probing everything is infeasible. Keep the list small and UI-centric.
+//
+// IMPORTANT NOTE: A user scoped only to say a secrets engine path
+// (e.g. `+/kv/data/*`) would still trigger the banner, since iterating over all
+// possible paths is not feasible.
+//
+// This may be the situation for Namespace-tenancy setups where users are
+// confined to secrets engines in a child namespace and given no management of
+// endpoints there.
+const CANARY_PATHS = [
+  ...Object.values(API_PATHS.access),
+  ...Object.values(API_PATHS.policies),
+  ...Object.values(API_PATHS.tools),
+  ...Object.values(API_PATHS.status),
+  ...Object.values(API_PATHS.clients),
+  ...Object.values(API_PATHS.settings),
+  ...Object.values(API_PATHS.sync),
+  ...Object.values(API_PATHS.monitoring),
+];
 
 export default class PermissionsService extends Service {
   @tracked exactPaths = null;
   @tracked globPaths = null;
-  @tracked canViewAll = null;
-  @tracked permissionsBanner = null;
+  @tracked hasFallbackAccess = false;
+  @tracked isRoot = false;
+  @tracked _aclLoadFailed = false;
   @tracked chrootNamespace = null;
+
   @service store;
-  @service auth;
   @service namespace;
 
-  get baseNs() {
+  // isAclLoaded:
+  // - True if we know the caller is actual root (resp.data.root === true),
+  //   or if we’ve received any exact/glob paths from the resultant-acl payload.
+  // - Starts false until the first ACL fetch.
+  // - On fetch failure, we deliberately keep isRoot=false (since the backend
+  //   didn’t confirm) and set hasFallbackAccess=true instead. This way the
+  //   sidebar remains usable but the banner shows "read-failed".
+  get isAclLoaded() {
+    return this.isRoot || this.exactPaths !== null || this.globPaths !== null;
+  }
+
+  get fullCurrentNamespace() {
     const currentNs = this.namespace.path;
     return this.chrootNamespace
       ? `${sanitizePath(this.chrootNamespace)}/${sanitizePath(currentNs)}`
       : sanitizePath(currentNs);
   }
 
-  @task *getPaths() {
-    if (this.paths) {
-      return;
+  // Banner logic: only show when we *know* the user has no meaningful UI access
+  // in the current namespace. Precedence:
+  // 1) Root token → never show a banner.
+  // 2) ACL fetch failed (_aclLoadFailed) → show "read-failed" (sidebar may still
+  //    render via hasFallbackAccess; the banner explains missing ACL data).
+  // 3) ACLs not loaded yet (!isAclLoaded) → suppress banner (avoid flicker while loading).
+  // 4) Explicit UI check: if the caller can READ "sys/internal/ui/resultant-acl" in the
+  //    effective namespace, treat that as minimal UI access → suppress banner.
+  //    History: This was the original intent (CE PR #23503). We temporarily removed reliance
+  //    on this signal (CE PR #25256) because our old banner logic used string prefix checks
+  //    and the resultant-acl payload did not preserve namespace-segment wildcards (`+`), so
+  //    policies like `+/sys/...` or `+/+/sys/...` in child namespaces could be missed.
+  //    Today the backend returns `+` in `glob_paths` and this service matches against the
+  //    fully-qualified path using proper glob semantics, so this explicit check is reliable again.
+  // 5) Heuristic canaries: if any curated UI-centric path is non-deny, suppress the banner.
+  // 6) Otherwise → "no-ns-access".
+  get permissionsBanner() {
+    // 1) Real root never sees a banner
+    if (this.isRoot) return null;
+
+    // 2) Fetch failed → explain
+    if (this._aclLoadFailed) return PERMISSIONS_BANNER_STATES.readFailed;
+
+    // 3) Still loading → stay quiet
+    if (!this.isAclLoaded) return null;
+
+    // 4) Explicit resultant-acl read → minimal UI access confirmed
+    if (this.hasPermission(RESULTANT_ACL_PATH, ['read'])) {
+      return null;
     }
 
+    // 5) Heuristic: any canary with any non-deny capability
+    const anyAllowed = CANARY_PATHS.some((p) => this.hasPermission(p));
+
+    // 6) Final decision
+    return anyAllowed ? null : PERMISSIONS_BANNER_STATES.noAccess;
+  }
+
+  // Load resultant-ACL used by sidebar + banner.
+  // Success:
+  //   • Clear _aclLoadFailed, then hydrate via setPaths(resp).
+  // Failure (network/403/etc):
+  //   • Mark _aclLoadFailed so the banner explains missing ACL data.
+  //   • Enable hasFallbackAccess so the sidebar remains usable (legacy behavior).
+  //   • Clear exact/glob to avoid using stale ACL from a prior success.
+  @task *getPaths() {
     try {
       const resp = yield this.store.adapterFor('permissions').query();
+      this._aclLoadFailed = false;
       this.setPaths(resp);
-      return;
     } catch (err) {
-      // If no policy can be found, default to showing all nav items.
-      this.canViewAll = true;
-      this.permissionsBanner = PERMISSIONS_BANNER_STATES.readFailed;
-    }
-  }
+      this._aclLoadFailed = true;
+      this.isRoot = false;
+      this.hasFallbackAccess = true; // fallback so nav stays visible
 
-  calcNsAccess() {
-    if (this.canViewAll) {
-      this.permissionsBanner = null;
-      return;
+      // Avoid stale ACL from a previous successful load
+      this.exactPaths = null;
+      this.globPaths = null;
     }
-    const namespace = this.baseNs;
-    const allowed =
-      Object.keys(this.globPaths).any((k) => k.startsWith(namespace)) ||
-      Object.keys(this.exactPaths).any((k) => k.startsWith(namespace));
-    this.permissionsBanner = allowed ? null : PERMISSIONS_BANNER_STATES.noAccess;
   }
 
+  // Populate tracked state from a successful resultant-ACL response.
+  //   • exact_paths / glob_paths → used for all permission checks
+  //   • root (boolean) → authoritative “real root” from backend
+  //   • hasFallbackAccess → always false on success (only true if ACL fetch fails)
+  //   • chroot_namespace → prefix applied to all checks
   setPaths(resp) {
     this.exactPaths = resp.data.exact_paths;
     this.globPaths = resp.data.glob_paths;
-    this.canViewAll = resp.data.root;
+    this.isRoot = resp.data.root; // true root per backend
+    this.hasFallbackAccess = false; // nav gating shortcut (true root behaves like “show all”). Only set true if ACL fail.
     this.chrootNamespace = resp.data.chroot_namespace;
-    this.calcNsAccess();
   }
 
   reset() {
     this.exactPaths = null;
     this.globPaths = null;
-    this.canViewAll = null;
+    this.hasFallbackAccess = false;
     this.chrootNamespace = null;
-    this.permissionsBanner = null;
+    this._aclLoadFailed = false;
+  }
+
+  // ===== Matching helpers (STRICT) ==========================================
+
+  // _globKeyToRegex
+  // Converts a Vault glob-style policy key into a regex:
+  //   • Trailing "/"   → include base + any children
+  //   • Trailing "/*"  → children-only (≥1 child; base does NOT match)
+  //   • "+"            → exactly one segment
+  //   • "*"            → greedy segment matcher
+  //   • "" (empty key) → baseline allow-all, equivalent to `path "*" { … }`
+  //
+  // PERF NOTE: Consider caching compiled regexes if ACLs are large or called frequently.
+  _globKeyToRegex(globKey) {
+    // Empty key → allow-all
+    if (globKey === '') {
+      return /^.*$/;
+    }
+
+    const endsWithChildrenOnly = /\/\*$/.test(globKey); // "/*" → children-only
+    const endsWithIncludeBase = !endsWithChildrenOnly && /\/$/.test(globKey); // "/" → include base
+    const trimmed = globKey
+      .replace(/\/\*$/, '') // strip "/*"
+      .replace(/\/$/, ''); // strip trailing "/"
+
+    const parts = trimmed.split('/').map((seg) => {
+      if (seg === '+') return '[^/]+'; // exactly one segment
+      if (seg === '*') return '.*'; // greedy tail matcher
+      return seg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // escape literal
+    });
+
+    if (endsWithChildrenOnly) {
+      // require ≥1 child segment
+      return new RegExp('^' + parts.join('/') + '/.+' + '$');
+    }
+
+    if (endsWithIncludeBase) {
+      // match base OR any children
+      return new RegExp('^' + parts.join('/') + '(?:/.*)?' + '$');
+    }
+
+    // exact match only
+    return new RegExp('^' + parts.join('/') + '$');
   }
 
+  // _matchExact
+  // Example: needle = "sys/auth"
+  //   • "sys/auth"        → matches directly
+  //   • "sys/auth/methods" → chosen over "sys/auth" (more specific child)
+  //
+  // Resolves an "exact_paths" match with Vault policy semantics:
+  //   • Normalize trailing "/" for both needle and keys
+  //   • Exact equality takes precedence
+  //   • Otherwise, choose the longest child key (most specific) under the base
+  _matchExact(fullPath) {
+    const exact = this.exactPaths;
+    if (!exact) return null;
+
+    const needle = fullPath.replace(/\/$/, '');
+
+    // Build [orig, norm] pairs so we can match on norm but return orig
+    const tuples = Object.keys(exact).map((k) => [k, k.replace(/\/$/, '')]);
+
+    // Exact equality wins outright
+    const eq = tuples.find(([, norm]) => norm === needle);
+    if (eq) {
+      const [orig] = eq;
+      return { key: orig, entry: exact[orig] };
+    }
+
+    // Otherwise, pick the longest child (most specific) under the base
+    const child = tuples
+      .filter(([, norm]) => norm.startsWith(needle + '/'))
+      .sort((a, b) => b[1].length - a[1].length)[0];
+
+    return child ? { key: child[0], entry: exact[child[0]] } : null;
+  }
+
+  // _matchGlob
+  // Example: fullPath = "sys/auth/methods"
+  //   • glob "*"                → matches (baseline allow-all)
+  //   • glob "+/sys/*"            → matches, less specific
+  //   • glob "+/sys/auth/*"       → matches, more specific → chosen
+  //   • glob "sys/auth/methods" → exact equality handled in _matchExact
+  //
+  // Glob match precedence:
+  //   • Empty key "" is a special baseline = allow all (overridable by denies)
+  //   • Among regex matches, the longest key (most specific) wins
+  //   • Final allow/deny resolution is deferred to _decide()
+  _matchGlob(fullPath) {
+    const globPaths = this.globPaths;
+    if (!globPaths) return null;
+
+    let matchKey = null;
+
+    // Treat empty-root ('') as baseline "allow all" if present
+    if (Object.prototype.hasOwnProperty.call(globPaths, '')) {
+      matchKey = '';
+    }
+
+    for (const k of Object.keys(globPaths)) {
+      if (k === '') continue; // already accounted for
+      const re = this._globKeyToRegex(k);
+      if (re.test(fullPath)) {
+        if (matchKey === null || k.length > matchKey.length) {
+          matchKey = k; // longest wins
+        }
+      }
+    }
+
+    return matchKey !== null ? { key: matchKey, entry: globPaths[matchKey] } : null;
+  }
+
+  // _decide
+  // Resolution rule across matchers:
+  // - If any matched entry is 'deny' → false (authoritative).
+  // - Otherwise, ALL requested capabilities must be satisfied by at least one matched non-deny entry.
+  //   • The 'capabilities' arg comes from the caller (via hasPermission):
+  //     - ["list"] for identity pages
+  //     - ["read", "update"] if a UI flow requires those
+  //     - [null] means "any non-deny capability is enough" (common for sidebar/nav checks).
+  _decide(fullPath, capabilities = [null]) {
+    // Collect matches from BOTH exact and glob, then apply precedence:
+    // 1. If ANY matching entry is an explicit deny → false.
+    // 2. If no deny, allow if every requested capability is satisfied by ≥1 non-deny match.
+    // 3. Otherwise → false.
+    const exactMatch = this._matchExact(fullPath);
+    const globMatch = this._matchGlob(fullPath);
+
+    // If any deny match exists (exact or glob), short-circuit to false
+    if ((exactMatch && this.isDenied(exactMatch.entry)) || (globMatch && this.isDenied(globMatch.entry))) {
+      return false;
+    }
+
+    // Now check capability satisfaction across the best exact/glob
+    const candidates = [exactMatch?.entry, globMatch?.entry].filter(Boolean);
+
+    return capabilities.every((cap) => {
+      // Null means “any non-deny capability”
+      if (cap === null) return candidates.some((e) => !this.isDenied(e));
+      return candidates.some((e) => !this.isDenied(e) && this.hasCapability(e, cap));
+    });
+  }
+
+  // ===== Public checks =======================================================
+
+  // Entry point used by the has-permissions helper (and tests).
+  // If `routeParams` is an array and `requireAll` is true, *all* params must
+  // be permitted; otherwise any one is enough.
+  // For identity entities/groups pages we require 'list'; other pages only need
+  // “not denied”, so we pass `[null]` to mean “any non-deny capability suffices”.
+  // Determine if a nav item should be shown.
+  // - Resolves one or more API paths from API_PATHS[navItem] (optionally using routeParams).
+  // - If routeParams is an array:
+  //    • requireAll=true  → every param must be permitted (Array.every)
+  //    • requireAll=false → at least one must be permitted (Array.some)
+  // - Capability policy:
+  //    • 'entities' / 'groups' require ["list"]
+  //    • everything else uses [null] → “any non-deny capability is enough”
+  // - Delegates to hasPermission(path, capabilities) per resolved path.
   hasNavPermission(navItem, routeParams, requireAll) {
     if (routeParams) {
-      // check that the user has permission to access all (requireAll = true) or any of the routes when array is passed
-      // useful for hiding nav headings when user does not have access to any of the links
       const params = Array.isArray(routeParams) ? routeParams : [routeParams];
       const evalMethod = !Array.isArray(routeParams) || requireAll ? 'every' : 'some';
       return params[evalMethod]((param) => {
-        // viewing the entity and groups pages require the list capability, while the others require the default, which is anything other than deny
         const capability = param === 'entities' || param === 'groups' ? ['list'] : [null];
         return this.hasPermission(API_PATHS[navItem][param], capability);
       });
     }
+    // No params → show if any canonical path for the nav item is permitted.
     return Object.values(API_PATHS[navItem]).some((path) => this.hasPermission(path));
   }
 
+  // Compute route params (models) for the *first* accessible path of a nav item.
+  // - Uses hasPermission(...) to pick the first allowed path in API_PATHS[navItem].
+  // - For 'policies' and 'tools', the model is the last path segment (e.g., 'acl', 'hash').
+  // - Otherwise, returns the pre-mapped route + models from API_PATHS_TO_ROUTE_PARAMS.
   navPathParams(navItem) {
     const path = Object.values(API_PATHS[navItem]).find((path) => this.hasPermission(path));
     if (['policies', 'tools'].includes(navItem)) {
-      return { models: [path.split('/').lastObject] };
+      const last = path.split('/').pop();
+      return { models: [last] };
     }
-
     return API_PATHS_TO_ROUTE_PARAMS[path];
   }
 
+  // Build a fully-qualified API path scoped to the effective namespace.
+  // - Prefixes <chroot>/<currentNamespace> when present.
+  // - sanitizePath/sanitizeStart prevent accidental double slashes and leading '/' issues.
+  // Examples:
+  //   ns="team", chroot=null, path="sys/auth"   → "team/sys/auth"
+  //   ns="team/child", chroot="admin", path="/sys/auth/" → "admin/team/child/sys/auth/"
   pathNameWithNamespace(pathName) {
-    const namespace = this.baseNs;
-    if (namespace) {
-      return `${sanitizePath(namespace)}/${sanitizeStart(pathName)}`;
-    } else {
-      return pathName;
-    }
+    const ns = this.fullCurrentNamespace;
+    return ns ? `${sanitizePath(ns)}/${sanitizeStart(pathName)}` : pathName;
   }
 
+  // Core permission check used by both sidebar gating and banner canary probes.
+  // - Root short-circuit: real root (isRoot) → true.
+  // - Otherwise, compose the fully-qualified path and delegate to _decide(full, capabilities).
+  // - 'capabilities' is the caller’s requirement:
+  //     • [null]  → “any non-deny capability is enough” (most nav checks)
+  //     • ['list'] for identity entities/groups
+  //     • or a concrete set like ['read','update'] for specific flows
   hasPermission(pathName, capabilities = [null]) {
-    if (this.canViewAll) {
-      return true;
-    }
-    const path = this.pathNameWithNamespace(pathName);
-
-    return capabilities.every(
-      (capability) =>
-        this.hasMatchingExactPath(path, capability) || this.hasMatchingGlobPath(path, capability)
-    );
-  }
-
-  hasMatchingExactPath(pathName, capability) {
-    const exactPaths = this.exactPaths;
-    if (exactPaths) {
-      const prefix = Object.keys(exactPaths).find((path) => path.startsWith(pathName));
-      const hasMatchingPath = prefix && !this.isDenied(exactPaths[prefix]);
-
-      if (prefix && capability) {
-        return this.hasCapability(exactPaths[prefix], capability) && hasMatchingPath;
-      }
-
-      return hasMatchingPath;
-    }
-    return false;
+    if (this.isRoot) return true;
+    const full = this.pathNameWithNamespace(pathName);
+    return this._decide(full, capabilities);
   }
 
-  hasMatchingGlobPath(pathName, capability) {
-    const globPaths = this.globPaths;
-    if (globPaths) {
-      const matchingPath = Object.keys(globPaths).find((k) => {
-        return pathName.includes(k) || pathName.includes(k.replace(/\/$/, ''));
-      });
-      const hasMatchingPath =
-        (matchingPath && !this.isDenied(globPaths[matchingPath])) ||
-        Object.prototype.hasOwnProperty.call(globPaths, '');
-
-      if (matchingPath && capability) {
-        return this.hasCapability(globPaths[matchingPath], capability) && hasMatchingPath;
-      }
-
-      return hasMatchingPath;
-    }
-    return false;
-  }
+  // ===== capability helpers ==================================================
 
+  // If a specific capability is requested, ensure it’s present.
+  // For the “any non-deny” case we pass `[null]` and gate on `isDenied(...)` only.
   hasCapability(path, capability) {
     return path.capabilities.includes(capability);
   }
 
+  // A deny anywhere is authoritative.
   isDenied(path) {
     return path.capabilities.includes('deny');
   }
diff --git a/ui/app/services/plugin-catalog.ts b/ui/app/services/plugin-catalog.ts
new file mode 100644
index 00000000000..e0ad676d8f9
--- /dev/null
+++ b/ui/app/services/plugin-catalog.ts
@@ -0,0 +1,191 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Service from '@ember/service';
+import { service } from '@ember/service';
+import { sanitizePath } from 'core/utils/sanitize-path';
+
+import type ApiService from 'vault/services/api';
+import type AuthService from 'vault/services/auth';
+import type NamespaceService from 'vault/services/namespace';
+
+export interface PluginCatalogPlugin {
+  name: string;
+  type: string;
+  builtin: boolean;
+  version: string;
+  deprecation_status?: string;
+  oci_image?: string;
+  runtime?: string;
+}
+
+export interface PluginCatalogData {
+  detailed: Array<PluginCatalogPlugin>;
+}
+
+export interface EnhancedPluginCatalogData extends PluginCatalogData {
+  secret: Array<string>;
+  auth: Array<string>;
+  database: Array<string>;
+}
+
+export interface PluginCatalogResponse {
+  data: EnhancedPluginCatalogData | null;
+  error: boolean;
+}
+
+export interface PluginCatalogRawDataResponse {
+  data: {
+    secret: Array<PluginCatalogPlugin>;
+    auth: Array<PluginCatalogPlugin>;
+    database: Array<PluginCatalogPlugin>;
+    detailed: Array<PluginCatalogPlugin>;
+  } | null;
+  error: boolean;
+}
+
+export default class PluginCatalogService extends Service {
+  @service declare readonly api: ApiService;
+  @service declare readonly auth: AuthService;
+  @service declare readonly namespace: NamespaceService;
+
+  /**
+   * Fetches the plugin catalog from the Vault API
+   * Uses the API service middleware for authentication, namespacing, and error handling
+   * @returns Promise resolving to plugin catalog data and error state
+   */
+  async fetchPluginCatalog(): Promise<PluginCatalogResponse> {
+    try {
+      const response = await this.api.sys.pluginsCatalogListPlugins({
+        headers: {
+          token: this.auth.currentToken,
+          namespace: sanitizePath(this.namespace.path),
+        },
+      });
+
+      if (response && response.detailed && Array.isArray(response.detailed) && response.detailed.length > 0) {
+        const detailedPlugins = response.detailed as PluginCatalogPlugin[];
+
+        const secretPlugins = detailedPlugins
+          .filter((plugin) => plugin.type === 'secret')
+          .map((plugin) => plugin.name);
+
+        const authPlugins = detailedPlugins
+          .filter((plugin) => plugin.type === 'auth')
+          .map((plugin) => plugin.name);
+
+        const databasePlugins = detailedPlugins
+          .filter((plugin) => plugin.type === 'database')
+          .map((plugin) => plugin.name);
+
+        return {
+          data: {
+            secret: secretPlugins,
+            auth: authPlugins,
+            database: databasePlugins,
+            detailed: detailedPlugins,
+          },
+          error: false,
+        };
+      }
+
+      return {
+        data: null,
+        error: true,
+      };
+    } catch (error) {
+      return {
+        data: null,
+        error: true,
+      };
+    }
+  }
+
+  /**
+   * Fetches the plugin catalog from the Vault API and groups the data by plugin type
+   * Uses the API service middleware for authentication, namespacing, and error handling
+   * @returns Promise resolving to plugin catalog data and error state
+   */
+  async getRawPluginCatalogData(): Promise<PluginCatalogRawDataResponse> {
+    try {
+      const response = await this.api.sys.pluginsCatalogListPlugins({
+        headers: {
+          token: this.auth.currentToken,
+          namespace: sanitizePath(this.namespace.path),
+        },
+      });
+
+      if (response && response.detailed && Array.isArray(response.detailed) && response.detailed.length > 0) {
+        const detailedPlugins = response.detailed as PluginCatalogPlugin[];
+
+        const secretPlugins = detailedPlugins.filter((plugin) => plugin.type === 'secret');
+
+        const authPlugins = detailedPlugins.filter((plugin) => plugin.type === 'auth');
+
+        const databasePlugins = detailedPlugins.filter((plugin) => plugin.type === 'database');
+
+        return {
+          data: {
+            secret: secretPlugins,
+            auth: authPlugins,
+            database: databasePlugins,
+            detailed: detailedPlugins,
+          },
+          error: false,
+        };
+      }
+
+      return {
+        data: null,
+        error: true,
+      };
+    } catch (error) {
+      return {
+        data: null,
+        error: true,
+      };
+    }
+  }
+
+  /**
+   * Gets plugins of a specific type from the catalog
+   * @param type - The plugin type ('secret', 'auth', 'database')
+   * @returns Promise resolving to array of plugin names for the specified type
+   */
+  async getPluginsByType(type: keyof Omit<EnhancedPluginCatalogData, 'detailed'>): Promise<Array<string>> {
+    const response = await this.fetchPluginCatalog();
+    return response.data?.[type] || [];
+  }
+
+  /**
+   * Gets detailed plugin information for all plugins
+   * @returns Promise resolving to array of detailed plugin objects
+   */
+  async getDetailedPlugins(): Promise<Array<PluginCatalogPlugin>> {
+    const response = await this.fetchPluginCatalog();
+    return response.data?.detailed || [];
+  }
+
+  /**
+   * Gets detailed plugin information filtered by type
+   * @param type - The plugin type to filter by ('secret', 'auth', 'database')
+   * @returns Promise resolving to array of detailed plugin objects of the specified type
+   */
+  async getDetailedPluginsByType(type: string): Promise<Array<PluginCatalogPlugin>> {
+    const response = await this.fetchPluginCatalog();
+    return response.data?.detailed.filter((plugin) => plugin.type === type) || [];
+  }
+
+  /**
+   * Gets a specific plugin by name and type
+   * @param name - The plugin name
+   * @param type - The plugin type ('secret', 'auth', 'database')
+   * @returns Promise resolving to the plugin object or undefined if not found
+   */
+  async getPlugin(name: string, type: string): Promise<PluginCatalogPlugin | undefined> {
+    const response = await this.fetchPluginCatalog();
+    return response.data?.detailed.find((plugin) => plugin.name === name && plugin.type === type);
+  }
+}
diff --git a/ui/app/services/replication-mode.js b/ui/app/services/replication-mode.js
index e4f825b96c8..7059a39c29e 100644
--- a/ui/app/services/replication-mode.js
+++ b/ui/app/services/replication-mode.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/services/secret-mount-path.ts b/ui/app/services/secret-mount-path.ts
index a9f54c9369c..348316057a5 100644
--- a/ui/app/services/secret-mount-path.ts
+++ b/ui/app/services/secret-mount-path.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/services/store.js b/ui/app/services/store.js
deleted file mode 100644
index 3662614e217..00000000000
--- a/ui/app/services/store.js
+++ /dev/null
@@ -1,251 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Store, { CacheHandler } from '@ember-data/store';
-import RequestManager from '@ember-data/request';
-import { LegacyNetworkHandler } from '@ember-data/legacy-compat';
-import { run, schedule } from '@ember/runloop';
-import { resolve, Promise } from 'rsvp';
-import { dasherize } from '@ember/string';
-import { assert } from '@ember/debug';
-import { set, get } from '@ember/object';
-import clamp from 'vault/utils/clamp';
-import config from 'vault/config/environment';
-import sortObjects from 'vault/utils/sort-objects';
-
-const { DEFAULT_PAGE_SIZE } = config.APP;
-
-export function normalizeModelName(modelName) {
-  return dasherize(modelName);
-}
-
-export function keyForCache(query) {
-  /*eslint no-unused-vars: ["error", { "ignoreRestSiblings": true }]*/
-  // we want to ignore size, page, responsePath, and pageFilter in the cacheKey
-  const { size, page, responsePath, pageFilter, ...queryForCache } = query;
-  const cacheKeyObject = Object.keys(queryForCache)
-    .sort()
-    .reduce((result, key) => {
-      result[key] = queryForCache[key];
-      return result;
-    }, {});
-  return JSON.stringify(cacheKeyObject);
-}
-
-export default class StoreService extends Store {
-  requestManager = new RequestManager();
-
-  constructor(args) {
-    super(args);
-    // If at some point we no longer need an extended store, we can remove the @ember-data/legacy-compat dep
-    // See: https://api.emberjs.com/ember-data/4.12/modules/@ember-data%2Frequest
-    this.requestManager.use([LegacyNetworkHandler]);
-    this.requestManager.useCache(CacheHandler);
-  }
-
-  lazyCaches = new Map();
-
-  setLazyCacheForModel(modelName, key, value) {
-    const cacheKey = keyForCache(key);
-    const cache = this.lazyCacheForModel(modelName) || new Map();
-    cache.set(cacheKey, value);
-    const modelKey = normalizeModelName(modelName);
-    this.lazyCaches.set(modelKey, cache);
-  }
-
-  getLazyCacheForModel(modelName, key) {
-    const cacheKey = keyForCache(key);
-    const modelCache = this.lazyCacheForModel(modelName);
-    if (modelCache) {
-      return modelCache.get(cacheKey);
-    }
-  }
-
-  lazyCacheForModel(modelName) {
-    return this.lazyCaches.get(normalizeModelName(modelName));
-  }
-
-  // This is the public interface for the store extension - to be used just
-  // like `Store.query`. Special handling of the response is controlled by
-  // `query.pageFilter`, `query.page`, and `query.size`.
-
-  // Required attributes of the `query` argument are:
-  //   responsePath: a string indicating the location on the response where
-  //     the array of items will be found
-  //   page: the page number to return
-  //   size: the size of the page
-  //   pageFilter: a string that will be used to do a fuzzy match against the results,
-  //     OR a function to be executed that will receive the dataset as the lone arg.
-  //     Filter is done pre-pagination.
-  lazyPaginatedQuery(modelType, query, adapterOptions) {
-    const skipCache = query.skipCache;
-    // We don't want skipCache to be part of the actual query key, so remove it
-    delete query.skipCache;
-    const adapter = this.adapterFor(modelType);
-    const modelName = normalizeModelName(modelType);
-    const dataCache = skipCache ? this.clearDataset(modelName) : this.getDataset(modelName, query);
-    const responsePath = query.responsePath;
-    assert('responsePath is required', responsePath);
-    assert('page is required', typeof query.page === 'number');
-    if (!query.size) {
-      query.size = DEFAULT_PAGE_SIZE;
-    }
-
-    if (dataCache) {
-      return resolve(this.fetchPage(modelName, query));
-    }
-    return adapter
-      .query(this, { modelName }, query, null, adapterOptions)
-      .then((response) => {
-        const serializer = this.serializerFor(modelName);
-        const datasetHelper = serializer.extractLazyPaginatedData;
-        const dataset = datasetHelper
-          ? datasetHelper.call(serializer, response)
-          : get(response, responsePath);
-        set(response, responsePath, null);
-        this.storeDataset(modelName, query, response, dataset);
-        return this.fetchPage(modelName, query);
-      })
-      .catch(function (e) {
-        throw e;
-      });
-  }
-
-  filterData(filter, dataset) {
-    let newData = dataset || [];
-    if (filter) {
-      if (filter instanceof Function) {
-        newData = filter(dataset);
-      } else {
-        newData = dataset.filter((item) => {
-          const id = item.id || item.name || item;
-          return id.toLowerCase().includes(filter.toLowerCase());
-        });
-      }
-    }
-    return newData;
-  }
-
-  // reconstructs the original form of the response from the server
-  // with an additional `meta` block
-  //
-  // the meta block includes:
-  // currentPage, lastPage, nextPage, prevPage, total, filteredTotal
-  constructResponse(modelName, query) {
-    const { pageFilter, responsePath, size, page } = query;
-    const { response, dataset } = this.getDataset(modelName, query);
-    const resp = { ...response };
-    const data = this.filterData(pageFilter, dataset);
-
-    const lastPage = Math.ceil(data.length / size);
-    const currentPage = clamp(page, 1, lastPage);
-    const end = currentPage * size;
-    const start = end - size;
-    const slicedDataSet = data.slice(start, end);
-
-    set(resp, responsePath || '', slicedDataSet);
-    resp.meta = {
-      currentPage,
-      lastPage,
-      nextPage: clamp(currentPage + 1, 1, lastPage),
-      prevPage: clamp(currentPage - 1, 1, lastPage),
-      total: dataset.length || 0,
-      filteredTotal: data.length || 0,
-      pageSize: size,
-    };
-
-    return resp;
-  }
-
-  forceUnload(modelName) {
-    // Hack to get unloadAll to work correctly until we update to ember-data@4.12
-    // so that all the records are properly unloaded and we don't get ghost records
-    this.peekAll(modelName).length;
-    // force destroy queue to flush https://github.com/emberjs/data/issues/5447
-    run(() => this.unloadAll(modelName));
-  }
-
-  // pushes records into the store and returns the result
-  fetchPage(modelName, query) {
-    const response = this.constructResponse(modelName, query);
-    this.forceUnload(modelName);
-    // Hack to ensure the pushed records below all get in the store. remove with update to ember-data@4.12
-    this.peekAll(modelName).length;
-    return new Promise((resolve) => {
-      // push subset of records into the store
-      schedule('destroy', () => {
-        this.push(
-          this.serializerFor(modelName).normalizeResponse(
-            this,
-            this.modelFor(modelName),
-            response,
-            null,
-            'query'
-          )
-        );
-        // Hack to make sure all records get in model correctly. remove with update to ember-data@4.12
-        this.peekAll(modelName).length;
-        const model = this.peekAll(modelName).toArray();
-        model.set('meta', response.meta);
-        resolve(model);
-      });
-    });
-  }
-
-  // get cached data
-  getDataset(modelName, query) {
-    return this.getLazyCacheForModel(modelName, query);
-  }
-
-  // store data cache as { response, dataset}
-  // also populated `lazyCaches` attribute
-  storeDataset(modelName, query, response, array) {
-    const dataset = query.sortBy ? sortObjects(array, query.sortBy) : array;
-    const value = {
-      response,
-      dataset,
-    };
-    this.setLazyCacheForModel(modelName, query, value);
-  }
-
-  clearDataset(modelName) {
-    if (!this.lazyCaches.size) return;
-    if (modelName && this.lazyCaches.has(modelName)) {
-      this.lazyCaches.delete(modelName);
-      return;
-    }
-    this.lazyCaches.clear();
-  }
-
-  clearAllDatasets() {
-    this.clearDataset();
-  }
-
-  /**
-   * this is designed to be a temporary workaround to an issue in the test environment after upgrading to Ember 4.12
-   * when performing an unloadAll or unloadRecord for auth-method or secret-engine models within the app code an error breaks the tests
-   * after the test run is finished during teardown an unloadAll happens and the error "Expected a stable identifier" is thrown
-   * it seems that when the unload happens in the app, for some reason the mount-config relationship models are not unloaded
-   * then when the unloadAll happens a second time during test teardown there seems to be an issue since those records should already have been unloaded
-   * when logging in the teardownRecord hook, it appears that other embedded inverse: null relationships such as replication-attributes are torn down when the parent model is unloaded
-   * the following fixes the issue by explicitly unloading the mount-config models associated to the parent
-   * this should be looked into further to find the root cause, at which time these overrides may be removed
-   */
-  unloadAll(modelName) {
-    const hasMountConfig = ['auth-method', 'secret-engine'];
-    if (hasMountConfig.includes(modelName)) {
-      this.peekAll(modelName).forEach((record) => this.unloadRecord(record));
-    } else {
-      super.unloadAll(modelName);
-    }
-  }
-  unloadRecord(record) {
-    const hasMountConfig = ['auth-method', 'secret-engine'];
-    if (record && hasMountConfig.includes(record.constructor.modelName) && record.config) {
-      super.unloadRecord(record.config);
-    }
-    super.unloadRecord(record);
-  }
-}
diff --git a/ui/app/services/unsaved-changes.ts b/ui/app/services/unsaved-changes.ts
new file mode 100644
index 00000000000..58d7c48dcad
--- /dev/null
+++ b/ui/app/services/unsaved-changes.ts
@@ -0,0 +1,40 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Service from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { create } from 'jsondiffpatch';
+
+// this service tracks the unsaved changes modal state.
+export default class UnsavedChangesService extends Service {
+  @tracked changedFields: Array<string> = [];
+  @tracked showModal = false;
+
+  @tracked initialState: Record<string, unknown> | undefined;
+  @tracked currentState: Record<string, unknown> | undefined;
+
+  setupProperties(
+    initialState: Record<string, unknown> | undefined,
+    currentState: Record<string, unknown> | undefined
+  ) {
+    this.initialState = initialState;
+    this.currentState = currentState;
+  }
+
+  getDiff() {
+    const diffpatcher = create({});
+    const delta = diffpatcher.diff(this.initialState, this.currentState);
+
+    const changedFields = delta ? Object.keys(delta) : [];
+
+    this.changedFields = changedFields;
+
+    return changedFields;
+  }
+
+  get hasChanges() {
+    return this.changedFields.length > 0;
+  }
+}
diff --git a/ui/app/services/version.js b/ui/app/services/version.js
index 7e3c7a2278c..d8c082c7ec2 100644
--- a/ui/app/services/version.js
+++ b/ui/app/services/version.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,10 +7,16 @@ import Service, { inject as service } from '@ember/service';
 import { keepLatestTask, task } from 'ember-concurrency';
 import { tracked } from '@glimmer/tracking';
 
+/**
+ * This service returns information about a cluster's license/features, version and type (community vs enterprise).
+ */
+
 export default class VersionService extends Service {
   @service store;
+  @service flags;
   @tracked features = [];
   @tracked version = null;
+  @tracked clusterName = null;
   @tracked type = null;
 
   get isEnterprise() {
@@ -42,6 +48,17 @@ export default class VersionService extends Service {
     return this.features.includes('Control Groups');
   }
 
+  get hasSecretsSync() {
+    const isEnterprise = this.isEnterprise;
+    const isHvdManaged = this.flags.isHvdManaged;
+    const onLicense = this.features.includes('Secrets Sync');
+
+    if (!isEnterprise) return false;
+    if (isHvdManaged) return true;
+    if (isEnterprise && onLicense) return true;
+    return false;
+  }
+
   get versionDisplay() {
     if (!this.version) {
       return '';
@@ -52,8 +69,10 @@ export default class VersionService extends Service {
   @task({ drop: true })
   *getVersion() {
     if (this.version) return;
-    const response = yield this.store.adapterFor('cluster').fetchVersion();
-    this.version = response.data?.version;
+    // Fetch seal status with token to get version
+    const response = yield this.store.adapterFor('cluster').sealStatus(false);
+    this.version = response?.version;
+    this.clusterName = response?.cluster_name;
   }
 
   @task
diff --git a/ui/app/services/wizard.js b/ui/app/services/wizard.js
deleted file mode 100644
index 58d242372ac..00000000000
--- a/ui/app/services/wizard.js
+++ /dev/null
@@ -1,361 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { next } from '@ember/runloop';
-import { typeOf } from '@ember/utils';
-import Service, { inject as service } from '@ember/service';
-import { Machine } from 'xstate';
-import { capitalize } from '@ember/string';
-
-import getStorage from 'vault/lib/token-storage';
-import { STORAGE_KEYS, DEFAULTS, MACHINES } from 'vault/helpers/wizard-constants';
-const {
-  TUTORIAL_STATE,
-  COMPONENT_STATE,
-  FEATURE_STATE,
-  FEATURE_LIST,
-  FEATURE_STATE_HISTORY,
-  COMPLETED_FEATURES,
-  RESUME_URL,
-  RESUME_ROUTE,
-} = STORAGE_KEYS;
-const TutorialMachine = Machine(MACHINES.tutorial);
-let FeatureMachine = null;
-
-export default Service.extend(DEFAULTS, {
-  router: service(),
-  showWhenUnauthenticated: false,
-  featureMachineHistory: null,
-  init() {
-    this._super(...arguments);
-    this.initializeMachines();
-  },
-
-  initializeMachines() {
-    if (!this.storageHasKey(TUTORIAL_STATE)) {
-      const state = TutorialMachine.initialState;
-      this.saveState('currentState', state.value);
-      this.saveExtState(TUTORIAL_STATE, state.value);
-    }
-    this.saveState('currentState', this.getExtState(TUTORIAL_STATE));
-    if (this.storageHasKey(COMPONENT_STATE)) {
-      this.set('componentState', this.getExtState(COMPONENT_STATE));
-    }
-    const stateNodes = TutorialMachine.getStateNodes(this.currentState);
-    this.executeActions(
-      stateNodes.reduce((acc, node) => acc.concat(node.onEntry), []),
-      null,
-      'tutorial'
-    );
-
-    if (this.storageHasKey(FEATURE_LIST)) {
-      this.set('featureList', this.getExtState(FEATURE_LIST));
-      if (this.storageHasKey(FEATURE_STATE_HISTORY)) {
-        this.set('featureMachineHistory', this.getExtState(FEATURE_STATE_HISTORY));
-      }
-      this.saveState(
-        'featureState',
-        this.getExtState(FEATURE_STATE) || (FeatureMachine ? FeatureMachine.initialState : null)
-      );
-      this.saveExtState(FEATURE_STATE, this.featureState);
-      this.buildFeatureMachine();
-    }
-  },
-
-  clearFeatureData() {
-    const storage = this.storage();
-    // empty storage
-    [FEATURE_LIST, FEATURE_STATE, FEATURE_STATE_HISTORY, COMPLETED_FEATURES].forEach((key) =>
-      storage.removeItem(key)
-    );
-
-    this.set('currentMachine', null);
-    this.set('featureMachineHistory', null);
-    this.set('featureState', null);
-    this.set('featureList', null);
-  },
-
-  restartGuide() {
-    this.clearFeatureData();
-    const storage = this.storage();
-    // empty storage
-    [TUTORIAL_STATE, COMPONENT_STATE, RESUME_URL, RESUME_ROUTE].forEach((key) => storage.removeItem(key));
-    // reset wizard state
-    this.setProperties(DEFAULTS);
-    // restart machines from blank state
-    this.initializeMachines();
-    // progress machine to 'active.select'
-    this.transitionTutorialMachine('idle', 'AUTH');
-  },
-
-  saveFeatureHistory(state) {
-    if (
-      this.getCompletedFeatures().length === 0 &&
-      this.featureMachineHistory === null &&
-      (state === 'idle' || state === 'wrap')
-    ) {
-      const newHistory = [state];
-      this.set('featureMachineHistory', newHistory);
-    } else {
-      if (this.featureMachineHistory) {
-        if (!this.featureMachineHistory.includes(state)) {
-          const newHistory = this.featureMachineHistory.addObject(state);
-          this.set('featureMachineHistory', newHistory);
-        } else {
-          //we're repeating steps
-          const stepIndex = this.featureMachineHistory.indexOf(state);
-          const newHistory = this.featureMachineHistory.splice(0, stepIndex + 1);
-          this.set('featureMachineHistory', newHistory);
-        }
-      }
-    }
-    if (this.featureMachineHistory) {
-      this.saveExtState(FEATURE_STATE_HISTORY, this.featureMachineHistory);
-    }
-  },
-
-  saveState(stateType, state) {
-    if (state.value) {
-      state = state.value;
-    }
-    let stateKey = '';
-    while (typeOf(state) === 'object') {
-      const newState = Object.keys(state);
-      stateKey += newState + '.';
-      state = state[newState];
-    }
-    stateKey += state;
-    this.set(stateType, stateKey);
-    if (stateType === 'featureState') {
-      //only track progress if we are on the first step of the first feature
-      this.saveFeatureHistory(state);
-    }
-  },
-
-  transitionTutorialMachine(currentState, event, extendedState) {
-    if (extendedState) {
-      this.set('componentState', extendedState);
-      this.saveExtState(COMPONENT_STATE, extendedState);
-    }
-    const { actions, value } = TutorialMachine.transition(currentState, event);
-    this.saveState('currentState', value);
-    this.saveExtState(TUTORIAL_STATE, this.currentState);
-    this.executeActions(actions, event, 'tutorial');
-  },
-
-  transitionFeatureMachine(currentState, event, extendedState) {
-    if (!FeatureMachine || !this.currentState.includes('active')) {
-      return;
-    }
-    if (extendedState) {
-      this.set('componentState', extendedState);
-      this.saveExtState(COMPONENT_STATE, extendedState);
-    }
-
-    const { actions, value } = FeatureMachine.transition(currentState, event, this.componentState);
-    this.saveState('featureState', value);
-    this.saveExtState(FEATURE_STATE, value);
-    this.executeActions(actions, event, 'feature');
-    // if all features were completed, the FeatureMachine gets nulled
-    // out and won't exist here as there is no next step
-    if (FeatureMachine) {
-      let next;
-      if (this.currentMachine === 'secrets' && value === 'display') {
-        next = FeatureMachine.transition(value, 'REPEAT', this.componentState);
-      } else {
-        next = FeatureMachine.transition(value, 'CONTINUE', this.componentState);
-      }
-      this.saveState('nextStep', next.value);
-    }
-  },
-
-  saveExtState(key, value) {
-    this.storage().setItem(key, value);
-  },
-
-  getExtState(key) {
-    return this.storage().getItem(key);
-  },
-
-  storageHasKey(key) {
-    return Boolean(this.getExtState(key));
-  },
-
-  executeActions(actions, event, machineType) {
-    let transitionURL;
-    let expectedRouteName;
-    const router = this.router;
-
-    for (const action of actions) {
-      let type = action;
-      if (action.type) {
-        type = action.type;
-      }
-      switch (type) {
-        case 'render':
-          this.set(`${action.level}Component`, action.component);
-          break;
-        case 'routeTransition':
-          expectedRouteName = action.params[0];
-          transitionURL = router.urlFor(...action.params).replace(/^\/ui/, '');
-          next(() => {
-            router.transitionTo(...action.params);
-          });
-          break;
-        case 'saveFeatures':
-          this.saveFeatures(event.features);
-          break;
-        case 'completeFeature':
-          this.completeFeature();
-          break;
-        case 'handleDismissed':
-          this.handleDismissed();
-          break;
-        case 'handlePaused':
-          this.handlePaused();
-          return;
-        case 'handleResume':
-          this.handleResume();
-          break;
-        case 'showTutorialWhenAuthenticated':
-          this.set('showWhenUnauthenticated', false);
-          break;
-        case 'showTutorialAlways':
-          this.set('showWhenUnauthenticated', true);
-          break;
-        case 'clearFeatureData':
-          this.clearFeatureData();
-          break;
-        case 'continueFeature':
-          this.transitionFeatureMachine(this.featureState, 'CONTINUE', this.componentState);
-          break;
-        default:
-          break;
-      }
-    }
-    if (machineType === 'tutorial') {
-      return;
-    }
-    // if we're transitioning in the actions, we want that url,
-    // else we want the URL we land on in didTransition in the
-    // application route - we'll notify the application route to
-    // update the route
-    if (transitionURL) {
-      this.set('expectedURL', transitionURL);
-      this.set('expectedRouteName', expectedRouteName);
-      this.set('setURLAfterTransition', false);
-    } else {
-      this.set('setURLAfterTransition', true);
-    }
-  },
-
-  handlePaused() {
-    const expected = this.expectedURL;
-    if (expected) {
-      this.saveExtState(RESUME_URL, this.expectedURL);
-      this.saveExtState(RESUME_ROUTE, this.expectedRouteName);
-    }
-  },
-
-  handleResume() {
-    const resumeURL = this.storage().getItem(RESUME_URL);
-    if (!resumeURL) {
-      return;
-    }
-    this.router
-      .transitionTo(resumeURL)
-      .followRedirects()
-      .then(() => {
-        this.set('expectedRouteName', this.storage().getItem(RESUME_ROUTE));
-        this.set('expectedURL', resumeURL);
-        this.initializeMachines();
-        this.storage().removeItem(RESUME_URL);
-      });
-  },
-
-  handleDismissed() {
-    this.storage().removeItem(FEATURE_STATE);
-    this.storage().removeItem(FEATURE_LIST);
-    this.storage().removeItem(FEATURE_STATE_HISTORY);
-    this.storage().removeItem(COMPONENT_STATE);
-  },
-
-  saveFeatures(features) {
-    this.set('featureList', features);
-    this.saveExtState(FEATURE_LIST, this.featureList);
-    this.buildFeatureMachine();
-  },
-
-  buildFeatureMachine() {
-    if (this.featureList === null) {
-      return;
-    }
-    this.startFeature();
-    const nextFeature = this.featureList.length > 1 ? capitalize(this.featureList.objectAt(1)) : 'Finish';
-    this.set('nextFeature', nextFeature);
-    let next;
-    if (this.currentMachine === 'secrets' && this.featureState === 'display') {
-      next = FeatureMachine.transition(this.featureState, 'REPEAT', this.componentState);
-    } else {
-      next = FeatureMachine.transition(this.featureState, 'CONTINUE', this.componentState);
-    }
-    this.saveState('nextStep', next.value);
-    const stateNodes = FeatureMachine.getStateNodes(this.featureState);
-    this.executeActions(
-      stateNodes.reduce((acc, node) => acc.concat(node.onEntry), []),
-      null,
-      'feature'
-    );
-  },
-
-  startFeature() {
-    const FeatureMachineConfig = MACHINES[this.featureList.objectAt(0)];
-    FeatureMachine = Machine(FeatureMachineConfig);
-    this.set('currentMachine', this.featureList.objectAt(0));
-    if (this.storageHasKey(FEATURE_STATE)) {
-      this.saveState('featureState', this.getExtState(FEATURE_STATE));
-    } else {
-      this.saveState('featureState', FeatureMachine.initialState);
-    }
-    this.saveExtState(FEATURE_STATE, this.featureState);
-  },
-
-  getCompletedFeatures() {
-    if (this.storageHasKey(COMPLETED_FEATURES)) {
-      return this.getExtState(COMPLETED_FEATURES).toArray();
-    }
-    return [];
-  },
-
-  completeFeature() {
-    const features = this.featureList;
-    const done = features.shift();
-    if (!this.getExtState(COMPLETED_FEATURES)) {
-      const completed = [];
-      completed.push(done);
-      this.saveExtState(COMPLETED_FEATURES, completed);
-    } else {
-      this.saveExtState(COMPLETED_FEATURES, this.getExtState(COMPLETED_FEATURES).toArray().addObject(done));
-    }
-
-    this.saveExtState(FEATURE_LIST, features.length ? features : null);
-    this.storage().removeItem(FEATURE_STATE);
-    if (this.featureMachineHistory) {
-      this.set('featureMachineHistory', []);
-      this.saveExtState(FEATURE_STATE_HISTORY, []);
-    }
-    if (features.length > 0) {
-      this.buildFeatureMachine();
-    } else {
-      this.storage().removeItem(FEATURE_LIST);
-      FeatureMachine = null;
-      this.transitionTutorialMachine(this.currentState, 'DONE');
-    }
-  },
-
-  storage() {
-    return getStorage();
-  },
-});
diff --git a/ui/app/styles/app.scss b/ui/app/styles/app.scss
index 56a186eb089..2c95be95282 100644
--- a/ui/app/styles/app.scss
+++ b/ui/app/styles/app.scss
@@ -1,18 +1,20 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-@import './reset';
-@import 'ember-basic-dropdown';
-@import 'ember-power-select';
-@import '@hashicorp/design-system-components';
-@import './core';
+@use 'reset';
+@use 'ember-basic-dropdown';
+@use 'ember-power-select';
+@use 'core';
+@use 'docs';
 
 @mixin font-face($name) {
   @font-face {
     font-family: $name;
-    src: url('/ui/fonts/#{$name}.woff2') format('woff2'), url('/ui/fonts/#{$name}.woff') format('woff');
+    src:
+      url('/ui/fonts/#{$name}.woff2') format('woff2'),
+      url('/ui/fonts/#{$name}.woff') format('woff');
   }
 }
 
diff --git a/ui/app/styles/components/action-block.scss b/ui/app/styles/components/action-block.scss
index f5b15283177..312a305a81d 100644
--- a/ui/app/styles/components/action-block.scss
+++ b/ui/app/styles/components/action-block.scss
@@ -1,5 +1,8 @@
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +11,7 @@
   grid-row: 1/1;
 }
 @mixin stacked-content {
-  margin-bottom: $spacing-24;
+  margin-bottom: size_variables.$spacing-24;
 }
 
 .action-block-width {
@@ -18,17 +21,17 @@
 .action-block {
   grid-template-columns: 2fr 1fr;
   display: grid;
-  padding: $spacing-16 $spacing-24;
+  padding: size_variables.$spacing-16 size_variables.$spacing-24;
   line-height: inherit;
-  grid-gap: $spacing-16;
+  grid-gap: size_variables.$spacing-16;
 
-  @include until($mobile) {
+  @include mixins.until(size_variables.$mobile) {
     @include stacked-grid();
   }
 }
 
 .action-block-info {
-  @include until($mobile) {
+  @include mixins.until(size_variables.$mobile) {
     @include stacked-content();
   }
 }
@@ -41,12 +44,12 @@
 }
 
 .action-block-title {
-  font-size: $size-5;
-  font-weight: $font-weight-bold;
+  font-size: size_variables.$size-5;
+  font-weight: var(--token-typography-font-weight-bold);
 }
 .action-block-action {
   text-align: right;
-  @include until($mobile) {
+  @include mixins.until(size_variables.$mobile) {
     text-align: left;
   }
 }
@@ -55,22 +58,22 @@
 .replication-actions-grid-layout {
   display: flex;
   flex-wrap: wrap;
-  margin: $spacing-16 0;
-  @include until($mobile) {
+  margin: size_variables.$spacing-16 0;
+  @include mixins.until(size_variables.$mobile) {
     display: block;
   }
 }
 
 .replication-actions-grid-item {
   flex-basis: 50%;
-  padding: $spacing-12;
+  padding: size_variables.$spacing-12;
   display: flex;
   width: 100%;
 }
 
 .replication-actions-grid-item .action-block {
   width: 100%;
-  @include until($mobile) {
+  @include mixins.until(size_variables.$mobile) {
     height: inherit;
   }
 }
diff --git a/ui/app/styles/components/auth-form.scss b/ui/app/styles/components/auth-form.scss
deleted file mode 100644
index c6f62abfea4..00000000000
--- a/ui/app/styles/components/auth-form.scss
+++ /dev/null
@@ -1,42 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-.auth-form {
-  @extend .box;
-  @extend .is-bottomless;
-  padding: 0;
-  position: relative;
-  overflow: hidden;
-}
-
-.auth-form .vault-loader {
-  position: absolute;
-  top: -1px;
-  left: -1px;
-  right: -1px;
-  bottom: -1px;
-  background: rgba(255, 255, 255, 0.8);
-  z-index: 10;
-  display: flex;
-  justify-content: center;
-  align-items: center;
-}
-
-.toolbar-namespace-picker {
-  padding: 0 $spacing-12;
-
-  .field {
-    width: 100%;
-  }
-
-  .field-label {
-    margin-right: $spacing-12;
-    align-self: center;
-  }
-
-  .is-label {
-    color: var(--token-color-foreground-faint);
-  }
-}
diff --git a/ui/app/styles/components/autocomplete-input.scss b/ui/app/styles/components/autocomplete-input.scss
index 2e6e3fcaf8c..4b6699c3e32 100644
--- a/ui/app/styles/components/autocomplete-input.scss
+++ b/ui/app/styles/components/autocomplete-input.scss
@@ -1,13 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .autocomplete-input {
-  background: $white !important;
-  border: 1px solid $grey-light;
+  background: hsl(0, 0%, 100%) !important;
+  border: 1px solid var(--token-color-palette-neutral-300);
   box-sizing: border-box;
-  border-radius: 3px;
+  border-radius: var(--token-form-control-border-radius);
   width: 99%;
   padding: 4px 0;
   margin-left: 0.5%;
@@ -17,7 +17,7 @@
 .autocomplete-input-option {
   padding: 12px;
   &:hover {
-    background-color: $grey-lightest;
+    background-color: var(--token-color-surface-faint);
     cursor: pointer;
   }
 }
diff --git a/ui/app/styles/components/b64-toggle.scss b/ui/app/styles/components/b64-toggle.scss
index 8fa4670b399..cba7806ad09 100644
--- a/ui/app/styles/components/b64-toggle.scss
+++ b/ui/app/styles/components/b64-toggle.scss
@@ -1,11 +1,14 @@
+@use '../utils/size_variables';
+@use '../core/buttons.scss';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .b64-toggle {
   padding: 0.75rem;
-  font-size: $size-9;
+  font-size: size_variables.$size-9;
 }
 .b64-toggle.is-input {
   box-shadow: none;
diff --git a/ui/app/styles/components/box-label.scss b/ui/app/styles/components/box-label.scss
index 9e985348174..767992ca766 100644
--- a/ui/app/styles/components/box-label.scss
+++ b/ui/app/styles/components/box-label.scss
@@ -1,5 +1,11 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+@use '../core/box.scss';
+@use '../core/columns.scss';
+@use '../helper-classes/flexbox-and-grid.scss';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,11 +17,11 @@ label.box-label {
   @extend .box;
   @extend .is-centered;
 
-  border-color: $grey-light;
-  border-radius: 3px;
-  box-shadow: $box-link-shadow;
+  border-color: var(--token-color-palette-neutral-300);
+  border-radius: var(--token-border-radius-x-small);
+  box-shadow: box-shadow_variables.$box-link-shadow;
   text-decoration: none;
-  transition: box-shadow $speed;
+  transition: box-shadow size_variables.$speed;
   width: 100%;
 
   > div:first-child {
@@ -27,15 +33,15 @@ label.box-label {
   }
 
   &.is-selected {
-    box-shadow: $box-link-hover-shadow, $box-shadow-middle;
+    box-shadow: box-shadow_variables.$box-link-hover-shadow, box-shadow_variables.$box-shadow-middle;
 
     .icon {
-      color: $grey;
+      color: var(--token-color-palette-neutral-400);
     }
   }
 
   .icon {
-    color: $grey-light;
+    color: var(--token-color-palette-neutral-300);
   }
 
   input[type='radio'] {
@@ -43,7 +49,7 @@ label.box-label {
   }
 
   input[type='radio'] + label {
-    border: 1px solid $grey-light;
+    border: 1px solid var(--token-color-palette-neutral-300);
     border-radius: 50%;
     cursor: pointer;
     display: block;
@@ -53,16 +59,16 @@ label.box-label {
   }
 
   input[type='radio']:checked + label {
-    background: $blue;
-    border: 1px solid $blue;
-    box-shadow: inset 0 0 0 0.15rem $white;
+    background: var(--token-color-palette-blue-200);
+    border: 1px solid var(--token-color-palette-blue-200);
+    box-shadow: inset 0 0 0 0.15rem hsl(0, 0%, 100%);
   }
 }
 
 .box-label-header {
-  color: $grey;
+  color: var(--token-color-palette-neutral-400);
 
   .is-selected & {
-    color: $grey-darkest;
+    color: var(--token-color-foreground-primary);
   }
 }
diff --git a/ui/app/styles/components/calendar-widget.scss b/ui/app/styles/components/calendar-widget.scss
index d7db9456385..92baa321645 100644
--- a/ui/app/styles/components/calendar-widget.scss
+++ b/ui/app/styles/components/calendar-widget.scss
@@ -1,5 +1,8 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -18,13 +21,13 @@ $dark-gray: #535f73;
   }
 }
 .calendar-title {
-  padding: $spacing-10 $spacing-12;
+  padding: size_variables.$spacing-10 size_variables.$spacing-12;
 }
 
 .select-year {
   grid-area: select-year;
   margin: 10px 24px;
-  font-weight: $font-weight-bold;
+  font-weight: var(--tokens-typography-font-weight-bold);
   display: flex;
   justify-content: space-between;
   align-items: first baseline;
@@ -36,7 +39,7 @@ $dark-gray: #535f73;
 
 .border-col {
   grid-area: border-col;
-  background-color: $ui-gray-200;
+  background-color: var(--token-color-palette-neutral-200);
 }
 
 .calendar-widget-container {
@@ -46,9 +49,9 @@ $dark-gray: #535f73;
     'calendar-widget';
   grid-template-columns: 1fr;
   grid-template-rows: 0.7fr 3fr;
-  box-shadow: $box-shadow, $box-shadow-middle;
-  background-color: white;
-  border-radius: $radius;
+  box-shadow: box-shadow_variables.$box-shadow, box-shadow_variables.$box-shadow-middle;
+  background-color: var(--token-color-surface-primary);
+  border-radius: var(--token-border-radius-x-small);
 }
 
 .calendar-widget-grid {
diff --git a/ui/app/styles/components/clients-counts-card.scss b/ui/app/styles/components/clients-counts-card.scss
new file mode 100644
index 00000000000..d1f627e27fe
--- /dev/null
+++ b/ui/app/styles/components/clients-counts-card.scss
@@ -0,0 +1,51 @@
+@use '../utils/size_variables';
+
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+.counts-card-container {
+  padding: size_variables.$spacing-12 size_variables.$spacing-24;
+  margin-bottom: size_variables.$spacing-24;
+
+  // LEGEND POSITION (color and styling is in chart.scss)
+  .legend-container {
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    gap: 1rem;
+    flex-wrap: wrap;
+
+    .legend-item {
+      display: flex;
+      align-items: center;
+      gap: 0.5rem;
+    }
+  }
+
+  .chart-flex-row {
+    display: flex;
+    gap: 1rem;
+
+    .item-left {
+      flex: 1 1 40%;
+      min-width: 0;
+    }
+    .item-right {
+      flex: 2 1 60%;
+      min-width: 0;
+    }
+
+    // Stack vertically on smaller screens
+    @media (max-width: 1024px) {
+      flex-direction: column;
+
+      .item-left,
+      .item-right {
+        flex: 1 1 100%;
+        width: 100%;
+      }
+    }
+  }
+}
diff --git a/ui/app/styles/components/clients-date-range.scss b/ui/app/styles/components/clients-date-range.scss
new file mode 100644
index 00000000000..4e2c29a5129
--- /dev/null
+++ b/ui/app/styles/components/clients-date-range.scss
@@ -0,0 +1,16 @@
+@use '../utils/size_variables';
+
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+.clients-date-range-display {
+  display: flex;
+  align-items: bottom;
+  > * {
+    margin-right: size_variables.$spacing-8;
+    vertical-align: bottom;
+    align-self: end;
+  }
+}
diff --git a/ui/app/styles/components/cluster-banners.scss b/ui/app/styles/components/cluster-banners.scss
index 1acd5ab2a53..7543aa1eeeb 100644
--- a/ui/app/styles/components/cluster-banners.scss
+++ b/ui/app/styles/components/cluster-banners.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,9 +12,9 @@
   padding: 0 1.5rem;
 
   > div {
-    margin-top: $spacing-24;
+    margin-top: size_variables.$spacing-24;
     &:last-of-type {
-      margin-bottom: $spacing-24;
+      margin-bottom: size_variables.$spacing-24;
     }
   }
 }
diff --git a/ui/app/styles/components/codemirror.scss b/ui/app/styles/components/codemirror.scss
deleted file mode 100644
index 49cd9d2d333..00000000000
--- a/ui/app/styles/components/codemirror.scss
+++ /dev/null
@@ -1,190 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-$light-grey: #dde3e7;
-$light-gray: #a4a4a4;
-$light-grey-blue: #6c7b81;
-$dark-grey: #788290;
-$faded-gray: #eaeaea;
-// Product colors
-$atlas: #127eff;
-$vagrant: #2f88f7;
-$consul: #69499a;
-$terraform: #822ff7;
-$serf: #dd4e58;
-$packer: #1ddba3;
-
-// Our colors
-$gray: lighten($black, 89%);
-$red: #ff3d3d;
-$green: #39b54a;
-$dark-gray: #535f73;
-
-$gutter-grey: #2a2f36;
-
-.CodeMirror-lint-tooltip {
-  background-color: #f9f9fa;
-  border: 1px solid $light-gray;
-  border-radius: 0;
-  color: lighten($black, 13%);
-  font-family: $family-monospace;
-  font-size: 13px;
-  padding: 7px 8px 9px;
-}
-
-.cm-s-hashi-read-only {
-  &.CodeMirror {
-    background-color: $grey-lightest;
-    border: none;
-    color: $ui-gray-600;
-    font-family: $family-monospace;
-    -webkit-font-smoothing: auto;
-    line-height: 1.4;
-  }
-
-  span.cm-string,
-  span.cm-string-2 {
-    color: $packer;
-  }
-  span.cm-property {
-    color: lighten($consul, 20%);
-  }
-}
-
-.cm-s-hashi {
-  &.CodeMirror {
-    background-color: $black !important;
-    resize: vertical;
-    color: #cfd2d1 !important;
-    border: none;
-    font-family: $family-monospace;
-    -webkit-font-smoothing: auto;
-    line-height: 1.4;
-  }
-
-  .CodeMirror-gutters {
-    color: $dark-grey;
-    background-color: $gutter-grey;
-    border: none;
-  }
-
-  .CodeMirror-cursor {
-    border-left: solid thin #f8f8f0;
-  }
-
-  .CodeMirror-linenumber {
-    color: #6d8a88;
-  }
-
-  div.CodeMirror-selected {
-    background: rgb(33, 66, 131);
-  }
-
-  &.CodeMirror-focused div.CodeMirror-selected {
-    background: rgb(33, 66, 131);
-  }
-
-  .CodeMirror-line::selection,
-  .CodeMirror-line > span::selection,
-  .CodeMirror-line > span > span::selection {
-    background: rgb(33, 66, 131);
-  }
-
-  .CodeMirror-line::-moz-selection,
-  .CodeMirror-line > span::-moz-selection,
-  .CodeMirror-line > span > span::-moz-selection {
-    background: rgb(33, 66, 131);
-  }
-
-  span.cm-comment {
-    color: $light-grey;
-  }
-
-  span.cm-string,
-  span.cm-string-2 {
-    color: $packer;
-  }
-
-  span.cm-number {
-    color: $serf;
-  }
-
-  span.cm-variable {
-    color: lighten($consul, 20%);
-  }
-
-  span.cm-variable-2 {
-    color: lighten($consul, 20%);
-  }
-
-  span.cm-def {
-    color: $packer;
-  }
-
-  span.cm-operator {
-    color: $gray;
-  }
-  span.cm-keyword {
-    color: $yellow;
-  }
-
-  span.cm-atom {
-    color: $serf;
-  }
-
-  span.cm-meta {
-    color: $packer;
-  }
-
-  span.cm-tag {
-    color: $packer;
-  }
-
-  span.cm-attribute {
-    color: #9fca56;
-  }
-
-  span.cm-qualifier {
-    color: #9fca56;
-  }
-
-  span.cm-property {
-    color: lighten($consul, 20%);
-  }
-
-  span.cm-variable-3 {
-    color: #9fca56;
-  }
-
-  span.cm-builtin {
-    color: #9fca56;
-  }
-
-  .CodeMirror-activeline-background {
-    background: #101213;
-  }
-
-  .CodeMirror-matchingbracket {
-    text-decoration: underline;
-    color: white !important;
-  }
-}
-
-.readonly-codemirror {
-  .CodeMirror-code {
-    cursor: default;
-  }
-  .CodeMirror-cursor {
-    // https://github.com/codemirror/CodeMirror/issues/1099
-    display: none;
-  }
-}
-.cm-s-auto-height.CodeMirror {
-  height: auto;
-}
-
-.cm-s-short.CodeMirror {
-  height: 100px;
-}
diff --git a/ui/app/styles/components/console-ui-panel.scss b/ui/app/styles/components/console-ui-panel.scss
index ed4b420ef5f..c0472da92fa 100644
--- a/ui/app/styles/components/console-ui-panel.scss
+++ b/ui/app/styles/components/console-ui-panel.scss
@@ -1,5 +1,9 @@
+@use 'sass:color';
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,41 +18,32 @@ $console-close-height: 35px;
   overflow: auto;
   position: fixed;
   bottom: 0;
-  transition: min-height $speed $easing, transform $speed ease-in;
+  transition:
+    min-height size_variables.$speed size_variables.$easing,
+    transform size_variables.$speed ease-in;
   will-change: transform, min-height;
   -webkit-overflow-scrolling: touch;
   z-index: 199;
 }
 
 .console-ui-panel-content {
-  color: $white;
+  color: hsl(0, 0%, 100%);
   display: flex;
   flex-direction: column;
-  font-size: $size-7;
-  font-weight: $font-weight-semibold;
+  font-size: size_variables.$size-7;
+  font-weight: var(--token-typography-font-weight-semibold);
   justify-content: flex-end;
   min-height: calc(100% - $console-close-height); // account for close button that is sticky positioned
-  padding: $spacing-12 $spacing-12 $spacing-18;
-  transition: justify-content $speed ease-in;
+  padding: size_variables.$spacing-12 size_variables.$spacing-12 size_variables.$spacing-18;
+  transition: justify-content size_variables.$speed ease-in;
 
   pre,
   p {
     background: none;
     color: inherit;
-    font-size: $size-7;
+    font-size: size_variables.$size-7;
     min-height: 2rem;
     padding: 0;
-
-    &:not(.console-ui-command):not(.CodeMirror-line) {
-      padding-left: $spacing-20;
-    }
-  }
-
-  .cm-s-hashi.CodeMirror {
-    background-color: rgba($black, 0.5) !important;
-    font-weight: $font-weight-normal;
-    margin-left: $spacing-20;
-    padding: $spacing-12 $spacing-20;
   }
 
   .console-ui-panel-intro {
@@ -61,19 +56,19 @@ $console-close-height: 35px;
   display: flex;
 
   input {
-    background-color: rgba($black, 0.5);
+    background-color: rgba(hsl(0, 0%, 4%), 0.5);
     border: 1px solid var(--token-color-palette-neutral-500);
     border-radius: var(--token-side-nav-body-list-item-border-radius);
-    caret-color: $white;
-    color: $white;
+    caret-color: hsl(0, 0%, 100%);
+    color: hsl(0, 0%, 100%);
     flex: 1 1 auto;
-    font-family: $family-monospace;
-    font-size: $size-6;
-    font-weight: $font-weight-bold;
+    font-family: var(--token-typography-font-stack-code);
+    font-size: var(--token-typography-body-300-font-size);
+    font-weight: var(--tokens-typography-font-weight-bold);
     outline: none;
-    padding: $spacing-8;
-    margin-right: $spacing-8;
-    transition: background-color $speed;
+    padding: size_variables.$spacing-8;
+    margin-right: size_variables.$spacing-8;
+    transition: background-color size_variables.$speed;
   }
 }
 
@@ -82,9 +77,9 @@ $console-close-height: 35px;
 }
 
 .console-ui-output {
-  transition: background-color $speed ease-in-out;
+  transition: background-color size_variables.$speed ease-in-out;
   will-change: background-color;
-  padding-right: $spacing-36;
+  padding-right: size_variables.$spacing-36;
   position: relative;
   background-color: rgba(#000, 0);
   color: var(--token-color-palette-neutral-400);
@@ -94,7 +89,7 @@ $console-close-height: 35px;
 }
 
 .console-ui-alert {
-  margin-left: calc(#{$spacing-20} - 0.33rem);
+  margin-left: calc(#{size_variables.$spacing-20} - 0.33rem);
   position: relative;
   color: var(--token-color-palette-neutral-400);
 
@@ -105,24 +100,20 @@ $console-close-height: 35px;
   }
 
   &.console-ui-alert--error {
-    // HDS tokens are not light enough on the dark background to pass a11y tests.
-    // hex value for --token-color-foreground-critical
-    color: lighten(#e52228, 20%);
+    color: color.adjust(#e52228, $lightness: 20%);
   }
   &.console-ui-alert--success {
-    // HDS tokens are not light enough on the dark background to pass a11y tests.
-    // hex value for --token-color-foreground-success
-    color: lighten(#008a22, 20%);
+    color: color.adjust(#008a22, $lightness: 20%);
   }
 }
 
 .panel-open .console-ui-panel {
-  box-shadow: $box-shadow-highest;
-  min-height: 400px;
+  box-shadow: box-shadow_variables.$box-shadow-highest;
+  min-height: 425px;
 }
 
 .main--console-open {
-  padding-bottom: 400px;
+  padding-bottom: 425px;
 }
 
 .panel-open .console-ui-panel.fullscreen {
@@ -149,13 +140,13 @@ $console-close-height: 35px;
 
 .console-close-button {
   position: sticky;
-  top: $spacing-8;
+  top: size_variables.$spacing-8;
   height: $console-close-height;
   display: flex;
   justify-content: flex-end;
   z-index: 210;
 
   button {
-    margin-right: $spacing-8;
+    margin-right: size_variables.$spacing-8;
   }
 }
diff --git a/ui/app/styles/components/control-group.scss b/ui/app/styles/components/control-group.scss
index a4a4b08fe3f..7c30c57d47f 100644
--- a/ui/app/styles/components/control-group.scss
+++ b/ui/app/styles/components/control-group.scss
@@ -1,15 +1,21 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+@use '../core/box.scss';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .control-group,
 .control-group-success {
   @extend .box;
-  box-shadow: $box-shadow-middle, 0 0 1px $grey-dark;
+  box-shadow:
+    box-shadow_variables.$box-shadow-middle,
+    0 0 1px var(--token-color-palette-neutral-500);
 }
 .control-group-success.is-editor {
-  background: $grey-lightest;
+  background: var(--token-color-surface-faint);
 }
 
 .control-group a {
@@ -17,9 +23,9 @@
 }
 .control-group-header {
   box-shadow: 0 0 1px currentColor;
-  padding: $spacing-10 $spacing-14;
-  background: $grey-lightest;
-  color: $grey-dark;
+  padding: size_variables.$spacing-10 size_variables.$spacing-14;
+  background: var(--token-color-surface-faint);
+  color: var(--token-color-foreground-faint);
   position: relative;
   strong {
     color: currentColor;
@@ -27,10 +33,10 @@
 }
 
 .control-group-header.is-success {
-  color: $green-dark;
-  background: $green-lightest;
+  color: var(--token-color-foreground-success-on-surface);
+  background: var(--token-color-palette-green-50);
 }
 
 .control-group .authorizations {
-  margin-top: $spacing-10;
+  margin-top: size_variables.$spacing-10;
 }
diff --git a/ui/app/styles/components/doc-link.scss b/ui/app/styles/components/doc-link.scss
index 8629ee56a6a..4a4e1148a29 100644
--- a/ui/app/styles/components/doc-link.scss
+++ b/ui/app/styles/components/doc-link.scss
@@ -1,11 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .doc-link {
-  color: $blue;
-  font-weight: $font-weight-semibold;
+  color: var(--token-color-foreground-action);
+  font-weight: var(--tokens-typography-font-weight-semibold);
+
   &:hover {
     text-decoration: underline !important;
   }
diff --git a/ui/app/styles/components/empty-state-component.scss b/ui/app/styles/components/empty-state-component.scss
index dce11b29e44..358f1931aec 100644
--- a/ui/app/styles/components/empty-state-component.scss
+++ b/ui/app/styles/components/empty-state-component.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,8 +11,8 @@
   background: var(--token-color-surface-faint);
   display: flex;
   justify-content: center;
-  padding: $spacing-48 $spacing-12;
-  box-shadow: 0 -2px 0 -1px $ui-gray-300;
+  padding: size_variables.$spacing-48 size_variables.$spacing-12;
+  box-shadow: 0 -2px 0 -1px var(--token-color-palette-neutral-300);
 }
 
 .empty-state-transparent {
@@ -19,7 +21,7 @@
   background: transparent;
   display: flex;
   justify-content: center;
-  padding: $spacing-48 0;
+  padding: size_variables.$spacing-48 0;
   box-shadow: none;
 }
 
@@ -28,36 +30,36 @@
 }
 
 .empty-state-title {
-  color: $grey;
-  font-size: $size-4;
-  font-weight: $font-weight-semibold;
+  color: var(--token-color-palette-neutral-400);
+  font-size: var(--token-typography-display-400-font-size);
+  font-weight: var(--token-typography-font-weight-semibold);
   line-height: 1.2;
-  margin-bottom: $spacing-8;
+  margin-bottom: size_variables.$spacing-8;
 }
 
 .empty-state-subTitle {
-  font-size: $size-7;
+  font-size: size_variables.$size-7;
   margin-top: -10px;
-  padding-bottom: $spacing-12;
+  padding-bottom: size_variables.$spacing-12;
 }
 
 .empty-state-message.has-border-bottom-light {
-  padding-bottom: $spacing-12;
+  padding-bottom: size_variables.$spacing-12;
 }
 
 .empty-state-actions {
-  margin-top: $spacing-8;
+  margin-top: size_variables.$spacing-8;
   display: flex;
   justify-content: space-between;
 
   > * + * {
-    margin-left: $spacing-12;
-    margin-right: $spacing-12;
+    margin-left: size_variables.$spacing-12;
+    margin-right: size_variables.$spacing-12;
   }
 }
 
 .empty-state-icon > .hs-icon,
-.empty-state-icon > .flight-icon {
+.empty-state-icon > .hds-icon {
   float: left;
-  margin-right: $spacing-8;
+  margin-right: size_variables.$spacing-8;
 }
diff --git a/ui/app/styles/components/env-banner.scss b/ui/app/styles/components/env-banner.scss
index cda5d646cf4..83c92eead87 100644
--- a/ui/app/styles/components/env-banner.scss
+++ b/ui/app/styles/components/env-banner.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,11 +10,11 @@
   border-radius: 3rem;
   background: linear-gradient(
     135deg,
-    $blue,
+    var(--token-color-palette-blue-200),
     hsl(271, 100%, 71%)
   ); // only use case for purple in the app. define here instead of utils/color_var
   animation: env-banner-color-rotate 8s infinite linear alternate;
-  color: $white;
+  color: hsl(0, 0%, 100%);
 
   .hs-icon {
     margin: 0;
@@ -21,7 +23,7 @@
   .notification {
     background-color: transparent;
     line-height: 2;
-    padding: 0 $spacing-12;
+    padding: 0 size_variables.$spacing-12;
   }
 }
 
diff --git a/ui/app/styles/components/features-selection.scss b/ui/app/styles/components/features-selection.scss
deleted file mode 100644
index aa12b31dbb5..00000000000
--- a/ui/app/styles/components/features-selection.scss
+++ /dev/null
@@ -1,60 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-.feature-header {
-  font-size: $size-6;
-  font-weight: $font-weight-semibold;
-  color: $grey;
-}
-
-.access-information {
-  display: flex;
-  padding: $spacing-12 0px;
-  font-size: $size-8;
-}
-
-.feature-box {
-  box-shadow: $box-shadow;
-  border-radius: $radius;
-  padding: $spacing-12;
-  margin: $spacing-12 0;
-
-  &.is-active {
-    box-shadow: 0 0 0 1px $grey-light;
-  }
-
-  &.is-disabled {
-    background-color: $ui-gray-010;
-    color: $ui-gray-300;
-  }
-}
-
-.feature-box label {
-  font-weight: $font-weight-semibold;
-  padding-left: $spacing-8;
-
-  &::before {
-    top: 3px;
-  }
-
-  &::after {
-    top: 5px;
-  }
-}
-
-.feature-steps {
-  font-size: $size-8;
-  color: $grey;
-  line-height: 1.5;
-  margin-left: $spacing-24;
-  margin-top: $spacing-8;
-
-  li::before {
-    // bullet
-    content: '\2022';
-    position: relative;
-    right: $size-11;
-  }
-}
diff --git a/ui/app/styles/components/form-section.scss b/ui/app/styles/components/form-section.scss
index 2abde3b3d96..d2a7595884f 100644
--- a/ui/app/styles/components/form-section.scss
+++ b/ui/app/styles/components/form-section.scss
@@ -1,11 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .form-section {
   padding: 1.75rem 0;
-  box-shadow: 0 -1px 0 0 rgba($black, 0.1);
+  box-shadow: 0 -1px 0 0 rgba(hsl(0, 0%, 4%), 0.1);
 }
 
 .field:first-child .form-section,
@@ -19,6 +19,6 @@
   background-color: black;
 
   pre {
-    color: $ui-gray-010;
+    color: var(--token-color-surface-faint);
   }
 }
diff --git a/ui/app/styles/components/global-flash.scss b/ui/app/styles/components/global-flash.scss
index 933ebe61a1b..6e55a2a1b65 100644
--- a/ui/app/styles/components/global-flash.scss
+++ b/ui/app/styles/components/global-flash.scss
@@ -1,11 +1,13 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .global-flash {
-  bottom: $spacing-32;
-  right: $spacing-24;
+  bottom: size_variables.$spacing-32;
+  right: size_variables.$spacing-24;
   margin: 10px;
   max-width: 360px;
   position: fixed;
diff --git a/ui/app/styles/components/icon.scss b/ui/app/styles/components/icon.scss
index f5fbdabb0f0..9709a396ab5 100644
--- a/ui/app/styles/components/icon.scss
+++ b/ui/app/styles/components/icon.scss
@@ -1,15 +1,17 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .icon {
   align-items: center;
   display: inline-flex;
-  height: $size-4;
+  height: size_variables.$size-4;
   justify-content: center;
   vertical-align: middle;
-  width: $size-4;
+  width: size_variables.$size-4;
   // override the display if .button.icon to .button's default display: inline-block. See manage namespaces icon button in the namespace picker
   &.button {
     display: inline-block;
@@ -17,14 +19,14 @@
 }
 
 .icon-blue {
-  color: $blue;
+  color: var(--token-color-foreground-action);
 }
 
-.flight-icon {
-  &.flight-icon-display-inline {
+.hds-icon {
+  &.hds-icon--is-inline {
     vertical-align: middle;
-    margin-left: $spacing-4;
-    margin-right: $spacing-4;
+    margin-left: size_variables.$spacing-4;
+    margin-right: size_variables.$spacing-4;
   }
 }
 
diff --git a/ui/app/styles/components/info-table-row.scss b/ui/app/styles/components/info-table-row.scss
index 2067402d4ed..34a420984fb 100644
--- a/ui/app/styles/components/info-table-row.scss
+++ b/ui/app/styles/components/info-table-row.scss
@@ -1,24 +1,29 @@
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .info-table-row {
-  box-shadow: 0 1px 0 $grey-light;
+  box-shadow: 0 1px 0 var(--token-color-palette-neutral-300);
   margin: 0;
 
   &.has-no-shadow {
     box-shadow: none;
   }
 
-  @include from($mobile) {
+  @include mixins.from(size_variables.$mobile) {
     display: flex;
   }
 
   &.thead {
-    box-shadow: 0 1px 0 $grey-light, 0 -1px 0 $grey-light;
+    box-shadow:
+      0 1px 0 var(--token-color-palette-neutral-300),
+      0 -1px 0 var(--token-color-palette-neutral-300);
     margin: 0;
-    padding: 0 $spacing-14 0 0;
+    padding: 0 size_variables.$spacing-14 0 0;
 
     .column {
       padding: 0.5rem 0.75rem;
@@ -27,7 +32,7 @@
 
   .column {
     align-self: center;
-    padding: $spacing-16;
+    padding: size_variables.$spacing-16;
 
     &.info-table-row-edit {
       padding-bottom: 0.3rem;
@@ -39,7 +44,7 @@
     }
 
     .helper-text {
-      font-weight: normal;
+      font-weight: var(--token-typography-font-weight-regular);
     }
     &.justify-right {
       display: flex;
@@ -48,15 +53,15 @@
   }
 
   .hs-icon {
-    margin-right: $spacing-4;
+    margin-right: size_variables.$spacing-4;
   }
 
   .icon-true {
-    color: $green-500;
+    color: var(--token-color-foreground-success);
   }
 
   .icon-false {
-    color: $ui-gray-300;
+    color: var(--token-color-palette-neutral-300);
   }
 
   a {
@@ -65,34 +70,34 @@
 }
 
 .info-table-row:not(.is-mobile) .column {
-  @include until($mobile) {
+  @include mixins.until(size_variables.$mobile) {
     padding: 0;
   }
 
   &:first-child {
     padding-left: 0;
 
-    @include until($mobile) {
-      padding: $spacing-12 0 0;
+    @include mixins.until(size_variables.$mobile) {
+      padding: size_variables.$spacing-12 0 0;
     }
   }
 
   &:last-child {
     padding-right: 0;
 
-    @include until($mobile) {
-      padding: 0 0 $spacing-12;
+    @include mixins.until(size_variables.$mobile) {
+      padding: 0 0 size_variables.$spacing-12;
     }
   }
 }
 
 .info-table-row-header {
   margin: 0;
-  font-size: $size-8;
-  color: $grey;
-  font-weight: $font-weight-semibold;
+  font-size: var(--token-typography-body-200-font-size);
+  color: var(--token-color-palette-neutral-400);
+  font-weight: var(--token-typography-font-weight-semibold);
 
-  @include until($mobile) {
+  @include mixins.until(size_variables.$mobile) {
     display: none;
   }
   .info-table-row:not(.is-mobile) .column:last-child {
@@ -101,15 +106,12 @@
 }
 
 .label-overflow {
-  white-space: nowrap;
   overflow: hidden;
+  max-width: 100%;
   text-overflow: ellipsis;
-
-  // inline display necessary for nested elements so ellipsis shows
-  > div {
-    display: inline;
-  }
-  > div > span {
+  display: inline;
+  // inline display necessary so ellipsis shows
+  > span {
     display: inline;
   }
 }
diff --git a/ui/app/styles/components/init-illustration.scss b/ui/app/styles/components/init-illustration.scss
deleted file mode 100644
index b3d6727902f..00000000000
--- a/ui/app/styles/components/init-illustration.scss
+++ /dev/null
@@ -1,23 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-.init-box {
-  position: relative;
-  z-index: 10;
-}
-.init-illustration {
-  bottom: 0;
-  right: 0;
-  overflow: hidden;
-  position: absolute;
-  height: 200px;
-  width: 200px;
-}
-.init-illustration svg {
-  position: absolute;
-  right: -50px;
-  bottom: -50px;
-  opacity: 0.8;
-}
diff --git a/ui/app/styles/components/kmip-role-edit.scss b/ui/app/styles/components/kmip-role-edit.scss
index a517c1a5431..aea8c6ef359 100644
--- a/ui/app/styles/components/kmip-role-edit.scss
+++ b/ui/app/styles/components/kmip-role-edit.scss
@@ -1,14 +1,20 @@
+@use '../utils/size_variables';
+@use '../core/box.scss';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+.kmip-role-operations {
+  column-count: 2;
+}
 .kmip-role-allowed-operations {
   @extend .box;
   flex: 1 1 auto;
   box-shadow: none;
-  padding: 0;
+  padding: size_variables.$spacing-4 0;
 }
 .kmip-role-allowed-operations .field {
-  margin-bottom: $spacing-4;
+  margin-bottom: size_variables.$spacing-4;
 }
diff --git a/ui/app/styles/components/known-secondaries-card.scss b/ui/app/styles/components/known-secondaries-card.scss
index 7c47842dd1e..8339fcdd485 100644
--- a/ui/app/styles/components/known-secondaries-card.scss
+++ b/ui/app/styles/components/known-secondaries-card.scss
@@ -1,5 +1,8 @@
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,17 +10,17 @@
   grid-column: 2/3;
   grid-row: 1/3;
 
-  @include until($mobile) {
+  @include mixins.until(size_variables.$mobile) {
     grid-column: 1/1;
     grid-row: 1/1;
   }
 
   .secondaries-table {
-    margin-bottom: $spacing-12;
+    margin-bottom: size_variables.$spacing-12;
   }
 
   .link {
-    font-size: $size-7;
+    font-size: size_variables.$size-7;
     text-decoration: none;
   }
 }
diff --git a/ui/app/styles/components/linked-block.scss b/ui/app/styles/components/linked-block.scss
index 500b6f509f1..25179f30e0d 100644
--- a/ui/app/styles/components/linked-block.scss
+++ b/ui/app/styles/components/linked-block.scss
@@ -1,5 +1,7 @@
+@use '../helper-classes/flexbox-and-grid.scss';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,3 +25,7 @@
   grid-row: 1;
   align-self: center;
 }
+
+.linked-block-title {
+  grid-template-columns: minmax(0, 28px) minmax(0, 1fr);
+}
diff --git a/ui/app/styles/components/list-item-row.scss b/ui/app/styles/components/list-item-row.scss
index 4cea11e44df..6925d3e52e2 100644
--- a/ui/app/styles/components/list-item-row.scss
+++ b/ui/app/styles/components/list-item-row.scss
@@ -1,5 +1,11 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+@use '../core/box.scss';
+@use '../helper-classes/general.scss';
+@use '../helper-classes/spacing.scss';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,9 +23,9 @@
   .center-inside-row {
     width: 50%;
     margin-left: auto;
-    font-size: $size-8;
-    font-weight: $font-weight-semibold;
-    color: $ui-gray-500;
+    font-size: var(--token-typography-body-200-font-size);
+    font-weight: var(--token-typography-font-weight-semibold);
+    color: var(--token-color-palette-neutral-400);
   }
 
   .center-display {
@@ -35,19 +41,25 @@
 
 a.list-item-row,
 .linked-block.list-item-row {
-  transition: box-shadow $speed, margin $speed, padding $speed;
+  transition:
+    box-shadow size_variables.$speed,
+    margin size_variables.$speed,
+    padding size_variables.$speed;
   will-change: box-shadow, margin, padding;
 
   &:hover,
   &:focus,
   &:active {
-    margin-left: #{-$spacing-10} !important;
-    margin-right: #{-$spacing-10} !important;
-    padding-left: $spacing-10;
-    padding-right: $spacing-10;
+    margin-left: #{-(size_variables.$spacing-10)} !important;
+    margin-right: #{-(size_variables.$spacing-10)} !important;
+    padding-left: size_variables.$spacing-10;
+    padding-right: size_variables.$spacing-10;
     position: relative;
-    box-shadow: 0 2px 0 -1px $grey-light, 0 -2px 0 -1px $grey-light, $box-link-hover-shadow,
-      $box-shadow-middle;
+    box-shadow:
+      0 2px 0 -1px var(--token-color-palette-neutral-300),
+      0 -2px 0 -1px var(--token-color-palette-neutral-300),
+      box-shadow_variables.$box-link-hover-shadow,
+      box-shadow_variables.$box-shadow-middle;
   }
 
   &.no-destination {
diff --git a/ui/app/styles/components/loader.scss b/ui/app/styles/components/loader.scss
index 8a7752697d7..0be89d4ed50 100644
--- a/ui/app/styles/components/loader.scss
+++ b/ui/app/styles/components/loader.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/components/login-form.scss b/ui/app/styles/components/login-form.scss
deleted file mode 100644
index 79476379a5d..00000000000
--- a/ui/app/styles/components/login-form.scss
+++ /dev/null
@@ -1,9 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-.login-form {
-  box-shadow: $box-shadow, $box-shadow-high;
-  overflow: auto;
-}
diff --git a/ui/app/styles/components/masked-input.scss b/ui/app/styles/components/masked-input.scss
index 12987d05749..33c33a556fb 100644
--- a/ui/app/styles/components/masked-input.scss
+++ b/ui/app/styles/components/masked-input.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,18 +16,18 @@ pre.masked-font {
 }
 
 .has-label .masked-input {
-  padding-top: $spacing-12;
+  padding-top: size_variables.$spacing-12;
 }
 
 .has-padding {
-  padding: $spacing-8 $spacing-12;
+  padding: size_variables.$spacing-8 size_variables.$spacing-12;
 }
 
 // we want to style the boxes the same everywhere so they
 // need to be the same font and small
 .masked-input.masked .masked-value {
   font-size: 9px;
-  font-family: $family-sans;
+  font-family: var(--token-typography-font-stack-text);
   line-height: 2.5;
 }
 
@@ -36,28 +38,28 @@ pre.masked-font {
 // aligns the boxes on the input page
 .masked-input.masked:not(.display-only) .masked-value {
   line-height: 3;
-  border-radius: $radius 0 0 $radius;
+  border-radius: var(--token-border-radius-x-small) 0 0 var(--token-border-radius-x-small);
 }
 
 //override bulma's pre styling
 .masked-input .display-only {
-  line-height: 1.5;
+  line-height: var(--token-typography-body-300-line-height);
   font-size: 1rem;
   padding-top: 0;
   padding-bottom: 0;
-  padding-left: $spacing-12;
+  padding-left: size_variables.$spacing-12;
   background-color: transparent;
 }
 
 .button.masked-input-toggle {
-  min-width: $spacing-36;
+  min-width: size_variables.$spacing-36;
   border-left: 0;
-  color: $grey;
+  color: var(--token-color-palette-neutral-400);
   box-shadow: 0 3px 1px 0px rgba(10, 10, 10, 0.12);
 }
 
 .button.masked-input-toggle {
-  border-radius: 0 $radius $radius 0;
+  border-radius: 0 var(--token-border-radius-x-small) var(--token-border-radius-x-small) 0;
 }
 
 .display-only {
@@ -65,10 +67,10 @@ pre.masked-font {
     background: transparent;
     height: auto;
     line-height: 1rem;
-    min-width: $spacing-24;
+    min-width: size_variables.$spacing-24;
     border: 0;
     box-shadow: none;
-    color: $grey-light;
+    color: var(--token-color-palette-neutral-300);
     padding-left: 0;
     padding-right: 0;
 
@@ -77,7 +79,7 @@ pre.masked-font {
     &:focus,
     &:hover,
     &:focus:not(:active) {
-      color: $blue;
+      color: var(--token-color-foreground-action);
       border: 0;
       box-shadow: none;
     }
@@ -89,5 +91,5 @@ pre.masked-font {
 }
 
 .masked-input .input:focus + .masked-input-toggle {
-  background: rgba($white, 0.95);
+  background: rgba(hsl(0, 0%, 100%), 0.95);
 }
diff --git a/ui/app/styles/components/namespace-picker.scss b/ui/app/styles/components/namespace-picker.scss
index 76ac7201366..c3b9da26674 100644
--- a/ui/app/styles/components/namespace-picker.scss
+++ b/ui/app/styles/components/namespace-picker.scss
@@ -1,124 +1,26 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-.namespace-picker {
-  position: relative;
-  color: var(--token-color-palette-neutral-300);
-  display: flex;
-  padding: $spacing-4 $spacing-8;
-  width: 100%;
-}
-
-.namespace-picker.no-namespaces {
-  border: none;
-  padding-right: 0;
-}
-
-.namespace-picker-trigger {
-  align-items: center;
-  display: flex;
-  flex: 1 1 auto;
-  height: 2rem;
-  justify-content: space-between;
-  margin-right: $spacing-4;
-}
-
-.namespace-picker-content {
-  width: 250px;
-  max-height: 300px;
-  overflow: auto;
-  border-radius: $radius;
-  box-shadow: $box-shadow, $box-shadow-high;
-
-  &.ember-basic-dropdown-content {
-    background: $white;
-  }
-}
-
-.namespace-picker-content .level-left {
-  max-width: 210px;
-  overflow-wrap: break-word;
-  word-wrap: break-word;
-  word-break: break-word;
-}
+@use '../helper-classes/general';
+@use '../helper-classes/flexbox-and-grid';
 
-.namespace-header-bar {
-  padding: $spacing-4 $spacing-10;
-  border-bottom: 1px solid rgba($black, 0.1);
-  font-weight: $font-weight-semibold;
-  min-height: 32px;
-}
-
-.namespace-manage-link {
-  border-top: 1px solid rgba($black, 0.1);
-
-  .level-left {
-    font-weight: $font-weight-bold;
-    font-size: 14px;
-  }
-  .level-right {
-    margin-right: 10px;
+.namespace-picker {
+  .hds-dropdown__content {
+    min-width: 239px;
   }
-}
-
-.namespace-list {
-  position: relative;
-  overflow: hidden;
-}
 
-.namespace-link {
-  color: $black;
-  text-decoration: none;
-  font-weight: $font-weight-semibold;
-  padding: $spacing-8 $spacing-10 $spacing-8 0;
-}
-
-.namespace-link.is-current {
-  margin-top: $spacing-12;
-  margin-right: -$spacing-8;
-
-  svg {
-    margin-top: 2px;
-    color: var(--token-color-border-strong);
+  .hds-dropdown-toggle-button__text {
+    @extend .truncate-second-line, .is-word-break;
+    white-space: normal;
   }
-}
 
-.leaf-panel {
-  padding: $spacing-4 $spacing-10;
-  transition: transform ease-in-out 250ms;
-  will-change: transform;
-  transform: translateX(0);
-  background: $white;
-  position: absolute;
-  top: 0;
-  left: 0;
-  right: 0;
-  bottom: 0;
-  z-index: 1;
-}
-
-.leaf-panel-left {
-  transform: translateX(-$drawer-width);
-}
-
-.leaf-panel-adding,
-.leaf-panel-current {
-  position: relative;
-  & .namespace-link:last-child {
-    margin-bottom: 4px;
-  }
-}
+  .hds-button-set {
+    @extend .is-flex-between;
 
-.animated-list {
-  .leaf-panel-exiting,
-  .leaf-panel-adding {
-    transform: translateX($drawer-width);
-    z-index: 20;
+    .hds-button {
+      @extend .is-flex-grow-1;
+    }
   }
 }
-
-.leaf-panel-adding {
-  z-index: 100;
-}
diff --git a/ui/app/styles/components/namespace-reminder.scss b/ui/app/styles/components/namespace-reminder.scss
deleted file mode 100644
index f5f27070027..00000000000
--- a/ui/app/styles/components/namespace-reminder.scss
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-.namespace-reminder {
-  color: $grey;
-  margin: 0 0 $spacing-14 0;
-}
-
-.console-reminder p.namespace-reminder {
-  color: $grey;
-  font-family: $family-monospace;
-  font-size: $size-8;
-  margin: $spacing-4 0 0;
-  opacity: 0.7;
-  position: absolute;
-
-  .tag {
-    background-color: $ui-gray-800;
-    color: $light-grey;
-    font-size: $size-9;
-  }
-}
diff --git a/ui/app/styles/components/navigate-input.scss b/ui/app/styles/components/navigate-input.scss
index c3083e7176b..c5aff41819d 100644
--- a/ui/app/styles/components/navigate-input.scss
+++ b/ui/app/styles/components/navigate-input.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/components/overview-card.scss b/ui/app/styles/components/overview-card.scss
index c989d7b6e20..fad2a1d795d 100644
--- a/ui/app/styles/components/overview-card.scss
+++ b/ui/app/styles/components/overview-card.scss
@@ -1,9 +1,11 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .overview-card {
-  padding: $spacing-24;
+  padding: size_variables.$spacing-24;
   line-height: initial;
 }
diff --git a/ui/app/styles/components/page-header-old.scss b/ui/app/styles/components/page-header-old.scss
index d5a9c37ae9c..1871aa3c676 100644
--- a/ui/app/styles/components/page-header-old.scss
+++ b/ui/app/styles/components/page-header-old.scss
@@ -1,11 +1,14 @@
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .page-header {
-  padding-bottom: $spacing-4;
-  padding-top: $spacing-20;
+  padding-bottom: size_variables.$spacing-4;
+  padding-top: size_variables.$spacing-20;
 
   .level {
     align-items: flex-end;
@@ -15,18 +18,18 @@
     flex-grow: 1;
     flex-shrink: 1;
 
-    @include until($mobile) {
+    @include mixins.until(size_variables.$mobile) {
       margin-top: 0.5rem;
     }
   }
   .level-right {
-    @include from($mobile) {
+    @include mixins.from(size_variables.$mobile) {
       justify-content: flex-end;
     }
   }
 
   .title {
-    margin-top: $spacing-16;
+    margin-top: size_variables.$spacing-16;
   }
 
   .title-with-icon {
@@ -34,7 +37,7 @@
   }
 
   .breadcrumb + .level .title {
-    margin-top: $spacing-20;
+    margin-top: size_variables.$spacing-20;
   }
   .title .icon {
     height: auto;
diff --git a/ui/app/styles/components/popup-menu.scss b/ui/app/styles/components/popup-menu.scss
index 96c15608255..a0665ca0f08 100644
--- a/ui/app/styles/components/popup-menu.scss
+++ b/ui/app/styles/components/popup-menu.scss
@@ -1,24 +1,27 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 // Popup menu no longer exists, but these styles are still used in some places
 .popup-menu-content,
-.ember-power-select-options {
-  border-radius: $radius;
+.search-select .ember-power-select-options {
+  border-radius: var(--token-border-radius-x-small);
   margin: -2px 0 0 0;
 
   & > .box {
-    border-radius: $radius;
-    box-shadow: $box-shadow, $box-shadow-middle;
+    border-radius: var(--token-border-radius-x-small);
+    box-shadow: box-shadow_variables.$box-shadow, box-shadow_variables.$box-shadow-middle;
     padding: 0;
     position: relative;
     width: 210px;
   }
 
   &.is-wide > .box {
-    width: $drawer-width;
+    width: size_variables.$drawer-width;
   }
 
   .confirm-action span .button {
@@ -28,7 +31,7 @@
   }
 
   .menu {
-    padding: $spacing-4 0;
+    padding: size_variables.$spacing-4 0;
   }
 
   button.link,
@@ -41,9 +44,9 @@
     border: none;
     display: block;
     height: auto;
-    font-size: $size-7;
-    font-weight: $font-weight-semibold;
-    padding: $spacing-10 $spacing-12;
+    font-size: size_variables.$size-7;
+    font-weight: var(--token-typography-font-weight-semibold);
+    padding: size_variables.$spacing-10 size_variables.$spacing-12;
     text-align: left;
     text-decoration: none;
     width: 100%;
@@ -53,12 +56,13 @@
   // so they match other dropdown elements until we replace popup-menu with Hds::Dropdown
   .hds-confirm-action-critical {
     &:hover {
-      background-color: $ui-gray-050;
+      background-color: var(--token-color-surface-faint);
     }
-    div {
-      margin-left: -$spacing-4;
-      font-size: $size-7;
-      font-weight: $font-weight-semibold;
+    div,
+    span {
+      margin-left: -(size_variables.$spacing-4);
+      font-size: size_variables.$size-7;
+      font-weight: var(--token-typography-font-weight-semibold);
     }
   }
 
@@ -66,26 +70,26 @@
   .ember-power-select-option,
   .ember-power-select-option[aria-current='true'],
   a {
-    background-color: $white;
-    color: $grey-darkest;
+    background-color: hsl(0, 0%, 100%);
+    color: var(--token-color-foreground-primary);
 
     &:hover {
-      background-color: $ui-gray-050;
-      color: $ui-gray-900;
+      background-color: var(--token-color-surface-faint);
+      color: var(--token-color-foreground-primary);
     }
 
     &.active,
     &.is-active {
       background-color: transparent;
-      color: $blue;
+      color: var(--token-color-foreground-action);
     }
 
     &.is-destroy {
-      color: $red;
+      color: var(--token-color-foreground-critical);
 
       &:hover {
-        background-color: $red;
-        color: $white;
+        background-color: var(--token-color-palette-red-200);
+        color: hsl(0, 0%, 100%);
       }
     }
 
@@ -104,29 +108,29 @@
   }
 
   .menu-label {
-    color: $grey-dark;
-    font-size: $size-9;
-    font-weight: $font-weight-normal;
+    color: var(--token-color-foreground-faint);
+    font-size: size_variables.$size-9;
+    font-weight: var(--token-typography-font-weight-regular);
     letter-spacing: 0;
     margin: 0;
-    padding: $spacing-8 $spacing-12 0;
+    padding: size_variables.$spacing-8 size_variables.$spacing-12 0;
     text-transform: uppercase;
   }
 
   .menu-content {
-    padding: $spacing-8 $spacing-12;
+    padding: size_variables.$spacing-8 size_variables.$spacing-12;
   }
 
   hr {
-    background-color: $ui-gray-200;
+    background-color: var(--token-color-palette-neutral-200);
     margin: 0;
   }
 }
 
 .popup-menu-content p {
   box-shadow: none;
-  padding-top: $spacing-8;
-  font-weight: $font-weight-semibold;
+  padding-top: size_variables.$spacing-8;
+  font-weight: var(--token-typography-font-weight-semibold);
 }
 
 .popup-menu-content .level-left {
@@ -140,8 +144,7 @@
 }
 
 .list-item-row,
-.info-table-row,
-.wizard-dismiss-menu {
+.info-table-row {
   .popup-menu-trigger {
     height: 2.5rem;
     min-width: 0;
@@ -150,30 +153,32 @@
   }
 }
 
-.ember-basic-dropdown-content {
-  background-color: transparent;
-
-  &--left.popup-menu {
-    margin: 0px 0 0 -8px;
-  }
+.search-select {
+  .ember-basic-dropdown-content {
+    background-color: transparent;
 
-  &--below {
-    &.ember-basic-dropdown--transitioning-in {
-      animation: drop-fade-above 0.15s;
+    &--left.popup-menu {
+      margin: 0px 0 0 -8px;
     }
 
-    &.ember-basic-dropdown--transitioning-out {
-      animation: drop-fade-above 0.15s reverse;
-    }
-  }
+    &--below {
+      &.ember-basic-dropdown--transitioning-in {
+        animation: drop-fade-above 0.15s;
+      }
 
-  &--above {
-    &.ember-basic-dropdown--transitioning-in {
-      animation: drop-fade-below 0.15s;
+      &.ember-basic-dropdown--transitioning-out {
+        animation: drop-fade-above 0.15s reverse;
+      }
     }
 
-    &.ember-basic-dropdown--transitioning-out {
-      animation: drop-fade-below 0.15s reverse;
+    &--above {
+      &.ember-basic-dropdown--transitioning-in {
+        animation: drop-fade-below 0.15s;
+      }
+
+      &.ember-basic-dropdown--transitioning-out {
+        animation: drop-fade-below 0.15s reverse;
+      }
     }
   }
 }
diff --git a/ui/app/styles/components/radial-progress.scss b/ui/app/styles/components/radial-progress.scss
index fac6bb7f2cc..9f428c4c091 100644
--- a/ui/app/styles/components/radial-progress.scss
+++ b/ui/app/styles/components/radial-progress.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,11 +9,11 @@
   transform: rotate(-90deg) translateX(-20%);
 }
 .radial-progress circle {
-  stroke: rgba($grey-light, 0.5);
-  transition: stroke-dashoffset $speed ease-in;
+  stroke: rgba(var(--token-color-palette-neutral-300), 0.5);
+  transition: stroke-dashoffset size_variables.$speed ease-in;
   will-change: stroke-dashoffset;
   stroke-linecap: round;
 }
 .radial-progress circle.progress-fill {
-  stroke: $green;
+  stroke: var(--token-color-palette-green-200);
 }
diff --git a/ui/app/styles/components/radio-card.scss b/ui/app/styles/components/radio-card.scss
index b335ebb6efc..17d425ae57e 100644
--- a/ui/app/styles/components/radio-card.scss
+++ b/ui/app/styles/components/radio-card.scss
@@ -1,21 +1,24 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .radio-card-selector {
   display: flex;
-  margin-bottom: $spacing-8;
+  margin-bottom: size_variables.$spacing-8;
 }
 .radio-card {
-  box-shadow: $box-shadow-low;
+  box-shadow: box-shadow_variables.$box-shadow-low;
   flex: 1 1 25%;
   flex-direction: column;
   justify-content: space-between;
-  margin: $spacing-8 $spacing-16;
-  border: $base-border;
-  border-radius: $radius;
-  transition: all ease-in-out $speed;
+  margin: size_variables.$spacing-8 size_variables.$spacing-16;
+  border: box-shadow_variables.$base-border;
+  border-radius: var(--token-form-radiocard-border-radius);
+  transition: all ease-in-out size_variables.$speed;
   max-width: 60%;
   input[type='radio'] {
     position: absolute;
@@ -24,7 +27,7 @@
   }
 
   input[type='radio'] + span.dot {
-    border: 1px solid $grey-light;
+    border: 1px solid var(--token-color-palette-neutral-300);
     border-radius: 50%;
     cursor: pointer;
     display: block;
@@ -35,12 +38,14 @@
   }
 
   input[type='radio']:checked + span.dot {
-    background: $blue;
-    border: 1px solid $blue;
-    box-shadow: inset 0 0 0 0.15rem $white;
+    background: var(--token-color-palette-blue-200);
+    border: 1px solid var(--token-color-palette-blue-200);
+    box-shadow: inset 0 0 0 0.15rem hsl(0, 0%, 100%);
   }
   input[type='radio']:focus + span.dot {
-    box-shadow: 0 0 10px 1px rgba($blue, 0.4), inset 0 0 0 0.15rem $white;
+    box-shadow:
+      0 0 10px 1px rgba(#1060ff, 0.4),
+      inset 0 0 0 0.15rem hsl(0, 0%, 100%);
   }
 
   &.is-disabled {
@@ -67,43 +72,43 @@
 .radio-card-row {
   display: flex;
   flex: 1;
-  padding: $spacing-16;
+  padding: size_variables.$spacing-16;
 }
 .radio-card-icon {
-  color: $ui-gray-300;
+  color: var(--token-color-palette-neutral-300);
 }
 .radio-card-message {
-  margin: $spacing-4;
+  margin: size_variables.$spacing-4;
 }
 
 .radio-card-message-title {
-  font-weight: $font-weight-semibold;
-  font-size: $size-7;
-  margin-bottom: $spacing-4;
+  font-weight: var(--token-typography-font-weight-semibold);
+  font-size: size_variables.$size-7;
+  margin-bottom: size_variables.$spacing-4;
 }
 .radio-card-message-body {
   line-height: 1.2;
   color: var(--token-color-foreground-faint);
-  font-size: $size-8;
+  font-size: var(--token-typography-body-200-font-size);
 }
 
 .radio-card-radio-row {
   display: flex;
   justify-content: center;
-  background: $ui-gray-050;
-  padding: $spacing-8;
+  background: var(--token-color-surface-faint);
+  padding: size_variables.$spacing-8;
 }
 
 .is-selected {
   &.radio-card {
-    border-color: $blue-500;
-    background: $ui-gray-010;
-    box-shadow: $box-shadow-middle;
+    border-color: var(--token-color-palette-blue-200);
+    background: var(--token-color-surface-faint);
+    box-shadow: box-shadow_variables.$box-shadow-middle;
   }
   .radio-card-icon {
-    color: $black;
+    color: hsl(0, 0%, 4%);
   }
   .radio-card-radio-row {
-    background: $blue-050;
+    background: var(--token-color-palette-blue-50);
   }
 }
diff --git a/ui/app/styles/components/raft-join.scss b/ui/app/styles/components/raft-join.scss
index 08b362360bb..d1e169dcdc9 100644
--- a/ui/app/styles/components/raft-join.scss
+++ b/ui/app/styles/components/raft-join.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,11 +9,11 @@
   margin-bottom: 0;
 }
 .raft-join .box.is-fullwidth {
-  padding-top: $spacing-12;
-  padding-bottom: $spacing-12;
+  padding-top: size_variables.$spacing-12;
+  padding-bottom: size_variables.$spacing-12;
 }
 .raft-join-unseal {
-  color: $orange;
-  font-size: $size-6;
+  color: var(--token-color-foreground-warning);
+  font-size: var(--token-typography-body-300-font-size);
   display: inline-block;
 }
diff --git a/ui/app/styles/components/read-more.scss b/ui/app/styles/components/read-more.scss
index 6cf71f2e4f5..9ee47e736eb 100644
--- a/ui/app/styles/components/read-more.scss
+++ b/ui/app/styles/components/read-more.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/components/regex-validator.scss b/ui/app/styles/components/regex-validator.scss
index 524c6ed1a0c..9e0152a94f7 100644
--- a/ui/app/styles/components/regex-validator.scss
+++ b/ui/app/styles/components/regex-validator.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,13 +16,13 @@
   flex: 0 1 auto;
 }
 .regex-group {
-  font-family: $family-monospace;
-  font-size: $size-8;
-  color: $ui-gray-600;
+  font-family: var(--token-typography-font-stack-code);
+  font-size: var(--token-typography-body-200-font-size);
+  color: var(--token-color-foreground-faint);
 }
 .regex-group-position {
-  background-color: $ui-gray-200;
-  border-radius: 3px;
+  background-color: var(--token-color-palette-neutral-200);
+  border-radius: var(--token-border-radius-x-small);
   padding-top: 5px;
   padding-bottom: 4px;
   margin-right: 4px;
@@ -29,5 +31,5 @@
   }
 }
 .regex-group-value {
-  margin-right: $spacing-16;
+  margin-right: size_variables.$spacing-16;
 }
diff --git a/ui/app/styles/components/replication-dashboard.scss b/ui/app/styles/components/replication-dashboard.scss
index 6f9a5e460a9..29b0459832b 100644
--- a/ui/app/styles/components/replication-dashboard.scss
+++ b/ui/app/styles/components/replication-dashboard.scss
@@ -1,5 +1,8 @@
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,29 +13,29 @@
     line-height: normal;
 
     &:hover {
-      box-shadow: 0 0 0 1px rgba($grey-dark, 0.3);
+      box-shadow: 0 0 0 1px rgba(var(--token-color-palette-neutral-500), 0.3);
     }
 
     .toolbar-link {
-      color: $blue-500;
+      color: var(--token-color-foreground-action);
     }
   }
 
   .helper-text {
-    font-weight: $font-weight-normal;
+    font-weight: var(--token-typography-font-weight-regular);
   }
 
   .title.is-6 {
-    margin-bottom: $spacing-8;
+    margin-bottom: size_variables.$spacing-8;
   }
 
   .reindexing-alert,
   .syncing-alert {
-    margin-top: $spacing-36;
+    margin-top: size_variables.$spacing-36;
   }
 
   .selectable-card-container {
-    margin-top: $spacing-36;
+    margin-top: size_variables.$spacing-36;
     display: grid;
 
     &.primary,
@@ -40,23 +43,23 @@
       margin: 2rem 0 2rem 0;
       grid-template-columns: 1fr 2fr;
 
-      @include until($mobile) {
+      @include mixins.until(size_variables.$mobile) {
         grid-template-columns: 1fr;
       }
     }
 
     &.secondary {
       grid-template-columns: repeat(auto-fit, minmax(400px, 1fr));
-      grid-gap: $spacing-36;
+      grid-gap: size_variables.$spacing-36;
     }
 
     .card-container {
       display: grid;
-      grid-gap: $spacing-12;
+      grid-gap: size_variables.$spacing-12;
       grid-template-columns: 1fr 1fr;
       grid-template-rows: 0.2fr 0.2fr 0.2fr;
-      padding: $spacing-24;
-      line-height: 1.5;
+      padding: size_variables.$spacing-24;
+      line-height: var(--token-typography-body-300-line-height);
 
       &.summary {
         grid-template-rows: 0.2fr 1fr 0.2fr 1fr;
@@ -66,7 +69,7 @@
         box-shadow: none;
       }
 
-      @include until(1320px) {
+      @include mixins.until(1320px) {
         // prevent an issue with the card descriptions wrapping and expanding height
         min-height: 250px;
       }
@@ -120,12 +123,12 @@
     }
 
     &.summary {
-      margin-bottom: $spacing-36;
+      margin-bottom: size_variables.$spacing-36;
     }
   }
   .summary-state {
-    padding-bottom: $spacing-36;
-    border-bottom: 1px solid rgba($grey-dark, 0.3);
+    padding-bottom: size_variables.$spacing-36;
+    border-bottom: 1px solid rgba(var(--token-color-palette-neutral-500), 0.3);
   }
 
   // prevent double lines at the bottom of the dashboard
diff --git a/ui/app/styles/components/replication-mode-summary.scss b/ui/app/styles/components/replication-mode-summary.scss
deleted file mode 100644
index a96a3d15c67..00000000000
--- a/ui/app/styles/components/replication-mode-summary.scss
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-.replication-description {
-  flex-shrink: 1;
-
-  .title {
-    margin-bottom: $spacing-8;
-  }
-
-  .detail-tags {
-    margin-bottom: $spacing-16;
-  }
-}
diff --git a/ui/app/styles/components/replication-page.scss b/ui/app/styles/components/replication-page.scss
index be4feec942e..4f7f42f8142 100644
--- a/ui/app/styles/components/replication-page.scss
+++ b/ui/app/styles/components/replication-page.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/components/replication-summary.scss b/ui/app/styles/components/replication-summary.scss
index c053cbc75a0..dfe8ad7a757 100644
--- a/ui/app/styles/components/replication-summary.scss
+++ b/ui/app/styles/components/replication-summary.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,11 +11,11 @@
   }
 
   .helper-text {
-    font-weight: normal;
+    font-weight: var(--token-typography-font-weight-regular);
   }
 
   .float-right {
-    margin: $spacing-12 0 $spacing-24 0;
+    margin: size_variables.$spacing-12 0 size_variables.$spacing-24 0;
     float: right;
   }
 }
diff --git a/ui/app/styles/components/role-item.scss b/ui/app/styles/components/role-item.scss
index 09d2d5d02c5..b4028dfd023 100644
--- a/ui/app/styles/components/role-item.scss
+++ b/ui/app/styles/components/role-item.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/components/search-select.scss b/ui/app/styles/components/search-select.scss
index fe279671df6..652287aec24 100644
--- a/ui/app/styles/components/search-select.scss
+++ b/ui/app/styles/components/search-select.scss
@@ -1,128 +1,136 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-.ember-power-select-dropdown {
-  background: transparent;
-  box-shadow: none;
-  overflow: visible;
+.search-select {
+  .ember-power-select-dropdown {
+    background: transparent;
+    box-shadow: none;
+    overflow: visible;
 
-  &.ember-power-select-dropdown.ember-basic-dropdown-content--below {
-    border: 0;
+    &.ember-power-select-dropdown.ember-basic-dropdown-content--below {
+      border: 0;
+    }
   }
-}
 
-.ember-power-select-trigger {
-  border: 0;
-  border-radius: $radius;
-  padding-right: 0;
+  .ember-power-select-trigger {
+    border: 0;
+    border-radius: var(--token-border-radius-x-small);
+    padding-right: 0;
 
-  &--active {
-    outline-width: 3px;
-    outline-offset: -2px;
+    &--active {
+      outline-width: 3px;
+      outline-offset: -2px;
+    }
   }
-}
 
-.ember-power-select-trigger:focus,
-.ember-power-select-trigger--active {
-  border: 0;
-}
+  .ember-power-select-trigger:focus,
+  .ember-power-select-trigger--active {
+    border: 0;
+  }
 
-.ember-power-select-status-icon {
-  display: none;
-}
+  .ember-power-select-status-icon {
+    display: none;
+  }
 
-.ember-power-select-search {
-  left: 0;
-  padding: 0;
-  position: absolute;
-  top: 0;
-  right: 0;
-  transform: translateY(-100%);
-  z-index: -1;
-
-  &::after {
-    background: $white;
-    bottom: $spacing-4;
-    content: '';
-    left: $spacing-4 + $spacing-24;
+  .ember-power-select-search {
+    left: 0;
+    padding: 0;
     position: absolute;
-    right: $spacing-4;
-    top: $spacing-4;
+    top: 0;
+    right: 0;
+    transform: translateY(-100%);
     z-index: -1;
+
+    &::after {
+      background: hsl(0, 0%, 100%);
+      bottom: size_variables.$spacing-4;
+      content: '';
+      left: size_variables.$spacing-4 + size_variables.$spacing-24;
+      position: absolute;
+      right: size_variables.$spacing-4;
+      top: size_variables.$spacing-4;
+      z-index: -1;
+    }
   }
-}
 
-.ember-power-select-search-input {
-  background: transparent;
-  border: 0;
-  padding: $spacing-4 $spacing-12;
-  padding-left: $spacing-4 + $spacing-24;
-}
+  .ember-power-select-search-input {
+    background: transparent;
+    border: 0;
+    padding: size_variables.$spacing-4 size_variables.$spacing-12;
+    padding-left: size_variables.$spacing-4 + size_variables.$spacing-24;
+  }
 
-div > .ember-power-select-options {
-  background: $white;
-  border: $base-border;
-  box-shadow: $box-shadow-middle;
-  margin: -4px $spacing-8 0;
-  padding: $spacing-4 0;
+  div > .ember-power-select-options {
+    background: hsl(0, 0%, 100%);
+    border: box-shadow_variables.$base-border;
+    box-shadow: box-shadow_variables.$box-shadow-middle;
+    margin: -4px size_variables.$spacing-8 0;
+    padding: size_variables.$spacing-4 0;
+
+    .ember-power-select-option,
+    .ember-power-select-option[aria-current='true'] {
+      align-items: center;
+      display: flex;
+      justify-content: space-between;
+    }
 
-  .ember-power-select-option,
-  .ember-power-select-option[aria-current='true'] {
+    .ember-power-select-option[aria-current='true'] {
+      background-color: var(--token-color-surface-faint);
+      color: var(--token-color-foreground-primary);
+    }
+
+    .ember-power-select-option--no-matches-message {
+      color: var(--token-color-palette-neutral-400);
+      font-size: var(--token-typography-body-200-font-size);
+      font-weight: var(--token-typography-font-weight-semibold);
+      text-transform: uppercase;
+
+      &:hover,
+      &:focus {
+        background: transparent;
+        color: var(--token-color-palette-neutral-400);
+      }
+    }
+  }
+
+  .search-select-list-item {
     align-items: center;
     display: flex;
+    padding: size_variables.$spacing-4;
     justify-content: space-between;
-  }
+    border-bottom: box-shadow_variables.$light-border;
 
-  .ember-power-select-option[aria-current='true'] {
-    background-color: $ui-gray-050;
-    color: $ui-gray-900;
-  }
+    .list-item-text {
+      max-width: 200px;
+    }
 
-  .ember-power-select-option--no-matches-message {
-    color: $grey;
-    font-size: $size-8;
-    font-weight: $font-weight-semibold;
-    text-transform: uppercase;
+    .control .button {
+      color: var(--token-color-palette-neutral-300);
+      min-width: auto;
 
-    &:hover,
-    &:focus {
-      background: transparent;
-      color: $grey;
+      &:hover,
+      &:focus {
+        color: var(--token-color-foreground-action);
+      }
     }
   }
-}
-
-.search-select-list-item {
-  align-items: center;
-  display: flex;
-  padding: $spacing-4;
-  justify-content: space-between;
-  border-bottom: $light-border;
-
-  .control .button {
-    color: $grey-light;
-    min-width: auto;
+  .ember-power-select-dropdown.ember-basic-dropdown-content {
+    animation: none;
 
-    &:hover,
-    &:focus {
-      color: $blue;
+    .ember-power-select-options {
+      animation: drop-fade-above 0.15s;
     }
   }
 }
 
 .search-select-list-key {
   color: var(--token-color-foreground-faint);
-  font-size: $size-8;
-}
-
-.ember-power-select-dropdown.ember-basic-dropdown-content {
-  animation: none;
-
-  .ember-power-select-options {
-    animation: drop-fade-above 0.15s;
-  }
+  font-size: var(--token-typography-body-200-font-size);
 }
 
 .search-select .search-icon {
diff --git a/ui/app/styles/components/secrets-engines-card.scss b/ui/app/styles/components/secrets-engines-card.scss
index 2087c84ca0c..38cf86d7b4d 100644
--- a/ui/app/styles/components/secrets-engines-card.scss
+++ b/ui/app/styles/components/secrets-engines-card.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/components/selectable-card-container.scss b/ui/app/styles/components/selectable-card-container.scss
index 3156eac48da..e6d07434b3d 100644
--- a/ui/app/styles/components/selectable-card-container.scss
+++ b/ui/app/styles/components/selectable-card-container.scss
@@ -1,5 +1,8 @@
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,7 +26,7 @@
   grid-template-rows: repeat(2, 1fr);
   grid-gap: 2rem;
 
-  @include until($mobile) {
+  @include mixins.until(size_variables.$mobile) {
     grid-template-columns: 2fr;
   }
 }
diff --git a/ui/app/styles/components/selectable-card.scss b/ui/app/styles/components/selectable-card.scss
index cb3fef378c9..34127d7ca93 100644
--- a/ui/app/styles/components/selectable-card.scss
+++ b/ui/app/styles/components/selectable-card.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,11 +16,6 @@
     opacity: 0.5;
   }
 
-  &.small-card {
-    width: 6.5rem;
-    min-height: 8rem;
-  }
-
   &.card-width-20 {
     width: 20rem;
   }
diff --git a/ui/app/styles/components/shamir-progress.scss b/ui/app/styles/components/shamir-progress.scss
index dfa02f38c1e..8efb63933d0 100644
--- a/ui/app/styles/components/shamir-progress.scss
+++ b/ui/app/styles/components/shamir-progress.scss
@@ -1,17 +1,19 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .shamir-progress {
   .shamir-progress-progress {
     display: inline-block;
-    margin-top: $spacing-8;
-    margin-right: $spacing-12;
+    margin-top: size_variables.$spacing-8;
+    margin-right: size_variables.$spacing-12;
   }
   .progress {
-    box-shadow: 0 0 0 4px $ui-gray-050;
-    margin-top: $spacing-8;
+    box-shadow: 0 0 0 4px var(--token-color-palette-neutral-50);
+    margin-top: size_variables.$spacing-8;
     min-width: 90px;
   }
 }
diff --git a/ui/app/styles/components/sidebar.scss b/ui/app/styles/components/sidebar.scss
index 57748468f15..700c5ef9a4d 100644
--- a/ui/app/styles/components/sidebar.scss
+++ b/ui/app/styles/components/sidebar.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,19 +10,19 @@
 
   .popup-menu-content {
     .menu-label {
-      color: $black;
-      font-size: 14px;
-      font-weight: $font-weight-bold;
+      color: hsl(0, 0%, 4%);
+      font-size: var(--token-typography-body-200-font-size);
+      font-weight: var(--token-typography-font-weight-bold);
       text-transform: unset;
     }
     .token-alert {
-      padding: $spacing-8;
+      padding: size_variables.$spacing-8;
     }
   }
 
   .confirm-action-message p {
-    padding-top: $spacing-4;
-    font-weight: $font-weight-semibold;
-    color: $black;
+    padding-top: size_variables.$spacing-4;
+    font-weight: var(--token-typography-font-weight-semibold);
+    color: hsl(0, 0%, 4%);
   }
 }
diff --git a/ui/app/styles/components/splash-page.scss b/ui/app/styles/components/splash-page.scss
index ff9384b9db7..36e3542915a 100644
--- a/ui/app/styles/components/splash-page.scss
+++ b/ui/app/styles/components/splash-page.scss
@@ -1,30 +1,42 @@
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .splash-page-logo {
-  padding: $spacing-8 $spacing-12 $spacing-8 $spacing-24;
+  padding: size_variables.$spacing-8 size_variables.$spacing-12 size_variables.$spacing-8
+    size_variables.$spacing-24;
 
-  @include from($mobile) {
-    padding-left: $spacing-8;
+  @include mixins.from(size_variables.$mobile) {
+    padding-left: size_variables.$spacing-8;
   }
 
   svg {
-    fill: $white;
+    fill: hsl(0, 0%, 100%);
     height: 24px;
     width: 72px;
 
-    @include from($mobile) {
-      margin-left: $spacing-8;
+    @include mixins.from(size_variables.$mobile) {
+      margin-left: size_variables.$spacing-8;
     }
   }
 }
 
 .splash-page-container {
-  margin: $spacing-36 0;
+  margin: size_variables.$spacing-36 0;
 }
 
 .splash-page-header {
-  padding: $spacing-14 0;
+  padding: size_variables.$spacing-14 0;
+}
+
+// Override default SplashPage styling which uses styles in columns.scss
+.wide-content {
+  .column.is-4-desktop {
+    max-width: 640px;
+    width: 75%;
+  }
 }
diff --git a/ui/app/styles/components/stat-text.scss b/ui/app/styles/components/stat-text.scss
index b160c64523d..d54b020a010 100644
--- a/ui/app/styles/components/stat-text.scss
+++ b/ui/app/styles/components/stat-text.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,98 +14,98 @@
   &.l,
   &.m {
     .stat-label {
-      font-size: $size-5;
-      font-weight: $font-weight-semibold;
-      margin-bottom: $spacing-4;
+      font-size: var(--token-typography-body-300-font-size);
+      font-weight: var(--token-typography-font-weight-semibold);
+      margin-bottom: size_variables.$spacing-4;
       line-height: inherit;
     }
     .stat-text {
-      font-size: $size-8;
-      font-weight: $font-weight-normal;
-      color: $ui-gray-700;
+      font-size: var(--token-typography-body-200-font-size);
+      font-weight: var(--token-typography-font-weight-regular);
+      color: var(--token-color-foreground-faint);
       line-height: inherit;
     }
     .stat-value {
-      font-size: $size-3;
-      font-weight: $font-weight-normal;
-      margin-top: $spacing-12;
+      font-size: size_variables.$size-3;
+      font-weight: var(--token-typography-font-weight-regular);
+      margin-top: size_variables.$spacing-12;
     }
   }
 
   &.s {
     .stat-label {
-      font-size: $size-5;
-      font-weight: $font-weight-semibold;
+      font-size: size_variables.$size-5;
+      font-weight: var(--token-typography-font-weight-semibold);
       line-height: inherit;
     }
     .stat-text {
-      font-size: $size-8;
-      font-weight: $font-weight-normal;
-      color: $ui-gray-700;
+      font-size: var(--token-typography-body-200-font-size);
+      font-weight: var(--token-typography-font-weight-regular);
+      color: var(--token-color-foreground-faint);
       line-height: inherit;
     }
     .stat-value {
-      font-size: $size-5;
-      font-weight: $font-weight-normal;
-      margin-top: $spacing-12;
+      font-size: size_variables.$size-5;
+      font-weight: var(--token-typography-font-weight-regular);
+      margin-top: size_variables.$spacing-12;
     }
   }
 
   &.l-no-subText {
     .stat-label {
-      font-size: $size-5;
-      font-weight: $font-weight-semibold;
+      font-size: size_variables.$size-5;
+      font-weight: var(--token-typography-font-weight-semibold);
       line-height: inherit;
     }
     .stat-text {
-      font-size: $size-8;
-      font-weight: $font-weight-normal;
-      color: $ui-gray-700;
+      font-size: var(--token-typography-body-200-font-size);
+      font-weight: var(--token-typography-font-weight-regular);
+      color: var(--token-color-foreground-faint);
       line-height: inherit;
     }
     .stat-value {
-      font-size: $size-3;
-      font-weight: $font-weight-normal;
-      margin-top: $spacing-4;
+      font-size: size_variables.$size-3;
+      font-weight: var(--token-typography-font-weight-regular);
+      margin-top: size_variables.$spacing-4;
     }
   }
 
   &.m-no-subText {
     .stat-label {
-      font-size: $size-8;
-      font-weight: $font-weight-bold;
+      font-size: var(--token-typography-body-200-font-size);
+      font-weight: var(--token-typography-font-weight-bold);
       line-height: inherit;
     }
     .stat-text {
-      font-size: $size-8;
-      font-weight: $font-weight-normal;
-      color: $ui-gray-700;
+      font-size: var(--token-typography-body-200-font-size);
+      font-weight: var(--token-typography-font-weight-regular);
+      color: var(--token-color-foreground-faint);
       line-height: inherit;
     }
     .stat-value {
-      font-size: $size-5;
-      font-weight: $font-weight-normal;
-      margin-top: $spacing-4;
+      font-size: size_variables.$size-5;
+      font-weight: var(--token-typography-font-weight-regular);
+      margin-top: size_variables.$spacing-4;
     }
   }
 
   &.s-no-subText {
     .stat-label {
-      font-size: $size-8;
-      font-weight: $font-weight-normal;
-      color: $ui-gray-500;
+      font-size: var(--token-typography-body-200-font-size);
+      font-weight: var(--token-typography-font-weight-regular);
+      color: var(--token-color-palette-neutral-400);
       line-height: inherit;
     }
     .stat-text {
-      font-size: $size-8;
-      font-weight: $font-weight-normal;
-      color: $ui-gray-700;
+      font-size: var(--token-typography-body-200-font-size);
+      font-weight: var(--token-typography-font-weight-regular);
+      color: var(--token-color-foreground-faint);
       line-height: inherit;
     }
     .stat-value {
-      font-size: $size-8;
-      font-weight: $font-weight-normal;
-      color: $ui-gray-800;
+      font-size: var(--token-typography-body-200-font-size);
+      font-weight: var(--token-typography-font-weight-regular);
+      color: var(--token-color-foreground-primary);
       line-height: inherit;
     }
   }
diff --git a/ui/app/styles/components/tabs-component.scss b/ui/app/styles/components/tabs-component.scss
index ff241da49f1..f4b2d1e0e71 100644
--- a/ui/app/styles/components/tabs-component.scss
+++ b/ui/app/styles/components/tabs-component.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +13,7 @@
 
 .tabs {
   align-items: stretch;
-  box-shadow: inset 0 -1px 0 $grey-light;
+  box-shadow: inset 0 -1px 0 var(--token-color-palette-neutral-300);
   display: flex;
   justify-content: space-between;
   overflow: hidden;
@@ -30,22 +32,22 @@
         box-shadow: none;
       }
       &.active {
-        border-color: $blue;
-        color: $blue;
+        border-color: var(--token-color-palette-blue-200);
+        color: var(--token-color-foreground-action);
       }
     }
     li {
       // solves for tools -> sub-tabs like "Unwrap data" -> "Data"
       &.is-active {
-        border-bottom: 2px solid $blue;
-        color: $blue;
+        border-bottom: 2px solid var(--token-color-palette-blue-200);
+        color: var(--token-color-foreground-action);
       }
       // solves for tabs on auth mounts & secrets engines
       > a {
         &.active {
-          color: $blue;
+          color: var(--token-color-foreground-action);
           background-color: transparent;
-          border-bottom: 2px solid $blue;
+          border-bottom: 2px solid var(--token-color-palette-blue-200);
         }
       }
     }
@@ -57,8 +59,8 @@
     }
     &.active a,
     &.is-active a {
-      border-color: $blue;
-      color: $blue;
+      border-color: var(--token-color-palette-blue-200);
+      color: var(--token-color-foreground-action);
     }
   }
   // important for auth tabs in active state, otherwise the border-bottom will not show.
@@ -68,20 +70,22 @@
     justify-content: center;
     vertical-align: top;
     border-bottom: 2px solid transparent;
-    color: $grey;
-    font-weight: $font-weight-semibold;
-    padding: $spacing-14 $spacing-12 $spacing-12;
+    color: var(--token-color-palette-neutral-400);
+    font-weight: var(--token-typography-font-weight-semibold);
+    padding: size_variables.$spacing-14 size_variables.$spacing-12 size_variables.$spacing-12;
     text-decoration: none;
-    transition: background-color $speed, border-color $speed;
+    transition:
+      background-color size_variables.$speed,
+      border-color size_variables.$speed;
 
     &:hover,
     &:active {
-      border-color: $grey-light;
+      border-color: var(--token-color-palette-neutral-300);
     }
 
     &:hover {
-      background-color: $ui-gray-050;
-      color: $grey-darkest;
+      background-color: var(--token-color-surface-faint);
+      color: var(--token-color-foreground-primary);
     }
   }
 
diff --git a/ui/app/styles/components/text-file.scss b/ui/app/styles/components/text-file.scss
index 3631e6e1efa..e084b8173ad 100644
--- a/ui/app/styles/components/text-file.scss
+++ b/ui/app/styles/components/text-file.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/components/tool-tip.scss b/ui/app/styles/components/tool-tip.scss
deleted file mode 100644
index e77d90033e4..00000000000
--- a/ui/app/styles/components/tool-tip.scss
+++ /dev/null
@@ -1,75 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-.tool-tip {
-  font-size: $size-7;
-  text-transform: none;
-  margin: 8px 0px 0 -4px;
-  border: none;
-  border-radius: $radius-large;
-
-  .box {
-    position: relative;
-    color: $white;
-    max-width: 200px;
-    background: $black;
-    padding: 0.5rem;
-    line-height: 1.4;
-    border-radius: $radius-large;
-  }
-
-  .fit-content {
-    max-width: fit-content;
-  }
-
-  @include css-top-arrow(8px, $black, 1px, $black, 20px);
-  &.ember-basic-dropdown-content--below.ember-basic-dropdown--transitioning-in {
-    animation: drop-fade-above 0.15s;
-  }
-  &.ember-basic-dropdown-content--below.ember-basic-dropdown--transitioning-out {
-    animation: drop-fade-above 0.15s reverse;
-  }
-  &.ember-basic-dropdown-content--above.ember-basic-dropdown--transitioning-in {
-    animation: drop-fade-below 0.15s;
-  }
-  &.ember-basic-dropdown-content--above.ember-basic-dropdown--transitioning-out {
-    animation: drop-fade-below 0.15s reverse;
-  }
-  &.smaller-font {
-    font-size: $size-8;
-  }
-}
-
-.ember-basic-dropdown-content--left.tool-tip {
-  margin: 8px 0 0 -2px;
-
-  &::before,
-  &::after {
-    right: auto;
-    left: $spacing-12;
-  }
-}
-.ember-basic-dropdown-content--right.tool-tip {
-  margin: 8px -11px;
-}
-
-.ember-basic-dropdown-content--below.ember-basic-dropdown-content--left.tool-tip {
-  @include css-top-arrow(8px, $black, 1px, $black, calc(100% - 20px));
-}
-.ember-basic-dropdown-content--below.ember-basic-dropdown-content--right.tool-tip {
-  @include css-top-arrow(8px, $black, 1px, $black, calc(100% - 20px));
-}
-.ember-basic-dropdown-content--above.tool-tip {
-  @include css-bottom-arrow(8px, $black, 1px, $black);
-  margin-top: -8px;
-}
-.ember-basic-dropdown-content--above.ember-basic-dropdown-content--right.tool-tip {
-  @include css-bottom-arrow(8px, $black, 1px, $black, calc(100% - 20px));
-}
-
-.b-checkbox .tool-tip-trigger {
-  position: relative;
-  top: -3px;
-}
diff --git a/ui/app/styles/components/toolbar.scss b/ui/app/styles/components/toolbar.scss
index bfbe4fabfc8..3cb13493674 100644
--- a/ui/app/styles/components/toolbar.scss
+++ b/ui/app/styles/components/toolbar.scss
@@ -1,5 +1,10 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/mixins';
+@use '../utils/size_variables';
+@use '../core/buttons.scss';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,20 +13,24 @@
 }
 
 .toolbar {
-  background-color: $ui-gray-010;
-  border: 1px solid $ui-gray-100;
-  border-bottom-color: $ui-gray-300;
-  border-top-color: $ui-gray-300;
+  background-color: var(--token-color-surface-faint);
+  border: 1px solid var(--token-color-palette-neutral-100);
+  border-bottom-color: var(--token-color-palette-neutral-300);
+  border-top-color: var(--token-color-palette-neutral-300);
   position: relative;
 
   &::after {
-    background: linear-gradient(to right, $ui-gray-010, rgba($ui-gray-010, 0));
+    background: linear-gradient(
+      to right,
+      var(--token-color-palette-neutral-50),
+      rgba(var(--token-color-palette-neutral-50), 0)
+    );
     bottom: 0;
     content: '';
     position: absolute;
     right: 0;
     top: 0;
-    width: $spacing-4;
+    width: size_variables.$spacing-4;
     z-index: 2;
   }
 
@@ -32,8 +41,8 @@
 }
 
 .toolbar-label {
-  padding: $spacing-8;
-  color: $grey;
+  padding: size_variables.$spacing-8;
+  color: var(--token-color-palette-neutral-400);
 }
 
 .toolbar-scroller {
@@ -41,21 +50,20 @@
   display: flex;
   height: 3rem;
   justify-content: space-between;
-  overflow-x: auto;
   width: 100%;
 
-  @include from($mobile) {
-    padding: 0 $spacing-4;
+  @include mixins.from(size_variables.$mobile) {
+    padding: 0 size_variables.$spacing-4;
   }
 
   &::-webkit-scrollbar {
-    border-bottom: $base-border;
-    height: $spacing-4;
+    border-bottom: box-shadow_variables.$base-border;
+    height: size_variables.$spacing-4;
   }
 
   &::-webkit-scrollbar-thumb {
-    background: $ui-gray-300;
-    border-radius: $spacing-4;
+    background: var(--token-color-surface-strong);
+    border-radius: var(--token-border-radius-small);
   }
 }
 
@@ -72,15 +80,15 @@
 }
 
 .toolbar-filters + .toolbar-actions {
-  @include until($mobile) {
-    border-left: $base-border;
-    margin-left: $spacing-8;
-    padding-left: $spacing-8;
+  @include mixins.until(size_variables.$mobile) {
+    border-left: box-shadow_variables.$base-border;
+    margin-left: size_variables.$spacing-8;
+    padding-left: size_variables.$spacing-8;
   }
 }
 
 .toolbar-actions {
-  @include from($mobile) {
+  @include mixins.from(size_variables.$mobile) {
     justify-content: flex-end;
   }
 }
@@ -90,13 +98,13 @@
   @extend .is-ghost;
   @extend .has-icon-right;
   border: 0;
-  color: $black;
-  transition: background-color $speed;
+  color: hsl(0, 0%, 4%);
+  transition: background-color size_variables.$speed;
 
   &:hover:not(.disabled) {
-    background-color: $ui-gray-100;
+    background-color: var(--token-color-surface-strong);
     border: 0;
-    color: $blue;
+    color: var(--token-color-foreground-action);
   }
 
   &:active {
@@ -105,7 +113,7 @@
 
   &.popup-menu-trigger {
     height: 2.5rem;
-    padding: $spacing-8 $spacing-12;
+    padding: size_variables.$spacing-8 size_variables.$spacing-12;
   }
 
   &.disabled {
@@ -121,18 +129,22 @@
   }
 }
 a.disabled.toolbar-link {
-  color: $black;
-  background-color: $white;
+  color: hsl(0, 0%, 4%);
+  background-color: hsl(0, 0%, 100%);
   cursor: not-allowed;
   &:hover {
-    background-color: $ui-gray-100;
-    color: $blue;
+    background-color: var(--token-color-surface-strong);
+    color: var(--token-color-foreground-action);
   }
 }
 
 .toolbar-separator {
-  border-right: $light-border;
+  border-right: box-shadow_variables.$light-border;
   height: 32px;
-  margin: 0 $spacing-8;
+  margin: 0 size_variables.$spacing-8;
   width: 0;
 }
+
+.segment-filter {
+  width: min-content;
+}
diff --git a/ui/app/styles/components/transform-edit.scss b/ui/app/styles/components/transform-edit.scss
index af47f8a37ca..37193727b65 100644
--- a/ui/app/styles/components/transform-edit.scss
+++ b/ui/app/styles/components/transform-edit.scss
@@ -1,19 +1,21 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .copy-text {
-  background: $ui-gray-010;
+  background: var(--token-color-surface-faint);
 
   & > code {
-    color: $ui-gray-800;
+    color: var(--token-color-foreground-primary);
     padding: 14px;
   }
 }
 .transform-pattern-text div:not(:first-child) {
-  font-family: $family-monospace;
+  font-family: var(--token-typography-font-stack-code);
 }
 .transform-decode-formats:not(:last-child) {
-  margin-bottom: $spacing-12;
+  margin-bottom: size_variables.$spacing-12;
 }
diff --git a/ui/app/styles/components/transit-card.scss b/ui/app/styles/components/transit-card.scss
index 28d5cc1c298..febb7dac7a3 100644
--- a/ui/app/styles/components/transit-card.scss
+++ b/ui/app/styles/components/transit-card.scss
@@ -1,5 +1,8 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,15 +12,15 @@
   grid-template-rows: 1fr;
   align-content: start;
   grid-gap: 2rem;
-  margin-top: $spacing-24;
+  margin-top: size_variables.$spacing-24;
 }
 
 .transit-card {
-  border-radius: $radius;
-  box-shadow: 0 0 0 1px rgba($grey-light, 0.4);
+  border-radius: var(--token-border-radius-x-small);
+  box-shadow: 0 0 0 1px rgba(var(--token-color-palette-neutral-300), 0.4);
   display: grid;
   grid-template-columns: 0.45fr 2fr;
-  padding: $spacing-16;
+  padding: size_variables.$spacing-16;
   border: none;
 
   .transit-icon {
@@ -25,20 +28,22 @@
   }
 
   .transit-action-description {
-    font-family: $family-sans;
-    font-size: $size-8;
-    color: $grey;
+    font-family: var(--token-typography-font-stack-text);
+    font-size: var(--token-typography-body-200-font-size);
+    color: var(--token-color-palette-neutral-400);
   }
 
   .title {
-    color: $grey;
-    font-size: $size-7;
-    margin-bottom: $spacing-4;
+    color: var(--token-color-palette-neutral-400);
+    font-size: size_variables.$size-7;
+    margin-bottom: size_variables.$spacing-4;
   }
 
   &:hover {
-    box-shadow: 0 0 0 1px $blue-500, $box-shadow-middle;
-    background: $blue-010;
+    box-shadow:
+      0 0 0 1px var(--token-color-palette-blue-200),
+      box-shadow_variables.$box-shadow-middle;
+    background: var(--token-color-palette-blue-50);
 
     .title {
       color: initial;
diff --git a/ui/app/styles/components/ttl-picker.scss b/ui/app/styles/components/ttl-picker.scss
index 4d445a839c6..0cbcf72ca36 100644
--- a/ui/app/styles/components/ttl-picker.scss
+++ b/ui/app/styles/components/ttl-picker.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,13 +8,13 @@
 }
 
 .ttl-picker-label {
-  font-weight: bold;
+  font-weight: var(--token-typography-font-weight-bold);
 }
 
 input.has-error,
 input.has-error:focus,
 input.has-error:hover {
-  border-color: $red-dark;
+  border-color: var(--token-color-palette-red-300);
 }
 
 .ttl-value-error {
diff --git a/ui/app/styles/components/type-form.scss b/ui/app/styles/components/type-form.scss
new file mode 100644
index 00000000000..af78852a4a5
--- /dev/null
+++ b/ui/app/styles/components/type-form.scss
@@ -0,0 +1,24 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+.selectable-engine-card {
+  &:hover:not(.disabled),
+  &:focus,
+  &:focus-visible {
+    cursor: pointer;
+    box-shadow: var(--token-focus-ring-action-box-shadow);
+  }
+
+  &.small-card {
+    width: 8rem;
+    min-height: 8rem;
+  }
+}
+
+/* Vertical divider between enabled and disabled plugins */
+.selectable-engines-vertical-divider {
+  border-left: 2px solid var(--token-color-border-primary);
+  align-self: stretch;
+}
diff --git a/ui/app/styles/components/ui-wizard.scss b/ui/app/styles/components/ui-wizard.scss
deleted file mode 100644
index fc1af827d82..00000000000
--- a/ui/app/styles/components/ui-wizard.scss
+++ /dev/null
@@ -1,250 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// This file is not being used. https://github.com/hashicorp/vault/pull/19220
-.ui-wizard-container {
-  display: flex;
-  flex-direction: column;
-  flex-grow: 1;
-}
-
-.ui-wizard-container .app-content {
-  display: flex;
-  flex-direction: column;
-  flex-grow: 1;
-  transition: padding $speed;
-  will-change: padding;
-  padding: env(safe-area-inset-top) env(safe-area-inset-right) env(safe-area-inset-bottom)
-    env(safe-area-inset-left);
-}
-
-.ui-wizard-container .app-content.wizard-open {
-  padding-right: 324px;
-  padding-right: calc(324px + env(safe-area-inset-right));
-
-  @include until($mobile) {
-    padding-right: 0;
-    padding-bottom: 50vh;
-  }
-}
-
-.ui-wizard {
-  z-index: 300;
-  padding: $spacing-18;
-  width: $drawer-width;
-  background: $white;
-  box-shadow: $box-shadow, $box-shadow-highest;
-  position: fixed;
-  right: $size-8;
-  bottom: $size-8;
-  top: calc(#{4rem} + #{$size-8});
-  overflow: auto;
-
-  p {
-    line-height: 1.33;
-  }
-
-  @include until($mobile) {
-    box-shadow: $box-shadow, 0 0 20px rgba($black, 0.24);
-    bottom: 0;
-    left: 0;
-    right: 0;
-    top: 50%;
-    width: auto;
-  }
-
-  .doc-link {
-    margin-top: $spacing-18;
-    display: block;
-  }
-
-  pre code {
-    background: $ui-gray-050;
-    margin: $spacing-12 0;
-  }
-}
-
-.wizard-header {
-  border-bottom: $light-border;
-  padding: 0 $spacing-20 $spacing-12 0;
-  margin: $spacing-20 0;
-  position: relative;
-
-  @include until($mobile) {
-    margin-top: 0;
-    padding-top: 0;
-  }
-}
-
-.wizard-dismiss-menu {
-  position: absolute;
-  right: 0;
-  top: -$size-11;
-  z-index: 10;
-}
-
-.ui-wizard.collapsed {
-  animation: drop-fade-above $speed-slow;
-  color: $white;
-  background: $black;
-  bottom: auto;
-  box-shadow: $box-shadow-middle;
-  height: auto;
-  min-height: 0;
-  padding-bottom: $spacing-4;
-  position: fixed;
-  right: $size-8;
-  top: calc(#{4rem} + #{$size-8});
-
-  @include until($mobile) {
-    box-shadow: $box-shadow, 0 0 20px rgba($black, 0.24);
-    bottom: 0;
-    left: 0;
-    right: 0;
-    top: auto;
-    width: auto;
-  }
-
-  .title {
-    color: $white;
-  }
-
-  .wizard-header {
-    border-bottom: 0;
-    margin: 0 0 $spacing-8;
-    padding-top: 0;
-  }
-
-  .wizard-dismiss-menu {
-    svg {
-      color: $white;
-    }
-
-    &:hover svg {
-      color: $black;
-    }
-  }
-}
-
-.wizard-divider-box {
-  background: none;
-  box-shadow: none;
-  margin: $spacing-12 0 0;
-  padding: 0 $spacing-12;
-  border-top: solid 1px $white;
-  border-image: linear-gradient(to right, $grey-dark, $grey) 1;
-  border-width: 1px 0 0;
-  button {
-    font-size: $size-7;
-    font-weight: $font-weight-semibold;
-  }
-}
-
-.wizard-section:last-of-type {
-  margin-bottom: $spacing-18;
-}
-
-.wizard-section button:not(:last-of-type) {
-  margin-bottom: $spacing-8;
-}
-
-.wizard-details {
-  padding-top: $spacing-20;
-  margin-top: $spacing-20;
-  border-top: 1px solid $grey-light;
-}
-
-.wizard-instructions {
-  margin: $spacing-20 0;
-}
-
-.selection-summary {
-  display: flex;
-  align-items: center;
-  width: 100%;
-  justify-content: space-between;
-}
-
-.time-estimate {
-  align-items: center;
-  color: $grey;
-  display: flex;
-  font-size: 12px;
-}
-
-.progress-container {
-  align-items: center;
-  background: $white;
-  bottom: 0;
-  height: $wizard-progress-bar-height;
-  display: flex;
-  left: 0;
-  padding: 0;
-  position: absolute;
-  right: 0;
-  transform: translateY(50%);
-  width: 100%;
-}
-
-.progress-bar {
-  background: $ui-gray-050;
-  box-shadow: inset $box-link-shadow;
-  display: flex;
-  height: $wizard-progress-bar-height;
-  position: relative;
-  width: 100%;
-}
-
-.feature-progress-container {
-  align-items: center;
-  flex: 1 0 auto;
-  padding: 0 ($wizard-progress-check-size / 4);
-  position: relative;
-}
-
-.feature-progress {
-  background: $green;
-  border-radius: $wizard-progress-bar-height;
-  height: $wizard-progress-bar-height;
-}
-
-.feature-check {
-  height: $wizard-progress-check-size;
-  left: $wizard-progress-check-size / 2;
-  position: absolute;
-  top: 50%;
-  transform: translate(-50%, -50%);
-  width: $wizard-progress-check-size;
-  z-index: 10;
-  margin: 0 !important;
-}
-
-.feature-progress-container .feature-check {
-  left: 100%;
-}
-
-.feature-progress-container:first-child {
-  padding-left: 0;
-
-  .progress-bar,
-  .feature-progress {
-    border-radius: $wizard-progress-bar-height 0 0 $wizard-progress-bar-height;
-  }
-}
-
-.feature-progress-container:first-child:last-child {
-  .progress-bar,
-  .feature-progress {
-    border-radius: $wizard-progress-bar-height;
-  }
-}
-
-.incomplete-check {
-  color: $ui-gray-200;
-}
-
-.completed-check {
-  color: $green;
-}
diff --git a/ui/app/styles/components/unseal-warning.scss b/ui/app/styles/components/unseal-warning.scss
index 2395bf98e63..3a04da9a3ca 100644
--- a/ui/app/styles/components/unseal-warning.scss
+++ b/ui/app/styles/components/unseal-warning.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/components/usage-page.scss b/ui/app/styles/components/usage-page.scss
new file mode 100644
index 00000000000..08750dc8c5d
--- /dev/null
+++ b/ui/app/styles/components/usage-page.scss
@@ -0,0 +1,5 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ */
+
+@use 'vault-reporting';
diff --git a/ui/app/styles/components/vault-loading.scss b/ui/app/styles/components/vault-loading.scss
index 8d2e6d6d095..078d574ce47 100644
--- a/ui/app/styles/components/vault-loading.scss
+++ b/ui/app/styles/components/vault-loading.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/core.scss b/ui/app/styles/core.scss
index d7732800fe6..f60828bbef8 100644
--- a/ui/app/styles/core.scss
+++ b/ui/app/styles/core.scss
@@ -1,114 +1,106 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 // Variables
-@import './utils/color_variables'; // colors need to come first.
-@import './utils/box-shadow_variables';
-@import './utils/font_variables';
-@import './utils/size_variables';
+@use 'utils/box-shadow_variables';
+@use 'utils/size_variables';
 
 // Element styling
-@import './core/element-styling';
+@use 'core/element-styling';
 
 // Mixins
-@import './utils/mixins';
-@import './utils/animations';
+@use 'utils/mixins';
+@use 'utils/animations';
 
 // Open-api styling
-@import './utils/swagger';
+@use 'utils/swagger';
 
 // Core Styles: each file styles a class that is not associated with a component. Ex: box and not box-label.
-@import './core/box';
-@import './core/buttons';
-@import './core/charts';
-@import './core/checkbox-and-radio';
-@import './core/columns';
-@import './core/containers';
-@import './core/control';
-@import './core/field';
-@import './core/file';
-@import './core/inputs';
-@import './core/json-diff-patch';
-@import './core/label';
-@import './core/level';
-@import './core/link';
-@import './core/lists';
-@import './core/menu';
-@import './core/message';
-@import './core/progress';
-@import './core/select';
-@import './core/tag';
-@import './core/title';
-@import './core/toggle';
+@use 'core/box';
+@use 'core/buttons';
+@use 'core/charts';
+@use 'core/checkbox-and-radio';
+@use 'core/columns';
+@use 'core/containers';
+@use 'core/control';
+@use 'core/field';
+@use 'core/file';
+@use 'core/inputs';
+@use 'core/json-diff-patch';
+@use 'core/label';
+@use 'core/level';
+@use 'core/link';
+@use 'core/lists';
+@use 'core/menu';
+@use 'core/message';
+@use 'core/progress';
+@use 'core/select';
+@use 'core/title';
+@use 'core/toggle';
 
 // Helpers
-@import './helper-classes/colors';
-@import './helper-classes/flexbox-and-grid';
-@import './helper-classes/layout';
-@import './helper-classes/general';
-@import './helper-classes/spacing';
-@import './helper-classes/typography';
+@use 'helper-classes/colors';
+@use 'helper-classes/flexbox-and-grid';
+@use 'helper-classes/layout';
+@use 'helper-classes/general';
+@use 'helper-classes/spacing';
+@use 'helper-classes/typography';
 
 // Component specific styling
-@import './components/auth-form';
-@import './components/autocomplete-input';
-@import './components/b64-toggle';
-@import './components/box-label';
-@import './components/calendar-widget';
-@import './components/cluster-banners';
-@import './components/codemirror';
-@import './components/console-ui-panel';
-@import './components/control-group';
-@import './components/doc-link';
-@import './components/empty-state-component';
-@import './components/env-banner';
-@import './components/features-selection';
-@import './components/form-section';
-@import './components/global-flash';
-@import './components/icon';
-@import './components/init-illustration';
-@import './components/info-table-row';
-@import './components/kmip-role-edit';
-@import './components/known-secondaries-card.scss';
-@import './components/linked-block';
-@import './components/list-item-row';
-@import './components/loader';
-@import './components/login-form';
-@import './components/masked-input';
-@import './components/namespace-picker';
-@import './components/namespace-reminder';
-@import './components/navigate-input';
-@import './components/overview-card';
-@import './components/page-header-old';
-@import './components/popup-menu';
-@import './components/radio-card';
-@import './components/radial-progress';
-@import './components/raft-join';
-@import './components/read-more';
-@import './components/regex-validator';
-@import './components/replication-dashboard';
-@import './components/replication-mode-summary';
-@import './components/replication-page';
-@import './components/replication-summary';
-@import './components/role-item';
-@import './components/search-select';
-@import './components/selectable-card';
-@import './components/selectable-card-container';
-@import './components/secrets-engines-card';
-@import './components/action-block';
-@import './components/shamir-progress';
-@import './components/sidebar';
-@import './components/splash-page';
-@import './components/stat-text';
-@import './components/tabs-component';
-@import './components/text-file';
-@import './components/toolbar';
-@import './components/tool-tip';
-@import './components/transform-edit';
-@import './components/transit-card';
-@import './components/ttl-picker';
-@import './components/unseal-warning';
-// @import './components/ui-wizard'; // remove, see PR https://github.com/hashicorp/vault/pull/19220
-@import './components/vault-loading';
+@use 'components/autocomplete-input';
+@use 'components/b64-toggle';
+@use 'components/box-label';
+@use 'components/calendar-widget';
+@use 'components/clients-counts-card.scss';
+@use 'components/clients-date-range';
+@use 'components/cluster-banners';
+@use 'components/console-ui-panel';
+@use 'components/control-group';
+@use 'components/doc-link';
+@use 'components/empty-state-component';
+@use 'components/env-banner';
+@use 'components/form-section';
+@use 'components/global-flash';
+@use 'components/icon';
+@use 'components/info-table-row';
+@use 'components/kmip-role-edit';
+@use 'components/known-secondaries-card.scss';
+@use 'components/linked-block';
+@use 'components/list-item-row';
+@use 'components/loader';
+@use 'components/masked-input';
+@use 'components/namespace-picker';
+@use 'components/navigate-input';
+@use 'components/overview-card';
+@use 'components/page-header-old';
+@use 'components/popup-menu';
+@use 'components/radio-card';
+@use 'components/radial-progress';
+@use 'components/raft-join';
+@use 'components/read-more';
+@use 'components/regex-validator';
+@use 'components/replication-dashboard';
+@use 'components/replication-page';
+@use 'components/replication-summary';
+@use 'components/role-item';
+@use 'components/search-select';
+@use 'components/selectable-card';
+@use 'components/selectable-card-container';
+@use 'components/secrets-engines-card';
+@use 'components/action-block';
+@use 'components/shamir-progress';
+@use 'components/sidebar';
+@use 'components/splash-page';
+@use 'components/stat-text';
+@use 'components/tabs-component';
+@use 'components/text-file';
+@use 'components/toolbar';
+@use 'components/transform-edit';
+@use 'components/transit-card';
+@use 'components/ttl-picker';
+@use 'components/type-form';
+@use 'components/unseal-warning';
+@use 'components/usage-page';
+@use 'components/vault-loading';
diff --git a/ui/app/styles/core/box.scss b/ui/app/styles/core/box.scss
index cbec5628de6..cd40b32ca2c 100644
--- a/ui/app/styles/core/box.scss
+++ b/ui/app/styles/core/box.scss
@@ -1,15 +1,18 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .box {
-  background-color: $white;
+  background-color: hsl(0, 0%, 100%);
   border-radius: 0;
-  box-shadow: 0 0 0 1px rgba($grey-dark, 0.3);
-  color: $ui-gray-900;
+  box-shadow: 0 0 0 1px rgba(var(--token-color-palette-neutral-500), 0.3);
+  color: var(--token-color-foreground-primary);
   display: block;
-  padding: $spacing-18;
+  padding: size_variables.$spacing-18;
 
   &:not(:last-child) {
     margin-bottom: 1.5rem;
@@ -29,12 +32,12 @@
   }
 
   &.no-top-shadow {
-    box-shadow: inset 0 -1px 0 0 rgba($black, 0.1);
+    box-shadow: inset 0 -1px 0 0 rgba(hsl(0, 0%, 4%), 0.1);
   }
 
   &.has-container {
-    box-shadow: 0 4px 4px rgba($black, 0.25);
-    border: $base-border;
-    padding: $spacing-24;
+    box-shadow: 0 4px 4px rgba(hsl(0, 0%, 4%), 0.25);
+    border: box-shadow_variables.$base-border;
+    padding: size_variables.$spacing-24;
   }
 }
diff --git a/ui/app/styles/core/buttons.scss b/ui/app/styles/core/buttons.scss
index 3bcdbf79e14..06f9fab9f42 100644
--- a/ui/app/styles/core/buttons.scss
+++ b/ui/app/styles/core/buttons.scss
@@ -1,26 +1,34 @@
+@use 'sass:color';
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .button {
   align-items: center;
-  background-color: $grey-lightest;
-  border: 1px solid $grey-light;
-  border-radius: $radius;
-  box-shadow: $box-shadow-low;
+  background-color: var(--token-color-surface-faint);
+  border: 1px solid var(--token-color-palette-neutral-300);
+  border-radius: var(--token-border-radius-x-small);
+  box-shadow: box-shadow_variables.$box-shadow-low;
   cursor: pointer;
-  color: $ui-gray-800;
+  color: var(--token-color-foreground-primary);
   display: inline-block;
-  font-size: $size-8;
-  font-weight: $font-weight-semibold;
+  font-size: var(--token-typography-body-200-font-size);
+  font-weight: var(--token-typography-font-weight-semibold);
   min-height: 2.25rem;
   min-width: 6rem;
   padding: 0.5625rem 0.9375rem;
   position: relative;
   text-align: center;
   text-decoration: none;
-  transition: background-color $speed, border-color $speed, box-shadow $speed, color $speed;
+  transition:
+    background-color size_variables.$speed,
+    border-color size_variables.$speed,
+    box-shadow size_variables.$speed,
+    color size_variables.$speed;
   user-select: none;
   vertical-align: middle;
   white-space: nowrap;
@@ -37,9 +45,9 @@
   &:active,
   &.is-active,
   &:focus {
-    border-color: darken($grey-light, 10%);
-    box-shadow: $button-box-shadow-standard;
-    color: darken($grey-dark, 10%);
+    border-color: color.adjust(#c2c5cb, $lightness: -10%);
+    box-shadow: box-shadow_variables.$button-box-shadow-standard;
+    color: color.adjust(#656a76, $lightness: -10%);
   }
 
   &:focus:not(:active) {
@@ -47,8 +55,8 @@
   }
 
   &:disabled {
-    background-color: $white;
-    border-color: $ui-gray-050;
+    background-color: hsl(0, 0%, 100%);
+    border-color: var(--token-color-palette-neutral-50);
     box-shadow: none;
     cursor: not-allowed;
     opacity: 0.5;
@@ -58,37 +66,37 @@
 
   &.is-compact {
     height: 2rem;
-    padding: $spacing-4 $spacing-12;
+    padding: size_variables.$spacing-4 size_variables.$spacing-12;
   }
 
   &.is-danger {
-    background-color: $red-500;
-    border-color: darken($red-500, 2%);
-    color: $white;
-    text-shadow: 0 1px 1px rgba($black, 0.25);
+    background-color: var(--token-color-palette-red-200);
+    border-color: color.adjust(#e52228, $lightness: -2%);
+    color: hsl(0, 0%, 100%);
+    text-shadow: 0 1px 1px rgba(hsl(0, 0%, 4%), 0.25);
 
     &:hover:not([disabled]) {
-      background-color: darken($red-500, 5%);
-      border-color: darken($red-500, 5%);
-      box-shadow: $box-shadow-middle;
+      background-color: color.adjust(#e52228, $lightness: -5%);
+      border-color: color.adjust(#e52228, $lightness: -5%);
+      box-shadow: box-shadow_variables.$box-shadow-middle;
     }
 
     &:active,
     &.is-active {
-      background-color: darken($red-500, 10%);
-      border-color: darken($red-500, 10%);
-      box-shadow: $box-shadow-middle;
+      background-color: color.adjust(#e52228, $lightness: -10%);
+      border-color: color.adjust(#e52228, $lightness: -10%);
+      box-shadow: box-shadow_variables.$box-shadow-middle;
     }
 
     &:focus {
-      border-color: darken($red-500, 10%);
-      box-shadow: $button-box-shadow-standard;
+      border-color: color.adjust(#e52228, $lightness: -10%);
+      box-shadow: box-shadow_variables.$button-box-shadow-standard;
     }
   }
 
   &.is-danger-outlined {
-    border: 1px solid $red-500;
-    color: $red-500;
+    border: 1px solid var(--token-color-palette-red-200);
+    color: var(--token-color-foreground-critical);
   }
 
   &.is-flat {
@@ -101,17 +109,17 @@
     background-color: transparent;
     border-color: transparent;
     box-shadow: none;
-    color: $blue;
+    color: var(--token-color-foreground-action);
     text-decoration: none;
 
     &:hover {
-      color: $blue-500;
-      background-color: $grey-lightest;
+      color: var(--token-color-palette-blue-500);
+      background-color: var(--token-color-palette-neutral-50);
     }
   }
 
   &.is-icon {
-    padding: 0.25rem $spacing-24;
+    padding: 0.25rem size_variables.$spacing-24;
   }
 
   &.is-loading {
@@ -119,7 +127,7 @@
     pointer-events: none;
     &::after {
       animation: spinAround 500ms infinite linear;
-      border: 2px solid $ui-gray-300;
+      border: 2px solid var(--token-color-palette-neutral-300);
       border-radius: 290486px;
       border-right-color: transparent;
       border-top-color: transparent;
@@ -136,83 +144,83 @@
   &.is-link {
     background-color: transparent;
     border-color: transparent;
-    color: $blue;
+    color: var(--token-color-foreground-action);
     text-decoration: none;
-    font-weight: $font-weight-semibold;
+    font-weight: var(--token-typography-font-weight-semibold);
     box-shadow: none;
     min-width: 4rem;
   }
 
   &.is-primary {
-    background-color: $blue;
-    border-color: darken($blue, 2%);
-    color: $white;
-    font-weight: $font-weight-bold;
-    text-shadow: 0 1px 1px rgba($black, 0.25);
+    background-color: var(--token-color-palette-blue-200);
+    border-color: color.adjust(#1060ff, $lightness: -2%);
+    color: hsl(0, 0%, 100%);
+    font-weight: var(--token-typography-font-weight-bold);
+    text-shadow: 0 1px 1px rgba(hsl(0, 0%, 4%), 0.25);
 
     &:disabled {
-      background-color: $ui-gray-700;
+      background-color: var(--token-color-palette-neutral-500);
       border-color: transparent;
       box-shadow: none;
     }
 
     &:hover:not([disabled]) {
-      background-color: darken($blue, 5%);
-      border-color: darken($blue, 5%);
-      box-shadow: $box-shadow-middle;
+      background-color: color.adjust(#1060ff, $lightness: -5%);
+      border-color: color.adjust(#1060ff, $lightness: -5%);
+      box-shadow: box-shadow_variables.$box-shadow-middle;
     }
 
     &:active,
     &.is-active {
-      background-color: darken($blue, 10%);
-      border-color: darken($blue, 10%);
-      box-shadow: $box-shadow-middle;
+      background-color: color.adjust(#1060ff, $lightness: -10%);
+      border-color: color.adjust(#1060ff, $lightness: -10%);
+      box-shadow: box-shadow_variables.$box-shadow-middle;
     }
 
     &:focus {
-      border-color: darken($blue, 10%);
-      box-shadow: $button-box-shadow-standard;
+      border-color: color.adjust(#1060ff, $lightness: -10%);
+      box-shadow: box-shadow_variables.$button-box-shadow-standard;
     }
 
     &.is-loading::after {
-      border-color: transparent transparent $white $white;
+      border-color: transparent transparent hsl(0, 0%, 100%) hsl(0, 0%, 100%);
     }
 
     &.is-underlined {
       &:active,
       &.is-active {
         background-color: transparent;
-        border-bottom: 2px solid darken($blue, 10%);
+        border-bottom: 2px solid color.adjust(#1060ff, $lightness: -10%);
         border-radius: unset;
-        color: darken($blue, 10%);
+        color: color.adjust(#1060ff, $lightness: -10%);
       }
     }
     // is-primary.is-outlined the only is-outlined buttons are primary.
     &.is-outlined {
       background-color: transparent;
-      border-color: $blue;
-      color: $blue;
+      border-color: var(--token-color-palette-blue-200);
+      color: var(--token-color-foreground-action);
 
       &:hover,
       &:focus {
         background-color: transparent;
-        border-color: darken($blue, 10%);
-        color: $blue;
+        border-color: color.adjust(#1060ff, $lightness: -10%);
+        color: var(--token-color-foreground-action);
       }
 
       &:active,
       &.is-active {
         background-color: transparent;
-        border-color: darken($blue, 10%);
-        color: darken($blue, 10%);
+        border-color: color.adjust(#1060ff, $lightness: -10%);
+        color: color.adjust(#1060ff, $lightness: -10%);
       }
     }
 
     &.is-outlined [disabled] {
       background-color: transparent;
-      border-color: $ui-gray-700;
+      border-color: var(--token-color-palette-neutral-500);
       box-shadow: none;
-      color: $ui-gray-700;
+      color: var(--token-color-foreground-faint);
     }
   }
 
@@ -227,7 +235,7 @@
   // End of button types
 
   &.tool-tip-trigger {
-    color: $grey-dark;
+    color: var(--token-color-foreground-faint);
     min-width: auto;
     padding: 0;
   }
@@ -246,7 +254,7 @@
       &,
       &:first-child:last-child {
         position: relative;
-        left: -$size-10;
+        left: -(size_variables.$size-10);
       }
     }
   }
@@ -255,8 +263,8 @@
     .hs-icon {
       &,
       &:first-child:last-child {
-        margin-left: $spacing-4;
-        margin-right: -$spacing-4;
+        margin-left: size_variables.$spacing-4;
+        margin-right: -(size_variables.$spacing-4);
       }
     }
   }
@@ -264,7 +272,7 @@
 
 .button.icon {
   box-sizing: border-box;
-  padding: 0 $spacing-4;
+  padding: 0 size_variables.$spacing-4;
   height: 24px;
   width: 24px;
   &,
@@ -281,8 +289,8 @@
 }
 
 a.button.disabled {
-  color: $white;
-  background-color: $grey-dark;
+  color: hsl(0, 0%, 100%);
+  background-color: var(--token-color-palette-neutral-500);
   opacity: 0.5;
   border-color: transparent;
   box-shadow: none;
@@ -305,7 +313,7 @@ a.button.disabled {
   cursor: pointer;
 
   &:disabled {
-    color: $grey-light;
+    color: var(--token-color-palette-neutral-300);
     cursor: not-allowed;
   }
 }
@@ -313,19 +321,19 @@ a.button.disabled {
 // TODO HDS adoption cleanup: audit styles with design and see what to keep/remove once buttons are fully HDS
 // Existing class on <Hds::Copy::Button> component, modifying to match existing UI Structure buttons
 .hds-copy-button {
-  font-weight: $font-weight-semibold; // TODO delete
-  box-shadow: $box-shadow-low; // TODO delete
+  font-weight: var(--token-typography-font-weight-semibold); // TODO delete
+  box-shadow: box-shadow_variables.$box-shadow-low; // TODO delete
 
   &.white-icon svg {
-    color: $white;
+    color: hsl(0, 0%, 100%);
   }
 
   &.icon-grey-300 svg {
-    color: $ui-gray-300;
+    color: var(--token-color-palette-neutral-300);
   }
 
   &.icon-grey-500 svg {
-    color: $ui-gray-500;
+    color: var(--token-color-palette-neutral-400);
   }
 
   &.transparent {
@@ -333,30 +341,30 @@ a.button.disabled {
     box-shadow: none;
     border: 1px solid transparent;
     &:hover {
-      border: 1px solid $grey-light;
+      border: 1px solid var(--token-color-palette-neutral-300);
       border-color: var(--token-color-border-strong);
     }
   }
 
   &.primary {
-    background-color: $blue;
-    border-color: darken($blue, 2%);
-    color: $white;
-    font-weight: $font-weight-bold;
-    text-shadow: 0 1px 1px rgba($black, 0.25);
+    background-color: var(--token-color-palette-blue-200);
+    border-color: color.adjust(#1060ff, $lightness: -2%);
+    color: hsl(0, 0%, 100%);
+    font-weight: var(--token-typography-font-weight-bold);
+    text-shadow: 0 1px 1px rgba(hsl(0, 0%, 4%), 0.25);
     svg {
-      color: $white;
+      color: hsl(0, 0%, 100%);
     }
   }
 
   &.secondary {
-    background-color: $grey-lightest;
-    border: 1px solid $grey-light;
+    background-color: var(--token-color-surface-faint);
+    border: 1px solid var(--token-color-palette-neutral-300);
   }
 
   &.in-dropdown {
     div {
-      font-size: $size-7;
+      font-size: size_variables.$size-7;
     }
     svg {
       color: transparent;
@@ -366,17 +374,19 @@ a.button.disabled {
 
 // Existing class on <Hds::Button> component, modifying to match existing UI Structure buttons
 .hds-button {
-  font-weight: $font-weight-semibold; // TODO consult design on font weight after button class audit
+  font-weight: var(
+    --token-typography-font-weight-semibold
+  ); // TODO consult design on font weight after button class audit
   display: inline-flex; // temporarily fixes existing button alignment until we adopt Hds::ButtonSet
   // for toolbar-button must pass arg @color="secondary"
   &.toolbar-button {
-    color: $black;
+    color: hsl(0, 0%, 4%);
     background: none;
     border: none;
     box-shadow: none;
     &:hover:not(.disabled) {
-      background-color: $ui-gray-100;
-      color: $blue;
+      background-color: var(--token-color-surface-strong);
+      color: var(--token-color-foreground-action);
     }
   }
 }
diff --git a/ui/app/styles/core/charts.scss b/ui/app/styles/core/charts.scss
index f42a046d1e2..aff6ae3d419 100644
--- a/ui/app/styles/core/charts.scss
+++ b/ui/app/styles/core/charts.scss
@@ -1,265 +1,67 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-.chart-wrapper {
-  border: $light-border;
-  border-radius: $radius-large;
-  padding: $spacing-12 $spacing-24;
-  margin-bottom: $spacing-16;
-}
-
-// GRID LAYOUT //
-.single-month-grid {
-  display: grid;
-  grid-template-columns: repeat(2, 1fr);
-  gap: 2em;
-  width: 100%;
-}
-.single-month-stats {
-  display: grid;
-  grid-template-columns: repeat(3, 1fr);
-  gap: 2em;
-  width: 100%;
-  margin-bottom: 1rem;
-}
-.single-month-section-title {
-  grid-column-start: 1;
-  grid-column-end: span col3-end;
-}
-.single-month-breakdown-entity {
-  grid-column-start: 1;
-}
-.single-month-breakdown-nonentity {
-  grid-column-start: 2;
-}
-.single-month-breakdown-sync {
-  grid-column-start: 3;
-}
-
-.single-chart-grid {
-  display: grid;
-  grid-template-columns: 1fr 0.3fr 3.7fr;
-  grid-template-rows: 0.5fr 1fr 1fr 1fr 0.25fr;
-  width: 100%;
-  &.no-legend {
-    grid-template-rows: 0.5fr 1fr 1fr 0.25fr;
-  }
-}
-
-.dual-chart-grid {
-  display: grid;
-  grid-template-columns: repeat(6, 1fr);
-  grid-template-rows: 0.7fr 1fr 1fr 1fr 0.3fr;
-  width: 100%;
-}
-
-.chart-header {
-  grid-column-start: 1;
-  grid-column-end: span col4-end;
-  grid-row-start: 1;
-  box-shadow: inset 0 -1px 0 $ui-gray-200;
-}
-
-.has-header-link {
-  display: grid;
-  grid-template-columns: 4fr 1fr;
-
-  .header-right {
-    text-align: right;
-    > button {
-      &:hover,
-      &:focus {
-        background-color: transparent;
-        background-color: darken($ui-gray-050, 5%);
-        border-color: darken($ui-gray-300, 5%);
-      }
-    }
-  }
-}
-
-.chart-container-wide {
-  grid-column-start: 3;
-  grid-column-end: 4;
-  grid-row-start: 2;
-  grid-row-end: span 3;
-  justify-self: center;
-  height: 300px;
-  max-width: 700px;
-  width: 100%;
-
-  svg.chart {
-    width: 100%;
-    height: 100%;
-  }
-}
-
-.chart-container-left {
-  grid-column-start: 1;
-  grid-column-end: 4;
-  grid-row-start: 2;
-  grid-row-end: 5;
-  padding-bottom: $spacing-36;
-  margin-bottom: $spacing-12;
-  box-shadow: inset 0 -1px 0 $ui-gray-200;
+// LEGEND STYLING (positioning is in chart-container.scss)
+$single: #1c345f;
+// stacked bar chart color scheme
+$first: #4269d0;
+$second: #efb117;
+$third: #ff725c;
+$fourth: #6cc5b0;
 
-  > h2 {
-    padding-left: 18px;
+.legend-container {
+  .dots {
+    height: 10px;
+    width: 10px;
+    border-radius: 50%;
+    display: inline-block;
   }
-  > p {
-    padding-left: 18px;
+  .legend-dot-new_clients {
+    background-color: $single;
   }
-}
-
-.chart-container-right {
-  grid-column-start: 4;
-  grid-column-end: 8;
-  grid-row-start: 2;
-  grid-row-end: 5;
-  padding-bottom: $spacing-36;
-  margin-bottom: $spacing-12;
-  box-shadow: inset 0 -1px 0 $ui-gray-200;
-
-  > h2 {
-    padding-left: 18px;
+  // numbers are indices because chart legend is iterated over to ensure
+  // legend colors match the correct stacked-bar-# class below
+  .legend-dot-0 {
+    background-color: $first;
   }
-  > p {
-    padding-left: 18px;
+  .legend-dot-1 {
+    background-color: $second;
   }
-}
-
-.chart-empty-state {
-  place-self: center stretch;
-  grid-row-end: span 2;
-  grid-column-start: 1;
-  grid-column-end: span 3;
-  max-width: none;
-  padding-right: 20px;
-  padding-left: 20px;
-  display: flex;
-
-  > div {
-    box-shadow: none !important;
+  .legend-dot-2 {
+    background-color: $third;
   }
-
-  > div.empty-state {
-    white-space: nowrap;
-    align-self: stretch;
-    width: 100%;
+  .legend-dot-3 {
+    background-color: $fourth;
   }
 }
 
-.chart-subTitle {
-  grid-column-start: 1;
-  grid-column-end: 3;
-  grid-row-start: 2;
-}
-
-.data-details-top {
-  grid-column-start: 1;
-  grid-column-end: 3;
-  grid-row-start: 3;
-}
-
-.data-details-bottom {
-  grid-column-start: 1;
-  grid-column-end: 3;
-  grid-row-start: 4;
-}
-
-.timestamp {
-  grid-column: 1 / span 2;
-  grid-row-start: -2;
-  color: $ui-gray-500;
-  font-size: $size-9;
-  align-self: end;
-}
-
-.legend {
-  grid-row-start: 5;
-  grid-column-start: 2;
-  grid-column-end: 6;
-  align-self: center;
-  justify-self: center;
-  font-size: $size-9;
-}
-
-// FONT STYLES //
-
-h2.chart-title {
-  font-weight: $font-weight-bold;
-  font-size: $size-5;
-  line-height: $spacing-24;
-  margin-bottom: $spacing-4;
-}
-
-p.chart-description {
-  color: $ui-gray-700;
-  font-size: 14px;
-  line-height: 18px;
-  margin-bottom: $spacing-8;
-}
-
-p.chart-subtext {
-  color: $ui-gray-500;
-  font-size: $size-8;
-  line-height: 16px;
-  margin-top: $spacing-8;
-}
-
-h3.data-details {
-  font-weight: $font-weight-bold;
-  font-size: $size-8;
-  line-height: 14px;
-  margin-bottom: $spacing-8;
-}
-
-p.data-details {
-  font-weight: $font-weight-normal;
-  font-size: $size-4;
-}
-
-// MISC STYLES
-
-.legend-colors {
-  height: 10px;
-  width: 10px;
-  border-radius: 50%;
-  display: inline-block;
-  // numbers are indices because chart legend is iterated over
-  &.dot-0 {
-    background-color: var(--token-color-palette-blue-100);
-  }
-  &.dot-1 {
-    background-color: var(--token-color-palette-blue-300);
-  }
-  &.dot-2 {
-    background-color: var(--token-color-palette-blue-500);
-  }
-}
-
-.legend-label {
-  padding-left: $spacing-8;
-  padding-right: $spacing-36;
-}
-
 .chart-tooltip {
-  background-color: $black;
-  color: white;
-  font-size: $size-9;
+  background-color: hsl(0, 0%, 4%);
+  color: var(--token-color-foreground-high-contrast);
+  font-size: size_variables.$size-9;
   padding: 6px;
-  border-radius: $radius-large;
+  border-radius: var(--token-border-radius-small);
   flex-wrap: nowrap;
   width: fit-content;
 
   .bold {
-    font-weight: $font-weight-bold;
+    font-weight: var(--token-typography-font-weight-bold);
   }
-}
-
-.is-label-fit-content {
-  max-width: fit-content !important;
+  // styling below handles tooltip position
+  position: absolute;
+  transform-style: preserve-3d;
+  bottom: 30px;
+  left: -20px;
+  pointer-events: none;
+  width: 140px;
+  transform: translate(calc(1px * var(--x, 0)), calc(-1px * var(--y, 0)));
+  transform-origin: bottom left;
+  z-index: 100;
+  margin-bottom: size_variables.$spacing-8;
 }
 
 .chart-tooltip-arrow {
@@ -267,71 +69,13 @@ p.data-details {
   height: 0;
   border-left: 5px solid transparent;
   border-right: 5px solid transparent;
-  border-top: 9px solid $black;
+  border-top: 9px solid hsl(0, 0%, 4%);
   position: absolute;
   opacity: 0.8;
   bottom: -9px;
   left: calc(50% - 5px);
 }
 
-.has-grid {
-  g > text {
-    color: $ui-gray-500;
-    font-size: $size-9;
-  }
-
-  g > line {
-    // TODO: mix-blend doesn't work in firefox browser?
-    mix-blend-mode: darken;
-    color: $ui-gray-300;
-  }
-}
-
-.is-horizontal {
-  .tick > text {
-    font-weight: $font-weight-semibold;
-    font-size: $size-9;
-  }
-}
-
-// RESPONSIVE STYLING //
-
-@media only screen and (max-width: 950px) {
-  .dual-chart-grid {
-    display: grid;
-    grid-template-columns: repeat(2, 1fr);
-    grid-template-rows: 0.2fr 0.75fr 0.75fr 0.2fr;
-    width: 100%;
-  }
-
-  .chart-container-left {
-    grid-column-start: 1;
-    grid-column-end: 4;
-    grid-row-start: 2;
-    grid-row-end: 3;
-    margin-left: $spacing-48;
-    margin-right: $spacing-48;
-  }
-  .chart-container-right {
-    grid-column-start: 1;
-    grid-column-end: 4;
-    grid-row-start: 3;
-    grid-row-end: 4;
-    margin-left: $spacing-48;
-    margin-right: $spacing-48;
-  }
-
-  .legend {
-    grid-column-start: 2;
-    grid-row-start: 4;
-  }
-
-  .timestamp {
-    grid-column-start: 1;
-    grid-row-start: 4;
-  }
-}
-
 // LINEAL STYLING //
 .lineal-chart {
   position: relative;
@@ -341,26 +85,36 @@ p.data-details {
     overflow: visible;
   }
 }
+
 .lineal-chart-bar {
-  fill: var(--token-color-palette-blue-300);
+  fill: $single;
 }
+
 .lineal-axis {
-  color: $ui-gray-500;
+  color: var(--token-color-palette-neutral-400);
   text {
     font-size: 0.75rem;
   }
   line {
-    color: $ui-gray-300;
+    color: var(--token-color-palette-neutral-300);
   }
 }
-.lineal-tooltip-position {
-  position: absolute;
-  transform-style: preserve-3d;
-  bottom: 30px;
-  left: -20px;
-  pointer-events: none;
-  width: 140px;
-  transform: translate(calc(1px * var(--x, 0)), calc(-1px * var(--y, 0)));
-  transform-origin: bottom left;
-  z-index: 100;
+
+// @colorScale arg for Lineal::VBars is "stacked-bar", numbers are added by lineal (not 0-indexed)
+.stacked-bar-1 {
+  color: $first;
+  fill: $first;
+}
+.stacked-bar-2 {
+  color: $second;
+  fill: $second;
+}
+.stacked-bar-3 {
+  color: $third;
+  fill: $third;
+}
+// MUST BE LAST because conditionally renders and legend color mapping for stacked bars will be off otherwise
+.stacked-bar-4 {
+  color: $fourth;
+  fill: $fourth;
 }
diff --git a/ui/app/styles/core/checkbox-and-radio.scss b/ui/app/styles/core/checkbox-and-radio.scss
index c7d7e08a519..338e93b1f7b 100644
--- a/ui/app/styles/core/checkbox-and-radio.scss
+++ b/ui/app/styles/core/checkbox-and-radio.scss
@@ -1,12 +1,12 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 // This file defines the styles for .checkbox, .radio and .b-checkboxes. The prefix "b" comes from Bulma.
 
-@import '../sass-svg-uri/svg-uri';
-
 // checkbox and radio styling
 .checkbox,
 .radio {
@@ -30,7 +30,7 @@
 .radio[disabled],
 .checkbox input[disabled],
 .radio input[disabled] {
-  color: $grey;
+  color: var(--token-color-foreground-disabled);
   cursor: not-allowed;
 }
 
@@ -41,8 +41,8 @@
 
 // one-off checkbox class
 .checkbox-help-text {
-  color: $ui-gray-700;
-  font-size: $size-7;
+  color: var(--token-color-foreground-faint);
+  font-size: size_variables.$size-7;
   padding-left: 28px;
 }
 
@@ -53,9 +53,9 @@
 }
 
 .b-checkbox label::before {
-  background-color: $white;
-  border-radius: 3px;
-  border: 1px solid $ui-gray-300;
+  background-color: hsl(0, 0%, 100%);
+  border-radius: var(--token-border-radius-x-small);
+  border: 1px solid var(--token-color-palette-neutral-300);
   content: '';
   height: 17px;
   left: 0;
@@ -66,16 +66,14 @@
 }
 
 .b-checkbox input[type='checkbox']:checked + label::before {
-  border-color: $blue;
+  border-color: var(--token-color-palette-blue-200);
 }
 
 .b-checkbox input[type='checkbox']:checked + label::after,
 .b-checkbox input[type='radio']:checked + label::after {
-  font-family: $family-monospace;
+  font-family: var(--token-typography-font-stack-code);
   /*checkmark from ionicons*/
-  content: svg-uri(
-    '<svg xmlns="http://www.w3.org/2000/svg" width="12" height="12" viewBox="0 0 512 512" fill="#{$blue}"><path d="M461.6 109.6l-54.9-43.3c-1.7-1.4-3.8-2.4-6.2-2.4-2.4 0-4.6 1-6.3 2.5L194.5 323s-78.5-75.5-80.7-77.7c-2.2-2.2-5.1-5.9-9.5-5.9s-6.4 3.1-8.7 5.4c-1.7 1.8-29.7 31.2-43.5 45.8-.8.9-1.3 1.4-2 2.1-1.2 1.7-2 3.6-2 5.7 0 2.2.8 4 2 5.7l2.8 2.6s139.3 133.8 141.6 136.1c2.3 2.3 5.1 5.2 9.2 5.2 4 0 7.3-4.3 9.2-6.2l249.1-320c1.2-1.7 2-3.6 2-5.8 0-2.5-1-4.6-2.4-6.4z"/></svg>'
-  );
+  content: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 512 512' fill='%231563ff'%3E%3Cpath d='M461.6 109.6l-54.9-43.3c-1.7-1.4-3.8-2.4-6.2-2.4-2.4 0-4.6 1-6.3 2.5L194.5 323s-78.5-75.5-80.7-77.7c-2.2-2.2-5.1-5.9-9.5-5.9s-6.4 3.1-8.7 5.4c-1.7 1.8-29.7 31.2-43.5 45.8-.8.9-1.3 1.4-2 2.1-1.2 1.7-2 3.6-2 5.7 0 2.2.8 4 2 5.7l2.8 2.6s139.3 133.8 141.6 136.1c2.3 2.3 5.1 5.2 9.2 5.2 4 0 7.3-4.3 9.2-6.2l249.1-320c1.2-1.7 2-3.6 2-5.8 0-2.5-1-4.6-2.4-6.4z'/%3E%3C/svg%3E");
 }
 
 .b-checkbox input[type='checkbox'],
@@ -86,7 +84,7 @@
 }
 
 .b-checkbox label::after {
-  color: $ui-gray-800;
+  color: var(--token-color-foreground-primary);
   font-size: 12px;
   height: 16px;
   left: 3px;
@@ -111,7 +109,7 @@
 
 .b-checkbox input[type='checkbox']:disabled + label::before,
 .b-checkbox input[type='radio']:disabled + label::before {
-  background-color: $ui-gray-100;
+  background-color: var(--token-color-palette-neutral-100);
   cursor: not-allowed;
 }
 
diff --git a/ui/app/styles/core/columns.scss b/ui/app/styles/core/columns.scss
index a9dd2f830f8..ed0465ddd06 100644
--- a/ui/app/styles/core/columns.scss
+++ b/ui/app/styles/core/columns.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,12 +9,12 @@
 
 // Columns (plural)
 .columns {
-  margin-left: -$spacing-10;
-  margin-right: -$spacing-10;
-  margin-top: -$spacing-10;
+  margin-left: -(size_variables.$spacing-10);
+  margin-right: -(size_variables.$spacing-10);
+  margin-top: -(size_variables.$spacing-10);
 
   &:last-child {
-    margin-bottom: -$spacing-10;
+    margin-bottom: -(size_variables.$spacing-10);
   }
 
   &.is-centered {
@@ -31,7 +33,7 @@
   }
 
   &.is-gapless:not(:last-child) {
-    margin-bottom: $spacing-20;
+    margin-bottom: size_variables.$spacing-20;
   }
 
   &.is-gapless:last-child {
@@ -197,5 +199,6 @@
   .column.is-4-desktop {
     flex: none;
     width: 33.33333%;
+    max-width: 600px;
   }
 }
diff --git a/ui/app/styles/core/containers.scss b/ui/app/styles/core/containers.scss
index 5d6e8d15faa..608dfaf4d69 100644
--- a/ui/app/styles/core/containers.scss
+++ b/ui/app/styles/core/containers.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -21,7 +23,7 @@
   display: flex;
   flex-grow: 1;
   flex-direction: column;
-  padding: 0 $spacing-20;
+  padding: 0 size_variables.$spacing-20;
 
   > .container {
     display: flex;
diff --git a/ui/app/styles/core/control.scss b/ui/app/styles/core/control.scss
index b4d3ff0176f..dc7e6f9e24f 100644
--- a/ui/app/styles/core/control.scss
+++ b/ui/app/styles/core/control.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,7 +15,7 @@
 }
 
 .control {
-  font-size: 1rem;
+  font-size: var(--token-typography-body-300-font-size);
   max-width: 100%;
   position: relative;
   text-align: left;
diff --git a/ui/app/styles/core/element-styling.scss b/ui/app/styles/core/element-styling.scss
index 596523db175..a422ecc93e0 100644
--- a/ui/app/styles/core/element-styling.scss
+++ b/ui/app/styles/core/element-styling.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -37,7 +39,7 @@ body,
 pre:not(.hds-code-block__code),
 strong,
 table th {
-  color: $ui-gray-900;
+  color: var(--token-color-foreground-primary);
 }
 
 h1,
@@ -47,7 +49,7 @@ h4,
 h5,
 h6 {
   font-size: 100%;
-  font-weight: normal;
+  font-weight: var(--token-typography-font-weight-regular);
 }
 
 ul {
@@ -80,8 +82,8 @@ object {
 }
 
 html {
-  background-color: $white;
-  font-size: $base-font-size; // 16px
+  background-color: hsl(0, 0%, 100%);
+  font-size: var(--token-typography-body-300-font-size); // 16px
   -moz-osx-font-smoothing: grayscale;
   -webkit-font-smoothing: antialiased;
   min-width: 300px;
@@ -104,14 +106,14 @@ button,
 input,
 select,
 textarea {
-  font-family: $family-sans;
+  font-family: var(--token-typography-font-stack-text);
 }
 
 code,
 pre {
   -moz-osx-font-smoothing: auto;
   -webkit-font-smoothing: inherit;
-  font-family: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, Courier, monospace;
+  font-family: var(--token-typography-font-stack-code);
   font-smooth: inherit;
 }
 
@@ -121,14 +123,14 @@ pre code {
 }
 
 body {
-  font-size: $size-6;
-  line-height: 1.5;
+  font-size: var(--token-typography-body-300-font-size);
+  line-height: var(--token-typography-body-300-line-height);
   overflow-x: hidden;
   overflow-y: scroll;
 }
 
 a {
-  color: $blue-500;
+  color: var(--token-color-foreground-action);
   cursor: pointer;
   text-decoration: underline;
 
@@ -140,19 +142,19 @@ a {
 }
 
 a:hover {
-  color: $ui-gray-900;
+  color: var(--token-color-foreground-primary);
 }
 
 code {
   background-color: transparent;
-  color: $ui-gray-700;
+  color: var(--token-color-foreground-faint);
   font-size: 1em;
-  font-weight: 400;
+  font-weight: var(--token-typography-font-weight-regular);
   padding: 0;
 }
 
 hr {
-  background-color: $ui-gray-300;
+  background-color: var(--token-color-surface-strong);
   border: none;
   display: block;
   height: 1px;
@@ -190,13 +192,13 @@ label {
 // <Hds::Dropdown>
 .hds-dropdown-list-item {
   > button:disabled {
-    color: $black;
+    color: hsl(0, 0%, 4%);
     opacity: 0.5;
     cursor: not-allowed;
   }
 }
 
-// TODO remove when HDS has released fix
-.hds-form-masked-input .hds-form-masked-input__toggle-button {
-  margin-right: $spacing-12;
+// <Hds::Text::Code> this applies to code elements that are placed within a surrounding text - not for standalone use
+.hds-text.code-in-text {
+  background-color: var(--token-color-surface-strong);
 }
diff --git a/ui/app/styles/core/field.scss b/ui/app/styles/core/field.scss
index fbdc6e85f2a..3e9088315a6 100644
--- a/ui/app/styles/core/field.scss
+++ b/ui/app/styles/core/field.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,12 +10,12 @@
 .field {
   // cannot use :read-only selector because tag used for other purposes
   &.is-readOnly {
-    background-color: $ui-gray-100;
+    background-color: var(--token-color-surface-strong);
     cursor: not-allowed;
   }
 
   &:not(:last-child) {
-    margin-bottom: $spacing-20;
+    margin-bottom: size_variables.$spacing-20;
   }
 }
 // must come after field due to overriding the margin-bottom of not last-child
@@ -47,8 +49,8 @@
       .checkbox,
       .input,
       .select select {
-        border-bottom-left-radius: $radius;
-        border-top-left-radius: $radius;
+        border-bottom-left-radius: var(--token-border-radius-x-small);
+        border-top-left-radius: var(--token-border-radius-x-small);
       }
     }
     &:last-child {
@@ -56,8 +58,8 @@
       .checkbox,
       .input,
       .select select {
-        border-bottom-right-radius: $radius;
-        border-top-right-radius: $radius;
+        border-bottom-right-radius: var(--token-border-radius-x-small);
+        border-top-right-radius: var(--token-border-radius-x-small);
       }
     }
   }
@@ -110,7 +112,7 @@ fieldset.form-fieldset {
     flex-shrink: 1;
 
     > .field:not(:last-child) {
-      margin-right: $spacing-10;
+      margin-right: size_variables.$spacing-10;
     }
     .field:not(.is-narrow) {
       flex-grow: 1;
@@ -134,7 +136,7 @@ fieldset.form-fieldset {
     }
 
     &.is-large {
-      font-size: 1.5rem;
+      font-size: var(--token-typography-display-400-font-size);
       padding-top: 0.375em;
     }
   }
diff --git a/ui/app/styles/core/file.scss b/ui/app/styles/core/file.scss
index 19108fd9196..7926707cb7e 100644
--- a/ui/app/styles/core/file.scss
+++ b/ui/app/styles/core/file.scss
@@ -1,5 +1,10 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+@use '../core/buttons.scss';
+@use '../core/inputs.scss';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,8 +16,8 @@
 
 .file-cta {
   align-items: center;
-  border: $base-border;
-  border-radius: $radius;
+  border: box-shadow_variables.$base-border;
+  border-radius: var(--token-border-radius-x-small);
   display: inline-flex;
   height: 2.25em;
   justify-content: flex-start;
@@ -26,7 +31,7 @@
   white-space: nowrap;
 
   &.button {
-    height: $size-2; // in older parts of the code (Ex: shamir-modal-flow) this class is not a button. In newer parts of the code it is, and height needs to match the height of a button (2.5rem).
+    height: size_variables.$size-2; // in older parts of the code (Ex: shamir-modal-flow) this class is not a button. In newer parts of the code it is, and height needs to match the height of a button (2.5rem).
   }
 
   &:disabled {
@@ -43,9 +48,9 @@
 .file-delete-button {
   @extend .button;
   @extend .is-transparent;
-  color: $grey;
+  color: var(--token-color-palette-neutral-400);
   position: absolute;
-  right: $spacing-8;
+  right: size_variables.$spacing-8;
 }
 
 .file-icon {
@@ -77,12 +82,12 @@
 
 .file-name {
   @extend .input;
-  border: $base-border;
-  border-radius: $radius;
+  border: box-shadow_variables.$base-border;
+  border-radius: var(--token-border-radius-x-small);
   box-shadow: 0 4px 1px rgba(10, 10, 10, 0.06) inset;
   display: block;
   font-size: 1em;
-  line-height: 1.5;
+  line-height: var(--token-typography-body-300-line-height);
   overflow: hidden;
   padding-bottom: calc(0.375em - 1px);
   padding-left: 1em;
diff --git a/ui/app/styles/core/inputs.scss b/ui/app/styles/core/inputs.scss
index e7982fd8110..907dc374ac3 100644
--- a/ui/app/styles/core/inputs.scss
+++ b/ui/app/styles/core/inputs.scss
@@ -1,5 +1,9 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,18 +12,18 @@
 .input,
 .textarea {
   align-items: center;
-  border-radius: $radius;
-  border: $base-border;
-  box-shadow: 0 4px 1px rgba($black, 0.06) inset;
-  color: $grey-dark;
+  border-radius: var(--token-border-radius-x-small);
+  border: box-shadow_variables.$base-border;
+  box-shadow: 0 4px 1px rgba(hsl(0, 0%, 4%), 0.06) inset;
+  color: var(--token-color-foreground-faint);
   display: inline-flex;
-  font-size: $size-6;
-  height: $size-2;
-  line-height: 1.5;
+  font-size: var(--token-typography-body-300-font-size);
+  height: size_variables.$size-2;
+  line-height: var(--token-typography-body-300-line-height);
   max-width: 100%;
   padding-bottom: calc(0.375em - 1px);
-  padding-left: $spacing-12;
-  padding-right: $spacing-12;
+  padding-left: size_variables.$spacing-12;
+  padding-right: size_variables.$spacing-12;
   padding-top: calc(0.375em - 1px);
   width: 100%;
 
@@ -28,17 +32,17 @@
   &.is-active,
   &:focus-visible {
     outline: none;
-    background-color: $white;
-    border-color: $blue-500 !important;
+    background-color: hsl(0, 0%, 100%);
+    border-color: var(--token-color-palette-blue-200) !important;
     box-shadow: 0 0 0 0.125em rgba(21, 99, 255, 0.25);
   }
 
   &:hover {
-    border-color: $ui-gray-300;
+    border-color: var(--token-color-palette-neutral-300);
   }
 
-  @include until($desktop) {
-    font-size: $size-6;
+  @include mixins.until(size_variables.$desktop) {
+    font-size: var(--token-typography-body-300-font-size);
   }
 
   &::placeholder {
@@ -48,13 +52,13 @@
 
 .input[disabled],
 .textarea[disabled] {
-  border-color: $grey-light;
-  background-color: $ui-gray-100;
-  color: $ui-gray-500;
+  border-color: var(--token-color-palette-neutral-300);
+  background-color: var(--token-color-palette-neutral-100);
+  color: var(--token-color-foreground-disabled);
   cursor: not-allowed;
 
   &:hover {
-    border-color: $grey-light;
+    border-color: var(--token-color-palette-neutral-300);
   }
 }
 
@@ -79,7 +83,7 @@
 
 // custom input
 .input-hint {
-  padding: 0 $spacing-10;
-  font-size: $size-8;
+  padding: 0 size_variables.$spacing-10;
+  font-size: var(--token-typography-body-200-font-size);
   color: var(--token-color-foreground-faint);
 }
diff --git a/ui/app/styles/core/json-diff-patch.scss b/ui/app/styles/core/json-diff-patch.scss
index 0bd749d4af2..ef632dac391 100644
--- a/ui/app/styles/core/json-diff-patch.scss
+++ b/ui/app/styles/core/json-diff-patch.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,7 +19,7 @@
 }
 
 .jsondiffpatch-property-name {
-  color: $ui-gray-300;
+  color: var(--token-color-palette-neutral-300);
 }
 
 .jsondiffpatch-added > .jsondiffpatch-property-name {
diff --git a/ui/app/styles/core/label.scss b/ui/app/styles/core/label.scss
index ba8a525d098..5ca45bea551 100644
--- a/ui/app/styles/core/label.scss
+++ b/ui/app/styles/core/label.scss
@@ -1,17 +1,19 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 // This file defines the style for .is-label
 
 .is-label {
-  color: $grey-darkest;
-  font-size: 14px;
-  font-weight: $font-weight-bold;
+  color: var(--token-color-foreground-primary);
+  font-size: var(--token-typography-body-200-font-size);
+  font-weight: var(--token-typography-font-weight-bold);
   display: flex;
   align-items: center;
-  gap: $spacing-4;
+  gap: size_variables.$spacing-4;
   width: min-content;
   min-width: 100%;
 
@@ -25,6 +27,6 @@
   }
 
   &::before {
-    border-color: $grey-light;
+    border-color: var(--token-color-palette-neutral-300);
   }
 }
diff --git a/ui/app/styles/core/level.scss b/ui/app/styles/core/level.scss
index 4c9092968c4..4fe93d1938c 100644
--- a/ui/app/styles/core/level.scss
+++ b/ui/app/styles/core/level.scss
@@ -1,5 +1,8 @@
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,11 +12,11 @@
 }
 
 .level code {
-  border-radius: $radius;
+  border-radius: var(--token-border-radius-x-small);
 }
 
 .level:not(:last-child) {
-  @include vault-block;
+  @include mixins.vault-block;
 }
 
 .level-left,
@@ -45,7 +48,7 @@
 
 .level.is-mobile .level-item:not(:last-child) {
   margin-bottom: 0;
-  margin-right: $spacing-10;
+  margin-right: size_variables.$spacing-10;
 }
 
 .level.is-mobile .level-item:not(.is-narrow) {
@@ -92,6 +95,6 @@
 
 @media screen and (max-width: 768px) {
   .level-item:not(:last-child) {
-    margin-bottom: $spacing-10;
+    margin-bottom: size_variables.$spacing-10;
   }
 }
diff --git a/ui/app/styles/core/link.scss b/ui/app/styles/core/link.scss
index efece782fc8..7ff4ee02d5f 100644
--- a/ui/app/styles/core/link.scss
+++ b/ui/app/styles/core/link.scss
@@ -1,19 +1,19 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .link {
   background: transparent;
   border: 0;
-  color: $blue;
+  color: var(--token-color-foreground-action);
   cursor: pointer;
   display: inline;
   font: inherit;
   line-height: normal;
   margin: 0;
   padding: 0;
-  font-weight: $font-weight-semibold;
+  font-weight: var(--token-typography-font-weight-semibold);
   user-select: text;
 
   &[disabled] {
diff --git a/ui/app/styles/core/lists.scss b/ui/app/styles/core/lists.scss
index f850b4ccc12..8c16ff071fa 100644
--- a/ui/app/styles/core/lists.scss
+++ b/ui/app/styles/core/lists.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,22 +11,22 @@
   display: inline-flex;
   align-items: center;
   &:before {
-    font-size: $size-5;
-    color: $blue-500;
+    font-size: size_variables.$size-5;
+    color: var(--token-color-foreground-action);
     content: '|';
     position: relative;
   }
 }
 
 .list-header {
-  margin: $spacing-10 $spacing-10 0;
-  color: $grey;
-  font-size: $size-8;
-  font-weight: $font-weight-semibold;
+  margin: size_variables.$spacing-10 size_variables.$spacing-10 0;
+  color: var(--token-color-palette-neutral-400);
+  font-size: var(--token-typography-body-200-font-size);
+  font-weight: var(--token-typography-font-weight-semibold);
   text-transform: uppercase;
 }
 
 ul.bullet {
   list-style: disc;
-  padding-left: $spacing-16;
+  padding-left: size_variables.$spacing-16;
 }
diff --git a/ui/app/styles/core/menu.scss b/ui/app/styles/core/menu.scss
index f0764a9d50d..dfcbbc0d886 100644
--- a/ui/app/styles/core/menu.scss
+++ b/ui/app/styles/core/menu.scss
@@ -1,15 +1,17 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .menu {
-  font-size: $size-6;
+  font-size: var(--token-typography-body-300-font-size);
 }
 
 .menu a {
   display: block;
-  padding: $spacing-8 $spacing-10;
+  padding: size_variables.$spacing-8 size_variables.$spacing-10;
   text-decoration: none;
 }
 
@@ -25,10 +27,10 @@
 .column .menu-list a {
   border-radius: 0;
   border-right: 0 solid transparent;
-  font-weight: $font-weight-semibold;
+  font-weight: var(--token-typography-font-weight-semibold);
 
   &:hover,
   &.is-active {
-    color: $blue;
+    color: var(--token-color-foreground-action);
   }
 }
diff --git a/ui/app/styles/core/message.scss b/ui/app/styles/core/message.scss
index 23596109cb6..756e2dbbd4c 100644
--- a/ui/app/styles/core/message.scss
+++ b/ui/app/styles/core/message.scss
@@ -1,108 +1,111 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .alert-title {
-  font-size: $size-5;
-  font-weight: $font-weight-bold;
+  font-size: size_variables.$size-5;
+  font-weight: var(--token-typography-font-weight-bold);
 }
 
 .message {
-  background: $blue-010;
-  border: 1px solid $blue-100;
-  margin-bottom: $spacing-12;
-  padding: $spacing-12 $spacing-16 $spacing-16 $spacing-12;
+  background: var(--token-color-palette-blue-50);
+  border: 1px solid var(--token-color-palette-blue-100);
+  margin-bottom: size_variables.$spacing-12;
+  padding: size_variables.$spacing-12 size_variables.$spacing-16 size_variables.$spacing-16
+    size_variables.$spacing-12;
   position: relative;
 
   &:not(:last-child) {
-    margin-bottom: $spacing-20;
+    margin-bottom: size_variables.$spacing-20;
   }
 
   .message-icon {
-    color: $blue;
-    margin-right: $spacing-8;
+    color: var(--token-color-foreground-action);
+    margin-right: size_variables.$spacing-8;
   }
 
   .message-title {
-    color: $blue-500;
-    font-size: 16px;
-    font-weight: $font-weight-bold;
+    color: var(--token-color-foreground-action);
+    font-size: var(--token-typography-body-300-font-size);
+    font-weight: var(--token-typography-font-weight-bold);
     line-height: 1.25;
   }
 
   .message-body {
     border: 0;
     padding: 1em 1.25em;
-    margin-top: $spacing-4;
+    margin-top: size_variables.$spacing-4;
   }
 
   // message types, see message-types.js
   &.is-danger {
-    background: $red-010;
-    border: 1px solid $red-050;
+    background: var(--token-color-surface-critical);
+    border: 1px solid var(--token-color-palette-red-50);
 
     .message-body {
-      color: $red-700;
+      color: var(--token-color-foreground-critical-on-surface);
     }
 
     .message-icon {
-      color: $red-500;
+      color: var(--token-color-foreground-critical);
     }
 
     .message-title {
-      color: $red-700;
+      color: var(--token-color-foreground-critical-on-surface);
     }
   }
 
   &.is-highlight {
-    background: $yellow-010;
-    border: 1px solid $yellow-100;
+    background: var(--token-color-surface-warning);
+    border: 1px solid var(--token-color-border-warning);
 
     .message-body {
-      color: $ui-gray-900;
+      color: var(--token-color-foreground-primary);
     }
 
     .message-icon {
-      color: $yellow-500;
+      color: var(--token-color-foreground-warning);
     }
 
     .message-title {
-      color: $orange-700;
+      color: var(--token-color-foreground-warning-on-surface);
     }
   }
 
   &.is-info {
-    background-color: $blue-010;
+    background-color: var(--token-color-palette-blue-50);
 
     .message-body {
-      color: $blue-700;
+      color: var(--token-color-palette-blue-300);
     }
 
     .message-header {
-      background-color: $blue-500;
-      color: $white;
+      background-color: var(--token-color-palette-blue-200);
+      color: hsl(0, 0%, 100%);
     }
 
     .message-title {
-      color: $blue-700;
+      color: var(--token-color-palette-blue-300);
     }
   }
 
   &.is-success {
-    background: $green-010;
-    border: 1px solid $green-100;
+    background: var(--token-color-surface-success);
+    border: 1px solid var(--token-color-border-success);
 
     .message-body {
-      color: $green-900;
+      color: var(--token-color-foreground-success-high-contrast);
     }
 
     .message-icon {
-      color: $green-500;
+      color: var(--token-color-foreground-success);
     }
 
     .message-title {
-      color: $green-700;
+      color: var(--token-color-foreground-success-on-surface);
     }
   }
 }
diff --git a/ui/app/styles/core/progress.scss b/ui/app/styles/core/progress.scss
index bdb5dfc5786..b0c084e20bf 100644
--- a/ui/app/styles/core/progress.scss
+++ b/ui/app/styles/core/progress.scss
@@ -1,16 +1,19 @@
+@use '../utils/box-shadow_variables';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 .progress {
   appearance: none;
-  background: $ui-gray-050;
+  background: var(--token-color-surface-faint);
   border: none;
-  box-shadow: inset $box-link-shadow;
-  border-radius: $radius;
+  box-shadow: inset box-shadow_variables.$box-link-shadow;
+  border-radius: var(--token-border-radius-x-small);
   display: block;
-  height: $size-6;
+  height: size_variables.$size-6;
   overflow: hidden;
   padding: 0;
   margin-bottom: 0;
@@ -23,7 +26,7 @@
     width: 30px;
   }
   &.is-medium {
-    height: $size-5;
+    height: size_variables.$size-5;
     width: 120px;
   }
 }
@@ -31,20 +34,20 @@
 // style the container in chrome
 .progress[value]::-webkit-progress-bar {
   background-color: #ededed;
-  box-shadow: inset $box-link-shadow;
+  box-shadow: inset box-shadow_variables.$box-link-shadow;
 }
 
 // style the bar in chrome
 .progress[value]::-webkit-progress-value {
   background-color: #4a4a4a;
-  border-radius: $radius;
-  transition: width 1s $easing;
+  border-radius: var(--token-border-radius-x-small);
+  transition: width 1s size_variables.$easing;
 }
 
 // style the bar in firefox
 .progress[value]::-moz-progress-bar {
-  border-radius: $radius;
-  transition: width 1s $easing;
+  border-radius: var(--token-border-radius-x-small);
+  transition: width 1s size_variables.$easing;
 }
 
 .progress::-ms-fill {
@@ -70,17 +73,17 @@
 }
 
 .progress.is-success::-webkit-progress-value {
-  background-color: $green-500;
+  background-color: var(--token-color-palette-green-200);
 }
 
 .progress.is-success::-moz-progress-bar {
-  background-color: $green-500;
+  background-color: var(--token-color-palette-green-200);
 }
 
 .progress.is-success::-ms-fill {
-  background-color: $green-500;
+  background-color: var(--token-color-palette-green-200);
 }
 
 .progress.is-success:indeterminate {
-  background-image: linear-gradient(to right, $green-500 30%, #ededed 30%);
+  background-image: linear-gradient(to right, var(--token-color-palette-green-200) 30%, #ededed 30%);
 }
diff --git a/ui/app/styles/core/select.scss b/ui/app/styles/core/select.scss
index 970554f85c9..1abeb76a021 100644
--- a/ui/app/styles/core/select.scss
+++ b/ui/app/styles/core/select.scss
@@ -1,19 +1,21 @@
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 select {
   width: 100%;
-  appearance: none;
 }
 
 .select select {
-  background-color: $ui-gray-050;
-  box-shadow: 0 3px 1px rgba($black, 0.12);
-  border: 1px solid $grey-light;
-  border-radius: $radius;
-  color: $grey-dark;
+  background-color: var(--token-color-surface-faint);
+  box-shadow: 0 3px 1px rgba(hsl(0, 0%, 4%), 0.12);
+  border: 1px solid var(--token-color-palette-neutral-300);
+  border-radius: var(--token-border-radius-x-small);
+  color: var(--token-color-foreground-faint);
   cursor: pointer;
   display: block;
   font-size: 1em;
@@ -21,13 +23,13 @@ select {
   max-width: 100%;
   outline: none;
   padding-bottom: calc(0.375em - 1px);
-  padding-left: $spacing-10;
-  padding-right: $spacing-10;
+  padding-left: size_variables.$spacing-10;
+  padding-right: size_variables.$spacing-10;
   padding-top: calc(0.375em - 1px);
   text-rendering: auto !important;
 
-  @include until($desktop) {
-    font-size: 1rem;
+  @include mixins.until(size_variables.$desktop) {
+    font-size: var(--token-typography-body-300-font-size);
   }
 
   &::placeholder {
@@ -38,23 +40,23 @@ select {
   &:focus,
   &:focus-visible,
   &.is-active {
-    border-color: $blue-500;
+    border-color: var(--token-color-palette-blue-200);
     box-shadow: 0 0 0 0.125em rgba(21, 99, 255, 0.25);
   }
 }
 
 .select select:not([multiple]) {
-  padding-right: $spacing-36;
+  padding-right: size_variables.$spacing-36;
 }
 
 .select select[disabled] {
-  border-color: $grey-light;
-  background-color: $ui-gray-100;
-  color: $ui-gray-500;
+  border-color: var(--token-color-palette-neutral-300);
+  background-color: var(--token-color-palette-neutral-100);
+  color: var(--token-color-foreground-disabled);
   cursor: not-allowed;
   user-select: none;
   &:hover {
-    border-color: $grey-light;
+    border-color: var(--token-color-palette-neutral-300);
   }
 }
 
@@ -76,7 +78,7 @@ select {
   margin: 0;
   pointer-events: none;
   position: absolute;
-  right: $spacing-8;
+  right: size_variables.$spacing-8;
   top: 50%;
   transform: translateY(-50%);
   width: 24px;
diff --git a/ui/app/styles/core/tag.scss b/ui/app/styles/core/tag.scss
deleted file mode 100644
index fd211e30b12..00000000000
--- a/ui/app/styles/core/tag.scss
+++ /dev/null
@@ -1,73 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// This file defines the style for .tag
-
-.tag:not(body) {
-  align-items: center;
-  // same as HDS::Badge @color=neutral
-  background-color: var(--token-color-surface-strong);
-  color: var(--token-color-foreground-primary);
-  border-radius: $radius;
-  display: inline-flex;
-  font-size: $size-8;
-  font-weight: $font-weight-normal;
-  height: auto;
-  justify-content: center;
-  line-height: 1.5;
-  margin-right: $spacing-8;
-  padding: 0 $spacing-8;
-  white-space: nowrap;
-  vertical-align: middle;
-
-  code {
-    color: var(--token-color-foreground-primary);
-  }
-
-  .icon {
-    height: 12px;
-    margin-left: -0.25em;
-    margin-right: 0.25em;
-    min-width: 0;
-    width: 12px;
-  }
-
-  &.has-extra-padding {
-    padding: $spacing-4 $spacing-4;
-  }
-}
-
-.tag {
-  &.is-bold {
-    font-weight: bold;
-  }
-
-  &.is-light {
-    background-color: whitesmoke;
-    color: rgba(0, 0, 0, 0.7);
-  }
-
-  &.is-outlined {
-    background-color: transparent;
-    border: 1px solid $grey-light;
-  }
-
-  &.is-transparent {
-    background-color: transparent;
-  }
-
-  &.is-small {
-    height: auto;
-  }
-
-  &.is-medium {
-    font-size: $size-6;
-  }
-
-  &.is-success {
-    background-color: $green-500;
-    color: $white;
-  }
-}
diff --git a/ui/app/styles/core/title.scss b/ui/app/styles/core/title.scss
index 9ffe8b67e5b..61cf8f4e3f3 100644
--- a/ui/app/styles/core/title.scss
+++ b/ui/app/styles/core/title.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,51 +16,51 @@
 .title {
   color: hsl(0, 0%, 21%);
   font-size: 2rem;
-  font-weight: $font-weight-bold;
+  font-weight: var(--token-typography-font-weight-bold);
   line-height: 1.125;
   word-break: break-word;
 
   > a {
-    color: $black;
+    color: hsl(0, 0%, 4%);
     text-decoration: none;
   }
 
   // title sizes
   &.is-2 {
-    font-size: $size-2;
+    font-size: size_variables.$size-2;
   }
 
   &.is-3 {
-    font-size: $size-3;
+    font-size: size_variables.$size-3;
   }
 
   &.is-4 {
-    font-size: $size-4;
+    font-size: var(--token-typography-display-400-font-size);
   }
 
   &.is-5 {
-    font-size: $size-5;
+    font-size: size_variables.$size-5;
   }
 
   &.is-6 {
-    font-size: $size-6;
+    font-size: var(--token-typography-display-200-font-size);
   }
 
   &.is-7 {
-    font-size: $size-7;
+    font-size: size_variables.$size-7;
   }
 
   &.is-8 {
-    font-size: $size-8;
+    font-size: var(--token-typography-body-200-font-size);
   }
 }
 
 .form-section .title {
-  margin-bottom: $spacing-12;
+  margin-bottom: size_variables.$spacing-12;
 }
 
 .is-subtitle-gray {
   text-transform: uppercase;
-  font-size: $size-7;
-  color: $ui-gray-500;
+  font-size: size_variables.$size-7;
+  color: var(--token-color-palette-neutral-400);
 }
diff --git a/ui/app/styles/core/toggle.scss b/ui/app/styles/core/toggle.scss
index 0c4cb0579ee..d077a721571 100644
--- a/ui/app/styles/core/toggle.scss
+++ b/ui/app/styles/core/toggle.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -43,7 +45,7 @@
   height: 1.5rem;
   border: 0.1rem solid transparent;
   border-radius: 0.75rem;
-  background: $ui-gray-300;
+  background: var(--token-color-palette-neutral-300);
   content: '';
 }
 .toggle[type='checkbox'] + label::after {
@@ -55,12 +57,12 @@
   height: 1rem;
   transform: translate3d(0, 0, 0);
   border-radius: 50%;
-  background: $white;
-  transition: all 0.25s $easing;
+  background: hsl(0, 0%, 100%);
+  transition: all 0.25s size_variables.$easing;
   content: '';
 }
 .toggle[type='checkbox']:checked + label::before {
-  background: $ui-gray-700;
+  background: var(--token-color-foreground-faint);
 }
 .toggle[type='checkbox']:checked + label::after {
   left: 1.625rem;
@@ -70,25 +72,25 @@
 .toggle[type='checkbox'] {
   &.is-small {
     + label {
-      font-size: $size-7;
-      padding-left: $spacing-32;
+      font-size: size_variables.$size-7;
+      padding-left: size_variables.$spacing-32;
       margin: 0 0.25rem;
       &::before {
-        top: calc($size-8 / 5);
-        height: $size-8;
-        width: $size-8 * 2;
+        top: calc(size_variables.$size-8 / 5);
+        height: size_variables.$size-8;
+        width: size_variables.$size-8 * 2;
       }
       &::after {
-        width: $size-8 * 0.9;
-        height: $size-8 * 0.9;
+        width: size_variables.$size-8 * 0.9;
+        height: size_variables.$size-8 * 0.9;
         transform: translateX(0.05rem);
         left: 0;
-        top: calc($size-8 / 4);
+        top: calc(size_variables.$size-8 / 4);
       }
     }
     &:checked + label::after {
       left: 0;
-      transform: translateX(($size-8 * 2) - ($size-8 * 0.94));
+      transform: translateX((size_variables.$size-8 * 2) - (size_variables.$size-8 * 0.94));
     }
   }
 }
@@ -96,10 +98,10 @@
   will-change: left;
 }
 .toggle[type='checkbox']:focus + label {
-  box-shadow: 0 0 1px $blue;
+  box-shadow: 0 0 1px var(--token-color-palette-blue-200);
 }
 .toggle[type='checkbox'].is-success:checked + label::before {
-  background: $blue;
+  background: var(--token-color-palette-blue-200);
 }
 
 .toggle-label {
diff --git a/ui/app/styles/docs.scss b/ui/app/styles/docs.scss
new file mode 100644
index 00000000000..94eed8b6c49
--- /dev/null
+++ b/ui/app/styles/docs.scss
@@ -0,0 +1,123 @@
+@use 'utils/size_variables';
+
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+.docs-collapse-toggle {
+  .hds-button {
+    color: var(--token-side-nav-color-foreground-primary);
+    background: var(--token-side-nav-color-surface-primary);
+    border-color: transparent;
+    border-radius: var(--token-side-nav-body-list-item-border-radius);
+    &:hover {
+      background: var(--token-side-nav-color-surface-interactive-hover);
+      border-color: transparent;
+    }
+  }
+}
+
+#docfy-content {
+  font-size: var(--token-typography-body-300-font-size);
+  font-family: var(--token-typography-font-stack-text);
+  margin-left: 1.5rem;
+  margin-right: 2rem;
+  margin-top: 1.5rem;
+  max-width: 90%;
+
+  h1,
+  h2,
+  h3 {
+    border-bottom: 1px solid var(--token-color-palette-neutral-300);
+    padding-bottom: 0.5rem;
+  }
+
+  h1 {
+    margin-bottom: 1.15rem;
+    font-size: var(--token-typography-display-500-font-size);
+    line-height: var(--token-typography-display-500-line-height);
+  }
+
+  h2 {
+    padding-top: 1rem;
+    font-size: var(--token-typography-display-400-font-size);
+    line-height: var(--token-typography-display-400-line-height);
+  }
+
+  ul {
+    list-style: disc;
+    li {
+      margin-top: 1rem;
+    }
+  }
+
+  ul,
+  ol {
+    padding-left: size_variables.$spacing-16;
+    padding-bottom: size_variables.$spacing-16;
+  }
+
+  pre,
+  code {
+    background-color: var(--token-color-surface-strong);
+  }
+
+  blockquote {
+    margin-left: 1rem;
+    padding: 0.5rem;
+    background: var(--token-color-surface-faint);
+    border-radius: var(--token-border-radius-medium);
+  }
+
+  code {
+    font-size: var(--token-typography-body-300-font-size);
+    font-family: var(--token-typography-font-stack-code);
+  }
+
+  pre code {
+    overflow-x: scroll;
+    max-width: 700px;
+    white-space: pre-line;
+  }
+
+  pre,
+  table {
+    margin-top: 1rem;
+    margin-bottom: 1rem;
+    padding: 1rem;
+    text-align: left;
+    border-radius: var(--token-border-radius-medium);
+  }
+
+  table {
+    border: none;
+    border-collapse: collapse;
+    td {
+      padding-left: 0.5rem;
+      padding-right: 0.5rem;
+      code {
+        background: none;
+      }
+    }
+    tr {
+      border-bottom: 1px solid var(--token-color-palette-neutral-300);
+    }
+  }
+
+  .docfy-demo {
+    border: 1px solid var(--token-color-palette-neutral-50);
+    border-radius: var(--token-border-radius-medium);
+    padding: 1rem;
+    overflow: scroll;
+
+    .docfy-demo__example {
+      & pre,
+      code {
+        background: none;
+        margin: 0;
+        padding: 0;
+      }
+    }
+  }
+}
diff --git a/ui/app/styles/helper-classes/colors.scss b/ui/app/styles/helper-classes/colors.scss
index a3a6b7c3908..b5ceafc937e 100644
--- a/ui/app/styles/helper-classes/colors.scss
+++ b/ui/app/styles/helper-classes/colors.scss
@@ -1,29 +1,33 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 /* This helper includes styles referencing background color, border color, and text color. */
 
 // background colors
+.background-neutral-50 {
+  background: var(--token-color-palette-neutral-50);
+}
+
 .has-background-white-bis {
-  background: $ui-gray-050;
+  background: var(--token-color-surface-faint);
 }
 
 .has-background-gray-100 {
-  background-color: $ui-gray-100;
+  background-color: var(--token-color-palette-neutral-100);
 }
 
 .has-background-gray-200 {
-  background-color: $ui-gray-200;
+  background-color: var(--token-color-palette-neutral-200);
 }
 
 .has-background-gray-300 {
-  background-color: $ui-gray-300;
+  background-color: var(--token-color-palette-neutral-300);
 }
 
 .has-background-gray-900 {
-  background-color: $ui-gray-900;
+  background-color: var(--token-color-palette-neutral-600);
 }
 
 .background-color-black {
@@ -33,12 +37,12 @@
 // borders
 .has-border-top-light {
   border-radius: 0;
-  border-top: 1px solid $grey-light;
+  border-top: 1px solid var(--token-color-palette-neutral-300);
 }
 
 .has-border-bottom-light {
   border-radius: 0;
-  border-bottom: 1px solid $grey-light;
+  border-bottom: 1px solid var(--token-color-palette-neutral-300);
 }
 
 .has-error-border,
@@ -46,25 +50,25 @@ select.has-error-border,
 .ttl-picker-form-field-error input,
 .string-list-form-field-error .field:first-of-type textarea,
 .hds-form-checkbox.has-error-border {
-  border: 1px solid $red-500;
+  border: 1px solid var(--token-color-palette-red-200);
 }
 
 .error-border-child-inputs input,
 .error-border-child-inputs textarea {
-  border: 1px solid $red-500;
+  border: 1px solid var(--token-color-palette-red-200);
 }
 
 // specifically for the SearchSelect dropdown.
 .dropdown-has-error-border > div.ember-basic-dropdown-trigger {
-  border: 1px solid $red-500;
+  border: 1px solid var(--token-color-palette-red-200);
 }
 
 // text color
 .text-grey-lightest {
-  color: $grey-lightest;
+  color: var(--token-color-palette-neutral-50);
 }
 
-.has-text-grey-light {
+.has-text-neutral-300 {
   color: var(--token-color-foreground-faint) !important;
 }
 
@@ -72,24 +76,24 @@ select.has-error-border,
   color: var(--token-color-foreground-faint) !important;
 }
 
-.has-text-grey-dark {
-  color: $ui-gray-700 !important;
+.has-text-neutral-500 {
+  color: var(--token-color-foreground-faint) !important;
 }
 
 .has-text-white {
-  color: $white !important;
+  color: hsl(0, 0%, 100%) !important;
 }
 
 .has-text-black {
-  color: $black !important;
+  color: hsl(0, 0%, 4%) !important;
 }
 
 .has-text-info {
-  color: $blue-500 !important;
+  color: var(--token-color-foreground-action) !important;
 }
 // same without the !important
 .has-text-primary {
-  color: $blue-500;
+  color: var(--token-color-foreground-action);
 }
 
 .has-text-success {
@@ -97,13 +101,13 @@ select.has-error-border,
 }
 
 .has-text-highlight {
-  color: $yellow-500;
+  color: var(--token-color-foreground-warning);
 }
 
 .has-text-danger {
-  color: $red-500 !important;
+  color: var(--token-color-foreground-critical) !important;
 }
 
 .has-text-primary {
-  color: $blue;
+  color: var(--token-color-foreground-action);
 }
diff --git a/ui/app/styles/helper-classes/flexbox-and-grid.scss b/ui/app/styles/helper-classes/flexbox-and-grid.scss
index 868552581f5..e8ffb2b8023 100644
--- a/ui/app/styles/helper-classes/flexbox-and-grid.scss
+++ b/ui/app/styles/helper-classes/flexbox-and-grid.scss
@@ -1,5 +1,8 @@
+@use '../utils/mixins';
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,11 +26,23 @@
   }
 
   &.row-gap-8 {
-    row-gap: $spacing-8;
+    row-gap: size_variables.$spacing-8;
+  }
+
+  &.row-gap-12 {
+    row-gap: size_variables.$spacing-12;
+  }
+
+  &.row-gap-16 {
+    row-gap: size_variables.$spacing-16;
+  }
+
+  &.column-gap-8 {
+    column-gap: size_variables.$spacing-8;
   }
 
   &.column-gap-16 {
-    column-gap: $spacing-16;
+    column-gap: size_variables.$spacing-16;
   }
 }
 
@@ -46,12 +61,16 @@
   flex-direction: row;
 }
 
-.has-gap-m {
-  gap: $spacing-16;
+.gap-16 {
+  gap: size_variables.$spacing-16;
 }
 
-.has-gap-l {
-  gap: $spacing-24;
+.gap-24 {
+  gap: size_variables.$spacing-24;
+}
+
+.gap-36 {
+  gap: size_variables.$spacing-36;
 }
 
 // Alignment of the items
@@ -92,7 +111,7 @@
   justify-content: flex-start;
 
   &.has-gap {
-    gap: $spacing-16;
+    gap: size_variables.$spacing-16;
   }
 }
 
@@ -140,7 +159,7 @@
   }
 }
 
-@include until($mobile) {
+@include mixins.until(size_variables.$mobile) {
   .is-flex-row {
     flex-flow: column wrap;
   }
@@ -154,7 +173,7 @@
 .grid-2-columns {
   grid-template-columns: 2fr 2fr;
 
-  @include until($mobile) {
+  @include mixins.until(size_variables.$mobile) {
     grid-template-columns: 1fr;
   }
 }
@@ -188,3 +207,11 @@
 .align-self-end {
   align-self: end;
 }
+
+.align-items-center {
+  align-items: center;
+}
+
+.align-items-end {
+  align-items: end;
+}
diff --git a/ui/app/styles/helper-classes/general.scss b/ui/app/styles/helper-classes/general.scss
index a3c5ec74b70..3411cecb596 100644
--- a/ui/app/styles/helper-classes/general.scss
+++ b/ui/app/styles/helper-classes/general.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +9,9 @@
 
 // box-shadow helpers
 .has-only-top-shadow {
-  box-shadow: 0 -1px 0 -1px $grey-light, 0 -2px 0 -1px $grey-light;
+  box-shadow:
+    0 -1px 0 -1px var(--token-color-palette-neutral-300),
+    0 -2px 0 -1px var(--token-color-palette-neutral-300);
 }
 
 .is-shadowless {
@@ -15,17 +19,19 @@
 }
 
 .is-sideless {
-  box-shadow: 0 2px 0 -1px $grey-light, 0 -2px 0 -1px $grey-light;
+  box-shadow:
+    0 2px 0 -1px var(--token-color-palette-neutral-300),
+    0 -2px 0 -1px var(--token-color-palette-neutral-300);
 }
 
 // this helper needs to go after is-sideless as they are often used together and is-bottomless needs to override is-sideless (no this is not ideal).
 .is-bottomless {
-  box-shadow: 0 -1px 0 0 $grey-light;
+  box-shadow: 0 -1px 0 0 var(--token-color-palette-neutral-300);
 }
 
 // border helpers
 .has-default-border {
-  border: 1px solid $grey !important;
+  border: 1px solid var(--token-color-palette-neutral-400) !important;
 }
 
 .is-borderless {
@@ -47,7 +53,7 @@
 
 // other
 .has-background-transition {
-  transition: background-color ease-out $speed;
+  transition: background-color ease-out size_variables.$speed;
 }
 
 .has-current-color-fill {
@@ -57,16 +63,19 @@
   }
 }
 
+.white-space-pre-line {
+  white-space: pre-line;
+}
+
 // large grouped css blocks
 .is-hint {
-  color: $grey;
-  font-size: $size-8;
-  padding: $spacing-12 0;
+  color: var(--token-color-palette-neutral-400);
+  font-size: var(--token-typography-body-200-font-size);
 }
 
 .is-optional {
-  color: $grey;
-  font-size: $size-8;
+  color: var(--token-color-palette-neutral-400);
+  font-size: var(--token-typography-body-200-font-size);
   text-transform: lowercase;
 }
 
@@ -77,6 +86,14 @@
   white-space: pre-wrap;
 }
 
+.overflow-wrap {
+  overflow-wrap: break-word;
+
+  &.word-break {
+    word-break: break-word;
+  }
+}
+
 .truncate-second-line {
   display: -webkit-box;
   -webkit-line-clamp: 2;
@@ -99,6 +116,10 @@
   text-overflow: ellipsis;
 }
 
+.white-space-nowrap {
+  white-space: nowrap;
+}
+
 // screen reader only
 .sr-only {
   border: 0;
@@ -114,8 +135,8 @@
 }
 
 // border-radius
-.border-radius-4 {
-  border-radius: $radius-large;
+.border-radius-small {
+  border-radius: var(--token-border-radius-small);
 }
 
 // border-spacing
diff --git a/ui/app/styles/helper-classes/layout.scss b/ui/app/styles/helper-classes/layout.scss
index fa654da798d..8c270baa776 100644
--- a/ui/app/styles/helper-classes/layout.scss
+++ b/ui/app/styles/helper-classes/layout.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -41,8 +43,12 @@
   position: relative;
 }
 
+.position-absolute {
+  position: absolute;
+}
+
 .top-xxs {
-  top: $spacing-4;
+  top: size_variables.$spacing-4;
 }
 
 // visibility
@@ -51,20 +57,36 @@
 }
 
 // overflow
+.overflow-auto {
+  overflow: auto;
+}
+
 .is-overflow-hidden {
   overflow: hidden;
 }
 
+.is-overflow-y-auto {
+  overflow-y: auto;
+}
+
 // width and height
 .is-fullwidth {
   width: 100%;
 }
 
-.is-three-fourths-width {
+.three-fourths-width {
   width: 75%;
 }
 
-.is-two-thirds-width {
+.one-fourth-width {
+  width: 25%;
+}
+
+.one-half-width {
+  width: 50%;
+}
+
+.two-thirds-width {
   width: 66%;
 }
 
@@ -77,7 +99,7 @@
 }
 
 .is-medium-width {
-  width: calc($desktop / 2.5);
+  width: calc(size_variables.$desktop / 2.5);
 }
 
 .is-medium-height {
@@ -85,7 +107,11 @@
 }
 
 .is-calc-large-height {
-  height: calc($desktop * 0.66);
+  height: calc(size_variables.$desktop * 0.66);
+}
+
+.is-max-drawer-height {
+  max-height: size_variables.$drawer-height;
 }
 
 // float
diff --git a/ui/app/styles/helper-classes/spacing.scss b/ui/app/styles/helper-classes/spacing.scss
index 8d95939e537..14bc7071db9 100644
--- a/ui/app/styles/helper-classes/spacing.scss
+++ b/ui/app/styles/helper-classes/spacing.scss
@@ -1,88 +1,121 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-/* Helpers that define margin and padding in pixels */
+/* 
+ Helpers that define margin and padding in pixels 
+ *New pattern* Use the numerical value in the name for class selectors
+ i.e. "has-padding-24" instead of "has-padding-l"
+ */
 
 .is-paddingless {
   padding: 0 !important;
 }
 
 .has-short-padding {
-  padding: $spacing-4 $spacing-18;
+  padding: size_variables.$spacing-4 size_variables.$spacing-18;
 }
 
 .has-tall-padding {
-  padding: $spacing-36;
+  padding: size_variables.$spacing-36;
+}
+
+.side-padding-4 {
+  padding-left: size_variables.$spacing-4;
+  padding-right: size_variables.$spacing-4;
+}
+
+.has-side-padding-8 {
+  padding-left: size_variables.$spacing-8;
+  padding-right: size_variables.$spacing-8;
 }
 
 .has-side-padding-s {
-  padding-left: $spacing-12;
-  padding-right: $spacing-12;
+  padding-left: size_variables.$spacing-12;
+  padding-right: size_variables.$spacing-12;
+}
+
+.has-padding-8 {
+  padding: size_variables.$spacing-8;
 }
 
 .has-padding-s {
-  padding: $spacing-12;
+  padding: size_variables.$spacing-12;
 }
 
 .has-padding-xxs {
-  padding: $spacing-4;
+  padding: size_variables.$spacing-4;
 }
 
 .has-padding-m {
-  padding: $spacing-16;
-}
-.has-padding-l {
-  padding: $spacing-24;
+  padding: size_variables.$spacing-16;
 }
 
 .has-padding-l {
-  padding: $spacing-24;
+  padding: size_variables.$spacing-24;
 }
 
 .has-bottom-padding-s {
-  padding-bottom: $spacing-12;
+  padding-bottom: size_variables.$spacing-12;
 }
 
 .has-bottom-padding-m {
-  padding-bottom: $spacing-16;
+  padding-bottom: size_variables.$spacing-16;
 }
 
 .has-bottom-padding-l {
-  padding-bottom: $spacing-24;
+  padding-bottom: size_variables.$spacing-24;
+}
+
+.top-padding-4 {
+  padding-top: size_variables.$spacing-4;
 }
 
 .has-top-padding-xs {
-  padding-top: $spacing-8;
+  padding-top: size_variables.$spacing-8;
+}
+
+.top-padding-10 {
+  padding-top: size_variables.$spacing-10;
 }
 
 .has-top-padding-s {
-  padding-top: $spacing-12;
+  padding-top: size_variables.$spacing-12;
 }
 
 .has-top-padding-m {
-  padding-top: $spacing-16;
+  padding-top: size_variables.$spacing-16;
 }
 
 .has-top-padding-l {
-  padding-top: $spacing-24;
+  padding-top: size_variables.$spacing-24;
 }
 
 .has-left-padding-xs {
-  padding-left: $spacing-8;
+  padding-left: size_variables.$spacing-8;
 }
 
 .has-left-padding-s {
-  padding-left: $spacing-12;
+  padding-left: size_variables.$spacing-12;
+}
+
+.left-padding-16 {
+  padding-left: size_variables.$spacing-16;
 }
 
 .has-left-padding-l {
-  padding-left: $spacing-24;
+  padding-left: size_variables.$spacing-24;
+}
+
+.right-padding-4 {
+  padding-right: size_variables.$spacing-4;
 }
 
 .has-top-padding-xxl {
-  padding-top: $spacing-48;
+  padding-top: size_variables.$spacing-48;
 }
 
 // All Margin helpers
@@ -90,127 +123,137 @@
   margin: 0 !important;
 }
 
+// spacing-18 is between medium + large
 .has-top-bottom-margin {
-  margin: $spacing-18 0rem;
+  margin: size_variables.$spacing-18 0rem;
 }
 
 .has-top-bottom-margin-xxs {
-  margin: $spacing-4 0;
+  margin: size_variables.$spacing-4 0;
+}
+
+// moving towards numerical class names (i.e. -12) and away from s/m/l etc.
+.has-top-bottom-margin-12 {
+  margin: size_variables.$spacing-12 0;
 }
 
 .has-top-margin-negative-m {
-  margin-top: -$spacing-16;
+  margin-top: -(size_variables.$spacing-16);
 }
 
 .has-top-bottom-margin-negative-m {
-  margin-top: -$spacing-16;
-  margin-bottom: -$spacing-16;
+  margin-top: -(size_variables.$spacing-16);
+  margin-bottom: -(size_variables.$spacing-16);
 }
 
 .has-top-margin-negative-xxl {
-  margin-top: -$spacing-48;
-}
-
-.has-right-margin-xxs {
-  margin-right: $spacing-4;
+  margin-top: -(size_variables.$spacing-48);
 }
 
 .has-left-margin-xxs {
-  margin-left: $spacing-4;
+  margin-left: size_variables.$spacing-4;
 }
 
 .has-bottom-margin-xxs {
-  margin-bottom: $spacing-4 !important;
+  margin-bottom: size_variables.$spacing-4 !important;
 }
 
 .has-bottom-margin-xs {
-  margin-bottom: $spacing-8 !important;
+  margin-bottom: size_variables.$spacing-8 !important;
 }
 
 .has-bottom-margin-s {
-  margin-bottom: $spacing-12;
+  margin-bottom: size_variables.$spacing-12;
 }
 
 .has-bottom-margin-m {
-  margin-bottom: $spacing-16;
+  margin-bottom: size_variables.$spacing-16;
 }
 
 .has-bottom-margin-l {
-  margin-bottom: $spacing-24;
+  margin-bottom: size_variables.$spacing-24;
 }
 
 .has-bottom-margin-xl {
-  margin-bottom: $spacing-36;
+  margin-bottom: size_variables.$spacing-36;
 }
 
 .has-bottom-margin-xxl {
-  margin-bottom: $spacing-48;
+  margin-bottom: size_variables.$spacing-48;
 }
 
 .has-top-margin-xxs {
-  margin-top: $spacing-4;
+  margin-top: size_variables.$spacing-4;
 }
 
 .has-top-margin-s {
-  margin-top: $spacing-12;
+  margin-top: size_variables.$spacing-12;
 }
 
 .has-top-margin-xs {
-  margin-top: $spacing-8;
+  margin-top: size_variables.$spacing-8;
 }
 
 .has-top-margin-m {
-  margin-top: $spacing-16;
+  margin-top: size_variables.$spacing-16;
 }
 
 .has-top-margin-l {
-  margin-top: $spacing-24;
+  margin-top: size_variables.$spacing-24;
 }
 
 .has-top-margin-xl {
-  margin-top: $spacing-36;
+  margin-top: size_variables.$spacing-36;
 }
 
 .has-top-margin-xxl {
-  margin-top: $spacing-48;
+  margin-top: size_variables.$spacing-48;
 }
 
 .has-top-margin-xxxl {
-  margin-top: $spacing-64;
+  margin-top: size_variables.$spacing-64;
 }
 
 .has-top-margin-negative-s {
-  margin-top: (-1 * $spacing-12);
+  margin-top: (-1 * size_variables.$spacing-12);
 }
 
 .has-left-margin-xxs {
-  margin-left: $spacing-4;
+  margin-left: size_variables.$spacing-4;
 }
 
 .has-left-margin-xs {
-  margin-left: $spacing-8;
+  margin-left: size_variables.$spacing-8;
 }
 
 .has-left-margin-s {
-  margin-left: $spacing-12;
+  margin-left: size_variables.$spacing-12;
 }
 
 .has-left-margin-m {
-  margin-left: $spacing-16;
+  margin-left: size_variables.$spacing-16;
 }
 
 .has-left-margin-l {
-  margin-left: $spacing-24;
+  margin-left: size_variables.$spacing-24;
 }
 
 .has-left-margin-xl {
-  margin-left: $spacing-36;
+  margin-left: size_variables.$spacing-36;
+}
+
+.has-right-margin-4 {
+  margin-right: size_variables.$spacing-4;
+}
+
+.has-right-margin-8 {
+  margin-right: size_variables.$spacing-8;
 }
 
 .has-right-margin-m {
-  margin-right: $spacing-16;
+  margin-right: size_variables.$spacing-16;
 }
 
 .has-right-margin-l {
-  margin-right: $spacing-24;
+  margin-right: size_variables.$spacing-24;
 }
diff --git a/ui/app/styles/helper-classes/typography.scss b/ui/app/styles/helper-classes/typography.scss
index 8466b0c2944..d9bef55cdf3 100644
--- a/ui/app/styles/helper-classes/typography.scss
+++ b/ui/app/styles/helper-classes/typography.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,45 +10,45 @@
 
 // font size helpers
 .is-size-4 {
-  font-size: $size-4 !important;
+  font-size: var(--token-typography-display-400-font-size) !important;
 }
 
 .is-size-5 {
-  font-size: $size-5 !important;
+  font-size: size_variables.$size-5 !important;
 }
 
 .is-size-6 {
-  font-size: $size-6 !important;
+  font-size: var(--token-typography-body-300-font-size) !important;
 }
 
 .is-size-7 {
-  font-size: $size-7 !important;
+  font-size: size_variables.$size-7 !important;
 }
 
 .is-size-8 {
-  font-size: $size-8 !important;
+  font-size: var(--token-typography-body-200-font-size) !important;
 }
 
 .is-size-9 {
-  font-size: $size-9 !important;
+  font-size: size_variables.$size-9 !important;
 }
 
 // Font weight
 .has-font-weight-normal {
-  font-weight: $font-weight-normal;
+  font-weight: var(--token-typography-font-weight-regular);
 }
 
 .has-text-weight-semibold {
-  font-weight: $font-weight-semibold !important;
+  font-weight: var(--token-typography-font-weight-semibold) !important;
 }
 
 .has-text-weight-bold {
-  font-weight: $font-weight-bold !important;
+  font-weight: var(--token-typography-font-weight-bold) !important;
 }
 
 // Font family
 .is-font-mono {
-  font-family: $family-monospace;
+  font-family: var(--token-typography-font-stack-code);
 }
 
 .masked-font {
@@ -61,6 +63,9 @@
 .is-no-underline {
   text-decoration: none;
 }
+.line-through {
+  text-decoration: line-through;
+}
 
 // Text transformations
 .is-lowercase {
@@ -90,20 +95,20 @@
 
 // Text color or styling
 .is-help {
-  font-size: $size-8;
-  margin-top: $size-11;
+  font-size: var(--token-typography-body-200-font-size);
+  margin-top: size_variables.$size-11;
 }
 
 .help {
   display: block;
   font-size: 0.85714rem;
-  margin-top: $size-11;
+  margin-top: size_variables.$size-11;
 }
 
 .sub-text {
   color: var(--token-color-foreground-faint);
-  margin-bottom: $size-11;
-  font-size: $size-8;
+  margin-bottom: size_variables.$size-11;
+  font-size: var(--token-typography-body-200-font-size);
 
   strong {
     color: inherit;
diff --git a/ui/app/styles/reset.scss b/ui/app/styles/reset.scss
index 56c85a3f538..18c87a00be0 100644
--- a/ui/app/styles/reset.scss
+++ b/ui/app/styles/reset.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/utils/_box-shadow_variables.scss b/ui/app/styles/utils/_box-shadow_variables.scss
index 3ffa5966883..7789e6298e4 100644
--- a/ui/app/styles/utils/_box-shadow_variables.scss
+++ b/ui/app/styles/utils/_box-shadow_variables.scss
@@ -1,24 +1,32 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 // TODO: lots of inconsistent variation on box-shadow usage. Fix.
 
 // box
-$box-shadow: 0 0 0 1px rgba($black, 0.1);
-$box-shadow-low: 0 5px 1px -2px rgba($black, 0.12), 0 3px 2px -1px rgba($black, 0);
-$box-shadow-middle: 0 8px 4px -4px rgba($black, 0.1), 0 6px 8px -2px rgba($black, 0.05);
-$box-shadow-high: 0 12px 5px -7px rgba($black, 0.08), 0 11px 10px -3px rgba($black, 0.1);
-$box-shadow-highest: 0 16px 6px -10px rgba($black, 0.06), 0 16px 16px -4px rgba($black, 0.2);
+$box-shadow: 0 0 0 1px rgba(hsl(0, 0%, 4%), 0.1);
+$box-shadow-low:
+  0 5px 1px -2px rgba(hsl(0, 0%, 4%), 0.12),
+  0 3px 2px -1px rgba(hsl(0, 0%, 4%), 0);
+$box-shadow-middle:
+  0 8px 4px -4px rgba(hsl(0, 0%, 4%), 0.1),
+  0 6px 8px -2px rgba(hsl(0, 0%, 4%), 0.05);
+$box-shadow-high:
+  0 12px 5px -7px rgba(hsl(0, 0%, 4%), 0.08),
+  0 11px 10px -3px rgba(hsl(0, 0%, 4%), 0.1);
+$box-shadow-highest:
+  0 16px 6px -10px rgba(hsl(0, 0%, 4%), 0.06),
+  0 16px 16px -4px rgba(hsl(0, 0%, 4%), 0.2);
 
 // box-link
-$box-link-shadow: 0 0 0 1px $ui-gray-200;
-$box-link-hover-shadow: 0 0 0 1px $ui-gray-300;
+$box-link-shadow: 0 0 0 1px var(--token-color-palette-neutral-200);
+$box-link-hover-shadow: 0 0 0 1px var(--token-color-palette-neutral-300);
 
 // border
-$base-border: 1px solid $ui-gray-300;
-$light-border: 1px solid $ui-gray-200;
+$base-border: 1px solid var(--token-color-palette-neutral-300);
+$light-border: 1px solid var(--token-color-palette-neutral-200);
 
 // button specific
-$button-box-shadow-standard: 0 3px 1px 0 rgba($black, 0.12);
+$button-box-shadow-standard: 0 3px 1px 0 rgba(hsl(0, 0%, 4%), 0.12);
diff --git a/ui/app/styles/utils/_color_variables.scss b/ui/app/styles/utils/_color_variables.scss
deleted file mode 100644
index 7b714b2d146..00000000000
--- a/ui/app/styles/utils/_color_variables.scss
+++ /dev/null
@@ -1,98 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// UI Gray
-$ui-gray-010: #fbfbfc;
-$ui-gray-050: #f7f8fa;
-$ui-gray-100: #ebeef2;
-$ui-gray-200: #dce0e6;
-$ui-gray-300: #bac1cc;
-$ui-gray-400: #8e96a3;
-$ui-gray-500: #6f7682;
-$ui-gray-600: #626873;
-$ui-gray-700: #525761;
-$ui-gray-800: #373a42;
-$ui-gray-900: #1f2124;
-$grey-lightest: $ui-gray-050;
-$grey-light: $ui-gray-300;
-$grey: $ui-gray-500;
-$grey-dark: $ui-gray-700;
-$grey-darkest: $ui-gray-900;
-
-// Black
-$black: hsl(0, 0%, 4%); // in hex: #0a0a0a
-
-// White
-$white: hsl(0, 0%, 100%);
-
-// Blue
-$blue-010: #fbfcff;
-$blue-050: #f0f5ff;
-$blue-100: #bfd4ff;
-$blue-300: #5b92ff;
-$blue-500: #1563ff;
-$blue-700: #0e40a3;
-$blue-900: #061b46;
-$blue-lightest: $blue-050;
-$blue-light: $blue-300;
-$blue: $blue-500;
-$blue-dark: $blue-700;
-$blue-darkest: $blue-900;
-
-// Red
-$red-010: #fdfafb;
-$red-050: #f9ecee;
-$red-100: #efc7cc;
-$red-300: #db7d88;
-$red-500: #c73445;
-$red-700: #7f222c;
-$red-900: #370f13;
-$red-lightest: $red-050;
-$red-light: $red-300;
-$red: $red-500;
-$red-dark: $red-700;
-$red-darkest: $red-900;
-
-// Green
-$green-010: #fafdfa;
-$green-050: #ecf7ed;
-$green-100: #c6e9c9;
-$green-300: #7acc81;
-$green-500: #2eb039;
-$green-700: #1e7125;
-$green-900: #0d3010;
-$green-lightest: $green-050;
-$green-light: $green-300;
-$green: $green-500;
-$green-dark: $green-700;
-$green-darkest: $green-900;
-
-// Orange
-$orange-010: #fffcfa;
-$orange-050: #fef4ec;
-$orange-100: #fde0c8;
-$orange-300: #fbb77f;
-$orange-500: #fa8f37;
-$orange-700: #a05c23;
-$orange-900: #45270f;
-$orange-lightest: $orange-050;
-$orange-light: $orange-300;
-$orange: $orange-500;
-$orange-dark: $orange-700;
-$orange-darkest: $orange-900;
-
-// Yellow
-$yellow-010: #fffdf6;
-$yellow-050: #fffbed;
-$yellow-100: #fdeeba;
-$yellow-300: #fbd95e;
-$yellow-500: #fac402;
-$yellow-700: #a07d02;
-$yellow-900: #453601;
-$yellow-lightest: $yellow-050;
-$yellow-light: $yellow-300;
-$yellow: $yellow-500;
-$yellow-dark: $yellow-700;
-$yellow-darkest: $yellow-900;
diff --git a/ui/app/styles/utils/_font_variables.scss b/ui/app/styles/utils/_font_variables.scss
deleted file mode 100644
index 73fd7ca707e..00000000000
--- a/ui/app/styles/utils/_font_variables.scss
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// Vars relating to font-family or font-weight.
-
-$family-sans: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu',
-  'Cantarell', 'Fira Sans', 'Droid Sans', 'Helvetica Neue', sans-serif;
-
-$family-monospace: 'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, Courier, monospace;
-
-/* Font weight */
-$font-weight-normal: 400;
-$font-weight-semibold: 600;
-$font-weight-bold: 700;
diff --git a/ui/app/styles/utils/_size_variables.scss b/ui/app/styles/utils/_size_variables.scss
index 97d1a532033..99eb89f6857 100644
--- a/ui/app/styles/utils/_size_variables.scss
+++ b/ui/app/styles/utils/_size_variables.scss
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-$base-font-size: 16px;
+$base-font-size: var(--token-typography-body-300-font-size); // 16px
 
 /* 
 General sizing in rem values
@@ -35,10 +35,6 @@ $spacing-36: 36px;
 $spacing-48: 48px;
 $spacing-64: 64px;
 
-/* Border radius */
-$radius: 2px;
-$radius-large: 4px;
-
 /* Responsiveness */
 // 960, 1152, and 1344 have been chosen because they are divisible by both 12 and 16
 $mobile: 769px;
@@ -52,8 +48,4 @@ $easing: ease-out;
 
 /* Nav */
 $drawer-width: 300px;
-
-// Wizard
-// Not being used: https://github.com/hashicorp/vault/pull/19220
-// $wizard-progress-bar-height: 6px;
-// $wizard-progress-check-size: 16px;
+$drawer-height: 300px;
diff --git a/ui/app/styles/utils/animations.scss b/ui/app/styles/utils/animations.scss
index feb82246d97..149eb7a2d78 100644
--- a/ui/app/styles/utils/animations.scss
+++ b/ui/app/styles/utils/animations.scss
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/styles/utils/mixins.scss b/ui/app/styles/utils/mixins.scss
index 6402219487b..f6aa7bf9b08 100644
--- a/ui/app/styles/utils/mixins.scss
+++ b/ui/app/styles/utils/mixins.scss
@@ -1,5 +1,6 @@
+@use 'sass:math';
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -43,9 +44,9 @@
   &:before {
     border-color: rgba($border-color, 0);
     border-bottom-color: $border-color;
-    border-width: $size + round(1.41421356 * $border-width);
+    border-width: $size + math.round(1.41421356 * $border-width);
     left: calc(#{$left} + #{$left-offset});
-    margin-left: -($size + round(1.41421356 * $border-width));
+    margin-left: -($size + math.round(1.41421356 * $border-width));
   }
   &:before,
   &:after {
diff --git a/ui/app/styles/utils/swagger.scss b/ui/app/styles/utils/swagger.scss
index e1ab0954217..ea381bb2a30 100644
--- a/ui/app/styles/utils/swagger.scss
+++ b/ui/app/styles/utils/swagger.scss
@@ -1,5 +1,7 @@
+@use '../utils/size_variables';
+
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,4 +10,64 @@
 /* align list items with container */
 .swagger-ember .swagger-ui .wrapper {
   padding: 0;
+
+  .info a {
+    color: var(--token-color-palette-blue-300);
+  }
+
+  .title {
+    small {
+      background-color: var(--token-color-palette-neutral-600);
+    }
+    .version-stamp {
+      background-color: var(--token-color-palette-green-300);
+    }
+  }
+
+  .opblock-deprecated {
+    opacity: 1;
+
+    .opblock-summary-method {
+      background-color: var(--token-color-foreground-faint);
+    }
+  }
+
+  .opblock-get {
+    .opblock-summary-method {
+      background-color: var(--token-color-palette-blue-200);
+    }
+  }
+
+  .opblock-post,
+  .opblock-patch {
+    .opblock-summary-method {
+      background-color: var(--token-color-palette-green-300);
+    }
+  }
+
+  .opblock-delete {
+    .opblock-summary-method {
+      background-color: var(--token-color-palette-red-200);
+    }
+  }
+
+  .opblock-summary-path-description-wrapper {
+    width: min-content;
+    flex-grow: 1;
+  }
+
+  .info {
+    margin: size_variables.$spacing-8 0;
+
+    .title {
+      font-size: size_variables.$size-5;
+    }
+  }
+
+  .copy-to-clipboard {
+    &:focus,
+    &:focus-visible {
+      width: size_variables.$size-4;
+    }
+  }
 }
diff --git a/ui/app/templates/application.hbs b/ui/app/templates/application.hbs
index a384a3a0559..5f2ffccb36d 100644
--- a/ui/app/templates/application.hbs
+++ b/ui/app/templates/application.hbs
@@ -1,10 +1,11 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Sidebar::Frame @showSidebar={{this.auth.isActiveSession}}>
   <div class="page-container">
     {{outlet}}
   </div>
+  <BasicDropdownWormhole />
 </Sidebar::Frame>
\ No newline at end of file
diff --git a/ui/app/templates/components/auth-config-form/config.hbs b/ui/app/templates/components/auth-config-form/config.hbs
deleted file mode 100644
index d0aa09c9e91..00000000000
--- a/ui/app/templates/components/auth-config-form/config.hbs
+++ /dev/null
@@ -1,27 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form {{action (perform this.saveModel) on="submit"}}>
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <NamespaceReminder @mode="save" @noun="Auth Method" />
-    <MessageError @model={{this.model}} />
-    {{#if this.model.attrs}}
-      {{#each this.model.attrs as |attr|}}
-        <FormField data-test-field={{true}} @attr={{attr}} @model={{@model}} />
-      {{/each}}
-    {{else if this.model.fieldGroups}}
-      <FormFieldGroups @model={{this.model}} @mode={{this.mode}} />
-    {{/if}}
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <Hds::Button
-      @text="Save"
-      @icon={{if this.saveModel.isRunning "loading"}}
-      type="submit"
-      data-test-save-config="true"
-      disabled={{this.saveModel.isRunning}}
-    />
-  </div>
-</form>
\ No newline at end of file
diff --git a/ui/app/templates/components/auth-config-form/options.hbs b/ui/app/templates/components/auth-config-form/options.hbs
deleted file mode 100644
index eaef6e030dc..00000000000
--- a/ui/app/templates/components/auth-config-form/options.hbs
+++ /dev/null
@@ -1,23 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form {{action (perform this.saveModel) on="submit"}}>
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <MessageError @model={{this.model}} @errorMessage={{this.model.errorMessage}} />
-    <NamespaceReminder @mode="save" @noun="Auth Method" />
-    {{#each this.model.tuneAttrs as |attr|}}
-      <FormField data-test-field @attr={{attr}} @model={{this.model}} />
-    {{/each}}
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <Hds::Button
-      @text="Update options"
-      @icon={{if this.saveModel.isRunning "loading"}}
-      type="submit"
-      data-test-save-config="true"
-      disabled={{this.saveModel.isRunning}}
-    />
-  </div>
-</form>
\ No newline at end of file
diff --git a/ui/app/templates/components/auth-form-options.hbs b/ui/app/templates/components/auth-form-options.hbs
deleted file mode 100644
index ace2085cfb2..00000000000
--- a/ui/app/templates/components/auth-form-options.hbs
+++ /dev/null
@@ -1,33 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#unless this.selectedAuthIsPath}}
-  <div class="box has-slim-padding is-shadowless">
-    <ToggleButton @isOpen={{this.isOpen}} @onClick={{fn (mut this.isOpen)}} data-test-auth-form-options-toggle />
-    {{#if this.isOpen}}
-      <div class="field">
-        <label for="custom-path" class="is-label">
-          Mount path
-        </label>
-        <div class="control">
-          <input
-            type="text"
-            name="custom-path"
-            id="custom-path"
-            class="input"
-            value={{@customPath}}
-            oninput={{action @onPathChange value="target.value"}}
-            data-test-auth-form-mount-path
-          />
-        </div>
-        <AlertInline
-          class="has-top-padding-s"
-          @type="info"
-          @message="If this backend was mounted using a non-default path, enter it here."
-        />
-      </div>
-    {{/if}}
-  </div>
-{{/unless}}
\ No newline at end of file
diff --git a/ui/app/templates/components/auth-form.hbs b/ui/app/templates/components/auth-form.hbs
deleted file mode 100644
index d7c1c35e7ca..00000000000
--- a/ui/app/templates/components/auth-form.hbs
+++ /dev/null
@@ -1,204 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-<div class="auth-form" data-test-auth-form>
-  {{#if (and this.waitingForOktaNumberChallenge (not this.cancelAuthForOktaNumberChallenge))}}
-    <OktaNumberChallenge
-      @correctAnswer={{this.oktaNumberChallengeAnswer}}
-      @hasError={{(not-eq this.error null)}}
-      @onReturnToLogin={{action "returnToLoginFromOktaNumberChallenge"}}
-    />
-  {{else}}
-    {{#if this.hasMethodsWithPath}}
-      <nav class="tabs is-marginless">
-        <ul>
-          {{#each this.methodsToShow as |method|}}
-            {{#let (or method.path method.type) as |methodKey|}}
-              <li
-                class={{if
-                  (and
-                    this.selectedAuthIsPath (eq (or this.selectedAuthBackend.path this.selectedAuthBackend.type) methodKey)
-                  )
-                  "is-active"
-                  ""
-                }}
-                data-test-auth-method={{method.id}}
-              >
-                <LinkTo
-                  @route="vault.cluster.auth"
-                  @model={{this.cluster.name}}
-                  @query={{hash with=methodKey}}
-                  data-test-auth-method-link={{method.type}}
-                >
-                  {{or method.id (capitalize method.type)}}
-                </LinkTo>
-              </li>
-            {{/let}}
-          {{/each}}
-          <li class={{unless this.selectedAuthIsPath "is-active" ""}} data-test-auth-method>
-            <LinkTo
-              @route="vault.cluster.auth"
-              @model={{this.cluster.name}}
-              @query={{hash with="token"}}
-              data-test-auth-method-link="other"
-            >
-              Other
-            </LinkTo>
-          </li>
-        </ul>
-      </nav>
-    {{/if}}
-    <div class="box is-marginless is-shadowless">
-      <MessageError @errorMessage={{if (and this.cluster.standby this.hasCSPError) this.cspErrorText this.error}} />
-      {{#if this.selectedAuthBackend.path}}
-        <div class="has-bottom-margin-s">
-          <p class="is-label">{{this.selectedAuthBackend.path}}</p>
-          <span class="description has-text-grey" data-test-description={{true}}>
-            {{this.selectedAuthBackend.mountDescription}}
-          </span>
-        </div>
-      {{/if}}
-      {{#if (or (not this.hasMethodsWithPath) (not this.selectedAuthIsPath))}}
-        <Select
-          @label="Method"
-          @name="auth-method"
-          @options={{this.authMethods}}
-          @valueAttribute={{"type"}}
-          @labelAttribute={{"typeDisplay"}}
-          @isFullwidth={{true}}
-          @selectedValue={{this.selectedAuth}}
-          @onChange={{action (mut this.selectedAuth)}}
-        />
-      {{/if}}
-      {{#if (or (eq this.selectedAuthBackend.type "jwt") (eq this.selectedAuthBackend.type "oidc"))}}
-        <AuthJwt
-          @onError={{action "handleError"}}
-          @onLoading={{action (mut this.isLoading)}}
-          @namespace={{this.namespace}}
-          @onNamespace={{action (mut this.namespace)}}
-          @onSubmit={{action "doSubmit"}}
-          @onRoleName={{action (mut this.roleName)}}
-          @roleName={{this.roleName}}
-          @selectedAuthType={{this.selectedAuthBackend.type}}
-          @selectedAuthPath={{or this.customPath this.selectedAuthBackend.id}}
-          @disabled={{or this.authenticate.isRunning this.isLoading}}
-        >
-          <AuthFormOptions
-            @customPath={{this.customPath}}
-            @onPathChange={{action (mut this.customPath)}}
-            @selectedAuthIsPath={{this.selectedAuthIsPath}}
-          />
-        </AuthJwt>
-      {{else if (eq this.selectedAuthBackend.type "saml")}}
-        <AuthSaml
-          @onError={{action "handleError"}}
-          @onLoading={{action (mut this.isLoading)}}
-          @namespace={{this.namespace}}
-          @onNamespace={{action (mut this.namespace)}}
-          @onSubmit={{action "doSubmit"}}
-          @onRoleName={{action (mut this.roleName)}}
-          @roleName={{this.roleName}}
-          @selectedAuthType={{this.selectedAuthBackend.type}}
-          @selectedAuthPath={{or this.customPath this.selectedAuthBackend.id}}
-          @disabled={{or this.authenticate.isRunning this.isLoading}}
-        >
-          <AuthFormOptions
-            @customPath={{this.customPath}}
-            @onPathChange={{action (mut this.customPath)}}
-            @selectedAuthIsPath={{this.selectedAuthIsPath}}
-          />
-        </AuthSaml>
-      {{else}}
-        <form id="auth-form" onsubmit={{action "doSubmit" null}}>
-          {{#if (eq this.providerName "github")}}
-            <div class="field">
-              <label for="token" class="is-label">GitHub token</label>
-              <div class="control">
-                <Input
-                  @type="password"
-                  @value={{this.token}}
-                  name="token"
-                  id="token"
-                  class="input"
-                  data-test-token={{true}}
-                  autocomplete="off"
-                  spellcheck="false"
-                />
-              </div>
-            </div>
-          {{else if (eq this.providerName "token")}}
-            <div class="field">
-              <label for="token" class="is-label">Token</label>
-              <div class="control">
-                <Input
-                  @type="password"
-                  @value={{this.token}}
-                  name="token"
-                  class="input"
-                  autocomplete="off"
-                  spellcheck="false"
-                  data-test-token={{true}}
-                  id="token"
-                />
-              </div>
-            </div>
-          {{else}}
-            <div class="field">
-              <label for="username" class="is-label">Username</label>
-              <div class="control">
-                <Input
-                  @value={{this.username}}
-                  name="username"
-                  id="username"
-                  class="input"
-                  autocomplete="off"
-                  spellcheck="false"
-                  data-test-username={{true}}
-                />
-              </div>
-            </div>
-            <div class="field">
-              <label for="password" class="is-label">Password</label>
-              <div class="control">
-                <Input
-                  @value={{this.password}}
-                  name="password"
-                  id="password"
-                  @type="password"
-                  class="input"
-                  autocomplete="off"
-                  spellcheck="false"
-                  data-test-password={{true}}
-                />
-              </div>
-            </div>
-          {{/if}}
-          {{#if (not-eq this.selectedAuthBackend.type "token")}}
-            <AuthFormOptions
-              @customPath={{this.customPath}}
-              @onPathChange={{action (mut this.customPath)}}
-              @selectedAuthIsPath={{this.selectedAuthIsPath}}
-            />
-          {{/if}}
-          <Hds::Button
-            @text="Sign in"
-            @icon={{if this.authenticate.isRunning "loading"}}
-            data-test-auth-submit={{true}}
-            type="submit"
-            disabled={{this.authenticate.isRunning}}
-            id="auth-submit"
-          />
-          {{#if (and this.delayAuthMessageReminder.isIdle this.showLoading)}}
-            <AlertInline
-              class="has-top-padding-s"
-              @type="info"
-              @message="If login takes longer than usual, you may need to check your device for an MFA notification, or contact your administrator if login times out."
-              data-test-auth-message="push"
-            />
-          {{/if}}
-        </form>
-      {{/if}}
-    </div>
-  {{/if}}
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/auth-jwt.hbs b/ui/app/templates/components/auth-jwt.hbs
deleted file mode 100644
index 5a8f2e28004..00000000000
--- a/ui/app/templates/components/auth-jwt.hbs
+++ /dev/null
@@ -1,69 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form id="auth-form" {{on "submit" (action "signIn")}}>
-  <div class="field">
-    <label for="role" class="is-label">Role</label>
-    <div class="control">
-      <input
-        value={{this.roleName}}
-        placeholder="Default"
-        autocomplete="off"
-        spellcheck="false"
-        name="role"
-        id="role"
-        class="input"
-        type="text"
-        {{on "input" (action "onRoleChange")}}
-        data-test-role
-      />
-    </div>
-    <AlertInline
-      class="has-top-padding-s"
-      @type="info"
-      @message="Leave blank to sign in with the default role if one is configured"
-    />
-  </div>
-  {{#unless this.isOIDC}}
-    <div class="field">
-      <label for="jwt-token" class="is-label">JWT Token</label>
-      <div class="control">
-        <Input
-          @type="password"
-          @value={{this.jwt}}
-          id="jwt-token"
-          name="jwt"
-          class="input"
-          autocomplete="off"
-          spellcheck="false"
-          data-test-jwt
-        />
-      </div>
-    </div>
-  {{/unless}}
-  <div data-test-yield-content>
-    {{yield}}
-  </div>
-
-  {{#if this.isOIDC}}
-    <Hds::Button
-      @text={{concat "Sign in with " (or this.role.providerName "OIDC Provider")}}
-      @icon={{if @disabled "loading" this.role.providerIcon}}
-      data-test-auth-submit
-      type="submit"
-      disabled={{@disabled}}
-      id="auth-submit"
-    />
-  {{else}}
-    <Hds::Button
-      @text="Sign in"
-      @icon={{if @disabled "loading"}}
-      data-test-auth-submit
-      type="submit"
-      disabled={{@disabled}}
-      id="auth-submit"
-    />
-  {{/if}}
-</form>
\ No newline at end of file
diff --git a/ui/app/templates/components/auth-method/configuration.hbs b/ui/app/templates/components/auth-method/configuration.hbs
deleted file mode 100644
index bddbfdc139f..00000000000
--- a/ui/app/templates/components/auth-method/configuration.hbs
+++ /dev/null
@@ -1,22 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="box is-fullwidth is-sideless is-paddingless is-marginless">
-  {{#each @model.attrs as |attr|}}
-    {{#if (eq attr.type "object")}}
-      <InfoTableRow
-        @alwaysRender={{not (is-empty-value (get @model attr.name))}}
-        @label={{or attr.options.label (to-label attr.name)}}
-        @value={{stringify (get @model attr.name)}}
-      />
-    {{else}}
-      <InfoTableRow
-        @alwaysRender={{not (is-empty-value (get @model attr.name))}}
-        @label={{or attr.options.label (to-label attr.name)}}
-        @value={{get @model attr.name}}
-      />
-    {{/if}}
-  {{/each}}
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/b64-toggle.hbs b/ui/app/templates/components/b64-toggle.hbs
deleted file mode 100644
index a352672403d..00000000000
--- a/ui/app/templates/components/b64-toggle.hbs
+++ /dev/null
@@ -1,10 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if this.isBase64}}
-  Decode from base64
-{{else}}
-  Encode to base64
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/configure-aws-secret.hbs b/ui/app/templates/components/configure-aws-secret.hbs
deleted file mode 100644
index 52403a12a33..00000000000
--- a/ui/app/templates/components/configure-aws-secret.hbs
+++ /dev/null
@@ -1,159 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="tabs-container box is-sideless is-fullwidth is-paddingless is-marginless">
-  <nav class="tabs" aria-label="navigation to configure A-W-S backend">
-    <ul>
-      <li>
-        <LinkTo
-          @route="vault.cluster.settings.configure-secret-backend"
-          @model={{@model.id}}
-          @query={{hash tab=""}}
-          data-test-aws-link="root-creds"
-        >
-          Dynamic IAM root credentials
-        </LinkTo>
-      </li>
-      <li>
-        <LinkTo
-          @route="vault.cluster.settings.configure-secret-backend"
-          @model={{@model.id}}
-          @query={{hash tab="leases"}}
-          data-test-aws-link="leases"
-        >
-          Leases
-        </LinkTo>
-      </li>
-    </ul>
-  </nav>
-</div>
-
-{{#if (eq @tab "leases")}}
-  <form
-    onsubmit={{action "saveLease" (hash lease=@model.lease lease_max=@model.leaseMax)}}
-    aria-label="save lease form"
-    data-test-aws-leases-form="true"
-  >
-    <div class="box is-fullwidth is-shadowless is-marginless">
-      <NamespaceReminder @mode="saved" @noun="configuration" />
-      <MessageError @model={{@model}} />
-      <p class="has-text-grey-dark">
-        If you do not supply lease settings, we will use the default values in AWS.
-      </p>
-    </div>
-    <TtlPicker
-      @label="Lease"
-      @initialValue={{@model.lease}}
-      @initialEnabled={{@model.lease}}
-      @onChange={{fn this.handleTtlChange "lease"}}
-    />
-    <TtlPicker
-      @label="Maximum Lease"
-      @initialValue={{@model.leaseMax}}
-      @initialEnabled={{@model.leaseMax}}
-      @onChange={{fn this.handleTtlChange "leaseMax"}}
-    />
-    <div class="box is-bottomless is-fullwidth">
-      <Hds::Button @text="Save" data-test-aws-input="lease-save" type="submit" />
-    </div>
-  </form>
-{{else}}
-  <form
-    onsubmit={{action
-      "saveRootCreds"
-      (hash access_key=@accessKey iam_endpoint=@iamEndpoint sts_endpoint=@stsEndpoint secret_key=@secretKey region=@region)
-    }}
-    data-test-aws-root-creds-form="true"
-    aria-label="save root creds form"
-  >
-    <div class="box is-fullwidth is-shadowless is-marginless">
-      <NamespaceReminder @mode="save" @noun="configuration" />
-      <p class="has-text-grey-dark">
-        Note: the client uses the official AWS SDK and will use the specified credentials, environment credentials, shared
-        file credentials, or IAM role/ECS task credentials in that order.
-      </p>
-    </div>
-
-    <div class="field">
-      <label for="access" class="is-label">
-        Access key
-      </label>
-      <div class="control">
-        <Input
-          @type="text"
-          id="access"
-          name="access"
-          class="input"
-          autocomplete="off"
-          spellcheck="false"
-          @value={{@accessKey}}
-          data-test-aws-input="accessKey"
-        />
-      </div>
-    </div>
-
-    <div class="field">
-      <label for="secret" class="is-label">
-        Secret key
-      </label>
-      <div class="control">
-        <Input
-          @type="password"
-          id="secret"
-          name="secret"
-          class="input"
-          @value={{@secretKey}}
-          data-test-aws-input="secretKey"
-        />
-      </div>
-    </div>
-
-    <ToggleButton @isOpen={{this.showOptions}} @onClick={{fn (mut this.showOptions)}} />
-    {{#if this.showOptions}}
-      <div class="box is-marginless">
-        <div class="field">
-          <label for="region" class="is-label">
-            Region
-          </label>
-          <div class="control is-expanded">
-            <div class="select is-fullwidth">
-              <select
-                name="region"
-                id="region"
-                onchange={{action (mut @region) value="target.value"}}
-                data-test-input="region"
-              >
-                <option value=""></option>
-                {{#each (aws-regions) as |val|}}
-                  <option>{{val}}</option>
-                {{/each}}
-              </select>
-            </div>
-          </div>
-        </div>
-        <div class="field">
-          <label for="iam" class="is-label">
-            IAM endpoint
-          </label>
-          <div class="control">
-            <Input @type="text" id="iam" name="iam" class="input" @value={{@iamEndpoint}} />
-          </div>
-        </div>
-        <div class="field">
-          <label for="sts" class="is-label">
-            STS endpoint
-          </label>
-          <div class="control">
-            <Input @type="text" id="sts" name="sts" class="input" @value={{@stsEndpoint}} />
-          </div>
-        </div>
-      </div>
-    {{/if}}
-
-    <div class="box is-bottomless is-fullwidth">
-      <Hds::Button @text="Save" data-test-aws-input="root-save" type="submit" />
-    </div>
-  </form>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/configure-ssh-secret.hbs b/ui/app/templates/components/configure-ssh-secret.hbs
deleted file mode 100644
index b7eb3e91fb4..00000000000
--- a/ui/app/templates/components/configure-ssh-secret.hbs
+++ /dev/null
@@ -1,91 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if @configured}}
-  <div class="box is-fullwidth is-sideless is-marginless">
-    <div class="field">
-      <label for="publicKey" class="is-label">
-        Public key
-      </label>
-      <div class="control">
-        <MaskedInput
-          @name="publickey"
-          @id="publicKey"
-          @value={{@model.publicKey}}
-          @displayOnly={{true}}
-          @allowCopy={{true}}
-          data-test-ssh-input="public-key"
-        />
-      </div>
-    </div>
-  </div>
-  <div class="field is-grouped-split box is-fullwidth is-bottomless">
-    <Hds::ButtonSet>
-      <Hds::Copy::Button
-        @text="Copy"
-        @textToCopy={{@model.publicKey}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-        class="primary"
-      />
-      <ConfirmAction
-        @buttonText="Delete"
-        @buttonColor="secondary"
-        @confirmMessage="This will remove the CA certificate information."
-        @onConfirmAction={{this.delete}}
-      />
-    </Hds::ButtonSet>
-  </div>
-{{else}}
-  <form {{on "submit" this.saveConfig}} data-test-ssh-configure-form="true">
-    <div class="box is-fullwidth is-sideless is-marginless">
-      <NamespaceReminder @mode="save" @noun="configuration" />
-      <div class="field">
-        <label for="privateKey" class="is-label">
-          Private key
-        </label>
-        <div class="control">
-          <MaskedInput @name="privateKey" id="privateKey" @value={{@model.privateKey}} @onChange={{mut @model.privateKey}} />
-        </div>
-      </div>
-      <div class="field">
-        <label for="publicKey" class="is-label">
-          Public key
-        </label>
-        <div class="control">
-          <Textarea name="publicKey" id="publicKey" class="input" @value={{@model.publicKey}} />
-        </div>
-      </div>
-      <div class="b-checkbox">
-        <Input
-          @type="checkbox"
-          id="generateSigningKey"
-          class="styled"
-          @checked={{@model.generateSigningKey}}
-          {{on "change" (fn (mut @model.generateSigningKey) (not @model.generateSigningKey))}}
-          data-test-ssh-input="generate-signing-key-checkbox"
-        />
-        <label for="generateSigningKey" class="is-label">
-          Generate signing key
-          <InfoTooltip>
-            Specifies if Vault should generate the signing key pair internally
-          </InfoTooltip>
-        </label>
-      </div>
-    </div>
-    <div class="field box is-fullwidth is-bottomless is-marginless">
-      <div class="control">
-        <Hds::Button
-          @text="Save"
-          @icon={{if @loading "loading"}}
-          type="submit"
-          disabled={{@loading}}
-          data-test-ssh-input="configure-submit"
-        />
-      </div>
-    </div>
-  </form>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/console/command-input.hbs b/ui/app/templates/components/console/command-input.hbs
deleted file mode 100644
index d7c6394bff3..00000000000
--- a/ui/app/templates/components/console/command-input.hbs
+++ /dev/null
@@ -1,29 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="console-ui-input" data-test-component="console/command-input">
-  {{#if this.isRunning}}
-    <div class="control console-spinner is-loading"></div>
-  {{else}}
-    <Chevron />
-  {{/if}}
-  <input
-    aria-label="command input"
-    onkeyup={{action "handleKeyUp"}}
-    value={{this.value}}
-    autocomplete="off"
-    spellcheck="false"
-  />
-  <Hds::Button
-    class="hds-side-nav__icon-button"
-    {{on "click" (action "fullscreen")}}
-    {{hds-tooltip (if this.isFullscreen "minimize" "maximize")}}
-    data-test-tool-tip-trigger
-    @icon={{if this.isFullscreen "minimize" "maximize"}}
-    @text={{if this.isFullscreen "Minimize" "Maximize"}}
-    @isIconOnly={{true}}
-  />
-</div>
-<NamespaceReminder @class="console-reminder" @mode="execute" @noun="command" />
\ No newline at end of file
diff --git a/ui/app/templates/components/console/log-json.hbs b/ui/app/templates/components/console/log-json.hbs
deleted file mode 100644
index d3ca9001d25..00000000000
--- a/ui/app/templates/components/console/log-json.hbs
+++ /dev/null
@@ -1,24 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="console-ui-output">
-  <JsonEditor
-    @showToolbar={{false}}
-    @value={{stringify this.content}}
-    @readOnly={{true}}
-    @viewportMargin="Infinity"
-    @gutters={{false}}
-    @theme="hashi auto-height"
-  />
-  <Hds::Copy::Button
-    @text="Copy"
-    @isIconOnly={{true}}
-    @textToCopy={{stringify this.content}}
-    @onError={{(fn
-      (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-    )}}
-    class="transparent icon-grey-500 top-right-absolute"
-  />
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/console/log-list.hbs b/ui/app/templates/components/console/log-list.hbs
deleted file mode 100644
index ace5f2cdb3d..00000000000
--- a/ui/app/templates/components/console/log-list.hbs
+++ /dev/null
@@ -1,23 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="console-ui-output">
-  <pre>
-    Keys
-    {{#each this.list as |item|}}
-      {{item}}
-
-    {{/each}}
-  </pre>
-  <Hds::Copy::Button
-    @text="Copy"
-    @isIconOnly={{true}}
-    @textToCopy={{multi-line-join this.list}}
-    @onError={{(fn
-      (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-    )}}
-    class="transparent icon-grey-500 top-right-absolute"
-  />
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/console/log-object.hbs b/ui/app/templates/components/console/log-object.hbs
deleted file mode 100644
index c2c3bf21224..00000000000
--- a/ui/app/templates/components/console/log-object.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="console-ui-output">
-  <pre>{{this.columns}}</pre>
-  <Hds::Copy::Button
-    @text="Copy"
-    @isIconOnly={{true}}
-    @textToCopy={{this.columns}}
-    @onError={{(fn
-      (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-    )}}
-    class="transparent icon-grey-500 top-right-absolute"
-  />
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/console/log-text.hbs b/ui/app/templates/components/console/log-text.hbs
deleted file mode 100644
index dc16eef8b49..00000000000
--- a/ui/app/templates/components/console/log-text.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="console-ui-output">
-  <pre>{{@content}}</pre>
-  <Hds::Copy::Button
-    @text="Copy"
-    @isIconOnly={{true}}
-    @textToCopy={{@content}}
-    @onError={{(fn
-      (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-    )}}
-    class="transparent icon-grey-500 top-right-absolute"
-  />
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/console/ui-panel.hbs b/ui/app/templates/components/console/ui-panel.hbs
deleted file mode 100644
index c90f8aa0263..00000000000
--- a/ui/app/templates/components/console/ui-panel.hbs
+++ /dev/null
@@ -1,44 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="console-close-button">
-  <Hds::Button
-    class="hds-side-nav__icon-button"
-    {{on "click" (action "closeConsole")}}
-    data-test-console-panel-close
-    @text="Close console"
-    @icon="x"
-    @isIconOnly={{true}}
-  />
-</div>
-<div class="console-ui-panel-content">
-  <div class="content has-bottom-margin-l">
-    <p class="console-ui-panel-intro is-font-mono has-bottom-margin-s">
-      The Vault Web REPL provides an easy way to execute common Vault CLI commands, such as write, read, delete, and list. It
-      does not include KV version 2 write or put commands. For guidance, type `help`. For more detailed documentation, see
-      the
-      <Hds::Link::Inline @href={{doc-link "/vault/docs/command/web"}}>HashiCorp Developer site</Hds::Link::Inline>.
-    </p>
-    <p class="console-ui-panel-intro is-font-mono has-bottom-margin-s">Examples:</p>
-    <p class="console-ui-panel-intro is-font-mono">→ Write secrets to kv v1: write &lt;mount&gt;/my-secret foo=bar</p>
-    <p class="console-ui-panel-intro is-font-mono">→ List kv v1 secret keys: list &lt;mount&gt;/</p>
-    <p class="console-ui-panel-intro is-font-mono">→ Read a kv v1 secret: read &lt;mount&gt;/my-secret</p>
-    <p class="console-ui-panel-intro is-font-mono">→ Mount a kv v2 secret engine: write sys/mounts/&lt;mount&gt; type=kv
-      options=version=2</p>
-    <p class="console-ui-panel-intro is-font-mono">→ Read a kv v2 secret: kv-get &lt;mount&gt;/secret-path</p>
-    <p class="console-ui-panel-intro is-font-mono">→ Read a kv v2 secret's metadata: kv-get &lt;mount&gt;/secret-path
-      -metadata</p>
-  </div>
-  <Console::OutputLog @outputLog={{this.cliLog}} />
-  <Console::CommandInput
-    @isFullscreen={{this.isFullscreen}}
-    @isRunning={{this.isRunning}}
-    @value={{this.inputValue}}
-    @onValueUpdate={{action (mut this.inputValue)}}
-    @onFullscreen={{action "toggleFullscreen"}}
-    @onExecuteCommand={{action "executeCommand"}}
-    @onShiftCommand={{action "shiftCommandIndex"}}
-  />
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/control-group-success.hbs b/ui/app/templates/components/control-group-success.hbs
deleted file mode 100644
index 4946ee5329f..00000000000
--- a/ui/app/templates/components/control-group-success.hbs
+++ /dev/null
@@ -1,76 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if (and this.controlGroupResponse.token this.controlGroupResponse.uiParams.url)}}
-  <div class="control-group-success" data-test-navigate-message>
-    You have been granted access to
-    <code>{{this.model.requestPath}}</code>. Be careful, you can only access this data once. If you need access again in the
-    future you will need to get authorized again.
-    <div class="box is-shadowless is-fullwidth is-marginless has-slim-padding">
-      <Hds::Button @text="Visit" data-test-navigate-button {{on "click" (action (perform this.markAndNavigate))}} />
-    </div>
-  </div>
-{{else}}
-  {{#if this.unwrapData}}
-    <div class="control-group-success is-editor">
-      <div class="is-relative">
-        <JsonEditor
-          data-test-json-viewer
-          @showToolbar={{false}}
-          @value={{stringify this.unwrapData}}
-          @readOnly={{true}}
-          @viewportMargin="Infinity"
-          @gutters={{false}}
-          @theme="hashi-read-only auto-height"
-        />
-        <Hds::Copy::Button
-          @text="Copy"
-          @isIconOnly={{true}}
-          @textToCopy={{stringify this.unwrapData}}
-          @onError={{(fn
-            (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-          )}}
-          class="transparent top-right-absolute"
-        />
-      </div>
-    </div>
-    <div class="field is-grouped box is-fullwidth is-bottomless">
-      <Hds::Button
-        @text="Back"
-        @color="secondary"
-        @route="vault.cluster.access.control-groups"
-        @icon="chevron-left"
-        @iconPosition="leading"
-      />
-    </div>
-  {{else}}
-    <div class="control-group-success" data-test-unwrap-form>
-      <form {{action (perform this.unwrap this.token) on="submit"}}>
-        <MessageError @errorMessage={{this.error}} />
-        <p>
-          If you have the token, you can now can access
-          <code>{{this.model.requestPath}}</code>
-        </p>
-        <label for="token" class="is-label">
-          Token to access data
-        </label>
-        <div class="control">
-          <Input
-            data-test-token-input
-            class="input"
-            autocomplete="off"
-            spellcheck="false"
-            name="token"
-            id="token"
-            @value={{this.token}}
-          />
-        </div>
-        <div class="field is-grouped box is-fullwidth is-bottomless">
-          <Hds::Button @text="Access" data-test-unwrap-button type="submit" disabled={{not this.token}} />
-        </div>
-      </form>
-    </div>
-  {{/if}}
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/control-group.hbs b/ui/app/templates/components/control-group.hbs
deleted file mode 100644
index bb33c26435c..00000000000
--- a/ui/app/templates/components/control-group.hbs
+++ /dev/null
@@ -1,143 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="box is-fullwidth is-bottomless is-sideless">
-  <MessageError @model={{this.model}} />
-  <div class="control-group-header {{if this.isSuccess 'is-success'}}">
-    <p>
-      <Icon @name={{if this.isSuccess "check-circle-fill" "lock-fill"}} />
-      <strong data-test-banner-prefix>{{this.bannerPrefix}}</strong>
-      <span data-test-banner-text>{{this.bannerText}}</span>
-    </p>
-  </div>
-  {{#if
-    (and
-      this.model.approved
-      (not this.currentUserHasAuthorized)
-      (or (not this.model.requestEntity) this.currentUserIsRequesting)
-    )
-  }}
-    <ControlGroupSuccess
-      data-test-control-group-success
-      @model={{this.model}}
-      @controlGroupResponse={{this.controlGroupResponse}}
-    />
-  {{else}}
-    <div class="control-group">
-      <div data-test-requestor-text>
-        {{#if this.model.requestEntity.canRead}}
-          <LinkTo
-            @route="vault.cluster.access.identity.show"
-            @models={{array "entities" this.model.requestEntity.id "details"}}
-          >
-            {{this.requestorName}}
-          </LinkTo>
-        {{else}}
-          {{this.requestorName}}
-        {{/if}}
-        {{#if this.currentUserIsRequesting}}are{{else}}is{{/if}}
-        {{#if this.model.approved}}
-          authorized to access
-          <code>{{this.model.requestPath}}</code>
-        {{else}}
-          requesting access to
-          <code>{{this.model.requestPath}}</code>
-        {{/if}}
-      </div>
-
-      {{#if (or (not this.model.requestEntity) this.currentUserIsRequesting)}}
-        <div class="message is-highlight" data-test-accessor-callout>
-          <Hds::Copy::Button
-            @text="Copy"
-            @isIconOnly={{true}}
-            @textToCopy={{this.model.id}}
-            @onError={{(fn
-              (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-            )}}
-            class="transparent top-right-absolute"
-          />
-          <div class="message-body">
-            <h4 class="title is-7 is-marginless">
-              Accessor
-            </h4>
-            <code class="is-word-break" data-test-accessor-value>{{this.model.id}}</code>
-          </div>
-        </div>
-      {{/if}}
-
-      <div class="authorizations" data-test-authorizations>
-        {{#if (gt this.model.authorizations.length 0)}}
-          <span class="has-text-success">
-            <Icon @name="check-circle" />
-          </span>
-          Already approved by
-          {{#each this.model.authorizations as |authorization index|}}
-            {{~#if authorization.canRead~}}
-              <LinkTo @route="vault.cluster.access.identity.show" @models={{array "entities" authorization.id "details"}}>
-                {{authorization.name}}
-              </LinkTo>
-            {{~else~}}
-              {{authorization.name}}
-            {{~/if~}}{{#if (lt (inc index) this.model.authorizations.length)}},{{/if}}
-          {{/each}}
-        {{else}}
-          <span class="has-text-grey">
-            <Icon @name="check-circle" />
-          </span>
-          Awaiting authorization.
-        {{/if}}
-      </div>
-    </div>
-  {{/if}}
-
-  {{#if this.controlGroupResponse.token}}
-    <div class="is-flex-row has-bottom-margin-m has-top-margin-m" data-test-token>
-      <p class="has-text-grey has-padding-xxs">
-        We’ve saved your request token, but you may want to copy it just in case:
-      </p>
-      <div>
-        <Hds::Copy::Snippet
-          data-test-token-value
-          @textToCopy={{this.controlGroupResponse.token}}
-          @color="secondary"
-          @onError={{(fn
-            (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-          )}}
-        />
-      </div>
-    </div>
-  {{/if}}
-  {{! template-lint-configure simple-unless "warn" }}
-  {{#unless (and this.model.approved (or (not this.model.requestEntity) this.currentUserIsRequesting))}}
-    <div class="field is-grouped box is-fullwidth is-bottomless">
-      {{#if this.model.canAuthorize}}
-        {{#if (or this.model.approved this.currentUserHasAuthorized)}}
-          <Hds::Button
-            @text="Back"
-            @color="secondary"
-            @route="vault.cluster.access.control-groups"
-            @icon="chevron-left"
-            @iconPosition="leading"
-            data-test-back-link
-          />
-        {{else}}
-          <Hds::Button
-            @text="Authorize"
-            @icon={{if this.authorize.isRunning "loading"}}
-            {{on "click" (action (perform this.authorize))}}
-            data-test-authorize-button
-          />
-        {{/if}}
-      {{else}}
-        <Hds::Button
-          @text="Refresh"
-          @icon={{if this.refresh.isRunning "loading"}}
-          {{on "click" (action (perform this.refresh))}}
-          data-test-refresh-button
-        />
-      {{/if}}
-    </div>
-  {{/unless}}
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/dashboard/client-count-card.hbs b/ui/app/templates/components/dashboard/client-count-card.hbs
deleted file mode 100644
index bdaea93f5b3..00000000000
--- a/ui/app/templates/components/dashboard/client-count-card.hbs
+++ /dev/null
@@ -1,63 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<Hds::Card::Container @hasBorder={{true}} class="has-padding-l" data-test-card="client-count">
-  <div class="is-flex-between">
-    <h3 class="title is-4 has-bottom-margin-xxs" data-test-client-count-title>
-      Client count
-    </h3>
-
-    <LinkTo @route="vault.cluster.clients">Details</LinkTo>
-  </div>
-
-  <hr class="has-background-gray-100" />
-
-  {{#if this.noActivityData}}
-    {{! This will likely not be show since the client activity api was changed to always return data. In the past it
-  would return no activity data. Adding this empty state here to match the current client count behavior }}
-    <Clients::NoData @config={{this.clientConfig}} />
-  {{else}}
-    {{#if this.fetchClientActivity.isRunning}}
-      <VaultLogoSpinner />
-    {{else}}
-      <div class="is-grid grid-2-columns grid-gap-2 has-top-margin-m grid-align-items-start is-flex-v-centered">
-        <StatText
-          @label="Total"
-          @value={{this.activityData.total.clients}}
-          @size="l"
-          @subText="The number of clients in this billing period ({{date-format
-            this.licenseStartTime
-            'MMM yyyy'
-          }} - {{date-format this.updatedAt 'MMM yyyy'}})."
-          data-test-stat-text="total-clients"
-        />
-        <StatText
-          @label="New"
-          @value={{this.currentMonthActivityTotalCount}}
-          @size="l"
-          @subText="The number of clients new to Vault in the current month."
-          data-test-stat-text="new-clients"
-        />
-      </div>
-
-      <div class="has-top-margin-l is-flex-center">
-        <Hds::Button
-          @text="Refresh"
-          @isIconOnly={{true}}
-          @color="tertiary"
-          @icon="sync"
-          disabled={{this.fetchClientActivity.isRunning}}
-          class="has-padding-xxs"
-          {{on "click" (perform this.fetchClientActivity)}}
-          data-test-refresh
-        />
-        <small class="has-left-margin-xs has-text-grey">
-          Updated
-          {{date-format this.updatedAt "MMM dd, yyyy hh:mm:ss"}}
-        </small>
-      </div>
-    {{/if}}
-  {{/if}}
-</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/app/templates/components/dashboard/overview.hbs b/ui/app/templates/components/dashboard/overview.hbs
deleted file mode 100644
index d8fca59d943..00000000000
--- a/ui/app/templates/components/dashboard/overview.hbs
+++ /dev/null
@@ -1,55 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<Dashboard::VaultVersionTitle @version={{@version}} />
-
-<div class="has-bottom-margin-xl">
-  <div class="is-flex-row has-gap-l">
-    {{#if (and @version.isEnterprise (or @license @isRootNamespace))}}
-      <div class="is-flex-column is-flex-1 has-gap-l">
-        {{#if @license}}
-          <Dashboard::ClientCountCard @license={{@license}} />
-        {{/if}}
-        {{#if
-          (and @isRootNamespace (has-permission "status" routeParams="replication") (not (is-empty-value @replication)))
-        }}
-          <Dashboard::ReplicationCard
-            @replication={{@replication}}
-            @version={{@version}}
-            @refresh={{@refreshModel}}
-            @updatedAt={{@replicationUpdatedAt}}
-          />
-        {{/if}}
-        <Dashboard::SecretsEnginesCard @secretsEngines={{@secretsEngines}} />
-      </div>
-
-      <div class="is-flex-column is-flex-1 has-gap-l">
-        <Dashboard::QuickActionsCard @secretsEngines={{@secretsEngines}} />
-        {{#if @vaultConfiguration}}
-          <Dashboard::VaultConfigurationDetailsCard @vaultConfiguration={{@vaultConfiguration}} />
-        {{/if}}
-        <div>
-          <Dashboard::LearnMoreCard @isEnterprise={{@version.isEnterprise}} />
-          <Dashboard::SurveyLinkText />
-        </div>
-      </div>
-
-    {{else}}
-      <div class="is-flex-column is-flex-1 has-gap-l">
-        <Dashboard::SecretsEnginesCard @secretsEngines={{@secretsEngines}} />
-        <div>
-          <Dashboard::LearnMoreCard @isEnterprise={{@version.isEnterprise}} />
-          <Dashboard::SurveyLinkText />
-        </div>
-      </div>
-      <div class="is-flex-column is-flex-1 has-gap-l">
-        <Dashboard::QuickActionsCard @secretsEngines={{@secretsEngines}} />
-        {{#if @vaultConfiguration}}
-          <Dashboard::VaultConfigurationDetailsCard @vaultConfiguration={{@vaultConfiguration}} />
-        {{/if}}
-      </div>
-    {{/if}}
-  </div>
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/dashboard/replication-state-text.hbs b/ui/app/templates/components/dashboard/replication-state-text.hbs
deleted file mode 100644
index 76d29c5d101..00000000000
--- a/ui/app/templates/components/dashboard/replication-state-text.hbs
+++ /dev/null
@@ -1,37 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div>
-  <h2 class="is-size-5 has-text-weight-semibold has-bottom-margin-xs" data-test-title={{@title}}>
-    {{@title}}
-  </h2>
-
-  {{#if @subText}}
-    <div class="title is-8 has-font-weight-normal has-text-grey-dark" data-test-subtext={{@title}}>
-      {{@subText}}
-    </div>
-  {{/if}}
-
-  <ToolTip @verticalPosition="above" @horizontalPosition="center" as |T|>
-    <T.Trigger
-      data-test-tooltip-trigger
-      tabindex="-1"
-      class="title is-4 has-text-weight-semibold has-top-margin-xxs has-bottom-margin-xxs"
-      data-test-tooltip-title={{@title}}
-    >
-      {{or @state "not set up"}}
-
-      <FlightIcon
-        @name={{or @clusterStates.glyph "x-circle"}}
-        class={{if @clusterStates.isOk "has-text-success" "has-text-danger"}}
-      />
-    </T.Trigger>
-    <T.Content @defaultClass="tool-tip smaller-font">
-      <div class="box" data-test-hover-copy-tooltip-text>
-        The cluster's current operating state
-      </div>
-    </T.Content>
-  </ToolTip>
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/dashboard/survey-link-text.hbs b/ui/app/templates/components/dashboard/survey-link-text.hbs
deleted file mode 100644
index 7d53a4dd057..00000000000
--- a/ui/app/templates/components/dashboard/survey-link-text.hbs
+++ /dev/null
@@ -1,14 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="has-top-padding-xs has-bottom-padding-xs has-top-margin-m" data-test-feedback-form>
-  <small>
-    Don't see what you're looking for on this page? Let us know via our
-    <Hds::Link::Inline @icon="external-link" @href="https://hashicorp.sjc1.qualtrics.com/jfe/form/SV_1SNUsZLdWHpfw0e">
-      feedback form
-    </Hds::Link::Inline>
-    .
-  </small>
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/database-role-edit.hbs b/ui/app/templates/components/database-role-edit.hbs
deleted file mode 100644
index 8e63faebe02..00000000000
--- a/ui/app/templates/components/database-role-edit.hbs
+++ /dev/null
@@ -1,160 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.top>
-    <KeyValueHeader @path="vault.cluster.secrets.backend.show" @mode={{this.mode}} @root={{@root}} @showCurrent={{true}} />
-  </p.top>
-  <p.levelLeft>
-    <h1 class="title is-3" data-test-secret-header="true">
-      {{#if (eq @mode "create")}}
-        Create Role
-      {{else if (eq @mode "edit")}}
-        Edit Role
-      {{else}}
-        {{@model.id}}
-      {{/if}}
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-{{#if (eq @mode "show")}}
-  <Toolbar>
-    <ToolbarActions>
-      {{#if @model.canDelete}}
-        <ConfirmAction
-          @buttonText="Delete role"
-          class="toolbar-button"
-          @buttonColor="secondary"
-          @onConfirmAction={{action "delete"}}
-          @confirmTitle="Delete role?"
-          @confirmMessage="This role will be permanently deleted. You will need to recreate it to use it again."
-          data-test-database-role-delete
-        />
-        <div class="toolbar-separator"></div>
-      {{/if}}
-      {{#if (and @model.canRotateRoleCredentials (eq @model.type "static"))}}
-        <Hds::Button
-          @text="Rotate credentials"
-          @color="secondary"
-          class="toolbar-button"
-          {{on "click" (fn this.rotateRoleCred @model.id)}}
-        />
-      {{/if}}
-      {{#if
-        (or
-          (and (eq @model.type "static") @model.canGetCredentials)
-          (and (eq @model.type "dynamic") @model.canGenerateCredentials)
-        )
-      }}
-        <Hds::Button
-          @text={{if (eq @model.type "static") "Get credentials" "Generate credentials"}}
-          @color="secondary"
-          class="toolbar-button"
-          {{on "click" (fn this.generateCreds @model.id @model.type)}}
-          data-test-database-role-creds={{@model.type}}
-        />
-      {{/if}}
-      {{#if @model.canEditRole}}
-        <ToolbarSecretLink
-          @secret={{concat "role/" @model.id}}
-          @mode="edit"
-          @replace={{true}}
-          @queryParams={{hash itemType="role"}}
-          data-test-edit-link={{true}}
-        >
-          Edit role
-        </ToolbarSecretLink>
-      {{/if}}
-    </ToolbarActions>
-  </Toolbar>
-  {{#each @model.showFields as |attr|}}
-    {{#let attr.options.defaultShown as |defaultDisplay|}}
-      {{#if (eq attr.type "object")}}
-        <InfoTableRow
-          @alwaysRender={{true}}
-          @defaultShown={{defaultDisplay}}
-          @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-          @value={{stringify (get @model attr.name)}}
-        />
-      {{else if (eq attr.options.editType "ttl")}}
-        <InfoTableRow
-          @alwaysRender={{true}}
-          @defaultShown={{defaultDisplay}}
-          @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-          @value={{format-duration (get @model attr.name)}}
-          @isLink={{eq attr.name "database"}}
-        />
-      {{else}}
-        <InfoTableRow
-          @alwaysRender={{true}}
-          @defaultShown={{defaultDisplay}}
-          @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-          @value={{get @model attr.name}}
-          @isLink={{eq attr.name "database"}}
-        />
-      {{/if}}
-    {{/let}}
-  {{/each}}
-{{else}}
-  {{! Edit or Create }}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <form {{on "submit" this.handleCreateEditRole}}>
-      {{#each @model.fieldAttrs as |attr|}}
-        {{#if (eq @mode "edit")}}
-          <ReadonlyFormField @attr={{attr}} @value={{get @model attr.name}} />
-        {{else if (not-eq attr.options.readOnly true)}}
-          <FormField data-test-field={{true}} @attr={{attr}} @model={{@model}} />
-          {{! TODO: If database && !updateDB show warning }}
-          {{#if (get this.warningMessages attr.name)}}
-            <Hds::Alert @type="inline" @color="warning" class="has-top-margin-negative-s has-bottom-margin-s" as |A|>
-              <A.Title>Warning</A.Title>
-              <A.Description>{{get this.warningMessages attr.name}}</A.Description>
-            </Hds::Alert>
-          {{/if}}
-        {{/if}}
-      {{/each}}
-
-      <DatabaseRoleSettingForm
-        @attrs={{@model.roleSettingAttrs}}
-        @roleType={{@model.type}}
-        @model={{@model}}
-        @mode={{@mode}}
-        @dbType={{await this.databaseType}}
-      />
-      <div class="field is-grouped is-grouped-split is-fullwidth box is-bottomless">
-        <div class="field is-grouped">
-          <Hds::ButtonSet>
-            <Hds::Button
-              @text={{if (eq @mode "create") "Create role" "Save"}}
-              @icon={{if this.loading "loading"}}
-              type="submit"
-              disabled={{this.loading}}
-              data-test-secret-save
-            />
-            <Hds::Button
-              @text="Cancel"
-              @color="secondary"
-              @route="vault.cluster.secrets.backend.list-root"
-              @model={{@model.backend}}
-              @query={{hash tab="role"}}
-              data-test-database-role-cancel
-            />
-          </Hds::ButtonSet>
-          {{#if (not (is-empty-value this.warningMessages))}}
-            <Hds::Alert @type="compact" @color="warning" class="has-left-margin-s" as |A|>
-              <A.Title>Warning</A.Title>
-              <A.Description>
-                You don't have permissions required to
-                {{if (eq @mode "create") "create" "update"}}
-                this role. See form for details.
-              </A.Description>
-            </Hds::Alert>
-          {{/if}}
-        </div>
-      </div>
-    </form>
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/database-role-setting-form.hbs b/ui/app/templates/components/database-role-setting-form.hbs
deleted file mode 100644
index 00772421f86..00000000000
--- a/ui/app/templates/components/database-role-setting-form.hbs
+++ /dev/null
@@ -1,40 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="box is-sideless is-fullwidth is-marginless" data-test-role-settings-section>
-  <h3 class="title is-5">Role settings</h3>
-  {{#if this.settingFields}}
-    <div class="form-section">
-      {{#each this.settingFields as |attr|}}
-        {{#if (and (eq @mode "edit") (eq attr.name "username"))}}
-          <ReadonlyFormField @attr={{attr}} @value={{get @model attr.name}} />
-        {{else}}
-          <FormField data-test-field={{true}} @attr={{attr}} @model={{@model}} />
-        {{/if}}
-
-      {{/each}}
-    </div>
-  {{else}}
-    <EmptyState @title="No role type selected" @message="Select a type of role to be able to configure it" />
-  {{/if}}
-</div>
-{{! template-lint-configure simple-unless "warn"  }}
-{{#unless (and @roleType (not this.statementFields))}}
-  <div class="box is-sideless is-fullwidth is-marginless" data-test-statements-section>
-    <h3 class="title is-5">Statements</h3>
-    {{#if this.statementFields}}
-      <div class="form-section">
-        {{#each this.statementFields as |attr|}}
-          <FormField data-test-field={{true}} @attr={{attr}} @model={{@model}} />
-        {{/each}}
-      </div>
-    {{else}}
-      <EmptyState
-        @title="No role type selected"
-        @message="Select a type of role to be able to add statements for creation, revocation, and/or rotation."
-      />
-    {{/if}}
-  </div>
-{{/unless}}
\ No newline at end of file
diff --git a/ui/app/templates/components/date-dropdown.hbs b/ui/app/templates/components/date-dropdown.hbs
deleted file mode 100644
index d154886f6a4..00000000000
--- a/ui/app/templates/components/date-dropdown.hbs
+++ /dev/null
@@ -1,38 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<Hds::SegmentedGroup ...attributes as |S|>
-  <S.Dropdown @listPosition="bottom-left" @height="200px" as |dd|>
-    <dd.ToggleButton data-test-toggle-month @text={{or this.selectedMonth.name "Month"}} @color="secondary" />
-    {{#each this.dropdownMonths as |month|}}
-      <dd.Interactive
-        data-test-dropdown-month={{month.name}}
-        disabled={{if (gt month.index this.maxMonthIdx) true false}}
-        {{on "click" (fn this.selectMonth month dd)}}
-        @text={{month.name}}
-      />
-    {{/each}}
-  </S.Dropdown>
-  <S.Dropdown data-test-year-list @listPosition="bottom-left" @height="200px" as |dd|>
-    <dd.ToggleButton data-test-toggle-year @text={{or this.selectedYear "Year"}} @color="secondary" />
-    {{#each this.dropdownYears as |year|}}
-      <dd.Interactive
-        data-test-dropdown-year={{year}}
-        disabled={{if (eq year this.disabledYear) true false}}
-        {{on "click" (fn this.selectYear year dd)}}
-        @text={{year}}
-      />
-    {{/each}}
-  </S.Dropdown>
-  <S.Button
-    data-test-date-dropdown-submit
-    disabled={{if (and this.selectedMonth this.selectedYear) false true}}
-    {{on "click" this.handleSubmit}}
-    @text={{or @submitText "Submit"}}
-  />
-</Hds::SegmentedGroup>
-{{#if this.invalidDate}}
-  <AlertInline @type="danger" @message={{this.invalidDate}} class="has-top-padding-s" />
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/file-to-array-buffer.hbs b/ui/app/templates/components/file-to-array-buffer.hbs
deleted file mode 100644
index 0d21fcd5895..00000000000
--- a/ui/app/templates/components/file-to-array-buffer.hbs
+++ /dev/null
@@ -1,49 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-<div class="box is-fullwidth is-marginless is-shadowless">
-  <div class="field">
-    <div class="control is-expanded">
-      <label class="is-label">
-        {{@label}}
-      </label>
-      <div class="file is-fullwidth">
-        <div class="file-label" aria-label="Choose a file">
-          <input id="file-input" class="file-input" type="file" {{on "change" this.pickedFile}} data-test-file-input />
-          <label for="file-input" class="file-cta button">
-            <Icon @name="upload" class="has-light-grey-text" />
-            Choose a file…
-          </label>
-          <span class="file-name has-text-grey-dark" data-test-text-file-input-label={{true}}>
-            {{or this.filename "No file chosen"}}
-          </span>
-          {{#if this.filename}}
-            <Hds::Button
-              @text="Clear file selection"
-              @icon="x-circle"
-              @isIconOnly={{true}}
-              @color="secondary"
-              class="file-delete-button"
-              {{on "click" this.fileChange}}
-              data-test-text-clear
-            />
-          {{/if}}
-        </div>
-      </div>
-    </div>
-    {{#if this.filename}}
-      <p class="help has-text-grey">
-        This file is
-        {{this.fileSize}}
-        and was created on
-        {{date-format this.fileLastModified "MMM dd, yyyy hh:mm:ss a"}}.
-      </p>
-    {{/if}}
-    {{#if @fileHelpText}}
-      <p class="help has-text-grey">
-        {{@fileHelpText}}
-      </p>
-    {{/if}}
-  </div>
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/generate-credentials.hbs b/ui/app/templates/components/generate-credentials.hbs
deleted file mode 100644
index 12b1939dec8..00000000000
--- a/ui/app/templates/components/generate-credentials.hbs
+++ /dev/null
@@ -1,158 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.top>
-    <Hds::Breadcrumb>
-      <Hds::Breadcrumb::Item
-        @text={{this.backendPath}}
-        @route="vault.cluster.secrets.backend"
-        @model={{this.backendPath}}
-        data-test-link="role-list"
-      />
-      <Hds::Breadcrumb::Item @text="Credentials" @route="vault.cluster.secrets.backend" @model={{this.backendPath}} />
-      <Hds::Breadcrumb::Item @text={{this.roleName}} @route="vault.cluster.secrets.backend.show" @model={{this.roleName}} />
-      <Hds::Breadcrumb::Item @text={{this.options.title}} @current={{true}} />
-    </Hds::Breadcrumb>
-  </p.top>
-  <p.levelLeft>
-    <h1 data-test-title class="title is-3">
-      {{this.options.title}}
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-{{#if this.model.hasGenerated}}
-  <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
-    <MessageError @model={{this.model}} />
-    {{#unless this.model.isError}}
-      <Hds::Alert @type="inline" @color="warning" class="has-top-bottom-margin" data-test-warning as |A|>
-        <A.Title>Warning</A.Title>
-        <A.Description>
-          You will not be able to access this information later, so please copy the information below.
-        </A.Description>
-      </Hds::Alert>
-    {{/unless}}
-    {{#each this.model.attrs as |attr|}}
-      {{#if (eq attr.type "object")}}
-        <InfoTableRow
-          @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-          @value={{stringify (get this.model attr.name)}}
-        />
-      {{else}}
-        {{#if
-          (or
-            (eq attr.name "key")
-            (eq attr.name "secretKey")
-            (eq attr.name "securityToken")
-            (eq attr.name "privateKey")
-            attr.options.masked
-          )
-        }}
-          {{#if (get this.model attr.name)}}
-            <InfoTableRow
-              @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-              @value={{get this.model attr.name}}
-            >
-              <MaskedInput
-                @value={{get this.model attr.name}}
-                @name={{attr.name}}
-                @displayOnly={{true}}
-                @allowCopy={{true}}
-              />
-            </InfoTableRow>
-          {{/if}}
-        {{else if (and (get this.model attr.name) (or (eq attr.name "issueDate") (eq attr.name "expiryDate")))}}
-          <InfoTableRow
-            data-test-table-row
-            @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-            @value={{date-format (get this.model attr.name) "MMM dd, yyyy hh:mm:ss a"}}
-          />
-        {{else}}
-          <InfoTableRow
-            @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
-            @value={{get this.model attr.name}}
-          />
-        {{/if}}
-      {{/if}}
-    {{/each}}
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Copy::Button
-        @text="Copy credentials"
-        @textToCopy={{this.model.toCreds}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-        class="primary"
-      />
-    </div>
-    {{#if this.model.leaseId}}
-      <div class="control">
-        <Hds::Copy::Button
-          @text="Copy Lease ID"
-          @textToCopy={{this.model.leaseId}}
-          @onError={{(fn
-            (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-          )}}
-          class="secondary"
-        />
-      </div>
-    {{/if}}
-    <div class="control">
-      {{#if this.options.backIsListLink}}
-        <Hds::Button
-          @text="Back"
-          @color="secondary"
-          @route="vault.cluster.secrets.backend.list-root"
-          @model={{this.backendPath}}
-          data-test-secret-generate-back={{true}}
-        />
-      {{else}}
-        <Hds::Button
-          @text="Back"
-          @color="secondary"
-          {{on "click" (action "newModel")}}
-          data-test-secret-generate-back="true"
-        />
-      {{/if}}
-    </div>
-  </div>
-{{else}}
-  <form {{action "create" on="submit"}} data-test-secret-generate-form="true">
-    <div class="box is-sideless no-padding-top is-fullwidth is-marginless">
-      <NamespaceReminder @mode="generate" @noun="credential" />
-      <MessageError @model={{this.model}} />
-      {{#if this.model.helpText}}
-        <p class="is-hint">{{this.model.helpText}}</p>
-      {{/if}}
-      {{#if this.model.fieldGroups}}
-        <FormFieldGroupsLoop @model={{this.model}} @mode={{this.mode}} />
-      {{else}}
-        {{#each this.model.attrs as |attr|}}
-          <FormField data-test-field={{true}} @attr={{attr}} @model={{this.model}} />
-        {{/each}}
-      {{/if}}
-    </div>
-    <div class="field is-grouped box is-fullwidth is-bottomless">
-      <Hds::ButtonSet>
-        <Hds::Button
-          @text="Generate"
-          @icon={{if this.loading "loading"}}
-          type="submit"
-          disabled={{this.loading}}
-          data-test-secret-generate={{true}}
-        />
-        <Hds::Button
-          @text="Cancel"
-          @route="vault.cluster.secrets.backend.list-root"
-          @model={{this.backendPath}}
-          data-test-secret-generate-cancel={{true}}
-        />
-      </Hds::ButtonSet>
-    </div>
-  </form>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/identity/edit-form.hbs b/ui/app/templates/components/identity/edit-form.hbs
deleted file mode 100644
index c631ba68d13..00000000000
--- a/ui/app/templates/components/identity/edit-form.hbs
+++ /dev/null
@@ -1,87 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if (and (eq this.mode "edit") this.model.canDelete)}}
-  <Toolbar>
-    <ToolbarActions>
-      <ConfirmAction
-        class="toolbar-button"
-        @buttonColor="secondary"
-        @buttonText="Delete {{this.model.identityType}}"
-        @confirmTitle="Delete this {{this.model.identityType}}?"
-        @onConfirmAction={{action "deleteItem" this.model}}
-        data-test-entity-item-delete="true"
-      />
-    </ToolbarActions>
-  </Toolbar>
-{{/if}}
-
-<form {{action (perform this.save) on="submit"}}>
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <NamespaceReminder @mode={{this.mode}} @noun={{lowercase (humanize this.model.identityType)}} />
-    <MessageError @model={{this.model}} />
-    {{#if (eq this.mode "merge")}}
-      <Hds::Alert @type="inline" @color="warning" class="has-bottom-margin-s" as |A|>
-        <A.Title>Warning</A.Title>
-        <A.Description>Metadata on merged entities is not preserved, you will need to recreate it on the entity you merge to.</A.Description>
-      </Hds::Alert>
-    {{/if}}
-    {{#each this.model.fields as |attr|}}
-      <FormField data-test-field={{true}} @attr={{attr}} @model={{@model}}>
-        <div class="form-section">
-          {{#if this.model.canCreatePolicies}}
-            <SearchSelectWithModal
-              @id="policies"
-              @label="Policies"
-              @labelClass="title is-4"
-              @models={{array "policy/acl" "policy/rgp"}}
-              @inputValue={{@model.policies}}
-              @onChange={{action (mut this.model.policies)}}
-              @fallbackComponent="string-list"
-              @modalFormTemplate="modal-form/policy-template"
-              @excludeOptions={{array "root"}}
-            />
-          {{else}}
-            <SearchSelect
-              @id="policies"
-              @label="Policies"
-              @labelClass="title is-4"
-              @models={{array "policy/acl" "policy/rgp"}}
-              @inputValue={{@model.policies}}
-              @onChange={{action (mut this.model.policies)}}
-              @fallbackComponent="string-list"
-              @disallowNewItems={{true}}
-            />
-          {{/if}}
-        </div>
-      </FormField>
-    {{/each}}
-  </div>
-
-  <div class="field is-grouped is-grouped-split is-fullwidth box is-bottomless">
-    <div class="field is-grouped">
-      <Hds::ButtonSet>
-        <Hds::Button
-          @text={{if (eq this.mode "create") "Create" "Save"}}
-          @icon={{if this.save.isRunning "loading"}}
-          type="submit"
-          data-test-identity-submit
-          disabled={{this.save.isRunning}}
-        />
-        {{#if (or (eq this.mode "merge") (eq this.mode "create"))}}
-          <Hds::Button @text="Cancel" @color="secondary" @route={{this.cancelLink}} data-test-cancel-link />
-        {{else}}
-          <Hds::Button
-            @text="Cancel"
-            @color="secondary"
-            @route={{this.cancelLink}}
-            @models={{array this.model.id "details"}}
-            data-test-cancel-link
-          />
-        {{/if}}
-      </Hds::ButtonSet>
-    </div>
-  </div>
-</form>
\ No newline at end of file
diff --git a/ui/app/templates/components/identity/lookup-input.hbs b/ui/app/templates/components/identity/lookup-input.hbs
deleted file mode 100644
index 51670f694a1..00000000000
--- a/ui/app/templates/components/identity/lookup-input.hbs
+++ /dev/null
@@ -1,32 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form {{action (perform this.lookup) on="submit"}}>
-  <div class="field is-flex">
-    <div class="control">
-      <div class="select is-fullwidth">
-        <select name="param" id="param" onchange={{action (mut this.param) value="target.value"}}>
-          {{#each (array "alias name" "name" "id" "alias id") as |paramOption|}}
-            <option selected={{eq this.param paramOption}} value={{paramOption}}>
-              Lookup by
-              {{paramOption}}
-            </option>
-          {{/each}}
-        </select>
-      </div>
-    </div>
-    <div class="control">
-      {{#if (eq this.param "alias name")}}
-        <MountAccessorSelect @value={{this.aliasMountAccessor}} @onChange={{action (mut this.aliasMountAccessor)}} />
-      {{/if}}
-    </div>
-    <div class="control is-expanded">
-      <Input class="input" @value={{this.paramValue}} placeholder={{capitalize this.param}} />
-    </div>
-    <div class="control">
-      <Hds::Button @text="Lookup" @color="secondary" class="is-hidden" type="submit" />
-    </div>
-  </div>
-</form>
\ No newline at end of file
diff --git a/ui/app/templates/components/identity/popup-policy.hbs b/ui/app/templates/components/identity/popup-policy.hbs
deleted file mode 100644
index eef6d33d582..00000000000
--- a/ui/app/templates/components/identity/popup-policy.hbs
+++ /dev/null
@@ -1,32 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="has-text-right">
-  <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
-    <dd.ToggleIcon
-      @icon="more-horizontal"
-      @text="Identity policy management options"
-      @hasChevron={{false}}
-      data-test-popup-menu-trigger
-    />
-    <dd.Interactive @text="View policy" @route="vault.cluster.policy.show" @models={{array "acl" @policyName}} />
-    <dd.Interactive @text="Edit policy" @route="vault.cluster.policy.edit" @models={{array "acl" @policyName}} />
-    <dd.Interactive
-      @text="Remove from {{@model.identityType}}"
-      @color="critical"
-      {{on "click" (fn (mut this.showConfirmModal) true)}}
-    />
-  </Hds::Dropdown>
-</div>
-
-{{#if this.showConfirmModal}}
-  <ConfirmModal
-    @color="critical"
-    @onClose={{fn (mut this.showConfirmModal) false}}
-    @onConfirm={{this.removePolicy}}
-    @confirmTitle="Remove this policy?"
-    @confirmMessage="This policy may affect permissions to access Vault data."
-  />
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/mfa/method-list-item.hbs b/ui/app/templates/components/mfa/method-list-item.hbs
deleted file mode 100644
index 75a719a5a3e..00000000000
--- a/ui/app/templates/components/mfa/method-list-item.hbs
+++ /dev/null
@@ -1,56 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<LinkedBlock
-  class="list-item-row"
-  @params={{array "vault.cluster.access.mfa.methods.method" @model.id}}
-  data-test-mfa-method-list-item={{@model.id}}
->
-  <div class="level is-mobile">
-    <div class="level-left">
-      <div class="is-flex-row">
-        <Icon @size="24" @name={{@model.icon}} class="has-text-grey" data-test-mfa-method-list-icon={{@model.type}} />
-        <div>
-          <span class="has-text-weight-semibold has-text-black">
-            {{@model.name}}
-          </span>
-          <span class="tag has-left-margin-xs">
-            {{@model.id}}
-          </span>
-          <div class="has-top-margin-xs">
-            <code class="is-size-9">
-              Namespace:
-              {{@model.namespace_id}}
-            </code>
-          </div>
-        </div>
-      </div>
-    </div>
-    <div class="level-right is-flex is-paddingless is-marginless">
-      <div class="level-item">
-        <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
-          <dd.ToggleIcon
-            @icon="more-horizontal"
-            @text="Manage M-F-A method"
-            @hasChevron={{false}}
-            data-test-popup-menu-trigger
-          />
-          <dd.Interactive
-            @text="Details"
-            @route="vault.cluster.access.mfa.methods.method"
-            @model={{@model.id}}
-            data-test-mfa-method-menu-link="details"
-          />
-          <dd.Interactive
-            @text="Edit"
-            @route="vault.cluster.access.mfa.methods.method.edit"
-            @model={{@model.id}}
-            data-test-mfa-method-menu-link="edit"
-          />
-        </Hds::Dropdown>
-      </div>
-    </div>
-  </div>
-</LinkedBlock>
\ No newline at end of file
diff --git a/ui/app/templates/components/mfa/mfa-form.hbs b/ui/app/templates/components/mfa/mfa-form.hbs
deleted file mode 100644
index f5025b64578..00000000000
--- a/ui/app/templates/components/mfa/mfa-form.hbs
+++ /dev/null
@@ -1,78 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="auth-form" data-test-mfa-form>
-  <div class="box is-marginless is-shadowless">
-    <p data-test-mfa-description>
-      {{this.description}}
-    </p>
-    <form id="auth-form" {{on "submit" this.submit}}>
-      <MessageError @errorMessage={{this.error}} />
-      <div class="field has-top-margin-l">
-        {{#each this.constraints as |constraint index|}}
-          {{#if index}}
-            <hr />
-          {{/if}}
-          {{#if (gt constraint.methods.length 1)}}
-            <Select
-              @label="Multi-factor authentication method"
-              @options={{constraint.methods}}
-              @valueAttribute={{"id"}}
-              @labelAttribute={{"label"}}
-              @isFullwidth={{true}}
-              @noDefault={{true}}
-              @selectedValue={{constraint.selectedId}}
-              @onChange={{fn this.onSelect constraint}}
-              data-test-mfa-select={{index}}
-            />
-          {{else}}
-            <label for="passcode" class="is-label" data-test-mfa-label>
-              {{constraint.selectedMethod.label}}
-            </label>
-          {{/if}}
-          {{#if constraint.selectedMethod.uses_passcode}}
-            <div class="control">
-              {{! template-lint-disable no-autofocus-attribute}}
-              <Input
-                id="passcode"
-                name="passcode"
-                class="input"
-                autocomplete="off"
-                placeholder={{if (gt constraint.methods.length 1) "Enter passcode"}}
-                spellcheck="false"
-                autofocus="true"
-                disabled={{or this.validate.isRunning this.newCodeDelay.isRunning}}
-                @value={{constraint.passcode}}
-                data-test-mfa-passcode={{index}}
-              />
-              {{! template-lint-enable no-autofocus-attribute}}
-            </div>
-          {{else if (eq constraint.methods.length 1)}}
-            <p class="has-text-grey-light" data-test-mfa-push-instruction>
-              Check device for push notification
-            </p>
-          {{/if}}
-        {{/each}}
-      </div>
-      {{#if this.newCodeDelay.isRunning}}
-        <div>
-          <AlertInline @type="danger" @message={{this.codeDelayMessage}} />
-        </div>
-      {{/if}}
-      <Hds::Button
-        @text="Verify"
-        @icon={{if this.validate.isRunning "loading"}}
-        id="validate"
-        type="submit"
-        disabled={{or this.validate.isRunning this.newCodeDelay.isRunning}}
-        data-test-mfa-validate
-      />
-      {{#if this.newCodeDelay.isRunning}}
-        <Icon @name="delay" class="has-text-grey" />
-        <span class="has-text-grey is-v-centered" data-test-mfa-countdown>{{this.countdown}}</span>
-      {{/if}}
-    </form>
-  </div>
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/mfa/mfa-setup-step-one.hbs b/ui/app/templates/components/mfa/mfa-setup-step-one.hbs
deleted file mode 100644
index e1198ec0d93..00000000000
--- a/ui/app/templates/components/mfa/mfa-setup-step-one.hbs
+++ /dev/null
@@ -1,38 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div ...attributes>
-  <p>
-    TOTP Multi-factor authentication (MFA) can be enabled here if it is required by your administrator. This will ensure that
-    you are not prevented from logging into Vault in the future, once MFA is fully enforced.
-  </p>
-  <form id="mfa-setup-step-one" {{on "submit" this.verifyUUID}}>
-    <MessageError @errorMessage={{this.error}} />
-    <div class="field has-top-margin-l">
-      <label class="is-label">
-        Method ID
-      </label>
-
-      {{! template-lint-disable no-autofocus-attribute}}
-      <p class="sub-text">Enter the UUID for your multi-factor authentication method. This can be provided to you by your
-        administrator.</p>
-      <Input
-        id="uuid"
-        name="uuid"
-        class="input"
-        autocomplete="off"
-        spellcheck="false"
-        autofocus="true"
-        @value={{this.UUID}}
-        data-test-input="uuid"
-      />
-    </div>
-
-    <Hds::ButtonSet>
-      <Hds::Button @text="Verify" id="continue" type="submit" disabled={{(is-empty-value this.UUID)}} data-test-verify />
-      <Hds::Button @text="Cancel" @color="secondary" id="cancel" {{on "click" this.redirectPreviousPage}} />
-    </Hds::ButtonSet>
-  </form>
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/mfa/mfa-setup-step-two.hbs b/ui/app/templates/components/mfa/mfa-setup-step-two.hbs
deleted file mode 100644
index c570d99db84..00000000000
--- a/ui/app/templates/components/mfa/mfa-setup-step-two.hbs
+++ /dev/null
@@ -1,53 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div ...attributes>
-  <p>
-    TOTP Multi-factor authentication (MFA) can be enabled here if it is required by your administrator. This will ensure that
-    you are not prevented from logging into Vault in the future, once MFA is fully enforced.
-  </p>
-  <div class="field has-top-margin-l">
-    <MessageError @errorMessage={{this.error}} />
-    {{#if @warning}}
-      <Hds::Alert
-        @type="inline"
-        @color="highlight"
-        class="has-bottom-margin-s has-top-margin-l"
-        data-test-mfa-enabled-warning
-        as |A|
-      >
-        <A.Title>MFA enabled</A.Title>
-        <A.Description>{{@warning}}</A.Description>
-      </Hds::Alert>
-    {{else}}
-      <div class="list-item-row">
-        <div class="center-display">
-          <QrCode
-            @text={{@qrCode}}
-            @colorLight="#F7F7F7"
-            @width={{155}}
-            @height={{155}}
-            @correctLevel="L"
-            data-test-qrcode
-          />
-        </div>
-      </div>
-      <div class="has-top-margin-s">
-        <div class="info-table-row has-no-shadow">
-          <div class="column info-table-row-edit"><Icon @name="alert-triangle-fill" class="has-text-highlight" /></div>
-          <p class="is-size-8">
-            After you leave this page, this QR code will be removed and
-            <strong>cannot</strong>
-            be regenerated.
-          </p>
-        </div>
-      </div>
-    {{/if}}
-    <div class="is-flex-start has-gap has-top-margin-l">
-      <Hds::Button @text="Restart setup" @color="critical" id="restart" {{on "click" this.restartSetup}} data-test-restart />
-      <Hds::Button @text="Done" id="cancel" {{on "click" this.redirectPreviousPage}} data-test-done />
-    </div>
-  </div>
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/mount-backend-form.hbs b/ui/app/templates/components/mount-backend-form.hbs
deleted file mode 100644
index 71818856b60..00000000000
--- a/ui/app/templates/components/mount-backend-form.hbs
+++ /dev/null
@@ -1,64 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.levelLeft>
-    <h1 class="title is-3 title-with-icon" data-test-mount-form-header="true">
-      {{#if this.showEnable}}
-        {{#let (find-by "type" @mountModel.type @mountTypes) as |typeInfo|}}
-          <Icon @name={{typeInfo.glyph}} @size="24" class="has-text-grey-light" />
-          {{#if (eq @mountType "secret")}}
-            {{concat "Enable " typeInfo.displayName " Secrets Engine"}}
-          {{else}}
-            {{concat "Enable " typeInfo.displayName " Authentication Method"}}
-          {{/if}}
-        {{/let}}
-      {{else if (eq @mountType "secret")}}
-        Enable a Secrets Engine
-      {{else}}
-        Enable an Authentication Method
-      {{/if}}
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-<div class="box is-sideless is-bottomless is-fullwidth is-marginless">
-  <NamespaceReminder @mode="enable" @noun={{if (eq @mountType "secret") "Secret Engine" "Auth Method"}} />
-  <MessageError @errorMessage={{this.errorMessage}} />
-  {{#if @mountModel.type}}
-    <form {{on "submit" (perform this.mountBackend)}}>
-      <FormFieldGroups
-        @model={{@mountModel}}
-        @renderGroup="default"
-        @modelValidations={{this.modelValidations}}
-        @onKeyUp={{this.onKeyUp}}
-      />
-      <FormFieldGroups @model={{@mountModel}} @renderGroup="Method Options" />
-
-      <div class="field is-grouped box is-fullwidth is-bottomless">
-        <div class="control">
-          <Hds::Button
-            @text={{if (eq @mountType "secret") "Enable engine" "Enable method"}}
-            @icon={{if this.mountBackend.isRunning "loading"}}
-            type="submit"
-            data-test-mount-submit="true"
-            disabled={{this.mountBackend.isRunning}}
-          />
-        </div>
-        <div class="control">
-          <Hds::Button @text="Back" @color="secondary" data-test-mount-back {{on "click" (fn this.setMountType "")}} />
-        </div>
-        {{#if this.invalidFormAlert}}
-          <div class="control">
-            <AlertInline @type="danger" class="has-top-padding-s" @message={{this.invalidFormAlert}} />
-          </div>
-        {{/if}}
-      </div>
-    </form>
-  {{else}}
-    {{!  Type not yet set, show type options }}
-    <MountBackend::TypeForm @setMountType={{this.setMountType}} @mountType={{@mountType}} />
-  {{/if}}
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/namespace-link.hbs b/ui/app/templates/components/namespace-link.hbs
deleted file mode 100644
index 2c867bdc698..00000000000
--- a/ui/app/templates/components/namespace-link.hbs
+++ /dev/null
@@ -1,21 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-<ExternalLink
-  @href={{this.namespaceLink}}
-  @sameTab={{true}}
-  class={{concat "is-block " this.class}}
-  data-test-namespace-link={{this.normalizedNamespace}}
->
-  {{#if (has-block)}}
-    {{yield}}
-  {{else}}
-    <div class="level is-mobile">
-      <span class="level-left">{{this.namespaceDisplay}}</span>
-      <span class="level-right">
-        <Hds::Button @text="Namespace link" @icon="chevron-right" @isIconOnly={{true}} @color="tertiary" />
-      </span>
-    </div>
-  {{/if}}
-</ExternalLink>
\ No newline at end of file
diff --git a/ui/app/templates/components/namespace-picker.hbs b/ui/app/templates/components/namespace-picker.hbs
deleted file mode 100644
index 787c42d5baa..00000000000
--- a/ui/app/templates/components/namespace-picker.hbs
+++ /dev/null
@@ -1,119 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="namespace-picker" ...attributes>
-  <BasicDropdown @horizontalPosition="left" @verticalPosition="above" as |D|>
-    <D.Trigger
-      @htmlTag="button"
-      class="button is-transparent namespace-picker-trigger has-current-color"
-      data-test-namespace-toggle
-    >
-      <div class="is-flex-center is-flex-1">
-        <Icon @name="org" />
-        <span class="is-flex-1 is-word-break has-text-left is-size-6 has-left-margin-xs">{{this.namespaceDisplay}}</span>
-      </div>
-      <Icon @name="caret" />
-    </D.Trigger>
-    <D.Content @defaultClass="namespace-picker-content">
-      <div class="is-mobile level-left">
-        <h5 class="list-header">Current namespace</h5>
-      </div>
-      <div class="namespace-header-bar level is-mobile">
-        <div class="level-left">
-          <header>
-            <div class="level is-mobile namespace-link">
-              <span class="level-left" data-test-current-namespace>
-                {{if this.namespacePath (concat this.namespacePath "/") "root"}}
-              </span>
-            </div>
-          </header>
-        </div>
-      </div>
-      <div class="namespace-list {{if this.isAnimating 'animated-list'}}">
-        {{#if this.auth.isRootToken}}
-          <div class="has-left-margin-s has-right-margin-s">
-            <span><Icon @name="alert-triangle-fill" class="has-text-highlight" /></span>
-            <span class="is-size-8 has-text-semibold">
-              You are logged in with a root token and will have to reauthenticate when switching namespaces.
-            </span>
-          </div>
-        {{/if}}
-
-        <div class="is-mobile level-left">
-          {{#if this.isUserRootNamespace}}
-            <h5 class="list-header">Namespaces</h5>
-          {{else}}
-            <NamespaceLink
-              @targetNamespace={{or
-                (object-at (dec 2 this.menuLeaves.length) this.lastMenuLeaves)
-                this.auth.authData.userRootNamespace
-              }}
-              @class="namespace-link is-current button is-transparent icon"
-            >
-              <div class="is-flex-align-baseline">
-                <Hds::Button
-                  @text="Go back"
-                  @icon="chevron-left"
-                  @isIconOnly={{true}}
-                  @color="tertiary"
-                  class="is-flex-align-baseline"
-                />
-                <p class="is-size-8 has-text-grey has-text-weight-semibold is-uppercase">Namespaces</p>
-              </div>
-            </NamespaceLink>
-          {{/if}}
-        </div>
-        {{#if (includes "" this.lastMenuLeaves)}}
-          {{! leaf is '' which is the root namespace, and then we need to iterate the root leaves }}
-          <div class="leaf-panel {{if (eq '' this.currentLeaf) 'leaf-panel-current' 'leaf-panel-left'}} ">
-            {{#each this.rootLeaves as |rootLeaf|}}
-              <NamespaceLink @targetNamespace={{rootLeaf}} @class="namespace-link" @showLastSegment={{true}} />
-            {{/each}}
-          </div>
-        {{/if}}
-        {{#each this.lastMenuLeaves as |leaf|}}
-          {{#if leaf}}
-            <div
-              class="leaf-panel
-                {{if (eq leaf this.currentLeaf) 'leaf-panel-current' 'leaf-panel-left'}}
-                {{if (and this.isAdding (eq leaf this.changedLeaf)) 'leaf-panel-adding'}}
-                {{if (and (not this.isAdding) (eq leaf this.changedLeaf)) 'leaf-panel-exiting'}}
-                "
-            >
-              {{#each-in (get this.namespaceTree leaf) as |leafName|}}
-                <NamespaceLink
-                  @targetNamespace={{concat leaf "/" leafName}}
-                  @class="namespace-link"
-                  @showLastSegment={{true}}
-                />
-              {{/each-in}}
-            </div>
-          {{/if}}
-        {{/each}}
-        {{#if this.canList}}
-          <div class="leaf-panel leaf-panel-current">
-            <div class="level">
-              <span class="level-left">
-                <LinkTo @route="vault.cluster.access.namespaces" class="is-block namespace-link namespace-manage-link">
-                  Manage Namespaces
-                </LinkTo>
-              </span>
-              <span class="level-right">
-                <Hds::Button
-                  @text="Refresh namespace list"
-                  @icon="reload"
-                  @isIconOnly={{true}}
-                  @color="tertiary"
-                  data-test-refresh-namespaces
-                  {{on "click" (action "refreshNamespaceList")}}
-                />
-              </span>
-            </div>
-          </div>
-        {{/if}}
-      </div>
-    </D.Content>
-  </BasicDropdown>
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/oidc/client-list.hbs b/ui/app/templates/components/oidc/client-list.hbs
deleted file mode 100644
index 27f00eeea09..00000000000
--- a/ui/app/templates/components/oidc/client-list.hbs
+++ /dev/null
@@ -1,57 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#each @model as |client|}}
-  <LinkedBlock
-    class="list-item-row"
-    @params={{array "vault.cluster.access.oidc.clients.client.details" client.name}}
-    data-test-oidc-client-linked-block={{client.name}}
-  >
-    <div class="level is-mobile">
-      <div class="level-left">
-        <div>
-          <Icon @name="code" class="has-text-grey-light" />
-          <span class="has-text-weight-semibold is-underline">
-            {{client.name}}
-          </span>
-          <div class="has-text-grey is-size-8">
-            Client ID:
-            {{client.clientId}}
-          </div>
-        </div>
-      </div>
-      <div class="level-right is-flex is-paddingless is-marginless">
-        <div class="level-item">
-          {{#if (or client.canRead client.canEdit)}}
-            <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
-              <dd.ToggleIcon
-                @icon="more-horizontal"
-                @text="Application nav options"
-                @hasChevron={{false}}
-                data-test-popup-menu-trigger
-              />
-              {{#if client.canRead}}
-                <dd.Interactive
-                  @text="Details"
-                  @route="vault.cluster.access.oidc.clients.client.details"
-                  @model={{client.name}}
-                  data-test-oidc-client-menu-link="details"
-                />
-              {{/if}}
-              {{#if client.canEdit}}
-                <dd.Interactive
-                  @text="Edit"
-                  @route="vault.cluster.access.oidc.clients.client.edit"
-                  @model={{client.name}}
-                  data-test-oidc-client-menu-link="edit"
-                />
-              {{/if}}
-            </Hds::Dropdown>
-          {{/if}}
-        </div>
-      </div>
-    </div>
-  </LinkedBlock>
-{{/each}}
\ No newline at end of file
diff --git a/ui/app/templates/components/oidc/key-form.hbs b/ui/app/templates/components/oidc/key-form.hbs
deleted file mode 100644
index de8ca37298f..00000000000
--- a/ui/app/templates/components/oidc/key-form.hbs
+++ /dev/null
@@ -1,97 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.top>
-    <Hds::Breadcrumb>
-      {{#if @model.isNew}}
-        <Hds::Breadcrumb::Item @text="Keys" @route="vault.cluster.access.oidc.keys" />
-      {{else}}
-        <Hds::Breadcrumb::Item @text="Details" @route="vault.cluster.access.oidc.keys.key.details" @model={{@model.name}} />
-      {{/if}}
-      <Hds::Breadcrumb::Item @text="{{if @model.isNew 'Create' 'Edit'}} Key" @current={{true}} />
-    </Hds::Breadcrumb>
-  </p.top>
-  <p.levelLeft>
-    <h1 class="title is-3" data-test-oidc-key-title>
-      {{if @model.isNew "Create" "Edit"}}
-      Key
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-<form {{on "submit" (perform this.save)}}>
-  <div class="box is-sideless is-fullwidth is-bottomless">
-    <MessageError @errorMessage={{this.errorBanner}} />
-    {{#each @model.formFields as |attr|}}
-      <FormField @attr={{attr}} @model={{@model}} @modelValidations={{this.modelValidations}} />
-    {{/each}}
-  </div>
-  {{! RADIO CARD + SEARCH SELECT }}
-  <div class="box is-sideless is-fullwidth is-marginless has-top-padding-xxl">
-    <Hds::Text::Display @tag="h2" @size="400">Allowed applications</Hds::Text::Display>
-    <div class="is-flex-row">
-      <RadioCard
-        data-test-oidc-radio="allow-all"
-        @title="Allow every application to use"
-        @description="All applications can use this key for authentication requests."
-        @icon="globe"
-        @value="allow_all"
-        @groupValue={{this.radioCardGroupValue}}
-        @onChange={{this.handleClientSelection}}
-      />
-      <RadioCard
-        data-test-oidc-radio="limited"
-        @title="Limit access to selected application"
-        @description="Only selected applications can use this key for authentication requests."
-        @icon="globe-private"
-        @value="limited"
-        @groupValue={{this.radioCardGroupValue}}
-        @onChange={{this.handleClientSelection}}
-        @disabled={{@model.isNew}}
-        @disabledTooltipMessage="This option has been disabled for now. To limit access, you must first create an application that references this key."
-      />
-    </div>
-    {{#if (eq this.radioCardGroupValue "limited")}}
-      <SearchSelect
-        @id="allowedClientIds"
-        @label="Application name"
-        @subText="Select which applications are allowed to use this key. Only applications that currently reference this key will appear in the dropdown."
-        @models={{array "oidc/client"}}
-        @inputValue={{@model.allowedClientIds}}
-        @onChange={{this.handleClientSelection}}
-        @disallowNewItems={{true}}
-        @fallbackComponent="string-list"
-        @passObject={{true}}
-        @objectKeys={{array "clientId"}}
-        @queryObject={{this.filterDropdownOptions}}
-      />
-    {{/if}}
-  </div>
-  <div class="field box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button
-        @text={{if @model.isNew "Create" "Update"}}
-        @icon={{if this.save.isRunning "loading"}}
-        type="submit"
-        disabled={{this.save.isRunning}}
-        data-test-oidc-key-save
-      />
-      <Hds::Button
-        @text="Cancel"
-        @color="secondary"
-        class="has-left-margin-s"
-        disabled={{this.save.isRunning}}
-        {{on "click" this.cancel}}
-        data-test-oidc-key-cancel
-      />
-    </div>
-    {{#if this.invalidFormAlert}}
-      <div class="control">
-        <AlertInline @type="danger" class="has-top-padding-s" @message={{this.invalidFormAlert}} />
-      </div>
-    {{/if}}
-  </div>
-</form>
\ No newline at end of file
diff --git a/ui/app/templates/components/okta-number-challenge.hbs b/ui/app/templates/components/okta-number-challenge.hbs
deleted file mode 100644
index 8f08fbc571b..00000000000
--- a/ui/app/templates/components/okta-number-challenge.hbs
+++ /dev/null
@@ -1,43 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="auth-form" data-test-okta-number-challenge>
-  <div class="box is-marginless is-shadowless">
-    <div class="field has-top-margin-xs">
-      <p data-test-okta-number-challenge-description>
-        To finish signing in, you will need to complete an additional MFA step.</p>
-      {{#if @hasError}}
-        <div class="has-top-margin-s">
-          <MessageError @errorMessage="There was a problem" />
-          <Hds::Button
-            @text="Return to login"
-            @color="secondary"
-            {{on "click" @onReturnToLogin}}
-            data-test-return-from-okta-number-challenge
-          />
-        </div>
-      {{else if @correctAnswer}}
-        <div class="has-top-margin-s">
-          <p class="has-text-black has-text-weight-semibold" data-test-okta-number-challenge-verification-type>Okta
-            verification</p>
-          <p data-test-okta-number-challenge-verification-description>Select the following number to complete verification:</p>
-          <h1
-            class="title has-font-weight-normal has-top-margin-m has-bottom-margin-s"
-            data-test-okta-number-challenge-answer
-          >{{@correctAnswer}}</h1>
-        </div>
-      {{else}}
-        <div class="has-top-margin-l has-bottom-margin-m">
-          <div class="is-flex-row">
-            <FlightIcon @name="loading" />
-            <div class="has-left-margin-xs">
-              <p data-test-okta-number-challenge-loading>Please wait...</p>
-            </div>
-          </div>
-        </div>
-      {{/if}}
-    </div>
-  </div>
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/section-tabs.hbs b/ui/app/templates/components/section-tabs.hbs
deleted file mode 100644
index 6b408df60b4..00000000000
--- a/ui/app/templates/components/section-tabs.hbs
+++ /dev/null
@@ -1,22 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#let (tabs-for-auth-section this.model this.tabType this.paths) as |tabs|}}
-  {{#if tabs.length}}
-    <div class="tabs-container box is-sideless is-fullwidth is-paddingless is-marginless">
-      <nav class="tabs" aria-label="navigation to manage {{this.model.type}}">
-        <ul>
-          {{#each tabs as |tab|}}
-            <li>
-              <LinkTo @route={{get tab.routeParams 0}} @model={{get tab.routeParams 1}} data-test-auth-section-tab={{true}}>
-                {{tab.label}}
-              </LinkTo>
-            </li>
-          {{/each}}
-        </ul>
-      </nav>
-    </div>
-  {{/if}}
-{{/let}}
\ No newline at end of file
diff --git a/ui/app/templates/components/tool-actions-form.hbs b/ui/app/templates/components/tool-actions-form.hbs
deleted file mode 100644
index 53ae308392f..00000000000
--- a/ui/app/templates/components/tool-actions-form.hbs
+++ /dev/null
@@ -1,67 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form onsubmit={{action "doSubmit"}}>
-  {{#if (eq this.selectedAction "hash")}}
-    {{! template-lint-disable no-passed-in-event-handlers }}
-    <ToolHash
-      @onClear={{action "onClear"}}
-      @sum={{this.sum}}
-      @algorithm={{this.algorithm}}
-      @errors={{this.errors}}
-      @format={{this.format}}
-      @input={{this.input}}
-    />
-    {{! template-lint-enable no-passed-in-event-handlers }}
-  {{else if (eq this.selectedAction "random")}}
-    <ToolRandom
-      @onClear={{action "onClear"}}
-      @random_bytes={{this.random_bytes}}
-      @errors={{this.errors}}
-      @format={{this.format}}
-      @bytes={{this.bytes}}
-    />
-  {{else if (eq this.selectedAction "rewrap")}}
-    <ToolRewrap
-      @onClear={{action "onClear"}}
-      @rewrap_token={{this.rewrap_token}}
-      @selectedAction={{this.selectedAction}}
-      @errors={{this.errors}}
-      @token={{this.token}}
-      @bytes={{this.bytes}}
-    />
-  {{else if (eq this.selectedAction "unwrap")}}
-    <ToolUnwrap
-      @onClear={{action "onClear"}}
-      @unwrap_data={{this.unwrap_data}}
-      @details={{this.details}}
-      @errors={{this.errors}}
-      @token={{this.token}}
-    />
-  {{else if (eq this.selectedAction "lookup")}}
-    <ToolLookup
-      @creation_time={{this.creation_time}}
-      @creation_ttl={{this.creation_ttl}}
-      @creation_path={{this.creation_path}}
-      @expirationDate={{this.expirationDate}}
-      @selectedAction={{this.selectedAction}}
-      @token={{this.token}}
-      @onClear={{action "onClear"}}
-      @errors={{this.errors}}
-    />
-  {{else if (eq this.selectedAction "wrap")}}
-    <ToolWrap
-      @token={{this.token}}
-      @selectedAction={{this.selectedAction}}
-      @onClear={{action "onClear"}}
-      @codemirrorUpdated={{action "codemirrorUpdated"}}
-      @updateTtl={{action "updateTtl"}}
-      @buttonDisabled={{this.buttonDisabled}}
-      @errors={{this.errors}}
-    />
-  {{else}}
-    <EmptyState @title="Tool not available" />
-  {{/if}}
-</form>
\ No newline at end of file
diff --git a/ui/app/templates/components/tool-hash.hbs b/ui/app/templates/components/tool-hash.hbs
deleted file mode 100644
index b1b59ce3689..00000000000
--- a/ui/app/templates/components/tool-hash.hbs
+++ /dev/null
@@ -1,88 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.levelLeft>
-    <h1 class="title is-3">
-      Hash Data
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-{{#if @sum}}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <div class="field">
-      <label for="sum" class="is-input">Sum</label>
-      <div class="control">
-        <textarea readonly class="textarea" id="sum" data-test-tools-input="sum">{{@sum}}</textarea>
-      </div>
-    </div>
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Copy::Button
-        @text="Copy"
-        @textToCopy={{@sum}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-        class="primary"
-      />
-    </div>
-    <div class="control">
-      <Hds::Button @text="Back" @color="secondary" {{on "click" this.onClear}} data-test-tools-back={{true}} />
-    </div>
-  </div>
-{{else}}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <MessageError @errors={{@errors}} />
-    <div class="field">
-      <label for="input" class="is-label">
-        Input
-      </label>
-      <div class="control">
-        <Textarea id="input-hash" name="input" @value={{@input}} class="textarea" data-test-tools-input="hash-input" />
-        <B64Toggle @value={{@input}} @isInput={{false}} @data-test-transit-b64-toggle="input" />
-      </div>
-    </div>
-    <div class="field is-horizontal">
-      <div class="field-body">
-        <div class="field">
-          <label for="algorithm" class="is-label">Algorithm</label>
-          <div class="control is-expanded">
-            <div class="select is-fullwidth">
-              <select name="algorithm" id="algorithm" onchange={{action (mut @algorithm) value="target.value"}}>
-                {{#each (sha2-digest-sizes) as |algo|}}
-                  <option selected={{if @algorithm (eq @algorithm algo)}} value={{algo}}>
-                    {{algo}}
-                  </option>
-                {{/each}}
-              </select>
-            </div>
-          </div>
-        </div>
-        <div class="field">
-          <label for="format" class="is-label"> Output format </label>
-          <div class="control is-expanded">
-            <div class="select is-fullwidth">
-              <select name="format" id="format" onchange={{action (mut @format) value="target.value"}}>
-                {{#each (array "base64" "hex") as |formatOption|}}
-                  <option selected={{if @format (eq @format formatOption)}} value={{formatOption}}>
-                    {{formatOption}}
-                  </option>
-                {{/each}}
-              </select>
-            </div>
-          </div>
-        </div>
-      </div>
-    </div>
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Hash" type="submit" data-test-tools-submit="true" />
-    </div>
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/tool-lookup.hbs b/ui/app/templates/components/tool-lookup.hbs
deleted file mode 100644
index d01e071d8b8..00000000000
--- a/ui/app/templates/components/tool-lookup.hbs
+++ /dev/null
@@ -1,48 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.levelLeft>
-    <h1 class="title is-3">
-      Lookup Token
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-{{#if (or @creation_time @creation_ttl)}}
-  <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
-    <InfoTableRow @label="Creation path" @value={{@creation_path}} data-test-tools="token-lookup-row" />
-    <InfoTableRow @label="Creation time" @value={{@creation_time}} data-test-tools="token-lookup-row" />
-    <InfoTableRow @label="Creation TTL" @value={{@creation_ttl}} data-test-tools="token-lookup-row" />
-    {{#if @expirationDate}}
-      <InfoTableRow @label="Expiration date" @value={{@expirationDate}} data-test-tools="token-lookup-row" />
-      <InfoTableRow @label="Expires in" @value={{date-from-now @expirationDate}} data-test-tools="token-lookup-row" />
-    {{/if}}
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Back" @color="secondary" {{on "click" this.onClear}} />
-    </div>
-  </div>
-{{else}}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <NamespaceReminder @mode="perform" @noun={{@selectedAction}} />
-    <MessageError @errors={{@errors}} />
-    <div class="field">
-      <label for="token" class="is-label">Wrapped token</label>
-      <div class="has-text-grey is-size-8 has-bottom-margin-xs">
-        Enter your wrapped token here to display its information.
-      </div>
-      <div class="control">
-        <Input @value={{@token}} class="input" id="token" name="token" data-test-tools-input="wrapping-token" />
-      </div>
-    </div>
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Lookup token" type="submit" data-test-tools-submit="true" />
-    </div>
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/tool-random.hbs b/ui/app/templates/components/tool-random.hbs
deleted file mode 100644
index 83777b1ef08..00000000000
--- a/ui/app/templates/components/tool-random.hbs
+++ /dev/null
@@ -1,71 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.levelLeft>
-    <h1 class="title is-3">
-      Random Bytes
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-{{#if @random_bytes}}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <label for="rand" class="is-label">Random bytes</label>
-    <textarea readonly class="textarea" id="rand" data-test-tools-input="random-bytes">{{@random_bytes}}</textarea>
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Copy::Button
-        @text="Copy"
-        @textToCopy={{@random_bytes}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-        class="primary"
-      />
-    </div>
-    <div class="control">
-      <Hds::Button @text="Back" @color="secondary" {{on "click" this.onClear}} />
-    </div>
-  </div>
-{{else}}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <MessageError @errors={{@errors}} />
-    <div class="field is-horizontal">
-      <div class="field-body">
-        <div class="field">
-          <label for="bytes" class="is-label">
-            Number of bytes
-          </label>
-          <div class="control">
-            <Input id="bytes" class="input" @value={{@bytes}} data-test-tools-input="bytes" />
-          </div>
-        </div>
-        <div class="field">
-          <label for="format" class="is-label">
-            Output format
-          </label>
-          <div class="control is-expanded">
-            <div class="select is-fullwidth">
-              <select name="format" id="format" onchange={{action (mut @format) value="target.value"}}>
-                {{#each (array "base64" "hex") as |formatOption|}}
-                  <option selected={{if @format (eq @format formatOption)}} value={{formatOption}}>
-                    {{formatOption}}
-                  </option>
-                {{/each}}
-              </select>
-            </div>
-          </div>
-        </div>
-      </div>
-    </div>
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Generate" type="submit" data-test-tools-submit="true" />
-    </div>
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/tool-rewrap.hbs b/ui/app/templates/components/tool-rewrap.hbs
deleted file mode 100644
index 96d9cc23a88..00000000000
--- a/ui/app/templates/components/tool-rewrap.hbs
+++ /dev/null
@@ -1,64 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.levelLeft>
-    <h1 class="title is-3">
-      Rewrap Token
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-{{#if @rewrap_token}}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <div class="field">
-      <label for="wrap-info" class="is-label">Rewrapped token</label>
-      <div class="control">
-        <Textarea
-          @value={{@rewrap_token}}
-          readonly={{true}}
-          class="textarea"
-          id="wrap-info"
-          name="wrap-info"
-          data-test-tools-input="rewrapped-token"
-        />
-      </div>
-    </div>
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Copy::Button
-        @text="Copy"
-        @textToCopy={{@rewrap_token}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-        class="primary"
-      />
-    </div>
-    <div class="control">
-      <Hds::Button @text="Back" @color="secondary" {{on "click" this.onClear}} />
-    </div>
-  </div>
-{{else}}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <NamespaceReminder @mode="perform" @noun={{@selectedAction}} />
-    <MessageError @errors={{@errors}} />
-    <div class="field">
-      <label for="token" class="is-label">Wrapped token</label>
-      <div class="has-text-grey is-size-8 has-bottom-margin-xs">
-        Enter your wrapped token here to rewrap it and refresh its TTL.
-      </div>
-      <div class="control">
-        <Input @value={{@token}} class="input" id="token" name="token" data-test-tools-input="wrapping-token" />
-      </div>
-    </div>
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Rewrap token" type="submit" data-test-tools-submit="true" />
-    </div>
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/tool-unwrap.hbs b/ui/app/templates/components/tool-unwrap.hbs
deleted file mode 100644
index 0a96118930c..00000000000
--- a/ui/app/templates/components/tool-unwrap.hbs
+++ /dev/null
@@ -1,83 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.levelLeft>
-    <h1 class="title is-3">
-      Unwrap Data
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-{{#if @unwrap_data}}
-  <Hds::Tabs as |T|>
-    <T.Tab data-test-button-data>Data</T.Tab>
-    <T.Tab data-test-button-details>Wrap Details</T.Tab>
-    <T.Panel>
-      <JsonEditor
-        class="has-top-padding-m"
-        @title="Unwrapped Data"
-        @value={{stringify @unwrap_data}}
-        @readOnly={{true}}
-        @container=".toolbar-actions"
-      />
-    </T.Panel>
-    <T.Panel>
-      <div class="has-top-padding-m">
-        {{#each-in @details as |key detail|}}
-          <InfoTableRow @label={{key}} @value={{key}}>
-            {{#if (or (eq detail "No") (eq detail "None"))}}
-              <Icon @name="x-circle" class="has-text-grey" />
-              {{detail}}
-            {{else}}
-              {{#if (eq detail "Yes")}}
-                <Icon @name="check-circle" class="has-text-success" />
-              {{/if}}
-              {{detail}}
-            {{/if}}
-          </InfoTableRow>
-        {{/each-in}}
-      </div>
-    </T.Panel>
-  </Hds::Tabs>
-  <Hds::ButtonSet class="has-top-padding-m">
-    <Hds::Copy::Button
-      @text="Copy unwrapped data"
-      @textToCopy={{stringify @unwrap_data}}
-      @onError={{(fn
-        (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-      )}}
-      class="primary"
-    />
-    <Hds::Button {{on "click" this.onClear}} @color="secondary" @text="Back" />
-  </Hds::ButtonSet>
-{{else}}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <NamespaceReminder @mode="perform" @noun={{@selectedAction}} />
-    <MessageError @errors={{@errors}} />
-    <div class="field">
-      <label for="token" class="is-label">Wrapped token</label>
-      <div class="has-text-grey is-size-8 has-bottom-margin-xs">
-        Enter your wrapped token here to unwrap it and return its original value.
-      </div>
-      <div class="control">
-        <Input
-          @value={{@token}}
-          class="input"
-          id="token"
-          name="token"
-          autocomplete="off"
-          spellcheck="false"
-          data-test-tools-input="wrapping-token"
-        />
-      </div>
-    </div>
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Unwrap data" type="submit" data-test-tools-submit="true" />
-    </div>
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/tool-wrap.hbs b/ui/app/templates/components/tool-wrap.hbs
deleted file mode 100644
index 981d5d10177..00000000000
--- a/ui/app/templates/components/tool-wrap.hbs
+++ /dev/null
@@ -1,73 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.levelLeft>
-    <h1 class="title is-3">
-      Wrap Data
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-{{#if @token}}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <div class="field">
-      <label for="wrap-info" class="is-label">Wrapped token</label>
-      <div class="control">
-        <Textarea
-          @value={{@token}}
-          readonly={{true}}
-          class="textarea"
-          id="wrap-info"
-          name="wrap-info"
-          data-test-tools-input="wrapping-token"
-        />
-      </div>
-    </div>
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Copy::Button
-        @text="Copy"
-        @textToCopy={{@token}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-        class="primary"
-      />
-    </div>
-    <div class="control">
-      <Hds::Button @text="Back" @color="secondary" {{on "click" this.onClear}} />
-    </div>
-  </div>
-{{else}}
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <NamespaceReminder @mode="perform" @noun={{@selectedAction}} />
-    <MessageError @errors={{@errors}} />
-    <div class="field">
-      <div class="control">
-        <JsonEditor
-          @title="Data to wrap"
-          @subTitle="json-formatted"
-          @value={{this.data}}
-          @valueUpdated={{action this.codemirrorUpdated}}
-        />
-      </div>
-    </div>
-    <TtlPicker
-      @label="Wrap TTL"
-      @initialValue="30m"
-      @onChange={{action "updateTtl"}}
-      @helperTextDisabled="Vault will use the default (30m)"
-      @helperTextEnabled="Wrap will expire after"
-      @changeOnInit={{true}}
-    />
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Wrap data" type="submit" data-test-tools-submit="true" disabled={{@buttonDisabled}} />
-    </div>
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/transform-template-edit.hbs b/ui/app/templates/components/transform-template-edit.hbs
deleted file mode 100644
index 4c165eb85f1..00000000000
--- a/ui/app/templates/components/transform-template-edit.hbs
+++ /dev/null
@@ -1,147 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.top>
-    <KeyValueHeader
-      @baseKey={{hash display=this.model.id id=this.model.idForNav}}
-      @path="vault.cluster.secrets.backend.list"
-      @mode={{this.mode}}
-      @root={{this.root}}
-      @showCurrent={{true}}
-    />
-  </p.top>
-  <p.levelLeft>
-    <h1 class="title is-3" data-test-secret-header="true">
-      {{#if (eq this.mode "create")}}
-        Create Template
-      {{else if (eq this.mode "edit")}}
-        Edit Template
-      {{else}}
-        Template
-        <code>{{this.model.id}}</code>
-      {{/if}}
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-{{#if (eq this.mode "show")}}
-  <Toolbar>
-    <ToolbarActions>
-      {{#if this.capabilities.canDelete}}
-        <Hds::Button
-          @text="Delete template"
-          @color="secondary"
-          class="toolbar-button"
-          {{on "click" (action "delete")}}
-          data-test-transformation-template-delete
-        />
-        <div class="toolbar-separator"></div>
-      {{/if}}
-      {{#if this.capabilities.canUpdate}}
-        <ToolbarSecretLink
-          @secret={{concat this.model.idPrefix this.model.id}}
-          @mode="edit"
-          data-test-edit-link={{true}}
-          @replace={{true}}
-        >
-          Edit template
-        </ToolbarSecretLink>
-      {{/if}}
-    </ToolbarActions>
-  </Toolbar>
-{{/if}}
-
-{{#if (or (eq this.mode "edit") (eq this.mode "create"))}}
-  <form onsubmit={{action "createOrUpdate" this.mode}}>
-    <div class="box is-sideless is-fullwidth is-marginless">
-      <MessageError @model={{this.model}} />
-      <NamespaceReminder @mode={{this.mode}} @noun="transform template" />
-      {{#each this.model.writeAttrs as |attr|}}
-        {{#if (and (eq attr.name "name") (eq this.mode "edit"))}}
-          <label for={{attr.name}} class="is-label">
-            {{attr.options.label}}
-          </label>
-          {{#if attr.options.subText}}
-            <p class="sub-text">{{attr.options.subText}}</p>
-          {{/if}}
-          <input
-            data-test-input={{attr.name}}
-            id={{attr.name}}
-            autocomplete="off"
-            spellcheck="false"
-            value={{or (get this.model attr.name) attr.options.defaultValue}}
-            readonly={{true}}
-            class="field input is-readOnly"
-            type={{attr.type}}
-          />
-        {{else}}
-          {{#if (eq attr.name "alphabet")}}
-            <TransformAdvancedTemplating @model={{this.model}} />
-          {{/if}}
-          <FormField data-test-field @attr={{attr}} @model={{this.model}} />
-        {{/if}}
-      {{/each}}
-    </div>
-    <div class="field is-grouped-split box is-fullwidth is-bottomless">
-      <Hds::ButtonSet>
-        <Hds::Button
-          @text={{if (eq this.mode "create") "Create template" "Save"}}
-          type="submit"
-          data-test-template-transform-create
-        />
-        {{#if (eq this.mode "create")}}
-          <Hds::Button
-            @text="Cancel"
-            @color="secondary"
-            @route="vault.cluster.secrets.backend.list-root"
-            @model={{this.model.backend}}
-            @query={{hash tab="template"}}
-          />
-        {{else}}
-          <Hds::Button
-            @text="Cancel"
-            @color="secondary"
-            @route="vault.cluster.secrets.backend.show"
-            @models={{array this.model.backend (concat "template/" this.model.id)}}
-            @query={{hash tab="template"}}
-          />
-        {{/if}}
-      </Hds::ButtonSet>
-    </div>
-  </form>
-{{else}}
-  {{#if this.model.displayErrors}}
-    <div class="has-top-margin-s">
-      <MessageError @model={{this.model}} />
-    </div>
-  {{/if}}
-  <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
-    {{#each this.model.readAttrs as |attr|}}
-      {{#let (capitalize (or attr.options.label (humanize (dasherize attr.name)))) as |label|}}
-        {{#if (eq attr.name "decodeFormats")}}
-          {{#if (not (is-empty-value this.model.decodeFormats))}}
-            <InfoTableRow @label={{label}}>
-              <div>
-                {{#each-in this.model.decodeFormats as |key value|}}
-                  <div class="transform-decode-formats">
-                    <p class="is-label has-text-grey-light">{{key}}</p>
-                    <p>{{value}}</p>
-                  </div>
-                {{/each-in}}
-              </div>
-            </InfoTableRow>
-          {{/if}}
-        {{else}}
-          <InfoTableRow
-            @label={{label}}
-            @value={{get this.model attr.name}}
-            class={{if (eq attr.name "pattern") "transform-pattern-text"}}
-          />
-        {{/if}}
-      {{/let}}
-    {{/each}}
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/transit-key-action/datakey.hbs b/ui/app/templates/components/transit-key-action/datakey.hbs
deleted file mode 100644
index e957d56a75b..00000000000
--- a/ui/app/templates/components/transit-key-action/datakey.hbs
+++ /dev/null
@@ -1,112 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form {{on "submit" (fn @doSubmit (hash param=@param context=@context nonce=@nonce bits=@bits))}} ...attributes>
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <NamespaceReminder @mode="perform" @noun="datakey creation" />
-    <div class="content has-bottom-margin-l">
-      <p>Generate a new high-entropy key and value using <code>{{@key.name}}</code> as the encryption key.</p>
-    </div>
-    <div class="field">
-      <label for="param" class="is-label">Output format</label>
-      <div class="control is-expanded">
-        <div class="select is-fullwidth">
-          <select name="param" id="param" onchange={{action (mut @param) value="target.value"}}>
-            {{#each (array "plaintext" "wrapped") as |paramOption|}}
-              <option selected={{eq @param paramOption}} value={{paramOption}}>
-                {{paramOption}}
-              </option>
-            {{/each}}
-          </select>
-        </div>
-      </div>
-    </div>
-    {{#if @key.derived}}
-      <div class="field">
-        <label for="context" class="is-label">
-          Context
-        </label>
-        <div class="field has-addons">
-          <div class="control">
-            <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
-          </div>
-          <div class="control">
-            <B64Toggle @value={{@context}} @data-test-transit-b64-toggle="context" />
-          </div>
-        </div>
-      </div>
-    {{/if}}
-    {{#if (eq @key.convergentEncryptionVersion 1)}}
-      <div class="field">
-        <label for="nonce" class="is-label">Nonce</label>
-        <div class="field has-addons">
-          <div class="control">
-            <Input @type="text" id="nonce" @value={{@nonce}} class="input" data-test-transit-input="nonce" />
-          </div>
-          <div class="control">
-            <B64Toggle @value={{@nonce}} @data-test-transit-b64-toggle="nonce" />
-          </div>
-        </div>
-      </div>
-    {{/if}}
-    <div class="field">
-      <label for="bits" class="is-label">Bits</label>
-      <div class="control is-expanded">
-        <div class="select is-fullwidth">
-          <select name="bits" id="bits" onchange={{action (mut @bits) value="target.value"}}>
-            {{#each (array 128 256 512) as |bitOption|}}
-              <option selected={{eq @bits bitOption}} value={{bitOption}}>
-                <code>{{bitOption}}</code>
-              </option>
-            {{/each}}
-          </select>
-        </div>
-      </div>
-    </div>
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Create datakey" type="submit" />
-    </div>
-  </div>
-</form>
-{{#if @isModalActive}}
-  <Hds::Modal id="transit-datakey-modal" @onClose={{fn (mut @isModalActive) false}} as |M|>
-    <M.Header>
-      Copy your generated key
-    </M.Header>
-    <M.Body>
-      {{#if @plaintext}}
-        <h2 class="has-text-weight-semibold is-6">Plaintext</h2>
-        <p class="sub-text">Plaintext is base64 encoded</p>
-        <Hds::Copy::Snippet
-          class="has-bottom-margin-m"
-          @textToCopy={{@plaintext}}
-          @color="secondary"
-          @container="#transit-datakey-modal"
-          @isFullWidth={{true}}
-          @isTruncated={{true}}
-          @onError={{(fn
-            (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-          )}}
-        />
-      {{/if}}
-      <h2 class="has-text-weight-semibold is-6">Ciphertext</h2>
-      <Hds::Copy::Snippet
-        @textToCopy={{@ciphertext}}
-        @color="secondary"
-        @container="#transit-datakey-modal"
-        @isFullWidth={{true}}
-        @isTruncated={{true}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-      />
-    </M.Body>
-    <M.Footer as |F|>
-      <Hds::Button @text="Close" {{on "click" F.close}} />
-    </M.Footer>
-  </Hds::Modal>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/transit-key-action/decrypt.hbs b/ui/app/templates/components/transit-key-action/decrypt.hbs
deleted file mode 100644
index 80fd65e3f91..00000000000
--- a/ui/app/templates/components/transit-key-action/decrypt.hbs
+++ /dev/null
@@ -1,80 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form {{on "submit" (fn @doSubmit (hash ciphertext=@ciphertext context=@context nonce=@nonce))}} ...attributes>
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <div class="content has-bottom-margin-l">
-      <p>You can decrypt ciphertext using <code>{{@key.name}}</code> as the encryption key.</p>
-    </div>
-    <div class="field">
-      <div id="ciphertext-control" class="control">
-        <JsonEditor
-          @title="Ciphertext"
-          @valueUpdated={{fn (mut @ciphertext)}}
-          @mode="ruby"
-          @data-test-transit-input="ciphertext"
-        />
-      </div>
-    </div>
-    {{#if @key.derived}}
-      <div class="field">
-        <label for="context" class="is-label">
-          Context
-        </label>
-        <div class="field has-addons">
-          <div class="control">
-            <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
-          </div>
-          <div class="control">
-            <B64Toggle @value={{@context}} @data-test-transit-b64-toggle="context" />
-          </div>
-        </div>
-      </div>
-    {{/if}}
-    {{#if (eq @key.convergentEncryptionVersion 1)}}
-      <div class="field">
-        <label for="nonce" class="is-label">Nonce</label>
-        <div class="field has-addons">
-          <div class="control">
-            <Input @type="text" id="nonce" @value={{@nonce}} class="input" data-test-transit-input="nonce" />
-          </div>
-          <div class="control">
-            <B64Toggle @value={{@nonce}} @data-test-transit-b64-toggle="nonce" />
-          </div>
-        </div>
-      </div>
-    {{/if}}
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Decrypt" type="submit" id="decrypt" data-test-button-decrypt />
-    </div>
-  </div>
-</form>
-{{#if @isModalActive}}
-  <Hds::Modal id="transit-decrypt-modal" @onClose={{fn (mut @isModalActive) false}} data-test-decrypt-modal as |M|>
-    <M.Header>
-      Copy your unwrapped data
-    </M.Header>
-    <M.Body>
-      <h2 class="has-text-weight-semibold is-6">Plaintext</h2>
-      <p class="sub-text">Plaintext is base64 encoded.</p>
-      <Hds::Copy::Snippet
-        @textToCopy={{@plaintext}}
-        @color="secondary"
-        @container="#transit-decrypt-modal"
-        @isFullWidth={{true}}
-        @isTruncated={{true}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-        data-test-encrypted-value="plaintext"
-      />
-    </M.Body>
-    <M.Footer as |F|>
-      <Hds::Button @text="Close" {{on "click" F.close}} />
-    </M.Footer>
-  </Hds::Modal>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/transit-key-action/encrypt.hbs b/ui/app/templates/components/transit-key-action/encrypt.hbs
deleted file mode 100644
index 6c9bb57528f..00000000000
--- a/ui/app/templates/components/transit-key-action/encrypt.hbs
+++ /dev/null
@@ -1,97 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form
-  {{on "submit" (fn @doSubmit (hash plaintext=@plaintext context=@context nonce=@nonce key_version=@key_version))}}
-  ...attributes
->
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <NamespaceReminder @mode="perform" @noun="encryption" />
-    <div class="content has-bottom-margin-l">
-      <p>You can encrypt plaintext data using <code>{{@key.name}}</code> as the encryption key.</p>
-    </div>
-    <KeyVersionSelect @key={{@key}} @onVersionChange={{fn (mut @key_version)}} @key_version={{@key_version}} />
-    <div class="field">
-      <div id="plaintext-control" class="control is-relative">
-        <JsonEditor
-          @title="Plaintext"
-          @value={{@plaintext}}
-          @valueUpdated={{fn (mut @plaintext)}}
-          @mode="ruby"
-          @data-test-transit-input="plaintext"
-        />
-      </div>
-    </div>
-    <div class="field">
-      <Input
-        @type="checkbox"
-        id="encodedBase64"
-        @checked={{@encodedBase64}}
-        {{on "change" @toggleEncodeBase64}}
-        data-test-transit-input="encodedBase64"
-      />
-      <label for="encodedBase64">This data is already encoded in base64</label>
-    </div>
-    {{#if @key.derived}}
-      <div class="field">
-        <label for="context" class="is-label">
-          Context
-        </label>
-        <div class="field has-addons">
-          <div class="control">
-            <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
-          </div>
-          <div class="control">
-            <B64Toggle @value={{@context}} @data-test-transit-b64-toggle="context" />
-          </div>
-        </div>
-      </div>
-    {{/if}}
-    {{#if (eq @key.convergentEncryptionVersion 1)}}
-      <div class="field">
-        <div class="level">
-          <div class="level-left">
-            <label for="nonce" class="is-label">Nonce</label>
-          </div>
-          <div class="level-right">
-            <B64Toggle @value={{@nonce}} @data-test-transit-b64-toggle="nonce" />
-          </div>
-        </div>
-        <div class="control">
-          <Input @type="text" id="nonce" @value={{@nonce}} class="input" data-test-transit-input="nonce" />
-        </div>
-      </div>
-    {{/if}}
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Encrypt" type="submit" data-test-button-encrypt />
-    </div>
-  </div>
-</form>
-{{#if @isModalActive}}
-  <Hds::Modal id="transit-encrypt-modal" @onClose={{fn (mut @isModalActive) false}} data-test-encrypt-modal as |M|>
-    <M.Header>
-      Copy your token
-    </M.Header>
-    <M.Body>
-      <h2 class="title is-6">Ciphertext</h2>
-      <Hds::Copy::Snippet
-        @textToCopy={{@ciphertext}}
-        @color="secondary"
-        @container="#transit-encrypt-modal"
-        @isFullWidth={{true}}
-        @isTruncated={{true}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-        data-test-encrypted-value="ciphertext"
-      />
-    </M.Body>
-    <M.Footer as |F|>
-      <Hds::Button @text="Close" {{on "click" F.close}} />
-    </M.Footer>
-  </Hds::Modal>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/transit-key-action/rewrap.hbs b/ui/app/templates/components/transit-key-action/rewrap.hbs
deleted file mode 100644
index 4ccd942b8d8..00000000000
--- a/ui/app/templates/components/transit-key-action/rewrap.hbs
+++ /dev/null
@@ -1,89 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form
-  {{on "submit" (fn @doSubmit (hash ciphertext=@ciphertext context=@context nonce=@nonce key_version=@key_version))}}
-  ...attributes
->
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <NamespaceReminder @mode="perform" @noun="rewrap" />
-    <div class="content has-bottom-margin-l">
-      <p>
-        You can rewrap the provided ciphertext using the latest version of
-        <code>{{@key.name}}</code>
-        as the encryption key.
-      </p>
-    </div>
-    <KeyVersionSelect @key={{@key}} @onVersionChange={{fn (mut @key_version)}} @key_version={{@key_version}} />
-    <div class="field">
-      <div class="control is-expanded">
-        <JsonEditor @title="Ciphertext" @valueUpdated={{fn (mut @ciphertext)}} @mode="ruby" />
-      </div>
-    </div>
-    {{#if @key.derived}}
-      <div class="field">
-        <label for="context" class="is-label">
-          Context
-        </label>
-        <div class="field has-addons">
-          <div class="control">
-            <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
-          </div>
-          <div class="control">
-            <B64Toggle @value={{@context}} @data-test-transit-b64-toggle="context" />
-          </div>
-        </div>
-      </div>
-    {{/if}}
-    {{#if (eq @key.convergentEncryptionVersion 1)}}
-      <div class="field">
-        <label for="nonce" class="is-label">Nonce</label>
-        <div class="field has-addons">
-          <div class="control">
-            <Input @type="text" id="nonce" @value={{@nonce}} class="input" data-test-transit-input="nonce" />
-          </div>
-          <div class="control">
-            <B64Toggle @value={{@nonce}} @data-test-transit-b64-toggle="nonce" />
-          </div>
-        </div>
-      </div>
-    {{/if}}
-  </div>
-  <div class="field box is-fullwidth is-bottomless">
-    <div class="content has-bottom-margin-l">
-      <p class="help">
-        Submitting this form will update the
-        <code>ciphertext</code>
-        in-place.
-      </p>
-    </div>
-    <div class="control">
-      <Hds::Button @text="Rewrap" type="submit" />
-    </div>
-  </div>
-</form>
-{{#if @isModalActive}}
-  <Hds::Modal id="transit-rewrap-modal" @onClose={{fn (mut @isModalActive) false}} as |M|>
-    <M.Header>
-      Copy your token
-    </M.Header>
-    <M.Body>
-      <h2 class="title is-6">Ciphertext</h2>
-      <Hds::Copy::Snippet
-        @textToCopy={{@ciphertext}}
-        @color="secondary"
-        @container="#transit-rewrap-modal"
-        @isFullWidth={{true}}
-        @isTruncated={{true}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-      />
-    </M.Body>
-    <M.Footer as |F|>
-      <Hds::Button @text="Close" {{on "click" F.close}} />
-    </M.Footer>
-  </Hds::Modal>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/transit-key-action/verify.hbs b/ui/app/templates/components/transit-key-action/verify.hbs
deleted file mode 100644
index ff0bc1cfff3..00000000000
--- a/ui/app/templates/components/transit-key-action/verify.hbs
+++ /dev/null
@@ -1,219 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form
-  {{on
-    "submit"
-    (fn
-      @doSubmit
-      (hash
-        input=@trackedInput
-        signature=@signature
-        signature_algorithm=@signature_algorithm
-        hmac=@hmac
-        hash_algorithm=@hash_algorithm
-        context=@context
-        prehashed=@prehashed
-        encodedBase64=@encodedBase64
-      )
-    )
-  }}
-  ...attributes
->
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <div class="content has-bottom-margin-l">
-      <p>Check whether the provided signature is valid for the given data.</p>
-    </div>
-    <div class="field">
-      <div class="control is-relative">
-        <JsonEditor
-          @title="Input"
-          @value={{@trackedInput}}
-          @valueUpdated={{fn (mut @trackedInput)}}
-          @mode="ruby"
-          @data-test-transit-input="input"
-        />
-      </div>
-    </div>
-    <div class="field">
-      <Input
-        @type="checkbox"
-        id="encodedBase64"
-        @checked={{@encodedBase64}}
-        {{on "change" @toggleEncodeBase64}}
-        data-test-transit-input="encodedBase64"
-      />
-      <label for="encodedBase64">This data is already encoded in base64</label>
-    </div>
-    {{#if (and @key.supportsSigning @key.derived (not @hmac))}}
-      <div class="field">
-        <label for="context" class="is-label">
-          Context
-        </label>
-        <div class="field has-addons">
-          <div class="control">
-            <Input @type="text" id="context" @value={{@context}} class="input" data-test-transit-input="context" />
-          </div>
-          <div class="control">
-            <B64Toggle @value={{@context}} @data-test-transit-b64-toggle="context" />
-          </div>
-        </div>
-      </div>
-    {{/if}}
-    {{#if @key.supportsSigning}}
-      <div class="columns is-5">
-        <div class="column is-one-third">
-          <div class="field">
-            <label for="verification" class="is-label">Verification Type</label>
-            <div class="control is-expanded">
-              <div class="select is-fullwidth">
-                <select
-                  name="verification"
-                  id="verification"
-                  onchange={{queue
-                    (action (mut @verification) value="target.value")
-                    (fn @clearSpecificProps (array "hmac" "signature"))
-                  }}
-                >
-                  {{#each (array "Signature" "HMAC") as |type|}}
-                    <option
-                      selected={{if @verification (eq @verification type) (if @hmac (eq type "HMAC") (eq type "Signature"))}}
-                      value={{type}}
-                    >
-                      {{type}}
-                    </option>
-                  {{/each}}
-                </select>
-              </div>
-            </div>
-          </div>
-          <div class="field">
-            <div class="level is-mobile">
-              <div class="level-left">
-                <label for="hash_algorithm" class="is-label">Hash Algorithm</label>
-              </div>
-              <div class="level-right">
-                {{#if (not-eq @verification "HMAC")}}
-                  <div class="control is-flex">
-                    <Input
-                      id="prehashed"
-                      @type="checkbox"
-                      name="prehashed"
-                      class="toggle is-success is-small"
-                      @checked={{@prehashed}}
-                    />
-                    <label for="prehashed" class="has-text-weight-bold is-size-8">Prehashed</label>
-                  </div>
-                {{/if}}
-              </div>
-            </div>
-            <div class="control is-expanded">
-              <div class="select is-fullwidth">
-                <select
-                  name="hash_algorithm"
-                  id="hash_algorithm"
-                  onchange={{action (mut @hash_algorithm) value="target.value"}}
-                >
-                  {{#each (sha2-digest-sizes) as |algo|}}
-                    <option selected={{if @hash_algorithm (eq @hash_algorithm algo) (eq algo "sha2-256")}} value={{algo}}>
-                      <code>{{algo}}</code>
-                    </option>
-                  {{/each}}
-                </select>
-              </div>
-            </div>
-          </div>
-          {{#if (and @keyIsRSA (or (and @verification (eq @verification "Signature")) @signature))}}
-            <div class="field">
-              <label for="signature_algorithm" class="is-label">Signature Algorithm</label>
-              <div class="control is-expanded">
-                <div class="select is-fullwidth">
-                  <select
-                    name="signature_algorithm"
-                    id="signature_algorithm"
-                    data-test-signature-algorithm="true"
-                    onchange={{action (mut @signature_algorithm) value="target.value"}}
-                  >
-                    {{#each (array "pss" "pkcs1v15") as |sigAlgo|}}
-                      <option
-                        selected={{if @signature_algorithm (eq @signature_algorithm sigAlgo) (eq sigAlgo "pss")}}
-                        value={{sigAlgo}}
-                      >
-                        {{sigAlgo}}
-                      </option>
-                    {{/each}}
-                  </select>
-                </div>
-              </div>
-            </div>
-          {{/if}}
-
-        </div>
-        <div class="column is-two-thirds is-flex-column">
-          {{#if (or (and @verification (eq @verification "HMAC")) @hmac)}}
-            <div class="field is-flex-column is-flex-grow-1">
-              <div class="control is-flex-column is-flex-grow-1">
-                <JsonEditor @title="HMAC" @value={{@hmac}} @valueUpdated={{fn (mut @hmac)}} @mode="ruby" />
-              </div>
-            </div>
-          {{else}}
-            <div class="field is-flex-column is-flex-grow-1">
-              <div class="control is-flex-column is-flex-grow-1">
-                <JsonEditor @title="Signature" @value={{@signature}} @valueUpdated={{fn (mut @signature)}} @mode="ruby" />
-              </div>
-            </div>
-          {{/if}}
-        </div>
-      </div>
-    {{else}}
-      <div class="field">
-        <div class="control">
-          <JsonEditor @title="HMAC" @value={{@hmac}} @valueUpdated={{fn (mut @hmac)}} @mode="ruby" />
-        </div>
-      </div>
-      <div class="field">
-        <label for="hash_algorithm" class="is-label">Algorithm</label>
-        <div class="control is-expanded">
-          <div class="select is-fullwidth">
-            <select name="hash_algorithm" id="hash_algorithm" onchange={{action (mut @hash_algorithm) value="target.value"}}>
-              {{#each (array "sha2-224" "sha2-256" "sha2-384" "sha2-512") as |algo|}}
-                <option selected={{if @hash_algorithm (eq @hash_algorithm algo) (eq algo "sha2-256")}} value={{algo}}>
-                  <code>{{algo}}</code>
-                </option>
-              {{/each}}
-            </select>
-          </div>
-        </div>
-      </div>
-    {{/if}}
-  </div>
-  <div class="field is-grouped box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button @text="Verify" @icon={{if @submitIsRunning "loading"}} type="submit" disabled={{@submitIsRunning}} />
-    </div>
-  </div>
-</form>
-{{#if @isModalActive}}
-  <Hds::Modal id="transit-verify-modal" @size="small" @onClose={{fn (mut @isModalActive) false}} as |M|>
-    <M.Header>
-      Results
-      <Hds::Badge
-        @text={{if @valid "Valid" "Not Valid"}}
-        @size="large"
-        @color={{if @valid "success" "critical"}}
-        @icon={{if @valid "check-circle" "x-circle"}}
-      />
-    </M.Header>
-    <M.Body>
-      The input is
-      {{if @valid "valid" "not valid"}}
-      for the given
-      {{if @signature "signature." "HMAC."}}
-    </M.Body>
-    <M.Footer as |F|>
-      <Hds::Button @text="Close" {{on "click" F.close}} />
-    </M.Footer>
-  </Hds::Modal>
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/ui-wizard.hbs b/ui/app/templates/components/ui-wizard.hbs
deleted file mode 100644
index 6a5e155bd44..00000000000
--- a/ui/app/templates/components/ui-wizard.hbs
+++ /dev/null
@@ -1,25 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="app-content {{if (and this.shouldRender this.featureComponent) 'wizard-open'}}">
-  {{yield}}
-</div>
-{{#if this.featureComponent}}
-  {{#component
-    (if this.shouldRender this.tutorialComponent) onAdvance=(action "advanceWizard") onDismiss=(action "dismissWizard")
-  }}
-    {{component
-      this.featureComponent
-      componentState=this.componentState
-      nextFeature=this.nextFeature
-      nextStep=this.nextStep
-      onDone=(action "finishFeature")
-      onRepeat=(action "repeatStep")
-      onReset=(action "resetFeature")
-      onAdvance=(action "advanceFeature")
-      currentRouteName=this.currentRouteName
-    }}
-  {{/component}}
-{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard-content.hbs b/ui/app/templates/components/wizard-content.hbs
deleted file mode 100644
index 61a50dd5c4b..00000000000
--- a/ui/app/templates/components/wizard-content.hbs
+++ /dev/null
@@ -1,39 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="wizard-header">
-  {{#unless this.hidePopup}}
-    <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
-      <dd.ToggleIcon @icon="more-horizontal" @text="Wizard dismiss menu" @hasChevron={{false}} class="wizard-dismiss-menu" />
-      <dd.Interactive @text="Dismiss" {{on "click" (action "dismissWizard")}} />
-    </Hds::Dropdown>
-  {{/unless}}
-  <h1 class="title is-5">
-    <Icon @name={{this.glyph}} />
-    {{this.headerText}}
-  </h1>
-  {{#if this.showProgress}}
-    <ToolTip @verticalPosition="below" as |T|>
-      <T.Trigger @tabindex="-1">
-        <WizardProgress @currentFeatureProgress={{this.currentFeatureProgress}} @progressBar={{this.progressBar}} />
-      </T.Trigger>
-      <T.Content @defaultClass="tool-tip">
-        <div class="box">
-          {{#if this.currentTutorialProgress}}
-            {{this.currentTutorialProgress.text}}
-          {{else}}
-            <p>{{capitalize this.currentFeatureProgress.feature}}</p>
-            {{this.currentFeatureProgress.text}}
-          {{/if}}
-        </div>
-      </T.Content>
-    </ToolTip>
-  {{else}}
-    {{#if this.selectProgress}}
-      <WizardProgress @noProgress={{true}} @progressBar={{this.selectProgress}} />
-    {{/if}}
-  {{/if}}
-</div>
-{{yield}}
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard-progress.hbs b/ui/app/templates/components/wizard-progress.hbs
deleted file mode 100644
index d3730e236e1..00000000000
--- a/ui/app/templates/components/wizard-progress.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="progress-container">
-  {{#each @progressBar as |bar|}}
-    <div class="feature-progress-container">
-      <span class="progress-bar">
-        <span class="feature-progress" style={{sanitized-html bar.style}}></span>
-      </span>
-      {{#if bar.showIcon}}
-        <Icon @name="check-circle-fill" class="feature-check {{if bar.completed 'completed-check' 'incomplete-check'}}" />
-      {{/if}}
-    </div>
-  {{/each}}
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard-section.hbs b/ui/app/templates/components/wizard-section.hbs
deleted file mode 100644
index 50f4dfdf060..00000000000
--- a/ui/app/templates/components/wizard-section.hbs
+++ /dev/null
@@ -1,26 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="wizard-section {{@class}}">
-  <h2 class="title is-6">
-    {{#if @headerIcon}}
-      <Icon @name={{@headerIcon}} aria-hidden="true" />
-    {{/if}}
-    {{@headerText}}
-  </h2>
-  {{yield}}
-  {{#if @instructions}}
-    <div class="wizard-instructions">
-      <h2 class="title is-6">What to do</h2>
-      <p>{{@instructions}}</p>
-    </div>
-  {{/if}}
-  {{#if @docText}}
-    <DocLink @path={{@docPath}}>
-      <Icon @name="learn-link" />
-      {{@docText}}
-    </DocLink>
-  {{/if}}
-</div>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/alicloud-engine.hbs b/ui/app/templates/components/wizard/alicloud-engine.hbs
deleted file mode 100644
index 89b7d9c3fb4..00000000000
--- a/ui/app/templates/components/wizard/alicloud-engine.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="AliCloud"
-  @headerIcon="alibaba"
-  @docText="Docs: Google Cloud Secrets"
-  @docPath="/docs/secrets/alicloud/index.html"
->
-  <p>
-    The AliCloud Secrets Engine dynamically generates AliCloud access tokens based on RAM policies, or AliCloud STS
-    credentials based on RAM roles. This generally makes working with AliCloud easier, since it does not involve clicking in
-    the web UI. The AliCloud access tokens are time-based and are automatically revoked when the Vault lease expires. STS
-    credentials are short-lived, non-renewable, and expire on their own.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/alicloud-method.hbs b/ui/app/templates/components/wizard/alicloud-method.hbs
deleted file mode 100644
index f8890ec6f03..00000000000
--- a/ui/app/templates/components/wizard/alicloud-method.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="AliCloud"
-  @headerIcon="alibaba"
-  @docText="Docs: AliCloud Authentication"
-  @docPath="/docs/auth/alicloud.html"
->
-  <p>
-    The AliCloud Auth Method provides an automated mechanism to retrieve a Vault token for AliCloud entities.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/approle-method.hbs b/ui/app/templates/components/wizard/approle-method.hbs
deleted file mode 100644
index 3d5cbdd3164..00000000000
--- a/ui/app/templates/components/wizard/approle-method.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="AppRole"
-  @headerIcon="cpu"
-  @docText="Docs: AppRole Authentication"
-  @docPath="/docs/auth/approle.html"
->
-  <p>
-    The Approle Auth Method allows machines or apps to authenticate with Vault-defined roles. The open design of AppRole
-    enables a varied set of workflows and configurations to handle large numbers of apps. This Auth Method is oriented to
-    automated workflows (machines and services), and is less useful for human operators.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/auth-config.hbs b/ui/app/templates/components/wizard/auth-config.hbs
deleted file mode 100644
index 02035cf47b5..00000000000
--- a/ui/app/templates/components/wizard/auth-config.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Configuring your Auth Method"
-  @docText="Docs: Authentication Methods"
-  @docPath="/docs/auth/index.html"
-  @instructions="Click the 'Save' link to save any extra configuration. Saving without filling anything in will use the defaults."
->
-  <p>
-    You can update your new Auth Method configuration here.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/auth-details.hbs b/ui/app/templates/components/wizard/auth-details.hbs
deleted file mode 100644
index f0d4757a7a3..00000000000
--- a/ui/app/templates/components/wizard/auth-details.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="Auth Method Details" @docText="Docs: Authentication Methods" @docPath="/docs/auth/index.html">
-  <p>
-    Fantastic! Now you're ready to use your new
-    {{@mountName}}
-    Auth Method!
-  </p>
-</WizardSection>
-<WizardSection @headerText="Want to start again or move on?" @class="wizard-details">
-  <Hds::ButtonSet>
-    <Hds::Button @text="Enable another Auth Method" @icon="sync" @color="secondary" {{on "click" (action @onReset)}} />
-    <Hds::Button @text={{@nextFeature}} @icon="chevron-right" @iconPosition="trailing" {{on "click" (action @onAdvance)}} />
-  </Hds::ButtonSet>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/auth-edit.hbs b/ui/app/templates/components/wizard/auth-edit.hbs
deleted file mode 100644
index 305c0f853c2..00000000000
--- a/ui/app/templates/components/wizard/auth-edit.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardSection
-  @headerText="Editing your Auth Method"
-  @docText="Docs: Authentication Methods"
-  @docPath="/docs/auth/index.html"
-  @instructions='Click the "View method" link to see its details.'
->
-  <p>
-    You can update your new Auth Method configuration here.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/auth-enable.hbs b/ui/app/templates/components/wizard/auth-enable.hbs
deleted file mode 100644
index d5f0e823827..00000000000
--- a/ui/app/templates/components/wizard/auth-enable.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Entering Auth Method details"
-  @docText="Docs: Authentication Methods"
-  @docPath="/docs/auth/index.html"
-  @instructions="Name your method and click 'Enable Method'."
->
-  <p>
-    Great! Now you can customize this method with a name and fill out general configuration under "Method Options".
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/auth-idle.hbs b/ui/app/templates/components/wizard/auth-idle.hbs
deleted file mode 100644
index ce4c6169671..00000000000
--- a/ui/app/templates/components/wizard/auth-idle.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardSection
-  @headerText="Enabling an Auth Method"
-  @docText="Docs: Authentication Methods"
-  @docPath="/docs/auth/index.html"
-  @instructions='Choose an Authentication Method and click "Next" to get started.'
->
-  <p>
-    Controlling who can see your secrets is important. Let's set up a an Authentication Method for you and your team to use.
-    Don't worry, you can add more methods later.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/auth-list.hbs b/ui/app/templates/components/wizard/auth-list.hbs
deleted file mode 100644
index 47e776eb6e9..00000000000
--- a/ui/app/templates/components/wizard/auth-list.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardSection
-  @headerText="Auth Method list"
-  @docText="Docs: Authentication Methods"
-  @docPath="/docs/auth/index.html"
-  @instructions='Click the ellipsis menu for your method and then click "View configuration" to see its details.'
->
-  <p>
-    Awesome! Now you can see your new Auth Method in the list.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/aws-engine.hbs b/ui/app/templates/components/wizard/aws-engine.hbs
deleted file mode 100644
index 239aba6a598..00000000000
--- a/ui/app/templates/components/wizard/aws-engine.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="AWS"
-  @headerIcon="aws-color"
-  @docText="Docs: AWS Secrets"
-  @docPath="/docs/secrets/aws/index.html"
->
-  <p>
-    The AWS Secrets Engine generates AWS access credentials dynamically based on IAM policies. This generally makes working
-    with AWS IAM easier, since it does not involve clicking in the web UI. Additionally, the process is codified and mapped
-    to internal Auth Methods (such as LDAP). The AWS IAM credentials are time-based and are automatically revoked when the
-    Vault lease expires.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/aws-method.hbs b/ui/app/templates/components/wizard/aws-method.hbs
deleted file mode 100644
index 39a03ad6fe7..00000000000
--- a/ui/app/templates/components/wizard/aws-method.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="AWS" @headerIcon="aws-color" @docText="Docs: AWS Authentication" @docPath="/docs/auth/aws.html">
-  <p>
-    The AWS Auth Method provides an automated mechanism to retrieve a Vault token for AWS EC2 instances and IAM principals.
-    Unlike most Vault Auth Methods, this method does not require manual first-deploying, or provisioning security-sensitive
-    credentials (tokens, username/password, client certificates, etc), by operators under many circumstances.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/azure-engine.hbs b/ui/app/templates/components/wizard/azure-engine.hbs
deleted file mode 100644
index 52d6b65b3c5..00000000000
--- a/ui/app/templates/components/wizard/azure-engine.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Azure"
-  @headerIcon="azure-color"
-  @docText="Docs: Azure Secrets"
-  @docPath="/docs/secrets/azure/index.html"
->
-  <p>
-    The Azure Secrets Engine dynamically generates Azure service principals and role assignments. Vault roles can be mapped
-    to one or more Azure roles, providing a simple, flexible way to manage the permissions granted to generated service
-    principals.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/azure-method.hbs b/ui/app/templates/components/wizard/azure-method.hbs
deleted file mode 100644
index 3bb07bdd632..00000000000
--- a/ui/app/templates/components/wizard/azure-method.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Azure"
-  @headerIcon="azure-color"
-  @docText="Docs: Azure Authentication"
-  @docPath="/docs/auth/azure.html"
->
-  <p>
-    The Azure Auth Method allows authentication against Vault using Azure Active Directory credentials.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/cert-method.hbs b/ui/app/templates/components/wizard/cert-method.hbs
deleted file mode 100644
index 76c81144cc0..00000000000
--- a/ui/app/templates/components/wizard/cert-method.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="TLS Certificates"
-  @headerIcon="certificate"
-  @docText="Docs: TLS Certificates Authentication"
-  @docPath="/docs/auth/cert.html"
->
-  <p>
-    The TLS Certificates Auth Method allows authentication using SSL/TLS client certificates which are either signed by a CA
-    or self-signed. CA certificates are associated with a role.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/ch-engine.hbs b/ui/app/templates/components/wizard/ch-engine.hbs
deleted file mode 100644
index 42895655f47..00000000000
--- a/ui/app/templates/components/wizard/ch-engine.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="Cubbyhole" @docText="Docs: Cubbyhole Secrets" @docPath="/docs/secrets/cubbyhole/index.html">
-  <p>
-    The cubbyhole Secrets Engine is used to store arbitrary secrets within the configured physical storage for Vault
-    namespaced to a token. In cubbyhole, paths are scoped per token. No token can access another token's cubbyhole. When the
-    token expires, its cubbyhole is destroyed.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/consul-engine.hbs b/ui/app/templates/components/wizard/consul-engine.hbs
deleted file mode 100644
index e3efa845a87..00000000000
--- a/ui/app/templates/components/wizard/consul-engine.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Consul"
-  @headerIcon="consul"
-  @docText="Docs: Consul Secrets"
-  @docPath="/docs/secrets/consul/index.html"
->
-  <p>
-    The Consul Secrets Engine generates Consul API tokens dynamically based on Consul ACL policies.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/database-engine.hbs b/ui/app/templates/components/wizard/database-engine.hbs
deleted file mode 100644
index 57031d266dc..00000000000
--- a/ui/app/templates/components/wizard/database-engine.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Databases"
-  @headerIcon="database"
-  @docText="Docs: Database Secrets"
-  @docPath="/docs/secrets/databases/index.html"
->
-  <p>
-    The database Secrets Engine generates database credentials dynamically based on configured roles.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/features-selection.hbs b/ui/app/templates/components/wizard/features-selection.hbs
deleted file mode 100644
index 4d9f030c654..00000000000
--- a/ui/app/templates/components/wizard/features-selection.hbs
+++ /dev/null
@@ -1,75 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText="Vault Web UI" @glyph="guide" @selectProgress={{this.selectProgress}}>
-  <h2 class="title is-6">
-    Choosing where to go
-  </h2>
-  <p>
-    You did it! You now have access to your Vault and can start entering your data. We can help you get started with any of
-    the options below.
-  </p>
-  <div class="access-information">
-    <Icon @name="info" class="has-text-info" />
-    <p>
-      Vault only shows links to pages that you have access to based on your policies. Contact your administrator if you need
-      access changes.
-    </p>
-  </div>
-  {{#if (or (has-feature "Performance Replication") (has-feature "DR Replication"))}}{{/if}}
-  <h3 class="feature-header">Walk me through setting up:</h3>
-  <form id="features-form" class="feature-selection" {{action "saveFeatures" on="submit"}}>
-    {{#each this.allFeatures as |feature|}}
-      {{#if feature.show}}
-        <div
-          class="feature-box {{if feature.selected 'is-active'}} {{if feature.disabled 'is-disabled'}}"
-          data-test-select-input={{true}}
-        >
-          <div class="b-checkbox">
-            <input
-              id="feature-{{feature.key}}"
-              type="checkbox"
-              class="styled"
-              checked={{feature.selected}}
-              onchange={{action (mut feature.selected) value="target.checked"}}
-              disabled={{feature.disabled}}
-              data-test-checkbox={{feature.name}}
-            />
-            <label for="feature-{{feature.key}}">{{feature.name}}</label>
-            <Hds::Button
-              @color="tertiary"
-              @text={{if (get this (concat feature.key "-isOpen")) "Close" "Open"}}
-              @icon={{if (get this (concat feature.key "-isOpen")) "chevron-up" "chevron-down"}}
-              @isIconOnly={{true}}
-              {{on "click" (action (toggle (concat feature.key "-isOpen") this))}}
-            />
-            {{#if feature.disabled}}
-              <Info-Tooltip data-test-tooltip>
-                You do not have permissions to tour some parts of this feature
-              </Info-Tooltip>
-            {{/if}}
-          </div>
-          {{#if (get this (concat feature.key "-isOpen"))}}
-            <ul class="feature-steps">
-              {{#each feature.steps as |step|}}
-                <li>{{step}}</li>
-              {{/each}}
-            </ul>
-          {{/if}}
-        </div>
-      {{/if}}
-    {{/each}}
-    <span class="selection-summary">
-      <Hds::Button @text="Start" type="submit" disabled={{this.cannotStartWizard}} data-test-start-button />
-      {{#if this.selectedFeatures}}
-        <span class="time-estimate">
-          <Icon @name="clock" class="has-text-grey" />About
-          {{this.estimatedTime}}
-          minutes
-        </span>
-      {{/if}}
-    </span>
-  </form>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/gcp-engine.hbs b/ui/app/templates/components/wizard/gcp-engine.hbs
deleted file mode 100644
index ce60ae54fbb..00000000000
--- a/ui/app/templates/components/wizard/gcp-engine.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Google Cloud"
-  @headerIcon="gcp-color"
-  @docText="Docs: Google Cloud Secrets"
-  @docPath="/docs/secrets/gcp/index.html"
->
-  <p>
-    The Google Cloud Vault Secrets Engine dynamically generates Google Cloud service account keys and OAuth tokens based on
-    IAM policies. This enables users to gain access to Google Cloud resources without needing to create or manage a dedicated
-    service account.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/gcp-method.hbs b/ui/app/templates/components/wizard/gcp-method.hbs
deleted file mode 100644
index 1645c2197d0..00000000000
--- a/ui/app/templates/components/wizard/gcp-method.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Google Cloud"
-  @headerIcon="gcp-color"
-  @docText="Docs: Google Cloud Authentication"
-  @docPath="/docs/auth/gcp.html"
->
-  <p>
-    The GCP Auth Method allows authentication against Vault using Google credentials.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/gcpkms-engine.hbs b/ui/app/templates/components/wizard/gcpkms-engine.hbs
deleted file mode 100644
index defc018ac92..00000000000
--- a/ui/app/templates/components/wizard/gcpkms-engine.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Google Cloud KMS"
-  @headerIcon="gcp-color"
-  @docText="Docs: Google Cloud Secrets"
-  @docPath="/docs/secrets/gcpkms/index.html"
->
-  <p>
-    The Google Cloud KMS Vault Secrets Engine provides encryption and key management via Google Cloud KMS. It supports
-    management of keys, including creation, rotation, and revocation, as well as encrypting and decrypting data with managed
-    keys. This enables management of KMS keys through Vault's policies and IAM system.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/github-method.hbs b/ui/app/templates/components/wizard/github-method.hbs
deleted file mode 100644
index 708eda4516a..00000000000
--- a/ui/app/templates/components/wizard/github-method.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="GitHub"
-  @headerIcon="github"
-  @docText="Docs: GitHub Authentication"
-  @docPath="/docs/auth/github.html"
->
-  <p>
-    The Github Auth Method can be used to authenticate with Vault using a GitHub personal access token.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/init-login.hbs b/ui/app/templates/components/wizard/init-login.hbs
deleted file mode 100644
index 66cf830931e..00000000000
--- a/ui/app/templates/components/wizard/init-login.hbs
+++ /dev/null
@@ -1,14 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText="Authentication" @glyph="guide">
-  <WizardSection @headerText="Authenticate to Vault" @docText="Learn: Initialization" @docPath="/docs/concepts/tokens.html">
-    <p>
-      Vault is unsealed, but we still need to authenticate using the Initial Root Token that was generated. We recommend
-      setting up an Authentication Method such as Username & Password for regular use, and only using a root token for
-      initial setup or for emergencies.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/init-save-keys.hbs b/ui/app/templates/components/wizard/init-save-keys.hbs
deleted file mode 100644
index 2d13ae76b83..00000000000
--- a/ui/app/templates/components/wizard/init-save-keys.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText="Initialization" @glyph="guide">
-  <WizardSection
-    @headerText="Saving your keys"
-    @docText="Learn: Initialization"
-    @docPath="/intro/getting-started/deploy.html#initializing-the-vault"
-  >
-    <p>
-      Now that Vault is initialized, you'll want to save your root token and root key portions in a safe place. Distribute
-      your keys to responsible people on your team. If these keys are lost, you may not be able to access your data again.
-      Keep them safe!
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/init-setup.hbs b/ui/app/templates/components/wizard/init-setup.hbs
deleted file mode 100644
index cc60b2143b4..00000000000
--- a/ui/app/templates/components/wizard/init-setup.hbs
+++ /dev/null
@@ -1,19 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText="Initialization" @glyph="guide">
-  <WizardSection
-    @headerText="Setting up your root keys"
-    @docText="Learn: Initialization"
-    @docPath="/intro/getting-started/deploy.html#initializing-the-vault"
-  >
-    <p>
-      This is the very first step of setting up a Vault server. Vault comes with an important security feature called a
-      "seal", which lets you shut down and secure your Vault installation if there is a security breach. This is the default
-      state of Vault, so it is currently sealed since it was just installed. To unseal the vault, you will need to provide
-      the key(s) that you generate here.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/init-unseal.hbs b/ui/app/templates/components/wizard/init-unseal.hbs
deleted file mode 100644
index ae6d8bd572d..00000000000
--- a/ui/app/templates/components/wizard/init-unseal.hbs
+++ /dev/null
@@ -1,30 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText="Initialization" @glyph="guide">
-  <WizardSection
-    @headerText="Unsealing your vault"
-    @docText="Learn: Initialization"
-    @docPath="/intro/getting-started/deploy.html#initializing-the-vault"
-  >
-    <p>
-      Now we will provide the
-      {{pluralize this.componentState.threshold "key"}}
-      that you copied or downloaded to unseal the vault so that we can get started using it. You'll need
-      {{pluralize this.componentState.threshold "key"}}
-      total, and
-      {{#let (pluralize this.componentState.progress "key" without-count=true) as |word|}}
-        {{if
-          (eq word "key")
-          (concat this.componentState.progress " " word " has ")
-          (concat this.componentState.progress " " word " have ")
-        }}
-      {{/let}}
-      already been provided. Please provide
-      {{pluralize (dec this.componentState.progress this.componentState.threshold) "more key"}}
-      to unseal.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/keymgmt-engine.hbs b/ui/app/templates/components/wizard/keymgmt-engine.hbs
deleted file mode 100644
index e32d00213d6..00000000000
--- a/ui/app/templates/components/wizard/keymgmt-engine.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Key Management"
-  @headerIcon="key"
-  @docText="Docs: Key Management Secrets Engine"
-  @docPath="/docs/secrets/key-management"
->
-  <p>
-    Key Management is a secrets engine that allows key generation, lifecycle management, and secure distribution of
-    cryptographic keys into cloud key management services.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/kmip-engine.hbs b/ui/app/templates/components/wizard/kmip-engine.hbs
deleted file mode 100644
index 6b5398e8aff..00000000000
--- a/ui/app/templates/components/wizard/kmip-engine.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="KMIP"
-  @headerIcon="unlock"
-  @docText="Docs: KMIP Secrets Engine"
-  @docPath="/docs/secrets/kmip/index.html"
->
-  <p>
-    The KMIP secrets engine allows Vault to act as a KMIP server provider and handle the lifecycle of KMIP managed objects.
-    KMIP, which stands for Key Management Interoperability Protocol, is a standardized protocol that allows services and
-    applications to perform cryptographic operations without having to manage cryptographic material, otherwise known as
-    manage objects, by delegating its storage and lifecycle to a key management server.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/kubernetes-method.hbs b/ui/app/templates/components/wizard/kubernetes-method.hbs
deleted file mode 100644
index 75eab8ad860..00000000000
--- a/ui/app/templates/components/wizard/kubernetes-method.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Kubernetes"
-  @headerIcon="kubernetes-color"
-  @docText="Docs: Kubernetes Authentication"
-  @docPath="/docs/auth/kubernetes.html"
->
-  <p>
-    The Kubernetes Auth Method can be used to authenticate with Vault using a Kubernetes Service Account Token. This method
-    of authentication makes it easy to introduce a Vault token into a Kubernetes Pod.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/kv-engine.hbs b/ui/app/templates/components/wizard/kv-engine.hbs
deleted file mode 100644
index f0bc73e03ee..00000000000
--- a/ui/app/templates/components/wizard/kv-engine.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Key Value"
-  @headerIcon="list"
-  @docText="Docs: Key Value Secrets"
-  @docPath="/docs/secrets/kv/index.html"
->
-  <p>
-    The KV Secrets Engine is used to store arbitrary secrets within the configured physical storage for Vault. This backend
-    can be run in one of two modes. It can be a generic key-value store that stores one value for a key. Versioning can be
-    enabled and a configurable number of versions for each key will be stored.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/ldap-method.hbs b/ui/app/templates/components/wizard/ldap-method.hbs
deleted file mode 100644
index d0c9b942ac8..00000000000
--- a/ui/app/templates/components/wizard/ldap-method.hbs
+++ /dev/null
@@ -1,11 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="LDAP" @headerIcon="user" @docText="Docs: LDAP Authentication" @docPath="/docs/auth/ldap.html">
-  <p>
-    The LDAP Auth Method allows authentication using an existing LDAP server and user/password credentials. This allows Vault
-    to be integrated into environments using LDAP without duplicating the user/pass configuration in multiple places.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/mount-info.hbs b/ui/app/templates/components/wizard/mount-info.hbs
deleted file mode 100644
index ccc276cdd38..00000000000
--- a/ui/app/templates/components/wizard/mount-info.hbs
+++ /dev/null
@@ -1,34 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.top>
-    <KeyValueHeader @baseKey={{this.model}} @path="vault.cluster.access.method" @root={{this.root}} @showCurrent={{true}} />
-  </p.top>
-  <p.levelLeft>
-    <h1 class="title is-3">
-      {{titleize this.model.methodType}}
-    </h1>
-  </p.levelLeft>
-  <p.levelRight>
-    {{#if (eq this.section "configuration")}}
-      <div class="field is-grouped">
-        <div class="control">
-          <LinkTo
-            @route="vault.cluster.settings.auth.configure"
-            @model={{this.model.id}}
-            class="button is-ghost has-icon-right is-compact"
-            data-test-configure-link={{true}}
-          >
-            Configure
-            <Chevron />
-          </LinkTo>
-        </div>
-      </div>
-    {{/if}}
-  </p.levelRight>
-</PageHeader>
-{{section-tabs this.model "authShow"}}
-{{component (concat "auth-method/" this.section) model=this.model}}
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/mounts-wizard.hbs b/ui/app/templates/components/wizard/mounts-wizard.hbs
deleted file mode 100644
index 8642aae7440..00000000000
--- a/ui/app/templates/components/wizard/mounts-wizard.hbs
+++ /dev/null
@@ -1,25 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText={{capitalize this.currentMachine}} @glyph="guide">
-  {{component
-    this.stepComponent
-    mountSubtype=this.mountSubtype
-    mountName=this.mountName
-    actionText=this.actionText
-    nextFeature=this.nextFeature
-    nextStep=this.nextStep
-    featureState=this.wizard.featureState
-    needsConnection=this.needsConnection
-    needsEncryption=this.needsEncryption
-    isSupported=this.isSupported
-    onDone=this.onDone
-    onAdvance=this.onAdvance
-    onRepeat=this.onRepeat
-    onReset=this.onReset
-    class="wizard-step"
-  }}
-  {{component this.detailsComponent onAdvance=this.onAdvance onRepeat=this.onRepeat class="wizard-details"}}
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/nomad-engine.hbs b/ui/app/templates/components/wizard/nomad-engine.hbs
deleted file mode 100644
index fa8a8e76221..00000000000
--- a/ui/app/templates/components/wizard/nomad-engine.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Nomad"
-  @headerIcon="nomad"
-  @docText="Docs: Nomad Secrets"
-  @docPath="/docs/secrets/nomad/index.html"
->
-  <p>
-    The Nomad secret backend for Vault generates Nomad API tokens dynamically based on pre-existing Nomad ACL policies.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/okta-method.hbs b/ui/app/templates/components/wizard/okta-method.hbs
deleted file mode 100644
index 03a3878358e..00000000000
--- a/ui/app/templates/components/wizard/okta-method.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Okta"
-  @headerIcon="okta-color"
-  @docText="Docs: Okta Authentication"
-  @docPath="/docs/auth/okta.html"
->
-  <p>
-    The Okta Auth Method allows authentication using Okta and user/password credentials. This allows Vault to be integrated
-    into environments using Okta.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/pki-engine.hbs b/ui/app/templates/components/wizard/pki-engine.hbs
deleted file mode 100644
index bfd9629cbff..00000000000
--- a/ui/app/templates/components/wizard/pki-engine.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="PKI"
-  @headerIcon="file-text"
-  @docText="Docs: PKI Secrets"
-  @docPath="/docs/secrets/pki/index.html"
->
-  <p>
-    The PKI Secrets Engine generates dynamic X.509 certificates. With this Secrets Engine, services can get certificates
-    without going through the usual manual process of generating a private key and CSR, submitting to a CA, and waiting for a
-    verification and signing process to complete.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/policies-create.hbs b/ui/app/templates/components/wizard/policies-create.hbs
deleted file mode 100644
index d7b6c94bd40..00000000000
--- a/ui/app/templates/components/wizard/policies-create.hbs
+++ /dev/null
@@ -1,19 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Policies" @glyph="guide">
-  <WizardSection
-    @headerText="Creating a policy"
-    @docText="Docs: Policies"
-    @docPath="/docs/concepts/policies.html"
-    @instructions='Fill in your policy details and click "Create Policy".'
-  >
-    <p>
-      Let's use "<code>my-new-policy</code>" for your policy name. Copy the policy below to try it out:
-    </p>
-    <pre><code>path "secret/foo" { capabilities = ["read"] }</code></pre>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/policies-delete.hbs b/ui/app/templates/components/wizard/policies-delete.hbs
deleted file mode 100644
index 5e51d841f67..00000000000
--- a/ui/app/templates/components/wizard/policies-delete.hbs
+++ /dev/null
@@ -1,22 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Policies" @glyph="guide">
-  <WizardSection
-    @headerText="Deleting your policy"
-    @docText="Docs: Policies"
-    @docPath="/docs/concepts/policies.html"
-    @instructions='Click on "Delete" to remove the policy that you created.'
-  >
-    <p>
-      {{#if (eq @currentRouteName "vault.cluster.policies.index")}}
-        You can delete your test policy by clicking the "..." icon to the right of the policy name.
-      {{else}}
-        You can delete your test policy by clicking "Delete" in the toolbar.
-      {{/if}}
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/policies-details.hbs b/ui/app/templates/components/wizard/policies-details.hbs
deleted file mode 100644
index abd78ca1f3f..00000000000
--- a/ui/app/templates/components/wizard/policies-details.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Policies" @glyph="guide">
-  <WizardSection
-    @headerText="Your new policy"
-    @docText="Docs: Policies"
-    @docPath="/docs/concepts/policies.html"
-    @instructions='Click on "ACL Policies" in the sidebar to go back to the list of policies.'
-  >
-    <p>
-      Good job! Here you can see your new policy. If you'd like to edit it, you'd just click "Edit policy" in the toolbar.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/policies-intro.hbs b/ui/app/templates/components/wizard/policies-intro.hbs
deleted file mode 100644
index 478c5cd4b4f..00000000000
--- a/ui/app/templates/components/wizard/policies-intro.hbs
+++ /dev/null
@@ -1,19 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Policies" @glyph="guide">
-  <WizardSection
-    @headerText="Choosing a policy type"
-    @docText="Docs: Policies"
-    @docPath="/docs/concepts/policies.html"
-    @instructions='To get started with something simple, click on "Create ACL policy".'
-  >
-    <p>
-      Policies in Vault are a way for you to control what data can be accessed, including things like creating new secrets,
-      listing users, or even entire Vault features.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/policies-others.hbs b/ui/app/templates/components/wizard/policies-others.hbs
deleted file mode 100644
index 22c0e8a3091..00000000000
--- a/ui/app/templates/components/wizard/policies-others.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText="Policies" @glyph="guide">
-  <WizardSection @headerText="Other kinds of policies" @docText="Docs: Policies" @docPath="/docs/concepts/policies.html">
-    <p>
-      Good! Now you're ready to go writing your own policies. We only explored ACL policies, but there are two other types of
-      policies available to Enterprise customers that might be what you need. RGP (Role Governing Policies) are policies tied
-      to particular tokens, entities, or groups. EGP (Endpoint Governing Policies) are tied to specific paths instead of
-      tokens.
-    </p>
-  </WizardSection>
-  <WizardSection @headerText="Ready to move on?" @class="wizard-details">
-    <Hds::Button @text={{@nextFeature}} @icon="chevron-right" @iconPosition="trailing" {{on "click" (action @onAdvance)}} />
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/rabbitmq-engine.hbs b/ui/app/templates/components/wizard/rabbitmq-engine.hbs
deleted file mode 100644
index c731f1e0615..00000000000
--- a/ui/app/templates/components/wizard/rabbitmq-engine.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="RabbitMQ"
-  @headerIcon="rabbitmq"
-  @docText="Docs: RabbitMQ Secrets"
-  @docPath="/docs/secrets/rabbitmq/index.html"
->
-  <p>
-    The RabbitMQ Secrets Engine generates user credentials dynamically based on configured permissions and virtual hosts.
-    This means that services that need to access a virtual host no longer need to hardcode credentials.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/radius-method.hbs b/ui/app/templates/components/wizard/radius-method.hbs
deleted file mode 100644
index 472357b1a16..00000000000
--- a/ui/app/templates/components/wizard/radius-method.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="RADIUS"
-  @headerIcon="user"
-  @docText="Docs: RADIUS Authentication"
-  @docPath="/docs/auth/radius.html"
->
-  <p>
-    The RADIUS Auth Method allows users to authenticate with Vault using an existing RADIUS server that accepts the PAP
-    authentication scheme.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/replication-setup.hbs b/ui/app/templates/components/wizard/replication-setup.hbs
deleted file mode 100644
index 71185ad2b4d..00000000000
--- a/ui/app/templates/components/wizard/replication-setup.hbs
+++ /dev/null
@@ -1,37 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Replication" @glyph="guide">
-  <WizardSection
-    @headerText="Setting up Replication"
-    @docText="Docs: Replication"
-    @docPath="/docs/internals/replication.html"
-    @instructions='Choose the one that is right for your needs and click "Enable Replication"'
-  >
-    <p>
-      Vault has two kinds of replication, each for a different purpose. Do you want to keep a backup of your data, or are you
-      more interested in speed of access?
-    </p>
-
-    <DocLink @path="/vault/tutorials/enterprise/performance-replication">
-      <Icon @name="learn-link" />
-      Learn: Setting Up Performance Replication
-    </DocLink>
-
-    <DocLink @path="/vault/tutorials/enterprise/disaster-recovery">
-      <Icon @name="learn-link" />
-      Learn: Setting up Disaster Recovery
-    </DocLink>
-
-  </WizardSection>
-  <WizardSection @headerText="Cluster mode" @class="wizard-details">
-    <p>
-      A cluster is set as either a primary or secondary. The primary cluster is authoritative, and is the only cluster
-      allowed to perform actions that write to the underlying data storage, such as modifying policies or secrets. Secondary
-      clusters can service all other operations and forward any writes to the primary cluster.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-connection-show.hbs b/ui/app/templates/components/wizard/secrets-connection-show.hbs
deleted file mode 100644
index 510de20ba1c..00000000000
--- a/ui/app/templates/components/wizard/secrets-connection-show.hbs
+++ /dev/null
@@ -1,10 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="Create a Role" @instructions="Click “Add role.”">
-  <p>
-    Now that we've setup a database let's connect a role.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-connection.hbs b/ui/app/templates/components/wizard/secrets-connection.hbs
deleted file mode 100644
index 7a7a3dda80c..00000000000
--- a/ui/app/templates/components/wizard/secrets-connection.hbs
+++ /dev/null
@@ -1,13 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Connect a database"
-  @instructions="Enter the details of your database and click “Create database.”"
->
-  <p>
-    Here you can specify the details of your database plugin and include any root rotation statements.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-credentials.hbs b/ui/app/templates/components/wizard/secrets-credentials.hbs
deleted file mode 100644
index 3415408b537..00000000000
--- a/ui/app/templates/components/wizard/secrets-credentials.hbs
+++ /dev/null
@@ -1,10 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="Generate Credential">
-  <p>
-    Enter details and generate your credential.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-details.hbs b/ui/app/templates/components/wizard/secrets-details.hbs
deleted file mode 100644
index c83ae970e24..00000000000
--- a/ui/app/templates/components/wizard/secrets-details.hbs
+++ /dev/null
@@ -1,22 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="Your Secrets Engine" @instructions="Click on the link to add a {{@nextStep}} in the page header">
-  <p>
-    {{#if (eq @mountSubtype "keymgmt")}}
-      This secrets engine manages keys and distributes them to external destinations. We recommend that you create a provider
-      to which you can distribute keys.
-    {{else}}
-      {{#if @needsEncryption}}
-        The Transit Secrets Engine uses encryption keys to provide "encryption as a service". Click on "Create Encryption
-        Key" at the top to create one.
-      {{/if}}
-      {{#if @needsConnection}}
-        Now that the engine has been mounted, let’s connect a
-        {{@mountSubtype}}.
-      {{/if}}
-    {{/if}}
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-display-database-role.hbs b/ui/app/templates/components/wizard/secrets-display-database-role.hbs
deleted file mode 100644
index b17c2ab98ba..00000000000
--- a/ui/app/templates/components/wizard/secrets-display-database-role.hbs
+++ /dev/null
@@ -1,10 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="Create a Role" @instructions="Edit the details of your role and click “Create role.”">
-  <p>
-    Roles are what generate database credentials. They can be static or dynamic.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-display-role.hbs b/ui/app/templates/components/wizard/secrets-display-role.hbs
deleted file mode 100644
index 276da158c83..00000000000
--- a/ui/app/templates/components/wizard/secrets-display-role.hbs
+++ /dev/null
@@ -1,11 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="Your new role">
-  <p>
-    With our new role, we can generate a credential that has the same permissions as that role. Click on "Generate
-    credentials" links at the top of the page.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-display.hbs b/ui/app/templates/components/wizard/secrets-display.hbs
deleted file mode 100644
index 5b50135828d..00000000000
--- a/ui/app/templates/components/wizard/secrets-display.hbs
+++ /dev/null
@@ -1,50 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if @isSupported}}
-  <WizardSection
-    @headerText={{if
-      (eq @mountSubtype "keymgmt")
-      "Your key and provider"
-      (unless @actionText "All set!" "Generate Credential")
-    }}
-  >
-    <p>
-      {{#if (eq @mountSubtype "keymgmt")}}
-        Your key and your provider have been created and connected. From here, you can click the key name to view the key
-        You’re now ready to start using the secrets engine.
-      {{else if @actionText}}
-        Here is your generated credential. As you can see, we can only show the credential once, so you'll want to be sure to
-        save it. If you need another credential in the future, just come back and generate a new one.
-      {{else}}
-        Well done!
-      {{/if}}
-      You're now ready to start using your new
-      {{@mountName}}
-      Secrets Engine.
-    </p>
-  </WizardSection>
-{{else}}
-  <WizardSection @headerText="Viewing engine configuration">
-    <p>
-      Here you can see all the details of your new engine. This can be useful to get information for things like TTL or Seal
-      Wrap settings.
-    </p>
-  </WizardSection>
-{{/if}}
-<WizardSection @headerText="Want to start again or move on?" @class="wizard-details has-bottom-margin-l">
-  <Hds::ButtonSet>
-    {{#if @isSupported}}
-      <Hds::Button
-        @text={{concat "Create another " (unless @needsEncryption @mountName) " " @nextStep (if @needsEncryption " key")}}
-        @icon="sync"
-        @color="secondary"
-        {{on "click" (action @onRepeat)}}
-      />
-    {{/if}}
-    <Hds::Button @text="Enable another Secrets Engine" @icon="sync" @color="secondary" {{on "click" (action @onReset)}} />
-    <Hds::Button @text={{@nextFeature}} @icon="chevron-right" @iconPosition="trailing" {{on "click" (action @onDone)}} />
-  </Hds::ButtonSet>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-enable.hbs b/ui/app/templates/components/wizard/secrets-enable.hbs
deleted file mode 100644
index c22f9660ae1..00000000000
--- a/ui/app/templates/components/wizard/secrets-enable.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardSection
-  @headerText="Entering Secrets Engine details"
-  @docText="Docs: Secrets Engines"
-  @docPath="/docs/secrets/index.html"
-  @instructions='Fill in the details for your engine and click "Enable Engine"'
-  @class="has-bottom-margin-l"
->
-  <p>
-    Good choice! Now you can customize your engine with a name and description that makes sense for your team, as well as
-    options for replication and caching.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-encryption.hbs b/ui/app/templates/components/wizard/secrets-encryption.hbs
deleted file mode 100644
index d1c21ebc0d5..00000000000
--- a/ui/app/templates/components/wizard/secrets-encryption.hbs
+++ /dev/null
@@ -1,10 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="Adding an encryption key">
-  <p>
-    Enter the details about your encryption key and save it.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-idle.hbs b/ui/app/templates/components/wizard/secrets-idle.hbs
deleted file mode 100644
index fdde9d39a31..00000000000
--- a/ui/app/templates/components/wizard/secrets-idle.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardSection
-  @headerText="Enabling a Secrets Engine"
-  @docText="Docs: Secrets Engines"
-  @docPath="/docs/secrets/index.html"
-  @instructions='Select an engine and click "Next"'
-  @class="has-bottom-margin-l"
->
-  <p>
-    Vault is all about managing secrets, so let's set up your first Secrets Engine. You can use a static engine to store your
-    secrets locally in Vault, or connect to a cloud backend with one of the dynamic engines.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-keymgmt.hbs b/ui/app/templates/components/wizard/secrets-keymgmt.hbs
deleted file mode 100644
index cb42b1c4171..00000000000
--- a/ui/app/templates/components/wizard/secrets-keymgmt.hbs
+++ /dev/null
@@ -1,10 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText={{this.headerText}} @instructions={{this.instructions}}>
-  <p>
-    {{this.body}}
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-list.hbs b/ui/app/templates/components/wizard/secrets-list.hbs
deleted file mode 100644
index c8358374412..00000000000
--- a/ui/app/templates/components/wizard/secrets-list.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardSection
-  @headerText="Viewing engine configuration"
-  @instructions='Find the engine in the list and click on "View configuration" in the menu on the right.'
->
-  <p>
-    This engine isn't fully supported in the Vault UI yet, but you can view and edit the configuration and use the Vault Web
-    REPL to interact with the engine just like you would on the command-line.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-role.hbs b/ui/app/templates/components/wizard/secrets-role.hbs
deleted file mode 100644
index 5216d82d667..00000000000
--- a/ui/app/templates/components/wizard/secrets-role.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardSection @headerText="Adding a role" @instructions='Enter your role details and click "Create role"'>
-  <p>
-    A role grants permissions that specify what an identity can and cannot do. A role is typically shared among many users
-    who are then granted credentials with that are granted the policy permissions.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/secrets-secret.hbs b/ui/app/templates/components/wizard/secrets-secret.hbs
deleted file mode 100644
index 9db1e3e6ddf..00000000000
--- a/ui/app/templates/components/wizard/secrets-secret.hbs
+++ /dev/null
@@ -1,11 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardSection @headerText="Adding a secret" @instructions='Enter the details of your secret and click "Save"'>
-  <p>
-    Here you can specify the path of your secret and include the key/value pairs to include.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/ssh-engine.hbs b/ui/app/templates/components/wizard/ssh-engine.hbs
deleted file mode 100644
index 141262e96e5..00000000000
--- a/ui/app/templates/components/wizard/ssh-engine.hbs
+++ /dev/null
@@ -1,17 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="SSH"
-  @headerIcon="terminal-screen"
-  @docText="Docs: SSH Secrets"
-  @docPath="/docs/secrets/ssh/index.html"
->
-  <p>
-    The Vault SSH Secrets Engine provides secure authentication and authorization for access to machines via the SSH
-    protocol. The Vault SSH Secrets Engine helps manage access to machine infrastructure, providing several ways to issue SSH
-    credentials.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tools-info.hbs b/ui/app/templates/components/wizard/tools-info.hbs
deleted file mode 100644
index e7f1f782f61..00000000000
--- a/ui/app/templates/components/wizard/tools-info.hbs
+++ /dev/null
@@ -1,19 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Tools" @glyph="guide">
-  <WizardSection
-    @headerText="Information about your data"
-    @docText="API: Lookup Data"
-    @docPath="/api/system/wrapping-lookup.html"
-    @instructions='Click on "Rewrap" in the sidebar.'
-  >
-    <p>
-      Good job! You can see some basic information about your wrapped data, including the expiration time. Next up, we'll
-      take the token you still have in your clipboard and rewrap it to keep it active and extend that expiration time.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tools-lookup.hbs b/ui/app/templates/components/wizard/tools-lookup.hbs
deleted file mode 100644
index bdd92d21457..00000000000
--- a/ui/app/templates/components/wizard/tools-lookup.hbs
+++ /dev/null
@@ -1,19 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Tools" @glyph="guide">
-  <WizardSection
-    @headerText="Lookup wrapped data"
-    @docText="API: Lookup Data"
-    @docPath="/api/system/wrapping-lookup.html"
-    @instructions='Paste the token that you copied and click "Lookup Token".'
-  >
-    <p>
-      Lookup lets you see information about your token without unwrapping it or changing it. Paste your token here and click
-      "Lookup". If you find that your data didn't copy for some reason, you can always go back and do it again.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tools-rewrap.hbs b/ui/app/templates/components/wizard/tools-rewrap.hbs
deleted file mode 100644
index 9d502660f0c..00000000000
--- a/ui/app/templates/components/wizard/tools-rewrap.hbs
+++ /dev/null
@@ -1,19 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Tools" @glyph="guide">
-  <WizardSection
-    @headerText="Rewrapping your data"
-    @docText="API: Rewrap Data"
-    @docPath="/api/system/wrapping-rewrap.html"
-    @instructions='Paste your token into the input and click "Rewrap Token" to transform your token into a new one.'
-  >
-    <p>
-      You can rewrap your data to rotate the token, but it will still have the same creation time and TTL. Don't worry, the
-      new token will still have the same data.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tools-rewrapped.hbs b/ui/app/templates/components/wizard/tools-rewrapped.hbs
deleted file mode 100644
index 2fcf6b6eaaf..00000000000
--- a/ui/app/templates/components/wizard/tools-rewrapped.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Tools" @glyph="guide">
-  <WizardSection
-    @headerText="Your rewrapped data"
-    @docText="API: Rewrap Data"
-    @docPath="/api/system/wrapping-rewrap.html"
-    @instructions='Copy this token and then click on "Unwrap" in the sidebar to verify the data is still in there.'
-  >
-    <p>
-      It's a subtle transformation, but your old token has been revoked and this new one has taken its place.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tools-unwrap.hbs b/ui/app/templates/components/wizard/tools-unwrap.hbs
deleted file mode 100644
index 171e32d8eb5..00000000000
--- a/ui/app/templates/components/wizard/tools-unwrap.hbs
+++ /dev/null
@@ -1,18 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Tools" @glyph="guide">
-  <WizardSection
-    @headerText="Unwrapping your data"
-    @docText="API: Unwrap Data"
-    @docPath="/api/system/wrapping-unwrap.html"
-    @instructions='Paste your token into the input and click "Unwrap Data".'
-  >
-    <p>
-      We saved this step for the end because unwrapping the token will revoke it, so we can only do this once.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tools-unwrapped.hbs b/ui/app/templates/components/wizard/tools-unwrapped.hbs
deleted file mode 100644
index 55756282180..00000000000
--- a/ui/app/templates/components/wizard/tools-unwrapped.hbs
+++ /dev/null
@@ -1,14 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText="Tools" @glyph="guide">
-  <WizardSection @headerText="Your unwrapped data" @docText="API: Unwrap Data" @docPath="/api/system/wrapping-unwrap.html">
-    <p>
-      Here you can see that your data survived intact. These tools are mostly handy for applications to use, but if you ever
-      do need to wrap data or handle the wrapped token, now you know how.
-    </p>
-  </WizardSection>
-  <Hds::Button @text={{@nextFeature}} @icon="chevron-right" @iconPosition="trailing" {{on "click" (action @onAdvance)}} />
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tools-wrap.hbs b/ui/app/templates/components/wizard/tools-wrap.hbs
deleted file mode 100644
index 5615af98bcb..00000000000
--- a/ui/app/templates/components/wizard/tools-wrap.hbs
+++ /dev/null
@@ -1,19 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Tools" @glyph="guide">
-  <WizardSection
-    @headerText="Wrapping data"
-    @docText="API: Wrap Data"
-    @docPath="/api/system/wrapping-wrap.html"
-    @instructions='Enter some data in JSON format and click "Wrap Data".'
-  >
-    <p>
-      Vault provides several ways to create or wrap data, and manage it from there. Here you can wrap a token (or anything
-      you like) in JSON format. Give it a try.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tools-wrapped.hbs b/ui/app/templates/components/wizard/tools-wrapped.hbs
deleted file mode 100644
index c85730bfbba..00000000000
--- a/ui/app/templates/components/wizard/tools-wrapped.hbs
+++ /dev/null
@@ -1,19 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable quotes }}
-<WizardContent @headerText="Tools" @glyph="guide">
-  <WizardSection
-    @headerText="Copying your wrapped token"
-    @docText="API: Wrap Data"
-    @docPath="/api/system/wrapping-wrap.html"
-    @instructions='Copy the token and then click on "Lookup" in the sidebar.'
-  >
-    <p>
-      Your data is now encrypted. You can recover the data using the token on this page, but be careful because if you lose
-      the token you won't be able to retrieve your data! We will use this token for the next few steps.
-    </p>
-  </WizardSection>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/totp-engine.hbs b/ui/app/templates/components/wizard/totp-engine.hbs
deleted file mode 100644
index 29bd08dc080..00000000000
--- a/ui/app/templates/components/wizard/totp-engine.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="TOTP"
-  @headerIcon="history"
-  @docText="Docs: TOTP Secrets"
-  @docPath="/docs/secrets/totp/index.html"
->
-  <p>
-    The TOTP Secrets Engine generates time-based credentials according to the TOTP standard.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/transit-engine.hbs b/ui/app/templates/components/wizard/transit-engine.hbs
deleted file mode 100644
index 67b28009223..00000000000
--- a/ui/app/templates/components/wizard/transit-engine.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Transit"
-  @headerIcon="swap-horizontal"
-  @docText="Docs: Transit Secrets"
-  @docPath="/docs/secrets/transit/index.html"
->
-  <p>
-    The Transit Secrets Engine handles cryptographic functions on data in-transit. Vault doesn't store the data sent to the
-    Secrets Engine. It can also be viewed as "cryptography as a service" or "encryption as a service".
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tutorial-active.hbs b/ui/app/templates/components/wizard/tutorial-active.hbs
deleted file mode 100644
index 64ac0317eeb..00000000000
--- a/ui/app/templates/components/wizard/tutorial-active.hbs
+++ /dev/null
@@ -1,7 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{! template-lint-disable no-yield-only }}
-{{yield}}
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tutorial-complete.hbs b/ui/app/templates/components/wizard/tutorial-complete.hbs
deleted file mode 100644
index 229a2afd385..00000000000
--- a/ui/app/templates/components/wizard/tutorial-complete.hbs
+++ /dev/null
@@ -1,13 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText="Thanks for taking the tour!" @glyph="guide" @class="collapsed">
-  <p>
-    We hope you enjoyed using Vault. You can get back to the guide in the user menu in the upper right.
-  </p>
-  <div class="box wizard-divider-box">
-    <Hds::Button @icon="x" @text="Close" {{on "click" (action this.onDismiss)}} />
-  </div>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tutorial-error.hbs b/ui/app/templates/components/wizard/tutorial-error.hbs
deleted file mode 100644
index 0c4e9917655..00000000000
--- a/ui/app/templates/components/wizard/tutorial-error.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection @headerText="Oops!">
-  <p>
-    Something went wrong and you can't complete this step.
-  </p>
-</WizardSection>
-<WizardSection>
-  <Hds::ButtonSet>
-    <Hds::Button @text="Go back" @icon="corner-up-left" @color="secondary" {{on "click" (action @onReset)}} />
-    <Hds::Button @text={{@nextFeature}} @icon="chevron-right" @iconPosition="trailing" {{on "click" (action @onAdvance)}} />
-  </Hds::ButtonSet>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tutorial-idle.hbs b/ui/app/templates/components/wizard/tutorial-idle.hbs
deleted file mode 100644
index 5b3c89be69b..00000000000
--- a/ui/app/templates/components/wizard/tutorial-idle.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText="Welcome to Vault" @glyph="guide" @class="collapsed" @hidePopup={{true}}>
-  <Hds::Button @text="Close" @icon="x" @isIconOnly={{true}} @color="secondary" {{on "click" (action @onDismiss)}} />
-  <p>Want a tour? Our helpful guide will introduce you to the Vault Web UI.</p>
-  <div class="box wizard-divider-box">
-    <Hds::Button @text="Let's get started" @icon="chevron-up" {{on "click" (action @onAdvance)}} />
-  </div>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/tutorial-paused.hbs b/ui/app/templates/components/wizard/tutorial-paused.hbs
deleted file mode 100644
index a3b00ad9939..00000000000
--- a/ui/app/templates/components/wizard/tutorial-paused.hbs
+++ /dev/null
@@ -1,12 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardContent @headerText="Vault Web UI Guide" @glyph="guide" @class="collapsed" @hidePopup={{true}}>
-  <Hds::Button @text="Close" @icon="x" @isIconOnly={{true}} @color="secondary" {{on "click" (action @onDismiss)}} />
-  <p>Feel free to explore Vault. Click below to get back to the guide or close this window.</p>
-  <div class="box wizard-divider-box">
-    <Hds::Button @text="Back to guide" @icon="chevron-up" {{on "click" (action @onAdvance)}} />
-  </div>
-</WizardContent>
\ No newline at end of file
diff --git a/ui/app/templates/components/wizard/userpass-method.hbs b/ui/app/templates/components/wizard/userpass-method.hbs
deleted file mode 100644
index de1b80d843e..00000000000
--- a/ui/app/templates/components/wizard/userpass-method.hbs
+++ /dev/null
@@ -1,15 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<WizardSection
-  @headerText="Username & Password"
-  @headerIcon="identity-user"
-  @docText="Docs: Userpass Authentication"
-  @docPath="/docs/auth/userpass.html"
->
-  <p>
-    The Username & Password Auth Method allows users to authenticate with Vault using a username and password combination.
-  </p>
-</WizardSection>
\ No newline at end of file
diff --git a/ui/app/templates/docs.hbs b/ui/app/templates/docs.hbs
new file mode 100644
index 00000000000..21853586c24
--- /dev/null
+++ b/ui/app/templates/docs.hbs
@@ -0,0 +1,79 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::AppFrame @hasSidebar={{@showSidebar}} @hasHeader={{false}} @hasFooter={{false}} as |Frame|>
+  <Frame.Sidebar data-test-sidebar-nav>
+    <DocfyOutput @scope="docs" as |docs|>
+      {{#let docs.children as |directories|}}
+        {{#let docs.pages as |pages|}}
+          <Hds::SideNav>
+            <:header>
+              <Hds::SideNav::Header>
+                <:logo>
+                  <Hds::SideNav::Header::HomeLink @icon="vault" @route="vault" @ariaLabel="Vault dashboard" />
+                </:logo>
+                <:actions>
+                  <Hds::Button @isIconOnly={{true}} @icon="home" @text="Docs index" @route="docs" />
+                </:actions>
+              </Hds::SideNav::Header>
+            </:header>
+            <:body>
+              <Hds::SideNav::List as |Nav|>
+                <Nav.BackLink @text="Back to work (Vault UI)" @route="vault" />
+                <Nav.Link @icon="home" @route="docs.index">
+                  Home
+                </Nav.Link>
+                <Nav.Link @icon="edit" @route="docs.how-to-docfy">
+                  How to docfy
+                </Nav.Link>
+
+                <Nav.Title>
+                  Components
+                </Nav.Title>
+                <Nav.Item>
+                  {{! FILTER + COMPONENT LIST }}
+                  <ZDocfyFilter @components={{get (find-by "name" "components" directories) "pages"}} />
+                </Nav.Item>
+
+                <Nav.Title>
+                  Contributing docs
+                </Nav.Title>
+                {{! Top level files in docs/ directory }}
+                {{#each pages as |page|}}
+                  {{#let (concat "docs." (if page.relativeUrl page.relativeUrl "index")) as |url|}}
+                    <Nav.Link @route={{url}}>
+                      {{page.title}}
+                    </Nav.Link>
+                  {{/let}}
+                {{/each}}
+
+                {{! Sub directories within docs/ (aside from 'components') }}
+                {{#each directories as |subDirectory|}}
+                  {{#if (not-eq subDirectory.name "components")}}
+                    <Nav.Title>
+                      {{capitalize subDirectory.label}}
+                    </Nav.Title>
+
+                    {{#each subDirectory.pages as |page|}}
+                      {{#let (concat "docs." (if page.relativeUrl page.relativeUrl "index")) as |url|}}
+                        <Nav.Link @route={{url}}>
+                          {{page.title}}
+                        </Nav.Link>
+                      {{/let}}
+                    {{/each}}
+                  {{/if}}
+                {{/each}}
+              </Hds::SideNav::List>
+            </:body>
+          </Hds::SideNav>
+        {{/let}}
+      {{/let}}
+    </DocfyOutput>
+  </Frame.Sidebar>
+
+  <Frame.Main id="docfy-content">
+    {{outlet}}
+  </Frame.Main>
+</Hds::AppFrame>
\ No newline at end of file
diff --git a/ui/app/templates/error.hbs b/ui/app/templates/error.hbs
index e8eda26490a..cd9a88be2e9 100644
--- a/ui/app/templates/error.hbs
+++ b/ui/app/templates/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="is-flex-grow-1 is-flex-v-centered">
   <div class="empty-state-content">
diff --git a/ui/app/templates/loading.hbs b/ui/app/templates/loading.hbs
index c2b1a43dc36..cc1512cdf29 100644
--- a/ui/app/templates/loading.hbs
+++ b/ui/app/templates/loading.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.isCallback}}
   <OidcCallbackSplash />
diff --git a/ui/app/templates/vault.hbs b/ui/app/templates/vault.hbs
index b26997c65a5..fdc2965fcd3 100644
--- a/ui/app/templates/vault.hbs
+++ b/ui/app/templates/vault.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{outlet}}
 
diff --git a/ui/app/templates/vault/cluster.hbs b/ui/app/templates/vault/cluster.hbs
index 37720a9d5e6..eeac13da35d 100644
--- a/ui/app/templates/vault/cluster.hbs
+++ b/ui/app/templates/vault/cluster.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 <Sidebar::Nav::Cluster />
 {{#if this.vaultVersion.isEnterprise}}
   {{#each this.customMessages.bannerMessages as |bannerMessage|}}
@@ -21,7 +21,7 @@
         {{/each}}
         {{#unless (is-empty-value bannerMessage.link)}}
           {{#each-in bannerMessage.link as |title href|}}
-            <A.Link::Standalone
+            <A.LinkStandalone
               @color="secondary"
               @icon="external-link"
               @isHrefExternal={{true}}
@@ -58,7 +58,7 @@
       </M.Body>
 
       <M.Footer as |F|>
-        <Hds::Button @text="Confirm" {{on "click" F.close}} data-test-modal-button={{modalMessage.id}} />
+        <Hds::Button @text="Confirm" {{on "click" F.close}} />
       </M.Footer>
     </Hds::Modal>
   {{/each}}
@@ -70,9 +70,6 @@
       @autoloaded={{eq this.activeCluster.licenseState "autoloaded"}}
     />
   {{/if}}
-  {{#if this.permissionBanner}}
-    <ResultantAclBanner @isEnterprise={{this.activeCluster.version.isEnterprise}} @failType={{this.permissionBanner}} />
-  {{/if}}
 </div>
 <div class="global-flash">
   {{#each this.flashMessages.queue as |flash|}}
@@ -84,6 +81,14 @@
 
 {{#if this.auth.isActiveSession}}
   <TokenExpireWarning @expirationDate={{this.auth.tokenExpirationDate}} @allowingExpiration={{this.auth.allowExpiration}}>
+    {{#if this.permissions.permissionsBanner}}
+      <div class="has-top-margin-m">
+        <ResultantAclBanner
+          @isEnterprise={{this.activeCluster.version.isEnterprise}}
+          @failType={{this.permissions.permissionsBanner}}
+        />
+      </div>
+    {{/if}}
     {{outlet}}
   </TokenExpireWarning>
 {{else}}
diff --git a/ui/app/templates/vault/cluster/access.hbs b/ui/app/templates/vault/cluster/access.hbs
index 7f312d2dfe9..2136badcf9c 100644
--- a/ui/app/templates/vault/cluster/access.hbs
+++ b/ui/app/templates/vault/cluster/access.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Sidebar::Nav::Access />
 {{outlet}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/access/control-group-accessor.hbs b/ui/app/templates/vault/cluster/access/control-group-accessor.hbs
index 894fafb8a16..49e5d5dbbab 100644
--- a/ui/app/templates/vault/cluster/access/control-group-accessor.hbs
+++ b/ui/app/templates/vault/cluster/access/control-group-accessor.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (has-feature "Control Groups")}}
   <PageHeader as |p|>
diff --git a/ui/app/templates/vault/cluster/access/control-groups-configure.hbs b/ui/app/templates/vault/cluster/access/control-groups-configure.hbs
index 76b15f46928..b0c05eb608f 100644
--- a/ui/app/templates/vault/cluster/access/control-groups-configure.hbs
+++ b/ui/app/templates/vault/cluster/access/control-groups-configure.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (has-feature "Control Groups")}}
   <PageHeader as |p|>
diff --git a/ui/app/templates/vault/cluster/access/control-groups.hbs b/ui/app/templates/vault/cluster/access/control-groups.hbs
index 595cf877416..d3dfb08e0c5 100644
--- a/ui/app/templates/vault/cluster/access/control-groups.hbs
+++ b/ui/app/templates/vault/cluster/access/control-groups.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (has-feature "Control Groups")}}
   <PageHeader as |p|>
diff --git a/ui/app/templates/vault/cluster/access/error.hbs b/ui/app/templates/vault/cluster/access/error.hbs
index d1105447ca1..d3358f5c4ff 100644
--- a/ui/app/templates/vault/cluster/access/error.hbs
+++ b/ui/app/templates/vault/cluster/access/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (eq this.model.httpStatus 404)}}
   <NotFound @model={{this.model}} />
diff --git a/ui/app/templates/vault/cluster/access/identity/aliases/add.hbs b/ui/app/templates/vault/cluster/access/identity/aliases/add.hbs
index da5a403fa59..d0f795722d4 100644
--- a/ui/app/templates/vault/cluster/access/identity/aliases/add.hbs
+++ b/ui/app/templates/vault/cluster/access/identity/aliases/add.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/identity/aliases/edit.hbs b/ui/app/templates/vault/cluster/access/identity/aliases/edit.hbs
index 0ab8d427c36..230b513ef43 100644
--- a/ui/app/templates/vault/cluster/access/identity/aliases/edit.hbs
+++ b/ui/app/templates/vault/cluster/access/identity/aliases/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/identity/aliases/index.hbs b/ui/app/templates/vault/cluster/access/identity/aliases/index.hbs
index 6dca7b8eafd..f791663cd74 100644
--- a/ui/app/templates/vault/cluster/access/identity/aliases/index.hbs
+++ b/ui/app/templates/vault/cluster/access/identity/aliases/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Identity::EntityNav @identityType={{this.identityType}} @model={{this.model}} />
 {{#if this.model.meta.total}}
@@ -25,7 +25,7 @@
           <div class="has-text-grey">
             {{item.id}}
           </div>
-          <span class="tag">{{item.mountType}}</span>
+          <Hds::Badge @text={{item.mountType}} class="has-right-margin-8" />
           <span class="has-text-grey is-size-8">
             {{item.mountAccessor}}
           </span>
diff --git a/ui/app/templates/vault/cluster/access/identity/aliases/show.hbs b/ui/app/templates/vault/cluster/access/identity/aliases/show.hbs
index 0fb63e99fb0..3c9161c5675 100644
--- a/ui/app/templates/vault/cluster/access/identity/aliases/show.hbs
+++ b/ui/app/templates/vault/cluster/access/identity/aliases/show.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/templates/vault/cluster/access/identity/create.hbs b/ui/app/templates/vault/cluster/access/identity/create.hbs
index 75b15043a0c..b326ffee9e2 100644
--- a/ui/app/templates/vault/cluster/access/identity/create.hbs
+++ b/ui/app/templates/vault/cluster/access/identity/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/identity/edit.hbs b/ui/app/templates/vault/cluster/access/identity/edit.hbs
index 0ab8d427c36..230b513ef43 100644
--- a/ui/app/templates/vault/cluster/access/identity/edit.hbs
+++ b/ui/app/templates/vault/cluster/access/identity/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/identity/index.hbs b/ui/app/templates/vault/cluster/access/identity/index.hbs
index de21aa26f66..bd7418f51c7 100644
--- a/ui/app/templates/vault/cluster/access/identity/index.hbs
+++ b/ui/app/templates/vault/cluster/access/identity/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Identity::EntityNav @identityType={{this.identityType}} @model={{this.model}} />
 {{#if this.model.meta.total}}
@@ -41,10 +41,9 @@
               data-test-popup-menu-trigger
             />
             <dd.Interactive
-              @text="Details"
               @route="vault.cluster.access.identity.show"
               @models={{array item.id "details"}}
-            />
+            >Details</dd.Interactive>
             {{#if (or item.isReloading item.updatePath.isPending item.aliasPath.isPending)}}
               <dd.Generic class="has-text-center">
                 <LoadingDropdownOption />
@@ -55,27 +54,28 @@
                 {{#if (or (eq this.identityType "entity") (and (eq item.type "external") (not item.alias)))}}
                   <dd.Interactive
                     data-test-popup-menu="create alias"
-                    @text="Create alias"
                     @route="vault.cluster.access.identity.aliases.add"
                     @models={{array (pluralize this.identityType) item.id}}
-                  />
+                  >Create alias</dd.Interactive>
                 {{/if}}
               {{/if}}
               {{#if item.canEdit}}
-                <dd.Interactive @text="Edit" @route="vault.cluster.access.identity.edit" @model={{item.id}} />
+                <dd.Interactive @route="vault.cluster.access.identity.edit" @model={{item.id}}>Edit</dd.Interactive>
                 {{#if item.disabled}}
-                  <dd.Interactive @text="Enable" {{on "click" (action "toggleDisabled" item)}} />
+                  <dd.Interactive {{on "click" (action "toggleDisabled" item)}}>Enable</dd.Interactive>
                 {{else if (eq this.identityType "entity")}}
-                  <dd.Interactive @text="Disable" @color="critical" {{on "click" (fn (mut this.entityToDisable) item)}} />
+                  <dd.Interactive
+                    @color="critical"
+                    {{on "click" (fn (mut this.entityToDisable) item)}}
+                  >Disable</dd.Interactive>
                 {{/if}}
               {{/if}}
               {{#if item.canDelete}}
                 <dd.Interactive
-                  @text="Delete"
                   @color="critical"
                   {{on "click" (fn (mut this.itemToDelete) item)}}
                   data-test-popup-menu="delete"
-                />
+                >Delete</dd.Interactive>
               {{/if}}
             {{/if}}
           </Hds::Dropdown>
@@ -88,6 +88,8 @@
     @currentPage={{this.model.meta.currentPage}}
     @currentPageSize={{this.model.meta.pageSize}}
     @route="vault.cluster.access.identity.index"
+    {{! The identity routes expect the dynamic URL segment for identity/:item_type to be plural }}
+    @model={{pluralize this.identityType}}
     @showSizeSelector={{false}}
     @totalItems={{this.model.meta.total}}
     @queryFunction={{this.paginationQueryParams}}
diff --git a/ui/app/templates/vault/cluster/access/identity/merge.hbs b/ui/app/templates/vault/cluster/access/identity/merge.hbs
index 3a15fc4ca0b..76eb1c5ab9c 100644
--- a/ui/app/templates/vault/cluster/access/identity/merge.hbs
+++ b/ui/app/templates/vault/cluster/access/identity/merge.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/identity/show.hbs b/ui/app/templates/vault/cluster/access/identity/show.hbs
index b6512f29b79..c031fcc77ec 100644
--- a/ui/app/templates/vault/cluster/access/identity/show.hbs
+++ b/ui/app/templates/vault/cluster/access/identity/show.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -58,4 +58,5 @@
     </ToolbarLink>
   </ToolbarActions>
 </Toolbar>
+{{! renders either the identity item-aliases or item-groups component}}
 {{component (concat "identity/item-" this.section) model=this.model}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/access/leases/error.hbs b/ui/app/templates/vault/cluster/access/leases/error.hbs
index 20aa34b8122..ecbae7bb3e6 100644
--- a/ui/app/templates/vault/cluster/access/leases/error.hbs
+++ b/ui/app/templates/vault/cluster/access/leases/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/leases/index.hbs b/ui/app/templates/vault/cluster/access/leases/index.hbs
index b5ff61e3975..265a6b0e5df 100644
--- a/ui/app/templates/vault/cluster/access/leases/index.hbs
+++ b/ui/app/templates/vault/cluster/access/leases/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/leases/list.hbs b/ui/app/templates/vault/cluster/access/leases/list.hbs
index c6782dc7951..f3493aa1297 100644
--- a/ui/app/templates/vault/cluster/access/leases/list.hbs
+++ b/ui/app/templates/vault/cluster/access/leases/list.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/templates/vault/cluster/access/leases/show.hbs b/ui/app/templates/vault/cluster/access/leases/show.hbs
index 1ba69117015..bc82b3b4984 100644
--- a/ui/app/templates/vault/cluster/access/leases/show.hbs
+++ b/ui/app/templates/vault/cluster/access/leases/show.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/templates/vault/cluster/access/loading.hbs b/ui/app/templates/vault/cluster/access/loading.hbs
index 45dfe248ba7..35426b00d56 100644
--- a/ui/app/templates/vault/cluster/access/loading.hbs
+++ b/ui/app/templates/vault/cluster/access/loading.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LayoutLoading />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/access/method/item/create.hbs b/ui/app/templates/vault/cluster/access/method/item/create.hbs
index ad47470ca4d..a5c31616f93 100644
--- a/ui/app/templates/vault/cluster/access/method/item/create.hbs
+++ b/ui/app/templates/vault/cluster/access/method/item/create.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<GeneratedItem @model={{this.model}} @mode="create" @itemType={{this.model.itemType}} />
\ No newline at end of file
+<GeneratedItem @mountPath={{this.method}} @model={{this.model}} @mode="create" @itemType={{this.model.itemType}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/access/method/item/edit.hbs b/ui/app/templates/vault/cluster/access/method/item/edit.hbs
index 202836e61f7..b5b704dfde6 100644
--- a/ui/app/templates/vault/cluster/access/method/item/edit.hbs
+++ b/ui/app/templates/vault/cluster/access/method/item/edit.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<GeneratedItem @model={{this.model}} @mode="edit" @itemType={{this.itemType}} />
\ No newline at end of file
+<GeneratedItem @mountPath={{this.method}} @model={{this.model}} @mode="edit" @itemType={{this.itemType}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/access/method/item/list.hbs b/ui/app/templates/vault/cluster/access/method/item/list.hbs
index 6b5a125ed2b..11eafb422c8 100644
--- a/ui/app/templates/vault/cluster/access/method/item/list.hbs
+++ b/ui/app/templates/vault/cluster/access/method/item/list.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <GeneratedItemList
   @model={{this.model}}
diff --git a/ui/app/templates/vault/cluster/access/method/item/show.hbs b/ui/app/templates/vault/cluster/access/method/item/show.hbs
index 61970507781..8be68f2512d 100644
--- a/ui/app/templates/vault/cluster/access/method/item/show.hbs
+++ b/ui/app/templates/vault/cluster/access/method/item/show.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<GeneratedItem @model={{this.model}} @itemType={{this.itemType}} @mode="show" />
\ No newline at end of file
+<GeneratedItem @mountPath={{this.method}} @model={{this.model}} @itemType={{this.itemType}} @mode="show" />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/access/method/section.hbs b/ui/app/templates/vault/cluster/access/method/section.hbs
index 19d69e4c5b4..db2c6ff09b8 100644
--- a/ui/app/templates/vault/cluster/access/method/section.hbs
+++ b/ui/app/templates/vault/cluster/access/method/section.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -18,14 +18,14 @@
 </PageHeader>
 
 {{#if (not (includes this.model.type (supported-managed-auth-backends)))}}
-  <div class="has-text-grey has-top-bottom-margin" data-test-doc-link>
+  <div class="has-text-grey has-top-bottom-margin" data-test-doc-link={{this.model.id}}>
     The Vault UI only supports configuration for this authentication method. For management, the
     <DocLink @path="/vault/api-docs">API or CLI</DocLink>
     should be used.
   </div>
 {{/if}}
 
-{{section-tabs this.model "authShow" this.paths}}
+<SectionTabs @model={{this.model}} @tabType="authShow" @paths={{this.paths}} />
 
 {{#if (eq this.section "configuration")}}
   <Toolbar>
@@ -36,4 +36,4 @@
     </ToolbarActions>
   </Toolbar>
 {{/if}}
-{{component (concat "auth-method/" this.section) model=this.model}}
\ No newline at end of file
+{{component (concat "auth-method/" this.section) method=this.model}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/access/methods.hbs b/ui/app/templates/vault/cluster/access/methods.hbs
index f25bc537385..2867ae5de37 100644
--- a/ui/app/templates/vault/cluster/access/methods.hbs
+++ b/ui/app/templates/vault/cluster/access/methods.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
@@ -46,19 +46,23 @@
   </ToolbarActions>
 </Toolbar>
 
-{{#each (sort-by "path" this.authMethodList) as |method|}}
+{{#each (this.sortMethods this.authMethodList) as |method|}}
   <LinkedBlock
     @params={{array "vault.cluster.access.method" method.id}}
     class="list-item-row"
-    data-test-auth-backend-link={{method.id}}
+    data-test-linked-block={{or method.id method.accessor}}
   >
     <div class="level is-mobile">
-      <div class="level-left">
-        <div>
-          <Hds::TooltipButton @text={{method.methodType}} aria-label="Type of auth mount">
+      <div>
+        <div class="is-grid align-items-center linked-block-title">
+          <Hds::TooltipButton
+            @text={{method.methodType}}
+            aria-label="Type of auth mount"
+            data-test-button={{method.methodType}}
+          >
             <Icon @name={{method.icon}} class="has-text-grey-light" />
           </Hds::TooltipButton>
-          <span data-test-path data-test-id={{method.id}} class="has-text-weight-semibold has-text-black">
+          <span class="has-text-weight-semibold has-text-black overflow-wrap">
             {{method.path}}
           </span>
           <br />
@@ -76,26 +80,43 @@
               @hasChevron={{false}}
               data-test-popup-menu-trigger
             />
-            <dd.Interactive
-              @text="View configuration"
-              @route="vault.cluster.access.method.section"
-              @models={{array method.id "configuration"}}
-            />
-            {{#if (or method.canEdit (and (eq method.methodType "aws") method.canEditAws))}}
-              <dd.Interactive
-                @text="Edit configuration"
-                @route="vault.cluster.settings.auth.configure"
-                @model={{method.id}}
-              />
+            <dd.Interactive @route="vault.cluster.access.method.section" @models={{array method.id "configuration"}}>
+              View configuration
+            </dd.Interactive>
+            {{#if
+              (or
+                (has-capability this.model.capabilities "update" pathKey="authMethodConfig" params=method.id)
+                (and
+                  (eq method.methodType "aws")
+                  (has-capability this.model.capabilities "update" pathKey="authMethodConfigAws" params=method.id)
+                )
+              )
+            }}
+              <dd.Interactive @route="vault.cluster.settings.auth.configure" @model={{method.id}}>
+                Edit configuration
+              </dd.Interactive>
             {{/if}}
-            {{#if (and (not-eq method.methodType "token") method.canDisable)}}
-              <dd.Interactive @text="Disable" @color="critical" {{on "click" (fn (mut this.methodToDisable) method)}} />
+            {{#if
+              (and
+                (not-eq method.methodType "token")
+                (has-capability this.model.capabilities "delete" pathKey="authMethodDelete" params=method.id)
+              )
+            }}
+              <dd.Interactive
+                @color="critical"
+                {{on "click" (fn (mut this.methodToDisable) method)}}
+                data-test-button="Disable auth method"
+              >
+                Disable
+              </dd.Interactive>
             {{/if}}
           </Hds::Dropdown>
         </div>
       </div>
     </div>
   </LinkedBlock>
+{{else}}
+  <EmptyState @title="No Authentication Methods found" />
 {{/each}}
 
 {{#if this.methodToDisable}}
diff --git a/ui/app/templates/vault/cluster/access/mfa/enforcements/create.hbs b/ui/app/templates/vault/cluster/access/mfa/enforcements/create.hbs
index be5ce04d864..6e9ecc0ce76 100644
--- a/ui/app/templates/vault/cluster/access/mfa/enforcements/create.hbs
+++ b/ui/app/templates/vault/cluster/access/mfa/enforcements/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Mfa::MfaLoginEnforcementHeader @heading="New enforcement" />
 <Mfa::MfaLoginEnforcementForm
diff --git a/ui/app/templates/vault/cluster/access/mfa/enforcements/enforcement/edit.hbs b/ui/app/templates/vault/cluster/access/mfa/enforcements/enforcement/edit.hbs
index d0e782e7b34..97b371ccf77 100644
--- a/ui/app/templates/vault/cluster/access/mfa/enforcements/enforcement/edit.hbs
+++ b/ui/app/templates/vault/cluster/access/mfa/enforcements/enforcement/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Mfa::MfaLoginEnforcementHeader @heading="Update enforcement" />
 <Mfa::MfaLoginEnforcementForm
diff --git a/ui/app/templates/vault/cluster/access/mfa/enforcements/enforcement/index.hbs b/ui/app/templates/vault/cluster/access/mfa/enforcements/enforcement/index.hbs
index f84bd9eb986..ea75b0f5816 100644
--- a/ui/app/templates/vault/cluster/access/mfa/enforcements/enforcement/index.hbs
+++ b/ui/app/templates/vault/cluster/access/mfa/enforcements/enforcement/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -24,6 +24,7 @@
         @route="vault.cluster.access.mfa.enforcements.enforcement"
         @query={{hash tab="targets"}}
         data-test-tab="targets"
+        @model={{this.model}}
       >
         Targets
       </LinkTo>
@@ -31,6 +32,7 @@
         @route="vault.cluster.access.mfa.enforcements.enforcement"
         @query={{hash tab="methods"}}
         data-test-tab="methods"
+        @model={{this.model}}
       >
         Methods
       </LinkTo>
@@ -91,11 +93,10 @@
                     data-test-popup-menu-trigger
                   />
                   <dd.Interactive
-                    @text="Details"
                     @route={{target.link}}
                     @models={{target.linkModels}}
                     data-test-target-link={{target.title}}
-                  />
+                  >Details</dd.Interactive>
                 </Hds::Dropdown>
               </div>
             </div>
diff --git a/ui/app/templates/vault/cluster/access/mfa/enforcements/index.hbs b/ui/app/templates/vault/cluster/access/mfa/enforcements/index.hbs
index c2a92d331e8..dce112f105c 100644
--- a/ui/app/templates/vault/cluster/access/mfa/enforcements/index.hbs
+++ b/ui/app/templates/vault/cluster/access/mfa/enforcements/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/mfa/index.hbs b/ui/app/templates/vault/cluster/access/mfa/index.hbs
index 6cd137eb386..dc9abb78586 100644
--- a/ui/app/templates/vault/cluster/access/mfa/index.hbs
+++ b/ui/app/templates/vault/cluster/access/mfa/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/mfa/methods/create.hbs b/ui/app/templates/vault/cluster/access/mfa/methods/create.hbs
index 18288f850f6..917abeec56f 100644
--- a/ui/app/templates/vault/cluster/access/mfa/methods/create.hbs
+++ b/ui/app/templates/vault/cluster/access/mfa/methods/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/templates/vault/cluster/access/mfa/methods/index.hbs b/ui/app/templates/vault/cluster/access/mfa/methods/index.hbs
index ff1f170cb1c..391cce0f823 100644
--- a/ui/app/templates/vault/cluster/access/mfa/methods/index.hbs
+++ b/ui/app/templates/vault/cluster/access/mfa/methods/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/mfa/methods/method/edit.hbs b/ui/app/templates/vault/cluster/access/mfa/methods/method/edit.hbs
index 698e5a88bda..d24b7a2427a 100644
--- a/ui/app/templates/vault/cluster/access/mfa/methods/method/edit.hbs
+++ b/ui/app/templates/vault/cluster/access/mfa/methods/method/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/mfa/methods/method/index.hbs b/ui/app/templates/vault/cluster/access/mfa/methods/method/index.hbs
index e4eade33632..82bd21e0fe3 100644
--- a/ui/app/templates/vault/cluster/access/mfa/methods/method/index.hbs
+++ b/ui/app/templates/vault/cluster/access/mfa/methods/method/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -21,11 +21,17 @@
 <div class="tabs-container box is-sideless is-fullwidth is-paddingless is-marginless">
   <nav class="tabs" aria-label="tabs">
     <ul>
-      <LinkTo @route="vault.cluster.access.mfa.methods.method" @query={{hash tab="config"}} data-test-tab="config">
+      <LinkTo
+        @route="vault.cluster.access.mfa.methods.method"
+        @model={{this.model.method.id}}
+        @query={{hash tab="config"}}
+        data-test-tab="config"
+      >
         Configuration
       </LinkTo>
       <LinkTo
         @route="vault.cluster.access.mfa.methods.method"
+        @model={{this.model.method.id}}
         @query={{hash tab="enforcements"}}
         data-test-tab="enforcements"
       >
@@ -60,6 +66,7 @@
     </ToolbarActions>
   </Toolbar>
   <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
+    <InfoTableRow @label="ID" @value={{this.model.method.id}} @addCopyButton={{true}} />
     {{#each this.model.method.attrs as |attr|}}
       {{#if (eq attr.type "object")}}
         <InfoTableRow
@@ -72,6 +79,8 @@
           @alwaysRender={{not (is-empty-value (get this.model.method attr.name))}}
           @label={{or attr.options.label (to-label attr.name)}}
           @value={{get this.model.method attr.name}}
+          @formatTtl={{eq attr.options.editType "ttl"}}
+          @helperText={{attr.options.helperText}}
         />
       {{/if}}
     {{/each}}
diff --git a/ui/app/templates/vault/cluster/access/namespaces.hbs b/ui/app/templates/vault/cluster/access/namespaces.hbs
index 11a06fba008..f6eb0207f6a 100644
--- a/ui/app/templates/vault/cluster/access/namespaces.hbs
+++ b/ui/app/templates/vault/cluster/access/namespaces.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{outlet}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/access/namespaces/create.hbs b/ui/app/templates/vault/cluster/access/namespaces/create.hbs
index 7281f4c5d4e..8c8d09ab9eb 100644
--- a/ui/app/templates/vault/cluster/access/namespaces/create.hbs
+++ b/ui/app/templates/vault/cluster/access/namespaces/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (has-feature "Namespaces")}}
   <PageHeader as |p|>
diff --git a/ui/app/templates/vault/cluster/access/namespaces/index.hbs b/ui/app/templates/vault/cluster/access/namespaces/index.hbs
index 169753405e2..cec9aa11760 100644
--- a/ui/app/templates/vault/cluster/access/namespaces/index.hbs
+++ b/ui/app/templates/vault/cluster/access/namespaces/index.hbs
@@ -1,35 +1,56 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (has-feature "Namespaces")}}
   <PageHeader as |p|>
+    <p.top>
+      <Hds::Breadcrumb data-test-breadcrumbs>
+        <Hds::Breadcrumb::Item @text="Namespaces" @current={{true}} />
+      </Hds::Breadcrumb>
+    </p.top>
+
     <p.levelLeft>
-      <h1 class="title is-3">
+      <h1 class="title is-3" data-test-page-title>
         Namespaces
       </h1>
     </p.levelLeft>
   </PageHeader>
 
   <Toolbar>
+    <ToolbarFilters>
+      <FilterInputExplicit
+        @query={{this.pageFilter}}
+        @placeholder="Search"
+        @handleSearch={{this.handleSearch}}
+        @handleInput={{this.handleInput}}
+        @handleKeyDown={{this.handleKeyDown}}
+      />
+    </ToolbarFilters>
     <ToolbarActions>
-      <ToolbarLink @route="vault.cluster.access.namespaces.create" @type="add">
+      <Hds::Button
+        class="has-right-margin-4"
+        @color="secondary"
+        @icon="reload"
+        @iconPosition="trailing"
+        @text="Refresh list"
+        {{on "click" this.refreshNamespaceList}}
+        data-test-button="refresh-namespace-list"
+      />
+      <ToolbarLink @route="vault.cluster.access.namespaces.create" @type="add" data-test-link-to="create-namespace">
         Create namespace
       </ToolbarLink>
     </ToolbarActions>
   </Toolbar>
 
-  <ListView @items={{this.model}} @itemNoun="namespace" @paginationRouteName="vault.cluster.access.namespaces" as |list|>
-    {{#if list.empty}}
-      <list.empty>
-        <Hds::Link::Standalone
-          @icon="learn-link"
-          @text="Secure multi-tenancy with namespaces tutorial"
-          @href={{doc-link "/vault/tutorials/enterprise/namespaces"}}
-        />
-      </list.empty>
-    {{else}}
+  <ListView
+    @items={{this.model.namespaces}}
+    @itemNoun="namespace"
+    @paginationRouteName="vault.cluster.access.namespaces"
+    as |list|
+  >
+    {{#if this.model.namespaces.length}}
       <ListItem as |Item|>
         <Item.content>
           {{list.item.id}}
@@ -37,37 +58,40 @@
         <Item.menu>
           <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
             <dd.ToggleIcon @icon="more-horizontal" @text="More options" @hasChevron={{false}} data-test-popup-menu-trigger />
-            {{#let (concat this.currentNamespace (if this.currentNamespace "/") list.item.id) as |targetNamespace|}}
-              {{#if (includes targetNamespace this.accessibleNamespaces)}}
-                <dd.Generic>
-                  <NamespaceLink @targetNamespace={{targetNamespace}} @unparsed={{true}} @class="ns-dropdown-item">
-                    Switch to Namespace
-                  </NamespaceLink>
-                </dd.Generic>
+            {{#let
+              (concat this.namespaceService.path (if this.namespaceService.path "/") list.item.id)
+              as |targetNamespace|
+            }}
+              {{#if (includes targetNamespace this.namespaceService.accessibleNamespaces)}}
+                <dd.Interactive {{on "click" (fn this.switchNamespace targetNamespace)}} data-test-popup-menu="switch">Switch
+                  to namespace</dd.Interactive>
               {{/if}}
             {{/let}}
-            <dd.Interactive @text="Delete" @color="critical" {{on "click" (fn (mut this.nsToDelete) list.item)}} />
+            <dd.Interactive
+              @color="critical"
+              {{on "click" (fn (mut this.nsToDelete) list.item)}}
+              data-test-popup-menu="delete"
+            >Delete</dd.Interactive>
           </Hds::Dropdown>
           {{#if (eq this.nsToDelete list.item)}}
             <ConfirmModal
               @color="critical"
               @onClose={{fn (mut this.nsToDelete) null}}
-              @onConfirm={{action
-                (perform
-                  Item.callMethod
-                  "destroyRecord"
-                  this.nsToDelete
-                  (concat "Successfully deleted namespace: " this.nsToDelete.id)
-                  "There was an error deleting this namespace: "
-                  (action "refreshNamespaceList")
-                )
-              }}
+              @onConfirm={{fn this.deleteNamespace list.item}}
               @confirmTitle="Delete this namespace?"
               @confirmMessage="Any engines or mounts in this namespace will also be removed."
             />
           {{/if}}
         </Item.menu>
       </ListItem>
+    {{else}}
+      <list.empty>
+        <Hds::Link::Standalone
+          @icon="learn-link"
+          @text="Secure multi-tenancy with namespaces tutorial"
+          @href={{doc-link "/vault/tutorials/enterprise/namespaces"}}
+        />
+      </list.empty>
     {{/if}}
   </ListView>
 {{else}}
diff --git a/ui/app/templates/vault/cluster/access/oidc.hbs b/ui/app/templates/vault/cluster/access/oidc.hbs
index aa6bf7ccbf6..46c875aced2 100644
--- a/ui/app/templates/vault/cluster/access/oidc.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.header}}
   <PageHeader as |p|>
diff --git a/ui/app/templates/vault/cluster/access/oidc/assignments/assignment/details.hbs b/ui/app/templates/vault/cluster/access/oidc/assignments/assignment/details.hbs
index 4630547ddb6..8e97f2b2a33 100644
--- a/ui/app/templates/vault/cluster/access/oidc/assignments/assignment/details.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/assignments/assignment/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/templates/vault/cluster/access/oidc/assignments/assignment/edit.hbs b/ui/app/templates/vault/cluster/access/oidc/assignments/assignment/edit.hbs
index 78b6c3a31e3..24b03485e23 100644
--- a/ui/app/templates/vault/cluster/access/oidc/assignments/assignment/edit.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/assignments/assignment/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/templates/vault/cluster/access/oidc/assignments/create.hbs b/ui/app/templates/vault/cluster/access/oidc/assignments/create.hbs
index 70ba32d8c1c..92c58300767 100644
--- a/ui/app/templates/vault/cluster/access/oidc/assignments/create.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/assignments/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/templates/vault/cluster/access/oidc/assignments/index.hbs b/ui/app/templates/vault/cluster/access/oidc/assignments/index.hbs
index 25f46ddbb02..b400ca4207e 100644
--- a/ui/app/templates/vault/cluster/access/oidc/assignments/index.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/assignments/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
@@ -46,19 +46,17 @@
                 data-test-popup-menu-trigger
               />
               <dd.Interactive
-                @text="Details"
                 @route="vault.cluster.access.oidc.assignments.assignment.details"
                 @model={{model.name}}
                 @disabled={{eq model.canRead false}}
                 data-test-oidc-assignment-menu-link="details"
-              />
+              >Details</dd.Interactive>
               <dd.Interactive
-                @text="Edit"
                 @route="vault.cluster.access.oidc.assignments.assignment.edit"
                 @model={{model.name}}
                 @disabled={{eq model.canEdit false}}
                 data-test-oidc-assignment-menu-link="edit"
-              />
+              >Edit</dd.Interactive>
             </Hds::Dropdown>
           </div>
         </div>
diff --git a/ui/app/templates/vault/cluster/access/oidc/clients/client.hbs b/ui/app/templates/vault/cluster/access/oidc/clients/client.hbs
index 54649339786..8680df85cad 100644
--- a/ui/app/templates/vault/cluster/access/oidc/clients/client.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/clients/client.hbs
@@ -1,9 +1,9 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-{{#if this.showHeader}}
+{{#if (not-eq this.router.currentRoute.localName "edit")}}
   <PageHeader as |p|>
     <p.top>
       <Hds::Breadcrumb>
diff --git a/ui/app/templates/vault/cluster/access/oidc/clients/client/details.hbs b/ui/app/templates/vault/cluster/access/oidc/clients/client/details.hbs
index 5452016f079..fc688946921 100644
--- a/ui/app/templates/vault/cluster/access/oidc/clients/client/details.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/clients/client/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar data-test-oidc-client-toolbar>
   <ToolbarActions>
diff --git a/ui/app/templates/vault/cluster/access/oidc/clients/client/edit.hbs b/ui/app/templates/vault/cluster/access/oidc/clients/client/edit.hbs
index fcd25e503ad..613f6185ab7 100644
--- a/ui/app/templates/vault/cluster/access/oidc/clients/client/edit.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/clients/client/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Oidc::ClientForm
   @model={{this.model}}
diff --git a/ui/app/templates/vault/cluster/access/oidc/clients/client/providers.hbs b/ui/app/templates/vault/cluster/access/oidc/clients/client/providers.hbs
index 6d66509073e..acd314cd7c6 100644
--- a/ui/app/templates/vault/cluster/access/oidc/clients/client/providers.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/clients/client/providers.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar />
 {{#if (gt this.model.length 0)}}
diff --git a/ui/app/templates/vault/cluster/access/oidc/clients/create.hbs b/ui/app/templates/vault/cluster/access/oidc/clients/create.hbs
index 6c01a07ec84..bcb38d83668 100644
--- a/ui/app/templates/vault/cluster/access/oidc/clients/create.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/clients/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Oidc::ClientForm
   @model={{this.model}}
diff --git a/ui/app/templates/vault/cluster/access/oidc/clients/index.hbs b/ui/app/templates/vault/cluster/access/oidc/clients/index.hbs
index f46ac0b03ac..0a50d939fcf 100644
--- a/ui/app/templates/vault/cluster/access/oidc/clients/index.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/clients/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
diff --git a/ui/app/templates/vault/cluster/access/oidc/index.hbs b/ui/app/templates/vault/cluster/access/oidc/index.hbs
index d75eca8fee6..fdc798d7b5c 100644
--- a/ui/app/templates/vault/cluster/access/oidc/index.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-fullwidth is-shadowless" data-test-oidc-landing>
   <p>
@@ -15,5 +15,9 @@
 </div>
 
 <div class="box is-fullwidth is-shadowless">
-  <img data-test-oidc-img src={{img-path "~/oidc-landing.png"}} alt="OIDC configure diagram" />
+  <img
+    data-test-oidc-img
+    src={{img-path "~/oidc-landing.png"}}
+    alt="Example flow of a user logging in to an application, which redirects them to the Vault U-I for authentication. Vault displays an auth method selection form and forwards the user to an upstream identity provider (like A-W-S, Okta, or Microsoft) for final credential verification."
+  />
 </div>
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/access/oidc/keys/create.hbs b/ui/app/templates/vault/cluster/access/oidc/keys/create.hbs
index 0349862a518..15a41c2460c 100644
--- a/ui/app/templates/vault/cluster/access/oidc/keys/create.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/keys/create.hbs
@@ -1,7 +1,21 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
+
+<PageHeader as |p|>
+  <p.top>
+    <Hds::Breadcrumb>
+      <Hds::Breadcrumb::Item @text="Keys" @route="vault.cluster.access.oidc.keys" />
+      <Hds::Breadcrumb::Item @text="Create Key" @current={{true}} />
+    </Hds::Breadcrumb>
+  </p.top>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      Create Key
+    </h1>
+  </p.levelLeft>
+</PageHeader>
 
 <Oidc::KeyForm
   @model={{this.model}}
diff --git a/ui/app/templates/vault/cluster/access/oidc/keys/index.hbs b/ui/app/templates/vault/cluster/access/oidc/keys/index.hbs
index 2995b2cb534..74541c31a92 100644
--- a/ui/app/templates/vault/cluster/access/oidc/keys/index.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/keys/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
@@ -21,7 +21,7 @@
       <div class="level-left">
         <div>
           <Icon @name="key" class="has-text-grey-light" />
-          <span class="has-text-weight-semibold is-underline">
+          <span class="has-text-weight-semibold is-underline" data-test-item>
             {{model.name}}
           </span>
         </div>
@@ -36,19 +36,17 @@
               data-test-popup-menu-trigger
             />
             <dd.Interactive
-              @text="Details"
               @route="vault.cluster.access.oidc.keys.key.details"
               @model={{model.name}}
               @disabled={{eq model.canRead false}}
               data-test-oidc-key-menu-link="details"
-            />
+            >Details</dd.Interactive>
             <dd.Interactive
-              @text="Edit"
               @route="vault.cluster.access.oidc.keys.key.edit"
               @model={{model.name}}
               @disabled={{eq model.canEdit false}}
               data-test-oidc-key-menu-link="edit"
-            />
+            >Edit</dd.Interactive>
           </Hds::Dropdown>
         </div>
       </div>
diff --git a/ui/app/templates/vault/cluster/access/oidc/keys/key.hbs b/ui/app/templates/vault/cluster/access/oidc/keys/key.hbs
index 8ed90248a7e..9e755289cb1 100644
--- a/ui/app/templates/vault/cluster/access/oidc/keys/key.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/keys/key.hbs
@@ -1,9 +1,9 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-{{#if this.showHeader}}
+{{#if (not-eq this.router.currentRoute.localName "edit")}}
   <PageHeader as |p|>
     <p.top>
       <Hds::Breadcrumb>
diff --git a/ui/app/templates/vault/cluster/access/oidc/keys/key/clients.hbs b/ui/app/templates/vault/cluster/access/oidc/keys/key/clients.hbs
index cbd487067cd..ac065a37a19 100644
--- a/ui/app/templates/vault/cluster/access/oidc/keys/key/clients.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/keys/key/clients.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar />
 
diff --git a/ui/app/templates/vault/cluster/access/oidc/keys/key/details.hbs b/ui/app/templates/vault/cluster/access/oidc/keys/key/details.hbs
index f96ea192c59..54cb9ae0162 100644
--- a/ui/app/templates/vault/cluster/access/oidc/keys/key/details.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/keys/key/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
diff --git a/ui/app/templates/vault/cluster/access/oidc/keys/key/edit.hbs b/ui/app/templates/vault/cluster/access/oidc/keys/key/edit.hbs
index ab8ea6c6d87..640acdca1fe 100644
--- a/ui/app/templates/vault/cluster/access/oidc/keys/key/edit.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/keys/key/edit.hbs
@@ -1,7 +1,26 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
+
+<PageHeader as |p|>
+  <p.top>
+    <Hds::Breadcrumb>
+      <Hds::Breadcrumb::Item @text="Keys" @route="vault.cluster.access.oidc.keys" />
+      <Hds::Breadcrumb::Item
+        @text="Details"
+        @route="vault.cluster.access.oidc.keys.key.details"
+        @model={{this.model.name}}
+      />
+      <Hds::Breadcrumb::Item @text="Edit Key" @current={{true}} />
+    </Hds::Breadcrumb>
+  </p.top>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      Edit Key
+    </h1>
+  </p.levelLeft>
+</PageHeader>
 
 <Oidc::KeyForm
   @model={{this.model}}
diff --git a/ui/app/templates/vault/cluster/access/oidc/providers/create.hbs b/ui/app/templates/vault/cluster/access/oidc/providers/create.hbs
index 3d3b0b106d0..d4415aa8e7b 100644
--- a/ui/app/templates/vault/cluster/access/oidc/providers/create.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/providers/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Oidc::ProviderForm
   @model={{this.model}}
diff --git a/ui/app/templates/vault/cluster/access/oidc/providers/index.hbs b/ui/app/templates/vault/cluster/access/oidc/providers/index.hbs
index ab67254fd2c..c28f3e32d59 100644
--- a/ui/app/templates/vault/cluster/access/oidc/providers/index.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/providers/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
diff --git a/ui/app/templates/vault/cluster/access/oidc/providers/provider.hbs b/ui/app/templates/vault/cluster/access/oidc/providers/provider.hbs
index abdcb1235cc..5c387534a2a 100644
--- a/ui/app/templates/vault/cluster/access/oidc/providers/provider.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/providers/provider.hbs
@@ -1,9 +1,9 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-{{#if this.showHeader}}
+{{#if (not-eq this.router.currentRoute.localName "edit")}}
   <PageHeader as |p|>
     <p.top>
       <Hds::Breadcrumb>
diff --git a/ui/app/templates/vault/cluster/access/oidc/providers/provider/clients.hbs b/ui/app/templates/vault/cluster/access/oidc/providers/provider/clients.hbs
index 5eb3faeb5af..38c3be19b05 100644
--- a/ui/app/templates/vault/cluster/access/oidc/providers/provider/clients.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/providers/provider/clients.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar />
 
diff --git a/ui/app/templates/vault/cluster/access/oidc/providers/provider/details.hbs b/ui/app/templates/vault/cluster/access/oidc/providers/provider/details.hbs
index 56d9e2462a3..3ecd49862cc 100644
--- a/ui/app/templates/vault/cluster/access/oidc/providers/provider/details.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/providers/provider/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
diff --git a/ui/app/templates/vault/cluster/access/oidc/providers/provider/edit.hbs b/ui/app/templates/vault/cluster/access/oidc/providers/provider/edit.hbs
index 8c71944ba75..db6450827ae 100644
--- a/ui/app/templates/vault/cluster/access/oidc/providers/provider/edit.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/providers/provider/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Oidc::ProviderForm
   @model={{this.model}}
diff --git a/ui/app/templates/vault/cluster/access/oidc/scopes/create.hbs b/ui/app/templates/vault/cluster/access/oidc/scopes/create.hbs
index ba9b386167e..b278e52e8ef 100644
--- a/ui/app/templates/vault/cluster/access/oidc/scopes/create.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/scopes/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Oidc::ScopeForm
   @model={{this.model}}
diff --git a/ui/app/templates/vault/cluster/access/oidc/scopes/index.hbs b/ui/app/templates/vault/cluster/access/oidc/scopes/index.hbs
index 0747bde8397..8ecacc4207d 100644
--- a/ui/app/templates/vault/cluster/access/oidc/scopes/index.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/scopes/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
@@ -37,19 +37,17 @@
                 data-test-popup-menu-trigger
               />
               <dd.Interactive
-                @text="Details"
                 @route="vault.cluster.access.oidc.scopes.scope.details"
                 @model={{model.name}}
                 @disabled={{eq model.canRead false}}
                 data-test-oidc-scope-menu-link="details"
-              />
+              >Details</dd.Interactive>
               <dd.Interactive
-                @text="Edit"
                 @route="vault.cluster.access.oidc.scopes.scope.edit"
                 @model={{model.name}}
                 @disabled={{eq model.canEdit false}}
                 data-test-oidc-scope-menu-link="edit"
-              />
+              >Edit</dd.Interactive>
             </Hds::Dropdown>
           </div>
         </div>
diff --git a/ui/app/templates/vault/cluster/access/oidc/scopes/scope/details.hbs b/ui/app/templates/vault/cluster/access/oidc/scopes/scope/details.hbs
index 343afaa83d7..1c710bcfd0e 100644
--- a/ui/app/templates/vault/cluster/access/oidc/scopes/scope/details.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/scopes/scope/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -56,12 +56,9 @@
 <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
   <InfoTableRow @label="Name" @value={{this.model.name}} />
   <InfoTableRow @label="Description" @value={{this.model.description}} />
-  <JsonEditor
-    @title="JSON Template"
-    @mode="ruby"
-    @value={{this.model.template}}
-    @readOnly={{true}}
-    class="has-top-margin-xl has-bottom-margin-xl"
-    data-test-oidc-scope-json
-  />
+  <Hds::CodeBlock @value={{this.model.template}} @language="ruby" @hasCopyButton={{true}} as |CB|>
+    <CB.Title @tag="h3">
+      JSON Template
+    </CB.Title>
+  </Hds::CodeBlock>
 </div>
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/access/oidc/scopes/scope/edit.hbs b/ui/app/templates/vault/cluster/access/oidc/scopes/scope/edit.hbs
index 576638eaee5..a11480c5dc2 100644
--- a/ui/app/templates/vault/cluster/access/oidc/scopes/scope/edit.hbs
+++ b/ui/app/templates/vault/cluster/access/oidc/scopes/scope/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Oidc::ScopeForm
   @model={{this.model}}
diff --git a/ui/app/templates/vault/cluster/access/reset-password-error.hbs b/ui/app/templates/vault/cluster/access/reset-password-error.hbs
index 1b5d785c887..1e73f24f4a6 100644
--- a/ui/app/templates/vault/cluster/access/reset-password-error.hbs
+++ b/ui/app/templates/vault/cluster/access/reset-password-error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/access/reset-password.hbs b/ui/app/templates/vault/cluster/access/reset-password.hbs
index bd50107cac0..2c9fc934339 100644
--- a/ui/app/templates/vault/cluster/access/reset-password.hbs
+++ b/ui/app/templates/vault/cluster/access/reset-password.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::UserpassResetPassword @backend={{this.model.backend}} @username={{this.model.username}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/auth.hbs b/ui/app/templates/vault/cluster/auth.hbs
index 13d291f2a24..ac414d2f3b3 100644
--- a/ui/app/templates/vault/cluster/auth.hbs
+++ b/ui/app/templates/vault/cluster/auth.hbs
@@ -1,132 +1,28 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-{{#if this.mfaErrors}}
-  <div class="has-top-margin-xxl" data-test-mfa-error>
-    <EmptyState
-      @title="Unauthorized"
-      @message="Multi-factor authentication is required, but failed. Go back and try again, or contact your administrator."
-      @icon="alert-circle"
-      @bottomBorder={{true}}
-      @subTitle={{join ". " this.mfaErrors}}
-      class="is-shadowless"
-    >
-      <Hds::Button @text="Go back" @icon="chevron-left" @color="tertiary" {{on "click" (action "onMfaErrorDismiss")}} />
-    </EmptyState>
-  </div>
+{{#if this.unwrapTokenError}}
+  <Hds::ApplicationState class="has-top-margin-xxl" data-test-page-error as |A|>
+    <A.Header @title="Authentication error" />
+    <A.Body @text="Token unwrap failed" />
+    <A.Body @text="Error: {{this.unwrapTokenError}}" />
+    <A.Footer as |F|>
+      <F.Button @icon="arrow-left" @color="tertiary" @text="Go back" {{on "click" (action "backToLogin")}} />
+    </A.Footer>
+  </Hds::ApplicationState>
 {{else}}
-  <SplashPage>
-    <:header>
-      {{#if this.oidcProvider}}
-        <div class="box is-shadowless is-flex-v-centered" data-test-auth-logo>
-          <LogoEdition aria-label="Sign in with Hashicorp Vault" />
-        </div>
-      {{else}}
-        <div class="is-flex-v-centered has-bottom-margin-xxl">
-          <div class="brand-icon-large">
-            <Icon @name="vault" @size="24" @stretched={{true}} />
-          </div>
-        </div>
-        <div class="is-flex-row">
-          {{#if this.mfaAuthData}}
-            <Hds::Button
-              @text="Back to login"
-              @icon="arrow-left"
-              @isIconOnly={{true}}
-              @color="tertiary"
-              {{on "click" (fn (mut this.mfaAuthData) null)}}
-            />
-          {{else if this.waitingForOktaNumberChallenge}}
-            <Hds::Button
-              @text="Back to login"
-              @icon="arrow-left"
-              @isIconOnly={{true}}
-              @color="tertiary"
-              {{on "click" (action "cancelAuthentication")}}
-            />
-          {{/if}}
-          <h1 class="title is-3">
-            {{if (or this.mfaAuthData this.waitingForOktaNumberChallenge) "Authenticate" "Sign in to Vault"}}
-          </h1>
-        </div>
-      {{/if}}
-    </:header>
-
-    <:subHeader>
-      {{#if (has-feature "Namespaces")}}
-        {{#unless this.mfaAuthData}}
-          <Toolbar class="toolbar-namespace-picker">
-            <div class="field is-horizontal" data-test-namespace-toolbar>
-              <div class="field-label is-normal">
-                <label class="is-label" for="namespace">Namespace</label>
-              </div>
-              {{#if this.managedNamespaceRoot}}
-                <div class="field-label">
-                  <span class="has-text-grey" data-test-managed-namespace-root>/{{this.managedNamespaceRoot}}</span>
-                </div>
-              {{/if}}
-              <div class="field-body">
-                <div class="field">
-                  <div class="control">
-                    <input
-                      data-test-auth-form-ns-input
-                      value={{this.namespaceInput}}
-                      placeholder={{if this.managedNamespaceRoot "/ (Default)" "/ (Root)"}}
-                      {{on "input" (perform this.updateNamespace value="target.value")}}
-                      autocomplete="off"
-                      spellcheck="false"
-                      name="namespace"
-                      id="namespace"
-                      class="input"
-                      type="text"
-                      disabled={{this.oidcProvider}}
-                    />
-                  </div>
-                </div>
-              </div>
-            </div>
-          </Toolbar>
-        {{/unless}}
-      {{/if}}
-    </:subHeader>
-
-    <:content>
-      {{#if this.mfaAuthData}}
-        <Mfa::MfaForm
-          @clusterId={{this.model.id}}
-          @authData={{this.mfaAuthData}}
-          @onSuccess={{action "onMfaSuccess"}}
-          @onError={{fn (mut this.mfaErrors)}}
-        />
-      {{else}}
-        <AuthForm
-          @wrappedToken={{this.wrappedToken}}
-          @cluster={{this.model}}
-          @namespace={{this.namespaceQueryParam}}
-          @redirectTo={{this.redirectTo}}
-          @selectedAuth={{this.authMethod}}
-          @onSuccess={{action "onAuthResponse"}}
-          @setOktaNumberChallenge={{fn (mut this.waitingForOktaNumberChallenge)}}
-          @waitingForOktaNumberChallenge={{this.waitingForOktaNumberChallenge}}
-          @setCancellingAuth={{fn (mut this.cancelAuth)}}
-          @cancelAuthForOktaNumberChallenge={{this.cancelAuth}}
-        />
-      {{/if}}
-    </:content>
-
-    <:footer>
-      <div class="has-short-padding">
-        <p class="help has-text-grey-dark" data-test-auth-helptext>
-          {{#if this.oidcProvider}}
-            Once you log in, you will be redirected back to your application. If you require login credentials, contact your
-            administrator.
-          {{else}}
-            Contact your administrator for login credentials.
-          {{/if}}
-        </p>
-      </div>
-    </:footer>
-  </SplashPage>
+  <Auth::Page
+    @cluster={{this.model.clusterModel}}
+    @directLinkData={{this.model.directLinkData}}
+    @loginAndTransition={{this.loginAndTransition}}
+    @loginSettings={{this.model.loginSettings}}
+    @namespaceQueryParam={{this.namespaceQueryParam}}
+    @oidcProviderQueryParam={{this.oidcProvider}}
+    @onNamespaceUpdate={{perform this.updateNamespace}}
+    @roleQueryParam={{this.role}}
+    @shouldRefocusNamespaceInput={{this.shouldRefocusNamespaceInput}}
+    @visibleAuthMounts={{this.model.visibleAuthMounts}}
+  />
 {{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/clients.hbs b/ui/app/templates/vault/cluster/clients.hbs
index 3bc8b42b1bb..808b1bb5c09 100644
--- a/ui/app/templates/vault/cluster/clients.hbs
+++ b/ui/app/templates/vault/cluster/clients.hbs
@@ -1,49 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.levelLeft>
-    <h1 class="title is-3">
-      Vault Usage Metrics
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-<div class="tabs-container box is-bottomless is-marginless is-fullwidth is-paddingless">
-  <nav class="tabs" aria-label="navigation for managing client counts">
-    <ul>
-      <li>
-        <LinkTo @route="vault.cluster.clients.counts.overview" data-test-tab="overview">
-          Overview
-        </LinkTo>
-      </li>
-      <li>
-        <LinkTo @route="vault.cluster.clients.counts.token" data-test-tab="token">
-          Entity/Non-entity clients
-        </LinkTo>
-      </li>
-      {{! * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-      <li>
-        <LinkTo @route="vault.cluster.clients.counts.sync" data-test-tab="sync">
-          Secrets sync clients
-        </LinkTo>
-      </li>
-       }}
-      {{#if (or @model.config.canRead @model.canRead)}}
-        <li>
-          <LinkTo
-            @route="vault.cluster.clients.config"
-            @current-when="vault.cluster.clients.config vault.cluster.clients.edit"
-            data-test-tab="config"
-          >
-            Configuration
-          </LinkTo>
-        </li>
-      {{/if}}
-    </ul>
-  </nav>
-</div>
+}}
 
+<Sidebar::Nav::Clients @canReadConfig={{this.model.config.canRead}} />
 {{outlet}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/clients/config.hbs b/ui/app/templates/vault/cluster/clients/config.hbs
index 829c68bd38d..46da457d711 100644
--- a/ui/app/templates/vault/cluster/clients/config.hbs
+++ b/ui/app/templates/vault/cluster/clients/config.hbs
@@ -1,7 +1,15 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      Configuration
+    </h1>
+  </p.levelLeft>
+</PageHeader>
 
 <Toolbar>
   <ToolbarActions>
diff --git a/ui/app/templates/vault/cluster/clients/counts.hbs b/ui/app/templates/vault/cluster/clients/counts.hbs
index 648851ed881..719b6ffe50e 100644
--- a/ui/app/templates/vault/cluster/clients/counts.hbs
+++ b/ui/app/templates/vault/cluster/clients/counts.hbs
@@ -1,17 +1,16 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Clients::Page::Counts
   @activity={{this.model.activity}}
   @activityError={{this.model.activityError}}
   @config={{this.model.config}}
-  @startTimestamp={{this.model.startTimestamp}}
   @endTimestamp={{this.model.endTimestamp}}
-  @namespace={{this.ns}}
-  @mountPath={{this.mountPath}}
   @onFilterChange={{this.updateQueryParams}}
+  @startTimestamp={{this.model.startTimestamp}}
+  @versionHistory={{this.model.versionHistory}}
 >
   {{outlet}}
 </Clients::Page::Counts>
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/clients/counts/client-list.hbs b/ui/app/templates/vault/cluster/clients/counts/client-list.hbs
new file mode 100644
index 00000000000..fa744200fd7
--- /dev/null
+++ b/ui/app/templates/vault/cluster/clients/counts/client-list.hbs
@@ -0,0 +1,34 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if this.model.exportError}}
+  <Clients::Counts::Error
+    @title={{if (eq this.model.exportError.message "No data to export in provided time range.") "No data found"}}
+    @error={{this.model.exportError}}
+  >
+    <:actions>
+      {{#if (eq this.model.exportError.httpStatus 403)}}
+        <Hds::Text::Body @tag="p" @color="faint" class="has-bottom-margin-s">
+          Viewing export data requires
+          <Hds::Text::Code class="code-in-text">sudo</Hds::Text::Code>
+          permissions.
+          <Hds::Link::Standalone
+            @icon="docs-link"
+            @iconPosition="trailing"
+            @text="Client Export Documentation"
+            @isHrefExternal={{true}}
+            @href={{doc-link "/vault/api-docs/system/internal-counters#activity-export"}}
+          />
+        </Hds::Text::Body>
+      {{/if}}
+    </:actions>
+  </Clients::Counts::Error>
+{{else}}
+  <Clients::Page::ClientList
+    @exportData={{this.model.exportData}}
+    @onFilterChange={{this.countsController.updateQueryParams}}
+    @filterQueryParams={{this.countsController.filterQueryParams}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/clients/counts/overview.hbs b/ui/app/templates/vault/cluster/clients/counts/overview.hbs
index 0d783dfab85..8055d570b2e 100644
--- a/ui/app/templates/vault/cluster/clients/counts/overview.hbs
+++ b/ui/app/templates/vault/cluster/clients/counts/overview.hbs
@@ -1,13 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Clients::Page::Overview
   @activity={{this.model.activity}}
-  @versionHistory={{this.model.versionHistory}}
-  @startTimestamp={{this.model.startTimestamp}}
-  @endTimestamp={{this.model.endTimestamp}}
-  @namespace={{this.countsController.ns}}
-  @mountPath={{this.countsController.mountPath}}
+  @onFilterChange={{this.countsController.updateQueryParams}}
+  @filterQueryParams={{this.countsController.filterQueryParams}}
 />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/clients/counts/sync.hbs b/ui/app/templates/vault/cluster/clients/counts/sync.hbs
deleted file mode 100644
index 4c61fa410a9..00000000000
--- a/ui/app/templates/vault/cluster/clients/counts/sync.hbs
+++ /dev/null
@@ -1,13 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<Clients::Page::Sync
-  @activity={{this.model.activity}}
-  @versionHistory={{this.model.versionHistory}}
-  @startTimestamp={{this.model.startTimestamp}}
-  @endTimestamp={{this.model.endTimestamp}}
-  @namespace={{this.countsController.ns}}
-  @mountPath={{this.countsController.mountPath}}
-/>
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/clients/counts/token.hbs b/ui/app/templates/vault/cluster/clients/counts/token.hbs
deleted file mode 100644
index bbd63484153..00000000000
--- a/ui/app/templates/vault/cluster/clients/counts/token.hbs
+++ /dev/null
@@ -1,13 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<Clients::Page::Token
-  @activity={{this.model.activity}}
-  @versionHistory={{this.model.versionHistory}}
-  @startTimestamp={{this.model.startTimestamp}}
-  @endTimestamp={{this.model.endTimestamp}}
-  @namespace={{this.countsController.ns}}
-  @mountPath={{this.countsController.mountPath}}
-/>
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/clients/edit.hbs b/ui/app/templates/vault/cluster/clients/edit.hbs
index 0a56269763b..a0da3b76509 100644
--- a/ui/app/templates/vault/cluster/clients/edit.hbs
+++ b/ui/app/templates/vault/cluster/clients/edit.hbs
@@ -1,6 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      Edit Configuration
+    </h1>
+  </p.levelLeft>
+</PageHeader>
 
 <Clients::Config @model={{@model}} @mode="edit" />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/clients/error.hbs b/ui/app/templates/vault/cluster/clients/error.hbs
index 15b81873f26..443a9b42cd8 100644
--- a/ui/app/templates/vault/cluster/clients/error.hbs
+++ b/ui/app/templates/vault/cluster/clients/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (eq @model.httpStatus 404)}}
   <NotFound @model={{this.model}} />
diff --git a/ui/app/templates/vault/cluster/clients/loading.hbs b/ui/app/templates/vault/cluster/clients/loading.hbs
index 45dfe248ba7..35426b00d56 100644
--- a/ui/app/templates/vault/cluster/clients/loading.hbs
+++ b/ui/app/templates/vault/cluster/clients/loading.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LayoutLoading />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/dashboard.hbs b/ui/app/templates/vault/cluster/dashboard.hbs
index b7f212674a0..31bf6599981 100644
--- a/ui/app/templates/vault/cluster/dashboard.hbs
+++ b/ui/app/templates/vault/cluster/dashboard.hbs
@@ -1,12 +1,11 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Dashboard::Overview
   @replication={{this.model.replication}}
   @secretsEngines={{this.model.secretsEngines}}
-  @license={{this.model.license}}
   @isRootNamespace={{this.model.isRootNamespace}}
   @version={{this.model.version}}
   @vaultConfiguration={{this.model.vaultConfiguration}}
diff --git a/ui/app/templates/vault/cluster/error.hbs b/ui/app/templates/vault/cluster/error.hbs
index b4ac303ed07..c2a36604cd4 100644
--- a/ui/app/templates/vault/cluster/error.hbs
+++ b/ui/app/templates/vault/cluster/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (eq this.model.httpStatus 404)}}
   <NotFound @model={{this.model}} />
diff --git a/ui/app/templates/vault/cluster/init.hbs b/ui/app/templates/vault/cluster/init.hbs
index af3fd58d229..4c0c59fd078 100644
--- a/ui/app/templates/vault/cluster/init.hbs
+++ b/ui/app/templates/vault/cluster/init.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <SplashPage>
   <:header>
@@ -85,7 +85,7 @@
               @color="primary"
               @route="vault.cluster.unseal"
               @model={{this.model.name}}
-              data-test-advance-button
+              data-test-button="Continue to Unseal"
             />
           {{else}}
             <Hds::Button
@@ -95,7 +95,7 @@
               @model={{this.model.name}}
               @icon={{if this.model.sealed "loading"}}
               disabled={{this.model.sealed}}
-              data-test-advance-button
+              data-test-button="Continue to Authenticate"
             />
           {{/if}}
           <DownloadButton
@@ -205,13 +205,10 @@
           <Hds::Button
             @text="Initialize"
             @icon={{if this.loading "loading"}}
-            data-test-init-submit
+            data-test-submit
             type="submit"
             disabled={{this.loading}}
           />
-          <div class="init-illustration">
-            {{svg-jar "initialize"}}
-          </div>
         </div>
       </form>
     {{/if}}
diff --git a/ui/app/templates/vault/cluster/license.hbs b/ui/app/templates/vault/cluster/license.hbs
index 281726a1ec1..2f6cf8ce604 100644
--- a/ui/app/templates/vault/cluster/license.hbs
+++ b/ui/app/templates/vault/cluster/license.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LicenseInfo
   @startTime={{this.model.startTime}}
diff --git a/ui/app/templates/vault/cluster/loading.hbs b/ui/app/templates/vault/cluster/loading.hbs
index 45dfe248ba7..35426b00d56 100644
--- a/ui/app/templates/vault/cluster/loading.hbs
+++ b/ui/app/templates/vault/cluster/loading.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LayoutLoading />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/mfa-setup.hbs b/ui/app/templates/vault/cluster/mfa-setup.hbs
index 3c203179fe3..6931ec2b875 100644
--- a/ui/app/templates/vault/cluster/mfa-setup.hbs
+++ b/ui/app/templates/vault/cluster/mfa-setup.hbs
@@ -1,35 +1,26 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<SplashPage>
-  <:header>
-    <h1 class="title is-4">MFA setup</h1>
-  </:header>
-  <:content>
-    <div class="auth-form" data-test-mfa-form>
-      <div class="box">
-        {{#if (eq this.onStep 1)}}
-          <Mfa::MfaSetupStepOne
-            @isUUIDVerified={{this.isUUIDVerified}}
-            @restartFlow={{this.restartFlow}}
-            @saveUUIDandQrCode={{this.saveUUIDandQrCode}}
-            @showWarning={{this.showWarning}}
-            data-test-step-one
-          />
-        {{/if}}
-        {{#if (eq this.onStep 2)}}
-          <Mfa::MfaSetupStepTwo
-            @entityId={{this.entityId}}
-            @uuid={{this.uuid}}
-            @qrCode={{this.qrCode}}
-            @restartFlow={{this.restartFlow}}
-            @warning={{this.warning}}
-            data-test-step-two
-          />
-        {{/if}}
-      </div>
-    </div>
-  </:content>
-</SplashPage>
\ No newline at end of file
+{{#if (eq this.onStep 1)}}
+  <Mfa::MfaSetupStepOne
+    @header={{this.header}}
+    @description={{this.description}}
+    @isUUIDVerified={{this.isUUIDVerified}}
+    @restartFlow={{this.restartFlow}}
+    @saveUUIDandQrCode={{this.saveUUIDandQrCode}}
+    @showWarning={{this.showWarning}}
+  />
+{{/if}}
+{{#if (eq this.onStep 2)}}
+  <Mfa::MfaSetupStepTwo
+    @header={{this.header}}
+    @description={{this.description}}
+    @entityId={{this.entityId}}
+    @uuid={{this.uuid}}
+    @qrCode={{this.qrCode}}
+    @restartFlow={{this.restartFlow}}
+    @warning={{this.warning}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/not-found.hbs b/ui/app/templates/vault/cluster/not-found.hbs
index f8ccc8d6bbb..d706b38fcc8 100644
--- a/ui/app/templates/vault/cluster/not-found.hbs
+++ b/ui/app/templates/vault/cluster/not-found.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <NotFound @model={{this.model}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/oidc-callback.hbs b/ui/app/templates/vault/cluster/oidc-callback.hbs
index b1c3b2524f4..208fb4d363e 100644
--- a/ui/app/templates/vault/cluster/oidc-callback.hbs
+++ b/ui/app/templates/vault/cluster/oidc-callback.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#in-element this.pageContainer}}
   <OidcCallbackSplash />
diff --git a/ui/app/templates/vault/cluster/oidc-provider-ns.hbs b/ui/app/templates/vault/cluster/oidc-provider-ns.hbs
index 24f57426bdc..3ea8b6240ff 100644
--- a/ui/app/templates/vault/cluster/oidc-provider-ns.hbs
+++ b/ui/app/templates/vault/cluster/oidc-provider-ns.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="splash-page-container section is-flex-v-centered-tablet is-flex-grow-1 is-fullwidth">
   <div class="columns is-centered is-gapless is-fullwidth">
diff --git a/ui/app/templates/vault/cluster/oidc-provider.hbs b/ui/app/templates/vault/cluster/oidc-provider.hbs
index e3fcd541a83..c4e23481de3 100644
--- a/ui/app/templates/vault/cluster/oidc-provider.hbs
+++ b/ui/app/templates/vault/cluster/oidc-provider.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="splash-page-container section is-flex-v-centered-tablet is-flex-grow-1 is-fullwidth">
   <div class="columns is-centered is-gapless is-fullwidth">
diff --git a/ui/app/templates/vault/cluster/policies.hbs b/ui/app/templates/vault/cluster/policies.hbs
index de2ce3ed899..8f409999be9 100644
--- a/ui/app/templates/vault/cluster/policies.hbs
+++ b/ui/app/templates/vault/cluster/policies.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Sidebar::Nav::Policies />
 {{outlet}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/policies/create.hbs b/ui/app/templates/vault/cluster/policies/create.hbs
index a8cd4aae506..6b2c81a2948 100644
--- a/ui/app/templates/vault/cluster/policies/create.hbs
+++ b/ui/app/templates/vault/cluster/policies/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/app/templates/vault/cluster/policies/error.hbs b/ui/app/templates/vault/cluster/policies/error.hbs
index d1105447ca1..d3358f5c4ff 100644
--- a/ui/app/templates/vault/cluster/policies/error.hbs
+++ b/ui/app/templates/vault/cluster/policies/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (eq this.model.httpStatus 404)}}
   <NotFound @model={{this.model}} />
diff --git a/ui/app/templates/vault/cluster/policies/index.hbs b/ui/app/templates/vault/cluster/policies/index.hbs
index df42c3bd873..1d1ac2856de 100644
--- a/ui/app/templates/vault/cluster/policies/index.hbs
+++ b/ui/app/templates/vault/cluster/policies/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (or (eq this.policyType "acl") (has-feature "Sentinel"))}}
   <PageHeader as |p|>
@@ -10,9 +10,7 @@
         {{uppercase this.policyType}}
         Policies
         {{#if (not-eq this.policyType "acl")}}
-          <span class="tag" aria-label="Enforcement level: {{this.model.enforcementLevel}}">
-            Sentinel
-          </span>
+          <Hds::Badge @text="Sentinel" />
         {{/if}}
       </h1>
     </p.levelLeft>
@@ -105,27 +103,24 @@
                 {{else}}
                   {{#if item.canRead}}
                     <dd.Interactive
-                      @text="Details"
                       @route="vault.cluster.policy.show"
                       @models={{array this.policyType item.id}}
                       data-test-policy-link="show"
-                    />
+                    >Details</dd.Interactive>
                   {{/if}}
                   {{#if item.canEdit}}
                     <dd.Interactive
-                      @text="Edit"
                       @route="vault.cluster.policy.edit"
                       @models={{array this.policyType item.id}}
                       data-test-policy-link="edit"
-                    />
+                    >Edit</dd.Interactive>
                   {{/if}}
                   {{#if (and item.canDelete (not-eq item.name "default"))}}
                     <dd.Interactive
-                      @text="Delete"
                       @color="critical"
                       data-test-confirm-action-trigger
                       {{on "click" (fn (mut this.policyToDelete) item)}}
-                    />
+                    >Delete</dd.Interactive>
                   {{/if}}
                 {{/if}}
               </Hds::Dropdown>
@@ -158,7 +153,7 @@
           @iconPosition="trailing"
           @icon="learn-link"
           @text="Getting started with policies"
-          @href={{doc-link "/vault/tutorials/getting-started/getting-started-policies"}}
+          @href={{doc-link "/vault/tutorials/get-started/introduction-policies"}}
         />
       {{else}}
         <Hds::Link::Standalone
diff --git a/ui/app/templates/vault/cluster/policies/loading.hbs b/ui/app/templates/vault/cluster/policies/loading.hbs
index 45dfe248ba7..35426b00d56 100644
--- a/ui/app/templates/vault/cluster/policies/loading.hbs
+++ b/ui/app/templates/vault/cluster/policies/loading.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LayoutLoading />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/policy.hbs b/ui/app/templates/vault/cluster/policy.hbs
index de2ce3ed899..8f409999be9 100644
--- a/ui/app/templates/vault/cluster/policy.hbs
+++ b/ui/app/templates/vault/cluster/policy.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Sidebar::Nav::Policies />
 {{outlet}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/policy/edit.hbs b/ui/app/templates/vault/cluster/policy/edit.hbs
index fce8584b153..bf744d4f5fb 100644
--- a/ui/app/templates/vault/cluster/policy/edit.hbs
+++ b/ui/app/templates/vault/cluster/policy/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -20,17 +20,15 @@
     <h1 class="title is-3">
       {{this.model.id}}
       {{#if this.model.enforcementLevel}}
-        <span class="tag is-medium" aria-label="Enforcement level: {{this.model.enforcementLevel}}">
-          {{this.model.enforcementLevel}}
-        </span>
+        <Hds::Badge @text={{this.model.enforcementLevel}} aria-label="Enforcement level: {{this.model.enforcementLevel}}" />
       {{/if}}
     </h1>
   </p.levelLeft>
 </PageHeader>
-{{#if (and (not-eq this.model.id "root") (or this.capabilities.canUpdate this.capabilities.canDelete))}}
+{{#if (and (not-eq this.model.id "root") (or this.model.canUpdate this.model.canDelete))}}
   <Toolbar>
     <ToolbarActions>
-      {{#if (and (not-eq this.model.id "default") this.capabilities.canDelete)}}
+      {{#if (and (not-eq this.model.id "default") this.model.canDelete)}}
         <ConfirmAction
           @buttonText="Delete policy"
           class="toolbar-button"
diff --git a/ui/app/templates/vault/cluster/policy/error.hbs b/ui/app/templates/vault/cluster/policy/error.hbs
index d1105447ca1..d3358f5c4ff 100644
--- a/ui/app/templates/vault/cluster/policy/error.hbs
+++ b/ui/app/templates/vault/cluster/policy/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (eq this.model.httpStatus 404)}}
   <NotFound @model={{this.model}} />
diff --git a/ui/app/templates/vault/cluster/policy/loading.hbs b/ui/app/templates/vault/cluster/policy/loading.hbs
index 45dfe248ba7..35426b00d56 100644
--- a/ui/app/templates/vault/cluster/policy/loading.hbs
+++ b/ui/app/templates/vault/cluster/policy/loading.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LayoutLoading />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/policy/show.hbs b/ui/app/templates/vault/cluster/policy/show.hbs
index 3b4162431ab..ca386045d5c 100644
--- a/ui/app/templates/vault/cluster/policy/show.hbs
+++ b/ui/app/templates/vault/cluster/policy/show.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -19,9 +19,7 @@
     <h1 class="title is-3" data-test-policy-name="true">
       {{this.model.id}}
       {{#if this.model.enforcementLevel}}
-        <span class="tag" aria-label="Enforcement level: {{this.model.enforcementLevel}}">
-          {{this.model.enforcementLevel}}
-        </span>
+        <Hds::Badge @text={{this.model.enforcementLevel}} aria-label="Enforcement level: {{this.model.enforcementLevel}}" />
       {{/if}}
     </h1>
   </p.levelLeft>
@@ -36,23 +34,30 @@
       @extension={{if (eq this.policyType "acl") this.model.format "sentinel"}}
       @text="Download policy"
     />
-    {{#if (and (not-eq this.model.id "root") (or this.capabilities.canUpdate this.capabilities.canDelete))}}
-      <ToolbarLink @route="vault.cluster.policy.edit" @model={{this.model.id}} data-test-policy-edit-toggle>
+    {{#if (and (not-eq this.model.id "root") (or this.model.canUpdate this.model.canDelete))}}
+      <ToolbarLink
+        @route="vault.cluster.policy.edit"
+        @models={{array this.policyType this.model.id}}
+        data-test-policy-edit-toggle
+      >
         Edit policy
       </ToolbarLink>
     {{/if}}
   </ToolbarActions>
 </Toolbar>
 <div class="box is-bottomless is-fullwidth is-marginless">
-  <div class="field">
-    <JsonEditor
-      @title="Policy"
-      @subTitle={{if (eq this.policyType "acl") (concat this.uppercase this.model.format " format")}}
-      @value={{this.model.policy}}
-      @readOnly={{true}}
-      @mode="ruby"
-    />
-  </div>
+  {{#if this.model.policy}}
+    <div class="field">
+      <Hds::CodeBlock @value={{this.model.policy}} @hasCopyButton={{true}} @maxHeight="300px" @language="ruby" as |CB|>
+        <CB.Title @tag="h3">
+          Policy
+        </CB.Title>
+        <CB.Description>
+          ({{if (eq this.policyType "acl") (concat this.uppercase this.model.format " format")}})
+        </CB.Description>
+      </Hds::CodeBlock>
+    </div>
+  {{/if}}
   {{#if this.model.paths}}
     <div class="field box is-shadowless no-bottom-padding is-marginless">
       <h2 class="title is-6">Paths</h2>
diff --git a/ui/app/templates/vault/cluster/recovery/error.hbs b/ui/app/templates/vault/cluster/recovery/error.hbs
new file mode 100644
index 00000000000..cba3c50f8d4
--- /dev/null
+++ b/ui/app/templates/vault/cluster/recovery/error.hbs
@@ -0,0 +1,30 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Recovery::Page::Header
+  @title="Secrets Recovery"
+  @subtitle="Recover lost or deleted data from a raft snapshot. Supported data includes KV v1 and Cubbyhole secrets or Database static roles."
+/>
+
+<hr class="has-background-gray-300" />
+
+{{#if (eq this.model.message "raft storage is not in use")}}
+  <Hds::ApplicationState as |A|>
+    <A.Header @title="Raft storage required" @icon="info" data-test-empty-state-title />
+    <A.Body @text="Raft storage must be used in order to recover data from a snapshot." data-test-empty-state-message />
+    <A.Footer data-test-empty-state-actions as |F|>
+      <F.LinkStandalone
+        @text="Snapshot management"
+        @icon="docs-link"
+        @iconPosition="trailing"
+        @href={{doc-link "/vault/docs/sysadmin/snapshots"}}
+        @isHrefExternal={{true}}
+      />
+    </A.Footer>
+
+  </Hds::ApplicationState>
+{{else}}
+  <Page::Error @error={{this.model}} />
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/recovery/snapshots/index.hbs b/ui/app/templates/vault/cluster/recovery/snapshots/index.hbs
new file mode 100644
index 00000000000..f74d4032a9d
--- /dev/null
+++ b/ui/app/templates/vault/cluster/recovery/snapshots/index.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Recovery::Page::Snapshots @model={{this.model}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/recovery/snapshots/load.hbs b/ui/app/templates/vault/cluster/recovery/snapshots/load.hbs
new file mode 100644
index 00000000000..a3924767f07
--- /dev/null
+++ b/ui/app/templates/vault/cluster/recovery/snapshots/load.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Recovery::Page::Snapshots::Load @breadcrumbs={{this.breadcrumbs}} @model={{this.model}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/recovery/snapshots/snapshot/details.hbs b/ui/app/templates/vault/cluster/recovery/snapshots/snapshot/details.hbs
new file mode 100644
index 00000000000..d4ed28ee293
--- /dev/null
+++ b/ui/app/templates/vault/cluster/recovery/snapshots/snapshot/details.hbs
@@ -0,0 +1,5 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+<Recovery::Page::Snapshots::SnapshotDetails @model={{this.model}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/recovery/snapshots/snapshot/manage.hbs b/ui/app/templates/vault/cluster/recovery/snapshots/snapshot/manage.hbs
new file mode 100644
index 00000000000..a4115c29bb1
--- /dev/null
+++ b/ui/app/templates/vault/cluster/recovery/snapshots/snapshot/manage.hbs
@@ -0,0 +1,5 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+<Recovery::Page::Snapshots::SnapshotManage @model={{this.model}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/redirect.hbs b/ui/app/templates/vault/cluster/redirect.hbs
index 9600ec5c6eb..f5cc84eb234 100644
--- a/ui/app/templates/vault/cluster/redirect.hbs
+++ b/ui/app/templates/vault/cluster/redirect.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LogoSplash />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/replication-dr-promote/details.hbs b/ui/app/templates/vault/cluster/replication-dr-promote/details.hbs
index a98a37c8be1..9ee463e29df 100644
--- a/ui/app/templates/vault/cluster/replication-dr-promote/details.hbs
+++ b/ui/app/templates/vault/cluster/replication-dr-promote/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <section class="section">
   <div class="container is-widescreen">
diff --git a/ui/app/templates/vault/cluster/replication-dr-promote/index.hbs b/ui/app/templates/vault/cluster/replication-dr-promote/index.hbs
index af59f0d20e6..cb801ec86e6 100644
--- a/ui/app/templates/vault/cluster/replication-dr-promote/index.hbs
+++ b/ui/app/templates/vault/cluster/replication-dr-promote/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <section class="section">
   <div class="container is-widescreen">
diff --git a/ui/app/templates/vault/cluster/secrets/backend/configuration.hbs b/ui/app/templates/vault/cluster/secrets/backend/configuration.hbs
index 7ced6edf900..b3648668ea9 100644
--- a/ui/app/templates/vault/cluster/secrets/backend/configuration.hbs
+++ b/ui/app/templates/vault/cluster/secrets/backend/configuration.hbs
@@ -1,48 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<SecretListHeader
-  @model={{this.model}}
-  @backendCrumb={{hash
-    label=this.model.id
-    text=this.model.id
-    path="vault.cluster.secrets.backend.list-root"
-    model=this.model.id
-  }}
-  @isConfigure={{true}}
-/>
-
-{{#if this.isConfigurable}}
-  <Toolbar>
-    <ToolbarActions>
-      <ToolbarLink
-        @route="vault.cluster.settings.configure-secret-backend"
-        @model={{this.model.id}}
-        data-test-secret-backend-configure
-      >
-        Configure
-      </ToolbarLink>
-    </ToolbarActions>
-  </Toolbar>
-{{/if}}
-
-<div class="box is-fullwidth is-sideless is-paddingless is-marginless">
-  {{#each this.model.attrs as |attr|}}
-    {{#if (eq attr.type "object")}}
-      <InfoTableRow
-        @alwaysRender={{not (is-empty-value (get this.model attr.name))}}
-        @label={{or attr.options.label (to-label attr.name)}}
-        @value={{stringify (get this.model (or attr.options.fieldValue attr.name))}}
-      />
-    {{else}}
-      <InfoTableRow
-        @alwaysRender={{and (not (is-empty-value (get this.model attr.name))) (not-eq attr.name "version")}}
-        @formatTtl={{eq attr.options.editType "ttl"}}
-        @label={{or attr.options.label (to-label attr.name)}}
-        @value={{get this.model (or attr.options.fieldValue attr.name)}}
-      />
-    {{/if}}
-  {{/each}}
-</div>
\ No newline at end of file
+}}
+{{! use the index route to view configuration and sibling edit route to edit the configuration. }}
+{{outlet}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/backend/configuration/edit.hbs b/ui/app/templates/vault/cluster/secrets/backend/configuration/edit.hbs
new file mode 100644
index 00000000000..eb186ee77e5
--- /dev/null
+++ b/ui/app/templates/vault/cluster/secrets/backend/configuration/edit.hbs
@@ -0,0 +1,41 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.top>
+    <KeyValueHeader
+      @baseKey={{this.model}}
+      @path="vault.cluster.secrets.backend"
+      @root={{this.root}}
+      @showCurrent={{true}}
+    />
+  </p.top>
+  <p.levelLeft>
+    <h1 class="title is-3" data-test-backend-configure-title={{this.model.type}}>
+      Configure
+      {{this.displayName}}
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+<Toolbar>
+  <ToolbarActions>
+    <ToolbarLink @route="vault.cluster.secrets.backend" @model={{this.model.id}} data-test-backend-view-link>
+      View backend
+    </ToolbarLink>
+  </ToolbarActions>
+</Toolbar>
+
+{{#if (eq this.model.type "ssh")}}
+  <SecretEngine::ConfigureSsh @configForm={{this.model.configForm}} @id={{this.model.id}} />
+  {{! This "else if" check is preventive. As of writing, all engines using this route, but "ssh", are wif engines }}
+{{else if this.isWifEngine}}
+  <SecretEngine::ConfigureWif
+    @backendPath={{this.model.id}}
+    @displayName={{this.displayName}}
+    @type={{this.model.type}}
+    @configForm={{this.model.configForm}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/backend/configuration/general-settings.hbs b/ui/app/templates/vault/cluster/secrets/backend/configuration/general-settings.hbs
new file mode 100644
index 00000000000..e0da6c8b631
--- /dev/null
+++ b/ui/app/templates/vault/cluster/secrets/backend/configuration/general-settings.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<SecretEngine::Page::GeneralSettings @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/backend/configuration/index.hbs b/ui/app/templates/vault/cluster/secrets/backend/configuration/index.hbs
new file mode 100644
index 00000000000..b43313b7d68
--- /dev/null
+++ b/ui/app/templates/vault/cluster/secrets/backend/configuration/index.hbs
@@ -0,0 +1,40 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<SecretListHeader @model={{this.model.secretsEngine}} @isConfigure={{true}} />
+
+{{#if this.isConfigurable}}
+  <Toolbar>
+    <ToolbarActions>
+      <ToolbarLink
+        @route="vault.cluster.secrets.backend.configuration.edit"
+        @model={{this.model.secretsEngine.id}}
+        data-test-secret-backend-configure
+      >
+        Configure
+      </ToolbarLink>
+    </ToolbarActions>
+  </Toolbar>
+
+  <SecretEngine::ConfigurationDetails @config={{this.model.config}} @typeDisplay={{this.typeDisplay}} @id={{this.modelId}} />
+
+  <SecretsEngineMountConfig
+    @secretsEngine={{this.model.secretsEngine}}
+    class="has-top-margin-xl has-bottom-margin-xl"
+    data-test-mount-config
+  />
+
+{{else}}
+  <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
+    {{#each this.displayFields as |field|}}
+      <InfoTableRow
+        @alwaysRender={{and (not (is-empty-value (get this.model.secretsEngine field))) (not-eq field "version")}}
+        @formatTtl={{includes field (array "config.default_lease_ttl" "config.max_lease_ttl")}}
+        @label={{this.label field}}
+        @value={{get this.model.secretsEngine field}}
+      />
+    {{/each}}
+  </div>
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/backend/configuration/plugin-settings.hbs b/ui/app/templates/vault/cluster/secrets/backend/configuration/plugin-settings.hbs
new file mode 100644
index 00000000000..56b659eab32
--- /dev/null
+++ b/ui/app/templates/vault/cluster/secrets/backend/configuration/plugin-settings.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<SecretEngine::Page::PluginSettings @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/backend/credentials.hbs b/ui/app/templates/vault/cluster/secrets/backend/credentials.hbs
index 38a118ab5d8..e072608729d 100644
--- a/ui/app/templates/vault/cluster/secrets/backend/credentials.hbs
+++ b/ui/app/templates/vault/cluster/secrets/backend/credentials.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (eq this.model.backendType "database")}}
   <GenerateCredentialsDatabase
@@ -10,12 +10,19 @@
     @roleType={{this.model.dbCred.roleType}}
     @model={{this.model.dbCred}}
   />
+{{else if (eq this.model.backendType "totp")}}
+  <GenerateCredentialsTotp
+    @backRoute={{this.model.backRoute}}
+    @backendPath={{this.model.backendPath}}
+    @backendType={{this.model.backendType}}
+    @keyName={{this.model.keyName}}
+    @totpCodePeriod={{this.model.totpCodePeriod}}
+  />
 {{else}}
-  {{! TODO smells a little to have action off of query param requiring a conditional }}
   <GenerateCredentials
     @backendPath={{this.model.backendPath}}
     @backendType={{this.model.backendType}}
     @roleName={{this.model.roleName}}
-    @action={{if this.action this.action ""}}
+    @awsRoleType={{this.model.awsRoleType}}
   />
 {{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/backend/error.hbs b/ui/app/templates/vault/cluster/secrets/backend/error.hbs
index b82bbe47729..1e0472ef31d 100644
--- a/ui/app/templates/vault/cluster/secrets/backend/error.hbs
+++ b/ui/app/templates/vault/cluster/secrets/backend/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-shadowless">
   <PageHeader as |p|>
@@ -14,7 +14,7 @@
       </Hds::Breadcrumb>
     </p.top>
     <p.levelLeft>
-      <h1 class="title is-3 has-text-grey">
+      <h1 class="title is-3 has-text-grey" data-test-backend-error-title>
         {{#if (eq this.model.httpStatus 404)}}
           404 Not Found
         {{else if (eq this.model.httpStatus 403)}}
diff --git a/ui/app/templates/vault/cluster/secrets/backend/list.hbs b/ui/app/templates/vault/cluster/secrets/backend/list.hbs
index 4d74b67951e..c084eb9fba2 100644
--- a/ui/app/templates/vault/cluster/secrets/backend/list.hbs
+++ b/ui/app/templates/vault/cluster/secrets/backend/list.hbs
@@ -1,66 +1,93 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<SecretListHeader
-  @isCertTab={{eq this.tab "cert"}}
-  @model={{this.backendModel}}
-  @baseKey={{this.baseKey}}
-  @backendCrumb={{this.backendCrumb}}
-  @filter={{this.filter}}
-/>
+<SecretListHeader @model={{this.backendModel}} />
 {{#let (options-for-backend this.backendType this.tab) as |options|}}
   {{#if (or this.model.meta.total (not this.isConfigurableTab))}}
     <Toolbar>
-      {{#if this.model.meta.total}}
-        <ToolbarFilters>
-          <NavigateInput
-            @enterpriseProduct="vault"
-            @filterFocusDidChange={{action "setFilterFocus"}}
-            @filterDidChange={{action "setFilter"}}
-            @filter={{this.filter}}
-            @filterMatchesKey={{this.filterMatchesKey}}
-            @firstPartialMatch={{this.firstPartialMatch}}
-            @baseKey={{get this.baseKey "id"}}
-            @shouldNavigateTree={{options.navigateTree}}
-            @placeholder={{options.searchPlaceholder}}
-            @mode={{if (eq this.tab "cert") "secrets-cert" "secrets"}}
-          />
-          {{#if this.filterFocused}}
-            {{#if this.filterMatchesKey}}
-              {{#unless this.filterIsFolder}}
-                <p class="input-hint">
-                  <kbd>Enter</kbd>
-                  to view
-                  {{this.filter}}
-                </p>
-              {{/unless}}
-            {{/if}}
-            {{#if this.firstPartialMatch}}
+      <ToolbarFilters>
+        <NavigateInput
+          @enterpriseProduct="vault"
+          @filterFocusDidChange={{action "setFilterFocus"}}
+          @filterDidChange={{action "setFilter"}}
+          @filter={{this.filter}}
+          @filterMatchesKey={{this.filterMatchesKey}}
+          @firstPartialMatch={{this.firstPartialMatch}}
+          @baseKey={{get this.baseKey "id"}}
+          @shouldNavigateTree={{options.navigateTree}}
+          @placeholder={{options.searchPlaceholder}}
+          @mode={{if (eq this.tab "cert") "secrets-cert" "secrets"}}
+        />
+        {{#if this.filterFocused}}
+          {{#if this.filterMatchesKey}}
+            {{#unless this.filterIsFolder}}
               <p class="input-hint">
-                <kbd>Tab</kbd>
-                to autocomplete
+                <kbd>Enter</kbd>
+                to view
+                {{this.filter}}
               </p>
-            {{/if}}
+            {{/unless}}
           {{/if}}
-        </ToolbarFilters>
-      {{/if}}
+          {{#if this.firstPartialMatch}}
+            <p class="input-hint">
+              <kbd>Tab</kbd>
+              to autocomplete
+            </p>
+          {{/if}}
+        {{/if}}
+      </ToolbarFilters>
 
-      <ToolbarActions>
-        <ToolbarSecretLink
-          @secret=""
-          @mode="create"
-          @type="add"
-          @queryParams={{hash initialKey=(or this.filter this.baseKey.id) itemType=this.tab}}
-          data-test-secret-create={{true}}
-        >
-          {{options.create}}
-        </ToolbarSecretLink>
-      </ToolbarActions>
+      {{! Old Engines will keep the existing toolbar actions }}
+      {{#if this.isOldEngine}}
+        <ToolbarActions>
+          <ToolbarSecretLink
+            @secret=""
+            @mode="create"
+            @backend={{this.backendModel.id}}
+            @type="add"
+            @queryParams={{hash initialKey=(or this.filter this.baseKey.id) itemType=this.tab}}
+            data-test-create-secret-link
+          >
+            {{options.create}}
+          </ToolbarSecretLink>
+        </ToolbarActions>
+      {{/if}}
     </Toolbar>
   {{/if}}
 
+  {{! Display CTA buttons if isOldEngine flag is not set }}
+  {{#unless this.isOldEngine}}
+    <div class="flex column-gap-16 top-right-absolute has-top-margin-s">
+      {{! TODO: Hook dropdown actions to the appropriate routes & actions }}
+      <Hds::Dropdown as |D|>
+        <D.ToggleButton @text="Manage" @color="secondary" data-test-manage-dropdown />
+        <D.Interactive
+          @icon="settings"
+          @route="vault.cluster.secrets.backend.configuration.index"
+          data-test-manage-dropdown-item="Configure"
+        >Configure</D.Interactive>
+        <D.Interactive
+          {{on "click" (fn (mut this.engineToDisable) this.backendModel)}}
+          @color="critical"
+          @icon="trash"
+          data-test-manage-dropdown-item="Delete"
+        >Delete</D.Interactive>
+      </Hds::Dropdown>
+
+      <Hds::Button
+        @text={{options.create}}
+        @icon="plus"
+        {{! This route would be set in secret-link.js but we're using an HDS button instead of the ToolbarSecretLink wrapper so we're explicitly setting it here  }}
+        @route="vault.cluster.secrets.backend.create-root"
+        @query={{hash initialKey=(or this.filter this.baseKey.id) itemType=this.tab}}
+        {{! TODO: rename this test identifier when updating tests }}
+        data-test-create-secret-link
+      />
+    </div>
+  {{/unless}}
+
   {{#if this.model.meta.total}}
     {{#each this.model as |item|}}
       {{! Because of the component helper cannot use glimmer nested SecretList::Item }}
@@ -79,32 +106,28 @@
         />
       {{/let}}
     {{else}}
-      <div class="box is-sideless">
-        {{#if this.filterFocused}}
-          There are no
-          {{pluralize options.item}}
-          matching
-          <code>{{this.filter}}</code>, press
-          <kbd>ENTER</kbd>
-          to add one.
-        {{else}}
-          There are no
-          {{pluralize options.item}}
-          matching
-          <code>{{this.filter}}</code>.
-        {{/if}}
-      </div>
-    {{/each}}
+      {{! Empty state here means that a filter was applied on top of the results list }}
+      <EmptyState
+        @title='There are no {{pluralize options.item}} matching "{{this.filter}}". {{if
+          this.filterFocused
+          'Press ENTER to add one.'
+        }}'
+      />
 
-    <Hds::Pagination::Numbered
-      @currentPage={{this.model.meta.currentPage}}
-      @currentPageSize={{this.model.meta.pageSize}}
-      @route={{concat "vault.cluster.secrets.backend.list" (unless this.baseKey.id "-root")}}
-      @showSizeSelector={{false}}
-      @totalItems={{this.model.meta.total}}
-      @queryFunction={{this.paginationQueryParams}}
-    />
+    {{/each}}
 
+    {{#if this.model.length}}
+      {{! Only show pagination when there are results on the page }}
+      <Hds::Pagination::Numbered
+        @currentPage={{this.model.meta.currentPage}}
+        @currentPageSize={{this.model.meta.pageSize}}
+        @route={{concat "vault.cluster.secrets.backend.list" (unless this.baseKey.id "-root")}}
+        @models={{if this.baseKey.id (array this.backendModel.id this.baseKey.id) (array this.backendModel.id)}}
+        @showSizeSelector={{false}}
+        @totalItems={{this.model.meta.total}}
+        @queryFunction={{this.paginationQueryParams}}
+      />
+    {{/if}}
   {{else}}
     {{#if (eq this.baseKey.id "")}}
       {{#if (and options.firstStep (not this.tab))}}
@@ -122,11 +145,31 @@
         <EmptyState
           @title={{if
             (eq this.filter this.baseKey.id)
-            (concat "No " (pluralize options.item) " under &quot;" this.filter "&quot;")
-            (concat "No folders matching &quot;" this.filter "&quot;")
+            (concat "No " (pluralize options.item) ' under "' this.filter '".')
+            (concat 'No folders matching "' this.filter '".')
           }}
-        />
+        >
+          <LinkTo @route="vault.cluster.secrets.backend.list-root" @model={{this.backend}} data-test-list-root-link>
+            Back to root
+          </LinkTo>
+        </EmptyState>
+      {{else}}
+        <EmptyState @title={{(concat "No " (pluralize options.item) ' matching "' this.filter '".')}}>
+          <LinkTo @route="vault.cluster.secrets.backend.list-root" @model={{this.backend}} data-test-list-root-link>
+            Back to root
+          </LinkTo>
+        </EmptyState>
       {{/if}}
     {{/if}}
   {{/if}}
-{{/let}}
\ No newline at end of file
+{{/let}}
+
+{{#if this.engineToDisable}}
+  <ConfirmModal
+    @color="critical"
+    @confirmMessage="Any data in this engine will be permanently deleted."
+    @confirmTitle="Disable engine?"
+    @onClose={{fn (mut this.engineToDisable) null}}
+    @onConfirm={{perform this.disableEngine this.engineToDisable}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/backend/overview.hbs b/ui/app/templates/vault/cluster/secrets/backend/overview.hbs
index 55a93e5e02f..38545749974 100644
--- a/ui/app/templates/vault/cluster/secrets/backend/overview.hbs
+++ b/ui/app/templates/vault/cluster/secrets/backend/overview.hbs
@@ -1,15 +1,9 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<SecretListHeader
-  @isCertTab={{eq this.tab "cert"}}
-  @model={{this.model}}
-  @baseKey={{this.baseKey}}
-  @backendCrumb={{this.backendCrumb}}
-  @filter={{this.filter}}
-/>
+<SecretListHeader @model={{this.model}} />
 
 {{#if this.showEmptyState}}
   <div class="box is-fullwidth is-shadowless is-sideless is-paddingless is-marginless">
@@ -21,7 +15,7 @@
           @text="Connect a database"
           @query={{hash itemType="connection"}}
           @route="vault.cluster.secrets.backend.create-root"
-          data-test-secret-create="connections"
+          data-test-create-secret-link
         />
       {{/if}}
     </EmptyState>
@@ -33,26 +27,41 @@
         <OverviewCard
           @cardTitle="Connections"
           @subText="The total number of connections to external databases that you have access to."
-          @actionText="Configure new"
-          @actionTo="vault.cluster.secrets.backend.create-root"
-          @actionQuery={{hash itemType="connection"}}
         >
-          <Hds::Text::Display class="has-top-padding-m" @tag="h2" @size="500">
-            {{format-number (if (eq this.model.connections 404) 0 this.model.connections.length)}}
-          </Hds::Text::Display>
+          <:action>
+            <Hds::Link::Standalone
+              @text="Configure new"
+              @route="vault.cluster.secrets.backend.create-root"
+              @query={{hash itemType="connection"}}
+              @icon="plus"
+              @iconPosition="trailing"
+              data-test-action-text="Configure new"
+            />
+          </:action>
+          <:content>
+            <Hds::Text::Display class="has-top-padding-m" @tag="h2" @size="500">
+              {{format-number (if (eq this.model.connections 404) 0 this.model.connections.length)}}
+            </Hds::Text::Display>
+          </:content>
         </OverviewCard>
       {{/if}}
       {{#if (or this.model.roleCapabilities.canList this.model.staticRoleCapabilities.canList)}}
-        <OverviewCard
-          @cardTitle="Roles"
-          @subText="The total number of roles configured that you have permissions to list."
-          @actionText="Create new"
-          @actionTo="vault.cluster.secrets.backend.create-root"
-          @actionQuery={{hash itemType="role"}}
-        >
-          <Hds::Text::Display class="has-top-padding-m" @tag="h2" @size="500">
-            {{format-number (if (eq this.model.roles 404) 0 this.model.roles.length)}}
-          </Hds::Text::Display>
+        <OverviewCard @cardTitle="Roles" @subText="The total number of roles configured that you have permissions to list.">
+          <:action>
+            <Hds::Link::Standalone
+              @text="Create new"
+              @route="vault.cluster.secrets.backend.create-root"
+              @query={{hash itemType="role"}}
+              @icon="plus"
+              @iconPosition="trailing"
+              data-test-action-text="Create new"
+            />
+          </:action>
+          <:content>
+            <Hds::Text::Display class="has-top-padding-m" @tag="h2" @size="500">
+              {{format-number (if (eq this.model.roles 404) 0 this.model.roles.length)}}
+            </Hds::Text::Display>
+          </:content>
         </OverviewCard>
       {{/if}}
       <GetCredentialsCard
diff --git a/ui/app/templates/vault/cluster/secrets/backend/secret-edit-layout.hbs b/ui/app/templates/vault/cluster/secrets/backend/secret-edit-layout.hbs
index 078046560e4..cfa99c17cf7 100644
--- a/ui/app/templates/vault/cluster/secrets/backend/secret-edit-layout.hbs
+++ b/ui/app/templates/vault/cluster/secrets/backend/secret-edit-layout.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{component
   (get (options-for-backend this.backendType this.model.idPrefix) "editComponent")
diff --git a/ui/app/templates/vault/cluster/secrets/backend/sign.hbs b/ui/app/templates/vault/cluster/secrets/backend/sign.hbs
index 96fd787dcc5..649c55470f4 100644
--- a/ui/app/templates/vault/cluster/secrets/backend/sign.hbs
+++ b/ui/app/templates/vault/cluster/secrets/backend/sign.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -50,9 +50,7 @@
       <Hds::Copy::Button
         @text="Copy key"
         @textToCopy={{this.model.signedKey}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
         class="primary"
       />
     </div>
@@ -62,19 +60,14 @@
           @text="Copy lease ID"
           @textToCopy={{this.model.leaseId}}
           @onError={{(fn
-            (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
+            (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
           )}}
           class="secondary"
         />
       </div>
     {{/if}}
     <div class="control">
-      <Hds::Button
-        @text="Back"
-        @color="secondary"
-        {{on "click" (action "newModel")}}
-        data-test-secret-generate-back={{true}}
-      />
+      <Hds::Button @text="Back" @color="secondary" {{on "click" (action "newModel")}} data-test-back-button />
     </div>
   </div>
 {{else}}
@@ -83,48 +76,47 @@
       <MessageError @model={{this.model}} />
       <NamespaceReminder @mode="sign" @noun="SSH key" />
       {{#if this.model.attrs}}
-        {{#each (take 1 this.model.attrs) as |attr|}}
-          <FormFieldFromModel
-            @attr={{attr}}
-            @model={{this.model}}
-            @updateTtl={{action "updateTtl" attr.name}}
-            @emptyData={{this.emptyData}}
-            @codemirrorUpdated={{action "codemirrorUpdated" attr.name}}
-          />
-        {{/each}}
+        {{#let (find-by "name" "publicKey" this.model.attrs) as |attr|}}
+          <FormFieldFromModel @attr={{attr}} @model={{this.model}} />
+        {{/let}}
+        {{! valid_principals is required unless allow_empty_principals is true (not recommended) }}
+        {{#let (find-by "name" "validPrincipals" this.model.attrs) as |attr|}}
+          <FormFieldFromModel @attr={{attr}} @model={{this.model}} />
+        {{/let}}
         <ToggleButton @isOpen={{this.showOptions}} @onClick={{fn (mut this.showOptions)}} data-test-toggle-button />
         {{#if this.showOptions}}
           <div class="box is-marginless">
-            {{#each (drop 1 this.model.attrs) as |attr|}}
-              <FormFieldFromModel
-                @attr={{attr}}
-                @model={{this.model}}
-                @updateTtl={{action "updateTtl" attr.name}}
-                @emptyData={{this.emptyData}}
-                @codemirrorUpdated={{action "codemirrorUpdated" attr.name}}
-              />
+            {{#each this.model.attrs as |attr|}}
+              {{! These attrs render above, outside of the "More options" toggle }}
+              {{#if (not (includes attr.name (array "publicKey" "validPrincipals")))}}
+                <FormFieldFromModel
+                  @attr={{attr}}
+                  @model={{this.model}}
+                  @updateTtl={{action "updateTtl" attr.name}}
+                  @emptyData={{this.emptyData}}
+                  @editorUpdated={{action "editorUpdated" attr.name}}
+                />
+              {{/if}}
             {{/each}}
           </div>
         {{/if}}
       {{/if}}
     </div>
-    <div class="field is-grouped box is-fullwidth is-bottomless">
-      <Hds::ButtonSet>
-        <Hds::Button
-          @text="Sign"
-          @icon={{if this.loading "loading"}}
-          type="submit"
-          disabled={{this.loading}}
-          data-test-secret-generate
-        />
-        <Hds::Button
-          @text="Cancel"
-          @color="secondary"
-          @route="vault.cluster.secrets.backend.list-root"
-          @model={{this.backend.id}}
-          data-test-secret-generate-cancel
-        />
-      </Hds::ButtonSet>
-    </div>
+    <Hds::ButtonSet class="has-top-bottom-margin">
+      <Hds::Button
+        @text="Sign"
+        @icon={{if this.loading "loading"}}
+        type="submit"
+        disabled={{this.loading}}
+        data-test-submit
+      />
+      <Hds::Button
+        @text="Cancel"
+        @color="secondary"
+        @route="vault.cluster.secrets.backend.list-root"
+        @model={{this.backend.id}}
+        data-test-cancel
+      />
+    </Hds::ButtonSet>
   </form>
 {{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/backend/transit-actions-layout.hbs b/ui/app/templates/vault/cluster/secrets/backend/transit-actions-layout.hbs
index 9406dbfcef8..ced0bedf1c8 100644
--- a/ui/app/templates/vault/cluster/secrets/backend/transit-actions-layout.hbs
+++ b/ui/app/templates/vault/cluster/secrets/backend/transit-actions-layout.hbs
@@ -1,25 +1,20 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="columns">
   <div class="column">
     <PageHeader as |p|>
       <p.top>
-        <KeyValueHeader
-          @baseKey={{this.model}}
-          @path="vault.cluster.secrets.backend.list"
-          @mode={{this.mode}}
-          @root={{this.backendCrumb}}
-          @showCurrent={{true}}
-        />
+        <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
       </p.top>
       <p.levelLeft>
         <h1 class="title is-3">
           <SecretLink
             class="is-inline has-text-info"
             @secret={{this.model.id}}
+            @backend={{this.model.backend}}
             @mode="show"
             @replace={{true}}
             @queryParams={{hash tab="actions"}}
@@ -39,6 +34,7 @@
             <li class={{if (eq supportedAction.name this.selectedAction) "is-active"}}>
               <SecretLink
                 @mode="actions"
+                @backend={{this.model.backend}}
                 @secret={{this.model.id}}
                 @queryParams={{hash action=supportedAction.name}}
                 data-test-transit-action-link={{supportedAction.name}}
@@ -56,7 +52,6 @@
         </ul>
       </nav>
     </div>
-
     <TransitKeyActions @selectedAction={{this.selectedAction}} @key={{this.model}} />
   </div>
 </div>
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/backends.hbs b/ui/app/templates/vault/cluster/secrets/backends.hbs
index 5a86dd7e446..8ef02eeac26 100644
--- a/ui/app/templates/vault/cluster/secrets/backends.hbs
+++ b/ui/app/templates/vault/cluster/secrets/backends.hbs
@@ -1,124 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<PageHeader as |p|>
-  <p.levelLeft>
-    <h1 class="title is-3">
-      Secrets Engines
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-<Toolbar>
-  <ToolbarFilters>
-    <SearchSelect
-      @id="filter-by-engine-type"
-      @options={{this.secretEngineArrayByType}}
-      @selectLimit="1"
-      @disallowNewItems={{true}}
-      @fallbackComponent="input-search"
-      @onChange={{this.filterEngineType}}
-      @placeholder={{"Filter by engine type"}}
-      @displayInherit={{true}}
-      @inputValue={{if this.selectedEngineType (array this.selectedEngineType)}}
-      @disabled={{if this.selectedEngineName true false}}
-      class="is-marginless"
-    />
-    <SearchSelect
-      @id="filter-by-engine-name"
-      @options={{this.secretEngineArrayByName}}
-      @selectLimit="1"
-      @disallowNewItems={{true}}
-      @fallbackComponent="input-search"
-      @onChange={{this.filterEngineName}}
-      @placeholder={{"Filter by engine name"}}
-      @displayInherit={{true}}
-      @inputValue={{if this.selectedEngineName (array this.selectedEngineName)}}
-      class="is-marginless has-left-padding-s"
-    />
-  </ToolbarFilters>
-  <ToolbarActions>
-    <ToolbarLink @route="vault.cluster.settings.mount-secret-backend" @type="add" data-test-enable-engine>
-      Enable new engine
-    </ToolbarLink>
-  </ToolbarActions>
-</Toolbar>
-
-{{#each this.sortedDisplayableBackends as |backend|}}
-  <LinkedBlock
-    @params={{array backend.backendLink backend.id}}
-    class="list-item-row linked-block-item is-no-underline"
-    data-test-secrets-backend-link={{backend.id}}
-    @disabled={{not backend.isSupportedBackend}}
-  >
-    <div>
-      <div class="has-text-grey">
-        {{#if backend.icon}}
-          <Hds::TooltipButton @text={{or backend.engineType backend.path}} aria-label="Type of backend">
-            <Icon @name={{backend.icon}} class="has-text-grey-light" />
-          </Hds::TooltipButton>
-        {{/if}}
-        {{#if backend.path}}
-          {{#if backend.isSupportedBackend}}
-            <LinkTo
-              @route={{backend.backendLink}}
-              @model={{backend.id}}
-              class="has-text-black has-text-weight-semibold"
-              data-test-secret-path
-            >
-              {{backend.path}}
-            </LinkTo>
-          {{else}}
-            <span data-test-secret-path>{{backend.path}}</span>
-          {{/if}}
-        {{/if}}
-      </div>
-      {{#if backend.accessor}}
-        <code class="has-text-grey is-size-8">
-          {{if (eq backend.version 2) (concat "v2 " backend.accessor) backend.accessor}}
-        </code>
-      {{/if}}
-      {{#if backend.description}}
-        <ReadMore>
-          {{backend.description}}
-        </ReadMore>
-      {{/if}}
-    </div>
-    <div class="linked-block-popup-menu">
-      <Hds::Dropdown @isInline={{true}} as |dd|>
-        <dd.ToggleIcon
-          @icon="more-horizontal"
-          @text="{{if backend.isSupportedBackend 'supported' 'unsupported'}} secrets engine menu"
-          @hasChevron={{false}}
-          data-test-popup-menu-trigger
-        />
-        <dd.Interactive
-          @text="View configuration"
-          @route="vault.cluster.secrets.backend.configuration"
-          @model={{backend.id}}
-          data-test-engine-config
-        />
-        {{#if (not-eq backend.type "cubbyhole")}}
-          <dd.Interactive
-            @text="Disable"
-            @color="critical"
-            {{on "click" (fn (mut this.engineToDisable) backend)}}
-            data-test-confirm-action-trigger
-          />
-        {{/if}}
-      </Hds::Dropdown>
-    </div>
-  </LinkedBlock>
-{{/each}}
-
-{{#if this.engineToDisable}}
-  <ConfirmModal
-    @color="critical"
-    @confirmMessage="Any data in this engine will be permanently deleted."
-    @confirmTitle="Disable engine?"
-    @onClose={{fn (mut this.engineToDisable) null}}
-    @onConfirm={{perform this.disableEngine this.engineToDisable}}
-  />
-{{/if}}
\ No newline at end of file
+<SecretEngine::List @secretEngines={{this.model}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/enable/create.hbs b/ui/app/templates/vault/cluster/secrets/enable/create.hbs
new file mode 100644
index 00000000000..4360d2369d6
--- /dev/null
+++ b/ui/app/templates/vault/cluster/secrets/enable/create.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{action "onMountSuccess"}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/secrets/enable/index.hbs b/ui/app/templates/vault/cluster/secrets/enable/index.hbs
new file mode 100644
index 00000000000..c21886272b6
--- /dev/null
+++ b/ui/app/templates/vault/cluster/secrets/enable/index.hbs
@@ -0,0 +1,10 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<SecretEngines::Catalog
+  @setMountType={{this.setMountType}}
+  @pluginCatalogData={{this.model.pluginCatalogData}}
+  @pluginCatalogError={{this.model.pluginCatalogError}}
+/>
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/settings.hbs b/ui/app/templates/vault/cluster/settings.hbs
index 11a06fba008..f6eb0207f6a 100644
--- a/ui/app/templates/vault/cluster/settings.hbs
+++ b/ui/app/templates/vault/cluster/settings.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{outlet}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/settings/auth.hbs b/ui/app/templates/vault/cluster/settings/auth.hbs
index 7f312d2dfe9..2136badcf9c 100644
--- a/ui/app/templates/vault/cluster/settings/auth.hbs
+++ b/ui/app/templates/vault/cluster/settings/auth.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Sidebar::Nav::Access />
 {{outlet}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/settings/auth/configure.hbs b/ui/app/templates/vault/cluster/settings/auth/configure.hbs
index 4014d5310b4..28c87e73fb6 100644
--- a/ui/app/templates/vault/cluster/settings/auth/configure.hbs
+++ b/ui/app/templates/vault/cluster/settings/auth/configure.hbs
@@ -1,29 +1,33 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
-    <Hds::Breadcrumb>
+    <Hds::Breadcrumb data-test-breadcrumbs>
       <Hds::Breadcrumb::Item @text="Auth Methods" @route="vault.cluster.access.methods" />
-      <Hds::Breadcrumb::Item @text={{this.model.id}} @route="vault.cluster.access.method" @model={{this.model.id}} />
+      <Hds::Breadcrumb::Item
+        @text={{this.model.method.id}}
+        @route="vault.cluster.access.method"
+        @model={{this.model.method.id}}
+      />
       <Hds::Breadcrumb::Item @text="Configure" @current={{true}} />
     </Hds::Breadcrumb>
   </p.top>
   <p.levelLeft>
     <h1 class="title is-3">
       Configure
-      {{get (find-by "type" this.model.type (mountable-auth-methods)) "displayName"}}
+      {{get (engines-display-data this.model.method.methodType) "displayName"}}
     </h1>
   </p.levelLeft>
 </PageHeader>
 
-{{section-tabs this.model}}
+<SectionTabs @model={{this.model.method}} />
 
 <Toolbar>
   <ToolbarActions>
-    <ToolbarLink @route="vault.cluster.access.method" @model={{this.model.id}} data-test-backend-view-link>
+    <ToolbarLink @route="vault.cluster.access.method" @model={{this.model.method.id}} data-test-backend-view-link>
       View method
     </ToolbarLink>
   </ToolbarActions>
diff --git a/ui/app/templates/vault/cluster/settings/auth/configure/section.hbs b/ui/app/templates/vault/cluster/settings/auth/configure/section.hbs
index 8dfd7c834a3..84d43881776 100644
--- a/ui/app/templates/vault/cluster/settings/auth/configure/section.hbs
+++ b/ui/app/templates/vault/cluster/settings/auth/configure/section.hbs
@@ -1,10 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (eq this.model.section "options")}}
-  {{auth-config-form/options this.model.model}}
+  <AuthConfigForm::Options @form={{this.model.form}} />
 {{else}}
-  {{auth-config-form/config this.model.model}}
+  <AuthConfigForm::Config @form={{this.model.form}} @section={{this.model.section}} @method={{this.model.method}} />
 {{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/settings/auth/enable.hbs b/ui/app/templates/vault/cluster/settings/auth/enable.hbs
index af0416113fe..d5f1468e6ae 100644
--- a/ui/app/templates/vault/cluster/settings/auth/enable.hbs
+++ b/ui/app/templates/vault/cluster/settings/auth/enable.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <MountBackendForm @mountModel={{this.model}} @onMountSuccess={{action "onMountSuccess"}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/settings/configure-secret-backend.hbs b/ui/app/templates/vault/cluster/settings/configure-secret-backend.hbs
deleted file mode 100644
index ce6bb40264b..00000000000
--- a/ui/app/templates/vault/cluster/settings/configure-secret-backend.hbs
+++ /dev/null
@@ -1,52 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.top>
-    <KeyValueHeader
-      @baseKey={{this.model}}
-      @path="vault.cluster.secrets.backend"
-      @root={{this.root}}
-      @showCurrent={{true}}
-    />
-  </p.top>
-  <p.levelLeft>
-    <h1 class="title is-3">
-      Configure
-      {{get (options-for-backend this.model.type) "displayName"}}
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-<Toolbar>
-  <ToolbarActions>
-    <ToolbarLink @route="vault.cluster.secrets.backend" @model={{this.model.id}} data-test-backend-view-link>
-      View backend
-    </ToolbarLink>
-  </ToolbarActions>
-</Toolbar>
-
-{{#if (eq this.model.type "aws")}}
-  <ConfigureAwsSecret
-    @model={{this.model}}
-    @tab={{this.tab}}
-    @accessKey={{this.accessKey}}
-    @secretKey={{this.secretKey}}
-    @region={{this.region}}
-    @iamEndpoint={{this.iamEndpoint}}
-    @stsEndpoint={{this.stsEndpoint}}
-    @saveAWSRoot={{action "save" "saveAWSRoot"}}
-    @saveAWSLease={{action "save" "saveAWSLease"}}
-  />
-{{else if (eq this.model.type "ssh")}}
-  <ConfigureSshSecret
-    @model={{this.model}}
-    @configured={{this.configured}}
-    @saveConfig={{action "saveConfig"}}
-    @loading={{this.loading}}
-  />
-{{/if}}
-
-{{outlet}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/settings/mount-secret-backend.hbs b/ui/app/templates/vault/cluster/settings/mount-secret-backend.hbs
deleted file mode 100644
index 53bbf45d9d1..00000000000
--- a/ui/app/templates/vault/cluster/settings/mount-secret-backend.hbs
+++ /dev/null
@@ -1,6 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<MountBackendForm @mountModel={{this.model}} @mountType="secret" @onMountSuccess={{action "onMountSuccess"}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/settings/seal.hbs b/ui/app/templates/vault/cluster/settings/seal.hbs
index 0b6d738e3f0..5d2a6b82860 100644
--- a/ui/app/templates/vault/cluster/settings/seal.hbs
+++ b/ui/app/templates/vault/cluster/settings/seal.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/app/templates/vault/cluster/storage-restore.hbs b/ui/app/templates/vault/cluster/storage-restore.hbs
index 6da667cb6d5..dc4c3f4f6d0 100644
--- a/ui/app/templates/vault/cluster/storage-restore.hbs
+++ b/ui/app/templates/vault/cluster/storage-restore.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <RaftStorageRestore />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/storage.hbs b/ui/app/templates/vault/cluster/storage.hbs
index 0623cb37fc0..69d3a280952 100644
--- a/ui/app/templates/vault/cluster/storage.hbs
+++ b/ui/app/templates/vault/cluster/storage.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <RaftStorageOverview @model={{this.model}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/tools.hbs b/ui/app/templates/vault/cluster/tools.hbs
index 2babffee56a..246ad244633 100644
--- a/ui/app/templates/vault/cluster/tools.hbs
+++ b/ui/app/templates/vault/cluster/tools.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Sidebar::Nav::Tools />
 {{outlet}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/tools/error.hbs b/ui/app/templates/vault/cluster/tools/error.hbs
index f8ccc8d6bbb..d706b38fcc8 100644
--- a/ui/app/templates/vault/cluster/tools/error.hbs
+++ b/ui/app/templates/vault/cluster/tools/error.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <NotFound @model={{this.model}} />
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/tools/tool.hbs b/ui/app/templates/vault/cluster/tools/tool.hbs
index 609ff360f7c..1a3e78998c0 100644
--- a/ui/app/templates/vault/cluster/tools/tool.hbs
+++ b/ui/app/templates/vault/cluster/tools/tool.hbs
@@ -1,6 +1,20 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<ToolActionsForm @selectedAction={{this.selectedAction}} />
\ No newline at end of file
+{{#if (eq this.selectedAction "hash")}}
+  <Tools::Hash />
+{{else if (eq this.selectedAction "random")}}
+  <Tools::Random />
+{{else if (eq this.selectedAction "rewrap")}}
+  <Tools::Rewrap />
+{{else if (eq this.selectedAction "unwrap")}}
+  <Tools::Unwrap />
+{{else if (eq this.selectedAction "lookup")}}
+  <Tools::Lookup />
+{{else if (eq this.selectedAction "wrap")}}
+  <Tools::Wrap />
+{{else}}
+  <EmptyState @title="Tool not available" />
+{{/if}}
\ No newline at end of file
diff --git a/ui/app/templates/vault/cluster/unseal.hbs b/ui/app/templates/vault/cluster/unseal.hbs
index d3d06ebbfbe..225b49d0500 100644
--- a/ui/app/templates/vault/cluster/unseal.hbs
+++ b/ui/app/templates/vault/cluster/unseal.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.showLicenseError}}
   <div class="section is-flex-v-centered-tablet is-flex-grow-1 is-fullwidth">
diff --git a/ui/app/templates/vault/cluster/usage-reporting.hbs b/ui/app/templates/vault/cluster/usage-reporting.hbs
new file mode 100644
index 00000000000..33bfe52bd78
--- /dev/null
+++ b/ui/app/templates/vault/cluster/usage-reporting.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Usage::Page />
\ No newline at end of file
diff --git a/ui/app/templates/vault/error.hbs b/ui/app/templates/vault/error.hbs
index 343b38e1e22..8d92ce6461f 100644
--- a/ui/app/templates/vault/error.hbs
+++ b/ui/app/templates/vault/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="is-flex-grow-1 is-flex-v-centered">
   <div class="empty-state-content">
diff --git a/ui/app/templates/vault/not-found.hbs b/ui/app/templates/vault/not-found.hbs
index f8ccc8d6bbb..d706b38fcc8 100644
--- a/ui/app/templates/vault/not-found.hbs
+++ b/ui/app/templates/vault/not-found.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <NotFound @model={{this.model}} />
\ No newline at end of file
diff --git a/ui/app/transforms/array.js b/ui/app/transforms/array.js
index aeaa5ab4a8a..b17171c6a4a 100644
--- a/ui/app/transforms/array.js
+++ b/ui/app/transforms/array.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Transform from '@ember-data/serializer/transform';
-import { isArray, A } from '@ember/array';
+import { isArray } from '@ember/array';
 /*
   This should go inside a globally available place for all apps
 
@@ -13,16 +13,16 @@ import { isArray, A } from '@ember/array';
 export default class ArrayTransform extends Transform {
   deserialize(value) {
     if (isArray(value)) {
-      return A(value);
+      return [...value];
     } else {
-      return A();
+      return [];
     }
   }
   serialize(value) {
     if (isArray(value)) {
-      return A(value);
+      return [...value];
     } else {
-      return A();
+      return [];
     }
   }
 }
diff --git a/ui/app/transforms/comma-string.js b/ui/app/transforms/comma-string.js
index fd536cc823c..8db68da03ca 100644
--- a/ui/app/transforms/comma-string.js
+++ b/ui/app/transforms/comma-string.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/transforms/date-time-local.js b/ui/app/transforms/date-time-local.js
index 313ce95d10a..9d59930080c 100644
--- a/ui/app/transforms/date-time-local.js
+++ b/ui/app/transforms/date-time-local.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/transforms/mount-visibility.js b/ui/app/transforms/mount-visibility.js
index 7a89bf34240..56c6c26f2d8 100644
--- a/ui/app/transforms/mount-visibility.js
+++ b/ui/app/transforms/mount-visibility.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/transforms/object.js b/ui/app/transforms/object.js
index 31f06690728..7663a422e34 100644
--- a/ui/app/transforms/object.js
+++ b/ui/app/transforms/object.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/utils/all-engines-metadata.ts b/ui/app/utils/all-engines-metadata.ts
new file mode 100644
index 00000000000..4fe17cd77b0
--- /dev/null
+++ b/ui/app/utils/all-engines-metadata.ts
@@ -0,0 +1,370 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+/**
+ * Metadata configuration for secret and auth engines, including enterprise.
+ *
+ * This file defines and exports engine metadata, including its
+ * displayName, mountCategory, requiresEnterprise, and other relevant properties. It serves as a
+ * centralized source of truth for engine-related configurations.
+ *
+ * Key responsibilities:
+ * - Define metadata for all engines.
+ * - Provide utility functions or constants for accessing engine-specific data.
+ * - Facilitate dynamic engine rendering and behavior based on metadata.
+ *
+ * Example usage:
+ * // If an enterprise license is present, return all secret engines;
+ * // otherwise, return only the secret engines supported in OSS.
+ * return filterEnginesByMountCategory({ mountCategory: 'secret', isEnterprise: this.version.isEnterprise });
+ */
+
+export interface EngineDisplayData {
+  pluginCategory?: string; // The plugin category is used to group engines in the UI. e.g., 'cloud', 'infra', 'generic'
+  displayName: string;
+  engineRoute?: string; // engines that have their own Ember engine will have this route defined.
+  glyph?: string;
+  isWIF?: boolean; // flag for 'Workload Identity Federation' engines. - https://developer.hashicorp.com/hcp/docs/hcp/iam/service-principal/workload-identity-federation
+  mountCategory: string[];
+  requiredFeature?: string; // flag for engines that require the ADP (Advanced Data Protection) feature. - https://www.hashicorp.com/en/blog/advanced-data-protection-adp-now-available-in-hcp-vault
+  requiresEnterprise?: boolean;
+  isConfigurable?: boolean; // for secret engines that have their own configuration page and actions. - These engines do not exist in their own Ember engine.
+  isOnlyMountable?: boolean; // The UI only supports configuration views for these secrets engines. The CLI must be used to manage other engine resources (i.e. roles, credentials).
+  isOldEngine?: boolean; // flag for engine views, if set to true, the engine will show pre-existing page design, if not, then the new views will be used. This is temporary until all engines have been migrated to the new design.
+  type: string;
+  value?: string;
+}
+
+/**
+ * @param mountCategory - Given mount category to filter by, e.g., 'auth' or 'secret'.
+ * @param isEnterprise - Optional boolean to indicate if enterprise engines should be included in the results.
+ * @returns Filtered array of engines that match the given mount category
+ */
+export function filterEnginesByMountCategory({
+  mountCategory,
+  isEnterprise = false,
+}: {
+  mountCategory: 'auth' | 'secret';
+  isEnterprise: boolean;
+}) {
+  return isEnterprise
+    ? ALL_ENGINES.filter((engine) => engine.mountCategory.includes(mountCategory))
+    : ALL_ENGINES.filter(
+        (engine) => engine.mountCategory.includes(mountCategory) && !engine.requiresEnterprise
+      );
+}
+
+export function isAddonEngine(type: string, version: number) {
+  if (type === 'kv' && version === 1) return false;
+  const engineRoute = ALL_ENGINES.find((engine) => engine.type === type)?.engineRoute;
+  return !!engineRoute;
+}
+
+export const ALL_ENGINES: EngineDisplayData[] = [
+  {
+    pluginCategory: 'cloud',
+    displayName: 'AliCloud',
+    glyph: 'alibaba-color',
+    isOldEngine: true,
+    mountCategory: ['auth', 'secret'],
+    type: 'alicloud',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'AppRole',
+    glyph: 'cpu',
+    isOldEngine: true,
+    mountCategory: ['auth'],
+    type: 'approle',
+    value: 'approle',
+  },
+  {
+    pluginCategory: 'cloud',
+    displayName: 'AWS',
+    glyph: 'aws-color',
+    isConfigurable: true,
+    isOldEngine: true,
+    isWIF: true,
+    mountCategory: ['auth', 'secret'],
+    type: 'aws',
+  },
+  {
+    pluginCategory: 'cloud',
+    displayName: 'Azure',
+    glyph: 'azure-color',
+    isOldEngine: true,
+    isOnlyMountable: true,
+    isConfigurable: true,
+    isWIF: true,
+    mountCategory: ['auth', 'secret'],
+    type: 'azure',
+  },
+  {
+    pluginCategory: 'infra',
+    displayName: 'Consul',
+    glyph: 'consul-color',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    type: 'consul',
+  },
+  {
+    displayName: 'Cubbyhole',
+    isOldEngine: true,
+    type: 'cubbyhole',
+    mountCategory: ['secret'],
+  },
+  {
+    pluginCategory: 'infra',
+    displayName: 'Databases',
+    glyph: 'database',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    type: 'database',
+  },
+  {
+    pluginCategory: 'cloud',
+    displayName: 'GitHub',
+    glyph: 'github-color',
+    isOldEngine: true,
+    mountCategory: ['auth'],
+    type: 'github',
+    value: 'github',
+  },
+  {
+    pluginCategory: 'cloud',
+    displayName: 'Google Cloud',
+    glyph: 'gcp-color',
+    isOldEngine: true,
+    isOnlyMountable: true,
+    isConfigurable: true,
+    isWIF: true,
+    mountCategory: ['auth', 'secret'],
+    type: 'gcp',
+  },
+  {
+    pluginCategory: 'cloud',
+    displayName: 'Google Cloud KMS',
+    glyph: 'gcp-color',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    type: 'gcpkms',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'JWT',
+    glyph: 'jwt',
+    isOldEngine: true,
+    mountCategory: ['auth'],
+    type: 'jwt',
+    value: 'jwt',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'KV',
+    engineRoute: 'kv.list',
+    glyph: 'key-values',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    type: 'kv',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'KMIP',
+    engineRoute: 'kmip.scopes.index',
+    glyph: 'lock',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    requiredFeature: 'KMIP',
+    requiresEnterprise: true,
+    type: 'kmip',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'Transform',
+    glyph: 'transform-data',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    requiredFeature: 'Transform Secrets Engine',
+    requiresEnterprise: true,
+    type: 'transform',
+  },
+  {
+    pluginCategory: 'cloud',
+    displayName: 'Key Management',
+    glyph: 'key',
+    mountCategory: ['secret'],
+    requiredFeature: 'Key Management Secrets Engine',
+    requiresEnterprise: true,
+    type: 'keymgmt',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'Kubernetes',
+    engineRoute: 'kubernetes.overview',
+    glyph: 'kubernetes-color',
+    isOldEngine: true,
+    mountCategory: ['auth', 'secret'],
+    type: 'kubernetes',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'LDAP',
+    engineRoute: 'ldap.overview',
+    glyph: 'folder-users',
+    isOldEngine: true,
+    mountCategory: ['auth', 'secret'],
+    type: 'ldap',
+  },
+  {
+    pluginCategory: 'infra',
+    displayName: 'Nomad',
+    glyph: 'nomad-color',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    type: 'nomad',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'OIDC',
+    glyph: 'openid-color',
+    isOldEngine: true,
+    mountCategory: ['auth'],
+    type: 'oidc',
+    value: 'oidc',
+  },
+  {
+    pluginCategory: 'infra',
+    displayName: 'Okta',
+    glyph: 'okta-color',
+    isOldEngine: true,
+    mountCategory: ['auth'],
+    type: 'okta',
+    value: 'okta',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'PKI Certificates',
+    engineRoute: 'pki.overview',
+    glyph: 'certificate',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    type: 'pki',
+  },
+  {
+    pluginCategory: 'infra',
+    displayName: 'RADIUS',
+    glyph: 'mainframe',
+    isOldEngine: true,
+    mountCategory: ['auth'],
+    type: 'radius',
+    value: 'radius',
+  },
+  {
+    pluginCategory: 'infra',
+    displayName: 'RabbitMQ',
+    glyph: 'rabbitmq-color',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    type: 'rabbitmq',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'SAML',
+    glyph: 'saml-color',
+    isOldEngine: true,
+    mountCategory: ['auth'],
+    requiresEnterprise: true,
+    type: 'saml',
+    value: 'saml',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'SSH',
+    glyph: 'terminal-screen',
+    isOldEngine: true,
+    isConfigurable: true,
+    mountCategory: ['secret'],
+    type: 'ssh',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'TLS Certificates',
+    glyph: 'certificate',
+    isOldEngine: true,
+    mountCategory: ['auth'],
+    type: 'cert',
+    value: 'cert',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'TOTP',
+    glyph: 'history',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    type: 'totp',
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'Transit',
+    glyph: 'swap-horizontal',
+    isOldEngine: true,
+    mountCategory: ['secret'],
+    type: 'transit',
+  },
+  {
+    displayName: 'Token',
+    isOldEngine: true,
+    type: 'token',
+    mountCategory: ['auth'],
+  },
+  {
+    pluginCategory: 'generic',
+    displayName: 'Userpass',
+    glyph: 'users',
+    isOldEngine: true,
+    mountCategory: ['auth'],
+    type: 'userpass',
+    value: 'userpass',
+  },
+
+  // TODO: enable builtin plugins after confirming with Product
+  //
+  // {
+  //   pluginCategory: 'generic',
+  //   displayName: 'Ad',
+  //   glyph: 'folder',
+  //   isOldEngine: true,
+  //   isOnlyMountable: true,
+  //   mountCategory: ['secret'],
+  //   type: 'ad',
+  // },
+  // {
+  //   pluginCategory: 'cloud',
+  //   displayName: 'MongoDB Atlas',
+  //   glyph: 'mongodb-color',
+  //   isOldEngine: true,
+  //   isOnlyMountable: true,
+  //   mountCategory: ['secret'],
+  //   type: 'mongodbatlas',
+  // },
+  // {
+  //   pluginCategory: 'infra',
+  //   displayName: 'OpenLDAP',
+  //   glyph: 'folder-users',
+  //   isOldEngine: true,
+  //   isOnlyMountable: true,
+  //   mountCategory: ['secret'],
+  //   type: 'openldap',
+  // },
+  // {
+  //   pluginCategory: 'infra',
+  //   displayName: 'Terraform',
+  //   glyph: 'terraform-color',
+  //   isOldEngine: true,
+  //   isOnlyMountable: true,
+  //   mountCategory: ['secret'],
+  //   type: 'terraform',
+  // },
+];
diff --git a/ui/app/utils/analytic-events/index.ts b/ui/app/utils/analytic-events/index.ts
new file mode 100644
index 00000000000..dcacf3a14de
--- /dev/null
+++ b/ui/app/utils/analytic-events/index.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const PREFIX = 'vault_ui';
+
+/*
+  buildEventName is a helper to build conformant analytics event names. 
+
+  While event names are not strictly controlled in the data warehouse, consistent
+    naming helps find things predictably.
+
+  
+*/
+const buildEventName = (category: string, resource: string, action: string) =>
+  `${PREFIX}_${category}_${resource}_${action}`;
+
+export const TOGGLE_WEB_REPL = buildEventName('core', 'web-repl', 'toggle');
diff --git a/ui/app/utils/analytics-providers/dummy.ts b/ui/app/utils/analytics-providers/dummy.ts
new file mode 100644
index 00000000000..11e2bb29bca
--- /dev/null
+++ b/ui/app/utils/analytics-providers/dummy.ts
@@ -0,0 +1,33 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+/*
+  Normally, the default export of this file would _do something_. 
+  In the dummy case, the methods for the provider are noops so we
+    have a safe fallback when analytics is disabled.
+*/
+import type { AnalyticsProvider } from 'vault/vault/analytics';
+
+export const PROVIDER_NAME = 'dummy';
+
+export class DummyProvider implements AnalyticsProvider {
+  name = PROVIDER_NAME;
+
+  start() {
+    /* intentionally blank */
+  }
+
+  identify() {
+    /* intentionally blank */
+  }
+
+  trackPageView() {
+    /* intentionally blank */
+  }
+
+  trackEvent() {
+    /* intentionally blank */
+  }
+}
diff --git a/ui/app/utils/analytics-providers/posthog.ts b/ui/app/utils/analytics-providers/posthog.ts
new file mode 100644
index 00000000000..653c1599c28
--- /dev/null
+++ b/ui/app/utils/analytics-providers/posthog.ts
@@ -0,0 +1,170 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import posthog from 'posthog-js/dist/module.no-external';
+
+import type { AnalyticsProvider } from 'vault/vault/analytics';
+import type { CaptureResult } from 'posthog-js/dist/module.no-external';
+
+interface PostHogConfig {
+  enabled: boolean;
+  project_id: string;
+  api_host: string;
+}
+
+/*
+  formatEvent takes the default posthog capture event and trims it down to only the things we want to collect
+  PostHog collects a lot of stuff by default, this removes everything pretaining to urls and possible customer info in favor of generic information
+*/
+const redactEvent = (cr: CaptureResult | null) => {
+  if (cr === null) return cr;
+  const { properties } = cr;
+
+  // extract ONLY what we need
+  // this is definitely ridiculous, but it's the best way to be sure we're not accidentally including things that aren't wanted
+  const {
+    $browser,
+    $browser_language,
+    $browser_language_prefix,
+    $browser_version,
+    $device_id,
+    $device_type,
+    $groups,
+    $insert_id,
+    $is_identified,
+    $lib,
+    $lib_rate_limit_remaining_tokens,
+    $lib_version,
+    $os,
+    $os_version,
+    $pageview_id,
+    $process_person_profile,
+    $raw_user_agent,
+    $recording_status,
+    $screen_height,
+    $screen_width,
+    $sdk_debug_current_session_duration,
+    $sdk_debug_replay_internal_buffer_length,
+    $sdk_debug_replay_internal_buffer_size,
+    $sdk_debug_retry_queue_size,
+    $sdk_debug_session_start,
+    $session_id,
+    $time,
+    $user_id,
+    $viewport_height,
+    $viewport_width,
+    $window_id,
+    distinct_id,
+    routeName,
+    token,
+  } = properties;
+
+  // replay into the sent object
+  return {
+    ...cr,
+    properties: {
+      $browser,
+      $browser_version,
+      $browser_language,
+      $browser_language_prefix,
+      $os,
+      $os_version,
+      $device_type,
+      $raw_user_agent,
+      $screen_height,
+      $screen_width,
+      $viewport_height,
+      $viewport_width,
+      $lib,
+      $lib_version,
+      $insert_id,
+      $time,
+      $device_id,
+      $user_id,
+      $groups,
+      $session_id,
+      $window_id,
+      $recording_status,
+      $sdk_debug_replay_internal_buffer_length,
+      $sdk_debug_replay_internal_buffer_size,
+      $sdk_debug_current_session_duration,
+      $sdk_debug_session_start,
+      $sdk_debug_retry_queue_size,
+      $pageview_id,
+      $is_identified,
+      $process_person_profile,
+      $lib_rate_limit_remaining_tokens,
+      distinct_id,
+      routeName,
+      token,
+    },
+  };
+};
+
+export const PROVIDER_NAME = 'posthog';
+
+export class PostHogProvider implements AnalyticsProvider {
+  name = PROVIDER_NAME;
+
+  client = posthog;
+  licenseId = '';
+
+  get anonymousId() {
+    return this.client.get_distinct_id();
+  }
+
+  start(config: unknown) {
+    const { enabled, project_id, api_host } = config as PostHogConfig;
+
+    if (enabled) {
+      this.client.init(project_id, {
+        api_host,
+        person_profiles: 'identified_only',
+        persistence: 'memory',
+        autocapture: false,
+        disable_session_recording: true,
+        advanced_disable_decide: true,
+        capture_pageview: false,
+        before_send: redactEvent,
+      });
+    }
+  }
+
+  identify(identifier: string, traits: Record<string, string>) {
+    this.licenseId = traits['licenseId'] || '';
+
+    this.client.identify(identifier, {
+      ...traits,
+    });
+  }
+
+  trackPageView(routeName: string /* metadata: Record<string, string> */) {
+    // use licenseId as a grouping for this cluster
+    if (this.licenseId) {
+      this.client.capture('$pageview', {
+        routeName,
+        $groups: {
+          licenseId: this.licenseId,
+        },
+      });
+    } else {
+      this.client.capture('$pageview', { routeName });
+    }
+  }
+
+  trackEvent(eventName: string, metadata: Record<string, string> = {}) {
+    // use licenseId as a grouping for this cluster
+    if (this.licenseId) {
+      this.client.capture(eventName, {
+        ...metadata,
+        $groups: {
+          licenseId: this.licenseId,
+        },
+      });
+    } else {
+      this.client.capture(eventName, metadata);
+    }
+  }
+}
diff --git a/ui/app/utils/api-path.js b/ui/app/utils/api-path.js
index c89460e2743..5a5d8a70c5c 100644
--- a/ui/app/utils/api-path.js
+++ b/ui/app/utils/api-path.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/utils/auth-form-helpers.ts b/ui/app/utils/auth-form-helpers.ts
new file mode 100644
index 00000000000..68315a18589
--- /dev/null
+++ b/ui/app/utils/auth-form-helpers.ts
@@ -0,0 +1,45 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+/**
+ * The web UI only supports logging in with these auth methods.
+ * This is a subset of the methods found in the `all-engines-metadata` util,
+ * which includes all the methods that can be enabled and mounted.
+ */
+
+const BASE_LOGIN_METHODS = ['github', 'jwt', 'ldap', 'oidc', 'okta', 'radius', 'token', 'userpass'];
+
+export const ENTERPRISE_LOGIN_METHODS = ['saml'];
+
+export const supportedTypes = (isEnterprise: boolean) => {
+  return isEnterprise ? [...BASE_LOGIN_METHODS, ...ENTERPRISE_LOGIN_METHODS] : [...BASE_LOGIN_METHODS];
+};
+
+// this ensures no unexpected params are injected and submitted in the login form
+// 'namespace' and 'path' are intentionally omitted because they are handled explicitly
+export const POSSIBLE_FIELDS = ['role', 'jwt', 'password', 'token', 'username'];
+
+// maps OIDC provider domain to display name for oidc-jwt auth form
+export const DOMAIN_PROVIDER_MAP = {
+  'github.com': 'GitHub',
+  'gitlab.com': 'GitLab',
+  'google.com': 'Google',
+  'ping.com': 'Ping Identity',
+  'okta.com': 'Okta',
+  'auth0.com': 'Auth0',
+  'login.microsoftonline.com': 'Azure',
+};
+
+export const ERROR_POPUP_FAILED =
+  'Your web browser may have blocked or closed a pop-up window. Please check your settings and click "Sign in" to try again.';
+
+export const ERROR_WINDOW_CLOSED = `The provider window was closed before authentication was complete. ${ERROR_POPUP_FAILED}`;
+
+export const ERROR_JWT_LOGIN = 'OIDC login is not configured for this mount';
+
+export const ERROR_MISSING_PARAMS =
+  'The callback from the provider did not supply all of the required parameters.  Please click Sign In to try again. If the problem persists, you may want to contact your administrator.';
+
+export const ERROR_TIMEOUT = 'The authentication request has timed out. Please click "Sign in" to try again.';
diff --git a/ui/app/utils/camelize-object-keys.js b/ui/app/utils/camelize-object-keys.js
index ac8adbaf0a3..4d1f4613843 100644
--- a/ui/app/utils/camelize-object-keys.js
+++ b/ui/app/utils/camelize-object-keys.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 import { camelize } from '@ember/string';
diff --git a/ui/app/utils/chart-helpers.js b/ui/app/utils/chart-helpers.js
index cf9a150cdd0..6f2689fcd91 100644
--- a/ui/app/utils/chart-helpers.js
+++ b/ui/app/utils/chart-helpers.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,7 @@ import { format } from 'd3-format';
 import { mean } from 'd3-array';
 
 // COLOR THEME:
-export const BLUE_PALETTE = ['#cce3fe', '#0c56e9', '#1c345f']; // blues from https://helios.hashicorp.design/foundations/colors?tab=palette#core-palette
+export const BAR_PALETTE = ['#CCE3FE', '#1060FF', '#C2C5CB', '#656A76'];
 export const UPGRADE_WARNING = '#FDEEBA';
 export const GREY = '#EBEEF2';
 
@@ -15,10 +15,10 @@ export const GREY = '#EBEEF2';
 export const TRANSLATE = { left: -11 };
 export const SVG_DIMENSIONS = { height: 190, width: 500 };
 
-export const BAR_WIDTH = 7; // data bar width is 7 pixels
+export const BAR_WIDTH = 17; // data bar width is 17 pixels
 
 // Reference for tickFormat https://www.youtube.com/watch?v=c3MCROTNN8g
-export function formatNumbers(number) {
+export function numericalAxisLabel(number) {
   if (number < 1000) return number;
   if (number < 1100) return format('.1s')(number);
   if (number < 2000) return format('.2s')(number); // between 1k and 2k, show 2 decimals
diff --git a/ui/app/utils/clamp.js b/ui/app/utils/clamp.js
index 3521b2215cd..2d8e2c6f1d1 100644
--- a/ui/app/utils/clamp.js
+++ b/ui/app/utils/clamp.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/utils/constants/capabilities.ts b/ui/app/utils/constants/capabilities.ts
new file mode 100644
index 00000000000..ed2a489c813
--- /dev/null
+++ b/ui/app/utils/constants/capabilities.ts
@@ -0,0 +1,30 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import apiPath from 'vault/utils/api-path';
+
+export const SUDO_PATHS = [
+  'sys/seal',
+  'sys/replication/performance/primary/secondary-token',
+  'sys/replication/dr/primary/secondary-token',
+  'sys/replication/reindex',
+  'sys/leases/lookup/',
+];
+
+export const SUDO_PATH_PREFIXES = ['sys/leases/revoke-prefix', 'sys/leases/revoke-force'];
+
+export const PATH_MAP = {
+  customLogin: apiPath`sys/config/ui/login/default-auth/${'id'}`,
+  customMessages: apiPath`sys/config/ui/custom-messages/${'id'}`,
+  syncActivate: apiPath`sys/activation-flags/secrets-sync/activate`,
+  syncDestination: apiPath`sys/sync/destinations/${'type'}/${'name'}`,
+  syncSetAssociation: apiPath`sys/sync/destinations/${'type'}/${'name'}/associations/set`,
+  syncRemoveAssociation: apiPath`sys/sync/destinations/${'type'}/${'name'}/associations/remove`,
+  kvConfig: apiPath`${'path'}/config`,
+  kvMetadata: apiPath`${'backend'}/metadata/${'path'}`,
+  authMethodConfig: apiPath`auth/${'path'}/config`,
+  authMethodConfigAws: apiPath`auth/${'path'}/config/client`,
+  authMethodDelete: apiPath`sys/auth/${'path'}`,
+};
diff --git a/ui/app/utils/error-message.js b/ui/app/utils/error-message.js
index 62cb692fd66..5019d371191 100644
--- a/ui/app/utils/error-message.js
+++ b/ui/app/utils/error-message.js
@@ -1,8 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+/**
+ * deprecated in favor of api-error-message for use with the api service
+ * this util will be removed once Ember Data is fully removed
+ * new requests should be made with api service
+ * if Ember Data is still needed during the migration then this util may be used
+ */
+
 // accepts an error and returns error.errors joined with a comma, error.message or a fallback message
 export default function (error, fallbackMessage = 'An error occurred, please try again') {
   if (error instanceof Error && error?.errors && typeof error.errors[0] === 'string') {
diff --git a/ui/app/utils/field-to-attrs.js b/ui/app/utils/field-to-attrs.js
index cd32bf3a867..22bdd5287a8 100644
--- a/ui/app/utils/field-to-attrs.js
+++ b/ui/app/utils/field-to-attrs.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/utils/forms/field-group.ts b/ui/app/utils/forms/field-group.ts
new file mode 100644
index 00000000000..922da21ffd9
--- /dev/null
+++ b/ui/app/utils/forms/field-group.ts
@@ -0,0 +1,16 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type FormField from './field';
+
+// very simple util class that accepts a key and an array of form fields
+// returns an object in the expected shape for use in the formFieldsGroup array of forms
+export default class FormFieldGroup {
+  [key: string]: FormField[]; // Add an index signature to allow dynamic property assignment
+
+  constructor(groupName: string, fields: FormField[]) {
+    this[groupName] = fields;
+  }
+}
diff --git a/ui/app/utils/forms/field.ts b/ui/app/utils/forms/field.ts
new file mode 100644
index 00000000000..fe86780daf0
--- /dev/null
+++ b/ui/app/utils/forms/field.ts
@@ -0,0 +1,42 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export interface FieldOptions {
+  label?: string;
+  subText?: string;
+  fieldValue?: string;
+  editType?: string;
+  defaultValue?: unknown;
+  possibleValues?: unknown[];
+  allowWhiteSpace?: boolean;
+  isSingleRow?: boolean;
+  keyPlaceholder?: string;
+  valuePlaceholder?: string;
+  editDisabled?: boolean;
+  sensitive?: boolean;
+  noCopy?: boolean;
+  docLink?: string;
+  helpText?: string;
+  helperTextDisabled?: string;
+  helperTextEnabled?: string;
+  placeholder?: string;
+  noDefault?: boolean;
+  isSectionHeader?: boolean;
+}
+
+export default class FormField {
+  name = '';
+  type: string | undefined;
+  options: FieldOptions = {};
+
+  constructor(key: string, type?: string, options: FieldOptions = {}) {
+    this.name = key;
+    this.type = type;
+    this.options = {
+      ...options,
+      fieldValue: options.fieldValue || key,
+    };
+  }
+}
diff --git a/ui/app/utils/forms/validate.ts b/ui/app/utils/forms/validate.ts
new file mode 100644
index 00000000000..f298cfb26d2
--- /dev/null
+++ b/ui/app/utils/forms/validate.ts
@@ -0,0 +1,85 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+/* eslint-disable no-console */
+
+import validators from 'vault/utils/forms/validators';
+import { get } from '@ember/object';
+
+import type { Validations, ValidationMap, FormValidations } from 'vault/app-types';
+
+export const generateErrorCountMessage = (errorCount: number) => {
+  if (errorCount < 1) return '';
+  // returns count specific message: 'There is an error/are N errors with this form.'
+  const isPlural = errorCount > 1 ? `are ${errorCount} errors` : false;
+  return `There ${isPlural ? isPlural : 'is an error'} with this form.`;
+};
+
+export const validate = (
+  data?: unknown,
+  validations?: Validations,
+  validationMapKey = ''
+): FormValidations => {
+  let isValid = true;
+  const state: ValidationMap = {};
+  let errorCount = 0;
+
+  // consider valid when validations are not provided
+  if (!validations) {
+    return { isValid: true, state, invalidFormMessage: '' };
+  }
+
+  for (const key in validations) {
+    const rules = validations[key];
+
+    if (!Array.isArray(rules)) {
+      console.error(`Must provide validations as an array for property "${key}".`);
+      continue;
+    }
+
+    // a stateKey may be passed in to map the validations to a nested object
+    // eg. validate(this.data, validations, 'data') => { 'data.key': { errors: [], warnings: [], isValid: true } }
+    const stateKey = validationMapKey ? `${validationMapKey}.${key}` : key;
+    state[stateKey] = { errors: [], warnings: [], isValid: true };
+
+    for (const rule of rules) {
+      const { type, options, level, message, validator: customValidator } = rule;
+      // check for custom validator or lookup in validators util by type
+      const useCustomValidator = typeof customValidator === 'function';
+      const validator = useCustomValidator ? customValidator : validators[type];
+      if (!validator) {
+        console.error(
+          !type
+            ? 'Validator not found. Either define type or pass custom validator function under "validator" key in validations object'
+            : `Validator type: "${type}" not found. Available validators: ${Object.keys(validators).join(
+                ', '
+              )}`
+        );
+        continue;
+      }
+      // dot notation may be used to define key for nested property
+      const passedValidation = useCustomValidator ? validator(data) : validator(get(data, key), options);
+
+      if (!passedValidation) {
+        // message can also be a function
+        const validationMessage = typeof message === 'function' ? message(data) : message;
+        // consider setting a prop like validationErrors directly on the model
+        // for now return an errors object
+        if (level === 'warn') {
+          state[stateKey].warnings.push(validationMessage);
+        } else {
+          state[stateKey].errors.push(validationMessage);
+          if (isValid) {
+            isValid = false;
+          }
+        }
+      }
+    }
+    errorCount += state[stateKey].errors.length;
+    state[stateKey].isValid = !state[stateKey].errors.length;
+  }
+
+  return { isValid, state, invalidFormMessage: generateErrorCountMessage(errorCount) };
+};
diff --git a/ui/app/utils/forms/validators.js b/ui/app/utils/forms/validators.js
new file mode 100644
index 00000000000..a23f515ec05
--- /dev/null
+++ b/ui/app/utils/forms/validators.js
@@ -0,0 +1,84 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { isPresent } from '@ember/utils';
+import { capitalize } from '@ember/string';
+
+/*
+* Model Validators
+these return false when the condition fails because false means "invalid"
+for example containsWhiteSpace returns "false" when a value HAS whitespace 
+because that is an invalid value
+*/
+export const presence = (value) => isPresent(value);
+
+export const length = (value, { nullable = false, min, max } = {}) => {
+  if (!min && !max) return;
+  // value could be an integer if the attr has a default value of some number
+  const valueLength = value?.toString().length;
+  if (valueLength) {
+    const underMin = min && valueLength < min;
+    const overMax = max && valueLength > max;
+    return underMin || overMax ? false : true;
+  }
+  return nullable;
+};
+
+export const number = (value, { nullable = false } = {}) => {
+  // since 0 is falsy, !value returns true even though 0 is a valid number
+  if (!value && value !== 0) return nullable;
+  return !isNaN(value);
+};
+
+export const containsWhiteSpace = (value) => {
+  return !hasWhitespace(value);
+};
+
+export const endsInSlash = (value) => {
+  const validation = new RegExp('/$');
+  return !validation.test(value);
+};
+
+/*
+* General Validators
+these utils return true or false relative to the function name
+*/
+
+export const hasWhitespace = (value) => {
+  const validation = new RegExp('\\s', 'g'); // search for whitespace
+  return validation.test(value);
+};
+
+// HTML form inputs transform values to a string type
+// this returns if the value can be evaluated as non-string, i.e. "null"
+export const isNonString = (value) => {
+  try {
+    // if parsable the value could be an object, array, number, null, true or false
+    JSON.parse(value);
+    return true;
+  } catch (e) {
+    return false;
+  }
+};
+
+export const WHITESPACE_WARNING = (item) =>
+  `${capitalize(
+    item
+  )} contains whitespace. If this is desired, you'll need to encode it with %20 in API requests.`;
+
+export const NON_STRING_WARNING =
+  'This value will be saved as a string. If you need to save a non-string value, please use the JSON editor.';
+
+export default {
+  presence,
+  length,
+  number,
+  containsWhiteSpace,
+  endsInSlash,
+  isNonString,
+  hasWhitespace,
+  WHITESPACE_WARNING,
+  NON_STRING_WARNING,
+};
diff --git a/ui/app/utils/identity-manager.js b/ui/app/utils/identity-manager.js
index caafd3f2343..6d943fbe270 100644
--- a/ui/app/utils/identity-manager.js
+++ b/ui/app/utils/identity-manager.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/utils/kv-path.ts b/ui/app/utils/kv-path.ts
index 116a5c0c219..f849b928429 100644
--- a/ui/app/utils/kv-path.ts
+++ b/ui/app/utils/kv-path.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,10 +8,14 @@
  * Additional methods for building URLs for other KV-V2 actions
  */
 
+import { sanitizeStart } from 'core/utils/sanitize-path';
 import { encodePath } from 'vault/utils/path-encoding-helpers';
+import queryParamString from './query-param-string';
 
-function buildKvPath(backend: string, path: string, type: string, version?: number | string) {
-  const url = `${encodePath(backend)}/${type}/${encodePath(path)}`;
+// only exported for testing
+export function buildKvPath(backend: string, path: string, type: string, version?: number | string) {
+  const sanitizedPath = sanitizeStart(path); // removing leading slashes
+  const url = `${encodePath(backend)}/${type}/${encodePath(sanitizedPath)}`;
   return version ? `${url}?version=${version}` : url;
 }
 
@@ -30,3 +34,17 @@ export function kvDestroyPath(backend: string, path: string) {
 export function kvUndeletePath(backend: string, path: string) {
   return buildKvPath(backend, path, 'undelete');
 }
+export function kvSubkeysPath(
+  backend: string,
+  path: string,
+  query: { depth?: number | string; version?: number | string }
+) {
+  const apiPath = buildKvPath(backend, path, 'subkeys');
+  // depth specifies the deepest nesting level the API should return
+  // depth=0 returns all subkeys (no limit), depth=1 returns only top-level keys
+  const queryParams = queryParamString({
+    depth: query?.depth ?? undefined, // no depth returns all levels (no limit)
+    version: query?.version ?? undefined, // no version defaults to latest
+  });
+  return `${apiPath}${queryParams}`;
+}
diff --git a/ui/app/utils/database-helpers.js b/ui/app/utils/model-helpers/database-helpers.js
similarity index 85%
rename from ui/app/utils/database-helpers.js
rename to ui/app/utils/model-helpers/database-helpers.js
index 38e7f565f6e..71a4f37f468 100644
--- a/ui/app/utils/database-helpers.js
+++ b/ui/app/utils/model-helpers/database-helpers.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -22,6 +22,7 @@ export const AVAILABLE_PLUGIN_TYPES = [
       { attr: 'tls_server_name', group: 'pluginConfig' },
       { attr: 'insecure', group: 'pluginConfig' },
       { attr: 'username_template', group: 'pluginConfig' },
+      { attr: 'skip_static_role_rotation_import', group: 'pluginConfig', isEnterprise: true },
     ],
   },
   {
@@ -37,6 +38,7 @@ export const AVAILABLE_PLUGIN_TYPES = [
       { attr: 'password', group: 'pluginConfig', show: false },
       { attr: 'write_concern', group: 'pluginConfig' },
       { attr: 'username_template', group: 'pluginConfig' },
+      { attr: 'skip_static_role_rotation_import', group: 'pluginConfig', isEnterprise: true },
       { attr: 'tls', group: 'pluginConfig', subgroup: 'TLS options' },
       { attr: 'tls_ca', group: 'pluginConfig', subgroup: 'TLS options' },
       { attr: 'root_rotation_statements', group: 'statements' },
@@ -57,6 +59,7 @@ export const AVAILABLE_PLUGIN_TYPES = [
       { attr: 'max_open_connections', group: 'pluginConfig' },
       { attr: 'max_idle_connections', group: 'pluginConfig' },
       { attr: 'max_connection_lifetime', group: 'pluginConfig' },
+      { attr: 'skip_static_role_rotation_import', group: 'pluginConfig', isEnterprise: true },
       { attr: 'root_rotation_statements', group: 'statements' },
     ],
   },
@@ -75,6 +78,7 @@ export const AVAILABLE_PLUGIN_TYPES = [
       { attr: 'max_idle_connections', group: 'pluginConfig' },
       { attr: 'max_connection_lifetime', group: 'pluginConfig' },
       { attr: 'username_template', group: 'pluginConfig' },
+      { attr: 'skip_static_role_rotation_import', group: 'pluginConfig', isEnterprise: true },
       { attr: 'tls', group: 'pluginConfig', subgroup: 'TLS options' },
       { attr: 'tls_ca', group: 'pluginConfig', subgroup: 'TLS options' },
       { attr: 'root_rotation_statements', group: 'statements' },
@@ -95,6 +99,7 @@ export const AVAILABLE_PLUGIN_TYPES = [
       { attr: 'max_idle_connections', group: 'pluginConfig' },
       { attr: 'max_connection_lifetime', group: 'pluginConfig' },
       { attr: 'username_template', group: 'pluginConfig' },
+      { attr: 'skip_static_role_rotation_import', group: 'pluginConfig', isEnterprise: true },
       { attr: 'tls', group: 'pluginConfig', subgroup: 'TLS options' },
       { attr: 'tls_ca', group: 'pluginConfig', subgroup: 'TLS options' },
       { attr: 'root_rotation_statements', group: 'statements' },
@@ -115,6 +120,7 @@ export const AVAILABLE_PLUGIN_TYPES = [
       { attr: 'max_idle_connections', group: 'pluginConfig' },
       { attr: 'max_connection_lifetime', group: 'pluginConfig' },
       { attr: 'username_template', group: 'pluginConfig' },
+      { attr: 'skip_static_role_rotation_import', group: 'pluginConfig', isEnterprise: true },
       { attr: 'tls', group: 'pluginConfig', subgroup: 'TLS options' },
       { attr: 'tls_ca', group: 'pluginConfig', subgroup: 'TLS options' },
       { attr: 'root_rotation_statements', group: 'statements' },
@@ -135,6 +141,7 @@ export const AVAILABLE_PLUGIN_TYPES = [
       { attr: 'max_idle_connections', group: 'pluginConfig' },
       { attr: 'max_connection_lifetime', group: 'pluginConfig' },
       { attr: 'username_template', group: 'pluginConfig' },
+      { attr: 'skip_static_role_rotation_import', group: 'pluginConfig', isEnterprise: true },
       { attr: 'tls', group: 'pluginConfig', subgroup: 'TLS options' },
       { attr: 'tls_ca', group: 'pluginConfig', subgroup: 'TLS options' },
       { attr: 'root_rotation_statements', group: 'statements' },
@@ -155,6 +162,7 @@ export const AVAILABLE_PLUGIN_TYPES = [
       { attr: 'max_idle_connections', group: 'pluginConfig' },
       { attr: 'max_connection_lifetime', group: 'pluginConfig' },
       { attr: 'username_template', group: 'pluginConfig' },
+      { attr: 'skip_static_role_rotation_import', group: 'pluginConfig', isEnterprise: true },
       { attr: 'root_rotation_statements', group: 'statements' },
     ],
   },
@@ -169,17 +177,27 @@ export const AVAILABLE_PLUGIN_TYPES = [
       { attr: 'connection_url', group: 'pluginConfig' },
       { attr: 'username', group: 'pluginConfig', show: false },
       { attr: 'password', group: 'pluginConfig', show: false },
+      { attr: 'password_authentication', group: 'pluginConfig' },
       { attr: 'max_open_connections', group: 'pluginConfig' },
       { attr: 'max_idle_connections', group: 'pluginConfig' },
       { attr: 'max_connection_lifetime', group: 'pluginConfig' },
+      { attr: 'auth_type', group: 'pluginConfig' },
+      { attr: 'service_account_json', group: 'pluginConfig' },
+      { attr: 'use_private_ip', group: 'pluginConfig' },
       { attr: 'username_template', group: 'pluginConfig' },
+      { attr: 'disable_escaping', group: 'pluginConfig' },
       { attr: 'root_rotation_statements', group: 'statements' },
+      { attr: 'self_managed', group: 'pluginConfig', isEnterprise: true },
+      { attr: 'skip_static_role_rotation_import', group: 'pluginConfig', isEnterprise: true },
+      { attr: 'private_key', group: 'pluginConfig', subgroup: 'TLS options' },
+      { attr: 'tls_ca', group: 'pluginConfig', subgroup: 'TLS options' },
+      { attr: 'tls_certificate', group: 'pluginConfig', subgroup: 'TLS options' },
     ],
   },
 ];
 
 export const ROLE_FIELDS = {
-  static: ['username', 'rotation_period'],
+  static: ['username', 'password', 'rotation_period', 'skip_import_rotation'],
   dynamic: ['default_ttl', 'max_ttl'],
 };
 
diff --git a/ui/app/utils/model-helpers/kmip-role-fields.js b/ui/app/utils/model-helpers/kmip-role-fields.js
new file mode 100644
index 00000000000..644ed6a8ae0
--- /dev/null
+++ b/ui/app/utils/model-helpers/kmip-role-fields.js
@@ -0,0 +1,27 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { removeManyFromArray } from 'vault/helpers/remove-from-array';
+
+export const operationFields = (fieldNames) => {
+  if (!Array.isArray(fieldNames)) {
+    throw new Error('fieldNames must be an array');
+  }
+  return fieldNames.filter((key) => key.startsWith('operation'));
+};
+
+export const operationFieldsWithoutSpecial = (fieldNames) => {
+  const opFields = operationFields(fieldNames);
+  return removeManyFromArray(opFields, ['operationAll', 'operationNone']);
+};
+
+export const nonOperationFields = (fieldNames) => {
+  const opFields = operationFields(fieldNames);
+  return removeManyFromArray(fieldNames, opFields);
+};
+
+export const tlsFields = () => {
+  return ['tlsClientKeyBits', 'tlsClientKeyType', 'tlsClientTtl'];
+};
diff --git a/ui/app/utils/openapi-helpers.ts b/ui/app/utils/openapi-helpers.ts
index 5b11ab1d683..72f6ad97ecc 100644
--- a/ui/app/utils/openapi-helpers.ts
+++ b/ui/app/utils/openapi-helpers.ts
@@ -1,13 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { dasherize } from '@ember/string';
+import { debug } from '@ember/debug';
+import { camelize, capitalize, dasherize } from '@ember/string';
 import { singularize } from 'ember-inflector';
 
-// TODO: Consolidate with openapi-to-attrs once it's typescript
-
 interface Path {
   path: string;
   itemType: string;
@@ -17,12 +16,13 @@ interface Path {
   navigation: boolean;
   param: string | false;
 }
-interface PathsInfo {
+export type PathInfo = {
   apiPath: string;
-  itemType: string;
-  itemTypes: string[];
   paths: Path[];
-}
+  itemTypes: string[];
+  itemType?: string;
+  itemID?: string;
+};
 
 interface OpenApiParameter {
   description?: string;
@@ -42,19 +42,90 @@ interface DisplayAttrs {
   sensitive?: boolean;
 }
 interface OpenApiAction {
+  operationId: string;
+  tags?: string[];
+  responses: Record<string, { description: string }>;
+  requestBody?: {
+    content: Record<string, { schema: { $ref: string } }>;
+    required: boolean;
+  };
   parameters: Array<{ name: string }>;
 }
 interface OpenApiPath {
   description?: string;
-  parameters: OpenApiParameter[];
+  parameters?: OpenApiParameter[];
   'x-vault-displayAttrs': DisplayAttrs;
   get?: OpenApiAction;
   post?: OpenApiAction;
   delete?: OpenApiAction;
 }
+interface Attribute {
+  name: string;
+  type: string | undefined;
+  options: {
+    editType?: string;
+    fieldGroup?: string;
+    fieldValue?: string;
+    label?: string;
+    readonly?: boolean;
+  };
+}
+interface OpenApiProp {
+  description: string;
+  type: string;
+  'x-vault-displayAttrs': {
+    name?: string;
+    value?: string | number;
+    group?: string;
+    sensitive?: boolean;
+    editType?: string;
+    description?: string;
+    identifier?: boolean;
+  };
+  items?: { type: string };
+  format?: string;
+  isId?: boolean;
+  deprecated?: boolean;
+  enum?: string[];
+}
+interface MixedAttr {
+  type?: string;
+  helpText?: string;
+  editType?: string;
+  fieldGroup: string;
+  fieldValue?: string;
+  label?: string;
+  readonly?: boolean;
+  possibleValues?: string[];
+  defaultValue?: string | number | (() => string | number);
+  sensitive?: boolean;
+  readOnly?: boolean;
+  name?: string;
+  identifier?: boolean;
+  [key: string]: unknown;
+}
+
+export type OpenApiProps = Record<string, OpenApiProp>;
+
+export type OpenApiHelpResponse = {
+  help: string;
+  openapi: {
+    paths: OpenApiPath[];
+    components: {
+      schemas: Record<string, { properties: OpenApiProps; type: string }>;
+    };
+    info: {
+      title: string;
+      version: string;
+      description: string;
+      license: { name: string; url: string };
+    };
+    openapi: string;
+  };
+};
 
 // Take object entries from the OpenAPI response and consolidate them into an object which includes itemTypes, operations, and paths
-export function reducePathsByPathName(pathsInfo: PathsInfo, currentPath: [string, OpenApiPath]): PathsInfo {
+export function reducePathsByPathName(pathsInfo: PathInfo, currentPath: [string, OpenApiPath]): PathInfo {
   const pathName = currentPath[0];
   const pathDetails = currentPath[1];
   const displayAttrs = pathDetails['x-vault-displayAttrs'];
@@ -124,7 +195,7 @@ export function pathToHelpUrlSegment(path: string): string {
   return path.replaceAll(apiPathRegex, 'example');
 }
 
-export function filterPathsByItemType(pathInfo: PathsInfo, itemType: string): Path[] {
+export function filterPathsByItemType(pathInfo: PathInfo, itemType: string): Path[] {
   if (!itemType) {
     return pathInfo.paths;
   }
@@ -132,3 +203,208 @@ export function filterPathsByItemType(pathInfo: PathsInfo, itemType: string): Pa
     return itemType === path.itemType;
   });
 }
+
+/**
+ * This object maps model names to the openAPI path that hydrates the model, given the backend path.
+ */
+const OPENAPI_POWERED_MODELS = {
+  'kmip/config': (backend: string) => `/v1/${backend}/config?help=1`,
+  'kmip/role': (backend: string) => `/v1/${backend}/scope/example/role/example?help=1`,
+  'pki/certificate/generate': (backend: string) => `/v1/${backend}/issue/example?help=1`,
+  'pki/certificate/sign': (backend: string) => `/v1/${backend}/sign/example?help=1`,
+  'pki/config/acme': (backend: string) => `/v1/${backend}/config/acme?help=1`,
+  'pki/config/cluster': (backend: string) => `/v1/${backend}/config/cluster?help=1`,
+  'pki/config/urls': (backend: string) => `/v1/${backend}/config/urls?help=1`,
+  'pki/role': (backend: string) => `/v1/${backend}/roles/example?help=1`,
+  'pki/sign-intermediate': (backend: string) => `/v1/${backend}/issuer/example/sign-intermediate?help=1`,
+  'pki/tidy': (backend: string) => `/v1/${backend}/config/auto-tidy?help=1`,
+  'role-ssh': (backend: string) => `/v1/${backend}/roles/example?help=1`,
+};
+
+export function getHelpUrlForModel(modelType: string, backend?: string) {
+  if (modelType in OPENAPI_POWERED_MODELS && backend) {
+    const urlFn = OPENAPI_POWERED_MODELS[modelType as keyof typeof OPENAPI_POWERED_MODELS];
+    return urlFn(backend);
+  }
+  return null;
+}
+
+export const expandOpenApiProps = function (
+  props: OpenApiProps,
+  outputFormat: 'model' | 'form' = 'model'
+): Record<string, MixedAttr> {
+  const attrs: Record<string, MixedAttr> = {};
+  // expand all attributes
+  for (const propName in props) {
+    const prop = props[propName];
+    if (!prop) continue;
+    let { description, items, type, format, isId, deprecated } = prop;
+    if (deprecated === true) {
+      continue;
+    }
+    let {
+      name,
+      value,
+      group,
+      sensitive,
+      editType,
+      description: displayDescription,
+      identifier,
+    } = prop['x-vault-displayAttrs'] || {};
+
+    if (type === 'integer') {
+      type = 'number';
+    }
+
+    if (displayDescription) {
+      description = displayDescription;
+    }
+
+    editType = editType || type;
+
+    if (format === 'seconds' || format === 'duration') {
+      editType = 'ttl';
+    } else if (items) {
+      editType = items.type + capitalize(type);
+    }
+
+    const attrDefn: MixedAttr = {
+      editType,
+      helpText: description,
+      possibleValues: prop['enum'],
+      fieldValue: isId ? 'mutableId' : undefined,
+      fieldGroup: group || 'default',
+      readOnly: isId,
+      defaultValue: value || undefined,
+      identifier,
+    };
+
+    if (type === 'object' && !!value && outputFormat !== 'form') {
+      attrDefn.defaultValue = () => {
+        return value;
+      };
+    }
+
+    if (sensitive) {
+      attrDefn.sensitive = true;
+    }
+
+    // only set a label if we have one from OpenAPI
+    // otherwise the propName will be humanized by the form-field component
+    if (name) {
+      attrDefn.label = name;
+    }
+
+    // ttls write as a string and read as a number
+    // so setting type on them runs the wrong transform
+    if (editType !== 'ttl' && type !== 'array') {
+      attrDefn.type = type;
+    }
+
+    // loop to remove empty vals
+    for (const attrProp in attrDefn) {
+      if (attrDefn[attrProp] == null) {
+        delete attrDefn[attrProp];
+      }
+    }
+
+    const key = outputFormat === 'model' ? camelize(propName) : propName;
+    attrs[key] = attrDefn;
+  }
+  return attrs;
+};
+
+/*
+ * extract props for post request schema from OpenAPI help response
+ * returns expanded OpenAPI props to be used in forms
+ */
+export const propsForSchema = function (helpResponse: OpenApiHelpResponse) {
+  const { openapi } = helpResponse;
+  // paths is an array but it will have a single entry with the scope we're in
+  const path = Object.values(openapi.paths)[0];
+  const schema = path?.post?.requestBody?.content['application/json']?.schema;
+  if (schema?.$ref) {
+    // $ref will be shaped like `#/components/schemas/MyResponseType
+    // this maps to the location of the item in openapi.components.schemas
+    const schemaRef = schema.$ref.replace('#/components/schemas/', '');
+    const props = openapi.components.schemas[schemaRef]?.['properties'] as OpenApiProps;
+    return expandOpenApiProps(props, 'form');
+  }
+
+  return {};
+};
+
+/**
+ * combineOpenApiAttrs takes attributes defined on an existing models
+ * and adds in the attributes found on an OpenAPI response. The values
+ * defined on the model should take precedence so we can overwrite
+ * attributes from OpenAPI.
+ */
+export const combineOpenApiAttrs = function (
+  oldAttrs: Map<string, Attribute>,
+  openApiProps: Record<string, MixedAttr>
+) {
+  const allAttrs: Record<string, boolean> = {};
+  const attrsArray: Attribute[] = [];
+  const newFields: string[] = [];
+
+  // First iterate over all the existing attrs and combine with recieved props, if they exist
+  oldAttrs.forEach(function (oldAttr, name) {
+    const attr: Attribute = { name, type: oldAttr.type, options: oldAttr.options };
+    const openApiProp = openApiProps[name];
+    if (openApiProp) {
+      const { type, ...options } = openApiProp;
+      // TODO: previous behavior took the openApi type no matter what
+      attr.type = oldAttr.type ?? type;
+      if (oldAttr.type && type && type !== oldAttr.type) {
+        debug(`mismatched type for ${name} -- ${type} vs ${oldAttr.type}`);
+      }
+      attr.options = { ...options, ...oldAttr.options };
+    }
+    attrsArray.push(attr);
+    // add to all attrs so we skip in the next part
+    allAttrs[name] = true;
+  });
+
+  // then iterate over all the new props and add them if they haven't already been accounted for
+  for (const name in openApiProps) {
+    // iterate over each
+    if (allAttrs[name]) {
+      continue;
+    } else {
+      const prop = openApiProps[name];
+      if (prop) {
+        const { type, ...options } = prop;
+        newFields.push(name);
+        attrsArray.push({ name, type, options });
+      }
+    }
+  }
+  return { attrs: attrsArray, newFields };
+};
+
+// interface FieldGroups {
+//   default: string[];
+//   [key: string]: string[];
+// }
+
+// export const combineFieldGroups = function (
+//   currentGroups: Array<Record<string, string[]>>,
+//   newFields: string[],
+//   excludedFields: string[]
+// ) {
+//   console.log({ currentGroups, newFields, excludedFields });
+//   let allFields: string[] = [];
+//   for (const group of currentGroups) {
+//     const fields = Object.values(group)[0] || [];
+//     allFields = allFields.concat(fields);
+//   }
+//   const otherFields = newFields.filter((field) => {
+//     return !allFields.includes(field) && !excludedFields.includes(field);
+//   });
+//   if (otherFields.length) {
+//     currentGroups[0].default = currentGroups[0].default.concat(otherFields);
+//   }
+
+//   return currentGroups;
+// };
diff --git a/ui/app/utils/openapi-to-attrs.js b/ui/app/utils/openapi-to-attrs.js
index 31406b47e11..6ba2019bcef 100644
--- a/ui/app/utils/openapi-to-attrs.js
+++ b/ui/app/utils/openapi-to-attrs.js
@@ -1,121 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { attr } from '@ember-data/model';
-import { camelize, capitalize } from '@ember/string';
-
-export const expandOpenApiProps = function (props) {
-  const attrs = {};
-  // expand all attributes
-  for (const propName in props) {
-    const prop = props[propName];
-    let { description, items, type, format, isId, deprecated } = prop;
-    if (deprecated === true) {
-      continue;
-    }
-    let {
-      name,
-      value,
-      group,
-      sensitive,
-      editType,
-      description: displayDescription,
-    } = prop['x-vault-displayAttrs'] || {};
-
-    if (type === 'integer') {
-      type = 'number';
-    }
-
-    if (displayDescription) {
-      description = displayDescription;
-    }
-
-    editType = editType || type;
-
-    if (format === 'seconds' || format === 'duration') {
-      editType = 'ttl';
-    } else if (items) {
-      editType = items.type + capitalize(type);
-    }
-
-    const attrDefn = {
-      editType,
-      helpText: description,
-      possibleValues: prop['enum'],
-      fieldValue: isId ? 'mutableId' : null,
-      fieldGroup: group || 'default',
-      readOnly: isId,
-      defaultValue: value || null,
-    };
-
-    if (type === 'object' && !!value) {
-      attrDefn.defaultValue = () => {
-        return value;
-      };
-    }
-
-    if (sensitive) {
-      attrDefn.sensitive = true;
-    }
-
-    // only set a label if we have one from OpenAPI
-    // otherwise the propName will be humanized by the form-field component
-    if (name) {
-      attrDefn.label = name;
-    }
-
-    // ttls write as a string and read as a number
-    // so setting type on them runs the wrong transform
-    if (editType !== 'ttl' && type !== 'array') {
-      attrDefn.type = type;
-    }
-
-    // loop to remove empty vals
-    for (const attrProp in attrDefn) {
-      if (attrDefn[attrProp] == null) {
-        delete attrDefn[attrProp];
-      }
-    }
-    attrs[camelize(propName)] = attrDefn;
-  }
-  return attrs;
-};
-
-export const combineAttributes = function (oldAttrs, newProps) {
-  const newAttrs = {};
-  const newFields = [];
-  if (oldAttrs) {
-    oldAttrs.forEach(function (value, name) {
-      if (newProps[name]) {
-        newAttrs[name] = attr(newProps[name].type, { ...newProps[name], ...value.options });
-      } else {
-        newAttrs[name] = attr(value.type, value.options);
-      }
-    });
-  }
-  for (const prop in newProps) {
-    if (newAttrs[prop]) {
-      continue;
-    } else {
-      newAttrs[prop] = attr(newProps[prop].type, newProps[prop]);
-      newFields.push(prop);
-    }
-  }
-  return { attrs: newAttrs, newFields };
-};
-
-export const combineFields = function (currentFields, newFields, excludedFields) {
-  const otherFields = newFields.filter((field) => {
-    return !currentFields.includes(field) && !excludedFields.includes(field);
-  });
-  if (otherFields.length) {
-    currentFields = currentFields.concat(otherFields);
-  }
-  return currentFields;
-};
-
+/**
+ * combineFieldGroups takes the newFields returned from OpenAPI and adds them to the default field group
+ * if they are not already accounted for in other field groups
+ * @param {Record<string,string[]>[]} currentGroups Field groups, as an array of objects like: [{ default: [] }, { 'TLS options': [] }]
+ * @param {string[]} newFields
+ * @param {string[]} excludedFields
+ * @returns modified currentGroups
+ */
 export const combineFieldGroups = function (currentGroups, newFields, excludedFields) {
   let allFields = [];
   for (const group of currentGroups) {
diff --git a/ui/app/utils/parse-pki-cert-oids.js b/ui/app/utils/parse-pki-cert-oids.js
index 2b36d85fe3b..af2bec8ab0a 100644
--- a/ui/app/utils/parse-pki-cert-oids.js
+++ b/ui/app/utils/parse-pki-cert-oids.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/utils/parse-pki-cert.js b/ui/app/utils/parse-pki-cert.js
index 5383d34218d..88608cc99cc 100644
--- a/ui/app/utils/parse-pki-cert.js
+++ b/ui/app/utils/parse-pki-cert.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/utils/path-encoding-helpers.js b/ui/app/utils/path-encoding-helpers.js
index 70719da02d9..dc21db85d18 100644
--- a/ui/app/utils/path-encoding-helpers.js
+++ b/ui/app/utils/path-encoding-helpers.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/utils/plugin-catalog-helpers.ts b/ui/app/utils/plugin-catalog-helpers.ts
new file mode 100644
index 00000000000..f85815e0745
--- /dev/null
+++ b/ui/app/utils/plugin-catalog-helpers.ts
@@ -0,0 +1,214 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { isEmpty } from '@ember/utils';
+import type { EngineDisplayData } from './all-engines-metadata';
+import type { PluginCatalogPlugin } from 'vault/services/plugin-catalog';
+
+/**
+ * Constants for plugin catalog functionality
+ */
+const DEFAULT_EXTERNAL_PLUGIN_GLYPH = '';
+
+/**
+ * Plugin categories used throughout the application
+ */
+export const PLUGIN_CATEGORIES = {
+  GENERIC: 'generic',
+  CLOUD: 'cloud',
+  INFRA: 'infra',
+  EXTERNAL: 'external',
+} as const;
+
+/**
+ * Mount categories for different engine types
+ */
+export const MOUNT_CATEGORIES = {
+  SECRET: 'secret',
+  AUTH: 'auth',
+  DATABASE: 'database',
+} as const;
+
+/**
+ * Plugin types used in catalog responses
+ */
+export const PLUGIN_TYPES = {
+  SECRET: 'secret',
+  AUTH: 'auth',
+  DATABASE: 'database',
+} as const;
+
+export interface PluginCatalogResponse {
+  data: {
+    detailed: PluginCatalogPlugin[];
+    secret?: string[];
+    auth?: string[];
+    database?: string[];
+  };
+}
+
+/**
+ * Enhanced engine display data with plugin catalog information
+ */
+export interface EnhancedEngineDisplayData extends EngineDisplayData {
+  version?: string;
+  builtin?: boolean;
+  deprecationStatus?: string;
+  isAvailable?: boolean;
+  pluginData?: PluginCatalogPlugin;
+}
+
+/**
+ * Enhances static engine data with plugin catalog information including availability status,
+ * deprecation status, and discovery of external plugins not in static metadata.
+ *
+ * @param allEngines - Array of static engine metadata
+ * @param secretEnginesDetailed - Array of detailed secret engine info from catalog
+ * @param databasePluginsDetailed - Array of detailed database plugin info from catalog
+ * @returns Enhanced engines with catalog data and dynamically discovered external plugins
+ */
+export function enhanceEnginesWithCatalogData(
+  allEngines: EngineDisplayData[],
+  secretEnginesDetailed: PluginCatalogPlugin[] = [],
+  databasePluginsDetailed: PluginCatalogPlugin[] = []
+): EnhancedEngineDisplayData[] {
+  if (isEmpty(secretEnginesDetailed) && isEmpty(databasePluginsDetailed)) {
+    return allEngines;
+  }
+
+  // First, enhance existing static engines with catalog data
+  const enhancedEngines = allEngines.map((engine) => {
+    if (engine.type === MOUNT_CATEGORIES.DATABASE) {
+      const isDatabaseAvailable = databasePluginsDetailed.length > 0;
+
+      if (isDatabaseAvailable) {
+        const representativePlugin = databasePluginsDetailed[0];
+
+        return {
+          ...engine,
+          builtin: representativePlugin?.builtin,
+          deprecationStatus: representativePlugin?.deprecation_status,
+          version: representativePlugin?.version,
+          isAvailable: true,
+          pluginData: representativePlugin,
+        };
+      } else {
+        return {
+          ...engine,
+          isAvailable: false,
+        };
+      }
+    }
+
+    const pluginData = secretEnginesDetailed.find((plugin) => plugin.name === engine.type);
+
+    if (pluginData) {
+      return {
+        ...engine,
+        builtin: pluginData.builtin,
+        deprecationStatus: pluginData.deprecation_status,
+        version: pluginData.version,
+        isAvailable: true,
+        pluginData,
+      };
+    }
+
+    return {
+      ...engine,
+      isAvailable: false,
+    };
+  });
+
+  // Find plugins in catalog that don't exist in static metadata
+  const staticEngineTypes = new Set(allEngines.map((engine) => engine.type));
+  const externalPlugins: EnhancedEngineDisplayData[] = [];
+
+  // Process secret engines from the detailed array
+  secretEnginesDetailed.forEach((plugin) => {
+    // Skip if this plugin already exists in static metadata
+    if (staticEngineTypes.has(plugin.name)) {
+      return;
+    }
+
+    // Look for a static engine type that this plugin name contains or matches
+    // This handles cases like "my-custom-aws-plugin" matching the "aws" static engine
+    const matchingStaticEngine = allEngines.find((engine) => {
+      // Direct type match (e.g., plugin.name = "aws" matches engine.type = "aws")
+      if (plugin.name === engine.type) {
+        return true;
+      }
+      // Pattern match (e.g., plugin.name = "my-custom-aws-plugin" contains "aws")
+      return plugin.name.includes(engine.type) || plugin.name.includes(engine.type.replace('-', ''));
+    });
+
+    // Create external engine metadata with defaults
+    const externalEngine: EnhancedEngineDisplayData = {
+      type: plugin.name,
+      displayName: plugin.name
+        .split('-')
+        .map((word: string) => word.charAt(0).toUpperCase() + word.slice(1))
+        .join(' '), // Convert kebab-case to Title Case
+      mountCategory: [MOUNT_CATEGORIES.SECRET],
+      pluginCategory: PLUGIN_CATEGORIES.EXTERNAL, // Mark as external since it's not in static metadata
+      glyph: matchingStaticEngine?.glyph || DEFAULT_EXTERNAL_PLUGIN_GLYPH, // Use glyph from matching type or default
+      isAvailable: true,
+      builtin: plugin.builtin,
+      deprecationStatus: plugin.deprecation_status,
+      version: plugin.version,
+      pluginData: plugin,
+    };
+
+    externalPlugins.push(externalEngine);
+  });
+
+  return [...enhancedEngines, ...externalPlugins];
+}
+
+/**
+ * Categorizes engines by their availability status for display purposes.
+ * Separate enabled and disabled plugins in the UI.
+ * Engines with isAvailable === false are considered disabled.
+ *
+ * @param engines - Array of enhanced engine data with availability information
+ * @returns Object containing separate arrays for enabled and disabled engines
+ *
+ * @example
+ * ```typescript
+ * const engines = enhanceEnginesWithCatalogData(staticEngines, catalogData);
+ * const { enabled, disabled } = categorizeEnginesByStatus(engines);
+ *
+ * // Render enabled plugins first, then disabled plugins with different styling
+ * enabled.forEach(engine => renderEnabledPlugin(engine));
+ * disabled.forEach(engine => renderDisabledPlugin(engine));
+ * ```
+ */
+export interface CategorizedEngines {
+  enabled: EnhancedEngineDisplayData[];
+  disabled: EnhancedEngineDisplayData[];
+}
+
+export function categorizeEnginesByStatus(engines: EnhancedEngineDisplayData[]): CategorizedEngines {
+  const enabled: EnhancedEngineDisplayData[] = [];
+  const disabled: EnhancedEngineDisplayData[] = [];
+
+  engines.forEach((engine) => {
+    if (engine.isAvailable !== false) {
+      enabled.push(engine);
+    } else {
+      disabled.push(engine);
+    }
+  });
+
+  return { enabled, disabled };
+}
+
+export function getPluginVersionsFromEngineType(list: PluginCatalogPlugin[] | undefined, name: string) {
+  if (!list) return [];
+
+  return list.reduce((acc: string[], item: PluginCatalogPlugin) => {
+    if (item.name === name) acc.push(item.version);
+    return acc;
+  }, []);
+}
diff --git a/ui/app/utils/query-param-string.js b/ui/app/utils/query-param-string.js
new file mode 100644
index 00000000000..f748d2bac4b
--- /dev/null
+++ b/ui/app/utils/query-param-string.js
@@ -0,0 +1,36 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { isEmptyValue } from 'core/helpers/is-empty-value';
+
+/**
+ * queryParamString converts an object to a query param string with URL encoded keys and values.
+ * It does not include values that are considered invalid query params (below).
+ * @param {object} queryObject with key-value pairs of desired URL params
+ * @returns string like ?key=val1&key2=val2
+ */
+
+// we can't just rely on falsy values because "false" and "0" are valid query params
+const INVALID_QP = [undefined, null, ''];
+
+export default function queryParamString(queryObject) {
+  if (
+    !queryObject ||
+    isEmptyValue(queryObject) ||
+    typeof queryObject !== 'object' ||
+    Array.isArray(queryObject) ||
+    Object.values(queryObject).every((v) => INVALID_QP.includes(v))
+  )
+    return '';
+  return Object.keys(queryObject).reduce((prev, key) => {
+    const value = queryObject[key];
+    if (INVALID_QP.includes(value)) return prev;
+    const keyval = `${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
+    if (prev === '?') {
+      return `${prev}${keyval}`;
+    }
+    return `${prev}&${keyval}`;
+  }, '?');
+}
diff --git a/ui/app/utils/remove-record.js b/ui/app/utils/remove-record.js
index 425546fef11..f21aa271abf 100644
--- a/ui/app/utils/remove-record.js
+++ b/ui/app/utils/remove-record.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/utils/sort-objects.js b/ui/app/utils/sort-objects.js
index 5ade25803e7..d2f61fe868c 100644
--- a/ui/app/utils/sort-objects.js
+++ b/ui/app/utils/sort-objects.js
@@ -1,8 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+/* 
+this util sorts the original array
+pass in a copy of the array, i.e. myArray.slice(), if you do not want to modify the original array
+*/
 export default function sortObjects(array, key) {
   if (Array.isArray(array) && array?.every((e) => e[key] && typeof e[key] === 'string')) {
     return array.sort((a, b) => {
diff --git a/ui/app/utils/trim-right.js b/ui/app/utils/trim-right.js
index e25d6d3b31f..cf991cc6031 100644
--- a/ui/app/utils/trim-right.js
+++ b/ui/app/utils/trim-right.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/app/utils/validators.js b/ui/app/utils/validators.js
deleted file mode 100644
index 2ee718f8f65..00000000000
--- a/ui/app/utils/validators.js
+++ /dev/null
@@ -1,41 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { isPresent } from '@ember/utils';
-
-export const presence = (value) => isPresent(value);
-
-export const length = (value, { nullable = false, min, max } = {}) => {
-  if (!min && !max) return;
-  // value could be an integer if the attr has a default value of some number
-  const valueLength = value?.toString().length;
-  if (valueLength) {
-    const underMin = min && valueLength < min;
-    const overMax = max && valueLength > max;
-    return underMin || overMax ? false : true;
-  }
-  return nullable;
-};
-
-export const number = (value, { nullable = false } = {}) => {
-  // since 0 is falsy, !value returns true even though 0 is a valid number
-  if (!value && value !== 0) return nullable;
-  return !isNaN(value);
-};
-
-/*
-the following validations return false (invalid) if the condition is met
-*/
-export const containsWhiteSpace = (value) => {
-  const validation = new RegExp('\\s', 'g'); // search for whitespace
-  return !validation.test(value);
-};
-
-export const endsInSlash = (value) => {
-  const validation = new RegExp('/$');
-  return !validation.test(value);
-};
-
-export default { presence, length, number, containsWhiteSpace, endsInSlash };
diff --git a/ui/codemods.log b/ui/codemods.log
deleted file mode 100644
index b71a455d478..00000000000
--- a/ui/codemods.log
+++ /dev/null
@@ -1,281 +0,0 @@
-2021-12-03T16:39:04.778Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/alphabet-edit.hbs
-2021-12-03T16:39:04.959Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-show-transformation.hbs
-2021-12-03T16:39:04.989Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/namespace-picker.hbs
-2021-12-03T16:39:05.089Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/wizard/init-unseal.hbs
-2021-12-03T16:39:05.091Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/wizard/init-unseal.hbs
-2021-12-03T16:39:05.091Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/wizard/init-unseal.hbs
-2021-12-03T16:39:05.115Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/wizard/mounts-wizard.hbs
-2021-12-03T16:39:05.277Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-alias/alias-details.hbs
-2021-12-03T16:39:05.362Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-policies.hbs
-2021-12-03T16:39:05.366Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backends.hbs
-2021-12-03T16:39:05.283Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-alias/alias-details.hbs
-2021-12-03T16:39:05.350Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/control-groups.hbs
-2021-12-03T16:39:05.422Z [warn] WARNING: {{uppercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policy/edit.hbs
-2021-12-03T16:39:05.456Z [warn] WARNING: {{uppercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policies/create.hbs
-2021-12-03T16:39:05.456Z [warn] WARNING: {{uppercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policies/create.hbs
-2021-12-03T16:39:05.456Z [warn] WARNING: {{toggle-action}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policies/create.hbs
-2021-12-03T16:39:05.558Z [warn] WARNING: {{uppercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policies/index.hbs
-2021-12-03T16:39:05.558Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policies/index.hbs
-2021-12-03T16:39:05.558Z [warn] WARNING: {{uppercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policies/index.hbs
-2021-12-03T16:39:05.559Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policies/index.hbs
-2021-12-03T16:39:05.559Z [warn] WARNING: {{uppercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policies/index.hbs
-2021-12-03T16:39:05.559Z [warn] WARNING: {{uppercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policies/index.hbs
-2021-12-03T16:39:05.559Z [warn] WARNING: {{uppercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policies/index.hbs
-2021-12-03T16:39:05.589Z [warn] WARNING: {{uppercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/policy/show.hbs
-2021-12-03T16:39:04.961Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-show-transformation.hbs
-2021-12-03T16:39:04.961Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-show-transformation.hbs
-2021-12-03T16:39:04.961Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-show-transformation.hbs
-2021-12-03T16:39:04.961Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-show-transformation.hbs
-2021-12-03T16:39:05.026Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-edit-form.hbs
-2021-12-03T16:39:05.116Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-role-edit.hbs
-2021-12-03T16:39:05.131Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-role-edit.hbs
-2021-12-03T16:39:05.131Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-role-edit.hbs
-2021-12-03T16:39:05.131Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-role-edit.hbs
-2021-12-03T16:39:05.132Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-role-edit.hbs
-2021-12-03T16:39:05.275Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-template-edit.hbs
-2021-12-03T16:39:05.276Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-template-edit.hbs
-2021-12-03T16:39:05.276Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-template-edit.hbs
-2021-12-03T16:39:05.276Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-template-edit.hbs
-2021-12-03T16:39:05.276Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transform-template-edit.hbs
-2021-12-03T16:39:05.346Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-create.hbs
-2021-12-03T16:39:05.346Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-create.hbs
-2021-12-03T16:39:05.347Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-create.hbs
-2021-12-03T16:39:05.347Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-create.hbs
-2021-12-03T16:39:05.347Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-create.hbs
-2021-12-03T16:39:05.347Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-create.hbs
-2021-12-03T16:39:05.347Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-create.hbs
-2021-12-03T16:39:05.347Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-create.hbs
-2021-12-03T16:39:05.347Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-create.hbs
-2021-12-03T16:39:05.347Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-create.hbs
-2021-12-03T16:39:05.449Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/wizard-content.hbs
-2021-12-03T16:39:05.553Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-show.hbs
-2021-12-03T16:39:05.553Z [warn] WARNING: {{humanize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-show.hbs
-2021-12-03T16:39:05.553Z [warn] WARNING: {{date-from-now}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-show.hbs
-2021-12-03T16:39:05.554Z [warn] WARNING: {{date-from-now}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-show.hbs
-2021-12-03T16:39:05.554Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-show.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/history.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/history.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/history.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/history.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/history.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/history.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/history.hbs
-2021-12-03T16:39:05.753Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/config.hbs
-2021-12-03T16:39:05.753Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/config.hbs
-2021-12-03T16:39:05.754Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/config.hbs
-2021-12-03T16:39:05.754Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/clients/config.hbs
-2021-12-03T16:39:05.756Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/console/log-json.hbs
-2021-12-03T16:39:05.756Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/console/log-json.hbs
-2021-12-03T16:39:05.761Z [warn] WARNING: {{multi-line-join}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/console/log-list.hbs
-2021-12-03T16:39:05.793Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-edit.hbs
-2021-12-03T16:39:05.793Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-edit.hbs
-2021-12-03T16:39:05.793Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-form-edit.hbs
-2021-12-03T16:39:05.832Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-method/configuration.hbs
-2021-12-03T16:39:05.833Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-method/configuration.hbs
-2021-12-03T16:39:05.833Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-method/configuration.hbs
-2021-12-03T16:39:05.833Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-method/configuration.hbs
-2021-12-03T16:39:05.833Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-method/configuration.hbs
-2021-12-03T16:39:05.845Z [warn] WARNING: {{lowercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/edit-form.hbs
-2021-12-03T16:39:05.973Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/entity-nav.hbs
-2021-12-03T16:39:05.973Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/entity-nav.hbs
-2021-12-03T16:39:05.973Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/entity-nav.hbs
-2021-12-03T16:39:05.973Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/entity-nav.hbs
-2021-12-03T16:39:05.974Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/entity-nav.hbs
-2021-12-03T16:39:05.974Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/entity-nav.hbs
-2021-12-03T16:39:05.974Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/entity-nav.hbs
-2021-12-03T16:39:05.982Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-aliases.hbs
-2021-12-03T16:39:06.007Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-details.hbs
-2021-12-03T16:39:06.007Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-details.hbs
-2021-12-03T16:39:06.031Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-groups.hbs
-2021-12-03T16:39:06.048Z [warn] WARNING: {{lowercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-metadata.hbs
-2021-12-03T16:39:06.048Z [warn] WARNING: {{lowercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-metadata.hbs
-2021-12-03T16:39:06.048Z [warn] WARNING: {{lowercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-metadata.hbs
-2021-12-03T16:39:06.061Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-members.hbs
-2021-12-03T16:39:06.062Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-members.hbs
-2021-12-03T16:39:06.075Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/item-parent-groups.hbs
-2021-12-03T16:39:05.367Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backends.hbs
-2021-12-03T16:39:05.493Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/index.hbs
-2021-12-03T16:39:05.493Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/index.hbs
-2021-12-03T16:39:05.494Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/index.hbs
-2021-12-03T16:39:05.494Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/index.hbs
-2021-12-03T16:39:05.494Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/index.hbs
-2021-12-03T16:39:05.526Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/show.hbs
-2021-12-03T16:39:05.527Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/show.hbs
-2021-12-03T16:39:05.558Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/tools/tool.hbs
-2021-12-03T16:39:05.586Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/leases/list.hbs
-2021-12-03T16:39:05.587Z [warn] WARNING: {{compact}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/leases/list.hbs
-2021-12-03T16:39:05.640Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/leases/show.hbs
-2021-12-03T16:39:05.640Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/leases/show.hbs
-2021-12-03T16:39:05.640Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/leases/show.hbs
-2021-12-03T16:39:05.640Z [warn] WARNING: {{date-from-now}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/leases/show.hbs
-2021-12-03T16:39:05.651Z [warn] WARNING: {{section-tabs}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/method/section.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/configuration.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/configuration.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/configuration.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{and}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/configuration.hbs
-2021-12-03T16:39:05.679Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/configuration.hbs
-2021-12-03T16:39:05.884Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/list.hbs
-2021-12-03T16:39:05.885Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/list.hbs
-2021-12-03T16:39:05.885Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/list.hbs
-2021-12-03T16:39:05.885Z [warn] WARNING: {{compact}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/list.hbs
-2021-12-03T16:39:05.885Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/list.hbs
-2021-12-03T16:39:05.885Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/list.hbs
-2021-12-03T16:39:05.912Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/overview.hbs
-2021-12-03T16:39:05.968Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/sign.hbs
-2021-12-03T16:39:05.968Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/sign.hbs
-2021-12-03T16:39:05.968Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/sign.hbs
-2021-12-03T16:39:05.991Z [warn] WARNING: {{humanize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/transit-actions-layout.hbs
-2021-12-03T16:39:06.040Z [warn] WARNING: {{reverse}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/versions.hbs
-2021-12-03T16:39:06.040Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/versions.hbs
-2021-12-03T16:39:06.052Z [warn] WARNING: {{section-tabs}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/settings/auth/configure.hbs
-2021-12-03T16:39:06.117Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/roles.hbs
-2021-12-03T16:39:06.117Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/roles.hbs
-2021-12-03T16:39:06.118Z [warn] WARNING: {{compact}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/roles.hbs
-2021-12-03T16:39:06.118Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/secrets/backend/roles.hbs
-2021-12-03T16:39:06.144Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/aliases/index.hbs
-2021-12-03T16:39:06.148Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/aliases/index.hbs
-2021-12-03T16:39:06.148Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/aliases/index.hbs
-2021-12-03T16:39:06.160Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/aliases/show.hbs
-2021-12-03T16:39:06.161Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/aliases/show.hbs
-2021-12-03T16:39:06.161Z [warn] WARNING: {{lowercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/aliases/show.hbs
-2021-12-03T16:39:06.166Z [warn] WARNING: {{lowercase}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/access/identity/aliases/add.hbs
-2021-12-03T16:39:06.170Z [warn] WARNING: {{auth-config-form/options}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/settings/auth/configure/section.hbs
-2021-12-03T16:39:06.170Z [warn] WARNING: {{auth-config-form/config}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/settings/auth/configure/section.hbs
-2021-12-03T16:39:04.788Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/alphabet-edit.hbs
-2021-12-03T16:39:04.788Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/alphabet-edit.hbs
-2021-12-03T16:39:04.788Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/alphabet-edit.hbs
-2021-12-03T16:39:04.788Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/alphabet-edit.hbs
-2021-12-03T16:39:04.788Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/alphabet-edit.hbs
-2021-12-03T16:39:04.798Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault.hbs
-2021-12-03T16:39:04.798Z [warn] WARNING: {{changelog-url-for}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault.hbs
-2021-12-03T16:39:04.889Z [warn] WARNING: {{date-from-now}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-info.hbs
-2021-12-03T16:39:04.890Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-info.hbs
-2021-12-03T16:39:04.956Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-jwt.hbs
-2021-12-03T16:39:05.130Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/config-pki-ca.hbs
-2021-12-03T16:39:05.130Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/config-pki-ca.hbs
-2021-12-03T16:39:05.131Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/config-pki-ca.hbs
-2021-12-03T16:39:05.131Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/config-pki-ca.hbs
-2021-12-03T16:39:05.131Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/config-pki-ca.hbs
-2021-12-03T16:39:05.131Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/config-pki-ca.hbs
-2021-12-03T16:39:05.131Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/config-pki-ca.hbs
-2021-12-03T16:39:05.131Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/config-pki-ca.hbs
-2021-12-03T16:39:05.132Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/config-pki-ca.hbs
-2021-12-03T16:39:05.352Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/cluster-info.hbs
-2021-12-03T16:39:05.352Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/cluster-info.hbs
-2021-12-03T16:39:05.352Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/cluster-info.hbs
-2021-12-03T16:39:05.525Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-form.hbs
-2021-12-03T16:39:05.526Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-form.hbs
-2021-12-03T16:39:05.526Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/auth-form.hbs
-2021-12-03T16:39:05.771Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-connection.hbs
-2021-12-03T16:39:05.771Z [warn] WARNING: {{fn}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-connection.hbs
-2021-12-03T16:39:05.771Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-connection.hbs
-2021-12-03T16:39:05.771Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-connection.hbs
-2021-12-03T16:39:05.772Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-connection.hbs
-2021-12-03T16:39:05.772Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-connection.hbs
-2021-12-03T16:39:05.772Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-connection.hbs
-2021-12-03T16:39:05.772Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-connection.hbs
-2021-12-03T16:39:05.772Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-connection.hbs
-2021-12-03T16:39:05.781Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/file-to-array-buffer.hbs
-2021-12-03T16:39:05.781Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/file-to-array-buffer.hbs
-2021-12-03T16:39:05.805Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/control-group-success.hbs
-2021-12-03T16:39:05.805Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/control-group-success.hbs
-2021-12-03T16:39:05.805Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/control-group-success.hbs
-2021-12-03T16:39:05.881Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/form-field-from-model.hbs
-2021-12-03T16:39:05.881Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/form-field-from-model.hbs
-2021-12-03T16:39:05.881Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/form-field-from-model.hbs
-2021-12-03T16:39:05.881Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/form-field-from-model.hbs
-2021-12-03T16:39:05.881Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/form-field-from-model.hbs
-2021-12-03T16:39:05.881Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/form-field-from-model.hbs
-2021-12-03T16:39:05.882Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/form-field-from-model.hbs
-2021-12-03T16:39:05.927Z [warn] WARNING: {{format-duration}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials-database.hbs
-2021-12-03T16:39:05.927Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials-database.hbs
-2021-12-03T16:39:05.927Z [warn] WARNING: {{format-duration}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials-database.hbs
-2021-12-03T16:39:05.927Z [warn] WARNING: {{format-duration}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials-database.hbs
-2021-12-03T16:39:06.019Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials.hbs
-2021-12-03T16:39:06.020Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials.hbs
-2021-12-03T16:39:06.020Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials.hbs
-2021-12-03T16:39:06.020Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials.hbs
-2021-12-03T16:39:06.020Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials.hbs
-2021-12-03T16:39:06.020Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials.hbs
-2021-12-03T16:39:06.020Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials.hbs
-2021-12-03T16:39:06.020Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generate-credentials.hbs
-2021-12-03T16:39:06.050Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generated-item.hbs
-2021-12-03T16:39:06.050Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generated-item.hbs
-2021-12-03T16:39:06.050Z [warn] WARNING: {{singularize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generated-item.hbs
-2021-12-03T16:39:06.050Z [warn] WARNING: {{singularize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generated-item.hbs
-2021-12-03T16:39:06.050Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/generated-item.hbs
-2021-12-03T16:39:06.128Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/license-banners.hbs
-2021-12-03T16:39:06.128Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/license-banners.hbs
-2021-12-03T16:39:06.128Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/license-banners.hbs
-2021-12-03T16:39:06.181Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-role-edit.hbs
-2021-12-03T16:39:06.181Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-role-edit.hbs
-2021-12-03T16:39:06.181Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-role-edit.hbs
-2021-12-03T16:39:06.182Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-role-edit.hbs
-2021-12-03T16:39:06.182Z [warn] WARNING: {{await}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/database-role-edit.hbs
-2021-12-03T16:39:06.192Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/license-info.hbs
-2021-12-03T16:39:06.192Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/license-info.hbs
-2021-12-03T16:39:04.991Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/namespace-picker.hbs
-2021-12-03T16:39:05.065Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/mount-backend-form.hbs
-2021-12-03T16:39:05.065Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/mount-backend-form.hbs
-2021-12-03T16:39:05.066Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/mount-backend-form.hbs
-2021-12-03T16:39:05.066Z [warn] WARNING: {{queue}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/mount-backend-form.hbs
-2021-12-03T16:39:05.083Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/mount-backend-form.hbs
-2021-12-03T16:39:05.083Z [warn] WARNING: {{not}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/mount-backend-form.hbs
-2021-12-03T16:39:05.139Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/mount-accessor-select.hbs
-2021-12-03T16:39:05.179Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/mount-info.hbs
-2021-12-03T16:39:05.180Z [warn] WARNING: {{section-tabs}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/mount-info.hbs
-2021-12-03T16:39:05.249Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/not-found.hbs
-2021-12-03T16:39:05.307Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/pki-cert-show.hbs
-2021-12-03T16:39:05.307Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/pki-cert-show.hbs
-2021-12-03T16:39:05.308Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/pki-cert-show.hbs
-2021-12-03T16:39:05.308Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/pki-cert-show.hbs
-2021-12-03T16:39:05.308Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/pki-cert-show.hbs
-2021-12-03T16:39:05.308Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/pki-cert-show.hbs
-2021-12-03T16:39:05.308Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/pki-cert-show.hbs
-2021-12-03T16:39:05.308Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/pki-cert-show.hbs
-2021-12-03T16:39:05.375Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/pricing-metrics-dates.hbs
-2021-12-03T16:39:05.375Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/pricing-metrics-dates.hbs
-2021-12-03T16:39:05.426Z [warn] WARNING: {{queue}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/raft-storage-overview.hbs
-2021-12-03T16:39:05.426Z [warn] WARNING: {{queue}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/raft-storage-overview.hbs
-2021-12-03T16:39:05.517Z [warn] WARNING: {{join}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/role-aws-edit.hbs
-2021-12-03T16:39:05.517Z [warn] WARNING: {{join}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/role-aws-edit.hbs
-2021-12-03T16:39:05.517Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/role-aws-edit.hbs
-2021-12-03T16:39:05.517Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/role-aws-edit.hbs
-2021-12-03T16:39:05.518Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/role-aws-edit.hbs
-2021-12-03T16:39:05.578Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/role-ssh-edit.hbs
-2021-12-03T16:39:05.578Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/role-ssh-edit.hbs
-2021-12-03T16:39:05.578Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/role-ssh-edit.hbs
-2021-12-03T16:39:05.623Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/role-pki-edit.hbs
-2021-12-03T16:39:05.623Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/role-pki-edit.hbs
-2021-12-03T16:39:05.753Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-create-or-update.hbs
-2021-12-03T16:39:05.754Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-create-or-update.hbs
-2021-12-03T16:39:05.766Z [warn] WARNING: {{compute}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/raft-join.hbs
-2021-12-03T16:39:05.907Z [warn] WARNING: {{and}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-edit-toolbar.hbs
-2021-12-03T16:39:05.907Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-edit-toolbar.hbs
-2021-12-03T16:39:05.942Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-form-show.hbs
-2021-12-03T16:39:05.985Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list-header.hbs
-2021-12-03T16:39:05.985Z [warn] WARNING: {{or}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list-header.hbs
-2021-12-03T16:39:05.985Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list-header.hbs
-2021-12-03T16:39:06.174Z [warn] WARNING: {{date-format}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/token-expire-warning.hbs
-2021-12-03T16:39:06.228Z [warn] WARNING: {{date-from-now}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/tool-lookup.hbs
-2021-12-03T16:39:06.280Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/tool-unwrap.hbs
-2021-12-03T16:39:06.280Z [warn] WARNING: {{stringify}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/tool-unwrap.hbs
-2021-12-03T16:39:05.385Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/lookup-input.hbs
-2021-12-03T16:39:05.385Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/identity/lookup-input.hbs
-2021-12-03T16:39:05.449Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list/aws-role-item.hbs
-2021-12-03T16:39:05.518Z [warn] WARNING: {{secret-query-params}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list/database-list-item.hbs
-2021-12-03T16:39:05.518Z [warn] WARNING: {{secret-query-params}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list/database-list-item.hbs
-2021-12-03T16:39:05.524Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list/pki-cert-item.hbs
-2021-12-03T16:39:05.596Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list/item.hbs
-2021-12-03T16:39:05.653Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list/pki-role-item.hbs
-2021-12-03T16:39:05.691Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list/transform-list-item.hbs
-2021-12-03T16:39:05.774Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list/ssh-role-item.hbs
-2021-12-03T16:39:05.834Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-key-action/datakey.hbs
-2021-12-03T16:39:05.835Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-key-action/datakey.hbs
-2021-12-03T16:39:05.875Z [warn] WARNING: {{linked-block}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/secret-list/transform-transformation-item.hbs
-2021-12-03T16:39:06.019Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-key-action/export.hbs
-2021-12-03T16:39:06.021Z [warn] WARNING: {{eq}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-key-action/export.hbs
-2021-12-03T16:39:06.203Z [warn] WARNING: {{queue}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/components/transit-key-action/verify.hbs
-2021-12-03T16:39:06.307Z [warn] WARNING: {{pluralize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/init.hbs
-2021-12-03T16:39:06.307Z [warn] WARNING: {{add}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/init.hbs
-2021-12-03T16:39:06.358Z [warn] WARNING: {{capitalize}} was not converted as it has positional parameters which can't be automatically converted. Source: app/templates/vault/cluster/unseal.hbs
diff --git a/ui/config/content-security-policy.js b/ui/config/content-security-policy.js
index 3c5d8a33113..5c0607dbd29 100644
--- a/ui/config/content-security-policy.js
+++ b/ui/config/content-security-policy.js
@@ -1,23 +1,27 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 module.exports = function (environment) {
+  const policy = {
+    'default-src': ["'none'"],
+    'script-src': ["'self'"],
+    'font-src': ["'self'"],
+    'connect-src': ["'self'"],
+    'img-src': ["'self'", 'data:'],
+    'style-src': ["'unsafe-inline'", "'self'"],
+    'media-src': ["'self'"],
+    'form-action': ["'none'"],
+  };
+
+  policy['connect-src'].push('https://eu.i.posthog.com');
+
   return {
     delivery: ['header', 'meta'],
     enabled: environment !== 'production',
     failTests: true,
-    policy: {
-      'default-src': ["'none'"],
-      'script-src': ["'self'"],
-      'font-src': ["'self'"],
-      'connect-src': ["'self'"],
-      'img-src': ["'self'", 'data:'],
-      'style-src': ["'unsafe-inline'", "'self'"],
-      'media-src': ["'self'"],
-      'form-action': ["'none'"],
-    },
+    policy,
     reportOnly: false,
   };
 };
diff --git a/ui/config/deprecation-workflow.js b/ui/config/deprecation-workflow.js
index cf343738e69..02a7f6b3d36 100644
--- a/ui/config/deprecation-workflow.js
+++ b/ui/config/deprecation-workflow.js
@@ -1,24 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 /* global self */
 self.deprecationWorkflow = self.deprecationWorkflow || {};
-//self.deprecationWorkflow.config = {
-//throwOnUnhandled: true
-//}
 self.deprecationWorkflow.config = {
-  // current output from deprecationWorkflow.flushDeprecations();
-  // deprecations that will not be removed until 5.0.0 are filtered by deprecation-filter initializer rather than silencing below
-  workflow: [
-    { handler: 'silence', matchId: 'ember-data:model-save-promise' },
-    { handler: 'silence', matchId: 'ember-engines.deprecation-camelized-engine-names' },
-    { handler: 'silence', matchId: 'ember-engines.deprecation-router-service-from-host' },
-    { handler: 'silence', matchId: 'ember-modifier.use-modify' },
-    { handler: 'silence', matchId: 'ember-modifier.no-element-property' },
-    { handler: 'silence', matchId: 'ember-modifier.no-args-property' },
-    { handler: 'silence', matchId: 'ember-cli-mirage-config-routes-only-export' },
-    { handler: 'silence', matchId: 'setting-on-hash' },
-  ],
+  throwOnUnhandled: false,
+  workflow: [],
 };
diff --git a/ui/config/ember-cli-update.json b/ui/config/ember-cli-update.json
index 60111fda5c2..5bc999cef51 100644
--- a/ui/config/ember-cli-update.json
+++ b/ui/config/ember-cli-update.json
@@ -3,7 +3,7 @@
   "packages": [
     {
       "name": "ember-cli",
-      "version": "4.12.1",
+      "version": "5.4.2",
       "blueprints": [
         {
           "name": "app",
diff --git a/ui/config/environment.js b/ui/config/environment.js
index 6525336fb71..465e4cd237e 100644
--- a/ui/config/environment.js
+++ b/ui/config/environment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -38,12 +38,15 @@ module.exports = function (environment) {
       ],
       // number of records to show on a single page by default - this is used by the client-side pagination
       DEFAULT_PAGE_SIZE: 100,
+
+      ANALYTICS_CONFIG: { enabled: false },
     },
     flashMessageDefaults: {
       timeout: 7000,
       sticky: false,
     },
   };
+
   if (environment === 'development') {
     // ENV.APP.LOG_RESOLVER = true;
     // ENV.APP.LOG_ACTIVE_GENERATION = true;
@@ -56,6 +59,15 @@ module.exports = function (environment) {
         handler: process.env.MIRAGE_DEV_HANDLER,
       };
     }
+
+    if (process.env.ENABLE_POSTHOG) {
+      ENV.APP.ANALYTICS_CONFIG = {
+        provider: 'posthog',
+        enabled: true,
+        project_id: 'phc_zPQ9fPlFj4ZTYKJmThG1C8AE4J4RgPQx8dJJ7agg4SG',
+        api_host: 'https://eu.i.posthog.com',
+      };
+    }
   }
 
   if (environment === 'test') {
@@ -70,11 +82,22 @@ module.exports = function (environment) {
     ENV['ember-cli-mirage'] = {
       enabled: false,
     };
+    ENV.APP.ANALYTICS_CONFIG = { enabled: false };
   }
+
   if (environment !== 'production') {
     ENV.APP.DEFAULT_PAGE_SIZE = 15;
   }
 
+  if (environment === 'production') {
+    ENV.APP.ANALYTICS_CONFIG = {
+      provider: 'posthog',
+      enabled: true,
+      project_id: 'phc_pIw6t5numW5jDram4dnJjSnwDOorf9IGd1MmlFp0dHh',
+      api_host: 'https://eu.i.posthog.com',
+    };
+  }
+
   ENV.welcomeMessage = process.env.UI_AUTH_WELCOME;
 
   return ENV;
diff --git a/ui/config/targets.js b/ui/config/targets.js
index dbd63a63a79..40f7ec7d46b 100644
--- a/ui/config/targets.js
+++ b/ui/config/targets.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/docs/building-components.md b/ui/docs/building-components.md
new file mode 100644
index 00000000000..033b0832c05
--- /dev/null
+++ b/ui/docs/building-components.md
@@ -0,0 +1,40 @@
+# Building and consuming components
+
+- [Page components for every route](#page-components-for-every-route)
+- [Conditional rendering](#conditional-rendering)
+- [Reusable components](#reusable-components)
+
+Components can range from small, highly reusable "atoms" to large units with lots of business logic specific to one workflow or action. In any scenario, these are things to keep in mind while developing components for the Vault UI.
+
+Please note that these guidelines are aspirational and you will see instances of anti-patterns in the codebase. Many of these should be updated as we move forward. As with any rule set, sometimes it is appropriate to break the rule.
+
+## Page components for every route
+
+Route templates should render a `Page` component, which includes breadcrumbs, page title, and then renders whatever else should be on the page (often another scoped component).
+
+- This component should be named something like `<Page::CreateFoo />` and you can create it like `ember g component page/create-foo -gc`.
+- The Route should pass the model hook data into the component in the template. However, if the model hook returns multiple objects they should each be passed into the Page component as separate args. For example: within a route's template whose model hook returns two different data models, the route's template would look like:
+
+```hbs
+<Page::CreateFoo @config={{this.model.config}} @foo={{this.model.foo}} />
+```
+
+## Conditional rendering
+
+Generally, we want the burden of deciding whether a component should render to live in the parent rather than the child.
+
+- **Readability** - it's easier to tell at a glance that a component will sometimes not render if the `{{#if}}` block is on the parent.
+- **Performance** - when a component is in charge of its own rendering logic, the component's lifecycle hooks will fire whether or not the component will render on the page. This can lead to degraded performance, for example if hundreds of the same component are listed on the page.
+
+## Reusable components
+
+- Consider yielding something instead of passing a new arg
+- Less is more! Adding lots of rendering logic means the component is likely doing too much
+
+| 💡 Tips for reusability                                           | Example                                                                    |
+| ----------------------------------------------------------------- | -------------------------------------------------------------------------- |
+| ✅ Add splattributes to the top level                             | <pre>`<div ...attributes> Something! </div>`</pre>                         |
+| ✅ Pass a class or helper that controls a style                   | <pre>`<Block @title="Example" class="padding-0" />`</pre>                  |
+| ❌ Don't pass a new arg that controls a style                     | <pre>`<Block @title="Example" @hasPadding={{false}} />` </pre>             |
+| ✅ Minimize args passed, pass one arg that is rendered if present | <pre>`<Block @title="Example" @icon="key" />`</pre>                        |
+| ❌ Don't pass separate args required for icon to render           | <pre>`<Block @title="Example" @hasIcon={{true}} @iconName="key" />` </pre> |
diff --git a/ui/docs/client-pagination.md b/ui/docs/client-pagination.md
index 7fd0197c6c1..44d425f5932 100644
--- a/ui/docs/client-pagination.md
+++ b/ui/docs/client-pagination.md
@@ -1,10 +1,10 @@
 # Client-side pagination
 
-Our custom extended `store` service allows us to paginate LIST responses while maintaining good performance, particularly when the LIST response includes tens of thousands of keys in the data response. It does this by caching the entire response, and then filtering the full response into the datastore for the client.
+Our custom `pagination` service allows us to paginate LIST responses while maintaining good performance, particularly when the LIST response includes tens of thousands of keys in the data response. It does this by caching the entire response, and then filtering the full response into the datastore for the client. It was originally a custom method in our `store` service that extended the ember-data `store` but now is it's own `pagination` service.
 
 ## Using pagination
 
-Rather than use `store.query`, use `store.lazyPaginatedQuery`. It generally uses the same inputs, but accepts additional keys in the query object `size`, `page`, `responsePath`, `pageFilter`
+Rather than use `store.query`, use `pagination.lazyPaginatedQuery`. It generally uses the same inputs, but accepts additional keys in the query object `size`, `page`, `responsePath`, `pageFilter`
 
 ### Before
 
@@ -23,12 +23,12 @@ export default class ExampleRoute extends Route {
 
 ```js
 export default class ExampleRoute extends Route {
-  @service store;
+  @service pagination;
 
   model(params) {
     const { page, pageFilter, secret } = params;
     const { backend } = this.paramsFor('vault.cluster.secrets.backend');
-    return this.store.lazyPaginatedQuery('secret', {
+    return this.pagination.lazyPaginatedQuery('secret', {
       backend,
       id: secret,
       size,
@@ -47,11 +47,11 @@ In order to interrupt the regular serialization when using `lazyPaginatedData`,
 
 ## Gotchas
 
-The data is cached from whenever the original API call is made, which means that if a user views a list and then creates or deletes an item, viewing the list page again will show outdated information unless the cache for the item is cleared first. For this reason, it is best practice to clear the dataset with `store.clearDataset(modelName)` after successfully deleting or creating an item.
+The data is cached from whenever the original API call is made, which means that if a user views a list and then creates or deletes an item, viewing the list page again will show outdated information unless the cache for the item is cleared first. For this reason, it is best practice to clear the dataset with `pagination.clearDataset(modelName)` after successfully deleting or creating an item.
 
 ## How it works
 
-When using the `lazyPaginatedQuery` method, the full response is cached in a [tracked Map](https://github.com/tracked-tools/tracked-built-ins/tree/master) within the service. `store.lazyCaches` is actually a Map of [Maps](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map), keyed first on the normalized modelType and then on a stringified version of the base query (all keys except ones related to pagination). So, at the top level `store.lazyCaches` looks like this:
+When using the `lazyPaginatedQuery` method, the full response is cached in a [tracked Map](https://github.com/tracked-tools/tracked-built-ins/tree/master) within the service. `pagination.lazyCaches` is actually a Map of [Maps](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map), keyed first on the normalized modelType and then on a stringified version of the base query (all keys except ones related to pagination). So, at the top level `pagination.lazyCaches` looks like this:
 
 ```
 lazyCaches = new Map({
@@ -61,7 +61,7 @@ lazyCaches = new Map({
 })
 ```
 
-Within each top-level modelType, we need to separate cached responses based on the details of the query. Typically (but not always) this includes the backend name. In list items that can be nested (see KV V2 secrets or namespaces for example) `id` is also provided, so that the keys nested under the given ID is returned. The store.lazyCaches may look something like the following after a user navigates to a couple different KV v2 lists, and clicks into the `app/` item:
+Within each top-level modelType, we need to separate cached responses based on the details of the query. Typically (but not always) this includes the backend name. In list items that can be nested (see KV V2 secrets or namespaces for example) `id` is also provided, so that the keys nested under the given ID is returned. The pagination.lazyCaches may look something like the following after a user navigates to a couple different KV v2 lists, and clicks into the `app/` item:
 
 ```
 lazyCaches = new Map({
diff --git a/ui/docs/components.md b/ui/docs/components.md
deleted file mode 100644
index b38aeafa427..00000000000
--- a/ui/docs/components.md
+++ /dev/null
@@ -1,61 +0,0 @@
-# Writing and consuming components
-
-Components can range from small, highly reusable "atoms" to large units with lots of business logic specific to one workflow or action. In any scenario, these are things to keep in mind while developing components for the Vault UI.
-
-Please note that these guidelines are aspirational and you will see instances of antipatterns in the codebase. Many of these should be updated as we move forward. As with any ruleset, sometimes it is appropriate to break the rule.
-
-## Page components for every route
-
-Route templates should render a `Page` component, which includes breadcrumbs, page title, and then renders whatever else should be on the page (often another scoped component).
-
-- This component should be named something like `<Page::CreateFoo />` and you can create it like `ember g component page/create-foo -gc`.
-- The Route should pass the model hook data into the component in the template. However, if the model hook returns multiple objects they should each be passed into the Page component as separate args. For example: within a route's template whose model hook returns two different data models, the route's template would look like:
-
-```hbs
-<Page::CreateFoo @config={{this.model.config}} @foo={{this.model.foo}} />
-```
-
-## Conditional rendering
-
-Generally, we want the burden of deciding whether a component should render to live in the parent rather than the child.
-
-- **Readability** - it's easier to tell at a glance that a component will sometimes not render if the `{{#if}}` block is on the parent.
-- **Performance** - when a component is in charge of its own rendering logic, the component's lifecycle hooks will fire whether or not the component will render on the page. This can lead to degraded performance, for example if hundreds of the same component are listed on the page.
-
-## Reusable components
-
-When developing components, make sure to:
-
-- Add splattributes to the top level, eg:
-
-  ```hbs
-  <div data-test-stuff ...attributes>Stuff!</div>
-  ```
-
-- Consider passing splattributes or yielding something instead of passing a new arg
-
-  ❌ **Instead of:** passing a new arg that controls a style
-
-  ```
-  <Block @title="Example" @hasPadding={{false}} />
-  ```
-
-  ✅ **Prefer:** passing a class or helper that controls a style
-
-  ```
-  <Block @title="Example" class="padding-0" />
-  ```
-
-- Minimize the number of args that must be passed
-
-  ❌ **Instead of:** Passing in separate args that are both required for icon to render
-
-  ```
-  <Block @title="Example" @hasIcon={{true}} @iconName="key" />
-  ```
-
-  ✅ **Prefer:** One arg that is rendered if present
-
-  ```
-  <Block @title="Example" @icon="key" />
-  ```
diff --git a/ui/docs/ember-engines.md b/ui/docs/ember-engines.md
index 56cd5841e39..dd37c71affc 100644
--- a/ui/docs/ember-engines.md
+++ b/ui/docs/ember-engines.md
@@ -35,7 +35,7 @@ In the engine’s `index.js` file:
 
 ```js
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -57,7 +57,6 @@ Within your Engine’s `config/environment.js` file:
 
 ```js
 /**
- * Copyright (c) HashiCorp, Inc.
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -79,7 +78,6 @@ Within your Engine’s `addon/engine.js` file:
 
 ```js
 /**
- * Copyright (c) HashiCorp, Inc.
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -96,7 +94,7 @@ export default class <EngineName>Engine extends Engine {
   modulePrefix = modulePrefix;
   Resolver = Resolver;
   dependencies = {
-    services: ['router', 'store', 'secret-mount-path', 'flash-messages'],
+    services: ['app-router', 'store', 'secret-mount-path', 'flash-messages'],
     externalRoutes: ['secrets'],
   };
 }
@@ -128,11 +126,10 @@ The external route dependencies allow you to link to a route outside of your eng
 
 ## Register your engine with our main application:
 
-In our `app/app.js` file in the engines object, add your engine’s name and dependencies.
+In our `app/app.js` file in the engines object, add your engine’s name and dependencies. The `router` service must be referenced via an alias within engines. The pattern is to use `app-router` as the alias, see example below.
 
 ```js
 /**
- * Copyright (c) HashiCorp, Inc.
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -146,7 +143,7 @@ export default class App extends Application {
   engines = {
     <engine-name>: {
       dependencies: {
-        services: ['router', 'store', 'secret-mount-path', 'flash-messages', <any-other-dependencies-you-have>],
+        services: [{ 'app-router': 'router' }, 'store', 'secret-mount-path', 'flash-messages', <any-other-dependencies-you-have>],
         externalRoutes: {
           secrets: 'vault.cluster.secrets.backends',
         },
diff --git a/ui/docs/how-to-docfy.md b/ui/docs/how-to-docfy.md
new file mode 100644
index 00000000000..50871acf8cc
--- /dev/null
+++ b/ui/docs/how-to-docfy.md
@@ -0,0 +1,102 @@
+---
+title: How to docfy
+order: 1
+---
+
+# How to docfy
+
+http://localhost:4200/ui/docs (navigate to directly or click the present icon in the bottom right of the app footer).
+
+## `docs/` markdown files
+
+Side nav links correspond to the file + directory structure within the `docs/` directory. These top-level markdown files **can** be edited directly and any updates should be saved and pushed to main. (Component docs are generated by the `yarn docs` command, see below.)
+
+## generating component docs
+
+The `docs/components` directory is where _generated_ component markdown files are located after running `yarn docs`. **Do not edit component markdown files directly**. Instead, update markdown by making changes to the `jsdoc` and then re-running the generate command. The `docs/components/*` files are included in `.gitignore` so they are not pushed to main. `jsdoc-to-markdown` errors log in the console.
+
+> _If you have never run the `yarn docs` command before, you need to create the `docs/components` directory locally before running `yarn docfy-md` so the markdown has a place to go. `mkdir docs/components`_
+
+```
+yarn docfy-md <component name> <addon or engine> <full filepath>
+```
+
+> _Note: the above command takes three args, if passing the full filepath for a component then the second arg is unnecessary_
+
+| Command                                                                   | Description                                                                                  |
+| ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| `yarn docs`                                                               | generate markdown file for every\* component in the `addon/core` directory                   |
+| `yarn docfy-md some-component-name`                                       | generate markdown file for **specific** component                                            |
+| `yarn docfy-md read-more core`                                            | generate markdown for `read-more` component in the `core` addon                              |
+| `yarn docfy-md pki-test null ./lib/pki/addon/components/pki-key-usage.ts` | optional third arg is the full component filepath (first arg will become markdown file name) |
+| `mkdir docs/components`                                                   | create directory where the generated component markdown files will go                        |
+| `rm -f ./docs/components/*`                                               | cleanup and delete generated component markdown files                                        |
+
+> _\*replication and `shamir/*` components are skipped as these are not reused and should eventually be moved outside the `addon/core` directory_
+
+## Writing documentation for a component
+
+Component docs are generated by the script `yarn docs`. Accurate `jsdoc` syntax is important so `jsdoc-to-markdown` properly generates the markdown file for that component. **Do not edit component markdown files directly**.
+
+| jsdoc examples                           |                                                                                                            |                                                               |
+| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
+| form-field (`@description` example)      | [github ](https://github.com/hashicorp/vault/blob/main/ui/lib/core/addon/components/form-field.js)         | [vscode ](../lib/core/addon/components/form-field.js)         |
+| confirmation-modal                       | [github ](https://github.com/hashicorp/vault/blob/main/ui/lib/core/addon/components/confirmation-modal.js) | [vscode ](../lib/core/addon/components/confirmation-modal.js) |
+| certificate-card                         | [github ](https://github.com/hashicorp/vault/blob/main/ui/lib/core/addon/components/certificate-card.js)   | [vscode ](../lib/core/addon/components/certificate-card.js)   |
+| alert-inline (`@deprecated` example)     | [github](https://github.com/hashicorp/vault/blob/main/ui/lib/core/addon/components/alert-inline.js)        | [vscode ](../lib/core/addon/components/alert-inline.js)       |
+| secret-list-header (code snippet only\*) | [github](https://github.com/hashicorp/vault/blob/main/ui/lib/core/addon/components/secret-list-header.js)  | [vscode ](../lib/core/addon/components/secret-list-header.js) |
+
+> _\*renders a template code snippet and not instantiated component because it relies on too many args that cannot be set up for component instance_
+
+### Syntax tips
+
+Docfy renders an actual instance of the component beneath `@example` as a sample. Make sure the component uses proper hbs syntax and all args are on a single line.
+
+> - Check the generated markdown file for syntax errors or typos. To update the markdown, first edit the jsdoc then re-run the generator. _Do not edit component markdown files directly_
+> - Param types: `object`, `string`, `function`, `array`
+> - Do not include `null` for empty default values
+> - Wrap optional params in brackets `[]`
+> - To include a codeblock in your module's description use `@description`
+
+```
+❌ multi-line jsdoc will not render a component example
+* @example
+* <Block
+*  @title="Example"
+*  @description="My component"
+* />
+```
+
+```
+✅ this will render
+* @example
+* <Block @title="Example" description="My component" />
+```
+
+**Template**
+
+```
+/**
+ * @module ComponentName
+ * @description
+ * Description of the component
+ *
+ * @example
+ * <ComponentName @param={{}} optionalParam={{}} />
+ *
+ * @param {object} paramName - description
+ * @param {array} requiredParam=foo - foo is the default value here
+ * @param {function} [optionalParamName] - An optional parameter is wrapped in brackets
+ * @param {string} [param="some default value"] - An optional parameter with a default value
+ */
+```
+
+> ### Config
+>
+> - [docfy-md.js](../scripts/docfy-md.js): script that generates component markdown and passes options to `jsdoc2md` command
+> - [generate-docs.sh](../scripts/docfy-md.js): batch command that iterates over desired javascript and typescript file in the `core` addon engine
+> - [jsdoc2md.json](../jsdoc2md.json): `jsdoc-to-markdown` config file, necessary so typescript files can be passed to `docfy-md` script
+
+### More info
+
+- [Building and consuming components](./building-components.md)
diff --git a/ui/docs/index.md b/ui/docs/index.md
new file mode 100644
index 00000000000..44bc4ac4337
--- /dev/null
+++ b/ui/docs/index.md
@@ -0,0 +1,21 @@
+---
+title: Index
+---
+
+# Welcome to our docs!
+
+These views are generated by files in the `docs/` directory.
+
+<hr>
+
+- [How to docfy](./how-to-docfy.md)
+- [Client pagination](./client-pagination.md)
+- [Building and consuming components](./building-components.md)
+- [CSS styling](./css.md)
+- [Ember Engines](./ember-engines.md)
+- [Fetch secrets engine config decorator](./fetch-secrets-engine-config.md)
+- [Forms](./forms.md)
+- [Model validations](./model-validations.md)
+- [Models](./models.md)
+- [Routing](./routing.md)
+- [Serializers and Adapters](./serializers-adapters.md)
diff --git a/ui/docs/model-validations.md b/ui/docs/model-validations.md
index ad0ce0dace6..622aa7debb7 100644
--- a/ui/docs/model-validations.md
+++ b/ui/docs/model-validations.md
@@ -1,34 +1,33 @@
 # Model Validations Decorator
-  
+
 The model-validations decorator provides a method on a model class which may be used for validating properties based on a provided rule set.
 
 ## API
 
 The decorator expects a validations object as the only argument with the following shape:
 
-``` js
+```js
 const validations = {
-  [propertyKeyName]: [
-    { type, options, message, level, validator }
-  ]
+  [propertyKeyName]: [{ type, options, message, level, validator }],
 };
 ```
+
 **propertyKeyName** [string] - each key in the validations object should refer to the property on the class to apply the validation to.
- 
-**type** [string] - the type of validation to apply. These must be exported from the [validators util](../app/utils/validators.js) for lookup. Type is required if a *validator* function is not provided.
+
+**type** [string] - the type of validation to apply. These must be exported from the [validators util](../app/utils/model-helpers/validators.js) for lookup. Type is required if a _validator_ function is not provided.
 
 **options** [object] - an optional object for the given validator -- min, max, nullable etc.
 
 **message** [string | function] - string added to the errors array and returned in the state object from the validate method if validation fails. A function may also be provided with the model as the lone argument that returns a string. Since this value is typically displayed to the user it should be a complete sentence with proper punctuation.
 
-**level** [string] *optional* - string that defaults to 'error'. Currently the only other accepted value is 'warn'.
+**level** [string] _optional_ - string that defaults to 'error'. Currently the only other accepted value is 'warn'.
 
-**validator** [function] *optional* - a function that may be used in place of type that is invoked in the validate method. This is useful when specific validations are needed which may be dependent on other class properties.
+**validator** [function] _optional_ - a function that may be used in place of type that is invoked in the validate method. This is useful when specific validations are needed which may be dependent on other class properties.
 This function takes the class context (this) as the only argument and returns true or false.
 
 ## Usage
 
-Each property defined in the validations object supports multiple validations provided as an array. For example, *presence* and *containsWhiteSpace* can both be added as validations for a string property. 
+Each property defined in the validations object supports multiple validations provided as an array. For example, _presence_ and _containsWhiteSpace_ can both be added as validations for a string property.
 
 ```js
 const validations = {
@@ -41,6 +40,7 @@ const validations = {
   ],
 };
 ```
+
 Decorate the model class and pass the validations object as the argument
 
 ```js
@@ -48,9 +48,7 @@ import Model, { attr } from '@ember-data/model';
 import withModelValidations from 'vault/decorators/model-validations';
 
 const validations = {
-  name: [
-    { type: 'presence', message: 'Name is required.' },
-  ],
+  name: [{ type: 'presence', message: 'Name is required.' }],
 };
 
 @withModelValidations(validations)
@@ -72,12 +70,13 @@ if (isValid) {
   this.errors = state;
 }
 ```
+
 **isValid** [boolean] - the validity of the full class. If no properties provided in the validations object are invalid this will be true.
 
-**state** [object] - the error state of the properties defined in the validations object. This object is keyed by the property names from the validations object and each property contains an *isValid* and *errors* value. The *errors* array will be populated with messages defined in the validations object when validations fail. Since a property can have multiple validations, errors is always returned as an array.
+**state** [object] - the error state of the properties defined in the validations object. This object is keyed by the property names from the validations object and each property contains an _isValid_ and _errors_ value. The _errors_ array will be populated with messages defined in the validations object when validations fail. Since a property can have multiple validations, errors is always returned as an array.
 
 **invalidFormMessage** [string] - message describing the number of errors currently present on the model class.
- 
+
 ```js
 const { state } = model.validate();
 const { isValid, errors } = state[propertyKeyName];
@@ -87,17 +86,18 @@ if (!isValid) {
 ```
 
 ## Examples
+
 ### Basic
 
 ```js
 const validations = {
-  foo: [
-    { type: 'presence', message: 'foo is a required field.' }
-  ],
+  foo: [{ type: 'presence', message: 'foo is a required field.' }],
 };
 
 @withModelValidations(validations)
-class SomeModel extends Model { foo = null; }
+class SomeModel extends Model {
+  foo = null;
+}
 
 const model = new SomeModel();
 const { isValid, state } = model.validate();
@@ -106,14 +106,17 @@ console.log(isValid); // false
 console.log(state.foo.isValid); // false
 console.log(state.foo.errors); // ['foo is a required field']
 ```
+
 ### Custom validator
 
 ```js
 const validations = {
-  foo: [{
-    validator: (model) => model.bar.includes('test') ? model.foo : false,
-    message: 'foo is required if bar includes test.'
-  }],
+  foo: [
+    {
+      validator: (model) => (model.bar.includes('test') ? model.foo : false),
+      message: 'foo is required if bar includes test.',
+    },
+  ],
 };
 
 @withModelValidations(validations)
@@ -139,7 +142,7 @@ console.log(state.foo.errors); // []
 
 ### Adding class in template based on validation state
 
-All form validation errors must have a red border around them. Add this by adding a conditional class *has-error-border* to the element.
+All form validation errors must have a red border around them. Add this by adding a conditional class _has-error-border_ to the element.
 
 ```js
 @action
@@ -155,5 +158,5 @@ async save() {
 ```
 
 ```hbs
- <input class="input field {{if this.isNameInvalid 'has-error-border'}}" />
-```
\ No newline at end of file
+<input class='input field {{if this.isNameInvalid "has-error-border"}}' />
+```
diff --git a/ui/docs/models.md b/ui/docs/models.md
index a13a56cbcf2..1c5b75fca51 100644
--- a/ui/docs/models.md
+++ b/ui/docs/models.md
@@ -4,17 +4,252 @@
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
 
 - [Models](#models)
-  - [Capabilities](#capabilities)
-  - [Decorators](#decorators)
+  - [Intro](#intro)
+  - [Model patterns overview](#model-patterns-overview)
+  - [Patterns](#patterns)
+    - [Attributes \& field groups](#attributes--field-groups)
+      - [Attributes \& field groups example](#attributes--field-groups-example)
+    - [Validations](#validations)
+      - [@withModelValidations()](#withmodelvalidations)
+    - [Capabilities](#capabilities)
+      - [Examples](#examples)
+    - [Models hydrated by OpenAPI](#models-hydrated-by-openapi)
+  - [Using Decorators](#using-decorators)
     - [@withFormFields()](#withformfields)
-    - [@withModelValidations()](#withmodelvalidations)
 
 <!-- END doctoc generated TOC please keep comment here to allow auto update -->
 
-## Capabilities
+## Intro
 
-- The API will prevent users from performing disallowed actions, adding capabilities is purely to improve UX
-- Always test the capability works as expected (never assume the API path 🙂), the extra string interpolation can lead to sneaky typos and incorrect returns from the getters
+We use models primarily as the backing data layer for our forms and for our list/show views. As Ember-Data has matured, our patterns of usage have become outdated. This document serves to outline our current best-practices, since examples within the codebase are often out of date and do not always reflect our best practices or ambitions.
+
+## Model patterns overview
+
+Models can be thought of as the shape of data that an instance of that Model -- a Record -- will have. Models should be as "thin" as possible, holding only data directly relevant to the Record itself. For example, if we have a Model `user` with attributes `firstName` and `lastName`, it _is_ appropriate to have a getter on the Model called `fullName`, because its attributes can be calculated directly from the record's values, and is relevant to the Record itself. However it is _not_ appropriate to store data like which fields are shown on the edit form, because that has no bearing on the Record itself. Field values are a display concern, not related to the values of the record.
+
+Other patterns and where they belong in relation to the Model:
+
+- **Attribute metadata** - this is referring to information defined on a Model's attributes, such as label, edit type, and other information relevant to both forms and the given attribute. We use these heavily in the `FormField` component to show the correct label, help text, and input type. Conceptually, this does not belong on a Model (because the information is not directly related to the data in a Record) but, since we leverage OpenAPI heavily to populate both attributes and their metadata, we are going to keep attribute metadata defined on the attribute in the Model. **TL;DR: Lives on Model**
+
+- **Form and show fields** - the grouping and order of fields that should display on both show routes and create/edit forms, while conceptually related to the Model, is not related to an individual record. Therefore, this information should not be defined on the Model (which has been our previous pattern). To support migration, we have a few helpful decorators and patterns. **TL;DR: Lives in component or model-helper util files**
+
+- **Validations** - While an argument can go either way about this one, we are going to continue defining these on the Model using our handy [withModelValidation decorator](#withmodelvalidations). The state of validation is directly correlated to a given Record which is a strong reason to keep it on the Model. **TL;DR: Lives on Model**
+
+- **[Capabilities](#capabilities)** - Capabilities are calculated by fetching permissions by path -- often multiple paths, based on the same information we need to fetch the Record data (eg. backend, ID). When using `lazyCapabilities` on the model we kick off one API request for each of the paths we need, while using the capabilities service `fetch` method we can make one request with all the required paths included. Our best practice is to fetch capabilities outside of the Model (perhaps as part of a route model, or on a user action such as dropdown click open). A downside to this approach is that the API may get re-requested per page we check the capability (eg. list view dropdown and then detail view) -- but we can optimize this in the future by first checking the store for `capabilities` of matching path/ID before sending the API request. **TL;DR: Lives in route or component where they are used**
+
+## Patterns
+
+### Attributes & field groups
+
+We use attributes defined on the Model to determine input concerns (label, input type, help text) and field groups to determine the order of the attribute data on the form and detail pages, and are defined in the component they are used in or in a `utils/model-helpers/*` file.
+
+#### Attributes & field groups example
+
+In this example, we have a Model `simple-timer` with a few attributes defined. The `withExpandedAttributes` helper adds a couple items to the Model it's applied to:
+
+- allByKey - a getter which returns all the attributes as keys of an object, and the value is the metadata of the attribute including anything returned from OpenAPI if the model is included in `OPENAPI_POWERED_MODELS`.
+- \_expandGroups - takes an array of group objects and expands the attribute keys into the metadata
+
+In the component where we pass a Record of this Model, we can see how we use it to populate either a flat array of attributes for use in the show view, or to populate groups of fields for rendering on a form.
+
+```js
+// models/simple-timer.js
+@withExpandedAttributes()
+export default class SimpleTimer extends Model {
+  @attr('string', {
+    editType: 'ttl',
+    defaultValue: '3600s',
+    label: 'TTL',
+    helpText: 'Here is some help text',
+  })
+  ttl;
+
+  @attr('string') name;
+  @attr('boolean') restartable; // enterprise only
+}
+```
+
+```js
+// components/simple-timer-display.ts
+export default class SimpleTimerDisplay extends Component<Args> {
+  @service declare readonly version: VersionService;
+
+  // these fields are shown flat in the show mode, iterated over
+  // and used in InfoTableRow
+  get showFields() {
+    let fields = ['name', 'ttl'];
+    if (this.version.isEnterprise) {
+      fields.push('restartable');
+    }
+    return fields.map((field) => this.args.model.allByKey[field]);
+  }
+
+  // these fields are shown grouped in edit mode and is formatted
+  // to be used in something like FormFieldGroups
+  get fieldGroups() {
+    let groups = [{ default: ['name', 'ttl'] }];
+    if (this.version.isEnterprise) {
+      groups[{ 'Custom options': ['restartable'] }];
+    }
+    return this.args.model._expandGroups(groups);
+  }
+}
+```
+
+### Validations
+
+Validations on used on forms, to present the user with feedback about their form answers before sending the payload to the API. Our best practices are:
+
+- define the validations using the `withModelValidations` decorator
+- trigger the `validate()` method added by the decorator on form submit
+- if there are validation errors:
+  - show a message at the bottom of the form saying there were errors with the form
+  - add inline-alert next to the inputs that have incorrect data
+  - exit the form submit function early
+  - do not disable the submit button
+- if there are no validation errors, continue saving as normal
+
+#### [@withModelValidations()](../app/decorators/model-validations.js)
+
+This decorator:
+
+- Adds `validate()` method on model to check attributes are valid before making an API request
+- Provides option to write a custom validation, or use validation method from the [validators util](../app/utils/model-helpers/validators.js) which is referenced by the `type` key
+- Option to add `level: 'warn'` to draw user attention to the input, without preventing form submission
+- Component example [here](../lib/pki/addon/components/pki-generate-root.ts)
+
+```js
+import { withModelValidations } from 'vault/decorators/model-validations';
+
+const validations = {
+  // object key is the model's attribute name
+  password: [{ type: 'presence', message: 'Password is required' }],
+  keyName: [
+    {
+      validator(model) {
+        return model.keyName === 'default' ? false : true;
+      },
+      message: `Key name cannot be the reserved value 'default'`,
+    },
+  ],
+};
+
+@withModelValidations(validations)
+export default class FooModel extends Model {
+  @attr() password;
+  @attr() keyName;
+}
+```
+
+```js
+// form-component.js
+export default class FormComponent extends Component {
+  @tracked modelValidations = null;
+  @tracked invalidFormAlert = '';
+
+  checkFormValidity() {
+    interface Validity {
+      // only true if all of the state's isValid are also true
+      isValid: boolean;
+      state: {
+        // state is keyed by the attribute names
+        [key: string]: {
+          errors: string[];
+          warnings: string[];
+          isValid: boolean;
+        }
+      }
+      invalidFormMessage: string; // eg "There are 2 errors with this form"
+    }
+    // calling validate() returns Validity
+    const { isValid, state, invalidFormMessage } = this.args.model.validate();
+    this.modelValidations = state;
+    this.invalidFormAlert = invalidFormMessage;
+    return isValid;
+  }
+
+  @action
+  submit() {
+    // clear errors
+    this.modelValidations = null;
+    this.invalidFormAlert = null;
+
+    // check validity
+    const continueSave = this.checkFormValidity();
+    if (!continueSave) return;
+
+    // continue save ...
+  }
+}
+```
+
+### Capabilities
+
+- The API will prevent users from performing disallowed actions, so adding capabilities is purely to improve UX by hiding actions we know the user cannot take. Because of this, we default to showing items if we cannot determine the capabilities for an endpoint.
+- Always test the capability works as expected (never assume the API path 🙂) -- the extra string interpolation can lead to sneaky typos and incorrect returns from the getters
+- Capabilities are checked via the `capabilities-self` endpoint, and registered in the store as a [capabilities Model](../app/models/capabilities.js), with the path as the Record's ID.
+- The path IDs on the capabilities Records should never include the namespace, but when operating within a namespace the paths in the API request payload must be prepended with the namespace so the API will return the proper capabilities (eg. for `kv/data/foo` in the `admin` namespace instead of root)
+- In general we want to check capabilities outside of the Model, but we have a patterns for both ways.
+
+#### Examples
+
+**Single capability check within a component**
+In [this example](../app/components/clients/page-header.js), we have an action that some users can take within the page header. Honestly this capability check could just have easily lived in the route's Model (since the PageHeader always renders on the relevant routes), but here it provides a good example of a check happening on component instantiation, using the args passed to the component:
+
+```js
+// clients/page-header.js
+constructor() {
+  super(...arguments);
+  this.getExportCapabilities(this.args.namespace);
+}
+
+async getExportCapabilities(ns = '') {
+  try {
+    const url = ns
+      ? `${sanitizePath(ns)}/sys/internal/counters/activity/export`
+      : 'sys/internal/counters/activity/export';
+    const cap = await this.store.findRecord('capabilities', url);
+    this.canDownload = cap.canSudo;
+  } catch (e) {
+    // if we can't read capabilities, default to show
+    this.canDownload = true;
+  }
+}
+```
+
+**Multiple capabilities checked at once**
+When there are multiple capabilities paths to check, the recommended approach is to use the [capabilities service's](../app/services/capabilities.ts) `fetch` method. It will pass all the paths in a single API request instead of making a capabilities-self call for each path as the other techniques do. In [this example](../lib/kv/addon/routes/secret.js), we get the capabilities as part of the route's model hook and then return the relevant `can*` values:
+
+```js
+async fetchCapabilities(backend, path) {
+  const metadataPath = `${backend}/metadata/${path}`;
+  const dataPath = `${backend}/data/${path}`;
+  const subkeysPath = `${backend}/subkeys/${path}`;
+  const perms = await this.capabilities.fetch([metadataPath, dataPath, subkeysPath]);
+  // returns values keyed at the path
+  return {
+    metadata: perms[metadataPath],
+    data: perms[dataPath],
+    subkeys: perms[subkeysPath],
+  };
+}
+
+async model() {
+  const backend = this.secretMountPath.currentPath;
+  const { name: path } = this.paramsFor('secret');
+  const capabilities = await this.fetchCapabilities(backend, path);
+  return hash({
+    // ...
+    canUpdateData: capabilities.data.canUpdate,
+    canReadData: capabilities.data.canRead,
+    canReadMetadata: capabilities.metadata.canRead,
+    canDeleteMetadata: capabilities.metadata.canDelete,
+    canUpdateMetadata: capabilities.metadata.canUpdate,
+  });
+}
+```
+
+Lastly, we have an example that is common but a pattern that we want to move away from: using `lazyCapabilities` on a Model. The `lazyCapabilities` macro only fetches the capabilities when the attribute is invoked -- so in the example below, only when `canRead` is rendered on the template will the capablities-self call be kicked off.
 
 ```js
 import lazyCapabilities, { apiPath } from 'vault/macros/lazy-capabilities';
@@ -37,13 +272,20 @@ export default class FooModel extends Model {
 }
 ```
 
-## Decorators
+### Models hydrated by OpenAPI
+
+In a Model which is hydrated by OpenAPI, it can be cumbersome to keep up with all the changes made by the backend. One pattern available to us is the [`combineFieldGroups`](../app/utils/openapi-to-attrs.js) method, which
+
+---
+
+## Using Decorators
 
 ### [@withFormFields()](../app/decorators/model-form-fields.js)
 
 - Sets `allFields`, `formFields` and/or `formFieldGroups` properties on a model class
 - `allFields` includes every model attribute (regardless of args passed to decorator)
 - `formFields` and `formFieldGroups` only exist if the relevant arg is passed to the decorator
+- `type` of validator should match the keys in [model-helpers/validators.js](../app/utils/model-helpers/validators.js)
 
 ```js
 import { withFormFields } from 'vault/decorators/model-form-fields';
@@ -106,48 +348,3 @@ model.formFieldGroups = [
   },
 ];
 ```
-
-### [@withModelValidations()](../app/decorators/model-validations.js)
-
-- Adds `validate()` method on model to check attributes are valid before making an API request
-- Option to write a custom validation, or use validation method from the [validators util](../app/utils/validators.js) which is referenced by the `type` key
-- Option to add `level: 'warn'` to draw user attention to the input, without preventing form submission
-- Component example [here](../lib/pki/addon/components/pki-generate-root.ts)
-
-```js
-import { withModelValidations } from 'vault/decorators/model-validations';
-
-const validations = {
-  // object key is the model's attribute name
-  password: [{ type: 'presence', message: 'Password is required' }],
-  keyName: [
-    {
-      validator(model) {
-        return model.keyName === 'default' ? false : true;
-      },
-      message: `Key name cannot be the reserved value 'default'`,
-    },
-  ],
-};
-
-@withModelValidations(validations)
-export default class FooModel extends Model {}
-
-// calling validate() returns an object:
-model.validate() = {
-  isValid: false,
-  state: {
-    password: {
-      errors: ['Password is required.'],
-      warnings: [],
-      isValid: false,
-    },
-    keyName: {
-      errors: ["Key name cannot be the reserved value 'default'"],
-      warnings: [],
-      isValid: true,
-    },
-  },
-  invalidFormMessage: 'There are 2 errors with this form.',
-};
-```
diff --git a/ui/docs/tests.md b/ui/docs/tests.md
new file mode 100644
index 00000000000..13821bec141
--- /dev/null
+++ b/ui/docs/tests.md
@@ -0,0 +1,35 @@
+# Test Helpers Organization
+
+Our test are constantly evolving, but here's a general overview of how we set up and organize tests.
+
+## Folder organization
+
+### /acceptance
+
+Acceptance tests should test the overall workflows and navigation within Vault. When possible, they should use the real API instead of mocked so that breaking changes from the backend can be caught. Reasons you may opt to use a mocked backend instead of the real one:
+
+- Using the real backend would cause instability in concurrently-running tests (eg. seal/unseal flow)
+- There isn't a way to set up a 3rd party dependency that the backend needs to run correctly (Database Secrets Engine, Sync Secrets)
+
+### /helpers
+
+Shared helpers such as selectors, common interactions, WebREPL commands, and API response stubs live in this folder. When selectors are only used for a single test, they should be defined on the same file where they are used for the test. Once the selectors are being used for multiple tests, they should be moved to this folder so they can be defined in a single place and shared to wherever they are needed.
+
+Often we will need a set of selectors for "workflow" tests, or acceptance tests that navigate through an area of the app. For these, the helpers should be organized as such:
+
+- `/helpers/<area>/<area>-selectors.ts` - exports selector consts (never default) for each page -- eg. for PKI we would have PKI_OVERVIEW, PKI_ROLE, etc.
+- `/helpers/<area>/<area>-helpers.js` - exports methods and consts which are otherwise helpful in the tests -- eg. example API responses, common interactions (eg. writeVersionedSecret for KV v2)
+
+Whenever possible we should try to use the general selectors exported from `/helpers/general-selectors.ts`.
+
+### integration
+
+Integration tests are most often used to test specific components out of context from the rest of the app. Be sure to mock anything that the component needs to work correctly -- for example, if the component has a certain behavior in enterprise than community edition, in your tests for each scenario it should not assume that the underlying Vault binary is in one state or the other, and mock the enterprise/community state in all the scenarios. The exports in `helpers/stubs.js` might be helpful for these tests, particularly when the component uses a model which fetches capabilities.
+
+### pages
+
+[DEPRECATED] This file should be removed in favor of selectors within the "helpers" folder. We are moving away from ember-page-object selectors toward simple strings
+
+### unit
+
+Unit tests are most often used to test utils, adapters, serializers, routes, and services functionality.
diff --git a/ui/ember-cli-build.js b/ui/ember-cli-build.js
index 0ea736613d2..c087ad126d0 100644
--- a/ui/ember-cli-build.js
+++ b/ui/ember-cli-build.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,12 +19,8 @@ const appConfig = {
     serviceWorkerScope: config.serviceWorkerScope,
     skipWaitingOnMessage: true,
   },
-  svgJar: {
-    //optimize: false,
-    //paths: [],
-    optimizer: {},
-    sourceDirs: ['public'],
-    rootURL: '/ui/',
+  babel: {
+    plugins: [require.resolve('ember-concurrency/async-arrow-task-transform')],
   },
   fingerprint: {
     exclude: ['images/'],
@@ -34,21 +30,26 @@ const appConfig = {
       return `${config.rootURL.replace(/\/$/, '')}${filePath}`;
     },
   },
-  babel: {
-    plugins: [['inline-json-import', {}]],
+  'ember-cli-babel': {
+    enableTypeScriptTransform: true,
+    throwUnlessParallelizable: true,
   },
   hinting: isTest,
-  tests: isTest,
+  tests: !isProd,
   sourcemaps: {
     enabled: !isProd,
   },
   sassOptions: {
     sourceMap: false,
     onlyIncluded: true,
+    quietDeps: true, // silences deprecation warnings from dependencies
     precision: 4,
     includePaths: [
-      './node_modules/@hashicorp/design-system-components/app/styles',
+      './node_modules/@hashicorp/design-system-components/dist/styles',
       './node_modules/@hashicorp/design-system-tokens/dist/products/css',
+      './node_modules/ember-basic-dropdown/',
+      './node_modules/ember-power-select/',
+      './node_modules/@hashicorp-internal/vault-reporting/dist/styles',
     ],
   },
   minifyCSS: {
@@ -78,18 +79,16 @@ const appConfig = {
 module.exports = function (defaults) {
   const app = new EmberApp(defaults, appConfig);
 
-  app.import('vendor/string-includes.js');
-  app.import('node_modules/string.prototype.endswith/endswith.js');
-  app.import('node_modules/string.prototype.startswith/startswith.js');
-
   app.import('node_modules/jsonlint/lib/jsonlint.js');
-  app.import('node_modules/codemirror/addon/lint/lint.css');
-  app.import('node_modules/codemirror/lib/codemirror.css');
   app.import('node_modules/text-encoder-lite/text-encoder-lite.js');
-  app.import('node_modules/jsondiffpatch/dist/jsondiffpatch.umd.js');
-  app.import('node_modules/jsondiffpatch/dist/formatters-styles/html.css');
+  app.import('vendor/jsondiffpatch.umd.js');
+  app.import('vendor/htmlformatter.umd.js');
+  app.import('node_modules/jsondiffpatch/lib/formatters/styles/html.css');
 
   app.import('app/styles/bulma/bulma-radio-checkbox.css');
+  app.import(
+    'node_modules/@hashicorp/design-system-components/dist/styles/@hashicorp/design-system-components.css'
+  );
 
   return app.toTree();
 };
diff --git a/ui/jsdoc2md.json b/ui/jsdoc2md.json
new file mode 100644
index 00000000000..2254967c08e
--- /dev/null
+++ b/ui/jsdoc2md.json
@@ -0,0 +1,18 @@
+{
+  "source": {
+    "includePattern": ".+\\.(js|ts)(doc|x)?$",
+    "excludePattern": ".+\\.(test|spec).(js|ts)"
+  },
+  "plugins": ["plugins/markdown", "node_modules/jsdoc-babel"],
+  "babel": {
+    "extensions": ["ts", "tsx", "js"],
+    "ignore": ["**/*.(test|spec).ts"],
+    "babelrc": false,
+    "presets": [["@babel/preset-env", { "targets": { "node": true } }], "@babel/preset-typescript"],
+    "plugins": [
+      "@babel/proposal-class-properties",
+      "@babel/proposal-object-rest-spread",
+      ["@babel/plugin-proposal-decorators", { "decoratorsBeforeExport": true }]
+    ]
+  }
+}
diff --git a/ui/lib/.eslintrc.js b/ui/lib/.eslintrc.js
index deddead0db4..e5b7fafa94e 100644
--- a/ui/lib/.eslintrc.js
+++ b/ui/lib/.eslintrc.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/config-ui/addon/components/login-settings/page/details.hbs b/ui/lib/config-ui/addon/components/login-settings/page/details.hbs
new file mode 100644
index 00000000000..818f39ba689
--- /dev/null
+++ b/ui/lib/config-ui/addon/components/login-settings/page/details.hbs
@@ -0,0 +1,52 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.top>
+    <Page::Breadcrumbs @breadcrumbs={{@breadcrumbs}} />
+  </p.top>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      {{@rule.name}}
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+<nav class="tabs" aria-label="navigation for rule details">
+  <ul>
+    <li>
+      <LinkTo @route="login-settings.rule.details" @model={{@rule}} data-test-tab="rule">
+        Details
+      </LinkTo>
+    </li>
+  </ul>
+</nav>
+
+<Toolbar>
+  <ToolbarActions>
+    {{#if (has-capability this.capabilities "delete" pathKey="customLogin" params=@rule)}}
+      <Hds::Button
+        @text="Delete Rule"
+        @color="secondary"
+        class="toolbar-button"
+        {{on "click" (fn (mut this.showConfirmModal) true)}}
+        data-test-rule-delete
+      />
+    {{/if}}
+  </ToolbarActions>
+</Toolbar>
+
+{{#each-in this.displayFields as |key label|}}
+  <InfoTableRow @alwaysRender={{true}} @label={{label}} @value={{this.displayValue key}} />
+{{/each-in}}
+
+{{#if this.showConfirmModal}}
+  <ConfirmModal
+    @color="critical"
+    @onClose={{fn (mut this.showConfirmModal) false}}
+    @confirmMessage="This will permanently delete this rule."
+    @onConfirm={{this.onDelete}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/config-ui/addon/components/login-settings/page/details.js b/ui/lib/config-ui/addon/components/login-settings/page/details.js
new file mode 100644
index 00000000000..b7e70703b25
--- /dev/null
+++ b/ui/lib/config-ui/addon/components/login-settings/page/details.js
@@ -0,0 +1,61 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import errorMessage from 'vault/utils/error-message';
+
+/**
+ * @module Page::LoginSettingsRuleDetails
+ * Page::LoginSettingsRuleDetails component is used to display rule information.
+ * Shows detailed data, (eg which namespace it applies to, auth type used etc.) on a selected login rule from the custom login settings list.
+ *
+ * @example
+ * ```js
+ * <Page::LoginSettingsRuleDetails @rule={{this.rule}}  />
+ * ```
+ * @param {object} rule - holds login rule data, { backup_auth_types: string[] eg. ['token'], default_auth_type: string "oidc", disable_inheritance: boolean,
+ * name: string "Login rule 1", namespace: string eg "admin/"}
+ * */
+
+export default class LoginSettingsRuleDetails extends Component {
+  @service capabilities;
+  @service flashMessages;
+  @service('app-router') router;
+  @service api;
+
+  @tracked showConfirmModal = false;
+
+  displayFields = {
+    default_auth_type: 'Default method',
+    backup_auth_types: 'Backup methods',
+    disable_inheritance: 'Inheritance enabled',
+    namespace_path: 'Namespace the rule applies to',
+  };
+
+  displayValue = (key) => {
+    const value = this.args.rule[key];
+    // flip boolean for disable inheritance so template reads "Inheritance enabled: Yes/No"
+    return key === 'disable_inheritance' ? !value : value;
+  };
+
+  @action
+  async onDelete() {
+    const { rule } = this.args;
+
+    try {
+      await this.api.sys.uiLoginDefaultAuthDeleteConfiguration(rule.name);
+
+      this.flashMessages.success(`Successfully deleted rule ${rule.name}.`);
+
+      this.router.transitionTo('vault.cluster.config-ui.login-settings.index');
+    } catch (error) {
+      const message = errorMessage(error, 'Error deleting rule. Please try again.');
+      this.flashMessages.danger(message);
+    }
+  }
+}
diff --git a/ui/lib/config-ui/addon/components/login-settings/page/list.hbs b/ui/lib/config-ui/addon/components/login-settings/page/list.hbs
new file mode 100644
index 00000000000..3b2dbf09542
--- /dev/null
+++ b/ui/lib/config-ui/addon/components/login-settings/page/list.hbs
@@ -0,0 +1,86 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      UI Login Settings
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+<Toolbar />
+
+{{#if @loginRules}}
+  {{#each @loginRules as |rule|}}
+    <LinkedBlock
+      class="list-item-row"
+      @params={{array "login-settings.rule.details" rule.name}}
+      @linkPrefix="vault.cluster.config-ui"
+      data-test-list-item={{rule.name}}
+    >
+      <div class="level is-mobile">
+        <div class="level-left">
+          <div>
+            <Hds::Text::Display @tag="h3">
+              <Hds::Icon @name="user-check" @size="24" @isInline={{true}} />
+              {{rule.name}}
+            </Hds::Text::Display>
+            <div class="has-top-margin-m">
+              {{rule.namespace_path}}
+              <Hds::Badge
+                @text="Inheritance {{if rule.disable_inheritance 'disabled' 'enabled'}}"
+                class="has-left-margin-xxs"
+              />
+            </div>
+          </div>
+        </div>
+        <div class="level-right is-flex is-paddingless is-marginless">
+          <div class="level-item">
+            <Hds::Dropdown @isInline={{true}} as |dd|>
+              <dd.ToggleIcon
+                @icon="more-horizontal"
+                @hasChevron={{false}}
+                @text="login rules menu"
+                data-test-popup-menu-trigger
+              />
+              <dd.Interactive @route="login-settings.rule.details" @model={{rule.name}} data-test-popup-menu="view-rule">
+                View
+              </dd.Interactive>
+              {{#if (has-capability this.capabilities "delete" pathKey="customLogin" params=rule)}}
+                <dd.Interactive
+                  @color="critical"
+                  data-test-popup-menu="delete-rule"
+                  {{on "click" (fn (mut this.ruleToDelete) rule)}}
+                >Delete</dd.Interactive>
+              {{/if}}
+            </Hds::Dropdown>
+          </div>
+        </div>
+      </div>
+    </LinkedBlock>
+  {{/each}}
+{{else}}
+  <EmptyState
+    @title="No UI login settings yet"
+    @message="Login settings can be used to customize which methods display in the web UI login form by setting a default and back up login methods. Available to be created via the CLI or HTTP API."
+  >
+    <Hds::Link::Standalone
+      @icon="docs-link"
+      @iconPosition="trailing"
+      @text="UI login settings documentation"
+      @href={{doc-link "/vault/docs/ui/custom-login"}}
+    />
+  </EmptyState>
+{{/if}}
+
+{{#if this.ruleToDelete}}
+  <ConfirmModal
+    @color="critical"
+    @onClose={{fn (mut this.ruleToDelete) null}}
+    @confirmMessage="This will permanently delete this rule."
+    @onConfirm={{this.onDelete}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/config-ui/addon/components/login-settings/page/list.js b/ui/lib/config-ui/addon/components/login-settings/page/list.js
new file mode 100644
index 00000000000..d1d878c9f68
--- /dev/null
+++ b/ui/lib/config-ui/addon/components/login-settings/page/list.js
@@ -0,0 +1,40 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import errorMessage from 'vault/utils/error-message';
+
+/**
+ * @module Page::LoginSettingsList
+ * Page::LoginSettingsList components are used to display list of rules.
+ *
+ * @example
+ * <Page::LoginSettingsList @loginRules={{this.rules}}  />
+ *
+ * @param {array} loginRules - array of rule objects
+ */
+
+export default class LoginSettingsList extends Component {
+  @service capabilities;
+  @service flashMessages;
+  @service('app-router') router;
+  @tracked ruleToDelete = null; // set to the rule intended to delete
+  @service api;
+
+  @action
+  async onDelete() {
+    try {
+      await this.api.sys.uiLoginDefaultAuthDeleteConfiguration(this.ruleToDelete.id);
+      this.flashMessages.success(`Successfully deleted rule ${this.ruleToDelete.id}.`);
+      this.router.refresh('vault.cluster.config-ui.login-settings');
+    } catch (error) {
+      const message = errorMessage(error, 'Error deleting rule. Please try again.');
+      this.flashMessages.danger(message);
+    }
+  }
+}
diff --git a/ui/lib/config-ui/addon/components/messages/message-expiration-date-form.hbs b/ui/lib/config-ui/addon/components/messages/message-expiration-date-form.hbs
index aabcd72e085..8f7631a7b1b 100644
--- a/ui/lib/config-ui/addon/components/messages/message-expiration-date-form.hbs
+++ b/ui/lib/config-ui/addon/components/messages/message-expiration-date-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="has-top-padding-xs has-bottom-padding-s is-narrow is-flex-align-baseline">
   <RadioButton
@@ -10,7 +10,7 @@
     id="never"
     value="never"
     @value="never"
-    @onChange={{fn (mut @message.endTime) ""}}
+    @onChange={{fn (mut @message.end_time) ""}}
     @groupValue={{this.groupValue}}
   />
   <label for="never" class="has-left-margin-xs has-text-black is-size-7">
@@ -45,8 +45,8 @@
         @type="datetime-local"
         @value={{if this.messageEndTime (date-format this.messageEndTime this.datetimeLocalStringFormat) ""}}
         class="input has-top-margin-xs is-auto-width {{if this.validationError 'has-error-border'}}"
-        name="endTime"
-        data-test-input="endTime"
+        name="end_time"
+        data-test-input="end_time"
         {{on "focusout" this.onFocusOut}}
       />
     </div>
diff --git a/ui/lib/config-ui/addon/components/messages/message-expiration-date-form.js b/ui/lib/config-ui/addon/components/messages/message-expiration-date-form.js
index b85e7622a41..f71e741fc42 100644
--- a/ui/lib/config-ui/addon/components/messages/message-expiration-date-form.js
+++ b/ui/lib/config-ui/addon/components/messages/message-expiration-date-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,7 +15,7 @@ import { datetimeLocalStringFormat } from 'core/utils/date-formatters';
  * ```js
  * <Messages::MessageExpirationDateForm @message={{this.message}} @attr={{attr}} />
  * ```
- * @param {array} messages - array message objects
+ * @param {array} message - message form data
  */
 
 export default class MessageExpirationDateForm extends Component {
@@ -26,9 +26,9 @@ export default class MessageExpirationDateForm extends Component {
   constructor() {
     super(...arguments);
 
-    if (this.args.message.endTime) {
+    if (this.args.message.end_time) {
       this.groupValue = 'specificDate';
-      this.messageEndTime = this.args.message.endTime;
+      this.messageEndTime = this.args.message.end_time;
     }
   }
 
@@ -41,13 +41,13 @@ export default class MessageExpirationDateForm extends Component {
   @action
   specificDateChange() {
     this.groupValue = 'specificDate';
-    this.args.message.endTime = this.messageEndTime;
+    this.args.message.end_time = this.messageEndTime;
   }
 
   @action
   onFocusOut(e) {
     this.messageEndTime = e.target.value;
-    this.args.message.endTime = this.messageEndTime;
+    this.args.message.end_time = this.messageEndTime;
     this.groupValue = 'specificDate';
   }
 }
diff --git a/ui/lib/config-ui/addon/components/messages/page/create-and-edit.hbs b/ui/lib/config-ui/addon/components/messages/page/create-and-edit.hbs
index 4ea214ef623..de17edac5a4 100644
--- a/ui/lib/config-ui/addon/components/messages/page/create-and-edit.hbs
+++ b/ui/lib/config-ui/addon/components/messages/page/create-and-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 <Messages::TabPageHeader
   @authenticated={{@message.authenticated}}
   @pageTitle="{{if @message.isNew 'Create' 'Edit'}} message"
@@ -38,9 +38,9 @@
         data-test-button="preview"
       />
 
-      <Hds::Button @text="{{if @message.isNew 'Create message' 'Save'}}" data-test-button="create-message" type="submit" />
+      <Hds::Button @text="{{if @message.isNew 'Create message' 'Save'}}" type="submit" data-test-submit />
 
-      <Hds::Button @text="Cancel" @color="secondary" {{on "click" this.cancel}} />
+      <Hds::Button @text="Cancel" @color="secondary" {{on "click" this.cancel}} data-test-cancel />
     </Hds::ButtonSet>
   </div>
   {{#if this.showMultipleModalsMessage}}
@@ -68,13 +68,13 @@
         <Hds::Button
           @text="Confirm"
           {{on "click" (fn this.updateUserConfirmation "confirmed")}}
-          data-test-modal-button="confirm"
+          data-test-button="confirm-multiple"
         />
         <Hds::Button
           @text="Cancel"
           @color="secondary"
           {{on "click" (fn this.updateUserConfirmation "cancel")}}
-          data-test-modal-button="cancel"
+          data-test-button="cancel-multiple"
         />
       </M.Footer>
     </Hds::Modal>
@@ -111,7 +111,7 @@
         {{/unless}}
       </M.Body>
       <M.Footer as |F|>
-        <Hds::Button @text="Confirm" {{on "click" F.close}} data-test-modal-button="Close" />
+        <Hds::Button @text="Confirm" {{on "click" F.close}} data-test-button="confirm-preview" />
       </M.Footer>
     </Hds::Modal>
   {{else}}
diff --git a/ui/lib/config-ui/addon/components/messages/page/create-and-edit.js b/ui/lib/config-ui/addon/components/messages/page/create-and-edit.js
index f00a48f18dc..623d2c4ff7f 100644
--- a/ui/lib/config-ui/addon/components/messages/page/create-and-edit.js
+++ b/ui/lib/config-ui/addon/components/messages/page/create-and-edit.js
@@ -1,16 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { tracked } from '@glimmer/tracking';
 import { task, timeout } from 'ember-concurrency';
-import errorMessage from 'vault/utils/error-message';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
 import Ember from 'ember';
 import { isAfter } from 'date-fns';
+import timestamp from 'core/utils/timestamp';
 
 /**
  * @module Page::CreateAndEditMessageForm
@@ -19,15 +19,17 @@ import { isAfter } from 'date-fns';
  * ```js
  * <Page::CreateAndEditMessageForm @message={{this.message}}  />
  * ```
- * @param {model} message - message model to pass to form components
+ * @param message - message to pass to form component
+ * @param messages - array of all created messages
+ * @param breadcrumbs - breadcrumbs to pass to the TabPageHeader component
  */
 
 export default class MessagesList extends Component {
-  @service router;
-  @service store;
+  @service('app-router') router;
+  @service pagination;
   @service flashMessages;
   @service customMessages;
-  @service namespace;
+  @service api;
 
   @tracked errorBanner = '';
   @tracked modelValidations;
@@ -36,17 +38,21 @@ export default class MessagesList extends Component {
   @tracked showMultipleModalsMessage = false;
   @tracked userConfirmation = '';
 
-  willDestroy() {
-    super.willDestroy();
-    const noTeardown = this.store && !this.store.isDestroying;
-    const { model } = this;
-    if (noTeardown && model && model.get('isDirty') && !model.isDestroyed && !model.isDestroying) {
-      model.rollbackAttributes();
-    }
+  get hasSomeActiveModals() {
+    const { messages } = this.args;
+    return messages?.some((message) => message.type === 'modal' && message.active);
+  }
+
+  get hasExpiredModalMessages() {
+    const modalMessages = this.args.messages?.filter((message) => message.type === 'modal') || [];
+    return modalMessages.every((message) => {
+      if (!message.end_time) return false;
+      return isAfter(timestamp.now(), new Date(message.end_time));
+    });
   }
 
   validate() {
-    const { isValid, state, invalidFormMessage } = this.args.message.validate();
+    const { isValid, state, invalidFormMessage } = this.args.message.toJSON();
     this.modelValidations = isValid ? null : state;
     this.invalidFormAlert = invalidFormMessage;
     return isValid;
@@ -58,29 +64,33 @@ export default class MessagesList extends Component {
     try {
       this.userConfirmation = '';
 
+      const { message } = this.args;
       const isValid = this.validate();
-      const modalMessages = this.args.messages?.filter((message) => message.type === 'modal') || [];
-      const hasExpiredModalMessages = modalMessages.every((message) => {
-        if (!message.endTime) return false;
-        return isAfter(new Date(), new Date(message.endTime));
-      });
 
-      if (!hasExpiredModalMessages && this.args.hasSomeActiveModals && this.args.message.type === 'modal') {
+      if (!this.hasExpiredModalMessages && this.hasSomeActiveModals && message.type === 'modal') {
         this.showMultipleModalsMessage = true;
         const isConfirmed = yield this.getUserConfirmation.perform();
         if (!isConfirmed) return;
       }
 
       if (isValid) {
-        const { isNew } = this.args.message;
-        const { id, title } = yield this.args.message.save();
-        this.flashMessages.success(`Successfully ${isNew ? 'created' : 'updated'} ${title} message.`);
-        this.store.clearDataset('config-ui/message');
-        this.customMessages.fetchMessages(this.namespace.path);
+        const { data } = message.toJSON();
+        let id = data.id;
+
+        if (message.isNew) {
+          const response = yield this.api.sys.createCustomMessage(data);
+          id = response.data.id;
+        } else {
+          yield this.api.sys.uiConfigUpdateCustomMessage(id, data);
+        }
+
+        this.flashMessages.success(`Successfully saved ${data.title} message.`);
+        this.customMessages.fetchMessages();
         this.router.transitionTo('vault.cluster.config-ui.messages.message.details', id);
       }
     } catch (error) {
-      this.errorBanner = errorMessage(error);
+      const { message } = yield this.api.parseError(error);
+      this.errorBanner = message;
       this.invalidFormAlert = 'There was an error submitting this form.';
     }
   }
diff --git a/ui/lib/config-ui/addon/components/messages/page/details.hbs b/ui/lib/config-ui/addon/components/messages/page/details.hbs
index 4c1e675cca8..36743e5420d 100644
--- a/ui/lib/config-ui/addon/components/messages/page/details.hbs
+++ b/ui/lib/config-ui/addon/components/messages/page/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Messages::TabPageHeader
   @authenticated={{@message.authenticated}}
@@ -11,7 +11,7 @@
 
 <Toolbar>
   <ToolbarActions aria-label="message delete and edit">
-    {{#if @message.canDeleteCustomMessages}}
+    {{#if @capabilities.canDelete}}
       <ConfirmAction
         class="toolbar-button"
         @buttonColor="secondary"
@@ -19,12 +19,11 @@
         @confirmTitle="Are you sure?"
         @confirmMessage="This will delete this message permanently. You cannot undo this action."
         @buttonText="Delete message"
-        data-test-confirm-action="Delete message"
       />
       <div class="toolbar-separator"></div>
     {{/if}}
-    {{#if @message.canEditCustomMessages}}
-      <LinkTo class="toolbar-link" @route="messages.message.edit" @model={{@message.id}} data-test-link="edit">
+    {{#if @capabilities.canUpdate}}
+      <LinkTo class="toolbar-link" @route="messages.message.edit" @model={{@message.id}} data-test-link-to="edit">
         Edit message
         <Icon @name="chevron-right" />
       </LinkTo>
@@ -32,18 +31,18 @@
   </ToolbarActions>
 </Toolbar>
 
-{{#each @message.allFields as |attr|}}
-  {{#if (or (eq attr.name "endTime") (eq attr.name "startTime"))}}
-    {{! if the attr is an endTime and is falsy, we want to show a 'Never' text value }}
+{{#each this.displayFields as |field|}}
+  {{#if (or (eq field "end_time") (eq field "start_time"))}}
+    {{! if the attr is an end_time and is falsy, we want to show a 'Never' text value }}
     <InfoTableRow
-      @label={{capitalize (humanize (dasherize attr.name))}}
+      @label={{capitalize (humanize (dasherize field))}}
       @value={{if
-        (and (eq attr.name "endTime") (not (get @message attr.name)))
+        (and (eq field "end_time") (not (get @message field)))
         "Never"
-        (date-format (get @message attr.name) "MMM d, yyyy hh:mm aaa" withTimeZone=true)
+        (date-format (get @message field) "MMM d, yyyy hh:mm aaa" withTimeZone=true)
       }}
     />
-  {{else if (eq attr.name "link")}}
+  {{else if (eq field "link")}}
     {{#if (is-empty-value @message.link)}}
       <InfoTableRow @label="Link" @value="None" />
     {{else}}
@@ -54,7 +53,7 @@
       {{/each-in}}
     {{/if}}
   {{else}}
-    <InfoTableRow @label={{capitalize (humanize (dasherize attr.name))}} @value={{get @message attr.name}} />
+    <InfoTableRow @label={{capitalize (humanize (dasherize field))}} @value={{get @message field}} />
   {{/if}}
 
 {{/each}}
\ No newline at end of file
diff --git a/ui/lib/config-ui/addon/components/messages/page/details.js b/ui/lib/config-ui/addon/components/messages/page/details.js
index 60d71ca78f7..8ea34a94d94 100644
--- a/ui/lib/config-ui/addon/components/messages/page/details.js
+++ b/ui/lib/config-ui/addon/components/messages/page/details.js
@@ -1,40 +1,42 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
-import errorMessage from 'vault/utils/error-message';
 
 /**
  * @module Page::MessageDetails
  * Page::MessageDetails components are used to display a message
  * @example
  * ```js
- * <Page::MessageDetails @message={{this.message}}  />
+ * <Page::MessageDetails @message={{this.model.message}} @capabilities={{this.model.capabilities}}  />
  * ```
- * @param {model} message - message model
+ * @param message
+ * @param capabilities - capabilities for the message
  */
 
 export default class MessageDetails extends Component {
-  @service store;
-  @service router;
+  @service('app-router') router;
   @service flashMessages;
   @service customMessages;
-  @service namespace;
+  @service pagination;
+  @service api;
+
+  displayFields = ['active', 'type', 'authenticated', 'title', 'message', 'start_time', 'end_time', 'link'];
 
   @action
   async deleteMessage() {
     try {
-      this.store.clearDataset('config-ui/message');
-      await this.args.message.destroyRecord(this.args.message.id);
+      const { message } = this.args;
+      await this.api.sys.uiConfigDeleteCustomMessage(message.id);
       this.router.transitionTo('vault.cluster.config-ui.messages');
-      this.customMessages.fetchMessages(this.namespace.path);
-      this.flashMessages.success(`Successfully deleted ${this.args.message.title}.`);
+      this.customMessages.fetchMessages();
+      this.flashMessages.success(`Successfully deleted ${message.title}.`);
     } catch (e) {
-      const message = errorMessage(e);
+      const { message } = await this.api.parseError(e);
       this.flashMessages.danger(message);
     }
   }
diff --git a/ui/lib/config-ui/addon/components/messages/page/list.hbs b/ui/lib/config-ui/addon/components/messages/page/list.hbs
index f54576829a6..a822d106950 100644
--- a/ui/lib/config-ui/addon/components/messages/page/list.hbs
+++ b/ui/lib/config-ui/addon/components/messages/page/list.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 <Messages::TabPageHeader
   @authenticated={{@authenticated}}
   @pageTitle="Custom messages"
@@ -9,40 +9,64 @@
   @breadcrumbs={{this.breadcrumbs}}
 >
   <:toolbarFilters>
-    <FilterInput
-      aria-label="Search by message title"
-      placeholder="Search by message title"
-      id="message-filter"
-      value={{@params.pageFilter}}
-      @autofocus={{true}}
-      @onInput={{this.onFilterInputChange}}
-    />
-    <div>
-      <SearchSelect
-        @id="filter-by-message-status"
-        class="has-left-margin-s"
-        @options={{this.statusFilterOptions}}
-        @selectLimit="1"
-        @searchEnabled={{false}}
-        @fallbackComponent="select"
-        @onChange={{fn this.onFilterChange "status"}}
-        @placeholder="Filter by message status"
-        @inputValue={{if @params.status (array @params.status)}}
-        data-test-filter-by-message-status
-      />
-    </div>
-    <SearchSelect
-      @id="filter-by-message-type"
-      class="has-left-margin-s"
-      @options={{this.typeFilterOptions}}
-      @selectLimit="1"
-      @searchEnabled={{false}}
-      @fallbackComponent="select"
-      @onChange={{fn this.onFilterChange "type"}}
-      @placeholder="Filter by message type"
-      @inputValue={{if @params.type (array @params.type)}}
-      data-test-filter-by-message-type
-    />
+    <form {{on "submit" (perform this.handleSearch)}} aria-label="Filter custom message list">
+      <Hds::SegmentedGroup as |S|>
+        <S.Button
+          @color="secondary"
+          @text="Clear filters"
+          @icon="trash"
+          @isIconOnly={{true}}
+          type="reset"
+          {{on "click" this.resetFilters}}
+          data-test-filter-reset
+        />
+        <S.TextInput
+          @value={{@params.pageFilter}}
+          @type="search"
+          name="pageFilter"
+          class="segment-filter"
+          placeholder="Search by message title"
+          aria-label="Search by message title"
+          size="32"
+          data-test-filter-by="pageFilter"
+        />
+        <S.Select
+          aria-label="Filter by message status"
+          name="status"
+          class="segment-filter {{unless @params.status 'has-text-grey'}}"
+          data-test-filter-by="status"
+          as |S|
+        >
+          <S.Options>
+            <option value="" class="default-option">Message status</option>
+            {{#each (array "active" "inactive") as |status|}}
+              <option value={{status}} selected={{eq @params.status status}}>{{status}}</option>
+            {{/each}}
+          </S.Options>
+        </S.Select>
+        <S.Select
+          aria-label="Filter by type"
+          name="type"
+          class="segment-filter {{unless @params.status 'has-text-grey'}}"
+          data-test-filter-by="type"
+          as |S|
+        >
+          <S.Options>
+            <option value="" class="has-text-grey">Message type</option>
+            {{#each (array "modal" "banner") as |type|}}
+              <option value={{type}} selected={{eq @params.type type}}>{{type}}</option>
+            {{/each}}
+          </S.Options>
+        </S.Select>
+        <S.Button
+          @color="secondary"
+          @text="Apply filters"
+          @icon={{if this.handleSearch.isRunning "loading" "filter"}}
+          type="submit"
+          data-test-submit
+        />
+      </Hds::SegmentedGroup>
+    </form>
   </:toolbarFilters>
   <:toolbarActions>
     <Hds::Button
@@ -51,8 +75,8 @@
       @color="secondary"
       class="toolbar-button"
       {{on "click" this.createMessage}}
-      data-test-button="create message"
       aria-label="create message"
+      data-test-button="Create message"
     />
   </:toolbarActions>
 </Messages::TabPageHeader>
@@ -68,19 +92,23 @@
       <div class="level is-mobile">
         <div class="level-left">
           <div>
-            <Hds::Text::Display @tag="h2" data-linked-block-title={{message.id}}>
+            <Hds::Text::Display @tag="h2">
               <Icon @name="message-circle" class="auto-width" aria-label="message" />
               {{message.title}}
             </Hds::Text::Display>
             <div class="has-top-margin-xs">
-              <Hds::Badge @text={{message.badgeDisplayText}} @color={{message.badgeColor}} data-test-badge={{message.id}} />
+              <Hds::Badge
+                @text={{message.badgeDisplayText}}
+                @color={{message.badgeColor}}
+                data-test-badge={{message.badgeDisplayText}}
+              />
               <Hds::Badge @text={{(capitalize message.type)}} data-test-badge={{message.type}} />
             </div>
           </div>
         </div>
         <div class="level-right is-flex is-paddingless is-marginless">
           <div class="level-item">
-            {{#if (or message.canEditCustomMessages message.canDeleteCustomMessages)}}
+            {{#if (has-capability @capabilities "update" "delete" pathKey="customMessages" params=message)}}
               <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
                 <dd.ToggleIcon
                   @icon="more-horizontal"
@@ -88,11 +116,15 @@
                   @hasChevron={{false}}
                   data-test-popup-menu-trigger
                 />
-                {{#if message.canEditCustomMessages}}
-                  <dd.Interactive @text="Edit" @route="messages.message.edit" @model={{message.id}} />
+                {{#if (has-capability @capabilities "update" pathKey="customMessages" params=message)}}
+                  <dd.Interactive @route="messages.message.edit" @model={{message.id}}>Edit</dd.Interactive>
                 {{/if}}
-                {{#if message.canDeleteCustomMessages}}
-                  <dd.Interactive @text="Delete" @color="critical" {{on "click" (fn (mut this.messageToDelete) message)}} />
+                {{#if (has-capability @capabilities "delete" pathKey="customMessages" params=message)}}
+                  <dd.Interactive
+                    @color="critical"
+                    {{on "click" (fn (mut this.messageToDelete) message)}}
+                    data-test-popup-menu="delete"
+                  >Delete</dd.Interactive>
                 {{/if}}
               </Hds::Dropdown>
             {{/if}}
@@ -132,7 +164,7 @@
       Vault can only store up to 100 messages. To create a message, delete one of your messages to clear up space.
     </M.Body>
     <M.Footer as |F|>
-      <Hds::Button @text="Close" {{on "click" F.close}} data-test-modal-button="maximum-message-modal" />
+      <Hds::Button @text="Close" {{on "click" F.close}} data-test-button="close-maximum-message" />
     </M.Footer>
   </Hds::Modal>
 {{/if}}
diff --git a/ui/lib/config-ui/addon/components/messages/page/list.js b/ui/lib/config-ui/addon/components/messages/page/list.js
index 2261e8847bc..a1415eb947b 100644
--- a/ui/lib/config-ui/addon/components/messages/page/list.js
+++ b/ui/lib/config-ui/addon/components/messages/page/list.js
@@ -1,16 +1,17 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+import Ember from 'ember';
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
-import { task } from 'ember-concurrency';
+import { task, timeout } from 'ember-concurrency';
 import { dateFormat } from 'core/helpers/date-format';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
-import errorMessage from 'vault/utils/error-message';
-import { next } from '@ember/runloop';
+import { isAfter } from 'date-fns';
+import timestamp from 'core/utils/timestamp';
 
 /**
  * @module Page::MessagesList
@@ -23,34 +24,19 @@ import { next } from '@ember/runloop';
  */
 
 export default class MessagesList extends Component {
-  @service store;
-  @service router;
+  @service customMessages;
   @service flashMessages;
   @service namespace;
-  @service customMessages;
+  @service pagination;
+  @service('app-router') router;
+  @service api;
 
   @tracked showMaxMessageModal = false;
   @tracked messageToDelete = null;
 
-  // This follows the pattern in sync/addon/components/secrets/page/destinations for FilterInput.
-  // Currently, FilterInput doesn't do a full page refresh causing it to lose focus.
-  // The work around is to verify that a transition from this route was completed and then focus the input.
-  constructor(owner, args) {
-    super(owner, args);
-    this.router.on('routeDidChange', this.focusNameFilter);
-  }
-
-  willDestroy() {
-    super.willDestroy();
-    this.router.off('routeDidChange', this.focusNameFilter);
-  }
-
-  focusNameFilter(transition) {
-    const route = 'vault.cluster.config-ui.messages.index';
-    if (transition?.from?.name === route && transition?.to?.name === route) {
-      next(() => document.getElementById('message-filter')?.focus());
-    }
-  }
+  isStartTimeAfterToday = (message) => {
+    return isAfter(message.start_time, timestamp.now());
+  };
 
   get formattedMessages() {
     return this.args.messages.map((message) => {
@@ -58,8 +44,8 @@ export default class MessagesList extends Component {
       let badgeColor = 'neutral';
 
       if (message.active) {
-        if (message.endTime) {
-          badgeDisplayText = `Active until ${dateFormat([message.endTime, 'MMM d, yyyy hh:mm aaa'], {
+        if (message.end_time) {
+          badgeDisplayText = `Active until ${dateFormat([message.end_time, 'MMM d, yyyy hh:mm aaa'], {
             withTimeZone: true,
           })}`;
         } else {
@@ -67,13 +53,13 @@ export default class MessagesList extends Component {
         }
         badgeColor = 'success';
       } else {
-        if (message.isStartTimeAfterToday) {
-          badgeDisplayText = `Scheduled: ${dateFormat([message.startTime, 'MMM d, yyyy hh:mm aaa'], {
+        if (this.isStartTimeAfterToday(message)) {
+          badgeDisplayText = `Scheduled: ${dateFormat([message.start_time, 'MMM d, yyyy hh:mm aaa'], {
             withTimeZone: true,
           })}`;
           badgeColor = 'highlight';
         } else {
-          badgeDisplayText = `Inactive:  ${dateFormat([message.startTime, 'MMM d, yyyy hh:mm aaa'], {
+          badgeDisplayText = `Inactive:  ${dateFormat([message.start_time, 'MMM d, yyyy hh:mm aaa'], {
             withTimeZone: true,
           })}`;
           badgeColor = 'neutral';
@@ -91,20 +77,6 @@ export default class MessagesList extends Component {
     return [{ label: 'Messages' }, { label }];
   }
 
-  get statusFilterOptions() {
-    return [
-      { id: 'active', name: 'active' },
-      { id: 'inactive', name: 'inactive' },
-    ];
-  }
-
-  get typeFilterOptions() {
-    return [
-      { id: 'modal', name: 'modal' },
-      { id: 'banner', name: 'banner' },
-    ];
-  }
-
   // callback from HDS pagination to set the queryParams page
   get paginationQueryParams() {
     return (page) => {
@@ -116,37 +88,44 @@ export default class MessagesList extends Component {
 
   transitionToMessagesWithParams(queryParams) {
     this.router.transitionTo('vault.cluster.config-ui.messages', {
-      queryParams,
+      // always reset back to page 1 when changing filters
+      queryParams: { ...queryParams, page: 1 },
     });
   }
 
   @task
   *deleteMessage(message) {
     try {
-      this.store.clearDataset('config-ui/message');
-      yield message.destroyRecord(message.id);
+      yield this.api.sys.uiConfigDeleteCustomMessage(message.id);
       this.router.transitionTo('vault.cluster.config-ui.messages');
-      this.customMessages.fetchMessages(this.namespace.path);
+      this.customMessages.fetchMessages();
       this.flashMessages.success(`Successfully deleted ${message.title}.`);
     } catch (e) {
-      const message = errorMessage(e);
+      const { message } = yield this.api.parseError(e);
       this.flashMessages.danger(message);
     } finally {
       this.messageToDelete = null;
     }
   }
 
-  @action
-  onFilterInputChange(pageFilter) {
-    this.transitionToMessagesWithParams({ pageFilter });
+  @task
+  *handleSearch(evt) {
+    evt.preventDefault();
+    const formData = new FormData(evt.target);
+    // shows loader to indicate that the search was executed
+    yield timeout(Ember.testing ? 0 : 250);
+    const params = {};
+    for (const key of formData.keys()) {
+      const valDefault = key === 'pageFilter' ? '' : null;
+      const val = formData.get(key) || valDefault;
+      params[key] = val;
+    }
+    this.transitionToMessagesWithParams(params);
   }
 
   @action
-  onFilterChange(filterType, [filterOption]) {
-    const param = {};
-    param[filterType] = filterOption;
-    param.page = 1;
-    this.transitionToMessagesWithParams(param);
+  resetFilters() {
+    this.transitionToMessagesWithParams({ pageFilter: '', status: null, type: null });
   }
 
   @action
diff --git a/ui/lib/config-ui/addon/components/messages/preview-image.hbs b/ui/lib/config-ui/addon/components/messages/preview-image.hbs
index e1e709a0871..0b2efe2898e 100644
--- a/ui/lib/config-ui/addon/components/messages/preview-image.hbs
+++ b/ui/lib/config-ui/addon/components/messages/preview-image.hbs
@@ -1,12 +1,12 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Modal
   @onClose={{fn (mut @showMessagePreviewModal) false}}
   id="message-alert-preview"
-  class="is-calc-large-height is-two-thirds-width"
+  class="is-calc-large-height two-thirds-width"
   data-test-modal="preview image"
   as |M|
 >
@@ -27,7 +27,7 @@
       {{/each}}
       {{#unless (is-empty-value @message.link)}}
         {{#each-in @message.link as |title href|}}
-          <A.Link::Standalone
+          <A.LinkStandalone
             @color="secondary"
             @icon="external-link"
             @isHrefExternal={{true}}
@@ -46,6 +46,6 @@
     />
   </M.Body>
   <M.Footer as |F|>
-    <Hds::Button @text="Close preview" {{on "click" F.close}} data-test-modal-button="Close" />
+    <Hds::Button @text="Close preview" {{on "click" F.close}} data-test-button="Close preview" />
   </M.Footer>
 </Hds::Modal>
\ No newline at end of file
diff --git a/ui/lib/config-ui/addon/components/messages/tab-page-header.hbs b/ui/lib/config-ui/addon/components/messages/tab-page-header.hbs
index 256ecb7299d..47025f90c0e 100644
--- a/ui/lib/config-ui/addon/components/messages/tab-page-header.hbs
+++ b/ui/lib/config-ui/addon/components/messages/tab-page-header.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   {{#if @breadcrumbs}}
diff --git a/ui/lib/config-ui/addon/controllers/messages/create.js b/ui/lib/config-ui/addon/controllers/messages/create.js
index 1f7513f8d04..d9abf85a838 100644
--- a/ui/lib/config-ui/addon/controllers/messages/create.js
+++ b/ui/lib/config-ui/addon/controllers/messages/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/config-ui/addon/controllers/messages/index.js b/ui/lib/config-ui/addon/controllers/messages/index.js
index afd38fcf26f..4a961c11194 100644
--- a/ui/lib/config-ui/addon/controllers/messages/index.js
+++ b/ui/lib/config-ui/addon/controllers/messages/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/config-ui/addon/engine.js b/ui/lib/config-ui/addon/engine.js
index 2eedbf9a9b3..1bd5e4696e1 100644
--- a/ui/lib/config-ui/addon/engine.js
+++ b/ui/lib/config-ui/addon/engine.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,7 +16,17 @@ export default class ConfigUiEngine extends Engine {
   modulePrefix = modulePrefix;
   Resolver = Resolver;
   dependencies = {
-    services: ['auth', 'store', 'flash-messages', 'namespace', 'router', 'version', 'customMessages'],
+    services: [
+      'auth',
+      'pagination',
+      'flash-messages',
+      'namespace',
+      'app-router',
+      'version',
+      'custom-messages',
+      'api',
+      'capabilities',
+    ],
   };
 }
 
diff --git a/ui/lib/config-ui/addon/routes.js b/ui/lib/config-ui/addon/routes.js
index 14b397a9408..75db0770bdf 100644
--- a/ui/lib/config-ui/addon/routes.js
+++ b/ui/lib/config-ui/addon/routes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,4 +13,10 @@ export default buildRoutes(function () {
       this.route('edit');
     });
   });
+
+  this.route('login-settings', function () {
+    this.route('rule', { path: '/:name' }, function () {
+      this.route('details');
+    });
+  });
 });
diff --git a/ui/lib/config-ui/addon/routes/login-settings/index.js b/ui/lib/config-ui/addon/routes/login-settings/index.js
new file mode 100644
index 00000000000..b9c66328c2f
--- /dev/null
+++ b/ui/lib/config-ui/addon/routes/login-settings/index.js
@@ -0,0 +1,27 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+
+export default class LoginSettingsRoute extends Route {
+  @service api;
+
+  async model() {
+    try {
+      const data = await this.api.sys.uiLoginDefaultAuthList(true);
+      const loginRules = this.api.keyInfoToArray(data);
+      return { loginRules };
+    } catch (e) {
+      // If no login settings exist, return an empty array to render the empty state
+      const error = await this.api.parseError(e);
+      if (error.status === 404) {
+        return { loginRules: [] };
+      }
+      // Otherwise fallback to the standard error template
+      throw error;
+    }
+  }
+}
diff --git a/ui/lib/config-ui/addon/routes/login-settings/rule/details.js b/ui/lib/config-ui/addon/routes/login-settings/rule/details.js
new file mode 100644
index 00000000000..ad291cd3c31
--- /dev/null
+++ b/ui/lib/config-ui/addon/routes/login-settings/rule/details.js
@@ -0,0 +1,36 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+
+export default class LoginSettingsRuleDetailsRoute extends Route {
+  @service('app-router') router;
+  @service api;
+
+  beforeModel() {
+    const { name } = this.paramsFor('login-settings.rule');
+    if (!name) {
+      this.router.transitionTo('vault.cluster.config-ui.login-settings.index');
+    }
+  }
+
+  async model() {
+    const { name } = this.paramsFor('login-settings.rule');
+
+    const rule = await this.api.sys.uiLoginDefaultAuthReadConfiguration(name);
+
+    return { rule: { name, ...rule.data } };
+  }
+
+  setupController(controller, resolvedModel) {
+    super.setupController(controller, resolvedModel);
+
+    controller.breadcrumbs = [
+      { label: 'UI login settings', route: 'login-settings' },
+      { label: resolvedModel.rule.name },
+    ];
+  }
+}
diff --git a/ui/lib/config-ui/addon/routes/login-settings/rule/index.js b/ui/lib/config-ui/addon/routes/login-settings/rule/index.js
new file mode 100644
index 00000000000..5b93f33c6e8
--- /dev/null
+++ b/ui/lib/config-ui/addon/routes/login-settings/rule/index.js
@@ -0,0 +1,15 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+
+export default class LoginSettingsRuleIndexRoute extends Route {
+  @service('app-router') router;
+
+  redirect() {
+    this.router.transitionTo('vault.cluster.config-ui.login-settings.rule.details');
+  }
+}
diff --git a/ui/lib/config-ui/addon/routes/messages/create.js b/ui/lib/config-ui/addon/routes/messages/create.js
index fe35b007b1b..aa7d6d52ded 100644
--- a/ui/lib/config-ui/addon/routes/messages/create.js
+++ b/ui/lib/config-ui/addon/routes/messages/create.js
@@ -1,13 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
+import CustomMessage from 'vault/forms/custom-message';
+import { addDays, startOfDay } from 'date-fns';
+import timestamp from 'core/utils/timestamp';
 
 export default class MessagesCreateRoute extends Route {
-  @service store;
+  @service api;
 
   queryParams = {
     authenticated: {
@@ -17,9 +20,8 @@ export default class MessagesCreateRoute extends Route {
 
   async getMessages(authenticated) {
     try {
-      return await this.store.query('config-ui/message', {
-        authenticated,
-      });
+      const { key_info } = await this.api.sys.uiConfigListCustomMessages(true, undefined, authenticated);
+      return Object.values(key_info);
     } catch {
       return [];
     }
@@ -27,17 +29,21 @@ export default class MessagesCreateRoute extends Route {
 
   async model(params) {
     const { authenticated } = params;
-    const message = this.store.createRecord('config-ui/message', {
-      authenticated,
-    });
+    const message = new CustomMessage(
+      {
+        authenticated,
+        type: 'banner',
+        start_time: addDays(startOfDay(timestamp.now()), 1).toISOString(),
+      },
+      { isNew: true }
+    );
+
     const messages = await this.getMessages(authenticated);
 
     return {
       message,
       messages,
       authenticated,
-      hasSomeActiveModals:
-        messages.length && messages?.some((message) => message.type === 'modal' && message.active),
     };
   }
 
diff --git a/ui/lib/config-ui/addon/routes/messages/index.js b/ui/lib/config-ui/addon/routes/messages/index.js
index ee882b6c3d8..1bcf0530b55 100644
--- a/ui/lib/config-ui/addon/routes/messages/index.js
+++ b/ui/lib/config-ui/addon/routes/messages/index.js
@@ -1,14 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
+import { paginate } from 'core/utils/paginate-list';
 
 export default class MessagesRoute extends Route {
-  @service store;
+  @service api;
+  @service capabilities;
 
   queryParams = {
     page: {
@@ -28,36 +29,49 @@ export default class MessagesRoute extends Route {
     },
   };
 
-  model(params) {
+  async model(params) {
     const { authenticated, page, pageFilter, status, type } = params;
-    const filter = pageFilter
-      ? (dataset) => dataset.filter((item) => item?.title.toLowerCase().includes(pageFilter.toLowerCase()))
-      : null;
-    let active;
+    const active = {
+      active: true,
+      inactive: false,
+    }[status];
 
-    if (status === 'active') active = true;
-    if (status === 'inactive') active = false;
-
-    const messages = this.store
-      .lazyPaginatedQuery('config-ui/message', {
-        authenticated,
-        pageFilter: filter,
+    try {
+      const { key_info, keys } = await this.api.sys.uiConfigListCustomMessages(
+        true,
         active,
-        type,
-        responsePath: 'data.keys',
-        page: page || 1,
-        size: 10,
-      })
-      .catch((e) => {
-        if (e.httpStatus === 404) {
-          return [];
-        }
-        throw e;
+        authenticated,
+        type
+      );
+      // ids are in the keys array and can be mapped to the object in key_info
+      // map and set id property on key_info object
+      const data = keys.map((id) => {
+        const { start_time, end_time, ...message } = key_info[id];
+        // dates returned from list endpoint are strings -- convert to date
+        return {
+          id,
+          ...message,
+          start_time: start_time ? new Date(start_time) : start_time,
+          end_time: end_time ? new Date(end_time) : end_time,
+        };
       });
-    return hash({
-      params,
-      messages,
-    });
+      const messages = paginate(data, {
+        page,
+        pageSize: 2,
+        filter: pageFilter,
+        filterKey: 'title',
+      });
+      // fetch capabilities for each message path
+      const paths = messages.map((message) => this.capabilities.pathFor('customMessages', message));
+      const capabilities = await this.capabilities.fetch(paths);
+
+      return { params, messages, capabilities };
+    } catch (e) {
+      if (e.response?.status === 404) {
+        return { params, messages: [] };
+      }
+      throw e;
+    }
   }
 
   setupController(controller, resolvedModel) {
diff --git a/ui/lib/config-ui/addon/routes/messages/message/details.js b/ui/lib/config-ui/addon/routes/messages/message/details.js
index 1889e5e2a69..39c4cad1ed4 100644
--- a/ui/lib/config-ui/addon/routes/messages/message/details.js
+++ b/ui/lib/config-ui/addon/routes/messages/message/details.js
@@ -1,26 +1,39 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
+import { decodeString } from 'core/utils/b64';
 
 export default class MessagesMessageDetailsRoute extends Route {
-  @service store;
+  @service api;
+  @service capabilities;
 
-  model() {
+  async model() {
     const { id } = this.paramsFor('messages.message');
 
-    return this.store.queryRecord('config-ui/message', id);
+    const requests = [
+      this.api.sys.uiConfigReadCustomMessage(id),
+      this.capabilities.for('customMessages', { id }),
+    ];
+    const [customMessage, capabilities] = await Promise.all(requests);
+    customMessage.message = decodeString(customMessage.message);
+
+    return {
+      message: customMessage,
+      capabilities,
+    };
   }
 
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
+    const { message } = resolvedModel;
 
     controller.breadcrumbs = [
-      { label: 'Messages', route: 'messages', query: { authenticated: resolvedModel.authenticated } },
-      { label: resolvedModel.title },
+      { label: 'Messages', route: 'messages', query: { authenticated: message.authenticated } },
+      { label: message.title },
     ];
   }
 }
diff --git a/ui/lib/config-ui/addon/routes/messages/message/edit.js b/ui/lib/config-ui/addon/routes/messages/message/edit.js
index 109c356123b..b8c95854640 100644
--- a/ui/lib/config-ui/addon/routes/messages/message/edit.js
+++ b/ui/lib/config-ui/addon/routes/messages/message/edit.js
@@ -1,29 +1,28 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
+import CustomMessage from 'vault/forms/custom-message';
+import { decodeString } from 'core/utils/b64';
 
 export default class MessagesMessageEditRoute extends Route {
-  @service store;
-
-  getMessages(authenticated = true) {
-    return this.store.query('config-ui/message', { authenticated }).catch(() => []);
-  }
+  @service api;
 
   async model() {
     const { id } = this.paramsFor('messages.message');
-    const message = await this.store.queryRecord('config-ui/message', id);
-    const messages = await this.getMessages(message.authenticated);
-    return hash({
-      message,
-      messages,
-      hasSomeActiveModals:
-        messages.length && messages?.some((message) => message.type === 'modal' && message.active),
-    });
+    const data = await this.api.sys.uiConfigReadCustomMessage(id);
+    const { key_info, keys } = await this.api.sys.uiConfigListCustomMessages(
+      true,
+      undefined,
+      data.authenticated
+    );
+    return {
+      message: new CustomMessage({ ...data, message: decodeString(data.message) }),
+      messages: keys.map((id) => ({ ...key_info[id], id })),
+    };
   }
 
   setupController(controller, resolvedModel) {
diff --git a/ui/lib/config-ui/addon/templates/error.hbs b/ui/lib/config-ui/addon/templates/error.hbs
new file mode 100644
index 00000000000..7cad1cf6cee
--- /dev/null
+++ b/ui/lib/config-ui/addon/templates/error.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Page::Error @error={{this.model}} />
\ No newline at end of file
diff --git a/ui/lib/config-ui/addon/templates/login-settings/index.hbs b/ui/lib/config-ui/addon/templates/login-settings/index.hbs
new file mode 100644
index 00000000000..f246896fa84
--- /dev/null
+++ b/ui/lib/config-ui/addon/templates/login-settings/index.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<LoginSettings::Page::List @loginRules={{this.model.loginRules}} />
\ No newline at end of file
diff --git a/ui/lib/config-ui/addon/templates/login-settings/rule/details.hbs b/ui/lib/config-ui/addon/templates/login-settings/rule/details.hbs
new file mode 100644
index 00000000000..af408e55de4
--- /dev/null
+++ b/ui/lib/config-ui/addon/templates/login-settings/rule/details.hbs
@@ -0,0 +1,6 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<LoginSettings::Page::Details @rule={{this.model.rule}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/config-ui/addon/templates/messages/create.hbs b/ui/lib/config-ui/addon/templates/messages/create.hbs
index 5a8fe13d3ad..a270d64e7cf 100644
--- a/ui/lib/config-ui/addon/templates/messages/create.hbs
+++ b/ui/lib/config-ui/addon/templates/messages/create.hbs
@@ -1,11 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Messages::Page::CreateAndEdit
   @message={{this.model.message}}
   @messages={{this.model.messages}}
-  @hasSomeActiveModals={{this.model.hasSomeActiveModals}}
   @breadcrumbs={{this.breadcrumbs}}
 />
\ No newline at end of file
diff --git a/ui/lib/config-ui/addon/templates/messages/index.hbs b/ui/lib/config-ui/addon/templates/messages/index.hbs
index 24837025c53..c7f24ef704b 100644
--- a/ui/lib/config-ui/addon/templates/messages/index.hbs
+++ b/ui/lib/config-ui/addon/templates/messages/index.hbs
@@ -1,10 +1,11 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Messages::Page::List
   @messages={{this.model.messages}}
   @authenticated={{this.authenticated}}
   @params={{this.model.params}}
+  @capabilities={{this.model.capabilities}}
 />
\ No newline at end of file
diff --git a/ui/lib/config-ui/addon/templates/messages/message/details.hbs b/ui/lib/config-ui/addon/templates/messages/message/details.hbs
index ec68bb64401..21c05b83a71 100644
--- a/ui/lib/config-ui/addon/templates/messages/message/details.hbs
+++ b/ui/lib/config-ui/addon/templates/messages/message/details.hbs
@@ -1,6 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Messages::Page::Details @message={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
+<Messages::Page::Details
+  @message={{this.model.message}}
+  @capabilities={{this.model.capabilities}}
+  @breadcrumbs={{this.breadcrumbs}}
+/>
\ No newline at end of file
diff --git a/ui/lib/config-ui/addon/templates/messages/message/edit.hbs b/ui/lib/config-ui/addon/templates/messages/message/edit.hbs
index 5a8fe13d3ad..a270d64e7cf 100644
--- a/ui/lib/config-ui/addon/templates/messages/message/edit.hbs
+++ b/ui/lib/config-ui/addon/templates/messages/message/edit.hbs
@@ -1,11 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Messages::Page::CreateAndEdit
   @message={{this.model.message}}
   @messages={{this.model.messages}}
-  @hasSomeActiveModals={{this.model.hasSomeActiveModals}}
   @breadcrumbs={{this.breadcrumbs}}
 />
\ No newline at end of file
diff --git a/ui/lib/config-ui/config/environment.js b/ui/lib/config-ui/config/environment.js
index c91dc65d0ed..aac88ae148a 100644
--- a/ui/lib/config-ui/config/environment.js
+++ b/ui/lib/config-ui/config/environment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/config-ui/index.js b/ui/lib/config-ui/index.js
index 3b5d11283ed..5234329e68b 100644
--- a/ui/lib/config-ui/index.js
+++ b/ui/lib/config-ui/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/components/alert-inline.hbs b/ui/lib/core/addon/components/alert-inline.hbs
index 0496ce57d62..8dd6784d300 100644
--- a/ui/lib/core/addon/components/alert-inline.hbs
+++ b/ui/lib/core/addon/components/alert-inline.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Alert
   {{did-update this.refresh @message}}
diff --git a/ui/lib/core/addon/components/alert-inline.js b/ui/lib/core/addon/components/alert-inline.js
index 8a25a6fc286..7aa23578abb 100644
--- a/ui/lib/core/addon/components/alert-inline.js
+++ b/ui/lib/core/addon/components/alert-inline.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,18 +10,22 @@ import { tracked } from '@glimmer/tracking';
 import { assert } from '@ember/debug';
 
 /**
+ * @deprecated
  * @module AlertInline
- * * Use Hds::Alert @type="compact" for displaying alert messages.
  * This component renders a compact Hds::Alert that displays a loading icon if the
- * @message arg changes and then re-renders the updated @message text.
+ * `@message` arg changes and then re-renders the updated `@message` text.
  * (Example: submitting a form and displaying the number of errors because on re-submit the number may change)
  *
  * @example
- * ```
  * <AlertInline @type="danger" @message="There are 2 errors with this form."/>
- * ```
  *
- * @deprecated {string} type - color getter maps type to the Hds::Alert @color
+ * * use Hds::Alert @type="compact" for displaying alert messages instead
+ * <Hds::Alert @type="compact" @color="critical" as |A|>
+ * <A.Title>Error</A.Title>
+ * <A.Description>Something is not right</A.Description>
+ * </Hds::Alert>
+ *
+ * @param {string} type - color getter maps type to the Hds::Alert @color
  * @param {string} color - Styles alert color and icon, can be one of: critical, warning, success, highlight, neutral
  * @param {string} message - The message to display within the alert.
  */
diff --git a/ui/lib/core/addon/components/autocomplete-input.hbs b/ui/lib/core/addon/components/autocomplete-input.hbs
index 436d232d763..7ab863d834e 100644
--- a/ui/lib/core/addon/components/autocomplete-input.hbs
+++ b/ui/lib/core/addon/components/autocomplete-input.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div {{did-insert this.setElement}} ...attributes>
   {{#if @label}}
diff --git a/ui/lib/core/addon/components/autocomplete-input.js b/ui/lib/core/addon/components/autocomplete-input.js
index 3171894d84a..7cc1ecc1181 100644
--- a/ui/lib/core/addon/components/autocomplete-input.js
+++ b/ui/lib/core/addon/components/autocomplete-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,20 +11,18 @@ import { action } from '@ember/object';
  * AutocompleteInput components are used as standard string inputs or optionally select options to append to input value
  *
  * @example
- * ```js
- * <AutocompleteInput @requiredParam={requiredParam} @optionalParam={optionalParam} @param1={{param1}}/>
- * ```
- * @callback inputChangeCallback
+ * <AutocompleteInput @label="Label here" @subText="subtext here" @value="foo" @onChange={{log "on change called"}} />
+ *
  * @param {string} value - input value
- * @param {inputChangeCallback} onChange - fires when input value changes to mutate value param by caller
+ * @param {function} onChange - fires when input value changes to mutate value param by caller
  * @param {string} [optionsTrigger] - display options dropdown when trigger character is input
- * @param {Object[]} [options] - array of { label, value } objects where label is displayed in options dropdown and value is appended to input value
+ * @param {array} [options] - array of `{ label, value }` objects where label is displayed in options dropdown and value is appended to input value
  * @param {string} [label] - label to display above input
  * @param {string} [subText] - text to display below label
  * @param {string} [placeholder] - input placeholder
  */
 
-export default class AutocompleteInput extends Component {
+export default class AutocompleteInputComponent extends Component {
   dropdownAPI;
   inputElement;
 
diff --git a/ui/lib/core/addon/components/certificate-card.hbs b/ui/lib/core/addon/components/certificate-card.hbs
index 65ac9cd04ca..f9cfc870084 100644
--- a/ui/lib/core/addon/components/certificate-card.hbs
+++ b/ui/lib/core/addon/components/certificate-card.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container
   @level="mid"
@@ -25,11 +25,9 @@
       @text="Copy"
       @isIconOnly={{true}}
       @textToCopy={{this.copyValue}}
-      @onError={{(fn
-        (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-      )}}
+      @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
       class="transparent"
-      data-test-copy-button={{or this.copyValue true}}
+      data-test-copy-button
     />
   </div>
 </Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/certificate-card.js b/ui/lib/core/addon/components/certificate-card.js
index f7dd8ff4bd9..10c0cd9907a 100644
--- a/ui/lib/core/addon/components/certificate-card.js
+++ b/ui/lib/core/addon/components/certificate-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,14 +8,13 @@ import Component from '@glimmer/component';
 /**
  * @module CertificateCard
  * The CertificateCard component receives data and optionally receives a boolean declaring if that data is meant to be in PEM
- * Format. It renders using the <HDS::Card::Container>. To the left there is a certificate icon. In the center there is a label
+ * Format. It renders using the Hds::Card::Container. To the left there is a certificate icon. In the center there is a label
  * which says which format (PEM or DER) the data is in. Below the label is the truncated data. To the right there is a copy
  * button to copy the data.
  *
  * @example
- * ```js
- *  <CertificateCard @data={{value}} @isPem={{true}} />
- * ```
+ *  <CertificateCard @isPem={{true}} @data="-----BEGIN CERTIFICATE-----MIIDezCCAmOgAwIBAgIUTBbQcZijQsmd0rjd6COikPsrGyowDQYJKoZIhvcNAQELBQAwFDESMBAGA1UEAxMJdGVzdC1yb290MB4XDTIzMDEyMDE3NTcxMloXDTIzMDIy" />
+ *
  * @param {string} data - the data to be displayed in the component (usually in PEM or DER format)
  * @param {boolean} [isPem] - optional argument for if the data is required to be in PEM format (and should thus have the PEM Format label)
  */
diff --git a/ui/lib/core/addon/components/checkbox-grid.hbs b/ui/lib/core/addon/components/checkbox-grid.hbs
index caac311cedc..6613598478c 100644
--- a/ui/lib/core/addon/components/checkbox-grid.hbs
+++ b/ui/lib/core/addon/components/checkbox-grid.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div data-test-checkbox-grid ...attributes>
   <FormFieldLabel for={{@name}} @label={{@label}} @subText={{@subText}} />
diff --git a/ui/lib/core/addon/components/checkbox-grid.ts b/ui/lib/core/addon/components/checkbox-grid.ts
index 3083cb425a8..38f21ddd7a6 100644
--- a/ui/lib/core/addon/components/checkbox-grid.ts
+++ b/ui/lib/core/addon/components/checkbox-grid.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -22,18 +22,12 @@ interface Field {
 
 /**
  * @module CheckboxGrid
- * CheckboxGrid components are used to allow users to select any
- * number of predetermined options, aligned in a 3-column grid.
+ * @description
+ * CheckboxGrid components are used to allow users to select any number of predetermined options, aligned in a 3-column grid.
+ *
  *
  * @example
- * ```js
- * <CheckboxGrid
- *   @name="modelKey"
- *   @label="Model Attribute Label"
- *   @fields={{options}}
- *   @value={{['Hello', 'Yes']}}
- * />
- * ```
+ * <CheckboxGrid @name="extKeyUsage" @label="Extended key usage" @fields={{array (hash key="EmailProtection" label="Email Protection") (hash key="TimeStamping" label="Time Stamping") (hash key="ServerAuth" label="Server Auth") }} @value={{array "TimeStamping"}} />
  */
 
 export default class CheckboxGrid extends Component<CheckboxGridArgs> {
diff --git a/ui/lib/core/addon/components/chevron.hbs b/ui/lib/core/addon/components/chevron.hbs
index 3a1d1013471..e65f0ed1f03 100644
--- a/ui/lib/core/addon/components/chevron.hbs
+++ b/ui/lib/core/addon/components/chevron.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Icon
   @name={{this.glyph}}
diff --git a/ui/lib/core/addon/components/chevron.js b/ui/lib/core/addon/components/chevron.js
index 2cfa6d996c2..cd67977787e 100644
--- a/ui/lib/core/addon/components/chevron.js
+++ b/ui/lib/core/addon/components/chevron.js
@@ -1,25 +1,24 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
 import Component from '@glimmer/component';
 import { assert } from '@ember/debug';
 
 const DIRECTIONS = ['right', 'left', 'up', 'down'];
 
 /**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-/**
+ * @deprecated
  * @module Chevron
- * `Chevron` components render `Icon` with one of the `chevron-` glyphs.
+ * * Use HDS icons instead
+ * Chevron components render Icon with one of the "chevron-" glyphs.
  *
  * @example
- * ```js
  * <Chevron @direction="up" />
- * ```
  *
- * @param [direction="right"] {String} - the direction the chevron icon points. Accepted values are
- * "right", "down", "left", "up".
- * @param [isButton=false] {String} - if true, adjusts the CSS classes to push the icon closer to the right of a button.
+ * @param {string} [direction="right"] - the direction the chevron icon points. Accepted values are "right", "down", "left", "up".
+ * @param {string} [isButton=false] - if true, adjusts the CSS classes to push the icon closer to the right of a button.
  *
  */
 
diff --git a/ui/lib/core/addon/components/choose-pgp-key-form.hbs b/ui/lib/core/addon/components/choose-pgp-key-form.hbs
index a799ca73607..a2daf5de24b 100644
--- a/ui/lib/core/addon/components/choose-pgp-key-form.hbs
+++ b/ui/lib/core/addon/components/choose-pgp-key-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.selectedPgp}}
   <form
@@ -26,9 +26,8 @@
         class="has-bottom-margin-s"
         @textToCopy={{this.pgpKey}}
         @color="secondary"
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+        @isTruncated={{true}}
         data-test-pgp-key-copy
         @container="#shamir-flow-modal"
       />
diff --git a/ui/lib/core/addon/components/choose-pgp-key-form.js b/ui/lib/core/addon/components/choose-pgp-key-form.js
index 982a070b811..edd135f963d 100644
--- a/ui/lib/core/addon/components/choose-pgp-key-form.js
+++ b/ui/lib/core/addon/components/choose-pgp-key-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,9 +15,8 @@ const pgpKeyFileDefault = () => ({ value: '' });
  * an interface for the user to upload or paste a PGP key for use
  *
  * @example
- * ```js
- * <ChoosePgpKeyForm @onCancel={{this.reset}} @onSubmit={{handleGenerateWithPgpKey}}>
- * ```
+ * <ChoosePgpKeyForm @onCancel={{log "cancel!"}} @onSubmit={{log "submit!"}} />
+ *
  * @param {function} onCancel - required - This function will be triggered when the modal intends to be closed
  * @param {function} onSubmit - required - When the PGP key is confirmed, it will call this method with the pgpKey value as the only param
  * @param {string} buttonText - Button text for onSubmit. Defaults to "Continue with key"
diff --git a/ui/lib/core/addon/components/confirm-action.hbs b/ui/lib/core/addon/components/confirm-action.hbs
index 019d1246fce..b435191da06 100644
--- a/ui/lib/core/addon/components/confirm-action.hbs
+++ b/ui/lib/core/addon/components/confirm-action.hbs
@@ -1,19 +1,20 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @isInDropdown}}
   {{! Hds component renders <li> and <button> elements }}
   <Hds::Dropdown::ListItem::Interactive
     data-test-confirm-action-trigger
-    @text={{@buttonText}}
     @color="critical"
     {{on "click" (fn (mut this.showConfirmModal) true)}}
     ...attributes
     {{! remove class when dropdown/popup menus are replaced with Hds::Dropdown }}
     class="hds-confirm-action-critical"
-  />
+  >
+    {{@buttonText}}
+  </Hds::Dropdown::ListItem::Interactive>
 {{else}}
   <Hds::Button
     data-test-confirm-action-trigger
diff --git a/ui/lib/core/addon/components/confirm-action.js b/ui/lib/core/addon/components/confirm-action.js
index 2f19552d40d..67d304207b5 100644
--- a/ui/lib/core/addon/components/confirm-action.js
+++ b/ui/lib/core/addon/components/confirm-action.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,39 +12,21 @@ import { tracked } from '@glimmer/tracking';
  * @module ConfirmAction
  * ConfirmAction is a button that opens a modal containing a confirmation message with confirm or cancel action.
  * Splattributes are spread to the button element to apply styling directly without adding extra args.
- * 
+ *
  *
  * @example
-//  in dropdown
-  <ConfirmAction
-    @isInDropdown={{true}}
-    @buttonText="Delete"
-    @confirmMessage="This action cannot be undone."
-    @onConfirmAction={{log "my action!"}}
-  />
-
-  // in toolbar 
-  <ConfirmAction
-    class="toolbar-button"
-    @buttonColor="secondary"
-    @buttonText="Delete item"
-    @confirmTitle="Delete item?"
-    @onConfirmAction={{log "my action!"}}
-    @confirmMessage="Are you sure you want to delete this config?"
-    @isRunning={{this.rotateKey.isRunning}}
-    @disabledMessage={{if true "A secondary ID is required perform revocation."}}
-   />
- * ```
+ * <ConfirmAction @buttonColor="critical" @buttonText="Delete" @confirmMessage="This action cannot be undone." @onConfirmAction={{fn (mut this.showConfirmModal) false}} />
+ *
  *
  * @param {Function} onConfirmAction - The action to take upon confirming.
- * @param {String} [confirmTitle=Are you sure?] - The title to display in the confirmation modal.
- * @param {String} [confirmMessage=You will not be able to recover it later.] - The message to display when confirming.
+ * @param {String} [confirmTitle="Are you sure?"] - The title to display in the confirmation modal.
+ * @param {String} [confirmMessage="You will not be able to recover it later."] - The message to display when confirming.
  * @param {Boolean} isInDropdown - If true styles for dropdowns, button color is 'critical', and renders inside `<li>` elements via `<Hds::Dropdown::ListItem::Interactive`
  * @param {String} buttonText - Text for the button that toggles modal to open.
- * @param {String} [buttonColor=primary] - Color of button that toggles modal, only applies when @isInDropdown=false. Options are primary, secondary (use for toolbars), tertiary, or critical
- * @param {String} [modalColor=critical] - Styles modal color, if 'critical' confirm button is also 'critical'. Possible values: critical, warning or neutral ('neutral' used for @disabledMessage modal)
+ * @param {String} [buttonColor="primary"] - Color of button that toggles modal, only applies when @isInDropdown=false. Options are primary, secondary (use for toolbars), tertiary, or critical
+ * @param {String} [modalColor="critical"] - Styles modal color, if 'critical' confirm button is also 'critical'. Possible values: critical, warning or neutral ('neutral' used for @disabledMessage modal)
  * @param {Boolean} [isRunning] - Disables the modal confirm button - usually a concurrency task that informs the modal if a process is still running
- * @param {String} [disabledMessage] - A message explaining why the confirm action is not allowed, usually combined with a conditional that returns a string if true 
+ * @param {String} [disabledMessage] - A message explaining why the confirm action is not allowed, usually combined with a conditional that returns a string if true
  *
  */
 
diff --git a/ui/lib/core/addon/components/confirm-modal.hbs b/ui/lib/core/addon/components/confirm-modal.hbs
index c6021b0bfd3..2b89634f485 100644
--- a/ui/lib/core/addon/components/confirm-modal.hbs
+++ b/ui/lib/core/addon/components/confirm-modal.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! Replaces ConfirmAction in dropdowns, instead use dd.Interactive + this modal }}
 {{! Destructive action confirmation modal that asks "Are you sure?" or similar @confirmTitle }}
@@ -25,7 +25,7 @@
       {{@disabledMessage}}
     </M.Body>
     <M.Footer as |F|>
-      <Hds::Button data-test-confirm-cancel-button @text="Close" {{on "click" F.close}} />
+      <Hds::Button data-test-cancel @text="Close" {{on "click" F.close}} />
     </M.Footer>
   {{else}}
     <M.Header data-test-confirm-action-title @icon="alert-circle">
@@ -44,7 +44,7 @@
           @text="Confirm"
           {{on "click" @onConfirm}}
         />
-        <Hds::Button data-test-confirm-cancel-button @color="secondary" @text="Cancel" {{on "click" F.close}} />
+        <Hds::Button data-test-cancel @color="secondary" @text="Cancel" {{on "click" F.close}} />
       </Hds::ButtonSet>
     </M.Footer>
   {{/if}}
diff --git a/ui/lib/core/addon/components/confirmation-modal.hbs b/ui/lib/core/addon/components/confirmation-modal.hbs
index d1c2d78ec5f..564820cb669 100644
--- a/ui/lib/core/addon/components/confirmation-modal.hbs
+++ b/ui/lib/core/addon/components/confirmation-modal.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @isActive}}
   <Hds::Modal id="confirmation-modal" @onClose={{@onClose}} @color="critical" as |M|>
@@ -40,7 +40,7 @@
           data-test-confirm-button={{@title}}
           @text={{or @buttonText "Confirm"}}
         />
-        <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onClose}} data-test-cancel-button />
+        <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onClose}} data-test-cancel />
       </Hds::ButtonSet>
     </M.Footer>
   </Hds::Modal>
diff --git a/ui/lib/core/addon/components/confirmation-modal.js b/ui/lib/core/addon/components/confirmation-modal.js
index 6a5a4bd6b6b..8691ad7f2d7 100644
--- a/ui/lib/core/addon/components/confirmation-modal.js
+++ b/ui/lib/core/addon/components/confirmation-modal.js
@@ -1,31 +1,26 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 import Component from '@glimmer/component';
+
 /**
  * @module ConfirmationModal
- * ConfirmationModal components wrap the <Hds::Modal> component to present a critical (red) type-to-confirm modal
+ * ConfirmationModal components wrap the Hds::Modal component to present a critical (red) type-to-confirm modal
  * which require the user to type something to confirm the action.
  * They are used for extremely destructive actions that require extra consideration before confirming.
  *
  * @example
- * ```js
- * <ConfirmationModal
- *   @onConfirm={action "destructiveAction"}
- *   @title="Do Dangerous Thing?"
- *   @isActive={{isModalActive}}
- *   @onClose={{action (mut isModalActive) false}}
- *   @confirmText="yes"
- *   @onConfirmMsg="deleting this thing to delete."
- * />
- * ```
+ * button is not part of component and is just to help demo functionality
+ * <Hds::Button @text="Confirm" @color="secondary" {{on "click" (fn (mut this.isModalOpen) true)}}  />
+ * <ConfirmationModal @onConfirm={{fn (mut this.isModalOpen) false}} @title="Do Dangerous Thing?" @isActive={{this.isModalOpen}} @onClose={{fn (mut this.isModalOpen) false}} @confirmText="yes" @onConfirmMsg="deleting this thing to delete." />
+ *
  * @param {function} onConfirm - onConfirm is the action that happens when user clicks onConfirm after filling in the confirmation block
  * @param {function} onClose - specify what to do when user attempts to close modal
  * @param {boolean} isActive - Controls whether the modal is "active" eg. visible or not.
  * @param {string} title - Title of the modal
  * @param {string} [confirmText=Yes] - The confirmation text that the user must type before continuing
- * @param {string} [toConfirmMsg] - Finishes the sentence "Type <confirmText> to confirm <toConfirmMsg>", default is an empty string (ex. 'secret deletion')
+ * @param {string} [toConfirmMsg] - Finishes the sentence "Type `<confirmText>` to confirm `<toConfirmMsg>`", default is an empty string (ex. 'secret deletion')
  * @param {string} [buttonText=Confirm] - Button text on the confirm button
  */
 
diff --git a/ui/lib/core/addon/components/control-group-inline-error.hbs b/ui/lib/core/addon/components/control-group-inline-error.hbs
new file mode 100644
index 00000000000..cb3d0c817bd
--- /dev/null
+++ b/ui/lib/core/addon/components/control-group-inline-error.hbs
@@ -0,0 +1,35 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{! This display only template is for rendering control group errors when the error is thrown from a component }}
+
+<Hds::Alert data-test-message-error @type="inline" @color="warning" ...attributes as |A|>
+  <A.Title>Control Group Error</A.Title>
+  {{#if (and @error.creation_path @error.token @error.accessor)}}
+    <A.Description>
+      A Control Group was encountered at
+      <code>{{@error.creation_path}}</code>. The Control Group Token is
+      <code>{{@error.token}}</code>. The Accessor is
+      <code>{{@error.accessor}}</code>.
+    </A.Description>
+  {{/if}}
+  {{#if (has-block "customMessage")}}
+    <A.Description>
+      {{yield to="customMessage"}}
+    </A.Description>
+  {{/if}}
+  {{#if @error.href}}
+    <A.Description>
+      Visit
+      <Hds::Link::Inline
+        @color="primary"
+        @href={{@error.href}}
+        @isHrefExternal={{false}}
+        data-test-control-error="href"
+      >{{@error.href}}</Hds::Link::Inline>
+      for more details.
+    </A.Description>
+  {{/if}}
+</Hds::Alert>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/copy-secret-dropdown.hbs b/ui/lib/core/addon/components/copy-secret-dropdown.hbs
index 46fe99090a2..36a80687e89 100644
--- a/ui/lib/core/addon/components/copy-secret-dropdown.hbs
+++ b/ui/lib/core/addon/components/copy-secret-dropdown.hbs
@@ -1,10 +1,17 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! @onWrap is recommend to be a concurrency task! see <Page::Secret::Details> in KV addon for example }}
-<BasicDropdown @class="popup-menu" @horizontalPosition="auto-right" @verticalPosition="below" @onClose={{@onClose}} as |D|>
+<BasicDropdown
+  @class="popup-menu"
+  @horizontalPosition="auto-right"
+  @verticalPosition="below"
+  @onClose={{@onClose}}
+  @renderInPlace={{true}}
+  as |D|
+>
   <D.Trigger data-test-copy-menu-trigger class="toolbar-link {{if D.isOpen 'is-active'}}" @htmlTag="button">
     Copy
     <Chevron @direction={{if D.isOpen "up" "down"}} @isButton={{true}} />
@@ -12,25 +19,25 @@
   <D.Content @defaultClass="popup-menu-content is-wide">
     <nav class="box menu">
       <ul class="menu-list">
-        <li class="action">
+        <li>
           <Hds::Copy::Button
             @text="Copy JSON"
             @textToCopy={{@clipboardText}}
             @isFullWidth={{true}}
             @onError={{(fn
-              (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
+              (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
             )}}
             class="in-dropdown link is-flex-start"
             {{on "click" (action (set-flash-message "JSON Copied!"))}}
-            data-test-copy-button={{@clipboardText}}
+            data-test-copy-button
           />
         </li>
-        <li class="action">
+        <li>
           {{#if @wrappedData}}
             <MaskedInput @class="has-padding" @displayOnly={{true}} @allowCopy={{true}} @value={{@wrappedData}} />
           {{else}}
             {{#if @isWrapping}}
-              <LoadingDropdownOption data-test-wrap-button />
+              <LoadingDropdownOption data-test-button="wrap" />
             {{else}}
               <Hds::Button
                 @text="Wrap secret"
@@ -38,7 +45,7 @@
                 @isFullWidth={{true}}
                 class="in-dropdown link is-flex-start"
                 {{on "click" @onWrap}}
-                data-test-wrap-button
+                data-test-button="wrap"
               />
             {{/if}}
           {{/if}}
diff --git a/ui/lib/core/addon/components/doc-link.js b/ui/lib/core/addon/components/doc-link.js
index b0ea6ddf62d..dc74caa4dde 100644
--- a/ui/lib/core/addon/components/doc-link.js
+++ b/ui/lib/core/addon/components/doc-link.js
@@ -1,20 +1,22 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ExternalLink from './external-link';
 
 /**
+ * @deprecated
  * @module DocLink
- * `DocLink` components are used to render anchor links to relevant Vault documentation at developer.hashicorp.com.
+ * DocLink components are used to render anchor links to relevant Vault documentation at developer.hashicorp.com.
  *
  * @example
- * ```js
-    <DocLink @path="/vault/docs/secrets/kv/kv-v2.html">Learn about KV v2</DocLink>
- * ```
+ * <DocLink @path="/vault/docs/secrets/kv/kv-v2.html">Learn about KV v2</DocLink>
  *
- * @param {string} path="/" - The path to documentation on developer.hashicorp.com that the component should link to.
+ *  * Use HDS link components instead with "doc-link" helper for path prefix
+ * <Hds::Link::Standalone @text="Docs" @href={{doc-link "/vault/tutorials"}} @icon="learn-link" @iconPosition="trailing" />
+ *
+ * @param {string} path=/ - The path to documentation on developer.hashicorp.com that the component should link to.
  *
  */
 export default class DocLinkComponent extends ExternalLink {
diff --git a/ui/lib/core/addon/components/download-button.hbs b/ui/lib/core/addon/components/download-button.hbs
index 52514b0262e..f911bf2ee12 100644
--- a/ui/lib/core/addon/components/download-button.hbs
+++ b/ui/lib/core/addon/components/download-button.hbs
@@ -1,10 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Button
-  data-test-download-button
+  data-test-button="Download"
   @icon={{if @hideIcon "" "download"}}
   @text={{or @text "Download"}}
   @color={{@color}}
diff --git a/ui/lib/core/addon/components/download-button.js b/ui/lib/core/addon/components/download-button.js
index feb8ad7593e..41959805ef5 100644
--- a/ui/lib/core/addon/components/download-button.js
+++ b/ui/lib/core/addon/components/download-button.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,32 +12,23 @@ import { tracked } from '@glimmer/tracking';
 import { assert } from '@ember/debug';
 /**
  * @module DownloadButton
- * DownloadButton wraps an <Hds::Button> to perform a download action.
- * * NOTE: when using in an engine, remember to add the 'download' service to its dependencies (in /engine.js) and map to it in /app.js
- * [ember-docs](https://ember-engines.com/docs/services)
+ * DownloadButton wraps an Hds::Button to perform a download action. [Docs for HDS args](https://helios.hashicorp.design/components/button?tab=code)
+ * * **NOTE**: when using in an engine, remember to add the 'download' service to its dependencies (in /engine.js) and map to it in /app.js
+ * [Ember Engines Services](https://ember-engines.com/docs/services)
+ *
  * @example
- * ```js
- *   <DownloadButton
- *     @text="Download this stuff"
- *     @color="secondary"
- *     @data={{this.data}}
- *     @filename={{this.filename}}
- *     @mime={{this.mime}}
- *     @extension={{this.extension}}
- *     @stringify={{true}}
- *  />
- * ```
+ * <DownloadButton @text="Download this stuff" @color="secondary" @data="download data" @filename="my file" />
+ *
  * @param {string} [filename] - name of file that prefixes the ISO timestamp generated at download
  * @param {string} [data] - data to download
  * @param {function} [fetchData] - function that fetches data and returns download content
- * @param {string} [extension='txt'] - file extension, the download service uses this to determine the mimetype
+ * @param {string} [extension=txt] - file extension, the download service uses this to determine the mimetype
  * @param {boolean} [stringify=false] - argument to stringify the data before passing to the File constructor
  * @param {callback} [onSuccess] - callback from parent to invoke if download is successful
  * @param {boolean} [hideIcon=false] - renders the 'download' icon by default, pass true to hide (ex: when download button appears in a dropdown)
- * * HDS ARGS https://helios.hashicorp.design/components/button?tab=code
- * @param {string} [text="Download"] - button text, defaults to 'Download'
+ * @param {string} [text=Download] - button text, defaults to 'Download'
  * @param {string} [color] - HDS default is primary, but there are four color options: primary, secondary, tertiary, and critical.
- * @param {string} [iconPosition="leading"] - icon position, 'leading' (HDS default) or 'trailing'
+ * @param {string} [iconPosition=leading] - icon position, 'leading' (HDS default) or 'trailing'
  * @param {boolean} [isIconOnly] - button only renders an icon, no text
  */
 
diff --git a/ui/lib/core/addon/components/edit-form.hbs b/ui/lib/core/addon/components/edit-form.hbs
new file mode 100644
index 00000000000..94c7d7235a4
--- /dev/null
+++ b/ui/lib/core/addon/components/edit-form.hbs
@@ -0,0 +1,37 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{action (perform this.save this.model) on="submit"}}>
+  <MessageError @model={{this.model}} data-test-edit-form-error />
+  <div class={{if this.includeBox "box is-sideless is-fullwidth is-marginless"}}>
+    <NamespaceReminder @mode="save" />
+    {{#if (or this.model.fields this.model.attrs)}}
+      {{#each (or this.model.fields this.model.attrs) as |attr|}}
+        <FormField
+          data-test-field
+          @attr={{attr}}
+          @model={{this.model}}
+          @mode={{@mode}}
+          @modelValidations={{this.modelValidations}}
+        />
+      {{/each}}
+    {{else if this.model.fieldGroups}}
+      <FormFieldGroups @model={{this.model}} @mode={{@mode}} @modelValidations={{this.modelValidations}} />
+    {{/if}}
+  </div>
+  <FormSaveButtons
+    @isSaving={{this.save.isRunning}}
+    @saveButtonText={{this.saveButtonText}}
+    @cancelLinkParams={{@cancelLinkParams}}
+    @includeBox={{this.includeBox}}
+    @onCancel={{@onCancel}}
+  >
+    <:error>
+      {{#if this.invalidFormAlert}}
+        <AlertInline @type="danger" class="has-top-padding-s" @message={{this.invalidFormAlert}} />
+      {{/if}}
+    </:error>
+  </FormSaveButtons>
+</form>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/edit-form.js b/ui/lib/core/addon/components/edit-form.js
index c0231617c0b..ca53655f594 100644
--- a/ui/lib/core/addon/components/edit-form.js
+++ b/ui/lib/core/addon/components/edit-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,19 +7,20 @@ import AdapterError from '@ember-data/adapter/error';
 import { service } from '@ember/service';
 import Component from '@ember/component';
 import { task } from 'ember-concurrency';
-import layout from '../templates/components/edit-form';
 import { next } from '@ember/runloop';
 import { waitFor } from '@ember/test-waiters';
 
 export default Component.extend({
-  layout,
   flashMessages: service(),
 
   // internal validations
   invalidFormAlert: '',
+
   modelValidations: null,
+
   // public API
   model: null,
+
   successMessage: 'Saved!',
   deleteSuccessMessage: 'Deleted!',
   deleteButtonText: 'Delete',
@@ -71,7 +72,7 @@ export default Component.extend({
         return;
       }
       if (this.flashEnabled) {
-        this.flashMessages.success(this.get(messageKey));
+        this.flashMessages.success(this[messageKey]);
       }
       if (this.callOnSaveAfterRender) {
         next(() => {
@@ -87,7 +88,7 @@ export default Component.extend({
     // components are torn down after store is unloaded and will cause an error if attempt to unload record
     const noTeardown = this.store && !this.store.isDestroying;
     const { model } = this;
-    if (noTeardown && model && model.get('isDirty') && !model.isDestroyed && !model.isDestroying) {
+    if (noTeardown && model && model.isDirty && !model.isDestroyed && !model.isDestroying) {
       model.rollbackAttributes();
     }
     this._super(...arguments);
diff --git a/ui/lib/core/addon/components/empty-state.hbs b/ui/lib/core/addon/components/empty-state.hbs
index da7682008e9..65589c26963 100644
--- a/ui/lib/core/addon/components/empty-state.hbs
+++ b/ui/lib/core/addon/components/empty-state.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div data-test-component="empty-state" class="empty-state" ...attributes>
   <div class="empty-state-content">
@@ -13,7 +13,7 @@
         </p>
       </div>
       {{#if @subTitle}}
-        <p class="empty-state-subTitle" data-test-empty-state-subText>
+        <p class="empty-state-subTitle" data-test-empty-state-subtitle>
           {{@subTitle}}
         </p>
       {{/if}}
@@ -22,7 +22,7 @@
         {{@title}}
       </p>
       {{#if @subTitle}}
-        <p class="empty-state-subTitle" data-test-empty-state-subText>
+        <p class="empty-state-subTitle" data-test-empty-state-subtitle>
           {{@subTitle}}
         </p>
       {{/if}}
diff --git a/ui/lib/core/addon/components/enable-input.hbs b/ui/lib/core/addon/components/enable-input.hbs
index 695f8243bd6..152722775fa 100644
--- a/ui/lib/core/addon/components/enable-input.hbs
+++ b/ui/lib/core/addon/components/enable-input.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.enable}}
   {{yield}}
@@ -14,14 +14,16 @@
         <Input aria-label={{@label}} readonly class="input" @type="text" @value="**********" />
       {{/if}}
     </div>
-    <div class="align-self-end">
-      <Hds::Button
-        @text="Enable input"
-        @icon="edit"
-        @isIconOnly={{true}}
-        @color="tertiary"
-        {{on "click" (fn (mut this.enable))}}
-      />
-    </div>
+    {{#unless @disabled}}
+      <div class="align-self-end">
+        <Hds::Button
+          @text="Enable input"
+          @icon="edit"
+          @isIconOnly={{true}}
+          @color="tertiary"
+          {{on "click" (fn (mut this.enable))}}
+        />
+      </div>
+    {{/unless}}
   </div>
 {{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/enable-input.ts b/ui/lib/core/addon/components/enable-input.ts
index ee5c8b3314c..90a99b5226a 100644
--- a/ui/lib/core/addon/components/enable-input.ts
+++ b/ui/lib/core/addon/components/enable-input.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { tracked } from '@glimmer/tracking';
 interface Args {
   attr?: AttrData;
   label?: string;
+  disabled?: boolean; // specifically used for disabling on edit
 }
 interface AttrData {
   name: string; // required if @attr is passed
@@ -38,6 +39,7 @@ interface AttrData {
 
  * @param {object} [attr] - used to generate label for `ReadonlyFormField`, `name` key is required. Can be an attribute from a model exported with expandAttributeMeta.
  * @param {string} [label] - required if no attr passed. Used to ensure a11y conformance for the readonly input.
+ * @param {boolean} [disabled=false] - to be used in specific scenarios where a user can visually see but not interact with the input field. ie. disabling a field on edit
  */
 
 export default class EnableInputComponent extends Component<Args> {
diff --git a/ui/lib/core/addon/components/external-link.hbs b/ui/lib/core/addon/components/external-link.hbs
index 54f82edd53b..fc32b9ed4cf 100644
--- a/ui/lib/core/addon/components/external-link.hbs
+++ b/ui/lib/core/addon/components/external-link.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @sameTab}}
   <a href={{this.href}} ...attributes>
diff --git a/ui/lib/core/addon/components/external-link.js b/ui/lib/core/addon/components/external-link.js
index 2eacb912b1a..e0e7b1b5d5c 100644
--- a/ui/lib/core/addon/components/external-link.js
+++ b/ui/lib/core/addon/components/external-link.js
@@ -1,21 +1,22 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 
 /**
- * @module ExternalLinkComponent
- * `ExternalLink` components are used to render anchor links to non-cluster links. Automatically opens in a new tab with noopener noreferrer.
- *  To link to developer.hashicorp.com, use DocLink .
+ * @deprecated
+ * @module ExternalLink
+ * ExternalLink components are used to render anchor links to non-cluster links. Automatically opens in a new tab with noopener noreferrer.
  *
  * @example
- * ```js
-    <ExternalLink @href="https://hashicorp.com">Arbitrary Link</ExternalLink>
- * ```
+ * <ExternalLink @href="https://hashicorp.com">Arbitrary Link</ExternalLink>
  *
- * @param {string} href="https://example.com/" - The full href with protocol
+ * * Use HDS links with @isHrefExternal={{true}} instead
+ * <Hds::Link::Inline @icon="external-link" @isHrefExternal={{true}} @href="https://hashicorp.com">My link</Hds::Link::Inline>
+ *
+ * @param {string} href - The full href with protocol
  * @param {boolean} [sameTab=false] - by default, these links open in new tab. To override, pass @sameTab={{true}}
  *
  */
diff --git a/ui/lib/core/addon/components/field-group-show.hbs b/ui/lib/core/addon/components/field-group-show.hbs
index 3ade5f8a1c5..bedfc733e10 100644
--- a/ui/lib/core/addon/components/field-group-show.hbs
+++ b/ui/lib/core/addon/components/field-group-show.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
   {{#each @model.fieldGroups as |fieldGroup|}}
diff --git a/ui/lib/core/addon/components/filter-input-explicit.hbs b/ui/lib/core/addon/components/filter-input-explicit.hbs
new file mode 100644
index 00000000000..85bddfd990d
--- /dev/null
+++ b/ui/lib/core/addon/components/filter-input-explicit.hbs
@@ -0,0 +1,19 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" @handleSearch}}>
+  <Hds::SegmentedGroup as |S|>
+    <S.TextInput
+      @value={{@query}}
+      placeholder={{@placeholder}}
+      aria-label="Search by path"
+      size="32"
+      {{on "input" @handleInput}}
+      {{on "keydown" @handleKeyDown}}
+      data-test-filter-input-explicit
+    />
+    <S.Button @color="secondary" @text="Search" @icon="search" type="submit" data-test-button="Search" />
+  </Hds::SegmentedGroup>
+</form>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/filter-input.hbs b/ui/lib/core/addon/components/filter-input.hbs
index 2f01821626c..9f52ece0602 100644
--- a/ui/lib/core/addon/components/filter-input.hbs
+++ b/ui/lib/core/addon/components/filter-input.hbs
@@ -1,11 +1,13 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<div class="control {{unless @hideIcon 'has-icons-left'}}" data-test-filter-input-container>
-  <input class="filter input" ...attributes {{on "input" this.onInput}} {{did-insert this.focus}} data-test-filter-input />
-  {{#unless @hideIcon}}
-    <Icon @name="search" class="search-icon has-text-grey-light" data-test-filter-input-icon />
-  {{/unless}}
-</div>
\ No newline at end of file
+<Hds::Form::TextInput::Base
+  @type="search"
+  @id={{@id}}
+  @value={{@value}}
+  {{on "input" this.onInput}}
+  data-test-filter-input
+  ...attributes
+/>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/filter-input.ts b/ui/lib/core/addon/components/filter-input.ts
index 00ba0bf5852..80129d45cef 100644
--- a/ui/lib/core/addon/components/filter-input.ts
+++ b/ui/lib/core/addon/components/filter-input.ts
@@ -1,29 +1,20 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { action } from '@ember/object';
-import { debounce, next } from '@ember/runloop';
+import { debounce } from '@ember/runloop';
 
 import type { HTMLElementEvent } from 'vault/forms';
 
 interface Args {
   wait?: number; // defaults to 500
-  autofocus?: boolean; // initially focus the input on did-insert
-  hideIcon?: boolean; // hide the search icon in the input
   onInput(value: string): void; // invoked with input value after debounce timer expires
 }
 
 export default class FilterInputComponent extends Component<Args> {
-  @action
-  focus(elem: HTMLElement) {
-    if (this.args.autofocus) {
-      next(() => elem.focus());
-    }
-  }
-
   @action
   onInput(event: HTMLElementEvent<HTMLInputElement>) {
     const wait = this.args.wait || 500;
diff --git a/ui/lib/core/addon/components/form-error.hbs b/ui/lib/core/addon/components/form-error.hbs
deleted file mode 100644
index 8fd53d71bae..00000000000
--- a/ui/lib/core/addon/components/form-error.hbs
+++ /dev/null
@@ -1,13 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="has-top-margin-s is-flex is-flex-center" data-test-form-error>
-  <div class="is-narrow message-icon">
-    <Icon @name="x-square-fill" class="has-text-danger" />
-  </div>
-  <div class="has-text-danger">
-    {{yield}}
-  </div>
-</div>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/form-field-groups-loop.hbs b/ui/lib/core/addon/components/form-field-groups-loop.hbs
index 03076ad9163..946cc73b996 100644
--- a/ui/lib/core/addon/components/form-field-groups-loop.hbs
+++ b/ui/lib/core/addon/components/form-field-groups-loop.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each (get @model this.fieldGroups) as |fieldGroup|}}
   {{#each-in fieldGroup as |group fields|}}
@@ -28,7 +28,7 @@
           @closedLabel={{group}}
           @onClick={{fn (mut (get @model prop))}}
           class="is-block"
-          data-test-toggle-group={{group}}
+          data-test-button={{group}}
         />
         {{#if (get @model prop)}}
           <div class="box is-marginless">
diff --git a/ui/lib/core/addon/components/form-field-groups-loop.js b/ui/lib/core/addon/components/form-field-groups-loop.js
index e5cc05f9c34..14b9d208b30 100644
--- a/ui/lib/core/addon/components/form-field-groups-loop.js
+++ b/ui/lib/core/addon/components/form-field-groups-loop.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,16 +10,15 @@ import Component from '@glimmer/component';
  * FormFieldGroupsLoop components loop through the "groups" set on a model and display them either as default or behind toggle components.
  *
  * @example
- * ```js
- <FormFieldGroupsLoop @model={{this.model}} @mode={{if @model.isNew "create" "update"}}/>
- * ```
+ * <FormFieldGroupsLoop @model={{this.model}} @mode={{if @model.isNew "create" "update"}}/>
+ *
  * @param {class} model - The routes model class.
  * @param {string} mode - "create" or "update" used to hide the name form field. TODO: not ideal, would prefer to disable it to follow new design patterns.
  * @param {function} [modelValidations] - Passed through to formField.
  * @param {boolean} [showHelpText] - Passed through to formField.
- * @param {string} [groupName="fieldGroups"] - option to override key on the model where groups are located
+ * @param {string} [groupName=fieldGroups] - option to override key on the model where groups are located
  */
-export default class FormFieldGroupsLoop extends Component {
+export default class FormFieldGroupsLoopComponent extends Component {
   get fieldGroups() {
     return this.args.groupName || 'fieldGroups';
   }
diff --git a/ui/lib/core/addon/components/form-field-groups.hbs b/ui/lib/core/addon/components/form-field-groups.hbs
index 30cc5c41d0e..ce8072e437f 100644
--- a/ui/lib/core/addon/components/form-field-groups.hbs
+++ b/ui/lib/core/addon/components/form-field-groups.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each (get @model this.fieldGroups) as |fieldGroup|}}
   {{#each-in fieldGroup as |group fields|}}
@@ -24,6 +24,10 @@
             {{! OTHERWISE WE'RE EDITING }}
             {{#if (or (eq attr.name "name") (attr.options.editDisabled))}}
               <ReadonlyFormField @attr={{attr}} @value={{get @model attr.name}} />
+            {{else if (and @useEnableInput attr.options.sensitive)}}
+              <EnableInput data-test-enable-field={{attr.name}} class="field" @attr={{attr}}>
+                <FormField @attr={{attr}} @model={{@model}} @modelValidations={{@modelValidations}} @onKeyUp={{@onKeyUp}} />
+              </EnableInput>
             {{else}}
               <FormField
                 data-test-field
@@ -45,7 +49,7 @@
           @closedLabel={{group}}
           @onClick={{fn this.toggleGroup group}}
           class="is-block"
-          data-test-toggle-group={{group}}
+          data-test-button={{group}}
         />
         {{#if (eq this.showGroup group)}}
           <div class="box is-marginless">
@@ -61,7 +65,11 @@
                   @onKeyUp={{@onKeyUp}}
                   @modelValidations={{@modelValidations}}
                   @showHelpText={{@showHelpText}}
-                />
+                >
+                  {{#if (and (has-block "identityTokenKey") (eq attr.name "config.identity_token_key"))}}
+                    {{yield to="identityTokenKey"}}
+                  {{/if}}
+                </FormField>
               {{else}}
                 {{! OTHERWISE WE'RE EDITING }}
                 {{#if (or (eq attr.name "name") (eq attr.options.editDisabled true))}}
diff --git a/ui/lib/core/addon/components/form-field-groups.js b/ui/lib/core/addon/components/form-field-groups.js
deleted file mode 100644
index d2cfe363f31..00000000000
--- a/ui/lib/core/addon/components/form-field-groups.js
+++ /dev/null
@@ -1,51 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { tracked } from '@glimmer/tracking';
-import { action } from '@ember/object';
-
-/**
- * @module FormFieldGroups
- * `FormFieldGroups` components are field groups associated with a particular model. They render individual `FormField` components.
- *
- * @example
- * ```js
- * {{if model.fieldGroups}}
- *  <FormFieldGroups @model={{model}} />
- * {{/if}}
- *
- * ...
- *
- * <FormFieldGroups
- *  @model={{mountModel}}
- *  @onChange={{action "onTypeChange"}}
- *  @renderGroup="Method Options"
- *  @onKeyUp={{action "onKeyUp"}}
- *  @validationMessages={{validationMessages}}
- * />
- * ```
- * @callback onChangeCallback
- * @callback onKeyUpCallback
- * @param {Model} model- Model to be passed down to form-field component. If `fieldGroups` is present on the model then it will be iterated over and groups of `FormField` components will be rendered.
- * @param {string} [renderGroup] - An allow list of groups to include in the render.
- * @param {onChangeCallback} [onChange] - Handler that will get set on the `FormField` component.
- * @param {onKeyUpCallback} [onKeyUp] - Handler that will set the value and trigger validation on input changes
- * @param {ModelValidations} [modelValidations] - Object containing validation message for each property
- * @param {string} [groupName='fieldGroups'] - attribute name where the field groups are
- */
-
-export default class FormFieldGroupsComponent extends Component {
-  @tracked showGroup = null;
-
-  @action
-  toggleGroup(group, isOpen) {
-    this.showGroup = isOpen ? group : null;
-  }
-
-  get fieldGroups() {
-    return this.args.groupName || 'fieldGroups';
-  }
-}
diff --git a/ui/lib/core/addon/components/form-field-groups.ts b/ui/lib/core/addon/components/form-field-groups.ts
new file mode 100644
index 00000000000..932ea2f3f1b
--- /dev/null
+++ b/ui/lib/core/addon/components/form-field-groups.ts
@@ -0,0 +1,47 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import type { ValidationMap } from 'vault/vault/app-types';
+
+/**
+ * @module FormFieldGroups
+ * FormFieldGroups components are field groups associated with a particular model. They render individual FormField components.
+ *
+ * @example
+ * <FormFieldGroups @model={{mountModel}} @onChange={{action "onTypeChange"}} @renderGroup="Method Options" @onKeyUp={{action "onKeyUp"}} @validationMessages={{validationMessages}} />
+ *
+ * @param {Model} model- Model to be passed down to form-field component. If `fieldGroups` is present on the model then it will be iterated over and groups of `FormField` components will be rendered.
+ * @param {string} [renderGroup] - An allow list of groups to include in the render.
+ * @param {function} [onChange] - Handler that will get set on the `FormField` component.
+ * @param {function} [onKeyUp] - Handler that will set the value and trigger validation on input changes
+ * @param {object} [modelValidations] - Object containing validation message for each property
+ * @param {string} [groupName=fieldGroups] - attribute name where the field groups are
+ * @param {boolean} [useEnableInput=false] - if you want to wrap your sensitive fields with the EnableInput component while editing.
+ */
+
+interface Args {
+  model: Record<string, unknown>;
+  renderGroup?: string;
+  onChange?: (value: string) => void;
+  onKeyUp?: (value: string) => void;
+  modelValidations?: ValidationMap;
+  groupName?: string;
+}
+
+export default class FormFieldGroupsComponent extends Component<Args> {
+  @tracked showGroup: string | null = null;
+
+  @action
+  toggleGroup(group: string, isOpen: boolean) {
+    this.showGroup = isOpen ? group : null;
+  }
+
+  get fieldGroups() {
+    return this.args.groupName || 'fieldGroups';
+  }
+}
diff --git a/ui/lib/core/addon/components/form-field-label.hbs b/ui/lib/core/addon/components/form-field-label.hbs
index 762b21dbdc8..a6156ea9e89 100644
--- a/ui/lib/core/addon/components/form-field-label.hbs
+++ b/ui/lib/core/addon/components/form-field-label.hbs
@@ -1,15 +1,15 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @label}}
-  <label class="is-label" ...attributes>
+  <label data-test-form-field-label class="is-label" ...attributes>
     {{@label}}
     {{#if @helpText}}
-      <InfoTooltip>
-        <span data-test-help-text>{{@helpText}}</span>
-      </InfoTooltip>
+      <Hds::TooltipButton @text={{@helpText}} aria-label="More information" data-test-tooltip="form field label">
+        <Hds::Icon @name="info" />
+      </Hds::TooltipButton>
     {{/if}}
   </label>
 {{/if}}
diff --git a/ui/lib/core/addon/components/form-field-label.js b/ui/lib/core/addon/components/form-field-label.js
index 5727401a751..e2a2c8e6c43 100644
--- a/ui/lib/core/addon/components/form-field-label.js
+++ b/ui/lib/core/addon/components/form-field-label.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/components/form-field.hbs b/ui/lib/core/addon/components/form-field.hbs
index fb63d2e4ff9..a9469036096 100644
--- a/ui/lib/core/addon/components/form-field.hbs
+++ b/ui/lib/core/addon/components/form-field.hbs
@@ -1,86 +1,116 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! template-lint-configure simple-unless "warn" }}
-<div class="field" data-test-field={{or @attr.name true}}>
-  {{#unless this.hideLabel}}
-    <FormFieldLabel
-      for={{@attr.name}}
-      @label={{this.labelString}}
-      @helpText={{(if this.showHelpText @attr.options.helpText)}}
-      @subText={{@attr.options.subText}}
-      @docLink={{@attr.options.docLink}}
-    />
-  {{/unless}}
-  {{#if @attr.options.possibleValues}}
-    {{#if (eq @attr.options.editType "radio")}}
-      <div class="control {{unless this.hasRadioSubText 'columns'}}" data-test-radio-input>
-        {{#each (path-or-array @attr.options.possibleValues @model) as |val|}}
-          <div
-            class="is-flex-center
-              {{if this.hasRadioSubText 'has-top-padding-xs has-bottom-padding-s' 'column is-narrow has-right-margin-s'}}"
-            data-test-input={{@attr.name}}
-          >
-            <RadioButton
-              class="radio"
-              name={{@attr.name}}
-              id={{or val.value val}}
-              value={{or val.value val}}
-              @value={{or val.value val}}
-              @onChange={{this.setAndBroadcast}}
-              @groupValue={{get @model this.valuePath}}
-              @disabled={{and @attr.options.editDisabled (not @model.isNew)}}
-              data-test-radio={{or val.value val}}
-            />
-            <div class="has-left-margin-xs">
-              <label
-                for="{{or val.value val}}"
-                class="has-left-margin-xs is-size-7"
-                data-test-radio-label={{or val.label val.value val}}
-              >
+<div class="field" data-test-field={{@attr.name}}>
+  {{#if this.isHdsFormField}}
+    {{! •••••••••••••••••••••••••••••••••••••••••••••••••••••••• }}
+    {{!                  HDS COMPONENTS - START                  }}
+    {{! •••••••••••••••••••••••••••••••••••••••••••••••••••••••• }}
+    {{#if @attr.options.possibleValues}}
+      {{#if (eq @attr.options.editType "radio")}}
+        <Hds::Form::Radio::Group
+          @name={{@attr.name}}
+          @layout={{if (or this.hasRadioSubText this.hasRadioHelpText) "vertical" "horizontal"}}
+          data-test-input-group={{@attr.name}}
+          as |G|
+        >
+          <G.Legend data-test-form-field-label={{@attr.name}}>{{this.labelString}}</G.Legend>
+          {{#if this.helpTextString}}
+            <G.HelperText data-test-help-text={{@attr.options.helpText}}>{{this.helpTextString}}</G.HelperText>
+          {{/if}}
+          {{#if @attr.options.subText}}
+            <G.HelperText data-test-help-text={{@attr.options.subText}}>
+              {{@attr.options.subText}}
+              {{#if @attr.options.docLink}}
+                <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>
+                  See our documentation
+                </DocLink>
+                for help.
+              {{/if}}
+            </G.HelperText>
+          {{/if}}
+          {{#each (path-or-array @attr.options.possibleValues @model) as |val|}}
+            <G.RadioField
+              @id={{or val.id (this.radioValue val)}}
+              @value={{this.radioValue val}}
+              checked={{if (eq (this.radioValue val) (get @model this.valuePath)) "checked"}}
+              disabled={{and @attr.options.editDisabled (not @model.isNew)}}
+              {{on "change" (fn this.setAndBroadcastRadio val)}}
+              data-test-radio={{or val.id (this.radioValue val)}}
+              as |F|
+            >
+              <F.Label data-test-input-group-item-label={{or val.label val.value val}}>
                 {{or val.label val.value val}}
-                {{#if val.helpText}}
-                  <Hds::TooltipButton @text={{val.helpText}} aria-label="More information">
-                    <FlightIcon @name="info" />
-                  </Hds::TooltipButton>
-                {{/if}}
-                {{#if this.hasRadioSubText}}
-                  <p class="has-left-margin-xs has-text-grey is-size-8" data-test-radio-subText={{val.subText}}>
-                    {{val.subText}}
-                  </p>
-                {{/if}}
-              </label>
-            </div>
-          </div>
-        {{/each}}
-      </div>
-    {{else if (eq @attr.options.editType "checkboxList")}}
-      <Hds::Form::Checkbox::Group @name={{@attr.name}} data-test-input={{@attr.name}} as |G|>
-        {{#each @attr.options.possibleValues as |option|}}
-          <G.Checkbox::Field
-            class={{if this.validationError "has-error-border"}}
-            checked={{includes option (get @model this.valuePath)}}
-            @value={{option}}
-            @id={{option}}
-            {{on "change" this.handleChecklist}}
-            as |F|
-          >
-            <F.Label>{{option}}</F.Label>
-          </G.Checkbox::Field>
-        {{/each}}
-      </Hds::Form::Checkbox::Group>
-    {{else}}
-      <div class="control is-expanded">
-        <div class="select is-fullwidth">
-          <select
-            class="{{if this.validationError 'has-error-border'}}"
-            name={{@attr.name}}
-            id={{@attr.name}}
-            onchange={{this.onChangeWithEvent}}
-            data-test-input={{@attr.name}}
-          >
+              </F.Label>
+              {{! Note: if we have both `subText` and `helpText`, we display only the `subText` because in these situations, the helpText is likely there to clarify or improve upon the OpenAPI-generated text }}
+              {{#if this.hasRadioSubText}}
+                <F.HelperText data-test-help-text={{val.subText}}>{{val.subText}}</F.HelperText>
+              {{else if this.hasRadioHelpText}}
+                <F.HelperText data-test-help-text={{val.helpText}}>{{val.helpText}}</F.HelperText>
+              {{/if}}
+            </G.RadioField>
+          {{/each}}
+          {{#if this.validationError}}
+            <G.Error data-test-validation-error={{this.valuePath}}>{{this.validationError}}</G.Error>
+          {{/if}}
+        </Hds::Form::Radio::Group>
+      {{else if (eq @attr.options.editType "checkboxList")}}
+        <Hds::Form::Checkbox::Group @name={{@attr.name}} data-test-input-group={{@attr.name}} as |G|>
+          <G.Legend data-test-form-field-label>{{this.labelString}}</G.Legend>
+          {{#if this.helpTextString}}
+            <G.HelperText data-test-help-text={{@attr.options.helpText}}>{{this.helpTextString}}</G.HelperText>
+          {{/if}}
+          {{#if @attr.options.subText}}
+            <G.HelperText data-test-help-text={{@attr.options.subText}}>
+              {{@attr.options.subText}}
+              {{#if @attr.options.docLink}}
+                <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>See our documentation</DocLink>
+                for help.
+              {{/if}}
+            </G.HelperText>
+          {{/if}}
+          {{#each @attr.options.possibleValues as |option|}}
+            <G.CheckboxField
+              @id={{option}}
+              @value={{option}}
+              checked={{includes option (get @model this.valuePath)}}
+              {{on "change" this.setAndBroadcastChecklist}}
+              data-test-checkbox={{option}}
+              as |F|
+            >
+              <F.Label data-test-input-group-item-label={{option}}>{{option}}</F.Label>
+            </G.CheckboxField>
+          {{/each}}
+          {{#if this.validationError}}
+            <G.Error data-test-validation-error={{this.valuePath}}>{{this.validationError}}</G.Error>
+          {{/if}}
+        </Hds::Form::Checkbox::Group>
+      {{else}}
+        <Hds::Form::Select::Field
+          name={{@attr.name}}
+          @id={{@attr.name}}
+          @isInvalid={{this.validationError}}
+          {{on "change" this.onChangeWithEvent}}
+          data-test-input={{@attr.name}}
+          as |F|
+        >
+          <F.Label data-test-form-field-label>{{this.labelString}}</F.Label>
+          {{#if this.helpTextString}}
+            <F.HelperText data-test-help-text={{@attr.options.helpText}}>{{this.helpTextString}}</F.HelperText>
+          {{/if}}
+          {{#if @attr.options.subText}}
+            <F.HelperText data-test-help-text={{@attr.options.subText}}>
+              {{@attr.options.subText}}
+              {{#if @attr.options.docLink}}
+                <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>See our documentation</DocLink>
+                for help.
+              {{/if}}
+            </F.HelperText>
+          {{/if}}
+          <F.Options>
             {{#if @attr.options.noDefault}}
               <option value="">
                 Select one
@@ -91,294 +121,427 @@
                 {{or val.displayName val}}
               </option>
             {{/each}}
-          </select>
-        </div>
-      </div>
+          </F.Options>
+          {{#if this.validationError}}
+            <F.Error data-test-validation-error={{this.valuePath}}>{{this.validationError}}</F.Error>
+          {{/if}}
+        </Hds::Form::Select::Field>
+      {{/if}}
+    {{else}}
+      {{#if (eq @attr.options.editType "dateTimeLocal")}}
+        <Hds::Form::TextInput::Field
+          @type="datetime-local"
+          name={{@attr.name}}
+          @id={{@attr.name}}
+          @value={{date-format (get @model this.valuePath) "yyyy-MM-dd'T'HH:mm"}}
+          @isInvalid={{this.validationError}}
+          {{on "focusout" this.onChangeWithEvent}}
+          data-test-input={{@attr.name}}
+          as |F|
+        >
+          <F.Label data-test-form-field-label>{{this.labelString}}</F.Label>
+          {{#if this.helpTextString}}
+            <F.HelperText data-test-help-text={{@attr.options.helpText}}>{{this.helpTextString}}</F.HelperText>
+          {{/if}}
+          {{#if @attr.options.subText}}
+            <F.HelperText data-test-help-text={{@attr.options.subText}}>
+              {{@attr.options.subText}}
+              {{#if @attr.options.docLink}}
+                <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>See our documentation</DocLink>
+                for help.
+              {{/if}}
+            </F.HelperText>
+          {{/if}}
+          {{#if this.validationError}}
+            <F.Error data-test-validation-error={{this.valuePath}}>{{this.validationError}}</F.Error>
+          {{/if}}
+        </Hds::Form::TextInput::Field>
+
+      {{else if (or (eq @attr.type "number") (eq @attr.type "string"))}}
+        {{#if (eq @attr.options.editType "password")}}
+          <Hds::Form::TextInput::Field
+            @type="password"
+            name={{@attr.name}}
+            {{! TODO: about this visibility toggle, see: https://hashicorp.atlassian.net/browse/VAULT-34870 }}
+            @hasVisibilityToggle={{false}}
+            @value={{get @model this.valuePath}}
+            @isInvalid={{this.validationError}}
+            placeholder={{@attr.options.placeholder}}
+            {{! Prevents browsers from auto-filling }}
+            autocomplete="new-password"
+            spellcheck="false"
+            {{on "input" this.onChangeWithEvent}}
+            data-test-input={{@attr.name}}
+            as |F|
+          >
+            <F.Label data-test-form-field-label>{{this.labelString}}</F.Label>
+            {{#if this.helpTextString}}
+              <F.HelperText data-test-help-text={{@attr.options.helpText}}>{{this.helpTextString}}</F.HelperText>
+            {{/if}}
+            {{#if @attr.options.subText}}
+              <F.HelperText data-test-help-text={{@attr.options.subText}}>
+                {{@attr.options.subText}}
+                {{#if @attr.options.docLink}}
+                  <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>See our documentation</DocLink>
+                  for help.
+                {{/if}}
+              </F.HelperText>
+            {{/if}}
+            {{#if this.validationError}}
+              <F.Error data-test-validation-error={{this.valuePath}}>{{this.validationError}}</F.Error>
+            {{/if}}
+          </Hds::Form::TextInput::Field>
+        {{else if (eq @attr.options.editType "textarea")}}
+          <Hds::Form::Textarea::Field
+            name={{@attr.name}}
+            @id={{@attr.name}}
+            @value={{or (get @model this.valuePath) @attr.options.defaultValue}}
+            @isInvalid={{this.validationError}}
+            placeholder={{@attr.options.placeholder}}
+            {{on "input" this.onChangeWithEvent}}
+            data-test-input={{@attr.name}}
+            as |F|
+          >
+            <F.Label data-test-form-field-label>{{this.labelString}}</F.Label>
+            {{#if this.helpTextString}}
+              <F.HelperText data-test-help-text={{@attr.options.helpText}}>{{this.helpTextString}}</F.HelperText>
+            {{/if}}
+            {{#if @attr.options.subText}}
+              <F.HelperText data-test-help-text={{@attr.options.subText}}>
+                {{@attr.options.subText}}
+                {{#if @attr.options.docLink}}
+                  <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>See our documentation</DocLink>
+                  for help.
+                {{/if}}
+              </F.HelperText>
+            {{/if}}
+            {{#if this.validationError}}
+              <F.Error data-test-validation-error={{this.valuePath}}>{{this.validationError}}</F.Error>
+            {{/if}}
+          </Hds::Form::Textarea::Field>
+        {{else}}
+          <Hds::Form::TextInput::Field
+            name={{@attr.name}}
+            @id={{@attr.name}}
+            @value={{get @model this.valuePath}}
+            @isInvalid={{this.validationError}}
+            readonly={{this.isReadOnly}}
+            disabled={{and @attr.options.editDisabled (not @model.isNew)}}
+            autocomplete="off"
+            spellcheck="false"
+            placeholder={{@attr.options.placeholder}}
+            maxLength={{@attr.options.characterLimit}}
+            {{on "change" this.onChangeWithEvent}}
+            {{on "input" this.onChangeWithEvent}}
+            {{on "keyup" this.handleKeyUp}}
+            data-test-input={{@attr.name}}
+            as |F|
+          >
+            <F.Label data-test-form-field-label>{{this.labelString}}</F.Label>
+            {{#if this.helpTextString}}
+              <F.HelperText data-test-help-text={{@attr.options.helpText}}>{{this.helpTextString}}</F.HelperText>
+            {{/if}}
+            {{#if @attr.options.subText}}
+              <F.HelperText data-test-help-text={{@attr.options.subText}}>
+                {{@attr.options.subText}}
+                {{#if @attr.options.docLink}}
+                  <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>See our documentation</DocLink>
+                  for help.
+                {{/if}}
+              </F.HelperText>
+            {{/if}}
+            {{#if @attr.options.characterLimit}}
+              <F.CharacterCount @maxLength={{@attr.options.characterLimit}} />
+            {{/if}}
+            {{#if this.validationError}}
+              <F.Error data-test-validation-error={{this.valuePath}}>{{this.validationError}}</F.Error>
+            {{/if}}
+          </Hds::Form::TextInput::Field>
+        {{/if}}
+      {{else if (or (eq @attr.type "boolean") (eq @attr.options.editType "boolean"))}}
+        <Hds::Form::Checkbox::Field
+          name={{@attr.name}}
+          @id={{@attr.name}}
+          checked={{get @model this.valuePath}}
+          disabled={{this.disabled}}
+          {{on "change" this.onChangeWithEvent}}
+          data-test-input={{@attr.name}}
+          as |F|
+        >
+          <F.Label data-test-form-field-label>{{this.labelString}}</F.Label>
+          {{#if (or this.helpTextString @attr.options.subText)}}
+            <F.HelperText>
+              {{#if this.helpTextString}}
+                <span data-test-help-text={{@attr.options.helpText}}>{{this.helpTextString}}</span>
+              {{/if}}
+              {{#if @attr.options.subText}}
+                <span data-test-help-text={{@attr.options.subText}}>
+                  {{@attr.options.subText}}
+                  {{#if @attr.options.docLink}}
+                    <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>Learn more here.</DocLink>
+                  {{/if}}
+                </span>
+              {{/if}}
+            </F.HelperText>
+          {{/if}}
+          {{#if this.validationError}}
+            <F.Error data-test-validation-error={{this.valuePath}}>{{this.validationError}}</F.Error>
+          {{/if}}
+        </Hds::Form::Checkbox::Field>
+      {{/if}}
     {{/if}}
-  {{else if (eq @attr.options.editType "dateTimeLocal")}}
-    <Input
-      @type="datetime-local"
-      @value={{date-format (get @model this.valuePath) "yyyy-MM-dd'T'HH:mm"}}
-      name={{@attr.name}}
-      id={{@attr.name}}
-      data-test-input={{@attr.name}}
-      class="input has-top-margin-xs has-bottom-margin-xs is-auto-width is-block
-        {{if this.validationError 'has-error-border'}}"
-      {{on "focusout" this.onChangeWithEvent}}
-    />
-  {{else if (eq @attr.options.editType "searchSelect")}}
-    <div class="form-section">
-      <SearchSelect
-        @id={{@attr.name}}
-        @models={{@attr.options.models}}
-        @onChange={{this.setAndBroadcast}}
-        @inputValue={{get @model this.valuePath}}
-        @wildcardLabel={{@attr.options.wildcardLabel}}
+    {{! •••••••••••••••••••••••••••••••••••••••••••••••••••••••• }}
+    {{!                  HDS COMPONENTS - END                  }}
+    {{! •••••••••••••••••••••••••••••••••••••••••••••••••••••••• }}
+  {{else}}
+    {{! ≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠ }}
+    {{!                NON-HDS COMPONENTS - START                }}
+    {{! ≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠ }}
+    {{#unless this.hideLabel}}
+      <FormFieldLabel
+        for={{@attr.name}}
         @label={{this.labelString}}
-        @labelClass={{if @attr.options.isSectionHeader "title is-4" "is-label"}}
+        @helpText={{this.helpTextString}}
         @subText={{@attr.options.subText}}
-        @helpText={{@attr.options.helpText}}
-        @fallbackComponent={{@attr.options.fallbackComponent}}
-        @selectLimit={{@attr.options.selectLimit}}
-        @backend={{@model.backend}}
-        @disallowNewItems={{@attr.options.onlyAllowExisting}}
-        class={{if this.validationError "dropdown-has-error-border"}}
+        @docLink={{@attr.options.docLink}}
       />
-    </div>
-  {{else if (eq @attr.options.editType "mountAccessor")}}
-    <MountAccessorSelect
-      @name={{@attr.name}}
-      @label={{this.labelString}}
-      @helpText={{@attr.options.helpText}}
-      @value={{get @model this.valuePath}}
-      @onChange={{this.setAndBroadcast}}
-    />
-  {{else if (eq @attr.options.editType "kv")}}
-    {{! KV Object Editor }}
-    <KvObjectEditor
-      @value={{get @model this.valuePath}}
-      @onChange={{this.setAndBroadcast}}
-      @label={{this.labelString}}
-      @labelClass={{if @attr.options.isSectionHeader "title is-4" "is-label"}}
-      @helpText={{@attr.options.helpText}}
-      @subText={{@attr.options.subText}}
-      @onKeyUp={{this.handleKeyUp}}
-      @keyPlaceholder={{@attr.options.keyPlaceholder}}
-      @valuePlaceholder={{@attr.options.valuePlaceholder}}
-      @isSingleRow={{@attr.options.isSingleRow}}
-      @allowWhiteSpace={{@attr.options.allowWhiteSpace}}
-      class="{{if this.validationError 'error-border-child-inputs'}} {{if @attr.options.isSectionHeader 'form-section'}}"
-    />
-  {{else if (eq @attr.options.editType "file")}}
-    {{! File Input }}
-    <div class="has-bottom-margin-m" data-test-input={{@attr.name}}>
-      <TextFile
+    {{/unless}}
+    {{#if (eq @attr.options.editType "searchSelect")}}
+      <div class="form-section">
+        <SearchSelect
+          @id={{@attr.name}}
+          @models={{@attr.options.models}}
+          @onChange={{this.setAndBroadcast}}
+          @inputValue={{get @model this.valuePath}}
+          @wildcardLabel={{@attr.options.wildcardLabel}}
+          @label={{this.labelString}}
+          @labelClass={{if @attr.options.isSectionHeader "title is-4" "is-label"}}
+          @subText={{@attr.options.subText}}
+          @helpText={{this.helpTextString}}
+          @fallbackComponent={{@attr.options.fallbackComponent}}
+          @selectLimit={{@attr.options.selectLimit}}
+          @backend={{@model.backend}}
+          @disallowNewItems={{@attr.options.onlyAllowExisting}}
+          class={{if this.validationError "dropdown-has-error-border"}}
+        />
+      </div>
+    {{else if (eq @attr.options.editType "mountAccessor")}}
+      <MountAccessorSelect
+        @name={{@attr.name}}
         @label={{this.labelString}}
+        @helpText={{this.helpTextString}}
+        @value={{get @model this.valuePath}}
+        @onChange={{this.setAndBroadcast}}
+      />
+    {{else if (eq @attr.options.editType "kv")}}
+      {{! KV Object Editor }}
+      <KvObjectEditor
+        @value={{get @model this.valuePath}}
+        @onChange={{this.setAndBroadcast}}
+        @label={{this.labelString}}
+        @labelClass={{if @attr.options.isSectionHeader "title is-4" "is-label"}}
+        @helpText={{this.helpTextString}}
         @subText={{@attr.options.subText}}
-        @helpText={{@attr.options.helpText}}
-        @docLink={{@attr.options.docLink}}
-        @onChange={{this.setFile}}
-        @validationError={{this.validationError}}
+        @onKeyUp={{this.handleKeyUp}}
+        @keyPlaceholder={{@attr.options.keyPlaceholder}}
+        @valuePlaceholder={{@attr.options.valuePlaceholder}}
+        @isSingleRow={{@attr.options.isSingleRow}}
+        @allowWhiteSpace={{@attr.options.allowWhiteSpace}}
+        class="{{if this.validationError 'error-border-child-inputs'}} {{if @attr.options.isSectionHeader 'form-section'}}"
       />
-    </div>
-  {{else if (eq @attr.options.editType "ttl")}}
-    {{! TTL Picker }}
-    <div class="field">
-      {{#let (or (get @model this.valuePath) @attr.options.setDefault) as |initialValue|}}
-        <TtlPicker
-          data-test-input={{@attr.name}}
-          class={{if this.validationError "ttl-picker-form-field-error"}}
-          @onChange={{this.setAndBroadcastTtl}}
+    {{else if (eq @attr.options.editType "file")}}
+      {{! File Input }}
+      <div class="has-bottom-margin-m" data-test-input={{@attr.name}}>
+        <TextFile
           @label={{this.labelString}}
-          @helperTextDisabled={{or @attr.options.helperTextDisabled "Vault will use the default lease duration."}}
-          @helperTextEnabled={{or @attr.options.helperTextEnabled "Lease will expire after"}}
-          @description={{@attr.helpText}}
-          @initialValue={{initialValue}}
-          @initialEnabled={{if (eq initialValue "0s") false initialValue}}
-          @hideToggle={{@attr.options.hideToggle}}
+          @subText={{@attr.options.subText}}
+          @helpText={{this.helpTextString}}
+          @docLink={{@attr.options.docLink}}
+          @onChange={{this.setFile}}
+          @validationError={{this.validationError}}
         />
-      {{/let}}
-    </div>
-  {{else if (eq @attr.options.editType "regex")}}
-    {{! Regex Validated Input }}
-    <RegexValidator
-      @attr={{@attr}}
-      @labelString={{this.labelString}}
-      @value={{or (get @model this.valuePath) @attr.options.defaultValue}}
-      @onChange={{this.onChangeWithEvent}}
-    />
-  {{else if (eq @attr.options.editType "optionalText")}}
-    {{! Togglable Text Input }}
-    <Toggle
-      @name="show-{{@attr.name}}"
-      @onChange={{this.toggleShow}}
-      @checked={{this.showInput}}
-      data-test-toggle={{@attr.name}}
-    >
-      <span class="ttl-picker-label is-large">{{this.labelString}}</span><br />
-      <div class="description has-text-grey">
-        {{#if this.showInput}}
-          <span>
-            {{@attr.options.subText}}
-            {{#if @attr.options.docLink}}
-              <DocLink @path={{@attr.options.docLink}}>
-                See our documentation
-              </DocLink>
-              for help.
-            {{/if}}
-          </span>
-        {{else}}
-          <span>
-            {{or @attr.options.defaultSubText "Vault will use the engine default."}}
-            {{#if @attr.options.docLink}}
-              <DocLink @path={{@attr.options.docLink}}>
-                See our documentation
-              </DocLink>
-              for help.
-            {{/if}}
-          </span>
-        {{/if}}
       </div>
-      {{#if this.showInput}}
-        <input
-          data-test-input={{@attr.name}}
-          id={{@attr.name}}
-          autocomplete="off"
-          spellcheck="false"
-          value={{or (get @model this.valuePath) @attr.options.defaultValue}}
-          onchange={{this.onChangeWithEvent}}
-          class="input"
-          maxLength={{@attr.options.characterLimit}}
-        />
-      {{/if}}
-    </Toggle>
-  {{else if (eq @attr.options.editType "stringArray")}}
-    <StringList
-      class={{if this.validationError "string-list-form-field-error"}}
-      data-test-input={{@attr.name}}
-      @label={{this.labelString}}
-      @helpText={{if this.showHelpText @attr.options.helpText}}
-      @inputValue={{get @model this.valuePath}}
-      @onChange={{this.setAndBroadcast}}
-      @attrName={{@attr.name}}
-      @subText="{{@attr.options.subText}} Add one item per row."
-    />
-  {{else if (eq @attr.options.sensitive true)}}
-    <MaskedInput
-      @name={{@attr.name}}
-      @value={{or (get @model this.valuePath) @attr.options.defaultValue}}
-      @allowCopy="true"
-      @onChange={{this.setAndBroadcast}}
-      @onKeyUp={{@onKeyUp}}
-    />
-  {{else if (or (eq @attr.type "number") (eq @attr.type "string"))}}
-    <div class="control">
-      {{#if (eq @attr.options.editType "textarea")}}
-        {{! Text area }}
-        <textarea
-          data-test-input={{@attr.name}}
-          id={{@attr.name}}
-          value={{or (get @model this.valuePath) @attr.options.defaultValue}}
-          oninput={{this.onChangeWithEvent}}
-          class="textarea {{if this.validationError 'has-error-border'}}"
-        ></textarea>
-      {{else if (eq @attr.options.editType "password")}}
-        <Input
-          data-test-input={{@attr.name}}
-          @type="password"
-          @value={{get @model this.valuePath}}
-          name={{@attr.name}}
-          class="input"
-          {{! Prevents browsers from auto-filling }}
-          autocomplete="new-password"
-          spellcheck="false"
-        />
-      {{else if (eq @attr.options.editType "json")}}
-        {{! JSON Editor }}
-        {{#let (get @model this.valuePath) as |value|}}
-          <JsonEditor
+    {{else if (eq @attr.options.editType "ttl")}}
+      {{! TTL Picker }}
+      <div class="field">
+        {{#let (or (get @model this.valuePath) @attr.options.setDefault) as |initialValue|}}
+          <TtlPicker
             data-test-input={{@attr.name}}
-            @title={{this.labelString}}
-            @value={{if
-              value
-              (if (eq @attr.options.mode "ruby") value (stringify (jsonify value)))
-              @attr.options.defaultValue
-            }}
-            @valueUpdated={{fn this.codemirrorUpdated true}}
-            @theme={{or @attr.options.theme "hashi"}}
-            @helpText={{@attr.options.helpText}}
-            @mode={{@attr.options.mode}}
-            @example={{@attr.options.example}}
-          >
-            {{#if @attr.options.allowReset}}
-              <Hds::Button
-                @text="Clear"
-                @icon="reload"
-                class="toolbar-button"
-                disabled={{not value}}
-                {{on "click" this.setAndBroadcast}}
-                data-test-json-clear-button
-              />
-            {{/if}}
-          </JsonEditor>
+            class={{if this.validationError "ttl-picker-form-field-error"}}
+            @onChange={{this.setAndBroadcastTtl}}
+            @label={{this.labelString}}
+            @helperTextDisabled={{or @attr.options.helperTextDisabled "Vault will use the default lease duration."}}
+            @helperTextEnabled={{or @attr.options.helperTextEnabled "Lease will expire after"}}
+            @description={{@attr.helpText}}
+            @initialValue={{initialValue}}
+            @initialEnabled={{if (eq initialValue "0s") false initialValue}}
+            @hideToggle={{@attr.options.hideToggle}}
+          />
         {{/let}}
-        {{#if @attr.options.subText}}
-          <p class="sub-text">
-            {{@attr.options.subText}}
-            {{#if @attr.options.docLink}}
-              <DocLink @path={{@attr.options.docLink}}>
-                See our documentation
-              </DocLink>
-              for help.
+      </div>
+    {{else if (eq @attr.options.editType "regex")}}
+      {{! Regex Validated Input }}
+      <RegexValidator
+        @attr={{@attr}}
+        @labelString={{this.labelString}}
+        @value={{or (get @model this.valuePath) @attr.options.defaultValue}}
+        @onChange={{this.onChangeWithEvent}}
+      />
+    {{else if (eq @attr.options.editType "toggleButton")}}
+      {{! Togglable Input }}
+      <Toggle
+        @name="toggle-{{@attr.name}}"
+        @onChange={{this.toggleButton}}
+        @checked={{if @attr.options.isOppositeValue (not this.toggleInputEnabled) this.toggleInputEnabled}}
+        data-test-toggle={{@attr.name}}
+        disabled={{this.disabled}}
+        aria-describedby={{concat @attr.name "-helper-text"}}
+      >
+        <span class="has-text-weight-bold is-large">{{this.labelString}}</span><br />
+        <div class="description has-text-grey" data-test-toggle-subtext>
+          <span id={{concat @attr.name "-helper-text"}}>
+            {{#if this.toggleInputEnabled}}
+              {{if @attr.options.isOppositeValue @attr.options.helperTextDisabled @attr.options.helperTextEnabled}}
+            {{else}}
+              {{if @attr.options.isOppositeValue @attr.options.helperTextEnabled @attr.options.helperTextDisabled}}
             {{/if}}
-          </p>
+          </span>
+        </div>
+      </Toggle>
+    {{else if (eq @attr.options.editType "optionalText")}}
+      {{! Togglable Text Input }}
+      <Toggle
+        @name="show-{{@attr.name}}"
+        @onChange={{this.toggleTextShow}}
+        @checked={{this.showToggleTextInput}}
+        data-test-toggle={{@attr.name}}
+        aria-describedby={{concat @attr.name "-helper-text"}}
+      >
+        <span class="ttl-picker-label is-large" id={{concat @attr.name "-helper-text"}}>{{this.labelString}}</span><br />
+        <div class="description has-text-grey">
+          {{#if this.showToggleTextInput}}
+            <span>
+              {{@attr.options.subText}}
+              {{#if @attr.options.docLink}}
+                <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>
+                  See our documentation
+                </DocLink>
+                for help.
+              {{/if}}
+            </span>
+          {{else}}
+            <span>
+              {{or @attr.options.defaultSubText "Vault will use the engine default."}}
+              {{#if @attr.options.docLink}}
+                <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>
+                  See our documentation
+                </DocLink>
+                for help.
+              {{/if}}
+            </span>
+          {{/if}}
+        </div>
+        {{#if this.showToggleTextInput}}
+          <input
+            data-test-input={{@attr.name}}
+            id={{@attr.name}}
+            autocomplete="off"
+            spellcheck="false"
+            value={{or (get @model this.valuePath) @attr.options.defaultValue}}
+            onchange={{this.onChangeWithEvent}}
+            class="input"
+            maxLength={{@attr.options.characterLimit}}
+          />
         {{/if}}
-      {{else}}
-        {{! Regular Text Input }}
-        <input
-          data-test-input={{@attr.name}}
-          id={{@attr.name}}
-          readonly={{this.isReadOnly}}
-          disabled={{and @attr.options.editDisabled (not @model.isNew)}}
-          autocomplete="off"
-          spellcheck="false"
-          value={{get @model this.valuePath}}
-          {{on "change" this.onChangeWithEvent}}
-          {{on "input" this.onChangeWithEvent}}
-          {{on "keyup" this.handleKeyUp}}
-          class="input {{if this.validationError 'has-error-border'}}"
-          maxLength={{@attr.options.characterLimit}}
-        />
-      {{/if}}
-    </div>
-  {{else if (or (eq @attr.type "boolean") (eq @attr.options.editType "boolean"))}}
-    <div class="b-checkbox">
-      <input
-        disabled={{this.disabled}}
-        type="checkbox"
-        id={{@attr.name}}
-        class="styled"
-        checked={{get @model @attr.name}}
-        onchange={{this.onChangeWithEvent}}
+      </Toggle>
+    {{else if (eq @attr.options.editType "stringArray")}}
+      <StringList
+        class={{if this.validationError "string-list-form-field-error"}}
         data-test-input={{@attr.name}}
+        @label={{this.labelString}}
+        @helpText={{this.helpTextString}}
+        @inputValue={{get @model this.valuePath}}
+        @onChange={{this.setAndBroadcast}}
+        @attrName={{@attr.name}}
+        @subText="{{@attr.options.subText}} Add one item per row."
       />
-      <label for={{@attr.name}} class="is-label">
-        {{this.labelString}}
-        {{#if (and this.showHelpText @attr.options.helpText)}}
-          <InfoTooltip>{{@attr.options.helpText}}</InfoTooltip>
-        {{/if}}
-      </label>
-      {{#if @attr.options.subText}}
-        <p class="sub-text">
-          {{@attr.options.subText}}
-          {{#if @attr.options.docLink}}
-            <DocLink @path={{@attr.options.docLink}}>
-              Learn more here.
-            </DocLink>
+    {{else if (eq @attr.options.sensitive true)}}
+      <MaskedInput
+        @name={{@attr.name}}
+        @value={{or (get @model this.valuePath) @attr.options.defaultValue}}
+        @allowCopy={{if @attr.options.noCopy false true}}
+        @onChange={{this.setAndBroadcast}}
+        @onKeyUp={{@onKeyUp}}
+      />
+    {{else if (or (eq @attr.type "number") (eq @attr.type "string"))}}
+      <div class="control">
+        {{#if (eq @attr.options.editType "json")}}
+          {{! JSON Editor }}
+          {{#let (get @model this.valuePath) as |value|}}
+            <JsonEditor
+              data-test-input={{@attr.name}}
+              @title={{this.labelString}}
+              @value={{if
+                value
+                (if (eq @attr.options.mode "ruby") value (stringify (jsonify value)))
+                @attr.options.defaultValue
+              }}
+              @valueUpdated={{fn this.editorUpdated true}}
+              @helpText={{this.helpTextString}}
+              @mode={{@attr.options.mode}}
+              @example={{@attr.options.example}}
+              @onSetup={{fn (mut this.codemirrorEditor)}}
+            >
+              {{#if @attr.options.allowReset}}
+                <Hds::Button
+                  @text="Clear"
+                  @icon="reload"
+                  @color="secondary"
+                  disabled={{not value}}
+                  {{on "click" (fn this.editorUpdated true "")}}
+                  data-test-json-clear-button
+                />
+              {{/if}}
+            </JsonEditor>
+          {{/let}}
+          {{#if @attr.options.subText}}
+            <p class="sub-text">
+              {{@attr.options.subText}}
+              {{#if @attr.options.docLink}}
+                <DocLink @path={{@attr.options.docLink}} data-test-doc-link={{@attr.options.docLink}}>
+                  See our documentation
+                </DocLink>
+                for help.
+              {{/if}}
+            </p>
           {{/if}}
-        </p>
-      {{/if}}
-    </div>
-  {{else if (eq @attr.type "object")}}
-    <JsonEditor
-      @title={{this.labelString}}
-      @value={{if (get @model this.valuePath) (stringify (get @model this.valuePath)) this.emptyData}}
-      @valueUpdated={{fn this.codemirrorUpdated false}}
-      @helpText={{@attr.options.helpText}}
-      @example={{@attr.options.example}}
-    />
-  {{else if (eq @attr.options.editType "yield")}}
-    {{yield}}
-  {{/if}}
-  {{#if this.validationError}}
-    <AlertInline
-      @type="danger"
-      @message={{this.validationError}}
-      @paddingTop={{not-eq @attr.options.editType "ttl"}}
-      data-test-field-validation={{this.valuePath}}
-      class={{if (eq @attr.options.editType "stringArray") "has-top-margin-negative-xxl"}}
-    />
+        {{/if}}
+      </div>
+    {{else if (eq @attr.type "object")}}
+      <JsonEditor
+        @title={{this.labelString}}
+        @value={{if (get @model this.valuePath) (stringify (get @model this.valuePath)) this.emptyData}}
+        @valueUpdated={{fn this.editorUpdated false}}
+        @helpText={{this.helpTextString}}
+        @example={{@attr.options.example}}
+      />
+    {{else if (eq @attr.options.editType "yield")}}
+      {{yield}}
+    {{/if}}
+    {{#if this.validationError}}
+      <AlertInline
+        @type="danger"
+        @message={{this.validationError}}
+        @paddingTop={{not-eq @attr.options.editType "ttl"}}
+        data-test-validation-error={{this.valuePath}}
+        class={{if (eq @attr.options.editType "stringArray") "has-top-margin-negative-xxl"}}
+      />
+    {{/if}}
+    {{! ≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠ }}
+    {{!                NON-HDS COMPONENTS - END                  }}
+    {{! ≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠≠ }}
   {{/if}}
+  {{! ~~~~~~~~~~~~~~ COMMON PART - START ~~~~~~~~~~~~~~ }}
   {{#if this.validationWarning}}
     <AlertInline
       @type="warning"
@@ -388,4 +551,5 @@
       class={{if (and (not this.validationError) (eq @attr.options.editType "stringArray")) "has-top-margin-negative-xxl"}}
     />
   {{/if}}
+  {{! ~~~~~~~~~~~~~~ COMMON PART - END ~~~~~~~~~~~~~~ }}
 </div>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/form-field.js b/ui/lib/core/addon/components/form-field.js
index 0349d10ba26..8f4e7ce0376 100644
--- a/ui/lib/core/addon/components/form-field.js
+++ b/ui/lib/core/addon/components/form-field.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,48 +10,52 @@ import { capitalize } from 'vault/helpers/capitalize';
 import { humanize } from 'vault/helpers/humanize';
 import { dasherize } from 'vault/helpers/dasherize';
 import { assert } from '@ember/debug';
+import { addToArray } from 'vault/helpers/add-to-array';
+import { removeFromArray } from 'vault/helpers/remove-from-array';
+import { isEmpty } from '@ember/utils';
+import { presence } from 'vault/utils/forms/validators';
+import { get } from '@ember/object';
 
 /**
  * @module FormField
- * `FormField` components are field elements associated with a particular model.
+ * FormField components are field elements associated with a particular model.
+ * @description
+ * ```
+ * sample attr shape:
+ * attr = {
+ * name: "foo", // name of attribute -- used to populate various fields and pull value from model
+ * type: "boolean" // type of attribute value -- string, boolean, etc.
+ * options: {
+ *  label: "To do task", // custom label to be shown, otherwise attr.name will be displayed
+ *  defaultValue: "", // default value to display if model value is not present
+ *  fieldValue: "toDo", // used for value lookup on model over attr.name
+ *  editType: "boolean", type of field to use. List of editTypes:boolean, file, json, kv, optionalText, mountAccessor, password, radio, regex, searchSelect, stringArray, textarea, ttl, yield.
+ *  helpText: "This will be in a tooltip",
+ *  readOnly: true
+ *  },
+ * }
+ * ```
  *
  * @example
- * ```js
  * {{#each @model.fields as |attr|}}
- *  <FormField data-test-field @attr={{attr}} @model={{this.model}} />
+ *  <FormField data-test-field @attr={{attr}} @model={{@model}} />
  * {{/each}}
- * ```
- * example attr object:
- * attr = {
- *   name: "foo", // name of attribute -- used to populate various fields and pull value from model
- *   options: {
- *     label: "Foo", // custom label to be shown, otherwise attr.name will be displayed
- *     defaultValue: "", // default value to display if model value is not present
- *     fieldValue: "bar", // used for value lookup on model over attr.name
- *     editType: "ttl", type of field to use. List of editTypes:boolean, file, json, kv, optionalText, mountAccessor, password, radio, regex, searchSelect, stringArray, textarea, ttl, yield.
- *     helpText: "This will be in a tooltip",
- *     readOnly: true
- *   },
- *   type: "boolean" // type of attribute value -- string, boolean, etc.
- * }
+ * <FormField @attr={{hash name="toDo" options=(hash label="To do task" helpText="helpful text" editType="boolean")}} @model={{hash toDo=true}} />
+ *
  * @param {Object} attr - usually derived from ember model `attributes` lookup, and all members of `attr.options` are optional
  * @param {Model} model - Ember Data model that `attr` is defined on
  * @param {boolean} [disabled=false] - whether the field is disabled
  * @param {boolean} [showHelpText=true] - whether to show the tooltip with help text from OpenAPI
- * @param {string} [subText] - text to be displayed below the label
  * @param {string} [mode] - used when editType is 'kv'
- * @param {ModelValidations} [modelValidations] - Object of errors.  If attr.name is in object and has error message display in AlertInline.
- * @callback onChangeCallback
- * @param {onChangeCallback} [onChange] - called whenever a value on the model changes via the component
- * @callback onKeyUpCallback
- * @param {onKeyUpCallback} [onKeyUp] - function passed through into MaskedInput to handle validation. It is also handled for certain form-field types here in the action handleKeyUp.
+ * @param {object} [modelValidations] - Object of errors.  If attr.name is in object and has error message display in AlertInline.
+ * @param {function} [onChange] - called whenever a value on the model changes via the component
+ * @param {function} [onKeyUp] - function passed through into MaskedInput to handle validation. It is also handled for certain form-field types here in the action handleKeyUp.
  *
  */
 
 export default class FormFieldComponent extends Component {
   emptyData = '{\n}';
   shouldHideLabel = [
-    'boolean',
     'file',
     'json',
     'kv',
@@ -61,8 +65,13 @@ export default class FormFieldComponent extends Component {
     'searchSelect',
     'stringArray',
     'ttl',
+    'toggleButton',
   ];
-  @tracked showInput = false;
+  @tracked codemirrorEditor;
+  @tracked showToggleTextInput = false;
+  @tracked toggleInputEnabled = false;
+
+  radioValue = (item) => (isEmpty(item.value) ? item : item.value);
 
   constructor() {
     super(...arguments);
@@ -72,18 +81,75 @@ export default class FormFieldComponent extends Component {
       'Form is attempting to modify an ID. Ember-data does not allow this.',
       valuePath.toLowerCase() !== 'id'
     );
-    const modelValue = model[valuePath];
-    this.showInput = !!modelValue;
+    assert('@name is required', presence(attr.name));
+    assert('@model (or resource object being updated) is required', presence(model));
+    const modelValue = get(model, valuePath);
+    this.showToggleTextInput = !!modelValue;
+    this.toggleInputEnabled = !!modelValue;
+  }
+
+  // ---------------------------------------------------------------
+  // IMPORTANT:
+  // this controls the top-level logic in the associated template
+  // to decide which type of form field to render (Vault or HDS)
+  // ---------------------------------------------------------------
+  //
+  get isHdsFormField() {
+    const { type, options } = this.args.attr;
+
+    // here we replicate the logic in the `form-field.hbs` template, as it was at the beginning of the migation to HDS
+    // to make sure we don't change the order in which the "ifs" are evaluated
+    // see: https://github.com/hashicorp/vault/blob/e99c06a0249f1ecde02c5b48990cb0e91e4ec575/ui/lib/core/addon/components/form-field.hbs
+    if (options?.possibleValues?.length > 0) {
+      return true;
+    } else {
+      if (options?.editType === 'dateTimeLocal') {
+        return true;
+      } else if (
+        options?.editType === 'searchSelect' ||
+        options?.editType === 'mountAccessor' ||
+        options?.editType === 'kv' ||
+        options?.editType === 'file' ||
+        options?.editType === 'ttl' ||
+        options?.editType === 'regex' ||
+        options?.editType === 'toggleButton' ||
+        options?.editType === 'optionalText' ||
+        options?.editType === 'stringArray' ||
+        options?.sensitive === true
+      ) {
+        return false;
+      } else if (type === 'number' || type === 'string') {
+        if (options?.editType === 'textarea' || options?.editType === 'password') {
+          return true;
+        } else if (options?.editType === 'json') {
+          return false;
+        } else {
+          return true;
+        }
+      } else if (type === 'boolean' || options?.editType === 'boolean') {
+        return true;
+      } else if (type === 'object' || options?.editType === 'yield') {
+        return false;
+      } else {
+        // fallback, just in case
+        return false;
+      }
+    }
   }
 
   get hasRadioSubText() {
-    // for 'radio' editType, check to see if every of the possibleValues has a subText and label
+    // for 'radio' editType, check to see if any of the possibleValues has a subText
     return this.args?.attr?.options?.possibleValues?.any((v) => v.subText);
   }
 
+  get hasRadioHelpText() {
+    // for 'radio' editType, check to see if any of the possibleValues has a helpText
+    return this.args?.attr?.options?.possibleValues?.any((v) => v.helpText);
+  }
+
   get hideLabel() {
     const { type, options } = this.args.attr;
-    if (type === 'boolean' || type === 'object' || options?.isSectionHeader) {
+    if (type === 'object' || options?.isSectionHeader) {
       return true;
     }
     // falsey values render a <FormFieldLabel>
@@ -93,36 +159,37 @@ export default class FormFieldComponent extends Component {
   get disabled() {
     return this.args.disabled || false;
   }
-  get showHelpText() {
-    return this.args.showHelpText === false ? false : true;
-  }
-  get subText() {
-    return this.args.subText || '';
+
+  get helpTextString() {
+    const helpText = this.args.attr?.options?.helpText;
+    if (this.args.showHelpText !== false && helpText) {
+      return helpText;
+    }
+    return '';
   }
+
   // used in the label element next to the form element
   get labelString() {
     const label = this.args.attr.options?.label || '';
-    if (label) {
-      return label;
-    }
-    if (this.args.attr.name) {
-      return capitalize([humanize([dasherize([this.args.attr.name])])]);
-    }
-    return '';
+    return label ? label : capitalize([humanize([dasherize([this.args.attr.name])])]);
   }
+
   // both the path to mutate on the model, and the path to read the value from
   get valuePath() {
     return this.args.attr.options?.fieldValue || this.args.attr.name;
   }
+
   get isReadOnly() {
     const readonly = this.args.attr.options?.readOnly || false;
     return readonly && this.args.mode === 'edit';
   }
+
   get validationError() {
     const validations = this.args.modelValidations || {};
     const state = validations[this.valuePath];
     return state && !state.isValid ? state.errors.join(' ') : null;
   }
+
   get validationWarning() {
     const validations = this.args.modelValidations || {};
     const state = validations[this.valuePath];
@@ -153,31 +220,66 @@ export default class FormFieldComponent extends Component {
     this.setAndBroadcast(valueToSet);
   }
   @action
+  setAndBroadcastChecklist(event) {
+    let updatedValue = this.args.model[this.valuePath];
+    if (event.target.checked) {
+      updatedValue = addToArray(updatedValue, event.target.value);
+    } else {
+      updatedValue = removeFromArray(updatedValue, event.target.value);
+    }
+    this.setAndBroadcast(updatedValue);
+  }
+  @action
+  setAndBroadcastRadio(item) {
+    // we want to read the original value instead of `event.target.value` so we have `false` (boolean) and not `"false"` (string)
+    const valueToSet = this.radioValue(item);
+    this.setAndBroadcast(valueToSet);
+  }
+  @action
   setAndBroadcastTtl(value) {
     const alwaysSendValue = this.valuePath === 'expiry' || this.valuePath === 'safetyBuffer';
-    const valueToSet = value.enabled === true || alwaysSendValue ? `${value.seconds}s` : 0;
+    const attrOptions = this.args.attr.options || {};
+    let valueToSet = 0;
+    if (value.enabled || alwaysSendValue) {
+      valueToSet = `${value.seconds}s`;
+    } else if (Object.keys(attrOptions).includes('ttlOffValue')) {
+      valueToSet = attrOptions.ttlOffValue;
+    }
     this.setAndBroadcast(`${valueToSet}`);
   }
   @action
-  codemirrorUpdated(isString, value, codemirror) {
-    codemirror.performLint();
-    const hasErrors = codemirror.state.lint.marked.length > 0;
-    const valToSet = isString ? value : JSON.parse(value);
-
-    if (!hasErrors) {
+  editorUpdated(isString, value) {
+    try {
+      const valToSet = isString ? value : JSON.parse(value);
       this.args.model.set(this.valuePath, valToSet);
       this.onChange(this.valuePath, valToSet);
+
+      // Clicking "Clear" passes an empty string as the value and in that case we must manually reset the editor.
+      // At this time `allowReset` is only passed when `isString` is true.
+      if (value === '' && this.args.attr.options.allowReset && isString) {
+        this.codemirrorEditor.dispatch({
+          changes: [{ from: 0, to: this.codemirrorEditor.state.doc.length, insert: '' }],
+        });
+      }
+    } catch {
+      // if the value is not valid JSON, we don't want to set it on the model
     }
   }
+
   @action
-  toggleShow() {
-    const value = !this.showInput;
-    this.showInput = value;
+  toggleTextShow() {
+    const value = !this.showToggleTextInput;
+    this.showToggleTextInput = value;
     if (!value) {
       this.setAndBroadcast(null);
     }
   }
   @action
+  toggleButton() {
+    this.toggleInputEnabled = !this.toggleInputEnabled;
+    this.setAndBroadcast(this.toggleInputEnabled);
+  }
+  @action
   handleKeyUp(maybeEvent) {
     const value = typeof maybeEvent === 'object' ? maybeEvent.target.value : maybeEvent;
     if (!this.args.onKeyUp) {
@@ -190,12 +292,4 @@ export default class FormFieldComponent extends Component {
     const prop = event.target.type === 'checkbox' ? 'checked' : 'value';
     this.setAndBroadcast(event.target[prop]);
   }
-
-  @action
-  handleChecklist(event) {
-    const valueArray = this.args.model[this.valuePath];
-    const method = event.target.checked ? 'addObject' : 'removeObject';
-    valueArray[method](event.target.value);
-    this.setAndBroadcast(valueArray);
-  }
 }
diff --git a/ui/lib/core/addon/components/form-save-buttons.hbs b/ui/lib/core/addon/components/form-save-buttons.hbs
index 7bcc3fe1ee8..c14f9556232 100644
--- a/ui/lib/core/addon/components/form-save-buttons.hbs
+++ b/ui/lib/core/addon/components/form-save-buttons.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="field is-fullwidth box is-bottomless {{if (eq @includeBox false) 'is-shadowless'}}">
   <Hds::ButtonSet>
@@ -9,7 +9,7 @@
       @text={{or @saveButtonText "Save"}}
       @icon={{if @isSaving "loading"}}
       type="submit"
-      data-test-edit-form-submit
+      data-test-submit
       disabled={{@isSaving}}
     />
     {{#if this.cancelLink}}
@@ -21,12 +21,7 @@
       />
     {{/if}}
     {{#if @onCancel}}
-      <Hds::Button
-        @text={{or @cancelButtonText "Cancel"}}
-        @color="secondary"
-        {{on "click" @onCancel}}
-        data-test-cancel-button
-      />
+      <Hds::Button @text={{or @cancelButtonText "Cancel"}} @color="secondary" {{on "click" @onCancel}} data-test-cancel />
     {{/if}}
   </Hds::ButtonSet>
   {{yield to="error"}}
diff --git a/ui/lib/core/addon/components/form-save-buttons.js b/ui/lib/core/addon/components/form-save-buttons.js
index a5029c1f6df..05a2eeb0146 100644
--- a/ui/lib/core/addon/components/form-save-buttons.js
+++ b/ui/lib/core/addon/components/form-save-buttons.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,19 +11,16 @@ import Component from '@glimmer/component';
  * To show an overall inline error message, use the :error yielded block like shown below.
  *
  * @example
- * ```js
- * <FormSaveButtons @saveButtonText="Save" @isSaving={{isSaving}} @cancelLinkParams={{array
- * "foo.route"}}>
+ * <FormSaveButtons @saveButtonText="Save" @isSaving={{false}} @cancelLinkParams={{array "vault"}}>
  *   <:error>This is an error</:error>
  * </FormSaveButtons>
- * ```
  *
- * @param [saveButtonText="Save" {String}] - The text that will be rendered on the Save button.
- * @param [cancelButtonText="Cancel" {String}] - The text that will be rendered on the Cancel button.
- * @param [isSaving=false {Boolean}] - If the form is saving, this should be true. This will disable the save button and render a spinner on it;
- * @param [cancelLinkParams=[] {Array}] - An array of arguments used to construct a link to navigate back to when the Cancel button is clicked.
- * @param [onCancel=null {Function}] - If the form should call an action on cancel instead of route somewhere, the function can be passed using onCancel instead of passing an array to cancelLinkParams.
- * @param [includeBox=true {Boolean}] - By default we include padding around the form with underlines. Passing this value as false will remove that padding.
+ * @param {string} [saveButtonText=Save] - The text that will be rendered on the Save button.
+ * @param {string} [cancelButtonText=Cancel] - The text that will be rendered on the Cancel button.
+ * @param {boolean} [isSaving=false] - If the form is saving, this should be true. This will disable the save button and render a spinner on it;
+ * @param {array} [cancelLinkParams] - An array of arguments used to construct a link to navigate back to when the Cancel button is clicked.
+ * @param {function} [onCancel=null] - If the form should call an action on cancel instead of route somewhere, the function can be passed using onCancel instead of passing an array to cancelLinkParams.
+ * @param {boolean} [includeBox=true] - By default we include padding around the form with underlines. Passing this value as false will remove that padding.
  *
  */
 
diff --git a/ui/lib/core/addon/components/icon.hbs b/ui/lib/core/addon/components/icon.hbs
index 62dd19dfbfe..150feee97c2 100644
--- a/ui/lib/core/addon/components/icon.hbs
+++ b/ui/lib/core/addon/components/icon.hbs
@@ -1,12 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-{{#if this.isFlightIcon}}
-  <FlightIcon @name={{@name}} @size={{this.size}} @stretched={{@stretched}} ...attributes />
-{{else}}
-  <span class="hs-icon {{this.hsIconClass}}" aria-hidden="true" ...attributes>
-    {{svg-jar @name}}
-  </span>
-{{/if}}
\ No newline at end of file
+<Hds::Icon @name={{@name}} @size={{(or @size "16")}} @stretched={{@stretched}} @isInline={{true}} ...attributes />
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/icon.js b/ui/lib/core/addon/components/icon.js
index 3b86a40e75a..f09f99ed493 100644
--- a/ui/lib/core/addon/components/icon.js
+++ b/ui/lib/core/addon/components/icon.js
@@ -1,12 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { assert } from '@ember/debug';
-import flightIconMap from '@hashicorp/flight-icons/catalog.json';
-const flightIconNames = flightIconMap.assets.map((asset) => asset.iconName).uniq();
 
 /**
  * @module Icon
@@ -16,31 +14,21 @@ const flightIconNames = flightIconMap.assets.map((asset) => asset.iconName).uniq
  * Flight icon library at https://helios.hashicorp.design/icons/library
  *
  * @example
- * ```js
- * <Icon @name="x-square" @size="24" />
- * ```
+ * <Icon @name="heart" @size="24" />
+ *
  * @param {string} name - The name of the SVG to render inline. Required.
  * @param {string} [size=16] - size for flight icon, can be 16 or 24
  *
  */
 
-export default class Icon extends Component {
+// TODO - deprecate and remove this after migrating all `<Icon />` instances to `<Hds::Icon />`
+export default class IconComponent extends Component {
   constructor(owner, args) {
     super(owner, args);
-    assert('Icon component size argument must be either "16" or "24"', ['16', '24'].includes(this.size));
-    assert('Icon name argument must be provided', this.args.name);
-  }
 
-  get size() {
-    return this.args.size || '16';
-  }
-
-  // favor flight icon set and fall back to structure icons if not found
-  get isFlightIcon() {
-    return this.args.name ? flightIconNames.includes(this.args.name) : false;
-  }
+    const { name, size = '16' } = args;
 
-  get hsIconClass() {
-    return this.size === '24' ? 'hs-icon-xlm' : 'hs-icon-l';
+    assert('Icon component size argument must be either "16" or "24"', ['16', '24'].includes(size));
+    assert('Icon name argument must be provided', name);
   }
 }
diff --git a/ui/lib/core/addon/components/info-table-item-array.hbs b/ui/lib/core/addon/components/info-table-item-array.hbs
index 24766aeaec0..17514eb6697 100644
--- a/ui/lib/core/addon/components/info-table-item-array.hbs
+++ b/ui/lib/core/addon/components/info-table-item-array.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! the class linked-block-item is needed for the read-more component }}
 <div data-test-info-table-item-array {{did-insert this.fetchOptions}} class="linked-block-item">
@@ -13,10 +13,12 @@
             {{#if (is-wildcard-string item)}}
               {{#let (filter-wildcard item this.allOptions) as |wildcardCount|}}
                 <span>{{item}}</span>
-                <span class="tag is-light has-text-grey-dark" data-test-count={{wildcardCount}}>
-                  {{if (not-eq wildcardCount undefined) (concat "includes " wildcardCount)}}
-                  {{if (eq wildcardCount 1) @wildcardLabel (pluralize @wildcardLabel)}}
-                </span>
+                {{#if (not-eq wildcardCount undefined)}}
+                  <Hds::Badge
+                    @text="includes {{pluralize wildcardCount this.wildcardLabel}}"
+                    data-test-count={{wildcardCount}}
+                  />
+                {{/if}}
                 {{#if (eq this.displayArrayTruncated.lastObject item)}}
                   <LinkTo @route={{this.rootRoute}} @query={{hash tab=@queryParam}}>
                     <span data-test-view-all={{lowercase @label}}>View all {{lowercase @label}}.</span>
diff --git a/ui/lib/core/addon/components/info-table-item-array.js b/ui/lib/core/addon/components/info-table-item-array.js
index b79afe102a8..6e3effbd211 100644
--- a/ui/lib/core/addon/components/info-table-item-array.js
+++ b/ui/lib/core/addon/components/info-table-item-array.js
@@ -1,12 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
-import { tracked } from '@glimmer/tracking';
-import { service } from '@ember/service';
+import { assert } from '@ember/debug';
 import { action } from '@ember/object';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
 
 /**
  * @module InfoTableItemArray
@@ -17,23 +18,13 @@ import { action } from '@ember/object';
  * return a wildcard count similar to what is done in the searchSelect component.
  *
  * @example
- * ```js
- * <InfoTableItemArray
- * @label="Roles"
- * @displayArray={{['test-1','test-2','test-3']}}
- * @isLink={{true}}
- * @rootRoute="vault.cluster.secrets.backend.list-root"
- * @itemRoute="vault.cluster.secrets.backend.show"
- * @modelType="transform/role"
- * @queryParam="role"
- * @backend="transform"
- * ```
+ * <InfoTableItemArray @label="Roles" @displayArray={{array "test-1" "test-2" "test-3"}}  />
  *
- * @param {string} label - used to render lowercased display text for "View all <label>."
- * @param {array} displayArray - The array of data to be displayed. (In InfoTableRow this comes from the @value arg.) If the array length > 10, and @doNotTruncate is false only 5 will show with a count of the number hidden.
+ * @param {string} label - used to render lowercased display text for "View all [label]."
+ * @param {array} displayArray - The array of data to be displayed. (In InfoTableRow this comes from the `@value` arg.) If the array length > 10, and `@doNotTruncate` is false only 5 will show with a count of the number hidden.
  * @param {boolean} [isLink]  - Indicates if the item should contain a link-to component.  Only setup for arrays, but this could be changed if needed.
- * @param {string || array} [rootRoute="vault.cluster.secrets.backend.list-root"] -  Tells what route the link should go to when selecting "view all". If the route requires more than one dynamic param, insert an array.
- * @param {string || array} [itemRoute=vault.cluster.secrets.backend.show] - Tells what route the link should go to when selecting the individual item. If the route requires more than one dynamic param, insert an array.
+ * @param {string | array} [rootRoute=vault.cluster.secrets.backend.list-root] -  Tells what route the link should go to when selecting "view all". If the route requires more than one dynamic param, insert an array.
+ * @param {string | array} [itemRoute=vault.cluster.secrets.backend.show] - Tells what route the link should go to when selecting the individual item. If the route requires more than one dynamic param, insert an array.
  * @param {string} [modelType]  - Tells which model you want to query and set allOptions.  Used in conjunction with the the isLink.
  * @param {string} [wildcardLabel]  - when you want the component to return a count on the model for options returned when using a wildcard you must provide a label of the count e.g. role.  Should be singular.
  * @param {string} [backend] - To specify which backend to point the link to.
@@ -46,6 +37,11 @@ export default class InfoTableItemArray extends Component {
   @tracked itemNameById; // object is only created if renderItemName=true
   @tracked fetchComplete = false;
 
+  constructor() {
+    super(...arguments);
+    assert('@label is required for InfoTableItemArray components', this.args.label);
+  }
+
   get rootRoute() {
     return this.args.rootRoute || 'vault.cluster.secrets.backend.list-root';
   }
@@ -68,6 +64,10 @@ export default class InfoTableItemArray extends Component {
     return displayArray;
   }
 
+  get wildcardLabel() {
+    return this.args.wildcardLabel || '';
+  }
+
   @action async fetchOptions() {
     if (this.args.isLink && this.args.modelType) {
       const queryOptions = this.args.backend ? { backend: this.args.backend } : {};
diff --git a/ui/lib/core/addon/components/info-table-row.hbs b/ui/lib/core/addon/components/info-table-row.hbs
index 7850fdf73e1..8f4574af661 100644
--- a/ui/lib/core/addon/components/info-table-row.hbs
+++ b/ui/lib/core/addon/components/info-table-row.hbs
@@ -1,27 +1,22 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if (or (has-block) this.isVisible)}}
   <div class="info-table-row" data-test-component="info-table-row" ...attributes>
-    <div
-      class="column {{or @labelWidth 'is-one-quarter'}} {{if this.hasLabelOverflow 'label-overflow'}}"
-      data-test-label-div
-      {{did-insert this.calculateLabelOverflow}}
-    >
+    {{! label section of the row }}
+    <div class="column {{or @labelWidth 'is-one-quarter'}}" {{did-insert this.calculateLabelOverflow}}>
       {{#if @label}}
         {{#if this.hasLabelOverflow}}
-          <ToolTip @verticalPosition="below" @horizontalPosition="left" as |T|>
-            <T.Trigger @tabindex={{false}}>
-              <span class="is-label has-text-grey-dark" data-test-row-label={{@label}}>{{@label}}</span>
-            </T.Trigger>
-            <T.Content @defaultClass="tool-tip">
-              <div class="box fit-content" data-test-label-tooltip>
-                {{@label}}
-              </div>
-            </T.Content>
-          </ToolTip>
+          <Hds::TooltipButton
+            @text={{@label}}
+            aria-label="Full label"
+            data-test-tooltip="info table row"
+            class="label-overflow"
+          >
+            <span class="is-label has-text-grey-dark" data-test-row-label={{@label}}>{{@label}}</span>
+          </Hds::TooltipButton>
         {{else}}
           <span class="is-label has-text-grey-dark" data-test-row-label={{@label}}>{{@label}}</span>
         {{/if}}
@@ -34,17 +29,18 @@
         <Icon @name="minus" />
       {{/if}}
     </div>
-    <div class="column is-flex-center {{if @truncateValue 'is-two-thirds'}}" data-test-value-div={{@label}}>
+    {{! value section of the row }}
+    <div class="column is-flex-center {{if @truncateValue 'is-two-thirds'}}" data-test-row-value={{@label}}>
       {{#if @addCopyButton}}
         <Hds::Copy::Button
           @text="Copy"
           @isIconOnly={{true}}
           @textToCopy={{@value}}
           @onError={{(fn
-            (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
+            (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
           )}}
           class="transparent has-padding-xxs"
-          data-test-copy-button={{@value}}
+          data-test-copy-button
         />
       {{/if}}
       {{#if (has-block)}}
@@ -85,30 +81,9 @@
           />
         {{else}}
           {{#if @tooltipText}}
-            <ToolTip @verticalPosition="above" @horizontalPosition="left" as |T|>
-              <T.Trigger @tabindex={{false}}>
-                <span class="is-word-break has-text-black" data-test-row-value={{@label}}>{{@value}}</span>
-              </T.Trigger>
-              <T.Content @defaultClass="tool-tip">
-                <div class="box is-flex-center">
-                  {{@tooltipText}}
-                  {{#if @isTooltipCopyable}}
-                    <Hds::Copy::Button
-                      @text="Copy"
-                      @isIconOnly={{true}}
-                      @textToCopy={{@tooltipText}}
-                      @onError={{(fn
-                        (set-flash-message
-                          "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger"
-                        )
-                      )}}
-                      class="transparent white-icon"
-                      data-test-tooltip-copy={{@tooltipText}}
-                    />
-                  {{/if}}
-                </div>
-              </T.Content>
-            </ToolTip>
+            <Hds::TooltipButton @text={{@tooltipText}} aria-label="More information" data-test-tooltip="info table row">
+              <span class="is-word-break has-text-black" data-test-row-value={{@label}}>{{@value}}</span>
+            </Hds::TooltipButton>
           {{else}}
             <span class="is-word-break has-text-black" data-test-row-value={{@label}}>{{@value}}</span>
           {{/if}}
diff --git a/ui/lib/core/addon/components/info-table-row.js b/ui/lib/core/addon/components/info-table-row.js
index b16464ead1e..a16cc1f792a 100644
--- a/ui/lib/core/addon/components/info-table-row.js
+++ b/ui/lib/core/addon/components/info-table-row.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,9 +14,7 @@ import { action } from '@ember/object';
  * that the value breaks under the label on smaller viewports.
  *
  * @example
- * ```js
  * <InfoTableRow @value={{5}} @label="TTL" @helperText="Some description"/>
- * ```
  *
  * @param {string} label=null - The display name for the value.
  * @param {string} helperText=null - Text to describe the value displayed beneath the label.
@@ -25,11 +23,10 @@ import { action } from '@ember/object';
  * @param {boolean} [truncateValue=false] - Indicates if the value should be truncated.
  * @param {string} [defaultShown] - Text that renders as value if alwaysRender=true. Eg. "Vault default"
  * @param {string} [tooltipText] - Text if a tooltip should display over the value.
- * @param {boolean} [isTooltipCopyable]  - Allows tooltip click to copy
  * @param {string} [formatDate] - A string of the desired date format that's passed to the date-format helper to render timestamps (ex. "MMM d yyyy, h:mm:ss aaa", see: https://date-fns.org/v2.30.0/docs/format)
  * @param {boolean} [formatTtl=false] - When true, value is passed to the format-duration helper, useful for TTL values
  * @param {string} [type=array] - The type of value being passed in.  This is used for when you want to trim an array.  For example, if you have an array value that can equal length 15+ this will trim to show 5 and count how many more are there
- * * InfoTableItemArray *
+ *
  * @param {boolean} [isLink=true] - Passed through to InfoTableItemArray. Indicates if the item should contain a link-to component.  Only setup for arrays, but this could be changed if needed.
  * @param {string} [modelType=null] - Passed through to InfoTableItemArray. Tells what model you want data for the allOptions to be returned from.  Used in conjunction with the the isLink.
  * @param {string} [queryParam] - Passed through to InfoTableItemArray. If you want to specific a tab for the View All XX to display to.  Ex= role
diff --git a/ui/lib/core/addon/components/info-tooltip.hbs b/ui/lib/core/addon/components/info-tooltip.hbs
deleted file mode 100644
index 2fa6bac42b9..00000000000
--- a/ui/lib/core/addon/components/info-tooltip.hbs
+++ /dev/null
@@ -1,30 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<span class="is-inline-block" data-test-component="info-tooltip" data-test-tooltip>
-  <ToolTip
-    @verticalPosition={{or @verticalPosition "below"}}
-    @horizontalPosition={{or @horizontalPosition "auto-right"}}
-    data-test-component="info-tooltip"
-    data-test-tooltip
-    as |d|
-  >
-    <d.Trigger
-      @htmlTag="button"
-      @type="button"
-      class="tool-tip-trigger button is-ghost is-compact"
-      data-test-tool-tip-trigger={{true}}
-      {{on "click" this.preventSubmit}}
-      aria-label="help"
-    >
-      <Icon @name="info" class="auto-width" />
-    </d.Trigger>
-    <d.Content @defaultClass="tool-tip">
-      <div class="box" data-test-info-tooltip-content>
-        {{yield}}
-      </div>
-    </d.Content>
-  </ToolTip>
-</span>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/info-tooltip.js b/ui/lib/core/addon/components/info-tooltip.js
deleted file mode 100644
index 231afef94b6..00000000000
--- a/ui/lib/core/addon/components/info-tooltip.js
+++ /dev/null
@@ -1,27 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-
-/**
- * @module JsonEditor
- *
- * @example
- * ```js
- * <JsonEditor @title="Policy" @value={{codemirror.string}} @valueUpdated={{ action "codemirrorUpdate"}} />
- * ```
- *
- * @param {string} [verticalPosition] - vertical position specification (above, below)
- * @param {string} [horizontalPosition] - horizontal position specification (center, auto-right)
-
- */
-
-export default class InfoTooltip extends Component {
-  @action
-  preventSubmit(e) {
-    e.preventDefault();
-  }
-}
diff --git a/ui/lib/core/addon/components/input-search.hbs b/ui/lib/core/addon/components/input-search.hbs
index 2de6ad0c66a..da5e63120bc 100644
--- a/ui/lib/core/addon/components/input-search.hbs
+++ b/ui/lib/core/addon/components/input-search.hbs
@@ -1,24 +1,24 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<div class="field is-grouped" ...attributes>
-  <div class="control is-expanded">
+<div class="field" ...attributes>
+  <Hds::Form::TextInput::Field
+    @type="text"
+    @id={{@id}}
+    @value={{this.searchInput}}
+    {{on "keyup" this.inputChanged}}
+    placeholder={{@placeholder}}
+    autocomplete="off"
+    data-test-input-search={{@id}}
+    as |F|
+  >
     {{#if @label}}
-      <label for={{@id}} class="is-label">{{@label}}</label>
+      <F.Label>{{@label}}</F.Label>
     {{/if}}
     {{#if @subText}}
-      <p class="sub-text">{{@subText}}</p>
+      <F.HelperText>{{@subText}}</F.HelperText>
     {{/if}}
-    <Input
-      id={{@id}}
-      class="input"
-      @type="text"
-      @value={{this.searchInput}}
-      {{on "keyup" this.inputChanged}}
-      placeholder={{@placeholder}}
-      autocomplete="off"
-    />
-  </div>
+  </Hds::Form::TextInput::Field>
 </div>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/input-search.js b/ui/lib/core/addon/components/input-search.js
index db37120015b..2c4431ab9a3 100644
--- a/ui/lib/core/addon/components/input-search.js
+++ b/ui/lib/core/addon/components/input-search.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,11 +12,8 @@ import { tracked } from '@glimmer/tracking';
  * This component renders an input that fires a callback on "keyup" containing the input's value
  *
  * @example
- * <InputSearch
- * @initialValue="secret/path/"
- * @onChange={{this.handleSearch}}
- * @placeholder="search..."
- * />
+ * <InputSearch @initialValue="secret/path/" @onChange={{this.handleSearch}} @placeholder="search..." />
+ *
  * @param {string} [id] - unique id for the input
  * @param {string} [initialValue] - initial search value, i.e. a secret path prefix, that pre-fills the input field
  * @param {string} [placeholder] - placeholder text for the input
@@ -40,7 +37,7 @@ export default class InputSearch extends Component {
   }
 
   @action
-  inputChanged() {
-    this.args.onChange(this.searchInput);
+  inputChanged(event) {
+    this.args.onChange(event.target.value);
   }
 }
diff --git a/ui/lib/core/addon/components/json-editor.hbs b/ui/lib/core/addon/components/json-editor.hbs
index b357b9cd74a..91df33428d7 100644
--- a/ui/lib/core/addon/components/json-editor.hbs
+++ b/ui/lib/core/addon/components/json-editor.hbs
@@ -1,23 +1,56 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
-
+}}
 <div ...attributes>
-  {{#if this.getShowToolbar}}
-    <div data-test-component="json-editor-toolbar">
-      <Toolbar aria-label="items for managing JSON editor for {{@title}}">
-        <label id="json-editor-title" class="has-text-weight-bold" data-test-component="json-editor-title">
+  {{#if @readOnly}}
+    <Hds::CodeBlock @hasCopyButton={{true}} @language={{@mode}} @value={{or @value @example}} as |CB|>
+      {{#if @title}}
+        <CB.Title data-test-component="json-editor-title">
           {{@title}}
-          {{#if @subTitle}}
-            <span class="is-size-9 is-lowercase has-text-grey-light">({{@subTitle}})</span>
-          {{/if}}
-        </label>
-        <ToolbarActions aria-label="actions for {{@title}} JSON editor">
+        </CB.Title>
+      {{/if}}
+
+      {{#if @helpText}}
+        <CB.Description>
+          {{@helpText}}
+        </CB.Description>
+      {{/if}}
+    </Hds::CodeBlock>
+  {{else}}
+    <Hds::CodeEditor
+      data-test-component="code-mirror-modifier"
+      @ariaLabel={{this.ariaLabel}}
+      @extraKeys={{@extraKeys}}
+      @hasCopyButton={{true}}
+      @language={{this.mode}}
+      @isLintingEnabled={{eq this.mode "json"}}
+      @value={{or @value @example}}
+      @onBlur={{@onBlur}}
+      @onInput={{@valueUpdated}}
+      @onLint={{@onLint}}
+      @onSetup={{this.onSetup}}
+      as |CE|
+    >
+      {{#if this.getShowToolbar}}
+        {{#if @title}}
+          <CE.Title data-test-component="json-editor-title">
+            {{@title}}
+          </CE.Title>
+        {{/if}}
+
+        {{#if @helpText}}
+          <CE.Description>
+            {{@helpText}}
+          </CE.Description>
+        {{/if}}
+
+        <CE.Generic>
           {{yield}}
+
           {{#if @example}}
             <Hds::Button
-              class="toolbar-button"
+              @color="secondary"
               @icon="reload"
               @text="Restore example"
               disabled={{not @value}}
@@ -25,52 +58,8 @@
               data-test-restore-example
             />
           {{/if}}
-          {{#if (and @allowObscure @readOnly)}}
-            {{! For safety we only use obscured values in readonly mode }}
-            <div>
-              <Toggle @name="revealValues" @checked={{this.revealValues}} @onChange={{fn (mut this.revealValues)}}>
-                <span class="has-text-grey">Reveal values</span>
-              </Toggle>
-            </div>
-          {{/if}}
-          <div class="toolbar-separator"></div>
-          <Hds::Copy::Button
-            @container={{@container}}
-            @text="Copy"
-            @isIconOnly={{true}}
-            @textToCopy={{@value}}
-            @onError={{(fn
-              (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-            )}}
-            class="transparent"
-            data-test-copy-button={{@value}}
-          />
-        </ToolbarActions>
-      </Toolbar>
-    </div>
-  {{/if}}
-  <div
-    {{code-mirror
-      content=(if this.showObfuscatedData this.obfuscatedData (or @value @example))
-      extraKeys=@extraKeys
-      gutters=@gutters
-      lineNumbers=(if @readOnly false true)
-      mode=@mode
-      readOnly=@readOnly
-      theme=@theme
-      viewportMarg=@viewportMargin
-      onSetup=this.onSetup
-      onUpdate=this.onUpdate
-      onFocus=this.onFocus
-      autoRefresh=(if @container true false)
-    }}
-    class={{if @readOnly "readonly-codemirror"}}
-    data-test-component="code-mirror-modifier"
-  ></div>
-
-  {{#if @helpText}}
-    <div class="box is-shadowless is-fullwidth has-short-padding">
-      <p class="sub-text">{{@helpText}}</p>
-    </div>
+        </CE.Generic>
+      {{/if}}
+    </Hds::CodeEditor>
   {{/if}}
 </div>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/json-editor.js b/ui/lib/core/addon/components/json-editor.js
index f924b5983a7..74e9788690c 100644
--- a/ui/lib/core/addon/components/json-editor.js
+++ b/ui/lib/core/addon/components/json-editor.js
@@ -1,78 +1,80 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { action } from '@ember/object';
-import { tracked } from '@glimmer/tracking';
-import { stringify } from 'core/helpers/stringify';
-import { obfuscateData } from 'core/utils/advanced-secret';
+import { assert } from '@ember/debug';
 
 /**
  * @module JsonEditor
  *
  * @example
- * ```js
- * <JsonEditor @title="Policy" @value={{codemirror.string}} @valueUpdated={{ action "codemirrorUpdate"}} />
- * ```
+ * <JsonEditor @title="Policy" @value={{hash foo="bar"}} @viewportMargin={{100}} />
  *
  * @param {string} [title] - Name above codemirror view
- * @param {string} value - a specific string the comes from codemirror. It's the value inside the codemirror display
+ * @param {string} [value] - a specific string the comes from codemirror. It's the value inside the codemirror display
  * @param {Function} [valueUpdated] - action to preform when you edit the codemirror value.
- * @param {Function} [onFocusOut] - action to preform when you focus out of codemirror.
+ * @param {Function} [onBlur] - action to preform when you focus out of codemirror.
  * @param {string} [helpText] - helper text.
  * @param {Object} [extraKeys] - Provides keyboard shortcut methods for things like saving on shift + enter.
- * @param {Array} [gutters] - An array of CSS class names or class name / CSS string pairs, each of which defines a width (and optionally a background), and which will be used to draw the background of the gutters.
- * @param {string} [mode] - The mode defined for styling. Right now we only import ruby so mode must but be ruby or defaults to javascript. If you wanted another language you need to import it into the modifier.
+ * @param {string} [mode] - The mode defined for styling
  * @param {Boolean} [readOnly] - Sets the view to readOnly, allowing for copying but no editing. It also hides the cursor. Defaults to false.
- * @param {String} [theme] - Specify or customize the look via a named "theme" class in scss.
  * @param {String} [value] - Value within the display. Generally, a json string.
- * @param {String} [viewportMargin] - Size of viewport. Often set to "Infinity" to load/show all text regardless of length.
  * @param {string} [example] - Example to show when value is null -- when example is provided a restore action will render in the toolbar to clear the current value and show the example after input
- * * REQUIRED if rendering within a modal *
- * @container gives context for the <Hd::Copy::Button> and sets autoRefresh=true so JsonEditor renders content (without this property @value only renders if editor is focused)
- * @param {string} [container] - Selector string or element object of containing element, set the focused element as the container value. This is for the Hds::Copy::Button and to set autoRefresh=true so content renders https://hds-website-hashicorp.vercel.app/components/copy/button?tab=code
+ * @param {Function} [onSetup] - action to preform when the codemirror editor is setup.
+ * @param {Function} [onRestoreExample] - override callback to customize  "Restore example" behavior. Default behavior is to reset @value to `null`
  *
  */
 
 export default class JsonEditorComponent extends Component {
-  @tracked revealValues = false;
-  get getShowToolbar() {
-    return this.args.showToolbar === false ? false : true;
-  }
+  _codemirrorEditor = null;
 
-  get showObfuscatedData() {
-    return this.args.readOnly && this.args.allowObscure && !this.revealValues;
+  constructor() {
+    super(...arguments);
+
+    const hasValueUpdated = !this.args.readOnly ? !!this.args.valueUpdated : true;
+    assert('@valueUpdated callback is required when component is not @readOnly', hasValueUpdated);
   }
-  get obfuscatedData() {
-    return stringify([obfuscateData(JSON.parse(this.args.value))], {});
+
+  get mode() {
+    return this.args.mode ?? 'json';
   }
 
-  @action
-  onSetup(editor) {
-    // store reference to codemirror editor so that it can be passed to valueUpdated when restoring example
-    this._codemirrorEditor = editor;
+  get getShowToolbar() {
+    return this.args.showToolbar ?? true;
   }
 
-  @action
-  onUpdate(...args) {
-    if (!this.args.readOnly) {
-      // catching a situation in which the user is not readOnly and has not provided a valueUpdated function to the instance
-      this.args.valueUpdated(...args);
-    }
+  get ariaLabel() {
+    return this.args.title ?? 'JSON Editor';
   }
 
   @action
-  onFocus(...args) {
-    if (this.args.onFocusOut) {
-      this.args.onFocusOut(...args);
-    }
+  onSetup(editor) {
+    this._codemirrorEditor = editor;
+
+    this.args.onSetup?.(editor);
   }
 
   @action
   restoreExample() {
-    // set value to null which will cause the example value to be passed into the editor
-    this.args.valueUpdated(null, this._codemirrorEditor);
+    if (this.args.onRestoreExample) {
+      // Override to reset the @value of the code editor to something other than `null`
+      this.args.onRestoreExample();
+    } else {
+      // Display @example in the editor but reset @value to `null` because
+      // sometimes @example is not valid to set and submit as the actual input value.
+      this._codemirrorEditor.dispatch({
+        changes: [
+          {
+            from: 0,
+            to: this._codemirrorEditor.state.doc.length,
+            insert: this.args.example,
+          },
+        ],
+      });
+      this.args.valueUpdated(null);
+    }
   }
 }
diff --git a/ui/lib/core/addon/components/key-value-header.hbs b/ui/lib/core/addon/components/key-value-header.hbs
index 6966b58f128..8745fcd6b56 100644
--- a/ui/lib/core/addon/components/key-value-header.hbs
+++ b/ui/lib/core/addon/components/key-value-header.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Breadcrumb>
   {{#each this.secretPath as |path|}}
diff --git a/ui/lib/core/addon/components/key-value-header.js b/ui/lib/core/addon/components/key-value-header.js
index 82fa2d9b2d4..e28ae6ad1be 100644
--- a/ui/lib/core/addon/components/key-value-header.js
+++ b/ui/lib/core/addon/components/key-value-header.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,9 +12,8 @@ import { encodePath } from 'vault/utils/path-encoding-helpers';
  * KeyValueHeader components show breadcrumbs for secret engines.
  *
  * @example
- * ```js
- <KeyValueHeader @path="vault.cluster.secrets.backend.show" @mode={{this.mode}} @root={{@root}}/>
- * ```
+ * <KeyValueHeader @path="vault.cluster.secrets.backend.show" @mode={{this.mode}}/>
+ *
  * @param {string} [mode=null] - Used to set the currentPath.
  * @param {string} [baseKey=null] - Used to generate the path backward.
  * @param {string} [path=null] - The fallback path.
diff --git a/ui/lib/core/addon/components/kv-object-editor.hbs b/ui/lib/core/addon/components/kv-object-editor.hbs
index 04663d3a7a7..8ca64389b30 100644
--- a/ui/lib/core/addon/components/kv-object-editor.hbs
+++ b/ui/lib/core/addon/components/kv-object-editor.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="field" ...attributes {{did-insert this.createKvData @value}}>
   <FormFieldLabel
@@ -72,20 +72,12 @@
       </div>
       {{#if (this.showWhitespaceWarning row.name)}}
         <div class="has-bottom-margin-s">
-          <AlertInline
-            @type="warning"
-            @message="Key contains whitespace. If this is desired, you'll need to encode it with %20 in API requests."
-            data-test-kv-whitespace-warning={{index}}
-          />
+          <AlertInline @type="warning" @message={{this.whitespaceWarning}} data-test-kv-whitespace-warning={{index}} />
         </div>
       {{/if}}
       {{#if (this.showNonStringWarning row.value)}}
         <div class="has-bottom-margin-s">
-          <AlertInline
-            @type="warning"
-            @message="This value will be saved as a string. If you need to save a non-string value, please use the JSON editor."
-            data-test-kv-object-warning={{index}}
-          />
+          <AlertInline @type="warning" @message={{this.nonStringWarning}} data-test-kv-object-warning={{index}} />
         </div>
       {{/if}}
     {{/each}}
diff --git a/ui/lib/core/addon/components/kv-object-editor.js b/ui/lib/core/addon/components/kv-object-editor.js
index 084d3cc4b38..fc253f28dc1 100644
--- a/ui/lib/core/addon/components/kv-object-editor.js
+++ b/ui/lib/core/addon/components/kv-object-editor.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,22 +10,23 @@ import { assert } from '@ember/debug';
 import { action } from '@ember/object';
 import { guidFor } from '@ember/object/internals';
 import KVObject from 'vault/lib/kv-object';
+import {
+  hasWhitespace,
+  isNonString,
+  NON_STRING_WARNING,
+  WHITESPACE_WARNING,
+} from 'vault/utils/forms/validators';
 
 /**
  * @module KvObjectEditor
  * KvObjectEditor components are called in FormFields when the editType on the model is kv.  They are used to show a key-value input field.
  *
  * @example
- * ```js
- * <KvObjectEditor
- *  @value={{get model valuePath}}
- *  @onChange={{action "setAndBroadcast" valuePath }}
- *  @label="some label"
-   />
- * ```
+ * <KvObjectEditor @value={{hash foo="bar"}} @onChange={{log "on change called"}} @label="Label here" />
+ *
  * @param {string} value - the value is captured from the model.
  * @param {function} onChange - function that captures the value on change
- * @param {boolean} [isMasked = false] - when true the <MaskedInput> renders instead of the default <textarea> to input the value portion of the key/value object
+ * @param {boolean} [isMasked = false] - when true the `MaskedInput` renders instead of the default `textarea` to input the value portion of the key/value object
  * @param {boolean} [isSingleRow = false] - when true the kv object editor will only show one row and hide the Add button
  * @param {function} [onKeyUp] - function passed in that handles the dom keyup event. Used for validation on the kv custom metadata.
  * @param {string} [label] - label displayed over key value inputs
@@ -40,7 +41,10 @@ import KVObject from 'vault/lib/kv-object';
  */
 
 export default class KvObjectEditor extends Component {
+  // kvData is type ArrayProxy, so addObject etc are fine here
   @tracked kvData;
+  whitespaceWarning = WHITESPACE_WARNING('key');
+  nonStringWarning = NON_STRING_WARNING;
 
   get placeholders() {
     return {
@@ -49,7 +53,7 @@ export default class KvObjectEditor extends Component {
     };
   }
   get hasDuplicateKeys() {
-    return this.kvData.uniqBy('name').length !== this.kvData.get('length');
+    return this.kvData.uniqBy('name').length !== this.kvData.length;
   }
 
   // fired on did-insert from render modifier
@@ -89,15 +93,11 @@ export default class KvObjectEditor extends Component {
   }
   showWhitespaceWarning = (name) => {
     if (this.args.allowWhiteSpace) return false;
-    return new RegExp('\\s', 'g').test(name);
+    return hasWhitespace(name);
   };
+
   showNonStringWarning = (value) => {
     if (!this.args.warnNonStringValues) return false;
-    try {
-      JSON.parse(value);
-      return true;
-    } catch (e) {
-      return false;
-    }
+    return isNonString(value);
   };
 }
diff --git a/ui/lib/core/addon/components/kv-suggestion-input.hbs b/ui/lib/core/addon/components/kv-suggestion-input.hbs
index f277a5afd7b..92d065305a4 100644
--- a/ui/lib/core/addon/components/kv-suggestion-input.hbs
+++ b/ui/lib/core/addon/components/kv-suggestion-input.hbs
@@ -1,17 +1,16 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 <div ...attributes {{did-update this.updateSuggestions @mountPath}}>
   {{#if @label}}
     <FormFieldLabel for={{this.inputId}} @label={{@label}} @subText={{@subText}} />
   {{/if}}
   <FilterInput
-    id={{this.inputId}}
+    @id={{this.inputId}}
     placeholder="Path to secret"
-    value={{@value}}
+    @value={{@value}}
     disabled={{not @mountPath}}
-    @hideIcon={{true}}
     @onInput={{this.onInput}}
     {{! used to trigger dropdown to open }}
     {{on "click" this.onInputClick}}
@@ -30,6 +29,6 @@
     data-test-kv-suggestion-select
     as |secret|
   >
-    {{secret.path}}
+    {{secret}}
   </PowerSelect>
 </div>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/kv-suggestion-input.ts b/ui/lib/core/addon/components/kv-suggestion-input.ts
index 55bb7fdcbc9..7558ce20851 100644
--- a/ui/lib/core/addon/components/kv-suggestion-input.ts
+++ b/ui/lib/core/addon/components/kv-suggestion-input.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,12 +10,13 @@ import { action } from '@ember/object';
 import { guidFor } from '@ember/object/internals';
 import { run } from '@ember/runloop';
 import { keyIsFolder, parentKeyForKey, keyWithoutParentKey } from 'core/utils/key-utils';
+import { KvV2ListListEnum } from '@hashicorp/vault-client-typescript';
 
-import type StoreService from 'vault/services/store';
-import type KvSecretMetadataModel from 'vault/models/kv/metadata';
+import type ApiService from 'vault/services/api';
 
 /**
  * @module KvSuggestionInput
+ * @description
  * Input component that fetches secrets at a provided mount path and displays them as suggestions in a dropdown
  * As the user types the result set will be filtered providing suggestions for the user to select
  * After the input debounce wait time (500ms), if the value ends in a slash, secrets will be fetched at that path
@@ -24,15 +25,12 @@ import type KvSecretMetadataModel from 'vault/models/kv/metadata';
  * This allows the user to build a full path to a secret for the provided mount
  * This is useful for helping the user find deeply nested secrets given the path based policy system
  * If the user does not have list permission they are still able to enter a path to a secret but will not see suggestions
- * 
+ * Input is disabled when mount path is not provided
+ *
  * @example
- * <KvSuggestionInput
-    @label="Select a secret to sync"
-    @subText="Enter the full path to the secret. Suggestions will display below if permitted by policy."
-    @value={{this.secretPath}}
-    @mountPath={{this.mountPath}} // input disabled when mount path is not provided
-    @onChange={{fn (mut this.secretPath)}}
-  /> 
+ * <KvSuggestionInput @label="Select a secret to sync" @subText="Enter the full path to the secret. Suggestions will display below if permitted by policy." @value={{this.secretPath}} @mountPath="my-kv/" @onChange={{fn (mut this.secretPath)}} />
+ *
+ * <KvSuggestionInput @label="Select a secret to sync" @subText="Disabled because no mount path provided" @value={{this.secretPath}} @mountPath={{false}} @onChange={{fn (mut this.secretPath)}} />
  */
 
 interface Args {
@@ -51,12 +49,13 @@ interface PowerSelectAPI {
 }
 
 export default class KvSuggestionInputComponent extends Component<Args> {
-  @service declare readonly store: StoreService;
+  @service declare readonly api: ApiService;
 
-  @tracked secrets: KvSecretMetadataModel[] = [];
+  @tracked secrets: string[] = [];
   powerSelectAPI: PowerSelectAPI | undefined;
-  _cachedSecrets: KvSecretMetadataModel[] = []; // cache the response for filtering purposes
+  _cachedSecrets: string[] = []; // cache the response for filtering purposes
   inputId = `suggestion-input-${guidFor(this)}`; // add unique segment to id in case multiple instances of component are used on the same page
+  pathToSecret = ''; // keeps track of the full path to the secret as user builds it out
 
   constructor(owner: unknown, args: Args) {
     super(owner, args);
@@ -65,18 +64,19 @@ export default class KvSuggestionInputComponent extends Component<Args> {
     }
   }
 
-  async fetchSecrets(isDirectory: boolean) {
-    const { mountPath } = this.args;
+  get isDirectory() {
+    return keyIsFolder(this.args.value);
+  }
+
+  async fetchSecrets() {
     try {
+      const { mountPath } = this.args;
       const backend = keyIsFolder(mountPath) ? mountPath.slice(0, -1) : mountPath;
       const parentDirectory = parentKeyForKey(this.args.value);
-      const pathToSecret = isDirectory ? this.args.value : parentDirectory;
-      const kvModels = (await this.store.query('kv/metadata', {
-        backend,
-        pathToSecret,
-      })) as unknown;
+      this.pathToSecret = this.isDirectory ? this.args.value : parentDirectory;
+      const { keys } = await this.api.secrets.kvV2List(this.pathToSecret, backend, KvV2ListListEnum.TRUE);
       // this will be used to filter the existing result set when the search term changes within the same path
-      this._cachedSecrets = kvModels as KvSecretMetadataModel[];
+      this._cachedSecrets = keys || [];
       return this._cachedSecrets;
     } catch (error) {
       console.log(error); // eslint-disable-line
@@ -84,33 +84,32 @@ export default class KvSuggestionInputComponent extends Component<Args> {
     }
   }
 
-  filterSecrets(kvModels: KvSecretMetadataModel[] | undefined = [], isDirectory: boolean) {
+  filterSecrets(secrets: string[] | undefined = []) {
     const { value } = this.args;
     const secretName = keyWithoutParentKey(value) || '';
-    return kvModels.filter((model) => {
-      if (!value || isDirectory) {
+    return secrets.filter((path) => {
+      if (!value || this.isDirectory) {
         return true;
       }
-      if (value === model.fullSecretPath) {
+      if (secretName === path) {
         // don't show suggestion if it's currently selected
         return false;
       }
-      return model.path.toLowerCase().includes(secretName.toLowerCase());
+      return path.toLowerCase().includes(secretName.toLowerCase());
     });
   }
 
   @action
   async updateSuggestions() {
     const isFirstUpdate = !this._cachedSecrets.length;
-    const isDirectory = keyIsFolder(this.args.value);
     if (!this.args.mountPath) {
       this.secrets = [];
-    } else if (this.args.value && !isDirectory && this.secrets) {
+    } else if (this.args.value && !this.isDirectory && this.secrets) {
       // if we don't need to fetch from a new path, filter the previous result set with the updated search term
-      this.secrets = this.filterSecrets(this._cachedSecrets, isDirectory);
+      this.secrets = this.filterSecrets(this._cachedSecrets);
     } else {
-      const kvModels = await this.fetchSecrets(isDirectory);
-      this.secrets = this.filterSecrets(kvModels, isDirectory);
+      const secrets = await this.fetchSecrets();
+      this.secrets = this.filterSecrets(secrets);
     }
     // don't do anything on first update -- allow dropdown to open on input click
     if (!isFirstUpdate) {
@@ -133,11 +132,11 @@ export default class KvSuggestionInputComponent extends Component<Args> {
   }
 
   @action
-  onSuggestionSelect(secret: KvSecretMetadataModel) {
+  onSuggestionSelect(secret: string) {
     // user may partially type a value to filter result set and then select a suggestion
     // in this case the partially typed value must be replaced with suggestion value
-    // the fullSecretPath contains the previous selections or typed path segments
-    this.args.onChange(secret.fullSecretPath);
+    // pathToSecret contains the previous selections or typed path segments
+    this.args.onChange(`${this.pathToSecret}${secret}`);
     this.updateSuggestions();
     // refocus the input after selection
     run(() => document.getElementById(this.inputId)?.focus());
diff --git a/ui/lib/core/addon/components/layout-loading.hbs b/ui/lib/core/addon/components/layout-loading.hbs
index 5f4a1940698..adccd727e3e 100644
--- a/ui/lib/core/addon/components/layout-loading.hbs
+++ b/ui/lib/core/addon/components/layout-loading.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="is-flex-v-centered is-flex-grow-1 loader-inner-page" data-test-layout-loading>
   <div class="columns is-centered">
diff --git a/ui/lib/core/addon/components/linked-block.hbs b/ui/lib/core/addon/components/linked-block.hbs
index 841924ab5d1..a1031ef5821 100644
--- a/ui/lib/core/addon/components/linked-block.hbs
+++ b/ui/lib/core/addon/components/linked-block.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class={{unless @disabled "linked-block"}} role="link" {{on "click" this.onClick}} ...attributes>
   {{yield}}
diff --git a/ui/lib/core/addon/components/linked-block.js b/ui/lib/core/addon/components/linked-block.js
index 1599b765dfe..04e30105d2f 100644
--- a/ui/lib/core/addon/components/linked-block.js
+++ b/ui/lib/core/addon/components/linked-block.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
-import { service } from '@ember/service';
+import { getOwner } from '@ember/owner';
 import { action } from '@ember/object';
 import { encodePath } from 'vault/utils/path-encoding-helpers';
 
@@ -13,16 +13,10 @@ import { encodePath } from 'vault/utils/path-encoding-helpers';
  * LinkedBlock components are linkable divs that yield any content nested within them. They are often used in list views such as when listing the secret engines.
  *
  * @example
- * ```js
- * <LinkedBlock
- *  @params={{array 'vault.cluster.secrets.backend.show 'my-secret-path'}}
- *  @queryParams={{hash version=1}}
- *  @class="list-item-row"
- *  data-test-list-item-link
- *  >
- * // Use any wrapped content here
+ * <LinkedBlock @params={{array "vault.cluster.secrets.backend.show" "my-secret-path"}} class="list-item-row" >
+ * My wrapped content
  * </LinkedBlock>
- * ```
+ *
  *
  * @param {Array} params=null - These are values sent to the router's transitionTo method.  First item is route, second is the optional path.
  * @param {Object} [queryParams=null] - queryParams can be passed via this property. It needs to be an object.
@@ -32,7 +26,14 @@ import { encodePath } from 'vault/utils/path-encoding-helpers';
  */
 
 export default class LinkedBlockComponent extends Component {
-  @service router;
+  // We don't import the router service here because Ember Engine's use the alias 'app-router'
+  // Since this component is shared across engines, we look up the router dynamically using getOwner instead.
+  // This way we avoid throwing an error by looking up a service that doesn't exist.
+  // https://guides.emberjs.com/release/services/#toc_accessing-services
+  get router() {
+    const owner = getOwner(this);
+    return owner.lookup('service:router') || owner.lookup('service:app-router');
+  }
 
   @action
   onClick(event) {
diff --git a/ui/lib/core/addon/components/list-item.hbs b/ui/lib/core/addon/components/list-item.hbs
index 817349a7171..4fe99b3cacd 100644
--- a/ui/lib/core/addon/components/list-item.hbs
+++ b/ui/lib/core/addon/components/list-item.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @componentName}}
   {{component @componentName item=@item}}
diff --git a/ui/lib/core/addon/components/list-item.js b/ui/lib/core/addon/components/list-item.js
index 426f48c2dfa..75d5c5724c3 100644
--- a/ui/lib/core/addon/components/list-item.js
+++ b/ui/lib/core/addon/components/list-item.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/components/list-item/content.hbs b/ui/lib/core/addon/components/list-item/content.hbs
index 10baf57e79c..14063a930e2 100644
--- a/ui/lib/core/addon/components/list-item/content.hbs
+++ b/ui/lib/core/addon/components/list-item/content.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{yield}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/list-item/popup-menu.hbs b/ui/lib/core/addon/components/list-item/popup-menu.hbs
index 10baf57e79c..14063a930e2 100644
--- a/ui/lib/core/addon/components/list-item/popup-menu.hbs
+++ b/ui/lib/core/addon/components/list-item/popup-menu.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{yield}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/list-table.hbs b/ui/lib/core/addon/components/list-table.hbs
new file mode 100644
index 00000000000..3d347ddba09
--- /dev/null
+++ b/ui/lib/core/addon/components/list-table.hbs
@@ -0,0 +1,56 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+{{#if (has-block "selectedItems")}}
+  {{yield to="selectedItems"}}
+{{/if}}
+<Hds::Table
+  @model={{this.paginatedTableData}}
+  @columns={{@columns}}
+  @isSelectable={{if @selectionKey true false}}
+  class="has-bottom-margin-s"
+  @onSelectionChange={{@onSelectionChange}}
+  @isFixedLayout={{true}}
+  {{did-update this.resetPagination @data}}
+>
+  <:body as |B|>
+    <B.Tr
+      @selectionKey={{get B.data @selectionKey}}
+      @selectionAriaLabelSuffix="row {{B.data.path}}"
+      data-test-table-row={{get B.data @selectionKey}}
+    >
+      {{#each this.columnKeys as |key index|}}
+        {{#if (and (eq key "popupMenu") (has-block "popupMenu"))}}
+          <B.Td data-test-table-data="popupMenu">
+            {{yield B.data to="popupMenu"}}
+          </B.Td>
+        {{else}}
+          {{#let (get B.data key) as |value|}}
+            <B.Td data-test-table-data={{key}} class="text-overflow-ellipsis">
+              {{#if (get (get @columns index) "customTableItem")}}
+                {{yield B.data to="customTableItem"}}
+              {{else}}
+                {{! stringify value if it is an array or object, otherwise render directly }}
+                {{if (this.isObject value) (stringify value) value}}
+              {{/if}}
+            </B.Td>
+          {{/let}}
+        {{/if}}
+      {{/each}}
+    </B.Tr>
+  </:body>
+</Hds::Table>
+{{! WORKAROUND to manually re-render Hds::Pagination::Numbered to force update @currentPage }}
+{{#if this.renderPagination}}
+  <Hds::Pagination::Numbered
+    class="has-bottom-margin-m is-fullwidth"
+    @currentPage={{this.currentPage}}
+    @currentPageSize={{this.pageSize}}
+    @onPageChange={{fn this.handlePaginationChange "currentPage"}}
+    @onPageSizeChange={{fn this.handlePaginationChange "pageSize"}}
+    @pageSizes={{array 5 10 25 50 100}}
+    data-test-pagination
+    @totalItems={{@data.length}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/list-table.ts b/ui/lib/core/addon/components/list-table.ts
new file mode 100644
index 00000000000..32994e98695
--- /dev/null
+++ b/ui/lib/core/addon/components/list-table.ts
@@ -0,0 +1,87 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { action } from '@ember/object';
+import { next } from '@ember/runloop';
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { paginate } from 'core/utils/paginate-list';
+
+/**
+ * @module ListTable
+ * `ListTable` component is used for rendering a list of items in a table.
+ *
+ * @example
+ * <ListTable
+ *   @columns={{this.tableColumns}}
+ *   @data={{this.data}}
+ *   @isSelectable={{true}}
+ *   @onSelectionChange={{this.updateSelectedItems}}
+ * >
+ *
+ * @param {array} columns - An array of type TableColumn, for populating table headers and any optional functionality (ie. isSortable...)
+ * @param {array} data - An array of data to display corresponding to columns. (ie. the key from a column corresponds to the parameter value of the data object your passing in)
+ * @param {string} [selectionKey] - string of desired param value to be used as a unique identifier for a selected row - setting this arg automatically sets 'isSelectable' on the table to make rows selectable
+ * @param {function} [onSelectionChange] - Provided function for handling when rows are selected
+ *
+ * For custom column items that are not 1 to 1 with their dataset (ie. these items have conditional icons, colors, generated text etc)
+ * within the column type, the 'customTableItem' flag will allow the parent component to {{yield}} any custom implementation from the parent for those items
+ * but the yield block in the parent must be 'customTableItem'.
+ *
+ * similarly, if 'isSelectable' is true and 'onSelectionChange' is being handled
+ * For displaying new content based on what's selected, the parent component can also pass in a yield block 'selectedItems'
+ *
+ * If there's an 'Action' column (ie. possibly for manipulating data rows, or navigating to a page per that row data, etc)
+ * The parent component must specify the key as 'popupMenu' for that column and pass in a yield block 'popupMenu' for it to render per each item under the 'action' column.
+ *
+ */
+
+interface TableColumn {
+  key: string;
+  label: string;
+  selectionKey?: string;
+  customTableItem?: boolean;
+  onSelectionChange?: CallableFunction;
+}
+
+interface Args {
+  data: Array<object>;
+  columns: TableColumn[];
+}
+
+export default class ListTable extends Component<Args> {
+  @tracked currentPage = 1;
+  @tracked pageSize = 10;
+
+  //  WORKAROUND to manually re-render Hds::Pagination::Numbered to force update @currentPage
+  @tracked renderPagination = true;
+
+  get paginatedTableData() {
+    const paginated = paginate(this.args.data, {
+      page: this.currentPage,
+      pageSize: this.pageSize,
+    });
+    return paginated;
+  }
+
+  get columnKeys() {
+    return this.args.columns.map((k: TableColumn) => k['key'] ?? k['label']);
+  }
+
+  @action
+  handlePaginationChange(action: 'currentPage' | 'pageSize', value: number) {
+    this[action] = value;
+  }
+
+  @action
+  async resetPagination() {
+    this.renderPagination = false;
+    this.currentPage = 1;
+    //  WORKAROUND to manually re-render Hds::Pagination::Numbered to force update @currentPage
+    next(() => {
+      this.renderPagination = true;
+    });
+  }
+}
diff --git a/ui/lib/core/addon/components/list-view.hbs b/ui/lib/core/addon/components/list-view.hbs
index fa6006d7ed3..9b91e3047bd 100644
--- a/ui/lib/core/addon/components/list-view.hbs
+++ b/ui/lib/core/addon/components/list-view.hbs
@@ -1,9 +1,8 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if (or (and @items.meta @items.meta.total) @items.length)}}
+}}
+{{#if (or (and @items.meta @items.meta.filteredTotal) @items.length)}}
   <div class="box is-fullwidth is-bottomless is-sideless is-paddingless" data-test-list-view-list>
     {{#each @items as |item|}}
       {{yield (hash item=item)}}
@@ -15,6 +14,7 @@
         @currentPage={{@items.meta.currentPage}}
         @currentPageSize={{@items.meta.pageSize}}
         @route={{@paginationRouteName}}
+        @models={{@paginationRouteParams}}
         @showSizeSelector={{false}}
         @totalItems={{@items.meta.total}}
         @queryFunction={{this.paginationQueryParams}}
diff --git a/ui/lib/core/addon/components/list-view.js b/ui/lib/core/addon/components/list-view.js
index ac7ceceb3f2..470180642b0 100644
--- a/ui/lib/core/addon/components/list-view.js
+++ b/ui/lib/core/addon/components/list-view.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,26 +7,25 @@ import Component from '@glimmer/component';
 import { pluralize } from 'ember-inflector';
 
 /**
+ * @deprecated As of 2025, This component is deprecated. Please refer to other related components such as 'list-table'
  * @module ListView
  * `ListView` components are used in conjunction with `ListItem` for rendering a list.
  *
  * @example
- * ```js
- * <ListView @items={{model}} @itemNoun="role" @paginationRouteName="scope.roles" as |list|>
+ * <ListView @items={{hash meta=(hash currentPage=1 total=1 pageSize=1)}} @itemNoun="role" @paginationRouteName="vault" as |list|>
  *   {{#if list.empty}}
  *     <list.empty @title="No roles here" />
  *   {{else}}
  *     <div>
- *       {{list.item.id}}
+ *       my item
  *     </div>
  *   {{/if}}
  * </ListView>
- * ```
  *
  * @param {array} [items=null] - An Ember array of items (objects) to render as a list. Because it's an Ember array it has properties like length an meta on it.
  * @param {string} [itemNoun=item] - A noun to use in the empty state of message and title.
  * @param {string} [message=null] - The message to display within the banner.
- * @param {string} [paginationRouteName=''] - The link used in the ListPagination component.
+ * @param {string} [paginationRouteName] - The link used in the ListPagination component.
  * @yields {object} Yields the current item in the loop.
  * @yields If there are no objects in items, then `empty` will be yielded - this is an instance of
  * the EmptyState component.
diff --git a/ui/lib/core/addon/components/loading-dropdown-option.hbs b/ui/lib/core/addon/components/loading-dropdown-option.hbs
index 5434770f4c2..8482756326a 100644
--- a/ui/lib/core/addon/components/loading-dropdown-option.hbs
+++ b/ui/lib/core/addon/components/loading-dropdown-option.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Button disabled @text="loading" class="link loading-dropdown" @icon="loading" @isIconOnly={{true}} ...attributes />
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/masked-input.hbs b/ui/lib/core/addon/components/masked-input.hbs
index 86af1df7991..bf815d84197 100644
--- a/ui/lib/core/addon/components/masked-input.hbs
+++ b/ui/lib/core/addon/components/masked-input.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div
   class="masked-input {{if @displayOnly 'display-only'}} {{if @allowCopy 'allow-copy'}}"
@@ -32,7 +32,7 @@
       aria-label={{or @name "masked input"}}
       {{on "change" this.onChange}}
       {{on "keyup" (fn this.handleKeyUp @name)}}
-      data-test-textarea
+      data-test-input={{or @name ""}}
     />
   {{/if}}
   {{#if @allowCopy}}
@@ -40,11 +40,9 @@
       @text="Copy"
       @isIconOnly={{true}}
       @textToCopy={{this.copyValue}}
-      @onError={{(fn
-        (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-      )}}
+      @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
       class="transparent has-padding-xxs"
-      data-test-copy-button={{or this.copyValue true}}
+      data-test-copy-button
     />
   {{/if}}
   {{#if @allowDownload}}
@@ -54,7 +52,7 @@
       @isIconOnly={{true}}
       @color="tertiary"
       class="has-padding-xxs"
-      data-test-download-icon
+      data-test-button="Download secret value"
       {{on "click" (fn (mut this.modalOpen) true)}}
     />
   {{/if}}
diff --git a/ui/lib/core/addon/components/masked-input.js b/ui/lib/core/addon/components/masked-input.js
index ac27526fea9..a22d544ee77 100644
--- a/ui/lib/core/addon/components/masked-input.js
+++ b/ui/lib/core/addon/components/masked-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,20 +15,14 @@ import autosize from 'autosize';
  * `MaskedInput` components are textarea inputs where the input is hidden. They are used to enter sensitive information like passwords.
  *
  * @example
- * <MaskedInput
- *  @value={{get @model attr.name}}
- *  @allowCopy={{true}}
- *  @allowDownload={{true}}
- *  @onChange={{this.handleChange}}
- *  @onKeyUp={{this.handleKeyUp}}
- * />
+ * <MaskedInput @value="my secret value" @allowCopy={{true}} @allowDownload={{true}} @onChange={{log "handle change"}} />
  *
- * @param value {String} - The value to display in the input.
- * @param name {String} - The key correlated to the value. Used for the download file name.
- * @param [onChange=Callback] {Function|action} - Callback triggered on change, sends new value. Must set the value of @value
- * @param [allowCopy=false] {bool} - Whether or not the input should render with a copy button.
- * @param [allowDownload=false] {bool} - Renders a download button that prompts a confirmation modal to download the secret value
- * @param [displayOnly=false] {bool} - Whether or not to display the value as a display only `pre` element or as an input.
+ * @param {string} value - The value to display in the input.
+ * @param {string} name - The key correlated to the value. Used for the download file name.
+ * @param {function} [onChange=Callback] - Callback triggered on change, sends new value. Must set the value of @value
+ * @param {boolean} [allowCopy=false]  - Whether or not the input should render with a copy button.
+ * @param {boolean} [allowDownload=false]  - Renders a download button that prompts a confirmation modal to download the secret value
+ * @param {boolean} [displayOnly=false]  - Whether or not to display the value as a display only `pre` element or as an input.
  *
  */
 export default class MaskedInputComponent extends Component {
diff --git a/ui/lib/core/addon/components/message-error.hbs b/ui/lib/core/addon/components/message-error.hbs
new file mode 100644
index 00000000000..485e4ae214b
--- /dev/null
+++ b/ui/lib/core/addon/components/message-error.hbs
@@ -0,0 +1,45 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if this.formattedError}}
+  {{#let this.formattedError.message this.formattedError.details as |message details|}}
+    <Hds::Alert
+      @type="inline"
+      @color="critical"
+      @onDismiss={{@onDismiss}}
+      class="has-top-margin-s has-bottom-margin-s"
+      data-test-message-error
+      ...attributes
+      as |A|
+    >
+      <A.Title>Error</A.Title>
+      <A.Description data-test-message-error-description>
+        {{message}}
+        <ul class="bullet">
+          {{#each details as |detail|}}
+            <li>
+              {{detail}}
+            </li>
+          {{/each}}
+        </ul>
+      </A.Description>
+    </Hds::Alert>
+  {{/let}}
+{{else if this.displayErrors}}
+  {{#each this.displayErrors as |error|}}
+    <Hds::Alert
+      @type="inline"
+      @color="critical"
+      @onDismiss={{@onDismiss}}
+      class="has-top-margin-s has-bottom-margin-s"
+      ...attributes
+      data-test-message-error
+      as |A|
+    >
+      <A.Title>Error</A.Title>
+      <A.Description data-test-message-error-description>{{error}}</A.Description>
+    </Hds::Alert>
+  {{/each}}
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/message-error.js b/ui/lib/core/addon/components/message-error.js
index 1318df0ea02..9f6463b248d 100644
--- a/ui/lib/core/addon/components/message-error.js
+++ b/ui/lib/core/addon/components/message-error.js
@@ -1,29 +1,24 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
-import layout from '../templates/components/message-error';
-import { setComponentTemplate } from '@ember/component';
 
 /**
  * @module MessageError
- * Renders form errors using the <Hds::Alert> component and extracts errors from
+ * Renders form errors using the Hds::Alert component and extracts errors from
  * a model, passed errorMessage or array of errors and displays each in a separate banner.
  *
  * @example
- * ```js
- * <MessageError @model={{model}} />
- * ```
+ * <MessageError @errorMessage="oh no there is a problem" />
  *
- * @param {object} [model=null] - An Ember data model that will be used to bind error states to the internal
- * `errors` property.
+ * @param {object} [model=null] - An Ember data model that will be used to bind error states to the internal `errors` property.
  * @param {array} [errors=null] - An array of error strings to show.
  * @param {string} [errorMessage=null] - An Error string to display.
  */
 
-class MessageError extends Component {
+export default class MessageError extends Component {
   get displayErrors() {
     const { errorMessage, errors, model } = this.args;
     if (errorMessage) {
@@ -39,7 +34,7 @@ class MessageError extends Component {
       if (!adapterError) {
         return null;
       }
-      if (adapterError.errors.length > 0) {
+      if (adapterError.errors?.length > 0) {
         return adapterError.errors.map((e) => {
           if (typeof e === 'object') return e.title || e.message || JSON.stringify(e);
           return e;
@@ -49,5 +44,21 @@ class MessageError extends Component {
     }
     return null;
   }
+
+  get formattedError() {
+    if (this.args.errorMessage?.includes('*') && this.args.errorMessage?.includes('error: ')) {
+      try {
+        const lines = this.args.errorMessage.split('\n');
+        const [message] = lines[0].split('. error:');
+        const details = lines
+          .filter((line) => line.includes('* '))
+          .map((line) => line.replace(/\t\* /, ''))
+          .filter(Boolean);
+        return message && details ? { message, details } : null;
+      } catch {
+        return null;
+      }
+    }
+    return null;
+  }
 }
-export default setComponentTemplate(layout, MessageError);
diff --git a/ui/lib/core/addon/components/namespace-reminder.hbs b/ui/lib/core/addon/components/namespace-reminder.hbs
index ab0a4577879..d9f299bcfc9 100644
--- a/ui/lib/core/addon/components/namespace-reminder.hbs
+++ b/ui/lib/core/addon/components/namespace-reminder.hbs
@@ -1,21 +1,22 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.showMessage}}
   {{#if (has-block)}}
-    <p class="namespace-reminder">
+    <p class="has-top-bottom-margin-xxs" id="namespace-reminder">
       {{yield (hash namespace=this.namespace)}}
     </p>
   {{else}}
-    <p class="namespace-reminder">
+    <p class="has-top-bottom-margin-xxs" id="namespace-reminder">
       This
       {{@noun}}
       will be
       {{this.modeVerb}}
       in the
-      <span class="tag">{{this.namespace.path}}/</span>namespace.
+      <Hds::Badge @text="{{this.namespace.path}}/" />
+      namespace.
     </p>
   {{/if}}
 {{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/namespace-reminder.js b/ui/lib/core/addon/components/namespace-reminder.js
index a7dafc40a77..d8259d421f1 100644
--- a/ui/lib/core/addon/components/namespace-reminder.js
+++ b/ui/lib/core/addon/components/namespace-reminder.js
@@ -1,11 +1,27 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
 
+/**
+ * @module NamespaceReminder
+ * Renders a namespace reminder, typically used when creating a new item.
+ * _The namespace reminder only renders within a namespace, we cannot stub the namespace service here
+ * so manually wrote the component in the **example** below so it renders in docfy_
+ *
+ * @example
+ * <NamespaceReminder @mode="save" @noun="Auth Method" />
+ *
+ * <p id="namespace-reminder">
+ *  This Auth Method will be saved in the <span class="tag">admin/</span>namespace.
+ * </p>
+ *
+ * @param {string} noun - item being created by form
+ * @param {string} [mode=edit] - action happening in form
+ */
 export default class NamespaceReminder extends Component {
   @service namespace;
 
diff --git a/ui/lib/core/addon/components/navigate-input.hbs b/ui/lib/core/addon/components/navigate-input.hbs
index c3cd19c4b11..09280542a1f 100644
--- a/ui/lib/core/addon/components/navigate-input.hbs
+++ b/ui/lib/core/addon/components/navigate-input.hbs
@@ -1,26 +1,22 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="navigate-filter">
   <div class="field" data-test-nav-input>
-    <p class="control has-icons-left">
-      <Input
-        id={{this.inputId}}
-        class="filter input"
-        placeholder={{or @placeholder "Filter items"}}
-        @value={{@filter}}
-        @type="text"
-        data-test-component="navigate-input"
-        {{on "input" this.handleInput}}
-        {{on "keyup" this.handleKeyUp}}
-        {{on "keydown" this.handleKeyPress}}
-        {{on "focus" (fn this.setFilterFocused true)}}
-        {{on "blur" (fn this.setFilterFocused false)}}
-        {{did-insert this.maybeFocusInput}}
-      />
-      <Icon @name="search" class="search-icon has-text-grey-light" />
-    </p>
+    <Hds::Form::TextInput::Base
+      id={{this.inputId}}
+      @type="search"
+      @value={{@filter}}
+      placeholder={{or @placeholder "Filter items"}}
+      {{on "input" this.handleInput}}
+      {{on "keyup" this.handleKeyUp}}
+      {{on "keydown" this.handleKeyPress}}
+      {{on "focus" (fn this.setFilterFocused true)}}
+      {{on "blur" (fn this.setFilterFocused false)}}
+      {{did-insert this.maybeFocusInput}}
+      data-test-component="navigate-input"
+    />
   </div>
 </div>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/navigate-input.js b/ui/lib/core/addon/components/navigate-input.js
index a02b24433ef..244e55f6a5d 100644
--- a/ui/lib/core/addon/components/navigate-input.js
+++ b/ui/lib/core/addon/components/navigate-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,28 +12,26 @@ import Component from '@glimmer/component';
 
 import { encodePath } from 'vault/utils/path-encoding-helpers';
 import { keyIsFolder, parentKeyForKey } from 'core/utils/key-utils';
-import keys from 'core/utils/key-codes';
+import keys from 'core/utils/keys';
 
 /**
  * @module NavigateInput
  * `NavigateInput` components are used to filter list data.
  *
  * @example
- * ```js
- * <NavigateInput @filter={@roleFiltered} @placeholder="placeholder text" urls="{{hash list="vault.cluster.secrets.backend.kubernetes.roles"}}"/>
- * ```
+ * <NavigateInput @filter={{@roleFiltered}} urls={{hash list="vault.cluster.secrets.backend.kubernetes.roles"}}/>
  *
  * @param {String} filter=null  - The filtered string.
- * @param {String} [placeholder="Filter items"] - The message inside the input to indicate what the user should enter into the space.
+ * @param {String} [placeholder=Filter items] - The message inside the input to indicate what the user should enter into the space.
  * @param {Object} [urls=null] - An object containing list=route url.
  * @param {Function} [filterFocusDidChange=null] - A function called when the focus changes.
  * @param {Function} [filterDidChange=null] - A function called when the filter string changes.
  * @param {Function} [filterMatchesKey=null] - A function used to match to a specific key, such as an Id.
  * @param {Function} [filterPartialMatch=null] - A function used to filter through a partial match. Such as "oo" of "root".
- * @param {String} [baseKey=""] - A string to transition by Id.
+ * @param {String} [baseKey] - A string to transition by Id.
  * @param {Boolean} [shouldNavigateTree=false] - If true, navigate a larger tree, such as when you're navigating leases under access.
- * @param {String} [mode="secrets"] - Mode which plays into navigation type.
- * @param {String} [extraNavParams=""] - A string used in route transition when necessary.
+ * @param {String} [mode=secrets] - Mode which plays into navigation type.
+ * @param {String} [extraNavParams] - A string used in route transition when necessary.
  */
 
 const routeFor = function (type, mode, urls) {
@@ -226,18 +224,17 @@ export default class NavigateInput extends Component {
   }
   @action
   handleKeyPress(event) {
-    if (event.keyCode === keys.TAB) {
+    if (event.key === keys.TAB) {
       this.onTab(event);
     }
   }
   @action
   handleKeyUp(event) {
-    const keyCode = event.keyCode;
     const val = event.target.value;
-    if (keyCode === keys.ENTER) {
+    if (event.key === keys.ENTER) {
       this.onEnter(val);
     }
-    if (keyCode === keys.ESC) {
+    if (keys.ESC.includes(event.key)) {
       this.onEscape(val);
     }
   }
diff --git a/ui/lib/core/addon/components/object-list-input.hbs b/ui/lib/core/addon/components/object-list-input.hbs
index 1b0a838e807..10768125ef2 100644
--- a/ui/lib/core/addon/components/object-list-input.hbs
+++ b/ui/lib/core/addon/components/object-list-input.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{yield}}
 {{#each this.inputList as |row index|}}
diff --git a/ui/lib/core/addon/components/object-list-input.js b/ui/lib/core/addon/components/object-list-input.js
index e6382435870..eb5cdb899a6 100644
--- a/ui/lib/core/addon/components/object-list-input.js
+++ b/ui/lib/core/addon/components/object-list-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,29 +7,32 @@ import Component from '@glimmer/component';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
 import { assert } from '@ember/debug';
+import { removeFromArray } from 'vault/helpers/remove-from-array';
 
 /**
  * @module ObjectListInput
  * ObjectListInput components are used to render a variable number of text inputs in a single row
  * with an "Add" button at the end of the row. Clicking 'add' generates a new row of empty inputs.
  * Each input field is generated by an object in the @objectKeys array. Labels render above each column.
+ * @description
+ * ```
  * sample object:
  *   {
  *     label: 'Input label', // required key
  *     key: 'attrKey', // required key
  *     placeholder: 'Enter input here'
  *   }
+ * ```
  *
  * @example
- * ```js
- * <ObjectListInput @objectKeys={{this.arrayOfObjects}} @onChange={{this.handleChange}} @inputValue={{this.inputValue}}/>
- * ```
+ * <ObjectListInput @objectKeys={{hash label="Input label" key="attrKey" placeholder="Enter input here"}} @onChange={{this.handleChange}} @inputValue={{this.inputValue}}/>
+ *
  * @param {array} objectKeys - an array of objects (sample above), the length determines the number of columns the component renders
- * @callback onChange - callback triggered when any input changes or when a row is deleted, called with array of objects containing each input's key and value ex: [ { attrKey: 'some input value' } ]
+ * @param {function} onChange - callback triggered when any input changes or when a row is deleted, called with array of objects containing each input's key and value ex: `[ { attrKey: 'some input value' } ]`
  * @param {string} [inputValue] - an array of objects to pre-fill the component inputs, key name must match objectKey[key]
  * @param {array} [validationErrors] - an array of validation objects, the index of each object corresponds to the row with an invalid input. each object has a key that matches a key in objectKeys
  * ex: (the nested object with 'errors' and 'isValid' matches the structure returned by the model validations decorator)
- *   { "attrKey": { "errors": ["Name is required."], "isValid": false } }
+ * `{ "attrKey": { "errors": ["Name is required."], "isValid": false } }`
  */
 
 export default class ObjectListInput extends Component {
@@ -65,7 +68,7 @@ export default class ObjectListInput extends Component {
 
   @action
   handleInput(idx, { target }) {
-    const inputObj = this.inputList.objectAt(idx);
+    const inputObj = this.inputList[idx];
     inputObj[target.name] = target.value;
     this.handleChange();
   }
@@ -79,8 +82,8 @@ export default class ObjectListInput extends Component {
 
   @action
   removeRow(idx) {
-    const row = this.inputList.objectAt(idx);
-    this.inputList.removeObject(row);
+    const row = this.inputList[idx];
+    this.inputList = removeFromArray(this.inputList, row);
     this.handleChange();
   }
 
diff --git a/ui/lib/core/addon/components/overview-card.hbs b/ui/lib/core/addon/components/overview-card.hbs
index d22a1519e57..3311629ad95 100644
--- a/ui/lib/core/addon/components/overview-card.hbs
+++ b/ui/lib/core/addon/components/overview-card.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container
   @level="mid"
@@ -10,28 +10,33 @@
   data-test-overview-card-container={{@cardTitle}}
   ...attributes
 >
-  <div class="flex row-wrap space-between has-bottom-margin-m" data-test-overview-card={{@cardTitle}}>
-    <Hds::Text::Display @weight="bold" @size="300" data-test-overview-card-title={{@cardTitle}}>
-      {{@cardTitle}}
-    </Hds::Text::Display>
-    {{#if @actionText}}
-      <Hds::Link::Standalone
-        @icon={{or @actionIcon "chevron-right"}}
-        @iconPosition="trailing"
-        @text={{@actionText}}
-        @route={{@actionTo}}
-        @isRouteExternal={{@actionExternal}}
-        @query={{@actionQuery}}
-        data-test-action-text={{@actionText}}
-      />
+  <div class="flex row-wrap space-between" data-test-overview-card={{@cardTitle}}>
+    {{#if (has-block "customTitle")}}
+      {{yield to="customTitle"}}
+    {{else}}
+      <Hds::Text::Display @weight="semibold" @size="300" data-test-overview-card-title={{@cardTitle}}>
+        {{@cardTitle}}
+      </Hds::Text::Display>
+    {{/if}}
+
+    {{#if (has-block "action")}}
+      {{yield to="action"}}
     {{/if}}
   </div>
-  <Hds::Text::Body
-    @color="faint"
-    class="{{unless @actionText 'has-top-margin-s'}}"
-    data-test-overview-card-subtitle={{@cardTitle}}
-  >
-    {{@subText}}
-  </Hds::Text::Body>
-  {{yield}}
+
+  {{! Pass @subText for text only content to use default styling. }}
+  {{#if @subText}}
+    <Hds::Text::Body @color="faint" data-test-overview-card-subtitle={{@cardTitle}}>
+      {{@subText}}
+    </Hds::Text::Body>
+  {{/if}}
+
+  {{! Use the "customSubtext" yield for stylized subtext or including elements like doc links. }}
+  {{#if (has-block "customSubtext")}}
+    {{yield to="customSubtext"}}
+  {{/if}}
+
+  {{#if (has-block "content")}}
+    {{yield to="content"}}
+  {{/if}}
 </Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/page-header-level.hbs b/ui/lib/core/addon/components/page-header-level.hbs
index 64ac0317eeb..5cbaa232e85 100644
--- a/ui/lib/core/addon/components/page-header-level.hbs
+++ b/ui/lib/core/addon/components/page-header-level.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! template-lint-disable no-yield-only }}
 {{yield}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/page-header.hbs b/ui/lib/core/addon/components/page-header.hbs
index 44d4d2c7322..ffaf839301d 100644
--- a/ui/lib/core/addon/components/page-header.hbs
+++ b/ui/lib/core/addon/components/page-header.hbs
@@ -1,20 +1,17 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<header class="page-header">
-  {{#if this.hasLevel}}
-    {{yield (hash top=(component "page-header-level"))}}
-    <div class="level">
-      <div class="level-left">
-        {{yield (hash levelLeft=(component "page-header-level"))}}
-      </div>
-      <div class="level-right field is-grouped">
-        {{yield (hash levelRight=(component "page-header-level"))}}
-      </div>
+{{! DEPRECATED: Use <Page::Header /> instead. <Page::Header> uses the new Hds page header and should be preferred over this component. }}
+<header class="page-header" ...attributes>
+  {{yield (hash top=(component "page-header-level"))}}
+  <div class="level">
+    <div class="level-left">
+      {{yield (hash levelLeft=(component "page-header-level"))}}
     </div>
-  {{else}}
-    {{yield (hash top=(component "page-header-level"))}}
-  {{/if}}
+    <div class="level-right field is-grouped">
+      {{yield (hash levelRight=(component "page-header-level"))}}
+    </div>
+  </div>
 </header>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/page-header.js b/ui/lib/core/addon/components/page-header.js
deleted file mode 100644
index c3225e51805..00000000000
--- a/ui/lib/core/addon/components/page-header.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-
-export default class PageHeader extends Component {
-  get hasLevel() {
-    return this.args.hasLevel === undefined ? true : this.args.hasLevel;
-  }
-}
diff --git a/ui/lib/core/addon/components/page/breadcrumbs.hbs b/ui/lib/core/addon/components/page/breadcrumbs.hbs
index da4d672ee8b..188b079cfcc 100644
--- a/ui/lib/core/addon/components/page/breadcrumbs.hbs
+++ b/ui/lib/core/addon/components/page/breadcrumbs.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Breadcrumb data-test-breadcrumbs>
   {{#each @breadcrumbs as |breadcrumb|}}
diff --git a/ui/lib/core/addon/components/page/breadcrumbs.ts b/ui/lib/core/addon/components/page/breadcrumbs.ts
index 8d33e991798..a24d2d9f476 100644
--- a/ui/lib/core/addon/components/page/breadcrumbs.ts
+++ b/ui/lib/core/addon/components/page/breadcrumbs.ts
@@ -1,31 +1,24 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { assert } from '@ember/debug';
 
+import type { Breadcrumb } from 'vault/vault/app-types';
+
 interface Args {
   breadcrumbs: Array<Breadcrumb>;
 }
-interface Breadcrumb {
-  label: string;
-  route?: string; // Do not provide for current route
-  icon?: string;
-  model?: string;
-  models?: string[];
-  linkToExternal?: boolean;
-}
 
 /**
  * @module Page::Breadcrumbs
  * Page::Breadcrumbs components are used to display an array of breadcrumbs at the top of the page.
  *
  * @example
- * ```js
- * <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}}  />
- * ```
+ * <Page::Breadcrumbs @breadcrumbs={{array (hash label="Home" route="vault") (hash label="my-secret")}}  />
+ *
  * @param {array} breadcrumbs - array of Breadcrumb objects, must contain a label key. If no route is provided, crumb is assumed to be the current page
  */
 
diff --git a/ui/lib/core/addon/components/page/error.hbs b/ui/lib/core/addon/components/page/error.hbs
index b11bc939ba1..80342ffee89 100644
--- a/ui/lib/core/addon/components/page/error.hbs
+++ b/ui/lib/core/addon/components/page/error.hbs
@@ -1,33 +1,33 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div
   class="box is-sideless has-background-white-bis has-text-grey-light has-text-centered has-tall-padding"
   data-test-page-error
 >
-  {{#if (eq @error.httpStatus 404)}}
-    <h1 class="title is-3 has-text-grey-light">
+  {{#if (eq this.error.httpStatus 404)}}
+    <h1 class="title is-3 has-text-grey-light" data-test-page-error-title={{this.error.httpStatus}}>
       404 Not Found
     </h1>
-    <p>Sorry, we were unable to find any content at <code>{{@error.path}}</code>.</p>
-  {{else if (eq @error.httpStatus 403)}}
-    <h1 class="title is-3 has-text-grey-light">
+    <p data-test-page-error-subtitle>Sorry, we were unable to find any content at <code>{{this.error.path}}</code>.</p>
+  {{else if (eq this.error.httpStatus 403)}}
+    <h1 class="title is-3 has-text-grey-light" data-test-page-error-title={{this.error.httpStatus}}>
       Not authorized
     </h1>
-    <p>You are not authorized to access content at <code>{{@error.path}}</code>.</p>
+    <p data-test-page-error-subtitle>You are not authorized to access content at <code>{{this.error.path}}</code>.</p>
   {{else}}
-    <h1 class="title is-3 has-text-grey-light">
+    <h1 class="title is-3 has-text-grey-light" data-test-page-error-title={{this.error.httpStatus}}>
       Error
     </h1>
-    <p>
-      {{#if @error.message}}
-        <p data-test-page-error-message>{{@error.message}}</p>
+    <div>
+      {{#if this.error.message}}
+        <p data-test-page-error-message>{{this.error.message}}</p>
       {{/if}}
-      {{#each @error.errors as |error index|}}
+      {{#each this.error.errors as |error index|}}
         <p data-test-page-error-details={{index}}>{{error}}</p>
       {{/each}}
-    </p>
+    </div>
   {{/if}}
 </div>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/page/error.ts b/ui/lib/core/addon/components/page/error.ts
new file mode 100644
index 00000000000..c1fee31e346
--- /dev/null
+++ b/ui/lib/core/addon/components/page/error.ts
@@ -0,0 +1,48 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { ResponseError } from '@hashicorp/vault-client-typescript';
+
+import type Owner from '@ember/owner';
+import type ApiService from 'vault/services/api';
+
+interface Args {
+  error: ResponseError | Error;
+}
+
+type Error = {
+  httpStatus?: number;
+  path?: string;
+  message: string;
+  errors: string[];
+};
+
+export default class PageErrorComponent extends Component<Args> {
+  @service declare readonly api: ApiService;
+
+  @tracked declare error: Error;
+
+  constructor(owner: Owner, args: Args) {
+    super(owner, args);
+    this.unpackError();
+  }
+
+  async unpackError() {
+    if (this.args.error instanceof ResponseError) {
+      const { status, path, response } = await this.api.parseError(this.args.error);
+      this.error = {
+        httpStatus: status,
+        path,
+        message: response?.message,
+        errors: response?.errors || [],
+      };
+    } else {
+      this.error = this.args.error;
+    }
+  }
+}
diff --git a/ui/lib/core/addon/components/page/header.hbs b/ui/lib/core/addon/components/page/header.hbs
new file mode 100644
index 00000000000..777c0144907
--- /dev/null
+++ b/ui/lib/core/addon/components/page/header.hbs
@@ -0,0 +1,36 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::PageHeader class="page-header" as |PH|>
+  <PH.Title>{{@title}}</PH.Title>
+  {{#if (has-block "breadcrumbs")}}
+    <PH.Breadcrumb>
+      {{yield to="breadcrumbs"}}
+    </PH.Breadcrumb>
+  {{/if}}
+  {{#if @icon}}
+    <PH.IconTile @icon={{@icon}} />
+  {{/if}}
+  {{#if (has-block "badges")}}
+    <PH.Badges>
+      {{yield to="badges"}}
+    </PH.Badges>
+  {{/if}}
+  {{#if @subtitle}}
+    <PH.Subtitle>{{@subtitle}}</PH.Subtitle>
+  {{/if}}
+  {{#if @description}}
+    <PH.Description>{{@description}}</PH.Description>
+  {{/if}}
+  {{#if (has-block "actions")}}
+    <PH.Actions>{{yield to="actions"}}</PH.Actions>
+  {{/if}}
+</Hds::PageHeader>
+
+{{#if (has-block "tabs")}}
+  <div class="has-top-margin-l">
+    {{yield to="tabs"}}
+  </div>
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/policy-example.hbs b/ui/lib/core/addon/components/policy-example.hbs
index 638089f7522..5db5fba2cc5 100644
--- a/ui/lib/core/addon/components/policy-example.hbs
+++ b/ui/lib/core/addon/components/policy-example.hbs
@@ -1,39 +1,51 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="has-bottom-margin-s">
   {{#if (eq @policyType "acl")}}
     <p data-test-example-modal-text="acl">
-      ACL Policies are written in Hashicorp Configuration Language (
-      <ExternalLink @href="https://github.com/hashicorp/hcl">HCL</ExternalLink>
+      <Hds::Link::Inline @isHrefExternal={{true}} @href={{doc-link "/vault/tutorials/get-started/introduction-policies"}}>ACL
+        Policies</Hds::Link::Inline>
+      are written in Hashicorp Configuration Language (
+      <Hds::Link::Inline @isHrefExternal={{true}} @href="https://github.com/hashicorp/hcl">HCL</Hds::Link::Inline>
       ) or JSON and describe which paths in Vault a user or machine is allowed to access. Here is an example policy:
     </p>
   {{else if (eq @policyType "rgp")}}
     <p class="has-bottom-margin-s" data-test-example-modal-text="rgp">
       Role Governing Policies (RGPs) are tied to client tokens or identities which is similar to
-      <DocLink @path="/vault/tutorials/policies/policies">ACL policies</DocLink>. They use
-      <DocLink @path="/vault/docs/enterprise/sentinel">Sentinel</DocLink>
+      <Hds::Link::Inline @isHrefExternal={{true}} @href={{doc-link "/vault/tutorials/policies/policies"}}>ACL policies</Hds::Link::Inline>.
+      They use
+      <Hds::Link::Inline
+        @isHrefExternal={{true}}
+        @href={{doc-link "/vault/docs/enterprise/sentinel"}}
+      >Sentinel</Hds::Link::Inline>
       as a language framework to enable fine-grained policy decisions.
     </p>
     <p>
       Here is an example policy that uses RGP to restrict access to the
-      <code class="tag is-marginless is-paddingless">admin</code>
+      <Hds::Text::Code class="code-in-text">admin</Hds::Text::Code>
       policy such that a user named "James Thomas" or has the
-      <code class="tag is-marginless is-paddingless">Team Lead</code>
+      <Hds::Text::Code class="code-in-text">Team Lead</Hds::Text::Code>
       role can manage the
-      <code class="tag is-marginless is-paddingless">admin</code>
+      <Hds::Text::Code class="code-in-text">admin</Hds::Text::Code>
       policy:
     </p>
   {{else}}
     <p class="has-bottom-margin-s" data-test-example-modal-text="egp">
       Endpoint Governing Policies (EGPs) are tied to particular paths (e.g.
-      <code class="tag is-marginless is-paddingless">aws/creds/</code>
+      <Hds::Text::Code class="code-in-text">aws/creds/</Hds::Text::Code>
       ) instead of tokens. They use
-      <ExternalLink @href="https://docs.hashicorp.com/sentinel/language">Sentinel</ExternalLink>
+      <Hds::Link::Inline
+        @isHrefExternal={{true}}
+        @href="https://docs.hashicorp.com/sentinel/language"
+      >Sentinel</Hds::Link::Inline>
       as a language to access
-      <DocLink @path="/vault/docs/enterprise/sentinel/properties">properties</DocLink>
+      <Hds::Link::Inline
+        @isHrefExternal={{true}}
+        @href={{doc-link "/vault/docs/enterprise/sentinel/properties"}}
+      >properties</Hds::Link::Inline>
       of the incoming requests.
     </p>
     <p>
@@ -42,21 +54,18 @@
     </p>
   {{/if}}
 </div>
-<JsonEditor
-  @value={{get this.policyTemplates @policyType}}
-  @mode="ruby"
-  @readOnly={{true}}
-  @showToolbar={{true}}
-  {{! Passed to copy button }}
-  @container={{@container}}
-/>
+<Hds::CodeBlock @value={{get this.policyTemplates @policyType}} @language="ruby" @hasCopyButton={{true}} />
 <div class="has-bottom-margin-m has-top-padding-s">
   <p>
     More information about
     {{uppercase @policyType}}
     policies can be found
-    <DocLink @path={{get this.moreInformationLinks @policyType}} data-test-example-modal-information-link>
+    <Hds::Link::Inline
+      @isHrefExternal={{true}}
+      @href={{doc-link (get this.moreInformationLinks @policyType)}}
+      data-test-example-modal-information-link
+    >
       here.
-    </DocLink>
+    </Hds::Link::Inline>
   </p>
 </div>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/policy-example.js b/ui/lib/core/addon/components/policy-example.js
index 0c6fdc3ecb6..ba3b4d9196b 100644
--- a/ui/lib/core/addon/components/policy-example.js
+++ b/ui/lib/core/addon/components/policy-example.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,17 +8,17 @@ import Component from '@glimmer/component';
 /**
  * @module PolicyExample
  * The PolicyExample component receives a policy type ('acl', 'rgp', or 'egp') and renders a copyable policy example of
- * that type using the <JsonEditor> component. Inside a modal, the PolicyExample component must be wrapped in a conditional
- * (example below), otherwise the <JsonEditor> value won't render until it's focused.
+ * that type using the JsonEditor component. Inside a modal, the PolicyExample component must be wrapped in a conditional
+ * (example below), otherwise the JsonEditor value won't render until it's focused.
  *
  * @example
- *  <PolicyExample
- *    @policyType={{@model.policyType}}
- *    @container="#search-select-modal"
- *  />
- * ```
+ * <PolicyExample @policyType="acl" />
+ * @example
+ * <PolicyExample @policyType="rgp" />
+ * @example
+ * <PolicyExample @policyType="egp" />
+ *
  * @param {string} policyType - policy type to decide which template to render; can either be "acl" or "rgp"
- * @param {string} container - selector for the container the example renders inside, passed to the copy button in JsonEditor
  */
 
 export default class PolicyExampleComponent extends Component {
diff --git a/ui/lib/core/addon/components/radio-button.hbs b/ui/lib/core/addon/components/radio-button.hbs
index a513d0b7491..952f7d62f2d 100644
--- a/ui/lib/core/addon/components/radio-button.hbs
+++ b/ui/lib/core/addon/components/radio-button.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <input
   ...attributes
diff --git a/ui/lib/core/addon/components/radio-card.hbs b/ui/lib/core/addon/components/radio-card.hbs
index 46b684d2058..5f141332ae1 100644
--- a/ui/lib/core/addon/components/radio-card.hbs
+++ b/ui/lib/core/addon/components/radio-card.hbs
@@ -1,51 +1,43 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <label
   for={{dasherize (or @title @value)}}
   class="radio-card {{if (eq @value @groupValue) 'is-selected'}} {{if @disabled 'is-disabled'}}"
+  {{! these extra parentheses are necessary to conditionally apply the modifier }}
+  {{! TODO: refactor this component and avoid this conditional modifier pattern }}
+  {{(if @tooltipMessage (modifier "hds-tooltip" @tooltipMessage))}}
   ...attributes
 >
-  <ToolTip @verticalPosition="above" @horizontalPosition="center" as |T|>
-    <T.Trigger tabindex="-1" class="radio-card-container">
-      {{#if (has-block)}}
-        {{yield}}
-      {{else}}
-        <div class="radio-card-row">
-          <div>
-            <Icon @name={{@icon}} @size="24" class={{or @iconClass "has-text-grey-light"}} />
-          </div>
-          <div class="has-left-margin-s">
-            <p class="radio-card-message-title">
-              {{@title}}
-            </p>
-            <p class="radio-card-message-body">
-              {{@description}}
-            </p>
-          </div>
-        </div>
-      {{/if}}
-      <div class="radio-card-radio-row">
-        <RadioButton
-          id={{dasherize (or @title @value)}}
-          name="config-mode"
-          class="radio"
-          @disabled={{@disabled}}
-          @value={{@value}}
-          @groupValue={{@groupValue}}
-          @onChange={{@onChange}}
-        />
-        <span class="dot"></span>
+  {{#if (has-block)}}
+    {{yield}}
+  {{else}}
+    <div class="radio-card-row">
+      <div>
+        <Icon @name={{@icon}} @size="24" class={{or @iconClass "has-text-grey-light"}} />
       </div>
-    </T.Trigger>
-    {{#if (and @disabled @disabledTooltipMessage)}}
-      <T.Content @defaultClass="tool-tip smaller-font">
-        <div class="box">
-          {{@disabledTooltipMessage}}
-        </div>
-      </T.Content>
-    {{/if}}
-  </ToolTip>
+      <div class="has-left-margin-s">
+        <p class="radio-card-message-title">
+          {{@title}}
+        </p>
+        <p class="radio-card-message-body">
+          {{@description}}
+        </p>
+      </div>
+    </div>
+  {{/if}}
+  <div class="radio-card-radio-row">
+    <RadioButton
+      id={{dasherize (or @title @value)}}
+      name="config-mode"
+      class="radio"
+      @disabled={{@disabled}}
+      @value={{@value}}
+      @groupValue={{@groupValue}}
+      @onChange={{@onChange}}
+    />
+    <span class="dot"></span>
+  </div>
 </label>
\ No newline at end of file
diff --git a/ui/lib/core/addon/templates/components/read-more.hbs b/ui/lib/core/addon/components/read-more.hbs
similarity index 93%
rename from ui/lib/core/addon/templates/components/read-more.hbs
rename to ui/lib/core/addon/components/read-more.hbs
index e7ce0afd9d6..76d2e4f2ff0 100644
--- a/ui/lib/core/addon/templates/components/read-more.hbs
+++ b/ui/lib/core/addon/components/read-more.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div
   class="has-text-grey has-font-weight-normal overflow-ellipsis {{if this.isOpen '' 'is-closed'}} "
diff --git a/ui/lib/core/addon/components/read-more.js b/ui/lib/core/addon/components/read-more.js
index 30b3162106d..e5cbcb6d405 100644
--- a/ui/lib/core/addon/components/read-more.js
+++ b/ui/lib/core/addon/components/read-more.js
@@ -1,26 +1,29 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
-import layout from '../templates/components/read-more';
-import { setComponentTemplate } from '@ember/component';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
 
 /**
  * @module ReadMore
+ * @description
  * ReadMore components are used to wrap long text that we'd like to show as one line initially with the option to expand and read.
  * Text which is shorter than the surrounding div will not truncate or show the See More button.
  *
  * @example
- * ```js
- * <ReadMore>My <em>super</em> long text goes in here</ReadMore>
- * ```
+ * <div style="width:100px;border: solid purple 2px; margin:20px">
+ * <ReadMore>My <em>super</em> long text goes in here.</ReadMore>
+ * </div>
+ *
+ * <div style="width:100px;border: solid purple 2px; margin:20px">
+ * <ReadMore>This text fits!</ReadMore>
+ * </div>
  */
 
-class ReadMoreComponent extends Component {
+export default class ReadMoreComponent extends Component {
   @action
   calculateOverflow(e) {
     const spanText = e.querySelector('.description-block');
@@ -40,5 +43,3 @@ class ReadMoreComponent extends Component {
     this.isOpen = !this.isOpen;
   }
 }
-
-export default setComponentTemplate(layout, ReadMoreComponent);
diff --git a/ui/lib/core/addon/templates/components/readonly-form-field.hbs b/ui/lib/core/addon/components/readonly-form-field.hbs
similarity index 82%
rename from ui/lib/core/addon/templates/components/readonly-form-field.hbs
rename to ui/lib/core/addon/components/readonly-form-field.hbs
index 56447ddd896..67cfeea547e 100644
--- a/ui/lib/core/addon/templates/components/readonly-form-field.hbs
+++ b/ui/lib/core/addon/components/readonly-form-field.hbs
@@ -1,16 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <label for={{@attr.name}} class="is-label" data-test-readonly-label>
   {{this.labelString}}
   {{#if @attr.options.helpText}}
-    <InfoTooltip>
-      <span data-test-help-text>
-        {{@attr.options.helpText}}
-      </span>
-    </InfoTooltip>
+    <Hds::TooltipButton @text={{@attr.options.helpText}} aria-label="More information">
+      <Hds::Icon @name="info" />
+    </Hds::TooltipButton>
   {{/if}}
 </label>
 {{#if @attr.options.subText}}
diff --git a/ui/lib/core/addon/components/readonly-form-field.js b/ui/lib/core/addon/components/readonly-form-field.js
index 3b0221490ac..6b5e3390b2c 100644
--- a/ui/lib/core/addon/components/readonly-form-field.js
+++ b/ui/lib/core/addon/components/readonly-form-field.js
@@ -1,27 +1,24 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 /**
  * @module ReadonlyFormField
- * ReadonlyFormField components are used to...
+ * ReadonlyFormField components are used to render an attribute that is read only
  *
  * @example
- * ```js
- * <ReadonlyFormField @attr={attr} />
- * ```
+ * <ReadonlyFormField @attr={{hash name="toDo" options=(hash label="To do task" helpText="helpful text")}} @value="Complete!"/>
+ *
  * @param {object} attr - Should be an attribute from a model exported with expandAttributeMeta
  * @param {any} value - The value that should be displayed on the input
  */
 
 import Component from '@glimmer/component';
-import { setComponentTemplate } from '@ember/component';
 import { capitalize, dasherize } from '@ember/string';
 import { humanize } from 'vault/helpers/humanize';
-import layout from '../templates/components/readonly-form-field';
 
-class ReadonlyFormField extends Component {
+export default class ReadonlyFormField extends Component {
   get labelString() {
     if (!this.args.attr) {
       return '';
@@ -37,5 +34,3 @@ class ReadonlyFormField extends Component {
     return '';
   }
 }
-
-export default setComponentTemplate(layout, ReadonlyFormField);
diff --git a/ui/lib/core/addon/templates/components/replication-action-demote.hbs b/ui/lib/core/addon/components/replication-action-demote.hbs
similarity index 95%
rename from ui/lib/core/addon/templates/components/replication-action-demote.hbs
rename to ui/lib/core/addon/components/replication-action-demote.hbs
index d70cb3096a1..956360425e6 100644
--- a/ui/lib/core/addon/templates/components/replication-action-demote.hbs
+++ b/ui/lib/core/addon/components/replication-action-demote.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="action-block is-rounded" data-test-demote-replication>
   <div class="action-block-info">
@@ -19,7 +19,7 @@
       @text="Demote"
       @color="secondary"
       {{on "click" (action (mut this.isModalActive) true)}}
-      data-test-replication-action-trigger="demote"
+      data-test-button="demote"
     />
   </div>
 </div>
diff --git a/ui/lib/core/addon/components/replication-action-demote.js b/ui/lib/core/addon/components/replication-action-demote.js
index 804e0d25284..920b29b2ffb 100644
--- a/ui/lib/core/addon/components/replication-action-demote.js
+++ b/ui/lib/core/addon/components/replication-action-demote.js
@@ -1,12 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Actions from 'core/components/replication-actions-single';
-import layout from '../templates/components/replication-action-demote';
 
 export default Actions.extend({
-  layout,
   tagName: '',
 });
diff --git a/ui/lib/core/addon/templates/components/replication-action-disable.hbs b/ui/lib/core/addon/components/replication-action-disable.hbs
similarity index 91%
rename from ui/lib/core/addon/templates/components/replication-action-disable.hbs
rename to ui/lib/core/addon/components/replication-action-disable.hbs
index 1ac951ee735..ed54313cd65 100644
--- a/ui/lib/core/addon/templates/components/replication-action-disable.hbs
+++ b/ui/lib/core/addon/components/replication-action-disable.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="action-block is-rounded" data-test-disable-replication>
   <div class="action-block-info">
@@ -20,7 +20,7 @@
       @text="Disable Replication"
       @color="critical"
       {{on "click" (action (mut this.isModalActive) true)}}
-      data-test-replication-action-trigger="disable"
+      data-test-button="disable"
     />
   </div>
 </div>
@@ -50,7 +50,6 @@
   <ul class="bullet">
     {{#if this.model.replicationAttrs.isPrimary}}
       <li>Secondaries will no longer be able to connect</li>
-      <li>We will wipe the underlying storage of connected secondaries</li>
       <li>Secondaries connecting back to the cluster will require a wipe of the underlying storage</li>
     {{else}}
       <li>We will wipe the underlying storage of this secondary when connected to a primary</li>
diff --git a/ui/lib/core/addon/components/replication-action-disable.js b/ui/lib/core/addon/components/replication-action-disable.js
index 77c5108e1f2..498da230513 100644
--- a/ui/lib/core/addon/components/replication-action-disable.js
+++ b/ui/lib/core/addon/components/replication-action-disable.js
@@ -1,13 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Actions from 'core/components/replication-actions-single';
-import layout from '../templates/components/replication-action-disable';
 
 export default Actions.extend({
-  layout,
   tagName: '',
 
   actions: {
diff --git a/ui/lib/core/addon/templates/components/replication-action-generate-token.hbs b/ui/lib/core/addon/components/replication-action-generate-token.hbs
similarity index 92%
rename from ui/lib/core/addon/templates/components/replication-action-generate-token.hbs
rename to ui/lib/core/addon/components/replication-action-generate-token.hbs
index e9a7170a7af..ab8f7414301 100644
--- a/ui/lib/core/addon/templates/components/replication-action-generate-token.hbs
+++ b/ui/lib/core/addon/components/replication-action-generate-token.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="action-block is-rounded" data-test-generate-token-replication>
   <div class="action-block-info">
@@ -18,7 +18,7 @@
       @text="Generate token"
       @color="secondary"
       {{on "click" (action (mut this.isModalActive) true)}}
-      data-test-replication-action-trigger
+      data-test-button="Generate token"
     />
   </div>
 </div>
diff --git a/ui/lib/core/addon/components/replication-action-generate-token.js b/ui/lib/core/addon/components/replication-action-generate-token.js
index 82b90ac96d1..5de9b052ecd 100644
--- a/ui/lib/core/addon/components/replication-action-generate-token.js
+++ b/ui/lib/core/addon/components/replication-action-generate-token.js
@@ -1,12 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Actions from './replication-actions-single';
-import layout from '../templates/components/replication-action-generate-token';
 
 export default Actions.extend({
-  layout,
   tagName: '',
 });
diff --git a/ui/lib/core/addon/templates/components/replication-action-promote.hbs b/ui/lib/core/addon/components/replication-action-promote.hbs
similarity index 96%
rename from ui/lib/core/addon/templates/components/replication-action-promote.hbs
rename to ui/lib/core/addon/components/replication-action-promote.hbs
index 7f888392ee4..ee17121c708 100644
--- a/ui/lib/core/addon/templates/components/replication-action-promote.hbs
+++ b/ui/lib/core/addon/components/replication-action-promote.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="action-block is-rounded" data-test-promote-replication>
   <div class="action-block-info">
     <h3 class="title is-5 is-marginless">
       Promote cluster
     </h3>
-    <p class="has-top-padding-s">
+    <p class="has-top-padding-s" data-test-promote-description>
       Promote this cluster to a
       {{this.model.replicationModeForDisplay}}
       primary
@@ -20,7 +20,7 @@
       @text="Promote"
       @color="secondary"
       {{on "click" (action (mut this.isModalActive) true)}}
-      data-test-replication-action-trigger="promote"
+      data-test-button="promote"
     />
   </div>
 </div>
diff --git a/ui/lib/core/addon/components/replication-action-promote.js b/ui/lib/core/addon/components/replication-action-promote.js
index 2677574b2a4..5de9b052ecd 100644
--- a/ui/lib/core/addon/components/replication-action-promote.js
+++ b/ui/lib/core/addon/components/replication-action-promote.js
@@ -1,12 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Actions from './replication-actions-single';
-import layout from '../templates/components/replication-action-promote';
 
 export default Actions.extend({
-  layout,
   tagName: '',
 });
diff --git a/ui/lib/core/addon/templates/components/replication-action-recover.hbs b/ui/lib/core/addon/components/replication-action-recover.hbs
similarity index 93%
rename from ui/lib/core/addon/templates/components/replication-action-recover.hbs
rename to ui/lib/core/addon/components/replication-action-recover.hbs
index e664802acd6..bdd5ef799bf 100644
--- a/ui/lib/core/addon/templates/components/replication-action-recover.hbs
+++ b/ui/lib/core/addon/components/replication-action-recover.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="action-block is-rounded" data-test-recover-replication>
   <div class="action-block-info">
@@ -18,7 +18,7 @@
       @text="Recover"
       @color="secondary"
       {{on "click" (action (mut this.isModalActive) true)}}
-      data-test-replication-action-trigger="recover"
+      data-test-button="recover"
     />
   </div>
 </div>
diff --git a/ui/lib/core/addon/components/replication-action-recover.js b/ui/lib/core/addon/components/replication-action-recover.js
index 1967151289e..920b29b2ffb 100644
--- a/ui/lib/core/addon/components/replication-action-recover.js
+++ b/ui/lib/core/addon/components/replication-action-recover.js
@@ -1,12 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Actions from 'core/components/replication-actions-single';
-import layout from '../templates/components/replication-action-recover';
 
 export default Actions.extend({
-  layout,
   tagName: '',
 });
diff --git a/ui/lib/core/addon/templates/components/replication-action-reindex.hbs b/ui/lib/core/addon/components/replication-action-reindex.hbs
similarity index 94%
rename from ui/lib/core/addon/templates/components/replication-action-reindex.hbs
rename to ui/lib/core/addon/components/replication-action-reindex.hbs
index 8432b4e181c..595cf2a596f 100644
--- a/ui/lib/core/addon/templates/components/replication-action-reindex.hbs
+++ b/ui/lib/core/addon/components/replication-action-reindex.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="action-block is-rounded" data-test-reindex-replication>
   <div class="action-block-info">
@@ -17,7 +17,7 @@
       @text="Reindex"
       @color="secondary"
       {{on "click" (action (mut this.isModalActive) true)}}
-      data-test-replication-action-trigger="reindex"
+      data-test-button="reindex"
     />
   </div>
 </div>
diff --git a/ui/lib/core/addon/components/replication-action-reindex.js b/ui/lib/core/addon/components/replication-action-reindex.js
index 2faa3c1d108..920b29b2ffb 100644
--- a/ui/lib/core/addon/components/replication-action-reindex.js
+++ b/ui/lib/core/addon/components/replication-action-reindex.js
@@ -1,12 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Actions from 'core/components/replication-actions-single';
-import layout from '../templates/components/replication-action-reindex';
 
 export default Actions.extend({
-  layout,
   tagName: '',
 });
diff --git a/ui/lib/core/addon/templates/components/replication-action-update-primary.hbs b/ui/lib/core/addon/components/replication-action-update-primary.hbs
similarity index 97%
rename from ui/lib/core/addon/templates/components/replication-action-update-primary.hbs
rename to ui/lib/core/addon/components/replication-action-update-primary.hbs
index 5ab2f1dbed2..9913d93203a 100644
--- a/ui/lib/core/addon/templates/components/replication-action-update-primary.hbs
+++ b/ui/lib/core/addon/components/replication-action-update-primary.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="action-block is-rounded" data-test-update-primary-replication>
   <div class="action-block-info">
@@ -18,7 +18,7 @@
       @text="Update"
       @color="secondary"
       {{on "click" (action (mut this.isModalActive) true)}}
-      data-test-replication-action-trigger="update-primary"
+      data-test-button="update-primary"
     />
   </div>
 </div>
diff --git a/ui/lib/core/addon/components/replication-action-update-primary.js b/ui/lib/core/addon/components/replication-action-update-primary.js
index 8d45009d04a..5de9b052ecd 100644
--- a/ui/lib/core/addon/components/replication-action-update-primary.js
+++ b/ui/lib/core/addon/components/replication-action-update-primary.js
@@ -1,12 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Actions from './replication-actions-single';
-import layout from '../templates/components/replication-action-update-primary';
 
 export default Actions.extend({
-  layout,
   tagName: '',
 });
diff --git a/ui/lib/core/addon/components/replication-actions-single.js b/ui/lib/core/addon/components/replication-actions-single.js
index 92950ddf2d1..38e0e51d8cc 100644
--- a/ui/lib/core/addon/components/replication-actions-single.js
+++ b/ui/lib/core/addon/components/replication-actions-single.js
@@ -1,10 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@ember/component';
 
+/**
+ * @type Class
+ */
 export default Component.extend({
   onSubmit() {},
   replicationMode: null,
diff --git a/ui/lib/core/addon/templates/components/replication-actions.hbs b/ui/lib/core/addon/components/replication-actions.hbs
similarity index 95%
rename from ui/lib/core/addon/templates/components/replication-actions.hbs
rename to ui/lib/core/addon/components/replication-actions.hbs
index 718ad28a151..0ded53d687e 100644
--- a/ui/lib/core/addon/templates/components/replication-actions.hbs
+++ b/ui/lib/core/addon/components/replication-actions.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.loading}}
   <LayoutLoading />
diff --git a/ui/lib/core/addon/components/replication-actions.js b/ui/lib/core/addon/components/replication-actions.js
index 506e717e8b6..111f5462869 100644
--- a/ui/lib/core/addon/components/replication-actions.js
+++ b/ui/lib/core/addon/components/replication-actions.js
@@ -1,28 +1,26 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { alias } from '@ember/object/computed';
 import Component from '@ember/component';
 import ReplicationActions from 'core/mixins/replication-actions';
-import layout from '../templates/components/replication-actions';
-import { A } from '@ember/array';
 
 const DEFAULTS = {
   token: null,
   primary_api_addr: null,
   primary_cluster_addr: null,
-  errors: A(),
+  errors: null,
   id: null,
   force: false,
 };
 
 export default Component.extend(ReplicationActions, DEFAULTS, {
-  layout,
   replicationMode: null,
   model: null,
   cluster: alias('model'),
+
   reset() {
     if (!this || this.isDestroyed || this.isDestroying) {
       return;
diff --git a/ui/lib/core/addon/templates/components/replication-dashboard.hbs b/ui/lib/core/addon/components/replication-dashboard.hbs
similarity index 82%
rename from ui/lib/core/addon/templates/components/replication-dashboard.hbs
rename to ui/lib/core/addon/components/replication-dashboard.hbs
index 27f0e12bae8..b3017b9a29e 100644
--- a/ui/lib/core/addon/templates/components/replication-dashboard.hbs
+++ b/ui/lib/core/addon/components/replication-dashboard.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="replication-dashboard box is-sideless is-fullwidth is-marginless" data-test-replication-dashboard>
   {{#if this.isReindexing}}
@@ -22,7 +22,7 @@
       </Hds::Alert>
     </div>
   {{/if}}
-  {{#if this.isSummaryDashboard}}
+  {{#if @isSummaryDashboard}}
     <div class="summary-state">
       <h6 class="title is-5 {{if (not (get (cluster-states this.summaryState) 'isOk')) 'has-text-danger'}}" data-test-error>
         state
@@ -47,15 +47,15 @@
       </h2>
     </div>
     <div class="selectable-card-container summary" data-test-selectable-card-container-summary>
-      {{yield (hash card=(component this.componentToRender replicationDetails=this.replicationDetailsSummary))}}
+      {{yield (hash card=(component @componentToRender replicationDetails=@replicationDetailsSummary))}}
     </div>
   {{else}}
     <div
-      class="selectable-card-container {{if this.isSecondary 'secondary' 'primary'}}"
-      data-test-selectable-card-container={{if this.isSecondary "secondary" "primary"}}
+      class="selectable-card-container {{if @isSecondary 'secondary' 'primary'}}"
+      data-test-selectable-card-container={{if @isSecondary "secondary" "primary"}}
     >
-      {{yield (hash card=(component this.componentToRender replicationDetails=this.replicationDetails))}}
-      {{#unless this.isSecondary}}
+      {{yield (hash card=(component @componentToRender replicationDetails=@replicationDetails))}}
+      {{#unless @isSecondary}}
         {{yield (hash secondaryCard=(component "known-secondaries-card"))}}
       {{/unless}}
     </div>
@@ -71,8 +71,8 @@
       </Hds::Alert>
     </div>
   {{/if}}
-  {{#unless this.isSummaryDashboard}}
-    <ReplicationTableRows @replicationDetails={{this.replicationDetails}} @clusterMode={{this.clusterMode}} />
+  {{#unless @isSummaryDashboard}}
+    <ReplicationTableRows @replicationDetails={{@replicationDetails}} @clusterMode={{@clusterMode}} />
     <div class="replication helper-text float-right" data-test-replication-doc-link>
       <p class="has-text-grey">
         We have additional time series telemetry that can be found
diff --git a/ui/lib/core/addon/components/replication-dashboard.js b/ui/lib/core/addon/components/replication-dashboard.js
index 86ded922b8d..6c0c35526c5 100644
--- a/ui/lib/core/addon/components/replication-dashboard.js
+++ b/ui/lib/core/addon/components/replication-dashboard.js
@@ -1,13 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Component from '@ember/component';
-import { computed } from '@ember/object';
+import Component from '@glimmer/component';
 import { clusterStates } from 'core/helpers/cluster-states';
 import { capitalize } from '@ember/string';
-import layout from '../templates/components/replication-dashboard';
 
 /**
  * @module ReplicationDashboard
@@ -18,7 +16,6 @@ import layout from '../templates/components/replication-dashboard';
  * @example
  * ```js
  * <ReplicationDashboard
-    @data={{model}}
     @componentToRender='replication-primary-card'
     @isSecondary=false
     @isSummaryDashboard=false
@@ -28,7 +25,6 @@ import layout from '../templates/components/replication-dashboard';
     @reindexingDetails={{reindexingDetails}}
     />
  * ```
- * @param {Object} data=null - An Ember data object that is pulled from the Ember Cluster Model.
  * @param {String} [componentToRender=''] - A string that determines which card component is displayed.  There are three options, replication-primary-card, replication-secondary-card, replication-summary-card.
  * @param {Boolean} [isSecondary=false] - Used to determine the title and display logic.
  * @param {Boolean} [isSummaryDashboard=false] -  Only true when the cluster is both a dr and performance primary. If true, replicationDetailsSummary is populated and used to pass through the cluster details.
@@ -38,34 +34,25 @@ import layout from '../templates/components/replication-dashboard';
  * @param {Object} reindexingDetails=null - An Ember data object used to show a reindexing progress bar.
  */
 
-export default Component.extend({
-  layout,
-  componentToRender: '',
-  data: null,
-  isSecondary: false,
-  isSummaryDashboard: false,
-  replicationDetails: null,
-  replicationDetailsSummary: null,
-  isSyncing: computed('replicationDetails.state', 'isSecondary', function () {
-    const { state } = this.replicationDetails;
-    const isSecondary = this.isSecondary;
+export default class ReplicationDashboard extends Component {
+  get isSyncing() {
+    const { state } = this.args.replicationDetails;
+    const isSecondary = this.args.isSecondary;
     return isSecondary && state && clusterStates([state]).isSyncing;
-  }),
-  isReindexing: computed('replicationDetails.reindex_in_progress', function () {
-    const { replicationDetails } = this;
-    return !!replicationDetails.reindex_in_progress;
-  }),
-  reindexingStage: computed('replicationDetails.reindex_stage', function () {
-    const { replicationDetails } = this;
-    const stage = replicationDetails.reindex_stage;
+  }
+  get isReindexing() {
+    return !!this.args.replicationDetails.reindex_in_progress;
+  }
+  get reindexingStage() {
+    const stage = this.args.replicationDetails.reindex_stage;
     // specify the stage if we have one
     if (stage) {
       return `: ${capitalize(stage)}`;
     }
     return '';
-  }),
-  progressBar: computed('replicationDetails.{reindex_building_progress,reindex_building_total}', function () {
-    const { reindex_building_progress, reindex_building_total } = this.replicationDetails;
+  }
+  get progressBar() {
+    const { reindex_building_progress, reindex_building_total } = this.args.replicationDetails;
     let progressBar = null;
 
     if (reindex_building_progress && reindex_building_total) {
@@ -76,9 +63,9 @@ export default Component.extend({
     }
 
     return progressBar;
-  }),
-  summaryState: computed('replicationDetailsSummary.{dr.state,performance.state}', function () {
-    const { replicationDetailsSummary } = this;
+  }
+  get summaryState() {
+    const { replicationDetailsSummary } = this.args;
     const drState = replicationDetailsSummary.dr.state;
     const performanceState = replicationDetailsSummary.performance.state;
 
@@ -90,11 +77,11 @@ export default Component.extend({
     }
 
     return drState;
-  }),
-  reindexMessage: computed('isSecondary', 'progressBar', function () {
-    if (!this.isSecondary) {
+  }
+  get reindexMessage() {
+    if (!this.args.isSecondary) {
       return 'This can cause a delay depending on the size of the data store. You can <b>not</b> use Vault during this time.';
     }
     return 'This can cause a delay depending on the size of the data store. You can use Vault during this time.';
-  }),
-});
+  }
+}
diff --git a/ui/lib/core/addon/components/replication-header.hbs b/ui/lib/core/addon/components/replication-header.hbs
new file mode 100644
index 00000000000..00c56e76bc5
--- /dev/null
+++ b/ui/lib/core/addon/components/replication-header.hbs
@@ -0,0 +1,57 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader data-test-replication-header as |p|>
+  <p.top>
+    {{#if (not (or @isSummaryDashboard @isSecondary))}}
+      <Hds::Breadcrumb>
+        <Hds::Breadcrumb::Item @text="Replication" @route="vault.cluster.replication.index" />
+        <Hds::Breadcrumb::Item @text={{@title}} @current={{true}} />
+      </Hds::Breadcrumb>
+    {{/if}}
+  </p.top>
+  <p.levelLeft>
+    <h1 class="title is-3" data-test-replication-title={{@title}}>
+      {{@title}}
+      {{#if @data.anyReplicationEnabled}}
+        <Hds::Badge @text={{if @isSecondary "secondary" "primary"}} data-test-mode />
+        {{#if @secondaryId}}
+          <Hds::Badge @text={{@secondaryId}} data-test-secondaryId />
+        {{/if}}
+      {{/if}}
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+{{#if @showTabs}}
+  <div class="tabs-container box is-bottomless is-fullwidth is-paddingless has-bottom-margin-l" data-test-tabs>
+    <nav class="tabs">
+      {{#if @isSummaryDashboard}}
+        <ul>
+          <li class="is-active">
+            <LinkToExternal @route="replication">Summary</LinkToExternal>
+          </li>
+        </ul>
+      {{else}}
+        <ul>
+          <li>
+            <LinkTo @route="vault.cluster.replication-dr-promote.details" data-test-link-to="Details">
+              Details
+            </LinkTo>
+          </li>
+          <li>
+            <LinkTo
+              @route="vault.cluster.replication-dr-promote"
+              @current-when="vault.cluster.replication-dr-promote.index"
+              data-test-link-to="Manage"
+            >
+              Manage
+            </LinkTo>
+          </li>
+        </ul>
+      {{/if}}
+    </nav>
+  </div>
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/replication-header.js b/ui/lib/core/addon/components/replication-header.js
deleted file mode 100644
index 2d48a60fe96..00000000000
--- a/ui/lib/core/addon/components/replication-header.js
+++ /dev/null
@@ -1,37 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@ember/component';
-import layout from '../templates/components/replication-header';
-
-/**
- * @module ReplicationHeader
- * The `ReplicationHeader` is a header component used on the Replication Dashboards.
- *
- * @example
- * ```js
- * <ReplicationHeader
-    @data={{model}}
-    @title="Secondary"
-    @secondaryID="meep_123"
-    @isSummaryDashboard=false
-    />
- * ```
- * @param {Object} model=null - An Ember data object pulled from the Ember cluster model.
- * @param {String} title=null - The title of the header.
- * @param {String} [secondaryID=null] - The secondaryID pulled off of the model object.
- * @param {Boolean} isSummaryDashboard=false - True when you have both a primary performance and dr cluster dashboard.
- */
-
-export default Component.extend({
-  layout,
-  data: null,
-  classNames: ['replication-header'],
-  isSecondary: null,
-  secondaryId: null,
-  isSummaryDashboard: false,
-  'data-test-replication-header': true,
-  attributeBindings: ['data-test-replication-header'],
-});
diff --git a/ui/lib/core/addon/components/replication-mode-summary.js b/ui/lib/core/addon/components/replication-mode-summary.js
deleted file mode 100644
index 0938b0399dc..00000000000
--- a/ui/lib/core/addon/components/replication-mode-summary.js
+++ /dev/null
@@ -1,68 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { service } from '@ember/service';
-import { equal } from '@ember/object/computed';
-import { get, computed } from '@ember/object';
-import Component from '@ember/component';
-import layout from '../templates/components/replication-mode-summary';
-
-const replicationAttr = function (attr) {
-  return computed(`cluster.{dr,performance}.${attr}`, 'cluster', 'mode', function () {
-    const { mode, cluster } = this;
-    return get(cluster, `${mode}.${attr}`);
-  });
-};
-export default Component.extend({
-  layout,
-  version: service(),
-  router: service(),
-  namespace: service(),
-  classNameBindings: ['isMenu::box'],
-  attributeBindings: ['href', 'target'],
-  display: 'banner',
-  isMenu: equal('display', 'menu'),
-  href: computed(
-    'cluster.id',
-    'display',
-    'mode',
-    'replicationEnabled',
-    'version.hasPerfReplication',
-    function () {
-      const display = this.display;
-      const mode = this.mode;
-      if (mode === 'performance' && display === 'menu' && this.version.hasPerfReplication === false) {
-        return 'https://www.hashicorp.com/products/vault';
-      }
-      if (this.replicationEnabled || display === 'menu') {
-        return this.router.urlFor('vault.cluster.replication.mode.index', this.cluster.id, mode);
-      }
-      return null;
-    }
-  ),
-  target: computed('isPerformance', 'version.hasPerfReplication', function () {
-    if (this.isPerformance && this.version.hasPerfReplication === false) {
-      return '_blank';
-    }
-    return null;
-  }),
-  internalLink: false,
-  isPerformance: equal('mode', 'performance'),
-  replicationEnabled: replicationAttr('replicationEnabled'),
-  replicationUnsupported: equal('cluster.mode', 'unsupported'),
-  replicationDisabled: replicationAttr('replicationDisabled'),
-  syncProgressPercent: replicationAttr('syncProgressPercent'),
-  syncProgress: replicationAttr('syncProgress'),
-  secondaryId: replicationAttr('secondaryId'),
-  modeForUrl: replicationAttr('modeForUrl'),
-  clusterIdDisplay: replicationAttr('clusterIdDisplay'),
-  mode: null,
-  cluster: null,
-  modeState: computed('cluster', 'mode', function () {
-    const { cluster, mode } = this;
-    const clusterState = cluster[mode].state;
-    return clusterState;
-  }),
-});
diff --git a/ui/lib/core/addon/templates/components/replication-page.hbs b/ui/lib/core/addon/components/replication-page.hbs
similarity index 79%
rename from ui/lib/core/addon/templates/components/replication-page.hbs
rename to ui/lib/core/addon/components/replication-page.hbs
index 8d7e5e96776..20adca04448 100644
--- a/ui/lib/core/addon/templates/components/replication-page.hbs
+++ b/ui/lib/core/addon/components/replication-page.hbs
@@ -1,9 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<div class="replication-page" data-test-replication-page>
+<div
+  class="replication-page"
+  {{did-insert this.onModeUpdate @model.replicationMode}}
+  {{did-update this.onModeUpdate @model.replicationMode}}
+  data-test-replication-page
+>
   {{#if this.isLoadingData}}
     <LayoutLoading />
   {{else}}
@@ -11,7 +16,7 @@
       (hash
         header=(component
           "replication-header"
-          data=this.model
+          data=@model
           title=this.formattedReplicationMode
           isSecondary=this.isSecondary
           secondaryId=this.replicationDetails.secondaryId
@@ -20,7 +25,6 @@
         )
         dashboard=(component
           "replication-dashboard"
-          data=this.model
           isSecondary=this.isSecondary
           isSummaryDashboard=this.isSummaryDashboard
           replicationDetailsSummary=this.replicationDetailsSummary
diff --git a/ui/lib/core/addon/components/replication-page.js b/ui/lib/core/addon/components/replication-page.js
index 40a11db8484..48f9b39acec 100644
--- a/ui/lib/core/addon/components/replication-page.js
+++ b/ui/lib/core/addon/components/replication-page.js
@@ -1,13 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Component from '@ember/component';
-import { computed } from '@ember/object';
-import layout from '../templates/components/replication-page';
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
 import { service } from '@ember/service';
 import { task } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+import { getOwner } from '@ember/owner';
 
 /**
  * @module ReplicationPage
@@ -15,12 +17,9 @@ import { task } from 'ember-concurrency';
  * It is the top level component on routes displaying replication dashboards.
  *
  * @example
- * ```js
- * <ReplicationPage
-    @model={{cluster}}
-    />
- * ```
- * @param {Object} cluster=null - An Ember data object that is pulled from the Ember Cluster Model.
+ * <ReplicationPage @model={{cluster}}/>
+ *
+ * @param {Object} model=null - An Ember data object that is pulled from the Ember Cluster Model.
  */
 
 const MODE = {
@@ -28,19 +27,25 @@ const MODE = {
   performance: 'Performance',
 };
 
-export default Component.extend({
-  layout,
-  store: service(),
-  router: service(),
-  reindexingDetails: null,
-  didReceiveAttrs() {
-    this._super(arguments);
-    this.getReplicationModeStatus.perform();
-  },
-  getReplicationModeStatus: task(function* () {
-    let resp;
-    const { replicationMode } = this.model;
+export default class ReplicationPage extends Component {
+  @service store;
+  @tracked reindexingDetails = null;
+
+  // This component renders both within and outside the replication engine so we have to dynamically look up the router
+  get router() {
+    const owner = getOwner(this);
+    return owner.lookup('service:router') || owner.lookup('service:app-router');
+  }
 
+  @action onModeUpdate(evt, replicationMode) {
+    // Called on did-insert and did-update
+    this.getReplicationModeStatus.perform(replicationMode);
+  }
+
+  @task
+  @waitFor
+  *getReplicationModeStatus(replicationMode) {
+    let resp;
     if (this.isSummaryDashboard) {
       // the summary dashboard is not mode specific and will error
       // while running replication/null/status in the replication-mode adapter
@@ -51,97 +56,82 @@ export default Component.extend({
       resp = yield this.store.adapterFor('replication-mode').fetchStatus(replicationMode);
     } catch (e) {
       // do not handle error
+    } finally {
+      this.reindexingDetails = resp;
     }
-    this.set('reindexingDetails', resp);
-  }),
-  isSummaryDashboard: computed('model.{performance.mode,dr.mode}', function () {
-    const router = this.router;
-    const currentRoute = router.get('currentRouteName');
+  }
+  get isSummaryDashboard() {
+    const currentRoute = this.router.currentRouteName;
 
     // we only show the summary dashboard in the replication index route
     if (currentRoute === 'vault.cluster.replication.index') {
-      const drMode = this.model.dr.mode;
-      const performanceMode = this.model.performance.mode;
+      const drMode = this.args.model.dr.mode;
+      const performanceMode = this.args.model.performance.mode;
       return drMode === 'primary' && performanceMode === 'primary';
     }
     return '';
-  }),
-  formattedReplicationMode: computed('model.replicationMode', 'isSummaryDashboard', function () {
+  }
+  get formattedReplicationMode() {
     // dr or performance 🤯
-    const { isSummaryDashboard } = this;
-    if (isSummaryDashboard) {
+    if (this.isSummaryDashboard) {
       return 'Disaster Recovery & Performance';
     }
-    const mode = this.model.replicationMode;
+    const mode = this.args.model.replicationMode;
     return MODE[mode];
-  }),
-  clusterMode: computed('model.replicationAttrs', 'isSummaryDashboard', function () {
+  }
+  get clusterMode() {
     // primary or secondary
-    const { model } = this;
-    const { isSummaryDashboard } = this;
-    if (isSummaryDashboard) {
+    if (this.isSummaryDashboard) {
       // replicationAttrs does not exist when summaryDashboard
       return 'primary';
     }
-    return model.replicationAttrs.mode;
-  }),
-  isLoadingData: computed('clusterMode', 'model.replicationAttrs', function () {
-    const { clusterMode } = this;
-    const { model } = this;
-    const { isSummaryDashboard } = this;
-    if (isSummaryDashboard) {
+    return this.args.model.replicationAttrs.mode;
+  }
+  get isLoadingData() {
+    if (this.isSummaryDashboard) {
       return false;
     }
-    const clusterId = model.replicationAttrs.clusterId;
-    const replicationDisabled = model.replicationAttrs.replicationDisabled;
-    if (clusterMode === 'bootstrapping' || (!clusterId && !replicationDisabled)) {
+    const { clusterId, replicationDisabled } = this.args.model.replicationAttrs;
+    if (this.clusterMode === 'bootstrapping' || (!clusterId && !replicationDisabled)) {
       // if clusterMode is bootstrapping
       // if no clusterId, the data hasn't loaded yet, wait for another status endpoint to be called
       return true;
     }
     return false;
-  }),
-  isSecondary: computed('clusterMode', function () {
-    const { clusterMode } = this;
-    return clusterMode === 'secondary';
-  }),
-  replicationDetailsSummary: computed('isSummaryDashboard', function () {
-    const { model } = this;
-    const { isSummaryDashboard } = this;
-    if (!isSummaryDashboard) {
-      return;
-    }
-    if (isSummaryDashboard) {
+  }
+  get isSecondary() {
+    return this.clusterMode === 'secondary';
+  }
+  get replicationDetailsSummary() {
+    if (this.isSummaryDashboard) {
       const combinedObject = {};
-      combinedObject.dr = model['dr'];
-      combinedObject.performance = model['performance'];
+      combinedObject.dr = this.args.model['dr'];
+      combinedObject.performance = this.args.model['performance'];
       return combinedObject;
     }
     return {};
-  }),
-  replicationDetails: computed('model.replicationMode', 'isSummaryDashboard', function () {
-    const { model } = this;
-    const { isSummaryDashboard } = this;
-    if (isSummaryDashboard) {
+  }
+  get replicationDetails() {
+    if (this.isSummaryDashboard) {
       // Cannot return null
       return {};
     }
-    const replicationMode = model.replicationMode;
-    return model[replicationMode];
-  }),
-  isDisabled: computed('replicationDetails.mode', function () {
+    const { replicationMode } = this.args.model;
+    return this.args.model[replicationMode];
+  }
+  get isDisabled() {
     if (this.replicationDetails.mode === 'disabled' || this.replicationDetails.mode === 'primary') {
       return true;
     }
     return false;
-  }),
-  message: computed('model.anyReplicationEnabled', 'formattedReplicationMode', function () {
+  }
+  get message() {
     let msg;
-    if (this.model.anyReplicationEnabled) {
+    if (this.args.model.anyReplicationEnabled) {
       msg = `This ${this.formattedReplicationMode} secondary has not been enabled.  You can do so from the ${this.formattedReplicationMode} Primary.`;
     } else {
       msg = `This cluster has not been enabled as a ${this.formattedReplicationMode} Secondary. You can do so by enabling replication and adding a secondary from the ${this.formattedReplicationMode} Primary.`;
     }
     return msg;
-  }),
-});
+  }
+}
diff --git a/ui/lib/core/addon/templates/components/replication-secondary-card.hbs b/ui/lib/core/addon/components/replication-secondary-card.hbs
similarity index 91%
rename from ui/lib/core/addon/templates/components/replication-secondary-card.hbs
rename to ui/lib/core/addon/components/replication-secondary-card.hbs
index 20be39dc813..5eab344ca9d 100644
--- a/ui/lib/core/addon/templates/components/replication-secondary-card.hbs
+++ b/ui/lib/core/addon/components/replication-secondary-card.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container
   @hasBorder={{true}}
@@ -57,16 +57,9 @@
     <h2 class="title is-3 grid-item-bottom-left" data-test-state>
       {{this.state}}
       {{#if this.inSyncState}}
-        <ToolTip @verticalPosition="above" as |T|>
-          <T.Trigger>
-            <Icon @name="check-circle" class="has-text-success" data-test-glyph />
-          </T.Trigger>
-          <T.Content @defaultClass="tool-tip">
-            <div class="box">
-              Everything is in sync
-            </div>
-          </T.Content>
-        </ToolTip>
+        <Hds::TooltipButton @text="Everything is in sync" class="is-inline-block" aria-label="Successful sync state">
+          <Icon @name="check-circle" class="has-text-success" />
+        </Hds::TooltipButton>
       {{/if}}
     </h2>
     <p class="title is-3 grid-item-bottom-right" data-test-connection>
@@ -113,7 +106,7 @@
             @text="These addresses are used by the secondary to communicate with the primary cluster. Should always be non-zero in a functioning replication setup."
           />
           <A.Footer @hasDivider={{true}} as |F|>
-            <F.Link::Standalone
+            <F.LinkStandalone
               @icon="help"
               @text="Learn more about replication"
               @href={{doc-link "/vault/tutorials/monitoring/monitor-replication"}}
diff --git a/ui/lib/core/addon/components/replication-secondary-card.js b/ui/lib/core/addon/components/replication-secondary-card.js
index eb9cc760817..934674be3c8 100644
--- a/ui/lib/core/addon/components/replication-secondary-card.js
+++ b/ui/lib/core/addon/components/replication-secondary-card.js
@@ -1,12 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { equal, reads } from '@ember/object/computed';
 import Component from '@ember/component';
 import { computed } from '@ember/object';
-import layout from '../templates/components/replication-secondary-card';
 import { clusterStates } from 'core/helpers/cluster-states';
 
 /**
@@ -25,24 +24,28 @@ import { clusterStates } from 'core/helpers/cluster-states';
  */
 
 export default Component.extend({
-  layout,
   tagName: '',
   title: null,
   replicationDetails: null,
+
   state: computed('replicationDetails.state', function () {
     return this.replicationDetails && this.replicationDetails.state
       ? this.replicationDetails.state
       : 'unknown';
   }),
+
   connection: computed('replicationDetails.connection_state', function () {
     return this.replicationDetails.connection_state ? this.replicationDetails.connection_state : 'unknown';
   }),
+
   lastRemoteWAL: computed('replicationDetails.lastRemoteWAL', function () {
     return this.replicationDetails && this.replicationDetails.lastRemoteWAL
       ? this.replicationDetails.lastRemoteWAL
       : 0;
   }),
+
   inSyncState: equal('state', 'stream-wals'),
+
   hasErrorClass: computed('replicationDetails', 'title', 'state', 'connection', function () {
     const { title, state, connection } = this;
 
@@ -54,7 +57,9 @@ export default Component.extend({
     }
     return false;
   }),
+
   knownPrimaryClusterAddrs: reads('replicationDetails.knownPrimaryClusterAddrs'),
+
   primaryUiUrl: computed('replicationDetails.{primaries,knownPrimaryClusterAddrs}', function () {
     const { replicationDetails } = this;
     if (replicationDetails.primaries && replicationDetails.primaries.length) {
diff --git a/ui/lib/core/addon/components/replication-summary-card.hbs b/ui/lib/core/addon/components/replication-summary-card.hbs
index 54f7d93b9b0..f60fa458c59 100644
--- a/ui/lib/core/addon/components/replication-summary-card.hbs
+++ b/ui/lib/core/addon/components/replication-summary-card.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container
   @hasBorder={{true}}
diff --git a/ui/lib/core/addon/components/replication-summary-card.js b/ui/lib/core/addon/components/replication-summary-card.js
index 21a15ec8967..df6a07f37fb 100644
--- a/ui/lib/core/addon/components/replication-summary-card.js
+++ b/ui/lib/core/addon/components/replication-summary-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/templates/components/replication-table-rows.hbs b/ui/lib/core/addon/components/replication-table-rows.hbs
similarity index 96%
rename from ui/lib/core/addon/templates/components/replication-table-rows.hbs
rename to ui/lib/core/addon/components/replication-table-rows.hbs
index 64df6eaaac0..d0a32ac6dd6 100644
--- a/ui/lib/core/addon/templates/components/replication-table-rows.hbs
+++ b/ui/lib/core/addon/components/replication-table-rows.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="has-top-margin-xl has-bottom-margin-s" data-test-table-rows>
   {{#if (eq this.clusterMode "secondary")}}
diff --git a/ui/lib/core/addon/components/replication-table-rows.js b/ui/lib/core/addon/components/replication-table-rows.js
index 22d9c21a458..8bf4b499b84 100644
--- a/ui/lib/core/addon/components/replication-table-rows.js
+++ b/ui/lib/core/addon/components/replication-table-rows.js
@@ -1,12 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { reads } from '@ember/object/computed';
 import Component from '@ember/component';
 import { computed } from '@ember/object';
-import layout from '../templates/components/replication-table-rows';
 
 /**
  * @module ReplicationTableRows
@@ -24,17 +23,19 @@ import layout from '../templates/components/replication-table-rows';
  */
 
 export default Component.extend({
-  layout,
   classNames: ['replication-table-rows'],
   replicationDetails: null,
   clusterMode: null,
   secondaryId: reads('replicationDetails.secondaryId'),
+
   primaryClusterAddr: computed('replicationDetails.primaryClusterAddr', function () {
     return this.replicationDetails.primaryClusterAddr || 'None set';
   }),
+
   merkleRoot: computed('replicationDetails.merkleRoot', function () {
     return this.replicationDetails.merkleRoot || 'unknown';
   }),
+
   clusterId: computed('replicationDetails.clusterId', function () {
     return this.replicationDetails.clusterId || 'unknown';
   }),
diff --git a/ui/lib/core/addon/components/search-select-placeholder.hbs b/ui/lib/core/addon/components/search-select-placeholder.hbs
index 32b9adeea1c..d945f8091d6 100644
--- a/ui/lib/core/addon/components/search-select-placeholder.hbs
+++ b/ui/lib/core/addon/components/search-select-placeholder.hbs
@@ -1,12 +1,12 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div>
   <div class="field">
     <p class="control has-icons-left has-icons-right">
-      <span class="input opacity-050">{{or @placeholder "Search"}}</span>
+      <span class="input">{{or @placeholder "Search"}}</span>
       <Icon @name="search" class="search-icon has-text-grey-light" />
     </p>
   </div>
diff --git a/ui/lib/core/addon/components/search-select-with-modal.hbs b/ui/lib/core/addon/components/search-select-with-modal.hbs
index 2e1f7eed844..cc025058001 100644
--- a/ui/lib/core/addon/components/search-select-with-modal.hbs
+++ b/ui/lib/core/addon/components/search-select-with-modal.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div
   {{did-insert (perform this.fetchOptions)}}
@@ -18,15 +18,18 @@
       onChange=@onChange
       inputValue=@inputValue
       helpText=@helpText
-      placeholder=@placeholder
+      placeholder=(or @fallbackComponentPlaceholder @placeholder)
       id=@id
+      selectLimit=@selectLimit
     }}
   {{else}}
     {{#if @label}}
       <label for={{@id}} class={{or @labelClass "is-label"}} data-test-field-label>
         {{@label}}
         {{#if @helpText}}
-          <InfoTooltip>{{@helpText}}</InfoTooltip>
+          <Hds::TooltipButton @text={{@helpText}} aria-label="More information">
+            <Hds::Icon @name="info" />
+          </Hds::TooltipButton>
         {{/if}}
       </label>
     {{/if}}
@@ -41,6 +44,7 @@
         @search={{this.searchAndSuggest}}
         @options={{this.dropdownOptions}}
         @onChange={{this.selectOrCreate}}
+        @renderInPlace={{true}}
         @placeholderComponent={{component "search-select-placeholder"}}
         @verticalPosition="below"
         as |option|
diff --git a/ui/lib/core/addon/components/search-select-with-modal.js b/ui/lib/core/addon/components/search-select-with-modal.js
index 313f148621e..59033b905b6 100644
--- a/ui/lib/core/addon/components/search-select-with-modal.js
+++ b/ui/lib/core/addon/components/search-select-with-modal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,37 +9,28 @@ import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
 import { task } from 'ember-concurrency';
 import { filterOptions, defaultMatcher } from 'ember-power-select/utils/group-utils';
+import { removeFromArray } from 'vault/helpers/remove-from-array';
+import { addToArray } from 'vault/helpers/add-to-array';
 
 /**
  * @module SearchSelectWithModal
- * The `SearchSelectWithModal` is an implementation of the [ember-power-select](https://github.com/cibernox/ember-power-select) used for form elements where options come dynamically from the API.
+ * The SearchSelectWithModal is an implementation of the [ember-power-select](https://github.com/cibernox/ember-power-select) used for form elements where options come dynamically from the API.
  * It renders a passed template component that parents a form so records can be created inline, via a modal that pops up after clicking 'No results found for "${term}". Click here to create it.' from the dropdown menu.
- * **!! NOTE: any form passed must be able to receive an @onSave and @onCancel arg so that the modal will close properly. See `oidc/client-form.hbs` that renders a modal for the `oidc-assignment-template.hbs` as an example.
+ * **!! NOTE: any form passed must be able to receive an `@onSave` and `@onCancel` arg so that the modal will close properly. See `oidc/client-form.hbs` that renders a modal for the `oidc-assignment-template.hbs` as an example.
  * @example
- * <SearchSelectWithModal
- *   @id="assignments"
- *   @models={{array "oidc/assignment"}}
- *   @label="assignment name"
- *   @subText="Search for an existing assignment, or type a new name to create it."
- *   @inputValue={{map-by "id" @model.assignments}}
- *   @onChange={{this.handleSearchSelect}}
- *   {{! since this is the "limited" radio select option we do not want to include 'allow_all' }}
- *   @excludeOptions={{array "allow_all"}}
- *   @fallbackComponent="string-list"
- *   @modalFormTemplate="modal-form/some-template"
- *   @modalSubtext="Use assignment to specify which Vault entities and groups are allowed to authenticate."
+ * <SearchSelectWithModal @id="assignments" @models={{array "oidc/assignment"}} @label="assignment name" @subText="Search for an existing assignment, or type a new name to create it." @inputValue={{map-by "id" @model.assignments}} @onChange={{this.handleSearchSelect}} @excludeOptions={{array "allow_all"}} @fallbackComponent="string-list" @modalFormTemplate="modal-form/some-template" @modalSubtext="Use assignment to specify which Vault entities and groups are allowed to authenticate."
  * />
  *
- // * component functionality
- * @param {function} onChange - The onchange action for this form field. ** SEE UTIL ** search-select-has-many.js if selecting models from a hasMany relationship
+ * component functionality
+ * @param {function} onChange - The onchange action for this form field. ** SEE EXAMPLE ** mfa-login-enforcement-form.js (onMethodChange) for example when selecting models from a hasMany relationship
  * @param {array} [inputValue] - Array of strings corresponding to the input's initial value, e.g. an array of model ids that on edit will appear as selected items below the input
  * @param {boolean} [shouldRenderName=false] - By default an item's id renders in the dropdown, `true` displays the name with its id in smaller text beside it *NOTE: the boolean flips automatically with 'identity' models
  * @param {array} [excludeOptions] - array of strings containing model ids to filter from the dropdown (ex: ['allow_all'])
 
-// * query params for dropdown items
+ * query params for dropdown items
  * @param {array} models - models to fetch from API. models with varying permissions should be ordered from least restricted to anticipated most restricted (ex. if one model is an enterprise only feature, pass it in last)
 
- // * template only/display args
+ * template only/display args
  * @param {string} id - The name of the form field
  * @param {string} [label] - Label appears above the form field
  * @param {string} [labelClass] - overwrite default label size (14px) from class="is-label"
@@ -47,7 +38,9 @@ import { filterOptions, defaultMatcher } from 'ember-power-select/utils/group-ut
  * @param {string} [subText] - Text to be displayed below the label
  * @param {string} fallbackComponent - name of component to be rendered if the API call 403s
  * @param {string} [placeholder] - placeholder text to override the default text of "Search"
+ * @param {string} [fallbackComponentPlaceholder] - specific placeholder text relevant to fallback component. In some cases, the placeholder text does not make sense for both the search-select and the fallback component. Ex: "Input key name" for input-search and "Search or type to create a new item" for search-select.
  * @param {boolean} [displayInherit=false] - if you need the search select component to display inherit instead of box.
+ * @param {number} [selectLimit=1] - if you only want the user to select a limited number of options, add number to this param.
  */
 export default class SearchSelectWithModal extends Component {
   @service store;
@@ -69,7 +62,7 @@ export default class SearchSelectWithModal extends Component {
 
   addSearchText(optionsToFormat) {
     // maps over array models from query
-    return optionsToFormat.toArray().map((option) => {
+    return optionsToFormat.map((option) => {
       option.searchText = `${option.name} ${option.id}`;
       return option;
     });
@@ -81,7 +74,7 @@ export default class SearchSelectWithModal extends Component {
     return inputValues.map((option) => {
       const matchingOption = this.dropdownOptions.find((opt) => opt.id === option);
       // remove any matches from dropdown list
-      this.dropdownOptions.removeObject(matchingOption);
+      this.dropdownOptions = removeFromArray(this.dropdownOptions, matchingOption);
       return {
         id: option,
         name: matchingOption ? matchingOption.name : option,
@@ -168,8 +161,8 @@ export default class SearchSelectWithModal extends Component {
   // -----
   @action
   discardSelection(selected) {
-    this.selectedOptions.removeObject(selected);
-    this.dropdownOptions.pushObject(selected);
+    this.selectedOptions = removeFromArray(this.selectedOptions, selected);
+    this.dropdownOptions = addToArray(this.dropdownOptions, selected);
     this.handleChange();
   }
 
@@ -196,8 +189,8 @@ export default class SearchSelectWithModal extends Component {
       this.showModal = true;
     } else {
       // user has selected an existing item, handleChange immediately
-      this.selectedOptions.pushObject(selection);
-      this.dropdownOptions.removeObject(selection);
+      this.selectedOptions = addToArray(this.selectedOptions, selection);
+      this.dropdownOptions = removeFromArray(this.dropdownOptions, selection);
       this.handleChange();
     }
   }
@@ -209,7 +202,7 @@ export default class SearchSelectWithModal extends Component {
     this.showModal = false;
     if (model && model.currentState.isSaved) {
       const { name } = model;
-      this.selectedOptions.pushObject({ name, id: name });
+      this.selectedOptions = addToArray(this.selectedOptions, { name, id: name });
       this.handleChange();
     }
     this.nameInput = null;
diff --git a/ui/lib/core/addon/components/search-select.hbs b/ui/lib/core/addon/components/search-select.hbs
index e21441aa8b7..722df718e20 100644
--- a/ui/lib/core/addon/components/search-select.hbs
+++ b/ui/lib/core/addon/components/search-select.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div
   {{did-insert (perform this.fetchOptions)}}
@@ -27,7 +27,9 @@
       <label for={{@id}} class={{or @labelClass "is-label"}} data-test-field-label>
         {{@label}}
         {{#if @helpText}}
-          <InfoTooltip>{{@helpText}}</InfoTooltip>
+          <Hds::TooltipButton @text={{@helpText}} aria-label="More information" data-test-tooltip="search-select">
+            <Hds::Icon @name="info" />
+          </Hds::TooltipButton>
         {{/if}}
       </label>
     {{/if}}
@@ -43,9 +45,10 @@
         @options={{this.dropdownOptions}}
         @onChange={{this.selectOrCreate}}
         @placeholderComponent={{component "search-select-placeholder"}}
-        @renderInPlace={{@renderInPlace}}
+        @renderInPlace={{true}}
         @verticalPosition="below"
         @disabled={{@disabled}}
+        @ariaLabel={{or @ariaLabel @label (humanize @id)}}
         as |option|
       >
         {{#if this.shouldRenderName}}
@@ -67,16 +70,15 @@
               {{get selected this.idKey}}
             </small>
           {{else}}
-            <div>
+            <div class="list-item-text has-right-margin-4 text-overflow-ellipsis">
               {{selected.id}}
               {{#if @wildcardLabel}}
                 {{#if (is-wildcard-string selected.id)}}
                   {{#let (filter-wildcard selected this.allOptions) as |wildcardCount|}}
-                    <span class="tag is-light has-text-grey-dark" data-test-count={{wildcardCount}}>
-                      includes
-                      {{wildcardCount}}
-                      {{if (eq wildcardCount 1) @wildcardLabel (pluralize @wildcardLabel)}}
-                    </span>
+                    <Hds::Badge
+                      @text="includes {{pluralize wildcardCount @wildcardLabel}}"
+                      data-test-count={{wildcardCount}}
+                    />
                   {{/let}}
                 {{/if}}
               {{/if}}
@@ -84,9 +86,13 @@
           {{/if}}
           <div class="control">
             {{#if selected.addTooltip}}
-              <InfoTooltip>
-                {{selected.addTooltip}}
-              </InfoTooltip>
+              <Hds::TooltipButton
+                @text={{selected.addTooltip}}
+                aria-label="More information"
+                data-test-tooltip="search-select"
+              >
+                <Hds::Icon @name="info" />
+              </Hds::TooltipButton>
             {{/if}}
             <Hds::Button
               @icon="trash"
diff --git a/ui/lib/core/addon/components/search-select.js b/ui/lib/core/addon/components/search-select.js
index f42dd2f27e0..2aa25d12ad0 100644
--- a/ui/lib/core/addon/components/search-select.js
+++ b/ui/lib/core/addon/components/search-select.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,25 +10,18 @@ import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
 import { resolve } from 'rsvp';
 import { filterOptions, defaultMatcher } from 'ember-power-select/utils/group-utils';
+import { removeFromArray } from 'vault/helpers/remove-from-array';
+import { addToArray } from 'vault/helpers/add-to-array';
+import { assert } from '@ember/debug';
 /**
  * @module SearchSelect
  * The `SearchSelect` is an implementation of the [ember-power-select](https://github.com/cibernox/ember-power-select) used for form elements where options come dynamically from the API.
+ * 
  * @example
- *  <SearchSelect
- *    @id="policy"
- *    @models={{array "policies/acl"}}
- *    @onChange={{this.onChange}}
- *    @inputValue={{get @model this.valuePath}}
- *    @wildcardLabel="role"
- *    @fallbackComponent="string-list"
- *    @selectLimit={{1}}
- *    @backend={{@model.backend}}
- *    @disallowNewItems={{true}}
- *    class={{if this.validationError "dropdown-has-error-border"}}
- * />
+ *  <SearchSelect @id="policy" @models={{array "policies/acl"}} @onChange={{this.onChange}} @inputValue={{get @model this.valuePath}} @wildcardLabel="role" @fallbackComponent="string-list" @selectLimit={{1}} @backend={{@model.backend}} @disallowNewItems={{true}} class={{if this.validationError "dropdown-has-error-border"}} />
  *
  // * component functionality
- * @param {function} onChange - The onchange action for this form field. ** SEE UTIL ** search-select-has-many.js if selecting models from a hasMany relationship
+ * @param {function} onChange - The onchange action for this form field. ** SEE EXAMPLE ** mfa-login-enforcement-form.js (onMethodChange) for example when selecting models from a hasMany relationship
  * @param {array} [inputValue] - Array of strings corresponding to the input's initial value, e.g. an array of model ids that on edit will appear as selected items below the input
  * @param {boolean} [disallowNewItems=false] - Controls whether or not the user can add a new item if none found
  * @param {boolean} [shouldRenderName=false] - By default an item's id renders in the dropdown, `true` displays the name with its id in smaller text beside it *NOTE: the boolean flips automatically with 'identity' models or if this.idKey !== 'id'
@@ -47,14 +40,14 @@ import { filterOptions, defaultMatcher } from 'ember-power-select/utils/group-ut
  * @param {string} id - The name of the form field
  * @param {string} [label] - Label for this form field
  * @param {string} [labelClass] - overwrite default label size (14px) from class="is-label"
+ * @param {string} [ariaLabel] - fallback accessible label if label is not provided
  * @param {string} [subText] - Text to be displayed below the label
  * @param {string} fallbackComponent - name of component to be rendered if the API call 403s
  * @param {string} [helpText] - Text to be displayed in the info tooltip for this form field
  * @param {string} [wildcardLabel] - string (singular) for rendering label tag beside a wildcard selection (i.e. 'role*'), for the number of items it includes, e.g. @wildcardLabel="role" -> "includes 4 roles"
  * @param {string} [placeholder] - text you wish to replace the default "search" with
  * @param {boolean} [displayInherit=false] - if you need the search select component to display inherit instead of box.
- * @param {boolean} [renderInPlace] - pass `true` when power select renders in a modal
- * @param {function} [renderInfoTooltip] - receives each inputValue string and list of dropdownOptions as args, so parent can determine when to render a tooltip beside a selectedOption and the tooltip text. see 'oidc/provider-form.js'
+ * @param {function} [renderTooltip] - receives each inputValue string and list of dropdownOptions as args, so parent can determine when to render a tooltip beside a selectedOption and the tooltip text. see 'oidc/provider-form.js'
  * @param {boolean} [disabled] - if true sets the disabled property on the ember-power-select component and makes it unusable.
  *
  // * advanced customization
@@ -71,6 +64,14 @@ export default class SearchSelect extends Component {
   @tracked dropdownOptions = []; // options that will render in dropdown, updates as selections are added/discarded
   @tracked allOptions = []; // both selected and unselected options, used for wildcard filter
 
+  constructor() {
+    super(...arguments);
+    assert(
+      'one of @id, @label, or @ariaLabel must be passed to search-select component',
+      this.args.id || this.args.label || this.args.ariaLabel
+    );
+  }
+
   get hidePowerSelect() {
     return this.selectedOptions.length >= this.args.selectLimit;
   }
@@ -100,7 +101,7 @@ export default class SearchSelect extends Component {
 
   addSearchText(optionsToFormat) {
     // maps over array of objects or response from query
-    return optionsToFormat.toArray().map((option) => {
+    return optionsToFormat.map((option) => {
       const id = option[this.idKey] ? option[this.idKey] : option.id;
       option.searchText = `${option[this.nameKey]} ${id}`;
       return option;
@@ -113,12 +114,12 @@ export default class SearchSelect extends Component {
     return inputValues.map((option) => {
       const matchingOption = this.dropdownOptions.find((opt) => opt[this.idKey] === option);
       // tooltip text comes from return of parent function
-      const addTooltip = this.args.renderInfoTooltip
-        ? this.args.renderInfoTooltip(option, this.dropdownOptions)
+      const addTooltip = this.args.renderTooltip
+        ? this.args.renderTooltip(option, this.dropdownOptions)
         : false;
 
       // remove any matches from dropdown list
-      this.dropdownOptions.removeObject(matchingOption);
+      this.dropdownOptions = removeFromArray(this.dropdownOptions, matchingOption);
       return {
         id: option,
         name: matchingOption ? matchingOption[this.nameKey] : option,
@@ -140,7 +141,7 @@ export default class SearchSelect extends Component {
     }
 
     if (!this.args.models) {
-      if (this.args.options) {
+      if (Array.isArray(this.args.options)) {
         const { options } = this.args;
         // if options are nested, let parent handle formatting - see path-filter-config-list.js
         this.dropdownOptions = options.some((e) => Object.keys(e).includes('groupName'))
@@ -263,9 +264,9 @@ export default class SearchSelect extends Component {
 
   @action
   discardSelection(selected) {
-    this.selectedOptions.removeObject(selected);
+    this.selectedOptions = removeFromArray(this.selectedOptions, selected);
     if (!selected.new) {
-      this.dropdownOptions.pushObject(selected);
+      this.dropdownOptions = addToArray(this.dropdownOptions, selected);
     }
     this.handleChange();
   }
@@ -278,9 +279,6 @@ export default class SearchSelect extends Component {
     }
     if (this.args.search) {
       return resolve(this.args.search(term, select)).then((results) => {
-        if (results.toArray) {
-          results = results.toArray();
-        }
         this.addCreateOption(term, results);
         return results;
       });
@@ -294,10 +292,10 @@ export default class SearchSelect extends Component {
   selectOrCreate(selection) {
     if (selection && selection.__isSuggestion__) {
       const name = selection.__value__;
-      this.selectedOptions.pushObject({ name, id: name, new: true });
+      this.selectedOptions = addToArray(this.selectedOptions, { name, id: name, new: true });
     } else {
-      this.selectedOptions.pushObject(selection);
-      this.dropdownOptions.removeObject(selection);
+      this.selectedOptions = addToArray(this.selectedOptions, selection);
+      this.dropdownOptions = removeFromArray(this.dropdownOptions, selection);
     }
     this.handleChange();
   }
diff --git a/ui/lib/core/addon/components/secret-list-header-tab.hbs b/ui/lib/core/addon/components/secret-list-header-tab.hbs
index 26243276be4..65a07a89a48 100644
--- a/ui/lib/core/addon/components/secret-list-header-tab.hbs
+++ b/ui/lib/core/addon/components/secret-list-header-tab.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#unless this.dontShowTab}}
   <LinkTo @route="vault.cluster.secrets.backend.list-root" @query={{hash tab=@tab}} data-test-secret-list-tab={{@label}}>
diff --git a/ui/lib/core/addon/components/secret-list-header-tab.js b/ui/lib/core/addon/components/secret-list-header-tab.js
index c6d0b9bb0ff..30a653928be 100644
--- a/ui/lib/core/addon/components/secret-list-header-tab.js
+++ b/ui/lib/core/addon/components/secret-list-header-tab.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,9 +11,8 @@
  *
  *
  * @example
- * ```js
  * <SecretListHeaderTab @displayName='Database' @id='database-2' @path='roles' @label='Roles' @tab='roles'/>
- * ```
+ *
  * @param {string} [displayName] - set on options-for-backend this sets a conditional to see if capabilities are being checked
  * @param {string} [id] - if fetching capabilities used for making the query url.  It is the name the user has assigned to the instance of the engine.
  * @param {string} [path] - set on options-for-backend this tells us the specifics of the URL the query should hit.
diff --git a/ui/lib/core/addon/components/secret-list-header.hbs b/ui/lib/core/addon/components/secret-list-header.hbs
index 67359ae8d21..e22a7846abc 100644
--- a/ui/lib/core/addon/components/secret-list-header.hbs
+++ b/ui/lib/core/addon/components/secret-list-header.hbs
@@ -1,13 +1,13 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#let (options-for-backend @model.engineType) as |options|}}
   <PageHeader as |p|>
     <p.top>
       <Hds::Breadcrumb>
-        <Hds::Breadcrumb::Item @text="Secrets" @route="vault.cluster.secrets" />
+        <Hds::Breadcrumb::Item @text="Secrets" @route="vault.cluster.secrets" data-test-breadcrumb="Secrets" />
         <Hds::Breadcrumb::Item
           @text={{@model.id}}
           @current={{not @isConfigure}}
@@ -24,10 +24,7 @@
         <Icon @name={{@model.icon}} @size="24" class="has-text-grey-light" />
         {{@model.id}}
         {{#if this.isKV}}
-          <span class="tag" data-test-kv-version-badge>
-            version
-            {{or @model.version "1"}}
-          </span>
+          <Hds::Badge @text="version {{or @model.version '1'}}" data-test-kv-version-badge />
         {{/if}}
       </h1>
 
@@ -39,7 +36,7 @@
         <ul>
           {{#if options.hasOverview}}
             <li>
-              <LinkTo @route="vault.cluster.secrets.backend.overview" data-test-tab="overview">
+              <LinkTo @route="vault.cluster.secrets.backend.overview" @model={{@model.id}} data-test-tab="overview">
                 Overview
               </LinkTo>
             </li>
@@ -55,11 +52,17 @@
               />
             </li>
           {{/each}}
-          <li>
-            <LinkTo @route="vault.cluster.secrets.backend.configuration" data-test-configuration-tab={{true}}>
-              Configuration
-            </LinkTo>
-          </li>
+          {{#if options.isOldEngine}}
+            <li>
+              <LinkTo
+                @route="vault.cluster.secrets.backend.configuration"
+                @model={{@model.id}}
+                data-test-configuration-tab={{true}}
+              >
+                Configuration
+              </LinkTo>
+            </li>
+          {{/if}}
         </ul>
       </nav>
     </div>
@@ -68,18 +71,24 @@
     <div class="tabs-container box is-bottomless is-marginless is-fullwidth is-paddingless">
       <nav class="tabs" aria-label="tabs">
         <ul>
-          {{#if (includes @model.engineType (supported-secret-backends))}}
+          {{#if this.showListTab}}
             <li>
               <LinkTo
                 @route="vault.cluster.secrets.backend.list-root"
+                @model={{@model.id}}
                 @current-when="vault.cluster.secrets.backend.list-root vault.cluster.secrets.backend.list"
+                data-test-tab={{@model.id}}
               >
                 {{capitalize (pluralize options.item)}}
               </LinkTo>
             </li>
           {{/if}}
           <li>
-            <LinkTo @route="vault.cluster.secrets.backend.configuration" data-test-configuration-tab={{true}}>
+            <LinkTo
+              @route="vault.cluster.secrets.backend.configuration"
+              @model={{@model.id}}
+              data-test-configuration-tab={{true}}
+            >
               Configuration
             </LinkTo>
           </li>
diff --git a/ui/lib/core/addon/components/secret-list-header.js b/ui/lib/core/addon/components/secret-list-header.js
index 9cee66b0f9e..47cd74d9a49 100644
--- a/ui/lib/core/addon/components/secret-list-header.js
+++ b/ui/lib/core/addon/components/secret-list-header.js
@@ -1,33 +1,34 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
 
 /**
  * @module SecretListHeader
  * SecretListHeader component is breadcrumb, title with icon and menu with tabs component.
  *
+ * Example is wrapped in back ticks because this component relies on routing and cannot render an isolated sample, so just rendering template sample
  * @example
- * ```js
- * <SecretListHeader
-   @model={{this.model}}
-   @backendCrumb={{hash
-    label=this.model.id
-    text=this.model.id
-    path="vault.cluster.secrets.backend.list-root"
-    model=this.model.id
-   }}
-  />
  * ```
+ * <SecretListHeader @model={{this.model}} />
+ * ```
+ *
  * @param {object} model - Model used to pull information about icon and title and backend type for navigation.
- * @param {string} [baseKey] - Provided for navigation on the breadcrumbs.
- * @param {object} [backendCrumb] - Includes label, text, path and model ID.
+ * @param {boolean} [isConfigure=false] - Boolean to determine if the configure tab should be shown.
  */
 
 export default class SecretListHeader extends Component {
   get isKV() {
     return ['kv', 'generic'].includes(this.args.model.engineType);
   }
+
+  get showListTab() {
+    // only show the list tab if the engine is not a configuration only engine and the UI supports it
+    const { engineType } = this.args.model;
+    return supportedSecretBackends().includes(engineType) && !engineDisplayData(engineType)?.isOnlyMountable;
+  }
 }
diff --git a/ui/lib/core/addon/components/secrets-engine-mount-config.hbs b/ui/lib/core/addon/components/secrets-engine-mount-config.hbs
index eaf7cefc28c..d1c1222934b 100644
--- a/ui/lib/core/addon/components/secrets-engine-mount-config.hbs
+++ b/ui/lib/core/addon/components/secrets-engine-mount-config.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div ...attributes>
   <ToggleButton
diff --git a/ui/lib/core/addon/components/secrets-engine-mount-config.ts b/ui/lib/core/addon/components/secrets-engine-mount-config.ts
index e1db2bdd187..2a4ac296fb2 100644
--- a/ui/lib/core/addon/components/secrets-engine-mount-config.ts
+++ b/ui/lib/core/addon/components/secrets-engine-mount-config.ts
@@ -1,34 +1,46 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { tracked } from '@glimmer/tracking';
+import { duration } from 'core/helpers/format-duration';
 
-import type SecretEngineModel from 'vault/models/secret-engine';
+import type SecretsEngineResource from 'vault/resources/secrets/engine';
+
+/**
+ * @module SecretsEngineMountConfig
+ * SecretsEngineMountConfig component is used to display a "Show mount configuration" toggle section. It is generally used alongside the fetch-secret-engine-config decorator which displays the engine configuration above this component. Mount configuration is always available for display but is hidden by default behind a toggle.
+ *
+ * @example
+ * <SecretsEngineMountConfig @secretsEngine={{this.model}} />
+ *
+ * @param {SecretsEngineResource} secretsEngine - the secrets engine resource containing the mount configuration details
+ */
 
 interface Args {
-  model: SecretEngineModel;
+  secretsEngine: SecretsEngineResource;
 }
 interface Field {
   label: string;
   value: string | boolean;
 }
 
-export default class SecretsEngineMountConfigComponent extends Component<Args> {
+export default class SecretsEngineMountConfig extends Component<Args> {
   @tracked showConfig = false;
 
   get fields(): Array<Field> {
-    const { model } = this.args;
+    const { secretsEngine } = this.args;
     return [
-      { label: 'Secret Engine Type', value: model.engineType },
-      { label: 'Path', value: model.path },
-      { label: 'Accessor', value: model.accessor },
-      { label: 'Local', value: model.local },
-      { label: 'Seal Wrap', value: model.sealWrap },
-      { label: 'Default Lease TTL', value: model.config.defaultLeaseTtl },
-      { label: 'Max Lease TTL', value: model.config.maxLeaseTtl },
+      { label: 'Secret engine type', value: secretsEngine.engineType },
+      { label: 'Path', value: secretsEngine.path },
+      { label: 'Accessor', value: secretsEngine.accessor },
+      { label: 'Local', value: secretsEngine.local },
+      { label: 'Seal wrap', value: secretsEngine.seal_wrap },
+      { label: 'Default Lease TTL', value: duration([secretsEngine.config.default_lease_ttl]) },
+      { label: 'Max Lease TTL', value: duration([secretsEngine.config.max_lease_ttl]) },
+      { label: 'Identity token key', value: secretsEngine.config.identity_token_key },
     ];
   }
 }
diff --git a/ui/lib/core/addon/templates/components/select.hbs b/ui/lib/core/addon/components/select.hbs
similarity index 85%
rename from ui/lib/core/addon/templates/components/select.hbs
rename to ui/lib/core/addon/components/select.hbs
index a58604095f4..3ac1a2584e8 100644
--- a/ui/lib/core/addon/templates/components/select.hbs
+++ b/ui/lib/core/addon/components/select.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.label}}
   <label for="select-{{this.name}}" class="is-label" data-test-select-label>
@@ -12,6 +12,7 @@
   <div class="select {{if this.isFullwidth 'is-fullwidth'}}">
     <select
       class="select"
+      {{! TODO: when 2 TtlPickers are on the same view this becomes two of the same ids. Shows up as dom warning. JIRA 29298}}
       id="select-{{this.name}}"
       onchange={{action this.onChange value="target.value"}}
       data-test-select={{this.name}}
diff --git a/ui/lib/core/addon/components/select.js b/ui/lib/core/addon/components/select.js
index 6b0a50cca4a..5fdc7c841e7 100644
--- a/ui/lib/core/addon/components/select.js
+++ b/ui/lib/core/addon/components/select.js
@@ -1,35 +1,31 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@ember/component';
-import layout from '../templates/components/select';
 
 /**
  * @module Select
  * Select components are used to render a dropdown.
  *
  * @example
- * ```js
- * <Select @label='Date Range' @options={{[{ value: 'berry', label: 'Berry' }]}} @onChange={{onChange}}/>
- * ```
+ * <Select @label='Date Range' @options={{[{ value: 'berry', label: 'Berry' }]}} @onChange={{log "on change"}}/>
  *
  * @param {string} [label=null] - The label for the select element.
  * @param {Array} [options=null] - A list of items that the user will select from. This can be an array of strings or objects.
  * @param {string} [selectedValue=null] - The currently selected item. Can also be used to set the default selected item. This should correspond to the `value` of one of the `<option>`s.
  * @param {string} [name = null] - The name of the select, used for the test selector.
- * @param {string} [valueAttribute = value]- When `options` is an array objects, the key to check for when assigning the option elements value.
- * @param {string} [labelAttribute = label] - When `options` is an array objects, the key to check for when assigning the option elements' inner text.
- * @param {boolean} [isInline = false] - Whether or not the select should be displayed as inline-block or block.
- * @param {boolean} [isFullwidth = false] - Whether or not the select should take up the full width of the parent element.
- * @param {boolean} [noDefault = false] - shows Select One with empty value as first option
+ * @param {string} [valueAttribute=value]- When `options` is an array objects, the key to check for when assigning the option elements value.
+ * @param {string} [labelAttribute=label] - When `options` is an array objects, the key to check for when assigning the option elements' inner text.
+ * @param {boolean} [isInline=false] - Whether or not the select should be displayed as inline-block or block.
+ * @param {boolean} [isFullwidth=false] - Whether or not the select should take up the full width of the parent element.
+ * @param {boolean} [noDefault=false] - shows Select One with empty value as first option
  * @param {Func} [onChange] - The action to take once the user has selected an item. This method will be passed the `value` of the select.
  * @param {string} [ariaLabel] - pass when label is defined elsewhere to ensure the select input has a valid label
  */
 
 export default Component.extend({
-  layout,
   classNames: ['field'],
   label: null,
   selectedValue: null,
diff --git a/ui/lib/core/addon/components/selectable-card.hbs b/ui/lib/core/addon/components/selectable-card.hbs
index a0ede5f3fcf..19f185c8ca0 100644
--- a/ui/lib/core/addon/components/selectable-card.hbs
+++ b/ui/lib/core/addon/components/selectable-card.hbs
@@ -1,15 +1,15 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container
   tabindex={{unless @disabled "0"}}
   class="selectable-card {{if @disabled 'disabled'}}"
   @level={{if @disabled "base" "mid"}}
   @hasBorder={{true}}
-  {{on "click" @onClick}}
-  {{on "keypress" @onClick}}
+  {{on "click" (if @disabled (noop) @onClick)}}
+  {{on "keypress" (if @disabled (noop) @onClick)}}
   ...attributes
 >
   {{yield}}
diff --git a/ui/lib/core/addon/components/shamir/dr-token-flow.hbs b/ui/lib/core/addon/components/shamir/dr-token-flow.hbs
index e9b4af61935..9386ee63d75 100644
--- a/ui/lib/core/addon/components/shamir/dr-token-flow.hbs
+++ b/ui/lib/core/addon/components/shamir/dr-token-flow.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 {{! THIS COMPONENT RENDERS INSIDE A MODAL (must pass @container to copy buttons) }}
 {{#if this.encodedToken}}
   <p class="has-bottom-margin-l" data-test-dr-token-flow-step="show-token">
@@ -18,9 +18,7 @@
       <Hds::Copy::Snippet
         @textToCopy={{this.encodedToken}}
         @container="#shamir-flow-modal"
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
+        @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
         data-test-shamir-encoded-token
       />
     </div>
@@ -36,7 +34,7 @@
           @textToCopy={{this.otp}}
           @container="#shamir-flow-modal"
           @onError={{(fn
-            (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
+            (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
           )}}
         />
       </div>
@@ -96,6 +94,7 @@
     </p>
   </Shamir::Form>
 {{else if this.generateWithPGP}}
+  <MessageError @errors={{this.errors}} />
   <ChoosePgpKeyForm
     @onCancel={{fn (mut this.generateWithPGP) false}}
     @onSubmit={{this.usePgpKey}}
diff --git a/ui/lib/core/addon/components/shamir/dr-token-flow.js b/ui/lib/core/addon/components/shamir/dr-token-flow.js
index 1681620eb9c..79730158181 100644
--- a/ui/lib/core/addon/components/shamir/dr-token-flow.js
+++ b/ui/lib/core/addon/components/shamir/dr-token-flow.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/components/shamir/flow.hbs b/ui/lib/core/addon/components/shamir/flow.hbs
index 6a74889bfeb..5e085dd9514 100644
--- a/ui/lib/core/addon/components/shamir/flow.hbs
+++ b/ui/lib/core/addon/components/shamir/flow.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Shamir::Form
   @onSubmit={{this.onSubmitKey}}
diff --git a/ui/lib/core/addon/components/shamir/flow.js b/ui/lib/core/addon/components/shamir/flow.js
index fdb802bd3f8..1367541b8b4 100644
--- a/ui/lib/core/addon/components/shamir/flow.js
+++ b/ui/lib/core/addon/components/shamir/flow.js
@@ -1,9 +1,8 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { A } from '@ember/array';
 import { action } from '@ember/object';
 import { service } from '@ember/service';
 import { camelize } from '@ember/string';
@@ -44,7 +43,7 @@ import { tracked } from '@glimmer/tracking';
  */
 export default class ShamirFlowComponent extends Component {
   @service store;
-  @tracked errors = A();
+  @tracked errors = null;
   @tracked attemptResponse = null;
 
   get action() {
diff --git a/ui/lib/core/addon/components/shamir/form.hbs b/ui/lib/core/addon/components/shamir/form.hbs
index 07a33cca6d1..4adb1b5091e 100644
--- a/ui/lib/core/addon/components/shamir/form.hbs
+++ b/ui/lib/core/addon/components/shamir/form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form id="shamir" aria-label="shamir form" {{on "submit" (fn this.onSubmit this.key)}} ...attributes>
   {{#if @errors}}
@@ -27,7 +27,7 @@
             @color="secondary"
             @container="#shamir-flow-modal"
             @onError={{(fn
-              (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
+              (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
             )}}
           />
         </A.Description>
diff --git a/ui/lib/core/addon/components/shamir/form.js b/ui/lib/core/addon/components/shamir/form.js
index 45338c1e371..2f3c68c60ea 100644
--- a/ui/lib/core/addon/components/shamir/form.js
+++ b/ui/lib/core/addon/components/shamir/form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/components/stat-text.hbs b/ui/lib/core/addon/components/stat-text.hbs
index 63ea9c6d17b..19cab38824f 100644
--- a/ui/lib/core/addon/components/stat-text.hbs
+++ b/ui/lib/core/addon/components/stat-text.hbs
@@ -1,14 +1,21 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div
   class={{concat "stat-text-container " @size (unless @subText "-no-subText")}}
-  data-test-stat-text-container={{(or @label "true")}}
+  data-test-stat-text={{or @label "true"}}
   ...attributes
 >
-  <div class="stat-label has-bottom-margin-xs">{{@label}}</div>
+  <div class="stat-label has-bottom-margin-xs">
+    {{@label}}
+    {{#if @tooltipText}}
+      <Hds::TooltipButton @text={{@tooltipText}} aria-label="more information about {{@label}}">
+        <Hds::Icon @name="info" @isInline={{true}} />
+      </Hds::TooltipButton>
+    {{/if}}
+  </div>
   {{#if @subText}}
     <div class="stat-text">{{@subText}}</div>
   {{/if}}
diff --git a/ui/lib/core/addon/components/string-list.hbs b/ui/lib/core/addon/components/string-list.hbs
index c9bd5b507c6..8e542b038d7 100644
--- a/ui/lib/core/addon/components/string-list.hbs
+++ b/ui/lib/core/addon/components/string-list.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div
   class="field string-list form-section"
@@ -15,11 +15,13 @@
     <label class="is-label" data-test-string-list-label="true">
       {{@label}}
       {{#if @helpText}}
-        <InfoTooltip>{{@helpText}}</InfoTooltip>
+        <Hds::TooltipButton @text={{@helpText}} aria-label="More information" data-test-tooltip="string-list">
+          <Hds::Icon @name="info" />
+        </Hds::TooltipButton>
       {{/if}}
     </label>
     {{#if @subText}}
-      <p class="sub-text">
+      <p class="sub-text" id={{concat (dasherize @label) "-helper-text"}}>
         {{@subText}}
       </p>
     {{/if}}
@@ -33,6 +35,7 @@
           @value={{data.value}}
           name={{concat this.elementId "-" index}}
           aria-label="{{@label}} list item {{index}}"
+          aria-describedby={{concat (dasherize @label) "-helper-text"}}
           {{on "keyup" (action "inputChanged" index)}}
           {{on "change" (action "inputChanged" index)}}
         />
@@ -53,7 +56,7 @@
         {{/if}}
       </div>
       {{#if (includes index this.indicesWithComma)}}
-        <FlightIcon @name="alert-triangle" @color="var(--token-color-foreground-warning)" @size="24" />
+        <Hds::Icon @name="alert-triangle" @color="warning" @size="24" @isInline={{true}} />
       {{/if}}
     </div>
   {{/each}}
diff --git a/ui/lib/core/addon/components/string-list.js b/ui/lib/core/addon/components/string-list.js
index 0a356dd30bc..11dea9ef1b0 100644
--- a/ui/lib/core/addon/components/string-list.js
+++ b/ui/lib/core/addon/components/string-list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,14 +10,15 @@ import { action } from '@ember/object';
 import { set } from '@ember/object';
 import { next } from '@ember/runloop';
 import { tracked } from '@glimmer/tracking';
+import { addToArray } from 'vault/helpers/add-to-array';
+import { removeFromArray } from 'vault/helpers/remove-from-array';
 
 /**
  * @module StringList
  *
  * @example
- * ```js
- * <StringList @label={label} @onChange={{this.setAndBroadcast}} @inputValue={{this.valuePath}}/>
- * ```
+ * <StringList @label="My label" @inputValue={{array "one" "two"}} />
+ *
  * @param {string} label - Text displayed in the header above all the inputs.
  * @param {function} onChange - Function called when any of the inputs change.
  * @param {string} inputValue - A string or an array of strings.
@@ -33,6 +34,7 @@ export default class StringList extends Component {
   constructor() {
     super(...arguments);
 
+    // inputList is type ArrayProxy, so addObject etc are fine here
     this.inputList = ArrayProxy.create({
       // trim the `value` when accessing objects
       content: [],
@@ -90,9 +92,11 @@ export default class StringList extends Component {
   @action
   inputChanged(idx, event) {
     if (event.target.value.includes(',') && !this.indicesWithComma.includes(idx)) {
-      this.indicesWithComma.pushObject(idx);
+      this.indicesWithComma = addToArray(this.indicesWithComma, idx);
+    }
+    if (!event.target.value.includes(',')) {
+      this.indicesWithComma = removeFromArray(this.indicesWithComma, idx);
     }
-    if (!event.target.value.includes(',')) this.indicesWithComma.removeObject(idx);
 
     const inputObj = this.inputList.objectAt(idx);
     set(inputObj, 'value', event.target.value);
@@ -101,16 +105,16 @@ export default class StringList extends Component {
 
   @action
   addInput() {
-    const inputList = this.inputList;
-    if (inputList.get('lastObject.value') !== '') {
-      inputList.pushObject({ value: '' });
+    const [lastItem] = this.inputList.slice(-1);
+    if (lastItem?.value !== '') {
+      this.inputList.pushObject({ value: '' });
     }
   }
 
   @action
   removeInput(idx) {
-    const inputs = this.inputList;
-    inputs.removeObject(inputs.objectAt(idx));
+    const itemToRemove = this.inputList.objectAt(idx);
+    this.inputList.removeObject(itemToRemove);
     this.args.onChange(this.toVal());
   }
 }
diff --git a/ui/lib/core/addon/components/sync-status-badge.hbs b/ui/lib/core/addon/components/sync-status-badge.hbs
index e3111f9d18d..f0effd88f3d 100644
--- a/ui/lib/core/addon/components/sync-status-badge.hbs
+++ b/ui/lib/core/addon/components/sync-status-badge.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Badge @text={{to-label @status}} @icon={{this.state.icon}} @color={{this.state.color}} ...attributes />
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/sync-status-badge.ts b/ui/lib/core/addon/components/sync-status-badge.ts
index 754ad9242d7..3512ede0ecf 100644
--- a/ui/lib/core/addon/components/sync-status-badge.ts
+++ b/ui/lib/core/addon/components/sync-status-badge.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/components/text-file.hbs b/ui/lib/core/addon/components/text-file.hbs
index 6cb2c8f9a97..08cd34b1c39 100644
--- a/ui/lib/core/addon/components/text-file.hbs
+++ b/ui/lib/core/addon/components/text-file.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @uploadOnly}}
   <label id="text-file-input-{{this.elementId}}" class="sr-only">{{or @label "File"}}</label>
@@ -11,11 +11,9 @@
       <label id="text-file-input-{{this.elementId}}" class="has-text-weight-semibold" data-test-text-file-label>
         {{or @label "File"}}
         {{#if @helpText}}
-          <InfoTooltip>
-            <span data-test-help-text>
-              {{@helpText}}
-            </span>
-          </InfoTooltip>
+          <Hds::TooltipButton @text={{@helpText}} aria-label="More information">
+            <Hds::Icon @name="info" />
+          </Hds::TooltipButton>
         {{/if}}
       </label>
     </div>
@@ -41,7 +39,7 @@
       @isMultiline={{true}}
       {{on "input" this.handleTextInput}}
       aria-labelledby="text-file-input-{{this.elementId}}"
-      data-test-text-file-textarea
+      data-test-masked-input
       as |F|
     >
       <F.HelperText>
@@ -80,7 +78,7 @@
         @type="danger"
         @message={{or @validationError this.uploadError}}
         class="has-top-padding-s"
-        data-test-field-validation="text-file"
+        data-test-inline-alert
       />
     {{/if}}
   {{/if}}
diff --git a/ui/lib/core/addon/components/text-file.js b/ui/lib/core/addon/components/text-file.js
index 892178f009e..daa28436ab6 100644
--- a/ui/lib/core/addon/components/text-file.js
+++ b/ui/lib/core/addon/components/text-file.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,17 +14,12 @@ import { buildWaiter } from '@ember/test-waiters';
  *  that changes the input into a textarea
  *
  * @example
- * <TextFile
- *  @uploadOnly={{true}}
- *  @helpText="help text"
- *  @onChange={{this.handleChange}}
- *  @label="PEM Bundle"
- * />
+ * <TextFile @uploadOnly={{true}} @helpText="help text" @onChange={{this.handleChange}} @label="PEM Bundle" />
  *
  * @param {function} onChange - Callback function to call when the value of the input changes, returns an object in the shape of { value: fileContents, filename: 'some-file.txt' }
  * @param {bool} [uploadOnly=false] - When true, renders a static file upload input and removes the option to toggle and input plain text
  * @param {string} [helpText] - Text underneath label.
- * @param {string} [label='File']  - Text to use as the label for the file input. If none, default of 'File' is rendered
+ * @param {string} [label=File]  - Text to use as the label for the file input. If none, default of 'File' is rendered
  */
 
 const waiter = buildWaiter('text-file');
diff --git a/ui/lib/core/addon/components/toggle-button.hbs b/ui/lib/core/addon/components/toggle-button.hbs
index e0b921f9692..823b756ae51 100644
--- a/ui/lib/core/addon/components/toggle-button.hbs
+++ b/ui/lib/core/addon/components/toggle-button.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! DEPRECATED use <Hds::Reveal /> instead https://helios.hashicorp.design/components/reveal }}
 <button type="button" class="button is-transparent has-text-info" {{on "click" (fn @onClick (not @isOpen))}} ...attributes>
diff --git a/ui/lib/core/addon/components/toggle-button.js b/ui/lib/core/addon/components/toggle-button.js
index b9a9e9a44b6..1de043627bc 100644
--- a/ui/lib/core/addon/components/toggle-button.js
+++ b/ui/lib/core/addon/components/toggle-button.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,21 +10,19 @@ import Component from '@glimmer/component';
  * `ToggleButton` components are used to expand and collapse content with a toggle.
  *
  * @example
- * ```js
- *   <ToggleButton @isOpen={{this.showOptions}} @openLabel="Encrypt Output with PGP" @closedLabel="Encrypt Output with PGP" @onClick={{fn (mut this.showOptions}} />
- *  {{#if showOptions}}
+ * <ToggleButton @isOpen={{this.showOptions}} @openLabel="Show stuff" @closedLabel="Hide the stuff" @onClick={{fn (mut this.showOptions) (not this.showOptions)}} />
+ *  {{#if this.showOptions}}
  *     <div>
  *       <p>
  *         I will be toggled!
  *       </p>
  *     </div>
  *   {{/if}}
- * ```
- * @callback onClickCallback
+ *
  * @param {boolean} isOpen - determines whether to show open or closed label
- * @param {onClickCallback} onClick - fired when button is clicked
- * @param {string} [openLabel="Hide options"] - The message to display when the toggle is open.
- * @param {string} [closedLabel="More options"] - The message to display when the toggle is closed.
+ * @param {function} onClick - fired when button is clicked
+ * @param {string} [openLabel=Hide options] - The message to display when the toggle is open.
+ * @param {string} [closedLabel=More options] - The message to display when the toggle is closed.
  */
 export default class ToggleButtonComponent extends Component {
   get openLabel() {
diff --git a/ui/lib/core/addon/components/toggle.hbs b/ui/lib/core/addon/components/toggle.hbs
index 3bd8858cf74..7436aea6927 100644
--- a/ui/lib/core/addon/components/toggle.hbs
+++ b/ui/lib/core/addon/components/toggle.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Input
   id={{this.safeId}}
diff --git a/ui/lib/core/addon/components/toggle.js b/ui/lib/core/addon/components/toggle.js
index 23cd1ff254c..eec3cf106e3 100644
--- a/ui/lib/core/addon/components/toggle.js
+++ b/ui/lib/core/addon/components/toggle.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,9 +9,8 @@
  * They are a stylistic alternative to checkboxes, but still use the input[type="checkbox"] under the hood.
  *
  * @example
- * ```js
- * <Toggle @requiredParam={requiredParam} @optionalParam={optionalParam} @param1={{param1}}/>
- * ```
+ * <Toggle/>
+ *
  * @param {function} onChange - onChange is triggered on checkbox change (select, deselect). Must manually mutate checked value
  * @param {string} name - name is passed along to the form field, as well as to generate the ID of the input & "for" value of the label
  * @param {boolean} [checked=false] - checked status of the input, and must be passed in and mutated from the parent
diff --git a/ui/lib/core/addon/components/tool-tip.hbs b/ui/lib/core/addon/components/tool-tip.hbs
deleted file mode 100644
index d90db27edd9..00000000000
--- a/ui/lib/core/addon/components/tool-tip.hbs
+++ /dev/null
@@ -1,29 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<BasicDropdown
-  @renderInPlace={{@renderInPlace}}
-  @verticalPosition={{@verticalPosition}}
-  @horizontalPosition={{this.horizontalPosition}}
-  @matchTriggerWidth={{@matchTriggerWidth}}
-  @triggerComponent={{@triggerComponent}}
-  @contentComponent={{@contentComponent}}
-  @calculatePosition={{@calculatePosition}}
-  @onOpen={{@onOpen}}
-  @onClose={{@onClose}}
-  @onFocus={{@onFocus}}
-  @calculateInPlacePosition={{@calculateInPlacePosition}}
-  as |dd|
->
-  {{yield
-    (assign
-      dd
-      (hash
-        Trigger=(component dd.Trigger onMouseDown=this.prevent onMouseEnter=this.open onMouseLeave=this.close)
-        Content=(component dd.Content onMouseEnter=this.open onMouseLeave=this.close)
-      )
-    )
-  }}
-</BasicDropdown>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/tool-tip.js b/ui/lib/core/addon/components/tool-tip.js
deleted file mode 100644
index 59eeb2284ae..00000000000
--- a/ui/lib/core/addon/components/tool-tip.js
+++ /dev/null
@@ -1,34 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-import { debounce } from '@ember/runloop';
-
-export default class ToolTipComponent extends Component {
-  get delay() {
-    return this.args.delay || 200;
-  }
-  get horizontalPosition() {
-    return this.args.horizontalPosition || 'auto-right';
-  }
-
-  toggleState({ dropdown, action }) {
-    dropdown.actions[action]();
-  }
-
-  @action
-  open(dropdown) {
-    debounce(this, 'toggleState', { dropdown, action: 'open' }, this.delay);
-  }
-  @action
-  close(dropdown) {
-    debounce(this, 'toggleState', { dropdown, action: 'close' }, this.delay);
-  }
-  @action
-  prevent() {
-    return false;
-  }
-}
diff --git a/ui/lib/core/addon/components/toolbar-actions.hbs b/ui/lib/core/addon/components/toolbar-actions.hbs
index 5d629fa7cd2..5042cfe731b 100644
--- a/ui/lib/core/addon/components/toolbar-actions.hbs
+++ b/ui/lib/core/addon/components/toolbar-actions.hbs
@@ -1,8 +1,8 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<nav class="toolbar-actions" ...attributes>
+<nav class="toolbar-actions" aria-label="toolbar actions" ...attributes>
   {{yield}}
 </nav>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/toolbar-filters.hbs b/ui/lib/core/addon/components/toolbar-filters.hbs
index 805bf173416..ed2e8325dfc 100644
--- a/ui/lib/core/addon/components/toolbar-filters.hbs
+++ b/ui/lib/core/addon/components/toolbar-filters.hbs
@@ -1,8 +1,8 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<nav class="toolbar-filters" ...attributes>
+<nav class="toolbar-filters" aria-label="toolbar filters" ...attributes>
   {{yield}}
 </nav>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/toolbar-link.hbs b/ui/lib/core/addon/components/toolbar-link.hbs
index 08d847040a5..6250d0725b8 100644
--- a/ui/lib/core/addon/components/toolbar-link.hbs
+++ b/ui/lib/core/addon/components/toolbar-link.hbs
@@ -1,41 +1,17 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-{{#if (and @disabled @disabledTooltip)}}
-  <ToolTip @verticalPosition="above" as |T|>
-    <T.Trigger tabindex="-1">
-      <LinkTo
-        class="toolbar-link"
-        ...attributes
-        @route={{@route}}
-        @models={{this.models}}
-        @query={{this.query}}
-        @replace={{@replace}}
-        @disabled={{@disabled}}
-      >
-        {{yield}}
-        <Icon @name={{this.glyph}} data-test-icon={{this.glyph}} />
-      </LinkTo>
-    </T.Trigger>
-    <T.Content @defaultClass="tool-tip smaller-font">
-      <div class="box" data-test-disabled-tooltip>
-        {{@disabledTooltip}}
-      </div>
-    </T.Content>
-  </ToolTip>
-{{else}}
-  <LinkTo
-    class="toolbar-link"
-    ...attributes
-    @route={{@route}}
-    @models={{this.models}}
-    @query={{this.query}}
-    @replace={{@replace}}
-    @disabled={{@disabled}}
-  >
-    {{yield}}
-    <Icon @name={{this.glyph}} data-test-icon={{this.glyph}} />
-  </LinkTo>
-{{/if}}
\ No newline at end of file
+<LinkTo
+  class="toolbar-link"
+  ...attributes
+  @route={{@route}}
+  @models={{this.models}}
+  @query={{this.query}}
+  @replace={{@replace}}
+  @disabled={{@disabled}}
+>
+  {{yield}}
+  <Icon @name={{this.glyph}} data-test-icon={{this.glyph}} />
+</LinkTo>
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/toolbar-link.js b/ui/lib/core/addon/components/toolbar-link.js
index 39c681f2a16..78a09436231 100644
--- a/ui/lib/core/addon/components/toolbar-link.js
+++ b/ui/lib/core/addon/components/toolbar-link.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,15 +10,13 @@ import Component from '@glimmer/component';
  * It should only be used inside of `Toolbar`.
  *
  * @example
- * ```js
  * <Toolbar>
  *   <ToolbarActions>
- *     <ToolbarLink @route="vault.cluster.policies.create" @type="add" @disabled={{true}} @disabledTooltip="This link is disabled">
+ *     <ToolbarLink @route="vault" @type="add">
  *       Create policy
  *     </ToolbarLink>
  *   </ToolbarActions>
  * </Toolbar>
- * ```
  *
  * @param {string} route - route to pass to LinkTo
  * @param {Model} model - model to pass to LinkTo
@@ -26,8 +24,6 @@ import Component from '@glimmer/component';
  * @param {Object} query - query params to pass to LinkTo
  * @param {boolean} replace - replace arg to pass to LinkTo
  * @param {string} type - Use "add" to change icon to plus sign, or pass in your own kind of icon.
- * @param {boolean} disabled - pass true to disable link
- * @param {string} disabledTooltip - tooltip to display on hover when disabled
  */
 
 export default class ToolbarLinkComponent extends Component {
diff --git a/ui/lib/core/addon/components/toolbar.hbs b/ui/lib/core/addon/components/toolbar.hbs
index 9d3cbf11a8b..144da87e181 100644
--- a/ui/lib/core/addon/components/toolbar.hbs
+++ b/ui/lib/core/addon/components/toolbar.hbs
@@ -1,9 +1,9 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<nav class="toolbar" ...attributes>
+<nav class="toolbar" aria-label="toolbar" ...attributes>
   <div class="toolbar-scroller">
     {{yield}}
   </div>
diff --git a/ui/lib/core/addon/components/ttl-picker.hbs b/ui/lib/core/addon/components/ttl-picker.hbs
index e115fbfe153..312cde52be3 100644
--- a/ui/lib/core/addon/components/ttl-picker.hbs
+++ b/ui/lib/core/addon/components/ttl-picker.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="has-bottom-margin-m" ...attributes>
   {{#if @hideToggle}}
@@ -16,16 +16,14 @@
             <div class="sub-text">
               <span data-test-ttl-form-subtext>{{this.helperText}}</span>
               {{#if @description}}
-                <ToolTip @verticalPosition="below" as |T|>
-                  <T.Trigger data-test-tooltip-trigger tabindex="-1">
-                    <Icon @name="info" aria-label="description" />
-                  </T.Trigger>
-                  <T.Content @defaultClass="tool-tip">
-                    <div class="box" data-test-hover-copy-tooltip-text>
-                      {{this.description}}
-                    </div>
-                  </T.Content>
-                </ToolTip>
+                <Hds::TooltipButton
+                  @text={{@description}}
+                  @placement="bottom"
+                  aria-label="description"
+                  data-test-tooltip="ttl-picker"
+                >
+                  <Icon @name="info" />
+                </Hds::TooltipButton>
               {{/if}}
             </div>
           {{/if}}
@@ -73,6 +71,7 @@
       @checked={{this.enableTTL}}
       @hideLabel={{true}}
       data-test-ttl-toggle={{this.label}}
+      aria-describedby={{concat (dasherize this.label) "-helper-text"}}
     >
       <fieldset class="field is-grouped is-marginless is-borderless">
         {{#if (has-block)}}
@@ -83,18 +82,17 @@
             <span class="ttl-picker-label is-large" data-test-ttl-form-label={{this.label}}>{{this.label}}</span><br />
             {{#if this.helperText}}
               <div class="sub-text">
-                <span data-test-ttl-form-subtext>{{this.helperText}}</span>
+                <span id={{concat (dasherize this.label) "-helper-text"}} data-test-ttl-form-subtext>{{this.helperText}}
+                </span>
                 {{#if @description}}
-                  <ToolTip @verticalPosition="below" as |T|>
-                    <T.Trigger data-test-tooltip-trigger tabindex="-1">
-                      <Icon @name="info" aria-label="description" />
-                    </T.Trigger>
-                    <T.Content @defaultClass="tool-tip">
-                      <div class="box" data-test-hover-copy-tooltip-text>
-                        {{this.description}}
-                      </div>
-                    </T.Content>
-                  </ToolTip>
+                  <Hds::TooltipButton
+                    @text={{@description}}
+                    @placement="bottom"
+                    aria-label="description"
+                    data-test-tooltip="ttl-picker"
+                  >
+                    <Icon @name="info" />
+                  </Hds::TooltipButton>
                 {{/if}}
               </div>
             {{/if}}
diff --git a/ui/lib/core/addon/components/ttl-picker.js b/ui/lib/core/addon/components/ttl-picker.js
index 5ddc7d25774..7eb12e88983 100644
--- a/ui/lib/core/addon/components/ttl-picker.js
+++ b/ui/lib/core/addon/components/ttl-picker.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,18 +12,17 @@
  * - recalculates the time when the unit is changed by the user (eg 60s -> 1m)
  *
  * @example
- * ```js
  * <TtlPicker @onChange={{this.handleChange}} @initialEnabled={{@model.myAttribute}} @initialValue={{@model.myAttribute}}/>
- * ```
- * @param onChange {Function} - This function will be passed a TTL object, which includes enabled{bool}, seconds{number}, timeString{string}, goSafeTimeString{string}.
- * @param initialEnabled=false {Boolean} - Set this value if you want the toggle on when component is mounted
- * @param label="Time to live (TTL)" {String} - Label is the main label that lives next to the toggle. Yielded values will replace the label
- * @param labelDisabled=Label to display when TTL is toggled off
- * @param helperTextEnabled="" {String} - This helper text is shown under the label when the toggle is switched on
- * @param helperTextDisabled="" {String} - This helper text is shown under the label when the toggle is switched off
- * @param initialValue=null {string} - InitialValue is the duration value which will be shown when the component is loaded. If it can't be parsed, will default to 0.
- * @param changeOnInit=false {boolean} - if true, calls the onChange hook when component is initialized
- * @param hideToggle=false {Boolean} - set this value if you'd like to hide the toggle and just leverage the input field
+ *
+ * @param {function} onChange - This function will be passed a TTL object, which includes enabled{bool}, seconds{number}, timeString{string}, goSafeTimeString{string}.
+ * @param {boolean} initialEnabled=false - Set this value if you want the toggle on when component is mounted
+ * @param {string} label=Time to live (TTL) - Label is the main label that lives next to the toggle. Yielded values will replace the label
+ * @param {string} labelDisabled=Label to display when TTL is toggled off
+ * @param {string} helperTextEnabled - This helper text is shown under the label when the toggle is switched on
+ * @param {string} helperTextDisabled - This helper text is shown under the label when the toggle is switched off
+ * @param {string} initialValue=null - InitialValue is the duration value which will be shown when the component is loaded. If it can't be parsed, will default to 0.
+ * @param {boolean} changeOnInit=false - if true, calls the onChange hook when component is initialized
+ * @param {boolean} hideToggle=false - set this value if you'd like to hide the toggle and just leverage the input field
  */
 
 import Component from '@glimmer/component';
diff --git a/ui/lib/core/addon/components/unsaved-changes-modal.hbs b/ui/lib/core/addon/components/unsaved-changes-modal.hbs
new file mode 100644
index 00000000000..ca13023f764
--- /dev/null
+++ b/ui/lib/core/addon/components/unsaved-changes-modal.hbs
@@ -0,0 +1,48 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if this.unsavedChanges.showModal}}
+  <Hds::Modal
+    id="unsavedChangesModal"
+    @onClose={{this.closeModal}}
+    @color="warning"
+    data-test-modal="unsaved-changes"
+    as |M|
+  >
+    <M.Header @icon="alert-triangle" data-test-modal-header="unsaved-changes">
+      Unsaved changes
+    </M.Header>
+    <M.Body data-test-modal-body="unsaved-changes">
+      <Hds::Text::Body @tag="p">You've made changes to the following:</Hds::Text::Body>
+      <br />
+      <ul class="bullet">
+        {{#each (or @changedFields this.unsavedChanges.changedFields) as |changedField|}}
+          <li class="has-left-margin-s">
+            <Hds::Text::Display>{{capitalize changedField}}</Hds::Text::Display>
+          </li>
+        {{/each}}
+      </ul>
+      <br />
+      <Hds::Text::Body @tag="p">Would you like to apply them?</Hds::Text::Body>
+    </M.Body>
+    <M.Footer as |F|>
+      <Hds::ButtonSet>
+        <Hds::Button
+          type="button"
+          @text="Save changes"
+          data-test-button="save"
+          {{on "click" (fn this.closeAndHandle F.close "save")}}
+        />
+        <Hds::Button
+          type="button"
+          @text="Discard changes"
+          @color="secondary"
+          data-test-button="discard"
+          {{on "click" (fn this.closeAndHandle F.close "discard")}}
+        />
+      </Hds::ButtonSet>
+    </M.Footer>
+  </Hds::Modal>
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/components/unsaved-changes-modal.ts b/ui/lib/core/addon/components/unsaved-changes-modal.ts
new file mode 100644
index 00000000000..8d8a0254443
--- /dev/null
+++ b/ui/lib/core/addon/components/unsaved-changes-modal.ts
@@ -0,0 +1,55 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+
+import type SecretsEngineResource from 'vault/resources/secrets/engine';
+import type RouterService from '@ember/routing/router-service';
+import type UnsavedChangesService from 'vault/services/unsaved-changes';
+import type { TaskGenerator, Task } from 'ember-concurrency';
+
+/**
+ * @module UnsavedChangesModal handles displaying the unsaved changes modal.
+ * 
+ * @example
+ * <SecretEngine::UnsavedChangesModal
+    @model={{this.model}}
+    />
+ *
+ * @param {object} model - A model contains a secret engine resource, lease config from the sys/internal endpoint. 
+ * */
+
+interface Args {
+  model: { secretsEngine: SecretsEngineResource };
+  showUnsavedChanges: boolean;
+  onSave: Task<TaskGenerator<[string]>, []>;
+  onDiscard: () => void;
+}
+
+export default class UnsavedChangesModal extends Component<Args> {
+  @service declare readonly router: RouterService;
+  @service declare readonly unsavedChanges: UnsavedChangesService;
+
+  @action
+  closeModal() {
+    this.unsavedChanges.showModal = false;
+  }
+
+  @action
+  closeAndHandle(close: () => void, action: 'save' | 'discard') {
+    close();
+
+    if (action === 'save') {
+      this.args.onSave.perform();
+    }
+
+    if (action === 'discard') {
+      this.unsavedChanges.changedFields = [];
+      this.args.onDiscard();
+    }
+  }
+}
diff --git a/ui/lib/core/addon/components/upgrade-page.hbs b/ui/lib/core/addon/components/upgrade-page.hbs
index a0ddf5c5e68..3b621020d3f 100644
--- a/ui/lib/core/addon/components/upgrade-page.hbs
+++ b/ui/lib/core/addon/components/upgrade-page.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.levelLeft>
diff --git a/ui/lib/core/addon/components/upgrade-page.js b/ui/lib/core/addon/components/upgrade-page.js
index ea9428c1ff2..d3e93a3648f 100644
--- a/ui/lib/core/addon/components/upgrade-page.js
+++ b/ui/lib/core/addon/components/upgrade-page.js
@@ -1,9 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
+/**
+ * @module UpgradePage
+ *
+ * @example
+ * <UpgradePage @title="Namespaces" @minimumEdition="Vault Enterprise Pro" />
+ *
+ */
 
 export default class UpgradePage extends Component {
   get minimumEdition() {
diff --git a/ui/lib/core/addon/components/vault-logo-spinner.hbs b/ui/lib/core/addon/components/vault-logo-spinner.hbs
index 5341a03ebbf..377ab2f3136 100644
--- a/ui/lib/core/addon/components/vault-logo-spinner.hbs
+++ b/ui/lib/core/addon/components/vault-logo-spinner.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! template-lint-disable no-inline-styles}}
 <svg
diff --git a/ui/lib/core/addon/decorators/confirm-leave.js b/ui/lib/core/addon/decorators/confirm-leave.js
index a5e726c58b2..7d875b903a5 100644
--- a/ui/lib/core/addon/decorators/confirm-leave.js
+++ b/ui/lib/core/addon/decorators/confirm-leave.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/decorators/fetch-secrets-engine-config.ts b/ui/lib/core/addon/decorators/fetch-secrets-engine-config.ts
index c01a0df7eb0..df5a62c7ccd 100644
--- a/ui/lib/core/addon/decorators/fetch-secrets-engine-config.ts
+++ b/ui/lib/core/addon/decorators/fetch-secrets-engine-config.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,8 +8,8 @@ import Route from '@ember/routing/route';
 import type Store from '@ember-data/store';
 import type SecretMountPath from 'vault/services/secret-mount-path';
 import type Transition from '@ember/routing/transition';
-import type Model from '@ember-data/model';
-import type AdapterError from 'ember-data/adapter'; // eslint-disable-line ember/use-ember-data-rfc-395-imports
+import type MountConfigModel from 'vault/models/mount-config';
+import type AdapterError from '@ember-data/adapter/error';
 
 /**
  * for use in routes that need to be aware of the config for a secrets engine
@@ -27,20 +27,23 @@ export function withConfig(modelName: string) {
   return function <RouteClass extends new (...args: any[]) => BaseRoute>(SuperClass: RouteClass) {
     if (!Object.prototype.isPrototypeOf.call(Route, SuperClass)) {
       // eslint-disable-next-line
-      console.error(
+      console.debug(
         'withConfig decorator must be used on an instance of Ember Route class. Decorator not applied to returned class'
       );
       return SuperClass;
     }
 
     return class FetchSecretsEngineConfig extends SuperClass {
-      configModel: Model | null = null;
+      configModel: MountConfigModel | null = null;
       configError: AdapterError | null = null;
       promptConfig = false;
 
       async beforeModel(transition: Transition) {
         super.beforeModel(transition);
-
+        if (!this.secretMountPath) {
+          // eslint-disable-next-line
+          console.debug('secretMountPath service is required for withConfig decorator. Add it to the route');
+        }
         const backend = this.secretMountPath.currentPath;
         // check the store for record first
         this.configModel = this.store.peekRecord(modelName, backend);
diff --git a/ui/lib/core/addon/helpers/await.js b/ui/lib/core/addon/helpers/await.js
new file mode 100644
index 00000000000..ec4ef2fec0f
--- /dev/null
+++ b/ui/lib/core/addon/helpers/await.js
@@ -0,0 +1,36 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Helper from '@ember/component/helper';
+import { Promise } from 'rsvp';
+
+export default class AwaitHelper extends Helper {
+  compute([promise]) {
+    if (!promise || typeof promise.then !== 'function') {
+      return promise;
+    }
+    if (promise !== this.lastPromise) {
+      this.lastPromise = promise;
+      this.value = null;
+      this.resolve(promise);
+    }
+    return this.value;
+  }
+  async resolve(promise) {
+    let value;
+    try {
+      value = await Promise.resolve(promise);
+    } catch (error) {
+      value = error;
+    } finally {
+      // ensure this promise is still the newest promise
+      // otherwise avoid firing recompute since a newer promise is in flight
+      if (promise === this.lastPromise) {
+        this.value = value;
+        this.recompute();
+      }
+    }
+  }
+}
diff --git a/ui/lib/core/addon/helpers/changelog-url-for.js b/ui/lib/core/addon/helpers/changelog-url-for.js
index 0928ced1275..02273540f9a 100644
--- a/ui/lib/core/addon/helpers/changelog-url-for.js
+++ b/ui/lib/core/addon/helpers/changelog-url-for.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/cluster-states.js b/ui/lib/core/addon/helpers/cluster-states.js
index 8d22e9fa8cf..73598a2c58f 100644
--- a/ui/lib/core/addon/helpers/cluster-states.js
+++ b/ui/lib/core/addon/helpers/cluster-states.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/date-format.js b/ui/lib/core/addon/helpers/date-format.js
index 0d802d0e1ee..403d1376904 100644
--- a/ui/lib/core/addon/helpers/date-format.js
+++ b/ui/lib/core/addon/helpers/date-format.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -43,7 +43,7 @@ function dateFromString(str) {
   return null;
 }
 
-export function dateFormat([value, style], { withTimeZone = false }) {
+export function dateFormat([value, style = 'MMM d yyyy, h:mm:ss aa'], { withTimeZone = false }) {
   // see format breaking in upgrade to date-fns 2.x https://github.com/date-fns/date-fns/blob/master/CHANGELOG.md#changed-5
   let date;
   switch (checkType(value)) {
@@ -66,15 +66,21 @@ export function dateFormat([value, style], { withTimeZone = false }) {
     return value || '';
   }
 
+  const zone = withTimeZone ? formatTimeZone(date) : '';
+  return format(date, style) + zone;
+}
+
+// separate function for testing
+export function formatTimeZone(date) {
   let zone; // local timezone ex: 'PST'
   try {
     // passing undefined means default to the browser's locale
-    zone = ' ' + date.toLocaleTimeString(undefined, { timeZoneName: 'short' }).split(' ')[2];
+    zone = date.toLocaleTimeString(undefined, { timeZoneName: 'short' }).split(' ')[2];
   } catch (e) {
     zone = '';
   }
-  zone = withTimeZone ? zone : '';
-  return format(date, style) + zone;
+
+  return zone ? ` ${zone}` : '';
 }
 
 export default helper(dateFormat);
diff --git a/ui/lib/core/addon/helpers/date-from-now.js b/ui/lib/core/addon/helpers/date-from-now.js
new file mode 100644
index 00000000000..249d2986ca4
--- /dev/null
+++ b/ui/lib/core/addon/helpers/date-from-now.js
@@ -0,0 +1,16 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { helper } from '@ember/component/helper';
+import { formatDistanceToNow } from 'date-fns';
+
+export function dateFromNow([date], options = {}) {
+  // check first if string. If it is, it could be ISO format or UTC, either way create a new date object
+  // otherwise it's a number or object and just return
+  const newDate = typeof date === 'string' ? new Date(date) : date;
+  return formatDistanceToNow(newDate, { ...options });
+}
+
+export default helper(dateFromNow);
diff --git a/ui/lib/core/addon/helpers/doc-link.js b/ui/lib/core/addon/helpers/doc-link.js
index bf0b113feed..a2c25858e9f 100644
--- a/ui/lib/core/addon/helpers/doc-link.js
+++ b/ui/lib/core/addon/helpers/doc-link.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/format-duration.js b/ui/lib/core/addon/helpers/format-duration.js
index be6b9f0c687..d151d9e7072 100644
--- a/ui/lib/core/addon/helpers/format-duration.js
+++ b/ui/lib/core/addon/helpers/format-duration.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/format-number.js b/ui/lib/core/addon/helpers/format-number.js
index 397b77ae2dc..883afd380e8 100644
--- a/ui/lib/core/addon/helpers/format-number.js
+++ b/ui/lib/core/addon/helpers/format-number.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/has-capability.ts b/ui/lib/core/addon/helpers/has-capability.ts
new file mode 100644
index 00000000000..625fad76157
--- /dev/null
+++ b/ui/lib/core/addon/helpers/has-capability.ts
@@ -0,0 +1,66 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+/**
+ * helper to get capabilities from map for given item by id
+ * useful in list views when capabilities are fetched for each item
+ * provide the full map of capabilities along with the id of the item and capabilities to be evaluated (read, update etc)
+ * multiple capabilities will return true if any of the capabilities are true by default
+ * to check if all provided capability types are true, set the all argument to true
+ * usage example: {{has-capability this.capabilities "delete" "update" pathKey="customMessages" params=message all=true}}
+ */
+
+import Helper from '@ember/component/helper';
+import { service } from '@ember/service';
+import { capitalize } from '@ember/string';
+
+import type { Capabilities, CapabilitiesMap, CapabilityTypes } from 'vault/app-types';
+import type CapabilitiesService from 'vault/services/capabilities';
+import type { PATH_MAP } from 'vault/utils/constants/capabilities';
+
+export default class HasCapabilityHelper extends Helper {
+  @service declare readonly capabilities: CapabilitiesService;
+
+  compute<T>(
+    [capabilitiesMap, ...types]: [CapabilitiesMap, ...CapabilityTypes[]],
+    { pathKey, params, all = false }: { pathKey: keyof typeof PATH_MAP; params?: T; all?: boolean }
+  ) {
+    // since the default is to return true we need to validate the inputs here more thoroughly
+    // this is to help devs from thinking that the checks are working properly when the capability lookup is actually failing
+    if (!capabilitiesMap) {
+      throw new Error('First positional argument must be the capabilities map.');
+    }
+    if (!types || !types.length) {
+      throw new Error('At least one capability type is required as a positional argument.');
+    }
+    const acceptedTypes = ['read', 'update', 'delete', 'list', 'create', 'patch', 'sudo'];
+    const invalidTypes = types.filter((type) => !acceptedTypes.includes(type));
+    if (invalidTypes.length) {
+      throw new Error(
+        `Invalid capability types: ${invalidTypes.join(', ')}. Accepted types are: ${acceptedTypes.join(
+          ', '
+        )}.`
+      );
+    }
+    if (!pathKey) {
+      throw new Error('pathKey is a required named arg for path lookup in capabilities map');
+    }
+
+    const path = this.capabilities.pathFor(pathKey, params);
+    const capabilities = capabilitiesMap[path];
+
+    if (capabilities) {
+      const method = all ? 'every' : 'some';
+
+      return types[method]((type) => {
+        const key = `can${capitalize(type)}` as keyof Capabilities;
+        return capabilities[key];
+      });
+    }
+
+    // similar to the Capabilities service, default to allow and the API will deny if needed
+    return true;
+  }
+}
diff --git a/ui/lib/core/addon/helpers/has-feature.js b/ui/lib/core/addon/helpers/has-feature.js
index bf240920c46..bc245017278 100644
--- a/ui/lib/core/addon/helpers/has-feature.js
+++ b/ui/lib/core/addon/helpers/has-feature.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/img-path.js b/ui/lib/core/addon/helpers/img-path.js
index e6264f2ee15..0c4b82e51e8 100644
--- a/ui/lib/core/addon/helpers/img-path.js
+++ b/ui/lib/core/addon/helpers/img-path.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/is-active-route.js b/ui/lib/core/addon/helpers/is-active-route.js
index 9dbe2f536fc..ad5a023a66b 100644
--- a/ui/lib/core/addon/helpers/is-active-route.js
+++ b/ui/lib/core/addon/helpers/is-active-route.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -21,8 +21,8 @@ export default Helper.extend({
 
   compute([routeName, model], { isExact }) {
     const router = this.router;
-    const currentRoute = router.get('currentRouteName');
-    let currentURL = router.get('currentURL');
+    const currentRoute = router.currentRouteName;
+    let currentURL = router.currentURL;
     // if we have any query params we want to discard them
     currentURL = currentURL?.split('?')[0];
     const comparator = isExact ? exact : startsWith;
diff --git a/ui/lib/core/addon/helpers/is-empty-value.js b/ui/lib/core/addon/helpers/is-empty-value.js
index 513353f692b..51e6815ca2b 100644
--- a/ui/lib/core/addon/helpers/is-empty-value.js
+++ b/ui/lib/core/addon/helpers/is-empty-value.js
@@ -1,11 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { helper } from '@ember/component/helper';
 
-export default helper(function isEmptyValue([value], { hasDefault = false }) {
+export function isEmptyValue(value, hasDefault = false) {
   if (hasDefault) {
     value = hasDefault;
   }
@@ -13,4 +13,8 @@ export default helper(function isEmptyValue([value], { hasDefault = false }) {
     return Object.keys(value).length === 0;
   }
   return value == null || value === '';
+}
+
+export default helper(function ([value], { hasDefault = false }) {
+  return isEmptyValue(value, hasDefault);
 });
diff --git a/ui/lib/core/addon/helpers/jsonify.js b/ui/lib/core/addon/helpers/jsonify.js
index 466900eb9fa..3a7378bbb0c 100644
--- a/ui/lib/core/addon/helpers/jsonify.js
+++ b/ui/lib/core/addon/helpers/jsonify.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/loose-equal.js b/ui/lib/core/addon/helpers/loose-equal.js
index ccdb6169d18..bb309b0c007 100644
--- a/ui/lib/core/addon/helpers/loose-equal.js
+++ b/ui/lib/core/addon/helpers/loose-equal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/message-types.js b/ui/lib/core/addon/helpers/message-types.js
index 72c90a39746..90c9ee8d7d0 100644
--- a/ui/lib/core/addon/helpers/message-types.js
+++ b/ui/lib/core/addon/helpers/message-types.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/new-line-split.js b/ui/lib/core/addon/helpers/new-line-split.js
index e456895b4b3..98d91338a58 100644
--- a/ui/lib/core/addon/helpers/new-line-split.js
+++ b/ui/lib/core/addon/helpers/new-line-split.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/options-for-backend.js b/ui/lib/core/addon/helpers/options-for-backend.js
index 115aaeca36f..78c4ff837cb 100644
--- a/ui/lib/core/addon/helpers/options-for-backend.js
+++ b/ui/lib/core/addon/helpers/options-for-backend.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -140,11 +140,20 @@ const SECRET_BACKENDS = {
   transit: {
     searchPlaceholder: 'Filter keys',
     item: 'key',
-    create: 'Create encryption key',
+    create: 'Create key',
     navigateTree: false,
     editComponent: 'transit-edit',
     listItemPartial: 'secret-list/item',
-    firstStep: `To use transit, you'll need to create an encryption key`,
+    firstStep: `To use transit, you'll need to create a key`,
+  },
+  totp: {
+    displayName: 'TOTP',
+    searchPlaceholder: 'Filter keys',
+    item: 'key',
+    create: 'Add key',
+    navigateTree: false,
+    editComponent: 'totp-edit',
+    listItemPartial: 'secret-list/totp-list-item',
   },
 };
 
diff --git a/ui/lib/core/addon/helpers/path-or-array.js b/ui/lib/core/addon/helpers/path-or-array.js
index 16876c0e078..df226d3195a 100644
--- a/ui/lib/core/addon/helpers/path-or-array.js
+++ b/ui/lib/core/addon/helpers/path-or-array.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ export function pathOrArray([maybeArray, target]) {
   if (Array.isArray(maybeArray)) {
     return maybeArray;
   }
-  return target.get(maybeArray);
+  return target[maybeArray];
 }
 
 export default buildHelper(pathOrArray);
diff --git a/ui/lib/core/addon/helpers/replication-action-for-mode.js b/ui/lib/core/addon/helpers/replication-action-for-mode.js
index 924cee71e0b..7b1ac43eae7 100644
--- a/ui/lib/core/addon/helpers/replication-action-for-mode.js
+++ b/ui/lib/core/addon/helpers/replication-action-for-mode.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/replication-mode-description.js b/ui/lib/core/addon/helpers/replication-mode-description.js
index 17d8596c9c4..34842695faf 100644
--- a/ui/lib/core/addon/helpers/replication-mode-description.js
+++ b/ui/lib/core/addon/helpers/replication-mode-description.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,7 @@ const REPLICATION_MODE_DESCRIPTIONS = {
     'Performance Replication scales workloads horizontally across clusters to make requests faster. Local secondaries handle read requests but forward writes to the primary to be handled.',
 };
 
-export function replicationModeDescription([mode]) {
+function replicationModeDescription([mode]) {
   return REPLICATION_MODE_DESCRIPTIONS[mode];
 }
 
diff --git a/ui/lib/core/addon/helpers/sanitized-html.js b/ui/lib/core/addon/helpers/sanitized-html.js
index 5fe229c6b77..ebf7fd775bb 100644
--- a/ui/lib/core/addon/helpers/sanitized-html.js
+++ b/ui/lib/core/addon/helpers/sanitized-html.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/set-flash-message.js b/ui/lib/core/addon/helpers/set-flash-message.js
index dc726b7f67c..a28b01cdfab 100644
--- a/ui/lib/core/addon/helpers/set-flash-message.js
+++ b/ui/lib/core/addon/helpers/set-flash-message.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/stringify.js b/ui/lib/core/addon/helpers/stringify.js
index a462f9c574f..25bfbc2a9b9 100644
--- a/ui/lib/core/addon/helpers/stringify.js
+++ b/ui/lib/core/addon/helpers/stringify.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/sync-destinations.ts b/ui/lib/core/addon/helpers/sync-destinations.ts
index 5581437e370..b0025ec5bcf 100644
--- a/ui/lib/core/addon/helpers/sync-destinations.ts
+++ b/ui/lib/core/addon/helpers/sync-destinations.ts
@@ -1,14 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { helper as buildHelper } from '@ember/component/helper';
 
-import type { SyncDestination, SyncDestinationType } from 'vault/vault/helpers/sync-destinations';
+import type { DestinationType } from 'vault/sync';
+import type { SyncDestination } from 'vault/helpers/sync-destinations';
 
 /* 
-This helper is referenced in the base sync destination model and elsewhere to set attributes that rely on type
+This helper is used to lookup static display properties for sync destinations
 maskedParams: attributes for sensitive data, the API returns these values as '*****'
 */
 
@@ -18,7 +19,8 @@ const SYNC_DESTINATIONS: Array<SyncDestination> = [
     type: 'aws-sm',
     icon: 'aws-color',
     category: 'cloud',
-    maskedParams: ['accessKeyId', 'secretAccessKey'],
+    maskedParams: ['access_key_id', 'secret_access_key'],
+    readonlyParams: ['name', 'region'],
     defaultValues: {
       granularity: 'secret-path',
     },
@@ -28,7 +30,8 @@ const SYNC_DESTINATIONS: Array<SyncDestination> = [
     type: 'azure-kv',
     icon: 'azure-color',
     category: 'cloud',
-    maskedParams: ['clientSecret'],
+    maskedParams: ['client_secret'],
+    readonlyParams: ['name', 'key_vault_uri', 'tenant_id', 'cloud'],
     defaultValues: {
       granularity: 'secret-path',
     },
@@ -39,6 +42,7 @@ const SYNC_DESTINATIONS: Array<SyncDestination> = [
     icon: 'gcp-color',
     category: 'cloud',
     maskedParams: ['credentials'],
+    readonlyParams: ['name'],
     defaultValues: {
       granularity: 'secret-path',
     },
@@ -48,7 +52,8 @@ const SYNC_DESTINATIONS: Array<SyncDestination> = [
     type: 'gh',
     icon: 'github-color',
     category: 'dev-tools',
-    maskedParams: ['accessToken'],
+    maskedParams: ['access_token'],
+    readonlyParams: ['name', 'repository_owner', 'repository_name'],
     defaultValues: {
       granularity: 'secret-key',
     },
@@ -58,9 +63,11 @@ const SYNC_DESTINATIONS: Array<SyncDestination> = [
     type: 'vercel-project',
     icon: 'vercel-color',
     category: 'dev-tools',
-    maskedParams: ['accessToken'],
+    maskedParams: ['access_token'],
+    readonlyParams: ['name', 'project_id'],
     defaultValues: {
       granularity: 'secret-key',
+      deployment_environments: [],
     },
   },
 ];
@@ -69,12 +76,16 @@ export function syncDestinations(): Array<SyncDestination> {
   return [...SYNC_DESTINATIONS];
 }
 
-export function destinationTypes(): Array<SyncDestinationType> {
+export function destinationTypes(): Array<DestinationType> {
   return SYNC_DESTINATIONS.map((d) => d.type);
 }
 
-export function findDestination(type: SyncDestinationType | undefined): SyncDestination | undefined {
-  return SYNC_DESTINATIONS.find((d) => d.type === type);
+export function findDestination(type: DestinationType) {
+  const destination = SYNC_DESTINATIONS.find((d) => d.type === type);
+  if (!destination) {
+    throw new Error(`Destination not found for type: ${type}`);
+  }
+  return destination;
 }
 
 export default buildHelper(syncDestinations);
diff --git a/ui/lib/core/addon/helpers/to-label.js b/ui/lib/core/addon/helpers/to-label.js
index 28990e0e904..51d47e70c67 100644
--- a/ui/lib/core/addon/helpers/to-label.js
+++ b/ui/lib/core/addon/helpers/to-label.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/helpers/transition-to.js b/ui/lib/core/addon/helpers/transition-to.js
new file mode 100644
index 00000000000..63c89f886b6
--- /dev/null
+++ b/ui/lib/core/addon/helpers/transition-to.js
@@ -0,0 +1,31 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Helper from '@ember/component/helper';
+import { getOwner } from '@ember/owner';
+
+/*
+template helper that replaces ember-router-helpers https://github.com/rwjblue/ember-router-helpers
+example:
+<MyForm @onSave={{transition-to "vault.cluster.some.route.item" "item-id"}} />
+<MyForm @onSave={{transition-to "vault.cluster.some.external.route"  external=true}} />
+*/
+export default class TransitionTo extends Helper {
+  // We don't import the router service here because Ember Engine's use the alias 'app-router'
+  // Since this helper is shared across engines, we look up the router dynamically using getOwner instead.
+  // This way we avoid throwing an error by looking up a service that doesn't exist.
+  // https://guides.emberjs.com/release/services/#toc_accessing-services
+  get router() {
+    const owner = getOwner(this);
+    return owner.lookup('service:router') || owner.lookup('service:app-router');
+  }
+
+  compute(routeParams, { external = false }) {
+    if (external) {
+      return () => this.router.transitionToExternal(...routeParams);
+    }
+    return () => this.router.transitionTo(...routeParams);
+  }
+}
diff --git a/ui/lib/core/addon/mixins/list-controller.js b/ui/lib/core/addon/mixins/list-controller.js
index 024c5e80124..028a6fdb601 100644
--- a/ui/lib/core/addon/mixins/list-controller.js
+++ b/ui/lib/core/addon/mixins/list-controller.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/mixins/list-route.js b/ui/lib/core/addon/mixins/list-route.js
index 781e76fb58c..0c43b0cc67e 100644
--- a/ui/lib/core/addon/mixins/list-route.js
+++ b/ui/lib/core/addon/mixins/list-route.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -35,12 +35,12 @@ export default Mixin.create({
     willTransition(transition) {
       window.scrollTo(0, 0);
       if (transition.targetName !== this.routeName) {
-        this.store.clearAllDatasets();
+        this.pagination.clearDataset();
       }
       return true;
     },
     reload() {
-      this.store.clearAllDatasets();
+      this.pagination.clearDataset();
       this.refresh();
     },
   },
diff --git a/ui/lib/core/addon/mixins/replication-actions.js b/ui/lib/core/addon/mixins/replication-actions.js
index 10ab7e2ff4a..460db291d12 100644
--- a/ui/lib/core/addon/mixins/replication-actions.js
+++ b/ui/lib/core/addon/mixins/replication-actions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,9 +11,7 @@ import { task } from 'ember-concurrency';
 
 export default Mixin.create({
   store: service(),
-  router: service(),
   loading: or('save.isRunning', 'submitSuccess.isRunning'),
-  onEnable() {},
   onDisable() {},
   onPromote() {},
   submitHandler: task(function* (action, clusterMode, data, event) {
@@ -53,10 +51,9 @@ export default Mixin.create({
     return yield this.submitSuccess.perform(resp, action, clusterMode);
   }).drop(),
 
-  submitSuccess: task(function* (resp, action, mode) {
+  submitSuccess: task(function* (resp, action) {
+    // enable action is handled separately in EnableReplicationForm component
     const cluster = this.cluster;
-    const replicationMode = this.selectedReplicationMode || this.replicationMode;
-    const store = this.store;
     if (!cluster) {
       return;
     }
@@ -75,20 +72,6 @@ export default Mixin.create({
     if (this.reset) {
       this.reset();
     }
-    if (action === 'enable') {
-      // do something to show model is pending
-      cluster.set(
-        replicationMode,
-        store.createRecord('replication-attributes', {
-          mode: 'bootstrapping',
-        })
-      );
-      if (mode === 'secondary' && replicationMode === 'performance') {
-        // if we're enabing a secondary, there could be mount filtering,
-        // so we should unload all of the backends
-        store.unloadAll('secret-engine');
-      }
-    }
     try {
       yield cluster.reload();
     } catch (e) {
@@ -101,11 +84,6 @@ export default Mixin.create({
     if (action === 'promote') {
       yield this.onPromote();
     }
-    if (action === 'enable') {
-      /// onEnable is a method available only to route vault.cluster.replication.index
-      // if action 'enable' is called from vault.cluster.replication.mode.index this method is not called
-      yield this.onEnable(replicationMode, mode);
-    }
   }).drop(),
 
   submitError(e) {
diff --git a/ui/lib/core/addon/modifiers/code-mirror.js b/ui/lib/core/addon/modifiers/code-mirror.js
deleted file mode 100644
index 2860684abea..00000000000
--- a/ui/lib/core/addon/modifiers/code-mirror.js
+++ /dev/null
@@ -1,78 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { action } from '@ember/object';
-import { bind } from '@ember/runloop';
-import codemirror from 'codemirror';
-import Modifier from 'ember-modifier';
-
-import 'codemirror/addon/edit/matchbrackets';
-import 'codemirror/addon/selection/active-line';
-import 'codemirror/addon/display/autorefresh';
-import 'codemirror/addon/lint/lint.js';
-import 'codemirror/addon/lint/json-lint.js';
-// right now we only use the ruby and javascript, if you use another mode you'll need to import it.
-// https://codemirror.net/mode/
-import 'codemirror/mode/ruby/ruby';
-import 'codemirror/mode/javascript/javascript';
-
-export default class CodeMirrorModifier extends Modifier {
-  modify(element, positionalArgs, namedArgs) {
-    // setup codemirror initially when modifier is installed on the element
-    if (!this._editor) {
-      this._setup(element, namedArgs);
-    } else {
-      // this hook also fires any time there is a change to tracked state
-      this._editor.setOption('readOnly', namedArgs.readOnly);
-      if (namedArgs.content && this._editor.getValue() !== namedArgs.content) {
-        this._editor.setValue(namedArgs.content);
-      }
-    }
-  }
-
-  @action
-  _onChange(namedArgs, editor) {
-    // avoid sending change event after initial setup when editor value is set to content
-    if (namedArgs.content !== editor.getValue()) {
-      namedArgs.onUpdate(editor.getValue(), this._editor);
-    }
-  }
-
-  @action
-  _onFocus(namedArgs, editor) {
-    namedArgs.onFocus(editor.getValue());
-  }
-
-  _setup(element, namedArgs) {
-    const editor = codemirror(element, {
-      // IMPORTANT: `gutters` must come before `lint` since the presence of
-      // `gutters` is cached internally when `lint` is toggled
-      gutters: namedArgs.gutters || ['CodeMirror-lint-markers'],
-      matchBrackets: true,
-      lint: { lintOnChange: true },
-      showCursorWhenSelecting: true,
-      styleActiveLine: true,
-      tabSize: 2,
-      // all values we can pass into the JsonEditor
-      extraKeys: namedArgs.extraKeys || '',
-      lineNumbers: namedArgs.lineNumbers,
-      mode: namedArgs.mode || 'application/json',
-      readOnly: namedArgs.readOnly || false,
-      theme: namedArgs.theme || 'hashi',
-      value: namedArgs.content || '',
-      viewportMargin: namedArgs.viewportMargin || '',
-      autoRefresh: namedArgs.autoRefresh,
-    });
-
-    editor.on('change', bind(this, this._onChange, namedArgs));
-    editor.on('focus', bind(this, this._onFocus, namedArgs));
-
-    this._editor = editor;
-
-    if (namedArgs.onSetup) {
-      namedArgs.onSetup(editor);
-    }
-  }
-}
diff --git a/ui/lib/core/addon/templates/components/edit-form.hbs b/ui/lib/core/addon/templates/components/edit-form.hbs
deleted file mode 100644
index 2ca2fb583b8..00000000000
--- a/ui/lib/core/addon/templates/components/edit-form.hbs
+++ /dev/null
@@ -1,37 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form {{action (perform this.save this.model) on="submit"}}>
-  <MessageError @model={{this.model}} data-test-edit-form-error />
-  <div class={{if this.includeBox "box is-sideless is-fullwidth is-marginless"}}>
-    <NamespaceReminder @mode="save" />
-    {{#if (or this.model.fields this.model.attrs)}}
-      {{#each (or this.model.fields this.model.attrs) as |attr|}}
-        <FormField
-          data-test-field
-          @attr={{attr}}
-          @model={{this.model}}
-          @mode={{@mode}}
-          @modelValidations={{this.modelValidations}}
-        />
-      {{/each}}
-    {{else if this.model.fieldGroups}}
-      <FormFieldGroups @model={{this.model}} @mode={{@mode}} @modelValidations={{this.modelValidations}} />
-    {{/if}}
-  </div>
-  <FormSaveButtons
-    @isSaving={{this.save.isRunning}}
-    @saveButtonText={{this.saveButtonText}}
-    @cancelLinkParams={{@cancelLinkParams}}
-    @includeBox={{this.includeBox}}
-    @onCancel={{@onCancel}}
-  >
-    <:error>
-      {{#if this.invalidFormAlert}}
-        <AlertInline @type="danger" class="has-top-padding-s" @message={{this.invalidFormAlert}} />
-      {{/if}}
-    </:error>
-  </FormSaveButtons>
-</form>
\ No newline at end of file
diff --git a/ui/lib/core/addon/templates/components/message-error.hbs b/ui/lib/core/addon/templates/components/message-error.hbs
deleted file mode 100644
index 9678ab51199..00000000000
--- a/ui/lib/core/addon/templates/components/message-error.hbs
+++ /dev/null
@@ -1,13 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if this.displayErrors}}
-  {{#each this.displayErrors as |error|}}
-    <Hds::Alert data-test-message-error @type="inline" @color="critical" class="has-top-margin-s has-bottom-margin-s" as |A|>
-      <A.Title>Error</A.Title>
-      <A.Description data-test-message-error-description>{{error}}</A.Description>
-    </Hds::Alert>
-  {{/each}}
-{{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/templates/components/replication-header.hbs b/ui/lib/core/addon/templates/components/replication-header.hbs
deleted file mode 100644
index a790e3f30c6..00000000000
--- a/ui/lib/core/addon/templates/components/replication-header.hbs
+++ /dev/null
@@ -1,51 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<PageHeader as |p|>
-  <p.top>
-    {{#if (not (or this.isSummaryDashboard this.isSecondary))}}
-      <Hds::Breadcrumb>
-        <Hds::Breadcrumb::Item @text="Replication" @route="vault.cluster.replication.index" />
-        <Hds::Breadcrumb::Item @text={{this.title}} @current={{true}} />
-      </Hds::Breadcrumb>
-    {{/if}}
-  </p.top>
-  <p.levelLeft>
-    <h1 class="title is-3" data-test-replication-title>
-      {{this.title}}
-      {{#if this.data.anyReplicationEnabled}}
-        <span class="tag is-light has-text-grey-dark" data-test-mode>
-          {{if this.isSecondary "secondary" "primary"}}
-        </span>
-        <span class="tag is-light has-text-grey-dark" data-test-secondaryId>
-          {{this.secondaryId}}
-        </span>
-      {{/if}}
-    </h1>
-  </p.levelLeft>
-</PageHeader>
-
-{{#if this.showTabs}}
-  <div class="tabs-container box is-bottomless is-fullwidth is-paddingless has-bottom-margin-l" data-test-tabs>
-    <nav class="tabs">
-      {{#if this.isSummaryDashboard}}
-        <ul>
-          <li class="is-active">
-            <LinkToExternal @route="replication">Summary</LinkToExternal>
-          </li>
-        </ul>
-      {{else}}
-        <ul>
-          <LinkTo @route="vault.cluster.replication-dr-promote.details">
-            Details
-          </LinkTo>
-          <LinkTo @route="vault.cluster.replication-dr-promote" @current-when="vault.cluster.replication-dr-promote.index">
-            Manage
-          </LinkTo>
-        </ul>
-      {{/if}}
-    </nav>
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/templates/components/replication-mode-summary.hbs b/ui/lib/core/addon/templates/components/replication-mode-summary.hbs
deleted file mode 100644
index bd2eec9950c..00000000000
--- a/ui/lib/core/addon/templates/components/replication-mode-summary.hbs
+++ /dev/null
@@ -1,122 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if this.isMenu}}
-  {{! this is the status menu }}
-  <div class="level is-mobile">
-    <div class="is-flex-grow-1">
-      {{#if this.replicationUnsupported}}
-        Unsupported
-      {{else if this.replicationEnabled}}
-        <div>
-          {{concat (if (eq this.mode "performance") "Performance " "Disaster Recovery ") (capitalize this.modeForUrl)}}
-        </div>
-        {{#if this.secondaryId}}
-          <small>
-            <code>
-              {{this.secondaryId}}
-            </code>
-          </small>
-        {{/if}}
-        <small>
-          <code>
-            {{this.clusterIdDisplay}}
-          </code>
-        </small>
-      {{else if (and (eq this.mode "performance") (not (has-feature "Performance Replication")))}}
-        Learn more
-      {{else if this.auth.currentToken}}
-        Enable
-        {{if (eq this.mode "performance") "Performance" "Disaster Recovery"}}
-      {{else}}
-        <span class="has-text-grey-light">
-          {{if (eq this.mode "performance") "Performance" "Disaster Recovery"}}
-        </span>
-      {{/if}}
-    </div>
-    <div class="level-right">
-      {{#if this.replicationEnabled}}
-        {{#if (cluster-states this.modeState)}}
-          <span class={{if (get (cluster-states this.modeState) "isOk") "has-text-success" "has-text-danger"}}>
-            <Icon @name={{get (cluster-states this.modeState) "glyph"}} />
-          </span>
-        {{else if this.syncProgress}}
-          <progress value={{this.syncProgressPercent}} max="100" class="progress is-small is-narrow is-info">
-            {{this.syncProgress.progress}}
-            of
-            {{this.syncProgress.total}}
-            keys
-          </progress>
-        {{/if}}
-      {{else}}
-        <Icon @name="minus-circle" aria-label="Replication not enabled" class="has-text-grey-light" />
-      {{/if}}
-    </div>
-  </div>
-{{else}}
-  {{! this is the replication index page }}
-  <div class="level">
-    <div class="replication-description level-left">
-      <div>
-        {{#if (and (eq this.mode "performance") (not (has-feature "Performance Replication")))}}
-          <p>
-            Performance Replication is a feature of Vault Enterprise Premium.
-            <ExternalLink
-              @href="https://hashicorp.com/products/vault/trial?source=vaultui_Performance%20Replication"
-              class="link"
-              data-test-upgrade-link-performance
-            >
-              Upgrade
-            </ExternalLink>
-          </p>
-        {{else if (and (eq this.mode "dr") (not (has-feature "DR Replication")))}}
-          <p>
-            Disaster Recovery is a feature of Vault Enterprise Premium.
-            <ExternalLink
-              @href="https://hashicorp.com/products/vault/trial?source=vaultui_Performance%20Replication"
-              class="link"
-              data-test-upgrade-link-dr
-            >
-              Upgrade
-            </ExternalLink>
-          </p>
-        {{else if this.replicationEnabled}}
-          <h6 class="title is-6 is-uppercase">
-            Enabled
-          </h6>
-          <div class="detail-tags">
-            <span class="has-text-grey">
-              {{capitalize this.modeForUrl}}
-            </span>
-            {{#if this.secondaryId}}
-              <span class="tag is-light has-text-grey-dark">
-                <code>
-                  {{this.secondaryId}}
-                </code>
-              </span>
-            {{/if}}
-            <span class="tag is-light has-text-grey-dark">
-              <code>
-                {{this.clusterIdDisplay}}
-              </code>
-            </span>
-          </div>
-        {{/if}}
-        <p class="help has-text-grey-dark">
-          {{replication-mode-description this.mode}}
-        </p>
-      </div>
-    </div>
-    <div class="level-right">
-      <Hds::Button
-        @route="mode.index"
-        @models={{array this.cluster.name this.mode}}
-        @color={{if this.replicationDisabled "primary" "secondary"}}
-        @text={{if this.replicationDisabled "Enable" "Details"}}
-        data-test-replication-details-link={{this.mode}}
-      />
-    </div>
-  </div>
-{{/if}}
\ No newline at end of file
diff --git a/ui/lib/core/addon/utils/advanced-secret.js b/ui/lib/core/addon/utils/advanced-secret.js
index d17ba71e762..d1cb317789e 100644
--- a/ui/lib/core/addon/utils/advanced-secret.js
+++ b/ui/lib/core/addon/utils/advanced-secret.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -18,23 +18,3 @@ export function isAdvancedSecret(value) {
     return false;
   }
 }
-
-/**
- * Method to obfuscate all values in a map, including nested values and arrays
- * @param obj object
- * @returns object
- */
-export function obfuscateData(obj) {
-  if (typeof obj !== 'object' || Array.isArray(obj)) return obj;
-  const newObj = {};
-  for (const key of Object.keys(obj)) {
-    if (Array.isArray(obj[key])) {
-      newObj[key] = obj[key].map(() => '********');
-    } else if (typeof obj[key] === 'object') {
-      newObj[key] = obfuscateData(obj[key]);
-    } else {
-      newObj[key] = '********';
-    }
-  }
-  return newObj;
-}
diff --git a/ui/lib/core/addon/utils/b64.js b/ui/lib/core/addon/utils/b64.js
index 6887d3dc70d..e32e1d533f5 100644
--- a/ui/lib/core/addon/utils/b64.js
+++ b/ui/lib/core/addon/utils/b64.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/utils/client-count-utils.js b/ui/lib/core/addon/utils/client-count-utils.js
deleted file mode 100644
index 770e45f41de..00000000000
--- a/ui/lib/core/addon/utils/client-count-utils.js
+++ /dev/null
@@ -1,279 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { parseAPITimestamp } from 'core/utils/date-formatters';
-import { compareAsc, getUnixTime } from 'date-fns';
-
-export const formatDateObject = (dateObj, isEnd) => {
-  if (dateObj) {
-    const { year, monthIdx } = dateObj;
-    // day=0 for Date.UTC() returns the last day of the month before
-    // increase monthIdx by one to get last day of queried month
-    const utc = isEnd ? Date.UTC(year, monthIdx + 1, 0) : Date.UTC(year, monthIdx, 1);
-    return getUnixTime(utc);
-  }
-};
-
-export const formatByMonths = (monthsArray) => {
-  // the monthsArray will always include a timestamp of the month and either new/total client data or counts = null
-  if (!Array.isArray(monthsArray)) return monthsArray;
-
-  const sortedPayload = sortMonthsByTimestamp(monthsArray);
-  return sortedPayload?.map((m) => {
-    const month = parseAPITimestamp(m.timestamp, 'M/yy');
-    const totalClientsByNamespace = formatByNamespace(m.namespaces);
-    const newClientsByNamespace = formatByNamespace(m.new_clients?.namespaces);
-    if (Object.keys(m).includes('counts')) {
-      const totalCounts = flattenDataset(m);
-      const newCounts = m.new_clients ? flattenDataset(m.new_clients) : {};
-      return {
-        month,
-        timestamp: m.timestamp,
-        ...totalCounts,
-        namespaces: formatByNamespace(m.namespaces) || [],
-        namespaces_by_key: namespaceArrayToObject(
-          totalClientsByNamespace,
-          newClientsByNamespace,
-          month,
-          m.timestamp
-        ),
-        new_clients: {
-          month,
-          timestamp: m.timestamp,
-          ...newCounts,
-          namespaces: formatByNamespace(m.new_clients?.namespaces) || [],
-        },
-      };
-    }
-  });
-};
-
-export const formatByNamespace = (namespaceArray) => {
-  if (!Array.isArray(namespaceArray)) return namespaceArray;
-  return namespaceArray?.map((ns) => {
-    // 'namespace_path' is an empty string for root
-    if (ns['namespace_id'] === 'root') ns['namespace_path'] = 'root';
-    const label = ns['namespace_path'];
-    const flattenedNs = flattenDataset(ns);
-    // if no mounts, mounts will be an empty array
-    flattenedNs.mounts = [];
-    if (ns?.mounts && ns.mounts.length > 0) {
-      flattenedNs.mounts = ns.mounts.map((mount) => {
-        return {
-          label: mount['mount_path'],
-          ...flattenDataset(mount),
-        };
-      });
-    }
-    return {
-      label,
-      ...flattenedNs,
-    };
-  });
-};
-
-// In 1.10 'distinct_entities' changed to 'entity_clients' and
-// 'non_entity_tokens' to 'non_entity_clients'
-export const homogenizeClientNaming = (object) => {
-  // if new key names exist, only return those key/value pairs
-  if (Object.keys(object).includes('entity_clients')) {
-    const { clients, entity_clients, non_entity_clients, secret_syncs } = object;
-    return {
-      clients,
-      entity_clients,
-      non_entity_clients,
-      secret_syncs,
-    };
-  }
-  // if object only has outdated key names, update naming
-  if (Object.keys(object).includes('distinct_entities')) {
-    const { clients, distinct_entities, non_entity_tokens } = object;
-    return {
-      clients,
-      entity_clients: distinct_entities,
-      non_entity_clients: non_entity_tokens,
-    };
-  }
-  return object;
-};
-
-export const flattenDataset = (object) => {
-  if (object?.counts) {
-    const flattenedObject = {};
-    Object.keys(object['counts']).forEach((key) => (flattenedObject[key] = object['counts'][key]));
-    return homogenizeClientNaming(flattenedObject);
-  }
-  return object;
-};
-
-export const sortMonthsByTimestamp = (monthsArray) => {
-  const sortedPayload = [...monthsArray];
-  return sortedPayload.sort((a, b) =>
-    compareAsc(parseAPITimestamp(a.timestamp), parseAPITimestamp(b.timestamp))
-  );
-};
-
-export const namespaceArrayToObject = (totalClientsByNamespace, newClientsByNamespace, month, timestamp) => {
-  if (!totalClientsByNamespace) return {}; // return if no data for that month
-  // all 'new_client' data resides within a separate key of each month (see data structure below)
-  // FIRST: iterate and nest respective 'new_clients' data within each namespace and mount object
-  // note: this is happening within the month object
-  const nestNewClientsWithinNamespace = totalClientsByNamespace?.map((ns) => {
-    const newNamespaceCounts = newClientsByNamespace?.find((n) => n.label === ns.label);
-    if (newNamespaceCounts) {
-      const { label, clients, entity_clients, non_entity_clients, secret_syncs } = newNamespaceCounts;
-      const newClientsByMount = [...newNamespaceCounts.mounts];
-      const nestNewClientsWithinMounts = ns.mounts?.map((mount) => {
-        const new_clients = newClientsByMount?.find((m) => m.label === mount.label) || {};
-        return {
-          ...mount,
-          new_clients,
-        };
-      });
-      return {
-        ...ns,
-        new_clients: {
-          label,
-          clients,
-          entity_clients,
-          non_entity_clients,
-          secret_syncs,
-          mounts: newClientsByMount,
-        },
-        mounts: [...nestNewClientsWithinMounts],
-      };
-    }
-    return {
-      ...ns,
-      new_clients: {},
-    };
-  });
-  // SECOND: create a new object (namespace_by_key) in which each namespace label is a key
-  const namespaces_by_key = {};
-  nestNewClientsWithinNamespace?.forEach((namespaceObject) => {
-    // THIRD: make another object within the namespace where each mount label is a key
-    const mounts_by_key = {};
-    namespaceObject.mounts.forEach((mountObject) => {
-      mounts_by_key[mountObject.label] = {
-        month,
-        timestamp,
-        ...mountObject,
-        new_clients: { month, ...mountObject.new_clients },
-      };
-    });
-
-    const { label, clients, entity_clients, non_entity_clients, secret_syncs, new_clients } = namespaceObject;
-    namespaces_by_key[label] = {
-      month,
-      timestamp,
-      clients,
-      entity_clients,
-      non_entity_clients,
-      secret_syncs,
-      new_clients: { month, ...new_clients },
-      mounts_by_key,
-    };
-  });
-  return namespaces_by_key;
-  /*
-  structure of object returned
-  namespace_by_key: {
-    "namespace_label": {
-      month: "3/22",
-      clients: 32,
-      entity_clients: 16,
-      non_entity_clients: 16,
-      new_clients: {
-        month: "3/22",
-        clients: 5,
-        entity_clients: 2,
-        non_entity_clients: 3,
-        mounts: [...array of this namespace's mounts and their new client counts],
-      },
-      mounts_by_key: {
-        "mount_label": {
-           month: "3/22",
-           clients: 3,
-           entity_clients: 2,
-           non_entity_clients: 1,
-           new_clients: {
-            month: "3/22",
-            clients: 5,
-            entity_clients: 2,
-            non_entity_clients: 3,
-          },
-        },
-      },
-    },
-  };
-  */
-};
-
-/*
-API RESPONSE STRUCTURE:
-data: {
-  ** by_namespace organized in descending order of client count number **
-  by_namespace: [
-    {
-      namespace_id: '96OwG',
-      namespace_path: 'test-ns/',
-      counts: {},
-      mounts: [{ mount_path: 'path-1', counts: {} }],
-    },
-  ],
-  ** months organized in ascending order of timestamps, oldest to most recent
-  months: [
-    {
-      timestamp: '2022-03-01T00:00:00Z',
-      counts: {},
-      namespaces: [
-        {
-          namespace_id: 'root',
-          namespace_path: '',
-          counts: {},
-          mounts: [{ mount_path: 'auth/up2/', counts: {} }],
-        },
-      ],
-      new_clients: {
-        counts: {},
-        namespaces: [
-          {
-            namespace_id: 'root',
-            namespace_path: '',
-            counts: {},
-            mounts: [{ mount_path: 'auth/up2/', counts: {} }],
-          },
-        ],
-      },
-    },
-    {
-      timestamp: '2022-04-01T00:00:00Z',
-      counts: {},
-      namespaces: [
-        {
-          namespace_id: 'root',
-          namespace_path: '',
-          counts: {},
-          mounts: [{ mount_path: 'auth/up2/', counts: {} }],
-        },
-      ],
-      new_clients: {
-        counts: {},
-        namespaces: [
-          {
-            namespace_id: 'root',
-            namespace_path: '',
-            counts: {},
-            mounts: [{ mount_path: 'auth/up2/', counts: {} }],
-          },
-        ],
-      },
-    },
-  ],
-  start_time: 'start timestamp string',
-  end_time: 'end timestamp string',
-  total: { clients: 300, non_entity_clients: 100, entity_clients: 400} ,
-}
-*/
diff --git a/ui/lib/core/addon/utils/client-count-utils.ts b/ui/lib/core/addon/utils/client-count-utils.ts
new file mode 100644
index 00000000000..701c25413ee
--- /dev/null
+++ b/ui/lib/core/addon/utils/client-count-utils.ts
@@ -0,0 +1,250 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { isSameMonthUTC, parseAPITimestamp } from 'core/utils/date-formatters';
+import { compareAsc, isWithinInterval } from 'date-fns';
+import { ROOT_NAMESPACE } from 'vault/services/namespace';
+import { sanitizePath } from './sanitize-path';
+
+import type ClientsVersionHistoryModel from 'vault/vault/models/clients/version-history';
+import type {
+  ActivityExportData,
+  ActivityMonthBlock,
+  ActivityMonthEmpty,
+  ActivityMonthStandard,
+  ByMonthNewClients,
+  ByNamespaceClients,
+  ClientFilterTypes,
+  ClientTypes,
+  Counts,
+  MountClients,
+  MountNewClients,
+  NamespaceNewClients,
+  NamespaceObject,
+} from 'vault/vault/client-counts/activity-api';
+
+/*
+The client count utils are responsible for serializing the sys/internal/counters/activity API response
+The initial API response shape and serialized types are defined below.
+
+To help visualize there are sample responses in ui/tests/helpers/clients.js
+*/
+
+// Add new sys/activity/counters client count types here
+export const CLIENT_TYPES = [
+  'acme_clients',
+  'clients', // summation of total clients
+  'entity_clients',
+  'non_entity_clients',
+  'secret_syncs',
+] as const;
+
+// map to dropdowns for filtering client count tables
+export enum ClientFilters {
+  NAMESPACE = 'namespace_path',
+  MOUNT_PATH = 'mount_path',
+  MOUNT_TYPE = 'mount_type',
+  // this filter/query param does not map to a key in either API response and is handled ~special~
+  MONTH = 'month',
+}
+
+// client_type in the exported activity data differs slightly from the types of client keys
+// returned by sys/internal/counters/activity endpoint (:
+export const EXPORT_CLIENT_TYPES = ['non-entity-token', 'pki-acme', 'secret-sync', 'entity'] as const;
+
+// returns array of VersionHistoryModels for noteworthy upgrades: 1.9, 1.10
+// that occurred between timestamps (i.e. queried activity data)
+export const filterVersionHistory = (
+  versionHistory: ClientsVersionHistoryModel[],
+  start: string,
+  end: string
+) => {
+  if (versionHistory && start && end) {
+    const upgrades = versionHistory.reduce((array: ClientsVersionHistoryModel[], upgradeData) => {
+      const isRelevantHistory = (v: string) => {
+        return (
+          upgradeData.version.match(v) &&
+          // only add if there is a previous version, otherwise this upgrade is the users' first version
+          upgradeData.previousVersion &&
+          // only add first match, disregard subsequent patch releases of the same version
+          !array.some((d: ClientsVersionHistoryModel) => d.version.match(v))
+        );
+      };
+
+      ['1.9', '1.10', '1.17'].forEach((v) => {
+        if (isRelevantHistory(v)) array.push(upgradeData);
+      });
+
+      return array;
+    }, []);
+
+    // if there are noteworthy upgrades, only return those during queried date range
+    if (upgrades.length) {
+      const startDate = parseAPITimestamp(start) as Date;
+      const endDate = parseAPITimestamp(end) as Date;
+      return upgrades.filter(({ timestampInstalled }) => {
+        const upgradeDate = parseAPITimestamp(timestampInstalled) as Date;
+        return isWithinInterval(upgradeDate, { start: startDate, end: endDate });
+      });
+    }
+  }
+  return [];
+};
+
+// METHODS FOR SERIALIZING ACTIVITY RESPONSE
+
+export const formatByMonths = (monthsArray: ActivityMonthBlock[]): ByMonthNewClients[] => {
+  const sortedPayload = sortMonthsByTimestamp(monthsArray);
+  return sortedPayload?.map((m) => {
+    const { timestamp } = m;
+    if (monthIsEmpty(m)) {
+      // empty month
+      return {
+        timestamp,
+        namespaces: [],
+        new_clients: { timestamp, namespaces: [] },
+      };
+    }
+
+    let newClients: ByMonthNewClients = { timestamp, namespaces: [] };
+    if (monthWithAllCounts(m)) {
+      newClients = {
+        timestamp,
+        ...destructureClientCounts(m?.new_clients.counts),
+        namespaces: formatByNamespace(m.new_clients.namespaces),
+      };
+    }
+    return {
+      timestamp,
+      ...destructureClientCounts(m.counts),
+      namespaces: formatByNamespace(m.namespaces),
+      new_clients: newClients,
+    };
+  });
+};
+
+export const formatByNamespace = (namespaceArray: NamespaceObject[] | null): ByNamespaceClients[] => {
+  if (!Array.isArray(namespaceArray)) return [];
+  return namespaceArray.map((ns) => {
+    // i.e. 'namespace_path' is an empty string for 'root', so use namespace_id
+    const nsLabel = ns.namespace_path === '' ? ns.namespace_id : ns.namespace_path;
+    // data prior to adding mount granularity will still have a mounts array,
+    // but the mount_path value will be "no mount accessor (pre-1.10 upgrade?)" (ref: vault/activity_log_util_common.go)
+    // transform to an empty array for type consistency
+    let mounts: MountClients[] | [] = [];
+    if (Array.isArray(ns.mounts)) {
+      mounts = ns.mounts.map((m) => ({
+        label: m.mount_path,
+        namespace_path: nsLabel,
+        mount_path: m.mount_path,
+        // sanitized so it matches activity export data because mount_type there does NOT have a trailing slash
+        mount_type: sanitizePath(m.mount_type),
+        ...destructureClientCounts(m.counts),
+      }));
+    }
+    return {
+      label: nsLabel,
+      ...destructureClientCounts(ns.counts),
+      mounts,
+    };
+  });
+};
+
+// This method returns only client types from the passed object, excluding other keys such as "label".
+// when querying historical data the response will always contain the latest client type keys because the activity log is
+// constructed based on the version of Vault the user is on (key values will be 0)
+export const destructureClientCounts = (verboseObject: Counts | ByNamespaceClients) => {
+  return CLIENT_TYPES.reduce(
+    (newObj: Record<ClientTypes, Counts[ClientTypes]>, clientType: ClientTypes) => {
+      newObj[clientType] = verboseObject[clientType];
+      return newObj;
+    },
+    {} as Record<ClientTypes, Counts[ClientTypes]>
+  );
+};
+
+export const sortMonthsByTimestamp = (monthsArray: ActivityMonthBlock[]) => {
+  const sortedPayload = [...monthsArray];
+  return sortedPayload.sort((a, b) =>
+    compareAsc(parseAPITimestamp(a.timestamp) as Date, parseAPITimestamp(b.timestamp) as Date)
+  );
+};
+
+// *Performance note*
+// The client dashboard renders dropdown lists that specify filters. When the user selects a dropdown item (filter)
+// it updates the query param and this method is called to filter the data passed to the displayed table.
+// This method is not doing anything computationally expensive so it should be fine for filtering up to 50K rows of data.
+// If activity data (either the by_namespace list or rows of data in the activity export API) grow past that, then we
+// will want to look at converting this to a restartable task or do something else :)
+export function filterTableData(
+  data: MountClients[] | ActivityExportData[],
+  filters: Record<ClientFilterTypes, string>
+): MountClients[] | ActivityExportData[] {
+  // Return original data if no filters are specified
+  if (!filters || Object.values(filters).every((v) => !v)) {
+    return data;
+  }
+
+  return data.filter((datum) => {
+    // Datum must satisfy every filter
+    return Object.entries(filters).every(([filterKey, filterValue]) => {
+      // If no filter is specified for that key, return true
+      if (!filterValue) return true;
+      // Otherwise only return true if the datum matches the filter
+      return matchesFilter(datum, filterKey as ClientFilterTypes, filterValue);
+    });
+  }) as typeof data;
+}
+
+const matchesFilter = (
+  datum: ActivityExportData | MountClients,
+  filterKey: ClientFilterTypes,
+  filterValue: string
+) => {
+  // Only ActivityExportData data is ever filtered by 'client_first_used_time' (not MountClients)
+  if (filterKey === ClientFilters.MONTH) {
+    return 'client_first_used_time' in datum
+      ? isSameMonthUTC(datum.client_first_used_time, filterValue)
+      : false;
+  }
+
+  const datumValue = datum[filterKey];
+  // The API returns and empty string as the namespace_path for the "root" namespace.
+  // When a user selects "root" as a namespace filter we need to match the datum value
+  // as either an empty string (for the activity export data) OR as "root"
+  // (the by_namespace data is serialized to make "root" the namespace_path).
+  if (filterKey === ClientFilters.NAMESPACE && filterValue === 'root') {
+    return datumValue === ROOT_NAMESPACE || datumValue === filterValue;
+  }
+  return datumValue === filterValue;
+};
+
+export const flattenMounts = (namespaceArray: ByNamespaceClients[]) =>
+  namespaceArray.map((n) => n.mounts).flat();
+
+// TYPE GUARDS FOR CONDITIONALS
+function monthIsEmpty(month: ActivityMonthBlock): month is ActivityMonthEmpty {
+  return !month || month?.counts === null;
+}
+
+function monthWithAllCounts(month: ActivityMonthBlock): month is ActivityMonthStandard {
+  return month?.counts !== null && month?.new_clients?.counts !== null;
+}
+
+export function filterIsSupported(f: string): f is ClientFilterTypes {
+  return Object.values(ClientFilters).includes(f as ClientFilterTypes);
+}
+
+export function hasMountsKey(
+  obj: ByMonthNewClients | NamespaceNewClients | MountNewClients
+): obj is NamespaceNewClients {
+  return 'mounts' in obj;
+}
+
+export function hasNamespacesKey(
+  obj: ByMonthNewClients | NamespaceNewClients | MountNewClients
+): obj is ByMonthNewClients {
+  return 'namespaces' in obj;
+}
diff --git a/ui/lib/core/addon/utils/common-prefix.js b/ui/lib/core/addon/utils/common-prefix.js
index 3ccfe0d00e1..fa313d69e82 100644
--- a/ui/lib/core/addon/utils/common-prefix.js
+++ b/ui/lib/core/addon/utils/common-prefix.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/utils/date-formatters.js b/ui/lib/core/addon/utils/date-formatters.js
deleted file mode 100644
index 1151c49a306..00000000000
--- a/ui/lib/core/addon/utils/date-formatters.js
+++ /dev/null
@@ -1,39 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { format, parseISO } from 'date-fns';
-
-export const datetimeLocalStringFormat = "yyyy-MM-dd'T'HH:mm";
-
-export const ARRAY_OF_MONTHS = [
-  'January',
-  'February',
-  'March',
-  'April',
-  'May',
-  'June',
-  'July',
-  'August',
-  'September',
-  'October',
-  'November',
-  'December',
-];
-
-// convert API timestamp ( '2021-03-21T00:00:00Z' ) to date object, optionally format
-export const parseAPITimestamp = (timestamp, style) => {
-  if (typeof timestamp !== 'string') return;
-  const date = parseISO(timestamp.split('T')[0]);
-  if (!style) return date;
-  return format(date, style);
-};
-
-// convert M/yy (format of dates in charts) to 'Month yyyy' (format in tooltip)
-export function formatChartDate(date) {
-  const array = date.split('/');
-  array.splice(1, 0, '01');
-  const dateString = array.join('/');
-  return format(new Date(dateString), 'MMMM yyyy');
-}
diff --git a/ui/lib/core/addon/utils/date-formatters.ts b/ui/lib/core/addon/utils/date-formatters.ts
new file mode 100644
index 00000000000..58b2184ca97
--- /dev/null
+++ b/ui/lib/core/addon/utils/date-formatters.ts
@@ -0,0 +1,64 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { format, parse, parseISO } from 'date-fns';
+import isValid from 'date-fns/isValid';
+
+export const datetimeLocalStringFormat = "yyyy-MM-dd'T'HH:mm";
+
+export const ARRAY_OF_MONTHS = [
+  'January',
+  'February',
+  'March',
+  'April',
+  'May',
+  'June',
+  'July',
+  'August',
+  'September',
+  'October',
+  'November',
+  'December',
+];
+
+// convert API timestamp ( '2021-03-21T00:00:00Z' ) to date object, optionally format
+export const parseAPITimestamp = (timestamp: string, style?: string): Date | string | null => {
+  if (!timestamp || typeof timestamp !== 'string') return null;
+
+  if (!style) {
+    // If no style, return a date object in UTC
+    const parsed = parseISO(timestamp) as Date;
+    return isValid(parsed) ? parsed : null;
+  }
+
+  // Otherwise format it as a calendar date that is timezone agnostic.
+  const yearMonthDay = timestamp.split('T')[0] ?? '';
+  const date = parse(yearMonthDay, 'yyyy-MM-dd', new Date()); // 'yyyy-MM-dd' lets parse() know the format of yearMonthDay
+  return format(date, style) as string;
+};
+
+export const buildISOTimestamp = (args: { monthIdx: number; year: number; isEndDate: boolean }) => {
+  const { monthIdx, year, isEndDate } = args;
+  // passing `0` for the "day" arg to Date.UTC() returns the last day of the previous month
+  // which is why the monthIdx is increased by one for end dates.
+  // Date.UTC() also returns December if -1 is passed (which happens when January is selected)
+  const utc = isEndDate
+    ? new Date(Date.UTC(year, monthIdx + 1, 0, 23, 59, 59))
+    : new Date(Date.UTC(year, monthIdx, 1));
+
+  // remove milliseconds to return a UTC timestamp that matches the API
+  // e.g. "2025-05-01T00:00:00Z" or "2025-09-30T23:59:59Z"
+  return utc.toISOString().replace('.000', '');
+};
+
+export const isSameMonthUTC = (timestampA: string, timestampB: string): boolean => {
+  const dateA = parseAPITimestamp(timestampA) as Date;
+  const dateB = parseAPITimestamp(timestampB) as Date;
+  if (isValid(dateA) && isValid(dateB)) {
+    // Compare in UTC as any date-fns comparisons will be in localized timezones!
+    return dateA.getUTCFullYear() === dateB.getUTCFullYear() && dateA.getUTCMonth() === dateB.getUTCMonth();
+  }
+  return false;
+};
diff --git a/ui/lib/core/addon/utils/duration-utils.ts b/ui/lib/core/addon/utils/duration-utils.ts
index 5943e885b62..08faef628f3 100644
--- a/ui/lib/core/addon/utils/duration-utils.ts
+++ b/ui/lib/core/addon/utils/duration-utils.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/utils/key-codes.js b/ui/lib/core/addon/utils/key-codes.js
deleted file mode 100644
index 4c0d933d0d6..00000000000
--- a/ui/lib/core/addon/utils/key-codes.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// a map of keyCode for use in keyboard event handlers
-export default {
-  ENTER: 13,
-  ESC: 27,
-  TAB: 9,
-  LEFT: 37,
-  UP: 38,
-  RIGHT: 39,
-  DOWN: 40,
-  T: 116,
-  BACKSPACE: 8,
-};
diff --git a/ui/lib/core/addon/utils/key-utils.ts b/ui/lib/core/addon/utils/key-utils.ts
index 919578f6e6c..e8936aa54e1 100644
--- a/ui/lib/core/addon/utils/key-utils.ts
+++ b/ui/lib/core/addon/utils/key-utils.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/utils/keys.js b/ui/lib/core/addon/utils/keys.js
new file mode 100644
index 00000000000..d9b14be311e
--- /dev/null
+++ b/ui/lib/core/addon/utils/keys.js
@@ -0,0 +1,19 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+// a map of keyCode for use in keyboard event handlers
+export default {
+  ENTER: 'Enter',
+  // some older browsers use 'Esc' instead of 'Escape'
+  ESC: ['Escape', 'Esc'],
+  TAB: 'Tab',
+  LEFT: 'ArrowLeft',
+  UP: 'ArrowUp',
+  RIGHT: 'ArrowRight',
+  DOWN: 'ArrowDown',
+  T: 'T',
+  BACKSPACE: 'Backspace',
+  SPACE: ' ',
+};
diff --git a/ui/lib/core/addon/utils/paginate-list.ts b/ui/lib/core/addon/utils/paginate-list.ts
new file mode 100644
index 00000000000..561541a03a3
--- /dev/null
+++ b/ui/lib/core/addon/utils/paginate-list.ts
@@ -0,0 +1,71 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import config from 'vault/config/environment';
+
+const { DEFAULT_PAGE_SIZE } = config.APP;
+
+type PaginateOptions = {
+  page?: number;
+  pageSize?: number;
+  filter?: string;
+  filterKey?: string;
+};
+export type PaginatedMetadata = {
+  meta: {
+    currentPage: number;
+    lastPage: number;
+    nextPage: number;
+    prevPage: number;
+    total: number;
+    filteredTotal: number;
+    pageSize: number;
+  };
+};
+
+/**
+ * Util to paginate data set based on page number and size
+ * If filter is provided, it will filter the data prior to paginating
+ */
+
+export function paginate<T>(data: T[], options: PaginateOptions = {}) {
+  const { page = 1, pageSize = DEFAULT_PAGE_SIZE, filter, filterKey } = options;
+
+  if (Array.isArray(data)) {
+    let filteredData = [...data];
+    // filter data before paginating if filter is provided
+    if (filter) {
+      filteredData = data.filter((item) => {
+        const filterValue = filterKey ? (item as Record<string, unknown>)[filterKey] : item;
+        if (typeof filterValue === 'string') {
+          return filterValue.toLowerCase().includes(filter.toLowerCase());
+        }
+        return false;
+      });
+    }
+
+    const lastPage = Math.ceil(filteredData.length / pageSize);
+    const start = (page - 1) * pageSize;
+    const end = start + pageSize;
+    filteredData = filteredData.slice(start, end);
+    // add meta data previously from lazyPaginatedQuery since components expect it
+    Object.defineProperty(filteredData, 'meta', {
+      value: {
+        currentPage: page,
+        lastPage,
+        nextPage: page + 1,
+        prevPage: page - 1,
+        total: data.length,
+        filteredTotal: filteredData.length,
+        pageSize,
+      },
+      writable: false,
+    });
+
+    return filteredData as T[] & PaginatedMetadata;
+  }
+
+  return data;
+}
diff --git a/ui/lib/core/addon/utils/parse-url.js b/ui/lib/core/addon/utils/parse-url.js
index 6d914e2fbfd..a4a95970998 100644
--- a/ui/lib/core/addon/utils/parse-url.js
+++ b/ui/lib/core/addon/utils/parse-url.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/utils/sanitize-path.js b/ui/lib/core/addon/utils/sanitize-path.js
index 88a7bbc9fe3..e28e5712480 100644
--- a/ui/lib/core/addon/utils/sanitize-path.js
+++ b/ui/lib/core/addon/utils/sanitize-path.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/utils/search-select-has-many.js b/ui/lib/core/addon/utils/search-select-has-many.js
deleted file mode 100644
index e30ec358cd2..00000000000
--- a/ui/lib/core/addon/utils/search-select-has-many.js
+++ /dev/null
@@ -1,38 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-/**
- * Util to add/remove models in a hasMany relationship via the search-select component
- *
- * @example of using the util within an action in a component
- *```js
- * @action
- * async onSearchSelectChange(selectedIds) {
- *    const methods = await this.args.model.mfa_methods;
- *   handleHasManySelection(selectedIds, methods, this.store, 'mfa-method');
- *  }
- *
- * @param selectedIds array of selected options from search-select component
- * @param modelCollection array-like, list of models from the hasMany relationship
- * @param store the store so we can call peekRecord()
- * @param modelRecord string passed to peekRecord
- */
-
-export default function handleHasManySelection(selectedIds, modelCollection, store, modelRecord) {
-  // first check for existing models that have been removed from selection
-  modelCollection.forEach((model) => {
-    if (!selectedIds.includes(model.id)) {
-      modelCollection.removeObject(model);
-    }
-  });
-  // now check for selected items that don't exist and add them to the model
-  const modelIds = modelCollection.map((model) => model.id);
-  selectedIds.forEach((id) => {
-    if (!modelIds.includes(id)) {
-      const model = store.peekRecord(modelRecord, id);
-      modelCollection.addObject(model);
-    }
-  });
-}
diff --git a/ui/lib/core/addon/utils/timestamp.js b/ui/lib/core/addon/utils/timestamp.js
index d2862b75c9c..cdf18664a45 100644
--- a/ui/lib/core/addon/utils/timestamp.js
+++ b/ui/lib/core/addon/utils/timestamp.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/addon/utils/uuid.js b/ui/lib/core/addon/utils/uuid.js
new file mode 100644
index 00000000000..860d5457e0f
--- /dev/null
+++ b/ui/lib/core/addon/utils/uuid.js
@@ -0,0 +1,14 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { v4 as uuidv4 } from 'uuid';
+
+/**
+ * Use this instead of uuidv4() so that generated UUIDs can be stubbed in tests.
+ */
+
+export default function uuid() {
+  return uuidv4();
+}
diff --git a/ui/lib/core/app/components/alert-inline.js b/ui/lib/core/app/components/alert-inline.js
index 43c607aa4d4..50e2e95f7df 100644
--- a/ui/lib/core/app/components/alert-inline.js
+++ b/ui/lib/core/app/components/alert-inline.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/autocomplete-input.js b/ui/lib/core/app/components/autocomplete-input.js
index 463a9b9cbfc..b5cf7af43e4 100644
--- a/ui/lib/core/app/components/autocomplete-input.js
+++ b/ui/lib/core/app/components/autocomplete-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/certificate-card.js b/ui/lib/core/app/components/certificate-card.js
index ada589c489e..3da3cd13f79 100644
--- a/ui/lib/core/app/components/certificate-card.js
+++ b/ui/lib/core/app/components/certificate-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/checkbox-grid.js b/ui/lib/core/app/components/checkbox-grid.js
index ade652def63..15aa510b61e 100644
--- a/ui/lib/core/app/components/checkbox-grid.js
+++ b/ui/lib/core/app/components/checkbox-grid.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/chevron.js b/ui/lib/core/app/components/chevron.js
index 8aa31d30e93..d37e7315dfc 100644
--- a/ui/lib/core/app/components/chevron.js
+++ b/ui/lib/core/app/components/chevron.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/choose-pgp-key-form.js b/ui/lib/core/app/components/choose-pgp-key-form.js
index 748d00e66f1..4163914788f 100644
--- a/ui/lib/core/app/components/choose-pgp-key-form.js
+++ b/ui/lib/core/app/components/choose-pgp-key-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/confirm-action.js b/ui/lib/core/app/components/confirm-action.js
index 543bbddbcb5..f905b7e10c0 100644
--- a/ui/lib/core/app/components/confirm-action.js
+++ b/ui/lib/core/app/components/confirm-action.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/confirm-modal.js b/ui/lib/core/app/components/confirm-modal.js
index e4ceff2d8c1..47e1927b527 100644
--- a/ui/lib/core/app/components/confirm-modal.js
+++ b/ui/lib/core/app/components/confirm-modal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/confirmation-modal.js b/ui/lib/core/app/components/confirmation-modal.js
index bc862722c74..cfa040b8f26 100644
--- a/ui/lib/core/app/components/confirmation-modal.js
+++ b/ui/lib/core/app/components/confirmation-modal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/control-group-inline-error.js b/ui/lib/core/app/components/control-group-inline-error.js
new file mode 100644
index 00000000000..bac269b8d30
--- /dev/null
+++ b/ui/lib/core/app/components/control-group-inline-error.js
@@ -0,0 +1,6 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export { default } from 'core/components/control-group-inline-error';
diff --git a/ui/lib/core/app/components/copy-secret-dropdown.js b/ui/lib/core/app/components/copy-secret-dropdown.js
index e5bafa42885..a8bab38e4a5 100644
--- a/ui/lib/core/app/components/copy-secret-dropdown.js
+++ b/ui/lib/core/app/components/copy-secret-dropdown.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/doc-link.js b/ui/lib/core/app/components/doc-link.js
index 34f924f2771..1b7d61fe867 100644
--- a/ui/lib/core/app/components/doc-link.js
+++ b/ui/lib/core/app/components/doc-link.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/download-button.js b/ui/lib/core/app/components/download-button.js
index 25358b8abc3..30ec527d508 100644
--- a/ui/lib/core/app/components/download-button.js
+++ b/ui/lib/core/app/components/download-button.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/edit-form.js b/ui/lib/core/app/components/edit-form.js
index eeecef4d80b..a9dbb223e51 100644
--- a/ui/lib/core/app/components/edit-form.js
+++ b/ui/lib/core/app/components/edit-form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/empty-state.js b/ui/lib/core/app/components/empty-state.js
index 2d928490430..fc59f34d45a 100644
--- a/ui/lib/core/app/components/empty-state.js
+++ b/ui/lib/core/app/components/empty-state.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/enable-input.js b/ui/lib/core/app/components/enable-input.js
index 2475cc005fe..e3972cf8ad1 100644
--- a/ui/lib/core/app/components/enable-input.js
+++ b/ui/lib/core/app/components/enable-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/external-link.js b/ui/lib/core/app/components/external-link.js
index 29afa0ae84e..43648d8bb63 100644
--- a/ui/lib/core/app/components/external-link.js
+++ b/ui/lib/core/app/components/external-link.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/field-group-show.js b/ui/lib/core/app/components/field-group-show.js
index 093db00c851..138cd52c9a4 100644
--- a/ui/lib/core/app/components/field-group-show.js
+++ b/ui/lib/core/app/components/field-group-show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/filter-input-explicit.js b/ui/lib/core/app/components/filter-input-explicit.js
new file mode 100644
index 00000000000..ccbd623e6bf
--- /dev/null
+++ b/ui/lib/core/app/components/filter-input-explicit.js
@@ -0,0 +1,27 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+/**
+ * @module FilterInputExplicit
+ *
+ * @description FilterInputExplicit component is a child component to show filter input.
+ * It also handles the filtering actions of roles.
+ *
+ * @example
+ * <FilterInputExplicit
+ *   @query={{this.pageFilter}}
+ *   @placeholder="Search"
+ *   @handleSearch={{this.handleSearch}}
+ *   @handleInput={{this.handleInput}}
+ *   @handleKeyDown={{this.handleKeyDown}}
+ * />
+ *
+ * @param {string} query - value of queryParam, such as pageFilter
+ * @param {string} placeholder - placeholder for the input field
+ * @param {function} handleSearch - callback function to handle search
+ * @param {function} handleInput - callback function to handle input
+ * @param {function} handleKeyDown - callback function to handle keydown
+ */
+export { default } from 'core/components/filter-input-explicit';
diff --git a/ui/lib/core/app/components/filter-input.js b/ui/lib/core/app/components/filter-input.js
index c3760e41de4..55d8a01143c 100644
--- a/ui/lib/core/app/components/filter-input.js
+++ b/ui/lib/core/app/components/filter-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/form-error.js b/ui/lib/core/app/components/form-error.js
deleted file mode 100644
index 0b4818dc0e7..00000000000
--- a/ui/lib/core/app/components/form-error.js
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export { default } from 'core/components/form-error';
diff --git a/ui/lib/core/app/components/form-field-groups-loop.js b/ui/lib/core/app/components/form-field-groups-loop.js
index 88c71c420a3..c5d54bd2b82 100644
--- a/ui/lib/core/app/components/form-field-groups-loop.js
+++ b/ui/lib/core/app/components/form-field-groups-loop.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/form-field-groups.js b/ui/lib/core/app/components/form-field-groups.js
index dbe455329bf..570fbebcb7d 100644
--- a/ui/lib/core/app/components/form-field-groups.js
+++ b/ui/lib/core/app/components/form-field-groups.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/form-field-label.js b/ui/lib/core/app/components/form-field-label.js
index 1aed51632f3..fff0b36c60c 100644
--- a/ui/lib/core/app/components/form-field-label.js
+++ b/ui/lib/core/app/components/form-field-label.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/form-field.js b/ui/lib/core/app/components/form-field.js
index bcc96056826..6b759088da0 100644
--- a/ui/lib/core/app/components/form-field.js
+++ b/ui/lib/core/app/components/form-field.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/form-save-buttons.js b/ui/lib/core/app/components/form-save-buttons.js
index 4fffdfd342e..303d44314ff 100644
--- a/ui/lib/core/app/components/form-save-buttons.js
+++ b/ui/lib/core/app/components/form-save-buttons.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/icon.js b/ui/lib/core/app/components/icon.js
index bd08c77149e..da2ab7c7088 100644
--- a/ui/lib/core/app/components/icon.js
+++ b/ui/lib/core/app/components/icon.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/info-table-item-array.js b/ui/lib/core/app/components/info-table-item-array.js
index 2b6e311e399..bb3adc0a00a 100644
--- a/ui/lib/core/app/components/info-table-item-array.js
+++ b/ui/lib/core/app/components/info-table-item-array.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/info-table-row.js b/ui/lib/core/app/components/info-table-row.js
index b630cfb40df..01ad52ff55b 100644
--- a/ui/lib/core/app/components/info-table-row.js
+++ b/ui/lib/core/app/components/info-table-row.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/info-tooltip.js b/ui/lib/core/app/components/info-tooltip.js
deleted file mode 100644
index 8e89575083b..00000000000
--- a/ui/lib/core/app/components/info-tooltip.js
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export { default } from 'core/components/info-tooltip';
diff --git a/ui/lib/core/app/components/input-search.js b/ui/lib/core/app/components/input-search.js
index 04e221e1a03..023b1ce7d9a 100644
--- a/ui/lib/core/app/components/input-search.js
+++ b/ui/lib/core/app/components/input-search.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/json-editor.js b/ui/lib/core/app/components/json-editor.js
index d84d3be1bb8..2daa38b5373 100644
--- a/ui/lib/core/app/components/json-editor.js
+++ b/ui/lib/core/app/components/json-editor.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/key-value-header.js b/ui/lib/core/app/components/key-value-header.js
index ee2ffa17088..25226d9e834 100644
--- a/ui/lib/core/app/components/key-value-header.js
+++ b/ui/lib/core/app/components/key-value-header.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/kv-object-editor.js b/ui/lib/core/app/components/kv-object-editor.js
index b95d418f6b6..736801966f4 100644
--- a/ui/lib/core/app/components/kv-object-editor.js
+++ b/ui/lib/core/app/components/kv-object-editor.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/kv-suggestion-input.js b/ui/lib/core/app/components/kv-suggestion-input.js
index 9d577d015b6..f5f8d04126f 100644
--- a/ui/lib/core/app/components/kv-suggestion-input.js
+++ b/ui/lib/core/app/components/kv-suggestion-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/layout-loading.js b/ui/lib/core/app/components/layout-loading.js
index d95963408d9..7acb426c868 100644
--- a/ui/lib/core/app/components/layout-loading.js
+++ b/ui/lib/core/app/components/layout-loading.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/linked-block.js b/ui/lib/core/app/components/linked-block.js
index 09be2ceed69..e4d7ded875d 100644
--- a/ui/lib/core/app/components/linked-block.js
+++ b/ui/lib/core/app/components/linked-block.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/list-item.js b/ui/lib/core/app/components/list-item.js
index 373460d390f..8b49ddab7a2 100644
--- a/ui/lib/core/app/components/list-item.js
+++ b/ui/lib/core/app/components/list-item.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/list-item/content.js b/ui/lib/core/app/components/list-item/content.js
index d058ce0c1be..2eec4d571a2 100644
--- a/ui/lib/core/app/components/list-item/content.js
+++ b/ui/lib/core/app/components/list-item/content.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/list-item/popup-menu.js b/ui/lib/core/app/components/list-item/popup-menu.js
index 7158fdeefe4..77f56dc6c23 100644
--- a/ui/lib/core/app/components/list-item/popup-menu.js
+++ b/ui/lib/core/app/components/list-item/popup-menu.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/list-table.js b/ui/lib/core/app/components/list-table.js
new file mode 100644
index 00000000000..ce4e625c0af
--- /dev/null
+++ b/ui/lib/core/app/components/list-table.js
@@ -0,0 +1,6 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export { default } from 'core/components/list-table';
diff --git a/ui/lib/core/app/components/list-view.js b/ui/lib/core/app/components/list-view.js
index cc9b51504ea..c9f817234f8 100644
--- a/ui/lib/core/app/components/list-view.js
+++ b/ui/lib/core/app/components/list-view.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/loading-dropdown-option.js b/ui/lib/core/app/components/loading-dropdown-option.js
index e661521dca4..f4604cbfd6f 100644
--- a/ui/lib/core/app/components/loading-dropdown-option.js
+++ b/ui/lib/core/app/components/loading-dropdown-option.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/masked-input.js b/ui/lib/core/app/components/masked-input.js
index b043dc72b0e..20059210d1c 100644
--- a/ui/lib/core/app/components/masked-input.js
+++ b/ui/lib/core/app/components/masked-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/message-error.js b/ui/lib/core/app/components/message-error.js
index aa17d5d3a52..5d151909ea2 100644
--- a/ui/lib/core/app/components/message-error.js
+++ b/ui/lib/core/app/components/message-error.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/namespace-reminder.js b/ui/lib/core/app/components/namespace-reminder.js
index 97f12b2b5cf..ce55f8927f9 100644
--- a/ui/lib/core/app/components/namespace-reminder.js
+++ b/ui/lib/core/app/components/namespace-reminder.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/navigate-input.js b/ui/lib/core/app/components/navigate-input.js
index 0153c2011cb..d89aeefda7d 100644
--- a/ui/lib/core/app/components/navigate-input.js
+++ b/ui/lib/core/app/components/navigate-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/object-list-input.js b/ui/lib/core/app/components/object-list-input.js
index e75e57f4763..717e140669f 100644
--- a/ui/lib/core/app/components/object-list-input.js
+++ b/ui/lib/core/app/components/object-list-input.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/overview-card.js b/ui/lib/core/app/components/overview-card.js
index 30440faeef9..bb62d3b65d6 100644
--- a/ui/lib/core/app/components/overview-card.js
+++ b/ui/lib/core/app/components/overview-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/page-header-level.js b/ui/lib/core/app/components/page-header-level.js
index 42a4e86fd5e..ef4dea5b4a2 100644
--- a/ui/lib/core/app/components/page-header-level.js
+++ b/ui/lib/core/app/components/page-header-level.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/page-header.js b/ui/lib/core/app/components/page-header.js
index 79cdb0b88d7..13e222d028e 100644
--- a/ui/lib/core/app/components/page-header.js
+++ b/ui/lib/core/app/components/page-header.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/page/breadcrumbs.js b/ui/lib/core/app/components/page/breadcrumbs.js
index fe9c40cec6d..f338633867e 100644
--- a/ui/lib/core/app/components/page/breadcrumbs.js
+++ b/ui/lib/core/app/components/page/breadcrumbs.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/page/error.js b/ui/lib/core/app/components/page/error.js
index 1d6a954e93b..3a997f1990c 100644
--- a/ui/lib/core/app/components/page/error.js
+++ b/ui/lib/core/app/components/page/error.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/page/header.js b/ui/lib/core/app/components/page/header.js
new file mode 100644
index 00000000000..98ba7390eb7
--- /dev/null
+++ b/ui/lib/core/app/components/page/header.js
@@ -0,0 +1,6 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export { default } from 'core/components/page/header';
diff --git a/ui/lib/core/app/components/policy-example.js b/ui/lib/core/app/components/policy-example.js
index 74fc075c44f..fced65a17ad 100644
--- a/ui/lib/core/app/components/policy-example.js
+++ b/ui/lib/core/app/components/policy-example.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/radio-button.js b/ui/lib/core/app/components/radio-button.js
index 2bff057cf46..145c265ef48 100644
--- a/ui/lib/core/app/components/radio-button.js
+++ b/ui/lib/core/app/components/radio-button.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/radio-card.js b/ui/lib/core/app/components/radio-card.js
index 54789a47106..7edee7e8a3a 100644
--- a/ui/lib/core/app/components/radio-card.js
+++ b/ui/lib/core/app/components/radio-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/read-more.js b/ui/lib/core/app/components/read-more.js
index e845c47a246..ec209ab7447 100644
--- a/ui/lib/core/app/components/read-more.js
+++ b/ui/lib/core/app/components/read-more.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/readonly-form-field.js b/ui/lib/core/app/components/readonly-form-field.js
index 91ca6398cb3..1ac8597189a 100644
--- a/ui/lib/core/app/components/readonly-form-field.js
+++ b/ui/lib/core/app/components/readonly-form-field.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-action-demote.js b/ui/lib/core/app/components/replication-action-demote.js
index b5ff2a647c0..a9820515c5b 100644
--- a/ui/lib/core/app/components/replication-action-demote.js
+++ b/ui/lib/core/app/components/replication-action-demote.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-action-disable.js b/ui/lib/core/app/components/replication-action-disable.js
index 380eec0c3a0..dc586cd04a2 100644
--- a/ui/lib/core/app/components/replication-action-disable.js
+++ b/ui/lib/core/app/components/replication-action-disable.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-action-generate-token.js b/ui/lib/core/app/components/replication-action-generate-token.js
index 97f8a63a26f..e3654f45051 100644
--- a/ui/lib/core/app/components/replication-action-generate-token.js
+++ b/ui/lib/core/app/components/replication-action-generate-token.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-action-promote.js b/ui/lib/core/app/components/replication-action-promote.js
index 6324db1176c..17cdbb3d49a 100644
--- a/ui/lib/core/app/components/replication-action-promote.js
+++ b/ui/lib/core/app/components/replication-action-promote.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-action-recover.js b/ui/lib/core/app/components/replication-action-recover.js
index a8198f770cf..6bad0326704 100644
--- a/ui/lib/core/app/components/replication-action-recover.js
+++ b/ui/lib/core/app/components/replication-action-recover.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-action-reindex.js b/ui/lib/core/app/components/replication-action-reindex.js
index a774965d66d..3401c2fb1d4 100644
--- a/ui/lib/core/app/components/replication-action-reindex.js
+++ b/ui/lib/core/app/components/replication-action-reindex.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-action-update-primary.js b/ui/lib/core/app/components/replication-action-update-primary.js
index 5cccf07ddbd..8a8e9723bdf 100644
--- a/ui/lib/core/app/components/replication-action-update-primary.js
+++ b/ui/lib/core/app/components/replication-action-update-primary.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-actions-single.js b/ui/lib/core/app/components/replication-actions-single.js
index fda53175b9b..fe8957d8f76 100644
--- a/ui/lib/core/app/components/replication-actions-single.js
+++ b/ui/lib/core/app/components/replication-actions-single.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-actions.js b/ui/lib/core/app/components/replication-actions.js
index d1b35218ff4..d77cf437e66 100644
--- a/ui/lib/core/app/components/replication-actions.js
+++ b/ui/lib/core/app/components/replication-actions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-dashboard.js b/ui/lib/core/app/components/replication-dashboard.js
index 78fe144e163..c4bc27d04e1 100644
--- a/ui/lib/core/app/components/replication-dashboard.js
+++ b/ui/lib/core/app/components/replication-dashboard.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-header.js b/ui/lib/core/app/components/replication-header.js
index 2b751db61c2..e31a1e2d6ad 100644
--- a/ui/lib/core/app/components/replication-header.js
+++ b/ui/lib/core/app/components/replication-header.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-mode-summary.js b/ui/lib/core/app/components/replication-mode-summary.js
deleted file mode 100644
index 605fceb5633..00000000000
--- a/ui/lib/core/app/components/replication-mode-summary.js
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export { default } from 'core/components/replication-mode-summary';
diff --git a/ui/lib/core/app/components/replication-page.js b/ui/lib/core/app/components/replication-page.js
index fd2ef4ffcb9..ad69a4b3e44 100644
--- a/ui/lib/core/app/components/replication-page.js
+++ b/ui/lib/core/app/components/replication-page.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-secondary-card.js b/ui/lib/core/app/components/replication-secondary-card.js
index 6f4926c8eaa..3d26b7c0544 100644
--- a/ui/lib/core/app/components/replication-secondary-card.js
+++ b/ui/lib/core/app/components/replication-secondary-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-summary-card.js b/ui/lib/core/app/components/replication-summary-card.js
index 74c9fe62d20..df2d2f43d69 100644
--- a/ui/lib/core/app/components/replication-summary-card.js
+++ b/ui/lib/core/app/components/replication-summary-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/replication-table-rows.js b/ui/lib/core/app/components/replication-table-rows.js
index cd00fe3932b..2ece14c0f89 100644
--- a/ui/lib/core/app/components/replication-table-rows.js
+++ b/ui/lib/core/app/components/replication-table-rows.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/search-select-placeholder.js b/ui/lib/core/app/components/search-select-placeholder.js
index 2779ed8e6b9..97ddadfaf4c 100644
--- a/ui/lib/core/app/components/search-select-placeholder.js
+++ b/ui/lib/core/app/components/search-select-placeholder.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/search-select-with-modal.js b/ui/lib/core/app/components/search-select-with-modal.js
index 8caa18f5d7d..3017bc341d1 100644
--- a/ui/lib/core/app/components/search-select-with-modal.js
+++ b/ui/lib/core/app/components/search-select-with-modal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/search-select.js b/ui/lib/core/app/components/search-select.js
index 9221d047f18..1581f9df7e9 100644
--- a/ui/lib/core/app/components/search-select.js
+++ b/ui/lib/core/app/components/search-select.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/secret-list-header-tab.js b/ui/lib/core/app/components/secret-list-header-tab.js
index fc322485b6d..5915fca1287 100644
--- a/ui/lib/core/app/components/secret-list-header-tab.js
+++ b/ui/lib/core/app/components/secret-list-header-tab.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/secret-list-header.js b/ui/lib/core/app/components/secret-list-header.js
index 0a49e8f4e69..53370a5af68 100644
--- a/ui/lib/core/app/components/secret-list-header.js
+++ b/ui/lib/core/app/components/secret-list-header.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/secrets-engine-mount-config.js b/ui/lib/core/app/components/secrets-engine-mount-config.js
index 46b6c2dbdb9..33a1b6671c2 100644
--- a/ui/lib/core/app/components/secrets-engine-mount-config.js
+++ b/ui/lib/core/app/components/secrets-engine-mount-config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/select.js b/ui/lib/core/app/components/select.js
index cba8daa6c79..c05ee2122fc 100644
--- a/ui/lib/core/app/components/select.js
+++ b/ui/lib/core/app/components/select.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/selectable-card.js b/ui/lib/core/app/components/selectable-card.js
index cbb011e81d0..0abcf0bd9ab 100644
--- a/ui/lib/core/app/components/selectable-card.js
+++ b/ui/lib/core/app/components/selectable-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/shamir/dr-token-flow.js b/ui/lib/core/app/components/shamir/dr-token-flow.js
index fb4eee6e824..8a86e0bb4f0 100644
--- a/ui/lib/core/app/components/shamir/dr-token-flow.js
+++ b/ui/lib/core/app/components/shamir/dr-token-flow.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/shamir/flow.js b/ui/lib/core/app/components/shamir/flow.js
index ddcc9da711a..c21ac60632a 100644
--- a/ui/lib/core/app/components/shamir/flow.js
+++ b/ui/lib/core/app/components/shamir/flow.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/shamir/form.js b/ui/lib/core/app/components/shamir/form.js
index b5bce4e6bdf..c67aa1c7e55 100644
--- a/ui/lib/core/app/components/shamir/form.js
+++ b/ui/lib/core/app/components/shamir/form.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/stat-text.js b/ui/lib/core/app/components/stat-text.js
index da2538a9fea..55ff4e76a35 100644
--- a/ui/lib/core/app/components/stat-text.js
+++ b/ui/lib/core/app/components/stat-text.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/string-list.js b/ui/lib/core/app/components/string-list.js
index 1e90f4fdf70..6757d260f42 100644
--- a/ui/lib/core/app/components/string-list.js
+++ b/ui/lib/core/app/components/string-list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/sync-status-badge.js b/ui/lib/core/app/components/sync-status-badge.js
index 4e857d66564..7c6bff68e8c 100644
--- a/ui/lib/core/app/components/sync-status-badge.js
+++ b/ui/lib/core/app/components/sync-status-badge.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/text-file.js b/ui/lib/core/app/components/text-file.js
index 103df06e4d2..8b2bc2e0907 100644
--- a/ui/lib/core/app/components/text-file.js
+++ b/ui/lib/core/app/components/text-file.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/toggle-button.js b/ui/lib/core/app/components/toggle-button.js
index 90647f5cff2..564edfa8485 100644
--- a/ui/lib/core/app/components/toggle-button.js
+++ b/ui/lib/core/app/components/toggle-button.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/toggle.js b/ui/lib/core/app/components/toggle.js
index 31b8533824b..3375b91c8ac 100644
--- a/ui/lib/core/app/components/toggle.js
+++ b/ui/lib/core/app/components/toggle.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/tool-tip.js b/ui/lib/core/app/components/tool-tip.js
deleted file mode 100644
index c36f921cb44..00000000000
--- a/ui/lib/core/app/components/tool-tip.js
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export { default } from 'core/components/tool-tip';
diff --git a/ui/lib/core/app/components/toolbar-actions.js b/ui/lib/core/app/components/toolbar-actions.js
index 9274ee66122..7ba9db0003d 100644
--- a/ui/lib/core/app/components/toolbar-actions.js
+++ b/ui/lib/core/app/components/toolbar-actions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/toolbar-filters.js b/ui/lib/core/app/components/toolbar-filters.js
index d60e2c85ea1..a73bc61527b 100644
--- a/ui/lib/core/app/components/toolbar-filters.js
+++ b/ui/lib/core/app/components/toolbar-filters.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/toolbar-link.js b/ui/lib/core/app/components/toolbar-link.js
index fb81bbedc00..4771504d261 100644
--- a/ui/lib/core/app/components/toolbar-link.js
+++ b/ui/lib/core/app/components/toolbar-link.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/toolbar.js b/ui/lib/core/app/components/toolbar.js
index a8286a5908a..3152fbd4a88 100644
--- a/ui/lib/core/app/components/toolbar.js
+++ b/ui/lib/core/app/components/toolbar.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/ttl-picker.js b/ui/lib/core/app/components/ttl-picker.js
index cd6d392bf36..23610636c00 100644
--- a/ui/lib/core/app/components/ttl-picker.js
+++ b/ui/lib/core/app/components/ttl-picker.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/unsaved-changes-modal.js b/ui/lib/core/app/components/unsaved-changes-modal.js
new file mode 100644
index 00000000000..d437064bd81
--- /dev/null
+++ b/ui/lib/core/app/components/unsaved-changes-modal.js
@@ -0,0 +1,6 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export { default } from 'core/components/unsaved-changes-modal';
diff --git a/ui/lib/core/app/components/upgrade-page.js b/ui/lib/core/app/components/upgrade-page.js
index 06c5192dc74..a6926dc20d9 100644
--- a/ui/lib/core/app/components/upgrade-page.js
+++ b/ui/lib/core/app/components/upgrade-page.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/components/vault-logo-spinner.js b/ui/lib/core/app/components/vault-logo-spinner.js
index 764146b69b1..d557f79f517 100644
--- a/ui/lib/core/app/components/vault-logo-spinner.js
+++ b/ui/lib/core/app/components/vault-logo-spinner.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/decorators/confirm-leave.js b/ui/lib/core/app/decorators/confirm-leave.js
index 8cc62a3a13a..69d6a749e16 100644
--- a/ui/lib/core/app/decorators/confirm-leave.js
+++ b/ui/lib/core/app/decorators/confirm-leave.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/await.js b/ui/lib/core/app/helpers/await.js
new file mode 100644
index 00000000000..da9ba8403dc
--- /dev/null
+++ b/ui/lib/core/app/helpers/await.js
@@ -0,0 +1,6 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export { default } from 'core/helpers/await';
diff --git a/ui/lib/core/app/helpers/changelog-url-for.js b/ui/lib/core/app/helpers/changelog-url-for.js
index 8339a722d48..9dae222d648 100644
--- a/ui/lib/core/app/helpers/changelog-url-for.js
+++ b/ui/lib/core/app/helpers/changelog-url-for.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/cluster-states.js b/ui/lib/core/app/helpers/cluster-states.js
index 7720a620b3f..c05af4c9883 100644
--- a/ui/lib/core/app/helpers/cluster-states.js
+++ b/ui/lib/core/app/helpers/cluster-states.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/date-format.js b/ui/lib/core/app/helpers/date-format.js
index 1abbcf07fb3..4b72e3ad0a1 100644
--- a/ui/lib/core/app/helpers/date-format.js
+++ b/ui/lib/core/app/helpers/date-format.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/date-from-now.js b/ui/lib/core/app/helpers/date-from-now.js
new file mode 100644
index 00000000000..53188f3875e
--- /dev/null
+++ b/ui/lib/core/app/helpers/date-from-now.js
@@ -0,0 +1,6 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export { default } from 'core/helpers/date-from-now';
diff --git a/ui/lib/core/app/helpers/doc-link.js b/ui/lib/core/app/helpers/doc-link.js
index 9d23c5575a0..43ffa311af2 100644
--- a/ui/lib/core/app/helpers/doc-link.js
+++ b/ui/lib/core/app/helpers/doc-link.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/format-duration.js b/ui/lib/core/app/helpers/format-duration.js
index caf870b0847..44aaf36180b 100644
--- a/ui/lib/core/app/helpers/format-duration.js
+++ b/ui/lib/core/app/helpers/format-duration.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/format-number.js b/ui/lib/core/app/helpers/format-number.js
index 04593726b2b..cc2f4d9e076 100644
--- a/ui/lib/core/app/helpers/format-number.js
+++ b/ui/lib/core/app/helpers/format-number.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/has-capability.js b/ui/lib/core/app/helpers/has-capability.js
new file mode 100644
index 00000000000..f411a8ab511
--- /dev/null
+++ b/ui/lib/core/app/helpers/has-capability.js
@@ -0,0 +1,6 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export { default, hasCapability } from 'core/helpers/has-capability';
diff --git a/ui/lib/core/app/helpers/has-feature.js b/ui/lib/core/app/helpers/has-feature.js
index de9affa3132..532f0702ff5 100644
--- a/ui/lib/core/app/helpers/has-feature.js
+++ b/ui/lib/core/app/helpers/has-feature.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/img-path.js b/ui/lib/core/app/helpers/img-path.js
index 51f65240fc8..db90ece6bab 100644
--- a/ui/lib/core/app/helpers/img-path.js
+++ b/ui/lib/core/app/helpers/img-path.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/is-active-route.js b/ui/lib/core/app/helpers/is-active-route.js
index b1dd65bcd98..b234cd82566 100644
--- a/ui/lib/core/app/helpers/is-active-route.js
+++ b/ui/lib/core/app/helpers/is-active-route.js
@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-export { default, isActiveRoute } from 'core/helpers/is-active-route';
+export { default } from 'core/helpers/is-active-route';
diff --git a/ui/lib/core/app/helpers/is-empty-value.js b/ui/lib/core/app/helpers/is-empty-value.js
index 80df11a4425..e5433970e32 100644
--- a/ui/lib/core/app/helpers/is-empty-value.js
+++ b/ui/lib/core/app/helpers/is-empty-value.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/jsonify.js b/ui/lib/core/app/helpers/jsonify.js
index 2903f91d884..f5f3ebac4ef 100644
--- a/ui/lib/core/app/helpers/jsonify.js
+++ b/ui/lib/core/app/helpers/jsonify.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/loose-equal.js b/ui/lib/core/app/helpers/loose-equal.js
index 2297e5b3bbd..afc92792dba 100644
--- a/ui/lib/core/app/helpers/loose-equal.js
+++ b/ui/lib/core/app/helpers/loose-equal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/message-types.js b/ui/lib/core/app/helpers/message-types.js
index 8e002a0772e..b68f144c38e 100644
--- a/ui/lib/core/app/helpers/message-types.js
+++ b/ui/lib/core/app/helpers/message-types.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/new-line-split.js b/ui/lib/core/app/helpers/new-line-split.js
index 47d53ccc812..5818cf0b8f7 100644
--- a/ui/lib/core/app/helpers/new-line-split.js
+++ b/ui/lib/core/app/helpers/new-line-split.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/options-for-backend.js b/ui/lib/core/app/helpers/options-for-backend.js
index 81d1ecbd89d..1f8f7637639 100644
--- a/ui/lib/core/app/helpers/options-for-backend.js
+++ b/ui/lib/core/app/helpers/options-for-backend.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/path-or-array.js b/ui/lib/core/app/helpers/path-or-array.js
index 2b0ac0d25e2..f2d5ad5cd2b 100644
--- a/ui/lib/core/app/helpers/path-or-array.js
+++ b/ui/lib/core/app/helpers/path-or-array.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/replication-action-for-mode.js b/ui/lib/core/app/helpers/replication-action-for-mode.js
index 99ca5be8b28..bd0f1616db8 100644
--- a/ui/lib/core/app/helpers/replication-action-for-mode.js
+++ b/ui/lib/core/app/helpers/replication-action-for-mode.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/replication-mode-description.js b/ui/lib/core/app/helpers/replication-mode-description.js
index 39b5a7b124b..de0f6ca9457 100644
--- a/ui/lib/core/app/helpers/replication-mode-description.js
+++ b/ui/lib/core/app/helpers/replication-mode-description.js
@@ -1,10 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-export {
-  default,
-  replicationModeDescription,
-  REPLICATION_MODE_DESCRIPTIONS,
-} from 'core/helpers/replication-mode-description';
+export { default } from 'core/helpers/replication-mode-description';
diff --git a/ui/lib/core/app/helpers/sanitized-html.js b/ui/lib/core/app/helpers/sanitized-html.js
index e1a42e4b62d..bfa4db9e352 100644
--- a/ui/lib/core/app/helpers/sanitized-html.js
+++ b/ui/lib/core/app/helpers/sanitized-html.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/set-flash-message.js b/ui/lib/core/app/helpers/set-flash-message.js
index 804d8186c81..b61014e2903 100644
--- a/ui/lib/core/app/helpers/set-flash-message.js
+++ b/ui/lib/core/app/helpers/set-flash-message.js
@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-export { default, setFlashMessage } from 'core/helpers/set-flash-message';
+export { default } from 'core/helpers/set-flash-message';
diff --git a/ui/lib/core/app/helpers/stringify.js b/ui/lib/core/app/helpers/stringify.js
index 76dcc51f23e..b62e5f62e3a 100644
--- a/ui/lib/core/app/helpers/stringify.js
+++ b/ui/lib/core/app/helpers/stringify.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/sync-destinations.js b/ui/lib/core/app/helpers/sync-destinations.js
index 8e7f0a65716..4a1bb3e4c72 100644
--- a/ui/lib/core/app/helpers/sync-destinations.js
+++ b/ui/lib/core/app/helpers/sync-destinations.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/to-label.js b/ui/lib/core/app/helpers/to-label.js
index 44c8e83e83f..dde4066d9a1 100644
--- a/ui/lib/core/app/helpers/to-label.js
+++ b/ui/lib/core/app/helpers/to-label.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/helpers/transition-to.js b/ui/lib/core/app/helpers/transition-to.js
new file mode 100644
index 00000000000..e8da571e39d
--- /dev/null
+++ b/ui/lib/core/app/helpers/transition-to.js
@@ -0,0 +1,6 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export { default } from 'core/helpers/transition-to';
diff --git a/ui/lib/core/app/mixins/list-controller.js b/ui/lib/core/app/mixins/list-controller.js
index d2fb032f2eb..0f3f18a3678 100644
--- a/ui/lib/core/app/mixins/list-controller.js
+++ b/ui/lib/core/app/mixins/list-controller.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/mixins/list-route.js b/ui/lib/core/app/mixins/list-route.js
index f811af6a311..6f41529a748 100644
--- a/ui/lib/core/app/mixins/list-route.js
+++ b/ui/lib/core/app/mixins/list-route.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/mixins/replication-actions.js b/ui/lib/core/app/mixins/replication-actions.js
index c4c7063c914..9407195768e 100644
--- a/ui/lib/core/app/mixins/replication-actions.js
+++ b/ui/lib/core/app/mixins/replication-actions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/modifiers/code-mirror.js b/ui/lib/core/app/modifiers/code-mirror.js
deleted file mode 100644
index 44105834574..00000000000
--- a/ui/lib/core/app/modifiers/code-mirror.js
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export { default } from 'core/modifiers/code-mirror';
diff --git a/ui/lib/core/app/utils/advanced-secret.js b/ui/lib/core/app/utils/advanced-secret.js
index 0975476278a..92a225c0191 100644
--- a/ui/lib/core/app/utils/advanced-secret.js
+++ b/ui/lib/core/app/utils/advanced-secret.js
@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-export { default } from 'core/utils/advanced-secret';
+export { isAdvancedSecret } from 'core/utils/advanced-secret';
diff --git a/ui/lib/core/app/utils/b64.js b/ui/lib/core/app/utils/b64.js
index db6d0a022c9..cbf9177aa3c 100644
--- a/ui/lib/core/app/utils/b64.js
+++ b/ui/lib/core/app/utils/b64.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/utils/key-utils.js b/ui/lib/core/app/utils/key-utils.js
index 71c907da5d0..45bc1cf8a7d 100644
--- a/ui/lib/core/app/utils/key-utils.js
+++ b/ui/lib/core/app/utils/key-utils.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/utils/sanitize-path.js b/ui/lib/core/app/utils/sanitize-path.js
index 27a0db30e1c..bfda3711c7c 100644
--- a/ui/lib/core/app/utils/sanitize-path.js
+++ b/ui/lib/core/app/utils/sanitize-path.js
@@ -1,6 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-export { ensureTrailingSlash, sanitizePath, getRelativePath } from 'core/utils/sanitize-path';
+export { ensureTrailingSlash, sanitizePath, sanitizeStart, getRelativePath } from 'core/utils/sanitize-path';
diff --git a/ui/lib/core/app/utils/timestamp.js b/ui/lib/core/app/utils/timestamp.js
index 8d75b5655f6..3544cf9d7ec 100644
--- a/ui/lib/core/app/utils/timestamp.js
+++ b/ui/lib/core/app/utils/timestamp.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/core/app/utils/uuid.js b/ui/lib/core/app/utils/uuid.js
new file mode 100644
index 00000000000..1772f4111b4
--- /dev/null
+++ b/ui/lib/core/app/utils/uuid.js
@@ -0,0 +1,6 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export { default } from 'core/utils/uuid';
diff --git a/ui/lib/core/icon-mappings.js b/ui/lib/core/icon-mappings.js
deleted file mode 100644
index e709a895f2a..00000000000
--- a/ui/lib/core/icon-mappings.js
+++ /dev/null
@@ -1,229 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// icons that exist in the public folder which are not part of the Structure set
-// values represent match to icon in Flight set with null representing no match
-export const localIconMap = {
-  hashicorp: null,
-  loop: 'sync',
-  reply: 'corner-up-left',
-  console: 'terminal-screen',
-  pki: 'file-text',
-  replication: 'replication-direct',
-  'perf-replication': 'replication-perf',
-  'status-indicator': 'circle-dot',
-  tour: null,
-  approle: 'cpu',
-  cert: 'certificate',
-  consul: null,
-  gcpkms: 'gcp-color',
-  kmip: 'unlock',
-  kv: 'key-values',
-  ldap: 'user',
-  okta: 'okta-color',
-  radius: 'user',
-  ssh: 'terminal-screen',
-  totp: 'history',
-  duo: null,
-  pingid: null,
-  transit: 'swap-horizontal',
-  userpass: 'identity-user',
-  stopwatch: 'clock',
-  'vault-logo': null,
-  auth: 'user',
-  'android-sync': 'sync-reverse',
-};
-// complete list of Structure icons mapped to their Flight counterpart
-// null values represent no direct correlation to icon in Flight set
-// Flight icon lookup @ https://flight-hashicorp.vercel.app/
-export const structureIconMap = {
-  'alert-circle-fill': 'alert-circle-fill',
-  'alert-circle-outline': 'alert-circle',
-  'alert-triangle': 'alert-triangle-fill',
-  'arrow-down': 'arrow-down',
-  'arrow-left': 'arrow-left',
-  'arrow-right': 'arrow-right',
-  'arrow-up': 'arrow-up',
-  bolt: 'zap',
-  'box-check-fill': 'check-square-fill',
-  'box-outline': 'square',
-  broadcast: 'radio',
-  bug: 'bug',
-  calendar: 'calendar',
-  'cancel-circle-fill': 'x-circle-fill',
-  'cancel-circle-outline': 'x-circle',
-  'cancel-plain': 'x',
-  'cancel-square-fill': 'x-square-fill',
-  'cancel-square-outline': 'x-square',
-  'caret-down': null,
-  'caret-up': null,
-  'check-circle-fill': 'check-circle-fill',
-  'check-circle-outline': 'check-circle',
-  'check-plain': 'check',
-  'chevron-down': 'chevron-down',
-  'chevron-left': 'chevron-left',
-  'chevron-right': 'chevron-right',
-  'chevron-up': 'chevron-up',
-  'clock-fill': null,
-  'clock-outline': 'clock',
-  'cloud-fail': 'cloud-x',
-  code: 'code',
-  console: 'terminal',
-  'copy-action': 'clipboard-copy',
-  'copy-success': 'clipboard-checked',
-  database: 'database',
-  delay: 'delay',
-  'deny-alt': null,
-  'deny-default': null,
-  disabled: 'skip',
-  docs: 'docs-link',
-  dot: 'circle-fill',
-  download: 'download',
-  edit: 'pencil-tool',
-  'envelope-sealed-fill': null,
-  'envelope-sealed-outline': 'mail',
-  'envelope-unsealed--outline': 'mail-open',
-  'envelope-unsealed-fill': null,
-  exit: 'external-link',
-  'expand-less': 'minimize',
-  'expand-more': 'maximize',
-  'file-error': 'file-x',
-  'file-fill': 'file-text',
-  'file-outline': 'file',
-  'file-success': 'file-check',
-  filter: 'filter',
-  flag: 'flag',
-  'folder-fill': 'folder-fill',
-  'folder-outline': 'folder',
-  gateway: 'gateway',
-  'gift-fill': null,
-  'gift-outline': 'gift',
-  'git-branch': 'git-branch',
-  'git-commit': 'git-commit',
-  'git-pull-request': 'git-pull-request',
-  'git-repository': 'git-repo',
-  guide: 'guide',
-  health: 'activity',
-  'help-circle-fill': null,
-  'help-circle-outline': 'help',
-  history: 'history',
-  'info-circle-fill': null,
-  'info-circle-outline': 'info',
-  key: 'key',
-  layers: 'layers',
-  leader: 'star-circle',
-  learn: 'learn-link',
-  link: 'link',
-  loading: '',
-  'lock-closed-fill': 'lock-fill',
-  'lock-closed-outline': 'lock',
-  'lock-closed': 'lock-fill',
-  'lock-disabled': 'lock-disabled',
-  'lock-open-outline': 'unlock',
-  'lock-open': 'unlock',
-  'logo-aws-color': 'aws-color',
-  'logo-aws-monochrome': 'aws',
-  'logo-alicloud-color': 'alibaba-color',
-  'logo-alicloud-monochrome': 'alibaba',
-  'logo-auth0-color': 'auth0-color',
-  'logo-auth0-monochrome': 'auth0',
-  'logo-azure-color': 'azure-color',
-  'logo-azure-monochrome': 'azure',
-  'logo-azure-dev-ops-color': 'azure-devops-color',
-  'logo-azure-dev-ops-monochrome': 'azure-devops',
-  'logo-bitbucket-color': 'bitbucket-color',
-  'logo-bitbucket-monochrome': 'bitbucket',
-  'logo-f5-color': 'f5-color',
-  'logo-f5-monochrome': 'f5',
-  'logo-gcp-color': 'gcp-color',
-  'logo-gcp-monochrome': 'gcp',
-  'logo-github-color': 'github-color',
-  'logo-github-monochrome': 'github',
-  'logo-gitlab-color': 'gitlab-color',
-  'logo-gitlab-monochrome': 'gitlab',
-  'logo-google-color': 'google-color',
-  'logo-google-monochrome': 'google',
-  'logo-kubernetes-color': 'kubernetes-color',
-  'logo-kubernetes-monochrome': 'kubernetes',
-  'logo-microsoft-color': 'microsoft-color',
-  'logo-microsoft-monochrome': 'microsoft',
-  'logo-okta-color': 'okta-color',
-  'logo-okta-monochrome': 'okta',
-  'logo-oracle-color': 'oracle-color',
-  'logo-oracle-monochrome': 'oracle',
-  'logo-slack-color': 'slack-color',
-  'logo-slack-monochrome': 'slack',
-  'logo-vmware-color': 'vmware-color',
-  'logo-vmware-monochrome': 'vmware',
-  menu: 'menu',
-  mesh: 'mesh',
-  'message-fill': 'message-square-fill',
-  'message-outline': 'message-square-fill',
-  message: 'message-square-fill',
-  'minus-circle-fill': null,
-  'minus-circle-outline': 'minus-circle',
-  'minus-plain': 'minus',
-  'minus-square-fill': 'minus-square',
-  module: 'module',
-  'more-horizontal': 'more-horizontal',
-  'more-vertical': 'more-vertical',
-  network: 'network',
-  'notification-disabled': 'notification-disabled',
-  'notification-fill': 'notification-fill',
-  'notification-outline': 'bell',
-  outline: 'outline',
-  'page-outline': 'outline',
-  path: 'path',
-  'play-fill': 'play-circle',
-  'play-outline': 'play-circle',
-  'play-plain': 'play',
-  'plus-circle-fill': null,
-  'plus-circle-outline': 'plus-circle',
-  'plus-plain': 'plus',
-  'plus-square-fill': 'plus-square',
-  provider: 'provider',
-  'public-default': 'globe',
-  'public-locked': 'globe-private',
-  queue: 'queue',
-  'radio-button-checked': 'circle-dot',
-  'radio-button-unchecked': 'circle',
-  random: 'random',
-  redirect: 'redirect',
-  'refresh-alert': 'refresh-alert',
-  'refresh-default': 'reload',
-  remix: 'shuffle',
-  ribbon: 'award',
-  run: '',
-  search: 'search',
-  server: 'server',
-  settings: 'settings',
-  sort: 'sort-desc',
-  'source-file': 'file-source',
-  'star-fill': 'star-fill',
-  'star-outline': 'star',
-  'sub-left': 'corner-down-left',
-  'sub-right': 'corner-down-right',
-  support: 'support',
-  'swap-horizontal': 'swap-horizontal',
-  'swap-vertical': 'swap-vertical',
-  syncing: 'syncing',
-  tag: 'tag',
-  tokens: 'token',
-  trash: 'trash',
-  tune: 'sliders',
-  'unfold-less': 'unfold-close',
-  'unfold-more': 'unfold-open',
-  upload: 'upload',
-  'user-add': 'user-plus',
-  'user-organization': 'org',
-  'user-plain': 'user',
-  'user-square-fill': 'user-circle-fill',
-  'user-square-outline': 'user-circle',
-  'user-team': 'users',
-  'visibility-hide': 'eye-off',
-  'visibility-show': 'eye',
-  webhook: 'webhook',
-  partner: 'users',
-};
diff --git a/ui/lib/core/index.js b/ui/lib/core/index.js
index dcbd551a799..cddf809e648 100644
--- a/ui/lib/core/index.js
+++ b/ui/lib/core/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,11 @@
 
 module.exports = {
   name: require('./package').name,
+
+  babel: {
+    plugins: [require.resolve('ember-concurrency/async-arrow-task-transform')],
+  },
+
   isDevelopingAddon() {
     return true;
   },
diff --git a/ui/lib/core/package.json b/ui/lib/core/package.json
index 2fa87647679..97b9f76aac1 100644
--- a/ui/lib/core/package.json
+++ b/ui/lib/core/package.json
@@ -18,14 +18,11 @@
     "ember-cli-typescript": "*",
     "ember-composable-helpers": "*",
     "ember-concurrency": "*",
-    "ember-maybe-in-element": "*",
-    "ember/render-modifiers": "*",
+    "@ember/render-modifiers": "*",
     "ember-power-select": "*",
     "ember-router-helpers": "*",
-    "ember-svg-jar": "*",
     "ember-truth-helpers": "*",
     "escape-string-regexp": "*",
-    "@hashicorp/ember-flight-icons": "*",
     "@hashicorp/flight-icons": "*",
     "@hashicorp/design-system-components": "*",
     "codemirror": "*",
diff --git a/ui/lib/css/index.js b/ui/lib/css/index.js
deleted file mode 100644
index 3f7699fdfe2..00000000000
--- a/ui/lib/css/index.js
+++ /dev/null
@@ -1,42 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-/* eslint-env node */
-/* eslint-disable n/no-extraneous-require */
-'use strict';
-
-var path = require('path');
-var Funnel = require('broccoli-funnel');
-var mergeTrees = require('broccoli-merge-trees');
-
-module.exports = {
-  name: 'sassSvgUri',
-
-  isDevelopingAddon() {
-    return true;
-  },
-
-  included: function (app) {
-    this._super.included.apply(this, arguments);
-
-    // see: https://github.com/ember-cli/ember-cli/issues/3718
-    while (typeof app.import !== 'function' && app.app) {
-      app = app.app;
-    }
-
-    this.sassSVGURIPath = path.dirname(require.resolve('sass-svg-uri'));
-    return app;
-  },
-
-  treeForStyles: function () {
-    var sassSVGURI = new Funnel(this.sassSVGURIPath, {
-      srcDir: '/',
-      destDir: 'app/styles/sass-svg-uri',
-      annotation: 'Sass SVG URI',
-    });
-
-    return mergeTrees([sassSVGURI], { overwrite: true });
-  },
-};
diff --git a/ui/lib/css/package.json b/ui/lib/css/package.json
deleted file mode 100644
index 2cc1795e14b..00000000000
--- a/ui/lib/css/package.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "name": "css",
-  "keywords": [
-    "ember-addon"
-  ]
-}
diff --git a/ui/lib/keep-gitkeep/index.js b/ui/lib/keep-gitkeep/index.js
index 1bf6f71db73..63fa89409f4 100644
--- a/ui/lib/keep-gitkeep/index.js
+++ b/ui/lib/keep-gitkeep/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kmip/addon/components/details-credentials.hbs b/ui/lib/kmip/addon/components/details-credentials.hbs
new file mode 100644
index 00000000000..d848356e72e
--- /dev/null
+++ b/ui/lib/kmip/addon/components/details-credentials.hbs
@@ -0,0 +1,62 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Toolbar>
+  <ToolbarActions>
+    {{#if @credentials.deletePath.canDelete}}
+      <ConfirmAction
+        @buttonText="Revoke credentials"
+        class="toolbar-button"
+        @buttonColor="secondary"
+        @onConfirmAction={{@onRevokeCredentials}}
+        @confirmTitle="Revoke this?"
+        @confirmMessage="Any client using these credentials will no longer be able to."
+      />
+      <div class="toolbar-separator"></div>
+    {{/if}}
+    <Hds::Copy::Button
+      @text="Copy certificate"
+      @textToCopy={{@credentials.certificate}}
+      @onError={{(fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger"))}}
+      class="toolbar-button"
+      data-test-copy-button
+    />
+    <div class="toolbar-separator"></div>
+    <ToolbarLink
+      @route="credentials.index"
+      @models={{array @credentials.scope @credentials.role}}
+      data-test-kmip-link-back-to-role
+    >
+      Back to role
+    </ToolbarLink>
+  </ToolbarActions>
+</Toolbar>
+
+<div class="box is-shadowless is-fullwidth is-sideless">
+  <InfoTableRow @label="Serial number" @value={{@credentials.id}}>
+    <MaskedInput @value={{@credentials.id}} @displayOnly={{true}} @allowCopy={{true}} />
+  </InfoTableRow>
+  {{#if @credentials.privateKey}}
+    <InfoTableRow @label="Private key" @value={{@credentials.privateKey}}>
+      <div class="is-block">
+        <Hds::Alert data-test-warning @type="inline" @color="warning" @class="has-bottom-margin-s" as |A|>
+          <A.Title>Warning</A.Title>
+          <A.Description>You will not be able to access the private key later, so please copy the information below.</A.Description>
+        </Hds::Alert>
+        <MaskedInput @value={{@credentials.privateKey}} @name="Private key" @allowCopy={{true}} @displayOnly={{true}} />
+      </div>
+    </InfoTableRow>
+  {{/if}}
+  <InfoTableRow @label="Certificate" @value={{@credentials.certificate}}>
+    <MaskedInput @value={{@credentials.certificate}} @displayOnly={{true}} @allowCopy={{true}} />
+  </InfoTableRow>
+  <InfoTableRow @label="CA Chain" @value={{@credentials.caChain}}>
+    <div class="is-block">
+      {{#each @credentials.caChain as |chain|}}
+        <MaskedInput @value={{chain}} @displayOnly={{true}} @allowCopy={{true}} />
+      {{/each}}
+    </div>
+  </InfoTableRow>
+</div>
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/components/edit-form-kmip-role.js b/ui/lib/kmip/addon/components/edit-form-kmip-role.js
deleted file mode 100644
index 43a230b80b1..00000000000
--- a/ui/lib/kmip/addon/components/edit-form-kmip-role.js
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import EditForm from 'core/components/edit-form';
-import { computed } from '@ember/object';
-import layout from '../templates/components/edit-form-kmip-role';
-
-export default EditForm.extend({
-  layout,
-  model: null,
-
-  cancelLink: computed('cancelLinkParams.[]', function () {
-    if (!Array.isArray(this.cancelLinkParams) || !this.cancelLinkParams.length) return;
-    const [route, ...models] = this.cancelLinkParams;
-    return { route, models };
-  }),
-
-  init() {
-    this._super(...arguments);
-
-    if (this.model.isNew) {
-      this.model.operationAll = true;
-    }
-  },
-
-  actions: {
-    toggleOperationSpecial(checked) {
-      this.model.operationNone = !checked;
-      this.model.operationAll = checked;
-    },
-
-    // when operationAll is true, we want all of the items
-    // to appear checked, but we don't want to override what items
-    // a user has selected - so this action creates an object that we
-    // pass to the FormField component as the model instead of the real model
-    placeholderOrModel(isOperationAll, attr) {
-      return isOperationAll ? { [attr.name]: true } : this.model;
-    },
-
-    preSave(model) {
-      // if we have operationAll or operationNone, we want to clear
-      // out the others so that display shows the right data
-      if (model.operationAll || model.operationNone) {
-        model.operationFieldsWithoutSpecial.forEach((field) => model.set(field, null));
-      }
-      // set operationNone if user unchecks 'operationAll' instead of toggling the 'operationNone' input
-      // doing here instead of on the 'operationNone' input because a user might deselect all, then reselect some options
-      // and immediately setting operationNone will hide all of the checkboxes in the UI
-      this.model.operationNone =
-        model.operationFieldsWithoutSpecial.every((attr) => !model[attr]) && !this.model.operationAll;
-    },
-  },
-});
diff --git a/ui/lib/kmip/addon/components/header-credentials.hbs b/ui/lib/kmip/addon/components/header-credentials.hbs
index 78a0e3fe1b6..0bbf43d606c 100644
--- a/ui/lib/kmip/addon/components/header-credentials.hbs
+++ b/ui/lib/kmip/addon/components/header-credentials.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/kmip/addon/templates/components/header-scope.hbs b/ui/lib/kmip/addon/components/header-scope.hbs
similarity index 95%
rename from ui/lib/kmip/addon/templates/components/header-scope.hbs
rename to ui/lib/kmip/addon/components/header-scope.hbs
index b3cd94a0863..2e7a6a4f56d 100644
--- a/ui/lib/kmip/addon/templates/components/header-scope.hbs
+++ b/ui/lib/kmip/addon/components/header-scope.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/kmip/addon/components/header-scope.js b/ui/lib/kmip/addon/components/header-scope.js
index 37458f3c808..f2700384597 100644
--- a/ui/lib/kmip/addon/components/header-scope.js
+++ b/ui/lib/kmip/addon/components/header-scope.js
@@ -1,14 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@ember/component';
 import { service } from '@ember/service';
-import layout from '../templates/components/header-scope';
 
 export default Component.extend({
-  layout,
   tagName: '',
   secretMountPath: service(),
 });
diff --git a/ui/lib/kmip/addon/components/kmip-breadcrumb.hbs b/ui/lib/kmip/addon/components/kmip-breadcrumb.hbs
new file mode 100644
index 00000000000..8d57f66c0e1
--- /dev/null
+++ b/ui/lib/kmip/addon/components/kmip-breadcrumb.hbs
@@ -0,0 +1,29 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Breadcrumb>
+  <Hds::Breadcrumb::Item @text="Secrets" @route="secrets" @isRouteExternal={{true}} data-test-breadcrumb="Secrets" />
+  {{#if this.shouldShowPath}}
+    <Hds::Breadcrumb::Item
+      @text={{this.secretMountPath.currentPath}}
+      @route="scopes.index"
+      data-test-breadcrumb={{this.secretMountPath.currentPath}}
+    />
+  {{/if}}
+  {{#if @scope}}
+    <Hds::Breadcrumb::Item @text={{@scope}} @route="scope.roles" @model={{@scope}} data-test-breadcrumb={{@scope}} />
+  {{/if}}
+  {{#if @role}}
+    <Hds::Breadcrumb::Item
+      @text={{@role}}
+      @route="credentials.index"
+      @models={{array @scope @role}}
+      data-test-breadcrumb={{@role}}
+    />
+  {{/if}}
+  {{#if @currentRoute}}
+    <Hds::Breadcrumb::Item @text={{@currentRoute}} @current={{true}} data-test-breadcrumb={{@currentRoute}} />
+  {{/if}}
+</Hds::Breadcrumb>
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/components/kmip-breadcrumb.js b/ui/lib/kmip/addon/components/kmip-breadcrumb.js
index 0cc6bb7f246..cf597ded548 100644
--- a/ui/lib/kmip/addon/components/kmip-breadcrumb.js
+++ b/ui/lib/kmip/addon/components/kmip-breadcrumb.js
@@ -1,15 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@ember/component';
 import { service } from '@ember/service';
-import layout from '../templates/components/kmip-breadcrumb';
 import { or } from '@ember/object/computed';
 
 export default Component.extend({
-  layout,
   tagName: '',
   secretMountPath: service(),
   shouldShowPath: or('showPath', 'scope', 'role'),
diff --git a/ui/lib/kmip/addon/components/kmip/role-form.hbs b/ui/lib/kmip/addon/components/kmip/role-form.hbs
new file mode 100644
index 00000000000..8f7c96fc146
--- /dev/null
+++ b/ui/lib/kmip/addon/components/kmip/role-form.hbs
@@ -0,0 +1,82 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" (perform this.save)}}>
+  <MessageError @model={{@model}} data-test-edit-form-error />
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <NamespaceReminder @mode="save" />
+    {{#if @model.isNew}}
+      {{! Show role name only in create mode }}
+      <FormField data-test-field @attr={{hash name="role" type="string" options=(hash label="Name")}} @model={{@model}} />
+    {{/if}}
+    <div class="control is-flex box is-shadowless is-fullwidth is-marginless">
+      <input
+        data-test-input="operationNone"
+        id="operationNone"
+        type="checkbox"
+        class="toggle is-success is-small"
+        checked={{not @model.operationNone}}
+        {{on "change" this.toggleOperationSpecial}}
+      />
+      <label for="operationNone" class="has-text-weight-bold is-size-8">
+        Allow this role to perform KMIP operations
+      </label>
+    </div>
+    {{#unless @model.operationNone}}
+      <Toolbar>
+        <h3 class="title is-6 has-left-padding-s" data-test-kmip-section="Allowed Operations">
+          Allowed Operations
+        </h3>
+      </Toolbar>
+      <div class="box">
+        <FormField
+          @attr={{hash name="operationAll" type="boolean" options=(hash label="Allow this role to perform all operations")}}
+          @model={{@model}}
+        />
+        <hr />
+        <div class="kmip-role-operations">
+          {{#each this.operationFormGroups as |group|}}
+            <div class="kmip-role-allowed-operations">
+              <h4 class="title is-7" data-test-kmip-operations={{group.name}}>{{group.name}}</h4>
+              {{#each group.fields as |attr|}}
+                <FormField
+                  data-test-field
+                  @disabled={{or @model.operationNone @model.operationAll}}
+                  @attr={{attr}}
+                  @model={{this.placeholderOrModel @model attr.name}}
+                  @showHelpText={{false}}
+                />
+              {{/each}}
+            </div>
+          {{/each}}
+        </div>
+      </div>
+    {{/unless}}
+    <div class="box is-fullwidth is-shadowless">
+      <h3 class="title is-3" data-test-kmip-section="TLS">
+        TLS
+      </h3>
+      {{#each this.tlsFormFields as |attr|}}
+        <FormField data-test-field @attr={{attr}} @model={{@model}} />
+      {{/each}}
+    </div>
+    {{#each @model.fields as |attr|}}
+      <FormField data-test-field @attr={{attr}} @model={{@model}} />
+    {{/each}}
+  </div>
+
+  <div class="field is-grouped is-grouped-split is-fullwidth box is-bottomless">
+    <Hds::ButtonSet>
+      <Hds::Button
+        @text="Save"
+        @icon={{if this.save.isRunning "loading"}}
+        type="submit"
+        disabled={{this.save.isRunning}}
+        data-test-submit
+      />
+      <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onCancel}} data-test-cancel />
+    </Hds::ButtonSet>
+  </div>
+</form>
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/components/kmip/role-form.js b/ui/lib/kmip/addon/components/kmip/role-form.js
new file mode 100644
index 00000000000..c4d76d4c643
--- /dev/null
+++ b/ui/lib/kmip/addon/components/kmip/role-form.js
@@ -0,0 +1,107 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import AdapterError from '@ember-data/adapter/error';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import Component from '@glimmer/component';
+import { task } from 'ember-concurrency';
+import { removeManyFromArray } from 'vault/helpers/remove-from-array';
+import { operationFieldsWithoutSpecial, tlsFields } from 'vault/utils/model-helpers/kmip-role-fields';
+
+export default class KmipRoleFormComponent extends Component {
+  @service flashMessages;
+  @service store;
+
+  // Actual attribute fields
+  get tlsFormFields() {
+    return tlsFields().map((attr) => this.args.model.allByKey[attr]);
+  }
+  get operationFormGroups() {
+    const objects = [
+      'operationCreate',
+      'operationActivate',
+      'operationGet',
+      'operationLocate',
+      'operationRekey',
+      'operationRevoke',
+      'operationDestroy',
+    ];
+    const attributes = ['operationAddAttribute', 'operationGetAttributes'];
+    const server = ['operationDiscoverVersions'];
+    const others = removeManyFromArray(operationFieldsWithoutSpecial(this.args.model.editableFields), [
+      ...objects,
+      ...attributes,
+      ...server,
+    ]);
+    const groups = [
+      { name: 'Managed Cryptographic Objects', fields: objects },
+      { name: 'Object Attributes', fields: attributes },
+      { name: 'Server', fields: server },
+    ];
+    if (others.length) {
+      groups.push({
+        name: 'Other',
+        fields: others,
+      });
+    }
+    // expand field names to attributes
+    return groups.map((group) => ({
+      ...group,
+      fields: group.fields.map((attr) => this.args.model.allByKey[attr]),
+    }));
+  }
+
+  placeholderOrModel = (model, attrName) => {
+    return model.operationAll ? { [attrName]: true } : model;
+  };
+
+  preSave() {
+    const opFieldsWithoutSpecial = operationFieldsWithoutSpecial(this.args.model.editableFields);
+    // if we have operationAll or operationNone, we want to clear
+    // out the others so that display shows the right data
+    if (this.args.model.operationAll || this.args.model.operationNone) {
+      opFieldsWithoutSpecial.forEach((field) => (this.args.model[field] = null));
+    }
+    // set operationNone if user unchecks 'operationAll' instead of toggling the 'operationNone' input
+    // doing here instead of on the 'operationNone' input because a user might deselect all, then reselect some options
+    // and immediately setting operationNone will hide all of the checkboxes in the UI
+    this.args.model.operationNone =
+      opFieldsWithoutSpecial.every((attr) => this.args.model[attr] !== true) && !this.args.model.operationAll;
+    return this.args.model;
+  }
+
+  @action toggleOperationSpecial(evt) {
+    const { checked } = evt.target;
+    this.args.model.operationNone = !checked;
+    this.args.model.operationAll = checked;
+  }
+
+  save = task(async (evt) => {
+    evt.preventDefault();
+    const model = this.preSave();
+    try {
+      await model.save();
+      this.flashMessages.success(`Saved role ${model.role}`);
+    } catch (err) {
+      // err will display via model state
+      // AdapterErrors are handled by the error-message component
+      if (err instanceof AdapterError === false) {
+        throw err;
+      }
+      return;
+    }
+    this.args.onSave();
+  });
+
+  willDestroy() {
+    // components are torn down after store is unloaded and will cause an error if attempt to unload record
+    const noTeardown = this.store && !this.store.isDestroying;
+    if (noTeardown && this.args?.model?.isDirty) {
+      this.args.model.rollbackAttributes();
+    }
+    super.willDestroy();
+  }
+}
diff --git a/ui/lib/kmip/addon/templates/components/operation-field-display.hbs b/ui/lib/kmip/addon/components/operation-field-display.hbs
similarity index 95%
rename from ui/lib/kmip/addon/templates/components/operation-field-display.hbs
rename to ui/lib/kmip/addon/components/operation-field-display.hbs
index 34d9d01ffcd..ac47815a7ca 100644
--- a/ui/lib/kmip/addon/templates/components/operation-field-display.hbs
+++ b/ui/lib/kmip/addon/components/operation-field-display.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.model.operationAll}}
   <AlertInline @type="info" @message="This role allows all KMIP operations" class="is-marginless" />
diff --git a/ui/lib/kmip/addon/components/operation-field-display.js b/ui/lib/kmip/addon/components/operation-field-display.js
index 19adc7cf775..c941f8696fc 100644
--- a/ui/lib/kmip/addon/components/operation-field-display.js
+++ b/ui/lib/kmip/addon/components/operation-field-display.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,10 +16,8 @@
  *
  */
 import Component from '@ember/component';
-import layout from '../templates/components/operation-field-display';
 
 export default Component.extend({
-  layout,
   tagName: '',
   model: null,
 
@@ -30,7 +28,7 @@ export default Component.extend({
     if (model.operationNone) {
       return falseString;
     }
-    return model.get(field.name) ? trueString : falseString;
+    return model[field.name] ? trueString : falseString;
   },
 
   actions: {
diff --git a/ui/lib/kmip/addon/components/page/credentials-generate.hbs b/ui/lib/kmip/addon/components/page/credentials-generate.hbs
new file mode 100644
index 00000000000..894578ed390
--- /dev/null
+++ b/ui/lib/kmip/addon/components/page/credentials-generate.hbs
@@ -0,0 +1,16 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if this.hasGenerated}}
+  <DetailsCredentials @credentials={{@credentials}} @onRevokeCredentials={{this.revokeCredentials}} />
+{{else}}
+  <EditForm
+    @model={{@credentials}}
+    @onSave={{fn (mut this.hasGenerated) true}}
+    @callOnSaveAfterRender={{true}}
+    @successMessage="Successfully generated credentials from role: {{@credentials.role}}!"
+    @cancelLinkParams={{array "credentials.index"}}
+  />
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/components/page/credentials-generate.js b/ui/lib/kmip/addon/components/page/credentials-generate.js
new file mode 100644
index 00000000000..dc2cb116709
--- /dev/null
+++ b/ui/lib/kmip/addon/components/page/credentials-generate.js
@@ -0,0 +1,30 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import errorMessage from 'vault/utils/error-message';
+
+export default class KmipPageCredentialsGenerate extends Component {
+  @service flashMessages;
+  @service('app-router') router;
+  @tracked hasGenerated = false;
+
+  @action
+  async revokeCredentials() {
+    const { scope, role } = this.args.credentials;
+    try {
+      await this.args.credentials.destroyRecord();
+      this.flashMessages.success('Successfully revoked credentials.');
+      this.router.transitionTo('vault.cluster.secrets.backend.kmip.credentials.index', scope, role);
+    } catch (e) {
+      const message = errorMessage(e);
+      this.flashMessages.danger(`There was an error revoking credentials: ${message}.`);
+      this.args.credentials.rollbackAttributes();
+    }
+  }
+}
diff --git a/ui/lib/kmip/addon/controllers/credentials/index.js b/ui/lib/kmip/addon/controllers/credentials/index.js
index 78428a36a86..e3c9fc7f0b3 100644
--- a/ui/lib/kmip/addon/controllers/credentials/index.js
+++ b/ui/lib/kmip/addon/controllers/credentials/index.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ListController from 'core/mixins/list-controller';
 import Controller from '@ember/controller';
 import { computed } from '@ember/object';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 
 export default Controller.extend(ListController, {
   mountPoint: computed(function () {
diff --git a/ui/lib/kmip/addon/controllers/credentials/show.js b/ui/lib/kmip/addon/controllers/credentials/show.js
index 97242a1bfe6..b7614b6c733 100644
--- a/ui/lib/kmip/addon/controllers/credentials/show.js
+++ b/ui/lib/kmip/addon/controllers/credentials/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,16 +9,16 @@ import { action } from '@ember/object';
 
 export default class CredentialsShowController extends Controller {
   @service flashMessages;
-  @service router;
+  @service('app-router') router;
 
   @action
   async revokeCredentials() {
     try {
       await this.model.destroyRecord();
-      this.flashMessages.success('Successfully revoked credentials');
+      this.flashMessages.success('Successfully revoked credentials.');
       this.router.transitionTo('vault.cluster.secrets.backend.kmip.credentials.index', this.scope, this.role);
     } catch (e) {
-      this.flashMessages.danger(`There was an error revoking credentials: ${e.errors.join(' ')}`);
+      this.flashMessages.danger(`There was an error revoking credentials: ${e.errors.join(' ')}.`);
       this.model.rollbackAttributes();
     }
   }
diff --git a/ui/lib/kmip/addon/controllers/role.js b/ui/lib/kmip/addon/controllers/role.js
index e4fe42c15bf..1e1587b1c9b 100644
--- a/ui/lib/kmip/addon/controllers/role.js
+++ b/ui/lib/kmip/addon/controllers/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { action } from '@ember/object';
 
 export default class RoleController extends Controller {
   @service flashMessages;
-  @service router;
+  @service('app-router') router;
 
   @action
   async deleteRole() {
diff --git a/ui/lib/kmip/addon/controllers/scope/roles.js b/ui/lib/kmip/addon/controllers/scope/roles.js
index 78428a36a86..e3c9fc7f0b3 100644
--- a/ui/lib/kmip/addon/controllers/scope/roles.js
+++ b/ui/lib/kmip/addon/controllers/scope/roles.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ListController from 'core/mixins/list-controller';
 import Controller from '@ember/controller';
 import { computed } from '@ember/object';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 
 export default Controller.extend(ListController, {
   mountPoint: computed(function () {
diff --git a/ui/lib/kmip/addon/controllers/scopes/index.js b/ui/lib/kmip/addon/controllers/scopes/index.js
index 78428a36a86..e3c9fc7f0b3 100644
--- a/ui/lib/kmip/addon/controllers/scopes/index.js
+++ b/ui/lib/kmip/addon/controllers/scopes/index.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ListController from 'core/mixins/list-controller';
 import Controller from '@ember/controller';
 import { computed } from '@ember/object';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 
 export default Controller.extend(ListController, {
   mountPoint: computed(function () {
diff --git a/ui/lib/kmip/addon/engine.js b/ui/lib/kmip/addon/engine.js
index c2a71428bf0..abf49a41a35 100644
--- a/ui/lib/kmip/addon/engine.js
+++ b/ui/lib/kmip/addon/engine.js
@@ -1,34 +1,32 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Engine from 'ember-engines/engine';
 import loadInitializers from 'ember-load-initializers';
-import Resolver from './resolver';
+import Resolver from 'ember-resolver';
 import config from './config/environment';
 
 const { modulePrefix } = config;
-/* eslint-disable ember/avoid-leaking-state-in-ember-objects */
-const Eng = Engine.extend({
-  modulePrefix,
-  Resolver,
-  dependencies: {
+export default class KmipEngine extends Engine {
+  modulePrefix = modulePrefix;
+  Resolver = Resolver;
+  dependencies = {
     services: [
       'auth',
       'download',
       'flash-messages',
       'namespace',
       'path-help',
-      'router',
+      'app-router',
       'store',
+      'pagination',
       'version',
       'secret-mount-path',
     ],
     externalRoutes: ['secrets'],
-  },
-});
+  };
+}
 
-loadInitializers(Eng, modulePrefix);
-
-export default Eng;
+loadInitializers(KmipEngine, modulePrefix);
diff --git a/ui/lib/kmip/addon/resolver.js b/ui/lib/kmip/addon/resolver.js
deleted file mode 100644
index deb3e8ad3b4..00000000000
--- a/ui/lib/kmip/addon/resolver.js
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Resolver from 'ember-resolver';
-
-export default Resolver;
diff --git a/ui/lib/kmip/addon/routes.js b/ui/lib/kmip/addon/routes.js
index 90e2f7618b3..e14f86583fe 100644
--- a/ui/lib/kmip/addon/routes.js
+++ b/ui/lib/kmip/addon/routes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kmip/addon/routes/configuration.js b/ui/lib/kmip/addon/routes/configuration.js
index f1c19f07569..2864b295ede 100644
--- a/ui/lib/kmip/addon/routes/configuration.js
+++ b/ui/lib/kmip/addon/routes/configuration.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,7 +12,7 @@ export default Route.extend(UnloadModel, {
   secretMountPath: service(),
   pathHelp: service(),
   beforeModel() {
-    return this.pathHelp.getNewModel('kmip/config', this.secretMountPath.currentPath);
+    return this.pathHelp.hydrateModel('kmip/config', this.secretMountPath.currentPath);
   },
   model() {
     return this.store.findRecord('kmip/config', this.secretMountPath.currentPath).catch((err) => {
diff --git a/ui/lib/kmip/addon/routes/configure.js b/ui/lib/kmip/addon/routes/configure.js
index 98c3f8b19a7..8eed26c7ff7 100644
--- a/ui/lib/kmip/addon/routes/configure.js
+++ b/ui/lib/kmip/addon/routes/configure.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,13 +11,13 @@ export default Route.extend({
   secretMountPath: service(),
   pathHelp: service(),
   beforeModel() {
-    return this.pathHelp.getNewModel('kmip/config', this.secretMountPath.currentPath);
+    return this.pathHelp.hydrateModel('kmip/config', this.secretMountPath.currentPath);
   },
   model() {
     return this.store.findRecord('kmip/config', this.secretMountPath.currentPath).catch((err) => {
       if (err.httpStatus === 404) {
         const model = this.store.createRecord('kmip/config');
-        model.set('id', this.secretMountPath.currentPath);
+        model.set('mutableId', this.secretMountPath.currentPath);
         return model;
       } else {
         throw err;
diff --git a/ui/lib/kmip/addon/routes/credentials/generate.js b/ui/lib/kmip/addon/routes/credentials/generate.js
index 5fc87354f52..c3c9fcb4c04 100644
--- a/ui/lib/kmip/addon/routes/credentials/generate.js
+++ b/ui/lib/kmip/addon/routes/credentials/generate.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kmip/addon/routes/credentials/index.js b/ui/lib/kmip/addon/routes/credentials/index.js
index f7bd93b4972..cd8cf088ea3 100644
--- a/ui/lib/kmip/addon/routes/credentials/index.js
+++ b/ui/lib/kmip/addon/routes/credentials/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,7 @@ import ListRoute from 'core/mixins/list-route';
 import { service } from '@ember/service';
 
 export default Route.extend(ListRoute, {
-  store: service(),
+  pagination: service(),
   secretMountPath: service(),
   credParams() {
     const { role_name: role, scope_name: scope } = this.paramsFor('credentials');
@@ -19,7 +19,7 @@ export default Route.extend(ListRoute, {
   },
   model(params) {
     const { role, scope } = this.credParams();
-    return this.store
+    return this.pagination
       .lazyPaginatedQuery('kmip/credential', {
         role,
         scope,
diff --git a/ui/lib/kmip/addon/routes/credentials/show.js b/ui/lib/kmip/addon/routes/credentials/show.js
index 2f991b3bbbd..dc2d2d2696d 100644
--- a/ui/lib/kmip/addon/routes/credentials/show.js
+++ b/ui/lib/kmip/addon/routes/credentials/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kmip/addon/routes/role.js b/ui/lib/kmip/addon/routes/role.js
index a12b480df6d..eb8e5a1be4f 100644
--- a/ui/lib/kmip/addon/routes/role.js
+++ b/ui/lib/kmip/addon/routes/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,7 +12,7 @@ export default class KmipRoleRoute extends Route {
   @service pathHelp;
 
   beforeModel() {
-    return this.pathHelp.getNewModel('kmip/role', this.secretMountPath.currentPath);
+    return this.pathHelp.hydrateModel('kmip/role', this.secretMountPath.currentPath);
   }
 
   model(params) {
diff --git a/ui/lib/kmip/addon/routes/role/edit.js b/ui/lib/kmip/addon/routes/role/edit.js
index 832d746a9b8..714bea8068c 100644
--- a/ui/lib/kmip/addon/routes/role/edit.js
+++ b/ui/lib/kmip/addon/routes/role/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,7 @@ export default Route.extend({
   secretMountPath: service(),
   pathHelp: service(),
   beforeModel() {
-    return this.pathHelp.getNewModel('kmip/role', this.secretMountPath.currentPath);
+    return this.pathHelp.hydrateModel('kmip/role', this.secretMountPath.currentPath);
   },
   model() {
     const params = this.paramsFor(this.routeName);
diff --git a/ui/lib/kmip/addon/routes/scope/roles.js b/ui/lib/kmip/addon/routes/scope/roles.js
index 46dab7e039c..34ccfdcf930 100644
--- a/ui/lib/kmip/addon/routes/scope/roles.js
+++ b/ui/lib/kmip/addon/routes/scope/roles.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,17 +8,17 @@ import ListRoute from 'core/mixins/list-route';
 import { service } from '@ember/service';
 
 export default Route.extend(ListRoute, {
-  store: service(),
+  pagination: service(),
   secretMountPath: service(),
   pathHelp: service(),
   scope() {
     return this.paramsFor('scope').scope_name;
   },
   beforeModel() {
-    return this.pathHelp.getNewModel('kmip/role', this.secretMountPath.currentPath);
+    return this.pathHelp.hydrateModel('kmip/role', this.secretMountPath.currentPath);
   },
   model(params) {
-    return this.store
+    return this.pagination
       .lazyPaginatedQuery('kmip/role', {
         backend: this.secretMountPath.currentPath,
         scope: this.scope(),
diff --git a/ui/lib/kmip/addon/routes/scope/roles/create.js b/ui/lib/kmip/addon/routes/scope/roles/create.js
index b6e0f5322e4..df702b9b8d5 100644
--- a/ui/lib/kmip/addon/routes/scope/roles/create.js
+++ b/ui/lib/kmip/addon/routes/scope/roles/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,12 +15,13 @@ export default Route.extend({
   },
   beforeModel() {
     this.store.unloadAll('kmip/role');
-    return this.pathHelp.getNewModel('kmip/role', this.secretMountPath.currentPath);
+    return this.pathHelp.hydrateModel('kmip/role', this.secretMountPath.currentPath);
   },
   model() {
     const model = this.store.createRecord('kmip/role', {
       backend: this.secretMountPath.currentPath,
       scope: this.scope(),
+      operationAll: true,
     });
     return model;
   },
diff --git a/ui/lib/kmip/addon/routes/scopes/create.js b/ui/lib/kmip/addon/routes/scopes/create.js
index 2f6ae832df4..0227cd18241 100644
--- a/ui/lib/kmip/addon/routes/scopes/create.js
+++ b/ui/lib/kmip/addon/routes/scopes/create.js
@@ -1,21 +1,22 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
-export default Route.extend({
-  store: service(),
-  secretMountPath: service(),
+export default class KmipScopesCreate extends Route {
+  @service store;
+  @service secretMountPath;
+
   beforeModel() {
     this.store.unloadAll('kmip/scope');
-  },
+  }
+
   model() {
-    const model = this.store.createRecord('kmip/scope', {
+    return this.store.createRecord('kmip/scope', {
       backend: this.secretMountPath.currentPath,
     });
-    return model;
-  },
-});
+  }
+}
diff --git a/ui/lib/kmip/addon/routes/scopes/index.js b/ui/lib/kmip/addon/routes/scopes/index.js
index 569c520dcb4..c80936d7d48 100644
--- a/ui/lib/kmip/addon/routes/scopes/index.js
+++ b/ui/lib/kmip/addon/routes/scopes/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,10 +8,10 @@ import { service } from '@ember/service';
 import ListRoute from 'core/mixins/list-route';
 
 export default Route.extend(ListRoute, {
-  store: service(),
+  pagination: service(),
   secretMountPath: service(),
   model(params) {
-    return this.store
+    return this.pagination
       .lazyPaginatedQuery('kmip/scope', {
         backend: this.secretMountPath.currentPath,
         responsePath: 'data.keys',
@@ -31,12 +31,12 @@ export default Route.extend(ListRoute, {
     willTransition(transition) {
       window.scrollTo(0, 0);
       if (transition.targetName !== this.routeName) {
-        this.store.clearAllDatasets();
+        this.pagination.clearDataset();
       }
       return true;
     },
     reload() {
-      this.store.clearAllDatasets();
+      this.pagination.clearDataset();
       this.refresh();
     },
   },
diff --git a/ui/lib/kmip/addon/templates/application.hbs b/ui/lib/kmip/addon/templates/application.hbs
index 11a06fba008..f6eb0207f6a 100644
--- a/ui/lib/kmip/addon/templates/application.hbs
+++ b/ui/lib/kmip/addon/templates/application.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{outlet}}
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/templates/components/edit-form-kmip-role.hbs b/ui/lib/kmip/addon/templates/components/edit-form-kmip-role.hbs
deleted file mode 100644
index 3aea47a1d8d..00000000000
--- a/ui/lib/kmip/addon/templates/components/edit-form-kmip-role.hbs
+++ /dev/null
@@ -1,107 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<form {{action (queue (action "preSave" this.model) (perform this.save this.model)) on="submit"}}>
-  <MessageError @model={{this.model}} data-test-edit-form-error />
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <NamespaceReminder @mode="save" />
-    {{#if (eq @mode "create")}}
-      <FormField data-test-field @attr={{hash name="name" type="string"}} @model={{this.model}} />
-    {{/if}}
-    <div class="control is-flex box is-shadowless is-fullwidth is-marginless">
-      <input
-        data-test-input="operationNone"
-        id="operationNone"
-        type="checkbox"
-        class="toggle is-success is-small"
-        checked={{not this.model.operationNone}}
-        onchange={{action "toggleOperationSpecial" value="target.checked"}}
-      />
-      <label for="operationNone" class="has-text-weight-bold is-size-8">
-        Allow this role to perform KMIP operations
-      </label>
-    </div>
-    {{#unless this.model.operationNone}}
-      <Toolbar>
-        <h3 class="title is-6 has-left-padding-s">
-          Allowed Operations
-        </h3>
-      </Toolbar>
-      <div class="box">
-        <FormField
-          @attr={{hash name="operationAll" type="boolean" options=(hash label="Allow this role to perform all operations")}}
-          @model={{this.model}}
-        />
-        <hr />
-        <div class="is-flex">
-          <div class="kmip-role-allowed-operations">
-            {{#each-in (get this.model.operationFormFields 0) as |groupName fieldsInGroup|}}
-              <h4 class="title is-7">{{groupName}}</h4>
-              {{#each fieldsInGroup as |attr|}}
-                <FormField
-                  data-test-field
-                  @disabled={{or this.model.operationNone this.model.operationAll}}
-                  @attr={{attr}}
-                  @model={{compute (action "placeholderOrModel") this.model.operationAll attr}}
-                  @showHelpText={{false}}
-                />
-              {{/each}}
-            {{/each-in}}
-          </div>
-          <div class="kmip-role-allowed-operations">
-            {{#each (drop 1 (or this.model.operationFormFields (array))) as |group|}}
-              <div class="kmip-role-allowed-operations">
-                {{#each-in group as |groupName fieldsInGroup|}}
-                  <h4 class="title is-7">{{groupName}}</h4>
-                  {{#each fieldsInGroup as |attr|}}
-                    <FormField
-                      data-test-field
-                      @disabled={{or this.model.operationNone this.model.operationAll}}
-                      @attr={{attr}}
-                      @model={{compute (action "placeholderOrModel") this.model.operationAll attr}}
-                      @showHelpText={{false}}
-                    />
-                  {{/each}}
-                {{/each-in}}
-              </div>
-            {{/each}}
-          </div>
-        </div>
-      </div>
-    {{/unless}}
-    <div class="box is-fullwidth is-shadowless">
-      <h3 class="title is-3">
-        TLS
-      </h3>
-      {{#each this.model.tlsFormFields as |attr|}}
-        <FormField data-test-field @attr={{attr}} @model={{this.model}} />
-      {{/each}}
-    </div>
-    {{#each this.model.fields as |attr|}}
-      <FormField data-test-field @attr={{attr}} @model={{this.model}} />
-    {{/each}}
-  </div>
-
-  <div class="field is-grouped is-grouped-split is-fullwidth box is-bottomless">
-    <Hds::ButtonSet>
-      <Hds::Button
-        @text={{this.saveButtonText}}
-        @icon={{if this.save.isRunning "loading"}}
-        type="submit"
-        data-test-edit-form-submit
-        disabled={{this.save.isRunning}}
-      />
-      {{#if this.cancelLink}}
-        <Hds::Button
-          @text="Cancel"
-          @color="secondary"
-          @route={{this.cancelLink.route}}
-          @models={{this.cancelLink.models}}
-          data-test-edit-form-cancel
-        />
-      {{/if}}
-    </Hds::ButtonSet>
-  </div>
-</form>
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/templates/components/kmip-breadcrumb.hbs b/ui/lib/kmip/addon/templates/components/kmip-breadcrumb.hbs
deleted file mode 100644
index 90cb4081793..00000000000
--- a/ui/lib/kmip/addon/templates/components/kmip-breadcrumb.hbs
+++ /dev/null
@@ -1,20 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<Hds::Breadcrumb>
-  <Hds::Breadcrumb::Item @text="Secrets" @route="secrets" @isRouteExternal={{true}} />
-  {{#if this.shouldShowPath}}
-    <Hds::Breadcrumb::Item @text={{this.secretMountPath.currentPath}} @route="scopes.index" />
-  {{/if}}
-  {{#if @scope}}
-    <Hds::Breadcrumb::Item @text={{@scope}} @route="scope.roles" @model={{@scope}} />
-  {{/if}}
-  {{#if @role}}
-    <Hds::Breadcrumb::Item @text={{@role}} @route="credentials.index" @models={{array @scope @role}} />
-  {{/if}}
-  {{#if @currentRoute}}
-    <Hds::Breadcrumb::Item @text={{@currentRoute}} @current={{true}} />
-  {{/if}}
-</Hds::Breadcrumb>
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/templates/configuration.hbs b/ui/lib/kmip/addon/templates/configuration.hbs
index ea41f8c22c1..7fe4a0d7681 100644
--- a/ui/lib/kmip/addon/templates/configuration.hbs
+++ b/ui/lib/kmip/addon/templates/configuration.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <HeaderScope />
 <Toolbar>
diff --git a/ui/lib/kmip/addon/templates/configure.hbs b/ui/lib/kmip/addon/templates/configure.hbs
index be630c7f31a..99a257a281c 100644
--- a/ui/lib/kmip/addon/templates/configure.hbs
+++ b/ui/lib/kmip/addon/templates/configure.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/kmip/addon/templates/credentials/generate.hbs b/ui/lib/kmip/addon/templates/credentials/generate.hbs
index 7446f16ec08..f5c917d191b 100644
--- a/ui/lib/kmip/addon/templates/credentials/generate.hbs
+++ b/ui/lib/kmip/addon/templates/credentials/generate.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -13,10 +13,6 @@
     </h1>
   </p.levelLeft>
 </PageHeader>
-<EditForm
-  @model={{this.model}}
-  @onSave={{transition-to "vault.cluster.secrets.backend.kmip.credentials.show" this.model.id}}
-  @callOnSaveAfterRender={{true}}
-  @successMessage={{concat "Successfully generated credentials from role:" this.role "!"}}
-  @cancelLinkParams={{array "credentials.index"}}
-/>
\ No newline at end of file
+
+{{! this.model is the ember data model kmip/credential }}
+<Page::CredentialsGenerate @credentials={{this.model}} />
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/templates/credentials/index.hbs b/ui/lib/kmip/addon/templates/credentials/index.hbs
index 15a46cf8ae6..ea53d1c4496 100644
--- a/ui/lib/kmip/addon/templates/credentials/index.hbs
+++ b/ui/lib/kmip/addon/templates/credentials/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <HeaderCredentials @role={{this.role}} @scope={{this.scope}} />
 <Toolbar>
@@ -45,7 +45,13 @@
     </ToolbarLink>
   </ToolbarActions>
 </Toolbar>
-<ListView @items={{this.model}} @itemNoun="credentials" @paginationRouteName="credentials.index" as |list|>
+<ListView
+  @items={{this.model}}
+  @itemNoun="credentials"
+  @paginationRouteName="credentials.index"
+  @paginationRouteParams={{array this.scope this.role}}
+  as |list|
+>
   {{#if list.empty}}
     <list.empty
       @title="No credentials yet for this role"
@@ -65,22 +71,17 @@
       <Item.menu>
         <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
           <dd.ToggleIcon @icon="more-horizontal" @text="More options" @hasChevron={{false}} data-test-popup-menu-trigger />
-          <dd.Interactive
-            @text="View credentials"
-            @route="credentials.show"
-            @models={{array this.scope this.role list.item.id}}
-          />
+          <dd.Interactive @route="credentials.show" @models={{array this.scope this.role list.item.id}}>View credentials</dd.Interactive>
           {{#if list.item.deletePath.isPending}}
             <dd.Generic>
               <LoadingDropdownOption />
             </dd.Generic>
           {{else if list.item.deletePath.canDelete}}
             <dd.Interactive
-              @text="Revoke credentials"
               @color="critical"
               {{on "click" (fn (mut this.credToRevoke) list.item)}}
               data-test-confirm-action-trigger
-            />
+            >Revoke credentials</dd.Interactive>
           {{/if}}
         </Hds::Dropdown>
         {{#if (eq this.credToRevoke list.item)}}
diff --git a/ui/lib/kmip/addon/templates/credentials/show.hbs b/ui/lib/kmip/addon/templates/credentials/show.hbs
index 97245e6505b..d0bf6390f9e 100644
--- a/ui/lib/kmip/addon/templates/credentials/show.hbs
+++ b/ui/lib/kmip/addon/templates/credentials/show.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -13,56 +13,5 @@
     </h1>
   </p.levelLeft>
 </PageHeader>
-<Toolbar>
-  <ToolbarActions>
-    {{#if this.model.deletePath.canDelete}}
-      <ConfirmAction
-        @buttonText="Revoke credentials"
-        class="toolbar-button"
-        @buttonColor="secondary"
-        @onConfirmAction={{this.revokeCredentials}}
-        @confirmTitle="Revoke this?"
-        @confirmMessage="Any client using these credentials will no longer be able to."
-      />
-      <div class="toolbar-separator"></div>
-    {{/if}}
-    <ToolbarLink @route="credentials.index" @models={{array this.scope this.role}} data-test-kmip-link-back-to-role>
-      Back to role
-    </ToolbarLink>
-    <Hds::Copy::Button
-      @text="Copy certificate"
-      @textToCopy={{this.model.certificate}}
-      @onError={{(fn
-        (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-      )}}
-      class="toolbar-button"
-      data-test-copy-button
-    />
-  </ToolbarActions>
-</Toolbar>
-<div class="box is-shadowless is-fullwidth is-sideless">
-  <InfoTableRow @label="Serial number" @value={{this.model.id}}>
-    <MaskedInput @value={{this.model.id}} @displayOnly={{true}} @allowCopy={{true}} />
-  </InfoTableRow>
-  {{#if this.model.privateKey}}
-    <InfoTableRow @label="Private key" @value={{this.model.privateKey}}>
-      <div class="is-block">
-        <Hds::Alert data-test-warning @type="inline" @color="warning" @class="has-bottom-margin-s" as |A|>
-          <A.Title>Warning</A.Title>
-          <A.Description>You will not be able to access the private key later, so please copy the information below.</A.Description>
-        </Hds::Alert>
-        <MaskedInput @value={{this.model.privateKey}} @name="Private key" @allowCopy={{true}} @displayOnly={{true}} />
-      </div>
-    </InfoTableRow>
-  {{/if}}
-  <InfoTableRow @label="Certificate" @value={{this.model.certificate}}>
-    <MaskedInput @value={{this.model.certificate}} @displayOnly={{true}} @allowCopy={{true}} />
-  </InfoTableRow>
-  <InfoTableRow @label="CA Chain" @value={{this.model.caChain}}>
-    <div class="is-block">
-      {{#each this.model.caChain as |chain|}}
-        <MaskedInput @value={{chain}} @displayOnly={{true}} @allowCopy={{true}} />
-      {{/each}}
-    </div>
-  </InfoTableRow>
-</div>
\ No newline at end of file
+
+<DetailsCredentials @credentials={{this.model}} @onRevokeCredentials={{this.revokeCredentials}} />
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/templates/role.hbs b/ui/lib/kmip/addon/templates/role.hbs
index 81b1cacdba2..c64d9780484 100644
--- a/ui/lib/kmip/addon/templates/role.hbs
+++ b/ui/lib/kmip/addon/templates/role.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <HeaderCredentials @role={{this.role}} @scope={{this.scope}} />
 <Toolbar>
diff --git a/ui/lib/kmip/addon/templates/role/edit.hbs b/ui/lib/kmip/addon/templates/role/edit.hbs
index ab2003d8578..695d34b669a 100644
--- a/ui/lib/kmip/addon/templates/role/edit.hbs
+++ b/ui/lib/kmip/addon/templates/role/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -13,8 +13,9 @@
     </h1>
   </p.levelLeft>
 </PageHeader>
-<EditFormKmipRole
+
+<Kmip::RoleForm
   @model={{this.model}}
   @onSave={{transition-to "vault.cluster.secrets.backend.kmip.role" this.scope this.role}}
-  @cancelLinkParams={{array "role" this.scope this.role}}
+  @onCancel={{transition-to "vault.cluster.secrets.backend.kmip.role" this.scope this.role}}
 />
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/templates/scope/roles.hbs b/ui/lib/kmip/addon/templates/scope/roles.hbs
index b9370ce2cc6..ca7960c59f6 100644
--- a/ui/lib/kmip/addon/templates/scope/roles.hbs
+++ b/ui/lib/kmip/addon/templates/scope/roles.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -71,23 +71,22 @@
       <Item.menu>
         <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
           <dd.ToggleIcon @icon="more-horizontal" @text="More options" @hasChevron={{false}} data-test-popup-menu-trigger />
-          <dd.Interactive @text="View credentials" @route="credentials" @models={{array this.scope list.item.id}} />
-          <dd.Interactive @text="View role" @route="role" @models={{array this.scope list.item.id}} />
+          <dd.Interactive @route="credentials" @models={{array this.scope list.item.id}}>View credentials</dd.Interactive>
+          <dd.Interactive @route="role" @models={{array this.scope list.item.id}}>View role</dd.Interactive>
           {{#if list.item.updatePath.isPending}}
             <dd.Generic>
               <LoadingDropdownOption />
             </dd.Generic>
           {{else}}
             {{#if list.item.updatePath.canUpdate}}
-              <dd.Interactive @text="Edit role" @route="role.edit" @models={{array this.scope list.item.id}} />
+              <dd.Interactive @route="role.edit" @models={{array this.scope list.item.id}}>Edit role</dd.Interactive>
             {{/if}}
             {{#if list.item.updatePath.canDelete}}
               <dd.Interactive
-                @text="Delete role"
                 @color="critical"
                 {{on "click" (fn (mut this.roleToDelete) list.item)}}
                 data-test-confirm-action-trigger
-              />
+              >Delete role</dd.Interactive>
             {{/if}}
           {{/if}}
         </Hds::Dropdown>
diff --git a/ui/lib/kmip/addon/templates/scope/roles/create.hbs b/ui/lib/kmip/addon/templates/scope/roles/create.hbs
index 42fcc4bf407..6b74d067d37 100644
--- a/ui/lib/kmip/addon/templates/scope/roles/create.hbs
+++ b/ui/lib/kmip/addon/templates/scope/roles/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -13,9 +13,9 @@
     </h1>
   </p.levelLeft>
 </PageHeader>
-<EditFormKmipRole
+
+<Kmip::RoleForm
   @model={{this.model}}
-  @mode="create"
   @onSave={{transition-to "vault.cluster.secrets.backend.kmip.scope.roles" this.scope}}
-  @cancelLinkParams={{array "scope.roles" this.scope}}
+  @onCancel={{transition-to "vault.cluster.secrets.backend.kmip.scope.roles" this.scope}}
 />
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/templates/scopes.hbs b/ui/lib/kmip/addon/templates/scopes.hbs
index 11a06fba008..f6eb0207f6a 100644
--- a/ui/lib/kmip/addon/templates/scopes.hbs
+++ b/ui/lib/kmip/addon/templates/scopes.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{outlet}}
\ No newline at end of file
diff --git a/ui/lib/kmip/addon/templates/scopes/create.hbs b/ui/lib/kmip/addon/templates/scopes/create.hbs
index 750d6cfc223..0d50a66694e 100644
--- a/ui/lib/kmip/addon/templates/scopes/create.hbs
+++ b/ui/lib/kmip/addon/templates/scopes/create.hbs
@@ -1,9 +1,12 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
+  <p.top>
+    <KmipBreadcrumb @showPath={{true}} @currentRoute="Create Scope" />
+  </p.top>
   <p.levelLeft>
     <h1 class="title is-3">
       Create a Scope
diff --git a/ui/lib/kmip/addon/templates/scopes/index.hbs b/ui/lib/kmip/addon/templates/scopes/index.hbs
index 4af903b79d9..f7e0ab1d82f 100644
--- a/ui/lib/kmip/addon/templates/scopes/index.hbs
+++ b/ui/lib/kmip/addon/templates/scopes/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <HeaderScope />
 <Toolbar>
@@ -60,18 +60,17 @@
       <Item.menu>
         <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
           <dd.ToggleIcon @icon="more-horizontal" @text="More options" @hasChevron={{false}} data-test-popup-menu-trigger />
-          <dd.Interactive @text="View scope" @route="scope" @model={{list.item.id}} />
+          <dd.Interactive @route="scope" @model={{list.item.id}}>View scope</dd.Interactive>
           {{#if list.item.updatePath.isPending}}
             <dd.Generic>
               <LoadingDropdownOption />
             </dd.Generic>
           {{else if list.item.updatePath.canDelete}}
             <dd.Interactive
-              @text="Delete scope"
               @color="critical"
               {{on "click" (fn (mut this.scopeToDelete) list.item)}}
               data-test-confirm-action-trigger
-            />
+            >Delete scope</dd.Interactive>
           {{/if}}
         </Hds::Dropdown>
         {{#if (eq this.scopeToDelete list.item)}}
diff --git a/ui/lib/kmip/config/environment.js b/ui/lib/kmip/config/environment.js
index add347f074c..0fb154558e6 100644
--- a/ui/lib/kmip/config/environment.js
+++ b/ui/lib/kmip/config/environment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kmip/index.js b/ui/lib/kmip/index.js
index 2d2ddc66e94..ddfdae08826 100644
--- a/ui/lib/kmip/index.js
+++ b/ui/lib/kmip/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,6 +17,10 @@ module.exports = EngineAddon.extend({
     enabled: true,
   },
 
+  babel: {
+    plugins: [require.resolve('ember-concurrency/async-arrow-task-transform')],
+  },
+
   isDevelopingAddon() {
     return true;
   },
diff --git a/ui/lib/kmip/package.json b/ui/lib/kmip/package.json
index ddf094fdd0b..f85fd41152b 100644
--- a/ui/lib/kmip/package.json
+++ b/ui/lib/kmip/package.json
@@ -7,7 +7,8 @@
   "dependencies": {
     "ember-cli-htmlbars": "*",
     "ember-cli-babel": "*",
-    "@hashicorp/design-system-components": "*"
+    "@hashicorp/design-system-components": "*",
+    "ember-auto-import": "*"
 
   },
   "ember-addon": {
diff --git a/ui/lib/kubernetes/addon/components/config-cta.hbs b/ui/lib/kubernetes/addon/components/config-cta.hbs
index bed20e538f5..ad0ff7d6cdd 100644
--- a/ui/lib/kubernetes/addon/components/config-cta.hbs
+++ b/ui/lib/kubernetes/addon/components/config-cta.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <EmptyState
   data-test-config-cta
diff --git a/ui/lib/kubernetes/addon/components/page/configuration.hbs b/ui/lib/kubernetes/addon/components/page/configuration.hbs
index bede4356fcd..5d6ae2b0d0b 100644
--- a/ui/lib/kubernetes/addon/components/page/configuration.hbs
+++ b/ui/lib/kubernetes/addon/components/page/configuration.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <TabPageHeader @model={{@backend}} @breadcrumbs={{@breadcrumbs}}>
   <ToolbarLink @route="configure" data-test-toolbar-config-action>
@@ -30,4 +30,8 @@
   <ConfigCta />
 {{/if}}
 
-<SecretsEngineMountConfig @model={{@backend}} class="has-top-margin-xl has-bottom-margin-xl" data-test-mount-config />
\ No newline at end of file
+<SecretsEngineMountConfig
+  @secretsEngine={{@backend}}
+  class="has-top-margin-xl has-bottom-margin-xl"
+  data-test-mount-config
+/>
\ No newline at end of file
diff --git a/ui/lib/kubernetes/addon/components/page/configure.hbs b/ui/lib/kubernetes/addon/components/page/configure.hbs
index 45795fa15cb..22a37093196 100644
--- a/ui/lib/kubernetes/addon/components/page/configure.hbs
+++ b/ui/lib/kubernetes/addon/components/page/configure.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/kubernetes/addon/components/page/configure.js b/ui/lib/kubernetes/addon/components/page/configure.js
index 72b1301697f..20ba49958d3 100644
--- a/ui/lib/kubernetes/addon/components/page/configure.js
+++ b/ui/lib/kubernetes/addon/components/page/configure.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -18,7 +18,7 @@ import errorMessage from 'vault/utils/error-message';
  * @param {object} model - config model that contains kubernetes configuration
  */
 export default class ConfigurePageComponent extends Component {
-  @service router;
+  @service('app-router') router;
   @service store;
 
   @tracked inferredState;
diff --git a/ui/lib/kubernetes/addon/components/page/credentials.hbs b/ui/lib/kubernetes/addon/components/page/credentials.hbs
index 82b9dafad16..62b650dffc4 100644
--- a/ui/lib/kubernetes/addon/components/page/credentials.hbs
+++ b/ui/lib/kubernetes/addon/components/page/credentials.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -75,7 +75,7 @@
           <Toggle
             @checked={{this.clusterRoleBinding}}
             @onChange={{(toggle-action "clusterRoleBinding" this)}}
-            data-test-kubernetes-clusterRoleBinding
+            data-test-toggle-input="kubernetes-clusterRoleBinding"
           >
             <h3 class="title is-7 is-marginless">ClusterRoleBinding</h3>
             <div class="description has-text-grey">
diff --git a/ui/lib/kubernetes/addon/components/page/credentials.js b/ui/lib/kubernetes/addon/components/page/credentials.js
index 736be6a0e31..dcce58c6011 100644
--- a/ui/lib/kubernetes/addon/components/page/credentials.js
+++ b/ui/lib/kubernetes/addon/components/page/credentials.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,7 +23,7 @@ import timestamp from 'vault/utils/timestamp';
  */
 export default class CredentialsPageComponent extends Component {
   @service store;
-  @service router;
+  @service('app-router') router;
 
   @tracked ttl = '';
   @tracked clusterRoleBinding = false;
diff --git a/ui/lib/kubernetes/addon/components/page/overview.hbs b/ui/lib/kubernetes/addon/components/page/overview.hbs
index 0fb2bb0ad28..0eb81ec3dc5 100644
--- a/ui/lib/kubernetes/addon/components/page/overview.hbs
+++ b/ui/lib/kubernetes/addon/components/page/overview.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <TabPageHeader @model={{@backend}} @breadcrumbs={{@breadcrumbs}}>
   <ToolbarLink @route="configure">Configure Kubernetes</ToolbarLink>
@@ -11,37 +11,45 @@
   <ConfigCta />
 {{else}}
   <div class="is-grid has-top-margin-l grid-2-columns grid-gap-2">
-    <OverviewCard
-      @cardTitle="Roles"
-      @subText="The number of Vault roles being used to generate Kubernetes credentials."
-      @actionText={{if @roles.length "View Roles" "Create Role"}}
-      @actionTo={{if @roles.length "roles" "roles.create"}}
-    >
-      <h2 class="title is-2 has-font-weight-normal has-top-margin-m" data-test-roles-card-overview-num>{{or
-          @roles.length
-          "None"
-        }}</h2>
+    <OverviewCard @cardTitle="Roles" @subText="The number of Vault roles being used to generate Kubernetes credentials.">
+      <:action>
+        <Hds::Link::Standalone
+          @text={{if @roles.length "View Roles" "Create Role"}}
+          @route={{if @roles.length "roles" "roles.create"}}
+          @icon={{if @roles.length "chevron-right" "plus"}}
+          @iconPosition="trailing"
+        />
+      </:action>
+      <:content>
+        <h2 class="title is-2 has-font-weight-normal has-top-margin-m" data-test-roles-card-overview-num>{{or
+            @roles.length
+            "None"
+          }}</h2>
+      </:content>
     </OverviewCard>
     <OverviewCard @cardTitle="Generate credentials" @subText="Quickly generate credentials by typing the role name.">
-      <div class="has-top-margin-m is-flex">
-        <SearchSelect
-          class="is-flex-grow-1"
-          @placeholder="Type to find a role..."
-          @disallowNewItems={{true}}
-          @options={{this.roleOptions}}
-          @selectLimit="1"
-          @fallbackComponent="input-search"
-          @onChange={{this.selectRole}}
-        />
-        <Hds::Button
-          @text="Generate"
-          @color="secondary"
-          class="has-left-margin-s"
-          disabled={{not this.selectedRole}}
-          {{on "click" this.generateCredential}}
-          data-test-generate-credential-button
-        />
-      </div>
+      <:content>
+        <div class="has-top-margin-m is-flex">
+          <SearchSelect
+            class="is-flex-grow-1"
+            @ariaLabel="Role"
+            @placeholder="Type to find a role..."
+            @disallowNewItems={{true}}
+            @options={{this.roleOptions}}
+            @selectLimit="1"
+            @fallbackComponent="input-search"
+            @onChange={{this.selectRole}}
+          />
+          <Hds::Button
+            @text="Generate"
+            @color="secondary"
+            class="has-left-margin-s"
+            disabled={{not this.selectedRole}}
+            {{on "click" this.generateCredential}}
+            data-test-generate-credential-button
+          />
+        </div>
+      </:content>
     </OverviewCard>
   </div>
 {{/if}}
\ No newline at end of file
diff --git a/ui/lib/kubernetes/addon/components/page/overview.js b/ui/lib/kubernetes/addon/components/page/overview.js
index d20ff4d1b8d..a5b13676ced 100644
--- a/ui/lib/kubernetes/addon/components/page/overview.js
+++ b/ui/lib/kubernetes/addon/components/page/overview.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,7 +19,7 @@ import { action } from '@ember/object';
  */
 
 export default class OverviewPageComponent extends Component {
-  @service router;
+  @service('app-router') router;
 
   @tracked selectedRole = null;
   @tracked roleOptions = [];
diff --git a/ui/lib/kubernetes/addon/components/page/role/create-and-edit.hbs b/ui/lib/kubernetes/addon/components/page/role/create-and-edit.hbs
index 9fc5770458e..42f625590d8 100644
--- a/ui/lib/kubernetes/addon/components/page/role/create-and-edit.hbs
+++ b/ui/lib/kubernetes/addon/components/page/role/create-and-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -112,19 +112,13 @@
             data-test-rules
             @title="Role rules"
             @value={{template.rules}}
+            @example={{template.rules}}
             @mode="ruby"
             @valueUpdated={{fn (mut template.rules)}}
             @helpText={{sanitized-html this.roleRulesHelpText}}
-          >
-            <Hds::Button
-              @icon="reload"
-              @text="Restore example"
-              @color="secondary"
-              class="toolbar-button"
-              {{on "click" this.resetRoleRules}}
-              data-test-restore-example
-            />
-          </JsonEditor>
+            @onSetup={{fn (mut this.codemirrorEditor)}}
+            @onRestoreExample={{this.resetRoleRules}}
+          />
         {{/let}}
       </div>
     {{/if}}
@@ -151,7 +145,7 @@
     type="submit"
     form="role"
     disabled={{or (not @model.generationPreference) this.save.isRunning}}
-    data-test-save
+    data-test-submit
   />
   <Hds::Button @text="Back" @color="secondary" class="has-left-margin-s" data-test-cancel {{on "click" this.cancel}} />
 </div>
\ No newline at end of file
diff --git a/ui/lib/kubernetes/addon/components/page/role/create-and-edit.js b/ui/lib/kubernetes/addon/components/page/role/create-and-edit.js
index d01d521e9c2..4ccc356a7a0 100644
--- a/ui/lib/kubernetes/addon/components/page/role/create-and-edit.js
+++ b/ui/lib/kubernetes/addon/components/page/role/create-and-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -20,7 +20,7 @@ import errorMessage from 'vault/utils/error-message';
  */
 
 export default class CreateAndEditRolePageComponent extends Component {
-  @service router;
+  @service('app-router') router;
   @service flashMessages;
 
   @tracked roleRulesTemplates;
@@ -28,6 +28,7 @@ export default class CreateAndEditRolePageComponent extends Component {
   @tracked modelValidations;
   @tracked invalidFormAlert;
   @tracked errorBanner;
+  @tracked codemirrorEditor;
 
   constructor() {
     super(...arguments);
@@ -85,7 +86,7 @@ export default class CreateAndEditRolePageComponent extends Component {
     const message =
       'This specifies the Role or ClusterRole rules to use when generating a role. Kubernetes documentation is';
     const link =
-      '<a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" target="_blank" rel="noopener noreferrer">available here</>';
+      '<a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" target="_blank" rel="noopener noreferrer" class="has-text-white">available here</>';
     return `${message} ${link}.`;
   }
 
@@ -111,12 +112,31 @@ export default class CreateAndEditRolePageComponent extends Component {
 
   @action
   resetRoleRules() {
+    // Reset tracked rule templates to initial values
     this.roleRulesTemplates = getRules();
+    // Make sure editor renders the reset template
+    this.updateCodeMirror();
+  }
+
+  @action
+  updateCodeMirror() {
+    const template = this.roleRulesTemplates.find((t) => t.id === this.selectedTemplateId);
+    this.codemirrorEditor.dispatch({
+      changes: [
+        {
+          from: 0,
+          to: this.codemirrorEditor.state.doc.length,
+          insert: template.rules,
+        },
+      ],
+    });
   }
 
   @action
   selectTemplate(event) {
     this.selectedTemplateId = event.target.value;
+    // Dispatch the event to codemirror so the code editor updates when a template is selected
+    this.updateCodeMirror();
   }
 
   @action
diff --git a/ui/lib/kubernetes/addon/components/page/role/details.hbs b/ui/lib/kubernetes/addon/components/page/role/details.hbs
index 1693464733e..8e440440568 100644
--- a/ui/lib/kubernetes/addon/components/page/role/details.hbs
+++ b/ui/lib/kubernetes/addon/components/page/role/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -52,14 +52,11 @@
 {{#if @model.generatedRoleRules}}
   <div class="has-top-margin-xl" data-test-generated-role-rules>
     <h2 class="title is-4">Generated role rules</h2>
-    <JsonEditor
-      @title="Role rules"
-      @value={{@model.generatedRoleRules}}
-      @mode="ruby"
-      @readOnly={{true}}
-      @showToolbar={{true}}
-      @theme="hashi auto-height"
-    />
+    <Hds::CodeBlock @value={{@model.generatedRoleRules}} @language="ruby" @hasCopyButton={{true}} as |CB|>
+      <CB.Title @tag="h3">
+        Role rules
+      </CB.Title>
+    </Hds::CodeBlock>
   </div>
 {{/if}}
 
diff --git a/ui/lib/kubernetes/addon/components/page/role/details.js b/ui/lib/kubernetes/addon/components/page/role/details.js
index d3001c1f2d5..1dc836f0805 100644
--- a/ui/lib/kubernetes/addon/components/page/role/details.js
+++ b/ui/lib/kubernetes/addon/components/page/role/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,7 +17,7 @@ import errorMessage from 'vault/utils/error-message';
  */
 
 export default class RoleDetailsPageComponent extends Component {
-  @service router;
+  @service('app-router') router;
   @service flashMessages;
 
   get extraFields() {
diff --git a/ui/lib/kubernetes/addon/components/page/roles.hbs b/ui/lib/kubernetes/addon/components/page/roles.hbs
index e1ade3fa611..9b4e5f07814 100644
--- a/ui/lib/kubernetes/addon/components/page/roles.hbs
+++ b/ui/lib/kubernetes/addon/components/page/roles.hbs
@@ -1,13 +1,16 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <TabPageHeader
   @model={{@backend}}
   @filterRoles={{not @promptConfig}}
-  @rolesFilterValue={{@filterValue}}
+  @query={{this.query}}
   @breadcrumbs={{@breadcrumbs}}
+  @handleSearch={{this.handleSearch}}
+  @handleInput={{this.handleInput}}
+  @handleKeyDown={{this.handleKeyDown}}
 >
   {{#unless @promptConfig}}
     <ToolbarLink @route="roles.create" @type="add" data-test-toolbar-roles-action>
@@ -46,18 +49,17 @@
                 data-test-popup-menu-trigger
               />
               {{#if role.canRead}}
-                <dd.Interactive @text="Details" @route="roles.role.details" @model={{role}} data-test-details />
+                <dd.Interactive @route="roles.role.details" @model={{role}} data-test-details>Details</dd.Interactive>
               {{/if}}
               {{#if role.canEdit}}
-                <dd.Interactive @text="Edit" data-test-edit @route="roles.role.edit" @model={{role}} />
+                <dd.Interactive data-test-edit @route="roles.role.edit" @model={{role}}>Edit</dd.Interactive>
               {{/if}}
               {{#if role.canDelete}}
                 <dd.Interactive
-                  @text="Delete"
                   data-test-delete
                   @color="critical"
                   {{on "click" (fn (mut this.roleToDelete) role)}}
-                />
+                >Delete</dd.Interactive>
               {{/if}}
             </Hds::Dropdown>
           {{/if}}
diff --git a/ui/lib/kubernetes/addon/components/page/roles.js b/ui/lib/kubernetes/addon/components/page/roles.js
index 78eeda01a47..76c181b824e 100644
--- a/ui/lib/kubernetes/addon/components/page/roles.js
+++ b/ui/lib/kubernetes/addon/components/page/roles.js
@@ -1,38 +1,72 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 import errorMessage from 'vault/utils/error-message';
 import { tracked } from '@glimmer/tracking';
+import keys from 'core/utils/keys';
 
 /**
  * @module Roles
- * RolesPage component is a child component to show list of roles
+ * RolesPage component is a child component to show list of roles.
+ * It also handles the filtering actions of roles.
  *
  * @param {array} roles - array of roles
  * @param {boolean} promptConfig - whether or not to display config cta
- * @param {array} pageFilter - array of filtered roles
+ * @param {string} filterValue - value of queryParam pageFilter
  * @param {array} breadcrumbs - breadcrumbs as an array of objects that contain label and route
  */
 export default class RolesPageComponent extends Component {
   @service flashMessages;
+  @service('app-router') router;
+  @tracked query;
   @tracked roleToDelete = null;
 
+  constructor() {
+    super(...arguments);
+    this.query = this.args.filterValue;
+  }
+
   get mountPoint() {
     return getOwner(this).mountPoint;
   }
 
+  navigate(pageFilter) {
+    const route = `${this.mountPoint}.roles.index`;
+    const args = [route, { queryParams: { pageFilter: pageFilter || null } }];
+    this.router.transitionTo(...args);
+  }
+
+  @action
+  handleKeyDown(event) {
+    const isEscKeyPressed = keys.ESC.includes(event.key);
+    if (isEscKeyPressed) {
+      // On escape, transition to roles index route.
+      this.navigate();
+    }
+    // ignore all other key events
+  }
+
+  @action handleInput(evt) {
+    this.query = evt.target.value;
+  }
+
+  @action
+  handleSearch(evt) {
+    evt.preventDefault();
+    this.navigate(this.query);
+  }
+
   @action
   async onDelete(model) {
     try {
       const message = `Successfully deleted role ${model.name}`;
       await model.destroyRecord();
-      this.args.roles.removeObject(model);
       this.flashMessages.success(message);
     } catch (error) {
       const message = errorMessage(error, 'Error deleting role. Please try again or contact support');
diff --git a/ui/lib/kubernetes/addon/components/tab-page-header.hbs b/ui/lib/kubernetes/addon/components/tab-page-header.hbs
index 6b6fc74a31a..5debc44b2c5 100644
--- a/ui/lib/kubernetes/addon/components/tab-page-header.hbs
+++ b/ui/lib/kubernetes/addon/components/tab-page-header.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -28,10 +28,12 @@
 <Toolbar aria-label="items for managing kubernetes items">
   {{#if @filterRoles}}
     <ToolbarFilters>
-      <NavigateInput
-        @filter={{@rolesFilterValue}}
+      <FilterInputExplicit
+        @query={{@query}}
         @placeholder="Filter roles"
-        @urls={{hash list="vault.cluster.secrets.backend.kubernetes.roles"}}
+        @handleSearch={{@handleSearch}}
+        @handleInput={{@handleInput}}
+        @handleKeyDown={{@handleKeyDown}}
       />
     </ToolbarFilters>
   {{/if}}
diff --git a/ui/lib/kubernetes/addon/controllers/roles/index.js b/ui/lib/kubernetes/addon/controllers/roles/index.js
index 740c04e2e39..5b30232dab8 100644
--- a/ui/lib/kubernetes/addon/controllers/roles/index.js
+++ b/ui/lib/kubernetes/addon/controllers/roles/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kubernetes/addon/engine.js b/ui/lib/kubernetes/addon/engine.js
index c033628b125..6e2552e0225 100644
--- a/ui/lib/kubernetes/addon/engine.js
+++ b/ui/lib/kubernetes/addon/engine.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,7 +16,7 @@ export default class KubernetesEngine extends Engine {
   modulePrefix = modulePrefix;
   Resolver = Resolver;
   dependencies = {
-    services: ['router', 'store', 'secret-mount-path', 'flash-messages'],
+    services: ['app-router', 'store', 'secret-mount-path', 'flash-messages'],
     externalRoutes: ['secrets'],
   };
 }
diff --git a/ui/lib/kubernetes/addon/routes.js b/ui/lib/kubernetes/addon/routes.js
index bb85403caa7..9f93323b89a 100644
--- a/ui/lib/kubernetes/addon/routes.js
+++ b/ui/lib/kubernetes/addon/routes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kubernetes/addon/routes/configuration.js b/ui/lib/kubernetes/addon/routes/configuration.js
index f9dc61ae59c..b3612c9627a 100644
--- a/ui/lib/kubernetes/addon/routes/configuration.js
+++ b/ui/lib/kubernetes/addon/routes/configuration.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -27,8 +27,9 @@ export default class KubernetesConfigureRoute extends Route {
     super.setupController(controller, resolvedModel);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend.id },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend.id, route: 'overview', model: resolvedModel.backend },
+      { label: 'Configuration' },
     ];
   }
 }
diff --git a/ui/lib/kubernetes/addon/routes/configure.js b/ui/lib/kubernetes/addon/routes/configure.js
index 1cdf783442a..eaa5ec7a609 100644
--- a/ui/lib/kubernetes/addon/routes/configure.js
+++ b/ui/lib/kubernetes/addon/routes/configure.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -21,9 +21,9 @@ export default class KubernetesConfigureRoute extends Route {
     super.setupController(controller, resolvedModel);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend, route: 'overview' },
-      { label: 'configure' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'overview', model: resolvedModel.backend },
+      { label: 'Configure' },
     ];
   }
 }
diff --git a/ui/lib/kubernetes/addon/routes/error.js b/ui/lib/kubernetes/addon/routes/error.js
index 4fd847d742e..f91a9415095 100644
--- a/ui/lib/kubernetes/addon/routes/error.js
+++ b/ui/lib/kubernetes/addon/routes/error.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,7 +12,7 @@ export default class KubernetesErrorRoute extends Route {
   setupController(controller) {
     super.setupController(...arguments);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: this.secretMountPath.currentPath, route: 'overview' },
     ];
     controller.backend = this.modelFor('application');
diff --git a/ui/lib/kubernetes/addon/routes/index.js b/ui/lib/kubernetes/addon/routes/index.js
index 75aebf2744c..43634d01615 100644
--- a/ui/lib/kubernetes/addon/routes/index.js
+++ b/ui/lib/kubernetes/addon/routes/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,7 @@ import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
 export default class KubernetesRoute extends Route {
-  @service router;
+  @service('app-router') router;
 
   redirect() {
     this.router.transitionTo('vault.cluster.secrets.backend.kubernetes.overview');
diff --git a/ui/lib/kubernetes/addon/routes/overview.js b/ui/lib/kubernetes/addon/routes/overview.js
index 996f2e6c5a9..bca866b6436 100644
--- a/ui/lib/kubernetes/addon/routes/overview.js
+++ b/ui/lib/kubernetes/addon/routes/overview.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -26,7 +26,7 @@ export default class KubernetesOverviewRoute extends Route {
     super.setupController(controller, resolvedModel);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: resolvedModel.backend.id },
     ];
   }
diff --git a/ui/lib/kubernetes/addon/routes/roles/create.js b/ui/lib/kubernetes/addon/routes/roles/create.js
index 43d742bbd91..f6164b0858c 100644
--- a/ui/lib/kubernetes/addon/routes/roles/create.js
+++ b/ui/lib/kubernetes/addon/routes/roles/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -20,8 +20,8 @@ export default class KubernetesRolesCreateRoute extends Route {
 
     controller.breadcrumbs = [
       { label: resolvedModel.backend, route: 'overview' },
-      { label: 'roles', route: 'roles' },
-      { label: 'create' },
+      { label: 'Roles', route: 'roles', model: resolvedModel.backend },
+      { label: 'Create' },
     ];
   }
 }
diff --git a/ui/lib/kubernetes/addon/routes/roles/index.js b/ui/lib/kubernetes/addon/routes/roles/index.js
index 545dfd62632..7dbbc738fed 100644
--- a/ui/lib/kubernetes/addon/routes/roles/index.js
+++ b/ui/lib/kubernetes/addon/routes/roles/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -40,8 +40,9 @@ export default class KubernetesRolesRoute extends Route {
     super.setupController(controller, resolvedModel);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend.id },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend.id, route: 'overview', model: resolvedModel.backend },
+      { label: 'Roles' },
     ];
   }
 }
diff --git a/ui/lib/kubernetes/addon/routes/roles/role/credentials.js b/ui/lib/kubernetes/addon/routes/roles/role/credentials.js
index 6167f62aa7b..4eb7a27aefd 100644
--- a/ui/lib/kubernetes/addon/routes/roles/role/credentials.js
+++ b/ui/lib/kubernetes/addon/routes/roles/role/credentials.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -20,9 +20,9 @@ export default class KubernetesRoleCredentialsRoute extends Route {
 
     controller.breadcrumbs = [
       { label: resolvedModel.backend, route: 'overview' },
-      { label: 'roles', route: 'roles' },
+      { label: 'Roles', route: 'roles', model: resolvedModel.backend },
       { label: resolvedModel.roleName, route: 'roles.role.details' },
-      { label: 'credentials' },
+      { label: 'Credentials' },
     ];
   }
 }
diff --git a/ui/lib/kubernetes/addon/routes/roles/role/details.js b/ui/lib/kubernetes/addon/routes/roles/role/details.js
index aafa8cdcbb3..ad8acf6e0ae 100644
--- a/ui/lib/kubernetes/addon/routes/roles/role/details.js
+++ b/ui/lib/kubernetes/addon/routes/roles/role/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -21,7 +21,7 @@ export default class KubernetesRoleDetailsRoute extends Route {
 
     controller.breadcrumbs = [
       { label: resolvedModel.backend, route: 'overview' },
-      { label: 'roles', route: 'roles' },
+      { label: 'Roles', route: 'roles', model: resolvedModel.backend },
       { label: resolvedModel.name },
     ];
   }
diff --git a/ui/lib/kubernetes/addon/routes/roles/role/edit.js b/ui/lib/kubernetes/addon/routes/roles/role/edit.js
index 68dd3f070f3..6ba4d48ec09 100644
--- a/ui/lib/kubernetes/addon/routes/roles/role/edit.js
+++ b/ui/lib/kubernetes/addon/routes/roles/role/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -21,9 +21,9 @@ export default class KubernetesRoleEditRoute extends Route {
 
     controller.breadcrumbs = [
       { label: resolvedModel.backend, route: 'overview' },
-      { label: 'roles', route: 'roles' },
+      { label: 'Roles', route: 'roles', model: resolvedModel.backend },
       { label: resolvedModel.name, route: 'roles.role' },
-      { label: 'edit' },
+      { label: 'Edit' },
     ];
   }
 }
diff --git a/ui/lib/kubernetes/addon/routes/roles/role/index.js b/ui/lib/kubernetes/addon/routes/roles/role/index.js
index 1be0ddd62f1..108b808cbbe 100644
--- a/ui/lib/kubernetes/addon/routes/roles/role/index.js
+++ b/ui/lib/kubernetes/addon/routes/roles/role/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,7 @@ import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
 export default class KubernetesRoleRoute extends Route {
-  @service router;
+  @service('app-router') router;
 
   redirect() {
     this.router.transitionTo('vault.cluster.secrets.backend.kubernetes.roles.role.details');
diff --git a/ui/lib/kubernetes/addon/templates/configuration.hbs b/ui/lib/kubernetes/addon/templates/configuration.hbs
index 7bf9decef65..c1e927c12d6 100644
--- a/ui/lib/kubernetes/addon/templates/configuration.hbs
+++ b/ui/lib/kubernetes/addon/templates/configuration.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Configuration @config={{this.model.config}} @backend={{this.model.backend}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/kubernetes/addon/templates/configure.hbs b/ui/lib/kubernetes/addon/templates/configure.hbs
index eba4ea7cb7d..3fb10e43dfe 100644
--- a/ui/lib/kubernetes/addon/templates/configure.hbs
+++ b/ui/lib/kubernetes/addon/templates/configure.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Configure @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/kubernetes/addon/templates/error.hbs b/ui/lib/kubernetes/addon/templates/error.hbs
index 8fbd70d53e3..6f3f16cd780 100644
--- a/ui/lib/kubernetes/addon/templates/error.hbs
+++ b/ui/lib/kubernetes/addon/templates/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <TabPageHeader @model={{this.backend}} @breadcrumbs={{this.breadcrumbs}} />
 
diff --git a/ui/lib/kubernetes/addon/templates/overview.hbs b/ui/lib/kubernetes/addon/templates/overview.hbs
index 35702d4dead..32a186207b0 100644
--- a/ui/lib/kubernetes/addon/templates/overview.hbs
+++ b/ui/lib/kubernetes/addon/templates/overview.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Overview
   @promptConfig={{this.model.promptConfig}}
diff --git a/ui/lib/kubernetes/addon/templates/roles/create.hbs b/ui/lib/kubernetes/addon/templates/roles/create.hbs
index 89b28b1d803..dad9d524570 100644
--- a/ui/lib/kubernetes/addon/templates/roles/create.hbs
+++ b/ui/lib/kubernetes/addon/templates/roles/create.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Role::CreateAndEdit @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/kubernetes/addon/templates/roles/index.hbs b/ui/lib/kubernetes/addon/templates/roles/index.hbs
index 6447bd42fad..ccfca18d37e 100644
--- a/ui/lib/kubernetes/addon/templates/roles/index.hbs
+++ b/ui/lib/kubernetes/addon/templates/roles/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Roles
   @roles={{this.model.roles}}
diff --git a/ui/lib/kubernetes/addon/templates/roles/role/credentials.hbs b/ui/lib/kubernetes/addon/templates/roles/role/credentials.hbs
index 93be3e8bf2b..323f374d28d 100644
--- a/ui/lib/kubernetes/addon/templates/roles/role/credentials.hbs
+++ b/ui/lib/kubernetes/addon/templates/roles/role/credentials.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Credentials @roleName={{this.model.roleName}} @backend={{this.model.backend}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/kubernetes/addon/templates/roles/role/details.hbs b/ui/lib/kubernetes/addon/templates/roles/role/details.hbs
index e58572a6c33..5ae72f2cd64 100644
--- a/ui/lib/kubernetes/addon/templates/roles/role/details.hbs
+++ b/ui/lib/kubernetes/addon/templates/roles/role/details.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Role::Details @model={{@model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/kubernetes/addon/templates/roles/role/edit.hbs b/ui/lib/kubernetes/addon/templates/roles/role/edit.hbs
index 89b28b1d803..dad9d524570 100644
--- a/ui/lib/kubernetes/addon/templates/roles/role/edit.hbs
+++ b/ui/lib/kubernetes/addon/templates/roles/role/edit.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Role::CreateAndEdit @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/kubernetes/addon/utils/generated-role-rules.js b/ui/lib/kubernetes/addon/utils/generated-role-rules.js
index f9976e064ef..ffd6d21401f 100644
--- a/ui/lib/kubernetes/addon/utils/generated-role-rules.js
+++ b/ui/lib/kubernetes/addon/utils/generated-role-rules.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kubernetes/config/environment.js b/ui/lib/kubernetes/config/environment.js
index 1ab288416d0..e565823fbf6 100644
--- a/ui/lib/kubernetes/config/environment.js
+++ b/ui/lib/kubernetes/config/environment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kubernetes/index.js b/ui/lib/kubernetes/index.js
index e4f1e3ebc05..70cb5fdf1c8 100644
--- a/ui/lib/kubernetes/index.js
+++ b/ui/lib/kubernetes/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,6 +14,9 @@ module.exports = buildEngine({
   lazyLoading: {
     enabled: false,
   },
+  babel: {
+    plugins: [require.resolve('ember-concurrency/async-arrow-task-transform')],
+  },
   isDevelopingAddon() {
     return true;
   },
diff --git a/ui/lib/kubernetes/package.json b/ui/lib/kubernetes/package.json
index e6204e9a6b4..b5f6027eb5b 100644
--- a/ui/lib/kubernetes/package.json
+++ b/ui/lib/kubernetes/package.json
@@ -10,7 +10,8 @@
     "ember-concurrency": "*",
     "@ember/test-waiters": "*",
     "ember-inflector": "*",
-    "@hashicorp/design-system-components": "*"
+    "@hashicorp/design-system-components": "*",
+    "ember-auto-import": "*"
   },
   "ember-addon": {
     "paths": [
diff --git a/ui/lib/kv/addon/components/kv-create-edit-form.hbs b/ui/lib/kv/addon/components/kv-create-edit-form.hbs
new file mode 100644
index 00000000000..fc3fc7ecb72
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-create-edit-form.hbs
@@ -0,0 +1,83 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+<form {{on "submit" (perform this.save)}}>
+  <div class="box is-sideless is-fullwidth is-bottomless">
+    <NamespaceReminder @mode="create" @noun="secret" />
+    <MessageError @errorMessage={{this.errorMessage}} />
+
+    {{#each @form.secretFields as |field|}}
+      {{! path is readonly when editing a secret }}
+      {{#if (and (not @form.isNew) (eq field.name "path"))}}
+        <ReadonlyFormField @attr={{field}} @value={{@form.data.path}} />
+      {{else}}
+        <FormField
+          @attr={{field}}
+          @model={{@form}}
+          @modelValidations={{this.modelValidations}}
+          @onKeyUp={{this.pathValidations}}
+        />
+      {{/if}}
+    {{/each}}
+
+    <hr class="is-marginless has-background-gray-200" />
+    {{#if @showJson}}
+      <JsonEditor
+        @title="{{if @form.isNew 'Secret' 'Version'}} data"
+        @value={{stringified-secret-data @form.data.secretData}}
+        @valueUpdated={{this.onJsonChange}}
+      />
+      {{#if (or this.modelValidations.secretData.errors this.lintingErrors)}}
+        <AlertInline
+          @color={{if this.lintingErrors "warning" "critical"}}
+          class="has-top-padding-s"
+          @message={{or
+            this.modelValidations.secretData.errors
+            "JSON is unparsable. Fix linting errors to avoid data discrepancies."
+          }}
+        />
+      {{/if}}
+    {{else}}
+      <KvObjectEditor
+        class="has-top-margin-m"
+        @label="{{if @form.isNew 'Secret' 'Version'}} data"
+        @value={{@form.data.secretData}}
+        @onChange={{this.onKvObjectChange}}
+        @isMasked={{true}}
+        @warnNonStringValues={{true}}
+      />
+    {{/if}}
+
+    {{! edit page renders version diff and create page renders metadata form }}
+    {{yield this.modelValidations}}
+  </div>
+
+  <div class="box is-fullwidth is-bottomless">
+    <div class="control">
+      <Hds::Button
+        @text="Save"
+        @icon={{if this.save.isRunning "loading"}}
+        type="submit"
+        disabled={{this.save.isRunning}}
+        data-test-kv-save
+      />
+      <Hds::Button
+        @text="Cancel"
+        @color="secondary"
+        class="has-left-margin-s"
+        disabled={{this.save.isRunning}}
+        {{on "click" this.onCancel}}
+        data-test-kv-cancel
+      />
+    </div>
+    {{#if this.invalidFormAlert}}
+      <AlertInline
+        data-test-invalid-form-alert
+        class="has-top-padding-s"
+        @type="danger"
+        @message={{this.invalidFormAlert}}
+      />
+    {{/if}}
+  </div>
+</form>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-create-edit-form.js b/ui/lib/kv/addon/components/kv-create-edit-form.js
new file mode 100644
index 00000000000..de685ec6fef
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-create-edit-form.js
@@ -0,0 +1,144 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import { task } from 'ember-concurrency';
+import { pathIsFromDirectory } from 'kv/utils/kv-breadcrumbs';
+import { waitFor } from '@ember/test-waiters';
+
+/**
+ * @module KvCreateEditForm is used for creating and editing kv secret data and metadata, it hides/shows a json editor and renders validation errors for the json editor
+ *
+ * <KvCreateEditForm
+ *  @form={{@form}}
+ *  @path={{@path}}
+ *  @backend={{@backend}}
+ *  @showJson={{true}}
+ *  @onChange={{@onChange}}
+ * />
+ *
+ * @param {Form} form - kv form
+ * @param {string} path - secret path
+ * @param {string} backend - secret mount path
+ * @param {boolean} showJson - boolean passed from parent to hide/show json editor
+ * @param {function} onSecretDataChange - function passed from parent to handle secret data change side effects
+ */
+
+export default class KvCreateEditForm extends Component {
+  @service api;
+  @service controlGroup;
+  @service flashMessages;
+  @service('app-router') router;
+
+  @tracked lintingErrors;
+  @tracked modelValidations;
+  @tracked invalidFormAlert;
+  @tracked errorMessage;
+
+  @action
+  onJsonChange(value) {
+    try {
+      const json = JSON.parse(value);
+      this.args.form.data.secretData = json;
+      this.lintingErrors = false;
+      this.args.onChange?.(json);
+    } catch {
+      this.lintingErrors = true;
+    }
+  }
+
+  @action
+  onKvObjectChange(value) {
+    this.args.form.data.secretData = value;
+    this.args.onChange?.(value);
+  }
+
+  @action
+  pathValidations() {
+    // check path attribute warnings on key up for new secrets
+    const { state } = this.args.form.toJSON();
+    if (state?.path?.warnings) {
+      // only set model validations if warnings exist
+      this.modelValidations = state;
+    }
+  }
+
+  @action
+  onCancel() {
+    const { form, path } = this.args;
+    if (form.isNew) {
+      pathIsFromDirectory(path)
+        ? this.router.transitionTo('vault.cluster.secrets.backend.kv.list-directory', path)
+        : this.router.transitionTo('vault.cluster.secrets.backend.kv.list');
+    } else {
+      this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.index');
+    }
+  }
+
+  hasMetadata(metadata) {
+    try {
+      const { custom_metadata = {}, max_versions, cas_required, delete_version_after = '0s' } = metadata;
+      return (
+        Object.keys(custom_metadata).length || max_versions || cas_required || delete_version_after !== '0s'
+      );
+    } catch (e) {
+      return false;
+    }
+  }
+
+  save = task(
+    waitFor(async (event) => {
+      event.preventDefault();
+
+      const { isValid, state, invalidFormMessage, data } = this.args.form.toJSON();
+      this.modelValidations = isValid ? null : state;
+      this.invalidFormAlert = invalidFormMessage;
+      this.errorMessage = null;
+
+      if (isValid) {
+        const { path, secretData, options, ...metadata } = data;
+        try {
+          // try saving secret data first
+          const payload = options ? { data: secretData, options } : { data: secretData };
+          await this.api.secrets.kvV2Write(path, this.args.backend, payload);
+          this.flashMessages.success(`Successfully saved secret data for: ${path}.`);
+
+          // users must have permission to create secret data to create metadata in the UI
+          // only attempt to save metadata if secret data saves successfully and metadata is added
+          if (this.hasMetadata(metadata)) {
+            try {
+              await this.api.secrets.kvV2WriteMetadata(path, this.args.backend, metadata);
+              this.flashMessages.success(`Successfully saved metadata.`);
+            } catch (error) {
+              const { message } = await this.api.parseError(error);
+              this.flashMessages.danger(`Secret data was saved but metadata was not: ${message}`, {
+                sticky: true,
+              });
+            }
+          }
+        } catch (error) {
+          const { message, response } = await this.api.parseError(error);
+          if (response.isControlGroupError) {
+            this.controlGroup.saveTokenFromError(response);
+            const err = this.controlGroup.logFromError(response);
+            this.errorMessage = err.content;
+          } else {
+            this.errorMessage = message;
+          }
+        }
+
+        // prevent transition if there are errors with secret data
+        if (this.errorMessage) {
+          this.invalidFormAlert = 'There was an error submitting this form.';
+        } else {
+          this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.index', path);
+        }
+      }
+    })
+  );
+}
diff --git a/ui/lib/kv/addon/components/kv-data-fields.hbs b/ui/lib/kv/addon/components/kv-data-fields.hbs
deleted file mode 100644
index c38749f679b..00000000000
--- a/ui/lib/kv/addon/components/kv-data-fields.hbs
+++ /dev/null
@@ -1,51 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#let (find-by "name" "path" @secret.allFields) as |attr|}}
-  {{#if (eq @type "edit")}}
-    <ReadonlyFormField @attr={{attr}} @value={{get @secret attr.name}} />
-  {{else if (eq @type "create")}}
-    <FormField @attr={{attr}} @model={{@secret}} @modelValidations={{@modelValidations}} @onKeyUp={{@pathValidations}} />
-  {{/if}}
-{{/let}}
-
-<hr class="is-marginless has-background-gray-200" />
-{{#if @showJson}}
-  <JsonEditor
-    @title="{{if (eq @type 'create') 'Secret' 'Version'}} data"
-    @value={{this.stringifiedSecretData}}
-    @allowObscure={{true}}
-    @valueUpdated={{this.handleJson}}
-    @readOnly={{eq @type "details"}}
-  />
-  {{#if (or @modelValidations.secretData.errors this.lintingErrors)}}
-    <AlertInline
-      @color={{if this.lintingErrors "warning" "critical"}}
-      class="has-top-padding-s"
-      @message={{if
-        @modelValidations.secretData.errors
-        @modelValidations.secretData.errors
-        "JSON is unparsable. Fix linting errors to avoid data discrepancies."
-      }}
-    />
-  {{/if}}
-{{else if (eq @type "details")}}
-  {{#each-in @secret.secretData as |key value|}}
-    <InfoTableRow @label={{key}} @value={{value}} @alwaysRender={{true}}>
-      <MaskedInput @name={{key}} @value={{value}} @displayOnly={{true}} @allowCopy={{true}} @allowDownload={{true}} />
-    </InfoTableRow>
-  {{else}}
-    <InfoTableRow @label="" @value="" @alwaysRender={{true}} />
-  {{/each-in}}
-{{else}}
-  <KvObjectEditor
-    class="has-top-margin-m"
-    @label="{{if (eq @type 'create') 'Secret' 'Version'}} data"
-    @value={{@secret.secretData}}
-    @onChange={{fn (mut @secret.secretData)}}
-    @isMasked={{true}}
-    @warnNonStringValues={{true}}
-  />
-{{/if}}
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-data-fields.js b/ui/lib/kv/addon/components/kv-data-fields.js
deleted file mode 100644
index 4ffd7ab574d..00000000000
--- a/ui/lib/kv/addon/components/kv-data-fields.js
+++ /dev/null
@@ -1,44 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { action } from '@ember/object';
-import { tracked } from '@glimmer/tracking';
-import { stringify } from 'core/helpers/stringify';
-
-/**
- * @module KvDataFields is used for rendering the fields associated with kv secret data, it hides/shows a json editor and renders validation errors for the json editor
- *
- * <KvDataFields
- *  @showJson={{true}}
- *  @secret={{@secret}}
- *  @type="edit"
- *  @modelValidations={{this.modelValidations}}
- *  @pathValidations={{this.pathValidations}}
- * />
- *
- * @param {model} secret - Ember data model: 'kv/data', the new record saved by the form
- * @param {boolean} showJson - boolean passed from parent to hide/show json editor
- * @param {object} [modelValidations] - object of errors.  If attr.name is in object and has error message display in AlertInline.
- * @param {callback} [pathValidations] - callback function fired for the path input on key up
- * @param {boolean} [type=null] - can be edit, create, or details. Used to change text for some form labels
- */
-
-export default class KvDataFields extends Component {
-  @tracked lintingErrors;
-
-  get stringifiedSecretData() {
-    return this.args.secret?.secretData ? stringify([this.args.secret.secretData], {}) : '{ "": "" }';
-  }
-
-  @action
-  handleJson(value, codemirror) {
-    codemirror.performLint();
-    this.lintingErrors = codemirror.state.lint.marked.length > 0;
-    if (!this.lintingErrors) {
-      this.args.secret.secretData = JSON.parse(value);
-    }
-  }
-}
diff --git a/ui/lib/kv/addon/components/kv-delete-modal.hbs b/ui/lib/kv/addon/components/kv-delete-modal.hbs
index 1bef8565dcf..b729a89c040 100644
--- a/ui/lib/kv/addon/components/kv-delete-modal.hbs
+++ b/ui/lib/kv/addon/components/kv-delete-modal.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Button
   @text={{or @text (capitalize @mode)}}
@@ -29,31 +29,26 @@
       {{#if (eq @mode "delete")}}
         <div class="is-flex-column">
           {{#each this.deleteOptions as |option|}}
-            <ToolTip @verticalPosition="above" @horizontalPosition="left" as |T|>
-              <T.Trigger @tabindex="-1">
-                <div class="is-flex-align-baseline has-bottom-margin-m">
-                  <RadioButton
-                    id={{option.key}}
-                    class="radio top-xxs"
-                    @disabled={{option.disabled}}
-                    @value={{option.key}}
-                    @groupValue={{this.deleteType}}
-                    @onChange={{fn (mut this.deleteType) option.key}}
-                  />
-                  <label for={{option.key}} class="has-left-margin-s {{if option.disabled 'opacity-060'}}">
-                    <p class="has-text-weight-semibold">{{option.label}}</p>
-                    <p>{{option.description}}</p>
-                  </label>
-                </div>
-              </T.Trigger>
-              {{#if option.disabled}}
-                <T.Content @defaultClass="tool-tip">
-                  <div class="box">
-                    {{option.tooltipMessage}}
-                  </div>
-                </T.Content>
-              {{/if}}
-            </ToolTip>
+            <div class="is-flex-align-baseline has-bottom-margin-m">
+              <RadioButton
+                id={{option.key}}
+                class="radio top-xxs"
+                @disabled={{option.disabled}}
+                @value={{option.key}}
+                @groupValue={{this.deleteType}}
+                @onChange={{fn (mut this.deleteType) option.key}}
+              />
+              <label
+                for={{option.key}}
+                class="has-left-margin-s {{if option.disabled 'opacity-060'}}"
+                {{! these extra parentheses are necessary to conditionally apply the modifier }}
+                {{! TODO: refactor this component and avoid this conditional modifier pattern }}
+                {{(if option.disabled (modifier "hds-tooltip" option.tooltipMessage))}}
+              >
+                <p class="has-text-weight-semibold">{{option.label}}</p>
+                <p>{{option.description}}</p>
+              </label>
+            </div>
           {{/each}}
         </div>
       {{/if}}
diff --git a/ui/lib/kv/addon/components/kv-delete-modal.js b/ui/lib/kv/addon/components/kv-delete-modal.js
index f1ed665fde3..6e533e662d5 100644
--- a/ui/lib/kv/addon/components/kv-delete-modal.js
+++ b/ui/lib/kv/addon/components/kv-delete-modal.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,7 @@ import Component from '@glimmer/component';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
 import { assert } from '@ember/debug';
+import currentSecret from 'kv/helpers/current-secret';
 
 /**
  * @module KvDeleteModal displays a button for a delete type and launches a modal. Undelete is the only mode that does not launch the modal and is not handled in this component.
@@ -15,13 +16,15 @@ import { assert } from '@ember/debug';
  *  @mode="destroy"
  *  @secret={{this.model.secret}}
  *  @metadata={{this.model.metadata}}
+ *  @capabilities={{this.model.capabilities}}
  *  @onDelete={{this.handleDestruction}}
  * />
  *
  * @param {string} mode - delete, delete-metadata, or destroy.
- * @param {object} secret - The kv/data model.
- * @param {object} [metadata] - The kv/metadata model. It is only required when mode is "delete" or "metadata-delete".
+ * @param {object} secret - secret data.
+ * @param {object} [metadata] - secret metadata. It is only required when mode is "delete".
  * @param {string} [text] - Button text that renders in KV v2 toolbar, defaults to capitalize @mode
+ * @param {object} capabilities - capabilities for data, metadata, subkeys, delete and undelete paths
  * @param {callback} onDelete - callback function fired to handle delete event.
  */
 
@@ -57,24 +60,29 @@ export default class KvDeleteModal extends Component {
     }
   }
 
+  get currentSecret() {
+    return currentSecret(this.args.metadata);
+  }
+
   get deleteOptions() {
-    const { secret, metadata, version } = this.args;
-    const isDeactivated = secret.canReadMetadata ? metadata?.currentSecret?.isDeactivated : false;
+    const { capabilities, secret, version } = this.args;
+    const { canDeleteVersion, canDeleteLatestVersion } = capabilities;
+    const isDeactivated = this.currentSecret?.isDeactivated || false;
     return [
       {
         key: 'delete-version',
         label: 'Delete this version',
         description: `This deletes ${version ? `Version ${version}` : `a specific version`} of the secret.`,
-        disabled: !secret.canDeleteVersion,
+        disabled: !canDeleteVersion,
         tooltipMessage: `Deleting a specific version requires "update" capabilities to ${secret.backend}/delete/${secret.path}.`,
       },
       {
         key: 'delete-latest-version',
         label: 'Delete latest version',
         description: 'This deletes the most recent version of the secret.',
-        disabled: !secret.canDeleteLatestVersion || isDeactivated,
+        disabled: !canDeleteLatestVersion || isDeactivated,
         tooltipMessage: isDeactivated
-          ? `The latest version of the secret is already ${metadata.currentSecret.state}.`
+          ? `The latest version of the secret is already ${this.currentSecret.state}.`
           : `Deleting the latest version of this secret requires "delete" capabilities to ${secret.backend}/data/${secret.path}.`,
       },
     ];
diff --git a/ui/lib/kv/addon/components/kv-list-filter.hbs b/ui/lib/kv/addon/components/kv-list-filter.hbs
index d870c0f706d..2220c414f39 100644
--- a/ui/lib/kv/addon/components/kv-list-filter.hbs
+++ b/ui/lib/kv/addon/components/kv-list-filter.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form {{on "submit" (perform this.handleSearch)}}>
   <Hds::SegmentedGroup as |S|>
diff --git a/ui/lib/kv/addon/components/kv-list-filter.js b/ui/lib/kv/addon/components/kv-list-filter.js
index 1cc9c0cfac3..caa17ddd795 100644
--- a/ui/lib/kv/addon/components/kv-list-filter.js
+++ b/ui/lib/kv/addon/components/kv-list-filter.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,7 @@ import Ember from 'ember';
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
-import keys from 'core/utils/key-codes';
+import keys from 'core/utils/keys';
 import { keyIsFolder, parentKeyForKey, keyWithoutParentKey } from 'core/utils/key-utils';
 import { tracked } from '@glimmer/tracking';
 import { task, timeout } from 'ember-concurrency';
@@ -21,17 +21,15 @@ import { task, timeout } from 'ember-concurrency';
  * route will reload the model and completely refresh the page.
  *  *
  * <KvListFilter
- *  @secrets={{this.model.secrets}}
  *  @mountPoint={{this.model.mountPoint}}
  *  @filterValue="beep/my-"
  * />
- * @param {array} secrets - An array of secret models.
  * @param {string} mountPoint - Where in the router files we're located. For this component it will always be vault.cluster.secrets.backend.kv
  * @param {string} filterValue - Full initial search value. A concatenation between the list-directory's dynamic path "path-to-secret" and the queryParam "pageFilter". For example, if we're inside the beep/ directory searching for any secret that starts with "my-" this value will equal "beep/my-".
  */
 
 export default class KvListFilterComponent extends Component {
-  @service router;
+  @service('app-router') router;
   @tracked query;
 
   constructor() {
@@ -55,7 +53,8 @@ export default class KvListFilterComponent extends Component {
 
   @action
   handleKeyDown(event) {
-    if (event.keyCode === keys.ESC) {
+    const isEscKeyPressed = keys.ESC.includes(event.key);
+    if (isEscKeyPressed) {
       // On escape, transition to the nearest parentDirectory.
       // If no parentDirectory, then to the list route.
       const input = event.target.value;
diff --git a/ui/lib/kv/addon/components/kv-metadata-fields.hbs b/ui/lib/kv/addon/components/kv-metadata-fields.hbs
index 391b32904c6..25347aa8c8f 100644
--- a/ui/lib/kv/addon/components/kv-metadata-fields.hbs
+++ b/ui/lib/kv/addon/components/kv-metadata-fields.hbs
@@ -1,15 +1,13 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-{{#each @metadata.formFields as |attr|}}
-  {{#if (eq attr.name "customMetadata")}}
-    <FormField @attr={{attr}} @model={{@metadata}} @modelValidations={{@modelValidations}} />
+{{#each @form.metadataFields as |field|}}
+  <FormField @attr={{field}} @model={{@form}} @modelValidations={{@modelValidations}} />
+  {{#if (eq field.name "custom_metadata")}}
     <label class="title has-top-padding-m is-4">
       Additional options
     </label>
-  {{else}}
-    <FormField @attr={{attr}} @model={{@metadata}} @modelValidations={{@modelValidations}} />
   {{/if}}
 {{/each}}
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-page-header.hbs b/ui/lib/kv/addon/components/kv-page-header.hbs
index fc62e70abce..fe4d16fce3e 100644
--- a/ui/lib/kv/addon/components/kv-page-header.hbs
+++ b/ui/lib/kv/addon/components/kv-page-header.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -12,7 +12,10 @@
       {{#if @mountName}}
         <Icon @name="key-values" @size="24" class="has-text-grey-light" />
         {{@mountName}}
-        <span class="tag">version 2</span>
+        <Hds::Badge @text="version 2" />
+      {{else if @secretPath}}
+        {{@secretPath}}
+        <Hds::Copy::Button @isIconOnly={{true}} @text="Copy your secret path" @textToCopy={{@secretPath}} />
       {{else}}
         {{@pageTitle}}
       {{/if}}
@@ -35,7 +38,7 @@
 {{/if}}
 
 {{#if (or (has-block "toolbarFilters") (has-block "toolbarActions"))}}
-  <Toolbar aria-label="menu items for managing {{or @mountName @pageTitle}}">
+  <Toolbar aria-label="menu items for managing {{or @mountName @secretPath @pageTitle}}">
     <ToolbarFilters aria-label="filters for secrets list">
       {{yield to="toolbarFilters"}}
     </ToolbarFilters>
diff --git a/ui/lib/kv/addon/components/kv-patch/editor/alerts.hbs b/ui/lib/kv/addon/components/kv-patch/editor/alerts.hbs
new file mode 100644
index 00000000000..d31b8a4562b
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-patch/editor/alerts.hbs
@@ -0,0 +1,22 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{! display only template for rendering alerts for the kv patch editor }}
+
+{{#if @keyError}}
+  <Hds::Alert @type="compact" @color="critical" @icon="alert-diamond-fill" data-test-alert-validation={{@idx}} as |A|>
+    <A.Description>{{@keyError}}</A.Description>
+  </Hds::Alert>
+{{/if}}
+{{#if @keyWarning}}
+  <Hds::Alert @type="compact" @color="warning" @icon="alert-triangle-fill" data-test-alert-key-warning={{@idx}} as |A|>
+    <A.Description>{{@keyWarning}}</A.Description>
+  </Hds::Alert>
+{{/if}}
+{{#if @valueWarning}}
+  <Hds::Alert @type="compact" @color="warning" @icon="alert-triangle-fill" data-test-alert-value-warning={{@idx}} as |A|>
+    <A.Description>{{@valueWarning}}</A.Description>
+  </Hds::Alert>
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-patch/editor/form.hbs b/ui/lib/kv/addon/components/kv-patch/editor/form.hbs
new file mode 100644
index 00000000000..b9531ee628d
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-patch/editor/form.hbs
@@ -0,0 +1,74 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" this.submit}} data-test-kv-patch-editor>
+  <div class="flex column-gap-16 has-top-padding-s">
+    <Hds::Form::Label @controlId="newKey" class="one-fourth-width">
+      Key
+    </Hds::Form::Label>
+    <Hds::Form::Label @controlId="newValue" class="three-fourths-width">
+      Value
+    </Hds::Form::Label>
+  </div>
+
+  {{! Rows for existing keys (includes new rows after user clicks "Add") }}
+  {{#each this.patchData as |kv idx|}}
+    <KvPatch::Editor::Row
+      @idx={{idx}}
+      @kvClass={{kv}}
+      @isOriginalSubkey={{this.isOriginalSubkey}}
+      @updateKey={{this.updateKey}}
+      @undoKey={{this.undoKey}}
+    />
+  {{/each}}
+
+  {{! Single row of empty inputs for adding new key/value pairs }}
+  <div class="flex column-gap-16 has-top-padding-s">
+    <Hds::Form::TextInput::Base
+      @type="text"
+      @value={{this.newKey}}
+      class="one-fourth-width"
+      aria-label="New key"
+      placeholder="key"
+      name="newKey"
+      {{on "blur" this.updateNewKey}}
+      data-test-kv-key="new"
+    />
+
+    <div class="flex column-gap-16 three-fourths-width">
+      <Hds::Form::MaskedInput::Base
+        @value={{this.newValue}}
+        aria-label="New value"
+        name="newValue"
+        {{on "blur" this.updateNewValue}}
+        data-test-kv-value="new"
+      />
+
+      <div class="flex column-gap-16" {{style width="9rem"}}>
+        <Hds::Button @text="Add" @color="secondary" {{on "click" this.addRow}} @isFullWidth={{true}} data-test-add-button />
+      </div>
+    </div>
+  </div>
+
+  <KvPatch::Editor::Alerts
+    @idx="new"
+    @keyError={{this.newKeyError}}
+    @keyWarning={{this.newKeyWarning}}
+    @valueWarning={{this.newValueWarning}}
+  />
+
+  <hr class="has-background-gray-200" />
+  <KvPatch::SubkeysReveal @subkeys={{@subkeys}} />
+  <hr class="has-background-gray-200" />
+
+  <Hds::ButtonSet>
+    <Hds::Button @text="Save" type="submit" @icon={{if @isSaving "loading"}} disabled={{@isSaving}} data-test-kv-save />
+    <Hds::Button @text="Cancel" {{on "click" @onCancel}} @color="secondary" disabled={{@isSaving}} data-test-kv-cancel />
+  </Hds::ButtonSet>
+
+  {{#if (or @submitError this.validationError)}}
+    <AlertInline @type="danger" @message={{or @submitError this.validationError}} class="has-top-padding-s" />
+  {{/if}}
+</form>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-patch/editor/form.js b/ui/lib/kv/addon/components/kv-patch/editor/form.js
new file mode 100644
index 00000000000..0155e94c253
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-patch/editor/form.js
@@ -0,0 +1,199 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import { A } from '@ember/array';
+import {
+  hasWhitespace,
+  isNonString,
+  WHITESPACE_WARNING,
+  NON_STRING_WARNING,
+} from 'vault/utils/forms/validators';
+
+/**
+ * @module KvPatch::Editor::Form
+ * @description
+ * This component renders one of two ways to patch a KV v2 secret (the other is using the JSON editor).
+ * Each top-level subkey returned by the API endpoint renders in a disabled column with an empty (also disabled) value input beside it.
+ * Initially, an edit or delete button is left of the value input. Clicking "Delete" marks a key for deletion (it does not remove the row).
+ * Clicking "Edit" enables the value input (the key input for retrieved subkeys is never editable). Users can then input a new value for that key.
+ * If either button is clicked it is replaced by a "Cancel" button. Canceling empties the value input and returns it to a 'disabled' state
+ *
+ * Additionally, there is one empty row at the bottom for adding new key/value pairs.
+ * Clicking "Add" adds the new key/value pair to the internally tracked state (an array) and creates a new empty row.
+ * Newly added keys are editable and therefore never disabled.
+ * A newly added pair can be undone by clicking "Remove" which deletes the row and removes it from the tracked array.
+ *
+ * Clicking the "Reveal subkeys in JSON" toggle displays the full, nested subkey structure returned by the API.
+ *
+ * @example
+ * <KvPatch::Editor::Form @subkeys={{@subkeys}} @onSubmit={{perform this.save}} @onCancel={{this.onCancel}} @isSaving={{this.save.isRunning}} />
+ *
+ * @param {boolean} isSaving - if true, disables the save and cancel buttons. useful if the onSubmit callback is a concurrency task
+ * @param {function} onCancel - called when form is canceled
+ * @param {function} onSubmit - called when form is saved, called with with the key value object containing patch data
+ * @param {object} subkeys - leaf keys of a kv v2 secret, all values (unless a nested object with more keys) return null. https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#read-secret-subkeys
+ * @param {string} submitError - error message string from parent if submit failed
+ */
+
+export class KeyValueState {
+  @tracked key;
+  @tracked value;
+  @tracked state; // 'enabled', 'disabled' or 'deleted'
+  @tracked keyError;
+
+  constructor({ key, value = undefined, state = 'disabled' }) {
+    this.key = key;
+    this.value = value;
+    this.state = state;
+  }
+
+  get keyWarning() {
+    return hasWhitespace(this.key) ? WHITESPACE_WARNING('this key') : '';
+  }
+
+  get valueWarning() {
+    if (this.value === null) return '';
+    return isNonString(this.value) ? NON_STRING_WARNING : '';
+  }
+
+  reset() {
+    this.value = undefined;
+    this.state = 'disabled';
+  }
+
+  @action
+  updateValue(event) {
+    this.value = event.target.value;
+  }
+
+  @action
+  updateState(state) {
+    this.state = state;
+  }
+}
+
+export default class KvPatchEditorForm extends Component {
+  @tracked patchData; // key value pairs in form
+  @tracked showSubkeys = false;
+  @tracked validationError;
+
+  // tracked variables for new (initially empty) row of inputs.
+  // once a user clicks "Add" a KeyValueState class is instantiated for that row
+  @tracked newKey;
+  @tracked newValue;
+
+  isOriginalSubkey = (key) => Object.keys(this.args.subkeys).includes(key);
+
+  constructor() {
+    super(...arguments);
+    const kvData = Object.keys(this.args.subkeys).map((key) => this.generateData(key));
+    this.patchData = A(kvData);
+    this.resetNewRow();
+  }
+
+  get newKeyWarning() {
+    return hasWhitespace(this.newKey) ? WHITESPACE_WARNING('this key') : '';
+  }
+
+  get newValueWarning() {
+    if (this.newValue === null) return '';
+    return isNonString(this.newValue) ? NON_STRING_WARNING : '';
+  }
+
+  get newKeyError() {
+    return this.validateKey(this.newKey);
+  }
+
+  generateData(key, value, state) {
+    return new KeyValueState({ key, value, state });
+  }
+
+  resetNewRow() {
+    this.newKey = undefined;
+    this.newValue = undefined;
+  }
+
+  validateKey(key) {
+    return this.patchData.any((KV) => KV.key === key)
+      ? `"${key}" key already exists. Update the value of the existing key or rename this one.`
+      : '';
+  }
+
+  @action
+  updateKey(KV, event) {
+    // KV is KeyValueState class
+    const key = event.target.value;
+    // if a user refocuses an input that already has a key
+    // validateKey miscalculates and thinks it's a duplicate
+    if (KV.key === key) return; // so we return if values match
+    const isInvalid = this.validateKey(key);
+    KV.keyError = isInvalid;
+    if (isInvalid) return;
+    // only set if valid, otherwise key matches original
+    // subkey and input state updates to readonly
+    KV.key = key;
+  }
+
+  @action
+  updateNewKey(event) {
+    const key = event.target.value;
+    this.newKey = key;
+  }
+
+  @action
+  updateNewValue(event) {
+    this.newValue = event.target.value;
+  }
+
+  @action
+  addRow() {
+    if (!this.newKey || this.newKeyError) return;
+    const KV = this.generateData(this.newKey, this.newValue, 'enabled');
+    this.patchData.pushObject(KV);
+    // reset tracked values after adding them to patchData
+    this.resetNewRow();
+  }
+
+  @action
+  undoKey(KV) {
+    if (this.isOriginalSubkey(KV.key)) {
+      // reset state to 'disabled' and value to undefined
+      KV.reset();
+    } else {
+      // remove row all together
+      this.patchData.removeObject(KV);
+    }
+  }
+
+  @action
+  submit(event) {
+    event.preventDefault();
+    if (this.newKeyError || this.patchData.any((KV) => KV.keyError)) {
+      this.validationError = 'This form contains validations errors, please resolve those before submitting.';
+      return;
+    }
+
+    // patchData will not include the last row if a user has not clicked "Add"
+    // manually check for data and add it to this.patchData
+    if (this.newKey) {
+      this.addRow();
+    }
+
+    const data = this.patchData.reduce((obj, KV) => {
+      // only include edited inputs
+      const { state } = KV;
+      if (state === 'enabled' || state === 'deleted') {
+        const value = state === 'deleted' ? null : KV.value;
+        obj[KV.key] = value;
+      }
+      return obj;
+    }, {});
+
+    this.args.onSubmit(data);
+  }
+}
diff --git a/ui/lib/kv/addon/components/kv-patch/editor/row.hbs b/ui/lib/kv/addon/components/kv-patch/editor/row.hbs
new file mode 100644
index 00000000000..52dc393762a
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-patch/editor/row.hbs
@@ -0,0 +1,76 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{! display only template for kv data rows to edit, delete or undo patching a key/value }}
+
+{{#let @kvClass.key @kvClass.value @kvClass.state as |key value state|}}
+  <div class="flex column-gap-16 has-top-padding-s">
+    <Hds::Form::TextInput::Base
+      @value={{key}}
+      aria-label="Key {{@idx}}"
+      class="one-fourth-width {{if (eq state 'deleted') 'line-through'}}"
+      {{! Original subkeys are not editable, only their values can be updated }}
+      disabled={{and (eq state "disabled") (@isOriginalSubkey key)}}
+      readonly={{and (not-eq state "disabled") (@isOriginalSubkey key)}}
+      {{on "blur" (fn @updateKey @kvClass)}}
+      data-test-kv-key={{@idx}}
+    />
+
+    <div class="flex column-gap-16 three-fourths-width">
+      <Hds::Form::MaskedInput::Base
+        @value={{value}}
+        aria-label="Value {{@idx}}"
+        disabled={{eq state "disabled"}}
+        readonly={{eq state "deleted"}}
+        {{on "blur" @kvClass.updateValue}}
+        data-test-kv-value={{@idx}}
+      />
+
+      <div class="flex column-gap-16" {{style width="9rem"}}>
+        {{#if (eq state "disabled")}}
+          <Hds::Button
+            @text="Edit"
+            @icon="edit"
+            @color="secondary"
+            @isIconOnly={{true}}
+            @isFullWidth={{true}}
+            {{on "click" (fn @kvClass.updateState "enabled")}}
+            data-test-edit-button={{@idx}}
+          />
+          <Hds::Button
+            @text="Delete"
+            @icon="trash"
+            @color="critical"
+            @isIconOnly={{true}}
+            @isFullWidth={{true}}
+            {{on "click" (fn @kvClass.updateState "deleted")}}
+            data-test-delete-button={{@idx}}
+          />
+        {{else}}
+          <Hds::Button
+            @text={{if (@isOriginalSubkey key) "Cancel" "Remove"}}
+            @color="secondary"
+            @isFullWidth={{true}}
+            {{on "click" (fn @undoKey @kvClass)}}
+            data-test-undo-button={{@idx}}
+          />
+        {{/if}}
+      </div>
+    </div>
+  </div>
+
+  {{#if (eq state "deleted")}}
+    <Hds::Alert @type="compact" @color="critical" @icon="trash" data-test-alert-delete={{@idx}} as |A|>
+      <A.Description>This key value pair is marked for deletion.</A.Description>
+    </Hds::Alert>
+  {{/if}}
+
+  <KvPatch::Editor::Alerts
+    @idx={{@idx}}
+    @keyError={{@kvClass.keyError}}
+    @keyWarning={{@kvClass.keyWarning}}
+    @valueWarning={{@kvClass.valueWarning}}
+  />
+{{/let}}
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-patch/json-form.hbs b/ui/lib/kv/addon/components/kv-patch/json-form.hbs
new file mode 100644
index 00000000000..9b3947da943
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-patch/json-form.hbs
@@ -0,0 +1,25 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" this.submit}}>
+  <JsonEditor class="has-top-margin-l" @title="Patch data" @valueUpdated={{this.handleJson}} @value={{this.jsonObject}} />
+  {{#if this.lintingErrors}}
+    <AlertInline
+      @color="warning"
+      class="has-top-padding-s"
+      @message="JSON is unparsable. Fix linting errors to avoid data discrepancies."
+    />
+  {{/if}}
+
+  <KvPatch::SubkeysReveal @subkeys={{@subkeys}} />
+  <hr class="has-background-gray-200" />
+  <Hds::ButtonSet>
+    <Hds::Button @text="Save" type="submit" @icon={{if @isSaving "loading"}} disabled={{@isSaving}} data-test-kv-save />
+    <Hds::Button @text="Cancel" {{on "click" @onCancel}} @color="secondary" disabled={{@isSaving}} data-test-kv-cancel />
+  </Hds::ButtonSet>
+  {{#if @submitError}}
+    <AlertInline @type="danger" @message={{@submitError}} class="has-top-padding-s" />
+  {{/if}}
+</form>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-patch/json-form.js b/ui/lib/kv/addon/components/kv-patch/json-form.js
new file mode 100644
index 00000000000..8444061daad
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-patch/json-form.js
@@ -0,0 +1,53 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+
+/**
+ * @module KvPatchJsonForm
+ * @description
+ * This component renders one of two ways to patch a KV v2 secret (the other is using the KvPatch::Editor::Form).
+ *
+ * @example
+ * <KvPatch::JsonForm @onSubmit={{perform this.save}} @onCancel={{this.onCancel}} @isSaving={{this.save.isRunning}} />
+ *
+ * @param {boolean} isSaving - if true, disables the save and cancel buttons. useful if the onSubmit callback is a concurrency task
+ * @param {function} onCancel - called when form is canceled
+ * @param {function} onSubmit - called when form is saved, called with with the key value object containing patch data
+ * @param {object} subkeys - leaf keys of a kv v2 secret, all values (unless a nested object with more keys) return null. used for toggle that reveals codeblock of subkey structure
+ * @param {string} submitError - error message string from parent if submit failed
+ */
+
+export default class KvPatchJsonForm extends Component {
+  @tracked jsonObject;
+  @tracked lintingErrors;
+
+  constructor() {
+    super(...arguments);
+    // prefill JSON editor with an empty object
+    this.jsonObject = JSON.stringify({ '': '' }, null, 2);
+  }
+
+  @action
+  handleJson(value) {
+    this.lintingErrors = false;
+
+    try {
+      JSON.parse(value);
+      this.jsonObject = value;
+    } catch {
+      this.lintingErrors = true;
+    }
+  }
+
+  @action
+  submit(event) {
+    event.preventDefault();
+    const patchData = JSON.parse(this.jsonObject);
+    this.args.onSubmit(patchData);
+  }
+}
diff --git a/ui/lib/kv/addon/components/kv-patch/subkeys-reveal.hbs b/ui/lib/kv/addon/components/kv-patch/subkeys-reveal.hbs
new file mode 100644
index 00000000000..a93c5912be1
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-patch/subkeys-reveal.hbs
@@ -0,0 +1,13 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div class="has-top-margin-m">
+  <Toggle @onChange={{fn (mut this.showSubkeys)}} @checked={{this.showSubkeys}} @name="Reveal subkeys">
+    <Hds::Text::Body @tag="p" @weight="semibold">Reveal subkeys in JSON</Hds::Text::Body>
+  </Toggle>
+  {{#if this.showSubkeys}}
+    <Hds::CodeBlock @value={{stringify @subkeys}} @hasLineNumbers={{false}} data-test-code-block="subkeys" />
+  {{/if}}
+</div>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-patch/subkeys-reveal.js b/ui/lib/kv/addon/components/kv-patch/subkeys-reveal.js
new file mode 100644
index 00000000000..eed0cecf6d1
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-patch/subkeys-reveal.js
@@ -0,0 +1,20 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+
+/**
+ * @module SubkeysReveal
+ *
+ * @example
+ * <SubkeysReveal @subkeys={{this.subkeys}} />
+ *
+ * @param {object} subkeys - leaf keys of a kv v2 secret, all values (unless a nested object with more keys) return null. https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#read-secret-subkeys
+ */
+
+export default class SubkeysReveal extends Component {
+  @tracked showSubkeys = false;
+}
diff --git a/ui/lib/kv/addon/components/kv-paths-card.hbs b/ui/lib/kv/addon/components/kv-paths-card.hbs
new file mode 100644
index 00000000000..66f34db3ebe
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-paths-card.hbs
@@ -0,0 +1,82 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<div data-test-overview-card-container="Paths" ...attributes>
+  <Hds::Text::Display @weight="semibold" @size="300" @tag="h2">
+    Paths
+  </Hds::Text::Display>
+  {{#if @isCondensed}}
+    <Hds::Text::Body @tag="p" @color="faint">
+      The paths to use when referring to this secret in API or CLI.
+    </Hds::Text::Body>
+  {{/if}}
+
+  <div class="box is-fullwidth is-sideless is-paddingless is-marginless {{if @isCondensed 'is-shadowless'}} ">
+    {{#each this.paths as |path|}}
+      <InfoTableRow
+        @label={{path.label}}
+        @labelWidth={{if @isCondensed "is-one-quarter" "is-one-third"}}
+        @helperText={{if @isCondensed "" path.text}}
+        @truncateValue={{true}}
+      >
+        <Hds::Copy::Button
+          @text="Copy"
+          @isIconOnly={{true}}
+          @textToCopy={{path.snippet}}
+          @onError={{fn (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")}}
+          data-test-copy-button
+          class="transparent"
+        />
+        <code class="is-flex-1 text-overflow-ellipsis has-left-margin-s">
+          {{path.snippet}}
+        </code>
+      </InfoTableRow>
+    {{/each}}
+  </div>
+
+  {{#unless @isCondensed}}
+    <Hds::Text::Display @weight="semibold" @size="300" @tag="h3" class="has-top-margin-xl">
+      Commands
+    </Hds::Text::Display>
+
+    <div class="box is-fullwidth is-sideless">
+      <h3 class="is-label">
+        CLI
+        <Hds::Badge @text="kv get" @color="neutral" />
+      </h3>
+      <p class="helper-text has-text-grey-light has-bottom-padding-s">
+        This command retrieves the value from KV secrets engine at the given key name. See our
+        <Hds::Link::Inline @isHrefExternal={{true}} @href={{doc-link "/vault/docs/commands/kv"}}>
+          documentation</Hds::Link::Inline>
+        for other CLI commands.
+      </p>
+      <Hds::CodeBlock
+        data-test-code-block="cli"
+        @language="bash"
+        @hasLineNumbers={{false}}
+        @hasCopyButton={{true}}
+        @value={{this.commands.cli}}
+      />
+
+      <h3 class="has-top-margin-l is-label">
+        API read secret version
+      </h3>
+      <p class="helper-text has-text-grey-light has-bottom-padding-s">
+        This command obtains data and metadata for the latest version of this secret. In this example, Vault is located at
+        https://127.0.0.1:8200. For other API commands,
+        <DocLink @path="/vault/api-docs/secret/kv/kv-v2">
+          learn more.
+        </DocLink>
+      </p>
+      <Hds::CodeBlock
+        data-test-code-block="api"
+        @language="bash"
+        @hasLineNumbers={{false}}
+        @hasCopyButton={{true}}
+        @value={{this.commands.api}}
+      />
+    </div>
+  {{/unless}}
+</div>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-paths-card.js b/ui/lib/kv/addon/components/kv-paths-card.js
new file mode 100644
index 00000000000..be3f9813e99
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-paths-card.js
@@ -0,0 +1,73 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { kvMetadataPath, kvDataPath } from 'vault/utils/kv-path';
+import { encodePath } from 'vault/utils/path-encoding-helpers';
+
+/**
+ * @module KvPathsCard is used to display copyable secret paths for KV v2 for CLI and API use.
+ * This component is permission agnostic because args come from the views mount path and url params.
+ *
+ * <KvPathsCard
+ *  @path={{this.model.path}}
+ *  @backend={{this.model.backend}}
+ *  @isCondensed={{false}}
+ * />
+ *
+ * @param {string} path - kv secret path for building the CLI and API paths
+ * @param {string} backend - the secret engine mount path, comes from the secretMountPath service defined in the route
+ * @param {boolean} isCondensed - if true a smaller version displays with no commands section or extra explanatory text
+ */
+
+export default class KvPathsCard extends Component {
+  @service namespace;
+
+  get paths() {
+    const { backend, path } = this.args;
+    const namespace = this.namespace.path;
+    const cli = `-mount="${backend}" "${path}"`;
+    const data = kvDataPath(backend, path);
+    const metadata = kvMetadataPath(backend, path);
+
+    return [
+      {
+        label: 'API path',
+        snippet: namespace ? `/v1/${encodePath(namespace)}/${data}` : `/v1/${data}`,
+        text: 'Use this path when referring to this secret in the API.',
+      },
+      {
+        label: 'CLI path',
+        snippet: namespace ? `-namespace=${namespace} ${cli}` : cli,
+        text: 'Use this path when referring to this secret in the CLI.',
+      },
+      ...(this.args.isCondensed
+        ? []
+        : [
+            {
+              label: 'API path for metadata',
+              snippet: namespace ? `/v1/${encodePath(namespace)}/${metadata}` : `/v1/${metadata}`,
+              text: `Use this path when referring to this secret's metadata in the API and permanent secret deletion.`,
+            },
+          ]),
+    ];
+  }
+
+  get commands() {
+    const cliPath = this.paths.find((p) => p.label === 'CLI path').snippet;
+    const apiPath = this.paths.find((p) => p.label === 'API path').snippet;
+    // as a future improvement, it might be nice to use window.location.protocol here:
+    const url = `https://127.0.0.1:8200${apiPath}`;
+
+    return {
+      cli: `vault kv get ${cliPath}`,
+      api: `curl \\
+  --header "X-Vault-Token: ..." \\
+  --request GET \\
+  ${url}`,
+    };
+  }
+}
diff --git a/ui/lib/kv/addon/components/kv-subkeys-card.hbs b/ui/lib/kv/addon/components/kv-subkeys-card.hbs
new file mode 100644
index 00000000000..64f4360fce9
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-subkeys-card.hbs
@@ -0,0 +1,67 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<OverviewCard @cardTitle="Subkeys" class="has-top-margin-l" {{style max-height="325px" overflow-y="auto"}}>
+  <:customSubtext>
+    <Hds::Text::Body @tag="p" @color="faint" data-test-overview-card-subtitle="Subkeys">
+      {{#if this.showJson}}
+        These are the subkeys within this secret. All underlying values of leaf keys are not retrieved and are replaced with
+        <code>null</code>
+        instead. Subkey
+        <Hds::Link::Inline
+          @icon="docs-link"
+          @iconPosition="trailing"
+          @href={{doc-link "/vault/api-docs/secret/kv/kv-v2#read-secret-subkeys"}}
+          @isHrefExternal={{true}}
+        >API documentation</Hds::Link::Inline>.
+      {{else}}
+        The table is displaying the top level subkeys. Toggle on the JSON view to see the full depth.
+      {{/if}}
+    </Hds::Text::Body>
+  </:customSubtext>
+  <:action>
+    <div class="flex column-gap-16">
+      <div class="top-padding-4">
+        <Hds::Form::Toggle::Field
+          checked={{this.showJson}}
+          {{on "change" this.toggleJson}}
+          data-test-toggle-input="kv-subkeys"
+          as |F|
+        >
+          <F.Label>JSON</F.Label>
+        </Hds::Form::Toggle::Field>
+      </div>
+      {{#if @isPatchAllowed}}
+        <Hds::Link::Standalone
+          @text="Patch secret"
+          @route="secret.patch"
+          @models={{array @backend @path}}
+          @icon="arrow-right"
+          @iconPosition="trailing"
+          @isFullWidth={{true}}
+          data-test-action-text="Patch secret"
+        />
+      {{/if}}
+    </div>
+  </:action>
+  <:content>
+    <div class="has-top-margin-s" data-test-overview-card-content="Subkeys">
+      {{#if this.showJson}}
+        <Hds::CodeBlock @value={{stringify @subkeys}} @hasLineNumbers={{false}} />
+      {{else}}
+        <Hds::Text::Display @tag="p" @size="200" @weight="semibold" @color="faint" class="has-bottom-margin-s">
+          Keys
+        </Hds::Text::Display>
+        <hr class="has-background-gray-100 is-marginless" />
+        {{#each-in @subkeys as |key|}}
+          <Hds::Text::Display @tag="p" @size="200" @weight="semibold" class="has-top-bottom-margin-12">
+            {{key}}
+          </Hds::Text::Display>
+          <hr class="has-background-gray-100 is-marginless" />
+        {{/each-in}}
+      {{/if}}
+    </div>
+  </:content>
+</OverviewCard>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-subkeys-card.js b/ui/lib/kv/addon/components/kv-subkeys-card.js
new file mode 100644
index 00000000000..bc9c5a2ff93
--- /dev/null
+++ b/ui/lib/kv/addon/components/kv-subkeys-card.js
@@ -0,0 +1,48 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+
+/**
+ * @module KvSubkeysCard
+ * @description
+sample secret data:
+```
+ {
+  "foo": "abc",
+  "bar": {
+    "baz": "def"
+  },
+  "quux": {}
+}
+```
+sample subkeys:
+```
+ this.subkeys = {
+    "bar": {
+        "baz": null
+    },
+    "foo": null,
+    "quux": null
+}
+```
+ * 
+ * @example
+ * <KvSubkeysCard @subkeys={{this.subkeys}} @isPatchAllowed={{true}} />
+ *
+ * @param {object} subkeys - leaf keys of a kv v2 secret, all values (unless a nested object with more keys) return null
+ * @param {boolean} isPatchAllowed - if true, renders the "Patch secret" action. True when: (1) the version is enterprise, (2) a user has "patch" secret + "read" subkeys capabilities, (3) latest secret version is not deleted or destroyed
+ */
+
+export default class KvSubkeysCard extends Component {
+  @tracked showJson = false;
+
+  @action
+  toggleJson(event) {
+    this.showJson = event.target.checked;
+  }
+}
diff --git a/ui/lib/kv/addon/components/kv-tooltip-timestamp.hbs b/ui/lib/kv/addon/components/kv-tooltip-timestamp.hbs
index db99f3f1b05..92f0c89bd04 100644
--- a/ui/lib/kv/addon/components/kv-tooltip-timestamp.hbs
+++ b/ui/lib/kv/addon/components/kv-tooltip-timestamp.hbs
@@ -1,19 +1,12 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! renders a human readable date with a tooltip containing the API timestamp}}
-<ToolTip @verticalPosition="above" @horizontalPosition="center" as |T|>
-  <T.Trigger data-test-kv-version-tooltip-trigger tabindex="-1">
-    {{#if @text}}
-      {{@text}}
-    {{/if}}
-    {{date-format @timestamp "MMM dd, yyyy hh:mm a"}}
-  </T.Trigger>
-  <T.Content @defaultClass="tool-tip smaller-font">
-    <div class="box" data-test-hover-copy-tooltip-text>
-      {{@timestamp}}
-    </div>
-  </T.Content>
-</ToolTip>
\ No newline at end of file
+<Hds::TooltipButton @text={{@timestamp}} aria-label="API timestamp" data-test-tooltip="kv-version">
+  {{#if @text}}
+    {{@text}}
+  {{/if}}
+  {{date-format @timestamp "MMM dd, yyyy hh:mm a"}}
+</Hds::TooltipButton>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/kv-version-dropdown.hbs b/ui/lib/kv/addon/components/kv-version-dropdown.hbs
index a5557d4ea69..f23c594545b 100644
--- a/ui/lib/kv/addon/components/kv-version-dropdown.hbs
+++ b/ui/lib/kv/addon/components/kv-version-dropdown.hbs
@@ -1,9 +1,9 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<BasicDropdown @class="popup-menu" @horizontalPosition="auto-right" @verticalPosition="below" as |D|>
+<BasicDropdown @class="popup-menu" @horizontalPosition="auto-right" @verticalPosition="below" @renderInPlace={{true}} as |D|>
   <D.Trigger data-test-version-dropdown class="toolbar-link {{if D.isOpen ' is-active'}}">
     Version
     {{or @displayVersion "current"}}
@@ -12,12 +12,12 @@
   <D.Content @defaultClass="popup-menu-content">
     <nav class="box menu">
       <ul class="menu-list">
-        {{#each @metadata.sortedVersions as |versionData|}}
-          <li data-test-version={{versionData.version}} class="action">
+        {{#each (sorted-versions @metadata.versions) as |versionData|}}
+          <li data-test-version={{versionData.version}}>
             {{#if @onSelect}}
               {{! TODO use Hds::Dropdown instead https://helios.hashicorp.design/components/dropdown }}
               <button
-                disabled={{or versionData.destroyed versionData.isSecretDeleted}}
+                disabled={{or versionData.destroyed (is-deleted versionData.deletion_time)}}
                 {{on "click" (fn @onSelect versionData.version D.actions)}}
                 type="button"
                 class="link {{if (loose-equal versionData.version @displayVersion) 'is-active'}}"
@@ -28,7 +28,7 @@
                   <Icon @name="x-square-fill" class="has-text-danger is-pulled-right" />
                 {{else if versionData.isSecretDeleted}}
                   <Icon @name="x-square-fill" class="has-text-grey is-pulled-right" />
-                {{else if (loose-equal versionData.version @metadata.currentVersion)}}
+                {{else if (loose-equal versionData.version @metadata.current_version)}}
                   <Icon @name="check-circle" class="has-text-success is-pulled-right" />
                 {{/if}}
               </button>
@@ -40,7 +40,7 @@
                   <Icon @name="x-square-fill" class="has-text-danger is-pulled-right" />
                 {{else if versionData.isSecretDeleted}}
                   <Icon @name="x-square-fill" class="has-text-grey is-pulled-right" />
-                {{else if (loose-equal versionData.version @metadata.currentVersion)}}
+                {{else if (loose-equal versionData.version @metadata.current_version)}}
                   <Icon @name="check-circle" class="has-text-success is-pulled-right" />
                 {{/if}}
               </LinkTo>
diff --git a/ui/lib/kv/addon/components/page/configuration.hbs b/ui/lib/kv/addon/components/page/configuration.hbs
index 7feeee0f5f8..778cf552307 100644
--- a/ui/lib/kv/addon/components/page/configuration.hbs
+++ b/ui/lib/kv/addon/components/page/configuration.hbs
@@ -1,37 +1,22 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<KvPageHeader @breadcrumbs={{@breadcrumbs}} @mountName={{@mountConfig.id}}>
+<KvPageHeader @breadcrumbs={{@breadcrumbs}} @mountName={{@backend}}>
   <:tabLinks>
     <li><LinkTo @route="list" data-test-secrets-tab="Secrets">Secrets</LinkTo></li>
     <li><LinkTo @route="configuration" data-test-secrets-tab="Configuration">Configuration</LinkTo></li>
   </:tabLinks>
 </KvPageHeader>
 
-{{! engine configuration }}
-{{#if @engineConfig.canRead}}
-  <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
-    {{#each @engineConfig.formFields as |attr|}}
-      <InfoTableRow
-        @alwaysRender={{true}}
-        @label={{or attr.options.label (to-label attr.name)}}
-        @value={{if (eq attr.name "deleteVersionAfter") @engineConfig.displayDeleteTtl (get @engineConfig attr.name)}}
-      />
-    {{/each}}
-  </div>
-{{/if}}
-
-{{! mount configuration }}
 <div class="box is-fullwidth is-sideless is-paddingless is-marginless">
-  {{#each @mountConfig.attrs as |attr|}}
-    {{#if (not (includes attr.name @engineConfig.displayFields))}}
-      <InfoTableRow
-        @formatTtl={{eq attr.options.editType "ttl"}}
-        @label={{or attr.options.label (to-label attr.name)}}
-        @value={{get @mountConfig (or attr.options.fieldValue attr.name)}}
-      />
-    {{/if}}
-  {{/each}}
+  {{#each-in @config as |key value|}}
+    <InfoTableRow
+      @alwaysRender={{true}}
+      @formatTtl={{includes key (array "default_lease_ttl" "max_lease_ttl")}}
+      @label={{this.label key}}
+      @value={{this.value key value}}
+    />
+  {{/each-in}}
 </div>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/page/configuration.js b/ui/lib/kv/addon/components/page/configuration.js
new file mode 100644
index 00000000000..5a621f2eb5b
--- /dev/null
+++ b/ui/lib/kv/addon/components/page/configuration.js
@@ -0,0 +1,40 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { toLabel } from 'core/helpers/to-label';
+import { duration } from 'core/helpers/format-duration';
+
+/**
+ * @module KvConfigPageComponent
+ * KvConfigPageComponent is a component to show secrets mount and engine configuration data
+ *
+ * @param {object} config - config data for mount and engine
+ * @param {string} backend - The name of the kv secret engine.
+ * @param {array} breadcrumbs - Breadcrumbs as an array of objects that contain label, route, and modelId. They are updated via the util kv-breadcrumbs to handle dynamic *pathToSecret on the list-directory route.
+ */
+
+export default class KvConfigPageComponent extends Component {
+  label = (key) => {
+    const label = toLabel([key]);
+    // map specific fields to custom labels
+    return (
+      {
+        cas_required: 'Require check and set',
+        delete_version_after: 'Automate secret deletion',
+        max_versions: 'Maximum number of versions',
+        default_lease_ttl: 'Default Lease TTL',
+        max_lease_ttl: 'Max Lease TTL',
+      }[key] || label
+    );
+  };
+
+  value = (key, value) => {
+    if (key === 'delete_version_after') {
+      return value === '0s' ? 'Never delete' : duration([value]);
+    }
+    return value;
+  };
+}
diff --git a/ui/lib/kv/addon/components/page/list.hbs b/ui/lib/kv/addon/components/page/list.hbs
index f503ef29d15..38b098b54d8 100644
--- a/ui/lib/kv/addon/components/page/list.hbs
+++ b/ui/lib/kv/addon/components/page/list.hbs
@@ -1,27 +1,42 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <KvPageHeader @breadcrumbs={{@breadcrumbs}} @mountName={{@backend}}>
   <:tabLinks>
-    <li><LinkTo @route={{this.router.currentRoute.localName}} data-test-secrets-tab="Secrets">Secrets</LinkTo></li>
-    <li><LinkTo @route="configuration" data-test-secrets-tab="Configuration">Configuration</LinkTo></li>
+    <li>
+      <LinkTo
+        @route={{this.router.currentRoute.localName}}
+        @models={{@currentRouteParams}}
+        data-test-secrets-tab="Secrets"
+        @current-when={{true}}
+      >Secrets</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="configuration" @model={{@backend}} data-test-secrets-tab="Configuration">Configuration</LinkTo>
+    </li>
   </:tabLinks>
 
   <:toolbarFilters>
-
     {{#if (and (not-eq @secrets 403) (or @secrets @filterValue))}}
-      <KvListFilter @secrets={{@secrets}} @mountPoint={{this.mountPoint}} @filterValue={{@filterValue}} />
+      <KvListFilter @mountPoint={{this.mountPoint}} @filterValue={{@filterValue}} />
     {{/if}}
   </:toolbarFilters>
 
   <:toolbarActions>
-    <ToolbarLink data-test-toolbar-create-secret @route="create" @query={{hash initialKey=@filterValue}} @type="add">
+    <ToolbarLink
+      data-test-toolbar-create-secret
+      @route="create"
+      @model={{@backend}}
+      @query={{hash initialKey=@filterValue}}
+      @type="add"
+    >
       Create secret
     </ToolbarLink>
   </:toolbarActions>
 </KvPageHeader>
+
 {{#if (eq @secrets 403)}}
   <div class="box is-fullwidth is-shadowless has-tall-padding">
     <div class="selectable-card-container one-card">
@@ -29,88 +44,109 @@
         @cardTitle="View secret"
         @subText="Type the path of the secret you want to view. Include a trailing slash to navigate to the list view."
       >
-        <form {{on "submit" this.transitionToSecretDetail}} class="has-top-margin-m">
-          <InputSearch
-            @id="search-input-kv-secret"
-            @initialValue={{@pathToSecret}}
-            @onChange={{this.handleSecretPathInput}}
-            @placeholder="secret/"
-            data-test-view-secret
-          />
-          <Hds::Button
-            @text={{this.buttonText}}
-            @color="secondary"
-            type="submit"
-            disabled={{not this.secretPath}}
-            data-test-get-secret-detail
-          />
-        </form>
-        {{#if @failedDirectoryQuery}}
-          <AlertInline @type="danger" @message="You do not have the required permissions or the directory does not exist." />
-        {{/if}}
+        <:content>
+          <form {{on "submit" this.transitionToSecretDetail}} class="has-top-margin-m">
+            <InputSearch
+              @id="search-input-kv-secret"
+              @initialValue={{@pathToSecret}}
+              @onChange={{this.handleSecretPathInput}}
+              @placeholder="secret/"
+              data-test-view-secret
+            />
+            <Hds::Button
+              @text={{this.buttonText}}
+              @color="secondary"
+              type="submit"
+              disabled={{not this.secretPath}}
+              data-test-submit
+            />
+          </form>
+          {{#if @failedDirectoryQuery}}
+            <AlertInline
+              @type="danger"
+              @message="You do not have the required permissions or the directory does not exist."
+            />
+          {{/if}}
+        </:content>
       </OverviewCard>
     </div>
   </div>
 {{else}}
   {{#if @secrets}}
-    {{#each @secrets as |metadata|}}
-      <LinkedBlock
-        data-test-list-item={{metadata.path}}
-        class="list-item-row"
-        @params={{array (if metadata.pathIsDirectory "list-directory" "secret.details") metadata.fullSecretPath}}
-        @linkPrefix={{this.mountPoint}}
-      >
-        <div class="level is-mobile">
-          <div class="level-left">
-            <div>
-              <Icon @name={{if metadata.pathIsDirectory "folder" "file"}} class="has-text-grey-light" />
-              <span class="has-text-weight-semibold is-underline">
-                {{metadata.path}}
-              </span>
+    {{#each @secrets as |secretPath|}}
+      {{#let (this.isDirectory secretPath) (this.fullSecretPath secretPath) as |isDir fullPath|}}
+        <LinkedBlock
+          data-test-list-item={{secretPath}}
+          class="list-item-row"
+          @params={{array (if isDir "list-directory" "secret.index") @backend fullPath}}
+          @linkPrefix={{this.mountPoint}}
+        >
+          <div class="level is-mobile">
+            <div class="level-left">
+              <div>
+                <Icon @name={{if isDir "folder" "file"}} class="has-text-grey-light" />
+                <span class="has-text-weight-semibold is-underline" data-test-path>
+                  {{secretPath}}
+                </span>
+              </div>
             </div>
-          </div>
-          <div class="level-right is-flex is-paddingless is-marginless">
-            <div class="level-item">
-              <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
-                <dd.ToggleIcon
-                  @icon="more-horizontal"
-                  @text="Manage secret"
-                  @hasChevron={{false}}
-                  data-test-popup-menu-trigger
-                />
-                {{#if metadata.pathIsDirectory}}
-                  <dd.Interactive @text="Content" @route="list-directory" @model={{metadata.fullSecretPath}} />
-                {{else}}
-                  <dd.Interactive @text="Details" @route="secret.details" @model={{metadata.fullSecretPath}} />
-                  {{#if metadata.canReadMetadata}}
+            <div class="level-right is-flex is-paddingless is-marginless">
+              <div class="level-item">
+                <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
+                  <dd.ToggleIcon
+                    @icon="more-horizontal"
+                    @text="Manage secret"
+                    @hasChevron={{false}}
+                    data-test-popup-menu-trigger
+                  />
+                  {{#if isDir}}
                     <dd.Interactive
-                      @text="View version history"
-                      @route="secret.metadata.versions"
-                      @model={{metadata.fullSecretPath}}
-                    />
-                  {{/if}}
-                  {{#if metadata.canCreateVersionData}}
+                      @route="list-directory"
+                      @models={{array @backend fullPath}}
+                      data-test-list-menu-item="Content"
+                    >
+                      Content
+                    </dd.Interactive>
+                  {{else}}
                     <dd.Interactive
-                      @text="Create new version"
-                      @route="secret.details.edit"
-                      @model={{metadata.fullSecretPath}}
-                      data-test-popup-create-new-version
-                    />
-                  {{/if}}
-                  {{#if metadata.canDeleteMetadata}}
+                      @route="secret.index"
+                      @models={{array @backend fullPath}}
+                      data-test-list-menu-item="Overview"
+                    >
+                      Overview
+                    </dd.Interactive>
                     <dd.Interactive
-                      @text="Permanently delete"
-                      @color="critical"
-                      {{on "click" (fn (mut this.metadataToDelete) metadata)}}
-                      data-test-popup-metadata-delete
-                    />
+                      @route="secret.details"
+                      @models={{array @backend fullPath}}
+                      data-test-list-menu-item="Secret data"
+                    >
+                      Secret data
+                    </dd.Interactive>
+                    {{#if @capabilities.canRead}}
+                      <dd.Interactive
+                        @route="secret.metadata.versions"
+                        @models={{array @backend fullPath}}
+                        data-test-list-menu-item="View version history"
+                      >
+                        View version history
+                      </dd.Interactive>
+                    {{/if}}
+                    {{#if @capabilities.canDelete}}
+                      <dd.Interactive
+                        @color="critical"
+                        {{on "click" (fn (mut this.metadataToDelete) secretPath)}}
+                        data-test-list-menu-item="Permanently delete"
+                      >
+                        Permanently delete
+                      </dd.Interactive>
+                    {{/if}}
                   {{/if}}
-                {{/if}}
-              </Hds::Dropdown>
+                </Hds::Dropdown>
+              </div>
             </div>
           </div>
-        </div>
-      </LinkedBlock>
+        </LinkedBlock>
+      {{/let}}
     {{/each}}
     {{#if this.metadataToDelete}}
       <ConfirmModal
@@ -120,12 +156,12 @@
         @confirmMessage="This will permanently delete this secret and all its versions."
       />
     {{/if}}
-    {{! Pagination }}
     <Hds::Pagination::Numbered
       @currentPage={{@secrets.meta.currentPage}}
       @currentPageSize={{@secrets.meta.pageSize}}
       @route={{this.router.currentRoute.localName}}
       @showSizeSelector={{false}}
+      @models={{@currentRouteParams}}
       @totalItems={{@secrets.meta.total}}
       @queryFunction={{this.paginationQueryParams}}
       data-test-pagination
diff --git a/ui/lib/kv/addon/components/page/list.js b/ui/lib/kv/addon/components/page/list.js
index 3abcc3808b9..08bdc3f1401 100644
--- a/ui/lib/kv/addon/components/page/list.js
+++ b/ui/lib/kv/addon/components/page/list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,31 +7,37 @@ import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 import { ancestorKeysForKey } from 'core/utils/key-utils';
-import errorMessage from 'vault/utils/error-message';
 import { pathIsDirectory } from 'kv/utils/kv-breadcrumbs';
 
 /**
  * @module List
- * ListPage component is a component to show a list of kv/metadata secrets.
+ * ListPage component is a component to show a list of secrets.
  *
- * @param {array} secrets - An array of models generated form kv/metadata query.
+ * @param {array} secrets - An array of secrets
  * @param {string} backend - The name of the kv secret engine.
  * @param {string} pathToSecret - The directory name that the secret belongs to ex: beep/boop/
  * @param {string} filterValue - The concatenation of the pathToSecret and pageFilter ex: beep/boop/my-
  * @param {boolean} failedDirectoryQuery - true if the query was a 403 and the search was for a directory. Used to display inline alert message on the overview card.
  * @param {array} breadcrumbs - Breadcrumbs as an array of objects that contain label, route, and modelId. They are updated via the util kv-breadcrumbs to handle dynamic *pathToSecret on the list-directory route.
+ * @param {object} capabilities - capabilities for metadata path
  */
 
 export default class KvListPageComponent extends Component {
   @service flashMessages;
-  @service router;
-  @service store;
+  @service('app-router') router;
+  @service pagination;
+  @service api;
 
   @tracked secretPath;
   @tracked metadataToDelete = null; // set to the metadata intended to delete
 
+  // used for KV list and list-directory view
+  // ex: beep/
+  isDirectory = (path) => pathIsDirectory(path);
+  fullSecretPath = (secret) => `${this.args.pathToSecret}${secret}`;
+
   get mountPoint() {
     // mountPoint tells transition where to start. In this case, mountPoint will always be vault.cluster.secrets.backend.kv.
     return getOwner(this).mountPoint;
@@ -53,16 +59,15 @@ export default class KvListPageComponent extends Component {
   }
 
   @action
-  async onDelete(model) {
+  async onDelete(secretPath) {
     try {
-      // The model passed in is a kv/metadata model
-      await model.destroyRecord();
-      this.store.clearDataset('kv/metadata'); // Clear out the store cache so that the metadata/list view is updated.
-      const message = `Successfully deleted the metadata and all version data of the secret ${model.fullSecretPath}.`;
+      const fullSecretPath = this.fullSecretPath(secretPath);
+      await this.api.secrets.kvV2DeleteMetadataAndAllVersions(fullSecretPath, this.args.backend);
+      const message = `Successfully deleted the metadata and all version data of the secret ${fullSecretPath}.`;
       this.flashMessages.success(message);
       // if you've deleted a secret from within a directory, transition to its parent directory.
       if (this.router.currentRoute.localName === 'list-directory') {
-        const ancestors = ancestorKeysForKey(model.fullSecretPath);
+        const ancestors = ancestorKeysForKey(fullSecretPath);
         const nearest = ancestors.pop();
         this.router.transitionTo(`${this.mountPoint}.list-directory`, nearest);
       } else {
@@ -70,7 +75,10 @@ export default class KvListPageComponent extends Component {
         this.router.transitionTo(`${this.mountPoint}.list`);
       }
     } catch (error) {
-      const message = errorMessage(error, 'Error deleting secret. Please try again or contact support.');
+      const { message } = await this.api.parseError(
+        error,
+        'Error deleting secret. Please try again or contact support.'
+      );
       this.flashMessages.danger(message);
     } finally {
       this.metadataToDelete = null;
@@ -87,6 +95,6 @@ export default class KvListPageComponent extends Component {
     evt.preventDefault();
     pathIsDirectory(this.secretPath)
       ? this.router.transitionTo('vault.cluster.secrets.backend.kv.list-directory', this.secretPath)
-      : this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.details', this.secretPath);
+      : this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.index', this.secretPath);
   }
 }
diff --git a/ui/lib/kv/addon/components/page/secret/details.hbs b/ui/lib/kv/addon/components/page/secret/details.hbs
index 91c4a517168..1f8a920f303 100644
--- a/ui/lib/kv/addon/components/page/secret/details.hbs
+++ b/ui/lib/kv/addon/components/page/secret/details.hbs
@@ -1,9 +1,9 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<KvPageHeader @breadcrumbs={{@breadcrumbs}} @pageTitle={{@path}}>
+<KvPageHeader @breadcrumbs={{@breadcrumbs}} @secretPath={{@path}}>
   <:syncDetails>
     {{#if this.syncStatus}}
       <Hds::Alert data-test-sync-alert @type="inline" class="has-top-margin-s has-bottom-margin-m" @color="neutral" as |A|>
@@ -14,16 +14,18 @@
         </A.Title>
 
         {{#each this.syncStatus as |status|}}
-          <A.Description data-test-sync-alert={{status.destinationName}}>
-            <SyncStatusBadge @status={{status.syncStatus}} />
+          <A.Description data-test-sync-alert={{status.name}}>
+            <SyncStatusBadge @status={{status.sync_status}} />
             <Hds::Link::Inline
               @route="syncDestination"
               @color="secondary"
               @isRouteExternal={{true}}
-              @models={{array status.destinationType status.destinationName}}
-            >{{status.destinationName}}</Hds::Link::Inline>
+              @models={{array status.type status.name}}
+            >
+              {{status.name}}
+            </Hds::Link::Inline>
             - last updated
-            {{date-format status.updatedAt "MMMM do yyyy, h:mm:ss a"}}
+            {{date-format status.updated_at "MMMM do yyyy, h:mm:ss a"}}
           </A.Description>
         {{/each}}
 
@@ -33,7 +35,7 @@
           @color="secondary"
           {{on "click" (perform this.fetchSyncStatus)}}
         />
-        <A.Link::Standalone
+        <A.LinkStandalone
           @isHrefExternal={{true}}
           @icon="docs-link"
           @text="About sync statuses"
@@ -44,11 +46,26 @@
   </:syncDetails>
 
   <:tabLinks>
-    <li><LinkTo @route="secret.details" data-test-secrets-tab="Secret">Secret</LinkTo></li>
-    <li><LinkTo @route="secret.metadata.index" data-test-secrets-tab="Metadata">Metadata</LinkTo></li>
-    <li><LinkTo @route="secret.paths" data-test-secrets-tab="Paths">Paths</LinkTo></li>
-    {{#if @secret.canReadMetadata}}
-      <li><LinkTo @route="secret.metadata.versions" data-test-secrets-tab="Version History">Version History</LinkTo></li>
+    <li>
+      <LinkTo @route="secret.index" @models={{array @backend @path}} data-test-secrets-tab="Overview">Overview</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.details" @models={{array @backend @path}} data-test-secrets-tab="Secret">Secret</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.metadata" @models={{array @backend @path}} data-test-secrets-tab="Metadata">Metadata</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.paths" @models={{array @backend @path}} data-test-secrets-tab="Paths">Paths</LinkTo>
+    </li>
+    {{#if @capabilities.canReadMetadata}}
+      <li>
+        <LinkTo
+          @route="secret.metadata.versions"
+          @models={{array @backend @path}}
+          data-test-secrets-tab="Version History"
+        >Version History</LinkTo>
+      </li>
     {{/if}}
   </:tabLinks>
 
@@ -74,35 +91,50 @@
         @mode="delete"
         @secret={{@secret}}
         @metadata={{@metadata}}
+        @capabilities={{@capabilities}}
         @onDelete={{this.handleDestruction}}
         @version={{this.version}}
       />
     {{/if}}
     {{#if this.showDestroy}}
-      <KvDeleteModal @mode="destroy" @secret={{@secret}} @onDelete={{this.handleDestruction}} @version={{this.version}} />
+      <KvDeleteModal
+        @mode="destroy"
+        @secret={{@secret}}
+        @capabilities={{@capabilities}}
+        @onDelete={{this.handleDestruction}}
+        @version={{this.version}}
+      />
     {{/if}}
-    {{#if (or @secret.canReadData @secret.canReadMetadata @secret.canEditData)}}
+    {{#if (or @capabilities.canReadData @capabilities.canReadMetadata @capabilities.canUpdateData)}}
       <div class="toolbar-separator"></div>
     {{/if}}
-    {{#if (and @secret.canReadData (eq @secret.state "created"))}}
+    {{#if (and @capabilities.canReadData (eq this.secretState "created"))}}
       <CopySecretDropdown
-        @clipboardText={{stringify @secret.secretData}}
+        @clipboardText={{stringify @secret.data}}
         @onWrap={{perform this.wrapSecret}}
         @isWrapping={{this.wrapSecret.isRunning}}
         @wrappedData={{this.wrappedData}}
         @onClose={{this.clearWrappedData}}
       />
     {{/if}}
-    {{#if @secret.canReadMetadata}}
+    {{#if @capabilities.canReadMetadata}}
       <KvVersionDropdown @displayVersion={{this.version}} @metadata={{@metadata}} @onClose={{this.closeVersionMenu}} />
     {{/if}}
-    {{#if @secret.canEditData}}
-      <ToolbarLink data-test-create-new-version @route="secret.details.edit" @type="add">Create new version</ToolbarLink>
+    {{! @isPatchAllowed is true if the version is enterprise AND a user has "patch" secret + "read" subkeys capabilities }}
+    {{#if @isPatchAllowed}}
+      <ToolbarLink data-test-patch-latest-version @route="secret.patch" @models={{array @backend @path}} @type="add">
+        Patch latest version
+      </ToolbarLink>
+    {{/if}}
+    {{#if @capabilities.canUpdateData}}
+      <ToolbarLink data-test-create-new-version @route="secret.details.edit" @models={{array @backend @path}} @type="add">
+        Create new version
+      </ToolbarLink>
     {{/if}}
   </:toolbarActions>
 </KvPageHeader>
 
-{{#if (or @secret.isSecretDeleted (not this.emptyState))}}
+{{#if (or this.isSecretDeleted (not this.emptyState))}}
   <div class="info-table-row-header">
     <div class="info-table-row thead {{if this.showJsonView 'is-shadowless'}} ">
       {{#unless this.hideHeaders}}
@@ -114,10 +146,10 @@
         </div>
       {{/unless}}
       <div class="th column justify-right">
-        {{#if (or @secret.isSecretDeleted @secret.createdTime)}}
+        {{#if (or this.isSecretDeleted @secret.created_time)}}
           <KvTooltipTimestamp
-            @text="Version {{if @secret.version @secret.version}} {{@secret.state}}"
-            @timestamp={{(if @secret.isSecretDeleted @secret.deletionTime @secret.createdTime)}}
+            @text="Version {{@secret.version}} {{this.secretState}}"
+            @timestamp={{(if this.isSecretDeleted @secret.deletion_time @secret.created_time)}}
           />
         {{/if}}
       </div>
@@ -133,14 +165,32 @@
         @iconPosition="trailing"
         @text="KV v2 API docs"
         @href={{doc-link this.emptyState.link}}
+        @isHrefExternal={{true}}
       />
     {{/if}}
   </EmptyState>
 {{else}}
-  <KvDataFields
-    @showJson={{this.showJsonView}}
-    @secret={{@secret}}
-    @modelValidations={{this.modelValidations}}
-    @type="details"
-  />
+  <hr class="is-marginless has-background-gray-200" />
+  {{#if this.showJsonView}}
+    <Hds::CodeBlock
+      data-test-code-block="secret-data"
+      @value={{stringified-secret-data @secret.secretData}}
+      @language="json"
+      @hasCopyButton={{true}}
+      @maxHeight="300px"
+      as |CB|
+    >
+      <CB.Title @tag="h3">
+        Version data
+      </CB.Title>
+    </Hds::CodeBlock>
+  {{else}}
+    {{#each-in @secret.secretData as |key value|}}
+      <InfoTableRow @label={{key}} @value={{value}} @alwaysRender={{true}}>
+        <MaskedInput @name={{key}} @value={{value}} @displayOnly={{true}} @allowCopy={{true}} />
+      </InfoTableRow>
+    {{else}}
+      <InfoTableRow @label="" @value="" @alwaysRender={{true}} />
+    {{/each-in}}
+  {{/if}}
 {{/if}}
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/page/secret/details.js b/ui/lib/kv/addon/components/page/secret/details.js
index 8a9815dd1b1..087f84b0b08 100644
--- a/ui/lib/kv/addon/components/page/secret/details.js
+++ b/ui/lib/kv/addon/components/page/secret/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,29 +10,36 @@ import { next } from '@ember/runloop';
 import { service } from '@ember/service';
 import { task } from 'ember-concurrency';
 import { waitFor } from '@ember/test-waiters';
-import { isDeleted } from 'kv/utils/kv-deleted';
+import sortedVersions from 'kv/helpers/sorted-versions';
+import isDeleted from 'kv/helpers/is-deleted';
 import { isAdvancedSecret } from 'core/utils/advanced-secret';
 
 /**
  * @module KvSecretDetails renders the key/value data of a KV secret.
  * It also renders a dropdown to display different versions of the secret.
  * <Page::Secret::Details
- *  @path={{this.model.path}}
- *  @secret={{this.model.secret}}
- *  @metadata={{this.model.metadata}}
- *  @breadcrumbs={{this.breadcrumbs}}
-  />
+ *   @backend={{this.model.backend}}
+ *   @breadcrumbs={{this.breadcrumbs}}
+ *   @capabilities={{this.model.capabilities}}
+ *   @isPatchAllowed={{this.model.isPatchAllowed}}
+ *   @metadata={{this.model.metadata}}
+ *   @path={{this.model.path}}
+ *   @secret={{this.model.secret}}
+ * />
  *
- * @param {string} path - path of kv secret 'my/secret' used as the title for the KV page header
- * @param {model} secret - Ember data model: 'kv/data'
- * @param {model} metadata - Ember data model: 'kv/metadata'
+ * @param {string} backend - path where kv engine is mounted
  * @param {array} breadcrumbs - Array to generate breadcrumbs, passed to the page header component
+ * @param {object} capabilities - capabilities for data, metadata, subkeys, delete and undelete paths
+ * @param {boolean} isPatchAllowed - if true it renders "Patch latest version" toolbar action. True when: (1) the version is enterprise, (2) a user has "patch" secret + "read" subkeys capabilities, (3) latest secret version is not deleted or destroyed
+ * @param {object} metadata - response object from /secret/metadata/path endpoint
+ * @param {string} path - path of kv secret 'my/secret' used as the title for the KV page header
+ * @param {object} secret - data and metadata objects from kvV2Read response - { secretData: data, ...metadata }
  */
 
 export default class KvSecretDetails extends Component {
   @service flashMessages;
-  @service router;
-  @service store;
+  @service('app-router') router;
+  @service api;
 
   @tracked showJsonView = false;
   @tracked wrappedData = null;
@@ -63,12 +70,14 @@ export default class KvSecretDetails extends Component {
   @task
   @waitFor
   *wrapSecret() {
-    const { backend, path } = this.args.secret;
-    const adapter = this.store.adapterFor('kv/data');
     try {
-      const { token } = yield adapter.fetchWrapInfo({ backend, path, wrapTTL: 1800 });
-      if (!token) throw 'No token';
-      this.wrappedData = token;
+      const { secretData: data, ...metadata } = this.args.secret;
+      const { wrap_info } = yield this.api.sys.wrap(
+        { data, metadata },
+        this.api.buildHeaders({ wrap: 1800 })
+      );
+      if (!wrap_info.token) throw 'No token';
+      this.wrappedData = wrap_info.token;
       this.flashMessages.success('Secret successfully wrapped!');
     } catch (error) {
       this.flashMessages.danger('Could not wrap secret.');
@@ -78,10 +87,12 @@ export default class KvSecretDetails extends Component {
   @task
   @waitFor
   *fetchSyncStatus() {
-    const { backend, path } = this.args.secret;
-    const syncAdapter = this.store.adapterFor('sync/association');
     try {
-      this.syncStatus = yield syncAdapter.fetchSyncStatus({ mount: backend, secretName: path });
+      const { backend: mount, path: secret_name } = this.args;
+      const { associated_destinations } = yield this.api.sys.systemReadSyncAssociationsDestinations(
+        (context) => this.api.addQueryParams(context, { mount, secret_name })
+      );
+      this.syncStatus = Object.values(associated_destinations);
     } catch (e) {
       // silently error
     }
@@ -89,49 +100,56 @@ export default class KvSecretDetails extends Component {
 
   @action
   async undelete() {
-    const { secret } = this.args;
+    const { backend, path } = this.args;
     try {
-      await secret.destroyRecord({
-        adapterOptions: { deleteType: 'undelete', deleteVersions: this.version },
-      });
-      this.flashMessages.success(`Successfully undeleted ${secret.path}.`);
-      this.refreshRoute();
+      await this.api.secrets.kvV2UndeleteVersions(path, backend, { versions: [this.version] });
+      this.flashMessages.success(`Successfully undeleted ${path}.`);
+      this.transition();
     } catch (err) {
-      this.flashMessages.danger(
-        `There was a problem undeleting ${secret.path}. Error: ${err.errors?.join(' ')}.`
-      );
+      const { message } = await this.api.parseError(err);
+      this.flashMessages.danger(`There was a problem undeleting ${path}. Error: ${message}.`);
     }
   }
 
   @action
   async handleDestruction(type) {
-    const { secret } = this.args;
+    const { backend, path } = this.args;
     try {
-      await secret.destroyRecord({ adapterOptions: { deleteType: type, deleteVersions: this.version } });
-      this.flashMessages.success(`Successfully ${secret.state} Version ${this.version} of ${secret.path}.`);
-      this.refreshRoute();
+      if (type === 'destroy') {
+        await this.api.secrets.kvV2DestroyVersions(path, backend, { versions: [this.version] });
+      } else if (type === 'delete-latest-version') {
+        await this.api.secrets.kvV2Delete(path, backend);
+      } else if (type === 'delete-version') {
+        await this.api.secrets.kvV2DeleteVersions(path, backend, { versions: [this.version] });
+      } else {
+        throw 'type must be one of delete-latest-version, delete-version, or destroy.';
+      }
+      const verb = type.includes('delete') ? 'deleted' : 'destroyed';
+      this.flashMessages.success(`Successfully ${verb} Version ${this.version} of ${path}.`);
+      this.transition();
     } catch (err) {
+      const { message } = await this.api.parseError(err);
       const verb = type.includes('delete') ? 'deleting' : 'destroying';
       this.flashMessages.danger(
-        `There was a problem ${verb} Version ${this.version} of ${secret.path}. Error: ${err.errors.join(
-          ' '
-        )}.`
+        `There was a problem ${verb} Version ${this.version} of ${path}. Error: ${message}.`
       );
     }
   }
 
-  refreshRoute() {
-    // transition to the parent secret route to refresh both metadata and data models
-    this.router.transitionTo('vault.cluster.secrets.backend.kv.secret', {
-      queryParams: { version: this.version },
-    });
+  transition() {
+    // transition to the overview to prevent automatically reading sensitive secret data
+    this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.index');
+  }
+
+  get sortedVersions() {
+    return sortedVersions(this.args.metadata?.versions);
   }
 
   get version() {
     return (
       this.args.secret?.version ||
       this.router.currentRoute.queryParams?.version ||
-      this.args.metadata?.sortedVersions[0].version
+      this.sortedVersions[0]?.version
     );
   }
 
@@ -139,18 +157,24 @@ export default class KvSecretDetails extends Component {
     return this.showJsonView || this.emptyState;
   }
 
+  get secretState() {
+    const { destroyed, created_time } = this.args.secret;
+    if (destroyed) return 'destroyed';
+    if (this.isSecretDeleted) return 'deleted';
+    if (created_time) return 'created';
+    return '';
+  }
+
   get versionState() {
-    const { secret, metadata } = this.args;
+    const { secret } = this.args;
     if (secret.failReadErrorCode !== 403) {
-      return secret.state;
+      return this.secretState;
     }
     // If the user can't read secret data, get the current version
     // state from metadata versions
-    if (metadata?.sortedVersions) {
+    if (this.sortedVersions) {
       const version = this.version;
-      const meta = version
-        ? metadata.sortedVersions.find((v) => v.version == version)
-        : metadata.sortedVersions[0];
+      const meta = version ? this.sortedVersions.find((v) => v.version == version) : this.sortedVersions[0];
       if (meta?.destroyed) {
         return 'destroyed';
       }
@@ -165,31 +189,37 @@ export default class KvSecretDetails extends Component {
   }
 
   get showUndelete() {
-    const { secret } = this.args;
-    if (secret.canUndelete) {
+    const { canUndelete } = this.args.capabilities;
+    if (canUndelete) {
       return this.versionState === 'deleted';
     }
     return false;
   }
 
   get showDelete() {
-    const { secret } = this.args;
-    if (secret.canDeleteVersion || secret.canDeleteLatestVersion) {
+    const { canDeleteVersion, canDeleteLatestVersion } = this.args.capabilities;
+    if (canDeleteVersion || canDeleteLatestVersion) {
       return this.versionState === 'created' || this.versionState === '';
     }
     return false;
   }
 
+  get isSecretDeleted() {
+    return isDeleted(this.args.secret.deletion_time);
+  }
+
   get showDestroy() {
-    const { secret } = this.args;
-    if (secret.canDestroyVersion) {
+    const { canDestroyVersion } = this.args.capabilities;
+    if (canDestroyVersion) {
       return this.versionState !== 'destroyed' && this.version;
     }
     return false;
   }
 
   get emptyState() {
-    if (!this.args.secret.canReadData) {
+    const { canReadData, canReadMetadata } = this.args.capabilities;
+
+    if (!canReadData) {
       return {
         title: 'You do not have permission to read this secret',
         message:
@@ -197,23 +227,23 @@ export default class KvSecretDetails extends Component {
       };
     }
     // only destructure if we can read secret data
-    const { version, destroyed, isSecretDeleted } = this.args.secret;
+    const { version, destroyed } = this.args.secret;
     if (destroyed) {
       return {
         title: `Version ${version} of this secret has been permanently destroyed`,
         message: `A version that has been permanently deleted cannot be restored. ${
-          this.args.secret.canReadMetadata
+          canReadMetadata
             ? ' You can view other versions of this secret in the Version History tab above.'
             : ''
         }`,
         link: '/vault/docs/secrets/kv/kv-v2',
       };
     }
-    if (isSecretDeleted) {
+    if (this.isSecretDeleted) {
       return {
         title: `Version ${version} of this secret has been deleted`,
         message: `This version has been deleted but can be undeleted. ${
-          this.args.secret.canReadMetadata
+          canReadMetadata
             ? 'View other versions of this secret by clicking the Version History tab above.'
             : ''
         }`,
diff --git a/ui/lib/kv/addon/components/page/secret/edit.hbs b/ui/lib/kv/addon/components/page/secret/edit.hbs
index 0fcf1aebf18..a44331c2e3d 100644
--- a/ui/lib/kv/addon/components/page/secret/edit.hbs
+++ b/ui/lib/kv/addon/components/page/secret/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <KvPageHeader @breadcrumbs={{@breadcrumbs}} @pageTitle="Create New Version">
   <:toolbarFilters>
@@ -16,14 +16,15 @@
     <A.Title>Warning</A.Title>
     <A.Description>
       You are creating a new version based on data from Version
-      {{@previousVersion}}. The current version for
-      <code>{{@secret.path}}</code>
+      {{@secret.version}}. The current version for
+      <code>{{@path}}</code>
       is Version
-      {{@currentVersion}}.
+      {{@metadata.current_version}}.
     </A.Description>
   </Hds::Alert>
 {{/if}}
-{{#if @noReadAccess}}
+
+{{#if (eq @secret.failReadErrorCode 403)}}
   <Hds::Alert data-test-secret-no-read-alert @type="inline" @color="warning" class="has-top-bottom-margin" as |A|>
     <A.Title>Warning</A.Title>
     <A.Description>
@@ -32,59 +33,26 @@
   </Hds::Alert>
 {{/if}}
 
-<form {{on "submit" (perform this.save)}}>
-  <div class="box is-sideless is-fullwidth is-bottomless">
-    <NamespaceReminder @mode="create" @noun="secret" />
-    <MessageError @model={{@secret}} @errorMessage={{this.errorMessage}} />
-
-    <KvDataFields
-      @showJson={{this.showJsonView}}
-      @secret={{@secret}}
-      @modelValidations={{this.modelValidations}}
-      @type="edit"
-    />
-
-    <div class="has-top-margin-m">
-      <Toggle @name="Show diff" @onChange={{fn (mut this.showDiff)}} @checked={{this.showDiff}}>
-        <span class="ttl-picker-label is-large">Show diff</span><br />
-        <div class="description has-text-grey" data-test-diff-description>{{if
-            this.diffDelta
-            "Showing the diff will reveal secret values"
-            "No changes to show. Update secret to view diff"
-          }}</div>
-        {{#if this.showDiff}}
-          <div class="form-section visual-diff text-grey-lightest background-color-black has-top-margin-s">
-            <pre data-test-visual-diff>{{sanitized-html this.visualDiff}}</pre>
-          </div>
-        {{/if}}
-      </Toggle>
-    </div>
-  </div>
-  <div class="box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button
-        @text="Save"
-        @icon={{if this.save.isRunning "loading"}}
-        type="submit"
-        disabled={{this.save.isRunning}}
-        data-test-kv-save
-      />
-      <Hds::Button
-        @text="Cancel"
-        @color="secondary"
-        class="has-left-margin-s"
-        disabled={{this.save.isRunning}}
-        {{on "click" this.onCancel}}
-        data-test-kv-cancel
-      />
-    </div>
-    {{#if this.invalidFormAlert}}
-      <AlertInline
-        data-test-invalid-form-alert
-        class="has-top-padding-s"
-        @type="danger"
-        @message={{this.invalidFormAlert}}
-      />
-    {{/if}}
+<KvCreateEditForm
+  @form={{@form}}
+  @path={{@path}}
+  @backend={{@backend}}
+  @showJson={{this.showJsonView}}
+  @onChange={{this.onSecretDataUpdate}}
+>
+  <div class="has-top-margin-m">
+    <Toggle @name="Show diff" @onChange={{fn (mut this.showDiff)}} @checked={{this.showDiff}}>
+      <span class="ttl-picker-label is-large">Show diff</span><br />
+      <div class="description has-text-grey" data-test-diff-description>{{if
+          this.diffDelta
+          "Showing the diff will reveal secret values"
+          "No changes to show. Update secret to view diff"
+        }}</div>
+      {{#if this.showDiff}}
+        <div class="form-section visual-diff text-grey-lightest background-color-black has-top-margin-s">
+          <pre data-test-visual-diff>{{sanitized-html this.visualDiff}}</pre>
+        </div>
+      {{/if}}
+    </Toggle>
   </div>
-</form>
\ No newline at end of file
+</KvCreateEditForm>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/page/secret/edit.js b/ui/lib/kv/addon/components/page/secret/edit.js
index cced8f6ba60..80021bb2850 100644
--- a/ui/lib/kv/addon/components/page/secret/edit.js
+++ b/ui/lib/kv/addon/components/page/secret/edit.js
@@ -1,48 +1,43 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Component from '@glimmer/component';
 import { action } from '@ember/object';
+import Component from '@glimmer/component';
 import { tracked } from '@glimmer/tracking';
-import { task } from 'ember-concurrency';
-import { service } from '@ember/service';
-import errorMessage from 'vault/utils/error-message';
 import { isAdvancedSecret } from 'core/utils/advanced-secret';
 
 /**
  * @module KvSecretEdit is used for creating a new version of a secret
  *
  * <Page::Secret::Edit
+ *  @form={{this.model.form}}
  *  @secret={{this.model.newVersion}}
- *  @previousVersion={{this.model.secret.version}}
- *  @currentVersion={{this.model.metadata.currentVersion}}
+ *  @metadata={{this.model.metadata}}
+ *  @path={{this.model.path}}
+ *  @backend={{this.model.backend}}
  *  @breadcrumbs={{this.breadcrumbs}
  * />
  *
- * @param {model} secret - Ember data model: 'kv/data', the new record for the new secret version saved by the form
- * @param {number} previousVersion - previous secret version number
- * @param {number} currentVersion - current secret version, comes from the metadata endpoint
+ * @param {Form} form - kv form
+ * @param {object} secret - secret data
+ * @param {object} metadata - secret metadata
+ * @param {string} path - secret path
+ * @param {string} backend - secret mount path
  * @param {array} breadcrumbs - breadcrumb objects to render in page header
  */
 
 /* eslint-disable no-undef */
 export default class KvSecretEdit extends Component {
-  @service controlGroup;
-  @service flashMessages;
-  @service router;
-
   @tracked showJsonView = false;
   @tracked showDiff = false;
-  @tracked errorMessage;
-  @tracked modelValidations;
-  @tracked invalidFormAlert;
-  originalSecret;
+  @tracked updatedSecret;
 
   constructor() {
     super(...arguments);
-    this.originalSecret = JSON.stringify(this.args.secret.secretData || {});
+    this.originalSecret = JSON.stringify(this.args.form.data.secretData || {});
+    this.updatedSecret = this.args.form.data.secretData || {};
     if (isAdvancedSecret(this.originalSecret)) {
       // Default to JSON view if advanced
       this.showJsonView = true;
@@ -50,58 +45,31 @@ export default class KvSecretEdit extends Component {
   }
 
   get showOldVersionAlert() {
-    const { currentVersion, previousVersion } = this.args;
+    const { secret, metadata } = this.args;
     // isNew check prevents alert from flashing after save but before route transitions
-    if (!currentVersion || !previousVersion || !this.args.secret.isNew) return false;
-    if (currentVersion !== previousVersion) return true;
+    if (metadata?.current_version && secret?.version) {
+      return metadata.current_version !== secret.version;
+    }
     return false;
   }
 
   get diffDelta() {
     const oldData = JSON.parse(this.originalSecret);
-    const newData = this.args.secret.secretData;
-
     const diffpatcher = jsondiffpatch.create({});
-    return diffpatcher.diff(oldData, newData);
+    return diffpatcher.diff(oldData, this.updatedSecret);
   }
 
   get visualDiff() {
-    if (!this.showDiff) return null;
-    const newData = this.args.secret.secretData;
-    return this.diffDelta
-      ? jsondiffpatch.formatters.html.format(this.diffDelta, newData)
-      : JSON.stringify(newData, undefined, 2);
-  }
-
-  @task
-  *save(event) {
-    event.preventDefault();
-    try {
-      const { isValid, state, invalidFormMessage } = this.args.secret.validate();
-      this.modelValidations = isValid ? null : state;
-      this.invalidFormAlert = invalidFormMessage;
-      if (isValid) {
-        const { secret } = this.args;
-        yield secret.save();
-        this.flashMessages.success(`Successfully created new version of ${secret.path}.`);
-        this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.details', {
-          queryParams: { version: secret?.version },
-        });
-      }
-    } catch (error) {
-      let message = errorMessage(error);
-      if (error.message === 'Control Group encountered') {
-        this.controlGroup.saveTokenFromError(error);
-        const err = this.controlGroup.logFromError(error);
-        message = err.content;
-      }
-      this.errorMessage = message;
-      this.invalidFormAlert = 'There was an error submitting this form.';
+    if (this.showDiff) {
+      return this.diffDelta
+        ? htmlformatter.format(this.diffDelta, this.updatedSecret)
+        : JSON.stringify(this.updatedSecret, undefined, 2);
     }
+    return null;
   }
 
   @action
-  onCancel() {
-    this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.details');
+  onSecretDataUpdate(value) {
+    this.updatedSecret = value;
   }
 }
diff --git a/ui/lib/kv/addon/components/page/secret/metadata/details.hbs b/ui/lib/kv/addon/components/page/secret/metadata/details.hbs
index 0c07e6c942c..da4c324d37a 100644
--- a/ui/lib/kv/addon/components/page/secret/metadata/details.hbs
+++ b/ui/lib/kv/addon/components/page/secret/metadata/details.hbs
@@ -1,29 +1,45 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<KvPageHeader @breadcrumbs={{@breadcrumbs}} @pageTitle={{@path}}>
+<KvPageHeader @breadcrumbs={{@breadcrumbs}} @secretPath={{@path}}>
   <:tabLinks>
-    <li><LinkTo @route="secret.details" data-test-secrets-tab="Secret">Secret</LinkTo></li>
-    <li><LinkTo @route="secret.metadata.index" data-test-secrets-tab="Metadata">Metadata</LinkTo></li>
-    <li><LinkTo @route="secret.paths" data-test-secrets-tab="Paths">Paths</LinkTo></li>
-    {{#if @secret.canReadMetadata}}
-      <li><LinkTo @route="secret.metadata.versions" data-test-secrets-tab="Version History">Version History</LinkTo></li>
+    <li>
+      <LinkTo @route="secret.index" @models={{array @backend @path}} data-test-secrets-tab="Overview">Overview</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.details" @models={{array @backend @path}} data-test-secrets-tab="Secret">Secret</LinkTo>
+    </li>
+    <li>
+      <LinkTo
+        @route="secret.metadata.index"
+        @models={{array @backend @path}}
+        data-test-secrets-tab="Metadata"
+      >Metadata</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.paths" @models={{array @backend @path}} data-test-secrets-tab="Paths">Paths</LinkTo>
+    </li>
+    {{#if @capabilities.canReadMetadata}}
+      <li>
+        <LinkTo
+          @route="secret.metadata.versions"
+          @models={{array @backend @path}}
+          data-test-secrets-tab="Version History"
+        >Version History</LinkTo>
+      </li>
     {{/if}}
   </:tabLinks>
 
   <:toolbarActions>
-    {{#if @secret.canDeleteMetadata}}
-      <KvDeleteModal
-        @mode="delete-metadata"
-        @metadata={{@metadata}}
-        @onDelete={{this.onDelete}}
-        @text="Permanently delete"
-      />
+    {{#if @capabilities.canDeleteMetadata}}
+      <KvDeleteModal @mode="delete-metadata" @onDelete={{this.onDelete}} @text="Permanently delete" />
     {{/if}}
-    {{#if @secret.canUpdateMetadata}}
-      <ToolbarLink @route="secret.metadata.edit" data-test-edit-metadata>Edit metadata</ToolbarLink>
+    {{#if @capabilities.canUpdateMetadata}}
+      <ToolbarLink @route="secret.metadata.edit" @models={{array @backend @path}} data-test-edit-metadata>
+        Edit metadata
+      </ToolbarLink>
     {{/if}}
   </:toolbarActions>
 </KvPageHeader>
@@ -32,48 +48,83 @@
   Custom metadata
 </h2>
 <div class="box is-fullwidth is-sideless is-paddingless is-marginless" data-test-kv-custom-metadata-section>
-  {{#if (or @metadata.canReadMetadata @secret.canReadData)}}
-    {{#each-in this.customMetadata as |key value|}}
-      <InfoTableRow @alwaysRender={{false}} @label={{key}} @value={{value}} />
-    {{else}}
-      <EmptyState
-        @title="No custom metadata"
-        @bottomBorder={{true}}
-        @message="This data is version-agnostic and is usually used to describe the secret being stored."
-      >
-        {{#if @secret.canUpdateMetadata}}
-          <Hds::Link::Standalone
-            @icon="plus"
-            @text="Add metadata"
-            @route="secret.metadata.edit"
-            @model={{@path}}
-            data-test-add-custom-metadata
-          />
-        {{/if}}
-      </EmptyState>
-    {{/each-in}}
+  {{#each-in this.customMetadata as |key value|}}
+    <InfoTableRow @alwaysRender={{false}} @label={{key}} @value={{value}} />
   {{else}}
-    <EmptyState
-      @title="You do not have access to read custom metadata"
-      @message="In order to read custom metadata you either need read access to the secret data and/or read access to metadata."
-    />
-  {{/if}}
+    {{#if (and (not @capabilities.canReadMetadata) (not @capabilities.canReadData))}}
+      <EmptyState
+        @title="You do not have access to read custom metadata"
+        @message="In order to read custom metadata you either need read access to the secret data and/or read access to metadata."
+      />
+    {{else}}
+      {{! Offer opportunity to manually request /data/ for custom_metadata }}
+      {{#if this.error.isControlGroup}}
+        <ControlGroupInlineError @error={{this.error}} class="has-top-margin-s has-bottom-margin-s" />
+      {{else if this.error}}
+        <MessageError @errorMessage={{this.error}} />
+      {{/if}}
+      {{#if this.canRequestData}}
+        <EmptyState
+          @title="Request custom metadata?"
+          @bottomBorder={{true}}
+          @message="You do not have access to the metadata endpoint but you can retrieve custom metadata from the secret data endpoint."
+        >
+          <div class="is-block">
+            <Hds::Alert @type="compact" @color="critical" class="has-top-margin-xs" as |A|>
+              <A.Description>
+                Sensitive secret data will be retrieved.
+              </A.Description>
+            </Hds::Alert>
+            <Hds::Button
+              class="has-top-margin-xs"
+              @text="Request data"
+              @icon="reload"
+              @iconPosition="trailing"
+              @isFullWidth={{true}}
+              data-test-request-data
+              {{on "click" this.requestData}}
+            />
+          </div>
+        </EmptyState>
+      {{else}}
+        <EmptyState
+          @title="No custom metadata"
+          @bottomBorder={{true}}
+          @message="This data is version-agnostic and is usually used to describe the secret being stored."
+        >
+          {{#if @capabilities.canUpdateMetadata}}
+            <Hds::Link::Standalone
+              @icon="plus"
+              @text="Add metadata"
+              @route="secret.metadata.edit"
+              @models={{array @backend @path}}
+              data-test-add-custom-metadata
+            />
+          {{/if}}
+        </EmptyState>
+      {{/if}}
+    {{/if}}
+  {{/each-in}}
 </div>
 <section data-test-kv-metadata-section>
   <h2 class="title is-5 has-bottom-padding-s has-top-margin-l">
     Secret metadata
   </h2>
-  {{#if @secret.canReadMetadata}}
+  {{#if @metadata}}
     <div class="box is-fullwidth is-sideless is-paddingless is-marginless" data-test-kv-metadata-section>
       <InfoTableRow @alwaysRender={{true}} @label="Last updated">
-        <KvTooltipTimestamp @timestamp={{@metadata.updatedTime}} />
+        <KvTooltipTimestamp @timestamp={{@metadata.updated_time}} />
       </InfoTableRow>
-      <InfoTableRow @alwaysRender={{true}} @label="Maximum versions" @value={{@metadata.maxVersions}} />
-      <InfoTableRow @alwaysRender={{true}} @label="Check-and-Set required" @value={{@metadata.casRequired}} />
+      <InfoTableRow @alwaysRender={{true}} @label="Maximum versions" @value={{@metadata.max_versions}} />
+      <InfoTableRow @alwaysRender={{true}} @label="Check-and-Set required" @value={{@metadata.cas_required}} />
       <InfoTableRow
         @alwaysRender={{true}}
         @label="Delete version after"
-        @value={{if (eq @metadata.deleteVersionAfter "0s") "Never delete" (format-duration @metadata.deleteVersionAfter)}}
+        @value={{if
+          (eq @metadata.delete_version_after "0s")
+          "Never delete"
+          (format-duration @metadata.delete_version_after)
+        }}
       />
     </div>
   {{else}}
diff --git a/ui/lib/kv/addon/components/page/secret/metadata/details.js b/ui/lib/kv/addon/components/page/secret/metadata/details.js
index 1f758ee4886..6cfa668fa5a 100644
--- a/ui/lib/kv/addon/components/page/secret/metadata/details.js
+++ b/ui/lib/kv/addon/components/page/secret/metadata/details.js
@@ -1,52 +1,86 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
 import { service } from '@ember/service';
+import errorMessage from 'vault/utils/error-message';
+import { waitFor } from '@ember/test-waiters';
 
 /**
- * @module KvSecretMetadataDetails renders the details view for kv/metadata.
- * It also renders a button to delete metadata.
+ * @module KvSecretMetadataDetails renders the details view for kv metadata and button to delete (which deletes the whole secret) or edit metadata.
  * <Page::Secret::Metadata::Details
- *  @path={{this.model.path}}
- *  @secret={{this.model.secret}}
- *  @metadata={{this.model.metadata}}
- *  @breadcrumbs={{this.breadcrumbs}}
-  />
+ *   @backend={{this.model.backend}}
+ *   @breadcrumbs={{this.breadcrumbs}}
+ *   @capabilities={{this.model.capabilities}}
+ *   @metadata={{this.model.metadata}}
+ *   @path={{this.model.path}}
+ * />
  *
- * @param {string} path - path of kv secret 'my/secret' used as the title for the KV page header
- * @param {model} [secret] - Ember data model: 'kv/data'. Param not required for delete-metadata.
- * @param {model} metadata - Ember data model: 'kv/metadata'
+ * @param {string} backend - The name of the kv secret engine.
  * @param {array} breadcrumbs - Array to generate breadcrumbs, passed to the page header component
+ * @param {object} capabilities - capabilities for data, metadata, subkeys, delete and undelete paths
+ * @param {object} metadata - kv metadata
+ * @param {string} path - path of kv secret 'my/secret' used as the title for the KV page header
+ *
+ *
  */
 
 export default class KvSecretMetadataDetails extends Component {
+  @service controlGroup;
   @service flashMessages;
-  @service router;
-  @service store;
+  @service('app-router') router;
+  @service api;
+
+  @tracked error = null;
+  @tracked customMetadataFromData = null;
+  @tracked didRequestData = false;
 
   get customMetadata() {
-    // metadata tab is available even if user only has access to kv/data path
-    return this.args.metadata?.customMetadata || this.args.secret?.customMetadata;
+    return this.args.metadata?.custom_metadata || this.customMetadataFromData;
+  }
+
+  get canRequestData() {
+    const { canReadMetadata, canReadData } = this.args.capabilities;
+    return !canReadMetadata && canReadData && !this.didRequestData;
   }
+
   @action
   async onDelete() {
-    // The only delete option from this view is delete all versions
-    const { secret } = this.args;
+    // The only delete option from this view is delete metadata and all versions
+    const { backend, path } = this.args;
     try {
-      await secret.destroyRecord({
-        adapterOptions: { deleteType: 'destroy-all-versions', deleteVersions: this.version },
-      });
-      this.store.clearDataset('kv/metadata'); // Clear out the store cache so that the metadata/list view is updated.
+      await this.api.secrets.kvV2DeleteMetadataAndAllVersions(path, backend);
       this.flashMessages.success(
-        `Successfully deleted the metadata and all version data for the secret ${secret.path}.`
+        `Successfully deleted the metadata and all version data for the secret ${path}.`
       );
       this.router.transitionTo('vault.cluster.secrets.backend.kv.list');
     } catch (err) {
-      this.flashMessages.danger(`There was an issue deleting ${secret.path} metadata.`);
+      this.flashMessages.danger(`There was an issue deleting ${path} metadata. \n ${errorMessage(err)}`);
+    }
+  }
+
+  @action
+  @waitFor
+  async requestData() {
+    const { backend, path } = this.args;
+    try {
+      const { metadata } = await this.api.secrets.kvV2Read(path, backend);
+      this.customMetadataFromData = metadata.custom_metadata;
+      this.didRequestData = true;
+    } catch (err) {
+      const { message, response } = await this.api.parseError(err);
+      if (response.isControlGroupError) {
+        this.controlGroup.saveTokenFromError(response);
+        this.error = this.controlGroup.logFromError(response);
+        this.error.isControlGroup = true;
+      } else {
+        this.error.isControlGroup = false;
+        this.error = message;
+      }
     }
   }
 }
diff --git a/ui/lib/kv/addon/components/page/secret/metadata/edit.hbs b/ui/lib/kv/addon/components/page/secret/metadata/edit.hbs
index 0c0dc4147a5..e62676365f3 100644
--- a/ui/lib/kv/addon/components/page/secret/metadata/edit.hbs
+++ b/ui/lib/kv/addon/components/page/secret/metadata/edit.hbs
@@ -1,11 +1,11 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <KvPageHeader @breadcrumbs={{@breadcrumbs}} @pageTitle="Edit Secret Metadata" />
 
-{{#if @metadata.canUpdateMetadata}}
+{{#if @capabilities.canUpdateMetadata}}
   <hr class="is-marginless has-background-gray-200" />
   <p class="has-top-margin-m has-bottom-margin-m">
     The options below are all version-agnostic; they apply to all versions of this secret.
@@ -14,8 +14,9 @@
     <div class="box is-sideless is-fullwidth is-marginless">
       <NamespaceReminder @mode="update" @noun="KV secret metadata" />
       <MessageError @errorMessage={{this.errorBanner}} class="has-top-margin-s" />
-      <KvMetadataFields @metadata={{@metadata}} @modelValidations={{this.modelValidations}} />
+      <KvMetadataFields @form={{@form}} @modelValidations={{this.modelValidations}} />
     </div>
+
     <div class="field is-grouped is-grouped-split is-fullwidth box is-bottomless">
       <div class="has-top-padding-s">
         <Hds::Button
@@ -30,7 +31,7 @@
           @color="secondary"
           class="has-left-margin-s"
           disabled={{this.save.isRunning}}
-          {{on "click" this.cancel}}
+          {{on "click" @onCancel}}
           data-test-kv-cancel
         />
         {{#if this.invalidFormAlert}}
@@ -57,6 +58,7 @@
       @iconPosition="trailing"
       @text="KV v2 metadata API docs"
       @href={{doc-link "/vault/api-docs/secret/kv/kv-v2#create-update-metadata"}}
+      @isHrefExternal={{true}}
     />
   </EmptyState>
 {{/if}}
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/page/secret/metadata/edit.js b/ui/lib/kv/addon/components/page/secret/metadata/edit.js
index f364d9ab3da..32f11b96eec 100644
--- a/ui/lib/kv/addon/components/page/secret/metadata/edit.js
+++ b/ui/lib/kv/addon/components/page/secret/metadata/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,47 +7,45 @@ import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { task } from 'ember-concurrency';
 import { tracked } from '@glimmer/tracking';
-import errorMessage from 'vault/utils/error-message';
-import { action } from '@ember/object';
 
 /**
  * @module KvSecretMetadataEdit
  * This component renders the view for editing a kv secret's metadata.
  * While secret data and metadata are created on the same view, they are edited on different views/routes.
  *
- * @param {array} metadata - The kv/metadata model. It is version agnostic.
+ * @param {Form} form - kv form
+ * @param {string} backend - mount path of the kv secret engine
  * @param {array} breadcrumbs - Breadcrumbs as an array of objects that contain label, route, and modelId. They are updated via the util kv-breadcrumbs to handle dynamic *pathToSecret on the list-directory route.
+ * @param {object} capabilities - capabilities for data, metadata, subkeys, delete and undelete paths
  * @callback onCancel - Callback triggered when cancel button is clicked that transitions to the metadata details route.
  * @callback onSave - Callback triggered on save success that transitions to the metadata details route.
  */
 
 export default class KvSecretMetadataEditComponent extends Component {
   @service flashMessages;
+  @service api;
+
   @tracked errorBanner = '';
   @tracked invalidFormAlert = '';
   @tracked modelValidations = null;
 
-  @action
-  cancel() {
-    this.args.metadata.rollbackAttributes();
-    this.args.onCancel();
-  }
-
   @task
   *save(event) {
     event.preventDefault();
     try {
-      const { isValid, state, invalidFormMessage } = this.args.metadata.validate();
+      const { isValid, state, invalidFormMessage, data } = this.args.form.toJSON();
       this.modelValidations = isValid ? null : state;
       this.invalidFormAlert = invalidFormMessage;
+
       if (isValid) {
-        const { path } = this.args.metadata;
-        yield this.args.metadata.save();
+        const { path, ...metadata } = data;
+        yield this.api.secrets.kvV2WriteMetadata(path, this.args.backend, metadata);
         this.flashMessages.success(`Successfully updated ${path}'s metadata.`);
         this.args.onSave();
       }
     } catch (error) {
-      this.errorBanner = errorMessage(error);
+      const { message } = yield this.api.parseError(error);
+      this.errorBanner = message;
       this.invalidFormAlert = 'There was an error submitting this form.';
     }
   }
diff --git a/ui/lib/kv/addon/components/page/secret/metadata/version-diff.hbs b/ui/lib/kv/addon/components/page/secret/metadata/version-diff.hbs
index 70dba08dc67..f52624e8512 100644
--- a/ui/lib/kv/addon/components/page/secret/metadata/version-diff.hbs
+++ b/ui/lib/kv/addon/components/page/secret/metadata/version-diff.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <KvPageHeader @breadcrumbs={{@breadcrumbs}} @pageTitle="Version Diff">
   <:toolbarFilters>
diff --git a/ui/lib/kv/addon/components/page/secret/metadata/version-diff.js b/ui/lib/kv/addon/components/page/secret/metadata/version-diff.js
index e250c7f2402..6ee2ff3c991 100644
--- a/ui/lib/kv/addon/components/page/secret/metadata/version-diff.js
+++ b/ui/lib/kv/addon/components/page/secret/metadata/version-diff.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,9 @@ import Component from '@glimmer/component';
 import { action } from '@ember/object';
 import { service } from '@ember/service';
 import { tracked } from '@glimmer/tracking';
-import { kvDataPath } from 'vault/utils/kv-path';
+import sortedVersions from 'kv/helpers/sorted-versions';
+import getCurrentSecret from 'kv/helpers/current-secret';
+import isDeleted from 'kv/helpers/is-deleted';
 
 /**
  * @module KvSecretMetadataVersionDiff renders the version diff comparison
@@ -18,7 +20,7 @@ import { kvDataPath } from 'vault/utils/kv-path';
  *  @breadcrumbs={{this.breadcrumbs}}
  * />
  *
- * @param {model} metadata - Ember data model: 'kv/metadata'
+ * @param {object} metadata - secret metadata
  * @param {string} path - path to request secret data for selected version
  * @param {string} backend - kv secret mount to make network request
  * @param {array} breadcrumbs - Array to generate breadcrumbs, passed to the page header component
@@ -26,7 +28,8 @@ import { kvDataPath } from 'vault/utils/kv-path';
 
 /* eslint-disable no-undef */
 export default class KvSecretMetadataVersionDiff extends Component {
-  @service store;
+  @service api;
+
   @tracked leftVersion;
   @tracked rightVersion;
   @tracked visualDiff;
@@ -36,20 +39,25 @@ export default class KvSecretMetadataVersionDiff extends Component {
     super(...arguments);
 
     // initialize with most recently (before current), active version on left
-    const olderVersions = this.args.metadata.sortedVersions.slice(1);
-    const recentlyActive = olderVersions.find((v) => !v.destroyed && !v.isSecretDeleted);
+    const olderVersions = this.sortedVersions.slice(1);
+    const recentlyActive = olderVersions.find((v) => !v.destroyed && !isDeleted(v.deletion_time));
     this.leftVersion = Number(recentlyActive?.version);
-    this.rightVersion = this.args.metadata.currentVersion;
+    this.rightVersion = this.args.metadata.current_version;
 
     // this diff is from older to newer (current) secret data
     this.createVisualDiff();
   }
 
+  get sortedVersions() {
+    return sortedVersions(this.args.metadata.versions);
+  }
+
   // this can only be true on initialization if the current version is inactive
   // selecting a deleted/destroyed version is otherwise disabled
   get deactivatedState() {
-    const { currentVersion, currentSecret } = this.args.metadata;
-    return this.rightVersion === currentVersion && currentSecret.isDeactivated ? currentSecret.state : '';
+    const { current_version } = this.args.metadata;
+    const currentSecret = getCurrentSecret(this.args.metadata);
+    return this.rightVersion === current_version && currentSecret.isDeactivated ? currentSecret.state : '';
   }
 
   @action
@@ -67,16 +75,18 @@ export default class KvSecretMetadataVersionDiff extends Component {
 
     this.statesMatch = !delta;
     this.visualDiff = delta
-      ? jsondiffpatch.formatters.html.format(delta, leftSecretData)
+      ? htmlformatter.format(delta, leftSecretData)
       : JSON.stringify(rightSecretData, undefined, 2);
   }
 
   async fetchSecretData(version) {
     const { backend, path } = this.args;
-    // check the store first, avoiding an extra network request if possible.
-    const storeData = await this.store.peekRecord('kv/data', kvDataPath(backend, path, version));
-    const data = storeData ? storeData : await this.store.queryRecord('kv/data', { backend, path, version });
-
-    return data?.secretData;
+    const initOverride = version ? (context) => this.api.addQueryParams(context, { version }) : undefined;
+    try {
+      const { data } = await this.api.secrets.kvV2Read(path, backend, initOverride);
+      return data;
+    } catch (e) {
+      // capabilities checks are higher up the tree so this request should not fail
+    }
   }
 }
diff --git a/ui/lib/kv/addon/components/page/secret/metadata/version-history.hbs b/ui/lib/kv/addon/components/page/secret/metadata/version-history.hbs
index ef4eacf1e81..abcfd2fdc97 100644
--- a/ui/lib/kv/addon/components/page/secret/metadata/version-history.hbs
+++ b/ui/lib/kv/addon/components/page/secret/metadata/version-history.hbs
@@ -1,36 +1,56 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<KvPageHeader @breadcrumbs={{@breadcrumbs}} @pageTitle={{@path}}>
+<KvPageHeader @breadcrumbs={{@breadcrumbs}} @secretPath={{@path}}>
   <:tabLinks>
-    <li><LinkTo @route="secret.details" data-test-secrets-tab="Secret">Secret</LinkTo></li>
-    <li><LinkTo @route="secret.metadata.index" data-test-secrets-tab="Metadata">Metadata</LinkTo></li>
-    <li><LinkTo @route="secret.paths" data-test-secrets-tab="Paths">Paths</LinkTo></li>
-    <li><LinkTo @route="secret.metadata.versions" data-test-secrets-tab="Version History">Version History</LinkTo></li>
+    <li>
+      <LinkTo @route="secret.index" @models={{array @backend @path}} data-test-secrets-tab="Overview">Overview</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.details" @models={{array @backend @path}} data-test-secrets-tab="Secret">Secret</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.metadata.index" @models={{array @backend @path}} data-test-secrets-tab="Metadata">
+        Metadata
+      </LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.paths" @models={{array @backend @path}} data-test-secrets-tab="Paths">Paths</LinkTo>
+    </li>
+    <li>
+      <LinkTo
+        @route="secret.metadata.versions"
+        @models={{array @backend @path}}
+        data-test-secrets-tab="Version History"
+        current-when={{true}}
+      >
+        Version History
+      </LinkTo>
+    </li>
   </:tabLinks>
 
   <:toolbarActions>
-    {{#if @metadata.canReadMetadata}}
-      <ToolbarLink @route="secret.metadata.diff">Version diff</ToolbarLink>
+    {{#if @capabilities.canReadMetadata}}
+      <ToolbarLink @route="secret.metadata.diff" @models={{array @backend @path}}>Version diff</ToolbarLink>
     {{/if}}
   </:toolbarActions>
 </KvPageHeader>
 
-{{#if @metadata.canReadMetadata}}
+{{#if @capabilities.canReadMetadata}}
   <div class="sub-text has-text-weight-semibold is-flex-end has-short-padding">
-    <KvTooltipTimestamp @text="Secret last updated" @timestamp={{@metadata.updatedTime}} />
+    <KvTooltipTimestamp @text="Secret last updated" @timestamp={{@metadata.updated_time}} />
   </div>
-  {{#each @metadata.sortedVersions as |versionData|}}
+  {{#each (sorted-versions @metadata.versions) as |versionData|}}
     <LinkedBlock
       class="list-item-row"
-      @params={{array "vault.cluster.secrets.backend.kv.secret.details" @metadata.path}}
+      @params={{array "vault.cluster.secrets.backend.kv.secret.details" @backend @path}}
       @queryParams={{hash version=versionData.version}}
       data-test-version-linked-block={{versionData.version}}
     >
       <div class="level is-mobile">
-        <div class="is-grid is-grid-3-columns is-three-fourths-width">
+        <div class="is-grid is-grid-3-columns three-fourths-width">
           {{! version number and icon }}
           <div class="align-self-center">
             <Icon @name="history" class="has-text-grey" data-test-version />
@@ -47,14 +67,14 @@
                   <Icon @name="x-square-fill" />Destroyed
                 </span>
               </div>
-            {{else if versionData.isSecretDeleted}}
+            {{else if (is-deleted versionData.deletion_time)}}
               <div>
                 <span class="has-text-grey is-size-8 is-block">
                   <Icon @name="x-square-fill" />
                   <KvTooltipTimestamp @text="Deleted" @timestamp={{versionData.deletion_time}} />
                 </span>
               </div>
-            {{else if (loose-equal versionData.version @metadata.currentVersion)}}
+            {{else if (loose-equal versionData.version @metadata.current_version)}}
               <div>
                 <span class="has-text-success is-size-8 is-block">
                   <Icon @name="check-circle-fill" />Current
@@ -78,17 +98,24 @@
                 data-test-popup-menu-trigger
               />
               <dd.Interactive
-                @text="View version {{versionData.version}}"
                 @route="secret.details"
+                @models={{array @backend @path}}
                 @query={{hash version=versionData.version}}
-              />
-              {{#if (and @metadata.canCreateVersionData (not versionData.destroyed) (not versionData.isSecretDeleted))}}
+              >View version {{versionData.version}}</dd.Interactive>
+              {{#if
+                (and
+                  @capabilities.canCreateVersionData (not versionData.destroyed) (not (is-deleted versionData.deletion_time))
+                )
+              }}
                 <dd.Interactive
-                  @text="Create new version from {{versionData.version}}"
                   @route="secret.details.edit"
+                  @models={{array @backend @path}}
                   @query={{hash version=versionData.version}}
                   data-test-create-new-version-from={{versionData.version}}
-                />
+                >
+                  Create new version from
+                  {{versionData.version}}
+                </dd.Interactive>
               {{/if}}
             </Hds::Dropdown>
           </div>
diff --git a/ui/lib/kv/addon/components/page/secret/overview.hbs b/ui/lib/kv/addon/components/page/secret/overview.hbs
new file mode 100644
index 00000000000..802d5a15bb6
--- /dev/null
+++ b/ui/lib/kv/addon/components/page/secret/overview.hbs
@@ -0,0 +1,109 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<KvPageHeader @breadcrumbs={{@breadcrumbs}} @secretPath={{@path}}>
+  <:tabLinks>
+    <li>
+      <LinkTo @route="secret.index" @models={{array @backend @path}} data-test-secrets-tab="Overview">Overview</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.details" @models={{array @backend @path}} data-test-secrets-tab="Secret">Secret</LinkTo>
+    </li>
+    <li>
+      <LinkTo
+        @route="secret.metadata.index"
+        @models={{array @backend @path}}
+        data-test-secrets-tab="Metadata"
+      >Metadata</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.paths" @models={{array @backend @path}} data-test-secrets-tab="Paths">Paths</LinkTo>
+    </li>
+    {{#if @capabilities.canReadMetadata}}
+      <li>
+        <LinkTo
+          @route="secret.metadata.versions"
+          @models={{array @backend @path}}
+          data-test-secrets-tab="Version History"
+        >Version History</LinkTo>
+      </li>
+    {{/if}}
+  </:tabLinks>
+  <:toolbarActions>
+  </:toolbarActions>
+</KvPageHeader>
+
+{{#if (or @metadata @subkeys.metadata)}}
+  <div class="flex row-wrap gap-24 has-top-margin-l">
+    <OverviewCard @cardTitle="Current version" @subText={{this.versionSubtext}} class="is-flex-1">
+      <:customTitle>
+        <Hds::Text::Display @weight="semibold" @size="300">
+          Current version
+          {{#if (not-eq this.secretState "created")}}
+            <Hds::Badge
+              @text={{capitalize this.secretState}}
+              @type={{if (eq this.secretState "destroyed") "outlined" "inverted"}}
+              @color={{if (eq this.secretState "destroyed") "critical"}}
+              @icon="x"
+            />
+          {{/if}}
+        </Hds::Text::Display>
+      </:customTitle>
+      <:action>
+        {{#if @capabilities.canUpdateData}}
+          <Hds::Link::Standalone
+            @text="Create new"
+            @route="secret.details.edit"
+            @models={{array @backend @path}}
+            @icon="plus"
+            @iconPosition="trailing"
+            data-test-action-text="Create new"
+          />
+        {{/if}}
+      </:action>
+      <:content>
+        <Hds::Text::Display @tag="p" @size="400" @weight="medium" class="has-top-margin-m">
+          {{or @metadata.current_version @subkeys.metadata.version}}
+        </Hds::Text::Display>
+      </:content>
+    </OverviewCard>
+
+    {{#if (eq this.secretState "created")}}
+      {{#let (or @metadata.updated_time @subkeys.metadata.created_time) as |timestamp|}}
+        <OverviewCard
+          @cardTitle="Secret age"
+          @subText="Current secret version age. Last updated on {{date-format timestamp}}."
+          class="is-flex-1"
+        >
+          <:action>
+            {{#if @capabilities.canReadMetadata}}
+              <Hds::Link::Standalone
+                @text="View metadata"
+                @route="secret.metadata"
+                @models={{array @backend @path}}
+                @icon="arrow-right"
+                @iconPosition="trailing"
+              />
+            {{/if}}
+          </:action>
+          <:content>
+            <Hds::Text::Display @tag="p" @size="400" @weight="medium" class="has-top-margin-m">
+              {{date-from-now timestamp}}
+            </Hds::Text::Display>
+          </:content>
+        </OverviewCard>
+      {{/let}}
+    {{/if}}
+  </div>
+{{/if}}
+
+<Hds::Card::Container @level="mid" @hasBorder={{true}} class="has-padding-l has-top-margin-l">
+  <KvPathsCard @backend={{@backend}} @path={{@path}} @isCondensed={{true}} />
+</Hds::Card::Container>
+
+{{! @subkeys is null for community edition or if a user does not have read permissions }}
+{{#if @subkeys.subkeys}}
+  <KvSubkeysCard @subkeys={{@subkeys.subkeys}} @isPatchAllowed={{@isPatchAllowed}} @backend={{@backend}} @path={{@path}} />
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/page/secret/overview.js b/ui/lib/kv/addon/components/page/secret/overview.js
new file mode 100644
index 00000000000..7a9cbe0d538
--- /dev/null
+++ b/ui/lib/kv/addon/components/page/secret/overview.js
@@ -0,0 +1,64 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { dateFormat } from 'core/helpers/date-format';
+import currentSecret from 'kv/helpers/current-secret';
+import isDeleted from 'kv/helpers/is-deleted';
+
+/**
+ * @module KvSecretOverview
+ * <Page::Secret::Overview
+ *   @backend={{this.model.backend}}
+ *   @breadcrumbs={{this.breadcrumbs}}
+ *   @capabilities={{this.model.capabilities}}
+ *   @isPatchAllowed={{true}}
+ *   @metadata={{this.model.metadata}}
+ *   @path={{this.model.path}}
+ *   @subkeys={{this.model.subkeys}}
+ * />
+ *
+ * @param {string} backend - kv secret mount to make network request
+ * @param {array} breadcrumbs - Array to generate breadcrumbs, passed to the page header component
+ * @param {object} capabilities - capabilities for data, metadata, subkeys, delete and undelete paths
+ * @param {boolean} isPatchAllowed - passed to KvSubkeysCard for rendering patch action. True when: (1) the version is enterprise, (2) a user has "patch" secret + "read" subkeys capabilities, (3) latest secret version is not deleted or destroyed
+ * @param {model} metadata - secret metadata
+ * @param {string} path - path to request secret data for selected version
+ * @param {object} subkeys - API response from subkeys endpoint, object with "subkeys" and "metadata" keys. This arg is null for community edition
+ */
+
+export default class KvSecretOverview extends Component {
+  get currentSecret() {
+    return currentSecret(this.args.metadata);
+  }
+  get secretState() {
+    if (this.args.metadata) {
+      return this.currentSecret?.state;
+    }
+    if (this.args.subkeys?.metadata) {
+      const { metadata } = this.args.subkeys;
+      const state = metadata.destroyed
+        ? 'destroyed'
+        : isDeleted(metadata.deletion_time)
+        ? 'deleted'
+        : 'created';
+      return state;
+    }
+    return 'created';
+  }
+
+  get versionSubtext() {
+    const state = this.secretState;
+    if (state === 'destroyed') {
+      return 'The current version of this secret has been permanently deleted and cannot be restored.';
+    }
+    if (state === 'deleted') {
+      const time = this.currentSecret?.deletionTime || this.args.subkeys?.metadata.deletion_time;
+      const date = dateFormat([time], 'MMM d yyyy, h:mm:ss aa');
+      return `The current version of this secret was deleted ${date}.`;
+    }
+    return 'The current version of this secret.';
+  }
+}
diff --git a/ui/lib/kv/addon/components/page/secret/patch.hbs b/ui/lib/kv/addon/components/page/secret/patch.hbs
new file mode 100644
index 00000000000..27969d9e11a
--- /dev/null
+++ b/ui/lib/kv/addon/components/page/secret/patch.hbs
@@ -0,0 +1,73 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<KvPageHeader @breadcrumbs={{@breadcrumbs}} @pageTitle="Patch Secret to New Version" />
+{{#if this.controlGroupError}}
+  <ControlGroupInlineError @error={{this.controlGroupError}} class="has-top-margin-s has-bottom-margin-s">
+    <:customMessage>
+      <strong>
+        You can re-submit the form once access is granted. Ask your authorizer when to attempt saving again.
+      </strong>
+    </:customMessage>
+  </ControlGroupInlineError>
+{{/if}}
+<MessageError @errorMessage={{this.errorMessage}} />
+
+<div class="box is-sideless is-fullwidth is-bottomless">
+  <NamespaceReminder @mode="patch" @noun="secret" />
+  <Hds::Form::TextInput::Field name="secret path" @value={{@path}} disabled data-test-field="Path" as |F|>
+    <F.Label>Path for this secret</F.Label>
+  </Hds::Form::TextInput::Field>
+
+  <hr class="has-background-gray-200" />
+
+  <Hds::Text::Display @tag="h2" @size="300" class="has-bottom-padding-s">Patch secret data</Hds::Text::Display>
+  <Hds::Alert @type="compact" @icon="alert-triangle-fill" @color="warning" class="has-bottom-padding-m" as |A|>
+    <A.Description>
+      The
+      <code>PATCH</code>
+      action allows you to partially update or add a key-value pair to the current version of the secret. The values will
+      remain the same in the new version if no changes are made to them.
+    </A.Description>
+  </Hds::Alert>
+
+  <Hds::Form::Radio::Group @name="patch-method" class="has-bottom-margin-m" as |G|>
+    <G.Legend>Edit via</G.Legend>
+    <G.HelperText>
+      Choose how to patch the secret data.
+      <strong>Switching to another method will reset the form data.</strong>
+    </G.HelperText>
+
+    {{#each (array "JSON" "UI") as |method|}}
+      <G.RadioField
+        @value={{method}}
+        {{on "change" this.selectPatchMethod}}
+        checked={{eq this.patchMethod method}}
+        data-test-input={{method}}
+        as |F|
+      >
+        <F.Label>{{method}}</F.Label>
+      </G.RadioField>
+    {{/each}}
+  </Hds::Form::Radio::Group>
+
+  {{#if (eq this.patchMethod "UI")}}
+    <KvPatch::Editor::Form
+      @isSaving={{this.save.isRunning}}
+      @onCancel={{this.onCancel}}
+      @onSubmit={{perform this.save}}
+      @subkeys={{@subkeys}}
+      @submitError={{this.invalidFormAlert}}
+    />
+  {{else}}
+    <KvPatch::JsonForm
+      @isSaving={{this.save.isRunning}}
+      @onCancel={{this.onCancel}}
+      @onSubmit={{perform this.save}}
+      @subkeys={{@subkeys}}
+      @submitError={{this.invalidFormAlert}}
+    />
+  {{/if}}
+</div>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/page/secret/patch.js b/ui/lib/kv/addon/components/page/secret/patch.js
new file mode 100644
index 00000000000..110efd12c61
--- /dev/null
+++ b/ui/lib/kv/addon/components/page/secret/patch.js
@@ -0,0 +1,91 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { service } from '@ember/service';
+import { action } from '@ember/object';
+import { tracked } from '@glimmer/tracking';
+import { task } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+
+/**
+ * @module KvSecretPatch
+ * @description
+ * This page template provides two methods for submitting patch data to update a KV v2 secret.
+ * Either using a key/value form KvPatch::Editor::Form or the json editor via KvPatch::JsonForm
+ *
+ * <Page::Secret::Patch
+ *  @backend="my-kv-engine"
+ *  @breadcrumbs={{this.breadcrumbs}
+ *  @metadata={{this.model.metadata}}
+ *  @path="my-secret"
+ *  @subkeys={{this.subkeys}
+ *  @subkeysMeta={{this.subkeysMeta}
+ * />
+ *
+ * @param {model} path - Secret path
+ * @param {string} backend - Mount backend path
+ * @param {model} metadata - secret metadata
+ * @param {object} subkeys - subkeys (leaf keys with null values) of kv v2 secret
+ * @param {object} subkeysMeta - metadata object returned from the /subkeys endpoint, contains: version, created_time, custom_metadata, deletion status and time
+ * @param {array} breadcrumbs - breadcrumb objects to render in page header
+ */
+
+export default class KvSecretPatch extends Component {
+  @service controlGroup;
+  @service flashMessages;
+  @service('app-router') router;
+  @service api;
+
+  @tracked controlGroupError;
+  @tracked errorMessage;
+  @tracked invalidFormAlert;
+  @tracked patchMethod = 'UI';
+
+  @action
+  selectPatchMethod(event) {
+    this.patchMethod = event.target.value;
+  }
+
+  @task
+  @waitFor
+  *save(data) {
+    const isEmpty = this.isEmpty(data);
+    if (isEmpty) {
+      this.flashMessages.info(`No changes to submit. No updates made to "${this.args.path}".`);
+      return this.onCancel();
+    }
+
+    try {
+      const { backend, path, metadata, subkeysMeta } = this.args;
+      // if no metadata permission, use subkey metadata as backup
+      const version = metadata?.current_version || subkeysMeta?.version;
+      const payload = { options: { cas: version }, data };
+      yield this.api.secrets.kvV2Patch(path, backend, payload);
+      this.flashMessages.success(`Successfully patched new version of ${path}.`);
+      this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.index');
+    } catch (error) {
+      const { message, response } = yield this.api.parseError(error);
+      if (response.isControlGroupError) {
+        this.controlGroup.saveTokenFromError(response);
+        this.controlGroupError = this.controlGroup.logFromError(response);
+        return;
+      }
+      this.errorMessage = message;
+      this.invalidFormAlert = 'There was an error submitting this form.';
+    }
+  }
+
+  @action
+  onCancel() {
+    this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.index');
+  }
+
+  isEmpty(object) {
+    const emptyKeys = Object.keys(object).every((k) => k === '');
+    const emptyValues = Object.values(object).every((v) => v === '');
+    return emptyKeys && emptyValues;
+  }
+}
diff --git a/ui/lib/kv/addon/components/page/secret/paths.hbs b/ui/lib/kv/addon/components/page/secret/paths.hbs
index 2016674cc79..c4debe3a211 100644
--- a/ui/lib/kv/addon/components/page/secret/paths.hbs
+++ b/ui/lib/kv/addon/components/page/secret/paths.hbs
@@ -1,81 +1,42 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<KvPageHeader @breadcrumbs={{@breadcrumbs}} @pageTitle={{@path}}>
+<KvPageHeader @breadcrumbs={{@breadcrumbs}} @secretPath={{@path}}>
   <:tabLinks>
-    <li><LinkTo @route="secret.details" data-test-secrets-tab="Secret">Secret</LinkTo></li>
-    <li><LinkTo @route="secret.metadata.index" data-test-secrets-tab="Metadata">Metadata</LinkTo></li>
-    <li><LinkTo @route="secret.paths" data-test-secrets-tab="Paths">Paths</LinkTo></li>
+    <li>
+      <LinkTo @route="secret.index" @models={{array @backend @path}} data-test-secrets-tab="Overview">Overview</LinkTo>
+    </li>
+    <li>
+      <LinkTo @route="secret.details" @models={{array @backend @path}} data-test-secrets-tab="Secret">Secret</LinkTo>
+    </li>
+    <li>
+      <LinkTo
+        @route="secret.metadata.index"
+        @models={{array @backend @path}}
+        data-test-secrets-tab="Metadata"
+      >Metadata</LinkTo>
+    </li>
+    <li>
+      <LinkTo
+        @route="secret.paths"
+        @models={{array @backend @path}}
+        data-test-secrets-tab="Paths"
+        @current-when={{true}}
+      >Paths</LinkTo>
+    </li>
     {{#if @canReadMetadata}}
-      <li><LinkTo @route="secret.metadata.versions" data-test-secrets-tab="Version History">Version History</LinkTo></li>
+      <li>
+        <LinkTo
+          @route="secret.metadata.versions"
+          @models={{array @backend @path}}
+          data-test-secrets-tab="Version History"
+        >Version History
+        </LinkTo>
+      </li>
     {{/if}}
   </:tabLinks>
 </KvPageHeader>
 
-<h2 class="title is-5 has-top-margin-xl">
-  Paths
-</h2>
-
-<div class="box is-fullwidth is-sideless is-paddingless is-marginless">
-  {{#each this.paths as |path|}}
-    <InfoTableRow @label={{path.label}} @labelWidth="is-one-third" @helperText={{path.text}} @truncateValue={{true}}>
-      <Hds::Copy::Button
-        @text="Copy"
-        @isIconOnly={{true}}
-        @textToCopy={{path.snippet}}
-        @onError={{(fn
-          (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
-        )}}
-        data-test-copy-button={{path.snippet}}
-        class="transparent"
-      />
-      <code class="is-flex-1 text-overflow-ellipsis has-left-margin-s">
-        {{path.snippet}}
-      </code>
-    </InfoTableRow>
-  {{/each}}
-</div>
-
-<h2 class="title is-5 has-top-margin-xl">
-  Commands
-</h2>
-
-<div class="box is-fullwidth is-sideless">
-  <h3 class="is-label">
-    CLI
-    <Hds::Badge @text="kv get" @color="neutral" />
-  </h3>
-  <p class="helper-text has-text-grey-light has-bottom-padding-s">
-    This command retrieves the value from KV secrets engine at the given key name. For other CLI commands,
-    <DocLink @path="/vault/docs/commands/kv">
-      learn more.
-    </DocLink>
-  </p>
-  <Hds::CodeBlock
-    data-test-commands="cli"
-    @language="bash"
-    @hasLineNumbers={{false}}
-    @hasCopyButton={{true}}
-    @value={{this.commands.cli}}
-  />
-
-  <h3 class="has-top-margin-l is-label">
-    API read secret version
-  </h3>
-  <p class="helper-text has-text-grey-light has-bottom-padding-s">
-    This command obtains data and metadata for the latest version of this secret. In this example, Vault is located at
-    https://127.0.0.1:8200. For other API commands,
-    <DocLink @path="/vault/api-docs/secret/kv/kv-v2">
-      learn more.
-    </DocLink>
-  </p>
-  <Hds::CodeBlock
-    data-test-commands="api"
-    @language="bash"
-    @hasLineNumbers={{false}}
-    @hasCopyButton={{true}}
-    @value={{this.commands.api}}
-  />
-</div>
\ No newline at end of file
+<KvPathsCard @backend={{@backend}} @path={{@path}} class="has-top-margin-xl" />
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/page/secret/paths.js b/ui/lib/kv/addon/components/page/secret/paths.js
deleted file mode 100644
index 716c76c3982..00000000000
--- a/ui/lib/kv/addon/components/page/secret/paths.js
+++ /dev/null
@@ -1,71 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { service } from '@ember/service';
-import { kvMetadataPath, kvDataPath } from 'vault/utils/kv-path';
-import { encodePath } from 'vault/utils/path-encoding-helpers';
-
-/**
- * @module KvSecretPaths is used to display copyable secret paths for KV v2 for CLI and API use.
- * This view is permission agnostic because args come from the views mount path and url params.
- *
- * <Page::Secret::Paths
- *  @path={{this.model.path}}
- *  @backend={{this.model.backend}}
- *  @breadcrumbs={{this.breadcrumbs}}
- *  @canReadMetadata={{this.model.secret.canReadMetadata}}
- * />
- *
- * @param {string} path - kv secret path for building the CLI and API paths
- * @param {string} backend - the secret engine mount path, comes from the secretMountPath service defined in the route
- * @param {array} breadcrumbs - Array to generate breadcrumbs, passed to the page header component
- * @param {boolean} [canReadMetadata=true] - if true, displays tab for Version History
- */
-
-export default class KvSecretPaths extends Component {
-  @service namespace;
-
-  get paths() {
-    const { backend, path } = this.args;
-    const namespace = this.namespace.path;
-    const cli = `-mount="${backend}" "${path}"`;
-    const data = kvDataPath(backend, path);
-    const metadata = kvMetadataPath(backend, path);
-
-    return [
-      {
-        label: 'API path',
-        snippet: namespace ? `/v1/${encodePath(namespace)}/${data}` : `/v1/${data}`,
-        text: 'Use this path when referring to this secret in the API.',
-      },
-      {
-        label: 'CLI path',
-        snippet: namespace ? `-namespace=${namespace} ${cli}` : cli,
-        text: 'Use this path when referring to this secret in the CLI.',
-      },
-      {
-        label: 'API path for metadata',
-        snippet: namespace ? `/v1/${encodePath(namespace)}/${metadata}` : `/v1/${metadata}`,
-        text: `Use this path when referring to this secret's metadata in the API and permanent secret deletion.`,
-      },
-    ];
-  }
-
-  get commands() {
-    const cliPath = this.paths.find((p) => p.label === 'CLI path').snippet;
-    const apiPath = this.paths.find((p) => p.label === 'API path').snippet;
-    // as a future improvement, it might be nice to use window.location.protocol here:
-    const url = `https://127.0.0.1:8200${apiPath}`;
-
-    return {
-      cli: `vault kv get ${cliPath}`,
-      api: `curl \\
-  --header "X-Vault-Token: ..." \\
-  --request GET \\
-  ${url}`,
-    };
-  }
-}
diff --git a/ui/lib/kv/addon/components/page/secrets/create.hbs b/ui/lib/kv/addon/components/page/secrets/create.hbs
index 47933c341a9..17d6627f8dd 100644
--- a/ui/lib/kv/addon/components/page/secrets/create.hbs
+++ b/ui/lib/kv/addon/components/page/secrets/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <KvPageHeader @breadcrumbs={{@breadcrumbs}} @pageTitle="Create Secret">
   <:toolbarFilters>
@@ -11,58 +11,24 @@
   </:toolbarFilters>
 </KvPageHeader>
 
-<form {{on "submit" (perform this.save)}}>
-  <div class="box is-sideless is-fullwidth is-bottomless">
-    <NamespaceReminder @mode="create" @noun="secret" />
-    <MessageError @errorMessage={{this.errorMessage}} />
-
-    <KvDataFields
-      @showJson={{this.showJsonView}}
-      @secret={{@secret}}
-      @modelValidations={{this.modelValidations}}
-      @pathValidations={{this.pathValidations}}
-      @type="create"
-    />
-
-    <ToggleButton
-      @isOpen={{this.showMetadata}}
-      @openLabel="Hide secret metadata"
-      @closedLabel="Show secret metadata"
-      @onClick={{fn (mut this.showMetadata)}}
-      class="is-block"
-      data-test-metadata-toggle
-    />
-    {{#if this.showMetadata}}
-      <div class="box has-container" data-test-metadata-section>
-        <KvMetadataFields @metadata={{@metadata}} @modelValidations={{this.modelValidations}} />
-      </div>
-    {{/if}}
-  </div>
-  <div class="box is-fullwidth is-bottomless">
-    <div class="control">
-      <Hds::Button
-        @text="Save"
-        @icon={{if this.save.isRunning "loading"}}
-        type="submit"
-        disabled={{this.save.isRunning}}
-        data-test-kv-save
-      />
-      <Hds::Button
-        @text="Cancel"
-        @color="secondary"
-        class="has-left-margin-s"
-        disabled={{this.save.isRunning}}
-        {{on "click" this.onCancel}}
-        data-test-kv-cancel
-      />
+<KvCreateEditForm
+  @form={{@form}}
+  @path={{@path}}
+  @backend={{@backend}}
+  @showJson={{this.showJsonView}}
+  as |modelValidations|
+>
+  <ToggleButton
+    @isOpen={{this.showMetadata}}
+    @openLabel="Hide secret metadata"
+    @closedLabel="Show secret metadata"
+    @onClick={{fn (mut this.showMetadata)}}
+    class="is-block"
+    data-test-metadata-toggle
+  />
+  {{#if this.showMetadata}}
+    <div class="box has-container" data-test-metadata-section>
+      <KvMetadataFields @form={{@form}} @modelValidations={{modelValidations}} />
     </div>
-    {{#if this.invalidFormAlert}}
-      <AlertInline
-        data-test-invalid-form-alert
-        class="has-top-padding-s"
-        @type="danger"
-        @message={{this.invalidFormAlert}}
-      />
-    {{/if}}
-  </div>
-</form>
\ No newline at end of file
+  {{/if}}
+</KvCreateEditForm>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/components/page/secrets/create.js b/ui/lib/kv/addon/components/page/secrets/create.js
index 0cd733b24ce..4afb93786ef 100644
--- a/ui/lib/kv/addon/components/page/secrets/create.js
+++ b/ui/lib/kv/addon/components/page/secrets/create.js
@@ -1,129 +1,28 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
-import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
-import { task } from 'ember-concurrency';
-import { service } from '@ember/service';
-import { pathIsFromDirectory } from 'kv/utils/kv-breadcrumbs';
-import errorMessage from 'vault/utils/error-message';
 
 /**
  * @module KvSecretCreate is used for creating the initial version of a secret
  *
  * <Page::Secrets::Create
- *    @secret={{this.model.secret}}
- *    @metadata={{this.model.metadata}}
+ *    @form={{this.model.form}}
+ *    @path={{this.model.path}}
+ *    @backend={{this.model.backend}}
  *    @breadcrumbs={{this.breadcrumbs}}
  *  />
  *
- * @param {model} secret - Ember data model: 'kv/data', the new record saved by the form
- * @param {model} metadata - Ember data model: 'kv/metadata'
+ * @param {Form} form - kv form
+ * @param {string} path - secret path
+ * @param {string} backend - secret mount path
  * @param {array} breadcrumbs - breadcrumb objects to render in page header
  */
 
 export default class KvSecretCreate extends Component {
-  @service controlGroup;
-  @service flashMessages;
-  @service router;
-  @service store;
-
   @tracked showJsonView = false;
-  @tracked errorMessage;
-  @tracked modelValidations;
-  @tracked invalidFormAlert;
-
-  @action
-  pathValidations() {
-    // check path attribute warnings on key up
-    const { state } = this.args.secret.validate();
-    if (state?.path?.warnings) {
-      // only set model validations if warnings exist
-      this.modelValidations = state;
-    }
-  }
-
-  @task
-  *save(event) {
-    event.preventDefault();
-    this.resetErrors();
-
-    const { isValid, state } = this.validate();
-    this.modelValidations = isValid ? null : state;
-    this.invalidFormAlert = isValid ? '' : 'There is an error with this form.';
-
-    const { secret, metadata } = this.args;
-    if (isValid) {
-      try {
-        // try saving secret data first
-        yield secret.save();
-        this.store.clearDataset('kv/metadata'); // Clear out the store cache so that the metadata/list view is updated.
-        this.flashMessages.success(`Successfully saved secret data for: ${secret.path}.`);
-      } catch (error) {
-        let message = errorMessage(error);
-        if (error.message === 'Control Group encountered') {
-          this.controlGroup.saveTokenFromError(error);
-          const err = this.controlGroup.logFromError(error);
-          message = err.content;
-        }
-        this.errorMessage = message;
-      }
-
-      // users must have permission to create secret data to create metadata in the UI
-      // only attempt to save metadata if secret data saves successfully and metadata is edited
-      if (secret.createdTime && this.hasChanged(metadata)) {
-        try {
-          metadata.path = secret.path;
-          yield metadata.save();
-          this.flashMessages.success(`Successfully saved metadata.`);
-        } catch (error) {
-          this.flashMessages.danger(`Secret data was saved but metadata was not: ${errorMessage(error)}`, {
-            sticky: true,
-          });
-        }
-      }
-
-      // prevent transition if there are errors with secret data
-      if (this.errorMessage) {
-        this.invalidFormAlert = 'There was an error submitting this form.';
-      } else {
-        this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.details', secret.path);
-      }
-    }
-  }
-
-  @action
-  onCancel() {
-    const { path } = this.args.secret;
-    pathIsFromDirectory(path)
-      ? this.router.transitionTo('vault.cluster.secrets.backend.kv.list-directory', path)
-      : this.router.transitionTo('vault.cluster.secrets.backend.kv.list');
-  }
-
-  // HELPERS
-
-  validate() {
-    const dataValidations = this.args.secret.validate();
-    const metadataValidations = this.args.metadata.validate();
-    const state = { ...dataValidations.state, ...metadataValidations.state };
-    const failed = !dataValidations.isValid || !metadataValidations.isValid;
-    return { state, isValid: !failed };
-  }
-
-  hasChanged(model) {
-    const fieldName = model.formFields.map((attr) => attr.name);
-    const changedAttrs = Object.keys(model.changedAttributes());
-    // exclusively check if form field attributes have changed ('backend' and 'path' are passed to createRecord)
-    return changedAttrs.any((attr) => fieldName.includes(attr));
-  }
-
-  resetErrors() {
-    this.flashMessages.clearMessages();
-    this.errorMessage = null;
-    this.modelValidations = null;
-    this.invalidFormAlert = null;
-  }
+  @tracked showMetadata = false;
 }
diff --git a/ui/lib/kv/addon/controllers/create.js b/ui/lib/kv/addon/controllers/create.js
index af20b86d992..441ae355cd0 100644
--- a/ui/lib/kv/addon/controllers/create.js
+++ b/ui/lib/kv/addon/controllers/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kv/addon/controllers/list.js b/ui/lib/kv/addon/controllers/list.js
index 814e52a25c9..1b5675fbdbf 100644
--- a/ui/lib/kv/addon/controllers/list.js
+++ b/ui/lib/kv/addon/controllers/list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kv/addon/controllers/secret/details.js b/ui/lib/kv/addon/controllers/secret/details.js
index 6fd847ecbb4..85ce3d47690 100644
--- a/ui/lib/kv/addon/controllers/secret/details.js
+++ b/ui/lib/kv/addon/controllers/secret/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kv/addon/engine.js b/ui/lib/kv/addon/engine.js
index 120e293ab98..612f53f6e17 100644
--- a/ui/lib/kv/addon/engine.js
+++ b/ui/lib/kv/addon/engine.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,13 +17,16 @@ export default class KvEngine extends Engine {
   Resolver = Resolver;
   dependencies = {
     services: [
+      'api',
+      'capabilities',
+      'control-group',
       'download',
+      'flash-messages',
       'namespace',
-      'router',
-      'store',
+      'app-router',
       'secret-mount-path',
-      'flash-messages',
-      'control-group',
+      'pagination',
+      'version',
     ],
     externalRoutes: ['secrets', 'syncDestination'],
   };
diff --git a/ui/lib/kv/addon/helpers/current-secret.js b/ui/lib/kv/addon/helpers/current-secret.js
new file mode 100644
index 00000000000..7050da4967b
--- /dev/null
+++ b/ui/lib/kv/addon/helpers/current-secret.js
@@ -0,0 +1,20 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import isDeleted from 'kv/helpers/is-deleted';
+
+// helps in long logic statements for state of a currentVersion
+export default function currentSecret(metadata) {
+  if (metadata?.versions && metadata?.current_version) {
+    const data = metadata.versions[metadata.current_version];
+    const state = data.destroyed ? 'destroyed' : isDeleted(data.deletion_time) ? 'deleted' : 'created';
+    return {
+      state,
+      isDeactivated: state !== 'created',
+      deletionTime: data.deletion_time,
+    };
+  }
+  return false;
+}
diff --git a/ui/lib/kv/addon/helpers/is-deleted.js b/ui/lib/kv/addon/helpers/is-deleted.js
new file mode 100644
index 00000000000..a2eaf84df27
--- /dev/null
+++ b/ui/lib/kv/addon/helpers/is-deleted.js
@@ -0,0 +1,15 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import timestamp from 'core/utils/timestamp';
+
+export default function isDeleted(date) {
+  // deletion_time does not always mean the secret has been deleted.
+  // if the delete_version_after is set then the deletion_time will be UTC of that time, even if it's a future time from now.
+  // to determine if the secret is deleted we check if deletion_time <= time right now.
+  const deletionTime = new Date(date);
+  const now = timestamp.now();
+  return deletionTime <= now;
+}
diff --git a/ui/lib/kv/addon/helpers/sorted-versions.js b/ui/lib/kv/addon/helpers/sorted-versions.js
new file mode 100644
index 00000000000..fa93fa9e0e2
--- /dev/null
+++ b/ui/lib/kv/addon/helpers/sorted-versions.js
@@ -0,0 +1,17 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import isDeleted from 'kv/helpers/is-deleted';
+
+export default function sortedVersions(versions) {
+  const array = [];
+  for (const key in versions) {
+    const version = versions[key];
+    const isSecretDeleted = isDeleted(version.deletion_time);
+    array.push({ version: key, isSecretDeleted, ...version });
+  }
+  // version keys are in order created with 1 being the oldest, we want newest first
+  return array.reverse();
+}
diff --git a/ui/lib/kv/addon/helpers/stringified-secret-data.js b/ui/lib/kv/addon/helpers/stringified-secret-data.js
new file mode 100644
index 00000000000..3a84db93b37
--- /dev/null
+++ b/ui/lib/kv/addon/helpers/stringified-secret-data.js
@@ -0,0 +1,18 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { helper } from '@ember/component/helper';
+import { stringify } from 'core/helpers/stringify';
+
+export function stringifiedSecretData(secretData) {
+  // must pass the third param called "space" in JSON.stringify to structure object with whitespace
+  // otherwise the following codemirror modifier check will pass `this._editor.getValue() !== namedArgs.content` and _setValue will be called.
+  // the method _setValue moves the cursor to the beginning of the text field.
+  // the effect is that the cursor jumps after the first key input.
+  const startingValue = JSON.stringify({ '': '' }, null, 2);
+  return secretData ? stringify([secretData], {}) : startingValue;
+}
+
+export default helper(([secretData]) => stringifiedSecretData(secretData));
diff --git a/ui/lib/kv/addon/routes.js b/ui/lib/kv/addon/routes.js
index 7eae3309f4d..680ef79f75d 100644
--- a/ui/lib/kv/addon/routes.js
+++ b/ui/lib/kv/addon/routes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,6 +13,7 @@ export default buildRoutes(function () {
   this.route('list-directory', { path: '/list/*path_to_secret' });
   this.route('create');
   this.route('secret', { path: '/:name' }, function () {
+    this.route('patch');
     this.route('paths');
     this.route('details', function () {
       this.route('edit'); // route to create new version of a secret
diff --git a/ui/lib/kv/addon/routes/configuration.js b/ui/lib/kv/addon/routes/configuration.js
index edea51815ee..9786e9dc745 100644
--- a/ui/lib/kv/addon/routes/configuration.js
+++ b/ui/lib/kv/addon/routes/configuration.js
@@ -1,32 +1,51 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
 
 export default class KvConfigurationRoute extends Route {
-  @service store;
+  @service api;
 
-  model() {
+  async model() {
     const backend = this.modelFor('application');
-    return hash({
-      mountConfig: backend,
-      engineConfig: this.store.findRecord('kv/config', backend.id).catch(() => {
-        // return an empty record so we have access to model capabilities
-        return this.store.createRecord('kv/config', { backend: backend.id });
-      }),
-    });
+    const {
+      type,
+      path,
+      accessor,
+      running_plugin_version,
+      local,
+      seal_wrap,
+      config: { default_lease_ttl, max_lease_ttl },
+      options: { version },
+    } = await this.api.sys.internalUiReadMountInformation(backend.id);
+    // display mount config if engine config request fails
+    const engineConfig = await this.api.secrets.kvV2ReadConfiguration(backend.id).catch(() => {});
+
+    return {
+      ...engineConfig,
+      type,
+      path,
+      accessor,
+      running_plugin_version,
+      local,
+      seal_wrap,
+      default_lease_ttl,
+      max_lease_ttl,
+      version,
+    };
   }
 
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
+    const { id } = this.modelFor('application');
+    controller.backend = id;
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.mountConfig.id, route: 'list' },
-      { label: 'configuration' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: id, route: 'list', model: id },
+      { label: 'Configuration' },
     ];
   }
 }
diff --git a/ui/lib/kv/addon/routes/create.js b/ui/lib/kv/addon/routes/create.js
index b81993e63c9..541f78e5e21 100644
--- a/ui/lib/kv/addon/routes/create.js
+++ b/ui/lib/kv/addon/routes/create.js
@@ -1,40 +1,44 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
-import { withConfirmLeave } from 'core/decorators/confirm-leave';
 import { breadcrumbsForSecret } from 'kv/utils/kv-breadcrumbs';
+import KvForm from 'vault/forms/secrets/kv';
 
-@withConfirmLeave('model.secret', ['model.metadata'])
 export default class KvSecretsCreateRoute extends Route {
-  @service store;
   @service secretMountPath;
 
   model(params) {
     const backend = this.secretMountPath.currentPath;
     const { initialKey: path } = params;
 
-    return hash({
+    return {
       backend,
       path,
-      // see serializer for logic behind setting casVersion
-      secret: this.store.createRecord('kv/data', { backend, path, casVersion: 0 }),
-      metadata: this.store.createRecord('kv/metadata', { backend, path }),
-    });
+      form: new KvForm(
+        {
+          path,
+          max_versions: 0,
+          delete_version_after: '0s',
+          cas_required: false,
+          options: { cas: 0 },
+        },
+        { isNew: true }
+      ),
+    };
   }
 
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
 
     const crumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend, route: 'list' },
-      ...breadcrumbsForSecret(resolvedModel.path),
-      { label: 'create' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+      ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.path),
+      { label: 'Create' },
     ];
     controller.breadcrumbs = crumbs;
   }
diff --git a/ui/lib/kv/addon/routes/error.js b/ui/lib/kv/addon/routes/error.js
index 960fd73d30a..553b0813e0e 100644
--- a/ui/lib/kv/addon/routes/error.js
+++ b/ui/lib/kv/addon/routes/error.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,8 +12,8 @@ export default class KvErrorRoute extends Route {
   setupController(controller) {
     super.setupController(...arguments);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'list' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'list', model: this.secretMountPath.currentPath },
     ];
     controller.mountName = this.secretMountPath.currentPath;
   }
diff --git a/ui/lib/kv/addon/routes/index.js b/ui/lib/kv/addon/routes/index.js
index 28a4566751e..25a163725e6 100644
--- a/ui/lib/kv/addon/routes/index.js
+++ b/ui/lib/kv/addon/routes/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,7 @@ import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
 export default class KvRoute extends Route {
-  @service router;
+  @service('app-router') router;
 
   redirect() {
     this.router.transitionTo('vault.cluster.secrets.backend.kv.list');
diff --git a/ui/lib/kv/addon/routes/list-directory.js b/ui/lib/kv/addon/routes/list-directory.js
index 4324c6e9a71..35c7fe0cd81 100644
--- a/ui/lib/kv/addon/routes/list-directory.js
+++ b/ui/lib/kv/addon/routes/list-directory.js
@@ -1,19 +1,19 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
-import { normalizePath } from 'vault/utils/path-encoding-helpers';
-import { breadcrumbsForSecret } from 'kv/utils/kv-breadcrumbs';
-import { pathIsDirectory } from 'kv/utils/kv-breadcrumbs';
+import { pathIsDirectory, breadcrumbsForSecret } from 'kv/utils/kv-breadcrumbs';
+import { paginate } from 'core/utils/paginate-list';
 
 export default class KvSecretsListRoute extends Route {
-  @service store;
-  @service router;
+  @service pagination;
+  @service('app-router') router;
   @service secretMountPath;
+  @service api;
+  @service capabilities;
 
   queryParams = {
     pageFilter: {
@@ -25,44 +25,45 @@ export default class KvSecretsListRoute extends Route {
   };
 
   async fetchMetadata(backend, pathToSecret, params) {
-    return await this.store
-      .lazyPaginatedQuery('kv/metadata', {
-        backend,
-        responsePath: 'data.keys',
-        page: Number(params.page) || 1,
-        pageFilter: params.pageFilter,
-        pathToSecret,
-      })
-      .catch((err) => {
-        if (err.httpStatus === 403) {
-          return 403;
-        }
-        if (err.httpStatus === 404) {
-          return [];
-        } else {
-          throw err;
-        }
-      });
+    try {
+      const { keys } = await this.api.secrets.kvV2List(pathToSecret, backend, true);
+      return paginate(keys, { page: Number(params.page) || 1, filter: params.pageFilter });
+    } catch (error) {
+      const { status, response } = await this.api.parseError(error);
+      if (status === 403 && !response.isControlGroupError) {
+        return 403;
+      }
+      if (status === 404) {
+        return [];
+      }
+      throw error;
+    }
   }
 
   getPathToSecret(pathParam) {
     if (!pathParam) return '';
     // links and routing assumes pathToParam includes trailing slash
-    return pathIsDirectory(pathParam) ? normalizePath(pathParam) : normalizePath(`${pathParam}/`);
+    // users may want to include a percent-encoded octet like %2f in their path. Example: 'foo%2fbar' or non-data octets like 'foo%bar'.
+    // we are assuming the user intended to include these characters in their path and we should not decode them.
+    return pathIsDirectory(pathParam) ? pathParam : `${pathParam}/`;
   }
 
-  model(params) {
+  async model(params) {
     const { pageFilter, path_to_secret } = params;
     const pathToSecret = this.getPathToSecret(path_to_secret);
     const backend = this.secretMountPath.currentPath;
     const filterValue = pathToSecret ? (pageFilter ? pathToSecret + pageFilter : pathToSecret) : pageFilter;
-    return hash({
-      secrets: this.fetchMetadata(backend, pathToSecret, params),
+    const secrets = await this.fetchMetadata(backend, pathToSecret, params);
+    const capabilities = await this.capabilities.for('kvMetadata', { backend, path: path_to_secret });
+
+    return {
+      secrets,
       backend,
       pathToSecret,
       filterValue,
       pageFilter,
-    });
+      capabilities,
+    };
   }
 
   setupController(controller, resolvedModel) {
@@ -71,15 +72,15 @@ export default class KvSecretsListRoute extends Route {
     resolvedModel.failedDirectoryQuery =
       resolvedModel.secrets === 403 && pathIsDirectory(resolvedModel.pathToSecret);
 
-    let breadcrumbsArray = [{ label: 'secrets', route: 'secrets', linkExternal: true }];
+    let breadcrumbsArray = [{ label: 'Secrets', route: 'secrets', linkExternal: true }];
     // if on top level don't link the engine breadcrumb label, but if within a directory, do link back to top level.
     if (this.routeName === 'list') {
       breadcrumbsArray.push({ label: resolvedModel.backend });
     } else {
       breadcrumbsArray = [
         ...breadcrumbsArray,
-        { label: resolvedModel.backend, route: 'list' },
-        ...breadcrumbsForSecret(resolvedModel.pathToSecret, true),
+        { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+        ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.pathToSecret, true),
       ];
     }
 
diff --git a/ui/lib/kv/addon/routes/list.js b/ui/lib/kv/addon/routes/list.js
index 472fea235ce..99dc769b6e8 100644
--- a/ui/lib/kv/addon/routes/list.js
+++ b/ui/lib/kv/addon/routes/list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kv/addon/routes/secret.js b/ui/lib/kv/addon/routes/secret.js
index a15e96f85d1..a03ce71d446 100644
--- a/ui/lib/kv/addon/routes/secret.js
+++ b/ui/lib/kv/addon/routes/secret.js
@@ -1,37 +1,110 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
 import { action } from '@ember/object';
+import isDeleted from 'kv/helpers/is-deleted';
+import { kvErrorHandler } from 'kv/utils/kv-error-handler';
 
 export default class KvSecretRoute extends Route {
+  @service api;
   @service secretMountPath;
-  @service store;
+  @service capabilities;
+  @service version;
 
-  fetchSecretData(backend, path) {
-    // This will always return a record unless 404 not found (show error) or control group
-    return this.store.queryRecord('kv/data', { backend, path });
+  async fetchSecretMetadata(backend, path) {
+    // catch error and only return 404 which indicates the secret truly does not exist.
+    // control group error is handled by the metadata route
+    try {
+      return await this.api.secrets.kvV2ReadMetadata(path, backend);
+    } catch (error) {
+      const { status } = await this.api.parseError(error);
+      if (status === 404) {
+        throw error;
+      }
+      return null;
+    }
   }
 
-  fetchSecretMetadata(backend, path) {
-    // catch error and do nothing because kv/data model handles metadata capabilities
-    return this.store.queryRecord('kv/metadata', { backend, path }).catch(() => {});
+  // this request always returns subkeys for the latest version
+  async fetchSubkeys(backend, path) {
+    if (this.version.isEnterprise) {
+      try {
+        return await this.api.secrets.kvV2ReadSubkeys(path, backend);
+      } catch (error) {
+        // metadata will throw if the secret does not exist
+        // kvErrorHandler will extract deletion state and relevant metadata from error
+        const { status, response } = await this.api.parseError(error);
+        return kvErrorHandler(status, response);
+      }
+    }
+    return null;
+  }
+
+  isPatchAllowed({ capabilities, subkeysMeta = {} }) {
+    if (this.version.isEnterprise) {
+      const { canReadSubkeys, canPatchData } = capabilities;
+      if (canReadSubkeys && canPatchData && subkeysMeta) {
+        const { deletion_time, destroyed } = subkeysMeta;
+        const isLatestActive = isDeleted(deletion_time) || destroyed ? false : true;
+        // only the latest secret version can be patched and it must not be deleted or destroyed
+        return isLatestActive;
+      }
+    }
+    return false;
+  }
+
+  async fetchCapabilities(backend, path) {
+    const metadataPath = `${backend}/metadata/${path}`;
+    const dataPath = `${backend}/data/${path}`;
+    const subkeysPath = `${backend}/subkeys/${path}`;
+    const deletePath = `${backend}/delete/${path}`;
+    const undeletePath = `${backend}/undelete/${path}`;
+    const destroyPath = `${backend}/destroy/${path}`;
+
+    const perms = await this.capabilities.fetch([
+      metadataPath,
+      dataPath,
+      subkeysPath,
+      deletePath,
+      undeletePath,
+      destroyPath,
+    ]);
+
+    return {
+      canReadData: perms[dataPath].canRead,
+      canUpdateData: perms[dataPath].canUpdate,
+      canPatchData: perms[dataPath].canPatch,
+      canCreateVersionData: perms[dataPath].canUpdate,
+      canDeleteVersion: perms[deletePath].canUpdate,
+      canDeleteLatestVersion: perms[dataPath].canDelete,
+      canDestroyVersion: perms[destroyPath].canUpdate,
+      canReadMetadata: perms[metadataPath].canRead,
+      canDeleteMetadata: perms[metadataPath].canDelete,
+      canUpdateMetadata: perms[metadataPath].canUpdate,
+      canUndelete: perms[undeletePath].canUpdate,
+      canReadSubkeys: perms[subkeysPath].canRead,
+    };
   }
 
-  model() {
+  async model() {
     const backend = this.secretMountPath.currentPath;
     const { name: path } = this.paramsFor('secret');
+    const capabilities = await this.fetchCapabilities(backend, path);
+    const subkeys = await this.fetchSubkeys(backend, path);
+    const metadata = await this.fetchSecretMetadata(backend, path);
 
-    return hash({
+    return {
       path,
       backend,
-      secret: this.fetchSecretData(backend, path),
-      metadata: this.fetchSecretMetadata(backend, path),
-    });
+      subkeys,
+      metadata,
+      isPatchAllowed: this.isPatchAllowed({ capabilities, subkeysMeta: subkeys?.metadata }),
+      capabilities,
+    };
   }
 
   @action
diff --git a/ui/lib/kv/addon/routes/secret/details.js b/ui/lib/kv/addon/routes/secret/details.js
index 52cfd3f0d4a..e424cdbd84c 100644
--- a/ui/lib/kv/addon/routes/secret/details.js
+++ b/ui/lib/kv/addon/routes/secret/details.js
@@ -1,14 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
+import { kvErrorHandler } from 'kv/utils/kv-error-handler';
 
 export default class KvSecretDetailsRoute extends Route {
-  @service store;
+  @service api;
 
   queryParams = {
     version: {
@@ -16,24 +16,28 @@ export default class KvSecretDetailsRoute extends Route {
     },
   };
 
-  model(params) {
+  async model(params) {
     const parentModel = this.modelFor('secret');
-    // Only fetch versioned data if selected version does not match parent (current) version
-    // and parentModel.secret has failReadErrorCode since permissions aren't version specific
-    if (
-      params.version &&
-      parentModel.secret.version !== params.version &&
-      !parentModel.secret.failReadErrorCode
-    ) {
-      // query params have changed by selecting a different version from the dropdown
-      // fire off new request for that version's secret data
-      const { backend, path } = parentModel;
-      return hash({
-        ...parentModel,
-        secret: this.store.queryRecord('kv/data', { backend, path, version: params.version }),
-      });
+    const { backend, path } = parentModel;
+    let secret;
+    // if a version is selected from the dropdown it triggers a model refresh
+    // and we fire off new request for that version's secret data
+    try {
+      const initOverride = params.version
+        ? (context) => this.api.addQueryParams(context, { version: params.version })
+        : undefined;
+      const { data, metadata } = await this.api.secrets.kvV2Read(path, backend, initOverride);
+      secret = { secretData: data, ...metadata };
+    } catch (error) {
+      const { status, response } = await this.api.parseError(error);
+      const { data, metadata, failReadErrorCode } = kvErrorHandler(status, response);
+      secret = failReadErrorCode ? { failReadErrorCode } : { secretData: data, ...metadata };
     }
-    return parentModel;
+
+    return {
+      ...parentModel,
+      secret,
+    };
   }
 
   // breadcrumbs are set in details/index.js
diff --git a/ui/lib/kv/addon/routes/secret/details/edit.js b/ui/lib/kv/addon/routes/secret/details/edit.js
index 5adc11c6367..754631ce620 100644
--- a/ui/lib/kv/addon/routes/secret/details/edit.js
+++ b/ui/lib/kv/addon/routes/secret/details/edit.js
@@ -1,44 +1,39 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
-import { service } from '@ember/service';
-import { hash } from 'rsvp';
-import { withConfirmLeave } from 'core/decorators/confirm-leave';
 import { breadcrumbsForSecret } from 'kv/utils/kv-breadcrumbs';
+import KvForm from 'vault/forms/secrets/kv';
 
-@withConfirmLeave('model.newVersion')
 export default class KvSecretDetailsEditRoute extends Route {
-  @service store;
-
   model() {
     const parentModel = this.modelFor('secret.details');
-    const { backend, path, secret, metadata } = parentModel;
-    return hash({
-      secret,
-      metadata,
-      backend,
-      path,
-      newVersion: this.store.createRecord('kv/data', {
-        backend,
-        path,
-        secretData: secret?.secretData,
-        // see serializer for logic behind setting casVersion
-        casVersion: metadata?.currentVersion || secret?.version,
-      }),
-    });
+    const { metadata, secret } = parentModel;
+    const formData = {
+      path: parentModel.path,
+      max_versions: 0,
+      options: {
+        cas: metadata?.current_version || secret.version,
+      },
+    };
+    if (!parentModel.secret.failReadErrorCode) {
+      formData.secretData = parentModel.secret.secretData;
+    }
+    return {
+      ...parentModel,
+      form: new KvForm(formData),
+    };
   }
-
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend, route: 'list' },
-      ...breadcrumbsForSecret(resolvedModel.path),
-      { label: 'edit' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+      ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.path),
+      { label: 'Edit' },
     ];
   }
 }
diff --git a/ui/lib/kv/addon/routes/secret/details/index.js b/ui/lib/kv/addon/routes/secret/details/index.js
index e99ba9e8dca..53c2920ac2c 100644
--- a/ui/lib/kv/addon/routes/secret/details/index.js
+++ b/ui/lib/kv/addon/routes/secret/details/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,9 +11,9 @@ export default class KvSecretDetailsIndexRoute extends Route {
     super.setupController(controller, resolvedModel);
 
     const breadcrumbsArray = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend, route: 'list' },
-      ...breadcrumbsForSecret(resolvedModel.path, true),
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+      ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.path, true),
     ];
     controller.breadcrumbs = breadcrumbsArray;
   }
diff --git a/ui/lib/kv/addon/routes/secret/index.js b/ui/lib/kv/addon/routes/secret/index.js
index 0c7d434534f..a1300d5ee54 100644
--- a/ui/lib/kv/addon/routes/secret/index.js
+++ b/ui/lib/kv/addon/routes/secret/index.js
@@ -1,15 +1,22 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
+import { breadcrumbsForSecret } from 'kv/utils/kv-breadcrumbs';
 
 export default class SecretIndex extends Route {
-  @service router;
+  @service('app-router') router;
 
-  redirect() {
-    this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.details');
+  setupController(controller, resolvedModel) {
+    super.setupController(controller, resolvedModel);
+    const breadcrumbsArray = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+      ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.path, true),
+    ];
+    controller.breadcrumbs = breadcrumbsArray;
   }
 }
diff --git a/ui/lib/kv/addon/routes/secret/metadata.js b/ui/lib/kv/addon/routes/secret/metadata.js
index 2e94e9f87fd..13595a08ff9 100644
--- a/ui/lib/kv/addon/routes/secret/metadata.js
+++ b/ui/lib/kv/addon/routes/secret/metadata.js
@@ -1,37 +1,42 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
+import KvForm from 'vault/forms/secrets/kv';
 
 export default class KvSecretMetadataRoute extends Route {
-  @service store;
   @service secretMountPath;
+  @service api;
 
-  fetchMetadata(backend, path) {
-    return this.store.queryRecord('kv/metadata', { backend, path }).catch((error) => {
-      if (error.message === 'Control Group encountered') {
-        throw error;
+  async fetchMetadata(backend, path) {
+    try {
+      return await this.api.secrets.kvV2ReadMetadata(path, backend);
+    } catch (error) {
+      const { response } = await this.api.parseError(error);
+      if (response.isControlGroupError) {
+        throw response;
       }
-      return {};
-    });
+      // if users can read secret data they can make an explicit request to retrieve secret data in the component
+      return null;
+    }
   }
 
   async model() {
-    const backend = this.secretMountPath.currentPath;
-    const { name: path } = this.paramsFor('secret');
     const parentModel = this.modelFor('secret');
+    const { backend, path } = parentModel;
     if (!parentModel.metadata) {
       // metadata read on the secret root fails silently
       // if there's no metadata, try again in case it's a control group
-      const metadata = await this.fetchMetadata(backend, path);
-      return {
-        ...parentModel,
-        metadata,
-      };
+      parentModel.metadata = await this.fetchMetadata(backend, path);
     }
-    return parentModel;
+
+    const { custom_metadata, max_versions, cas_required, delete_version_after } = parentModel.metadata || {};
+    return {
+      ...parentModel,
+      form: new KvForm({ path, custom_metadata, max_versions, cas_required, delete_version_after }),
+    };
   }
 }
diff --git a/ui/lib/kv/addon/routes/secret/metadata/diff.js b/ui/lib/kv/addon/routes/secret/metadata/diff.js
index 4a7f93687df..7e379a4adbd 100644
--- a/ui/lib/kv/addon/routes/secret/metadata/diff.js
+++ b/ui/lib/kv/addon/routes/secret/metadata/diff.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,11 +12,11 @@ export default class KvSecretMetadataDiffRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     const breadcrumbsArray = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend, route: 'list' },
-      ...breadcrumbsForSecret(resolvedModel.path),
-      { label: 'version history', route: 'secret.metadata.versions' },
-      { label: 'diff' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+      ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.path),
+      { label: 'Version History', route: 'secret.metadata.versions' },
+      { label: 'Diff' },
     ];
     controller.set('breadcrumbs', breadcrumbsArray);
   }
diff --git a/ui/lib/kv/addon/routes/secret/metadata/edit.js b/ui/lib/kv/addon/routes/secret/metadata/edit.js
index a6da0ab27a5..919eb0a8f00 100644
--- a/ui/lib/kv/addon/routes/secret/metadata/edit.js
+++ b/ui/lib/kv/addon/routes/secret/metadata/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,11 +13,11 @@ export default class KvSecretMetadataEditRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     const breadcrumbsArray = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend, route: 'list' },
-      ...breadcrumbsForSecret(resolvedModel.path),
-      { label: 'metadata', route: 'secret.metadata' },
-      { label: 'edit' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+      ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.path),
+      { label: 'Metadata', route: 'secret.metadata' },
+      { label: 'Edit' },
     ];
 
     controller.set('breadcrumbs', breadcrumbsArray);
diff --git a/ui/lib/kv/addon/routes/secret/metadata/index.js b/ui/lib/kv/addon/routes/secret/metadata/index.js
index 2e661be7cfb..8f3c94f482d 100644
--- a/ui/lib/kv/addon/routes/secret/metadata/index.js
+++ b/ui/lib/kv/addon/routes/secret/metadata/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,10 +13,10 @@ export default class KvSecretMetadataIndexRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     const breadcrumbsArray = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend, route: 'list' },
-      ...breadcrumbsForSecret(resolvedModel.path),
-      { label: 'metadata' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+      ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.path),
+      { label: 'Metadata' },
     ];
 
     controller.set('breadcrumbs', breadcrumbsArray);
diff --git a/ui/lib/kv/addon/routes/secret/metadata/versions.js b/ui/lib/kv/addon/routes/secret/metadata/versions.js
index 93ead65bda3..a6ec022b388 100644
--- a/ui/lib/kv/addon/routes/secret/metadata/versions.js
+++ b/ui/lib/kv/addon/routes/secret/metadata/versions.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,10 +10,10 @@ export default class KvSecretMetadataVersionsRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     const breadcrumbsArray = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend, route: 'list' },
-      ...breadcrumbsForSecret(resolvedModel.path),
-      { label: 'version history' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+      ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.path),
+      { label: 'Version History' },
     ];
 
     controller.set('breadcrumbs', breadcrumbsArray);
diff --git a/ui/lib/kv/addon/routes/secret/patch.js b/ui/lib/kv/addon/routes/secret/patch.js
new file mode 100644
index 00000000000..dd482c03471
--- /dev/null
+++ b/ui/lib/kv/addon/routes/secret/patch.js
@@ -0,0 +1,30 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { breadcrumbsForSecret } from 'kv/utils/kv-breadcrumbs';
+import { service } from '@ember/service';
+
+export default class SecretPatch extends Route {
+  @service('app-router') router;
+
+  setupController(controller, resolvedModel) {
+    super.setupController(controller, resolvedModel);
+    const breadcrumbsArray = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+      ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.path),
+      { label: 'Patch' },
+    ];
+    controller.breadcrumbs = breadcrumbsArray;
+  }
+
+  // isPatchAllowed is true if (1) the version is enterprise, (2) a user has "patch" secret + "read" subkeys capabilities, (3) latest secret version is not deleted or destroyed
+  redirect(model) {
+    if (!model.isPatchAllowed) {
+      this.router.transitionTo('vault.cluster.secrets.backend.kv.secret.index', model.path);
+    }
+  }
+}
diff --git a/ui/lib/kv/addon/routes/secret/paths.js b/ui/lib/kv/addon/routes/secret/paths.js
index 7bfaf8da58c..bd1cf1abcbe 100644
--- a/ui/lib/kv/addon/routes/secret/paths.js
+++ b/ui/lib/kv/addon/routes/secret/paths.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,10 +11,10 @@ export default class KvSecretPathsRoute extends Route {
     super.setupController(controller, resolvedModel);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backend, route: 'list' },
-      ...breadcrumbsForSecret(resolvedModel.path),
-      { label: 'paths' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backend, route: 'list', model: resolvedModel.backend },
+      ...breadcrumbsForSecret(resolvedModel.backend, resolvedModel.path),
+      { label: 'Paths' },
     ];
   }
 }
diff --git a/ui/lib/kv/addon/templates/configuration.hbs b/ui/lib/kv/addon/templates/configuration.hbs
index 6b69fc1ea1f..4242d109c29 100644
--- a/ui/lib/kv/addon/templates/configuration.hbs
+++ b/ui/lib/kv/addon/templates/configuration.hbs
@@ -1,10 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Page::Configuration
-  @engineConfig={{this.model.engineConfig}}
-  @mountConfig={{this.model.mountConfig}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>
\ No newline at end of file
+<Page::Configuration @config={{this.model}} @backend={{this.backend}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/create.hbs b/ui/lib/kv/addon/templates/create.hbs
index 1bff973834e..834b1de9319 100644
--- a/ui/lib/kv/addon/templates/create.hbs
+++ b/ui/lib/kv/addon/templates/create.hbs
@@ -1,6 +1,11 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Page::Secrets::Create @secret={{this.model.secret}} @metadata={{this.model.metadata}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
+<Page::Secrets::Create
+  @form={{this.model.form}}
+  @path={{this.model.path}}
+  @backend={{this.model.backend}}
+  @breadcrumbs={{this.breadcrumbs}}
+/>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/error.hbs b/ui/lib/kv/addon/templates/error.hbs
index 8d5a687430e..6dda5a04903 100644
--- a/ui/lib/kv/addon/templates/error.hbs
+++ b/ui/lib/kv/addon/templates/error.hbs
@@ -1,12 +1,16 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <KvPageHeader @breadcrumbs={{this.breadcrumbs}} @mountName={{this.mountName}}>
   <:tabLinks>
-    <li><LinkTo @route="list" data-test-secrets-tab="Secrets">Secrets</LinkTo></li>
-    <li><LinkTo @route="configuration" data-test-secrets-tab="Configuration">Configuration</LinkTo></li>
+    <li><LinkTo @route="list" @model={{this.mountName}} data-test-secrets-tab="Secrets">Secrets</LinkTo></li>
+    <li><LinkTo
+        @route="configuration"
+        @model={{this.mountName}}
+        data-test-secrets-tab="Configuration"
+      >Configuration</LinkTo></li>
   </:tabLinks>
 </KvPageHeader>
 
diff --git a/ui/lib/kv/addon/templates/list-directory.hbs b/ui/lib/kv/addon/templates/list-directory.hbs
index a1b76f60e87..496fc4f822f 100644
--- a/ui/lib/kv/addon/templates/list-directory.hbs
+++ b/ui/lib/kv/addon/templates/list-directory.hbs
@@ -1,14 +1,15 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::List
   @secrets={{this.model.secrets}}
   @backend={{this.model.backend}}
   @pathToSecret={{this.model.pathToSecret}}
-  @pageFilter={{this.model.pageFilter}}
   @filterValue={{this.model.filterValue}}
   @failedDirectoryQuery={{this.model.failedDirectoryQuery}}
   @breadcrumbs={{this.breadcrumbs}}
+  @currentRouteParams={{array this.model.backend this.model.pathToSecret}}
+  @capabilities={{this.model.capabilities}}
 />
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/list.hbs b/ui/lib/kv/addon/templates/list.hbs
index d6272f7afc6..df895271aa4 100644
--- a/ui/lib/kv/addon/templates/list.hbs
+++ b/ui/lib/kv/addon/templates/list.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::List
   @secrets={{this.model.secrets}}
@@ -10,4 +10,6 @@
   @filterValue={{this.model.filterValue}}
   @failedDirectoryQuery={{this.model.failedDirectoryQuery}}
   @breadcrumbs={{this.breadcrumbs}}
+  @currentRouteParams={{array this.model.backend}}
+  @capabilities={{this.model.capabilities}}
 />
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/secret/details/edit.hbs b/ui/lib/kv/addon/templates/secret/details/edit.hbs
index d04db8bff19..2fd176cefec 100644
--- a/ui/lib/kv/addon/templates/secret/details/edit.hbs
+++ b/ui/lib/kv/addon/templates/secret/details/edit.hbs
@@ -1,12 +1,13 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Secret::Edit
-  @secret={{this.model.newVersion}}
-  @previousVersion={{this.model.secret.version}}
-  @currentVersion={{this.model.metadata.currentVersion}}
+  @form={{this.model.form}}
+  @secret={{this.model.secret}}
+  @metadata={{this.model.metadata}}
+  @path={{this.model.path}}
+  @backend={{this.model.backend}}
   @breadcrumbs={{this.breadcrumbs}}
-  @noReadAccess={{eq this.model.secret.failReadErrorCode 403}}
 />
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/secret/details/index.hbs b/ui/lib/kv/addon/templates/secret/details/index.hbs
index 2744537886f..850be4213c2 100644
--- a/ui/lib/kv/addon/templates/secret/details/index.hbs
+++ b/ui/lib/kv/addon/templates/secret/details/index.hbs
@@ -1,11 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Secret::Details
+  @backend={{this.model.backend}}
+  @breadcrumbs={{this.breadcrumbs}}
+  @capabilities={{this.model.capabilities}}
+  @isPatchAllowed={{this.model.isPatchAllowed}}
+  @metadata={{this.model.metadata}}
   @path={{this.model.path}}
   @secret={{this.model.secret}}
-  @metadata={{this.model.metadata}}
-  @breadcrumbs={{this.breadcrumbs}}
 />
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/secret/index.hbs b/ui/lib/kv/addon/templates/secret/index.hbs
new file mode 100644
index 00000000000..81456734b28
--- /dev/null
+++ b/ui/lib/kv/addon/templates/secret/index.hbs
@@ -0,0 +1,14 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Page::Secret::Overview
+  @backend={{this.model.backend}}
+  @breadcrumbs={{this.breadcrumbs}}
+  @capabilities={{this.model.capabilities}}
+  @isPatchAllowed={{this.model.isPatchAllowed}}
+  @metadata={{this.model.metadata}}
+  @path={{this.model.path}}
+  @subkeys={{this.model.subkeys}}
+/>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/secret/metadata/diff.hbs b/ui/lib/kv/addon/templates/secret/metadata/diff.hbs
index 47b0eda4084..0835389ce38 100644
--- a/ui/lib/kv/addon/templates/secret/metadata/diff.hbs
+++ b/ui/lib/kv/addon/templates/secret/metadata/diff.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Secret::Metadata::VersionDiff
   @metadata={{this.model.metadata}}
diff --git a/ui/lib/kv/addon/templates/secret/metadata/edit.hbs b/ui/lib/kv/addon/templates/secret/metadata/edit.hbs
index 3f0c0d069fe..b2ff1573cac 100644
--- a/ui/lib/kv/addon/templates/secret/metadata/edit.hbs
+++ b/ui/lib/kv/addon/templates/secret/metadata/edit.hbs
@@ -1,11 +1,13 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Secret::Metadata::Edit
-  @metadata={{this.model.metadata}}
+  @form={{this.model.form}}
+  @backend={{this.model.backend}}
   @breadcrumbs={{this.breadcrumbs}}
-  @onCancel={{transition-to "vault.cluster.secrets.backend.kv.secret.metadata" this.model.metadata.path}}
-  @onSave={{transition-to "vault.cluster.secrets.backend.kv.secret.metadata" this.model.metadata.path}}
+  @capabilities={{this.model.capabilities}}
+  @onCancel={{transition-to "vault.cluster.secrets.backend.kv.secret.metadata" this.model.path}}
+  @onSave={{transition-to "vault.cluster.secrets.backend.kv.secret.metadata" this.model.path}}
 />
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/secret/metadata/index.hbs b/ui/lib/kv/addon/templates/secret/metadata/index.hbs
index 147f25d93d9..4796e65480b 100644
--- a/ui/lib/kv/addon/templates/secret/metadata/index.hbs
+++ b/ui/lib/kv/addon/templates/secret/metadata/index.hbs
@@ -1,11 +1,12 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Secret::Metadata::Details
+  @backend={{this.model.backend}}
+  @breadcrumbs={{this.breadcrumbs}}
+  @capabilities={{this.model.capabilities}}
   @metadata={{this.model.metadata}}
   @path={{this.model.path}}
-  @breadcrumbs={{this.breadcrumbs}}
-  @secret={{this.model.secret}}
 />
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/secret/metadata/versions.hbs b/ui/lib/kv/addon/templates/secret/metadata/versions.hbs
index 4fc1719107e..a217094de11 100644
--- a/ui/lib/kv/addon/templates/secret/metadata/versions.hbs
+++ b/ui/lib/kv/addon/templates/secret/metadata/versions.hbs
@@ -1,10 +1,12 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Secret::Metadata::VersionHistory
   @metadata={{this.model.metadata}}
   @path={{this.model.path}}
+  @backend={{this.model.backend}}
   @breadcrumbs={{this.breadcrumbs}}
+  @capabilities={{this.model.capabilities}}
 />
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/secret/patch.hbs b/ui/lib/kv/addon/templates/secret/patch.hbs
new file mode 100644
index 00000000000..4d62c002ce4
--- /dev/null
+++ b/ui/lib/kv/addon/templates/secret/patch.hbs
@@ -0,0 +1,13 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Page::Secret::Patch
+  @backend={{this.model.backend}}
+  @breadcrumbs={{this.breadcrumbs}}
+  @metadata={{this.model.metadata}}
+  @path={{this.model.path}}
+  @subkeys={{this.model.subkeys.subkeys}}
+  @subkeysMeta={{this.model.subkeys.metadata}}
+/>
\ No newline at end of file
diff --git a/ui/lib/kv/addon/templates/secret/paths.hbs b/ui/lib/kv/addon/templates/secret/paths.hbs
index d27c698d53c..38dcdd84e5c 100644
--- a/ui/lib/kv/addon/templates/secret/paths.hbs
+++ b/ui/lib/kv/addon/templates/secret/paths.hbs
@@ -1,11 +1,11 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Secret::Paths
   @path={{this.model.path}}
   @backend={{this.model.backend}}
   @breadcrumbs={{this.breadcrumbs}}
-  @canReadMetadata={{this.model.secret.canReadMetadata}}
+  @canReadMetadata={{this.model.capabilities.canReadMetadata}}
 />
\ No newline at end of file
diff --git a/ui/lib/kv/addon/utils/kv-breadcrumbs.js b/ui/lib/kv/addon/utils/kv-breadcrumbs.js
index 0ac5c562205..b68a5cec6b6 100644
--- a/ui/lib/kv/addon/utils/kv-breadcrumbs.js
+++ b/ui/lib/kv/addon/utils/kv-breadcrumbs.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -32,8 +32,8 @@ function splitSegments(secretPath) {
  * @param {boolean} lastItemCurrent
  * @returns array of breadcrumbs specific to KV engine
  */
-export function breadcrumbsForSecret(secretPath, lastItemCurrent = false) {
-  if (!secretPath) return [];
+export function breadcrumbsForSecret(backend, secretPath, lastItemCurrent = false) {
+  if (!backend || !secretPath) return [];
   const isDir = pathIsDirectory(secretPath);
   const segments = splitSegments(secretPath);
 
@@ -45,9 +45,9 @@ export function breadcrumbsForSecret(secretPath, lastItemCurrent = false) {
         };
       }
       if (!isDir) {
-        return { label: segment.label, route: 'secret.details', model: segment.model };
+        return { label: segment.label, route: 'secret.index', models: [backend, segment.model] };
       }
     }
-    return { label: segment.label, route: 'list-directory', model: `${segment.model}/` };
+    return { label: segment.label, route: 'list-directory', models: [backend, `${segment.model}/`] };
   });
 }
diff --git a/ui/lib/kv/addon/utils/kv-deleted.js b/ui/lib/kv/addon/utils/kv-deleted.js
deleted file mode 100644
index 7533bc01a54..00000000000
--- a/ui/lib/kv/addon/utils/kv-deleted.js
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-import timestamp from 'core/utils/timestamp';
-
-export function isDeleted(date) {
-  // on the kv/data model, deletion_time does not always mean the secret has been deleted.
-  // if the delete_version_after is set then the deletion_time will be UTC of that time, even if it's a future time from now.
-  // to determine if the secret is deleted we check if deletion_time <= time right now.
-  const deletionTime = new Date(date);
-  const now = timestamp.now();
-  return deletionTime <= now;
-}
diff --git a/ui/lib/kv/addon/utils/kv-error-handler.js b/ui/lib/kv/addon/utils/kv-error-handler.js
new file mode 100644
index 00000000000..89c4ab3b33b
--- /dev/null
+++ b/ui/lib/kv/addon/utils/kv-error-handler.js
@@ -0,0 +1,33 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export function kvErrorHandler(status, errorResponse) {
+  // if it's a legitimate error - throw it!
+  if (errorResponse?.isControlGroupError) {
+    throw errorResponse;
+  }
+
+  if (typeof errorResponse === 'object' && errorResponse !== null) {
+    const { data } = errorResponse;
+
+    if (status === 403) {
+      return {
+        failReadErrorCode: 403,
+      };
+    }
+
+    // in the case of a deleted/destroyed secret the API returns a 404 because { data: null }
+    // however, there could be a metadata block with important information like deletion_time
+    // handleResponse below checks 404 status codes for metadata and updates the code to 200 if it exists.
+    // we still end up in the good ol' catch() block, but instead of a 404 adapter error we've "caught"
+    // the metadata that sneakily tried to hide from us
+    if (data) {
+      return data;
+    }
+  }
+
+  // if we get here, it's likely either a script error or 404 because it doesn't exist
+  throw errorResponse;
+}
diff --git a/ui/lib/kv/app/utils/kv-breadcrumbs.js b/ui/lib/kv/app/utils/kv-breadcrumbs.js
deleted file mode 100644
index f3392c257a2..00000000000
--- a/ui/lib/kv/app/utils/kv-breadcrumbs.js
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export { default } from 'kv/utils/kv-breadcrumbs';
diff --git a/ui/lib/kv/app/utils/kv-deleted.js b/ui/lib/kv/app/utils/kv-deleted.js
deleted file mode 100644
index 7b305de0d8c..00000000000
--- a/ui/lib/kv/app/utils/kv-deleted.js
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export { default } from 'kv/utils/kv-deleted';
diff --git a/ui/lib/kv/config/environment.js b/ui/lib/kv/config/environment.js
index 6eb4b8997e9..1507b3dca1d 100644
--- a/ui/lib/kv/config/environment.js
+++ b/ui/lib/kv/config/environment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/kv/index.js b/ui/lib/kv/index.js
index c7d72b7286c..6fbf86bebd4 100644
--- a/ui/lib/kv/index.js
+++ b/ui/lib/kv/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,6 +16,10 @@ module.exports = buildEngine({
     enabled: false,
   },
 
+  babel: {
+    plugins: [require.resolve('ember-concurrency/async-arrow-task-transform')],
+  },
+
   isDevelopingAddon() {
     return true;
   },
diff --git a/ui/lib/kv/package.json b/ui/lib/kv/package.json
index 5c76aa678d4..f9fb088c6c7 100644
--- a/ui/lib/kv/package.json
+++ b/ui/lib/kv/package.json
@@ -5,15 +5,17 @@
     "ember-engine"
   ],
   "dependencies": {
+    "ember-auto-import": "*",
     "ember-cli-htmlbars": "*",
     "ember-cli-babel": "*",
     "ember-concurrency": "*",
     "@ember/test-waiters": "*",
-    "ember-inflector": "*"
+    "ember-inflector": "*",
+    "ember-template-lint": "*"
   },
   "ember-addon": {
     "paths": [
       "../core"
     ]
   }
-}
\ No newline at end of file
+}
diff --git a/ui/lib/ldap/addon/components/accounts-checked-out.hbs b/ui/lib/ldap/addon/components/accounts-checked-out.hbs
index 0624252a453..66116ead815 100644
--- a/ui/lib/ldap/addon/components/accounts-checked-out.hbs
+++ b/ui/lib/ldap/addon/components/accounts-checked-out.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <OverviewCard
   @cardTitle="Accounts checked-out"
@@ -9,36 +9,38 @@
   class="has-padding-l"
   ...attributes
 >
-  <hr class="has-background-gray-200" />
+  <:content>
+    <hr class="has-background-gray-200" />
 
-  {{#if this.filteredAccounts}}
-    <Hds::Table @model={{this.filteredAccounts}} @columns={{this.columns}}>
-      <:body as |Body|>
-        <Body.Tr>
-          <Body.Td data-test-checked-out-account={{Body.data.account}}>{{Body.data.account}}</Body.Td>
-          {{#if @showLibraryColumn}}
-            <Body.Td data-test-checked-out-library={{Body.data.account}}>{{Body.data.library}}</Body.Td>
-          {{/if}}
-          <Body.Td>
-            <Hds::Button
-              @icon="queue"
-              @text="Check-in"
-              @color="tertiary"
-              disabled={{this.disableCheckIn Body.data.library}}
-              data-test-checked-out-account-action={{Body.data.account}}
-              {{on "click" (fn (mut this.selectedStatus) Body.data)}}
-            />
-          </Body.Td>
-        </Body.Tr>
-      </:body>
-    </Hds::Table>
-  {{else}}
-    <EmptyState
-      @title="No accounts checked out yet"
-      @message="There is no account that is currently in use."
-      class="is-shadowless"
-    />
-  {{/if}}
+    {{#if this.filteredAccounts}}
+      <Hds::Table @model={{this.filteredAccounts}} @columns={{this.columns}}>
+        <:body as |Body|>
+          <Body.Tr>
+            <Body.Td data-test-checked-out-account={{Body.data.account}}>{{Body.data.account}}</Body.Td>
+            {{#if @showLibraryColumn}}
+              <Body.Td data-test-checked-out-library={{Body.data.account}}>{{Body.data.library}}</Body.Td>
+            {{/if}}
+            <Body.Td>
+              <Hds::Button
+                @icon="queue"
+                @text="Check-in"
+                @color="tertiary"
+                disabled={{this.disableCheckIn Body.data.library}}
+                data-test-checked-out-account-action={{Body.data.account}}
+                {{on "click" (fn (mut this.selectedStatus) Body.data)}}
+              />
+            </Body.Td>
+          </Body.Tr>
+        </:body>
+      </Hds::Table>
+    {{else}}
+      <EmptyState
+        @title="No accounts checked out yet"
+        @message="There is no account that is currently in use."
+        class="is-shadowless"
+      />
+    {{/if}}
+  </:content>
 </OverviewCard>
 
 {{#if this.selectedStatus}}
diff --git a/ui/lib/ldap/addon/components/accounts-checked-out.ts b/ui/lib/ldap/addon/components/accounts-checked-out.ts
index ca3963f5e10..fec64e2cef6 100644
--- a/ui/lib/ldap/addon/components/accounts-checked-out.ts
+++ b/ui/lib/ldap/addon/components/accounts-checked-out.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -40,7 +40,7 @@ export default class LdapAccountsCheckedOutComponent extends Component<Args> {
     // filter status to only show checked out accounts associated to the current user
     // if disable_check_in_enforcement is true on the library set then all checked out accounts are displayed
     return this.args.statuses.filter((status) => {
-      const authEntityId = this.auth.authData?.entity_id;
+      const authEntityId = this.auth.authData?.entityId;
       const isRoot = !status.borrower_entity_id && !authEntityId; // root user will not have an entity id and it won't be populated on status
       const isEntity = status.borrower_entity_id === authEntityId;
       const library = this.findLibrary(status.library);
diff --git a/ui/lib/ldap/addon/components/config-cta.hbs b/ui/lib/ldap/addon/components/config-cta.hbs
index 19aa49323d1..bba54acd358 100644
--- a/ui/lib/ldap/addon/components/config-cta.hbs
+++ b/ui/lib/ldap/addon/components/config-cta.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <EmptyState
   data-test-config-cta
diff --git a/ui/lib/ldap/addon/components/page/configuration.hbs b/ui/lib/ldap/addon/components/page/configuration.hbs
index 6182aa22868..4336c49284a 100644
--- a/ui/lib/ldap/addon/components/page/configuration.hbs
+++ b/ui/lib/ldap/addon/components/page/configuration.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <TabPageHeader @model={{@backendModel}} @breadcrumbs={{@breadcrumbs}}>
   <:toolbarActions>
@@ -41,4 +41,8 @@
   <ConfigCta />
 {{/if}}
 
-<SecretsEngineMountConfig @model={{@backendModel}} class="has-top-margin-xl has-bottom-margin-xl" data-test-mount-config />
\ No newline at end of file
+<SecretsEngineMountConfig
+  @secretsEngine={{@backendModel}}
+  class="has-top-margin-xl has-bottom-margin-xl"
+  data-test-mount-config
+/>
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/components/page/configuration.ts b/ui/lib/ldap/addon/components/page/configuration.ts
index d29bdf142bf..72b8c94430b 100644
--- a/ui/lib/ldap/addon/components/page/configuration.ts
+++ b/ui/lib/ldap/addon/components/page/configuration.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,7 @@ import errorMessage from 'vault/utils/error-message';
 
 import type LdapConfigModel from 'vault/models/ldap/config';
 import type SecretEngineModel from 'vault/models/secret-engine';
-import type AdapterError from 'ember-data/adapter'; // eslint-disable-line ember/use-ember-data-rfc-395-imports
+import type AdapterError from '@ember-data/adapter/error';
 import type { Breadcrumb } from 'vault/vault/app-types';
 import type FlashMessageService from 'vault/services/flash-messages';
 
diff --git a/ui/lib/ldap/addon/components/page/configure.hbs b/ui/lib/ldap/addon/components/page/configure.hbs
index 393b8eb51e9..35694a090b9 100644
--- a/ui/lib/ldap/addon/components/page/configure.hbs
+++ b/ui/lib/ldap/addon/components/page/configure.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -96,12 +96,16 @@
     </M.Body>
     <M.Footer>
       <Hds::ButtonSet>
-        <Hds::Button data-test-save-with-rotate @text="Save and rotate" {{on "click" (fn (perform this.save) null true)}} />
         <Hds::Button
-          data-test-save-without-rotate
+          @text="Save and rotate"
+          {{on "click" (fn (perform this.save) null true)}}
+          data-test-button="Save and rotate"
+        />
+        <Hds::Button
           @text="Save without rotating"
           @color="secondary"
           {{on "click" (fn (perform this.save) null false)}}
+          data-test-button="Save without rotating"
         />
       </Hds::ButtonSet>
     </M.Footer>
diff --git a/ui/lib/ldap/addon/components/page/configure.ts b/ui/lib/ldap/addon/components/page/configure.ts
index 303659df536..f5c721f97b4 100644
--- a/ui/lib/ldap/addon/components/page/configure.ts
+++ b/ui/lib/ldap/addon/components/page/configure.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -29,7 +29,7 @@ interface SchemaOption {
 
 export default class LdapConfigurePageComponent extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked showRotatePrompt = false;
   @tracked modelValidations: ValidationMap | null = null;
diff --git a/ui/lib/ldap/addon/components/page/libraries.hbs b/ui/lib/ldap/addon/components/page/libraries.hbs
index 01f41696e8b..ca52dd6cca6 100644
--- a/ui/lib/ldap/addon/components/page/libraries.hbs
+++ b/ui/lib/ldap/addon/components/page/libraries.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <TabPageHeader @model={{@backendModel}} @breadcrumbs={{@breadcrumbs}}>
   <:toolbarFilters>
@@ -9,7 +9,7 @@
       <FilterInput
         aria-label="Filter libraries"
         placeholder="Filter libraries"
-        value={{this.filterValue}}
+        @value={{this.filterValue}}
         @wait={{200}}
         @onInput={{fn (mut this.filterValue)}}
       />
@@ -43,10 +43,10 @@
 {{else}}
   <div class="has-bottom-margin-s">
     {{#each this.filteredLibraries as |library|}}
-      <ListItem @linkPrefix={{this.mountPoint}} @linkParams={{array "libraries.library.details" library.name}} as |Item|>
+      <ListItem @linkPrefix={{this.mountPoint}} @linkParams={{this.linkParams library}} as |Item|>
         <Item.content>
           <Icon @name="folder" />
-          <span data-test-library={{library.name}}>{{library.name}}</span>
+          <span data-test-library={{library.completeLibraryName}}>{{library.name}}</span>
         </Item.content>
         <Item.menu>
           {{#if (or library.canRead library.canEdit library.canDelete)}}
@@ -55,21 +55,36 @@
                 @icon="more-horizontal"
                 @text="More options"
                 @hasChevron={{false}}
-                data-test-popup-menu-trigger
+                data-test-popup-menu-trigger={{library.completeLibraryName}}
               />
-              {{#if library.canEdit}}
-                <dd.Interactive @text="Edit" data-test-edit @route="libraries.library.edit" @model={{library}} />
-              {{/if}}
-              {{#if library.canRead}}
-                <dd.Interactive @text="Details" data-test-details @route="libraries.library.details" @model={{library}} />
-              {{/if}}
-              {{#if library.canDelete}}
+              {{#if (this.isHierarchical library.name)}}
                 <dd.Interactive
-                  @text="Delete"
-                  data-test-delete
-                  @color="critical"
-                  {{on "click" (fn (mut this.libraryToDelete) library)}}
-                />
+                  data-test-subdirectory
+                  @route="libraries.subdirectory"
+                  @model={{library.completeLibraryName}}
+                >Content</dd.Interactive>
+              {{else}}
+                {{#if library.canEdit}}
+                  <dd.Interactive
+                    data-test-edit
+                    @route="libraries.library.edit"
+                    @model={{library.completeLibraryName}}
+                  >Edit</dd.Interactive>
+                {{/if}}
+                {{#if library.canRead}}
+                  <dd.Interactive
+                    data-test-details
+                    @route="libraries.library.details"
+                    @model={{library.completeLibraryName}}
+                  >Details</dd.Interactive>
+                {{/if}}
+                {{#if library.canDelete}}
+                  <dd.Interactive
+                    data-test-delete
+                    @color="critical"
+                    {{on "click" (fn (mut this.libraryToDelete) library)}}
+                  >Delete</dd.Interactive>
+                {{/if}}
               {{/if}}
             </Hds::Dropdown>
           {{/if}}
diff --git a/ui/lib/ldap/addon/components/page/libraries.ts b/ui/lib/ldap/addon/components/page/libraries.ts
index 3aac64170f7..4602d694fd6 100644
--- a/ui/lib/ldap/addon/components/page/libraries.ts
+++ b/ui/lib/ldap/addon/components/page/libraries.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,13 +7,14 @@ import Component from '@glimmer/component';
 import { tracked } from '@glimmer/tracking';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 import errorMessage from 'vault/utils/error-message';
 
 import type LdapLibraryModel from 'vault/models/ldap/library';
 import type SecretEngineModel from 'vault/models/secret-engine';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type { Breadcrumb, EngineOwner } from 'vault/vault/app-types';
+import type RouterService from '@ember/routing/router-service';
 
 interface Args {
   libraries: Array<LdapLibraryModel>;
@@ -24,10 +25,18 @@ interface Args {
 
 export default class LdapLibrariesPageComponent extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked filterValue = '';
   @tracked libraryToDelete: LdapLibraryModel | null = null;
 
+  isHierarchical = (name: string) => name.endsWith('/');
+
+  linkParams = (library: LdapLibraryModel) => {
+    const route = this.isHierarchical(library.name) ? 'libraries.subdirectory' : 'libraries.library.details';
+    return [route, library.completeLibraryName];
+  };
+
   get mountPoint(): string {
     const owner = getOwner(this) as EngineOwner;
     return owner.mountPoint;
@@ -43,8 +52,9 @@ export default class LdapLibrariesPageComponent extends Component<Args> {
   @action
   async onDelete(model: LdapLibraryModel) {
     try {
-      const message = `Successfully deleted library ${model.name}.`;
+      const message = `Successfully deleted library ${model.completeLibraryName}.`;
       await model.destroyRecord();
+      this.router.transitionTo('vault.cluster.secrets.backend.ldap.libraries');
       this.flashMessages.success(message);
     } catch (error) {
       this.flashMessages.danger(`Error deleting library \n ${errorMessage(error)}`);
diff --git a/ui/lib/ldap/addon/components/page/library/check-out.hbs b/ui/lib/ldap/addon/components/page/library/check-out.hbs
index acfc5cdd282..50b13e0324c 100644
--- a/ui/lib/ldap/addon/components/page/library/check-out.hbs
+++ b/ui/lib/ldap/addon/components/page/library/check-out.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/ldap/addon/components/page/library/create-and-edit.hbs b/ui/lib/ldap/addon/components/page/library/create-and-edit.hbs
index 7f8b77c00bd..77a8f5e13c1 100644
--- a/ui/lib/ldap/addon/components/page/library/create-and-edit.hbs
+++ b/ui/lib/ldap/addon/components/page/library/create-and-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -28,7 +28,7 @@
   <div class="has-top-margin-l has-bottom-margin-l is-flex">
     <Hds::Button
       @text={{if @model.isNew "Create library" "Save"}}
-      data-test-save
+      data-test-submit
       type="submit"
       disabled={{this.save.isRunning}}
     />
diff --git a/ui/lib/ldap/addon/components/page/library/create-and-edit.ts b/ui/lib/ldap/addon/components/page/library/create-and-edit.ts
index 0724a103176..f22d7c37a53 100644
--- a/ui/lib/ldap/addon/components/page/library/create-and-edit.ts
+++ b/ui/lib/ldap/addon/components/page/library/create-and-edit.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,7 +23,7 @@ interface Args {
 
 export default class LdapCreateAndEditLibraryPageComponent extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked modelValidations: ValidationMap | null = null;
   @tracked invalidFormMessage = '';
diff --git a/ui/lib/ldap/addon/components/page/library/details.hbs b/ui/lib/ldap/addon/components/page/library/details.hbs
index 67044161803..bf503979928 100644
--- a/ui/lib/ldap/addon/components/page/library/details.hbs
+++ b/ui/lib/ldap/addon/components/page/library/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/ldap/addon/components/page/library/details.ts b/ui/lib/ldap/addon/components/page/library/details.ts
index c96962821cb..fa4ce23b78f 100644
--- a/ui/lib/ldap/addon/components/page/library/details.ts
+++ b/ui/lib/ldap/addon/components/page/library/details.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -20,7 +20,7 @@ interface Args {
 
 export default class LdapLibraryDetailsPageComponent extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   @action
   async delete() {
diff --git a/ui/lib/ldap/addon/components/page/library/details/accounts.hbs b/ui/lib/ldap/addon/components/page/library/details/accounts.hbs
index a59fccf2b1f..21964db99dd 100644
--- a/ui/lib/ldap/addon/components/page/library/details/accounts.hbs
+++ b/ui/lib/ldap/addon/components/page/library/details/accounts.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="is-grid has-top-margin-l grid-2-columns grid-gap-2">
   <div>
@@ -52,14 +52,16 @@
       @subText="Use the CLI command below:"
       class="has-padding-l has-top-margin-l"
     >
-      <Hds::CodeBlock
-        class="has-top-margin-s"
-        data-test-accounts-code-block
-        @language="bash"
-        @hasLineNumbers={{false}}
-        @hasCopyButton={{true}}
-        @value={{this.cliCommand}}
-      />
+      <:content>
+        <Hds::CodeBlock
+          class="has-top-margin-s"
+          data-test-code-block="accounts"
+          @language="bash"
+          @hasLineNumbers={{false}}
+          @hasCopyButton={{true}}
+          @value={{this.cliCommand}}
+        />
+      </:content>
     </OverviewCard>
   </div>
 </div>
diff --git a/ui/lib/ldap/addon/components/page/library/details/accounts.ts b/ui/lib/ldap/addon/components/page/library/details/accounts.ts
index 6e039f56893..71670b8f86e 100644
--- a/ui/lib/ldap/addon/components/page/library/details/accounts.ts
+++ b/ui/lib/ldap/addon/components/page/library/details/accounts.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -21,13 +21,13 @@ interface Args {
 
 export default class LdapLibraryDetailsAccountsPageComponent extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked showCheckOutPrompt = false;
   @tracked checkOutTtl: string | null = null;
 
   get cliCommand() {
-    return `vault lease renew ad/library/${this.args.library.name}/check-out/:lease_id`;
+    return `vault lease renew ${this.args.library.backend}/library/${this.args.library.name}/check-out/:lease_id`;
   }
   @action
   setTtl(data: TtlEvent) {
diff --git a/ui/lib/ldap/addon/components/page/library/details/configuration.hbs b/ui/lib/ldap/addon/components/page/library/details/configuration.hbs
index ce3aace93d7..04da7f460d5 100644
--- a/ui/lib/ldap/addon/components/page/library/details/configuration.hbs
+++ b/ui/lib/ldap/addon/components/page/library/details/configuration.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each @model.displayFields as |field|}}
   {{#let (get @model field.name) as |value|}}
diff --git a/ui/lib/ldap/addon/components/page/overview.hbs b/ui/lib/ldap/addon/components/page/overview.hbs
index 50b6fc714b0..314739bb5f1 100644
--- a/ui/lib/ldap/addon/components/page/overview.hbs
+++ b/ui/lib/ldap/addon/components/page/overview.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <TabPageHeader @model={{@backendModel}} @breadcrumbs={{@breadcrumbs}}>
   <:toolbarActions>
@@ -20,22 +20,28 @@
     <OverviewCard
       @cardTitle="Roles"
       @subText="The total number of roles that have been set up in this secret engine in order to generate credentials."
-      @actionText="Create new"
-      @actionTo="roles.create"
     >
-      <h2 class="title is-2 has-font-weight-normal has-top-margin-m" data-test-roles-count>
-        {{or @roles.length "None"}}
-      </h2>
+      <:action>
+        <Hds::Link::Standalone @text="Create new" @route="roles.create" @icon="plus" @iconPosition="trailing" />
+      </:action>
+      <:content>
+        <h2 class="title is-2 has-font-weight-normal has-top-margin-m" data-test-roles-count>
+          {{or @roles.length "None"}}
+        </h2>
+      </:content>
     </OverviewCard>
     <OverviewCard
       @cardTitle="Libraries"
       @subText="The total number of libraries that have been created for service account management."
-      @actionText="Create new"
-      @actionTo="libraries.create"
     >
-      <h2 class="title is-2 has-font-weight-normal has-top-margin-m" data-test-libraries-count>
-        {{or @libraries.length "None"}}
-      </h2>
+      <:action>
+        <Hds::Link::Standalone @text="Create new" @route="libraries.create" @icon="plus" @iconPosition="trailing" />
+      </:action>
+      <:content>
+        <h2 class="title is-2 has-font-weight-normal has-top-margin-m" data-test-libraries-count>
+          {{or @libraries.length "None"}}
+        </h2>
+      </:content>
     </OverviewCard>
   </div>
   <div class="is-grid has-top-margin-l grid-2-columns grid-gap-2">
@@ -47,26 +53,37 @@
       class="is-flex-half"
     />
     <div>
-      <OverviewCard @cardTitle="Generate credentials" @subText="Quickly generate credentials by typing the role name.">
-        <div class="has-top-margin-m is-flex">
-          <SearchSelect
-            class="is-flex-1"
-            @placeholder="Select a role"
-            @disallowNewItems={{true}}
-            @options={{@roles}}
-            @selectLimit="1"
-            @fallbackComponent="input-search"
-            @onChange={{this.selectRole}}
-          />
-          <Hds::Button
-            @text="Get credentials"
-            @color="secondary"
-            class="has-left-margin-s"
-            disabled={{not this.selectedRole}}
-            {{on "click" this.generateCredentials}}
-            data-test-generate-credential-button
-          />
-        </div>
+      <OverviewCard
+        @cardTitle="Generate credentials"
+        @subText="Quickly generate credentials by typing the role name. Only the engine's top-level roles are listed here."
+      >
+        <:content>
+          <div class="has-top-margin-m is-flex">
+            <SearchSelect
+              class="is-flex-1"
+              @ariaLabel="Role"
+              @placeholder="Select a role"
+              @disallowNewItems={{true}}
+              @options={{this.roleOptions}}
+              @selectLimit="1"
+              @fallbackComponent="input-search"
+              @onChange={{this.selectRole}}
+              @passObject={{true}}
+              @objectKeys={{array "id" "name" "type"}}
+              @shouldRenderName={{true}}
+            />
+            <div>
+              <Hds::Button
+                @text="Get credentials"
+                @color="secondary"
+                class="has-left-margin-s"
+                disabled={{not this.selectedRole}}
+                {{on "click" this.generateCredentials}}
+                data-test-generate-credential-button
+              />
+            </div>
+          </div>
+        </:content>
       </OverviewCard>
     </div>
   </div>
diff --git a/ui/lib/ldap/addon/components/page/overview.ts b/ui/lib/ldap/addon/components/page/overview.ts
index 78b89bedea4..1141faba36f 100644
--- a/ui/lib/ldap/addon/components/page/overview.ts
+++ b/ui/lib/ldap/addon/components/page/overview.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -24,15 +24,35 @@ interface Args {
   breadcrumbs: Array<Breadcrumb>;
 }
 
+interface Option {
+  id: string;
+  name: string;
+  type: string;
+}
+
 export default class LdapLibrariesPageComponent extends Component<Args> {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked selectedRole: LdapRoleModel | undefined;
 
+  get roleOptions() {
+    const options = this.args.roles
+      // hierarchical roles are not selectable
+      .filter((r: LdapRoleModel) => !r.name.endsWith('/'))
+      // *hack alert* - type is set as id so it renders beside name in search select
+      // this is to avoid more changes to search select and is okay here because
+      // we use the type and name to select the item below, not the id
+      .map((r: LdapRoleModel) => ({ id: r.type, name: r.name, type: r.type }));
+    return options;
+  }
+
   @action
-  selectRole([roleName]: Array<string>) {
-    const model = this.args.roles.find((role) => role.name === roleName);
-    this.selectedRole = model;
+  async selectRole([option]: Array<Option>) {
+    if (option) {
+      const { name, type } = option;
+      const model = this.args.roles.find((role) => role.name === name && role.type === type);
+      this.selectedRole = model;
+    }
   }
 
   @action
diff --git a/ui/lib/ldap/addon/components/page/role/create-and-edit.hbs b/ui/lib/ldap/addon/components/page/role/create-and-edit.hbs
index c90601480d1..93fb4f9471c 100644
--- a/ui/lib/ldap/addon/components/page/role/create-and-edit.hbs
+++ b/ui/lib/ldap/addon/components/page/role/create-and-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -52,7 +52,7 @@
   <div class="has-top-margin-l has-bottom-margin-l is-flex">
     <Hds::Button
       @text={{if @model.isNew "Create role" "Save"}}
-      data-test-save
+      data-test-submit
       type="submit"
       disabled={{this.save.isRunning}}
     />
diff --git a/ui/lib/ldap/addon/components/page/role/create-and-edit.ts b/ui/lib/ldap/addon/components/page/role/create-and-edit.ts
index 80fb5d164e5..65e6706abcb 100644
--- a/ui/lib/ldap/addon/components/page/role/create-and-edit.ts
+++ b/ui/lib/ldap/addon/components/page/role/create-and-edit.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,7 +15,7 @@ import type LdapRoleModel from 'vault/models/ldap/role';
 import { Breadcrumb, ValidationMap } from 'vault/vault/app-types';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type RouterService from '@ember/routing/router-service';
-import type StoreService from 'vault/services/store';
+import type PaginationService from 'vault/services/pagination';
 
 interface Args {
   model: LdapRoleModel;
@@ -30,8 +30,8 @@ interface RoleTypeOption {
 
 export default class LdapCreateAndEditRolePageComponent extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
-  @service declare readonly store: StoreService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly pagination: PaginationService;
 
   @tracked modelValidations: ValidationMap | null = null;
   @tracked invalidFormMessage = '';
@@ -71,7 +71,7 @@ export default class LdapCreateAndEditRolePageComponent extends Component<Args>
         yield model.save();
         this.flashMessages.success(`Successfully ${action} the role ${model.name}`);
         if (action === 'created') {
-          this.store.clearDataset('ldap/role');
+          this.pagination.clearDataset('ldap/role');
         }
         this.router.transitionTo(
           'vault.cluster.secrets.backend.ldap.roles.role.details',
diff --git a/ui/lib/ldap/addon/components/page/role/credentials.hbs b/ui/lib/ldap/addon/components/page/role/credentials.hbs
index 7e489f15863..e3e8c7a57cb 100644
--- a/ui/lib/ldap/addon/components/page/role/credentials.hbs
+++ b/ui/lib/ldap/addon/components/page/role/credentials.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/ldap/addon/components/page/role/credentials.ts b/ui/lib/ldap/addon/components/page/role/credentials.ts
index 9bb1dd1dbf6..851d04bbbda 100644
--- a/ui/lib/ldap/addon/components/page/role/credentials.ts
+++ b/ui/lib/ldap/addon/components/page/role/credentials.ts
@@ -1,19 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 
-import type {
-  LdapStaticRoleCredentials,
-  LdapDynamicRoleCredentials,
-} from 'ldap/routes/roles/role/credentials';
+import type { StaticCredentials, DynamicCredentials } from 'ldap/routes/roles/role/credentials';
 import { Breadcrumb } from 'vault/vault/app-types';
-import type AdapterError from 'ember-data/adapter'; // eslint-disable-line ember/use-ember-data-rfc-395-imports
+import type AdapterError from '@ember-data/adapter/error';
 
 interface Args {
-  credentials: LdapStaticRoleCredentials | LdapDynamicRoleCredentials;
+  credentials: StaticCredentials | DynamicCredentials;
   error: AdapterError;
   breadcrumbs: Array<Breadcrumb>;
 }
diff --git a/ui/lib/ldap/addon/components/page/role/details.hbs b/ui/lib/ldap/addon/components/page/role/details.hbs
index 86c2ec978b9..692267d7cf3 100644
--- a/ui/lib/ldap/addon/components/page/role/details.hbs
+++ b/ui/lib/ldap/addon/components/page/role/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -27,7 +27,7 @@
       <div class="toolbar-separator"></div>
     {{/if}}
     {{#if @model.canReadCreds}}
-      <ToolbarLink @route="roles.role.credentials" data-test-get-credentials>
+      <ToolbarLink @route="roles.role.credentials" data-test-button="Get credentials">
         Get credentials
       </ToolbarLink>
     {{/if}}
diff --git a/ui/lib/ldap/addon/components/page/role/details.ts b/ui/lib/ldap/addon/components/page/role/details.ts
index cc6e9f08560..fe3c5934ee5 100644
--- a/ui/lib/ldap/addon/components/page/role/details.ts
+++ b/ui/lib/ldap/addon/components/page/role/details.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,7 +14,7 @@ import type LdapRoleModel from 'vault/models/ldap/role';
 import { Breadcrumb } from 'vault/vault/app-types';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type RouterService from '@ember/routing/router-service';
-import type StoreService from 'vault/services/store';
+import type PaginationService from 'vault/services/pagination';
 
 interface Args {
   model: LdapRoleModel;
@@ -23,15 +23,15 @@ interface Args {
 
 export default class LdapRoleDetailsPageComponent extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
-  @service declare readonly store: StoreService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly pagination: PaginationService;
 
   @action
   async delete() {
     try {
       await this.args.model.destroyRecord();
       this.flashMessages.success('Role deleted successfully.');
-      this.store.clearDataset('ldap/role');
+      this.pagination.clearDataset('ldap/role');
       this.router.transitionTo('vault.cluster.secrets.backend.ldap.roles');
     } catch (error) {
       const message = errorMessage(error, 'Unable to delete role. Please try again or contact support.');
diff --git a/ui/lib/ldap/addon/components/page/roles.hbs b/ui/lib/ldap/addon/components/page/roles.hbs
index 740c9d92e9b..50a367ad19d 100644
--- a/ui/lib/ldap/addon/components/page/roles.hbs
+++ b/ui/lib/ldap/addon/components/page/roles.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <TabPageHeader @model={{@backendModel}} @breadcrumbs={{@breadcrumbs}}>
   <:toolbarFilters>
@@ -9,8 +9,7 @@
       <FilterInput
         aria-label="Filter roles"
         placeholder="Filter roles"
-        value={{@pageFilter}}
-        @autofocus={{true}}
+        @value={{@pageFilter}}
         @onInput={{this.onFilterChange}}
       />
     {{/if}}
@@ -43,48 +42,63 @@
 {{else}}
   <div class="has-bottom-margin-s">
     {{#each @roles as |role|}}
-      <ListItem @linkPrefix={{this.mountPoint}} @linkParams={{array "roles.role.details" role.type role.name}} as |Item|>
+      <ListItem @linkPrefix={{this.mountPoint}} @linkParams={{this.linkParams role}} as |Item|>
         <Item.content>
           <Icon @name="user" />
-          <span data-test-role={{role.name}}>{{role.name}}</span>
+          <span data-test-role="{{role.type}} {{role.name}}">{{role.name}}</span>
           <Hds::Badge @text={{role.type}} data-test-role-type-badge={{role.name}} />
         </Item.content>
         <Item.menu>
           <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
-            <dd.ToggleIcon @icon="more-horizontal" @text="More options" @hasChevron={{false}} data-test-popup-menu-trigger />
-            {{#if role.canEdit}}
-              <dd.Interactive @text="Edit" data-test-edit @route="roles.role.edit" @models={{array role.type role.name}} />
-            {{/if}}
-            {{#if role.canReadCreds}}
-              <dd.Interactive
-                @text="Get credentials"
-                data-test-get-creds
-                @route="roles.role.credentials"
-                @models={{array role.type role.name}}
-              />
-            {{/if}}
-            {{#if role.canRotateStaticCreds}}
-              <dd.Interactive
-                @text="Rotate credentials"
-                data-test-rotate-creds
-                @color="critical"
-                {{on "click" (fn (mut this.credsToRotate) role)}}
-              />
-            {{/if}}
-            <dd.Interactive
-              @text="Details"
-              data-test-details
-              @route="roles.role.details"
-              {{! this will force the roles.role model hook to fire since we may only have a partial model loaded in the list view }}
-              @models={{array role.type role.name}}
+            <dd.ToggleIcon
+              @icon="more-horizontal"
+              @text="More options"
+              @hasChevron={{false}}
+              data-test-popup-menu-trigger="{{role.type}} {{role.name}}"
             />
-            {{#if role.canDelete}}
+            {{#if (this.isHierarchical role.name)}}
+              <dd.Interactive
+                data-test-subdirectory
+                @route="roles.subdirectory"
+                @models={{array role.type role.completeRoleName}}
+              >Content</dd.Interactive>
+            {{else}}
+              {{#if role.canEdit}}
+                <dd.Interactive
+                  data-test-edit
+                  @route="roles.role.edit"
+                  @models={{array role.type role.name}}
+                >Edit</dd.Interactive>
+              {{/if}}
+              {{#if role.canReadCreds}}
+                <dd.Interactive
+                  data-test-get-creds
+                  @route="roles.role.credentials"
+                  @models={{array role.type role.completeRoleName}}
+                >
+                  Get credentials
+                </dd.Interactive>
+              {{/if}}
+              {{#if role.canRotateStaticCreds}}
+                <dd.Interactive
+                  data-test-rotate-creds
+                  @color="critical"
+                  {{on "click" (fn (mut this.credsToRotate) role)}}
+                >Rotate credentials</dd.Interactive>
+              {{/if}}
               <dd.Interactive
-                @text="Delete"
-                data-test-delete
-                @color="critical"
-                {{on "click" (fn (mut this.roleToDelete) role)}}
-              />
+                data-test-details
+                @route="roles.role.details"
+                {{! this will force the roles.role model hook to fire since we may only have a partial model loaded in the list view }}
+                @models={{array role.type role.completeRoleName}}
+              >Details</dd.Interactive>
+              {{#if role.canDelete}}
+                <dd.Interactive
+                  data-test-delete
+                  @color="critical"
+                  {{on "click" (fn (mut this.roleToDelete) role)}}
+                >Delete</dd.Interactive>
+              {{/if}}
             {{/if}}
           </Hds::Dropdown>
         </Item.menu>
@@ -110,7 +124,9 @@
     <Hds::Pagination::Numbered
       @currentPage={{@roles.meta.currentPage}}
       @currentPageSize={{@roles.meta.pageSize}}
-      @route="roles"
+      {{! localName will be either "index" or "subdirectory" }}
+      @route="roles.{{this.router.currentRoute.localName}}"
+      @models={{@currentRouteParams}}
       @showSizeSelector={{false}}
       @totalItems={{@roles.meta.filteredTotal}}
       @queryFunction={{this.paginationQueryParams}}
diff --git a/ui/lib/ldap/addon/components/page/roles.ts b/ui/lib/ldap/addon/components/page/roles.ts
index f3dacb0be29..d433d42d30a 100644
--- a/ui/lib/ldap/addon/components/page/roles.ts
+++ b/ui/lib/ldap/addon/components/page/roles.ts
@@ -1,21 +1,21 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 import errorMessage from 'vault/utils/error-message';
+import { tracked } from '@glimmer/tracking';
 
 import type LdapRoleModel from 'vault/models/ldap/role';
 import type SecretEngineModel from 'vault/models/secret-engine';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type { Breadcrumb, EngineOwner } from 'vault/vault/app-types';
 import type RouterService from '@ember/routing/router-service';
-import type StoreService from 'vault/services/store';
-import { tracked } from '@glimmer/tracking';
+import type PaginationService from 'vault/services/pagination';
 
 interface Args {
   roles: Array<LdapRoleModel>;
@@ -27,11 +27,19 @@ interface Args {
 
 export default class LdapRolesPageComponent extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
-  @service declare readonly store: StoreService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly pagination: PaginationService;
+
   @tracked credsToRotate: LdapRoleModel | null = null;
   @tracked roleToDelete: LdapRoleModel | null = null;
 
+  isHierarchical = (name: string) => name.endsWith('/');
+
+  linkParams = (role: LdapRoleModel) => {
+    const route = this.isHierarchical(role.name) ? 'roles.subdirectory' : 'roles.role.details';
+    return [route, role.type, role.completeRoleName];
+  };
+
   get mountPoint(): string {
     const owner = getOwner(this) as EngineOwner;
     return owner.mountPoint;
@@ -43,13 +51,14 @@ export default class LdapRolesPageComponent extends Component<Args> {
 
   @action
   onFilterChange(pageFilter: string) {
-    this.router.transitionTo('vault.cluster.secrets.backend.ldap.roles', { queryParams: { pageFilter } });
+    // refresh route, which fires off lazyPaginatedQuery to re-request and filter response
+    this.router.transitionTo(this.router?.currentRoute?.name, { queryParams: { pageFilter } });
   }
 
   @action
   async onRotate(model: LdapRoleModel) {
     try {
-      const message = `Successfully rotated credentials for ${model.name}.`;
+      const message = `Successfully rotated credentials for ${model.completeRoleName}.`;
       await model.rotateStaticPassword();
       this.flashMessages.success(message);
     } catch (error) {
@@ -62,9 +71,9 @@ export default class LdapRolesPageComponent extends Component<Args> {
   @action
   async onDelete(model: LdapRoleModel) {
     try {
-      const message = `Successfully deleted role ${model.name}.`;
+      const message = `Successfully deleted role ${model.completeRoleName}.`;
       await model.destroyRecord();
-      this.store.clearDataset('ldap/role');
+      this.pagination.clearDataset('ldap/role');
       this.router.transitionTo('vault.cluster.secrets.backend.ldap.roles');
       this.flashMessages.success(message);
     } catch (error) {
diff --git a/ui/lib/ldap/addon/components/tab-page-header.hbs b/ui/lib/ldap/addon/components/tab-page-header.hbs
index e8c11721ee5..79a2929119a 100644
--- a/ui/lib/ldap/addon/components/tab-page-header.hbs
+++ b/ui/lib/ldap/addon/components/tab-page-header.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/ldap/addon/controllers/roles/index.ts b/ui/lib/ldap/addon/controllers/roles/index.ts
index a8eec50870f..efbd592ed47 100644
--- a/ui/lib/ldap/addon/controllers/roles/index.ts
+++ b/ui/lib/ldap/addon/controllers/roles/index.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/ldap/addon/controllers/roles/subdirectory.ts b/ui/lib/ldap/addon/controllers/roles/subdirectory.ts
new file mode 100644
index 00000000000..80ee078357c
--- /dev/null
+++ b/ui/lib/ldap/addon/controllers/roles/subdirectory.ts
@@ -0,0 +1,10 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Controller from '@ember/controller';
+
+export default class LdapRolesSubdirectoryController extends Controller {
+  queryParams = ['pageFilter', 'page'];
+}
diff --git a/ui/lib/ldap/addon/engine.js b/ui/lib/ldap/addon/engine.js
index 22a4c7caa64..be8dbde9cf0 100644
--- a/ui/lib/ldap/addon/engine.js
+++ b/ui/lib/ldap/addon/engine.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,7 +14,7 @@ export default class LdapEngine extends Engine {
   modulePrefix = modulePrefix;
   Resolver = Resolver;
   dependencies = {
-    services: ['router', 'store', 'secret-mount-path', 'flash-messages', 'auth'],
+    services: ['app-router', 'store', 'pagination', 'secret-mount-path', 'flash-messages', 'auth'],
     externalRoutes: ['secrets'],
   };
 }
diff --git a/ui/lib/ldap/addon/routes.js b/ui/lib/ldap/addon/routes.js
index e363f3dd1be..46d656a6fa9 100644
--- a/ui/lib/ldap/addon/routes.js
+++ b/ui/lib/ldap/addon/routes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,8 @@ export default buildRoutes(function () {
   this.route('overview');
   this.route('roles', function () {
     this.route('create');
+    // wildcard route so we can traverse hierarchical roles i.e. prod/admin/my-role
+    this.route('subdirectory', { path: '/:type/subdirectory/*path_to_role' });
     this.route('role', { path: '/:type/:name' }, function () {
       this.route('details');
       this.route('edit');
@@ -17,6 +19,8 @@ export default buildRoutes(function () {
   });
   this.route('libraries', function () {
     this.route('create');
+    // wildcard route so we can traverse hierarchical libraries i.e. prod/admin/my-library
+    this.route('subdirectory', { path: '/subdirectory/*path_to_library' });
     this.route('library', { path: '/:name' }, function () {
       this.route('details', function () {
         this.route('accounts');
diff --git a/ui/lib/ldap/addon/routes/configuration.ts b/ui/lib/ldap/addon/routes/configuration.ts
index 914567eabdc..ac705cbe735 100644
--- a/ui/lib/ldap/addon/routes/configuration.ts
+++ b/ui/lib/ldap/addon/routes/configuration.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,16 +14,16 @@ import type LdapConfigModel from 'vault/models/ldap/config';
 import type SecretEngineModel from 'vault/models/secret-engine';
 import type Controller from '@ember/controller';
 import type { Breadcrumb } from 'vault/vault/app-types';
-import type AdapterError from 'ember-data/adapter'; // eslint-disable-line ember/use-ember-data-rfc-395-imports
+import type AdapterError from '@ember-data/adapter/error';
 
-interface LdapConfigurationRouteModel {
+interface RouteModel {
   backendModel: SecretEngineModel;
   configModel: LdapConfigModel;
   configError: AdapterError;
 }
-interface LdapConfigurationController extends Controller {
+interface RouteController extends Controller {
   breadcrumbs: Array<Breadcrumb>;
-  model: LdapConfigurationRouteModel;
+  model: RouteModel;
 }
 
 @withConfig('ldap/config')
@@ -42,16 +42,13 @@ export default class LdapConfigurationRoute extends Route {
     };
   }
 
-  setupController(
-    controller: LdapConfigurationController,
-    resolvedModel: LdapConfigurationRouteModel,
-    transition: Transition
-  ) {
+  setupController(controller: RouteController, resolvedModel: RouteModel, transition: Transition) {
     super.setupController(controller, resolvedModel, transition);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backendModel.id },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backendModel.id, route: 'overview', model: resolvedModel.backendModel.id },
+      { label: 'Configuration' },
     ];
   }
 }
diff --git a/ui/lib/ldap/addon/routes/configure.ts b/ui/lib/ldap/addon/routes/configure.ts
index 48733085261..29bc6fc2acb 100644
--- a/ui/lib/ldap/addon/routes/configure.ts
+++ b/ui/lib/ldap/addon/routes/configure.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,7 +14,7 @@ import type LdapConfigModel from 'vault/models/ldap/config';
 import type Controller from '@ember/controller';
 import type { Breadcrumb } from 'vault/vault/app-types';
 
-interface LdapConfigureController extends Controller {
+interface RouteController extends Controller {
   breadcrumbs: Array<Breadcrumb>;
 }
 
@@ -30,11 +30,7 @@ export default class LdapConfigureRoute extends Route {
     return this.configModel || this.store.createRecord('ldap/config', { backend });
   }
 
-  setupController(
-    controller: LdapConfigureController,
-    resolvedModel: LdapConfigModel,
-    transition: Transition
-  ) {
+  setupController(controller: RouteController, resolvedModel: LdapConfigModel, transition: Transition) {
     super.setupController(controller, resolvedModel, transition);
 
     controller.breadcrumbs = [
diff --git a/ui/lib/ldap/addon/routes/error.ts b/ui/lib/ldap/addon/routes/error.ts
index 45901f7b385..6b7ddc9f43d 100644
--- a/ui/lib/ldap/addon/routes/error.ts
+++ b/ui/lib/ldap/addon/routes/error.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,7 @@ import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
 import type Transition from '@ember/routing/transition';
-import type AdapterError from 'ember-data/adapter'; // eslint-disable-line ember/use-ember-data-rfc-395-imports
+import type AdapterError from '@ember-data/adapter/error';
 import type SecretEngineModel from 'vault/models/secret-engine';
 import type { Breadcrumb } from 'vault/vault/app-types';
 import type Controller from '@ember/controller';
@@ -24,7 +24,7 @@ export default class LdapErrorRoute extends Route {
   setupController(controller: LdapErrorController, resolvedModel: AdapterError, transition: Transition) {
     super.setupController(controller, resolvedModel, transition);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: this.secretMountPath.currentPath, route: 'overview' },
     ];
     controller.backend = this.modelFor('application') as SecretEngineModel;
diff --git a/ui/lib/ldap/addon/routes/libraries/create.ts b/ui/lib/ldap/addon/routes/libraries/create.ts
index 67c7775fb84..d353e002542 100644
--- a/ui/lib/ldap/addon/routes/libraries/create.ts
+++ b/ui/lib/ldap/addon/routes/libraries/create.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -36,8 +36,8 @@ export default class LdapLibrariesCreateRoute extends Route {
 
     controller.breadcrumbs = [
       { label: resolvedModel.backend, route: 'overview' },
-      { label: 'libraries', route: 'libraries' },
-      { label: 'create' },
+      { label: 'Libraries', route: 'libraries' },
+      { label: 'Create' },
     ];
   }
 }
diff --git a/ui/lib/ldap/addon/routes/libraries/index.ts b/ui/lib/ldap/addon/routes/libraries/index.ts
index 04bacb21f84..5c5e14db96b 100644
--- a/ui/lib/ldap/addon/routes/libraries/index.ts
+++ b/ui/lib/ldap/addon/routes/libraries/index.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -50,8 +50,9 @@ export default class LdapLibrariesRoute extends Route {
     super.setupController(controller, resolvedModel, transition);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backendModel.id },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backendModel.id, route: 'overview', model: resolvedModel.backendModel.id },
+      { label: 'Libraries' },
     ];
   }
 }
diff --git a/ui/lib/ldap/addon/routes/libraries/library.ts b/ui/lib/ldap/addon/routes/libraries/library.ts
index 5a026c2b359..53fe5cb8afa 100644
--- a/ui/lib/ldap/addon/routes/libraries/library.ts
+++ b/ui/lib/ldap/addon/routes/libraries/library.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,7 +10,7 @@ import type Store from '@ember-data/store';
 import type SecretMountPath from 'vault/services/secret-mount-path';
 
 interface LdapLibraryRouteParams {
-  name: string;
+  name?: string;
 }
 
 export default class LdapLibraryRoute extends Route {
diff --git a/ui/lib/ldap/addon/routes/libraries/library/check-out.ts b/ui/lib/ldap/addon/routes/libraries/library/check-out.ts
index 084a76d15de..86bbcf17e40 100644
--- a/ui/lib/ldap/addon/routes/libraries/library/check-out.ts
+++ b/ui/lib/ldap/addon/routes/libraries/library/check-out.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,7 +15,7 @@ import type Controller from '@ember/controller';
 import type Transition from '@ember/routing/transition';
 import type { Breadcrumb } from 'vault/vault/app-types';
 import { LdapLibraryCheckOutCredentials } from 'vault/vault/adapters/ldap/library';
-import type AdapterError from 'ember-data/adapter'; // eslint-disable-line ember/use-ember-data-rfc-395-imports
+import { ldapBreadcrumbs, libraryRoutes } from 'ldap/utils/ldap-breadcrumbs';
 
 interface LdapLibraryCheckOutController extends Controller {
   breadcrumbs: Array<Breadcrumb>;
@@ -24,7 +24,7 @@ interface LdapLibraryCheckOutController extends Controller {
 
 export default class LdapLibraryCheckOutRoute extends Route {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   accountsRoute = 'vault.cluster.secrets.backend.ldap.libraries.library.details.accounts';
 
@@ -35,7 +35,7 @@ export default class LdapLibraryCheckOutRoute extends Route {
     }
   }
   model(_params: object, transition: Transition) {
-    const { ttl } = transition.to.queryParams;
+    const ttl = transition.to?.queryParams['ttl'] as string;
     const library = this.modelFor('libraries.library') as LdapLibraryModel;
     return library.checkOutAccount(ttl);
   }
@@ -45,18 +45,20 @@ export default class LdapLibraryCheckOutRoute extends Route {
     transition: Transition
   ) {
     super.setupController(controller, resolvedModel, transition);
-
     const library = this.modelFor('libraries.library') as LdapLibraryModel;
+    const routeParams = (childResource: string) => {
+      return [library.backend, childResource];
+    };
     controller.breadcrumbs = [
       { label: library.backend, route: 'overview' },
-      { label: 'libraries', route: 'libraries' },
-      { label: library.name, route: 'libraries.library' },
-      { label: 'check-out' },
+      { label: 'Libraries', route: 'libraries' },
+      ...ldapBreadcrumbs(library.name, routeParams, libraryRoutes),
+      { label: 'Check-Out' },
     ];
   }
 
   @action
-  error(error: AdapterError) {
+  error(error: Error) {
     // if check-out fails, return to library details route
     const message = errorMessage(error, 'Error checking out account. Please try again or contact support.');
     this.flashMessages.danger(message);
diff --git a/ui/lib/ldap/addon/routes/libraries/library/details.ts b/ui/lib/ldap/addon/routes/libraries/library/details.ts
index 7f8c579dc0b..0cbe1d6382d 100644
--- a/ui/lib/ldap/addon/routes/libraries/library/details.ts
+++ b/ui/lib/ldap/addon/routes/libraries/library/details.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import type LdapLibraryModel from 'vault/models/ldap/library';
 import type Controller from '@ember/controller';
 import type Transition from '@ember/routing/transition';
 import type { Breadcrumb } from 'vault/vault/app-types';
+import { ldapBreadcrumbs, libraryRoutes } from 'ldap/utils/ldap-breadcrumbs';
 
 interface LdapLibraryDetailsController extends Controller {
   breadcrumbs: Array<Breadcrumb>;
@@ -23,10 +24,14 @@ export default class LdapLibraryDetailsRoute extends Route {
   ) {
     super.setupController(controller, resolvedModel, transition);
 
+    const routeParams = (childResource: string) => {
+      return [resolvedModel.backend, childResource];
+    };
+
     controller.breadcrumbs = [
       { label: resolvedModel.backend, route: 'overview' },
-      { label: 'libraries', route: 'libraries' },
-      { label: resolvedModel.name },
+      { label: 'Libraries', route: 'libraries' },
+      ...ldapBreadcrumbs(resolvedModel.name, routeParams, libraryRoutes, true),
     ];
   }
 }
diff --git a/ui/lib/ldap/addon/routes/libraries/library/details/accounts.ts b/ui/lib/ldap/addon/routes/libraries/library/details/accounts.ts
index 3885cab201c..656415fa13a 100644
--- a/ui/lib/ldap/addon/routes/libraries/library/details/accounts.ts
+++ b/ui/lib/ldap/addon/routes/libraries/library/details/accounts.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/ldap/addon/routes/libraries/library/details/index.ts b/ui/lib/ldap/addon/routes/libraries/library/details/index.ts
index 77024023f48..408195ab1ba 100644
--- a/ui/lib/ldap/addon/routes/libraries/library/details/index.ts
+++ b/ui/lib/ldap/addon/routes/libraries/library/details/index.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { service } from '@ember/service';
 import type RouterService from '@ember/routing/router-service';
 
 export default class LdapLibraryRoute extends Route {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   redirect() {
     this.router.transitionTo('vault.cluster.secrets.backend.ldap.libraries.library.details.accounts');
diff --git a/ui/lib/ldap/addon/routes/libraries/library/edit.ts b/ui/lib/ldap/addon/routes/libraries/library/edit.ts
index 329983097b2..682a6183c85 100644
--- a/ui/lib/ldap/addon/routes/libraries/library/edit.ts
+++ b/ui/lib/ldap/addon/routes/libraries/library/edit.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import type LdapLibraryModel from 'vault/models/ldap/library';
 import type Controller from '@ember/controller';
 import type Transition from '@ember/routing/transition';
 import type { Breadcrumb } from 'vault/vault/app-types';
+import { ldapBreadcrumbs, libraryRoutes } from 'ldap/utils/ldap-breadcrumbs';
 
 interface LdapLibraryEditController extends Controller {
   breadcrumbs: Array<Breadcrumb>;
@@ -23,11 +24,14 @@ export default class LdapLibraryEditRoute extends Route {
   ) {
     super.setupController(controller, resolvedModel, transition);
 
+    const routeParams = (childResource: string) => {
+      return [resolvedModel.backend, childResource];
+    };
     controller.breadcrumbs = [
       { label: resolvedModel.backend, route: 'overview' },
-      { label: 'libraries', route: 'libraries' },
-      { label: resolvedModel.name, route: 'libraries.library.details' },
-      { label: 'edit' },
+      { label: 'Libraries', route: 'libraries' },
+      ...ldapBreadcrumbs(resolvedModel.name, routeParams, libraryRoutes),
+      { label: 'Edit' },
     ];
   }
 }
diff --git a/ui/lib/ldap/addon/routes/libraries/library/index.ts b/ui/lib/ldap/addon/routes/libraries/library/index.ts
index eb4fbd897f0..d5fcbd155c2 100644
--- a/ui/lib/ldap/addon/routes/libraries/library/index.ts
+++ b/ui/lib/ldap/addon/routes/libraries/library/index.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { service } from '@ember/service';
 import type RouterService from '@ember/routing/router-service';
 
 export default class LdapLibraryRoute extends Route {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   redirect() {
     this.router.transitionTo('vault.cluster.secrets.backend.ldap.libraries.library.details');
diff --git a/ui/lib/ldap/addon/routes/libraries/subdirectory.ts b/ui/lib/ldap/addon/routes/libraries/subdirectory.ts
new file mode 100644
index 00000000000..ff520cf7e1b
--- /dev/null
+++ b/ui/lib/ldap/addon/routes/libraries/subdirectory.ts
@@ -0,0 +1,60 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import { hash } from 'rsvp';
+
+import type Store from '@ember-data/store';
+import type SecretMountPath from 'vault/services/secret-mount-path';
+import type Transition from '@ember/routing/transition';
+import type LdapLibraryModel from 'vault/models/ldap/library';
+import type SecretEngineModel from 'vault/models/secret-engine';
+import type Controller from '@ember/controller';
+import type { Breadcrumb } from 'vault/vault/app-types';
+import { ldapBreadcrumbs, libraryRoutes } from 'ldap/utils/ldap-breadcrumbs';
+
+interface RouteModel {
+  backendModel: SecretEngineModel;
+  path_to_library: string;
+  libraries: Array<LdapLibraryModel>;
+}
+interface RouteController extends Controller {
+  breadcrumbs: Array<Breadcrumb>;
+  model: RouteModel;
+}
+interface RouteParams {
+  path_to_library?: string;
+}
+
+export default class LdapLibrariesSubdirectoryRoute extends Route {
+  @service declare readonly store: Store;
+  @service declare readonly secretMountPath: SecretMountPath;
+
+  model(params: RouteParams) {
+    const backendModel = this.modelFor('application') as SecretEngineModel;
+    const { path_to_library } = params;
+    return hash({
+      backendModel,
+      path_to_library,
+      libraries: this.store.query('ldap/library', { backend: backendModel.id, path_to_library }),
+    });
+  }
+
+  setupController(controller: RouteController, resolvedModel: RouteModel, transition: Transition) {
+    super.setupController(controller, resolvedModel, transition);
+
+    const routeParams = (childResource: string) => {
+      return [resolvedModel.backendModel.id, childResource];
+    };
+
+    controller.breadcrumbs = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backendModel.id, route: 'overview' },
+      { label: 'Libraries', route: 'libraries' },
+      ...ldapBreadcrumbs(resolvedModel.path_to_library, routeParams, libraryRoutes, true),
+    ];
+  }
+}
diff --git a/ui/lib/ldap/addon/routes/overview.ts b/ui/lib/ldap/addon/routes/overview.ts
index fce16371558..f4012e61933 100644
--- a/ui/lib/ldap/addon/routes/overview.ts
+++ b/ui/lib/ldap/addon/routes/overview.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -18,10 +18,10 @@ import type Controller from '@ember/controller';
 import type { Breadcrumb } from 'vault/vault/app-types';
 import { LdapLibraryAccountStatus } from 'vault/vault/adapters/ldap/library';
 
-interface LdapOverviewController extends Controller {
+interface RouteController extends Controller {
   breadcrumbs: Array<Breadcrumb>;
 }
-interface LdapOverviewRouteModel {
+interface RouteModel {
   backendModel: SecretEngineModel;
   promptConfig: boolean;
   roles: Array<LdapRoleModel>;
@@ -66,15 +66,11 @@ export default class LdapOverviewRoute extends Route {
     });
   }
 
-  setupController(
-    controller: LdapOverviewController,
-    resolvedModel: LdapOverviewRouteModel,
-    transition: Transition
-  ) {
+  setupController(controller: RouteController, resolvedModel: RouteModel, transition: Transition) {
     super.setupController(controller, resolvedModel, transition);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: resolvedModel.backendModel.id },
     ];
   }
diff --git a/ui/lib/ldap/addon/routes/roles.ts b/ui/lib/ldap/addon/routes/roles.ts
new file mode 100644
index 00000000000..9777f29b66a
--- /dev/null
+++ b/ui/lib/ldap/addon/routes/roles.ts
@@ -0,0 +1,31 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+
+import type PaginationService from 'vault/services/pagination';
+import type SecretMountPath from 'vault/services/secret-mount-path';
+
+// Base class for roles/index and roles/subdirectory routes
+export default class LdapRolesRoute extends Route {
+  @service declare readonly pagination: PaginationService;
+  @service declare readonly secretMountPath: SecretMountPath;
+
+  lazyQuery(backendId: string, params: { page?: string; pageFilter?: string }, adapterOptions: object) {
+    const page = Number(params.page) || 1;
+    return this.pagination.lazyPaginatedQuery(
+      'ldap/role',
+      {
+        backend: backendId,
+        page,
+        pageFilter: params.pageFilter,
+        responsePath: 'data.keys',
+        skipCache: page === 1,
+      },
+      { adapterOptions }
+    );
+  }
+}
diff --git a/ui/lib/ldap/addon/routes/roles/create.ts b/ui/lib/ldap/addon/routes/roles/create.ts
index 4c10a0e8309..a037598052d 100644
--- a/ui/lib/ldap/addon/routes/roles/create.ts
+++ b/ui/lib/ldap/addon/routes/roles/create.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,7 +13,7 @@ import type Controller from '@ember/controller';
 import type Transition from '@ember/routing/transition';
 import type { Breadcrumb } from 'vault/vault/app-types';
 
-interface LdapRolesCreateController extends Controller {
+interface RouteController extends Controller {
   breadcrumbs: Array<Breadcrumb>;
   model: LdapRoleModel;
 }
@@ -27,17 +27,13 @@ export default class LdapRolesCreateRoute extends Route {
     return this.store.createRecord('ldap/role', { backend });
   }
 
-  setupController(
-    controller: LdapRolesCreateController,
-    resolvedModel: LdapRoleModel,
-    transition: Transition
-  ) {
+  setupController(controller: RouteController, resolvedModel: LdapRoleModel, transition: Transition) {
     super.setupController(controller, resolvedModel, transition);
 
     controller.breadcrumbs = [
       { label: resolvedModel.backend, route: 'overview' },
-      { label: 'roles', route: 'roles' },
-      { label: 'create' },
+      { label: 'Roles', route: 'roles' },
+      { label: 'Create' },
     ];
   }
 }
diff --git a/ui/lib/ldap/addon/routes/roles/index.ts b/ui/lib/ldap/addon/routes/roles/index.ts
index ee494c1b6e8..0868034e144 100644
--- a/ui/lib/ldap/addon/routes/roles/index.ts
+++ b/ui/lib/ldap/addon/routes/roles/index.ts
@@ -1,42 +1,34 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Route from '@ember/routing/route';
+import LdapRolesRoute from '../roles';
 import { service } from '@ember/service';
 import { withConfig } from 'core/decorators/fetch-secrets-engine-config';
 import { hash } from 'rsvp';
 
-import type StoreService from 'vault/services/store';
-import type SecretMountPath from 'vault/services/secret-mount-path';
+import type Store from '@ember-data/store';
 import type Transition from '@ember/routing/transition';
 import type LdapRoleModel from 'vault/models/ldap/role';
 import type SecretEngineModel from 'vault/models/secret-engine';
 import type Controller from '@ember/controller';
 import type { Breadcrumb } from 'vault/vault/app-types';
 
-interface LdapRolesRouteModel {
+interface RouteModel {
   backendModel: SecretEngineModel;
   promptConfig: boolean;
   roles: Array<LdapRoleModel>;
 }
-interface LdapRolesController extends Controller {
-  breadcrumbs: Array<Breadcrumb>;
-  model: LdapRolesRouteModel;
-  pageFilter: string | undefined;
-  page: number | undefined;
-}
 
-interface LdapRolesRouteParams {
-  page?: string;
-  pageFilter: string;
+interface RouteController extends Controller {
+  breadcrumbs: Array<Breadcrumb>;
+  model: RouteModel;
 }
 
 @withConfig('ldap/config')
-export default class LdapRolesRoute extends Route {
-  @service declare readonly store: StoreService;
-  @service declare readonly secretMountPath: SecretMountPath;
+export default class LdapRolesIndexRoute extends LdapRolesRoute {
+  @service declare readonly store: Store; // necessary for @withConfig decorator
 
   declare promptConfig: boolean;
 
@@ -49,38 +41,26 @@ export default class LdapRolesRoute extends Route {
     },
   };
 
-  model(params: LdapRolesRouteParams) {
+  model(params: { page?: string; pageFilter: string }) {
     const backendModel = this.modelFor('application') as SecretEngineModel;
     return hash({
       backendModel,
       promptConfig: this.promptConfig,
-      roles: this.store.lazyPaginatedQuery(
-        'ldap/role',
-        {
-          backend: backendModel.id,
-          page: Number(params.page) || 1,
-          pageFilter: params.pageFilter,
-          responsePath: 'data.keys',
-        },
-        { adapterOptions: { showPartialError: true } }
-      ),
+      roles: this.lazyQuery(backendModel.id, params, { showPartialError: true }),
     });
   }
 
-  setupController(
-    controller: LdapRolesController,
-    resolvedModel: LdapRolesRouteModel,
-    transition: Transition
-  ) {
+  setupController(controller: RouteController, resolvedModel: RouteModel, transition: Transition) {
     super.setupController(controller, resolvedModel, transition);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: resolvedModel.backendModel.id },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: resolvedModel.backendModel.id, route: 'overview' },
+      { label: 'Roles' },
     ];
   }
 
-  resetController(controller: LdapRolesController, isExiting: boolean) {
+  resetController(controller: RouteController, isExiting: boolean) {
     if (isExiting) {
       controller.set('pageFilter', undefined);
       controller.set('page', undefined);
diff --git a/ui/lib/ldap/addon/routes/roles/role.ts b/ui/lib/ldap/addon/routes/roles/role.ts
index 85fe107299f..5b3685e7a8b 100644
--- a/ui/lib/ldap/addon/routes/roles/role.ts
+++ b/ui/lib/ldap/addon/routes/roles/role.ts
@@ -1,24 +1,22 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
+import { ModelFrom } from 'vault/vault/route';
 import type Store from '@ember-data/store';
 import type SecretMountPath from 'vault/services/secret-mount-path';
 
-interface LdapRoleRouteParams {
-  name: string;
-  type: string;
-}
+export type LdapRolesRoleRouteModel = ModelFrom<LdapRolesRoleRoute>;
 
-export default class LdapRoleRoute extends Route {
+export default class LdapRolesRoleRoute extends Route {
   @service declare readonly store: Store;
   @service declare readonly secretMountPath: SecretMountPath;
 
-  model(params: LdapRoleRouteParams) {
+  model(params: { name: string; type: string }) {
     const backend = this.secretMountPath.currentPath;
     const { name, type } = params;
     return this.store.queryRecord('ldap/role', { backend, name, type });
diff --git a/ui/lib/ldap/addon/routes/roles/role/credentials.ts b/ui/lib/ldap/addon/routes/roles/role/credentials.ts
index ffbe8a74ebf..46e8ca6d1cf 100644
--- a/ui/lib/ldap/addon/routes/roles/role/credentials.ts
+++ b/ui/lib/ldap/addon/routes/roles/role/credentials.ts
@@ -1,19 +1,20 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
+import { ldapBreadcrumbs, roleRoutes } from 'ldap/utils/ldap-breadcrumbs';
 
 import type Store from '@ember-data/store';
 import type LdapRoleModel from 'vault/models/ldap/role';
 import type Controller from '@ember/controller';
 import type Transition from '@ember/routing/transition';
 import type { Breadcrumb } from 'vault/vault/app-types';
-import type AdapterError from 'ember-data/adapter'; // eslint-disable-line ember/use-ember-data-rfc-395-imports
+import type AdapterError from '@ember-data/adapter/error';
 
-export interface LdapStaticRoleCredentials {
+export interface StaticCredentials {
   dn: string;
   last_vault_rotation: string;
   password: string;
@@ -23,7 +24,7 @@ export interface LdapStaticRoleCredentials {
   username: string;
   type: string;
 }
-export interface LdapDynamicRoleCredentials {
+export interface DynamicCredentials {
   distinguished_names: Array<string>;
   password: string;
   username: string;
@@ -32,13 +33,13 @@ export interface LdapDynamicRoleCredentials {
   renewable: boolean;
   type: string;
 }
-interface LdapRoleCredentialsRouteModel {
-  credentials: undefined | LdapStaticRoleCredentials | LdapDynamicRoleCredentials;
+interface RouteModel {
+  credentials: undefined | StaticCredentials | DynamicCredentials;
   error: undefined | AdapterError;
 }
-interface LdapRoleCredentialsController extends Controller {
+interface RouteController extends Controller {
   breadcrumbs: Array<Breadcrumb>;
-  model: LdapRoleCredentialsRouteModel;
+  model: RouteModel;
 }
 
 export default class LdapRoleCredentialsRoute extends Route {
@@ -53,19 +54,19 @@ export default class LdapRoleCredentialsRoute extends Route {
       return { error };
     }
   }
-  setupController(
-    controller: LdapRoleCredentialsController,
-    resolvedModel: LdapRoleCredentialsRouteModel,
-    transition: Transition
-  ) {
+  setupController(controller: RouteController, resolvedModel: RouteModel, transition: Transition) {
     super.setupController(controller, resolvedModel, transition);
 
     const role = this.modelFor('roles.role') as LdapRoleModel;
+    const routeParams = (childResource: string) => {
+      return [role.backend, role.type, childResource];
+    };
     controller.breadcrumbs = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: role.backend, route: 'overview' },
-      { label: 'roles', route: 'roles' },
-      { label: role.name, route: 'roles.role' },
-      { label: 'credentials' },
+      { label: 'Roles', route: 'roles' },
+      ...ldapBreadcrumbs(role.name, routeParams, roleRoutes),
+      { label: 'Credentials' },
     ];
   }
 }
diff --git a/ui/lib/ldap/addon/routes/roles/role/details.ts b/ui/lib/ldap/addon/routes/roles/role/details.ts
index 2ae529e5830..97dd3adc8ca 100644
--- a/ui/lib/ldap/addon/routes/roles/role/details.ts
+++ b/ui/lib/ldap/addon/routes/roles/role/details.ts
@@ -1,32 +1,38 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+import { ldapBreadcrumbs, roleRoutes } from 'ldap/utils/ldap-breadcrumbs';
 
-import type LdapRoleModel from 'vault/models/ldap/role';
+import type { Breadcrumb } from 'vault/vault/app-types';
 import type Controller from '@ember/controller';
+import type LdapRoleModel from 'vault/models/ldap/role';
+import type SecretMountPath from 'vault/services/secret-mount-path';
 import type Transition from '@ember/routing/transition';
-import type { Breadcrumb } from 'vault/vault/app-types';
 
-interface LdapRoleDetailsController extends Controller {
+interface RouteController extends Controller {
   breadcrumbs: Array<Breadcrumb>;
   model: LdapRoleModel;
 }
 
-export default class LdapRoleEditRoute extends Route {
-  setupController(
-    controller: LdapRoleDetailsController,
-    resolvedModel: LdapRoleModel,
-    transition: Transition
-  ) {
+export default class LdapRolesRoleDetailsRoute extends Route {
+  @service declare readonly secretMountPath: SecretMountPath;
+
+  setupController(controller: RouteController, resolvedModel: LdapRoleModel, transition: Transition) {
     super.setupController(controller, resolvedModel, transition);
 
+    const routeParams = (childResource: string) => {
+      return [this.secretMountPath.currentPath, resolvedModel.type, childResource];
+    };
+
     controller.breadcrumbs = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: resolvedModel.backend, route: 'overview' },
-      { label: 'roles', route: 'roles' },
-      { label: resolvedModel.name },
+      { label: 'Roles', route: 'roles' },
+      ...ldapBreadcrumbs(resolvedModel.name, routeParams, roleRoutes, true),
     ];
   }
 }
diff --git a/ui/lib/ldap/addon/routes/roles/role/edit.ts b/ui/lib/ldap/addon/routes/roles/role/edit.ts
index 8fa5f3f8562..303fc3ac02f 100644
--- a/ui/lib/ldap/addon/routes/roles/role/edit.ts
+++ b/ui/lib/ldap/addon/routes/roles/role/edit.ts
@@ -1,29 +1,35 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
+import { ldapBreadcrumbs, roleRoutes } from 'ldap/utils/ldap-breadcrumbs';
 
 import type LdapRoleModel from 'vault/models/ldap/role';
 import type Controller from '@ember/controller';
 import type Transition from '@ember/routing/transition';
 import type { Breadcrumb } from 'vault/vault/app-types';
 
-interface LdapRoleEditController extends Controller {
+interface RouteController extends Controller {
   breadcrumbs: Array<Breadcrumb>;
   model: LdapRoleModel;
 }
 
 export default class LdapRoleEditRoute extends Route {
-  setupController(controller: LdapRoleEditController, resolvedModel: LdapRoleModel, transition: Transition) {
+  setupController(controller: RouteController, resolvedModel: LdapRoleModel, transition: Transition) {
     super.setupController(controller, resolvedModel, transition);
 
+    const routeParams = (childResource: string) => {
+      return [resolvedModel.backend, resolvedModel.type, childResource];
+    };
+
     controller.breadcrumbs = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: resolvedModel.backend, route: 'overview' },
-      { label: 'roles', route: 'roles' },
-      { label: resolvedModel.name, route: 'roles.role' },
-      { label: 'edit' },
+      { label: 'Roles', route: 'roles' },
+      ...ldapBreadcrumbs(resolvedModel.name, routeParams, roleRoutes),
+      { label: 'Edit' },
     ];
   }
 }
diff --git a/ui/lib/ldap/addon/routes/roles/role/index.ts b/ui/lib/ldap/addon/routes/roles/role/index.ts
index 852289daf1b..1ccb70dd758 100644
--- a/ui/lib/ldap/addon/routes/roles/role/index.ts
+++ b/ui/lib/ldap/addon/routes/roles/role/index.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { service } from '@ember/service';
 import type RouterService from '@ember/routing/router-service';
 
 export default class LdapRoleRoute extends Route {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   redirect() {
     this.router.transitionTo('vault.cluster.secrets.backend.ldap.roles.role.details');
diff --git a/ui/lib/ldap/addon/routes/roles/subdirectory.ts b/ui/lib/ldap/addon/routes/roles/subdirectory.ts
new file mode 100644
index 00000000000..0cae502af4a
--- /dev/null
+++ b/ui/lib/ldap/addon/routes/roles/subdirectory.ts
@@ -0,0 +1,80 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import LdapRolesRoute from '../roles';
+import { hash } from 'rsvp';
+import { ldapBreadcrumbs, roleRoutes } from 'ldap/utils/ldap-breadcrumbs';
+
+import type { Breadcrumb } from 'vault/vault/app-types';
+import type Controller from '@ember/controller';
+import type LdapRoleModel from 'vault/models/ldap/role';
+import type SecretEngineModel from 'vault/models/secret-engine';
+import type Transition from '@ember/routing/transition';
+
+interface RouteModel {
+  backendModel: SecretEngineModel;
+  roleAncestry: { path_to_role: string; type: string };
+  roles: Array<LdapRoleModel>;
+}
+
+interface RouteController extends Controller {
+  breadcrumbs: Array<Breadcrumb>;
+  model: RouteModel;
+}
+
+interface RouteParams {
+  page?: string;
+  pageFilter?: string;
+  path_to_role?: string;
+  type?: string;
+}
+
+export default class LdapRolesSubdirectoryRoute extends LdapRolesRoute {
+  queryParams = {
+    pageFilter: {
+      refreshModel: true,
+    },
+    page: {
+      refreshModel: true,
+    },
+  };
+
+  model(params: RouteParams) {
+    const backendModel = this.modelFor('application') as SecretEngineModel;
+    const { path_to_role, type } = params;
+    const roleAncestry = { path_to_role, type };
+    return hash({
+      backendModel,
+      roleAncestry,
+      roles: this.lazyQuery(backendModel.id, params, { roleAncestry }),
+    });
+  }
+
+  setupController(controller: RouteController, resolvedModel: RouteModel, transition: Transition) {
+    super.setupController(controller, resolvedModel, transition);
+    const { backendModel, roleAncestry } = resolvedModel;
+
+    const routeParams = (childResource: string) => {
+      return [backendModel.id, roleAncestry.type, childResource];
+    };
+
+    const crumbs = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: backendModel.id, route: 'overview' },
+      { label: 'Roles', route: 'roles' },
+      ...ldapBreadcrumbs(roleAncestry.path_to_role, routeParams, roleRoutes, true),
+    ];
+
+    // must call 'set' so breadcrumbs update as we navigate through directories
+    controller.set('breadcrumbs', crumbs);
+  }
+
+  resetController(controller: RouteController, isExiting: boolean) {
+    if (isExiting) {
+      controller.set('pageFilter', undefined);
+      controller.set('page', undefined);
+    }
+  }
+}
diff --git a/ui/lib/ldap/addon/templates/configuration.hbs b/ui/lib/ldap/addon/templates/configuration.hbs
index c6846297a99..87c13efb66b 100644
--- a/ui/lib/ldap/addon/templates/configuration.hbs
+++ b/ui/lib/ldap/addon/templates/configuration.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Configuration
   @configModel={{this.model.configModel}}
diff --git a/ui/lib/ldap/addon/templates/configure.hbs b/ui/lib/ldap/addon/templates/configure.hbs
index eba4ea7cb7d..3fb10e43dfe 100644
--- a/ui/lib/ldap/addon/templates/configure.hbs
+++ b/ui/lib/ldap/addon/templates/configure.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Configure @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/error.hbs b/ui/lib/ldap/addon/templates/error.hbs
index 8fbd70d53e3..6f3f16cd780 100644
--- a/ui/lib/ldap/addon/templates/error.hbs
+++ b/ui/lib/ldap/addon/templates/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <TabPageHeader @model={{this.backend}} @breadcrumbs={{this.breadcrumbs}} />
 
diff --git a/ui/lib/ldap/addon/templates/libraries/create.hbs b/ui/lib/ldap/addon/templates/libraries/create.hbs
index 3b692e312f1..f9064a6f46b 100644
--- a/ui/lib/ldap/addon/templates/libraries/create.hbs
+++ b/ui/lib/ldap/addon/templates/libraries/create.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Library::CreateAndEdit @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/libraries/index.hbs b/ui/lib/ldap/addon/templates/libraries/index.hbs
index dc35a820e77..6e1c1177f9d 100644
--- a/ui/lib/ldap/addon/templates/libraries/index.hbs
+++ b/ui/lib/ldap/addon/templates/libraries/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Libraries
   @libraries={{this.model.libraries}}
diff --git a/ui/lib/ldap/addon/templates/libraries/library/check-out.hbs b/ui/lib/ldap/addon/templates/libraries/library/check-out.hbs
index 356df6aea2a..fd8df0defd3 100644
--- a/ui/lib/ldap/addon/templates/libraries/library/check-out.hbs
+++ b/ui/lib/ldap/addon/templates/libraries/library/check-out.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Library::CheckOut @credentials={{@model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/libraries/library/details.hbs b/ui/lib/ldap/addon/templates/libraries/library/details.hbs
index 981818c42d0..30387d747bf 100644
--- a/ui/lib/ldap/addon/templates/libraries/library/details.hbs
+++ b/ui/lib/ldap/addon/templates/libraries/library/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Library::Details @model={{@model}} @breadcrumbs={{this.breadcrumbs}} />
 
diff --git a/ui/lib/ldap/addon/templates/libraries/library/details/accounts.hbs b/ui/lib/ldap/addon/templates/libraries/library/details/accounts.hbs
index f34e53c49a4..64298065d6c 100644
--- a/ui/lib/ldap/addon/templates/libraries/library/details/accounts.hbs
+++ b/ui/lib/ldap/addon/templates/libraries/library/details/accounts.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Library::Details::Accounts @library={{this.model.library}} @statuses={{this.model.statuses}} />
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/libraries/library/details/configuration.hbs b/ui/lib/ldap/addon/templates/libraries/library/details/configuration.hbs
index 26770a3d9d1..fc20502014e 100644
--- a/ui/lib/ldap/addon/templates/libraries/library/details/configuration.hbs
+++ b/ui/lib/ldap/addon/templates/libraries/library/details/configuration.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Library::Details::Configuration @model={{this.model}} />
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/libraries/library/edit.hbs b/ui/lib/ldap/addon/templates/libraries/library/edit.hbs
index 3b692e312f1..f9064a6f46b 100644
--- a/ui/lib/ldap/addon/templates/libraries/library/edit.hbs
+++ b/ui/lib/ldap/addon/templates/libraries/library/edit.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Library::CreateAndEdit @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/libraries/subdirectory.hbs b/ui/lib/ldap/addon/templates/libraries/subdirectory.hbs
new file mode 100644
index 00000000000..e484e1bb42e
--- /dev/null
+++ b/ui/lib/ldap/addon/templates/libraries/subdirectory.hbs
@@ -0,0 +1,11 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Page::Libraries
+  @libraries={{this.model.libraries}}
+  @promptConfig={{false}}
+  @backendModel={{this.model.backendModel}}
+  @breadcrumbs={{this.breadcrumbs}}
+/>
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/overview.hbs b/ui/lib/ldap/addon/templates/overview.hbs
index 6048776c521..eea21c86ec5 100644
--- a/ui/lib/ldap/addon/templates/overview.hbs
+++ b/ui/lib/ldap/addon/templates/overview.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Overview
   @promptConfig={{this.model.promptConfig}}
diff --git a/ui/lib/ldap/addon/templates/roles/create.hbs b/ui/lib/ldap/addon/templates/roles/create.hbs
index 89b28b1d803..dad9d524570 100644
--- a/ui/lib/ldap/addon/templates/roles/create.hbs
+++ b/ui/lib/ldap/addon/templates/roles/create.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Role::CreateAndEdit @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/roles/index.hbs b/ui/lib/ldap/addon/templates/roles/index.hbs
index 4892aa2f9cf..1a291729645 100644
--- a/ui/lib/ldap/addon/templates/roles/index.hbs
+++ b/ui/lib/ldap/addon/templates/roles/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Roles
   @roles={{this.model.roles}}
diff --git a/ui/lib/ldap/addon/templates/roles/role/credentials.hbs b/ui/lib/ldap/addon/templates/roles/role/credentials.hbs
index 52beccf8000..f1160658256 100644
--- a/ui/lib/ldap/addon/templates/roles/role/credentials.hbs
+++ b/ui/lib/ldap/addon/templates/roles/role/credentials.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Role::Credentials @credentials={{@model.credentials}} @error={{@model.error}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/roles/role/details.hbs b/ui/lib/ldap/addon/templates/roles/role/details.hbs
index e58572a6c33..5ae72f2cd64 100644
--- a/ui/lib/ldap/addon/templates/roles/role/details.hbs
+++ b/ui/lib/ldap/addon/templates/roles/role/details.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Role::Details @model={{@model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/roles/role/edit.hbs b/ui/lib/ldap/addon/templates/roles/role/edit.hbs
index 89b28b1d803..dad9d524570 100644
--- a/ui/lib/ldap/addon/templates/roles/role/edit.hbs
+++ b/ui/lib/ldap/addon/templates/roles/role/edit.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::Role::CreateAndEdit @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/templates/roles/subdirectory.hbs b/ui/lib/ldap/addon/templates/roles/subdirectory.hbs
new file mode 100644
index 00000000000..5a1edeca1c0
--- /dev/null
+++ b/ui/lib/ldap/addon/templates/roles/subdirectory.hbs
@@ -0,0 +1,15 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#let this.model.roleAncestry.type this.model.roleAncestry.path_to_role as |roleType path_to_role|}}
+  <Page::Roles
+    @roles={{this.model.roles}}
+    @promptConfig={{false}}
+    @backendModel={{this.model.backendModel}}
+    @breadcrumbs={{this.breadcrumbs}}
+    @pageFilter={{this.pageFilter}}
+    @currentRouteParams={{array this.model.backendModel.id roleType path_to_role}}
+  />
+{{/let}}
\ No newline at end of file
diff --git a/ui/lib/ldap/addon/utils/ldap-breadcrumbs.ts b/ui/lib/ldap/addon/utils/ldap-breadcrumbs.ts
new file mode 100644
index 00000000000..5ebb3dca6d9
--- /dev/null
+++ b/ui/lib/ldap/addon/utils/ldap-breadcrumbs.ts
@@ -0,0 +1,41 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+import type { Breadcrumb } from 'vault/vault/app-types';
+
+export const roleRoutes = { details: 'roles.role.details', subdirectory: 'roles.subdirectory' };
+export const libraryRoutes = {
+  details: 'libraries.library.details',
+  subdirectory: 'libraries.subdirectory',
+};
+
+export const ldapBreadcrumbs = (
+  fullPath: string | undefined, // i.e. path/to/item
+  routeParams: (childResource: string) => string[], // array of route param strings
+  routes: { details: string; subdirectory: string },
+  lastItemCurrent = false // this array of objects can be spread anywhere within the crumbs array
+): Breadcrumb[] => {
+  if (!fullPath) return [];
+  const ancestry = fullPath.split('/').filter((path) => path !== '');
+  const isDirectory = fullPath.endsWith('/');
+
+  return ancestry.map((name: string, idx: number) => {
+    const isLast = ancestry.length === idx + 1;
+    // if the end of the path is the current route, don't return a route link
+    if (isLast && lastItemCurrent) return { label: name };
+
+    // each segment is a continued concatenation of ancestral paths.
+    // for example, if the full path to an item is "prod/admin/west"
+    // the segments will be: prod/, prod/admin/, prod/admin/west.
+    // LIST or GET requests can then be made for each crumb accordingly.
+    const segment = ancestry.slice(0, idx + 1).join('/');
+
+    const itemPath = isLast && !isDirectory ? segment : `${segment}/`;
+    return {
+      label: name,
+      route: isLast && !isDirectory ? routes.details : routes.subdirectory,
+      models: routeParams(itemPath),
+    };
+  });
+};
diff --git a/ui/lib/ldap/config/environment.js b/ui/lib/ldap/config/environment.js
index 42059bd5cc7..eae03812965 100644
--- a/ui/lib/ldap/config/environment.js
+++ b/ui/lib/ldap/config/environment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/ldap/index.js b/ui/lib/ldap/index.js
index ea720a64cfa..d9b55bec67a 100644
--- a/ui/lib/ldap/index.js
+++ b/ui/lib/ldap/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,6 +16,10 @@ module.exports = buildEngine({
     enabled: false,
   }),
 
+  babel: {
+    plugins: [require.resolve('ember-concurrency/async-arrow-task-transform')],
+  },
+
   isDevelopingAddon() {
     return true;
   },
diff --git a/ui/lib/ldap/package.json b/ui/lib/ldap/package.json
index 5288e352efa..be96c680229 100644
--- a/ui/lib/ldap/package.json
+++ b/ui/lib/ldap/package.json
@@ -10,6 +10,7 @@
     "ember-cli-babel": "*",
     "ember-concurrency": "*",
     "@ember/test-waiters": "*",
+    "ember-auto-import": "*",
     "ember-cli-typescript": "*",
     "@types/ember": "latest",
     "@types/ember-data": "latest",
diff --git a/ui/lib/open-api-explorer/addon/components/swagger-ui.hbs b/ui/lib/open-api-explorer/addon/components/swagger-ui.hbs
new file mode 100644
index 00000000000..de6efa1337a
--- /dev/null
+++ b/ui/lib/open-api-explorer/addon/components/swagger-ui.hbs
@@ -0,0 +1,25 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<PageHeader as |p|>
+  <p.levelLeft>
+    <h1 class="title is-3">
+      API Explorer
+    </h1>
+  </p.levelLeft>
+</PageHeader>
+
+<div class="box is-fullwidth is-sideless is-marginless">
+  <NamespaceReminder as |R|>
+    Requests use the header
+    <code>X-Vault-Namespace: {{R.namespace.path}}</code>. You can also use
+    <code>{{R.namespace.path}}</code>
+    as an API prefix. See
+    <DocLink @path="/vault/api-docs#namespaces">docs</DocLink>
+    for examples.
+  </NamespaceReminder>
+
+  <div id={{this.inputId}} class="swagger-ember" {{did-insert this.swaggerInit}} data-test-swagger-ui></div>
+</div>
\ No newline at end of file
diff --git a/ui/lib/open-api-explorer/addon/components/swagger-ui.js b/ui/lib/open-api-explorer/addon/components/swagger-ui.js
index 024edf03a04..56cee505d77 100644
--- a/ui/lib/open-api-explorer/addon/components/swagger-ui.js
+++ b/ui/lib/open-api-explorer/addon/components/swagger-ui.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,10 +8,14 @@ import { service } from '@ember/service';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
 import parseURL from 'core/utils/parse-url';
-import config from 'open-api-explorer/config/environment';
+import config from 'vault/config/environment';
+import openApiExplorerConfig from 'open-api-explorer/config/environment';
 import { guidFor } from '@ember/object/internals';
+import SwaggerUIBundle from 'swagger-ui-dist/swagger-ui-bundle.js';
+import { camelize } from '@ember/string';
+import keys from 'core/utils/keys';
 
-const { APP } = config;
+const { APP } = openApiExplorerConfig;
 
 export default class SwaggerUiComponent extends Component {
   @service auth;
@@ -25,33 +29,64 @@ export default class SwaggerUiComponent extends Component {
     return {
       fn: {
         opsFilter: (taggedOps, phrase) => {
-          // map over the options and filter out operations where the path doesn't match what's typed
-          return (
-            taggedOps
-              .map((tagObj) => {
-                const operations = tagObj.get('operations').filter((operationObj) => {
-                  return operationObj.get('path').includes(phrase);
-                });
-                return tagObj.set('operations', operations);
-              })
-              // then traverse again and remove the top level item if there are no operations left after filtering
-              .filter((tagObj) => !!tagObj.get('operations').size)
-          );
+          const filteredOperations = taggedOps.reduce((acc, tagObj) => {
+            const operations = tagObj.get('operations');
+
+            // filter out operations where the path doesn't match search phrase
+            const operationsWithMatchingPath = operations.filter((operationObj) => {
+              const path = operationObj.get('path');
+              return path.includes(phrase);
+            });
+
+            // if there are any operations left after filtering, add the tagObj to the accumulator
+            if (operationsWithMatchingPath.size > 0) {
+              acc.push(tagObj.set('operations', operationsWithMatchingPath));
+            }
+
+            return acc;
+          }, []);
+
+          return filteredOperations;
         },
       },
     };
   }
 
+  // the operationId values in the spec are dasherized
+  // camelize the values so they match the function names in the generated API client SDK
+  CamelizeOperationIdPlugin() {
+    return {
+      wrapComponents: {
+        operation:
+          (Original, { React }) =>
+          (props) => {
+            const { operation } = props;
+            const operationId = operation.get('operationId');
+
+            if (operationId) {
+              return React.createElement(Original, {
+                ...props,
+                operation: operation.set('operationId', camelize(operationId)),
+              });
+            }
+
+            return React.createElement(Original, props);
+          },
+      },
+    };
+  }
+
   CONFIG = (SwaggerUIBundle, componentInstance) => {
     return {
       dom_id: `#${componentInstance.inputId}`,
       url: '/v1/sys/internal/specs/openapi',
       deepLinking: false,
       presets: [SwaggerUIBundle.presets.apis],
-      plugins: [SwaggerUIBundle.plugins.DownloadUrl, this.SearchFilterPlugin],
+      plugins: [SwaggerUIBundle.plugins.DownloadUrl, this.SearchFilterPlugin, this.CamelizeOperationIdPlugin],
       // 'list' expands tags, but not operations
       docExpansion: 'list',
       operationsSorter: 'alpha',
+      displayOperationId: config.environment === 'development',
       filter: true,
       // this makes sure we show the x-vault- options
       showExtensions: true,
@@ -78,15 +113,79 @@ export default class SwaggerUiComponent extends Component {
       },
       onComplete: () => {
         componentInstance.swaggerLoading = false;
+        this.applyA11yFixes();
       },
     };
   };
 
   // using an action to bind the correct "this" context
   @action async swaggerInit() {
-    const { default: SwaggerUIBundle } = await import('swagger-ui-dist/swagger-ui-bundle.js');
-    // trim any slashes on the filter value
     const configSettings = this.CONFIG(SwaggerUIBundle, this);
     SwaggerUIBundle(configSettings);
   }
+
+  applyA11yFixes() {
+    const container = document.querySelector('.swagger-ui');
+    if (container) {
+      this.observer = new MutationObserver(() => {
+        this.updateCaretTabIndex();
+        this.updateCopyToClipboard();
+        this.updateDisabledFields();
+        this.updateTryItOutButtonDescription();
+      });
+      this.observer.observe(container, { childList: true, subtree: true });
+      // Run once on initial load
+      this.updateCaretTabIndex();
+      this.updateCopyToClipboard();
+      this.updateDisabledFields();
+      this.updateTryItOutButtonDescription();
+    }
+  }
+
+  updateCaretTabIndex() {
+    document.querySelectorAll('.opblock-control-arrow').forEach((el) => {
+      el.tabIndex = 0;
+    });
+  }
+
+  updateCopyToClipboard() {
+    document.querySelectorAll('.copy-to-clipboard').forEach((div) => {
+      div.tabIndex = 0;
+      div.setAttribute('role', 'button');
+      div.addEventListener('keydown', function (e) {
+        if (e.key === keys.ENTER || e.key === keys.SPACE) {
+          const svg = div.querySelector('svg');
+          if (svg) {
+            svg.dispatchEvent(new MouseEvent('click', { bubbles: true }));
+          }
+          e.preventDefault();
+        }
+      });
+    });
+  }
+
+  updateDisabledFields() {
+    document.querySelectorAll('.parameters').forEach((el) => {
+      if (!el.disabled) {
+        el.removeAttribute('readonly');
+      } else {
+        el.removeAttribute('disabled');
+        el.setAttribute('readonly', true);
+      }
+    });
+  }
+
+  updateTryItOutButtonDescription() {
+    document.querySelectorAll('.try-out button').forEach((el) => {
+      const warning =
+        'Caution: This will make requests to the Vault server on your behalf which may create or delete items.';
+
+      el.setAttribute('aria-description', warning);
+    });
+  }
+
+  willDestroy() {
+    this.observer.disconnect();
+    super.willDestroy();
+  }
 }
diff --git a/ui/lib/open-api-explorer/addon/engine.js b/ui/lib/open-api-explorer/addon/engine.js
index b16e623c86e..1dc22fa4eb1 100644
--- a/ui/lib/open-api-explorer/addon/engine.js
+++ b/ui/lib/open-api-explorer/addon/engine.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,7 +14,7 @@ const Eng = Engine.extend({
   modulePrefix,
   Resolver,
   dependencies: {
-    services: ['auth', 'flash-messages', 'namespace', 'router', 'version'],
+    services: ['auth', 'flash-messages', 'namespace', 'app-router', 'version'],
   },
 });
 
diff --git a/ui/lib/open-api-explorer/addon/resolver.js b/ui/lib/open-api-explorer/addon/resolver.js
index deb3e8ad3b4..aaae6063af1 100644
--- a/ui/lib/open-api-explorer/addon/resolver.js
+++ b/ui/lib/open-api-explorer/addon/resolver.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/open-api-explorer/addon/routes.js b/ui/lib/open-api-explorer/addon/routes.js
index 18ec2bd321e..88f45ded504 100644
--- a/ui/lib/open-api-explorer/addon/routes.js
+++ b/ui/lib/open-api-explorer/addon/routes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/open-api-explorer/addon/routes/index.js b/ui/lib/open-api-explorer/addon/routes/index.js
index 57408807b93..92a0dec2f48 100644
--- a/ui/lib/open-api-explorer/addon/routes/index.js
+++ b/ui/lib/open-api-explorer/addon/routes/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/open-api-explorer/addon/templates/application.hbs b/ui/lib/open-api-explorer/addon/templates/application.hbs
index 11a06fba008..f6eb0207f6a 100644
--- a/ui/lib/open-api-explorer/addon/templates/application.hbs
+++ b/ui/lib/open-api-explorer/addon/templates/application.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{outlet}}
\ No newline at end of file
diff --git a/ui/lib/open-api-explorer/addon/templates/components/swagger-ui.hbs b/ui/lib/open-api-explorer/addon/templates/components/swagger-ui.hbs
deleted file mode 100644
index 230fe6aec58..00000000000
--- a/ui/lib/open-api-explorer/addon/templates/components/swagger-ui.hbs
+++ /dev/null
@@ -1,16 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-<div class="box is-fullwidth is-sideless">
-  <NamespaceReminder as |R|>
-    Requests use the header
-    <code>X-Vault-Namespace: {{R.namespace.path}}</code>. You can also use
-    <code>{{R.namespace.path}}</code>
-    as an API prefix. See
-    <DocLink @path="/vault/api-docs#namespaces">docs</DocLink>
-    for examples.
-  </NamespaceReminder>
-  <div id={{this.inputId}} class="swagger-ember" {{did-insert this.swaggerInit}} data-test-swagger-ui></div>
-</div>
\ No newline at end of file
diff --git a/ui/lib/open-api-explorer/addon/templates/index.hbs b/ui/lib/open-api-explorer/addon/templates/index.hbs
index ff97c189cc1..f50b9cfa5d7 100644
--- a/ui/lib/open-api-explorer/addon/templates/index.hbs
+++ b/ui/lib/open-api-explorer/addon/templates/index.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <SwaggerUi />
\ No newline at end of file
diff --git a/ui/lib/open-api-explorer/config/environment.js b/ui/lib/open-api-explorer/config/environment.js
index 9bba7411a62..b7c70fef3a6 100644
--- a/ui/lib/open-api-explorer/config/environment.js
+++ b/ui/lib/open-api-explorer/config/environment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/open-api-explorer/index.js b/ui/lib/open-api-explorer/index.js
index 4e712bf4f30..948095fbb0a 100644
--- a/ui/lib/open-api-explorer/index.js
+++ b/ui/lib/open-api-explorer/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,9 +13,6 @@ const EngineAddon = require('ember-engines/lib/engine-addon');
 module.exports = EngineAddon.extend({
   name: 'open-api-explorer',
 
-  babel: {
-    plugins: [require.resolve('ember-auto-import/babel-plugin')],
-  },
   included() {
     this._super.included && this._super.included.apply(this, arguments);
     // we want to lazy load the CSS deps, importing them here will result in them being added to the
diff --git a/ui/lib/pki/addon/components/page/pki-certificate-details.hbs b/ui/lib/pki/addon/components/page/pki-certificate-details.hbs
index d5d3e4ba8ab..1c17503a8c2 100644
--- a/ui/lib/pki/addon/components/page/pki-certificate-details.hbs
+++ b/ui/lib/pki/addon/components/page/pki-certificate-details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
diff --git a/ui/lib/pki/addon/components/page/pki-certificate-details.ts b/ui/lib/pki/addon/components/page/pki-certificate-details.ts
index ff017f1e71f..b78cf2f7a69 100644
--- a/ui/lib/pki/addon/components/page/pki-certificate-details.ts
+++ b/ui/lib/pki/addon/components/page/pki-certificate-details.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/page/pki-configuration-details.hbs b/ui/lib/pki/addon/components/page/pki-configuration-details.hbs
index ae18cd00d1e..7ed34fc0870 100644
--- a/ui/lib/pki/addon/components/page/pki-configuration-details.hbs
+++ b/ui/lib/pki/addon/components/page/pki-configuration-details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @hasConfig}}
   <Toolbar aria-label="PKI configuration">
@@ -16,7 +16,7 @@
         />
         <div class="toolbar-separator"></div>
       {{/if}}
-      <ToolbarLink @route="configuration.edit">
+      <ToolbarLink @route="configuration.edit" @model={{@backend}}>
         Edit configuration
       </ToolbarLink>
     </ToolbarActions>
@@ -42,6 +42,7 @@
       <InfoTableRow
         @label={{or attr.options.label (humanize (dasherize attr.name))}}
         @value={{or (get @acme attr.name) "None"}}
+        @formatTtl={{eq attr.options.editType "ttl"}}
       />
     {{/each}}
   {{/if}}
diff --git a/ui/lib/pki/addon/components/page/pki-configuration-details.ts b/ui/lib/pki/addon/components/page/pki-configuration-details.ts
index 149d7b45039..96a48d36e66 100644
--- a/ui/lib/pki/addon/components/page/pki-configuration-details.ts
+++ b/ui/lib/pki/addon/components/page/pki-configuration-details.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,7 +10,7 @@ import { tracked } from '@glimmer/tracking';
 import errorMessage from 'vault/utils/error-message';
 import type RouterService from '@ember/routing/router-service';
 import type FlashMessageService from 'vault/services/flash-messages';
-import type Store from 'vault/services/store';
+import type Store from '@ember-data/store';
 import type VersionService from 'vault/services/version';
 
 interface Args {
@@ -19,7 +19,7 @@ interface Args {
 
 export default class PkiConfigurationDetails extends Component<Args> {
   @service declare readonly store: Store;
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
   @service declare readonly flashMessages: FlashMessageService;
   @service declare readonly version: VersionService;
   @tracked showDeleteAllIssuers = false;
diff --git a/ui/lib/pki/addon/components/page/pki-configuration-edit.hbs b/ui/lib/pki/addon/components/page/pki-configuration-edit.hbs
index e1c890a0b31..8f789339345 100644
--- a/ui/lib/pki/addon/components/page/pki-configuration-edit.hbs
+++ b/ui/lib/pki/addon/components/page/pki-configuration-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-sideless is-fullwidth is-marginless">
   {{#if this.errors}}
diff --git a/ui/lib/pki/addon/components/page/pki-configuration-edit.ts b/ui/lib/pki/addon/components/page/pki-configuration-edit.ts
index 704b77d1540..cd640d56364 100644
--- a/ui/lib/pki/addon/components/page/pki-configuration-edit.ts
+++ b/ui/lib/pki/addon/components/page/pki-configuration-edit.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -18,6 +18,7 @@ import type PkiConfigClusterModel from 'vault/models/pki/config/cluster';
 import type PkiConfigCrlModel from 'vault/models/pki/config/crl';
 import type PkiConfigUrlsModel from 'vault/models/pki/config/urls';
 import type { FormField, TtlEvent } from 'vault/app-types';
+import { addToArray } from 'vault/helpers/add-to-array';
 
 interface Args {
   acme: PkiConfigAcmeModel;
@@ -43,7 +44,7 @@ interface ErrorObject {
   message: string;
 }
 export default class PkiConfigurationEditComponent extends Component<Args> {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
   @service declare readonly flashMessages: FlashMessageService;
   @service declare readonly version: VersionService;
 
@@ -76,7 +77,7 @@ export default class PkiConfigurationEditComponent extends Component<Args> {
           message: errorMessage(error),
         };
         this.flashMessages.danger(`Error updating config/${modelName}`, { sticky: true });
-        this.errors.pushObject(errorObject);
+        this.errors = addToArray(this.errors, errorObject);
       }
     }
 
diff --git a/ui/lib/pki/addon/components/page/pki-configure-create.hbs b/ui/lib/pki/addon/components/page/pki-configure-create.hbs
index f03b78749f7..4dbdb7c8074 100644
--- a/ui/lib/pki/addon/components/page/pki-configure-create.hbs
+++ b/ui/lib/pki/addon/components/page/pki-configure-create.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{@breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-engine-page-title>
+    <h1 class="title is-3" data-test-page-title>
       {{this.title}}
     </h1>
   </p.levelLeft>
@@ -85,14 +85,10 @@
     @onComplete={{transition-to "vault.cluster.secrets.backend.pki.overview"}}
   />
 {{else}}
-  <EmptyState
-    @title="Choose an option"
-    @message="To see configuration options, choose your desired output above."
-    data-test-configuration-empty-state
-  />
+  <EmptyState @title="Choose an option" @message="To see configuration options, choose your desired output above." />
   <hr class="has-background-gray-100" />
   <Hds::ButtonSet>
-    <Hds::Button @text="Done" disabled={{true}} data-test-pki-config-save />
-    <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onCancel}} data-test-pki-config-cancel />
+    <Hds::Button @text="Done" disabled={{true}} data-test-submit />
+    <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onCancel}} data-test-cancel />
   </Hds::ButtonSet>
 {{/if}}
\ No newline at end of file
diff --git a/ui/lib/pki/addon/components/page/pki-configure-create.ts b/ui/lib/pki/addon/components/page/pki-configure-create.ts
index fba02ee780d..0799082fce3 100644
--- a/ui/lib/pki/addon/components/page/pki-configure-create.ts
+++ b/ui/lib/pki/addon/components/page/pki-configure-create.ts
@@ -1,13 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { tracked } from '@glimmer/tracking';
+
 import type Store from '@ember-data/store';
-import type Router from '@ember/routing/router';
+import type RouterService from '@ember/routing/router';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type PkiActionModel from 'vault/models/pki/action';
 import type { Breadcrumb } from 'vault/vault/app-types';
@@ -26,9 +27,9 @@ interface Args {
  * and form submission and cancel actions.
  */
 export default class PkiConfigureCreate extends Component<Args> {
-  @service declare readonly store: Store;
-  @service declare readonly router: Router;
   @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly store: Store;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked title = 'Configure PKI';
 
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-details.hbs b/ui/lib/pki/addon/components/page/pki-issuer-details.hbs
index 5924d9f959c..0ed1fa54e5a 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-details.hbs
+++ b/ui/lib/pki/addon/components/page/pki-issuer-details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
@@ -16,31 +16,47 @@
       />
     {{/if}}
     {{#if @canCrossSign}}
-      <ToolbarLink @route="issuers.issuer.cross-sign" @type="pen-tool" @model={{@issuer.id}} data-test-pki-issuer-cross-sign>
+      <ToolbarLink
+        @route="issuers.issuer.cross-sign"
+        @type="pen-tool"
+        @models={{array @backend @issuer.id}}
+        data-test-pki-issuer-cross-sign
+      >
         Cross-sign issuers
       </ToolbarLink>
     {{/if}}
     {{#if @canSignIntermediate}}
-      <ToolbarLink @route="issuers.issuer.sign" @type="pen-tool" @issuer={{@issuer.id}} data-test-pki-issuer-sign-int>
+      <ToolbarLink
+        @route="issuers.issuer.sign"
+        @type="pen-tool"
+        @models={{array @backend @issuer.id}}
+        data-test-pki-issuer-sign-int
+      >
         Sign Intermediate
       </ToolbarLink>
     {{/if}}
-    <BasicDropdown @class="popup-menu" @horizontalPosition="auto-right" @verticalPosition="below" as |D|>
+    <BasicDropdown
+      @class="popup-menu"
+      @horizontalPosition="auto-right"
+      @verticalPosition="below"
+      @renderInPlace={{true}}
+      as |D|
+    >
       <D.Trigger
-        data-test-popup-menu-trigger="true"
         class={{concat "toolbar-link" (if D.isOpen " is-active")}}
         @htmlTag="button"
         data-test-issuer-download
+        data-test-popup-menu-trigger
       >
         Download
-        <Chevron @direction="down" @isButton={{true}} />
+        <Chevron @direction={{if D.isOpen "up" "down"}} @isButton={{true}} />
       </D.Trigger>
       <D.Content @defaultClass="popup-menu-content">
         <nav class="box menu" aria-label="snapshots actions">
           <ul class="menu-list">
             {{#if @pem}}
               {{! should never be null, but if it is we don't want to let users download an empty file }}
-              <li class="action">
+              <li>
                 <DownloadButton
                   class="link"
                   @filename={{@issuer.id}}
@@ -54,7 +70,7 @@
             {{/if}}
             {{#if @der}}
               {{! should never be null, but if it is we don't want to let users download an empty file }}
-              <li class="action">
+              <li>
                 <DownloadButton
                   class="link"
                   @filename={{@issuer.id}}
@@ -72,7 +88,7 @@
     </BasicDropdown>
 
     {{#if @canConfigure}}
-      <ToolbarLink @route="issuers.issuer.edit" @model={{@issuer.id}} data-test-pki-issuer-configure>
+      <ToolbarLink @route="issuers.issuer.edit" @models={{array @backend @issuer.id}} data-test-pki-issuer-configure>
         Configure
       </ToolbarLink>
     {{/if}}
@@ -82,7 +98,7 @@
 {{#if @issuer.isDefault}}
   <p class="has-top-margin-m">
     This is your default issuer certificate. You will see it in your
-    <LinkTo @route="issuers.index">
+    <LinkTo @route="issuers.index" @model={{@backend}}>
       list of Issuers.
     </LinkTo>
     You may also want to configure its usage and other behaviors.
@@ -105,7 +121,7 @@
           {{else if (eq attr.name "keyId")}}
             <InfoTableRow @label={{or attr.options.label (humanize (dasherize attr.name))}} @value={{get @issuer attr.name}}>
               {{#if @issuer.keyId}}
-                <LinkTo @route="keys.key.details" @model={{@issuer.keyId}}>{{@issuer.keyId}}</LinkTo>
+                <LinkTo @route="keys.key.details" @models={{array @backend @issuer.keyId}}>{{@issuer.keyId}}</LinkTo>
               {{else}}
                 <Icon @name="minus" />
               {{/if}}
@@ -175,7 +191,12 @@
     </M.Body>
     <M.Footer as |F|>
       <Hds::ButtonSet>
-        <Hds::Button @text="Generate new root" @route="issuers.issuer.rotate-root" data-test-root-rotate-step-one />
+        <Hds::Button
+          @text="Generate new root"
+          @route="issuers.issuer.rotate-root"
+          @models={{array @backend @issuer.id}}
+          data-test-root-rotate-step-one
+        />
         <Hds::Button @text="Cancel" @color="secondary" {{on "click" F.close}} />
       </Hds::ButtonSet>
     </M.Footer>
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-details.ts b/ui/lib/pki/addon/components/page/pki-issuer-details.ts
index ba51518b6a4..de0a2814814 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-details.ts
+++ b/ui/lib/pki/addon/components/page/pki-issuer-details.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-edit.hbs b/ui/lib/pki/addon/components/page/pki-issuer-edit.hbs
index c9c45034a27..e82f5f32f8f 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-edit.hbs
+++ b/ui/lib/pki/addon/components/page/pki-issuer-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form {{on "submit" (perform this.save)}}>
   <div class="box is-sideless is-fullwidth is-marginless">
@@ -39,8 +39,13 @@
               >
                 {{#each field.options.valueOptions as |value|}}
                   <option selected={{eq @model.leafNotAfterBehavior value}} value={{value}}>
-                    {{capitalize (if (eq value "err") "error" value)}}
-                    if the computed NotAfter exceeds that of this issuer
+                    {{#if (eq value "always_enforce_err")}}
+                      Error if the computed NotAfter exceeds that of this issuer in all circumstances (leaf, CA issuance and
+                      ACME)
+                    {{else}}
+                      {{capitalize (if (eq value "err") "error" value)}}
+                      if the computed NotAfter exceeds that of this issuer
+                    {{/if}}
                   </option>
                 {{/each}}
               </select>
@@ -56,7 +61,7 @@
       @icon={{if this.save.isRunning "loading"}}
       type="submit"
       disabled={{this.save.isRunning}}
-      data-test-save
+      data-test-submit
     />
     <Hds::Button
       @text="Cancel"
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-edit.ts b/ui/lib/pki/addon/components/page/pki-issuer-edit.ts
index ab233a2ebde..e64ef64a2e3 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-edit.ts
+++ b/ui/lib/pki/addon/components/page/pki-issuer-edit.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,13 +13,15 @@ import errorMessage from 'vault/utils/error-message';
 import type RouterService from '@ember/routing/router-service';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type PkiIssuerModel from 'vault/models/pki/issuer';
+import { removeFromArray } from 'vault/helpers/remove-from-array';
+import { addToArray } from 'vault/helpers/add-to-array';
 
 interface Args {
   model: PkiIssuerModel;
 }
 
 export default class PkiIssuerEditComponent extends Component<Args> {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
   @service declare readonly flashMessages: FlashMessageService;
 
   @tracked usageValues: Array<string> = [];
@@ -36,8 +38,11 @@ export default class PkiIssuerEditComponent extends Component<Args> {
 
   @action
   setUsage(value: string) {
-    const method = this.usageValues.includes(value) ? 'removeObject' : 'addObject';
-    this.usageValues[method](value);
+    if (this.usageValues.includes(value)) {
+      this.usageValues = removeFromArray(this.usageValues, value);
+    } else {
+      this.usageValues = addToArray(this.usageValues, value);
+    }
     this.args.model.usage = this.usageValues.join(',');
   }
 
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-generate-intermediate.hbs b/ui/lib/pki/addon/components/page/pki-issuer-generate-intermediate.hbs
index 619f3094826..8e50618245c 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-generate-intermediate.hbs
+++ b/ui/lib/pki/addon/components/page/pki-issuer-generate-intermediate.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{@breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-page-title>
+    <h1 class="title is-3" data-test-page-title>
       {{this.title}}
     </h1>
   </p.levelLeft>
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-generate-intermediate.ts b/ui/lib/pki/addon/components/page/pki-issuer-generate-intermediate.ts
index 07155c8f4ca..938dd89eafa 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-generate-intermediate.ts
+++ b/ui/lib/pki/addon/components/page/pki-issuer-generate-intermediate.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-generate-root.hbs b/ui/lib/pki/addon/components/page/pki-issuer-generate-root.hbs
index 2282b24e40d..c93bc782a7f 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-generate-root.hbs
+++ b/ui/lib/pki/addon/components/page/pki-issuer-generate-root.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{@breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-page-title>
+    <h1 class="title is-3" data-test-page-title>
       {{this.title}}
     </h1>
   </p.levelLeft>
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-generate-root.ts b/ui/lib/pki/addon/components/page/pki-issuer-generate-root.ts
index 18f41f4a882..e85b236fd32 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-generate-root.ts
+++ b/ui/lib/pki/addon/components/page/pki-issuer-generate-root.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-import.hbs b/ui/lib/pki/addon/components/page/pki-issuer-import.hbs
index da3e2ef2d5f..703fe996bf9 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-import.hbs
+++ b/ui/lib/pki/addon/components/page/pki-issuer-import.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{@breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-page-title>
+    <h1 class="title is-3" data-test-page-title>
       {{this.title}}
     </h1>
   </p.levelLeft>
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-import.ts b/ui/lib/pki/addon/components/page/pki-issuer-import.ts
index a9974a36c2a..5a4349ebbc2 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-import.ts
+++ b/ui/lib/pki/addon/components/page/pki-issuer-import.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-list.hbs b/ui/lib/pki/addon/components/page/pki-issuer-list.hbs
index b6d5ab63f5b..c9977976fdb 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-list.hbs
+++ b/ui/lib/pki/addon/components/page/pki-issuer-list.hbs
@@ -1,14 +1,20 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<PkiPaginatedList @listRoute="issuers.index" @list={{@issuers}}>
+<PkiPaginatedList @backend={{@backend}} @listRoute="issuers.index" @list={{@issuers}}>
   <:actions>
-    <ToolbarLink @route="issuers.import" data-test-generate-issuer="import">
+    <ToolbarLink @route="issuers.import" @model={{@backend}} data-test-generate-issuer="import">
       Import
     </ToolbarLink>
-    <BasicDropdown @class="popup-menu" @horizontalPosition="auto-right" @verticalPosition="below" as |D|>
+    <BasicDropdown
+      @class="popup-menu"
+      @horizontalPosition="auto-right"
+      @verticalPosition="below"
+      @renderInPlace={{true}}
+      as |D|
+    >
       <D.Trigger
         class={{concat "toolbar-link" (if D.isOpen " is-active")}}
         @htmlTag="button"
@@ -20,14 +26,20 @@
       <D.Content @defaultClass="popup-menu-content">
         <nav class="box menu" aria-label="generate options">
           <ul class="menu-list">
-            <li class="action">
-              <LinkTo @route="issuers.generate-root" {{on "click" (fn this.onLinkClick D)}} data-test-generate-issuer="root">
+            <li>
+              <LinkTo
+                @route="issuers.generate-root"
+                @model={{@backend}}
+                {{on "click" (fn this.onLinkClick D)}}
+                data-test-generate-issuer="root"
+              >
                 Root
               </LinkTo>
             </li>
-            <li class="action">
+            <li>
               <LinkTo
                 @route="issuers.generate-intermediate"
+                @model={{@backend}}
                 {{on "click" (fn this.onLinkClick D)}}
                 data-test-generate-issuer="intermediate"
               >
@@ -41,7 +53,11 @@
   </:actions>
   <:list as |issuers|>
     {{#each issuers as |pkiIssuer idx|}}
-      <LinkedBlock class="list-item-row" @params={{array "issuers.issuer.details" pkiIssuer.id}} @linkPrefix={{@mountPoint}}>
+      <LinkedBlock
+        class="list-item-row"
+        @params={{array "issuers.issuer.details" @backend pkiIssuer.id}}
+        @linkPrefix={{@mountPoint}}
+      >
         <div class="level is-mobile">
           <div class="level-left">
             <div data-test-issuer-list={{pkiIssuer.id}}>
@@ -49,33 +65,33 @@
               <span class="has-text-weight-semibold is-underline">
                 {{pkiIssuer.issuerRef}}
                 {{#if pkiIssuer.issuerName}}
-                  <span class="tag has-text-grey-dark">{{pkiIssuer.id}}</span>
+                  <Hds::Badge @text={{pkiIssuer.id}} />
                 {{/if}}
               </span>
               <div class="is-flex-row has-left-margin-l has-top-margin-xs">
                 {{#if pkiIssuer.isDefault}}
-                  <span class="tag has-text-grey-dark" data-test-is-default={{idx}}>default issuer</span>
+                  <Hds::Badge @text="default issuer" data-test-is-default={{idx}} class="has-right-margin-8" />
                 {{/if}}
                 {{#if (not-eq pkiIssuer.isRoot undefined)}}
-                  <span class="tag has-text-grey-dark" data-test-is-root-tag={{idx}}>{{if
-                      pkiIssuer.isRoot
-                      "root"
-                      "intermediate"
-                    }}</span>
+                  <Hds::Badge
+                    @text={{if pkiIssuer.isRoot "root" "intermediate"}}
+                    data-test-is-root-tag={{idx}}
+                    class="has-right-margin-8"
+                  />
                 {{/if}}
                 {{#if pkiIssuer.serialNumber}}
-                  <span class="tag is-transparent has-right-margin-none" data-test-serial-number={{idx}}>
-                    <InfoTooltip>
-                      Serial number
-                    </InfoTooltip>
+                  <span class="is-flex-v-centered has-side-padding-8" data-test-serial-number={{idx}}>
+                    <Hds::TooltipButton @text="Serial number" aria-label="This is the serial number">
+                      <Hds::Icon @name="info" />
+                    </Hds::TooltipButton>
                     {{pkiIssuer.serialNumber}}
                   </span>
                 {{/if}}
                 {{#if pkiIssuer.parsedCertificate.common_name}}
-                  <span class="tag is-transparent has-left-margin-none" data-test-common-name={{idx}}>
-                    <InfoTooltip>
-                      Common name
-                    </InfoTooltip>
+                  <span class="is-flex-v-centered has-side-padding-8" data-test-common-name={{idx}}>
+                    <Hds::TooltipButton @text="Common name" aria-label="This is the common name">
+                      <Hds::Icon @name="info" />
+                    </Hds::TooltipButton>
                     {{pkiIssuer.parsedCertificate.common_name}}
                   </span>
                 {{/if}}
@@ -92,12 +108,11 @@
                   data-test-popup-menu-trigger
                 />
                 <dd.Interactive
-                  @text="Details"
                   @route="issuers.issuer.details"
-                  @model={{pkiIssuer.id}}
-                  data-test-popup-menu-details
-                />
-                <dd.Interactive @text="Edit" @route="issuers.issuer.edit" @model={{pkiIssuer.id}} />
+                  @models={{array @backend pkiIssuer.id}}
+                  data-test-pki-issuer-details
+                >Details</dd.Interactive>
+                <dd.Interactive @route="issuers.issuer.edit" @models={{array @backend pkiIssuer.id}}>Edit</dd.Interactive>
               </Hds::Dropdown>
             </div>
           </div>
@@ -112,6 +127,7 @@
         @iconPosition="trailing"
         @text="Configure PKI"
         @route="configuration.create"
+        @model={{@backend}}
       />
     </EmptyState>
   </:empty>
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-list.ts b/ui/lib/pki/addon/components/page/pki-issuer-list.ts
index 00f38e41970..a6cf2740391 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-list.ts
+++ b/ui/lib/pki/addon/components/page/pki-issuer-list.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,6 +17,7 @@ interface BasicDropdown {
 interface Args {
   issuers: PkiIssuerModel[];
   mountPoint: string;
+  backend: string;
 }
 
 export default class PkiIssuerList extends Component<Args> {
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-rotate-root.hbs b/ui/lib/pki/addon/components/page/pki-issuer-rotate-root.hbs
index 9fef33a4b79..3d54340b77d 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-rotate-root.hbs
+++ b/ui/lib/pki/addon/components/page/pki-issuer-rotate-root.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{@breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-page-title>
+    <h1 class="title is-3" data-test-page-title>
       {{if @newRootModel.id "View Issuer Certificate" "Generate New Root"}}
     </h1>
   </p.levelLeft>
@@ -20,7 +20,7 @@
       <ToolbarLink
         @route="issuers.issuer.cross-sign"
         @type="pen-tool"
-        @model={{@newRootModel.issuerId}}
+        @models={{array @newRootModel.backend @newRootModel.issuerId}}
         data-test-pki-issuer-cross-sign
       >
         Cross-sign issuers
@@ -28,12 +28,18 @@
       <ToolbarLink
         @route="issuers.issuer.sign"
         @type="pen-tool"
-        @model={{@newRootModel.issuerId}}
+        @models={{array @newRootModel.backend @newRootModel.issuerId}}
         data-test-pki-issuer-sign-int
       >
         Sign Intermediate
       </ToolbarLink>
-      <BasicDropdown @class="popup-menu" @horizontalPosition="auto-right" @verticalPosition="below" as |D|>
+      <BasicDropdown
+        @class="popup-menu"
+        @horizontalPosition="auto-right"
+        @verticalPosition="below"
+        @renderInPlace={{true}}
+        as |D|
+      >
         <D.Trigger
           data-test-popup-menu-trigger
           class={{concat "toolbar-link" (if D.isOpen " is-active")}}
@@ -46,7 +52,7 @@
         <D.Content @defaultClass="popup-menu-content">
           <nav class="box menu" aria-label="snapshots actions">
             <ul class="menu-list">
-              <li class="action">
+              <li>
                 <DownloadButton
                   class="link"
                   @filename={{@newRootModel.issuerId}}
@@ -57,7 +63,7 @@
                   @hideIcon={{true}}
                 />
               </li>
-              <li class="action">
+              <li>
                 <DownloadButton
                   class="link"
                   @filename={{@newRootModel.issuerId}}
@@ -72,7 +78,11 @@
           </nav>
         </D.Content>
       </BasicDropdown>
-      <ToolbarLink @route="issuers.issuer.edit" @model={{@newRootModel.issuerId}} data-test-pki-issuer-configure>
+      <ToolbarLink
+        @route="issuers.issuer.edit"
+        @models={{array @newRootModel.backend @newRootModel.issuerId}}
+        data-test-pki-issuer-configure
+      >
         Configure
       </ToolbarLink>
     </ToolbarActions>
@@ -93,11 +103,12 @@
         If you’re ready, you can begin cross-signing issuers now. If not, the option to cross-sign is available when you use
         this certificate.
       </A.Description>
-      <A.Link::Standalone
+      <A.LinkStandalone
         @icon="arrow-right"
         @iconPosition="trailing"
         @text="Cross-sign issuers"
         @route="issuers.issuer.cross-sign"
+        @models={{array @newRootModel.backend @newRootModel.issuerId}}
       />
 
     </Hds::Alert>
@@ -166,8 +177,8 @@
 
       <hr class="has-background-gray-100" />
       <Hds::ButtonSet>
-        <Hds::Button @text="Done" type="submit" data-test-pki-rotate-root-save />
-        <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onCancel}} data-test-pki-rotate-root-cancel />
+        <Hds::Button @text="Done" type="submit" data-test-submit />
+        <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onCancel}} data-test-cancel />
       </Hds::ButtonSet>
       {{#if this.invalidFormAlert}}
         <div class="control">
diff --git a/ui/lib/pki/addon/components/page/pki-issuer-rotate-root.ts b/ui/lib/pki/addon/components/page/pki-issuer-rotate-root.ts
index d0854c2cd4e..0a4f609052b 100644
--- a/ui/lib/pki/addon/components/page/pki-issuer-rotate-root.ts
+++ b/ui/lib/pki/addon/components/page/pki-issuer-rotate-root.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,8 +10,9 @@ import { action } from '@ember/object';
 import { waitFor } from '@ember/test-waiters';
 import { task } from 'ember-concurrency';
 import errorMessage from 'vault/utils/error-message';
+
 import type Store from '@ember-data/store';
-import type Router from '@ember/routing/router';
+import type RouterService from '@ember/routing/router';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type SecretMountPath from 'vault/services/secret-mount-path';
 import type PkiIssuerModel from 'vault/models/pki/issuer';
@@ -31,10 +32,10 @@ const RADIO_BUTTON_KEY = {
 };
 
 export default class PagePkiIssuerRotateRootComponent extends Component<Args> {
-  @service declare readonly store: Store;
-  @service declare readonly router: Router;
   @service declare readonly flashMessages: FlashMessageService;
   @service declare readonly secretMountPath: SecretMountPath;
+  @service declare readonly store: Store;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked displayedForm = RADIO_BUTTON_KEY.oldSettings;
   @tracked showOldSettings = false;
@@ -108,14 +109,14 @@ export default class PagePkiIssuerRotateRootComponent extends Component<Args> {
     const endpoint = `/v1/${this.secretMountPath.currentPath}/issuer/${this.args.newRootModel.issuerId}/${format}`;
     const adapter = this.store.adapterFor('application');
     try {
-      return adapter
-        .rawRequest(endpoint, 'GET', { unauthenticated: true })
-        .then(function (response: Response) {
-          if (format === 'der') {
-            return response.blob();
-          }
-          return response.text();
-        });
+      return adapter.rawRequest(endpoint, 'GET', { unauthenticated: true }).then(function (
+        response: Response
+      ) {
+        if (format === 'der') {
+          return response.blob();
+        }
+        return response.text();
+      });
     } catch (e) {
       return null;
     }
diff --git a/ui/lib/pki/addon/components/page/pki-key-details.hbs b/ui/lib/pki/addon/components/page/pki-key-details.hbs
index 211539b5c54..1b88df0d824 100644
--- a/ui/lib/pki/addon/components/page/pki-key-details.hbs
+++ b/ui/lib/pki/addon/components/page/pki-key-details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
@@ -27,7 +27,7 @@
       />
     {{/if}}
     {{#if @canEdit}}
-      <ToolbarLink @route="keys.key.edit" @model={{@key.keyId}} data-test-pki-key-edit>
+      <ToolbarLink @route="keys.key.edit" @models={{array @key.backend @key.keyId}} data-test-pki-key-edit>
         Edit key
       </ToolbarLink>
     {{/if}}
diff --git a/ui/lib/pki/addon/components/page/pki-key-details.ts b/ui/lib/pki/addon/components/page/pki-key-details.ts
index d48ef94e4e4..fe2bf24c746 100644
--- a/ui/lib/pki/addon/components/page/pki-key-details.ts
+++ b/ui/lib/pki/addon/components/page/pki-key-details.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,7 +15,7 @@ interface Args {
 }
 
 export default class PkiKeyDetails extends Component<Args> {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
   @service declare readonly flashMessages: FlashMessageService;
 
   @action
diff --git a/ui/lib/pki/addon/components/page/pki-key-list.hbs b/ui/lib/pki/addon/components/page/pki-key-list.hbs
index a8d13458f42..0651c6bf458 100644
--- a/ui/lib/pki/addon/components/page/pki-key-list.hbs
+++ b/ui/lib/pki/addon/components/page/pki-key-list.hbs
@@ -1,17 +1,17 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<PkiPaginatedList @listRoute="keys.index" @list={{@keyModels}} @hasConfig={{@hasConfig}}>
+<PkiPaginatedList @backend={{@backend}} @listRoute="keys.index" @list={{@keyModels}} @hasConfig={{@hasConfig}}>
   <:actions>
     {{#if @canImportKey}}
-      <ToolbarLink @route="keys.import" @type="upload" data-test-pki-key-import>
+      <ToolbarLink @route="keys.import" @model={{@backend}} @type="upload" data-test-pki-key-import>
         Import
       </ToolbarLink>
     {{/if}}
     {{#if @canGenerateKey}}
-      <ToolbarLink @route="keys.create" @type="add" data-test-pki-key-generate>
+      <ToolbarLink @route="keys.create" @model={{@backend}} @type="add" data-test-pki-key-generate>
         Generate
       </ToolbarLink>
     {{/if}}
@@ -23,7 +23,11 @@
   </:description>
   <:list as |keys|>
     {{#each keys as |pkiKey|}}
-      <LinkedBlock class="list-item-row" @params={{array "keys.key.details" pkiKey.keyId}} @linkPrefix={{@mountPoint}}>
+      <LinkedBlock
+        class="list-item-row"
+        @params={{array "keys.key.details" @backend pkiKey.keyId}}
+        @linkPrefix={{@mountPoint}}
+      >
         <div class="level is-mobile">
           <div class="level-left">
             <div>
@@ -33,7 +37,7 @@
               </span>
               <div class="is-flex-row has-left-margin-l has-top-margin-xs">
                 {{#if pkiKey.keyName}}
-                  <span class="tag has-text-grey-dark" data-test-key="id">{{pkiKey.id}}</span>
+                  <Hds::Badge @text={{pkiKey.id}} data-test-key="id" />
                 {{/if}}
               </div>
             </div>
@@ -50,19 +54,17 @@
                   />
                   {{#if @canRead}}
                     <dd.Interactive
-                      @text="Details"
                       @route="keys.key.details"
-                      @model={{pkiKey.keyId}}
+                      @models={{array @backend pkiKey.keyId}}
                       data-test-key-menu-link="details"
-                    />
+                    >Details</dd.Interactive>
                   {{/if}}
                   {{#if @canEdit}}
                     <dd.Interactive
-                      @text="Edit"
                       @route="keys.key.edit"
-                      @model={{pkiKey.keyId}}
+                      @models={{array @backend pkiKey.keyId}}
                       data-test-key-menu-link="edit"
-                    />
+                    >Edit</dd.Interactive>
                   {{/if}}
                 </Hds::Dropdown>
               {{/if}}
@@ -84,6 +86,7 @@
         @iconPosition="trailing"
         @text="Configure PKI"
         @route="configuration.create"
+        @model={{@backend}}
       />
     </EmptyState>
   </:configure>
diff --git a/ui/lib/pki/addon/components/page/pki-key-list.ts b/ui/lib/pki/addon/components/page/pki-key-list.ts
index a6ce292f4d5..579ccfca565 100644
--- a/ui/lib/pki/addon/components/page/pki-key-list.ts
+++ b/ui/lib/pki/addon/components/page/pki-key-list.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,6 +10,7 @@ import type PkiKeyModel from 'vault/models/pki/key';
 interface Args {
   keyModels: PkiKeyModel[];
   mountPoint: string;
+  backend: string;
   canImportKey: boolean;
   canGenerateKey: boolean;
   canRead: boolean;
diff --git a/ui/lib/pki/addon/components/page/pki-overview.hbs b/ui/lib/pki/addon/components/page/pki-overview.hbs
index 915e4c21236..ed94b1c8896 100644
--- a/ui/lib/pki/addon/components/page/pki-overview.hbs
+++ b/ui/lib/pki/addon/components/page/pki-overview.hbs
@@ -1,104 +1,131 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="is-grid grid-2-columns grid-gap-2 has-top-margin-l">
   <OverviewCard
     @cardTitle="Issuers"
     @subText="The total number of issuers in this PKI mount. Includes both root and intermediate certificates."
-    @actionText="View issuers"
-    @actionTo="issuers"
   >
-    <Hds::Text::Display @tag="h2" @size="500">
-      {{format-number (if (eq @issuers 404) 0 @issuers.length)}}
-    </Hds::Text::Display>
+    <:action>
+      <Hds::Link::Standalone
+        @text="View issuers"
+        @route="issuers"
+        @model={{@engine.id}}
+        @icon="chevron-right"
+        @iconPosition="trailing"
+      />
+    </:action>
+    <:content>
+      <Hds::Text::Display @tag="p" @size="400" @weight="medium" class="has-top-margin-m">
+        {{format-number (if (eq @issuers 404) 0 @issuers.length)}}
+      </Hds::Text::Display>
+    </:content>
   </OverviewCard>
   {{#if (not-eq @roles 403)}}
     <OverviewCard
       @cardTitle="Roles"
       @subText="The total number of roles in this PKI mount that have been created to generate certificates."
-      @actionText="View roles"
-      @actionTo="roles"
     >
-      <Hds::Text::Display @tag="h2" @size="500">
-        {{format-number (if (eq @roles 404) 0 @roles.length)}}
-      </Hds::Text::Display>
+      <:action>
+        <Hds::Link::Standalone
+          @text="View roles"
+          @route="roles"
+          @model={{@engine.id}}
+          @icon="chevron-right"
+          @iconPosition="trailing"
+        />
+      </:action>
+      <:content>
+        <Hds::Text::Display @tag="p" @size="400" @weight="medium" class="has-top-margin-m">
+          {{format-number (if (eq @roles 404) 0 @roles.length)}}
+        </Hds::Text::Display>
+      </:content>
     </OverviewCard>
   {{/if}}
   <OverviewCard @cardTitle="Issue certificate" @subText="Begin issuing a certificate by choosing a role.">
-    <div class="has-top-margin-m is-flex">
-      <SearchSelect
-        class="is-flex-grow-1"
-        @selectLimit="1"
-        @models={{array "pki/role"}}
-        @backend={{@engine.id}}
-        @placeholder="Type to find a role..."
-        @disallowNewItems={{true}}
-        @onChange={{this.handleRolesInput}}
-        @fallbackComponent="input-search"
-        data-test-issue-certificate-input
-      />
-      <Hds::Button
-        @text="Issue"
-        @color="secondary"
-        class="has-left-margin-s align-self-baseline"
-        type="submit"
-        disabled={{unless this.rolesValue true}}
-        {{on "click" this.transitionToIssueCertificates}}
-        data-test-issue-certificate-button
-      />
-    </div>
+    <:content>
+      <div class="has-top-margin-m is-flex">
+        <SearchSelect
+          class="is-flex-grow-1"
+          @ariaLabel="Role"
+          @selectLimit="1"
+          @models={{array "pki/role"}}
+          @backend={{@engine.id}}
+          @placeholder="Type to find a role..."
+          @disallowNewItems={{true}}
+          @onChange={{this.handleRolesInput}}
+          @fallbackComponent="input-search"
+          data-test-issue-certificate-input
+        />
+        <Hds::Button
+          @text="Issue"
+          @color="secondary"
+          class="has-left-margin-s align-self-baseline"
+          type="submit"
+          disabled={{unless this.rolesValue true}}
+          {{on "click" this.transitionToIssueCertificates}}
+          data-test-issue-certificate-button
+        />
+      </div>
+    </:content>
   </OverviewCard>
 
   <OverviewCard @cardTitle="View certificate" @subText="Quickly view a certificate by typing its serial number.">
-    <div class="has-top-margin-m {{unless this.certificateValue 'is-flex'}}">
-      <SearchSelect
-        class="is-flex-grow-1"
-        @selectLimit="1"
-        @models={{array "pki/certificate/base"}}
-        @backend={{@engine.id}}
-        @placeholder="33:a3:..."
-        @disallowNewItems={{true}}
-        @onChange={{this.handleCertificateInput}}
-        @fallbackComponent="input-search"
-        data-test-view-certificate-input
-      />
-      <Hds::Button
-        @text="View"
-        @color="secondary"
-        class="align-self-baseline {{unless this.certificateValue 'has-left-margin-s'}}"
-        disabled={{unless this.certificateValue true}}
-        {{on "click" this.transitionToViewCertificates}}
-        data-test-view-certificate-button
-      />
-    </div>
+    <:content>
+      <div class="has-top-margin-m {{unless this.certificateValue 'is-flex'}}">
+        <SearchSelect
+          class="is-flex-grow-1"
+          @ariaLabel="Certificate serial number"
+          @selectLimit="1"
+          @models={{array "pki/certificate/base"}}
+          @backend={{@engine.id}}
+          @placeholder="33:a3:..."
+          @disallowNewItems={{true}}
+          @onChange={{this.handleCertificateInput}}
+          @fallbackComponent="input-search"
+          data-test-view-certificate-input
+        />
+        <Hds::Button
+          @text="View"
+          @color="secondary"
+          class="align-self-baseline {{unless this.certificateValue 'has-left-margin-s'}}"
+          disabled={{unless this.certificateValue true}}
+          {{on "click" this.transitionToViewCertificates}}
+          data-test-view-certificate-button
+        />
+      </div>
+    </:content>
   </OverviewCard>
 
   <OverviewCard @cardTitle="View issuer" @subText="Choose or type an issuer name or ID to view its details">
-    <div class="has-top-margin-m is-flex">
-      <SearchSelect
-        class="is-flex-grow-1"
-        @selectLimit="1"
-        @models={{array "pki/issuer"}}
-        @backend={{@engine.id}}
-        @placeholder="Type to find an issuer..."
-        @disallowNewItems={{true}}
-        @onChange={{this.handleIssuerSearch}}
-        @fallbackComponent="input-search"
-        @shouldRenderName={{true}}
-        @nameKey={{"issuerName"}}
-        data-test-issue-issuer-input
-      />
-      <Hds::Button
-        @text="View"
-        @color="secondary"
-        class="has-left-margin-s align-self-baseline"
-        type="submit"
-        disabled={{unless this.issuerValue true}}
-        {{on "click" this.transitionToIssuerDetails}}
-        data-test-view-issuer-button
-      />
-    </div>
+    <:content>
+      <div class="has-top-margin-m is-flex">
+        <SearchSelect
+          class="is-flex-grow-1"
+          @ariaLabel="Issuer name or ID"
+          @selectLimit="1"
+          @models={{array "pki/issuer"}}
+          @backend={{@engine.id}}
+          @placeholder="Type to find an issuer..."
+          @disallowNewItems={{true}}
+          @onChange={{this.handleIssuerSearch}}
+          @fallbackComponent="input-search"
+          @shouldRenderName={{true}}
+          @nameKey="issuerName"
+          data-test-issue-issuer-input
+        />
+        <Hds::Button
+          @text="View"
+          @color="secondary"
+          class="has-left-margin-s align-self-baseline"
+          type="submit"
+          disabled={{unless this.issuerValue true}}
+          {{on "click" this.transitionToIssuerDetails}}
+          data-test-view-issuer-button
+        />
+      </div>
+    </:content>
   </OverviewCard>
 </div>
\ No newline at end of file
diff --git a/ui/lib/pki/addon/components/page/pki-overview.ts b/ui/lib/pki/addon/components/page/pki-overview.ts
index bf5c70937bd..d8c6a2a62c1 100644
--- a/ui/lib/pki/addon/components/page/pki-overview.ts
+++ b/ui/lib/pki/addon/components/page/pki-overview.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,19 +7,20 @@ import Component from '@glimmer/component';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
 import { service } from '@ember/service';
+
 import type Store from '@ember-data/store';
 import type RouterService from '@ember/routing/router-service';
 import type PkiIssuerModel from 'vault/models/pki/issuer';
 import type PkiRoleModel from 'vault/models/pki/role';
 
 interface Args {
-  issuers: PkiIssuerModel | number;
-  roles: PkiRoleModel | number;
+  issuers: PkiIssuerModel[] | number;
+  roles: PkiRoleModel[] | number;
   engine: string;
 }
 
 export default class PkiOverview extends Component<Args> {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
   @service declare readonly store: Store;
 
   @tracked rolesValue = '';
diff --git a/ui/lib/pki/addon/components/page/pki-role-details.hbs b/ui/lib/pki/addon/components/page/pki-role-details.hbs
index 28feede7648..6ff03a75a86 100644
--- a/ui/lib/pki/addon/components/page/pki-role-details.hbs
+++ b/ui/lib/pki/addon/components/page/pki-role-details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
@@ -17,19 +17,34 @@
       <div class="toolbar-separator"></div>
     {{/if}}
     {{#if @role.canGenerateCert}}
-      <LinkTo class="toolbar-link" @route="roles.role.generate" @model={{@role.id}} data-test-pki-role-generate-cert>
+      <LinkTo
+        class="toolbar-link"
+        @route="roles.role.generate"
+        @models={{array @role.backend @role.id}}
+        data-test-pki-role-generate-cert
+      >
         Generate Certificate
         <Icon @name="chevron-right" />
       </LinkTo>
     {{/if}}
     {{#if @role.canSign}}
-      <LinkTo class="toolbar-link" @route="roles.role.sign" @model={{@role.id}} data-test-pki-role-sign-cert>
+      <LinkTo
+        class="toolbar-link"
+        @route="roles.role.sign"
+        @models={{array @role.backend @role.id}}
+        data-test-pki-role-sign-cert
+      >
         Sign Certificate
         <Icon @name="chevron-right" />
       </LinkTo>
     {{/if}}
     {{#if @role.canEdit}}
-      <LinkTo class="toolbar-link" @route="roles.role.edit" @model={{@role.id}} data-test-pki-role-edit-link>
+      <LinkTo
+        class="toolbar-link"
+        @route="roles.role.edit"
+        @models={{array @role.backend @role.id}}
+        data-test-pki-role-edit-link
+      >
         Edit
         <Icon @name="chevron-right" />
       </LinkTo>
@@ -49,7 +64,7 @@
             @value={{val}}
             @alwaysRender={{true}}
           >
-            <LinkTo @route="issuers.issuer.details" @model={{val}}>{{val}}</LinkTo>
+            <LinkTo @route="issuers.issuer.details" @models={{array @role.backend val}}>{{val}}</LinkTo>
           </InfoTableRow>
         {{else if (includes attr.name this.arrayAttrs)}}
           <InfoTableRow
@@ -57,7 +72,7 @@
             @value={{val}}
             @alwaysRender={{true}}
           />
-        {{else if (eq attr.name "noStore")}}
+        {{else if (includes attr.name (array "noStore" "noStoreMetadata"))}}
           <InfoTableRow
             @label={{capitalize (or attr.options.detailsLabel attr.options.label (humanize (dasherize attr.name)))}}
             @value={{not val}}
diff --git a/ui/lib/pki/addon/components/page/pki-role-details.ts b/ui/lib/pki/addon/components/page/pki-role-details.ts
index af06fb67edb..0298710b643 100644
--- a/ui/lib/pki/addon/components/page/pki-role-details.ts
+++ b/ui/lib/pki/addon/components/page/pki-role-details.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,15 +17,15 @@ interface Args {
 }
 
 export default class DetailsPage extends Component<Args> {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
   @service declare readonly flashMessages: FlashMessageService;
   @service declare readonly secretMountPath: SecretMountPath;
 
   get breadcrumbs() {
     return [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'roles', route: 'roles.index' },
+      { label: 'Roles', route: 'roles.index' },
       { label: this.args.role.id },
     ];
   }
diff --git a/ui/lib/pki/addon/components/page/pki-tidy-auto-configure.hbs b/ui/lib/pki/addon/components/page/pki-tidy-auto-configure.hbs
index 5a31ddc60fd..fdd5fabd2f3 100644
--- a/ui/lib/pki/addon/components/page/pki-tidy-auto-configure.hbs
+++ b/ui/lib/pki/addon/components/page/pki-tidy-auto-configure.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/pki/addon/components/page/pki-tidy-auto-settings.hbs b/ui/lib/pki/addon/components/page/pki-tidy-auto-settings.hbs
index b47e2b12f88..e9e20973bfd 100644
--- a/ui/lib/pki/addon/components/page/pki-tidy-auto-settings.hbs
+++ b/ui/lib/pki/addon/components/page/pki-tidy-auto-settings.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -16,7 +16,7 @@
 
 <Toolbar>
   <ToolbarActions>
-    <LinkTo @route="tidy.auto.configure" class="toolbar-link" data-test-pki-edit-tidy-auto-link>
+    <LinkTo @route="tidy.auto.configure" @model={{@model.id}} class="toolbar-link" data-test-pki-edit-tidy-auto-link>
       Edit auto-tidy
       <Icon @name="chevron-right" />
     </LinkTo>
diff --git a/ui/lib/pki/addon/components/page/pki-tidy-manual.hbs b/ui/lib/pki/addon/components/page/pki-tidy-manual.hbs
index 0bcbb9936c7..771a3bd73aa 100644
--- a/ui/lib/pki/addon/components/page/pki-tidy-manual.hbs
+++ b/ui/lib/pki/addon/components/page/pki-tidy-manual.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/pki/addon/components/page/pki-tidy-status.hbs b/ui/lib/pki/addon/components/page/pki-tidy-status.hbs
index c4b599a4125..86d2334d4ba 100644
--- a/ui/lib/pki/addon/components/page/pki-tidy-status.hbs
+++ b/ui/lib/pki/addon/components/page/pki-tidy-status.hbs
@@ -1,16 +1,16 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
     <div class="toolbar-separator"></div>
     {{#if @autoTidyConfig.enabled}}
-      <ToolbarLink @route="tidy.auto" data-test-pki-auto-tidy-config>
+      <ToolbarLink @route="tidy.auto" @model={{@autoTidyConfig.id}} data-test-pki-auto-tidy-config>
         Auto-tidy configuration
       </ToolbarLink>
-      <ToolbarLink @route="tidy.manual" data-test-pki-manual-tidy-config>
+      <ToolbarLink @route="tidy.manual" @model={{@autoTidyConfig.id}} data-test-pki-manual-tidy-config>
         Perform manual tidy
       </ToolbarLink>
     {{else}}
@@ -146,8 +146,18 @@
     </M.Body>
     <M.Footer as |F|>
       <Hds::ButtonSet>
-        <Hds::Button @text="Automatic tidy" @route="tidy.auto.configure" data-test-tidy-modal-auto-button />
-        <Hds::Button @text="Manual tidy" @route="tidy.manual" data-test-tidy-modal-manual-button />
+        <Hds::Button
+          @text="Automatic tidy"
+          @route="tidy.auto.configure"
+          @model={{@autoTidyConfig.id}}
+          data-test-tidy-modal-auto-button
+        />
+        <Hds::Button
+          @text="Manual tidy"
+          @route="tidy.manual"
+          @model={{@autoTidyConfig.id}}
+          data-test-tidy-modal-manual-button
+        />
         <Hds::Button @text="Cancel" @color="secondary" {{on "click" F.close}} data-test-tidy-modal-cancel-button />
       </Hds::ButtonSet>
     </M.Footer>
diff --git a/ui/lib/pki/addon/components/page/pki-tidy-status.ts b/ui/lib/pki/addon/components/page/pki-tidy-status.ts
index 2c5b33ca88f..2846d721b03 100644
--- a/ui/lib/pki/addon/components/page/pki-tidy-status.ts
+++ b/ui/lib/pki/addon/components/page/pki-tidy-status.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -52,7 +52,7 @@ export default class PkiTidyStatusComponent extends Component<Args> {
   @service declare readonly secretMountPath: SecretMountPath;
   @service declare readonly flashMessages: FlashMessageService;
   @service declare readonly version: VersionService;
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked tidyOptionsModal = false;
   @tracked confirmCancelTidy = false;
@@ -67,6 +67,7 @@ export default class PkiTidyStatusComponent extends Component<Args> {
 
   tidyStatusConfigFields = [
     'tidy_cert_store',
+    'tidy_cert_metadata',
     'tidy_revoked_certs',
     'safety_buffer',
     'pause_duration',
diff --git a/ui/lib/pki/addon/components/parsed-certificate-info-rows.hbs b/ui/lib/pki/addon/components/parsed-certificate-info-rows.hbs
index a7b886565db..ad5dcdf71c5 100644
--- a/ui/lib/pki/addon/components/parsed-certificate-info-rows.hbs
+++ b/ui/lib/pki/addon/components/parsed-certificate-info-rows.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each this.possibleFields as |field|}}
   {{#let (get @model field.key) as |value|}}
diff --git a/ui/lib/pki/addon/components/parsed-certificate-info-rows.ts b/ui/lib/pki/addon/components/parsed-certificate-info-rows.ts
index 0ed39c95017..bdd304eec8a 100644
--- a/ui/lib/pki/addon/components/parsed-certificate-info-rows.ts
+++ b/ui/lib/pki/addon/components/parsed-certificate-info-rows.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/pki-generate-csr.hbs b/ui/lib/pki/addon/components/pki-generate-csr.hbs
index 1b4a38f8bd9..ffc45663219 100644
--- a/ui/lib/pki/addon/components/pki-generate-csr.hbs
+++ b/ui/lib/pki/addon/components/pki-generate-csr.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @model.id}}
   {{! Model only has ID once form has been submitted and saved }}
@@ -29,12 +29,14 @@
               {{#if (and attr.options.isCertificate value)}}
                 <CertificateCard @data={{value}} />
               {{else if (eq attr.name "keyId")}}
-                <LinkTo @route="keys.key.details" @model={{@model.keyId}}>
+                <LinkTo @route="keys.key.details" @models={{array @model.backend @model.keyId}}>
                   {{@model.keyId}}
                 </LinkTo>
+              {{else if value}}
+                {{value}}
+                {{! it's unlikely but if a value is returned for privateKey and privateKeyType we want to display it, otherwise we show the "internal" badge below }}
               {{else}}
-                {{! this block only ever renders privateKey and privateKeyType }}
-                <span class="{{unless value 'tag'}}">{{or value "internal"}}</span>
+                <Hds::Badge @text="internal" />
               {{/if}}
             </InfoTableRow>
           {{/let}}
@@ -62,7 +64,7 @@
 
     <hr class="has-background-gray-100" />
     <Hds::ButtonSet>
-      <Hds::Button @text="Generate" type="submit" data-test-save />
+      <Hds::Button @text="Generate" type="submit" data-test-submit />
       <Hds::Button @text="Cancel" @color="secondary" {{on "click" this.cancel}} data-test-cancel />
     </Hds::ButtonSet>
     {{#if this.alert}}
diff --git a/ui/lib/pki/addon/components/pki-generate-csr.ts b/ui/lib/pki/addon/components/pki-generate-csr.ts
index 75ba5b34b2a..d2202ab0617 100644
--- a/ui/lib/pki/addon/components/pki-generate-csr.ts
+++ b/ui/lib/pki/addon/components/pki-generate-csr.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,9 +11,10 @@ import { task } from 'ember-concurrency';
 import { waitFor } from '@ember/test-waiters';
 import { expandAttributeMeta } from 'vault/utils/field-to-attrs';
 import errorMessage from 'vault/utils/error-message';
+
 import type FlashMessageService from 'vault/services/flash-messages';
 import type PkiActionModel from 'vault/models/pki/action';
-import type { ValidationMap } from 'vault/vault/app-types';
+import type { Model, ValidationMap } from 'vault/app-types';
 
 interface Args {
   model: PkiActionModel;
@@ -82,7 +83,7 @@ export default class PkiGenerateCsrComponent extends Component<Args> {
 
   @task
   @waitFor
-  *save(event: Event): Generator<Promise<boolean | PkiActionModel>> {
+  *save(event: Event): Generator<Promise<boolean | Model>> {
     event.preventDefault();
     try {
       const { model, onSave } = this.args;
diff --git a/ui/lib/pki/addon/components/pki-generate-root.hbs b/ui/lib/pki/addon/components/pki-generate-root.hbs
index 8980ef11462..8918d50c79a 100644
--- a/ui/lib/pki/addon/components/pki-generate-root.hbs
+++ b/ui/lib/pki/addon/components/pki-generate-root.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{! Show results if model has an ID, which is only generated after save }}
 {{#if @model.id}}
@@ -14,7 +14,10 @@
             @value={{get @model attr.name}}
             @addCopyButton={{or (eq attr.name "issuerId") (eq attr.name "keyId")}}
           >
-            <LinkTo @route={{attr.options.detailLinkTo}} @model={{get @model attr.name}}>{{get @model attr.name}}</LinkTo>
+            <LinkTo @route={{attr.options.detailLinkTo}} @models={{array @model.backend (get @model attr.name)}}>{{get
+                @model
+                attr.name
+              }}</LinkTo>
           </InfoTableRow>
         {{else if attr.options.isCertificate}}
           <InfoTableRow
@@ -34,11 +37,15 @@
       {{#if @model.privateKey}}
         <CertificateCard @data={{@model.privateKey}} />
       {{else}}
-        <span class="tag">internal</span>
+        <Hds::Badge @text="internal" />
       {{/if}}
     </InfoTableRow>
     <InfoTableRow @label="Private key type" @value={{@model.privateKeyType}}>
-      <span class="{{unless @model.privateKeyType 'tag'}}">{{or @model.privateKeyType "internal"}}</span>
+      {{#if @model.privateKeyType}}
+        {{@model.privateKeyType}}
+      {{else}}
+        <Hds::Badge @text="internal" />
+      {{/if}}
     </InfoTableRow>
     <ParsedCertificateInfoRows @model={{@model.parsedCertificate}} />
   </main>
@@ -97,8 +104,8 @@
 
     <hr class="has-background-gray-100" />
     <Hds::ButtonSet>
-      <Hds::Button @text="Done" type="submit" data-test-pki-generate-root-save />
-      <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onCancel}} data-test-pki-generate-root-cancel />
+      <Hds::Button @text="Done" type="submit" data-test-submit />
+      <Hds::Button @text="Cancel" @color="secondary" {{on "click" @onCancel}} data-test-cancel />
     </Hds::ButtonSet>
     {{#if this.invalidFormAlert}}
       <div class="control">
diff --git a/ui/lib/pki/addon/components/pki-generate-root.ts b/ui/lib/pki/addon/components/pki-generate-root.ts
index d8bab62adce..36d23c89f69 100644
--- a/ui/lib/pki/addon/components/pki-generate-root.ts
+++ b/ui/lib/pki/addon/components/pki-generate-root.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -51,7 +51,7 @@ interface Args {
  */
 export default class PkiGenerateRootComponent extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked modelValidations: ValidationMap | null = null;
   @tracked errorBanner = '';
diff --git a/ui/lib/pki/addon/components/pki-generate-toggle-groups.hbs b/ui/lib/pki/addon/components/pki-generate-toggle-groups.hbs
index 210e9101b02..11630b47fe0 100644
--- a/ui/lib/pki/addon/components/pki-generate-toggle-groups.hbs
+++ b/ui/lib/pki/addon/components/pki-generate-toggle-groups.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each-in this.groups as |group fields|}}
   <ToggleButton
@@ -10,7 +10,7 @@
     @closedLabel={{group}}
     @onClick={{fn this.toggleGroup group}}
     class="is-block"
-    data-test-toggle-group={{group}}
+    data-test-button={{group}}
   />
   {{#if (eq this.showGroup group)}}
     <div class="box is-marginless" data-test-group={{group}}>
@@ -43,6 +43,13 @@
             etc.) to be protected by a single certificate.
           {{else if (eq group "Additional subject fields")}}
             These fields provide more information about the client to which the certificate belongs.
+          {{else if (eq group "Name constraints")}}
+            These fields create the name constraints extension when generating CA certificates. Specifying any combination of
+            these parameters will trigger the creation of the name constraints extension as per
+            <Hds::Link::Inline
+              @isHrefExternal={{true}}
+              @href="https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10"
+            >RFC 5280 section 4.2.1.10</Hds::Link::Inline>.
           {{/if}}
         </p>
         {{#each fields as |fieldName|}}
diff --git a/ui/lib/pki/addon/components/pki-generate-toggle-groups.ts b/ui/lib/pki/addon/components/pki-generate-toggle-groups.ts
index eed897910cd..4b4d800a622 100644
--- a/ui/lib/pki/addon/components/pki-generate-toggle-groups.ts
+++ b/ui/lib/pki/addon/components/pki-generate-toggle-groups.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/pki-import-pem-bundle.hbs b/ui/lib/pki/addon/components/pki-import-pem-bundle.hbs
index 010084e1aa0..d29415d61af 100644
--- a/ui/lib/pki/addon/components/pki-import-pem-bundle.hbs
+++ b/ui/lib/pki/addon/components/pki-import-pem-bundle.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.importedResponse}}
   <div class="is-flex-start has-top-margin-xs">
@@ -25,7 +25,7 @@
         <div class="is-flex-start">
           <div class="is-flex-grow-1 basis-0 has-bottom-margin-xs" data-test-imported-issuer>
             {{#if imported.issuer}}
-              <LinkTo @route="issuers.issuer.details" @model={{imported.issuer}}>
+              <LinkTo @route="issuers.issuer.details" @models={{array @model.backend imported.issuer}}>
                 {{imported.issuer}}
               </LinkTo>
             {{else}}
@@ -34,7 +34,7 @@
           </div>
           <div class="is-flex-grow-1 basis-0 has-bottom-margin-xs" data-test-imported-key>
             {{#if imported.key}}
-              <LinkTo @route="keys.key.details" @model={{imported.key}}>
+              <LinkTo @route="keys.key.details" @models={{array @model.backend imported.key}}>
                 {{imported.key}}
               </LinkTo>
             {{else}}
diff --git a/ui/lib/pki/addon/components/pki-import-pem-bundle.ts b/ui/lib/pki/addon/components/pki-import-pem-bundle.ts
index 85fa1cce305..49f69ec2fae 100644
--- a/ui/lib/pki/addon/components/pki-import-pem-bundle.ts
+++ b/ui/lib/pki/addon/components/pki-import-pem-bundle.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/pki-info-table-rows.hbs b/ui/lib/pki/addon/components/pki-info-table-rows.hbs
index 73d20d6b8d4..bc354dd4111 100644
--- a/ui/lib/pki/addon/components/pki-info-table-rows.hbs
+++ b/ui/lib/pki/addon/components/pki-info-table-rows.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#each @displayFields as |field|}}
   {{#let (find-by "name" field @model.allFields) as |attr|}}
@@ -18,7 +18,11 @@
           {{else if attr.options.detailLinkTo}}
             <LinkTo @route={{attr.options.detailLinkTo}} @model={{value}}>{{value}}</LinkTo>
           {{else if (or (eq attr.name "privateKey") (eq attr.name "privateKeyType"))}}
-            <span class="{{unless value 'tag'}}">{{or value "internal"}}</span>
+            {{#if value}}
+              {{value}}
+            {{else}}
+              <Hds::Badge @text="internal" />
+            {{/if}}
           {{else if attr.options.formatDate}}
             {{date-format value "MMM d yyyy HH:mm:ss a zzzz"}}
           {{else}}
diff --git a/ui/lib/pki/addon/components/pki-issuer-cross-sign.hbs b/ui/lib/pki/addon/components/pki-issuer-cross-sign.hbs
index 0f4cf53e756..01658370563 100644
--- a/ui/lib/pki/addon/components/pki-issuer-cross-sign.hbs
+++ b/ui/lib/pki/addon/components/pki-issuer-cross-sign.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <h3 class="title is-4">Intermediates</h3>
 <div class="box is-fullwidth has-only-top-shadow">
@@ -24,7 +24,9 @@
           <h2 data-test-info-table-label={{column.key}}>
             {{column.label}}
             {{#if column.helpText}}
-              <InfoTooltip @verticalPosition="above" @horizontalPosition="center">{{column.helpText}}</InfoTooltip>
+              <Hds::TooltipButton @text={{column.helpText}} aria-label="More information">
+                <Hds::Icon @name="info" />
+              </Hds::TooltipButton>
             {{/if}}
           </h2>
         </div>
@@ -93,14 +95,14 @@
           @icon={{if this.submit.isRunning "loading"}}
           type="submit"
           disabled={{this.submit.isRunning}}
-          data-test-cross-sign-submit
+          data-test-submit
         />
         <Hds::Button
           @text="Cancel"
           @color="secondary"
           @route="issuers.issuer.details"
           disabled={{this.submit.isRunning}}
-          data-test-cross-sign-cancel
+          data-test-cancel
         />
       </Hds::ButtonSet>
     </form>
diff --git a/ui/lib/pki/addon/components/pki-issuer-cross-sign.js b/ui/lib/pki/addon/components/pki-issuer-cross-sign.js
index eac1b49d478..91fc0087290 100644
--- a/ui/lib/pki/addon/components/pki-issuer-cross-sign.js
+++ b/ui/lib/pki/addon/components/pki-issuer-cross-sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,6 +11,7 @@ import { tracked } from '@glimmer/tracking';
 import errorMessage from 'vault/utils/error-message';
 import { waitFor } from '@ember/test-waiters';
 import { parseCertificate } from 'vault/utils/parse-pki-cert';
+import { addToArray } from 'vault/helpers/add-to-array';
 /**
  * @module PkiIssuerCrossSign
  * PkiIssuerCrossSign components render from a parent issuer's details page to cross-sign an intermediate issuer (from a different mount).
@@ -92,7 +93,7 @@ export default class PkiIssuerCrossSign extends Component {
 
       // for cross-signing error handling we want to record the list of issuers before the process starts
       this.intermediateIssuers[intermediateMount] = issuers;
-      this.validationErrors.addObject({
+      this.validationErrors = addToArray(this.validationErrors, {
         newCrossSignedIssuer: this.nameValidation(newCrossSignedIssuer, issuers),
       });
     }
@@ -109,9 +110,9 @@ export default class PkiIssuerCrossSign extends Component {
           intermediateIssuer,
           newCrossSignedIssuer
         );
-        this.signedIssuers.addObject({ ...data, hasError: false });
+        this.signedIssuers = addToArray(this.signedIssuers, { ...data, hasError: false });
       } catch (error) {
-        this.signedIssuers.addObject({
+        this.signedIssuers = addToArray(this.signedIssuers, {
           ...this.formData[row],
           hasError: errorMessage(error),
           hasUnsupportedParams: error.cause ? error.cause.map((e) => e.message).join(', ') : null,
diff --git a/ui/lib/pki/addon/components/pki-key-form.hbs b/ui/lib/pki/addon/components/pki-key-form.hbs
index 881492a512b..05843b56158 100644
--- a/ui/lib/pki/addon/components/pki-key-form.hbs
+++ b/ui/lib/pki/addon/components/pki-key-form.hbs
@@ -1,64 +1,73 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<form {{on "submit" (perform this.save)}}>
-  <div class="box is-sideless is-fullwidth is-marginless">
-    <MessageError @errorMessage={{this.errorBanner}} class="has-top-margin-s" />
-    <NamespaceReminder @mode={{if @model.isNew "generate" "update"}} @noun="PKI key" />
-    {{#if @model.isNew}}
-      {{#each @model.formFieldGroups as |fieldGroup|}}
-        {{#each-in fieldGroup as |group fields|}}
-          {{#if (eq group "Key parameters")}}
-            <PkiKeyParameters @model={{@model}} @fields={{fields}} @modelValidations={{this.modelValidations}} />
-          {{else}}
-            {{#each fields as |attr|}}
-              <FormField
-                data-test-field={{attr}}
-                @attr={{attr}}
-                @model={{@model}}
-                @modelValidations={{this.modelValidations}}
-                @showHelpText={{false}}
-              />
-            {{/each}}
-          {{/if}}
-        {{/each-in}}
-      {{/each}}
-    {{else}}
-      {{! only key name is edit-able }}
-      {{#let (find-by "name" "keyName" @model.formFields) as |keyName|}}
-        <FormField data-test-field={{keyName}} @attr={{keyName}} @model={{@model}} @showHelpText={{false}} />
-      {{/let}}
-      {{#let (find-by "name" "keyType" @model.formFields) as |keyType|}}
-        <ReadonlyFormField @attr={{keyType}} @value={{@model.keyType}} />
-      {{/let}}
-    {{/if}}
-  </div>
-  <Hds::ButtonSet class="has-top-padding-s">
-    <Hds::Button
-      @text={{if @model.isNew "Generate key" "Edit key"}}
-      @icon={{if this.save.isRunning "loading"}}
-      type="submit"
-      disabled={{this.save.isRunning}}
-      data-test-pki-key-save
-    />
-    <Hds::Button
-      @text="Cancel"
-      @color="secondary"
-      disabled={{this.save.isRunning}}
-      {{on "click" @onCancel}}
-      data-test-pki-key-cancel
-    />
-  </Hds::ButtonSet>
-  {{#if this.invalidFormAlert}}
-    <div class="control">
-      <AlertInline
-        @type="danger"
-        class="has-top-padding-s"
-        @message={{this.invalidFormAlert}}
-        data-test-pki-key-validation-error
-      />
+{{! private_key is only available after initial save }}
+{{#if this.generatedKey.privateKey}}
+  <Page::PkiKeyDetails
+    @key={{this.generatedKey}}
+    @canDelete={{this.generatedKey.canDelete}}
+    @canEdit={{this.generatedKey.canEdit}}
+  />
+{{else}}
+  <form {{on "submit" (perform this.save)}}>
+    <div class="box is-sideless is-fullwidth is-marginless">
+      <MessageError @errorMessage={{this.errorBanner}} class="has-top-margin-s" />
+      <NamespaceReminder @mode={{if @model.isNew "generate" "update"}} @noun="PKI key" />
+      {{#if @model.isNew}}
+        {{#each @model.formFieldGroups as |fieldGroup|}}
+          {{#each-in fieldGroup as |group fields|}}
+            {{#if (eq group "Key parameters")}}
+              <PkiKeyParameters @model={{@model}} @fields={{fields}} @modelValidations={{this.modelValidations}} />
+            {{else}}
+              {{#each fields as |attr|}}
+                <FormField
+                  data-test-field={{attr}}
+                  @attr={{attr}}
+                  @model={{@model}}
+                  @modelValidations={{this.modelValidations}}
+                  @showHelpText={{false}}
+                />
+              {{/each}}
+            {{/if}}
+          {{/each-in}}
+        {{/each}}
+      {{else}}
+        {{! only key name is edit-able }}
+        {{#let (find-by "name" "keyName" @model.formFields) as |keyName|}}
+          <FormField data-test-field={{keyName}} @attr={{keyName}} @model={{@model}} @showHelpText={{false}} />
+        {{/let}}
+        {{#let (find-by "name" "keyType" @model.formFields) as |keyType|}}
+          <ReadonlyFormField @attr={{keyType}} @value={{@model.keyType}} />
+        {{/let}}
+      {{/if}}
     </div>
-  {{/if}}
-</form>
\ No newline at end of file
+    <Hds::ButtonSet class="has-top-padding-s">
+      <Hds::Button
+        @text={{if @model.isNew "Generate key" "Edit key"}}
+        @icon={{if this.save.isRunning "loading"}}
+        type="submit"
+        disabled={{this.save.isRunning}}
+        data-test-submit
+      />
+      <Hds::Button
+        @text="Cancel"
+        @color="secondary"
+        disabled={{this.save.isRunning}}
+        {{on "click" @onCancel}}
+        data-test-cancel
+      />
+    </Hds::ButtonSet>
+    {{#if this.invalidFormAlert}}
+      <div class="control">
+        <AlertInline
+          @type="danger"
+          class="has-top-padding-s"
+          @message={{this.invalidFormAlert}}
+          data-test-pki-key-validation-error
+        />
+      </div>
+    {{/if}}
+  </form>
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/pki/addon/components/pki-key-form.ts b/ui/lib/pki/addon/components/pki-key-form.ts
index ce66110e2f1..2e10676c9ba 100644
--- a/ui/lib/pki/addon/components/pki-key-form.ts
+++ b/ui/lib/pki/addon/components/pki-key-form.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -39,6 +39,8 @@ export default class PkiKeyForm extends Component<Args> {
   @tracked invalidFormAlert = '';
   @tracked modelValidations: ValidationMap | null = null;
 
+  @tracked generatedKey: PkiKeyModel | null = null;
+
   @task
   @waitFor
   *save(event: Event) {
@@ -51,11 +53,15 @@ export default class PkiKeyForm extends Component<Args> {
         this.invalidFormAlert = invalidFormMessage;
       }
       if (!isValid && isNew) return;
-      yield this.args.model.save({ adapterOptions: { import: false } });
+      this.generatedKey = yield this.args.model.save({ adapterOptions: { import: false } });
       this.flashMessages.success(
         `Successfully ${isNew ? 'generated' : 'updated'} key${keyName ? ` ${keyName}.` : '.'}`
       );
-      this.args.onSave();
+
+      // only transition to details if there is no private_key data to display
+      if (!this.generatedKey?.privateKey) {
+        this.args.onSave();
+      }
     } catch (error) {
       this.errorBanner = errorMessage(error);
       this.invalidFormAlert = 'There was an error submitting this form.';
diff --git a/ui/lib/pki/addon/components/pki-key-import.hbs b/ui/lib/pki/addon/components/pki-key-import.hbs
index 882149985a7..8cbbde74555 100644
--- a/ui/lib/pki/addon/components/pki-key-import.hbs
+++ b/ui/lib/pki/addon/components/pki-key-import.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form {{on "submit" (perform this.submitForm)}} data-test-pki-key-import-form>
   <MessageError @errorMessage={{this.errorBanner}} class="has-top-margin-s" />
@@ -30,7 +30,7 @@
       @color="secondary"
       disabled={{this.submitForm.isRunning}}
       {{on "click" this.cancel}}
-      data-test-pki-key-cancel
+      data-test-cancel
     />
   </Hds::ButtonSet>
   {{#if this.invalidFormAlert}}
diff --git a/ui/lib/pki/addon/components/pki-key-import.ts b/ui/lib/pki/addon/components/pki-key-import.ts
index 51343f32328..058ae4e9ca4 100644
--- a/ui/lib/pki/addon/components/pki-key-import.ts
+++ b/ui/lib/pki/addon/components/pki-key-import.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/pki-key-parameters.hbs b/ui/lib/pki/addon/components/pki-key-parameters.hbs
index c05fac3c387..b3cfa6cc4ca 100644
--- a/ui/lib/pki/addon/components/pki-key-parameters.hbs
+++ b/ui/lib/pki/addon/components/pki-key-parameters.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{yield}}
 {{#each @fields as |attr|}}
@@ -12,38 +12,30 @@
         @label={{capitalize (or attr.options.label (humanize (dasherize attr.name)))}}
         @subText={{attr.options.subText}}
       />
-      <div class="control is-expanded">
-        <ToolTip @verticalPosition="above" @horizontalPosition="center" as |T|>
-          <T.Trigger tabindex="-1">
-            <div class="select is-fullwidth">
-              <select
-                id={{attr.name}}
-                name={{attr.name}}
-                data-test-input={{attr.name}}
-                disabled={{unless @model.keyType true}}
-                {{on "change" this.onKeyBitsChange}}
-              >
-                {{#if (and attr.options.noDefault (not @model.keyType))}}
-                  <option value="">
-                    Select one
-                  </option>
-                {{/if}}
-                {{#each this.keyBitOptions as |val|}}
-                  <option selected={{loose-equal (get @model "keyBits") val}} value={{val}}>
-                    {{val}}
-                  </option>
-                {{/each}}
-              </select>
-            </div>
-          </T.Trigger>
-          {{#unless @model.keyType}}
-            <T.Content @defaultClass="tool-tip smaller-font">
-              <div class="box">
-                Choose a key type before specifying bit length.
-              </div>
-            </T.Content>
-          {{/unless}}
-        </ToolTip>
+      <div
+        class="select is-fullwidth"
+        {{! these extra parentheses are necessary to conditionally apply the modifier }}
+        {{! TODO: refactor this component and avoid this conditional modifier pattern }}
+        {{(unless @model.keyType (modifier "hds-tooltip" "Choose a key type before specifying bit length."))}}
+      >
+        <select
+          id={{attr.name}}
+          name={{attr.name}}
+          data-test-input={{attr.name}}
+          disabled={{unless @model.keyType true}}
+          {{on "change" this.onKeyBitsChange}}
+        >
+          {{#if (and attr.options.noDefault (not @model.keyType))}}
+            <option value="">
+              Select one
+            </option>
+          {{/if}}
+          {{#each this.keyBitOptions as |val|}}
+            <option selected={{loose-equal (get @model "keyBits") val}} value={{val}}>
+              {{val}}
+            </option>
+          {{/each}}
+        </select>
       </div>
     </div>
   {{else}}
diff --git a/ui/lib/pki/addon/components/pki-key-parameters.ts b/ui/lib/pki/addon/components/pki-key-parameters.ts
index 5bea31a4ed8..d289500566e 100644
--- a/ui/lib/pki/addon/components/pki-key-parameters.ts
+++ b/ui/lib/pki/addon/components/pki-key-parameters.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/pki-key-usage.hbs b/ui/lib/pki/addon/components/pki-key-usage.hbs
index f6b5ebd7ab7..5b99290a8ad 100644
--- a/ui/lib/pki/addon/components/pki-key-usage.hbs
+++ b/ui/lib/pki/addon/components/pki-key-usage.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <CheckboxGrid
   @name="keyUsage"
diff --git a/ui/lib/pki/addon/components/pki-key-usage.ts b/ui/lib/pki/addon/components/pki-key-usage.ts
index ca1dc1a6492..d3566f880bf 100644
--- a/ui/lib/pki/addon/components/pki-key-usage.ts
+++ b/ui/lib/pki/addon/components/pki-key-usage.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/components/pki-not-valid-after-form.hbs b/ui/lib/pki/addon/components/pki-not-valid-after-form.hbs
index 68f31696679..d6669f47a08 100644
--- a/ui/lib/pki/addon/components/pki-not-valid-after-form.hbs
+++ b/ui/lib/pki/addon/components/pki-not-valid-after-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="column is-narrow is-flex-align-baseline has-text-grey has-right-margin-s has-padding-xs">
   <RadioButton
diff --git a/ui/lib/pki/addon/components/pki-not-valid-after-form.ts b/ui/lib/pki/addon/components/pki-not-valid-after-form.ts
index 7e9f582baf5..2cbb2d8e932 100644
--- a/ui/lib/pki/addon/components/pki-not-valid-after-form.ts
+++ b/ui/lib/pki/addon/components/pki-not-valid-after-form.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -20,7 +20,7 @@ interface Args {
   };
 }
 
-export default class RadioSelectTtlOrString extends Component<Args> {
+export default class PkiNotValidAfterForm extends Component<Args> {
   @tracked groupValue = 'ttl';
   @tracked cachedNotAfter: string;
   @tracked cachedTtl: string | number;
diff --git a/ui/lib/pki/addon/components/pki-page-header.hbs b/ui/lib/pki/addon/components/pki-page-header.hbs
index 8858e37853a..b48cf4cf348 100644
--- a/ui/lib/pki/addon/components/pki-page-header.hbs
+++ b/ui/lib/pki/addon/components/pki-page-header.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
@@ -21,13 +21,21 @@
 <div class="tabs-container box is-bottomless is-marginless is-paddingless">
   <nav class="tabs" aria-label="pki tabs">
     <ul>
-      <li><LinkTo @route="overview" data-test-secret-list-tab="Overview">Overview</LinkTo></li>
-      <li><LinkTo @route="roles" data-test-secret-list-tab="Roles">Roles</LinkTo></li>
-      <li><LinkTo @route="issuers" data-test-secret-list-tab="Issuers">Issuers</LinkTo></li>
-      <li><LinkTo @route="keys" data-test-secret-list-tab="Keys">Keys</LinkTo></li>
-      <li><LinkTo @route="certificates" data-test-secret-list-tab="Certificates">Certificates</LinkTo></li>
-      <li><LinkTo @route="tidy" data-test-secret-list-tab="Tidy">Tidy</LinkTo></li>
-      <li><LinkTo @route="configuration" data-test-secret-list-tab="Configuration">Configuration</LinkTo></li>
+      <li><LinkTo @route="overview" @model={{@backend.id}} data-test-secret-list-tab="Overview">Overview</LinkTo></li>
+      <li><LinkTo @route="roles" @model={{@backend.id}} data-test-secret-list-tab="Roles">Roles</LinkTo></li>
+      <li><LinkTo @route="issuers" @model={{@backend.id}} data-test-secret-list-tab="Issuers">Issuers</LinkTo></li>
+      <li><LinkTo @route="keys" @model={{@backend.id}} data-test-secret-list-tab="Keys">Keys</LinkTo></li>
+      <li><LinkTo
+          @route="certificates"
+          @model={{@backend.id}}
+          data-test-secret-list-tab="Certificates"
+        >Certificates</LinkTo></li>
+      <li><LinkTo @route="tidy" @model={{@backend.id}} data-test-secret-list-tab="Tidy">Tidy</LinkTo></li>
+      <li><LinkTo
+          @route="configuration"
+          @model={{@backend.id}}
+          data-test-secret-list-tab="Configuration"
+        >Configuration</LinkTo></li>
     </ul>
   </nav>
 </div>
\ No newline at end of file
diff --git a/ui/lib/pki/addon/components/pki-paginated-list.hbs b/ui/lib/pki/addon/components/pki-paginated-list.hbs
index 5c67dd98993..69f6618565c 100644
--- a/ui/lib/pki/addon/components/pki-paginated-list.hbs
+++ b/ui/lib/pki/addon/components/pki-paginated-list.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
@@ -17,6 +17,7 @@
       @currentPage={{@list.meta.currentPage}}
       @currentPageSize={{@list.meta.pageSize}}
       @route={{@listRoute}}
+      @model={{@backend}}
       @showSizeSelector={{false}}
       @totalItems={{@list.meta.total}}
       @queryFunction={{this.paginationQueryParams}}
diff --git a/ui/lib/pki/addon/components/pki-paginated-list.ts b/ui/lib/pki/addon/components/pki-paginated-list.ts
index 0af6e7cea3a..a2a4a7cb673 100644
--- a/ui/lib/pki/addon/components/pki-paginated-list.ts
+++ b/ui/lib/pki/addon/components/pki-paginated-list.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -26,6 +26,7 @@ interface Args {
   list: unknown[];
   listRoute: string;
   hasConfig?: boolean;
+  backend: string;
 }
 export default class PkiPaginatedListComponent extends Component<Args> {
   get paginationQueryParams() {
diff --git a/ui/lib/pki/addon/components/pki-role-form.hbs b/ui/lib/pki/addon/components/pki-role-form.hbs
index ccd2e0a36fa..8420ebe7d1a 100644
--- a/ui/lib/pki/addon/components/pki-role-form.hbs
+++ b/ui/lib/pki/addon/components/pki-role-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form {{on "submit" (perform this.save)}}>
   <div class="box is-sideless is-fullwidth is-marginless">
@@ -64,7 +64,7 @@
               @closedLabel={{group}}
               @onClick={{fn (mut (get @role prop))}}
               class="is-block"
-              data-test-toggle-group={{group}}
+              data-test-button={{group}}
             />
             {{#if (get @role prop)}}
               <div class="box is-tall is-marginless" data-test-toggle-div={{group}}>
@@ -124,14 +124,14 @@
       @icon={{if this.save.isRunning "loading"}}
       type="submit"
       disabled={{this.save.isRunning}}
-      data-test-pki-role-save
+      data-test-submit
     />
     <Hds::Button
       @text="Cancel"
       @color="secondary"
       disabled={{this.save.isRunning}}
       {{on "click" @onCancel}}
-      data-test-pki-role-cancel
+      data-test-cancel
     />
   </Hds::ButtonSet>
   {{#if this.modelValidations.targets.errors}}
diff --git a/ui/lib/pki/addon/components/pki-role-form.ts b/ui/lib/pki/addon/components/pki-role-form.ts
index f870242bb0c..bb52d6c62bd 100644
--- a/ui/lib/pki/addon/components/pki-role-form.ts
+++ b/ui/lib/pki/addon/components/pki-role-form.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { task } from 'ember-concurrency';
 import { tracked } from '@glimmer/tracking';
 import { action } from '@ember/object';
 import errorMessage from 'vault/utils/error-message';
+
 import type Store from '@ember-data/store';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type SecretMountPathService from 'vault/services/secret-mount-path';
diff --git a/ui/lib/pki/addon/components/pki-role-generate.hbs b/ui/lib/pki/addon/components/pki-role-generate.hbs
index a5db88ff655..aaf8a7cf437 100644
--- a/ui/lib/pki/addon/components/pki-role-generate.hbs
+++ b/ui/lib/pki/addon/components/pki-role-generate.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @model.serialNumber}}
   <Page::PkiCertificateDetails @model={{@model}} @onBack={{this.cancel}} />
@@ -31,14 +31,14 @@
         @icon={{if this.save.isRunning "loading"}}
         type="submit"
         disabled={{this.save.isRunning}}
-        data-test-pki-generate-button
+        data-test-submit
       />
       <Hds::Button
         @text="Cancel"
         @color="secondary"
         disabled={{this.save.isRunning}}
         {{on "click" this.cancel}}
-        data-test-pki-generate-cancel
+        data-test-cancel
       />
     </Hds::ButtonSet>
 
diff --git a/ui/lib/pki/addon/components/pki-role-generate.ts b/ui/lib/pki/addon/components/pki-role-generate.ts
index 3c008b4196d..27cbd422ebf 100644
--- a/ui/lib/pki/addon/components/pki-role-generate.ts
+++ b/ui/lib/pki/addon/components/pki-role-generate.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,8 @@ import { task } from 'ember-concurrency';
 import { service } from '@ember/service';
 import { tracked } from '@glimmer/tracking';
 import errorMessage from 'vault/utils/error-message';
-import type Router from '@ember/routing/router';
+
+import type RouterService from '@ember/routing/router';
 import type Store from '@ember-data/store';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type DownloadService from 'vault/services/download';
@@ -23,10 +24,10 @@ interface Args {
 }
 
 export default class PkiRoleGenerate extends Component<Args> {
-  @service declare readonly router: Router;
-  @service declare readonly store: Store;
-  @service declare readonly flashMessages: FlashMessageService;
   @service declare readonly download: DownloadService;
+  @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly store: Store;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked errorBanner = '';
   @tracked invalidFormAlert = '';
diff --git a/ui/lib/pki/addon/components/pki-sign-intermediate-form.hbs b/ui/lib/pki/addon/components/pki-sign-intermediate-form.hbs
index 157ba3d16c6..ba4392f8664 100644
--- a/ui/lib/pki/addon/components/pki-sign-intermediate-form.hbs
+++ b/ui/lib/pki/addon/components/pki-sign-intermediate-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if @model.id}}
   {{! Model only has ID once form has been submitted and saved }}
diff --git a/ui/lib/pki/addon/components/pki-sign-intermediate-form.ts b/ui/lib/pki/addon/components/pki-sign-intermediate-form.ts
index 2fb1c660ab5..301032469cd 100644
--- a/ui/lib/pki/addon/components/pki-sign-intermediate-form.ts
+++ b/ui/lib/pki/addon/components/pki-sign-intermediate-form.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -49,6 +49,16 @@ export default class PkiSignIntermediateFormComponent extends Component<Args> {
 
   get groups() {
     return {
+      'Name constraints': [
+        'permittedDnsDomains',
+        'permittedEmailAddresses',
+        'permittedIpRanges',
+        'permittedUriDomains',
+        'excludedDnsDomains',
+        'excludedEmailAddresses',
+        'excludedIpRanges',
+        'excludedUriDomains',
+      ],
       'Signing options': ['usePss', 'skid', 'signatureBits'],
       'Subject Alternative Name (SAN) Options': ['altNames', 'ipSans', 'uriSans', 'otherSans'],
       'Additional subject fields': [
diff --git a/ui/lib/pki/addon/components/pki-tidy-form.hbs b/ui/lib/pki/addon/components/pki-tidy-form.hbs
index e45483b6871..bc154147011 100644
--- a/ui/lib/pki/addon/components/pki-tidy-form.hbs
+++ b/ui/lib/pki/addon/components/pki-tidy-form.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <hr class="is-marginless has-background-gray-200" />
 
@@ -13,23 +13,34 @@
 <MessageError @errorMessage={{this.errorBanner}} class="has-top-margin-s" />
 
 <form class="has-bottom-margin-s" {{on "submit" (perform this.save)}} data-test-tidy-form={{@tidyType}}>
-  {{#if (and (eq @tidyType "auto") this.intervalDurationAttr)}}
-    {{#let this.intervalDurationAttr as |attr|}}
-      <TtlPicker
-        data-test-input={{attr.name}}
-        @onChange={{fn this.handleTtl attr}}
-        @label={{attr.options.label}}
-        @labelDisabled={{attr.options.labelDisabled}}
-        @helperTextDisabled={{attr.options.helperTextDisabled}}
-        @helperTextEnabled={{attr.options.helperTextEnabled}}
-        @initialEnabled={{get @tidy attr.options.mapToBoolean}}
-        @initialValue={{get @tidy attr.name}}
-      />
+  {{#if (eq @tidyType "auto")}}
+    {{#let (get @tidy.allByKey "enabled") as |enabledAttr|}}
+      <div class="field">
+        <Toggle @onChange={{fn (mut @tidy.enabled)}} @checked={{@tidy.enabled}} @name={{enabledAttr.name}}>
+          <legend>
+            <span class="ttl-picker-label is-large">
+              {{if @tidy.enabled enabledAttr.options.label enabledAttr.options.labelDisabled}}
+            </span>
+            {{#unless @tidy.enabled}}
+              <p class="sub-text">{{enabledAttr.options.helperTextDisabled}}</p>
+            {{/unless}}
+          </legend>
+        </Toggle>
+      </div>
     {{/let}}
+    {{#if @tidy.enabled}}
+      <h2 class="title is-size-5 has-border-bottom-light page-header" data-test-tidy-header="Automatic tidy settings">
+        Automatic tidy settings
+      </h2>
+      {{#each @tidy.autoTidyConfigFields as |field|}}
+        <FormField @attr={{get @tidy.allByKey field}} @model={{@tidy}} />
+      {{/each}}
+    {{/if}}
   {{/if}}
-  {{#each @tidy.formFieldGroups as |fieldGroup|}}
-    {{#each-in fieldGroup as |group fields|}}
-      {{#if (or (eq @tidyType "manual") @tidy.enabled)}}
+
+  {{#if (or (eq @tidyType "manual") @tidy.enabled)}}
+    {{#each @tidy.formFieldGroups as |fieldGroup|}}
+      {{#each-in fieldGroup as |group fields|}}
         <h2 class="title is-size-5 has-border-bottom-light page-header" data-test-tidy-header={{group}}>
           {{group}}
         </h2>
@@ -52,9 +63,9 @@
             {{/if}}
           {{/if}}
         {{/each}}
-      {{/if}}
-    {{/each-in}}
-  {{/each}}
+      {{/each-in}}
+    {{/each}}
+  {{/if}}
 
   <hr class="is-marginless has-background-gray-200" />
   <Hds::ButtonSet class="has-top-margin-m">
diff --git a/ui/lib/pki/addon/components/pki-tidy-form.ts b/ui/lib/pki/addon/components/pki-tidy-form.ts
index a5a290ad821..3b168856a61 100644
--- a/ui/lib/pki/addon/components/pki-tidy-form.ts
+++ b/ui/lib/pki/addon/components/pki-tidy-form.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,24 +23,18 @@ interface Args {
 }
 
 interface PkiTidyTtls {
-  intervalDuration: string;
   acmeAccountSafetyBuffer: string;
 }
 interface PkiTidyBooleans {
-  enabled: boolean;
   tidyAcme: boolean;
 }
 
 export default class PkiTidyForm extends Component<Args> {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   @tracked errorBanner = '';
   @tracked invalidFormAlert = '';
 
-  get intervalDurationAttr() {
-    return this.args.tidy?.allByKey.intervalDuration;
-  }
-
   @task
   @waitFor
   *save(event: Event) {
diff --git a/ui/lib/pki/addon/controllers/certificates/index.js b/ui/lib/pki/addon/controllers/certificates/index.js
index 3aeb60e007c..84831aa0d4b 100644
--- a/ui/lib/pki/addon/controllers/certificates/index.js
+++ b/ui/lib/pki/addon/controllers/certificates/index.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 import { action } from '@ember/object';
 
 export default class PkiCertificatesIndexController extends Controller {
diff --git a/ui/lib/pki/addon/controllers/issuers/index.js b/ui/lib/pki/addon/controllers/issuers/index.js
index 74c4ee5b259..07856bb29ad 100644
--- a/ui/lib/pki/addon/controllers/issuers/index.js
+++ b/ui/lib/pki/addon/controllers/issuers/index.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 
 export default class PkiIssuerIndexController extends Controller {
   queryParams = ['page'];
diff --git a/ui/lib/pki/addon/controllers/keys/index.js b/ui/lib/pki/addon/controllers/keys/index.js
index 24ff89ae55d..c9dd331b58a 100644
--- a/ui/lib/pki/addon/controllers/keys/index.js
+++ b/ui/lib/pki/addon/controllers/keys/index.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 
 export default class PkiKeysIndexController extends Controller {
   queryParams = ['page'];
diff --git a/ui/lib/pki/addon/controllers/roles/index.js b/ui/lib/pki/addon/controllers/roles/index.js
index 0730673e2fb..8172dac9e74 100644
--- a/ui/lib/pki/addon/controllers/roles/index.js
+++ b/ui/lib/pki/addon/controllers/roles/index.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Controller from '@ember/controller';
-import { getOwner } from '@ember/application';
+import { getOwner } from '@ember/owner';
 
 export default class PkiRolesIndexController extends Controller {
   queryParams = ['page'];
diff --git a/ui/lib/pki/addon/controllers/roles/role/generate.js b/ui/lib/pki/addon/controllers/roles/role/generate.js
index 44261f2b14f..02b859cc491 100644
--- a/ui/lib/pki/addon/controllers/roles/role/generate.js
+++ b/ui/lib/pki/addon/controllers/roles/role/generate.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/controllers/roles/role/sign.js b/ui/lib/pki/addon/controllers/roles/role/sign.js
index b0c58c9e8a9..353dae4335f 100644
--- a/ui/lib/pki/addon/controllers/roles/role/sign.js
+++ b/ui/lib/pki/addon/controllers/roles/role/sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/controllers/tidy/index.js b/ui/lib/pki/addon/controllers/tidy/index.js
index 200b7c9cb70..4773fb06614 100644
--- a/ui/lib/pki/addon/controllers/tidy/index.js
+++ b/ui/lib/pki/addon/controllers/tidy/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 import Ember from 'ember';
diff --git a/ui/lib/pki/addon/decorators/check-issuers.js b/ui/lib/pki/addon/decorators/check-issuers.js
index f829ce1d1bc..385a7d8a465 100644
--- a/ui/lib/pki/addon/decorators/check-issuers.js
+++ b/ui/lib/pki/addon/decorators/check-issuers.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/engine.js b/ui/lib/pki/addon/engine.js
index 803bc507178..2103ec92ebe 100644
--- a/ui/lib/pki/addon/engine.js
+++ b/ui/lib/pki/addon/engine.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -22,9 +22,10 @@ export default class PkiEngine extends Engine {
       'flash-messages',
       'namespace',
       'path-help',
-      'router',
+      'app-router',
       'secret-mount-path',
       'store',
+      'pagination',
       'version',
     ],
     externalRoutes: ['secrets', 'secretsListRootConfiguration', 'externalMountIssuer'],
diff --git a/ui/lib/pki/addon/routes.js b/ui/lib/pki/addon/routes.js
index 3f3966608f5..9a85cf07f80 100644
--- a/ui/lib/pki/addon/routes.js
+++ b/ui/lib/pki/addon/routes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/routes/application.js b/ui/lib/pki/addon/routes/application.js
index d8ffa116451..e715a8490eb 100644
--- a/ui/lib/pki/addon/routes/application.js
+++ b/ui/lib/pki/addon/routes/application.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,15 +17,15 @@ export default class PkiRoute extends Route {
     // the openAPI attributes to the model prototype
     const mountPath = this.secretMountPath.currentPath;
     return hash({
-      acme: this.pathHelp.getNewModel('pki/config/acme', mountPath),
-      certGenerate: this.pathHelp.getNewModel('pki/certificate/generate', mountPath),
-      certSign: this.pathHelp.getNewModel('pki/certificate/sign', mountPath),
-      cluster: this.pathHelp.getNewModel('pki/config/cluster', mountPath),
-      key: this.pathHelp.getNewModel('pki/key', mountPath),
-      role: this.pathHelp.getNewModel('pki/role', mountPath),
-      signCsr: this.pathHelp.getNewModel('pki/sign-intermediate', mountPath),
-      tidy: this.pathHelp.getNewModel('pki/tidy', mountPath),
-      urls: this.pathHelp.getNewModel('pki/config/urls', mountPath),
+      acme: this.pathHelp.hydrateModel('pki/config/acme', mountPath),
+      certGenerate: this.pathHelp.hydrateModel('pki/certificate/generate', mountPath),
+      certSign: this.pathHelp.hydrateModel('pki/certificate/sign', mountPath),
+      cluster: this.pathHelp.hydrateModel('pki/config/cluster', mountPath),
+      key: this.pathHelp.hydrateModel('pki/key', mountPath),
+      role: this.pathHelp.hydrateModel('pki/role', mountPath),
+      signCsr: this.pathHelp.hydrateModel('pki/sign-intermediate', mountPath),
+      tidy: this.pathHelp.hydrateModel('pki/tidy', mountPath),
+      urls: this.pathHelp.hydrateModel('pki/config/urls', mountPath),
     });
   }
 }
diff --git a/ui/lib/pki/addon/routes/certificates/certificate/details.js b/ui/lib/pki/addon/routes/certificates/certificate/details.js
index 66fdd5a3add..cdd1d243e13 100644
--- a/ui/lib/pki/addon/routes/certificates/certificate/details.js
+++ b/ui/lib/pki/addon/routes/certificates/certificate/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,9 +17,9 @@ export default class PkiCertificateDetailsRoute extends Route {
   setupController(controller, model) {
     super.setupController(controller, model);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'certificates', route: 'certificates.index' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Certificates', route: 'certificates.index', model: this.secretMountPath.currentPath },
       { label: model.id },
     ];
   }
diff --git a/ui/lib/pki/addon/routes/certificates/index.js b/ui/lib/pki/addon/routes/certificates/index.js
index 0d21c887e4e..8605f257cd0 100644
--- a/ui/lib/pki/addon/routes/certificates/index.js
+++ b/ui/lib/pki/addon/routes/certificates/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,8 +11,9 @@ import { getCliMessage } from 'pki/routes/overview';
 
 @withConfig()
 export default class PkiCertificatesIndexRoute extends Route {
-  @service store;
+  @service pagination;
   @service secretMountPath;
+  @service store; // used by @withConfig decorator
 
   queryParams = {
     page: {
@@ -23,7 +24,7 @@ export default class PkiCertificatesIndexRoute extends Route {
   async fetchCertificates(params) {
     try {
       const page = Number(params.page) || 1;
-      return await this.store.lazyPaginatedQuery('pki/certificate/base', {
+      return await this.pagination.lazyPaginatedQuery('pki/certificate/base', {
         backend: this.secretMountPath.currentPath,
         responsePath: 'data.keys',
         page,
diff --git a/ui/lib/pki/addon/routes/configuration.js b/ui/lib/pki/addon/routes/configuration.js
index 79556c85c21..aaccfcd589e 100644
--- a/ui/lib/pki/addon/routes/configuration.js
+++ b/ui/lib/pki/addon/routes/configuration.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/routes/configuration/create.js b/ui/lib/pki/addon/routes/configuration/create.js
index 8152aef8e80..b61e16801ec 100644
--- a/ui/lib/pki/addon/routes/configuration/create.js
+++ b/ui/lib/pki/addon/routes/configuration/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,9 +23,9 @@ export default class PkiConfigurationCreateRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'configure' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Configure' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/configuration/edit.js b/ui/lib/pki/addon/routes/configuration/edit.js
index a9cf3919a8b..cfafdcefc70 100644
--- a/ui/lib/pki/addon/routes/configuration/edit.js
+++ b/ui/lib/pki/addon/routes/configuration/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -25,10 +25,10 @@ export default class PkiConfigurationEditRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'configuration', route: 'configuration.index' },
-      { label: 'edit' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Configuration', route: 'configuration.index', model: this.secretMountPath.currentPath },
+      { label: 'Edit' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/configuration/index.js b/ui/lib/pki/addon/routes/configuration/index.js
index 7d01102c28c..28933f10f8d 100644
--- a/ui/lib/pki/addon/routes/configuration/index.js
+++ b/ui/lib/pki/addon/routes/configuration/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/routes/error.js b/ui/lib/pki/addon/routes/error.js
index 0b2e05074ee..9c5d9f9181a 100644
--- a/ui/lib/pki/addon/routes/error.js
+++ b/ui/lib/pki/addon/routes/error.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,17 +12,17 @@ export default class PkiRolesErrorRoute extends Route {
   setupController(controller) {
     super.setupController(...arguments);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: this.secretMountPath.currentPath, route: 'overview' },
     ];
     controller.tabs = [
-      { label: 'Overview', route: 'overview' },
-      { label: 'Roles', route: 'roles.index' },
-      { label: 'Issuers', route: 'issuers.index' },
-      { label: 'Keys', route: 'keys.index' },
-      { label: 'Certificates', route: 'certificates.index' },
-      { label: 'Tidy', route: 'tidy.index' },
-      { label: 'Configuration', route: 'configuration.index' },
+      { label: 'Overview', route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Roles', route: 'roles.index', model: this.secretMountPath.currentPath },
+      { label: 'Issuers', route: 'issuers.index', model: this.secretMountPath.currentPath },
+      { label: 'Keys', route: 'keys.index', model: this.secretMountPath.currentPath },
+      { label: 'Certificates', route: 'certificates.index', model: this.secretMountPath.currentPath },
+      { label: 'Tidy', route: 'tidy.index', model: this.secretMountPath.currentPath },
+      { label: 'Configuration', route: 'configuration.index', model: this.secretMountPath.currentPath },
     ];
     controller.title = this.secretMountPath.currentPath;
   }
diff --git a/ui/lib/pki/addon/routes/index.js b/ui/lib/pki/addon/routes/index.js
index 38c03207a00..81d29ddfd44 100644
--- a/ui/lib/pki/addon/routes/index.js
+++ b/ui/lib/pki/addon/routes/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,7 @@ import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
 export default class PkiRoute extends Route {
-  @service router;
+  @service('app-router') router;
 
   redirect() {
     this.router.transitionTo('vault.cluster.secrets.backend.pki.overview');
diff --git a/ui/lib/pki/addon/routes/issuers/generate-intermediate.js b/ui/lib/pki/addon/routes/issuers/generate-intermediate.js
index ae6d6a40d95..db189763188 100644
--- a/ui/lib/pki/addon/routes/issuers/generate-intermediate.js
+++ b/ui/lib/pki/addon/routes/issuers/generate-intermediate.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,10 +19,10 @@ export default class PkiIssuersGenerateIntermediateRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'issuers', route: 'issuers.index' },
-      { label: 'generate CSR' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Issuers', route: 'issuers.index', model: this.secretMountPath.currentPath },
+      { label: 'Generate CSR' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/issuers/generate-root.js b/ui/lib/pki/addon/routes/issuers/generate-root.js
index 5f03d8b2b74..b07c8ade55a 100644
--- a/ui/lib/pki/addon/routes/issuers/generate-root.js
+++ b/ui/lib/pki/addon/routes/issuers/generate-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,9 +19,9 @@ export default class PkiIssuersGenerateRootRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'generate root' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Generate Root' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/issuers/import.js b/ui/lib/pki/addon/routes/issuers/import.js
index a3585077569..5b21ebd58f2 100644
--- a/ui/lib/pki/addon/routes/issuers/import.js
+++ b/ui/lib/pki/addon/routes/issuers/import.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,10 +19,10 @@ export default class PkiIssuersImportRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'issuers', route: 'issuers.index' },
-      { label: 'import' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Issuers', route: 'issuers.index', model: this.secretMountPath.currentPath },
+      { label: 'Import' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/issuers/index.js b/ui/lib/pki/addon/routes/issuers/index.js
index 597634777e6..c292c9e5a86 100644
--- a/ui/lib/pki/addon/routes/issuers/index.js
+++ b/ui/lib/pki/addon/routes/issuers/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,12 +7,12 @@ import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
 export default class PkiIssuersListRoute extends Route {
-  @service store;
+  @service pagination;
   @service secretMountPath;
 
   model(params) {
     const page = Number(params.page) || 1;
-    return this.store
+    return this.pagination
       .lazyPaginatedQuery('pki/issuer', {
         backend: this.secretMountPath.currentPath,
         responsePath: 'data.keys',
@@ -35,9 +35,9 @@ export default class PkiIssuersListRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'issuers', route: 'issuers.index' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Issuers', route: 'issuers.index', model: this.secretMountPath.currentPath },
     ];
   }
 
diff --git a/ui/lib/pki/addon/routes/issuers/issuer.js b/ui/lib/pki/addon/routes/issuers/issuer.js
index bbf01a5941a..a43f886c4cf 100644
--- a/ui/lib/pki/addon/routes/issuers/issuer.js
+++ b/ui/lib/pki/addon/routes/issuers/issuer.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -21,9 +21,9 @@ export default class PkiIssuerIndexRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'issuers', route: 'issuers.index' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Issuers', route: 'issuers.index', model: this.secretMountPath.currentPath },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/issuers/issuer/cross-sign.js b/ui/lib/pki/addon/routes/issuers/issuer/cross-sign.js
index d8a57441ecc..abdf25dd973 100644
--- a/ui/lib/pki/addon/routes/issuers/issuer/cross-sign.js
+++ b/ui/lib/pki/addon/routes/issuers/issuer/cross-sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -20,11 +20,15 @@ export default class PkiIssuerCrossSignRoute extends Route {
     super.setupController(controller, resolvedModel);
 
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'issuers', route: 'issuers.index' },
-      { label: resolvedModel.id, route: 'issuers.issuer.details' },
-      { label: 'cross-sign' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Issuers', route: 'issuers.index', model: this.secretMountPath.currentPath },
+      {
+        label: resolvedModel.id,
+        route: 'issuers.issuer.details',
+        models: [this.secretMountPath.currentPath, resolvedModel.id],
+      },
+      { label: 'Cross-sign' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/issuers/issuer/details.js b/ui/lib/pki/addon/routes/issuers/issuer/details.js
index 34cdc8b6e44..ae198cfb726 100644
--- a/ui/lib/pki/addon/routes/issuers/issuer/details.js
+++ b/ui/lib/pki/addon/routes/issuers/issuer/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,15 +19,16 @@ export default class PkiIssuerDetailsRoute extends Route {
       pem: this.fetchCertByFormat(issuer.id, 'pem'),
       der: this.fetchCertByFormat(issuer.id, 'der'),
       isRotatable: this.isRoot(issuer),
+      backend: this.secretMountPath.currentPath,
     });
   }
 
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'issuers', route: 'issuers.index' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: resolvedModel.backend },
+      { label: 'Issuers', route: 'issuers.index', model: resolvedModel.backend },
       { label: resolvedModel.issuer.id },
     ];
   }
diff --git a/ui/lib/pki/addon/routes/issuers/issuer/edit.js b/ui/lib/pki/addon/routes/issuers/issuer/edit.js
index f0e3f6aecc1..500608cc6ae 100644
--- a/ui/lib/pki/addon/routes/issuers/issuer/edit.js
+++ b/ui/lib/pki/addon/routes/issuers/issuer/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,11 +23,15 @@ export default class PkiIssuerEditRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'issuers', route: 'issuers.index' },
-      { label: resolvedModel.id, route: 'issuers.issuer.details' },
-      { label: 'update' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Issuers', route: 'issuers.index', model: this.secretMountPath.currentPath },
+      {
+        label: resolvedModel.id,
+        route: 'issuers.issuer.details',
+        models: [this.secretMountPath.currentPath, resolvedModel.id],
+      },
+      { label: 'Update' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/issuers/issuer/rotate-root.js b/ui/lib/pki/addon/routes/issuers/issuer/rotate-root.js
index 5a0405b5adc..133045c5269 100644
--- a/ui/lib/pki/addon/routes/issuers/issuer/rotate-root.js
+++ b/ui/lib/pki/addon/routes/issuers/issuer/rotate-root.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -32,17 +32,22 @@ export default class PkiIssuerRotateRootRoute extends Route {
       oldRoot,
       newRootModel,
       parsingErrors,
+      backend: this.secretMountPath.currentPath,
     });
   }
 
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'issuers', route: 'issuers.index' },
-      { label: resolvedModel.oldRoot.id, route: 'issuers.issuer.details' },
-      { label: 'rotate root' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: resolvedModel.oldRoot.backend },
+      { label: 'Issuers', route: 'issuers.index', model: resolvedModel.oldRoot.backend },
+      {
+        label: resolvedModel.oldRoot.id,
+        route: 'issuers.issuer.details',
+        models: [resolvedModel.oldRoot.backend, resolvedModel.oldRoot.id],
+      },
+      { label: 'Rotate Root' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/issuers/issuer/sign.js b/ui/lib/pki/addon/routes/issuers/issuer/sign.js
index cf3f58608c4..3d53bcb9c7f 100644
--- a/ui/lib/pki/addon/routes/issuers/issuer/sign.js
+++ b/ui/lib/pki/addon/routes/issuers/issuer/sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,11 +19,15 @@ export default class PkiIssuerSignRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'issuers', route: 'issuers.index' },
-      { label: resolvedModel.issuerRef, route: 'issuers.issuer.details' },
-      { label: 'sign intermediate' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Issuers', route: 'issuers.index', model: this.secretMountPath.currentPath },
+      {
+        label: resolvedModel.issuerRef,
+        route: 'issuers.issuer.details',
+        models: [this.secretMountPath.currentPath, resolvedModel.issuerRef],
+      },
+      { label: 'Sign Intermediate' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/keys/create.js b/ui/lib/pki/addon/routes/keys/create.js
index 1b130a3a01f..c8cded5c168 100644
--- a/ui/lib/pki/addon/routes/keys/create.js
+++ b/ui/lib/pki/addon/routes/keys/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,10 +19,10 @@ export default class PkiKeysCreateRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'keys', route: 'keys.index' },
-      { label: 'generate' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Keys', route: 'keys.index', model: this.secretMountPath.currentPath },
+      { label: 'Generate' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/keys/import.js b/ui/lib/pki/addon/routes/keys/import.js
index 59988349663..3641d3fa648 100644
--- a/ui/lib/pki/addon/routes/keys/import.js
+++ b/ui/lib/pki/addon/routes/keys/import.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,10 +19,10 @@ export default class PkiKeysImportRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'keys', route: 'keys.index' },
-      { label: 'import' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Keys', route: 'keys.index', model: this.secretMountPath.currentPath },
+      { label: 'Import' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/keys/index.js b/ui/lib/pki/addon/routes/keys/index.js
index 58eb72d9402..b05473878a7 100644
--- a/ui/lib/pki/addon/routes/keys/index.js
+++ b/ui/lib/pki/addon/routes/keys/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,8 +11,9 @@ import { PKI_DEFAULT_EMPTY_STATE_MSG } from 'pki/routes/overview';
 
 @withConfig()
 export default class PkiKeysIndexRoute extends Route {
+  @service pagination;
   @service secretMountPath;
-  @service store;
+  @service store; // used by @withConfig decorator
 
   queryParams = {
     page: {
@@ -25,7 +26,7 @@ export default class PkiKeysIndexRoute extends Route {
     return hash({
       hasConfig: this.pkiMountHasConfig,
       parentModel: this.modelFor('keys'),
-      keyModels: this.store
+      keyModels: this.pagination
         .lazyPaginatedQuery('pki/key', {
           backend: this.secretMountPath.currentPath,
           responsePath: 'data.keys',
@@ -45,9 +46,9 @@ export default class PkiKeysIndexRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'keys', route: 'keys.index' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: resolvedModel.parentModel.id },
+      { label: 'Keys', route: 'keys.index', model: resolvedModel.parentModel.id },
     ];
     controller.notConfiguredMessage = PKI_DEFAULT_EMPTY_STATE_MSG;
   }
diff --git a/ui/lib/pki/addon/routes/keys/key.js b/ui/lib/pki/addon/routes/keys/key.js
index 0db61082d4f..a7e1885fe4d 100644
--- a/ui/lib/pki/addon/routes/keys/key.js
+++ b/ui/lib/pki/addon/routes/keys/key.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/routes/keys/key/details.js b/ui/lib/pki/addon/routes/keys/key/details.js
index 091de36a26a..edbe32dc677 100644
--- a/ui/lib/pki/addon/routes/keys/key/details.js
+++ b/ui/lib/pki/addon/routes/keys/key/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,9 +15,9 @@ export default class PkiKeyDetailsRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'keys', route: 'keys.index' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: resolvedModel.backend },
+      { label: 'Keys', route: 'keys.index', model: resolvedModel.backend },
       { label: resolvedModel.id },
     ];
   }
diff --git a/ui/lib/pki/addon/routes/keys/key/edit.js b/ui/lib/pki/addon/routes/keys/key/edit.js
index 160f8a9eaa1..ccdcaf3991e 100644
--- a/ui/lib/pki/addon/routes/keys/key/edit.js
+++ b/ui/lib/pki/addon/routes/keys/key/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -18,9 +18,9 @@ export default class PkiKeyEditRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'keys', route: 'keys.index' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Keys', route: 'keys.index', model: this.secretMountPath.currentPath },
       { label: resolvedModel.id },
     ];
   }
diff --git a/ui/lib/pki/addon/routes/overview.js b/ui/lib/pki/addon/routes/overview.js
index 902dd7cf4ba..9c58fcc0d25 100644
--- a/ui/lib/pki/addon/routes/overview.js
+++ b/ui/lib/pki/addon/routes/overview.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/routes/roles/create.js b/ui/lib/pki/addon/routes/roles/create.js
index 5f88b772d40..3964c852377 100644
--- a/ui/lib/pki/addon/routes/roles/create.js
+++ b/ui/lib/pki/addon/routes/roles/create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -30,10 +30,16 @@ export default class PkiRolesCreateRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'roles', route: 'roles.index' },
-      { label: 'create' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Roles', route: 'roles.index', model: this.secretMountPath.currentPath },
+      { label: 'Create' },
     ];
   }
+
+  willTransition() {
+    // after upgrading to Ember Data 5.3.2 we saw duplicate records in the store after creating and saving a new role
+    // it's unclear why this ghost record is persisting, manually unloading refreshes the store
+    this.store.unloadAll('pki/role');
+  }
 }
diff --git a/ui/lib/pki/addon/routes/roles/index.js b/ui/lib/pki/addon/routes/roles/index.js
index 3dae1186f85..ebf2bd9109c 100644
--- a/ui/lib/pki/addon/routes/roles/index.js
+++ b/ui/lib/pki/addon/routes/roles/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,8 +10,9 @@ import { hash } from 'rsvp';
 import { getCliMessage } from 'pki/routes/overview';
 @withConfig()
 export default class PkiRolesIndexRoute extends Route {
-  @service store;
+  @service store; // used by @withConfig decorator
   @service secretMountPath;
+  @service pagination;
 
   queryParams = {
     page: {
@@ -22,7 +23,7 @@ export default class PkiRolesIndexRoute extends Route {
   async fetchRoles(params) {
     try {
       const page = Number(params.page) || 1;
-      return await this.store.lazyPaginatedQuery('pki/role', {
+      return await this.pagination.lazyPaginatedQuery('pki/role', {
         backend: this.secretMountPath.currentPath,
         responsePath: 'data.keys',
         page,
diff --git a/ui/lib/pki/addon/routes/roles/role/details.js b/ui/lib/pki/addon/routes/roles/role/details.js
index 84a589c5426..08b66fb2e0a 100644
--- a/ui/lib/pki/addon/routes/roles/role/details.js
+++ b/ui/lib/pki/addon/routes/roles/role/details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -22,9 +22,9 @@ export default class RolesRoleDetailsRoute extends Route {
     super.setupController(controller, resolvedModel);
     const { id } = resolvedModel;
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'roles', route: 'roles.index' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Roles', route: 'roles.index', model: this.secretMountPath.currentPath },
       { label: id },
     ];
   }
diff --git a/ui/lib/pki/addon/routes/roles/role/edit.js b/ui/lib/pki/addon/routes/roles/role/edit.js
index 8ac1236a7a9..ea005f5d0ae 100644
--- a/ui/lib/pki/addon/routes/roles/role/edit.js
+++ b/ui/lib/pki/addon/routes/roles/role/edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -38,11 +38,11 @@ export default class PkiRoleEditRoute extends Route {
       role: { id },
     } = resolvedModel;
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'roles', route: 'roles.index' },
-      { label: id, route: 'roles.role.details' },
-      { label: 'edit' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Roles', route: 'roles.index', model: this.secretMountPath.currentPath },
+      { label: id, route: 'roles.role.details', models: [this.secretMountPath.currentPath, id] },
+      { label: 'Edit' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/roles/role/generate.js b/ui/lib/pki/addon/routes/roles/role/generate.js
index fe30ee85888..cb0dbc93442 100644
--- a/ui/lib/pki/addon/routes/roles/role/generate.js
+++ b/ui/lib/pki/addon/routes/roles/role/generate.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,11 +23,11 @@ export default class PkiRoleGenerateRoute extends Route {
     super.setupController(controller, resolvedModel);
     const { role } = this.paramsFor('roles/role');
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'roles', route: 'roles.index' },
-      { label: role, route: 'roles.role.details' },
-      { label: 'generate certificate' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Roles', route: 'roles.index', model: this.secretMountPath.currentPath },
+      { label: role, route: 'roles.role.details', models: [this.secretMountPath.currentPath, role] },
+      { label: 'Generate Certificate' },
     ];
     // This is updated on successful generate in the controller
     controller.hasSubmitted = false;
diff --git a/ui/lib/pki/addon/routes/roles/role/sign.js b/ui/lib/pki/addon/routes/roles/role/sign.js
index c3cc931d215..30266ae258d 100644
--- a/ui/lib/pki/addon/routes/roles/role/sign.js
+++ b/ui/lib/pki/addon/routes/roles/role/sign.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,11 +23,11 @@ export default class PkiRoleSignRoute extends Route {
     super.setupController(controller, resolvedModel);
     const { role } = this.paramsFor('roles/role');
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'roles', route: 'roles.index' },
-      { label: role, route: 'roles.role.details' },
-      { label: 'sign certificate' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: this.secretMountPath.currentPath },
+      { label: 'Roles', route: 'roles.index', model: this.secretMountPath.currentPath },
+      { label: role, route: 'roles.role.details', models: [this.secretMountPath.currentPath, role] },
+      { label: 'Sign Certificate' },
     ];
     // This is updated on successful generate in the controller
     controller.hasSubmitted = false;
diff --git a/ui/lib/pki/addon/routes/tidy.js b/ui/lib/pki/addon/routes/tidy.js
index 2053fb81a92..55a9bf80522 100644
--- a/ui/lib/pki/addon/routes/tidy.js
+++ b/ui/lib/pki/addon/routes/tidy.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/routes/tidy/auto.js b/ui/lib/pki/addon/routes/tidy/auto.js
index 127da4355cd..10d39609b3b 100644
--- a/ui/lib/pki/addon/routes/tidy/auto.js
+++ b/ui/lib/pki/addon/routes/tidy/auto.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/routes/tidy/auto/configure.js b/ui/lib/pki/addon/routes/tidy/auto/configure.js
index 2391b4531e8..cb3b955ed9c 100644
--- a/ui/lib/pki/addon/routes/tidy/auto/configure.js
+++ b/ui/lib/pki/addon/routes/tidy/auto/configure.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,14 +15,16 @@ export default class PkiTidyAutoConfigureRoute extends Route {
   // inherits model from tidy/auto
 
   setupController(controller, resolvedModel) {
+    // autoTidyConfig id is the backend path
+    const { id: backend } = resolvedModel;
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'configuration', route: 'configuration.index' },
-      { label: 'tidy', route: 'tidy' },
-      { label: 'auto', route: 'tidy.auto' },
-      { label: 'configure' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: backend },
+      { label: 'Configuration', route: 'configuration.index', model: backend },
+      { label: 'Tidy', route: 'tidy', model: backend },
+      { label: 'Auto', route: 'tidy.auto', model: backend },
+      { label: 'Configure' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/routes/tidy/auto/index.js b/ui/lib/pki/addon/routes/tidy/auto/index.js
index a9d93b790cf..94d1e12097d 100644
--- a/ui/lib/pki/addon/routes/tidy/auto/index.js
+++ b/ui/lib/pki/addon/routes/tidy/auto/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,13 +12,15 @@ export default class TidyAutoIndexRoute extends Route {
 
   // inherits model from tidy/auto
 
-  setupController(controller) {
+  setupController(controller, resolvedModel) {
+    // autoTidyConfig id is the backend path
+    const { id: backend } = resolvedModel;
     super.setupController(...arguments);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'tidy', route: 'tidy.index' },
-      { label: 'auto' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: backend },
+      { label: 'Tidy', route: 'tidy.index', model: backend },
+      { label: 'Auto' },
     ];
     controller.title = this.secretMountPath.currentPath;
   }
diff --git a/ui/lib/pki/addon/routes/tidy/index.js b/ui/lib/pki/addon/routes/tidy/index.js
index e84e55cb279..980ee0a2e42 100644
--- a/ui/lib/pki/addon/routes/tidy/index.js
+++ b/ui/lib/pki/addon/routes/tidy/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/addon/routes/tidy/manual.js b/ui/lib/pki/addon/routes/tidy/manual.js
index d902769a8e6..1ef4943678a 100644
--- a/ui/lib/pki/addon/routes/tidy/manual.js
+++ b/ui/lib/pki/addon/routes/tidy/manual.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,11 +19,11 @@ export default class PkiTidyManualRoute extends Route {
   setupController(controller, resolvedModel) {
     super.setupController(controller, resolvedModel);
     controller.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.secretMountPath.currentPath, route: 'overview' },
-      { label: 'configuration', route: 'configuration.index' },
-      { label: 'tidy', route: 'tidy' },
-      { label: 'manual' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.secretMountPath.currentPath, route: 'overview', model: resolvedModel.backend },
+      { label: 'Configuration', route: 'configuration.index', model: resolvedModel.backend },
+      { label: 'Tidy', route: 'tidy', model: resolvedModel.backend },
+      { label: 'Manual' },
     ];
   }
 }
diff --git a/ui/lib/pki/addon/templates/application.hbs b/ui/lib/pki/addon/templates/application.hbs
index 11a06fba008..f6eb0207f6a 100644
--- a/ui/lib/pki/addon/templates/application.hbs
+++ b/ui/lib/pki/addon/templates/application.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{outlet}}
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/certificates/certificate/details.hbs b/ui/lib/pki/addon/templates/certificates/certificate/details.hbs
index 42dd77565e9..22a7e464500 100644
--- a/ui/lib/pki/addon/templates/certificates/certificate/details.hbs
+++ b/ui/lib/pki/addon/templates/certificates/certificate/details.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/pki/addon/templates/certificates/index.hbs b/ui/lib/pki/addon/templates/certificates/index.hbs
index 96e2d394af3..2e80cbd95ca 100644
--- a/ui/lib/pki/addon/templates/certificates/index.hbs
+++ b/ui/lib/pki/addon/templates/certificates/index.hbs
@@ -1,16 +1,21 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PkiPageHeader @backend={{this.model.parentModel}} />
 
-<PkiPaginatedList @listRoute="certificates.index" @list={{this.model.certificates}} @hasConfig={{this.model.hasConfig}}>
+<PkiPaginatedList
+  @backend={{this.model.parentModel.id}}
+  @listRoute="certificates.index"
+  @list={{this.model.certificates}}
+  @hasConfig={{this.model.hasConfig}}
+>
   <:list as |certs|>
     {{#each certs as |pkiCertificate|}}
       <LinkedBlock
         class="list-item-row"
-        @params={{array "certificates.certificate.details" pkiCertificate.id}}
+        @params={{array "certificates.certificate.details" this.model.parentModel.id pkiCertificate.id}}
         @linkPrefix={{this.mountPoint}}
       >
         <div class="level is-mobile">
@@ -33,7 +38,10 @@
                   @hasChevron={{false}}
                   data-test-popup-menu-trigger
                 />
-                <dd.Interactive @text="Details" @route="certificates.certificate.details" @model={{pkiCertificate.id}} />
+                <dd.Interactive
+                  @route="certificates.certificate.details"
+                  @model={{pkiCertificate.id}}
+                >Details</dd.Interactive>
               </Hds::Dropdown>
             </div>
           </div>
@@ -54,6 +62,7 @@
         @iconPosition="trailing"
         @text="Configure PKI"
         @route="configuration.create"
+        @model={{this.model.parentModel.id}}
       />
     </EmptyState>
   </:configure>
diff --git a/ui/lib/pki/addon/templates/configuration.hbs b/ui/lib/pki/addon/templates/configuration.hbs
index 11a06fba008..f6eb0207f6a 100644
--- a/ui/lib/pki/addon/templates/configuration.hbs
+++ b/ui/lib/pki/addon/templates/configuration.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{outlet}}
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/configuration/create.hbs b/ui/lib/pki/addon/templates/configuration/create.hbs
index a2921367f0f..121e5f0661d 100644
--- a/ui/lib/pki/addon/templates/configuration/create.hbs
+++ b/ui/lib/pki/addon/templates/configuration/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::PkiConfigureCreate
   @breadcrumbs={{this.breadcrumbs}}
diff --git a/ui/lib/pki/addon/templates/configuration/edit.hbs b/ui/lib/pki/addon/templates/configuration/edit.hbs
index 7d3ff9c8945..02ef1785223 100644
--- a/ui/lib/pki/addon/templates/configuration/edit.hbs
+++ b/ui/lib/pki/addon/templates/configuration/edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/pki/addon/templates/configuration/index.hbs b/ui/lib/pki/addon/templates/configuration/index.hbs
index d7200b3271e..e42ea06d92f 100644
--- a/ui/lib/pki/addon/templates/configuration/index.hbs
+++ b/ui/lib/pki/addon/templates/configuration/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PkiPageHeader @backend={{this.model.engine}} />
 
@@ -18,7 +18,7 @@
 {{else}}
   <Toolbar>
     <ToolbarActions>
-      <ToolbarLink @route="configuration.create" data-test-configure-pki-button>
+      <ToolbarLink @route="configuration.create" @model={{this.model.engine.id}} data-test-configure-pki-button>
         Configure
       </ToolbarLink>
     </ToolbarActions>
@@ -29,12 +29,13 @@
       @iconPosition="trailing"
       @text="Configure PKI"
       @route="configuration.create"
+      @model={{this.model.engine.id}}
     />
   </EmptyState>
 {{/if}}
 
 <SecretsEngineMountConfig
-  @model={{this.model.mountConfig}}
+  @secretsEngine={{this.model.mountConfig}}
   class="has-top-margin-m has-bottom-margin-xl"
   data-test-mount-config
 />
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/error.hbs b/ui/lib/pki/addon/templates/error.hbs
index c9408bd0dca..f9c42f0968b 100644
--- a/ui/lib/pki/addon/templates/error.hbs
+++ b/ui/lib/pki/addon/templates/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/pki/addon/templates/issuers/generate-intermediate.hbs b/ui/lib/pki/addon/templates/issuers/generate-intermediate.hbs
index 39ca1724257..a81ea97ea94 100644
--- a/ui/lib/pki/addon/templates/issuers/generate-intermediate.hbs
+++ b/ui/lib/pki/addon/templates/issuers/generate-intermediate.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::PkiIssuerGenerateIntermediate @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/issuers/generate-root.hbs b/ui/lib/pki/addon/templates/issuers/generate-root.hbs
index ce296175b81..ebd40b52ac3 100644
--- a/ui/lib/pki/addon/templates/issuers/generate-root.hbs
+++ b/ui/lib/pki/addon/templates/issuers/generate-root.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::PkiIssuerGenerateRoot @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/issuers/import.hbs b/ui/lib/pki/addon/templates/issuers/import.hbs
index f40a2cd06f3..88f2d74c0a4 100644
--- a/ui/lib/pki/addon/templates/issuers/import.hbs
+++ b/ui/lib/pki/addon/templates/issuers/import.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::PkiIssuerImport @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/issuers/index.hbs b/ui/lib/pki/addon/templates/issuers/index.hbs
index 4a4ce9dda03..6088344082b 100644
--- a/ui/lib/pki/addon/templates/issuers/index.hbs
+++ b/ui/lib/pki/addon/templates/issuers/index.hbs
@@ -1,8 +1,12 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PkiPageHeader @backend={{this.model.parentModel}} />
 
-<Page::PkiIssuerList @issuers={{this.model.issuersModel}} @mountPoint={{this.mountPoint}} />
\ No newline at end of file
+<Page::PkiIssuerList
+  @backend={{this.model.parentModel.id}}
+  @issuers={{this.model.issuersModel}}
+  @mountPoint={{this.mountPoint}}
+/>
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/issuers/issuer/cross-sign.hbs b/ui/lib/pki/addon/templates/issuers/issuer/cross-sign.hbs
index 3992ab61bb2..44caaf0a24c 100644
--- a/ui/lib/pki/addon/templates/issuers/issuer/cross-sign.hbs
+++ b/ui/lib/pki/addon/templates/issuers/issuer/cross-sign.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-issuer-page-title>
+    <h1 class="title is-3" data-test-page-title>
       Cross-Sign Issuers
     </h1>
   </p.levelLeft>
diff --git a/ui/lib/pki/addon/templates/issuers/issuer/details.hbs b/ui/lib/pki/addon/templates/issuers/issuer/details.hbs
index b0f836d3c9e..03170249cda 100644
--- a/ui/lib/pki/addon/templates/issuers/issuer/details.hbs
+++ b/ui/lib/pki/addon/templates/issuers/issuer/details.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-issuer-page-title>
+    <h1 class="title is-3" data-test-page-title>
       <Icon @name="file-text" @size="24" class="has-text-grey-light" />
       View Issuer Certificate
     </h1>
@@ -24,4 +24,5 @@
   @canCrossSign={{this.model.issuer.canCrossSign}}
   @canSignIntermediate={{this.model.issuer.canSignIntermediate}}
   @canConfigure={{this.model.issuer.canConfigure}}
+  @backend={{this.model.backend}}
 />
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/issuers/issuer/edit.hbs b/ui/lib/pki/addon/templates/issuers/issuer/edit.hbs
index c8b7f849225..bec7d4f4fa2 100644
--- a/ui/lib/pki/addon/templates/issuers/issuer/edit.hbs
+++ b/ui/lib/pki/addon/templates/issuers/issuer/edit.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-issuer-page-title>
+    <h1 class="title is-3" data-test-page-title>
       Update Issuer
     </h1>
   </p.levelLeft>
diff --git a/ui/lib/pki/addon/templates/issuers/issuer/rotate-root.hbs b/ui/lib/pki/addon/templates/issuers/issuer/rotate-root.hbs
index 3625fa484f5..ecd0a767850 100644
--- a/ui/lib/pki/addon/templates/issuers/issuer/rotate-root.hbs
+++ b/ui/lib/pki/addon/templates/issuers/issuer/rotate-root.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::PkiIssuerRotateRoot
   @oldRoot={{this.model.oldRoot}}
diff --git a/ui/lib/pki/addon/templates/issuers/issuer/sign.hbs b/ui/lib/pki/addon/templates/issuers/issuer/sign.hbs
index 013a281a512..2b00ce02d83 100644
--- a/ui/lib/pki/addon/templates/issuers/issuer/sign.hbs
+++ b/ui/lib/pki/addon/templates/issuers/issuer/sign.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-issuer-page-title>
+    <h1 class="title is-3" data-test-page-title>
       <Icon @name="file-text" @size="24" class="has-text-grey-light" />
       Sign Intermediate
     </h1>
diff --git a/ui/lib/pki/addon/templates/keys/create.hbs b/ui/lib/pki/addon/templates/keys/create.hbs
index 261702f9946..b21e5792fbc 100644
--- a/ui/lib/pki/addon/templates/keys/create.hbs
+++ b/ui/lib/pki/addon/templates/keys/create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/pki/addon/templates/keys/import.hbs b/ui/lib/pki/addon/templates/keys/import.hbs
index 3137618eda1..6bf7f9694ff 100644
--- a/ui/lib/pki/addon/templates/keys/import.hbs
+++ b/ui/lib/pki/addon/templates/keys/import.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
diff --git a/ui/lib/pki/addon/templates/keys/index.hbs b/ui/lib/pki/addon/templates/keys/index.hbs
index dd077ae68d3..5a229c7131f 100644
--- a/ui/lib/pki/addon/templates/keys/index.hbs
+++ b/ui/lib/pki/addon/templates/keys/index.hbs
@@ -1,13 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PkiPageHeader @backend={{this.model.parentModel}} />
 
 <Page::PkiKeyList
   @keyModels={{this.model.keyModels}}
   @mountPoint={{this.mountPoint}}
+  @backend={{this.model.parentModel.id}}
   @canImportKey={{(get (get this.model.keyModels 0) "canImportKey")}}
   @canGenerateKey={{(get (get this.model.keyModels 0) "canGenerateKey")}}
   @canRead={{(get (get this.model.keyModels 0) "canRead")}}
diff --git a/ui/lib/pki/addon/templates/keys/key/details.hbs b/ui/lib/pki/addon/templates/keys/key/details.hbs
index 3c46a40f2c3..3e3e8fbf82d 100644
--- a/ui/lib/pki/addon/templates/keys/key/details.hbs
+++ b/ui/lib/pki/addon/templates/keys/key/details.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-key-details-title>
+    <h1 class="title is-3" data-test-page-title>
       <Icon @name="certificate" @size="24" class="has-text-grey-light" />
       View Key
     </h1>
diff --git a/ui/lib/pki/addon/templates/keys/key/edit.hbs b/ui/lib/pki/addon/templates/keys/key/edit.hbs
index 9e31f382470..efcfb2a78a4 100644
--- a/ui/lib/pki/addon/templates/keys/key/edit.hbs
+++ b/ui/lib/pki/addon/templates/keys/key/edit.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-key-details-title>
+    <h1 class="title is-3" data-test-page-title>
       <Icon @name="certificate" @size="24" class="has-text-grey-light" />
       Edit Key
     </h1>
diff --git a/ui/lib/pki/addon/templates/overview.hbs b/ui/lib/pki/addon/templates/overview.hbs
index 7a898c7514c..1e213e313a8 100644
--- a/ui/lib/pki/addon/templates/overview.hbs
+++ b/ui/lib/pki/addon/templates/overview.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PkiPageHeader @backend={{this.model.engine}} />
 
 <Toolbar>
   <ToolbarActions>
     {{#unless this.model.hasConfig}}
-      <ToolbarLink @route="configuration.create">
+      <ToolbarLink @route="configuration.create" @model={{this.model.engine.id}}>
         Configure PKI
       </ToolbarLink>
     {{/unless}}
@@ -24,6 +24,7 @@
       @iconPosition="trailing"
       @text="Configure PKI"
       @route="configuration.create"
+      @model={{this.model.engine.id}}
     />
   </EmptyState>
 {{/if}}
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/roles/create.hbs b/ui/lib/pki/addon/templates/roles/create.hbs
index 93bae553504..41370d2e2c6 100644
--- a/ui/lib/pki/addon/templates/roles/create.hbs
+++ b/ui/lib/pki/addon/templates/roles/create.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-role-page-title>
+    <h1 class="title is-3" data-test-page-title>
       Create a PKI Role
     </h1>
   </p.levelLeft>
diff --git a/ui/lib/pki/addon/templates/roles/index.hbs b/ui/lib/pki/addon/templates/roles/index.hbs
index 956466968c4..d5f85784bec 100644
--- a/ui/lib/pki/addon/templates/roles/index.hbs
+++ b/ui/lib/pki/addon/templates/roles/index.hbs
@@ -1,21 +1,30 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PkiPageHeader @backend={{this.model.parentModel}} />
 
-<PkiPaginatedList @listRoute="roles.index" @list={{this.model.roles}} @hasConfig={{this.model.hasConfig}}>
+<PkiPaginatedList
+  @backend={{this.model.parentModel.id}}
+  @listRoute="roles.index"
+  @list={{this.model.roles}}
+  @hasConfig={{this.model.hasConfig}}
+>
   <:actions>
     {{#if this.model.hasConfig}}
-      <ToolbarLink @type="add" @route="roles.create" data-test-pki-role-create-link>
+      <ToolbarLink @type="add" @route="roles.create" @model={{this.model.parentModel.id}} data-test-pki-role-create-link>
         Create role
       </ToolbarLink>
     {{/if}}
   </:actions>
   <:list as |roles|>
     {{#each roles as |pkiRole|}}
-      <LinkedBlock class="list-item-row" @params={{array "roles.role.details" pkiRole.id}} @linkPrefix={{this.mountPoint}}>
+      <LinkedBlock
+        class="list-item-row"
+        @params={{array "roles.role.details" this.model.parentModel.id pkiRole.id}}
+        @linkPrefix={{this.mountPoint}}
+      >
         <div class="level is-mobile">
           <div class="level-left">
             <div>
@@ -34,8 +43,14 @@
                   @hasChevron={{false}}
                   data-test-popup-menu-trigger
                 />
-                <dd.Interactive @text="Details" @route="roles.role.details" @model={{pkiRole.id}} />
-                <dd.Interactive @text="Edit" @route="roles.role.edit" @model={{pkiRole.id}} />
+                <dd.Interactive
+                  @route="roles.role.details"
+                  @models={{array this.model.parentModel.id pkiRole.id}}
+                >Details</dd.Interactive>
+                <dd.Interactive
+                  @route="roles.role.edit"
+                  @models={{array this.model.parentModel.id pkiRole.id}}
+                >Edit</dd.Interactive>
               </Hds::Dropdown>
             </div>
           </div>
@@ -56,6 +71,7 @@
         @iconPosition="trailing"
         @text="Configure PKI"
         @route="configuration.create"
+        @model={{this.model.parentModel.id}}
       />
     </EmptyState>
   </:configure>
diff --git a/ui/lib/pki/addon/templates/roles/role/details.hbs b/ui/lib/pki/addon/templates/roles/role/details.hbs
index d90c0b0d068..45ca95502df 100644
--- a/ui/lib/pki/addon/templates/roles/role/details.hbs
+++ b/ui/lib/pki/addon/templates/roles/role/details.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-role-page-title>
+    <h1 class="title is-3" data-test-page-title>
       <Icon @name="file-text" @size="24" class="has-text-grey-light" />
       PKI Role
       <code>{{this.model.name}}</code>
diff --git a/ui/lib/pki/addon/templates/roles/role/edit.hbs b/ui/lib/pki/addon/templates/roles/role/edit.hbs
index d9e9a71dbcc..2693a509a3e 100644
--- a/ui/lib/pki/addon/templates/roles/role/edit.hbs
+++ b/ui/lib/pki/addon/templates/roles/role/edit.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-role-page-title>
+    <h1 class="title is-3" data-test-page-title>
       Edit Role
     </h1>
   </p.levelLeft>
diff --git a/ui/lib/pki/addon/templates/roles/role/generate.hbs b/ui/lib/pki/addon/templates/roles/role/generate.hbs
index 737907514a6..da6784da855 100644
--- a/ui/lib/pki/addon/templates/roles/role/generate.hbs
+++ b/ui/lib/pki/addon/templates/roles/role/generate.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-role-page-title>
+    <h1 class="title is-3" data-test-page-title>
       <Icon @name="certificate" @size="24" class="has-text-grey-light" />
       {{if this.hasSubmitted "View Generated Certificate" "Generate Certificate"}}
     </h1>
diff --git a/ui/lib/pki/addon/templates/roles/role/sign.hbs b/ui/lib/pki/addon/templates/roles/role/sign.hbs
index 9faa7b12a45..c4712fe35a2 100644
--- a/ui/lib/pki/addon/templates/roles/role/sign.hbs
+++ b/ui/lib/pki/addon/templates/roles/role/sign.hbs
@@ -1,14 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
   <p.top>
     <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
   </p.top>
   <p.levelLeft>
-    <h1 class="title is-3" data-test-pki-role-page-title>
+    <h1 class="title is-3" data-test-page-title>
       <Icon @name="certificate" @size="24" class="has-text-grey-light" />
       {{if this.hasSubmitted "View Signed Certificate" "Sign Certificate"}}
     </h1>
diff --git a/ui/lib/pki/addon/templates/tidy.hbs b/ui/lib/pki/addon/templates/tidy.hbs
index 11a06fba008..f6eb0207f6a 100644
--- a/ui/lib/pki/addon/templates/tidy.hbs
+++ b/ui/lib/pki/addon/templates/tidy.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{outlet}}
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/tidy/auto.hbs b/ui/lib/pki/addon/templates/tidy/auto.hbs
index 11a06fba008..f6eb0207f6a 100644
--- a/ui/lib/pki/addon/templates/tidy/auto.hbs
+++ b/ui/lib/pki/addon/templates/tidy/auto.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{outlet}}
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/tidy/auto/configure.hbs b/ui/lib/pki/addon/templates/tidy/auto/configure.hbs
index 51e7d503ddd..7c5cfd43d2b 100644
--- a/ui/lib/pki/addon/templates/tidy/auto/configure.hbs
+++ b/ui/lib/pki/addon/templates/tidy/auto/configure.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::PkiTidyAutoConfigure @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/tidy/auto/index.hbs b/ui/lib/pki/addon/templates/tidy/auto/index.hbs
index e39fdbd79af..8006fc49f6f 100644
--- a/ui/lib/pki/addon/templates/tidy/auto/index.hbs
+++ b/ui/lib/pki/addon/templates/tidy/auto/index.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::PkiTidyAutoSettings @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/tidy/index.hbs b/ui/lib/pki/addon/templates/tidy/index.hbs
index e974bc3d81e..706f953186e 100644
--- a/ui/lib/pki/addon/templates/tidy/index.hbs
+++ b/ui/lib/pki/addon/templates/tidy/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PkiPageHeader @backend={{this.model.engine}} />
 
@@ -15,6 +15,7 @@
       @iconPosition="trailing"
       @text="Configure PKI"
       @route="configuration.create"
+      @model={{this.model.engine.id}}
     />
   </EmptyState>
 {{/if}}
\ No newline at end of file
diff --git a/ui/lib/pki/addon/templates/tidy/manual.hbs b/ui/lib/pki/addon/templates/tidy/manual.hbs
index 97618676023..3fe5176cc25 100644
--- a/ui/lib/pki/addon/templates/tidy/manual.hbs
+++ b/ui/lib/pki/addon/templates/tidy/manual.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Page::PkiTidyManual @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
\ No newline at end of file
diff --git a/ui/lib/pki/addon/utils/action-params.js b/ui/lib/pki/addon/utils/action-params.js
index 26fc0c9d9bc..1d56e1fe81d 100644
--- a/ui/lib/pki/addon/utils/action-params.js
+++ b/ui/lib/pki/addon/utils/action-params.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/app/utils/action-params.js b/ui/lib/pki/app/utils/action-params.js
index da24daabc2a..27ccb582a6b 100644
--- a/ui/lib/pki/app/utils/action-params.js
+++ b/ui/lib/pki/app/utils/action-params.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/config/environment.js b/ui/lib/pki/config/environment.js
index 08490187830..228e999fa4e 100644
--- a/ui/lib/pki/config/environment.js
+++ b/ui/lib/pki/config/environment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/pki/index.js b/ui/lib/pki/index.js
index aa73214886f..0566ef41acf 100644
--- a/ui/lib/pki/index.js
+++ b/ui/lib/pki/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,6 +11,9 @@ module.exports = buildEngine({
   lazyLoading: {
     enabled: false,
   },
+  babel: {
+    plugins: [require.resolve('ember-concurrency/async-arrow-task-transform')],
+  },
   isDevelopingAddon() {
     return true;
   },
diff --git a/ui/lib/pki/package.json b/ui/lib/pki/package.json
index 873f81402a8..948f5e21136 100644
--- a/ui/lib/pki/package.json
+++ b/ui/lib/pki/package.json
@@ -5,9 +5,13 @@
     "ember-engine"
   ],
   "dependencies": {
+    "date-fns": "*",
+    "ember-basic-dropdown": "*",
     "ember-cli-babel": "*",
     "ember-cli-htmlbars": "*",
     "ember-cli-typescript": "*",
+    "ember-concurrency": "*",
+    "ember-auto-import": "*",
     "@hashicorp/design-system-components": "*",
     "@types/ember": "latest",
     "@types/ember-data": "latest",
diff --git a/ui/lib/replication/addon/.eslintrc.js b/ui/lib/replication/addon/.eslintrc.js
index 1e947ecb6de..434fdd36d6c 100644
--- a/ui/lib/replication/addon/.eslintrc.js
+++ b/ui/lib/replication/addon/.eslintrc.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/components/enable-replication-form.hbs b/ui/lib/replication/addon/components/enable-replication-form.hbs
new file mode 100644
index 00000000000..d04561838ec
--- /dev/null
+++ b/ui/lib/replication/addon/components/enable-replication-form.hbs
@@ -0,0 +1,178 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<form {{on "submit" (fn this.onSubmit this.data)}} data-test-replication-enable-form>
+  <MessageError @errorMessage={{this.error}} />
+
+  <div class="box is-sideless is-fullwidth is-marginless">
+    <label for="replication-mode" class="is-label">
+      Cluster mode
+    </label>
+    <div class="field is-expanded">
+      <div class="control select is-fullwidth">
+        <select {{on "change" this.inputChange}} id="replication-mode" name="mode" data-test-replication-cluster-mode-select>
+          {{#each (array "primary" "secondary") as |modeOption|}}
+            <option selected={{eq this.data.mode modeOption}} value={{modeOption}}>
+              {{modeOption}}
+            </option>
+          {{/each}}
+        </select>
+      </div>
+      {{#if (eq this.data.mode "secondary")}}
+        <AlertInline
+          class="has-top-margin-xs"
+          @type="warning"
+          @message="This will immediately clear all data in this cluster!"
+        />
+      {{/if}}
+    </div>
+    {{#if (eq this.data.mode "primary")}}
+      {{#if @canEnablePrimary}}
+        <div class="field">
+          <label for="primary_cluster_addr" class="is-label">
+            Primary cluster address
+            <em class="is-optional">(optional)</em>
+          </label>
+          <div class="control">
+            <input
+              class="input"
+              id="primary_cluster_addr"
+              name="primary_cluster_addr"
+              value={{this.data.primary_cluster_addr}}
+              {{on "change" this.inputChange}}
+              data-test-input="primary_cluster_addr"
+            />
+          </div>
+          <p class="help has-text-grey">
+            Overrides the cluster address that the primary gives to secondary nodes.
+          </p>
+        </div>
+      {{else}}
+        <p data-test-not-allowed>
+          The token you are using is not authorized to enable primary replication.
+        </p>
+      {{/if}}
+    {{else}}
+      {{#if @canEnableSecondary}}
+        {{#if (and (eq @replicationMode "dr") this.performanceReplicationEnabled (has-feature "Performance Replication"))}}
+          <div>
+            <ToggleButton
+              @isOpen={{this.showExplanation}}
+              @openLabel="Disable Performance Replication in order to enable this cluster as a DR secondary."
+              @closedLabel="Disable Performance Replication in order to enable this cluster as a DR secondary."
+              @onClick={{fn (mut this.showExplanation)}}
+              class="has-text-danger"
+              data-test-disable-to-continue
+            />
+            {{#if this.showExplanation}}
+              <p data-test-disable-explanation>
+                When running as a DR Secondary Vault is read only. For this reason, we don't allow other Replication modes to
+                operate at the same time. This cluster is also currently operating as a Performance
+                {{capitalize @performanceMode}}.
+              </p>
+            {{/if}}
+          </div>
+        {{else}}
+          <div class="field">
+            <label for="secondary-token" class="is-label">
+              Secondary activation token
+            </label>
+            <div class="control">
+              <Textarea
+                @value={{this.data.token}}
+                id="secondary-token"
+                name="secondary-token"
+                class="textarea"
+                data-test-textarea="secondary-token"
+              />
+            </div>
+          </div>
+          <div class="field">
+            <label for="primary_api_addr" class="is-label">
+              Primary API address
+              {{#if (not (and this.data.token (not this.data.tokenIncludesAPIAddr)))}}
+                <em class="is-optional">(optional)</em>
+              {{/if}}
+            </label>
+            <div class="control">
+              <input
+                id="primary_api_addr"
+                name="primary_api_addr"
+                class="input"
+                value={{this.data.primary_api_addr}}
+                {{on "change" this.inputChange}}
+                data-test-input="primary_api_addr"
+              />
+            </div>
+            <p class="help {{if (and this.data.token (not this.data.tokenIncludesAPIAddr)) 'is-danger' 'has-text-grey'}}">
+              {{#if (and this.data.token (not this.data.tokenIncludesAPIAddr))}}
+                The supplied token does not contain an embedded address for the primary cluster. Please enter the primary
+                cluster's API address (normal Vault address).
+              {{else}}
+                Set this to the API address (normal Vault address) to override the value embedded in the token.
+              {{/if}}
+            </p>
+          </div>
+          <div class="field">
+            <label for="ca_file" class="is-label">
+              CA file
+              <em class="is-optional">(optional)</em>
+            </label>
+            <div class="control">
+              <input
+                id="ca_file"
+                name="ca_file"
+                class="input"
+                value={{this.data.ca_file}}
+                {{on "change" this.inputChange}}
+                data-test-input="ca_file"
+              />
+            </div>
+            <p class="help has-text-grey">
+              Specifies the path to a CA root file (PEM format) that the secondary can use when unwrapping the token from the
+              primary.
+            </p>
+          </div>
+          <div class="field">
+            <label for="ca_path" class="is-label">
+              CA path
+              <em class="is-optional">(optional)</em>
+            </label>
+            <div class="control">
+              <input
+                id="ca_path"
+                name="ca_path"
+                class="input"
+                value={{this.data.ca_path}}
+                {{on "change" this.inputChange}}
+                data-test-input="ca_path"
+              />
+            </div>
+            <p class="help has-text-grey">
+              Specifies the path to a CA root directory containing PEM-format files that the secondary can use when
+              unwrapping the token from the primary.
+            </p>
+          </div>
+          <p>
+            Note: If both
+            <code>CA file</code>
+            and
+            <code>CA path</code>
+            are not given, they default to system CA roots.
+          </p>
+        {{/if}}
+      {{else}}
+        <p data-test-not-allowed>The token you are using is not authorized to enable secondary replication.</p>
+      {{/if}}
+    {{/if}}
+  </div>
+  {{#if
+    (or (and (eq this.data.mode "primary") @canEnablePrimary) (and (eq this.data.mode "secondary") @canEnableSecondary))
+  }}
+    <div class="field is-grouped box is-fullwidth is-bottomless">
+      <Hds::Button @text="Enable Replication" type="submit" disabled={{this.disallowEnable}} data-test-submit />
+    </div>
+  {{/if}}
+</form>
\ No newline at end of file
diff --git a/ui/lib/replication/addon/components/enable-replication-form.js b/ui/lib/replication/addon/components/enable-replication-form.js
new file mode 100644
index 00000000000..d11b3f65ac3
--- /dev/null
+++ b/ui/lib/replication/addon/components/enable-replication-form.js
@@ -0,0 +1,125 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import decodeConfigFromJwt from 'replication/utils/decode-config-from-jwt';
+import { service } from '@ember/service';
+import { task } from 'ember-concurrency';
+import errorMessage from 'vault/utils/error-message';
+import { isPresent } from '@ember/utils';
+import { waitFor } from '@ember/test-waiters';
+
+/**
+ * @module EnableReplicationFormComponent
+ * EnableReplicationForm component is used in the replication engine to enable replication. It must be passed the replicationMode,
+ * but otherwise it handles the rest of the form inputs. On success it will clear the form and call the onSuccess callback.
+ *
+ * @example
+ * <EnableReplicationForm @replicationMode="dr" @canEnablePrimary={{true}} @canEnableSecondary={{false}} @performanceReplicationDisabled={{false}} @onSuccess={{this.reloadCluster}} />
+ *
+ * @param {string} replicationMode - should be one of "dr" or "performance"
+ * @param {boolean} canEnablePrimary - if the capabilities allow the user to enable a primary cluster, parent getter returns capabilities based on type (i.e. "dr" or "performance")
+ * @param {boolean} canEnableSecondary - if the capabilities allow the user to enable a secondary cluster, parent getter returns capabilities based on type (i.e. "dr" or "performance")
+ * @param {boolean} performanceMode - should be "primary", "secondary", or "disabled". If enabled, form will show a warning when attempting to enable DR secondary
+ * @param {Promise} onSuccess - (optional) callback called after successful replication enablement. Must be a promise.
+ * @param {boolean} doTransition - (optional) if provided, passed to onSuccess callback to determine if a transition should be done
+ *
+ */
+export default class EnableReplicationFormComponent extends Component {
+  @service version;
+  @service store;
+
+  @tracked error = '';
+  @tracked showExplanation = false;
+  data = new EnablePayload();
+
+  get performanceReplicationEnabled() {
+    return this.args.performanceMode !== 'disabled';
+  }
+
+  get tokenIncludesAPIAddr() {
+    const config = decodeConfigFromJwt(this.token);
+    return config && config.addr ? true : false;
+  }
+
+  get disallowEnable() {
+    if (this.args.replicationMode === 'performance' && this.version.hasPerfReplication === false) {
+      return true;
+    }
+    const { mode, tokenIncludesAPIAddr, primary_api_addr } = this.data;
+    if (mode !== 'secondary' || tokenIncludesAPIAddr || (!tokenIncludesAPIAddr && primary_api_addr)) {
+      return false;
+    }
+    return true;
+  }
+
+  async onSuccess(resp, clusterMode) {
+    // clear form
+    this.data.reset();
+    // call callback
+    if (this.args.onSuccess) {
+      await this.args.onSuccess(resp, this.args.replicationMode, clusterMode, this.args.doTransition);
+    }
+  }
+
+  @action inputChange(evt) {
+    const name = evt.target.name;
+    const val = evt.target.value;
+    this.data[name] = val;
+  }
+
+  @task
+  @waitFor
+  *enableReplication(replicationMode, clusterMode, data) {
+    const payload = data.allKeys.reduce((newData, key) => {
+      var val = data[key];
+      if (isPresent(val)) {
+        newData[key] = val;
+      }
+      return newData;
+    }, {});
+    delete payload.mode;
+    try {
+      const resp = yield this.store
+        .adapterFor('cluster')
+        .replicationAction('enable', replicationMode, clusterMode, payload);
+      yield this.onSuccess(resp, clusterMode);
+    } catch (e) {
+      this.error = errorMessage(e, 'Enable replication failed. Check Vault logs for details.');
+    }
+  }
+
+  @action onSubmit(payload, evt) {
+    evt.preventDefault();
+    this.error = '';
+    this.enableReplication.perform(this.args.replicationMode, this.data.mode, payload);
+  }
+}
+
+class EnablePayload {
+  @tracked mode = 'primary';
+  @tracked token = '';
+  @tracked primary_api_addr = '';
+  @tracked primary_cluster_addr = '';
+  @tracked ca_file = '';
+  @tracked ca_path = '';
+  get tokenIncludesAPIAddr() {
+    const config = decodeConfigFromJwt(this.token);
+    return config && config.addr ? true : false;
+  }
+  get allKeys() {
+    return ['mode', 'token', 'primary_api_addr', 'primary_cluster_addr', 'ca_file', 'ca_path'];
+  }
+  reset() {
+    // reset all but mode
+    this.token = '';
+    this.primary_api_addr = '';
+    this.primary_cluster_addr = '';
+    this.ca_file = '';
+    this.ca_path = '';
+  }
+}
diff --git a/ui/lib/replication/addon/templates/components/known-secondaries-card.hbs b/ui/lib/replication/addon/components/known-secondaries-card.hbs
similarity index 84%
rename from ui/lib/replication/addon/templates/components/known-secondaries-card.hbs
rename to ui/lib/replication/addon/components/known-secondaries-card.hbs
index f190d43ff5e..3af04590f6e 100644
--- a/ui/lib/replication/addon/templates/components/known-secondaries-card.hbs
+++ b/ui/lib/replication/addon/components/known-secondaries-card.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container
   @hasBorder={{true}}
@@ -29,7 +29,12 @@
     {{/if}}
   </div>
   {{#if this.cluster.canAddSecondary}}
-    <LinkTo @route="mode.secondaries.add" @model={{this.cluster.replicationMode}} class="link add-secondaries">
+    <LinkTo
+      @route="mode.secondaries.add"
+      @model={{this.cluster.replicationMode}}
+      class="link add-secondaries"
+      data-test-link-to="Add secondary"
+    >
       Add secondary
     </LinkTo>
   {{/if}}
diff --git a/ui/lib/replication/addon/components/known-secondaries-card.js b/ui/lib/replication/addon/components/known-secondaries-card.js
index 64733827676..f75c7d2d4ab 100644
--- a/ui/lib/replication/addon/components/known-secondaries-card.js
+++ b/ui/lib/replication/addon/components/known-secondaries-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/templates/components/known-secondaries-table.hbs b/ui/lib/replication/addon/components/known-secondaries-table.hbs
similarity index 87%
rename from ui/lib/replication/addon/templates/components/known-secondaries-table.hbs
rename to ui/lib/replication/addon/components/known-secondaries-table.hbs
index b447dd29bf3..6a848ea8ad1 100644
--- a/ui/lib/replication/addon/templates/components/known-secondaries-table.hbs
+++ b/ui/lib/replication/addon/components/known-secondaries-table.hbs
@@ -1,9 +1,9 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Hds::Table @caption="Known Secondaries" data-test-known-secondaries-table>
+<Hds::Table class="overflow-wrap word-break" @caption="Known Secondaries" data-test-known-secondaries-table>
   <:head as |H|>
     <H.Tr>
       <H.Th>Secondary ID</H.Th>
diff --git a/ui/lib/replication/addon/components/known-secondaries-table.js b/ui/lib/replication/addon/components/known-secondaries-table.js
index 545c3ed9a82..7a33a960b7e 100644
--- a/ui/lib/replication/addon/components/known-secondaries-table.js
+++ b/ui/lib/replication/addon/components/known-secondaries-table.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/components/page/mode-index.hbs b/ui/lib/replication/addon/components/page/mode-index.hbs
new file mode 100644
index 00000000000..475d4c204b7
--- /dev/null
+++ b/ui/lib/replication/addon/components/page/mode-index.hbs
@@ -0,0 +1,56 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if @replicationDisabled}}
+  <PageHeader as |p|>
+    <p.levelLeft>
+      <h1 class="title is-3" data-test-replication-title={{@replicationMode}}>
+        {{#if (eq @replicationMode "dr")}}
+          Enable Disaster Recovery Replication
+        {{else if (eq @replicationMode "performance")}}
+          Enable Performance Replication
+        {{else}}
+          {{! should never get here, but have safe fallback just in case }}
+          Enable Replication
+        {{/if}}
+      </h1>
+    </p.levelLeft>
+  </PageHeader>
+  <div class="box is-sideless is-fullwidth is-marginless">
+    {{#if (eq @replicationMode "dr")}}
+      <h2 class="title is-flex-center is-5 is-marginless">
+        <Icon @size="24" @name="replication-direct" />
+        Disaster Recovery (DR) Replication
+      </h2>
+      <p class="help has-text-grey-dark">
+        {{replication-mode-description "dr"}}
+      </p>
+    {{else if (eq @replicationMode "performance")}}
+      <h2 class="title is-flex-center is-5 is-marginless">
+        <Icon @size="24" @name="replication-perf" />
+        Performance Replication
+      </h2>
+      {{#if (has-feature "Performance Replication")}}
+        <p class="help has-text-grey-dark">
+          {{replication-mode-description "performance"}}
+        </p>
+      {{else}}
+        <p class="help has-text-grey-dark">
+          Performance Replication is a feature of Vault Enterprise Premium
+        </p>
+      {{/if}}
+    {{/if}}
+  </div>
+  <EnableReplicationForm
+    @replicationMode={{@replicationMode}}
+    @canEnablePrimary={{this.canEnable "Primary"}}
+    @canEnableSecondary={{this.canEnable "Secondary"}}
+    @performanceReplicationDisabled={{@cluster.performance.replicationDisabled}}
+    @performanceMode={{if @cluster.performance.replicationDisabled "disabled" @cluster.performance.modeForUrl}}
+    @onSuccess={{@onEnableSuccess}}
+  />
+{{else}}
+  <ReplicationSummary @cluster={{@cluster}} @initialReplicationMode={{@replicationMode}} />
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/replication/addon/components/page/mode-index.js b/ui/lib/replication/addon/components/page/mode-index.js
new file mode 100644
index 00000000000..a1f1e2b0d50
--- /dev/null
+++ b/ui/lib/replication/addon/components/page/mode-index.js
@@ -0,0 +1,40 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+
+/**
+ * @module PageModeIndex
+ *
+ * @example
+ * <Page::ModeIndex
+ *  @cluster={{this.model}}
+ *  @onEnableSuccess={{this.onEnableSuccess}}
+ *  @replicationDisabled={{this.replicationForMode.replicationDisabled}
+ *  @replicationMode={{this.replicationMode}}
+ * />
+ *
+ * @param {model} cluster - cluster route model
+ * @param {function} onEnableSuccess - callback after enabling is successful, handles transition if enabled from the top-level index route
+ * @param {boolean} replicationDisabled - whether or not replication is enabled
+ * @param {string} replicationMode - should be "dr" or "performance"
+ */
+export default class PageModeIndex extends Component {
+  canEnable = (type) => {
+    const { cluster, replicationMode } = this.args;
+    let perm;
+    if (replicationMode === 'dr') {
+      // returns canEnablePrimaryDr or canEnableSecondaryDr
+      perm = `canEnable${type}Dr`;
+    }
+    if (replicationMode === 'performance') {
+      // returns canEnablePrimaryPerformance or canEnableSecondaryPerformance
+      perm = `canEnable${type}Performance`;
+    }
+    // if there's a problem checking capabilities, default to true
+    // since the backend can gate as a fallback
+    return cluster[perm] ?? true;
+  };
+}
diff --git a/ui/lib/replication/addon/templates/components/path-filter-config-list.hbs b/ui/lib/replication/addon/components/path-filter-config-list.hbs
similarity index 98%
rename from ui/lib/replication/addon/templates/components/path-filter-config-list.hbs
rename to ui/lib/replication/addon/components/path-filter-config-list.hbs
index 1fa4e022049..b8de5f0840c 100644
--- a/ui/lib/replication/addon/templates/components/path-filter-config-list.hbs
+++ b/ui/lib/replication/addon/components/path-filter-config-list.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <h4 class="title is-5">
   Filtered paths
diff --git a/ui/lib/replication/addon/components/path-filter-config-list.js b/ui/lib/replication/addon/components/path-filter-config-list.js
index b227956e2bc..99387658533 100644
--- a/ui/lib/replication/addon/components/path-filter-config-list.js
+++ b/ui/lib/replication/addon/components/path-filter-config-list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/components/replication-overview-mode.hbs b/ui/lib/replication/addon/components/replication-overview-mode.hbs
new file mode 100644
index 00000000000..1b710d1d294
--- /dev/null
+++ b/ui/lib/replication/addon/components/replication-overview-mode.hbs
@@ -0,0 +1,49 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Card::Container @level="mid" @hasBorder={{true}} ...attributes>
+  <div class="has-padding-m">
+    <div class="flex">
+      <Icon @size="24" @name={{this.details.icon}} />
+      <Hds::Text::Display
+        @tag="h2"
+        @size="400"
+        data-test-overview-mode-title
+      >{{this.details.blockTitle}}</Hds::Text::Display>
+    </div>
+    <div class="has-top-padding-m has-bottom-padding-m" data-test-overview-mode-body>
+      {{#if (not (has-feature this.details.feature))}}
+        <Hds::Text::Body @size="300" @tag="div">
+          {{this.details.upgradeTitle}}
+          <Hds::Link::Inline @href={{this.details.upgradeLink}} data-test-upgrade-link={{@mode}}>
+            Upgrade
+          </Hds::Link::Inline>
+        </Hds::Text::Body>
+      {{else if @model.replicationEnabled}}
+        <Hds::Text::Body @tag="div" @size="300" @weight="semibold" @color="strong">ENABLED</Hds::Text::Body>
+        <div class="has-bottom-padding-s">
+          <Hds::Text::Body @color="faint">{{capitalize @model.modeForUrl}}</Hds::Text::Body>
+          {{#if @model.secondaryId}}
+            <Hds::Badge @text={{@model.secondaryId}} />
+          {{/if}}
+          {{#if @model.clusterIdDisplay}}
+            <Hds::Badge @text={{@model.clusterIdDisplay}} />
+          {{/if}}
+        </div>
+      {{/if}}
+
+      <Hds::Text::Body @color="faint">{{replication-mode-description @mode}}</Hds::Text::Body>
+    </div>
+    {{#if (has-feature this.details.feature)}}
+      <Hds::Button
+        @route="mode.index"
+        @models={{array @clusterName @mode}}
+        @color={{if @model.replicationEnabled "secondary" "primary"}}
+        @text={{if @model.replicationEnabled "Details" "Enable"}}
+        data-test-replication-details-link={{@mode}}
+      />
+    {{/if}}
+  </div>
+</Hds::Card::Container>
\ No newline at end of file
diff --git a/ui/lib/replication/addon/components/replication-overview-mode.js b/ui/lib/replication/addon/components/replication-overview-mode.js
new file mode 100644
index 00000000000..ac505bb244b
--- /dev/null
+++ b/ui/lib/replication/addon/components/replication-overview-mode.js
@@ -0,0 +1,39 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+
+/**
+ * @module ReplicationOverviewModeComponent
+ * ReplicationOverviewMode components are used on the Replication index page to display
+ * details about a given mode (DR or Performance) status.
+ *
+ * @example
+ * <ReplicationOverviewModeComponent @mode="dr" @model={{this.cluster.dr}} @clusterName={{this.cluster.name}} />
+ *
+ * @param {string} mode - should be "dr" or "performance"
+ * @param {ReplicationAttributesModel} model - either the dr or performance attribute of the cluster model
+ * @param {string} clusterName - used for the link to the mode details
+ */
+export default class ReplicationOverviewModeComponent extends Component {
+  get details() {
+    if (this.args.mode === 'dr') {
+      return {
+        blockTitle: 'Disaster Recovery (DR)',
+        upgradeTitle: 'Disaster Recovery is a feature of Vault Enterprise Premium.',
+        upgradeLink: 'https://hashicorp.com/products/vault/trial?source=vaultui_DR%20Replication',
+        feature: 'DR Replication',
+        icon: 'replication-direct',
+      };
+    }
+    return {
+      blockTitle: 'Performance',
+      upgradeTitle: 'Performance Replication is a feature of Vault Enterprise Premium.',
+      upgradeLink: 'https://hashicorp.com/products/vault/trial?source=vaultui_Performance%20Replication',
+      feature: 'Performance Replication',
+      icon: 'replication-perf',
+    };
+  }
+}
diff --git a/ui/lib/replication/addon/templates/components/replication-primary-card.hbs b/ui/lib/replication/addon/components/replication-primary-card.hbs
similarity index 95%
rename from ui/lib/replication/addon/templates/components/replication-primary-card.hbs
rename to ui/lib/replication/addon/components/replication-primary-card.hbs
index e3b13ba48fc..297d589a070 100644
--- a/ui/lib/replication/addon/templates/components/replication-primary-card.hbs
+++ b/ui/lib/replication/addon/components/replication-primary-card.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::Card::Container @hasBorder={{true}} class="has-padding-m {{if this.hasErrorClass 'has-error-border'}}">
   <h3 class="card-title title is-5">{{this.title}}</h3>
diff --git a/ui/lib/replication/addon/components/replication-primary-card.js b/ui/lib/replication/addon/components/replication-primary-card.js
index 6250eed0425..209e24e0139 100644
--- a/ui/lib/replication/addon/components/replication-primary-card.js
+++ b/ui/lib/replication/addon/components/replication-primary-card.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/components/replication-summary.hbs b/ui/lib/replication/addon/components/replication-summary.hbs
new file mode 100644
index 00000000000..2ba451fcb43
--- /dev/null
+++ b/ui/lib/replication/addon/components/replication-summary.hbs
@@ -0,0 +1,41 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+{{#if (eq this.attrsForCurrentMode.mode "initializing")}}
+  The cluster is initializing replication. This may take some time.
+{{else}}
+  <p>{{this.cluster.replicationModeStatus.cluster_id}}</p>
+  <div class="replication">
+    <ReplicationPage @model={{this.cluster}} as |Page|>
+      <Page.dashboard
+        @data={{this.cluster}}
+        @componentToRender={{if
+          (eq this.attrsForCurrentMode.mode "secondary")
+          "replication-secondary-card"
+          "replication-primary-card"
+        }}
+        as |Dashboard|
+      >
+        {{#if (eq this.attrsForCurrentMode.mode "secondary")}}
+          <Dashboard.card @title="Status" />
+          <Dashboard.card @title="Primary cluster" />
+        {{else}}
+          <Dashboard.card
+            @title="State"
+            @description="The cluster’s current operating state."
+            @glyph={{get (cluster-states this.attrsForCurrentMode.state) "glyph"}}
+            @metric={{this.attrsForCurrentMode.state}}
+          />
+          <Dashboard.card
+            @title="Last WAL entry"
+            @description="Index of last Write Ahead Logs entry written on local storage. Updates every ten seconds."
+            @metric={{format-number this.attrsForCurrentMode.lastWAL}}
+          />
+          <Dashboard.secondaryCard @cluster={{this.cluster}} @replicationAttrs={{this.attrsForCurrentMode}} />
+        {{/if}}
+      </Page.dashboard>
+    </ReplicationPage>
+  </div>
+{{/if}}
\ No newline at end of file
diff --git a/ui/lib/replication/addon/components/replication-summary.js b/ui/lib/replication/addon/components/replication-summary.js
index 708a26ac903..e254abc93d2 100644
--- a/ui/lib/replication/addon/components/replication-summary.js
+++ b/ui/lib/replication/addon/components/replication-summary.js
@@ -1,32 +1,27 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
-import { alias } from '@ember/object/computed';
 import { computed } from '@ember/object';
 import Component from '@ember/component';
-import decodeConfigFromJWT from 'replication/utils/decode-config-from-jwt';
 import ReplicationActions from 'core/mixins/replication-actions';
-import { task } from 'ember-concurrency';
-import { A } from '@ember/array';
 
-const DEFAULTS = {
-  token: null,
-  id: null,
-  loading: false,
-  errors: A(),
-  primary_api_addr: null,
-  primary_cluster_addr: null,
-  ca_file: null,
-  ca_path: null,
-};
-
-export default Component.extend(ReplicationActions, DEFAULTS, {
+/**
+ * @module ReplicationSummary
+ * ReplicationSummary component is a component to show the mode-specific summary for replication
+ *
+ * @param {ClusterModel} cluster - the cluster ember-data model
+ * @param {string} initialReplicationMode - mode for replication details we want to see, either "dr" or "performance"
+ */
+export default Component.extend(ReplicationActions, {
+  'data-test-replication-summary': true,
+  attributeBindings: ['data-test-replication-summary'],
   replicationMode: 'dr',
   mode: 'primary',
   version: service(),
+  rm: service('replication-mode'),
   didReceiveAttrs() {
     this._super(...arguments);
     const initialReplicationMode = this.initialReplicationMode;
@@ -34,57 +29,10 @@ export default Component.extend(ReplicationActions, DEFAULTS, {
       this.set('replicationMode', initialReplicationMode);
     }
   },
-  showModeSummary: false,
   initialReplicationMode: null,
   cluster: null,
 
-  replicationAttrs: alias('cluster.replicationAttrs'),
-
-  tokenIncludesAPIAddr: computed('token', function () {
-    const config = decodeConfigFromJWT(this.token);
-    return config && config.addr ? true : false;
+  attrsForCurrentMode: computed('cluster', 'rm.mode', function () {
+    return this.cluster[this.rm.mode];
   }),
-
-  disallowEnable: computed(
-    'replicationMode',
-    'version.hasPerfReplication',
-    'mode',
-    'tokenIncludesAPIAddr',
-    'primary_api_addr',
-    function () {
-      const inculdesAPIAddr = this.tokenIncludesAPIAddr;
-      if (this.replicationMode === 'performance' && this.version.hasPerfReplication === false) {
-        return true;
-      }
-      if (this.mode !== 'secondary' || inculdesAPIAddr || (!inculdesAPIAddr && this.primary_api_addr)) {
-        return false;
-      }
-      return true;
-    }
-  ),
-
-  reset() {
-    this.setProperties(DEFAULTS);
-  },
-
-  submit: task(function* () {
-    try {
-      yield this.submitHandler.perform(...arguments);
-    } catch (e) {
-      // do not handle error
-    }
-  }),
-  actions: {
-    onSubmit(/*action, mode, data, event*/) {
-      this.submit.perform(...arguments);
-    },
-
-    clear() {
-      this.reset();
-      this.setProperties({
-        token: null,
-        id: null,
-      });
-    },
-  },
 });
diff --git a/ui/lib/replication/addon/controllers/application.js b/ui/lib/replication/addon/controllers/application.js
index 36641ba42c1..1a2ea838a86 100644
--- a/ui/lib/replication/addon/controllers/application.js
+++ b/ui/lib/replication/addon/controllers/application.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,9 +7,9 @@ import { isPresent } from '@ember/utils';
 import { alias } from '@ember/object/computed';
 import { service } from '@ember/service';
 import Controller from '@ember/controller';
-import { copy } from 'ember-copy';
 import { resolve } from 'rsvp';
 import decodeConfigFromJWT from 'replication/utils/decode-config-from-jwt';
+import { buildWaiter } from '@ember/test-waiters';
 
 const DEFAULTS = {
   token: null,
@@ -23,11 +23,16 @@ const DEFAULTS = {
     paths: [],
   },
 };
+const waiter = buildWaiter('replication-actions');
 
-export default Controller.extend(copy(DEFAULTS, true), {
+/**
+ * @type Class
+ */
+export default Controller.extend(structuredClone(DEFAULTS), {
   isModalActive: false,
   isTokenCopied: false,
   expirationDate: null,
+  router: service('app-router'),
   store: service(),
   rm: service('replication-mode'),
   replicationMode: alias('rm.mode'),
@@ -54,7 +59,7 @@ export default Controller.extend(copy(DEFAULTS, true), {
   },
 
   reset() {
-    this.setProperties(copy(DEFAULTS, true));
+    this.setProperties(structuredClone(DEFAULTS));
   },
 
   submitSuccess(resp, action) {
@@ -87,6 +92,7 @@ export default Controller.extend(copy(DEFAULTS, true), {
   },
 
   submitHandler(action, clusterMode, data, event) {
+    const waiterToken = waiter.beginAsync();
     const replicationMode = this.replicationMode;
     if (event && event.preventDefault) {
       event.preventDefault();
@@ -116,7 +122,10 @@ export default Controller.extend(copy(DEFAULTS, true), {
         },
         (...args) => this.submitError(...args)
       )
-      .finally(() => this.set('secondaryToRevoke', null));
+      .finally(() => {
+        this.set('secondaryToRevoke', null);
+        waiter.endAsync(waiterToken);
+      });
   },
 
   actions: {
@@ -125,7 +134,7 @@ export default Controller.extend(copy(DEFAULTS, true), {
     },
     closeTokenModal() {
       this.toggleProperty('isModalActive');
-      this.transitionToRoute('mode.secondaries');
+      this.router.transitionTo('vault.cluster.replication.mode.secondaries');
       this.set('isTokenCopied', false);
     },
     onCopy() {
diff --git a/ui/lib/replication/addon/controllers/index.js b/ui/lib/replication/addon/controllers/index.js
index efe3c3d74de..dc679cbdcdd 100644
--- a/ui/lib/replication/addon/controllers/index.js
+++ b/ui/lib/replication/addon/controllers/index.js
@@ -1,8 +1,31 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Controller from './replication-mode';
+import ReplicationModeBaseController from './replication-mode';
+import { tracked } from '@glimmer/tracking';
 
-export default Controller.extend();
+export default class ReplicationIndexController extends ReplicationModeBaseController {
+  @tracked modeSelection = 'dr';
+
+  getPerm(type) {
+    if (this.modeSelection === 'dr') {
+      // returns canEnablePrimaryDr or canEnableSecondaryDr
+      return `canEnable${type}Dr`;
+    }
+    if (this.modeSelection === 'performance') {
+      // returns canEnablePrimaryPerformance or canEnableSecondaryPerformance
+      return `canEnable${type}Performance`;
+    }
+  }
+
+  // if there's a problem checking capabilities, default to true
+  // since the backend will gate as a fallback
+  get canEnablePrimary() {
+    return this.model[this.getPerm('Primary')] ?? true;
+  }
+  get canEnableSecondary() {
+    return this.model[this.getPerm('Secondary')] ?? true;
+  }
+}
diff --git a/ui/lib/replication/addon/controllers/mode.js b/ui/lib/replication/addon/controllers/mode.js
index efe3c3d74de..80187dbe0fb 100644
--- a/ui/lib/replication/addon/controllers/mode.js
+++ b/ui/lib/replication/addon/controllers/mode.js
@@ -1,8 +1,8 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Controller from './replication-mode';
+import ReplicationModeBaseController from './replication-mode';
 
-export default Controller.extend();
+export default class ReplicationModeController extends ReplicationModeBaseController {}
diff --git a/ui/lib/replication/addon/controllers/mode/index.js b/ui/lib/replication/addon/controllers/mode/index.js
index b4908268468..9c74975c69f 100644
--- a/ui/lib/replication/addon/controllers/mode/index.js
+++ b/ui/lib/replication/addon/controllers/mode/index.js
@@ -1,8 +1,8 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Controller from '../replication-mode';
+import ReplicationModeBaseController from '../replication-mode';
 
-export default Controller.extend();
+export default class ReplicationModeIndexController extends ReplicationModeBaseController {}
diff --git a/ui/lib/replication/addon/controllers/mode/manage.js b/ui/lib/replication/addon/controllers/mode/manage.js
index b4908268468..4073a37df5c 100644
--- a/ui/lib/replication/addon/controllers/mode/manage.js
+++ b/ui/lib/replication/addon/controllers/mode/manage.js
@@ -1,8 +1,8 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Controller from '../replication-mode';
+import ReplicationModeBaseController from '../replication-mode';
 
-export default Controller.extend();
+export default class ReplicationModeManageController extends ReplicationModeBaseController {}
diff --git a/ui/lib/replication/addon/controllers/mode/secondaries.js b/ui/lib/replication/addon/controllers/mode/secondaries.js
index b4908268468..b0a1af7b9b4 100644
--- a/ui/lib/replication/addon/controllers/mode/secondaries.js
+++ b/ui/lib/replication/addon/controllers/mode/secondaries.js
@@ -1,8 +1,8 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Controller from '../replication-mode';
+import ReplicationModeBaseController from '../replication-mode';
 
-export default Controller.extend();
+export default class ReplicationModeSecondariesController extends ReplicationModeBaseController {}
diff --git a/ui/lib/replication/addon/controllers/mode/secondaries/add.js b/ui/lib/replication/addon/controllers/mode/secondaries/add.js
index 1741b54b503..d6943ba883f 100644
--- a/ui/lib/replication/addon/controllers/mode/secondaries/add.js
+++ b/ui/lib/replication/addon/controllers/mode/secondaries/add.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/controllers/mode/secondaries/config-create.js b/ui/lib/replication/addon/controllers/mode/secondaries/config-create.js
index f87aa806b8b..2558a234213 100644
--- a/ui/lib/replication/addon/controllers/mode/secondaries/config-create.js
+++ b/ui/lib/replication/addon/controllers/mode/secondaries/config-create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/controllers/mode/secondaries/config-edit.js b/ui/lib/replication/addon/controllers/mode/secondaries/config-edit.js
index 2d0b3552325..915930dff27 100644
--- a/ui/lib/replication/addon/controllers/mode/secondaries/config-edit.js
+++ b/ui/lib/replication/addon/controllers/mode/secondaries/config-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,11 +9,12 @@ import Controller from '@ember/controller';
 
 export default Controller.extend({
   flashMessages: service(),
+  router: service('app-router'),
   rm: service('replication-mode'),
   replicationMode: alias('rm.mode'),
   actions: {
     resetConfig(config) {
-      if (config.get('isNew')) {
+      if (config.isNew) {
         config.setProperties({
           mode: null,
           paths: [],
@@ -29,14 +30,15 @@ export default Controller.extend({
       const flash = this.flashMessages;
       const id = config.id;
       const redirectArgs = isDelete
-        ? ['mode.secondaries', this.replicationMode]
-        : ['mode.secondaries.config-show', id];
+        ? ['vault.cluster.replication.mode.secondaries', this.replicationMode]
+        : ['vault.cluster.replication.mode.secondaries.config-show', id];
       const modelMethod = isDelete ? config.destroyRecord : config.save;
 
       modelMethod
         .call(config)
         .then(() => {
-          this.transitionToRoute(...redirectArgs)
+          this.router
+            .transitionTo(...redirectArgs)
             .followRedirects()
             .then(() => {
               flash.success(
diff --git a/ui/lib/replication/addon/controllers/mode/secondaries/config-show.js b/ui/lib/replication/addon/controllers/mode/secondaries/config-show.js
index e96b64fbcae..b7490aa238c 100644
--- a/ui/lib/replication/addon/controllers/mode/secondaries/config-show.js
+++ b/ui/lib/replication/addon/controllers/mode/secondaries/config-show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/controllers/mode/secondaries/index.js b/ui/lib/replication/addon/controllers/mode/secondaries/index.js
index 18b518e88f1..4917358265f 100644
--- a/ui/lib/replication/addon/controllers/mode/secondaries/index.js
+++ b/ui/lib/replication/addon/controllers/mode/secondaries/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/controllers/mode/secondaries/revoke.js b/ui/lib/replication/addon/controllers/mode/secondaries/revoke.js
index 18b518e88f1..4917358265f 100644
--- a/ui/lib/replication/addon/controllers/mode/secondaries/revoke.js
+++ b/ui/lib/replication/addon/controllers/mode/secondaries/revoke.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/controllers/replication-mode.js b/ui/lib/replication/addon/controllers/replication-mode.js
index afa6c929ec8..d2780b01060 100644
--- a/ui/lib/replication/addon/controllers/replication-mode.js
+++ b/ui/lib/replication/addon/controllers/replication-mode.js
@@ -1,34 +1,76 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { alias } from '@ember/object/computed';
 import { service } from '@ember/service';
 import Controller from '@ember/controller';
 import { task, timeout } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+import { action } from '@ember/object';
 
-export default Controller.extend({
-  rm: service('replication-mode'),
-  replicationMode: alias('rm.mode'),
-  waitForNewClusterToInit: task(function* (replicationMode) {
+export default class ReplicationModeBaseController extends Controller {
+  @service('replication-mode') rm;
+  @service('app-router') router;
+  @service store;
+
+  get replicationMode() {
+    return this.rm.mode;
+  }
+
+  get replicationForMode() {
+    if (!this.replicationMode || !this.model) return null;
+    return this.model[this.replicationMode];
+  }
+
+  @task
+  @waitFor
+  *waitForNewClusterToInit(replicationMode) {
     // waiting for the newly enabled cluster to init
     // this ensures we don't hit a capabilities-self error, called in the model of the mode/index route
     yield timeout(1000);
-    return this.transitionToRoute('mode', replicationMode);
-  }),
-  actions: {
-    onEnable(replicationMode, mode) {
-      if (replicationMode == 'dr' && mode === 'secondary') {
-        return this.transitionToRoute('vault.cluster');
+    this.router.transitionTo('vault.cluster.replication.mode', replicationMode);
+  }
+
+  @action
+  onDisable() {
+    this.router.transitionTo('vault.cluster.replication.index');
+  }
+
+  @action
+  async onEnableSuccess(resp, replicationMode, clusterMode, doTransition = false) {
+    // this is extrapolated from the replication-actions mixin "submitSuccess"
+    const cluster = this.model;
+    if (!cluster) {
+      return;
+    }
+    // do something to show model is pending
+    cluster.set(
+      replicationMode,
+      this.store.createRecord('replication-attributes', {
+        mode: 'bootstrapping',
+      })
+    );
+    if (clusterMode === 'secondary' && replicationMode === 'performance') {
+      // if we're enabing a secondary, there could be mount filtering,
+      // so we should unload all of the backends
+      this.store.unloadAll('secret-engine');
+    }
+    try {
+      await cluster.reload();
+    } catch (e) {
+      // no error handling here
+    }
+    cluster.rollbackAttributes();
+    // we should only do the transitions if called from vault.cluster.replication.index
+    if (doTransition) {
+      if (replicationMode == 'dr' && clusterMode === 'secondary') {
+        this.router.transitionTo('vault.cluster');
       } else if (replicationMode === 'dr') {
-        return this.transitionToRoute('mode', replicationMode);
+        this.router.transitionTo('vault.cluster.replication.mode', replicationMode);
       } else {
         this.waitForNewClusterToInit.perform(replicationMode);
       }
-    },
-    onDisable() {
-      return this.transitionToRoute('index');
-    },
-  },
-});
+    }
+  }
+}
diff --git a/ui/lib/replication/addon/engine.js b/ui/lib/replication/addon/engine.js
index f3ddb560ea4..a979312ac51 100644
--- a/ui/lib/replication/addon/engine.js
+++ b/ui/lib/replication/addon/engine.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,10 +16,11 @@ const Eng = Engine.extend({
   dependencies: {
     services: [
       'auth',
+      'capabilities',
       'flash-messages',
       'namespace',
       'replication-mode',
-      'router',
+      'app-router',
       'store',
       'version',
       '-portal',
diff --git a/ui/lib/replication/addon/resolver.js b/ui/lib/replication/addon/resolver.js
index deb3e8ad3b4..aaae6063af1 100644
--- a/ui/lib/replication/addon/resolver.js
+++ b/ui/lib/replication/addon/resolver.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/routes.js b/ui/lib/replication/addon/routes.js
index af38cbb5bbc..2183b2e8ab7 100644
--- a/ui/lib/replication/addon/routes.js
+++ b/ui/lib/replication/addon/routes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/routes/application.js b/ui/lib/replication/addon/routes/application.js
index 808dfb5886c..9c81eb11f9a 100644
--- a/ui/lib/replication/addon/routes/application.js
+++ b/ui/lib/replication/addon/routes/application.js
@@ -1,11 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { service } from '@ember/service';
 import { setProperties } from '@ember/object';
-import { hash } from 'rsvp';
 import Route from '@ember/routing/route';
 import ClusterRoute from 'vault/mixins/cluster-route';
 
@@ -13,7 +12,24 @@ export default Route.extend(ClusterRoute, {
   version: service(),
   store: service(),
   auth: service(),
-  router: service(),
+  router: service('app-router'),
+  capabilities: service(),
+
+  async fetchCapabilities() {
+    const enablePath = (type, cluster) => `sys/replication/${type}/${cluster}/enable`;
+    const perms = await this.capabilities.fetch([
+      enablePath('dr', 'primary'),
+      enablePath('dr', 'primary'),
+      enablePath('performance', 'secondary'),
+      enablePath('performance', 'secondary'),
+    ]);
+    return {
+      canEnablePrimaryDr: perms[enablePath('dr', 'primary')].canUpdate,
+      canEnableSecondaryDr: perms[enablePath('dr', 'primary')].canUpdate,
+      canEnablePrimaryPerformance: perms[enablePath('performance', 'secondary')].canUpdate,
+      canEnableSecondaryPerformance: perms[enablePath('performance', 'secondary')].canUpdate,
+    };
+  },
 
   beforeModel() {
     if (this.auth.activeCluster.replicationRedacted) {
@@ -29,21 +45,21 @@ export default Route.extend(ClusterRoute, {
     return this.auth.activeCluster;
   },
 
-  afterModel(model) {
-    return hash({
-      canEnablePrimary: this.store
-        .findRecord('capabilities', 'sys/replication/primary/enable')
-        .then((c) => c.get('canUpdate')),
-      canEnableSecondary: this.store
-        .findRecord('capabilities', 'sys/replication/secondary/enable')
-        .then((c) => c.get('canUpdate')),
-    }).then(({ canEnablePrimary, canEnableSecondary }) => {
-      setProperties(model, {
-        canEnablePrimary,
-        canEnableSecondary,
-      });
-      return model;
+  async afterModel(model) {
+    const {
+      canEnablePrimaryDr,
+      canEnableSecondaryDr,
+      canEnablePrimaryPerformance,
+      canEnableSecondaryPerformance,
+    } = await this.fetchCapabilities();
+
+    setProperties(model, {
+      canEnablePrimaryDr,
+      canEnableSecondaryDr,
+      canEnablePrimaryPerformance,
+      canEnableSecondaryPerformance,
     });
+    return model;
   },
   actions: {
     refresh() {
diff --git a/ui/lib/replication/addon/routes/index.js b/ui/lib/replication/addon/routes/index.js
index c310fd564cc..46fbea821a1 100644
--- a/ui/lib/replication/addon/routes/index.js
+++ b/ui/lib/replication/addon/routes/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/addon/routes/mode.js b/ui/lib/replication/addon/routes/mode.js
index 623a1a530ed..7c2216c485b 100644
--- a/ui/lib/replication/addon/routes/mode.js
+++ b/ui/lib/replication/addon/routes/mode.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,11 +12,12 @@ const SUPPORTED_REPLICATION_MODES = ['dr', 'performance'];
 
 export default Route.extend({
   replicationMode: service(),
+  router: service('app-router'),
   store: service(),
   beforeModel() {
     const replicationMode = this.paramsFor(this.routeName).replication_mode;
     if (!SUPPORTED_REPLICATION_MODES.includes(replicationMode)) {
-      return this.transitionTo('index');
+      this.router.transitionTo('vault.cluster.replication.index');
     }
   },
   model() {
diff --git a/ui/lib/replication/addon/routes/mode/index.js b/ui/lib/replication/addon/routes/mode/index.js
index 4f408162b67..2bd8cffec4c 100644
--- a/ui/lib/replication/addon/routes/mode/index.js
+++ b/ui/lib/replication/addon/routes/mode/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
 export default Route.extend({
+  router: service('app-router'),
   store: service(),
   model() {
     const replicationMode = this.paramsFor('mode').replication_mode;
@@ -17,10 +18,10 @@ export default Route.extend({
       cluster: this.modelFor('mode'),
       canAddSecondary: this.store
         .findRecord('capabilities', `sys/replication/${replicationMode}/primary/secondary-token`)
-        .then((c) => c.get('canUpdate')),
+        .then((c) => c.canUpdate),
       canRevokeSecondary: this.store
         .findRecord('capabilities', `sys/replication/${replicationMode}/primary/revoke-secondary`)
-        .then((c) => c.get('canUpdate')),
+        .then((c) => c.canUpdate),
     }).then(({ cluster, canAddSecondary, canRevokeSecondary }) => {
       setProperties(cluster, {
         canRevokeSecondary,
@@ -29,14 +30,12 @@ export default Route.extend({
       return cluster;
     });
   },
+
   afterModel(model) {
     const replicationMode = this.paramsFor('mode').replication_mode;
-    if (
-      !model.get(`${replicationMode}.isPrimary`) ||
-      model.get(`${replicationMode}.replicationDisabled`) ||
-      model.get(`${replicationMode}.replicationUnsupported`)
-    ) {
-      return this.transitionTo('mode', replicationMode);
+    const cluster = model[replicationMode];
+    if (!cluster.isPrimary || cluster.replicationDisabled || cluster.replicationUnsupported) {
+      return this.router.transitionTo('vault.cluster.replication.mode', replicationMode);
     }
   },
 });
diff --git a/ui/lib/replication/addon/routes/mode/manage.js b/ui/lib/replication/addon/routes/mode/manage.js
index 226202d23b9..43268e6da61 100644
--- a/ui/lib/replication/addon/routes/mode/manage.js
+++ b/ui/lib/replication/addon/routes/mode/manage.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,7 @@ import { camelize } from '@ember/string';
 import { all } from 'rsvp';
 import { service } from '@ember/service';
 import Route from '@ember/routing/route';
-import { replicationActionForMode } from 'replication/helpers/replication-action-for-mode';
+import { replicationActionForMode } from 'core/helpers/replication-action-for-mode';
 
 const pathForAction = (action, replicationMode, clusterMode) => {
   let path;
@@ -20,18 +20,19 @@ const pathForAction = (action, replicationMode, clusterMode) => {
 };
 
 export default Route.extend({
+  router: service('app-router'),
   store: service(),
   model() {
     const store = this.store;
     const model = this.modelFor('mode');
 
     const replicationMode = this.paramsFor('mode').replication_mode;
-    const clusterMode = model.get(replicationMode).get('modeForUrl');
+    const clusterMode = model[replicationMode].modeForUrl;
     const actions = replicationActionForMode([replicationMode, clusterMode]);
     return all(
       actions.map((action) => {
         return store.findRecord('capabilities', pathForAction(action)).then((capability) => {
-          model.set(`can${camelize(action)}`, capability.get('canUpdate'));
+          model.set(`can${camelize(action)}`, capability.canUpdate);
         });
       })
     ).then(() => {
@@ -42,11 +43,9 @@ export default Route.extend({
   beforeModel() {
     const model = this.modelFor('mode');
     const replicationMode = this.paramsFor('mode').replication_mode;
-    if (
-      model.get(replicationMode).get('replicationDisabled') ||
-      model.get(replicationMode).get('replicationUnsupported')
-    ) {
-      return this.transitionTo('mode', replicationMode);
+    const modeModel = model[replicationMode];
+    if (modeModel.replicationDisabled || modeModel.replicationUnsupported) {
+      this.router.transitionTo('vault.cluster.replication.mode', replicationMode);
     }
   },
 });
diff --git a/ui/lib/replication/addon/routes/mode/secondaries.js b/ui/lib/replication/addon/routes/mode/secondaries.js
index 4f408162b67..c94da7bb6fd 100644
--- a/ui/lib/replication/addon/routes/mode/secondaries.js
+++ b/ui/lib/replication/addon/routes/mode/secondaries.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import Route from '@ember/routing/route';
 import { service } from '@ember/service';
 
 export default Route.extend({
+  router: service('app-router'),
   store: service(),
   model() {
     const replicationMode = this.paramsFor('mode').replication_mode;
@@ -17,10 +18,10 @@ export default Route.extend({
       cluster: this.modelFor('mode'),
       canAddSecondary: this.store
         .findRecord('capabilities', `sys/replication/${replicationMode}/primary/secondary-token`)
-        .then((c) => c.get('canUpdate')),
+        .then((c) => c.canUpdate),
       canRevokeSecondary: this.store
         .findRecord('capabilities', `sys/replication/${replicationMode}/primary/revoke-secondary`)
-        .then((c) => c.get('canUpdate')),
+        .then((c) => c.canUpdate),
     }).then(({ cluster, canAddSecondary, canRevokeSecondary }) => {
       setProperties(cluster, {
         canRevokeSecondary,
@@ -31,12 +32,9 @@ export default Route.extend({
   },
   afterModel(model) {
     const replicationMode = this.paramsFor('mode').replication_mode;
-    if (
-      !model.get(`${replicationMode}.isPrimary`) ||
-      model.get(`${replicationMode}.replicationDisabled`) ||
-      model.get(`${replicationMode}.replicationUnsupported`)
-    ) {
-      return this.transitionTo('mode', replicationMode);
+    const modeModel = model[replicationMode];
+    if (!modeModel.isPrimary || modeModel.replicationDisabled || modeModel.replicationUnsupported) {
+      this.router.transitionTo('vault.cluster.replication.mode', replicationMode);
     }
   },
 });
diff --git a/ui/lib/replication/addon/routes/mode/secondaries/add.js b/ui/lib/replication/addon/routes/mode/secondaries/add.js
index 09ccf4c946b..058c23a8817 100644
--- a/ui/lib/replication/addon/routes/mode/secondaries/add.js
+++ b/ui/lib/replication/addon/routes/mode/secondaries/add.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,8 +12,8 @@ export default Base.extend({
 
   redirect(model) {
     const replicationMode = this.paramsFor('mode').replication_mode;
-    if (!model.get(`${replicationMode}.isPrimary`) || !model.get('canAddSecondary')) {
-      return this.transitionTo('mode', replicationMode);
+    if (!model[replicationMode].isPrimary || !model.canAddSecondary) {
+      return this.router.transitionTo('vault.cluster.replication.mode', replicationMode);
     }
   },
 
diff --git a/ui/lib/replication/addon/routes/mode/secondaries/config-create.js b/ui/lib/replication/addon/routes/mode/secondaries/config-create.js
index 6cf57ad52fe..4e2bf4c3b8b 100644
--- a/ui/lib/replication/addon/routes/mode/secondaries/config-create.js
+++ b/ui/lib/replication/addon/routes/mode/secondaries/config-create.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import Base from '../../replication-base';
 
 export default Base.extend({
   flashMessages: service(),
+  router: service('app-router'),
 
   modelPath: 'model.config',
 
@@ -18,7 +19,8 @@ export default Base.extend({
       .findRecord('path-filter-config', id)
       .then(() => {
         // if we find a record, transition to the edit view
-        return this.transitionTo('mode.secondaries.config-edit', id)
+        return this.router
+          .transitionTo('vault.cluster.replication.mode.secondaries.config-edit', id)
           .followRedirects()
           .then(() => {
             flash.info(
@@ -45,10 +47,10 @@ export default Base.extend({
     if (
       !this.version.hasPerfReplication ||
       replicationMode !== 'performance' ||
-      !cluster.get(`${replicationMode}.isPrimary`) ||
-      !cluster.get('canAddSecondary')
+      !cluster[replicationMode].isPrimary ||
+      !cluster.canAddSecondary
     ) {
-      return this.transitionTo('mode', replicationMode);
+      return this.router.transitionTo('vault.cluster.replication.mode', replicationMode);
     }
   },
 
diff --git a/ui/lib/replication/addon/routes/mode/secondaries/config-edit.js b/ui/lib/replication/addon/routes/mode/secondaries/config-edit.js
index 89bb45c0f53..85bf39da70b 100644
--- a/ui/lib/replication/addon/routes/mode/secondaries/config-edit.js
+++ b/ui/lib/replication/addon/routes/mode/secondaries/config-edit.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -22,10 +22,10 @@ export default Base.extend({
     if (
       !this.version.hasPerfReplication ||
       replicationMode !== 'performance' ||
-      !cluster.get(`${replicationMode}.isPrimary`) ||
-      !cluster.get('canAddSecondary')
+      !cluster[replicationMode].isPrimary ||
+      !cluster.canAddSecondary
     ) {
-      return this.transitionTo('mode', replicationMode);
+      return this.router.transitionTo('vault.cluster.replication.mode', replicationMode);
     }
   },
 });
diff --git a/ui/lib/replication/addon/routes/mode/secondaries/config-show.js b/ui/lib/replication/addon/routes/mode/secondaries/config-show.js
index c7f5d717156..e850ee2243b 100644
--- a/ui/lib/replication/addon/routes/mode/secondaries/config-show.js
+++ b/ui/lib/replication/addon/routes/mode/secondaries/config-show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -29,9 +29,9 @@ export default Base.extend({
     if (
       !this.version.hasPerfReplication ||
       replicationMode !== 'performance' ||
-      !cluster.get(`${replicationMode}.isPrimary`)
+      !cluster[replicationMode].isPrimary
     ) {
-      return this.transitionTo('mode', cluster.get('name'), replicationMode);
+      return this.router.transitionTo('vault.cluster.replication.mode', cluster.name, replicationMode);
     }
   },
 });
diff --git a/ui/lib/replication/addon/routes/mode/secondaries/revoke.js b/ui/lib/replication/addon/routes/mode/secondaries/revoke.js
index ec5a1ec1bdf..df21a677b85 100644
--- a/ui/lib/replication/addon/routes/mode/secondaries/revoke.js
+++ b/ui/lib/replication/addon/routes/mode/secondaries/revoke.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,8 +12,8 @@ export default Base.extend({
 
   redirect(model) {
     const replicationMode = this.replicationMode;
-    if (!model.get(`${replicationMode}.isPrimary`) || !model.get('canRevokeSecondary')) {
-      return this.transitionTo('index');
+    if (!model[replicationMode].isPrimary || !model.canRevokeSecondary) {
+      return this.router.transitionTo('vault.cluster.replication.index');
     }
   },
 
diff --git a/ui/lib/replication/addon/routes/replication-base.js b/ui/lib/replication/addon/routes/replication-base.js
index 30c73b593b4..dfc88b4858a 100644
--- a/ui/lib/replication/addon/routes/replication-base.js
+++ b/ui/lib/replication/addon/routes/replication-base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,11 @@ import { service } from '@ember/service';
 import Route from '@ember/routing/route';
 import UnloadModelRouteMixin from 'vault/mixins/unload-model-route';
 
+/**
+ * @type Class
+ */
 export default Route.extend(UnloadModelRouteMixin, {
+  router: service('app-router'),
   store: service(),
   version: service(),
   rm: service('replication-mode'),
diff --git a/ui/lib/replication/addon/templates/application.hbs b/ui/lib/replication/addon/templates/application.hbs
index 1e8c8ad0b3f..1cf41442151 100644
--- a/ui/lib/replication/addon/templates/application.hbs
+++ b/ui/lib/replication/addon/templates/application.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Hds::SideNav::Portal @ariaLabel="Replication Navigation Links" data-test-sidebar-nav-panel="Replication" as |Nav|>
   <Nav.BackLink
diff --git a/ui/lib/replication/addon/templates/components/replication-summary.hbs b/ui/lib/replication/addon/templates/components/replication-summary.hbs
deleted file mode 100644
index 7fa582ffcb1..00000000000
--- a/ui/lib/replication/addon/templates/components/replication-summary.hbs
+++ /dev/null
@@ -1,373 +0,0 @@
-{{!
-  Copyright (c) HashiCorp, Inc.
-  SPDX-License-Identifier: BUSL-1.1
-~}}
-
-{{#if (not (has-feature "DR Replication"))}}
-  <UpgradePage @title="Replication" />
-{{else if (or this.cluster.allReplicationDisabled this.cluster.replicationAttrs.replicationDisabled)}}
-  <PageHeader as |p|>
-    <p.levelLeft>
-      <h1 class="title is-3" data-test-replication-title>
-        {{#if this.initialReplicationMode}}
-          {{#if (eq this.initialReplicationMode "dr")}}
-            Enable Disaster Recovery Replication
-          {{else if (eq this.initialReplicationMode "performance")}}
-            Enable Performance Replication
-          {{/if}}
-        {{else}}
-          Enable Replication
-        {{/if}}
-      </h1>
-    </p.levelLeft>
-  </PageHeader>
-
-  <form
-    onsubmit={{action
-      "onSubmit"
-      "enable"
-      (or this.mode "primary")
-      (hash
-        token=this.token
-        primary_cluster_addr=this.primary_cluster_addr
-        primary_api_addr=this.primary_api_addr
-        ca_file=this.ca_file
-        ca_path=this.ca_path
-        replicationMode=this.replicationMode
-      )
-    }}
-    data-test-replication-enable-form
-  >
-    <div class="box is-sideless is-fullwidth is-marginless">
-      <MessageError @errors={{this.errors}} />
-      {{#if this.initialReplicationMode}}
-        {{#if (eq this.initialReplicationMode "dr")}}
-          <h3 class="title is-flex-center is-5 is-marginless">
-            <Icon @size="24" @name="replication-direct" />
-            Disaster Recovery (DR) Replication
-          </h3>
-          <p class="help has-text-grey-dark">
-            {{replication-mode-description "dr"}}
-          </p>
-        {{else if (eq this.initialReplicationMode "performance")}}
-          <h3 class="title is-flex-center is-5 is-marginless">
-            <Icon @size="24" @name="replication-perf" />
-            Performance Replication
-          </h3>
-          {{#if (has-feature "Performance Replication")}}
-            <p class="help has-text-grey-dark">
-              {{replication-mode-description "performance"}}
-            </p>
-          {{else}}
-            <p class="help has-text-grey-dark">
-              Performance Replication is a feature of Vault Enterprise Premium
-            </p>
-          {{/if}}
-        {{/if}}
-      {{else}}
-        <p class="has-text-grey-dark box is-shadowless is-fullwidth has-slim-padding">
-          <label for="replication-mode" class="is-label is-block">
-            Type of replication
-          </label>
-          In both Performance and Disaster Recovery (DR) Replication, secondaries share the underlying configuration,
-          policies, and supporting secrets as their primary cluster.
-        </p>
-        <div class="columns">
-          <div class="column is-flex">
-            <label for="dr" class="box-label is-column {{if (eq this.replicationMode 'dr') 'is-selected'}}">
-              <div>
-                <h3 class="box-label-header title is-6">
-                  <Icon @size="24" @name="replication-direct" />
-                  Disaster Recovery (DR)
-                </h3>
-                <p class="help has-text-grey-dark">
-                  {{replication-mode-description "dr"}}
-                </p>
-              </div>
-              <div>
-                <RadioButton
-                  id="dr"
-                  name="replication-mode"
-                  @value="dr"
-                  @groupValue={{this.replicationMode}}
-                  @onChange={{fn (mut this.replicationMode)}}
-                />
-                <label for="dr" data-test-replication-type-select="dr"></label>
-              </div>
-            </label>
-          </div>
-          <div class="column is-flex">
-            <label
-              for="performance"
-              class="box-label is-column {{if (eq this.replicationMode 'performance') 'is-selected'}}"
-            >
-              <div>
-                <h3 class="box-label-header title is-6">
-                  <Icon @size="24" @name="replication-perf" />
-                  Performance
-                </h3>
-                {{#if (not (has-feature "Performance Replication"))}}
-                  <p class="help has-text-grey-dark">
-                    Performance Replication is a feature of Vault Enterprise Premium
-                  </p>
-                {{else}}
-                  <p class="help has-text-grey-dark">
-                    {{replication-mode-description "performance"}}
-                  </p>
-                {{/if}}
-              </div>
-              <div>
-                {{#if (has-feature "Performance Replication")}}
-                  <RadioButton
-                    id="performance"
-                    name="replication-mode"
-                    @value="performance"
-                    @groupValue={{this.replicationMode}}
-                    @onChange={{fn (mut this.replicationMode)}}
-                  />
-                  <label for="performance" data-test-replication-type-select="performance"></label>
-                {{/if}}
-              </div>
-            </label>
-          </div>
-        </div>
-      {{/if}}
-    </div>
-    <div class="box is-sideless is-fullwidth is-marginless">
-      <label for="replication-mode" class="is-label">
-        Cluster mode
-      </label>
-      <div class="field is-expanded">
-        <div class="control select is-fullwidth">
-          <select
-            onchange={{action (mut this.mode) value="target.value"}}
-            id="replication-mode"
-            name="replication-mode"
-            data-test-replication-cluster-mode-select={{true}}
-          >
-            {{#each (array "primary" "secondary") as |modeOption|}}
-              <option selected={{if this.mode (eq this.mode modeOption) (eq modeOption "primary")}} value={{modeOption}}>
-                {{modeOption}}
-              </option>
-            {{/each}}
-          </select>
-        </div>
-        {{#if (eq this.mode "secondary")}}
-          <AlertInline @class="has-top" @type="warning" @message="This will immediately clear all data in this cluster!" />
-        {{/if}}
-      </div>
-      {{#if (eq this.mode "primary")}}
-        {{#if this.cluster.canEnablePrimary}}
-          <div class="field">
-            <label for="primary_cluster_addr" class="is-label">
-              Primary cluster address
-              <em class="is-optional">(optional)</em>
-            </label>
-            <div class="control">
-              <Input
-                class="input"
-                id="primary_cluster_addr"
-                name="primary_cluster_addr"
-                @value={{this.primary_cluster_addr}}
-              />
-            </div>
-            <p class="help has-text-grey">
-              Overrides the cluster address that the primary gives to secondary nodes.
-            </p>
-          </div>
-        {{else}}
-          <p>
-            The token you are using is not authorized to enable primary replication.
-          </p>
-        {{/if}}
-      {{else}}
-        {{#if this.cluster.canEnableSecondary}}
-          {{#if
-            (and
-              (eq this.replicationMode "dr")
-              (not this.cluster.performance.replicationDisabled)
-              (has-feature "Performance Replication")
-            )
-          }}
-            <div>
-              <ToggleButton
-                @isOpen={{this.showExplanation}}
-                @openLabel="Disable Performance Replication in order to enable this cluster as a DR secondary."
-                @closedLabel="Disable Performance Replication in order to enable this cluster as a DR secondary."
-                @onClick={{fn (mut this.showExplanation)}}
-                class="has-text-danger"
-              />
-              {{#if this.showExplanation}}
-                <p>
-                  When running as a DR Secondary Vault is read only. For this reason, we don't allow other Replication modes
-                  to operate at the same time. This cluster is also currently operating as a Performance
-                  {{capitalize this.cluster.performance.modeForUrl}}.
-                </p>
-              {{/if}}
-            </div>
-          {{else}}
-            <div class="field">
-              <label for="secondary-token" class="is-label">
-                Secondary activation token
-              </label>
-              <div class="control">
-                <Textarea @value={{this.token}} id="secondary-token" name="secondary-token" class="textarea" />
-              </div>
-            </div>
-            <div class="field">
-              <label for="primary_api_addr" class="is-label">
-                Primary API address
-                {{#if (not (and this.token (not this.tokenIncludesAPIAddr)))}}
-                  <em class="is-optional">(optional)</em>
-                {{/if}}
-              </label>
-              <div class="control">
-                <Input @value={{this.primary_api_addr}} id="primary_api_addr" name="primary_api_addr" class="input" />
-              </div>
-              <p class="help {{if (and this.token (not this.tokenIncludesAPIAddr)) 'is-danger' 'has-text-grey'}}">
-                {{#if (and this.token (not this.tokenIncludesAPIAddr))}}
-                  The supplied token does not contain an embedded address for the primary cluster. Please enter the primary
-                  cluster's API address (normal Vault address).
-                {{else}}
-                  Set this to the API address (normal Vault address) to override the value embedded in the token.
-                {{/if}}
-              </p>
-            </div>
-            <div class="field">
-              <label for="ca_file" class="is-label">
-                CA file
-                <em class="is-optional">(optional)</em>
-              </label>
-              <div class="control">
-                <Input @value={{this.ca_file}} id="ca_file" name="ca_file" class="input" />
-              </div>
-              <p class="help has-text-grey">
-                Specifies the path to a CA root file (PEM format) that the secondary can use when unwrapping the token from
-                the primary.
-              </p>
-            </div>
-            <div class="field">
-              <label for="ca_path" class="is-label">
-                CA path
-                <em class="is-optional">(optional)</em>
-              </label>
-              <div class="control">
-                <Input @value={{this.ca_path}} id="ca_path" name="ca_file" class="input" />
-              </div>
-              <p class="help has-text-grey">
-                Specifies the path to a CA root directory containing PEM-format files that the secondary can use when
-                unwrapping the token from the primary.
-              </p>
-            </div>
-            <p>
-              Note: If both
-              <code>CA file</code>
-              and
-              <code>CA path</code>
-              are not given, they default to system CA roots.
-            </p>
-          {{/if}}
-        {{else}}
-          <p>The token you are using is not authorized to enable secondary replication.</p>
-        {{/if}}
-      {{/if}}
-    </div>
-    {{#if
-      (or
-        (and (eq this.mode "primary") this.cluster.canEnablePrimary)
-        (and (eq this.mode "secondary") this.cluster.canEnableSecondary)
-      )
-    }}
-      <div class="field is-grouped box is-fullwidth is-bottomless">
-        <Hds::Button
-          @text="Enable Replication"
-          type="submit"
-          disabled={{this.disallowEnable}}
-          data-test-replication-enable
-        />
-      </div>
-    {{/if}}
-  </form>
-{{else if this.showModeSummary}}
-  {{#if (not (and this.cluster.dr.replicationEnabled this.cluster.performance.replicationEnabled))}}
-    <PageHeader as |p|>
-      <p.levelLeft>
-        <h1 class="title is-3" data-test-replication-title>
-          Replication
-        </h1>
-      </p.levelLeft>
-    </PageHeader>
-  {{/if}}
-
-  {{#if (and (eq this.cluster.dr.mode "primary") (eq this.cluster.performance.mode "primary"))}}
-    <ReplicationPage @model={{this.cluster}} as |Page|>
-      <Page.header @showTabs={{true}} />
-      <Page.dashboard @componentToRender="replication-summary-card" as |Dashboard|>
-        <Dashboard.card @title="Disaster Recovery" />
-        <Dashboard.card @title="Performance" />
-      </Page.dashboard>
-    </ReplicationPage>
-  {{else}}
-    <div class="box is-sideless is-fullwidth is-marginless">
-      <h3 class="title is-flex-center is-5 is-marginless">
-        <Icon @size="24" @name="replication-direct" />
-        Disaster Recovery (DR)
-      </h3>
-      {{#if this.cluster.dr.replicationEnabled}}
-        {{#if this.submit.isRunning}}
-          <LayoutLoading />
-        {{else}}
-          <ReplicationModeSummary @mode="dr" @cluster={{this.cluster}} @tagName="span" />
-        {{/if}}
-      {{else}}
-        <ReplicationModeSummary @mode="dr" @cluster={{this.cluster}} @tagName="div" />
-      {{/if}}
-    </div>
-    {{#if (not (and this.submit.isRunning (eq this.cluster.dr.mode "bootstrapping")))}}
-      <div class="box is-bottomless is-fullwidth is-marginless">
-        <h3 class="title is-flex-center is-5 is-marginless">
-          <Icon @size="24" @name="replication-perf" />
-          Performance
-        </h3>
-        <ReplicationModeSummary @mode="performance" @cluster={{this.cluster}} @tagName="span" />
-      </div>
-    {{/if}}
-  {{/if}}
-{{else}}
-  {{#if (eq this.replicationAttrs.mode "initializing")}}
-    The cluster is initializing replication. This may take some time.
-  {{else}}
-    <p>{{this.cluster.replicationModeStatus.cluster_id}}</p>
-    <div class="replication">
-      <ReplicationPage @model={{this.cluster}} as |Page|>
-        <Page.dashboard
-          @data={{this.cluster}}
-          @componentToRender={{if
-            (eq this.replicationAttrs.mode "secondary")
-            "replication-secondary-card"
-            "replication-primary-card"
-          }}
-          as |Dashboard|
-        >
-          {{#if (eq this.replicationAttrs.mode "secondary")}}
-            <Dashboard.card @title="Status" />
-            <Dashboard.card @title="Primary cluster" />
-          {{else}}
-            <Dashboard.card
-              @title="State"
-              @description="The cluster’s current operating state."
-              @glyph={{get (cluster-states this.replicationAttrs.state) "glyph"}}
-              @metric={{this.replicationAttrs.state}}
-            />
-            <Dashboard.card
-              @title="Last WAL entry"
-              @description="Index of last Write Ahead Logs entry written on local storage. Updates every ten seconds."
-              @metric={{format-number this.replicationAttrs.lastWAL}}
-            />
-            <Dashboard.secondaryCard @cluster={{this.cluster}} @replicationAttrs={{this.replicationAttrs}} />
-          {{/if}}
-        </Page.dashboard>
-      </ReplicationPage>
-    </div>
-  {{/if}}
-{{/if}}
\ No newline at end of file
diff --git a/ui/lib/replication/addon/templates/index.hbs b/ui/lib/replication/addon/templates/index.hbs
index 04919c794f5..dd565c56d6c 100644
--- a/ui/lib/replication/addon/templates/index.hbs
+++ b/ui/lib/replication/addon/templates/index.hbs
@@ -1,14 +1,15 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <section class="section">
   <div class="container is-widescreen">
     {{#if (eq this.model.mode "unsupported")}}
+      {{! Replication is unsupported in non-enterprise or when using non-transactional storage (eg inmem) }}
       <PageHeader as |p|>
         <p.levelLeft>
-          <h1 class="title is-3 has-text-grey" data-test-replication-title>
+          <h1 class="title is-3 has-text-grey" data-test-replication-title="Replication unsupported">
             Replication unsupported
           </h1>
         </p.levelLeft>
@@ -16,13 +17,118 @@
       <EmptyState @title="The current cluster configuration does not support replication" />
     {{else if this.model.replicationIsInitializing}}
       <LayoutLoading />
-    {{else}}
-      <ReplicationSummary
-        @cluster={{this.model}}
-        @showModeSummary={{true}}
-        @onEnable={{action "onEnable"}}
-        @onDisable={{action "onDisable"}}
+    {{else if this.model.allReplicationDisabled}}
+      <PageHeader as |p|>
+        <p.levelLeft>
+          <h1 class="title is-3" data-test-replication-title="Enable Replication">
+            Enable Replication
+          </h1>
+        </p.levelLeft>
+      </PageHeader>
+      <div class="box is-sideless is-fullwidth is-marginless">
+        <p class="has-text-grey-dark box is-shadowless is-fullwidth has-slim-padding">
+          <label for="replication-mode" class="is-label is-block">
+            Type of replication
+          </label>
+          In both Performance and Disaster Recovery (DR) Replication, secondaries share the underlying configuration,
+          policies, and supporting secrets as their primary cluster.
+        </p>
+        <div class="columns">
+          <div class="column is-flex">
+            <label for="dr" class="box-label is-column {{if (eq this.replicationMode 'dr') 'is-selected'}}">
+              <div>
+                <h3 class="box-label-header title is-6">
+                  <Icon @size="24" @name="replication-direct" />
+                  Disaster Recovery (DR)
+                </h3>
+                <p class="help has-text-grey-dark">
+                  {{replication-mode-description "dr"}}
+                </p>
+              </div>
+              <div>
+                <RadioButton
+                  id="dr"
+                  name="replication-mode"
+                  @value="dr"
+                  @groupValue={{this.modeSelection}}
+                  @onChange={{fn (mut this.modeSelection)}}
+                />
+                <label for="dr" data-test-replication-type-select="dr"></label>
+              </div>
+            </label>
+          </div>
+          <div class="column is-flex">
+            <label for="performance" class="box-label is-column {{if (eq this.modeSelection 'performance') 'is-selected'}}">
+              <div>
+                <h3 class="box-label-header title is-6">
+                  <Icon @size="24" @name="replication-perf" />
+                  Performance
+                </h3>
+                {{#if (not (has-feature "Performance Replication"))}}
+                  <p class="help has-text-grey-dark">
+                    Performance Replication is a feature of Vault Enterprise Premium
+                  </p>
+                {{else}}
+                  <p class="help has-text-grey-dark">
+                    {{replication-mode-description "performance"}}
+                  </p>
+                {{/if}}
+              </div>
+              <div>
+                {{#if (has-feature "Performance Replication")}}
+                  <RadioButton
+                    id="performance"
+                    name="replication-mode"
+                    @value="performance"
+                    @groupValue={{this.modeSelection}}
+                    @onChange={{fn (mut this.modeSelection)}}
+                  />
+                  <label for="performance" data-test-replication-type-select="performance"></label>
+                {{/if}}
+              </div>
+            </label>
+          </div>
+        </div>
+      </div>
+      <EnableReplicationForm
+        @replicationMode={{this.modeSelection}}
+        @canEnablePrimary={{this.canEnablePrimary}}
+        @canEnableSecondary={{this.canEnableSecondary}}
+        @performanceReplicationDisabled={{this.model.performance.replicationDisabled}}
+        @performanceMode={{if this.model.performance.replicationDisabled "disabled" this.model.performance.modeForUrl}}
+        @onSuccess={{this.onEnableSuccess}}
+        @doTransition={{true}}
       />
+    {{else if (not (has-feature "DR Replication"))}}
+      <UpgradePage @title="Replication" />
+    {{else if (and (eq this.model.dr.mode "primary") (eq this.model.performance.mode "primary"))}}
+      {{! Renders when cluster is primary for both replication modes }}
+      <ReplicationPage @model={{this.model}} as |Page|>
+        <Page.header @showTabs={{true}} />
+        <Page.dashboard @componentToRender="replication-summary-card" as |Dashboard|>
+          <Dashboard.card @title="Disaster Recovery" />
+          <Dashboard.card @title="Performance" />
+        </Page.dashboard>
+      </ReplicationPage>
+    {{else}}
+      {{! Renders when at least one mode is not enabled }}
+      <PageHeader as |p|>
+        <p.levelLeft>
+          <h1 class="title is-3" data-test-replication-title="Replication">
+            Replication
+          </h1>
+        </p.levelLeft>
+      </PageHeader>
+
+      <div class="box is-sideless is-fullwidth is-marginless flex-col">
+        <ReplicationOverviewMode
+          @mode="dr"
+          @model={{this.model.dr}}
+          @clusterName={{this.model.name}}
+          class="has-bottom-margin-m"
+        />
+        <ReplicationOverviewMode @mode="performance" @model={{this.model.performance}} @clusterName={{this.model.name}} />
+      </div>
     {{/if}}
   </div>
 </section>
\ No newline at end of file
diff --git a/ui/lib/replication/addon/templates/mode.hbs b/ui/lib/replication/addon/templates/mode.hbs
index 1cd17605f8f..72aa123b6dd 100644
--- a/ui/lib/replication/addon/templates/mode.hbs
+++ b/ui/lib/replication/addon/templates/mode.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <section class="section">
   <div class="container is-widescreen">
@@ -17,11 +17,9 @@
             </Hds::Breadcrumb>
           </p.top>
           <p.levelLeft>
-            <h1 class="has-top-margin-m title is-3" data-test-replication-title={{true}}>
+            <h1 class="has-top-margin-m title is-3" data-test-replication-title={{this.model.replicationModeForDisplay}}>
               {{this.model.replicationModeForDisplay}}
-              <span class="tag is-light has-text-grey-dark" data-test-replication-mode-display={{true}}>
-                {{this.model.replicationAttrs.modeForHeader}}
-              </span>
+              <Hds::Badge @text={{this.model.replicationAttrs.modeForHeader}} data-test-replication-mode-display />
             </h1>
           </p.levelLeft>
         </PageHeader>
diff --git a/ui/lib/replication/addon/templates/mode/index.hbs b/ui/lib/replication/addon/templates/mode/index.hbs
index 1b5fae08000..d350d2ccaa8 100644
--- a/ui/lib/replication/addon/templates/mode/index.hbs
+++ b/ui/lib/replication/addon/templates/mode/index.hbs
@@ -1,6 +1,11 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<ReplicationSummary @cluster={{this.model}} @initialReplicationMode={{this.replicationMode}} />
\ No newline at end of file
+<Page::ModeIndex
+  @replicationDisabled={{this.replicationForMode.replicationDisabled}}
+  @replicationMode={{this.replicationMode}}
+  @cluster={{this.model}}
+  @onEnableSuccess={{this.onEnableSuccess}}
+/>
\ No newline at end of file
diff --git a/ui/lib/replication/addon/templates/mode/manage.hbs b/ui/lib/replication/addon/templates/mode/manage.hbs
index 4e8b0225c4a..28bef5c3ebc 100644
--- a/ui/lib/replication/addon/templates/mode/manage.hbs
+++ b/ui/lib/replication/addon/templates/mode/manage.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <ReplicationActions @model={{this.model}} @onDisable={{action "onDisable"}} @replicationMode={{this.replicationMode}} />
\ No newline at end of file
diff --git a/ui/lib/replication/addon/templates/mode/secondaries/add.hbs b/ui/lib/replication/addon/templates/mode/secondaries/add.hbs
index 9fc54ccb783..d411903c9a0 100644
--- a/ui/lib/replication/addon/templates/mode/secondaries/add.hbs
+++ b/ui/lib/replication/addon/templates/mode/secondaries/add.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <form {{action "onSubmit" "secondary-token" "primary" (hash ttl=this.ttl id=this.id) on="submit"}}>
   <div class="box is-fullwidth is-shadowless is-marginless">
@@ -25,7 +25,7 @@
         name="activation-token-id"
         id="activation-token-id"
         @value={{this.id}}
-        data-test-replication-secondary-id
+        data-test-input="Secondary ID"
       />
     </div>
     <p class="help has-text-grey">
@@ -47,7 +47,7 @@
   {{/if}}
   <hr class="has-background-gray-100" />
   <Hds::ButtonSet>
-    <Hds::Button @text="Generate token" type="submit" data-test-secondary-add />
+    <Hds::Button @text="Generate token" type="submit" data-test-submit />
     <Hds::Button @text="Cancel" @color="secondary" @route="mode.secondaries" @model={{this.model.replicationMode}} />
   </Hds::ButtonSet>
 </form>
@@ -84,18 +84,18 @@
     <M.Footer>
       <Hds::ButtonSet>
         <Hds::Copy::Button
-          data-test-modal-copy
+          data-test-button="Copy token"
           @text="Copy token"
           @textToCopy={{this.token}}
           class="primary"
           @container=".hds-modal"
           @onError={{(fn
-            (set-flash-message "Clipboard copy failed. Please make sure the browser Clipboard API is allowed." "danger")
+            (set-flash-message "Clipboard copy failed. The Clipboard API requires a secure context." "danger")
           )}}
           {{on "click" (action "onCopy")}}
         />
         <Hds::Button
-          data-test-modal-close
+          data-test-cancel
           disabled={{not this.isTokenCopied}}
           @text="Close"
           @color="secondary"
diff --git a/ui/lib/replication/addon/templates/mode/secondaries/config-create.hbs b/ui/lib/replication/addon/templates/mode/secondaries/config-create.hbs
index 1858da83be3..d9d93c14df4 100644
--- a/ui/lib/replication/addon/templates/mode/secondaries/config-create.hbs
+++ b/ui/lib/replication/addon/templates/mode/secondaries/config-create.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-fullwidth is-shadowless is-marginless">
   <h4 class="title is-5 is-marginless">
diff --git a/ui/lib/replication/addon/templates/mode/secondaries/config-edit.hbs b/ui/lib/replication/addon/templates/mode/secondaries/config-edit.hbs
index 03b5dbd18de..8da40197f1e 100644
--- a/ui/lib/replication/addon/templates/mode/secondaries/config-edit.hbs
+++ b/ui/lib/replication/addon/templates/mode/secondaries/config-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar />
 <div class="box is-fullwidth is-shadowless is-marginless">
diff --git a/ui/lib/replication/addon/templates/mode/secondaries/config-show.hbs b/ui/lib/replication/addon/templates/mode/secondaries/config-show.hbs
index b7c88505137..4eaeb774833 100644
--- a/ui/lib/replication/addon/templates/mode/secondaries/config-show.hbs
+++ b/ui/lib/replication/addon/templates/mode/secondaries/config-show.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Toolbar>
   <ToolbarActions>
@@ -16,7 +16,7 @@
     {{else}}
       <ToolbarLink
         @route="mode.secondaries.config-create"
-        @params={{this.model.config.id}}
+        @model={{this.model.config.id}}
         data-test-replication-link="create-mount-config"
       >
         Create config
diff --git a/ui/lib/replication/addon/templates/mode/secondaries/index.hbs b/ui/lib/replication/addon/templates/mode/secondaries/index.hbs
index 5f5b63cf30e..4274556f040 100644
--- a/ui/lib/replication/addon/templates/mode/secondaries/index.hbs
+++ b/ui/lib/replication/addon/templates/mode/secondaries/index.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 {{#if this.model.replicationAttrs.isPrimary}}
   <Toolbar>
@@ -22,7 +22,7 @@
   </Toolbar>
   {{#if this.model.replicationAttrs.knownSecondaries.length}}
     {{#each this.model.replicationAttrs.knownSecondaries as |secondary|}}
-      <div class="list-item-row" data-test-secondary-name={{secondary}}>
+      <div class="list-item-row overflow-wrap" data-test-secondary-name={{secondary}}>
         <div class="columns is-mobile">
           <div class="column is-10">
             {{secondary}}
@@ -38,18 +38,16 @@
                 />
                 {{#if (eq this.replicationMode "performance")}}
                   <dd.Interactive
-                    @text="Path filter config"
                     @route="mode.secondaries.config-show"
                     @models={{array this.replicationMode secondary}}
-                    data-test-replication-path-filter-link={{true}}
-                  />
+                    data-test-replication-path-filter-link
+                  >Path filter config</dd.Interactive>
                 {{/if}}
                 {{#if this.model.canRevokeSecondary}}
                   <dd.Interactive
-                    @text="Revoke"
                     @color="critical"
                     {{on "click" (fn (mut this.secondaryToRevoke) secondary)}}
-                  />
+                  >Revoke</dd.Interactive>
                 {{/if}}
               </Hds::Dropdown>
             {{/if}}
diff --git a/ui/lib/replication/addon/templates/mode/secondaries/revoke.hbs b/ui/lib/replication/addon/templates/mode/secondaries/revoke.hbs
index 1143f5170a5..f81d58a3e4f 100644
--- a/ui/lib/replication/addon/templates/mode/secondaries/revoke.hbs
+++ b/ui/lib/replication/addon/templates/mode/secondaries/revoke.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <div class="box is-fullwidth is-shadowless is-marginless">
   <h4 class="title is-5">
@@ -14,7 +14,13 @@
     Secondary ID
   </label>
   <div class="control">
-    <Input class="input" name="activation-token-id" id="activation-token-id" @value={{this.id}} />
+    <Input
+      class="input"
+      name="activation-token-id"
+      id="activation-token-id"
+      @value={{this.id}}
+      data-test-input="Secondary ID"
+    />
   </div>
   <p class="help has-text-grey">
     The secondary id to revoke; given initially to generate a secondary token.
diff --git a/ui/lib/replication/addon/utils/decode-config-from-jwt.js b/ui/lib/replication/addon/utils/decode-config-from-jwt.js
index c4d6df59eeb..bf77405bbb8 100644
--- a/ui/lib/replication/addon/utils/decode-config-from-jwt.js
+++ b/ui/lib/replication/addon/utils/decode-config-from-jwt.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/config/environment.js b/ui/lib/replication/config/environment.js
index 18bf2bc1830..ea8cbece9d3 100644
--- a/ui/lib/replication/config/environment.js
+++ b/ui/lib/replication/config/environment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/replication/index.js b/ui/lib/replication/index.js
index 2fc0366d071..d71f2a66425 100644
--- a/ui/lib/replication/index.js
+++ b/ui/lib/replication/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,6 +17,10 @@ module.exports = EngineAddon.extend({
     enabled: true,
   },
 
+  babel: {
+    plugins: [require.resolve('ember-concurrency/async-arrow-task-transform')],
+  },
+
   isDevelopingAddon() {
     return true;
   },
diff --git a/ui/lib/replication/package.json b/ui/lib/replication/package.json
index f0ae42e85e0..f8fdcd86a90 100644
--- a/ui/lib/replication/package.json
+++ b/ui/lib/replication/package.json
@@ -5,8 +5,10 @@
     "ember-engine"
   ],
   "dependencies": {
+    "ember-auto-import": "*",
     "ember-cli-htmlbars": "*",
     "ember-cli-babel": "*",
+    "ember-concurrency": "*",
     "@hashicorp/design-system-components": "*"
   },
   "ember-addon": {
diff --git a/ui/lib/service-worker-authenticated-download/index.js b/ui/lib/service-worker-authenticated-download/index.js
index 55da83b89f3..ed90f1c79e5 100644
--- a/ui/lib/service-worker-authenticated-download/index.js
+++ b/ui/lib/service-worker-authenticated-download/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/service-worker-authenticated-download/service-worker-registration/index.js b/ui/lib/service-worker-authenticated-download/service-worker-registration/index.js
index c0cd6c1b86c..c7355697891 100644
--- a/ui/lib/service-worker-authenticated-download/service-worker-registration/index.js
+++ b/ui/lib/service-worker-authenticated-download/service-worker-registration/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/service-worker-authenticated-download/service-worker/index.js b/ui/lib/service-worker-authenticated-download/service-worker/index.js
index 10387433483..c53a5e0ee75 100644
--- a/ui/lib/service-worker-authenticated-download/service-worker/index.js
+++ b/ui/lib/service-worker-authenticated-download/service-worker/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/sync/addon/components/secrets/destination-header.hbs b/ui/lib/sync/addon/components/secrets/destination-header.hbs
index 7ea9cb40b34..9dadfbe7b78 100644
--- a/ui/lib/sync/addon/components/secrets/destination-header.hbs
+++ b/ui/lib/sync/addon/components/secrets/destination-header.hbs
@@ -1,10 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <SyncHeader
-  @icon={{@destination.icon}}
+  @icon={{get (find-by "type" @destination.type (sync-destinations)) "icon"}}
   @title={{@destination.name}}
   @breadcrumbs={{array
     (hash label="Secrets Sync" route="secrets.overview")
@@ -13,29 +13,29 @@
   }}
 />
 
-{{#if @destination.purgeInitiatedAt}}
+{{#if @destination.purge_initiated_at}}
   <Hds::Alert
     data-test-delete-status-banner
     @type="inline"
     class="has-bottom-margin-m"
-    @color={{if @destination.purgeError "critical" "neutral"}}
-    @icon={{unless @destination.purgeError "loading-static"}}
+    @color={{if @destination.purge_error "critical" "neutral"}}
+    @icon={{unless @destination.purge_error "loading-static"}}
     as |A|
   >
-    {{#if @destination.purgeError}}
+    {{#if @destination.purge_error}}
       <A.Title>Deletion failed</A.Title>
       <A.Description>
         There was a problem with the delete purge initiated at
-        {{date-format @destination.purgeInitiatedAt "MMM dd, yyyy 'at' hh:mm:ss aaa"}}.
+        {{date-format @destination.purge_initiated_at "MMM dd, yyyy 'at' hh:mm:ss aaa"}}.
       </A.Description>
       <A.Description>
-        {{@destination.purgeError}}
+        {{@destination.purge_error}}
       </A.Description>
     {{else}}
       <A.Title>Deletion in progress</A.Title>
       <A.Description>
         Purge initiated on
-        {{date-format @destination.purgeInitiatedAt "MMM dd, yyyy 'at' hh:mm:ss aaa"}}. This process may take some time
+        {{date-format @destination.purge_initiated_at "MMM dd, yyyy 'at' hh:mm:ss aaa"}}. This process may take some time
         depending on how many secrets must be un-synced from this destination.
       </A.Description>
     {{/if}}
@@ -65,7 +65,7 @@
     </ToolbarFilters>
   {{/if}}
   <ToolbarActions>
-    {{#if @destination.canDelete}}
+    {{#if (has-capability @capabilities "delete" pathKey="syncDestination" params=@destination)}}
       <Hds::Button
         data-test-toolbar="Delete destination"
         @text="Delete destination"
@@ -73,11 +73,11 @@
         class="toolbar-button"
         {{on "click" (fn (mut this.isDeleteModalOpen) true)}}
       />
-      {{#if (or @destination.canSync @destination.canEdit)}}
+      {{#if (or this.showSyncBtn this.showEditBtn)}}
         <div class="toolbar-separator"></div>
       {{/if}}
     {{/if}}
-    {{#if @destination.canSync}}
+    {{#if this.showSyncBtn}}
       <Hds::Button
         data-test-toolbar="Sync secrets"
         @text="Sync secrets"
@@ -88,7 +88,7 @@
         @route="secrets.destinations.destination.sync"
       />
     {{/if}}
-    {{#if @destination.canEdit}}
+    {{#if this.showEditBtn}}
       <Hds::Button
         data-test-toolbar="Edit destination"
         @text="Edit destination"
diff --git a/ui/lib/sync/addon/components/secrets/destination-header.ts b/ui/lib/sync/addon/components/secrets/destination-header.ts
index 6da771e6155..e2a7eab7b83 100644
--- a/ui/lib/sync/addon/components/secrets/destination-header.ts
+++ b/ui/lib/sync/addon/components/secrets/destination-header.ts
@@ -1,38 +1,57 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { action } from '@ember/object';
 import { service } from '@ember/service';
-import errorMessage from 'vault/utils/error-message';
+import apiMethodResolver from 'sync/utils/api-method-resolver';
 
-import type SyncDestinationModel from 'vault/models/sync/destination';
 import type RouterService from '@ember/routing/router-service';
-import type StoreService from 'vault/services/store';
+import type PaginationService from 'vault/services/pagination';
 import type FlashMessageService from 'vault/services/flash-messages';
+import type ApiService from 'vault/services/api';
+import type CapabilitiesService from 'vault/services/capabilities';
+import type { Destination } from 'vault/sync';
+import type { CapabilitiesMap } from 'vault/app-types';
 
 interface Args {
-  destination: SyncDestinationModel;
+  destination: Destination;
+  capabilities: CapabilitiesMap;
 }
 
 export default class DestinationsTabsToolbar extends Component<Args> {
-  @service declare readonly router: RouterService;
-  @service declare readonly store: StoreService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly pagination: PaginationService;
   @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly api: ApiService;
+  @service declare readonly capabilities: CapabilitiesService;
+
+  get showSyncBtn() {
+    const { destination, capabilities } = this.args;
+    const path = this.capabilities.pathFor('syncSetAssociation', destination);
+    return capabilities[path]?.canUpdate && !destination.purge_initiated_at;
+  }
+
+  get showEditBtn() {
+    const { destination, capabilities } = this.args;
+    const path = this.capabilities.pathFor('syncDestination', destination);
+    return capabilities[path]?.canUpdate && !destination.purge_initiated_at;
+  }
 
   @action
   async deleteDestination() {
     try {
       const { destination } = this.args;
       const message = `Destination ${destination.name} has been queued for deletion.`;
-      await destination.destroyRecord();
-      this.store.clearDataset('sync/destination');
+      const method = apiMethodResolver('delete', destination.type);
+      await this.api.sys[method](destination.name, {});
       this.router.transitionTo('vault.cluster.sync.secrets.overview');
       this.flashMessages.success(message);
     } catch (error) {
-      this.flashMessages.danger(`Error deleting destination \n ${errorMessage(error)}`);
+      const { message } = await this.api.parseError(error);
+      this.flashMessages.danger(`Error deleting destination \n ${message}`);
     }
   }
 }
diff --git a/ui/lib/sync/addon/components/secrets/landing-cta.hbs b/ui/lib/sync/addon/components/secrets/landing-cta.hbs
index c7a3096bc1a..bb7d400f6e0 100644
--- a/ui/lib/sync/addon/components/secrets/landing-cta.hbs
+++ b/ui/lib/sync/addon/components/secrets/landing-cta.hbs
@@ -1,36 +1,34 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
+
+<SyncHeader @title="Secrets Sync">
+  <:actions>
+    {{! Only allow users who have activated the feature to create a destination. }}
+    {{#if @isActivated}}
+      <Hds::Button @text="Create first destination" @route="secrets.destinations.create" data-test-cta-button />
+    {{/if}}
+  </:actions>
+</SyncHeader>
 
 <div class="box is-fullwidth is-sideless is-flex-between is-shadowless" data-test-cta-container>
-  {{#if this.version.isEnterprise}}
-    <p>
-      Sync secrets to platforms and tools across your stack to get secrets when and where you need them.
-      <Hds::Link::Standalone
-        @icon="learn-link"
-        @text="Secrets sync tutorial"
-        @href={{doc-link "/vault/tutorials/enterprise/secrets-sync"}}
-        data-test-cta-doc-link
-      />
-    </p>
-  {{else}}
-    <p>
-      This enterprise feature allows you to sync secrets to platforms and tools across your stack to get secrets when and
-      where you need them.
-      <Hds::Link::Standalone
-        @text="Learn more about secrets sync"
-        @icon="docs-link"
-        @iconPosition="trailing"
-        @isHrefExternal={{true}}
-        @href={{doc-link "/vault/tutorials/enterprise/secrets-sync"}}
-        data-test-cta-doc-link
-      />
-    </p>
-  {{/if}}
+  {{! One cta message regardless of OSS vs Enterprise with/without secrets sync or managed cluster. }}
+  <p>
+    This feature allows you to sync secrets to platforms and tools across your stack to get secrets when and where you need
+    them.
+    <Hds::Link::Standalone
+      @text="Learn more about Secrets Sync"
+      @icon="docs-link"
+      @iconPosition="trailing"
+      @isHrefExternal={{true}}
+      @href={{doc-link "/vault/tutorials/enterprise/secrets-sync"}}
+      data-test-cta-doc-link
+    />
+  </p>
 </div>
 
-<div class="is-flex-row has-gap-l has-bottom-margin-m">
+<div class="is-flex-row gap-24 has-bottom-margin-m">
   <div>
     <img src={{img-path "~/sync-landing-1.png"}} alt="Secrets sync destinations diagram" aria-describedby="sync-step-1" />
     <p id="sync-step-1" class="has-top-margin-m">
diff --git a/ui/lib/sync/addon/components/secrets/landing-cta.ts b/ui/lib/sync/addon/components/secrets/landing-cta.ts
deleted file mode 100644
index 1ec4682fa30..00000000000
--- a/ui/lib/sync/addon/components/secrets/landing-cta.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Component from '@glimmer/component';
-import { service } from '@ember/service';
-
-import type VersionService from 'vault/services/version';
-
-export default class SyncLandingCtaComponent extends Component {
-  @service declare readonly version: VersionService;
-}
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations.hbs b/ui/lib/sync/addon/components/secrets/page/destinations.hbs
index 4fc03ba6338..2ba426a26de 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations.hbs
+++ b/ui/lib/sync/addon/components/secrets/page/destinations.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <SyncHeader @title="Secrets Sync" />
 
@@ -23,6 +23,7 @@
       @selectLimit={{1}}
       @disallowNewItems={{true}}
       @placeholder="Filter by type"
+      @ariaLabel="Filter by type"
       @inputValue={{if this.typeFilterName (array this.typeFilterName)}}
       @onChange={{fn this.onFilterChange "type"}}
       class="is-marginless"
@@ -30,12 +31,11 @@
     />
     <div class="has-left-margin-s">
       <FilterInput
-        id="name-filter"
+        @id="name-filter"
         aria-label="Filter by name"
         placeholder="Filter by name"
-        value={{@nameFilter}}
+        @value={{@nameFilter}}
         data-test-filter="name"
-        @autofocus={{true}}
         @onInput={{fn this.onFilterChange "name"}}
       />
     </div>
@@ -63,7 +63,7 @@
             </span>
           </div>
           <code class="has-text-grey is-size-8" data-test-destination-type={{index}}>
-            {{destination.typeDisplayName}}
+            {{destination.type_display_name}}
           </code>
         </Item.content>
 
@@ -75,34 +75,31 @@
               @hasChevron={{false}}
               data-test-popup-menu-trigger
             />
-            {{#if destination.destinationPath.isLoading}}
-              <dd.Generic class="has-text-center">
-                <LoadingDropdownOption />
-              </dd.Generic>
-            {{else}}
+            <dd.Interactive
+              data-test-popup-menu="details"
+              @route="secrets.destinations.destination.details"
+              @models={{array destination.type destination.name}}
+              @disabled={{not (has-capability @capabilities "read" pathKey="syncDestination" params=destination)}}
+            >
+              Details
+            </dd.Interactive>
+            {{#if (has-capability @capabilities "update" pathKey="syncDestination" params=destination)}}
               <dd.Interactive
-                @text="Details"
-                data-test-details
-                @route="secrets.destinations.destination.details"
+                data-test-popup-menu="edit"
+                @route="secrets.destinations.destination.edit"
                 @models={{array destination.type destination.name}}
-                @disabled={{not destination.canRead}}
-              />
-              {{#if destination.canEdit}}
-                <dd.Interactive
-                  @text="Edit"
-                  data-test-edit
-                  @route="secrets.destinations.destination.edit"
-                  @models={{array destination.type destination.name}}
-                />
-              {{/if}}
-              {{#if destination.canDelete}}
-                <dd.Interactive
-                  data-test-delete
-                  @text="Delete"
-                  @color="critical"
-                  {{on "click" (fn (mut this.destinationToDelete) destination)}}
-                />
-              {{/if}}
+              >
+                Edit
+              </dd.Interactive>
+            {{/if}}
+            {{#if (has-capability @capabilities "delete" pathKey="syncDestination" params=destination)}}
+              <dd.Interactive
+                data-test-popup-menu="delete"
+                @color="critical"
+                {{on "click" (fn (mut this.destinationToDelete) destination)}}
+              >
+                Delete
+              </dd.Interactive>
             {{/if}}
           </Hds::Dropdown>
         </Item.menu>
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations.ts b/ui/lib/sync/addon/components/secrets/page/destinations.ts
index d2dff4a3cd0..29131ff872c 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations.ts
+++ b/ui/lib/sync/addon/components/secrets/page/destinations.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,31 +7,34 @@ import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
-import { getOwner } from '@ember/application';
-import errorMessage from 'vault/utils/error-message';
+import { getOwner } from '@ember/owner';
 import { findDestination, syncDestinations } from 'core/helpers/sync-destinations';
 import { next } from '@ember/runloop';
+import apiMethodResolver from 'sync/utils/api-method-resolver';
 
-import type SyncDestinationModel from 'vault/vault/models/sync/destination';
 import type RouterService from '@ember/routing/router-service';
-import type StoreService from 'vault/services/store';
+import type PaginationService from 'vault/services/pagination';
 import type FlashMessageService from 'vault/services/flash-messages';
-import type { EngineOwner } from 'vault/vault/app-types';
-import type { SyncDestinationName, SyncDestinationType } from 'vault/vault/helpers/sync-destinations';
+import type { CapabilitiesMap, EngineOwner } from 'vault/app-types';
+import type { DestinationName, DestinationType, ListDestination } from 'vault/sync';
 import type Transition from '@ember/routing/transition';
+import type { PaginatedMetadata } from 'core/utils/paginate-list';
+import type ApiService from 'vault/services/api';
 
 interface Args {
-  destinations: Array<SyncDestinationModel>;
-  nameFilter: SyncDestinationName;
-  typeFilter: SyncDestinationType;
+  capabilities: CapabilitiesMap;
+  destinations: ListDestination & PaginatedMetadata[];
+  nameFilter: DestinationName;
+  typeFilter: DestinationType;
 }
 
 export default class SyncSecretsDestinationsPageComponent extends Component<Args> {
-  @service declare readonly router: RouterService;
-  @service declare readonly store: StoreService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly pagination: PaginationService;
   @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly api: ApiService;
 
-  @tracked destinationToDelete: SyncDestinationModel | null = null;
+  @tracked destinationToDelete: ListDestination | null = null;
   // for some reason there isn't a full page refresh happening when transitioning on filter change
   // when the transition happens it causes the FilterInput component to lose focus since it can only focus on didInsert
   // to work around this, verify that a transition from this route was completed and then focus the input
@@ -41,8 +44,8 @@ export default class SyncSecretsDestinationsPageComponent extends Component<Args
   }
 
   willDestroy(): void {
-    super.willDestroy();
     this.router.off('routeDidChange', this.focusNameFilter);
+    super.willDestroy();
   }
 
   focusNameFilter(transition?: Transition) {
@@ -54,7 +57,8 @@ export default class SyncSecretsDestinationsPageComponent extends Component<Args
 
   // typeFilter arg comes in as destination type but we need to pass the destination display name into the SearchSelect
   get typeFilterName() {
-    return findDestination(this.args.typeFilter)?.name;
+    const { typeFilter } = this.args;
+    return typeFilter ? findDestination(typeFilter).name : undefined;
   }
 
   get destinationTypes() {
@@ -93,16 +97,17 @@ export default class SyncSecretsDestinationsPageComponent extends Component<Args
   }
 
   @action
-  async onDelete(destination: SyncDestinationModel) {
+  async onDelete(destination: ListDestination) {
     try {
       const { name } = destination;
       const message = `Destination ${name} has been queued for deletion.`;
-      await destination.destroyRecord();
-      this.store.clearDataset('sync/destination');
+      const method = apiMethodResolver('delete', destination.type);
+      await this.api.sys[method](destination.name, {});
       this.router.transitionTo('vault.cluster.sync.secrets.overview');
       this.flashMessages.success(message);
     } catch (error) {
-      this.flashMessages.danger(`Error deleting destination \n ${errorMessage(error)}`);
+      const { message } = await this.api.parseError(error);
+      this.flashMessages.danger(`Error deleting destination \n ${message}`);
     } finally {
       this.destinationToDelete = null;
     }
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations/create-and-edit.hbs b/ui/lib/sync/addon/components/secrets/page/destinations/create-and-edit.hbs
index 5593fa59117..f51dad0b027 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations/create-and-edit.hbs
+++ b/ui/lib/sync/addon/components/secrets/page/destinations/create-and-edit.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <SyncHeader @title={{this.header.title}} @breadcrumbs={{this.header.breadcrumbs}} />
 
@@ -9,41 +9,51 @@
 
 <form {{on "submit" (perform this.save)}} class="has-top-margin-l">
   <MessageError @errorMessage={{this.error}} />
-
-  {{#each @destination.formFieldGroups as |fieldGroup|}}
+  {{#each @form.formFieldGroups as |fieldGroup|}}
     {{#each-in fieldGroup as |group fields|}}
-      {{#if (and (eq group "Credentials") (not @destination.isNew))}}
+      {{#if (not-eq group "default")}}
         <hr class="has-top-margin-xl has-bottom-margin-l has-background-gray-200" />
-        <Hds::Text::Display @tag="h2" @size="400" @weight="bold">Credentials</Hds::Text::Display>
-        <Hds::Text::Body @tag="p" @size="100" @color="faint" class="has-bottom-margin-m">
-          Connection credentials are sensitive information and the value cannot be read. Enable the input to update.
+        <Hds::Text::Display
+          @tag="h2"
+          @size="400"
+          @weight="bold"
+          data-test-destination-header={{group}}
+        >{{group}}</Hds::Text::Display>
+        <Hds::Text::Body
+          @tag="p"
+          @size="100"
+          @color="faint"
+          class="has-bottom-margin-m"
+          data-test-destination-subText={{group}}
+        >
+          {{this.groupSubtext group @form.isNew}}
         </Hds::Text::Body>
-        {{#each fields as |attr|}}
+      {{/if}}
+      {{#each fields as |attr|}}
+        {{#if (and (eq group "Credentials") (not @form.isNew))}}
           <EnableInput data-test-enable-field={{attr.name}} class="field" @attr={{attr}}>
-            <FormField @attr={{attr}} @model={{@destination}} @modelValidations={{this.modelValidations}} />
+            <FormField @attr={{attr}} @model={{@form}} @modelValidations={{this.modelValidations}} />
           </EnableInput>
-        {{/each}}
-      {{else}}
-        {{#each fields as |attr|}}
+        {{else}}
           <FormField
             @attr={{attr}}
-            @model={{@destination}}
+            @model={{@form}}
             @modelValidations={{this.modelValidations}}
             @onKeyUp={{this.updateWarningValidation}}
           />
-        {{/each}}
-      {{/if}}
+        {{/if}}
+      {{/each}}
     {{/each-in}}
   {{/each}}
 
   <hr class="has-background-gray-200 has-top-margin-l" />
   <Hds::ButtonSet class="has-bottom-margin-m">
     <Hds::Button
-      @text={{if @model.isNew "Create destination" "Save"}}
+      @text={{if @form.isNew "Create destination" "Save"}}
       @icon={{if this.save.isRunning "loading"}}
       type="submit"
       disabled={{this.save.isRunning}}
-      data-test-save
+      data-test-submit
     />
     <Hds::Button
       @text="Cancel"
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations/create-and-edit.ts b/ui/lib/sync/addon/components/secrets/page/destinations/create-and-edit.ts
index 35d7d4221e7..f768eccfbdd 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations/create-and-edit.ts
+++ b/ui/lib/sync/addon/components/secrets/page/destinations/create-and-edit.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,30 +9,49 @@ import { tracked } from '@glimmer/tracking';
 import { task } from 'ember-concurrency';
 import { waitFor } from '@ember/test-waiters';
 import { service } from '@ember/service';
-import errorMessage from 'vault/utils/error-message';
+import { findDestination } from 'core/helpers/sync-destinations';
+import apiMethodResolver from 'sync/utils/api-method-resolver';
 
-import type SyncDestinationModel from 'vault/models/sync/destination';
-import { ValidationMap } from 'vault/vault/app-types';
+import type { ValidationMap } from 'vault/app-types';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type RouterService from '@ember/routing/router-service';
-import type StoreService from 'vault/services/store';
+import type ApiService from 'vault/services/api';
+import type { DestinationForm, DestinationType } from 'vault/sync';
+import type Owner from '@ember/owner';
 
 interface Args {
-  destination: SyncDestinationModel;
+  type: DestinationType;
+  form: DestinationForm;
 }
 
 export default class DestinationsCreateForm extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
-  @service declare readonly store: StoreService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly api: ApiService;
 
   @tracked modelValidations: ValidationMap | null = null;
   @tracked invalidFormMessage = '';
   @tracked error = '';
 
+  declare readonly initialCustomTags?: Record<string, string>;
+
+  constructor(owner: Owner, args: Args) {
+    super(owner, args);
+    // cache initial custom tags value to compare against updates
+    // tags that are removed when editing need to be added to the payload
+    // cast type here since not all types have custom_tags
+    const { custom_tags } = args.form.data as unknown as Record<string, unknown>;
+    if (custom_tags) {
+      this.initialCustomTags = { ...custom_tags };
+    }
+  }
+
   get header() {
-    const { isNew, typeDisplayName, name } = this.args.destination;
-    return isNew
+    const { type, form } = this.args;
+    const { name: typeDisplayName } = findDestination(type);
+    const { name } = form.data;
+
+    return form.isNew
       ? {
           title: `Create Destination for ${typeDisplayName}`,
           breadcrumbs: [
@@ -49,64 +68,87 @@ export default class DestinationsCreateForm extends Component<Args> {
             {
               label: 'Destination',
               route: 'secrets.destinations.destination.secrets',
-              model: this.args.destination,
+              model: { name, type },
             },
             { label: 'Edit Destination' },
           ],
         };
   }
 
-  @task
-  @waitFor
-  *save(event: Event) {
-    event.preventDefault();
-    this.error = '';
-    // clear out validation warnings
-    this.modelValidations = null;
-    const { destination } = this.args;
-    const { isValid, state, invalidFormMessage } = destination.validate();
-
-    this.modelValidations = isValid ? null : state;
-    this.invalidFormMessage = isValid ? '' : invalidFormMessage;
-
-    if (isValid) {
-      try {
-        // we only want to save if there are changes
-        if (destination.dirtyType as unknown as string) {
-          const verb = destination.isNew ? 'created' : 'updated';
-          yield destination.save();
-          this.flashMessages.success(`Successfully ${verb} the destination ${destination.name}`);
-          // when saving a record the server returns all credentials as ******
-          // Ember Data observes this as a change, marks the model as dirty and the field will be returned from changedAttributes
-          // if the user then attempts to update the record the credential will get overwritten with the masked placeholder value
-          // since the record will be fetched from the details route we can safely unload it to avoid the aforementioned issue
-          destination.unloadRecord();
-          this.store.clearDataset('sync/destination');
-        }
-        this.router.transitionTo(
-          'vault.cluster.sync.secrets.destinations.destination.details',
-          destination.type,
-          destination.name
-        );
-      } catch (error) {
-        this.error = errorMessage(error, 'Error saving destination. Please try again or contact support.');
+  groupSubtext(group: string, isNew: boolean) {
+    const dynamicText = isNew
+      ? 'used to authenticate with the destination'
+      : 'and the value cannot be read. Enable the input to update';
+    switch (group) {
+      case 'Advanced configuration':
+        return 'Configuration options for the destination.';
+      case 'Credentials':
+        return `Connection credentials are sensitive information ${dynamicText}.`;
+      default:
+        return '';
+    }
+  }
+
+  diffCustomTags(payload: Record<string, unknown>) {
+    // if tags were removed we need to add them to the payload
+    const { isNew } = this.args.form;
+    const { custom_tags } = payload;
+    if (!isNew && custom_tags && this.initialCustomTags) {
+      // compare the new and old keys of custom_tags object to determine which need to be removed
+      const oldKeys = Object.keys(this.initialCustomTags).filter(
+        (k) => !Object.keys(custom_tags).includes(k)
+      );
+      // add tags_to_remove to the payload if there is a diff
+      if (oldKeys.length > 0) {
+        payload['tags_to_remove'] = oldKeys;
       }
     }
   }
 
+  save = task(
+    waitFor(async (event: Event) => {
+      event.preventDefault();
+      this.error = '';
+      // clear out validation warnings
+      this.modelValidations = null;
+
+      const { form, type } = this.args;
+      const { name } = form.data;
+      const { isValid, state, invalidFormMessage, data } = form.toJSON();
+
+      this.modelValidations = isValid ? null : state;
+      this.invalidFormMessage = isValid ? '' : invalidFormMessage;
+
+      if (isValid) {
+        try {
+          const payload = data as unknown as Record<string, unknown>;
+          this.diffCustomTags(payload);
+          const method = apiMethodResolver(form.isNew ? 'write' : 'patch', type);
+          await this.api.sys[method](name, payload);
+
+          this.router.transitionTo('vault.cluster.sync.secrets.destinations.destination.details', type, name);
+        } catch (error) {
+          const { message } = await this.api.parseError(
+            error,
+            'Error saving destination. Please try again or contact support.'
+          );
+          this.error = message;
+        }
+      }
+    })
+  );
+
   @action
   updateWarningValidation() {
-    if (this.args.destination.isNew) return;
+    if (this.args.form.isNew) return;
     // check for warnings on change
-    const { state } = this.args.destination.validate();
+    const { state } = this.args.form.toJSON();
     this.modelValidations = state;
   }
 
   @action
   cancel() {
-    const { isNew } = this.args.destination;
-    const method = isNew ? 'unloadRecord' : 'rollbackAttributes';
-    this.args.destination[method]();
-    this.router.transitionTo(`vault.cluster.sync.secrets.destinations.${isNew ? 'create' : 'destination'}`);
+    const route = this.args.form.isNew ? 'create' : 'destination';
+    this.router.transitionTo(`vault.cluster.sync.secrets.destinations.${route}`);
   }
 }
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations/destination/details.hbs b/ui/lib/sync/addon/components/secrets/page/destinations/destination/details.hbs
index 137e510ee6a..95d3cb94c3c 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations/destination/details.hbs
+++ b/ui/lib/sync/addon/components/secrets/page/destinations/destination/details.hbs
@@ -1,17 +1,16 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Secrets::DestinationHeader @destination={{@destination}} />
-
-{{#each @destination.formFields as |field|}}
-  {{#let (get @destination field.name) as |fieldValue|}}
-    {{#if (includes field.name @destination.maskedParams)}}
-      <InfoTableRow @label={{or field.options.label (to-label field.name)}}>
+<Secrets::DestinationHeader @destination={{@destination}} @capabilities={{@capabilities}} />
+{{#each this.displayFields as |field|}}
+  {{#let (get @destination field) as |fieldValue|}}
+    {{#if (this.isMasked field)}}
+      <InfoTableRow @label={{this.fieldLabel field}}>
         <Hds::Badge @text={{this.credentialValue fieldValue}} @icon="check-circle" @color="success" />
       </InfoTableRow>
-    {{else if (eq field.name "customTags")}}
+    {{else if (eq field "options.custom_tags")}}
       {{#unless (is-empty-value fieldValue)}}
         <Hds::Text::Display @tag="h3" @size="300" @weight="semibold" class="has-top-margin-l" data-test-section-header>
           Custom tags
@@ -21,7 +20,7 @@
         <InfoTableRow @alwaysRender={{false}} @label={{key}} @value={{value}} />
       {{/each-in}}
     {{else}}
-      <InfoTableRow @label={{or field.options.label (to-label field.name)}} @value={{fieldValue}} />
+      <InfoTableRow @label={{this.fieldLabel field}} @value={{fieldValue}} />
     {{/if}}
   {{/let}}
 {{/each}}
\ No newline at end of file
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations/destination/details.ts b/ui/lib/sync/addon/components/secrets/page/destinations/destination/details.ts
index 3e70f12f3b8..cf7c42e7f72 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations/destination/details.ts
+++ b/ui/lib/sync/addon/components/secrets/page/destinations/destination/details.ts
@@ -1,16 +1,76 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
+import { findDestination } from 'core/helpers/sync-destinations';
+import { toLabel } from 'core/helpers/to-label';
+
+import type { Destination } from 'vault/sync';
+import type { CapabilitiesMap } from 'vault/app-types';
 
-import type SyncDestinationModel from 'vault/models/sync/destination';
 interface Args {
-  destination: SyncDestinationModel;
+  destination: Destination;
+  capabilities: CapabilitiesMap;
 }
 
 export default class DestinationDetailsPage extends Component<Args> {
+  connectionDetailsMap = {
+    'aws-sm': ['region', 'access_key_id', 'secret_access_key', 'role_arn', 'external_id'],
+    'azure-kv': ['key_vault_uri', 'tenant_id', 'cloud', 'client_id', 'client_secret'],
+    'gcp-sm': ['project_id', 'credentials'],
+    gh: ['repository_owner', 'repository_name', 'access_token'],
+    'vercel-project': ['access_token', 'project_id', 'team_id', 'deployment_environments'],
+  };
+
+  get displayFields() {
+    const { destination } = this.args;
+    const type = destination.type as keyof typeof this.connectionDetailsMap;
+    const connectionDetails = this.connectionDetailsMap[type].map((field) => `connection_details.${field}`);
+    const fields = [
+      'name',
+      ...connectionDetails,
+      'options.granularity_level',
+      'options.secret_name_template',
+    ];
+
+    if (!['gh', 'vercel-project'].includes(type)) {
+      fields.push('options.custom_tags');
+    }
+
+    return fields;
+  }
+
+  // remove connection_details or options from the field name
+  fieldName(field: string) {
+    return field.replace(/(connection_details|options)\./, '');
+  }
+
+  fieldLabel = (field: string) => {
+    const fieldName = this.fieldName(field);
+    // some fields have a specific label that cannot be converted from key name
+    const customLabel = {
+      granularity_level: 'Secret sync granularity',
+      access_key_id: 'Access key ID',
+      role_arn: 'Role ARN',
+      external_id: 'External ID',
+      key_vault_uri: 'Key Vault URI',
+      client_id: 'Client ID',
+      tenant_id: 'Tenant ID',
+      project_id: 'Project ID',
+      credentials: 'JSON credentials',
+      team_id: 'Team ID',
+    }[fieldName];
+
+    return customLabel || toLabel([fieldName]);
+  };
+
+  isMasked = (field: string) => {
+    const { maskedParams = [] } = findDestination(this.args.destination.type);
+    return maskedParams.includes(this.fieldName(field));
+  };
+
   credentialValue = (value: string) => {
     // if this value is empty, a destination uses globally set environment variables
     return value ? 'Destination credentials added' : 'Using environment variable';
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations/destination/secrets.hbs b/ui/lib/sync/addon/components/secrets/page/destinations/destination/secrets.hbs
index d5688737254..28b1a99c484 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations/destination/secrets.hbs
+++ b/ui/lib/sync/addon/components/secrets/page/destinations/destination/secrets.hbs
@@ -1,9 +1,13 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Secrets::DestinationHeader @destination={{@destination}} @refreshList={{this.refreshRoute}} />
+<Secrets::DestinationHeader
+  @destination={{@destination}}
+  @capabilities={{@capabilities}}
+  @refreshList={{this.refreshRoute}}
+/>
 
 {{#if @associations.meta.filteredTotal}}
   <div class="has-bottom-margin-s">
@@ -17,17 +21,19 @@
             <LinkToExternal
               data-test-association-name={{index}}
               class="has-text-black has-text-weight-semibold"
-              @route="kvSecretDetails"
-              @models={{array association.mount association.secretName}}
-            >{{association.secretName}}</LinkToExternal>
-            {{#if association.subKey}}
-              <Hds::Badge @text="secret key: {{association.subKey}}/" />
+              @route="kvSecretOverview"
+              @models={{array association.mount association.secret_name}}
+            >
+              {{association.secret_name}}
+            </LinkToExternal>
+            {{#if association.sub_key}}
+              <Hds::Badge @text="secret key: {{association.sub_key}}/" />
             {{/if}}
             <div>
-              <SyncStatusBadge @status={{association.syncStatus}} data-test-association-status={{index}} />
+              <SyncStatusBadge @status={{association.sync_status}} data-test-association-status={{index}} />
               <code class="has-text-grey is-size-8" data-test-association-updated={{index}}>
                 last updated on
-                {{date-format association.updatedAt "MMMM do yyyy, h:mm:ss a"}}
+                {{date-format association.updated_at "MMMM do yyyy, h:mm:ss a"}}
               </code>
             </div>
           </div>
@@ -41,39 +47,33 @@
               @hasChevron={{false}}
               data-test-popup-menu-trigger
             />
-            {{#if (or association.setAssociationPath.isLoading association.removeAssociationPath.isLoading)}}
-              <dd.Generic class="has-text-center">
-                <LoadingDropdownOption />
-              </dd.Generic>
-            {{else}}
-              {{#if (eq @destination.granularity "secret-key")}}
-                <dd.Description
-                  @text='Sync or unsync actions will apply to the secret "{{association.secretName}}" and not this individual key.'
-                />
-                <dd.Separator />
-              {{/if}}
-              {{#if association.canSync}}
-                <dd.Interactive
-                  @text="Sync now"
-                  data-test-association-action="sync"
-                  {{on "click" (fn this.update association "set")}}
-                />
-              {{/if}}
-              <dd.Interactive
-                @text="View secret"
-                data-test-association-action="view"
-                @route="kvSecretDetails"
-                @isRouteExternal={{true}}
-                @models={{array association.mount association.secretName}}
+            {{#if (eq @destination.options.granularity_level "secret-key")}}
+              <dd.Description
+                @text='Sync or unsync actions will apply to the secret "{{association.secret_name}}" and not this individual key.'
               />
-              {{#if association.canUnsync}}
-                <dd.Interactive
-                  data-test-association-action="unsync"
-                  @color="critical"
-                  @text="Unsync"
-                  {{on "click" (fn (mut this.secretToUnsync) association)}}
-                />
-              {{/if}}
+              <dd.Separator />
+            {{/if}}
+            {{#if (has-capability @capabilities "update" pathKey="syncSetAssociation" params=@destination)}}
+              <dd.Interactive data-test-association-action="sync" {{on "click" (fn this.update association "set")}}>
+                Sync now
+              </dd.Interactive>
+            {{/if}}
+            <dd.Interactive
+              data-test-association-action="view"
+              @route="kvSecretOverview"
+              @isRouteExternal={{true}}
+              @models={{array association.mount association.secret_name}}
+            >
+              View secret
+            </dd.Interactive>
+            {{#if (has-capability @capabilities "update" pathKey="syncRemoveAssociation" params=@destination)}}
+              <dd.Interactive
+                data-test-association-action="unsync"
+                @color="critical"
+                {{on "click" (fn (mut this.secretToUnsync) association)}}
+              >
+                Unsync
+              </dd.Interactive>
             {{/if}}
           </Hds::Dropdown>
         </Item.menu>
@@ -107,7 +107,7 @@
 {{#if this.secretToUnsync}}
   <ConfirmModal
     @color="critical"
-    @confirmMessage='The secret "{{this.secretToUnsync.secretName}}" will be unsynced from this destination.'
+    @confirmMessage='The secret "{{this.secretToUnsync.secret_name}}" will be unsynced from this destination.'
     @onClose={{fn (mut this.secretToUnsync) null}}
     @onConfirm={{fn this.update this.secretToUnsync "remove"}}
   />
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations/destination/secrets.ts b/ui/lib/sync/addon/components/secrets/page/destinations/destination/secrets.ts
index 2e4a1e6ed58..dacacc09f88 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations/destination/secrets.ts
+++ b/ui/lib/sync/addon/components/secrets/page/destinations/destination/secrets.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,27 +7,26 @@ import Component from '@glimmer/component';
 import { service } from '@ember/service';
 import { action } from '@ember/object';
 import { tracked } from '@glimmer/tracking';
-import { getOwner } from '@ember/application';
-import errorMessage from 'vault/utils/error-message';
+import { getOwner } from '@ember/owner';
 
-import SyncDestinationModel from 'vault/vault/models/sync/destination';
-import type SyncAssociationModel from 'vault/vault/models/sync/association';
 import type RouterService from '@ember/routing/router-service';
-import type StoreService from 'vault/services/store';
+import type ApiService from 'vault/services/api';
 import type FlashMessageService from 'vault/services/flash-messages';
-import type { EngineOwner } from 'vault/vault/app-types';
+import type { EngineOwner, CapabilitiesMap } from 'vault/app-types';
+import type { Destination, AssociatedSecret } from 'vault/sync';
 
 interface Args {
-  destination: SyncDestinationModel;
-  associations: Array<SyncAssociationModel>;
+  destination: Destination;
+  associations: AssociatedSecret[];
+  capabilities: CapabilitiesMap;
 }
 
 export default class SyncSecretsDestinationsPageComponent extends Component<Args> {
-  @service declare readonly router: RouterService;
-  @service declare readonly store: StoreService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly api: ApiService;
   @service declare readonly flashMessages: FlashMessageService;
 
-  @tracked secretToUnsync: SyncAssociationModel | null = null;
+  @tracked secretToUnsync: AssociatedSecret | null = null;
 
   get mountPoint(): string {
     const owner = getOwner(this) as EngineOwner;
@@ -41,7 +40,6 @@ export default class SyncSecretsDestinationsPageComponent extends Component<Args
   @action
   refreshRoute() {
     // refresh route to update displayed secrets
-    this.store.clearDataset('sync/association');
     this.router.transitionTo(
       'vault.cluster.sync.secrets.destinations.destination.secrets',
       this.args.destination.type,
@@ -50,13 +48,22 @@ export default class SyncSecretsDestinationsPageComponent extends Component<Args
   }
 
   @action
-  async update(association: SyncAssociationModel, operation: string) {
+  async update(association: AssociatedSecret, operation: string) {
     try {
-      await association.save({ adapterOptions: { action: operation } });
+      const { name, type } = this.args.destination;
+      const { mount, secret_name } = association;
+      const body = { mount, secret_name };
+
+      if (operation === 'set') {
+        await this.api.sys.systemWriteSyncDestinationsTypeNameAssociationsSet(name, type, body);
+      } else {
+        await this.api.sys.systemWriteSyncDestinationsTypeNameAssociationsRemove(name, type, body);
+      }
       const action: string = operation === 'set' ? 'Sync' : 'Unsync';
       this.flashMessages.success(`${action} operation initiated.`);
     } catch (error) {
-      this.flashMessages.danger(`Sync operation error: \n ${errorMessage(error)}`);
+      const { message } = await this.api.parseError(error);
+      this.flashMessages.danger(`Sync operation error: \n ${message}`);
     } finally {
       this.secretToUnsync = null;
       this.refreshRoute();
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations/destination/sync.hbs b/ui/lib/sync/addon/components/secrets/page/destinations/destination/sync.hbs
index 71b5cc80ae7..0612063799a 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations/destination/sync.hbs
+++ b/ui/lib/sync/addon/components/secrets/page/destinations/destination/sync.hbs
@@ -1,11 +1,11 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <SyncHeader
   @title="Sync Secrets to {{@destination.name}}"
-  @icon={{@destination.icon}}
+  @icon={{get (find-by "type" @destination.type (sync-destinations)) "icon"}}
   @breadcrumbs={{array
     (hash label="Secrets Sync" route="secrets.overview")
     (hash label="Destinations" route="secrets.destinations")
@@ -24,7 +24,7 @@
         Sync operation successfully initiated for
         <Hds::Link::Inline
           @isRouteExternal={{true}}
-          @route="kvSecretDetails"
+          @route="kvSecretOverview"
           @models={{array this.mountPath this.syncedSecret}}
         >{{this.syncedSecret}}</Hds::Link::Inline>. You can continue on this page to sync more secrets.
       </A.Description>
@@ -36,7 +36,7 @@
     <p class="is-label">Which secrets would you like us to sync?</p>
     <p class="sub-text">
       Select a KV engine mount and path to sync a secret to the
-      {{@destination.typeDisplayName}}
+      {{@destination.type_display_name}}
       destination. Selecting a previously synced secret will re-sync that secret.
       {{#if (eq @destination.granularity "secret-key")}}
         This destination is configured to sync with
@@ -58,9 +58,9 @@
       {{else}}
         <FormFieldLabel for="kv-mount-input" @label="Enter an existing KV engine mount" />
         <FilterInput
-          id="kv-mount-input"
+          @id="kv-mount-input"
           placeholder="KV engine mount path"
-          value={{this.mountPath}}
+          @value={{this.mountPath}}
           @onInput={{fn (mut this.mountPath)}}
           data-test-sync-mount-input
         />
@@ -82,7 +82,7 @@
             @icon={{if this.setAssociation.isRunning "loading"}}
             type="submit"
             disabled={{this.isSubmitDisabled}}
-            data-test-sync-submit
+            data-test-submit
           />
           <Hds::Button
             @text={{if this.syncedSecret "View synced secrets" "Back"}}
@@ -90,7 +90,7 @@
             @iconPosition="trailing"
             @color={{if this.syncedSecret "tertiary" "secondary"}}
             @route="secrets.destinations.destination.secrets"
-            data-test-sync-cancel
+            data-test-cancel
           />
         </Hds::ButtonSet>
         {{#if this.isSecretDirectory}}
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations/destination/sync.ts b/ui/lib/sync/addon/components/secrets/page/destinations/destination/sync.ts
index b59ad040cfb..18f224a5a33 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations/destination/sync.ts
+++ b/ui/lib/sync/addon/components/secrets/page/destinations/destination/sync.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,22 +9,23 @@ import { service } from '@ember/service';
 import { action } from '@ember/object';
 import { task } from 'ember-concurrency';
 import { keyIsFolder } from 'core/utils/key-utils';
-import errorMessage from 'vault/utils/error-message';
 
-import type SyncDestinationModel from 'vault/models/sync/destination';
+import type { Destination } from 'vault/sync';
 import type RouterService from '@ember/routing/router-service';
-import type StoreService from 'vault/services/store';
+import type ApiService from 'vault/services/api';
+import type PaginationService from 'vault/services/pagination';
 import type FlashMessageService from 'vault/services/flash-messages';
-import type { SearchSelectOption } from 'vault/vault/app-types';
+import type { SearchSelectOption } from 'vault/app-types';
 
 interface Args {
-  destination: SyncDestinationModel;
+  destination: Destination;
 }
 
 export default class DestinationSyncPageComponent extends Component<Args> {
-  @service declare readonly router: RouterService;
-  @service declare readonly store: StoreService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly api: ApiService;
   @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly pagination: PaginationService;
 
   constructor(owner: unknown, args: Args) {
     super(owner, args);
@@ -45,21 +46,20 @@ export default class DestinationSyncPageComponent extends Component<Args> {
     return !this.mountPath || !this.secretPath || this.isSecretDirectory || this.setAssociation.isRunning;
   }
 
-  willDestroy(): void {
-    this.store.clearDataset('sync/association');
-    super.willDestroy();
-  }
-
   // unable to use built-in fetch functionality of SearchSelect since we need to filter by kv type
   async fetchMounts() {
+    const mounts = [];
     try {
-      const secretEngines = await this.store.query('secret-engine', {});
-      this.mounts = secretEngines.reduce((filtered, model) => {
-        if (model.type === 'kv' && model.version === 2) {
-          filtered.push({ name: model.path, id: model.path });
+      const { secret } = await this.api.sys.internalUiListEnabledVisibleMounts();
+      if (secret) {
+        for (const path in secret) {
+          const { type, options } = secret[path as keyof typeof secret];
+          if (type === 'kv' && options?.['version'] === '2') {
+            mounts.push({ name: path, id: path });
+          }
         }
-        return filtered;
-      }, []);
+      }
+      this.mounts = mounts;
     } catch (error) {
       // the user is still able to manually enter the mount path
       // InputSearch component will render in this case
@@ -81,20 +81,16 @@ export default class DestinationSyncPageComponent extends Component<Args> {
     this.error = ''; // reset error
     try {
       this.syncedSecret = '';
-      const { name: destinationName, type: destinationType } = this.args.destination;
+      const { name, type } = this.args.destination;
       const mount = keyIsFolder(this.mountPath) ? this.mountPath.slice(0, -1) : this.mountPath; // strip trailing slash from mount path
-      const association = this.store.createRecord('sync/association', {
-        destinationName,
-        destinationType,
-        mount,
-        secretName: this.secretPath,
-      });
-      await association.save({ adapterOptions: { action: 'set' } });
+      const payload = { mount, secret_name: this.secretPath };
+      await this.api.sys.systemWriteSyncDestinationsTypeNameAssociationsSet(name, type, payload);
       this.syncedSecret = this.secretPath;
       // reset the secret path to help make it clear that the sync was successful
       this.secretPath = '';
     } catch (error) {
-      this.error = `Sync operation error: \n ${errorMessage(error)}`;
+      const { message } = await this.api.parseError(error);
+      this.error = `Sync operation error: \n ${message}`;
     }
   });
 }
diff --git a/ui/lib/sync/addon/components/secrets/page/destinations/select-type.hbs b/ui/lib/sync/addon/components/secrets/page/destinations/select-type.hbs
index 4158388784f..01aa1b522dd 100644
--- a/ui/lib/sync/addon/components/secrets/page/destinations/select-type.hbs
+++ b/ui/lib/sync/addon/components/secrets/page/destinations/select-type.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <SyncHeader
   @title="Select a Destination"
diff --git a/ui/lib/sync/addon/components/secrets/page/overview.hbs b/ui/lib/sync/addon/components/secrets/page/overview.hbs
index d91c48578ab..8440f1526b7 100644
--- a/ui/lib/sync/addon/components/secrets/page/overview.hbs
+++ b/ui/lib/sync/addon/components/secrets/page/overview.hbs
@@ -1,17 +1,48 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
+{{#unless this.flags.secretsSyncIsActivated}}
+  {{#if this.version.hasSecretsSync}}
+    {{#unless this.hideOptIn}}
+      {{! Allows users to dismiss activation banner if they have permissions to activate. }}
+      <Hds::Alert
+        @type="inline"
+        @color="warning"
+        @onDismiss={{if @canActivateSecretsSync (fn (mut this.hideOptIn) true) undefined}}
+        data-test-secrets-sync-opt-in-banner
+        as |A|
+      >
+        <A.Title>Enable Secrets Sync feature</A.Title>
+        <A.Description data-test-secrets-sync-opt-in-banner-description>To use this feature, specific activation is required.
+          {{if
+            @canActivateSecretsSync
+            "Please review the feature documentation and
+          enable it. If you're upgrading from beta, your previous data will be accessible after activation."
+            "Please contact your administrator to activate."
+          }}</A.Description>
+        {{#if @canActivateSecretsSync}}
+          <A.Button
+            @text="Enable"
+            @color="secondary"
+            {{on "click" (fn (mut this.showActivateSecretsSyncModal) true)}}
+            data-test-secrets-sync-opt-in-banner-enable
+          />
+        {{/if}}
+      </Hds::Alert>
+    {{/unless}}
+  {{/if}}
+{{/unless}}
 
-<SyncHeader @title="Secrets Sync">
-  <:actions>
-    {{#if (and this.version.isEnterprise (not @destinations))}}
-      <Hds::Button @text="Create first destination" @route="secrets.destinations.create" data-test-cta-button />
-    {{/if}}
-  </:actions>
-</SyncHeader>
+{{#if this.activationErrors}}
+  {{#unless this.hideError}}
+    <MessageError @errors={{this.activationErrors}} @onDismiss={{fn (mut this.hideError) true}} data-test-opt-in-error />
+  {{/unless}}
+{{/if}}
 
 {{#if @destinations}}
+  <SyncHeader @title="Secrets Sync" />
+
   <div class="tabs-container box is-bottomless is-marginless is-paddingless">
     <nav class="tabs" aria-label="destination tabs">
       <ul>
@@ -38,131 +69,155 @@
   </Toolbar>
 
   <OverviewCard @cardTitle="Secrets by destination" class="has-top-margin-l">
-    {{#if this.fetchAssociationsForDestinations.isRunning}}
-      <div data-test-sync-overview-loading>
-        <Icon @name="loading" @size="24" />
-        Loading destinations...
-      </div>
-    {{else if (not this.destinationMetrics)}}
-      <EmptyState
-        @title="Error fetching information"
-        @message="Ensure that the policy has access to read sync associations."
-      >
-        <Hds::Link::Standalone
-          @icon="docs-link"
-          @iconPosition="trailing"
-          @text="Secrets sync association API docs"
-          @href={{doc-link "/vault/api-docs/system/secrets-sync#read-associations"}}
-        />
-      </EmptyState>
-    {{else}}
-      <Hds::Table>
-        <:head as |H|>
-          <H.Tr>
-            <H.Th>Sync destination</H.Th>
-            <H.Th @align="right">
-              # of external secrets
-              <Hds::TooltipButton
-                @text="Number of secrets created at the destination"
-                aria-label="More information"
-                class="is-v-centered"
-              >
-                <FlightIcon @name="info" />
-              </Hds::TooltipButton>
-            </H.Th>
-            <H.Th @align="right">Last updated</H.Th>
-            <H.Th @align="right">Actions</H.Th>
-          </H.Tr>
-        </:head>
-        <:body as |B|>
-          {{#each this.destinationMetrics as |data index|}}
-            <B.Tr data-test-overview-table-row>
-              <B.Td>
-                <Icon @name={{data.icon}} data-test-overview-table-icon={{index}} />
-                <span data-test-overview-table-name={{index}}>{{data.name}}</span>
-                {{#if data.status}}
-                  <Hds::Badge
-                    @text={{data.status}}
-                    @color={{if (eq data.status "All synced") "success"}}
-                    data-test-overview-table-badge={{index}}
-                  />
-                {{/if}}
-              </B.Td>
-              <B.Td @align="right" data-test-overview-table-total={{index}}>
-                {{data.associationCount}}
-              </B.Td>
-              <B.Td @align="right" data-test-overview-table-updated={{index}}>
-                {{#if data.lastUpdated}}
-                  {{date-format data.lastUpdated "MMMM do yyyy, h:mm:ss a"}}
-                {{else}}
-                  &mdash;
-                {{/if}}
-              </B.Td>
-              <B.Td @align="right">
-                <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
-                  <dd.ToggleIcon
-                    @icon="more-horizontal"
-                    @text="Actions"
-                    @hasChevron={{false}}
-                    @size="small"
-                    data-test-overview-table-action-toggle={{index}}
-                  />
-                  <dd.Interactive
-                    @route="secrets.destinations.destination.sync"
-                    @models={{array data.type data.name}}
-                    @text="Sync secrets"
-                    data-test-overview-table-action="sync"
-                  />
-                  <dd.Interactive
-                    @route="secrets.destinations.destination.secrets"
-                    @models={{array data.type data.name}}
-                    @text="View synced secrets"
-                    data-test-overview-table-action="details"
-                  />
-                </Hds::Dropdown>
-              </B.Td>
-            </B.Tr>
-          {{/each}}
-        </:body>
-      </Hds::Table>
+    <:content>
+      {{#if this.fetchAssociationsForDestinations.isRunning}}
+        <div data-test-sync-overview-loading>
+          <Icon @name="loading" @size="24" />
+          Loading destinations...
+        </div>
+      {{else if (not this.destinationMetrics)}}
+        <EmptyState
+          @title="Error fetching information"
+          @message="Ensure that the policy has access to read sync associations."
+        >
+          <Hds::Link::Standalone
+            @icon="docs-link"
+            @iconPosition="trailing"
+            @text="Secrets Sync association API docs"
+            @href={{doc-link "/vault/api-docs/system/secrets-sync#read-associations"}}
+          />
+        </EmptyState>
+      {{else}}
+        <Hds::Table>
+          <:head as |H|>
+            <H.Tr>
+              <H.Th>Sync destination</H.Th>
+              <H.Th @align="right">
+                # of external secrets
+                <Hds::TooltipButton
+                  @text="Number of secrets created at the destination"
+                  aria-label="More information"
+                  class="is-v-centered"
+                >
+                  <Hds::Icon @name="info" @isInline={{true}} />
+                </Hds::TooltipButton>
+              </H.Th>
+              <H.Th @align="right">Last updated</H.Th>
+              <H.Th @align="right">Actions</H.Th>
+            </H.Tr>
+          </:head>
+          <:body as |B|>
+            {{#each this.destinationMetrics as |data index|}}
+              <B.Tr data-test-overview-table-row>
+                <B.Td>
+                  <Icon @name={{data.icon}} data-test-overview-table-icon={{index}} />
+                  <span data-test-overview-table-name={{index}}>{{data.name}}</span>
+                  {{#if data.status}}
+                    <Hds::Badge
+                      @text={{data.status}}
+                      @color={{if (eq data.status "All synced") "success"}}
+                      data-test-overview-table-badge={{index}}
+                    />
+                  {{/if}}
+                </B.Td>
+                <B.Td @align="right" data-test-overview-table-total={{index}}>
+                  {{data.associationCount}}
+                </B.Td>
+                <B.Td @align="right" data-test-overview-table-updated={{index}}>
+                  {{#if data.lastUpdated}}
+                    {{date-format data.lastUpdated "MMMM do yyyy, h:mm:ss a"}}
+                  {{else}}
+                    &mdash;
+                  {{/if}}
+                </B.Td>
+                <B.Td @align="right">
+                  <Hds::Dropdown @isInline={{true}} @listPosition="bottom-right" as |dd|>
+                    <dd.ToggleIcon
+                      @icon="more-horizontal"
+                      @text="Actions"
+                      @hasChevron={{false}}
+                      @size="small"
+                      data-test-overview-table-action-toggle={{index}}
+                    />
+                    <dd.Interactive
+                      @route="secrets.destinations.destination.sync"
+                      @models={{array data.type data.name}}
+                      data-test-overview-table-action="sync"
+                    >Sync secrets</dd.Interactive>
+                    <dd.Interactive
+                      @route="secrets.destinations.destination.secrets"
+                      @models={{array data.type data.name}}
+                      data-test-overview-table-action="details"
+                    >View synced secrets</dd.Interactive>
+                  </Hds::Dropdown>
+                </B.Td>
+              </B.Tr>
+            {{/each}}
+          </:body>
+        </Hds::Table>
 
-      <Hds::Pagination::Numbered
-        @totalItems={{@destinations.length}}
-        @currentPage={{this.page}}
-        @currentPageSize={{this.pageSize}}
-        @showSizeSelector={{false}}
-        @onPageChange={{perform this.fetchAssociationsForDestinations}}
-      />
-    {{/if}}
+        <Hds::Pagination::Numbered
+          @totalItems={{@destinations.length}}
+          @currentPage={{this.page}}
+          @currentPageSize={{this.pageSize}}
+          @showSizeSelector={{false}}
+          @onPageChange={{perform this.fetchAssociationsForDestinations}}
+        />
+      {{/if}}
+    </:content>
   </OverviewCard>
 
   <div class="is-grid grid-2-columns grid-gap-2 has-top-margin-l has-bottom-margin-l">
     <OverviewCard
       @cardTitle="Total destinations"
-      @subText="The total number of connected destinations"
-      @actionText="Create new"
-      @actionTo="secrets.destinations.create"
+      @subText="The total number of connected destinations."
       class="is-flex-half"
     >
-      <h2 class="title is-2 has-font-weight-normal has-top-margin-m" data-test-overview-card-content="Total destinations">
-        {{or @destinations.length "None"}}
-      </h2>
+      <:action>
+        <Hds::Link::Standalone
+          @text="Create new"
+          @route="secrets.destinations.create"
+          @icon="plus"
+          @iconPosition="trailing"
+          data-test-action-text="Create new"
+        />
+      </:action>
+      <:content>
+        <h2 class="title is-2 has-font-weight-normal has-top-margin-m" data-test-overview-card-content="Total destinations">
+          {{or @destinations.length "None"}}
+        </h2>
+      </:content>
     </OverviewCard>
     <OverviewCard
       @cardTitle="Total secrets"
-      @subText="The total number of secrets synced from Vault."
-      {{!-- * sync clients are unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release 
-      @actionText="View billing" 
-      @actionTo="clientCountOverview"
-      @actionExternal={{true}}
-       --}}
+      @subText="The total number of secrets that have been synced from Vault over time. One secret will be counted as one sync client."
       class="is-flex-half"
     >
-      <h2 class="title is-2 has-font-weight-normal has-top-margin-m" data-test-overview-card-content="Total secrets">
-        {{or @totalVaultSecrets "None"}}
-      </h2>
+      <:action>
+        <Hds::Link::Standalone
+          @text="View billing"
+          @route="clientCountOverview"
+          @isRouteExternal={{true}}
+          @icon="chevron-right"
+          @iconPosition="trailing"
+          data-test-action-text
+        />
+      </:action>
+      <:content>
+        <h2 class="title is-2 has-font-weight-normal has-top-margin-m" data-test-overview-card-content="Total secrets">
+          {{or @totalVaultSecrets "None"}}
+        </h2>
+      </:content>
     </OverviewCard>
   </div>
 {{else}}
-  <Secrets::LandingCta />
+  <Secrets::LandingCta @isActivated={{this.flags.secretsSyncIsActivated}} />
+{{/if}}
+
+{{#if this.showActivateSecretsSyncModal}}
+  <Secrets::SyncActivationModal
+    @onClose={{fn (mut this.showActivateSecretsSyncModal) false}}
+    @onError={{this.onModalError}}
+    @onConfirm={{this.clearActivationErrors}}
+  />
 {{/if}}
\ No newline at end of file
diff --git a/ui/lib/sync/addon/components/secrets/page/overview.ts b/ui/lib/sync/addon/components/secrets/page/overview.ts
index b0edaff33d3..eea3a343a66 100644
--- a/ui/lib/sync/addon/components/secrets/page/overview.ts
+++ b/ui/lib/sync/addon/components/secrets/page/overview.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,28 +7,37 @@ import Component from '@glimmer/component';
 import { tracked } from '@glimmer/tracking';
 import { service } from '@ember/service';
 import { task } from 'ember-concurrency';
+import { action } from '@ember/object';
 import Ember from 'ember';
+import { DEBUG } from '@glimmer/env';
+import { findDestination } from 'core/helpers/sync-destinations';
 
 import type FlashMessageService from 'vault/services/flash-messages';
-import type RouterService from '@ember/routing/router-service';
-import type StoreService from 'vault/services/store';
 import type VersionService from 'vault/services/version';
-import type { SyncDestinationAssociationMetrics } from 'vault/vault/adapters/sync/association';
-import type SyncDestinationModel from 'vault/vault/models/sync/destination';
+import type FlagsService from 'vault/services/flags';
+import type ApiService from 'vault/services/api';
+import type { SystemReadSyncDestinationsTypeNameAssociationsResponse } from '@hashicorp/vault-client-typescript';
+import type { ListDestination, DestinationMetrics, AssociatedSecret, DestinationType } from 'vault/sync';
 
 interface Args {
-  destinations: Array<SyncDestinationModel>;
-  totalAssociations: number;
+  destinations: ListDestination[];
+  totalVaultSecrets: number;
+  canActivateSecretsSync: boolean;
 }
 
 export default class SyncSecretsDestinationsPageComponent extends Component<Args> {
   @service declare readonly flashMessages: FlashMessageService;
-  @service declare readonly router: RouterService;
-  @service declare readonly store: StoreService;
+  @service declare readonly api: ApiService;
   @service declare readonly version: VersionService;
+  @service declare readonly flags: FlagsService;
 
-  @tracked destinationMetrics: SyncDestinationAssociationMetrics[] = [];
+  @tracked destinationMetrics: DestinationMetrics[] = [];
   @tracked page = 1;
+  @tracked showActivateSecretsSyncModal = false;
+  @tracked activationErrors: null | string[] = null;
+  // eventually remove when we deal with permissions on activation-features
+  @tracked hideOptIn = false;
+  @tracked hideError = false;
 
   pageSize = Ember.testing ? 3 : 5; // lower in tests to test pagination without seeding more data
 
@@ -43,12 +52,70 @@ export default class SyncSecretsDestinationsPageComponent extends Component<Args
     try {
       const total = page * this.pageSize;
       const paginatedDestinations = this.args.destinations.slice(total - this.pageSize, total);
-      this.destinationMetrics = await this.store
-        .adapterFor('sync/association')
-        .fetchByDestinations(paginatedDestinations);
+      const requests = paginatedDestinations.map(({ name, type }) => {
+        return this.api.sys.systemReadSyncDestinationsTypeNameAssociations(name, type);
+      });
+      const responses = await Promise.all(requests);
+      this.destinationMetrics = this.normalizeFetchByDestinations(responses);
       this.page = page;
     } catch (error) {
       this.destinationMetrics = [];
     }
   });
+
+  normalizeFetchByDestinations(
+    responses: SystemReadSyncDestinationsTypeNameAssociationsResponse[]
+  ): DestinationMetrics[] {
+    return responses.map((response) => {
+      const { store_name, store_type, associated_secrets } = response;
+      const type = store_type as DestinationType;
+      const secrets = associated_secrets as Record<string, AssociatedSecret>;
+      const unsynced = [];
+      let lastUpdated;
+
+      for (const key in secrets) {
+        const association = secrets[key];
+        // for display purposes, any status other than SYNCED is considered unsynced
+        if (association) {
+          if (association.sync_status !== 'SYNCED') {
+            unsynced.push(association.sync_status);
+          }
+          // use the most recent updated_at value as the last synced date
+          const updated = new Date(association.updated_at);
+          if (!lastUpdated || updated > lastUpdated) {
+            lastUpdated = updated;
+          }
+        }
+      }
+
+      const associationCount = Object.entries(secrets).length;
+      return {
+        icon: findDestination(type).icon,
+        name: store_name,
+        type,
+        associationCount,
+        status: associationCount ? (unsynced.length ? `${unsynced.length} Unsynced` : 'All synced') : null,
+        lastUpdated,
+      };
+    });
+  }
+
+  @action
+  clearActivationErrors() {
+    this.activationErrors = null;
+  }
+
+  @action
+  onModalError(errorMsg: string) {
+    if (DEBUG) console.error(errorMsg); // eslint-disable-line no-console
+
+    const errors = [errorMsg];
+
+    if (this.flags.isHvdManaged) {
+      errors.push(
+        'Secrets Sync is available for Plus tier clusters only. Please check the tier of your cluster to enable Secrets Sync.'
+      );
+    }
+    this.activationErrors = errors;
+  }
 }
diff --git a/ui/lib/sync/addon/components/secrets/sync-activation-modal.hbs b/ui/lib/sync/addon/components/secrets/sync-activation-modal.hbs
new file mode 100644
index 00000000000..0c50a694300
--- /dev/null
+++ b/ui/lib/sync/addon/components/secrets/sync-activation-modal.hbs
@@ -0,0 +1,38 @@
+{{!
+  Copyright IBM Corp. 2016, 2025
+  SPDX-License-Identifier: BUSL-1.1
+}}
+
+<Hds::Modal @onClose={{@onClose}} data-test-secrets-sync-opt-in-modal as |M|>
+  <M.Header @icon="alert-triangle">
+    Enable Secrets Sync feature
+  </M.Header>
+  <M.Body>
+    <p class="has-bottom-margin-m">
+      By enabling the Secrets Sync feature you may incur additional costs. Please review our
+      <Hds::Link::Inline
+        @isHrefExternal={{true}}
+        @href={{doc-link "/hcp/docs/vault/what-is-hcp-vault/client#secrets-sync"}}
+      >documentation</Hds::Link::Inline>
+      to learn more.
+    </p>
+    <Hds::Form::Checkbox::Field
+      {{on "change" (fn (mut this.hasConfirmedDocs) (not this.hasConfirmedDocs))}}
+      data-test-opt-in-check
+      as |F|
+    >
+      <F.Label>I've read the above linked document</F.Label>
+    </Hds::Form::Checkbox::Field>
+  </M.Body>
+  <M.Footer>
+    <Hds::ButtonSet>
+      <Hds::Button
+        data-test-opt-in-confirm
+        @text="Confirm"
+        disabled={{not this.hasConfirmedDocs}}
+        {{on "click" (perform this.onFeatureConfirm)}}
+      />
+      <Hds::Button data-test-opt-in-cancel @text="Cancel" @color="secondary" {{on "click" @onClose}} />
+    </Hds::ButtonSet>
+  </M.Footer>
+</Hds::Modal>
\ No newline at end of file
diff --git a/ui/lib/sync/addon/components/secrets/sync-activation-modal.ts b/ui/lib/sync/addon/components/secrets/sync-activation-modal.ts
new file mode 100644
index 00000000000..9e6e2d8f13d
--- /dev/null
+++ b/ui/lib/sync/addon/components/secrets/sync-activation-modal.ts
@@ -0,0 +1,52 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Component from '@glimmer/component';
+import { tracked } from '@glimmer/tracking';
+import { service } from '@ember/service';
+import { task } from 'ember-concurrency';
+import { waitFor } from '@ember/test-waiters';
+
+import type FlagsService from 'vault/services/flags';
+import type FlashMessageService from 'vault/services/flash-messages';
+import type RouterService from '@ember/routing/router-service';
+import type ApiService from 'vault/services/api';
+
+interface Args {
+  onClose: () => void;
+  onError: (errorMessage: string) => void;
+  onConfirm: () => void;
+}
+
+export default class SyncActivationModal extends Component<Args> {
+  @service declare readonly flags: FlagsService;
+  @service declare readonly flashMessages: FlashMessageService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly api: ApiService;
+
+  @tracked hasConfirmedDocs = false;
+
+  @task
+  @waitFor
+  *onFeatureConfirm() {
+    // clear any previous errors in the parent component
+    this.args.onConfirm();
+
+    // sync activation is managed by the root/administrative namespace so child namespaces are not sent.
+    // for non-managed clusters the root namespace path is technically an empty string, otherwise we pass 'admin' if HVD managed.
+    const namespace = this.flags.hvdManagedNamespaceRoot || '';
+    try {
+      yield this.api.sys.activationFlagsActivate_3(this.api.buildHeaders({ namespace }));
+      // must refresh and not transition because transition does not refresh the model from within a namespace
+      yield this.router.refresh('vault.cluster');
+    } catch (error) {
+      const { message } = yield this.api.parseError(error);
+      this.args.onError(message);
+      this.flashMessages.danger(`Error enabling feature \n ${message}`);
+    } finally {
+      this.args.onClose();
+    }
+  }
+}
diff --git a/ui/lib/sync/addon/components/sync-header.hbs b/ui/lib/sync/addon/components/sync-header.hbs
index 763d3498992..91f423124cd 100644
--- a/ui/lib/sync/addon/components/sync-header.hbs
+++ b/ui/lib/sync/addon/components/sync-header.hbs
@@ -1,12 +1,14 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <PageHeader as |p|>
-  <p.top>
-    <Page::Breadcrumbs @breadcrumbs={{or @breadcrumbs (array (hash label="Secrets Sync"))}} />
-  </p.top>
+  {{#if @breadcrumbs}}
+    <p.top>
+      <Page::Breadcrumbs @breadcrumbs={{@breadcrumbs}} />
+    </p.top>
+  {{/if}}
 
   <p.levelLeft>
     <h1 class="title is-3 has-bottom-margin-m" data-test-page-title>
@@ -14,11 +16,8 @@
         <Icon @name={{@icon}} @size="24" />
       {{/if}}
       {{@title}}
-      {{#if this.version.isCommunity}}
-        <Hds::Badge @text="Enterprise feature" @color="highlight" @size="large" />
-      {{/if}}
-      {{#if this.version.isEnterprise}}
-        <Hds::Badge @text="Beta" @color="highlight" @size="large" />
+      {{#if this.flags.isHvdManaged}}
+        <Hds::Badge @text="Plus feature" @color="highlight" @size="large" />
       {{/if}}
     </h1>
   </p.levelLeft>
diff --git a/ui/lib/sync/addon/components/sync-header.ts b/ui/lib/sync/addon/components/sync-header.ts
index ea233d72616..95ad899757e 100644
--- a/ui/lib/sync/addon/components/sync-header.ts
+++ b/ui/lib/sync/addon/components/sync-header.ts
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Component from '@glimmer/component';
 import { service } from '@ember/service';
 
-import type VersionService from 'vault/services/version';
+import type FlagsService from 'vault/services/flags';
 import type { Breadcrumb } from 'vault/vault/app-types';
 
 interface Args {
@@ -16,5 +16,5 @@ interface Args {
 }
 
 export default class SyncHeaderComponent extends Component<Args> {
-  @service declare readonly version: VersionService;
+  @service declare readonly flags: FlagsService;
 }
diff --git a/ui/lib/sync/addon/controllers/secrets/destinations/destination/secrets.ts b/ui/lib/sync/addon/controllers/secrets/destinations/destination/secrets.ts
index c53d41f6341..5f787c2ee1b 100644
--- a/ui/lib/sync/addon/controllers/secrets/destinations/destination/secrets.ts
+++ b/ui/lib/sync/addon/controllers/secrets/destinations/destination/secrets.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/sync/addon/controllers/secrets/destinations/index.ts b/ui/lib/sync/addon/controllers/secrets/destinations/index.ts
index 2de510ad1b9..b3d55a1b1ca 100644
--- a/ui/lib/sync/addon/controllers/secrets/destinations/index.ts
+++ b/ui/lib/sync/addon/controllers/secrets/destinations/index.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/sync/addon/engine.js b/ui/lib/sync/addon/engine.js
index 512b34e1f0c..cc58bcabf7d 100644
--- a/ui/lib/sync/addon/engine.js
+++ b/ui/lib/sync/addon/engine.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,8 +14,17 @@ export default class SyncEngine extends Engine {
   modulePrefix = modulePrefix;
   Resolver = Resolver;
   dependencies = {
-    services: ['flash-messages', 'router', 'store', 'version'],
-    externalRoutes: ['kvSecretDetails', 'clientCountOverview'],
+    services: [
+      'flash-messages',
+      'flags',
+      'app-router',
+      'store',
+      'api',
+      'capabilities',
+      'pagination',
+      'version',
+    ],
+    externalRoutes: ['kvSecretOverview', 'clientCountOverview'],
   };
 }
 
diff --git a/ui/lib/sync/addon/routes.js b/ui/lib/sync/addon/routes.js
index 2f4c2014067..cfb9a9f2988 100644
--- a/ui/lib/sync/addon/routes.js
+++ b/ui/lib/sync/addon/routes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/sync/addon/routes/index.ts b/ui/lib/sync/addon/routes/index.ts
index e73816a5e3e..0c57ccd9496 100644
--- a/ui/lib/sync/addon/routes/index.ts
+++ b/ui/lib/sync/addon/routes/index.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { service } from '@ember/service';
 import type RouterService from '@ember/routing/router-service';
 
 export default class SyncIndexRoute extends Route {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   redirect() {
     this.router.transitionTo('vault.cluster.sync.secrets.overview');
diff --git a/ui/lib/sync/addon/routes/secrets.ts b/ui/lib/sync/addon/routes/secrets.ts
new file mode 100644
index 00000000000..3422ea9df02
--- /dev/null
+++ b/ui/lib/sync/addon/routes/secrets.ts
@@ -0,0 +1,27 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import { service } from '@ember/service';
+
+import type RouterService from '@ember/routing/router-service';
+import type FlagService from 'vault/services/flags';
+
+export default class SyncSecretsRoute extends Route {
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly flags: FlagService;
+
+  model() {
+    return {
+      activatedFeatures: this.flags.activatedFlags,
+    };
+  }
+
+  afterModel(model: { activatedFeatures: Array<string> }) {
+    if (!model.activatedFeatures) {
+      this.router.transitionTo('vault.cluster.sync.secrets.overview');
+    }
+  }
+}
diff --git a/ui/lib/sync/addon/routes/secrets/destinations/create/destination.ts b/ui/lib/sync/addon/routes/secrets/destinations/create/destination.ts
index ebb04b61675..6edab84a09f 100644
--- a/ui/lib/sync/addon/routes/secrets/destinations/create/destination.ts
+++ b/ui/lib/sync/addon/routes/secrets/destinations/create/destination.ts
@@ -1,25 +1,25 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
-import { service } from '@ember/service';
 import { findDestination } from 'core/helpers/sync-destinations';
+import formResolver from 'vault/forms/sync/resolver';
 
-import type StoreService from 'vault/services/store';
-import type { SyncDestinationType } from 'vault/vault/helpers/sync-destinations';
+import type { DestinationType } from 'vault/sync';
 
-interface Params {
-  type: SyncDestinationType;
-}
+type Params = {
+  type: DestinationType;
+};
 
 export default class SyncSecretsDestinationsCreateDestinationRoute extends Route {
-  @service declare readonly store: StoreService;
-
   model(params: Params) {
     const { type } = params;
-    const defaultValues = findDestination(type)?.defaultValues;
-    return this.store.createRecord(`sync/destinations/${type}`, { type, ...defaultValues });
+    const { defaultValues } = findDestination(type);
+    return {
+      type,
+      form: formResolver(type, defaultValues, { isNew: true }),
+    };
   }
 }
diff --git a/ui/lib/sync/addon/routes/secrets/destinations/destination.ts b/ui/lib/sync/addon/routes/secrets/destinations/destination.ts
index bc34e66038d..5e10c67def9 100644
--- a/ui/lib/sync/addon/routes/secrets/destinations/destination.ts
+++ b/ui/lib/sync/addon/routes/secrets/destinations/destination.ts
@@ -1,43 +1,65 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
+import apiMethodResolver from 'sync/utils/api-method-resolver';
 
-import type Store from '@ember-data/store';
 import type RouterService from '@ember/routing/router-service';
 import type FlashMessageService from 'vault/services/flash-messages';
 import type Transition from '@ember/routing/transition';
-import type SyncDestinationModel from 'vault/models/sync/destination';
+import type ApiService from 'vault/services/api';
+import type { Destination } from 'vault/sync';
+import type CapabilitiesService from 'vault/services/capabilities';
+import type { CapabilitiesMap } from 'vault/app-types';
 
-interface RouteParams {
+type Params = {
   name: string;
-  type: string;
-}
+  type: Destination['type'];
+};
+
+export type DestinationRouteModel = {
+  destination: Destination;
+  capabilities: CapabilitiesMap;
+};
 
 export default class SyncSecretsDestinationsDestinationRoute extends Route {
-  @service declare readonly store: Store;
-  @service declare readonly router: RouterService;
+  @service declare readonly api: ApiService;
+  @service('app-router') declare readonly router: RouterService;
   @service declare readonly flashMessages: FlashMessageService;
+  @service declare readonly capabilities: CapabilitiesService;
 
-  model(params: RouteParams) {
+  async model(params: Params) {
     const { name, type } = params;
-    return this.store.findRecord(`sync/destinations/${type}`, name);
+    const method = apiMethodResolver('read', type);
+
+    const requests = [
+      this.api.sys[method](name, {}),
+      this.capabilities.fetch([
+        this.capabilities.pathFor('syncDestination', { name, type }),
+        this.capabilities.pathFor('syncSetAssociation', { name, type }),
+      ]),
+    ];
+    const [destination, capabilities] = await Promise.all(requests);
+
+    return {
+      destination,
+      capabilities,
+    };
   }
 
-  afterModel(model: SyncDestinationModel, transition: Transition) {
+  afterModel({ destination }: DestinationRouteModel, transition: Transition) {
     // handles the case where the user attempts to perform actions on a destination when a purge has been initiated
     // editing is available from the list view and syncing secrets is available from the overview
     // the list endpoint does not return the full model so we don't have access to purgeInitiatedAt to disable or hide the actions
     // if transitioning from either of the mentioned routes and a purge has been initiated redirect to the secrets view
     const baseRoute = 'vault.cluster.sync.secrets.destinations.destination';
     const routes = [`${baseRoute}.edit`, `${baseRoute}.sync`];
-    if (routes.includes(transition.to.name) && model.purgeInitiatedAt) {
-      // const target = transition.to.name.
-      // this.flashMessages.info('Actions are ')
-      const action = transition.to.localName === 'edit' ? 'Editing a destination' : 'Syncing secrets';
+    const toRoute = transition.to?.name;
+    if (toRoute && routes.includes(toRoute) && destination.purge_initiated_at) {
+      const action = transition.to?.localName === 'edit' ? 'Editing a destination' : 'Syncing secrets';
       this.flashMessages.info(`${action} is not permitted once a purge has been initiated.`);
       this.router.replaceWith('vault.cluster.sync.secrets.destinations.destination.secrets');
     }
diff --git a/ui/lib/sync/addon/routes/secrets/destinations/destination/edit.ts b/ui/lib/sync/addon/routes/secrets/destinations/destination/edit.ts
new file mode 100644
index 00000000000..ac34da28b18
--- /dev/null
+++ b/ui/lib/sync/addon/routes/secrets/destinations/destination/edit.ts
@@ -0,0 +1,31 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Route from '@ember/routing/route';
+import formResolver from 'vault/forms/sync/resolver';
+
+import type { DestinationRouteModel } from '../destination';
+
+// originally this route was inheriting the model (Ember Data destination model) from the destination parent route
+// an explicit route will be necessary since we will be passing in a Form instance to edit
+// this will be done in a follow up PR but for now the Ember Data model will be returned to preserver functionality
+export default class SyncSecretsDestinationsDestinationEditRoute extends Route {
+  model() {
+    const { destination } = this.modelFor('secrets.destinations.destination') as DestinationRouteModel;
+    const { type, name, connection_details, options } = destination;
+    // granularity is returned as granularityLevel in the response but expected as granularity in the request
+    const { granularity_level, ...partialOptions } = options;
+
+    return {
+      type,
+      form: formResolver(type, {
+        name,
+        ...connection_details,
+        ...partialOptions,
+        granularity: granularity_level,
+      }),
+    };
+  }
+}
diff --git a/ui/lib/sync/addon/routes/secrets/destinations/destination/index.ts b/ui/lib/sync/addon/routes/secrets/destinations/destination/index.ts
index 660e186f437..8840e511b8b 100644
--- a/ui/lib/sync/addon/routes/secrets/destinations/destination/index.ts
+++ b/ui/lib/sync/addon/routes/secrets/destinations/destination/index.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { service } from '@ember/service';
 import type RouterService from '@ember/routing/router-service';
 
 export default class SyncSecretsDestinationsDestinationIndexRoute extends Route {
-  @service declare readonly router: RouterService;
+  @service('app-router') declare readonly router: RouterService;
 
   redirect() {
     this.router.transitionTo('vault.cluster.sync.secrets.destinations.destination.details');
diff --git a/ui/lib/sync/addon/routes/secrets/destinations/destination/secrets.ts b/ui/lib/sync/addon/routes/secrets/destinations/destination/secrets.ts
index 6fcdda8d99d..2d2ca03e0d2 100644
--- a/ui/lib/sync/addon/routes/secrets/destinations/destination/secrets.ts
+++ b/ui/lib/sync/addon/routes/secrets/destinations/destination/secrets.ts
@@ -1,33 +1,22 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
+import { paginate } from 'core/utils/paginate-list';
 
-import type StoreService from 'vault/services/store';
-import type SyncDestinationModel from 'vault/vault/models/sync/destination';
-import type SyncAssociationModel from 'vault/vault/models/sync/association';
+import type ApiService from 'vault/services/api';
+import type { DestinationRouteModel } from '../destination';
 import type Controller from '@ember/controller';
 
-interface SyncDestinationSecretsRouteParams {
-  page: string;
-}
-
-interface SyncDestinationSecretsRouteModel {
-  destination: SyncDestinationModel;
-  associations: SyncAssociationModel[];
-}
-
-interface SyncDestinationSecretsController extends Controller {
-  model: SyncDestinationSecretsRouteModel;
-  page: number | undefined;
-}
+type Params = {
+  page?: string;
+};
 
 export default class SyncDestinationSecretsRoute extends Route {
-  @service declare readonly store: StoreService;
+  @service declare readonly api: ApiService;
 
   queryParams = {
     page: {
@@ -35,20 +24,31 @@ export default class SyncDestinationSecretsRoute extends Route {
     },
   };
 
-  model(params: SyncDestinationSecretsRouteParams) {
-    const destination = this.modelFor('secrets.destinations.destination') as SyncDestinationModel;
-    return hash({
+  async model({ page }: Params) {
+    const { destination, capabilities } = this.modelFor(
+      'secrets.destinations.destination'
+    ) as DestinationRouteModel;
+
+    const {
+      associated_secrets = {},
+      store_name,
+      store_type,
+    } = await this.api.sys.systemReadSyncDestinationsTypeNameAssociations(destination.name, destination.type);
+
+    const associations = Object.values(associated_secrets).map((association) => ({
+      destination_name: store_name,
+      destination_type: store_type,
+      ...association,
+    }));
+
+    return {
       destination,
-      associations: this.store.lazyPaginatedQuery('sync/association', {
-        responsePath: 'data.keys',
-        page: Number(params.page) || 1,
-        destinationType: destination.type,
-        destinationName: destination.name,
-      }),
-    });
+      capabilities,
+      associations: paginate(associations, { page: Number(page) || 1 }),
+    };
   }
 
-  resetController(controller: SyncDestinationSecretsController, isExiting: boolean) {
+  resetController(controller: Controller, isExiting: boolean) {
     if (isExiting) {
       controller.set('page', undefined);
     }
diff --git a/ui/lib/sync/addon/routes/secrets/destinations/index.ts b/ui/lib/sync/addon/routes/secrets/destinations/index.ts
index 7634cd5a9db..ec302bf0375 100644
--- a/ui/lib/sync/addon/routes/secrets/destinations/index.ts
+++ b/ui/lib/sync/addon/routes/secrets/destinations/index.ts
@@ -1,22 +1,27 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
+import { SystemListSyncDestinationsListEnum } from '@hashicorp/vault-client-typescript';
+import { listDestinationsTransform } from 'sync/utils/api-transforms';
+import { paginate } from 'core/utils/paginate-list';
 
-import type StoreService from 'vault/services/store';
+import type PaginationService from 'vault/services/pagination';
 import type RouterService from '@ember/routing/router-service';
 import type { ModelFrom } from 'vault/vault/route';
 import type SyncDestinationModel from 'vault/vault/models/sync/destination';
 import type Controller from '@ember/controller';
+import type ApiService from 'vault/services/api';
+import type CapabilitiesService from 'vault/services/capabilities';
+import { ListDestination } from 'vault/vault/sync';
 
 interface SyncSecretsDestinationsIndexRouteParams {
-  name: string;
-  type: string;
-  page: string;
+  name?: string;
+  type?: string;
+  page?: string;
 }
 
 interface SyncSecretsDestinationsRouteModel {
@@ -33,8 +38,10 @@ interface SyncSecretsDestinationsController extends Controller {
 }
 
 export default class SyncSecretsDestinationsIndexRoute extends Route {
-  @service declare readonly store: StoreService;
-  @service declare readonly router: RouterService;
+  @service declare readonly pagination: PaginationService;
+  @service declare readonly api: ApiService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly capabilities: CapabilitiesService;
 
   queryParams = {
     page: {
@@ -54,33 +61,24 @@ export default class SyncSecretsDestinationsIndexRoute extends Route {
     }
   }
 
-  filterData(dataset: Array<SyncDestinationModel>, name: string, type: string): Array<SyncDestinationModel> {
-    let filteredDataset = dataset;
-    const filter = (key: keyof SyncDestinationModel, value: string) => {
-      return filteredDataset.filter((model) => {
-        return model[key].toLowerCase().includes(value.toLowerCase());
-      });
-    };
-    if (type) {
-      filteredDataset = filter('type', type);
-    }
-    if (name) {
-      filteredDataset = filter('name', name);
-    }
-    return filteredDataset;
-  }
-
   async model(params: SyncSecretsDestinationsIndexRouteParams) {
-    const { name, type, page } = params;
-    return hash({
-      destinations: this.store.lazyPaginatedQuery('sync/destination', {
-        page: Number(page) || 1,
-        pageFilter: (dataset: Array<SyncDestinationModel>) => this.filterData(dataset, name, type),
-        responsePath: 'data.keys',
-      }),
-      nameFilter: params.name,
-      typeFilter: params.type,
-    });
+    const { name = '', type = '', page } = params;
+    const response = await this.api.sys.systemListSyncDestinations(SystemListSyncDestinationsListEnum.TRUE);
+    // transform and paginate destinations response
+    const destinations = listDestinationsTransform(response, name, type);
+    const paginatedDestinations = paginate(destinations, { page: Number(page) || 1 });
+    // fetch capabilities for destinations
+    const paths = paginatedDestinations.map((destination: ListDestination) =>
+      this.capabilities.pathFor('syncDestination', destination)
+    );
+    const capabilities = await this.capabilities.fetch(paths);
+
+    return {
+      capabilities,
+      destinations: paginatedDestinations,
+      nameFilter: name,
+      typeFilter: type,
+    };
   }
 
   resetController(controller: SyncSecretsDestinationsController, isExiting: boolean) {
diff --git a/ui/lib/sync/addon/routes/secrets/overview.ts b/ui/lib/sync/addon/routes/secrets/overview.ts
index 07142cca65f..70a8dadd66b 100644
--- a/ui/lib/sync/addon/routes/secrets/overview.ts
+++ b/ui/lib/sync/addon/routes/secrets/overview.ts
@@ -1,24 +1,61 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Route from '@ember/routing/route';
 import { service } from '@ember/service';
-import { hash } from 'rsvp';
+import {
+  SystemListSyncDestinationsListEnum,
+  SystemListSyncAssociationsListEnum,
+} from '@hashicorp/vault-client-typescript';
+import { listDestinationsTransform } from 'sync/utils/api-transforms';
 
-import type StoreService from 'vault/services/store';
+import type FlagsService from 'vault/services/flags';
+import type RouterService from '@ember/routing/router-service';
+import type ApiService from 'vault/services/api';
+import type VersionService from 'vault/services/version';
+import type CapabilitiesService from 'vault/services/capabilities';
+import type { Capabilities } from 'vault/app-types';
+import type {
+  SystemListSyncDestinationsResponse,
+  SystemListSyncAssociationsResponse,
+} from '@hashicorp/vault-client-typescript';
 
 export default class SyncSecretsOverviewRoute extends Route {
-  @service declare readonly store: StoreService;
+  @service('app-router') declare readonly router: RouterService;
+  @service declare readonly api: ApiService;
+  @service declare readonly flags: FlagsService;
+  @service declare readonly version: VersionService;
+  @service declare readonly capabilities: CapabilitiesService;
 
   async model() {
-    return hash({
-      destinations: this.store.query('sync/destination', {}).catch(() => []),
-      associations: this.store
-        .adapterFor('sync/association')
-        .queryAll()
-        .catch(() => []),
-    });
+    const isActivated = this.flags.secretsSyncIsActivated;
+    const capabilitiesReq = this.capabilities.for('syncActivate');
+    const requests = isActivated
+      ? [
+          capabilitiesReq,
+          this.api.sys.systemListSyncAssociations(SystemListSyncAssociationsListEnum.TRUE).catch(() => []),
+          this.api.sys.systemListSyncDestinations(SystemListSyncDestinationsListEnum.TRUE).catch(() => []),
+        ]
+      : [capabilitiesReq, [], []];
+
+    const [{ canCreate, canUpdate }, { total_secrets }, destinations] = (await Promise.all(requests)) as [
+      Capabilities,
+      SystemListSyncAssociationsResponse,
+      SystemListSyncDestinationsResponse,
+    ];
+
+    return {
+      canActivateSecretsSync: canCreate || canUpdate,
+      total_secrets,
+      destinations: listDestinationsTransform(destinations),
+    };
+  }
+
+  redirect() {
+    if (!this.version.hasSecretsSync) {
+      this.router.replaceWith('vault.cluster.dashboard');
+    }
   }
 }
diff --git a/ui/lib/sync/addon/templates/error.hbs b/ui/lib/sync/addon/templates/error.hbs
index 5e27922c800..7407f22127f 100644
--- a/ui/lib/sync/addon/templates/error.hbs
+++ b/ui/lib/sync/addon/templates/error.hbs
@@ -1,7 +1,7 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <SyncHeader @title="Secrets Sync" @breadcrumbs={{array (hash label="Secrets Sync" route="secrets.overview")}} />
 
diff --git a/ui/lib/sync/addon/templates/secrets/destinations/create/destination.hbs b/ui/lib/sync/addon/templates/secrets/destinations/create/destination.hbs
index ac435130756..6d144a491cb 100644
--- a/ui/lib/sync/addon/templates/secrets/destinations/create/destination.hbs
+++ b/ui/lib/sync/addon/templates/secrets/destinations/create/destination.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Secrets::Page::Destinations::CreateAndEdit @destination={{this.model}} />
\ No newline at end of file
+<Secrets::Page::Destinations::CreateAndEdit @form={{this.model.form}} @type={{this.model.type}} />
\ No newline at end of file
diff --git a/ui/lib/sync/addon/templates/secrets/destinations/create/index.hbs b/ui/lib/sync/addon/templates/secrets/destinations/create/index.hbs
index f114a5a9a1f..ba287cf12d3 100644
--- a/ui/lib/sync/addon/templates/secrets/destinations/create/index.hbs
+++ b/ui/lib/sync/addon/templates/secrets/destinations/create/index.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Secrets::Page::Destinations::SelectType />
\ No newline at end of file
diff --git a/ui/lib/sync/addon/templates/secrets/destinations/destination/details.hbs b/ui/lib/sync/addon/templates/secrets/destinations/destination/details.hbs
index 3d6cd522697..0f60b281af5 100644
--- a/ui/lib/sync/addon/templates/secrets/destinations/destination/details.hbs
+++ b/ui/lib/sync/addon/templates/secrets/destinations/destination/details.hbs
@@ -1,6 +1,9 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Secrets::Page::Destinations::Destination::Details @destination={{this.model}} />
\ No newline at end of file
+<Secrets::Page::Destinations::Destination::Details
+  @destination={{this.model.destination}}
+  @capabilities={{this.model.capabilities}}
+/>
\ No newline at end of file
diff --git a/ui/lib/sync/addon/templates/secrets/destinations/destination/edit.hbs b/ui/lib/sync/addon/templates/secrets/destinations/destination/edit.hbs
index ac435130756..6d144a491cb 100644
--- a/ui/lib/sync/addon/templates/secrets/destinations/destination/edit.hbs
+++ b/ui/lib/sync/addon/templates/secrets/destinations/destination/edit.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Secrets::Page::Destinations::CreateAndEdit @destination={{this.model}} />
\ No newline at end of file
+<Secrets::Page::Destinations::CreateAndEdit @form={{this.model.form}} @type={{this.model.type}} />
\ No newline at end of file
diff --git a/ui/lib/sync/addon/templates/secrets/destinations/destination/secrets.hbs b/ui/lib/sync/addon/templates/secrets/destinations/destination/secrets.hbs
index 5ee3b365dc5..7582db99f29 100644
--- a/ui/lib/sync/addon/templates/secrets/destinations/destination/secrets.hbs
+++ b/ui/lib/sync/addon/templates/secrets/destinations/destination/secrets.hbs
@@ -1,9 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Secrets::Page::Destinations::Destination::Secrets
   @destination={{this.model.destination}}
   @associations={{this.model.associations}}
+  @capabilities={{this.model.capabilities}}
 />
\ No newline at end of file
diff --git a/ui/lib/sync/addon/templates/secrets/destinations/destination/sync.hbs b/ui/lib/sync/addon/templates/secrets/destinations/destination/sync.hbs
index 6a2304e6f2b..5caf77f4bdf 100644
--- a/ui/lib/sync/addon/templates/secrets/destinations/destination/sync.hbs
+++ b/ui/lib/sync/addon/templates/secrets/destinations/destination/sync.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
-<Secrets::Page::Destinations::Destination::Sync @destination={{this.model}} />
\ No newline at end of file
+<Secrets::Page::Destinations::Destination::Sync @destination={{this.model.destination}} />
\ No newline at end of file
diff --git a/ui/lib/sync/addon/templates/secrets/destinations/index.hbs b/ui/lib/sync/addon/templates/secrets/destinations/index.hbs
index 644f98bfcbc..e3c252c550b 100644
--- a/ui/lib/sync/addon/templates/secrets/destinations/index.hbs
+++ b/ui/lib/sync/addon/templates/secrets/destinations/index.hbs
@@ -1,9 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Secrets::Page::Destinations
+  @capabilities={{this.model.capabilities}}
   @destinations={{this.model.destinations}}
   @nameFilter={{this.model.nameFilter}}
   @typeFilter={{this.model.typeFilter}}
diff --git a/ui/lib/sync/addon/templates/secrets/destinations/loading.hbs b/ui/lib/sync/addon/templates/secrets/destinations/loading.hbs
index 45dfe248ba7..35426b00d56 100644
--- a/ui/lib/sync/addon/templates/secrets/destinations/loading.hbs
+++ b/ui/lib/sync/addon/templates/secrets/destinations/loading.hbs
@@ -1,6 +1,6 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <LayoutLoading />
\ No newline at end of file
diff --git a/ui/lib/sync/addon/templates/secrets/overview.hbs b/ui/lib/sync/addon/templates/secrets/overview.hbs
index 72f31cc6e44..007b448c9aa 100644
--- a/ui/lib/sync/addon/templates/secrets/overview.hbs
+++ b/ui/lib/sync/addon/templates/secrets/overview.hbs
@@ -1,9 +1,10 @@
 {{!
-  Copyright (c) HashiCorp, Inc.
+  Copyright IBM Corp. 2016, 2025
   SPDX-License-Identifier: BUSL-1.1
-~}}
+}}
 
 <Secrets::Page::Overview
   @destinations={{this.model.destinations}}
-  @totalVaultSecrets={{this.model.associations.total_secrets}}
+  @totalVaultSecrets={{this.model.totalSecrets}}
+  @canActivateSecretsSync={{this.model.canActivateSecretsSync}}
 />
\ No newline at end of file
diff --git a/ui/lib/sync/addon/utils/api-method-resolver.ts b/ui/lib/sync/addon/utils/api-method-resolver.ts
new file mode 100644
index 00000000000..8c7f53e13dc
--- /dev/null
+++ b/ui/lib/sync/addon/utils/api-method-resolver.ts
@@ -0,0 +1,27 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+/**
+ * Util that resolves the API client method name for a given action and destination type
+ * Typically both type and name would be defined as params -> /sys/sync/destinations/{type}/{name}
+ * This would result in a method on the API client like systemReadSyncDestinations('aws-sm', 'my-destination')
+ * This unfortunately is not the case and type was hardcoded in the path -> /sys/sync/destinations/aws-sm/{name}
+ * This results in GET, POST and DELETE methods for each destination type -> systemReadSyncDestinationsAwsSmName('my-destination')
+ * Since these are used in numerous places, this util was created to more easily resolve the method name
+ */
+
+import { capitalize, classify } from '@ember/string';
+
+import type { DestinationType } from 'vault/sync';
+
+type TypeKey = 'AwsSm' | 'AzureKv' | 'GcpSm' | 'Gh' | 'VercelProject';
+
+export default function apiMethodResolver(
+  action: 'read' | 'write' | 'delete' | 'patch',
+  type: DestinationType
+) {
+  const method = `system${capitalize(action)}SyncDestinations${classify(type)}Name`;
+  return method as `system${Capitalize<typeof action>}SyncDestinations${TypeKey}Name`;
+}
diff --git a/ui/lib/sync/addon/utils/api-transforms.ts b/ui/lib/sync/addon/utils/api-transforms.ts
new file mode 100644
index 00000000000..794207f2f0c
--- /dev/null
+++ b/ui/lib/sync/addon/utils/api-transforms.ts
@@ -0,0 +1,53 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { findDestination } from 'core/helpers/sync-destinations';
+
+import type { DestinationType, ListDestination } from 'vault/sync';
+import type { SystemListSyncDestinationsResponse } from '@hashicorp/vault-client-typescript';
+
+// transforms the systemListSyncDestinations response to a flat array
+// destination name and type are the only properties returned from the request
+// to satisfy the list views, combine this data with static properties icon and typeDisplayName
+// the flat array is then filtered by name and type if filter values are provided
+export const listDestinationsTransform = (
+  response: SystemListSyncDestinationsResponse,
+  nameFilter?: string,
+  typeFilter?: string
+) => {
+  const { key_info } = response;
+  const destinations: ListDestination[] = [];
+  // build ListDestination objects from keyInfo
+  for (const key in key_info) {
+    // iterate through each type's destination names
+    const names = (key_info as Record<string, string[]>)[key];
+    // remove trailing slash from key
+    const type = key.replace(/\/$/, '') as DestinationType;
+
+    names?.forEach((name: string) => {
+      const id = `${type}/${name}`;
+      const { icon, name: type_display_name } = findDestination(type);
+      // create object with destination's id and attributes
+      destinations.push({ id, name, type, icon, type_display_name });
+    });
+  }
+
+  // optionally filter by name and type
+  let filteredDestinations = [...destinations];
+
+  const filter = (key: 'type' | 'name', value: string) => {
+    return filteredDestinations.filter((destination: ListDestination) => {
+      return destination[key].toLowerCase().includes(value.toLowerCase());
+    });
+  };
+  if (typeFilter) {
+    filteredDestinations = filter('type', typeFilter);
+  }
+  if (nameFilter) {
+    filteredDestinations = filter('name', nameFilter);
+  }
+
+  return filteredDestinations;
+};
diff --git a/ui/lib/sync/config/environment.js b/ui/lib/sync/config/environment.js
index c27504f655a..e372e84a373 100644
--- a/ui/lib/sync/config/environment.js
+++ b/ui/lib/sync/config/environment.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/lib/sync/index.js b/ui/lib/sync/index.js
index 2cba3736227..48987e82ecb 100644
--- a/ui/lib/sync/index.js
+++ b/ui/lib/sync/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,6 +16,10 @@ module.exports = buildEngine({
     enabled: false,
   }),
 
+  babel: {
+    plugins: [require.resolve('ember-concurrency/async-arrow-task-transform')],
+  },
+
   isDevelopingAddon() {
     return true;
   },
diff --git a/ui/lib/sync/package.json b/ui/lib/sync/package.json
index de25621938c..943da546bb2 100644
--- a/ui/lib/sync/package.json
+++ b/ui/lib/sync/package.json
@@ -11,9 +11,8 @@
     "ember-concurrency": "*",
     "@ember/test-waiters": "*",
     "ember-cli-typescript": "*",
+    "ember-auto-import": "*",
     "@types/ember": "latest",
-    "@types/ember-data": "latest",
-    "@types/ember-data__store": "latest",
     "@types/ember__array": "latest",
     "@types/ember__component": "latest",
     "@types/ember__controller": "latest",
diff --git a/ui/lint-staged.config.mjs b/ui/lint-staged.config.mjs
new file mode 100644
index 00000000000..073e01d51af
--- /dev/null
+++ b/ui/lint-staged.config.mjs
@@ -0,0 +1,14 @@
+/* eslint-env node */
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+// defining config here rather than in package.json to run tsc on all .ts files, not just the staged changes
+// this is accomplished by using function syntax rather than string
+
+export default {
+  '*.{js,ts}': ['prettier --config .prettierrc.js --write', 'eslint --quiet', () => 'tsc --noEmit'],
+  '*.hbs': ['prettier --config .prettierrc.js --write', 'ember-template-lint --quiet'],
+  '*.scss': ['prettier --write'],
+};
diff --git a/ui/mirage/config.js b/ui/mirage/config.js
index 022fe3d49f4..6ab3e624d57 100644
--- a/ui/mirage/config.js
+++ b/ui/mirage/config.js
@@ -1,24 +1,36 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+import { createServer } from 'miragejs';
+import { discoverEmberDataModels } from 'ember-cli-mirage';
 import ENV from 'vault/config/environment';
 import handlers from './handlers';
-
 // remember to export handler name from mirage/handlers/index.js file
 
-export default function () {
+export default function (config) {
+  const finalConfig = {
+    ...config,
+    logging: false,
+    models: {
+      ...discoverEmberDataModels(config.store),
+      ...config.models,
+    },
+    routes,
+  };
+
+  return createServer(finalConfig);
+}
+
+function routes() {
   this.namespace = 'v1';
 
-  // start ember in development running mirage -> yarn start:mirage handlerName
-  // if handler is not provided, general config will be used
-  // this is useful for feature development when a specific and limited config is required
   const { handler } = ENV['ember-cli-mirage'];
   const handlerName = handler in handlers ? handler : 'base';
   handlers[handlerName](this);
   this.logging = false; // disables passthrough logging which spams the console
   console.log(`⚙ Using ${handlerName} Mirage request handlers ⚙`); // eslint-disable-line
-  // passthrough all unhandled requests
+
   this.passthrough();
 }
diff --git a/ui/mirage/factories/configuration.js b/ui/mirage/factories/configuration.js
index 4082ef63dd9..5da8ba7843d 100644
--- a/ui/mirage/factories/configuration.js
+++ b/ui/mirage/factories/configuration.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory, trait } from 'ember-cli-mirage';
+import { Factory, trait } from 'miragejs';
 
 export default Factory.extend({
   auth: null,
diff --git a/ui/mirage/factories/database-connection.js b/ui/mirage/factories/database-connection.js
index 2f6e8db22a4..ba819c8688e 100644
--- a/ui/mirage/factories/database-connection.js
+++ b/ui/mirage/factories/database-connection.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 // For the purposes of testing, we only use a subset of fields relevant to mysql
 export default Factory.extend({
diff --git a/ui/mirage/factories/feature.js b/ui/mirage/factories/feature.js
index c1e9ee9dcef..367673f2637 100644
--- a/ui/mirage/factories/feature.js
+++ b/ui/mirage/factories/feature.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   feature_flags() {
diff --git a/ui/mirage/factories/kubernetes-config.js b/ui/mirage/factories/kubernetes-config.js
index 7b8eb353914..f75c9e7c1e3 100644
--- a/ui/mirage/factories/kubernetes-config.js
+++ b/ui/mirage/factories/kubernetes-config.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   kubernetes_host: 'https://192.168.99.100:8443',
diff --git a/ui/mirage/factories/kubernetes-role.js b/ui/mirage/factories/kubernetes-role.js
index 028eb962436..f13f7838239 100644
--- a/ui/mirage/factories/kubernetes-role.js
+++ b/ui/mirage/factories/kubernetes-role.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory, trait } from 'ember-cli-mirage';
+import { Factory, trait } from 'miragejs';
 
 const generated_role_rules = `rules:
 - apiGroups: [""]
diff --git a/ui/mirage/factories/kv-metadatum.js b/ui/mirage/factories/kv-metadatum.js
index 84a097e7d9a..a04113a6db4 100644
--- a/ui/mirage/factories/kv-metadatum.js
+++ b/ui/mirage/factories/kv-metadatum.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 // This cannot be called kv-metadata because mirage checks for plural factory names, and metadata and data are considered plural. It will throw an error.
-import { Factory, trait } from 'ember-cli-mirage';
+import { Factory, trait } from 'miragejs';
 
 // define data outside of factory for linting error: https://github.com/ember-cli/eslint-plugin-ember/issues/202#issuecomment-356255988
 const data = {
@@ -16,10 +16,13 @@ const data = {
   delete_version_after: '3h25m19s',
   max_versions: 15,
   oldest_version: 0,
-  updated_time: '2018-03-22T02:36:43.986212308Z',
+  updated_time: '2023-07-21T03:11:58.095971Z',
+  // the API returns custom_metadata: null if empty but because the attr is an 'object' ember data transforms it to an empty object.
+  // this is important because we rely on the empty object as a truthy value in template conditionals
+  custom_metadata: null,
   versions: {
     1: {
-      created_time: '2023-07-20T02:12:09.11529Z',
+      created_time: '2018-03-22T02:24:06.945319214Z',
       deletion_time: '',
       destroyed: false,
     },
@@ -45,10 +48,13 @@ export default Factory.extend({
   data,
 
   withCustomMetadata: trait({
-    custom_metadata: {
-      foo: 'abc',
-      bar: '123',
-      baz: '5c07d823-3810-48f6-a147-4c06b5219e84',
+    data: {
+      ...data,
+      custom_metadata: {
+        foo: 'abc',
+        bar: '123',
+        baz: '5c07d823-3810-48f6-a147-4c06b5219e84',
+      },
     },
   }),
 
diff --git a/ui/mirage/factories/ldap-config.js b/ui/mirage/factories/ldap-config.js
index aa4e8bda178..0ffff8ffb4f 100644
--- a/ui/mirage/factories/ldap-config.js
+++ b/ui/mirage/factories/ldap-config.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   backend: 'ldap-test',
diff --git a/ui/mirage/factories/ldap-credential.js b/ui/mirage/factories/ldap-credential.js
index 37ede363aa0..bd1889ef111 100644
--- a/ui/mirage/factories/ldap-credential.js
+++ b/ui/mirage/factories/ldap-credential.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory, trait } from 'ember-cli-mirage';
+import { Factory, trait } from 'miragejs';
 
 export default Factory.extend({
   // static props
diff --git a/ui/mirage/factories/ldap-library.js b/ui/mirage/factories/ldap-library.js
index 3cfa3451fc9..f367b453a05 100644
--- a/ui/mirage/factories/ldap-library.js
+++ b/ui/mirage/factories/ldap-library.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   name: (i) => `library-${i}`,
diff --git a/ui/mirage/factories/ldap-role.js b/ui/mirage/factories/ldap-role.js
index e108ec75779..6c2366dfd2f 100644
--- a/ui/mirage/factories/ldap-role.js
+++ b/ui/mirage/factories/ldap-role.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory, trait } from 'ember-cli-mirage';
+import { Factory, trait } from 'miragejs';
 
 export default Factory.extend({
   name: (i) => `role-${i}`,
diff --git a/ui/mirage/factories/login-rule.js b/ui/mirage/factories/login-rule.js
new file mode 100644
index 00000000000..c7539abb935
--- /dev/null
+++ b/ui/mirage/factories/login-rule.js
@@ -0,0 +1,14 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { Factory } from 'miragejs';
+
+export default Factory.extend({
+  name: (i) => `Login-rule-${i}`,
+  namespace_path: (i) => `namespace-${i}/`,
+  default_auth_type: 'okta',
+  backup_auth_types: () => ['oidc', 'token'],
+  disable_inheritance: false,
+});
diff --git a/ui/mirage/factories/mfa-duo-method.js b/ui/mirage/factories/mfa-duo-method.js
index bea96f59141..7e760a79bff 100644
--- a/ui/mirage/factories/mfa-duo-method.js
+++ b/ui/mirage/factories/mfa-duo-method.js
@@ -1,15 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   api_hostname: 'api-foobar.duosecurity.com',
   mount_accessor: '',
   name: '', // returned but cannot be set at this time
-  namespace_id: 'root',
+  namespace_path: '', // the root namespace returns an empty string for the path
   pushinfo: '',
   type: 'duo',
   use_passcode: false,
diff --git a/ui/mirage/factories/mfa-login-enforcement.js b/ui/mirage/factories/mfa-login-enforcement.js
index bfc2b5bfb45..01ca3b500e4 100644
--- a/ui/mirage/factories/mfa-login-enforcement.js
+++ b/ui/mirage/factories/mfa-login-enforcement.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   auth_method_accessors: null,
diff --git a/ui/mirage/factories/mfa-method.js b/ui/mirage/factories/mfa-method.js
index 67e3e903019..0f334c9f705 100644
--- a/ui/mirage/factories/mfa-method.js
+++ b/ui/mirage/factories/mfa-method.js
@@ -1,13 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   type: 'okta',
   uses_passcode: false,
+  self_enrollment_enabled: false,
 
   afterCreate(mfaMethod) {
     if (mfaMethod.type === 'totp') {
diff --git a/ui/mirage/factories/mfa-okta-method.js b/ui/mirage/factories/mfa-okta-method.js
index 29b3347da93..7319cd90fa9 100644
--- a/ui/mirage/factories/mfa-okta-method.js
+++ b/ui/mirage/factories/mfa-okta-method.js
@@ -1,15 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   base_url: 'okta.com',
   mount_accessor: '',
   name: '', // returned but cannot be set at this time
-  namespace_id: 'root',
+  namespace_path: 'admin/',
   org_name: 'dev-foobar',
   type: 'okta',
   username_template: '', // returned but cannot be set at this time
diff --git a/ui/mirage/factories/mfa-pingid-method.js b/ui/mirage/factories/mfa-pingid-method.js
index 7b87465dbe8..9bc283af02f 100644
--- a/ui/mirage/factories/mfa-pingid-method.js
+++ b/ui/mirage/factories/mfa-pingid-method.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   use_signature: true,
@@ -13,5 +13,5 @@ export default Factory.extend({
   org_alias: 'foobarbaz',
   type: 'pingid',
   username_template: '',
-  namespace_id: 'root',
+  namespace_path: 'admin/',
 });
diff --git a/ui/mirage/factories/mfa-totp-method.js b/ui/mirage/factories/mfa-totp-method.js
index b4ac63b9749..0c0e1ae0a2d 100644
--- a/ui/mirage/factories/mfa-totp-method.js
+++ b/ui/mirage/factories/mfa-totp-method.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   algorithm: 'SHA1',
@@ -12,10 +12,11 @@ export default Factory.extend({
   key_size: 20,
   max_validation_attempts: 5,
   name: '', // returned but cannot be set at this time
-  namespace_id: 'root',
+  namespace_path: 'admin/',
   period: 30,
   qr_size: 200,
   skew: 1,
+  self_enrollment_enabled: false,
   type: 'totp',
 
   afterCreate(record) {
diff --git a/ui/mirage/factories/open-api-explorer.js b/ui/mirage/factories/open-api-explorer.js
index 6d18fd8ec3b..84e73379d8c 100644
--- a/ui/mirage/factories/open-api-explorer.js
+++ b/ui/mirage/factories/open-api-explorer.js
@@ -1,45 +1,78 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
-/* eslint-disable ember/avoid-leaking-state-in-ember-objects */
+import { Factory } from 'miragejs';
+
 export default Factory.extend({
   openapi: '3.0.2',
-  info: {
-    title: 'HashiCorp Vault API',
-    description: 'HTTP API that gives you full access to Vault. All API routes are prefixed with `/v1/`.',
-    version: '1.0.0',
-    license: {
-      name: 'Mozilla Public License 2.0',
-      url: 'https://www.mozilla.org/en-US/MPL/2.0',
-    },
-  },
-  paths: {
-    '/auth/token/create': {
-      description: 'The token create path is used to create new tokens.',
-      post: {
-        summary: 'The token create path is used to create new tokens.',
-        tags: ['auth'],
-        responses: {
-          200: {
-            description: 'OK',
+  // set in afterCreate to avoid leaking state lint error
+  info: null,
+  paths: null,
+
+  afterCreate(spec) {
+    spec.info = {
+      title: 'HashiCorp Vault API',
+      description: 'HTTP API that gives you full access to Vault. All API routes are prefixed with `/v1/`.',
+      version: '1.0.0',
+      license: {
+        name: 'Mozilla Public License 2.0',
+        url: 'https://www.mozilla.org/en-US/MPL/2.0',
+      },
+    };
+
+    spec.paths = {
+      '/auth/token/create': {
+        description: 'The token create path is used to create new tokens.',
+        post: {
+          summary: 'The token create path is used to create new tokens.',
+          tags: ['auth'],
+          operationId: 'token-create',
+          responses: {
+            200: {
+              description: 'OK',
+            },
+          },
+        },
+      },
+      'auth/token/roles/{role_name}': {
+        description: '',
+        get: {
+          summary: '',
+          tags: ['auth'],
+          operationId: 'token-read-role',
+          parameters: [
+            {
+              name: 'role_name',
+              required: true,
+              in: 'path',
+              schema: {
+                type: 'string',
+              },
+              description: 'Name of the role',
+            },
+          ],
+          responses: {
+            200: {
+              description: 'OK',
+            },
           },
         },
       },
-    },
-    '/secret/data/{path}': {
-      description: 'Location of a secret.',
-      post: {
-        summary: 'Location of a secret.',
-        tags: ['secret'],
-        responses: {
-          200: {
-            description: 'OK',
+      '/secret/data/{path}': {
+        description: 'Location of a secret.',
+        post: {
+          summary: 'Location of a secret.',
+          tags: ['secret'],
+          operationId: 'kv-v2-write',
+          responses: {
+            200: {
+              description: 'OK',
+            },
           },
         },
       },
-    },
+    };
   },
 });
diff --git a/ui/mirage/factories/secret-engine.js b/ui/mirage/factories/secret-engine.js
index 7fc3167817f..75cd76e8e9a 100644
--- a/ui/mirage/factories/secret-engine.js
+++ b/ui/mirage/factories/secret-engine.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   path: 'foo/',
diff --git a/ui/mirage/factories/server.js b/ui/mirage/factories/server.js
index dfdbd950723..2563292a669 100644
--- a/ui/mirage/factories/server.js
+++ b/ui/mirage/factories/server.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   address: '127.0.0.1',
diff --git a/ui/mirage/factories/snapshot.js b/ui/mirage/factories/snapshot.js
new file mode 100644
index 00000000000..997407cd8db
--- /dev/null
+++ b/ui/mirage/factories/snapshot.js
@@ -0,0 +1,15 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { Factory } from 'miragejs';
+import timestamp from 'core/utils/timestamp';
+import { addHours } from 'date-fns';
+
+export default Factory.extend({
+  status: 'ready',
+  // Snapshots expire after 72 hours
+  expires_at: addHours(timestamp.now(), 72),
+  snapshot_id: '9465df92-8236-4af9-8cc8-b7460d882e41s',
+});
diff --git a/ui/mirage/factories/sync-association.js b/ui/mirage/factories/sync-association.js
index af5b99f4528..1a2539dedbf 100644
--- a/ui/mirage/factories/sync-association.js
+++ b/ui/mirage/factories/sync-association.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory } from 'ember-cli-mirage';
+import { Factory } from 'miragejs';
 
 export default Factory.extend({
   accessor: 'kv_eb4acbae', // mount will be added to API response for use in the ui but leaving since it is a documented property
diff --git a/ui/mirage/factories/sync-destination.js b/ui/mirage/factories/sync-destination.js
index 27180d16f39..f46ea9be0be 100644
--- a/ui/mirage/factories/sync-destination.js
+++ b/ui/mirage/factories/sync-destination.js
@@ -1,9 +1,18 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Factory, trait } from 'ember-cli-mirage';
+import { Factory, trait } from 'miragejs';
+
+const options = {
+  granularity: 'secret-path', // default varies per destination, but setting all as secret-path so edit test loop updates each to 'secret-key'
+  secret_name_template: 'vault/{{ .MountAccessor }}/{{ .SecretPath }}',
+};
+const optionsWithTags = {
+  ...options,
+  custom_tags: { foo: 'bar' },
+};
 
 export default Factory.extend({
   ['aws-sm']: trait({
@@ -16,35 +25,28 @@ export default Factory.extend({
     role_arn: 'test-role',
     external_id: 'id12345',
     // options
-    granularity: 'secret-path', // default varies per destination, but setting all as secret-path so edit test loop updates each to 'secret-key'
-    secret_name_template: 'vault-{{ .MountAccessor }}-{{ .SecretPath }}',
-    custom_tags: { foo: 'bar' },
+    ...optionsWithTags,
   }),
   ['azure-kv']: trait({
     type: 'azure-kv',
     name: 'destination-azure',
     // connection_details
     key_vault_uri: 'https://keyvault-1234abcd.vault.azure.net',
-    subscription_id: 'subscription-id',
     tenant_id: 'tenant-id',
     client_id: 'azure-client-id',
     client_secret: '*****',
     cloud: 'Azure Public Cloud',
     // options
-    granularity: 'secret-path',
-    secret_name_template: 'vault-{{ .MountAccessor }}-{{ .SecretPath }}',
-    custom_tags: { foo: 'bar' },
+    ...optionsWithTags,
   }),
   ['gcp-sm']: trait({
     type: 'gcp-sm',
     name: 'destination-gcp',
-    project_id: 'id12345',
     // connection_details
     credentials: '*****',
+    project_id: 'id12345',
     // options
-    granularity: 'secret-path',
-    secret_name_template: 'vault-{{ .MountAccessor }}-{{ .SecretPath }}',
-    custom_tags: { foo: 'bar' },
+    ...optionsWithTags,
   }),
   gh: trait({
     type: 'gh',
@@ -54,8 +56,7 @@ export default Factory.extend({
     repository_owner: 'my-organization-or-username',
     repository_name: 'my-repository',
     // options
-    granularity: 'secret-path',
-    secret_name_template: 'vault-{{ .MountAccessor }}-{{ .SecretPath }}',
+    ...options,
   }),
   ['vercel-project']: trait({
     type: 'vercel-project',
@@ -66,7 +67,6 @@ export default Factory.extend({
     team_id: 'team_12345',
     deployment_environments: ['development', 'preview'], // 'production' is also an option, but left out for testing to assert form changes value
     // options
-    granularity: 'secret-path',
-    secret_name_template: 'vault-{{ .MountAccessor }}-{{ .SecretPath }}',
+    ...options,
   }),
 });
diff --git a/ui/mirage/handlers/base.js b/ui/mirage/handlers/base.js
index 92ebdbda44e..04f28681dbe 100644
--- a/ui/mirage/handlers/base.js
+++ b/ui/mirage/handlers/base.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,6 +16,15 @@ export default function (server) {
     };
   });
 
+  server.get('/sys/activation-flags', () => {
+    return {
+      data: {
+        activated: [''],
+        unactivated: ['secrets-sync'],
+      },
+    };
+  });
+
   server.get('/sys/health', function () {
     return {
       enterprise: true,
@@ -37,14 +46,6 @@ export default function (server) {
     };
   });
 
-  server.get('/sys/internal/ui/version', function () {
-    return {
-      data: {
-        version: '1.9.0+ent',
-      },
-    };
-  });
-
   server.get('/sys/license/status', function () {
     return {
       data: {
diff --git a/ui/mirage/handlers/chroot-namespace.js b/ui/mirage/handlers/chroot-namespace.js
index 6a6fb5d7eca..603ec867bce 100644
--- a/ui/mirage/handlers/chroot-namespace.js
+++ b/ui/mirage/handlers/chroot-namespace.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/handlers/clients.js b/ui/mirage/handlers/clients.js
index a2e3cb0f578..fcd0c09edcb 100644
--- a/ui/mirage/handlers/clients.js
+++ b/ui/mirage/handlers/clients.js
@@ -1,103 +1,118 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import {
-  isBefore,
-  startOfMonth,
-  endOfMonth,
   addMonths,
-  subMonths,
-  differenceInCalendarMonths,
+  endOfMonth,
+  formatRFC3339,
   fromUnixTime,
   isAfter,
-  formatRFC3339,
+  isBefore,
+  isSameMonth,
+  isWithinInterval,
+  subMonths,
 } from 'date-fns';
 import { parseAPITimestamp } from 'core/utils/date-formatters';
+import { CLIENT_TYPES } from 'core/utils/client-count-utils';
+
+/*
+HOW TO ADD NEW TYPES:
+1. add key to CLIENT_TYPES
+2. Find "ADD NEW CLIENT TYPES HERE" comment below and add type to destructuring array
+3. Add generateMounts() for that client type to the mounts array
+*/
+export const LICENSE_START = new Date('2023-07-02T00:00:00Z');
+export const STATIC_NOW = new Date('2024-01-25T23:59:59Z');
+export const STATIC_PREVIOUS_MONTH = new Date('2023-12-25T23:59:59Z');
+const COUNTS_START = subMonths(STATIC_NOW, 12); // user started Vault cluster on 2023-01-25
+// upgrade happened 2 month after license start
+export const UPGRADE_DATE = new Date('2023-09-01T00:00:00Z'); // monthly attribution added
 
-// Matches mocked date in client-dashboard-test file
-const CURRENT_DATE = new Date('2023-01-13T14:15:00');
-const COUNTS_START = subMonths(CURRENT_DATE, 12); // pretend vault user started cluster 6 months ago
-// for testing, we're in the middle of a license/billing period
-const LICENSE_START = startOfMonth(subMonths(CURRENT_DATE, 6));
-// upgrade happened 1 month after license start
-const UPGRADE_DATE = addMonths(LICENSE_START, 1);
+// exported so that tests not using this scenario can use the same response
+export const CONFIG_RESPONSE = {
+  request_id: 'some-config-id',
+  data: {
+    billing_start_timestamp: formatRFC3339(LICENSE_START),
+    enabled: 'default-enabled',
+    minimum_retention_months: 48,
+    queries_available: false,
+    reporting_enabled: true,
+    retention_months: 48,
+  },
+};
 
+// --------- FOR DATA GENERATION
 function getSum(array, key) {
   return array.reduce((sum, { counts }) => sum + counts[key], 0);
 }
 
 function getTotalCounts(array) {
-  return {
-    distinct_entities: getSum(array, 'entity_clients'),
-    entity_clients: getSum(array, 'entity_clients'),
-    non_entity_tokens: getSum(array, 'non_entity_clients'),
-    non_entity_clients: getSum(array, 'non_entity_clients'),
-    secret_syncs: getSum(array, 'secret_syncs'),
-    clients: getSum(array, 'clients'),
-  };
+  return CLIENT_TYPES.reduce((obj, key) => {
+    obj[key] = getSum(array, key);
+    return obj;
+  }, {});
 }
 
 function randomBetween(min, max) {
-  return Math.floor(Math.random() * (max - min + 1) + min);
+  const secureRandom = crypto.getRandomValues(new Uint32Array(1))[0] * Math.pow(2, -32);
+  return Math.floor(secureRandom * (max - min + 1) + min);
 }
 
-function arrayOfCounts(max, arrayLength) {
-  var result = [];
-  var sum = 0;
-  for (var i = 0; i < arrayLength - 1; i++) {
-    result[i] = randomBetween(1, max - (arrayLength - i - 1) - sum);
-    sum += result[i];
-  }
-  result[arrayLength - 1] = max - sum;
-  return result.sort((a, b) => b - a);
+function generateMountBlock(path, counts) {
+  const baseObject = CLIENT_TYPES.reduce((obj, key) => {
+    obj[key] = 0;
+    return obj;
+  }, {});
+  // this logic is random nonsense just to have some mounts be "deleted"
+  // "mount_type" from /sys/internal/counters/activity ends in a trailing slash (but in the export activity data it does not)
+  const setMountType = () => (counts.clients % 5 <= 1 ? 'deleted mount' : `${path.split('/')[1]}/`);
+  return {
+    mount_path: path,
+    mount_type: setMountType(),
+    counts: {
+      ...baseObject,
+      // object contains keys for which 0-values of base object to overwrite
+      ...counts,
+    },
+  };
 }
 
-function generateNamespaceBlock(idx = 0, isLowerCounts = false, ns) {
+function generateNamespaceBlock(idx = 0, isLowerCounts = false, ns, skipCounts = false) {
   const min = isLowerCounts ? 10 : 50;
-  const max = isLowerCounts ? 100 : 5000;
+  const max = isLowerCounts ? 100 : 1000;
   const nsBlock = {
     namespace_id: ns?.namespace_id || (idx === 0 ? 'root' : Math.random().toString(36).slice(2, 7) + idx),
-    namespace_path: ns?.namespace_path || (idx === 0 ? '' : `ns/${idx}`),
+    namespace_path: ns?.namespace_path || (idx === 0 ? '' : `ns${idx}/`),
     counts: {},
     mounts: {},
   };
-  const mounts = [];
-
-  Array.from(Array(5)).forEach((mount, index) => {
-    const [secretSyncs] = arrayOfCounts(randomBetween(min, max), 1);
-    mounts.push({
-      mount_path: `kvv2-engine-${index}`,
-      counts: {
-        clients: secretSyncs,
-        // TODO test with live backend to confirm entity keys are present (and 0) for kv mounts
-        entity_clients: 0,
-        non_entity_clients: 0,
-        distinct_entities: 0,
-        non_entity_tokens: 0,
-        secret_syncs: secretSyncs,
-      },
-    });
-  });
 
-  // generate auth mounts array
-  Array.from(Array(10)).forEach((mount, index) => {
-    const mountClients = randomBetween(min, max);
-    const [nonEntity, entity] = arrayOfCounts(mountClients, 2);
-    mounts.push({
-      mount_path: `auth/authid${index}`,
-      counts: {
-        clients: mountClients,
-        entity_clients: entity,
-        non_entity_clients: nonEntity,
-        distinct_entities: entity,
-        non_entity_tokens: nonEntity,
-        // TODO test with live backend to confirm this key is present (and 0) for auth mounts (non-kv mounts)
-        secret_syncs: 0,
-      },
-    });
-  });
+  if (skipCounts) return nsBlock; // skip counts to generate empty ns block with namespace ids and paths
+
+  // generates one mount per client type
+  const mountsArray = (idx) => {
+    // * ADD NEW CLIENT TYPES HERE and pass to a new generateMountBlock() function below
+    const [acme_clients, entity_clients, non_entity_clients, secret_syncs] = CLIENT_TYPES.map(() =>
+      randomBetween(min, max)
+    );
+
+    // each mount type generates a different type of client
+    return [
+      generateMountBlock(`auth/token/${idx}/`, {
+        clients: non_entity_clients + entity_clients,
+        non_entity_clients,
+        entity_clients,
+      }),
+      generateMountBlock(`secrets/kv/${idx}/`, { clients: secret_syncs, secret_syncs }),
+      generateMountBlock(`acme/pki/${idx}/`, { clients: acme_clients, acme_clients }),
+    ];
+  };
+
+  // two mounts per client type for more varied mock data
+  const mounts = [...mountsArray(0), ...mountsArray(1)];
+
   mounts.sort((a, b) => b.counts.clients - a.counts.clients);
   nsBlock.mounts = mounts;
   nsBlock.counts = getTotalCounts(mounts);
@@ -105,52 +120,162 @@ function generateNamespaceBlock(idx = 0, isLowerCounts = false, ns) {
 }
 
 function generateMonths(startDate, endDate, namespaces) {
-  const startDateObject = startOfMonth(parseAPITimestamp(startDate));
-  const endDateObject = startOfMonth(parseAPITimestamp(endDate));
-  const numberOfMonths = differenceInCalendarMonths(endDateObject, startDateObject) + 1;
+  const startDateObject = parseAPITimestamp(startDate);
+  const endDateObject = parseAPITimestamp(endDate);
+  const startMonth = startDateObject.getUTCMonth() + startDateObject.getUTCFullYear() * 12;
+  const endMonth = endDateObject.getUTCMonth() + endDateObject.getUTCFullYear() * 12;
+  const numberOfMonths = endMonth - startMonth + 1;
   const months = [];
-  if (isBefore(startDateObject, UPGRADE_DATE) && isBefore(endDateObject, UPGRADE_DATE)) {
-    // months block is empty if dates do not span an upgrade
-    return [];
-  }
-  for (let i = 0; i < numberOfMonths; i++) {
-    const month = addMonths(startDateObject, i);
-    const hasNoData = isBefore(month, UPGRADE_DATE);
-    if (hasNoData) {
+
+  // only generate monthly block if queried dates span or follow upgrade to 1.10
+  const upgradeWithin = isWithinInterval(UPGRADE_DATE, { start: startDateObject, end: endDateObject });
+  const upgradeAfter = isAfter(startDateObject, UPGRADE_DATE);
+
+  if (upgradeWithin || upgradeAfter) {
+    for (let i = 0; i < numberOfMonths; i++) {
+      const month = new Date(Date.UTC(startDateObject.getUTCFullYear(), startDateObject.getUTCMonth() + i));
+
+      const hasNoData = isBefore(month, UPGRADE_DATE) && !isSameMonth(month, UPGRADE_DATE);
+      if (hasNoData) {
+        months.push({
+          timestamp: month.toISOString(),
+          counts: null,
+          namespaces: null,
+          new_clients: null,
+        });
+        continue;
+      }
+
+      const monthNs = namespaces.map((ns, idx) => generateNamespaceBlock(idx, false, ns));
+      const newClients = namespaces.map((ns, idx) => generateNamespaceBlock(idx, true, ns));
       months.push({
-        timestamp: formatRFC3339(month),
-        counts: null,
-        namespaces: null,
-        new_clients: null,
+        timestamp: month.toISOString(),
+        counts: getTotalCounts(monthNs),
+        namespaces: monthNs.sort((a, b) => b.counts.clients - a.counts.clients),
+        new_clients: {
+          counts: getTotalCounts(newClients),
+          namespaces: newClients.sort((a, b) => b.counts.clients - a.counts.clients),
+        },
       });
-      continue;
     }
-
-    const monthNs = namespaces.map((ns, idx) => generateNamespaceBlock(idx, false, ns));
-    const newClients = namespaces.map((ns, idx) => generateNamespaceBlock(idx, true, ns));
-    months.push({
-      timestamp: formatRFC3339(month),
-      counts: getTotalCounts(monthNs),
-      namespaces: monthNs.sort((a, b) => b.counts.clients - a.counts.clients),
-      new_clients: {
-        counts: getTotalCounts(newClients),
-        namespaces: newClients.sort((a, b) => b.counts.clients - a.counts.clients),
-      },
-    });
   }
   return months;
 }
 
-function generateActivityResponse(namespaces, startDate, endDate) {
+function generateActivityResponse(startDate, endDate) {
+  let namespaces = Array.from(Array(12)).map((v, idx) => generateNamespaceBlock(idx, null, null, true));
+  const months = generateMonths(startDate, endDate, namespaces);
+  if (months.length) {
+    const monthlyCounts = months.filter((m) => m.counts);
+    // sum namespace counts from monthly data
+    namespaces.forEach((ns) => {
+      const nsData = monthlyCounts.map((d) =>
+        d.namespaces.find((n) => n.namespace_path === ns.namespace_path)
+      );
+      const mountCounts = nsData.flatMap((d) => d.mounts);
+      ns.mounts = nsData[0].mounts.map((mount) => {
+        const counts = getTotalCounts(mountCounts.filter((m) => m.mount_path === mount.mount_path));
+        return { ...mount, counts };
+      });
+      ns.counts = getTotalCounts(nsData);
+    });
+  } else {
+    // if no monthly data due to upgrade stuff, generate counts
+    namespaces = Array.from(Array(12)).map((v, idx) => generateNamespaceBlock(idx));
+  }
+  namespaces.sort((a, b) => b.counts.clients - a.counts.clients);
   return {
     start_time: isAfter(new Date(startDate), COUNTS_START) ? startDate : formatRFC3339(COUNTS_START),
     end_time: endDate,
-    by_namespace: namespaces.sort((a, b) => b.counts.clients - a.counts.clients),
-    months: generateMonths(startDate, endDate, namespaces),
+    by_namespace: namespaces,
+    months,
     total: getTotalCounts(namespaces),
   };
 }
 
+// --------- FOR MOCK FILTERING
+
+/**
+ * Helper fn for calculating total counts based on array containing counts block
+ */
+function calcCounts(arr) {
+  return arr.reduce(
+    (prev, ns) => {
+      const base = ns.counts;
+      prev.entity_clients += base.entity_clients;
+      prev.non_entity_clients += base.non_entity_clients;
+      prev.clients += base.clients;
+      prev.secret_syncs += base.secret_syncs;
+      prev.acme_clients += base.acme_clients;
+      return prev;
+    },
+    {
+      entity_clients: 0,
+      non_entity_clients: 0,
+      clients: 0,
+      secret_syncs: 0,
+      acme_clients: 0,
+    }
+  );
+}
+
+/**
+ * Helper fn to filter namespaces to include the namespace itself, and any children
+ */
+function filterByNamespace(namespaces, namespacePath) {
+  // if we simply do a check for startsWith, filtering for `ns1` will include `ns11` as well as the desired `ns1/child`
+  return namespaces.filter(
+    (ns) => ns.namespace_path === namespacePath || ns.namespace_path.startsWith(`${namespacePath}/`)
+  );
+}
+
+/**
+ * Helper fn to filter months data from activity response
+ */
+function filterMonths(months, namespacePath) {
+  return months.map((month) => {
+    if (!month.namespaces) return month;
+
+    const newMonth = {
+      ...month,
+    };
+    const filteredNs = filterByNamespace(month.namespaces, namespacePath);
+    const monthsCount = calcCounts(filteredNs);
+
+    if (month.new_clients?.namespaces) {
+      const filteredNewNs = filterByNamespace(month.new_clients.namespaces, namespacePath);
+      const newCount = calcCounts(filteredNewNs);
+
+      newMonth.new_clients.namespaces = filteredNewNs;
+      newMonth.new_clients.counts = newCount;
+    }
+
+    newMonth.namespaces = filteredNs;
+    newMonth.counts = monthsCount;
+    return newMonth;
+  });
+}
+
+/**
+ * Util to mock filter namespace data from the activity response, matching what the API does
+ */
+function filterActivityResponse(originalData, namespacePath) {
+  // make a deep copy of the object so we don't mutate the original
+  const data = JSON.parse(JSON.stringify(originalData));
+  if (!namespacePath) return data;
+
+  const filteredMonths = filterMonths(data.months, namespacePath);
+  const filteredNs = filterByNamespace(data.by_namespace, namespacePath);
+  const filteredTotals = calcCounts(filteredNs);
+  return {
+    ...data,
+    months: filteredMonths,
+    by_namespace: filteredNs,
+    total: filteredTotals,
+  };
+}
+
+// --------- SERVER FN
 export default function (server) {
   server.get('sys/license/status', function () {
     return {
@@ -159,40 +284,115 @@ export default function (server) {
         autoloaded: {
           license_id: 'my-license-id',
           start_time: formatRFC3339(LICENSE_START),
-          expiration_time: formatRFC3339(endOfMonth(addMonths(CURRENT_DATE, 6))),
+          expiration_time: formatRFC3339(endOfMonth(addMonths(STATIC_NOW, 6))),
         },
       },
     };
   });
 
   server.get('sys/internal/counters/config', function () {
-    return {
-      request_id: 'some-config-id',
-      data: {
-        default_report_months: 12,
-        enabled: 'default-enable',
-        queries_available: true,
-        retention_months: 24,
-        billing_start_timestamp: formatRFC3339(LICENSE_START),
-      },
-    };
+    return CONFIG_RESPONSE;
   });
 
   server.get('/sys/internal/counters/activity', (schema, req) => {
+    const activities = schema['clients/activities'];
+    const namespace = req.requestHeaders['X-Vault-Namespace'];
     let { start_time, end_time } = req.queryParams;
+
+    if (!start_time) {
+      // if there are no date query params, the activity log default behavior
+      // queries from the builtin license start timestamp to the current month
+      start_time = LICENSE_START.toISOString();
+    }
+    if (!end_time) {
+      end_time = STATIC_NOW.toISOString();
+    }
     // backend returns a timestamp if given unix time, so first convert to timestamp string here
-    if (!start_time.includes('T')) start_time = fromUnixTime(start_time).toISOString();
-    if (!end_time.includes('T')) end_time = fromUnixTime(end_time).toISOString();
-    const namespaces = Array.from(Array(12)).map((v, idx) => generateNamespaceBlock(idx));
+    if (!start_time?.includes('T')) start_time = fromUnixTime(start_time).toISOString();
+    if (!end_time?.includes('T')) end_time = fromUnixTime(end_time).toISOString();
+
+    const record = activities.findBy({ start_time, end_time });
+    let data;
+    if (record) {
+      // if we already have data for the given start/end time, use that
+      data = {
+        start_time: record.start_time,
+        end_time: record.end_time,
+        by_namespace: record.by_namespace,
+        months: record.months,
+        total: record.total,
+      };
+    } else {
+      data = generateActivityResponse(start_time, end_time);
+      activities.create(data);
+    }
     return {
       request_id: 'some-activity-id',
       lease_id: '',
       renewable: false,
       lease_duration: 0,
-      data: generateActivityResponse(namespaces, start_time, end_time),
+      data: filterActivityResponse(data, namespace),
       wrap_info: null,
-      warnings: null,
+      warnings: req.queryParams.end_time
+        ? null
+        : [
+            'Since this usage period includes both the current month and at least one historical month, counts returned in this usage period are an estimate. Client counts for this period will no longer be estimated at the start of the next month.',
+          ],
       auth: null,
     };
   });
+
+  // client counting has changed in different ways since 1.9 see link below for details
+  // https://developer.hashicorp.com/vault/docs/concepts/client-count/faq#client-count-faq
+  server.get('sys/version-history', function () {
+    return {
+      request_id: 'version-history-request-id',
+      data: {
+        keys: ['1.9.0', '1.9.1', '1.10.1', '1.10.3', '1.14.4', '1.16.0', '1.17.0'],
+        key_info: {
+          // entity/non-entity breakdown added
+          '1.9.0': {
+            // we don't currently use build_date, including for accuracy. it's only tracked in versions >= 1.11.0
+            build_date: null,
+            previous_version: null,
+            timestamp_installed: '2023-07-02T00:00:00Z',
+          },
+          '1.9.1': {
+            build_date: null,
+            previous_version: '1.9.0',
+            timestamp_installed: '2023-08-02T00:00:00Z',
+          },
+          // auth mount attribution added in 1.10.0
+          '1.10.1': {
+            build_date: null,
+            previous_version: '1.9.1',
+            timestamp_installed: '2023-09-02T00:00:00Z', // same as UPGRADE_DATE
+          },
+          '1.10.3': {
+            build_date: null,
+            previous_version: '1.10.1',
+            timestamp_installed: '2023-10-23T00:00:00Z',
+          },
+          // no notable UI changes
+          '1.14.4': {
+            build_date: '2023-11-02T00:00:00Z',
+            previous_version: '1.10.3',
+            timestamp_installed: '2023-11-02T00:00:00Z',
+          },
+          // sync clients added
+          '1.16.0': {
+            build_date: '2023-11-23T00:00:00Z',
+            previous_version: '1.14.4',
+            timestamp_installed: '2023-11-23T00:00:00Z',
+          },
+          // acme_clients separated from non-entity clients
+          '1.17.0': {
+            build_date: '2023-12-02T00:00:00Z',
+            previous_version: '1.16.0',
+            timestamp_installed: '2023-12-02T00:00:00Z',
+          },
+        },
+      },
+    };
+  });
 }
diff --git a/ui/mirage/handlers/custom-login.js b/ui/mirage/handlers/custom-login.js
new file mode 100644
index 00000000000..18d82616339
--- /dev/null
+++ b/ui/mirage/handlers/custom-login.js
@@ -0,0 +1,70 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { sanitizePath } from 'core/utils/sanitize-path';
+
+export default function (server) {
+  // LIST, READ and DELETE requests for default-auth (login customizations)
+  server.get('sys/config/ui/login/default-auth', (schema, req) => {
+    // API expects { data: { list: true } } as query params when making LIST requests
+    if (req.queryParams.list) {
+      const records = schema.db['loginRules'];
+      if (records) {
+        const keys = records.map(({ name }) => name);
+        const key_info = records.reduce((obj, record) => {
+          const { name, namespace_path, disable_inheritance } = record;
+          obj[name] = { namespace_path, disable_inheritance, name };
+          return obj;
+        }, {});
+        return {
+          data: { keys, key_info },
+        };
+      }
+      return new Response(404, {}, { errors: [] });
+    }
+  });
+
+  server.get('sys/config/ui/login/default-auth/:name', (schema, req) => {
+    // req.params come in as: { name: "Login rule name" }
+    const record = schema.db['loginRules'].findBy(req.params);
+    if (record) {
+      delete record.id; // "name" is the id
+      return { data: record };
+    }
+    return new Response(404, {}, { errors: [] });
+  });
+
+  server.delete('sys/config/ui/login/default-auth/:name', (schema, req) => {
+    const record = schema.db['loginRules'].findBy(req.params);
+    if (record) {
+      schema.db['loginRules'].remove(record);
+      return new Response(204); // No content
+    }
+    return new Response(404, {}, { errors: [] });
+  });
+
+  // UNAUTHENTICATED READ ONLY for login form display logic
+  server.get('sys/internal/ui/default-auth-methods', (schema, req) => {
+    const nsHeader = req.requestHeaders['X-Vault-Namespace'];
+    const findRule = (ns) => schema.db['loginRules'].findBy({ namespace_path: ns });
+    // the namespace header shouldn't have a trailing slash, but sanitize just in case
+    //  if no namespace is passed then it's the root namespace (which does not have a trailing slash)
+    const nsPath = sanitizePath(nsHeader) ? `${nsHeader}/` : 'root';
+    let rule = findRule(nsPath);
+
+    if (!rule && nsHeader?.includes('/')) {
+      // for simplicity, tests only support namespaces nested one level, e.g. "test-ns/child"
+      const [parent] = nsHeader.split('/');
+      const parentRule = findRule(`${parent}/`);
+      rule = parentRule?.disable_inheritance ? null : parentRule;
+    }
+
+    // Fallback to root namespace settings to simulate inheritance if no rule exists or parent has disabled inheritance
+    rule = rule || findRule('root');
+
+    const { default_auth_type, backup_auth_types, disable_inheritance } = rule || {};
+    return { data: { default_auth_type, backup_auth_types, disable_inheritance } };
+  });
+}
diff --git a/ui/mirage/handlers/custom-messages.js b/ui/mirage/handlers/custom-messages.js
index 3e273e770db..a5d27c23914 100644
--- a/ui/mirage/handlers/custom-messages.js
+++ b/ui/mirage/handlers/custom-messages.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/handlers/database.js b/ui/mirage/handlers/database.js
index e4c22aac59e..2ec10ce441d 100644
--- a/ui/mirage/handlers/database.js
+++ b/ui/mirage/handlers/database.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/handlers/hcp-link.js b/ui/mirage/handlers/hcp-link.js
index c4e6950363f..a61bcdb8176 100644
--- a/ui/mirage/handlers/hcp-link.js
+++ b/ui/mirage/handlers/hcp-link.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/handlers/index.js b/ui/mirage/handlers/index.js
index 1c1e0d3b064..35a2b6ec6d5 100644
--- a/ui/mirage/handlers/index.js
+++ b/ui/mirage/handlers/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,8 +7,9 @@
 // individual lookup done in mirage config
 import base from './base';
 import chrootNamespace from './chroot-namespace';
-import customMessages from './custom-messages';
 import clients from './clients';
+import customLogin from './custom-login';
+import customMessages from './custom-messages';
 import database from './database';
 import hcpLink from './hcp-link';
 import kms from './kms';
@@ -17,13 +18,17 @@ import ldap from './ldap';
 import mfaConfig from './mfa-config';
 import mfaLogin from './mfa-login';
 import oidcConfig from './oidc-config';
+import recovery from './recovery';
 import reducedDisclosure from './reduced-disclosure';
+import replication from './replication';
 import sync from './sync';
 
 export {
   base,
   chrootNamespace,
   clients,
+  customLogin,
+  customMessages,
   database,
   hcpLink,
   kms,
@@ -32,7 +37,8 @@ export {
   mfaConfig,
   mfaLogin,
   oidcConfig,
+  recovery,
   reducedDisclosure,
-  customMessages,
+  replication,
   sync,
 };
diff --git a/ui/mirage/handlers/kms.js b/ui/mirage/handlers/kms.js
index 36fd25080ea..59e180795f2 100644
--- a/ui/mirage/handlers/kms.js
+++ b/ui/mirage/handlers/kms.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/handlers/kubernetes.js b/ui/mirage/handlers/kubernetes.js
index 022d801bdfa..18c7d0cbab8 100644
--- a/ui/mirage/handlers/kubernetes.js
+++ b/ui/mirage/handlers/kubernetes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/handlers/ldap.js b/ui/mirage/handlers/ldap.js
index 0e976241ae8..f286c603161 100644
--- a/ui/mirage/handlers/ldap.js
+++ b/ui/mirage/handlers/ldap.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -30,30 +30,44 @@ export default function (server) {
   };
   const listRecords = (schema, dbKey, query = {}) => {
     const records = schema.db[dbKey].where(query);
+    const keys = records.map(({ name }) => {
+      if (name.includes('/')) {
+        const [parent, child] = name.split('/');
+        // query.name is only passed by listOrGetRecord and means we want to list children of admin/
+        // otherwise this is the request for all roles in an engine so we return the top-level paths
+        return query?.name ? child : `${parent}/`;
+      }
+      return name;
+    });
+
     return {
-      data: { keys: records.map((record) => record.name) },
+      data: { keys },
     };
   };
 
-  // mount
-  server.post('/sys/mounts/:path', () => new Response(204));
-  server.get('/sys/internal/ui/mounts/:path', () => ({
-    data: {
-      accessor: 'ldap_ade94329',
-      type: 'ldap',
-      path: 'ldap-test/',
-      uuid: '35e9119d-5708-4b6b-58d2-f913e27f242d',
-      config: {},
-    },
-  }));
+  const listOrGetRecord = (schema, req, type) => {
+    const dbKey = type ? 'ldapRoles' : 'ldapLibraries';
+    const query = type ? { type, name: `admin/child-${type}-role` } : { name: 'admin/test-library' };
+    if (req.queryParams.list) {
+      // the mirage database has setup all hierarchical names to be prefixed with "admin/"
+      // while passing a query with specific name is not flexible, for simplicity
+      // we only seeded the mirage db with one hierarchical resource for each role and a library
+      return listRecords(schema, dbKey, query);
+    }
+    // otherwise we want to view details for a specific resource
+    return getRecord(schema, req, dbKey);
+  };
+
   // config
   server.post('/:backend/config', (schema, req) => createOrUpdateRecord(schema, req, 'ldapConfigs'));
   server.get('/:backend/config', (schema, req) => getRecord(schema, req, 'ldapConfigs'));
   // roles
   server.post('/:backend/static-role/:name', (schema, req) => createOrUpdateRecord(schema, req, 'ldapRoles'));
   server.post('/:backend/role/:name', (schema, req) => createOrUpdateRecord(schema, req, 'ldapRoles'));
-  server.get('/:backend/static-role/:name', (schema, req) => getRecord(schema, req, 'ldapRoles', 'static'));
-  server.get('/:backend/role/:name', (schema, req) => getRecord(schema, req, 'ldapRoles', 'dynamic'));
+  // if the role is hierarchical the name ends in a forward slash so we make a list request
+  server.get('/:backend/static-role/*name', (schema, req) => listOrGetRecord(schema, req, 'static'));
+  server.get('/:backend/role/*name', (schema, req) => listOrGetRecord(schema, req, 'dynamic'));
+
   server.get('/:backend/static-role', (schema) => listRecords(schema, 'ldapRoles', { type: 'static' }));
   server.get('/:backend/role', (schema) => listRecords(schema, 'ldapRoles', { type: 'dynamic' }));
   // role credentials
@@ -65,10 +79,62 @@ export default function (server) {
   }));
   // libraries
   server.post('/:backend/library/:name', (schema, req) => createOrUpdateRecord(schema, req, 'ldapLibraries'));
-  server.get('/:backend/library/:name', (schema, req) => getRecord(schema, req, 'ldapLibraries'));
+  server.get('/:backend/library/*name', (schema, req) => listOrGetRecord(schema, req));
   server.get('/:backend/library', (schema) => listRecords(schema, 'ldapLibraries'));
-  server.get('/:backend/library/:name/status', () => ({
-    'bob.johnson': { available: false, borrower_client_token: '8b80c305eb3a7dbd161ef98f10ea60a116ce0910' },
-    'mary.smith': { available: true },
-  }));
+  server.get('/:backend/library/*name/status', (schema) => {
+    const data = schema.db['ldapAccountStatuses'].reduce((prev, curr) => {
+      prev[curr.account] = {
+        available: curr.available,
+        borrower_client_token: curr.borrower_client_token,
+      };
+      return prev;
+    }, {});
+    return { data };
+  });
+  // check-out / check-in
+  server.post('/:backend/library/:set_name/check-in', (schema, req) => {
+    // Check-in makes an unavailable account available again
+    const { service_account_names } = JSON.parse(req.requestBody);
+    const dbCollection = schema.db['ldapAccountStatuses'];
+    const updated = dbCollection.find(service_account_names).map((f) => ({
+      ...f,
+      available: true,
+      borrower_client_token: undefined,
+    }));
+    updated.forEach((u) => {
+      dbCollection.update(u.id, u);
+    });
+    return {
+      data: {
+        check_ins: service_account_names,
+      },
+    };
+  });
+  server.post('/:backend/library/:set_name/check-out', (schema, req) => {
+    const { set_name, backend } = req.params;
+    const dbCollection = schema.db['ldapAccountStatuses'];
+    const available = dbCollection.where({ available: true });
+    if (available) {
+      return Response(404, {}, { errors: ['no accounts available to check out'] });
+    }
+    const checkOut = {
+      ...available[0],
+      available: false,
+      borrower_client_token: crypto.randomUUID(),
+    };
+    dbCollection.update(checkOut.id, checkOut);
+    return {
+      request_id: '364a17d4-e5ab-998b-ceee-b49929229e0c',
+      lease_id: `${backend}/library/${set_name}/check-out/aoBsaBEI4PK96VnukubvYDlZ`,
+      renewable: true,
+      lease_duration: 36000,
+      data: {
+        password: crypto.randomUUID(),
+        service_account_name: checkOut.account,
+      },
+      wrap_info: null,
+      warnings: null,
+      auth: null,
+    };
+  });
 }
diff --git a/ui/mirage/handlers/mfa-config.js b/ui/mirage/handlers/mfa-config.js
index f16caa5ecdd..455ff93e36a 100644
--- a/ui/mirage/handlers/mfa-config.js
+++ b/ui/mirage/handlers/mfa-config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -38,7 +38,7 @@ export default function (server) {
     let records = [];
     if (isMethod) {
       methods.forEach((method) => {
-        records.addObjects(schema.db[dbKeyFromType(method)].where({}));
+        records = [...records, ...schema.db[dbKeyFromType(method)].where({})];
       });
     } else {
       records = schema.db.mfaLoginEnforcements.where({});
@@ -50,7 +50,7 @@ export default function (server) {
           records.push(server.create(`mfa-${type}-method`));
         });
       } else {
-        records = server.createList('mfa-login-enforcement', 4).toArray();
+        records = server.createList('mfa-login-enforcement', 4);
       }
     }
     const dataKey = isMethod ? 'id' : 'name';
diff --git a/ui/mirage/handlers/mfa-login.js b/ui/mirage/handlers/mfa-login.js
index 9ae39f6f838..57eff9547f9 100644
--- a/ui/mirage/handlers/mfa-login.js
+++ b/ui/mirage/handlers/mfa-login.js
@@ -1,16 +1,39 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+/* 
+* HOW TO USE THIS HANDLER
+- Create the mfa users below in Vault (e.g. "mfa-a") - there is a config.sh script in the vault-tools repo to expedite this
+- do NOT configure MFA, this mirage handler stubs all of that
+- For TOTP the passcode for successful login is "test"
+- PingID is used to test push failure states
+*/
+
 import { Response } from 'miragejs';
 import Ember from 'ember';
-import fetch from 'fetch';
+
+export const QR_CODE_URL =
+  'otpauth://totp/vault-not-self-enroll:daf8420c-0b6b-34e6-ff38-ee1ed093bea9?algorithm=SHA1\u0026digits=6\u0026issuer=vault-not-self-enroll\u0026period=30\u0026secret=JGPHY3TZBIUCHWYN7ZO3LHISKQIAJZGL';
 
 // initial auth response cache -- lookup by mfa_request_id key
 const authResponses = {};
 // mfa requirement cache -- lookup by mfa_request_id key
 const mfaRequirement = {};
+// mfa constraint cache -- lookup by mfa_request_id key
+const mfaConstraints = {};
+
+export const buildEnforcementError = (method, constraintName) => {
+  // Although this block is just for pingid, adding failure message for posterity and testing other method error states
+  const failure =
+    method.type === 'totp'
+      ? 'failed to validate TOTP passcode'
+      : `${method.type} authentication failed: "Login request denied."`;
+  const name = constraintName || 'My Secure Enforcement';
+  const msg = `failed to satisfy enforcement ${name}. error: 2 errors occurred:\n\t* ${failure}\n\t* login MFA validation failed for methodID: [${method.id}]\n\n`;
+  return new Response(403, {}, { errors: [msg] });
+};
 
 // may be imported in tests when the validation request needs to be intercepted to make assertions prior to returning a response
 // in that case it may be helpful to still use this validation logic to ensure to payload is as expected
@@ -18,23 +41,24 @@ export const validationHandler = (schema, req) => {
   try {
     const { mfa_request_id, mfa_payload } = JSON.parse(req.requestBody);
     const mfaRequest = mfaRequirement[mfa_request_id];
+    const constraintNameLookup = mfaConstraints[mfa_request_id];
 
     if (!mfaRequest) {
       return new Response(404, {}, { errors: ['MFA Request ID not found'] });
     }
     // validate request body
-    for (const constraintId in mfa_payload) {
+    for (const methodId in mfa_payload) {
       // ensure ids were passed in map
-      const method = mfaRequest.methods.find(({ id }) => id === constraintId);
+      const method = mfaRequest.methods.find(({ id }) => id === methodId);
       if (!method) {
-        return new Response(400, {}, { errors: [`Invalid MFA constraint id ${constraintId} passed in map`] });
+        return new Response(400, {}, { errors: [`Invalid MFA method id ${methodId} passed in map`] });
       }
       // test non-totp validation by rejecting all pingid requests
       if (method.type === 'pingid') {
-        return new Response(403, {}, { errors: ['PingId MFA validation failed'] });
+        return buildEnforcementError(method, constraintNameLookup[method.id]);
       }
       // validate totp passcode
-      const passcode = mfa_payload[constraintId][0];
+      const passcode = mfa_payload[methodId][0];
       if (method.uses_passcode) {
         const expectedPasscode = method.type === 'duo' ? 'passcode=test' : 'test';
         if (passcode !== expectedPasscode) {
@@ -43,9 +67,12 @@ export const validationHandler = (schema, req) => {
               used: 'code already used; new code is available in 30 seconds',
               limit:
                 'maximum TOTP validation attempts 4 exceeded the allowed attempts 3. Please try again in 15 seconds',
-            }[passcode] || 'failed to validate';
+            }[passcode] || null;
           console.log(error); // eslint-disable-line
-          return new Response(403, {}, { errors: [error] });
+          if (error) {
+            return new Response(403, {}, { errors: [error] });
+          }
+          return buildEnforcementError(method, constraintNameLookup[method.id]);
         }
       } else if (passcode) {
         // for okta and duo, reject if a passcode was provided
@@ -64,7 +91,8 @@ export default function (server) {
   const generateMfaRequirement = (req, res) => {
     const { user } = req.params;
     // uses_passcode automatically set to true in factory for totp type
-    const m = (type, uses_passcode = false) => server.create('mfa-method', { type, uses_passcode });
+    const m = (type, { uses_passcode = false, self_enrollment_enabled = false } = {}) =>
+      server.create('mfa-method', { type, uses_passcode, self_enrollment_enabled });
     let mfa_constraints = {};
     let methods = []; // flat array of methods for easy lookup during validation
 
@@ -83,24 +111,69 @@ export default function (server) {
     } else if (user === 'mfa-b') {
       [mfa_constraints, methods] = generator([m('okta')]); // 1 constraint 1 non-passcode
     } else if (user === 'mfa-c') {
-      [mfa_constraints, methods] = generator([m('totp'), m('duo', true)]); // 1 constraint 2 passcodes
+      [mfa_constraints, methods] = generator([m('totp'), m('duo', { uses_passcode: true })]); // 1 constraint 2 passcodes
     } else if (user === 'mfa-d') {
       [mfa_constraints, methods] = generator([m('okta'), m('duo')]); // 1 constraint 2 non-passcode
     } else if (user === 'mfa-e') {
       [mfa_constraints, methods] = generator([m('okta'), m('totp')]); // 1 constraint 1 passcode 1 non-passcode
     } else if (user === 'mfa-f') {
-      [mfa_constraints, methods] = generator([m('totp')], [m('duo', true)]); // 2 constraints 1 passcode for each
+      [mfa_constraints, methods] = generator([m('totp')], [m('duo', { uses_passcode: true })]); // 2 constraints 1 passcode for each
     } else if (user === 'mfa-g') {
       [mfa_constraints, methods] = generator([m('okta')], [m('duo')]); // 2 constraints 1 non-passcode for each
     } else if (user === 'mfa-h') {
       [mfa_constraints, methods] = generator([m('totp')], [m('okta')]); // 2 constraints 1 passcode 1 non-passcode
     } else if (user === 'mfa-i') {
-      [mfa_constraints, methods] = generator([m('okta'), m('totp')], [m('totp')]); // 2 constraints 1 passcode/1 non-passcode 1 non-passcode
+      [mfa_constraints, methods] = generator([m('okta'), m('totp')], [m('duo', { uses_passcode: true })]); // 2 constraints 1 non-passcode or 1 non-passcode and 1 passcode
     } else if (user === 'mfa-j') {
       [mfa_constraints, methods] = generator([m('pingid')]); // use to test push failures
     } else if (user === 'mfa-k') {
       [mfa_constraints, methods] = generator([m('duo', true)]); // test duo passcode and prepending passcode= to user input
+
+      // * SELF-ENROLLMENT USERS BELOW
+      // users match counterpart config scenario above
+      // e.g. "mfa-a" is the same as "mfa-a-self", but with self-enroll enabled
+    } else if (user === 'mfa-a-self') {
+      // 1 constraint 1 passcode
+      [mfa_constraints, methods] = generator([m('totp', { self_enrollment_enabled: true })]);
+    } else if (user === 'mfa-c-self') {
+      // 1 constraint 2 passcodes
+      [mfa_constraints, methods] = generator([
+        m('totp', { self_enrollment_enabled: true }),
+        m('duo', { uses_passcode: true }),
+      ]);
+    } else if (user === 'mfa-f-self') {
+      // 2 constraints 1 passcode for each
+      [mfa_constraints, methods] = generator(
+        [m('totp', { self_enrollment_enabled: true })],
+        [m('duo', { uses_passcode: true })]
+      );
+    } else if (user === 'mfa-h-self') {
+      // 2 constraints 1 passcode 1 non-passcode
+      [mfa_constraints, methods] = generator([m('totp', { self_enrollment_enabled: true })], [m('okta')]);
+    } else if (user === 'mfa-i-self') {
+      // 2 constraints 1 non-passcode or 1 non-passcode and 1 passcode
+      [mfa_constraints, methods] = generator(
+        [m('okta'), m('totp', { self_enrollment_enabled: true })],
+        [m('duo', { uses_passcode: true })]
+      );
+    } else if (user === 'mfa-y-self') {
+      // 1 constraint 2 self-enroll methods
+      [mfa_constraints, methods] = generator([
+        m('totp', { self_enrollment_enabled: true }),
+        m('totp', { self_enrollment_enabled: true }),
+      ]);
+    } else if (user === 'mfa-z-self') {
+      // We've discussed that this scenario likely won't be allowed in the real-world
+      // by having the API restrict self-enrollment so it's only be possible when only ONE
+      // constraint has self_enrollment_enabled.
+      // 3 constraints, two have 2 methods (and each includes a method with self_enrollment_enabled)
+      [mfa_constraints, methods] = generator(
+        [m('totp', { self_enrollment_enabled: true }), m('pingid')],
+        [m('totp', { self_enrollment_enabled: true }), m('okta')],
+        [m('duo')]
+      );
     }
+
     const mfa_request_id = crypto.randomUUID();
     const mfa_requirement = {
       mfa_request_id,
@@ -108,6 +181,17 @@ export default function (server) {
     };
     // cache mfa requests to test different validation scenarios
     mfaRequirement[mfa_request_id] = { methods };
+    // cache login enforcement names
+    for (const [constraintName, constraint] of Object.entries(mfa_constraints)) {
+      // Create lookup by method ID
+      constraint.any.forEach((method) => {
+        if (!mfaConstraints[mfa_request_id]) {
+          mfaConstraints[mfa_request_id] = {};
+        }
+        mfaConstraints[mfa_request_id][method.id] = constraintName;
+      });
+    }
+
     // cache auth response to be returned later by sys/mfa/validate
     authResponses[mfa_request_id] = { ...res };
     return mfa_requirement;
@@ -156,4 +240,16 @@ export default function (server) {
   server.post('/auth/:method/login/:user', passthroughLogin);
 
   server.post('/sys/mfa/validate', validationHandler);
+
+  server.post('/identity/mfa/method/totp/self-enroll', async () => {
+    // For this endpoint to return a legitimate QR code, the user has to actually exist in Vault.
+    // Since we're using mirage to stub MFA users and methods this just returns a dummy QR code for testing.
+    return {
+      data: {
+        barcode:
+          'iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BAAAG50lEQVR4nOydwW4kNwxE42D//5c3h74oYFh4lDTZ6kG9k6FRS7ILJEiKPf71+/dfwYi///QBwr+JIGZEEDMiiBkRxIwIYkYEMSOCmBFBzIggZkQQMyKIGRHEjAhiRgQxI4KYEUHMiCBmRBAzftGJPz905npLvz71jD8j68/107pafarbpXuK/F5kze5ZDe9ciIWYEUHMwC7rgZu//rRzJtVpENfRfVpXm7rKehJ95gp3aw+xEDMiiBlDl/XAIxAdWXVOoDNzHrPp+KpzXN0unVvTZ97rCY2FmBFBzNhyWRyd0PE5df50dx1f6dhMz79LLMSMCGLGh13Wio5Vpolbjan0Ot1JSJrZxWOfIBZiRgQxY8tlTc22Rjt1vK5P6ktdzDYt1+s1CbdcWSzEjAhixtBlTYvJ0/qVvh8kz9Z9b63ZjU//JppYiBkRxIyfTyU6pFTe7U1K9+vKel/+qd79/yEWYkYEMWPYl0XuzmoCSNYkn3YxG9/lVvGf/x2mxELMiCBmXCq/77VZTtOx9SnSosDbHrp19F7ksmAap8VCzIggZhy4LG6eOo5a53ROYB3vqkkkuiMl/Tre7b7nljWxEDMiiBm4lrXXPLBXmp7Wu07G6xxykunMRFmvJYKYsXVjuFe45k6P7MgbPvm+pNKlz3BetI+FmBFBzDh+x5AkU9N+ct4IUdfRxXnex1VX7kbudnnFQsyIIGYMmxxISljH6wqkq5wkX9NyPT9nhbjW86aIWIgZEcSMA5fFYyTuQKaOSz+lHRSPrPTv20F6wCqxEDMiiBkHL+xwt1PH9X3cOn7e8MB7sUjjRHeSW8RCzIggZmxFWdP0aq9ds4O0TJBnp9GX3l2fIVHWa4kgZmy9sEMqSA8kydIzu6duxVfdLpq9ahghFmJGBDFj2JfVQRoyb/UyTcvyvKZEqnBkfsrvX0QEMeM4MSQ1H+J89m7ieNm8O78+5/TmUa9GiIWYEUHMOH4teh3fS6nqOGkc1T1gpG9Kn3B6iTBNUTtiIWZEEDOOmxy6cd4OUVfTa/LuLH3+lb1kcBrjEWIhZkQQM46bHLpxEml06/C4iF8EdCeszRXTfe+W4mMhZkQQMw5uDAkkCjppFtX7rjOnbq3OIfWrOjNR1suJIGZs1bIetGGu0YsugJ80i+pnu5pbfXbqXqYNHqllvZYIYsbBd793CR0pUJO+qYpOJEniuVenqs92+543PMRCzIggZmCXdXKtr28Ju8iNr8NjHs7JlUFqWV9EBDHj0hcpTys8dUQ3NnQ7kjI7Py13Nfr33bvNfIiFmBFBzLj6r1dJhWra5U5uJ+s4OSc5wzpHP7tXqK/EQsyIIGZcesfwpMOqztEz9XlI51i3y3TkE8RCzIggZmzdGPK+LJL0kb534i6m/WB6hHPrrvAhFmJGBDHj6j8FI2X26nxICjl1U2R37nJ1ilpPuJcSPsRCzIggZnyglvVAzLxzGp3r6GbqHbuYZy/ZrJ92v8sesRAzIogZH/g/huun+tn6VJd+kvYJ7eimJXGe5OoVpsRCzIggZlx6LbqbyYvtHXwXfdp1tWlJv1utrknOrImFmBFBzDj+p2ArPA4hc7pXfgidw+TJ47QZo1snfVkvJ4KYsdXk8B/LYBehi+080atzOk56rrrVyKnWdeKyXksEMePgHcO9iIL3ydef676ksWEvyup2nyabaXJ4ORHEjINvcujK5udF+G6ErEDu+HRZnkeJXSJ5QizEjAhixvC16AeS4umZ66d1F70+OaEe1z1XNcqaJncnpfhYiBkRxIyDKKvCC9TdOK9cTSO66flJL1b3W+jUVRMLMSOCmLFVy+J94OuIjpG4IyLrT1tMdQm9O+f070CIhZgRQczY+r6svUSJ1510fUmfcJ1fV9NxlHZie7tMiYWYEUHMOOjL4ndzZM2ui75zHXoOd4/dGchIPc95ET4WYkYEMeP4hR09Qp7tnA8p73dzeJTV1cempX5945la1muJIGYMy+8EfelP+pdO6kvdavXn+uz0plJHVqllfQURxIwPvLBTf+bVJBKZEFfWdUzxwv60K6zuu5cqxkLMiCBmbCWGPP7RSdzeLjx969oPuvXrXutMUmEjDaiaWIgZEcSMq9+X1UHaNevP9Vmymn62wuNGMp/P6YiFmBFBzPiwy9Il7nXOw60a1LStYprGTps0OLEQMyKIGVsua9q6MG1I4LvUvUgCOK1inTQwpJb1ciKIGQff5MBnknRvhRfeu6emt43rHJ5m6hgyN4ZfQQQx49L3ZYVbxELMiCBmRBAzIogZEcSMCGJGBDEjgpgRQcyIIGZEEDMiiBkRxIwIYkYEMSOCmBFBzIggZkQQMyKIGf8EAAD//zl1N+YGOSI8AAAAAElFTkSuQmCC',
+        url: QR_CODE_URL,
+      },
+    };
+  });
 }
diff --git a/ui/mirage/handlers/oidc-config.js b/ui/mirage/handlers/oidc-config.js
index 542141b0f63..942136f2567 100644
--- a/ui/mirage/handlers/oidc-config.js
+++ b/ui/mirage/handlers/oidc-config.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/handlers/recovery.js b/ui/mirage/handlers/recovery.js
new file mode 100644
index 00000000000..82fcbbf5a28
--- /dev/null
+++ b/ui/mirage/handlers/recovery.js
@@ -0,0 +1,157 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { Response } from 'miragejs';
+
+export default function (server) {
+  server.get('/sys/storage/raft/configuration', () => {
+    return server.create('configuration', 'withRaft');
+  });
+
+  // LOAD SNAPSHOT FORM HANDLERS
+  server.post('sys/storage/raft/snapshot-load', () => ({
+    data: {},
+  }));
+
+  server.post('sys/storage/raft/snapshot-auto/snapshot-load/:config_name', () => ({
+    data: {},
+  }));
+
+  // UNLOAD SNAPSHOT HANDLER
+  server.delete('/sys/storage/raft/snapshot-load/:snapshot_id', (schema, req) => {
+    const record = schema.db['snapshots'].findBy(req.params);
+    if (record) {
+      schema.db['snapshots'].remove(record);
+      return new Response(204); // No content
+    }
+    return new Response(404, {}, { errors: [] });
+  });
+
+  // LOADED SNAPSHOT HANDLERS
+  server.get('/sys/storage/raft/snapshot-load', (schema) => {
+    // Currently only one snapshot can be loaded at a time
+    const record = schema.db['snapshots'][0];
+
+    if (record) {
+      const { snapshot_id } = record;
+      return { data: { keys: [snapshot_id] } };
+    }
+    return new Response(404, {}, { errors: [] });
+  });
+
+  server.get('/sys/storage/raft/snapshot-load/:snapshot_id', (schema, req) => {
+    const record = schema.db['snapshots'].findBy(req.params);
+    if (record) {
+      delete record.id; // "snapshot_id" is the id
+      return { data: record };
+    }
+    return new Response(404, {}, { errors: [] });
+  });
+
+  // NAMESPACE SEARCH SELECT
+  server.get('/sys/internal/ui/namespaces', () => ({
+    data: {
+      keys: ['child-ns-1', 'child-ns-1/nested', 'child-ns-2'],
+    },
+  }));
+
+  // MOUNT SEARCH SELECT
+  server.get('/sys/internal/ui/mounts', () => ({
+    data: {
+      secret: {
+        'cubbyhole/': {
+          type: 'cubbyhole',
+          local: true,
+          path: 'cubbyhole/',
+        },
+        'kv/': {
+          type: 'kv',
+          local: false,
+          path: 'kv/',
+        },
+        'database/': {
+          type: 'database',
+          local: true,
+          path: 'database/',
+        },
+      },
+    },
+  }));
+
+  // READ SECRET HANDLERS
+  server.get('/cubbyhole/:path', (schema, req) => {
+    const path = req.params.path;
+
+    // Mock data for different paths
+    if (path === 'my-path') {
+      return {
+        data: {
+          secret_key: 'secret_value',
+          another_key: 'another_value',
+        },
+      };
+    }
+
+    if (path === 'nonexistent-secret') {
+      return new Response(404, {}, { errors: ['An error occurred, please try again'] });
+    }
+
+    // Default mock data for any other path
+    return {
+      data: {
+        key1: 'value1',
+        key2: 'value2',
+      },
+    };
+  });
+
+  server.get('/kv/:path', (schema, req) => {
+    const path = req.params.path;
+
+    // Mock data for different paths
+    if (path === 'my-path') {
+      return {
+        data: {
+          username: 'admin',
+          password: 'secret123',
+        },
+      };
+    }
+
+    // Default mock data for any other path
+    return {
+      data: {
+        foo: 'bar',
+        baz: 'qux',
+      },
+    };
+  });
+
+  server.get('/database/static-roles/:path', () => {
+    return {
+      data: {
+        credential_type: 'password',
+        db_name: 'test-db',
+        rotation_period: 86400,
+        rotation_statements: [],
+        skip_import_rotation: true,
+        username: 'super-user',
+      },
+    };
+  });
+
+  // RECOVER SECRET HANDLERS
+  server.post('/cubbyhole/:path', () => ({
+    data: {},
+  }));
+
+  server.post('/kv/:path', () => ({
+    data: {},
+  }));
+
+  server.post('/database/static-roles/:path', () => ({
+    data: {},
+  }));
+}
diff --git a/ui/mirage/handlers/reduced-disclosure.js b/ui/mirage/handlers/reduced-disclosure.js
index 73fc189d36c..4c93d340a4b 100644
--- a/ui/mirage/handlers/reduced-disclosure.js
+++ b/ui/mirage/handlers/reduced-disclosure.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,9 +10,13 @@ export default function (server) {
   server.get('/sys/health', (schema, req) =>
     modifyPassthroughResponse(req, { version: '', cluster_name: '' })
   );
-  server.get('/sys/seal-status', (schema, req) =>
-    modifyPassthroughResponse(req, { version: '', cluster_name: '', build_date: '' })
-  );
+  server.get('/sys/seal-status', (schema, req) => {
+    // When reduced disclosure is active, the version is only returned when a valid token is used
+    const overrides = req.requestHeaders['X-Vault-Token']
+      ? { cluster_name: '', build_date: '' }
+      : { version: '', cluster_name: '', build_date: '' };
+    return modifyPassthroughResponse(req, overrides);
+  });
   server.get('sys/replication/status', () => new Response(404, {}, { errors: ['disabled path'] }));
   server.get('sys/replication/dr/status', () => new Response(404, {}, { errors: ['disabled path'] }));
   server.get(
diff --git a/ui/mirage/handlers/replication.js b/ui/mirage/handlers/replication.js
new file mode 100644
index 00000000000..439b6536ad1
--- /dev/null
+++ b/ui/mirage/handlers/replication.js
@@ -0,0 +1,107 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export default function (server) {
+  server.get('sys/replication/status', function () {
+    return {
+      data: {
+        dr: {
+          cluster_id: 'dr-cluster-id',
+          corrupted_merkle_tree: false,
+          known_secondaries: ['foobar'],
+          last_corruption_check_epoch: '-62135596800',
+          last_dr_wal: 98,
+          last_reindex_epoch: '0',
+          last_wal: 98,
+          merkle_root: 'ad721f32ed6789a1e5824841f358a517340a4585',
+          mode: 'primary',
+          primary_cluster_addr: 'dr-foobar',
+          secondaries: [
+            {
+              api_address: 'http://127.0.0.1:8202',
+              cluster_address: 'https://127.0.0.1:8203',
+              connection_status: 'disconnected',
+              last_heartbeat: '2024-04-09T09:04:22-05:00',
+              node_id: 'foobar',
+            },
+          ],
+          ssct_generation_counter: 0,
+          state: 'running',
+        },
+        performance: {
+          cluster_id: 'perf-cluster-id',
+          corrupted_merkle_tree: false,
+          known_secondaries: [],
+          last_corruption_check_epoch: '-62135596800',
+          last_performance_wal: 98,
+          last_reindex_epoch: '0',
+          last_wal: 98,
+          merkle_root: '618c9136bb443aa584f5d6b90755d42888c9c54a',
+          mode: 'primary',
+          primary_cluster_addr: 'perf-foobar',
+          secondaries: [],
+          ssct_generation_counter: 0,
+          state: 'running',
+        },
+      },
+    };
+  });
+
+  server.get('sys/replication/performance/status', function () {
+    return {
+      data: {
+        cluster_id: 'perf-cluster-id',
+        corrupted_merkle_tree: false,
+        known_secondaries: ['foobar'],
+        last_corruption_check_epoch: '-62135596800',
+        last_dr_wal: 98,
+        last_reindex_epoch: '0',
+        last_wal: 98,
+        merkle_root: 'ad721f32ed6789a1e5824841f358a517340a4585',
+        mode: 'primary',
+        primary_cluster_addr: 'perf-foobar',
+        secondaries: [
+          {
+            api_address: 'http://127.0.0.1:8202',
+            cluster_address: 'https://127.0.0.1:8203',
+            connection_status: 'disconnected',
+            last_heartbeat: '2024-04-09T09:04:22-05:00',
+            node_id: 'foobar',
+          },
+        ],
+        ssct_generation_counter: 0,
+        state: 'running',
+      },
+    };
+  });
+
+  server.get('sys/replication/dr/status', function () {
+    return {
+      data: {
+        cluster_id: 'dr-cluster-id',
+        corrupted_merkle_tree: false,
+        known_secondaries: ['foobar'],
+        last_corruption_check_epoch: '-62135596800',
+        last_dr_wal: 98,
+        last_reindex_epoch: '0',
+        last_wal: 98,
+        merkle_root: 'ad721f32ed6789a1e5824841f358a517340a4585',
+        mode: 'primary',
+        primary_cluster_addr: 'dr-foobar',
+        secondaries: [
+          {
+            api_address: 'http://127.0.0.1:8202',
+            cluster_address: 'https://127.0.0.1:8203',
+            connection_status: 'disconnected',
+            last_heartbeat: '2024-04-09T09:04:22-05:00',
+            node_id: 'foobar',
+          },
+        ],
+        ssct_generation_counter: 0,
+        state: 'running',
+      },
+    };
+  });
+}
diff --git a/ui/mirage/handlers/sync.js b/ui/mirage/handlers/sync.js
index 86645fa6408..d5a5e30c80e 100644
--- a/ui/mirage/handlers/sync.js
+++ b/ui/mirage/handlers/sync.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,7 @@ import { Response } from 'miragejs';
 import { camelize } from '@ember/string';
 import { findDestination } from 'core/helpers/sync-destinations';
 import clientsHandler from './clients';
+import modifyPassthroughResponse from '../helpers/modify-passthrough-response';
 
 export const associationsResponse = (schema, req) => {
   const { type, name } = req.params;
@@ -14,7 +15,7 @@ export const associationsResponse = (schema, req) => {
   const records = schema.db.syncAssociations.where({ type, name });
   const associations = records.length
     ? records.reduce((associations, association) => {
-        const key = `${association.mount}/${association.secret_name}`;
+        const key = `${association.mount}_12345/${association.secret_name}`;
         delete association.type;
         delete association.name;
         associations[key] = association;
@@ -26,21 +27,21 @@ export const associationsResponse = (schema, req) => {
   // are added to the association response but they are not individual associations
   // the secret itself is still a single association
   const subKeys = {
-    'my-kv/my-granular-secret/foo': {
+    'my-kv_12345/my-granular-secret/foo': {
       mount: 'my-kv',
       secret_name: 'my-granular-secret',
       sync_status: 'SYNCED',
       updated_at: '2023-09-20T10:51:53.961861096-04:00',
       sub_key: 'foo',
     },
-    'my-kv/my-granular-secret/bar': {
+    'my-kv_12345/my-granular-secret/bar': {
       mount: 'my-kv',
       secret_name: 'my-granular-secret',
       sync_status: 'SYNCED',
       updated_at: '2023-09-20T10:51:53.961861096-04:00',
       sub_key: 'bar',
     },
-    'my-kv/my-granular-secret/baz': {
+    'my-kv_12345/my-granular-secret/baz': {
       mount: 'my-kv',
       secret_name: 'my-granular-secret',
       sync_status: 'SYNCED',
@@ -116,17 +117,47 @@ const createOrUpdateDestination = (schema, req) => {
 };
 
 export default function (server) {
+  // default to enterprise with Secrets Sync on the license and activated
+  server.get('sys/health', (schema, req) => modifyPassthroughResponse(req, { enterprise: true }));
+  server.get('/sys/license/features', () => ({ features: ['Secrets Sync'] }));
+  server.get('/sys/activation-flags', () => {
+    return {
+      data: {
+        activated: ['secrets-sync'],
+        unactivated: [''],
+      },
+    };
+  });
+
   const base = '/sys/sync/destinations';
   const uri = `${base}/:type/:name`;
 
   const destinationResponse = (record) => {
     delete record.id;
-    const { name, type, ...connection_details } = record;
+
+    const {
+      name,
+      type,
+      granularity,
+      secret_name_template,
+      custom_tags,
+      purge_initiated_at,
+      purge_error,
+      ...connection_details
+    } = record;
+
     return {
       data: {
-        connection_details,
         name,
         type,
+        connection_details,
+        options: {
+          granularity_level: granularity,
+          secret_name_template,
+          custom_tags,
+        },
+        purge_initiated_at,
+        purge_error,
       },
     };
   };
@@ -237,7 +268,7 @@ export default function (server) {
     schema.db.syncAssociations.update({ type, name }, { sync_status: 'UNSYNCED' });
     return associationsResponse(schema, req);
   });
-  server.get('sys/sync/associations/:mount/*name', (schema, req) => {
+  server.get('sys/sync/associations/destinations', (schema, req) => {
     return syncStatusResponse(schema, req);
   });
 
@@ -263,30 +294,24 @@ export default function (server) {
         end_time, // set by query params
         total: {
           clients: 15,
-          distinct_entities: 0,
           entity_clients: 0,
           non_entity_clients: 0,
-          non_entity_tokens: 0,
           secret_syncs: 15,
         },
         by_namespace: [
           {
             counts: {
               clients: 15,
-              distinct_entities: 0,
               entity_clients: 0,
               non_entity_clients: 0,
-              non_entity_tokens: 0,
               secret_syncs: 15,
             },
             mounts: [
               {
                 counts: {
                   clients: 15,
-                  distinct_entities: 0,
                   entity_clients: 0,
                   non_entity_clients: 0,
-                  non_entity_tokens: 0,
                   secret_syncs: 15,
                 },
                 mount_path: 'sys/',
@@ -301,30 +326,24 @@ export default function (server) {
           {
             counts: {
               clients: 10,
-              distinct_entities: 0,
               entity_clients: 0,
               non_entity_clients: 0,
-              non_entity_tokens: 0,
               secret_syncs: 10,
             },
             namespaces: [
               {
                 counts: {
                   clients: 10,
-                  distinct_entities: 0,
                   entity_clients: 0,
                   non_entity_clients: 0,
-                  non_entity_tokens: 0,
                   secret_syncs: 10,
                 },
                 mounts: [
                   {
                     counts: {
                       clients: 10,
-                      distinct_entities: 0,
                       entity_clients: 0,
                       non_entity_clients: 0,
-                      non_entity_tokens: 0,
                       secret_syncs: 10,
                     },
                     mount_path: 'sys/',
@@ -337,30 +356,24 @@ export default function (server) {
             new_clients: {
               counts: {
                 clients: 10,
-                distinct_entities: 0,
                 entity_clients: 0,
                 non_entity_clients: 0,
-                non_entity_tokens: 0,
                 secret_syncs: 10,
               },
               namespaces: [
                 {
                   counts: {
                     clients: 10,
-                    distinct_entities: 0,
                     entity_clients: 0,
                     non_entity_clients: 0,
-                    non_entity_tokens: 0,
                     secret_syncs: 10,
                   },
                   mounts: [
                     {
                       counts: {
                         clients: 10,
-                        distinct_entities: 0,
                         entity_clients: 0,
                         non_entity_clients: 0,
-                        non_entity_tokens: 0,
                         secret_syncs: 10,
                       },
                       mount_path: 'sys/',
@@ -376,30 +389,24 @@ export default function (server) {
           {
             counts: {
               clients: 7,
-              distinct_entities: 0,
               entity_clients: 0,
               non_entity_clients: 0,
-              non_entity_tokens: 0,
               secret_syncs: 7,
             },
             namespaces: [
               {
                 counts: {
                   clients: 7,
-                  distinct_entities: 0,
                   entity_clients: 0,
                   non_entity_clients: 0,
-                  non_entity_tokens: 0,
                   secret_syncs: 7,
                 },
                 mounts: [
                   {
                     counts: {
                       clients: 7,
-                      distinct_entities: 0,
                       entity_clients: 0,
                       non_entity_clients: 0,
-                      non_entity_tokens: 0,
                       secret_syncs: 7,
                     },
                     mount_path: 'sys/',
@@ -412,30 +419,24 @@ export default function (server) {
             new_clients: {
               counts: {
                 clients: 3,
-                distinct_entities: 0,
                 entity_clients: 0,
                 non_entity_clients: 0,
-                non_entity_tokens: 0,
                 secret_syncs: 3,
               },
               namespaces: [
                 {
                   counts: {
                     clients: 3,
-                    distinct_entities: 0,
                     entity_clients: 0,
                     non_entity_clients: 0,
-                    non_entity_tokens: 0,
                     secret_syncs: 3,
                   },
                   mounts: [
                     {
                       counts: {
                         clients: 3,
-                        distinct_entities: 0,
                         entity_clients: 0,
                         non_entity_clients: 0,
-                        non_entity_tokens: 0,
                         secret_syncs: 3,
                       },
                       mount_path: 'sys/',
@@ -451,30 +452,24 @@ export default function (server) {
           {
             counts: {
               clients: 7,
-              distinct_entities: 0,
               entity_clients: 0,
               non_entity_clients: 0,
-              non_entity_tokens: 0,
               secret_syncs: 7,
             },
             namespaces: [
               {
                 counts: {
                   clients: 7,
-                  distinct_entities: 0,
                   entity_clients: 0,
                   non_entity_clients: 0,
-                  non_entity_tokens: 0,
                   secret_syncs: 7,
                 },
                 mounts: [
                   {
                     counts: {
                       clients: 7,
-                      distinct_entities: 0,
                       entity_clients: 0,
                       non_entity_clients: 0,
-                      non_entity_tokens: 0,
                       secret_syncs: 7,
                     },
                     mount_path: 'sys/',
@@ -487,30 +482,24 @@ export default function (server) {
             new_clients: {
               counts: {
                 clients: 2,
-                distinct_entities: 0,
                 entity_clients: 0,
                 non_entity_clients: 0,
-                non_entity_tokens: 0,
                 secret_syncs: 2,
               },
               namespaces: [
                 {
                   counts: {
                     clients: 2,
-                    distinct_entities: 0,
                     entity_clients: 0,
                     non_entity_clients: 0,
-                    non_entity_tokens: 0,
                     secret_syncs: 2,
                   },
                   mounts: [
                     {
                       counts: {
                         clients: 2,
-                        distinct_entities: 0,
                         entity_clients: 0,
                         non_entity_clients: 0,
-                        non_entity_tokens: 0,
                         secret_syncs: 2,
                       },
                       mount_path: 'sys/',
diff --git a/ui/mirage/helpers/modify-passthrough-response.js b/ui/mirage/helpers/modify-passthrough-response.js
index c86a23eb07e..87cdf9027b8 100644
--- a/ui/mirage/helpers/modify-passthrough-response.js
+++ b/ui/mirage/helpers/modify-passthrough-response.js
@@ -1,10 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 // passthrough request and modify response from server
 // pass object as second arg of properties in response to override
+// ex: server.get('sys/health', (schema, req) => modifyPassthroughResponse(req, { enterprise: true }));
 export default function (req, props = {}) {
   return new Promise((resolve) => {
     const xhr = req.passthrough();
diff --git a/ui/mirage/identity-managers/application.js b/ui/mirage/identity-managers/application.js
index ad03509396e..7d55a76b766 100644
--- a/ui/mirage/identity-managers/application.js
+++ b/ui/mirage/identity-managers/application.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/models/feature.js b/ui/mirage/models/feature.js
index 77cae4e5e0a..fe11d779ead 100644
--- a/ui/mirage/models/feature.js
+++ b/ui/mirage/models/feature.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Model } from 'ember-cli-mirage';
+import { Model } from 'miragejs';
 
 export default Model.extend({
   feature_flags: null,
diff --git a/ui/mirage/models/ldap-account-status.js b/ui/mirage/models/ldap-account-status.js
new file mode 100644
index 00000000000..de10143fd35
--- /dev/null
+++ b/ui/mirage/models/ldap-account-status.js
@@ -0,0 +1,13 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { Model } from 'miragejs';
+
+export default Model.extend({
+  account: '', // should match ID
+  library: '',
+  available: false,
+  borrower_client_token: undefined,
+});
diff --git a/ui/mirage/scenarios/custom-login.js b/ui/mirage/scenarios/custom-login.js
new file mode 100644
index 00000000000..d91ba72efdc
--- /dev/null
+++ b/ui/mirage/scenarios/custom-login.js
@@ -0,0 +1,30 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export default function (server) {
+  server.create('login-rule', {
+    name: 'root-rule',
+    namespace_path: 'root',
+    default_auth_type: 'token',
+    backup_auth_types: ['userpass', 'ldap'],
+    disable_inheritance: false,
+  });
+  server.create('login-rule', {
+    namespace_path: 'admin/',
+    default_auth_type: 'oidc',
+    backup_auth_types: ['token'],
+  });
+  server.create('login-rule', {
+    name: 'ns-rule',
+    namespace_path: 'test-ns/',
+    default_auth_type: 'ldap',
+    backup_auth_types: [],
+    disable_inheritance: true,
+  });
+  // generated with defaults set by ui/mirage/factories/login-rule.js
+  server.create('login-rule', { default_auth_type: 'jwt', backup_auth_types: [] }); // namespace-2
+  server.create('login-rule', { default_auth_type: '', backup_auth_types: ['oidc', 'jwt'] }); // namespace-3
+  server.create('login-rule', { default_auth_type: '', backup_auth_types: ['token'] }); // namespace-4
+}
diff --git a/ui/mirage/scenarios/default.js b/ui/mirage/scenarios/default.js
index 56a74a54056..d1a3a150198 100644
--- a/ui/mirage/scenarios/default.js
+++ b/ui/mirage/scenarios/default.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/scenarios/index.js b/ui/mirage/scenarios/index.js
index d2e4587c2bf..707cfc19f91 100644
--- a/ui/mirage/scenarios/index.js
+++ b/ui/mirage/scenarios/index.js
@@ -1,10 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import kubernetes from './kubernetes';
 import ldap from './ldap';
 import sync from './sync';
+import customLogin from './custom-login';
+import recovery from './recovery';
 
-export { kubernetes, ldap, sync };
+export { kubernetes, ldap, sync, customLogin, recovery };
diff --git a/ui/mirage/scenarios/kubernetes.js b/ui/mirage/scenarios/kubernetes.js
index 6fa19471586..747fcba8c7e 100644
--- a/ui/mirage/scenarios/kubernetes.js
+++ b/ui/mirage/scenarios/kubernetes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/scenarios/ldap.js b/ui/mirage/scenarios/ldap.js
index 19b6b61f4c5..5d858b48bce 100644
--- a/ui/mirage/scenarios/ldap.js
+++ b/ui/mirage/scenarios/ldap.js
@@ -1,11 +1,30 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 export default function (server) {
-  server.create('ldap-config', { path: 'kubernetes' });
+  server.create('ldap-config', { path: 'kubernetes', backend: 'ldap-test' });
   server.create('ldap-role', 'static', { name: 'static-role' });
   server.create('ldap-role', 'dynamic', { name: 'dynamic-role' });
+  // hierarchical roles
+  server.create('ldap-role', 'static', { name: 'admin/child-static-role' });
+  server.create('ldap-role', 'dynamic', { name: 'admin/child-dynamic-role' });
+  // use same name for both role types to test edge cases
+  server.create('ldap-role', 'static', { name: 'my-role' });
+  server.create('ldap-role', 'dynamic', { name: 'my-role' });
   server.create('ldap-library', { name: 'test-library' });
+  // mirage handler is hardcoded to accommodate hierarchical paths starting with 'admin/'
+  server.create('ldap-library', { name: 'admin/test-library' });
+  server.create('ldap-account-status', {
+    id: 'bob.johnson',
+    account: 'bob.johnson',
+    available: false,
+    borrower_client_token: '8b80c305eb3a7dbd161ef98f10ea60a116ce0910',
+  });
+  server.create('ldap-account-status', {
+    id: 'mary.smith',
+    account: 'mary.smith',
+    available: true,
+  });
 }
diff --git a/ui/mirage/scenarios/recovery.js b/ui/mirage/scenarios/recovery.js
new file mode 100644
index 00000000000..1d655b66b13
--- /dev/null
+++ b/ui/mirage/scenarios/recovery.js
@@ -0,0 +1,11 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export default function (server) {
+  server.create('snapshot');
+  // Other snapshot states, only one snapshot should be "loaded" at a time
+  // server.create('snapshot', { status: 'loading' });
+  // server.create('snapshot', { status: 'error' });
+}
diff --git a/ui/mirage/scenarios/sync.js b/ui/mirage/scenarios/sync.js
index 5bd4b1e4b2b..e9523d7a1ff 100644
--- a/ui/mirage/scenarios/sync.js
+++ b/ui/mirage/scenarios/sync.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/mirage/serializers/application.js b/ui/mirage/serializers/application.js
index a7dc21ae974..0f34b186f49 100644
--- a/ui/mirage/serializers/application.js
+++ b/ui/mirage/serializers/application.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { JSONAPISerializer } from 'ember-cli-mirage';
+import { JSONAPISerializer } from 'miragejs';
 
 export default JSONAPISerializer.extend({
   typeKeyForModel(model) {
diff --git a/ui/package.json b/ui/package.json
index c3a68ebcabd..426e1b39e4a 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -9,8 +9,12 @@
     "test": "tests"
   },
   "scripts": {
-    "build": "ember build --environment=production && cp metadata.json ../http/web_ui/metadata.json",
-    "build:dev": "ember build",
+    "postinstall": "yarn build:jsondiffpatch",
+    "build": "yarn build:jsondiffpatch && ember build --environment=production && cp metadata.json ../http/web_ui/metadata.json",
+    "build:dev": "yarn build:jsondiffpatch && ember build",
+    "build:jsondiffpatch": "webpack --config webpack.jsondiffpatch.config.js",
+    "docs": "sh scripts/generate-docs.sh",
+    "docfy-md": "node scripts/docfy-md.js",
     "lint:css": "stylelint \"**/*.css\"",
     "lint:css:fix": "yarn lint:css --fix",
     "lint:fix": "concurrently -c \"auto\" -n lint: \"yarn:lint:*:fix\"",
@@ -20,217 +24,175 @@
     "lint:js": "eslint . --cache",
     "lint:js:quiet": "eslint . --cache --quiet",
     "lint:js:fix": "eslint . --fix",
+    "lint:types": "tsc --noEmit",
     "fmt": "concurrently -c \"auto\" -n fmt: \"yarn:fmt:*\"",
     "fmt:js": "prettier --config .prettierrc.js --write '{app,tests,config,lib}/**/*.js'",
     "fmt:hbs": "prettier --config .prettierrc.js --write '**/*.hbs'",
     "fmt:styles": "prettier --write app/styles/**/*.*",
-    "start": "VAULT_ADDR=http://localhost:8200; ember server --proxy=$VAULT_ADDR",
-    "start2": "ember server --proxy=http://localhost:8202 --port=4202",
-    "start:chroot": "ember server --proxy=http://localhost:8300 --port=4300",
-    "start:mirage": "start () { MIRAGE_DEV_HANDLER=$1 yarn run start; }; start",
-    "test": "concurrently --kill-others-on-fail -P -c \"auto\" -n lint:js,lint:hbs,vault \"yarn:lint:js:quiet\" \"yarn:lint:hbs:quiet\" \"node scripts/start-vault.js {@}\" --",
-    "test:enos": "concurrently --kill-others-on-fail -P -c \"auto\" -n lint:js,lint:hbs,enos \"yarn:lint:js:quiet\" \"yarn:lint:hbs:quiet\" \"node scripts/enos-test-ember.js {@}\" --",
-    "test:oss": "yarn run test -f='!enterprise' --split=8 --preserve-test-name --parallel",
-    "test:quick": "node scripts/start-vault.js --split=8 --preserve-test-name --parallel",
-    "test:quick-oss": "yarn test:quick -f='!enterprise' --split=8 --preserve-test-name --parallel",
+    "start": "VAULT_ADDR=http://127.0.0.1:8200; yarn build:jsondiffpatch && ember server --proxy=$VAULT_ADDR",
+    "start2": "yarn build:jsondiffpatch && ember server --proxy=http://127.0.0.1:8202 --port=4202",
+    "start:chroot": "ember server --proxy=http://127.0.0.1:8300 --port=4300",
+    "lint": "concurrently --kill-others-on-fail -P -c \"auto\" -n lint:js,lint:hbs,lint:types \"yarn:lint:js:quiet\" \"yarn:lint:hbs:quiet\" \"yarn:lint:types\"",
+    "test": "yarn lint && node scripts/start-vault.js",
+    "test:enos": "concurrently --kill-others-on-fail -P -c \"auto\" -n lint:js,lint:hbs,lint:types,enos \"yarn:lint:js:quiet\" \"yarn:lint:hbs:quiet\" \"yarn:lint:types\" \"node scripts/enos-test-ember.js {@}\" --",
+    "test:oss": "yarn test -f='!enterprise'",
+    "test:ent": "node scripts/start-vault.js -f='enterprise'",
+    "test:quick": "node scripts/start-vault.js --split=8 --preserve-test-name --parallel=1",
     "test:filter": "node scripts/start-vault.js --server -f='!enterprise'",
-    "types:declare": "declare () { yarn tsc $1 --declaration --allowJs --emitDeclarationOnly --experimentalDecorators --outDir $2; }; declare",
+    "test:server": "node scripts/start-vault.js --server",
+    "test:dev": "node scripts/start-vault.js",
     "vault": "VAULT_REDIRECT_ADDR=http://127.0.0.1:8200 vault server -log-level=error -dev -dev-root-token-id=root -dev-ha -dev-transactional",
     "vault:cluster": "VAULT_REDIRECT_ADDR=http://127.0.0.1:8202 vault server -log-level=error -dev -dev-root-token-id=root -dev-listen-address=127.0.0.1:8202 -dev-ha -dev-transactional"
   },
-  "lint-staged": {
-    "*.js": [
-      "prettier --config .prettierrc.js --write",
-      "eslint --quiet",
-      "git add"
-    ],
-    "*.hbs": [
-      "prettier --config .prettierrc.js --write",
-      "ember-template-lint --quiet",
-      "git add"
-    ],
-    "*.scss": [
-      "prettier --write",
-      "git add"
-    ]
-  },
   "devDependencies": {
-    "@babel/eslint-parser": "^7.21.3",
-    "@babel/plugin-proposal-decorators": "^7.21.0",
-    "@babel/plugin-proposal-object-rest-spread": "^7.12.1",
-    "@babel/plugin-transform-block-scoping": "^7.12.1",
-    "@ember-data/legacy-compat": "~4.12.4",
-    "@ember/legacy-built-in-components": "^0.4.1",
-    "@ember/optional-features": "^2.0.0",
-    "@ember/render-modifiers": "^1.0.2",
-    "@ember/string": "^3.0.1",
-    "@ember/test-helpers": "^2.9.3",
-    "@ember/test-waiters": "^3.1.0",
-    "@glimmer/component": "^1.1.2",
-    "@glimmer/tracking": "^1.1.2",
-    "@icholy/duration": "^5.1.0",
-    "@lineal-viz/lineal": "^0.5.1",
-    "@tsconfig/ember": "^2.0.0",
-    "@types/ember": "^4.0.2",
-    "@types/ember-data": "^4.4.6",
-    "@types/ember-data__adapter": "^4.0.1",
-    "@types/ember-data__model": "^4.0.0",
-    "@types/ember-data__serializer": "^4.0.1",
-    "@types/ember-data__store": "^4.0.2",
-    "@types/ember-qunit": "^5.0.2",
-    "@types/ember-resolver": "^5.0.13",
-    "@types/ember__application": "^4.0.4",
-    "@types/ember__array": "^4.0.3",
-    "@types/ember__component": "^4.0.11",
-    "@types/ember__controller": "^4.0.3",
-    "@types/ember__debug": "^4.0.3",
-    "@types/ember__destroyable": "^4.0.1",
-    "@types/ember__engine": "^4.0.4",
-    "@types/ember__error": "^4.0.1",
-    "@types/ember__object": "^4.0.5",
-    "@types/ember__polyfills": "^4.0.1",
-    "@types/ember__routing": "^4.0.12",
-    "@types/ember__runloop": "^4.0.2",
-    "@types/ember__service": "^4.0.1",
-    "@types/ember__string": "^3.0.10",
-    "@types/ember__template": "^4.0.1",
-    "@types/ember__test": "^4.0.1",
-    "@types/ember__test-helpers": "^2.8.2",
-    "@types/ember__utils": "^4.0.2",
-    "@types/qunit": "^2.19.4",
-    "@types/rsvp": "^4.0.4",
-    "@types/shell-quote": "^1.7.1",
-    "@typescript-eslint/eslint-plugin": "^5.19.0",
-    "@typescript-eslint/parser": "^5.19.0",
-    "asn1js": "^2.2.0",
-    "autosize": "^4.0.0",
-    "babel-plugin-inline-json-import": "^0.3.2",
-    "base64-js": "^1.3.1",
-    "broccoli-asset-rev": "^3.0.0",
+    "@babel/cli": "~7.27.0",
+    "@babel/core": "~7.26.10",
+    "@babel/eslint-parser": "~7.27.0",
+    "@babel/plugin-proposal-class-properties": "~7.18.6",
+    "@babel/plugin-proposal-decorators": "~7.25.9",
+    "@babel/plugin-proposal-object-rest-spread": "~7.20.7",
+    "@babel/plugin-transform-block-scoping": "~7.27.0",
+    "@babel/preset-env": "~7.26.9",
+    "@babel/preset-typescript": "~7.27.0",
+    "@docfy/ember": "~0.8.5",
+    "@ember/legacy-built-in-components": "~0.4.2",
+    "@ember/optional-features": "~2.2.0",
+    "@ember/render-modifiers": "~3.0.0",
+    "@ember/string": "~4.0.1",
+    "@ember/test-helpers": "~5.2.1",
+    "@ember/test-waiters": "~4.1.0",
+    "@glimmer/component": "~1.1.2",
+    "@glimmer/tracking": "~1.1.2",
+    "@icholy/duration": "~5.1.0",
+    "@lineal-viz/lineal": "~0.5.1",
+    "@tsconfig/ember": "~2.0.0",
+    "@types/d3-array": "~3.2.1",
+    "@types/ember-data": "~4.4.16",
+    "@types/qunit": "~2.19.12",
+    "@types/rsvp": "~4.0.9",
+    "@types/shell-quote": "~1.7.5",
+    "@typescript-eslint/eslint-plugin": "~5.62.0",
+    "@typescript-eslint/parser": "~5.62.0",
+    "asn1js": "~3.0.6",
+    "autosize": "~6.0.1",
+    "babel-plugin-inline-json-import": "~0.3.2",
+    "base64-js": "~1.5.1",
+    "broccoli-asset-rev": "~3.0.0",
     "broccoli-sri-hash": "meirish/broccoli-sri-hash#rooturl",
-    "codemirror": "^5.58.2",
-    "columnify": "^1.5.4",
-    "concurrently": "^8.2.2",
-    "d3-axis": "^1.0.8",
-    "d3-ease": "^1.0.5",
-    "d3-scale": "^1.0.7",
-    "d3-selection": "^1.3.0",
-    "d3-time-format": "^2.1.1",
-    "d3-tip": "^0.9.1",
-    "d3-transition": "^1.2.0",
-    "date-fns": "^2.30.0",
-    "date-fns-tz": "^1.2.2",
-    "deepmerge": "^4.0.0",
-    "doctoc": "^2.2.0",
-    "dompurify": "^3.0.2",
-    "ember-a11y-testing": "^5.2.1",
-    "ember-auto-import": "2.6.3",
-    "ember-basic-dropdown": "6.0.1",
-    "ember-cli": "~4.12.1",
-    "ember-cli-autoprefixer": "^0.8.1",
-    "ember-cli-babel": "^7.26.11",
+    "columnify": "~1.6.0",
+    "concurrently": "~9.1.2",
+    "d3-array": "~3.2.4",
+    "d3-axis": "~3.0.0",
+    "d3-format": "~3.1.0",
+    "d3-scale": "~4.0.2",
+    "d3-selection": "~3.0.0",
+    "d3-shape": "~3.2.0",
+    "date-fns": "~2.30.0",
+    "date-fns-tz": "~1.3.8",
+    "doctoc": "~2.2.1",
+    "dompurify": "~3.2.5",
+    "ember-a11y-testing": "~7.1.2",
+    "ember-basic-dropdown": "~8.6.0",
+    "ember-cli": "~5.8.0",
+    "ember-cli-babel": "~8.2.0",
+    "ember-cli-clean-css": "~3.0.0",
     "ember-cli-content-security-policy": "2.0.3",
-    "ember-cli-dependency-checker": "^3.3.1",
-    "ember-cli-deprecation-workflow": "^2.1.0",
+    "ember-cli-dependency-checker": "~3.3.3",
+    "ember-cli-deprecation-workflow": "~3.3.0",
     "ember-cli-flash": "4.0.0",
-    "ember-cli-htmlbars": "^6.2.0",
-    "ember-cli-inject-live-reload": "^2.1.0",
-    "ember-cli-mirage": "2.4.0",
-    "ember-cli-page-object": "1.17.10",
+    "ember-cli-htmlbars": "~6.3.0",
+    "ember-cli-inject-live-reload": "~2.1.0",
+    "ember-cli-mirage": "~3.0.4",
+    "ember-cli-page-object": "~2.3.1",
     "ember-cli-sass": "11.0.1",
     "ember-cli-sri": "meirish/ember-cli-sri#rooturl",
     "ember-cli-string-helpers": "6.1.0",
-    "ember-cli-terser": "^4.0.2",
-    "ember-cli-typescript": "^5.2.1",
+    "ember-cli-terser": "~4.0.2",
     "ember-composable-helpers": "5.0.0",
-    "ember-concurrency": "2.3.4",
-    "ember-copy": "2.0.1",
-    "ember-d3": "^0.5.1",
-    "ember-data": "~4.12.4",
+    "ember-concurrency": "~4.0.3",
+    "ember-data": "~5.3.13",
     "ember-engines": "0.8.23",
-    "ember-exam": "^9.0.0",
-    "ember-fetch": "^8.1.2",
+    "ember-exam": "~9.1.0",
     "ember-inflector": "4.0.2",
-    "ember-load-initializers": "^2.1.2",
-    "ember-maybe-in-element": "^2.0.3",
-    "ember-modal-dialog": "^4.0.1",
-    "ember-modifier": "^4.1.0",
-    "ember-page-title": "^7.0.0",
-    "ember-power-select": "6.0.1",
-    "ember-qrcode-shim": "^0.4.0",
-    "ember-qunit": "^6.2.0",
-    "ember-resolver": "^10.0.0",
+    "ember-load-initializers": "~3.0.1",
+    "ember-modal-dialog": "~4.1.5",
+    "ember-modifier": "~4.2.0",
+    "ember-power-select": "~8.7.0",
+    "ember-qrcode-shim": "~0.4.0",
+    "ember-qunit": "~8.1.1",
+    "ember-resolver": "~13.1.0",
     "ember-responsive": "5.0.0",
-    "ember-router-helpers": "^0.4.0",
     "ember-service-worker": "meirish/ember-service-worker#configurable-scope",
-    "ember-sinon": "^4.0.0",
-    "ember-source": "~4.12.0",
-    "ember-style-modifier": "^4.1.0",
-    "ember-svg-jar": "2.4.0",
-    "ember-template-lint": "5.7.2",
-    "ember-template-lint-plugin-prettier": "4.0.0",
-    "ember-test-selectors": "6.0.0",
-    "ember-tether": "^2.0.1",
-    "ember-truth-helpers": "3.0.0",
-    "escape-string-regexp": "^2.0.0",
-    "eslint": "^8.37.0",
-    "eslint-config-prettier": "^8.8.0",
-    "eslint-plugin-compat": "4.0.2",
-    "eslint-plugin-ember": "^11.5.0",
-    "eslint-plugin-n": "^15.7.0",
-    "eslint-plugin-prettier": "^4.2.1",
-    "eslint-plugin-qunit": "^7.3.4",
-    "filesize": "^4.2.1",
-    "flat": "^6.0.1",
-    "jsondiffpatch": "^0.4.1",
-    "jsonlint": "^1.6.3",
-    "lint-staged": "^10.5.1",
-    "loader.js": "^4.7.0",
-    "normalize.css": "4.1.1",
-    "pkijs": "^2.2.2",
-    "pretender": "^3.4.3",
-    "prettier": "2.8.7",
-    "prettier-eslint-cli": "^7.1.0",
-    "pvutils": "^1.0.17",
-    "qunit": "^2.19.4",
-    "qunit-dom": "^2.0.0",
-    "sass": "^1.58.3",
-    "sass-svg-uri": "^1.0.0",
-    "shell-quote": "^1.8.1",
-    "string.prototype.endswith": "^0.2.0",
-    "string.prototype.startswith": "^0.2.0",
-    "stylelint": "^15.4.0",
-    "stylelint-config-standard": "^32.0.0",
-    "stylelint-prettier": "^3.0.0",
-    "swagger-ui-dist": "^5.9.0",
+    "ember-sinon-qunit": "~7.5.0",
+    "ember-source": "~5.8.0",
+    "ember-style-modifier": "~4.4.0",
+    "ember-template-lint": "~6.1.0",
+    "ember-template-lint-plugin-prettier": "~5.0.0",
+    "ember-test-selectors": "7.1.0",
+    "ember-tether": "3.0.0",
+    "ember-truth-helpers": "4.0.3",
+    "escape-string-regexp": "~2.0.0",
+    "eslint": "~8.57.1",
+    "eslint-config-prettier": "~9.1.0",
+    "eslint-plugin-compat": "~4.2.0",
+    "eslint-plugin-ember": "~11.12.0",
+    "eslint-plugin-n": "~16.6.2",
+    "eslint-plugin-prettier": "~5.2.6",
+    "eslint-plugin-qunit": "~8.1.2",
+    "filesize": "~4.2.1",
+    "jsdoc-babel": "~0.5.0",
+    "jsdoc-to-markdown": "~8.0.3",
+    "jsondiffpatch": "0.7.3",
+    "jsonlint": "~1.6.3",
+    "lint-staged": "~16.0.0",
+    "loader.js": "~4.7.0",
+    "miragejs": "~0.1.48",
+    "pkijs": "~2.4.0",
+    "prettier": "3.0.3",
+    "prettier-eslint-cli": "~7.1.0",
+    "pvutils": "~1.1.3",
+    "qunit": "~2.24.1",
+    "qunit-dom": "~3.4.0",
+    "sass": "~1.88.0",
+    "shell-quote": "~1.8.2",
+    "sinon": "~20.0.0",
+    "stylelint": "~16.19.1",
+    "stylelint-config-standard": "~38.0.0",
+    "stylelint-prettier": "~5.0.3",
+    "swagger-ui-dist": "~5.21.0",
     "text-encoder-lite": "2.0.0",
-    "tracked-built-ins": "^3.1.1",
-    "typescript": "^4.9.5",
-    "walk-sync": "^2.0.2",
-    "webpack": "5.78.0",
-    "xstate": "^3.3.3"
+    "tracked-built-ins": "~3.4.0",
+    "typescript": "~5.8.3",
+    "webpack": "5.94.0",
+    "webpack-cli": "^6.0.1"
   },
   "resolutions": {
-    "cryptiles": "^4.1.2",
-    "eslint-utils": "^1.4.1",
-    "ember-basic-dropdown": "6.0.1",
-    "growl": "^1.10.0",
-    "highlight.js": "^10.4.1",
-    "https-proxy-agent": "^2.2.3",
-    "ini": "^1.3.6",
-    "kind-of": "^6.0.3",
-    "minimatch": "^3.0.2",
-    "node-notifier": "^8.0.1",
-    "prismjs": "^1.21.0",
-    "qs": "^6.3.0",
-    "serialize-javascript": "^3.1.0",
-    "underscore": "^1.12.1",
-    "trim": "^0.0.3",
-    "xmlhttprequest-ssl": "^1.6.2",
-    "@embroider/macros": "^1.0.0"
+    "ansi-html": "0.0.8",
+    "async": "2.6.4",
+    "body-parser": "1.20.3",
+    "braces": "3.0.3",
+    "eslint-utils": "1.4.3",
+    "highlight.js": "10.7.3",
+    "https-proxy-agent": "2.2.4",
+    "ini": "1.3.8",
+    "kind-of": "6.0.3",
+    "micromatch": "4.0.8",
+    "nth-check": "2.0.1",
+    "prismjs": "1.30.0",
+    "rollup": "2.79.2",
+    "serialize-javascript": "3.1.0",
+    "underscore": "1.13.7",
+    "xmlhttprequest-ssl": "1.6.3",
+    "@embroider/macros": "1.15.0",
+    "@babel/runtime": "7.27.0",
+    "socket.io": "4.8.1",
+    "json5": "1.0.2",
+    "ember-cli-typescript": "5.3.0",
+    "lodash.template@^4.4.0": "patch:lodash.template@npm%3A4.5.0#./.yarn/patches/lodash.template-npm-4.5.0-5272df3039.patch",
+    "lodash.template@^4.5.0": "patch:lodash.template@npm%3A4.5.0#./.yarn/patches/lodash.template-npm-4.5.0-5272df3039.patch"
   },
   "engines": {
-    "node": "18"
+    "node": "20"
   },
   "ember": {
     "edition": "octane"
@@ -240,7 +202,6 @@
     "paths": [
       "lib/config-ui",
       "lib/core",
-      "lib/css",
       "lib/keep-gitkeep",
       "lib/kmip",
       "lib/kubernetes",
@@ -254,12 +215,20 @@
     ]
   },
   "dependencies": {
-    "@hashicorp/design-system-components": "^3.4.0",
-    "@hashicorp/ember-flight-icons": "^4.0.5",
-    "handlebars": "4.7.7",
-    "highlight.js": "^10.4.1",
-    "node-notifier": "^8.0.1",
-    "uuid": "^9.0.0"
+    "@babel/core": "7.26.10",
+    "@hashicorp-internal/vault-reporting": "file:vault-reporting/0.8.0.tgz",
+    "@hashicorp/design-system-components": "4.20.1",
+    "@hashicorp/vault-client-typescript": "hashicorp/vault-client-typescript",
+    "ember-auto-import": "2.10.0",
+    "handlebars": "4.7.8",
+    "highlight.js": "10.7.3",
+    "posthog-js": "^1.202.2",
+    "uuid": "9.0.1"
   },
-  "packageManager": "yarn@3.5.0"
+  "packageManager": "yarn@3.5.0",
+  "scarfSettings": {
+    "defaultOptIn": false,
+    "enabled": false,
+    "skipTraversal": true
+  }
 }
diff --git a/ui/public/android-sync.svg b/ui/public/android-sync.svg
deleted file mode 100644
index 251025e48dd..00000000000
--- a/ui/public/android-sync.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg height="24px" width="24px" viewBox="0 0 500 500" xmlns="http://www.w3.org/2000/svg">
-<path d="M256 93.09V32l-80 81.454 80 81.456v-61.093c65.996 0 120 54.982 120 122.183 0 20.363-5 39.714-14.004 57.016L391 342.547c15.996-25.457 25-54.988 25-86.547 0-89.599-72.002-162.91-160-162.91zm0 285.094c-66.001 0-120-54.988-120-122.184 0-20.363 5-39.709 13.999-57.02L121 169.454C104.999 193.89 96 224.436 96 256c0 89.599 72.002 162.91 160 162.91V480l80-81.453-80-81.457v61.094z"/>
-</svg>
diff --git a/ui/public/console.svg b/ui/public/console.svg
deleted file mode 100644
index 9c43c0cffe7..00000000000
--- a/ui/public/console.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-  <path d="M3 3h18c1.1 0 2 .9 2 2v14c0 1.1-.9 2-2 2H3c-1.1 0-2-.9-2-2V5c0-1.1.9-2 2-2zm18 16V5H3v14h18zm-10-5h6v1h-6v-1zM6.47 9.522l.761-.76L10.47 12l-3.239 3.239-.761-.761L8.942 12 6.47 9.522z" fill="currentColor"/>
-</svg>
diff --git a/ui/public/duo.svg b/ui/public/duo.svg
deleted file mode 100644
index 72a97e5d139..00000000000
--- a/ui/public/duo.svg
+++ /dev/null
@@ -1,5 +0,0 @@
-<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M23.988 11.994C23.988 18.618 18.618 23.988 11.994 23.988C5.37 23.988 0 18.618 0 11.994C0 5.37 5.37 0 11.994 0C18.618 0 23.988 5.37 23.988 11.994Z" fill="#59B734"/>
-<path d="M20.4045 11.9505C20.3153 13.3849 19.1259 14.5026 17.6888 14.5026C16.2516 14.5026 15.0622 13.3849 14.973 11.9505H20.4045ZM9.01951 11.9505C8.93647 13.3893 7.7457 14.5136 6.30451 14.514H3.58276V11.9505H9.01876H9.01951ZM14.7173 9.07275V11.793C14.7173 11.8462 14.715 11.898 14.712 11.9505V14.5095H12.153V9.072H14.7173V9.07275Z" fill="#E6F3D8"/>
-<path d="M11.8395 9.07275V14.5095C10.4 14.4264 9.27525 13.2349 9.27525 11.793V9.07275H11.8402H11.8395ZM17.6887 9.07275C19.1301 9.07311 20.3211 10.1973 20.4045 11.6362H14.973C15.0564 10.1976 16.247 9.07351 17.688 9.07275H17.6887ZM6.30375 9.07275C7.74507 9.07311 8.93607 10.1973 9.0195 11.6362H3.5835V9.07275H6.30375Z" fill="white"/>
-</svg>
diff --git a/ui/public/file-error.svg b/ui/public/file-error.svg
deleted file mode 100644
index 97f8e13104f..00000000000
--- a/ui/public/file-error.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-  <path d="M20,14 L20,20.5714286 C20,21.3571429 19.2857143,22 18.5,22 L4.5,22 C3.71428571,22 3,21.2857143 3,20.5 L3,3.5 C3,2.71428571 3.71428571,2 4.5,2 L10,2 L10,3.5 L4.5,3.5 L4.5,20.5 L18.5,20.5 L18.5,14 L20,14 Z M7,18.5 L16,18.5 L16,17 L7,17 L7,18.5 Z M7,15.5 L16,15.5 L16,14 L7,14 L7,15.5 Z M7,12.5 L11,12.5 L11,11 L7,11 L7,12.5 Z M7,9.5 L10,9.5 L10,8 L7,8 L7,9.5 Z M20,1 C21.6568542,1 23,2.34314575 23,4 L23,9 C23,10.6568542 21.6568542,12 20,12 L15,12 C13.3431458,12 12,10.6568542 12,9 L12,4 C12,2.34314575 13.3431458,1 15,1 L20,1 Z M19.9425,3 L17.5,5.4425 L15.0575,3 L14,4.0575 L16.4425,6.5 L14,8.9425 L15.0575,10 L17.5,7.5575 L19.9425,10 L21,8.9425 L18.5575,6.5 L21,4.0575 L19.9425,3 Z" fill="currentColor" />
-</svg>
diff --git a/ui/public/file-success.svg b/ui/public/file-success.svg
deleted file mode 100644
index 779273d51ef..00000000000
--- a/ui/public/file-success.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-  <path d="M20,14 L20,20.5714286 C20,21.3571429 19.2857143,22 18.5,22 L4.5,22 C3.71428571,22 3,21.2857143 3,20.5 L3,3.5 C3,2.71428571 3.71428571,2 4.5,2 L11,2 L10,3.5 L4.5,3.5 L4.5,20.5 L18.5,20.5 L18.5,14 L20,14 Z M7,18.5 L16,18.5 L16,17 L7,17 L7,18.5 Z M7,15.5 L16,15.5 L16,14 L7,14 L7,15.5 Z M7,12.5 L12,12.5 L12,11 L7,11 L7,12.5 Z M7,9.5 L10,9.5 L10,8 L7,8 L7,9.5 Z M17.5,12 C20.5375661,12 23,9.53756612 23,6.5 C23,3.46243388 20.5375661,1 17.5,1 C14.4624339,1 12,3.46243388 12,6.5 C12,9.53756612 14.4624339,12 17.5,12 Z M14,6.66152019 L15.0254545,5.6567696 L16.9090909,7.49524941 L20.4745455,4 L21.5,5.01187648 L16.9090909,9.51187648 L14,6.66152019 Z" fill="currentColor" />
-</svg>
diff --git a/ui/public/hashicorp.svg b/ui/public/hashicorp.svg
deleted file mode 100644
index 15532618143..00000000000
--- a/ui/public/hashicorp.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
-<path d="M283.2 378.4l77.3-42.5V44.7L283.2 0v216.4H185v-84.5l-77.4 42.4v291.2l77.4 44.8V293.9h98.2z"/><path d="M396.5 65.5v294.1l-113.3 62.2v88.4l185-106.8V106.8zM185 0L0 106.8v296.6l71.7 41.4V150.7L185 88.5z"/>
-</svg>
diff --git a/ui/public/initialize.svg b/ui/public/initialize.svg
deleted file mode 100644
index d8cc987b60e..00000000000
--- a/ui/public/initialize.svg
+++ /dev/null
@@ -1,963 +0,0 @@
-<svg width="200" height="200" viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg">
-  <defs>
-    <linearGradient x1="50%" y1="96.412%" x2="50%" y2="0%" id="a">
-      <stop stop-color="#949FAD" offset="0%"/>
-      <stop stop-color="#BBC4D1" offset="100%"/>
-    </linearGradient>
-  </defs>
-  <g fill="none" fill-rule="evenodd">
-    <g opacity=".5" fill-rule="nonzero" fill="#BBC4D0">
-      <g opacity=".1">
-        <circle cx="100" cy="3.125" r="3.125"/>
-        <circle cx="100" cy="196.875" r="3.125"/>
-        <circle cx="16.111" cy="51.563" r="3.125"/>
-        <circle cx="183.889" cy="148.438" r="3.125"/>
-        <circle cx="16.111" cy="148.438" r="3.125"/>
-        <circle cx="183.889" cy="51.563" r="3.125"/>
-        <circle cx="51.563" cy="16.111" r="3.125"/>
-        <circle cx="148.438" cy="183.889" r="3.125"/>
-        <circle cx="3.125" cy="100" r="3.125"/>
-        <circle cx="196.875" cy="100" r="3.125"/>
-        <circle cx="51.563" cy="183.889" r="3.125"/>
-        <circle cx="148.438" cy="16.111" r="3.125"/>
-        <g transform="translate(3.3 3.3)">
-          <circle cx="71.632" cy="3.125" r="3.125"/>
-          <circle cx="121.771" cy="190.278" r="3.125"/>
-          <circle cx="3.125" cy="71.632" r="3.125"/>
-          <circle cx="190.278" cy="121.771" r="3.125"/>
-          <circle cx="28.194" cy="165.208" r="3.125"/>
-          <circle cx="165.208" cy="28.194" r="3.125"/>
-          <circle cx="28.194" cy="28.194" r="3.125"/>
-          <circle cx="165.208" cy="165.208" r="3.125"/>
-          <circle cx="3.125" cy="121.771" r="3.125"/>
-          <circle cx="190.278" cy="71.632" r="3.125"/>
-          <circle cx="71.632" cy="190.278" r="3.125"/>
-          <circle cx="121.771" cy="3.125" r="3.125"/>
-        </g>
-        <g>
-          <g transform="translate(.694 .694)">
-            <circle cx="86.667" cy="3.264" r="3.125"/>
-            <circle cx="111.944" cy="195.347" r="3.125"/>
-            <circle cx="9.809" cy="62.24" r="3.125"/>
-            <circle cx="188.802" cy="136.372" r="3.125"/>
-            <circle cx="22.448" cy="158.281" r="3.125"/>
-            <circle cx="176.163" cy="40.33" r="3.125"/>
-            <circle cx="40.33" cy="22.448" r="3.125"/>
-            <circle cx="158.281" cy="176.163" r="3.125"/>
-            <circle cx="3.264" cy="111.944" r="3.125"/>
-            <circle cx="195.347" cy="86.667" r="3.125"/>
-            <circle cx="62.24" cy="188.802" r="3.125"/>
-            <circle cx="136.372" cy="9.809" r="3.125"/>
-          </g>
-          <g transform="translate(.694 .694)">
-            <circle cx="62.24" cy="9.809" r="3.125"/>
-            <circle cx="136.372" cy="188.802" r="3.125"/>
-            <circle cx="3.264" cy="86.667" r="3.125"/>
-            <circle cx="195.347" cy="111.944" r="3.125"/>
-            <circle cx="40.33" cy="176.163" r="3.125"/>
-            <circle cx="158.281" cy="22.448" r="3.125"/>
-            <circle cx="22.448" cy="40.33" r="3.125"/>
-            <circle cx="176.163" cy="158.281" r="3.125"/>
-            <circle cx="9.809" cy="136.372" r="3.125"/>
-            <circle cx="188.802" cy="62.24" r="3.125"/>
-            <circle cx="86.667" cy="195.347" r="3.125"/>
-            <circle cx="111.944" cy="3.264" r="3.125"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".2">
-        <g transform="translate(9.896 9.896)">
-          <circle cx="84.392" cy="2.917" r="2.813"/>
-          <circle cx="95.816" cy="177.292" r="2.813"/>
-          <circle cx="11.753" cy="51.458" r="2.813"/>
-          <circle cx="168.455" cy="128.75" r="2.813"/>
-          <circle cx="17.465" cy="138.646" r="2.813"/>
-          <circle cx="162.743" cy="41.563" r="2.813"/>
-          <circle cx="41.563" cy="17.465" r="2.813"/>
-          <circle cx="138.646" cy="162.743" r="2.813"/>
-          <circle cx="2.917" cy="95.816" r="2.813"/>
-          <circle cx="177.292" cy="84.392" r="2.813"/>
-          <circle cx="51.458" cy="168.455" r="2.813"/>
-          <circle cx="128.75" cy="11.753" r="2.813"/>
-        </g>
-        <g transform="translate(11.458 11.458)">
-          <circle cx="60.451" cy="5.816" r="2.813"/>
-          <circle cx="116.632" cy="171.267" r="2.813"/>
-          <circle cx="2.847" cy="71.493" r="2.813"/>
-          <circle cx="174.236" cy="105.59" r="2.813"/>
-          <circle cx="30.938" cy="154.236" r="2.813"/>
-          <circle cx="146.146" cy="22.847" r="2.813"/>
-          <circle cx="22.847" cy="30.938" r="2.813"/>
-          <circle cx="154.236" cy="146.146" r="2.813"/>
-          <circle cx="5.816" cy="116.632" r="2.813"/>
-          <circle cx="171.267" cy="60.451" r="2.813"/>
-          <circle cx="71.493" cy="174.236" r="2.813"/>
-          <circle cx="105.59" cy="2.847" r="2.813"/>
-        </g>
-        <g>
-          <g transform="translate(11.458 11.458)">
-            <circle cx="71.493" cy="2.847" r="2.813"/>
-            <circle cx="105.59" cy="174.236" r="2.813"/>
-            <circle cx="5.816" cy="60.451" r="2.813"/>
-            <circle cx="171.267" cy="116.632" r="2.813"/>
-            <circle cx="22.847" cy="146.146" r="2.813"/>
-            <circle cx="154.236" cy="30.938" r="2.813"/>
-            <circle cx="30.938" cy="22.847" r="2.813"/>
-            <circle cx="146.146" cy="154.236" r="2.813"/>
-            <circle cx="2.847" cy="105.59" r="2.813"/>
-            <circle cx="174.236" cy="71.493" r="2.813"/>
-            <circle cx="60.451" cy="171.267" r="2.813"/>
-            <circle cx="116.632" cy="5.816" r="2.813"/>
-          </g>
-          <g transform="translate(9.896 9.896)">
-            <circle cx="51.458" cy="11.753" r="2.813"/>
-            <circle cx="128.75" cy="168.455" r="2.813"/>
-            <circle cx="2.917" cy="84.392" r="2.813"/>
-            <circle cx="177.292" cy="95.816" r="2.813"/>
-            <circle cx="41.563" cy="162.743" r="2.813"/>
-            <circle cx="138.646" cy="17.465" r="2.813"/>
-            <circle cx="17.465" cy="41.563" r="2.813"/>
-            <circle cx="162.743" cy="138.646" r="2.813"/>
-            <circle cx="11.753" cy="128.75" r="2.813"/>
-            <circle cx="168.455" cy="51.458" r="2.813"/>
-            <circle cx="84.392" cy="177.292" r="2.813"/>
-            <circle cx="95.816" cy="2.917" r="2.813"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".4">
-        <g transform="translate(19.618 19.618)">
-          <circle cx="70.139" cy="2.587" r="2.535"/>
-          <circle cx="90.625" cy="158.177" r="2.535"/>
-          <circle cx="7.882" cy="50.347" r="2.535"/>
-          <circle cx="152.882" cy="110.417" r="2.535"/>
-          <circle cx="18.125" cy="128.142" r="2.535"/>
-          <circle cx="142.639" cy="32.622" r="2.535"/>
-          <circle cx="32.622" cy="18.125" r="2.535"/>
-          <circle cx="128.142" cy="142.639" r="2.535"/>
-          <circle cx="2.587" cy="90.625" r="2.535"/>
-          <circle cx="158.177" cy="70.139" r="2.535"/>
-          <circle cx="50.347" cy="152.882" r="2.535"/>
-          <circle cx="110.417" cy="7.882" r="2.535"/>
-        </g>
-        <g transform="translate(19.618 19.618)">
-          <circle cx="50.347" cy="7.882" r="2.535"/>
-          <circle cx="110.417" cy="152.882" r="2.535"/>
-          <circle cx="2.587" cy="70.139" r="2.535"/>
-          <circle cx="158.177" cy="90.625" r="2.535"/>
-          <circle cx="32.622" cy="142.639" r="2.535"/>
-          <circle cx="128.142" cy="18.125" r="2.535"/>
-          <circle cx="18.125" cy="32.622" r="2.535"/>
-          <circle cx="142.639" cy="128.142" r="2.535"/>
-          <circle cx="7.882" cy="110.417" r="2.535"/>
-          <circle cx="152.882" cy="50.347" r="2.535"/>
-          <circle cx="70.139" cy="158.177" r="2.535"/>
-          <circle cx="90.625" cy="2.587" r="2.535"/>
-        </g>
-        <g>
-          <g transform="translate(21.528 21.528)">
-            <circle cx="58.16" cy="2.674" r="2.535"/>
-            <circle cx="98.785" cy="154.271" r="2.535"/>
-            <circle cx="2.674" cy="58.16" r="2.535"/>
-            <circle cx="154.271" cy="98.785" r="2.535"/>
-            <circle cx="22.986" cy="133.958" r="2.535"/>
-            <circle cx="133.958" cy="22.986" r="2.535"/>
-            <circle cx="22.986" cy="22.986" r="2.535"/>
-            <circle cx="133.958" cy="133.958" r="2.535"/>
-            <circle cx="2.674" cy="98.785" r="2.535"/>
-            <circle cx="154.271" cy="58.16" r="2.535"/>
-            <circle cx="58.16" cy="154.271" r="2.535"/>
-            <circle cx="98.785" cy="2.674" r="2.535"/>
-          </g>
-          <g transform="translate(18.924 18.924)">
-            <circle cx="41.84" cy="13.125" r="2.535"/>
-            <circle cx="120.313" cy="149.028" r="2.535"/>
-            <circle cx="2.604" cy="81.076" r="2.535"/>
-            <circle cx="159.549" cy="81.076" r="2.535"/>
-            <circle cx="41.84" cy="149.028" r="2.535"/>
-            <circle cx="120.313" cy="13.125" r="2.535"/>
-            <circle cx="13.125" cy="41.84" r="2.535"/>
-            <circle cx="149.028" cy="120.313" r="2.535"/>
-            <circle cx="13.125" cy="120.313" r="2.535"/>
-            <circle cx="149.028" cy="41.84" r="2.535"/>
-            <circle cx="81.076" cy="159.549" r="2.535"/>
-            <circle cx="81.076" cy="2.604" r="2.535"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".6">
-        <g transform="translate(28.3 28.3)">
-          <circle cx="57.899" cy="2.292" r="2.274"/>
-          <circle cx="85.503" cy="141.111" r="2.274"/>
-          <circle cx="4.688" cy="48.958" r="2.274"/>
-          <circle cx="138.715" cy="94.444" r="2.274"/>
-          <circle cx="18.49" cy="118.368" r="2.274"/>
-          <circle cx="124.913" cy="25.035" r="2.274"/>
-          <circle cx="25.035" cy="18.49" r="2.274"/>
-          <circle cx="118.368" cy="124.913" r="2.274"/>
-          <circle cx="2.292" cy="85.503" r="2.274"/>
-          <circle cx="141.111" cy="57.899" r="2.274"/>
-          <circle cx="48.958" cy="138.715" r="2.274"/>
-          <circle cx="94.444" cy="4.688" r="2.274"/>
-        </g>
-        <g transform="translate(27.083 27.083)">
-          <circle cx="41.615" cy="9.444" r="2.274"/>
-          <circle cx="104.219" cy="136.389" r="2.274"/>
-          <circle cx="2.292" cy="68.281" r="2.274"/>
-          <circle cx="143.542" cy="77.552" r="2.274"/>
-          <circle cx="33.594" cy="131.753" r="2.274"/>
-          <circle cx="112.24" cy="14.08" r="2.274"/>
-          <circle cx="14.08" cy="33.594" r="2.274"/>
-          <circle cx="131.753" cy="112.24" r="2.274"/>
-          <circle cx="9.444" cy="104.219" r="2.274"/>
-          <circle cx="136.389" cy="41.615" r="2.274"/>
-          <circle cx="68.281" cy="143.542" r="2.274"/>
-          <circle cx="77.552" cy="2.292" r="2.274"/>
-        </g>
-        <g>
-          <g transform="translate(28.3 28.3)">
-            <circle cx="48.958" cy="4.688" r="2.274"/>
-            <circle cx="94.444" cy="138.715" r="2.274"/>
-            <circle cx="2.292" cy="57.899" r="2.274"/>
-            <circle cx="141.111" cy="85.503" r="2.274"/>
-            <circle cx="25.035" cy="124.913" r="2.274"/>
-            <circle cx="118.368" cy="18.49" r="2.274"/>
-            <circle cx="18.49" cy="25.035" r="2.274"/>
-            <circle cx="124.913" cy="118.368" r="2.274"/>
-            <circle cx="4.688" cy="94.444" r="2.274"/>
-            <circle cx="138.715" cy="48.958" r="2.274"/>
-            <circle cx="57.899" cy="141.111" r="2.274"/>
-            <circle cx="85.503" cy="2.292" r="2.274"/>
-          </g>
-          <g transform="translate(27.083 27.083)">
-            <circle cx="33.594" cy="14.08" r="2.274"/>
-            <circle cx="112.24" cy="131.753" r="2.274"/>
-            <circle cx="2.292" cy="77.552" r="2.274"/>
-            <circle cx="143.542" cy="68.281" r="2.274"/>
-            <circle cx="41.615" cy="136.389" r="2.274"/>
-            <circle cx="104.219" cy="9.444" r="2.274"/>
-            <circle cx="9.444" cy="41.615" r="2.274"/>
-            <circle cx="136.389" cy="104.219" r="2.274"/>
-            <circle cx="14.08" cy="112.24" r="2.274"/>
-            <circle cx="131.753" cy="33.594" r="2.274"/>
-            <circle cx="77.552" cy="143.542" r="2.274"/>
-            <circle cx="68.281" cy="2.292" r="2.274"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".8">
-        <g transform="translate(34.375 34.375)">
-          <circle cx="65.625" cy="2.049" r="2.049"/>
-          <circle cx="65.625" cy="129.201" r="2.049"/>
-          <circle cx="10.573" cy="33.837" r="2.049"/>
-          <circle cx="120.677" cy="97.413" r="2.049"/>
-          <circle cx="10.573" cy="97.413" r="2.049"/>
-          <circle cx="120.677" cy="33.837" r="2.049"/>
-          <circle cx="33.837" cy="10.573" r="2.049"/>
-          <circle cx="97.413" cy="120.677" r="2.049"/>
-          <circle cx="2.049" cy="65.625" r="2.049"/>
-          <circle cx="129.201" cy="65.625" r="2.049"/>
-          <circle cx="33.837" cy="120.677" r="2.049"/>
-          <circle cx="97.413" cy="10.573" r="2.049"/>
-        </g>
-        <g transform="translate(36.458 36.458)">
-          <circle cx="47.083" cy="2.135" r="2.049"/>
-          <circle cx="80" cy="124.948" r="2.049"/>
-          <circle cx="2.135" cy="47.083" r="2.049"/>
-          <circle cx="124.948" cy="80" r="2.049"/>
-          <circle cx="18.594" cy="108.49" r="2.049"/>
-          <circle cx="108.49" cy="18.594" r="2.049"/>
-          <circle cx="18.594" cy="18.594" r="2.049"/>
-          <circle cx="108.49" cy="108.49" r="2.049"/>
-          <circle cx="2.135" cy="80" r="2.049"/>
-          <circle cx="124.948" cy="47.083" r="2.049"/>
-          <circle cx="47.083" cy="124.948" r="2.049"/>
-          <circle cx="80" cy="2.135" r="2.049"/>
-        </g>
-        <g>
-          <g transform="translate(34.896 34.896)">
-            <circle cx="56.806" cy="2.066" r="2.049"/>
-            <circle cx="73.403" cy="128.142" r="2.049"/>
-            <circle cx="6.372" cy="40.781" r="2.049"/>
-            <circle cx="123.837" cy="89.427" r="2.049"/>
-            <circle cx="14.67" cy="103.802" r="2.049"/>
-            <circle cx="115.538" cy="26.406" r="2.049"/>
-            <circle cx="26.406" cy="14.67" r="2.049"/>
-            <circle cx="103.802" cy="115.538" r="2.049"/>
-            <circle cx="2.066" cy="73.403" r="2.049"/>
-            <circle cx="128.142" cy="56.806" r="2.049"/>
-            <circle cx="40.781" cy="123.837" r="2.049"/>
-            <circle cx="89.427" cy="6.372" r="2.049"/>
-          </g>
-          <g transform="translate(34.896 34.896)">
-            <circle cx="40.781" cy="6.372" r="2.049"/>
-            <circle cx="89.427" cy="123.837" r="2.049"/>
-            <circle cx="2.066" cy="56.806" r="2.049"/>
-            <circle cx="128.142" cy="73.403" r="2.049"/>
-            <circle cx="26.406" cy="115.538" r="2.049"/>
-            <circle cx="103.802" cy="14.67" r="2.049"/>
-            <circle cx="14.67" cy="26.406" r="2.049"/>
-            <circle cx="115.538" cy="103.802" r="2.049"/>
-            <circle cx="6.372" cy="89.427" r="2.049"/>
-            <circle cx="123.837" cy="40.781" r="2.049"/>
-            <circle cx="56.806" cy="128.142" r="2.049"/>
-            <circle cx="73.403" cy="2.066" r="2.049"/>
-          </g>
-        </g>
-      </g>
-      <g transform="translate(40.8 40.8)">
-        <circle cx="55.451" cy="1.997" r="1.858"/>
-        <circle cx="62.951" cy="116.406" r="1.858"/>
-        <circle cx="7.778" cy="33.837" r="1.858"/>
-        <circle cx="110.625" cy="84.566" r="1.858"/>
-        <circle cx="11.528" cy="91.059" r="1.858"/>
-        <circle cx="106.875" cy="27.344" r="1.858"/>
-        <circle cx="27.344" cy="11.528" r="1.858"/>
-        <circle cx="91.059" cy="106.875" r="1.858"/>
-        <circle cx="1.997" cy="62.951" r="1.858"/>
-        <circle cx="116.406" cy="55.451" r="1.858"/>
-        <circle cx="33.837" cy="110.625" r="1.858"/>
-        <circle cx="84.566" cy="7.778" r="1.858"/>
-      </g>
-      <g transform="translate(41.84 41.84)">
-        <circle cx="39.722" cy="3.872" r="1.858"/>
-        <circle cx="76.597" cy="112.448" r="1.858"/>
-        <circle cx="1.927" cy="46.979" r="1.858"/>
-        <circle cx="114.392" cy="69.34" r="1.858"/>
-        <circle cx="20.347" cy="101.267" r="1.858"/>
-        <circle cx="95.972" cy="15.052" r="1.858"/>
-        <circle cx="15.052" cy="20.347" r="1.858"/>
-        <circle cx="101.267" cy="95.972" r="1.858"/>
-        <circle cx="3.872" cy="76.597" r="1.858"/>
-        <circle cx="112.448" cy="39.722" r="1.858"/>
-        <circle cx="46.979" cy="114.392" r="1.858"/>
-        <circle cx="69.34" cy="1.927" r="1.858"/>
-      </g>
-      <g transform="translate(41.84 41.84)">
-        <circle cx="46.979" cy="1.927" r="1.858"/>
-        <circle cx="69.34" cy="114.392" r="1.858"/>
-        <circle cx="3.872" cy="39.722" r="1.858"/>
-        <circle cx="112.448" cy="76.597" r="1.858"/>
-        <circle cx="15.052" cy="95.972" r="1.858"/>
-        <circle cx="101.267" cy="20.347" r="1.858"/>
-        <circle cx="20.347" cy="15.052" r="1.858"/>
-        <circle cx="95.972" cy="101.267" r="1.858"/>
-        <circle cx="1.927" cy="69.34" r="1.858"/>
-        <circle cx="114.392" cy="46.979" r="1.858"/>
-        <circle cx="39.722" cy="112.448" r="1.858"/>
-        <circle cx="76.597" cy="3.872" r="1.858"/>
-      </g>
-      <g transform="translate(40.8 40.8)">
-        <circle cx="33.837" cy="7.778" r="1.858"/>
-        <circle cx="84.566" cy="110.625" r="1.858"/>
-        <circle cx="1.997" cy="55.451" r="1.858"/>
-        <circle cx="116.406" cy="62.951" r="1.858"/>
-        <circle cx="27.344" cy="106.875" r="1.858"/>
-        <circle cx="91.059" cy="11.528" r="1.858"/>
-        <circle cx="11.528" cy="27.344" r="1.858"/>
-        <circle cx="106.875" cy="91.059" r="1.858"/>
-        <circle cx="7.778" cy="84.566" r="1.858"/>
-        <circle cx="110.625" cy="33.837" r="1.858"/>
-        <circle cx="55.451" cy="116.406" r="1.858"/>
-        <circle cx="62.951" cy="1.997" r="1.858"/>
-      </g>
-      <g transform="translate(47.222 47.222)">
-        <circle cx="46.059" cy="1.719" r="1.667"/>
-        <circle cx="59.497" cy="103.837" r="1.667"/>
-        <circle cx="5.208" cy="33.073" r="1.667"/>
-        <circle cx="100.347" cy="72.483" r="1.667"/>
-        <circle cx="11.927" cy="84.132" r="1.667"/>
-        <circle cx="93.628" cy="21.424" r="1.667"/>
-        <circle cx="21.424" cy="11.927" r="1.667"/>
-        <circle cx="84.132" cy="93.628" r="1.667"/>
-        <circle cx="1.719" cy="59.497" r="1.667"/>
-        <circle cx="103.837" cy="46.059" r="1.667"/>
-        <circle cx="33.073" cy="100.347" r="1.667"/>
-        <circle cx="72.483" cy="5.208" r="1.667"/>
-      </g>
-      <g transform="translate(47.222 47.222)">
-        <circle cx="33.073" cy="5.208" r="1.667"/>
-        <circle cx="72.483" cy="100.347" r="1.667"/>
-        <circle cx="1.719" cy="46.059" r="1.667"/>
-        <circle cx="103.837" cy="59.497" r="1.667"/>
-        <circle cx="21.424" cy="93.628" r="1.667"/>
-        <circle cx="84.132" cy="11.927" r="1.667"/>
-        <circle cx="11.927" cy="21.424" r="1.667"/>
-        <circle cx="93.628" cy="84.132" r="1.667"/>
-        <circle cx="5.208" cy="72.483" r="1.667"/>
-        <circle cx="100.347" cy="33.073" r="1.667"/>
-        <circle cx="46.059" cy="103.837" r="1.667"/>
-        <circle cx="59.497" cy="1.719" r="1.667"/>
-      </g>
-      <g transform="translate(48.438 48.438)">
-        <circle cx="38.229" cy="1.823" r="1.667"/>
-        <circle cx="64.896" cy="101.302" r="1.667"/>
-        <circle cx="1.823" cy="38.229" r="1.667"/>
-        <circle cx="101.302" cy="64.896" r="1.667"/>
-        <circle cx="15.156" cy="87.969" r="1.667"/>
-        <circle cx="87.969" cy="15.156" r="1.667"/>
-        <circle cx="15.156" cy="15.156" r="1.667"/>
-        <circle cx="87.969" cy="87.969" r="1.667"/>
-        <circle cx="1.823" cy="64.896" r="1.667"/>
-        <circle cx="101.302" cy="38.229" r="1.667"/>
-        <circle cx="38.229" cy="101.302" r="1.667"/>
-        <circle cx="64.896" cy="1.823" r="1.667"/>
-      </g>
-      <g transform="translate(46.7 46.7)">
-        <circle cx="27.552" cy="8.698" r="1.667"/>
-        <circle cx="79.045" cy="97.899" r="1.667"/>
-        <circle cx="1.806" cy="53.299" r="1.667"/>
-        <circle cx="104.792" cy="53.299" r="1.667"/>
-        <circle cx="27.552" cy="97.899" r="1.667"/>
-        <circle cx="79.045" cy="8.698" r="1.667"/>
-        <circle cx="8.698" cy="27.552" r="1.667"/>
-        <circle cx="97.899" cy="79.045" r="1.667"/>
-        <circle cx="8.698" cy="79.045" r="1.667"/>
-        <circle cx="97.899" cy="27.552" r="1.667"/>
-        <circle cx="53.299" cy="104.792" r="1.667"/>
-        <circle cx="53.299" cy="1.806" r="1.667"/>
-      </g>
-      <g opacity=".9">
-        <g transform="translate(52.95 52.95)">
-          <circle cx="37.986" cy="1.493" r="1.493"/>
-          <circle cx="56.111" cy="92.604" r="1.493"/>
-          <circle cx="3.073" cy="32.118" r="1.493"/>
-          <circle cx="91.024" cy="61.979" r="1.493"/>
-          <circle cx="12.135" cy="77.674" r="1.493"/>
-          <circle cx="81.962" cy="16.424" r="1.493"/>
-          <circle cx="16.424" cy="12.135" r="1.493"/>
-          <circle cx="77.674" cy="81.962" r="1.493"/>
-          <circle cx="1.493" cy="56.111" r="1.493"/>
-          <circle cx="92.604" cy="37.986" r="1.493"/>
-          <circle cx="32.118" cy="91.024" r="1.493"/>
-          <circle cx="61.979" cy="3.073" r="1.493"/>
-        </g>
-        <g transform="translate(52.083 52.083)">
-          <circle cx="27.378" cy="6.267" r="1.493"/>
-          <circle cx="68.455" cy="89.566" r="1.493"/>
-          <circle cx="1.58" cy="44.878" r="1.493"/>
-          <circle cx="94.253" cy="50.955" r="1.493"/>
-          <circle cx="22.118" cy="86.528" r="1.493"/>
-          <circle cx="73.715" cy="9.306" r="1.493"/>
-          <circle cx="9.306" cy="22.118" r="1.493"/>
-          <circle cx="86.528" cy="73.715" r="1.493"/>
-          <circle cx="6.267" cy="68.455" r="1.493"/>
-          <circle cx="89.566" cy="27.378" r="1.493"/>
-          <circle cx="44.878" cy="94.253" r="1.493"/>
-          <circle cx="50.955" cy="1.58" r="1.493"/>
-        </g>
-        <g>
-          <g transform="translate(52.95 52.95)">
-            <circle cx="32.118" cy="3.073" r="1.493"/>
-            <circle cx="61.979" cy="91.024" r="1.493"/>
-            <circle cx="1.493" cy="37.986" r="1.493"/>
-            <circle cx="92.604" cy="56.111" r="1.493"/>
-            <circle cx="16.424" cy="81.962" r="1.493"/>
-            <circle cx="77.674" cy="12.135" r="1.493"/>
-            <circle cx="12.135" cy="16.424" r="1.493"/>
-            <circle cx="81.962" cy="77.674" r="1.493"/>
-            <circle cx="3.073" cy="61.979" r="1.493"/>
-            <circle cx="91.024" cy="32.118" r="1.493"/>
-            <circle cx="37.986" cy="92.604" r="1.493"/>
-            <circle cx="56.111" cy="1.493" r="1.493"/>
-          </g>
-          <g transform="translate(52.083 52.083)">
-            <circle cx="22.118" cy="9.306" r="1.493"/>
-            <circle cx="73.715" cy="86.528" r="1.493"/>
-            <circle cx="1.58" cy="50.955" r="1.493"/>
-            <circle cx="94.253" cy="44.878" r="1.493"/>
-            <circle cx="27.378" cy="89.566" r="1.493"/>
-            <circle cx="68.455" cy="6.267" r="1.493"/>
-            <circle cx="6.267" cy="27.378" r="1.493"/>
-            <circle cx="89.566" cy="68.455" r="1.493"/>
-            <circle cx="9.306" cy="73.715" r="1.493"/>
-            <circle cx="86.528" cy="22.118" r="1.493"/>
-            <circle cx="50.955" cy="94.253" r="1.493"/>
-            <circle cx="44.878" cy="1.58" r="1.493"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".8">
-        <g transform="translate(56.944 56.944)">
-          <circle cx="43.056" cy="1.406" r="1.337"/>
-          <circle cx="43.056" cy="84.705" r="1.337"/>
-          <circle cx="6.979" cy="22.222" r="1.337"/>
-          <circle cx="79.132" cy="63.889" r="1.337"/>
-          <circle cx="6.979" cy="63.889" r="1.337"/>
-          <circle cx="79.132" cy="22.222" r="1.337"/>
-          <circle cx="22.222" cy="6.979" r="1.337"/>
-          <circle cx="63.889" cy="79.132" r="1.337"/>
-          <circle cx="1.406" cy="43.056" r="1.337"/>
-          <circle cx="84.705" cy="43.056" r="1.337"/>
-          <circle cx="22.222" cy="79.132" r="1.337"/>
-          <circle cx="63.889" cy="6.979" r="1.337"/>
-        </g>
-        <g transform="translate(58.333 58.333)">
-          <circle cx="30.885" cy="1.424" r="1.337"/>
-          <circle cx="52.448" cy="81.91" r="1.337"/>
-          <circle cx="1.424" cy="30.885" r="1.337"/>
-          <circle cx="81.91" cy="52.448" r="1.337"/>
-          <circle cx="12.205" cy="71.128" r="1.337"/>
-          <circle cx="71.128" cy="12.205" r="1.337"/>
-          <circle cx="12.205" cy="12.205" r="1.337"/>
-          <circle cx="71.128" cy="71.128" r="1.337"/>
-          <circle cx="1.424" cy="52.448" r="1.337"/>
-          <circle cx="81.91" cy="30.885" r="1.337"/>
-          <circle cx="30.885" cy="81.91" r="1.337"/>
-          <circle cx="52.448" cy="1.424" r="1.337"/>
-        </g>
-        <g>
-          <g transform="translate(57.292 57.292)">
-            <circle cx="37.274" cy="1.406" r="1.337"/>
-            <circle cx="48.142" cy="84.01" r="1.337"/>
-            <circle cx="4.219" cy="26.771" r="1.337"/>
-            <circle cx="81.198" cy="58.646" r="1.337"/>
-            <circle cx="9.653" cy="68.073" r="1.337"/>
-            <circle cx="75.764" cy="17.344" r="1.337"/>
-            <circle cx="17.344" cy="9.653" r="1.337"/>
-            <circle cx="68.073" cy="75.764" r="1.337"/>
-            <circle cx="1.406" cy="48.142" r="1.337"/>
-            <circle cx="84.01" cy="37.274" r="1.337"/>
-            <circle cx="26.771" cy="81.198" r="1.337"/>
-            <circle cx="58.646" cy="4.219" r="1.337"/>
-          </g>
-          <g transform="translate(57.292 57.292)">
-            <circle cx="26.771" cy="4.219" r="1.337"/>
-            <circle cx="58.646" cy="81.198" r="1.337"/>
-            <circle cx="1.406" cy="37.274" r="1.337"/>
-            <circle cx="84.01" cy="48.142" r="1.337"/>
-            <circle cx="17.344" cy="75.764" r="1.337"/>
-            <circle cx="68.073" cy="9.653" r="1.337"/>
-            <circle cx="9.653" cy="17.344" r="1.337"/>
-            <circle cx="75.764" cy="68.073" r="1.337"/>
-            <circle cx="4.219" cy="58.646" r="1.337"/>
-            <circle cx="81.198" cy="26.771" r="1.337"/>
-            <circle cx="37.274" cy="84.01" r="1.337"/>
-            <circle cx="48.142" cy="1.406" r="1.337"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".7">
-        <g transform="translate(61.285 61.285)">
-          <circle cx="36.25" cy="1.233" r="1.215"/>
-          <circle cx="41.181" cy="76.198" r="1.215"/>
-          <circle cx="5.017" cy="22.101" r="1.215"/>
-          <circle cx="72.413" cy="55.33" r="1.215"/>
-          <circle cx="7.483" cy="59.583" r="1.215"/>
-          <circle cx="69.948" cy="17.847" r="1.215"/>
-          <circle cx="17.847" cy="7.483" r="1.215"/>
-          <circle cx="59.583" cy="69.948" r="1.215"/>
-          <circle cx="1.233" cy="41.181" r="1.215"/>
-          <circle cx="76.198" cy="36.25" r="1.215"/>
-          <circle cx="22.101" cy="72.413" r="1.215"/>
-          <circle cx="55.33" cy="5.017" r="1.215"/>
-        </g>
-        <g transform="translate(61.806 61.806)">
-          <circle cx="26.111" cy="2.622" r="1.215"/>
-          <circle cx="50.278" cy="73.767" r="1.215"/>
-          <circle cx="1.354" cy="30.868" r="1.215"/>
-          <circle cx="75.035" cy="45.521" r="1.215"/>
-          <circle cx="13.42" cy="66.441" r="1.215"/>
-          <circle cx="62.969" cy="9.948" r="1.215"/>
-          <circle cx="9.948" cy="13.42" r="1.215"/>
-          <circle cx="66.441" cy="62.969" r="1.215"/>
-          <circle cx="2.622" cy="50.278" r="1.215"/>
-          <circle cx="73.767" cy="26.111" r="1.215"/>
-          <circle cx="30.868" cy="75.035" r="1.215"/>
-          <circle cx="45.521" cy="1.354" r="1.215"/>
-        </g>
-        <g>
-          <g transform="translate(61.806 61.806)">
-            <circle cx="30.868" cy="1.354" r="1.215"/>
-            <circle cx="45.521" cy="75.035" r="1.215"/>
-            <circle cx="2.622" cy="26.111" r="1.215"/>
-            <circle cx="73.767" cy="50.278" r="1.215"/>
-            <circle cx="9.948" cy="62.969" r="1.215"/>
-            <circle cx="66.441" cy="13.42" r="1.215"/>
-            <circle cx="13.42" cy="9.948" r="1.215"/>
-            <circle cx="62.969" cy="66.441" r="1.215"/>
-            <circle cx="1.354" cy="45.521" r="1.215"/>
-            <circle cx="75.035" cy="30.868" r="1.215"/>
-            <circle cx="26.111" cy="73.767" r="1.215"/>
-            <circle cx="50.278" cy="2.622" r="1.215"/>
-          </g>
-          <g transform="translate(61.285 61.285)">
-            <circle cx="22.101" cy="5.017" r="1.215"/>
-            <circle cx="55.33" cy="72.413" r="1.215"/>
-            <circle cx="1.233" cy="36.25" r="1.215"/>
-            <circle cx="76.198" cy="41.181" r="1.215"/>
-            <circle cx="17.847" cy="69.948" r="1.215"/>
-            <circle cx="59.583" cy="7.483" r="1.215"/>
-            <circle cx="7.483" cy="17.847" r="1.215"/>
-            <circle cx="69.948" cy="59.583" r="1.215"/>
-            <circle cx="5.017" cy="55.33" r="1.215"/>
-            <circle cx="72.413" cy="22.101" r="1.215"/>
-            <circle cx="36.25" cy="76.198" r="1.215"/>
-            <circle cx="41.181" cy="1.233" r="1.215"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".6">
-        <g transform="translate(65.45 65.45)">
-          <circle cx="30.139" cy="1.094" r="1.094"/>
-          <circle cx="38.958" cy="68.003" r="1.094"/>
-          <circle cx="3.368" cy="21.632" r="1.094"/>
-          <circle cx="65.729" cy="47.465" r="1.094"/>
-          <circle cx="7.778" cy="55.087" r="1.094"/>
-          <circle cx="61.319" cy="14.01" r="1.094"/>
-          <circle cx="14.01" cy="7.778" r="1.094"/>
-          <circle cx="55.087" cy="61.319" r="1.094"/>
-          <circle cx="1.094" cy="38.958" r="1.094"/>
-          <circle cx="68.003" cy="30.139" r="1.094"/>
-          <circle cx="21.632" cy="65.729" r="1.094"/>
-          <circle cx="47.465" cy="3.368" r="1.094"/>
-        </g>
-        <g transform="translate(65.45 65.45)">
-          <circle cx="21.632" cy="3.368" r="1.094"/>
-          <circle cx="47.465" cy="65.729" r="1.094"/>
-          <circle cx="1.094" cy="30.139" r="1.094"/>
-          <circle cx="68.003" cy="38.958" r="1.094"/>
-          <circle cx="14.01" cy="61.319" r="1.094"/>
-          <circle cx="55.087" cy="7.778" r="1.094"/>
-          <circle cx="7.778" cy="14.01" r="1.094"/>
-          <circle cx="61.319" cy="55.087" r="1.094"/>
-          <circle cx="3.368" cy="47.465" r="1.094"/>
-          <circle cx="65.729" cy="21.632" r="1.094"/>
-          <circle cx="30.139" cy="68.003" r="1.094"/>
-          <circle cx="38.958" cy="1.094" r="1.094"/>
-        </g>
-        <g>
-          <g transform="translate(66.32 66.32)">
-            <circle cx="24.948" cy="1.094" r="1.094"/>
-            <circle cx="42.413" cy="66.267" r="1.094"/>
-            <circle cx="1.094" cy="24.948" r="1.094"/>
-            <circle cx="66.267" cy="42.413" r="1.094"/>
-            <circle cx="9.826" cy="57.535" r="1.094"/>
-            <circle cx="57.535" cy="9.826" r="1.094"/>
-            <circle cx="9.826" cy="9.826" r="1.094"/>
-            <circle cx="57.535" cy="57.535" r="1.094"/>
-            <circle cx="1.094" cy="42.413" r="1.094"/>
-            <circle cx="66.267" cy="24.948" r="1.094"/>
-            <circle cx="24.948" cy="66.267" r="1.094"/>
-            <circle cx="42.413" cy="1.094" r="1.094"/>
-          </g>
-          <g transform="translate(65.104 65.104)">
-            <circle cx="18.021" cy="5.677" r="1.094"/>
-            <circle cx="51.771" cy="64.115" r="1.094"/>
-            <circle cx="1.146" cy="34.896" r="1.094"/>
-            <circle cx="68.646" cy="34.896" r="1.094"/>
-            <circle cx="18.021" cy="64.115" r="1.094"/>
-            <circle cx="51.771" cy="5.677" r="1.094"/>
-            <circle cx="5.677" cy="18.021" r="1.094"/>
-            <circle cx="64.115" cy="51.771" r="1.094"/>
-            <circle cx="5.677" cy="51.771" r="1.094"/>
-            <circle cx="64.115" cy="18.021" r="1.094"/>
-            <circle cx="34.896" cy="68.646" r="1.094"/>
-            <circle cx="34.896" cy="1.146" r="1.094"/>
-          </g>
-        </g>
-      </g>
-      <g>
-        <g transform="translate(69.097 69.097)">
-          <circle cx="24.965" cy="1.059" r="1"/>
-          <circle cx="36.84" cy="60.747" r="1"/>
-          <circle cx="2.083" cy="21.128" r="1"/>
-          <circle cx="59.722" cy="40.677" r="1"/>
-          <circle cx="8.021" cy="50.972" r="1"/>
-          <circle cx="53.785" cy="10.833" r="1"/>
-          <circle cx="10.833" cy="8.021" r="1"/>
-          <circle cx="50.972" cy="53.785" r="1"/>
-          <circle cx="1.059" cy="36.84" r="1"/>
-          <circle cx="60.747" cy="24.965" r="1"/>
-          <circle cx="21.128" cy="59.722" r="1"/>
-          <circle cx="40.677" cy="2.083" r="1"/>
-        </g>
-        <g transform="translate(68.576 68.576)">
-          <circle cx="17.969" cy="4.132" r="1"/>
-          <circle cx="44.878" cy="58.715" r="1"/>
-          <circle cx="1.059" cy="29.427" r="1"/>
-          <circle cx="61.788" cy="33.42" r="1"/>
-          <circle cx="14.514" cy="56.719" r="1"/>
-          <circle cx="48.333" cy="6.128" r="1"/>
-          <circle cx="6.128" cy="14.514" r="1"/>
-          <circle cx="56.719" cy="48.333" r="1"/>
-          <circle cx="4.132" cy="44.878" r="1"/>
-          <circle cx="58.715" cy="17.969" r="1"/>
-          <circle cx="29.427" cy="61.788" r="1"/>
-          <circle cx="33.42" cy="1.059" r="1"/>
-        </g>
-        <g>
-          <g transform="translate(69.097 69.097)">
-            <circle cx="21.128" cy="2.083" r="1"/>
-            <circle cx="40.677" cy="59.722" r="1"/>
-            <circle cx="1.059" cy="24.965" r="1"/>
-            <circle cx="60.747" cy="36.84" r="1"/>
-            <circle cx="10.833" cy="53.785" r="1"/>
-            <circle cx="50.972" cy="8.021" r="1"/>
-            <circle cx="8.021" cy="10.833" r="1"/>
-            <circle cx="53.785" cy="50.972" r="1"/>
-            <circle cx="2.083" cy="40.677" r="1"/>
-            <circle cx="59.722" cy="21.128" r="1"/>
-            <circle cx="24.965" cy="60.747" r="1"/>
-            <circle cx="36.84" cy="1.059" r="1"/>
-          </g>
-          <g transform="translate(68.576 68.576)">
-            <circle cx="14.514" cy="6.128" r="1"/>
-            <circle cx="48.333" cy="56.719" r="1"/>
-            <circle cx="1.059" cy="33.42" r="1"/>
-            <circle cx="61.788" cy="29.427" r="1"/>
-            <circle cx="17.969" cy="58.715" r="1"/>
-            <circle cx="44.878" cy="4.132" r="1"/>
-            <circle cx="4.132" cy="17.969" r="1"/>
-            <circle cx="58.715" cy="44.878" r="1"/>
-            <circle cx="6.128" cy="48.333" r="1"/>
-            <circle cx="56.719" cy="14.514" r="1"/>
-            <circle cx="33.42" cy="61.788" r="1"/>
-            <circle cx="29.427" cy="1.059" r="1"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".4">
-        <g transform="translate(71.7 71.7)">
-          <circle cx="28.299" cy=".955" r="1"/>
-          <circle cx="28.299" cy="55.642" r="1"/>
-          <circle cx="4.618" cy="14.635" r="1"/>
-          <circle cx="51.979" cy="41.962" r="1"/>
-          <circle cx="4.618" cy="41.962" r="1"/>
-          <circle cx="51.979" cy="14.635" r="1"/>
-          <circle cx="14.635" cy="4.618" r="1"/>
-          <circle cx="41.962" cy="51.979" r="1"/>
-          <circle cx=".955" cy="28.299" r="1"/>
-          <circle cx="55.642" cy="28.299" r="1"/>
-          <circle cx="14.635" cy="51.979" r="1"/>
-          <circle cx="41.962" cy="4.618" r="1"/>
-        </g>
-        <g transform="translate(72.57 72.57)">
-          <circle cx="20.347" cy="1.024" r="1"/>
-          <circle cx="34.514" cy="53.837" r="1"/>
-          <circle cx="1.024" cy="20.347" r="1"/>
-          <circle cx="53.837" cy="34.514" r="1"/>
-          <circle cx="8.108" cy="46.753" r="1"/>
-          <circle cx="46.753" cy="8.108" r="1"/>
-          <circle cx="8.108" cy="8.108" r="1"/>
-          <circle cx="46.753" cy="46.753" r="1"/>
-          <circle cx="1.024" cy="34.514" r="1"/>
-          <circle cx="53.837" cy="20.347" r="1"/>
-          <circle cx="20.347" cy="53.837" r="1"/>
-          <circle cx="34.514" cy="1.024" r="1"/>
-        </g>
-        <g>
-          <g transform="translate(71.875 71.875)">
-            <circle cx="24.549" cy="1.024" r="1"/>
-            <circle cx="31.701" cy="55.226" r="1"/>
-            <circle cx="2.865" cy="17.656" r="1"/>
-            <circle cx="53.385" cy="38.594" r="1"/>
-            <circle cx="6.441" cy="44.774" r="1"/>
-            <circle cx="49.809" cy="11.476" r="1"/>
-            <circle cx="11.476" cy="6.441" r="1"/>
-            <circle cx="44.774" cy="49.809" r="1"/>
-            <circle cx="1.024" cy="31.701" r="1"/>
-            <circle cx="55.226" cy="24.549" r="1"/>
-            <circle cx="17.656" cy="53.385" r="1"/>
-            <circle cx="38.594" cy="2.865" r="1"/>
-          </g>
-          <g transform="translate(71.875 71.875)">
-            <circle cx="17.656" cy="2.865" r="1"/>
-            <circle cx="38.594" cy="53.385" r="1"/>
-            <circle cx="1.024" cy="24.549" r="1"/>
-            <circle cx="55.226" cy="31.701" r="1"/>
-            <circle cx="11.476" cy="49.809" r="1"/>
-            <circle cx="44.774" cy="6.441" r="1"/>
-            <circle cx="6.441" cy="11.476" r="1"/>
-            <circle cx="49.809" cy="44.774" r="1"/>
-            <circle cx="2.865" cy="38.594" r="1"/>
-            <circle cx="53.385" cy="17.656" r="1"/>
-            <circle cx="24.549" cy="55.226" r="1"/>
-            <circle cx="31.701" cy="1.024" r="1"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".3">
-        <g transform="translate(74.48 74.48)">
-          <circle cx="23.906" cy=".92" r="1"/>
-          <circle cx="27.135" cy="50.122" r="1"/>
-          <circle cx="3.403" cy="14.618" r="1"/>
-          <circle cx="47.639" cy="36.424" r="1"/>
-          <circle cx="5.017" cy="39.219" r="1"/>
-          <circle cx="46.024" cy="11.823" r="1"/>
-          <circle cx="11.823" cy="5.017" r="1"/>
-          <circle cx="39.219" cy="46.024" r="1"/>
-          <circle cx=".92" cy="27.135" r="1"/>
-          <circle cx="50.122" cy="23.906" r="1"/>
-          <circle cx="14.618" cy="47.639" r="1"/>
-          <circle cx="36.424" cy="3.403" r="1"/>
-        </g>
-        <g transform="translate(75 75)">
-          <circle cx="17.083" cy="1.649" r="1"/>
-          <circle cx="32.917" cy="48.351" r="1"/>
-          <circle cx=".816" cy="20.191" r="1"/>
-          <circle cx="49.184" cy="29.809" r="1"/>
-          <circle cx="8.75" cy="43.542" r="1"/>
-          <circle cx="41.25" cy="6.458" r="1"/>
-          <circle cx="6.458" cy="8.75" r="1"/>
-          <circle cx="43.542" cy="41.25" r="1"/>
-          <circle cx="1.649" cy="32.917" r="1"/>
-          <circle cx="48.351" cy="17.083" r="1"/>
-          <circle cx="20.191" cy="49.184" r="1"/>
-          <circle cx="29.809" cy=".816" r="1"/>
-        </g>
-        <g>
-          <g transform="translate(75 75)">
-            <circle cx="20.191" cy=".816" r="1"/>
-            <circle cx="29.809" cy="49.184" r="1"/>
-            <circle cx="1.649" cy="17.083" r="1"/>
-            <circle cx="48.351" cy="32.917" r="1"/>
-            <circle cx="6.458" cy="41.25" r="1"/>
-            <circle cx="43.542" cy="8.75" r="1"/>
-            <circle cx="8.75" cy="6.458" r="1"/>
-            <circle cx="41.25" cy="43.542" r="1"/>
-            <circle cx=".816" cy="29.809" r="1"/>
-            <circle cx="49.184" cy="20.191" r="1"/>
-            <circle cx="17.083" cy="48.351" r="1"/>
-            <circle cx="32.917" cy="1.649" r="1"/>
-          </g>
-          <g transform="translate(74.48 74.48)">
-            <circle cx="14.618" cy="3.403" r="1"/>
-            <circle cx="36.424" cy="47.639" r="1"/>
-            <circle cx=".92" cy="23.906" r="1"/>
-            <circle cx="50.122" cy="27.135" r="1"/>
-            <circle cx="11.823" cy="46.024" r="1"/>
-            <circle cx="39.219" cy="5.017" r="1"/>
-            <circle cx="5.017" cy="11.823" r="1"/>
-            <circle cx="46.024" cy="39.219" r="1"/>
-            <circle cx="3.403" cy="36.424" r="1"/>
-            <circle cx="47.639" cy="14.618" r="1"/>
-            <circle cx="23.906" cy="50.122" r="1"/>
-            <circle cx="27.135" cy=".92" r="1"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".2">
-        <g transform="translate(77.257 77.257)">
-          <circle cx="19.861" cy=".781" r="1"/>
-          <circle cx="25.625" cy="44.705" r="1"/>
-          <circle cx="2.292" cy="14.271" r="1"/>
-          <circle cx="43.194" cy="31.215" r="1"/>
-          <circle cx="5.174" cy="36.215" r="1"/>
-          <circle cx="40.313" cy="9.271" r="1"/>
-          <circle cx="9.271" cy="5.174" r="1"/>
-          <circle cx="36.215" cy="40.313" r="1"/>
-          <circle cx=".781" cy="25.625" r="1"/>
-          <circle cx="44.705" cy="19.861" r="1"/>
-          <circle cx="14.271" cy="43.194" r="1"/>
-          <circle cx="31.215" cy="2.292" r="1"/>
-        </g>
-        <g transform="translate(77.257 77.257)">
-          <circle cx="14.271" cy="2.292" r="1"/>
-          <circle cx="31.215" cy="43.194" r="1"/>
-          <circle cx=".781" cy="19.861" r="1"/>
-          <circle cx="44.705" cy="25.625" r="1"/>
-          <circle cx="9.271" cy="40.313" r="1"/>
-          <circle cx="36.215" cy="5.174" r="1"/>
-          <circle cx="5.174" cy="9.271" r="1"/>
-          <circle cx="40.313" cy="36.215" r="1"/>
-          <circle cx="2.292" cy="31.215" r="1"/>
-          <circle cx="43.194" cy="14.271" r="1"/>
-          <circle cx="19.861" cy="44.705" r="1"/>
-          <circle cx="25.625" cy=".781" r="1"/>
-        </g>
-        <g>
-          <g transform="translate(77.778 77.778)">
-            <circle cx="16.493" cy=".833" r="1"/>
-            <circle cx="27.951" cy="43.611" r="1"/>
-            <circle cx=".833" cy="16.493" r="1"/>
-            <circle cx="43.611" cy="27.951" r="1"/>
-            <circle cx="6.563" cy="37.882" r="1"/>
-            <circle cx="37.882" cy="6.563" r="1"/>
-            <circle cx="6.563" cy="6.563" r="1"/>
-            <circle cx="37.882" cy="37.882" r="1"/>
-            <circle cx=".833" cy="27.951" r="1"/>
-            <circle cx="43.611" cy="16.493" r="1"/>
-            <circle cx="16.493" cy="43.611" r="1"/>
-            <circle cx="27.951" cy=".833" r="1"/>
-          </g>
-          <g transform="translate(77.083 77.083)">
-            <circle cx="11.84" cy="3.733" r="1"/>
-            <circle cx="33.993" cy="42.101" r="1"/>
-            <circle cx=".781" cy="22.917" r="1"/>
-            <circle cx="45.052" cy="22.917" r="1"/>
-            <circle cx="11.84" cy="42.101" r="1"/>
-            <circle cx="33.993" cy="3.733" r="1"/>
-            <circle cx="3.733" cy="11.84" r="1"/>
-            <circle cx="42.101" cy="33.993" r="1"/>
-            <circle cx="3.733" cy="33.993" r="1"/>
-            <circle cx="42.101" cy="11.84" r="1"/>
-            <circle cx="22.917" cy="45.052" r="1"/>
-            <circle cx="22.917" cy=".781" r="1"/>
-          </g>
-        </g>
-      </g>
-      <g opacity=".1">
-        <g transform="translate(79.688 79.688)">
-          <circle cx="16.424" cy=".729" r="1"/>
-          <circle cx="24.201" cy="39.896" r="1"/>
-          <circle cx="1.406" cy="13.889" r="1"/>
-          <circle cx="39.219" cy="26.736" r="1"/>
-          <circle cx="5.295" cy="33.472" r="1"/>
-          <circle cx="35.33" cy="7.153" r="1"/>
-          <circle cx="7.153" cy="5.295" r="1"/>
-          <circle cx="33.472" cy="35.33" r="1"/>
-          <circle cx=".729" cy="24.201" r="1"/>
-          <circle cx="39.896" cy="16.424" r="1"/>
-          <circle cx="13.889" cy="39.219" r="1"/>
-          <circle cx="26.736" cy="1.406" r="1"/>
-        </g>
-        <g transform="translate(79.34 79.34)">
-          <circle cx="11.823" cy="2.743" r="1"/>
-          <circle cx="29.497" cy="38.576" r="1"/>
-          <circle cx=".729" cy="19.358" r="1"/>
-          <circle cx="40.59" cy="21.962" r="1"/>
-          <circle cx="9.566" cy="37.257" r="1"/>
-          <circle cx="31.753" cy="4.063" r="1"/>
-          <circle cx="4.063" cy="9.566" r="1"/>
-          <circle cx="37.257" cy="31.753" r="1"/>
-          <circle cx="2.743" cy="29.497" r="1"/>
-          <circle cx="38.576" cy="11.823" r="1"/>
-          <circle cx="19.358" cy="40.59" r="1"/>
-          <circle cx="21.962" cy=".729" r="1"/>
-        </g>
-        <g>
-          <g transform="translate(79.688 79.688)">
-            <circle cx="13.889" cy="1.406" r="1"/>
-            <circle cx="26.736" cy="39.219" r="1"/>
-            <circle cx=".729" cy="16.424" r="1"/>
-            <circle cx="39.896" cy="24.201" r="1"/>
-            <circle cx="7.153" cy="35.33" r="1"/>
-            <circle cx="33.472" cy="5.295" r="1"/>
-            <circle cx="5.295" cy="7.153" r="1"/>
-            <circle cx="35.33" cy="33.472" r="1"/>
-            <circle cx="1.406" cy="26.736" r="1"/>
-            <circle cx="39.219" cy="13.889" r="1"/>
-            <circle cx="16.424" cy="39.896" r="1"/>
-            <circle cx="24.201" cy=".729" r="1"/>
-          </g>
-          <g transform="translate(79.34 79.34)">
-            <circle cx="9.566" cy="4.063" r="1"/>
-            <circle cx="31.753" cy="37.257" r="1"/>
-            <circle cx=".729" cy="21.962" r="1"/>
-            <circle cx="40.59" cy="19.358" r="1"/>
-            <circle cx="11.823" cy="38.576" r="1"/>
-            <circle cx="29.497" cy="2.743" r="1"/>
-            <circle cx="2.743" cy="11.823" r="1"/>
-            <circle cx="38.576" cy="29.497" r="1"/>
-            <circle cx="4.063" cy="31.753" r="1"/>
-            <circle cx="37.257" cy="9.566" r="1"/>
-            <circle cx="21.962" cy="40.59" r="1"/>
-            <circle cx="19.358" cy=".729" r="1"/>
-          </g>
-        </g>
-      </g>
-    </g>
-    <path d="M96.81 99.48l-1.308 10.478h8.496l-1.274-10.212c1.942-.993 3.27-3.016 3.27-5.35 0-3.316-2.683-6.004-5.994-6.004-3.31 0-5.995 2.688-5.995 6.004 0 2.142 1.12 4.022 2.805 5.085zM76 73h48v38.903c0 1.255-.59 2.438-1.592 3.194l-21.204 15.98c-.713.538-1.695.538-2.408 0l-21.204-15.98c-1.002-.756-1.592-1.94-1.592-3.194V73z" fill="url(#a)"/>
-  </g>
-</svg>
diff --git a/ui/public/loop.svg b/ui/public/loop.svg
deleted file mode 100644
index 290bbb70956..00000000000
--- a/ui/public/loop.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
-<path d="M273.4 300.5l-.3 58c48.9-8.2 86.3-51 86.3-102.5 0-15.9-3.6-31-10-44.5-2.8-5.8-6-11.3-9.8-16.5l47.1-43.5c1.1 1.3 2.1 2.7 3.1 4 20.9 28 33.2 62.8 33.2 100.5v3.7c-1.5 71.5-47.6 132-111.4 154.6-12.3 4.3-25.2 7.3-38.5 8.7l-.1 57-76.2-67-26.2-23 44.4-38.7 58.4-50.8zM89 252.3c1.6-72.1 48.3-133 112.9-155.2 11.7-4 24-6.8 36.8-8.1l.1-57 76.1 66.9 26.2 23.1-44.3 38.6-58.4 50.9.2-57.9c-48.8 8.3-86 51.1-86 102.4 0 16 3.6 31.1 10.1 44.7 2.7 5.8 6 11.2 9.7 16.3l-47 43.6c-1.3-1.6-2.6-3.3-3.8-5C101.1 327.7 89 293.3 89 256v-3.7z"/>
-</svg>
diff --git a/ui/public/okta.svg b/ui/public/okta.svg
deleted file mode 100644
index 6b6e8906e47..00000000000
--- a/ui/public/okta.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M12 2C6.49063 2 2 6.45844 2 12C2 17.5416 6.45875 22 12 22C17.5413 22 22 17.5413 22 12C22 6.45875 17.5094 2 12 2ZM12 17C9.22937 17 7 14.7706 7 12C7 9.22937 9.22937 7 12 7C14.7706 7 17 9.22937 17 12C17 14.7706 14.7706 17 12 17Z" fill="#007DC1"/>
-</svg>
diff --git a/ui/public/perf-replication.svg b/ui/public/perf-replication.svg
deleted file mode 100644
index e6730929eef..00000000000
--- a/ui/public/perf-replication.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-<svg width="20px" height="20px" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-  <g >
-    <path d="M19 17.628v-2.204l1.3 1.302c.4.4 1.1.3 1.4 0 .4-.4.4-1 0-1.402L19 12.62v-2.604c.3 0 .5-.1.7-.3.4-.4.4-1.002 0-1.403l-.7-.7V0H0v19.03h7.6l3.7 3.706c.4.4 1.1.3 1.4 0 .4-.4.4-1.002 0-1.402l-2.3-2.304h2.2l1.7 1.703c.4.4 1.1.3 1.4 0 .4-.4.4-1.002 0-1.403l-.3-.3h2.2l3.7 3.706c.4.4 1.1.3 1.4 0 .4-.4.4-1.002 0-1.402L19 17.628zm-10.7-.6H2V2.002h15v15.025H8.3z"/>
-    <path d="M17.7 21.304c-.4-.405-1-.405-1.4 0-.4.405-.4 1.113 0 1.417l1 1.018c.4.405 1.1.304 1.4 0 .4-.405.4-1.012 0-1.417l-1-1.012zm6.03-3.906c-.508-.512-1.12-.512-1.424-.102-.408.41-.408 1.126 0 1.434.407.41 1.12.307 1.425 0 .31-.308.41-1.025 0-1.332zm-3.418-5.635l.996.98c.398.39 1.095.292 1.393 0 .4-.393.4-.98 0-1.372l-1.09-1.07c-.4-.392-.995-.392-1.393 0-.3.49-.3 1.077.1 1.47z"/>
-  </g>
-</svg>
diff --git a/ui/public/pingid.svg b/ui/public/pingid.svg
deleted file mode 100644
index 99b33fefc3d..00000000000
--- a/ui/public/pingid.svg
+++ /dev/null
@@ -1,11 +0,0 @@
-<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g clip-path="url(#clip0_1174_82447)">
-<path d="M23.9812 0.00939178H0.0187988V24.0094H23.9812V0.00939178Z" fill="#E3002C"/>
-<path d="M13.9996 19.3444L14.4834 20.9977C14.5538 21.2372 14.6243 21.6317 14.6243 21.6317C14.6337 21.6317 14.7229 21.3076 14.7793 21.0963L15.2395 19.4149H15.6622L14.8544 22.0591C14.6947 22.571 14.5068 22.9092 14.0935 23.0172L13.9855 22.7448C14.2157 22.665 14.3378 22.5523 14.4364 22.2751C14.3988 22.0779 14.3753 21.9887 14.3753 21.9887C14.3472 21.8243 14.2204 21.3311 14.1405 21.0728L13.6333 19.4759L13.9996 19.3444ZM15.8616 21.2231C16.135 21.2231 16.3616 21.4509 16.3616 21.7231C16.3616 21.9952 16.135 22.2231 15.8616 22.2231C15.5883 22.2231 15.3616 22.0016 15.3616 21.7231C15.3616 21.4509 15.5883 21.2231 15.8616 21.2231ZM15.8616 21.318C15.6483 21.318 15.4816 21.4889 15.4816 21.7231C15.4816 21.9573 15.655 22.1282 15.8616 22.1282C16.0683 22.1282 16.2416 21.9573 16.2416 21.7231C16.2416 21.4889 16.0683 21.318 15.8616 21.318ZM12.91 18.4568V19.4243H13.5018L13.389 19.7249V19.7202H12.9006V21.364C12.9006 21.6458 12.971 21.7444 13.2012 21.7444C13.3045 21.7444 13.3656 21.7303 13.4313 21.6928L13.483 21.9511C13.3609 22.0168 13.2294 22.0544 13.065 22.0544C12.9382 22.0544 12.8442 22.0309 12.755 21.984C12.5906 21.8947 12.5296 21.735 12.5296 21.4767V19.7249H12.2196V19.4243H12.5296V18.4568H12.91ZM10.6039 18.4568V19.4196H11.6841L12.0082 19.3632V21.9699H11.6231V19.7202H10.5992V21.364C10.5992 21.6458 10.6697 21.7444 10.8998 21.7444C11.0031 21.7444 11.0642 21.7303 11.1299 21.6928L11.1816 21.9511C11.0595 22.0168 10.928 22.0544 10.7636 22.0544C10.6368 22.0544 10.5429 22.0309 10.4536 21.984C10.2892 21.8994 10.2282 21.735 10.2282 21.4767V19.7249H9.9182V19.4243H10.2235V18.4568H10.6039ZM6.77143 19.3538C7.02505 19.3538 7.25049 19.4524 7.41018 19.6309C7.61213 19.8564 7.66849 20.0959 7.67789 20.7065V20.7534H6.21252V20.8145C6.21252 21.054 6.2407 21.2419 6.32055 21.3734C6.45205 21.5941 6.6728 21.6881 6.90763 21.6881C7.13307 21.6881 7.32094 21.6129 7.48532 21.4485L7.62622 21.7069C7.41957 21.9135 7.13777 22.0262 6.83249 22.0262C6.17965 22.0262 5.78513 21.5143 5.78513 20.6689C5.78513 20.2368 5.86967 19.9644 6.06693 19.7061C6.25479 19.4665 6.48963 19.3538 6.77143 19.3538ZM5.51742 18.4568V21.1479C5.51742 21.5894 5.5362 21.8243 5.58787 21.9793H5.20744C5.20744 21.9793 5.16047 21.8478 5.15577 21.7162C4.98669 21.9276 4.80352 22.0121 4.53112 22.0121C3.92055 22.0121 3.5683 21.5331 3.5683 20.7205C3.5683 20.1757 3.73268 19.7765 4.05675 19.537C4.20705 19.4243 4.34325 19.3773 4.51233 19.3773C4.77534 19.3773 5.01018 19.4947 5.15108 19.7014C5.15108 19.7014 5.14638 19.49 5.14638 19.3069V18.4568H5.51742ZM8.23679 19.3632C8.23679 19.3632 8.32133 19.5511 8.32133 19.7624C8.56556 19.4947 8.81448 19.3679 9.06341 19.3679C9.31703 19.3679 9.54716 19.5135 9.6411 19.7436C9.67867 19.8329 9.69746 19.9362 9.69746 20.0395V21.9746H9.32172V20.2509C9.32172 19.9785 9.30294 19.9127 9.23718 19.8235C9.18552 19.7577 9.08689 19.7155 8.97886 19.7155C8.791 19.7155 8.49511 19.8798 8.32603 20.0724V21.9746H7.96438V20.0067C7.96438 19.645 7.87515 19.4712 7.87515 19.4712L8.23679 19.3632ZM3.38513 18.4614V21.9746H3.0047V18.4614H3.38513ZM4.56869 19.7014C4.38082 19.7014 4.22583 19.7953 4.1272 19.9691C4.01448 20.1616 3.97691 20.3495 3.97691 20.7065C3.97691 21.0023 3.99569 21.2231 4.07084 21.3734C4.17886 21.58 4.32916 21.6693 4.54521 21.6693C4.73777 21.6693 4.85049 21.6223 5.00078 21.5049C5.09941 21.4297 5.14168 21.3217 5.14168 21.3217V19.9691C5.02427 19.7906 4.84579 19.7014 4.56869 19.7014ZM6.74795 19.6685C6.40978 19.6685 6.22192 19.9362 6.20313 20.4622H7.28337C7.27867 20.1851 7.24579 20.016 7.17534 19.8939C7.0955 19.7577 6.92642 19.6685 6.74795 19.6685ZM21.5096 11.7452L22.1296 12.7409C21.8055 13.0556 21.4955 13.1871 21.0869 13.1871C20.9413 13.1871 20.7863 13.1636 20.6971 13.1542C20.9178 13.436 21.0305 13.7413 21.0305 14.1405C21.0305 15.1738 20.1429 15.9252 18.9358 15.9252C18.8701 15.9252 18.8278 15.9252 18.7151 15.9112C18.3393 16.099 18.128 16.2399 18.128 16.4043C18.128 16.4842 18.2172 16.5452 18.3722 16.5452L19.1706 16.5546C20.0348 16.5687 20.4904 16.7096 20.8896 17.0947C21.2231 17.4235 21.3781 17.8321 21.3781 18.3722C21.3781 18.8795 21.2325 19.2646 20.9225 19.6168C20.4247 20.1804 19.5699 20.3918 18.6822 20.3918C17.8744 20.3918 17.0431 20.2509 16.5311 19.7483C16.2211 19.4431 16.0661 19.0908 16.0661 18.6822C16.0661 18.3534 16.1413 18.189 16.1977 18.0716H17.5738C17.5174 18.2125 17.508 18.2924 17.508 18.4568C17.508 18.9358 17.8885 19.1941 18.5742 19.1941C18.9499 19.1941 19.2693 19.1519 19.5041 18.9969C19.7249 18.856 19.8705 18.6352 19.8705 18.3863C19.8705 17.8509 19.4149 17.6818 18.8278 17.6724L18.1937 17.6583C17.5315 17.6442 17.0994 17.5879 16.8317 17.4705C16.564 17.3671 16.3996 17.0994 16.3996 16.6861C16.3996 16.2963 16.5123 15.9346 17.4423 15.6763C16.6204 15.4509 16.2211 14.9014 16.2211 14.009C16.2211 12.7785 17.1652 11.98 18.6164 11.98C18.9358 11.98 19.227 12.027 19.6356 12.1303C19.9456 12.2149 20.1476 12.2618 20.3354 12.2618C20.744 12.2618 21.1667 12.074 21.5096 11.7452ZM12.2947 11.9331C12.4262 12.182 12.5061 12.4356 12.5061 12.6845C12.7268 12.5202 12.9147 12.3793 13.1589 12.2384C13.4595 12.074 13.8446 11.98 14.1781 11.98C14.8121 11.98 15.3663 12.3323 15.5401 12.8489C15.62 13.0697 15.6528 13.328 15.6528 13.7037V18.0951H14.1922V14.1875C14.1922 13.5065 14.0795 13.3092 13.6943 13.3092C13.3937 13.3092 13.0086 13.5205 12.6658 13.8493V18.0998H11.1769V13.746C11.1769 13.2294 11.1112 12.7362 10.9796 12.337L12.2947 11.9331ZM5.02896 9.93699C6.33933 9.93699 6.73855 10.0779 7.17065 10.3362C7.89393 10.7589 8.27906 11.5104 8.27906 12.4497C8.27906 13.5299 7.79061 14.3988 6.9499 14.8215C6.59765 14.9953 6.26419 15.0892 5.40939 15.0892H4.5546V18.0951H3V9.93699H5.02896ZM10.2892 11.9425V18.0951H8.80509V12.1914L10.2892 11.9425ZM18.607 13.1307C18.0434 13.1307 17.7194 13.4595 17.7194 14.0231C17.7194 14.6337 18.0716 14.8779 18.593 14.8779C19.1847 14.8779 19.5041 14.5726 19.5041 14.0231C19.5041 13.4595 19.1753 13.1307 18.607 13.1307ZM5.5456 11.2614H4.5593V13.7507H5.36712C5.99648 13.7507 6.18434 13.6661 6.39569 13.328C6.5319 13.1072 6.58356 12.8724 6.58826 12.4826C6.58826 11.7217 6.19843 11.2614 5.5456 11.2614ZM9.56595 9.45793C10.0685 9.45323 10.4677 9.89002 10.4677 10.4301C10.4677 10.9703 10.0591 11.4023 9.54716 11.4023C9.04931 11.4023 8.63601 10.9656 8.63601 10.4301C8.63601 9.89472 9.05871 9.45793 9.56595 9.45793Z" fill="white"/>
-</g>
-<defs>
-<clipPath id="clip0_1174_82447">
-<rect width="24" height="24" fill="white"/>
-</clipPath>
-</defs>
-</svg>
diff --git a/ui/public/replication.svg b/ui/public/replication.svg
deleted file mode 100644
index 3d9fc032c7a..00000000000
--- a/ui/public/replication.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 512 512">
-<path d="M379.076923,137.846154 L448,137.846154 L448,448 L137.846154,448 L137.846154,379.076923 L68.9230769,379.076923 L68.9230769,310.153846 L0,310.153846 L0,0 L310.153846,0 L310.153846,68.9230769 L379.076923,68.9230769 L379.076923,137.846154 Z M34.4615385,275.692308 L68.9230769,275.692308 L103.384615,275.692308 L137.846154,275.692308 L172.307692,275.692308 L275.692308,275.692308 L275.692308,172.307692 L275.692308,137.846154 L275.692308,103.384615 L275.692308,68.9230769 L275.692308,34.4615385 L34.4615385,34.4615385 L34.4615385,275.692308 Z M103.384615,344.615385 L137.846154,344.615385 L172.307692,344.615385 L344.615385,344.615385 L344.615385,172.307692 L344.615385,137.846154 L344.615385,103.384615 L310.153846,103.384615 L310.153846,137.846154 L310.153846,172.307692 L310.153846,310.153846 L172.307692,310.153846 L137.846154,310.153846 L103.384615,310.153846 L103.384615,344.615385 Z M413.538462,413.538462 L413.538462,172.307692 L379.076923,172.307692 L379.076923,379.076923 L172.307692,379.076923 L172.307692,413.538462 L413.538462,413.538462 Z"></path>
-</svg>
diff --git a/ui/public/reply.svg b/ui/public/reply.svg
deleted file mode 100644
index dcdf541e192..00000000000
--- a/ui/public/reply.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg aria-hidden="true" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512">
-<path d="M448 400s-36.8-208-224-208v-80L64 256l160 134.4v-92.3c101.6 0 171 8.9 224 101.9z"/>
-</svg>
diff --git a/ui/public/stopwatch.svg b/ui/public/stopwatch.svg
deleted file mode 100644
index 10d4b40b0f8..00000000000
--- a/ui/public/stopwatch.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg">
-  <path d="M2.906 3.199A6.98 6.98 0 0 1 8 1a6.98 6.98 0 0 1 5.094 2.199l.406-.406.707.707-.477.478a7 7 0 1 1-11.46 0L1.793 3.5l.707-.707.406.406zM8.5 8.106l3.83 2.211-.5.866L7.53 8.7H7.5v-6h1v5.406zM8 14A6 6 0 1 0 8 2a6 6 0 0 0 0 12zM7.5 1V.5H7V0h2v.5h-.5V1h-1z" />
-</svg>
diff --git a/ui/public/tour.svg b/ui/public/tour.svg
deleted file mode 100644
index e864d782d1d..00000000000
--- a/ui/public/tour.svg
+++ /dev/null
@@ -1,4 +0,0 @@
-<svg viewBox="0 0 22 23" xmlns="http://www.w3.org/2000/svg">
-  <path d="M19.794 21.12v-7.76a.75.75 0 1 1 1.5 0v8.51a.75.75 0 0 1-.75.75h-19.2a.75.75 0 0 1-.75-.75V2.67a.75.75 0 0 1 .75-.75h8.942a.75.75 0 1 1 0 1.5H2.094v17.7h17.7zM6.444 9.5a.75.75 0 0 1 0-1.5h3.75a.75.75 0 1 1 0 1.5h-3.75zm0 3.479a.75.75 0 1 1 0-1.5h9a.75.75 0 1 1 0 1.5h-9zm-.004 3.478a.75.75 0 1 1 0-1.5h9a.75.75 0 1 1 0 1.5h-9z" />
-  <path d="M15.157 4.157a5.577 5.577 0 0 1-1.003.793 5.547 5.547 0 0 1 1.796 1.796 5.547 5.547 0 0 1 1.796-1.796 5.547 5.547 0 0 1-1.796-1.796 5.521 5.521 0 0 1-.793 1.003zM15.95 0c.175 1.475.675 2.624 1.5 3.45.825.824 1.975 1.324 3.45 1.5-1.475.174-2.625.675-3.45 1.5-.825.824-1.325 1.975-1.5 3.45-.175-1.476-.675-2.626-1.5-3.45-.825-.825-1.975-1.325-3.45-1.5 1.475-.175 2.625-.676 3.45-1.5.825-.826 1.325-1.976 1.5-3.45zM19.975 6c.07.588.27 1.047.599 1.376.329.329.787.528 1.376.598-.588.071-1.047.27-1.377.6-.329.328-.527.787-.598 1.375-.07-.587-.269-1.046-.598-1.376-.33-.33-.789-.528-1.377-.599.588-.069 1.047-.268 1.376-.598.33-.33.529-.788.599-1.377z" />
-</svg>
diff --git a/ui/public/vault-logo.svg b/ui/public/vault-logo.svg
deleted file mode 100644
index 6a7ec531e31..00000000000
--- a/ui/public/vault-logo.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg width="22" height="22" viewBox="0 0 34 34" xmlns="http://www.w3.org/2000/svg" aria-label="Vault logo" class="vault-logo">
-  <path d="M0 0l16.9 34L34 0H0zm15 15h-2v-2h2v2zm0-3h-2v-2h2v2zm0-3h-2V7h2v2zm3 9h-2v-2h2v2zm0-3h-2v-2h2v2zm0-3h-2v-2h2v2zm0-3h-2V7h2v2zm3 6h-2v-2h2v2zm0-3h-2v-2h2v2zm-2-3V7h2v2h-2z" fill-rule="nonzero"/>
-</svg>
diff --git a/ui/scripts/codemods/dropdown-transform.js b/ui/scripts/codemods/dropdown-transform.js
index 14c88d092e3..4286967c58b 100644
--- a/ui/scripts/codemods/dropdown-transform.js
+++ b/ui/scripts/codemods/dropdown-transform.js
@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 /* eslint-env node */
 
 /**
- * Codemod to transform BasicDropdown and Tooltip trigger and content components
+ * Codemod to transform BasicDropdown and content components
  * As of version 2 of ember-basic-dropdown the yielded component names are now capitalized
  * In addition, splattributes are used and class must be passed as an attribute rather than argument
  */
@@ -15,8 +15,8 @@
 module.exports = () => {
   return {
     ElementNode(node) {
-      // ensure we have the right parent node by first looking for BasicDropdown or ToolTip nodes
-      if (['BasicDropdown', 'ToolTip'].includes(node.tag)) {
+      // ensure we have the right parent node by first looking for BasicDropdown nodes
+      if (['BasicDropdown'].includes(node.tag)) {
         node.children.forEach((child) => {
           // capitalize trigger and content and transform attributes
           if (child.type === 'ElementNode' && child.tag.match(/\.(content|trigger)/gi)) {
diff --git a/ui/scripts/codemods/hds/button.js b/ui/scripts/codemods/hds/button.js
index 2ddcc08418e..8168514dd40 100755
--- a/ui/scripts/codemods/hds/button.js
+++ b/ui/scripts/codemods/hds/button.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/scripts/codemods/icon-transform.js b/ui/scripts/codemods/icon-transform.js
index 19a359dcbfa..f9d3ccf7fbc 100644
--- a/ui/scripts/codemods/icon-transform.js
+++ b/ui/scripts/codemods/icon-transform.js
@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/scripts/codemods/inject-service.js b/ui/scripts/codemods/inject-service.js
index 95fc4bf0217..8d068e010c3 100644
--- a/ui/scripts/codemods/inject-service.js
+++ b/ui/scripts/codemods/inject-service.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/scripts/codemods/jscodeshift-babylon-parser.js b/ui/scripts/codemods/jscodeshift-babylon-parser.js
index 5c78ac9ef61..0ce1595ad5c 100644
--- a/ui/scripts/codemods/jscodeshift-babylon-parser.js
+++ b/ui/scripts/codemods/jscodeshift-babylon-parser.js
@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/scripts/codemods/linkto-with-on-modifier.js b/ui/scripts/codemods/linkto-with-on-modifier.js
index 08f9aa781e2..aecae18869b 100644
--- a/ui/scripts/codemods/linkto-with-on-modifier.js
+++ b/ui/scripts/codemods/linkto-with-on-modifier.js
@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/scripts/codemods/no-quoteless-attributes.js b/ui/scripts/codemods/no-quoteless-attributes.js
index c8759fb9bf4..7e0ae541a2c 100644
--- a/ui/scripts/codemods/no-quoteless-attributes.js
+++ b/ui/scripts/codemods/no-quoteless-attributes.js
@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/scripts/codemods/transform-deprecated-args.js b/ui/scripts/codemods/transform-deprecated-args.js
index cf9d702914f..9a37add8a4e 100644
--- a/ui/scripts/codemods/transform-deprecated-args.js
+++ b/ui/scripts/codemods/transform-deprecated-args.js
@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/scripts/docfy-md.js b/ui/scripts/docfy-md.js
new file mode 100644
index 00000000000..d80a6cc7ca9
--- /dev/null
+++ b/ui/scripts/docfy-md.js
@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+/* eslint-disable */
+
+/*
+run from the ui directory:
+yarn docfy-md some-component
+
+or if the docs are for a component in an in-repo-addon or an engine:
+yarn docfy-md some-component name-of-engine
+
+see the readme ui/docs/how-to-docfy.md for more info
+*/
+
+const fs = require('fs');
+const jsdoc2md = require('jsdoc-to-markdown');
+
+// the fullFilepath arg will override the assumed inputFile which is built using the addonOrEngine arg
+const [nameOrFile, addonOrEngine, fullFilepath] = process.argv.slice(2);
+
+const isFile = nameOrFile.includes('.');
+const name = isFile ? nameOrFile?.split('.')[0] : nameOrFile; // can pass component-name or component-name.js
+const path = isFile ? nameOrFile : `${nameOrFile}.js`; // default to js
+
+const inputFile = addonOrEngine ? `lib/${addonOrEngine}/addon/components/${path}` : `app/components/${path}`;
+const outputFile = `docs/components/${name}.md`;
+
+const outputFormat = `
+{{#module}}
+# {{name}}
+{{>body}}
+{{/module}}
+`;
+
+const options = {
+  files: fullFilepath || inputFile,
+  'example-lang': 'hbs preview-template',
+  configure: './jsdoc2md.json',
+  template: outputFormat,
+};
+
+try {
+  const md = jsdoc2md.renderSync(options);
+  // for some reason components without a jsdoc @module doesn't throw, so throw manually
+  if (md.includes('ERROR')) throw `${md} (there is probably no jsdoc for this component)`;
+  fs.writeFileSync(outputFile, md);
+  console.log(`✅ ${name}`);
+} catch (error) {
+  console.log(`❌ ${name}`);
+  console.log(error);
+}
diff --git a/ui/scripts/enos-test-ember.js b/ui/scripts/enos-test-ember.js
index 6ba89336b39..0fd52507fff 100755
--- a/ui/scripts/enos-test-ember.js
+++ b/ui/scripts/enos-test-ember.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -48,7 +48,7 @@ const testHelper = require('./test-helper');
   console.log('VAULT_ADDR=' + vaultAddr);
 
   try {
-    const testArgs = ['test', '-c', 'testem.enos.js'];
+    const testArgs = ['test', '-c', 'scripts/testem.enos.js'];
 
     if (process.env.TEST_FILTER && process.env.TEST_FILTER.length > 0) {
       testArgs.push('-f=' + process.env.TEST_FILTER);
diff --git a/ui/scripts/gen-story-md.js b/ui/scripts/gen-story-md.js
deleted file mode 100755
index 2dfcdd3f90a..00000000000
--- a/ui/scripts/gen-story-md.js
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/env node
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-/* eslint-disable */
-// run this script via yarn in the ui directory:
-// yarn gen-story-md some-component
-//
-// or if the story is for a component in an in-repo-addon or an engine:
-// yarn gen-story-md some-component name-of-engine
-
-const fs = require('fs');
-const jsdoc2md = require('jsdoc-to-markdown');
-var args = process.argv.slice(2);
-const name = args[0];
-const addonOrEngine = args[1];
-const inputFile = addonOrEngine
-  ? `lib/${addonOrEngine}/addon/components/${name}.js`
-  : `app/components/${name}.js`;
-const outputFile = addonOrEngine ? `lib/${addonOrEngine}/stories/${name}.md` : `stories/${name}.md`;
-
-const component = name
-  .split('-')
-  .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
-  .join('');
-const options = {
-  files: inputFile,
-  template: fs.readFileSync('./lib/story-md.hbs', 'utf8'),
-  'example-lang': 'js',
-};
-let md = jsdoc2md.renderSync(options);
-
-const pageBreakIndex = md.lastIndexOf('---'); //this is our last page break
-
-const seeLinks = `**See**
-- [Uses of ${component}](https://github.com/hashicorp/vault/search?l=Handlebars&q=${component}+OR+${name})
-- [${component} Source Code](https://github.com/hashicorp/vault/blob/main/ui/${inputFile})
-`;
-const generatedWarning = `<!--THIS FILE IS AUTO GENERATED. This file is generated from JSDoc comments in ${inputFile}. To make changes, first edit that file and run "yarn gen-story-md ${name}" to re-generate the content.-->
-`;
-md = generatedWarning + md.slice(0, pageBreakIndex) + seeLinks + md.slice(pageBreakIndex);
-
-fs.writeFileSync(outputFile, md);
diff --git a/ui/scripts/generate-docs.sh b/ui/scripts/generate-docs.sh
new file mode 100644
index 00000000000..c31a70e525e
--- /dev/null
+++ b/ui/scripts/generate-docs.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+echo "Create components/ directory"
+mkdir docs/components/ 
+
+echo "Generating markdown files for components in core addon..." 
+
+# iterate over every .ts and .js file in core/addon/components (including nested files)
+# skip .hbs files and shamir/ directory 
+find "./lib/core/addon/components" -type f ! -name "*.hbs" -not -path "*/shamir*"  -print0 | while IFS= read -r -d '' file; do
+  component=`eval "echo $file | cut -d/ -f6"`; 
+
+ # skip replication components
+  if [[ "$component" == replication* ]]; then
+    echo "🔃 skipping $component" 
+    continue
+  fi
+
+  yarn docfy-md $component core $file
+done
\ No newline at end of file
diff --git a/ui/scripts/list-templates.js b/ui/scripts/list-templates.js
deleted file mode 100755
index c8f302c4bfb..00000000000
--- a/ui/scripts/list-templates.js
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/usr/bin/env node
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-/* eslint-disable */
-
-// We need an array in this format for all of the files
-//https://github.com/ember-template-lint/ember-cli-template-lint/blob/1bc03444ecf367473108cb28208cb3123199f950/.template-lintrc.js#L9
-
-var walkSync = require('walk-sync');
-var templates = walkSync('app', { globs: ['**/*.hbs'] });
-
-templates = templates.map((path) => {
-  // we want the relative path w/o the extension:
-  // 'app/templates/path/to/file/filename'
-  return `app/${path.replace(/\.hbs$/, '')}`;
-});
-
-// stringify because if we don't console won't output the full list lol
-console.log(JSON.stringify(templates, null, 2));
diff --git a/ui/scripts/start-vault.js b/ui/scripts/start-vault.js
index 8ea4398da80..0687b9934cf 100755
--- a/ui/scripts/start-vault.js
+++ b/ui/scripts/start-vault.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -69,9 +69,15 @@ async function processLines(input, eachLine = () => {}) {
       }
     });
     try {
-      // only the test:filter command specifies --server by default
-      const verb = process.argv[2] === '--server' ? 'test' : 'exam';
-      await testHelper.run('ember', [verb, ...process.argv.slice(2)]);
+      // ignore first 2 args (node and path) and extract flags to pass to test/exam command
+      const args = process.argv.slice(2);
+      const withServer = args.includes('--server') || args.includes('-s');
+      // current issue with headless Chrome where an event listener in Hds::Modal is not triggered resulting in a pending test waiter and timeout
+      // the workaround for now is to run the tests in headless firefox for local runs
+      if (!withServer && !process.env.CI) {
+        args.push('--launch=Firefox');
+      }
+      await testHelper.run('ember', ['exam', ...args]);
     } catch (error) {
       console.log(error);
       process.exit(1);
diff --git a/ui/scripts/test-helper.js b/ui/scripts/test-helper.js
index 1af4a2493ff..99a3316e355 100644
--- a/ui/scripts/test-helper.js
+++ b/ui/scripts/test-helper.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/testem.enos.js b/ui/scripts/testem.enos.js
similarity index 96%
rename from ui/testem.enos.js
rename to ui/scripts/testem.enos.js
index 0c857804522..84d8468d364 100644
--- a/ui/testem.enos.js
+++ b/ui/scripts/testem.enos.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/scripts/update-vault-reporting-addon.sh b/ui/scripts/update-vault-reporting-addon.sh
new file mode 100755
index 00000000000..f22bfadf598
--- /dev/null
+++ b/ui/scripts/update-vault-reporting-addon.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Copyright IBM Corp. 2016, 2025
+# SPDX-License-Identifier: BUSL-1.1
+ARTIFACTORY_NPM_URL="https://artifactory.hashicorp.engineering/artifactory/npm/"
+
+# Show error if doormat CLI or jq doesn't exist
+
+if ! command -v doormat &> /dev/null; then
+  echo "Error: doormat CLI is not installed."
+  exit 1
+fi
+
+if ! command -v jq &> /dev/null; then
+  echo "Error: jq is not installed."
+  exit 1
+fi
+
+doormat login
+# Get artifactory token from doormat
+AF_TOKEN=$(doormat artifactory create-token | jq -r .access_token)
+
+# Get package info from artifactory API
+PACKAGE_INFO=$(curl -s -L -H "Authorization: Bearer $AF_TOKEN" "https://artifactory.hashicorp.engineering/artifactory/api/npm/npm/@hashicorp-internal/vault-reporting")
+
+# Extract the latest version and tarball URL
+LATEST_VERSION=$(echo "$PACKAGE_INFO" | jq -r '."dist-tags".latest')
+TARBALL_URL=$(echo "$PACKAGE_INFO" | jq -r --arg version "$LATEST_VERSION" '.versions[$version].dist.tarball')
+
+echo "LATEST_VERSION: $LATEST_VERSION"
+echo "TARBALL_URL: $TARBALL_URL"
+
+# Download the tarball
+echo "Downloading vault-reporting v$LATEST_VERSION..."
+curl -L -H "Authorization: Bearer $AF_TOKEN" -o "vault-reporting/$LATEST_VERSION.tgz" "$TARBALL_URL"
+
+if [ $? -eq 0 ]; then
+    echo "✅ Successfully downloaded vault-reporting-$LATEST_VERSION.tgz"
+    echo "📦 File size: $(ls -lh vault-reporting-$LATEST_VERSION.tgz | awk '{print $5}')"
+else
+    echo "❌ Failed to download tarball"
+    exit 1
+fi
+
+# Delete all but the latest version
+find vault-reporting -name "*.tgz" ! -name "$LATEST_VERSION.tgz" -delete
+
+# Update package.json to point to file:vault-reporting/$LATEST_VERSION.tgz
+FILENAME="$LATEST_VERSION.tgz"
+jq --arg version "$LATEST_VERSION" --arg filename "$FILENAME" '.dependencies["@hashicorp-internal/vault-reporting"] = "file:vault-reporting/" + $filename' package.json > tmp.json && mv tmp.json package.json
+# Install dependencies
+yarn install
\ No newline at end of file
diff --git a/ui/testem.js b/ui/testem.js
index 66c8bdbbb0b..a10bdb84863 100644
--- a/ui/testem.js
+++ b/ui/testem.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -25,6 +25,9 @@ module.exports = {
         '--window-size=1440,900',
       ].filter(Boolean),
     },
+    Firefox: {
+      ci: ['--headless'],
+    },
   },
   proxies: {
     '/v1': {
diff --git a/ui/tests/.eslintrc.js b/ui/tests/.eslintrc.js
index 3eae4102487..d02d452ca97 100644
--- a/ui/tests/.eslintrc.js
+++ b/ui/tests/.eslintrc.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/acceptance/access/identity/_shared-alias-tests.js b/ui/tests/acceptance/access/identity/_shared-alias-tests.js
deleted file mode 100644
index 854ce27fcdd..00000000000
--- a/ui/tests/acceptance/access/identity/_shared-alias-tests.js
+++ /dev/null
@@ -1,106 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { currentRouteName, find, settled } from '@ember/test-helpers';
-import page from 'vault/tests/pages/access/identity/aliases/add';
-import aliasIndexPage from 'vault/tests/pages/access/identity/aliases/index';
-import aliasShowPage from 'vault/tests/pages/access/identity/aliases/show';
-import createItemPage from 'vault/tests/pages/access/identity/create';
-
-export const testAliasCRUD = async function (name, itemType, assert) {
-  if (itemType === 'groups') {
-    await createItemPage.createItem(itemType, 'external');
-    await settled();
-  } else {
-    await createItemPage.createItem(itemType);
-    await settled();
-  }
-
-  const itemID = find('[data-test-row-value="ID"]').textContent.trim();
-  await page.visit({ item_type: itemType, id: itemID });
-  await settled();
-  await page.editForm.name(name).submit();
-  await settled();
-  assert.ok(
-    aliasShowPage.flashMessage.latestMessage.startsWith('Successfully saved'),
-    `${itemType}: shows a flash message`
-  );
-
-  const aliasID = find('[data-test-row-value="ID"]').textContent.trim();
-  assert.strictEqual(
-    currentRouteName(),
-    'vault.cluster.access.identity.aliases.show',
-    'navigates to the correct route'
-  );
-  assert.ok(aliasShowPage.nameContains(name), `${itemType}: renders the name on the show page`);
-
-  await aliasIndexPage.visit({ item_type: itemType });
-  await settled();
-  assert.strictEqual(
-    aliasIndexPage.items.filterBy('name', name).length,
-    1,
-    `${itemType}: lists the entity in the entity list`
-  );
-
-  const item = aliasIndexPage.items.filterBy('name', name)[0];
-  await item.menu();
-  await settled();
-  await aliasIndexPage.delete();
-  await settled();
-  await aliasIndexPage.confirmDelete();
-  await settled();
-  assert.ok(
-    aliasIndexPage.flashMessage.latestMessage.startsWith('Successfully deleted'),
-    `${itemType}: shows flash message`
-  );
-
-  assert.strictEqual(
-    aliasIndexPage.items.filterBy('id', aliasID).length,
-    0,
-    `${itemType}: the row is deleted`
-  );
-};
-
-export const testAliasDeleteFromForm = async function (name, itemType, assert) {
-  if (itemType === 'groups') {
-    await createItemPage.createItem(itemType, 'external');
-    await settled();
-  } else {
-    await createItemPage.createItem(itemType);
-    await settled();
-  }
-
-  const itemID = find('[data-test-row-value="ID"]').textContent.trim();
-  await page.visit({ item_type: itemType, id: itemID });
-  await settled();
-  await page.editForm.name(name).submit();
-  await settled();
-  const aliasID = find('[data-test-row-value="ID"]').textContent.trim();
-  await aliasShowPage.edit();
-  await settled();
-  assert.strictEqual(
-    currentRouteName(),
-    'vault.cluster.access.identity.aliases.edit',
-    `${itemType}: navigates to edit on create`
-  );
-  await page.editForm.delete();
-  await page.editForm.waitForConfirm();
-  await page.editForm.confirmDelete();
-  await settled();
-  assert.ok(
-    aliasIndexPage.flashMessage.latestMessage.startsWith('Successfully deleted'),
-    `${itemType}: shows flash message`
-  );
-  assert.strictEqual(
-    currentRouteName(),
-    'vault.cluster.access.identity.aliases.index',
-    `${itemType}: navigates to list page on delete`
-  );
-  assert.strictEqual(
-    aliasIndexPage.items.filterBy('id', aliasID).length,
-    0,
-    `${itemType}: the row does not show in the list`
-  );
-};
diff --git a/ui/tests/acceptance/access/identity/_shared-tests.js b/ui/tests/acceptance/access/identity/_shared-tests.js
deleted file mode 100644
index 2558551599a..00000000000
--- a/ui/tests/acceptance/access/identity/_shared-tests.js
+++ /dev/null
@@ -1,90 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { settled, currentRouteName, click, waitUntil, find } from '@ember/test-helpers';
-import { selectChoose, clickTrigger } from 'ember-power-select/test-support/helpers';
-import page from 'vault/tests/pages/access/identity/create';
-import showPage from 'vault/tests/pages/access/identity/show';
-import indexPage from 'vault/tests/pages/access/identity/index';
-const SELECTORS = {
-  identityRow: (name) => `[data-test-identity-row="${name}"]`,
-  popupMenu: '[data-test-popup-menu-trigger]',
-  menuDelete: '[data-test-popup-menu="delete"]',
-};
-export const testCRUD = async (name, itemType, assert) => {
-  await page.visit({ item_type: itemType });
-  await settled();
-  await page.editForm.name(name).submit();
-  await settled();
-  assert.ok(
-    showPage.flashMessage.latestMessage.startsWith('Successfully saved'),
-    `${itemType}: shows a flash message`
-  );
-  assert.strictEqual(
-    currentRouteName(),
-    'vault.cluster.access.identity.show',
-    `${itemType}: navigates to show on create`
-  );
-  assert.ok(showPage.nameContains(name), `${itemType}: renders the name on the show page`);
-  await indexPage.visit({ item_type: itemType });
-  await settled();
-  assert.strictEqual(
-    indexPage.items.filterBy('name', name).length,
-    1,
-    `${itemType}: lists the entity in the entity list`
-  );
-
-  await click(`${SELECTORS.identityRow(name)} ${SELECTORS.popupMenu}`);
-  await waitUntil(() => find(SELECTORS.menuDelete));
-  await click(SELECTORS.menuDelete);
-  await indexPage.confirmDelete();
-  await settled();
-  assert.ok(
-    indexPage.flashMessage.latestMessage.startsWith('Successfully deleted'),
-    `${itemType}: shows flash message`
-  );
-  assert.strictEqual(indexPage.items.filterBy('name', name).length, 0, `${itemType}: the row is deleted`);
-};
-
-export const testDeleteFromForm = async (name, itemType, assert) => {
-  await page.visit({ item_type: itemType });
-  await settled();
-  await page.editForm.name(name);
-  await page.editForm.metadataKey('hello');
-  await page.editForm.metadataValue('goodbye');
-  await clickTrigger('#policies');
-  // first option should be "default"
-  await selectChoose('#policies', '.ember-power-select-option', 0);
-  await page.editForm.submit();
-  await click('[data-test-tab-subnav="policies"]');
-  assert.dom('.list-item-row').exists({ count: 1 }, 'One item is under policies');
-  await click('[data-test-tab-subnav="metadata"]');
-  assert.dom('.info-table-row').hasText('hello goodbye', 'Metadata shows on tab');
-  await showPage.edit();
-  assert.strictEqual(
-    currentRouteName(),
-    'vault.cluster.access.identity.edit',
-    `${itemType}: navigates to edit on create`
-  );
-  await settled();
-  await page.editForm.delete();
-  await settled();
-  await page.editForm.confirmDelete();
-  await settled();
-  assert.ok(
-    indexPage.flashMessage.latestMessage.startsWith('Successfully deleted'),
-    `${itemType}: shows flash message`
-  );
-  assert.strictEqual(
-    currentRouteName(),
-    'vault.cluster.access.identity.index',
-    `${itemType}: navigates to list page on delete`
-  );
-  assert.strictEqual(
-    indexPage.items.filterBy('name', name).length,
-    0,
-    `${itemType}: the row does not show in the list`
-  );
-};
diff --git a/ui/tests/acceptance/access/identity/entities/aliases/create-test.js b/ui/tests/acceptance/access/identity/entities/aliases/create-test.js
deleted file mode 100644
index 05edcd69100..00000000000
--- a/ui/tests/acceptance/access/identity/entities/aliases/create-test.js
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { settled } from '@ember/test-helpers';
-import { setupApplicationTest } from 'ember-qunit';
-import { testAliasCRUD, testAliasDeleteFromForm } from '../../_shared-alias-tests';
-import authPage from 'vault/tests/pages/auth';
-
-module('Acceptance | /access/identity/entities/aliases/add', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(async function () {
-    await authPage.login();
-    return;
-  });
-
-  test('it allows create, list, delete of an entity alias', async function (assert) {
-    assert.expect(6);
-    const name = `alias-${Date.now()}`;
-    await testAliasCRUD(name, 'entities', assert);
-    await settled();
-  });
-
-  test('it allows delete from the edit form', async function (assert) {
-    assert.expect(4);
-    const name = `alias-${Date.now()}`;
-    await testAliasDeleteFromForm(name, 'entities', assert);
-    await settled();
-  });
-});
diff --git a/ui/tests/acceptance/access/identity/entities/create-test.js b/ui/tests/acceptance/access/identity/entities/create-test.js
deleted file mode 100644
index 9af2cbb95d3..00000000000
--- a/ui/tests/acceptance/access/identity/entities/create-test.js
+++ /dev/null
@@ -1,47 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { currentRouteName } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import page from 'vault/tests/pages/access/identity/create';
-import { testCRUD, testDeleteFromForm } from '../_shared-tests';
-import authPage from 'vault/tests/pages/auth';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
-
-module('Acceptance | /access/identity/entities/create', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    // Popup menu causes flakiness
-    setRunOptions({
-      rules: {
-        'color-contrast': { enabled: false },
-      },
-    });
-    return authPage.login();
-  });
-
-  test('it visits the correct page', async function (assert) {
-    await page.visit({ item_type: 'entities' });
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.identity.create',
-      'navigates to the correct route'
-    );
-  });
-
-  test('it allows create, list, delete of an entity', async function (assert) {
-    assert.expect(6);
-    const name = `entity-${Date.now()}`;
-    await testCRUD(name, 'entities', assert);
-  });
-
-  test('it can be deleted from the edit form', async function (assert) {
-    assert.expect(6);
-    const name = `entity-${Date.now()}`;
-    await testDeleteFromForm(name, 'entities', assert);
-  });
-});
diff --git a/ui/tests/acceptance/access/identity/entities/index-test.js b/ui/tests/acceptance/access/identity/entities/index-test.js
index 8bb80fb28fa..c0bcbbd0a53 100644
--- a/ui/tests/acceptance/access/identity/entities/index-test.js
+++ b/ui/tests/acceptance/access/identity/entities/index-test.js
@@ -1,29 +1,28 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { fillIn, click, currentRouteName, currentURL, visit } from '@ember/test-helpers';
+import { click, currentRouteName, currentURL, visit } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import page from 'vault/tests/pages/access/identity/index';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { runCmd } from 'vault/tests/helpers/commands';
-import { SELECTORS as GENERAL } from 'vault/tests/helpers/general-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import { v4 as uuidv4 } from 'uuid';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 const SELECTORS = {
   listItem: (name) => `[data-test-identity-row="${name}"]`,
-  menu: `[data-test-popup-menu-trigger]`,
-  menuItem: (element) => `[data-test-popup-menu="${element}"]`,
-  submit: '[data-test-identity-submit]',
-  confirm: '[data-test-confirm-button]',
 };
+
 module('Acceptance | /access/identity/entities', function (hooks) {
   setupApplicationTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    return authPage.login();
+    return login();
   });
 
   test('it renders the entities page', async function (assert) {
@@ -50,12 +49,12 @@ module('Acceptance | /access/identity/entities', function (hooks) {
     await visit('/vault/access/identity/entities');
     assert.strictEqual(currentURL(), '/vault/access/identity/entities', 'navigates to entities tab');
 
-    await click(`${SELECTORS.listItem(name)} ${SELECTORS.menu}`);
+    await click(`${SELECTORS.listItem(name)} ${GENERAL.menuTrigger}`);
     assert
       .dom('.hds-dropdown ul')
       .hasText('Details Create alias Edit Disable Delete', 'all actions render for entities');
-    await click(`${SELECTORS.listItem(name)} ${SELECTORS.menuItem('delete')}`);
-    await click(SELECTORS.confirm);
+    await click(`${SELECTORS.listItem(name)} ${GENERAL.menuItem('delete')}`);
+    await click(GENERAL.confirmButton);
   });
 
   test('it renders popup menu for external groups', async function (assert) {
@@ -64,41 +63,52 @@ module('Acceptance | /access/identity/entities', function (hooks) {
     await visit('/vault/access/identity/groups');
     assert.strictEqual(currentURL(), '/vault/access/identity/groups', 'navigates to the groups tab');
 
-    await click(`${SELECTORS.listItem(name)} ${SELECTORS.menu}`);
+    await click(`${SELECTORS.listItem(name)} ${GENERAL.menuTrigger}`);
     assert
       .dom('.hds-dropdown ul')
       .hasText('Details Create alias Edit Delete', 'all actions render for external groups');
-    await click(`${SELECTORS.listItem(name)} ${SELECTORS.menuItem('delete')}`);
-    await click(SELECTORS.confirm);
+    await click(`${SELECTORS.listItem(name)} ${GENERAL.menuItem('delete')}`);
+    await click(GENERAL.confirmButton);
   });
 
   test('it renders popup menu for external groups with alias', async function (assert) {
-    const name = `external-hasalias-${uuidv4()}`;
-    await runCmd(`vault write identity/group name="${name}" policies="default" type="external"`);
-    await visit('/vault/access/identity/groups');
-    await click(`${SELECTORS.listItem(name)} ${SELECTORS.menu}`);
-    await click(SELECTORS.menuItem('create alias'));
-    await fillIn(GENERAL.inputByAttr('name'), 'alias-test');
-    await click(SELECTORS.submit);
+    const groupId = '44b2f1d1-699a-4a79-3a7b-37e53e17e7b2';
+    const groupName = 'external-hasalias';
+    // only relevant response keys are stubbed to simplify testing (more data is actually returned by both endpoints)
+    this.server.get('/identity/group/id', () => {
+      return {
+        data: {
+          key_info: { [groupId]: { name: groupName } },
+          keys: [groupId],
+        },
+      };
+    });
+
+    this.server.get(`/identity/group/id/${groupId}`, () => {
+      return {
+        data: {
+          alias: { id: '15bac764-d690-b72a-9cbc-b1fdeac1af9e', name: 'alias-test' },
+          type: 'external',
+        },
+      };
+    });
 
     await visit('/vault/access/identity/groups');
-    await click(`${SELECTORS.listItem(name)} ${SELECTORS.menu}`);
+    await click(`${SELECTORS.listItem(groupName)} ${GENERAL.menuTrigger}`);
     assert
       .dom('.hds-dropdown ul')
       .hasText('Details Edit Delete', 'no "Create alias" option for external groups with an alias');
-    await click(`${SELECTORS.listItem(name)} ${SELECTORS.menuItem('delete')}`);
-    await click(SELECTORS.confirm);
   });
 
   test('it renders popup menu for internal groups', async function (assert) {
     const name = `internal-${uuidv4()}`;
     await runCmd(`vault write identity/group name="${name}" policies="default" type="internal"`);
     await visit('/vault/access/identity/groups');
-    await click(`${SELECTORS.listItem(name)} ${SELECTORS.menu}`);
+    await click(`${SELECTORS.listItem(name)} ${GENERAL.menuTrigger}`);
     assert
       .dom('.hds-dropdown ul')
       .hasText('Details Edit Delete', 'no "Create alias" option for internal groups');
-    await click(`${SELECTORS.listItem(name)} ${SELECTORS.menuItem('delete')}`);
-    await click(SELECTORS.confirm);
+    await click(`${SELECTORS.listItem(name)} ${GENERAL.menuItem('delete')}`);
+    await click(GENERAL.confirmButton);
   });
 });
diff --git a/ui/tests/acceptance/access/identity/groups/aliases/create-test.js b/ui/tests/acceptance/access/identity/groups/aliases/create-test.js
deleted file mode 100644
index 50a1b4e2b88..00000000000
--- a/ui/tests/acceptance/access/identity/groups/aliases/create-test.js
+++ /dev/null
@@ -1,42 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, skip, test } from 'qunit';
-import { settled } from '@ember/test-helpers';
-import { setupApplicationTest } from 'ember-qunit';
-import { testAliasCRUD, testAliasDeleteFromForm } from '../../_shared-alias-tests';
-import authPage from 'vault/tests/pages/auth';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
-
-module('Acceptance | /access/identity/groups/aliases/add', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(async function () {
-    // Popup menu causes flakiness
-    setRunOptions({
-      rules: {
-        'color-contrast': { enabled: false },
-      },
-    });
-    await authPage.login();
-    return;
-  });
-
-  skip('it allows create, list, delete of an entity alias', async function (assert) {
-    // TODO figure out what is wrong with this test
-    assert.expect(6);
-    const name = `alias-${Date.now()}`;
-    await testAliasCRUD(name, 'groups', assert);
-    await settled();
-  });
-
-  test('it allows delete from the edit form', async function (assert) {
-    // TODO figure out what is wrong with this test
-    assert.expect(4);
-    const name = `alias-${Date.now()}`;
-    await testAliasDeleteFromForm(name, 'groups', assert);
-    await settled();
-  });
-});
diff --git a/ui/tests/acceptance/access/identity/groups/create-test.js b/ui/tests/acceptance/access/identity/groups/create-test.js
deleted file mode 100644
index 963406fa7e1..00000000000
--- a/ui/tests/acceptance/access/identity/groups/create-test.js
+++ /dev/null
@@ -1,47 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { currentRouteName } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import page from 'vault/tests/pages/access/identity/create';
-import { testCRUD, testDeleteFromForm } from '../_shared-tests';
-import authPage from 'vault/tests/pages/auth';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
-
-module('Acceptance | /access/identity/groups/create', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    // Popup menu causes flakiness
-    setRunOptions({
-      rules: {
-        'color-contrast': { enabled: false },
-      },
-    });
-    return authPage.login();
-  });
-
-  test('it visits the correct page', async function (assert) {
-    await page.visit({ item_type: 'groups' });
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.identity.create',
-      'navigates to the correct route'
-    );
-  });
-
-  test('it allows create, list, delete of an group', async function (assert) {
-    assert.expect(6);
-    const name = `group-${Date.now()}`;
-    await testCRUD(name, 'groups', assert);
-  });
-
-  test('it can be deleted from the group edit form', async function (assert) {
-    assert.expect(6);
-    const name = `group-${Date.now()}`;
-    await testDeleteFromForm(name, 'groups', assert);
-  });
-});
diff --git a/ui/tests/acceptance/access/identity/shared-identity-test.js b/ui/tests/acceptance/access/identity/shared-identity-test.js
new file mode 100644
index 00000000000..d9876020e19
--- /dev/null
+++ b/ui/tests/acceptance/access/identity/shared-identity-test.js
@@ -0,0 +1,146 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import sinon from 'sinon';
+import { setupApplicationTest } from 'ember-qunit';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { v4 as uuidv4 } from 'uuid';
+import { click, fillIn, visit, currentURL } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { capitalize } from '@ember/string';
+import { singularize } from 'ember-inflector';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+
+// Helper to create an entity or group
+async function createEntityOrGroup(itemType, name) {
+  await visit(`/vault/access/identity/${itemType}/create`);
+  if (itemType === 'groups') {
+    await fillIn(GENERAL.inputByAttr('type'), 'external');
+  }
+  await fillIn(GENERAL.inputByAttr('name'), name);
+  await click(GENERAL.submitButton);
+  return document.querySelector(GENERAL.infoRowValue('ID')).innerText;
+}
+
+// Helper to create an alias
+async function createAlias(itemType, itemGeneratedId, name) {
+  await visit(`/vault/access/identity/${itemType}/aliases/add/${itemGeneratedId}`);
+  await fillIn(GENERAL.inputByAttr('name'), name);
+  await click(GENERAL.submitButton);
+  return document.querySelector(GENERAL.infoRowValue('ID')).innerText;
+}
+
+// This module covers both groups and entities, so the module name differs from the route path.
+// Creation of an Entity or Group is inherently tested as part of the alias flow, so no separate test is needed.
+module('Acceptance | Create groups and entities alias test', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    this.flashMessages = this.owner.lookup('service:flash-messages');
+    this.flashMessages.registerTypes(['success']);
+    this.flashSuccessSpy = sinon.spy(this.flashMessages, 'success');
+    await login();
+  });
+
+  hooks.afterEach(function () {
+    this.flashSuccessSpy.restore();
+  });
+
+  for (const itemType of ['groups', 'entities']) {
+    test(`${itemType}: it allows create, list, delete of an entity alias`, async function (assert) {
+      const name = `${itemType}-${uuidv4()}`;
+      const itemGeneratedId = await createEntityOrGroup(itemType, name);
+
+      assert.true(
+        this.flashSuccessSpy.calledWith(`Successfully saved ${singularize(capitalize(itemType))}.`),
+        `${itemType}: shows a flash message on create`
+      );
+
+      const aliasGeneratedId = await createAlias(itemType, itemGeneratedId, name);
+
+      assert.true(
+        this.flashSuccessSpy.calledWith(`Successfully saved ${singularize(capitalize(itemType))} alias.`),
+        `${itemType}: shows a flash message when creating an alias.`
+      );
+
+      assert.strictEqual(
+        currentURL(),
+        `/vault/access/identity/${itemType}/aliases/${aliasGeneratedId}/details`,
+        'navigates to the alias show route after creation'
+      );
+      assert
+        .dom(GENERAL.infoRowValue('Name'))
+        .hasText(name, `${itemType}: renders the alias name on the alias show page`);
+
+      await visit(`/vault/access/identity/${itemType}/aliases`);
+      assert
+        .dom(`[data-test-identity-link="${aliasGeneratedId}"]`)
+        .exists(`${itemType}: lists the entity alias`);
+
+      await click(GENERAL.menuItem(name));
+      await click('[data-test-popup-menu="delete"]');
+      await click(GENERAL.confirmButton);
+      assert.dom(GENERAL.latestFlashContent).includesText('Successfully deleted');
+    });
+
+    test(`${itemType}: it allows delete from the edit form`, async function (assert) {
+      assert.expect(3);
+      const itemId = uuidv4();
+      const name = `${itemType}-${itemId}`;
+      this.server.get(`/identity/${singularize(itemType)}/id/${itemId}`, () => {
+        return { data: { id: itemId, name } };
+      });
+      this.server.delete(`/identity/${singularize(itemType)}/id/${itemId}`, () => {
+        assert.true(true, `request made to delete ${name}`);
+      });
+      await visit(`/vault/access/identity/${itemType}/edit/${itemId}`);
+      await click(GENERAL.confirmTrigger); // click the Delete entity-alias trigger button
+      await click(GENERAL.confirmButton);
+      assert.dom(GENERAL.latestFlashContent).includesText('Successfully deleted');
+      assert.strictEqual(
+        currentURL(),
+        `/vault/access/identity/${itemType}`,
+        `${itemType}: navigates to the list page after deletion`
+      );
+    });
+
+    test(`${itemType}: it allows you to delete the ${itemType} from the list view`, async function (assert) {
+      assert.expect(3);
+      const itemId = uuidv4();
+      const name = `${itemType}-${itemId}`;
+
+      this.server.get(`/identity/${singularize(itemType)}/id`, () => {
+        return {
+          data: {
+            key_info: { [itemId]: { name } },
+            keys: [itemId],
+          },
+        };
+      });
+
+      this.server.get(`/identity/${singularize(itemType)}/id/${itemId}`, () => {
+        return { data: { id: itemId, name } };
+      });
+
+      this.server.delete(`/identity/${singularize(itemType)}/id/${itemId}`, () => {
+        assert.true(true, `request made to delete ${name}`);
+      });
+
+      await visit(`/vault/access/identity/${itemType}`);
+
+      const rowSelector = `[data-test-identity-row="${name}"]`;
+      const menuTriggerSelector = `${rowSelector} ${GENERAL.menuTrigger}`;
+
+      assert.dom(rowSelector).exists(`${itemType}: is in the list view`);
+
+      await click(menuTriggerSelector);
+      await click(GENERAL.menuItem('delete'));
+      await click(GENERAL.confirmButton);
+      assert.dom(GENERAL.latestFlashContent).includesText('Successfully deleted');
+    });
+  }
+});
diff --git a/ui/tests/acceptance/access/methods-test.js b/ui/tests/acceptance/access/methods-test.js
index 414d064acc8..512d33ec6ff 100644
--- a/ui/tests/acceptance/access/methods-test.js
+++ b/ui/tests/acceptance/access/methods-test.js
@@ -1,24 +1,20 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentRouteName, click } from '@ember/test-helpers';
+import { currentRouteName, click, find, findAll, visit } from '@ember/test-helpers';
 import { clickTrigger } from 'ember-power-select/test-support/helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { create } from 'ember-cli-page-object';
-import page from 'vault/tests/pages/access/methods';
-import authEnable from 'vault/tests/pages/settings/auth/enable';
-import authPage from 'vault/tests/pages/auth';
-import ss from 'vault/tests/pages/components/search-select';
-import consoleClass from 'vault/tests/pages/components/console/ui-panel';
-
 import { v4 as uuidv4 } from 'uuid';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { mountAuthCmd, runCmd } from 'vault/tests/helpers/commands';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { sanitizePath } from 'core/utils/sanitize-path';
 
-const consoleComponent = create(consoleClass);
-const searchSelect = create(ss);
+const { searchSelect } = GENERAL;
 
 module('Acceptance | auth-methods list view', function (hooks) {
   setupApplicationTest(hooks);
@@ -26,14 +22,13 @@ module('Acceptance | auth-methods list view', function (hooks) {
 
   hooks.beforeEach(function () {
     this.uid = uuidv4();
-    return authPage.login();
+    return login();
   });
 
   test('it navigates to auth method', async function (assert) {
-    await page.visit();
+    await visit('/vault/access/');
     assert.strictEqual(currentRouteName(), 'vault.cluster.access.methods', 'navigates to the correct route');
-    assert.ok(page.methodsLink.isActive, 'the first link is active');
-    assert.strictEqual(page.methodsLink.text, 'Authentication Methods');
+    assert.dom('[data-test-sidebar-nav-link="Authentication Methods"]').hasClass('active');
   });
 
   test('it filters by name and auth type', async function (assert) {
@@ -41,52 +36,72 @@ module('Acceptance | auth-methods list view', function (hooks) {
     const authPath1 = `userpass-1-${this.uid}`;
     const authPath2 = `userpass-2-${this.uid}`;
     const type = 'userpass';
-    await authEnable.visit();
-    await authEnable.enable(type, authPath1);
-    await authEnable.visit();
-    await authEnable.enable(type, authPath2);
-    await page.visit();
-    // filter by auth type
+    await visit('/vault/settings/auth/enable');
+    await runCmd(mountAuthCmd(type, authPath1));
+    await visit('/vault/settings/auth/enable');
+    await runCmd(mountAuthCmd(type, authPath2));
+    await visit('/vault/access/');
 
+    // filter by auth type
     await clickTrigger('#filter-by-auth-type');
-    await searchSelect.options.objectAt(0).click();
-    const rows = document.querySelectorAll('[data-test-auth-backend-link]');
-    const rowsUserpass = Array.from(rows).filter((row) => row.innerText.includes('userpass'));
-
+    await click(searchSelect.option(searchSelect.optionIndex(type)));
+    let rows = findAll('.list-item-row');
+    const rowsUserpass = findAll(GENERAL.button('userpass'));
     assert.strictEqual(rows.length, rowsUserpass.length, 'all rows returned are userpass');
 
     // filter by name
     await clickTrigger('#filter-by-auth-name');
-    const firstItemToSelect = searchSelect.options.objectAt(0).text;
-    await searchSelect.options.objectAt(0).click();
-    const singleRow = document.querySelectorAll('[data-test-auth-backend-link]');
-
+    await click(searchSelect.option());
+    const selectedItem = find(`#filter-by-auth-name ${searchSelect.selectedOption()}`).innerText;
+    const singleRow = findAll('.linked-block');
     assert.strictEqual(singleRow.length, 1, 'returns only one row');
-    assert.dom(singleRow[0]).includesText(firstItemToSelect, 'shows the filtered by auth name');
-    // clear filter by engine name
-    await searchSelect.deleteButtons.objectAt(1).click();
-    const rowsAgain = document.querySelectorAll('[data-test-auth-backend-link]');
-    assert.ok(rowsAgain.length > 1, 'filter has been removed');
+    assert.dom(singleRow[0]).includesText(selectedItem, 'shows the filtered by auth name');
+    // clear filter by name
+    await click(`#filter-by-auth-name ${searchSelect.removeSelected}`);
+    rows = findAll('.linked-block');
+    assert.true(rows.length > 1, 'filter has been removed');
 
     // cleanup
-    await consoleComponent.runCommands([`delete sys/auth/${authPath1}`]);
-    await consoleComponent.runCommands([`delete sys/auth/${authPath2}`]);
+    await runCmd(`delete sys/auth/${authPath1}`);
+    await runCmd(`delete sys/auth/${authPath2}`);
   });
 
   test('it should show all methods in list view', async function (assert) {
-    this.server.get('/sys/auth', () => ({
+    const authPayload = {
+      'token/': { accessor: 'auth_token_263b8b4e', type: 'token' },
+      'userpass/': { accessor: 'auth_userpass_87aca1f8', type: 'userpass' },
+    };
+    this.server.get('/sys/internal/ui/mounts', () => ({
       data: {
-        'token/': { accessor: 'auth_token_263b8b4e', type: 'token' },
-        'userpass/': { accessor: 'auth_userpass_87aca1f8', type: 'userpass' },
+        auth: authPayload,
       },
     }));
-    await page.visit();
-    assert.dom('[data-test-auth-backend-link]').exists({ count: 2 }, 'All auth methods appear in list view');
-    await authEnable.visit();
-    await click('[data-test-sidebar-nav-link="OIDC Provider"]');
-    await page.visit();
-    assert
-      .dom('[data-test-auth-backend-link]')
-      .exists({ count: 2 }, 'All auth methods appear in list view after navigating back');
+    await visit('/vault/access/');
+    for (const [key] of Object.entries(authPayload)) {
+      assert
+        .dom(GENERAL.linkedBlock(sanitizePath(key)))
+        .exists({ count: 1 }, `auth method ${key} appears in list view`);
+    }
+    await visit('/vault/settings/auth/enable');
+    await click(GENERAL.navLink('OIDC Provider'));
+    await visit('/vault/access/');
+    for (const [key] of Object.entries(authPayload)) {
+      assert
+        .dom(GENERAL.linkedBlock(sanitizePath(key)))
+        .exists({ count: 1 }, `auth method ${key} appears in list view after navigating from OIDC Provider`);
+    }
+  });
+
+  test('it should disable an auth method', async function (assert) {
+    const authPath1 = `userpass-1-${this.uid}`;
+    const type = 'userpass';
+    await visit('/vault/settings/auth/enable');
+    await runCmd(mountAuthCmd(type, authPath1));
+    await visit('/vault/access/');
+    await click(`${GENERAL.linkedBlock(authPath1)} ${GENERAL.menuTrigger}`);
+    await click(GENERAL.button('Disable auth method'));
+    await click(GENERAL.confirmButton);
+    assert.dom(GENERAL.linkedBlock(authPath1)).doesNotExist('auth mount disabled');
+    await runCmd(`delete sys/auth/${authPath1}`);
   });
 });
diff --git a/ui/tests/acceptance/access/namespaces/index-test.js b/ui/tests/acceptance/access/namespaces/index-test.js
index 0a64769e260..51ad43484db 100644
--- a/ui/tests/acceptance/access/namespaces/index-test.js
+++ b/ui/tests/acceptance/access/namespaces/index-test.js
@@ -1,40 +1,153 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentRouteName } from '@ember/test-helpers';
+import { click, currentRouteName, fillIn, visit, waitFor } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import page from 'vault/tests/pages/access/namespaces/index';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { createNS, deleteNS, runCmd } from 'vault/tests/helpers/commands';
 
 module('Acceptance | Enterprise | /access/namespaces', function (hooks) {
   setupApplicationTest(hooks);
-  setupMirage(hooks);
 
-  hooks.beforeEach(function () {
-    return authPage.login();
+  hooks.beforeEach(async () => {
+    await login();
+
+    // Go to the manage namespaces page
+    await visit('/vault/access/namespaces');
   });
 
-  test('it navigates to namespaces page', async function (assert) {
-    assert.expect(1);
-    await page.visit();
+  test('the route url navigates to namespace index page', async function (assert) {
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.access.namespaces.index',
       'navigates to the correct route'
     );
+
+    assert.dom(GENERAL.title).hasText('Namespaces', 'Page title is displayed correctly');
+  });
+
+  test('the route displays the breadcrumb trail', async function (assert) {
+    assert.dom(GENERAL.breadcrumb).exists({ count: 1 }, 'Only one breadcrumb is displayed');
+    assert.dom(GENERAL.breadcrumb).hasText('Namespaces', 'Breadcrumb trail is displayed correctly');
+  });
+
+  test('the route should update namespace list after create/delete WITH manual refresh in the CLI', async function (assert) {
+    const testNS = 'test-refresh-ns-cli';
+
+    // Setup: Create namespace via the CLI
+    await runCmd(createNS(testNS), false);
+
+    // Click the refresh list button on the namespace page
+    await click(GENERAL.button('refresh-namespace-list'));
+    await fillIn(GENERAL.filterInputExplicit, testNS);
+    await click(GENERAL.button('Search'));
+    assert.dom('[data-test-list-item]').hasText(testNS, 'Namespace is displayed after refreshing the list');
+
+    // Delete the created namespace via the CLI
+    await runCmd(deleteNS(testNS), false);
+    await visit('/vault/access/namespaces');
+
+    // Search for the deleted namespace
+    await fillIn(GENERAL.filterInputExplicit, testNS);
+    await click(GENERAL.button('Search'));
+
+    // Click the refresh list button from the namespace page
+    await click(GENERAL.button('refresh-namespace-list'));
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText(
+        'No namespaces yet',
+        'Empty state is displayed when searching for the namespace we have created in the CLI but have not refreshed the list yet'
+      );
   });
 
-  test('it should render correct number of namespaces', async function (assert) {
-    assert.expect(3);
-    await page.visit();
-    const store = this.owner.lookup('service:store');
-    // Default page size is 15
-    assert.strictEqual(store.peekAll('namespace').length, 15, 'Store has 15 namespaces records');
-    assert.dom('.list-item-row').exists({ count: 15 });
-    assert.dom('.hds-pagination').exists();
+  test('the route should update namespace list after create/delete WITHOUT manual refresh in the UI', async function (assert) {
+    const testNS = 'test-create-ns-ui';
+
+    // Verify test-create-ns does not exist in the Manage Namespace page
+    await fillIn(GENERAL.filterInputExplicit, testNS);
+    await click(GENERAL.button('Search'));
+    await waitFor(GENERAL.emptyStateTitle, {
+      timeout: 2000,
+      timeoutMessage: 'timed out waiting for empty state title to render',
+    });
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText(
+        'No namespaces yet',
+        'Empty state is displayed when searching for the namespace we have created in the UI but have not refreshed the list yet'
+      );
+
+    // Create a new namespace in the UI
+    await click(GENERAL.linkTo('create-namespace'));
+    await fillIn(GENERAL.inputByAttr('path'), testNS);
+    await click(GENERAL.submitButton);
+
+    // Verify test-create-ns-ui exists in the Manage Namespace page
+    await fillIn(GENERAL.filterInputExplicit, testNS);
+    await click(GENERAL.button('Search'));
+    assert.dom('[data-test-list-item]').hasText(testNS, 'Namespace is displayed after refreshing the list');
+
+    // Delete the created namespace
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.menuItem('delete'));
+    await click(GENERAL.confirmButton);
+    await click(GENERAL.button('refresh-namespace-list'));
+
+    // Verify test-create-ns does not exist in the Manage Namespace page
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('No namespaces yet', 'Empty state is displayed indicating the namespace was deleted');
+  });
+
+  test('the route should show "delete" option menu for each namespace', async function (assert) {
+    // Setup: Create namespace(s) via the CLI
+    const testNS = 'asdf';
+    await runCmd(createNS(testNS), false);
+
+    // Search for created namespace// Enter search text
+    await fillIn(GENERAL.filterInputExplicit, testNS);
+    await click(GENERAL.button('Search'));
+    await click(GENERAL.button('refresh-namespace-list'));
+
+    // Verify the menu options
+    await waitFor(GENERAL.menuTrigger, {
+      timeout: 2000,
+      timeoutMessage: 'timed out waiting for menu trigger to render',
+    });
+    await click(GENERAL.menuTrigger);
+    assert.dom(GENERAL.menuItem('delete')).exists('Delete namespace option is displayed');
+
+    // Cleanup: Delete namespace(s) via the CLI
+    await runCmd(deleteNS(testNS), false);
+  });
+
+  test('the route should switch to the selected namespace on click "Switch to namespace"', async function (assert) {
+    // Setup: Create namespace(s) via the CLI
+    const testNS = 'test-create-ns-switch';
+    await runCmd(createNS(testNS), false);
+
+    // Search for created namespace
+    await fillIn(GENERAL.filterInputExplicit, testNS);
+    await click(GENERAL.button('Search'));
+    await click(GENERAL.button('refresh-namespace-list'));
+
+    // Switch namespace
+    await waitFor(GENERAL.menuTrigger);
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.menuItem('switch'));
+
+    // Verify that we switched namespaces
+    await click(GENERAL.button('namespace-picker'));
+    assert.dom('[data-test-badge-namespace]').hasText(testNS, 'Namespace badge shows the correct namespace');
+    assert.strictEqual(currentRouteName(), 'vault.cluster.dashboard', 'navigates to the correct route');
+
+    // Cleanup: Delete namespace(s) via the CLI
+    await visit('vault/dashboard'); // navigate to "root" before deleting
+    await runCmd(deleteNS(testNS), false);
   });
 });
diff --git a/ui/tests/acceptance/auth-list-test.js b/ui/tests/acceptance/auth-list-test.js
deleted file mode 100644
index de8c1523763..00000000000
--- a/ui/tests/acceptance/auth-list-test.js
+++ /dev/null
@@ -1,178 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-/* eslint qunit/no-conditional-assertions: "warn" */
-import { click, fillIn, settled, visit, currentURL } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import { v4 as uuidv4 } from 'uuid';
-
-import authPage from 'vault/tests/pages/auth';
-import enablePage from 'vault/tests/pages/settings/auth/enable';
-import { allSupportedAuthBackends, supportedAuthBackends } from 'vault/helpers/supported-auth-backends';
-import { supportedManagedAuthBackends } from 'vault/helpers/supported-managed-auth-backends';
-import { deleteAuthCmd, mountAuthCmd, runCmd, createNS } from 'vault/tests/helpers/commands';
-
-const SELECTORS = {
-  backendLink: (path) => `[data-test-auth-backend-link="${path}"]`,
-  createUser: '[data-test-entity-create-link="user"]',
-  input: (attr) => `[data-test-input="${attr}"]`,
-  password: '[data-test-textarea]',
-  saveBtn: '[data-test-save-config]',
-  methods: '[data-test-access-methods] a',
-  listItem: '[data-test-list-item-content]',
-};
-module('Acceptance | auth backend list', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(async function () {
-    await authPage.login();
-    this.path1 = `userpass-${uuidv4()}`;
-    this.path2 = `userpass-${uuidv4()}`;
-    this.user1 = 'user1';
-    this.user2 = 'user2';
-
-    await runCmd([mountAuthCmd('userpass', this.path1), mountAuthCmd('userpass', this.path2)], false);
-  });
-
-  hooks.afterEach(async function () {
-    await authPage.login();
-    await runCmd([deleteAuthCmd(this.path1), deleteAuthCmd(this.path2)], false);
-    return;
-  });
-
-  test('userpass secret backend', async function (assert) {
-    assert.expect(5);
-    // enable a user in first userpass backend
-    await visit('/vault/access');
-    await click(SELECTORS.backendLink(this.path1));
-    await click(SELECTORS.createUser);
-    await fillIn(SELECTORS.input('username'), this.user1);
-    await fillIn(SELECTORS.password, this.user1);
-    await click(SELECTORS.saveBtn);
-    assert.strictEqual(currentURL(), `/vault/access/${this.path1}/item/user`);
-
-    await click(SELECTORS.methods);
-    assert.strictEqual(currentURL(), '/vault/access');
-
-    // enable a user in second userpass backend
-    await click(SELECTORS.backendLink(this.path2));
-    await click(SELECTORS.createUser);
-    await fillIn(SELECTORS.input('username'), this.user2);
-    await fillIn(SELECTORS.password, this.user2);
-    await click(SELECTORS.saveBtn);
-    assert.strictEqual(currentURL(), `/vault/access/${this.path2}/item/user`);
-
-    // Confirm that the user was created. There was a bug where the apiPath was not being updated when toggling between auth routes.
-    assert.dom(SELECTORS.listItem).hasText(this.user2, 'user2 exists in the list');
-
-    // Confirm that the auth method 1 shows user1. There was a bug where the user was not listed when toggling between auth routes.
-    await click(SELECTORS.methods);
-    await click(SELECTORS.backendLink(this.path1));
-    assert.dom(SELECTORS.listItem).hasText(this.user1, 'user1 exists in the list');
-  });
-
-  test('auth methods are linkable and link to correct view', async function (assert) {
-    assert.expect(24);
-    const uid = uuidv4();
-    await visit('/vault/access');
-
-    const supportManaged = supportedManagedAuthBackends();
-    const backends = supportedAuthBackends();
-    for (const backend of backends) {
-      const { type } = backend;
-      const path = type === 'token' ? 'token' : `auth-list-${type}-${uid}`;
-      if (type !== 'token') {
-        await enablePage.enable(type, path);
-      }
-      await settled();
-      await visit('/vault/access');
-
-      // check popup menu
-      const itemCount = type === 'token' ? 2 : 3;
-      await click(`[data-test-auth-backend-link="${path}"] [data-test-popup-menu-trigger]`);
-      assert
-        .dom('.hds-dropdown-list-item')
-        .exists({ count: itemCount }, `shows ${itemCount} dropdown items for ${type}`);
-
-      // all auth methods should be linkable
-      await click(`[data-test-auth-backend-link="${path}"]`);
-      if (!supportManaged.includes(type)) {
-        assert.dom('[data-test-auth-section-tab]').exists({ count: 1 });
-        assert
-          .dom('[data-test-auth-section-tab]')
-          .hasText('Configuration', `only shows configuration tab for ${type} auth method`);
-        assert.dom('[data-test-doc-link] .doc-link').exists(`includes doc link for ${type} auth method`);
-      } else {
-        let expectedTabs = 2;
-        if (type == 'ldap' || type === 'okta') {
-          expectedTabs = 3;
-        }
-        assert
-          .dom('[data-test-auth-section-tab]')
-          .exists({ count: expectedTabs }, `has management tabs for ${type} auth method`);
-      }
-      if (type !== 'token') {
-        // cleanup method
-        await runCmd(deleteAuthCmd(path));
-      }
-    }
-  });
-
-  test('enterprise: auth methods are linkable and link to correct view', async function (assert) {
-    assert.expect(19);
-    const uid = uuidv4();
-    await visit('/vault/access');
-
-    const supportManaged = supportedManagedAuthBackends();
-    const backends = allSupportedAuthBackends();
-    for (const backend of backends) {
-      const { type } = backend;
-      const path = `auth-list-${type}-${uid}`;
-      if (type !== 'token') {
-        await enablePage.enable(type, path);
-      }
-      await settled();
-      await visit('/vault/access');
-
-      // all auth methods should be linkable
-      await click(`[data-test-auth-backend-link="${type === 'token' ? type : path}"]`);
-      if (!supportManaged.includes(type)) {
-        assert.dom('[data-test-auth-section-tab]').exists({ count: 1 });
-        assert
-          .dom('[data-test-auth-section-tab]')
-          .hasText('Configuration', `only shows configuration tab for ${type} auth method`);
-        assert.dom('[data-test-doc-link] .doc-link').exists(`includes doc link for ${type} auth method`);
-      } else {
-        let expectedTabs = 2;
-        if (type == 'ldap' || type === 'okta') {
-          expectedTabs = 3;
-        }
-        assert
-          .dom('[data-test-auth-section-tab]')
-          .exists({ count: expectedTabs }, `has management tabs for ${type} auth method`);
-        // cleanup method
-        await runCmd(deleteAuthCmd(path));
-      }
-    }
-  });
-
-  test('enterprise: token config within namespace', async function (assert) {
-    const ns = 'ns-wxyz';
-    await runCmd(createNS(ns), false);
-    await settled();
-    await authPage.loginNs(ns);
-    // go directly to token configure route
-    await visit('/vault/settings/auth/configure/token/options');
-    await fillIn('[data-test-input="description"]', 'My custom description');
-    await click('[data-test-save-config="true"]');
-    assert.strictEqual(currentURL(), '/vault/access', 'successfully saves and navigates away');
-    await click('[data-test-auth-backend-link="token"]');
-    assert
-      .dom('[data-test-row-value="Description"]')
-      .hasText('My custom description', 'description was saved');
-    await runCmd(`delete sys/namespaces/${ns}`);
-  });
-});
diff --git a/ui/tests/acceptance/auth-test.js b/ui/tests/acceptance/auth-test.js
deleted file mode 100644
index ab48fe5d339..00000000000
--- a/ui/tests/acceptance/auth-test.js
+++ /dev/null
@@ -1,109 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-/* eslint qunit/no-conditional-assertions: "warn" */
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import sinon from 'sinon';
-import { click, currentURL, visit, waitUntil, find } from '@ember/test-helpers';
-import { supportedAuthBackends } from 'vault/helpers/supported-auth-backends';
-import authForm from '../pages/components/auth-form';
-import jwtForm from '../pages/components/auth-jwt';
-import { create } from 'ember-cli-page-object';
-import apiStub from 'vault/tests/helpers/noop-all-api-requests';
-
-const component = create(authForm);
-const jwtComponent = create(jwtForm);
-
-module('Acceptance | auth', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.clock = sinon.useFakeTimers({
-      now: Date.now(),
-      shouldAdvanceTime: true,
-    });
-    this.server = apiStub({ usePassthrough: true });
-  });
-
-  hooks.afterEach(function () {
-    this.clock.restore();
-    this.server.shutdown();
-  });
-
-  test('auth query params', async function (assert) {
-    const backends = supportedAuthBackends();
-    assert.expect(backends.length + 1);
-    await visit('/vault/auth');
-    assert.strictEqual(currentURL(), '/vault/auth?with=token');
-    for (const backend of backends.reverse()) {
-      await component.selectMethod(backend.type);
-      assert.strictEqual(
-        currentURL(),
-        `/vault/auth?with=${backend.type}`,
-        `has the correct URL for ${backend.type}`
-      );
-    }
-  });
-
-  test('it clears token when changing selected auth method', async function (assert) {
-    await visit('/vault/auth');
-    await component.token('token').selectMethod('github');
-    await component.selectMethod('token');
-    assert.strictEqual(component.tokenValue, '', 'it clears the token value when toggling methods');
-  });
-
-  test('it sends the right attributes when authenticating', async function (assert) {
-    assert.expect(8);
-    const backends = supportedAuthBackends();
-    await visit('/vault/auth');
-    for (const backend of backends.reverse()) {
-      await component.selectMethod(backend.type);
-      if (backend.type === 'github') {
-        await component.token('token');
-      }
-      if (backend.type === 'jwt' || backend.type === 'oidc') {
-        await jwtComponent.role('test');
-      }
-      await component.login();
-      const lastRequest = this.server.passthroughRequests[this.server.passthroughRequests.length - 1];
-      const body = JSON.parse(lastRequest.requestBody);
-
-      let keys;
-      let included;
-      if (backend.type === 'token') {
-        keys = lastRequest.requestHeaders;
-        included = 'x-vault-token';
-      } else if (backend.type === 'github') {
-        keys = body;
-        included = 'token';
-      } else if (backend.type === 'jwt' || backend.type === 'oidc') {
-        const authReq = this.server.passthroughRequests[this.server.passthroughRequests.length - 2];
-        keys = JSON.parse(authReq.requestBody);
-        included = 'role';
-      } else {
-        keys = body;
-        included = 'password';
-      }
-      assert.ok(Object.keys(keys).includes(included), `${backend.type} includes ${included}`);
-    }
-  });
-
-  test('it shows the push notification warning after submit', async function (assert) {
-    assert.expect(1);
-
-    this.server.get('/v1/auth/token/lookup-self', async () => {
-      assert.ok(
-        await waitUntil(() => find('[data-test-auth-message="push"]')),
-        'shows push notification message'
-      );
-      return [204, { 'Content-Type': 'application/json' }, JSON.stringify({})];
-    });
-
-    await visit('/vault/auth');
-    await component.selectMethod('token');
-    await click('[data-test-auth-submit]');
-  });
-});
diff --git a/ui/tests/acceptance/auth/auth-list-test.js b/ui/tests/acceptance/auth/auth-list-test.js
new file mode 100644
index 00000000000..4bebbe016f8
--- /dev/null
+++ b/ui/tests/acceptance/auth/auth-list-test.js
@@ -0,0 +1,174 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, fillIn, settled, visit, currentURL } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { v4 as uuidv4 } from 'uuid';
+
+import { login, loginNs } from 'vault/tests/helpers/auth/auth-helpers';
+import { MANAGED_AUTH_BACKENDS } from 'vault/helpers/supported-managed-auth-backends';
+import { deleteAuthCmd, mountAuthCmd, runCmd, createNS } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
+
+const SELECTORS = {
+  createUser: '[data-test-entity-create-link="user"]',
+  methods: '[data-test-access-methods] a',
+  listItem: '[data-test-list-item-content]',
+};
+
+module('Acceptance | auth backend list', function (hooks) {
+  setupApplicationTest(hooks);
+
+  hooks.beforeEach(async function () {
+    await login();
+  });
+
+  test('userpass secret backend', async function (assert) {
+    this.path1 = `userpass-${uuidv4()}`;
+    this.path2 = `userpass-${uuidv4()}`;
+    this.user1 = 'user1';
+    this.user2 = 'user2';
+
+    await runCmd([mountAuthCmd('userpass', this.path1), mountAuthCmd('userpass', this.path2)], false);
+    // helper function to create a user in the specified backend
+    async function createUser(backendPath, username) {
+      await click(GENERAL.linkedBlock(backendPath));
+      assert.dom(GENERAL.emptyStateTitle).exists('shows empty state');
+      await click(SELECTORS.createUser);
+      await fillIn(GENERAL.inputByAttr('username'), username);
+      await fillIn(GENERAL.inputByAttr('password'), username);
+      await click(GENERAL.submitButton);
+      assert.strictEqual(currentURL(), `/vault/access/${backendPath}/item/user`);
+    }
+    // visit access page and enable the first user in the first userpass backend
+    await visit('/vault/access');
+    await createUser(this.path1, this.user1);
+
+    // navigate back to the methods list
+    await click(SELECTORS.methods);
+    assert.strictEqual(currentURL(), '/vault/access');
+
+    // enable a second user in the second userpass backend
+    await createUser(this.path2, this.user2);
+
+    // verify the second user is listed after creation
+    assert.dom(SELECTORS.listItem).hasText(this.user2, 'user2 exists in the list');
+
+    // check that switching back to the first auth method shows the first user
+    await click(SELECTORS.methods);
+    await click(GENERAL.linkedBlock(this.path1));
+    assert.dom(SELECTORS.listItem).hasText(this.user1, 'user1 exists in the list');
+
+    await login();
+    await runCmd([deleteAuthCmd(this.path1), deleteAuthCmd(this.path2)], false);
+  });
+
+  module('auth methods are linkable and link to correct view', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.uid = uuidv4();
+      await visit('/vault/access');
+    });
+
+    // Test all auth methods, not just those you can log in with
+    filterEnginesByMountCategory({ mountCategory: 'auth', isEnterprise: false })
+      .map((backend) => backend.type)
+      .forEach((type) => {
+        test(`${type} auth method`, async function (assert) {
+          const supportManaged = MANAGED_AUTH_BACKENDS;
+          const isTokenType = type === 'token';
+          const path = isTokenType ? 'token' : `auth-list-${type}-${this.uid}`;
+
+          // Enable auth if the backend is not type token
+          if (!isTokenType) {
+            await visit('/vault/settings/auth/enable');
+            await click(GENERAL.cardContainer(type));
+            await fillIn(GENERAL.inputByAttr('path'), path);
+            await click(GENERAL.submitButton);
+          }
+
+          await visit('/vault/access');
+
+          // check popup menu for auth method
+          const itemCount = isTokenType ? 2 : 3;
+          const triggerSelector = `${GENERAL.linkedBlock(path)} [data-test-popup-menu-trigger]`;
+          const itemSelector = `${GENERAL.linkedBlock(path)} .hds-dropdown-list-item`;
+
+          await click(triggerSelector);
+          assert
+            .dom(itemSelector)
+            .exists({ count: itemCount }, `shows ${itemCount} dropdown items for ${type}`);
+
+          // check that auth methods are linkable
+          await click(GENERAL.linkedBlock(path));
+
+          if (!supportManaged.includes(type)) {
+            assert.dom(GENERAL.linkTo('auth-tab')).exists({ count: 1 });
+            assert
+              .dom(GENERAL.linkTo('auth-tab'))
+              .hasText('Configuration', `only shows configuration tab for ${type} auth method`);
+            assert.dom(GENERAL.docLinkByAttr(path)).exists(`includes doc link for ${type} auth method`);
+          } else {
+            // determine expected number of managed auth tabs
+            const expectedTabs = ['ldap', 'okta'].includes(type) ? 3 : 2;
+            assert
+              .dom(GENERAL.linkTo('generated-tab'))
+              .exists({ count: expectedTabs }, `has management tabs for ${type} auth method`);
+          }
+          // cleanup method
+          if (!isTokenType) {
+            await runCmd(deleteAuthCmd(path));
+          }
+        });
+      });
+  });
+
+  module('enterprise', function () {
+    test('ent-only auth methods are linkable and link to correct view', async function (assert) {
+      assert.expect(3);
+      const uid = uuidv4();
+      await visit('/vault/access');
+
+      // Only SAML is enterprise-only for now
+      const type = 'saml';
+      const path = `auth-list-${type}-${uid}`;
+      await runCmd([mountAuthCmd(type, path), 'refresh']);
+      await settled();
+      await visit('/vault/access');
+
+      // all auth methods should be linkable
+      await click(GENERAL.linkedBlock(path));
+      assert.dom(GENERAL.linkTo('auth-tab')).exists({ count: 1 });
+      assert
+        .dom(GENERAL.linkTo('auth-tab'))
+        .hasText('Configuration', `only shows configuration tab for ${type} auth method`);
+      assert.dom(GENERAL.docLinkByAttr(path)).exists(`includes doc link for ${type} auth method`);
+      await runCmd(deleteAuthCmd(path));
+    });
+
+    test('token config within namespace', async function (assert) {
+      const ns = 'ns-wxyz';
+      await runCmd(createNS(ns), false);
+      await settled();
+      await loginNs(ns);
+      // go directly to token configure route
+      await visit(`/vault/settings/auth/configure/token/options?namespace=${ns}`);
+      await fillIn(GENERAL.inputByAttr('description'), 'My custom description');
+      await click(GENERAL.submitButton);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/access?namespace=${ns}`,
+        'successfully saves and navigates away'
+      );
+      await click(GENERAL.linkedBlock('token'));
+      assert
+        .dom('[data-test-row-value="Description"]')
+        .hasText('My custom description', 'description was saved');
+      await login();
+      await runCmd(`delete sys/namespaces/${ns}`);
+    });
+  });
+});
diff --git a/ui/tests/acceptance/auth/auth-login-test.js b/ui/tests/acceptance/auth/auth-login-test.js
new file mode 100644
index 00000000000..528e243955e
--- /dev/null
+++ b/ui/tests/acceptance/auth/auth-login-test.js
@@ -0,0 +1,444 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { click, currentURL, fillIn, typeIn, visit, waitFor } from '@ember/test-helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import VAULT_KEYS from 'vault/tests/helpers/vault-keys';
+import { createNS, createPolicyCmd, deleteNS, mountEngineCmd, runCmd } from 'vault/tests/helpers/commands';
+import {
+  AUTH_METHOD_LOGIN_DATA,
+  fillInLoginFields,
+  login,
+  loginNs,
+  logout,
+  SYS_INTERNAL_UI_MOUNTS,
+} from 'vault/tests/helpers/auth/auth-helpers';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { v4 as uuidv4 } from 'uuid';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+import { ERROR_JWT_LOGIN, supportedTypes } from 'vault/utils/auth-form-helpers';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+
+const { rootToken } = VAULT_KEYS;
+
+module('Acceptance | auth login', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  test('it does not request login settings for community versions', async function (assert) {
+    assert.expect(1); // should only be one assertion because the stubbed mirage request should NOT be hit
+    this.owner.lookup('service:version').type = 'community';
+    this.server.get('/sys/internal/ui/default-auth-methods', () => {
+      // cannot throw error here because request errors are swallowed
+      assert.false(true, 'request made for login settings and it should not have been');
+    });
+    await visit('/vault/auth');
+    assert.strictEqual(currentURL(), '/vault/auth');
+  });
+
+  test('it selects auth method if "with" query param is a supported auth method', async function (assert) {
+    const authTypes = supportedTypes(false);
+    assert.expect(authTypes.length);
+    for (const backend of authTypes.reverse()) {
+      await visit(`/vault/auth?with=${backend}`);
+      assert.dom(AUTH_FORM.selectMethod).hasValue(backend);
+    }
+  });
+
+  test('it selects auth method if "with" query param ends in an unencoded a slash', async function (assert) {
+    await visit('/vault/auth?with=userpass/');
+    assert.dom(AUTH_FORM.selectMethod).hasValue('userpass');
+  });
+
+  test('it pre-fills OIDC role if specified in query param', async function (assert) {
+    const role = AUTH_METHOD_LOGIN_DATA.oidc.role;
+    await visit(`/vault/auth?with=oidc&role=${role}`);
+    assert.dom(AUTH_FORM.selectMethod).hasValue('oidc');
+    assert.dom(GENERAL.inputByAttr('role')).hasValue(role);
+  });
+
+  test('enterprise: it pre-fills SAML role if specified in query param', async function (assert) {
+    const role = AUTH_METHOD_LOGIN_DATA.oidc.role;
+    await visit(`/vault/auth?with=saml&role=${role}`);
+    assert.dom(AUTH_FORM.selectMethod).hasValue('saml');
+    assert.dom(GENERAL.inputByAttr('role')).hasValue(role);
+  });
+
+  test('it selects auth method if "with" query param ends in an encoded slash and matches an auth type', async function (assert) {
+    await visit('/vault/auth?with=userpass%2F');
+    assert.dom(AUTH_FORM.selectMethod).hasValue('userpass');
+  });
+
+  test('it redirects if "with" query param is not a supported auth method', async function (assert) {
+    await visit('/vault/auth?with=fake');
+    assert.strictEqual(currentURL(), '/vault/auth', 'invalid query param is cleared');
+  });
+
+  test('it does not refire route model if query param does not exist', async function (assert) {
+    const route = this.owner.lookup('route:vault/cluster/auth');
+    const modelSpy = sinon.spy(route, 'model');
+    await visit('/vault/auth');
+    assert.strictEqual(modelSpy.callCount, 1, 'model hook is only called once');
+    modelSpy.restore();
+  });
+
+  test('it clears token when changing selected auth method', async function (assert) {
+    await visit('/vault/auth');
+    await fillIn(AUTH_FORM.selectMethod, 'token');
+    await fillIn(GENERAL.inputByAttr('token'), 'token');
+    await fillIn(AUTH_FORM.selectMethod, 'github');
+    await fillIn(AUTH_FORM.selectMethod, 'token');
+    assert.dom(GENERAL.inputByAttr('token')).hasNoValue('it clears the token value when toggling methods');
+  });
+
+  test('it does not render tabs if sys/internal/ui/mounts is empty', async function (assert) {
+    await logout(); // clear local storage
+    await visit('/vault/auth');
+    await waitFor(AUTH_FORM.form);
+    assert.dom(GENERAL.selectByAttr('auth type')).exists('dropdown renders');
+    // dropdown could still render in "Sign in with other methods" view, so make sure we're not in a weird state
+    assert.dom(GENERAL.backButton).doesNotExist('it does not render "Back" button');
+    assert.dom(AUTH_FORM.authForm('token')).exists('it renders token form');
+    assert.dom(AUTH_FORM.tabs).doesNotExist();
+  });
+
+  test('it renders default view if sys/internal/ui/mounts has unsupported type', async function (assert) {
+    this.server.get('/sys/internal/ui/mounts', () => {
+      return { data: { auth: { 'custom-auth/': { type: 'custom-auth' } } } };
+    });
+    await logout();
+    await visit('/vault/auth');
+    await waitFor(AUTH_FORM.form);
+    assert.dom(GENERAL.selectByAttr('auth type')).exists('dropdown renders');
+    assert.dom(GENERAL.selectByAttr('auth type')).hasValue('token', 'dropdown has default "Token" selected');
+    // dropdown could still render in "Sign in with other methods" view, so make sure we're not in a weird state
+    assert.dom(GENERAL.backButton).doesNotExist('it does not render "Back" button');
+    assert.dom(AUTH_FORM.authForm('token')).exists('it renders token form');
+    assert.dom(AUTH_FORM.tabs).doesNotExist('it does not render auth tabs');
+  });
+
+  module('listing visibility', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.server.get('/sys/internal/ui/mounts', () => {
+        return { data: { auth: SYS_INTERNAL_UI_MOUNTS } };
+      });
+      await logout(); // clear local storage
+    });
+
+    test('it renders tabs if sys/internal/ui/mounts returns data', async function (assert) {
+      assert.expect(9);
+      const expectedTabs = [
+        { type: 'userpass', display: 'Userpass' },
+        { type: 'oidc', display: 'OIDC' },
+        { type: 'ldap', display: 'LDAP' },
+      ];
+      await visit('/vault/auth');
+      await waitFor(AUTH_FORM.tabs);
+      assert.dom(GENERAL.selectByAttr('auth type')).doesNotExist('dropdown does not render');
+      // there are 4 mount paths returned in the stubbed sys/internal/ui/mounts response above,
+      // but two are of the same type so only expect 3 tabs
+      assert.dom(AUTH_FORM.tabs).exists({ count: 3 }, 'it groups mount paths by type and renders 3 tabs');
+      expectedTabs.forEach((m) => {
+        assert.dom(AUTH_FORM.tabBtn(m.type)).exists(`${m.type} renders as a tab`);
+        assert.dom(AUTH_FORM.tabBtn(m.type)).hasText(m.display, `${m.type} renders expected display name`);
+      });
+      assert
+        .dom(AUTH_FORM.tabBtn('userpass'))
+        .hasAttribute('aria-selected', 'true', 'it selects the first type by default');
+    });
+
+    test('it renders preferred mount view if "with" query param is a mount path with listing_visibility="unauth"', async function (assert) {
+      await visit('/vault/auth?with=my_oidc%2F');
+      await waitFor(AUTH_FORM.tabBtn('oidc'));
+      assert.dom(AUTH_FORM.authForm('oidc')).exists();
+      assert.dom(AUTH_FORM.tabBtn('oidc')).exists();
+      assert.dom(GENERAL.inputByAttr('role')).exists();
+      assert.dom(GENERAL.inputByAttr('path')).hasAttribute('type', 'hidden');
+      assert
+        .dom(GENERAL.inputByAttr('path'))
+        .hasValue('my_oidc/', 'mount path matches server value and is not camelized');
+      assert.dom(GENERAL.button('Sign in with other methods')).exists('"Sign in with other methods" renders');
+
+      assert.dom(GENERAL.selectByAttr('auth type')).doesNotExist('dropdown does not render');
+      assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+      assert.dom(GENERAL.backButton).doesNotExist();
+    });
+
+    test('it selects tab if "with" query param matches a tab type', async function (assert) {
+      await visit('/vault/auth?with=oidc');
+      await waitFor(AUTH_FORM.tabBtn('oidc'));
+      assert
+        .dom(AUTH_FORM.tabBtn('oidc'))
+        .hasAttribute('aria-selected', 'true', 'it selects tab matching query param');
+      assert.dom(GENERAL.inputByAttr('path')).hasAttribute('type', 'hidden');
+      assert.dom(GENERAL.inputByAttr('path')).hasValue('my_oidc/');
+      assert.dom(GENERAL.button('Sign in with other methods')).exists('"Sign in with other methods" renders');
+      assert.dom(GENERAL.backButton).doesNotExist();
+    });
+
+    test('it selects type from dropdown if query param is NOT a visible mount, but is a supported method', async function (assert) {
+      await visit('/vault/auth?with=token');
+      await waitFor(GENERAL.selectByAttr('auth type'));
+      assert.dom(GENERAL.selectByAttr('auth type')).hasValue('token');
+      assert.dom(GENERAL.backButton).exists('it renders "Back" button because tabs do exist');
+      assert
+        .dom(GENERAL.button('Sign in with other methods'))
+        .doesNotExist(
+          'Tabs exist but query param does not match so login is showing "other" methods and this button should not render'
+        );
+    });
+  });
+
+  // PAYLOAD TESTS FOR EACH AUTH METHOD
+  // Assertion count is one for the URL and one for each payload key
+  module('it sends the right payload when authenticating', function (hooks) {
+    hooks.beforeEach(function () {
+      this.assertAuthPayload = (assert, req, expectedPayload) => {
+        const body = JSON.parse(req.requestBody);
+        assert.true(true, `it calls the correct URL: ${req.url}`);
+
+        for (const [expKey, expValue] of Object.entries(expectedPayload)) {
+          assert.strictEqual(body[expKey], expValue, `payload includes ${expKey}: ${expValue}`);
+        }
+      };
+
+      this.fillAndLogIn = async () => {
+        await visit('/vault/auth');
+        await fillIn(AUTH_FORM.selectMethod, this.authType);
+
+        const loginData = { ...AUTH_METHOD_LOGIN_DATA[this.authType], path: `custom-${this.authType}` };
+        await fillInLoginFields(loginData, { toggleOptions: true });
+        await click(GENERAL.submitButton);
+      };
+    });
+
+    test('token', async function (assert) {
+      assert.expect(2);
+      this.authType = 'token';
+      this.expectedPayload = { 'x-vault-token': 'mysupersecuretoken' };
+      const headerKey = 'x-vault-token';
+      const expectedToken = this.expectedPayload[headerKey];
+
+      this.server.get('/auth/token/lookup-self', (schema, req) => {
+        const actualToken = req.requestHeaders[headerKey];
+        assert.true(true, `it calls the correct URL: ${req.url}`);
+        assert.strictEqual(actualToken, expectedToken, 'headers include token');
+        req.passthrough();
+      });
+
+      await visit('/vault/auth');
+      await fillIn(AUTH_FORM.selectMethod, this.authType);
+      const loginData = AUTH_METHOD_LOGIN_DATA[this.authType];
+      await fillInLoginFields(loginData);
+      await click(GENERAL.submitButton);
+    });
+
+    test('github', async function (assert) {
+      assert.expect(2);
+      this.authType = 'github';
+      this.expectedPayload = { token: 'mysupersecuretoken' };
+      this.server.post('/auth/custom-github/login', (schema, req) => {
+        this.assertAuthPayload(assert, req, this.expectedPayload);
+        req.passthrough();
+      });
+
+      await this.fillAndLogIn();
+    });
+
+    test('ldap', async function (assert) {
+      assert.expect(2);
+      this.authType = 'ldap';
+      this.expectedPayload = { password: 'some-password' };
+      this.server.post('/auth/custom-ldap/login/matilda', (schema, req) => {
+        this.assertAuthPayload(assert, req, this.expectedPayload);
+        req.passthrough();
+      });
+
+      await this.fillAndLogIn();
+    });
+
+    // JWT and OIDC use the same request URLs and how the login happens depends on the configuration.
+    // For simplicity, mocking each to be configured as their namesake.
+    test('jwt', async function (assert) {
+      // assertion for each payload key and request made
+      assert.expect(3);
+      this.authType = 'jwt';
+      this.expectedPayload = {
+        jwt: 'some-jwt-token',
+        role: 'some-dev',
+      };
+      // Additional setup so that JWT method is configured as jwt (not OIDC)
+      this.server.post(`/auth/:path/oidc/auth_url`, () =>
+        overrideResponse(400, { errors: [ERROR_JWT_LOGIN] })
+      );
+
+      this.server.post('/auth/custom-jwt/login', (schema, req) => {
+        this.assertAuthPayload(assert, req, this.expectedPayload); // 1 assertion + 1 for each payload key
+        req.passthrough();
+      });
+
+      await this.fillAndLogIn();
+    });
+
+    test('oidc', async function (assert) {
+      // auth_url is hit twice (once when inputs are filled and again on submit)
+      // so the assertion count is doubled
+      assert.expect(6);
+      this.authType = 'oidc';
+      this.expectedPayload = {
+        redirect_uri: 'http://localhost:7357/ui/vault/auth/custom-oidc/oidc/callback',
+        role: 'some-dev',
+      };
+      this.server.post('/auth/custom-oidc/oidc/auth_url', (schema, req) => {
+        this.assertAuthPayload(assert, req, this.expectedPayload);
+        req.passthrough();
+      });
+
+      await this.fillAndLogIn();
+    });
+
+    test('okta', async function (assert) {
+      assert.expect(2);
+      this.authType = 'okta';
+      this.expectedPayload = { password: 'some-password' };
+      this.server.post('/auth/custom-okta/login/matilda', (schema, req) => {
+        this.assertAuthPayload(assert, req, this.expectedPayload);
+        req.passthrough();
+      });
+
+      await this.fillAndLogIn();
+    });
+
+    test('radius', async function (assert) {
+      assert.expect(2);
+      this.authType = 'radius';
+      this.expectedPayload = { password: 'some-password' };
+      this.server.post('/auth/custom-radius/login/matilda', (schema, req) => {
+        this.assertAuthPayload(assert, req, this.expectedPayload);
+        req.passthrough();
+      });
+
+      await this.fillAndLogIn();
+    });
+
+    test('userpass', async function (assert) {
+      assert.expect(2);
+      this.authType = 'userpass';
+      this.expectedPayload = { password: 'some-password' };
+      this.server.post('/auth/custom-userpass/login/matilda', (schema, req) => {
+        this.assertAuthPayload(assert, req, this.expectedPayload);
+        req.passthrough();
+      });
+
+      await this.fillAndLogIn();
+    });
+
+    test('enterprise: saml', async function (assert) {
+      assert.expect(2);
+      this.authType = 'saml';
+      this.expectedPayload = { role: 'some-dev' };
+      this.server.post('/auth/custom-saml/sso_service_url', (schema, req) => {
+        this.assertAuthPayload(assert, req, this.expectedPayload);
+        req.passthrough();
+      });
+
+      await this.fillAndLogIn();
+    });
+  });
+
+  test('it does not call renew-self after successful login with non-renewable token', async function (assert) {
+    this.server.post(
+      '/auth/token/renew-self',
+      () => new Error('should not call renew-self directly after logging in')
+    );
+
+    await login(rootToken);
+    assert.strictEqual(currentURL(), '/vault/dashboard');
+  });
+
+  module('Enterprise', function () {
+    // this test is to cover a token renewal bug within namespaces.
+    // namespace_path isn't returned by the renew-self response and so the auth service was
+    // incorrectly setting userRootNamespace to '' (which denotes 'root').
+    // this caused subsequent capability checks to fail because they would not be queried with the appropriate namespace header.
+    // if this test fails because a POST /v1/sys/capabilities-self returns a 403, then we have a problem!
+    test('it sets namespace when renewing token', async function (assert) {
+      const setTokenDataSpy = sinon.spy(this.owner.lookup('service:auth'), 'setTokenData');
+      const uid = uuidv4();
+      const ns = `admin-${uid}`;
+
+      // log in to root to create namespace
+      await login();
+      await runCmd(createNS(ns), false);
+      // log in to namespace, create policy and generate token
+      await loginNs(ns);
+      const db = `database-${uid}`;
+      const policyName = `policy-${uid}`;
+      const policy = `
+        path "${db}/" {
+          capabilities = ["list"]
+        }
+        path "${db}/roles" {
+          capabilities = ["read","list"]
+        }
+        `;
+      const token = await runCmd([
+        mountEngineCmd('database', db),
+        createPolicyCmd(policyName, policy),
+        `write auth/token/create policies=${policyName} -field=client_token`,
+      ]);
+
+      // login with token to reproduce bug
+      await loginNs(ns, token);
+      await visit(`/vault/secrets-engines/${db}/overview?namespace=${ns}`);
+      assert
+        .dom('[data-test-overview-card="Roles"]')
+        .hasText('Roles Create new', 'database overview renders');
+
+      // renew token
+      await click(GENERAL.button('user-menu-trigger'));
+      await click('[data-test-user-menu-item="renew token"]');
+      // confirm setTokenData is called with correct args
+      const [tokenName, { authMethodType, displayName, userRootNamespace, namespacePath }] =
+        setTokenDataSpy.lastCall.args;
+      assert.strictEqual(tokenName, 'vault-token☃1', 'setTokenData is called with tokenName');
+      assert.strictEqual(authMethodType, 'token', 'setTokenData is called with authMethodType');
+      assert.strictEqual(displayName, 'token', 'setTokenData is called with displayName');
+      assert.strictEqual(userRootNamespace, ns, 'setTokenData is called with userRootNamespace');
+      assert.strictEqual(namespacePath, `${ns}/`, 'setTokenData is called with namespacePath');
+
+      // navigate out and back to overview tab to re-request capabilities
+      // (before the bug fix, the view would not render and instead would show a 403)
+      await click(GENERAL.secretTab('Roles'));
+      await click(GENERAL.tab('overview'));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${db}/overview?namespace=${ns}`,
+        'it navigates to database overview'
+      );
+
+      // cleanup
+      await visit(`/vault/logout?namespace=${ns}`);
+      await fillIn(GENERAL.inputByAttr('namespace'), ''); // clear login form namespace input
+      await login();
+      // clean up namespace pollution
+      await runCmd(deleteNS(ns));
+    });
+
+    test('it sets namespace header for sys/internal/ui/mounts request when namespace is inputted', async function (assert) {
+      assert.expect(1);
+      await visit('/vault/auth');
+
+      this.server.get('/sys/internal/ui/mounts', (_, req) => {
+        assert.strictEqual(req.requestHeaders['x-vault-namespace'], 'admin', 'header contains namespace');
+        return req.passthrough();
+      });
+      await typeIn(GENERAL.inputByAttr('namespace'), 'admin');
+    });
+  });
+});
diff --git a/ui/tests/acceptance/auth/config-form-test.js b/ui/tests/acceptance/auth/config-form-test.js
new file mode 100644
index 00000000000..deeaa9889ec
--- /dev/null
+++ b/ui/tests/acceptance/auth/config-form-test.js
@@ -0,0 +1,219 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { v4 as uuidv4 } from 'uuid';
+
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { visit } from '@ember/test-helpers';
+import { deleteAuthCmd, runCmd } from 'vault/tests/helpers/commands';
+import testHelper from './test-helper';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+// * There are different groups of configuration parameters
+// 1) Auth mount parameters or tune settings - parameters configured when an auth method is enabled in Vault and can be modified via the /tune endpoint (or "tuned").
+//    These params are typically the same across all auth mounts, e.g. `default_lease_ttl`.
+// 2) Method specific configuration settings - additional parameters, e.g. `client_id` that need to be configured to setup the auth method. Only
+//    some methods require these (e.g. AWS or OIDC)
+
+// These models use openAPI so we assert the form inputs using an acceptance test
+// The default selector is to use GENERAL.inputByAttr()
+// custom fields should be added to the this.customSelectors object
+module('Acceptance | auth config form', function (hooks) {
+  setupApplicationTest(hooks);
+  hooks.beforeEach(async function () {
+    // these tend to be the same across models because they share the same mount-config model
+    // if necessary, they can be overridden in the individual module
+    this.mountFields = [
+      'path',
+      'description',
+      'local',
+      'seal_wrap',
+      'config.listing_visibility',
+      'config.default_lease_ttl',
+      'config.max_lease_ttl',
+      'config.token_type',
+      'config.audit_non_hmac_request_keys',
+      'config.audit_non_hmac_response_keys',
+      'config.passthrough_request_headers',
+      'config.allowed_response_headers',
+      'config.plugin_version',
+    ];
+    this.tokensGroup = {
+      Tokens: [
+        'token_bound_cidrs',
+        'token_explicit_max_ttl',
+        'token_max_ttl',
+        'token_no_default_policy',
+        'token_num_uses',
+        'token_period',
+        'token_policies',
+        'token_ttl',
+        'token_type',
+      ],
+    };
+    this.oidcJwtGroup = {
+      'OIDC/JWT Options': [
+        'oidc_client_id',
+        'oidc_client_secret',
+        'oidc_discovery_ca_pem',
+        'jwt_validation_pubkeys',
+        'jwt_supported_algs',
+        'bound_issuer',
+      ],
+    };
+  });
+
+  module('azure', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.type = 'azure';
+      this.path = `${this.type}-${uuidv4()}`;
+      this.configFields = [
+        'environment',
+        'identity_token_audience',
+        'identity_token_ttl',
+        'max_retries',
+        'max_retry_delay',
+        'resource',
+        'retry_delay',
+        'root_password_ttl',
+        'tenant_id',
+      ];
+      // until the vault-plugin-auth-azure changes are released, these fields will be in the default group
+      // this test should then fail and the following line can be removed and the next line uncommented
+      this.configFields.push('client_id', 'client_secret');
+      // this.configToggles = { 'Azure Options': ['client_id', 'client_secret'] };
+      await login();
+      return visit('/vault/settings/auth/enable');
+    });
+    hooks.afterEach(async function () {
+      await runCmd(deleteAuthCmd(this.path), false);
+    });
+    testHelper(test);
+  });
+
+  module('jwt', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.type = 'jwt';
+      this.path = `${this.type}-${uuidv4()}`;
+      this.customSelectors = {
+        provider_config: `${GENERAL.fieldByAttr('provider_config')} .cm-editor`,
+      };
+      this.configFields = [
+        'default_role',
+        'jwks_ca_pem',
+        'jwks_url',
+        'namespace_in_state',
+        'oidc_discovery_url',
+        'oidc_response_mode',
+        'oidc_response_types',
+        // provider_config will be updated to EditType: file in next version of vault-plugin-auth-jwt
+        // commenting out for now to avoid test failure
+        // 'provider_config',
+        'unsupported_critical_cert_extensions',
+      ];
+      // until the vault-plugin-auth-jwt changes are released, these fields will be in the default group
+      // this test should then fail and the following line can be removed and the next line uncommented
+      this.configFields.push(...this.oidcJwtGroup['OIDC/JWT Options']);
+      // this.configToggles = this.oidcJwtGroup;
+      await login();
+      return visit('/vault/settings/auth/enable');
+    });
+    hooks.afterEach(async function () {
+      await runCmd(deleteAuthCmd(this.path), false);
+    });
+    testHelper(test);
+  });
+
+  module('ldap', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.type = 'ldap';
+      this.path = `${this.type}-${uuidv4()}`;
+      this.configFields = [
+        'url',
+        'case_sensitive_names',
+        'connection_timeout',
+        'dereference_aliases',
+        'max_page_size',
+        'password_policy',
+        'request_timeout',
+        'use_pre111_group_cn_behavior',
+        'username_as_alias',
+      ];
+      this.configToggles = {
+        'LDAP Options': [
+          'starttls',
+          'insecure_tls',
+          'discoverdn',
+          'deny_null_bind',
+          'tls_min_version',
+          'tls_max_version',
+          'certificate',
+          'client_tls_cert',
+          'client_tls_key',
+          'userattr',
+          'upndomain',
+          'anonymous_group_search',
+        ],
+        'Customize User Search': ['binddn', 'userdn', 'bindpass', 'userfilter'],
+        'Customize Group Membership Search': ['groupfilter', 'groupattr', 'groupdn', 'use_token_groups'],
+        ...this.tokensGroup,
+      };
+      await login();
+      return visit('/vault/settings/auth/enable');
+    });
+    hooks.afterEach(async function () {
+      await runCmd(deleteAuthCmd(this.path), false);
+    });
+    testHelper(test);
+  });
+
+  module('oidc', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.type = 'oidc';
+      this.path = `${this.type}-${uuidv4()}`;
+      this.customSelectors = {
+        provider_config: `${GENERAL.fieldByAttr('provider_config')} .cm-editor`,
+      };
+      this.configFields = [
+        'oidc_discovery_url',
+        'default_role',
+        'jwks_ca_pem',
+        'jwks_url',
+        'oidc_response_mode',
+        'oidc_response_types',
+        'namespace_in_state',
+        'provider_config',
+        'unsupported_critical_cert_extensions',
+      ];
+      // until the vault-plugin-auth-jwt changes are released, these fields will be in the default group
+      // this test should then fail and the following line can be removed and the next line uncommented
+      this.configFields.push(...this.oidcJwtGroup['OIDC/JWT Options']);
+      // this.configToggles = this.oidcJwtGroup;
+      await login();
+      return visit('/vault/settings/auth/enable');
+    });
+    hooks.afterEach(async function () {
+      await runCmd(deleteAuthCmd(this.path), false);
+    });
+    testHelper(test);
+  });
+
+  module('okta', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.type = 'okta';
+      this.path = `${this.type}-${uuidv4()}`;
+      this.configFields = ['org_name', 'api_token', 'base_url', 'bypass_okta_mfa'];
+      this.configToggles = this.tokensGroup;
+      await login();
+      return visit('/vault/settings/auth/enable');
+    });
+    hooks.afterEach(async function () {
+      await runCmd(deleteAuthCmd(this.path), false);
+    });
+    testHelper(test);
+  });
+});
diff --git a/ui/tests/acceptance/auth/login-settings-test.js b/ui/tests/acceptance/auth/login-settings-test.js
new file mode 100644
index 00000000000..f51e1a5edf6
--- /dev/null
+++ b/ui/tests/acceptance/auth/login-settings-test.js
@@ -0,0 +1,97 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { click, fillIn, typeIn, visit, waitFor } from '@ember/test-helpers';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import customLoginHandler from 'vault/mirage/handlers/custom-login';
+import customLoginScenario from 'vault/mirage/scenarios/custom-login';
+
+// Auth form login settings
+// This feature has thorough integration test coverage so only testing a few scenarios and direct link functionality
+// Tests for read/list views are in ui/tests/acceptance/config-ui/login-settings-test.js
+module('Acceptance | Enterprise | auth form custom login settings', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    customLoginHandler(this.server);
+    customLoginScenario(this.server);
+    // mirage scenario sets:
+    // root namespace with 'token' as default backups are 'userpass' and 'ldap'
+    // 'test-ns' with 'ldap' as default and no backups
+  });
+
+  test('it renders login settings for root namespace', async function (assert) {
+    await visit('/vault/auth');
+    await waitFor(AUTH_FORM.tabBtn('token'));
+    assert.dom(AUTH_FORM.tabBtn('token')).hasAttribute('aria-selected', 'true');
+    assert.dom(AUTH_FORM.authForm('token')).exists('it renders default method');
+    assert
+      .dom(AUTH_FORM.advancedSettings)
+      .doesNotExist('it does not render advanced settings for token auth method');
+    await click(GENERAL.button('Sign in with other methods'));
+    assert
+      .dom(AUTH_FORM.tabBtn('userpass'))
+      .exists('it renders backup "Userpass" method')
+      .hasAttribute('aria-selected', 'true');
+    assert.dom(AUTH_FORM.authForm('userpass')).exists('it renders "Userpass" form when method is selected');
+    assert.dom(AUTH_FORM.advancedSettings).exists('it renders advanced settings for "Userpass"');
+    assert.dom(AUTH_FORM.tabBtn('ldap')).exists('it renders backup "LDAP" method');
+    await click(AUTH_FORM.tabBtn('ldap'));
+    assert.dom(AUTH_FORM.authForm('ldap')).exists('it renders "LDAP" form when method is selected');
+    assert.dom(AUTH_FORM.advancedSettings).exists('it renders advanced settings for "LDAP"');
+  });
+
+  test('it renders login settings for namespaces', async function (assert) {
+    await visit('/vault/auth');
+    await fillIn(GENERAL.inputByAttr('namespace'), 'test-ns');
+    await waitFor(AUTH_FORM.authForm('ldap'));
+    assert.dom(AUTH_FORM.authForm('ldap')).exists('it renders default method');
+    assert.dom(AUTH_FORM.advancedSettings).exists();
+    assert
+      .dom(GENERAL.button('Sign in with other methods'))
+      .doesNotExist('it does not render alternate view');
+
+    // All we're testing here is that the form settings update for nested namespaces.
+    // (We're not concerned with what the settings are since the mirage handler is stubbing the API logic)
+    // typeIn so that the text appends to the existing namespace input: "test-ns/child"
+    await typeIn(GENERAL.inputByAttr('namespace'), '/child');
+    await waitFor(AUTH_FORM.authForm('token'));
+    assert.dom(AUTH_FORM.authForm('token')).exists('it updates to render child namespace settings');
+    assert.dom(AUTH_FORM.authForm('ldap')).doesNotExist('it does not render default view for parent');
+  });
+
+  module('listing visibility', function (hooks) {
+    hooks.beforeEach(function () {
+      this.server.get('/sys/internal/ui/mounts', () => {
+        // Stub a visible mount that does NOT match a type in the login settings
+        return { data: { auth: { 'my_oidc/': { description: '', options: {}, type: 'oidc' } } } };
+      });
+    });
+
+    test('it ignores login settings if query param references a visible mount path', async function (assert) {
+      await visit('/vault/auth?with=my_oidc%2F');
+      await waitFor(AUTH_FORM.tabBtn('oidc'));
+      assert
+        .dom(AUTH_FORM.tabBtn('oidc'))
+        .hasAttribute('aria-selected', 'true', 'it selects tab matching query param');
+      assert.dom(AUTH_FORM.authForm('oidc')).exists();
+      assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+      await click(GENERAL.button('Sign in with other methods'));
+      assert.dom(GENERAL.selectByAttr('auth type')).exists('dropdown renders as fallback view');
+    });
+
+    test('it ignores login settings if query param references a valid type', async function (assert) {
+      await visit('/vault/auth?with=userpass');
+      assert.dom(GENERAL.selectByAttr('auth type')).hasValue('userpass', 'dropdown selects userpass');
+      await click(GENERAL.backButton);
+      assert.dom(AUTH_FORM.tabBtn('oidc')).exists('it renders tabs on "Back" because visible mounts exist');
+    });
+  });
+});
diff --git a/ui/tests/acceptance/auth/test-helper.js b/ui/tests/acceptance/auth/test-helper.js
new file mode 100644
index 00000000000..9c20ddace16
--- /dev/null
+++ b/ui/tests/acceptance/auth/test-helper.js
@@ -0,0 +1,46 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, currentURL } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+
+const assertFields = (assert, fields, customSelectors = {}) => {
+  fields.forEach((param) => {
+    if (Object.keys(customSelectors).includes(param)) {
+      assert.dom(customSelectors[param]).exists();
+    } else if (param === 'config.listing_visibility') {
+      assert.dom(GENERAL.toggleInput('toggle-config.listing_visibility')).exists();
+    } else {
+      assert.dom(GENERAL.inputByAttr(param)).exists();
+    }
+  });
+};
+export default (test) => {
+  test('it renders mount fields', async function (assert) {
+    await click(GENERAL.cardContainer(this.type));
+    // This is where the "tune" parameters are rendered.
+    await click(GENERAL.button('Method Options'));
+    assertFields(assert, this.mountFields, this.customSelectors);
+  });
+
+  test('it renders tune fields', async function (assert) {
+    // enable auth method to check tune fields
+    await mountBackend(this.type, this.path);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/settings/auth/configure/${this.path}/configuration`,
+      `${this.type}: it mounts and navigates to configuration form`
+    );
+
+    assertFields(assert, this.configFields, this.customSelectors);
+
+    for (const toggle in this.configToggles) {
+      const fields = this.configToggles[toggle];
+      await click(GENERAL.button(toggle));
+      assertFields(assert, fields, this.customSelectors);
+    }
+  });
+};
diff --git a/ui/tests/acceptance/aws-test.js b/ui/tests/acceptance/aws-test.js
deleted file mode 100644
index ee0b2bbfce8..00000000000
--- a/ui/tests/acceptance/aws-test.js
+++ /dev/null
@@ -1,90 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { click, fillIn, findAll, currentURL, find, settled, waitUntil } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import { v4 as uuidv4 } from 'uuid';
-
-import authPage from 'vault/tests/pages/auth';
-import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
-
-module('Acceptance | aws secret backend', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.uid = uuidv4();
-    return authPage.login();
-  });
-
-  test('aws backend', async function (assert) {
-    assert.expect(12);
-    const path = `aws-${this.uid}`;
-    const roleName = 'awsrole';
-
-    await enablePage.enable('aws', path);
-    await settled();
-    await click('[data-test-configuration-tab]');
-
-    await click('[data-test-secret-backend-configure]');
-
-    assert.strictEqual(currentURL(), `/vault/settings/secrets/configure/${path}`);
-    assert.ok(findAll('[data-test-aws-root-creds-form]').length, 'renders the empty root creds form');
-    assert.ok(findAll('[data-test-aws-link="root-creds"]').length, 'renders the root creds link');
-    assert.ok(findAll('[data-test-aws-link="leases"]').length, 'renders the leases config link');
-
-    await fillIn('[data-test-aws-input="accessKey"]', 'foo');
-    await fillIn('[data-test-aws-input="secretKey"]', 'bar');
-
-    await click('[data-test-aws-input="root-save"]');
-
-    assert.ok(
-      find('[data-test-flash-message]').textContent.trim(),
-      `The backend configuration saved successfully!`
-    );
-
-    await click('[data-test-aws-link="leases"]');
-
-    await click('[data-test-aws-input="lease-save"]');
-
-    assert.ok(
-      find('[data-test-flash-message]').textContent.trim(),
-      `The backend configuration saved successfully!`
-    );
-
-    await click('[data-test-backend-view-link]');
-
-    assert.strictEqual(currentURL(), `/vault/secrets/${path}/list`, `navigates to the roles list`);
-
-    await click('[data-test-secret-create]');
-
-    assert.ok(
-      find('[data-test-secret-header]').textContent.includes('AWS Role'),
-      `aws: renders the create page`
-    );
-
-    await fillIn('[data-test-input="name"]', roleName);
-
-    // save the role
-    await click('[data-test-role-aws-create]');
-    await waitUntil(() => currentURL() === `/vault/secrets/${path}/show/${roleName}`); // flaky without this
-    assert.strictEqual(
-      currentURL(),
-      `/vault/secrets/${path}/show/${roleName}`,
-      `$aws: navigates to the show page on creation`
-    );
-    await click(`[data-test-secret-breadcrumb="${path}"] a`);
-
-    assert.strictEqual(currentURL(), `/vault/secrets/${path}/list`);
-    assert.ok(findAll(`[data-test-secret-link="${roleName}"]`).length, `aws: role shows in the list`);
-
-    //and delete
-    await click(`[data-test-secret-link="${roleName}"] [data-test-popup-menu-trigger]`);
-    await waitUntil(() => find(`[data-test-aws-role-delete="${roleName}"]`)); // flaky without
-    await click(`[data-test-aws-role-delete="${roleName}"]`);
-    await click(`[data-test-confirm-button]`);
-    assert.dom(`[data-test-secret-link="${roleName}"]`).doesNotExist(`aws: role is no longer in the list`);
-  });
-});
diff --git a/ui/tests/acceptance/chroot-namespace-test.js b/ui/tests/acceptance/chroot-namespace-test.js
index 6e34c1fd0e7..b06b7b16e50 100644
--- a/ui/tests/acceptance/chroot-namespace-test.js
+++ b/ui/tests/acceptance/chroot-namespace-test.js
@@ -1,15 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { currentRouteName } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login, loginNs } from 'vault/tests/helpers/auth/auth-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import chrootNamespaceHandlers from 'vault/mirage/handlers/chroot-namespace';
-import { createTokenCmd, runCmd, tokenWithPolicyCmd } from '../helpers/commands';
+import { createTokenCmd, runCmd, tokenWithPolicyCmd } from 'vault/tests/helpers/commands';
 
 const navLink = (title) => `[data-test-sidebar-nav-link="${title}"]`;
 // Matches the chroot namespace on the mirage handler
@@ -24,36 +24,37 @@ module('Acceptance | chroot-namespace enterprise ui', function (hooks) {
   });
 
   test('it should render normally when chroot namespace exists', async function (assert) {
-    await authPage.login();
+    await login();
     assert.strictEqual(currentRouteName(), 'vault.cluster.dashboard', 'goes to dashboard page');
     assert.dom('[data-test-badge-namespace]').includesText('root', 'Shows root namespace badge');
   });
 
   test('root-only nav items are unavailable', async function (assert) {
-    await authPage.login();
+    await login();
 
-    ['Dashboard', 'Secrets Engines', 'Access', 'Tools', 'Policies', 'Client Count'].forEach((nav) => {
+    ['Dashboard', 'Secrets Engines', 'Access', 'Tools', 'Policies'].forEach((nav) => {
       assert.dom(navLink(nav)).exists(`Shows ${nav} nav item in chroot listener`);
     });
-    ['Replication', 'Raft Storage', 'License', 'Seal Vault'].forEach((nav) => {
+    // Client count is not root-only, but it is hidden for chroot
+    ['Replication', 'Raft Storage', 'License', 'Seal Vault', 'Client Count'].forEach((nav) => {
       assert.dom(navLink(nav)).doesNotExist(`Does not show ${nav} nav item in chroot listener`);
     });
 
     // cleanup namespace
-    await authPage.login();
+    await login();
     await runCmd(`delete sys/namespaces/${namespace}`);
   });
 
   test('a user with default policy should see nav items', async function (assert) {
-    await authPage.login();
+    await login();
     // Create namespace
     await runCmd(`write sys/namespaces/${namespace} -f`, false);
     // Create user within the namespace
-    await authPage.loginNs(namespace);
+    await loginNs(namespace);
     const userDefault = await runCmd(createTokenCmd());
 
-    await authPage.loginNs(namespace, userDefault);
-    ['Dashboard', 'Secrets Engines', 'Access', 'Tools'].forEach((nav) => {
+    await loginNs(namespace, userDefault);
+    [('Dashboard', 'Secrets Engines', 'Access', 'Tools')].forEach((nav) => {
       assert.dom(navLink(nav)).exists(`Shows ${nav} nav item for user with default policy`);
     });
     ['Policies', 'Client Count', 'Replication', 'Raft Storage', 'License', 'Seal Vault'].forEach((nav) => {
@@ -61,16 +62,16 @@ module('Acceptance | chroot-namespace enterprise ui', function (hooks) {
     });
 
     // cleanup namespace
-    await authPage.login();
+    await login();
     await runCmd(`delete sys/namespaces/${namespace}`);
   });
 
   test('a user with read policy should see nav items', async function (assert) {
-    await authPage.login();
+    await login();
     // Create namespace
     await runCmd(`write sys/namespaces/${namespace} -f`, false);
     // Create user within the namespace
-    await authPage.loginNs(namespace);
+    await loginNs(namespace);
     const reader = await runCmd(
       tokenWithPolicyCmd(
         'read-all',
@@ -82,25 +83,25 @@ module('Acceptance | chroot-namespace enterprise ui', function (hooks) {
       )
     );
 
-    await authPage.loginNs(namespace, reader);
-    ['Dashboard', 'Secrets Engines', 'Access', 'Policies', 'Tools', 'Client Count'].forEach((nav) => {
+    await loginNs(namespace, reader);
+    ['Dashboard', 'Secrets Engines', 'Access', 'Policies', 'Tools'].forEach((nav) => {
       assert.dom(navLink(nav)).exists(`Shows ${nav} nav item for user with read access policy`);
     });
-    ['Replication', 'Raft Storage', 'License', 'Seal Vault'].forEach((nav) => {
+    ['Replication', 'Raft Storage', 'License', 'Seal Vault', 'Client Count'].forEach((nav) => {
       assert.dom(navLink(nav)).doesNotExist(`Does not show ${nav} nav item for user with read access policy`);
     });
 
     // cleanup namespace
-    await authPage.login();
+    await login();
     await runCmd(`delete sys/namespaces/${namespace}`);
   });
 
   test('it works within a child namespace', async function (assert) {
-    await authPage.login();
+    await login();
     // Create namespace
     await runCmd(`write sys/namespaces/${namespace} -f`, false);
     // Create user within the namespace
-    await authPage.loginNs(namespace);
+    await loginNs(namespace);
     const childReader = await runCmd(
       tokenWithPolicyCmd(
         'read-child',
@@ -114,7 +115,7 @@ module('Acceptance | chroot-namespace enterprise ui', function (hooks) {
     // Create child namespace
     await runCmd(`write sys/namespaces/child -f`, false);
 
-    await authPage.loginNs(namespace, childReader);
+    await loginNs(namespace, childReader);
     ['Dashboard', 'Secrets Engines', 'Access', 'Tools'].forEach((nav) => {
       assert.dom(navLink(nav)).exists(`Shows ${nav} nav item`);
     });
@@ -122,18 +123,18 @@ module('Acceptance | chroot-namespace enterprise ui', function (hooks) {
       assert.dom(navLink(nav)).doesNotExist(`Does not show ${nav} nav item`);
     });
 
-    await authPage.loginNs(`${namespace}/child`, childReader);
-    ['Dashboard', 'Secrets Engines', 'Access', 'Policies', 'Tools', 'Client Count'].forEach((nav) => {
+    await loginNs(`${namespace}/child`, childReader);
+    ['Dashboard', 'Secrets Engines', 'Access', 'Policies', 'Tools'].forEach((nav) => {
       assert.dom(navLink(nav)).exists(`Shows ${nav} nav item within child namespace`);
     });
-    ['Replication', 'Raft Storage', 'License', 'Seal Vault'].forEach((nav) => {
+    ['Replication', 'Raft Storage', 'License', 'Seal Vault', 'Client Count'].forEach((nav) => {
       assert.dom(navLink(nav)).doesNotExist(`Does not show ${nav} nav item within child namespace`);
     });
 
     // cleanup namespaces
-    await authPage.loginNs(namespace);
+    await loginNs(namespace);
     await runCmd(`delete sys/namespaces/child`);
-    await authPage.login();
+    await login();
     await runCmd(`delete sys/namespaces/${namespace}`);
   });
 });
diff --git a/ui/tests/acceptance/clients/counts-test.js b/ui/tests/acceptance/clients/counts-test.js
index 2b9cfdf855a..52529b4059f 100644
--- a/ui/tests/acceptance/clients/counts-test.js
+++ b/ui/tests/acceptance/clients/counts-test.js
@@ -1,34 +1,54 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import clientsHandler from 'vault/mirage/handlers/clients';
+import clientsHandler, { STATIC_NOW } from 'vault/mirage/handlers/clients';
 import sinon from 'sinon';
-import { visit, click, currentURL } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
-import { SELECTORS as ts, STATIC_NOW } from 'vault/tests/helpers/clients';
+import { visit, currentURL, click } from '@ember/test-helpers';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CLIENT_COUNT } from 'vault/tests/helpers/clients/client-count-selectors';
 import timestamp from 'core/utils/timestamp';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { format } from 'date-fns';
 
 module('Acceptance | clients | counts', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => STATIC_NOW);
-  });
-
   hooks.beforeEach(async function () {
+    this.timestampStub = sinon.stub(timestamp, 'now');
+    this.timestampStub.returns(STATIC_NOW);
     clientsHandler(this.server);
     this.store = this.owner.lookup('service:store');
-    return authPage.login();
+    return login();
   });
 
-  hooks.after(function () {
-    timestamp.now.restore();
+  test('it should prompt user to query start time for community version', async function (assert) {
+    assert.expect(2);
+    this.owner.lookup('service:version').type = 'community';
+    await visit('/vault/clients/counts/overview');
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('Input the start and end dates to view client attribution by path.');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText('Only historical data may be queried. No data is available for the current month.');
+  });
+
+  test('it does not make a request to the export api on community versions', async function (assert) {
+    assert.expect(1);
+    this.owner.lookup('service:version').type = 'community';
+    server.get('/sys/internal/counters/activity/export', () => {
+      // passing "false" because a request should NOT be made, so if this assertion is hit we want it to fail
+      assert.true(false, 'it does not make request to export API on community versions ');
+    });
+    await visit('/vault/clients/counts/overview');
+    assert.dom(GENERAL.tab('client list')).doesNotExist();
   });
 
   test('it should redirect to counts overview route for transitions to parent', async function (assert) {
@@ -36,25 +56,142 @@ module('Acceptance | clients | counts', function (hooks) {
     assert.strictEqual(currentURL(), '/vault/clients/counts/overview', 'Redirects to counts overview route');
   });
 
-  test('it should persist filter query params between child routes', async function (assert) {
+  test('it should render empty state if no permission to query activity data', async function (assert) {
+    assert.expect(2);
+    server.get('/sys/internal/counters/activity', () => {
+      return overrideResponse(403);
+    });
     await visit('/vault/clients/counts/overview');
-    await click(ts.rangeDropdown);
-    await click(ts.currentBillingPeriod);
-    const timeQueryRegex = /end_time=\d+&start_time=\d+/g;
-    assert.ok(currentURL().match(timeQueryRegex).length, 'Start and end times added as query params');
-
-    await click(ts.tab('token'));
-    assert.ok(
-      currentURL().match(timeQueryRegex).length,
-      'Start and end times persist through child route change'
-    );
-
-    await click(ts.navLink('Dashboard'));
-    await click(ts.navLink('Client Count'));
-    assert.strictEqual(
-      currentURL(),
-      '/vault/clients/counts/overview',
-      'Query params are reset when exiting route'
-    );
+    assert.dom(GENERAL.emptyStateTitle).hasText('You are not authorized');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'You must be granted permissions to view this page. Ask your administrator if you think you should have access to the /v1/sys/internal/counters/activity endpoint.'
+      );
+  });
+
+  test('it should use the response start_time as the timestamp', async function (assert) {
+    const getCounts = () => {
+      return {
+        acme_clients: 0,
+        clients: 0,
+        entity_clients: 0,
+        non_entity_clients: 0,
+        secret_syncs: 0,
+        distinct_entities: 0,
+        non_entity_tokens: 1,
+      };
+    };
+    // set to enterprise because when community the initial activity call is skipped
+    this.owner.lookup('service:version').type = 'enterprise';
+    this.server.get('/sys/internal/counters/activity', function () {
+      return {
+        request_id: 'some-activity-id',
+        data: {
+          start_time: '2023-04-01T00:00:00Z', // API returns complete billing cycles, so we use this date as the source of truth
+          end_time: '2023-04-30T00:00:00Z',
+          by_namespace: [],
+          months: [
+            {
+              timestamp: '2023-04-01T00:00:00Z',
+              counts: getCounts(),
+              namespaces: [
+                {
+                  namespace_id: 'root',
+                  namespace_path: '',
+                  counts: getCounts(),
+                  mounts: [
+                    {
+                      mount_path: 'auth/userpass-0',
+                      counts: getCounts(),
+                    },
+                  ],
+                },
+              ],
+              new_clients: {
+                counts: getCounts(),
+                namespaces: [
+                  {
+                    namespace_id: 'root',
+                    namespace_path: '',
+                    counts: getCounts(),
+                    mounts: [
+                      {
+                        mount_path: 'auth/userpass-0',
+                        counts: getCounts(),
+                      },
+                    ],
+                  },
+                ],
+              },
+            },
+          ],
+          total: getCounts(),
+        },
+      };
+    });
+    await visit('/vault/clients/counts/overview');
+    assert.dom(CLIENT_COUNT.dateRange.dateDisplay('start')).hasText('April 2023');
+    assert.dom(CLIENT_COUNT.dateRange.dateDisplay('end')).hasText('April 2023');
+  });
+
+  module('manual refresh', function (hooks) {
+    hooks.beforeEach(async function () {
+      const router = this.owner.lookup('service:router');
+      this.refreshSpy = sinon.spy(router, 'refresh');
+      return login();
+    });
+
+    // Date querying is different in CE vs Enterprise, but the refresh behaves the same.
+    // For simplicity, just test this action on enterprise versions.
+    test('enterprise: it refreshes the overview route and preserves query params', async function (assert) {
+      await visit('/vault/clients/counts/overview');
+      assert.strictEqual(currentURL(), '/vault/clients/counts/overview', 'current view is the overview page');
+      // Change date to add query params
+      await click(CLIENT_COUNT.dateRange.edit);
+      await click(CLIENT_COUNT.dateRange.dropdownOption(1));
+      assert
+        .dom(CLIENT_COUNT.activityTimestamp)
+        .hasTextContaining(`Dashboard last updated: ${format(STATIC_NOW, 'MMM d yyyy')}`);
+      // Save URL with query params before clicking refresh
+      const url = currentURL();
+      // re-stub with a completely different year/month/day before clicking refresh
+      // to mock the timestamp updating when page reloads
+      const fakeUpdatedNow = new Date('2025-07-02T23:25:13Z');
+      this.timestampStub.returns(fakeUpdatedNow);
+      await click(GENERAL.button('Refresh page'));
+      assert.true(this.refreshSpy.calledOnce, 'router.refresh() is called once');
+      assert.strictEqual(currentURL(), url, 'url is the same after clicking refresh');
+      assert
+        .dom(CLIENT_COUNT.activityTimestamp)
+        .hasTextContaining(`Dashboard last updated: ${format(fakeUpdatedNow, 'MMM d yyyy')}`);
+    });
+
+    test('enterprise: it refreshes the client-list route and preserves query params', async function (assert) {
+      await visit('/vault/clients/counts/client-list');
+      assert.strictEqual(
+        currentURL(),
+        '/vault/clients/counts/client-list',
+        'current view is the client-list page'
+      );
+      // Change date to add query params
+      await click(CLIENT_COUNT.dateRange.edit);
+      await click(CLIENT_COUNT.dateRange.dropdownOption(1));
+      assert
+        .dom(CLIENT_COUNT.activityTimestamp)
+        .hasTextContaining(`Dashboard last updated: ${format(STATIC_NOW, 'MMM d yyyy')}`);
+      // Save URL with query params before clicking refresh
+      const url = currentURL();
+      // re-stub with a completely different year/month/day before clicking refresh
+      // to mock the timestamp updating when page reloads
+      const fakeUpdatedNow = new Date('2025-07-02T23:25:13Z');
+      this.timestampStub.returns(fakeUpdatedNow);
+      await click(GENERAL.button('Refresh page'));
+      assert.true(this.refreshSpy.calledOnce, 'router.refresh() is called once');
+      assert.strictEqual(currentURL(), url, 'url is the same after clicking refresh');
+      assert
+        .dom(CLIENT_COUNT.activityTimestamp)
+        .hasTextContaining(`Dashboard last updated: ${format(fakeUpdatedNow, 'MMM d yyyy')}`);
+    });
   });
 });
diff --git a/ui/tests/acceptance/clients/counts/client-list-test.js b/ui/tests/acceptance/clients/counts/client-list-test.js
new file mode 100644
index 00000000000..1b6814c9336
--- /dev/null
+++ b/ui/tests/acceptance/clients/counts/client-list-test.js
@@ -0,0 +1,133 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { visit, click, currentURL } from '@ember/test-helpers';
+import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { ClientFilters } from 'core/utils/client-count-utils';
+import { CLIENT_COUNT, FILTERS } from 'vault/tests/helpers/clients/client-count-selectors';
+import { ACTIVITY_EXPORT_STUB } from 'vault/tests/helpers/clients/client-count-helpers';
+import timestamp from 'core/utils/timestamp';
+import clientsHandler, { STATIC_NOW } from 'vault/mirage/handlers/clients';
+
+// integration test handle general display assertions, acceptance handles nav + filtering
+module('Acceptance | clients | counts | client list', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    //* Community version setup
+    // This tab is hidden on community this setup is stubbed for consistent test running on either version
+    this.version = this.owner.lookup('service:version');
+    this.version.type = 'enterprise';
+    // Return a consistent billing start timestamp for community versions
+    sinon.replace(timestamp, 'now', sinon.fake.returns(STATIC_NOW));
+    clientsHandler(this.server);
+    //* End CE setup
+
+    // The activity export endpoint returns a ReadableStream of json lines, this is not easily mocked using mirage.
+    // Stubbing the adapter method return instead.
+    const mockResponse = {
+      status: 200,
+      ok: true,
+      text: () => Promise.resolve(ACTIVITY_EXPORT_STUB.trim()),
+    };
+    const store = this.owner.lookup('service:store');
+    const adapter = store.adapterFor('clients/activity');
+    this.exportDataStub = sinon.stub(adapter, 'exportData');
+    this.exportDataStub.resolves(mockResponse);
+    await login();
+    return visit('/vault');
+  });
+
+  hooks.afterEach(async function () {
+    this.exportDataStub.restore();
+  });
+
+  test('it hides client list tab on community', async function (assert) {
+    this.version.type = 'community';
+    assert.dom(GENERAL.tab('client list')).doesNotExist();
+  });
+
+  test('it navigates to client list tab', async function (assert) {
+    assert.expect(3);
+    await click(GENERAL.navLink('Client Count'));
+    await click(GENERAL.tab('client list'));
+    assert.strictEqual(currentURL(), '/vault/clients/counts/client-list', 'it navigates to client list tab');
+    assert.dom(GENERAL.tab('client list')).hasClass('active');
+    await click(GENERAL.navLink('Back to main navigation'));
+    assert.strictEqual(currentURL(), '/vault/dashboard', 'it navigates back to dashboard');
+  });
+
+  test('filters are preset if URL includes query params', async function (assert) {
+    assert.expect(4);
+    const ns = 'ns2/';
+    const mPath = 'auth/userpass/';
+    const mType = 'userpass';
+    await visit(
+      `vault/clients/counts/client-list?namespace_path=${ns}&mount_path=${mPath}&mount_type=${mType}`
+    );
+    assert.dom(FILTERS.tag()).exists({ count: 3 }, '3 filter tags render');
+    assert.dom(FILTERS.tag(ClientFilters.NAMESPACE, ns)).exists();
+    assert.dom(FILTERS.tag(ClientFilters.MOUNT_PATH, mPath)).exists();
+    assert.dom(FILTERS.tag(ClientFilters.MOUNT_TYPE, mType)).exists();
+  });
+
+  test('selecting filters update URL query params', async function (assert) {
+    assert.expect(3);
+    const ns = 'ns2/';
+    const mPath = 'auth/userpass/';
+    const mType = 'userpass';
+    const url = '/vault/clients/counts/client-list';
+    await visit(url);
+    assert.strictEqual(currentURL(), url, 'URL does not contain query params');
+    // select namespace
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    await click(FILTERS.dropdownItem(ns));
+    // select mount path
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    await click(FILTERS.dropdownItem(mPath));
+    // select mount type
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    await click(FILTERS.dropdownItem(mType));
+    assert.strictEqual(
+      currentURL(),
+      `${url}?mount_path=${encodeURIComponent(mPath)}&mount_type=${mType}&namespace_path=${encodeURIComponent(
+        ns
+      )}`,
+      'url query params match filters'
+    );
+    await click(GENERAL.button('Clear filters'));
+    assert.strictEqual(currentURL(), url, '"Clear filters" resets URL query params');
+  });
+
+  test('it renders error message if export has no data', async function (assert) {
+    this.exportDataStub.throws(new Error('No data to export in provided time range.'));
+    await visit('/vault/clients/counts/client-list');
+    await click(CLIENT_COUNT.dateRange.edit);
+    await click(CLIENT_COUNT.dateRange.dropdownOption(4));
+    assert.dom(GENERAL.emptyStateTitle).hasText('No data found');
+    assert.dom(GENERAL.emptyStateMessage).hasText('No data to export in provided time range.');
+    // Assert the empty state message renders below the page header so user can query other dates
+    assert.dom(GENERAL.tab('overview')).exists('Overview tab still renders');
+    assert.dom(GENERAL.tab('client list')).exists('Client list tab still renders');
+  });
+
+  test('it renders error message for permission denied', async function (assert) {
+    this.exportDataStub.throws(new Error('permission denied'));
+    await visit('/vault/clients/counts/client-list');
+    await click(CLIENT_COUNT.dateRange.edit);
+    await click(CLIENT_COUNT.dateRange.dropdownOption(4));
+    assert.dom(GENERAL.emptyStateTitle).hasText('Error');
+    assert.dom(GENERAL.emptyStateMessage).hasText('permission denied');
+    // Assert the empty state message renders below the page header so user can query other dates
+    assert.dom(GENERAL.tab('overview')).exists('Overview tab still renders');
+    assert.dom(GENERAL.tab('client list')).exists('Client list tab still renders');
+  });
+});
diff --git a/ui/tests/acceptance/clients/counts/overview-test.js b/ui/tests/acceptance/clients/counts/overview-test.js
index 65b7773ffd9..2bb540294e3 100644
--- a/ui/tests/acceptance/clients/counts/overview-test.js
+++ b/ui/tests/acceptance/clients/counts/overview-test.js
@@ -1,243 +1,356 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import clientsHandler from 'vault/mirage/handlers/clients';
+import clientsHandler, {
+  STATIC_NOW,
+  LICENSE_START,
+  UPGRADE_DATE,
+  STATIC_PREVIOUS_MONTH,
+} from 'vault/mirage/handlers/clients';
+import syncHandler from 'vault/mirage/handlers/sync';
 import sinon from 'sinon';
-import { visit, click, findAll, find, settled } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
-import { ARRAY_OF_MONTHS } from 'core/utils/date-formatters';
-import { SELECTORS, STATIC_NOW, LICENSE_START, UPGRADE_DATE } from 'vault/tests/helpers/clients';
-import { create } from 'ember-cli-page-object';
-import { clickTrigger } from 'ember-power-select/test-support/helpers';
-import { formatNumber } from 'core/helpers/format-number';
+import { visit, click, findAll, fillIn, currentURL } from '@ember/test-helpers';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CHARTS, CLIENT_COUNT, FILTERS } from 'vault/tests/helpers/clients/client-count-selectors';
 import timestamp from 'core/utils/timestamp';
-import ss from 'vault/tests/pages/components/search-select';
-
-const searchSelect = create(ss);
+import {
+  ACTIVITY_EXPORT_STUB,
+  ACTIVITY_RESPONSE_STUB,
+} from 'vault/tests/helpers/clients/client-count-helpers';
+import { ClientFilters, flattenMounts } from 'core/utils/client-count-utils';
+import { parseAPITimestamp } from 'core/utils/date-formatters';
 
 module('Acceptance | clients | overview', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => STATIC_NOW);
-  });
-
   hooks.beforeEach(async function () {
+    sinon.replace(timestamp, 'now', sinon.fake.returns(STATIC_NOW));
+    // These tests use the clientsHandler which dynamically generates activity data, used for asserting date querying, etc
     clientsHandler(this.server);
     this.store = this.owner.lookup('service:store');
-    await authPage.login();
-    return visit('/vault/clients/counts/overview');
+    this.version = this.owner.lookup('service:version');
   });
 
-  hooks.after(function () {
-    timestamp.now.restore();
+  test('it should hide secrets sync stats when feature is NOT on license', async function (assert) {
+    // mocks endpoint for no additional license modules
+    this.server.get('/sys/license/features', () => ({ features: [] }));
+
+    await login();
+    await visit('/vault/clients/counts/overview');
+    assert.dom(CLIENT_COUNT.statLegendValue('Secret sync clients')).doesNotExist();
+    assert.dom(CLIENT_COUNT.statLegendValue('Entity clients')).exists('other stats are still visible');
+
+    await click(GENERAL.inputByAttr('toggle view'));
+    assert.dom(CHARTS.legend).hasText('Entity clients Non-entity clients ACME clients');
   });
 
   test('it should render charts', async function (assert) {
+    await login();
+    await visit('/vault/clients/counts/overview');
+    assert
+      .dom(`${GENERAL.flashMessage}.is-info`)
+      .includesText(
+        'counts returned in this usage period are an estimate',
+        'Shows warning from API about client count estimations'
+      );
     assert
-      .dom(SELECTORS.counts.startMonth)
-      .hasText('July 2022', 'billing start month is correctly parsed from license');
+      .dom(CLIENT_COUNT.dateRange.dateDisplay('start'))
+      .hasText('July 2023', 'start month is correctly parsed from license');
     assert
-      .dom(SELECTORS.rangeDropdown)
-      .hasText(`Jul 2022 - Jan 2023`, 'Date range shows dates correctly parsed activity response');
-    assert.dom(SELECTORS.attributionBlock).exists('Shows attribution area');
+      .dom(CLIENT_COUNT.dateRange.dateDisplay('end'))
+      .hasText('January 2024', 'end month is correctly parsed from STATIC_NOW');
     assert
-      .dom(SELECTORS.charts.chart('running total'))
+      .dom(CLIENT_COUNT.card('Client usage trends for selected billing period'))
       .exists('Shows running totals with monthly breakdown charts');
     assert
-      .dom(SELECTORS.charts.line.xAxisLabel)
-      .hasText(`7/22`, 'x-axis labels start with billing start date');
-    assert.strictEqual(
-      findAll('[data-test-line-chart="plot-point"]').length,
-      6,
-      `line chart plots 6 points to match query`
-    );
+      .dom(`${CLIENT_COUNT.card('Client usage trends for selected billing period')} ${CHARTS.xAxisLabel}`)
+      .hasText('7/23', 'x-axis labels start with billing start date');
+    assert.dom(CHARTS.xAxisLabel).exists({ count: 7 }, 'chart months matches query');
   });
 
-  test('it should update charts when querying date ranges', async function (assert) {
-    // query for single, historical month with no new counts
-    await click(SELECTORS.rangeDropdown);
-    await click('[data-test-show-calendar]');
-    if (parseInt(find('[data-test-display-year]').innerText) > LICENSE_START.getFullYear()) {
-      await click('[data-test-previous-year]');
-    }
-    await click(`[data-test-calendar-month=${ARRAY_OF_MONTHS[LICENSE_START.getMonth()]}]`);
-    assert
-      .dom(SELECTORS.runningTotalMonthStats)
-      .doesNotExist('running total single month stat boxes do not show');
-    assert
-      .dom(SELECTORS.charts.chart('running total'))
-      .doesNotExist('running total month over month charts do not show');
-    assert.dom(SELECTORS.attributionBlock).exists('attribution area shows');
-    assert
-      .dom('[data-test-chart-container="new-clients"] [data-test-component="empty-state"]')
-      .exists('new client attribution has empty state');
-    assert
-      .dom('[data-test-empty-state-subtext]')
-      .hasText('There are no new clients for this namespace during this time period.    ');
-    assert.dom('[data-test-chart-container="total-clients"]').exists('total client attribution chart shows');
-
-    // reset to billing period
-    await click(SELECTORS.rangeDropdown);
-    await click('[data-test-current-billing-period]');
-
-    // change billing start to month/year of first upgrade
-    await click(SELECTORS.counts.startEdit);
-    await click(SELECTORS.monthDropdown);
-    await click(`[data-test-dropdown-month="${ARRAY_OF_MONTHS[UPGRADE_DATE.getMonth()]}"]`);
-    await click(SELECTORS.yearDropdown);
-    await click(`[data-test-dropdown-year="${UPGRADE_DATE.getFullYear()}"]`);
-    await click('[data-test-date-dropdown-submit]');
-    assert.dom(SELECTORS.attributionBlock).exists('Shows attribution area');
-    assert
-      .dom(SELECTORS.charts.chart('running total'))
-      .exists('Shows running totals with monthly breakdown charts');
-    assert
-      .dom(SELECTORS.charts.line.xAxisLabel)
-      .hasText(`8/22`, 'x-axis labels start with updated billing start month');
-    assert.strictEqual(
-      findAll('[data-test-line-chart="plot-point"]').length,
-      6,
-      `line chart plots 6 points to match query`
-    );
-
-    // query three months ago (Oct 2022)
-    await click(SELECTORS.rangeDropdown);
-    await click('[data-test-show-calendar]');
-    await click('[data-test-previous-year]');
-    await click('[data-test-calendar-month="October"]');
-
-    assert.dom(SELECTORS.attributionBlock).exists('Shows attribution area');
-    assert
-      .dom(SELECTORS.charts.chart('running total'))
-      .exists('Shows running totals with monthly breakdown charts');
-    assert.strictEqual(
-      findAll('[data-test-line-chart="plot-point"]').length,
-      3,
-      `line chart plots 3 points to match query`
-    );
-    const xAxisLabels = findAll(SELECTORS.charts.line.xAxisLabel);
-    assert
-      .dom(xAxisLabels[xAxisLabels.length - 1])
-      .hasText(`10/22`, 'x-axis labels end with queried end month');
+  module('community', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.version.type = 'community';
+      await login();
+      return await visit('/vault/clients/counts/overview');
+    });
 
-    // query for single, historical month (upgrade month)
-    await click(SELECTORS.rangeDropdown);
-    await click('[data-test-show-calendar]');
-    assert.dom('[data-test-display-year]').hasText('2022');
-    await click('[data-test-calendar-month="August"]');
+    test('it should update charts when querying date ranges', async function (assert) {
+      // Use parseAPITimestamp because we want a date string that is timezone agnostic (so it stays in UTC)
+      const clientCountingStartDate = parseAPITimestamp(LICENSE_START.toISOString(), 'yyyy-MM');
+      const upgradeMonth = parseAPITimestamp(UPGRADE_DATE.toISOString(), 'yyyy-MM');
+      const endMonth = parseAPITimestamp(STATIC_PREVIOUS_MONTH.toISOString(), 'yyyy-MM');
+      await click(CLIENT_COUNT.dateRange.edit);
+      await fillIn(CLIENT_COUNT.dateRange.editDate('start'), clientCountingStartDate);
+      await fillIn(CLIENT_COUNT.dateRange.editDate('end'), clientCountingStartDate);
+      await click(GENERAL.submitButton);
+      assert
+        .dom(CLIENT_COUNT.usageStats('Client usage'))
+        .exists('running total single month usage stats show');
+      assert
+        .dom(CLIENT_COUNT.card('Client usage trends for selected billing period'))
+        .doesNotExist('running total month over month charts do not show');
 
-    assert.dom(SELECTORS.runningTotalMonthStats).exists('running total single month stat boxes show');
-    assert
-      .dom(SELECTORS.charts.chart('running total'))
-      .doesNotExist('running total month over month charts do not show');
-    assert.dom(SELECTORS.attributionBlock).exists('attribution area shows');
-    assert.dom('[data-test-chart-container="new-clients"]').exists('new client attribution chart shows');
-    assert.dom('[data-test-chart-container="total-clients"]').exists('total client attribution chart shows');
-
-    // reset to billing period
-    await click(SELECTORS.rangeDropdown);
-    await click('[data-test-current-billing-period]');
-    // query month older than count start date
-    await click(SELECTORS.counts.startEdit);
-    await click(SELECTORS.monthDropdown);
-    await click(`[data-test-dropdown-month="${ARRAY_OF_MONTHS[LICENSE_START.getMonth()]}"]`);
-    await click(SELECTORS.yearDropdown);
-    await click(`[data-test-dropdown-year="${LICENSE_START.getFullYear() - 3}"]`);
-    await click('[data-test-date-dropdown-submit]');
-    assert
-      .dom(SELECTORS.counts.startDiscrepancy)
-      .hasTextContaining(
-        `We only have data from January 2022`,
-        'warning banner displays that date queried was prior to count start date'
-      );
+      // change to start on month/year of upgrade to 1.10
+      await click(CLIENT_COUNT.dateRange.edit);
+      await fillIn(CLIENT_COUNT.dateRange.editDate('start'), upgradeMonth);
+      await fillIn(CLIENT_COUNT.dateRange.editDate('end'), endMonth);
+      await click(GENERAL.submitButton);
+
+      assert
+        .dom(CLIENT_COUNT.dateRange.dateDisplay('start'))
+        .hasText('September 2023', 'client count start month is correctly parsed from start query');
+      assert
+        .dom(CLIENT_COUNT.card('Client usage trends for selected billing period'))
+        .exists('Shows running totals with monthly breakdown charts');
+      assert
+        .dom(`${CLIENT_COUNT.card('Client usage trends for selected billing period')} ${CHARTS.xAxisLabel}`)
+        .hasText('9/23', 'x-axis labels start with queried start month (upgrade date)');
+      assert.dom(CHARTS.xAxisLabel).exists({ count: 4 }, 'chart months matches query');
+
+      // query for single, historical month (upgrade month)
+      await click(CLIENT_COUNT.dateRange.edit);
+      await fillIn(CLIENT_COUNT.dateRange.editDate('start'), upgradeMonth);
+      await fillIn(CLIENT_COUNT.dateRange.editDate('end'), upgradeMonth);
+      await click(GENERAL.submitButton);
+      assert
+        .dom(CLIENT_COUNT.card('Client usage trends for selected billing period'))
+        .exists('running total month over month charts show');
+
+      // query historical date range (from September 2023 to December 2023)
+      await click(CLIENT_COUNT.dateRange.edit);
+      await fillIn(CLIENT_COUNT.dateRange.editDate('start'), '2023-09');
+      await fillIn(CLIENT_COUNT.dateRange.editDate('end'), '2023-12');
+      await click(GENERAL.submitButton);
+
+      assert
+        .dom(CLIENT_COUNT.dateRange.dateDisplay('start'))
+        .hasText('September 2023', 'it displays correct start time');
+      assert
+        .dom(CLIENT_COUNT.dateRange.dateDisplay('end'))
+        .hasText('December 2023', 'it displays correct end time');
+      assert
+        .dom(CLIENT_COUNT.card('Client usage trends for selected billing period'))
+        .exists('Shows running totals with monthly breakdown charts');
+
+      assert.dom(CHARTS.xAxisLabel).exists({ count: 4 }, 'chart months matches query');
+      const xAxisLabels = findAll(CHARTS.xAxisLabel);
+      assert
+        .dom(xAxisLabels[xAxisLabels.length - 1])
+        .hasText('12/23', 'x-axis labels end with queried end month');
+    });
+
+    test('it does not render client list links for community versions', async function (assert) {
+      assert
+        .dom(`${GENERAL.tableData(0, 'clients')} a`)
+        .doesNotExist('client counts do not render as hyperlinks');
+    });
   });
 
-  test('totals filter correctly with full data', async function (assert) {
-    assert
-      .dom(SELECTORS.charts.chart('running total'))
-      .exists('Shows running totals with monthly breakdown charts');
-    assert.dom(SELECTORS.attributionBlock).exists('Shows attribution area');
-
-    const response = await this.store.peekRecord('clients/activity', 'some-activity-id');
-    // FILTER BY NAMESPACE
-    await clickTrigger();
-    await searchSelect.options.objectAt(0).click();
-    await settled();
-    const topNamespace = response.byNamespace[0];
-    const topMount = topNamespace.mounts[0];
-
-    assert.dom(SELECTORS.selectedNs).hasText(topNamespace.label, 'selects top namespace');
-    assert.dom('[data-test-top-attribution]').includesText('Top auth method');
-    assert
-      .dom(SELECTORS.charts.statTextValue('Entity clients'))
-      .includesText(`${formatNumber([topNamespace.entity_clients])}`, 'total entity clients is accurate');
-    assert
-      .dom(SELECTORS.charts.statTextValue('Non-entity clients'))
-      .includesText(
-        `${formatNumber([topNamespace.non_entity_clients])}`,
-        'total non-entity clients is accurate'
+  // * FILTERING ASSERTIONS
+  // These tests use the static data from the ACTIVITY_RESPONSE_STUB to assert filtering
+  // Filtering tests are split between integration and acceptance tests
+  // because changing filters updates the URL query params.
+  module('static data', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.server.get('sys/internal/counters/activity', () => {
+        return {
+          request_id: 'some-activity-id',
+          data: ACTIVITY_RESPONSE_STUB,
+        };
+      });
+      const staticActivity = await this.store.findRecord('clients/activity', 'some-activity-id');
+      this.staticMostRecentMonth = staticActivity.byMonth[staticActivity.byMonth.length - 1];
+      await login();
+      return visit('/vault/clients/counts/overview');
+    });
+
+    test('it filters attribution table when filters are applied', async function (assert) {
+      const url = '/vault/clients/counts/overview';
+      const topMount = flattenMounts(this.staticMostRecentMonth.new_clients.namespaces)[0];
+      const timestamp = this.staticMostRecentMonth.timestamp;
+      const { namespace_path, mount_type, mount_path } = topMount;
+      assert.strictEqual(currentURL(), url, 'URL does not contain query params');
+      await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+      await click(FILTERS.dropdownItem(timestamp));
+      await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+      await click(FILTERS.dropdownItem(namespace_path));
+      await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+      await click(FILTERS.dropdownItem(mount_path));
+      await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+      await click(FILTERS.dropdownItem(mount_type));
+      assert.strictEqual(
+        currentURL(),
+        `${url}?month=${encodeURIComponent(timestamp)}&mount_path=${encodeURIComponent(
+          mount_path
+        )}&mount_type=${mount_type}&namespace_path=${namespace_path}`,
+        'url query params match filters'
       );
-    // * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-    // assert
-    //   .dom(SELECTORS.charts.statTextValue('Secrets sync clients'))
-    //   .includesText(`${formatNumber([topNamespace.secret_syncs])}`, 'total sync clients is accurate');
-    assert
-      .dom('[data-test-attribution-clients] p')
-      .includesText(`${formatNumber([topMount.clients])}`, 'top attribution clients accurate');
+      assert.dom(FILTERS.tag()).exists({ count: 4 }, '4 filter tags render');
+      assert.dom(GENERAL.tableRow()).exists({ count: 1 }, 'it only renders the filtered table row');
+      assert.dom(GENERAL.tableData(0, 'namespace_path')).hasText(namespace_path);
+      assert.dom(GENERAL.tableData(0, 'mount_type')).hasText(mount_type);
+      assert.dom(GENERAL.tableData(0, 'mount_path')).hasText(mount_path);
+    });
 
-    // FILTER BY AUTH METHOD
-    await clickTrigger();
-    await searchSelect.options.objectAt(0).click();
-    await settled();
+    test('it updates table when filters are cleared', async function (assert) {
+      const url = '/vault/clients/counts/overview';
+      const mounts = flattenMounts(this.staticMostRecentMonth.new_clients.namespaces);
+      const timestamp = this.staticMostRecentMonth.timestamp;
+      const { namespace_path, mount_type, mount_path } = mounts[0];
+      await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+      await click(FILTERS.dropdownItem(timestamp));
+      await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+      await click(FILTERS.dropdownItem(namespace_path));
+      await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+      await click(FILTERS.dropdownItem(mount_path));
+      await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+      await click(FILTERS.dropdownItem(mount_type));
+      assert.dom(GENERAL.tableRow()).exists({ count: 1 }, 'it only renders the filtered table row');
+      await click(FILTERS.clearTag(namespace_path));
+      assert.strictEqual(
+        currentURL(),
+        `${url}?month=${encodeURIComponent(timestamp)}&mount_path=${encodeURIComponent(
+          mount_path
+        )}&mount_type=${mount_type}`,
+        'url does not have namespace_path query param'
+      );
+      assert.dom(GENERAL.tableRow()).exists({ count: 2 }, 'it renders 2 data rows that match filters');
+      assert.dom(GENERAL.tableData(0, 'namespace_path')).hasText('root');
+      assert.dom(GENERAL.tableData(0, 'mount_type')).hasText(mount_type);
+      assert.dom(GENERAL.tableData(1, 'namespace_path')).hasText('ns1/');
+      assert.dom(GENERAL.tableData(1, 'mount_type')).hasText(mount_type);
+      assert.dom(GENERAL.tableData(1, 'mount_path')).hasText(mount_path);
+      await click(GENERAL.button('Clear filters'));
+      assert.strictEqual(currentURL(), url, 'url does not have any query params');
+      assert
+        .dom(GENERAL.tableRow())
+        .exists({ count: mounts.length }, 'it renders all data when filters are cleared');
+    });
 
-    assert.ok(true, 'Filter by first auth method');
-    assert.dom(SELECTORS.selectedAuthMount).hasText(topMount.label, 'selects top mount');
-    assert
-      .dom(SELECTORS.charts.statTextValue('Entity clients'))
-      .includesText(`${formatNumber([topMount.entity_clients])}`, 'total entity clients is accurate');
-    assert
-      .dom(SELECTORS.charts.statTextValue('Non-entity clients'))
-      .includesText(`${formatNumber([topMount.non_entity_clients])}`, 'total non-entity clients is accurate');
-    // * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-    // assert
-    //   .dom(SELECTORS.charts.statTextValue('Secrets sync clients'))
-    //   .includesText(`${formatNumber([topMount.secret_syncs])}`, 'total sync clients is accurate');
-    assert.dom(SELECTORS.attributionBlock).doesNotExist('Does not show attribution block');
-
-    await click('#namespace-search-select [data-test-selected-list-button="delete"]');
-    assert.ok(true, 'Remove namespace filter without first removing auth method filter');
-    assert.dom('[data-test-top-attribution]').includesText('Top namespace');
-    assert
-      .dom(SELECTORS.charts.statTextValue('Entity clients'))
-      .hasTextContaining(
-        `${formatNumber([response.total.entity_clients])}`,
-        'total entity clients is back to unfiltered value'
+    test('it renders client counts for full billing period when month is unselected', async function (assert) {
+      const url = '/vault/clients/counts/overview';
+      const mounts = flattenMounts(this.staticMostRecentMonth.new_clients.namespaces);
+      const timestamp = this.staticMostRecentMonth.timestamp;
+      const { namespace_path, mount_type, mount_path } = mounts[0];
+      await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+      await click(FILTERS.dropdownItem(timestamp));
+      await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+      await click(FILTERS.dropdownItem(namespace_path));
+      await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+      await click(FILTERS.dropdownItem(mount_path));
+      await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+      await click(FILTERS.dropdownItem(mount_type));
+      assert.strictEqual(
+        currentURL(),
+        `${url}?month=${encodeURIComponent(timestamp)}&mount_path=${encodeURIComponent(
+          mount_path
+        )}&mount_type=${mount_type}&namespace_path=${namespace_path}`,
+        'url query params match filters'
       );
-    assert
-      .dom(SELECTORS.charts.statTextValue('Non-entity clients'))
-      .hasTextContaining(
-        `${formatNumber([formatNumber([response.total.non_entity_clients])])}`,
-        'total non-entity clients is back to unfiltered value'
+      await click(FILTERS.clearTag('September 2023'));
+      assert
+        .dom(GENERAL.tableData(0, 'clients'))
+        .hasText('4003', 'the table renders clients for the full billing period (not September)');
+      assert.strictEqual(
+        currentURL(),
+        `${url}?mount_path=${encodeURIComponent(
+          mount_path
+        )}&mount_type=${mount_type}&namespace_path=${namespace_path}`,
+        'url does not include month'
       );
-    // * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-    // assert
-    //   .dom(SELECTORS.charts.statTextValue('Secrets sync clients'))
-    //   .hasTextContaining(
-    //     `${formatNumber([formatNumber([response.total.secret_syncs])])}`,
-    //     'total sync clients is back to unfiltered value'
-    //   );
-    assert
-      .dom('[data-test-attribution-clients]')
-      .hasTextContaining(
-        `${formatNumber([topNamespace.clients])}`,
-        'top attribution clients back to unfiltered value'
+    });
+
+    test('enterprise: it navigates to the client list page when clicking the client count hyperlink', async function (assert) {
+      const mockResponse = {
+        status: 200,
+        ok: true,
+        text: () => Promise.resolve(ACTIVITY_EXPORT_STUB.trim()),
+      };
+      const adapter = this.store.adapterFor('clients/activity');
+      const exportDataStub = sinon.stub(adapter, 'exportData');
+      exportDataStub.resolves(mockResponse);
+      const timestamp = this.staticMostRecentMonth.timestamp;
+      await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+      await click(FILTERS.dropdownItem(timestamp));
+      await click(`${GENERAL.tableData(0, 'clients')} a`);
+      const url = '/vault/clients/counts/client-list';
+      const monthQp = encodeURIComponent(timestamp);
+      const ns = encodeURIComponent('ns1/');
+      const mPath = encodeURIComponent('auth/userpass/0/');
+      const mType = 'userpass';
+      assert.strictEqual(
+        currentURL(),
+        `${url}?month=${monthQp}&mount_path=${mPath}&mount_type=${mType}&namespace_path=${ns}`,
+        'url query params match filters'
       );
+      exportDataStub.restore();
+    });
+  });
+
+  module('license includes secrets sync feature', function (hooks) {
+    hooks.beforeEach(async function () {
+      syncHandler(this.server);
+    });
+
+    test('it should show secrets sync stats when the feature is activated', async function (assert) {
+      await login();
+      await visit('/vault/clients/counts/overview');
+      assert
+        .dom(CLIENT_COUNT.statLegendValue('Secret sync clients'))
+        .exists('shows secret sync data on overview');
+      await click(GENERAL.inputByAttr('toggle view'));
+      assert
+        .dom(CHARTS.legend)
+        .hasText(
+          'Entity clients Non-entity clients ACME clients Secret sync clients',
+          'it renders legend in order that matches the stacked bar data'
+        );
+    });
+
+    test('it should hide secrets sync stats when feature is NOT activated', async function (assert) {
+      this.server.get('/sys/activation-flags', () => {
+        return {
+          data: { activated: [], unactivated: ['secrets-sync'] },
+        };
+      });
+
+      await login();
+      await visit('/vault/clients/counts/overview');
+      assert
+        .dom(CLIENT_COUNT.statLegendValue('Secret sync clients'))
+        .doesNotExist('stat is hidden because feature is not activated');
+      assert.dom(CLIENT_COUNT.statLegendValue('Entity clients')).exists('other stats are still visible');
+      await click(GENERAL.inputByAttr('toggle view'));
+      assert
+        .dom(CHARTS.legend)
+        .hasText(
+          'Entity clients Non-entity clients ACME clients',
+          'it renders legend in order that matches the stacked bar data and does not include secret sync'
+        );
+    });
+
+    test('it should show secrets sync stats for HVD managed clusters', async function (assert) {
+      // mock HVD managed cluster
+      this.owner.lookup('service:flags').featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+
+      await login();
+      await visit('/vault/clients/counts/overview');
+      assert.dom(CLIENT_COUNT.statLegendValue('Secret sync clients')).exists();
+      await click(GENERAL.inputByAttr('toggle view'));
+      assert
+        .dom(CHARTS.legend)
+        .hasText(
+          'Entity clients Non-entity clients ACME clients Secret sync clients',
+          'it renders legend in order that matches the stacked bar data'
+        );
+    });
   });
 });
diff --git a/ui/tests/acceptance/cluster-test.js b/ui/tests/acceptance/cluster-test.js
index 036397c622d..5c2f61b0fc3 100644
--- a/ui/tests/acceptance/cluster-test.js
+++ b/ui/tests/acceptance/cluster-test.js
@@ -1,17 +1,17 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { settled, click, visit } from '@ember/test-helpers';
+import { settled, click, visit, currentURL } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
-import enablePage from 'vault/tests/pages/settings/auth/enable';
+import { login, loginMethod, logout } from 'vault/tests/helpers/auth/auth-helpers';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
 import { runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const tokenWithPolicy = async function (name, policy) {
   return await runCmd([
@@ -24,7 +24,7 @@ module('Acceptance | cluster', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(async function () {
-    return authPage.login();
+    return login();
   });
 
   test('hides nav item if user does not have permission', async function (assert) {
@@ -35,31 +35,29 @@ module('Acceptance | cluster', function (hooks) {
     `;
 
     const userToken = await tokenWithPolicy('hide-policies-nav', deny_policies_policy);
-    await logout.visit();
-    await authPage.login(userToken);
+    await login(userToken);
     await visit('/vault/access');
 
     assert.dom('[data-test-sidebar-nav-link="Policies"]').doesNotExist();
   });
 
-  test('it hides mfa setup if user has not entityId (ex: is a root user)', async function (assert) {
-    const user = 'end-user';
+  test('it hides mfa setup if user does not have entityId (ex: is a root user)', async function (assert) {
+    const username = 'end-user';
     const password = 'mypassword';
     const path = `cluster-userpass-${uuidv4()}`;
 
-    await enablePage.enable('userpass', path);
+    await visit('/vault/settings/auth/enable');
+    await mountBackend('userpass', path);
     await runCmd([`write auth/${path}/users/end-user password="${password}"`]);
 
-    await logout.visit();
-    await settled();
-    await authPage.loginUsername(user, password, path);
-    await click('[data-test-user-menu-trigger]');
+    await loginMethod({ username, password, path }, { authType: 'userpass', toggleOptions: true });
+
+    await click(GENERAL.button('user-menu-trigger'));
     assert.dom('[data-test-user-menu-item="mfa"]').exists();
-    await logout.visit();
 
-    await authPage.login('root');
+    await login();
     await settled();
-    await click('[data-test-user-menu-trigger]');
+    await click(GENERAL.button('user-menu-trigger'));
     assert.dom('[data-test-user-menu-item="mfa"]').doesNotExist();
   });
 
@@ -71,28 +69,51 @@ module('Acceptance | cluster', function (hooks) {
     `;
 
     const userToken = await tokenWithPolicy('show-policies-nav', read_rgp_policy);
-    await logout.visit();
-    await authPage.login(userToken);
+    await login(userToken);
     await visit('/vault/access');
 
     assert.dom('[data-test-sidebar-nav-link="Policies"]').hasAttribute('href', '/ui/vault/policies/rgp');
   });
 
   test('shows error banner if resultant-acl check fails', async function (assert) {
+    const version = this.owner.lookup('service:version');
     const login_only = `
       path "auth/token/lookup-self" {
         capabilities = ["read"]
       },
     `;
+    // note: the default policy is attached to a user unless you add the no_default_policy=true flag
+    // you can confirm this by running `vault token lookup` on the generated token
     const noDefaultPolicyUser = await runCmd([
       `write sys/policies/acl/login-only policy=${btoa(login_only)}`,
       `write -field=client_token auth/token/create no_default_policy=true policies="login-only"`,
     ]);
 
-    assert.dom('[data-test-resultant-acl-banner]').doesNotExist('Resultant ACL banner does not show as root');
-    await logout.visit();
-    assert.dom('[data-test-resultant-acl-banner]').doesNotExist('Does not show on login page');
-    await authPage.login(noDefaultPolicyUser);
-    assert.dom('[data-test-resultant-acl-banner]').includesText('Resultant ACL check failed');
+    assert
+      .dom('[data-test-resultant-acl-banner]')
+      .doesNotExist('Resultant ACL banner does not show as root user with access to everything');
+
+    await logout();
+    assert
+      .dom('[data-test-resultant-acl-banner]')
+      .doesNotExist('Resultant ACL banner does not show on login page');
+
+    await login(noDefaultPolicyUser);
+    const expectedText = version.isEnterprise
+      ? "Resultant ACL check failed Links might be shown that you don't have access to. Contact your administrator to update your policy. Log into root namespace"
+      : "Resultant ACL check failed Links might be shown that you don't have access to. Contact your administrator to update your policy.";
+
+    assert
+      .dom('[data-test-resultant-acl-banner]')
+      .includesText(expectedText, 'Resultant ACL banner shows appropriate message for OSS/Enterprise');
+  });
+
+  test('redirects to secret-engines from legacy /secrets path', async function (assert) {
+    await visit('/vault/secrets');
+    assert.strictEqual(
+      currentURL(),
+      '/vault/secrets-engines',
+      'Navigating to /secrets redirects to /secrets-engines'
+    );
   });
 });
diff --git a/ui/tests/acceptance/config-ui/login-settings-test.js b/ui/tests/acceptance/config-ui/login-settings-test.js
new file mode 100644
index 00000000000..b855dbd84d1
--- /dev/null
+++ b/ui/tests/acceptance/config-ui/login-settings-test.js
@@ -0,0 +1,117 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { click, visit, currentRouteName, fillIn, waitUntil } from '@ember/test-helpers';
+import { login, logout, rootToken } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+
+import customLoginScenario from 'vault/mirage/scenarios/custom-login';
+import customLoginHandler from 'vault/mirage/handlers/custom-login';
+import Sinon from 'sinon';
+
+// read view for custom login settings
+module('Acceptance | Enterprise | config-ui/login-settings', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    await login();
+  });
+
+  test('it renders empty state if no login settings exist', async function (assert) {
+    await visit('vault/config-ui/login-settings');
+    assert.dom(GENERAL.emptyStateTitle).hasText('No UI login settings yet');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'Login settings can be used to customize which methods display in the web UI login form by setting a default and back up login methods. Available to be created via the CLI or HTTP API.'
+      );
+  });
+
+  test('it renders error template when permission is denied', async function (assert) {
+    this.server.get('/sys/config/ui/login/default-auth', () => overrideResponse(403));
+    await visit('vault/config-ui/login-settings');
+    assert.dom(GENERAL.pageError.error).hasText('Error permission denied');
+  });
+
+  module('list, read and delete', function (hooks) {
+    hooks.beforeEach(async function () {
+      customLoginScenario(this.server);
+      customLoginHandler(this.server);
+      this.loginRules = this.server.db.loginRules;
+
+      // Cannot use the login() helper because customLoginHandler returns "token" as the default auth method
+      await logout();
+      await fillIn(GENERAL.inputByAttr('token'), rootToken);
+      await click(GENERAL.submitButton);
+      await waitUntil(() => currentRouteName() === 'vault.cluster.dashboard');
+      await click(GENERAL.navLink('UI Login Settings'));
+    });
+
+    test('it renders login rules', async function (assert) {
+      assert
+        .dom(GENERAL.listItem())
+        .exists({ count: this.loginRules.length }, `${this.loginRules.length} rules render`);
+      this.loginRules.forEach(({ name, disable_inheritance, namespace_path }) => {
+        const inheritance = disable_inheritance ? 'Inheritance disabled' : 'Inheritance enabled';
+        assert.dom(GENERAL.listItem(name)).hasText(`${name} ${namespace_path} ${inheritance}`);
+      });
+    });
+
+    test('it deletes rule from list view', async function (assert) {
+      const successFlashSpy = Sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
+      const ruleToDelete = this.loginRules[0].name;
+      const initialCount = this.loginRules.length; // cache record length so we can confirm delete
+      await click(`${GENERAL.listItem(ruleToDelete)} ${GENERAL.menuTrigger}`);
+      await click(GENERAL.menuItem('delete-rule'));
+      await click(GENERAL.confirmButton);
+      const [success] = successFlashSpy.lastCall.args;
+      assert.strictEqual(
+        success,
+        `Successfully deleted rule ${ruleToDelete}.`,
+        'it calls flash success with expected message'
+      );
+      assert.dom(GENERAL.listItem(ruleToDelete)).doesNotExist('the deleted rule does not exist');
+      assert.dom(GENERAL.listItem()).exists({ count: initialCount - 1 }, `${initialCount - 1} rules render`);
+    });
+
+    test('it navigates to rule details page and renders rule data', async function (assert) {
+      const rule = this.server.db.loginRules[0];
+      // visit individual rule page
+      await click(`${GENERAL.listItem(rule.name)} ${GENERAL.menuTrigger}`);
+      await click(GENERAL.menuItem('view-rule'));
+      // verify that user is redirected to the rule details page
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.config-ui.login-settings.rule.details',
+        'goes to rule details page'
+      );
+      // verify fetched rule data is rendered
+      assert.dom(GENERAL.infoRowValue('Default method')).hasText(rule.default_auth_type);
+      assert.dom(GENERAL.infoRowValue('Namespace the rule applies to')).hasText(rule.namespace_path);
+      assert.dom(GENERAL.infoRowValue('Backup methods')).hasText(rule.backup_auth_types.join(','));
+      assert.dom(GENERAL.infoRowValue('Inheritance enabled')).hasText('Yes');
+    });
+
+    test('it navigates to rule details from linked block', async function (assert) {
+      const rule = this.server.db.loginRules[2];
+      await visit('vault/config-ui/login-settings');
+      await click(GENERAL.listItem(rule.name));
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.config-ui.login-settings.rule.details',
+        'goes to rule details page'
+      );
+      assert.dom(GENERAL.infoRowValue('Default method')).hasText(rule.default_auth_type);
+      assert.dom(GENERAL.infoRowValue('Namespace the rule applies to')).hasText(rule.namespace_path);
+      assert.dom(GENERAL.infoRowValue('Backup methods')).hasText(rule.backup_auth_types.join(', '));
+      assert.dom(GENERAL.infoRowValue('Inheritance enabled')).hasText('No');
+    });
+  });
+});
diff --git a/ui/tests/acceptance/config-ui/messages/messages-test.js b/ui/tests/acceptance/config-ui/messages/messages-test.js
index f1e2af426c4..9e51e5b1c8c 100644
--- a/ui/tests/acceptance/config-ui/messages/messages-test.js
+++ b/ui/tests/acceptance/config-ui/messages/messages-test.js
@@ -1,62 +1,43 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { click, visit, fillIn, currentRouteName } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
+import { click, visit, fillIn, findAll, waitFor } from '@ember/test-helpers';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { runCmd } from 'vault/tests/helpers/commands';
 import { format, addDays, startOfDay } from 'date-fns';
 import { datetimeLocalStringFormat } from 'core/utils/date-formatters';
-import { PAGE } from 'vault/tests/helpers/config-ui/message-selectors';
-import { clickTrigger } from 'ember-power-select/test-support/helpers';
+import { CUSTOM_MESSAGES } from 'vault/tests/helpers/config-ui/message-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { encodeString } from 'core/utils/b64';
+
+const MESSAGES_LIST = {
+  listItem: '.linked-block',
+  filterBy: (name) => `[data-test-filter-by="${name}"]`,
+  filterSubmit: '[data-test-filter-submit]',
+  filterReset: '[data-test-filter-reset]',
+};
 
 module('Acceptance | Community | config-ui/messages', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
   hooks.beforeEach(async function () {
-    this.server.get('sys/internal/ui/version', function () {
-      return {
-        data: {
-          version: '1.16.0',
-        },
-      };
-    });
-
-    this.server.get('/sys/health', function () {
-      return {
-        enterprise: false,
-        initialized: true,
-        sealed: false,
-        standby: false,
-        license: {
-          expiry: '2024-01-12T23:20:50.52Z',
-          state: 'stored',
-        },
-        performance_standby: false,
-        replication_performance_mode: 'disabled',
-        replication_dr_mode: 'disabled',
-        server_time_utc: 1622562585,
-        version: '1.16.0',
-        cluster_name: 'vault-cluster-e779cd7c',
-        cluster_id: '5f20f5ab-acea-0481-787e-71ec2ff5a60b',
-        last_wal: 121,
-      };
-    });
-    await authPage.login();
+    const version = this.owner.lookup('service:version');
+    version.type = 'community';
+    await login();
   });
 
   hooks.afterEach(async function () {
-    await logout.visit();
+    await visit('/vault/logout');
   });
 
   test('it should hide the sidebar settings section on community', async function (assert) {
-    assert.expect(1);
-    assert.dom(PAGE.navLink).doesNotExist();
+    assert.dom(CUSTOM_MESSAGES.navLink).doesNotExist();
   });
 });
 
@@ -64,274 +45,326 @@ module('Acceptance | Enterprise | config-ui/message', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
+  const messageIdObject = {}; // Object that holds the message title as the key and the message ID as the value. using an object to help debug if a specific createMessage is causing issues.
+
   hooks.beforeEach(async function () {
-    this.createMessage = async (messageType = 'banner', endTime = '2023-12-12', authenticated = true) => {
-      await click(PAGE.navLink);
-
-      if (authenticated) {
-        await click(PAGE.tab('After user logs in'));
-        await click(PAGE.button('create message'));
-      } else {
-        await click(PAGE.tab('On login page'));
-        await click(PAGE.button('create message'));
+    const version = this.owner.lookup('service:version');
+    version.type = 'enterprise';
+    await login();
+
+    // Use the CLI command to create a message and retrieve its ID (assigned by the API on POST).
+    // The message ID is required for cleanup to prevent test pollution.
+    this.createMessageRepl = async ({
+      title = 'Test Message',
+      type = 'banner',
+      message = encodeString('Lorem ipsum dolor sit amet, consectetur adipiscing elit.'),
+      end_time = null,
+      start_time = '2023-12-12T00:00:00.000Z',
+      authenticated = true,
+    } = {}) => {
+      const payloadParts = [
+        `title="${title}"`,
+        `message="${message}"`,
+        `type="${type}"`,
+        `start_time="${start_time}"`,
+        `authenticated=${authenticated}`,
+      ];
+      if (end_time) {
+        payloadParts.push(`end_time="${end_time}"`);
       }
+      const payload = payloadParts.join(' ');
+      const result = await runCmd(`vault write sys/config/ui/custom-messages/ ${payload}`);
+      // The result will contain the message ID in the response, but the response is a giant string not an object.
+      const match = result.match(/id\s+([a-f0-9-]+)/i);
+      const messageId = match ? match[1] : null;
+      messageIdObject[title] = messageId;
+      // visit the details page to ensure the message is created
+      await visit(`/vault/config-ui/messages/${messageId}/details`);
+    };
 
-      await visit(`vault/config-ui/messages?authenticated=${authenticated}`);
-      await click(PAGE.button('create message'));
-      await fillIn(PAGE.input('title'), 'Awesome custom message title');
-      await click(PAGE.radio(messageType));
+    this.deleteMessages = async () => {
+      // Store message IDs in an object to ensure all are deleted, even if a test is interrupted.
+      for (const id of Object.values(messageIdObject)) {
+        await runCmd(`vault delete sys/config/ui/custom-messages/${id}`);
+      }
+      await visit(`/vault/config-ui/messages`); // redirect to messages index after delete to ensure the state is refreshed
+    };
+
+    this.createMessageBrowser = async ({
+      title,
+      type = 'banner',
+      end_time = '2023-12-12',
+      authenticated = true,
+    }) => {
+      await visit('/vault/config-ui/messages');
+      await click(CUSTOM_MESSAGES.tab(authenticated ? 'After user logs in' : 'On login page'));
+      await click(GENERAL.button('Create message'));
+      await fillIn(CUSTOM_MESSAGES.input('title'), title);
+
+      await click(CUSTOM_MESSAGES.radio(type));
       await fillIn(
-        PAGE.input('message'),
-        'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Pulvinar mattis nunc sed blandit libero volutpat sed cras ornare.'
+        CUSTOM_MESSAGES.input('message'),
+        'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'
       );
       await fillIn(
-        PAGE.input('startTime'),
+        CUSTOM_MESSAGES.input('start_time'),
         format(addDays(startOfDay(new Date('2023-12-12')), 1), datetimeLocalStringFormat)
       );
-      if (endTime) {
+      if (end_time) {
         await click('#specificDate');
         await fillIn(
-          PAGE.input('endTime'),
+          CUSTOM_MESSAGES.input('end_time'),
           format(addDays(startOfDay(new Date('2023-12-12')), 10), datetimeLocalStringFormat)
         );
       }
       await fillIn('[data-test-kv-key="0"]', 'Learn more');
       await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
-
-      await click(PAGE.button('create-message'));
+      await click(GENERAL.submitButton);
     };
-    this.server.get('sys/internal/ui/version', function () {
-      return {
-        data: {
-          version: '1.16.0+ent',
-        },
-      };
-    });
-    this.server.get('/sys/health', function () {
-      return {
-        enterprise: true,
-        initialized: true,
-        sealed: false,
-        standby: false,
-        license: {
-          expiry: '2024-01-12T23:20:50.52Z',
-          state: 'stored',
-        },
-        performance_standby: false,
-        replication_performance_mode: 'disabled',
-        replication_dr_mode: 'disabled',
-        server_time_utc: 1622562585,
-        version: '1.16.0+ent',
-        cluster_name: 'vault-cluster-e779cd7c',
-        cluster_id: '5f20f5ab-acea-0481-787e-71ec2ff5a60b',
-        last_wal: 121,
-      };
-    });
-    await authPage.login();
   });
 
   hooks.afterEach(async function () {
-    await logout.visit();
+    await visit('/vault/logout');
   });
-  test('it should show an empty state when no messages are created', async function (assert) {
-    assert.expect(4);
-    await click(PAGE.navLink);
-    assert.dom('[data-test-component="empty-state"]').exists();
-    assert.dom(PAGE.emptyStateTitle).hasText('No messages yet');
-    await click(PAGE.tab('On login page'));
-    assert.dom('[data-test-component="empty-state"]').exists();
-    assert.dom(PAGE.emptyStateTitle).hasText('No messages yet');
+
+  test('authenticated it should create, edit, view, and delete a message', async function (assert) {
+    // create first message
+    await this.createMessageRepl({ title: 'new-message' });
+    assert.dom(GENERAL.title).hasText('new-message', 'message title shows on the details screen');
+    // edit message
+    await click(GENERAL.linkTo('edit'));
+    await fillIn(CUSTOM_MESSAGES.input('title'), `Edited new-message`);
+    await click(GENERAL.submitButton);
+    assert
+      .dom(GENERAL.title)
+      .hasText(`Edited new-message`, 'edited message title shows on the details screen');
+    await this.deleteMessages();
+    const linkedBlocks = findAll('[data-test-list-item]');
+    assert.false(linkedBlocks.includes(`Edited new-message`), 'edited message was deleted.');
   });
 
-  module('Authenticated messages', function () {
-    test('it should create, edit, view, and delete a message', async function (assert) {
-      assert.expect(3);
-      await this.createMessage();
-      assert.dom(PAGE.title).hasText('Awesome custom message title', 'on the details screen');
-      await click('[data-test-link="edit"]');
-      await fillIn(PAGE.input('title'), 'Edited custom message title');
-      await click(PAGE.button('create-message'));
-      assert.dom(PAGE.title).hasText('Edited custom message title');
-      await click(PAGE.confirmActionButton('Delete message'));
-      await click(PAGE.confirmButton);
-      assert.strictEqual(
-        currentRouteName(),
-        'vault.cluster.config-ui.messages.index',
-        'redirects to messages page after delete'
-      );
-    });
+  test('authenticated it should show multiple messages modal', async function (assert) {
+    await this.createMessageRepl({ title: 'message-one', type: 'modal' });
+    // create second message with same model name through the UI (not the webrepl)
+    await this.createMessageBrowser({ title: 'message-one', type: 'modal', end_time: null });
 
-    test('it should show multiple messages modal', async function (assert) {
-      assert.expect(4);
-      await this.createMessage('modal', null);
-      assert.dom(PAGE.title).hasText('Awesome custom message title');
-      await this.createMessage('modal', null);
-      assert.dom(PAGE.modal('multiple modal messages')).exists();
-      assert
-        .dom(PAGE.modalTitle('Warning: more than one modal'))
-        .hasText('Warning: more than one modal after the user logs in');
-      await click(PAGE.modalButton('cancel'));
-      await visit('vault/config-ui/messages');
-      await click(PAGE.listItem('Awesome custom message title'));
-      await click(PAGE.confirmActionButton('Delete message'));
-      await click(PAGE.confirmButton);
-      assert.dom('[data-test-component="empty-state"]').exists('Message was deleted');
-    });
-    test('it should filter by type and status', async function (assert) {
-      assert.expect(6);
-      await this.createMessage('banner', null);
-      await this.createMessage('banner');
-      await visit('vault/config-ui/messages');
-
-      // check number of messages with status filters
-      await clickTrigger('#filter-by-message-status');
-      await click('.ember-power-select-options [data-option-index="0"]');
-      assert.dom('.linked-block').exists({ count: 1 }, 'filtered by active');
-      await click('[data-test-selected-list-button="delete"]');
-      await clickTrigger('#filter-by-message-status');
-      await click('.ember-power-select-options [data-option-index="1"]');
-      assert.dom('.linked-block').exists({ count: 1 }, 'filtered by inactive');
-      await click('[data-test-selected-list-button="delete"]');
-
-      // check number of messages with type filters
-      await clickTrigger('#filter-by-message-type');
-      await click('.ember-power-select-options [data-option-index="0"]');
-      assert.dom('.linked-block').exists({ count: 0 }, 'filtered by modal');
-      await click('[data-test-selected-list-button="delete"]');
-      await clickTrigger('#filter-by-message-type');
-      await click('.ember-power-select-options [data-option-index="1"]');
-      assert.dom('.linked-block').exists({ count: 2 }, 'filtered by banner');
-      await click('[data-test-selected-list-button="delete"]');
-
-      // check number of messages with no filters
-      assert.dom('.linked-block').exists({ count: 2 }, 'no filters selected');
-
-      // clean up custom messages
-      await click(PAGE.listItem('Awesome custom message title'));
-      await click(PAGE.confirmActionButton('Delete message'));
-      await click(PAGE.confirmButton);
-      await click(PAGE.listItem('Awesome custom message title'));
-      await click(PAGE.confirmActionButton('Delete message'));
-      await click(PAGE.confirmButton);
-      assert.dom('[data-test-component="empty-state"]').exists('Message was deleted');
+    assert.dom(CUSTOM_MESSAGES.modal('multiple modal messages')).exists();
+    assert
+      .dom(CUSTOM_MESSAGES.modalTitle('Warning: more than one modal'))
+      .hasText('Warning: more than one modal after the user logs in');
+
+    await click(GENERAL.button('cancel-multiple')); // cancel out of the modal
+    await click(GENERAL.cancelButton); // cancel out of the create message form
+    // delete the created message to avoid test pollution
+    await this.deleteMessages();
+  });
+
+  test('it should filter by type and status', async function (assert) {
+    await this.createMessageRepl({ title: 'filter-status-1', type: 'banner' });
+    await this.createMessageRepl({
+      title: 'filter-status-2',
+      type: 'banner',
+      end_time: '2023-12-22T00:00:00.000Z',
     });
-    test('it should display preview a message when all required fields are filled out', async function (assert) {
-      assert.expect(2);
-      await click(PAGE.navLink);
-      await click(PAGE.tab('After user logs in'));
-      await click(PAGE.button('create message'));
-      await fillIn(PAGE.input('title'), 'Awesome custom message title');
-      await click(PAGE.radio('banner'));
-      await fillIn(
-        PAGE.input('message'),
-        'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Pulvinar mattis nunc sed blandit libero volutpat sed cras ornare.'
-      );
-      await fillIn('[data-test-kv-key="0"]', 'Learn more');
-      await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
-      await click(PAGE.button('preview'));
-      assert.dom(PAGE.modal('preview image')).exists();
-      await click(PAGE.modalButton('Close'));
-      await click(PAGE.radio('modal'));
-      await click(PAGE.button('preview'));
-      assert.dom(PAGE.modal('preview modal')).exists();
+    await visit('vault/config-ui/messages?pageFilter=foobar&status=inactive&type=banner');
+    // check that filters inherit param values
+    assert.dom(MESSAGES_LIST.filterBy('pageFilter')).hasValue('foobar');
+    assert.dom(MESSAGES_LIST.filterBy('status')).hasValue('inactive');
+    assert.dom(MESSAGES_LIST.filterBy('type')).hasValue('banner');
+    assert.dom(GENERAL.emptyStateTitle).exists();
+
+    // clear filters works
+    await click(MESSAGES_LIST.filterReset);
+    assert.dom(MESSAGES_LIST.listItem).exists({ count: 2 });
+
+    // check number of messages with status filters
+    await fillIn(MESSAGES_LIST.filterBy('status'), 'active');
+    await click(GENERAL.submitButton);
+    assert.dom(MESSAGES_LIST.listItem).exists({ count: 1 }, 'list filters by status');
+
+    // check number of messages with type filters
+    await click(MESSAGES_LIST.filterReset);
+    await fillIn(MESSAGES_LIST.filterBy('type'), 'modal');
+    await click(GENERAL.submitButton);
+    // because of test pollution, we cannot guarantee that the list will be empty
+    // make sure only modal messages or no messages are shown
+    const messages = findAll(MESSAGES_LIST.listItem);
+    const allMessages = Array.from(messages || []);
+    const modalMessages = allMessages.filter((node) => node.querySelector('[data-test-badge="modal"]'));
+
+    const hasMessages = allMessages.length > 0;
+
+    assert.strictEqual(
+      modalMessages.length,
+      hasMessages ? allMessages.length : 0,
+      'if there are items in the list, they are modal messages'
+    );
+    // unsetting a filter will reset that item in the query
+    await fillIn(MESSAGES_LIST.filterBy('type'), '');
+    await fillIn(MESSAGES_LIST.filterBy('status'), 'inactive');
+    await click(GENERAL.submitButton);
+    assert.dom(MESSAGES_LIST.listItem).exists({ count: 1 }, 'list filters by status again');
+
+    // delete the created messages
+    await this.deleteMessages();
+  });
+
+  test('it should display preview a message when all required fields are filled out', async function (assert) {
+    await click(CUSTOM_MESSAGES.navLink);
+    await click(CUSTOM_MESSAGES.tab('After user logs in'));
+    await click(GENERAL.button('Create message'));
+    await fillIn(CUSTOM_MESSAGES.input('title'), 'authenticated display preview');
+    await click(CUSTOM_MESSAGES.radio('banner'));
+    await fillIn(
+      CUSTOM_MESSAGES.input('message'),
+      'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'
+    );
+    await fillIn('[data-test-kv-key="0"]', 'Learn more');
+    await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
+    await click(GENERAL.button('preview'));
+    assert.dom(CUSTOM_MESSAGES.modal('preview image')).exists('preview image of the message shows');
+
+    await click(GENERAL.button('Close preview'));
+    await click(CUSTOM_MESSAGES.radio('modal'));
+    await click(GENERAL.button('preview'));
+    assert.dom(CUSTOM_MESSAGES.modal('preview modal')).exists('preview modal of the message shows');
+  });
+
+  test('it should not display preview a message when all required fields are not filled out', async function (assert) {
+    await click(CUSTOM_MESSAGES.navLink);
+    await click(CUSTOM_MESSAGES.tab('After user logs in'));
+    await click(GENERAL.button('Create message'));
+    await click(CUSTOM_MESSAGES.radio('banner'));
+    await fillIn(
+      CUSTOM_MESSAGES.input('message'),
+      'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'
+    );
+    await fillIn('[data-test-kv-key="0"]', 'Learn more');
+    await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
+    await click(GENERAL.button('preview'));
+    assert
+      .dom(CUSTOM_MESSAGES.modal('preview image'))
+      .doesNotExist('preview image does not show because you have a missing title');
+    assert.dom(GENERAL.validationErrorByAttr('title')).exists();
+  });
+
+  // unauthenticated messages
+  test('unauthenticated it should create, edit, view, and delete a message', async function (assert) {
+    await this.createMessageRepl({
+      title: 'unauthenticated create edit view delete',
+      type: 'banner',
+      authenticated: false,
     });
-    test('it should not display preview a message when all required fields are not filled out', async function (assert) {
-      assert.expect(2);
-      await click(PAGE.navLink);
-      await click(PAGE.tab('After user logs in'));
-      await click(PAGE.button('create message'));
-      await click(PAGE.radio('banner'));
-      await fillIn(
-        PAGE.input('message'),
-        'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Pulvinar mattis nunc sed blandit libero volutpat sed cras ornare.'
+    assert
+      .dom(GENERAL.title)
+      .hasText('unauthenticated create edit view delete', 'title shows on the details screen');
+    // navigate to edit the title
+    await click(GENERAL.linkTo('edit'));
+    await fillIn(CUSTOM_MESSAGES.input('title'), `Edited ${'unauthenticated create edit view delete'}`);
+    await click(GENERAL.submitButton);
+    assert
+      .dom(GENERAL.title)
+      .hasText(
+        `Edited ${'unauthenticated create edit view delete'}`,
+        'edited title shows on the details screen'
       );
-      await fillIn('[data-test-kv-key="0"]', 'Learn more');
-      await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
-      await click(PAGE.button('preview'));
-      assert.dom(PAGE.modal('preview image')).doesNotExist();
-      assert.dom(PAGE.input('title')).hasClass('has-error-border');
-    });
+    // delete the edited message
+    await this.deleteMessages();
   });
 
-  module('Unauthenticated messages', function () {
-    test('it should create, edit, view, and delete a message', async function (assert) {
-      assert.expect(3);
-      await this.createMessage('banner', null, false);
-      assert.dom(PAGE.title).hasText('Awesome custom message title', 'on the details screen');
-      await click('[data-test-link="edit"]');
-      await fillIn(PAGE.input('title'), 'Edited custom message title');
-      await click(PAGE.button('create-message'));
-      assert.dom(PAGE.title).hasText('Edited custom message title');
-      await click(PAGE.confirmActionButton('Delete message'));
-      await click(PAGE.confirmButton);
-      assert.strictEqual(
-        currentRouteName(),
-        'vault.cluster.config-ui.messages.index',
-        'redirects to messages page after delete'
-      );
-    });
-    test('it should show multiple messages modal', async function (assert) {
-      assert.expect(4);
-      await this.createMessage('modal', null, false);
-      assert.dom(PAGE.title).hasText('Awesome custom message title');
-      await this.createMessage('modal', null, false);
-      assert.dom(PAGE.modal('multiple modal messages')).exists();
-      assert
-        .dom(PAGE.modalTitle('Warning: more than one modal'))
-        .hasText('Warning: more than one modal on the login page');
-      await click(PAGE.modalButton('cancel'));
-      await visit('vault/config-ui/messages?authenticated=false');
-      await click(PAGE.listItem('Awesome custom message title'));
-      await click(PAGE.confirmActionButton('Delete message'));
-      await click(PAGE.confirmButton);
-      assert.dom('[data-test-component="empty-state"]').exists('Message was deleted');
-    });
-    test('it should show info message on create and edit form', async function (assert) {
-      assert.expect(1);
-      await click(PAGE.navLink);
-      await click(PAGE.tab('On login page'));
-      await click(PAGE.button('create message'));
-      assert
-        .dom(PAGE.unauthCreateFormInfo)
-        .hasText(
-          'Note: Do not include sensitive information in this message since users are unauthenticated at this stage.'
-        );
+  test('unauthenticated it should show multiple messages modal', async function (assert) {
+    await this.createMessageRepl({
+      title: 'unauthenticated message 1',
+      type: 'modal',
+      authenticated: false,
     });
-    test('it should display preview a message when all required fields are filled out', async function (assert) {
-      assert.expect(2);
-      await click(PAGE.navLink);
-      await click(PAGE.tab('On login page'));
-      await click(PAGE.button('create message'));
-      await fillIn(PAGE.input('title'), 'Awesome custom message title');
-      await click(PAGE.radio('banner'));
-      await fillIn(
-        PAGE.input('message'),
-        'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Pulvinar mattis nunc sed blandit libero volutpat sed cras ornare.'
-      );
-      await fillIn('[data-test-kv-key="0"]', 'Learn more');
-      await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
-      await click(PAGE.button('preview'));
-      assert.dom(PAGE.modal('preview image')).exists();
-      await click(PAGE.modalButton('Close'));
-      await click(PAGE.radio('modal'));
-      await click(PAGE.button('preview'));
-      assert.dom(PAGE.modal('preview modal')).exists();
+    // create second message with same model name
+    await this.createMessageBrowser({
+      title: 'unauthenticated message 1',
+      type: 'modal',
+      authenticated: false,
     });
-    test('it should not display preview a message when all required fields are not filled out', async function (assert) {
-      assert.expect(2);
-      await click(PAGE.navLink);
-      await click(PAGE.tab('On login page'));
-      await click(PAGE.button('create message'));
-      await click(PAGE.radio('banner'));
-      await fillIn(
-        PAGE.input('message'),
-        'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Pulvinar mattis nunc sed blandit libero volutpat sed cras ornare.'
+    assert.dom(CUSTOM_MESSAGES.modal('multiple modal messages')).exists('the multiple modal message shows');
+    assert
+      .dom(CUSTOM_MESSAGES.modalTitle('Warning: more than one modal'))
+      .hasText('Warning: more than one modal on the login page', 'the warning modal title shows');
+
+    await click(GENERAL.button('cancel-multiple')); // cancel out of the modal
+    await click(GENERAL.cancelButton); // cancel out of the create message form
+    // delete the created message
+    await this.deleteMessages();
+  });
+
+  test('it should show info message about sensitive information on create and edit form', async function (assert) {
+    await click(CUSTOM_MESSAGES.navLink);
+    await click(CUSTOM_MESSAGES.tab('On login page'));
+    await click(GENERAL.button('Create message'));
+    assert
+      .dom(CUSTOM_MESSAGES.unauthCreateFormInfo)
+      .hasText(
+        'Note: Do not include sensitive information in this message since users are unauthenticated at this stage.'
       );
-      await fillIn('[data-test-kv-key="0"]', 'Learn more');
-      await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
-      await click(PAGE.button('preview'));
-      assert.dom(PAGE.modal('preview image')).doesNotExist();
-      assert.dom(PAGE.input('title')).hasClass('has-error-border');
+  });
+
+  test('it should allow you to preview a message when all required fields are filled out', async function (assert) {
+    await click(CUSTOM_MESSAGES.navLink);
+    await click(CUSTOM_MESSAGES.tab('On login page'));
+    await click(GENERAL.button('Create message'));
+    await fillIn(CUSTOM_MESSAGES.input('title'), 'unauthenticated display preview');
+    await click(CUSTOM_MESSAGES.radio('banner'));
+    await fillIn(
+      CUSTOM_MESSAGES.input('message'),
+      'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'
+    );
+    await fillIn('[data-test-kv-key="0"]', 'Learn more');
+    await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
+    await click(GENERAL.button('preview'));
+    assert.dom(CUSTOM_MESSAGES.modal('preview image')).exists('preview image of the message shows');
+
+    await click(GENERAL.button('Close preview'));
+    await click(CUSTOM_MESSAGES.radio('modal'));
+    await click(GENERAL.button('preview'));
+    assert.dom(CUSTOM_MESSAGES.modal('preview modal')).exists('preview modal of the message shows');
+  });
+
+  test('it should not display a preview of a message when all required fields are not filled out', async function (assert) {
+    await click(CUSTOM_MESSAGES.navLink);
+    await click(CUSTOM_MESSAGES.tab('On login page'));
+    await click(GENERAL.button('Create message'));
+    await click(CUSTOM_MESSAGES.radio('banner'));
+    await fillIn(
+      CUSTOM_MESSAGES.input('message'),
+      'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'
+    );
+    await fillIn('[data-test-kv-key="0"]', 'Learn more');
+    await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
+    await click(GENERAL.button('preview'));
+    assert.dom(CUSTOM_MESSAGES.modal('preview image')).doesNotExist('preview image does not show');
+    assert.dom(GENERAL.validationErrorByAttr('title')).exists();
+  });
+
+  test('cleanup message pollution', async function (assert) {
+    // Visit the messages page and delete any remaining messages.
+    await visit('/vault/config-ui/messages');
+    const rows = findAll('.list-item-row');
+    for (const row of rows) {
+      const trigger = row.querySelector('[data-test-popup-menu-trigger]');
+      if (trigger) {
+        await click(GENERAL.menuTrigger);
+        await click(GENERAL.menuItem('delete'));
+        await click(GENERAL.confirmButton);
+      }
+    }
+
+    // Redirect to the dashboard and revisit the messages page to refresh the state.
+    await visit('/vault/dashboard');
+    await visit('/vault/config-ui/messages');
+
+    // Wait for the empty state to render and assert that no messages exist.
+    await waitFor(GENERAL.emptyStateTitle, {
+      timeout: 2000,
+      timeoutMessage: 'Timed out waiting for empty state title to render',
     });
+    assert.dom(GENERAL.emptyStateTitle).hasText('No messages yet', 'No messages exist after cleanup');
   });
 });
diff --git a/ui/tests/acceptance/config-ui/messages/messages-unauth-auth-test.js b/ui/tests/acceptance/config-ui/messages/messages-unauth-auth-test.js
index 9a962b8e85f..ad9ca998bdc 100644
--- a/ui/tests/acceptance/config-ui/messages/messages-unauth-auth-test.js
+++ b/ui/tests/acceptance/config-ui/messages/messages-unauth-auth-test.js
@@ -1,18 +1,19 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { click, visit, fillIn, currentRouteName } from '@ember/test-helpers';
-import { PAGE } from 'vault/tests/helpers/config-ui/message-selectors';
+import { click, visit, fillIn, currentRouteName, currentURL, waitFor } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CUSTOM_MESSAGES } from 'vault/tests/helpers/config-ui/message-selectors';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 
-import authPage from 'vault/tests/pages/auth';
+import { login, loginNs, logout } from 'vault/tests/helpers/auth/auth-helpers';
 import { datetimeLocalStringFormat } from 'core/utils/date-formatters';
 import { format, addDays, startOfDay } from 'date-fns';
-import { createNS, runCmd } from '../../../helpers/commands';
+import { createNS, deleteNS, runCmd } from '../../../helpers/commands';
 
 const unauthenticatedMessageResponse = {
   request_id: '664fbad0-fcd8-9023-4c5b-81a7962e9f4b',
@@ -50,12 +51,20 @@ const unauthenticatedMessageResponse = {
   auth: null,
   mount_type: '',
 };
-
 // custom messages is an enterprise feature, but since we're using mirage enterprise is omitted from the module name.
 module('Acceptance | auth custom messages auth tests', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
+  hooks.beforeEach(async function () {
+    // clean up messages after creation to avoid test pollution
+    this.deleteMessage = async (messageId) => {
+      await visit(`vault/config-ui/messages/${messageId}/details`);
+      await click(GENERAL.confirmTrigger);
+      await click(GENERAL.confirmButton);
+    };
+  });
+
   module('auth and unauth messages', function (hooks) {
     hooks.beforeEach(function () {
       return this.server.get('/sys/internal/ui/mounts', () => ({}));
@@ -68,15 +77,15 @@ module('Acceptance | auth custom messages auth tests', function (hooks) {
       await visit('/vault/auth');
       const modalId = 'some-awesome-id-1';
       const alertId = 'some-awesome-id-2';
-      assert.dom(PAGE.modal(modalId)).exists();
-      assert.dom(PAGE.modalTitle(modalId)).hasText('Modal title');
-      assert.dom(PAGE.modalBody(modalId)).exists();
-      assert.dom(PAGE.modalBody(modalId)).hasText('here is a cool message');
-      await click(PAGE.modalButton(modalId));
-      assert.dom(PAGE.alertTitle(alertId)).hasText('Banner title');
-      assert.dom(PAGE.alertDescription(alertId)).hasText('hello world hello wolrd');
-      assert.dom(PAGE.alertAction('link')).hasText('some alert link');
+      assert.dom(CUSTOM_MESSAGES.modal(modalId)).exists();
+      assert.dom(CUSTOM_MESSAGES.modalTitle(modalId)).hasText('Modal title');
+      assert.dom(CUSTOM_MESSAGES.modalBody(modalId)).exists();
+      assert.dom(CUSTOM_MESSAGES.modalBody(modalId)).hasText('here is a cool message');
+      assert.dom(CUSTOM_MESSAGES.alertTitle(alertId)).hasText('Banner title');
+      assert.dom(CUSTOM_MESSAGES.alertDescription(alertId)).hasText('hello world hello wolrd');
+      assert.dom(CUSTOM_MESSAGES.alertAction('link')).hasText('some alert link');
     });
+
     test('it shows the multiple modal messages', async function (assert) {
       const modalIdOne = 'some-awesome-id-2';
       const modalIdTwo = 'some-awesome-id-1';
@@ -89,17 +98,16 @@ module('Acceptance | auth custom messages auth tests', function (hooks) {
         return unauthenticatedMessageResponse;
       });
       await visit('/vault/auth');
-      assert.dom(PAGE.modal(modalIdOne)).exists();
-      assert.dom(PAGE.modalTitle(modalIdOne)).hasText('Modal title 1');
-      assert.dom(PAGE.modalBody(modalIdOne)).exists();
-      assert.dom(PAGE.modalBody(modalIdOne)).hasText('hello world hello wolrd some alert link');
-      await click(PAGE.modalButton(modalIdOne));
-      assert.dom(PAGE.modal(modalIdTwo)).exists();
-      assert.dom(PAGE.modalTitle(modalIdTwo)).hasText('Modal title 2');
-      assert.dom(PAGE.modalBody(modalIdTwo)).exists();
-      assert.dom(PAGE.modalBody(modalIdTwo)).hasText('here is a cool message');
-      await click(PAGE.modalButton(modalIdTwo));
+      assert.dom(CUSTOM_MESSAGES.modal(modalIdOne)).exists();
+      assert.dom(CUSTOM_MESSAGES.modalTitle(modalIdOne)).hasText('Modal title 1');
+      assert.dom(CUSTOM_MESSAGES.modalBody(modalIdOne)).exists();
+      assert.dom(CUSTOM_MESSAGES.modalBody(modalIdOne)).hasText('hello world hello wolrd some alert link');
+      assert.dom(CUSTOM_MESSAGES.modal(modalIdTwo)).exists();
+      assert.dom(CUSTOM_MESSAGES.modalTitle(modalIdTwo)).hasText('Modal title 2');
+      assert.dom(CUSTOM_MESSAGES.modalBody(modalIdTwo)).exists();
+      assert.dom(CUSTOM_MESSAGES.modalBody(modalIdTwo)).hasText('here is a cool message');
     });
+
     test('it shows the multiple banner messages', async function (assert) {
       const bannerIdOne = 'some-awesome-id-2';
       const bannerIdTwo = 'some-awesome-id-1';
@@ -112,45 +120,61 @@ module('Acceptance | auth custom messages auth tests', function (hooks) {
         return unauthenticatedMessageResponse;
       });
       await visit('/vault/auth');
-      assert.dom(PAGE.alertTitle(bannerIdOne)).hasText('Banner title 1');
-      assert.dom(PAGE.alertDescription(bannerIdOne)).hasText('hello world hello wolrd');
-      assert.dom(PAGE.alertTitle(bannerIdTwo)).hasText('Banner title 2');
-      assert.dom(PAGE.alertDescription(bannerIdTwo)).hasText('here is a cool message');
-      assert.dom(PAGE.alertAction('link')).hasText('some alert link');
+      assert.dom(CUSTOM_MESSAGES.alertTitle(bannerIdOne)).hasText('Banner title 1');
+      assert.dom(CUSTOM_MESSAGES.alertDescription(bannerIdOne)).hasText('hello world hello wolrd');
+      assert.dom(CUSTOM_MESSAGES.alertTitle(bannerIdTwo)).hasText('Banner title 2');
+      assert.dom(CUSTOM_MESSAGES.alertDescription(bannerIdTwo)).hasText('here is a cool message');
+      assert.dom(CUSTOM_MESSAGES.alertAction('link')).hasText('some alert link');
     });
   });
 
   test('it should display an active authenticated message after creation on enterprise', async function (assert) {
-    assert.expect(4);
-    await authPage.login();
-    await visit('vault/config-ui/messages');
-    await click(PAGE.button('create message'));
-    await fillIn(PAGE.input('title'), 'Awesome custom message title');
-    await click(PAGE.radio('banner'));
+    await login();
+    await visit('vault/config-ui/messages/create');
+    await fillIn(CUSTOM_MESSAGES.input('title'), 'active authenticated message title');
+    await click(CUSTOM_MESSAGES.radio('banner'));
     await fillIn(
-      PAGE.input('message'),
-      'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Pulvinar mattis nunc sed blandit libero volutpat sed cras ornare.'
+      CUSTOM_MESSAGES.input('message'),
+      'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'
     );
     await fillIn(
-      PAGE.input('startTime'),
+      CUSTOM_MESSAGES.input('start_time'),
       format(addDays(startOfDay(new Date('2023-12-12')), 1), datetimeLocalStringFormat)
     );
     await fillIn('[data-test-kv-key="0"]', 'Learn more');
     await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
+    await click(GENERAL.submitButton);
+    // message id is generated on create and only available via the URL -> /vault/config-ui/messages/:id/details
+    const id = currentURL().split('/').slice(-2, -1);
+    assert
+      .dom(CUSTOM_MESSAGES.alertTitle(id))
+      .hasText('active authenticated message title', 'title is correct');
+    assert.dom('.hds-alert').exists('active custom message displays in root when authenticated.');
 
-    await click(PAGE.button('create-message'));
-    assert.dom(PAGE.title).hasText('Awesome custom message title', 'on the details screen');
-    assert.dom('.hds-alert').exists('active custom message displays on authenticated.');
+    //  confirm message shows within a namespace
     await runCmd(createNS('world'), false);
+    await logout();
+    assert.dom(CUSTOM_MESSAGES.alertTitle(id)).doesNotExist('message does not display when logged out');
+
+    // log in to namespace
+    await loginNs('world');
+    await waitFor(CUSTOM_MESSAGES.alertTitle(id));
+    assert
+      .dom(CUSTOM_MESSAGES.alertTitle(id))
+      .hasText('active authenticated message title', 'title is correct')
+      .exists('active custom message displays after logging in to namespace');
+
+    // navigate back to root namespace to delete message
     await visit('vault/config-ui/messages');
-    assert.dom('.hds-alert').exists('active custom message displays on namespace authenticated.');
-    await click(PAGE.listItem('Awesome custom message title'));
-    await click(PAGE.confirmActionButton('Delete message'));
-    await click(PAGE.confirmButton);
+    await click(GENERAL.listItem('active authenticated message title'));
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.config-ui.messages.index',
       'redirects to messages page after delete'
     );
+    // clean up namespace pollution
+    await runCmd(deleteNS('world'));
   });
 });
diff --git a/ui/tests/acceptance/console-test.js b/ui/tests/acceptance/console-test.js
index 527605da81c..c56dbf44f82 100644
--- a/ui/tests/acceptance/console-test.js
+++ b/ui/tests/acceptance/console-test.js
@@ -1,15 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
-import { settled, waitUntil, click } from '@ember/test-helpers';
+import { settled, waitUntil, click, visit } from '@ember/test-helpers';
 import { create } from 'ember-cli-page-object';
 import { setupApplicationTest } from 'ember-qunit';
-import enginesPage from 'vault/tests/pages/secrets/backends';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import consoleClass from 'vault/tests/pages/components/console/ui-panel';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
 import { v4 as uuidv4 } from 'uuid';
 
 const consoleComponent = create(consoleClass);
@@ -18,15 +19,12 @@ module('Acceptance | console', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(function () {
-    return authPage.login();
+    return login();
   });
 
   test("refresh reloads the current route's data", async function (assert) {
     assert.expect(6);
-    await enginesPage.visit();
-    await settled();
-    await consoleComponent.toggle();
-    await settled();
+    await visit(`/vault/secrets-engines`);
     const ids = [uuidv4(), uuidv4(), uuidv4()];
     for (const id of ids) {
       const inputString = `write sys/mounts/console-route-${id} type=kv`;
@@ -36,10 +34,7 @@ module('Acceptance | console', function (hooks) {
     await consoleComponent.runCommands('refresh');
     await settled();
     for (const id of ids) {
-      assert.ok(
-        enginesPage.rows.findOneBy('path', `console-route-${id}/`),
-        'new engine is shown on the page'
-      );
+      assert.dom(GENERAL.tableRow(`console-route-${id}/`)).exists('new engine is shown on the page');
     }
     // Clean up
     for (const id of ids) {
@@ -50,16 +45,14 @@ module('Acceptance | console', function (hooks) {
     await consoleComponent.runCommands('refresh');
     await settled();
     for (const id of ids) {
-      assert.throws(() => {
-        enginesPage.rows.findOneBy('path', `console-route-${id}/`);
-      }, 'engine was removed');
+      assert.dom(GENERAL.tableRow(`console-route-${id}/`)).doesNotExist('engine was removed');
     }
   });
 
   test('fullscreen command expands the cli panel', async function (assert) {
     await consoleComponent.toggle();
     await settled();
-    await consoleComponent.runCommands('fullscreen');
+    await consoleComponent.runCommands('fullscreen', false);
     await settled();
     const consoleEle = document.querySelector('[data-test-component="console/ui-panel"]');
     // wait for the CSS transition to finish
@@ -74,7 +67,7 @@ module('Acceptance | console', function (hooks) {
   test('array output is correctly formatted', async function (assert) {
     await consoleComponent.toggle();
     await settled();
-    await consoleComponent.runCommands('read -field=policies /auth/token/lookup-self');
+    await consoleComponent.runCommands('read -field=policies /auth/token/lookup-self', false);
     await settled();
     const consoleOut = document.querySelector('.console-ui-output>pre');
     // wait for the CSS transition to finish
@@ -86,7 +79,7 @@ module('Acceptance | console', function (hooks) {
   test('number output is correctly formatted', async function (assert) {
     await consoleComponent.toggle();
     await settled();
-    await consoleComponent.runCommands('read -field=creation_time /auth/token/lookup-self');
+    await consoleComponent.runCommands('read -field=creation_time /auth/token/lookup-self', false);
     await settled();
     const consoleOut = document.querySelector('.console-ui-output>pre');
     // wait for the CSS transition to finish
@@ -97,7 +90,7 @@ module('Acceptance | console', function (hooks) {
   test('boolean output is correctly formatted', async function (assert) {
     await consoleComponent.toggle();
     await settled();
-    await consoleComponent.runCommands('read -field=orphan /auth/token/lookup-self');
+    await consoleComponent.runCommands('read -field=orphan /auth/token/lookup-self', false);
     await settled();
     const consoleOut = document.querySelector('.console-ui-output>pre');
     // have to wrap in a later so that we can wait for the CSS transition to finish
diff --git a/ui/tests/acceptance/custom-messages-test.js b/ui/tests/acceptance/custom-messages-test.js
new file mode 100644
index 00000000000..1a2fb4db757
--- /dev/null
+++ b/ui/tests/acceptance/custom-messages-test.js
@@ -0,0 +1,112 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { visit } from '@ember/test-helpers';
+import { setupApplicationTest } from 'vault/tests/helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { CUSTOM_MESSAGES } from 'vault/tests/helpers/config-ui/message-selectors';
+
+const authenticatedMessageResponse = {
+  request_id: '664fbad0-fcd8-9023-4c5b-81a7962e9f4b',
+  lease_id: '',
+  renewable: false,
+  lease_duration: 0,
+  data: {
+    key_info: {
+      'some-awesome-id-2': {
+        authenticated: true,
+        end_time: null,
+        link: {
+          'some link title': 'www.link.com',
+        },
+        message: 'aGVsbG8gd29ybGQgaGVsbG8gd29scmQ=',
+        options: null,
+        start_time: '2024-01-04T08:00:00Z',
+        title: 'Banner title',
+        type: 'banner',
+      },
+      'some-awesome-id-1': {
+        authenticated: true,
+        end_time: null,
+        message: 'aGVyZSBpcyBhIGNvb2wgbWVzc2FnZQ==',
+        options: null,
+        start_time: '2024-01-01T08:00:00Z',
+        title: 'Modal title',
+        type: 'modal',
+      },
+    },
+    keys: ['some-awesome-id-2', 'some-awesome-id-1'],
+  },
+  wrap_info: null,
+  warnings: null,
+  auth: null,
+  mount_type: '',
+};
+
+module('Acceptance | custom messages', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  test('it shows the alert banner and modal message', async function (assert) {
+    this.server.get('/sys/internal/ui/unauthenticated-messages', function () {
+      return authenticatedMessageResponse;
+    });
+    await visit('/vault/dashboard');
+
+    const modalId = 'some-awesome-id-1';
+    const alertId = 'some-awesome-id-2';
+    assert.dom(CUSTOM_MESSAGES.modal(modalId)).exists();
+    assert.dom(CUSTOM_MESSAGES.modalTitle(modalId)).hasText('Modal title');
+    assert.dom(CUSTOM_MESSAGES.modalBody(modalId)).exists();
+    assert.dom(CUSTOM_MESSAGES.modalBody(modalId)).hasText('here is a cool message');
+    assert.dom(CUSTOM_MESSAGES.alertTitle(alertId)).hasText('Banner title');
+    assert.dom(CUSTOM_MESSAGES.alertDescription(alertId)).hasText('hello world hello wolrd');
+    assert.dom(CUSTOM_MESSAGES.alertAction('link')).hasText('some link title');
+  });
+
+  test('it shows the multiple modal messages', async function (assert) {
+    const modalIdOne = 'some-awesome-id-2';
+    const modalIdTwo = 'some-awesome-id-1';
+
+    this.server.get('/sys/internal/ui/unauthenticated-messages', function () {
+      authenticatedMessageResponse.data.key_info[modalIdOne].type = 'modal';
+      authenticatedMessageResponse.data.key_info[modalIdOne].title = 'Modal title 1';
+      authenticatedMessageResponse.data.key_info[modalIdTwo].type = 'modal';
+      authenticatedMessageResponse.data.key_info[modalIdTwo].title = 'Modal title 2';
+      return authenticatedMessageResponse;
+    });
+    await visit('/vault/dashboard');
+
+    assert.dom(CUSTOM_MESSAGES.modal(modalIdOne)).exists();
+    assert.dom(CUSTOM_MESSAGES.modalTitle(modalIdOne)).hasText('Modal title 1');
+    assert.dom(CUSTOM_MESSAGES.modalBody(modalIdOne)).exists();
+    assert.dom(CUSTOM_MESSAGES.modalBody(modalIdOne)).hasText('hello world hello wolrd some link title');
+    assert.dom(CUSTOM_MESSAGES.modal(modalIdTwo)).exists();
+    assert.dom(CUSTOM_MESSAGES.modalTitle(modalIdTwo)).hasText('Modal title 2');
+    assert.dom(CUSTOM_MESSAGES.modalBody(modalIdTwo)).exists();
+    assert.dom(CUSTOM_MESSAGES.modalBody(modalIdTwo)).hasText('here is a cool message');
+  });
+
+  test('it shows the multiple banner messages', async function (assert) {
+    const bannerIdOne = 'some-awesome-id-2';
+    const bannerIdTwo = 'some-awesome-id-1';
+
+    this.server.get('/sys/internal/ui/unauthenticated-messages', function () {
+      authenticatedMessageResponse.data.key_info[bannerIdOne].type = 'banner';
+      authenticatedMessageResponse.data.key_info[bannerIdOne].title = 'Banner title 1';
+      authenticatedMessageResponse.data.key_info[bannerIdTwo].type = 'banner';
+      authenticatedMessageResponse.data.key_info[bannerIdTwo].title = 'Banner title 2';
+      return authenticatedMessageResponse;
+    });
+    await visit('/vault/dashboard');
+
+    assert.dom(CUSTOM_MESSAGES.alertTitle(bannerIdOne)).hasText('Banner title 1');
+    assert.dom(CUSTOM_MESSAGES.alertDescription(bannerIdOne)).hasText('hello world hello wolrd');
+    assert.dom(CUSTOM_MESSAGES.alertAction('link')).hasText('some link title');
+    assert.dom(CUSTOM_MESSAGES.alertTitle(bannerIdTwo)).hasText('Banner title 2');
+    assert.dom(CUSTOM_MESSAGES.alertDescription(bannerIdTwo)).hasText('here is a cool message');
+  });
+});
diff --git a/ui/tests/acceptance/dashboard-test.js b/ui/tests/acceptance/dashboard-test.js
index 3cf73edebe7..dc50cc39b59 100644
--- a/ui/tests/acceptance/dashboard-test.js
+++ b/ui/tests/acceptance/dashboard-test.js
@@ -1,543 +1,44 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
-import {
-  visit,
-  currentURL,
-  settled,
-  fillIn,
-  click,
-  waitUntil,
-  find,
-  currentRouteName,
-} from '@ember/test-helpers';
+import { visit, currentURL } from '@ember/test-helpers';
 import { setupApplicationTest } from 'vault/tests/helpers';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { selectChoose } from 'ember-power-select/test-support/helpers';
-import authPage from 'vault/tests/pages/auth';
-import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
-import clientsHandlers from 'vault/mirage/handlers/clients';
-import { formatNumber } from 'core/helpers/format-number';
-import { pollCluster } from 'vault/tests/helpers/poll-cluster';
-import { disableReplication } from 'vault/tests/helpers/replication';
-import connectionPage from 'vault/tests/pages/secrets/backend/database/connection';
-import { v4 as uuidv4 } from 'uuid';
-import { runCmd, deleteEngineCmd, createNS } from 'vault/tests/helpers/commands';
-
-import { SELECTORS } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
-import { PAGE } from 'vault/tests/helpers/config-ui/message-selectors';
-
-const authenticatedMessageResponse = {
-  request_id: '664fbad0-fcd8-9023-4c5b-81a7962e9f4b',
-  lease_id: '',
-  renewable: false,
-  lease_duration: 0,
-  data: {
-    key_info: {
-      'some-awesome-id-2': {
-        authenticated: true,
-        end_time: null,
-        link: {
-          'some link title': 'www.link.com',
-        },
-        message: 'aGVsbG8gd29ybGQgaGVsbG8gd29scmQ=',
-        options: null,
-        start_time: '2024-01-04T08:00:00Z',
-        title: 'Banner title',
-        type: 'banner',
-      },
-      'some-awesome-id-1': {
-        authenticated: true,
-        end_time: null,
-        message: 'aGVyZSBpcyBhIGNvb2wgbWVzc2FnZQ==',
-        options: null,
-        start_time: '2024-01-01T08:00:00Z',
-        title: 'Modal title',
-        type: 'modal',
-      },
-    },
-    keys: ['some-awesome-id-2', 'some-awesome-id-1'],
-  },
-  wrap_info: null,
-  warnings: null,
-  auth: null,
-  mount_type: '',
-};
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { DASHBOARD } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
+import Sinon from 'sinon';
 
 module('Acceptance | landing page dashboard', function (hooks) {
   setupApplicationTest(hooks);
-  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    this.version = this.owner.lookup('service:version');
+    this.namespace = this.owner.lookup('service:namespace');
+  });
 
   test('navigate to dashboard on login', async function (assert) {
-    assert.expect(1);
-    await authPage.login();
+    await login();
     assert.strictEqual(currentURL(), '/vault/dashboard');
   });
 
   test('display the version number for the title', async function (assert) {
-    assert.expect(1);
-    await authPage.login();
-    await visit('/vault/dashboard');
-    const version = this.owner.lookup('service:version');
+    await login();
     // Since we're using mirage, version is mocked static value
-    const versionText = version.isEnterprise ? `Vault v1.9.0 root` : `Vault v1.9.0`;
-
-    assert.dom(SELECTORS.cardHeader('Vault version')).hasText(versionText);
-  });
-
-  module('secrets engines card', function (hooks) {
-    hooks.beforeEach(async function () {
-      await authPage.login();
-    });
-
-    test('shows a secrets engine card', async function (assert) {
-      assert.expect(1);
-      await mountSecrets.enable('pki', 'pki');
-      await settled();
-      await visit('/vault/dashboard');
-      assert.dom(SELECTORS.cardHeader('Secrets engines')).hasText('Secrets engines');
-      // cleanup engine mount
-      await runCmd(deleteEngineCmd('pki'));
-    });
-
-    test('it adds disabled css styling to unsupported secret engines', async function (assert) {
-      assert.expect(1);
-      await mountSecrets.enable('nomad', 'nomad');
-      await settled();
-      await visit('/vault/dashboard');
-      assert.dom('[data-test-secrets-engines-row="nomad"] [data-test-view]').doesNotExist();
-      // cleanup engine mount
-      await runCmd(deleteEngineCmd('nomad'));
-    });
-  });
-
-  module('configuration details card', function (hooks) {
-    hooks.beforeEach(async function () {
-      this.data = {
-        api_addr: 'http://127.0.0.1:8200',
-        cache_size: 0,
-        cluster_addr: 'https://127.0.0.1:8201',
-        cluster_cipher_suites: '',
-        cluster_name: '',
-        default_lease_ttl: 0,
-        default_max_request_duration: 0,
-        detect_deadlocks: '',
-        disable_cache: false,
-        disable_clustering: false,
-        disable_indexing: false,
-        disable_mlock: true,
-        disable_performance_standby: false,
-        disable_printable_check: false,
-        disable_sealwrap: false,
-        disable_sentinel_trace: false,
-        enable_response_header_hostname: false,
-        enable_response_header_raft_node_id: false,
-        enable_ui: true,
-        experiments: null,
-        introspection_endpoint: false,
-        listeners: [
-          {
-            config: {
-              address: '0.0.0.0:8200',
-              cluster_address: '0.0.0.0:8201',
-              tls_disable: true,
-            },
-            type: 'tcp',
-          },
-        ],
-        log_format: '',
-        log_level: 'debug',
-        log_requests_level: '',
-        max_lease_ttl: '48h',
-        pid_file: '',
-        plugin_directory: '',
-        plugin_file_permissions: 0,
-        plugin_file_uid: 0,
-        raw_storage_endpoint: true,
-        seals: [
-          {
-            disabled: false,
-            type: 'shamir',
-          },
-        ],
-        storage: {
-          cluster_addr: 'https://127.0.0.1:8201',
-          disable_clustering: false,
-          raft: {
-            max_entry_size: '',
-          },
-          redirect_addr: 'http://127.0.0.1:8200',
-          type: 'raft',
-        },
-        telemetry: {
-          add_lease_metrics_namespace_labels: false,
-          circonus_api_app: '',
-          circonus_api_token: '',
-          circonus_api_url: '',
-          circonus_broker_id: '',
-          circonus_broker_select_tag: '',
-          circonus_check_display_name: '',
-          circonus_check_force_metric_activation: '',
-          circonus_check_id: '',
-          circonus_check_instance_id: '',
-          circonus_check_search_tag: '',
-          circonus_check_tags: '',
-          circonus_submission_interval: '',
-          circonus_submission_url: '',
-          disable_hostname: true,
-          dogstatsd_addr: '',
-          dogstatsd_tags: null,
-          lease_metrics_epsilon: 3600000000000,
-          maximum_gauge_cardinality: 500,
-          metrics_prefix: '',
-          num_lease_metrics_buckets: 168,
-          prometheus_retention_time: 86400000000000,
-          stackdriver_debug_logs: false,
-          stackdriver_location: '',
-          stackdriver_namespace: '',
-          stackdriver_project_id: '',
-          statsd_address: '',
-          statsite_address: '',
-          usage_gauge_period: 5000000000,
-        },
-      };
-
-      this.server.get('sys/config/state/sanitized', () => ({
-        data: this.data,
-        wrap_info: null,
-        warnings: null,
-        auth: null,
-      }));
-    });
-
-    test('hides the configuration details card on a non-root namespace enterprise version', async function (assert) {
-      assert.expect(3);
-      await authPage.login();
-      await visit('/vault/dashboard');
-      const version = this.owner.lookup('service:version');
-      assert.true(version.isEnterprise, 'vault is enterprise');
-      assert.dom(SELECTORS.cardName('configuration-details')).exists();
-      await runCmd(createNS('world'), false);
-      await visit('/vault/dashboard?namespace=world');
-      assert.dom(SELECTORS.cardName('configuration-details')).doesNotExist();
-    });
-
-    test('shows the configuration details card', async function (assert) {
-      assert.expect(8);
-      await authPage.login();
-      await visit('/vault/dashboard');
-      assert.dom(SELECTORS.cardHeader('configuration')).hasText('Configuration details');
-      assert
-        .dom(SELECTORS.vaultConfigurationCard.configDetailsField('api_addr'))
-        .hasText('http://127.0.0.1:8200');
-      assert.dom(SELECTORS.vaultConfigurationCard.configDetailsField('default_lease_ttl')).hasText('0');
-      assert.dom(SELECTORS.vaultConfigurationCard.configDetailsField('max_lease_ttl')).hasText('2 days');
-      assert.dom(SELECTORS.vaultConfigurationCard.configDetailsField('tls')).hasText('Disabled'); // tls_disable=true
-      assert.dom(SELECTORS.vaultConfigurationCard.configDetailsField('log_format')).hasText('None');
-      assert.dom(SELECTORS.vaultConfigurationCard.configDetailsField('log_level')).hasText('debug');
-      assert.dom(SELECTORS.vaultConfigurationCard.configDetailsField('type')).hasText('raft');
-    });
-
-    test('it should show tls as enabled if tls_disable, tls_cert_file and tls_key_file are in the config', async function (assert) {
-      assert.expect(1);
-      this.data.listeners[0].config.tls_disable = false;
-      this.data.listeners[0].config.tls_cert_file = './cert.pem';
-      this.data.listeners[0].config.tls_key_file = './key.pem';
-
-      await authPage.login();
-      await visit('/vault/dashboard');
-      assert.dom(SELECTORS.vaultConfigurationCard.configDetailsField('tls')).hasText('Enabled');
-    });
-
-    test('it should show tls as enabled if only cert and key exist in config', async function (assert) {
-      assert.expect(1);
-      delete this.data.listeners[0].config.tls_disable;
-      this.data.listeners[0].config.tls_cert_file = './cert.pem';
-      this.data.listeners[0].config.tls_key_file = './key.pem';
-      await authPage.login();
-      await visit('/vault/dashboard');
-      assert.dom(SELECTORS.vaultConfigurationCard.configDetailsField('tls')).hasText('Enabled');
-    });
-
-    test('it should show tls as disabled if there is no tls information in the config', async function (assert) {
-      assert.expect(1);
-      this.data.listeners = [];
-      await authPage.login();
-      await visit('/vault/dashboard');
-      assert.dom(SELECTORS.vaultConfigurationCard.configDetailsField('tls')).hasText('Disabled');
-    });
-  });
-
-  module('quick actions card', function (hooks) {
-    hooks.beforeEach(async function () {
-      await authPage.login();
-    });
-
-    test('shows the default state of the quick actions card', async function (assert) {
-      assert.expect(1);
-      assert.dom(SELECTORS.emptyState('no-mount-selected')).exists();
-    });
+    const versionText = this.version.isEnterprise
+      ? `Vault ${this.version.versionDisplay} root`
+      : `Vault ${this.version.versionDisplay}`;
 
-    test('shows the correct actions and links associated with pki', async function (assert) {
-      assert.expect(12);
-      const backend = 'pki-dashboard';
-      await mountSecrets.enable('pki', backend);
-      await runCmd([
-        `write ${backend}/roles/some-role \
-      issuer_ref="default" \
-      allowed_domains="example.com" \
-      allow_subdomains=true \
-      max_ttl="720h"`,
-      ]);
-      await runCmd([`write ${backend}/root/generate/internal issuer_name="Hashicorp" common_name="Hello"`]);
-      await settled();
-      await visit('/vault/dashboard');
-      await selectChoose(SELECTORS.searchSelect('secrets-engines'), backend);
-      await fillIn(SELECTORS.selectEl, 'Issue certificate');
-      assert.dom(SELECTORS.emptyState('quick-actions')).doesNotExist();
-      assert.dom(SELECTORS.subtitle('param')).hasText('Role to use');
-
-      await selectChoose(SELECTORS.searchSelect('params'), 'some-role');
-      assert.dom(SELECTORS.actionButton('Issue leaf certificate')).exists({ count: 1 });
-      await click(SELECTORS.actionButton('Issue leaf certificate'));
-      assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.pki.roles.role.generate');
-
-      await visit('/vault/dashboard');
-
-      await selectChoose(SELECTORS.searchSelect('secrets-engines'), backend);
-      await fillIn(SELECTORS.selectEl, 'View certificate');
-      assert.dom(SELECTORS.emptyState('quick-actions')).doesNotExist();
-      assert.dom(SELECTORS.subtitle('param')).hasText('Certificate serial number');
-      assert.dom(SELECTORS.actionButton('View certificate')).exists({ count: 1 });
-      await selectChoose(SELECTORS.searchSelect('params'), '.ember-power-select-option', 0);
-      await click(SELECTORS.actionButton('View certificate'));
-      assert.strictEqual(
-        currentRouteName(),
-        'vault.cluster.secrets.backend.pki.certificates.certificate.details'
-      );
-
-      await visit('/vault/dashboard');
-
-      await selectChoose(SELECTORS.searchSelect('secrets-engines'), backend);
-      await fillIn(SELECTORS.selectEl, 'View issuer');
-      assert.dom(SELECTORS.emptyState('quick-actions')).doesNotExist();
-      assert.dom(SELECTORS.subtitle('param')).hasText('Issuer');
-      assert.dom(SELECTORS.actionButton('View issuer')).exists({ count: 1 });
-      await selectChoose(SELECTORS.searchSelect('params'), '.ember-power-select-option', 0);
-      await click(SELECTORS.actionButton('View issuer'));
-      assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.pki.issuers.issuer.details');
-
-      // cleanup engine mount
-      await runCmd(deleteEngineCmd(backend));
-    });
-
-    const newConnection = async (backend, plugin = 'mongodb-database-plugin') => {
-      const name = `connection-${Date.now()}`;
-      await connectionPage.visitCreate({ backend });
-      await connectionPage.dbPlugin(plugin);
-      await connectionPage.name(name);
-      await connectionPage.connectionUrl(`mongodb://127.0.0.1:4321/${name}`);
-      await connectionPage.toggleVerify();
-      await connectionPage.save();
-      await connectionPage.enable();
-      return name;
-    };
-
-    test('shows the correct actions and links associated with database', async function (assert) {
-      assert.expect(4);
-      const databaseBackend = `database-${uuidv4()}`;
-      await mountSecrets.enable('database', databaseBackend);
-      await newConnection(databaseBackend);
-      await runCmd([
-        `write ${databaseBackend}/roles/my-role \
-        db_name=mongodb-database-plugin \
-        creation_statements='{ "db": "admin", "roles": [{ "role": "readWrite" }, {"role": "read", "db": "foo"}] }' \
-        default_ttl="1h" \
-        max_ttl="24h`,
-      ]);
-      await settled();
-      await visit('/vault/dashboard');
-      await selectChoose(SELECTORS.searchSelect('secrets-engines'), databaseBackend);
-      await fillIn(SELECTORS.selectEl, 'Generate credentials for database');
-      assert.dom(SELECTORS.emptyState('quick-actions')).doesNotExist();
-      assert.dom(SELECTORS.subtitle('param')).hasText('Role to use');
-      assert.dom(SELECTORS.actionButton('Generate credentials')).exists({ count: 1 });
-      await selectChoose(SELECTORS.searchSelect('params'), '.ember-power-select-option', 0);
-      await click(SELECTORS.actionButton('Generate credentials'));
-      assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.credentials');
-      await runCmd(deleteEngineCmd(databaseBackend));
-    });
-
-    test('does not show kv1 mounts', async function (assert) {
-      assert.expect(1);
-      // delete before in case you are rerunning the test and it fails without deleting
-      await runCmd(deleteEngineCmd('kv1'));
-      await runCmd([`write sys/mounts/kv1 type=kv`]);
-      await settled();
-      await visit('/vault/dashboard');
-      await click('[data-test-component="search-select"] .ember-basic-dropdown-trigger');
-      assert
-        .dom('.ember-power-select-option')
-        .doesNotHaveTextContaining('kv1', 'dropdown does not show kv1 mount');
-      await runCmd(deleteEngineCmd('kv1'));
-    });
-  });
-
-  module('client counts card enterprise', function (hooks) {
-    hooks.beforeEach(async function () {
-      clientsHandlers(this.server);
-      this.store = this.owner.lookup('service:store');
-
-      await authPage.login();
-    });
-
-    test('shows the client count card for enterprise', async function (assert) {
-      assert.expect(9);
-      const version = this.owner.lookup('service:version');
-      assert.true(version.isEnterprise, 'version is enterprise');
-      assert.strictEqual(currentURL(), '/vault/dashboard');
-      assert.dom(SELECTORS.cardName('client-count')).exists();
-      const response = await this.store.peekRecord('clients/activity', 'some-activity-id');
-      assert.dom('[data-test-client-count-title]').hasText('Client count');
-      assert.dom('[data-test-stat-text="total-clients"] .stat-label').hasText('Total');
-      assert
-        .dom('[data-test-stat-text="total-clients"] .stat-value')
-        .hasText(formatNumber([response.total.clients]));
-      assert.dom('[data-test-stat-text="new-clients"] .stat-label').hasText('New');
-      assert
-        .dom('[data-test-stat-text="new-clients"] .stat-text')
-        .hasText('The number of clients new to Vault in the current month.');
-      assert
-        .dom('[data-test-stat-text="new-clients"] .stat-value')
-        .hasText(formatNumber([response.byMonth.lastObject.new_clients.clients]));
-    });
+    assert.dom(DASHBOARD.cardHeader('Vault version')).hasText(versionText);
   });
 
-  module('replication card enterprise', function (hooks) {
-    hooks.beforeEach(async function () {
-      await authPage.login();
-      await settled();
-      await disableReplication('dr');
-      await settled();
-      await disableReplication('performance');
-      await settled();
-    });
-
-    test('shows the replication card empty state in enterprise version', async function (assert) {
-      assert.expect(5);
-      await visit('/vault/dashboard');
-      const version = this.owner.lookup('service:version');
-      assert.true(version.isEnterprise, 'vault is enterprise');
-      assert.dom(SELECTORS.emptyState('replication')).exists();
-      assert.dom(SELECTORS.emptyStateTitle('replication')).hasText('Replication not set up');
-      assert
-        .dom(SELECTORS.emptyStateMessage('replication'))
-        .hasText('Data will be listed here. Enable a primary replication cluster to get started.');
-      assert.dom(SELECTORS.emptyStateActions('replication')).hasText('Enable replication');
-    });
-
-    test('hides the replication card on a non-root namespace enterprise version', async function (assert) {
-      assert.expect(3);
-      await visit('/vault/dashboard');
-      const version = this.owner.lookup('service:version');
-      assert.true(version.isEnterprise, 'vault is enterprise');
-      assert.dom(SELECTORS.cardName('replication')).exists();
-      await runCmd(createNS('blah'), false);
-      await visit('/vault/dashboard?namespace=blah');
-      assert.dom(SELECTORS.cardName('replication')).doesNotExist();
-    });
-
-    test('it should show replication status if both dr and performance replication are enabled as features in enterprise', async function (assert) {
-      assert.expect(9);
-      const version = this.owner.lookup('service:version');
-      assert.true(version.isEnterprise, 'vault is enterprise');
-      await visit('/vault/replication');
-      assert.strictEqual(currentURL(), '/vault/replication');
-      await click('[data-test-replication-type-select="performance"]');
-      await fillIn('[data-test-replication-cluster-mode-select]', 'primary');
-      await click('[data-test-replication-enable]');
-      await pollCluster(this.owner);
-      assert.ok(
-        await waitUntil(() => find('[data-test-replication-dashboard]')),
-        'details dashboard is shown'
-      );
-      await visit('/vault/dashboard');
-      assert.dom(SELECTORS.title('DR primary')).hasText('DR primary');
-      assert.dom(SELECTORS.tooltipTitle('DR primary')).hasText('not set up');
-      assert.dom(SELECTORS.tooltipIcon('dr-perf', 'DR primary', 'x-circle')).exists();
-      assert.dom(SELECTORS.title('Performance primary')).hasText('Performance primary');
-      assert.dom(SELECTORS.tooltipTitle('Performance primary')).hasText('running');
-      assert.dom(SELECTORS.tooltipIcon('dr-perf', 'Performance primary', 'check-circle')).exists();
-    });
-  });
-
-  module('custom messages auth tests', function (hooks) {
-    hooks.beforeEach(function () {
-      return this.server.get('/sys/internal/ui/mounts', () => ({}));
-    });
-
-    test('it shows the alert banner and modal message', async function (assert) {
-      this.server.get('/sys/internal/ui/unauthenticated-messages', function () {
-        return authenticatedMessageResponse;
-      });
-      assert.expect(7);
-      await visit('/vault/dashboard');
-      const modalId = 'some-awesome-id-1';
-      const alertId = 'some-awesome-id-2';
-      assert.dom(PAGE.modal(modalId)).exists();
-      assert.dom(PAGE.modalTitle(modalId)).hasText('Modal title');
-      assert.dom(PAGE.modalBody(modalId)).exists();
-      assert.dom(PAGE.modalBody(modalId)).hasText('here is a cool message');
-      await click(PAGE.modalButton(modalId));
-      assert.dom(PAGE.alertTitle(alertId)).hasText('Banner title');
-      assert.dom(PAGE.alertDescription(alertId)).hasText('hello world hello wolrd');
-      assert.dom(PAGE.alertAction('link')).hasText('some link title');
-    });
-    test('it shows the multiple modal messages', async function (assert) {
-      assert.expect(8);
-      const modalIdOne = 'some-awesome-id-2';
-      const modalIdTwo = 'some-awesome-id-1';
-
-      this.server.get('/sys/internal/ui/unauthenticated-messages', function () {
-        authenticatedMessageResponse.data.key_info[modalIdOne].type = 'modal';
-        authenticatedMessageResponse.data.key_info[modalIdOne].title = 'Modal title 1';
-        authenticatedMessageResponse.data.key_info[modalIdTwo].type = 'modal';
-        authenticatedMessageResponse.data.key_info[modalIdTwo].title = 'Modal title 2';
-        return authenticatedMessageResponse;
-      });
-      await visit('/vault/dashboard');
-      assert.dom(PAGE.modal(modalIdOne)).exists();
-      assert.dom(PAGE.modalTitle(modalIdOne)).hasText('Modal title 1');
-      assert.dom(PAGE.modalBody(modalIdOne)).exists();
-      assert.dom(PAGE.modalBody(modalIdOne)).hasText('hello world hello wolrd some link title');
-      await click(PAGE.modalButton(modalIdOne));
-      assert.dom(PAGE.modal(modalIdTwo)).exists();
-      assert.dom(PAGE.modalTitle(modalIdTwo)).hasText('Modal title 2');
-      assert.dom(PAGE.modalBody(modalIdTwo)).exists();
-      assert.dom(PAGE.modalBody(modalIdTwo)).hasText('here is a cool message');
-      await click(PAGE.modalButton(modalIdTwo));
-    });
-    test('it shows the multiple banner messages', async function (assert) {
-      assert.expect(5);
-      const bannerIdOne = 'some-awesome-id-2';
-      const bannerIdTwo = 'some-awesome-id-1';
-
-      this.server.get('/sys/internal/ui/unauthenticated-messages', function () {
-        authenticatedMessageResponse.data.key_info[bannerIdOne].type = 'banner';
-        authenticatedMessageResponse.data.key_info[bannerIdOne].title = 'Banner title 1';
-        authenticatedMessageResponse.data.key_info[bannerIdTwo].type = 'banner';
-        authenticatedMessageResponse.data.key_info[bannerIdTwo].title = 'Banner title 2';
-        return authenticatedMessageResponse;
-      });
-      await visit('/vault/dashboard');
-      assert.dom(PAGE.alertTitle(bannerIdOne)).hasText('Banner title 1');
-      assert.dom(PAGE.alertDescription(bannerIdOne)).hasText('hello world hello wolrd');
-      assert.dom(PAGE.alertAction('link')).hasText('some link title');
-      assert.dom(PAGE.alertTitle(bannerIdTwo)).hasText('Banner title 2');
-      assert.dom(PAGE.alertDescription(bannerIdTwo)).hasText('here is a cool message');
-    });
+  test('hides the configuration details card on a non-root namespace enterprise version', async function (assert) {
+    // The route checks `inRootNamespace` so stub that return
+    const nsStub = Sinon.stub(this.namespace, 'inRootNamespace').get(() => false);
+    await login();
+    await visit('/vault/dashboard');
+    assert.dom(DASHBOARD.cardName('configuration-details')).doesNotExist();
+    nsStub.restore();
   });
 });
diff --git a/ui/tests/acceptance/enterprise-control-groups-test.js b/ui/tests/acceptance/enterprise-control-groups-test.js
index 04e7575d4fc..6e93a10e188 100644
--- a/ui/tests/acceptance/enterprise-control-groups-test.js
+++ b/ui/tests/acceptance/enterprise-control-groups-test.js
@@ -1,39 +1,33 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { settled, currentURL, currentRouteName, visit, waitUntil } from '@ember/test-helpers';
-import { module, test, skip } from 'qunit';
+import {
+  settled,
+  currentURL,
+  currentRouteName,
+  visit,
+  waitUntil,
+  fillIn,
+  click,
+  waitFor,
+  find,
+} from '@ember/test-helpers';
+import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { create } from 'ember-cli-page-object';
-
 import { storageKey } from 'vault/services/control-group';
-import consoleClass from 'vault/tests/pages/components/console/ui-panel';
-import authForm from 'vault/tests/pages/components/auth-form';
-import controlGroup from 'vault/tests/pages/components/control-group';
-import controlGroupSuccess from 'vault/tests/pages/components/control-group-success';
 import { writeSecret } from 'vault/tests/helpers/kv/kv-run-commands';
-import authPage from 'vault/tests/pages/auth';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { login, logout } from 'vault/tests/helpers/auth/auth-helpers';
 import { runCmd } from 'vault/tests/helpers/commands';
-
-const consoleComponent = create(consoleClass);
-const authFormComponent = create(authForm);
-const controlGroupComponent = create(controlGroup);
-const controlGroupSuccessComponent = create(controlGroupSuccess);
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CONTROL_GROUP } from 'vault/tests/helpers/components/control-group-selectors';
 
 module('Acceptance | Enterprise | control groups', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(function () {
-    setRunOptions({
-      rules: {
-        // TODO: fix the hashi-read-only theme
-        'color-contrast': { enabled: false },
-      },
-    });
-    return authPage.login();
+    return login();
   });
 
   const POLICY = `
@@ -81,10 +75,8 @@ module('Acceptance | Enterprise | control groups', function (hooks) {
   const ADMIN_USER = 'authorizer';
   const ADMIN_PASSWORD = 'test';
   const setupControlGroup = async (context) => {
-    await visit('/vault/secrets');
-    await consoleComponent.toggle();
-    await settled();
-    await runCmd([
+    await visit('/vault/secrets-engines');
+    const userpassAccessor = await runCmd([
       //enable kv-v1 mount and write a secret
       'write sys/mounts/kv type=kv',
       'write kv/foo bar=baz',
@@ -99,28 +91,23 @@ module('Acceptance | Enterprise | control groups', function (hooks) {
       // read out mount to get the accessor
       'read -field=accessor sys/internal/ui/mounts/auth/userpass',
     ]);
-    await settled();
-    const userpassAccessor = consoleComponent.lastTextOutput;
 
-    await runCmd([
+    const authorizerEntityId = await runCmd([
       // lookup entity id for our authorizer
       `write -field=id identity/lookup/entity name=${ADMIN_USER}`,
     ]);
-    await settled();
-    const authorizerEntityId = consoleComponent.lastTextOutput;
-    await runCmd([
+
+    const userToken = await runCmd([
       // create alias for authorizor and add them to the managers group
       `write identity/alias mount_accessor=${userpassAccessor} entity_id=${authorizerEntityId} name=${ADMIN_USER}`,
       `write identity/group name=managers member_entity_ids=${authorizerEntityId} policies=authorizer`,
       // create a token to request access to kv/foo
       'write -field=client_token auth/token/create policies=kv-control-group',
     ]);
+    context.userToken = userToken;
+    await login(userToken);
     await settled();
-    context.userToken = consoleComponent.lastLogOutput;
-
-    await authPage.login(context.userToken);
-    await settled();
-    return this;
+    return context;
   };
 
   test('for v2 secrets it redirects you if you try to navigate to a Control Group restricted path', async function (assert) {
@@ -129,7 +116,7 @@ module('Acceptance | Enterprise | control groups', function (hooks) {
     await settled();
     await setupControlGroup(this);
     await settled();
-    await visit('/vault/secrets/kv-v2-mount/kv/foo/details');
+    await visit('/vault/secrets-engines/kv-v2-mount/kv/foo/details');
 
     assert.ok(
       await waitUntil(() => currentRouteName() === 'vault.cluster.access.control-group-accessor'),
@@ -143,38 +130,32 @@ module('Acceptance | Enterprise | control groups', function (hooks) {
   });
 
   const workflow = async (assert, context, shouldStoreToken) => {
-    const url = '/vault/secrets/kv/show/foo';
+    const url = '/vault/secrets-engines/kv/show/foo';
     await setupControlGroup(context);
     await settled();
     // as the requestor, go to the URL that's blocked by the control group
     // and store the values
     await visit(url);
-
-    const accessor = controlGroupComponent.accessor;
-    const controlGroupToken = controlGroupComponent.token;
-    await authPage.logout();
+    await waitFor(CONTROL_GROUP.accessorValue);
+    const accessor = find(CONTROL_GROUP.accessorValue).textContent.trim();
+    const controlGroupToken = find(CONTROL_GROUP.tokenValue).textContent.trim();
+    await logout();
     await settled();
     // log in as the admin, navigate to the accessor page,
     // and authorize the control group request
     await visit('/vault/auth?with=userpass');
 
-    await authFormComponent.username(ADMIN_USER);
-    await settled();
-    await authFormComponent.password(ADMIN_PASSWORD);
-    await settled();
-    await authFormComponent.login();
-    await settled();
+    await fillIn(GENERAL.inputByAttr('username'), ADMIN_USER);
+    await fillIn(GENERAL.inputByAttr('password'), ADMIN_PASSWORD);
+    await click(GENERAL.submitButton);
     await visit(`/vault/access/control-groups/${accessor}`);
 
     // putting here to help with flaky test
-    assert.dom('[data-test-authorize-button]').exists();
-    await controlGroupComponent.authorize();
-    await settled();
-    assert.strictEqual(controlGroupComponent.bannerPrefix, 'Thanks!', 'text display changes');
-    await settled();
-    await authPage.logout();
+    await waitFor(GENERAL.button('Authorize'));
+    await click(GENERAL.button('Authorize'));
+    assert.dom(CONTROL_GROUP.bannerPrefix).hasText('Thanks!', 'text display changes');
     await settled();
-    await authPage.login(context.userToken);
+    await login(context.userToken);
     await settled();
     if (shouldStoreToken) {
       localStorage.setItem(
@@ -190,39 +171,31 @@ module('Acceptance | Enterprise | control groups', function (hooks) {
       );
       await visit(`/vault/access/control-groups/${accessor}`);
 
-      assert.ok(controlGroupSuccessComponent.showsNavigateMessage, 'shows user the navigate message');
-      await controlGroupSuccessComponent.navigate();
-      await settled();
+      assert.dom(CONTROL_GROUP.navMessage).exists('shows user the navigate message');
+      await click(GENERAL.button('Visit'));
       assert.strictEqual(currentURL(), url, 'successfully loads the target url');
     } else {
       await visit(`/vault/access/control-groups/${accessor}`);
-
-      await controlGroupSuccessComponent.token(controlGroupToken);
-      await settled();
-      await controlGroupSuccessComponent.unwrap();
-      await settled();
-      assert.ok(controlGroupSuccessComponent.showsJsonViewer, 'shows the json viewer');
+      await fillIn(GENERAL.inputByAttr('token'), controlGroupToken);
+      await click(GENERAL.submitButton);
+      await waitFor(CONTROL_GROUP.jsonViewer);
+      assert.dom(CONTROL_GROUP.jsonViewer).exists('shows the json viewer');
     }
   };
 
-  skip('it allows the full flow to work without a saved token', async function (assert) {
+  test('it allows the full flow to work without a saved token', async function (assert) {
     await workflow(assert, this);
     await settled();
   });
 
-  skip('it allows the full flow to work with a saved token', async function (assert) {
+  test('it allows the full flow to work with a saved token', async function (assert) {
     await workflow(assert, this, true);
     await settled();
   });
 
   test('it displays the warning in the console when making a request to a Control Group path', async function (assert) {
     await setupControlGroup(this);
-    await settled();
-    await consoleComponent.toggle();
-    await settled();
-    await runCmd('read kv/foo');
-    await settled();
-    const output = consoleComponent.lastLogOutput;
+    const output = await runCmd('read kv/foo');
     assert.ok(output.includes('A Control Group was encountered at kv/foo'));
     assert.ok(output.includes('The Control Group Token is'));
     assert.ok(output.includes('The Accessor is'));
diff --git a/ui/tests/acceptance/enterprise-kmip-test.js b/ui/tests/acceptance/enterprise-kmip-test.js
index 868f5f954c6..1add83f76ba 100644
--- a/ui/tests/acceptance/enterprise-kmip-test.js
+++ b/ui/tests/acceptance/enterprise-kmip-test.js
@@ -1,39 +1,38 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentURL, currentRouteName, settled, fillIn, waitUntil, find } from '@ember/test-helpers';
+import {
+  currentURL,
+  currentRouteName,
+  settled,
+  fillIn,
+  visit,
+  waitUntil,
+  find,
+  click,
+} from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import scopesPage from 'vault/tests/pages/secrets/backend/kmip/scopes';
 import rolesPage from 'vault/tests/pages/secrets/backend/kmip/roles';
 import credentialsPage from 'vault/tests/pages/secrets/backend/kmip/credentials';
 import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
-import { allEngines } from 'vault/helpers/mountable-secret-engines';
-import { runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+import { mountEngineCmd, runCmd } from 'vault/tests/helpers/commands';
 import { v4 as uuidv4 } from 'uuid';
 
-const getRandomPort = () => {
-  let a = Math.floor(100000 + Math.random() * 900000);
-  a = String(a);
-  return a.substring(0, 4);
-};
-
-const mount = async (backend) => {
-  const res = await runCmd(`write sys/mounts/${backend} type=kmip`);
-  await settled();
-  if (res.includes('Error')) {
-    throw new Error(`Error mounting secrets engine: ${res}`);
-  }
-  return backend;
-};
+// port has a lower limit of 1024
+const getRandomPort = () => Math.floor(Math.random() * 5000 + 1024);
 
 const mountWithConfig = async (backend) => {
-  const addr = `127.0.0.1:${getRandomPort()}`; // use random port
-  await mount(backend);
+  const addr = `127.0.0.1:${getRandomPort()}`;
+  await runCmd(mountEngineCmd('kmip', backend), false);
   const res = await runCmd(`write ${backend}/config listen_addrs=${addr}`);
   if (res.includes('Error')) {
     throw new Error(`Error configuring KMIP: ${res}`);
@@ -78,12 +77,13 @@ const generateCreds = async (backend) => {
   }
   return { backend, scope, role, serial };
 };
+
 module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(async function () {
     this.backend = `kmip-${uuidv4()}`;
-    await authPage.login();
+    await login();
     return;
   });
 
@@ -92,13 +92,13 @@ module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
     await runCmd([`delete sys/mounts/${this.backend}`], false);
   });
 
-  test('it should enables KMIP & transitions to addon engine route after mount success', async function (assert) {
+  test('it should enable KMIP & transitions to addon engine route after mount success', async function (assert) {
     // test supported backends that ARE ember engines (enterprise only engines are tested individually)
-    const engine = allEngines().find((e) => e.type === 'kmip');
+    const engine = engineDisplayData('kmip');
 
     await mountSecrets.visit();
-    await mountSecrets.selectType(engine.type);
-    await mountSecrets.path(this.backend).submit();
+    await mountBackend(engine.type, `${engine.type}-${uuidv4()}`);
+
     assert.strictEqual(
       currentRouteName(),
       `vault.cluster.secrets.backend.${engine.engineRoute}`,
@@ -108,14 +108,15 @@ module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
   });
 
   test('it can configure a KMIP secrets engine', async function (assert) {
-    const backend = await mount(this.backend);
+    await runCmd(mountEngineCmd('kmip', this.backend));
+    const backend = this.backend;
     await scopesPage.visit({ backend });
     await settled();
     await scopesPage.configurationLink();
     await settled();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/configuration`,
+      `/vault/secrets-engines/${backend}/kmip/configuration`,
       'configuration navigates to the config page'
     );
     assert.ok(scopesPage.isEmpty, 'config page renders empty state');
@@ -124,38 +125,44 @@ module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
     await settled();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/configure`,
+      `/vault/secrets-engines/${backend}/kmip/configure`,
       'configuration navigates to the configure page'
     );
     const addr = `127.0.0.1:${getRandomPort()}`;
     await fillIn('[data-test-string-list-input="0"]', addr);
-    await scopesPage.submit();
-    await settled();
+    await click(GENERAL.submitButton);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/configuration`,
+      `/vault/secrets-engines/${backend}/kmip/configuration`,
       'redirects to configuration page after saving config'
     );
     assert.notOk(scopesPage.isEmpty, 'configuration page no longer renders empty state');
-    assert.dom('[data-test-value-div="Listen addrs"]').hasText(addr, 'renders the correct listen address');
+    assert.dom(GENERAL.infoRowValue('Listen addrs')).hasText(addr, 'renders the correct listen address');
   });
 
   test('it can revoke from the credentials show page', async function (assert) {
     const { backend, scope, role, serial } = await generateCreds(this.backend);
     await settled();
-    await credentialsPage.visitDetail({ backend, scope, role, serial });
-    await settled();
-    await waitUntil(() => find('[data-test-confirm-action-trigger]'));
-    assert.dom('[data-test-confirm-action-trigger]').exists('delete button exists');
-    await credentialsPage.delete().confirmDelete();
-    await settled();
+    await visit(`/vault/secrets-engines/${backend}/kmip/scopes/${scope}/roles/${role}/credentials/${serial}`);
+
+    // Wait for the delete/revoke button to appear
+    await waitUntil(() => find(GENERAL.confirmTrigger));
+    assert.dom(GENERAL.confirmTrigger).exists('Confirm trigger exists before clicking');
+    await click(GENERAL.confirmTrigger);
+
+    // Wait for the confirm delete button to appear
+    await waitUntil(() => find(GENERAL.confirmButton));
+    assert.dom(GENERAL.confirmButton).exists('Confirm delete exists before clicking');
+    await click(GENERAL.confirmButton);
 
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/scopes/${scope}/roles/${role}/credentials`,
+      `/vault/secrets-engines/${backend}/kmip/scopes/${scope}/roles/${role}/credentials`,
       'redirects to the credentials list'
     );
-    assert.ok(credentialsPage.isEmpty, 'renders an empty credentials page');
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('No credentials yet for this role', 'renders an empty credentials page');
   });
 
   test('it can create a scope', async function (assert) {
@@ -166,23 +173,35 @@ module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
     await settled();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/scopes/create`,
+      `/vault/secrets-engines/${backend}/kmip/scopes/create`,
       'navigates to the kmip scope create page'
     );
 
     // create scope
     await scopesPage.scopeName('foo');
     await settled();
-    await scopesPage.submit();
-    await settled();
+    await click(GENERAL.submitButton);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/scopes`,
+      `/vault/secrets-engines/${backend}/kmip/scopes`,
       'navigates to the kmip scopes page after create'
     );
     assert.strictEqual(scopesPage.listItemLinks.length, 1, 'renders a single scope');
   });
 
+  test('it navigates to kmip scopes view using breadcrumbs', async function (assert) {
+    const backend = await mountWithConfig(this.backend);
+    await scopesPage.visitCreate({ backend });
+    await settled();
+    await click(GENERAL.breadcrumbLink(backend));
+
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backend.kmip.scopes.index',
+      'Breadcrumb transitions to scopes list'
+    );
+  });
+
   test('it can delete a scope from the list', async function (assert) {
     const { backend } = await createScope(this.backend);
     await scopesPage.visit({ backend });
@@ -190,26 +209,19 @@ module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
     // delete the scope
     await scopesPage.listItemLinks.objectAt(0).menuToggle();
     await settled();
-    await scopesPage.delete();
-    await settled();
-    await scopesPage.confirmDelete();
-    await settled();
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
     assert.strictEqual(scopesPage.listItemLinks.length, 0, 'no scopes');
     assert.ok(scopesPage.isEmpty, 'renders the empty state');
   });
 
   test('it can create a role', async function (assert) {
     // moving create scope here to help with flaky test
-    const backend = await mountWithConfig(this.backend);
-    await settled();
     const scope = `scope-for-can-create-role`;
-    await settled();
-    const res = await runCmd([`write ${backend}/scope/${scope} -force`]);
-    await settled();
-    if (res.includes('Error')) {
-      throw new Error(`Error creating scope: ${res}`);
-    }
     const role = `role-new-role`;
+    const backend = await mountWithConfig(this.backend);
+    await settled();
+    await runCmd([`write ${backend}/scope/${scope} -force`], true);
     await rolesPage.visit({ backend, scope });
     await settled();
     assert.ok(rolesPage.isEmpty, 'renders the empty role page');
@@ -217,21 +229,53 @@ module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
     await settled();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/scopes/${scope}/roles/create`,
+      `/vault/secrets-engines/${backend}/kmip/scopes/${scope}/roles/create`,
       'links to the role create form'
     );
+    // check that the role form looks right
+    assert.dom(GENERAL.inputByAttr('operationNone')).isChecked('allows role to perform roles by default');
+    assert.dom(GENERAL.inputByAttr('operationAll')).isChecked('operationAll is checked by default');
+    assert.dom('[data-test-kmip-section]').exists({ count: 2 });
+    assert.dom('[data-test-kmip-operations]').exists({ count: 4 });
 
     await rolesPage.roleName(role);
     await settled();
-    await rolesPage.submit();
-    await settled();
+    await click(GENERAL.submitButton);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/scopes/${scope}/roles`,
+      `/vault/secrets-engines/${backend}/kmip/scopes/${scope}/roles`,
       'redirects to roles list'
     );
 
     assert.strictEqual(rolesPage.listItemLinks.length, 1, 'renders a single role');
+    await rolesPage.visitDetail({ backend, scope, role });
+    // check that the role details looks right
+    assert.dom('h2').exists({ count: 3 }, 'renders correct section headings');
+    assert.dom('[data-test-inline-error-message]').hasText('This role allows all KMIP operations');
+    ['Managed Cryptographic Objects', 'Object Attributes', 'Server', 'Other'].forEach((title) => {
+      assert.dom(`[data-test-row-label="${title}"]`).exists(`Renders allowed operations row for: ${title}`);
+    });
+  });
+
+  test('it navigates to kmip roles view using breadcrumbs', async function (assert) {
+    const { backend, scope, role } = await createRole(this.backend);
+    await settled();
+    await rolesPage.visitDetail({ backend, scope, role });
+    // navigate to scope from role
+    await click(GENERAL.breadcrumbLink(scope));
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backend.kmip.scope.roles',
+      'Breadcrumb transitions to scope details'
+    );
+    await rolesPage.visitDetail({ backend, scope, role });
+    // navigate to scopes from role
+    await click(GENERAL.breadcrumbLink(backend));
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backend.kmip.scopes.index',
+      'Breadcrumb transitions to scopes list'
+    );
   });
 
   test('it can delete a role from the list', async function (assert) {
@@ -241,10 +285,8 @@ module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
     // delete the role
     await rolesPage.listItemLinks.objectAt(0).menuToggle();
     await settled();
-    await rolesPage.delete();
-    await settled();
-    await rolesPage.confirmDelete();
-    await settled();
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
     assert.strictEqual(rolesPage.listItemLinks.length, 0, 'renders no roles');
     assert.ok(rolesPage.isEmpty, 'renders empty');
   });
@@ -259,21 +301,20 @@ module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
     await settled();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/scopes/${scope}/roles/${role}/edit`,
+      `/vault/secrets-engines/${backend}/kmip/scopes/${scope}/roles/${role}/edit`,
       'navigates to role edit'
     );
-    await rolesPage.cancelLink();
-    await settled();
+    await click(GENERAL.cancelButton);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/scopes/${scope}/roles/${role}`,
+      `/vault/secrets-engines/${backend}/kmip/scopes/${scope}/roles/${role}`,
       'cancel navigates to role show'
     );
-    await rolesPage.delete().confirmDelete();
-    await settled();
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/scopes/${scope}/roles`,
+      `/vault/secrets-engines/${backend}/kmip/scopes/${scope}/roles`,
       'redirects to the roles list'
     );
     assert.ok(rolesPage.isEmpty, 'renders an empty roles page');
@@ -288,21 +329,44 @@ module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
     await settled();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/kmip/scopes/${scope}/roles/${role}/credentials/generate`,
+      `/vault/secrets-engines/${backend}/kmip/scopes/${scope}/roles/${role}/credentials/generate`,
       'navigates to generate credentials'
     );
-    await credentialsPage.submit();
-    await settled();
+    await click(GENERAL.submitButton);
     assert.strictEqual(
       currentRouteName(),
-      'vault.cluster.secrets.backend.kmip.credentials.show',
-      'generate redirects to the show page'
+      'vault.cluster.secrets.backend.kmip.credentials.generate',
+      'it remains in the generate route'
     );
+    assert
+      .dom(GENERAL.infoRowValue('Private key'))
+      .hasText(
+        'Warning You will not be able to access the private key later, so please copy the information below. ***********',
+        'it renders private key after generating'
+      );
     await credentialsPage.backToRoleLink();
     await settled();
     assert.strictEqual(credentialsPage.listItemLinks.length, 1, 'renders a single credential');
   });
 
+  test('it can revoke a credential from the generate view', async function (assert) {
+    const { backend, scope, role } = await createRole(this.backend);
+    await credentialsPage.visit({ backend, scope, role });
+    await credentialsPage.generateCredentialsLink();
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(GENERAL.confirmTrigger));
+    assert.dom(GENERAL.confirmTrigger).exists('delete button exists');
+    // revoke the credentials
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${backend}/kmip/scopes/${scope}/roles/${role}/credentials`,
+      'redirects to the credentials list'
+    );
+    assert.true(credentialsPage.isEmpty, 'renders an empty credentials page');
+  });
+
   test('it can revoke a credential from the list', async function (assert) {
     const { backend, scope, role } = await generateCreds(this.backend);
     await credentialsPage.visit({ backend, scope, role });
@@ -310,9 +374,90 @@ module('Acceptance | Enterprise | KMIP secrets', function (hooks) {
     await settled();
     await credentialsPage.listItemLinks.objectAt(0).menuToggle();
     await settled();
-    await credentialsPage.delete().confirmDelete();
-    await settled();
+    await waitUntil(() => find(GENERAL.confirmTrigger));
+    assert.dom(GENERAL.confirmTrigger).exists('delete button exists');
+    // revoke the credentials
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
     assert.strictEqual(credentialsPage.listItemLinks.length, 0, 'renders no credentials');
     assert.ok(credentialsPage.isEmpty, 'renders empty');
   });
+
+  // the kmip/role model relies on openApi so testing the form via an acceptance test
+  module('kmip role edit form', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.store = this.owner.lookup('service:store');
+      this.scope = 'my-scope';
+      this.name = 'my-role';
+      await login();
+      await runCmd(mountEngineCmd('kmip', this.backend), false);
+      await runCmd([`write ${this.backend}/scope/${this.scope} -force`]);
+      await rolesPage.visit({ backend: this.backend, scope: this.scope });
+      this.setModel = async () => {
+        await click(GENERAL.submitButton);
+        await visit(`/vault/secrets-engines/${this.backend}/kmip/scopes/${this.scope}/roles/${this.name}`);
+        this.model = this.store.peekRecord('kmip/role', this.name);
+      };
+    });
+
+    // "operationNone" is the attr name for the 'Allow this role to perform KMIP operations' toggle
+    // operationNone = false => the toggle is ON and KMIP operations are allowed
+    // operationNone = true => the toggle is OFF and KMIP operations are not allowed
+    test('it submits when operationNone is toggled on', async function (assert) {
+      assert.expect(3);
+
+      await click('[data-test-role-create]');
+      await fillIn(GENERAL.inputByAttr('role'), this.name);
+      assert.dom(GENERAL.inputByAttr('operationAll')).isChecked('operationAll is checked by default');
+      await this.setModel();
+      assert.true(this.model.operationAll, 'operationAll is true');
+      assert.strictEqual(this.model.operationNone, undefined, 'operationNone is unset');
+    });
+
+    test('it submits when operationNone is toggled off', async function (assert) {
+      assert.expect(4);
+
+      await click('[data-test-role-create]');
+      await fillIn(GENERAL.inputByAttr('role'), this.name);
+      await click(GENERAL.inputByAttr('operationNone'));
+      assert
+        .dom(GENERAL.inputByAttr('operationNone'))
+        .isNotChecked('Allow this role to perform KMIP operations is toggled off');
+      assert
+        .dom(GENERAL.inputByAttr('operationAll'))
+        .doesNotExist('clicking the toggle hides KMIP operation checkboxes');
+      await this.setModel();
+      assert.strictEqual(this.model.operationAll, undefined, 'operationAll is unset');
+      assert.true(this.model.operationNone, 'operationNone is true');
+    });
+
+    test('it submits when operationAll is unchecked', async function (assert) {
+      assert.expect(2);
+
+      await click('[data-test-role-create]');
+      await fillIn(GENERAL.inputByAttr('role'), this.name);
+      await click(GENERAL.inputByAttr('operationAll'));
+      await this.setModel();
+
+      assert.strictEqual(this.model.operationAll, undefined, 'operationAll is unset');
+      assert.true(this.model.operationNone, 'operationNone is true');
+    });
+
+    test('it submits individually selected operations', async function (assert) {
+      assert.expect(6);
+
+      await click('[data-test-role-create]');
+      await fillIn(GENERAL.inputByAttr('role'), this.name);
+      await click(GENERAL.inputByAttr('operationAll'));
+      await click(GENERAL.inputByAttr('operationGet'));
+      await click(GENERAL.inputByAttr('operationGetAttributes'));
+      assert.dom(GENERAL.inputByAttr('operationAll')).isNotChecked();
+      assert.dom(GENERAL.inputByAttr('operationCreate')).isNotChecked(); // unchecking operationAll deselects the other checkboxes
+      await this.setModel();
+      assert.strictEqual(this.model.operationAll, undefined, 'operationAll is unset');
+      assert.strictEqual(this.model.operationNone, undefined, 'operationNone is unset');
+      assert.true(this.model.operationGet, 'operationGet is true');
+      assert.true(this.model.operationGetAttributes, 'operationGetAttributes is true');
+    });
+  });
 });
diff --git a/ui/tests/acceptance/enterprise-kmse-test.js b/ui/tests/acceptance/enterprise-kmse-test.js
index c1f503b8137..4f5ed2594c4 100644
--- a/ui/tests/acceptance/enterprise-kmse-test.js
+++ b/ui/tests/acceptance/enterprise-kmse-test.js
@@ -1,35 +1,35 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { click, currentRouteName, fillIn } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { allEngines } from 'vault/helpers/mountable-secret-engines';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
 import { runCmd } from '../helpers/commands';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import engineDisplayData from 'vault/helpers/engines-display-data';
 
 module('Acceptance | Enterprise | keymgmt', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
   hooks.beforeEach(async function () {
-    return authPage.login();
+    return login();
   });
 
   test('it transitions to list route after mount success', async function (assert) {
     assert.expect(1);
-    const engine = allEngines().find((e) => e.type === 'keymgmt');
+    const engine = engineDisplayData('keymgmt');
 
     // delete any previous mount with same name
     await runCmd([`delete sys/mounts/${engine.type}`]);
     await mountSecrets.visit();
-    await mountSecrets.selectType(engine.type);
-    await mountSecrets.path(engine.type);
-    await mountSecrets.submit();
+    await mountBackend(engine.type, engine.type);
 
     assert.strictEqual(
       currentRouteName(),
@@ -46,7 +46,7 @@ module('Acceptance | Enterprise | keymgmt', function (hooks) {
     this.server.put(`/${path}/kms/test-keyvault/key/test-key`, () => ({}));
 
     await mountSecrets.enable('keymgmt', path);
-    await click('[data-test-secret-create]');
+    await click(SES.createSecretLink);
     await fillIn('[data-test-input="provider"]', 'azurekeyvault');
     await fillIn('[data-test-input="name"]', 'test-keyvault');
     await fillIn('[data-test-input="keyCollection"]', 'test-keycollection');
diff --git a/ui/tests/acceptance/enterprise-license-banner-test.js b/ui/tests/acceptance/enterprise-license-banner-test.js
index 9d84c71e7dc..c8213d40516 100644
--- a/ui/tests/acceptance/enterprise-license-banner-test.js
+++ b/ui/tests/acceptance/enterprise-license-banner-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,10 +7,10 @@ import { module, test } from 'qunit';
 import sinon from 'sinon';
 import { visit } from '@ember/test-helpers';
 import { setupApplicationTest } from 'ember-qunit';
-import Pretender from 'pretender';
 import formatRFC3339 from 'date-fns/formatRFC3339';
 import { addDays, subDays } from 'date-fns';
 import timestamp from 'core/utils/timestamp';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 const generateHealthResponse = (now, state) => {
   let expiry;
@@ -47,31 +47,16 @@ const generateHealthResponse = (now, state) => {
 
 module('Acceptance | Enterprise | License banner warnings', function (hooks) {
   setupApplicationTest(hooks);
+  setupMirage(hooks);
 
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => new Date('2018-04-03T14:15:30'));
-  });
   hooks.beforeEach(function () {
+    sinon.replace(timestamp, 'now', sinon.fake.returns(new Date('2018-04-03T14:15:30')));
     this.now = timestamp.now();
   });
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
 
   test('it shows no license banner if license expires in > 30 days', async function (assert) {
     const healthResp = generateHealthResponse(this.now);
-    this.server = new Pretender(function () {
-      this.get('/v1/sys/health', (response) => {
-        return [response, { 'Content-Type': 'application/json' }, JSON.stringify(healthResp)];
-      });
-      this.get('/v1/sys/internal/ui/feature-flags', this.passthrough);
-      this.get('/v1/sys/internal/ui/mounts', this.passthrough);
-      this.get('/v1/sys/seal-status', this.passthrough);
-      this.get('/v1/sys/license/features', this.passthrough);
-    });
+    this.server.get('/sys/health', () => healthResp);
     await visit('/vault/auth');
     assert.dom('[data-test-license-banner-expired]').doesNotExist('expired banner does not show');
     assert.dom('[data-test-license-banner-warning]').doesNotExist('warning banner does not show');
@@ -79,15 +64,7 @@ module('Acceptance | Enterprise | License banner warnings', function (hooks) {
   });
   test('it shows license banner warning if license expires within 30 days', async function (assert) {
     const healthResp = generateHealthResponse(this.now, 'expiring');
-    this.server = new Pretender(function () {
-      this.get('/v1/sys/health', (response) => {
-        return [response, { 'Content-Type': 'application/json' }, JSON.stringify(healthResp)];
-      });
-      this.get('/v1/sys/internal/ui/feature-flags', this.passthrough);
-      this.get('/v1/sys/internal/ui/mounts', this.passthrough);
-      this.get('/v1/sys/seal-status', this.passthrough);
-      this.get('/v1/sys/license/features', this.passthrough);
-    });
+    this.server.get('/sys/health', () => healthResp);
     await visit('/vault/auth');
     assert.dom('[data-test-license-banner-warning]').exists('license warning shows');
     this.server.shutdown();
@@ -95,15 +72,7 @@ module('Acceptance | Enterprise | License banner warnings', function (hooks) {
 
   test('it shows license banner alert if license has already expired', async function (assert) {
     const healthResp = generateHealthResponse(this.now, 'expired');
-    this.server = new Pretender(function () {
-      this.get('/v1/sys/health', (response) => {
-        return [response, { 'Content-Type': 'application/json' }, JSON.stringify(healthResp)];
-      });
-      this.get('/v1/sys/internal/ui/feature-flags', this.passthrough);
-      this.get('/v1/sys/internal/ui/mounts', this.passthrough);
-      this.get('/v1/sys/seal-status', this.passthrough);
-      this.get('/v1/sys/license/features', this.passthrough);
-    });
+    this.server.get('/sys/health', () => healthResp);
     await visit('/vault/auth');
     assert.dom('[data-test-license-banner-expired]').exists('expired license message shows');
     this.server.shutdown();
diff --git a/ui/tests/acceptance/enterprise-namespaces-test.js b/ui/tests/acceptance/enterprise-namespaces-test.js
index 1e5fde84a69..b394e98ebf0 100644
--- a/ui/tests/acceptance/enterprise-namespaces-test.js
+++ b/ui/tests/acceptance/enterprise-namespaces-test.js
@@ -1,85 +1,209 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { click, settled, visit, fillIn, currentURL, waitFor } from '@ember/test-helpers';
+import {
+  click,
+  settled,
+  visit,
+  fillIn,
+  currentURL,
+  triggerKeyEvent,
+  find,
+  waitFor,
+  waitUntil,
+} from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { runCmd, createNS } from 'vault/tests/helpers/commands';
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
+import { runCmd, createNSFromPaths, deleteNSFromPaths } from 'vault/tests/helpers/commands';
+import { login, loginNs, logout } from 'vault/tests/helpers/auth/auth-helpers';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Acceptance | Enterprise | namespaces', function (hooks) {
   setupApplicationTest(hooks);
 
-  hooks.beforeEach(function () {
-    return authPage.login();
+  hooks.beforeEach(async () => {
+    await login();
   });
 
+  test('it focuses the search input field when user toggles namespace picker', async function (assert) {
+    await click(GENERAL.button('namespace-picker'));
+
+    // Verify that the search input field is focused
+    const searchInput = find(GENERAL.inputByAttr('Search namespaces'));
+    assert.strictEqual(
+      document.activeElement,
+      searchInput,
+      'The search input field is focused on component load'
+    );
+  });
+
+  test('it navigates to the matching namespace when Enter is pressed', async function (assert) {
+    // Setup: Create namespace(s) via the CLI
+    const namespaces = ['beep/boop'];
+    await createNSFromPaths(namespaces);
+
+    await click(GENERAL.button('namespace-picker'));
+    await click(GENERAL.button('Refresh list'));
+
+    // Simulate typing into the search input
+    await fillIn(GENERAL.inputByAttr('Search namespaces'), 'beep/boop');
+
+    assert
+      .dom(GENERAL.inputByAttr('Search namespaces'))
+      .hasValue('beep/boop', 'The search input field has the correct value');
+
+    // Simulate pressing Enter
+    await triggerKeyEvent(GENERAL.inputByAttr('Search namespaces'), 'keydown', 'Enter');
+
+    // Verify navigation to the matching namespace
+    assert.strictEqual(
+      this.owner.lookup('service:router').currentURL,
+      '/vault/dashboard?namespace=beep%2Fboop',
+      'Navigates to the correct namespace when Enter is pressed'
+    );
+
+    // Cleanup: Delete namespace(s) via the CLI
+    await deleteNSFromPaths(namespaces);
+  });
+
+  // This test originated from this PR: https://github.com/hashicorp/vault/pull/7186
   test('it clears namespaces when you log out', async function (assert) {
-    const ns = 'foo';
-    await runCmd(createNS(ns), false);
+    // Test Setup
+    const namespace = 'foo';
+    await createNSFromPaths([namespace]);
+
     const token = await runCmd(`write -field=client_token auth/token/create policies=default`);
-    await logout.visit();
-    await authPage.login(token);
-    await click('[data-test-namespace-toggle]');
-    assert.dom('[data-test-current-namespace]').hasText('root', 'root renders as current namespace');
-    assert.dom('[data-test-namespace-link]').doesNotExist('Additional namespace have been cleared');
+    await login(token);
+
+    // Open the namespace picker
+    await click(GENERAL.button('namespace-picker'));
+
+    // Verify that the root namespace is selected by default
+    assert.dom(GENERAL.button('root')).hasAttribute('aria-selected', 'true', 'root is selected by default');
+    assert
+      .dom(`${GENERAL.button('root')} svg${GENERAL.icon('check')}`)
+      .exists('The root namespace has a check icon indicating it is selected');
+
+    // Verify that the foo namespace does not exist in the namespace picker
+    assert.dom(GENERAL.button(namespace)).doesNotExist('foo should not exist in the namespace picker');
+
+    // Logout and log back into root
+    await logout();
+    await login();
+
+    // Open the namespace picker & verify that the foo namespace does exist
+    await click(GENERAL.button('namespace-picker'));
+    assert.dom(GENERAL.button(namespace)).exists('foo should exist in the namespace picker');
+
+    // Cleanup: Delete namespace(s) via the CLI
+    await deleteNSFromPaths([namespace]);
   });
 
-  test('it shows nested namespaces if you log in with a namespace starting with a /', async function (assert) {
-    assert.expect(5);
-
-    await click('[data-test-namespace-toggle]');
-
-    const nses = ['beep', 'boop', 'bop'];
-    for (const [i, ns] of nses.entries()) {
-      await runCmd(createNS(ns), false);
-      await settled();
-      // the namespace path will include all of the namespaces up to this point
-      const targetNamespace = nses.slice(0, i + 1).join('/');
-      const url = `/vault/secrets?namespace=${targetNamespace}`;
-      // this is usually triggered when creating a ns in the form -- trigger a reload of the namespaces manually
-      await click('[data-test-refresh-namespaces]');
-      await waitFor(`[data-test-namespace-link="${targetNamespace}"]`);
-      // check that the single namespace "beep" or "boop" not "beep/boop" shows in the toggle display
-      assert
-        .dom(`[data-test-namespace-link="${targetNamespace}"]`)
-        .hasText(ns, `shows the namespace ${ns} in the toggle component`);
-      // because quint does not like page reloads, visiting url directly instead of clicking on namespace in toggle
-      await visit(url);
-    }
-
-    await logout.visit();
-    await settled();
-    await authPage.visit({ namespace: '/beep/boop' });
-    await settled();
-    await authPage.tokenInput('root').submit();
+  // This test originated from this PR: https://github.com/hashicorp/vault/pull/7186
+  test('it displays namespaces whether you log in with a namespace prefixed with / or not', async function (assert) {
+    // Setup: Create namespace(s) via the CLI
+    const namespaces = ['beep/boop/bop'];
+    await createNSFromPaths(namespaces);
+
+    await click(GENERAL.button('namespace-picker'));
+    await click(GENERAL.button('Refresh list'));
+
+    // Login with a namespace prefixed with /
+    await loginNs('/beep/boop');
     await settled();
-    await click('[data-test-namespace-toggle]');
-    await waitFor('[data-test-current-namespace]');
-    assert.dom('[data-test-current-namespace]').hasText('/beep/boop/', 'current namespace begins with a /');
+
     assert
-      .dom('[data-test-namespace-link="beep/boop/bop"]')
-      .exists('renders the link to the nested namespace');
+      .dom(GENERAL.button('namespace-picker'))
+      .hasText('boop', `shows the namespace 'boop' in the toggle component`);
+
+    // Open the namespace picker
+    await click(GENERAL.button('namespace-picker'));
+
+    // Find the selected element with the check icon & ensure it exists
+    assert
+      .dom(`${GENERAL.button('beep/boop')} ${GENERAL.icon('check')}`)
+      .exists('The selected namespace link exists with the check icon');
+
+    // Cleanup: Delete namespace(s) via the CLI
+    await deleteNSFromPaths(namespaces);
   });
 
   test('it shows the regular namespace toolbar when not managed', async function (assert) {
     // This test is the opposite of the test in managed-namespace-test
-    await logout.visit();
-    assert.strictEqual(currentURL(), '/vault/auth?with=token', 'Does not redirect');
-    assert.dom('[data-test-namespace-toolbar]').exists('Normal namespace toolbar exists');
-    assert
-      .dom('[data-test-managed-namespace-root]')
-      .doesNotExist('Managed namespace indicator does not exist');
-    assert.dom('input#namespace').hasAttribute('placeholder', '/ (Root)');
-    await fillIn('input#namespace', '/foo/bar ');
+    await logout();
+    assert.strictEqual(currentURL(), '/vault/auth', 'Does not redirect');
+    assert.dom(AUTH_FORM.managedNsRoot).doesNotExist('Managed namespace indicator does not exist');
+    assert.dom(GENERAL.inputByAttr('namespace')).hasAttribute('placeholder', '/ (root)');
+    await fillIn(GENERAL.inputByAttr('namespace'), '/foo/bar ');
     const encodedNamespace = encodeURIComponent('foo/bar');
+    await waitUntil(() => currentURL() === `/vault/auth?namespace=${encodedNamespace}`);
     assert.strictEqual(
       currentURL(),
-      `/vault/auth?namespace=${encodedNamespace}&with=token`,
+      `/vault/auth?namespace=${encodedNamespace}`,
       'correctly sanitizes namespace'
     );
   });
+
+  test('it should allow the user to delete a namespace', async function (assert) {
+    // Setup: Create namespace(s) via the CLI
+    const namespace = 'test-delete-me';
+    await createNSFromPaths([namespace]);
+
+    await visit('/vault/access/namespaces');
+
+    // Verify that the namespace exists in the namespace picker
+    await click(GENERAL.button('namespace-picker'));
+    await waitFor(GENERAL.button('Refresh list'));
+    await click(GENERAL.button('Refresh list'));
+    await fillIn(GENERAL.inputByAttr('Search namespaces'), namespace);
+
+    assert.dom(GENERAL.button(namespace)).exists('Namespace exists in the namespace picker');
+
+    // Close the namespace picker
+    await click(GENERAL.button('namespace-picker'));
+
+    // Verify that the namespace exists in the manage namespaces page
+    await fillIn(GENERAL.filterInputExplicit, namespace);
+    await click(GENERAL.button('Search'));
+
+    // Delete the namespace
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.menuItem('delete'));
+    await click(GENERAL.confirmButton);
+
+    assert.strictEqual(
+      currentURL(),
+      `/vault/access/namespaces?page=1&pageFilter=${namespace}`,
+      'Should remain on the manage namespaces page after deletion'
+    );
+    // Verify that the namespace no longer exists on the namespace page
+    assert.dom(GENERAL.emptyStateTitle).hasText('No namespaces yet', 'Namespace deletion successful');
+
+    // Verify that the namespace does not exist in the namespace picker
+    await click(GENERAL.button('namespace-picker'));
+    await waitFor(GENERAL.button('Refresh list'));
+    await click(GENERAL.button('Refresh list'));
+    await fillIn(GENERAL.inputByAttr('Search namespaces'), namespace);
+    assert
+      .dom(GENERAL.button(namespace))
+      .doesNotExist('Deleted namespace does not exist in the namespace picker');
+  });
+
+  test('it should show root in namespace picker when the user explicitly logs into root namespace', async function (assert) {
+    // Explicitly set root as the namespace to login to
+    await loginNs('root');
+
+    assert
+      .dom(GENERAL.button('namespace-picker'))
+      .hasText('root', `shows the namespace 'root' in the toggle component`);
+
+    // Verify user is in root namespace
+    assert.true(
+      this.owner.lookup('service:namespace').inRootNamespace,
+      'Verifies that the user is in the root namespace'
+    );
+  });
 });
diff --git a/ui/tests/acceptance/enterprise-oidc-namespace-test.js b/ui/tests/acceptance/enterprise-oidc-namespace-test.js
index 7caf49afef3..0bb08a08264 100644
--- a/ui/tests/acceptance/enterprise-oidc-namespace-test.js
+++ b/ui/tests/acceptance/enterprise-oidc-namespace-test.js
@@ -1,82 +1,56 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentURL, click } from '@ember/test-helpers';
+import { fillIn, waitFor } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { runCmd, createNS } from 'vault/tests/helpers/commands';
+import { deleteNS, runCmd } from 'vault/tests/helpers/commands';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import parseURL from 'core/utils/parse-url';
-import authPage from 'vault/tests/pages/auth';
-
-const SELECTORS = {
-  authTab: (path) => `[data-test-auth-method="${path}"] a`,
-};
+import { login, logout } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
 
 module('Acceptance | Enterprise | oidc auth namespace test', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
-  hooks.beforeEach(async function () {
-    this.namespace = 'test-ns';
-    this.rootOidc = 'root-oidc';
-    this.nsOidc = 'ns-oidc';
-
-    this.server.post(`/auth/:path/config`, () => {});
-
-    this.enableOidc = (path, role = '') => {
-      return runCmd([
-        `write sys/auth/${path} type=oidc`,
-        `write auth/${path}/config default_role="${role}" oidc_discovery_url="https://example.com"`,
-        // show method as tab
-        `write sys/auth/${path}/tune listing_visibility="unauth"`,
-      ]);
-    };
-
-    this.disableOidc = (path) => runCmd([`delete /sys/auth/${path}`]);
-  });
-
   test('oidc: request is made to auth_url when a namespace is inputted', async function (assert) {
-    assert.expect(4);
+    assert.expect(2);
+    const namespace = 'test-ns';
+    const mountPath = 'ns-oidc';
 
-    this.server.post(`/auth/${this.nsOidc}/oidc/auth_url`, (schema, req) => {
+    // stubs the auth_url for the OIDC method configured in the namespace, NOT for the root namespace
+    // should only be hit once when the oidc tab is selected after inputting a namespace
+    this.server.post(`/auth/${mountPath}/oidc/auth_url`, (schema, req) => {
       const { redirect_uri } = JSON.parse(req.requestBody);
       const { pathname, search } = parseURL(redirect_uri);
       assert.strictEqual(
         pathname + search,
-        `/ui/vault/auth/${this.nsOidc}/oidc/callback?namespace=${this.namespace}`,
+        `/ui/vault/auth/${mountPath}/oidc/callback?namespace=${namespace}`,
         'request made to correct auth_url when namespace is filled in'
       );
     });
 
-    await authPage.login();
-    // enable oidc in root namespace, without default role
-    await this.enableOidc(this.rootOidc);
-    // create child namespace to enable oidc
-    await runCmd(createNS(this.namespace), false);
-    // enable oidc in child namespace with default role
-    await authPage.loginNs(this.namespace);
-    await this.enableOidc(this.nsOidc, `${this.nsOidc}-role`);
-    // check root namespace for method tab
-    await authPage.logout();
-    await authPage.namespaceInput('');
-    assert.dom(SELECTORS.authTab(this.rootOidc)).exists('renders oidc method tab for root');
-    // check child namespace for method tab
-    await authPage.namespaceInput(this.namespace);
-    assert.dom(SELECTORS.authTab(this.nsOidc)).exists('renders oidc method tab for child namespace');
-    // clicking on the tab should update with= queryParam
-    await click(`[data-test-auth-method="${this.nsOidc}"] a`);
-    assert.strictEqual(
-      currentURL(),
-      `/vault/auth?namespace=${this.namespace}&with=${this.nsOidc}%2F`,
-      'url updates with namespace value'
-    );
-    // disable methods to cleanup test state for re-running
-    await authPage.login();
-    await this.disableOidc(this.rootOidc);
-    await this.disableOidc(this.nsOidc);
-    await runCmd([`delete /sys/auth/${this.namespace}`]);
+    await login();
+    await runCmd([
+      `write sys/namespaces/${namespace} -force`,
+      `write ${namespace}/sys/auth/${mountPath} type=oidc`,
+      `write auth/${mountPath}/config default_role="myrole" oidc_discovery_url="https://example.com"`,
+      // show method as tab
+      `write ${namespace}/sys/auth/${mountPath}/tune listing_visibility="unauth"`,
+    ]);
+    await logout();
+
+    await fillIn(GENERAL.inputByAttr('namespace'), namespace);
+    await waitFor(AUTH_FORM.tabBtn('oidc')); // no need to click because selected by default
+    assert.dom(AUTH_FORM.tabBtn('oidc')).exists('renders oidc method tab for child namespace');
+
+    // cleanup
+    await fillIn(GENERAL.inputByAttr('namespace'), ''); // clear namespace input
+    await login();
+    await runCmd(deleteNS(namespace));
   });
 });
diff --git a/ui/tests/acceptance/enterprise-replication-dr-secondaries-test.js b/ui/tests/acceptance/enterprise-replication-dr-secondaries-test.js
new file mode 100644
index 00000000000..98a147afb1d
--- /dev/null
+++ b/ui/tests/acceptance/enterprise-replication-dr-secondaries-test.js
@@ -0,0 +1,162 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, visit, settled } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { login, logout } from 'vault/tests/helpers/auth/auth-helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+import { disableReplication, enableReplication } from 'vault/tests/helpers/replication';
+import { pollCluster } from 'vault/tests/helpers/poll-cluster';
+
+// To allow a user to login and create a secondary dr cluster we demote a primary dr cluster.
+// We stub this demotion so we do not break the dev process for all future tests.
+// All DR secondary assertions are done in one test to avoid the lengthy setup and teardown process.
+module('Acceptance | Enterprise | replication-secondaries', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    await login();
+    await settled();
+    await disableReplication('dr');
+    await settled();
+    await disableReplication('performance');
+    await settled();
+  });
+
+  hooks.afterEach(async function () {
+    // For the tests following this, return to a good state.
+    // We've reset mirage with this.server.shutdown() but re-poll the cluster to get the latest state.
+    this.server.shutdown();
+    await pollCluster(this.owner);
+    await disableReplication('dr');
+    await settled();
+    await pollCluster(this.owner);
+    await logout();
+  });
+
+  test('DR secondary: manage tab, details tab, and analytics are not run', async function (assert) {
+    // Log in and set up a DR primary
+    await login();
+    await settled();
+    await enableReplication('dr', 'primary');
+    await pollCluster(this.owner);
+    await click('[data-test-replication-link="manage"]');
+
+    // Stub the demote action so it does not actually demote the cluster
+    this.server.post('/sys/replication/dr/demote', () => {
+      return { request_id: 'fake-demote', data: { success: true } };
+    });
+    // Stub endpoints for DR secondary state
+    this.server.post('/sys/capabilities-self', () => ({ capabilities: [] }));
+    this.server.get('/sys/replication/status', () => ({
+      request_id: '2f50313f-be70-493d-5883-c84c2d6f05ce',
+      lease_id: '',
+      renewable: false,
+      lease_duration: 0,
+      data: {
+        dr: {
+          cluster_id: '7222cbbf-3fb3-949b-8e03-cd5a15babde6',
+          corrupted_merkle_tree: false,
+          known_primary_cluster_addrs: null,
+          last_corruption_check_epoch: '-62135596800',
+          last_reindex_epoch: '0',
+          merkle_root: 'd3ae75bde029e05d435f92b9ecc5641c1b027cc4',
+          mode: 'secondary',
+          primaries: [],
+          primary_cluster_addr: '',
+          secondary_id: '',
+          ssct_generation_counter: 0,
+          state: 'idle',
+        },
+        performance: {
+          mode: 'disabled',
+        },
+      },
+      wrap_info: null,
+      warnings: null,
+      auth: null,
+      mount_type: '',
+    }));
+    this.server.get('/sys/replication/dr/status', () => ({
+      data: { mode: 'secondary', cluster_id: 'dr-cluster-id' },
+    }));
+    this.server.get('/sys/health', () => ({
+      initialized: true,
+      sealed: false,
+      standby: false,
+      performance_standby: false,
+      replication_performance_mode: 'disabled',
+      replication_dr_mode: 'secondary',
+      server_time_utc: 1754948244,
+      version: '1.21.0-beta1+ent',
+      enterprise: true,
+      cluster_name: 'vault-cluster-64853bcd',
+      cluster_id: '113a6c47-077f-bea7-0e8e-70a91821e85a',
+      last_wal: 82,
+      license: {
+        state: 'autoloaded',
+        expiry_time: '2029-01-27T00:00:00Z',
+        terminated: false,
+      },
+      echo_duration_ms: 0,
+      clock_skew_ms: 0,
+      replication_primary_canary_age_ms: 0,
+      removed_from_cluster: false,
+    }));
+    this.server.get('/sys/seal-status', () => ({
+      type: 'shamir',
+      initialized: true,
+      sealed: false,
+      t: 1,
+      n: 1,
+      progress: 0,
+      nonce: '',
+      version: '1.21.0-beta1+ent',
+      build_date: '2025-08-11T14:11:00Z',
+      migration: false,
+      cluster_name: 'vault-cluster-64853bcd',
+      cluster_id: '113a6c47-077f-bea7-0e8e-70a91821e85a',
+      recovery_seal: false,
+      storage_type: 'raft',
+      removed_from_cluster: false,
+    }));
+
+    await click(GENERAL.button('demote'));
+    await pollCluster(this.owner); // We must poll the cluster to stimulate a cluster reload. This is skipped in ember testing so must be forced.
+
+    // Spy on the route's addAnalyticsService method
+    const clusterRoute = this.owner.lookup('route:vault.cluster');
+    const addAnalyticsSpy = sinon.spy(clusterRoute, 'addAnalyticsService');
+
+    // Visit the DR secondary view. This is the route used only by DR secondaries
+    await visit('/vault/replication-dr-promote');
+
+    assert
+      .dom('[data-test-promote-description]')
+      .hasText(
+        'Promote this cluster to a Disaster Recovery primary',
+        'shows the correct description for a DR secondary'
+      );
+    assert.dom('[data-test-mode]').includesText('secondary', 'shows the DR secondary mode badge');
+
+    await click(GENERAL.linkTo('Details'));
+    assert
+      .dom('[data-test-replication-secondary-card]')
+      .hasClass(
+        'has-error-border',
+        'shows error border on status because the DR secondary is not connected to a primary.'
+      );
+
+    // Assert addAnalyticsService was NOT called
+    assert.false(addAnalyticsSpy.called, 'addAnalyticsService should not be called on DR secondary');
+
+    // Restore spy
+    addAnalyticsSpy.restore();
+  });
+});
diff --git a/ui/tests/acceptance/enterprise-replication-modes-test.js b/ui/tests/acceptance/enterprise-replication-modes-test.js
index c06c7181acd..66d75e3909f 100644
--- a/ui/tests/acceptance/enterprise-replication-modes-test.js
+++ b/ui/tests/acceptance/enterprise-replication-modes-test.js
@@ -1,18 +1,18 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { click, visit } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
+import { click, currentURL, settled, visit, waitFor } from '@ember/test-helpers';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { STATUS_DISABLED_RESPONSE, mockReplicationBlock } from 'vault/tests/helpers/replication';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const s = {
-  navLink: (title) => `[data-test-sidebar-nav-link="${title}"]`,
-  title: '[data-test-replication-title]',
+  title: (t) => `[data-test-replication-title="${t}"]`,
   detailLink: (mode) => `[data-test-replication-details-link="${mode}"]`,
   summaryCard: '[data-test-replication-summary-card]',
   dashboard: '[data-test-replication-dashboard]',
@@ -20,6 +20,13 @@ const s = {
   knownSecondary: (name) => `[data-test-secondaries-node="${name}"]`,
 };
 
+// wait for specific title selector as an attempt to stabilize flaky tests
+async function assertTitle(assert, title, altSelector) {
+  const selector = altSelector || title;
+  await waitFor(s.title(selector));
+  assert.dom(s.title(selector)).hasText(title);
+}
+
 module('Acceptance | Enterprise | replication modes', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
@@ -29,38 +36,45 @@ module('Acceptance | Enterprise | replication modes', function (hooks) {
       this.server.get('sys/replication/status', () => ({
         data: payload,
       }));
-      return authPage.login();
+      return login();
     };
   });
 
   test('replication page when unsupported', async function (assert) {
-    await this.setupMocks({
+    this.server.get('sys/replication/status', () => ({
       data: {
         mode: 'unsupported',
       },
-    });
+    }));
+
+    await login();
     await visit('/vault/replication');
-    assert.dom(s.title).hasText('Replication unsupported', 'it shows the unsupported view');
+
+    await assertTitle(assert, 'Replication unsupported');
 
     // Nav links
-    assert.dom(s.navLink('Performance')).doesNotExist('hides performance link');
-    assert.dom(s.navLink('Disaster Recovery')).doesNotExist('hides dr link');
+    assert.dom(GENERAL.navLink('Performance')).doesNotExist('hides performance link');
+    assert.dom(GENERAL.navLink('Disaster Recovery')).doesNotExist('hides dr link');
   });
 
   test('replication page when disabled', async function (assert) {
     await this.setupMocks(STATUS_DISABLED_RESPONSE);
     await visit('/vault/replication');
-    assert.dom(s.title).hasText('Enable Replication', 'it shows the enable view');
+
+    await assertTitle(assert, 'Enable Replication');
 
     // Nav links
-    assert.dom(s.navLink('Performance')).exists('shows performance link');
-    assert.dom(s.navLink('Disaster Recovery')).exists('shows dr link');
+    assert.dom(GENERAL.navLink('Performance')).exists('shows performance link');
+    assert.dom(GENERAL.navLink('Disaster Recovery')).exists('shows dr link');
 
-    await click(s.navLink('Performance'));
-    assert.dom(s.title).hasText('Enable Performance Replication', 'it shows the enable view for performance');
+    await click(GENERAL.navLink('Performance'));
+    assert.strictEqual(currentURL(), '/vault/replication/performance', 'it navigates to the correct page');
+    await settled();
+    assert.dom(s.enableForm).exists();
 
-    await click(s.navLink('Disaster Recovery'));
-    assert.dom(s.title).hasText('Enable Disaster Recovery Replication', 'it shows the enable view for dr');
+    await click(GENERAL.navLink('Disaster Recovery'));
+
+    await assertTitle(assert, 'Enable Disaster Recovery Replication', 'dr');
   });
 
   ['primary', 'secondary'].forEach((mode) => {
@@ -71,60 +85,64 @@ module('Acceptance | Enterprise | replication modes', function (hooks) {
       });
       await visit('/vault/replication');
 
-      assert.dom(s.title).hasText('Replication', 'it shows default view');
+      await assertTitle(assert, 'Replication');
       assert.dom(s.detailLink('performance')).hasText('Details', 'CTA to see performance details');
       assert.dom(s.detailLink('dr')).hasText('Enable', 'CTA to enable dr');
 
       // Nav links
-      assert.dom(s.navLink('Performance')).exists('shows performance link');
-      assert.dom(s.navLink('Disaster Recovery')).exists('shows dr link');
+      assert.dom(GENERAL.navLink('Performance')).exists('shows performance link');
+      assert.dom(GENERAL.navLink('Disaster Recovery')).exists('shows dr link');
 
-      await click(s.navLink('Performance'));
-      assert.dom(s.title).hasText(`Performance ${mode}`, `it shows the performance title`);
+      await click(GENERAL.navLink('Performance'));
+      assert.strictEqual(currentURL(), `/vault/replication/performance`, `goes to correct URL`);
+      await waitFor(s.dashboard);
       assert.dom(s.dashboard).exists(`it shows the replication dashboard`);
 
-      await click(s.navLink('Disaster Recovery'));
-      assert.dom(s.title).hasText('Enable Disaster Recovery Replication', 'it shows the dr title');
+      await click(GENERAL.navLink('Disaster Recovery'));
+      await assertTitle(assert, 'Enable Disaster Recovery Replication', 'dr');
       assert.dom(s.enableForm).exists('it shows the enable view for dr');
     });
   });
-  // DR secondary mode is a whole other thing, test primary only here
-  test(`replication page when dr primary only`, async function (assert) {
+
+  test('replication page when dr primary only', async function (assert) {
     await this.setupMocks({
       dr: mockReplicationBlock('primary'),
       performance: mockReplicationBlock(),
     });
     await visit('/vault/replication');
-    assert.dom(s.title).hasText('Replication', 'it shows default view');
+    await assertTitle(assert, 'Replication');
     assert.dom(s.detailLink('performance')).hasText('Enable', 'CTA to enable performance');
     assert.dom(s.detailLink('dr')).hasText('Details', 'CTA to see dr details');
 
     // Nav links
-    assert.dom(s.navLink('Performance')).exists('shows performance link');
-    assert.dom(s.navLink('Disaster Recovery')).exists('shows dr link');
+    assert.dom(GENERAL.navLink('Performance')).exists('shows performance link');
+    assert.dom(GENERAL.navLink('Disaster Recovery')).exists('shows dr link');
 
-    await click(s.navLink('Performance'));
-    assert.dom(s.title).hasText(`Enable Performance Replication`, `it shows the performance title`);
+    await click(GENERAL.navLink('Performance'));
+    assert.strictEqual(currentURL(), `/vault/replication/performance`, `goes to correct URL`);
+    await waitFor(s.enableForm);
     assert.dom(s.enableForm).exists('it shows the enable view for performance');
 
-    await click(s.navLink('Disaster Recovery'));
-    assert.dom(s.title).hasText(`Disaster Recovery primary`, 'it shows the dr title');
+    await click(GENERAL.navLink('Disaster Recovery'));
+    await assertTitle(assert, 'Disaster Recovery primary', 'Disaster Recovery');
     assert.dom(s.dashboard).exists(`it shows the replication dashboard`);
   });
 
-  test(`replication page both primary`, async function (assert) {
+  test('replication page both primary', async function (assert) {
     await this.setupMocks({
       dr: mockReplicationBlock('primary'),
       performance: mockReplicationBlock('primary'),
     });
     await visit('/vault/replication');
-    assert.dom(s.title).hasText('Disaster Recovery & Performance primary', 'it shows primary view');
+    await assertTitle(assert, 'Disaster Recovery & Performance primary', 'Disaster Recovery & Performance');
     assert.dom(s.summaryCard).exists({ count: 2 }, 'shows 2 summary cards');
 
-    await click(s.navLink('Performance'));
-    assert.dom(s.title).hasText(`Performance primary`, `it shows the performance mode details`);
+    await click(GENERAL.navLink('Performance'));
+    await assertTitle(assert, 'Performance primary', 'Performance');
+    assert.dom(s.enableForm).doesNotExist();
 
-    await click(s.navLink('Disaster Recovery'));
-    assert.dom(s.title).hasText(`Disaster Recovery primary`, 'it shows the dr mode details');
+    await click(GENERAL.navLink('Disaster Recovery'));
+    await assertTitle(assert, 'Disaster Recovery primary', 'Disaster Recovery');
+    assert.dom(s.enableForm).doesNotExist();
   });
 });
diff --git a/ui/tests/acceptance/enterprise-replication-test.js b/ui/tests/acceptance/enterprise-replication-test.js
index a4e24348385..c52bcf5cbfa 100644
--- a/ui/tests/acceptance/enterprise-replication-test.js
+++ b/ui/tests/acceptance/enterprise-replication-test.js
@@ -1,26 +1,23 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { clickTrigger } from 'ember-power-select/test-support/helpers';
-import { click, fillIn, findAll, currentURL, find, visit, settled, waitUntil } from '@ember/test-helpers';
+import { click, fillIn, findAll, currentURL, visit, settled, waitFor } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { pollCluster } from 'vault/tests/helpers/poll-cluster';
-import { create } from 'ember-cli-page-object';
-import flashMessage from 'vault/tests/pages/components/flash-message';
-import ss from 'vault/tests/pages/components/search-select';
-import { disableReplication } from 'vault/tests/helpers/replication';
-const searchSelect = create(ss);
-const flash = create(flashMessage);
+import { addSecondary, disableReplication, enableReplication } from 'vault/tests/helpers/replication';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
 
+// note: dr secondary tests are done in ./replication-dr-secondaries-test.js
 module('Acceptance | Enterprise | replication', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(async function () {
-    await authPage.login();
+    await login();
     await settled();
     await disableReplication('dr');
     await settled();
@@ -35,158 +32,43 @@ module('Acceptance | Enterprise | replication', function (hooks) {
     await settled();
   });
 
-  test('replication', async function (assert) {
-    assert.expect(17);
-    const secondaryName = 'firstSecondary';
-    const mode = 'deny';
-
-    // confirm unable to visit dr secondary details page when both replications are disabled
-    await visit('/vault/replication-dr-promote/details');
-
-    assert.dom('[data-test-component="empty-state"]').exists();
-    assert
-      .dom('[data-test-empty-state-title]')
-      .includesText('Disaster Recovery secondary not set up', 'shows the correct title of the empty state');
-
-    assert
-      .dom('[data-test-empty-state-message]')
-      .hasText(
-        'This cluster has not been enabled as a Disaster Recovery Secondary. You can do so by enabling replication and adding a secondary from the Disaster Recovery Primary.',
-        'renders default message specific to when no replication is enabled'
-      );
-
-    await visit('/vault/replication');
-
-    assert.strictEqual(currentURL(), '/vault/replication');
-
-    // enable perf replication
-    await click('[data-test-replication-type-select="performance"]');
-
-    await fillIn('[data-test-replication-cluster-mode-select]', 'primary');
-
-    await click('[data-test-replication-enable]');
+  test('DR primary: enables primary and adds secondary', async function (assert) {
+    const secondaryName = 'drSecondary';
 
+    await enableReplication('dr', 'primary');
     await pollCluster(this.owner);
-
-    // confirm that the details dashboard shows
-    assert.ok(await waitUntil(() => find('[data-test-replication-dashboard]')), 'details dashboard is shown');
-
-    // add a secondary with a mount filter config
-    await click('[data-test-replication-link="secondaries"]');
-
-    await click('[data-test-secondary-add]');
-
-    await fillIn('[data-test-replication-secondary-id]', secondaryName);
-
-    await click('#deny');
-    await clickTrigger();
-    const mountPath = searchSelect.options.objectAt(0).text;
-    await searchSelect.options.objectAt(0).click();
-    await click('[data-test-secondary-add]');
-
-    await pollCluster(this.owner);
-    // click into the added secondary's mount filter config
-    await click('[data-test-replication-link="secondaries"]');
-
-    await click('[data-test-popup-menu-trigger]');
-
-    await click('[data-test-replication-path-filter-link]');
-
-    assert.strictEqual(
-      currentURL(),
-      `/vault/replication/performance/secondaries/config/show/${secondaryName}`
-    );
-    assert.dom('[data-test-mount-config-mode]').includesText(mode, 'show page renders the correct mode');
-    assert
-      .dom('[data-test-mount-config-paths]')
-      .includesText(mountPath, 'show page renders the correct mount path');
-
-    // delete config by choosing "no filter" in the edit screen
-    await click('[data-test-replication-link="edit-mount-config"]');
-
-    await click('#no-filtering');
-
-    await click('[data-test-config-save]');
-    await settled(); // eslint-disable-line
-
-    assert.strictEqual(
-      flash.latestMessage,
-      `The performance mount filter config for the secondary ${secondaryName} was successfully deleted.`,
-      'renders success flash upon deletion'
-    );
-    assert.strictEqual(
-      currentURL(),
-      `/vault/replication/performance/secondaries`,
-      'redirects to the secondaries page'
-    );
-    // nav back to details page and confirm secondary is in the known secondaries table
-    await click('[data-test-replication-link="details"]');
-
+    await settled();
     assert
-      .dom(`[data-test-secondaries-node=${secondaryName}]`)
-      .exists('shows a table row the recently added secondary');
-
-    // nav to DR
-    await visit('/vault/replication/dr');
-
-    await fillIn('[data-test-replication-cluster-mode-select]', 'secondary');
+      .dom('[data-test-replication-title="Disaster Recovery"]')
+      .includesText('Disaster Recovery', 'it displays the replication type correctly');
     assert
-      .dom('[data-test-replication-enable]')
-      .isDisabled('dr secondary enable is disabled when other replication modes are on');
+      .dom('[data-test-replication-mode-display]')
+      .includesText('primary', 'it displays the cluster mode correctly');
 
-    // disable performance replication
-    await disableReplication('performance', assert);
-    await settled();
+    await addSecondary(secondaryName);
+    // modal for copying the token appears
+    await click(GENERAL.button('Copy token')); // must copy token before escaping the modal.
+    await click(GENERAL.cancelButton);
     await pollCluster(this.owner);
+    await settled();
 
-    // enable dr replication
-    await visit('vault/replication/dr');
-
-    await fillIn('[data-test-replication-cluster-mode-select]', 'primary');
-    await click('button[type="submit"]');
-
-    await pollCluster(this.owner);
-    await waitUntil(() => find('[data-test-empty-state-title]'));
-    // empty state inside of know secondaries table
-    assert
-      .dom('[data-test-empty-state-title]')
-      .includesText(
-        'No known dr secondary clusters associated with this cluster',
-        'shows the correct title of the empty state'
-      );
-
-    assert.ok(
-      find('[data-test-replication-title]').textContent.includes('Disaster Recovery'),
-      'it displays the replication type correctly'
-    );
-    assert.ok(
-      find('[data-test-replication-mode-display]').textContent.includes('primary'),
-      'it displays the cluster mode correctly'
-    );
-
-    // add dr secondary
-    await click('[data-test-replication-link="secondaries"]');
-
-    await click('[data-test-secondary-add]');
-
-    await fillIn('[data-test-replication-secondary-id]', secondaryName);
-
-    await click('[data-test-secondary-add]');
-
-    await pollCluster(this.owner);
     await click('[data-test-replication-link="secondaries"]');
-
     assert
       .dom('[data-test-secondary-name]')
       .includesText(secondaryName, 'it displays the secondary in the list of known secondaries');
+
+    // verify overflow-wrap class is applied to secondary name
+    assert
+      .dom('[data-test-secondary-name]')
+      .hasClass('overflow-wrap', 'it applies the overflow-wrap class to the secondary name');
   });
 
-  test('disabling dr primary when perf replication is enabled', async function (assert) {
+  test('DR primary: shows demotion warning when Performance replication is active', async function (assert) {
     await visit('vault/replication/performance');
 
     // enable perf replication
     await fillIn('[data-test-replication-cluster-mode-select]', 'primary');
-    await click('[data-test-replication-enable]');
+    await click(GENERAL.submitButton);
 
     await pollCluster(this.owner);
 
@@ -195,87 +77,150 @@ module('Acceptance | Enterprise | replication', function (hooks) {
 
     await fillIn('[data-test-replication-cluster-mode-select]', 'primary');
 
-    await click('[data-test-replication-enable]');
+    await click(GENERAL.submitButton);
 
     await pollCluster(this.owner);
     await visit('/vault/replication/dr/manage');
 
-    await click('[data-test-demote-replication] [data-test-replication-action-trigger]');
-
+    await click(GENERAL.button('demote'));
     assert.ok(findAll('[data-test-demote-warning]').length, 'displays the demotion warning');
   });
 
-  test('navigating to dr secondary details page when dr secondary is not enabled', async function (assert) {
+  test('DR primary: shows empty state when secondary mode is not enabled and we navigated to the secondary details page', async function (assert) {
     // enable dr replication
 
     await visit('/vault/replication/dr');
 
     await fillIn('[data-test-replication-cluster-mode-select]', 'primary');
-    await click('[data-test-replication-enable]');
+    await click(GENERAL.submitButton);
     await settled(); // eslint-disable-line
     await pollCluster(this.owner);
     await visit('/vault/replication-dr-promote/details');
 
-    assert.dom('[data-test-component="empty-state"]').exists();
+    assert
+      .dom('[data-test-component="empty-state"]')
+      .exists('Empty state is shown when no secondary is configured');
     assert
       .dom('[data-test-empty-state-message]')
       .hasText(
         'This Disaster Recovery secondary has not been enabled. You can do so from the Disaster Recovery Primary.',
-        'renders message when replication is enabled'
+        'Renders the correct message for when a primary is enabled but no secondary is configured and we have navigated to the secondary details page.'
       );
   });
 
-  test('add secondary and navigate through token generation modal', async function (assert) {
-    const secondaryNameFirst = 'firstSecondary';
-    const secondaryNameSecond = 'secondSecondary';
-    await visit('/vault/replication');
+  test('DR primary: runs analytics service when enabled', async function (assert) {
+    // Spy on the route's addAnalyticsService method if needed
+    const clusterRoute = this.owner.lookup('route:vault.cluster');
+    const addAnalyticsSpy = sinon.spy(clusterRoute, 'addAnalyticsService');
 
-    // enable perf replication
-    await click('[data-test-replication-type-select="performance"]');
+    // Set up DR replication as primary
+    await enableReplication('dr', 'primary');
+    await pollCluster(this.owner);
+    await settled();
 
-    await fillIn('[data-test-replication-cluster-mode-select]', 'primary');
-    await click('[data-test-replication-enable]');
+    // Visit the route that triggers analytics
+    await visit('/vault/replication/replication/dr'); // or the correct route for your app
+
+    // Verify that analytics service was called
+    assert.true(addAnalyticsSpy.called, 'addAnalyticsService should be called on DR primary');
+
+    // Clean up spy
+    addAnalyticsSpy.restore();
+  });
+
+  test('DR secondary: shows empty state when replication is not enabled', async function (assert) {
+    await visit('/vault/replication-dr-promote/details');
+
+    assert.dom('[data-test-component="empty-state"]').exists();
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .includesText('Disaster Recovery secondary not set up', 'shows the correct title of the empty state');
+
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'This cluster has not been enabled as a Disaster Recovery Secondary. You can do so by enabling replication and adding a secondary from the Disaster Recovery Primary.',
+        'renders default message specific to when no replication is enabled'
+      );
+  });
 
+  test('Performance primary: add secondary and delete config', async function (assert) {
+    const secondaryName = `performanceSecondary`;
+    const mode = 'deny';
+
+    await enableReplication('performance', 'primary');
+    await pollCluster(this.owner);
+    await settled();
+    // confirm that the details dashboard shows
+    await waitFor('[data-test-replication-dashboard]', 2000);
+    await addSecondary(secondaryName, mode);
+    await click(GENERAL.button('Copy token')); // must copy token before escaping the modal.
+    await click(GENERAL.cancelButton);
     await pollCluster(this.owner);
     await settled();
 
-    // add a secondary with default TTL
     await click('[data-test-replication-link="secondaries"]');
+    await click(GENERAL.menuTrigger);
+    await click('[data-test-replication-path-filter-link]');
+    assert.strictEqual(
+      currentURL(),
+      `/vault/replication/performance/secondaries/config/show/${secondaryName}`
+    );
+    assert.dom('[data-test-mount-config-mode]').includesText(mode, 'show page renders the correct mode');
 
-    await click('[data-test-secondary-add]');
+    // delete config by choosing "no filter" on the edit screen
+    await click('[data-test-replication-link="edit-mount-config"]');
+    await click('#no-filtering');
+    await click('[data-test-config-save]');
+    await settled(); // eslint-disable-line
+    assert.strictEqual(
+      currentURL(),
+      `/vault/replication/performance/secondaries`,
+      'redirects to the secondaries page'
+    );
+    // nav back to details page and confirm secondary is in the known secondaries table
+    await click('[data-test-replication-link="details"]');
 
-    await fillIn('[data-test-replication-secondary-id]', secondaryNameFirst);
-    await click('[data-test-secondary-add]');
+    assert
+      .dom(`[data-test-secondaries-node=${secondaryName}]`)
+      .exists('shows a table row the recently added secondary');
+  });
 
+  test('Performance primary: manages secondary token generation and TTL configuration', async function (assert) {
+    const secondaryNameFirst = 'firstSecondary';
+    const secondaryNameSecond = 'secondSecondary';
+
+    // enable perf replication
+    await enableReplication('performance', 'primary');
+    await pollCluster(this.owner);
+    await settled();
+    // confirm that the details dashboard shows
+    await addSecondary(secondaryNameFirst);
     await pollCluster(this.owner);
     await settled();
-    const modalDefaultTtl = document.querySelector('[data-test-row-value="TTL"]').innerText;
 
     // checks on secondary token modal
     assert.dom('#replication-copy-token-modal').exists();
-    assert.dom('[data-test-inline-error-message]').hasText('Copy token to dismiss modal');
-    assert.strictEqual(modalDefaultTtl, '1800s', 'shows the correct TTL of 1800s');
+    assert.dom(GENERAL.inlineError).hasText('Copy token to dismiss modal');
+    assert.dom(GENERAL.infoRowValue('TTL')).hasText('1800s', 'shows the correct TTL of 1800s');
     // click off the modal to make sure you don't just have to click on the copy-close button to copy the token
-    assert.dom('[data-test-modal-close]').isDisabled('cancel is disabled');
-    await click('[data-test-modal-copy]');
-    assert.dom('[data-test-modal-close]').isEnabled('cancel is enabled after token is copied');
-    await click('[data-test-modal-close]');
+    assert.dom(GENERAL.cancelButton).isDisabled('cancel is disabled');
+    await click(GENERAL.button('Copy token'));
+    assert.dom(GENERAL.cancelButton).isEnabled('cancel is enabled after token is copied');
+    await click(GENERAL.cancelButton);
 
     // add another secondary not using the default ttl
     await click('[data-test-secondary-add]');
-
-    await fillIn('[data-test-replication-secondary-id]', secondaryNameSecond);
-    await click('[data-test-toggle-input]');
-
+    await fillIn('[data-test-input="Secondary ID"]', secondaryNameSecond);
+    await click(GENERAL.toggleInput('Time to Live (TTL) for generated secondary token'));
     await fillIn('[data-test-ttl-value]', 3);
-    await click('[data-test-secondary-add]');
+    await click(GENERAL.submitButton);
 
     await pollCluster(this.owner);
     await settled();
-    const modalTtl = document.querySelector('[data-test-row-value="TTL"]').innerText;
-    assert.strictEqual(modalTtl, '180s', 'shows the correct TTL of 180s');
-    await click('[data-test-modal-copy]');
-    await click('[data-test-modal-close]');
+    assert.dom(GENERAL.infoRowValue('TTL')).hasText('180s', 'shows the correct TTL of 180s');
+    await click(GENERAL.button('Copy token'));
+    await click(GENERAL.cancelButton);
 
     // confirm you were redirected to the secondaries page
     assert.strictEqual(
@@ -288,14 +233,37 @@ module('Acceptance | Enterprise | replication', function (hooks) {
       .includesText(secondaryNameFirst, 'it displays the secondary in the list of secondaries');
   });
 
-  test('render performance and dr primary and navigate to details page', async function (assert) {
-    // enable perf primary replication
-    await visit('/vault/replication');
-    await click('[data-test-replication-type-select="performance"]');
+  test('Performance primary: demotes primary to secondary and displays correct status', async function (assert) {
+    // enable perf replication
+    await enableReplication('performance', 'primary');
+    await pollCluster(this.owner);
+    await settled();
 
-    await fillIn('[data-test-replication-cluster-mode-select]', 'primary');
-    await click('[data-test-replication-enable]');
+    // demote perf primary to a secondary
+    await click('[data-test-replication-link="manage"]');
+
+    // open demote modal
+    await click(GENERAL.button('demote'));
+
+    // enter confirmation text
+    await fillIn('[data-test-confirmation-modal-input="Demote to secondary?"]', 'Performance');
+    // Click confirm button
+    await click(GENERAL.confirmButton);
+
+    await pollCluster(this.owner);
+    await settled();
+
+    await click('[data-test-replication-link="details"]');
+    await waitFor('[data-test-replication-dashboard]');
+    assert.dom('[data-test-replication-dashboard]').exists();
+    assert.dom('[data-test-selectable-card-container="secondary"]').exists();
+    assert
+      .dom('[data-test-replication-mode-display]')
+      .hasText('secondary', 'it displays the cluster mode correctly in header');
+  });
 
+  test('Replication Dashboard: displays summary cards for both Performance and DR primaries', async function (assert) {
+    await enableReplication('performance', 'primary');
     await pollCluster(this.owner);
     await settled();
 
@@ -306,13 +274,18 @@ module('Acceptance | Enterprise | replication', function (hooks) {
       .doesNotExist(`does not render replication summary card when both modes are not enabled as primary`);
 
     // enable DR primary replication
-    await click('[data-test-replication-details-link="dr"]');
-    await click('[data-test-replication-enable]');
+    await click('[data-test-sidebar-nav-link="Disaster Recovery"]');
+    // let the controller set replicationMode in afterModel
+    await waitFor('[data-test-replication-enable-form]');
+    await click(GENERAL.submitButton);
 
     await pollCluster(this.owner);
     await settled();
 
+    // Breadcrumbs only load once we're in the summary mode after enabling
+    await waitFor('[data-test-replication-breadcrumb]');
     // navigate using breadcrumbs back to replication.index
+    assert.dom('[data-test-replication-breadcrumb]').exists('shows the replication breadcrumb (flaky)');
     await click('[data-test-replication-breadcrumb] a');
 
     assert
@@ -327,37 +300,4 @@ module('Acceptance | Enterprise | replication', function (hooks) {
       .exists('shows the correct card on the details dashboard');
     assert.strictEqual(currentURL(), '/vault/replication/dr');
   });
-
-  test('render performance secondary and navigate to the details page', async function (assert) {
-    // enable perf replication
-    await visit('/vault/replication');
-
-    await click('[data-test-replication-type-select="performance"]');
-
-    await fillIn('[data-test-replication-cluster-mode-select]', 'primary');
-    await click('[data-test-replication-enable]');
-
-    await pollCluster(this.owner);
-    await settled();
-
-    // demote perf primary to a secondary
-    await click('[data-test-replication-link="manage"]');
-
-    // open demote modal
-    await click('[data-test-demote-replication] [data-test-replication-action-trigger]');
-
-    // enter confirmation text
-    await fillIn('[data-test-confirmation-modal-input="Demote to secondary?"]', 'Performance');
-    // Click confirm button
-    await click('[data-test-confirm-button="Demote to secondary?"]');
-
-    await click('[data-test-replication-link="details"]');
-
-    assert.dom('[data-test-replication-dashboard]').exists();
-    assert.dom('[data-test-selectable-card-container="secondary"]').exists();
-    assert.ok(
-      find('[data-test-replication-mode-display]').textContent.includes('secondary'),
-      'it displays the cluster mode correctly'
-    );
-  });
 });
diff --git a/ui/tests/acceptance/enterprise-sidebar-nav-test.js b/ui/tests/acceptance/enterprise-sidebar-nav-test.js
index 928349e62b2..9c45deceb5f 100644
--- a/ui/tests/acceptance/enterprise-sidebar-nav-test.js
+++ b/ui/tests/acceptance/enterprise-sidebar-nav-test.js
@@ -1,13 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { click, currentURL } from '@ember/test-helpers';
+import { click, currentURL, visit } from '@ember/test-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 
 const link = (label) => `[data-test-sidebar-nav-link="${label}"]`;
 const panel = (label) => `[data-test-sidebar-nav-panel="${label}"]`;
@@ -17,7 +17,7 @@ module('Acceptance | Enterprise | sidebar navigation', function (hooks) {
   setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    return authPage.login();
+    return login();
   });
 
   // common links are tested in the sidebar-nav test and will not be covered here
@@ -41,15 +41,21 @@ module('Acceptance | Enterprise | sidebar navigation', function (hooks) {
       'Replication performance route renders'
     );
 
-    await click(link('Disaster Recovery'));
-    assert.strictEqual(currentURL(), '/vault/replication/dr', 'Replication dr route renders');
+    // for some reason clicking this link would cause the testing browser locally
+    // to navigate to 'vault/replication/dr' and halt the test runner
+    assert
+      .dom(link('Disaster Recovery'))
+      .hasAttribute('href', '/ui/vault/replication/dr', 'Replication dr route renders');
+    await visit('/vault');
 
     await click(link('Client Count'));
+    assert.dom(panel('Client Count')).exists('Client Count nav panel renders');
+    assert.dom(link('Client Usage')).hasClass('active', 'Client Usage link is active');
     assert.strictEqual(currentURL(), '/vault/clients/counts/overview', 'Client counts route renders');
+    await click(link('Back to main navigation'));
 
     await click(link('License'));
     assert.strictEqual(currentURL(), '/vault/license', 'License route renders');
-
     await click(link('Access'));
     await click(link('Control Groups'));
     assert.strictEqual(currentURL(), '/vault/access/control-groups', 'Control groups route renders');
diff --git a/ui/tests/acceptance/enterprise-transform-test.js b/ui/tests/acceptance/enterprise-transform-test.js
index 3cc33637402..03c3a5ee53f 100644
--- a/ui/tests/acceptance/enterprise-transform-test.js
+++ b/ui/tests/acceptance/enterprise-transform-test.js
@@ -1,33 +1,30 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { currentURL, click, settled, currentRouteName } from '@ember/test-helpers';
+import { click, currentRouteName, currentURL, fillIn, settled, visit } from '@ember/test-helpers';
 import { create } from 'ember-cli-page-object';
-import { typeInSearch, selectChoose, clickTrigger } from 'ember-power-select/test-support/helpers';
+import { selectChoose } from 'ember-power-select/test-support';
+import { typeInSearch, clickTrigger } from 'ember-power-select/test-support/helpers';
 
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
 import transformationsPage from 'vault/tests/pages/secrets/backend/transform/transformations';
 import rolesPage from 'vault/tests/pages/secrets/backend/transform/roles';
-import templatesPage from 'vault/tests/pages/secrets/backend/transform/templates';
 import alphabetsPage from 'vault/tests/pages/secrets/backend/transform/alphabets';
 import searchSelect from 'vault/tests/pages/components/search-select';
 import { runCmd } from '../helpers/commands';
-import { allEngines } from 'vault/helpers/mountable-secret-engines';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import { v4 as uuidv4 } from 'uuid';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import engineDisplayData from 'vault/helpers/engines-display-data';
 
 const searchSelectComponent = create(searchSelect);
 
-const mount = async () => {
-  const path = `transform-${Date.now()}`;
-  await mountSecrets.enable('transform', path);
-  await settled();
-  return path;
-};
-
 const newTransformation = async (backend, name, submit = false) => {
   const transformationName = name || 'foo';
   await transformationsPage.visitCreate({ backend });
@@ -39,8 +36,7 @@ const newTransformation = async (backend, name, submit = false) => {
   await settled();
   // Don't automatically choose role because we might be testing that
   if (submit) {
-    await transformationsPage.submit();
-    await settled();
+    await click(GENERAL.submitButton);
   }
   return transformationName;
 };
@@ -55,28 +51,25 @@ const newRole = async (backend, name) => {
   await settled();
   await selectChoose('#transformations', '.ember-power-select-option', 0);
   await settled();
-  await rolesPage.submit();
-  await settled();
+  await click(GENERAL.submitButton);
   return roleName;
 };
 
 module('Acceptance | Enterprise | Transform secrets', function (hooks) {
   setupApplicationTest(hooks);
 
-  hooks.beforeEach(function () {
-    return authPage.login();
+  hooks.beforeEach(async function () {
+    return login();
   });
 
   test('it transitions to list route after mount success', async function (assert) {
     assert.expect(1);
-    const engine = allEngines().find((e) => e.type === 'transform');
+    const engine = engineDisplayData('transform');
 
     // delete any previous mount with same name
     await runCmd([`delete sys/mounts/${engine.type}`]);
     await mountSecrets.visit();
-    await mountSecrets.selectType(engine.type);
-    await mountSecrets.path(engine.type);
-    await mountSecrets.submit();
+    await mountBackend(engine.type, engine.type);
 
     assert.strictEqual(
       currentRouteName(),
@@ -94,7 +87,7 @@ module('Acceptance | Enterprise | Transform secrets', function (hooks) {
     await settled();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/list`,
+      `/vault/secrets-engines/${backend}/list`,
       'mounts and redirects to the transformations list page'
     );
     assert.ok(transformationsPage.isEmpty, 'renders empty state');
@@ -107,96 +100,105 @@ module('Acceptance | Enterprise | Transform secrets', function (hooks) {
   });
 
   test('it can create a transformation and add itself to the role attached', async function (assert) {
-    const backend = await mount();
+    await visit('/vault/secrets-engines/enable');
+    const backend = `transform-${uuidv4()}`;
+    await click(GENERAL.cardContainer('transform'));
+    await fillIn(GENERAL.inputByAttr('path'), backend);
+    await click(GENERAL.submitButton);
     const transformationName = 'foo';
     const roleName = 'foo-role';
     await settled();
-    await transformationsPage.createLink({ backend });
-    await settled();
+    await click(SES.createSecretLink);
+
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/create`,
+      `/vault/secrets-engines/${backend}/create`,
       'redirects to create transformation page'
     );
     await transformationsPage.name(transformationName);
     await settled();
-    assert.dom('[data-test-input="type"]').hasValue('fpe', 'Has type FPE by default');
-    assert.dom('[data-test-input="tweak_source"]').exists('Shows tweak source when FPE');
+    assert.dom(GENERAL.inputByAttr('type')).hasValue('fpe', 'Has type FPE by default');
+    assert.dom(GENERAL.inputByAttr('tweak_source')).exists('Shows tweak source when FPE');
     await transformationsPage.type('masking');
     await settled();
     assert
-      .dom('[data-test-input="masking_character"]')
+      .dom(GENERAL.inputByAttr('masking_character'))
       .exists('Shows masking character input when changed to masking type');
-    assert.dom('[data-test-input="tweak_source"]').doesNotExist('Does not show tweak source when masking');
+    assert.dom(GENERAL.inputByAttr('tweak_source')).doesNotExist('Does not show tweak source when masking');
     await clickTrigger('#template');
     await settled();
     assert.strictEqual(searchSelectComponent.options.length, 2, 'list shows two builtin options by default');
     await selectChoose('#template', '.ember-power-select-option', 0);
     await settled();
-
     await clickTrigger('#allowed_roles');
     await settled();
     await typeInSearch(roleName);
     await settled();
     await selectChoose('#allowed_roles', '.ember-power-select-option', 0);
     await settled();
-    await transformationsPage.submit();
-    await settled();
+    await click(GENERAL.submitButton);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/show/${transformationName}`,
+      `/vault/secrets-engines/${backend}/show/${transformationName}`,
       'redirects to show transformation page after submit'
     );
     await click(`[data-test-secret-breadcrumb="${backend}"] a`);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/list`,
+      `/vault/secrets-engines/${backend}/list`,
       'Links back to list view from breadcrumb'
     );
   });
 
   test('it can create a role and add itself to the transformation attached', async function (assert) {
     const roleName = 'my-role';
-    const backend = await mount();
+    await visit('/vault/secrets-engines/enable');
+    const backend = `transform-${uuidv4()}`;
+    await mountBackend('transform', backend);
     // create transformation without role
     await newTransformation(backend, 'a-transformation', true);
     await click(`[data-test-secret-breadcrumb="${backend}"] a`);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/list`,
+      `/vault/secrets-engines/${backend}/list`,
       'Links back to list view from breadcrumb'
     );
     await click('[data-test-secret-list-tab="Roles"]');
-    assert.strictEqual(currentURL(), `/vault/secrets/${backend}/list?tab=role`, 'links to role list page');
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${backend}/list?tab=role`,
+      'links to role list page'
+    );
     // create role with transformation attached
-    await rolesPage.createLink();
+    await click(SES.createSecretLink);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/create?itemType=role`,
+      `/vault/secrets-engines/${backend}/create?itemType=role`,
       'redirects to create role page'
     );
     await rolesPage.name(roleName);
     await clickTrigger('#transformations');
     assert.strictEqual(searchSelectComponent.options.length, 1, 'lists the transformation');
     await selectChoose('#transformations', '.ember-power-select-option', 0);
-    await rolesPage.submit();
-    await settled();
+    await click(GENERAL.submitButton);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/show/role/${roleName}`,
+      `/vault/secrets-engines/${backend}/show/role/${roleName}`,
       'redirects to show role page after submit'
     );
     await click(`[data-test-secret-breadcrumb="${backend}"] a`);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/list?tab=role`,
+      `/vault/secrets-engines/${backend}/list?tab=role`,
       'Links back to role list view from breadcrumb'
     );
   });
 
   test('it adds a role to a transformation when added to a role', async function (assert) {
     const roleName = 'role-test';
-    const backend = await mount();
+    await visit('/vault/secrets-engines/enable');
+    const backend = `transform-${uuidv4()}`;
+    await mountBackend('transform', backend);
     const transformation = await newTransformation(backend, 'b-transformation', true);
     await newRole(backend, roleName);
     await transformationsPage.visitShow({ backend, id: transformation });
@@ -206,7 +208,9 @@ module('Acceptance | Enterprise | Transform secrets', function (hooks) {
 
   test('it shows a message if an update fails after save', async function (assert) {
     const roleName = 'role-remove';
-    const backend = await mount();
+    await visit('/vault/secrets-engines/enable');
+    const backend = `transform-${uuidv4()}`;
+    await mountBackend('transform', backend);
     // Create transformation
     const transformation = await newTransformation(backend, 'c-transformation', true);
     // create role
@@ -221,19 +225,18 @@ module('Acceptance | Enterprise | Transform secrets', function (hooks) {
     await settled();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/edit/${transformation}`,
+      `/vault/secrets-engines/${backend}/edit/${transformation}`,
       'Correctly links to edit page for secret'
     );
     // remove role
     await settled();
     await click('#allowed_roles [data-test-selected-list-button="delete"]');
 
-    await transformationsPage.save();
-    await settled();
+    await click(GENERAL.submitButton);
     assert.dom('.flash-message.is-info').exists('Shows info message since role could not be updated');
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/show/${transformation}`,
+      `/vault/secrets-engines/${backend}/show/${transformation}`,
       'Correctly links to show page for secret'
     );
     assert
@@ -243,40 +246,40 @@ module('Acceptance | Enterprise | Transform secrets', function (hooks) {
 
   test('it allows creation and edit of a template', async function (assert) {
     const templateName = 'my-template';
-    const backend = await mount();
+    await visit('/vault/secrets-engines/enable');
+    const backend = `transform-${uuidv4()}`;
+    await mountBackend('transform', backend);
     await click('[data-test-secret-list-tab="Templates"]');
 
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/list?tab=template`,
+      `/vault/secrets-engines/${backend}/list?tab=template`,
       'links to template list page'
     );
     await settled();
-    await templatesPage.createLink();
+    await click(SES.createSecretLink);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/create?itemType=template`,
+      `/vault/secrets-engines/${backend}/create?itemType=template`,
       'redirects to create template page'
     );
-    await templatesPage.name(templateName);
-    await templatesPage.pattern(`(\\d{4})`);
+    await fillIn(GENERAL.inputByAttr('name'), templateName);
+    await fillIn(GENERAL.inputByAttr('pattern'), `(\\d{4})`);
     await clickTrigger('#alphabet');
     await settled();
     assert.ok(searchSelectComponent.options.length > 0, 'lists built-in alphabets');
     await selectChoose('#alphabet', '.ember-power-select-option', 0);
     assert.dom('#alphabet .ember-power-select-trigger').doesNotExist('Alphabet input no longer searchable');
-    await templatesPage.submit();
-    await settled();
+    await click(GENERAL.submitButton);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/show/template/${templateName}`,
+      `/vault/secrets-engines/${backend}/show/template/${templateName}`,
       'redirects to show template page after submit'
     );
-    await templatesPage.editLink();
-    await settled();
+    await click('[data-test-edit-link]');
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/edit/template/${templateName}`,
+      `/vault/secrets-engines/${backend}/edit/template/${templateName}`,
       'Links to template edit page'
     );
     await settled();
@@ -285,28 +288,28 @@ module('Acceptance | Enterprise | Transform secrets', function (hooks) {
 
   test('it allows creation and edit of an alphabet', async function (assert) {
     const alphabetName = 'vowels-only';
-    const backend = await mount();
+    await visit('/vault/secrets-engines/enable');
+    const backend = `transform-${uuidv4()}`;
+    await mountBackend('transform', backend);
     await click('[data-test-secret-list-tab="Alphabets"]');
 
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/list?tab=alphabet`,
+      `/vault/secrets-engines/${backend}/list?tab=alphabet`,
       'links to alphabet list page'
     );
-    await alphabetsPage.createLink();
-    await settled();
+    await click(SES.createSecretLink);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/create?itemType=alphabet`,
+      `/vault/secrets-engines/${backend}/create?itemType=alphabet`,
       'redirects to create alphabet page'
     );
     await alphabetsPage.name(alphabetName);
     await alphabetsPage.alphabet('aeiou');
-    await alphabetsPage.submit();
-    await settled();
+    await click(GENERAL.submitButton);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/show/alphabet/${alphabetName}`,
+      `/vault/secrets-engines/${backend}/show/alphabet/${alphabetName}`,
       'redirects to show alphabet page after submit'
     );
     assert.dom('[data-test-row-value="Name"]').hasText(alphabetName);
@@ -315,7 +318,7 @@ module('Acceptance | Enterprise | Transform secrets', function (hooks) {
     await settled();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/edit/alphabet/${alphabetName}`,
+      `/vault/secrets-engines/${backend}/edit/alphabet/${alphabetName}`,
       'Links to alphabet edit page'
     );
     assert.dom('[data-test-input="name"]').hasAttribute('readonly');
diff --git a/ui/tests/acceptance/init-test.js b/ui/tests/acceptance/init-test.js
index d22b1607fdf..af3c6e0310b 100644
--- a/ui/tests/acceptance/init-test.js
+++ b/ui/tests/acceptance/init-test.js
@@ -1,25 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+import { waitFor } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-
-import initPage from 'vault/tests/pages/init';
-import Pretender from 'pretender';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
-
-const HEALTH_RESPONSE = {
-  initialized: false,
-  sealed: true,
-  standby: true,
-  performance_standby: false,
-  replication_performance_mode: 'unknown',
-  replication_dr_mode: 'unknown',
-  server_time_utc: 1538066726,
-  version: '1.13.0-dev1',
-};
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { click } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import initPage from 'vault/tests/pages/init';
 
 const CLOUD_SEAL_RESPONSE = {
   keys: [],
@@ -83,28 +74,7 @@ const assertRequest = (req, assert, isCloud) => {
 
 module('Acceptance | init', function (hooks) {
   setupApplicationTest(hooks);
-
-  const setInitResponse = (server, resp) => {
-    server.put('/v1/sys/init', () => {
-      return [200, { 'Content-Type': 'application/json' }, JSON.stringify(resp)];
-    });
-  };
-  const setStatusResponse = (server, resp) => {
-    server.get('/v1/sys/seal-status', () => {
-      return [200, { 'Content-Type': 'application/json' }, JSON.stringify(resp)];
-    });
-  };
-  hooks.beforeEach(function () {
-    this.server = new Pretender();
-    this.server.get('/v1/sys/health', () => {
-      return [200, { 'Content-Type': 'application/json' }, JSON.stringify(HEALTH_RESPONSE)];
-    });
-    this.server.get('/v1/sys/internal/ui/feature-flags', this.server.passthrough);
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
+  setupMirage(hooks);
 
   test('cloud seal init', async function (assert) {
     // continue button is disabled, violating color-contrast
@@ -114,39 +84,40 @@ module('Acceptance | init', function (hooks) {
       },
     });
     assert.expect(6);
-
-    setInitResponse(this.server, CLOUD_SEAL_RESPONSE);
-    setStatusResponse(this.server, CLOUD_SEAL_STATUS_RESPONSE);
+    this.server.put('/sys/init', (schema, req) => {
+      assertRequest(req, assert, true);
+      return CLOUD_SEAL_RESPONSE;
+    });
+    this.server.get('/sys/seal-status', () => {
+      return CLOUD_SEAL_STATUS_RESPONSE;
+    });
 
     await initPage.init(5, 3);
-
+    await click(GENERAL.submitButton);
+    await waitFor(GENERAL.button('Continue to Authenticate'));
     assert.strictEqual(
       initPage.keys.length,
       CLOUD_SEAL_RESPONSE.recovery_keys.length,
       'shows all of the recovery keys'
     );
-    assert.strictEqual(initPage.buttonText, 'Continue to Authenticate', 'links to authenticate');
-    assertRequest(
-      this.server.handledRequests.find((req) => req.url === '/v1/sys/init'),
-      assert,
-      true
-    );
+    assert.dom(GENERAL.button('Continue to Authenticate')).exists('links to authenticate');
   });
 
   test('shamir seal init', async function (assert) {
     assert.expect(6);
 
-    setInitResponse(this.server, SEAL_RESPONSE);
-    setStatusResponse(this.server, SEAL_STATUS_RESPONSE);
+    this.server.put('/sys/init', (schema, req) => {
+      assertRequest(req, assert, false);
+      return SEAL_RESPONSE;
+    });
+    this.server.get('/sys/seal-status', () => {
+      return SEAL_STATUS_RESPONSE;
+    });
 
     await initPage.init(3, 2);
-
+    await click(GENERAL.submitButton);
+    await waitFor(GENERAL.button('Continue to Unseal'));
     assert.strictEqual(initPage.keys.length, SEAL_RESPONSE.keys.length, 'shows all of the recovery keys');
-    assert.strictEqual(initPage.buttonText, 'Continue to Unseal', 'links to unseal');
-    assertRequest(
-      this.server.handledRequests.find((r) => r.url === '/v1/sys/init'),
-      assert,
-      false
-    );
+    assert.dom(GENERAL.button('Continue to Unseal')).exists('links to unseal');
   });
 });
diff --git a/ui/tests/acceptance/jwt-auth-method-test.js b/ui/tests/acceptance/jwt-auth-method-test.js
deleted file mode 100644
index 6a6d83d52df..00000000000
--- a/ui/tests/acceptance/jwt-auth-method-test.js
+++ /dev/null
@@ -1,98 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import { click, visit, fillIn } from '@ember/test-helpers';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import sinon from 'sinon';
-import { Response } from 'miragejs';
-import { ERROR_JWT_LOGIN } from 'vault/components/auth-jwt';
-
-module('Acceptance | jwt auth method', function (hooks) {
-  setupApplicationTest(hooks);
-  setupMirage(hooks);
-
-  hooks.beforeEach(function () {
-    localStorage.clear(); // ensure that a token isn't stored otherwise visit('/vault/auth') will redirect to secrets
-    this.stub = sinon.stub();
-    this.server.post(
-      '/auth/:path/oidc/auth_url',
-      () =>
-        new Response(
-          400,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify({ errors: [ERROR_JWT_LOGIN] })
-        )
-    );
-    this.server.get('/auth/foo/oidc/callback', () => ({
-      auth: { client_token: 'root' },
-    }));
-  });
-
-  test('it works correctly with default name and no role', async function (assert) {
-    assert.expect(6);
-    this.server.post('/auth/jwt/login', (schema, req) => {
-      const { jwt, role } = JSON.parse(req.requestBody);
-      assert.ok(true, 'request made to auth/jwt/login after submit');
-      assert.strictEqual(jwt, 'my-test-jwt-token', 'JWT token is sent in body');
-      assert.strictEqual(role, undefined, 'role is not sent in body when not filled in');
-      req.passthrough();
-    });
-    await visit('/vault/auth');
-    await fillIn('[data-test-select="auth-method"]', 'jwt');
-    assert.dom('[data-test-role]').exists({ count: 1 }, 'Role input exists');
-    assert.dom('[data-test-jwt]').exists({ count: 1 }, 'JWT input exists');
-    await fillIn('[data-test-jwt]', 'my-test-jwt-token');
-    await click('[data-test-auth-submit]');
-    assert.dom('[data-test-message-error]').exists('Failed login');
-  });
-
-  test('it works correctly with default name and a role', async function (assert) {
-    assert.expect(7);
-    this.server.post('/auth/jwt/login', (schema, req) => {
-      const { jwt, role } = JSON.parse(req.requestBody);
-      assert.ok(true, 'request made to auth/jwt/login after login');
-      assert.strictEqual(jwt, 'my-test-jwt-token', 'JWT token is sent in body');
-      assert.strictEqual(role, 'some-role', 'role is sent in the body when filled in');
-      req.passthrough();
-    });
-    await visit('/vault/auth');
-    await fillIn('[data-test-select="auth-method"]', 'jwt');
-    assert.dom('[data-test-role]').exists({ count: 1 }, 'Role input exists');
-    assert.dom('[data-test-jwt]').exists({ count: 1 }, 'JWT input exists');
-    await fillIn('[data-test-role]', 'some-role');
-    await fillIn('[data-test-jwt]', 'my-test-jwt-token');
-    assert.dom('[data-test-jwt]').exists({ count: 1 }, 'JWT input exists');
-    await click('[data-test-auth-submit]');
-    assert.dom('[data-test-message-error]').exists('Failed login');
-  });
-
-  test('it works correctly with custom endpoint and a role', async function (assert) {
-    assert.expect(6);
-    this.server.get('/sys/internal/ui/mounts', () => ({
-      data: {
-        auth: {
-          'test-jwt/': { description: '', options: {}, type: 'jwt' },
-        },
-      },
-    }));
-    this.server.post('/auth/test-jwt/login', (schema, req) => {
-      const { jwt, role } = JSON.parse(req.requestBody);
-      assert.ok(true, 'request made to auth/custom-jwt-login after login');
-      assert.strictEqual(jwt, 'my-test-jwt-token', 'JWT token is sent in body');
-      assert.strictEqual(role, 'some-role', 'role is sent in body when filled in');
-      req.passthrough();
-    });
-    await visit('/vault/auth');
-    await click('[data-test-auth-method-link="jwt"]');
-    assert.dom('[data-test-role]').exists({ count: 1 }, 'Role input exists');
-    assert.dom('[data-test-jwt]').exists({ count: 1 }, 'JWT input exists');
-    await fillIn('[data-test-role]', 'some-role');
-    await fillIn('[data-test-jwt]', 'my-test-jwt-token');
-    await click('[data-test-auth-submit]');
-    assert.dom('[data-test-message-error]').exists('Failed login');
-  });
-});
diff --git a/ui/tests/acceptance/leases-test.js b/ui/tests/acceptance/leases-test.js
index cd2c11a06fe..c4ddd1d6b51 100644
--- a/ui/tests/acceptance/leases-test.js
+++ b/ui/tests/acceptance/leases-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,23 +15,26 @@ import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 import secretList from 'vault/tests/pages/secrets/backend/list';
 import secretEdit from 'vault/tests/pages/secrets/backend/kv/edit-secret';
-import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
-import authPage from 'vault/tests/pages/auth';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+// import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
+// import { login } from 'vault/tests/helpers/auth/auth-helpers';
 
 module('Acceptance | leases', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(async function () {
-    await authPage.login();
-    this.enginePath = `kv-for-lease-${uuidv4()}`;
-    // need a version 1 mount for leased secrets here
-    return mountSecrets.visit().path(this.enginePath).type('kv').version(1).submit();
+    // await login();
+    // this.enginePath = `kv-for-lease-${uuidv4()}`;
+    // // need a version 1 mount for leased secrets here
+    // return mountSecrets.visit().path(this.enginePath).type('kv').version(1).submit();
   });
 
   const createSecret = async (context, isRenewable) => {
     context.name = `secret-${uuidv4()}`;
     await secretList.visitRoot({ backend: context.enginePath });
-    await secretList.create();
+    await click(SES.createSecretLink);
     if (isRenewable) {
       await secretEdit.createSecret(context.name, 'ttl', '30h');
     } else {
@@ -77,7 +80,7 @@ module('Acceptance | leases', function (hooks) {
     createSecret(this);
     navToDetail(this);
     await click('[data-test-lease-revoke] button');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.access.leases.list-root',
@@ -94,7 +97,7 @@ module('Acceptance | leases', function (hooks) {
     createSecret(this);
     await visit(`/vault/access/leases/list/${this.enginePath}`);
     await click('[data-test-lease-revoke-prefix] button');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.access.leases.list-root',
diff --git a/ui/tests/acceptance/managed-namespace-test.js b/ui/tests/acceptance/managed-namespace-test.js
index 3bf8581211d..cd21ea9af0a 100644
--- a/ui/tests/acceptance/managed-namespace-test.js
+++ b/ui/tests/acceptance/managed-namespace-test.js
@@ -1,60 +1,43 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { currentURL, visit, fillIn } from '@ember/test-helpers';
 import { setupApplicationTest } from 'ember-qunit';
-import Pretender from 'pretender';
 import { getManagedNamespace } from 'vault/routes/vault/cluster';
-
-const FEATURE_FLAGS_RESPONSE = {
-  feature_flags: ['VAULT_CLOUD_ADMIN_NAMESPACE'],
-};
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
 
 module('Acceptance | Enterprise | Managed namespace root', function (hooks) {
   setupApplicationTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    /**
-     * Since the features are fetched on the application load,
-     * we have to populate them on the beforeEach hook because
-     * the fetch won't trigger again within the tests
-     */
-    this.server = new Pretender(function () {
-      this.get('/v1/sys/internal/ui/feature-flags', () => {
-        return [200, { 'Content-Type': 'application/json' }, JSON.stringify(FEATURE_FLAGS_RESPONSE)];
-      });
-      this.get('/v1/sys/health', this.passthrough);
-      this.get('/v1/sys/seal-status', this.passthrough);
-      this.get('/v1/sys/license/features', this.passthrough);
-      this.get('/v1/sys/internal/ui/mounts', this.passthrough);
+    this.server.get('/sys/internal/ui/feature-flags', () => {
+      return { feature_flags: ['VAULT_CLOUD_ADMIN_NAMESPACE'] };
     });
   });
 
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
-
   test('it shows the managed namespace toolbar when feature flag exists', async function (assert) {
     await visit('/vault/auth');
     assert.ok(currentURL().startsWith('/vault/auth'), 'Redirected to auth');
     assert.ok(currentURL().includes('?namespace=admin'), 'with base namespace');
-    assert.dom('[data-test-namespace-toolbar]').exists('Namespace toolbar exists');
-    assert.dom('[data-test-managed-namespace-root]').hasText('/admin', 'Shows /admin namespace prefix');
-    assert.dom('input#namespace').hasAttribute('placeholder', '/ (Default)');
-    await fillIn('input#namespace', '/foo');
+    assert.dom(AUTH_FORM.managedNsRoot).hasValue('/admin', 'Shows /admin namespace prefix');
+    assert.dom(AUTH_FORM.managedNsRoot).hasAttribute('readonly', '', 'HVD managed prefix input is readonly');
+    assert.dom('input[name="namespace"]').hasAttribute('placeholder', '/ (default)');
+    await fillIn('input[name="namespace"]', '/foo');
     const encodedNamespace = encodeURIComponent('admin/foo');
     assert.strictEqual(
       currentURL(),
-      `/vault/auth?namespace=${encodedNamespace}&with=token`,
+      `/vault/auth?namespace=${encodedNamespace}`,
       'Correctly prepends root to namespace when input starts with /'
     );
-    await fillIn('input#namespace', 'foo');
+    await fillIn('input[name="namespace"]', 'foo');
     assert.strictEqual(
       currentURL(),
-      `/vault/auth?namespace=${encodedNamespace}&with=token`,
+      `/vault/auth?namespace=${encodedNamespace}`,
       'Correctly prepends root to namespace when input does not start with /'
     );
   });
@@ -82,7 +65,7 @@ module('Acceptance | Enterprise | Managed namespace root', function (hooks) {
       'with appended namespace'
     );
 
-    assert.dom('[data-test-managed-namespace-root]').hasText('/admin', 'Shows /admin namespace prefix');
-    assert.dom('input#namespace').hasValue('/admindev', 'Input has /dev value');
+    assert.dom(AUTH_FORM.managedNsRoot).hasValue('/admin', 'Shows /admin namespace prefix');
+    assert.dom('input[name="namespace"]').hasValue('/admindev', 'Input has /dev value');
   });
 });
diff --git a/ui/tests/acceptance/mfa-login-enforcement-test.js b/ui/tests/acceptance/mfa-login-enforcement-test.js
index 1c4751d374a..9966837f25d 100644
--- a/ui/tests/acceptance/mfa-login-enforcement-test.js
+++ b/ui/tests/acceptance/mfa-login-enforcement-test.js
@@ -1,14 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { click, currentRouteName, fillIn, visit, waitFor } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import mfaConfigHandlers from 'vault/mirage/handlers/mfa-config';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Acceptance | mfa-login-enforcement', function (hooks) {
   setupApplicationTest(hooks);
@@ -16,7 +17,7 @@ module('Acceptance | mfa-login-enforcement', function (hooks) {
 
   hooks.beforeEach(function () {
     mfaConfigHandlers(this.server);
-    return authPage.login();
+    return login();
   });
 
   test('it should send the correct data when creating an enforcement', async function (assert) {
@@ -34,7 +35,7 @@ module('Acceptance | mfa-login-enforcement', function (hooks) {
 
     await visit('/ui/vault/access');
     await click('[data-test-sidebar-nav-link="Multi-Factor Authentication"]');
-    await click('[data-test-tab="enforcements"]');
+    await click(GENERAL.tab('enforcements'));
     await click('[data-test-enforcement-create]');
     // Fill out form
     await fillIn('[data-test-mlef-input="name"]', 'salad-college-setting');
@@ -48,7 +49,7 @@ module('Acceptance | mfa-login-enforcement', function (hooks) {
   test('it should create login enforcement', async function (assert) {
     await visit('/ui/vault/access');
     await click('[data-test-sidebar-nav-link="Multi-Factor Authentication"]');
-    await click('[data-test-tab="enforcements"]');
+    await click(GENERAL.tab('enforcements'));
     await click('[data-test-enforcement-create]');
 
     assert.dom('[data-test-mleh-title]').hasText('New enforcement', 'Title renders');
@@ -87,7 +88,7 @@ module('Acceptance | mfa-login-enforcement', function (hooks) {
 
   test('it should list login enforcements', async function (assert) {
     await visit('/vault/access/mfa/enforcements');
-    assert.dom('[data-test-tab="enforcements"]').hasClass('active', 'Enforcements tab is active');
+    assert.dom(GENERAL.tab('enforcements')).hasClass('active', 'Enforcements tab is active');
     assert.dom('.toolbar-link').exists({ count: 1 }, 'Correct number of toolbar links render');
     assert
       .dom('[data-test-enforcement-create]')
@@ -106,10 +107,10 @@ module('Acceptance | mfa-login-enforcement', function (hooks) {
     assert.dom('[data-test-list-item]').exists({ count: enforcements.length }, 'Enforcements list renders');
     assert
       .dom(`[data-test-list-item="${item.name}"] svg`)
-      .hasClass('flight-icon-lock', 'Lock icon renders for list item');
+      .hasClass('hds-icon-lock', 'Lock icon renders for list item');
     assert.dom(`[data-test-list-item-title="${item.name}"]`).hasText(item.name, 'Enforcement name renders');
 
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     await click('[data-test-list-item-link="details"]');
     assert.strictEqual(
       currentRouteName(),
@@ -117,7 +118,7 @@ module('Acceptance | mfa-login-enforcement', function (hooks) {
       'Details more menu action transitions to enforcement route'
     );
     await click('.hds-breadcrumb a');
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     await click('[data-test-list-item-link="edit"]');
     assert.strictEqual(
       currentRouteName(),
@@ -132,8 +133,8 @@ module('Acceptance | mfa-login-enforcement', function (hooks) {
     await click(`[data-test-list-item="${enforcement.name}"]`);
     // heading
     assert.dom('h1').includesText(enforcement.name, 'Name renders in title');
-    assert.dom('h1 svg').hasClass('flight-icon-lock', 'Lock icon renders in title');
-    assert.dom('[data-test-tab="targets"]').hasClass('active', 'Targets tab is active by default');
+    assert.dom('h1 svg').hasClass('hds-icon-lock', 'Lock icon renders in title');
+    assert.dom(GENERAL.tab('targets')).hasClass('active', 'Targets tab is active by default');
     await waitFor('[data-test-target]', { timeout: 5000 });
     assert.dom('[data-test-target]').exists({ count: 4 }, 'Targets render in list');
     // targets tab
@@ -165,16 +166,16 @@ module('Acceptance | mfa-login-enforcement', function (hooks) {
       }
     }
     // methods tab
-    await click('[data-test-tab="methods"]');
-    assert.dom('[data-test-tab="methods"]').hasClass('active', 'Methods tab is active');
+    await click(GENERAL.tab('methods'));
+    assert.dom(GENERAL.tab('methods')).hasClass('active', 'Methods tab is active');
     const method = this.owner.lookup('service:store').peekRecord('mfa-method', enforcement.mfa_method_ids[0]);
     assert
       .dom(`[data-test-mfa-method-list-item="${method.id}"]`)
       .includesText(
-        `${method.name} ${method.id} Namespace: ${method.namespace_id}`,
+        `${method.name} ${method.id} Namespace: ${method.namespace_path}`,
         'Method list item renders'
       );
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     assert
       .dom(`[data-test-mfa-method-menu-link="details"]`)
       .hasAttribute('href', `/ui/vault/access/mfa/methods/${method.id}`, `Details link renders for method`);
@@ -190,9 +191,9 @@ module('Acceptance | mfa-login-enforcement', function (hooks) {
         'Toolbar edit action has link to edit route'
       );
     await click('[data-test-enforcement-delete]');
-    assert.dom('[data-test-confirm-button]').isDisabled('Delete button disabled with no confirmation');
+    assert.dom(GENERAL.confirmButton).isDisabled('Delete button disabled with no confirmation');
     await fillIn('[data-test-confirmation-modal-input]', enforcement.name);
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.access.mfa.enforcements.index',
@@ -203,7 +204,7 @@ module('Acceptance | mfa-login-enforcement', function (hooks) {
   test('it should edit login enforcement', async function (assert) {
     await visit('/vault/access/mfa/enforcements');
     const enforcement = this.server.db.mfaLoginEnforcements.where({})[0];
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     await click('[data-test-list-item-link="edit"]');
 
     assert.dom('h1').hasText('Update enforcement', 'Title renders');
diff --git a/ui/tests/acceptance/mfa-login-test.js b/ui/tests/acceptance/mfa-login-test.js
index 5154a6647b3..91962e59cd8 100644
--- a/ui/tests/acceptance/mfa-login-test.js
+++ b/ui/tests/acceptance/mfa-login-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,11 @@ import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { click, currentRouteName, fillIn, visit, waitUntil, find, waitFor } from '@ember/test-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import mfaLoginHandler, { validationHandler } from '../../mirage/handlers/mfa-login';
+import mfaLoginHandler, { validationHandler } from 'vault/mirage/handlers/mfa-login';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { MFA_SELECTORS } from 'vault/tests/helpers/mfa/mfa-selectors';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
 
 module('Acceptance | mfa-login', function (hooks) {
   setupApplicationTest(hooks);
@@ -17,24 +21,26 @@ module('Acceptance | mfa-login', function (hooks) {
     mfaLoginHandler(this.server);
     this.auth = this.owner.lookup('service:auth');
     this.select = async (select = 0, option = 1) => {
-      const selector = `[data-test-mfa-select="${select}"]`;
+      const selector = MFA_SELECTORS.select(select);
       const value = this.element.querySelector(`${selector} option:nth-child(${option + 1})`).value;
-      await fillIn(`${selector} select`, value);
+      await fillIn(selector, value);
     };
     return visit('/vault/logout');
   });
+
   hooks.afterEach(function () {
     // Manually clear token after each so that future tests don't get into a weird state
     this.auth.deleteCurrentToken();
   });
 
   const login = async (user) => {
-    await visit('/vault/auth?with=token');
-    await fillIn('[data-test-select="auth-method"]', 'userpass');
-    await fillIn('[data-test-username]', user);
-    await fillIn('[data-test-password]', 'test');
-    await click('[data-test-auth-submit]');
+    await visit('/vault/auth');
+    await fillIn(AUTH_FORM.selectMethod, 'userpass');
+    await fillIn(GENERAL.inputByAttr('username'), user);
+    await fillIn(GENERAL.inputByAttr('password'), 'test');
+    await click(GENERAL.submitButton);
   };
+
   const didLogin = async (assert) => {
     await waitFor('[data-test-dashboard-card-header]', {
       timeout: 5000,
@@ -42,47 +48,53 @@ module('Acceptance | mfa-login', function (hooks) {
     });
     assert.strictEqual(currentRouteName(), 'vault.cluster.dashboard', 'Route transitions after login');
   };
+
   const validate = async (multi) => {
-    await fillIn('[data-test-mfa-passcode="0"]', 'test');
+    await fillIn(MFA_SELECTORS.passcode(0), 'test');
     if (multi) {
-      await fillIn('[data-test-mfa-passcode="1"]', 'test');
+      await fillIn(MFA_SELECTORS.passcode(1), 'test');
     }
-    await click('[data-test-mfa-validate]');
+    await click(GENERAL.button('Verify'));
+  };
+
+  // 7 assertions
+  const assertSelfEnroll = async (assert) => {
+    // Wait for QR code
+    await waitFor(MFA_SELECTORS.qrCode);
+    assert.dom(MFA_SELECTORS.qrCode).exists('it renders a QR code');
+    assert.dom(GENERAL.title).hasText('Set up MFA TOTP to continue');
+    // Click "Continue" to go onto next step and verify code
+    await click(GENERAL.button('Continue'));
+    assert.dom(GENERAL.button('Continue')).doesNotExist('"Continue" button is replaced by "Verify"');
+    assert.dom(MFA_SELECTORS.qrCode).doesNotExist('Clicking "Continue" removes QR code');
+    assert.dom(MFA_SELECTORS.label).hasText('Enter your one-time code');
+    assert.dom(MFA_SELECTORS.passcode()).exists({ count: 1 }, '1 passcode inputs renders');
+    assert.dom(GENERAL.button('Verify')).exists();
   };
 
-  test('it should handle single mfa constraint with passcode method', async function (assert) {
+  test('it should handle single constraint with passcode method', async function (assert) {
     assert.expect(4);
     await login('mfa-a');
-    assert
-      .dom('[data-test-mfa-description]')
-      .includesText(
-        'Enter your authentication code to log in.',
-        'Mfa form displays with correct description'
-      );
-    assert.dom('[data-test-mfa-select]').doesNotExist('Select is hidden for single method');
-    assert.dom('[data-test-mfa-passcode]').exists({ count: 1 }, 'Single passcode input renders');
+    await waitFor(GENERAL.title);
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(MFA_SELECTORS.select()).doesNotExist('Select is hidden for single method');
+    assert.dom(MFA_SELECTORS.passcode()).exists({ count: 1 }, 'Single passcode input renders');
     await validate();
     await didLogin(assert);
   });
 
-  test('it should handle single mfa constraint with push method', async function (assert) {
+  test('it should handle single constraint with push method', async function (assert) {
     assert.expect(6);
-
-    server.post('/sys/mfa/validate', async (schema, req) => {
-      await waitUntil(() => find('[data-test-mfa-description]'));
-      assert
-        .dom('[data-test-mfa-description]')
-        .hasText(
-          'Multi-factor authentication is enabled for your account.',
-          'Mfa form displays with correct description'
-        );
-      assert.dom('[data-test-mfa-label]').hasText('Okta push notification', 'Correct method renders');
+    this.server.post('/sys/mfa/validate', async (schema, req) => {
+      await waitUntil(() => find(MFA_SELECTORS.verifyForm));
+      assert.dom(GENERAL.title).hasText('Verify your identity');
+      assert.dom(MFA_SELECTORS.label).hasText('Okta push notification', 'Correct method renders');
       assert
-        .dom('[data-test-mfa-push-instruction]')
+        .dom(MFA_SELECTORS.push)
         .hasText('Check device for push notification', 'Push notification instruction renders');
-      assert.dom('[data-test-mfa-validate]').isDisabled('Button is disabled while validating');
+      assert.dom(GENERAL.button('Verify')).isDisabled('Button is disabled while validating');
       assert
-        .dom('[data-test-mfa-validate] [data-test-icon="loading"]')
+        .dom(`${GENERAL.button('Verify')} ${GENERAL.icon('loading')}`)
         .exists('Loading icon shows while validating');
       return validationHandler(schema, req);
     });
@@ -91,50 +103,46 @@ module('Acceptance | mfa-login', function (hooks) {
     await didLogin(assert);
   });
 
-  test('it should handle single mfa constraint with 2 passcode methods', async function (assert) {
-    assert.expect(4);
+  test('it should handle single constraint with 2 passcode methods', async function (assert) {
+    assert.expect(5);
     await login('mfa-c');
-    assert
-      .dom('[data-test-mfa-description]')
-      .includesText('Select the MFA method you wish to use.', 'Mfa form displays with correct description');
-    assert
-      .dom('[data-test-mfa-select]')
-      .exists({ count: 1 }, 'Select renders for single constraint with multiple methods');
-    assert.dom('[data-test-mfa-passcode]').doesNotExist('Passcode input hidden until selection is made');
-    await this.select();
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(GENERAL.button('Verify with Duo')).exists('It renders button for Duo');
+    assert.dom(GENERAL.button('Verify with TOTP')).exists('It renders button for TOTP');
+    assert.dom(MFA_SELECTORS.passcode()).doesNotExist('Passcode input hidden until selection is made');
+    await click(GENERAL.button('Verify with TOTP'));
     await validate();
     await didLogin(assert);
   });
 
-  test('it should handle single mfa constraint with 2 push methods', async function (assert) {
-    assert.expect(1);
+  test('it should handle single constraint with 2 push methods', async function (assert) {
+    assert.expect(4);
     await login('mfa-d');
-    await this.select();
-    await click('[data-test-mfa-validate]');
+    await waitFor(MFA_SELECTORS.mfaForm);
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(GENERAL.button('Verify with Okta')).exists('It renders button for Okta');
+    assert.dom(GENERAL.button('Verify with Duo')).exists('It renders button for Duo');
+    await click(GENERAL.button('Verify with Okta'));
     await didLogin(assert);
   });
 
-  test('it should handle single mfa constraint with 1 passcode and 1 push method', async function (assert) {
+  test('it should handle single constraint with 1 passcode and 1 push method', async function (assert) {
     assert.expect(3);
     await login('mfa-e');
-    await this.select(0, 2);
-    assert.dom('[data-test-mfa-passcode]').exists('Passcode input renders');
-    await this.select();
-    assert.dom('[data-test-mfa-passcode]').doesNotExist('Passcode input is hidden for push method');
-    await click('[data-test-mfa-validate]');
+    await waitFor(MFA_SELECTORS.mfaForm);
+    assert.dom(GENERAL.button('Verify with Okta')).exists('It renders button for Okta');
+    await click(GENERAL.button('Verify with TOTP'));
+    assert.dom(MFA_SELECTORS.passcode()).exists('Passcode input renders');
+    await click(GENERAL.button('Try another method'));
+    // Clicking "Verify with Okta" automatically starts validation so no need to click "Verify"
+    await click(GENERAL.button('Verify with Okta'));
     await didLogin(assert);
   });
 
-  test('it should handle multiple mfa constraints with 1 passcode method each', async function (assert) {
-    assert.expect(3);
+  test('it should handle multiple constraints with 1 passcode method each', async function (assert) {
+    assert.expect(2);
     await login('mfa-f');
-    assert
-      .dom('[data-test-mfa-description]')
-      .includesText(
-        'Two methods are required for successful authentication.',
-        'Mfa form displays with correct description'
-      );
-    assert.dom('[data-test-mfa-select]').doesNotExist('Selects do not render for single methods');
+    assert.dom(MFA_SELECTORS.select()).doesNotExist('Selects do not render for single methods');
     await validate(true);
     await didLogin(assert);
   });
@@ -145,51 +153,189 @@ module('Acceptance | mfa-login', function (hooks) {
     await didLogin(assert);
   });
 
-  test('it should handle multiple mfa constraints with 1 passcode and 1 push method', async function (assert) {
-    assert.expect(4);
+  test('it should handle multiple constraints with 1 passcode and 1 push method', async function (assert) {
+    assert.expect(3);
     await login('mfa-h');
-    assert
-      .dom('[data-test-mfa-description]')
-      .includesText(
-        'Two methods are required for successful authentication.',
-        'Mfa form displays with correct description'
-      );
-    assert.dom('[data-test-mfa-select]').doesNotExist('Select is hidden for single method');
-    assert.dom('[data-test-mfa-passcode]').exists({ count: 1 }, 'Passcode input renders');
+    assert.dom(MFA_SELECTORS.select()).doesNotExist('Select is hidden for single method');
+    assert.dom(MFA_SELECTORS.passcode()).exists({ count: 1 }, 'Passcode input renders');
     await validate();
     await didLogin(assert);
   });
 
-  test('it should handle multiple mfa constraints with multiple mixed methods', async function (assert) {
-    assert.expect(2);
+  test('it should handle multiple constraints with multiple mixed methods', async function (assert) {
+    assert.expect(1);
     await login('mfa-i');
-    assert
-      .dom('[data-test-mfa-description]')
-      .includesText(
-        'Two methods are required for successful authentication.',
-        'Mfa form displays with correct description'
-      );
     await this.select();
-    await fillIn('[data-test-mfa-passcode="1"]', 'test');
-    await click('[data-test-mfa-validate]');
+    await fillIn(MFA_SELECTORS.passcode(1), 'test');
+    await click(GENERAL.button('Verify'));
     await didLogin(assert);
   });
 
   test('it should render unauthorized message for push failure', async function (assert) {
     await login('mfa-j');
-    await waitFor('[data-test-empty-state-title]');
-    assert.dom('[data-test-auth-form]').doesNotExist('Auth form hidden when mfa fails');
-    assert.dom('[data-test-empty-state-title]').hasText('Unauthorized', 'Error title renders');
+    await waitFor(GENERAL.messageError);
+    assert.dom(AUTH_FORM.form).doesNotExist('Auth form does not render');
+    // Using hasTextContaining because the UUID is regenerated each time in mirage
     assert
-      .dom('[data-test-empty-state-subText]')
-      .hasText('PingId MFA validation failed', 'Error message from server renders');
-    assert
-      .dom('[data-test-empty-state-message]')
-      .hasText(
-        'Multi-factor authentication is required, but failed. Go back and try again, or contact your administrator.',
-        'Error description renders'
+      .dom(GENERAL.messageError)
+      .hasTextContaining(
+        'Error failed to satisfy enforcement test_0 pingid authentication failed: "Login request denied." login MFA validation failed for methodID:'
       );
-    await click('[data-test-mfa-error] button');
-    assert.dom('[data-test-auth-form]').exists('Auth form renders after mfa error dismissal');
+    await click(GENERAL.cancelButton);
+    assert.dom(AUTH_FORM.form).exists('Auth form renders after mfa error dismissal');
+  });
+
+  /*
+   * SELF-ENROLLMENT TESTS
+   * Even though self-enrollment is an enterprise-only feature, these tests use Mirage so we don't need to filter them out of CE test runs
+   */
+  test('self-enroll: single constraint with one TOTP passcode', async function (assert) {
+    assert.expect(8);
+    await login('mfa-a-self');
+    await assertSelfEnroll(assert);
+    await validate();
+    await didLogin(assert);
+  });
+
+  test('self-enroll: single constraint with 2 passcode methods', async function (assert) {
+    assert.expect(10);
+    await login('mfa-c-self');
+    // Buttons render for both Duo and TOTP, we want to click TOTP to initiate self-enrollment flow
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(GENERAL.button('Verify with Duo')).exists();
+    await click(GENERAL.button('Setup to verify with TOTP'));
+    await assertSelfEnroll(assert);
+    await validate();
+    await didLogin(assert);
+  });
+
+  test('self-enroll: multiple constraints with 1 passcode method each', async function (assert) {
+    assert.expect(13);
+    await login('mfa-f-self');
+    await assertSelfEnroll(assert);
+    // Fill in and click "Verify" which should render passcode for second constraint
+    await fillIn(MFA_SELECTORS.passcode(0), 'test');
+    await click(GENERAL.button('Verify'));
+    assert.dom(MFA_SELECTORS.verifyBadge('TOTP passcode')).hasText('TOTP passcode');
+    assert.dom(GENERAL.button('Verify')).exists();
+    assert.dom(MFA_SELECTORS.label).hasText('Duo passcode');
+    assert.dom(MFA_SELECTORS.passcode()).exists({ count: 1 }, '1 passcode inputs renders');
+    assert.dom('hr').exists({ count: 1 }, 'only one separator renders');
+    await fillIn(MFA_SELECTORS.passcode(1), 'test');
+    await click(GENERAL.button('Verify'));
+    await didLogin(assert);
+  });
+
+  test('self-enroll: multiple constraints with 1 passcode and 1 push method', async function (assert) {
+    assert.expect(8);
+    await login('mfa-h-self');
+    await assertSelfEnroll(assert);
+    // Fill in and click "Verify" which should immediately trigger MFA validation because the
+    // second constraint is a push notification and no user input is required.
+    await fillIn(MFA_SELECTORS.passcode(0), 'test');
+    await click(GENERAL.button('Verify'));
+    await didLogin(assert);
+  });
+
+  test('self-enroll: multiple constraints with multiple mixed methods', async function (assert) {
+    assert.expect(14);
+    await login('mfa-i-self');
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(GENERAL.button('Verify with Okta')).exists();
+    await click(GENERAL.button('Setup to verify with TOTP'));
+    await assertSelfEnroll(assert);
+    // Fill in and click "Verify" which should render passcode for second constraint
+    await fillIn(MFA_SELECTORS.passcode(0), 'test');
+    await click(GENERAL.button('Verify'));
+    assert.dom(MFA_SELECTORS.verifyBadge('TOTP passcode')).hasText('TOTP passcode');
+    assert.dom(MFA_SELECTORS.select(0)).isDisabled('Select with self-enrolled TOTP is disabled');
+    assert.dom(MFA_SELECTORS.passcode()).exists({ count: 1 }, '1 passcode inputs renders');
+    assert.dom(MFA_SELECTORS.label).hasText('Duo passcode');
+    await fillIn(MFA_SELECTORS.passcode(1), 'test');
+    await click(GENERAL.button('Verify'));
+    await didLogin(assert);
+  });
+
+  test('self-enroll: single constraint with 2 self-enroll methods', async function (assert) {
+    assert.expect(10);
+    await login('mfa-y-self');
+    // Buttons render for both TOTP methods
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(GENERAL.button('Setup to verify with TOTP')).exists({ count: 2 });
+    await click(GENERAL.button('Setup to verify with TOTP'));
+    await assertSelfEnroll(assert);
+    await validate();
+    await didLogin(assert);
+  });
+
+  test('self-enroll: multiple constraints, 1 with 2 methods (one that supports self-enroll), 1 with push method', async function (assert) {
+    assert.expect(17);
+    await login('mfa-z-self');
+    // For the constraint that supports self-enrollment, user must select it first.
+    assert.dom(MFA_SELECTORS.select(0)).exists();
+    assert.dom(MFA_SELECTORS.select(1)).exists();
+    assert.dom('hr').exists({ count: 1 }, 'only one separator renders');
+    await this.select(0, 1);
+    await assertSelfEnroll(assert);
+    await fillIn(MFA_SELECTORS.passcode(0), 'test');
+    await click(GENERAL.button('Verify'));
+    assert
+      .dom(`${MFA_SELECTORS.select(0)} option:nth-child(2)`)
+      .hasText('TOTP passcode (supports self-enrollment)', 'TOTP is pre-selected for the first constraint');
+    await this.select(1, 2);
+    // On second selection we are redirected
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(MFA_SELECTORS.verifyForm).exists('it renders mfa validation form');
+    assert.dom(MFA_SELECTORS.select(0)).isDisabled();
+    assert.dom(MFA_SELECTORS.verifyBadge('TOTP passcode')).exists('pending verification badge exists');
+    assert.dom(MFA_SELECTORS.select(1)).isNotDisabled();
+    await didLogin(assert);
+  });
+
+  test('self-enroll: if validation fails it resets the enrollment status', async function (assert) {
+    await login('mfa-c-self');
+    await click(GENERAL.button('Setup to verify with TOTP'));
+    await waitFor(MFA_SELECTORS.qrCode);
+    await click(GENERAL.button('Continue'));
+    await fillIn(MFA_SELECTORS.passcode(0), '123456'); // not a valid code so it fails
+    await click(GENERAL.button('Verify'));
+    await waitFor(MFA_SELECTORS.verifyForm);
+    assert.dom(MFA_SELECTORS.verifyBadge('TOTP passcode')).doesNotExist();
+    assert.dom(MFA_SELECTORS.passcode(0)).exists().hasValue('123456', 'input has last used passcode');
+  });
+
+  module('error handling', function (hooks) {
+    hooks.beforeEach(function () {
+      this.server.post('/identity/mfa/method/totp/self-enroll', async () => {
+        return overrideResponse(500, JSON.stringify({ errors: ['uh oh!'] }));
+      });
+    });
+
+    test('single constraint with one TOTP passcode', async function (assert) {
+      await login('mfa-a-self');
+      await waitFor(MFA_SELECTORS.verifyForm);
+      assert.dom(MFA_SELECTORS.qrCode).doesNotExist('it does not enter self-enroll workflow');
+      assert.dom(GENERAL.button('Continue')).doesNotExist();
+      assert.dom(GENERAL.messageError).hasText('Error uh oh!', 'it renders error messages');
+    });
+
+    test('single constraint with 2 passcode methods', async function (assert) {
+      await login('mfa-c-self');
+      // Buttons render for both Duo and TOTP, we want to click TOTP to initiate self-enrollment flow
+      assert.dom(GENERAL.button('Verify with Duo')).exists();
+      await click(GENERAL.button('Setup to verify with TOTP'));
+      await waitFor(MFA_SELECTORS.verifyForm);
+      assert.dom(MFA_SELECTORS.qrCode).doesNotExist('it does not enter self-enroll workflow');
+      assert.dom(GENERAL.button('Continue')).doesNotExist();
+      assert.dom(GENERAL.messageError).hasText('Error uh oh!', 'it renders error messages');
+    });
+
+    test('multiple constraints with 1 passcode method each', async function (assert) {
+      await login('mfa-f-self');
+      await waitFor(MFA_SELECTORS.verifyForm);
+      assert.dom(MFA_SELECTORS.qrCode).doesNotExist('it does not enter self-enroll workflow');
+      assert.dom(GENERAL.button('Continue')).doesNotExist();
+      assert.dom(GENERAL.messageError).hasText('Error uh oh!', 'it renders error messages');
+    });
   });
 });
diff --git a/ui/tests/acceptance/mfa-method-test.js b/ui/tests/acceptance/mfa-method-test.js
index 52a82dd5781..62e4875e9b8 100644
--- a/ui/tests/acceptance/mfa-method-test.js
+++ b/ui/tests/acceptance/mfa-method-test.js
@@ -1,16 +1,18 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { click, currentRouteName, currentURL, fillIn, visit } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import mfaConfigHandler from 'vault/mirage/handlers/mfa-config';
 import { Response } from 'miragejs';
 import { underscore } from '@ember/string';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { duration } from 'vault/helpers/format-duration';
 
 module('Acceptance | mfa-method', function (hooks) {
   setupApplicationTest(hooks);
@@ -21,10 +23,10 @@ module('Acceptance | mfa-method', function (hooks) {
     this.store = this.owner.lookup('service:store');
     this.getMethods = () =>
       ['Totp', 'Duo', 'Okta', 'Pingid'].reduce((methods, type) => {
-        methods.addObjects(this.server.db[`mfa${type}Methods`].where({}));
+        methods = [...methods, ...this.server.db[`mfa${type}Methods`].where({})];
         return methods;
       }, []);
-    return authPage.login();
+    return login();
   });
 
   test('it should display landing page when no methods exist', async function (assert) {
@@ -65,11 +67,11 @@ module('Acceptance | mfa-method', function (hooks) {
     assert
       .dom(`[data-test-mfa-method-list-item="${model.id}"]`)
       .includesText(
-        `${model.name} ${model.id} Namespace: ${model.namespace_id}`,
+        `${model.name} ${model.id} Namespace: ${model.namespace_path}`,
         'Copy renders for list item'
       );
 
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     await click('[data-test-mfa-method-menu-link="details"]');
     assert.strictEqual(
       currentRouteName(),
@@ -77,7 +79,7 @@ module('Acceptance | mfa-method', function (hooks) {
       'Details more menu action transitions to method route'
     );
     await click('.hds-breadcrumb a');
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     await click('[data-test-mfa-method-menu-link="edit"]');
     assert.strictEqual(
       currentRouteName(),
@@ -86,6 +88,17 @@ module('Acceptance | mfa-method', function (hooks) {
     );
   });
 
+  test('it should not display for the root namespace', async function (assert) {
+    await visit('/vault/access/mfa');
+    const methods = this.getMethods();
+    const duoModel = this.store.peekRecord('mfa-method', methods[1].id);
+    assert.strictEqual(duoModel.namespace_path, '', 'Namespace path is unset');
+    assert
+      .dom(`[data-test-mfa-method-list-item="${duoModel.id}"]`)
+      .includesText(`${duoModel.name} ${duoModel.id}`, 'Copy renders for list item without namespace path')
+      .doesNotContainText('Namespace:', 'Does not include the namespace label');
+  });
+
   test('it should display method details', async function (assert) {
     // ensure methods are tied to an enforcement
     this.server.get('/identity/mfa/login-enforcement', () => {
@@ -110,6 +123,9 @@ module('Acceptance | mfa-method', function (hooks) {
         "This method cannot be deleted until its enforcements are deleted. This can be done from the 'Enforcements' tab."
       );
 
+    // we need to close the modal
+    await click(GENERAL.cancelButton);
+
     const fields = [
       ['Issuer', 'Period', 'Key size', 'QR size', 'Algorithm', 'Digits', 'Skew', 'Max validation attempts'],
       ['Duo API hostname', 'Passcode reminder'],
@@ -132,8 +148,11 @@ module('Acceptance | mfa-method', function (hooks) {
             'Passcode reminder': 'use_passcode',
             'Organization name': 'org_name',
           }[label] || underscore(label);
-        const value = typeof model[key] === 'boolean' ? (model[key] ? 'Yes' : 'No') : model[key].toString();
-        assert.dom(`[data-test-value-div="${label}"]`).hasText(value, `${label} value renders`);
+        let value = typeof model[key] === 'boolean' ? (model[key] ? 'Yes' : 'No') : model[key].toString();
+        if (key === 'period') {
+          value = duration([Number(value)]);
+        }
+        assert.dom(GENERAL.infoRowValue(label)).hasText(value, `${label} value renders`);
       });
       await click('.hds-breadcrumb a');
     }
@@ -153,8 +172,8 @@ module('Acceptance | mfa-method', function (hooks) {
     await visit('/vault/access/mfa/methods');
     const methodCount = this.element.querySelectorAll('[data-test-mfa-method-list-item]').length;
     await click('[data-test-mfa-method-list-item]');
-    await click('[data-test-confirm-action-trigger]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
     assert.dom('[data-test-mfa-method-list-item]').exists({ count: methodCount - 1 }, 'Method was deleted');
   });
 
@@ -178,20 +197,13 @@ module('Acceptance | mfa-method', function (hooks) {
       await click('[data-test-mleh-radio="skip"]');
       await click('[data-test-mfa-create-save]');
       assert
-        .dom('[data-test-inline-error-message]')
+        .dom('[data-test-validation-error]')
         .exists({ count: required.length }, `Required field validations display for ${type}`);
 
-      for (const [i, field] of required.entries()) {
-        let inputType = 'input';
-        // this is less than ideal but updating the test selectors in masked-input break a bunch of tests
-        // add value to the masked input text area data-test attributes for selection
-        if (['secret_key', 'integration_key'].includes(field)) {
-          inputType = 'textarea';
-          const textareas = this.element.querySelectorAll('[data-test-textarea]');
-          textareas[i].setAttribute('data-test-textarea', field);
-        }
-        await fillIn(`[data-test-${inputType}="${field}"]`, 'foo');
+      for (const field of required) {
+        await fillIn(GENERAL.inputByAttr(field), 'foo');
       }
+
       await click('[data-test-mfa-create-save]');
       assert.strictEqual(
         currentRouteName(),
@@ -220,10 +232,12 @@ module('Acceptance | mfa-method', function (hooks) {
       'Route transitions to method on save'
     );
     await click('[data-test-tab="enforcements"]');
-    assert.dom('[data-test-list-item]').hasText('bar', 'Enforcement is listed in method view');
+    assert.dom('[data-test-list-item]').hasTextContaining('bar', 'Enforcement is listed in method view');
     await click('[data-test-sidebar-nav-link="Multi-Factor Authentication"]');
     await click('[data-test-tab="enforcements"]');
-    assert.dom('[data-test-list-item="bar"]').hasText('bar', 'Enforcement is listed in enforcements view');
+    assert
+      .dom('[data-test-list-item="bar"]')
+      .hasTextContaining('bar', 'Enforcement is listed in enforcements view');
     await click('[data-test-list-item="bar"]');
     await click('[data-test-tab="methods"]');
     assert
@@ -248,12 +262,14 @@ module('Acceptance | mfa-method', function (hooks) {
       'Route transitions to method on save'
     );
     await click('[data-test-tab="enforcements"]');
-    assert.dom('[data-test-list-item]').hasText(name, 'Enforcement is listed in method view');
+    assert.dom('[data-test-list-item]').hasTextContaining(name, 'Enforcement is listed in method view');
   });
 
   test('it should edit methods', async function (assert) {
     await visit('/vault/access/mfa/methods');
-    const id = this.element.querySelector('[data-test-mfa-method-list-item] .tag').textContent.trim();
+    const id = this.element
+      .querySelector('[data-test-mfa-method-list-item] .hds-badge div')
+      .textContent.trim();
     const model = this.store.peekRecord('mfa-method', id);
     await click('[data-test-mfa-method-list-item] [data-test-popup-menu-trigger]');
     await click('[data-test-mfa-method-menu-link="edit"]');
@@ -283,7 +299,7 @@ module('Acceptance | mfa-method', function (hooks) {
     await fillIn('[data-test-input="max_validation_attempts"]', 10);
     await click('[data-test-mfa-save]');
     await fillIn('[data-test-confirmation-modal-input]', model.type);
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
 
     assert.dom('[data-test-row-value="Issuer"]').hasText('foo', 'Issuer field is updated');
     assert.dom('[data-test-row-value="Algorithm"]').hasText('SHA1', 'Algorithm field is updated');
diff --git a/ui/tests/acceptance/mfa-setup-test.js b/ui/tests/acceptance/mfa-setup-test.js
index 17503562538..62f54300c52 100644
--- a/ui/tests/acceptance/mfa-setup-test.js
+++ b/ui/tests/acceptance/mfa-setup-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,11 +7,12 @@ import { module, test } from 'qunit';
 import { create } from 'ember-cli-page-object';
 import { v4 as uuidv4 } from 'uuid';
 import { setupApplicationTest } from 'ember-qunit';
-import { click, fillIn, waitFor } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
-import enablePage from 'vault/tests/pages/settings/auth/enable';
+import { click, fillIn, visit, waitFor } from '@ember/test-helpers';
+import { login, loginMethod } from 'vault/tests/helpers/auth/auth-helpers';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
 import consoleClass from 'vault/tests/pages/components/console/ui-panel';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const consoleComponent = create(consoleClass);
 const USER = 'end-user';
@@ -19,7 +20,8 @@ const PASSWORD = 'mypassword';
 const POLICY_NAME = 'identity_policy';
 
 const writePolicy = async function (path) {
-  await enablePage.enable('userpass', path);
+  await visit('/vault/settings/auth/enable');
+  await mountBackend('userpass', path);
   const identityPolicy = `path "identity/*" {
     capabilities = ["create", "read", "update", "delete", "list"]
   }`;
@@ -37,7 +39,7 @@ const writeUserWithPolicy = async function (path) {
 const setupUser = async function (path) {
   await writePolicy(path);
   await writeUserWithPolicy(path);
-  await click('[data-test-save-config="true"]');
+  await click(GENERAL.submitButton);
 };
 
 module('Acceptance | mfa-setup', function (hooks) {
@@ -46,11 +48,13 @@ module('Acceptance | mfa-setup', function (hooks) {
 
   hooks.beforeEach(async function () {
     const path = `userpass-${uuidv4()}`;
-    await authPage.login();
+    await login();
     await setupUser(path);
-    await authPage.logout();
-    await authPage.loginUsername(USER, PASSWORD, path);
-    await click('[data-test-user-menu-trigger]');
+    await loginMethod(
+      { username: USER, password: PASSWORD, path },
+      { authType: 'userpass', toggleOptions: true }
+    );
+    await click(GENERAL.button('user-menu-trigger'));
     await click('[data-test-user-menu-item="mfa"]');
   });
 
diff --git a/ui/tests/acceptance/not-found-test.js b/ui/tests/acceptance/not-found-test.js
index d5ef26de08e..84307aaf77d 100644
--- a/ui/tests/acceptance/not-found-test.js
+++ b/ui/tests/acceptance/not-found-test.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { visit } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import Ember from 'ember';
 
 let adapterException;
@@ -17,7 +17,7 @@ module('Acceptance | not-found', function (hooks) {
   hooks.beforeEach(function () {
     adapterException = Ember.Test.adapter.exception;
     Ember.Test.adapter.exception = () => {};
-    return authPage.login();
+    return login();
   });
 
   hooks.afterEach(function () {
@@ -40,12 +40,12 @@ module('Acceptance | not-found', function (hooks) {
   });
 
   test('cluster route not-found', async function (assert) {
-    await visit('/vault/secrets/secret/404/show');
+    await visit('/vault/secrets-engines/secret/404/show');
     assert.dom('[data-test-not-found]').exists('renders the not found component');
   });
 
   test('secret not-found', async function (assert) {
-    await visit('/vault/secrets/cubbyhole/show/404');
+    await visit('/vault/secrets-engines/cubbyhole/show/404');
     assert.dom('[data-test-secret-not-found]').exists('renders the message about the secret not being found');
   });
 });
diff --git a/ui/tests/acceptance/oidc-auth-method-test.js b/ui/tests/acceptance/oidc-auth-method-test.js
index cedd5899e3b..ed2fa0f7180 100644
--- a/ui/tests/acceptance/oidc-auth-method-test.js
+++ b/ui/tests/acceptance/oidc-auth-method-test.js
@@ -1,155 +1,146 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
-
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { click, fillIn, find, waitUntil } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
+import { click, fillIn, waitFor } from '@ember/test-helpers';
+import { logout } from 'vault/tests/helpers/auth/auth-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { fakeWindow, buildMessage } from '../helpers/oidc-window-stub';
+import {
+  callbackData,
+  DELAY_IN_MS,
+  triggerMessageEvent,
+  windowStub,
+} from 'vault/tests/helpers/oidc-window-stub';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { ERROR_MISSING_PARAMS, ERROR_POPUP_FAILED, ERROR_WINDOW_CLOSED } from 'vault/utils/auth-form-helpers';
+import { getErrorResponse } from 'vault/tests/helpers/api/error-response';
 import sinon from 'sinon';
-import { later, _cancelTimers as cancelTimers } from '@ember/runloop';
-import { Response } from 'miragejs';
+import { RESPONSE_STUBS } from '../helpers/auth/response-stubs';
 
 module('Acceptance | oidc auth method', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.openStub = sinon.stub(window, 'open').callsFake(() => fakeWindow.create());
+    this.openStub = windowStub();
 
-    this.setupMocks = (assert) => {
+    this.setupMocks = () => {
       this.server.post('/auth/oidc/oidc/auth_url', () => ({
         data: { auth_url: 'http://example.com' },
       }));
-      // there was a bug that would result in the /auth/:path/login endpoint hit with an empty payload rather than lookup-self
-      // ensure that the correct endpoint is hit after the oidc callback
-      if (assert) {
-        this.server.get('/auth/token/lookup-self', (schema, req) => {
-          assert.ok(true, 'request made to auth/token/lookup-self after oidc callback');
-          req.passthrough();
-        });
-      }
+      this.server.get(`/auth/oidc/oidc/callback`, () => RESPONSE_STUBS.oidc['oidc/callback']);
+      this.server.get(`/auth/token/lookup-self`, () => RESPONSE_STUBS.oidc['lookup-self']);
     };
-
-    this.server.get('/auth/foo/oidc/callback', () => ({
-      auth: { client_token: 'root' },
-    }));
-
-    // select method from dropdown or click auth path tab
-    this.selectMethod = async (method, useLink) => {
-      const methodSelector = useLink
-        ? `[data-test-auth-method-link="${method}"]`
-        : '[data-test-select="auth-method"]';
-      await waitUntil(() => find(methodSelector));
-      if (useLink) {
-        await click(`[data-test-auth-method-link="${method}"]`);
-      } else {
-        await fillIn('[data-test-select="auth-method"]', method);
-      }
-    };
-
-    // ensure clean state
-    localStorage.removeItem('selectedAuth');
-    authPage.logout();
   });
 
-  hooks.afterEach(function () {
+  hooks.afterEach(async function () {
     this.openStub.restore();
+    // ensure clean state
+    // Cannot use logout() here because it will hit the internal mount request before the mocks can interrupt it
+    localStorage.clear();
   });
 
-  test('it should login with oidc when selected from auth methods dropdown', async function (assert) {
-    assert.expect(1);
-
-    this.setupMocks(assert);
+  // coverage for bug where token was selected as auth method for oidc and jwt
+  test('it should populate oidc auth method on logout', async function (assert) {
+    this.setupMocks();
+    await logout();
+    await fillIn(AUTH_FORM.selectMethod, 'oidc');
 
-    await this.selectMethod('oidc');
-    later(() => {
-      window.postMessage(buildMessage().data, window.origin);
-      cancelTimers();
-    }, 50);
-    await click('[data-test-auth-submit]');
-  });
+    triggerMessageEvent('oidc');
 
-  test('it should login with oidc from listed auth mount tab', async function (assert) {
-    assert.expect(3);
+    await click(GENERAL.submitButton);
+    await waitFor('[data-test-dashboard-card-header="Vault version"]');
+    assert
+      .dom('[data-test-dashboard-card-header="Vault version"]')
+      .exists('Render the dashboard landing page.');
 
-    this.setupMocks(assert);
+    await logout();
+    assert.dom(AUTH_FORM.selectMethod).hasValue('oidc', 'Previous auth method selected on logout');
+  });
 
-    this.server.get('/sys/internal/ui/mounts', () => ({
-      data: {
-        auth: {
-          'test-path/': { description: '', options: {}, type: 'oidc' },
-        },
-      },
-    }));
-    // this request is fired twice -- total assertion count should be 3 rather than 2
-    // JLR TODO - auth-jwt: verify whether additional request is necessary, especially when glimmerizing component
-    // look into whether didReceiveAttrs is necessary to trigger this request
-    this.server.post('/auth/test-path/oidc/auth_url', () => {
-      assert.ok(true, 'auth_url request made to correct non-standard mount path');
-      return { data: { auth_url: 'http://example.com' } };
+  // test case for https://github.com/hashicorp/vault/issues/12436
+  test('it should ignore messages sent from outside the app while waiting for oidc callback', async function (assert) {
+    assert.expect(3); // one for both message events (2) and one for callback request
+    this.setupMocks();
+    this.server.get('/auth/foo/oidc/callback', () => {
+      // third assertion
+      assert.true(true, 'request is made to callback url');
+      return { auth: { client_token: 'root' } };
     });
 
-    await this.selectMethod('oidc', true);
-    later(() => {
-      window.postMessage(buildMessage().data, window.origin);
-      cancelTimers();
-    }, 50);
-    await click('[data-test-auth-submit]');
+    let count = 0;
+    const assertEvent = (event) => {
+      count++;
+      // we have to use the same event method, but need to update what it checks for depending on when it's called
+      const source = count === 1 ? 'miscellaneous-source' : 'oidc-callback';
+      assert.strictEqual(event.data.source, source, `message event fires with source: ${event.data.source}`);
+    };
+    window.addEventListener('message', assertEvent);
+    await logout();
+    await fillIn(AUTH_FORM.selectMethod, 'oidc');
+
+    setTimeout(() => {
+      // first assertion
+      window.postMessage(callbackData({ source: 'miscellaneous-source' }), window.origin);
+      // second assertion
+      window.postMessage(callbackData({ source: 'oidc-callback' }), window.origin);
+    }, DELAY_IN_MS);
+
+    await click(GENERAL.submitButton);
+    // cleanup
+    window.removeEventListener('message', assertEvent);
   });
 
-  // coverage for bug where token was selected as auth method for oidc and jwt
-  test('it should populate oidc auth method on logout', async function (assert) {
+  test('it shows error when message posted with state key, wrong params', async function (assert) {
     this.setupMocks();
-    await this.selectMethod('oidc');
-    later(() => {
-      window.postMessage(buildMessage().data, window.origin);
-      cancelTimers();
-    }, 50);
-    await click('[data-test-auth-submit]');
-    await waitUntil(() => find('[data-test-user-menu-trigger]'));
-    await click('[data-test-user-menu-trigger]');
-    await click('#logout');
+    await logout();
+    await fillIn(AUTH_FORM.selectMethod, 'oidc');
+    setTimeout(() => {
+      // callback params are missing "code"
+      window.postMessage({ source: 'oidc-callback', state: 'state', foo: 'bar' }, window.origin);
+    }, DELAY_IN_MS);
+    await click(GENERAL.submitButton);
     assert
-      .dom('[data-test-select="auth-method"]')
-      .hasValue('oidc', 'Previous auth method selected on logout');
+      .dom(GENERAL.messageError)
+      .hasText(`Error Authentication failed: ${ERROR_MISSING_PARAMS}`, 'displays error when missing params');
   });
 
-  test('it should fetch role when switching between oidc/jwt auth methods and changing the mount path', async function (assert) {
-    let reqCount = 0;
-    this.server.post('/auth/:method/oidc/auth_url', (schema, req) => {
-      reqCount++;
-      const errors =
-        req.params.method === 'jwt' ? ['OIDC login is not configured for this mount'] : ['missing role'];
-      return new Response(400, {}, { errors });
-    });
+  test('it shows error when popup is prematurely closed ', async function (assert) {
+    windowStub({ stub: this.openStub, popup: { closed: true, close: () => {} } });
 
-    await this.selectMethod('oidc');
-    assert.dom('[data-test-jwt]').doesNotExist('JWT Token input hidden for OIDC');
-    await this.selectMethod('jwt');
-    assert.dom('[data-test-jwt]').exists('JWT Token input renders for JWT configured method');
-    await click('[data-test-auth-form-options-toggle]');
-    await fillIn('[data-test-auth-form-mount-path]', 'foo');
-    assert.strictEqual(reqCount, 3, 'Role is fetched when dependant values are changed');
+    this.setupMocks();
+    await logout();
+    await fillIn(AUTH_FORM.selectMethod, 'oidc');
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.messageError).hasText(`Error Authentication failed: ${ERROR_WINDOW_CLOSED}`);
   });
 
-  test('it should display role fetch errors when signing in with OIDC', async function (assert) {
-    this.server.post('/auth/:method/oidc/auth_url', (schema, req) => {
-      const { role } = JSON.parse(req.requestBody);
-      const status = role ? 403 : 400;
-      const errors = role ? ['permission denied'] : ['missing role'];
-      return new Response(status, {}, { errors });
-    });
-
-    await this.selectMethod('oidc');
-    await click('[data-test-auth-submit]');
-    assert.dom('[data-test-message-error-description]').hasText('Invalid role. Please try again.');
+  test('it renders error when window fails to open', async function (assert) {
+    this.openStub.returns(null);
+    this.setupMocks();
+    await logout();
+    await fillIn(AUTH_FORM.selectMethod, 'oidc');
+    await click(GENERAL.submitButton);
+    assert
+      .dom(GENERAL.messageError)
+      .hasText(`Error Authentication failed: Failed to open OIDC popup window. ${ERROR_POPUP_FAILED}`);
+  });
 
-    await fillIn('[data-test-role]', 'test');
-    await click('[data-test-auth-submit]');
-    assert.dom('[data-test-message-error-description]').hasText('Error fetching role: permission denied');
+  test('it renders api errors if oidc callback request fails', async function (assert) {
+    await logout();
+    this.server.post('/auth/oidc/oidc/auth_url', () => ({
+      data: { auth_url: 'http://example.com' },
+    }));
+    const api = this.owner.lookup('service:api');
+    const oidcCallbackStub = sinon.stub(api.auth, 'jwtOidcCallback');
+    oidcCallbackStub.rejects(getErrorResponse({ errors: ['something went terribly wrong!'] }, 500));
+    await fillIn(AUTH_FORM.selectMethod, 'oidc');
+    triggerMessageEvent('oidc');
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.messageError).hasText('Error Authentication failed: something went terribly wrong!');
+    oidcCallbackStub.restore();
   });
 });
diff --git a/ui/tests/acceptance/oidc-config/clients-assignments-test.js b/ui/tests/acceptance/oidc-config/clients-assignments-test.js
deleted file mode 100644
index edf65baec06..00000000000
--- a/ui/tests/acceptance/oidc-config/clients-assignments-test.js
+++ /dev/null
@@ -1,353 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { visit, currentURL, click, fillIn, findAll, currentRouteName } from '@ember/test-helpers';
-import { setupApplicationTest } from 'ember-qunit';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import oidcConfigHandlers from 'vault/mirage/handlers/oidc-config';
-import authPage from 'vault/tests/pages/auth';
-import { create } from 'ember-cli-page-object';
-import { clickTrigger } from 'ember-power-select/test-support/helpers';
-import ss from 'vault/tests/pages/components/search-select';
-import fm from 'vault/tests/pages/components/flash-message';
-import {
-  OIDC_BASE_URL, // -> '/vault/access/oidc'
-  SELECTORS,
-  clearRecord,
-  overrideCapabilities,
-  overrideMirageResponse,
-  ASSIGNMENT_LIST_RESPONSE,
-  ASSIGNMENT_DATA_RESPONSE,
-} from 'vault/tests/helpers/oidc-config';
-const searchSelect = create(ss);
-const flashMessage = create(fm);
-
-module('Acceptance | oidc-config clients and assignments', function (hooks) {
-  setupApplicationTest(hooks);
-  setupMirage(hooks);
-
-  hooks.beforeEach(function () {
-    oidcConfigHandlers(this.server);
-    this.store = this.owner.lookup('service:store');
-    return authPage.login();
-  });
-
-  test('it renders only allow_all when no assignments are configured', async function (assert) {
-    assert.expect(3);
-
-    //* clear out test state
-    await clearRecord(this.store, 'oidc/assignment', 'test-assignment');
-
-    await visit(OIDC_BASE_URL + '/assignments');
-    assert.strictEqual(currentURL(), '/vault/access/oidc/assignments');
-    assert.dom('[data-test-tab="assignments"]').hasClass('active', 'assignments tab is active');
-    assert
-      .dom('[data-test-oidc-assignment-linked-block="allow_all"]')
-      .hasClass('is-disabled', 'renders default allow all assignment and is disabled.');
-  });
-
-  test('it renders empty state when no clients are configured', async function (assert) {
-    assert.expect(5);
-    this.server.get('/identity/oidc/client', () => overrideMirageResponse(404));
-
-    await visit(OIDC_BASE_URL);
-    assert.strictEqual(currentURL(), '/vault/access/oidc');
-    assert.dom('h1.title.is-3').hasText('OIDC Provider');
-    assert.dom(SELECTORS.oidcHeader).hasText(
-      `Configure Vault to act as an OIDC identity provider, and offer Vault’s various authentication
-    methods and source of identity to any client applications. Learn more Create your first app`,
-      'renders call to action header when no clients are configured'
-    );
-    assert.dom('[data-test-oidc-landing]').exists('landing page renders when no clients are configured');
-    assert
-      .dom(SELECTORS.oidcLandingImg)
-      .hasAttribute('src', '/ui/images/oidc-landing.png', 'image renders image when no clients configured');
-  });
-
-  test('it creates an assignment inline, creates a client, updates client to limit access, deletes client', async function (assert) {
-    assert.expect(21);
-
-    //* clear out test state
-    await clearRecord(this.store, 'oidc/client', 'test-app');
-    await clearRecord(this.store, 'oidc/client', 'my-webapp'); // created by oidc-provider-test
-    await clearRecord(this.store, 'oidc/assignment', 'assignment-inline');
-
-    // create a client with allow all access
-    await visit(OIDC_BASE_URL + '/clients/create');
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.clients.create',
-      'navigates to create form'
-    );
-    await fillIn('[data-test-input="name"]', 'test-app');
-    await click('[data-test-toggle-group="More options"]');
-    // toggle ttls to false, testing it sets correct default duration
-    await click('[data-test-input="idTokenTtl"]');
-    await click('[data-test-input="accessTokenTtl"]');
-    await click(SELECTORS.clientSaveButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Successfully created the application test-app.',
-      'renders success flash upon client creation'
-    );
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.clients.client.details',
-      'navigates to client details view after save'
-    );
-    // assert default values in details view are correct
-    assert.dom('[data-test-value-div="Assignment"]').hasText('allow_all', 'client allows all assignments');
-    assert.dom('[data-test-value-div="Type"]').hasText('confidential', 'type defaults to confidential');
-    assert
-      .dom('[data-test-value-div="Key"] a')
-      .hasText('default', 'client uses default key and renders a link');
-    assert
-      .dom('[data-test-value-div="Client ID"] [data-test-copy-button]')
-      .exists('client ID exists and has copy button');
-    assert
-      .dom('[data-test-value-div="Client Secret"] [data-test-copy-button]')
-      .exists('client secret exists and has copy button');
-    assert
-      .dom('[data-test-value-div="ID Token TTL"]')
-      .hasText('1 day', 'ID token ttl toggled off sets default of 24h');
-    assert
-      .dom('[data-test-value-div="Access Token TTL"]')
-      .hasText('1 day', 'access token ttl toggled off sets default of 24h');
-
-    // edit client
-    await click(SELECTORS.clientDetailsTab);
-    await click(SELECTORS.clientEditButton);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.clients.client.edit',
-      'navigates to edit page from details'
-    );
-    await fillIn('[data-test-input="redirectUris"] [data-test-string-list-input="0"]', 'some-url.com');
-
-    // limit access & create new assignment inline
-    await click('[data-test-oidc-radio="limited"]');
-    await clickTrigger();
-    await fillIn('.ember-power-select-search input', 'assignment-inline');
-    await searchSelect.options.objectAt(0).click();
-    await click('[data-test-search-select="entities"] .ember-basic-dropdown-trigger');
-    await searchSelect.options.objectAt(0).click();
-    await click('[data-test-search-select="groups"] .ember-basic-dropdown-trigger');
-    await searchSelect.options.objectAt(0).click();
-    await click(SELECTORS.assignmentSaveButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Successfully created the assignment assignment-inline.',
-      'renders success flash upon assignment creating'
-    );
-    await click(SELECTORS.clientSaveButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Successfully updated the application test-app.',
-      'renders success flash upon client updating'
-    );
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.clients.client.details',
-      'navigates back to details on update'
-    );
-    assert.dom('[data-test-value-div="Redirect URI"]').hasText('some-url.com', 'shows updated attribute');
-    assert
-      .dom('[data-test-value-div="Assignment"]')
-      .hasText('assignment-inline', 'updated to limited assignment');
-
-    // edit back to allow_all
-    await click(SELECTORS.clientEditButton);
-    assert.dom(SELECTORS.clientSaveButton).hasText('Update', 'form button renders correct text');
-    await click('[data-test-oidc-radio="allow-all"]');
-    await click(SELECTORS.clientSaveButton);
-    assert
-      .dom('[data-test-value-div="Assignment"]')
-      .hasText('allow_all', 'client updated to allow all assignments');
-
-    // create another client
-    await visit(OIDC_BASE_URL + '/clients/create');
-    await fillIn('[data-test-input="name"]', 'app-to-delete');
-    await click(SELECTORS.clientSaveButton);
-
-    // immediately delete client, test transition
-    await click(SELECTORS.clientDeleteButton);
-    await click(SELECTORS.confirmActionButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Application deleted successfully',
-      'renders success flash upon deleting client'
-    );
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.clients.index',
-      'navigates back to list view after delete'
-    );
-    // delete last client
-    await click('[data-test-oidc-client-linked-block]');
-    assert.strictEqual(currentRouteName(), 'vault.cluster.access.oidc.clients.client.details');
-    await click(SELECTORS.clientDeleteButton);
-    await click(SELECTORS.confirmActionButton);
-
-    //TODO this part of the test has a race condition
-    //because other tests could have created clients - there is no guarantee that this will be the last
-    //client in the list to redirect to the call to action
-    //assert.strictEqual(
-    //currentRouteName(),
-    //'vault.cluster.access.oidc.index',
-    //'redirects to call to action if only existing client is deleted'
-    //);
-
-    //* clean up test state
-    await clearRecord(this.store, 'oidc/assignment', 'assignment-inline');
-  });
-
-  test('it creates, updates, and deletes an assignment', async function (assert) {
-    assert.expect(14);
-    await visit(OIDC_BASE_URL + '/assignments');
-
-    //* ensure clean test state
-    await clearRecord(this.store, 'oidc/assignment', 'test-assignment');
-
-    // create a new assignment
-    await click(SELECTORS.assignmentCreateButton);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.assignments.create',
-      'navigates to create form'
-    );
-    assert.dom('[data-test-oidc-assignment-title]').hasText('Create Assignment', 'Form title renders');
-    await fillIn('[data-test-input="name"]', 'test-assignment');
-    await click('[data-test-component="search-select"]#entities .ember-basic-dropdown-trigger');
-    await click('.ember-power-select-option');
-    await click(SELECTORS.assignmentSaveButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Successfully created the assignment test-assignment.',
-      'renders success flash upon creating the assignment'
-    );
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.assignments.assignment.details',
-      'navigates to the assignments detail view after save'
-    );
-
-    // assert default values in assignment details view are correct
-    assert.dom('[data-test-value-div="Name"]').hasText('test-assignment');
-    assert.dom('[data-test-value-div="Entities"]').hasText('test-entity', 'shows the entity name.');
-
-    // edit assignment
-    await click(SELECTORS.assignmentEditButton);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.assignments.assignment.edit',
-      'navigates to the assignment edit page from details'
-    );
-    assert.dom('[data-test-oidc-assignment-title]').hasText('Edit Assignment', 'Form title renders');
-    await click('[data-test-component="search-select"]#groups .ember-basic-dropdown-trigger');
-    await click('.ember-power-select-option');
-    assert.dom('[data-test-oidc-assignment-save]').hasText('Update');
-    await click(SELECTORS.assignmentSaveButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Successfully updated the assignment test-assignment.',
-      'renders success flash upon updating the assignment'
-    );
-
-    assert.dom('[data-test-value-div="Entities"]').hasText('test-entity', 'it still shows the entity name.');
-    assert.dom('[data-test-value-div="Groups"]').hasText('test-group', 'shows updated group name id.');
-
-    // delete the assignment
-    await click(SELECTORS.assignmentDeleteButton);
-    await click(SELECTORS.confirmActionButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Assignment deleted successfully',
-      'renders success flash upon deleting assignment'
-    );
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.assignments.index',
-      'navigates back to assignment list view after delete'
-    );
-  });
-
-  test('it navigates to and from an assignment from the list view', async function (assert) {
-    assert.expect(6);
-    this.server.get('/identity/oidc/assignment', () =>
-      overrideMirageResponse(null, ASSIGNMENT_LIST_RESPONSE)
-    );
-    this.server.get('/identity/oidc/assignment/test-assignment', () =>
-      overrideMirageResponse(null, ASSIGNMENT_DATA_RESPONSE)
-    );
-    await visit(OIDC_BASE_URL + '/assignments');
-    assert
-      .dom('[data-test-oidc-assignment-linked-block="test-assignment"]')
-      .exists('displays linked block for test-assignment');
-
-    await click(SELECTORS.assignmentCreateButton);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.assignments.create',
-      'assignments index toolbar navigates to create form'
-    );
-    await click(SELECTORS.assignmentCancelButton);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.assignments.index',
-      'create form navigates back to assignment index on cancel'
-    );
-
-    await click('[data-test-popup-menu-trigger]');
-    await click('[data-test-oidc-assignment-menu-link="edit"]');
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.assignments.assignment.edit',
-      'linked block popup menu navigates to edit'
-    );
-    await click(SELECTORS.assignmentCancelButton);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.assignments.assignment.details',
-      'edit form navigates back to assignment details on cancel'
-    );
-    // navigate to details from index page
-    await visit('/vault/access/oidc/assignments');
-    await click('[data-test-popup-menu-trigger]');
-    await click('[data-test-oidc-assignment-menu-link="details"]');
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.assignments.assignment.details',
-      'popup menu navigates to assignment details'
-    );
-  });
-
-  test('it hides assignment delete and edit when no permission', async function (assert) {
-    assert.expect(5);
-    this.server.get('/identity/oidc/assignment', () =>
-      overrideMirageResponse(null, ASSIGNMENT_LIST_RESPONSE)
-    );
-    this.server.get('/identity/oidc/assignment/test-assignment', () =>
-      overrideMirageResponse(null, ASSIGNMENT_DATA_RESPONSE)
-    );
-    this.server.post('/sys/capabilities-self', () =>
-      overrideCapabilities(OIDC_BASE_URL + '/assignment/test-assignment', ['read'])
-    );
-
-    await visit(OIDC_BASE_URL + '/assignments');
-    await click('[data-test-oidc-assignment-linked-block="test-assignment"]');
-    assert
-      .dom('[data-test-oidc-assignment-title]')
-      .hasText('test-assignment', 'renders assignment name as title');
-    assert.dom(SELECTORS.assignmentDetailsTab).hasClass('active', 'details tab is active');
-    assert.dom(SELECTORS.assignmentDeleteButton).doesNotExist('delete option is hidden');
-    assert.dom(SELECTORS.assignmentEditButton).doesNotExist('edit button is hidden');
-    assert.strictEqual(
-      findAll('[data-test-component="info-table-row"]').length,
-      3,
-      'renders all assignment info rows'
-    );
-  });
-});
diff --git a/ui/tests/acceptance/oidc-config/clients-keys-test.js b/ui/tests/acceptance/oidc-config/clients-keys-test.js
deleted file mode 100644
index 7a37f8c6a9e..00000000000
--- a/ui/tests/acceptance/oidc-config/clients-keys-test.js
+++ /dev/null
@@ -1,306 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { visit, click, fillIn, findAll, currentRouteName } from '@ember/test-helpers';
-import { setupApplicationTest } from 'ember-qunit';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import oidcConfigHandlers from 'vault/mirage/handlers/oidc-config';
-import authPage from 'vault/tests/pages/auth';
-import { create } from 'ember-cli-page-object';
-import { clickTrigger, selectChoose } from 'ember-power-select/test-support/helpers';
-import ss from 'vault/tests/pages/components/search-select';
-import fm from 'vault/tests/pages/components/flash-message';
-import {
-  OIDC_BASE_URL, // -> '/vault/access/oidc'
-  SELECTORS,
-  clearRecord,
-  overrideCapabilities,
-  overrideMirageResponse,
-  CLIENT_LIST_RESPONSE,
-  CLIENT_DATA_RESPONSE,
-} from 'vault/tests/helpers/oidc-config';
-const searchSelect = create(ss);
-const flashMessage = create(fm);
-
-// in congruency with backend verbiage 'applications' are referred to as 'clients'
-// throughout the codebase and the term 'applications' only appears in the UI
-
-module('Acceptance | oidc-config clients and keys', function (hooks) {
-  setupApplicationTest(hooks);
-  setupMirage(hooks);
-
-  hooks.beforeEach(function () {
-    oidcConfigHandlers(this.server);
-    this.store = this.owner.lookup('service:store');
-    return authPage.login();
-  });
-
-  test('it creates a key, signs a client and edits key access to only that client', async function (assert) {
-    assert.expect(21);
-
-    //* start with clean test state
-    await clearRecord(this.store, 'oidc/client', 'client-with-test-key');
-    await clearRecord(this.store, 'oidc/client', 'client-with-default-key');
-    await clearRecord(this.store, 'oidc/key', 'test-key');
-
-    // create client with default key
-    await visit(OIDC_BASE_URL + '/clients/create');
-    await fillIn('[data-test-input="name"]', 'client-with-default-key');
-    await click(SELECTORS.clientSaveButton);
-
-    // check reroutes from oidc index to clients index when client exists
-    await visit(OIDC_BASE_URL);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.clients.index',
-      'redirects to clients index route when clients exist'
-    );
-    assert.dom('[data-test-tab="clients"]').hasClass('active', 'clients tab is active');
-    assert
-      .dom('[data-test-oidc-client-linked-block]')
-      .hasTextContaining('client-with-default-key', 'displays linked block for client');
-
-    // navigate to keys
-    await click('[data-test-tab="keys"]');
-    assert.dom('[data-test-tab="keys"]').hasClass('active', 'keys tab is active');
-    assert.strictEqual(currentRouteName(), 'vault.cluster.access.oidc.keys.index');
-    assert
-      .dom('[data-test-oidc-key-linked-block="default"]')
-      .hasText('default', 'index page lists default key');
-
-    // navigate to default key details from pop-up menu
-    await click('[data-test-popup-menu-trigger]');
-    await click('[data-test-oidc-key-menu-link="details"]');
-    assert.dom(SELECTORS.keyDeleteButton).doesNotExist('delete button is hidden for default key');
-    await click(SELECTORS.keyEditButton);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.keys.key.edit',
-      'navigates to edit from key details'
-    );
-    await click(SELECTORS.keyCancelButton);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.keys.key.details',
-      'key edit form navigates back to details on cancel'
-    );
-    await click(SELECTORS.keyClientsTab);
-    assert
-      .dom('[data-test-oidc-client-linked-block="client-with-default-key"]')
-      .exists('lists correct app with default');
-
-    // create a new key
-    await click('[data-test-breadcrumb-link="oidc-keys"] a');
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.keys.index',
-      'keys breadcrumb navigates back to list view'
-    );
-    await click('[data-test-oidc-key-create]');
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.keys.create',
-      'navigates to key create form'
-    );
-    await fillIn('[data-test-input="name"]', 'test-key');
-    await click(SELECTORS.keySaveButton);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.keys.key.details',
-      'navigates to key details after save'
-    );
-
-    // create client with test-key
-    await visit(OIDC_BASE_URL + '/clients');
-    await click('[data-test-oidc-client-create]');
-    await fillIn('[data-test-input="name"]', 'client-with-test-key');
-    await click('[data-test-toggle-group="More options"]');
-    await click('[data-test-component="search-select"] [data-test-icon="trash"]');
-    await clickTrigger('#key');
-    await selectChoose('[data-test-component="search-select"]#key', 'test-key');
-    await click(SELECTORS.clientSaveButton);
-
-    // edit key and limit applications
-    await visit(OIDC_BASE_URL + '/keys');
-    await click('[data-test-oidc-key-linked-block="test-key"] [data-test-popup-menu-trigger]');
-    await click('[data-test-oidc-key-menu-link="edit"]');
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.keys.key.edit',
-      'key linked block popup menu navigates to edit'
-    );
-    await click('[data-test-oidc-radio="limited"]');
-    await clickTrigger();
-    assert.strictEqual(searchSelect.options.length, 1, 'dropdown has only application that uses this key');
-    assert
-      .dom('.ember-power-select-option')
-      .hasTextContaining('client-with-test-key', 'dropdown renders correct application');
-    await searchSelect.options.objectAt(0).click();
-    await click(SELECTORS.keySaveButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Successfully updated the key test-key.',
-      'renders success flash upon key updating'
-    );
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.keys.key.details',
-      'navigates back to details on update'
-    );
-    await click(SELECTORS.keyClientsTab);
-    assert
-      .dom('[data-test-oidc-client-linked-block="client-with-test-key"]')
-      .exists('lists client-with-test-key');
-    assert.strictEqual(findAll('[data-test-oidc-client-linked-block]').length, 1, 'it lists only one client');
-
-    // edit back to allow all
-    await click(SELECTORS.keyDetailsTab);
-    await click(SELECTORS.keyEditButton);
-    await click('[data-test-oidc-radio="allow-all"]');
-    await click(SELECTORS.keySaveButton);
-    await click(SELECTORS.keyClientsTab);
-    assert.notEqual(
-      findAll('[data-test-oidc-client-linked-block]').length,
-      1,
-      'more than one client appears in key applications tab'
-    );
-
-    //* clean up test state
-    await clearRecord(this.store, 'oidc/client', 'client-with-test-key');
-    await clearRecord(this.store, 'oidc/client', 'client-with-default-key');
-    await clearRecord(this.store, 'oidc/key', 'test-key');
-  });
-
-  test('it creates, rotates and deletes a key', async function (assert) {
-    assert.expect(10);
-    // mock client list so OIDC url does not redirect to landing page
-    this.server.get('/identity/oidc/client', () => overrideMirageResponse(null, CLIENT_LIST_RESPONSE));
-    this.server.post('/identity/oidc/key/test-key/rotate', (schema, req) => {
-      const json = JSON.parse(req.requestBody);
-      assert.strictEqual(json.verification_ttl, 86400, 'request made with correct args to accurate endpoint');
-    });
-
-    //* clear out test state
-    await clearRecord(this.store, 'oidc/key', 'test-key');
-
-    // create a new key
-    await visit(OIDC_BASE_URL + '/keys/create');
-    await fillIn('[data-test-input="name"]', 'test-key');
-    // toggle ttls to false, testing it sets correct default duration
-    await click('[data-test-input="rotationPeriod"]');
-    await click('[data-test-input="verificationTtl"]');
-    assert
-      .dom('[data-test-oidc-radio="limited"] input')
-      .isDisabled('limiting access radio button is disabled on create');
-    assert
-      .dom('[data-test-oidc-radio="limited"]')
-      .hasClass('is-disabled', 'limited radio button label has disabled class');
-    await click(SELECTORS.keySaveButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Successfully created the key test-key.',
-      'renders success flash upon key creation'
-    );
-
-    // assert default values in details view are correct
-    assert.dom('[data-test-value-div="Algorithm"]').hasText('RS256', 'defaults to RS526 algorithm');
-    assert
-      .dom('[data-test-value-div="Rotation period"]')
-      .hasText('1 day', 'when toggled off rotation period defaults to 1 day');
-    assert
-      .dom('[data-test-value-div="Verification TTL"]')
-      .hasText('1 day', 'when toggled off verification ttl defaults to 1 day');
-
-    // rotate key
-    await click(SELECTORS.keyDetailsTab);
-    await click(SELECTORS.keyRotateButton);
-    await click(SELECTORS.confirmActionButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Success: test-key connection was rotated.',
-      'renders success flash upon key rotation'
-    );
-    // delete
-    await click(SELECTORS.keyDeleteButton);
-    await click(SELECTORS.confirmActionButton);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'Key deleted successfully',
-      'success flash message renders after deleting key'
-    );
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.keys.index',
-      'navigates back to list view after delete'
-    );
-  });
-
-  test('it renders client details and providers', async function (assert) {
-    assert.expect(8);
-    this.server.get('/identity/oidc/client', () => overrideMirageResponse(null, CLIENT_LIST_RESPONSE));
-    this.server.get('/identity/oidc/client/test-app', () =>
-      overrideMirageResponse(null, CLIENT_DATA_RESPONSE)
-    );
-    await visit(OIDC_BASE_URL);
-    await click('[data-test-oidc-client-linked-block]');
-    assert.dom('[data-test-oidc-client-header]').hasText('test-app', 'renders application name as title');
-    assert.dom(SELECTORS.clientDetailsTab).hasClass('active', 'details tab is active');
-    assert.dom(SELECTORS.clientDeleteButton).exists('toolbar renders delete option');
-    assert.dom(SELECTORS.clientEditButton).exists('toolbar renders edit button');
-    assert.strictEqual(findAll('[data-test-component="info-table-row"]').length, 9, 'renders all info rows');
-
-    await click(SELECTORS.clientProvidersTab);
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.access.oidc.clients.client.providers',
-      'navigates to client providers route'
-    );
-    assert.dom(SELECTORS.clientProvidersTab).hasClass('active', 'providers tab is active');
-    assert.dom('[data-test-oidc-provider-linked-block="default"]').exists('lists default provider');
-  });
-
-  test('it hides delete and edit client when no permission', async function (assert) {
-    assert.expect(5);
-    this.server.get('/identity/oidc/client', () => overrideMirageResponse(null, CLIENT_LIST_RESPONSE));
-    this.server.get('/identity/oidc/client/test-app', () =>
-      overrideMirageResponse(null, CLIENT_DATA_RESPONSE)
-    );
-    this.server.post('/sys/capabilities-self', () =>
-      overrideCapabilities(OIDC_BASE_URL + '/client/test-app', ['read'])
-    );
-
-    await visit(OIDC_BASE_URL);
-    await click('[data-test-oidc-client-linked-block]');
-    assert.dom('[data-test-oidc-client-header]').hasText('test-app', 'renders application name as title');
-    assert.dom(SELECTORS.clientDetailsTab).hasClass('active', 'details tab is active');
-    assert.dom(SELECTORS.clientDeleteButton).doesNotExist('delete option is hidden');
-    assert.dom(SELECTORS.clientEditButton).doesNotExist('edit button is hidden');
-    assert.strictEqual(findAll('[data-test-component="info-table-row"]').length, 9, 'renders all info rows');
-  });
-
-  test('it hides delete and edit key when no permission', async function (assert) {
-    assert.expect(4);
-    this.server.get('/identity/oidc/keys', () => overrideMirageResponse(null, { keys: ['test-key'] }));
-    this.server.get('/identity/oidc/key/test-key', () =>
-      overrideMirageResponse(null, {
-        algorithm: 'RS256',
-        allowed_client_ids: ['*'],
-        rotation_period: 86400,
-        verification_ttl: 86400,
-      })
-    );
-    this.server.post('/sys/capabilities-self', () =>
-      overrideCapabilities(OIDC_BASE_URL + '/key/test-key', ['read'])
-    );
-
-    await visit(OIDC_BASE_URL + '/keys');
-    await click('[data-test-oidc-key-linked-block]');
-    assert.dom(SELECTORS.keyDetailsTab).hasClass('active', 'details tab is active');
-    assert.dom(SELECTORS.keyDeleteButton).doesNotExist('delete option is hidden');
-    assert.dom(SELECTORS.keyEditButton).doesNotExist('edit button is hidden');
-    assert.strictEqual(findAll('[data-test-component="info-table-row"]').length, 4, 'renders all info rows');
-  });
-});
diff --git a/ui/tests/acceptance/oidc-config/clients-test.js b/ui/tests/acceptance/oidc-config/clients-test.js
new file mode 100644
index 00000000000..cbb7418b3a5
--- /dev/null
+++ b/ui/tests/acceptance/oidc-config/clients-test.js
@@ -0,0 +1,654 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { visit, click, fillIn, findAll, currentRouteName, currentURL } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import oidcConfigHandlers from 'vault/mirage/handlers/oidc-config';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { create } from 'ember-cli-page-object';
+import { clickTrigger } from 'ember-power-select/test-support/helpers';
+import { selectChoose } from 'ember-power-select/test-support';
+import ss from 'vault/tests/pages/components/search-select';
+import fm from 'vault/tests/pages/components/flash-message';
+import {
+  OIDC_BASE_URL, // -> '/vault/access/oidc'
+  SELECTORS,
+  clearRecord,
+  CLIENT_LIST_RESPONSE,
+  CLIENT_DATA_RESPONSE,
+  ASSIGNMENT_LIST_RESPONSE,
+  ASSIGNMENT_DATA_RESPONSE,
+} from 'vault/tests/helpers/oidc-config';
+import { capabilitiesStub, overrideResponse } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+const searchSelect = create(ss);
+const flashMessage = create(fm);
+
+// in congruency with backend verbiage 'applications' are referred to as 'clients'
+// throughout the codebase and the term 'applications' only appears in the UI
+
+module('Acceptance | oidc-config clients', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    oidcConfigHandlers(this.server);
+    this.store = this.owner.lookup('service:store');
+    return login();
+  });
+
+  module('keys', function () {
+    test('it creates a key, signs a client and edits key access to only that client', async function (assert) {
+      assert.expect(21);
+
+      //* start with clean test state
+      await clearRecord(this.store, 'oidc/client', 'client-with-test-key');
+      await clearRecord(this.store, 'oidc/client', 'client-with-default-key');
+      await clearRecord(this.store, 'oidc/key', 'test-key');
+
+      // create client with default key
+      await visit(OIDC_BASE_URL + '/clients/create');
+      await fillIn('[data-test-input="name"]', 'client-with-default-key');
+      await click(SELECTORS.clientSaveButton);
+
+      // check reroutes from oidc index to clients index when client exists
+      await visit(OIDC_BASE_URL);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.clients.index',
+        'redirects to clients index route when clients exist'
+      );
+      assert.dom('[data-test-tab="clients"]').hasClass('active', 'clients tab is active');
+      assert
+        .dom('[data-test-oidc-client-linked-block]')
+        .hasTextContaining('client-with-default-key', 'displays linked block for client');
+
+      // navigate to keys
+      await click('[data-test-tab="keys"]');
+      assert.dom('[data-test-tab="keys"]').hasClass('active', 'keys tab is active');
+      assert.strictEqual(currentRouteName(), 'vault.cluster.access.oidc.keys.index');
+      assert
+        .dom('[data-test-oidc-key-linked-block="default"] [data-test-item]')
+        .hasText('default', 'index page lists default key');
+
+      // navigate to default key details from pop-up menu
+      await click(GENERAL.menuTrigger);
+      await click('[data-test-oidc-key-menu-link="details"]');
+      assert.dom(SELECTORS.keyDeleteButton).doesNotExist('delete button is hidden for default key');
+      await click(SELECTORS.keyEditButton);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.keys.key.edit',
+        'navigates to edit from key details'
+      );
+      await click(SELECTORS.keyCancelButton);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.keys.key.details',
+        'key edit form navigates back to details on cancel'
+      );
+      await click(SELECTORS.keyClientsTab);
+      assert.strictEqual(
+        currentURL(),
+        '/vault/access/oidc/keys/default/clients',
+        'navigates to key applications list '
+      );
+
+      // create a new key
+      await click('[data-test-breadcrumb-link="oidc-keys"] a');
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.keys.index',
+        'keys breadcrumb navigates back to list view'
+      );
+      await click('[data-test-oidc-key-create]');
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.keys.create',
+        'navigates to key create form'
+      );
+      await fillIn('[data-test-input="name"]', 'test-key');
+      await click(SELECTORS.keySaveButton);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.keys.key.details',
+        'navigates to key details after save'
+      );
+
+      // create client with test-key
+      await visit(OIDC_BASE_URL + '/clients');
+      await click('[data-test-oidc-client-create]');
+      await fillIn('[data-test-input="name"]', 'client-with-test-key');
+      await click(GENERAL.button('More options'));
+      await click('[data-test-component="search-select"] [data-test-icon="trash"]');
+      await clickTrigger('#key');
+      await selectChoose('[data-test-component="search-select"]#key', 'test-key');
+      await click(SELECTORS.clientSaveButton);
+
+      // edit key and limit applications
+      await visit(OIDC_BASE_URL + '/keys');
+      await click('[data-test-oidc-key-linked-block="test-key"] [data-test-popup-menu-trigger]');
+      await click('[data-test-oidc-key-linked-block="test-key"] [data-test-oidc-key-menu-link="edit"]');
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.keys.key.edit',
+        'key linked block popup menu navigates to edit'
+      );
+      await click('[data-test-oidc-radio="limited"]');
+      await clickTrigger();
+      assert.strictEqual(searchSelect.options.length, 1, 'dropdown has only application that uses this key');
+      assert
+        .dom('.ember-power-select-option')
+        .hasTextContaining('client-with-test-key', 'dropdown renders correct application');
+      await searchSelect.options.objectAt(0).click();
+      await click(SELECTORS.keySaveButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Successfully updated the key test-key.',
+        'renders success flash upon key updating'
+      );
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.keys.key.details',
+        'navigates back to details on update'
+      );
+      await click(SELECTORS.keyClientsTab);
+      assert
+        .dom('[data-test-oidc-client-linked-block="client-with-test-key"]')
+        .exists('lists client-with-test-key');
+      assert.strictEqual(
+        findAll('[data-test-oidc-client-linked-block]').length,
+        1,
+        'it lists only one client'
+      );
+
+      // edit back to allow all
+      await click(SELECTORS.keyDetailsTab);
+      await click(SELECTORS.keyEditButton);
+      await click('[data-test-oidc-radio="allow-all"]');
+      await click(SELECTORS.keySaveButton);
+      await click(SELECTORS.keyClientsTab);
+      assert.notEqual(
+        findAll('[data-test-oidc-client-linked-block]').length,
+        1,
+        'more than one client appears in key applications tab'
+      );
+
+      //* clean up test state
+      await clearRecord(this.store, 'oidc/client', 'client-with-test-key');
+      await clearRecord(this.store, 'oidc/client', 'client-with-default-key');
+      await clearRecord(this.store, 'oidc/key', 'test-key');
+    });
+
+    test('it creates, rotates and deletes a key', async function (assert) {
+      assert.expect(10);
+      // mock client list so OIDC url does not redirect to landing page
+      this.server.get('/identity/oidc/client', () => overrideResponse(null, { data: CLIENT_LIST_RESPONSE }));
+      this.server.post('/identity/oidc/key/test-key/rotate', (schema, req) => {
+        const json = JSON.parse(req.requestBody);
+        assert.strictEqual(
+          json.verification_ttl,
+          86400,
+          'request made with correct args to accurate endpoint'
+        );
+      });
+
+      //* clear out test state
+      await clearRecord(this.store, 'oidc/key', 'test-key');
+
+      // create a new key
+      await visit(OIDC_BASE_URL + '/keys/create');
+      await fillIn('[data-test-input="name"]', 'test-key');
+      // toggle ttls to false, testing it sets correct default duration
+      await click('[data-test-input="rotationPeriod"]');
+      await click('[data-test-input="verificationTtl"]');
+      assert
+        .dom('[data-test-oidc-radio="limited"] input')
+        .isDisabled('limiting access radio button is disabled on create');
+      assert
+        .dom('[data-test-oidc-radio="limited"]')
+        .hasClass('is-disabled', 'limited radio button label has disabled class');
+      await click(SELECTORS.keySaveButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Successfully created the key test-key.',
+        'renders success flash upon key creation'
+      );
+
+      // assert default values in details view are correct
+      assert.dom(GENERAL.infoRowValue('Algorithm')).hasText('RS256', 'defaults to RS526 algorithm');
+      assert
+        .dom(GENERAL.infoRowValue('Rotation period'))
+        .hasText('1 day', 'when toggled off rotation period defaults to 1 day');
+      assert
+        .dom(GENERAL.infoRowValue('Verification TTL'))
+        .hasText('1 day', 'when toggled off verification ttl defaults to 1 day');
+
+      // rotate key
+      await click(SELECTORS.keyDetailsTab);
+      await click(SELECTORS.keyRotateButton);
+      await click(GENERAL.confirmButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Success: test-key connection was rotated.',
+        'renders success flash upon key rotation'
+      );
+      // delete
+      await click(SELECTORS.keyDeleteButton);
+      await click(GENERAL.confirmButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Key deleted successfully',
+        'success flash message renders after deleting key'
+      );
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.keys.index',
+        'navigates back to list view after delete'
+      );
+    });
+
+    test('it renders client details and providers', async function (assert) {
+      assert.expect(8);
+      this.server.get('/identity/oidc/client', () => overrideResponse(null, { data: CLIENT_LIST_RESPONSE }));
+      this.server.get('/identity/oidc/client/test-app', () =>
+        overrideResponse(null, { data: CLIENT_DATA_RESPONSE })
+      );
+      await visit(OIDC_BASE_URL);
+      await click('[data-test-oidc-client-linked-block]');
+      assert.dom('[data-test-oidc-client-header]').hasText('test-app', 'renders application name as title');
+      assert.dom(SELECTORS.clientDetailsTab).hasClass('active', 'details tab is active');
+      assert.dom(SELECTORS.clientDeleteButton).exists('toolbar renders delete option');
+      assert.dom(SELECTORS.clientEditButton).exists('toolbar renders edit button');
+      assert.strictEqual(
+        findAll('[data-test-component="info-table-row"]').length,
+        9,
+        'renders all info rows'
+      );
+
+      await click(SELECTORS.clientProvidersTab);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.clients.client.providers',
+        'navigates to client providers route'
+      );
+      assert.dom(SELECTORS.clientProvidersTab).hasClass('active', 'providers tab is active');
+      assert.dom('[data-test-oidc-provider-linked-block="default"]').exists('lists default provider');
+    });
+
+    test('it hides delete and edit client when no permission', async function (assert) {
+      assert.expect(5);
+      this.server.get('/identity/oidc/client', () => overrideResponse(null, { data: CLIENT_LIST_RESPONSE }));
+      this.server.get('/identity/oidc/client/test-app', () =>
+        overrideResponse(null, { data: CLIENT_DATA_RESPONSE })
+      );
+      this.server.post('/sys/capabilities-self', () =>
+        capabilitiesStub(OIDC_BASE_URL + '/client/test-app', ['read'])
+      );
+
+      await visit(OIDC_BASE_URL);
+      await click('[data-test-oidc-client-linked-block]');
+      assert.dom('[data-test-oidc-client-header]').hasText('test-app', 'renders application name as title');
+      assert.dom(SELECTORS.clientDetailsTab).hasClass('active', 'details tab is active');
+      assert.dom(SELECTORS.clientDeleteButton).doesNotExist('delete option is hidden');
+      assert.dom(SELECTORS.clientEditButton).doesNotExist('edit button is hidden');
+      assert.strictEqual(
+        findAll('[data-test-component="info-table-row"]').length,
+        9,
+        'renders all info rows'
+      );
+    });
+
+    test('it hides delete and edit key when no permission', async function (assert) {
+      assert.expect(4);
+      this.server.get('/identity/oidc/keys', () => overrideResponse(null, { data: { keys: ['test-key'] } }));
+      this.server.get('/identity/oidc/key/test-key', () =>
+        overrideResponse(null, {
+          data: {
+            algorithm: 'RS256',
+            allowed_client_ids: ['*'],
+            rotation_period: 86400,
+            verification_ttl: 86400,
+          },
+        })
+      );
+      this.server.post('/sys/capabilities-self', () =>
+        capabilitiesStub(OIDC_BASE_URL + '/key/test-key', ['read'])
+      );
+
+      await visit(OIDC_BASE_URL + '/keys');
+      await click('[data-test-oidc-key-linked-block]');
+      assert.dom(SELECTORS.keyDetailsTab).hasClass('active', 'details tab is active');
+      assert.dom(SELECTORS.keyDeleteButton).doesNotExist('delete option is hidden');
+      assert.dom(SELECTORS.keyEditButton).doesNotExist('edit button is hidden');
+      assert.strictEqual(
+        findAll('[data-test-component="info-table-row"]').length,
+        4,
+        'renders all info rows'
+      );
+    });
+  });
+
+  module('assignments', function () {
+    test('it renders only allow_all when no assignments are configured', async function (assert) {
+      assert.expect(3);
+
+      //* clear out test state
+      await clearRecord(this.store, 'oidc/assignment', 'test-assignment');
+
+      await visit(OIDC_BASE_URL + '/assignments');
+      assert.strictEqual(currentURL(), '/vault/access/oidc/assignments');
+      assert.dom('[data-test-tab="assignments"]').hasClass('active', 'assignments tab is active');
+      assert
+        .dom('[data-test-oidc-assignment-linked-block="allow_all"]')
+        .hasClass('is-disabled', 'renders default allow all assignment and is disabled.');
+    });
+
+    test('it renders empty state when no clients are configured', async function (assert) {
+      assert.expect(5);
+      this.server.get('/identity/oidc/client', () => overrideResponse(404));
+
+      await visit(OIDC_BASE_URL);
+      assert.strictEqual(currentURL(), '/vault/access/oidc');
+      assert.dom('h1.title.is-3').hasText('OIDC Provider');
+      assert.dom(SELECTORS.oidcHeader).hasText(
+        `Configure Vault to act as an OIDC identity provider, and offer Vault’s various authentication
+      methods and source of identity to any client applications. Learn more Create your first app`,
+        'renders call to action header when no clients are configured'
+      );
+      assert.dom('[data-test-oidc-landing]').exists('landing page renders when no clients are configured');
+      assert
+        .dom(SELECTORS.oidcLandingImg)
+        .hasAttribute('src', '/ui/images/oidc-landing.png', 'image renders image when no clients configured');
+    });
+
+    test('it creates an assignment inline, creates a client, updates client to limit access, deletes client', async function (assert) {
+      assert.expect(21);
+
+      //* clear out test state
+      await clearRecord(this.store, 'oidc/client', 'test-app');
+      await clearRecord(this.store, 'oidc/client', 'my-webapp'); // created by oidc-provider-test
+      await clearRecord(this.store, 'oidc/assignment', 'assignment-inline');
+
+      // create a client with allow all access
+      await visit(OIDC_BASE_URL + '/clients/create');
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.clients.create',
+        'navigates to create form'
+      );
+      await fillIn('[data-test-input="name"]', 'test-app');
+      await click(GENERAL.button('More options'));
+      // toggle ttls to false, testing it sets correct default duration
+      await click('[data-test-input="idTokenTtl"]');
+      await click('[data-test-input="accessTokenTtl"]');
+      await click(SELECTORS.clientSaveButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Successfully created the application test-app.',
+        'renders success flash upon client creation'
+      );
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.clients.client.details',
+        'navigates to client details view after save'
+      );
+      // assert default values in details view are correct
+      assert.dom(GENERAL.infoRowValue('Assignment')).hasText('allow_all', 'client allows all assignments');
+      assert.dom(GENERAL.infoRowValue('Type')).hasText('confidential', 'type defaults to confidential');
+      assert
+        .dom(`${GENERAL.infoRowValue('Key')} a`)
+        .hasText('default', 'client uses default key and renders a link');
+      assert
+        .dom(`${GENERAL.infoRowValue('Client ID')} ${GENERAL.copyButton}`)
+        .exists('client ID exists and has copy button');
+      assert
+        .dom(`${GENERAL.infoRowValue('Client Secret')} ${GENERAL.copyButton}`)
+        .exists('client secret exists and has copy button');
+      assert
+        .dom(GENERAL.infoRowValue('ID Token TTL'))
+        .hasText('1 day', 'ID token ttl toggled off sets default of 24h');
+      assert
+        .dom(GENERAL.infoRowValue('Access Token TTL'))
+        .hasText('1 day', 'access token ttl toggled off sets default of 24h');
+
+      // edit client
+      await click(SELECTORS.clientDetailsTab);
+      await click(SELECTORS.clientEditButton);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.clients.client.edit',
+        'navigates to edit page from details'
+      );
+      await fillIn('[data-test-input="redirectUris"] [data-test-string-list-input="0"]', 'some-url.com');
+
+      // limit access & create new assignment inline
+      await click('[data-test-oidc-radio="limited"]');
+      await clickTrigger();
+      await fillIn('.ember-power-select-search input', 'assignment-inline');
+      await searchSelect.options.objectAt(0).click();
+      await click('[data-test-search-select="entities"] .ember-basic-dropdown-trigger');
+      await searchSelect.options.objectAt(0).click();
+      await click('[data-test-search-select="groups"] .ember-basic-dropdown-trigger');
+      await searchSelect.options.objectAt(0).click();
+      await click(SELECTORS.assignmentSaveButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Successfully created the assignment assignment-inline.',
+        'renders success flash upon assignment creating'
+      );
+      await click(SELECTORS.clientSaveButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Successfully updated the application test-app.',
+        'renders success flash upon client updating'
+      );
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.clients.client.details',
+        'navigates back to details on update'
+      );
+      assert.dom(GENERAL.infoRowValue('Redirect URI')).hasText('some-url.com', 'shows updated attribute');
+      assert
+        .dom(GENERAL.infoRowValue('Assignment'))
+        .hasText('assignment-inline', 'updated to limited assignment');
+
+      // edit back to allow_all
+      await click(SELECTORS.clientEditButton);
+      assert.dom(SELECTORS.clientSaveButton).hasText('Update', 'form button renders correct text');
+      await click('[data-test-oidc-radio="allow-all"]');
+      await click(SELECTORS.clientSaveButton);
+      assert
+        .dom(GENERAL.infoRowValue('Assignment'))
+        .hasText('allow_all', 'client updated to allow all assignments');
+
+      // create another client
+      await visit(OIDC_BASE_URL + '/clients/create');
+      await fillIn('[data-test-input="name"]', 'app-to-delete');
+      await click(SELECTORS.clientSaveButton);
+
+      // immediately delete client, test transition
+      await click(SELECTORS.clientDeleteButton);
+      await click(GENERAL.confirmButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Application deleted successfully',
+        'renders success flash upon deleting client'
+      );
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.clients.index',
+        'navigates back to list view after delete'
+      );
+      // delete last client
+      await click('[data-test-oidc-client-linked-block]');
+      assert.strictEqual(currentRouteName(), 'vault.cluster.access.oidc.clients.client.details');
+      await click(SELECTORS.clientDeleteButton);
+      await click(GENERAL.confirmButton);
+
+      //TODO this part of the test has a race condition
+      //because other tests could have created clients - there is no guarantee that this will be the last
+      //client in the list to redirect to the call to action
+      //assert.strictEqual(
+      //currentRouteName(),
+      //'vault.cluster.access.oidc.index',
+      //'redirects to call to action if only existing client is deleted'
+      //);
+
+      //* clean up test state
+      await clearRecord(this.store, 'oidc/assignment', 'assignment-inline');
+    });
+
+    test('it creates, updates, and deletes an assignment', async function (assert) {
+      assert.expect(14);
+      await visit(OIDC_BASE_URL + '/assignments');
+
+      //* ensure clean test state
+      await clearRecord(this.store, 'oidc/assignment', 'test-assignment');
+
+      // create a new assignment
+      await click(SELECTORS.assignmentCreateButton);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.assignments.create',
+        'navigates to create form'
+      );
+      assert.dom('[data-test-oidc-assignment-title]').hasText('Create Assignment', 'Form title renders');
+      await fillIn('[data-test-input="name"]', 'test-assignment');
+      await click('[data-test-component="search-select"]#entities .ember-basic-dropdown-trigger');
+      await click('.ember-power-select-option');
+      await click(SELECTORS.assignmentSaveButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Successfully created the assignment test-assignment.',
+        'renders success flash upon creating the assignment'
+      );
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.assignments.assignment.details',
+        'navigates to the assignments detail view after save'
+      );
+
+      // assert default values in assignment details view are correct
+      assert.dom(GENERAL.infoRowValue('Name')).hasText('test-assignment');
+      assert.dom(GENERAL.infoRowValue('Entities')).hasText('test-entity', 'shows the entity name.');
+
+      // edit assignment
+      await click(SELECTORS.assignmentEditButton);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.assignments.assignment.edit',
+        'navigates to the assignment edit page from details'
+      );
+      assert.dom('[data-test-oidc-assignment-title]').hasText('Edit Assignment', 'Form title renders');
+      await click('[data-test-component="search-select"]#groups .ember-basic-dropdown-trigger');
+      await click('.ember-power-select-option');
+      assert.dom('[data-test-oidc-assignment-save]').hasText('Update');
+      await click(SELECTORS.assignmentSaveButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Successfully updated the assignment test-assignment.',
+        'renders success flash upon updating the assignment'
+      );
+
+      assert.dom(GENERAL.infoRowValue('Entities')).hasText('test-entity', 'it still shows the entity name.');
+      assert.dom(GENERAL.infoRowValue('Groups')).hasText('test-group', 'shows updated group name id.');
+
+      // delete the assignment
+      await click(SELECTORS.assignmentDeleteButton);
+      await click(GENERAL.confirmButton);
+      assert.strictEqual(
+        flashMessage.latestMessage,
+        'Assignment deleted successfully',
+        'renders success flash upon deleting assignment'
+      );
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.assignments.index',
+        'navigates back to assignment list view after delete'
+      );
+    });
+
+    test('it navigates to and from an assignment from the list view', async function (assert) {
+      assert.expect(6);
+      this.server.get('/identity/oidc/assignment', () =>
+        overrideResponse(200, { data: ASSIGNMENT_LIST_RESPONSE })
+      );
+      this.server.get('/identity/oidc/assignment/test-assignment', () =>
+        overrideResponse(200, { data: ASSIGNMENT_DATA_RESPONSE })
+      );
+      await visit(OIDC_BASE_URL + '/assignments');
+      assert
+        .dom('[data-test-oidc-assignment-linked-block="test-assignment"]')
+        .exists('displays linked block for test-assignment');
+
+      await click(SELECTORS.assignmentCreateButton);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.assignments.create',
+        'assignments index toolbar navigates to create form'
+      );
+      await click(SELECTORS.assignmentCancelButton);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.assignments.index',
+        'create form navigates back to assignment index on cancel'
+      );
+
+      await click(GENERAL.menuTrigger);
+      await click('[data-test-oidc-assignment-menu-link="edit"]');
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.assignments.assignment.edit',
+        'linked block popup menu navigates to edit'
+      );
+      await click(SELECTORS.assignmentCancelButton);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.assignments.assignment.details',
+        'edit form navigates back to assignment details on cancel'
+      );
+      // navigate to details from index page
+      await visit('/vault/access/oidc/assignments');
+      await click(GENERAL.menuTrigger);
+      await click('[data-test-oidc-assignment-menu-link="details"]');
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.access.oidc.assignments.assignment.details',
+        'popup menu navigates to assignment details'
+      );
+    });
+
+    test('it hides assignment delete and edit when no permission', async function (assert) {
+      assert.expect(5);
+      this.server.get('/identity/oidc/assignment', () =>
+        overrideResponse(null, { data: ASSIGNMENT_LIST_RESPONSE })
+      );
+      this.server.get('/identity/oidc/assignment/test-assignment', () =>
+        overrideResponse(null, { data: ASSIGNMENT_DATA_RESPONSE })
+      );
+      this.server.post('/sys/capabilities-self', () =>
+        capabilitiesStub(OIDC_BASE_URL + '/assignment/test-assignment', ['read'])
+      );
+
+      await visit(OIDC_BASE_URL + '/assignments');
+      await click('[data-test-oidc-assignment-linked-block="test-assignment"]');
+      assert
+        .dom('[data-test-oidc-assignment-title]')
+        .hasText('test-assignment', 'renders assignment name as title');
+      assert.dom(SELECTORS.assignmentDetailsTab).hasClass('active', 'details tab is active');
+      assert.dom(SELECTORS.assignmentDeleteButton).doesNotExist('delete option is hidden');
+      assert.dom(SELECTORS.assignmentEditButton).doesNotExist('edit button is hidden');
+      assert.strictEqual(
+        findAll('[data-test-component="info-table-row"]').length,
+        3,
+        'renders all assignment info rows'
+      );
+    });
+  });
+});
diff --git a/ui/tests/acceptance/oidc-config/providers-scopes-test.js b/ui/tests/acceptance/oidc-config/providers-scopes-test.js
index 472fa443bc0..b3d8f442f2b 100644
--- a/ui/tests/acceptance/oidc-config/providers-scopes-test.js
+++ b/ui/tests/acceptance/oidc-config/providers-scopes-test.js
@@ -1,16 +1,18 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
-import { visit, currentURL, click, fillIn, findAll, currentRouteName } from '@ember/test-helpers';
+import { find, visit, currentURL, click, fillIn, findAll, currentRouteName } from '@ember/test-helpers';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import oidcConfigHandlers from 'vault/mirage/handlers/oidc-config';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { create } from 'ember-cli-page-object';
-import { clickTrigger, selectChoose } from 'ember-power-select/test-support/helpers';
+import { selectChoose } from 'ember-power-select/test-support';
+import { clickTrigger } from 'ember-power-select/test-support/helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import ss from 'vault/tests/pages/components/search-select';
 import fm from 'vault/tests/pages/components/flash-message';
 import {
@@ -22,9 +24,8 @@ import {
   PROVIDER_LIST_RESPONSE,
   PROVIDER_DATA_RESPONSE,
   clearRecord,
-  overrideCapabilities,
-  overrideMirageResponse,
 } from 'vault/tests/helpers/oidc-config';
+import { capabilitiesStub, overrideResponse } from 'vault/tests/helpers/stubs';
 const searchSelect = create(ss);
 const flashMessage = create(fm);
 
@@ -38,18 +39,18 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
     oidcConfigHandlers(this.server);
     this.store = this.owner.lookup('service:store');
     // mock client list so OIDC BASE URL does not redirect to landing call-to-action image
-    this.server.get('/identity/oidc/client', () => overrideMirageResponse(null, CLIENT_LIST_RESPONSE));
-    return authPage.login();
+    this.server.get('/identity/oidc/client', () => overrideResponse(null, { data: CLIENT_LIST_RESPONSE }));
+    return login();
   });
 
   // LIST SCOPES EMPTY
   test('it navigates to scopes list view and renders empty state when no scopes are configured', async function (assert) {
     assert.expect(4);
-    this.server.get('/identity/oidc/scope', () => overrideMirageResponse(404));
+    this.server.get('/identity/oidc/scope', () => overrideResponse(404));
     await visit(OIDC_BASE_URL);
-    await click('[data-test-tab="scopes"]');
+    await click(GENERAL.tab('scopes'));
     assert.strictEqual(currentURL(), '/vault/access/oidc/scopes');
-    assert.dom('[data-test-tab="scopes"]').hasClass('active', 'scopes tab is active');
+    assert.dom(GENERAL.tab('scopes')).hasClass('active', 'scopes tab is active');
     assert
       .dom(SELECTORS.scopeEmptyState)
       .hasText(
@@ -64,9 +65,9 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
   // LIST SCOPE EXIST
   test('it renders scope list when scopes exist', async function (assert) {
     assert.expect(11);
-    this.server.get('/identity/oidc/scope', () => overrideMirageResponse(null, SCOPE_LIST_RESPONSE));
+    this.server.get('/identity/oidc/scope', () => overrideResponse(null, { data: SCOPE_LIST_RESPONSE }));
     this.server.get('/identity/oidc/scope/test-scope', () =>
-      overrideMirageResponse(null, SCOPE_DATA_RESPONSE)
+      overrideResponse(null, { data: SCOPE_DATA_RESPONSE })
     );
     await visit(OIDC_BASE_URL + '/scopes');
     assert.strictEqual(
@@ -92,7 +93,7 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
       'create form navigates back to index on cancel'
     );
 
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     await click('[data-test-oidc-scope-menu-link="edit"]');
     assert.strictEqual(
       currentRouteName(),
@@ -108,7 +109,7 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
 
     // navigate to details from index page
     await click('[data-test-breadcrumb-link="oidc-scopes"] a');
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     await click('[data-test-oidc-scope-menu-link="details"]');
     assert.strictEqual(
       currentRouteName(),
@@ -125,13 +126,15 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
   // ERROR DELETING SCOPE
   test('it throws error when trying to delete when scope is currently being associated with any provider', async function (assert) {
     assert.expect(3);
-    this.server.get('/identity/oidc/scope', () => overrideMirageResponse(null, SCOPE_LIST_RESPONSE));
+    this.server.get('/identity/oidc/scope', () => overrideResponse(null, { data: SCOPE_LIST_RESPONSE }));
     this.server.get('/identity/oidc/scope/test-scope', () =>
-      overrideMirageResponse(null, SCOPE_DATA_RESPONSE)
+      overrideResponse(null, { data: SCOPE_DATA_RESPONSE })
+    );
+    this.server.get('/identity/oidc/provider', () =>
+      overrideResponse(null, { data: PROVIDER_LIST_RESPONSE })
     );
-    this.server.get('/identity/oidc/provider', () => overrideMirageResponse(null, PROVIDER_LIST_RESPONSE));
     this.server.get('/identity/oidc/provider/test-provider', () => {
-      overrideMirageResponse(null, PROVIDER_DATA_RESPONSE);
+      overrideResponse(null, { data: PROVIDER_DATA_RESPONSE });
     });
     // throw error when trying to delete test-scope since it is associated to test-provider
     this.server.delete(
@@ -150,7 +153,7 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
 
     // try to delete scope
     await click(SELECTORS.scopeDeleteButton);
-    await click(SELECTORS.confirmActionButton);
+    await click(GENERAL.confirmButton);
     assert.strictEqual(
       flashMessage.latestMessage,
       'unable to delete scope "test-scope" because it is currently referenced by these providers: test-provider',
@@ -173,9 +176,21 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
       'vault.cluster.access.oidc.scopes.create',
       'navigates to create form'
     );
-    await fillIn('[data-test-input="name"]', 'test-scope');
-    await fillIn('[data-test-input="description"]', 'this is a test');
-    await fillIn('[data-test-component="code-mirror-modifier"] textarea', SCOPE_DATA_RESPONSE.template);
+    await fillIn(GENERAL.inputByAttr('name'), 'test-scope');
+    await fillIn(GENERAL.inputByAttr('description'), 'this is a test');
+
+    const editorElement = await find(`${GENERAL.codemirror} .hds-code-editor__editor`);
+    const { editor } = editorElement;
+
+    editor.dispatch({
+      changes: [
+        {
+          from: 0,
+          to: editor.state.doc.length,
+          insert: SCOPE_DATA_RESPONSE.template,
+        },
+      ],
+    });
     await click(SELECTORS.scopeSaveButton);
     assert.strictEqual(
       flashMessage.latestMessage,
@@ -188,9 +203,9 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
       'navigates to scope detail view after save'
     );
     assert.dom(SELECTORS.scopeDetailsTab).hasClass('active', 'scope details tab is active');
-    assert.dom('[data-test-value-div="Name"]').hasText('test-scope', 'has correct created name');
+    assert.dom(GENERAL.infoRowValue('Name')).hasText('test-scope', 'has correct created name');
     assert
-      .dom('[data-test-value-div="Description"]')
+      .dom(GENERAL.infoRowValue('Description'))
       .hasText('this is a test', 'has correct created description');
 
     // edit scope
@@ -200,7 +215,7 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
       'vault.cluster.access.oidc.scopes.scope.edit',
       'navigates to edit page from details'
     );
-    await fillIn('[data-test-input="description"]', 'this is an edit test');
+    await fillIn(GENERAL.inputByAttr('description'), 'this is an edit test');
     await click(SELECTORS.scopeSaveButton);
     assert.strictEqual(
       flashMessage.latestMessage,
@@ -213,20 +228,20 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
       'navigates back to scope details on update'
     );
     assert
-      .dom('[data-test-value-div="Description"]')
+      .dom(GENERAL.infoRowValue('Description'))
       .hasText('this is an edit test', 'has correct edited description');
 
     // create a provider using test-scope
     await click('[data-test-breadcrumb-link="oidc-scopes"] a');
-    await click('[data-test-tab="providers"]');
-    assert.dom('[data-test-tab="providers"]').hasClass('active', 'providers tab is active');
+    await click(GENERAL.tab('providers'));
+    assert.dom(GENERAL.tab('providers')).hasClass('active', 'providers tab is active');
     await click('[data-test-oidc-provider-create]');
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.access.oidc.providers.create',
       'navigates to provider create form'
     );
-    await fillIn('[data-test-input="name"]', 'test-provider');
+    await fillIn(GENERAL.inputByAttr('name'), 'test-provider');
     await clickTrigger('#scopesSupported');
     await selectChoose('#scopesSupported', 'test-scope');
     await click(SELECTORS.providerSaveButton);
@@ -242,12 +257,12 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
     );
 
     // assert default values in details view are correct
-    assert.dom('[data-test-value-div="Issuer URL"]').hasTextContaining('http://', 'issuer includes scheme');
+    assert.dom(GENERAL.infoRowValue('Issuer URL')).hasTextContaining('http://', 'issuer includes scheme');
     assert
-      .dom('[data-test-value-div="Issuer URL"]')
+      .dom(GENERAL.infoRowValue('Issuer URL'))
       .hasTextContaining('identity/oidc/provider/test', 'issuer path populates correctly');
     assert
-      .dom('[data-test-value-div="Scopes"] a')
+      .dom(`${GENERAL.infoRowValue('Scopes')} a`)
       .hasAttribute('href', '/ui/vault/access/oidc/scopes/test-scope/details', 'lists scopes as links');
 
     // check provider's application list view
@@ -268,7 +283,7 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
     );
     await click('[data-test-oidc-radio="limited"]');
     await click('[data-test-component="search-select"]#allowedClientIds .ember-basic-dropdown-trigger');
-    await fillIn('.ember-power-select-search input', 'test-app');
+    await fillIn(GENERAL.searchSelect.searchInput, 'test-app');
     await searchSelect.options.objectAt(0).click();
     await click(SELECTORS.providerSaveButton);
     assert.strictEqual(
@@ -307,7 +322,7 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
     // delete
     await click(SELECTORS.providerDetailsTab);
     await click(SELECTORS.providerDeleteButton);
-    await click(SELECTORS.confirmActionButton);
+    await click(GENERAL.confirmButton);
     assert.strictEqual(
       flashMessage.latestMessage,
       'Provider deleted successfully',
@@ -322,7 +337,7 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
     // delete scope
     await visit(OIDC_BASE_URL + '/scopes/test-scope/details');
     await click(SELECTORS.scopeDeleteButton);
-    await click(SELECTORS.confirmActionButton);
+    await click(GENERAL.confirmButton);
     assert.strictEqual(
       flashMessage.latestMessage,
       'Scope deleted successfully',
@@ -339,13 +354,13 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
   test('it lists default provider and navigates to details', async function (assert) {
     assert.expect(7);
     await visit(OIDC_BASE_URL);
-    await click('[data-test-tab="providers"]');
-    assert.dom('[data-test-tab="providers"]').hasClass('active', 'providers tab is active');
+    await click(GENERAL.tab('providers'));
+    assert.dom(GENERAL.tab('providers')).hasClass('active', 'providers tab is active');
     assert.strictEqual(currentURL(), '/vault/access/oidc/providers');
     assert
       .dom('[data-test-oidc-provider-linked-block="default"]')
       .exists('index page lists default provider');
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
 
     await click('[data-test-oidc-provider-menu-link="edit"]');
     assert.strictEqual(
@@ -376,17 +391,19 @@ module('Acceptance |  oidc-config providers and scopes', function (hooks) {
   test('it hides delete and edit for a provider when no permission', async function (assert) {
     assert.expect(3);
     this.server.get('/identity/oidc/providers', () =>
-      overrideMirageResponse(null, { providers: ['test-provider'] })
+      overrideResponse(null, { data: { providers: ['test-provider'] } })
     );
     this.server.get('/identity/oidc/provider/test-provider', () =>
-      overrideMirageResponse(null, {
-        allowed_client_ids: ['*'],
-        issuer: 'http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider',
-        scopes_supported: ['test-scope'],
+      overrideResponse(null, {
+        data: {
+          allowed_client_ids: ['*'],
+          issuer: 'http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider',
+          scopes_supported: ['test-scope'],
+        },
       })
     );
     this.server.post('/sys/capabilities-self', () =>
-      overrideCapabilities(OIDC_BASE_URL + '/provider/test-provider', ['read'])
+      capabilitiesStub(OIDC_BASE_URL + '/provider/test-provider', ['read'])
     );
 
     await visit(OIDC_BASE_URL + '/providers');
diff --git a/ui/tests/acceptance/oidc-provider-test.js b/ui/tests/acceptance/oidc-provider-test.js
index 56380dd5b5c..233087cff0e 100644
--- a/ui/tests/acceptance/oidc-provider-test.js
+++ b/ui/tests/acceptance/oidc-provider-test.js
@@ -1,22 +1,21 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { create } from 'ember-cli-page-object';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
+import sinon from 'sinon';
 
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
-import authForm from 'vault/tests/pages/components/auth-form';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import enablePage from 'vault/tests/pages/settings/auth/enable';
-import { visit, settled, currentURL, waitFor } from '@ember/test-helpers';
+import { visit, settled, currentURL, waitFor, currentRouteName, fillIn, click } from '@ember/test-helpers';
 import { clearRecord } from 'vault/tests/helpers/oidc-config';
 import { runCmd } from 'vault/tests/helpers/commands';
-
-const authFormComponent = create(authForm);
+import queryParamString from 'vault/utils/query-param-string';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
 
 const OIDC_USER = 'end-user';
 const USER_PASSWORD = 'mypassword';
@@ -82,18 +81,13 @@ const getAuthzUrl = (providerName, redirect, clientId, params) => {
   const queryParams = {
     client_id: clientId,
     nonce: 'abc123',
-    redirect_uri: encodeURIComponent(redirect),
+    redirect_uri: redirect,
     response_type: 'code',
     scope: 'openid',
     state: 'foobar',
     ...params,
   };
-  const queryString = Object.keys(queryParams).reduce((prev, key, idx) => {
-    if (idx === 0) {
-      return `${prev}${key}=${queryParams[key]}`;
-    }
-    return `${prev}&${key}=${queryParams[key]}`;
-  }, '?');
+  const queryString = queryParamString(queryParams);
   return `/vault/identity/oidc/provider/${providerName}/authorize${queryString}`;
 };
 
@@ -128,14 +122,14 @@ module('Acceptance | oidc provider', function (hooks) {
   hooks.beforeEach(async function () {
     this.uid = uuidv4();
     this.store = this.owner.lookup('service:store');
-    await authPage.login();
+    await login();
     await settled();
     this.oidcSetupInformation = await setupOidc(this.uid);
     return;
   });
 
   hooks.afterEach(async function () {
-    await authPage.login();
+    await login();
   });
 
   test('OIDC Provider logs in and redirects correctly', async function (assert) {
@@ -144,8 +138,7 @@ module('Acceptance | oidc provider', function (hooks) {
     assert
       .dom(`[data-test-oidc-client-linked-block='${WEB_APP_NAME}']`)
       .exists({ count: 1 }, 'shows webapp in oidc provider list');
-    await logout.visit();
-    await settled();
+    await visit('/vault/logout');
     const url = getAuthzUrl(providerName, callback, clientId);
     await visit(url);
 
@@ -163,11 +156,13 @@ module('Acceptance | oidc provider', function (hooks) {
         'Once you log in, you will be redirected back to your application. If you require login credentials, contact your administrator.',
         'Has updated text for client authorization flow'
       );
-    await authFormComponent.selectMethod(authMethodPath);
-    await authFormComponent.username(OIDC_USER);
-    await authFormComponent.password(USER_PASSWORD);
-    await authFormComponent.login();
-    await settled();
+
+    await fillIn(AUTH_FORM.selectMethod, 'userpass');
+    await fillIn(GENERAL.inputByAttr('username'), OIDC_USER);
+    await fillIn(GENERAL.inputByAttr('password'), USER_PASSWORD);
+    await click(AUTH_FORM.advancedSettings);
+    await fillIn(GENERAL.inputByAttr('path'), authMethodPath);
+    await click(GENERAL.submitButton);
     assert.strictEqual(currentURL(), url, 'URL is as expected after login');
     assert
       .dom('[data-test-oidc-redirect]')
@@ -193,37 +188,90 @@ module('Acceptance | oidc provider', function (hooks) {
       currentURL().includes('prompt=login'),
       'Url params no longer include prompt=login after redirect'
     );
-    await authFormComponent.selectMethod(authMethodPath);
-    await authFormComponent.username(OIDC_USER);
-    await authFormComponent.password(USER_PASSWORD);
-    await authFormComponent.login();
-    await settled();
+
+    await fillIn(AUTH_FORM.selectMethod, 'userpass');
+    await click(AUTH_FORM.advancedSettings);
+    await fillIn(GENERAL.inputByAttr('path'), authMethodPath);
+    await fillIn(GENERAL.inputByAttr('username'), OIDC_USER);
+    await fillIn(GENERAL.inputByAttr('password'), USER_PASSWORD);
+    await click(GENERAL.submitButton);
     assert
       .dom('[data-test-oidc-redirect]')
       .hasTextContaining(`click here to go back to app`, 'Shows link back to app');
     const link = document.querySelector('[data-test-oidc-redirect]').getAttribute('href');
-    assert.ok(link.includes('/callback?code='), 'Redirects to correct url');
+    assert.true(link.includes('/callback?code='), 'Redirects to correct url');
   });
 
   test('OIDC Provider shows consent form when prompt = consent', async function (assert) {
     const { providerName, callback, clientId, authMethodPath } = this.oidcSetupInformation;
     const url = getAuthzUrl(providerName, callback, clientId, { prompt: 'consent' });
-    await logout.visit();
-    await authFormComponent.selectMethod(authMethodPath);
-    await authFormComponent.username(OIDC_USER);
-    await authFormComponent.password(USER_PASSWORD);
-    await authFormComponent.login();
+    await visit('/vault/logout');
+    await fillIn(AUTH_FORM.selectMethod, 'userpass');
+    await click(AUTH_FORM.advancedSettings);
+    await fillIn(GENERAL.inputByAttr('path'), authMethodPath);
+    await fillIn(GENERAL.inputByAttr('username'), OIDC_USER);
+    await fillIn(GENERAL.inputByAttr('password'), USER_PASSWORD);
+    await click(GENERAL.submitButton);
     await visit(url);
 
     assert.notOk(
       currentURL().startsWith('/vault/auth'),
       'Does not redirect to auth because user is already logged in'
     );
-    await waitFor('[data-test-consent-form]');
+    assert.strictEqual(currentRouteName(), 'vault.cluster.oidc-provider');
     assert.dom('[data-test-consent-form]').exists('Consent form exists');
 
     //* clean up test state
     await clearRecord(this.store, 'oidc/client', WEB_APP_NAME);
     await clearRecord(this.store, 'oidc/provider', PROVIDER_NAME);
   });
+
+  // Error handling test coverage, see issue for more context https://github.com/hashicorp/vault/issues/27772
+  test('OIDC Provider redirects if authorization request throws a permission denied error', async function (assert) {
+    this.auth = this.owner.lookup('service:auth');
+    const { providerName, callback, clientId, authMethodPath } = this.oidcSetupInformation;
+    // oidc provider authorization url, see https://developer.hashicorp.com/vault/docs/concepts/oidc-provider#authorization-endpoint
+    const url = getAuthzUrl(providerName, callback, clientId);
+
+    // stub ajax request made by the model hook in routes/vault/cluster/oidc-provider.js
+    const authStub = sinon.stub(this.auth, 'ajax');
+    authStub.rejects({
+      json: () =>
+        Promise.resolve({
+          errors: ['2 errors occurred:\n\t* permission denied\n\t* invalid token\n\n'],
+        }),
+    });
+
+    await visit('/vault/logout');
+
+    // set spy here so they only spy on the relevant logic
+    const deleteTokenSpy = sinon.spy(this.auth, 'deleteToken');
+
+    // visit the OIDC authorization url to trigger the stubbed (and rejected) auth service ajax request
+    await visit(url);
+
+    await waitFor('[data-test-auth-form]', { timeout: 5000 });
+    await fillIn(AUTH_FORM.selectMethod, 'userpass');
+    await fillIn(GENERAL.inputByAttr('username'), OIDC_USER);
+    await fillIn(GENERAL.inputByAttr('password'), USER_PASSWORD);
+    await click(AUTH_FORM.advancedSettings);
+    await fillIn(GENERAL.inputByAttr('path'), authMethodPath);
+    await click(GENERAL.submitButton);
+
+    // permission denied error redirect user to log in
+    // if the route remains "vault.cluster.oidc-provider" - it did not redirect
+    assert.strictEqual(currentRouteName(), 'vault.cluster.auth', 'it redirects to auth route');
+
+    // assert permission denied error deletes OIDC user's token
+    assert.true(
+      deleteTokenSpy.calledOnce,
+      'deleteToken is called because _redirectToAuth was called with logout:true'
+    );
+
+    //* clean up test state
+    authStub.restore();
+    await login();
+    await clearRecord(this.store, 'oidc/client', WEB_APP_NAME);
+    await clearRecord(this.store, 'oidc/provider', PROVIDER_NAME);
+  });
 });
diff --git a/ui/tests/acceptance/open-api-path-help-test.js b/ui/tests/acceptance/open-api-path-help-test.js
deleted file mode 100644
index c2fdcf36ebc..00000000000
--- a/ui/tests/acceptance/open-api-path-help-test.js
+++ /dev/null
@@ -1,58 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'vault/tests/helpers';
-import authPage from 'vault/tests/pages/auth';
-import { deleteAuthCmd, deleteEngineCmd, mountAuthCmd, mountEngineCmd, runCmd } from '../helpers/commands';
-import { authEngineHelper, secretEngineHelper } from '../helpers/openapi/test-helpers';
-
-/**
- * This set of tests is for ensuring that backend changes to the OpenAPI spec
- * are known by UI developers and adequately addressed in the UI. When changes
- * are detected from this set of tests, they should be updated to pass and
- * smoke tested to ensure changes to not break the GUI workflow.
- * Marked as enterprise so it only runs periodically
- */
-module('Acceptance | OpenAPI provides expected attributes enterprise', function (hooks) {
-  setupApplicationTest(hooks);
-  hooks.beforeEach(function () {
-    this.pathHelp = this.owner.lookup('service:pathHelp');
-    this.store = this.owner.lookup('service:store');
-    return authPage.login();
-  });
-
-  // Secret engines that use OpenAPI
-  ['ssh', 'kmip', 'pki'].forEach(function (testCase) {
-    return module(`${testCase} engine`, function (hooks) {
-      hooks.beforeEach(async function () {
-        this.backend = `${testCase}-openapi`;
-        await runCmd(mountEngineCmd(testCase, this.backend), false);
-      });
-      hooks.afterEach(async function () {
-        await runCmd(deleteEngineCmd(this.backend), false);
-      });
-
-      secretEngineHelper(test, testCase);
-    });
-  });
-
-  // All auth backends use OpenAPI except aws
-  ['azure', 'userpass', 'cert', 'gcp', 'github', 'jwt', 'kubernetes', 'ldap', 'okta', 'radius'].forEach(
-    function (testCase) {
-      return module(`${testCase} auth`, function (hooks) {
-        hooks.beforeEach(async function () {
-          this.mount = `${testCase}-openapi`;
-          await runCmd(mountAuthCmd(testCase, this.mount), false);
-        });
-        hooks.afterEach(async function () {
-          await runCmd(deleteAuthCmd(this.backend), false);
-        });
-
-        authEngineHelper(test, testCase);
-      });
-    }
-  );
-});
diff --git a/ui/tests/acceptance/pki/pki-action-forms-test.js b/ui/tests/acceptance/pki/pki-action-forms-test.js
index adedfc46ecf..86923c6b9fc 100644
--- a/ui/tests/acceptance/pki/pki-action-forms-test.js
+++ b/ui/tests/acceptance/pki/pki-action-forms-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,28 +9,29 @@ import { click, currentURL, fillIn, typeIn, visit } from '@ember/test-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { v4 as uuidv4 } from 'uuid';
 
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
 import { runCmd } from 'vault/tests/helpers/commands';
-import { SELECTORS as S } from 'vault/tests/helpers/pki/workflow';
-import { issuerPemBundle } from 'vault/tests/helpers/pki/values';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
+import { PKI_CONFIGURE_CREATE, PKI_GENERATE_ROOT } from 'vault/tests/helpers/pki/pki-selectors';
+
+const { issuerPemBundle } = CERTIFICATES;
 
 module('Acceptance | pki action forms test', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(async function () {
-    await authPage.login();
+    await login();
     // Setup PKI engine
     const mountPath = `pki-workflow-${uuidv4()}`;
     await enablePage.enable('pki', mountPath);
     this.mountPath = mountPath;
-    await logout.visit();
+    await visit('/vault/logout');
   });
 
   hooks.afterEach(async function () {
-    await logout.visit();
-    await authPage.login();
+    await login();
     // Cleanup engine
     await runCmd([`delete sys/mounts/${this.mountPath}`]);
   });
@@ -43,35 +44,35 @@ module('Acceptance | pki action forms test', function (hooks) {
     });
 
     test('happy path', async function (assert) {
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(S.emptyStateLink);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/configuration/create`);
-      assert.dom(S.configuration.title).hasText('Configure PKI');
-      assert.dom(S.configuration.emptyState).exists({ count: 1 }, 'Shows empty state by default');
-      await click(S.configuration.optionByKey('import'));
-      assert.dom(S.configuration.emptyState).doesNotExist();
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(`${GENERAL.emptyStateActions} a`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/configuration/create`);
+      assert.dom(GENERAL.title).hasText('Configure PKI');
+      assert.dom(GENERAL.emptyStateTitle).exists({ count: 1 }, 'Shows empty state by default');
+      await click(PKI_CONFIGURE_CREATE.optionByKey('import'));
+      assert.dom(GENERAL.emptyStateTitle).doesNotExist();
       // Submit before filling out form shows an error
-      await click('[data-test-pki-import-pem-bundle]');
-      assert.dom(S.configuration.importError).hasText('Error please upload your PEM bundle');
+      await click(PKI_CONFIGURE_CREATE.importSubmit);
+      assert.dom(GENERAL.messageError).hasText('Error please upload your PEM bundle');
       // Fill in form data
-      await click('[data-test-text-toggle]');
-      await fillIn('[data-test-text-file-textarea]', this.pemBundle);
-      await click('[data-test-pki-import-pem-bundle]');
+      await click(GENERAL.textToggle);
+      await fillIn(GENERAL.maskedInput, this.pemBundle);
+      await click(PKI_CONFIGURE_CREATE.importSubmit);
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/configuration/create`,
+        `/vault/secrets-engines/${this.mountPath}/pki/configuration/create`,
         'stays on page on success'
       );
-      assert.dom(S.configuration.title).hasText('View imported items');
-      assert.dom(S.configuration.importForm).doesNotExist('import form is hidden after save');
-      assert.dom(S.configuration.importMapping).exists('import mapping is shown after save');
+      assert.dom(GENERAL.title).hasText('View imported items');
+      assert.dom(PKI_CONFIGURE_CREATE.importForm).doesNotExist('import form is hidden after save');
+      assert.dom(PKI_CONFIGURE_CREATE.importMapping).exists('import mapping is shown after save');
       await click('[data-test-done]');
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/overview`,
+        `/vault/secrets-engines/${this.mountPath}/pki/overview`,
         'redirects to overview when done'
       );
     });
@@ -89,28 +90,30 @@ module('Acceptance | pki action forms test', function (hooks) {
           },
         };
       });
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/configuration/create`);
-      await click(S.configuration.optionByKey('import'));
-      assert.dom(S.configuration.importForm).exists('import form is shown save');
-      await click('[data-test-text-toggle]');
-      await fillIn('[data-test-text-file-textarea]', this.pemBundle);
-      await click('[data-test-pki-import-pem-bundle]');
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/configuration/create`);
+      await click(PKI_CONFIGURE_CREATE.optionByKey('import'));
+      assert.dom(PKI_CONFIGURE_CREATE.importForm).exists('import form is shown save');
+      await click(GENERAL.textToggle);
+      await fillIn(GENERAL.maskedInput, this.pemBundle);
+      await click(PKI_CONFIGURE_CREATE.importSubmit);
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/configuration/create`,
+        `/vault/secrets-engines/${this.mountPath}/pki/configuration/create`,
         'stays on page on success'
       );
-      assert.dom(S.configuration.title).hasText('View imported items');
-      assert.dom(S.configuration.importForm).doesNotExist('import form is hidden after save');
-      assert.dom(S.configuration.importMapping).exists('import mapping is shown after save');
-      assert.dom(S.configuration.importedIssuer).hasText('my-imported-issuer', 'Issuer value is displayed');
-      assert.dom(S.configuration.importedKey).hasText('my-imported-key', 'Key value is displayed');
+      assert.dom(GENERAL.title).hasText('View imported items');
+      assert.dom(PKI_CONFIGURE_CREATE.importForm).doesNotExist('import form is hidden after save');
+      assert.dom(PKI_CONFIGURE_CREATE.importMapping).exists('import mapping is shown after save');
+      assert
+        .dom(PKI_CONFIGURE_CREATE.importedIssuer)
+        .hasText('my-imported-issuer', 'Issuer value is displayed');
+      assert.dom(PKI_CONFIGURE_CREATE.importedKey).hasText('my-imported-key', 'Key value is displayed');
       await click('[data-test-done]');
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/overview`,
+        `/vault/secrets-engines/${this.mountPath}/pki/overview`,
         'redirects to overview when done'
       );
     });
@@ -128,18 +131,20 @@ module('Acceptance | pki action forms test', function (hooks) {
           },
         };
       });
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/configuration/create`);
-      await click(S.configuration.optionByKey('import'));
-      assert.dom(S.configuration.importForm).exists('import form is shown save');
-      await click('[data-test-text-toggle]');
-      await fillIn('[data-test-text-file-textarea]', this.pemBundle);
-      await click('[data-test-pki-import-pem-bundle]');
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/configuration/create`);
+      await click(PKI_CONFIGURE_CREATE.optionByKey('import'));
+      assert.dom(PKI_CONFIGURE_CREATE.importForm).exists('import form is shown save');
+      await click(GENERAL.textToggle);
+      await fillIn(GENERAL.maskedInput, this.pemBundle);
+      await click(PKI_CONFIGURE_CREATE.importSubmit);
 
-      assert.dom(S.configuration.importForm).doesNotExist('import form is hidden after save');
-      assert.dom(S.configuration.importMapping).exists('import mapping is shown after save');
-      assert.dom(S.configuration.importedIssuer).hasText('my-imported-issuer', 'Issuer value is displayed');
-      assert.dom(S.configuration.importedKey).hasText('None', 'Shows placeholder value for key');
+      assert.dom(PKI_CONFIGURE_CREATE.importForm).doesNotExist('import form is hidden after save');
+      assert.dom(PKI_CONFIGURE_CREATE.importMapping).exists('import mapping is shown after save');
+      assert
+        .dom(PKI_CONFIGURE_CREATE.importedIssuer)
+        .hasText('my-imported-issuer', 'Issuer value is displayed');
+      assert.dom(PKI_CONFIGURE_CREATE.importedKey).hasText('None', 'Shows placeholder value for key');
     });
     test('shows None for imported items if nothing new imported', async function (assert) {
       this.server.post(`${this.mountPath}/config/ca`, () => {
@@ -152,18 +157,18 @@ module('Acceptance | pki action forms test', function (hooks) {
           },
         };
       });
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/configuration/create`);
-      await click(S.configuration.optionByKey('import'));
-      assert.dom(S.configuration.importForm).exists('import form is shown save');
-      await click('[data-test-text-toggle]');
-      await fillIn('[data-test-text-file-textarea]', this.pemBundle);
-      await click('[data-test-pki-import-pem-bundle]');
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/configuration/create`);
+      await click(PKI_CONFIGURE_CREATE.optionByKey('import'));
+      assert.dom(PKI_CONFIGURE_CREATE.importForm).exists('import form is shown save');
+      await click(GENERAL.textToggle);
+      await fillIn(GENERAL.maskedInput, this.pemBundle);
+      await click(PKI_CONFIGURE_CREATE.importSubmit);
 
-      assert.dom(S.configuration.importForm).doesNotExist('import form is hidden after save');
-      assert.dom(S.configuration.importMapping).exists('import mapping is shown after save');
-      assert.dom(S.configuration.importedIssuer).hasText('None', 'Shows placeholder value for issuer');
-      assert.dom(S.configuration.importedKey).hasText('None', 'Shows placeholder value for key');
+      assert.dom(PKI_CONFIGURE_CREATE.importForm).doesNotExist('import form is hidden after save');
+      assert.dom(PKI_CONFIGURE_CREATE.importMapping).exists('import mapping is shown after save');
+      assert.dom(PKI_CONFIGURE_CREATE.importedIssuer).hasText('None', 'Shows placeholder value for issuer');
+      assert.dom(PKI_CONFIGURE_CREATE.importedKey).hasText('None', 'Shows placeholder value for key');
     });
   });
 
@@ -172,118 +177,118 @@ module('Acceptance | pki action forms test', function (hooks) {
       const commonName = 'my-common-name';
       const issuerName = 'my-first-issuer';
       const keyName = 'my-first-key';
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(S.emptyStateLink);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/configuration/create`);
-      assert.dom(S.configuration.title).hasText('Configure PKI');
-      assert.dom(S.configuration.emptyState).exists({ count: 1 }, 'Shows empty state by default');
-      await click(S.configuration.optionByKey('generate-root'));
-      assert.dom(S.configuration.emptyState).doesNotExist();
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(`${GENERAL.emptyStateActions} a`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/configuration/create`);
+      assert.dom(GENERAL.title).hasText('Configure PKI');
+      assert.dom(GENERAL.emptyStateTitle).exists({ count: 1 }, 'Shows empty state by default');
+      await click(PKI_CONFIGURE_CREATE.optionByKey('generate-root'));
+      assert.dom(GENERAL.emptyStateTitle).doesNotExist();
       // The URLs section is populated based on params returned from OpenAPI. This test will break when
       // the backend adds fields. We should update the count accordingly.
-      assert.dom(S.configuration.urlField).exists({ count: 4 });
+      assert.dom(PKI_GENERATE_ROOT.urlField).exists({ count: 5 });
       // Fill in form
-      await fillIn(S.configuration.typeField, 'internal');
-      await typeIn(S.configuration.inputByName('commonName'), commonName);
-      await typeIn(S.configuration.inputByName('issuerName'), issuerName);
-      await click(S.configuration.keyParamsGroupToggle);
-      await typeIn(S.configuration.inputByName('keyName'), keyName);
-      await click(S.configuration.generateRootSave);
+      await fillIn(GENERAL.inputByAttr('type'), 'internal');
+      await typeIn(GENERAL.inputByAttr('commonName'), commonName);
+      await typeIn(GENERAL.inputByAttr('issuerName'), issuerName);
+      await click(GENERAL.button('Key parameters'));
+      await typeIn(GENERAL.inputByAttr('keyName'), keyName);
+      await click(GENERAL.submitButton);
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/configuration/create`,
+        `/vault/secrets-engines/${this.mountPath}/pki/configuration/create`,
         'stays on page on success'
       );
-      assert.dom(S.configuration.title).hasText('View Root Certificate');
-      assert.dom(S.configuration.nextStepsBanner).doesNotExist('no private key warning');
-      assert.dom(S.configuration.title).hasText('View Root Certificate', 'Updates title on page');
-      assert.dom(S.configuration.saved.certificate).exists('Copyable certificate exists');
-      assert.dom(S.configuration.saved.issuerName).hasText(issuerName);
-      assert.dom(S.configuration.saved.issuerLink).exists('Issuer link exists');
-      assert.dom(S.configuration.saved.keyLink).exists('Key link exists');
-      assert.dom(S.configuration.saved.keyName).hasText(keyName);
+      assert.dom(GENERAL.title).hasText('View Root Certificate');
+      assert.dom(PKI_CONFIGURE_CREATE.nextStepsBanner).doesNotExist('no private key warning');
+      assert.dom(GENERAL.title).hasText('View Root Certificate', 'Updates title on page');
+      assert.dom(PKI_GENERATE_ROOT.saved.certificate).exists('Copyable certificate exists');
+      assert.dom(PKI_GENERATE_ROOT.saved.issuerName).hasText(issuerName);
+      assert.dom(PKI_GENERATE_ROOT.saved.issuerLink).exists('Issuer link exists');
+      assert.dom(PKI_GENERATE_ROOT.saved.keyLink).exists('Key link exists');
+      assert.dom(PKI_GENERATE_ROOT.saved.keyName).hasText(keyName);
       assert.dom('[data-test-done]').exists('Done button exists');
       // Check that linked issuer has correct common name
-      await click(S.configuration.saved.issuerLink);
-      assert.dom(S.issuerDetails.valueByName('Common name')).hasText(commonName);
+      await click(PKI_GENERATE_ROOT.saved.issuerLink);
+      assert.dom(GENERAL.infoRowValue('Common name')).hasText(commonName);
     });
     test('type=exported', async function (assert) {
       const commonName = 'my-exported-name';
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/configuration/create`);
-      await click(S.configuration.optionByKey('generate-root'));
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/configuration/create`);
+      await click(PKI_CONFIGURE_CREATE.optionByKey('generate-root'));
       // Fill in form
-      await fillIn(S.configuration.typeField, 'exported');
-      await typeIn(S.configuration.inputByName('commonName'), commonName);
-      await click(S.configuration.generateRootSave);
+      await fillIn(GENERAL.inputByAttr('type'), 'exported');
+      await typeIn(GENERAL.inputByAttr('commonName'), commonName);
+      await click(GENERAL.submitButton);
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/configuration/create`,
+        `/vault/secrets-engines/${this.mountPath}/pki/configuration/create`,
         'stays on page on success'
       );
-      assert.dom(S.configuration.title).hasText('View Root Certificate');
+      assert.dom(GENERAL.title).hasText('View Root Certificate');
       assert
-        .dom(S.configuration.nextStepsBanner)
+        .dom(PKI_CONFIGURE_CREATE.nextStepsBanner)
         .hasText('Next steps The private_key is only available once. Make sure you copy and save it now.');
-      assert.dom(S.configuration.title).hasText('View Root Certificate', 'Updates title on page');
-      assert.dom(S.configuration.saved.certificate).exists('Copyable certificate exists');
+      assert.dom(GENERAL.title).hasText('View Root Certificate', 'Updates title on page');
+      assert.dom(PKI_GENERATE_ROOT.saved.certificate).exists('Copyable certificate exists');
       assert
-        .dom(S.configuration.saved.issuerName)
+        .dom(PKI_GENERATE_ROOT.saved.issuerName)
         .doesNotExist('Issuer name not shown because it was not named');
-      assert.dom(S.configuration.saved.issuerLink).exists('Issuer link exists');
-      assert.dom(S.configuration.saved.keyLink).exists('Key link exists');
-      assert.dom(S.configuration.saved.privateKey).exists('Copyable private key exists');
-      assert.dom(S.configuration.saved.keyName).doesNotExist('Key name not shown because it was not named');
+      assert.dom(PKI_GENERATE_ROOT.saved.issuerLink).exists('Issuer link exists');
+      assert.dom(PKI_GENERATE_ROOT.saved.keyLink).exists('Key link exists');
+      assert.dom(PKI_GENERATE_ROOT.saved.privateKey).exists('Copyable private key exists');
+      assert.dom(PKI_GENERATE_ROOT.saved.keyName).doesNotExist('Key name not shown because it was not named');
       assert.dom('[data-test-done]').exists('Done button exists');
       // Check that linked issuer has correct common name
-      await click(S.configuration.saved.issuerLink);
-      assert.dom(S.issuerDetails.valueByName('Common name')).hasText(commonName);
+      await click(PKI_GENERATE_ROOT.saved.issuerLink);
+      assert.dom(GENERAL.infoRowValue('Common name')).hasText(commonName);
     });
   });
 
   module('generate CSR', function () {
     test('happy path', async function (assert) {
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(S.emptyStateLink);
-      assert.dom(S.configuration.title).hasText('Configure PKI');
-      await click(S.configuration.optionByKey('generate-csr'));
-      await fillIn(S.configuration.typeField, 'internal');
-      await fillIn(S.configuration.inputByName('commonName'), 'my-common-name');
-      await click('[data-test-save]');
-      assert.dom(S.configuration.title).hasText('View Generated CSR');
-      await assert.dom(S.configuration.csrDetails).exists('renders CSR details after save');
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(`${GENERAL.emptyStateActions} a`);
+      assert.dom(GENERAL.title).hasText('Configure PKI');
+      await click(PKI_CONFIGURE_CREATE.optionByKey('generate-csr'));
+      await fillIn(GENERAL.inputByAttr('type'), 'internal');
+      await fillIn(GENERAL.inputByAttr('commonName'), 'my-common-name');
+      await click('[data-test-submit]');
+      assert.dom(GENERAL.title).hasText('View Generated CSR');
+      await assert.dom(PKI_CONFIGURE_CREATE.csrDetails).exists('renders CSR details after save');
       await click('[data-test-done]');
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/overview`,
+        `/vault/secrets-engines/${this.mountPath}/pki/overview`,
         'Transitions to overview after viewing csr details'
       );
     });
     test('type = exported', async function (assert) {
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(S.emptyStateLink);
-      await click(S.configuration.optionByKey('generate-csr'));
-      await fillIn(S.configuration.typeField, 'exported');
-      await fillIn(S.configuration.inputByName('commonName'), 'my-common-name');
-      await click('[data-test-save]');
-      await assert.dom(S.configuration.csrDetails).exists('renders CSR details after save');
-      assert.dom(S.configuration.title).hasText('View Generated CSR');
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(`${GENERAL.emptyStateActions} a`);
+      await click(PKI_CONFIGURE_CREATE.optionByKey('generate-csr'));
+      await fillIn(GENERAL.inputByAttr('type'), 'exported');
+      await fillIn(GENERAL.inputByAttr('commonName'), 'my-common-name');
+      await click('[data-test-submit]');
+      await assert.dom(PKI_CONFIGURE_CREATE.csrDetails).exists('renders CSR details after save');
+      assert.dom(GENERAL.title).hasText('View Generated CSR');
       assert
         .dom('[data-test-next-steps-csr]')
         .hasText(
           'Next steps Copy the CSR below for a parent issuer to sign and then import the signed certificate back into this mount. The private_key is only available once. Make sure you copy and save it now.'
         );
-      assert.dom(S.configuration.saved.privateKey).exists('Copyable private key exists');
+      assert.dom(PKI_GENERATE_ROOT.saved.privateKey).exists('Copyable private key exists');
       await click('[data-test-done]');
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/overview`,
+        `/vault/secrets-engines/${this.mountPath}/pki/overview`,
         'Transitions to overview after viewing csr details'
       );
     });
diff --git a/ui/tests/acceptance/pki/pki-configuration-test.js b/ui/tests/acceptance/pki/pki-configuration-test.js
index 3e9fae9507e..589c5f9c59a 100644
--- a/ui/tests/acceptance/pki/pki-configuration-test.js
+++ b/ui/tests/acceptance/pki/pki-configuration-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,29 +10,35 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { click, currentURL, fillIn, visit, settled, find, waitFor, waitUntil } from '@ember/test-helpers';
 import { v4 as uuidv4 } from 'uuid';
 
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
+import { login, logout } from 'vault/tests/helpers/auth/auth-helpers';
 import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
 import { runCmd } from 'vault/tests/helpers/commands';
-import { SELECTORS } from 'vault/tests/helpers/pki/workflow';
-import { issuerPemBundle } from 'vault/tests/helpers/pki/values';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
+import {
+  PKI_CONFIGURE_CREATE,
+  PKI_DELETE_ALL_ISSUERS,
+  PKI_GENERATE_ROOT,
+  PKI_ISSUER_LIST,
+} from 'vault/tests/helpers/pki/pki-selectors';
 
+const { issuerPemBundle } = CERTIFICATES;
 module('Acceptance | pki configuration test', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(async function () {
     this.pemBundle = issuerPemBundle;
-    await authPage.login();
+    await login();
     // Setup PKI engine
     const mountPath = `pki-workflow-${uuidv4()}`;
     await enablePage.enable('pki', mountPath);
     this.mountPath = mountPath;
-    await logout.visit();
+    await logout();
   });
 
   hooks.afterEach(async function () {
-    await logout.visit();
-    await authPage.login();
+    await logout();
+    await login();
     // Cleanup engine
     await runCmd([`delete sys/mounts/${this.mountPath}`]);
   });
@@ -41,128 +47,126 @@ module('Acceptance | pki configuration test', function (hooks) {
     setupMirage(hooks);
 
     test('it shows the delete all issuers modal', async function (assert) {
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/configuration`);
-      await click(SELECTORS.configuration.configureButton);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/configuration/create`);
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/configuration`);
+      await click(PKI_CONFIGURE_CREATE.configureButton);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/configuration/create`);
       await settled();
-      await click(SELECTORS.configuration.generateRootOption);
-      await fillIn(SELECTORS.configuration.typeField, 'exported');
-      await fillIn(SELECTORS.configuration.generateRootCommonNameField, 'issuer-common-0');
-      await fillIn(SELECTORS.configuration.generateRootIssuerNameField, 'issuer-0');
-      await click(SELECTORS.configuration.generateRootSave);
-      await click(SELECTORS.configuration.doneButton);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
+      await click(PKI_CONFIGURE_CREATE.generateRootOption);
+      await fillIn(GENERAL.inputByAttr('type'), 'exported');
+      await fillIn(GENERAL.inputByAttr('commonName'), 'issuer-common-0');
+      await fillIn(GENERAL.inputByAttr('issuerName'), 'issuer-0');
+      await click(GENERAL.submitButton);
+      await click(PKI_CONFIGURE_CREATE.doneButton);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
       await settled();
-      await click(SELECTORS.configTab);
+      await click(GENERAL.secretTab('Configuration'));
       await settled();
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/configuration`);
-      await click(SELECTORS.configuration.issuerLink);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/configuration`);
+      await click(PKI_DELETE_ALL_ISSUERS.issuerLink);
       await settled();
-      await waitFor(SELECTORS.configuration.deleteAllIssuerModal, { timeout: 5000 });
-      assert.dom(SELECTORS.configuration.deleteAllIssuerModal).exists();
-      await fillIn(SELECTORS.configuration.deleteAllIssuerInput, 'delete-all');
-      await click(SELECTORS.configuration.deleteAllIssuerButton);
+      await waitFor(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal, { timeout: 5000 });
+      assert.dom(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal).exists();
+      await fillIn(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerInput, 'delete-all');
+      await click(GENERAL.confirmButton);
       await settled();
-      await waitUntil(() => !find(SELECTORS.configuration.deleteAllIssuerModal));
+      await waitUntil(() => !find(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal));
 
-      assert.dom(SELECTORS.configuration.deleteAllIssuerModal).doesNotExist();
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/configuration`);
+      assert.dom(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal).doesNotExist();
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/configuration`);
     });
 
     test('it shows the correct empty state message if certificates exists after delete all issuers', async function (assert) {
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/configuration`);
-      await click(SELECTORS.configuration.configureButton);
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/configuration`);
+      await click(PKI_CONFIGURE_CREATE.configureButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/configuration/create`,
+        `/vault/secrets-engines/${this.mountPath}/pki/configuration/create`,
         'goes to pki configure page'
       );
-      await click(SELECTORS.configuration.generateRootOption);
-      await fillIn(SELECTORS.configuration.typeField, 'exported');
-      await fillIn(SELECTORS.configuration.generateRootCommonNameField, 'issuer-common-0');
-      await fillIn(SELECTORS.configuration.generateRootIssuerNameField, 'issuer-0');
-      await click(SELECTORS.configuration.generateRootSave);
-      await click(SELECTORS.configuration.doneButton);
+      await click(PKI_CONFIGURE_CREATE.generateRootOption);
+      await fillIn(GENERAL.inputByAttr('type'), 'exported');
+      await fillIn(GENERAL.inputByAttr('commonName'), 'issuer-common-0');
+      await fillIn(GENERAL.inputByAttr('issuerName'), 'issuer-0');
+      await click(GENERAL.submitButton);
+      await click(PKI_CONFIGURE_CREATE.doneButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/overview`,
+        `/vault/secrets-engines/${this.mountPath}/pki/overview`,
         'goes to overview page'
       );
-      await click(SELECTORS.configTab);
+      await click(GENERAL.secretTab('Configuration'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/configuration`,
+        `/vault/secrets-engines/${this.mountPath}/pki/configuration`,
         'goes to configuration page'
       );
-      await click(SELECTORS.configuration.issuerLink);
-      await waitFor(SELECTORS.configuration.deleteAllIssuerModal);
-      assert.dom(SELECTORS.configuration.deleteAllIssuerModal).exists();
-      await fillIn(SELECTORS.configuration.deleteAllIssuerInput, 'delete-all');
-      await click(SELECTORS.configuration.deleteAllIssuerButton);
-      await waitUntil(() => !find(SELECTORS.configuration.deleteAllIssuerModal));
-      assert
-        .dom(SELECTORS.configuration.deleteAllIssuerModal)
-        .doesNotExist('delete all issuers modal closes');
+      await click(PKI_DELETE_ALL_ISSUERS.issuerLink);
+      await waitFor(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal);
+      assert.dom(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal).exists();
+      await fillIn(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerInput, 'delete-all');
+      await click(GENERAL.confirmButton);
+      await waitUntil(() => !find(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal));
+      assert.dom(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal).doesNotExist('delete all issuers modal closes');
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/configuration`,
+        `/vault/secrets-engines/${this.mountPath}/pki/configuration`,
         'is still on configuration page'
       );
       await settled();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
       await settled();
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/overview`,
+        `/vault/secrets-engines/${this.mountPath}/pki/overview`,
         'goes to overview page'
       );
       assert
-        .dom(SELECTORS.emptyStateMessage)
+        .dom(GENERAL.emptyStateMessage)
         .hasText(
           "This PKI mount hasn't yet been configured with a certificate issuer. There are existing certificates. Use the CLI to perform any operations with them until an issuer is configured."
         );
 
-      await visit(`/vault/secrets/${this.mountPath}/pki/roles`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/roles`);
       await settled();
       assert
-        .dom(SELECTORS.emptyStateMessage)
+        .dom(GENERAL.emptyStateMessage)
         .hasText("This PKI mount hasn't yet been configured with a certificate issuer.");
 
-      await visit(`/vault/secrets/${this.mountPath}/pki/issuers`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/issuers`);
       await settled();
       assert
-        .dom(SELECTORS.emptyStateMessage)
+        .dom(GENERAL.emptyStateMessage)
         .hasText("This PKI mount hasn't yet been configured with a certificate issuer.");
 
-      await visit(`/vault/secrets/${this.mountPath}/pki/keys`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/keys`);
       await settled();
       assert
-        .dom(SELECTORS.emptyStateMessage)
+        .dom(GENERAL.emptyStateMessage)
         .hasText("This PKI mount hasn't yet been configured with a certificate issuer.");
 
-      await visit(`/vault/secrets/${this.mountPath}/pki/certificates`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/certificates`);
       await settled();
       assert
-        .dom(SELECTORS.emptyStateMessage)
+        .dom(GENERAL.emptyStateMessage)
         .hasText(
           "This PKI mount hasn't yet been configured with a certificate issuer. There are existing certificates. Use the CLI to perform any operations with them until an issuer is configured."
         );
     });
 
     test('it shows the correct empty state message if roles and certificates exists after delete all issuers', async function (assert) {
-      await authPage.login(this.pkiAdminToken);
+      await login(this.pkiAdminToken);
       // Configure PKI
-      await visit(`/vault/secrets/${this.mountPath}/pki/configuration`);
-      await click(SELECTORS.configuration.configureButton);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/configuration/create`);
-      await click(SELECTORS.configuration.generateRootOption);
-      await fillIn(SELECTORS.configuration.typeField, 'exported');
-      await fillIn(SELECTORS.configuration.generateRootCommonNameField, 'issuer-common-0');
-      await fillIn(SELECTORS.configuration.generateRootIssuerNameField, 'issuer-0');
-      await click(SELECTORS.configuration.generateRootSave);
-      await click(SELECTORS.configuration.doneButton);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/configuration`);
+      await click(PKI_CONFIGURE_CREATE.configureButton);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/configuration/create`);
+      await click(PKI_CONFIGURE_CREATE.generateRootOption);
+      await fillIn(GENERAL.inputByAttr('type'), 'exported');
+      await fillIn(GENERAL.inputByAttr('commonName'), 'issuer-common-0');
+      await fillIn(GENERAL.inputByAttr('issuerName'), 'issuer-0');
+      await click(GENERAL.submitButton);
+      await click(PKI_CONFIGURE_CREATE.doneButton);
       // Create role and root CA"
       await runCmd([
         `write ${this.mountPath}/roles/some-role \
@@ -172,52 +176,52 @@ module('Acceptance | pki configuration test', function (hooks) {
         max_ttl="720h"`,
       ]);
       await runCmd([`write ${this.mountPath}/root/generate/internal common_name="Hashicorp Test"`]);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.configTab);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/configuration`);
-      await click(SELECTORS.configuration.issuerLink);
-      await waitFor(SELECTORS.configuration.deleteAllIssuerModal);
-      assert.dom(SELECTORS.configuration.deleteAllIssuerModal).exists();
-      await fillIn(SELECTORS.configuration.deleteAllIssuerInput, 'delete-all');
-      await click(SELECTORS.configuration.deleteAllIssuerButton);
-      await settled();
-      await waitUntil(() => !find(SELECTORS.configuration.deleteAllIssuerModal));
-      assert.dom(SELECTORS.configuration.deleteAllIssuerModal).doesNotExist();
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/configuration`);
-      await settled();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await settled();
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Configuration'));
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/configuration`);
+      await click(PKI_DELETE_ALL_ISSUERS.issuerLink);
+      await waitFor(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal);
+      assert.dom(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal).exists();
+      await fillIn(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerInput, 'delete-all');
+      await click(GENERAL.confirmButton);
+      await settled();
+      await waitUntil(() => !find(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal));
+      assert.dom(PKI_DELETE_ALL_ISSUERS.deleteAllIssuerModal).doesNotExist();
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/configuration`);
+      await settled();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await settled();
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
       assert
-        .dom(SELECTORS.emptyStateMessage)
+        .dom(GENERAL.emptyStateMessage)
         .hasText(
           "This PKI mount hasn't yet been configured with a certificate issuer. There are existing roles and certificates. Use the CLI to perform any operations with them until an issuer is configured."
         );
 
-      await visit(`/vault/secrets/${this.mountPath}/pki/roles`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/roles`);
       await settled();
       assert
-        .dom(SELECTORS.emptyStateMessage)
+        .dom(GENERAL.emptyStateMessage)
         .hasText(
           "This PKI mount hasn't yet been configured with a certificate issuer. There are existing roles. Use the CLI to perform any operations with them until an issuer is configured."
         );
 
-      await visit(`/vault/secrets/${this.mountPath}/pki/issuers`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/issuers`);
       await settled();
       assert
-        .dom(SELECTORS.emptyStateMessage)
+        .dom(GENERAL.emptyStateMessage)
         .hasText("This PKI mount hasn't yet been configured with a certificate issuer.");
 
-      await visit(`/vault/secrets/${this.mountPath}/pki/keys`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/keys`);
       await settled();
       assert
-        .dom(SELECTORS.emptyStateMessage)
+        .dom(GENERAL.emptyStateMessage)
         .hasText("This PKI mount hasn't yet been configured with a certificate issuer.");
 
-      await visit(`/vault/secrets/${this.mountPath}/pki/certificates`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/certificates`);
       await settled();
       assert
-        .dom(SELECTORS.emptyStateMessage)
+        .dom(GENERAL.emptyStateMessage)
         .hasText(
           "This PKI mount hasn't yet been configured with a certificate issuer. There are existing certificates. Use the CLI to perform any operations with them until an issuer is configured."
         );
@@ -226,26 +230,29 @@ module('Acceptance | pki configuration test', function (hooks) {
     // test coverage for ed25519 certs not displaying because the verify() function errors
     test('it generates and displays a root issuer of key type = ed25519', async function (assert) {
       assert.expect(4);
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.issuersTab);
-      await click(SELECTORS.generateIssuerDropdown);
-      await click(SELECTORS.generateIssuerRoot);
-      await fillIn(SELECTORS.configuration.inputByName('type'), 'internal');
-      await fillIn(SELECTORS.configuration.inputByName('commonName'), 'my-certificate');
-      await click(SELECTORS.configuration.keyParamsGroupToggle);
-      await fillIn(SELECTORS.configuration.inputByName('keyType'), 'ed25519');
-      await click(SELECTORS.configuration.generateRootSave);
-
-      const issuerId = find(SELECTORS.configuration.saved.issuerLink).innerHTML;
-      await visit(`/vault/secrets/${this.mountPath}/pki/issuers`);
-      assert.dom(SELECTORS.issuerListItem(issuerId)).exists();
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Issuers'));
+      await click(PKI_ISSUER_LIST.generateIssuerDropdown);
+      await click(PKI_ISSUER_LIST.generateIssuerRoot);
+      await fillIn(GENERAL.inputByAttr('type'), 'internal');
+      await fillIn(GENERAL.inputByAttr('commonName'), 'my-certificate');
+      await click(GENERAL.button('Key parameters'));
+      await fillIn(GENERAL.inputByAttr('keyType'), 'ed25519');
+      await click(GENERAL.submitButton);
+
+      const issuerId = find(PKI_GENERATE_ROOT.saved.issuerLink).innerHTML;
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/issuers`);
+      assert.dom(PKI_ISSUER_LIST.issuerListItem(issuerId)).exists();
       assert
         .dom('[data-test-common-name="0"]')
         .hasText('my-certificate', 'parses certificate metadata in the list view');
-      await click(SELECTORS.issuerListItem(issuerId));
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/issuers/${issuerId}/details`);
-      assert.dom(SELECTORS.configuration.saved.commonName).exists('renders issuer details');
+      await click(PKI_ISSUER_LIST.issuerListItem(issuerId));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.mountPath}/pki/issuers/${issuerId}/details`
+      );
+      assert.dom(PKI_GENERATE_ROOT.saved.commonName).exists('renders issuer details');
     });
   });
 });
diff --git a/ui/tests/acceptance/pki/pki-cross-sign-test.js b/ui/tests/acceptance/pki/pki-cross-sign-test.js
index b3fddb6f0b5..c36e2d65f71 100644
--- a/ui/tests/acceptance/pki/pki-cross-sign-test.js
+++ b/ui/tests/acceptance/pki/pki-cross-sign-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,16 +8,23 @@ import { visit, click, fillIn, find } from '@ember/test-helpers';
 import { setupApplicationTest } from 'vault/tests/helpers';
 import { v4 as uuidv4 } from 'uuid';
 
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
 import { runCmd } from 'vault/tests/helpers/commands';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-issuer-cross-sign';
 import { verifyCertificates } from 'vault/utils/parse-pki-cert';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import {
+  PKI_CONFIGURE_CREATE,
+  PKI_CROSS_SIGN,
+  PKI_ISSUER_DETAILS,
+} from 'vault/tests/helpers/pki/pki-selectors';
+import sinon from 'sinon';
+
 module('Acceptance | pki/pki cross sign', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(async function () {
-    await authPage.login();
+    await login();
     this.parentMountPath = `parent-mount-${uuidv4()}`;
     this.oldParentIssuerName = 'old-parent-issuer'; // old parent issuer we're transferring from
     this.parentIssuerName = 'new-parent-issuer'; // issuer where cross-signing action will begin
@@ -41,50 +48,59 @@ module('Acceptance | pki/pki cross sign', function (hooks) {
   });
 
   test('it cross-signs an issuer', async function (assert) {
+    // Sinon spy for clipboard
+    const clipboardSpy = sinon.stub(navigator.clipboard, 'writeText').resolves();
     // configure parent and intermediate mounts to make them cross-signable
-    await visit(`/vault/secrets/${this.intMountPath}/pki/configuration/create`);
-    await click(SELECTORS.configure.optionByKey('generate-csr'));
-    await fillIn(SELECTORS.inputByName('type'), 'internal');
-    await fillIn(SELECTORS.inputByName('commonName'), 'Short-Lived Int R1');
-    await click('[data-test-save]');
-    const csr = find(SELECTORS.copyButton('CSR')).getAttribute('data-test-copy-button');
-    await visit(`vault/secrets/${this.parentMountPath}/pki/issuers/${this.oldParentIssuerName}/sign`);
-    await fillIn(SELECTORS.inputByName('csr'), csr);
-    await fillIn(SELECTORS.inputByName('format'), 'pem_bundle');
+    await visit(`/vault/secrets-engines/${this.intMountPath}/pki/configuration/create`);
+    await click(PKI_CONFIGURE_CREATE.optionByKey('generate-csr'));
+    await fillIn(GENERAL.inputByAttr('type'), 'internal');
+    await fillIn(GENERAL.inputByAttr('commonName'), 'Short-Lived Int R1');
+    await click(GENERAL.submitButton);
+    await click(PKI_CROSS_SIGN.copyButton('CSR'));
+    const csr = clipboardSpy.firstCall.args[0];
+    await visit(`vault/secrets-engines/${this.parentMountPath}/pki/issuers/${this.oldParentIssuerName}/sign`);
+    await fillIn(GENERAL.inputByAttr('csr'), csr);
+    await fillIn(GENERAL.inputByAttr('format'), 'pem_bundle');
     await click('[data-test-pki-sign-intermediate-save]');
-    const pemBundle = find(SELECTORS.copyButton('CA Chain'))
-      .getAttribute('data-test-copy-button')
-      .replace(/,/, '\n');
-    await visit(`vault/secrets/${this.intMountPath}/pki/configuration/create`);
-    await click(SELECTORS.configure.optionByKey('import'));
-    await click('[data-test-text-toggle]');
-    await fillIn('[data-test-text-file-textarea]', pemBundle);
-    await click(SELECTORS.configure.importSubmit);
-    await visit(`vault/secrets/${this.intMountPath}/pki/issuers`);
+    await click(PKI_CROSS_SIGN.copyButton('CA Chain'));
+    const pemBundle = clipboardSpy.secondCall.args[0].replace(/,/, '\n');
+    await visit(`vault/secrets-engines/${this.intMountPath}/pki/configuration/create`);
+    await click(PKI_CONFIGURE_CREATE.optionByKey('import'));
+    await click(GENERAL.textToggle);
+    await fillIn(GENERAL.maskedInput, pemBundle);
+    await click(PKI_CONFIGURE_CREATE.importSubmit);
+    await visit(`vault/secrets-engines/${this.intMountPath}/pki/issuers`);
     await click('[data-test-is-default]');
     // name default issuer of intermediate
-    const oldIntIssuerId = find(SELECTORS.rowValue('Issuer ID')).innerText;
-    const oldIntCert = find(SELECTORS.copyButton('Certificate')).getAttribute('data-test-copy-button');
-    await click(SELECTORS.details.configure);
-    await fillIn(SELECTORS.inputByName('issuerName'), this.intIssuerName);
-    await click('[data-test-save]');
+    const oldIntIssuerId = find(PKI_CROSS_SIGN.rowValue('Issuer ID')).innerText;
+    await click(PKI_CROSS_SIGN.copyButton('Certificate'));
+    const oldIntCert = clipboardSpy.thirdCall.args[0];
+    await click(PKI_ISSUER_DETAILS.configure);
+    await fillIn(GENERAL.inputByAttr('issuerName'), this.intIssuerName);
+    await click('[data-test-submit]');
 
     // perform cross-sign
-    await visit(`vault/secrets/${this.parentMountPath}/pki/issuers/${this.parentIssuerName}/cross-sign`);
-    await fillIn(SELECTORS.objectListInput('intermediateMount'), this.intMountPath);
-    await fillIn(SELECTORS.objectListInput('intermediateIssuer'), this.intIssuerName);
-    await fillIn(SELECTORS.objectListInput('newCrossSignedIssuer'), this.newlySignedIssuer);
-    await click(SELECTORS.submitButton);
+    await visit(
+      `vault/secrets-engines/${this.parentMountPath}/pki/issuers/${this.parentIssuerName}/cross-sign`
+    );
+    await fillIn(PKI_CROSS_SIGN.objectListInput('intermediateMount'), this.intMountPath);
+    await fillIn(PKI_CROSS_SIGN.objectListInput('intermediateIssuer'), this.intIssuerName);
+    await fillIn(PKI_CROSS_SIGN.objectListInput('newCrossSignedIssuer'), this.newlySignedIssuer);
+    await click(GENERAL.submitButton);
     assert
-      .dom(`${SELECTORS.signedIssuerCol('intermediateMount')} a`)
-      .hasAttribute('href', `/ui/vault/secrets/${this.intMountPath}/pki/overview`);
+      .dom(`${PKI_CROSS_SIGN.signedIssuerCol('intermediateMount')} a`)
+      .hasAttribute('href', `/ui/vault/secrets-engines/${this.intMountPath}/pki/overview`);
     assert
-      .dom(`${SELECTORS.signedIssuerCol('intermediateIssuer')} a`)
-      .hasAttribute('href', `/ui/vault/secrets/${this.intMountPath}/pki/issuers/${oldIntIssuerId}/details`);
+      .dom(`${PKI_CROSS_SIGN.signedIssuerCol('intermediateIssuer')} a`)
+      .hasAttribute(
+        'href',
+        `/ui/vault/secrets-engines/${this.intMountPath}/pki/issuers/${oldIntIssuerId}/details`
+      );
 
     // get certificate data of newly signed issuer
-    await click(`${SELECTORS.signedIssuerCol('newCrossSignedIssuer')} a`);
-    const newIntCert = find(SELECTORS.copyButton('Certificate')).getAttribute('data-test-copy-button');
+    await click(`${PKI_CROSS_SIGN.signedIssuerCol('newCrossSignedIssuer')} a`);
+    await click(PKI_CROSS_SIGN.copyButton('Certificate'));
+    const newIntCert = clipboardSpy.getCall(3).args[0];
 
     // verify cross-sign was accurate by creating a role to issue a leaf certificate
     const myRole = 'some-role';
@@ -94,16 +110,19 @@ module('Acceptance | pki/pki cross sign', function (hooks) {
     allow_any_name=true \
     max_ttl="720h"`,
     ]);
-    await visit(`vault/secrets/${this.intMountPath}/pki/roles/${myRole}/generate`);
-    await fillIn(SELECTORS.inputByName('commonName'), 'my-leaf');
+    await visit(`vault/secrets-engines/${this.intMountPath}/pki/roles/${myRole}/generate`);
+    await fillIn(GENERAL.inputByAttr('commonName'), 'my-leaf');
     await fillIn('[data-test-ttl-value="TTL"]', '3600');
-    await click('[data-test-pki-generate-button]');
-    const myLeafCert = find(SELECTORS.copyButton('Certificate')).getAttribute('data-test-copy-button');
+    await click(GENERAL.submitButton);
+    await click(PKI_CROSS_SIGN.copyButton('Certificate'));
+    const myLeafCert = clipboardSpy.lastCall.args[0];
 
     // see comments in utils/parse-pki-cert.js for step-by-step explanation of of verifyCertificates method
     assert.true(
       await verifyCertificates(oldIntCert, newIntCert, myLeafCert),
       'the leaf certificate validates against both intermediate certificates'
     );
+    // Restore original clipboard
+    clipboardSpy.restore(); // cleanup
   });
 });
diff --git a/ui/tests/acceptance/pki/pki-engine-route-cleanup-test.js b/ui/tests/acceptance/pki/pki-engine-route-cleanup-test.js
index 3e9186a5b9e..ef3fc32e6a4 100644
--- a/ui/tests/acceptance/pki/pki-engine-route-cleanup-test.js
+++ b/ui/tests/acceptance/pki/pki-engine-route-cleanup-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,32 +7,38 @@ import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
 import { click, currentURL, fillIn, visit } from '@ember/test-helpers';
 import { runCmd } from 'vault/tests/helpers/commands';
-import { SELECTORS } from 'vault/tests/helpers/pki/workflow';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import {
+  PKI_CONFIGURE_CREATE,
+  PKI_ISSUER_DETAILS,
+  PKI_ISSUER_LIST,
+  PKI_KEYS,
+  PKI_ROLE_DETAILS,
+} from 'vault/tests/helpers/pki/pki-selectors';
 
+const OVERVIEW_BREADCRUMB = '[data-test-breadcrumbs] li:nth-of-type(2) > a';
 /**
- * This test module should test that dirty route models are cleaned up when the user leaves the page
+ * This test module should test that dirty route models are cleaned up when
+ * the user leaves the page via cancel or breadcrumb navigation
  */
 module('Acceptance | pki engine route cleanup test', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(async function () {
     this.store = this.owner.lookup('service:store');
-    await authPage.login();
+    await login();
     // Setup PKI engine
     const mountPath = `pki-workflow-${uuidv4()}`;
     await enablePage.enable('pki', mountPath);
     this.mountPath = mountPath;
-    await logout.visit();
   });
 
   hooks.afterEach(async function () {
-    await logout.visit();
-    await authPage.login();
+    await login();
     // Cleanup engine
     await runCmd([`delete sys/mounts/${this.mountPath}`]);
   });
@@ -40,33 +46,33 @@ module('Acceptance | pki engine route cleanup test', function (hooks) {
   module('configuration', function () {
     test('create config', async function (assert) {
       let configs, urls, config;
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.emptyStateLink);
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(`${GENERAL.emptyStateActions} a`);
       configs = this.store.peekAll('pki/action');
       urls = this.store.peekRecord('pki/config/urls', this.mountPath);
-      config = configs.objectAt(0);
+      config = configs.at(0);
       assert.strictEqual(configs.length, 1, 'One config model present');
       assert.false(urls.hasDirtyAttributes, 'URLs is loaded from endpoint');
       assert.true(config.hasDirtyAttributes, 'Config model is dirty');
 
       // Cancel button rolls it back
-      await click(SELECTORS.configuration.cancelButton);
+      await click(GENERAL.cancelButton);
       configs = this.store.peekAll('pki/action');
       urls = this.store.peekRecord('pki/config/urls', this.mountPath);
       assert.strictEqual(configs.length, 0, 'config model is rolled back on cancel');
       assert.strictEqual(urls.id, this.mountPath, 'Urls still exists on exit');
 
-      await click(SELECTORS.emptyStateLink);
+      await click(`${GENERAL.emptyStateActions} a`);
       configs = this.store.peekAll('pki/action');
       urls = this.store.peekRecord('pki/config/urls', this.mountPath);
-      config = configs.objectAt(0);
+      config = configs.at(0);
       assert.strictEqual(configs.length, 1, 'One config model present');
       assert.false(urls.hasDirtyAttributes, 'URLs is loaded from endpoint');
       assert.true(config.hasDirtyAttributes, 'Config model is dirty');
 
       // Exit page via link rolls it back
-      await click(SELECTORS.overviewBreadcrumb);
+      await click(OVERVIEW_BREADCRUMB);
       configs = this.store.peekAll('pki/action');
       urls = this.store.peekRecord('pki/config/urls', this.mountPath);
       assert.strictEqual(configs.length, 0, 'config model is rolled back on cancel');
@@ -76,89 +82,91 @@ module('Acceptance | pki engine route cleanup test', function (hooks) {
 
   module('role routes', function (hooks) {
     hooks.beforeEach(async function () {
-      await authPage.login();
+      await login();
       // Configure PKI
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.emptyStateLink);
-      await click(SELECTORS.configuration.optionByKey('generate-root'));
-      await fillIn(SELECTORS.configuration.typeField, 'internal');
-      await fillIn(SELECTORS.configuration.inputByName('commonName'), 'my-root-cert');
-      await click(SELECTORS.configuration.generateRootSave);
-      await logout.visit();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(`${GENERAL.emptyStateActions} a`);
+      await click(PKI_CONFIGURE_CREATE.optionByKey('generate-root'));
+      await fillIn(GENERAL.inputByAttr('type'), 'internal');
+      await fillIn(GENERAL.inputByAttr('commonName'), 'my-root-cert');
+      await click(GENERAL.submitButton);
     });
 
     test('create role exit via cancel', async function (assert) {
       let roles;
-      await authPage.login();
+      await login();
       // Create PKI
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.rolesTab);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Roles'));
       roles = this.store.peekAll('pki/role');
       assert.strictEqual(roles.length, 0, 'No roles exist yet');
-      await click(SELECTORS.createRoleLink);
+      await click(PKI_ROLE_DETAILS.createRoleLink);
       roles = this.store.peekAll('pki/role');
-      const role = roles.objectAt(0);
+      const role = roles.at(0);
       assert.strictEqual(roles.length, 1, 'New role exists');
       assert.true(role.isNew, 'Role is new model');
-      await click(SELECTORS.roleForm.roleCancelButton);
+      await click(GENERAL.cancelButton);
       roles = this.store.peekAll('pki/role');
       assert.strictEqual(roles.length, 0, 'Role is removed from store');
     });
     test('create role exit via breadcrumb', async function (assert) {
       let roles;
-      await authPage.login();
+      await login();
       // Create PKI
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.rolesTab);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Roles'));
       roles = this.store.peekAll('pki/role');
       assert.strictEqual(roles.length, 0, 'No roles exist yet');
-      await click(SELECTORS.createRoleLink);
+      await click(PKI_ROLE_DETAILS.createRoleLink);
       roles = this.store.peekAll('pki/role');
-      const role = roles.objectAt(0);
+      const role = roles.at(0);
       assert.strictEqual(roles.length, 1, 'New role exists');
       assert.true(role.isNew, 'Role is new model');
-      await click(SELECTORS.overviewBreadcrumb);
+      await click(OVERVIEW_BREADCRUMB);
       roles = this.store.peekAll('pki/role');
       assert.strictEqual(roles.length, 0, 'Role is removed from store');
     });
     test('edit role', async function (assert) {
       let roles, role;
       const roleId = 'workflow-edit-role';
-      await authPage.login();
+      await login();
       // Create PKI
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.rolesTab);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Roles'));
       roles = this.store.peekAll('pki/role');
       assert.strictEqual(roles.length, 0, 'No roles exist yet');
-      await click(SELECTORS.createRoleLink);
-      await fillIn(SELECTORS.roleForm.roleName, roleId);
-      await click(SELECTORS.roleForm.roleCreateButton);
-      assert.dom('[data-test-value-div="Role name"]').hasText(roleId, 'Shows correct role after create');
+      await click(PKI_ROLE_DETAILS.createRoleLink);
+      await fillIn(GENERAL.inputByAttr('name'), roleId);
+      await click(GENERAL.submitButton);
+      assert.dom(GENERAL.infoRowValue('Role name')).hasText(roleId, 'Shows correct role after create');
       roles = this.store.peekAll('pki/role');
-      role = roles.objectAt(0);
+      role = roles.at(0);
       assert.strictEqual(roles.length, 1, 'Role is created');
       assert.false(role.hasDirtyAttributes, 'Role no longer has dirty attributes');
 
       // Edit role
-      await click(SELECTORS.editRoleLink);
-      await click(SELECTORS.roleForm.issuerRefToggle);
-      await fillIn(SELECTORS.roleForm.issuerRefSelect, 'foobar');
+      await click(PKI_ROLE_DETAILS.editRoleLink);
+      await click(GENERAL.ttl.toggle('issuerRef-toggle'));
+      await fillIn(GENERAL.selectByAttr('issuerRef'), 'foobar');
       role = this.store.peekRecord('pki/role', roleId);
       assert.true(role.hasDirtyAttributes, 'Role has dirty attrs');
       // Exit page via cancel button
-      await click(SELECTORS.roleForm.roleCancelButton);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles/${roleId}/details`);
+      await click(GENERAL.cancelButton);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.mountPath}/pki/roles/${roleId}/details`
+      );
       role = this.store.peekRecord('pki/role', roleId);
       assert.false(role.hasDirtyAttributes, 'Role dirty attrs have been rolled back');
 
       // Edit again
-      await click(SELECTORS.editRoleLink);
-      await click(SELECTORS.roleForm.issuerRefToggle);
-      await fillIn(SELECTORS.roleForm.issuerRefSelect, 'foobar2');
+      await click(PKI_ROLE_DETAILS.editRoleLink);
+      await click(GENERAL.ttl.toggle('issuerRef-toggle'));
+      await fillIn(GENERAL.selectByAttr('issuerRef'), 'foobar2');
       role = this.store.peekRecord('pki/role', roleId);
       assert.true(role.hasDirtyAttributes, 'Role has dirty attrs');
       // Exit page via breadcrumbs
-      await click(SELECTORS.overviewBreadcrumb);
+      await click(OVERVIEW_BREADCRUMB);
       role = this.store.peekRecord('pki/role', roleId);
       assert.false(role.hasDirtyAttributes, 'Role dirty attrs have been rolled back');
     });
@@ -167,148 +175,148 @@ module('Acceptance | pki engine route cleanup test', function (hooks) {
   module('issuer routes', function () {
     test('import issuer exit via cancel', async function (assert) {
       let issuers;
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.issuersTab);
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Issuers'));
       issuers = this.store.peekAll('pki/issuer');
       assert.strictEqual(issuers.length, 0, 'No issuer models exist yet');
-      await click(SELECTORS.importIssuerLink);
+      await click(PKI_ISSUER_LIST.importIssuerLink);
       issuers = this.store.peekAll('pki/action');
       assert.strictEqual(issuers.length, 1, 'Action model created');
-      const issuer = issuers.objectAt(0);
+      const issuer = issuers.at(0);
       assert.true(issuer.hasDirtyAttributes, 'Action has dirty attrs');
       assert.true(issuer.isNew, 'Action is new');
       // Exit
       await click('[data-test-pki-ca-cert-cancel]');
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/issuers`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/issuers`);
       issuers = this.store.peekAll('pki/action');
       assert.strictEqual(issuers.length, 0, 'Action is removed from store');
     });
     test('import issuer exit via breadcrumb', async function (assert) {
       let issuers;
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.issuersTab);
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Issuers'));
       issuers = this.store.peekAll('pki/issuer');
       assert.strictEqual(issuers.length, 0, 'No issuers exist yet');
-      await click(SELECTORS.importIssuerLink);
+      await click(PKI_ISSUER_LIST.importIssuerLink);
       issuers = this.store.peekAll('pki/action');
       assert.strictEqual(issuers.length, 1, 'Action model created');
-      const issuer = issuers.objectAt(0);
+      const issuer = issuers.at(0);
       assert.true(issuer.hasDirtyAttributes, 'Action model has dirty attrs');
       assert.true(issuer.isNew, 'Action model is new');
       // Exit
-      await click(SELECTORS.overviewBreadcrumb);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
+      await click(OVERVIEW_BREADCRUMB);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
       issuers = this.store.peekAll('pki/action');
       assert.strictEqual(issuers.length, 0, 'Issuer is removed from store');
     });
     test('generate root exit via cancel', async function (assert) {
       let actions;
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.issuersTab);
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Issuers'));
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 0, 'No actions exist yet');
-      await click(SELECTORS.generateIssuerDropdown);
-      await click(SELECTORS.generateIssuerRoot);
+      await click(PKI_ISSUER_LIST.generateIssuerDropdown);
+      await click(PKI_ISSUER_LIST.generateIssuerRoot);
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 1, 'Action model for generate-root created');
-      const action = actions.objectAt(0);
+      const action = actions.at(0);
       assert.true(action.hasDirtyAttributes, 'Action has dirty attrs');
       assert.true(action.isNew, 'Action is new');
       assert.strictEqual(action.actionType, 'generate-root', 'Action type is correct');
       // Exit
-      await click(SELECTORS.configuration.generateRootCancel);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/issuers`);
+      await click(GENERAL.cancelButton);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/issuers`);
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 0, 'Action is removed from store');
     });
     test('generate root exit via breadcrumb', async function (assert) {
       let actions;
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.issuersTab);
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Issuers'));
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 0, 'No actions exist yet');
-      await click(SELECTORS.generateIssuerDropdown);
-      await click(SELECTORS.generateIssuerRoot);
+      await click(PKI_ISSUER_LIST.generateIssuerDropdown);
+      await click(PKI_ISSUER_LIST.generateIssuerRoot);
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 1, 'Action model for generate-root created');
-      const action = actions.objectAt(0);
+      const action = actions.at(0);
       assert.true(action.hasDirtyAttributes, 'Action has dirty attrs');
       assert.true(action.isNew, 'Action is new');
       assert.strictEqual(action.actionType, 'generate-root');
       // Exit
-      await click(SELECTORS.overviewBreadcrumb);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
+      await click(OVERVIEW_BREADCRUMB);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 0, 'Action is removed from store');
     });
     test('generate intermediate csr exit via cancel', async function (assert) {
       let actions;
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.issuersTab);
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Issuers'));
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 0, 'No actions exist yet');
-      await await click(SELECTORS.generateIssuerDropdown);
-      await click(SELECTORS.generateIssuerIntermediate);
+      await await click(PKI_ISSUER_LIST.generateIssuerDropdown);
+      await click(PKI_ISSUER_LIST.generateIssuerIntermediate);
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 1, 'Action model for generate-csr created');
-      const action = actions.objectAt(0);
+      const action = actions.at(0);
       assert.true(action.hasDirtyAttributes, 'Action has dirty attrs');
       assert.true(action.isNew, 'Action is new');
       assert.strictEqual(action.actionType, 'generate-csr');
       // Exit
       await click('[data-test-cancel]');
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/issuers`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/issuers`);
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 0, 'Action is removed from store');
     });
     test('generate intermediate csr exit via breadcrumb', async function (assert) {
       let actions;
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.issuersTab);
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Issuers'));
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 0, 'No actions exist yet');
-      await click(SELECTORS.generateIssuerDropdown);
-      await click(SELECTORS.generateIssuerIntermediate);
+      await click(PKI_ISSUER_LIST.generateIssuerDropdown);
+      await click(PKI_ISSUER_LIST.generateIssuerIntermediate);
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 1, 'Action model for generate-csr created');
-      const action = actions.objectAt(0);
+      const action = actions.at(0);
       assert.true(action.hasDirtyAttributes, 'Action has dirty attrs');
       assert.true(action.isNew, 'Action is new');
       assert.strictEqual(action.actionType, 'generate-csr');
       // Exit
-      await click(SELECTORS.overviewBreadcrumb);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
+      await click(OVERVIEW_BREADCRUMB);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
       actions = this.store.peekAll('pki/action');
       assert.strictEqual(actions.length, 0, 'Action is removed from store');
     });
     test('edit issuer exit', async function (assert) {
       let issuers, issuer;
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.emptyStateLink);
-      await click(SELECTORS.configuration.optionByKey('generate-root'));
-      await fillIn(SELECTORS.configuration.typeField, 'internal');
-      await fillIn(SELECTORS.configuration.inputByName('commonName'), 'my-root-cert');
-      await click(SELECTORS.configuration.generateRootSave);
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(`${GENERAL.emptyStateActions} a`);
+      await click(PKI_CONFIGURE_CREATE.optionByKey('generate-root'));
+      await fillIn(GENERAL.inputByAttr('type'), 'internal');
+      await fillIn(GENERAL.inputByAttr('commonName'), 'my-root-cert');
+      await click(GENERAL.submitButton);
       // Go to list view so we fetch all the issuers
-      await visit(`/vault/secrets/${this.mountPath}/pki/issuers`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/issuers`);
 
       issuers = this.store.peekAll('pki/issuer');
-      const issuerId = issuers.objectAt(0).id;
+      const issuerId = issuers.at(0).id;
       assert.strictEqual(issuers.length, 1, 'Issuer exists on model in list');
-      await visit(`/vault/secrets/${this.mountPath}/pki/issuers/${issuerId}/details`);
-      await click(SELECTORS.issuerDetails.configure);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/issuers/${issuerId}/details`);
+      await click(PKI_ISSUER_DETAILS.configure);
       issuer = this.store.peekRecord('pki/issuer', issuerId);
       assert.false(issuer.hasDirtyAttributes, 'Model not dirty');
       await fillIn('[data-test-input="issuerName"]', 'foobar');
       assert.true(issuer.hasDirtyAttributes, 'Model is dirty');
-      await click(SELECTORS.overviewBreadcrumb);
+      await click(OVERVIEW_BREADCRUMB);
       issuers = this.store.peekAll('pki/issuer');
       assert.strictEqual(issuers.length, 1, 'Issuer exists on model in overview');
       issuer = this.store.peekRecord('pki/issuer', issuerId);
@@ -318,69 +326,72 @@ module('Acceptance | pki engine route cleanup test', function (hooks) {
 
   module('key routes', function (hooks) {
     hooks.beforeEach(async function () {
-      await authPage.login();
+      await login();
       // Configure PKI -- key creation not allowed unless configured
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.emptyStateLink);
-      await click(SELECTORS.configuration.optionByKey('generate-root'));
-      await fillIn(SELECTORS.configuration.typeField, 'internal');
-      await fillIn(SELECTORS.configuration.inputByName('commonName'), 'my-root-cert');
-      await click(SELECTORS.configuration.generateRootSave);
-      await logout.visit();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(`${GENERAL.emptyStateActions} a`);
+      await click(PKI_CONFIGURE_CREATE.optionByKey('generate-root'));
+      await fillIn(GENERAL.inputByAttr('type'), 'internal');
+      await fillIn(GENERAL.inputByAttr('commonName'), 'my-root-cert');
+      await click(GENERAL.submitButton);
     });
     test('create key exit', async function (assert) {
       let keys, key;
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.keysTab);
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Keys'));
       keys = this.store.peekAll('pki/key');
-      const configKeyId = keys.objectAt(0).id;
+      const configKeyId = keys.at(0).id;
       assert.strictEqual(keys.length, 1, 'One key exists from config');
       // Create key
-      await click(SELECTORS.keyPages.generateKey);
+      await click(PKI_KEYS.generateKey);
       keys = this.store.peekAll('pki/key');
-      key = keys.objectAt(1);
+      key = keys.at(1);
       assert.strictEqual(keys.length, 2, 'New key exists');
       assert.true(key.isNew, 'Role is new model');
       // Exit
-      await click(SELECTORS.keyForm.keyCancelButton);
+      await click(GENERAL.cancelButton);
       keys = this.store.peekAll('pki/key');
       assert.strictEqual(keys.length, 1, 'Second key is removed from store');
-      assert.strictEqual(keys.objectAt(0).id, configKeyId);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys`, 'url is correct');
+      assert.strictEqual(keys.at(0).id, configKeyId);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/keys`, 'url is correct');
 
       // Create again
-      await click(SELECTORS.keyPages.generateKey);
+      await click(PKI_KEYS.generateKey);
       assert.strictEqual(keys.length, 2, 'New key exists');
       keys = this.store.peekAll('pki/key');
-      key = keys.objectAt(1);
+      key = keys.at(1);
       assert.true(key.isNew, 'Key is new model');
       // Exit
-      await click(SELECTORS.overviewBreadcrumb);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`, 'url is correct');
+      await click(OVERVIEW_BREADCRUMB);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.mountPath}/pki/overview`,
+        'url is correct'
+      );
       keys = this.store.peekAll('pki/key');
       assert.strictEqual(keys.length, 1, 'Key is removed from store');
     });
     test('edit key exit', async function (assert) {
       let keys, key;
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.keysTab);
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Keys'));
       keys = this.store.peekAll('pki/key');
       assert.strictEqual(keys.length, 1, 'One key from config exists');
       assert.dom('.list-item-row').exists({ count: 1 }, 'single row for key');
       await click('.list-item-row');
       // Edit
-      await click(SELECTORS.keyPages.keyEditLink);
-      await fillIn(SELECTORS.keyForm.keyNameInput, 'foobar');
+      await click(PKI_KEYS.keyEditLink);
+      await fillIn(GENERAL.inputByAttr('keyName'), 'foobar');
       keys = this.store.peekAll('pki/key');
-      key = keys.objectAt(0);
+      key = keys.at(0);
       assert.true(key.hasDirtyAttributes, 'Key model is dirty');
       // Exit
-      await click(SELECTORS.keyForm.keyCancelButton);
+      await click(GENERAL.cancelButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/keys/${key.id}/details`,
+        `/vault/secrets-engines/${this.mountPath}/pki/keys/${key.id}/details`,
         'url is correct'
       );
       keys = this.store.peekAll('pki/key');
@@ -388,15 +399,19 @@ module('Acceptance | pki engine route cleanup test', function (hooks) {
       assert.false(key.hasDirtyAttributes, 'Key dirty attrs have been rolled back');
 
       // Edit again
-      await click(SELECTORS.keyPages.keyEditLink);
-      await fillIn(SELECTORS.keyForm.keyNameInput, 'foobar');
+      await click(PKI_KEYS.keyEditLink);
+      await fillIn(GENERAL.inputByAttr('keyName'), 'foobar');
       keys = this.store.peekAll('pki/key');
-      key = keys.objectAt(0);
+      key = keys.at(0);
       assert.true(key.hasDirtyAttributes, 'Key model is dirty');
 
       // Exit via breadcrumb
-      await click(SELECTORS.overviewBreadcrumb);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`, 'url is correct');
+      await click(OVERVIEW_BREADCRUMB);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.mountPath}/pki/overview`,
+        'url is correct'
+      );
       keys = this.store.peekAll('pki/key');
       assert.strictEqual(keys.length, 1, 'Key list has 1');
       assert.false(key.hasDirtyAttributes, 'Key dirty attrs have been rolled back');
diff --git a/ui/tests/acceptance/pki/pki-engine-workflow-test.js b/ui/tests/acceptance/pki/pki-engine-workflow-test.js
index 395bf41c19a..30b90175806 100644
--- a/ui/tests/acceptance/pki/pki-engine-workflow-test.js
+++ b/ui/tests/acceptance/pki/pki-engine-workflow-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,18 +7,26 @@ import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
 import { click, currentURL, fillIn, find, isSettled, visit } from '@ember/test-helpers';
-import { SELECTORS } from 'vault/tests/helpers/pki/workflow';
-import { adminPolicy, readerPolicy, updatePolicy } from 'vault/tests/helpers/policy-generator/pki';
-import { clearRecords } from 'vault/tests/helpers/pki/pki-run-commands';
+import { adminPolicy, readerPolicy, updatePolicy } from 'vault/tests/helpers/pki/policy-generator';
 import { runCmd, tokenWithPolicyCmd } from 'vault/tests/helpers/commands';
-import { unsupportedPem } from 'vault/tests/helpers/pki/values';
 import { create } from 'ember-cli-page-object';
 import flashMessage from 'vault/tests/pages/components/flash-message';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CERTIFICATES, clearRecords } from 'vault/tests/helpers/pki/pki-helpers';
+import {
+  PKI_CONFIGURE_CREATE,
+  PKI_CONFIG_EDIT,
+  PKI_ISSUER_DETAILS,
+  PKI_ISSUER_LIST,
+  PKI_KEYS,
+  PKI_ROLE_DETAILS,
+} from 'vault/tests/helpers/pki/pki-selectors';
+
 const flash = create(flashMessage);
+const { unsupportedPem } = CERTIFICATES;
 /**
  * This test module should test the PKI workflow, including:
  * - link between pages and confirm that the url is as expected
@@ -29,71 +37,68 @@ module('Acceptance | pki workflow', function (hooks) {
 
   hooks.beforeEach(async function () {
     this.store = this.owner.lookup('service:store');
-    await authPage.login();
+    await login();
     // Setup PKI engine
     const mountPath = `pki-workflow-${uuidv4()}`;
     await enablePage.enable('pki', mountPath);
     this.mountPath = mountPath;
-    await logout.visit();
     clearRecords(this.store);
   });
 
   hooks.afterEach(async function () {
-    await logout.visit();
-    await authPage.login();
+    await login();
     // Cleanup engine
     await runCmd([`delete sys/mounts/${this.mountPath}`]);
   });
 
   module('not configured', function (hooks) {
     hooks.beforeEach(async function () {
-      await authPage.login();
+      await login();
       const pki_admin_policy = adminPolicy(this.mountPath, 'roles');
       this.pkiAdminToken = await runCmd(tokenWithPolicyCmd(`pki-admin-${this.mountPath}`, pki_admin_policy));
-      await logout.visit();
       clearRecords(this.store);
     });
 
     test('empty state messages are correct when PKI not configured', async function (assert) {
       assert.expect(21);
       const assertEmptyState = (assert, resource) => {
-        assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/${resource}`);
+        assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/${resource}`);
         assert
-          .dom(SELECTORS.emptyStateTitle)
+          .dom(GENERAL.emptyStateTitle)
           .hasText(
             'PKI not configured',
             `${resource} index renders correct empty state title when PKI not configured`
           );
-        assert.dom(SELECTORS.emptyStateLink).hasText('Configure PKI');
+        assert.dom(GENERAL.emptyStateActions).hasText('Configure PKI');
         assert
-          .dom(SELECTORS.emptyStateMessage)
+          .dom(GENERAL.emptyStateMessage)
           .hasText(
             `This PKI mount hasn't yet been configured with a certificate issuer.`,
             `${resource} index empty state message correct when PKI not configured`
           );
       };
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
 
-      await click(SELECTORS.rolesTab);
+      await click(GENERAL.secretTab('Roles'));
       assertEmptyState(assert, 'roles');
 
-      await click(SELECTORS.issuersTab);
+      await click(GENERAL.secretTab('Issuers'));
       assertEmptyState(assert, 'issuers');
 
-      await click(SELECTORS.certsTab);
+      await click(GENERAL.secretTab('Certificates'));
       assertEmptyState(assert, 'certificates');
-      await click(SELECTORS.keysTab);
+      await click(GENERAL.secretTab('Keys'));
       assertEmptyState(assert, 'keys');
-      await click(SELECTORS.tidyTab);
+      await click(GENERAL.secretTab('Tidy'));
       assertEmptyState(assert, 'tidy');
     });
   });
 
   module('roles', function (hooks) {
     hooks.beforeEach(async function () {
-      await authPage.login();
+      await login();
       // Setup role-specific items
       await runCmd([
         `write ${this.mountPath}/roles/some-role \
@@ -102,6 +107,7 @@ module('Acceptance | pki workflow', function (hooks) {
       allow_subdomains=true \
       max_ttl="720h"`,
       ]);
+
       await runCmd([`write ${this.mountPath}/root/generate/internal common_name="Hashicorp Test"`]);
       const pki_admin_policy = adminPolicy(this.mountPath, 'roles');
       const pki_reader_policy = readerPolicy(this.mountPath, 'roles');
@@ -113,134 +119,148 @@ module('Acceptance | pki workflow', function (hooks) {
         tokenWithPolicyCmd(`pki-editor-${this.mountPath}`, pki_editor_policy)
       );
       this.pkiAdminToken = await runCmd(tokenWithPolicyCmd(`pki-admin-${this.mountPath}`, pki_admin_policy));
-      await logout.visit();
       clearRecords(this.store);
     });
 
     test('shows correct items if user has all permissions', async function (assert) {
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.dom(SELECTORS.rolesTab).exists('Roles tab is present');
-      await click(SELECTORS.rolesTab);
-      assert.dom(SELECTORS.createRoleLink).exists({ count: 1 }, 'Create role link is rendered');
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles`);
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.dom(GENERAL.secretTab('Roles')).exists('Roles tab is present');
+      await click(GENERAL.secretTab('Roles'));
+      assert.dom(PKI_ROLE_DETAILS.createRoleLink).exists({ count: 1 }, 'Create role link is rendered');
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/roles`);
       assert.dom('.linked-block').exists({ count: 1 }, 'One role is in list');
       await click('.linked-block');
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles/some-role/details`);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/details`
+      );
 
-      assert.dom(SELECTORS.generateCertLink).exists('Generate cert link is shown');
-      await click(SELECTORS.generateCertLink);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles/some-role/generate`);
+      assert.dom(PKI_ROLE_DETAILS.generateCertLink).exists('Generate cert link is shown');
+      await click(PKI_ROLE_DETAILS.generateCertLink);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/generate`
+      );
 
       // Go back to details and test all the links
-      await visit(`/vault/secrets/${this.mountPath}/pki/roles/some-role/details`);
-      assert.dom(SELECTORS.signCertLink).exists('Sign cert link is shown');
-      await click(SELECTORS.signCertLink);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles/some-role/sign`);
-
-      await visit(`/vault/secrets/${this.mountPath}/pki/roles/some-role/details`);
-      assert.dom(SELECTORS.editRoleLink).exists('Edit link is shown');
-      await click(SELECTORS.editRoleLink);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles/some-role/edit`);
-
-      await visit(`/vault/secrets/${this.mountPath}/pki/roles/some-role/details`);
-      assert.dom(SELECTORS.deleteRoleButton).exists('Delete role button is shown');
-      await click(SELECTORS.deleteRoleButton);
-      await click('[data-test-confirm-button]');
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/details`);
+      assert.dom(PKI_ROLE_DETAILS.signCertLink).exists('Sign cert link is shown');
+      await click(PKI_ROLE_DETAILS.signCertLink);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/sign`);
+
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/details`);
+      assert.dom(PKI_ROLE_DETAILS.editRoleLink).exists('Edit link is shown');
+      await click(PKI_ROLE_DETAILS.editRoleLink);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/edit`);
+
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/details`);
+      assert.dom(PKI_ROLE_DETAILS.deleteRoleButton).exists('Delete role button is shown');
+      await click(PKI_ROLE_DETAILS.deleteRoleButton);
+      await click(GENERAL.confirmButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/roles`,
+        `/vault/secrets-engines/${this.mountPath}/pki/roles`,
         'redirects to roles list after deletion'
       );
     });
 
     test('it does not show toolbar items the user does not have permission to see', async function (assert) {
-      await authPage.login(this.pkiRoleReader);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.dom(SELECTORS.rolesTab).exists('Roles tab is present');
-      await click(SELECTORS.rolesTab);
-      assert.dom(SELECTORS.createRoleLink).exists({ count: 1 }, 'Create role link is rendered');
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles`);
+      await login(this.pkiRoleReader);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.dom(GENERAL.secretTab('Roles')).exists('Roles tab is present');
+      await click(GENERAL.secretTab('Roles'));
+      assert.dom(PKI_ROLE_DETAILS.createRoleLink).exists({ count: 1 }, 'Create role link is rendered');
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/roles`);
       assert.dom('.linked-block').exists({ count: 1 }, 'One role is in list');
       await click('.linked-block');
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles/some-role/details`);
-      assert.dom(SELECTORS.deleteRoleButton).doesNotExist('Delete role button is not shown');
-      assert.dom(SELECTORS.generateCertLink).doesNotExist('Generate cert link is not shown');
-      assert.dom(SELECTORS.signCertLink).doesNotExist('Sign cert link is not shown');
-      assert.dom(SELECTORS.editRoleLink).doesNotExist('Edit link is not shown');
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/details`
+      );
+      assert.dom(PKI_ROLE_DETAILS.deleteRoleButton).doesNotExist('Delete role button is not shown');
+      assert.dom(PKI_ROLE_DETAILS.generateCertLink).doesNotExist('Generate cert link is not shown');
+      assert.dom(PKI_ROLE_DETAILS.signCertLink).doesNotExist('Sign cert link is not shown');
+      assert.dom(PKI_ROLE_DETAILS.editRoleLink).doesNotExist('Edit link is not shown');
     });
 
     test('it shows correct toolbar items for the user policy', async function (assert) {
-      await authPage.login(this.pkiRoleEditor);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.dom(SELECTORS.rolesTab).exists('Roles tab is present');
-      await click(SELECTORS.rolesTab);
-      assert.dom(SELECTORS.createRoleLink).exists({ count: 1 }, 'Create role link is rendered');
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles`);
+      await login(this.pkiRoleEditor);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.dom(GENERAL.secretTab('Roles')).exists('Roles tab is present');
+      await click(GENERAL.secretTab('Roles'));
+      assert.dom(PKI_ROLE_DETAILS.createRoleLink).exists({ count: 1 }, 'Create role link is rendered');
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/roles`);
       assert.dom('.linked-block').exists({ count: 1 }, 'One role is in list');
       await click('.linked-block');
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles/some-role/details`);
-      assert.dom(SELECTORS.deleteRoleButton).doesNotExist('Delete role button is not shown');
-      assert.dom(SELECTORS.generateCertLink).exists('Generate cert link is shown');
-      assert.dom(SELECTORS.signCertLink).exists('Sign cert link is shown');
-      assert.dom(SELECTORS.editRoleLink).exists('Edit link is shown');
-      await click(SELECTORS.editRoleLink);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/roles/some-role/edit`,
+        `/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/details`
+      );
+      assert.dom(PKI_ROLE_DETAILS.deleteRoleButton).doesNotExist('Delete role button is not shown');
+      assert.dom(PKI_ROLE_DETAILS.generateCertLink).exists('Generate cert link is shown');
+      assert.dom(PKI_ROLE_DETAILS.signCertLink).exists('Sign cert link is shown');
+      assert.dom(PKI_ROLE_DETAILS.editRoleLink).exists('Edit link is shown');
+      await click(PKI_ROLE_DETAILS.editRoleLink);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/edit`,
         'Links to edit view'
       );
-      await click(SELECTORS.roleForm.roleCancelButton);
+      await click(GENERAL.cancelButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/roles/some-role/details`,
+        `/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/details`,
         'Cancel from edit goes to details'
       );
-      await click(SELECTORS.generateCertLink);
+      await click(PKI_ROLE_DETAILS.generateCertLink);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/roles/some-role/generate`,
+        `/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/generate`,
         'Generate cert button goes to generate page'
       );
-      await click(SELECTORS.generateCertForm.cancelButton);
+      await click(GENERAL.cancelButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/roles/some-role/details`,
+        `/vault/secrets-engines/${this.mountPath}/pki/roles/some-role/details`,
         'Cancel from generate goes to details'
       );
     });
 
     test('create role happy path', async function (assert) {
       const roleName = 'another-role';
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.dom(SELECTORS.emptyState).doesNotExist();
-      await click(SELECTORS.rolesTab);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles`);
-      await click(SELECTORS.createRoleLink);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles/create`);
-      assert.dom(SELECTORS.breadcrumbContainer).exists({ count: 1 }, 'breadcrumbs are rendered');
-      assert.dom(SELECTORS.breadcrumbs).exists({ count: 4 }, 'Shows 4 breadcrumbs');
-      assert.dom(SELECTORS.pageTitle).hasText('Create a PKI Role');
-
-      await fillIn(SELECTORS.roleForm.roleName, roleName);
-      await click(SELECTORS.roleForm.roleCreateButton);
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.dom(GENERAL.emptyStateTitle).doesNotExist();
+      await click(GENERAL.secretTab('Roles'));
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/roles`);
+      await click(PKI_ROLE_DETAILS.createRoleLink);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/roles/create`);
+      assert.dom(GENERAL.breadcrumbs).exists({ count: 1 }, 'breadcrumbs are rendered');
+      assert.dom(GENERAL.breadcrumb).exists({ count: 4 }, 'Shows 4 breadcrumbs');
+      assert.dom(GENERAL.title).hasText('Create a PKI Role');
+
+      await fillIn(GENERAL.inputByAttr('name'), roleName);
+      await click(GENERAL.submitButton);
       assert.strictEqual(
         flash.latestMessage,
         `Successfully created the role ${roleName}.`,
         'renders success flash upon creation'
       );
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles/${roleName}/details`);
-      assert.dom(SELECTORS.breadcrumbs).exists({ count: 4 }, 'Shows 4 breadcrumbs');
-      assert.dom(SELECTORS.pageTitle).hasText(`PKI Role ${roleName}`);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.mountPath}/pki/roles/${roleName}/details`
+      );
+      assert.dom(GENERAL.breadcrumb).exists({ count: 4 }, 'Shows 4 breadcrumbs');
+      assert.dom(GENERAL.title).hasText(`PKI Role ${roleName}`);
     });
   });
 
   module('keys', function (hooks) {
     hooks.beforeEach(async function () {
-      await authPage.login();
+      await login();
       // base config pki so empty state doesn't show
       await runCmd([`write ${this.mountPath}/root/generate/internal common_name="Hashicorp Test"`]);
       const pki_admin_policy = adminPolicy(this.mountPath);
@@ -249,150 +269,148 @@ module('Acceptance | pki workflow', function (hooks) {
       this.pkiKeyReader = await runCmd(tokenWithPolicyCmd(`pki-reader-${this.mountPath}`, pki_reader_policy));
       this.pkiKeyEditor = await runCmd(tokenWithPolicyCmd(`pki-editor-${this.mountPath}`, pki_editor_policy));
       this.pkiAdminToken = await runCmd(tokenWithPolicyCmd(`pki-admin-${this.mountPath}`, pki_admin_policy));
-      await logout.visit();
       clearRecords(this.store);
     });
 
     test('shows correct items if user has all permissions', async function (assert) {
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.keysTab);
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Keys'));
       // index page
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/keys`);
       assert
-        .dom(SELECTORS.keyPages.importKey)
+        .dom(PKI_KEYS.importKey)
         .hasAttribute(
           'href',
-          `/ui/vault/secrets/${this.mountPath}/pki/keys/import`,
+          `/ui/vault/secrets-engines/${this.mountPath}/pki/keys/import`,
           'import link renders with correct url'
         );
-      let keyId = find(SELECTORS.keyPages.keyId).innerText;
+      let keyId = find(PKI_KEYS.keyId).innerText;
       assert.dom('.linked-block').exists({ count: 1 }, 'One key is in list');
       await click('.linked-block');
       // details page
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys/${keyId}/details`);
-      assert.dom(SELECTORS.keyPages.downloadButton).doesNotExist('does not download button for private key');
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/keys/${keyId}/details`);
+      assert.dom(GENERAL.button('Download')).doesNotExist('does not download button for private key');
 
       // edit page
-      await click(SELECTORS.keyPages.keyEditLink);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys/${keyId}/edit`);
-      await click(SELECTORS.keyForm.keyCancelButton);
+      await click(PKI_KEYS.keyEditLink);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/keys/${keyId}/edit`);
+      await click(GENERAL.cancelButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/keys/${keyId}/details`,
+        `/vault/secrets-engines/${this.mountPath}/pki/keys/${keyId}/details`,
         'navigates back to details on cancel'
       );
-      await visit(`/vault/secrets/${this.mountPath}/pki/keys/${keyId}/edit`);
-      await fillIn(SELECTORS.keyForm.keyNameInput, 'test-key');
-      await click(SELECTORS.keyForm.keyCreateButton);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/keys/${keyId}/edit`);
+      await fillIn(GENERAL.inputByAttr('keyName'), 'test-key');
+      await click(GENERAL.submitButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/keys/${keyId}/details`,
+        `/vault/secrets-engines/${this.mountPath}/pki/keys/${keyId}/details`,
         'navigates to details after save'
       );
-      assert.dom(SELECTORS.keyPages.keyNameValue).hasText('test-key', 'updates key name');
+      assert.dom(GENERAL.infoRowValue('Key name')).hasText('test-key', 'updates key name');
 
       // key generate and delete navigation
-      await visit(`/vault/secrets/${this.mountPath}/pki/keys`);
-      await click(SELECTORS.keyPages.generateKey);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys/create`);
-      await fillIn(SELECTORS.keyForm.typeInput, 'exported');
-      await fillIn(SELECTORS.keyForm.keyTypeInput, 'rsa');
-      await click(SELECTORS.keyForm.keyCreateButton);
-      keyId = find(SELECTORS.keyPages.keyIdValue).innerText;
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys/${keyId}/details`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/keys`);
+      await click(PKI_KEYS.generateKey);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/keys/create`);
+      await fillIn(GENERAL.inputByAttr('type'), 'exported'); // exported keys generated private_key data
+      await fillIn(GENERAL.inputByAttr('keyType'), 'rsa');
+      await click(GENERAL.submitButton);
+      keyId = find(GENERAL.infoRowValue('Key ID')).textContent?.trim();
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.mountPath}/pki/keys/create`,
+        'it does not transition to details private_key data exists'
+      );
 
       assert
-        .dom(SELECTORS.keyPages.nextStepsAlert)
+        .dom(PKI_KEYS.nextStepsAlert)
         .hasText(
           'Next steps This private key material will only be available once. Copy or download it now.',
           'renders banner to save private key'
         );
-      assert.dom(SELECTORS.keyPages.downloadButton).exists('renders download button');
-      await click(SELECTORS.keyPages.keyDeleteButton);
-      await click(SELECTORS.keyPages.confirmDelete);
+      assert.dom(GENERAL.button('Download')).exists('renders download button');
+      await click(PKI_KEYS.keyDeleteButton);
+      await click(GENERAL.confirmButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/keys`,
+        `/vault/secrets-engines/${this.mountPath}/pki/keys`,
         'navigates back to key list view on delete'
       );
     });
 
     test('it hides correct actions for user with read policy', async function (assert) {
-      await authPage.login(this.pkiKeyReader);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.keysTab);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys`);
+      await login(this.pkiKeyReader);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Keys'));
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/keys`);
       await isSettled();
-      assert.dom(SELECTORS.keyPages.importKey).doesNotExist();
-      assert.dom(SELECTORS.keyPages.generateKey).doesNotExist();
+      assert.dom(PKI_KEYS.importKey).doesNotExist();
+      assert.dom(PKI_KEYS.generateKey).doesNotExist();
       assert.dom('.linked-block').exists({ count: 1 }, 'One key is in list');
-      const keyId = find(SELECTORS.keyPages.keyId).innerText;
-      await click(SELECTORS.keyPages.popupMenuTrigger);
-      assert.dom(SELECTORS.keyPages.popupMenuEdit).doesNotExist('popup menu edit link is not shown');
-      await click(SELECTORS.keyPages.popupMenuDetails);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys/${keyId}/details`);
-      assert.dom(SELECTORS.keyPages.keyDeleteButton).doesNotExist('Delete key button is not shown');
-      assert.dom(SELECTORS.keyPages.keyEditLink).doesNotExist('Edit key button does not render');
+      const keyId = find(PKI_KEYS.keyId).innerText;
+      await click(GENERAL.menuTrigger);
+      assert.dom(PKI_KEYS.popupMenuEdit).doesNotExist('popup menu edit link is not shown');
+      await click(PKI_KEYS.popupMenuDetails);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/keys/${keyId}/details`);
+      assert.dom(PKI_KEYS.keyDeleteButton).doesNotExist('Delete key button is not shown');
+      assert.dom(PKI_KEYS.keyEditLink).doesNotExist('Edit key button does not render');
     });
 
     test('it shows correct toolbar items for the user with update policy', async function (assert) {
-      await authPage.login(this.pkiKeyEditor);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.keysTab);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys`);
+      await login(this.pkiKeyEditor);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Keys'));
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/keys`);
       await isSettled();
-      assert.dom(SELECTORS.keyPages.importKey).exists('import action exists');
-      assert.dom(SELECTORS.keyPages.generateKey).exists('generate action exists');
+      assert.dom(PKI_KEYS.importKey).exists('import action exists');
+      assert.dom(PKI_KEYS.generateKey).exists('generate action exists');
       assert.dom('.linked-block').exists({ count: 1 }, 'One key is in list');
-      const keyId = find(SELECTORS.keyPages.keyId).innerText;
-      await click(SELECTORS.keyPages.popupMenuTrigger);
-      assert
-        .dom(SELECTORS.keyPages.popupMenuEdit)
-        .doesNotHaveClass('disabled', 'popup menu edit link is not disabled');
+      const keyId = find(PKI_KEYS.keyId).innerText;
+      await click(GENERAL.menuTrigger);
+      assert.dom(PKI_KEYS.popupMenuEdit).doesNotHaveClass('disabled', 'popup menu edit link is not disabled');
       await click('.linked-block');
-      assert.dom(SELECTORS.keyPages.keyDeleteButton).doesNotExist('Delete key button is not shown');
-      await click(SELECTORS.keyPages.keyEditLink);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys/${keyId}/edit`);
-      assert.dom(SELECTORS.keyPages.title).hasText('Edit Key');
-      await click(SELECTORS.keyForm.keyCancelButton);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/keys/${keyId}/details`);
+      assert.dom(PKI_KEYS.keyDeleteButton).doesNotExist('Delete key button is not shown');
+      await click(PKI_KEYS.keyEditLink);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/keys/${keyId}/edit`);
+      assert.dom(GENERAL.title).hasText('Edit Key');
+      await click(GENERAL.cancelButton);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/keys/${keyId}/details`);
     });
   });
 
   module('issuers', function (hooks) {
     hooks.beforeEach(async function () {
-      await authPage.login();
+      await login();
       const pki_admin_policy = adminPolicy(this.mountPath);
       this.pkiAdminToken = await runCmd(tokenWithPolicyCmd(`pki-admin-${this.mountPath}`, pki_admin_policy));
       // Configure engine with a default issuer
       await runCmd([
         `write ${this.mountPath}/root/generate/internal common_name="Hashicorp Test" name="Hashicorp Test"`,
       ]);
-      await logout.visit();
       clearRecords(this.store);
     });
     test('lists the correct issuer metadata info', async function (assert) {
-      assert.expect(6);
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.dom(SELECTORS.issuersTab).exists('Issuers tab is present');
-      await click(SELECTORS.issuersTab);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/issuers`);
-      assert.dom('.linked-block').exists({ count: 1 }, 'One issuer is in list');
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.dom(GENERAL.secretTab('Issuers')).exists();
+      await click(GENERAL.secretTab('Issuers'));
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/issuers`);
+      assert.dom('.linked-block').exists({ count: 1 });
       assert.dom('[data-test-is-root-tag="0"]').hasText('root');
-      assert.dom('[data-test-serial-number="0"]').exists({ count: 1 }, 'displays serial number tag');
-      assert.dom('[data-test-common-name="0"]').exists({ count: 1 }, 'displays cert common name tag');
+      assert.dom('[data-test-serial-number="0"]').exists({ count: 1 });
+      assert.dom('[data-test-common-name="0"]').exists({ count: 1 });
     });
     test('lists the correct issuer metadata info when user has only read permission', async function (assert) {
-      assert.expect(2);
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.issuersTab);
-      await click(SELECTORS.issuerPopupMenu);
-      await click(SELECTORS.issuerPopupDetails);
-      const issuerId = find(SELECTORS.issuerDetails.valueByName('Issuer ID')).innerText;
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Issuers'));
+      await click(GENERAL.menuTrigger);
+      await click(PKI_ISSUER_LIST.issuerPopupDetails);
+      const issuerId = find(GENERAL.infoRowValue('Issuer ID')).innerText;
       const pki_issuer_denied_policy = `
       path "${this.mountPath}/*" {
         capabilities = ["create", "read", "update", "delete", "list"]
@@ -404,69 +422,72 @@ module('Acceptance | pki workflow', function (hooks) {
       this.token = await runCmd(
         tokenWithPolicyCmd(`pki-issuer-denied-policy-${this.mountPath}`, pki_issuer_denied_policy)
       );
-      await logout.visit();
-      await authPage.login(this.token);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.issuersTab);
+      await login(this.token);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Issuers'));
       assert.dom('[data-test-serial-number="0"]').exists({ count: 1 }, 'displays serial number tag');
       assert.dom('[data-test-common-name="0"]').doesNotExist('does not display cert common name tag');
     });
 
     test('details view renders correct number of info items', async function (assert) {
       assert.expect(13);
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      assert.dom(SELECTORS.issuersTab).exists('Issuers tab is present');
-      await click(SELECTORS.issuersTab);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/issuers`);
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      assert.dom(GENERAL.secretTab('Issuers')).exists('Issuers tab is present');
+      await click(GENERAL.secretTab('Issuers'));
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/issuers`);
       assert.dom('.linked-block').exists({ count: 1 }, 'One issuer is in list');
       await click('.linked-block');
       assert.ok(
-        currentURL().match(`/vault/secrets/${this.mountPath}/pki/issuers/.+/details`),
-        `/vault/secrets/${this.mountPath}/pki/issuers/my-issuer/details`
+        currentURL().match(`/vault/secrets-engines/${this.mountPath}/pki/issuers/.+/details`),
+        `/vault/secrets-engines/${this.mountPath}/pki/issuers/my-issuer/details`
       );
-      assert.dom(SELECTORS.issuerDetails.title).hasText('View Issuer Certificate');
+      assert.dom(GENERAL.title).hasText('View Issuer Certificate');
+
       ['Certificate', 'CA Chain', 'Common name', 'Issuer name', 'Issuer ID', 'Default key ID'].forEach(
         (label) => {
           assert
-            .dom(`${SELECTORS.issuerDetails.defaultGroup} ${SELECTORS.issuerDetails.valueByName(label)}`)
-            .exists({ count: 1 }, `${label} value rendered`);
+            .dom(`${PKI_ISSUER_DETAILS.defaultGroup} ${GENERAL.infoRowValue(label)}`)
+            .exists(`${label} value rendered`);
         }
       );
       assert
-        .dom(`${SELECTORS.issuerDetails.urlsGroup} ${SELECTORS.issuerDetails.row}`)
+        .dom(`${PKI_ISSUER_DETAILS.urlsGroup} ${PKI_ISSUER_DETAILS.row}`)
         .exists({ count: 3 }, 'Renders 3 info table items under URLs group');
-      assert.dom(SELECTORS.issuerDetails.groupTitle).exists({ count: 1 }, 'only 1 group title rendered');
+      assert.dom(PKI_ISSUER_DETAILS.groupTitle).exists({ count: 1 }, 'only 1 group title rendered');
     });
 
     test('toolbar links navigate to expected routes', async function (assert) {
-      await authPage.login(this.pkiAdminToken);
-      await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-      await click(SELECTORS.issuersTab);
-      await click(SELECTORS.issuerPopupMenu);
-      await click(SELECTORS.issuerPopupDetails);
+      await login(this.pkiAdminToken);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+      await click(GENERAL.secretTab('Issuers'));
+      await click(GENERAL.menuTrigger);
+      await click(PKI_ISSUER_LIST.issuerPopupDetails);
 
-      const issuerId = find(SELECTORS.issuerDetails.valueByName('Issuer ID')).innerText;
+      const issuerId = find(GENERAL.infoRowValue('Issuer ID')).innerText;
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/issuers/${issuerId}/details`,
+        `/vault/secrets-engines/${this.mountPath}/pki/issuers/${issuerId}/details`,
         'it navigates to details route'
       );
       assert
-        .dom(SELECTORS.issuerDetails.crossSign)
-        .hasAttribute('href', `/ui/vault/secrets/${this.mountPath}/pki/issuers/${issuerId}/cross-sign`);
+        .dom(PKI_ISSUER_DETAILS.crossSign)
+        .hasAttribute(
+          'href',
+          `/ui/vault/secrets-engines/${this.mountPath}/pki/issuers/${issuerId}/cross-sign`
+        );
       assert
-        .dom(SELECTORS.issuerDetails.signIntermediate)
-        .hasAttribute('href', `/ui/vault/secrets/${this.mountPath}/pki/issuers/${issuerId}/sign`);
+        .dom(PKI_ISSUER_DETAILS.signIntermediate)
+        .hasAttribute('href', `/ui/vault/secrets-engines/${this.mountPath}/pki/issuers/${issuerId}/sign`);
       assert
-        .dom(SELECTORS.issuerDetails.configure)
-        .hasAttribute('href', `/ui/vault/secrets/${this.mountPath}/pki/issuers/${issuerId}/edit`);
-      await click(SELECTORS.issuerDetails.rotateRoot);
-      assert.dom(SELECTORS.issuerDetails.rotateModal).exists('rotate root modal opens');
-      await click(SELECTORS.issuerDetails.rotateModalGenerate);
+        .dom(PKI_ISSUER_DETAILS.configure)
+        .hasAttribute('href', `/ui/vault/secrets-engines/${this.mountPath}/pki/issuers/${issuerId}/edit`);
+      await click(PKI_ISSUER_DETAILS.rotateRoot);
+      assert.dom(PKI_ISSUER_DETAILS.rotateModal).exists('rotate root modal opens');
+      await click(PKI_ISSUER_DETAILS.rotateModalGenerate);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.mountPath}/pki/issuers/${issuerId}/rotate-root`,
+        `/vault/secrets-engines/${this.mountPath}/pki/issuers/${issuerId}/rotate-root`,
         'it navigates to root rotate form'
       );
       assert
@@ -477,23 +498,22 @@ module('Acceptance | pki workflow', function (hooks) {
 
   module('rotate', function (hooks) {
     hooks.beforeEach(async function () {
-      await authPage.login();
+      await login();
       await runCmd([`write ${this.mountPath}/root/generate/internal issuer_name="existing-issuer"`]);
-      await logout.visit();
     });
     test('it renders a warning banner when parent issuer has unsupported OIDs', async function (assert) {
-      await authPage.login();
-      await visit(`/vault/secrets/${this.mountPath}/pki/configuration/create`);
-      await click(SELECTORS.configuration.optionByKey('import'));
-      await click('[data-test-text-toggle]');
-      await fillIn('[data-test-text-file-textarea]', unsupportedPem);
-      await click(SELECTORS.configuration.importSubmit);
-      const issuerId = find(SELECTORS.configuration.importedIssuer).innerText;
-      await click(`${SELECTORS.configuration.importedIssuer} a`);
+      await login();
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/configuration/create`);
+      await click(PKI_CONFIGURE_CREATE.optionByKey('import'));
+      await click(GENERAL.textToggle);
+      await fillIn(GENERAL.maskedInput, unsupportedPem);
+      await click(PKI_CONFIGURE_CREATE.importSubmit);
+      const issuerId = find(PKI_CONFIGURE_CREATE.importedIssuer).innerText;
+      await click(`${PKI_CONFIGURE_CREATE.importedIssuer} a`);
 
       // navigating directly to route because the rotate button is not visible for non-root issuers
       // but we're just testing that route model was parsed and passed as expected
-      await visit(`/vault/secrets/${this.mountPath}/pki/issuers/${issuerId}/rotate-root`);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/issuers/${issuerId}/rotate-root`);
       assert
         .dom('[data-test-parsing-warning]')
         .hasTextContaining(
@@ -502,7 +522,7 @@ module('Acceptance | pki workflow', function (hooks) {
         );
       assert.dom('[data-test-input="commonName"]').hasValue('fancy-cert-unsupported-subj-and-ext-oids');
       await fillIn('[data-test-input="issuerName"]', 'existing-issuer');
-      await click('[data-test-pki-rotate-root-save]');
+      await click(GENERAL.submitButton);
       assert
         .dom('[data-test-rotate-error]')
         .hasText('Error issuer name already in use', 'it renders error banner');
@@ -511,7 +531,7 @@ module('Acceptance | pki workflow', function (hooks) {
 
   module('config', function (hooks) {
     hooks.beforeEach(async function () {
-      await authPage.login();
+      await login();
       await runCmd([`write ${this.mountPath}/root/generate/internal issuer_name="existing-issuer"`]);
       const mixed_config_policy = `
       ${adminPolicy(this.mountPath)}
@@ -520,28 +540,28 @@ module('Acceptance | pki workflow', function (hooks) {
       this.mixedConfigCapabilities = await runCmd(
         tokenWithPolicyCmd(`pki-reader-${this.mountPath}`, mixed_config_policy)
       );
-      await logout.visit();
+      await visit('/vault/logout');
     });
 
     test('it updates config when user only has permission to some endpoints', async function (assert) {
-      await authPage.login(this.mixedConfigCapabilities);
-      await visit(`/vault/secrets/${this.mountPath}/pki/configuration/edit`);
+      await login(this.mixedConfigCapabilities);
+      await visit(`/vault/secrets-engines/${this.mountPath}/pki/configuration/edit`);
       assert
-        .dom(`${SELECTORS.configEdit.configEditSection} [data-test-component="empty-state"]`)
+        .dom(`${PKI_CONFIG_EDIT.configEditSection} [data-test-component="empty-state"]`)
         .hasText(
           `You do not have permission to set this mount's the cluster config Ask your administrator if you think you should have access to: POST /${this.mountPath}/config/cluster`
         );
-      assert.dom(SELECTORS.configEdit.acmeEditSection).exists();
-      assert.dom(SELECTORS.configEdit.urlsEditSection).exists();
-      assert.dom(SELECTORS.configEdit.crlEditSection).exists();
-      assert.dom(`${SELECTORS.acmeEditSection} [data-test-component="empty-state"]`).doesNotExist();
-      assert.dom(`${SELECTORS.urlsEditSection} [data-test-component="empty-state"]`).doesNotExist();
-      assert.dom(`${SELECTORS.crlEditSection} [data-test-component="empty-state"]`).doesNotExist();
-      await click(SELECTORS.configEdit.crlToggleInput('expiry'));
-      await click(SELECTORS.configEdit.saveButton);
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/configuration`);
+      assert.dom(PKI_CONFIG_EDIT.acmeEditSection).exists();
+      assert.dom(PKI_CONFIG_EDIT.urlsEditSection).exists();
+      assert.dom(PKI_CONFIG_EDIT.crlEditSection).exists();
+      assert.dom(`${PKI_CONFIG_EDIT.acmeEditSection} [data-test-component="empty-state"]`).doesNotExist();
+      assert.dom(`${PKI_CONFIG_EDIT.urlsEditSection} [data-test-component="empty-state"]`).doesNotExist();
+      assert.dom(`${PKI_CONFIG_EDIT.crlEditSection} [data-test-component="empty-state"]`).doesNotExist();
+      await click(PKI_CONFIG_EDIT.crlToggleInput('expiry'));
+      await click(PKI_CONFIG_EDIT.saveButton);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/configuration`);
       assert
-        .dom('[data-test-value-div="CRL building"]')
+        .dom(GENERAL.infoRowValue('CRL building'))
         .hasText('Disabled', 'Successfully saves config with partial permission');
     });
   });
diff --git a/ui/tests/acceptance/pki/pki-overview-test.js b/ui/tests/acceptance/pki/pki-overview-test.js
index 5e86d33e76c..0e912b3f9f8 100644
--- a/ui/tests/acceptance/pki/pki-overview-test.js
+++ b/ui/tests/acceptance/pki/pki-overview-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,20 +7,21 @@ import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
 import { click, currentURL, currentRouteName, visit } from '@ember/test-helpers';
-import { SELECTORS } from 'vault/tests/helpers/pki/overview';
-import { clearRecords } from 'vault/tests/helpers/pki/pki-run-commands';
 import { runCmd, tokenWithPolicyCmd } from 'vault/tests/helpers/commands';
+import { clearRecords } from 'vault/tests/helpers/pki/pki-helpers';
+import { PKI_OVERVIEW } from 'vault/tests/helpers/pki/pki-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+const { overviewCard } = GENERAL;
 
 module('Acceptance | pki overview', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(async function () {
     this.store = this.owner.lookup('service:store');
-    await authPage.login();
+    await login();
     // Setup PKI engine
     const mountPath = `pki-${uuidv4()}`;
     await enablePage.enable('pki', mountPath);
@@ -45,34 +46,33 @@ module('Acceptance | pki overview', function (hooks) {
     this.pkiRolesList = await runCmd(tokenWithPolicyCmd('pki-roles-list', pki_roles_list_policy));
     this.pkiIssuersList = await runCmd(tokenWithPolicyCmd('pki-issuers-list', pki_issuers_list_policy));
     this.pkiAdminToken = await runCmd(tokenWithPolicyCmd('pki-admin', pki_admin_policy));
-    await logout.visit();
+
     clearRecords(this.store);
   });
 
   hooks.afterEach(async function () {
-    await logout.visit();
-    await authPage.login();
+    await login();
     // Cleanup engine
     await runCmd([`delete sys/mounts/${this.mountPath}`]);
   });
 
   test('navigates to view issuers when link is clicked on issuer card', async function (assert) {
-    await authPage.login(this.pkiAdminToken);
-    await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-    assert.dom(SELECTORS.issuersCardTitle).hasText('Issuers');
-    assert.dom(SELECTORS.issuersCardOverviewNum).hasText('1');
-    await click(SELECTORS.issuersCardLink);
-    assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/issuers`);
-    await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
+    await login(this.pkiAdminToken);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+    assert.dom(overviewCard.title('Issuers')).hasText('Issuers');
+    assert.dom(`${overviewCard.container('Issuers')} p`).hasText('1');
+    await click(overviewCard.actionLink('Issuers'));
+    assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/issuers`);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
   });
 
   test('navigates to view roles when link is clicked on roles card', async function (assert) {
-    await authPage.login(this.pkiAdminToken);
-    await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-    assert.dom(SELECTORS.rolesCardTitle).hasText('Roles');
-    assert.dom(SELECTORS.rolesCardOverviewNum).hasText('0');
-    await click(SELECTORS.rolesCardLink);
-    assert.strictEqual(currentURL(), `/vault/secrets/${this.mountPath}/pki/roles`);
+    await login(this.pkiAdminToken);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+    assert.dom(overviewCard.title('Roles')).hasText('Roles');
+    assert.dom(`${overviewCard.container('Roles')} p`).hasText('0');
+    await click(overviewCard.actionLink('Roles'));
+    assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.mountPath}/pki/roles`);
     await runCmd([
       `write ${this.mountPath}/roles/some-role \
     issuer_ref="default" \
@@ -80,19 +80,19 @@ module('Acceptance | pki overview', function (hooks) {
     allow_subdomains=true \
     max_ttl="720h"`,
     ]);
-    await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-    assert.dom(SELECTORS.rolesCardOverviewNum).hasText('1');
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+    assert.dom(`${overviewCard.container('Roles')} p`).hasText('1');
   });
 
   test('hides roles card if user does not have permissions', async function (assert) {
-    await authPage.login(this.pkiIssuersList);
-    await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-    assert.dom(SELECTORS.rolesCardTitle).doesNotExist('Roles card does not exist');
-    assert.dom(SELECTORS.issuersCardTitle).exists('Issuers card exists');
+    await login(this.pkiIssuersList);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+    assert.dom(overviewCard.title('Roles')).doesNotExist('Roles card does not exist');
+    assert.dom(overviewCard.title('Issuers')).hasText('Issuers');
   });
 
   test('navigates to generate certificate page for Issue Certificates card', async function (assert) {
-    await authPage.login(this.pkiAdminToken);
+    await login(this.pkiAdminToken);
     await runCmd([
       `write ${this.mountPath}/roles/some-role \
     issuer_ref="default" \
@@ -100,19 +100,19 @@ module('Acceptance | pki overview', function (hooks) {
     allow_subdomains=true \
     max_ttl="720h"`,
     ]);
-    await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-    await click(SELECTORS.issueCertificatePowerSearch);
-    await click(SELECTORS.firstPowerSelectOption);
-    await click(SELECTORS.issueCertificateButton);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+    await click(PKI_OVERVIEW.issueCertificatePowerSearch);
+    await click(PKI_OVERVIEW.firstPowerSelectOption);
+    await click(PKI_OVERVIEW.issueCertificateButton);
     assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.pki.roles.role.generate');
   });
 
   test('navigates to certificate details page for View Certificates card', async function (assert) {
-    await authPage.login(this.pkiAdminToken);
-    await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-    await click(SELECTORS.viewCertificatePowerSearch);
-    await click(SELECTORS.firstPowerSelectOption);
-    await click(SELECTORS.viewCertificateButton);
+    await login(this.pkiAdminToken);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+    await click(PKI_OVERVIEW.viewCertificatePowerSearch);
+    await click(PKI_OVERVIEW.firstPowerSelectOption);
+    await click(PKI_OVERVIEW.viewCertificateButton);
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.secrets.backend.pki.certificates.certificate.details'
@@ -120,11 +120,11 @@ module('Acceptance | pki overview', function (hooks) {
   });
 
   test('navigates to issuer details page for View Issuer card', async function (assert) {
-    await authPage.login(this.pkiAdminToken);
-    await visit(`/vault/secrets/${this.mountPath}/pki/overview`);
-    await click(SELECTORS.viewIssuerPowerSearch);
-    await click(SELECTORS.firstPowerSelectOption);
-    await click(SELECTORS.viewIssuerButton);
+    await login(this.pkiAdminToken);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/overview`);
+    await click(PKI_OVERVIEW.viewIssuerPowerSearch);
+    await click(PKI_OVERVIEW.firstPowerSelectOption);
+    await click(PKI_OVERVIEW.viewIssuerButton);
     assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.pki.issuers.issuer.details');
   });
 });
diff --git a/ui/tests/acceptance/pki/pki-tidy-test.js b/ui/tests/acceptance/pki/pki-tidy-test.js
index 4f16c858b58..b8affba13b8 100644
--- a/ui/tests/acceptance/pki/pki-tidy-test.js
+++ b/ui/tests/acceptance/pki/pki-tidy-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,18 +10,18 @@ import { click, currentRouteName, fillIn, visit } from '@ember/test-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { v4 as uuidv4 } from 'uuid';
 
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
 import { runCmd } from 'vault/tests/helpers/commands';
-import { SELECTORS } from 'vault/tests/helpers/pki/page/pki-tidy';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { PKI_TIDY, PKI_TIDY_FORM } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Acceptance | pki tidy', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
   hooks.beforeEach(async function () {
-    await authPage.login();
+    await login();
     // Setup PKI engine
     const mountPath = `pki-workflow-${uuidv4()}`;
     await enablePage.enable('pki', mountPath);
@@ -29,33 +29,31 @@ module('Acceptance | pki tidy', function (hooks) {
     await runCmd([
       `write ${this.mountPath}/root/generate/internal common_name="Hashicorp Test" name="Hashicorp Test"`,
     ]);
-    await logout.visit();
   });
 
   hooks.afterEach(async function () {
-    await logout.visit();
-    await authPage.login();
+    await login();
     // Cleanup engine
     await runCmd([`delete sys/mounts/${this.mountPath}`]);
   });
 
   test('it configures a manual tidy operation and shows its details and tidy states', async function (assert) {
-    await authPage.login(this.pkiAdminToken);
-    await visit(`/vault/secrets/${this.mountPath}/pki/tidy`);
-    await click(SELECTORS.tidyEmptyStateConfigure);
-    assert.dom(SELECTORS.tidyConfigureModal.configureTidyModal).exists('Configure tidy modal exists');
-    assert.dom(SELECTORS.tidyConfigureModal.tidyModalAutoButton).exists('Configure auto tidy button exists');
+    await login(this.pkiAdminToken);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/tidy`);
+    await click(PKI_TIDY.tidyEmptyStateConfigure);
+    assert.dom(PKI_TIDY.tidyConfigureModal.configureTidyModal).exists('Configure tidy modal exists');
+    assert.dom(PKI_TIDY.tidyConfigureModal.tidyModalAutoButton).exists('Configure auto tidy button exists');
     assert
-      .dom(SELECTORS.tidyConfigureModal.tidyModalManualButton)
+      .dom(PKI_TIDY.tidyConfigureModal.tidyModalManualButton)
       .exists('Configure manual tidy button exists');
-    await click(SELECTORS.tidyConfigureModal.tidyModalManualButton);
-    assert.dom(SELECTORS.tidyForm.tidyFormName('manual')).exists('Manual tidy form exists');
-    await click(SELECTORS.tidyForm.inputByAttr('tidyCertStore'));
-    await fillIn(SELECTORS.tidyForm.tidyPauseDuration, '10');
-    await click(SELECTORS.tidyForm.tidySave);
-    await click(SELECTORS.cancelTidyAction);
-    assert.dom(SELECTORS.cancelTidyModalBackground).exists('Confirm cancel tidy modal exits');
-    await click(SELECTORS.tidyConfigureModal.tidyModalCancelButton);
+    await click(PKI_TIDY.tidyConfigureModal.tidyModalManualButton);
+    assert.dom(PKI_TIDY_FORM.tidyFormName('manual')).exists('Manual tidy form exists');
+    await click(PKI_TIDY_FORM.inputByAttr('tidyCertStore'));
+    await fillIn(PKI_TIDY_FORM.tidyPauseDuration, '10');
+    await click(PKI_TIDY_FORM.tidySave);
+    await click(PKI_TIDY.cancelTidyAction);
+    assert.dom(PKI_TIDY.cancelTidyModalBackground).exists('Confirm cancel tidy modal exits');
+    await click(PKI_TIDY.tidyConfigureModal.tidyModalCancelButton);
     // we can't properly test the background refresh fetching of tidy status in testing
     this.server.get(`${this.mountPath}/tidy-status`, () => {
       return {
@@ -101,79 +99,104 @@ module('Acceptance | pki tidy', function (hooks) {
         auth: null,
       };
     });
-    await visit(`/vault/secrets/${this.mountPath}/pki/configuration`);
-    await visit(`/vault/secrets/${this.mountPath}/pki/tidy`);
-    assert.dom(SELECTORS.hdsAlertTitle).hasText('Tidy operation cancelled');
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/configuration`);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/tidy`);
+    assert.dom(PKI_TIDY.hdsAlertTitle).hasText('Tidy operation cancelled');
     assert
-      .dom(SELECTORS.hdsAlertDescription)
+      .dom(PKI_TIDY.hdsAlertDescription)
       .hasText(
         'Your tidy operation has been cancelled. If this was a mistake configure and run another tidy operation.'
       );
-    assert.dom(SELECTORS.alertUpdatedAt).exists();
+    assert.dom(PKI_TIDY.alertUpdatedAt).exists();
   });
 
   test('it configures an auto tidy operation and shows its details', async function (assert) {
-    await authPage.login(this.pkiAdminToken);
-    await visit(`/vault/secrets/${this.mountPath}/pki/tidy`);
-    await click(SELECTORS.tidyEmptyStateConfigure);
-    assert.dom(SELECTORS.tidyConfigureModal.configureTidyModal).exists('Configure tidy modal exists');
-    assert.dom(SELECTORS.tidyConfigureModal.tidyModalAutoButton).exists('Configure auto tidy button exists');
+    await login(this.pkiAdminToken);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/tidy`);
+    await click(PKI_TIDY.tidyEmptyStateConfigure);
+    assert.dom(PKI_TIDY.tidyConfigureModal.configureTidyModal).exists('Configure tidy modal exists');
+    assert.dom(PKI_TIDY.tidyConfigureModal.tidyModalAutoButton).exists('Configure auto tidy button exists');
     assert
-      .dom(SELECTORS.tidyConfigureModal.tidyModalManualButton)
+      .dom(PKI_TIDY.tidyConfigureModal.tidyModalManualButton)
       .exists('Configure manual tidy button exists');
-    await click(SELECTORS.tidyConfigureModal.tidyModalAutoButton);
-    assert.dom(SELECTORS.tidyForm.tidyFormName('auto')).exists('Auto tidy form exists');
-    await click(SELECTORS.tidyForm.tidyCancel);
+    await click(PKI_TIDY.tidyConfigureModal.tidyModalAutoButton);
+    assert.dom(PKI_TIDY_FORM.tidyFormName('auto')).exists('Auto tidy form exists');
+    await click(PKI_TIDY_FORM.tidyCancel);
     assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.pki.tidy.index');
-    await click(SELECTORS.tidyEmptyStateConfigure);
-    await click(SELECTORS.tidyConfigureModal.tidyModalAutoButton);
-    assert.dom(SELECTORS.tidyForm.tidyFormName('auto')).exists('Auto tidy form exists');
-    await click(SELECTORS.tidyForm.toggleLabel('Automatic tidy disabled'));
+    await click(PKI_TIDY.tidyEmptyStateConfigure);
+    await click(PKI_TIDY.tidyConfigureModal.tidyModalAutoButton);
+    assert.dom(PKI_TIDY_FORM.tidyFormName('auto')).exists('Auto tidy form exists');
+    await click(GENERAL.ttl.toggle('enabled'));
     assert
-      .dom(SELECTORS.tidyForm.tidySectionHeader('ACME operations'))
+      .dom(PKI_TIDY_FORM.tidySectionHeader('ACME operations'))
       .exists('Auto tidy form enabled shows ACME operations field');
-    await click(SELECTORS.tidyForm.inputByAttr('tidyCertStore'));
-    await click(SELECTORS.tidyForm.tidySave);
+    await click(PKI_TIDY_FORM.inputByAttr('tidyCertStore'));
+    await click(PKI_TIDY_FORM.tidySave);
     assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.pki.tidy.auto.index');
-    await click(SELECTORS.tidyForm.editAutoTidyButton);
+    await click(PKI_TIDY_FORM.editAutoTidyButton);
     assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.pki.tidy.auto.configure');
-    await click(SELECTORS.tidyForm.inputByAttr('tidyRevokedCerts'));
-    await click(SELECTORS.tidyForm.tidySave);
+    await click(PKI_TIDY_FORM.inputByAttr('tidyRevokedCerts'));
+    await click(PKI_TIDY_FORM.tidySave);
     assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.pki.tidy.auto.index');
   });
 
+  // test coverage for a bug where toggling acme tidy on then off caused API failure
+  test('it configures a manual tidy operation', async function (assert) {
+    await login(this.pkiAdminToken);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/tidy`);
+    await click(PKI_TIDY.tidyEmptyStateConfigure);
+    assert.dom(PKI_TIDY.tidyConfigureModal.configureTidyModal).exists();
+    assert.dom(PKI_TIDY.tidyConfigureModal.tidyModalAutoButton).exists();
+    assert.dom(PKI_TIDY.tidyConfigureModal.tidyModalManualButton).exists();
+    await click(PKI_TIDY.tidyConfigureModal.tidyModalManualButton);
+
+    assert.dom(PKI_TIDY_FORM.tidyFormName('manual')).exists();
+    await click(PKI_TIDY_FORM.inputByAttr('tidyCertStore'));
+
+    await click(GENERAL.ttl.toggle('Tidy ACME disabled'));
+    assert
+      .dom(GENERAL.ttl.input('Tidy ACME enabled'))
+      .hasValue('30', 'acmeAccountSafetyBuffer defaults to 30 days');
+    await click(GENERAL.toggleInput('Tidy ACME enabled'));
+
+    await click(PKI_TIDY_FORM.tidySave);
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backend.pki.tidy.index',
+      'saves successfully and redirects to index'
+    );
+  });
+
   test('it opens a tidy modal when the user clicks on the tidy toolbar action', async function (assert) {
-    await authPage.login(this.pkiAdminToken);
-    await visit(`/vault/secrets/${this.mountPath}/pki/tidy`);
-    await click(SELECTORS.tidyConfigureModal.tidyOptionsModal);
-    assert.dom(SELECTORS.tidyConfigureModal.configureTidyModal).exists('Configure tidy modal exists');
-    assert.dom(SELECTORS.tidyConfigureModal.tidyModalAutoButton).exists('Configure auto tidy button exists');
+    await login(this.pkiAdminToken);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/tidy`);
+    await click(PKI_TIDY.tidyConfigureModal.tidyOptionsModal);
+    assert.dom(PKI_TIDY.tidyConfigureModal.configureTidyModal).exists('Configure tidy modal exists');
+    assert.dom(PKI_TIDY.tidyConfigureModal.tidyModalAutoButton).exists('Configure auto tidy button exists');
     assert
-      .dom(SELECTORS.tidyConfigureModal.tidyModalManualButton)
+      .dom(PKI_TIDY.tidyConfigureModal.tidyModalManualButton)
       .exists('Configure manual tidy button exists');
-    await click(SELECTORS.tidyConfigureModal.tidyModalCancelButton);
-    assert.dom(SELECTORS.tidyEmptyState).exists();
+    await click(PKI_TIDY.tidyConfigureModal.tidyModalCancelButton);
+    assert.dom(GENERAL.emptyStateTitle).exists();
   });
 
   test('it should show correct toolbar action depending on whether auto tidy is enabled', async function (assert) {
-    await authPage.login(this.pkiAdminToken);
-    await visit(`/vault/secrets/${this.mountPath}/pki/tidy`);
+    await login(this.pkiAdminToken);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/tidy`);
     assert
-      .dom(SELECTORS.tidyConfigureModal.tidyOptionsModal)
+      .dom(PKI_TIDY.tidyConfigureModal.tidyOptionsModal)
       .exists('Configure tidy modal options button exists');
-    await click(SELECTORS.tidyConfigureModal.tidyOptionsModal);
-    assert.dom(SELECTORS.tidyConfigureModal.configureTidyModal).exists('Configure tidy modal exists');
-    await click(SELECTORS.tidyConfigureModal.tidyModalAutoButton);
-    await click(SELECTORS.tidyForm.toggleLabel('Automatic tidy disabled'));
-    await click(SELECTORS.tidyForm.inputByAttr('tidyCertStore'));
-    await click(SELECTORS.tidyForm.inputByAttr('tidyRevokedCerts'));
-    await click(SELECTORS.tidyForm.tidySave);
-    await visit(`/vault/secrets/${this.mountPath}/pki/tidy`);
+    await click(PKI_TIDY.tidyConfigureModal.tidyOptionsModal);
+    assert.dom(PKI_TIDY.tidyConfigureModal.configureTidyModal).exists('Configure tidy modal exists');
+    await click(PKI_TIDY.tidyConfigureModal.tidyModalAutoButton);
+    await click(GENERAL.ttl.toggle('enabled'));
+    await click(PKI_TIDY_FORM.inputByAttr('tidyCertStore'));
+    await click(PKI_TIDY_FORM.inputByAttr('tidyRevokedCerts'));
+    await click(PKI_TIDY_FORM.tidySave);
+    await visit(`/vault/secrets-engines/${this.mountPath}/pki/tidy`);
     assert
-      .dom(SELECTORS.manualTidyToolbar)
+      .dom(PKI_TIDY.manualTidyToolbar)
       .exists('Manual tidy toolbar action exists if auto tidy is configured');
-    assert
-      .dom(SELECTORS.autoTidyToolbar)
-      .exists('Auto tidy toolbar action exists if auto tidy is configured');
+    assert.dom(PKI_TIDY.autoTidyToolbar).exists('Auto tidy toolbar action exists if auto tidy is configured');
   });
 });
diff --git a/ui/tests/acceptance/policies-test.js b/ui/tests/acceptance/policies-test.js
index 8f06cc81d74..74575828439 100644
--- a/ui/tests/acceptance/policies-test.js
+++ b/ui/tests/acceptance/policies-test.js
@@ -1,21 +1,28 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentURL, currentRouteName, visit } from '@ember/test-helpers';
+import { click, currentURL, currentRouteName, visit, fillIn } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Acceptance | policies', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(function () {
-    return authPage.login();
+    return login();
   });
 
-  test('it redirects to acls on unknown policy type', async function (assert) {
+  test('it redirects from plural policies route with unknown policy type', async function (assert) {
+    await visit('/vault/policies/foo');
+    assert.strictEqual(currentRouteName(), 'vault.cluster.policies.index');
+    assert.strictEqual(currentURL(), '/vault/policies/acl');
+  });
+
+  test('it redirects from singular policy route with unknown policy type', async function (assert) {
     await visit('/vault/policy/foo/default');
     assert.strictEqual(currentRouteName(), 'vault.cluster.policies.index');
     assert.strictEqual(currentURL(), '/vault/policies/acl');
@@ -25,9 +32,20 @@ module('Acceptance | policies', function (hooks) {
     assert.strictEqual(currentURL(), '/vault/policies/acl');
   });
 
-  test('it redirects to acls on index navigation', async function (assert) {
+  test('it redirects to policies/acl on index navigation', async function (assert) {
     await visit('/vault/policy/acl');
     assert.strictEqual(currentRouteName(), 'vault.cluster.policies.index');
     assert.strictEqual(currentURL(), '/vault/policies/acl');
   });
+
+  test('it navigates to and from policy show page from sidebar', async function (assert) {
+    await visit('/vault/dashboard');
+    await click(GENERAL.navLink('Policies'));
+    assert.strictEqual(currentURL(), '/vault/policies/acl', 'currentURL is /vault/policies/acl');
+    await fillIn('[data-test-component="navigate-input"]', 'default'); // filter for the policy in case there are many on this view and the default policy is on the second page
+    await click('[data-test-policy-link="default"]');
+    assert.strictEqual(currentURL(), '/vault/policy/acl/default');
+    await click(GENERAL.navLink('Back to main navigation'));
+    assert.strictEqual(currentURL(), '/vault/dashboard');
+  });
 });
diff --git a/ui/tests/acceptance/policies/index-test.js b/ui/tests/acceptance/policies/index-test.js
index e79eb3057e5..37d650e4829 100644
--- a/ui/tests/acceptance/policies/index-test.js
+++ b/ui/tests/acceptance/policies/index-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,7 +10,6 @@ import {
   fillIn,
   visit,
   click,
-  find,
   waitFor,
   waitUntil,
 } from '@ember/test-helpers';
@@ -18,27 +17,26 @@ import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { runCmd } from 'vault/tests/helpers/commands';
+import codemirror, { setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const SELECT = {
   policyByName: (name) => `[data-test-policy-link="${name}"]`,
   filterBar: '[data-test-component="navigate-input"]',
-  delete: '[data-test-confirm-action-trigger]',
-  confirmDelete: '[data-test-confirm-button]',
-  createLink: '[data-test-policy-create-link]',
+  createPolicy: '[data-test-policy-create-link]',
   nameInput: '[data-test-policy-input="name"]',
-  save: '[data-test-policy-save]',
-  createError: '[data-test-message-error]',
   policyTitle: '[data-test-policy-name]',
   listBreadcrumb: '[data-test-policy-list-link] a',
 };
+
 module('Acceptance | policies/acl', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(function () {
     this.uid = uuidv4();
-    return authPage.login();
+    return login();
   });
 
   test('it lists default and root acls', async function (assert) {
@@ -71,8 +69,8 @@ module('Acceptance | policies/acl', function (hooks) {
     await waitFor(SELECT.policyByName(policyName));
     assert.dom(SELECT.policyByName(policyName)).exists('policy is shown in list');
     await click(`${SELECT.policyByName(policyName)} [data-test-popup-menu-trigger]`);
-    await click(SELECT.delete);
-    await click(SELECT.confirmDelete);
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
     assert.dom(SELECT.policyByName(policyName)).doesNotExist('policy is deleted successfully');
   });
 
@@ -83,11 +81,15 @@ module('Acceptance | policies/acl', function (hooks) {
 
     await visit('/vault/policies/acl');
     // new policy creation
-    await click(SELECT.createLink);
+    await click(SELECT.createPolicy);
 
     await fillIn(SELECT.nameInput, policyName);
-    find('.CodeMirror').CodeMirror.setValue(policyString);
-    await click(SELECT.save);
+
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    setCodeEditorValue(editor, policyString);
+
+    await click(GENERAL.submitButton);
     assert.strictEqual(
       currentURL(),
       `/vault/policy/acl/${policyName}`,
@@ -103,15 +105,19 @@ module('Acceptance | policies/acl', function (hooks) {
 
     await visit('/vault/policies/acl');
     // new policy creation
-    await click(SELECT.createLink);
+    await click(SELECT.createPolicy);
 
     await fillIn(SELECT.nameInput, policyName);
-    await click(SELECT.save);
+    await click(GENERAL.submitButton);
     assert
-      .dom(SELECT.createError)
+      .dom(GENERAL.messageError)
       .hasText(`Error 'policy' parameter not supplied or empty`, 'renders error message on save');
-    find('.CodeMirror').CodeMirror.setValue(policyString);
-    await click(SELECT.save);
+
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    setCodeEditorValue(editor, policyString);
+
+    await click(GENERAL.submitButton);
 
     await waitUntil(() => currentURL() === `/vault/policy/acl/${encodeURIComponent(policyLower)}`);
     assert.strictEqual(
@@ -120,8 +126,7 @@ module('Acceptance | policies/acl', function (hooks) {
       'navigates to policy show on successful save'
     );
     assert.dom(SELECT.policyTitle).hasText(policyLower, 'displays the policy name on the show page');
-    // will fail if you have a license about to expire.
-    assert.dom('[data-test-flash-message].is-info').doesNotExist('no flash message is displayed on save');
+    assert.dom(GENERAL.latestFlashContent).hasText(`ACL policy "${policyLower}" was successfully created.`);
     await click(SELECT.listBreadcrumb);
 
     assert.strictEqual(currentURL(), `/vault/policies/acl`, 'navigates to policy list from breadcrumb');
@@ -133,12 +138,9 @@ module('Acceptance | policies/acl', function (hooks) {
 
     // policy deletion
     await click(SELECT.policyByName(policyLower));
-
     await click('[data-test-policy-edit-toggle]');
-
-    await click('[data-test-confirm-action-trigger]');
-
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
     await waitUntil(() => currentURL() === `/vault/policies/acl`);
     assert.strictEqual(
       currentURL(),
diff --git a/ui/tests/acceptance/policy-test.js b/ui/tests/acceptance/policy-test.js
deleted file mode 100644
index b519d4270ad..00000000000
--- a/ui/tests/acceptance/policy-test.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { currentURL, currentRouteName, visit } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import authPage from 'vault/tests/pages/auth';
-
-module('Acceptance | policies', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    return authPage.login();
-  });
-
-  test('it redirects to acls with unknown policy type', async function (assert) {
-    await visit('/vault/policies/foo');
-    assert.strictEqual(currentRouteName(), 'vault.cluster.policies.index');
-    assert.strictEqual(currentURL(), '/vault/policies/acl');
-  });
-});
diff --git a/ui/tests/acceptance/policy/edit-test.js b/ui/tests/acceptance/policy/edit-test.js
index 88ae6188e40..73cc8e8b042 100644
--- a/ui/tests/acceptance/policy/edit-test.js
+++ b/ui/tests/acceptance/policy/edit-test.js
@@ -1,37 +1,38 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentURL } from '@ember/test-helpers';
+import { currentURL, click, visit } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import page from 'vault/tests/pages/policy/edit';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Acceptance | policy/acl/:name/edit', function (hooks) {
   setupApplicationTest(hooks);
 
-  hooks.beforeEach(function () {
-    return authPage.login();
+  hooks.beforeEach(async function () {
+    await login();
   });
 
   test('it redirects to list if navigating to root', async function (assert) {
-    await page.visit({ type: 'acl', name: 'root' });
+    await visit(`vault/policy/acl/root/edit`);
     assert.strictEqual(
       currentURL(),
       '/vault/policies/acl',
-      'navigation to root show redirects you to policy list'
+      'navigation to root redirects you to policy list'
     );
   });
 
   test('it does not show delete for default policy', async function (assert) {
-    await page.visit({ type: 'acl', name: 'default' });
-    assert.notOk(page.deleteIsPresent, 'there is no delete button');
+    await visit(`vault/policy/acl/default/edit`);
+    assert.dom(GENERAL.confirmButton).doesNotExist('there is no delete button');
   });
 
   test('it navigates to show when the toggle is clicked', async function (assert) {
-    await page.visit({ type: 'acl', name: 'default' }).toggleEdit();
+    await visit(`vault/policy/acl/default/edit`);
+    await click('[data-test-policy-edit-toggle]');
     assert.strictEqual(currentURL(), '/vault/policy/acl/default', 'toggle navigates from edit to show');
   });
 });
diff --git a/ui/tests/acceptance/policy/show-test.js b/ui/tests/acceptance/policy/show-test.js
index 724cb89b42d..fbf8b4f4eb8 100644
--- a/ui/tests/acceptance/policy/show-test.js
+++ b/ui/tests/acceptance/policy/show-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,13 +7,13 @@ import { currentURL } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import page from 'vault/tests/pages/policy/show';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 
 module('Acceptance | policy/acl/:name', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(function () {
-    return authPage.login();
+    return login();
   });
 
   test('it redirects to list if navigating to root', async function (assert) {
diff --git a/ui/tests/acceptance/raft-storage-test.js b/ui/tests/acceptance/raft-storage-test.js
index 56c2aa7ec93..c4840791f01 100644
--- a/ui/tests/acceptance/raft-storage-test.js
+++ b/ui/tests/acceptance/raft-storage-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,8 @@ import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { click, visit } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Acceptance | raft storage', function (hooks) {
   setupApplicationTest(hooks);
@@ -18,8 +19,8 @@ module('Acceptance | raft storage', function (hooks) {
     this.server.get('/sys/internal/ui/resultant-acl', () =>
       this.server.create('configuration', { data: { root: true } })
     );
-    this.server.get('/sys/license/features', () => ({}));
-    await authPage.login();
+    this.server.get('/sys/license/features', () => ({ features: [] }));
+    await login();
   });
 
   test('it should render correct number of raft peers', async function (assert) {
@@ -39,7 +40,7 @@ module('Acceptance | raft storage', function (hooks) {
     await visit('/vault/storage/raft');
     assert.dom('[data-raft-row]').exists({ count: 2 }, '2 raft peers render in table');
     // leave route and return to trigger config fetch
-    await visit('/vault/secrets');
+    await visit('/vault/secrets-engines');
     await visit('/vault/storage/raft');
     const store = this.owner.lookup('service:store');
     assert.strictEqual(
@@ -64,11 +65,12 @@ module('Acceptance | raft storage', function (hooks) {
       return {};
     });
 
+    const row = '[data-raft-row]:nth-child(2) [data-test-raft-actions]';
     await visit('/vault/storage/raft');
     assert.dom('[data-raft-row]').exists({ count: 2 }, '2 raft peers render in table');
-    await click('[data-raft-row]:nth-child(2) [data-test-raft-actions] button');
-    await click('[data-test-confirm-action-trigger]');
-    await click('[data-test-confirm-button]');
+    await click(`${row} button`);
+    await click(`${row} ${GENERAL.confirmTrigger}`);
+    await click(GENERAL.confirmButton);
     assert.dom('[data-raft-row]').exists({ count: 1 }, 'Raft peer successfully removed');
   });
 });
diff --git a/ui/tests/acceptance/recovery/snapshot-details-test.js b/ui/tests/acceptance/recovery/snapshot-details-test.js
new file mode 100644
index 00000000000..fbfac2c0491
--- /dev/null
+++ b/ui/tests/acceptance/recovery/snapshot-details-test.js
@@ -0,0 +1,74 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { click, currentRouteName, currentURL, visit } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import recoveryHandler from 'vault/mirage/handlers/recovery';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+const SELECTORS = {
+  action: (index) => `.hds-dropdown__list li:nth-of-type(${index}) > :first-child`,
+};
+
+module('Acceptance | recovery | snapshot-details', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    recoveryHandler(this.server);
+
+    this.snapshot = this.server.create('snapshot');
+
+    return login();
+  });
+
+  test('it redirects to snapshots route when a snapshot is unloaded', async function (assert) {
+    await visit('vault/recovery/snapshots');
+    await click('[data-test-details-link]');
+
+    await click(GENERAL.button('toggle'));
+
+    await click(SELECTORS.action(2));
+
+    assert.strictEqual(currentURL(), '/vault/recovery/snapshots');
+    assert.strictEqual(currentRouteName(), 'vault.cluster.recovery.snapshots.index');
+  });
+
+  test('it makes the snapshot status requests in the root namespace', async function (assert) {
+    // 2 for initial req + 2 for polling req
+    assert.expect(4);
+
+    this.server.get('/sys/storage/raft/snapshot-load/:snapshot_id', (schema, req) => {
+      assert.propEqual(req.params, {
+        snapshot_id: this.snapshot.snapshot_id,
+      });
+      assert.strictEqual(req.requestHeaders['x-vault-namespace'], '');
+
+      const record = schema.db['snapshots'].findBy(req.params);
+      if (record) {
+        delete record.id; // "snapshot_id" is the id
+        return { data: record };
+      }
+      return new Response(404, {}, { errors: [] });
+    });
+
+    // go directly to details page to avoid polling requests from manage page
+    await visit(`/vault/recovery/snapshots/${this.snapshot.snapshot_id}/details`);
+  });
+
+  test('it redirects to snapshot route when manage is selected', async function (assert) {
+    await visit('vault/recovery/snapshots');
+    await click('[data-test-details-link]');
+
+    await click(GENERAL.button('toggle'));
+    await click(SELECTORS.action(1));
+
+    assert.strictEqual(currentURL(), `/vault/recovery/snapshots/${this.snapshot.snapshot_id}/manage`);
+    assert.strictEqual(currentRouteName(), 'vault.cluster.recovery.snapshots.snapshot.manage');
+  });
+});
diff --git a/ui/tests/acceptance/recovery/snapshot-manage-test.js b/ui/tests/acceptance/recovery/snapshot-manage-test.js
new file mode 100644
index 00000000000..7e1c79ff672
--- /dev/null
+++ b/ui/tests/acceptance/recovery/snapshot-manage-test.js
@@ -0,0 +1,363 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { click, fillIn, visit } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import recoveryHandler from 'vault/mirage/handlers/recovery';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+
+const requestTests = (test) => {
+  test('it makes the recovery request in the root namespace', async function (assert) {
+    assert.expect(3);
+
+    this.server.post(`/${this.type}/:path`, (schema, req) => {
+      assert.strictEqual(
+        req.params.path,
+        `${this.type}-recovered-data`,
+        'url param has expected resource path'
+      );
+
+      const expectedHeaders = {
+        'x-vault-recover-snapshot-id': this.snapshot_id,
+        'x-vault-namespace': '',
+      };
+
+      Object.entries(expectedHeaders).forEach(([key, value]) => {
+        assert.strictEqual(req.requestHeaders[key], value, `"${key}" header has expected value "${value}"`);
+      });
+    });
+
+    await click(GENERAL.selectByAttr('mount'));
+    await click(`[data-option-index="${this.mountIdx}"]`);
+    await fillIn(GENERAL.inputByAttr('resourcePath'), `${this.type}-recovered-data`);
+    await click(GENERAL.button('recover'));
+  });
+
+  test('it makes the recovery request in the child namespace', async function (assert) {
+    assert.expect(3);
+
+    this.server.post(`/${this.type}/:path`, (schema, req) => {
+      assert.strictEqual(
+        req.params.path,
+        `${this.type}-recovered-data`,
+        'url param has expected resource path'
+      );
+
+      const expectedHeaders = {
+        'x-vault-recover-snapshot-id': this.snapshot_id,
+        'x-vault-namespace': 'child-ns-1',
+      };
+
+      Object.entries(expectedHeaders).forEach(([key, value]) => {
+        assert.strictEqual(req.requestHeaders[key], value, `"${key}" header has expected value "${value}"`);
+      });
+    });
+
+    await click(GENERAL.selectByAttr('namespace'));
+    await click('[data-option-index="1"]');
+    await click(GENERAL.selectByAttr('mount'));
+    await click(`[data-option-index="${this.mountIdx}"]`);
+    await fillIn(GENERAL.inputByAttr('resourcePath'), `${this.type}-recovered-data`);
+    await click(GENERAL.button('recover'));
+  });
+
+  test('it makes the recovery request in the grandchild namespace', async function (assert) {
+    assert.expect(3);
+
+    this.server.post(`/${this.type}/:path`, (schema, req) => {
+      assert.strictEqual(
+        req.params.path,
+        `${this.type}-recovered-data`,
+        'url param has expected resource path'
+      );
+
+      const expectedHeaders = {
+        'x-vault-recover-snapshot-id': this.snapshot_id,
+        'x-vault-namespace': 'child-ns-1/nested',
+      };
+
+      Object.entries(expectedHeaders).forEach(([key, value]) => {
+        assert.strictEqual(req.requestHeaders[key], value, `"${key}" header has expected value "${value}"`);
+      });
+    });
+
+    await click(GENERAL.selectByAttr('namespace'));
+    await click('[data-option-index="2"]');
+    await click(GENERAL.selectByAttr('mount'));
+    await click(`[data-option-index="${this.mountIdx}"]`);
+    await fillIn(GENERAL.inputByAttr('resourcePath'), `${this.type}-recovered-data`);
+    await click(GENERAL.button('recover'));
+  });
+
+  test('it recovers to a copy in the root namespace', async function (assert) {
+    assert.expect(5);
+
+    this.server.post(`/${this.type}/:path`, (schema, req) => {
+      assert.strictEqual(req.params.path, `${this.type}-new-path`, 'url param is the new "copy" path');
+
+      const expectedHeaders = {
+        'x-vault-recover-snapshot-id': this.snapshot_id,
+        'x-vault-recover-source-path': `${this.type}/${this.type}-recovered-data`,
+        'x-vault-namespace': '',
+      };
+
+      Object.entries(expectedHeaders).forEach(([key, value]) => {
+        assert.strictEqual(req.requestHeaders[key], value, `"${key}" header has expected value "${value}"`);
+      });
+    });
+
+    await click(GENERAL.selectByAttr('mount'));
+    await click(`[data-option-index="${this.mountIdx}"]`);
+    await fillIn(GENERAL.inputByAttr('resourcePath'), `${this.type}-recovered-data`);
+    // Select "Recover to a new path"
+    await click(GENERAL.inputByAttr('copy'));
+    assert
+      .dom(GENERAL.inputByAttr('copyPath'))
+      .hasValue(`${this.type}-recovered-data-copy`, 'it appends "-copy" to original resource path');
+    await fillIn(GENERAL.inputByAttr('copyPath'), `${this.type}-new-path`);
+    await click(GENERAL.button('recover'));
+  });
+
+  test('it recovers to a copy in the child namespace', async function (assert) {
+    assert.expect(5);
+
+    this.server.post(`/${this.type}/:path`, (schema, req) => {
+      assert.strictEqual(req.params.path, `${this.type}-new-path`, 'url param is the new "copy" path');
+
+      const expectedHeaders = {
+        'x-vault-recover-snapshot-id': this.snapshot_id,
+        'x-vault-recover-source-path': `${this.type}/${this.type}-recovered-data`,
+        'x-vault-namespace': 'child-ns-1',
+      };
+
+      Object.entries(expectedHeaders).forEach(([key, value]) => {
+        assert.strictEqual(req.requestHeaders[key], value, `"${key}" header has expected value "${value}"`);
+      });
+    });
+
+    await click(GENERAL.selectByAttr('namespace'));
+    await click('[data-option-index="1"]');
+    await click(GENERAL.selectByAttr('mount'));
+    await click(`[data-option-index="${this.mountIdx}"]`);
+    await fillIn(GENERAL.inputByAttr('resourcePath'), `${this.type}-recovered-data`);
+    // Select "Recover to a new path"
+    await click(GENERAL.inputByAttr('copy'));
+    assert
+      .dom(GENERAL.inputByAttr('copyPath'))
+      .hasValue(`${this.type}-recovered-data-copy`, 'it appends "-copy" to original resource path');
+    await fillIn(GENERAL.inputByAttr('copyPath'), `${this.type}-new-path`);
+    await click(GENERAL.button('recover'));
+  });
+
+  test('it recovers to a copy in the grandchild namespace', async function (assert) {
+    assert.expect(5);
+
+    this.server.post(`/${this.type}/:path`, (schema, req) => {
+      assert.strictEqual(req.params.path, `${this.type}-new-path`, 'url param is the new "copy" path');
+
+      const expectedHeaders = {
+        'x-vault-recover-snapshot-id': this.snapshot_id,
+        'x-vault-recover-source-path': `${this.type}/${this.type}-recovered-data`,
+        'x-vault-namespace': 'child-ns-1/nested',
+      };
+
+      Object.entries(expectedHeaders).forEach(([key, value]) => {
+        assert.strictEqual(req.requestHeaders[key], value, `"${key}" header has expected value "${value}"`);
+      });
+    });
+
+    await click(GENERAL.selectByAttr('namespace'));
+    await click('[data-option-index="2"]');
+    await click(GENERAL.selectByAttr('mount'));
+    await click(`[data-option-index="${this.mountIdx}"]`);
+    await fillIn(GENERAL.inputByAttr('resourcePath'), `${this.type}-recovered-data`);
+    // Select "Recover to a new path"
+    await click(GENERAL.inputByAttr('copy'));
+    assert
+      .dom(GENERAL.inputByAttr('copyPath'))
+      .hasValue(`${this.type}-recovered-data-copy`, 'it appends "-copy" to original resource path');
+    await fillIn(GENERAL.inputByAttr('copyPath'), `${this.type}-new-path`);
+    await click(GENERAL.button('recover'));
+  });
+
+  test('it makes the read request in the root namespace', async function (assert) {
+    assert.expect(3);
+
+    this.server.get(`/${this.type}/:path`, (schema, req) => {
+      const { params, queryParams, requestHeaders } = req;
+      assert.strictEqual(params.path, `${this.type}-recovered-data`, 'url param is resource path');
+      assert.strictEqual(queryParams.read_snapshot_id, this.snapshot_id, 'query param has snapshot_id');
+      assert.strictEqual(
+        requestHeaders['x-vault-namespace'],
+        '',
+        `'x-vault-namespace' header is an empty string`
+      );
+    });
+
+    await click(GENERAL.selectByAttr('mount'));
+    await click(`[data-option-index="${this.mountIdx}"]`);
+    await fillIn(GENERAL.inputByAttr('resourcePath'), `${this.type}-recovered-data`);
+    await click(GENERAL.button('read'));
+  });
+
+  test('it makes the read request in the child namespace', async function (assert) {
+    assert.expect(3);
+
+    this.server.get(`/${this.type}/:path`, (schema, req) => {
+      const { params, queryParams, requestHeaders } = req;
+      assert.strictEqual(params.path, `${this.type}-recovered-data`, 'url param is resource path');
+      assert.strictEqual(queryParams.read_snapshot_id, this.snapshot_id, 'query param has snapshot_id');
+      assert.strictEqual(
+        requestHeaders['x-vault-namespace'],
+        'child-ns-1',
+        `'x-vault-namespace' header has namespace`
+      );
+    });
+
+    await click(GENERAL.selectByAttr('namespace'));
+    await click('[data-option-index="1"]');
+    await click(GENERAL.selectByAttr('mount'));
+    await click(`[data-option-index="${this.mountIdx}"]`);
+    await fillIn(GENERAL.inputByAttr('resourcePath'), `${this.type}-recovered-data`);
+    await click(GENERAL.button('read'));
+  });
+
+  test('it makes the read request in the grandchild namespace', async function (assert) {
+    assert.expect(3);
+
+    this.server.get(`/${this.type}/:path`, (schema, req) => {
+      const { params, queryParams, requestHeaders } = req;
+      assert.strictEqual(params.path, `${this.type}-recovered-data`, 'url param is resource path');
+      assert.strictEqual(queryParams.read_snapshot_id, this.snapshot_id, 'query param has snapshot_id');
+      assert.strictEqual(
+        requestHeaders['x-vault-namespace'],
+        'child-ns-1/nested',
+        `'x-vault-namespace' header has namespace`
+      );
+    });
+
+    await click(GENERAL.selectByAttr('namespace'));
+    await click('[data-option-index="2"]');
+    await click(GENERAL.selectByAttr('mount'));
+    await click(`[data-option-index="${this.mountIdx}"]`);
+    await fillIn(GENERAL.inputByAttr('resourcePath'), `${this.type}-recovered-data`);
+    await click(GENERAL.button('read'));
+  });
+};
+
+module('Acceptance | recovery | snapshot-manage', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    recoveryHandler(this.server);
+
+    const snapshot = this.server.create('snapshot');
+    this.snapshot_id = snapshot.snapshot_id;
+    await login();
+    await visit('/vault/recovery/snapshots');
+  });
+
+  module('cubbyhole', function (hooks) {
+    hooks.beforeEach(function () {
+      this.type = 'cubbyhole';
+      this.mountIdx = '1.0';
+    });
+
+    requestTests(test);
+  });
+
+  module('kvv1', function (hooks) {
+    hooks.beforeEach(function () {
+      this.type = 'kv';
+      this.mountIdx = '1.1';
+    });
+
+    requestTests(test);
+
+    test('it makes the recovery request to custom mount paths', async function (assert) {
+      assert.expect(5);
+      // Stub no permissions to render manual input so we can supply a custom path
+      this.server.get('/sys/internal/ui/mounts', () => overrideResponse(403));
+      // Re-visit route to re-fire request to mounts endpoint
+      await visit('/vault/recovery/snapshots');
+
+      const customMountPath = `custom-kvv1`;
+      this.server.post(`/${customMountPath}/:path`, (schema, req) => {
+        assert.true(true, 'it makes request to custom path URL');
+        assert.strictEqual(req.params.path, `kvv1-recovered-data`, ':path param is expected value');
+
+        const expectedHeaders = {
+          'x-vault-recover-snapshot-id': this.snapshot_id,
+          'x-vault-namespace': '',
+        };
+
+        Object.entries(expectedHeaders).forEach(([key, value]) => {
+          assert.strictEqual(req.requestHeaders[key], value, `"${key}" header has expected value "${value}"`);
+        });
+      });
+
+      await click(GENERAL.button('Type'));
+      // First select a different type to ensure input resets as expected
+      await click(GENERAL.radioByAttr('database'));
+      await fillIn(GENERAL.inputByAttr('manual-mount-path'), 'bad-path');
+      // Now select type we actually want to use
+      await click(GENERAL.button('Type'));
+      await click(GENERAL.radioByAttr('kv'));
+      assert.dom(GENERAL.inputByAttr('manual-mount-path')).hasValue('', 'input clears when type changes');
+      await fillIn(GENERAL.inputByAttr('manual-mount-path'), customMountPath);
+      await fillIn(GENERAL.inputByAttr('resourcePath'), `kvv1-recovered-data`);
+      await click(GENERAL.button('recover'));
+    });
+  });
+
+  module('database static-roles', function (hooks) {
+    hooks.beforeEach(function () {
+      this.type = 'database/static-roles';
+      this.mountIdx = '0.0';
+    });
+
+    requestTests(test);
+
+    test('it makes the recovery request to custom mount paths', async function (assert) {
+      assert.expect(5);
+      // Stub no permissions to render manual input so we can supply a custom path
+      this.server.get('/sys/internal/ui/mounts', () => overrideResponse(403));
+      // Re-visit route to re-fire request to mounts endpoint
+      await visit('/vault/recovery/snapshots');
+
+      const customMountPath = `custom-database`;
+      this.server.post(`/${customMountPath}/static-roles/:path`, (schema, req) => {
+        assert.true(true, 'it makes request to custom path URL');
+        assert.strictEqual(req.params.path, `database-recovered-data`, ':path param is expected value');
+
+        const expectedHeaders = {
+          'x-vault-recover-snapshot-id': this.snapshot_id,
+          'x-vault-namespace': '',
+        };
+
+        Object.entries(expectedHeaders).forEach(([key, value]) => {
+          assert.strictEqual(req.requestHeaders[key], value, `"${key}" header has expected value "${value}"`);
+        });
+      });
+
+      await click(GENERAL.button('Type'));
+      // First select a different type to ensure input resets as expected
+      await click(GENERAL.radioByAttr('kv'));
+      await fillIn(GENERAL.inputByAttr('manual-mount-path'), 'bad-path');
+      // Now select type we actually want to use
+      await click(GENERAL.button('Type'));
+      await click(GENERAL.radioByAttr('database'));
+      assert.dom(GENERAL.inputByAttr('manual-mount-path')).hasValue('', 'input clears when type changes');
+      await fillIn(GENERAL.inputByAttr('manual-mount-path'), customMountPath);
+      await fillIn(GENERAL.inputByAttr('resourcePath'), `database-recovered-data`);
+      await click(GENERAL.button('recover'));
+    });
+  });
+});
diff --git a/ui/tests/acceptance/recovery/snapshots-load-test.js b/ui/tests/acceptance/recovery/snapshots-load-test.js
new file mode 100644
index 00000000000..e3865e770a2
--- /dev/null
+++ b/ui/tests/acceptance/recovery/snapshots-load-test.js
@@ -0,0 +1,35 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { click, currentRouteName, currentURL, visit } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Acceptance | recovery | snapshots-load', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.server.get('/sys/storage/raft/configuration', () => this.server.create('configuration', 'withRaft'));
+
+    return login();
+  });
+
+  test('it redirects to snapshot route when a snapshot is loaded', async function (assert) {
+    this.server.get('/sys/storage/raft/snapshot-load', () => {
+      return { data: { keys: [] } };
+    });
+
+    await visit('vault/recovery/snapshots');
+
+    await click(`${GENERAL.emptyStateActions} a`);
+
+    assert.strictEqual(currentURL(), '/vault/recovery/snapshots/load');
+    assert.strictEqual(currentRouteName(), 'vault.cluster.recovery.snapshots.load');
+  });
+});
diff --git a/ui/tests/acceptance/recovery/snapshots-test.js b/ui/tests/acceptance/recovery/snapshots-test.js
new file mode 100644
index 00000000000..5855960657c
--- /dev/null
+++ b/ui/tests/acceptance/recovery/snapshots-test.js
@@ -0,0 +1,102 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { visit, currentRouteName, currentURL, click } from '@ember/test-helpers';
+import { setupApplicationTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { Response } from 'miragejs';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { addDays } from 'date-fns';
+
+module('Acceptance | recovery | snapshots', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    return login();
+  });
+
+  test('enterprise: it renders empty state when raft storage is not in use', async function (assert) {
+    this.server.get('/sys/storage/raft/snapshot-load', () => {
+      return overrideResponse(400, JSON.stringify({ errors: ['raft storage is not in use'] }));
+    });
+    await visit('/vault/recovery/snapshots');
+    assert.strictEqual(currentURL(), '/vault/recovery/snapshots');
+    assert.dom('header').exists('it renders header despite route throwing an error');
+    assert.dom(GENERAL.emptyStateTitle).hasText('Raft storage required');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText('Raft storage must be used in order to recover data from a snapshot.');
+    assert.dom(GENERAL.emptyStateActions).hasText('Snapshot management');
+  });
+
+  test('it renders promo for community versions', async function (assert) {
+    const version = this.owner.lookup('service:version');
+    version.type = 'community';
+    this.server.get('/sys/storage/raft/snapshot-load', () => {
+      // This assertion is intentionally setup to fail if a request is made to this endpoint
+      // because community versions should NOT request the snapshot-load endpoint
+      assert.true(false, 'it does not make a request to snapshot-load on CE versions');
+    });
+
+    await visit('/vault/recovery/snapshots');
+    assert
+      .dom(`${GENERAL.navLink('Secrets Recovery')} .hds-badge`)
+      .hasText('Enterprise', 'side nav link renders "Enterprise" badge');
+    assert.strictEqual(currentURL(), '/vault/recovery/snapshots');
+    assert.dom(GENERAL.emptyStateTitle).hasText('Secrets Recovery is an enterprise feature');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'Secrets Recovery allows you to restore accidentally deleted or lost secrets from a snapshot. The snapshots can be provided via upload or loaded from external storage.'
+      );
+    assert.dom(GENERAL.emptyStateActions).hasText('Learn more about upgrading');
+    assert.dom(GENERAL.badge('enterprise')).exists();
+  });
+
+  module('enterprise: with raft configured', function (hooks) {
+    hooks.beforeEach(function () {
+      this.server.get('/sys/storage/raft/configuration', () =>
+        this.server.create('configuration', 'withRaft')
+      );
+    });
+
+    test('it renders empty state when no snapshots are loaded', async function (assert) {
+      this.server.get('/sys/storage/raft/snapshot-load', () => {
+        return new Response(404, { 'Content-Type': 'application/json' }, JSON.stringify({ errors: [] }));
+      });
+
+      await visit('/vault/recovery/snapshots');
+
+      assert.strictEqual(currentURL(), '/vault/recovery/snapshots');
+
+      assert.dom(GENERAL.emptyStateTitle).hasText('Upload a snapshot to get started');
+      assert.dom(GENERAL.emptyStateActions).hasText('Upload snapshot');
+    });
+
+    test('it redirects to snapshot route when a snapshot is loaded', async function (assert) {
+      this.server.get('/sys/storage/raft/snapshot-load', () => {
+        return { data: { keys: ['1234'] } };
+      });
+
+      this.server.get('/sys/storage/raft/snapshot-load/1234', () => {
+        return {
+          data: {
+            status: 'ready',
+            expires_at: addDays(new Date(), 3).toISOString(),
+            snapshot_id: '1234',
+          },
+        };
+      });
+
+      await click(GENERAL.navLink('Secrets Recovery'));
+      assert.strictEqual(currentURL(), '/vault/recovery/snapshots/1234/manage');
+      assert.strictEqual(currentRouteName(), 'vault.cluster.recovery.snapshots.snapshot.manage');
+    });
+  });
+});
diff --git a/ui/tests/acceptance/redirect-to-test.js b/ui/tests/acceptance/redirect-to-test.js
index dc788d1dbac..077b57863c9 100644
--- a/ui/tests/acceptance/redirect-to-test.js
+++ b/ui/tests/acceptance/redirect-to-test.js
@@ -1,14 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentURL, visit as _visit, settled } from '@ember/test-helpers';
+import { currentURL, visit as _visit, settled, fillIn, click, waitUntil } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { create } from 'ember-cli-page-object';
-import auth from 'vault/tests/pages/auth';
-import consoleClass from 'vault/tests/pages/components/console/ui-panel';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { runCmd } from 'vault/tests/helpers/commands';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const visit = async (url) => {
   try {
@@ -22,30 +23,12 @@ const visit = async (url) => {
   await settled();
 };
 
-const consoleComponent = create(consoleClass);
-
-const wrappedAuth = async () => {
-  await consoleComponent.runCommands(`write -field=token auth/token/create policies=default -wrap-ttl=5m`);
-  await settled();
-  // because of flaky test, trying to capture the token using a dom selector instead of the page object
-  const token = document.querySelector('[data-test-component="console/log-text"] pre').textContent;
-  if (token.includes('Error')) {
-    throw new Error(`Error mounting secrets engine: ${token}`);
-  }
-  return token;
-};
-
 const setupWrapping = async () => {
-  await auth.logout();
-  await settled();
-  await auth.visit();
-  await settled();
-  await auth.authType('token');
-  await auth.tokenInput('root').submit();
-  await settled();
-  const wrappedToken = await wrappedAuth();
+  await login();
+  const wrappedToken = await runCmd(`write -field=token auth/token/create policies=default -wrap-ttl=5m`);
   return wrappedToken;
 };
+
 module('Acceptance | redirect_to query param functionality', function (hooks) {
   setupApplicationTest(hooks);
 
@@ -56,17 +39,18 @@ module('Acceptance | redirect_to query param functionality', function (hooks) {
     localStorage.clear();
   });
   test('redirect to a route after authentication', async function (assert) {
-    const url = '/vault/secrets/secret/kv/create';
+    const url = '/vault/secrets-engines/secret/kv/create';
     await visit(url);
 
     assert.ok(
       currentURL().includes(`redirect_to=${encodeURIComponent(url)}`),
       `encodes url for the query param in ${currentURL()}`
     );
-    await auth.authType('token');
+    await fillIn(AUTH_FORM.selectMethod, 'token');
     // the login method on this page does another visit call that we don't want here
-    await auth.tokenInput('root').submit();
-    await settled();
+    await fillIn(GENERAL.inputByAttr('token'), 'root');
+    await click(GENERAL.submitButton);
+    await waitUntil(() => currentURL().includes('vault/secrets-engines'));
     assert.strictEqual(currentURL(), url, 'navigates to the redirect_to url after auth');
   });
 
@@ -77,28 +61,25 @@ module('Acceptance | redirect_to query param functionality', function (hooks) {
   });
 
   test('redirect to a route after authentication with a query param', async function (assert) {
-    const url = '/vault/secrets/secret/kv/create?initialKey=hello';
+    const url = '/vault/secrets-engines/secret/kv/create?initialKey=hello';
     await visit(url);
     assert.ok(
       currentURL().includes(`?redirect_to=${encodeURIComponent(url)}`),
       'encodes url for the query param'
     );
-    await auth.authType('token');
-    await auth.tokenInput('root').submit();
-    await settled();
+    await fillIn(AUTH_FORM.selectMethod, 'token');
+    await fillIn(GENERAL.inputByAttr('token'), 'root');
+    await click(GENERAL.submitButton);
+    await waitUntil(() => currentURL().includes('vault/secrets-engines'));
     assert.strictEqual(currentURL(), url, 'navigates to the redirect_to with the query param after auth');
   });
 
   test('redirect to logout with wrapped token authenticates you', async function (assert) {
     const wrappedToken = await setupWrapping();
-    const url = '/vault/secrets/cubbyhole/create';
-
-    await auth.logout({
-      redirect_to: url,
-      wrapped_token: wrappedToken,
-    });
-    await settled();
+    const url = '/vault/secrets-engines/cubbyhole/create';
 
+    await visit(`/vault/logout?redirect_to=${url}&wrapped_token=${wrappedToken}`);
+    await waitUntil(() => currentURL().includes('vault/secrets-engines'));
     assert.strictEqual(currentURL(), url, 'authenticates then navigates to the redirect_to url after auth');
   });
 });
diff --git a/ui/tests/acceptance/reduced-disclosure-test.js b/ui/tests/acceptance/reduced-disclosure-test.js
index 172d34eb8b1..8188286ba9c 100644
--- a/ui/tests/acceptance/reduced-disclosure-test.js
+++ b/ui/tests/acceptance/reduced-disclosure-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,12 +7,13 @@ import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { click, currentRouteName, currentURL, fillIn, settled, visit } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
-import { createTokenCmd, runCmd, tokenWithPolicyCmd } from 'vault/tests/helpers/commands';
+import { login, loginNs, logout } from 'vault/tests/helpers/auth/auth-helpers';
+import { createTokenCmd, deleteNS, runCmd, tokenWithPolicyCmd } from 'vault/tests/helpers/commands';
 import { pollCluster } from 'vault/tests/helpers/poll-cluster';
 import VAULT_KEYS from 'vault/tests/helpers/vault-keys';
 import reducedDisclosureHandlers from 'vault/mirage/handlers/reduced-disclosure';
-import { overrideResponse } from 'vault/tests/helpers/clients';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const { unsealKeys } = VAULT_KEYS;
 const SELECTORS = {
@@ -29,12 +30,12 @@ module('Acceptance | reduced disclosure test', function (hooks) {
     this.unsealCount = 0;
     this.sealed = false;
     this.versionSvc = this.owner.lookup('service:version');
-    return authPage.logout();
+    return logout();
   });
 
   test('login works when reduced disclosure enabled', async function (assert) {
     assert.dom(SELECTORS.footerVersion).hasText(`Vault`, 'shows Vault without version when logged out');
-    await authPage.login();
+    await login();
     assert.strictEqual(currentURL(), '/vault/dashboard');
 
     // Ensure it shows version on dashboard
@@ -45,10 +46,10 @@ module('Acceptance | reduced disclosure test', function (hooks) {
 
     const token = await runCmd(createTokenCmd('default'));
 
-    await authPage.logout();
+    await logout();
     assert.dom(SELECTORS.footerVersion).hasText(`Vault`, 'no vault version after logout');
 
-    await authPage.login(token);
+    await login(token);
     assert.strictEqual(currentURL(), '/vault/dashboard');
 
     assert
@@ -62,6 +63,7 @@ module('Acceptance | reduced disclosure test', function (hooks) {
         type: 'shamir',
         initialized: true,
         sealed: this.sealed,
+        version: '1.21.3',
       };
     });
     this.server.put(`/sys/seal`, () => {
@@ -82,20 +84,16 @@ module('Acceptance | reduced disclosure test', function (hooks) {
         progress: attemptCount,
       };
     });
-    await authPage.login();
+    await login();
 
-    const versionSvc = this.owner.lookup('service:version');
     await visit('/vault/settings/seal');
-    assert
-      .dom('[data-test-footer-version]')
-      .hasText(`Vault ${versionSvc.version}`, 'shows version on seal page');
+
+    assert.dom('[data-test-footer-version]').hasText(`Vault 1.21.3`, 'shows version on seal page');
     assert.strictEqual(currentURL(), '/vault/settings/seal');
 
     // seal
     await click('[data-test-seal]');
-
-    await click('[data-test-confirm-button]');
-
+    await click(GENERAL.confirmButton);
     await pollCluster(this.owner);
     await settled();
     assert.strictEqual(currentURL(), '/vault/unseal', 'vault is on the unseal page');
@@ -114,15 +112,13 @@ module('Acceptance | reduced disclosure test', function (hooks) {
     assert.dom('[data-test-cluster-status]').doesNotExist('ui does not show sealed warning');
     assert.strictEqual(currentRouteName(), 'vault.cluster.auth', 'vault is ready to authenticate');
     assert.dom('[data-test-footer-version]').hasText(`Vault`, 'Version is still not shown before auth');
-    await authPage.login();
-    assert
-      .dom('[data-test-footer-version]')
-      .hasText(`Vault ${versionSvc.version}`, 'Version is shown after login');
+    await login();
+    assert.dom('[data-test-footer-version]').hasText(`Vault 1.21.3`, 'Version is shown after login');
   });
 
   module('enterprise', function () {
     test('does not allow access to replication pages', async function (assert) {
-      await authPage.login();
+      await login();
       assert.dom('[data-test-sidebar-nav-link="Replication"]').doesNotExist('hides replication nav item');
 
       await visit(`/vault/replication/dr`);
@@ -136,7 +132,7 @@ module('Acceptance | reduced disclosure test', function (hooks) {
 
     test('it works for user accessing child namespace', async function (assert) {
       const namespace = 'reduced-disclosure';
-      await authPage.login();
+      await login();
 
       await runCmd(`write sys/namespaces/${namespace} -f`, false);
       const token = await runCmd(
@@ -150,8 +146,8 @@ module('Acceptance | reduced disclosure test', function (hooks) {
         )
       );
 
-      await authPage.logout();
-      await authPage.login(token);
+      await logout();
+      await login(token);
       assert
         .dom(SELECTORS.footerVersion)
         .hasText(`Vault ${this.versionSvc.version}`, 'shows Vault version for default policy in namespace');
@@ -165,11 +161,16 @@ module('Acceptance | reduced disclosure test', function (hooks) {
           'shows Vault version for default policy in child namespace'
         );
       assert.dom(SELECTORS.dashboardTitle).includesText('Vault v1.');
+
+      // log in to "root" before deleting
+      await login();
+      // clean up namespace pollution
+      await runCmd(deleteNS(namespace));
     });
     test('login works when reduced disclosure enabled (ent)', async function (assert) {
       const namespace = 'reduced-disclosure';
       assert.dom(SELECTORS.footerVersion).hasText(`Vault`, 'shows Vault without version when logged out');
-      await authPage.login();
+      await login();
       assert.strictEqual(currentURL(), '/vault/dashboard');
 
       // Ensure it shows version on dashboard
@@ -179,7 +180,7 @@ module('Acceptance | reduced disclosure test', function (hooks) {
         .hasText(`Vault ${this.versionSvc.version}`, 'shows Vault version after login');
 
       await runCmd(`write sys/namespaces/${namespace} -f`, false);
-      await authPage.loginNs(namespace);
+      await loginNs(namespace);
 
       assert
         .dom(SELECTORS.footerVersion)
@@ -187,14 +188,19 @@ module('Acceptance | reduced disclosure test', function (hooks) {
 
       const token = await runCmd(createTokenCmd('default'));
 
-      await authPage.logout();
+      await logout();
       assert.dom(SELECTORS.footerVersion).hasText(`Vault`, 'no vault version after logout');
 
-      await authPage.loginNs(namespace, token);
+      await loginNs(namespace, token);
       assert.strictEqual(currentURL(), '/vault/dashboard?namespace=reduced-disclosure');
       assert
         .dom(SELECTORS.footerVersion)
         .hasText(`Vault ${this.versionSvc.version}`, 'shows Vault version for default policy in namespace');
+
+      // log in to "root" before deleting
+      await login();
+      // clean up namespace pollution
+      await runCmd(deleteNS(namespace));
     });
   });
 });
diff --git a/ui/tests/acceptance/replication-nav-test.js b/ui/tests/acceptance/replication-nav-test.js
new file mode 100644
index 00000000000..731408f39ff
--- /dev/null
+++ b/ui/tests/acceptance/replication-nav-test.js
@@ -0,0 +1,50 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import replicationHandlers from 'vault/mirage/handlers/replication';
+import { click } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+const SELECTORS = {
+  navReplication: '[data-test-sidebar-nav-link="Replication"]',
+  navPerformance: '[data-test-sidebar-nav-link="Performance"]',
+  navDR: '[data-test-sidebar-nav-link="Disaster Recovery"]',
+  title: '[data-test-replication-title]',
+  primaryCluster: `${GENERAL.infoRowValue('primary_cluster_addr')}`,
+  replicationSet: `${GENERAL.infoRowValue('Replication set')}`,
+  knownSecondariesTitle: '.known-secondaries-card h3',
+};
+module('Acceptance | Enterprise | replication navigation', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    replicationHandlers(this.server);
+    return login();
+  });
+
+  test('navigate between replication types updates page', async function (assert) {
+    await click(SELECTORS.navReplication);
+    assert.dom(SELECTORS.title).hasText('Disaster Recovery & Performance primary');
+    await click(SELECTORS.navPerformance);
+
+    // Ensure data is expected for performance
+    assert.dom(SELECTORS.title).hasText('Performance primary');
+    assert.dom(SELECTORS.primaryCluster).hasText('perf-foobar');
+    assert.dom(SELECTORS.replicationSet).hasText('perf-cluster-id');
+    assert.dom(SELECTORS.knownSecondariesTitle).hasText('0 Known secondaries');
+
+    // Nav to DR and see updated data
+    await click(SELECTORS.navDR);
+    assert.dom(SELECTORS.title).hasText('Disaster Recovery primary');
+    assert.dom(SELECTORS.primaryCluster).hasText('dr-foobar');
+    assert.dom(SELECTORS.replicationSet).hasText('dr-cluster-id');
+    assert.dom(SELECTORS.knownSecondariesTitle).hasText('1 Known secondaries');
+  });
+});
diff --git a/ui/tests/acceptance/reset-password-test.js b/ui/tests/acceptance/reset-password-test.js
index 51a4a9ce3f3..1c744b177d1 100644
--- a/ui/tests/acceptance/reset-password-test.js
+++ b/ui/tests/acceptance/reset-password-test.js
@@ -1,14 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { currentURL, click, fillIn, settled, waitFor } from '@ember/test-helpers';
 import { setupApplicationTest } from 'vault/tests/helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login, loginMethod } from 'vault/tests/helpers/auth/auth-helpers';
 import { createPolicyCmd, deleteAuthCmd, mountAuthCmd, runCmd } from '../helpers/commands';
 import { v4 as uuidv4 } from 'uuid';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const SUCCESS_MESSAGE = 'Successfully reset password';
 
@@ -26,60 +27,32 @@ module('Acceptance | reset password', function (hooks) {
   });
 
   hooks.afterEach(async function () {
-    await authPage.login();
+    await login();
     await runCmd([deleteAuthCmd(this.userpass), `delete sys/policies/acl/${this.userpass}`], false);
   });
 
   test('does not allow password reset for non-userpass users', async function (assert) {
-    await authPage.login();
+    await login();
     await settled();
 
-    await click('[data-test-user-menu-trigger]');
+    await click(GENERAL.button('user-menu-trigger'));
     assert.dom('[data-test-user-menu-item="reset-password"]').doesNotExist();
   });
 
   test('allows password reset for userpass users logged in via dropdown', async function (assert) {
-    await authPage.login();
+    await login();
     await runCmd([
       mountAuthCmd('userpass', this.userpass),
       createPolicyCmd(this.userpass, this.policy),
       `write auth/${this.userpass}/users/reset-me password=password token_policies=${this.userpass}`,
     ]);
-    await authPage.loginUsername('reset-me', 'password', this.userpass);
 
-    await click('[data-test-user-menu-trigger]');
-    await click('[data-test-user-menu-item="reset-password"]');
-
-    assert.strictEqual(currentURL(), '/vault/access/reset-password', 'links to password reset');
-    assert
-      .dom('[data-test-current-user-banner]')
-      .hasText(
-        `You are updating the password for reset-me on the ${this.userpass} auth mount.`,
-        'shows correct banner text'
-      );
-
-    assert.dom('[data-test-title]').hasText('Reset password', 'page title');
-    await fillIn('[data-test-textarea]', 'newpassword');
-    await click('[data-test-reset-password-save]');
-    await waitFor('[data-test-flash-message]');
-    assert.dom('[data-test-flash-message]').hasText(`Success ${SUCCESS_MESSAGE}`);
-    assert.dom('[data-test-textarea]').hasValue('', 'Resets input after save');
-  });
-
-  test('allows password reset for userpass users logged in via tab', async function (assert) {
-    await authPage.login();
-    await runCmd([
-      mountAuthCmd('userpass', this.userpass),
-      `write sys/auth/${this.userpass}/tune listing_visibility="unauth"`,
-      createPolicyCmd(this.userpass, this.policy),
-      `write auth/${this.userpass}/users/reset-me password=password token_policies=${this.userpass}`,
-    ]);
-    await authPage.logout();
-    await click(`[data-test-auth-method="${this.userpass}"] a`);
-    await authPage.usernameInput('reset-me');
-    await authPage.passwordInput('password').submit();
+    await loginMethod(
+      { username: 'reset-me', password: 'password', path: this.userpass },
+      { authType: 'userpass', toggleOptions: true }
+    );
 
-    await click('[data-test-user-menu-trigger]');
+    await click(GENERAL.button('user-menu-trigger'));
     await click('[data-test-user-menu-item="reset-password"]');
 
     assert.strictEqual(currentURL(), '/vault/access/reset-password', 'links to password reset');
@@ -91,10 +64,10 @@ module('Acceptance | reset password', function (hooks) {
       );
 
     assert.dom('[data-test-title]').hasText('Reset password', 'page title');
-    await fillIn('[data-test-textarea]', 'newpassword');
-    await click('[data-test-reset-password-save]');
+    await fillIn('[data-test-input="reset-password"]', 'newpassword');
+    await click(GENERAL.submitButton);
     await waitFor('[data-test-flash-message]');
     assert.dom('[data-test-flash-message]').hasText(`Success ${SUCCESS_MESSAGE}`);
-    assert.dom('[data-test-textarea]').hasValue('', 'Resets input after save');
+    assert.dom('[data-test-input="reset-password"]').hasValue('', 'Resets input after save');
   });
 });
diff --git a/ui/tests/acceptance/saml-auth-method-test.js b/ui/tests/acceptance/saml-auth-method-test.js
index c95ff37fee2..50e5d874917 100644
--- a/ui/tests/acceptance/saml-auth-method-test.js
+++ b/ui/tests/acceptance/saml-auth-method-test.js
@@ -1,35 +1,39 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import sinon from 'sinon';
-import { click, fillIn, find, waitUntil } from '@ember/test-helpers';
+import { click, fillIn, find, visit, waitUntil, waitFor } from '@ember/test-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { Response } from 'miragejs';
-import authPage from 'vault/tests/pages/auth';
-import { fakeWindow } from 'vault/tests/helpers/oidc-window-stub';
+import { DELAY_IN_MS, windowStub } from 'vault/tests/helpers/oidc-window-stub';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+import { logout } from 'vault/tests/helpers/auth/auth-helpers';
+import { getErrorResponse } from 'vault/tests/helpers/api/error-response';
+import sinon from 'sinon';
+import { ERROR_POPUP_FAILED, ERROR_TIMEOUT, ERROR_WINDOW_CLOSED } from 'vault/utils/auth-form-helpers';
 
 module('Acceptance | enterprise saml auth method', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
-  hooks.beforeEach(function () {
-    this.openStub = sinon.stub(window, 'open').callsFake(() => fakeWindow.create());
-    this.server.put('/auth/saml/sso_service_url', () => ({
+  hooks.beforeEach(async function () {
+    this.openStub = windowStub();
+    this.server.post('/auth/saml/sso_service_url', () => ({
       data: {
-        sso_service_url: 'http://sso-url.hashicorp.com/service',
+        sso_service_url: 'test/fake/sso/route', // we aren't actually opening a popup so use a fake url
         token_poll_id: '1234',
       },
     }));
-    this.server.put('/auth/saml/token', () => ({
+    this.server.post('/auth/saml/token', () => ({
       auth: { client_token: 'root' },
     }));
     // ensure clean state
-    localStorage.removeItem('selectedAuth');
-    authPage.logout();
+    await logout(); // clears local storage
   });
 
   hooks.afterEach(function () {
@@ -40,18 +44,17 @@ module('Acceptance | enterprise saml auth method', function (hooks) {
     assert.expect(1);
 
     this.server.get('/auth/token/lookup-self', (schema, req) => {
-      assert.ok(true, 'request made to auth/token/lookup-self after saml callback');
-      req.passthrough();
+      assert.true(true, 'request made to auth/token/lookup-self after saml callback');
+      return req.passthrough();
     });
     // select from dropdown or click auth path tab
-    await waitUntil(() => find('[data-test-select="auth-method"]'));
-    await fillIn('[data-test-select="auth-method"]', 'saml');
-    await click('[data-test-auth-submit]');
+    await waitUntil(() => find(AUTH_FORM.selectMethod), { timeout: DELAY_IN_MS });
+    await fillIn(AUTH_FORM.selectMethod, 'saml');
+    await click(GENERAL.submitButton);
   });
 
   test('it should login with saml from listed auth mount tab', async function (assert) {
     assert.expect(4);
-
     this.server.get('/sys/internal/ui/mounts', () => ({
       data: {
         auth: {
@@ -59,16 +62,16 @@ module('Acceptance | enterprise saml auth method', function (hooks) {
         },
       },
     }));
-    this.server.put('/auth/test-path/sso_service_url', () => {
+    this.server.post('/auth/test-path/sso_service_url', () => {
       assert.ok(true, 'role request made to correct non-standard mount path');
       return {
         data: {
-          sso_service_url: 'http://sso-url.hashicorp.com/service',
+          sso_service_url: 'test/fake/sso/route',
           token_poll_id: '1234',
         },
       };
     });
-    this.server.put('/auth/test-path/token', () => {
+    this.server.post('/auth/test-path/token', () => {
       assert.ok(true, 'login request made to correct non-standard mount path');
       return {
         auth: { client_token: 'root' },
@@ -81,81 +84,93 @@ module('Acceptance | enterprise saml auth method', function (hooks) {
         { 'X-Vault-Token': 'root' },
         'calls lookup-self with returned client token after login'
       );
-      req.passthrough();
+      return req.passthrough();
     });
 
+    await logout(); // clear local storage and refresh route so sys/internal/ui/mounts is reliably called
     // click auth path tab
-    await waitUntil(() => find('[data-test-auth-method="test-path"]'));
-    await click('[data-test-auth-method="test-path"]');
-    await click('[data-test-auth-submit]');
+    await waitUntil(() => find(AUTH_FORM.tabBtn('saml')), { timeout: DELAY_IN_MS });
+    await click(GENERAL.submitButton);
   });
 
-  test('it should render API errors from both endpoints', async function (assert) {
-    assert.expect(3);
-
-    this.server.put('/auth/saml/sso_service_url', (schema, { requestBody }) => {
-      const { role } = JSON.parse(requestBody);
-      if (!role) {
-        return new Response(
-          400,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify({ errors: ["missing required 'role' parameter"] })
-        );
-      }
-      return {
-        data: {
-          sso_service_url: 'http://sso-url.hashicorp.com/service',
-          token_poll_id: '1234',
-        },
-      };
-    });
-    this.server.put('/auth/saml/token', (schema, { requestHeaders }) => {
-      if (requestHeaders['X-Vault-Namespace']) {
-        return new Response(
-          400,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify({ errors: ['something went wrong'] })
-        );
-      }
-      return {
-        auth: { client_token: 'root' },
-      };
-    });
-    this.server.get('/auth/token/lookup-self', (schema, req) => {
-      assert.ok(true, 'request made to auth/token/lookup-self after saml callback');
-      req.passthrough();
+  test('it should render API errors from sso_service_url', async function (assert) {
+    assert.expect(1);
+    this.server.post('/auth/saml/sso_service_url', () => {
+      return new Response(
+        400,
+        { 'Content-Type': 'application/json' },
+        JSON.stringify({ errors: ["missing required 'role' parameter"] })
+      );
     });
 
     // select saml auth type
-    await waitUntil(() => find('[data-test-select="auth-method"]'));
-    await fillIn('[data-test-select="auth-method"]', 'saml');
-    await fillIn('[data-test-auth-form-ns-input]', 'some-ns');
-    await click('[data-test-auth-submit]');
+    await waitUntil(() => find(AUTH_FORM.selectMethod), { timeout: DELAY_IN_MS });
+    await fillIn(AUTH_FORM.selectMethod, 'saml');
+    await click(GENERAL.submitButton);
     assert
-      .dom('[data-test-message-error-description]')
-      .hasText("missing required 'role' parameter", 'shows API error from role fetch');
+      .dom(GENERAL.messageError)
+      .hasText(
+        "Error Authentication failed: missing required 'role' parameter",
+        'shows API error from role fetch'
+      );
+  });
+
+  test('it should render timeout error from polling token', async function (assert) {
+    assert.expect(1);
+    const api = this.owner.lookup('service:api');
+    const samlWriteTokenStub = sinon.stub(api.auth, 'samlWriteToken');
+    samlWriteTokenStub.rejects(getErrorResponse({}, 401));
+    await waitUntil(() => find(AUTH_FORM.selectMethod), { timeout: DELAY_IN_MS });
+    await fillIn(AUTH_FORM.selectMethod, 'saml');
+    await click(GENERAL.submitButton);
+    // Polling timeout is 1 second for testing environments
+    await waitFor(GENERAL.messageError, { timeout: 1000 });
+    assert.dom(GENERAL.messageError).hasText(`Error Authentication failed: ${ERROR_TIMEOUT}`);
+  });
 
-    await fillIn('[data-test-role]', 'my-role');
-    await click('[data-test-auth-submit]');
+  test('it renders error when popup is prematurely closed', async function (assert) {
+    windowStub({ stub: this.openStub, popup: { closed: true, close: () => {} } });
+
+    await logout();
+    await fillIn(AUTH_FORM.selectMethod, 'saml');
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.messageError).hasText(`Error Authentication failed: ${ERROR_WINDOW_CLOSED}`);
+  });
+
+  test('it renders error when window fails to open', async function (assert) {
+    this.openStub.returns(null);
+
+    await logout();
+    await fillIn(AUTH_FORM.selectMethod, 'saml');
+    await click(GENERAL.submitButton);
     assert
-      .dom('[data-test-message-error-description]')
-      .hasText('something went wrong', 'shows API error from login attempt');
+      .dom(GENERAL.messageError)
+      .hasText(`Error Authentication failed: Failed to open SAML popup window. ${ERROR_POPUP_FAILED}`);
+  });
 
-    await fillIn('[data-test-auth-form-ns-input]', '');
-    await click('[data-test-auth-submit]');
+  test('it should render API errors from saml token polling url', async function (assert) {
+    assert.expect(1);
+    const api = this.owner.lookup('service:api');
+    const samlWriteTokenStub = sinon.stub(api.auth, 'samlWriteToken');
+    samlWriteTokenStub.rejects(getErrorResponse({ errors: ['something went wrong'] }, 400));
+
+    // select saml auth type
+    await waitUntil(() => find(AUTH_FORM.selectMethod), { timeout: DELAY_IN_MS });
+    await fillIn(AUTH_FORM.selectMethod, 'saml');
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.messageError).hasText('Error Authentication failed: something went wrong');
+    samlWriteTokenStub.restore();
   });
 
   test('it should populate saml auth method on logout', async function (assert) {
-    authPage.logout();
+    await visit('/vault/logout');
     // select from dropdown
-    await waitUntil(() => find('[data-test-select="auth-method"]'));
-    await fillIn('[data-test-select="auth-method"]', 'saml');
-    await click('[data-test-auth-submit]');
-    await waitUntil(() => find('[data-test-user-menu-trigger]'));
-    await click('[data-test-user-menu-trigger]');
+    await waitUntil(() => find(AUTH_FORM.selectMethod), { timeout: DELAY_IN_MS });
+    await fillIn(AUTH_FORM.selectMethod, 'saml');
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(GENERAL.button('user-menu-trigger')), { timeout: DELAY_IN_MS });
+    await click(GENERAL.button('user-menu-trigger'));
     await click('#logout');
-    assert
-      .dom('[data-test-select="auth-method"]')
-      .hasValue('saml', 'Previous auth method selected on logout');
+    assert.dom(AUTH_FORM.selectMethod).hasValue('saml', 'Previous auth method selected on logout');
   });
 });
diff --git a/ui/tests/acceptance/secret-engine-list-view-test.js b/ui/tests/acceptance/secret-engine-list-view-test.js
new file mode 100644
index 00000000000..2dba3d79fcc
--- /dev/null
+++ b/ui/tests/acceptance/secret-engine-list-view-test.js
@@ -0,0 +1,243 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, fillIn, currentRouteName, visit, currentURL } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { v4 as uuidv4 } from 'uuid';
+
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import {
+  createTokenCmd,
+  deleteEngineCmd,
+  mountEngineCmd,
+  runCmd,
+  tokenWithPolicyCmd,
+} from 'vault/tests/helpers/commands';
+import { login, loginNs } from 'vault/tests/helpers/auth/auth-helpers';
+import page from 'vault/tests/pages/settings/mount-secret-backend';
+
+module('Acceptance | secret-engine list view', function (hooks) {
+  setupApplicationTest(hooks);
+
+  const createSecret = async (path, key, value, enginePath) => {
+    await click(SES.createSecretLink);
+    await fillIn(SES.secretPath('create'), path);
+    await fillIn(SES.secretKey('create'), key);
+    await fillIn(GENERAL.inputByAttr(key), value);
+    await click(GENERAL.submitButton);
+    await click(SES.crumb(enginePath));
+  };
+
+  hooks.beforeEach(function () {
+    this.uid = uuidv4();
+    return login();
+  });
+
+  // the new API service camelizes response keys, so this tests is to assert that does NOT happen when we re-implement it
+  test('it does not camelize the secret mount path', async function (assert) {
+    await visit('/vault/secrets-engines');
+    await page.enableEngine();
+    await click(GENERAL.cardContainer('aws'));
+    await fillIn(GENERAL.inputByAttr('path'), 'aws_engine');
+    await click(GENERAL.submitButton);
+    await click(GENERAL.breadcrumbLink('Secrets'));
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backends',
+      'breadcrumb navigates to the list page'
+    );
+    assert.dom(GENERAL.tableData('aws_engine/', 'path')).hasTextContaining('aws_engine/');
+    // cleanup
+    await runCmd(deleteEngineCmd('aws_engine'));
+  });
+
+  test('after enabling an unsupported engine it takes you to list page', async function (assert) {
+    await visit('/vault/secrets-engines');
+    await page.enableEngine();
+    await click(GENERAL.cardContainer('nomad'));
+    await click(GENERAL.submitButton);
+
+    assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backends', 'navigates to the list page');
+    // cleanup
+    await runCmd(deleteEngineCmd('nomad'));
+  });
+
+  test('after enabling a supported engine it takes you to mount page, can see configure and clicking breadcrumb takes you back to list page', async function (assert) {
+    await visit('/vault/secrets-engines');
+    await page.enableEngine();
+    await click(GENERAL.cardContainer('aws'));
+    await click(GENERAL.submitButton);
+
+    assert.dom(SES.configTab).exists();
+
+    await click(GENERAL.breadcrumbLink('Secrets'));
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backends',
+      'breadcrumb navigates to the list page'
+    );
+    // cleanup
+    await runCmd(deleteEngineCmd('aws'));
+  });
+
+  test('enterprise: cannot view list without permissions inside a namespace', async function (assert) {
+    this.namespace = `ns-${this.uid}`;
+    const enginePath1 = `kv-t1-${this.uid}`;
+    const userDefault = await runCmd(createTokenCmd()); // creates a default user token
+
+    await runCmd([`write sys/namespaces/${this.namespace} -force`]); // creates a namespace
+    await loginNs(this.namespace); //logs into namespace with root token
+    await runCmd(mountEngineCmd('kv', enginePath1)); // mounts a kv engine in namespace
+
+    await loginNs(this.namespace, userDefault); // logs into that same namespace with a default user token
+
+    await visit(`/vault/secrets-engines?namespace=${this.namespace}`); // nav to specified namespace list
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines?namespace=${this.namespace}`,
+      'Should be on main secret engines list page within namespace.'
+    );
+    assert.dom(GENERAL.tableData(`${enginePath1}/`, 'path')).doesNotExist(); // without permissions, engine should not show for this user
+
+    // cleanup namespace
+    await login();
+    await runCmd(`delete sys/namespaces/${this.namespace}`);
+  });
+
+  test('enterprise: can view list with permissions inside a namespace', async function (assert) {
+    this.namespace = `ns-${this.uid}`;
+    const enginePath1 = `kv-t2-${this.uid}`;
+    const userToken = await runCmd(
+      tokenWithPolicyCmd(
+        'policy',
+        `path "${this.namespace}/sys/*" {
+          capabilities = ["create", "read", "update", "delete", "list"]
+        }`
+      )
+    );
+
+    await runCmd([`write sys/namespaces/${this.namespace} -force`]);
+    await loginNs(this.namespace, userToken); // logs into namespace with user token
+    await runCmd(mountEngineCmd('kv', enginePath1)); // mount kv engine as user
+
+    await loginNs(this.namespace); // logs into namespace with root token
+
+    await visit(`/vault/secrets-engines?namespace=${this.namespace}`); // nav to specified namespace list
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines?namespace=${this.namespace}`,
+      'Should be on main secret engines list page within namespace.'
+    );
+
+    assert.dom(GENERAL.tableData(`${enginePath1}/`, 'path')).exists(); // with permissions, able to see the engine in list
+
+    // cleanup namespace
+    await login();
+    await runCmd(`delete sys/namespaces/${this.namespace}`);
+  });
+
+  test('enterprise: it should navigate to cubbyhole list view in child namespace', async function (assert) {
+    this.namespace = `ns-${this.uid}`;
+
+    await runCmd([`write sys/namespaces/${this.namespace} -force`]);
+    await loginNs(this.namespace);
+    await visit(`/vault/secrets-engines?namespace=${this.namespace}`);
+    await click(`${GENERAL.tableData('cubbyhole/', 'path')} a`);
+
+    assert.dom(GENERAL.emptyStateTitle).hasText('No secrets in this backend');
+
+    // cleanup namespace
+    await login();
+    await runCmd(`delete sys/namespaces/${this.namespace}`);
+  });
+
+  test('after disabling it stays on the list view', async function (assert) {
+    // first mount an engine so we can disable it.
+    const enginePath = `alicloud-disable-${this.uid}`;
+    await runCmd(mountEngineCmd('alicloud', enginePath));
+    await visit('/vault/secrets-engines');
+    // to reduce flakiness, searching by engine name first in case there are pagination issues
+    await fillIn(GENERAL.inputSearch('secret-engine-path'), enginePath);
+    assert.dom(GENERAL.tableData(`${enginePath}/`, 'path')).exists('the alicloud engine is mounted');
+
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.menuItem('disable-engine'));
+    await click(GENERAL.confirmButton);
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backends',
+      'redirects to the backends list page'
+    );
+  });
+
+  test('it allows navigation to a non-nested secret with pagination', async function (assert) {
+    assert.expect(2);
+
+    const enginePath1 = `kv-v1-${this.uid}`;
+    const secretPath = 'secret-9';
+    await runCmd(mountEngineCmd('kv', enginePath1));
+
+    // check kv1
+    await visit('/vault/secrets-engines');
+    await click(`${GENERAL.tableData(`${enginePath1}/`, 'path')} a`);
+    for (let i = 0; i <= 15; i++) {
+      await createSecret(`secret-${i}`, 'foo', 'bar', enginePath1);
+    }
+
+    // navigate and check that details view is shown from non-nested secrets
+    await click(GENERAL.nextPage);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${enginePath1}/list?page=2`,
+      'After clicking next page in navigates to the second page.'
+    );
+    await click(SES.secretLink(secretPath));
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${enginePath1}/show/${secretPath}`,
+      'After clicking a non-nested secret, it navigates to the details view.'
+    );
+
+    // cleanup
+    await runCmd(deleteEngineCmd(enginePath1));
+  });
+
+  test('it allows navigation to a nested secret with pagination', async function (assert) {
+    assert.expect(2);
+
+    const enginePath1 = `kv-v1-${this.uid}`;
+    const parentPath = 'nested';
+
+    await runCmd(mountEngineCmd('kv', enginePath1));
+
+    // check kv1
+    await visit('/vault/secrets-engines');
+    await click(`${GENERAL.tableData(`${enginePath1}/`, 'path')} a`);
+    for (let i = 0; i <= 15; i++) {
+      await createSecret(`${parentPath}/secret-${i}`, 'foo', 'bar', enginePath1);
+    }
+
+    // navigate and check that the children list view is shown from nested secrets
+    await click(SES.secretLink(`${parentPath}/`));
+
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${enginePath1}/list/${parentPath}/`,
+      'After clicking a nested secret it navigates to the children list view.'
+    );
+
+    await click(GENERAL.nextPage);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${enginePath1}/list/${parentPath}/?page=2`,
+      'After clicking next page it navigates to the second page.'
+    );
+
+    // cleanup
+    await runCmd(deleteEngineCmd(enginePath1));
+  });
+});
diff --git a/ui/tests/acceptance/secrets/backend/alicloud/secret-test.js b/ui/tests/acceptance/secrets/backend/alicloud/secret-test.js
deleted file mode 100644
index e1f5114e7c2..00000000000
--- a/ui/tests/acceptance/secrets/backend/alicloud/secret-test.js
+++ /dev/null
@@ -1,40 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { currentRouteName, settled } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import { v4 as uuidv4 } from 'uuid';
-
-import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
-import backendsPage from 'vault/tests/pages/secrets/backends';
-import authPage from 'vault/tests/pages/auth';
-
-module('Acceptance | alicloud/enable', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.uid = uuidv4();
-    return authPage.login();
-  });
-
-  test('enable alicloud', async function (assert) {
-    const enginePath = `alicloud-${this.uid}`;
-    await mountSecrets.visit();
-    await settled();
-    await mountSecrets.selectType('alicloud');
-    await settled();
-    await mountSecrets.path(enginePath).submit();
-    await settled();
-
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.secrets.backends',
-      'redirects to the backends page'
-    );
-    await settled();
-    assert.ok(backendsPage.rows.filterBy('path', `${enginePath}/`)[0], 'shows the alicloud engine');
-  });
-});
diff --git a/ui/tests/acceptance/secrets/backend/aws/aws-configuration-test.js b/ui/tests/acceptance/secrets/backend/aws/aws-configuration-test.js
new file mode 100644
index 00000000000..c3491238093
--- /dev/null
+++ b/ui/tests/acceptance/secrets/backend/aws/aws-configuration-test.js
@@ -0,0 +1,402 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, fillIn, visit, currentURL } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { v4 as uuidv4 } from 'uuid';
+import { spy } from 'sinon';
+
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import {
+  expectedConfigKeys,
+  expectedValueOfConfigKeys,
+  configUrl,
+  fillInAwsConfig,
+} from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
+
+module('Acceptance | aws | configuration', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    const flash = this.owner.lookup('service:flash-messages');
+    this.flashSuccessSpy = spy(flash, 'success');
+    this.flashInfoSpy = spy(flash, 'info');
+    this.flashDangerSpy = spy(flash, 'danger');
+    this.version = this.owner.lookup('service:version');
+    this.uid = uuidv4();
+    this.awsRootConfigResponse = {
+      data: {
+        region: 'us-west-2',
+        access_key: '123-key',
+        iam_endpoint: 'iam-endpoint',
+        sts_endpoint: 'sts-endpoint',
+        max_retries: 1,
+      },
+    };
+    return login();
+  });
+
+  module('Enterprise', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.type = 'enterprise';
+    });
+
+    test('it should prompt configuration after mounting the aws engine', async function (assert) {
+      const path = `aws-${this.uid}`;
+      // in this test go through the full mount process. Bypass this step in later tests.
+      await visit('/vault/secrets-engines/enable');
+      await mountBackend('aws', path);
+      await click(SES.configTab);
+      assert.dom(GENERAL.emptyStateTitle).hasText('AWS not configured');
+      assert.dom(GENERAL.emptyStateActions).hasText('Configure AWS');
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    test('it should transition to configure page on click "Configure" from toolbar', async function (assert) {
+      const path = `aws-${this.uid}`;
+      await enablePage.enable('aws', path);
+      await click(SES.configTab);
+      await click(SES.configure);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${path}/configuration/edit`);
+      assert.dom(SES.configureTitle('aws')).hasText('Configure AWS');
+      assert.dom(SES.configureForm).exists('it lands on the configuration form.');
+      assert
+        .dom(SES.additionalConfigModelTitle)
+        .hasText(
+          'Lease Configuration',
+          'it shows the lease configuration section with the "Lease Configuration" title.'
+        );
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    test('it should show error if old url is entered', async function (assert) {
+      // we are intentionally not redirecting from the old url to the new one.
+      const path = `aws-${this.uid}`;
+      await enablePage.enable('aws', path);
+      await click(SES.configTab);
+      await visit(`/vault/settings/secrets/configure/${path}`);
+      assert.dom(GENERAL.notFound).exists('shows page-error');
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    test('it should save root AWS—with WIF options—configuration', async function (assert) {
+      const path = `aws-${this.uid}`;
+      await enablePage.enable('aws', path);
+
+      this.server.post(configUrl('aws-lease', path), () => {
+        throw new Error(
+          'A POST request was made to config/lease when it should not because no data was changed.'
+        );
+      });
+
+      await click(SES.configTab);
+      await click(SES.configure);
+      await fillInAwsConfig('withWif');
+      await click(GENERAL.submitButton);
+      assert.dom(SES.wif.issuerWarningModal).exists('issuer warning modal exists');
+      await click(SES.wif.issuerWarningSave);
+      // three flash messages, the first is about mounting the engine, only care about the last two
+      assert.strictEqual(
+        this.flashSuccessSpy.args[1][0],
+        `Successfully saved ${path}'s configuration.`,
+        'first flash message about the first model config.'
+      );
+      assert.dom(GENERAL.infoRowValue('Issuer')).exists('Issuer has been set and is shown.');
+      assert.dom(GENERAL.infoRowValue('Role ARN')).hasText('foo-role', 'Role ARN has been set.');
+      assert
+        .dom(GENERAL.infoRowValue('Identity token audience'))
+        .hasText('foo-audience', 'Identity token audience has been set.');
+      assert
+        .dom(GENERAL.infoRowValue('Identity token TTL'))
+        .hasText('2 hours', 'Identity token TTL has been set.');
+      assert.dom(GENERAL.infoRowValue('Access key')).doesNotExist('Access key—a non-wif attr is not shown.');
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    test('it should not show issuer if no root WIF configuration data is returned', async function (assert) {
+      const path = `aws-${this.uid}`;
+      const type = 'aws';
+
+      this.server.get(`${path}/config/root`, () => {
+        assert.true(true, 'request made to config/root when navigating to the configuration page.');
+        return this.awsRootConfigResponse;
+      });
+      this.server.get(`identity/oidc/config`, () => {
+        throw new Error(`Request was made to return the issuer when it should not have been.`);
+      });
+
+      await enablePage.enable(type, path);
+      await click(SES.configTab);
+      assert.dom(GENERAL.infoRowLabel('Issuer')).doesNotExist(`Issuer does not exists on config details.`);
+      assert.dom(GENERAL.infoRowLabel('Access key')).exists(`Access key does exists on config details.`);
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    test('it should save root AWS—with IAM options—configuration', async function (assert) {
+      assert.expect(3);
+      const path = `aws-${this.uid}`;
+      await enablePage.enable('aws', path);
+
+      this.server.post(configUrl('aws-lease', path), () => {
+        throw new Error(`post request was made to config/lease when it should not have been.`);
+      });
+
+      await click(SES.configTab);
+      await click(SES.configure);
+      await fillInAwsConfig('withAccess');
+      await click(GENERAL.submitButton);
+      assert.true(
+        this.flashSuccessSpy.calledWith(`Successfully saved ${path}'s configuration.`),
+        'Success flash message is rendered showing the configuration was saved.'
+      );
+      assert.dom(GENERAL.infoRowValue('Access key')).hasText('foo', 'Access Key has been set.');
+      assert
+        .dom(GENERAL.infoRowValue('Secret key'))
+        .doesNotExist('Secret key is not shown because it does not get returned by the api.');
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    test('it should show identity_token_ttl or maxRetries even if they have not been set', async function (assert) {
+      // documenting the intention that we show fields that have not been set but are returned by the api due to defaults
+      const path = `aws-${this.uid}`;
+      await enablePage.enable('aws', path);
+
+      await click(SES.configTab);
+      await click(SES.configure);
+      // manually fill in attrs without using helper so we can exclude identity_token_ttl and max_retries.
+      await click(SES.wif.accessType('wif')); // toggle to wif
+      await fillIn(GENERAL.inputByAttr('role_arn'), 'foo-role');
+      await fillIn(GENERAL.inputByAttr('identity_token_audience'), 'foo-audience');
+      // manually fill in non-access type specific fields on root config so we can exclude Max Retries.
+      await click(GENERAL.button('Root config options'));
+      await fillIn(GENERAL.inputByAttr('region'), 'eu-central-1');
+      await click(GENERAL.submitButton);
+      assert
+        .dom(GENERAL.infoRowValue('Identity token TTL'))
+        .hasText('0', 'Identity token TTL shows default.');
+      assert
+        .dom(GENERAL.infoRowValue('Max retries'))
+        .hasText('-1', 'Max retries shows -1 indicating the default will be used.');
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    test('it shows AWS mount configuration details', async function (assert) {
+      const path = `aws-${this.uid}`;
+      const type = 'aws';
+
+      this.server.get(`${path}/config/root`, () => {
+        assert.true(true, 'request made to config/root when navigating to the configuration page.');
+        return this.awsRootConfigResponse;
+      });
+
+      await enablePage.enable(type, path);
+      await click(SES.configTab);
+
+      for (const key of expectedConfigKeys(type)) {
+        if (key === 'Secret key') continue; // secret-key is not returned by the API
+        assert.dom(GENERAL.infoRowLabel(key)).exists(`${key} on the ${type} config details exists.`);
+        const responseKeyAndValue = expectedValueOfConfigKeys(type, key);
+        assert
+          .dom(GENERAL.infoRowValue(key))
+          .hasText(responseKeyAndValue, `value for ${key} on the ${type} config details exists.`);
+      }
+      // check mount configuration details are present and accurate.
+      await click(SES.configurationToggle);
+      assert
+        .dom(GENERAL.infoRowValue('Path'))
+        .hasText(`${path}/`, 'mount path is displayed in the configuration details');
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    test('it should update AWS configuration details after editing', async function (assert) {
+      const path = `aws-${this.uid}`;
+      const type = 'aws';
+      await enablePage.enable(type, path);
+      // create access_key with value foo and confirm it shows up in the details page.
+      await click(SES.configTab);
+      await click(SES.configure);
+      await fillInAwsConfig('withAccess');
+      await click(GENERAL.submitButton);
+      assert.dom(GENERAL.infoRowValue('Access key')).hasText('foo', 'Access key is foo');
+      assert
+        .dom(GENERAL.infoRowValue('Region'))
+        .doesNotExist('Region has not been added therefor it does not show up on the details view.');
+      // edit root config details and lease config details and confirm the configuration.index page is updated.
+      await click(SES.configure);
+      // edit root config details
+      await fillIn(GENERAL.inputByAttr('access_key'), 'not-foo');
+      await click(GENERAL.button('Root config options'));
+      await fillIn(GENERAL.inputByAttr('region'), 'ap-southeast-2');
+      // add lease config details
+      await fillInAwsConfig('withLease');
+      await click(GENERAL.submitButton);
+      assert
+        .dom(GENERAL.infoRowValue('Access key'))
+        .hasText('not-foo', 'Access key has been updated to not-foo');
+      assert.dom(GENERAL.infoRowValue('Region')).hasText('ap-southeast-2', 'Region has been added');
+      assert
+        .dom(GENERAL.infoRowValue('Default Lease TTL'))
+        .hasText('33 seconds', 'Default Lease TTL has been added');
+      assert.dom(GENERAL.infoRowValue('Max Lease TTL')).hasText('44 seconds', 'Max Lease TTL has been added');
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    test('it saves lease configuration if root configuration was not changed', async function (assert) {
+      assert.expect(2);
+      const path = `aws-${this.uid}`;
+      await enablePage.enable('aws', path);
+
+      await click(SES.configTab);
+      await click(SES.configure);
+      await fillInAwsConfig('withLease');
+      await click(GENERAL.submitButton);
+
+      assert.true(
+        this.flashSuccessSpy.calledWith(`Successfully saved ${path}'s configuration.`),
+        'Success flash message is rendered showing the lease configuration was saved.'
+      );
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${path}/configuration`,
+        'the form transitioned as expected to the details page'
+      );
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+  });
+
+  module('Community', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.type = 'community';
+    });
+
+    test('it does not show access type option and iam fields are shown', async function (assert) {
+      const path = `aws-${this.uid}`;
+      const type = 'aws';
+      await enablePage.enable(type, path);
+      await click(SES.configTab);
+      await click(SES.configure);
+      assert
+        .dom(SES.wif.accessTypeSection)
+        .doesNotExist('Access type section does not render for a community user');
+      // check all the form fields are present
+      await click(GENERAL.button('Root config options'));
+      for (const key of expectedConfigKeys('aws', true)) {
+        assert.dom(GENERAL.inputByAttr(key)).exists(`${key} shows for root section.`);
+      }
+      for (const key of expectedConfigKeys('aws-lease')) {
+        assert.dom(`[data-test-ttl-form-label="${key}"]`).exists(`${key} shows for Lease section.`);
+      }
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    module('Error handling', function () {
+      test('it does not try to save lease configuration if root configuration errored on save', async function (assert) {
+        assert.expect(1);
+        const path = `aws-${this.uid}`;
+        await enablePage.enable('aws', path);
+
+        this.server.post(configUrl('aws', path), () => {
+          assert.true(true, 'post request was made to save aws root config.');
+          return overrideResponse(400, { errors: ['bad request!'] });
+        });
+        this.server.post(configUrl('aws-lease', path), () => {
+          throw new Error(
+            `post request was made to config/lease when the first config was not saved. A request to this endpoint should NOT be be made`
+          );
+        });
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInAwsConfig('withAccess');
+        await fillInAwsConfig('withLease');
+        await click(GENERAL.submitButton);
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+
+      test('it shows a flash message error and transitions if lease configuration errored on save', async function (assert) {
+        assert.expect(2);
+        const path = `aws-${this.uid}`;
+        await enablePage.enable('aws', path);
+
+        this.server.post(configUrl('aws-lease', path), () => {
+          return overrideResponse(400, { errors: ['bad request!'] });
+        });
+
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInAwsConfig('withLease');
+        await click(GENERAL.submitButton);
+
+        assert.true(
+          this.flashDangerSpy.calledWith(`Error saving lease configuration: bad request!`),
+          'flash danger message is rendered showing the lease configuration was NOT saved.'
+        );
+        assert.strictEqual(
+          currentURL(),
+          `/vault/secrets-engines/${path}/configuration`,
+          'lease configuration failed to save but the component transitioned as expected'
+        );
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+
+      test('it prevents transition and shows api error if root config errored on save', async function (assert) {
+        const path = `aws-${this.uid}`;
+        await enablePage.enable('aws', path);
+
+        this.server.post(configUrl('aws', path), () => {
+          return overrideResponse(400, { errors: ['welp, that did not work!'] });
+        });
+
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInAwsConfig('withAccess');
+        await click(GENERAL.submitButton);
+
+        assert.dom(GENERAL.messageError).hasText('Error welp, that did not work!', 'API error shows on form');
+        assert.strictEqual(
+          currentURL(),
+          `/vault/secrets-engines/${path}/configuration/edit`,
+          'the form did not transition because the save failed.'
+        );
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+
+      test('it should show API error when AWS configuration read fails', async function (assert) {
+        assert.expect(1);
+        const path = `aws-${this.uid}`;
+        const type = 'aws';
+        await enablePage.enable(type, path);
+        // interrupt get and return API error
+        this.server.get(configUrl(type, path), () => {
+          return overrideResponse(400, { errors: ['bad request'] });
+        });
+        await click(SES.configTab);
+        assert.dom(SES.error.title).hasText('Error', 'shows the secrets backend error route');
+      });
+    });
+  });
+});
diff --git a/ui/tests/acceptance/secrets/backend/aws/aws-test.js b/ui/tests/acceptance/secrets/backend/aws/aws-test.js
new file mode 100644
index 00000000000..aeb64733611
--- /dev/null
+++ b/ui/tests/acceptance/secrets/backend/aws/aws-test.js
@@ -0,0 +1,197 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, fillIn, currentURL, find, waitUntil, visit } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { v4 as uuidv4 } from 'uuid';
+import { spy } from 'sinon';
+
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { deleteEngineCmd, mountEngineCmd, runCmd } from 'vault/tests/helpers/commands';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+
+const ROLE_TYPES = [
+  {
+    credentialType: 'iam_user',
+    async fillOutForm(assert) {
+      // nothing to fill out
+      assert.dom('[data-test-field]').exists({ count: 1 });
+    },
+    expectedPayload: {},
+  },
+  {
+    credentialType: 'assumed_role',
+    async fillOutForm(assert) {
+      await click(GENERAL.toggleInput('TTL'));
+      assert.dom(GENERAL.toggleInput('TTL')).isNotChecked();
+      await fillIn(GENERAL.inputByAttr('roleArn'), 'foobar');
+    },
+    expectedPayload: {
+      role_arn: 'foobar',
+    },
+  },
+  {
+    credentialType: 'federation_token',
+    async fillOutForm(assert) {
+      assert.dom(GENERAL.toggleInput('TTL')).isChecked();
+      await fillIn(GENERAL.ttl.input('TTL'), '3');
+    },
+    expectedPayload: {
+      ttl: '10800s',
+    },
+  },
+  {
+    credentialType: 'session_token',
+    async fillOutForm(assert) {
+      await click(GENERAL.toggleInput('TTL'));
+      assert.dom(GENERAL.toggleInput('TTL')).isNotChecked();
+    },
+    expectedPayload: null,
+  },
+];
+module('Acceptance | aws secret backend', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    const flash = this.owner.lookup('service:flash-messages');
+    this.flashSuccessSpy = spy(flash, 'success');
+    this.flashDangerSpy = spy(flash, 'danger');
+
+    this.uid = uuidv4();
+    return login();
+  });
+
+  test('it creates role and deletes role', async function (assert) {
+    const path = `aws-${this.uid}`;
+    const roleName = 'awsrole';
+    await enablePage.enable('aws', path);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${path}/list`,
+      'After enabling aws secrets engine it navigates to roles list'
+    );
+
+    await click(SES.createSecretLink);
+    assert.dom(SES.secretHeader).hasText('Create an AWS Role', 'It renders the create role page');
+
+    await fillIn(GENERAL.inputByAttr('name'), roleName);
+    await click(GENERAL.submitButton);
+    await waitUntil(() => currentURL() === `/vault/secrets-engines/${path}/show/${roleName}`); // flaky without this
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${path}/show/${roleName}`,
+      'aws: navigates to the show page on creation'
+    );
+
+    await click(SES.crumb(path));
+    assert.strictEqual(currentURL(), `/vault/secrets-engines/${path}/list`);
+    assert.dom(SES.secretLink(roleName)).exists();
+
+    // delete role
+    await click(`${SES.secretLink(roleName)} [data-test-popup-menu-trigger]`);
+    await waitUntil(() => find(SES.aws.deleteRole(roleName))); // flaky without
+    await click(SES.aws.deleteRole(roleName));
+    await click(GENERAL.confirmButton);
+    assert.dom(SES.secretLink(roleName)).doesNotExist('aws: role is no longer in the list');
+  });
+
+  ROLE_TYPES.forEach((scenario) => {
+    test(`aws credentials - type ${scenario.credentialType}`, async function (assert) {
+      const path = `aws-cred-${this.uid}`;
+      const roleName = `awsrole-${scenario.credentialType}`;
+      this.server.post(`/${path}/creds/${roleName}`, (_, req) => {
+        const payload = JSON.parse(req.requestBody);
+        assert.deepEqual(payload, scenario.expectedPayload);
+        return {
+          data: {
+            access_key: 'AKIA...',
+            secret_key: 'xlCs...',
+            security_token: 'some-token',
+            arn: 'arn:aws:sts::123456789012:assumed-role/DeveloperRole/some-user-supplied-role-session-name',
+          },
+        };
+      });
+      this.server.get(`/${path}/creds/${roleName}`, () => {
+        return {
+          data: {
+            access_key: 'AKIA...',
+            secret_key: 'xlCs...',
+            security_token: 'some-token',
+            arn: 'arn:aws:sts::123456789012:assumed-role/DeveloperRole/some-user-supplied-role-session-name',
+          },
+        };
+      });
+      await runCmd(mountEngineCmd('aws', path));
+
+      await visit(`/vault/secrets-engines/${path}/create`);
+      assert.dom('h1').hasText('Create an AWS Role');
+      await fillIn(GENERAL.inputByAttr('name'), roleName);
+      await fillIn(GENERAL.inputByAttr('credentialType'), scenario.credentialType);
+      await click(GENERAL.submitButton);
+      await waitUntil(() => currentURL() === `/vault/secrets-engines/${path}/show/${roleName}`); // flaky without this
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${path}/show/${roleName}`);
+      await click(SES.generateLink);
+      assert
+        .dom(GENERAL.inputByAttr('credentialType'))
+        .hasValue(scenario.credentialType, 'credentialType matches backing role');
+
+      // based on credentialType, fill out form
+      await scenario.fillOutForm(assert);
+
+      await click(GENERAL.submitButton);
+      assert.dom(SES.warning).exists('Shows access warning after generation');
+      assert.dom(GENERAL.infoRowValue('Access key')).exists();
+      assert.dom(GENERAL.infoRowValue('Secret key')).exists();
+      assert.dom(GENERAL.infoRowValue('Security token')).exists();
+      await visit('/vault/dashboard');
+
+      await runCmd(deleteEngineCmd(path));
+    });
+  });
+
+  test(`aws credentials without role read access`, async function (assert) {
+    const path = `aws-cred-${this.uid}`;
+    const roleName = `awsrole-noread`;
+    this.server.post(`/${path}/creds/${roleName}`, () => {
+      return {
+        data: {
+          access_key: 'AKIA...',
+          secret_key: 'xlCs...',
+          security_token: 'some-token',
+          arn: 'arn:aws:sts::123456789012:assumed-role/DeveloperRole/some-user-supplied-role-session-name',
+        },
+      };
+    });
+    this.server.get(`/${path}/roles/${roleName}`, () => overrideResponse(403));
+    await runCmd(mountEngineCmd('aws', path));
+    await runCmd(`write ${path}/roles/${roleName} credential_type=assumed_role`);
+
+    await visit(`/vault/secrets-engines/${path}/list`);
+    assert.dom(SES.secretLink(roleName)).exists();
+    await click(SES.secretLink(roleName));
+
+    assert.strictEqual(currentURL(), `/vault/secrets-engines/${path}/credentials/${roleName}`);
+    assert
+      .dom(GENERAL.inputByAttr('credentialType'))
+      .hasValue('iam_user', 'credentialType defaults to first in list due to no role read permissions');
+
+    await fillIn(GENERAL.inputByAttr('credentialType'), 'assumed_role');
+
+    await click(GENERAL.submitButton);
+    assert.dom(SES.warning).exists('Shows access warning after generation');
+    assert.dom(GENERAL.infoRowValue('Access key')).exists();
+    assert.dom(GENERAL.infoRowValue('Secret key')).exists();
+    assert.dom(GENERAL.infoRowValue('Security token')).exists();
+    await visit('/vault/dashboard');
+
+    await runCmd(deleteEngineCmd(path));
+  });
+});
diff --git a/ui/tests/acceptance/secrets/backend/azure/azure-configuration-test.js b/ui/tests/acceptance/secrets/backend/azure/azure-configuration-test.js
new file mode 100644
index 00000000000..0fcc57b2a19
--- /dev/null
+++ b/ui/tests/acceptance/secrets/backend/azure/azure-configuration-test.js
@@ -0,0 +1,462 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, visit, currentURL, fillIn } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { v4 as uuidv4 } from 'uuid';
+import { spy } from 'sinon';
+
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import {
+  expectedConfigKeys,
+  expectedValueOfConfigKeys,
+  configUrl,
+  fillInAzureConfig,
+} from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
+
+module('Acceptance | Azure | configuration', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    const flash = this.owner.lookup('service:flash-messages');
+    this.flashSuccessSpy = spy(flash, 'success');
+    this.flashDangerSpy = spy(flash, 'danger');
+    this.flashInfoSpy = spy(flash, 'info');
+    this.version = this.owner.lookup('service:version');
+    this.uid = uuidv4();
+    this.type = 'azure';
+    return login();
+  });
+
+  test('it should prompt configuration after mounting the azure engine', async function (assert) {
+    const path = `azure-${this.uid}`;
+    await visit('/vault/secrets-engines/enable');
+    await mountBackend(this.type, path);
+
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${path}/configuration`,
+      'navigated to configuration view'
+    );
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('Azure not configured', "empty state title is 'Azure not configured'");
+    assert.dom(GENERAL.emptyStateActions).hasText('Configure Azure');
+    // cleanup
+    await runCmd(`delete sys/mounts/${path}`);
+  });
+
+  test('it should transition to configure page on click "Configure" from toolbar', async function (assert) {
+    const path = `azure-${this.uid}`;
+    await enablePage.enable(this.type, path);
+    await click(SES.configure);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${path}/configuration/edit`,
+      'navigated to configuration edit view'
+    );
+    // cleanup
+    await runCmd(`delete sys/mounts/${path}`);
+  });
+
+  module('Community', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.type = 'community';
+    });
+
+    module('details', function () {
+      test('it should show configuration with Azure account options configured', async function (assert) {
+        const path = `azure-${this.uid}`;
+        const azureAccountAttrs = {
+          client_secret: 'client-secret',
+          subscription_id: 'subscription-id',
+          tenant_id: 'tenant-id',
+          client_id: 'client-id',
+          environment: 'AZUREPUBLICCLOUD',
+          root_password_ttl: '1800000s',
+        };
+        this.server.get(`${path}/config`, () => {
+          assert.true(true, 'request made to config when navigating to the configuration page.');
+          return { data: { id: path, type: this.type, ...azureAccountAttrs } };
+        });
+        await enablePage.enable(this.type, path);
+        for (const key of expectedConfigKeys('azure')) {
+          if (key === 'Client secret') continue; // client-secret is not returned by the API
+          assert.dom(GENERAL.infoRowLabel(key)).exists(`${key} on the ${this.type} config details exists.`);
+          const responseKeyAndValue = expectedValueOfConfigKeys(this.type, key);
+          assert
+            .dom(GENERAL.infoRowValue(key))
+            .hasText(responseKeyAndValue, `value for ${key} on the ${this.type} config details exists.`);
+        }
+        // check mount configuration details are present and accurate.
+        await click(SES.configurationToggle);
+        assert
+          .dom(GENERAL.infoRowValue('Path'))
+          .hasText(`${path}/`, 'mount path is displayed in the configuration details');
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+    });
+
+    module('create', function () {
+      test('it should save azure account options', async function (assert) {
+        // there are no azure specific options that can be returned from the API so confirm the generic options are saved.
+        assert.expect(3);
+        const path = `azure-${this.uid}`;
+        await enablePage.enable(this.type, path);
+
+        this.server.post('/identity/oidc/config', () => {
+          throw new Error(
+            `Request was made to return the issuer when it should not have been because user is on CE.`
+          );
+        });
+
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInAzureConfig();
+        await click(GENERAL.submitButton);
+        assert.true(
+          this.flashSuccessSpy.calledWith(`Successfully saved ${path}'s configuration.`),
+          'Success flash message is rendered showing the azure configuration was saved.'
+        );
+        assert
+          .dom(GENERAL.infoRowValue('Root password TTL'))
+          .hasText('3 minutes 20 seconds', 'Root password TTL, a generic field, has been set.');
+        assert
+          .dom(GENERAL.infoRowValue('Subscription ID'))
+          .hasText('subscription-id', 'Subscription ID, a generic field, has been set.');
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+    });
+
+    module('edit', function (hooks) {
+      hooks.beforeEach(async function () {
+        const path = `azure-${this.uid}`;
+        const type = 'azure';
+        const genericAttrs = {
+          // attributes that can be used for either wif or azure account access type
+          subscription_id: 'subscription-id',
+          tenant_id: 'tenant-id',
+          client_id: 'client-id',
+          environment: 'AZUREPUBLICCLOUD',
+        };
+        this.server.get(`${path}/config`, () => {
+          return { data: { id: path, type, ...genericAttrs } };
+        });
+        await enablePage.enable(type, path);
+      });
+
+      test('it should not save client secret if it has NOT been changed', async function (assert) {
+        assert.expect(2);
+        await click(SES.configure);
+        const url = currentURL();
+        const path = url.split('/')[3]; // get path from url because we can't pass the path from beforeEach hook to individual test.
+        this.server.post(configUrl('azure', path), (schema, req) => {
+          const payload = JSON.parse(req.requestBody);
+          assert.strictEqual(
+            undefined,
+            payload.client_secret,
+            'client_secret is not sent if it has not been changed'
+          );
+          assert.strictEqual(
+            payload.subscription_id,
+            'subscription-id-updated',
+            'subscription_id is included with updated value in the payload'
+          );
+        });
+        await fillIn(GENERAL.inputByAttr('subscription_id'), 'subscription-id-updated');
+        await click(GENERAL.enableField('client_secret'));
+        await click(GENERAL.submitButton);
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+
+      test('it should save client secret if it HAS been changed', async function (assert) {
+        assert.expect(2);
+        await click(SES.configure);
+        const url = currentURL();
+        const path = url.split('/')[3]; // get path from url because we can't pass the path from beforeEach hook to individual test.
+        this.server.post(configUrl('azure', path), (schema, req) => {
+          const payload = JSON.parse(req.requestBody);
+          assert.strictEqual(
+            payload.client_secret,
+            'client-secret-updated',
+            'client_secret is sent on payload because user updated its value'
+          );
+          assert.strictEqual(
+            payload.subscription_id,
+            'subscription-id-updated-again',
+            'subscription_id is included with updated value in the payload'
+          );
+        });
+        await fillIn(GENERAL.inputByAttr('subscription_id'), 'subscription-id-updated-again');
+        await click(GENERAL.enableField('client_secret'));
+        await click(GENERAL.button('toggle-masked'));
+        await fillIn(GENERAL.inputByAttr('client_secret'), 'client-secret-updated');
+        await click(GENERAL.submitButton);
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+    });
+
+    module('Error handling', function () {
+      test('it prevents transition and shows api error if config errored on save', async function (assert) {
+        const path = `azure-${this.uid}`;
+        await enablePage.enable('azure', path);
+
+        this.server.post(configUrl('azure', path), () => {
+          return overrideResponse(400, { errors: ['welp, that did not work!'] });
+        });
+
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInAzureConfig();
+        await click(GENERAL.submitButton);
+
+        assert.dom(GENERAL.messageError).hasText('Error welp, that did not work!', 'API error shows on form');
+        assert.strictEqual(
+          currentURL(),
+          `/vault/secrets-engines/${path}/configuration/edit`,
+          'the form did not transition because the save failed.'
+        );
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+
+      test('it should show API error when configuration read fails', async function (assert) {
+        assert.expect(1);
+        const path = `azure-${this.uid}`;
+        // interrupt get and return API error
+        this.server.get(configUrl(this.type, path), () => {
+          return overrideResponse(400, { errors: ['bad request'] });
+        });
+        await enablePage.enable(this.type, path);
+        assert.dom(SES.error.title).hasText('Error', 'shows the secrets backend error route');
+      });
+    });
+  });
+
+  module('Enterprise', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.type = 'enterprise';
+    });
+
+    module('details', function () {
+      test('it should save WIF configuration options', async function (assert) {
+        const path = `azure-${this.uid}`;
+        const wifAttrs = {
+          subscription_id: 'subscription-id',
+          tenant_id: 'tenant-id',
+          client_id: 'client-id',
+          identity_token_audience: 'audience',
+          identity_token_ttl: 720000,
+          environment: 'AZUREPUBLICCLOUD',
+          root_password_ttl: '1800000s',
+        };
+        this.server.get(`${path}/config`, () => {
+          assert.true(true, 'request made to config when navigating to the configuration page.');
+          return { data: { id: path, type: this.type, ...wifAttrs } };
+        });
+        await enablePage.enable(this.type, path);
+        GENERAL.button('More options');
+
+        for (const key of expectedConfigKeys('azure-wif')) {
+          const responseKeyAndValue = expectedValueOfConfigKeys(this.type, key);
+          assert
+            .dom(GENERAL.infoRowValue(key))
+            .hasText(responseKeyAndValue, `value for ${key} on the ${this.type} config details exists.`);
+        }
+        // check mount configuration details are present and accurate.
+        await click(SES.configurationToggle);
+        assert
+          .dom(GENERAL.infoRowValue('Path'))
+          .hasText(`${path}/`, 'mount path is displayed in the configuration details');
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+
+      test('it should not show issuer if no WIF configuration data is returned', async function (assert) {
+        const path = `azure-${this.uid}`;
+        this.server.get(`${path}/config`, (schema, req) => {
+          const payload = JSON.parse(req.requestBody);
+          assert.true(true, 'request made to config/root when navigating to the configuration page.');
+          return { data: { id: path, type: this.type, attributes: payload } };
+        });
+        this.server.get(`identity/oidc/config`, () => {
+          throw new Error(`Request was made to return the issuer when it should not have been.`);
+        });
+        await enablePage.enable(this.type, path);
+        await click(SES.configTab);
+
+        assert.dom(GENERAL.infoRowLabel('Issuer')).doesNotExist(`Issuer does not exists on config details.`);
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+    });
+
+    module('create', function () {
+      test('it should transition and save issuer if config was not changed but issuer was', async function (assert) {
+        assert.expect(2);
+        const path = `azure-${this.uid}`;
+        await enablePage.enable(this.type, path);
+        const newIssuer = `http://new.issuer.${this.uid}`;
+
+        this.server.post('/identity/oidc/config', (schema, req) => {
+          const payload = JSON.parse(req.requestBody);
+          assert.deepEqual(payload, { issuer: newIssuer }, 'payload for issuer is correct');
+          return {
+            id: 'identity-oidc-config',
+            data: null,
+            warnings: [
+              'If "issuer" is set explicitly, all tokens must be validated against that address, including those issued by secondary clusters. Setting issuer to "" will restore the default behavior of using the cluster\'s api_addr as the issuer.',
+            ],
+          };
+        });
+
+        await click(SES.configTab);
+        await click(SES.configure);
+        await click(SES.wif.accessType('wif'));
+        await fillIn(GENERAL.inputByAttr('issuer'), newIssuer);
+        await click(GENERAL.submitButton);
+        await click(SES.wif.issuerWarningSave);
+        assert.true(
+          this.flashSuccessSpy.calledWith(`Successfully saved ${path}'s configuration.`),
+          'Success message renders'
+        );
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+
+      test('it should transition on save if config was changed but issuer was not', async function (assert) {
+        assert.expect(4);
+        const path = `azure-${this.uid}`;
+        await enablePage.enable(this.type, path);
+
+        this.server.post('/identity/oidc/config', () => {
+          throw new Error('post request was incorrectly made to update the issuer');
+        });
+
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInAzureConfig(true);
+        await click(GENERAL.submitButton);
+        assert.dom(SES.wif.issuerWarningModal).doesNotExist('issuer warning modal does not show');
+        assert.true(
+          this.flashSuccessSpy.calledWith(`Successfully saved ${path}'s configuration.`),
+          'Success flash message is rendered showing the azure configuration was saved.'
+        );
+        assert
+          .dom(GENERAL.infoRowValue('Identity token audience'))
+          .hasText('azure-audience', 'Identity token audience has been set.');
+        assert
+          .dom(GENERAL.infoRowValue('Identity token TTL'))
+          .hasText('2 hours', 'Identity token TTL has been set.');
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+
+      test('it should transition and show issuer error if config saved but issuer encountered an error', async function (assert) {
+        const path = `azure-${this.uid}`;
+        const oldIssuer = 'http://old.issuer';
+
+        this.server.get('/identity/oidc/config', () => {
+          return { data: { issuer: oldIssuer } };
+        });
+        this.server.post('/identity/oidc/config', () => {
+          return overrideResponse(400, { errors: ['bad request'] });
+        });
+
+        await enablePage.enable(this.type, path);
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInAzureConfig(true);
+        await fillIn(GENERAL.inputByAttr('issuer'), 'http://new.issuererrors');
+        await click(GENERAL.submitButton);
+        await click(SES.wif.issuerWarningSave);
+
+        assert.true(
+          this.flashSuccessSpy.calledWith(`Successfully saved ${path}'s configuration.`),
+          'Success flash message is rendered showing the azure configuration was saved.'
+        );
+        assert.true(
+          this.flashDangerSpy.calledWith(`Issuer was not saved: bad request`),
+          'Danger flash message is rendered showing the issuer was not saved.'
+        );
+        assert
+          .dom(GENERAL.infoRowValue('Identity token audience'))
+          .hasText('azure-audience', 'Identity token audience has been set.');
+        assert
+          .dom(GENERAL.infoRowValue('Identity token TTL'))
+          .hasText('2 hours', 'Identity token TTL has been set.');
+        assert
+          .dom(GENERAL.infoRowValue('Issuer'))
+          .hasText(oldIssuer, 'Issuer is shows the old saved value not the new value that errors on save.');
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+
+      test('it should NOT transition and show error if config errors', async function (assert) {
+        const path = `azure-${this.uid}`;
+        const newIssuer = `http://new.issuer.${this.uid}`;
+
+        this.server.post(configUrl(this.type, path), () => {
+          return overrideResponse(400, { errors: ['bad request'] });
+        });
+
+        await enablePage.enable(this.type, path);
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInAzureConfig(true);
+        await fillIn(GENERAL.inputByAttr('issuer'), newIssuer);
+        await click(GENERAL.submitButton);
+        await click(SES.wif.issuerWarningSave);
+
+        assert.dom(GENERAL.messageError).hasText('Error bad request', 'Error message is displayed.');
+        assert.strictEqual(
+          currentURL(),
+          `/vault/secrets-engines/${path}/configuration/edit`,
+          'stays on the edit page'
+        );
+        assert
+          .dom(GENERAL.inputByAttr('issuer'))
+          .hasValue(newIssuer, 'issuer is updated to newly saved value');
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+    });
+
+    module('edit', function () {
+      test('it should update WIF attributes', async function (assert) {
+        const path = `azure-${this.uid}`;
+        await enablePage.enable(this.type, path);
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInAzureConfig(true);
+        await click(GENERAL.submitButton); // finished creating attributes, go back and edit them.
+        assert
+          .dom(GENERAL.infoRowValue('Identity token audience'))
+          .hasText('azure-audience', `value for identity token audience shows on the config details view.`);
+        await click(SES.configure);
+        await fillIn(GENERAL.inputByAttr('identity_token_audience'), 'new-audience');
+        await click(GENERAL.submitButton);
+        assert
+          .dom(GENERAL.infoRowValue('Identity token audience'))
+          .hasText('new-audience', `value for identity token audience shows on the config details view.`);
+        // cleanup
+        await runCmd(`delete sys/mounts/${path}`);
+      });
+    });
+  });
+});
diff --git a/ui/tests/acceptance/secrets/backend/cubbyhole/secret-test.js b/ui/tests/acceptance/secrets/backend/cubbyhole/secret-test.js
index 860979d6f19..773d3814567 100644
--- a/ui/tests/acceptance/secrets/backend/cubbyhole/secret-test.js
+++ b/ui/tests/acceptance/secrets/backend/cubbyhole/secret-test.js
@@ -1,19 +1,20 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentRouteName, settled } from '@ember/test-helpers';
+import { currentRouteName, settled, click, visit } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 
-import editPage from 'vault/tests/pages/secrets/backend/kv/edit-secret';
+import { createSecret } from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
 import showPage from 'vault/tests/pages/secrets/backend/kv/show';
 import listPage from 'vault/tests/pages/secrets/backend/list';
-import authPage from 'vault/tests/pages/auth';
-import assertSecretWrap from 'vault/tests/helpers/secret-edit-toolbar';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { assertSecretWrap } from 'vault/tests/helpers/components/secret-edit-toolbar';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
 
 module('Acceptance | secrets/cubbyhole/create', function (hooks) {
   setupApplicationTest(hooks);
@@ -21,7 +22,7 @@ module('Acceptance | secrets/cubbyhole/create', function (hooks) {
 
   hooks.beforeEach(function () {
     this.uid = uuidv4();
-    return authPage.login();
+    return login();
   });
 
   hooks.afterEach(function () {
@@ -40,10 +41,8 @@ module('Acceptance | secrets/cubbyhole/create', function (hooks) {
       'navigates to the list page'
     );
 
-    await listPage.create();
-    await settled();
-    await editPage.createSecret(kvPath, 'foo', 'bar');
-    await settled();
+    await click(SES.createSecretLink);
+    await createSecret(kvPath, 'foo', 'bar');
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.secrets.backend.show',
@@ -53,4 +52,13 @@ module('Acceptance | secrets/cubbyhole/create', function (hooks) {
 
     await assertSecretWrap(assert, this.server, requestPath);
   });
+
+  test('it does not show the option to configure', async function (assert) {
+    await visit(`/vault/secrets-engines/cubbyhole/list`);
+    await click(SES.configTab);
+    assert.dom(SES.configure).doesNotExist('does not show the configure button');
+    // try to force it by visiting the URL
+    await visit(`/vault/secrets-engines/cubbyhole/configuration/edit`);
+    assert.dom('[data-test-backend-error-title]').hasText('404 Not Found', 'shows 404 error');
+  });
 });
diff --git a/ui/tests/acceptance/secrets/backend/database/secret-test.js b/ui/tests/acceptance/secrets/backend/database/secret-test.js
index 58cd3915cf5..4f60bb121c5 100644
--- a/ui/tests/acceptance/secrets/backend/database/secret-test.js
+++ b/ui/tests/acceptance/secrets/backend/database/secret-test.js
@@ -1,22 +1,26 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { currentURL, settled, click, visit, fillIn, typeIn } from '@ember/test-helpers';
+import { currentURL, settled, click, visit, fillIn, typeIn, waitFor } from '@ember/test-helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 import { create } from 'ember-cli-page-object';
-import { selectChoose, clickTrigger } from 'ember-power-select/test-support/helpers';
+import { selectChoose } from 'ember-power-select/test-support';
+import { clickTrigger } from 'ember-power-select/test-support/helpers';
 
 import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
 import connectionPage from 'vault/tests/pages/secrets/backend/database/connection';
 import rolePage from 'vault/tests/pages/secrets/backend/database/role';
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import searchSelect from 'vault/tests/pages/components/search-select';
 import { deleteEngineCmd, mountEngineCmd, runCmd, tokenWithPolicyCmd } from 'vault/tests/helpers/commands';
 
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+
 const searchSelectComponent = create(searchSelect);
 
 const newConnection = async (
@@ -30,16 +34,16 @@ const newConnection = async (
   await connectionPage.name(name);
   await connectionPage.connectionUrl(connectionUrl);
   await connectionPage.toggleVerify();
-  await connectionPage.save();
+  await click(GENERAL.submitButton);
   await connectionPage.enable();
   return name;
 };
 
 const navToConnection = async (backend, connection) => {
-  await visit('/vault/secrets');
-  await click(`[data-test-secrets-backend-link="${backend}"]`);
-  await click('[data-test-secret-list-tab="Connections"]');
-  await click(`[data-test-secret-link="${connection}"]`);
+  await visit('/vault/secrets-engines');
+  await click(`${GENERAL.tableData(`${backend}/`, 'path')} a`);
+  await click(GENERAL.secretTab('Connections'));
+  await click(SES.secretLink(connection));
   return;
 };
 
@@ -47,21 +51,21 @@ const connectionTests = [
   {
     name: 'elasticsearch-connection',
     plugin: 'elasticsearch-database-plugin',
-    elasticUser: 'username',
-    elasticPassword: 'password',
+    username: 'username',
+    password: 'password',
     url: 'http://127.0.0.1:9200',
     assertCount: 9,
     requiredFields: async (assert, name) => {
-      assert.dom('[data-test-input="username"]').exists(`Username field exists for ${name}`);
-      assert.dom('[data-test-input="password"]').exists(`Password field exists for ${name}`);
-      assert.dom('[data-test-input="ca_cert"]').exists(`CA certificate field exists for ${name}`);
-      assert.dom('[data-test-input="ca_path"]').exists(`CA path field exists for ${name}`);
-      assert.dom('[data-test-input="client_cert"]').exists(`Client certificate field exists for ${name}`);
-      assert.dom('[data-test-input="client_key"]').exists(`Client key field exists for ${name}`);
-      assert.dom('[data-test-input="tls_server_name"]').exists(`TLS server name field exists for ${name}`);
-      assert.dom('[data-test-input="insecure"]').exists(`Insecure checkbox exists for ${name}`);
-      assert
-        .dom('[data-test-toggle-input="show-username_template"]')
+      assert.dom(GENERAL.inputByAttr('username')).exists(`Username field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('password')).exists(`Password field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('ca_cert')).exists(`CA certificate field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('ca_path')).exists(`CA path field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('client_cert')).exists(`Client certificate field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('client_key')).exists(`Client key field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('tls_server_name')).exists(`TLS server name field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('insecure')).exists(`Insecure checkbox exists for ${name}`);
+      assert
+        .dom(GENERAL.toggleInput('show-username_template'))
         .exists(`Username template toggle exists for ${name}`);
     },
   },
@@ -71,12 +75,12 @@ const connectionTests = [
     url: `mongodb://127.0.0.1:4321/test`,
     assertCount: 5,
     requiredFields: async (assert, name) => {
-      assert.dom('[data-test-input="username"]').exists(`Username field exists for ${name}`);
-      assert.dom('[data-test-input="password"]').exists(`Password field exists for ${name}`);
-      assert.dom('[data-test-input="write_concern"]').exists(`Write concern field exists for ${name}`);
-      assert.dom('[data-test-toggle-group="TLS options"]').exists('TLS options toggle exists');
+      assert.dom(GENERAL.inputByAttr('username')).exists(`Username field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('password')).exists(`Password field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('write_concern')).exists(`Write concern field exists for ${name}`);
+      assert.dom(GENERAL.button('TLS options')).exists('TLS options toggle exists');
       assert
-        .dom('[data-test-input="root_rotation_statements"]')
+        .dom(GENERAL.inputByAttr('root_rotation_statements'))
         .exists(`Root rotation statements exists for ${name}`);
     },
   },
@@ -86,19 +90,19 @@ const connectionTests = [
     url: `mssql://127.0.0.1:4321/test`,
     assertCount: 6,
     requiredFields: async (assert, name) => {
-      assert.dom('[data-test-input="username"]').exists(`Username field exists for ${name}`);
-      assert.dom('[data-test-input="password"]').exists(`Password field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('username')).exists(`Username field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('password')).exists(`Password field exists for ${name}`);
       assert
-        .dom('[data-test-input="max_open_connections"]')
+        .dom(GENERAL.inputByAttr('max_open_connections'))
         .exists(`Max open connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_idle_connections"]')
+        .dom(GENERAL.inputByAttr('max_idle_connections'))
         .exists(`Max idle connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_connection_lifetime"]')
+        .dom(GENERAL.inputByAttr('max_connection_lifetime'))
         .exists(`Max connection lifetime exists for ${name}`);
       assert
-        .dom('[data-test-input="root_rotation_statements"]')
+        .dom(GENERAL.inputByAttr('root_rotation_statements'))
         .exists(`Root rotation statements exists for ${name}`);
     },
   },
@@ -108,20 +112,20 @@ const connectionTests = [
     url: `{{username}}:{{password}}@tcp(127.0.0.1:3306)/test`,
     assertCount: 7,
     requiredFields: async (assert, name) => {
-      assert.dom('[data-test-input="username"]').exists(`Username field exists for ${name}`);
-      assert.dom('[data-test-input="password"]').exists(`Password field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('username')).exists(`Username field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('password')).exists(`Password field exists for ${name}`);
       assert
-        .dom('[data-test-input="max_open_connections"]')
+        .dom(GENERAL.inputByAttr('max_open_connections'))
         .exists(`Max open connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_idle_connections"]')
+        .dom(GENERAL.inputByAttr('max_idle_connections'))
         .exists(`Max idle connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_connection_lifetime"]')
+        .dom(GENERAL.inputByAttr('max_connection_lifetime'))
         .exists(`Max connection lifetime exists for ${name}`);
-      assert.dom('[data-test-toggle-group="TLS options"]').exists('TLS options toggle exists');
+      assert.dom(GENERAL.button('TLS options')).exists('TLS options toggle exists');
       assert
-        .dom('[data-test-input="root_rotation_statements"]')
+        .dom(GENERAL.inputByAttr('root_rotation_statements'))
         .exists(`Root rotation statements exists for ${name}`);
     },
   },
@@ -131,20 +135,20 @@ const connectionTests = [
     url: `{{username}}:{{password}}@tcp(127.0.0.1:3306)/test`,
     assertCount: 7,
     requiredFields: async (assert, name) => {
-      assert.dom('[data-test-input="username"]').exists(`Username field exists for ${name}`);
-      assert.dom('[data-test-input="password"]').exists(`Password field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('username')).exists(`Username field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('password')).exists(`Password field exists for ${name}`);
       assert
-        .dom('[data-test-input="max_open_connections"]')
+        .dom(GENERAL.inputByAttr('max_open_connections'))
         .exists(`Max open connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_idle_connections"]')
+        .dom(GENERAL.inputByAttr('max_idle_connections'))
         .exists(`Max idle connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_connection_lifetime"]')
+        .dom(GENERAL.inputByAttr('max_connection_lifetime'))
         .exists(`Max connection lifetime exists for ${name}`);
-      assert.dom('[data-test-toggle-group="TLS options"]').exists('TLS options toggle exists');
+      assert.dom(GENERAL.button('TLS options')).exists('TLS options toggle exists');
       assert
-        .dom('[data-test-input="root_rotation_statements"]')
+        .dom(GENERAL.inputByAttr('root_rotation_statements'))
         .exists(`Root rotation statements exists for ${name}`);
     },
   },
@@ -154,20 +158,20 @@ const connectionTests = [
     url: `{{username}}:{{password}}@tcp(127.0.0.1:3306)/test`,
     assertCount: 7,
     requiredFields: async (assert, name) => {
-      assert.dom('[data-test-input="username"]').exists(`Username field exists for ${name}`);
-      assert.dom('[data-test-input="password"]').exists(`Password field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('username')).exists(`Username field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('password')).exists(`Password field exists for ${name}`);
       assert
-        .dom('[data-test-input="max_open_connections"]')
+        .dom(GENERAL.inputByAttr('max_open_connections'))
         .exists(`Max open connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_idle_connections"]')
+        .dom(GENERAL.inputByAttr('max_idle_connections'))
         .exists(`Max idle connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_connection_lifetime"]')
+        .dom(GENERAL.inputByAttr('max_connection_lifetime'))
         .exists(`Max connection lifetime exists for ${name}`);
-      assert.dom('[data-test-toggle-group="TLS options"]').exists('TLS options toggle exists');
+      assert.dom(GENERAL.button('TLS options')).exists('TLS options toggle exists');
       assert
-        .dom('[data-test-input="root_rotation_statements"]')
+        .dom(GENERAL.inputByAttr('root_rotation_statements'))
         .exists(`Root rotation statements exists for ${name}`);
     },
   },
@@ -177,20 +181,20 @@ const connectionTests = [
     url: `{{username}}:{{password}}@tcp(127.0.0.1:3306)/test`,
     assertCount: 7,
     requiredFields: async (assert, name) => {
-      assert.dom('[data-test-input="username"]').exists(`Username field exists for ${name}`);
-      assert.dom('[data-test-input="password"]').exists(`Password field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('username')).exists(`Username field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('password')).exists(`Password field exists for ${name}`);
       assert
-        .dom('[data-test-input="max_open_connections"]')
+        .dom(GENERAL.inputByAttr('max_open_connections'))
         .exists(`Max open connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_idle_connections"]')
+        .dom(GENERAL.inputByAttr('max_idle_connections'))
         .exists(`Max idle connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_connection_lifetime"]')
+        .dom(GENERAL.inputByAttr('max_connection_lifetime'))
         .exists(`Max connection lifetime exists for ${name}`);
-      assert.dom('[data-test-toggle-group="TLS options"]').exists('TLS options toggle exists');
+      assert.dom(GENERAL.button('TLS options')).exists('TLS options toggle exists');
       assert
-        .dom('[data-test-input="root_rotation_statements"]')
+        .dom(GENERAL.inputByAttr('root_rotation_statements'))
         .exists(`Root rotation statements exists for ${name}`);
     },
   },
@@ -198,24 +202,26 @@ const connectionTests = [
     name: 'postgresql-connection',
     plugin: 'postgresql-database-plugin',
     url: `postgresql://{{username}}:{{password}}@localhost:5432/postgres?sslmode=disable`,
+    username: 'username',
+    password: 'password',
     assertCount: 7,
     requiredFields: async (assert, name) => {
-      assert.dom('[data-test-input="username"]').exists(`Username field exists for ${name}`);
-      assert.dom('[data-test-input="password"]').exists(`Password field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('username')).exists(`Username field exists for ${name}`);
+      assert.dom(GENERAL.inputByAttr('password')).exists(`Password field exists for ${name}`);
       assert
-        .dom('[data-test-input="max_open_connections"]')
+        .dom(GENERAL.inputByAttr('max_open_connections'))
         .exists(`Max open connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_idle_connections"]')
+        .dom(GENERAL.inputByAttr('max_idle_connections'))
         .exists(`Max idle connections exists for ${name}`);
       assert
-        .dom('[data-test-input="max_connection_lifetime"]')
+        .dom(GENERAL.inputByAttr('max_connection_lifetime'))
         .exists(`Max connection lifetime exists for ${name}`);
       assert
-        .dom('[data-test-input="root_rotation_statements"]')
+        .dom(GENERAL.inputByAttr('root_rotation_statements'))
         .exists(`Root rotation statements exists for ${name}`);
       assert
-        .dom('[data-test-toggle-input="show-username_template"]')
+        .dom(GENERAL.toggleInput('show-username_template'))
         .exists(`Username template toggle exists for ${name}`);
     },
   },
@@ -223,14 +229,15 @@ const connectionTests = [
 
 module('Acceptance | secrets/database/*', function (hooks) {
   setupApplicationTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(async function () {
     this.backend = `database-testing`;
-    await authPage.login();
+    await login();
     return runCmd(mountEngineCmd('database', this.backend), false);
   });
   hooks.afterEach(async function () {
-    await authPage.login();
+    await login();
     return runCmd(deleteEngineCmd(this.backend), false);
   });
 
@@ -240,7 +247,7 @@ module('Acceptance | secrets/database/*', function (hooks) {
     await settled();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/list`,
+      `/vault/secrets-engines/${backend}/list`,
       'Mounts and redirects to connection list page'
     );
     assert.dom('[data-test-component="empty-state"]').exists('Empty state exists');
@@ -248,10 +255,14 @@ module('Acceptance | secrets/database/*', function (hooks) {
       .dom('.active[data-test-secret-list-tab="Connections"]')
       .exists('Has Connections tab which is active');
     await click('[data-test-tab="overview"]');
-    assert.strictEqual(currentURL(), `/vault/secrets/${backend}/overview`, 'Tab links to overview page');
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${backend}/overview`,
+      'Tab links to overview page'
+    );
     assert.dom('[data-test-component="empty-state"]').exists('Empty state also exists on overview page');
     assert.dom('[data-test-secret-list-tab="Roles"]').exists('Has Roles tab');
-    await visit('/vault/secrets');
+    await visit('/vault/secrets-engines');
     // Cleanup backend
     await runCmd(deleteEngineCmd(backend), false);
   });
@@ -261,36 +272,42 @@ module('Acceptance | secrets/database/*', function (hooks) {
       assert.expect(19 + testCase.assertCount);
       const backend = this.backend;
       await connectionPage.visitCreate({ backend });
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/create`, 'Correct creation URL');
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${backend}/create`, 'Correct creation URL');
       assert
         .dom('[data-test-empty-state-title]')
         .hasText('No plugin selected', 'No plugin is selected by default and empty state shows');
       await connectionPage.dbPlugin(testCase.plugin);
       assert.dom('[data-test-empty-state]').doesNotExist('Empty state goes away after plugin selected');
       await connectionPage.name(testCase.name);
+
+      // elasticsearch has a special url field
       if (testCase.plugin === 'elasticsearch-database-plugin') {
         await connectionPage.url(testCase.url);
-        await connectionPage.username(testCase.elasticUser);
-        await connectionPage.password(testCase.elasticPassword);
       } else {
         await connectionPage.connectionUrl(testCase.url);
       }
+
+      // elasticsearch and postgres require username and password set in order to save
+      if (testCase.username) {
+        await connectionPage.username(testCase.username);
+        await connectionPage.password(testCase.password);
+      }
       testCase.requiredFields(assert, testCase.plugin);
-      assert.dom('[data-test-input="verify_connection"]').isChecked('verify is checked');
+      assert.dom(GENERAL.inputByAttr('verify_connection')).isChecked('verify is checked');
       await connectionPage.toggleVerify();
-      assert.dom('[data-test-input="verify_connection"]').isNotChecked('verify is unchecked');
+      assert.dom(GENERAL.inputByAttr('verify_connection')).isNotChecked('verify is unchecked');
       assert
         .dom('[data-test-database-oracle-alert]')
         .doesNotExist('does not show oracle alert for non-oracle plugins');
-      await connectionPage.save();
-      await settled();
+      await click(GENERAL.submitButton);
       assert
         .dom('[data-test-db-connection-modal-title]')
         .hasText('Rotate your root credentials?', 'Modal appears asking to rotate root credentials');
       assert.dom('[data-test-enable-connection]').exists('Enable button exists');
       await click('[data-test-enable-connection]');
+      await waitFor('[data-test-component="info-table-row"]');
       assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/show/${testCase.name}`),
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/show/${testCase.name}`),
         `Saves connection and takes you to show page for ${testCase.name}`
       );
       assert
@@ -298,17 +315,17 @@ module('Acceptance | secrets/database/*', function (hooks) {
         .doesNotExist(`Does not show Password value on show page for ${testCase.name}`);
       await connectionPage.edit();
       assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/edit/${testCase.name}`),
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/edit/${testCase.name}`),
         `Edit connection button and takes you to edit page for ${testCase.name}`
       );
       assert.dom(`[data-test-input="name"]`).hasAttribute('readonly');
       assert.dom(`[data-test-input="plugin_name"]`).hasAttribute('readonly');
-      assert.dom('[data-test-input="password"]').doesNotExist('Password is not displayed on edit form');
-      assert.dom('[data-test-toggle-input="show-password"]').exists('Update password toggle exists');
+      assert.dom(GENERAL.inputByAttr('password')).doesNotExist('Password is not displayed on edit form');
+      assert.dom(GENERAL.toggleInput('show-password')).exists('Update password toggle exists');
 
-      assert.dom('[data-test-input="verify_connection"]').isNotChecked('verify is still unchecked');
-      await connectionPage.save();
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/show/${testCase.name}`);
+      assert.dom(GENERAL.inputByAttr('verify_connection')).isNotChecked('verify is still unchecked');
+      await click(GENERAL.submitButton);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${backend}/show/${testCase.name}`);
       // click "Add Role"
       await connectionPage.addRole();
       await settled();
@@ -317,35 +334,39 @@ module('Acceptance | secrets/database/*', function (hooks) {
         testCase.name,
         'Database connection is pre-selected on the form'
       );
-      await click('[data-test-database-role-cancel]');
+      await click(GENERAL.cancelButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/list?tab=role`,
+        `/vault/secrets-engines/${backend}/list?tab=role`,
         'Cancel button links to role list view'
       );
+      // [BANDAID] navigate away to fix test failing on capabilities-self check before teardown
+      await visit('/vault/secrets-engines');
     });
   }
-  test('database connection create and edit: vault-plugin-database-oracle', async function (assert) {
+
+  // keep oracle as separate test because it relies on an external plugin that isn't rolled into the vault binary
+  // https://github.com/hashicorp/vault-plugin-database-oracle
+  test('database connection create: vault-plugin-database-oracle', async function (assert) {
     assert.expect(11);
-    // keep oracle as separate test because it behaves differently than the others
     const testCase = {
       name: 'oracle-connection',
       plugin: 'vault-plugin-database-oracle',
       url: `{{username}}/{{password}}@localhost:1521/OraDoc.localhost`,
       requiredFields: async (assert, name) => {
-        assert.dom('[data-test-input="username"]').exists(`Username field exists for ${name}`);
-        assert.dom('[data-test-input="password"]').exists(`Password field exists for ${name}`);
+        assert.dom(GENERAL.inputByAttr('username')).exists(`Username field exists for ${name}`);
+        assert.dom(GENERAL.inputByAttr('password')).exists(`Password field exists for ${name}`);
         assert
-          .dom('[data-test-input="max_open_connections"]')
+          .dom(GENERAL.inputByAttr('max_open_connections'))
           .exists(`Max open connections exists for ${name}`);
         assert
-          .dom('[data-test-input="max_idle_connections"]')
+          .dom(GENERAL.inputByAttr('max_idle_connections'))
           .exists(`Max idle connections exists for ${name}`);
         assert
-          .dom('[data-test-input="max_connection_lifetime"]')
+          .dom(GENERAL.inputByAttr('max_connection_lifetime'))
           .exists(`Max connection lifetime exists for ${name}`);
         assert
-          .dom('[data-test-input="root_rotation_statements"]')
+          .dom(GENERAL.inputByAttr('root_rotation_statements'))
           .exists(`Root rotation statements exists for ${name}`);
         assert
           .dom('[data-test-database-oracle-alert]')
@@ -357,7 +378,7 @@ module('Acceptance | secrets/database/*', function (hooks) {
     };
     const backend = this.backend;
     await connectionPage.visitCreate({ backend });
-    assert.strictEqual(currentURL(), `/vault/secrets/${backend}/create`, 'Correct creation URL');
+    assert.strictEqual(currentURL(), `/vault/secrets-engines/${backend}/create`, 'Correct creation URL');
     assert
       .dom('[data-test-empty-state-title]')
       .hasText('No plugin selected', 'No plugin is selected by default and empty state shows');
@@ -368,7 +389,52 @@ module('Acceptance | secrets/database/*', function (hooks) {
     await connectionPage.connectionUrl(testCase.url);
     testCase.requiredFields(assert, testCase.plugin);
     // Cannot save without plugin mounted
-    // TODO: add fake server response for fuller test coverage
+    // Edit tested separately with mocked server response
+  });
+
+  test('database connection edit: vault-plugin-database-oracle', async function (assert) {
+    assert.expect(2);
+    const connectionName = 'oracle-connection';
+    // mock API so we can test edit (without mounting external oracle plugin)
+    this.server.get(`/${this.backend}/config/${connectionName}`, () => {
+      return {
+        request_id: 'f869f23e-15c0-389b-82ac-84035a2b6079',
+        lease_id: '',
+        renewable: false,
+        lease_duration: 0,
+        data: {
+          allowed_roles: ['*'],
+          connection_details: {
+            backend: 'database',
+            connection_url: '%7B%7Busername%7D%7D/%7B%7Bpassword%7D%7D@//localhost:1521/ORCLPDB1',
+            max_connection_lifetime: '0s',
+            max_idle_connections: 0,
+            max_open_connections: 3,
+            username: 'VAULTADMIN',
+          },
+          password_policy: '',
+          plugin_name: 'vault-plugin-database-oracle',
+          plugin_version: '',
+          root_credentials_rotate_statements: [],
+          verify_connection: true,
+        },
+        wrap_info: null,
+        warnings: null,
+        auth: null,
+        mount_type: 'database',
+      };
+    });
+
+    await visit(`/vault/secrets-engines/${this.backend}/show/${connectionName}`);
+    const decoded = '{{username}}/{{password}}@//localhost:1521/ORCLPDB1';
+    assert
+      .dom('[data-test-row-value="Connection URL"]')
+      .hasText(decoded, 'connection_url is decoded in display');
+
+    await connectionPage.edit();
+    assert
+      .dom(GENERAL.inputByAttr('connection_url'))
+      .hasValue(decoded, 'connection_url is decoded when editing');
   });
 
   test('Can create and delete a connection', async function (assert) {
@@ -384,9 +450,13 @@ module('Acceptance | secrets/database/*', function (hooks) {
         { label: 'Write concern', name: 'write_concern' },
       ],
     };
-    await visit(`/vault/secrets/${backend}/list`);
-    await connectionPage.createLink();
-    assert.strictEqual(currentURL(), `/vault/secrets/${backend}/create`, 'Create link goes to create page');
+    await visit(`/vault/secrets-engines/${backend}/list`);
+    await click(SES.createSecretLink);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${backend}/create`,
+      'Create link goes to create page'
+    );
     assert
       .dom('[data-test-empty-state-title]')
       .hasText('No plugin selected', 'No plugin is selected by default and empty state shows');
@@ -402,15 +472,14 @@ module('Acceptance | secrets/database/*', function (hooks) {
     });
     // uncheck verify for the save step to work
     await connectionPage.toggleVerify();
-    await connectionPage.save();
-    await settled();
+    await click(GENERAL.submitButton);
     assert
       .dom('[data-test-db-connection-modal-title]')
       .hasText('Rotate your root credentials?', 'Modal appears asking to ');
     await connectionPage.enable();
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/show/${connectionDetails.id}`,
+      `/vault/secrets-engines/${backend}/show/${connectionDetails.id}`,
       'Saves connection and takes you to show page'
     );
     connectionDetails.fields.forEach(({ label, name, value, hideOnShow }) => {
@@ -429,12 +498,18 @@ module('Acceptance | secrets/database/*', function (hooks) {
       .dom('[data-test-confirmation-modal-title]')
       .hasText('Delete connection?', 'Modal appears asking to confirm delete action');
     await fillIn('[data-test-confirmation-modal-input="Delete connection?"]', connectionDetails.id);
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
 
-    assert.strictEqual(currentURL(), `/vault/secrets/${backend}/list`, 'Redirects to connection list page');
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${backend}/list`,
+      'Redirects to connection list page'
+    );
     assert
       .dom('[data-test-empty-state-title]')
       .hasText('No connections in this backend', 'No connections listed because it was deleted');
+    // [BANDAID] navigate away to fix test failing on capabilities-self check before teardown
+    await visit('/vault/secrets-engines');
   });
 
   test('buttons show up for managing connection', async function (assert) {
@@ -456,17 +531,16 @@ module('Acceptance | secrets/database/*', function (hooks) {
     assert
       .dom('[data-test-database-connection-reset]')
       .hasText('Reset connection', 'Reset button exists with correct text');
-    assert.dom('[data-test-secret-create]').hasText('Add role', 'Add role button exists with correct text');
+    assert.dom('[data-test-add-role]').hasText('Add role', 'Add role button exists with correct text');
     assert.dom('[data-test-edit-link]').hasText('Edit configuration', 'Edit button exists with correct text');
-    await authPage.logout();
     // Check with restricted permissions
-    await authPage.login(token);
+    await login(token);
     await click('[data-test-sidebar-nav-link="Secrets Engines"]');
-    assert.dom(`[data-test-secrets-backend-link="${backend}"]`).exists('Shows backend on secret list page');
+    assert.dom(GENERAL.tableData(`${backend}/`, 'path')).exists('Shows backend on secret list page');
     await navToConnection(backend, connection);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${backend}/show/${connection}`,
+      `/vault/secrets-engines/${backend}/show/${connection}`,
       'Allows reading connection'
     );
     assert
@@ -475,30 +549,32 @@ module('Acceptance | secrets/database/*', function (hooks) {
     assert
       .dom('[data-test-database-connection-reset]')
       .doesNotExist('Reset button does not show due to permissions');
-    assert.dom('[data-test-secret-create]').doesNotExist('Add role button does not show due to permissions');
+    assert.dom('[data-test-add-role]').doesNotExist('Add role button does not show due to permissions');
     assert.dom('[data-test-edit-link]').doesNotExist('Edit button does not show due to permissions');
-    await visit(`/vault/secrets/${backend}/overview`);
+    await visit(`/vault/secrets-engines/${backend}/overview`);
     assert.dom('[data-test-overview-card="Connections"]').exists('Connections card exists on overview');
     assert
       .dom('[data-test-overview-card="Roles"]')
       .doesNotExist('Roles card does not exist on overview w/ policy');
     assert.dom('.overview-card h2').hasText('1', 'Lists the correct number of connections');
     // confirm get credentials card is an option to select. Regression bug.
-    await typeIn('.ember-text-field', 'blah');
-    assert.dom('[data-test-get-credentials]').isEnabled();
+    await typeIn(GENERAL.inputSearch('search-input-role'), 'blah');
+    assert.dom(GENERAL.button('Get credentials')).isEnabled();
+    // [BANDAID] navigate away to fix test failing on capabilities-self check before teardown
+    await visit('/vault/secrets-engines');
   });
 
-  test('connection_url must be decoded', async function (assert) {
+  test('connection_url is decoded', async function (assert) {
     const backend = this.backend;
     const connection = await newConnection(
       backend,
       'mongodb-database-plugin',
-      '{{username}}/{{password}}@oracle-xe:1521/XEPDB1'
+      '{{username}}/{{password}}@mongo:1521/XEPDB1'
     );
     await navToConnection(backend, connection);
     assert
       .dom('[data-test-row-value="Connection URL"]')
-      .hasText('{{username}}/{{password}}@oracle-xe:1521/XEPDB1');
+      .hasText('{{username}}/{{password}}@mongo:1521/XEPDB1');
   });
 
   test('Role create form', async function (assert) {
@@ -509,25 +585,25 @@ module('Acceptance | secrets/database/*', function (hooks) {
     await rolePage.name('bar');
     assert
       .dom('[data-test-component="empty-state"]')
-      .exists({ count: 2 }, 'Two empty states exist before selections made');
+      .exists({ count: 1 }, 'One empty state exists before database selection is made');
     await clickTrigger('#database');
     assert.strictEqual(searchSelectComponent.options.length, 1, 'list shows existing connections so far');
     await selectChoose('#database', '.ember-power-select-option', 0);
     assert
       .dom('[data-test-component="empty-state"]')
-      .exists({ count: 2 }, 'Two empty states exist before selections made');
+      .exists({ count: 2 }, 'Two empty states exist after a database is selected');
     await rolePage.roleType('static');
     assert.dom('[data-test-component="empty-state"]').doesNotExist('Empty states go away');
-    assert.dom('[data-test-input="username"]').exists('Username field appears for static role');
+    assert.dom(GENERAL.inputByAttr('username')).exists('Username field appears for static role');
     assert
-      .dom('[data-test-toggle-input="Rotation period"]')
+      .dom(GENERAL.toggleInput('Rotation period'))
       .exists('Rotation period field appears for static role');
     await rolePage.roleType('dynamic');
     assert
-      .dom('[data-test-toggle-input="Generated credentials’s Time-to-Live (TTL)"]')
+      .dom(GENERAL.toggleInput('Generated credentials’s Time-to-Live (TTL)'))
       .exists('TTL field exists for dynamic');
     assert
-      .dom('[data-test-toggle-input="Generated credentials’s maximum Time-to-Live (Max TTL)"]')
+      .dom(GENERAL.toggleInput('Generated credentials’s maximum Time-to-Live (Max TTL)'))
       .exists('Max TTL field exists for dynamic');
     // Real connection (actual running db) required to save role, so we aren't testing that flow yet
   });
@@ -551,19 +627,18 @@ module('Acceptance | secrets/database/*', function (hooks) {
     const token = await runCmd(tokenWithPolicyCmd('test-policy', NO_ROLES_POLICY));
 
     // test root user flow first
-    await visit(`/vault/secrets/${backend}/overview`);
+    await visit(`/vault/secrets-engines/${backend}/overview`);
 
     assert.dom('[data-test-component="empty-state"]').exists('renders empty state');
     assert.dom('[data-test-secret-list-tab="Connections"]').exists('renders connections tab');
     assert.dom('[data-test-secret-list-tab="Roles"]').exists('renders connections tab');
 
-    await click('[data-test-secret-create="connections"]');
-    assert.strictEqual(currentURL(), `/vault/secrets/${backend}/create?itemType=connection`);
+    await click(SES.createSecretLink);
+    assert.strictEqual(currentURL(), `/vault/secrets-engines/${backend}/create?itemType=connection`);
 
     // Login with restricted policy
-    await logout.visit();
-    await authPage.login(token);
-    await visit(`/vault/secrets/${backend}/overview`);
+    await login(token);
+    await visit(`/vault/secrets-engines/${backend}/overview`);
     assert.dom('[data-test-tab="overview"]').exists('renders overview tab');
     assert.dom('[data-test-secret-list-tab="Connections"]').exists('renders connections tab');
     assert
@@ -573,6 +648,6 @@ module('Acceptance | secrets/database/*', function (hooks) {
       .dom('[data-test-overview-card="Connections"]')
       .exists({ count: 1 }, 'renders only the connection card');
     await click('[data-test-action-text="Configure new"]');
-    assert.strictEqual(currentURL(), `/vault/secrets/${backend}/create?itemType=connection`);
+    assert.strictEqual(currentURL(), `/vault/secrets-engines/${backend}/create?itemType=connection`);
   });
 });
diff --git a/ui/tests/acceptance/secrets/backend/database/workflow-test.js b/ui/tests/acceptance/secrets/backend/database/workflow-test.js
index 2266c2625ca..0997e9d20e5 100644
--- a/ui/tests/acceptance/secrets/backend/database/workflow-test.js
+++ b/ui/tests/acceptance/secrets/backend/database/workflow-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,45 +12,40 @@ import { create } from 'ember-cli-page-object';
 
 import databaseHandlers from 'vault/mirage/handlers/database';
 import { setupApplicationTest } from 'vault/tests/helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import flashMessage from 'vault/tests/pages/components/flash-message';
 import { deleteEngineCmd, mountEngineCmd, runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
 
 const flash = create(flashMessage);
 
 const PAGE = {
   // GENERIC
   emptyStateTitle: '[data-test-empty-state-title]',
-  emptyStateAction: '[data-test-secret-create="connections"]',
   infoRow: '[data-test-component="info-table-row"]',
-  infoRowLabel: (label) => `[data-test-row-label="${label}"]`,
-  infoRowValue: (label) => `[data-test-row-value="${label}"]`,
-  infoRowValueDiv: (label) => `[data-test-value-div="${label}"]`,
   // CONNECTIONS
   rotateModal: '[data-test-db-connection-modal-title]',
   confirmRotate: '[data-test-enable-rotate-connection]',
   skipRotate: '[data-test-enable-connection]',
   // ROLES
-  addRole: '[data-test-secret-create]',
+  addRole: '[data-test-add-role]',
   roleSettingsSection: '[data-test-role-settings-section]',
   statementsSection: '[data-test-statements-section]',
   editRole: '[data-test-edit-link]',
-  generateCredentials: (type = 'dynamic') => `[data-test-database-role-creds="${type}"]`,
 };
 
 const FORM = {
-  inputByAttr: (attr) => `[data-test-input="${attr}"]`,
   creationStatement: (idx = 0) =>
     `[data-test-input="creation_statements"] [data-test-string-list-input="${idx}"]`,
-  saveBtn: '[data-test-secret-save]',
 };
 
 async function fillOutConnection(name) {
-  await fillIn(FORM.inputByAttr('name'), name);
-  await fillIn(FORM.inputByAttr('plugin_name'), 'mysql-database-plugin');
-  await fillIn(FORM.inputByAttr('connection_url'), '{{username}}:{{password}}@tcp(127.0.0.1:33060)/');
-  await fillIn(FORM.inputByAttr('username'), 'admin');
-  await fillIn(FORM.inputByAttr('password'), 'very-secure');
+  await fillIn(GENERAL.inputByAttr('name'), name);
+  await fillIn(GENERAL.inputByAttr('plugin_name'), 'mysql-database-plugin');
+  await fillIn(GENERAL.inputByAttr('connection_url'), '{{username}}:{{password}}@tcp(127.0.0.1:33060)/');
+  await fillIn(GENERAL.inputByAttr('username'), 'admin');
+  await fillIn(GENERAL.inputByAttr('password'), 'very-secure');
 }
 
 /**
@@ -64,12 +59,12 @@ module('Acceptance | database workflow', function (hooks) {
     databaseHandlers(this.server);
     this.backend = `db-workflow-${uuidv4()}`;
     this.store = this.owner.lookup('service:store');
-    await authPage.login();
+    await login();
     await runCmd(mountEngineCmd('database', this.backend), false);
   });
 
   hooks.afterEach(async function () {
-    await authPage.login();
+    await login();
     return runCmd(deleteEngineCmd(this.backend));
   });
 
@@ -88,128 +83,129 @@ module('Acceptance | database workflow', function (hooks) {
           label: 'Root rotation statements',
           value: `Default`,
         },
+        { label: 'Rotate static roles immediately', value: 'Yes' },
       ];
     });
     test('create with rotate', async function (assert) {
-      assert.expect(24);
+      assert.expect(26);
       this.server.post('/:backend/rotate-root/:name', () => {
         assert.ok(true, 'rotate root called');
         new Response(204);
       });
-      await visit(`/vault/secrets/${this.backend}/overview`);
+      await visit(`/vault/secrets-engines/${this.backend}/overview`);
       assert.dom(PAGE.emptyStateTitle).hasText('Connect a database', 'empty state title is correct');
-      await click(PAGE.emptyStateAction);
+      await click(SES.createSecretLink);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/create?itemType=connection`,
+        `/vault/secrets-engines/${this.backend}/create?itemType=connection`,
         'Takes you to create page'
       );
 
       // fill in connection details
       await fillOutConnection(`connect-${this.backend}`);
-      await click(FORM.saveBtn);
+      await click(GENERAL.submitButton);
 
       assert.dom(PAGE.rotateModal).hasText('Rotate your root credentials?', 'rotate modal is shown');
       await click(PAGE.confirmRotate);
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/show/connect-${this.backend}`,
+        `/vault/secrets-engines/${this.backend}/show/connect-${this.backend}`,
         'Takes you to details page for connection'
       );
       assert.dom(PAGE.infoRow).exists({ count: this.expectedRows.length }, 'correct number of rows');
       this.expectedRows.forEach(({ label, value }) => {
-        assert.dom(PAGE.infoRowLabel(label)).hasText(label, `Label for ${label} is correct`);
-        assert.dom(PAGE.infoRowValue(label)).hasText(value, `Value for ${label} is correct`);
+        assert.dom(GENERAL.infoRowLabel(label)).hasText(label, `Label for ${label} is correct`);
+        assert.dom(GENERAL.infoRowValue(label)).hasText(value, `Value for ${label} is correct`);
       });
     });
     test('create without rotate', async function (assert) {
-      assert.expect(23);
+      assert.expect(25);
       this.server.post('/:backend/rotate-root/:name', () => {
         assert.notOk(true, 'rotate root called when it should not have been');
         new Response(204);
       });
-      await visit(`/vault/secrets/${this.backend}/overview`);
+      await visit(`/vault/secrets-engines/${this.backend}/overview`);
       assert.dom(PAGE.emptyStateTitle).hasText('Connect a database', 'empty state title is correct');
-      await click(PAGE.emptyStateAction);
+      await click(SES.createSecretLink);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/create?itemType=connection`,
+        `/vault/secrets-engines/${this.backend}/create?itemType=connection`,
         'Takes you to create page'
       );
 
       // fill in connection details
       await fillOutConnection(`connect-${this.backend}`);
-      await click(FORM.saveBtn);
+      await click(GENERAL.submitButton);
 
       assert.dom(PAGE.rotateModal).hasText('Rotate your root credentials?', 'rotate modal is shown');
       await click(PAGE.skipRotate);
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/show/connect-${this.backend}`,
+        `/vault/secrets-engines/${this.backend}/show/connect-${this.backend}`,
         'Takes you to details page for connection'
       );
       assert.dom(PAGE.infoRow).exists({ count: this.expectedRows.length }, 'correct number of rows');
       this.expectedRows.forEach(({ label, value }) => {
-        assert.dom(PAGE.infoRowLabel(label)).hasText(label, `Label for ${label} is correct`);
-        assert.dom(PAGE.infoRowValue(label)).hasText(value, `Value for ${label} is correct`);
+        assert.dom(GENERAL.infoRowLabel(label)).hasText(label, `Label for ${label} is correct`);
+        assert.dom(GENERAL.infoRowValue(label)).hasText(value, `Value for ${label} is correct`);
       });
     });
     test('create failure', async function (assert) {
-      assert.expect(25);
+      assert.expect(27);
       this.server.post('/:backend/rotate-root/:name', (schema, req) => {
         const okay = req.params.name !== 'bad-connection';
         assert.ok(okay, 'rotate root called but not for bad-connection');
         new Response(204);
       });
-      await visit(`/vault/secrets/${this.backend}/overview`);
+      await visit(`/vault/secrets-engines/${this.backend}/overview`);
       assert.dom(PAGE.emptyStateTitle).hasText('Connect a database', 'empty state title is correct');
-      await click(PAGE.emptyStateAction);
+      await click(SES.createSecretLink);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/create?itemType=connection`,
+        `/vault/secrets-engines/${this.backend}/create?itemType=connection`,
         'Takes you to create page'
       );
 
       // fill in connection details
       await fillOutConnection(`bad-connection`);
-      await click(FORM.saveBtn);
+      await click(GENERAL.submitButton);
       assert.strictEqual(
         flash.latestMessage,
         `error creating database object: error verifying - ping: Error 1045 (28000): Access denied for user 'admin'@'192.168.65.1' (using password: YES)`,
         'shows the error message from API'
       );
-      await fillIn(FORM.inputByAttr('name'), `connect-${this.backend}`);
-      await click(FORM.saveBtn);
+      await fillIn(GENERAL.inputByAttr('name'), `connect-${this.backend}`);
+      await click(GENERAL.submitButton);
       assert.dom(PAGE.rotateModal).hasText('Rotate your root credentials?', 'rotate modal is shown');
       await click(PAGE.confirmRotate);
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/show/connect-${this.backend}`,
+        `/vault/secrets-engines/${this.backend}/show/connect-${this.backend}`,
         'Takes you to details page for connection'
       );
       assert.dom(PAGE.infoRow).exists({ count: this.expectedRows.length }, 'correct number of rows');
       this.expectedRows.forEach(({ label, value }) => {
-        assert.dom(PAGE.infoRowLabel(label)).hasText(label, `Label for ${label} is correct`);
-        assert.dom(PAGE.infoRowValue(label)).hasText(value, `Value for ${label} is correct`);
+        assert.dom(GENERAL.infoRowLabel(label)).hasText(label, `Label for ${label} is correct`);
+        assert.dom(GENERAL.infoRowValue(label)).hasText(value, `Value for ${label} is correct`);
       });
     });
 
     test('create connection with rotate failure', async function (assert) {
-      await visit(`/vault/secrets/${this.backend}/overview`);
+      await visit(`/vault/secrets-engines/${this.backend}/overview`);
       assert.dom(PAGE.emptyStateTitle).hasText('Connect a database', 'empty state title is correct');
-      await click(PAGE.emptyStateAction);
+      await click(SES.createSecretLink);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/create?itemType=connection`,
+        `/vault/secrets-engines/${this.backend}/create?itemType=connection`,
         'Takes you to create page'
       );
 
       // fill in connection details
       await fillOutConnection(`fail-rotate`);
-      await click(FORM.saveBtn);
+      await click(GENERAL.submitButton);
       assert.dom(PAGE.rotateModal).hasText('Rotate your root credentials?', 'rotate modal is shown');
       await click(PAGE.confirmRotate);
 
@@ -220,18 +216,18 @@ module('Acceptance | database workflow', function (hooks) {
       );
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/show/fail-rotate`,
+        `/vault/secrets-engines/${this.backend}/show/fail-rotate`,
         'Takes you to details page for connection'
       );
     });
   });
-  module('roles', function (hooks) {
+  module('dynamic roles', function (hooks) {
     hooks.beforeEach(async function () {
       this.connection = `connect-${this.backend}`;
-      await visit(`/vault/secrets/${this.backend}/create`);
+      await visit(`/vault/secrets-engines/${this.backend}/create`);
       await fillOutConnection(this.connection);
-      await click(FORM.saveBtn);
-      await visit(`/vault/secrets/${this.backend}/show/${this.connection}`);
+      await click(GENERAL.submitButton);
+      await visit(`/vault/secrets-engines/${this.backend}/show/${this.connection}`);
     });
 
     test('it creates a dynamic role attached to the current connection', async function (assert) {
@@ -239,7 +235,7 @@ module('Acceptance | database workflow', function (hooks) {
       await click(PAGE.addRole);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/create?initialKey=${this.connection}&itemType=role`,
+        `/vault/secrets-engines/${this.backend}/create?initialKey=${this.connection}&itemType=role`,
         'Takes you to create role page'
       );
 
@@ -250,10 +246,10 @@ module('Acceptance | database workflow', function (hooks) {
         .dom(`${PAGE.statementsSection} ${PAGE.emptyStateTitle}`)
         .hasText('No role type selected', 'statements section shows empty state before selecting role type');
 
-      await fillIn(FORM.inputByAttr('name'), roleName);
+      await fillIn(GENERAL.inputByAttr('name'), roleName);
       assert.dom('[data-test-selected-option]').hasText(this.connection, 'Connection is selected by default');
 
-      await fillIn(FORM.inputByAttr('type'), 'dynamic');
+      await fillIn(GENERAL.inputByAttr('type'), 'dynamic');
       assert
         .dom(`${PAGE.roleSettingsSection} ${PAGE.emptyStateTitle}`)
         .doesNotExist('roles section no longer has empty state');
@@ -265,11 +261,11 @@ module('Acceptance | database workflow', function (hooks) {
       await fillIn(FORM.creationStatement(), `GRANT SELECT ON *.* TO '{{name}}'@'%'`);
       await click(`[data-test-string-list-row="0"] [data-test-string-list-button="add"]`);
       await fillIn(FORM.creationStatement(1), `GRANT CREATE ON *.* TO '{{name}}'@'%'`);
-      await click(FORM.saveBtn);
+      await click(GENERAL.submitButton);
       // DETAILS
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/show/role/${roleName}`,
+        `/vault/secrets-engines/${this.backend}/show/role/${roleName}`,
         'Takes you to details page for role after save'
       );
       assert.dom(PAGE.infoRow).exists({ count: 7 }, 'correct number of info rows displayed');
@@ -285,62 +281,119 @@ module('Acceptance | database workflow', function (hooks) {
         },
         { label: 'Revocation statements', value: 'Default' },
       ].forEach(({ label, value }) => {
-        const valueSelector =
-          label === 'Creation statements' ? PAGE.infoRowValueDiv(label) : PAGE.infoRowValue(label);
-        assert.dom(PAGE.infoRowLabel(label)).hasText(label, `Label for ${label} is correct`);
-        assert.dom(valueSelector).hasText(value, `Value for ${label} is correct`);
+        assert.dom(GENERAL.infoRowLabel(label)).hasText(label, `Label for ${label} is correct`);
+        assert.dom(GENERAL.infoRowValue(label)).hasText(value, `Value for ${label} is correct`);
       });
       // EDIT
       await click(PAGE.editRole);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/edit/role/${roleName}?itemType=role`,
+        `/vault/secrets-engines/${this.backend}/edit/role/${roleName}?itemType=role`,
         'Takes you to edit page for role'
       );
       // TODO: these should be readonly not disabled
-      assert.dom(FORM.inputByAttr('name')).isDisabled('Name is read-only');
-      assert.dom(FORM.inputByAttr('database')).isDisabled('Database is read-only');
-      assert.dom(FORM.inputByAttr('type')).isDisabled('Type is read-only');
+      assert.dom(GENERAL.inputByAttr('name')).isDisabled('Name is read-only');
+      assert.dom(GENERAL.inputByAttr('database')).isDisabled('Database is read-only');
+      assert.dom(GENERAL.inputByAttr('type')).isDisabled('Type is read-only');
       await fillIn('[data-test-ttl-value="Generated credentials’s Time-to-Live (TTL)"]', '2');
-      await click(FORM.saveBtn);
+      await click(GENERAL.submitButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/show/role/${roleName}`,
+        `/vault/secrets-engines/${this.backend}/show/role/${roleName}`,
         'Takes you to details page for role after save'
       );
       assert
-        .dom(PAGE.infoRowValue('Generated credentials’s Time-to-Live (TTL)'))
+        .dom(GENERAL.infoRowValue('Generated credentials’s Time-to-Live (TTL)'))
         .hasText('2 hours', 'Shows updated TTL');
 
       // CREDENTIALS
-      await click(PAGE.generateCredentials());
+      await click(GENERAL.button('dynamic'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/credentials/${roleName}?roleType=dynamic`,
+        `/vault/secrets-engines/${this.backend}/credentials/${roleName}?roleType=dynamic`,
         'Takes you to credentials page for role'
       );
       assert
         .dom('[data-test-credentials-warning]')
         .exists('shows warning about credentials only being available once');
       assert
-        .dom(`[data-test-value-div="Username"] [data-test-masked-input]`)
+        .dom(`${GENERAL.infoRowValue('Username')} [data-test-masked-input]`)
         .hasText('***********', 'Username is masked');
-      await click(`[data-test-value-div="Username"] [data-test-button="toggle-masked"]`);
+
+      await click(`${GENERAL.infoRowValue('Username')} ${GENERAL.button('toggle-masked')}`);
       assert
-        .dom(`[data-test-value-div="Username"] [data-test-masked-input]`)
+        .dom(`${GENERAL.infoRowValue('Username')} [data-test-masked-input]`)
         .hasText('generated-username', 'Username is generated');
 
       assert
-        .dom(`[data-test-value-div="Password"] [data-test-masked-input]`)
+        .dom(`${GENERAL.infoRowValue('Password')} [data-test-masked-input]`)
         .hasText('***********', 'Password is masked');
-      await click(`[data-test-value-div="Password"] [data-test-button="toggle-masked"]`);
+
+      await click(`${GENERAL.infoRowValue('Password')} ${GENERAL.button('toggle-masked')}`);
       assert
-        .dom(`[data-test-value-div="Password"] [data-test-masked-input]`)
+        .dom(`${GENERAL.infoRowValue('Password')} [data-test-masked-input]`)
         .hasText('generated-password', 'Password is generated');
-      assert.dom(PAGE.infoRowValue('Lease Duration')).hasText('3600', 'shows lease duration from response');
       assert
-        .dom(PAGE.infoRowValue('Lease ID'))
+        .dom(GENERAL.infoRowValue('Lease Duration'))
+        .hasText('3600', 'shows lease duration from response');
+      assert
+        .dom(GENERAL.infoRowValue('Lease ID'))
         .hasText(`database/creds/${roleName}/abcd`, 'shows lease ID from response');
     });
   });
+
+  module('static roles', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.setup = async ({ toggleRotateOff = false }) => {
+        this.connection = `connect-${this.backend}`;
+        await visit(`/vault/secrets-engines/${this.backend}/create`);
+        await fillOutConnection(this.connection);
+        if (toggleRotateOff) {
+          await click(GENERAL.toggleInput('toggle-skip_static_role_rotation_import'));
+        }
+        await click(GENERAL.submitButton);
+        await visit(`/vault/secrets-engines/${this.backend}/show/${this.connection}`);
+      };
+    });
+
+    test('set parent db to rotate static roles immediately, verify static role reflects that default', async function (assert) {
+      await this.setup({ toggleRotateOff: false });
+
+      const roleName = 'static-role';
+      await click(PAGE.addRole);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.backend}/create?initialKey=${this.connection}&itemType=role`,
+        'Takes you to create role page'
+      );
+
+      await fillIn(GENERAL.inputByAttr('name'), roleName);
+
+      await fillIn(GENERAL.inputByAttr('type'), 'static');
+
+      assert
+        .dom('[data-test-toggle-subtext]')
+        .containsText(`Vault will rotate the password for this static role on creation.`);
+    });
+
+    test('set parent db to not rotate static roles immediately, verify static role reflects that default', async function (assert) {
+      await this.setup({ toggleRotateOff: true });
+
+      const roleName = 'static-role';
+      await click(PAGE.addRole);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.backend}/create?initialKey=${this.connection}&itemType=role`,
+        'Takes you to create role page'
+      );
+
+      await fillIn(GENERAL.inputByAttr('name'), roleName);
+
+      await fillIn(GENERAL.inputByAttr('type'), 'static');
+
+      assert
+        .dom('[data-test-toggle-subtext]')
+        .containsText(`Vault will not rotate this role's password on creation.`);
+    });
+  });
 });
diff --git a/ui/tests/acceptance/secrets/backend/engines-test.js b/ui/tests/acceptance/secrets/backend/engines-test.js
deleted file mode 100644
index 79b657b77c9..00000000000
--- a/ui/tests/acceptance/secrets/backend/engines-test.js
+++ /dev/null
@@ -1,116 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { currentRouteName, settled } from '@ember/test-helpers';
-import { clickTrigger } from 'ember-power-select/test-support/helpers';
-import { create } from 'ember-cli-page-object';
-import { module, test } from 'qunit';
-import consoleClass from 'vault/tests/pages/components/console/ui-panel';
-import { setupApplicationTest } from 'ember-qunit';
-import { v4 as uuidv4 } from 'uuid';
-
-import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
-import backendsPage from 'vault/tests/pages/secrets/backends';
-import authPage from 'vault/tests/pages/auth';
-import ss from 'vault/tests/pages/components/search-select';
-
-const consoleComponent = create(consoleClass);
-const searchSelect = create(ss);
-
-module('Acceptance | secret-engine list view', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.uid = uuidv4();
-    return authPage.login();
-  });
-
-  test('it allows you to disable an engine', async function (assert) {
-    // first mount an engine so we can disable it.
-    const enginePath = `alicloud-disable-${this.uid}`;
-    await mountSecrets.enable('alicloud', enginePath);
-    await settled();
-    assert.ok(backendsPage.rows.filterBy('path', `${enginePath}/`)[0], 'shows the mounted engine');
-
-    await backendsPage.visit();
-    await settled();
-    const row = backendsPage.rows.filterBy('path', `${enginePath}/`)[0];
-    await row.menu();
-    await settled();
-    await backendsPage.disableButton();
-    await settled();
-    await backendsPage.confirmDisable();
-    await settled();
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.secrets.backends',
-      'redirects to the backends page'
-    );
-    assert.strictEqual(
-      backendsPage.rows.filterBy('path', `${enginePath}/`).length,
-      0,
-      'does not show the disabled engine'
-    );
-  });
-
-  test('it adds disabled css styling to unsupported secret engines', async function (assert) {
-    assert.expect(2);
-    // first mount engine that is not supported
-    const enginePath = `nomad-${this.uid}`;
-
-    await mountSecrets.enable('nomad', enginePath);
-    await settled();
-    await backendsPage.visit();
-    await settled();
-
-    const rows = document.querySelectorAll('[data-test-secrets-backend-link]');
-    const rowUnsupported = Array.from(rows).filter((row) => row.innerText.includes('nomad'));
-    const rowSupported = Array.from(rows).filter((row) => row.innerText.includes('cubbyhole'));
-    assert
-      .dom(rowUnsupported[0])
-      .doesNotHaveClass(
-        'linked-block',
-        `the linked-block class is not added to unsupported engines, which effectively disables it.`
-      );
-    assert.dom(rowSupported[0]).hasClass('linked-block', `linked-block class is added to supported engines.`);
-
-    // cleanup
-    await consoleComponent.runCommands([`delete sys/mounts/${enginePath}`]);
-  });
-
-  test('it filters by name and engine type', async function (assert) {
-    assert.expect(4);
-    const enginePath1 = `aws-1-${this.uid}`;
-    const enginePath2 = `aws-2-${this.uid}`;
-
-    await mountSecrets.enable('aws', enginePath1);
-    await mountSecrets.enable('aws', enginePath2);
-    await backendsPage.visit();
-    await settled();
-    // filter by type
-    await clickTrigger('#filter-by-engine-type');
-    await searchSelect.options.objectAt(0).click();
-
-    const rows = document.querySelectorAll('[data-test-secrets-backend-link]');
-    const rowsAws = Array.from(rows).filter((row) => row.innerText.includes('aws'));
-
-    assert.strictEqual(rows.length, rowsAws.length, 'all rows returned are aws');
-    // filter by name
-    await clickTrigger('#filter-by-engine-name');
-    const firstItemToSelect = searchSelect.options.objectAt(0).text;
-    await searchSelect.options.objectAt(0).click();
-    const singleRow = document.querySelectorAll('[data-test-secrets-backend-link]');
-    assert.strictEqual(singleRow.length, 1, 'returns only one row');
-    assert.dom(singleRow[0]).includesText(firstItemToSelect, 'shows the filtered by name engine');
-    // clear filter by engine name
-    await searchSelect.deleteButtons.objectAt(1).click();
-    const rowsAgain = document.querySelectorAll('[data-test-secrets-backend-link]');
-    assert.ok(rowsAgain.length > 1, 'filter has been removed');
-
-    // cleanup
-    await consoleComponent.runCommands([`delete sys/mounts/${enginePath1}`]);
-    await consoleComponent.runCommands([`delete sys/mounts/${enginePath2}`]);
-  });
-});
diff --git a/ui/tests/acceptance/secrets/backend/gcp/gcp-configuration-test.js b/ui/tests/acceptance/secrets/backend/gcp/gcp-configuration-test.js
new file mode 100644
index 00000000000..928cc00487a
--- /dev/null
+++ b/ui/tests/acceptance/secrets/backend/gcp/gcp-configuration-test.js
@@ -0,0 +1,290 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, visit, currentURL, fillIn } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { v4 as uuidv4 } from 'uuid';
+import { spy } from 'sinon';
+
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import {
+  expectedConfigKeys,
+  expectedValueOfConfigKeys,
+  configUrl,
+  fillInGcpConfig,
+} from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
+
+module('Acceptance | GCP | configuration', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    const flash = this.owner.lookup('service:flash-messages');
+    this.store = this.owner.lookup('service:store');
+    this.flashSuccessSpy = spy(flash, 'success');
+    this.flashDangerSpy = spy(flash, 'danger');
+    this.flashInfoSpy = spy(flash, 'info');
+    this.version = this.owner.lookup('service:version');
+    this.uid = uuidv4();
+    this.type = 'gcp';
+    this.path = `GCP-${this.uid}`;
+    return login();
+  });
+
+  test('it should prompt configuration after mounting the GCP engine', async function (assert) {
+    await visit('/vault/secrets-engines/enable');
+    await mountBackend(this.type, this.path);
+
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.path}/configuration`,
+      'navigated to configuration view'
+    );
+    assert.dom(GENERAL.emptyStateTitle).hasText('Google Cloud not configured');
+    assert.dom(GENERAL.emptyStateActions).hasText('Configure Google Cloud');
+    // cleanup
+    await runCmd(`delete sys/mounts/${this.path}`);
+  });
+
+  test('it should transition to configure page on click "Configure" from toolbar', async function (assert) {
+    await enablePage.enable(this.type, this.path);
+    await click(SES.configure);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.path}/configuration/edit`,
+      'navigated to configuration edit view'
+    );
+    // cleanup
+    await runCmd(`delete sys/mounts/${this.path}`);
+  });
+
+  module('Community', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.type = 'community';
+    });
+
+    module('details', function () {
+      test('it should show configuration details with GCP account options configured', async function (assert) {
+        const gcpAccountAttrs = {
+          credentials: '{"some-key":"some-value"}',
+          ttl: '1 minute 40 seconds',
+          max_ttl: '1 minute 41 seconds',
+        };
+        this.server.get(`${this.path}/config`, () => {
+          assert.true(true, 'request made to config when navigating to the configuration page.');
+          return { data: { id: this.path, type: this.type, ...gcpAccountAttrs } };
+        });
+        await enablePage.enable(this.type, this.path);
+        for (const key of expectedConfigKeys(this.type)) {
+          if (key === 'Credentials') continue; // not returned by the API
+          const responseKeyAndValue = expectedValueOfConfigKeys(this.type, key);
+          assert
+            .dom(GENERAL.infoRowValue(key))
+            .hasText(responseKeyAndValue, `value for ${key} on the ${this.type} config details exists.`);
+        }
+        // check mount configuration details are present and accurate.
+        await click(SES.configurationToggle);
+        assert
+          .dom(GENERAL.infoRowValue('Path'))
+          .hasText(`${this.path}/`, 'mount path is displayed in the configuration details');
+        // cleanup
+        await runCmd(`delete sys/mounts/${this.path}`);
+      });
+    });
+
+    module('create', function () {
+      test('it should save gcp account accessType options', async function (assert) {
+        await enablePage.enable(this.type, this.path);
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInGcpConfig();
+        await click(GENERAL.submitButton);
+        assert.true(
+          this.flashSuccessSpy.calledWith(`Successfully saved ${this.path}'s configuration.`),
+          'Success flash message is rendered showing the GCP model configuration was saved.'
+        );
+
+        assert
+          .dom(GENERAL.infoRowValue('Config TTL'))
+          .hasText('2 hours', 'Config TTL, a generic account specific field, has been set.');
+        assert
+          .dom(GENERAL.infoRowValue('Max TTL'))
+          .hasText('2 hours 16 minutes 40 seconds', 'Max TTL, a generic field, has been set.');
+        assert
+          .dom(GENERAL.infoRowValue('Credentials'))
+          .doesNotExist('credentials are not shown in the configuration details');
+        // cleanup
+        await runCmd(`delete sys/mounts/${this.path}`);
+      });
+    });
+
+    module('edit', function (hooks) {
+      hooks.beforeEach(async function () {
+        const genericAttrs = {
+          configTtl: '2h',
+          maxTtl: '4h',
+        };
+        this.server.get(`${this.path}/config`, () => {
+          return { data: { id: this.path, type: this.type, ...genericAttrs } };
+        });
+        await enablePage.enable(this.type, this.path);
+      });
+
+      test('it should save credentials', async function (assert) {
+        assert.expect(3);
+        const credentials = '{"some-key":"some-value"}';
+        await click(SES.configure);
+
+        this.server.post(configUrl('gcp', this.path), (schema, req) => {
+          const payload = JSON.parse(req.requestBody);
+          assert.strictEqual(credentials, payload.credentials, 'credentials are sent in post request');
+          assert.strictEqual(
+            undefined,
+            payload.configTtl,
+            'config_ttl is not included in payload if value has not been updated'
+          );
+          assert.strictEqual(
+            undefined,
+            payload.maxTtl,
+            'max_ttl is not included in payload if value has not been updated'
+          );
+        });
+
+        await click(GENERAL.textToggle);
+        await fillIn(GENERAL.maskedInput, credentials);
+        await click(GENERAL.submitButton);
+        // cleanup
+        await runCmd(`delete sys/mounts/${this.path}`);
+      });
+
+      test('it should not save credentials if it has NOT been changed', async function (assert) {
+        assert.expect(3);
+        await click(SES.configure);
+
+        this.server.post(configUrl('gcp', this.path), (schema, req) => {
+          const payload = JSON.parse(req.requestBody);
+          assert.strictEqual(payload.credentials, undefined, 'credentials are not sent in post request');
+
+          assert.strictEqual(
+            payload.ttl,
+            '10800s',
+            'config_ttl is included in payload because the value was updated'
+          );
+          assert.strictEqual(
+            payload.maxTtl,
+            undefined,
+            'max_ttl is not included in payload if value has not been updated'
+          );
+        });
+
+        await click(GENERAL.button('More options'));
+        await click(GENERAL.ttl.toggle('Config TTL'));
+        await fillIn(GENERAL.ttl.input('Config TTL'), '10800');
+        await click(GENERAL.submitButton);
+        // cleanup
+        await runCmd(`delete sys/mounts/${this.path}`);
+      });
+    });
+
+    module('Error handling', function () {
+      test('it prevents transition and shows api error if config errored on save', async function (assert) {
+        await enablePage.enable(this.type, this.path);
+
+        this.server.post(configUrl(this.type, this.path), () => {
+          return overrideResponse(400, { errors: ['my goodness, that did not work!'] });
+        });
+
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInGcpConfig();
+        await click(GENERAL.submitButton);
+
+        assert
+          .dom(GENERAL.messageError)
+          .hasText('Error my goodness, that did not work!', 'API error shows on form');
+        assert.strictEqual(
+          currentURL(),
+          `/vault/secrets-engines/${this.path}/configuration/edit`,
+          'the form did not transition because the save failed.'
+        );
+        // cleanup
+        await runCmd(`delete sys/mounts/${this.path}`);
+      });
+
+      test('it should show API error when configuration read fails', async function (assert) {
+        this.server.get(configUrl(this.type, this.path), () => {
+          return overrideResponse(400, { errors: ['bad request'] });
+        });
+        await enablePage.enable(this.type, this.path);
+        assert.dom(SES.error.title).hasText('Error', 'shows the secrets backend error route');
+      });
+    });
+  });
+
+  module('Enterprise', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.type = 'enterprise';
+      this.wifAttrs = {
+        service_account_email: 'service-email',
+        identity_token_audience: 'audience',
+        identity_token_ttl: 720000,
+        max_ttl: 14400,
+        ttl: 3600,
+      };
+    });
+
+    test('it should show configuration details with WIF options configured', async function (assert) {
+      this.server.get(`${this.path}/config`, () => {
+        assert.true(true, 'request made to config when navigating to the configuration page.');
+        return { data: { id: this.path, type: this.type, ...this.wifAttrs } };
+      });
+      await enablePage.enable(this.type, this.path);
+      for (const key of expectedConfigKeys('gcp-wif')) {
+        const responseKeyAndValue = expectedValueOfConfigKeys(this.type, key);
+        assert
+          .dom(GENERAL.infoRowValue(key))
+          .hasText(responseKeyAndValue, `value for ${key} on the ${this.type} config details exists.`);
+      }
+      // check mount configuration details are present and accurate.
+      await click(SES.configurationToggle);
+      assert
+        .dom(GENERAL.infoRowValue('Path'))
+        .hasText(`${this.path}/`, 'mount path is displayed in the configuration details');
+      // cleanup
+      await runCmd(`delete sys/mounts/${this.path}`);
+    });
+
+    module('Error handling', function () {
+      test('it shows API error if user previously set credentials but tries to edit the configuration with wif fields', async function (assert) {
+        await enablePage.enable(this.type, this.path);
+        await click(SES.configTab);
+        await click(SES.configure);
+        await fillInGcpConfig();
+        await click(GENERAL.submitButton); // save GCP credentials
+
+        await click(SES.configure); // navigate so you can edit that configuration
+        await fillInGcpConfig(true);
+        await click(GENERAL.submitButton); // try and save wif fields
+        assert
+          .dom(GENERAL.messageError)
+          .hasText(
+            `Error only one of 'credentials' or 'identity_token_audience' can be set`,
+            'api error about conflicting fields is shown'
+          );
+        assert.dom(GENERAL.inlineError).hasText('There was an error submitting this form.');
+        // cleanup
+        await runCmd(`delete sys/mounts/${this.path}`);
+      });
+    });
+  });
+});
diff --git a/ui/tests/acceptance/secrets/backend/gcpkms/secrets-test.js b/ui/tests/acceptance/secrets/backend/gcpkms/secrets-test.js
deleted file mode 100644
index fba46e0bdd1..00000000000
--- a/ui/tests/acceptance/secrets/backend/gcpkms/secrets-test.js
+++ /dev/null
@@ -1,38 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { currentRouteName, settled } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import { v4 as uuidv4 } from 'uuid';
-
-import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
-import backendsPage from 'vault/tests/pages/secrets/backends';
-import authPage from 'vault/tests/pages/auth';
-
-module('Acceptance | gcpkms/enable', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.uid = uuidv4();
-    return authPage.login();
-  });
-
-  test('enable gcpkms', async function (assert) {
-    // Error: Cannot call `visit` without having first called `setupApplicationContext`.
-    const enginePath = `gcpkms-${this.uid}`;
-    await mountSecrets.visit();
-    await settled();
-    await mountSecrets.selectType('gcpkms');
-    await mountSecrets.path(enginePath).submit();
-    await settled();
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.secrets.backends',
-      'redirects to the backends page'
-    );
-    assert.ok(backendsPage.rows.filterBy('path', `${enginePath}/`)[0], 'shows the gcpkms engine');
-  });
-});
diff --git a/ui/tests/acceptance/secrets/backend/generic/secret-test.js b/ui/tests/acceptance/secrets/backend/generic/secret-test.js
index ec6a7cdbf30..4f55636f398 100644
--- a/ui/tests/acceptance/secrets/backend/generic/secret-test.js
+++ b/ui/tests/acceptance/secrets/backend/generic/secret-test.js
@@ -1,24 +1,25 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentRouteName, visit } from '@ember/test-helpers';
+import { click, currentRouteName, fillIn, visit } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 
-import editPage from 'vault/tests/pages/secrets/backend/kv/edit-secret';
 import showPage from 'vault/tests/pages/secrets/backend/kv/show';
 import listPage from 'vault/tests/pages/secrets/backend/list';
 import consolePanel from 'vault/tests/pages/components/console/ui-panel';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { writeSecret } from 'vault/tests/helpers/kv/kv-run-commands';
 import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { createSecret } from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
 
 import { create } from 'ember-cli-page-object';
-
-import apiStub from 'vault/tests/helpers/noop-all-api-requests';
+import { deleteEngineCmd, runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const cli = create(consolePanel);
 
@@ -27,12 +28,7 @@ module('Acceptance | secrets/generic/create', function (hooks) {
 
   hooks.beforeEach(function () {
     this.uid = uuidv4();
-    this.server = apiStub({ usePassthrough: true });
-    return authPage.login();
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
+    return login();
   });
 
   test('it creates and can view a secret with the generic backend', async function (assert) {
@@ -47,14 +43,18 @@ module('Acceptance | secrets/generic/create', function (hooks) {
     );
     assert.strictEqual(listPage.secrets.length, 1, 'lists one secret in the backend');
 
-    await listPage.create();
-    await editPage.createSecret(kvPath, 'foo', 'bar');
+    await click(SES.createSecretLink);
+    await createSecret(kvPath, 'foo', 'bar');
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.secrets.backend.show',
       'redirects to the show page'
     );
     assert.ok(showPage.editIsPresent, 'shows the edit button');
+
+    // Clean up
+    await runCmd(deleteEngineCmd(path));
+    await runCmd(deleteEngineCmd(kvPath));
   });
 
   test('upgrading generic to version 2 lists all existing secrets, and CRUD continues to work', async function (assert) {
@@ -65,18 +65,35 @@ module('Acceptance | secrets/generic/create', function (hooks) {
       // upgrade to version 2 generic mount
       `write sys/mounts/${path}/tune options=version=2`,
     ]);
-    await visit(`/vault/secrets/${path}/kv/list`);
+    await visit('/vault/secrets-engines');
+    await fillIn(GENERAL.inputSearch('secret-engine-path'), path);
+    await click(`${GENERAL.tableData(`${path}/`, 'path')} a`);
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backend.kv.list',
+      'navigates to the KV engine list page'
+    );
 
     assert
       .dom(PAGE.list.item('foo'))
       .exists('lists secret created under kv1 engine as secret in the kv2 list view');
 
     await writeSecret(path, 'bar', 'key', 'value');
-    await visit(`/vault/secrets/${path}/kv/list`);
+    await visit(`/vault/secrets-engines/${path}/kv/list`);
 
     ['foo', 'bar'].forEach((secret) => {
       assert.dom(PAGE.list.item(secret.path)).exists('lists both records');
     });
     assert.dom(PAGE.list.item()).exists({ count: 2 }, 'lists only the two secrets');
+
+    await visit(`/vault/secrets-engines/${path}/list`);
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backend.kv.list',
+      'redirects to the KV engine list page from generic list'
+    );
+
+    // Clean up
+    await runCmd(deleteEngineCmd(path));
   });
 });
diff --git a/ui/tests/acceptance/secrets/backend/keymgmt/workflow-test.js b/ui/tests/acceptance/secrets/backend/keymgmt/workflow-test.js
new file mode 100644
index 00000000000..6783a38bcaa
--- /dev/null
+++ b/ui/tests/acceptance/secrets/backend/keymgmt/workflow-test.js
@@ -0,0 +1,122 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { settled, click, fillIn, visit, currentRouteName } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+
+import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SELECTORS } from 'vault/tests/helpers/secret-engine/general-settings-selectors';
+import { create } from 'ember-cli-page-object';
+import consoleClass from 'vault/tests/pages/components/console/ui-panel';
+
+const consoleComponent = create(consoleClass);
+
+module('Acceptance | Enterprise | keymgmt-configuration-workflow', function (hooks) {
+  setupApplicationTest(hooks);
+
+  hooks.beforeEach(function () {
+    return login();
+  });
+
+  test('it should display keymgmt configuration and tune keymgmt in the general settings form', async function (assert) {
+    await consoleComponent.runCommands([
+      // delete any previous mount with same name
+      'delete sys/mounts/keymgmt',
+    ]);
+    const keymgmtType = 'keymgmt';
+    await mountSecrets.visit();
+    await settled();
+    await mountBackend(keymgmtType, keymgmtType);
+    await click(SELECTORS.manageDropdown);
+    await click(SELECTORS.manageDropdownItem('Configure'));
+    assert
+      .dom(GENERAL.hdsPageHeaderTitle)
+      .hasText(`${keymgmtType} configuration`, 'displays configuration title');
+    assert.dom(GENERAL.tab('general-settings')).hasText(`General settings`);
+    assert.dom(GENERAL.cardContainer('version')).exists('version card exists');
+    assert.dom(SELECTORS.versionCard.engineType).hasText(keymgmtType, 'shows keymgmt engine type');
+    assert.dom(GENERAL.cardContainer('metadata')).exists('metadata card exists');
+    assert.dom(GENERAL.copySnippet('path')).hasText(`${keymgmtType}/`, 'show path value');
+    assert.dom(GENERAL.cardContainer('secrets duration')).exists('secrets duration card exists');
+    assert.dom(GENERAL.cardContainer('security')).exists('security card exists');
+
+    // fill in values to tune
+    await fillIn(GENERAL.inputByAttr('default_lease_ttl'), 10);
+    await fillIn(GENERAL.selectByAttr('default_lease_ttl'), 'm');
+    await fillIn(GENERAL.inputByAttr('max_lease_ttl'), 15);
+    await fillIn(GENERAL.selectByAttr('max_lease_ttl'), 'd');
+    await fillIn(GENERAL.textareaByAttr('description'), 'Some awesome description.');
+    await click(GENERAL.submitButton);
+
+    // after submitting go to list and back to configuration
+    await visit(`/vault/secrets-engines/${keymgmtType}/list`);
+    await visit(`/vault/secrets-engines/${keymgmtType}/configuration`);
+
+    // confirm that submitted values were saved and prepopulated with those saved values
+    assert
+      .dom(GENERAL.textareaByAttr('description'))
+      .hasValue('Some awesome description.', 'description was tuned');
+    assert.dom(GENERAL.inputByAttr('default_lease_ttl')).hasValue('10', 'default ttl value was tuned');
+    assert
+      .dom(GENERAL.selectByAttr('default_lease_ttl'))
+      .hasValue('m', 'default ttl value was tuned and shows correct unit');
+    assert.dom(GENERAL.inputByAttr('max_lease_ttl')).hasValue('15', 'max ttl value was tuned');
+    assert
+      .dom(GENERAL.selectByAttr('max_lease_ttl'))
+      .hasValue('d', 'max ttl value was tuned and shows correct unit');
+
+    // show unsaved changes modal and save
+    await fillIn(GENERAL.inputByAttr('default_lease_ttl'), 11);
+    await fillIn(GENERAL.selectByAttr('default_lease_ttl'), 'm');
+    await fillIn(GENERAL.textareaByAttr('description'), 'Updated awesome description.');
+    await click(GENERAL.breadcrumbAtIdx(0));
+    assert.dom(GENERAL.modal.container('unsaved-changes')).exists('Unsaved changes exists');
+    await click(GENERAL.button('save'));
+    assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.configuration.general-settings');
+    assert
+      .dom(GENERAL.textareaByAttr('description'))
+      .hasValue('Updated awesome description.', 'description was tuned from unsaved changes modal');
+    assert.dom(GENERAL.inputByAttr('default_lease_ttl')).hasValue('11', 'default ttl value was tuned');
+    assert.dom(GENERAL.selectByAttr('default_lease_ttl')).hasValue('m', 'default ttl unit was tuned');
+
+    await visit(`/vault/secrets-engines/${keymgmtType}/configuration`);
+
+    // show unsaved changes modal and discard
+    await fillIn(GENERAL.inputByAttr('default_lease_ttl'), 12);
+    await fillIn(GENERAL.selectByAttr('default_lease_ttl'), 'm');
+    await fillIn(GENERAL.textareaByAttr('description'), 'Some awesome description.');
+    await click(GENERAL.breadcrumbAtIdx(0));
+    assert.dom(GENERAL.modal.container('unsaved-changes')).exists('Unsaved changes exists');
+    await click(GENERAL.button('discard'));
+    assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.configuration.general-settings');
+    assert
+      .dom(GENERAL.textareaByAttr('description'))
+      .hasValue(
+        'Updated awesome description.',
+        'description was reset to original values after discarding from unsaved changes modal'
+      );
+    assert
+      .dom(GENERAL.inputByAttr('default_lease_ttl'))
+      .hasValue('11', 'default ttl value was reset to original values');
+    assert
+      .dom(GENERAL.selectByAttr('default_lease_ttl'))
+      .hasValue('m', 'default ttl unit was reset to original values');
+
+    // navigate back to keymgmt list view to delete the engine from the manage dropdown
+    await visit(`/vault/secrets-engines/${keymgmtType}/list`);
+    await click(SELECTORS.manageDropdown);
+    await click(SELECTORS.manageDropdownItem('Delete'));
+    await click(GENERAL.confirmButton);
+
+    await consoleComponent.runCommands([
+      // cleanup after
+      'delete sys/mounts/keymgmt',
+    ]);
+  });
+});
diff --git a/ui/tests/acceptance/secrets/backend/kubernetes/configuration-test.js b/ui/tests/acceptance/secrets/backend/kubernetes/configuration-test.js
index 873f2eb922e..d719c2d4805 100644
--- a/ui/tests/acceptance/secrets/backend/kubernetes/configuration-test.js
+++ b/ui/tests/acceptance/secrets/backend/kubernetes/configuration-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,7 @@ import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import kubernetesScenario from 'vault/mirage/scenarios/kubernetes';
 import kubernetesHandlers from 'vault/mirage/handlers/kubernetes';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { visit, click, currentRouteName } from '@ember/test-helpers';
 import { Response } from 'miragejs';
 
@@ -20,12 +20,12 @@ module('Acceptance | kubernetes | configuration', function (hooks) {
     kubernetesHandlers(this.server);
     kubernetesScenario(this.server);
     this.visitConfiguration = () => {
-      return visit('/vault/secrets/kubernetes/kubernetes/configuration');
+      return visit('/vault/secrets-engines/kubernetes/kubernetes/configuration');
     };
     this.validateRoute = (assert, route, message) => {
       assert.strictEqual(currentRouteName(), `vault.cluster.secrets.backend.kubernetes.${route}`, message);
     };
-    return authPage.login();
+    return login();
   });
 
   test('it should transition to configure page on Edit Configuration click from toolbar', async function (assert) {
diff --git a/ui/tests/acceptance/secrets/backend/kubernetes/credentials-test.js b/ui/tests/acceptance/secrets/backend/kubernetes/credentials-test.js
index 0aa4a410c1e..d1df231eb6f 100644
--- a/ui/tests/acceptance/secrets/backend/kubernetes/credentials-test.js
+++ b/ui/tests/acceptance/secrets/backend/kubernetes/credentials-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,8 +8,9 @@ import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import kubernetesScenario from 'vault/mirage/scenarios/kubernetes';
 import kubernetesHandlers from 'vault/mirage/handlers/kubernetes';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { fillIn, visit, click, currentRouteName } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Acceptance | kubernetes | credentials', function (hooks) {
   setupApplicationTest(hooks);
@@ -19,12 +20,12 @@ module('Acceptance | kubernetes | credentials', function (hooks) {
     kubernetesHandlers(this.server);
     kubernetesScenario(this.server);
     this.visitRoleCredentials = () => {
-      return visit('/vault/secrets/kubernetes/kubernetes/roles/role-0/credentials');
+      return visit('/vault/secrets-engines/kubernetes/kubernetes/roles/role-0/credentials');
     };
     this.validateRoute = (assert, route, message) => {
       assert.strictEqual(currentRouteName(), `vault.cluster.secrets.backend.kubernetes.${route}`, message);
     };
-    return authPage.login();
+    return login();
   });
 
   test('it should have correct breadcrumb links in credentials view', async function (assert) {
@@ -66,8 +67,8 @@ module('Acceptance | kubernetes | credentials', function (hooks) {
       };
     });
     await fillIn('[data-test-kubernetes-namespace]', 'kubernetes-test');
-    await click('[data-test-toggle-input]');
-    await click('[data-test-toggle-input="Time-to-Live (TTL)"]');
+    await click(GENERAL.toggleInput('kubernetes-clusterRoleBinding'));
+    await click(GENERAL.toggleInput('Time-to-Live (TTL)'));
     await fillIn('[data-test-ttl-value="Time-to-Live (TTL)"]', 2);
     await click('[data-test-generate-credentials-button]');
     await click('[data-test-generate-credentials-done]');
diff --git a/ui/tests/acceptance/secrets/backend/kubernetes/overview-test.js b/ui/tests/acceptance/secrets/backend/kubernetes/overview-test.js
index 5bb8b257b44..3224c62c2fa 100644
--- a/ui/tests/acceptance/secrets/backend/kubernetes/overview-test.js
+++ b/ui/tests/acceptance/secrets/backend/kubernetes/overview-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,10 +8,11 @@ import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import kubernetesScenario from 'vault/mirage/scenarios/kubernetes';
 import kubernetesHandlers from 'vault/mirage/handlers/kubernetes';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { visit, click, currentRouteName } from '@ember/test-helpers';
 import { selectChoose } from 'ember-power-select/test-support';
-import { SELECTORS } from 'vault/tests/helpers/kubernetes/overview';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { KUBERNETES_OVERVIEW } from 'vault/tests/helpers/kubernetes/kubernetes-selectors';
 
 module('Acceptance | kubernetes | overview', function (hooks) {
   setupApplicationTest(hooks);
@@ -23,18 +24,18 @@ module('Acceptance | kubernetes | overview', function (hooks) {
       shouldConfigureRoles ? kubernetesScenario(this.server) : kubernetesScenario(this.server, false);
 
     this.visitOverview = () => {
-      return visit('/vault/secrets/kubernetes/kubernetes/overview');
+      return visit('/vault/secrets-engines/kubernetes/kubernetes/overview');
     };
     this.validateRoute = (assert, route, message) => {
       assert.strictEqual(currentRouteName(), `vault.cluster.secrets.backend.kubernetes.${route}`, message);
     };
-    return authPage.login();
+    return login();
   });
 
   test('it should transition to configuration page during empty state', async function (assert) {
     assert.expect(1);
     await this.visitOverview();
-    await click('[data-test-component="empty-state"] a');
+    await click(`${GENERAL.emptyStateActions} a`);
     this.validateRoute(assert, 'configure', 'Transitions to Configure route on click');
   });
 
@@ -42,7 +43,7 @@ module('Acceptance | kubernetes | overview', function (hooks) {
     assert.expect(1);
     this.createScenario();
     await this.visitOverview();
-    await click(SELECTORS.rolesCardLink);
+    await click(KUBERNETES_OVERVIEW.rolesCardLink);
     this.validateRoute(assert, 'roles.index', 'Transitions to roles route on View Roles click');
   });
 
@@ -50,7 +51,7 @@ module('Acceptance | kubernetes | overview', function (hooks) {
     assert.expect(1);
     this.createScenario(false);
     await this.visitOverview();
-    await click(SELECTORS.rolesCardLink);
+    await click(KUBERNETES_OVERVIEW.rolesCardLink);
     this.validateRoute(assert, 'roles.create', 'Transitions to roles route on Create Roles click');
   });
 
@@ -59,7 +60,7 @@ module('Acceptance | kubernetes | overview', function (hooks) {
     await this.createScenario();
     await this.visitOverview();
     await selectChoose('.search-select', 'role-0');
-    await click('[data-test-generate-credential-button]');
+    await click(KUBERNETES_OVERVIEW.generateCredentialsCardButton);
     this.validateRoute(assert, 'roles.role.credentials', 'Transitions to roles route on Generate click');
   });
 });
diff --git a/ui/tests/acceptance/secrets/backend/kubernetes/roles-test.js b/ui/tests/acceptance/secrets/backend/kubernetes/roles-test.js
index 4a8dcdbdf6f..ead5a76a13e 100644
--- a/ui/tests/acceptance/secrets/backend/kubernetes/roles-test.js
+++ b/ui/tests/acceptance/secrets/backend/kubernetes/roles-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,8 +8,9 @@ import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import kubernetesScenario from 'vault/mirage/scenarios/kubernetes';
 import kubernetesHandlers from 'vault/mirage/handlers/kubernetes';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { fillIn, visit, currentURL, click, currentRouteName } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Acceptance | kubernetes | roles', function (hooks) {
   setupApplicationTest(hooks);
@@ -19,18 +20,19 @@ module('Acceptance | kubernetes | roles', function (hooks) {
     kubernetesHandlers(this.server);
     kubernetesScenario(this.server);
     this.visitRoles = () => {
-      return visit('/vault/secrets/kubernetes/kubernetes/roles');
+      return visit('/vault/secrets-engines/kubernetes/kubernetes/roles');
     };
     this.validateRoute = (assert, route, message) => {
       assert.strictEqual(currentRouteName(), `vault.cluster.secrets.backend.kubernetes.${route}`, message);
     };
-    return authPage.login();
+    return login();
   });
 
   test('it should filter roles', async function (assert) {
     await this.visitRoles();
     assert.dom('[data-test-list-item-link]').exists({ count: 3 }, 'Roles list renders');
-    await fillIn('[data-test-component="navigate-input"]', '1');
+    await fillIn(GENERAL.filterInputExplicit, '1');
+    await click(GENERAL.button('Search'));
     assert.dom('[data-test-list-item-link]').exists({ count: 1 }, 'Filtered roles list renders');
     assert.ok(currentURL().includes('pageFilter=1'), 'pageFilter query param value is set');
   });
@@ -60,7 +62,7 @@ module('Acceptance | kubernetes | roles', function (hooks) {
       await click('[data-test-list-item-popup] button');
       await click(`[data-test-${action}]`);
       if (action === 'delete') {
-        await click('[data-test-confirm-button]');
+        await click(GENERAL.confirmButton);
         assert.dom('[data-test-list-item-link]').exists({ count: 2 }, 'Deleted role removed from list');
       } else {
         this.validateRoute(
@@ -83,7 +85,7 @@ module('Acceptance | kubernetes | roles', function (hooks) {
     await fillIn('[data-test-input="name"]', 'new-test-role');
     await fillIn('[data-test-input="serviceAccountName"]', 'default');
     await fillIn('[data-test-input="allowedKubernetesNamespaces"]', '*');
-    await click('[data-test-save]');
+    await click('[data-test-submit]');
     this.validateRoute(assert, 'roles.role.details', 'Transitions to details route on save success');
     await click('[data-test-breadcrumbs] li:nth-child(2) a');
     assert.dom('[data-test-role="new-test-role"]').exists('New role renders in list');
@@ -101,7 +103,7 @@ module('Acceptance | kubernetes | roles', function (hooks) {
     await click('[data-test-cancel]');
     await click('[data-test-list-item-link]');
     await click('[data-test-delete]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
     assert
       .dom('[data-test-list-item-link]')
       .exists({ count: 2 }, 'Transitions to roles route and deleted role removed from list');
diff --git a/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-create-test.js b/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-create-test.js
index fc121a888c2..636298aebaf 100644
--- a/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-create-test.js
+++ b/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-create-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,12 +8,13 @@ import { v4 as uuidv4 } from 'uuid';
 import { click, currentURL, fillIn, typeIn, visit } from '@ember/test-helpers';
 
 import { setupApplicationTest } from 'vault/tests/helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { deleteEngineCmd, mountEngineCmd, runCmd, tokenWithPolicyCmd } from 'vault/tests/helpers/commands';
-import { personas } from 'vault/tests/helpers/policy-generator/kv';
-import { clearRecords, writeVersionedSecret } from 'vault/tests/helpers/kv/kv-run-commands';
+import { personas } from 'vault/tests/helpers/kv/policy-generator';
+import { writeSecret, writeVersionedSecret } from 'vault/tests/helpers/kv/kv-run-commands';
 import { FORM, PAGE } from 'vault/tests/helpers/kv/kv-selectors';
 import { grantAccessForWrite, setupControlGroup } from 'vault/tests/helpers/control-groups';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 /**
  * This test set is for testing the flow for creating new secrets and versions.
@@ -26,62 +27,62 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
   hooks.beforeEach(async function () {
     this.backend = `kv-create-${uuidv4()}`;
     this.store = this.owner.lookup('service:store');
-    await authPage.login();
+    await login();
     await runCmd(mountEngineCmd('kv-v2', this.backend), false);
     await writeVersionedSecret(this.backend, 'app/first', 'foo', 'bar', 2);
   });
 
   hooks.afterEach(async function () {
-    await authPage.login();
+    await login();
     return runCmd(deleteEngineCmd(this.backend));
   });
 
   module('admin persona', function (hooks) {
     hooks.beforeEach(async function () {
       const token = await runCmd(tokenWithPolicyCmd(`admin-${this.backend}`, personas.admin(this.backend)));
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('cancel on create clears model (a)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       assert.dom(PAGE.list.item()).exists({ count: 1 }, 'single secret exists on list');
-      assert.dom(PAGE.list.item('app/')).hasText('app/', 'expected list item');
+      assert.dom(`${PAGE.list.item('app/')} [data-test-path]`).hasText('app/', 'expected list item');
       await click(PAGE.list.createSecret);
       await fillIn(FORM.inputByAttr('path'), 'jk');
       await click(FORM.cancelBtn);
       assert.dom(PAGE.list.item()).exists({ count: 1 }, 'same amount of secrets');
-      assert.dom(PAGE.list.item('app/')).hasText('app/', 'expected list item');
+      assert.dom(`${PAGE.list.item('app/')} [data-test-path]`).hasText('app/', 'expected list item');
       await click(PAGE.list.createSecret);
       await fillIn(FORM.inputByAttr('path'), 'psych');
       await click(PAGE.breadcrumbAtIdx(1));
       assert.dom(PAGE.list.item()).exists({ count: 1 }, 'same amount of secrets');
-      assert.dom(PAGE.list.item('app/')).hasText('app/', 'expected list item');
+      assert.dom(`${PAGE.list.item('app/')} [data-test-path]`).hasText('app/', 'expected list item');
     });
     test('cancel on new version rolls back model (a)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/${encodeURIComponent('app/first')}/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/${encodeURIComponent('app/first')}/details`);
       assert.dom(PAGE.infoRowValue('foo')).exists('key has expected value');
       await click(PAGE.detail.createNewVersion);
       await fillIn(FORM.keyInput(), 'bar');
       await click(FORM.cancelBtn);
+      await click(PAGE.secretTab('Secret'));
       assert.dom(PAGE.infoRowValue('foo')).exists('secret is previous value');
       await click(PAGE.detail.createNewVersion);
       await fillIn(FORM.keyInput(), 'bar');
       await click(PAGE.breadcrumbAtIdx(3));
+      await click(PAGE.secretTab('Secret'));
       assert.dom(PAGE.infoRowValue('foo')).exists('secret is previous value');
     });
     test('create & update root secret with default metadata (a)', async function (assert) {
       const backend = this.backend;
       const secretPath = 'some secret';
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret form -- validations
       await click(FORM.saveBtn);
       assert.dom(FORM.invalidFormAlert).hasText('There is an error with this form.');
-      assert.dom(FORM.validation('path')).hasText("Path can't be blank.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't be blank.");
       await typeIn(FORM.inputByAttr('path'), secretPath);
       assert
         .dom(FORM.validationWarning)
@@ -98,12 +99,15 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       await fillIn(FORM.maskedValueInput(), 'partyparty');
       await click(FORM.saveBtn);
 
-      // Details page
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent(secretPath)}/details?version=1`,
-        'Goes to details page after save'
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent(secretPath)}`,
+        'Goes to overview after save'
       );
+      // Details page
+      await click(PAGE.secretTab('Secret'));
+      `/vault/secrets-engines/${backend}/kv/${encodeURIComponent(secretPath)}/details?version=1`,
+        'details has version 1 param';
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 1 created');
       assert.dom(PAGE.infoRow).exists({ count: 1 }, '1 row of data shows');
       assert.dom(PAGE.infoRowValue('api_key')).hasText('***********');
@@ -135,11 +139,15 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       await fillIn(FORM.keyInput(1), 'api_url');
       await fillIn(FORM.maskedValueInput(1), 'hashicorp.com');
       await click(FORM.saveBtn);
+      assert
+        .dom(GENERAL.overviewCard.container('Current version'))
+        .hasTextContaining('2', 'Overview shows updated version');
 
       // Back to details page
+      await click(PAGE.secretTab('Secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent(secretPath)}/details?version=2`
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent(secretPath)}/details?version=2`
       );
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 2 created');
       assert.dom(PAGE.infoRow).exists({ count: 2 }, '2 rows of data shows');
@@ -152,34 +160,34 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('create nested secret with metadata (a)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret
       await typeIn(FORM.inputByAttr('path'), 'my/');
-      assert.dom(FORM.validation('path')).hasText("Path can't end in forward slash '/'.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't end in forward slash '/'.");
       await typeIn(FORM.inputByAttr('path'), 'secret');
-      assert.dom(FORM.validation('path')).doesNotExist('form validation goes away');
+      assert.dom(GENERAL.validationErrorByAttr('path')).doesNotExist('form validation goes away');
       await fillIn(FORM.keyInput(), 'password');
       await fillIn(FORM.maskedValueInput(), 'kittens1234');
 
       await click(FORM.toggleMetadata);
       assert.dom(PAGE.create.metadataSection).exists('Shows metadata section after toggled');
       // Check initial values
-      assert.dom(FORM.inputByAttr('maxVersions')).hasValue('0');
-      assert.dom(FORM.inputByAttr('casRequired')).isNotChecked();
+      assert.dom(FORM.inputByAttr('max_versions')).hasValue('0');
+      assert.dom(FORM.inputByAttr('cas_required')).isNotChecked();
       assert.dom(FORM.toggleByLabel('Automate secret deletion')).isNotChecked();
-      // MaxVersions validation
-      await fillIn(FORM.inputByAttr('maxVersions'), 'seven');
+      // max_versions validation
+      await fillIn(FORM.inputByAttr('max_versions'), 'seven');
       await click(FORM.saveBtn);
-      assert.dom(FORM.validation('maxVersions')).hasText('Maximum versions must be a number.');
-      await fillIn(FORM.inputByAttr('maxVersions'), '99999999999999999');
+      assert.dom(GENERAL.validationErrorByAttr('max_versions')).hasText('Maximum versions must be a number.');
+      await fillIn(FORM.inputByAttr('max_versions'), '99999999999999999');
       await click(FORM.saveBtn);
-      assert.dom(FORM.validation('maxVersions')).hasText('You cannot go over 16 characters.');
-      await fillIn(FORM.inputByAttr('maxVersions'), '7');
+      assert.dom(GENERAL.validationErrorByAttr('max_versions')).hasText('You cannot go over 16 characters.');
+      await fillIn(FORM.inputByAttr('max_versions'), '7');
 
       // Fill in other metadata
-      await click(FORM.inputByAttr('casRequired'));
+      await click(FORM.inputByAttr('cas_required'));
       await click(FORM.toggleByLabel('Automate secret deletion'));
       await fillIn(FORM.ttlValue('Automate secret deletion'), '1000');
 
@@ -188,11 +196,17 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       await fillIn(`${PAGE.create.metadataSection} ${FORM.valueInput()}`, 'UI');
       // Fill in metadata
       await click(FORM.saveBtn);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent('my/secret')}`,
+        'goes to overview after save'
+      );
 
       // Details
+      await click(PAGE.secretTab('Secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent('my/secret')}/details?version=1`
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent('my/secret')}/details?version=1`
       );
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 1 created');
       assert.dom(PAGE.infoRow).exists({ count: 1 }, '1 row of data shows');
@@ -218,43 +232,47 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('creates a secret at a sub-directory (a)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list/app/`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list/app/`);
       assert.dom(PAGE.list.item('first')).exists('Lists first sub-secret');
       assert.dom(PAGE.list.item('new')).doesNotExist('Does not show new secret');
       await click(PAGE.list.createSecret);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/create?initialKey=app%2F`,
+        `/vault/secrets-engines/${backend}/kv/create?initialKey=app%2F`,
         'Goes to create page with initialKey'
       );
       await typeIn(FORM.inputByAttr('path'), 'new');
       await fillIn(FORM.keyInput(), 'api_key');
       await fillIn(FORM.maskedValueInput(), 'partyparty');
       await click(FORM.saveBtn);
+      assert
+        .dom(GENERAL.overviewCard.container('Current version'))
+        .hasTextContaining('1', 'Overview shows current version');
+      await click(PAGE.secretTab('Secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent('app/new')}/details?version=1`,
-        'Redirects to detail after save'
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent('app/new')}/details?version=1`,
+        'Details url has version param'
       );
       await click(PAGE.breadcrumbAtIdx(2));
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list/app/`, 'sub-dir page');
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${backend}/kv/list/app/`, 'sub-dir page');
       assert.dom(PAGE.list.item('new')).exists('Lists new secret in sub-dir');
     });
     test('create new version of secret from older version (a)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/app%2Ffirst/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/app%2Ffirst/details`);
       await click(PAGE.detail.versionDropdown);
       await click(`${PAGE.detail.version(1)} a`);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Ffirst/details?version=1`,
+        `/vault/secrets-engines/${backend}/kv/app%2Ffirst/details?version=1`,
         'goes to version 1'
       );
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 1 created');
       await click(PAGE.detail.createNewVersion);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Ffirst/details/edit?version=1`,
+        `/vault/secrets-engines/${backend}/kv/app%2Ffirst/details/edit?version=1`,
         'Goes to new version page'
       );
       assert
@@ -269,15 +287,56 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       await fillIn(FORM.keyInput(), 'my-key');
       await fillIn(FORM.maskedValueInput(), 'my-value');
       await click(FORM.saveBtn);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/app%2Ffirst`,
+        'goes to overview after save'
+      );
 
+      await click(PAGE.secretTab('Secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Ffirst/details?version=3`,
+        `/vault/secrets-engines/${backend}/kv/app%2Ffirst/details?version=3`,
         'goes to latest version 3'
       );
       await click(PAGE.infoRowToggleMasked('my-key'));
       assert.dom(PAGE.infoRowValue('my-key')).hasText('my-value', 'has new value');
     });
+
+    // patch is technically enterprise only but stubbing the version so these run on both CE and enterprise
+    test('it patches a secret', async function (assert) {
+      this.owner.lookup('service:version').type = 'enterprise';
+      const patchSecret = 'patch-secret';
+      await writeSecret(this.backend, patchSecret, 'foo', 'bar');
+      assert.dom(GENERAL.overviewCard.content('Subkeys')).hasText('Keys foo');
+
+      await click(GENERAL.overviewCard.actionText('Patch secret'));
+      // edit existing key
+      await click(FORM.patchEdit(0));
+      await fillIn(FORM.valueInput(0), 'newfoo');
+      // add new key
+      await fillIn(FORM.keyInput('new'), 'newkey');
+      await fillIn(FORM.valueInput('new'), 'newvalue');
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.overviewCard.content('Subkeys')).hasText('Keys foo newkey');
+
+      // check patch updated secret
+      await click(PAGE.secretTab('Secret'));
+      await click(PAGE.infoRowToggleMasked('foo'));
+      assert.dom(PAGE.infoRowValue('foo')).hasText('newfoo', 'has updated value');
+      await click(PAGE.infoRowToggleMasked('newkey'));
+      assert.dom(PAGE.infoRowValue('newkey')).hasText('newvalue', 'has new key/value pair');
+
+      await click(PAGE.detail.patchLatest);
+      await click(FORM.patchDelete());
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.overviewCard.content('Subkeys')).hasText('Keys newkey');
+      // check patch updated secret
+      await click(PAGE.secretTab('Secret'));
+      await click(PAGE.infoRowToggleMasked('newkey'));
+      assert.dom(PAGE.infoRowValue('foo')).doesNotExist();
+      assert.dom(PAGE.infoRowValue('newkey')).hasText('newvalue', 'has new key/value pair');
+    });
   });
 
   module('data-reader persona', function (hooks) {
@@ -285,13 +344,11 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       const token = await runCmd(
         tokenWithPolicyCmd(`data-reader-${this.backend}`, personas.dataReader(this.backend))
       );
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('cancel on create clears model (dr)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       assert.dom(PAGE.list.item()).doesNotExist('list view has no items');
       await click(PAGE.list.createSecret);
       await fillIn(FORM.inputByAttr('path'), 'jk');
@@ -304,20 +361,20 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('cancel on new version rolls back model (dr)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/${encodeURIComponent('app/first')}/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/${encodeURIComponent('app/first')}/details`);
       assert.dom(PAGE.infoRowValue('foo')).exists('key has expected value');
       assert.dom(PAGE.detail.createNewVersion).doesNotExist();
     });
     test('create & update root secret with default metadata (dr)', async function (assert) {
       const backend = this.backend;
       const secretPath = 'some secret';
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret form -- validations
       await click(FORM.saveBtn);
       assert.dom(FORM.invalidFormAlert).hasText('There is an error with this form.');
-      assert.dom(FORM.validation('path')).hasText("Path can't be blank.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't be blank.");
       await typeIn(FORM.inputByAttr('path'), secretPath);
       assert
         .dom(FORM.validationWarning)
@@ -333,7 +390,7 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
         .hasText('Error 1 error occurred: * permission denied', 'API error shows on form');
 
       // Since this persona can't create a new secret, test update with existing:
-      await visit(`/vault/secrets/${backend}/kv/app%2Ffirst/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/app%2Ffirst/details`);
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 2 created');
       assert.dom(PAGE.infoRow).exists({ count: 1 }, '1 row of data shows');
       assert.dom(PAGE.infoRowValue('foo')).hasText('***********');
@@ -342,6 +399,10 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
 
       // Metadata page
       await click(PAGE.secretTab('Metadata'));
+      assert
+        .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
+        .hasText('Request custom metadata?');
+      await click(PAGE.metadata.requestData);
       assert
         .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
         .hasText('No custom metadata', 'No custom metadata empty state');
@@ -355,34 +416,34 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('create nested secret with metadata (dr)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret
       await typeIn(FORM.inputByAttr('path'), 'my/');
-      assert.dom(FORM.validation('path')).hasText("Path can't end in forward slash '/'.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't end in forward slash '/'.");
       await typeIn(FORM.inputByAttr('path'), 'secret');
-      assert.dom(FORM.validation('path')).doesNotExist('form validation goes away');
+      assert.dom(GENERAL.validationErrorByAttr('path')).doesNotExist('form validation goes away');
       await fillIn(FORM.keyInput(), 'password');
       await fillIn(FORM.maskedValueInput(), 'kittens1234');
 
       await click(FORM.toggleMetadata);
       assert.dom(PAGE.create.metadataSection).exists('Shows metadata section after toggled');
       // Check initial values
-      assert.dom(FORM.inputByAttr('maxVersions')).hasValue('0');
-      assert.dom(FORM.inputByAttr('casRequired')).isNotChecked();
+      assert.dom(FORM.inputByAttr('max_versions')).hasValue('0');
+      assert.dom(FORM.inputByAttr('cas_required')).isNotChecked();
       assert.dom(FORM.toggleByLabel('Automate secret deletion')).isNotChecked();
-      // MaxVersions validation
-      await fillIn(FORM.inputByAttr('maxVersions'), 'seven');
+      // max_versions validation
+      await fillIn(FORM.inputByAttr('max_versions'), 'seven');
       await click(FORM.saveBtn);
-      assert.dom(FORM.validation('maxVersions')).hasText('Maximum versions must be a number.');
-      await fillIn(FORM.inputByAttr('maxVersions'), '99999999999999999');
+      assert.dom(GENERAL.validationErrorByAttr('max_versions')).hasText('Maximum versions must be a number.');
+      await fillIn(FORM.inputByAttr('max_versions'), '99999999999999999');
       await click(FORM.saveBtn);
-      assert.dom(FORM.validation('maxVersions')).hasText('You cannot go over 16 characters.');
-      await fillIn(FORM.inputByAttr('maxVersions'), '7');
+      assert.dom(GENERAL.validationErrorByAttr('max_versions')).hasText('You cannot go over 16 characters.');
+      await fillIn(FORM.inputByAttr('max_versions'), '7');
 
       // Fill in other metadata
-      await click(FORM.inputByAttr('casRequired'));
+      await click(FORM.inputByAttr('cas_required'));
       await click(FORM.toggleByLabel('Automate secret deletion'));
       await fillIn(FORM.ttlValue('Automate secret deletion'), '1000');
 
@@ -397,12 +458,12 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('creates a secret at a sub-directory (dr)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list/app/`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list/app/`);
       assert.dom(PAGE.list.item()).doesNotExist('Does not list any secrets');
       await click(PAGE.list.createSecret);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/create?initialKey=app%2F`,
+        `/vault/secrets-engines/${backend}/kv/create?initialKey=app%2F`,
         'Goes to create page with initialKey'
       );
       await typeIn(FORM.inputByAttr('path'), 'new');
@@ -415,7 +476,7 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('create new version of secret from older version (dr)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/app%2Ffirst/details?version=1`);
+      await visit(`/vault/secrets-engines/${backend}/kv/app%2Ffirst/details?version=1`);
       assert.dom(PAGE.detail.versionDropdown).doesNotExist('version dropdown does not show');
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 1 created');
       assert.dom(PAGE.detail.createNewVersion).doesNotExist('cannot create new version');
@@ -427,42 +488,40 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       const token = await runCmd(
         tokenWithPolicyCmd(`data-list-reader-${this.backend}`, personas.dataListReader(this.backend))
       );
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('cancel on create clears model (dlr)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       assert.dom(PAGE.list.item()).exists({ count: 1 }, 'single secret exists on list');
-      assert.dom(PAGE.list.item('app/')).hasText('app/', 'expected list item');
+      assert.dom(`${PAGE.list.item('app/')} [data-test-path]`).hasText('app/', 'expected list item');
       await click(PAGE.list.createSecret);
       await fillIn(FORM.inputByAttr('path'), 'jk');
       await click(FORM.cancelBtn);
       assert.dom(PAGE.list.item()).exists({ count: 1 }, 'same amount of secrets');
-      assert.dom(PAGE.list.item('app/')).hasText('app/', 'expected list item');
+      assert.dom(`${PAGE.list.item('app/')} [data-test-path]`).hasText('app/', 'expected list item');
       await click(PAGE.list.createSecret);
       await fillIn(FORM.inputByAttr('path'), 'psych');
       await click(PAGE.breadcrumbAtIdx(1));
       assert.dom(PAGE.list.item()).exists({ count: 1 }, 'same amount of secrets');
-      assert.dom(PAGE.list.item('app/')).hasText('app/', 'expected list item');
+      assert.dom(`${PAGE.list.item('app/')} [data-test-path]`).hasText('app/', 'expected list item');
     });
     test('cancel on new version rolls back model (dlr)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/${encodeURIComponent('app/first')}/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/${encodeURIComponent('app/first')}/details`);
       assert.dom(PAGE.infoRowValue('foo')).exists('key has expected value');
       assert.dom(PAGE.detail.createNewVersion).doesNotExist('cannot create new version');
     });
     test('create & update root secret with default metadata (dlr)', async function (assert) {
       const backend = this.backend;
       const secretPath = 'some secret';
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret form -- validations
       await click(FORM.saveBtn);
       assert.dom(FORM.invalidFormAlert).hasText('There is an error with this form.');
-      assert.dom(FORM.validation('path')).hasText("Path can't be blank.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't be blank.");
       await typeIn(FORM.inputByAttr('path'), secretPath);
       assert
         .dom(FORM.validationWarning)
@@ -478,7 +537,7 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
         .hasText('Error 1 error occurred: * permission denied', 'API error shows on form');
 
       // Since this persona can't create a new secret, test update with existing:
-      await visit(`/vault/secrets/${backend}/kv/app%2Ffirst/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/app%2Ffirst/details`);
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 2 created');
       assert.dom(PAGE.infoRow).exists({ count: 1 }, '1 row of data shows');
       assert.dom(PAGE.infoRowValue('foo')).hasText('***********');
@@ -487,6 +546,10 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
 
       // Metadata page
       await click(PAGE.secretTab('Metadata'));
+      assert
+        .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
+        .hasText('Request custom metadata?');
+      await click(PAGE.metadata.requestData);
       assert
         .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
         .hasText('No custom metadata', 'No custom metadata empty state');
@@ -500,34 +563,34 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('create nested secret with metadata (dlr)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret
       await typeIn(FORM.inputByAttr('path'), 'my/');
-      assert.dom(FORM.validation('path')).hasText("Path can't end in forward slash '/'.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't end in forward slash '/'.");
       await typeIn(FORM.inputByAttr('path'), 'secret');
-      assert.dom(FORM.validation('path')).doesNotExist('form validation goes away');
+      assert.dom(GENERAL.validationErrorByAttr('path')).doesNotExist('form validation goes away');
       await fillIn(FORM.keyInput(), 'password');
       await fillIn(FORM.maskedValueInput(), 'kittens1234');
 
       await click(FORM.toggleMetadata);
       assert.dom(PAGE.create.metadataSection).exists('Shows metadata section after toggled');
       // Check initial values
-      assert.dom(FORM.inputByAttr('maxVersions')).hasValue('0');
-      assert.dom(FORM.inputByAttr('casRequired')).isNotChecked();
+      assert.dom(FORM.inputByAttr('max_versions')).hasValue('0');
+      assert.dom(FORM.inputByAttr('cas_required')).isNotChecked();
       assert.dom(FORM.toggleByLabel('Automate secret deletion')).isNotChecked();
-      // MaxVersions validation
-      await fillIn(FORM.inputByAttr('maxVersions'), 'seven');
+      // max_versions validation
+      await fillIn(FORM.inputByAttr('max_versions'), 'seven');
       await click(FORM.saveBtn);
-      assert.dom(FORM.validation('maxVersions')).hasText('Maximum versions must be a number.');
-      await fillIn(FORM.inputByAttr('maxVersions'), '99999999999999999');
+      assert.dom(GENERAL.validationErrorByAttr('max_versions')).hasText('Maximum versions must be a number.');
+      await fillIn(FORM.inputByAttr('max_versions'), '99999999999999999');
       await click(FORM.saveBtn);
-      assert.dom(FORM.validation('maxVersions')).hasText('You cannot go over 16 characters.');
-      await fillIn(FORM.inputByAttr('maxVersions'), '7');
+      assert.dom(GENERAL.validationErrorByAttr('max_versions')).hasText('You cannot go over 16 characters.');
+      await fillIn(FORM.inputByAttr('max_versions'), '7');
 
       // Fill in other metadata
-      await click(FORM.inputByAttr('casRequired'));
+      await click(FORM.inputByAttr('cas_required'));
       await click(FORM.toggleByLabel('Automate secret deletion'));
       await fillIn(FORM.ttlValue('Automate secret deletion'), '1000');
 
@@ -542,12 +605,12 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('creates a secret at a sub-directory (dlr)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list/app/`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list/app/`);
       assert.dom(PAGE.list.item()).doesNotExist('Does not list any secrets');
       await click(PAGE.list.createSecret);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/create?initialKey=app%2F`,
+        `/vault/secrets-engines/${backend}/kv/create?initialKey=app%2F`,
         'Goes to create page with initialKey'
       );
       await typeIn(FORM.inputByAttr('path'), 'new');
@@ -560,7 +623,7 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('create new version of secret from older version (dlr)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/app%2Ffirst/details?version=1`);
+      await visit(`/vault/secrets-engines/${backend}/kv/app%2Ffirst/details?version=1`);
       assert.dom(PAGE.detail.versionDropdown).doesNotExist('version dropdown does not show');
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 1 created');
       assert.dom(PAGE.detail.createNewVersion).doesNotExist('cannot create new version');
@@ -572,29 +635,27 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       const token = await runCmd(
         tokenWithPolicyCmd(`data-list-reader-${this.backend}`, personas.metadataMaintainer(this.backend))
       );
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('cancel on create clears model (mm)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       assert.dom(PAGE.list.item()).exists({ count: 1 }, 'single secret exists on list');
-      assert.dom(PAGE.list.item('app/')).hasText('app/', 'expected list item');
+      assert.dom(`${PAGE.list.item('app/')} [data-test-path]`).hasText('app/', 'expected list item');
       await click(PAGE.list.createSecret);
       await fillIn(FORM.inputByAttr('path'), 'jk');
       await click(FORM.cancelBtn);
       assert.dom(PAGE.list.item()).exists({ count: 1 }, 'same amount of secrets');
-      assert.dom(PAGE.list.item('app/')).hasText('app/', 'expected list item');
+      assert.dom(`${PAGE.list.item('app/')} [data-test-path]`).hasText('app/', 'expected list item');
       await click(PAGE.list.createSecret);
       await fillIn(FORM.inputByAttr('path'), 'psych');
       await click(PAGE.breadcrumbAtIdx(1));
       assert.dom(PAGE.list.item()).exists({ count: 1 }, 'same amount of secrets');
-      assert.dom(PAGE.list.item('app/')).hasText('app/', 'expected list item');
+      assert.dom(`${PAGE.list.item('app/')} [data-test-path]`).hasText('app/', 'expected list item');
     });
     test('cancel on new version rolls back model (mm)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/${encodeURIComponent('app/first')}/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/${encodeURIComponent('app/first')}/details`);
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
       assert
         .dom(PAGE.detail.createNewVersion)
@@ -603,13 +664,13 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     test('create & update root secret with default metadata (mm)', async function (assert) {
       const backend = this.backend;
       const secretPath = 'some secret';
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret form -- validations
       await click(FORM.saveBtn);
       assert.dom(FORM.invalidFormAlert).hasText('There is an error with this form.');
-      assert.dom(FORM.validation('path')).hasText("Path can't be blank.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't be blank.");
       await typeIn(FORM.inputByAttr('path'), secretPath);
       assert
         .dom(FORM.validationWarning)
@@ -625,7 +686,7 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
         .hasText('Error 1 error occurred: * permission denied', 'API error shows on form');
 
       // Since this persona can't create a new secret, test update with existing:
-      await visit(`/vault/secrets/${backend}/kv/app%2Ffirst/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/app%2Ffirst/details`);
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('Version created tooltip does not show');
       assert.dom(PAGE.infoRow).doesNotExist('secret data not shown');
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
@@ -647,7 +708,7 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       // Add new version
       await click(PAGE.secretTab('Secret'));
       assert.dom(PAGE.detail.createNewVersion).doesNotExist('create new version button not rendered');
-      await visit(`/vault/secrets/${backend}/kv/app%2Ffirst/details/edit?version=1`);
+      await visit(`/vault/secrets-engines/${backend}/kv/app%2Ffirst/details/edit?version=1`);
       assert
         .dom(FORM.noReadAlert)
         .hasText(
@@ -669,34 +730,34 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('create nested secret with metadata (mm)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret
       await typeIn(FORM.inputByAttr('path'), 'my/');
-      assert.dom(FORM.validation('path')).hasText("Path can't end in forward slash '/'.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't end in forward slash '/'.");
       await typeIn(FORM.inputByAttr('path'), 'secret');
-      assert.dom(FORM.validation('path')).doesNotExist('form validation goes away');
+      assert.dom(GENERAL.validationErrorByAttr('path')).doesNotExist('form validation goes away');
       await fillIn(FORM.keyInput(), 'password');
       await fillIn(FORM.maskedValueInput(), 'kittens1234');
 
       await click(FORM.toggleMetadata);
       assert.dom(PAGE.create.metadataSection).exists('Shows metadata section after toggled');
       // Check initial values
-      assert.dom(FORM.inputByAttr('maxVersions')).hasValue('0');
-      assert.dom(FORM.inputByAttr('casRequired')).isNotChecked();
+      assert.dom(FORM.inputByAttr('max_versions')).hasValue('0');
+      assert.dom(FORM.inputByAttr('cas_required')).isNotChecked();
       assert.dom(FORM.toggleByLabel('Automate secret deletion')).isNotChecked();
-      // MaxVersions validation
-      await fillIn(FORM.inputByAttr('maxVersions'), 'seven');
+      // max_versions validation
+      await fillIn(FORM.inputByAttr('max_versions'), 'seven');
       await click(FORM.saveBtn);
-      assert.dom(FORM.validation('maxVersions')).hasText('Maximum versions must be a number.');
-      await fillIn(FORM.inputByAttr('maxVersions'), '99999999999999999');
+      assert.dom(GENERAL.validationErrorByAttr('max_versions')).hasText('Maximum versions must be a number.');
+      await fillIn(FORM.inputByAttr('max_versions'), '99999999999999999');
       await click(FORM.saveBtn);
-      assert.dom(FORM.validation('maxVersions')).hasText('You cannot go over 16 characters.');
-      await fillIn(FORM.inputByAttr('maxVersions'), '7');
+      assert.dom(GENERAL.validationErrorByAttr('max_versions')).hasText('You cannot go over 16 characters.');
+      await fillIn(FORM.inputByAttr('max_versions'), '7');
 
       // Fill in other metadata
-      await click(FORM.inputByAttr('casRequired'));
+      await click(FORM.inputByAttr('cas_required'));
       await click(FORM.toggleByLabel('Automate secret deletion'));
       await fillIn(FORM.ttlValue('Automate secret deletion'), '1000');
 
@@ -711,13 +772,13 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('creates a secret at a sub-directory (mm)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list/app/`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list/app/`);
       assert.dom(PAGE.list.item('first')).exists('Lists first sub-secret');
       assert.dom(PAGE.list.item('new')).doesNotExist('Does not show new secret');
       await click(PAGE.list.createSecret);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/create?initialKey=app%2F`,
+        `/vault/secrets-engines/${backend}/kv/create?initialKey=app%2F`,
         'Goes to create page with initialKey'
       );
       await typeIn(FORM.inputByAttr('path'), 'new');
@@ -730,19 +791,19 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('create new version of secret from older version (mm)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/app%2Ffirst/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/app%2Ffirst/details`);
       assert.dom(PAGE.detail.versionDropdown).hasText('Version 2');
       await click(PAGE.detail.versionDropdown);
       await click(`${PAGE.detail.version(1)} a`);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Ffirst/details?version=1`,
+        `/vault/secrets-engines/${backend}/kv/app%2Ffirst/details?version=1`,
         'goes to version 1'
       );
       assert.dom(PAGE.detail.versionDropdown).hasText('Version 1');
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('version timestamp not shown');
       assert.dom(PAGE.detail.createNewVersion).doesNotExist('create new version button not rendered');
-      await visit(`/vault/secrets/${backend}/kv/app%2Ffirst/details/edit?version=1`);
+      await visit(`/vault/secrets-engines/${backend}/kv/app%2Ffirst/details/edit?version=1`);
       assert
         .dom(FORM.noReadAlert)
         .hasText(
@@ -769,13 +830,11 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       const token = await runCmd(
         tokenWithPolicyCmd(`secret-creator-${this.backend}`, personas.secretCreator(this.backend))
       );
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('cancel on create clears model (sc)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       assert.dom(PAGE.list.item()).doesNotExist('list view has no items');
       await click(PAGE.list.createSecret);
       await fillIn(FORM.inputByAttr('path'), 'jk');
@@ -788,7 +847,7 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('cancel on new version rolls back model (sc)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/${encodeURIComponent('app/first')}/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/${encodeURIComponent('app/first')}/details`);
       assert
         .dom(PAGE.emptyStateTitle)
         .hasText('You do not have permission to read this secret', 'no permissions state shows');
@@ -797,30 +856,29 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       await click(FORM.cancelBtn);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent('app/first')}/details`,
-        'cancel goes to correct url'
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent('app/first')}`,
+        'cancel goes to overview'
       );
-      assert.dom(PAGE.list.item()).doesNotExist('list view has no items');
+      await click(PAGE.secretTab('Secret'));
       await click(PAGE.detail.createNewVersion);
       await fillIn(FORM.keyInput(), 'bar');
       await click(PAGE.breadcrumbAtIdx(3));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent('app/first')}/details`,
-        'breadcrumb goes to correct url'
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent('app/first')}`,
+        'breadcrumb goes to overview'
       );
-      assert.dom(PAGE.list.item()).doesNotExist('list view has no items');
     });
     test('create & update root secret with default metadata (sc)', async function (assert) {
       const backend = this.backend;
       const secretPath = 'some secret';
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret form -- validations
       await click(FORM.saveBtn);
       assert.dom(FORM.invalidFormAlert).hasText('There is an error with this form.');
-      assert.dom(FORM.validation('path')).hasText("Path can't be blank.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't be blank.");
       await typeIn(FORM.inputByAttr('path'), secretPath);
       assert
         .dom(FORM.validationWarning)
@@ -836,13 +894,13 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       await fillIn(FORM.keyInput(), 'api_key');
       await fillIn(FORM.maskedValueInput(), 'partyparty');
       await click(FORM.saveBtn);
-
-      // Details page
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent(secretPath)}/details`,
-        'Goes to details page after save'
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent(secretPath)}`,
+        'Goes to overview page after save'
       );
+      // Details page
+      await click(PAGE.secretTab('Secret'));
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('Version created not shown');
       assert.dom(PAGE.infoRow).doesNotExist('does not show data contents');
       assert
@@ -864,20 +922,31 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       // Add new version
       await click(PAGE.secretTab('Secret'));
       await click(PAGE.detail.createNewVersion);
+      assert
+        .dom(FORM.noReadAlert)
+        .hasText(
+          'Warning You do not have read permissions for this secret data. Saving will overwrite the existing secret.',
+          'shows alert for no read permissions'
+        );
       assert.dom(FORM.inputByAttr('path')).isDisabled('path input is disabled');
       assert.dom(FORM.inputByAttr('path')).hasValue(secretPath);
       assert.dom(FORM.toggleMetadata).doesNotExist('Does not show metadata toggle when creating new version');
-      assert.dom(FORM.keyInput()).hasValue('', 'row 1 is empty key');
-      assert.dom(FORM.maskedValueInput()).hasValue('', 'row 1 has empty value');
+      assert.dom(FORM.keyInput()).hasValue('', 'Key input has empty value');
+      assert.dom(FORM.maskedValueInput()).hasValue('', 'Val input has empty value');
       await fillIn(FORM.keyInput(), 'api_url');
       await fillIn(FORM.maskedValueInput(), 'hashicorp.com');
       await click(FORM.saveBtn);
-
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent(secretPath)}`,
+        'goes to overview page'
+      );
       // Back to details page
+      await click(PAGE.secretTab('Secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent(secretPath)}/details?version=2`,
-        'goes back to details page'
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent(secretPath)}/details`,
+        'goes to details page'
       );
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('Version created does not show');
       assert.dom(PAGE.infoRow).doesNotExist('does not show data contents');
@@ -887,34 +956,34 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('create nested secret with metadata (sc)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret
       await typeIn(FORM.inputByAttr('path'), 'my/');
-      assert.dom(FORM.validation('path')).hasText("Path can't end in forward slash '/'.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't end in forward slash '/'.");
       await typeIn(FORM.inputByAttr('path'), 'secret');
-      assert.dom(FORM.validation('path')).doesNotExist('form validation goes away');
+      assert.dom(GENERAL.validationErrorByAttr('path')).doesNotExist('form validation goes away');
       await fillIn(FORM.keyInput(), 'password');
       await fillIn(FORM.maskedValueInput(), 'kittens1234');
 
       await click(FORM.toggleMetadata);
       assert.dom(PAGE.create.metadataSection).exists('Shows metadata section after toggled');
       // Check initial values
-      assert.dom(FORM.inputByAttr('maxVersions')).hasValue('0');
-      assert.dom(FORM.inputByAttr('casRequired')).isNotChecked();
+      assert.dom(FORM.inputByAttr('max_versions')).hasValue('0');
+      assert.dom(FORM.inputByAttr('cas_required')).isNotChecked();
       assert.dom(FORM.toggleByLabel('Automate secret deletion')).isNotChecked();
-      // MaxVersions validation
-      await fillIn(FORM.inputByAttr('maxVersions'), 'seven');
+      // max_versions validation
+      await fillIn(FORM.inputByAttr('max_versions'), 'seven');
       await click(FORM.saveBtn);
-      assert.dom(FORM.validation('maxVersions')).hasText('Maximum versions must be a number.');
-      await fillIn(FORM.inputByAttr('maxVersions'), '99999999999999999');
+      assert.dom(GENERAL.validationErrorByAttr('max_versions')).hasText('Maximum versions must be a number.');
+      await fillIn(FORM.inputByAttr('max_versions'), '99999999999999999');
       await click(FORM.saveBtn);
-      assert.dom(FORM.validation('maxVersions')).hasText('You cannot go over 16 characters.');
-      await fillIn(FORM.inputByAttr('maxVersions'), '7');
+      assert.dom(GENERAL.validationErrorByAttr('max_versions')).hasText('You cannot go over 16 characters.');
+      await fillIn(FORM.inputByAttr('max_versions'), '7');
 
       // Fill in other metadata
-      await click(FORM.inputByAttr('casRequired'));
+      await click(FORM.inputByAttr('cas_required'));
       await click(FORM.toggleByLabel('Automate secret deletion'));
       await fillIn(FORM.ttlValue('Automate secret deletion'), '1000');
 
@@ -923,13 +992,14 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       await fillIn(`${PAGE.create.metadataSection} ${FORM.valueInput()}`, 'UI');
       // Fill in metadata
       await click(FORM.saveBtn);
-
-      // Details
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent('my/secret')}/details`,
-        'goes back to details page'
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent('my/secret')}`,
+        'goes to overview page'
       );
+
+      // Details
+      await click(PAGE.secretTab('Secret'));
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('version created not shown');
       assert.dom(PAGE.infoRow).doesNotExist('does not show data contents');
       assert
@@ -950,12 +1020,12 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
     });
     test('creates a secret at a sub-directory (sc)', async function (assert) {
       const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/list/app/`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list/app/`);
       assert.dom(PAGE.list.item()).doesNotExist('Does not list any secrets');
       await click(PAGE.list.createSecret);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/create?initialKey=app%2F`,
+        `/vault/secrets-engines/${backend}/kv/create?initialKey=app%2F`,
         'Goes to create page with initialKey'
       );
       await typeIn(FORM.inputByAttr('path'), 'new');
@@ -964,69 +1034,18 @@ module('Acceptance | kv-v2 workflow | secret and version create', function (hook
       await click(FORM.saveBtn);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent('app/new')}/details`,
-        'Redirects to detail after save'
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent('app/new')}`,
+        'Redirects to overview after save'
       );
-      await click(PAGE.breadcrumbAtIdx(2));
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list/app/`, 'sub-dir page');
-      assert.dom(PAGE.list.item()).doesNotExist('Does not list any secrets');
-    });
-    test('create new version of secret from older version (sc)', async function (assert) {
-      const backend = this.backend;
-      await visit(`/vault/secrets/${backend}/kv/app%2Ffirst/details?version=1`);
-      assert.dom(PAGE.detail.versionDropdown).doesNotExist('version dropdown does not show');
-      assert.dom(PAGE.detail.versionTimestamp).doesNotExist('Version created not shown');
-      await click(PAGE.detail.createNewVersion);
-      assert.strictEqual(
-        currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Ffirst/details/edit?version=1`,
-        'Goes to new version page'
-      );
-      assert
-        .dom(FORM.noReadAlert)
-        .hasText(
-          'Warning You do not have read permissions for this secret data. Saving will overwrite the existing secret.',
-          'shows alert for no read permissions'
-        );
-      assert.dom(FORM.keyInput()).hasValue('', 'Key input has empty value');
-      assert.dom(FORM.maskedValueInput()).hasValue('', 'Val input has empty value');
-
-      await fillIn(FORM.keyInput(), 'my-key');
-      await fillIn(FORM.maskedValueInput(), 'my-value');
-      await click(FORM.saveBtn);
-
+      await click(PAGE.secretTab('Secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Ffirst/details?version=3`,
-        'redirects to details page'
-      );
-      assert.dom(PAGE.infoRow).doesNotExist('does not show data contents');
-      assert
-        .dom(PAGE.emptyStateTitle)
-        .hasText('You do not have permission to read this secret', 'shows permissions empty state');
-    });
-  });
-
-  module('secret-nested-creator persona', function (hooks) {
-    hooks.beforeEach(async function () {
-      const token = await runCmd(
-        tokenWithPolicyCmd(
-          `secret-nested-creator-${this.backend}`,
-          personas.secretNestedCreator(this.backend)
-        )
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent('app/new')}/details`,
+        'navigates to details'
       );
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
-    });
-    test('can create a secret from the nested list view (snc)', async function (assert) {
-      assert.expect(1);
-      // go to nested secret directory list view
-      await visit(`/vault/secrets/${this.backend}/kv/list/app/`);
-      // correct popup menu items appear on list view
-      const popupSelector = `${PAGE.list.item('first')} ${PAGE.popup}`;
-      await click(popupSelector);
-      assert.dom(PAGE.list.listMenuCreate).exists('shows the option to create new version');
+      await click(PAGE.breadcrumbAtIdx(2));
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${backend}/kv/list/app/`, 'sub-dir page');
+      assert.dom(PAGE.list.item()).doesNotExist('Does not list any secrets');
     });
   });
 
@@ -1061,21 +1080,19 @@ path "${this.backend}/metadata/*" {
         backend: this.backend,
       });
       this.userToken = userToken;
-      await authPage.login(userToken);
-      clearRecords(this.store);
-      return;
+      return login(userToken);
     });
     test('create & update root secret with default metadata (cg)', async function (assert) {
       const backend = this.backend;
       // Known issue: control groups do not work correctly in UI when encodable characters in path
       const secretPath = 'some-secret';
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
 
       // Create secret form -- validations
       await click(FORM.saveBtn);
       assert.dom(FORM.invalidFormAlert).hasText('There is an error with this form.');
-      assert.dom(FORM.validation('path')).hasText("Path can't be blank.");
+      assert.dom(GENERAL.validationErrorByAttr('path')).hasText("Path can't be blank.");
       await typeIn(FORM.inputByAttr('path'), secretPath);
       assert.dom(PAGE.create.metadataSection).doesNotExist('Hides metadata section by default');
 
@@ -1103,7 +1120,7 @@ path "${this.backend}/metadata/*" {
         token: tokenToUnwrap.token,
         accessor: tokenToUnwrap.accessor,
         creation_path: `${backend}/data/${secretPath}`,
-        originUrl: `/vault/secrets/${backend}/kv/create`,
+        originUrl: `/vault/secrets-engines/${backend}/kv/create`,
         userToken: this.userToken,
         backend: this.backend,
       });
@@ -1114,12 +1131,13 @@ path "${this.backend}/metadata/*" {
       await fillIn(FORM.maskedValueInput(), 'this too, gonna use the wrapped data');
       await click(FORM.saveBtn);
       assert.strictEqual(this.controlGroup.tokenToUnwrap, null, 'clears tokenToUnwrap after successful save');
-      // Details page
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPath}/details?version=1`,
-        'Goes to details page after save'
+        `/vault/secrets-engines/${backend}/kv/${secretPath}`,
+        'Goes to overview page after save'
       );
+      // Details page
+      await click(PAGE.secretTab('Secret'));
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 1 created');
       assert.dom(PAGE.infoRow).exists({ count: 1 }, '1 row of data shows');
       assert.dom(PAGE.infoRowValue('api_key')).hasText('***********');
@@ -1171,7 +1189,7 @@ path "${this.backend}/metadata/*" {
         accessor: tokenToUnwrap.accessor,
         token: tokenToUnwrap.token,
         creation_path: `${backend}/data/${secretPath}`,
-        originUrl: `/vault/secrets/${backend}/kv/${secretPath}/details/edit`,
+        originUrl: `/vault/secrets-engines/${backend}/kv/${secretPath}/details/edit`,
         userToken: this.userToken,
         backend: this.backend,
       });
@@ -1185,11 +1203,11 @@ path "${this.backend}/metadata/*" {
         null,
         'clears tokenToUnwrap after successful update'
       );
-
       // Back to details page
+      await click(PAGE.secretTab('Secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${encodeURIComponent(secretPath)}/details?version=2`
+        `/vault/secrets-engines/${backend}/kv/${encodeURIComponent(secretPath)}/details?version=2`
       );
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 2 created');
       assert.dom(PAGE.infoRow).exists({ count: 2 }, '2 rows of data shows');
diff --git a/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-delete-test.js b/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-delete-test.js
index 6a5f5be9c98..aa41d055117 100644
--- a/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-delete-test.js
+++ b/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-delete-test.js
@@ -1,22 +1,20 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { v4 as uuidv4 } from 'uuid';
 import { setupApplicationTest } from 'vault/tests/helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { deleteEngineCmd, mountEngineCmd, runCmd, tokenWithPolicyCmd } from 'vault/tests/helpers/commands';
-import { personas } from 'vault/tests/helpers/policy-generator/kv';
-import {
-  clearRecords,
-  deleteLatestCmd,
-  setupControlGroup,
-  writeVersionedSecret,
-} from 'vault/tests/helpers/kv/kv-run-commands';
-import { click, currentURL, visit } from '@ember/test-helpers';
+import { personas } from 'vault/tests/helpers/kv/policy-generator';
+import { deleteLatestCmd, writeVersionedSecret } from 'vault/tests/helpers/kv/kv-run-commands';
+import { setupControlGroup } from 'vault/tests/helpers/control-groups';
+import { click, currentRouteName, currentURL, waitUntil, visit } from '@ember/test-helpers';
 import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
+import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const ALL_DELETE_ACTIONS = ['delete', 'destroy', 'undelete'];
 const assertDeleteActions = (assert, expected = ['delete', 'destroy']) => {
@@ -46,35 +44,36 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
     this.backend = `kv-delete-${uuidv4()}`;
     this.secretPath = 'bad-secret';
     this.nestedSecretPath = 'app/nested/bad-secret';
-    await authPage.login();
+    await login();
     await runCmd(mountEngineCmd('kv-v2', this.backend), false);
     await writeVersionedSecret(this.backend, this.secretPath, 'foo', 'bar', 4);
     await writeVersionedSecret(this.backend, this.nestedSecretPath, 'foo', 'bar', 1);
-    await writeVersionedSecret(this.backend, 'nuke', 'foo', 'bar', 2);
-    // Delete latest version for testing undelete for users that can't delete
-    await runCmd(deleteLatestCmd(this.backend, 'nuke'));
+    // Versioned secret for testing delete is created (and deleted) by each module to avoid race condition failures
     return;
   });
 
   hooks.afterEach(async function () {
-    await authPage.login();
+    await login();
     return runCmd(deleteEngineCmd(this.backend));
   });
 
   module('admin persona', function (hooks) {
     hooks.beforeEach(async function () {
+      // patch is an enterprise feature but stubbing the version so assertions that check
+      // patch actions exist before/after deletion can run on both CE and ent repos
+      this.version = this.owner.lookup('service:version').type = 'enterprise';
       const token = await runCmd(makeToken('admin', this.backend, personas.admin));
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('can delete and undelete the latest secret version (a)', async function (assert) {
-      assert.expect(17);
+      assert.expect(21);
+      const flashSuccess = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details`);
       // correct toolbar options & details show
       assertDeleteActions(assert);
-      assert.dom(PAGE.infoRow).exists('shows secret data');
+      assert.dom(PAGE.detail.patchLatest).exists();
+      assert.dom(PAGE.infoRow).exists('shows secret data on load');
       // delete flow
       await click(PAGE.detail.delete);
       assert.dom(PAGE.detail.deleteModalTitle).includesText('Delete version?', 'shows correct modal title');
@@ -82,28 +81,37 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
       assert.dom(PAGE.detail.deleteOptionLatest).isNotDisabled('delete latest option is selectable');
       await click(PAGE.detail.deleteOptionLatest);
       await click(PAGE.detail.deleteConfirm);
+      const expected = `Successfully deleted Version 4 of ${this.secretPath}.`;
+      const [actual] = flashSuccess.lastCall.args;
+      assert.strictEqual(actual, expected, 'renders correct flash message');
+
       // details update accordingly
+      await click(PAGE.secretTab('Secret'));
       assert
         .dom(PAGE.emptyStateTitle)
         .hasText('Version 4 of this secret has been deleted', 'Shows deleted message');
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 4 deleted');
       // updated toolbar options
       assertDeleteActions(assert, ['undelete', 'destroy']);
+      assert.dom(PAGE.detail.patchLatest).doesNotExist('patching a deleted secret is not allowed');
       // undelete flow
       await click(PAGE.detail.undelete);
       // details update accordingly
-      assert.dom(PAGE.infoRow).exists('shows secret data');
+      await click(PAGE.secretTab('Secret'));
+      assert.dom(PAGE.infoRow).exists('shows secret data after undeleting');
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 4 created');
       // correct toolbar options
       assertDeleteActions(assert, ['delete', 'destroy']);
+      assert.dom(PAGE.detail.patchLatest).exists('patch is allowed after undeleting');
     });
     test('can soft delete and undelete an older secret version (a)', async function (assert) {
-      assert.expect(17);
+      assert.expect(19);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details?version=2`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=2`);
       // correct toolbar options & details show
       assertDeleteActions(assert);
-      assert.dom(PAGE.infoRow).exists('shows secret data');
+      assert.dom(PAGE.detail.patchLatest).exists();
+      assert.dom(PAGE.infoRow).exists('shows secret data on load');
       // delete flow
       await click(PAGE.detail.delete);
       assert.dom(PAGE.detail.deleteModalTitle).includesText('Delete version?', 'shows correct modal title');
@@ -111,44 +119,58 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
       assert.dom(PAGE.detail.deleteOptionLatest).isNotDisabled('delete latest option is selectable');
       await click(PAGE.detail.deleteOption);
       await click(PAGE.detail.deleteConfirm);
-      // details update accordingly
+      // we get navigated back to the overview page, so manually go back to deleted version
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=2`);
       assert
         .dom(PAGE.emptyStateTitle)
         .hasText('Version 2 of this secret has been deleted', 'Shows deleted message');
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 2 deleted');
       // updated toolbar options
       assertDeleteActions(assert, ['undelete', 'destroy']);
+      assert
+        .dom(PAGE.detail.patchLatest)
+        .exists('patching the latest version is allowed after deleting an older version');
+
       // undelete flow
       await click(PAGE.detail.undelete);
       // details update accordingly
-      assert.dom(PAGE.infoRow).exists('shows secret data');
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=2`);
+      assert.dom(PAGE.infoRow).exists('shows secret data after undeleting');
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 2 created');
       // correct toolbar options
       assertDeleteActions(assert, ['delete', 'destroy']);
     });
     test('can destroy a secret version (a)', async function (assert) {
-      assert.expect(9);
+      assert.expect(12);
+      const flashSuccess = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details?version=3`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=3`);
       // correct toolbar options show
       assertDeleteActions(assert);
+      assert.dom(PAGE.detail.patchLatest).exists();
       // delete flow
       await click(PAGE.detail.destroy);
       assert.dom(PAGE.detail.deleteModalTitle).includesText('Destroy version?', 'modal has correct title');
       await click(PAGE.detail.deleteConfirm);
+      const expected = `Successfully destroyed Version 3 of ${this.secretPath}.`;
+      const [actual] = flashSuccess.lastCall.args;
+      assert.strictEqual(actual, expected, 'renders correct flash message');
       // details update accordingly
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=3`);
       assert
         .dom(PAGE.emptyStateTitle)
         .hasText('Version 3 of this secret has been permanently destroyed', 'Shows destroyed message');
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('does not show version timestamp');
       // updated toolbar options
       assertDeleteActions(assert, []);
+      assert
+        .dom(PAGE.detail.patchLatest)
+        .exists('patching the latest version is allowed after destroying an older version');
     });
+
     test('can permanently delete all secret versions (a)', async function (assert) {
-      // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/nuke/details`);
-      // Check metadata toolbar
-      await click(PAGE.secretTab('Metadata'));
+      await writeVersionedSecret(this.backend, 'nuke', 'foo', 'bar', 2);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/nuke/metadata`);
       assert.dom(PAGE.metadata.deleteMetadata).hasText('Permanently delete', 'shows delete metadata button');
       // delete flow
       await click(PAGE.metadata.deleteMetadata);
@@ -156,29 +178,32 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
         .dom(PAGE.detail.deleteModalTitle)
         .includesText('Delete metadata and secret data?', 'modal has correct title');
       await click(PAGE.detail.deleteConfirm);
-
+      await waitUntil(() => currentRouteName() === 'vault.cluster.secrets.backend.kv.list');
       // redirects to list
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.backend}/kv/list`, 'redirects to list');
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.backend}/kv/list`, 'redirects to list');
     });
   });
 
   module('data-reader persona', function (hooks) {
     hooks.beforeEach(async function () {
+      // create and delete a secret as root user
+      await login();
+      await writeVersionedSecret(this.backend, 'nuke', 'foo', 'bar', 2);
+      await runCmd(deleteLatestCmd(this.backend, 'nuke'));
+      // login as data-reader persona
       const token = await runCmd(makeToken('data-reader', this.backend, personas.dataReader));
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('cannot delete and undelete the latest secret version (dr)', async function (assert) {
       assert.expect(9);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details`);
       // correct toolbar options & details show
       assertDeleteActions(assert, []);
       assert.dom(PAGE.infoRow).exists('shows secret data');
 
       // data-reader can't delete, so check undelete with already-deleted version
-      await visit(`/vault/secrets/${this.backend}/kv/nuke/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/nuke/details`);
       assertDeleteActions(assert, []);
       assert
         .dom(PAGE.emptyStateTitle)
@@ -188,7 +213,7 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
     test('cannot soft delete and undelete an older secret version (dr)', async function (assert) {
       assert.expect(4);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details?version=2`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=2`);
       // correct toolbar options & details show
       assertDeleteActions(assert, []);
       assert.dom(PAGE.infoRow).exists('shows secret data');
@@ -196,13 +221,13 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
     test('cannot destroy a secret version (dr)', async function (assert) {
       assert.expect(3);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details?version=3`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=3`);
       // correct toolbar options show
       assertDeleteActions(assert, []);
     });
     test('cannot permanently delete all secret versions (dr)', async function (assert) {
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/nuke/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/nuke/details`);
       // Check metadata toolbar
       await click(PAGE.secretTab('Metadata'));
       assert.dom(PAGE.metadata.deleteMetadata).doesNotExist('does not show delete metadata button');
@@ -211,15 +236,18 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
 
   module('data-list-reader persona', function (hooks) {
     hooks.beforeEach(async function () {
+      // create and delete a secret as root user
+      await login();
+      await writeVersionedSecret(this.backend, 'nuke', 'foo', 'bar', 2);
+      await runCmd(deleteLatestCmd(this.backend, 'nuke'));
+      // login as data-list-reader persona
       const token = await runCmd(makeToken('data-list-reader', this.backend, personas.dataListReader));
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
-    test('can delete and undelete the latest secret version (dlr)', async function (assert) {
+    test('can delete and cannot undelete the latest secret version (dlr)', async function (assert) {
       assert.expect(12);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details`);
       // correct toolbar options & details show
       assertDeleteActions(assert, ['delete']);
       assert.dom(PAGE.infoRow).exists('shows secret data');
@@ -231,6 +259,7 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
       await click(PAGE.detail.deleteOptionLatest);
       await click(PAGE.detail.deleteConfirm);
       // details update accordingly
+      await click(PAGE.secretTab('Secret'));
       assert
         .dom(PAGE.emptyStateTitle)
         .hasText('Version 4 of this secret has been deleted', 'Shows deleted message');
@@ -242,7 +271,7 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
     test('can soft delete and undelete an older secret version (dlr)', async function (assert) {
       assert.expect(6);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details?version=2`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=2`);
       // correct toolbar options & details show
       assertDeleteActions(assert, ['delete']);
       assert.dom(PAGE.infoRow).exists('shows secret data');
@@ -254,13 +283,13 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
     test('cannot destroy a secret version (dlr)', async function (assert) {
       assert.expect(3);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details?version=3`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=3`);
       // correct toolbar options show
       assertDeleteActions(assert, ['delete']);
     });
-    test('cannot permanently delete all secret versions (dr)', async function (assert) {
+    test('cannot permanently delete all secret versions (dlr)', async function (assert) {
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/nuke/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/nuke/details`);
       // Check metadata toolbar
       await click(PAGE.secretTab('Metadata'));
       assert.dom(PAGE.metadata.deleteMetadata).doesNotExist('does not show delete metadata button');
@@ -269,15 +298,18 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
 
   module('metadata-maintainer persona', function (hooks) {
     hooks.beforeEach(async function () {
+      // create and delete a secret as root user
+      await login();
+      await writeVersionedSecret(this.backend, 'nuke', 'foo', 'bar', 2);
+      await runCmd(deleteLatestCmd(this.backend, 'nuke'));
+      // login as metadata-maintainer persona
       const token = await runCmd(makeToken('metadata-maintainer', this.backend, personas.metadataMaintainer));
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
-    test('can delete and undelete the latest secret version (mm)', async function (assert) {
-      assert.expect(17);
+    test('cannot delete but can undelete the latest secret version (mm)', async function (assert) {
+      assert.expect(18);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details`);
       // correct toolbar options & details show
       assertDeleteActions(assert);
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
@@ -288,14 +320,19 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
       assert.dom(PAGE.detail.deleteOptionLatest).isDisabled('delete latest option is disabled');
 
       // Can't delete latest, try with pre-deleted secret
-      await visit(`/vault/secrets/${this.backend}/kv/nuke/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/nuke/details`);
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('Version 2 timestamp not rendered');
       // updated toolbar options
       assertDeleteActions(assert, ['undelete', 'destroy']);
       // undelete flow
       await click(PAGE.detail.undelete);
+      await waitUntil(() => currentRouteName() === 'vault.cluster.secrets.backend.kv.secret.index');
+      assert
+        .dom(GENERAL.overviewCard.container('Current version'))
+        .hasText(`Current version The current version of this secret. 2`);
       // details update accordingly
+      await click(PAGE.secretTab('Secret'));
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('Version 2 timestamp not rendered');
       // correct toolbar options
@@ -304,7 +341,7 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
     test('can soft delete and undelete an older secret version (mm)', async function (assert) {
       assert.expect(18);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details?version=2`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=2`);
       // correct toolbar options & details show
       assertDeleteActions(assert);
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
@@ -317,6 +354,7 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
       await click(PAGE.detail.deleteOption);
       await click(PAGE.detail.deleteConfirm);
       // details update accordingly
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=2`);
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('Version 2 timestamp not rendered');
       // updated toolbar options
@@ -324,6 +362,7 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
       // undelete flow
       await click(PAGE.detail.undelete);
       // details update accordingly
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=2`);
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('Version 2 timestamp not rendered');
       // correct toolbar options
@@ -332,7 +371,7 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
     test('can destroy a secret version (mm)', async function (assert) {
       assert.expect(9);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details?version=3`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=3`);
       // correct toolbar options show
       assertDeleteActions(assert);
       // delete flow
@@ -340,6 +379,7 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
       assert.dom(PAGE.detail.deleteModalTitle).includesText('Destroy version?', 'modal has correct title');
       await click(PAGE.detail.deleteConfirm);
       // details update accordingly
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=3`);
       assert
         .dom(PAGE.emptyStateTitle)
         .hasText('You do not have permission to read this secret', 'Shows permissions message');
@@ -349,7 +389,7 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
     });
     test('cannot permanently delete all secret versions (mm)', async function (assert) {
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/nuke/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/nuke/details`);
       // Check metadata toolbar
       await click(PAGE.secretTab('Metadata'));
       assert.dom(PAGE.metadata.deleteMetadata).doesNotExist('does not show delete metadata button');
@@ -361,23 +401,21 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
       const token = await runCmd(
         makeToken('secret-nested-creator', this.backend, personas.secretNestedCreator)
       );
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('can delete all secret versions from the nested list view (snc)', async function (assert) {
       assert.expect(1);
       // go to nested secret directory list view
-      await visit(`/vault/secrets/${this.backend}/kv/list/app/nested`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/list/app/nested`);
       // correct popup menu items appear on list view
       const popupSelector = `${PAGE.list.item('bad-secret')} ${PAGE.popup}`;
       await click(popupSelector);
-      assert.dom(PAGE.list.listMenuDelete).exists('shows the option to permanently delete');
+      assert.dom(PAGE.list.menuItem('Permanently delete')).exists('shows the option to permanently delete');
     });
     test('can not delete all secret versions from root list view (snc)', async function (assert) {
       assert.expect(1);
       // go to root secret directory list view
-      await visit(`/vault/secrets/${this.backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/list`);
       // shows overview card and not list view
       assert.dom(PAGE.list.overviewCard).exists('renders overview card');
     });
@@ -386,20 +424,18 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
   module('secret-creator persona', function (hooks) {
     hooks.beforeEach(async function () {
       const token = await runCmd(makeToken('secret-creator', this.backend, personas.secretCreator));
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('cannot delete and undelete the latest secret version (sc)', async function (assert) {
       assert.expect(9);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details`);
       // correct toolbar options & details show
       assertDeleteActions(assert, []);
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
 
       // test with already deleted method
-      await visit(`/vault/secrets/${this.backend}/kv/nuke/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/nuke/details`);
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('version timestamp not rendered');
       // updated toolbar options
@@ -408,7 +444,7 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
     test('cannot soft delete and undelete an older secret version (sc)', async function (assert) {
       assert.expect(4);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details?version=2`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=2`);
       // correct toolbar options & details show
       assertDeleteActions(assert, []);
       assert.dom(PAGE.emptyStateTitle).hasText('You do not have permission to read this secret');
@@ -416,13 +452,14 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
     test('cannot destroy a secret version (sc)', async function (assert) {
       assert.expect(3);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/${this.secretPath}/details?version=3`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.secretPath}/details?version=3`);
       // correct toolbar options show
       assertDeleteActions(assert, []);
     });
     test('can permanently delete all secret versions (sc)', async function (assert) {
+      await writeVersionedSecret(this.backend, 'nuke', 'foo', 'bar', 2);
       // go to secret details
-      await visit(`/vault/secrets/${this.backend}/kv/nuke/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/nuke/details`);
       // Check metadata toolbar
       await click(PAGE.secretTab('Metadata'));
       assert.dom(PAGE.metadata.deleteMetadata).hasText('Permanently delete', 'shows delete metadata button');
@@ -432,9 +469,9 @@ module('Acceptance | kv-v2 workflow | delete, undelete, destroy', function (hook
         .dom(PAGE.detail.deleteModalTitle)
         .includesText('Delete metadata and secret data?', 'modal has correct title');
       await click(PAGE.detail.deleteConfirm);
-
+      await waitUntil(() => currentRouteName() === 'vault.cluster.secrets.backend.kv.list');
       // redirects to list
-      assert.strictEqual(currentURL(), `/vault/secrets/${this.backend}/kv/list`, 'redirects to list');
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${this.backend}/kv/list`, 'redirects to list');
     });
   });
 
@@ -471,9 +508,7 @@ path "sys/control-group/request" {
 
       const { userToken } = await setupControlGroup({ userPolicy, backend: this.backend });
       this.userToken = userToken;
-      await authPage.login(userToken);
-      clearRecords(this.store);
-      return;
+      return login(userToken);
     });
     // Copy test outline from admin persona
   });
diff --git a/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-edge-cases-test.js b/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-edge-cases-test.js
index bf94b801883..2edc977a514 100644
--- a/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-edge-cases-test.js
+++ b/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-edge-cases-test.js
@@ -1,19 +1,29 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
-
+/* eslint-disable no-useless-escape */
 import { module, test } from 'qunit';
 import { v4 as uuidv4 } from 'uuid';
-import { click, currentURL, fillIn, findAll, setupOnerror, typeIn, visit } from '@ember/test-helpers';
+import {
+  click,
+  currentURL,
+  fillIn,
+  findAll,
+  setupOnerror,
+  typeIn,
+  visit,
+  waitFor,
+} from '@ember/test-helpers';
 import { setupApplicationTest } from 'vault/tests/helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login, loginNs } from 'vault/tests/helpers/auth/auth-helpers';
 import {
   createPolicyCmd,
   deleteEngineCmd,
   mountEngineCmd,
   runCmd,
   createTokenCmd,
+  deleteNS,
 } from 'vault/tests/helpers/commands';
 import {
   dataPolicy,
@@ -21,23 +31,28 @@ import {
   destroyVersionsPolicy,
   metadataListPolicy,
   metadataPolicy,
-} from 'vault/tests/helpers/policy-generator/kv';
-import { clearRecords, writeSecret, writeVersionedSecret } from 'vault/tests/helpers/kv/kv-run-commands';
+} from 'vault/tests/helpers/kv/policy-generator';
+import { writeSecret, writeVersionedSecret } from 'vault/tests/helpers/kv/kv-run-commands';
 import { FORM, PAGE } from 'vault/tests/helpers/kv/kv-selectors';
-import codemirror from 'vault/tests/helpers/codemirror';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import codemirror, { getCodeEditorValue, setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+import { personas } from 'vault/tests/helpers/kv/policy-generator';
+import { capabilitiesStub } from 'vault/tests/helpers/stubs';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 /**
  * This test set is for testing edge cases, such as specific bug fixes or reported user workflows
  */
 module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
   setupApplicationTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(async function () {
     const uid = uuidv4();
     this.backend = `kv-edge-${uid}`;
     this.rootSecret = 'root-directory';
     this.fullSecretPath = `${this.rootSecret}/nested/child-secret`;
-    await authPage.login();
+    await login();
     await runCmd(mountEngineCmd('kv-v2', this.backend), false);
     await writeSecret(this.backend, this.fullSecretPath, 'foo', 'bar');
     await writeSecret(this.backend, 'edge/one', 'foo', 'bar');
@@ -46,7 +61,7 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
   });
 
   hooks.afterEach(async function () {
-    await authPage.login();
+    await login();
     await runCmd(deleteEngineCmd(this.backend));
     return;
   });
@@ -65,32 +80,36 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
         ),
         createTokenCmd(`nested-secret-list-reader-${this.backend}`),
       ]);
-      await authPage.login(token);
+      await login(token);
     });
 
     test('it can navigate to secrets within a secret directory', async function (assert) {
-      assert.expect(21);
+      assert.expect(23);
       const backend = this.backend;
       const [root, subdirectory, secret] = this.fullSecretPath.split('/');
 
-      await visit(`/vault/secrets/${backend}/kv/list`);
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list`, 'lands on secrets list page');
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list`,
+        'lands on secrets list page'
+      );
 
       await typeIn(PAGE.list.overviewInput, `${root}/no-access/`);
       assert
-        .dom(PAGE.list.overviewButton)
+        .dom(GENERAL.submitButton)
         .hasText('View list', 'shows list and not secret because search is a directory');
-      await click(PAGE.list.overviewButton);
-      assert.dom(PAGE.emptyStateTitle).hasText(`There are no secrets matching "${root}/no-access/".`);
+      await click(GENERAL.submitButton);
+      assert.dom(GENERAL.emptyStateTitle).hasText(`There are no secrets matching "${root}/no-access/".`);
 
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await typeIn(PAGE.list.overviewInput, `${root}/`); // add slash because this is a directory
-      await click(PAGE.list.overviewButton);
+      await click(GENERAL.submitButton);
 
       // URL correct
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/list/${root}/`,
+        `/vault/secrets-engines/${backend}/kv/list/${root}/`,
         'visits list-directory of root'
       );
 
@@ -105,11 +124,15 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
       assert.dom(PAGE.toolbarAction).exists({ count: 1 }, 'toolbar only renders create secret action');
       assert.dom(PAGE.list.filter).hasValue(`${root}/`);
       // List content correct
-      assert.dom(PAGE.list.item(`${subdirectory}/`)).exists('renders linked block for subdirectory');
-      await click(PAGE.list.item(`${subdirectory}/`));
-      assert.dom(PAGE.list.item(secret)).exists('renders linked block for child secret');
-      await click(PAGE.list.item(secret));
+      assert.dom(GENERAL.listItem(`${subdirectory}/`)).exists('renders linked block for subdirectory');
+      await click(GENERAL.listItem(`${subdirectory}/`));
+      assert.dom(GENERAL.listItem(secret)).exists('renders linked block for child secret');
+      await click(GENERAL.listItem(secret));
+      assert
+        .dom(GENERAL.overviewCard.container('Current version'))
+        .hasText(`Current version The current version of this secret. 1`);
       // Secret details visible
+      await click(PAGE.secretTab('Secret'));
       assert.dom(PAGE.title).hasText(this.fullSecretPath);
       assert.dom(PAGE.secretTab('Secret')).hasText('Secret');
       assert.dom(PAGE.secretTab('Secret')).hasClass('active');
@@ -117,7 +140,8 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
       assert.dom(PAGE.secretTab('Metadata')).doesNotHaveClass('active');
       assert.dom(PAGE.secretTab('Version History')).hasText('Version History');
       assert.dom(PAGE.secretTab('Version History')).doesNotHaveClass('active');
-      assert.dom(PAGE.toolbarAction).exists({ count: 4 }, 'toolbar renders all actions');
+      assert.dom(PAGE.detail.copy).exists();
+      assert.dom(PAGE.detail.versionDropdown).exists();
     });
 
     test('it navigates back to engine index route via breadcrumbs from secret details', async function (assert) {
@@ -125,34 +149,36 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
       const backend = this.backend;
       const [root, subdirectory, secret] = this.fullSecretPath.split('/');
 
-      await visit(`vault/secrets/${backend}/kv/${encodeURIComponent(this.fullSecretPath)}/details?version=1`);
+      await visit(
+        `vault/secrets-engines/${backend}/kv/${encodeURIComponent(this.fullSecretPath)}/details?version=1`
+      );
       // navigate back through crumbs
-      let previousCrumb = findAll('[data-test-breadcrumbs] li').length - 2;
-      await click(PAGE.breadcrumbAtIdx(previousCrumb));
+      let previousCrumb = findAll(GENERAL.breadcrumb).length - 2;
+      await click(GENERAL.breadcrumbAtIdx(previousCrumb));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/list/${root}/${subdirectory}/`,
+        `/vault/secrets-engines/${backend}/kv/list/${root}/${subdirectory}/`,
         'goes back to subdirectory list'
       );
       assert.dom(PAGE.list.filter).hasValue(`${root}/${subdirectory}/`);
-      assert.dom(PAGE.list.item(secret)).exists('renders linked block for child secret');
+      assert.dom(GENERAL.listItem(secret)).exists('renders linked block for child secret');
 
       // back again
-      previousCrumb = findAll('[data-test-breadcrumbs] li').length - 2;
-      await click(PAGE.breadcrumbAtIdx(previousCrumb));
+      previousCrumb = findAll(GENERAL.breadcrumb).length - 2;
+      await click(GENERAL.breadcrumbAtIdx(previousCrumb));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/list/${root}/`,
+        `/vault/secrets-engines/${backend}/kv/list/${root}/`,
         'goes back to root directory'
       );
-      assert.dom(PAGE.list.item(`${subdirectory}/`)).exists('renders linked block for subdirectory');
+      assert.dom(GENERAL.listItem(`${subdirectory}/`)).exists('renders linked block for subdirectory');
 
       // and back to the engine list view
-      previousCrumb = findAll('[data-test-breadcrumbs] li').length - 2;
-      await click(PAGE.breadcrumbAtIdx(previousCrumb));
+      previousCrumb = findAll(GENERAL.breadcrumb).length - 2;
+      await click(GENERAL.breadcrumbAtIdx(previousCrumb));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/list`,
+        `/vault/secrets-engines/${backend}/kv/list`,
         'navigates back to engine list from crumbs'
       );
     });
@@ -161,21 +187,45 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
       assert.expect(7);
       const backend = this.backend;
       const [root, subdirectory] = this.fullSecretPath.split('/');
-      setupOnerror((error) => assert.strictEqual(error.httpStatus, 404), '404 error is thrown'); // catches error so qunit test doesn't fail
+      setupOnerror((error) => assert.strictEqual(error.response.status, 404), '404 error is thrown'); // catches error so qunit test doesn't fail
 
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await typeIn(PAGE.list.overviewInput, `${root}/${subdirectory}`); // intentionally leave out trailing slash
-      await click(PAGE.list.overviewButton);
+      await click(GENERAL.submitButton);
       assert.dom(PAGE.error.title).hasText('404 Not Found');
       assert
         .dom(PAGE.error.message)
-        .hasText(`Sorry, we were unable to find any content at /v1/${backend}/data/${root}/${subdirectory}.`);
+        .hasText(
+          `Sorry, we were unable to find any content at /v1/${backend}/metadata/${root}/${subdirectory}.`
+        );
 
-      assert.dom(PAGE.breadcrumbAtIdx(0)).hasText('secrets');
-      assert.dom(PAGE.breadcrumbAtIdx(1)).hasText(backend);
+      assert.dom(GENERAL.breadcrumbAtIdx(0)).hasText('Secrets');
+      assert.dom(GENERAL.breadcrumbAtIdx(1)).hasText(backend);
       assert.dom(PAGE.secretTab('Secrets')).doesNotHaveClass('is-active');
       assert.dom(PAGE.secretTab('Configuration')).doesNotHaveClass('is-active');
     });
+
+    // it's rare for a policy check to fail, but if it does we default to "true" and let the API handle gating.
+    // there was an issue with the new capabilities service incorrectly mapping permissions for secrets with underscores which surfaced this bug.
+    // The user logged in here does NOT have access to the subkeys endpoint, but we're stubbing capabilities to return true
+    // to simulate the capabilities map failing and returning a false positive.
+    test('it navigates to secret if policy check fails for the subkeys endpoint', async function (assert) {
+      assert.expect(2);
+      this.server.post(
+        '/sys/capabilities-self',
+        capabilitiesStub(`${this.backend}/subkeys/my_secret`, ['read'])
+      );
+
+      await visit(`/vault/secrets-engines/${this.backend}/kv/list`);
+      await typeIn(PAGE.list.overviewInput, 'my_secret');
+      await click(GENERAL.submitButton);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.backend}/kv/my_secret`,
+        'it navigates to secret overview'
+      );
+      assert.dom(GENERAL.overviewCard.container('Paths')).exists();
+    });
   });
 
   module('destruction without read', function (hooks) {
@@ -203,13 +253,13 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
       for (const secret of testSecrets) {
         await writeVersionedSecret(backend, secret, 'foo', 'bar', 2);
       }
-      await authPage.login(token);
+      await login(token);
     });
 
     test('it renders the delete action and disables delete this version option', async function (assert) {
       assert.expect(4);
       const testSecret = 'data-delete-only';
-      await visit(`/vault/secrets/${this.backend}/kv/${testSecret}/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${testSecret}/details`);
 
       assert.dom(PAGE.detail.delete).exists('renders delete button');
       await click(PAGE.detail.delete);
@@ -223,7 +273,7 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
     test('it renders the delete action and disables delete latest version option', async function (assert) {
       assert.expect(4);
       const testSecret = 'delete-version-only';
-      await visit(`/vault/secrets/${this.backend}/kv/${testSecret}/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${testSecret}/details`);
 
       assert.dom(PAGE.detail.delete).exists('renders delete button');
       await click(PAGE.detail.delete);
@@ -238,7 +288,7 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
     test('it hides destroy option without version number', async function (assert) {
       assert.expect(1);
       const testSecret = 'destroy-version-only';
-      await visit(`/vault/secrets/${this.backend}/kv/${testSecret}/details`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${testSecret}/details`);
 
       assert.dom(PAGE.detail.destroy).doesNotExist();
     });
@@ -247,7 +297,7 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
       assert.expect(2);
 
       const testSecret = 'destroy-metadata-only';
-      await visit(`/vault/secrets/${this.backend}/kv/${testSecret}/metadata`);
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${testSecret}/metadata`);
       assert.dom(PAGE.metadata.deleteMetadata).exists('renders delete metadata button');
       await click(PAGE.metadata.deleteMetadata);
       assert
@@ -259,96 +309,204 @@ module('Acceptance | kv-v2 workflow | edge cases', function (hooks) {
   });
 
   test('no ghost item after editing metadata', async function (assert) {
-    await visit(`/vault/secrets/${this.backend}/kv/list/edge/`);
+    await visit(`/vault/secrets-engines/${this.backend}/kv/list/edge/`);
     assert.dom(PAGE.list.item()).exists({ count: 2 }, 'two secrets are listed');
-    await click(PAGE.list.item('two'));
+    await click(GENERAL.listItem('two'));
     await click(PAGE.secretTab('Metadata'));
     await click(PAGE.metadata.editBtn);
     await fillIn(FORM.keyInput(), 'foo');
     await fillIn(FORM.valueInput(), 'bar');
     await click(FORM.saveBtn);
-    await click(PAGE.breadcrumbAtIdx(2));
+    await click(GENERAL.breadcrumbAtIdx(2));
     assert.dom(PAGE.list.item()).exists({ count: 2 }, 'two secrets are listed');
   });
 
   test('advanced secret values default to JSON display', async function (assert) {
-    const obscuredData = `{
-  "foo3": {
-    "name": "********"
-  }
-}`;
-    await visit(`/vault/secrets/${this.backend}/kv/create`);
+    await visit(`/vault/secrets-engines/${this.backend}/kv/create`);
     await fillIn(FORM.inputByAttr('path'), 'complex');
 
-    await click(FORM.toggleJson);
-    assert.strictEqual(codemirror().getValue(), '{ "": "" }');
-    codemirror().setValue('{ "foo3": { "name": "bar3" } }');
-    await click(FORM.saveBtn);
+    await click(GENERAL.toggleInput('json'));
+
+    await waitFor('.cm-editor');
+    const view = codemirror();
 
-    // Details view
-    assert.dom(FORM.toggleJson).isNotDisabled();
-    assert.dom(FORM.toggleJson).isChecked();
     assert.strictEqual(
-      codemirror().getValue(),
-      obscuredData,
-      'Value is obscured by default on details view when advanced'
+      getCodeEditorValue(view),
+      `{
+  \"\": \"\"
+}`,
+      'JSON editor displays correct empty object'
     );
-    await click('[data-test-toggle-input="revealValues"]');
-    assert.false(codemirror().getValue().includes('*'), 'Value unobscured after toggle');
+    setCodeEditorValue(view, '{ "foo3": { "name": "bar3" } }');
+    await click(FORM.saveBtn);
+
+    // Details view
+    await click(PAGE.secretTab('Secret'));
+    assert.dom(GENERAL.toggleInput('json')).isNotDisabled('JSON toggle is not disabled');
+    assert.dom(GENERAL.toggleInput('json')).isChecked("JSON toggle is checked 'on'");
+
+    assert
+      .dom(GENERAL.codeBlock('secret-data'))
+      .hasText('Version data { "foo3": { "name": "bar3" } }', 'Values are displayed in the details view');
 
     // New version view
     await click(PAGE.detail.createNewVersion);
-    assert.dom(FORM.toggleJson).isNotDisabled();
-    assert.dom(FORM.toggleJson).isChecked();
-    assert.false(codemirror().getValue().includes('*'), 'Values are not obscured on edit view');
+    assert.dom(GENERAL.toggleInput('json')).isNotDisabled();
+    assert.dom(GENERAL.toggleInput('json')).isChecked();
+    assert.deepEqual(
+      getCodeEditorValue(view),
+      '{ "foo3": { "name": "bar3" } }',
+      'Values are displayed in the new version view'
+    );
   });
 
   test('viewing advanced secret data versions displays the correct version data', async function (assert) {
     assert.expect(2);
-    const obscuredDataV1 = `{
+    const expectedDataV1 = `{
   "foo1": {
-    "name": "********"
+    "name": "bar1"
   }
 }`;
-    const obscuredDataV2 = `{
+    const expectedDataV2 = `{
   "foo2": {
-    "name": "********"
+    "name": "bar2"
   }
 }`;
 
-    await visit(`/vault/secrets/${this.backend}/kv/create`);
+    let view;
+
+    await visit(`/vault/secrets-engines/${this.backend}/kv/create`);
     await fillIn(FORM.inputByAttr('path'), 'complex_version_test');
 
-    await click(FORM.toggleJson);
-    codemirror().setValue('{ "foo1": { "name": "bar1" } }');
+    await click(GENERAL.toggleInput('json'));
+    await waitFor('.cm-editor');
+    view = codemirror();
+    setCodeEditorValue(view, '{ "foo1": { "name": "bar1" } }');
     await click(FORM.saveBtn);
 
     // Create another version
-    await click(PAGE.detail.createNewVersion);
-    codemirror().setValue('{ "foo2": { "name": "bar2" } }');
+    await click(GENERAL.overviewCard.actionText('Create new'));
+    await waitFor('.cm-editor');
+    view = codemirror();
+    setCodeEditorValue(view, '{ "foo2": { "name": "bar2" } }');
     await click(FORM.saveBtn);
 
     // View the first version and make sure the secret data is correct
+    await click(PAGE.secretTab('Secret'));
     await click(PAGE.detail.versionDropdown);
     await click(`${PAGE.detail.version(1)} a`);
-    assert.strictEqual(codemirror().getValue(), obscuredDataV1, 'Version one data is displayed');
+    assert
+      .dom(GENERAL.codeBlock('secret-data'))
+      .hasText(`Version data ${expectedDataV1}`, 'Version one data is displayed');
 
     // Navigate back the second version and make sure the secret data is correct
     await click(PAGE.detail.versionDropdown);
     await click(`${PAGE.detail.version(2)} a`);
-    assert.strictEqual(codemirror().getValue(), obscuredDataV2, 'Version two data is displayed');
+    assert
+      .dom(GENERAL.codeBlock('secret-data'))
+      .hasText(`Version data ${expectedDataV2}`, 'Version two data is displayed');
   });
 
   test('does not register as advanced when value includes {', async function (assert) {
-    await visit(`/vault/secrets/${this.backend}/kv/create`);
+    await visit(`/vault/secrets-engines/${this.backend}/kv/create`);
     await fillIn(FORM.inputByAttr('path'), 'not-advanced');
 
     await fillIn(FORM.keyInput(), 'foo');
     await fillIn(FORM.maskedValueInput(), '{bar}');
     await click(FORM.saveBtn);
-    await click(PAGE.detail.createNewVersion);
-    assert.dom(FORM.toggleJson).isNotDisabled();
-    assert.dom(FORM.toggleJson).isNotChecked();
+    await click(GENERAL.overviewCard.actionText('Create new'));
+    assert.dom(GENERAL.toggleInput('json')).isNotDisabled();
+    assert.dom(GENERAL.toggleInput('json')).isNotChecked();
+  });
+
+  // patch is technically enterprise only but stubbing the version so these tests run on both CE and enterprise
+  module('patch-persona', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.patchSecret = 'patch-secret';
+      this.owner.lookup('service:version').type = 'enterprise';
+      this.store = this.owner.lookup('service:store');
+      await writeSecret(this.backend, this.patchSecret, 'foo', 'bar');
+      await writeSecret(this.backend, 'my-destroyed-secret', 'foo', 'bar');
+      const token = await runCmd([
+        createPolicyCmd(
+          `secret-patcher-${this.backend}`,
+          personas.secretPatcher(this.backend) + personas.secretPatcher(this.emptyBackend)
+        ),
+        createTokenCmd(`secret-patcher-${this.backend}`),
+      ]);
+      return login(token);
+    });
+
+    test('it patches a secret from the overview page', async function (assert) {
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.patchSecret}`);
+      assert.dom(GENERAL.overviewCard.content('Subkeys')).hasText('Keys foo');
+
+      await click(GENERAL.overviewCard.actionText('Patch secret'));
+      await click(FORM.patchEdit(0));
+      await fillIn(FORM.valueInput(0), 'newvalue');
+      await fillIn(FORM.keyInput('new'), 'newkey');
+      await fillIn(FORM.valueInput('new'), 'newvalue');
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.overviewCard.content('Subkeys')).hasText('Keys foo newkey');
+    });
+
+    test('it patches a secret from the secret details', async function (assert) {
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.patchSecret}`);
+      assert.dom(GENERAL.overviewCard.content('Subkeys')).hasText('Keys foo');
+      await click(PAGE.secretTab('Secret'));
+      await click(PAGE.detail.patchLatest);
+      await click(FORM.patchEdit(0));
+      await fillIn(FORM.valueInput(0), 'newvalue');
+      await fillIn(FORM.keyInput('new'), 'newkey');
+      await fillIn(FORM.valueInput('new'), 'newvalue');
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.overviewCard.content('Subkeys')).hasText('Keys foo newkey');
+    });
+
+    // testing both adding and deleting a key here because the writeSecret helper only creates a single key/value pair
+    test('it adds and deletes a key', async function (assert) {
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${this.patchSecret}`);
+      // add a new key
+      assert.dom(GENERAL.overviewCard.content('Subkeys')).hasText('Keys foo');
+      await click(GENERAL.overviewCard.actionText('Patch secret'));
+      await fillIn(FORM.keyInput('new'), 'newkey');
+      await fillIn(FORM.valueInput('new'), 'newvalue');
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.overviewCard.content('Subkeys')).hasText('Keys foo newkey');
+
+      // deletes a key
+      await click(GENERAL.overviewCard.actionText('Patch secret'));
+      await click(FORM.patchDelete());
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.overviewCard.content('Subkeys')).hasText('Keys newkey');
+    });
+
+    test('patching a destroyed secret is not allowed', async function (assert) {
+      assert.expect(5);
+      const secret = 'my-destroyed-secret';
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${secret}`);
+      assert.dom(GENERAL.overviewCard.actionText('Patch secret')).exists();
+      await click(PAGE.secretTab('Secret'));
+      assert.dom(PAGE.detail.patchLatest).exists();
+      await click(PAGE.detail.destroy);
+      await click(PAGE.detail.deleteConfirm);
+      // check overview
+      assert
+        .dom(GENERAL.overviewCard.actionText('Patch secret'))
+        .doesNotExist('overview patch action is hidden for destroyed versions');
+      await click(PAGE.secretTab('Secret'));
+      // check secret tab
+      assert
+        .dom(PAGE.detail.patchLatest)
+        .doesNotExist('toolbar patch action is hidden for destroyed versions');
+      // check navigating directly
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${secret}/patch`);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.backend}/kv/${secret}`,
+        'destroyed secrets redirect'
+      );
+    });
   });
 });
 
@@ -357,8 +515,8 @@ module('Acceptance | Enterprise | kv-v2 workflow | edge cases', function (hooks)
   setupApplicationTest(hooks);
 
   const navToEngine = async (backend) => {
-    await click('[data-test-sidebar-nav-link="Secrets Engines"]');
-    return await click(PAGE.backends.link(backend));
+    await click(GENERAL.navLink('Secrets Engines'));
+    return await click(`${GENERAL.tableData(`${backend}/`, 'path')} a`);
   };
 
   const assertDeleteActions = (assert, expected = ['delete', 'destroy']) => {
@@ -379,7 +537,7 @@ module('Acceptance | Enterprise | kv-v2 workflow | edge cases', function (hooks)
     });
     // also asserts destroyed icon
     deleted.forEach((num) => {
-      assert.dom(`${PAGE.detail.version(num)} [data-test-icon="x-square"]`);
+      assert.dom(`${PAGE.detail.version(num)} ${GENERAL.icon('x-square')}`);
     });
   };
 
@@ -389,42 +547,40 @@ module('Acceptance | Enterprise | kv-v2 workflow | edge cases', function (hooks)
     this.store = this.owner.lookup('service:store');
     this.backend = `kv-enterprise-edge-${uid}`;
     this.namespace = `ns-${uid}`;
-    await authPage.login();
+    await login();
     await runCmd([`write sys/namespaces/${this.namespace} -force`]);
     return;
   });
 
   hooks.afterEach(async function () {
-    await authPage.login();
-    await runCmd([`delete /sys/auth/${this.namespace}`]);
+    await login();
+    await runCmd(deleteNS(this.namespace));
     await runCmd(deleteEngineCmd(this.backend));
     return;
   });
 
   module('admin persona', function (hooks) {
     hooks.beforeEach(async function () {
-      await authPage.loginNs(this.namespace);
+      await loginNs(this.namespace);
       // mount engine within namespace
-      await runCmd(mountEngineCmd('kv-v2', this.backend), false);
-      clearRecords(this.store);
-      return;
+      return runCmd(mountEngineCmd('kv-v2', this.backend), false);
     });
     hooks.afterEach(async function () {
       // visit logout with namespace query param because we're transitioning from within an engine
       // and navigating directly to /vault/auth caused test context routing problems :(
       await visit(`/vault/logout?namespace=${this.namespace}`);
-      await authPage.namespaceInput(''); // clear login form namespace input
+      await fillIn(GENERAL.inputByAttr('namespace'), ''); // clear login form namespace input
     });
 
     test('namespace: it can create a secret and new secret version', async function (assert) {
-      assert.expect(15);
+      assert.expect(16);
       const backend = this.backend;
       const ns = this.namespace;
       const secret = 'my-create-secret';
       await navToEngine(backend);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/list?namespace=${ns}`,
+        `/vault/secrets-engines/${backend}/kv/list?namespace=${ns}`,
         'navigates to list'
       );
       // Create first version of secret
@@ -434,14 +590,12 @@ module('Acceptance | Enterprise | kv-v2 workflow | edge cases', function (hooks)
       await fillIn(FORM.keyInput(), 'foo');
       await fillIn(FORM.maskedValueInput(), 'woahsecret');
       await click(FORM.saveBtn);
-      assert.strictEqual(
-        currentURL(),
-        `/vault/secrets/${backend}/kv/${secret}/details?namespace=${ns}&version=1`,
-        'navigates to details'
-      );
+      assert
+        .dom(GENERAL.overviewCard.container('Current version'))
+        .hasText(`Current version Create new The current version of this secret. 1`);
 
       // Create a new version
-      await click(PAGE.detail.createNewVersion);
+      await click(GENERAL.overviewCard.actionText('Create new'));
       assert.dom(FORM.inputByAttr('path')).isDisabled('path input is disabled');
       assert.dom(FORM.inputByAttr('path')).hasValue(secret);
       assert.dom(FORM.toggleMetadata).doesNotExist('Does not show metadata toggle when creating new version');
@@ -450,16 +604,20 @@ module('Acceptance | Enterprise | kv-v2 workflow | edge cases', function (hooks)
       await fillIn(FORM.keyInput(1), 'foo-two');
       await fillIn(FORM.maskedValueInput(1), 'supersecret');
       await click(FORM.saveBtn);
+      assert
+        .dom(GENERAL.overviewCard.container('Current version'))
+        .hasText(`Current version Create new The current version of this secret. 2`);
 
       // Check details
+      await click(PAGE.secretTab('Secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secret}/details?namespace=${ns}&version=2`,
+        `/vault/secrets-engines/${backend}/kv/${secret}/details?namespace=${ns}&version=2`,
         'navigates to details'
       );
       await assertVersionDropdown(assert);
       assert
-        .dom(`${PAGE.detail.version(2)} [data-test-icon="check-circle"]`)
+        .dom(`${PAGE.detail.version(2)} ${GENERAL.icon('check-circle')}`)
         .exists('renders current version icon');
       assert.dom(PAGE.infoRowValue('foo-two')).hasText('***********');
       await click(PAGE.infoRowToggleMasked('foo-two'));
@@ -467,7 +625,7 @@ module('Acceptance | Enterprise | kv-v2 workflow | edge cases', function (hooks)
     });
 
     test('namespace: it manages state throughout delete, destroy and undelete operations', async function (assert) {
-      assert.expect(34);
+      assert.expect(36);
       const backend = this.backend;
       const ns = this.namespace;
       const secret = 'my-delete-secret';
@@ -477,21 +635,29 @@ module('Acceptance | Enterprise | kv-v2 workflow | edge cases', function (hooks)
       await click(PAGE.list.item(secret));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secret}/details?namespace=${ns}&version=2`,
-        'navigates to details'
+        `/vault/secrets-engines/${backend}/kv/${secret}?namespace=${ns}`,
+        'navigates to overview'
       );
 
       // correct toolbar options & details show
+      await click(PAGE.secretTab('Secret'));
       assertDeleteActions(assert);
       await assertVersionDropdown(assert);
       // delete flow
       await click(PAGE.detail.delete);
       await click(PAGE.detail.deleteOption);
       await click(PAGE.detail.deleteConfirm);
+      assert
+        .dom(GENERAL.overviewCard.container('Current version'))
+        .hasTextContaining(
+          'Current version Deleted Create new The current version of this secret was deleted'
+        );
+
+      await click(PAGE.secretTab('Secret'));
       // check empty state and toolbar
       assertDeleteActions(assert, ['undelete', 'destroy']);
       assert
-        .dom(PAGE.emptyStateTitle)
+        .dom(GENERAL.emptyStateTitle)
         .hasText('Version 2 of this secret has been deleted', 'Shows deleted message');
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 2 deleted');
       await assertVersionDropdown(assert, [2]); // important to test dropdown versions are accurate
@@ -503,12 +669,16 @@ module('Acceptance | Enterprise | kv-v2 workflow | edge cases', function (hooks)
       // back to secret tab to confirm deleted state
       await click(PAGE.secretTab('Secret'));
       // if this assertion fails, the view is rendering a stale model
-      assert.dom(PAGE.emptyStateTitle).exists('still renders empty state!!');
+      assert.dom(GENERAL.emptyStateTitle).exists('still renders empty state!!');
       await assertVersionDropdown(assert, [2]);
 
       // undelete flow
       await click(PAGE.detail.undelete);
+      assert
+        .dom(GENERAL.overviewCard.container('Current version'))
+        .hasTextContaining('Current version Create new The current version of this secret.');
       // details update accordingly
+      await click(PAGE.secretTab('Secret'));
       assertDeleteActions(assert, ['delete', 'destroy']);
       assert.dom(PAGE.infoRow).exists('shows secret data');
       assert.dom(PAGE.detail.versionTimestamp).includesText('Version 2 created');
@@ -516,9 +686,10 @@ module('Acceptance | Enterprise | kv-v2 workflow | edge cases', function (hooks)
       // destroy flow
       await click(PAGE.detail.destroy);
       await click(PAGE.detail.deleteConfirm);
+      await click(PAGE.secretTab('Secret'));
       assertDeleteActions(assert, []);
       assert
-        .dom(PAGE.emptyStateTitle)
+        .dom(GENERAL.emptyStateTitle)
         .hasText('Version 2 of this secret has been permanently destroyed', 'Shows destroyed message');
 
       // navigate to sibling route to make sure empty state remains for details tab
@@ -528,7 +699,7 @@ module('Acceptance | Enterprise | kv-v2 workflow | edge cases', function (hooks)
       // back to secret tab to confirm destroyed state
       await click(PAGE.secretTab('Secret'));
       // if this assertion fails, the view is rendering a stale model
-      assert.dom(PAGE.emptyStateTitle).exists('still renders empty state!!');
+      assert.dom(GENERAL.emptyStateTitle).exists('still renders empty state!!');
       await assertVersionDropdown(assert, [2]);
     });
   });
diff --git a/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-navigation-test.js b/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-navigation-test.js
index 015683faeca..000c78ff7ac 100644
--- a/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-navigation-test.js
+++ b/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-navigation-test.js
@@ -1,13 +1,23 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { v4 as uuidv4 } from 'uuid';
-import { click, currentRouteName, currentURL, typeIn, visit, waitUntil } from '@ember/test-helpers';
+import {
+  click,
+  currentRouteName,
+  currentURL,
+  find,
+  findAll,
+  fillIn,
+  typeIn,
+  visit,
+  waitUntil,
+} from '@ember/test-helpers';
 import { setupApplicationTest } from 'vault/tests/helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import {
   createPolicyCmd,
   deleteEngineCmd,
@@ -16,33 +26,34 @@ import {
   createTokenCmd,
   tokenWithPolicyCmd,
 } from 'vault/tests/helpers/commands';
-import { personas } from 'vault/tests/helpers/policy-generator/kv';
+import { personas } from 'vault/tests/helpers/kv/policy-generator';
 import {
   addSecretMetadataCmd,
-  clearRecords,
   writeSecret,
   writeVersionedSecret,
 } from 'vault/tests/helpers/kv/kv-run-commands';
 import { FORM, PAGE } from 'vault/tests/helpers/kv/kv-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import { setupControlGroup, grantAccess } from 'vault/tests/helpers/control-groups';
 
 const secretPath = `my-#:$=?-secret`;
 // This doesn't encode in a normal way, so hardcoding it here until we sort that out
 const secretPathUrlEncoded = `my-%23:$=%3F-secret`;
+// these are rendered individually by each page component, assigning a const here for consistency
+const ALL_TABS = ['Overview', 'Secret', 'Metadata', 'Paths', 'Version History'];
 const navToBackend = async (backend) => {
-  await visit(`/vault/secrets`);
-  return click(PAGE.backends.link(backend));
+  await visit(`/vault/secrets-engines`);
+  return click(`${GENERAL.tableData(`${backend}/`, 'path')} a`);
 };
 const assertCorrectBreadcrumbs = (assert, expected) => {
-  assert.dom(PAGE.breadcrumb).exists({ count: expected.length }, 'correct number of breadcrumbs');
-  const breadcrumbs = document.querySelectorAll(PAGE.breadcrumb);
+  assert.dom(PAGE.breadcrumbs).hasText(expected.join(' '));
+  const breadcrumbs = findAll(PAGE.breadcrumb);
   expected.forEach((text, idx) => {
-    assert.dom(breadcrumbs[idx]).includesText(text, `position ${idx} breadcrumb includes text ${text}`);
+    assert.dom(breadcrumbs[idx]).hasText(text, `position ${idx} breadcrumb includes text ${text}`);
   });
 };
 const assertDetailTabs = (assert, current, hidden = []) => {
-  const allTabs = ['Secret', 'Metadata', 'Paths', 'Version History'];
-  allTabs.forEach((tab) => {
+  ALL_TABS.forEach((tab) => {
     if (hidden.includes(tab)) {
       assert.dom(PAGE.secretTab(tab)).doesNotExist(`${tab} tab does not render`);
       return;
@@ -55,17 +66,31 @@ const assertDetailTabs = (assert, current, hidden = []) => {
     }
   });
 };
+// patchLatest is only available for enterprise so it's not included here
 const DETAIL_TOOLBARS = ['delete', 'destroy', 'copy', 'versionDropdown', 'createNewVersion'];
 const assertDetailsToolbar = (assert, expected = DETAIL_TOOLBARS) => {
   assert
     .dom(PAGE.toolbarAction)
     .exists({ count: expected.length }, 'correct number of toolbar actions render');
-  DETAIL_TOOLBARS.forEach((toolbar) => {
-    if (expected.includes(toolbar)) {
-      assert.dom(PAGE.detail[toolbar]).exists(`${toolbar} toolbar action exists`);
-    } else {
-      assert.dom(PAGE.detail[toolbar]).doesNotExist(`${toolbar} toolbar action not rendered`);
-    }
+  expected.forEach((toolbar) => {
+    assert.dom(PAGE.detail[toolbar]).exists(`${toolbar} action exists`);
+  });
+  const unexpected = DETAIL_TOOLBARS.filter((t) => !expected.includes(t));
+  unexpected.forEach((toolbar) => {
+    assert.dom(PAGE.detail[toolbar]).doesNotExist(`${toolbar} action doesNotExist`);
+  });
+};
+
+const patchRedirectTest = (test, testCase) => {
+  // only run this test on enterprise so we are testing permissions specifically and not enterprise vs CE (which also redirects)
+  test(`enterprise: patch route redirects for users without permissions (${testCase})`, async function (assert) {
+    await visit(`/vault/secrets-engines/${this.backend}/kv/app%2Fnested%2Fsecret/patch`);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.backend}/kv/app%2Fnested%2Fsecret`,
+      'redirects to index'
+    );
+    assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.kv.secret.index');
   });
 };
 
@@ -80,9 +105,10 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
   hooks.beforeEach(async function () {
     const uid = uuidv4();
     this.store = this.owner.lookup('service:store');
+    this.version = this.owner.lookup('service:version');
     this.emptyBackend = `kv-empty-${uid}`;
     this.backend = `kv-nav-${uid}`;
-    await authPage.login();
+    await login();
     await runCmd(mountEngineCmd('kv-v2', this.emptyBackend), false);
     await runCmd(mountEngineCmd('kv-v2', this.backend), false);
     await writeSecret(this.backend, 'app/nested/secret', 'foo', 'bar');
@@ -92,33 +118,152 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
   });
 
   hooks.afterEach(async function () {
-    await authPage.login();
+    await login();
     await runCmd(deleteEngineCmd(this.backend));
     await runCmd(deleteEngineCmd(this.emptyBackend));
     return;
   });
 
+  test('KVv2 handles secret with % and space in path correctly', async function (assert) {
+    // To check this bug no longer happens: https://github.com/hashicorp/vault/issues/11616
+    await navToBackend(this.backend);
+    await click(PAGE.list.createSecret);
+    const pathWithSpace = 'per%centfu ll';
+    await typeIn(GENERAL.inputByAttr('path'), pathWithSpace);
+    await fillIn(FORM.keyInput(), 'someKey');
+    await fillIn(FORM.maskedValueInput(), 'someValue');
+    await click(FORM.saveBtn);
+    assert.dom(PAGE.title).hasText(pathWithSpace, 'title is full path without any encoding/decoding.');
+    assert
+      .dom(PAGE.breadcrumbAtIdx(1))
+      .hasText(this.backend, 'breadcrumb before secret path is backend path');
+    assert
+      .dom(PAGE.breadcrumbCurrentAtIdx(2))
+      .hasText('per%centfu ll', 'the current breadcrumb is value of the secret path');
+
+    await click(PAGE.breadcrumbAtIdx(1));
+    assert
+      .dom(`${PAGE.list.item(pathWithSpace)} [data-test-path]`)
+      .hasText(pathWithSpace, 'the list item is shown correctly');
+
+    await typeIn(PAGE.list.filter, 'per%');
+    await click('[data-test-kv-list-filter-submit]');
+    assert
+      .dom(`${PAGE.list.item(pathWithSpace)} [data-test-path]`)
+      .hasText(pathWithSpace, 'the list item is shown correctly after filtering');
+
+    await click(PAGE.list.item(pathWithSpace));
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.backend}/kv/${encodeURIComponent(pathWithSpace)}`,
+      'Path is encoded in the URL'
+    );
+  });
+
+  test('KVv2 handles nested secret with % and space in path correctly', async function (assert) {
+    await navToBackend(this.backend);
+    await click(PAGE.list.createSecret);
+    const nestedPathWithSpace = 'per%/centfu ll';
+    await typeIn(GENERAL.inputByAttr('path'), nestedPathWithSpace);
+    await fillIn(FORM.keyInput(), 'someKey');
+    await fillIn(FORM.maskedValueInput(), 'someValue');
+    await click(FORM.saveBtn);
+    assert
+      .dom(PAGE.title)
+      .hasText(
+        nestedPathWithSpace,
+        'title is of the full nested path (directory included) without any encoding/decoding.'
+      );
+    assert.dom(PAGE.breadcrumbAtIdx(2)).hasText('per%');
+    assert
+      .dom(PAGE.breadcrumbCurrentAtIdx(3))
+      .hasText('centfu ll', 'the current breadcrumb is value centfu ll');
+
+    await click(PAGE.breadcrumbAtIdx(1));
+    assert
+      .dom(`${PAGE.list.item('per%/')} [data-test-path]`)
+      .hasText('per%/', 'the directory item is shown correctly');
+
+    await typeIn(PAGE.list.filter, 'per%/');
+    await click('[data-test-kv-list-filter-submit]');
+    assert
+      .dom(`${PAGE.list.item('centfu ll')} [data-test-path]`)
+      .hasText('centfu ll', 'the list item is shown correctly after filtering');
+
+    await click(PAGE.list.item('centfu ll'));
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.backend}/kv/${encodeURIComponent(nestedPathWithSpace)}`,
+      'Path is encoded in the URL'
+    );
+  });
+
+  test('KVv2 handles nested secret with a percent-encoded data octet in path correctly', async function (assert) {
+    // To check this bug no longer happens: https://github.com/hashicorp/vault/issues/25905
+    await navToBackend(this.backend);
+    await click(PAGE.list.createSecret);
+    const pathDataOctet = 'hello/foo%2fbar/world';
+    await typeIn(GENERAL.inputByAttr('path'), pathDataOctet);
+    await fillIn(FORM.keyInput(), 'someKey');
+    await fillIn(FORM.maskedValueInput(), 'someValue');
+    await click(FORM.saveBtn);
+    assert
+      .dom(PAGE.title)
+      .hasText(
+        pathDataOctet,
+        'title is of the full nested path (directory included) without any encoding/decoding.'
+      );
+    assert
+      .dom(PAGE.breadcrumbAtIdx(2))
+      .hasText('hello', 'hello is the first directory and shows up as a separate breadcrumb');
+    assert
+      .dom(PAGE.breadcrumbAtIdx(3))
+      .hasText('foo%2fbar', 'foo%2fbar is the second directory and shows up as a separate breadcrumb');
+    assert.dom(PAGE.breadcrumbCurrentAtIdx(4)).hasText('world', 'the current breadcrumb is value world');
+
+    await click(PAGE.breadcrumbAtIdx(2));
+    assert
+      .dom(`${PAGE.list.item('foo%2fbar/')} [data-test-path]`)
+      .hasText('foo%2fbar/', 'the directory item is shown correctly');
+
+    await click(PAGE.list.item('foo%2fbar/'));
+    await click(PAGE.list.item('world'));
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.backend}/kv/${encodeURIComponent(pathDataOctet)}`,
+      'Path is encoded in the URL'
+    );
+  });
+
   module('admin persona', function (hooks) {
     hooks.beforeEach(async function () {
       const token = await runCmd(
         tokenWithPolicyCmd('admin', personas.admin(this.backend) + personas.admin(this.emptyBackend))
       );
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('empty backend - breadcrumbs, title, tabs, emptyState (a)', async function (assert) {
-      assert.expect(15);
+      assert.expect(23);
       const backend = this.emptyBackend;
       await navToBackend(backend);
 
       // URL correct
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list`, 'lands on secrets list page');
-      // Breadcrumbs correct
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
-      // Title correct
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list`,
+        'lands on secrets list page'
+      );
+      // CONFIGURATION TAB
+      await click(PAGE.secretTab('Configuration'));
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'Configuration']);
+      assert.dom(PAGE.secretTab('Configuration')).hasClass('active');
+      assert.dom(PAGE.secretTab('Configuration')).hasText('Configuration');
+      assert.dom(PAGE.secretTab('Secrets')).hasText('Secrets');
+      assert.dom(PAGE.secretTab('Secrets')).doesNotHaveClass('active');
+      // SECRETS TAB
+      await click(PAGE.secretTab('Secrets'));
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
-      // Tabs correct
       assert.dom(PAGE.secretTab('Secrets')).hasText('Secrets');
       assert.dom(PAGE.secretTab('Secrets')).hasClass('active');
       assert.dom(PAGE.secretTab('Configuration')).hasText('Configuration');
@@ -132,38 +277,48 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
 
       // click toolbar CTA
       await click(PAGE.list.createSecret);
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/create`),
-        `url includes /vault/secrets/${backend}/kv/create`
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/create`),
+        `url includes /vault/secrets-engines/${backend}/kv/create`
       );
 
       // Click cancel btn
       await click(FORM.cancelBtn);
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list`),
-        `url includes /vault/secrets/${backend}/kv/list`
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list`),
+        `url includes /vault/secrets-engines/${backend}/kv/list`
       );
     });
     test('can access nested secret (a)', async function (assert) {
-      assert.expect(40);
+      // enterprise has "Patch latest version" in the toolbar which adds an assertion
+      const count = this.version.isEnterprise ? 47 : 46;
+      assert.expect(count);
       const backend = this.backend;
       await navToBackend(backend);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'title text correct');
       assert.dom(PAGE.emptyStateTitle).doesNotExist('No empty state');
-      assertCorrectBreadcrumbs(assert, ['secret', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.list.filter).hasNoValue('List filter input is empty');
 
       // Navigate through list items
       await click(PAGE.list.item('app/'));
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list/app/`);
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app']);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list/app/`,
+        `navigated to ${currentURL()}`
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       assert.dom(PAGE.list.filter).hasValue('app/', 'List filter input is prefilled');
       assert.dom(PAGE.list.item('nested/')).exists('Shows nested secret');
 
       await click(PAGE.list.item('nested/'));
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list/app/nested/`);
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app', 'nested']);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list/app/nested/`,
+        `navigated to ${currentURL()}`
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       assert.dom(PAGE.list.filter).hasValue('app/nested/', 'List filter input is prefilled');
       assert.dom(PAGE.list.item('secret')).exists('Shows deeply nested secret');
@@ -171,62 +326,84 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.list.item('secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Fnested%2Fsecret/details?version=1`
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret`,
+        `navigated to ${currentURL()}`
       );
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app', 'nested', 'secret']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested', 'secret']);
       assert.dom(PAGE.title).hasText('app/nested/secret', 'title is full secret path');
-      assertDetailsToolbar(assert);
+
+      await click(PAGE.secretTab('Secret'));
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested', 'secret']);
+      const expectedToolbar = this.version.isEnterprise
+        ? [...DETAIL_TOOLBARS, 'patchLatest']
+        : DETAIL_TOOLBARS;
+      assertDetailsToolbar(assert, expectedToolbar);
 
       await click(PAGE.breadcrumbAtIdx(3));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/nested/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/nested/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(2));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(1));
-      assert.ok(currentURL().startsWith(`/vault/secrets/${backend}/kv/list`), 'links back to list root');
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list`),
+        'links back to list root'
+      );
     });
     test('it redirects from LIST, SHOW and EDIT views using old non-engine url to ember engine url (a)', async function (assert) {
       assert.expect(4);
       const backend = this.backend;
       // create with initialKey
-      await visit(`/vault/secrets/${backend}/create/test`);
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/create?initialKey=test`);
+      await visit(`/vault/secrets-engines/${backend}/create/test`);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/create?initialKey=test`,
+        `navigated to ${currentURL()}`
+      );
       // Reported bug, backported fix https://github.com/hashicorp/vault/pull/24281
       // list for directory
-      await visit(`/vault/secrets/${backend}/list/app/`);
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list/app/`);
+      await visit(`/vault/secrets-engines/${backend}/list/app/`);
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${backend}/kv/list/app/`, `navigates to list`);
       // show for secret
-      await visit(`/vault/secrets/${backend}/show/app/nested/secret`);
+      await visit(`/vault/secrets-engines/${backend}/show/app/nested/secret`);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Fnested%2Fsecret/details?version=1`
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret`,
+        `navigates to overview`
       );
       // edit for secret
-      await visit(`/vault/secrets/${backend}/edit/app/nested/secret`);
+      await visit(`/vault/secrets-engines/${backend}/edit/app/nested/secret`);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Fnested%2Fsecret/details?version=1`
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret/details/edit?version=1`,
+        `navigates to edit`
       );
     });
-    test('versioned secret nav, tabs, breadcrumbs (a)', async function (assert) {
-      assert.expect(45);
+    test('versioned secret nav, tabs (a)', async function (assert) {
+      assert.expect(27);
       const backend = this.backend;
       await navToBackend(backend);
       await click(PAGE.list.item(secretPath));
+
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details?version=3`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`,
+        'navigates to overview'
+      );
+      await click(PAGE.secretTab('Secret'));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details?version=3`,
         'Url includes version query param'
       );
       assert.dom(PAGE.title).hasText(secretPath, 'title is correct on detail view');
-      assertDetailTabs(assert, 'Secret');
       assert.dom(PAGE.detail.versionDropdown).hasText('Version 3', 'Version dropdown shows current version');
       assert.dom(PAGE.detail.createNewVersion).hasText('Create new version', 'Create version button shows');
       assert.dom(PAGE.detail.versionTimestamp).containsText('Version 3 created');
@@ -235,7 +412,7 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.detail.createNewVersion);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details/edit?version=3`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details/edit?version=3`,
         'Url includes version query param'
       );
       assert.dom(FORM.versionAlert).doesNotExist('Does not show version alert for current version');
@@ -244,15 +421,15 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(FORM.cancelBtn);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details?version=3`,
-        'Goes back to detail view'
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`,
+        'Goes back to overview'
       );
-
+      await click(PAGE.secretTab('Secret'));
       await click(PAGE.detail.versionDropdown);
       await click(`${PAGE.detail.version(1)} a`);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details?version=1`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details?version=1`,
         'Goes to detail view for version 1'
       );
       assert.dom(PAGE.detail.versionDropdown).hasText('Version 1', 'Version dropdown shows selected version');
@@ -262,7 +439,7 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.detail.createNewVersion);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details/edit?version=1`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details/edit?version=1`,
         'Url includes version query param'
       );
       assert.dom(FORM.inputByAttr('path')).isDisabled();
@@ -274,10 +451,9 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.secretTab('Metadata'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/metadata`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata`,
         `goes to metadata page`
       );
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata']);
       assert.dom(PAGE.title).hasText(secretPath);
       assert
         .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
@@ -290,55 +466,131 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.metadata.editBtn);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/metadata/edit`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata/edit`,
         `goes to metadata edit page`
       );
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata', 'edit']);
       await click(FORM.cancelBtn);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/metadata`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata`,
         `cancel btn goes back to metadata page`
       );
     });
-    test('breadcrumbs & page titles are correct (a)', async function (assert) {
-      assert.expect(45);
+    test('breadcrumbs, tabs & page titles are correct (a)', async function (assert) {
+      assert.expect(123);
+      // only need to assert hrefs one test, no need for this function to be global
+      const assertTabHrefs = (assert, page) => {
+        ALL_TABS.forEach((tab) => {
+          const baseUrl = `/ui/vault/secrets-engines/${backend}/kv`;
+          const hrefs = {
+            Overview: `${baseUrl}/${secretPathUrlEncoded}`,
+            Secret:
+              page === 'Secret'
+                ? `${baseUrl}/${secretPathUrlEncoded}/details?version=3`
+                : `${baseUrl}/${secretPathUrlEncoded}/details`,
+            Metadata: `${baseUrl}/${secretPathUrlEncoded}/metadata`,
+            Paths: `${baseUrl}/${secretPathUrlEncoded}/paths`,
+            'Version History': `${baseUrl}/${secretPathUrlEncoded}/metadata/versions`,
+          };
+          assert
+            .dom(PAGE.secretTab(tab))
+            .hasAttribute('href', hrefs[tab], `${tab} tab for page: ${page} has expected href`);
+        });
+      };
       const backend = this.backend;
       await navToBackend(backend);
-      await click(PAGE.secretTab('Configuration'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, 'configuration']);
-      assert.dom(PAGE.title).hasText(`${backend} version 2`, 'correct page title for configuration');
+      await click(PAGE.list.item(secretPath));
 
-      await click(PAGE.secretTab('Secrets'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
-      assert.dom(PAGE.title).hasText(`${backend} version 2`, 'correct page title for secret list');
+      // PAGE COMPONENTS RENDER THEIR OWN TABS, ASSERT EACH HREF ON EACH PAGE
+      // overview tab
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.kv.secret.index',
+        'navs to overview'
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath]);
+      assertDetailTabs(assert, 'Overview');
+      assertTabHrefs(assert, 'Overview');
+      assert.dom(PAGE.title).hasText(secretPath, 'correct page title for secret overview');
 
-      await click(PAGE.list.item(secretPath));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath]);
+      // secret tab
+      await click(PAGE.secretTab('Secret'));
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.kv.secret.details.index',
+        'navs to details'
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath]);
+      assertDetailTabs(assert, 'Secret');
+      assertTabHrefs(assert, 'Secret');
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for secret detail');
 
       await click(PAGE.detail.createNewVersion);
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'edit']);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.kv.secret.details.edit',
+        'navs to create'
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Edit']);
       assert.dom(PAGE.title).hasText('Create New Version', 'correct page title for secret edit');
 
+      // metadata tab
       await click(PAGE.breadcrumbAtIdx(2));
       await click(PAGE.secretTab('Metadata'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata']);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.kv.secret.metadata.index',
+        'navs to metadata'
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata']);
+      assertDetailTabs(assert, 'Metadata');
+      assertTabHrefs(assert, 'Metadata');
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for metadata');
 
       await click(PAGE.metadata.editBtn);
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata', 'edit']);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.kv.secret.metadata.edit',
+        'navs to metadata.edit'
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata', 'Edit']);
       assert.dom(PAGE.title).hasText('Edit Secret Metadata', 'correct page title for metadata edit');
 
+      // paths tab
       await click(PAGE.breadcrumbAtIdx(3));
       await click(PAGE.secretTab('Paths'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'paths']);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.kv.secret.paths',
+        'navs to paths'
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Paths']);
+      assertDetailTabs(assert, 'Paths');
+      assertTabHrefs(assert, 'Paths');
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for paths');
 
+      // version history tab
       await click(PAGE.secretTab('Version History'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'version history']);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.kv.secret.metadata.versions',
+        'navs to version history'
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Version History']);
+      assertDetailTabs(assert, 'Version History');
+      assertTabHrefs(assert, 'Version History');
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for version history');
     });
+    // only run this test on enterprise so we are testing permissions specifically and not enterprise vs CE (which also redirects)
+    test('enterprise: patch route does not redirect for users with permissions (a)', async function (assert) {
+      await visit(`/vault/secrets-engines/${this.backend}/kv/app%2Fnested%2Fsecret/patch`);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.backend}/kv/app%2Fnested%2Fsecret/patch`,
+        'redirects to index'
+      );
+      assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.kv.secret.patch');
+    });
   });
 
   module('data-reader persona', function (hooks) {
@@ -350,9 +602,7 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
         ),
         createTokenCmd(`data-reader-${this.backend}`),
       ]);
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('empty backend - breadcrumbs, title, tabs, emptyState (dr)', async function (assert) {
       assert.expect(16);
@@ -360,9 +610,13 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await navToBackend(backend);
 
       // URL correct
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list`, 'lands on secrets list page');
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list`,
+        'lands on secrets list page'
+      );
       // Breadcrumbs correct
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       // Title correct
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       // Tabs correct
@@ -382,26 +636,26 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       assert.dom(PAGE.list.overviewCard).exists('renders overview card');
 
       await typeIn(PAGE.list.overviewInput, 'directory/');
-      await click(PAGE.list.overviewButton);
+      await click(GENERAL.submitButton);
       assert
         .dom('[data-test-inline-error-message]')
         .hasText('You do not have the required permissions or the directory does not exist.');
 
       // click toolbar CTA
-      await visit(`/vault/secrets/${backend}/kv/list`);
+      await visit(`/vault/secrets-engines/${backend}/kv/list`);
       await click(PAGE.list.createSecret);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/create`,
-        `url includes /vault/secrets/${backend}/kv/create`
+        `/vault/secrets-engines/${backend}/kv/create`,
+        `url includes /vault/secrets-engines/${backend}/kv/create`
       );
 
       // Click cancel btn
       await click(FORM.cancelBtn);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/list`,
-        `url includes /vault/secrets/${backend}/kv/list`
+        `/vault/secrets-engines/${backend}/kv/list`,
+        `url includes /vault/secrets-engines/${backend}/kv/list`
       );
     });
     test('can access nested secret (dr)', async function (assert) {
@@ -410,50 +664,60 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await navToBackend(backend);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'title text correct');
       assert.dom(PAGE.emptyStateTitle).doesNotExist('No empty state');
-      assertCorrectBreadcrumbs(assert, ['secret', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert
         .dom(PAGE.list.filter)
         .doesNotExist('List filter input does not render because no list capabilities');
 
       await typeIn(PAGE.list.overviewInput, 'app/nested/secret');
-      await click(PAGE.list.overviewButton);
+      await click(GENERAL.submitButton);
 
-      // Goes to correct detail view
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Fnested%2Fsecret/details?version=1`
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret`,
+        `navigated to secret overview ${currentURL()}`
       );
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app', 'nested', 'secret']);
+      await click(PAGE.secretTab('Secret'));
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested', 'secret']);
       assert.dom(PAGE.title).hasText('app/nested/secret', 'title is full secret path');
       assertDetailsToolbar(assert, ['copy']);
 
       await click(PAGE.breadcrumbAtIdx(3));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/nested/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/nested/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(2));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(1));
-      assert.ok(currentURL().startsWith(`/vault/secrets/${backend}/kv/list`), 'links back to list root');
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list`),
+        'links back to list root'
+      );
     });
     test('versioned secret nav, tabs, breadcrumbs (dr)', async function (assert) {
-      assert.expect(28);
+      assert.expect(32);
       const backend = this.backend;
       await navToBackend(backend);
 
       // Navigate to secret
       await typeIn(PAGE.list.overviewInput, secretPath);
-      await click(PAGE.list.overviewButton);
+      await click(GENERAL.submitButton);
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details?version=3`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`,
+        'navigates to secret overview'
+      );
+      await click(PAGE.secretTab('Secret'));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details?version=3`,
         'Url includes version query param'
       );
       assert.dom(PAGE.title).hasText(secretPath, 'Goes to secret detail view');
@@ -464,7 +728,7 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       assert.dom(PAGE.infoRowValue('foo')).exists('renders current data');
 
       // data-reader can't navigate to older versions, but they can go to page directly
-      await visit(`/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details?version=1`);
+      await visit(`/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details?version=1`);
       assert.dom(PAGE.detail.versionDropdown).doesNotExist('Version dropdown does not exist');
       assert.dom(PAGE.detail.versionTimestamp).containsText('Version 1 created');
       assert.dom(PAGE.infoRowValue('key-1')).exists('renders previous data');
@@ -474,12 +738,16 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.secretTab('Metadata'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/metadata`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata`,
         `goes to metadata page`
       );
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata']);
       assert.dom(PAGE.title).hasText(secretPath);
       assert.dom(PAGE.toolbarAction).doesNotExist('no toolbar actions available on metadata');
+      assert
+        .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
+        .hasText('Request custom metadata?');
+      await click(PAGE.metadata.requestData);
       assert
         .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
         .hasText('No custom metadata');
@@ -493,32 +761,33 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       const backend = this.backend;
       await navToBackend(backend);
       await click(PAGE.secretTab('Configuration'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, 'configuration']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'Configuration']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'title correct on config page');
 
       await click(PAGE.secretTab('Secrets'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'title correct on secrets list');
 
       await typeIn(PAGE.list.overviewInput, 'app/nested/secret');
-      await click(PAGE.list.overviewButton);
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, 'app', 'nested', 'secret']);
+      await click(GENERAL.submitButton);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested', 'secret']);
       assert.dom(PAGE.title).hasText('app/nested/secret', 'title correct on secret detail');
 
       assert.dom(PAGE.detail.createNewVersion).doesNotExist('cannot create new version');
 
       await click(PAGE.secretTab('Metadata'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, 'app', 'nested', 'secret', 'metadata']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested', 'secret', 'Metadata']);
       assert.dom(PAGE.title).hasText('app/nested/secret', 'title correct on metadata');
 
       assert.dom(PAGE.metadata.editBtn).doesNotExist('cannot edit metadata');
 
       await click(PAGE.secretTab('Paths'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, 'app', 'nested', 'secret', 'paths']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested', 'secret', 'Paths']);
       assert.dom(PAGE.title).hasText('app/nested/secret', 'correct page title for paths');
 
       assert.dom(PAGE.secretTab('Version History')).doesNotExist('Version History tab not shown');
     });
+    patchRedirectTest(test, 'dr');
   });
 
   module('data-list-reader persona', function (hooks) {
@@ -531,9 +800,7 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
         createTokenCmd(`data-reader-list-${this.backend}`),
       ]);
 
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('empty backend - breadcrumbs, title, tabs, emptyState (dlr)', async function (assert) {
       assert.expect(15);
@@ -541,9 +808,13 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await navToBackend(backend);
 
       // URL correct
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list`, 'lands on secrets list page');
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list`,
+        'lands on secrets list page'
+      );
       // Breadcrumbs correct
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       // Title correct
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       // Tabs correct
@@ -560,31 +831,35 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
 
       // click toolbar CTA
       await click(PAGE.list.createSecret);
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/create`),
-        `url includes /vault/secrets/${backend}/kv/create`
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/create`),
+        `url includes /vault/secrets-engines/${backend}/kv/create`
       );
 
       // Click cancel btn
       await click(FORM.cancelBtn);
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list`),
-        `url includes /vault/secrets/${backend}/kv/list`
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list`),
+        `url includes /vault/secrets-engines/${backend}/kv/list`
       );
     });
     test('can access nested secret (dlr)', async function (assert) {
-      assert.expect(31);
+      assert.expect(32);
       const backend = this.backend;
       await navToBackend(backend);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'title text correct');
       assert.dom(PAGE.emptyStateTitle).doesNotExist('No empty state');
-      assertCorrectBreadcrumbs(assert, ['secret', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.list.filter).hasNoValue('List filter input is empty');
 
       // Navigate through list items
       await click(PAGE.list.item('app/'));
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list/app/`);
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app']);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list/app/`,
+        `navigated to ${currentURL()}`
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       assert.dom(PAGE.list.filter).doesNotExist('List filter hidden since no nested list access');
 
@@ -592,39 +867,55 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
         .dom(PAGE.list.overviewInput)
         .hasValue('app/', 'overview card is pre-filled with directory param');
       await typeIn(PAGE.list.overviewInput, 'nested/secret');
-      await click(PAGE.list.overviewButton);
+      await click(GENERAL.submitButton);
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Fnested%2Fsecret/details?version=1`
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret`,
+        `navigated to overview`
       );
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app', 'nested', 'secret']);
+      await click(PAGE.secretTab('Secret'));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret/details?version=1`,
+        `navigated to ${currentURL()}`
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested', 'secret']);
       assert.dom(PAGE.title).hasText('app/nested/secret', 'title is full secret path');
       assertDetailsToolbar(assert, ['delete', 'copy']);
 
       await click(PAGE.breadcrumbAtIdx(3));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/nested/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/nested/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(2));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(1));
-      assert.ok(currentURL().startsWith(`/vault/secrets/${backend}/kv/list`), 'links back to list root');
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list`),
+        'links back to list root'
+      );
     });
     test('versioned secret nav, tabs, breadcrumbs (dlr)', async function (assert) {
-      assert.expect(28);
+      assert.expect(32);
       const backend = this.backend;
       await navToBackend(backend);
       await click(PAGE.list.item(secretPath));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details?version=3`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`,
+        'navigates to overview'
+      );
+      await click(PAGE.secretTab('Secret'));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details?version=3`,
         'Url includes version query param'
       );
       assert.dom(PAGE.title).hasText(secretPath, 'Goes to secret detail view');
@@ -637,7 +928,7 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       assert.dom(PAGE.detail.createNewVersion).doesNotExist('cannot create new version');
 
       // data-list-reader can't navigate to older versions, but they can go to page directly
-      await visit(`/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details?version=1`);
+      await visit(`/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details?version=1`);
       assert.dom(PAGE.detail.versionDropdown).doesNotExist('no version dropdown');
       assert.dom(PAGE.detail.versionTimestamp).containsText('Version 1 created');
       assert.dom(PAGE.infoRowValue('key-1')).exists('renders previous data');
@@ -647,11 +938,15 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.secretTab('Metadata'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/metadata`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata`,
         `goes to metadata page`
       );
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata']);
       assert.dom(PAGE.title).hasText(secretPath);
+      assert
+        .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
+        .hasText('Request custom metadata?');
+      await click(PAGE.metadata.requestData);
       assert
         .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
         .hasText('No custom metadata');
@@ -666,31 +961,32 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await navToBackend(backend);
 
       await click(PAGE.secretTab('Configuration'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, 'configuration']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'Configuration']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'correct page title for configuration');
 
       await click(PAGE.secretTab('Secrets'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'correct page title for secret list');
 
       await click(PAGE.list.item(secretPath));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath]);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for secret detail');
 
       assert.dom(PAGE.detail.createNewVersion).doesNotExist('cannot create new version');
 
       await click(PAGE.secretTab('Metadata'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata']);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for metadata');
 
       assert.dom(PAGE.metadata.editBtn).doesNotExist('cannot edit metadata');
 
       await click(PAGE.secretTab('Paths'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'paths']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Paths']);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for paths');
 
       assert.dom(PAGE.secretTab('Version History')).doesNotExist('Version History tab not shown');
     });
+    patchRedirectTest(test, 'dlr');
   });
 
   module('metadata-maintainer persona', function (hooks) {
@@ -702,19 +998,20 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
         ),
         createTokenCmd(`metadata-maintainer-${this.backend}`),
       ]);
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('empty backend - breadcrumbs, title, tabs, emptyState (mm)', async function (assert) {
       assert.expect(15);
       const backend = this.emptyBackend;
       await navToBackend(backend);
-
       // URL correct
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list`, 'lands on secrets list page');
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list`,
+        'lands on secrets list page'
+      );
       // Breadcrumbs correct
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       // Title correct
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       // Tabs correct
@@ -731,38 +1028,46 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
 
       // click toolbar CTA
       await click(PAGE.list.createSecret);
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/create`),
-        `url includes /vault/secrets/${backend}/kv/create`
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/create`),
+        `url includes /vault/secrets-engines/${backend}/kv/create`
       );
 
       // Click cancel btn
       await click(FORM.cancelBtn);
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list`),
-        `url includes /vault/secrets/${backend}/kv/list`
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list`),
+        `url includes /vault/secrets-engines/${backend}/kv/list`
       );
     });
     test('can access nested secret (mm)', async function (assert) {
-      assert.expect(41);
+      assert.expect(42);
       const backend = this.backend;
       await navToBackend(backend);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'title text correct');
       assert.dom(PAGE.emptyStateTitle).doesNotExist('No empty state');
-      assertCorrectBreadcrumbs(assert, ['secret', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.list.filter).hasNoValue('List filter input is empty');
 
       // Navigate through list items
       await click(PAGE.list.item('app/'));
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list/app/`);
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app']);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list/app/`,
+        `navigated to ${currentURL()}`
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       assert.dom(PAGE.list.filter).hasValue('app/', 'List filter input is prefilled');
       assert.dom(PAGE.list.item('nested/')).exists('Shows nested secret');
 
       await click(PAGE.list.item('nested/'));
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list/app/nested/`);
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app', 'nested']);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list/app/nested/`,
+        `navigated to ${currentURL()}`
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       assert.dom(PAGE.list.filter).hasValue('app/nested/', 'List filter input is prefilled');
       assert.dom(PAGE.list.item('secret')).exists('Shows deeply nested secret');
@@ -770,39 +1075,54 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.list.item('secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Fnested%2Fsecret/details`,
-        `Goes to URL with version`
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret`,
+        `goes to overview`
       );
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app', 'nested', 'secret']);
+      await click(PAGE.secretTab('Secret'));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret/details`,
+        `Goes to URL without version`
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested', 'secret']);
       assert.dom(PAGE.title).hasText('app/nested/secret', 'title is full secret path');
       assertDetailsToolbar(assert, ['delete', 'destroy', 'versionDropdown']);
       assert.dom(PAGE.detail.versionDropdown).hasText('Version 1', 'Shows version timestamp');
 
       await click(PAGE.breadcrumbAtIdx(3));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/nested/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/nested/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(2));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(1));
-      assert.ok(currentURL().startsWith(`/vault/secrets/${backend}/kv/list`), 'links back to list root');
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list`),
+        'links back to list root'
+      );
     });
     test('versioned secret nav, tabs, breadcrumbs (mm)', async function (assert) {
-      assert.expect(37);
+      assert.expect(40);
       const backend = this.backend;
       await navToBackend(backend);
       await click(PAGE.list.item(secretPath));
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details`,
-        'Url includes version query param'
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`,
+        'navs to overview'
+      );
+      await click(PAGE.secretTab('Secret'));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details`,
+        'Url does not include version query param'
       );
       assert.dom(PAGE.title).hasText(secretPath, 'Goes to secret detail view');
       assertDetailTabs(assert, 'Secret');
@@ -818,7 +1138,7 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(`${PAGE.detail.version(1)} a`);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details?version=1`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details?version=1`,
         'Goes to detail view for version 1'
       );
       assert.dom(PAGE.detail.versionDropdown).hasText('Version 1', 'Version dropdown shows selected version');
@@ -834,10 +1154,10 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.secretTab('Metadata'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/metadata`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata`,
         `goes to metadata page`
       );
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata']);
       assert.dom(PAGE.title).hasText(secretPath);
       assert
         .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
@@ -850,14 +1170,14 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.metadata.editBtn);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/metadata/edit`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata/edit`,
         `goes to metadata edit page`
       );
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata', 'edit']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata', 'Edit']);
       await click(FORM.cancelBtn);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/metadata`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata`,
         `cancel btn goes back to metadata page`
       );
     });
@@ -866,34 +1186,35 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       const backend = this.backend;
       await navToBackend(backend);
       await click(PAGE.secretTab('Configuration'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, 'configuration']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'Configuration']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'correct page title for configuration');
 
       await click(PAGE.secretTab('Secrets'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'correct page title for secret list');
 
       await click(PAGE.list.item(secretPath));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath]);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for secret detail');
 
       await click(PAGE.secretTab('Metadata'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata']);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for metadata');
 
       await click(PAGE.metadata.editBtn);
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata', 'edit']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata', 'Edit']);
       assert.dom(PAGE.title).hasText('Edit Secret Metadata', 'correct page title for metadata edit');
 
       await click(PAGE.breadcrumbAtIdx(3));
       await click(PAGE.secretTab('Paths'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'paths']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Paths']);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for paths');
 
       await click(PAGE.secretTab('Version History'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'version history']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Version History']);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for version history');
     });
+    patchRedirectTest(test, 'mm');
   });
 
   module('secret-creator persona', function (hooks) {
@@ -905,9 +1226,7 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
         ),
         createTokenCmd(`secret-creator-${this.backend}`),
       ]);
-      await authPage.login(token);
-      clearRecords(this.store);
-      return;
+      return login(token);
     });
     test('empty backend - breadcrumbs, title, tabs, emptyState (sc)', async function (assert) {
       assert.expect(15);
@@ -915,9 +1234,13 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await navToBackend(backend);
 
       // URL correct
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list`, 'lands on secrets list page');
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list`,
+        'lands on secrets list page'
+      );
       // Breadcrumbs correct
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       // Title correct
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       // Tabs correct
@@ -936,65 +1259,80 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.list.createSecret);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/create`,
-        `goes to /vault/secrets/${backend}/kv/create`
+        `/vault/secrets-engines/${backend}/kv/create`,
+        `goes to /vault/secrets-engines/${backend}/kv/create`
       );
 
       // Click cancel btn
       await click(FORM.cancelBtn);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/list`,
-        `url includes /vault/secrets/${backend}/kv/list`
+        `/vault/secrets-engines/${backend}/kv/list`,
+        `url includes /vault/secrets-engines/${backend}/kv/list`
       );
     });
     test('can access nested secret (sc)', async function (assert) {
-      assert.expect(23);
+      assert.expect(24);
       const backend = this.backend;
       await navToBackend(backend);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'title text correct');
       assert.dom(PAGE.emptyStateTitle).doesNotExist('No empty state');
-      assertCorrectBreadcrumbs(assert, ['secret', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.list.filter).doesNotExist('List filter input is not rendered');
 
       // Navigate to secret
       await typeIn(PAGE.list.overviewInput, 'app/nested/secret');
-      await click(PAGE.list.overviewButton);
+      await click(GENERAL.submitButton);
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Fnested%2Fsecret/details`,
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret`,
+        'goes to overview'
+      );
+      await click(PAGE.secretTab('Secret'));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret/details`,
         'goes to secret detail page'
       );
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app', 'nested', 'secret']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested', 'secret']);
       assert.dom(PAGE.title).hasText('app/nested/secret', 'title is full secret path');
       assertDetailsToolbar(assert, ['createNewVersion']);
 
       await click(PAGE.breadcrumbAtIdx(3));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/nested/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/nested/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(2));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(1));
-      assert.ok(currentURL().startsWith(`/vault/secrets/${backend}/kv/list`), 'links back to list root');
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list`),
+        'links back to list root'
+      );
     });
     test('versioned secret nav, tabs, breadcrumbs (sc)', async function (assert) {
-      assert.expect(36);
+      assert.expect(39);
       const backend = this.backend;
       await navToBackend(backend);
 
       await typeIn(PAGE.list.overviewInput, secretPath);
-      await click(PAGE.list.overviewButton);
+      await click(GENERAL.submitButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`,
+        'Goes to overview'
+      );
+      await click(PAGE.secretTab('Secret'));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details`,
         'Goes to detail view'
       );
       assert.dom(PAGE.title).hasText(secretPath, 'Goes to secret detail view');
@@ -1010,7 +1348,7 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.detail.createNewVersion);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details/edit`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details/edit`,
         'Goes to edit page'
       );
       assert.dom(FORM.versionAlert).doesNotExist('Does not show version alert for current version');
@@ -1025,11 +1363,11 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(FORM.cancelBtn);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details`,
-        'Goes back to detail view'
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`,
+        'Goes back to overview'
       );
 
-      await visit(`/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details?version=1`);
+      await visit(`/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details?version=1`);
       assert.dom(PAGE.detail.versionDropdown).doesNotExist('Version dropdown does not exist');
       assert.dom(PAGE.detail.versionTimestamp).doesNotExist('version created data not rendered');
       assert.dom(PAGE.infoRowValue('key-1')).doesNotExist('does not render previous data');
@@ -1037,7 +1375,7 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.detail.createNewVersion);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details/edit?version=1`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details/edit?version=1`,
         'Url includes version query param'
       );
       assert.dom(FORM.inputByAttr('path')).isDisabled();
@@ -1049,10 +1387,10 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       await click(PAGE.secretTab('Metadata'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/metadata`,
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata`,
         `goes to metadata page`
       );
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata']);
       assert.dom(PAGE.title).hasText(secretPath);
       assert
         .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
@@ -1060,40 +1398,45 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       assert.dom(PAGE.metadata.editBtn).doesNotExist('edit metadata button does not render');
     });
     test('breadcrumbs & page titles are correct (sc)', async function (assert) {
-      assert.expect(34);
+      assert.expect(39);
       const backend = this.backend;
       await navToBackend(backend);
       await click(PAGE.secretTab('Configuration'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, 'configuration']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'Configuration']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'correct page title for configuration');
 
       await click(PAGE.secretTab('Secrets'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'correct page title for secret list');
 
       await typeIn(PAGE.list.overviewInput, secretPath);
-      await click(PAGE.list.overviewButton);
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath]);
+      await click(GENERAL.submitButton);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath]);
+      assert.dom(PAGE.title).hasText(secretPath, 'correct page title for secret detail');
+
+      await click(PAGE.secretTab('Secret'));
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath]);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for secret detail');
 
       await click(PAGE.detail.createNewVersion);
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'edit']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Edit']);
       assert.dom(PAGE.title).hasText('Create New Version', 'correct page title for secret edit');
 
       await click(PAGE.breadcrumbAtIdx(2));
       await click(PAGE.secretTab('Metadata'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata']);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for metadata');
 
       assert.dom(PAGE.metadata.editBtn).doesNotExist('cannot edit metadata');
 
       await click(PAGE.breadcrumbAtIdx(2));
       await click(PAGE.secretTab('Paths'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'paths']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Paths']);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for paths');
 
       assert.dom(PAGE.secretTab('Version History')).doesNotExist('Version History tab not shown');
     });
+    patchRedirectTest(test, 'sc');
   });
 
   module('enterprise controlled access persona', function (hooks) {
@@ -1101,11 +1444,11 @@ module('Acceptance | kv-v2 workflow | navigation', function (hooks) {
       // Set up control group scenario
       const userPolicy = `
 path "${this.backend}/data/*" {
-  capabilities = ["create", "read", "update", "delete", "list"]
+  capabilities = ["create", "read", "update", "delete", "list", "patch"]
   control_group = {
     max_ttl = "24h"
     factor "ops_manager" {
-      controlled_capabilities = ["read"]
+      controlled_capabilities = ["read", "patch"]
       identity {
           group_names = ["managers"]
           approvals = 1
@@ -1117,133 +1460,315 @@ path "${this.backend}/data/*" {
 path "${this.backend}/*" {
   capabilities = ["list"]
 }
+
+path "${this.backend}/subkeys/*" {
+  capabilities = ["read"]
+}
 `;
       const { userToken } = await setupControlGroup({ userPolicy, backend: this.backend });
       this.userToken = userToken;
-      await authPage.login(userToken);
-      clearRecords(this.store);
-      return;
+      return login(userToken);
     });
     test('can access nested secret (cg)', async function (assert) {
-      assert.expect(42);
+      assert.expect(44);
       const backend = this.backend;
       await navToBackend(backend);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'title text correct');
       assert.dom(PAGE.emptyStateTitle).doesNotExist('No empty state');
-      assertCorrectBreadcrumbs(assert, ['secret', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.list.filter).hasNoValue('List filter input is empty');
 
       // Navigate through list items
       await click(PAGE.list.item('app/'));
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list/app/`);
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app']);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list/app/`,
+        `navigated to ${currentURL()}`
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       assert.dom(PAGE.list.filter).hasValue('app/', 'List filter input is prefilled');
       assert.dom(PAGE.list.item('nested/')).exists('Shows nested secret');
 
       await click(PAGE.list.item('nested/'));
-      assert.strictEqual(currentURL(), `/vault/secrets/${backend}/kv/list/app/nested/`);
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app', 'nested']);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/list/app/nested/`,
+        `navigated to ${currentURL()}`
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`);
       assert.dom(PAGE.list.filter).hasValue('app/nested/', 'List filter input is prefilled');
       assert.dom(PAGE.list.item('secret')).exists('Shows deeply nested secret');
 
       // For some reason when we click on the item in tests it throws a global control group error
       // But not when we visit the page directly
-      await visit(`/vault/secrets/${backend}/kv/app%2Fnested%2Fsecret/details`);
-      assert.ok(
+      await visit(`/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret/details`);
+      assert.true(
         await waitUntil(() => currentRouteName() === 'vault.cluster.access.control-group-accessor'),
         'redirects to access control group route'
       );
       await grantAccess({
         apiPath: `${backend}/data/app/nested/secret`,
-        originUrl: `/vault/secrets/${backend}/kv/list/app/nested/`,
+        originUrl: `/vault/secrets-engines/${backend}/kv/list/app/nested/`,
         userToken: this.userToken,
         backend: this.backend,
       });
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/list/app/nested/`,
+        `/vault/secrets-engines/${backend}/kv/list/app/nested/`,
         'navigates to list url where secret is'
       );
       await click(PAGE.list.item('secret'));
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret`,
+        'goes to overview'
+      );
 
+      await click(PAGE.secretTab('Secret'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/app%2Fnested%2Fsecret/details?version=1`,
+        `/vault/secrets-engines/${backend}/kv/app%2Fnested%2Fsecret/details?version=1`,
         'goes to secret details'
       );
-      assertCorrectBreadcrumbs(assert, ['secret', backend, 'app', 'nested', 'secret']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'app', 'nested', 'secret']);
       assert.dom(PAGE.title).hasText('app/nested/secret', 'title is full secret path');
-      assertDetailsToolbar(assert, ['delete', 'copy', 'createNewVersion']);
+      assertDetailsToolbar(assert, ['delete', 'copy', 'createNewVersion', 'patchLatest']);
 
       await click(PAGE.breadcrumbAtIdx(3));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/nested/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/nested/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(2));
-      assert.ok(
-        currentURL().startsWith(`/vault/secrets/${backend}/kv/list/app/`),
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list/app/`),
         'links back to list directory'
       );
 
       await click(PAGE.breadcrumbAtIdx(1));
-      assert.ok(currentURL().startsWith(`/vault/secrets/${backend}/kv/list`), 'links back to list root');
+      assert.true(
+        currentURL().startsWith(`/vault/secrets-engines/${backend}/kv/list`),
+        'links back to list root'
+      );
     });
     test('breadcrumbs & page titles are correct (cg)', async function (assert) {
-      assert.expect(36);
+      assert.expect(42);
       const backend = this.backend;
       await navToBackend(backend);
       await click(PAGE.secretTab('Configuration'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, 'configuration']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, 'Configuration']);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'correct page title for configuration');
 
       await click(PAGE.secretTab('Secrets'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend]);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend]);
       assert.dom(PAGE.title).hasText(`${backend} version 2`, 'correct page title for secret list');
 
-      await visit(`/vault/secrets/${backend}/kv/${secretPathUrlEncoded}/details`);
+      await visit(`/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/details`);
 
-      assert.ok(
+      assert.true(
         await waitUntil(() => currentRouteName() === 'vault.cluster.access.control-group-accessor'),
         'redirects to access control group route'
       );
       await grantAccess({
-        apiPath: `${backend}/data/${encodeURIComponent(secretPath)}`,
-        originUrl: `/vault/secrets/${backend}/kv/list`,
+        apiPath: `${backend}/data/${secretPath}`,
+        originUrl: `/vault/secrets-engines/${backend}/kv/list`,
         userToken: this.userToken,
         backend: this.backend,
       });
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${backend}/kv/list`,
+        `/vault/secrets-engines/${backend}/kv/list`,
         'navigates back to list url after authorized'
       );
       await click(PAGE.list.item(secretPath));
-
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath]);
-      assert.dom(PAGE.title).hasText(secretPath, 'correct page title for secret detail');
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`,
+        'Goes to overview'
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath]);
+      assert.dom(PAGE.title).hasText(secretPath, 'correct page title for secret overview');
 
       await click(PAGE.secretTab('Metadata'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'metadata']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Metadata']);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for metadata');
-
       assert.dom(PAGE.metadata.editBtn).doesNotExist('cannot edit metadata');
 
-      await click(PAGE.breadcrumbAtIdx(2));
       await click(PAGE.secretTab('Paths'));
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'paths']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Paths']);
       assert.dom(PAGE.title).hasText(secretPath, 'correct page title for paths');
 
       assert.dom(PAGE.secretTab('Version History')).doesNotExist('Version History tab not shown');
 
       await click(PAGE.secretTab('Secret'));
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath]);
+      assert.dom(PAGE.title).hasText(secretPath, 'correct page title for secret details');
       await click(PAGE.detail.createNewVersion);
-      assertCorrectBreadcrumbs(assert, ['secrets', backend, secretPath, 'edit']);
+      assertCorrectBreadcrumbs(assert, ['Secrets', backend, secretPath, 'Edit']);
       assert.dom(PAGE.title).hasText('Create New Version', 'correct page title for secret edit');
     });
+    test('can request custom_metadata from data endpoint (cg)', async function (assert) {
+      // custom metadata is empty
+      assert.expect(3);
+      const backend = this.backend;
+      await visit(`/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`);
+      await click(PAGE.secretTab('Metadata'));
+      assert
+        .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
+        .hasText('Request custom metadata?');
+      await click(PAGE.metadata.requestData);
+      assert
+        .dom(GENERAL.messageError)
+        .hasTextContaining(
+          `Control Group Error A Control Group was encountered at ${backend}/data/${secretPath}.`
+        );
+      const url = find('[data-test-control-error="href"]').innerText;
+      await visit(url);
+      await grantAccess({
+        apiPath: `${backend}/data/${secretPath}`,
+        originUrl: `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata`,
+        userToken: this.userToken,
+        backend: this.backend,
+      });
+      await click(PAGE.metadata.requestData);
+      assert
+        .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
+        .hasText('No custom metadata', 'empty state updates when access is granted');
+    });
+    test('can patch a secret (cg)', async function (assert) {
+      assert.expect(3);
+      const backend = this.backend;
+      await visit(`/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`);
+      await click(GENERAL.overviewCard.actionText('Patch secret'));
+      await fillIn(FORM.keyInput('new'), 'newkey');
+      await fillIn(FORM.valueInput('new'), 'newvalue');
+      await click(FORM.saveBtn);
+      assert
+        .dom(GENERAL.messageError)
+        .hasTextContaining(
+          `Control Group Error A Control Group was encountered at ${backend}/data/${secretPath}.`
+        );
+      assert
+        .dom(GENERAL.messageError)
+        .hasTextContaining(
+          'You can re-submit the form once access is granted. Ask your authorizer when to attempt saving again.'
+        );
+      const url = find('[data-test-control-error="href"]').innerText;
+      await visit(url);
+      await grantAccess({
+        apiPath: `${backend}/data/${secretPath}`,
+        originUrl: `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/patch`,
+        userToken: this.userToken,
+        backend: this.backend,
+      });
+      // we have to refill the data because granting access reloads the form
+      // however in the real world it's likely access is authorized in a separate browser
+      // once granted, the user can click "submit" the form will save successfully.
+      await fillIn(FORM.keyInput('new'), 'newkey');
+      await fillIn(FORM.valueInput('new'), 'newvalue');
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.overviewCard.container('Subkeys')).hasTextContaining('Keys foo newkey');
+    });
+    test('can read custom_metadata from data endpoint (cg)', async function (assert) {
+      assert.expect(3);
+      // login is root user and make custom metadata since console can't be used to pass an object
+      await login();
+      await visit(`/vault/secrets-engines/${this.backend}/kv/${secretPathUrlEncoded}/metadata/edit`);
+      await fillIn(FORM.keyInput(), 'special');
+      await fillIn(FORM.valueInput(), 'secret');
+      await click(FORM.saveBtn);
+      await login(this.userToken);
+
+      const backend = this.backend;
+      await visit(`/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}`);
+
+      await click(PAGE.secretTab('Metadata'));
+      assert
+        .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
+        .hasText('Request custom metadata?');
+      await click(PAGE.metadata.requestData);
+      assert
+        .dom(GENERAL.messageError)
+        .hasTextContaining(
+          `Control Group Error A Control Group was encountered at ${backend}/data/${secretPath}.`
+        );
+      const url = find('[data-test-control-error="href"]').innerText;
+      await visit(url);
+      await grantAccess({
+        apiPath: `${backend}/data/${secretPath}`,
+        originUrl: `/vault/secrets-engines/${backend}/kv/${secretPathUrlEncoded}/metadata`,
+        userToken: this.userToken,
+        backend: this.backend,
+      });
+      await click(PAGE.metadata.requestData);
+      assert.dom(PAGE.infoRowValue('special')).hasText('secret', 'it renders custom metadata');
+    });
+  });
+
+  // patch is technically enterprise only but stubbing the version so these tests can run on both CE and enterprise
+  module('patch-persona', function (hooks) {
+    hooks.beforeEach(async function () {
+      const token = await runCmd([
+        createPolicyCmd(
+          `secret-patcher-${this.backend}`,
+          personas.secretPatcher(this.backend) + personas.secretPatcher(this.emptyBackend)
+        ),
+        createTokenCmd(`secret-patcher-${this.backend}`),
+      ]);
+      return login(token);
+    });
+
+    test('it navigates to patch a secret from overview', async function (assert) {
+      this.version.type = 'enterprise';
+      await navToBackend(this.backend);
+      await click(PAGE.list.item(secretPath));
+      await click(GENERAL.overviewCard.actionText('Patch secret'));
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.kv.secret.patch',
+        'navs to patch'
+      );
+      assertCorrectBreadcrumbs(assert, ['Secrets', this.backend, secretPath, 'Patch']);
+      assert.dom(PAGE.title).hasText('Patch Secret to New Version');
+      await click(FORM.cancelBtn);
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.kv.secret.index',
+        'navs back to overview'
+      );
+    });
+
+    test('overview subkeys card is hidden for community edition', async function (assert) {
+      this.version.type = 'community';
+      await navToBackend(this.backend);
+      await click(PAGE.list.item(secretPath));
+      assert.dom(GENERAL.overviewCard.container('Subkeys')).doesNotExist();
+    });
+
+    test('it does not redirect for ent', async function (assert) {
+      this.version.type = 'enterprise';
+      await visit(`/vault/secrets-engines/${this.backend}/kv/app%2Fnested%2Fsecret/patch`);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.backend}/kv/app%2Fnested%2Fsecret/patch`,
+        'redirects to index'
+      );
+      assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.kv.secret.patch');
+    });
+
+    test('it redirects for community edition', async function (assert) {
+      this.version.type = 'community';
+      await visit(`/vault/secrets-engines/${this.backend}/kv/app%2Fnested%2Fsecret/patch`);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${this.backend}/kv/app%2Fnested%2Fsecret`,
+        'redirects to index'
+      );
+      assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.kv.secret.index');
+    });
   });
 });
diff --git a/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-version-history-paths-test.js b/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-version-history-paths-test.js
index 82d0461ed64..ba794c297a5 100644
--- a/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-version-history-paths-test.js
+++ b/ui/tests/acceptance/secrets/backend/kv/kv-v2-workflow-version-history-paths-test.js
@@ -1,16 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { v4 as uuidv4 } from 'uuid';
 import { setupApplicationTest } from 'vault/tests/helpers';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { deleteEngineCmd, mountEngineCmd, runCmd, tokenWithPolicyCmd } from 'vault/tests/helpers/commands';
-import { personas } from 'vault/tests/helpers/policy-generator/kv';
+import { personas } from 'vault/tests/helpers/kv/policy-generator';
 import {
-  clearRecords,
   deleteVersionCmd,
   destroyVersionCmd,
   writeVersionedSecret,
@@ -37,9 +36,9 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
     this.secretPath = 'app/first-secret';
     this.urlPath = `${this.backend}/kv/${encodeURIComponent(this.secretPath)}`;
     this.navToSecret = async () => {
-      return visit(`/vault/secrets/${this.urlPath}/details?version=4`);
+      return visit(`/vault/secrets-engines/${this.urlPath}/details?version=4`);
     };
-    await authPage.login();
+    await login();
     await runCmd(mountEngineCmd('kv-v2', this.backend), false);
     await writeVersionedSecret(this.backend, this.secretPath, 'hello', 'there', 6);
     await runCmd([
@@ -49,22 +48,21 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
   });
 
   hooks.afterEach(async function () {
-    await authPage.login();
+    await login();
     return runCmd(deleteEngineCmd(this.backend));
   });
 
   module('admin persona', function (hooks) {
     hooks.beforeEach(async function () {
       const token = await runCmd(makeToken('admin', this.backend, personas.admin));
-      await authPage.login(token);
-      clearRecords(this.store);
+      return login(token);
     });
     test('can navigate to the version history page (a)', async function (assert) {
       await this.navToSecret();
       await click(PAGE.secretTab('Version History'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/metadata/versions`,
+        `/vault/secrets-engines/${this.urlPath}/metadata/versions`,
         'navigates to version history'
       );
       assert.dom(PAGE.versions.linkedBlock()).exists({ count: 6 });
@@ -81,7 +79,7 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
       await click(PAGE.versions.linkedBlock(5));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/details?version=5`,
+        `/vault/secrets-engines/${this.urlPath}/details?version=5`,
         'navigates to detail at specific version'
       );
     });
@@ -90,7 +88,7 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
       await click(PAGE.secretTab('Paths'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/paths`,
+        `/vault/secrets-engines/${this.urlPath}/paths`,
         'navigates to secret paths route'
       );
       assert.dom(PAGE.infoRow).exists({ count: 3 }, 'shows 3 rows of information');
@@ -105,8 +103,7 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
   module('data-reader persona', function (hooks) {
     hooks.beforeEach(async function () {
       const token = await runCmd(makeToken('data-reader', this.backend, personas.dataReader));
-      await authPage.login(token);
-      clearRecords(this.store);
+      return login(token);
     });
     test('cannot navigate to the version history page (dr)', async function (assert) {
       await this.navToSecret();
@@ -117,7 +114,7 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
       await click(PAGE.secretTab('Paths'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/paths`,
+        `/vault/secrets-engines/${this.urlPath}/paths`,
         'navigates to secret paths route'
       );
       assert.dom(PAGE.infoRow).exists({ count: 3 }, 'shows 3 rows of information');
@@ -132,8 +129,7 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
   module('data-list-reader persona', function (hooks) {
     hooks.beforeEach(async function () {
       const token = await runCmd(makeToken('data-list-reader', this.backend, personas.dataListReader));
-      await authPage.login(token);
-      clearRecords(this.store);
+      return login(token);
     });
     test('cannot navigate to the version history page (dlr)', async function (assert) {
       await this.navToSecret();
@@ -144,7 +140,7 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
       await click(PAGE.secretTab('Paths'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/paths`,
+        `/vault/secrets-engines/${this.urlPath}/paths`,
         'navigates to secret paths route'
       );
       assert.dom(PAGE.infoRow).exists({ count: 3 }, 'shows 3 rows of information');
@@ -159,15 +155,14 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
   module('metadata-maintainer persona', function (hooks) {
     hooks.beforeEach(async function () {
       const token = await runCmd(makeToken('metadata-maintainer', this.backend, personas.metadataMaintainer));
-      await authPage.login(token);
-      clearRecords(this.store);
+      return login(token);
     });
     test('can navigate to the version history page (mm)', async function (assert) {
       await this.navToSecret();
       await click(PAGE.secretTab('Version History'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/metadata/versions`,
+        `/vault/secrets-engines/${this.urlPath}/metadata/versions`,
         'navigates to version history'
       );
       assert.dom(PAGE.versions.linkedBlock()).exists({ count: 6 });
@@ -184,7 +179,7 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
       await click(PAGE.versions.linkedBlock(5));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/details?version=5`,
+        `/vault/secrets-engines/${this.urlPath}/details?version=5`,
         'navigates to detail at specific version'
       );
     });
@@ -193,7 +188,7 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
       await click(PAGE.secretTab('Paths'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/paths`,
+        `/vault/secrets-engines/${this.urlPath}/paths`,
         'navigates to secret paths route'
       );
       assert.dom(PAGE.infoRow).exists({ count: 3 }, 'shows 3 rows of information');
@@ -208,8 +203,7 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
   module('secret-creator persona', function (hooks) {
     hooks.beforeEach(async function () {
       const token = await runCmd(makeToken('secret-creator', this.backend, personas.secretCreator));
-      await authPage.login(token);
-      clearRecords(this.store);
+      return login(token);
     });
     test('cannot navigate to the version history page (sc)', async function (assert) {
       await this.navToSecret();
@@ -220,7 +214,7 @@ module('Acceptance | kv-v2 workflow | version history, paths', function (hooks)
       await click(PAGE.secretTab('Paths'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/paths`,
+        `/vault/secrets-engines/${this.urlPath}/paths`,
         'navigates to secret paths route'
       );
       assert.dom(PAGE.infoRow).exists({ count: 3 }, 'shows 3 rows of information');
@@ -255,8 +249,7 @@ path "${this.backend}/*" {
 `;
       const { userToken } = await setupControlGroup({ userPolicy, backend: this.backend });
       this.userToken = userToken;
-      await authPage.login(userToken);
-      clearRecords(this.store);
+      return login(userToken);
     });
     test('can navigate to the version history page (cg)', async function (assert) {
       await this.navToSecret();
@@ -267,19 +260,19 @@ path "${this.backend}/*" {
       );
       await grantAccess({
         apiPath: `${this.backend}/metadata/${this.secretPath}`,
-        originUrl: `/vault/secrets/${this.urlPath}/details`,
+        originUrl: `/vault/secrets-engines/${this.urlPath}/details`,
         userToken: this.userToken,
         backend: this.backend,
       });
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/details`,
+        `/vault/secrets-engines/${this.urlPath}/details`,
         'navigates back to secret overview after authorized'
       );
       await click(PAGE.secretTab('Version History'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/metadata/versions`,
+        `/vault/secrets-engines/${this.urlPath}/metadata/versions`,
         'goes to version history page'
       );
       assert.dom(PAGE.versions.linkedBlock()).exists({ count: 6 });
@@ -296,7 +289,7 @@ path "${this.backend}/*" {
       await click(PAGE.versions.linkedBlock(5));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/details?version=5`,
+        `/vault/secrets-engines/${this.urlPath}/details?version=5`,
         'navigates to detail at specific version'
       );
     });
@@ -305,7 +298,7 @@ path "${this.backend}/*" {
       await click(PAGE.secretTab('Paths'));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.urlPath}/paths`,
+        `/vault/secrets-engines/${this.urlPath}/paths`,
         'navigates to secret paths route'
       );
       assert.dom(PAGE.infoRow).exists({ count: 3 }, 'shows 3 rows of information');
diff --git a/ui/tests/acceptance/secrets/backend/kv/secret-test.js b/ui/tests/acceptance/secrets/backend/kv/secret-test.js
index ab1df048942..9022bbf8532 100644
--- a/ui/tests/acceptance/secrets/backend/kv/secret-test.js
+++ b/ui/tests/acceptance/secrets/backend/kv/secret-test.js
@@ -1,27 +1,28 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { click, visit, settled, currentURL, currentRouteName, fillIn } from '@ember/test-helpers';
+import { click, visit, settled, currentURL, currentRouteName, fillIn, waitFor } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 
-import editPage from 'vault/tests/pages/secrets/backend/kv/edit-secret';
 import showPage from 'vault/tests/pages/secrets/backend/kv/show';
 import listPage from 'vault/tests/pages/secrets/backend/list';
 
 import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
-import authPage from 'vault/tests/pages/auth';
-import logout from 'vault/tests/pages/logout';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { writeSecret, writeVersionedSecret } from 'vault/tests/helpers/kv/kv-run-commands';
 import { runCmd } from 'vault/tests/helpers/commands';
 import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
+import codemirror, { setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SS } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { createSecret } from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
 
 const deleteEngine = async function (enginePath, assert) {
-  await logout.visit();
-  await authPage.login();
+  await login();
 
   const response = await runCmd([`delete sys/mounts/${enginePath}`]);
   assert.strictEqual(
@@ -36,7 +37,7 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
 
   hooks.beforeEach(async function () {
     this.uid = uuidv4();
-    await authPage.login();
+    await login();
   });
 
   module('mount and configure', function () {
@@ -46,15 +47,16 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
       const enginePath = `kv-secret-${this.uid}`;
       const maxVersion = '101';
       await mountSecrets.visit();
-      await click('[data-test-mount-type="kv"]');
+      await click(GENERAL.cardContainer('kv'));
+      await fillIn(GENERAL.inputByAttr('path'), enginePath);
 
-      await fillIn('[data-test-input="path"]', enginePath);
-      await fillIn('[data-test-input="maxVersions"]', maxVersion);
-      await click('[data-test-input="casRequired"]');
-      await click('[data-test-toggle-label="Automate secret deletion"]');
-      await fillIn('[data-test-select="ttl-unit"]', 's');
-      await fillIn('[data-test-ttl-value="Automate secret deletion"]', '1');
-      await click('[data-test-mount-submit="true"]');
+      await fillIn(GENERAL.inputByAttr('kv_config.max_versions'), maxVersion);
+      await click(GENERAL.inputByAttr('kv_config.cas_required'));
+      await click(GENERAL.ttl.toggle('Automate secret deletion'));
+      await fillIn(GENERAL.selectByAttr('ttl-unit'), 's');
+      await fillIn(GENERAL.ttl.input('Automate secret deletion'), '1');
+
+      await click(GENERAL.submitButton);
 
       await click(PAGE.secretTab('Configuration'));
 
@@ -67,6 +69,8 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
       assert
         .dom(PAGE.infoRowValue('Automate secret deletion'))
         .hasText('1 second', 'displays the delete version after set when configuring the secret-engine');
+      // [BANDAID] avoid error from missing param for links in SecretEdit > KeyValueHeader
+      await visit('/vault/secrets-engines');
       await deleteEngine(enginePath, assert);
     });
 
@@ -76,6 +80,8 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
       await runCmd(['vault write sys/mounts/test type=kv', 'refresh', 'vault write test/a keys=a keys=b']);
       await showPage.visit({ backend: 'test', id: 'a' });
       assert.ok(showPage.editIsPresent, 'renders the page properly');
+      // [BANDAID] avoid error from missing param for links in SecretEdit > KeyValueHeader
+      await visit('/vault/secrets-engines');
       await deleteEngine('test', assert);
     });
   });
@@ -96,19 +102,19 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
         `Success! Data written to: ${this.backend}/config`,
         'Engine successfully updated'
       );
-      await visit(`/vault/secrets/kv/list`);
+      await visit(`/vault/secrets-engines/kv/list`);
       await writeSecret(this.backend, secretPath, 'foo', 'bar');
       assert.strictEqual(
         currentRouteName(),
-        'vault.cluster.secrets.backend.kv.secret.details.index',
-        'redirects to the show page'
+        'vault.cluster.secrets.backend.kv.secret.index',
+        'redirects to the overview page'
       );
-      assert.dom(PAGE.detail.createNewVersion).exists('shows the edit button');
     });
     test('it navigates to version history and to a specific version', async function (assert) {
       assert.expect(4);
       const secretPath = `specific-version`;
       await writeVersionedSecret(this.backend, secretPath, 'foo', 'bar', 4);
+      await click(PAGE.secretTab('Secret'));
       assert
         .dom(PAGE.detail.versionTimestamp)
         .includesText('Version 4 created', 'shows version created time');
@@ -120,7 +126,7 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.backend}/kv/${secretPath}/details?version=2`,
+        `/vault/secrets-engines/${this.backend}/kv/${secretPath}/details?version=2`,
         'redirects to the show page with queryParam version=2'
       );
     });
@@ -131,8 +137,11 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
       this.backend = `kv-v1-${this.uid}`;
       // mount version 1 engine
       await mountSecrets.visit();
-      await mountSecrets.selectType('kv');
-      await mountSecrets.path(this.backend).toggleOptions().version(1).submit();
+      await click(GENERAL.cardContainer('kv'));
+      await fillIn(GENERAL.inputByAttr('path'), this.backend);
+      await click(GENERAL.button('Method Options'));
+      await mountSecrets.version(1);
+      await click(GENERAL.submitButton);
     });
     hooks.afterEach(async function () {
       await runCmd([`delete sys/mounts/${this.backend}`]);
@@ -140,8 +149,8 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
     test('version 1 performs the correct capabilities lookup', async function (assert) {
       // TODO: while this should pass it doesn't really do anything anymore for us as v1 and v2 are completely separate.
       const secretPath = 'foo/bar';
-      await listPage.create();
-      await editPage.createSecret(secretPath, 'foo', 'bar');
+      await click(SS.createSecretLink);
+      await createSecret(secretPath, 'foo', 'bar');
       assert.strictEqual(
         currentRouteName(),
         'vault.cluster.secrets.backend.show',
@@ -152,55 +161,63 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
     // https://github.com/hashicorp/vault/issues/5960
     test('version 1: nested paths creation maintains ability to navigate the tree', async function (assert) {
       const enginePath = this.backend;
-      const secretPath = '1/2/3/4';
-      await listPage.create();
-      await editPage.createSecret(secretPath, 'foo', 'bar');
-
-      // setup an ancestor for when we delete
-      await listPage.visitRoot({ backend: enginePath });
-      await listPage.secrets.filterBy('text', '1/')[0].click();
-      await listPage.create();
-      await editPage.createSecret('1/2', 'foo', 'bar');
-
-      // lol we have to do this because ember-cli-page-object doesn't like *'s in visitable
-      await listPage.visitRoot({ backend: enginePath });
-      await listPage.secrets.filterBy('text', '1/')[0].click();
-      await listPage.secrets.filterBy('text', '2/')[0].click();
-      await listPage.secrets.filterBy('text', '3/')[0].click();
-      await listPage.create();
-
-      await editPage.createSecret(secretPath + 'a', 'foo', 'bar');
-      await listPage.visitRoot({ backend: enginePath });
-      await listPage.secrets.filterBy('text', '1/')[0].click();
-      await listPage.secrets.filterBy('text', '2/')[0].click();
-      const secretLink = listPage.secrets.filterBy('text', '3/')[0];
-      assert.ok(secretLink, 'link to the 3/ branch displays properly');
-
-      await listPage.secrets.filterBy('text', '3/')[0].click();
-      await listPage.secrets.objectAt(0).menuToggle();
-      await settled();
-      await listPage.delete();
-      await listPage.confirmDelete();
+      await runCmd([
+        `write ${enginePath}/1/2 foo=bar`,
+        `write ${enginePath}/1/2/3/4 foo=bar`,
+        `write ${enginePath}/1/2/3/4a foo=bar`,
+        'refresh',
+      ]);
       await settled();
+      // navigate to farthest leaf
+      await visit(`/vault/secrets-engines/${enginePath}/list`);
+      assert.dom('[data-test-component="navigate-input"]').hasNoValue();
+      assert.dom(SS.secretLink()).exists({ count: 1 });
+      await click(SS.secretLink('1/'));
+      assert.dom('[data-test-component="navigate-input"]').hasValue('1/');
+      assert.dom(SS.secretLink()).exists({ count: 2 });
+      await click(SS.secretLink('1/2/'));
+      assert.dom('[data-test-component="navigate-input"]').hasValue('1/2/');
+      assert.dom(SS.secretLink()).exists({ count: 1 });
+      await click(SS.secretLink('1/2/3/'));
+      assert.dom('[data-test-component="navigate-input"]').hasValue('1/2/3/');
+      assert.dom(SS.secretLink()).exists({ count: 2 });
+
+      // delete the items
+      await click(SS.secretLinkMenu('1/2/3/4'));
+      await click(`${SS.secretLink('1/2/3/4')} ${GENERAL.confirmTrigger}`);
+      await click(GENERAL.confirmButton);
       assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.list');
-      assert.strictEqual(currentURL(), `/vault/secrets/${enginePath}/list/1/2/3/`, 'remains on the page');
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${enginePath}/list/1/2/3/`,
+        'remains on the page'
+      );
+      assert.dom(SS.secretLink()).exists({ count: 1 });
 
       await listPage.secrets.objectAt(0).menuToggle();
-      await listPage.delete();
-      await listPage.confirmDelete();
-      await settled();
-      assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.backend.list');
+      await click(GENERAL.confirmTrigger);
+      await click(GENERAL.confirmButton);
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${enginePath}/list/1/`,
-        'navigates to the ancestor created earlier'
+        `/vault/secrets-engines/${enginePath}/list/1/2/3/`,
+        'remains on the page'
       );
+      assert.dom(GENERAL.emptyStateTitle).hasText('No secrets under "1/2/3/".');
+
+      await fillIn('[data-test-component="navigate-input"]', '1/2/');
+      assert.dom(GENERAL.emptyStateTitle).hasText('No secrets under "1/2/".');
+
+      await click('[data-test-list-root-link]');
+      assert.strictEqual(currentURL(), `/vault/secrets-engines/${enginePath}/list`);
+      assert.dom(SS.secretLink()).exists({ count: 1 });
     });
+
     test('first level secrets redirect properly upon deletion', async function (assert) {
       const secretPath = 'test';
-      await listPage.create();
-      await editPage.createSecret(secretPath, 'foo', 'bar');
-      await showPage.deleteSecretV1();
+      await click(SS.createSecretLink);
+      await createSecret(secretPath, 'foo', 'bar');
+      await click(GENERAL.confirmTrigger);
+      await click(GENERAL.confirmButton);
       assert.strictEqual(
         currentRouteName(),
         'vault.cluster.secrets.backend.list-root',
@@ -213,7 +230,7 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
         '(',
         ')',
         '"',
-        //"'",
+        // "'",
         '!',
         '#',
         '$',
@@ -237,18 +254,20 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
       await runCmd([...commands, 'refresh']);
       for (const path of paths) {
         await listPage.visit({ backend, id: path });
-        assert.ok(listPage.secrets.filterBy('text', '2')[0], `${path}: secret is displayed properly`);
-        await listPage.secrets.filterBy('text', '2')[0].click();
+        assert.dom(SS.secretLinkATag()).hasText('2', `${path}: secret is displayed properly`);
+        await click(SS.secretLink());
         assert.strictEqual(
           currentRouteName(),
           'vault.cluster.secrets.backend.show',
           `${path}: show page renders correctly`
         );
       }
+      // [BANDAID] avoid error from missing param for links in SecretEdit > KeyValueHeader
+      await visit('/vault/secrets-engines');
       await deleteEngine(backend, assert);
     });
 
-    test('UI handles secret with % in path correctly', async function (assert) {
+    test('KVv1 handles secret with % in path correctly', async function (assert) {
       const enginePath = this.backend;
       const secretPath = 'per%cent/%fu ll';
       const [firstPath, secondPath] = secretPath.split('/');
@@ -257,28 +276,28 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
       await listPage.visitRoot({ backend: enginePath });
       await settled();
 
-      assert.dom(`[data-test-secret-link="${firstPath}/"]`).exists('First section item exists');
-      await click(`[data-test-secret-link="${firstPath}/"]`);
+      assert.dom(SS.secretLink(`${firstPath}/`)).exists('First section item exists');
+      await click(SS.secretLink(`${firstPath}/`));
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${enginePath}/list/${encodeURIComponent(firstPath)}/`,
+        `/vault/secrets-engines/${enginePath}/list/${encodeURIComponent(firstPath)}/`,
         'First part of path is encoded in URL'
       );
-      assert.dom(`[data-test-secret-link="${secretPath}"]`).exists('Link to secret exists');
-      await click(`[data-test-secret-link="${secretPath}"]`);
+      assert.dom(SS.secretLink(secretPath)).exists('Link to secret exists');
+      await click(SS.secretLink(secretPath));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${enginePath}/show/${encodeURIComponent(firstPath)}/${encodeURIComponent(
+        `/vault/secrets-engines/${enginePath}/show/${encodeURIComponent(firstPath)}/${encodeURIComponent(
           secondPath
         )}`,
         'secret path is encoded in URL'
       );
       assert.dom('h1').hasText(secretPath, 'Path renders correctly on show page');
-      await click(`[data-test-secret-breadcrumb="${firstPath}"] a`);
+      await click(SS.crumb(firstPath));
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${enginePath}/list/${encodeURIComponent(firstPath)}/`,
+        `/vault/secrets-engines/${enginePath}/list/${encodeURIComponent(firstPath)}/`,
         'Breadcrumb link encodes correctly'
       );
     });
@@ -290,11 +309,11 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
       const paths = ["'some", '"some'];
       for (const path of paths) {
         await listPage.visitRoot({ backend });
-        await listPage.create();
-        await editPage.createSecret(`${path}/2`, 'foo', 'bar');
+        await click(SS.createSecretLink);
+        await createSecret(`${path}/2`, 'foo', 'bar');
         await listPage.visit({ backend, id: path });
-        assert.ok(listPage.secrets.filterBy('text', '2')[0], `${path}: secret is displayed properly`);
-        await listPage.secrets.filterBy('text', '2')[0].click();
+        assert.dom(SS.secretLinkATag()).hasText('2', `${path}: secret is displayed properly`);
+        await click(SS.secretLink());
         assert.strictEqual(
           currentRouteName(),
           'vault.cluster.secrets.backend.show',
@@ -318,7 +337,7 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
       await listPage.filterInput('filter/foo1');
       assert.strictEqual(listPage.secrets.length, 1, 'renders only one secret');
       await listPage.secrets.objectAt(0).click();
-      await click('[data-test-secret-breadcrumb="filter"] a');
+      await click(SS.crumb('filter'));
       assert.strictEqual(listPage.secrets.length, 3, 'renders three secrets');
       assert.strictEqual(listPage.filterInputValue, 'filter/', 'pageFilter has been reset');
     });
@@ -327,11 +346,15 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
       const content = JSON.stringify({ foo: 'fa', bar: 'boo' });
       const secretPath = `kv-json-${this.uid}`;
       await listPage.visitRoot({ backend: this.backend });
-      await listPage.create();
-      await editPage.path(secretPath).toggleJSON();
-      const instance = document.querySelector('.CodeMirror').CodeMirror;
-      instance.setValue(content);
-      await editPage.save();
+      await click(SS.createSecretLink);
+      await fillIn(SS.secretPath('create'), secretPath);
+      await click(GENERAL.toggleInput('json'));
+
+      await waitFor('.cm-editor');
+      const editor = codemirror();
+      setCodeEditorValue(editor, content);
+
+      await click(GENERAL.submitButton);
 
       assert.strictEqual(
         currentRouteName(),
@@ -339,12 +362,12 @@ module('Acceptance | secrets/secret/create, read, delete', function (hooks) {
         'redirects to the show page'
       );
       assert.ok(showPage.editIsPresent, 'shows the edit button');
-      const savedInstance = document.querySelector('.CodeMirror').CodeMirror;
-      assert.strictEqual(
-        savedInstance.options.value,
-        JSON.stringify({ bar: 'boo', foo: 'fa' }, null, 2),
-        'saves the content'
-      );
+      assert
+        .dom('.hds-code-block')
+        .includesText(
+          `Secret Data ${JSON.stringify({ bar: 'boo', foo: 'fa' }, null, 2).replace(/\n\s*/g, ' ').trim()}`,
+          'shows the secret data'
+        );
     });
   });
 });
diff --git a/ui/tests/acceptance/secrets/backend/ldap/libraries-test.js b/ui/tests/acceptance/secrets/backend/ldap/libraries-test.js
index d8bd65b0094..3be1f86cfc8 100644
--- a/ui/tests/acceptance/secrets/backend/ldap/libraries-test.js
+++ b/ui/tests/acceptance/secrets/backend/ldap/libraries-test.js
@@ -1,16 +1,20 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { v4 as uuidv4 } from 'uuid';
 import ldapMirageScenario from 'vault/mirage/scenarios/ldap';
 import ldapHandlers from 'vault/mirage/handlers/ldap';
-import authPage from 'vault/tests/pages/auth';
-import { click } from '@ember/test-helpers';
-import { isURL, visitURL } from 'vault/tests/helpers/ldap';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { click, currentURL } from '@ember/test-helpers';
+import { isURL, visitURL } from 'vault/tests/helpers/ldap/ldap-helpers';
+import { deleteEngineCmd, mountEngineCmd, runCmd } from 'vault/tests/helpers/commands';
+import { LDAP_SELECTORS } from 'vault/tests/helpers/ldap/ldap-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Acceptance | ldap | libraries', function (hooks) {
   setupApplicationTest(hooks);
@@ -19,35 +23,74 @@ module('Acceptance | ldap | libraries', function (hooks) {
   hooks.beforeEach(async function () {
     ldapHandlers(this.server);
     ldapMirageScenario(this.server);
-    await authPage.login();
-    return visitURL('libraries');
+    this.backend = `ldap-test-${uuidv4()}`;
+    await login();
+    // mount & configure
+    await runCmd([
+      mountEngineCmd('ldap', this.backend),
+      `write ${this.backend}/config binddn=foo bindpass=bar url=http://localhost:8208`,
+    ]);
+    return visitURL('libraries', this.backend);
+  });
+
+  hooks.afterEach(async function () {
+    await runCmd(deleteEngineCmd(this.backend));
+  });
+
+  test('it should show libraries on overview page', async function (assert) {
+    await visitURL('overview', this.backend);
+    assert.dom('[data-test-libraries-count]').hasText('2');
   });
 
   test('it should transition to create library route on toolbar link click', async function (assert) {
     await click('[data-test-toolbar-action="library"]');
-    assert.true(isURL('libraries/create'), 'Transitions to library create route on toolbar link click');
+    assert.true(
+      isURL('libraries/create', this.backend),
+      'Transitions to library create route on toolbar link click'
+    );
   });
 
   test('it should transition to library details route on list item click', async function (assert) {
-    await click('[data-test-list-item-link] a');
-    assert.true(
-      isURL('libraries/test-library/details/accounts'),
+    await click(LDAP_SELECTORS.libraryItem('test-library'));
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.backend}/ldap/libraries/test-library/details/accounts`,
       'Transitions to library details accounts route on list item click'
     );
+    assert.dom('[data-test-account-name]').exists({ count: 2 }, 'lists the accounts');
+    assert.dom('[data-test-checked-out-account]').exists({ count: 1 }, 'lists the checked out accounts');
+  });
+
+  test('it should transition to library details for hierarchical list items', async function (assert) {
+    await click(LDAP_SELECTORS.libraryItem('admin/'));
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.backend}/ldap/libraries/subdirectory/admin/`,
+      'Transitions to subdirectory list view'
+    );
+
+    await click(LDAP_SELECTORS.libraryItem('admin/test-library'));
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.backend}/ldap/libraries/admin%2Ftest-library/details/accounts`,
+      'Transitions to child library details accounts'
+    );
+    assert.dom('[data-test-account-name]').exists({ count: 2 }, 'lists the accounts');
+    assert.dom('[data-test-checked-out-account]').exists({ count: 1 }, 'lists the checked out accounts');
   });
 
   test('it should transition to routes from list item action menu', async function (assert) {
     assert.expect(2);
 
     for (const action of ['edit', 'details']) {
-      await click('[data-test-popup-menu-trigger]');
+      await click(GENERAL.menuTrigger);
       await click(`[data-test-${action}]`);
       const uri = action === 'details' ? 'details/accounts' : action;
       assert.true(
-        isURL(`libraries/test-library/${uri}`),
+        isURL(`libraries/test-library/${uri}`, this.backend),
         `Transitions to ${action} route on list item action menu click`
       );
-      await click('[data-test-breadcrumb="libraries"] a');
+      await click('[data-test-breadcrumb="Libraries"] a');
     }
   });
 
@@ -55,13 +98,13 @@ module('Acceptance | ldap | libraries', function (hooks) {
     await click('[data-test-list-item-link] a');
     await click('[data-test-tab="config"]');
     assert.true(
-      isURL('libraries/test-library/details/configuration'),
+      isURL('libraries/test-library/details/configuration', this.backend),
       'Transitions to configuration route on tab click'
     );
 
     await click('[data-test-tab="accounts"]');
     assert.true(
-      isURL('libraries/test-library/details/accounts'),
+      isURL('libraries/test-library/details/accounts', this.backend),
       'Transitions to accounts route on tab click'
     );
   });
@@ -69,6 +112,9 @@ module('Acceptance | ldap | libraries', function (hooks) {
   test('it should transition to routes from library details toolbar links', async function (assert) {
     await click('[data-test-list-item-link] a');
     await click('[data-test-edit]');
-    assert.true(isURL('libraries/test-library/edit'), 'Transitions to credentials route from toolbar link');
+    assert.true(
+      isURL('libraries/test-library/edit', this.backend),
+      'Transitions to credentials route from toolbar link'
+    );
   });
 });
diff --git a/ui/tests/acceptance/secrets/backend/ldap/overview-test.js b/ui/tests/acceptance/secrets/backend/ldap/overview-test.js
index 726ff8ddbae..d4c7dd9a85c 100644
--- a/ui/tests/acceptance/secrets/backend/ldap/overview-test.js
+++ b/ui/tests/acceptance/secrets/backend/ldap/overview-test.js
@@ -1,17 +1,20 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { v4 as uuidv4 } from 'uuid';
 import ldapMirageScenario from 'vault/mirage/scenarios/ldap';
 import ldapHandlers from 'vault/mirage/handlers/ldap';
-import authPage from 'vault/tests/pages/auth';
-import { click, fillIn, visit } from '@ember/test-helpers';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { click, visit } from '@ember/test-helpers';
 import { selectChoose } from 'ember-power-select/test-support';
-import { isURL, visitURL } from 'vault/tests/helpers/ldap';
+import { isURL, visitURL } from 'vault/tests/helpers/ldap/ldap-helpers';
+import { deleteEngineCmd, mountEngineCmd, runCmd } from 'vault/tests/helpers/commands';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
 
 module('Acceptance | ldap | overview', function (hooks) {
   setupApplicationTest(hooks);
@@ -19,77 +22,99 @@ module('Acceptance | ldap | overview', function (hooks) {
 
   hooks.beforeEach(async function () {
     ldapHandlers(this.server);
-    return authPage.login();
+    this.backend = `ldap-test-${uuidv4()}`;
+    this.mountAndConfig = (backend) => {
+      return runCmd([
+        mountEngineCmd('ldap', backend),
+        `write ${backend}/config binddn=foo bindpass=bar url=http://localhost:8208`,
+      ]);
+    };
+    return login();
   });
 
   test('it should transition to ldap overview on mount success', async function (assert) {
-    await visit('/vault/secrets');
+    const backend = 'ldap-test-mount';
+    await visit('/vault/secrets-engines');
     await click('[data-test-enable-engine]');
-    await click('[data-test-mount-type="ldap"]');
-    await fillIn('[data-test-input="path"]', 'ldap-test');
-    await click('[data-test-mount-submit]');
-    assert.true(isURL('overview'), 'Transitions to ldap overview route on mount success');
+    await mountBackend('ldap', backend);
+    assert.true(isURL('overview', backend), 'Transitions to ldap overview route on mount success');
+    assert.dom('[data-test-header-title]').hasText(backend);
+    // cleanup mounted engine
+    await visit('/vault/secrets-engines');
+    await runCmd(deleteEngineCmd(backend));
   });
 
   test('it should transition to routes on tab link click', async function (assert) {
     assert.expect(4);
+    await this.mountAndConfig(this.backend);
 
-    await visitURL('overview');
+    await visitURL('overview', this.backend);
 
     for (const tab of ['roles', 'libraries', 'config', 'overview']) {
       await click(`[data-test-tab="${tab}"]`);
       const route = tab === 'config' ? 'configuration' : tab;
-      assert.true(isURL(route), `Transitions to ${route} route on tab link click`);
+      assert.true(isURL(route, this.backend), `Transitions to ${route} route on tab link click`);
     }
   });
 
   test('it should transition to configuration route when engine is not configured', async function (assert) {
-    await visitURL('overview');
+    await runCmd(mountEngineCmd('ldap', this.backend));
+    await visitURL('overview', this.backend);
     await click('[data-test-config-cta] a');
-    assert.true(isURL('configure'), 'Transitions to configure route on cta link click');
+    assert.true(isURL('configure', this.backend), 'Transitions to configure route on cta link click');
 
-    await click('[data-test-breadcrumb="ldap-test"] a');
+    await click(`[data-test-breadcrumb="${this.backend}"] a`);
     await click('[data-test-toolbar-action="config"]');
-    assert.true(isURL('configure'), 'Transitions to configure route on toolbar link click');
+    assert.true(isURL('configure', this.backend), 'Transitions to configure route on toolbar link click');
   });
   // including a test for the configuration route here since it is the only one needed
   test('it should transition to configuration edit on toolbar link click', async function (assert) {
     ldapMirageScenario(this.server);
-    await visitURL('overview');
+    await this.mountAndConfig(this.backend);
+    await visitURL('overview', this.backend);
     await click('[data-test-tab="config"]');
     await click('[data-test-toolbar-config-action]');
-    assert.true(isURL('configure'), 'Transitions to configure route on toolbar link click');
+    assert.true(isURL('configure', this.backend), 'Transitions to configure route on toolbar link click');
   });
 
   test('it should transition to create role route on card action link click', async function (assert) {
     ldapMirageScenario(this.server);
-    await visitURL('overview');
+    await this.mountAndConfig(this.backend);
+    await visitURL('overview', this.backend);
     await click('[data-test-overview-card="Roles"] a');
-    assert.true(isURL('roles/create'), 'Transitions to role create route on card action link click');
+    assert.true(
+      isURL('roles/create', this.backend),
+      'Transitions to role create route on card action link click'
+    );
   });
 
   test('it should transition to create library route on card action link click', async function (assert) {
     ldapMirageScenario(this.server);
-    await visitURL('overview');
+    await this.mountAndConfig(this.backend);
+    await visitURL('overview', this.backend);
     await click('[data-test-overview-card="Libraries"] a');
-    assert.true(isURL('libraries/create'), 'Transitions to library create route on card action link click');
+    assert.true(
+      isURL('libraries/create', this.backend),
+      'Transitions to library create route on card action link click'
+    );
   });
 
   test('it should transition to role credentials route on generate credentials action', async function (assert) {
     ldapMirageScenario(this.server);
-    await visitURL('overview');
+    await this.mountAndConfig(this.backend);
+    await visitURL('overview', this.backend);
     await selectChoose('.search-select', 'static-role');
     await click('[data-test-generate-credential-button]');
     assert.true(
-      isURL('roles/static/static-role/credentials'),
+      isURL('roles/static/static-role/credentials', this.backend),
       'Transitions to role credentials route on generate credentials action'
     );
 
-    await click('[data-test-breadcrumb="ldap-test"] a');
+    await click(`[data-test-breadcrumb="${this.backend}"] a`);
     await selectChoose('.search-select', 'dynamic-role');
     await click('[data-test-generate-credential-button]');
     assert.true(
-      isURL('roles/dynamic/dynamic-role/credentials'),
+      isURL('roles/dynamic/dynamic-role/credentials', this.backend),
       'Transitions to role credentials route on generate credentials action'
     );
   });
diff --git a/ui/tests/acceptance/secrets/backend/ldap/roles-test.js b/ui/tests/acceptance/secrets/backend/ldap/roles-test.js
index 5c0551e36d9..d028c9bfb3a 100644
--- a/ui/tests/acceptance/secrets/backend/ldap/roles-test.js
+++ b/ui/tests/acceptance/secrets/backend/ldap/roles-test.js
@@ -1,16 +1,20 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { v4 as uuidv4 } from 'uuid';
 import ldapMirageScenario from 'vault/mirage/scenarios/ldap';
 import ldapHandlers from 'vault/mirage/handlers/ldap';
-import authPage from 'vault/tests/pages/auth';
-import { click, fillIn } from '@ember/test-helpers';
-import { isURL, visitURL } from 'vault/tests/helpers/ldap';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { click, fillIn, waitFor } from '@ember/test-helpers';
+import { assertURL, isURL, visitURL } from 'vault/tests/helpers/ldap/ldap-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { deleteEngineCmd, mountEngineCmd, runCmd } from 'vault/tests/helpers/commands';
+import { LDAP_SELECTORS } from 'vault/tests/helpers/ldap/ldap-selectors';
 
 module('Acceptance | ldap | roles', function (hooks) {
   setupApplicationTest(hooks);
@@ -19,56 +23,81 @@ module('Acceptance | ldap | roles', function (hooks) {
   hooks.beforeEach(async function () {
     ldapHandlers(this.server);
     ldapMirageScenario(this.server);
-    await authPage.login();
-    return visitURL('roles');
+    this.backend = `ldap-test-${uuidv4()}`;
+    await login();
+    // mount & configure
+    await runCmd([
+      mountEngineCmd('ldap', this.backend),
+      `write ${this.backend}/config binddn=foo bindpass=bar url=http://localhost:8208`,
+    ]);
+    return visitURL('roles', this.backend);
+  });
+
+  hooks.afterEach(async function () {
+    await runCmd(deleteEngineCmd(this.backend));
   });
 
   test('it should transition to create role route on toolbar link click', async function (assert) {
     await click('[data-test-toolbar-action="role"]');
-    assert.true(isURL('roles/create'), 'Transitions to role create route on toolbar link click');
+    assert.true(
+      isURL('roles/create', this.backend),
+      'Transitions to role create route on toolbar link click'
+    );
   });
 
   test('it should transition to role details route on list item click', async function (assert) {
-    await click('[data-test-list-item-link]:nth-of-type(1) a');
-    assert.true(
-      isURL('roles/dynamic/dynamic-role/details'),
-      'Transitions to role details route on list item click'
-    );
+    let path;
 
-    await click('[data-test-breadcrumb="roles"] a');
-    await click('[data-test-list-item-link]:nth-of-type(2) a');
-    assert.true(
-      isURL('roles/static/static-role/details'),
-      'Transitions to role details route on list item click'
-    );
+    await click(LDAP_SELECTORS.roleItem('dynamic', 'dynamic-role'));
+    path = 'roles/dynamic/dynamic-role/details';
+    assertURL(assert, this.backend, path);
+    await click(GENERAL.breadcrumbLink('Roles'));
+
+    await click(LDAP_SELECTORS.roleItem('static', 'static-role'));
+    path = 'roles/static/static-role/details';
+    assertURL(assert, this.backend, path);
+    await click(GENERAL.breadcrumbLink('Roles'));
+
+    // edge case, roles of different type with same name
+    await click(LDAP_SELECTORS.roleItem('dynamic', 'my-role'));
+    path = 'roles/dynamic/my-role/details';
+    assertURL(assert, this.backend, path);
+    await click(GENERAL.breadcrumbLink('Roles'));
+
+    await click(LDAP_SELECTORS.roleItem('static', 'my-role'));
+    path = 'roles/static/my-role/details';
+    assertURL(assert, this.backend, path);
   });
 
   test('it should transition to routes from list item action menu', async function (assert) {
     assert.expect(3);
 
     for (const action of ['edit', 'get-creds', 'details']) {
-      await click('[data-test-popup-menu-trigger]');
-      await click(`[data-test-${action}]`);
+      await click(LDAP_SELECTORS.roleMenu('dynamic', 'dynamic-role'));
+      await click(LDAP_SELECTORS.action(action));
       const uri = action === 'get-creds' ? 'credentials' : action;
       assert.true(
-        isURL(`roles/dynamic/dynamic-role/${uri}`),
+        isURL(`roles/dynamic/dynamic-role/${uri}`, this.backend),
         `Transitions to ${uri} route on list item action menu click`
       );
-      await click('[data-test-breadcrumb="roles"] a');
+      await click(GENERAL.breadcrumbLink('Roles'));
     }
   });
 
   test('it should transition to routes from role details toolbar links', async function (assert) {
-    await click('[data-test-list-item-link]:nth-of-type(1) a');
-    await click('[data-test-get-credentials]');
+    await click(LDAP_SELECTORS.roleItem('dynamic', 'dynamic-role'));
+    await click(GENERAL.button('Get credentials'));
     assert.true(
-      isURL('roles/dynamic/dynamic-role/credentials'),
+      isURL('roles/dynamic/dynamic-role/credentials', this.backend),
       'Transitions to credentials route from toolbar link'
     );
 
     await click('[data-test-breadcrumb="dynamic-role"] a');
     await click('[data-test-edit]');
-    assert.true(isURL('roles/dynamic/dynamic-role/edit'), 'Transitions to edit route from toolbar link');
+    assert.true(
+      isURL('roles/dynamic/dynamic-role/edit', this.backend),
+      'Transitions to edit route from toolbar link'
+    );
   });
 
   test('it should clear roles page filter value on route exit', async function (assert) {
@@ -76,8 +105,65 @@ module('Acceptance | ldap | roles', function (hooks) {
     assert
       .dom('[data-test-filter-input]')
       .hasValue('foo', 'Roles page filter value set after model refresh and rerender');
+    await waitFor(GENERAL.emptyStateTitle);
     await click('[data-test-tab="libraries"]');
     await click('[data-test-tab="roles"]');
     assert.dom('[data-test-filter-input]').hasNoValue('Roles page filter value cleared on route exit');
   });
+
+  module('subdirectory', function () {
+    test('it navigates to hierarchical roles', async function (assert) {
+      let path;
+      // hierarchical paths
+      await click(LDAP_SELECTORS.roleItem('dynamic', 'admin/'));
+      path = 'roles/dynamic/subdirectory/admin/';
+      assertURL(assert, this.backend, path);
+
+      await click(LDAP_SELECTORS.roleItem('dynamic', 'child-dynamic-role'));
+      path = 'roles/dynamic/admin%2Fchild-dynamic-role/details';
+      assertURL(assert, this.backend, path);
+
+      // navigate out via breadcrumbs to test
+      await click(GENERAL.breadcrumbLink('admin'));
+      path = 'roles/dynamic/subdirectory/admin/';
+      assertURL(assert, this.backend, path);
+
+      await click(GENERAL.breadcrumbLink('Roles'));
+
+      await click(LDAP_SELECTORS.roleItem('static', 'admin/'));
+      path = 'roles/static/subdirectory/admin/';
+      assertURL(assert, this.backend, path);
+      await click(LDAP_SELECTORS.roleItem('static', 'child-static-role'));
+      path = 'roles/static/admin%2Fchild-static-role/details';
+      assertURL(assert, this.backend, path);
+
+      // navigate out via breadcrumbs to test
+      await click(GENERAL.breadcrumbLink('admin'));
+      path = 'roles/static/subdirectory/admin/';
+      assertURL(assert, this.backend, path);
+    });
+
+    test('it should transition to subdirectory from hierarchical role popup menu', async function (assert) {
+      assert.expect(4);
+
+      await click(LDAP_SELECTORS.roleMenu('dynamic', 'admin/'));
+      for (const action of ['edit', 'get-creds', 'details']) {
+        assert.dom(LDAP_SELECTORS.action(action)).doesNotExist(`${action} does not render in popup menu`);
+      }
+      await click(LDAP_SELECTORS.action('subdirectory'));
+      assertURL(assert, this.backend, 'roles/dynamic/subdirectory/admin/');
+    });
+
+    test('it should clear roles page filter value on route exit', async function (assert) {
+      await visitURL('roles/static/subdirectory/admin/', this.backend);
+      await fillIn('[data-test-filter-input]', 'foo');
+      assert
+        .dom('[data-test-filter-input]')
+        .hasValue('foo', 'Roles page filter value set after model refresh and rerender');
+      await waitFor(GENERAL.emptyStateTitle);
+      await click('[data-test-tab="libraries"]');
+      await click('[data-test-tab="roles"]');
+      assert.dom('[data-test-filter-input]').hasNoValue('Roles page filter value cleared on route exit');
+    });
+  });
 });
diff --git a/ui/tests/acceptance/secrets/backend/ssh/configuration-test.js b/ui/tests/acceptance/secrets/backend/ssh/configuration-test.js
new file mode 100644
index 00000000000..d3452e9779f
--- /dev/null
+++ b/ui/tests/acceptance/secrets/backend/ssh/configuration-test.js
@@ -0,0 +1,132 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, currentURL, visit, waitFor } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { v4 as uuidv4 } from 'uuid';
+
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import { configUrl } from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+
+module('Acceptance | ssh | configuration', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.uid = uuidv4();
+    return login();
+  });
+
+  test('it should prompt configuration after mounting ssh engine', async function (assert) {
+    const sshPath = `ssh-${this.uid}`;
+    // in this test go through the full mount process. Bypass this step in later tests.
+    await visit('/vault/secrets-engines/enable');
+    await mountBackend('ssh', sshPath);
+    await click(SES.configTab);
+    assert.dom(GENERAL.emptyStateTitle).hasText('SSH not configured');
+    assert.dom(GENERAL.emptyStateActions).hasText('Configure SSH');
+    // cleanup
+    await runCmd(`delete sys/mounts/${sshPath}`);
+  });
+
+  test('it should show error if old url is entered', async function (assert) {
+    // we are intentionally not redirecting from the old url to the new one
+    const sshPath = `ssh-${this.uid}`;
+    await enablePage.enable('ssh', sshPath);
+    await click(SES.configTab);
+    await visit(`/vault/settings/secrets/configure/${sshPath}`);
+    assert.dom(GENERAL.notFound).exists('shows page-error');
+    // cleanup
+    await runCmd(`delete sys/mounts/${sshPath}`);
+  });
+
+  test('it should show a public key after saving default configuration and allows you to delete public key', async function (assert) {
+    const sshPath = `ssh-${this.uid}`;
+    await enablePage.enable('ssh', sshPath);
+    await click(SES.configTab);
+    await click(SES.configure);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${sshPath}/configuration/edit`,
+      'transitions to the configuration page'
+    );
+    // default has generate CA checked so we just submit the form
+    await click(GENERAL.submitButton);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${sshPath}/configuration`,
+      'navigates to the details page.'
+    );
+    // There is a delay in the backend for the public key to be generated, wait for it to complete by checking that the public key is displayed
+    await waitFor(GENERAL.infoRowLabel('Public key'));
+    assert.dom(GENERAL.infoRowLabel('Public key')).exists('public key shown on the details screen');
+
+    await click(SES.configure);
+    assert
+      .dom(SES.ssh.editConfigSection)
+      .exists('renders the edit configuration section of the form and not the create part');
+    // delete Public key
+    await click(GENERAL.button('delete-public-key'));
+    assert.dom(GENERAL.confirmMessage).hasText('Confirming will remove the CA certificate information.');
+    await click(GENERAL.confirmButton);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${sshPath}/configuration/edit`,
+      'after deleting public key stays on edit page'
+    );
+    assert.dom(GENERAL.inputByAttr('private_key')).hasNoText('Private key is empty and reset');
+    assert.dom(GENERAL.inputByAttr('public_key')).hasNoText('Public key is empty and reset');
+    assert.dom(GENERAL.inputByAttr('generate_signing_key')).isChecked('Generate signing key is checked');
+    await click(SES.viewBackend);
+    await click(SES.configTab);
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('SSH not configured', 'after deleting public key SSH is no longer configured');
+    // cleanup
+    await runCmd(`delete sys/mounts/${sshPath}`);
+  });
+
+  test('it displays error if generate Signing key is not checked and no public and private keys', async function (assert) {
+    const path = `ssh-configure-${this.uid}`;
+    await enablePage.enable('ssh', path);
+    await click(SES.configTab);
+    await click(SES.configure);
+    assert
+      .dom(GENERAL.inputByAttr('generate_signing_key'))
+      .isChecked('generate_signing_key defaults to true');
+    await click(GENERAL.inputByAttr('generate_signing_key'));
+    await click(GENERAL.submitButton);
+    assert
+      .dom(GENERAL.validationErrorByAttr('generate_signing_key'))
+      .hasText('Provide a Public and Private key or set "Generate Signing Key" to true.');
+    // visit the details page and confirm the public key is not shown
+    await visit(`/vault/secrets-engines/${path}/configuration`);
+    assert.dom(GENERAL.infoRowLabel('Public key')).doesNotExist('Public key label does not exist');
+    assert.dom(GENERAL.emptyStateTitle).hasText('SSH not configured', 'SSH not configured');
+    // cleanup
+    await runCmd(`delete sys/mounts/${path}`);
+  });
+
+  test('it should show API error when SSH configuration read fails', async function (assert) {
+    assert.expect(1);
+    const path = `ssh-${this.uid}`;
+    const type = 'ssh';
+    await enablePage.enable(type, path);
+    // interrupt get and return API error
+    this.server.get(configUrl(type, path), () => {
+      return overrideResponse(400, { errors: ['bad request'] });
+    });
+    await click(SES.configTab);
+    assert.dom(SES.error.title).hasText('Error', 'shows the secrets backend error route');
+  });
+});
diff --git a/ui/tests/acceptance/secrets/backend/ssh/role-test.js b/ui/tests/acceptance/secrets/backend/ssh/role-test.js
deleted file mode 100644
index f4d3ab8d932..00000000000
--- a/ui/tests/acceptance/secrets/backend/ssh/role-test.js
+++ /dev/null
@@ -1,112 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { currentRouteName, settled } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import { v4 as uuidv4 } from 'uuid';
-
-import editPage from 'vault/tests/pages/secrets/backend/ssh/edit-role';
-import showPage from 'vault/tests/pages/secrets/backend/ssh/show';
-import generatePage from 'vault/tests/pages/secrets/backend/ssh/generate-otp';
-import listPage from 'vault/tests/pages/secrets/backend/list';
-import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
-import authPage from 'vault/tests/pages/auth';
-
-module('Acceptance | secrets/ssh', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.uid = uuidv4();
-    return authPage.login();
-  });
-
-  const mountAndNav = async (uid) => {
-    const path = `ssh-${uid}`;
-    await enablePage.enable('ssh', path);
-    await settled();
-    await editPage.visitRoot({ backend: path });
-    await settled();
-    return path;
-  };
-
-  test('it creates a role and redirects', async function (assert) {
-    assert.expect(5);
-    const path = await mountAndNav(this.uid);
-    await editPage.createOTPRole('role');
-    await settled();
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.secrets.backend.show',
-      'redirects to the show page'
-    );
-    assert.ok(showPage.generateIsPresent, 'shows the generate button');
-
-    await showPage.visit({ backend: path, id: 'role' });
-    await settled();
-    await showPage.generate();
-    await settled();
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.secrets.backend.credentials',
-      'navs to the credentials page'
-    );
-
-    await listPage.visitRoot({ backend: path });
-    await settled();
-    assert.strictEqual(listPage.secrets.length, 1, 'shows role in the list');
-    const secret = listPage.secrets.objectAt(0);
-    await secret.menuToggle();
-    assert.dom('.hds-dropdown li').exists({ count: 5 }, 'Renders 5 popup menu items');
-  });
-
-  test('it deletes a role', async function (assert) {
-    assert.expect(2);
-    const path = await mountAndNav(this.uid);
-    await editPage.createOTPRole('role');
-    await settled();
-    await showPage.visit({ backend: path, id: 'role' });
-    await settled();
-    await showPage.deleteRole();
-    await settled();
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.secrets.backend.list-root',
-      'redirects to list page'
-    );
-    assert.ok(listPage.backendIsEmpty, 'no roles listed');
-  });
-
-  test('it generates an OTP', async function (assert) {
-    assert.expect(6);
-    const path = await mountAndNav(this.uid);
-    await editPage.createOTPRole('role');
-    await settled();
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.secrets.backend.show',
-      'redirects to the show page'
-    );
-    assert.ok(showPage.generateIsPresent, 'shows the generate button');
-
-    await showPage.visit({ backend: path, id: 'role' });
-    await settled();
-    await showPage.generate();
-    await settled();
-    assert.strictEqual(
-      currentRouteName(),
-      'vault.cluster.secrets.backend.credentials',
-      'navs to the credentials page'
-    );
-
-    await generatePage.generateOTP();
-    await settled();
-    assert.ok(generatePage.warningIsPresent, 'shows warning');
-    await generatePage.back();
-    await settled();
-    assert.ok(generatePage.userIsPresent, 'clears generate, shows user input');
-    assert.ok(generatePage.ipIsPresent, 'clears generate, shows ip input');
-  });
-});
diff --git a/ui/tests/acceptance/secrets/backend/ssh/roles-test.js b/ui/tests/acceptance/secrets/backend/ssh/roles-test.js
new file mode 100644
index 00000000000..0a84e6c0634
--- /dev/null
+++ b/ui/tests/acceptance/secrets/backend/ssh/roles-test.js
@@ -0,0 +1,243 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import {
+  click,
+  fillIn,
+  currentURL,
+  find,
+  settled,
+  waitUntil,
+  currentRouteName,
+  waitFor,
+  visit,
+} from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { v4 as uuidv4 } from 'uuid';
+
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
+import listPage from 'vault/tests/pages/secrets/backend/list';
+import showPage from 'vault/tests/pages/secrets/backend/ssh/show';
+import generatePage from 'vault/tests/pages/secrets/backend/ssh/generate-otp';
+import { runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+
+// There is duplication within this test suite. The duplication occurred because two test suites both testing ssh roles were merged.
+// refactoring the tests to remove the duplication would be a good next step as well as removing the tests/pages.
+
+module('Acceptance | ssh | roles', function (hooks) {
+  setupApplicationTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.uid = uuidv4();
+    return login();
+  });
+
+  const PUB_KEY = `ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCn9p5dHNr4aU4R2W7ln+efzO5N2Cdv/SXk6zbCcvhWcblWMjkXf802B0PbKvf6cJIzM/Xalb3qz1cK+UUjCSEAQWefk6YmfzbOikfc5EHaSKUqDdE+HlsGPvl42rjCr28qYfuYh031YfwEQGEAIEypo7OyAj+38NLbHAQxDxuaReee1YCOV5rqWGtEgl2VtP5kG+QEBza4ZfeglS85f/GGTvZC4Jq1GX+wgmFxIPnd6/mUXa4ecoR0QMfOAzzvPm4ajcNCQORfHLQKAcmiBYMiyQJoU+fYpi9CJGT1jWTmR99yBkrSg6yitI2qqXyrpwAbhNGrM0Fw0WpWxh66N9Xp meirish@Macintosh-3.local`;
+
+  const ROLES = [
+    {
+      type: 'ca',
+      name: 'carole',
+      credsRoute: 'vault.cluster.secrets.backend.sign',
+      async fillInCreate() {
+        await click(GENERAL.inputByAttr('allowUserCertificates'));
+        await click(GENERAL.button('Options'));
+        // it's recommended to keep allow_empty_principals false, check for testing so we don't have to input an extra field when signing a key
+        await click(GENERAL.inputByAttr('allowEmptyPrincipals'));
+      },
+      async fillInGenerate() {
+        await fillIn(GENERAL.inputByAttr('publicKey'), PUB_KEY);
+        await click('[data-test-toggle-button]');
+
+        await click(GENERAL.ttl.toggle('TTL'));
+        await fillIn(GENERAL.selectByAttr('ttl-unit'), 'm');
+
+        document.querySelector(GENERAL.ttl.input('TTL')).value = 30;
+      },
+      assertBeforeGenerate(assert) {
+        assert.dom('[data-test-form-field-from-model]').exists('renders the FormFieldFromModel');
+        const value = document.querySelector('[data-test-ttl-value="TTL"]').value;
+        // confirms that the actions are correctly being passed down to the FormFieldFromModel component
+        assert.strictEqual(value, '30', 'renders action updateTtl');
+      },
+      assertAfterGenerate(assert, sshPath) {
+        assert.strictEqual(
+          currentURL(),
+          `/vault/secrets-engines/${sshPath}/sign/${this.name}`,
+          'ca sign url is correct'
+        );
+        assert.dom(GENERAL.infoRowLabel('Signed key')).exists({ count: 1 }, 'renders the signed key');
+        assert.dom(GENERAL.infoRowValue('Signed key')).exists("renders the signed key's value");
+        assert.dom(GENERAL.infoRowLabel('Serial number')).exists({ count: 1 }, 'renders the serial');
+        assert.dom(GENERAL.infoRowValue('Serial number')).exists('renders the serial value');
+      },
+    },
+    {
+      type: 'otp',
+      name: 'otprole',
+      credsRoute: 'vault.cluster.secrets.backend.credentials',
+      async fillInCreate() {
+        await fillIn(GENERAL.inputByAttr('defaultUser'), 'admin');
+        await click(GENERAL.button('Options'));
+        await fillIn(GENERAL.inputByAttr('cidrList'), '1.2.3.4/32');
+      },
+      async fillInGenerate() {
+        await fillIn(GENERAL.inputByAttr('username'), 'admin');
+        await fillIn(GENERAL.inputByAttr('ip'), '1.2.3.4');
+      },
+      assertAfterGenerate(assert, sshPath) {
+        assert.strictEqual(
+          currentURL(),
+          `/vault/secrets-engines/${sshPath}/credentials/${this.name}`,
+          'otp credential url is correct'
+        );
+        assert.dom(GENERAL.infoRowLabel('Key')).exists({ count: 1 }, 'renders the key');
+        assert.dom('[data-test-masked-input]').exists({ count: 1 }, 'renders mask for key value');
+        assert.dom(GENERAL.infoRowLabel('Port')).exists({ count: 1 }, 'renders the port');
+        assert.dom(GENERAL.infoRowValue('Port')).exists("renders the port's value");
+      },
+    },
+  ];
+
+  test('it creates roles, generates keys and deletes roles', async function (assert) {
+    assert.expect(28);
+    const sshPath = `ssh-${this.uid}`;
+    await enablePage.enable('ssh', sshPath);
+    await click(SES.configTab);
+    await click(SES.configure);
+    // default has generate CA checked so we just submit the form
+    await click(GENERAL.submitButton);
+    // There is a delay in the backend for the public key to be generated, wait for it to complete by checking that the public key is displayed
+    await waitFor(GENERAL.infoRowLabel('Public key'));
+    await click(GENERAL.tab(sshPath));
+    for (const role of ROLES) {
+      // create a role
+      await click(SES.createSecretLink);
+      assert.dom(SES.secretHeader).includesText('SSH Role', `${role.type}: renders the create page`);
+
+      await fillIn(GENERAL.inputByAttr('name'), role.name);
+      await fillIn(GENERAL.inputByAttr('keyType'), role.type);
+      await role.fillInCreate();
+      await settled();
+
+      // save the role
+      await click(SES.ssh.createRole);
+      await waitUntil(() => currentURL() === `/vault/secrets-engines/${sshPath}/show/${role.name}`); // flaky without this
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${sshPath}/show/${role.name}`,
+        `${role.type}: navigates to the show page on creation`
+      );
+
+      // sign a key with this role
+      await click(SES.generateLink);
+      assert.strictEqual(currentRouteName(), role.credsRoute, 'navigates to the credentials page');
+      await role.fillInGenerate();
+      if (role.type === 'ca') {
+        await settled();
+        role.assertBeforeGenerate(assert);
+      }
+
+      // generate creds
+      await click(GENERAL.submitButton);
+      await settled(); // eslint-disable-line
+      role.assertAfterGenerate(assert, sshPath);
+
+      await click(GENERAL.backButton);
+      assert.dom('[data-test-secret-generate-form]').exists(`${role.type}: back takes you back to the form`);
+
+      await click(GENERAL.cancelButton);
+      assert.strictEqual(
+        currentURL(),
+        `/vault/secrets-engines/${sshPath}/list`,
+        `${role.type}: cancel takes you to ssh index`
+      );
+      assert.dom(SES.secretLink(role.name)).exists(`${role.type}: role shows in the list`);
+      const secret = listPage.secrets.objectAt(0);
+      await secret.menuToggle();
+      assert.dom('.hds-dropdown li').exists({ count: 5 }, 'Renders 5 popup menu items');
+
+      // and delete from the popup list menu
+      await waitUntil(() => find(SES.ssh.deleteRole)); // flaky without
+      await click(SES.ssh.deleteRole);
+      await click(GENERAL.confirmButton);
+      assert.dom(SES.secretLink(role.name)).doesNotExist(`${role.type}: role is no longer in the list`);
+    }
+    // cleanup
+    await runCmd(`delete sys/mounts/${sshPath}`);
+  });
+  module('Acceptance | ssh | otp role', function () {
+    const createOTPRole = async (name) => {
+      await fillIn(GENERAL.inputByAttr('name'), name);
+      await fillIn(GENERAL.inputByAttr('keyType'), name);
+      await click(GENERAL.button('Options'));
+      await fillIn(GENERAL.inputByAttr('keyType'), 'otp');
+      await fillIn(GENERAL.inputByAttr('defaultUser'), 'admin');
+      await fillIn(GENERAL.inputByAttr('cidrList'), '0.0.0.0/0');
+      await click(SES.ssh.createRole);
+    };
+    test('it deletes a role from list view', async function (assert) {
+      assert.expect(2);
+      const path = `ssh-${this.uid}`;
+      await enablePage.enable('ssh', path);
+      await settled();
+      await visit(`/vault/secrets-engines/${path}/create`);
+      await createOTPRole('role');
+      await settled();
+      await showPage.visit({ backend: path, id: 'role' });
+      await settled();
+      await click(GENERAL.confirmTrigger);
+      await click(GENERAL.confirmButton);
+
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.list-root',
+        'redirects to list page'
+      );
+      assert.ok(listPage.backendIsEmpty, 'no roles listed');
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+
+    test('it generates an OTP', async function (assert) {
+      assert.expect(6);
+      const path = `ssh-${this.uid}`;
+      await enablePage.enable('ssh', path);
+      await visit(`/vault/secrets-engines/${path}/create`);
+      await createOTPRole('role');
+      await settled();
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.show',
+        'redirects to the show page'
+      );
+      assert.ok(showPage.generateIsPresent, 'shows the generate button');
+
+      await showPage.visit({ backend: path, id: 'role' });
+      await settled();
+      await showPage.generate();
+      await settled();
+      assert.strictEqual(
+        currentRouteName(),
+        'vault.cluster.secrets.backend.credentials',
+        'navs to the credentials page'
+      );
+
+      await fillIn(GENERAL.inputByAttr('username'), 'admin');
+      await fillIn(GENERAL.inputByAttr('ip'), '192.168.1.1');
+      await click(GENERAL.submitButton);
+      assert.ok(generatePage.warningIsPresent, 'shows warning');
+      await click(GENERAL.backButton);
+      assert.ok(generatePage.userIsPresent, 'clears generate, shows user input');
+      assert.ok(generatePage.ipIsPresent, 'clears generate, shows ip input');
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+  });
+});
diff --git a/ui/tests/acceptance/secrets/backend/totp/key-test.js b/ui/tests/acceptance/secrets/backend/totp/key-test.js
new file mode 100644
index 00000000000..ede917e9ad3
--- /dev/null
+++ b/ui/tests/acceptance/secrets/backend/totp/key-test.js
@@ -0,0 +1,166 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, fillIn, currentURL, visit, waitUntil } from '@ember/test-helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { v4 as uuidv4 } from 'uuid';
+import sinon from 'sinon';
+
+module('Acceptance | totp key backend', function (hooks) {
+  setupApplicationTest(hooks);
+
+  const createVaultKey = async (keyName, issuer, accountName, exported = true, qrSize = 200) => {
+    await fillIn(GENERAL.inputByAttr('name'), keyName);
+    await fillIn(GENERAL.inputByAttr('issuer'), issuer);
+    await fillIn(GENERAL.inputByAttr('accountName'), accountName);
+    if (!exported) {
+      await click(GENERAL.toggleInput('toggle-exported'));
+    }
+    if (qrSize !== 200) {
+      await click(GENERAL.button('Provider Options'));
+      await fillIn(GENERAL.inputByAttr('qrSize'), qrSize);
+    }
+    await click(GENERAL.submitButton);
+  };
+
+  const createNonVaultKey = async (keyName, issuer, accountName, url, key) => {
+    await click(GENERAL.radioByAttr('Other service'));
+    await fillIn(GENERAL.inputByAttr('name'), keyName);
+    await fillIn(GENERAL.inputByAttr('issuer'), issuer);
+    await fillIn(GENERAL.inputByAttr('accountName'), accountName);
+    if (url) await fillIn(GENERAL.inputByAttr('url'), url);
+    if (key) await fillIn(GENERAL.inputByAttr('key'), key);
+    await click(GENERAL.submitButton);
+  };
+
+  hooks.beforeEach(async function () {
+    this.uid = uuidv4();
+    this.mountPath = `totp-${this.uid}`;
+    this.path = `totp-${this.uid}`;
+    this.keyName = 'totp-key';
+    this.issuer = 'totp-issuer';
+    this.accountName = 'totp-acount';
+    this.url =
+      'otpauth://totp/test-issuer:my-account?algorithm=SHA1&digits=6&issuer=test-issuer&period=30&secret=HICPOBIMFO4YYHFYX3QPVYUL2YEPVJKU';
+    this.key = 'VCUDXBWFQXUEAIJYXH5YB62D5WFNQXFA';
+
+    const flash = this.owner.lookup('service:flash-messages');
+    this.flashSuccessSpy = sinon.spy(flash, 'success');
+
+    await login();
+    // Setup TOTP engine
+    await visit('/vault/secrets-engines/enable');
+    await mountBackend('totp', this.mountPath);
+  });
+
+  test('it views a key via menu option', async function (assert) {
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.path}/list`,
+      'After enabling totp secrets engine it navigates to keys list'
+    );
+
+    await click(SES.createSecretLink);
+    await createVaultKey(this.keyName, this.issuer, this.accountName);
+    await click(GENERAL.backButton);
+    await visit(`/vault/secrets-engines/${this.path}`);
+    await click(GENERAL.menuTrigger);
+    await click(`${GENERAL.menuItem('details')}`);
+
+    assert.dom('.title').hasText(`TOTP key ${this.keyName}`);
+    assert.dom('[data-test-totp-key-details]').exists();
+
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.path}/show/${this.keyName}`,
+      'After clicking details option it navigates to key detail view'
+    );
+  });
+
+  test('it deletes a key via menu option', async function (assert) {
+    await click(SES.createSecretLink);
+    await createVaultKey(this.keyName, this.issuer, this.accountName);
+    await click(GENERAL.backButton);
+    await waitUntil(() => currentURL() === `/vault/secrets-engines/${this.path}/show/${this.keyName}`);
+    await visit(`/vault/secrets-engines/${this.path}`);
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
+    assert.dom(SES.secretLink(this.keyName)).doesNotExist(`${this.keyName}: key is no longer in the list`);
+
+    const [flashMessage] = this.flashSuccessSpy.lastCall.args;
+    assert.strictEqual(flashMessage, `${this.keyName} was successfully deleted.`);
+  });
+
+  test('it creates a key with Vault as the provider', async function (assert) {
+    await click(SES.createSecretLink);
+    assert.dom(SES.secretHeader).hasText('Create a TOTP key', 'It renders the create key page');
+
+    await createVaultKey(this.keyName, this.issuer, this.accountName);
+    assert.dom('[data-test-qrcode]').exists('QR code exists');
+    assert.dom(GENERAL.infoRowLabel('URL')).exists('URL exists');
+
+    await click(GENERAL.backButton);
+    await waitUntil(() => currentURL() === `/vault/secrets-engines/${this.path}/show/${this.keyName}`);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.path}/show/${this.keyName}`,
+      'totp: navigates to the show page on creation'
+    );
+
+    const [flashMessage] = this.flashSuccessSpy.lastCall.args;
+    assert.strictEqual(flashMessage, 'Successfully created key.');
+  });
+
+  test('it creates a key with another service as the provider with URL', async function (assert) {
+    await click(SES.createSecretLink);
+    assert.dom(SES.secretHeader).hasText('Create a TOTP key', 'It renders the create key page');
+    await createNonVaultKey(this.keyName, this.issuer, this.accountName, this.url);
+    await waitUntil(() => currentURL() === `/vault/secrets-engines/${this.path}/show/${this.keyName}`);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.path}/show/${this.keyName}`,
+      'totp: navigates to the show page on creation'
+    );
+
+    const [flashMessage] = this.flashSuccessSpy.lastCall.args;
+    assert.strictEqual(flashMessage, 'Successfully created key.');
+  });
+
+  test('it creates a key with another service as the provider with key', async function (assert) {
+    await click(SES.createSecretLink);
+    assert.dom(SES.secretHeader).hasText('Create a TOTP key', 'It renders the create key page');
+    await createNonVaultKey(this.keyName, this.issuer, this.accountName, undefined, this.key);
+    await waitUntil(() => currentURL() === `/vault/secrets-engines/${this.path}/show/${this.keyName}`);
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${this.path}/show/${this.keyName}`,
+      'totp: navigates to the show page on creation'
+    );
+
+    const [flashMessage] = this.flashSuccessSpy.lastCall.args;
+    assert.strictEqual(flashMessage, 'Successfully created key.');
+  });
+
+  test('it does not render QR code or URL when exported is false', async function (assert) {
+    await click(SES.createSecretLink);
+    await createVaultKey(this.keyName, this.issuer, this.accountName, false);
+    await waitUntil(() => currentURL() === `/vault/secrets-engines/${this.path}/show/${this.keyName}`);
+    assert.dom('[data-test-qrcode]').doesNotExist('QR code is not displayed');
+    assert.dom(GENERAL.infoRowLabel('URL')).doesNotExist('URl is not displayed');
+  });
+
+  test('it does not render QR code when QR size is 0', async function (assert) {
+    await click(SES.createSecretLink);
+    await createVaultKey(this.keyName, this.issuer, this.accountName, true, 0);
+    assert.dom('[data-test-qrcode]').doesNotExist('QR code is not displayed');
+    assert.dom(GENERAL.infoRowLabel('URL')).exists('URl is displayed');
+  });
+});
diff --git a/ui/tests/acceptance/secrets/mounts-test.js b/ui/tests/acceptance/secrets/mounts-test.js
new file mode 100644
index 00000000000..142f0f32f05
--- /dev/null
+++ b/ui/tests/acceptance/secrets/mounts-test.js
@@ -0,0 +1,403 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import {
+  currentRouteName,
+  currentURL,
+  settled,
+  click,
+  findAll,
+  fillIn,
+  visit,
+  typeIn,
+  waitFor,
+} from '@ember/test-helpers';
+import { clickTrigger } from 'ember-power-select/test-support/helpers';
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { v4 as uuidv4 } from 'uuid';
+import { runCmd, tokenWithPolicyCmd } from 'vault/tests/helpers/commands';
+
+import { create } from 'ember-cli-page-object';
+import page from 'vault/tests/pages/settings/mount-secret-backend';
+import configPage from 'vault/tests/pages/secrets/backend/configuration';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import consoleClass from 'vault/tests/pages/components/console/ui-panel';
+import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
+import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import { SELECTORS as OIDC } from 'vault/tests/helpers/oidc-config';
+import { adminOidcCreateRead, adminOidcCreate } from 'vault/tests/helpers/secret-engine/policy-generator';
+import { filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+
+const consoleComponent = create(consoleClass);
+
+// enterprise backends are tested separately
+const BACKENDS_WITH_ENGINES = ['kv', 'pki', 'ldap', 'kubernetes'];
+module('Acceptance | secrets-engines/enable', function (hooks) {
+  setupApplicationTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.uid = uuidv4();
+    this.calcDays = (hours) => {
+      const days = Math.floor(hours / 24);
+      const remainder = hours % 24;
+      return `${days} days ${remainder} hours`;
+    };
+    return login();
+  });
+
+  test('it sets the ttl correctly when mounting', async function (assert) {
+    // always force the new mount to the top of the list
+    const path = `mount-kv-${this.uid}`;
+    const defaultTTLHours = 100;
+    const maxTTLHours = 300;
+    await page.visit();
+
+    assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.enable.index');
+    await click(GENERAL.cardContainer('kv'));
+    await fillIn(GENERAL.inputByAttr('path'), path);
+    await click(GENERAL.button('Method Options'));
+    await click(GENERAL.toggleInput('Default Lease TTL'));
+    await page.defaultTTLUnit('h').defaultTTLVal(defaultTTLHours);
+    await click(GENERAL.toggleInput('Max Lease TTL'));
+    await page.maxTTLUnit('h').maxTTLVal(maxTTLHours);
+    await click(GENERAL.submitButton);
+    await configPage.visit({ backend: path });
+    assert.strictEqual(configPage.defaultTTL, `${this.calcDays(defaultTTLHours)}`, 'shows the proper TTL');
+    assert.strictEqual(configPage.maxTTL, `${this.calcDays(maxTTLHours)}`, 'shows the proper max TTL');
+  });
+
+  test('it sets the ttl when enabled then disabled', async function (assert) {
+    // always force the new mount to the top of the list
+    const path = `mount-kv-${this.uid}`;
+    const maxTTLHours = 300;
+
+    await page.visit();
+
+    assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.enable.index', 'navigates to mount page');
+    await click(GENERAL.cardContainer('kv'));
+    await fillIn(GENERAL.inputByAttr('path'), path);
+    await click(GENERAL.button('Method Options'));
+    await click(GENERAL.toggleInput('Default Lease TTL'));
+    await click(GENERAL.toggleInput('Max Lease TTL'));
+    await page.maxTTLUnit('h').maxTTLVal(maxTTLHours);
+    await click(GENERAL.submitButton);
+    await configPage.visit({ backend: path });
+    assert.strictEqual(configPage.defaultTTL, '1 month 1 day', 'shows system default TTL');
+    assert.strictEqual(configPage.maxTTL, `${this.calcDays(maxTTLHours)}`, 'shows the proper max TTL');
+  });
+
+  test('it sets the max ttl after pki chosen, resets after', async function (assert) {
+    await page.visit();
+    assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.enable.index');
+    await click(GENERAL.cardContainer('pki'));
+    assert.dom('[data-test-input="config.max_lease_ttl"]').exists();
+    assert
+      .dom('[data-test-input="config.max_lease_ttl"] [data-test-ttl-toggle]')
+      .isChecked('Toggle is checked by default');
+    assert.dom('[data-test-input="config.max_lease_ttl"] [data-test-ttl-value]').hasValue('3650');
+    assert.dom('[data-test-input="config.max_lease_ttl"] [data-test-select="ttl-unit"]').hasValue('d');
+
+    // Go back and choose a different type
+    await click(GENERAL.backButton);
+    await click(GENERAL.cardContainer('database'));
+    assert.dom('[data-test-input="config.max_lease_ttl"]').exists('3650');
+    assert
+      .dom('[data-test-input="config.max_lease_ttl"] [data-test-ttl-toggle]')
+      .isNotChecked('Toggle is unchecked by default');
+    await click(GENERAL.toggleInput('Max Lease TTL'));
+    assert.dom('[data-test-input="config.max_lease_ttl"] [data-test-ttl-value]').hasValue('');
+    assert.dom('[data-test-input="config.max_lease_ttl"] [data-test-select="ttl-unit"]').hasValue('s');
+  });
+
+  test('it throws error if setting duplicate path name', async function (assert) {
+    const path = `kv-duplicate`;
+
+    await consoleComponent.runCommands([
+      // delete any kv-duplicate previously written here so that tests can be re-run
+      `delete sys/mounts/${path}`,
+    ]);
+
+    await page.visit();
+
+    assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.enable.index');
+    await mountBackend('kv', path);
+    await page.secretList();
+    await settled();
+    await page.enableEngine();
+    await mountBackend('kv', path);
+    await waitFor('[data-test-message-error-description]');
+    assert.dom('[data-test-message-error-description]').containsText(`path is already in use at ${path}`);
+    assert.strictEqual(currentRouteName(), 'vault.cluster.secrets.enable.create');
+
+    await page.secretList();
+    await settled();
+    assert
+      .dom(GENERAL.tableData(`${path}/`, 'path'))
+      .exists({ count: 1 }, 'renders only one instance of the engine');
+  });
+
+  test('it should transition to mountable addon engine after mount success', async function (assert) {
+    // test supported backends that ARE ember engines (enterprise only engines are tested individually)
+    const addons = filterEnginesByMountCategory({ mountCategory: 'secret', isEnterprise: false }).filter(
+      (e) => BACKENDS_WITH_ENGINES.includes(e.type)
+    );
+    assert.expect(addons.length);
+
+    for (const engine of addons) {
+      await consoleComponent.runCommands([
+        // delete any previous mount with same name
+        `delete sys/mounts/${engine.type}`,
+      ]);
+      await mountSecrets.visit();
+      await mountBackend(engine.type, engine.type);
+
+      assert.strictEqual(
+        currentRouteName(),
+        `vault.cluster.secrets.backend.${engine.engineRoute}`,
+        `Transitions to ${engine.displayName} route on mount success`
+      );
+      await consoleComponent.runCommands([
+        // cleanup after
+        `delete sys/mounts/${engine.type}`,
+      ]);
+    }
+  });
+
+  test('it should transition to mountable non-addon engine after mount success', async function (assert) {
+    // test supported backends that are not ember engines (enterprise only engines are tested individually)
+    const nonEngineBackends = supportedSecretBackends().filter((b) => !BACKENDS_WITH_ENGINES.includes(b));
+    // add back kv because we want to test v1
+    const engines = filterEnginesByMountCategory({ mountCategory: 'secret', isEnterprise: false }).filter(
+      (e) => (nonEngineBackends.includes(e.type) || e.type === 'kv') && e.type !== 'cubbyhole'
+    );
+    assert.expect(engines.length);
+
+    for (const engine of engines) {
+      await consoleComponent.runCommands([
+        // delete any previous mount with same name
+        `delete sys/mounts/${engine.type}`,
+      ]);
+      await mountSecrets.visit();
+      await click(GENERAL.cardContainer(engine.type));
+      await fillIn(GENERAL.inputByAttr('path'), engine.type);
+      if (engine.type === 'kv') {
+        await click(GENERAL.button('Method Options'));
+        await mountSecrets.version(1);
+      }
+      await click(GENERAL.submitButton);
+
+      const route = engineDisplayData(engine.type)?.isOnlyMountable ? 'configuration.index' : 'list-root';
+      assert.strictEqual(
+        currentRouteName(),
+        `vault.cluster.secrets.backend.${route}`,
+        `${engine.type} navigates to the correct view (either list if not configuration only or configuration if it is).`
+      );
+
+      await consoleComponent.runCommands([
+        // cleanup after
+        `delete sys/mounts/${engine.type}`,
+      ]);
+    }
+  });
+
+  test('it should transition back to backend list for unsupported backends', async function (assert) {
+    const unsupported = filterEnginesByMountCategory({ mountCategory: 'secret', isEnterprise: false }).filter(
+      (e) => !supportedSecretBackends().includes(e.type)
+    );
+    assert.expect(unsupported.length);
+
+    for (const engine of unsupported) {
+      await consoleComponent.runCommands([
+        // delete any previous mount with same name
+        `delete sys/mounts/${engine.type}`,
+      ]);
+      await mountSecrets.visit();
+      await mountBackend(engine.type, engine.type);
+
+      assert.strictEqual(
+        currentRouteName(),
+        `vault.cluster.secrets.backends`,
+        `${engine.type} returns to backends list`
+      );
+    }
+  });
+
+  test('it should transition to different locations for kv v1 and v2', async function (assert) {
+    assert.expect(4);
+    const v2 = 'kv-v2';
+    await consoleComponent.runCommands([
+      // delete any previous mount with same name
+      `delete sys/mounts/${v2}`,
+    ]);
+    await mountSecrets.visit();
+    await mountBackend('kv', v2);
+    assert.strictEqual(currentURL(), `/vault/secrets-engines/${v2}/kv/list`, `${v2} navigates to list url`);
+    assert.strictEqual(
+      currentRouteName(),
+      `vault.cluster.secrets.backend.kv.list`,
+      `${v2} navigates to list url`
+    );
+
+    const v1 = 'kv-v1';
+    await consoleComponent.runCommands([
+      // delete any previous mount with same name
+      `delete sys/mounts/${v1}`,
+    ]);
+    await mountSecrets.visit();
+    await click(GENERAL.cardContainer('kv'));
+    await fillIn(GENERAL.inputByAttr('path'), v1);
+    await click(GENERAL.button('Method Options'));
+    await mountSecrets.version(1);
+    await click(GENERAL.submitButton);
+
+    assert.strictEqual(currentURL(), `/vault/secrets-engines/${v1}/list`, `${v1} navigates to list url`);
+    assert.strictEqual(
+      currentRouteName(),
+      `vault.cluster.secrets.backend.list-root`,
+      `${v1} navigates to list route`
+    );
+  });
+
+  // Condensed tests for these specific engines here as they just check if they are added to the list after mounting
+  test('enable alicloud', async function (assert) {
+    const enginePath = `alicloud-${this.uid}`;
+    await mountSecrets.visit();
+    await mountBackend('alicloud', enginePath);
+
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backends',
+      'redirects to the backends page'
+    );
+
+    assert.ok(GENERAL.tableData(`${enginePath}/`, 'path'), 'shows the alicloud engine');
+
+    // cleanup
+    await runCmd(`delete sys/mounts/${enginePath}`);
+  });
+
+  test('enable gcpkms', async function (assert) {
+    const enginePath = `gcpkms-${this.uid}`;
+    await mountSecrets.visit();
+    await mountBackend('gcpkms', enginePath);
+
+    assert.strictEqual(
+      currentRouteName(),
+      'vault.cluster.secrets.backends',
+      'redirects to the backends page'
+    );
+
+    assert.ok(GENERAL.tableData(`${enginePath}/`, 'path'), 'shows the gcpkms engine');
+    // cleanup
+    await runCmd(`delete sys/mounts/${enginePath}`);
+  });
+
+  module('WIF secret engines', function () {
+    test('it sets identity_token_key on mount config using search select list, resets after', async function (assert) {
+      // create an oidc/key
+      await runCmd(`write identity/oidc/key/some-key allowed_client_ids="*"`);
+
+      await page.visit();
+      await click(GENERAL.cardContainer('aws')); // only testing aws of the WIF engines as the functionality for all others WIF engines in this form are the same
+      await click(GENERAL.button('Method Options'));
+      assert.dom('[data-test-search-select-with-modal]').exists('Search select with modal component renders');
+      await clickTrigger('#key');
+      const dropdownOptions = findAll('[data-option-index]').map((o) => o.innerText);
+      assert.ok(dropdownOptions.includes('some-key'), 'search select options show some-key');
+      await click(GENERAL.searchSelect.option(GENERAL.searchSelect.optionIndex('some-key')));
+      assert
+        .dom(GENERAL.searchSelect.selectedOption())
+        .hasText('some-key', 'some-key was selected and displays in the search select');
+      await click(GENERAL.backButton);
+      // Choose a non-wif engine
+      await click(GENERAL.cardContainer('ssh'));
+      assert
+        .dom('[data-test-search-select-with-modal]')
+        .doesNotExist('for type ssh, the modal field does not render.');
+      // cleanup
+      await runCmd(`delete identity/oidc/key/some-key`);
+    });
+
+    test('it allows a user with permissions to oidc/key to create an identity_token_key', async function (assert) {
+      const engine = 'aws'; // only testing aws of the WIF engines as the functionality for all others WIF engines in this form are the same
+      await login();
+      const path = `secrets-adminPolicy-${engine}`;
+      const newKey = `key-${engine}-${uuidv4()}`;
+      const secrets_admin_policy = adminOidcCreateRead(path);
+      const secretsAdminToken = await runCmd(
+        tokenWithPolicyCmd(`secrets-admin-${path}`, secrets_admin_policy)
+      );
+
+      await login(secretsAdminToken);
+      await visit('/vault/secrets-engines/enable');
+      await click(GENERAL.cardContainer(engine));
+      await fillIn(GENERAL.inputByAttr('path'), path);
+      await click(GENERAL.button('Method Options'));
+      await clickTrigger('#key');
+      // create new key
+      await fillIn(GENERAL.searchSelect.searchInput, newKey);
+      await click(GENERAL.searchSelect.options);
+      assert.dom('#search-select-modal').exists(`modal with form opens for engine ${engine}`);
+      assert
+        .dom('[data-test-modal-title]')
+        .hasText('Create new key', `Create key modal renders for engine: ${engine}`);
+
+      await click(OIDC.keySaveButton);
+      assert.dom('#search-select-modal').doesNotExist(`modal disappears onSave for engine ${engine}`);
+      assert.dom(GENERAL.searchSelect.selectedOption()).hasText(newKey, `${newKey} is now selected`);
+
+      await click(GENERAL.submitButton);
+      await visit(`/vault/secrets-engines/${path}/configuration`);
+      await click(SES.configurationToggle);
+      assert
+        .dom(GENERAL.infoRowValue('Identity token key'))
+        .hasText(newKey, `shows identity token key on configuration page for engine: ${engine}`);
+
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+      await runCmd(`delete identity/oidc/key/some-key`);
+      await runCmd(`delete identity/oidc/key/${newKey}`);
+    });
+
+    test('it allows user with NO access to oidc/key to manually input an identity_token_key', async function (assert) {
+      const engine = 'aws'; // only testing aws of the WIF engines as the functionality for all others WIF engines in this form are the same
+      await login();
+      const path = `secrets-noOidcAdmin-${engine}`;
+      const secretsNoOidcAdminPolicy = adminOidcCreate(path);
+      const secretsNoOidcAdminToken = await runCmd(
+        tokenWithPolicyCmd(`secrets-noOidcAdmin-${path}`, secretsNoOidcAdminPolicy)
+      );
+      // create an oidc/key that they can then use even if they can't read it.
+      await runCmd(`write identity/oidc/key/general-key allowed_client_ids="*"`);
+
+      await login(secretsNoOidcAdminToken);
+      await page.visit();
+      await click(GENERAL.cardContainer(engine));
+      await fillIn(GENERAL.inputByAttr('path'), path);
+      await click(GENERAL.button('Method Options'));
+      // type-in fallback component to create new key
+      await typeIn(GENERAL.inputSearch('key'), 'general-key');
+      await click(GENERAL.submitButton);
+      assert
+        .dom(GENERAL.latestFlashContent)
+        .hasText(`Successfully mounted the ${engine} secrets engine at ${path}.`);
+
+      await visit(`/vault/secrets-engines/${path}/configuration`);
+
+      await click(SES.configurationToggle);
+      assert
+        .dom(GENERAL.infoRowValue('Identity token key'))
+        .hasText('general-key', `shows identity token key on configuration page for engine: ${engine}`);
+
+      // cleanup
+      await runCmd(`delete sys/mounts/${path}`);
+    });
+  });
+});
diff --git a/ui/tests/acceptance/settings-test.js b/ui/tests/acceptance/settings-test.js
index 0b9d568318c..cebe7370c50 100644
--- a/ui/tests/acceptance/settings-test.js
+++ b/ui/tests/acceptance/settings-test.js
@@ -1,52 +1,92 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentURL, find, visit, settled } from '@ember/test-helpers';
+import { currentURL, visit, click, fillIn } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 
-import backendListPage from 'vault/tests/pages/secrets/backends';
 import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { deleteEngineCmd, mountEngineCmd, runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
-module('Acceptance | settings', function (hooks) {
+module('Acceptance | secret engine mount settings', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(function () {
     this.uid = uuidv4();
-    return authPage.login();
+    return login();
   });
 
-  test('settings', async function (assert) {
+  test('it allows you to mount a secret engine', async function (assert) {
     const type = 'consul';
     const path = `settings-path-${this.uid}`;
 
     // mount unsupported backend
-    await visit('/vault/settings/mount-secret-backend');
-
-    assert.strictEqual(currentURL(), '/vault/settings/mount-secret-backend');
-
-    await mountSecrets.selectType(type);
-    await mountSecrets
-      .path(path)
-      .toggleOptions()
-      .enableDefaultTtl()
-      .defaultTTLUnit('s')
-      .defaultTTLVal(100)
-      .submit();
-    await settled();
-    assert.ok(
-      find('[data-test-flash-message]').textContent.trim(),
-      `Successfully mounted '${type}' at '${path}'!`
+    await visit('/vault/secrets-engines/enable');
+
+    assert.strictEqual(
+      currentURL(),
+      '/vault/secrets-engines/enable',
+      'navigates to the mount secret backend page'
+    );
+    await click(GENERAL.cardContainer(type));
+    await fillIn(GENERAL.inputByAttr('path'), path);
+    await click(GENERAL.button('Method Options'));
+    await click(GENERAL.toggleInput('Default Lease TTL'));
+    await mountSecrets.defaultTTLUnit('s').defaultTTLVal(100);
+    await click(GENERAL.submitButton);
+
+    assert
+      .dom(`${GENERAL.flashMessage}.is-success`)
+      .includesText(
+        `Success Successfully mounted the ${type} secrets engine at ${path}`,
+        'flash message is shown after mounting'
+      );
+
+    assert.strictEqual(currentURL(), `/vault/secrets-engines`, 'redirects to secrets page');
+    // cleanup
+    await runCmd(deleteEngineCmd(path));
+  });
+
+  test('it navigates to ember engine configuration page', async function (assert) {
+    const type = 'ldap';
+    const path = `ldap-${this.uid}`;
+
+    await visit('/vault/secrets-engines/enable');
+    await runCmd(mountEngineCmd(type, path), false);
+    await visit('/vault/secrets-engines');
+    await fillIn(GENERAL.inputSearch('secret-engine-path'), path);
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.menuItem('view-configuration'));
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${path}/${type}/configuration`,
+      'navigates to the config page for ember engine'
+    );
+    // clean up
+    await runCmd(deleteEngineCmd(path));
+  });
+
+  test('it navigates to non-ember engine configuration page', async function (assert) {
+    const type = 'ssh';
+    const path = `ssh-${this.uid}`;
+
+    await visit('/vault/secrets-engines/enable');
+    await runCmd(mountEngineCmd(type, path), false);
+    await visit('/vault/secrets-engines');
+    await fillIn(GENERAL.inputSearch('secret-engine-path'), path);
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.menuItem('view-configuration'));
+    assert.strictEqual(
+      currentURL(),
+      `/vault/secrets-engines/${path}/configuration`,
+      'navigates to the config page for non-ember engine'
     );
-    await settled();
-    assert.strictEqual(currentURL(), `/vault/secrets`, 'redirects to secrets page');
-    const row = backendListPage.rows.filterBy('path', path + '/')[0];
-    await row.menu();
-    await backendListPage.configLink();
-    assert.strictEqual(currentURL(), `/vault/secrets/${path}/configuration`, 'navigates to the config page');
+    // clean up
+    await runCmd(deleteEngineCmd(path));
   });
 });
diff --git a/ui/tests/acceptance/settings/auth/configure/index-test.js b/ui/tests/acceptance/settings/auth/configure/index-test.js
index 90b68ee92b9..1c35688d59a 100644
--- a/ui/tests/acceptance/settings/auth/configure/index-test.js
+++ b/ui/tests/acceptance/settings/auth/configure/index-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,14 +10,14 @@ import { v4 as uuidv4 } from 'uuid';
 
 import enablePage from 'vault/tests/pages/settings/auth/enable';
 import page from 'vault/tests/pages/settings/auth/configure/index';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 
 module('Acceptance | settings/auth/configure', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(function () {
     this.uid = uuidv4();
-    return authPage.login();
+    return login();
   });
 
   test('it redirects to section options when there are no other sections', async function (assert) {
diff --git a/ui/tests/acceptance/settings/auth/configure/section-test.js b/ui/tests/acceptance/settings/auth/configure/section-test.js
index e9c0539c3ee..506d5d50c48 100644
--- a/ui/tests/acceptance/settings/auth/configure/section-test.js
+++ b/ui/tests/acceptance/settings/auth/configure/section-test.js
@@ -1,74 +1,79 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 import { create } from 'ember-cli-page-object';
-import { fillIn } from '@ember/test-helpers';
+import { fillIn, settled, findAll, click } from '@ember/test-helpers';
 import { v4 as uuidv4 } from 'uuid';
 
 import enablePage from 'vault/tests/pages/settings/auth/enable';
 import page from 'vault/tests/pages/settings/auth/configure/section';
 import indexPage from 'vault/tests/pages/settings/auth/configure/index';
-import apiStub from 'vault/tests/helpers/noop-all-api-requests';
 import consolePanel from 'vault/tests/pages/components/console/ui-panel';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const cli = create(consolePanel);
 
 module('Acceptance | settings/auth/configure/section', function (hooks) {
   setupApplicationTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
     this.uid = uuidv4();
-    this.server = apiStub({ usePassthrough: true });
-    return authPage.login();
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
+    return login();
   });
 
   test('it can save options', async function (assert) {
+    assert.expect(6);
+
     const path = `approle-save-${this.uid}`;
     const type = 'approle';
     const section = 'options';
+
+    this.server.post(`/sys/mounts/auth/${path}/tune`, function (schema, request) {
+      const body = JSON.parse(request.requestBody);
+      const keys = Object.keys(body);
+      assert.strictEqual(body.token_type, 'batch', 'passes new token type');
+      assert.true(keys.includes('default_lease_ttl'), 'passes default_lease_ttl on tune');
+      assert.true(keys.includes('max_lease_ttl'), 'passes max_lease_ttl on tune');
+      assert.true(keys.includes('description'), 'passes updated description on tune');
+      return request.passthrough();
+    });
+
     await enablePage.enable(type, path);
     await page.visit({ path, section });
-    await page.fillInTextarea('description', 'This is AppRole!');
+    await fillIn(GENERAL.inputByAttr('description'), 'This is Approle!');
     assert
-      .dom('[data-test-input="config.tokenType"]')
+      .dom(GENERAL.inputByAttr('config.token_type'))
       .hasValue('default-service', 'as default the token type selected is default-service.');
-    await fillIn('[data-test-input="config.tokenType"]', 'batch');
-    await page.save();
+    await fillIn(GENERAL.inputByAttr('config.token_type'), 'batch');
+    await click(GENERAL.submitButton);
+
     assert.strictEqual(
       page.flash.latestMessage,
       `The configuration was saved successfully.`,
       'success flash shows'
     );
-    const tuneRequest = this.server.passthroughRequests.filterBy(
-      'url',
-      `/v1/sys/mounts/auth/${path}/tune`
-    )[0];
-    const keys = Object.keys(JSON.parse(tuneRequest.requestBody));
-    const token_type = JSON.parse(tuneRequest.requestBody).token_type;
-    assert.strictEqual(token_type, 'batch', 'passes new token type');
-    assert.ok(keys.includes('default_lease_ttl'), 'passes default_lease_ttl on tune');
-    assert.ok(keys.includes('max_lease_ttl'), 'passes max_lease_ttl on tune');
-    assert.ok(keys.includes('description'), 'passes updated description on tune');
   });
 
   for (const type of ['aws', 'azure', 'gcp', 'github', 'kubernetes']) {
     test(`it shows tabs for auth method: ${type}`, async function (assert) {
       const path = `${type}-showtab-${this.uid}`;
+      await cli.toggle();
+      await settled();
       await cli.consoleInput(`write sys/auth/${path} type=${type}`);
       await cli.enter();
       await indexPage.visit({ path });
       // aws has 4 tabs, the others will have 'Configuration' and 'Method Options' tabs
       const numTabs = type === 'aws' ? 4 : 2;
-      assert.strictEqual(page.tabs.length, numTabs, 'shows correct number of tabs');
+      const tabs = findAll(GENERAL.linkTo('auth-tab'));
+      assert.strictEqual(tabs.length, numTabs, 'shows correct number of tabs');
     });
   }
 });
diff --git a/ui/tests/acceptance/settings/auth/enable-test.js b/ui/tests/acceptance/settings/auth/enable-test.js
index 45a04123e77..00b7dc8bb0b 100644
--- a/ui/tests/acceptance/settings/auth/enable-test.js
+++ b/ui/tests/acceptance/settings/auth/enable-test.js
@@ -1,45 +1,87 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { currentRouteName, settled } from '@ember/test-helpers';
+import { click, currentRouteName, visit } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
-
-import page from 'vault/tests/pages/settings/auth/enable';
-import listPage from 'vault/tests/pages/access/methods';
-import authPage from 'vault/tests/pages/auth';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { deleteAuthCmd, runCmd } from 'vault/tests/helpers/commands';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Acceptance | settings/auth/enable', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(function () {
     this.uid = uuidv4();
-    return authPage.login();
+    return login();
   });
 
   test('it mounts and redirects', async function (assert) {
     // always force the new mount to the top of the list
     const path = `aaa-approle-${this.uid}`;
     const type = 'approle';
-    await page.visit();
+    await visit('/vault/settings/auth/enable');
     assert.strictEqual(currentRouteName(), 'vault.cluster.settings.auth.enable');
-    await page.enable(type, path);
-    await settled();
-    await assert.strictEqual(
-      page.flash.latestMessage,
-      `Successfully mounted the ${type} auth method at ${path}.`,
-      'success flash shows'
-    );
+    await mountBackend(type, path);
+    assert
+      .dom(GENERAL.latestFlashContent)
+      .hasText(`Successfully mounted the ${type} auth method at ${path}.`);
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.settings.auth.configure.section',
       'redirects to the auth config page'
     );
 
-    await listPage.visit();
-    assert.ok(listPage.findLinkById(path), 'mount is present in the list');
+    await visit('/vault/access/');
+    assert.dom(GENERAL.linkedBlock(path)).exists('mount is present in the list');
+
+    // cleanup
+    await runCmd(deleteAuthCmd(path));
+  });
+
+  test('it renders default config details', async function (assert) {
+    const path = `approle-config-${this.uid}`;
+    const type = 'approle';
+    await visit('/vault/settings/auth/enable');
+    await mountBackend(type, path);
+    // the config details is updated to query mount details from sys/internal/ui/mounts
+    // but we still want these forms to continue using sys/auth which returns 0 for default ttl values
+    // check tune form (right after enabling)
+    assert.dom(GENERAL.toggleInput('Default Lease TTL')).isNotChecked('default lease ttl is unset');
+    assert.dom(GENERAL.toggleInput('Max Lease TTL')).isNotChecked('max lease ttl is unset');
+    await click(GENERAL.breadcrumbAtIdx(1));
+    assert
+      .dom(GENERAL.infoRowValue('Default Lease TTL'))
+      .hasText('1 month 1 day', 'shows system default TTL');
+    assert.dom(GENERAL.infoRowValue('Max Lease TTL')).hasText('1 month 1 day', 'shows the proper max TTL');
+    assert
+      .dom(GENERAL.infoRowValue('UI login link'))
+      .doesNotExist('Login link does not render for unsupported methods');
+
+    // check edit form TTL values
+    await click('[data-test-configure-link]');
+    assert.dom(GENERAL.toggleInput('Default Lease TTL')).isNotChecked('default lease ttl is still unset');
+    assert.dom(GENERAL.toggleInput('Max Lease TTL')).isNotChecked('max lease ttl is still unset');
+
+    // cleanup
+    await runCmd(deleteAuthCmd(path));
+  });
+
+  test('it renders direct login link for supported method', async function (assert) {
+    const path = `oidc-config-${this.uid}`;
+    const type = 'oidc';
+    await visit('/vault/settings/auth/enable');
+    await mountBackend(type, path);
+    await click(GENERAL.breadcrumbAtIdx(1));
+    assert
+      .dom(GENERAL.infoRowValue('UI login link'))
+      .hasText(`${window.origin}/ui/vault/auth?with=${path}%2F`);
+
+    // cleanup
+    await runCmd(deleteAuthCmd(path));
   });
 });
diff --git a/ui/tests/acceptance/settings/configure-secret-backends/configure-ssh-secret-test.js b/ui/tests/acceptance/settings/configure-secret-backends/configure-ssh-secret-test.js
deleted file mode 100644
index 80ffda26091..00000000000
--- a/ui/tests/acceptance/settings/configure-secret-backends/configure-ssh-secret-test.js
+++ /dev/null
@@ -1,48 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { click, settled } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import { v4 as uuidv4 } from 'uuid';
-
-import { visit } from '@ember/test-helpers';
-import authPage from 'vault/tests/pages/auth';
-import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
-import { create } from 'ember-cli-page-object';
-import fm from 'vault/tests/pages/components/flash-message';
-const flashMessage = create(fm);
-const SELECTORS = {
-  generateSigningKey: '[data-test-ssh-input="generate-signing-key-checkbox"]',
-  saveConfig: '[data-test-ssh-input="configure-submit"]',
-  publicKey: '[data-test-ssh-input="public-key"]',
-};
-module('Acceptance | settings/configure/secrets/ssh', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.uid = uuidv4();
-    return authPage.login();
-  });
-
-  test('it configures ssh ca', async function (assert) {
-    const path = `ssh-configure-${this.uid}`;
-    await enablePage.enable('ssh', path);
-    await settled();
-    visit(`/vault/settings/secrets/configure/${path}`);
-    await settled();
-    assert.dom(SELECTORS.generateSigningKey).isChecked('generate_signing_key defaults to true');
-    await click(SELECTORS.generateSigningKey);
-    await click(SELECTORS.saveConfig);
-    assert.strictEqual(
-      flashMessage.latestMessage,
-      'missing public_key',
-      'renders warning flash message for failed save'
-    );
-    await click(SELECTORS.generateSigningKey);
-    await click(SELECTORS.saveConfig);
-    assert.dom(SELECTORS.publicKey).exists('renders public key after saving config');
-  });
-});
diff --git a/ui/tests/acceptance/settings/mount-secret-backend-test.js b/ui/tests/acceptance/settings/mount-secret-backend-test.js
deleted file mode 100644
index 4b8deae4afb..00000000000
--- a/ui/tests/acceptance/settings/mount-secret-backend-test.js
+++ /dev/null
@@ -1,301 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { currentRouteName, currentURL, settled } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import { v4 as uuidv4 } from 'uuid';
-
-import { create } from 'ember-cli-page-object';
-import page from 'vault/tests/pages/settings/mount-secret-backend';
-import configPage from 'vault/tests/pages/secrets/backend/configuration';
-import authPage from 'vault/tests/pages/auth';
-import consoleClass from 'vault/tests/pages/components/console/ui-panel';
-import logout from 'vault/tests/pages/logout';
-import mountSecrets from 'vault/tests/pages/settings/mount-secret-backend';
-import { mountableEngines } from 'vault/helpers/mountable-secret-engines'; // allEngines() includes enterprise engines, those are tested elsewhere
-import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
-
-const consoleComponent = create(consoleClass);
-
-// enterprise backends are tested separately
-const BACKENDS_WITH_ENGINES = ['kv', 'pki', 'ldap', 'kubernetes'];
-module('Acceptance | settings/mount-secret-backend', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.uid = uuidv4();
-    this.calcDays = (hours) => {
-      const days = Math.floor(hours / 24);
-      const remainder = hours % 24;
-      return `${days} days ${remainder} hours`;
-    };
-    return authPage.login();
-  });
-
-  test('it sets the ttl correctly when mounting', async function (assert) {
-    // always force the new mount to the top of the list
-    const path = `mount-kv-${this.uid}`;
-    const defaultTTLHours = 100;
-    const maxTTLHours = 300;
-    await page.visit();
-
-    assert.strictEqual(currentRouteName(), 'vault.cluster.settings.mount-secret-backend');
-    await page.selectType('kv');
-    await page
-      .path(path)
-      .toggleOptions()
-      .enableDefaultTtl()
-      .defaultTTLUnit('h')
-      .defaultTTLVal(defaultTTLHours)
-      .enableMaxTtl()
-      .maxTTLUnit('h')
-      .maxTTLVal(maxTTLHours)
-      .submit();
-    await configPage.visit({ backend: path });
-    assert.strictEqual(configPage.defaultTTL, `${this.calcDays(defaultTTLHours)}`, 'shows the proper TTL');
-    assert.strictEqual(configPage.maxTTL, `${this.calcDays(maxTTLHours)}`, 'shows the proper max TTL');
-  });
-
-  test('it sets the ttl when enabled then disabled', async function (assert) {
-    // always force the new mount to the top of the list
-    const path = `mount-kv-${this.uid}`;
-    const maxTTLHours = 300;
-
-    await page.visit();
-
-    assert.strictEqual(currentRouteName(), 'vault.cluster.settings.mount-secret-backend');
-    await page.selectType('kv');
-    await page
-      .path(path)
-      .toggleOptions()
-      .enableDefaultTtl()
-      .enableMaxTtl()
-      .maxTTLUnit('h')
-      .maxTTLVal(maxTTLHours)
-      .submit();
-    await configPage.visit({ backend: path });
-    assert.strictEqual(
-      configPage.defaultTTL,
-      '0',
-      'shows 0 (with no seconds) which means using the system default TTL'
-    ); // https://developer.hashicorp.com/vault/api-docs/system/mounts#default_lease_ttl-1
-    assert.strictEqual(configPage.maxTTL, `${this.calcDays(maxTTLHours)}`, 'shows the proper max TTL');
-  });
-
-  test('it sets the max ttl after pki chosen, resets after', async function (assert) {
-    await page.visit();
-    assert.strictEqual(currentRouteName(), 'vault.cluster.settings.mount-secret-backend');
-    await page.selectType('pki');
-    assert.dom('[data-test-input="maxLeaseTtl"]').exists();
-    assert
-      .dom('[data-test-input="maxLeaseTtl"] [data-test-ttl-toggle]')
-      .isChecked('Toggle is checked by default');
-    assert.dom('[data-test-input="maxLeaseTtl"] [data-test-ttl-value]').hasValue('3650');
-    assert.dom('[data-test-input="maxLeaseTtl"] [data-test-select="ttl-unit"]').hasValue('d');
-
-    // Go back and choose a different type
-    await page.back();
-    await page.selectType('database');
-    assert.dom('[data-test-input="maxLeaseTtl"]').exists('3650');
-    assert
-      .dom('[data-test-input="maxLeaseTtl"] [data-test-ttl-toggle]')
-      .isNotChecked('Toggle is unchecked by default');
-    await page.enableMaxTtl();
-    assert.dom('[data-test-input="maxLeaseTtl"] [data-test-ttl-value]').hasValue('');
-    assert.dom('[data-test-input="maxLeaseTtl"] [data-test-select="ttl-unit"]').hasValue('s');
-  });
-
-  test('it throws error if setting duplicate path name', async function (assert) {
-    const path = `kv-duplicate`;
-
-    await consoleComponent.runCommands([
-      // delete any kv-duplicate previously written here so that tests can be re-run
-      `delete sys/mounts/${path}`,
-    ]);
-
-    await page.visit();
-
-    assert.strictEqual(currentRouteName(), 'vault.cluster.settings.mount-secret-backend');
-    await page.selectType('kv');
-    await page.path(path).submit();
-    await page.secretList();
-    await settled();
-    await page.enableEngine();
-    await page.selectType('kv');
-    await page.path(path).submit();
-    assert.dom('[data-test-message-error-description]').containsText(`path is already in use at ${path}`);
-    assert.strictEqual(currentRouteName(), 'vault.cluster.settings.mount-secret-backend');
-
-    await page.secretList();
-    await settled();
-    assert
-      .dom(`[data-test-secrets-backend-link=${path}]`)
-      .exists({ count: 1 }, 'renders only one instance of the engine');
-  });
-
-  test('version 2 with no update to config endpoint still allows mount of secret engine', async function (assert) {
-    const enginePath = `kv-noUpdate-${this.uid}`;
-    const V2_POLICY = `
-      path "${enginePath}/*" {
-        capabilities = ["list","create","read","sudo","delete"]
-      }
-      path "sys/mounts/*"
-      {
-        capabilities = ["create", "read", "update", "delete", "list", "sudo"]
-      }
-
-      # List existing secrets engines.
-      path "sys/mounts"
-      {
-        capabilities = ["read"]
-      }
-      # Allow page to load after mount
-      path "sys/internal/ui/mounts/${enginePath}" {
-        capabilities = ["read"]
-      }
-    `;
-    await consoleComponent.runCommands([
-      // delete any previous mount with same name
-      `delete sys/mounts/${enginePath}`,
-      `write sys/policies/acl/kv-v2-degrade policy=${btoa(V2_POLICY)}`,
-      'write -field=client_token auth/token/create policies=kv-v2-degrade',
-    ]);
-    await settled();
-    const userToken = consoleComponent.lastLogOutput;
-    await logout.visit();
-    await authPage.login(userToken);
-    // create the engine
-    await mountSecrets.visit();
-    await mountSecrets.selectType('kv');
-    await mountSecrets.path(enginePath).setMaxVersion(101).submit();
-    await settled();
-    assert
-      .dom('[data-test-flash-message]')
-      .containsText(
-        `You do not have access to the config endpoint. The secret engine was mounted, but the configuration settings were not saved.`
-      );
-    assert.strictEqual(
-      currentURL(),
-      `/vault/secrets/${enginePath}/kv/list`,
-      'After mounting, redirects to secrets list page'
-    );
-    await configPage.visit({ backend: enginePath });
-    await settled();
-  });
-
-  test('it should transition to mountable addon engine after mount success', async function (assert) {
-    // test supported backends that ARE ember engines (enterprise only engines are tested individually)
-    const addons = mountableEngines().filter((e) => BACKENDS_WITH_ENGINES.includes(e.type));
-    assert.expect(addons.length);
-
-    for (const engine of addons) {
-      await consoleComponent.runCommands([
-        // delete any previous mount with same name
-        `delete sys/mounts/${engine.type}`,
-      ]);
-      await mountSecrets.visit();
-      await mountSecrets.selectType(engine.type);
-      await mountSecrets.path(engine.type).submit();
-      assert.strictEqual(
-        currentRouteName(),
-        `vault.cluster.secrets.backend.${engine.engineRoute}`,
-        `Transitions to ${engine.displayName} route on mount success`
-      );
-      await consoleComponent.runCommands([
-        // cleanup after
-        `delete sys/mounts/${engine.type}`,
-      ]);
-    }
-  });
-
-  test('it should transition to mountable non-addon engine after mount success', async function (assert) {
-    // test supported backends that are not ember engines (enterprise only engines are tested individually)
-    const nonEngineBackends = supportedSecretBackends().filter((b) => !BACKENDS_WITH_ENGINES.includes(b));
-    // add back kv because we want to test v1
-    const engines = mountableEngines().filter((e) => nonEngineBackends.includes(e.type) || e.type === 'kv');
-    assert.expect(engines.length);
-
-    for (const engine of engines) {
-      await consoleComponent.runCommands([
-        // delete any previous mount with same name
-        `delete sys/mounts/${engine.type}`,
-      ]);
-      await mountSecrets.visit();
-      await mountSecrets.selectType(engine.type);
-      await mountSecrets.path(engine.type);
-      if (engine.type === 'kv') {
-        await mountSecrets.toggleOptions().version(1);
-      }
-      await mountSecrets.submit();
-
-      assert.strictEqual(
-        currentRouteName(),
-        `vault.cluster.secrets.backend.list-root`,
-        `${engine.type} navigates to list view`
-      );
-      await consoleComponent.runCommands([
-        // cleanup after
-        `delete sys/mounts/${engine.type}`,
-      ]);
-    }
-  });
-
-  test('it should transition back to backend list for unsupported backends', async function (assert) {
-    const unsupported = mountableEngines().filter((e) => !supportedSecretBackends().includes(e.type));
-    assert.expect(unsupported.length);
-
-    for (const engine of unsupported) {
-      await consoleComponent.runCommands([
-        // delete any previous mount with same name
-        `delete sys/mounts/${engine.type}`,
-      ]);
-      await mountSecrets.visit();
-      await mountSecrets.selectType(engine.type);
-      await mountSecrets.path(engine.type).submit();
-
-      assert.strictEqual(
-        currentRouteName(),
-        `vault.cluster.secrets.backends`,
-        `${engine.type} returns to backends list`
-      );
-    }
-  });
-
-  test('it should transition to different locations for kv v1 and v2', async function (assert) {
-    assert.expect(4);
-    const v2 = 'kv-v2';
-    await consoleComponent.runCommands([
-      // delete any previous mount with same name
-      `delete sys/mounts/${v2}`,
-    ]);
-    await mountSecrets.visit();
-    await mountSecrets.selectType('kv');
-    await mountSecrets.path(v2).submit();
-
-    assert.strictEqual(currentURL(), `/vault/secrets/${v2}/kv/list`, `${v2} navigates to list url`);
-    assert.strictEqual(
-      currentRouteName(),
-      `vault.cluster.secrets.backend.kv.list`,
-      `${v2} navigates to list url`
-    );
-
-    const v1 = 'kv-v1';
-    await consoleComponent.runCommands([
-      // delete any previous mount with same name
-      `delete sys/mounts/${v1}`,
-    ]);
-    await mountSecrets.visit();
-    await mountSecrets.selectType('kv');
-    await mountSecrets.path(v1).toggleOptions().version(1).submit();
-
-    assert.strictEqual(currentURL(), `/vault/secrets/${v1}/list`, `${v1} navigates to list url`);
-    assert.strictEqual(
-      currentRouteName(),
-      `vault.cluster.secrets.backend.list-root`,
-      `${v1} navigates to list route`
-    );
-  });
-});
diff --git a/ui/tests/acceptance/sidebar-nav-test.js b/ui/tests/acceptance/sidebar-nav-test.js
index 14af0d1a2ab..cc2e3dddae2 100644
--- a/ui/tests/acceptance/sidebar-nav-test.js
+++ b/ui/tests/acceptance/sidebar-nav-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,9 +7,10 @@ import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { click, currentURL } from '@ember/test-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import modifyPassthroughResponse from 'vault/mirage/helpers/modify-passthrough-response';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const link = (label) => `[data-test-sidebar-nav-link="${label}"]`;
 const panel = (label) => `[data-test-sidebar-nav-panel="${label}"]`;
@@ -30,7 +31,7 @@ module('Acceptance | sidebar navigation', function (hooks) {
         'nested-interactive': { enabled: false },
       },
     });
-    return authPage.login();
+    return login();
   });
 
   test('it should navigate back to the dashboard when logo is clicked', async function (assert) {
@@ -60,7 +61,7 @@ module('Acceptance | sidebar navigation', function (hooks) {
     const links = [
       { label: 'Raft Storage', route: '/vault/storage/raft' },
       { label: 'Seal Vault', route: '/vault/settings/seal' },
-      { label: 'Secrets Engines', route: '/vault/secrets' },
+      { label: 'Secrets Engines', route: '/vault/secrets-engines' },
       { label: 'Dashboard', route: '/vault/dashboard' },
     ];
 
@@ -105,7 +106,7 @@ module('Acceptance | sidebar navigation', function (hooks) {
     assert.expect(7);
 
     await click(link('Tools'));
-    assert.dom(panel('Tools')).exists('Access nav panel renders');
+    assert.dom(panel('Tools')).exists('Tools nav panel renders');
 
     const links = [
       { label: 'Wrap', route: '/vault/tools/wrap' },
@@ -122,12 +123,26 @@ module('Acceptance | sidebar navigation', function (hooks) {
     }
   });
 
+  test('it should link to correct routes at the client counts level', async function (assert) {
+    assert.expect(7);
+    await click(link('Client Count'));
+    assert.dom(panel('Client Count')).exists('Client counts nav panel renders');
+    assert.strictEqual(currentURL(), '/vault/clients/counts/overview', 'Top level nav link renders overview');
+    assert.dom(link('Client Usage')).hasClass('active');
+    await click(link('Configuration'));
+    assert.strictEqual(currentURL(), '/vault/clients/config', 'Clients configuration renders');
+    assert.dom(link('Configuration')).hasClass('active');
+    await click(link('Client Usage'));
+    assert.strictEqual(currentURL(), '/vault/clients/counts/overview', 'Sub nav link navigates to overview');
+    assert.dom(link('Client Usage')).hasClass('active');
+  });
+
   test('it should display access nav when mounting and configuring auth methods', async function (assert) {
     await click(link('Access'));
     await click('[data-test-auth-enable]');
     assert.dom('[data-test-sidebar-nav-panel="Access"]').exists('Access nav panel renders');
     await click(link('Authentication Methods'));
-    await click('[data-test-auth-backend-link="token"]');
+    await click(GENERAL.linkedBlock('token'));
     await click('[data-test-configure-link]');
     assert.dom('[data-test-sidebar-nav-panel="Access"]').exists('Access nav panel renders');
   });
diff --git a/ui/tests/acceptance/ssh-test.js b/ui/tests/acceptance/ssh-test.js
deleted file mode 100644
index 72e1428009a..00000000000
--- a/ui/tests/acceptance/ssh-test.js
+++ /dev/null
@@ -1,183 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { click, fillIn, findAll, currentURL, find, settled, waitUntil } from '@ember/test-helpers';
-import { module, test } from 'qunit';
-import { setupApplicationTest } from 'ember-qunit';
-import { v4 as uuidv4 } from 'uuid';
-
-import authPage from 'vault/tests/pages/auth';
-import enablePage from 'vault/tests/pages/settings/mount-secret-backend';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
-
-module('Acceptance | ssh secret backend', function (hooks) {
-  setupApplicationTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.uid = uuidv4();
-    return authPage.login();
-  });
-
-  const PUB_KEY = `ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCn9p5dHNr4aU4R2W7ln+efzO5N2Cdv/SXk6zbCcvhWcblWMjkXf802B0PbKvf6cJIzM/Xalb3qz1cK+UUjCSEAQWefk6YmfzbOikfc5EHaSKUqDdE+HlsGPvl42rjCr28qYfuYh031YfwEQGEAIEypo7OyAj+38NLbHAQxDxuaReee1YCOV5rqWGtEgl2VtP5kG+QEBza4ZfeglS85f/GGTvZC4Jq1GX+wgmFxIPnd6/mUXa4ecoR0QMfOAzzvPm4ajcNCQORfHLQKAcmiBYMiyQJoU+fYpi9CJGT1jWTmR99yBkrSg6yitI2qqXyrpwAbhNGrM0Fw0WpWxh66N9Xp meirish@Macintosh-3.local`;
-
-  const ROLES = [
-    {
-      type: 'ca',
-      name: 'carole',
-      async fillInCreate() {
-        await click('[data-test-input="allowUserCertificates"]');
-      },
-      async fillInGenerate() {
-        await fillIn('[data-test-input="publicKey"]', PUB_KEY);
-        await click('[data-test-toggle-button]');
-
-        await click('[data-test-toggle-label="TTL"]');
-        await fillIn('[data-test-select="ttl-unit"]', 'm');
-
-        document.querySelector('[data-test-ttl-value="TTL"]').value = 30;
-      },
-      assertBeforeGenerate(assert) {
-        assert.dom('[data-test-form-field-from-model]').exists('renders the FormFieldFromModel');
-        const value = document.querySelector('[data-test-ttl-value="TTL"]').value;
-        // confirms that the actions are correctly being passed down to the FormFieldFromModel component
-        assert.strictEqual(value, '30', 'renders action updateTtl');
-      },
-      assertAfterGenerate(assert, sshPath) {
-        assert.strictEqual(
-          currentURL(),
-          `/vault/secrets/${sshPath}/sign/${this.name}`,
-          'ca sign url is correct'
-        );
-        assert.dom('[data-test-row-label="Signed key"]').exists({ count: 1 }, 'renders the signed key');
-        assert
-          .dom('[data-test-row-value="Signed key"]')
-          .exists({ count: 1 }, "renders the signed key's value");
-        assert.dom('[data-test-row-label="Serial number"]').exists({ count: 1 }, 'renders the serial');
-        assert.dom('[data-test-row-value="Serial number"]').exists({ count: 1 }, 'renders the serial value');
-      },
-    },
-    {
-      type: 'otp',
-      name: 'otprole',
-      async fillInCreate() {
-        await fillIn('[data-test-input="defaultUser"]', 'admin');
-        await click('[data-test-toggle-group="Options"]');
-        await fillIn('[data-test-input="cidrList"]', '1.2.3.4/32');
-      },
-      async fillInGenerate() {
-        await fillIn('[data-test-input="username"]', 'admin');
-        await fillIn('[data-test-input="ip"]', '1.2.3.4');
-      },
-      assertAfterGenerate(assert, sshPath) {
-        assert.strictEqual(
-          currentURL(),
-          `/vault/secrets/${sshPath}/credentials/${this.name}`,
-          'otp credential url is correct'
-        );
-        assert.dom('[data-test-row-label="Key"]').exists({ count: 1 }, 'renders the key');
-        assert.dom('[data-test-masked-input]').exists({ count: 1 }, 'renders mask for key value');
-        assert.dom('[data-test-row-label="Port"]').exists({ count: 1 }, 'renders the port');
-        assert.dom('[data-test-row-value="Port"]').exists({ count: 1 }, "renders the port's value");
-      },
-    },
-  ];
-  test('ssh backend', async function (assert) {
-    // Popup menu causes flakiness
-    setRunOptions({
-      rules: {
-        'color-contrast': { enabled: false },
-      },
-    });
-    assert.expect(28);
-    const sshPath = `ssh-${this.uid}`;
-
-    await enablePage.enable('ssh', sshPath);
-    await settled();
-    await click('[data-test-configuration-tab]');
-
-    await click('[data-test-secret-backend-configure]');
-
-    assert.strictEqual(currentURL(), `/vault/settings/secrets/configure/${sshPath}`);
-    assert.ok(findAll('[data-test-ssh-configure-form]').length, 'renders the empty configuration form');
-
-    // default has generate CA checked so we just submit the form
-    await click('[data-test-ssh-input="configure-submit"]');
-
-    assert.ok(
-      await waitUntil(() => findAll('[data-test-ssh-input="public-key"]').length),
-      'a public key is fetched'
-    );
-    await click('[data-test-backend-view-link]');
-
-    assert.strictEqual(currentURL(), `/vault/secrets/${sshPath}/list`, `redirects to ssh index`);
-
-    for (const role of ROLES) {
-      // create a role
-      await click('[ data-test-secret-create]');
-
-      assert.ok(
-        find('[data-test-secret-header]').textContent.includes('SSH Role'),
-        `${role.type}: renders the create page`
-      );
-
-      await fillIn('[data-test-input="name"]', role.name);
-      await fillIn('[data-test-input="keyType"]', role.type);
-      await role.fillInCreate();
-      await settled();
-
-      // save the role
-      await click('[data-test-role-ssh-create]');
-      await waitUntil(() => currentURL() === `/vault/secrets/${sshPath}/show/${role.name}`); // flaky without this
-      assert.strictEqual(
-        currentURL(),
-        `/vault/secrets/${sshPath}/show/${role.name}`,
-        `${role.type}: navigates to the show page on creation`
-      );
-
-      // sign a key with this role
-      await click('[data-test-backend-credentials]');
-
-      await role.fillInGenerate();
-      if (role.type === 'ca') {
-        await settled();
-        role.assertBeforeGenerate(assert);
-      }
-
-      // generate creds
-      await click('[data-test-secret-generate]');
-      await settled(); // eslint-disable-line
-      role.assertAfterGenerate(assert, sshPath);
-
-      // click the "Back" button
-      await click('[data-test-secret-generate-back]');
-
-      assert.ok(
-        findAll('[data-test-secret-generate-form]').length,
-        `${role.type}: back takes you back to the form`
-      );
-
-      await click('[data-test-secret-generate-cancel]');
-
-      assert.strictEqual(
-        currentURL(),
-        `/vault/secrets/${sshPath}/list`,
-        `${role.type}: cancel takes you to ssh index`
-      );
-      assert.ok(
-        findAll(`[data-test-secret-link="${role.name}"]`).length,
-        `${role.type}: role shows in the list`
-      );
-
-      //and delete
-      await click(`[data-test-secret-link="${role.name}"] [data-test-popup-menu-trigger]`);
-      await waitUntil(() => find('[data-test-ssh-role-delete]')); // flaky without
-      await click(`[data-test-ssh-role-delete]`);
-      await click(`[data-test-confirm-button]`);
-      assert
-        .dom(`[data-test-secret-link="${role.name}"]`)
-        .doesNotExist(`${role.type}: role is no longer in the list`);
-    }
-  });
-});
diff --git a/ui/tests/acceptance/sync/secrets/destination-test.js b/ui/tests/acceptance/sync/secrets/destination-test.js
index b5182b90c66..e541fbbabb5 100644
--- a/ui/tests/acceptance/sync/secrets/destination-test.js
+++ b/ui/tests/acceptance/sync/secrets/destination-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,19 +9,23 @@ import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import syncScenario from 'vault/mirage/scenarios/sync';
 import syncHandlers from 'vault/mirage/handlers/sync';
-import authPage from 'vault/tests/pages/auth';
+import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { settled, click, visit, currentURL, fillIn, currentRouteName } from '@ember/test-helpers';
 import { PAGE as ts } from 'vault/tests/helpers/sync/sync-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
 
 // sync is an enterprise feature but since mirage is used the enterprise label has been intentionally omitted from the module name
-module('Acceptance | sync | destination', function (hooks) {
+module('Acceptance | sync | destination (singular)', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
   hooks.beforeEach(async function () {
     syncScenario(this.server);
     syncHandlers(this.server);
-    return authPage.login();
+    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
+    return login();
   });
 
   test('it should transition to overview route via breadcrumb', async function (assert) {
@@ -36,20 +40,20 @@ module('Acceptance | sync | destination', function (hooks) {
 
   test('it should transition to correct routes when performing actions', async function (assert) {
     await click(ts.navLink('Secrets Sync'));
-    await click(ts.tab('Destinations'));
-    await click(ts.listItem);
-    assert.dom(ts.tab('Secrets')).hasClass('active', 'Secrets tab is active');
+    await click(GENERAL.tab('Destinations'));
+    await click(GENERAL.listItemLink);
+    assert.dom(GENERAL.tab('Secrets')).hasClass('active', 'Secrets hdsTab is active');
 
-    await click(ts.tab('Details'));
+    await click(GENERAL.tab('Details'));
     assert.dom(ts.infoRowLabel('Name')).exists('Destination details display');
 
     await click(ts.toolbar('Sync secrets'));
-    await click(ts.destinations.sync.cancel);
+    await click(GENERAL.cancelButton);
 
     await click(ts.toolbar('Edit destination'));
     assert.dom(ts.inputByAttr('name')).isDisabled('Edit view renders with disabled name field');
-    await click(ts.cancelButton);
-    assert.dom(ts.tab('Details')).hasClass('active', 'Details view is active');
+    await click(GENERAL.cancelButton);
+    assert.dom(GENERAL.tab('Details')).hasClass('active', 'Details view is active');
   });
 
   test('it should delete destination', async function (assert) {
@@ -60,40 +64,36 @@ module('Acceptance | sync | destination', function (hooks) {
     assert.strictEqual(currentURL(), '/vault/sync/secrets/overview', 'navigates back to overview on delete');
   });
 
-  test('it should not save placeholder values for credentials and only save when there are changes', async function (assert) {
+  test('it should not save placeholder values for credentials', async function (assert) {
     assert.expect(2);
 
-    const handler = this.server.patch(
-      '/sys/sync/destinations/vercel-project/destination-vercel',
-      (schema, req) => {
-        assert.deepEqual(
-          JSON.parse(req.requestBody),
-          { access_token: 'foobar' },
-          'Updated access token sent in patch request'
-        );
-        const { deployment_environments, project_id, team_id, name, type, secret_name_template } =
-          this.server.create('sync-destination', 'vercel-project');
-        return {
-          data: {
-            connection_details: { access_token: '*****', deployment_environments, project_id, team_id },
-            name,
-            options: { custom_tags: {}, secret_name_template },
-            type,
-          },
-        };
-      }
-    );
+    const apiService = this.owner.lookup('service:api');
+    const apiStub = sinon.stub(apiService.sys, 'systemPatchSyncDestinationsVercelProjectName');
+    const { deployment_environments, project_id, team_id, name, type, secret_name_template } =
+      this.server.create('sync-destination', 'vercel-project');
+    const response = {
+      data: {
+        connection_details: { access_token: '*****', deployment_environments, project_id, team_id },
+        name,
+        options: { custom_tags: {}, secret_name_template },
+        type,
+      },
+    };
+    apiStub.resolves(response);
 
     await visit('vault/sync/secrets/destinations/vercel-project/destination-vercel/edit');
-    await click(ts.enableField('accessToken'));
-    await fillIn(ts.inputByAttr('accessToken'), 'foobar');
-    await click(ts.saveButton);
+    await fillIn(GENERAL.inputByAttr('team_id'), 'team-id');
+    await click(GENERAL.submitButton);
+    assert.false('access_token' in apiStub.lastCall.args[1], 'access_token not sent in request');
+
     await click(ts.toolbar('Edit destination'));
-    await click(ts.saveButton);
+    await click(ts.enableField('access_token'));
+    await fillIn(GENERAL.inputByAttr('access_token'), 'foobar');
+    await click(GENERAL.submitButton);
     assert.strictEqual(
-      handler.numberOfCalls,
-      1,
-      'Model is not dirty after server returns masked value for credentials and save request is not made when there are no changes'
+      apiStub.lastCall.args[1].access_token,
+      'foobar',
+      'Updated access token sent in patch request'
     );
   });
 
@@ -112,8 +112,8 @@ module('Acceptance | sync | destination', function (hooks) {
     );
 
     await click(ts.breadcrumbLink('Destinations'));
-    await click(ts.menuTrigger);
-    await click(ts.destinations.list.menu.edit);
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.menuItem('edit'));
     assert.strictEqual(
       currentRouteName(),
       route,
@@ -121,12 +121,19 @@ module('Acceptance | sync | destination', function (hooks) {
     );
 
     await click(ts.breadcrumbLink('Destinations'));
-    await click(ts.menuTrigger);
-    await click(ts.destinations.list.menu.details);
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.menuItem('details'));
     assert.strictEqual(
       currentRouteName(),
       'vault.cluster.sync.secrets.destinations.destination.details',
       'Does no redirect when navigating to destination route other than edit or sync'
     );
   });
+
+  test('it should render correct number of associations in list for sub keys', async function (assert) {
+    this.server.db.syncDestinations.update({ granularity: 'secret-key' });
+
+    await visit('vault/sync/secrets/destinations/vercel-project/destination-vercel/secrets');
+    assert.dom('[data-test-list-item]').exists({ count: 3 }, 'Sub key associations render in list');
+  });
 });
diff --git a/ui/tests/acceptance/sync/secrets/destinations-test.js b/ui/tests/acceptance/sync/secrets/destinations-test.js
index 6885acd5fed..58cc5ded454 100644
--- a/ui/tests/acceptance/sync/secrets/destinations-test.js
+++ b/ui/tests/acceptance/sync/secrets/destinations-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,33 +8,44 @@ import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import syncScenario from 'vault/mirage/scenarios/sync';
 import syncHandlers from 'vault/mirage/handlers/sync';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { click, visit, fillIn, currentURL, currentRouteName } from '@ember/test-helpers';
 import { PAGE as ts } from 'vault/tests/helpers/sync/sync-selectors';
 import { syncDestinations } from 'vault/helpers/sync-destinations';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const SYNC_DESTINATIONS = syncDestinations();
 
 // sync is an enterprise feature but since mirage is used the enterprise label has been intentionally omitted from the module name
-module('Acceptance | sync | destinations', function (hooks) {
+module('Acceptance | sync | destinations (plural)', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
   hooks.beforeEach(async function () {
+    this.version = this.owner.lookup('service:version');
+    this.version.features = ['Secrets Sync'];
     syncScenario(this.server);
     syncHandlers(this.server);
-    return authPage.login();
+    return login();
   });
 
   test('it should create new destination', async function (assert) {
     // remove destinations from mirage so cta shows when 404 is returned
     this.server.db.syncDestinations.remove();
 
+    this.server.get('/sys/activation-flags', () => {
+      return {
+        data: {
+          activated: ['secrets-sync'],
+          unactivated: [],
+        },
+      };
+    });
     await click(ts.navLink('Secrets Sync'));
     await click(ts.cta.button);
     await click(ts.selectType('aws-sm'));
     await fillIn(ts.inputByAttr('name'), 'foo');
-    await click(ts.saveButton);
+    await click(GENERAL.submitButton);
     assert.dom(ts.infoRowValue('Name')).hasText('foo', 'Destination details render after create success');
 
     await click(ts.breadcrumbLink('Destinations'));
@@ -51,6 +62,14 @@ module('Acceptance | sync | destinations', function (hooks) {
     test(`it should render default values for destination: ${type}`, async function (assert) {
       // remove destinations from mirage so cta shows when 404 is returned
       this.server.db.syncDestinations.remove();
+      this.server.get('/sys/activation-flags', () => {
+        return {
+          data: {
+            activated: ['secrets-sync'],
+            unactivated: [],
+          },
+        };
+      });
 
       await click(ts.navLink('Secrets Sync'));
       await click(ts.cta.button);
@@ -59,33 +78,33 @@ module('Acceptance | sync | destinations', function (hooks) {
       // check default values
       const attr = 'granularity';
       assert
-        .dom(`${ts.inputByAttr(attr)} input#${defaultValues[attr]}`)
+        .dom(`${ts.inputGroupByAttr(attr)} input#${defaultValues[attr]}`)
         .isChecked(`${defaultValues[attr]} is checked`);
     });
   }
 
   test('it should filter destinations list', async function (assert) {
     await visit('vault/sync/secrets/destinations');
-    assert.dom(ts.listItem).exists({ count: 6 }, 'All destinations render');
+    assert.dom(GENERAL.listItemLink).exists({ count: 6 }, 'All destinations render');
     await click(`${ts.filter('type')} .ember-basic-dropdown-trigger`);
     await click(ts.searchSelect.option());
-    assert.dom(ts.listItem).exists({ count: 2 }, 'Destinations are filtered by type');
+    assert.dom(GENERAL.listItemLink).exists({ count: 2 }, 'Destinations are filtered by type');
     await fillIn(ts.filter('name'), 'new');
-    assert.dom(ts.listItem).exists({ count: 1 }, 'Destinations are filtered by type and name');
+    assert.dom(GENERAL.listItemLink).exists({ count: 1 }, 'Destinations are filtered by type and name');
     await click(ts.searchSelect.removeSelected);
     await fillIn(ts.filter('name'), 'gcp');
-    assert.dom(ts.listItem).exists({ count: 1 }, 'Destinations are filtered by name');
+    assert.dom(GENERAL.listItemLink).exists({ count: 1 }, 'Destinations are filtered by name');
   });
 
   test('it should transition to correct routes when performing actions', async function (assert) {
     const routeName = (route) => `vault.cluster.sync.secrets.destinations.destination.${route}`;
     await visit('vault/sync/secrets/destinations');
-    await click(ts.menuTrigger);
-    await click(ts.destinations.list.menu.details);
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.menuItem('details'));
     assert.strictEqual(currentRouteName(), routeName('details'), 'Navigates to details route');
     await click(ts.breadcrumbLink('Destinations'));
-    await click(ts.menuTrigger);
-    await click(ts.destinations.list.menu.edit);
+    await click(GENERAL.menuTrigger);
+    await click(GENERAL.menuItem('edit'));
     assert.strictEqual(currentRouteName(), routeName('edit'), 'Navigates to edit route');
   });
 });
diff --git a/ui/tests/acceptance/sync/secrets/overview-test.js b/ui/tests/acceptance/sync/secrets/overview-test.js
index ea24d262f73..74d8ba5a818 100644
--- a/ui/tests/acceptance/sync/secrets/overview-test.js
+++ b/ui/tests/acceptance/sync/secrets/overview-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,35 +8,260 @@ import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import syncScenario from 'vault/mirage/scenarios/sync';
 import syncHandlers from 'vault/mirage/handlers/sync';
-import authPage from 'vault/tests/pages/auth';
-import { click, waitFor } from '@ember/test-helpers';
+import { login, loginNs } from 'vault/tests/helpers/auth/auth-helpers';
+import { click, waitFor, visit, currentURL } from '@ember/test-helpers';
 import { PAGE as ts } from 'vault/tests/helpers/sync/sync-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { deleteNS, runCmd } from 'vault/tests/helpers/commands';
 
 // sync is an enterprise feature but since mirage is used the enterprise label has been intentionally omitted from the module name
-module('Acceptance | sync | destination', function (hooks) {
+module('Acceptance | sync | overview', function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
   hooks.beforeEach(async function () {
-    syncScenario(this.server);
-    syncHandlers(this.server);
-    return authPage.login();
+    this.version = this.owner.lookup('service:version');
+    this.version.type = 'enterprise';
+    this.server.get('/sys/license/features', () => ({ features: ['Secrets Sync'] }));
   });
 
-  test('it should transition to correct routes when performing actions', async function (assert) {
-    await click(ts.navLink('Secrets Sync'));
-    await click(ts.destinations.list.create);
-    await click(ts.createCancel);
-    await click(ts.overviewCard.actionLink('Create new'));
-    await click(ts.createCancel);
-    await waitFor(ts.overview.table.actionToggle(0));
-    await click(ts.overview.table.actionToggle(0));
-    await click(ts.overview.table.action('sync'));
-    await click(ts.destinations.sync.cancel);
-    await click(ts.breadcrumbLink('Secrets Sync'));
-    await waitFor(ts.overview.table.actionToggle(0));
-    await click(ts.overview.table.actionToggle(0));
-    await click(ts.overview.table.action('details'));
-    assert.dom(ts.tab('Secrets')).hasClass('active', 'Navigates to secrets view for destination');
+  test('it redirects on community', async function (assert) {
+    this.version.type = 'community';
+    await login();
+    await visit('/vault/sync/secrets/overview');
+    assert.strictEqual(currentURL(), '/vault/dashboard', 'redirects to cluster dashboard route');
+  });
+
+  test('it redirects if enterprise but not on license', async function (assert) {
+    this.server.get('/sys/license/features', () => ({ features: [] }));
+    await login();
+    await visit('/vault/sync/secrets/overview');
+    assert.strictEqual(currentURL(), '/vault/dashboard', 'redirects to cluster dashboard route');
+  });
+
+  // this test only runs on enterprise since HVD managed is harder to stub on CE
+  test('enterprise: it does not redirect if HVD managed', async function (assert) {
+    this.owner.lookup('service:flags').featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+    await login();
+    await visit('/vault/sync/secrets/overview');
+    assert.strictEqual(currentURL(), '/vault/sync/secrets/overview', 'it navigates to overview');
+  });
+
+  module('when feature is activated', function (hooks) {
+    hooks.beforeEach(async function () {
+      syncHandlers(this.server);
+      await login();
+    });
+
+    test('it fetches destinations and associations', async function (assert) {
+      assert.expect(2);
+
+      this.server.get('/sys/sync/destinations', () => {
+        assert.true(true, 'destinations is called');
+      });
+      this.server.get('/sys/sync/associations', () => {
+        assert.true(true, 'associations is called');
+      });
+
+      await visit('/vault/sync/secrets/overview');
+    });
+
+    test('it should transition to correct routes when performing actions', async function (assert) {
+      syncScenario(this.server);
+      await click(ts.navLink('Secrets Sync'));
+      await click(ts.destinations.list.create);
+      await click(ts.createCancel);
+      await click(ts.overviewCard.actionText('Create new'));
+      await click(ts.createCancel);
+      await waitFor(ts.overview.table.actionToggle(0));
+      await click(ts.overview.table.actionToggle(0));
+      await click(ts.overview.table.action('sync'));
+      await click(GENERAL.cancelButton);
+      await click(ts.breadcrumbLink('Secrets Sync'));
+      await waitFor(ts.overview.table.actionToggle(0));
+      await click(ts.overview.table.actionToggle(0));
+      await click(ts.overview.table.action('details'));
+      assert.dom(GENERAL.tab('Secrets')).hasClass('active', 'Navigates to secrets view for destination');
+    });
+  });
+
+  module('when feature is not activated', function (hooks) {
+    hooks.beforeEach(async function () {
+      let wasActivatePOSTCalled = false;
+      // simulate the feature being activated once /secrets-sync/activate has been called
+      this.server.get('/sys/activation-flags', () => {
+        if (wasActivatePOSTCalled) {
+          return {
+            data: {
+              activated: ['secrets-sync'],
+              unactivated: [''],
+            },
+          };
+        } else {
+          return {
+            data: {
+              activated: [''],
+              unactivated: ['secrets-sync'],
+            },
+          };
+        }
+      });
+
+      this.server.post('/sys/activation-flags/secrets-sync/activate', () => {
+        wasActivatePOSTCalled = true;
+        return {};
+      });
+      await login();
+    });
+
+    test('it does not fetch destinations and associations', async function (assert) {
+      assert.expect(0);
+
+      this.server.get('/sys/sync/destinations', () => {
+        assert.true(false, 'destinations is not called');
+      });
+      this.server.get('/sys/sync/associations', () => {
+        assert.true(false, 'associations is not called');
+      });
+
+      await visit('/vault/sync/secrets/overview');
+    });
+
+    test('the activation workflow works', async function (assert) {
+      await visit('/vault/sync/secrets/overview');
+
+      assert
+        .dom(ts.cta.button)
+        .doesNotExist('create first destination is not available until feature has been activated');
+
+      assert.dom(ts.overview.optInBanner.container).exists();
+      await click(ts.overview.optInBanner.enable);
+
+      assert
+        .dom(ts.overview.activationModal.container)
+        .exists('modal to opt-in and activate feature is shown');
+      await click(ts.overview.activationModal.checkbox);
+      await click(ts.overview.activationModal.confirm);
+
+      assert
+        .dom(ts.overview.activationModal.container)
+        .doesNotExist('modal is gone once activation has been submitted');
+      assert
+        .dom(ts.overview.optInBanner.container)
+        .doesNotExist('opt-in banner is gone once activation has been submitted');
+
+      await click(ts.cta.button);
+      assert.strictEqual(
+        currentURL(),
+        '/vault/sync/secrets/destinations/create',
+        'create new destination is available once feature is activated'
+      );
+    });
+
+    module('enterprise with namespaces', function (hooks) {
+      hooks.beforeEach(async function () {
+        this.version.features = ['Secrets Sync', 'Namespaces'];
+
+        await runCmd(`write sys/namespaces/admin -f`, false);
+        await loginNs('admin');
+        await runCmd(`write sys/namespaces/foo -f`, false);
+        await loginNs('admin/foo');
+      });
+
+      test('it should make activation-flag requests to correct namespace', async function (assert) {
+        assert.expect(3);
+
+        this.server.get('/sys/activation-flags', (_, req) => {
+          assert.deepEqual(req.requestHeaders, {}, 'Request is unauthenticated and in root namespace');
+          return {
+            data: {
+              activated: [''],
+              unactivated: ['secrets-sync'],
+            },
+          };
+        });
+        this.server.post('/sys/activation-flags/secrets-sync/activate', (_, req) => {
+          assert.strictEqual(
+            req.requestHeaders['X-Vault-Namespace'],
+            undefined,
+            'Request is made to undefined namespace'
+          );
+          return {};
+        });
+
+        // confirm we're in admin/foo
+        assert.dom('[data-test-badge-namespace]').hasText('foo');
+        await click(ts.navLink('Secrets Sync'));
+        await click(ts.overview.optInBanner.enable);
+        await click(ts.overview.activationModal.checkbox);
+        await click(ts.overview.activationModal.confirm);
+
+        // During the namespace cleanup in the afterEach hook this endpoint is hit again which increases the assertion count (above)
+        // Re-stub here without the assertion to reduce unnecessary assertions.
+        this.server.get('/sys/activation-flags', () => {
+          return {
+            data: {
+              activated: ['secrets-sync'],
+              unactivated: [],
+            },
+          };
+        });
+        await visit('vault/dashboard');
+        await runCmd([`delete admin/sys/namespaces/foo -f`, deleteNS('admin')]);
+      });
+
+      test('it should make activation-flag requests to correct namespace when managed', async function (assert) {
+        assert.expect(3);
+
+        const flagService = this.owner.lookup('service:flags');
+        flagService.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+
+        this.server.get('/sys/activation-flags', (_, req) => {
+          assert.deepEqual(req.requestHeaders, {}, 'Request is unauthenticated and in root namespace');
+          return {
+            data: {
+              activated: [''],
+              unactivated: ['secrets-sync'],
+            },
+          };
+        });
+        this.server.post('/sys/activation-flags/secrets-sync/activate', (_, req) => {
+          assert.strictEqual(
+            req.requestHeaders['x-vault-namespace'],
+            'admin',
+            'Request is made to the admin namespace'
+          );
+          return {};
+        });
+
+        // confirm we're in admin/foo
+        assert.dom('[data-test-badge-namespace]').hasText('foo');
+
+        await click(ts.navLink('Secrets Sync'));
+        await click(ts.overview.optInBanner.enable);
+        await click(ts.overview.activationModal.checkbox);
+        await click(ts.overview.activationModal.confirm);
+
+        // During the namespace cleanup in the afterEach hook this endpoint is hit again which increases the assertion count (above)
+        // Re-stub here without the assertion to reduce unnecessary assertions.
+        this.server.get('/sys/activation-flags', () => {
+          return {
+            data: {
+              activated: ['secrets-sync'],
+              unactivated: [],
+            },
+          };
+        });
+
+        // Delete the admin/foo namespace
+        await visit('vault/dashboard');
+        await runCmd([deleteNS('foo')]);
+
+        // Reset the HVD feature flag so that we can delete the admin namespace
+        flagService.featureFlags = [];
+        await login();
+        await runCmd([deleteNS('admin')]);
+      });
+    });
   });
 });
diff --git a/ui/tests/acceptance/tools-test.js b/ui/tests/acceptance/tools-test.js
index 152d23a10f2..ae4cd2d205c 100644
--- a/ui/tests/acceptance/tools-test.js
+++ b/ui/tests/acceptance/tools-test.js
@@ -1,169 +1,225 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { click, fillIn, find, findAll, currentURL, visit, settled, waitUntil } from '@ember/test-helpers';
-import Pretender from 'pretender';
+import { click, fillIn, find, findAll, currentURL, visit, waitUntil } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { toolsActions } from 'vault/helpers/tools-actions';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+
 import { capitalize } from '@ember/string';
+import codemirror, { assertCodeBlockValue, setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { TOOLS_SELECTORS as TS } from 'vault/tests/helpers/tools-selectors';
+
+const createTokenStore = () => {
+  let token;
+  return {
+    set(val) {
+      token = val;
+    },
+    get() {
+      return token;
+    },
+  };
+};
+const DATA_TO_WRAP = JSON.stringify({ tools: 'tests' });
 
 module('Acceptance | tools', function (hooks) {
   setupApplicationTest(hooks);
+  setupMirage(hooks);
 
-  hooks.beforeEach(function () {
-    return authPage.login();
+  hooks.beforeEach(async function () {
+    await login();
+    return visit('/vault/tools');
   });
 
-  const DATA_TO_WRAP = JSON.stringify({ tools: 'tests' });
-  const TOOLS_ACTIONS = toolsActions();
-
-  /*
-  data-test-tools-input="wrapping-token"
-  data-test-tools-input="rewrapped-token"
-  data-test-tools="token-lookup-row"
-  data-test-sidebar-nav-link=supportedAction
-  */
-
-  var createTokenStore = () => {
-    let token;
-    return {
-      set(val) {
-        token = val;
-      },
-      get() {
-        return token;
-      },
-    };
-  };
-  test('tools functionality', async function (assert) {
-    var tokenStore = createTokenStore();
-    await visit('/vault/tools');
+  test('it navigates to each action link', async function (assert) {
+    assert.strictEqual(currentURL(), '/vault/tools/wrap', 'forwards from "vault/tools" to the first action');
+    for (const action of toolsActions()) {
+      await click(GENERAL.navLink(capitalize(action)));
+      assert.strictEqual(currentURL(), `/vault/tools/${action}`, `it navigates to ${action}`);
+    }
+  });
 
-    assert.strictEqual(currentURL(), '/vault/tools/wrap', 'forwards to the first action');
-    TOOLS_ACTIONS.forEach((action) => {
-      assert.dom(`[data-test-sidebar-nav-link="${capitalize(action)}"]`).exists(`${action} link renders`);
+  module('cross tool workflow', function () {
+    test('it wraps data, performs lookup, rewraps and then unwraps data', async function (assert) {
+      const tokenStore = createTokenStore();
+
+      await waitUntil(() => find('.cm-editor'));
+
+      const editor = codemirror();
+      setCodeEditorValue(editor, DATA_TO_WRAP);
+
+      await click(GENERAL.submitButton);
+      const wrappedToken = await waitUntil(() => find(TS.toolsInput('wrapping-token')));
+      tokenStore.set(wrappedToken.innerText);
+
+      // lookup
+      await click(GENERAL.navLink('Lookup'));
+
+      await fillIn(TS.toolsInput('wrapping-token'), tokenStore.get());
+      await click(GENERAL.submitButton);
+      await waitUntil(() => findAll('[data-test-component="info-table-row"]').length >= 3);
+      assert
+        .dom(GENERAL.infoRowValue('Creation path'))
+        .hasText('sys/wrapping/wrap', 'show creation path row');
+      assert.dom(GENERAL.infoRowValue('Creation time')).exists();
+      assert.dom(GENERAL.infoRowValue('Creation TTL')).hasText('1800', 'show creation ttl row');
+
+      // rewrap
+      await click(GENERAL.navLink('Rewrap'));
+
+      await fillIn(TS.toolsInput('original-token'), tokenStore.get());
+      await click(GENERAL.submitButton);
+      await waitUntil(() => find(TS.toolsInput('rewrapped-token')));
+      const rewrappedToken = find(TS.toolsInput('rewrapped-token')).innerText;
+      assert.notEqual(rewrappedToken, tokenStore.get(), 're-wrapped token is not the wrapped token');
+      tokenStore.set(rewrappedToken);
+
+      // unwrap
+      await click(GENERAL.navLink('Unwrap'));
+      await fillIn(TS.toolsInput('unwrap-token'), tokenStore.get());
+      await click(GENERAL.submitButton);
+
+      await waitUntil(() => find('.hds-code-block__code'));
+      assertCodeBlockValue(assert, '.hds-code-block__code', DATA_TO_WRAP);
+
+      await waitUntil(() => find(GENERAL.hdsTab('details')));
+      await click(GENERAL.hdsTab('details'));
+      await click(GENERAL.hdsTab('data'));
+      assertCodeBlockValue(assert, '.hds-code-block__code', DATA_TO_WRAP);
     });
+  });
 
-    const { CodeMirror } = await waitUntil(() => find('.CodeMirror'));
-    CodeMirror.setValue(DATA_TO_WRAP);
-
-    // wrap
-    await click('[data-test-tools-submit]');
-    const wrappedToken = await waitUntil(() => find('[data-test-tools-input="wrapping-token"]'));
-    tokenStore.set(wrappedToken.value);
-    assert
-      .dom('[data-test-tools-input="wrapping-token"]')
-      .hasValue(wrappedToken.value, 'has a wrapping token');
-
-    //lookup
-    await click('[data-test-sidebar-nav-link="Lookup"]');
-
-    await fillIn('[data-test-tools-input="wrapping-token"]', tokenStore.get());
-    await click('[data-test-tools-submit]');
-    await waitUntil(() => findAll('[data-test-tools="token-lookup-row"]').length >= 3);
-    const rows = findAll('[data-test-tools="token-lookup-row"]');
-    assert.dom(rows[0]).hasText(/Creation path/, 'show creation path row');
-    assert.dom(rows[1]).hasText(/Creation time/, 'show creation time row');
-    assert.dom(rows[2]).hasText(/Creation TTL/, 'show creation ttl row');
-
-    //rewrap
-    await click('[data-test-sidebar-nav-link="Rewrap"]');
-
-    await fillIn('[data-test-tools-input="wrapping-token"]', tokenStore.get());
-    await click('[data-test-tools-submit]');
-    const rewrappedToken = await waitUntil(() => find('[data-test-tools-input="rewrapped-token"]'));
-    assert.ok(rewrappedToken.value, 'has a new re-wrapped token');
-    assert.notEqual(rewrappedToken.value, tokenStore.get(), 're-wrapped token is not the wrapped token');
-    tokenStore.set(rewrappedToken.value);
-    await settled();
-
-    //unwrap
-    await click('[data-test-sidebar-nav-link="Unwrap"]');
-
-    await fillIn('[data-test-tools-input="wrapping-token"]', tokenStore.get());
-    await click('[data-test-tools-submit]');
-    assert.deepEqual(
-      JSON.parse(CodeMirror.getValue()),
-      JSON.parse(DATA_TO_WRAP),
-      'unwrapped data equals input data'
-    );
-    const buttonDetails = await waitUntil(() => find('[data-test-button-details]'));
-    await click(buttonDetails);
-    await click('[data-test-button-data]');
-    assert.dom('.CodeMirror').exists();
-
-    //random
-    await click('[data-test-sidebar-nav-link="Random"]');
-
-    assert.dom('[data-test-tools-input="bytes"]').hasValue('32', 'defaults to 32 bytes');
-    await click('[data-test-tools-submit]');
-    const randomBytes = await waitUntil(() => find('[data-test-tools-input="random-bytes"]'));
-    assert.ok(randomBytes.value, 'shows the returned value of random bytes');
-
-    //hash
-    await click('[data-test-sidebar-nav-link="Hash"]');
-
-    await fillIn('[data-test-tools-input="hash-input"]', 'foo');
-    await click('[data-test-transit-b64-toggle="input"]');
-
-    await click('[data-test-tools-submit]');
-    let sumInput = await waitUntil(() => find('[data-test-tools-input="sum"]'));
-    assert
-      .dom(sumInput)
-      .hasValue('LCa0a2j/xo/5m0U8HTBBNBNCLXBkg7+g+YpeiGJm564=', 'hashes the data, encodes input');
-    await click('[data-test-tools-back]');
-
-    await fillIn('[data-test-tools-input="hash-input"]', 'e2RhdGE6ImZvbyJ9');
-
-    await click('[data-test-tools-submit]');
-    sumInput = await waitUntil(() => find('[data-test-tools-input="sum"]'));
-    assert
-      .dom(sumInput)
-      .hasValue('JmSi2Hhbgu2WYOrcOyTqqMdym7KT3sohCwAwaMonVrc=', 'hashes the data, passes b64 input through');
+  module('random', function () {
+    test('it generates random bytes', async function (assert) {
+      await click(GENERAL.navLink('Random'));
+      assert.dom(TS.toolsInput('bytes')).hasValue('32', 'defaults to 32 bytes');
+      await click(GENERAL.submitButton);
+      const randomBytes = await waitUntil(() => find(TS.toolsInput('random-bytes')));
+      assert.strictEqual(randomBytes.innerText.length, 44, 'shows the returned value of random bytes');
+    });
   });
 
-  const AUTH_RESPONSE = {
-    request_id: '39802bc4-235c-2f0b-87f3-ccf38503ac3e',
-    lease_id: '',
-    renewable: false,
-    lease_duration: 0,
-    data: null,
-    wrap_info: null,
-    warnings: null,
-    auth: {
-      client_token: 'ecfc2758-588e-981d-50f4-a25883bbf03c',
-      accessor: '6299780b-f2b2-1a3f-7b83-9d3d67629249',
-      policies: ['root'],
-      metadata: null,
-      lease_duration: 0,
-      renewable: false,
-      entity_id: '',
-    },
-  };
+  module('hash', function () {
+    test('it generates hash', async function (assert) {
+      await click(GENERAL.navLink('Hash'));
+
+      await fillIn(TS.toolsInput('hash-input'), 'foo');
+      await click(TS.toolsInput('b64-toggle'));
+      assert.dom(TS.toolsInput('hash-input')).hasValue('Zm9v', 'it base64 encodes input');
+      await click(GENERAL.submitButton);
+      let sumInput = await waitUntil(() => find(TS.toolsInput('sum')));
+      assert
+        .dom(sumInput)
+        .hasText('LCa0a2j/xo/5m0U8HTBBNBNCLXBkg7+g+YpeiGJm564=', 'hashes the data, encodes input');
+      await click(GENERAL.button('Done'));
+
+      await waitUntil(() => find(TS.toolsInput('hash-input')));
+      assert.dom(TS.toolsInput('hash-input')).hasText('', 'it clears input on done');
+      await fillIn(TS.toolsInput('hash-input'), 'e2RhdGE6ImZvbyJ9');
+
+      await click(GENERAL.submitButton);
+      sumInput = await waitUntil(() => find(TS.toolsInput('sum')));
+      assert
+        .dom(sumInput)
+        .hasText('JmSi2Hhbgu2WYOrcOyTqqMdym7KT3sohCwAwaMonVrc=', 'hashes the data, passes b64 input through');
+    });
+  });
 
-  test('ensure unwrap with auth block works properly', async function (assert) {
-    this.server = new Pretender(function () {
-      this.post('/v1/sys/wrapping/unwrap', (response) => {
-        return [response, { 'Content-Type': 'application/json' }, JSON.stringify(AUTH_RESPONSE)];
+  module('unwrap', function () {
+    test('it unwraps with auth block', async function (assert) {
+      const AUTH_RESPONSE = {
+        request_id: '39802bc4-235c-2f0b-87f3-ccf38503ac3e',
+        lease_id: '',
+        renewable: false,
+        lease_duration: 0,
+        data: null,
+        wrap_info: null,
+        warnings: null,
+        auth: {
+          client_token: 'ecfc2758-588e-981d-50f4-a25883bbf03c',
+          accessor: '6299780b-f2b2-1a3f-7b83-9d3d67629249',
+          policies: ['root'],
+          metadata: null,
+          lease_duration: 0,
+          renewable: false,
+          entity_id: '',
+        },
+      };
+      this.server.post('/sys/wrapping/unwrap', () => {
+        return AUTH_RESPONSE;
       });
+
+      // unwrap
+      await click(GENERAL.navLink('Unwrap'));
+
+      await fillIn(TS.toolsInput('unwrap-token'), 'sometoken');
+      await click(GENERAL.submitButton);
+
+      await waitUntil(() => find('.hds-code-block__code'));
+      assertCodeBlockValue(assert, '.hds-code-block__code', AUTH_RESPONSE.auth);
     });
-    await visit('/vault/tools');
+  });
 
-    //unwrap
-    await click('[data-test-sidebar-nav-link="Unwrap"]');
+  module('wrap', function () {
+    test('it wraps data again after clicking "Back"', async function (assert) {
+      const tokenStore = createTokenStore();
+      await visit('/vault/tools/wrap');
+
+      await waitUntil(() => find('.cm-editor'));
+      const editor = codemirror();
+      setCodeEditorValue(editor, DATA_TO_WRAP);
+
+      // initial wrap
+      await click(GENERAL.submitButton);
+      await waitUntil(() => find(TS.toolsInput('wrapping-token')));
+      await click(GENERAL.button('Back'));
+
+      // wrap again without re-inputting data
+      await click(GENERAL.submitButton);
+      const wrappedToken = await waitUntil(() => find(TS.toolsInput('wrapping-token')));
+      tokenStore.set(wrappedToken.innerText);
+
+      // there was a bug where clicking "back" cleared the parent's data, but not the child form component
+      // so when users attempted to wrap data again the payload was actually empty and unwrapping the token returned {token: ""}
+      // it is user desired behavior that the form does not clear on back, and that wrapping can be immediately repeated
+      // we use lookup to check our token from the second wrap returns the unwrapped data we expect
+      await click(GENERAL.navLink('Unwrap'));
+      await fillIn(TS.toolsInput('unwrap-token'), tokenStore.get());
+      await click(GENERAL.submitButton);
+
+      await waitUntil(() => find('.hds-code-block__code'));
+      assertCodeBlockValue(assert, '.hds-code-block__code', '{   "tools": "tests" }');
+    });
+
+    test('it sends wrap ttl', async function (assert) {
+      const tokenStore = createTokenStore();
+      await visit('/vault/tools/wrap');
+
+      await waitUntil(() => find('.cm-editor'));
+      const editor = codemirror();
+      setCodeEditorValue(editor, DATA_TO_WRAP);
 
-    await fillIn('[data-test-tools-input="wrapping-token"]', 'sometoken');
-    await click('[data-test-tools-submit]');
+      // update to non-default ttl
+      await click(GENERAL.toggleInput('Wrap TTL'));
+      await fillIn(GENERAL.ttl.input('Wrap TTL'), '20');
 
-    assert.deepEqual(
-      JSON.parse(findAll('.CodeMirror')[0].CodeMirror.getValue()),
-      AUTH_RESPONSE.auth,
-      'unwrapped data equals input data'
-    );
-    this.server.shutdown();
+      await click(GENERAL.submitButton);
+      const wrappedToken = await waitUntil(() => find(TS.toolsInput('wrapping-token')));
+      tokenStore.set(wrappedToken.innerText);
+
+      // lookup to check ttl is what we expect
+      await click(GENERAL.navLink('Lookup'));
+      await fillIn(TS.toolsInput('wrapping-token'), tokenStore.get());
+      await click(GENERAL.submitButton);
+      await waitUntil(() => findAll('[data-test-component="info-table-row"]').length >= 3);
+      assert.dom(GENERAL.infoRowValue('Creation TTL')).hasText('1200', 'show creation ttl row');
+    });
   });
 });
diff --git a/ui/tests/acceptance/transit-test.js b/ui/tests/acceptance/transit-test.js
index 25b553a244c..971c93d918c 100644
--- a/ui/tests/acceptance/transit-test.js
+++ b/ui/tests/acceptance/transit-test.js
@@ -1,30 +1,30 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { click, fillIn, find, currentURL, settled, visit, findAll } from '@ember/test-helpers';
+import { click, fillIn, find, currentURL, settled, visit, findAll, waitFor } from '@ember/test-helpers';
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
 import { v4 as uuidv4 } from 'uuid';
 
 import { encodeString } from 'vault/utils/b64';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { deleteEngineCmd, mountEngineCmd, runCmd } from 'vault/tests/helpers/commands';
+import codemirror, { setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
 
 const SELECTORS = {
   secretLink: '[data-test-secret-link]',
   popupMenu: '[data-test-popup-menu-trigger]',
   versionsTab: '[data-test-transit-link="versions"]',
   actionsTab: '[data-test-transit-key-actions-link]',
-  rootCrumb: (path) => `[data-test-secret-breadcrumb="${path}"] a`,
   card: (action) => `[data-test-transit-card="${action}"]`,
-  infoRow: (label) => `[data-test-value-div="${label}"]`,
   form: (item) => `[data-test-transit-key="${item}"]`,
   versionRow: (version) => `[data-test-transit-version="${version}"]`,
   rotate: {
     trigger: '[data-test-transit-key-rotate]',
-    confirm: '[data-test-confirm-button]',
   },
 };
 
@@ -150,7 +150,9 @@ const testConvergentEncryption = async function (assert, keyName) {
   for (const testCase of tests) {
     await click('[data-test-transit-action-link="encrypt"]');
 
-    find('#plaintext-control .CodeMirror').CodeMirror.setValue(testCase.plaintext);
+    await waitFor('.cm-editor');
+    const editor = codemirror('#plaintext-control');
+    setCodeEditorValue(editor, testCase.plaintext);
     await fillIn('[data-test-transit-input="context"]', testCase.context);
 
     if (!testCase.encodePlaintext) {
@@ -160,8 +162,8 @@ const testConvergentEncryption = async function (assert, keyName) {
     if (testCase.encodeContext) {
       await click('[data-test-transit-b64-toggle="context"]');
     }
-    assert.dom('[data-test-encrypt-modal]').doesNotExist(`${name}: is not open before encrypt`);
-    await click('[data-test-button-encrypt]');
+    assert.dom('[data-test-encrypt-modal]').doesNotExist(`${keyName}: is not open before encrypt`);
+    await click(GENERAL.submitButton);
 
     if (testCase.assertAfterEncrypt) {
       await settled();
@@ -171,15 +173,17 @@ const testConvergentEncryption = async function (assert, keyName) {
     const copiedCiphertext = find('[data-test-encrypted-value="ciphertext"]').innerText;
     await click('dialog button');
 
-    assert.dom('dialog.hds-modal').doesNotExist(`${name}: Modal closes after background clicked`);
+    assert.dom('dialog.hds-modal').doesNotExist(`${keyName}: Modal closes after background clicked`);
     await click('[data-test-transit-action-link="decrypt"]');
 
     if (testCase.assertBeforeDecrypt) {
       await settled();
       testCase.assertBeforeDecrypt(keyName);
     }
-    find('#ciphertext-control .CodeMirror').CodeMirror.setValue(copiedCiphertext);
-    await click('[data-test-button-decrypt]');
+
+    setCodeEditorValue(editor, copiedCiphertext);
+
+    await click(GENERAL.submitButton);
 
     if (testCase.assertAfterDecrypt) {
       await settled();
@@ -188,16 +192,16 @@ const testConvergentEncryption = async function (assert, keyName) {
 
     await click('dialog button');
 
-    assert.dom('dialog.hds-modal').doesNotExist(`${name}: Modal closes after background clicked`);
+    assert.dom('dialog.hds-modal').doesNotExist(`${keyName}: Modal closes after background clicked`);
   }
 };
 
-module('Acceptance | transit (flaky)', function (hooks) {
+module('Acceptance | transit', function (hooks) {
   setupApplicationTest(hooks);
 
   hooks.beforeEach(async function () {
     const uid = uuidv4();
-    await authPage.login();
+    await login();
     this.uid = uid;
     this.path = `transit-${uid}`;
 
@@ -215,11 +219,11 @@ module('Acceptance | transit (flaky)', function (hooks) {
     };
     await runCmd(mountEngineCmd('transit', this.path));
     // Start test on backend main page
-    return visit(`/vault/secrets/${this.path}/list`);
+    return visit(`/vault/secrets-engines/${this.path}/list`);
   });
 
   hooks.afterEach(async function () {
-    await authPage.login();
+    await login();
     await runCmd(deleteEngineCmd(this.mountPath));
   });
 
@@ -227,26 +231,26 @@ module('Acceptance | transit (flaky)', function (hooks) {
     assert.expect(8);
     const type = 'chacha20-poly1305';
     const name = `test-generate-${this.uid}`;
-    await click('[data-test-secret-create]');
+    await click(SES.createSecretLink);
 
     await fillIn(SELECTORS.form('name'), name);
     await fillIn(SELECTORS.form('type'), type);
     await click(SELECTORS.form('exportable'));
     await click(SELECTORS.form('derived'));
     await click(SELECTORS.form('convergent-encryption'));
-    await click('[data-test-toggle-label="Auto-rotation period"]');
+    await click(GENERAL.ttl.toggle('Auto-rotation period'));
     await click(SELECTORS.form('create'));
 
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${this.path}/show/${name}?tab=details`,
+      `/vault/secrets-engines/${this.path}/show/${name}?tab=details`,
       'it navigates to show page'
     );
-    assert.dom(SELECTORS.infoRow('Auto-rotation period')).hasText('30 days');
-    assert.dom(SELECTORS.infoRow('Deletion allowed')).hasText('false');
-    assert.dom(SELECTORS.infoRow('Derived')).hasText('Yes');
-    assert.dom(SELECTORS.infoRow('Convergent encryption')).hasText('Yes');
-    await click(SELECTORS.rootCrumb(this.path));
+    assert.dom(GENERAL.infoRowValue('Auto-rotation period')).hasText('30 days');
+    assert.dom(GENERAL.infoRowValue('Deletion allowed')).hasText('false');
+    assert.dom(GENERAL.infoRowValue('Derived')).hasText('Yes');
+    assert.dom(GENERAL.infoRowValue('Convergent encryption')).hasText('Yes');
+    await click(GENERAL.breadcrumbLink(this.path));
     await click(SELECTORS.popupMenu);
     const actions = findAll('.hds-dropdown__list li');
     assert.strictEqual(actions.length, 2, 'shows 2 items in popup menu');
@@ -254,20 +258,20 @@ module('Acceptance | transit (flaky)', function (hooks) {
     await click(SELECTORS.secretLink);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${this.path}/show/${name}?tab=actions`,
+      `/vault/secrets-engines/${this.path}/show/${name}?tab=actions`,
       'navigates to key actions tab'
     );
     await click(SELECTORS.actionsTab);
     assert.strictEqual(
       currentURL(),
-      `/vault/secrets/${this.path}/show/${name}?tab=actions`,
+      `/vault/secrets-engines/${this.path}/show/${name}?tab=actions`,
       'navigates back to transit actions'
     );
   });
 
   test('create form renders supported options for each key type', async function (assert) {
     assert.expect(30);
-    await visit(`/vault/secrets/${this.path}/create`);
+    await visit(`/vault/secrets-engines/${this.path}/create`);
     const KEY_OPTIONS = [
       {
         type: 'ed25519',
@@ -341,16 +345,16 @@ module('Acceptance | transit (flaky)', function (hooks) {
     };
 
     const name = await this.generateTransitKey(keyData);
-    await visit(`vault/secrets/${this.path}/show/${name}`);
+    await visit(`vault/secrets-engines/${this.path}/show/${name}`);
     assert
-      .dom(SELECTORS.infoRow('Auto-rotation period'))
+      .dom(GENERAL.infoRowValue('Auto-rotation period'))
       .hasText('30 days', 'Has expected auto rotate value');
 
     await click(SELECTORS.versionsTab);
     assert.dom(SELECTORS.versionRow(1)).hasTextContaining('Version 1', `${name}: only one key version`);
 
     await click(SELECTORS.rotate.trigger);
-    await click(SELECTORS.rotate.confirm);
+    await click(GENERAL.confirmButton);
 
     assert.dom(SELECTORS.versionRow(2)).exists('two key versions after rotate');
 
@@ -458,11 +462,11 @@ module('Acceptance | transit (flaky)', function (hooks) {
     test(`transit backend: ${key.type}`, async function (assert) {
       assert.expect(key.convergent ? 43 : 7);
       const name = await this.generateTransitKey(key);
-      await visit(`vault/secrets/${this.path}/show/${name}`);
+      await visit(`vault/secrets-engines/${this.path}/show/${name}`);
 
       const expectedRotateValue = key.autoRotate ? '30 days' : 'Key will not be automatically rotated';
       assert
-        .dom('[data-test-row-value="Auto-rotation period"]')
+        .dom(GENERAL.infoRowValue('Auto-rotation period'))
         .hasText(expectedRotateValue, 'Has expected auto rotate value');
 
       await click(SELECTORS.versionsTab);
@@ -471,7 +475,7 @@ module('Acceptance | transit (flaky)', function (hooks) {
       assert.dom('[data-test-transit-version]').exists({ count: 1 }, `${name}: only one key version`);
       await click(SELECTORS.rotate.trigger);
 
-      await click(SELECTORS.rotate.confirm);
+      await click(GENERAL.confirmButton);
       assert
         .dom('[data-test-transit-version]')
         .exists({ count: 2 }, `${name}: two key versions after rotate`);
@@ -479,7 +483,7 @@ module('Acceptance | transit (flaky)', function (hooks) {
 
       assert.strictEqual(
         currentURL(),
-        `/vault/secrets/${this.path}/show/${name}?tab=actions`,
+        `/vault/secrets-engines/${this.path}/show/${name}?tab=actions`,
         `${name}: navigates to transit actions`
       );
 
diff --git a/ui/tests/acceptance/unseal-test.js b/ui/tests/acceptance/unseal-test.js
index f7a1cab3ecd..32fae0e4cd5 100644
--- a/ui/tests/acceptance/unseal-test.js
+++ b/ui/tests/acceptance/unseal-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,9 +9,10 @@ import { setupApplicationTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 
 import VAULT_KEYS from 'vault/tests/helpers/vault-keys';
-import authPage from 'vault/tests/pages/auth';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
 import { pollCluster } from 'vault/tests/helpers/poll-cluster';
-import { overrideResponse } from 'vault/tests/helpers/clients';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const { unsealKeys } = VAULT_KEYS;
 
@@ -22,7 +23,7 @@ module('Acceptance | unseal', function (hooks) {
   hooks.beforeEach(function () {
     this.unsealCount = 0;
     this.sealed = false;
-    return authPage.login();
+    return login();
   });
 
   test('seal then unseal', async function (assert) {
@@ -57,7 +58,7 @@ module('Acceptance | unseal', function (hooks) {
 
     // seal
     await click('[data-test-seal]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
 
     await pollCluster(this.owner);
     await settled();
diff --git a/ui/tests/acceptance/vault-reporting/index-test.js b/ui/tests/acceptance/vault-reporting/index-test.js
new file mode 100644
index 00000000000..27ea5e30b52
--- /dev/null
+++ b/ui/tests/acceptance/vault-reporting/index-test.js
@@ -0,0 +1,353 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupApplicationTest } from 'ember-qunit';
+import { visit, currentURL, waitFor, click, fillIn } from '@ember/test-helpers';
+import { login } from 'vault/tests/helpers/auth/auth-helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { mockedResponseWithData, mockedEmptyResponse } from 'vault/tests/helpers/vault-usage/mocks';
+import { createPolicyCmd, createTokenCmd, runCmd } from 'vault/tests/helpers/commands';
+
+const loginWithReportingToken = async (capability = 'read') => {
+  const policyName = 'show-vault-reporting';
+  const policy = `
+      path "sys/utilization-report" {
+        capabilities = ["${capability}"]
+      }
+    `;
+
+  const commands = [createPolicyCmd(policyName, policy), createTokenCmd(policyName)];
+  // Use lower privileged token
+  const token = await runCmd(commands);
+  await login(token);
+};
+
+module('Acceptance | enterprise vault-reporting', function (hooks) {
+  setupApplicationTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    await login();
+  });
+
+  test('it visits the usage reporting dashboard and renders the header', async function (assert) {
+    // Log in with lower privileged token
+    await loginWithReportingToken('read');
+    await visit('/vault/dashboard');
+    await click('[data-test-sidebar-nav-link="Vault Usage"]');
+    assert.strictEqual(currentURL(), '/vault/usage-reporting', 'navigates to usage reporting dashboard');
+    assert.dom('.hds-page-header').includesText('Vault Usage', 'renders the "Vault Usage" header');
+  });
+
+  test('it hides the nav item if policy does not allow access to sys/utilization-report', async function (assert) {
+    await loginWithReportingToken('deny');
+    await visit('/vault/dashboard');
+    assert.dom('[data-test-sidebar-nav-link="Vault Usage"]').doesNotExist('sidebar nav link is hidden');
+  });
+
+  test('it renders the counters dashboard block with all expected counters', async function (assert) {
+    this.server.get('sys/utilization-report', () => mockedResponseWithData);
+    await visit('/vault/usage-reporting');
+    await waitFor('[data-test-vault-reporting-dashboard-counters]');
+    assert
+      .dom('[data-test-vault-reporting-dashboard-counters]')
+      .exists('renders the counters dashboard block');
+
+    const expectedCounters = ['Child namespaces', 'KV secrets', 'PKI roles'];
+
+    expectedCounters.forEach((counterLabel) => {
+      assert
+        .dom(`[data-test-vault-reporting-counter="${counterLabel}"]`)
+        .exists(`counter "${counterLabel}" is rendered`);
+    });
+
+    assert.dom('[data-test-vault-reporting-counter="Child namespaces"]').includesText('1');
+    assert.dom('[data-test-vault-reporting-counter="KV secrets"]').includesText('100');
+  });
+
+  test('dashboard card: Secret engines', async function (assert) {
+    this.server.get('sys/utilization-report', () => mockedResponseWithData);
+    await visit('/vault/usage-reporting');
+    await waitFor('[data-test-vault-reporting-dashboard-secret-engines]');
+
+    assert.dom('[data-test-vault-reporting-dashboard-secret-engines]').exists('renders Secret engines card');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-secret-engines] [data-test-vault-reporting-dashboard-card-title]'
+      )
+      .exists('title is present')
+      .hasText('Secret engines', 'title is correct');
+
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-secret-engines] [data-test-vault-reporting-dashboard-card-title-link]'
+      )
+      .exists('title link is present')
+      .hasAttribute('href', '/ui/vault/secrets-engines', 'link points to secrets');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-secret-engines] [data-test-vault-reporting-dashboard-card-description]'
+      )
+      .exists('description is present')
+      .hasText('Enabled secret engines for this cluster.', 'description is correct');
+    assert
+      .dom('[data-test-vault-reporting-dashboard-secret-engines]')
+      .includesText('aws nomad cubbyhole 47 46 45');
+  });
+
+  test('dashboard card: Authentication methods', async function (assert) {
+    this.server.get('sys/utilization-report', () => mockedResponseWithData);
+    await visit('/vault/usage-reporting');
+    await waitFor('[data-test-vault-reporting-dashboard-auth-methods]');
+
+    assert
+      .dom('[data-test-vault-reporting-dashboard-auth-methods]')
+      .exists('renders Authentication methods card');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-auth-methods] [data-test-vault-reporting-dashboard-card-title]'
+      )
+      .exists('title is present')
+      .hasText('Authentication methods', 'title is correct');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-auth-methods] [data-test-vault-reporting-dashboard-card-title-link]'
+      )
+      .exists('title link is present')
+      .hasAttribute('href', '/ui/vault/access', 'link points to access');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-auth-methods] [data-test-vault-reporting-dashboard-card-description]'
+      )
+      .exists('description is present')
+      .hasText('Enabled authentication methods for this cluster.', 'description is correct');
+    assert
+      .dom('[data-test-vault-reporting-dashboard-auth-methods]')
+      .includesText('kubernetes userpass aws 44 43 42');
+  });
+
+  test('dashboard card: Global lease count quota', async function (assert) {
+    this.server.get('sys/utilization-report', () => mockedResponseWithData);
+    await visit('/vault/usage-reporting');
+    await waitFor('[data-test-vault-reporting-dashboard-lease-count]');
+
+    assert
+      .dom('[data-test-vault-reporting-dashboard-lease-count]')
+      .exists('renders Global lease count quota card');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-lease-count] [data-test-vault-reporting-dashboard-card-title]'
+      )
+      .exists('title is present')
+      .hasText('Global lease count quota', 'title is correct');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-lease-count] [data-test-vault-reporting-dashboard-card-title-link]'
+      )
+      .exists('title link is present')
+      .hasAttribute(
+        'href',
+        'https://developer.hashicorp.com/vault/tutorials/operations/resource-quotas#global-default-lease-count-quota',
+        'link points to lease count docs'
+      );
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-lease-count] [data-test-vault-reporting-dashboard-card-description]'
+      )
+      .exists('description is present')
+      .hasText('Total number of active leases for this quota.', 'description is correct');
+    assert
+      .dom('[data-test-vault-reporting-global-lease-percentage-text]')
+      .hasText('50%', 'percentage is correct');
+    assert
+      .dom('[data-test-vault-reporting-global-lease-count-text]')
+      .hasText('210K / 420K', 'lease count is correct');
+  });
+
+  test('dashboard card: Secrets sync', async function (assert) {
+    this.server.get('sys/utilization-report', () => mockedResponseWithData);
+    await visit('/vault/usage-reporting');
+    await waitFor('[data-test-vault-reporting-dashboard-secrets-sync]');
+
+    assert.dom('[data-test-vault-reporting-dashboard-secrets-sync]').exists('renders Secrets sync card');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-secrets-sync] [data-test-vault-reporting-dashboard-card-title]'
+      )
+      .hasText('Secrets sync', 'title is correct');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-secrets-sync] [data-test-vault-reporting-dashboard-card-title-link]'
+      )
+      .exists('title link is present')
+      .hasAttribute('href', '/ui/vault/sync', 'link points to sync');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-secrets-sync] [data-test-vault-reporting-dashboard-card-description]'
+      )
+      .hasText(
+        'Total number of destinations (e.g. third-party integrations) synced with secrets',
+        'description is correct'
+      );
+    assert
+      .dom('[data-test-vault-reporting-secrets-sync-destinations-row]')
+      .includesText('Destination', 'Destinations header is present');
+    assert
+      .dom('[data-test-vault-reporting-secrets-sync-destinations-row]')
+      .includesText('aws: 1', 'aws destination is present');
+  });
+
+  test('dashboard card: Cluster replication status', async function (assert) {
+    this.server.get('sys/utilization-report', () => mockedResponseWithData);
+    await visit('/vault/usage-reporting');
+    await waitFor('[data-test-vault-reporting-dashboard-cluster-replication]');
+
+    assert
+      .dom('[data-test-vault-reporting-dashboard-cluster-replication]')
+      .exists('renders Cluster replication status card');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-cluster-replication] [data-test-vault-reporting-dashboard-card-title]'
+      )
+      .exists('title is present')
+      .hasText('Cluster replication', 'title is correct');
+
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-cluster-replication] [data-test-vault-reporting-dashboard-card-title-link]'
+      )
+      .exists('title link is present')
+      .hasAttribute('href', '/ui/vault/replication', 'link points to replication');
+    assert
+      .dom(
+        '[data-test-vault-reporting-dashboard-cluster-replication] [data-test-vault-reporting-dashboard-card-description]'
+      )
+      .exists('description is present')
+      .hasText('Status of disaster recovery and performance replication.', 'description is correct');
+  });
+
+  test('empty states display expected text', async function (assert) {
+    this.server.get('sys/utilization-report', () => mockedEmptyResponse);
+    await visit('/vault/usage-reporting');
+
+    await waitFor('[data-test-vault-reporting-dashboard-secret-engines]');
+    assert
+      .dom('[data-test-vault-reporting-dashboard-secret-engines]')
+      .includesText('None enabled', 'Secret engines empty state: title is shown');
+    assert
+      .dom('[data-test-vault-reporting-dashboard-secret-engines]')
+      .includesText(
+        'Secret engines in this namespace will appear here.',
+        'Secret engines empty state: body is shown'
+      );
+    assert
+      .dom('[data-test-vault-reporting-dashboard-secret-engines]')
+      .includesText('Enable secret engines', 'Secret engines empty state: CTA is shown');
+
+    await waitFor('[data-test-vault-reporting-dashboard-auth-methods]');
+    assert
+      .dom('[data-test-vault-reporting-dashboard-auth-methods]')
+      .includesText('None enabled', 'Auth methods empty state: title is shown');
+    assert
+      .dom('[data-test-vault-reporting-dashboard-auth-methods]')
+      .includesText(
+        'Authentication methods in this namespace will appear here.',
+        'Auth methods empty state: body is shown'
+      );
+    assert
+      .dom('[data-test-vault-reporting-dashboard-auth-methods]')
+      .includesText('Enable authentication methods', 'Auth methods empty state: CTA is shown');
+
+    await waitFor('[data-test-vault-reporting-dashboard-lease-count]');
+    assert
+      .dom('[data-test-vault-reporting-dashboard-lease-count]')
+      .includesText(
+        `Lease quotas enforce limits on active secrets and tokens. It's recommended to enable this to protect stability for this Vault cluster.`,
+        'Lease quota empty state description is shown'
+      );
+    assert
+      .dom('[data-test-vault-reporting-dashboard-lease-count]')
+      .includesText('Global lease count quota', 'Lease quota empty state: docs link is shown');
+  });
+
+  test('namespace lookup functionality', async function (assert) {
+    this.server.get('sys/internal/ui/namespaces', {
+      data: {
+        keys: ['child-ns1/', 'child-ns2/'],
+      },
+    });
+
+    // Mock different responses for different namespaces
+    const defaultMockResponse = mockedResponseWithData;
+    const childNs1MockResponse = {
+      data: {
+        ...mockedResponseWithData.data,
+        kvv2_secrets: 200,
+        kvv1_secrets: 50,
+      },
+    };
+
+    // Initially load default data
+    this.server.get('sys/utilization-report', () => defaultMockResponse);
+
+    const namespaceService = this.owner.lookup('service:namespace');
+    namespaceService.set('accessibleNamespaces', ['child-ns1/', 'child-ns2/']);
+    namespaceService.set('path', 'parent-ns');
+
+    await visit('/vault/usage-reporting');
+
+    // Verify initial KV secrets count (should be 40 from default mock)
+    await waitFor('[data-test-vault-reporting-counter="KV secrets"]');
+    assert
+      .dom('[data-test-vault-reporting-counter="KV secrets"]')
+      .includesText('100', 'Initial KV secrets count is 100');
+
+    // Update mock to return different data for child-ns1
+    this.server.get('sys/utilization-report', () => childNs1MockResponse);
+
+    // Click the namespace picker dropdown to open it
+    await click('.hds-dropdown.ssu-namespace-picker button');
+
+    // Verify all namespaces are visible initially
+    assert.dom('[data-test-vault-reporting-namespace-menu-item="root"]').exists('root namespace is visible');
+    assert
+      .dom('[data-test-vault-reporting-namespace-menu-item="child-ns1"]')
+      .exists('child-ns1 namespace is visible');
+    assert
+      .dom('[data-test-vault-reporting-namespace-menu-item="child-ns2"]')
+      .exists('child-ns2 namespace is visible');
+
+    // Use the search bar to search for "ns1"
+    await fillIn('[data-test-vault-reporting-namespace-search]', 'ns1');
+
+    // Verify only child-ns1 is visible after search
+    assert
+      .dom('[data-test-vault-reporting-namespace-menu-item="child-ns1"]')
+      .exists('child-ns1 is visible after search');
+
+    // Verify root and child-ns2 are filtered out
+    assert
+      .dom('[data-test-vault-reporting-namespace-menu-item="root"]')
+      .doesNotExist('root namespace is filtered out');
+    assert
+      .dom('[data-test-vault-reporting-namespace-menu-item="child-ns2"]')
+      .doesNotExist('child-ns2 namespace is filtered out');
+
+    // Click on child-ns1 to select it
+    await click('[data-test-vault-reporting-namespace-menu-item="child-ns1"]');
+
+    // Verify that child-ns1 is now displayed as the selected namespace in the closed dropdown
+    assert
+      .dom('.hds-dropdown.ssu-namespace-picker')
+      .includesText('child-ns1', 'child-ns1 is displayed as the selected namespace');
+
+    // Wait for data to be refetched and verify the KV secrets count has changed
+    await waitFor('[data-test-vault-reporting-counter="KV secrets"]');
+    assert
+      .dom('[data-test-vault-reporting-counter="KV secrets"]')
+      .includesText('250', 'KV secrets count updated to 250 after selecting child-ns1');
+  });
+});
diff --git a/ui/tests/acceptance/wrapped-token-test.js b/ui/tests/acceptance/wrapped-token-test.js
index 150741b0ada..2a3c2b94d27 100644
--- a/ui/tests/acceptance/wrapped-token-test.js
+++ b/ui/tests/acceptance/wrapped-token-test.js
@@ -1,45 +1,32 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupApplicationTest } from 'ember-qunit';
-import { settled, currentURL, visit } from '@ember/test-helpers';
-import { create } from 'ember-cli-page-object';
+import { currentURL, visit, currentRouteName, click, waitFor } from '@ember/test-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import auth from 'vault/tests/pages/auth';
-import consoleClass from 'vault/tests/pages/components/console/ui-panel';
+import { login, logout } from 'vault/tests/helpers/auth/auth-helpers';
+import { runCmd } from 'vault/tests/helpers/commands';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
 
-const consoleComponent = create(consoleClass);
-
-const wrappedAuth = async () => {
-  await consoleComponent.runCommands(`write -field=token auth/token/create policies=default -wrap-ttl=3m`);
-  await settled();
-  return consoleComponent.lastLogOutput;
-};
-
-const setupWrapping = async () => {
-  await auth.logout();
-  await settled();
-  await auth.visit();
-  await settled();
-  await auth.authType('token');
-  await auth.tokenInput('root').submit();
-  await settled();
-  const token = await wrappedAuth();
-  await auth.logout();
-  await settled();
-  return token;
-};
-module('Acceptance | wrapped_token query param functionality', function (hooks) {
+module(`Acceptance | wrapped_token query param functionality`, function (hooks) {
   setupApplicationTest(hooks);
   setupMirage(hooks);
 
+  hooks.beforeEach(async function () {
+    await login();
+    // create wrapped token
+    const token = await runCmd(`write -field=token auth/token/create policies=default -wrap-ttl=3m`);
+    await logout();
+    this.token = token;
+  });
+
   test('it authenticates you if the query param is present', async function (assert) {
-    const token = await setupWrapping();
-    await auth.visit({ wrapped_token: token });
-    await settled();
+    await visit(`/vault/auth?wrapped_token=${this.token}`);
     assert.strictEqual(
       currentURL(),
       '/vault/dashboard',
@@ -48,9 +35,7 @@ module('Acceptance | wrapped_token query param functionality', function (hooks)
   });
 
   test('it authenticates when used with the with=token query param', async function (assert) {
-    const token = await setupWrapping();
-    await auth.visit({ wrapped_token: token, with: 'token' });
-    await settled();
+    await visit(`/vault/auth?wrapped_token=${this.token}&with=token`);
     assert.strictEqual(
       currentURL(),
       '/vault/dashboard',
@@ -59,15 +44,42 @@ module('Acceptance | wrapped_token query param functionality', function (hooks)
   });
 
   test('it should authenticate when hitting logout url with wrapped_token when logged out', async function (assert) {
-    this.server.post('/sys/wrapping/unwrap', () => {
-      return { auth: { client_token: 'root' } };
-    });
-
-    await visit(`/vault/logout?wrapped_token=1234`);
+    await login();
+    assert.strictEqual(currentRouteName(), 'vault.cluster.dashboard');
+    await visit(`/vault/logout?wrapped_token=${this.token}`);
     assert.strictEqual(
       currentURL(),
       '/vault/dashboard',
       'authenticates and redirects to home (dashboard page)'
     );
   });
+
+  test('it shows error if unwrap fails and goes back to login form', async function (assert) {
+    await visit(`/vault/auth?wrapped_token=54321`);
+    assert
+      .dom(GENERAL.pageError.error)
+      .hasText(
+        'Authentication error Token unwrap failed Error: wrapping token is not valid or does not exist Go back'
+      );
+    assert.dom(AUTH_FORM.form).doesNotExist();
+    await click(`${GENERAL.pageError.error} button`);
+    await waitFor(AUTH_FORM.form);
+    const url = currentURL();
+    assert.false(url.includes('wrapped_token='), `url does not include wrapped_token param: ${url}`);
+    assert.strictEqual(currentRouteName(), 'vault.cluster.auth', 'it navigates back to auth route');
+    assert.dom(AUTH_FORM.form).exists('it navigates back to login form');
+  });
+
+  test('it makes request to authentication service with expected args', async function (assert) {
+    // stub response so we know what the client_token value will be
+    this.server.post('/sys/wrapping/unwrap', () => {
+      return { auth: { client_token: '12345' } };
+    });
+    const authSpy = sinon.spy(this.owner.lookup('service:auth'), 'authSuccess');
+    await visit(`/vault/logout?wrapped_token=${this.token}`);
+    const [clusterId, { authMethodType, token }] = authSpy.lastCall.args;
+    assert.strictEqual(clusterId, '1', 'authSuccess is called with clusterId');
+    assert.strictEqual(authMethodType, 'token', 'authSuccess is called with token as the authMethodType');
+    assert.strictEqual(token, '12345', 'authSuccess is called with the client_token');
+  });
 });
diff --git a/ui/tests/helpers/api/error-response.ts b/ui/tests/helpers/api/error-response.ts
new file mode 100644
index 00000000000..0c4df098ad7
--- /dev/null
+++ b/ui/tests/helpers/api/error-response.ts
@@ -0,0 +1,24 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { ResponseError } from '@hashicorp/vault-client-typescript';
+
+export const getErrorResponse = <T>(error?: T, status?: number) => {
+  const e = error || {
+    errors: ['first error', 'second error'],
+    message: 'there were some errors',
+  };
+  // url is readonly on Response so mock it and cast to Response type
+  const response = {
+    status: status || 404,
+    url: `${document.location.origin}/v1/test/error/parsing`,
+    json: () => Promise.resolve(e),
+  } as Response;
+
+  return new ResponseError({
+    ...response,
+    clone: () => response,
+  });
+};
diff --git a/ui/tests/helpers/auth/auth-form-selectors.ts b/ui/tests/helpers/auth/auth-form-selectors.ts
new file mode 100644
index 00000000000..915a3201373
--- /dev/null
+++ b/ui/tests/helpers/auth/auth-form-selectors.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const AUTH_FORM = {
+  description: '[data-test-description]',
+  form: '[data-test-auth-form]',
+  selectMethod: '[data-test-select="auth type"]',
+  tabBtn: (method: string) => `[data-test-auth-tab="${method}"] button`, // method is all lowercased
+  tabs: '[data-test-auth-tab]',
+  advancedSettings: '[data-test-auth-form-options-toggle] button',
+  authForm: (type: string) => `[data-test-auth-form="${type}"]`,
+  helpText: '[data-test-auth-helptext]',
+  logo: '[data-test-auth-logo]',
+  managedNsRoot: '[data-test-managed-namespace-root]',
+};
diff --git a/ui/tests/helpers/auth/auth-helpers.ts b/ui/tests/helpers/auth/auth-helpers.ts
new file mode 100644
index 00000000000..656fb826b0c
--- /dev/null
+++ b/ui/tests/helpers/auth/auth-helpers.ts
@@ -0,0 +1,127 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, currentRouteName, fillIn, visit, waitUntil } from '@ember/test-helpers';
+import VAULT_KEYS from 'vault/tests/helpers/vault-keys';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import AuthMethodResource from 'vault/resources/auth/method';
+
+import type { LoginFields } from 'vault/vault/auth/form';
+import type ApiService from 'vault/services/api';
+
+export const { rootToken } = VAULT_KEYS;
+
+// LOGOUT
+export const logout = async () => {
+  // make sure we're always logged out and logged back in
+  await visit('/vault/logout');
+  // clear session storage to ensure we have a clean state
+  window.localStorage.clear();
+  return;
+};
+
+// LOGIN WITH TOKEN
+export const login = async (token = rootToken) => {
+  // make sure we're always logged out and logged back in
+  await logout();
+  await visit('/vault/auth');
+
+  await fillIn(AUTH_FORM.selectMethod, 'token');
+  await fillIn(GENERAL.inputByAttr('token'), token);
+  await click(GENERAL.submitButton);
+  return await waitUntil(() => currentRouteName() === 'vault.cluster.dashboard');
+};
+
+export const loginNs = async (ns: string, token = rootToken) => {
+  // make sure we're always logged out and logged back in
+  await logout();
+  await visit('/vault/auth');
+
+  await fillIn(GENERAL.inputByAttr('namespace'), ns);
+
+  await fillIn(AUTH_FORM.selectMethod, 'token');
+  await fillIn(GENERAL.inputByAttr('token'), token);
+  await click(GENERAL.submitButton);
+  return await waitUntil(() => currentRouteName() === 'vault.cluster.dashboard');
+};
+
+// LOGIN WITH NON-TOKEN METHODS
+export const loginMethod = async (
+  loginFields: LoginFields,
+  options: { authType?: string; toggleOptions?: boolean }
+) => {
+  // make sure we're always logged out and logged back in
+  await logout();
+  const type = options?.authType || 'token';
+
+  await fillIn(AUTH_FORM.selectMethod, type);
+
+  await fillInLoginFields(loginFields, options);
+  await click(GENERAL.submitButton);
+  return await waitUntil(() => currentRouteName() === 'vault.cluster.dashboard');
+};
+
+export const fillInLoginFields = async (loginFields: LoginFields, { toggleOptions = false } = {}) => {
+  if (toggleOptions) await click(AUTH_FORM.advancedSettings);
+
+  for (const [input, value] of Object.entries(loginFields)) {
+    if (value) {
+      await fillIn(GENERAL.inputByAttr(input), value);
+    }
+  }
+};
+
+const LOGIN_DATA = {
+  token: { token: 'mysupersecuretoken' },
+  username: { username: 'matilda', password: 'some-password' },
+  role: { role: 'some-dev' },
+  jwt: { role: 'some-dev', jwt: 'some-jwt-token' },
+};
+// maps auth type to login input data
+export const AUTH_METHOD_LOGIN_DATA = {
+  // token methods
+  token: LOGIN_DATA.token,
+  github: LOGIN_DATA.token,
+  // username and password methods
+  userpass: LOGIN_DATA.username,
+  ldap: LOGIN_DATA.username,
+  okta: LOGIN_DATA.username,
+  radius: LOGIN_DATA.username,
+  // role
+  oidc: LOGIN_DATA.role,
+  jwt: LOGIN_DATA.jwt,
+  saml: LOGIN_DATA.role,
+};
+
+// Mock response for `sys/internal/ui/mounts`
+export const SYS_INTERNAL_UI_MOUNTS = {
+  'userpass/': {
+    description: '',
+    options: {},
+    type: 'userpass',
+  },
+  'userpass2/': {
+    description: '',
+    options: {},
+    type: 'userpass',
+  },
+  // there was a problem with the API service camel-casing mounts that were snake cased
+  // so including a snake cased mount for testing
+  'my_oidc/': {
+    description: '',
+    options: {},
+    type: 'oidc',
+  },
+  'ldap/': {
+    description: '',
+    options: null,
+    type: 'ldap',
+  },
+};
+
+// helper function to stub logic in the AuthRoute to format visibleAuthMounts for integration tests
+export const formatAuthMounts = (api: ApiService, mounts = SYS_INTERNAL_UI_MOUNTS) =>
+  api.responseObjectToArray(mounts, 'path').map((method) => new AuthMethodResource(method, this));
diff --git a/ui/tests/helpers/auth/response-stubs.ts b/ui/tests/helpers/auth/response-stubs.ts
new file mode 100644
index 00000000000..dd5c90a5e53
--- /dev/null
+++ b/ui/tests/helpers/auth/response-stubs.ts
@@ -0,0 +1,432 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import timestamp from 'core/utils/timestamp';
+import { addDays } from 'date-fns';
+
+/*
+Authentication requests return authentication information in either the "auth" or "data" key, 
+depending on the authentication method. 
+
+The stubbed responses below are used to test and compare authentication logic across different method types:
+- If the method has `{ mount_type: "token" }`, the authentication details are returned inside the "data" key.
+- Otherwise, `mount_type` is an empty string (""), and the authentication details are found in the "auth" key.
+
+Some values depend on the method's mount configuration (such as `ttl` and `lease_duration`). 
+For consistency, all methods stubbed here were mounted using default settings.
+*/
+
+const BASE_REQUEST_DATA = {
+  request_id: 'cbca58ca-8b53-76e7-3d07-6d72f7c5affe',
+  lease_id: '',
+  renewable: false,
+  lease_duration: 0,
+  wrap_info: null,
+  warnings: null,
+};
+
+export const RESPONSE_STUBS = {
+  github: {
+    ...BASE_REQUEST_DATA,
+    data: null,
+    auth: {
+      client_token: 'hvs.myvaultgeneratedgithubtoken',
+      accessor: 'm9UFOzTtVahYxs8nQe6Su73r',
+      policies: ['default'],
+      token_policies: ['default'],
+      metadata: {
+        org: 'hashicorp',
+        username: 'github-user99',
+      },
+      lease_duration: 2764800,
+      renewable: true,
+      entity_id: 'd3396007-4d0e-33f9-7e4e-beb2e87c3518',
+      token_type: 'service',
+      orphan: true,
+      mfa_requirement: null,
+      num_uses: 0,
+    },
+    mount_type: '',
+  },
+  jwt: {
+    ['lookup-self']: {
+      ...BASE_REQUEST_DATA,
+      data: {
+        accessor: 'MkjSR78ducuarJ6ypCDbHhBp',
+        creation_time: timestamp.now().getTime(),
+        creation_ttl: 2764800,
+        display_name: 'jwt-ugaKjSEAKwQkiGh1rbnGkp39oCSe3LQ2@clients',
+        entity_id: 'b6061dc8-a19e-195e-43a8-43d37f4625dd',
+        expire_time: addDays(timestamp.now(), 1),
+        explicit_max_ttl: 0,
+        id: 'hvs.myvaultgeneratedjwttoken',
+        issue_time: timestamp.now().toISOString(),
+        meta: {
+          role: 'reader',
+        },
+        num_uses: 0,
+        orphan: true,
+        path: 'auth/jwt/login',
+        policies: ['default', 'reader'],
+        renewable: true,
+        ttl: 2764800,
+        type: 'service',
+      },
+      auth: null,
+      mount_type: 'token',
+    },
+    login: {
+      ...BASE_REQUEST_DATA,
+      data: null,
+      auth: {
+        client_token: 'hvs.myvaultgeneratedjwttoken',
+        accessor: 'wzT0PZBYP0ZWyXI0Cst3UlsY',
+        policies: ['default', 'reader'],
+        token_policies: ['default', 'reader'],
+        metadata: {
+          role: 'reader',
+        },
+        lease_duration: 2764800,
+        renewable: true,
+        entity_id: 'b6061dc8-a19e-195e-43a8-43d37f4625dd',
+        token_type: 'service',
+        orphan: true,
+        mfa_requirement: null,
+        num_uses: 0,
+      },
+      mount_type: '',
+    },
+  },
+  ldap: {
+    ...BASE_REQUEST_DATA,
+    data: {}, // empty object instead of null
+    auth: {
+      client_token: 'hvs.myvaultgeneratedldaptoken',
+      accessor: 'aIFJgy2Eo6qgIUx9bAuOKC6y',
+      policies: ['default'],
+      token_policies: ['default'],
+      metadata: {
+        username: 'bob.johnson',
+      },
+      lease_duration: 2764800,
+      renewable: true,
+      entity_id: '998d4fb7-c7db-8d81-c34d-dc1754103510',
+      token_type: 'service',
+      orphan: true,
+      mfa_requirement: null,
+      num_uses: 0,
+    },
+    mount_type: '',
+  },
+  oidc: {
+    // Response from the OIDC token exchange (happens first)
+    ['oidc/callback']: {
+      ...BASE_REQUEST_DATA,
+      data: null,
+      auth: {
+        client_token: 'hvs.myvaultgeneratedoidctoken',
+        accessor: 'AjTM1Ec825ZJCg4xEVxbdPmf',
+        policies: ['default'],
+        token_policies: ['default'],
+        metadata: {
+          role: 'reader',
+        },
+        lease_duration: 2764800,
+        renewable: true,
+        entity_id: '18b57edf-acff-3e65-2ff2-6c772ce44924',
+        token_type: 'service',
+        orphan: true,
+        mfa_requirement: null,
+        num_uses: 0,
+      },
+      mount_type: '',
+    },
+    // Response from token lookup (after OIDC token exchange)
+    'lookup-self': {
+      ...BASE_REQUEST_DATA,
+      data: {
+        accessor: 'ew50HTqF2xgsmaKIsdKpJtTc',
+        creation_time: timestamp.now().getTime(),
+        creation_ttl: 2764800,
+        display_name: 'my-oidc-google-oauth2|105299854624506884705',
+        entity_id: '18b57edf-acff-3e65-2ff2-6c772ce44924',
+        expire_time: addDays(timestamp.now(), 1),
+        explicit_max_ttl: 0,
+        id: 'hvs.myvaultgeneratedoidctoken',
+        issue_time: timestamp.now().toISOString(),
+        meta: {
+          role: 'reader',
+        },
+        num_uses: 0,
+        orphan: true,
+        path: 'auth/my_oidc/oidc/callback',
+        policies: ['default'],
+        renewable: true,
+        ttl: 2764799,
+        type: 'service',
+      },
+      auth: null,
+      mount_type: 'token',
+    },
+  },
+  okta: {
+    ...BASE_REQUEST_DATA,
+    data: {}, // empty object instead of null
+    auth: {
+      client_token: 'hvs.myvaultgeneratedoktatoken',
+      accessor: 'bnCp5tEioxHJXgSXbKowYoZj',
+      policies: ['default'],
+      token_policies: ['default'],
+      metadata: {
+        policies: '',
+        username: 'vaultuser@gmail.com',
+      },
+      lease_duration: 2592000,
+      renewable: true,
+      entity_id: 'cb1ed44d-d3fb-5fd4-62cf-e027f84f35f6',
+      token_type: 'service',
+      orphan: true,
+      mfa_requirement: null,
+      num_uses: 0,
+    },
+    mount_type: '',
+  },
+  radius: {
+    ...BASE_REQUEST_DATA,
+    data: null,
+    auth: {
+      client_token: 'hvs.myvaultgeneratedradiustoken',
+      accessor: 'wx4Df1iktankETDXZ67tpGgo',
+      policies: ['default'],
+      token_policies: ['default'],
+      metadata: {
+        policies: '',
+        username: 'vaultuser',
+      },
+      lease_duration: 2764800,
+      renewable: true,
+      entity_id: '7056887c-7e54-3f76-e498-1f76fc0d0e2c',
+      token_type: 'service',
+      orphan: true,
+      mfa_requirement: null,
+      num_uses: 0,
+    },
+    mount_type: '',
+  },
+  token: {
+    request_id: '6a7c7b72-6f0b-1700-5a4e-cd82e768b5d8',
+    lease_id: '',
+    renewable: false,
+    lease_duration: 0,
+    data: {
+      accessor: '3tl0hAUwdDJVduSEnIca7Tr6',
+      creation_time: timestamp.now().getTime(),
+      creation_ttl: 2764800,
+      display_name: 'token',
+      entity_id: '',
+      expire_time: addDays(timestamp.now(), 1),
+      explicit_max_ttl: 0,
+      id: 'hvs.myvaultgeneratedtoken',
+      issue_time: timestamp.now().toISOString(),
+      meta: null,
+      num_uses: 0,
+      orphan: false,
+      path: 'auth/token/create',
+      policies: ['default'],
+      renewable: true,
+      ttl: 2764785,
+      type: 'service',
+    },
+    wrap_info: null,
+    warnings: null,
+    auth: null,
+    mount_type: 'token',
+  },
+  userpass: {
+    ...BASE_REQUEST_DATA,
+    data: null,
+    auth: {
+      client_token: 'hvs.myvaultgenerateduserpasstoken',
+      accessor: 'WSm7g8UzWEXhMO7g8C1zggDU',
+      policies: ['default'],
+      token_policies: ['default'],
+      metadata: {
+        username: 'bob',
+      },
+      lease_duration: 2764800,
+      renewable: true,
+      entity_id: 'fa17f31c-41b0-c927-7b2b-d905200bb95c',
+      token_type: 'service',
+      orphan: true,
+      mfa_requirement: null,
+      num_uses: 0,
+    },
+    mount_type: '',
+  },
+  // ENTERPRISE ONLY
+  saml: {
+    ['saml/token']: {
+      ...BASE_REQUEST_DATA,
+      data: null,
+      auth: {
+        client_token: 'hvs.myvaultgeneratedsamltoken',
+        accessor: 'kHiH5wwqClnujASsKalca1T6',
+        policies: ['default'],
+        token_policies: ['default'],
+        metadata: {
+          role: 'dev',
+        },
+        lease_duration: 1800,
+        renewable: true,
+        entity_id: '81fc10e5-49a3-d0a2-9835-ac6b551ee266',
+        token_type: 'service',
+        orphan: true,
+        mfa_requirement: null,
+        num_uses: 0,
+      },
+      mount_type: '',
+    },
+    ['lookup-self']: {
+      ...BASE_REQUEST_DATA,
+      data: {
+        accessor: 'H4fWtQaYX3aaEg1JIPSWiK9v',
+        creation_time: timestamp.now().getTime(),
+        creation_ttl: 1800,
+        display_name: 'saml-vaultuser@hashicorp.com',
+        entity_id: '81fc10e5-49a3-d0a2-9835-ac6b551ee266',
+        expire_time: addDays(timestamp.now(), 1),
+        explicit_max_ttl: 0,
+        id: 'hvs.myvaultgeneratedsamltoken',
+        issue_time: timestamp.now().toISOString(),
+        meta: {
+          role: 'dev',
+        },
+        num_uses: 0,
+        orphan: true,
+        path: 'auth/saml/token',
+        policies: ['default'],
+        renewable: true,
+        ttl: 1800,
+        type: 'service',
+      },
+      auth: null,
+      mount_type: 'token',
+    },
+  },
+};
+
+// Once the auth service authentication method is simplified and no longer handles every auth type
+// the "backend" key should be completely removable
+export const TOKEN_DATA = {
+  github: {
+    authMethodType: 'github',
+    authMountPath: 'github',
+    displayName: `${RESPONSE_STUBS.github.auth.metadata.org}/${RESPONSE_STUBS.github.auth.metadata.username}`,
+    entityId: RESPONSE_STUBS.github.auth.entity_id,
+    policies: RESPONSE_STUBS.github.auth.policies,
+    renewable: RESPONSE_STUBS.github.auth.renewable,
+    token: RESPONSE_STUBS.github.auth.client_token,
+    tokenExpirationEpoch: 1752352843223,
+    ttl: RESPONSE_STUBS.github.auth.lease_duration,
+    userRootNamespace: '',
+  },
+  ldap: {
+    authMethodType: 'ldap',
+    authMountPath: 'ldap',
+    displayName: RESPONSE_STUBS.ldap.auth.metadata.username,
+    entityId: RESPONSE_STUBS.ldap.auth.entity_id,
+    policies: RESPONSE_STUBS.ldap.auth.policies,
+    renewable: RESPONSE_STUBS.ldap.auth.renewable,
+    token: RESPONSE_STUBS.ldap.auth.client_token,
+    tokenExpirationEpoch: 1752352843696,
+    ttl: RESPONSE_STUBS.ldap.auth.lease_duration,
+    userRootNamespace: '',
+  },
+  jwt: {
+    authMethodType: 'jwt',
+    authMountPath: 'jwt',
+    displayName: RESPONSE_STUBS.jwt['lookup-self'].data.display_name,
+    entityId: RESPONSE_STUBS.jwt.login.auth.entity_id,
+    policies: RESPONSE_STUBS.jwt.login.auth.policies,
+    renewable: RESPONSE_STUBS.jwt.login.auth.renewable,
+    token: RESPONSE_STUBS.jwt.login.auth.client_token,
+    tokenExpirationEpoch: 1752425319766,
+    ttl: RESPONSE_STUBS.jwt.login.auth.lease_duration,
+    userRootNamespace: '',
+  },
+  oidc: {
+    authMethodType: 'oidc',
+    authMountPath: 'oidc',
+    displayName: RESPONSE_STUBS.oidc['lookup-self'].data.display_name,
+    entityId: RESPONSE_STUBS.oidc['oidc/callback'].auth.entity_id,
+    policies: RESPONSE_STUBS.oidc['oidc/callback'].auth.policies,
+    renewable: RESPONSE_STUBS.oidc['oidc/callback'].auth.renewable,
+    token: RESPONSE_STUBS.oidc['oidc/callback'].auth.client_token,
+    tokenExpirationEpoch: 1752349314961,
+    ttl: RESPONSE_STUBS.oidc['oidc/callback'].auth.lease_duration,
+    userRootNamespace: '',
+  },
+  okta: {
+    authMethodType: 'okta',
+    authMountPath: 'okta',
+    displayName: RESPONSE_STUBS.okta.auth.metadata.username,
+    entityId: RESPONSE_STUBS.okta.auth.entity_id,
+    policies: RESPONSE_STUBS.okta.auth.policies,
+    renewable: RESPONSE_STUBS.okta.auth.renewable,
+    token: RESPONSE_STUBS.okta.auth.client_token,
+    tokenExpirationEpoch: 1752180044950,
+    ttl: RESPONSE_STUBS.okta.auth.lease_duration,
+    userRootNamespace: '',
+  },
+  radius: {
+    authMethodType: 'radius',
+    authMountPath: 'radius',
+    displayName: RESPONSE_STUBS.radius.auth.metadata.username,
+    entityId: RESPONSE_STUBS.radius.auth.entity_id,
+    policies: RESPONSE_STUBS.radius.auth.policies,
+    renewable: RESPONSE_STUBS.radius.auth.renewable,
+    token: RESPONSE_STUBS.radius.auth.client_token,
+    tokenExpirationEpoch: 1752352846180,
+    ttl: RESPONSE_STUBS.radius.auth.lease_duration,
+    userRootNamespace: '',
+  },
+  token: {
+    authMethodType: 'token',
+    authMountPath: '',
+    displayName: 'token',
+    entityId: RESPONSE_STUBS.token.data.entity_id,
+    policies: RESPONSE_STUBS.token.data.policies,
+    renewable: RESPONSE_STUBS.token.data.renewable,
+    token: RESPONSE_STUBS.token.data.id,
+    tokenExpirationEpoch: 1747413884837,
+    ttl: RESPONSE_STUBS.token.data.ttl,
+    userRootNamespace: '',
+  },
+  userpass: {
+    authMethodType: 'userpass',
+    authMountPath: 'userpass',
+    displayName: RESPONSE_STUBS.userpass.auth.metadata.username,
+    entityId: RESPONSE_STUBS.userpass.auth.entity_id,
+    policies: RESPONSE_STUBS.userpass.auth.policies,
+    renewable: RESPONSE_STUBS.userpass.auth.renewable,
+    token: RESPONSE_STUBS.userpass.auth.client_token,
+    tokenExpirationEpoch: 1752352843463,
+    ttl: RESPONSE_STUBS.userpass.auth.lease_duration,
+    userRootNamespace: '',
+  },
+  // ENTERPRISE ONLY
+  saml: {
+    authMethodType: 'saml',
+    authMountPath: 'saml',
+    displayName: RESPONSE_STUBS.saml['lookup-self'].data.display_name,
+    entityId: RESPONSE_STUBS.saml['lookup-self'].data.entity_id,
+    policies: RESPONSE_STUBS.saml['lookup-self'].data.policies,
+    renewable: RESPONSE_STUBS.saml['lookup-self'].data.renewable,
+    token: RESPONSE_STUBS.saml['lookup-self'].data.id,
+    tokenExpirationEpoch: 1749587109246,
+    ttl: RESPONSE_STUBS.saml['lookup-self'].data.ttl,
+    userRootNamespace: '',
+  },
+};
diff --git a/ui/tests/helpers/clients.js b/ui/tests/helpers/clients.js
deleted file mode 100644
index 2bbbdfae199..00000000000
--- a/ui/tests/helpers/clients.js
+++ /dev/null
@@ -1,142 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { Response } from 'miragejs';
-import { SELECTORS as GENERAL } from 'vault/tests/helpers/general-selectors';
-import { click } from '@ember/test-helpers';
-import { addMonths, startOfMonth, subMonths } from 'date-fns';
-
-/** Scenarios
-  Config off, no data
-  Config on, no data
-  Config on, with data
-  Filtering (data with mounts)
-  Filtering (data without mounts)
-  Filtering (data without mounts)
-  * -- HISTORY ONLY --
-  Filtering different date ranges (hist only)
-  Upgrade warning
-  No permissions for license
-  Version
-  queries available
-  queries unavailable
-  License start date this month
-*/
-export const SELECTORS = {
-  ...GENERAL,
-  counts: {
-    startLabel: '[data-test-counts-start-label]',
-    description: '[data-test-counts-description]',
-    startMonth: '[data-test-counts-start-month]',
-    startEdit: '[data-test-counts-start-edit]',
-    startDropdown: '[data-test-counts-start-dropdown]',
-    configDisabled: '[data-test-counts-disabled]',
-    namespaces: '[data-test-counts-namespaces]',
-    mountPaths: '[data-test-counts-auth-mounts]',
-    startDiscrepancy: '[data-test-counts-start-discrepancy]',
-  },
-  tokenTab: {
-    entity: '[data-test-monthly-new-entity]',
-    nonentity: '[data-test-monthly-new-nonentity]',
-    legend: '[data-test-monthly-new-legend]',
-  },
-  syncTab: {
-    total: '[data-test-total-sync-clients]',
-    average: '[data-test-average-sync-clients]',
-  },
-  charts: {
-    chart: (title) => `[data-test-chart="${title}"]`, // newer lineal charts
-    statTextValue: (label) =>
-      label ? `[data-test-stat-text-container="${label}"] .stat-value` : '[data-test-stat-text-container]',
-    legend: '[data-test-chart-container-legend]',
-    legendLabel: (nth) => `.legend-label:nth-child(${nth * 2})`, // nth * 2 accounts for dots in legend
-    timestamp: '[data-test-chart-container-timestamp]',
-    dataBar: '[data-test-vertical-bar]',
-    xAxisLabel: '[data-test-x-axis] text',
-    // selectors for old d3 charts
-    verticalBar: '[data-test-vertical-bar-chart]',
-    lineChart: '[data-test-line-chart]',
-    bar: {
-      xAxisLabel: '[data-test-vertical-chart="x-axis-labels"] text',
-      dataBar: '[data-test-vertical-chart="data-bar"]',
-    },
-    line: {
-      xAxisLabel: '[data-test-line-chart] [data-test-x-axis] text',
-      plotPoint: '[data-test-line-chart="plot-point"]',
-    },
-  },
-  emptyStateTitle: '[data-test-empty-state-title]',
-  usageStats: '[data-test-usage-stats]',
-  dateDisplay: '[data-test-date-display]',
-  attributionBlock: '[data-test-clients-attribution]',
-  filterBar: '[data-test-clients-filter-bar]',
-  rangeDropdown: '[data-test-calendar-widget-trigger]',
-  monthDropdown: '[data-test-toggle-month]',
-  yearDropdown: '[data-test-toggle-year]',
-  currentBillingPeriod: '[data-test-current-billing-period]',
-  dateDropdownSubmit: '[data-test-date-dropdown-submit]',
-  runningTotalMonthStats: '[data-test-running-total="single-month-stats"]',
-  runningTotalMonthlyCharts: '[data-test-running-total="monthly-charts"]',
-  selectedAuthMount: 'div#auth-method-search-select [data-test-selected-option] div',
-  selectedNs: 'div#namespace-search-select [data-test-selected-option] div',
-  upgradeWarning: '[data-test-clients-upgrade-warning]',
-};
-
-export const CHART_ELEMENTS = {
-  entityClientDataBars: '[data-test-group="entity_clients"]',
-  nonEntityDataBars: '[data-test-group="non_entity_clients"]',
-  yLabels: '[data-test-group="y-labels"]',
-  actionBars: '[data-test-group="action-bars"]',
-  labelActionBars: '[data-test-group="label-action-bars"]',
-  totalValues: '[data-test-group="total-values"]',
-};
-
-export function sendResponse(data, httpStatus = 200) {
-  if (httpStatus === 403) {
-    return [
-      httpStatus,
-      { 'Content-Type': 'application/json' },
-      JSON.stringify({ errors: ['permission denied'] }),
-    ];
-  }
-  if (httpStatus === 204) {
-    // /activity endpoint returns 204 when no data, while
-    // /activity/monthly returns 200 with zero values on data
-    return [httpStatus, { 'Content-Type': 'application/json' }];
-  }
-  return [httpStatus, { 'Content-Type': 'application/json' }, JSON.stringify(data)];
-}
-
-export function overrideResponse(httpStatus, data) {
-  if (httpStatus === 403) {
-    return new Response(
-      403,
-      { 'Content-Type': 'application/json' },
-      JSON.stringify({ errors: ['permission denied'] })
-    );
-  }
-  // /activity endpoint returns 204 when no data, while
-  // /activity/monthly returns 200 with zero values on data
-  if (httpStatus === 204) {
-    return new Response(204, { 'Content-Type': 'application/json' });
-  }
-  return new Response(200, { 'Content-Type': 'application/json' }, JSON.stringify(data));
-}
-
-export async function dateDropdownSelect(month, year) {
-  const { dateDropdown, counts } = SELECTORS;
-  await click(counts.startEdit);
-  await click(dateDropdown.toggleMonth);
-  await click(dateDropdown.selectMonth(month));
-  await click(dateDropdown.toggleYear);
-  await click(dateDropdown.selectYear(year));
-  await click(dateDropdown.submit);
-}
-
-export const STATIC_NOW = new Date('2023-01-13T14:15:00');
-// for testing, we're in the middle of a license/billing period
-export const LICENSE_START = startOfMonth(subMonths(STATIC_NOW, 6)); // 2022-07-01
-// upgrade happened 1 month after license start
-export const UPGRADE_DATE = addMonths(LICENSE_START, 1); // 2022-08-01
diff --git a/ui/tests/helpers/clients/client-count-helpers.js b/ui/tests/helpers/clients/client-count-helpers.js
new file mode 100644
index 00000000000..cbef4831823
--- /dev/null
+++ b/ui/tests/helpers/clients/client-count-helpers.js
@@ -0,0 +1,1180 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { findAll } from '@ember/test-helpers';
+import { CHARTS } from './client-count-selectors';
+
+export function assertBarChart(assert, chartName, byMonthData, isStacked = false) {
+  // assertion count is byMonthData.length, plus 2
+  const chart = CHARTS.chart(chartName);
+  const dataBars = findAll(`${chart} ${CHARTS.verticalBar}`).filter(
+    (b) => b.hasAttribute('height') && b.getAttribute('height') !== '0'
+  );
+  const xAxisLabels = findAll(`${chart} ${CHARTS.xAxisLabel}`);
+
+  let count = byMonthData.filter((m) => m.clients).length;
+  if (isStacked) count = count * 2;
+
+  assert.strictEqual(dataBars.length, count, `${chartName}: it renders bars for each non-zero month`);
+  assert.strictEqual(
+    xAxisLabels.length,
+    byMonthData.length,
+    `${chartName}: it renders a label for each month`
+  );
+
+  xAxisLabels.forEach((e, i) => {
+    assert.dom(e).hasText(`${byMonthData[i].month}`, `renders x-axis label: ${byMonthData[i].month}`);
+  });
+}
+
+export const ACTIVITY_RESPONSE_STUB = {
+  start_time: '2023-06-01T00:00:00Z',
+  end_time: '2023-09-30T23:59:59Z', // is always the last day and hour of the month queried
+  by_namespace: [
+    {
+      namespace_id: 'e67m31',
+      namespace_path: 'ns1/',
+      counts: {
+        acme_clients: 5699,
+        clients: 18903,
+        entity_clients: 4256,
+        non_entity_clients: 4138,
+        secret_syncs: 4810,
+      },
+      mounts: [
+        {
+          mount_path: 'auth/userpass/0/',
+          mount_type: 'userpass/',
+          counts: {
+            acme_clients: 0,
+            clients: 8394,
+            entity_clients: 4256,
+            non_entity_clients: 4138,
+            secret_syncs: 0,
+          },
+        },
+        {
+          mount_path: 'acme/pki/0/',
+          mount_type: 'pki/',
+          counts: {
+            acme_clients: 5699,
+            clients: 5699,
+            entity_clients: 0,
+            non_entity_clients: 0,
+            secret_syncs: 0,
+          },
+        },
+        {
+          mount_path: 'secrets/kv/0/',
+          mount_type: 'kv/',
+          counts: {
+            acme_clients: 0,
+            clients: 4810,
+            entity_clients: 0,
+            non_entity_clients: 0,
+            secret_syncs: 4810,
+          },
+        },
+      ],
+    },
+    {
+      namespace_id: 'root',
+      namespace_path: '',
+      counts: {
+        acme_clients: 4003,
+        clients: 16384,
+        entity_clients: 4002,
+        non_entity_clients: 4089,
+        secret_syncs: 4290,
+      },
+      mounts: [
+        {
+          mount_path: 'auth/userpass/0/',
+          mount_type: 'userpass/',
+          counts: {
+            acme_clients: 0,
+            clients: 8091,
+            entity_clients: 4002,
+            non_entity_clients: 4089,
+            secret_syncs: 0,
+          },
+        },
+        {
+          mount_path: 'secrets/kv/0/',
+          mount_type: 'kv/',
+          counts: {
+            acme_clients: 0,
+            clients: 4290,
+            entity_clients: 0,
+            non_entity_clients: 0,
+            secret_syncs: 4290,
+          },
+        },
+        {
+          mount_path: 'acme/pki/0/',
+          mount_type: 'pki/',
+          counts: {
+            acme_clients: 4003,
+            clients: 4003,
+            entity_clients: 0,
+            non_entity_clients: 0,
+            secret_syncs: 0,
+          },
+        },
+      ],
+    },
+  ],
+  months: [
+    {
+      timestamp: '2023-06-01T00:00:00Z',
+      counts: null,
+      namespaces: null,
+      new_clients: null,
+    },
+    {
+      timestamp: '2023-07-01T00:00:00Z',
+      counts: {
+        acme_clients: 100,
+        clients: 400,
+        entity_clients: 100,
+        non_entity_clients: 100,
+        secret_syncs: 100,
+      },
+      namespaces: [
+        {
+          namespace_id: 'root',
+          namespace_path: '',
+          counts: {
+            acme_clients: 100,
+            clients: 400,
+            entity_clients: 100,
+            non_entity_clients: 100,
+            secret_syncs: 100,
+          },
+          mounts: [
+            {
+              mount_path: 'auth/userpass/0/',
+              mount_type: 'userpass/',
+              counts: {
+                acme_clients: 0,
+                clients: 200,
+                entity_clients: 100,
+                non_entity_clients: 100,
+                secret_syncs: 0,
+              },
+            },
+            {
+              mount_path: 'acme/pki/0/',
+              mount_type: 'pki/',
+              counts: {
+                acme_clients: 100,
+                clients: 100,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 0,
+              },
+            },
+            {
+              mount_path: 'secrets/kv/0/',
+              mount_type: 'kv/',
+              counts: {
+                acme_clients: 0,
+                clients: 100,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 100,
+              },
+            },
+          ],
+        },
+      ],
+      new_clients: {
+        counts: {
+          acme_clients: 100,
+          clients: 400,
+          entity_clients: 100,
+          non_entity_clients: 100,
+          secret_syncs: 100,
+        },
+        namespaces: [
+          {
+            namespace_id: 'root',
+            namespace_path: '',
+            counts: {
+              acme_clients: 100,
+              clients: 400,
+              entity_clients: 100,
+              non_entity_clients: 100,
+              secret_syncs: 100,
+            },
+            mounts: [
+              {
+                mount_path: 'auth/userpass/0/',
+                mount_type: 'userpass/',
+                counts: {
+                  acme_clients: 0,
+                  clients: 200,
+                  entity_clients: 100,
+                  non_entity_clients: 100,
+                  secret_syncs: 0,
+                },
+              },
+              {
+                mount_path: 'acme/pki/0/',
+                mount_type: 'pki/',
+                counts: {
+                  acme_clients: 100,
+                  clients: 100,
+                  entity_clients: 0,
+                  non_entity_clients: 0,
+                  secret_syncs: 0,
+                },
+              },
+              {
+                mount_path: 'secrets/kv/0/',
+                mount_type: 'kv/',
+                counts: {
+                  acme_clients: 0,
+                  clients: 100,
+                  entity_clients: 0,
+                  non_entity_clients: 0,
+                  secret_syncs: 100,
+                },
+              },
+            ],
+          },
+        ],
+      },
+    },
+    {
+      timestamp: '2023-08-01T00:00:00Z',
+      counts: {
+        acme_clients: 100,
+        clients: 400,
+        entity_clients: 100,
+        non_entity_clients: 100,
+        secret_syncs: 100,
+      },
+      namespaces: [
+        {
+          namespace_id: 'root',
+          namespace_path: '',
+          counts: {
+            acme_clients: 100,
+            clients: 400,
+            entity_clients: 100,
+            non_entity_clients: 100,
+            secret_syncs: 100,
+          },
+          mounts: [
+            {
+              mount_path: 'auth/userpass/0/',
+              mount_type: 'userpass/',
+              counts: {
+                acme_clients: 0,
+                clients: 200,
+                entity_clients: 100,
+                non_entity_clients: 100,
+                secret_syncs: 0,
+              },
+            },
+            {
+              mount_path: 'acme/pki/0/',
+              mount_type: 'pki/',
+              counts: {
+                acme_clients: 100,
+                clients: 100,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 0,
+              },
+            },
+            {
+              mount_path: 'secrets/kv/0/',
+              mount_type: 'kv/',
+              counts: {
+                acme_clients: 0,
+                clients: 100,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 100,
+              },
+            },
+          ],
+        },
+      ],
+      new_clients: {
+        counts: null,
+        namespaces: null,
+      },
+    },
+    {
+      timestamp: '2023-09-01T00:00:00Z',
+      counts: {
+        acme_clients: 1928,
+        clients: 3928,
+        entity_clients: 832,
+        non_entity_clients: 930,
+        secret_syncs: 238,
+      },
+      namespaces: [
+        {
+          namespace_id: 'e67m31',
+          namespace_path: 'ns1/',
+          counts: {
+            acme_clients: 934,
+            clients: 1981,
+            entity_clients: 708,
+            non_entity_clients: 182,
+            secret_syncs: 157,
+          },
+          mounts: [
+            {
+              mount_path: 'acme/pki/0/',
+              counts: {
+                acme_clients: 934,
+                clients: 934,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 0,
+              },
+            },
+            {
+              mount_path: 'auth/userpass/0/',
+              counts: {
+                acme_clients: 0,
+                clients: 890,
+                entity_clients: 708,
+                non_entity_clients: 182,
+                secret_syncs: 0,
+              },
+            },
+            {
+              mount_path: 'secrets/kv/0/',
+              counts: {
+                acme_clients: 0,
+                clients: 157,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 157,
+              },
+            },
+          ],
+        },
+        {
+          namespace_id: 'root',
+          namespace_path: '',
+          counts: {
+            acme_clients: 994,
+            clients: 1947,
+            entity_clients: 124,
+            non_entity_clients: 748,
+            secret_syncs: 81,
+          },
+          mounts: [
+            {
+              mount_path: 'acme/pki/0/',
+              counts: {
+                acme_clients: 994,
+                clients: 994,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 0,
+              },
+            },
+            {
+              mount_path: 'auth/userpass/0/',
+              counts: {
+                acme_clients: 0,
+                clients: 872,
+                entity_clients: 124,
+                non_entity_clients: 748,
+                secret_syncs: 0,
+              },
+            },
+            {
+              mount_path: 'secrets/kv/0/',
+              counts: {
+                acme_clients: 0,
+                clients: 81,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 81,
+              },
+            },
+          ],
+        },
+      ],
+      new_clients: {
+        counts: {
+          acme_clients: 144,
+          clients: 364,
+          entity_clients: 59,
+          non_entity_clients: 112,
+          secret_syncs: 49,
+        },
+        namespaces: [
+          {
+            namespace_id: 'root',
+            namespace_path: '',
+            counts: {
+              acme_clients: 91,
+              clients: 191,
+              entity_clients: 25,
+              non_entity_clients: 50,
+              secret_syncs: 25,
+            },
+            mounts: [
+              {
+                mount_path: 'acme/pki/0/',
+                mount_type: 'pki/',
+                counts: {
+                  acme_clients: 91,
+                  clients: 91,
+                  entity_clients: 0,
+                  non_entity_clients: 0,
+                  secret_syncs: 0,
+                },
+              },
+              {
+                mount_path: 'auth/userpass/0/',
+                mount_type: 'userpass/',
+                counts: {
+                  acme_clients: 0,
+                  clients: 75,
+                  entity_clients: 25,
+                  non_entity_clients: 50,
+                  secret_syncs: 0,
+                },
+              },
+              {
+                mount_path: 'secrets/kv/0/',
+                mount_type: 'kv/',
+                counts: {
+                  acme_clients: 0,
+                  clients: 25,
+                  entity_clients: 0,
+                  non_entity_clients: 0,
+                  secret_syncs: 25,
+                },
+              },
+            ],
+          },
+          {
+            namespace_id: 'e67m31',
+            namespace_path: 'ns1/',
+            counts: {
+              acme_clients: 53,
+              clients: 173,
+              entity_clients: 34,
+              non_entity_clients: 62,
+              secret_syncs: 24,
+            },
+            mounts: [
+              {
+                mount_path: 'auth/userpass/0/',
+                mount_type: 'userpass/',
+                counts: {
+                  acme_clients: 0,
+                  clients: 96,
+                  entity_clients: 34,
+                  non_entity_clients: 62,
+                  secret_syncs: 0,
+                },
+              },
+              {
+                mount_path: 'acme/pki/0/',
+                mount_type: 'pki/',
+                counts: {
+                  acme_clients: 53,
+                  clients: 53,
+                  entity_clients: 0,
+                  non_entity_clients: 0,
+                  secret_syncs: 0,
+                },
+              },
+              {
+                mount_path: 'secrets/kv/0/',
+                mount_type: 'kv/',
+                counts: {
+                  acme_clients: 0,
+                  clients: 24,
+                  entity_clients: 0,
+                  non_entity_clients: 0,
+                  secret_syncs: 24,
+                },
+              },
+            ],
+          },
+        ],
+      },
+    },
+  ],
+  total: {
+    acme_clients: 9702,
+    clients: 35287,
+    entity_clients: 8258,
+    non_entity_clients: 8227,
+    secret_syncs: 9100,
+  },
+};
+
+// combined activity data before and after 1.10 upgrade when Vault added mount attribution
+export const MIXED_ACTIVITY_RESPONSE_STUB = {
+  start_time: '2024-03-01T00:00:00Z',
+  end_time: '2024-04-30T23:59:59Z',
+  total: {
+    acme_clients: 0,
+    clients: 3,
+    entity_clients: 3,
+    non_entity_clients: 0,
+    secret_syncs: 0,
+  },
+  by_namespace: [
+    {
+      counts: {
+        acme_clients: 0,
+        clients: 3,
+        entity_clients: 3,
+        non_entity_clients: 0,
+        secret_syncs: 0,
+      },
+      mounts: [
+        {
+          counts: {
+            acme_clients: 0,
+            clients: 2,
+            entity_clients: 2,
+            non_entity_clients: 0,
+            secret_syncs: 0,
+          },
+          mount_path: 'no mount accessor (pre-1.10 upgrade?)',
+          mount_type: 'no mount path (pre-1.10 upgrade?)',
+        },
+        {
+          counts: {
+            acme_clients: 0,
+            clients: 1,
+            entity_clients: 1,
+            non_entity_clients: 0,
+            secret_syncs: 0,
+          },
+          mount_path: 'auth/userpass/0/',
+          mount_type: 'userpass',
+        },
+      ],
+      namespace_id: 'root',
+      namespace_path: '',
+    },
+  ],
+  months: [
+    {
+      counts: null,
+      namespaces: null,
+      new_clients: null,
+      timestamp: '2024-03-01T00:00:00Z',
+    },
+    {
+      counts: {
+        acme_clients: 0,
+        clients: 3,
+        entity_clients: 3,
+        non_entity_clients: 0,
+        secret_syncs: 0,
+      },
+      namespaces: [
+        {
+          counts: {
+            acme_clients: 0,
+            clients: 3,
+            entity_clients: 3,
+            non_entity_clients: 0,
+            secret_syncs: 0,
+          },
+          mounts: [
+            {
+              counts: {
+                acme_clients: 0,
+                clients: 2,
+                entity_clients: 2,
+                non_entity_clients: 0,
+                secret_syncs: 0,
+              },
+              mount_path: 'no mount accessor (pre-1.10 upgrade?)',
+              mount_type: 'no mount path (pre-1.10 upgrade?)',
+            },
+            {
+              counts: {
+                acme_clients: 0,
+                clients: 1,
+                entity_clients: 1,
+                non_entity_clients: 0,
+                secret_syncs: 0,
+              },
+              mount_path: 'auth/userpass/0/',
+              mount_type: 'userpass',
+            },
+          ],
+          namespace_id: 'root',
+          namespace_path: '',
+        },
+      ],
+      new_clients: {
+        counts: {
+          acme_clients: 0,
+          clients: 3,
+          entity_clients: 3,
+          non_entity_clients: 0,
+          secret_syncs: 0,
+        },
+        namespaces: [
+          {
+            counts: {
+              acme_clients: 0,
+              clients: 3,
+              entity_clients: 3,
+              non_entity_clients: 0,
+              secret_syncs: 0,
+            },
+            mounts: [
+              {
+                counts: {
+                  acme_clients: 0,
+                  clients: 2,
+                  entity_clients: 2,
+                  non_entity_clients: 0,
+                  secret_syncs: 0,
+                },
+                mount_path: 'no mount accessor (pre-1.10 upgrade?)',
+                mount_type: 'no mount path (pre-1.10 upgrade?)',
+              },
+              {
+                counts: {
+                  acme_clients: 0,
+                  clients: 1,
+                  entity_clients: 1,
+                  non_entity_clients: 0,
+                  secret_syncs: 0,
+                },
+                mount_path: 'auth/userpass/0/',
+                mount_type: 'userpass',
+              },
+            ],
+            namespace_id: 'root',
+            namespace_path: '',
+          },
+        ],
+      },
+      timestamp: '2024-04-01T00:00:00Z',
+    },
+  ],
+};
+
+// order of this array matters because index 0 is a month without data
+export const SERIALIZED_ACTIVITY_RESPONSE = {
+  total: {
+    acme_clients: 9702,
+    clients: 35287,
+    entity_clients: 8258,
+    non_entity_clients: 8227,
+    secret_syncs: 9100,
+  },
+  by_namespace: [
+    {
+      label: 'ns1/',
+      acme_clients: 5699,
+      clients: 18903,
+      entity_clients: 4256,
+      non_entity_clients: 4138,
+      secret_syncs: 4810,
+      mounts: [
+        {
+          label: 'auth/userpass/0/',
+          mount_path: 'auth/userpass/0/',
+          mount_type: 'userpass',
+          namespace_path: 'ns1/',
+          acme_clients: 0,
+          clients: 8394,
+          entity_clients: 4256,
+          non_entity_clients: 4138,
+          secret_syncs: 0,
+        },
+        {
+          label: 'acme/pki/0/',
+          mount_path: 'acme/pki/0/',
+          mount_type: 'pki',
+          namespace_path: 'ns1/',
+          acme_clients: 5699,
+          clients: 5699,
+          entity_clients: 0,
+          non_entity_clients: 0,
+          secret_syncs: 0,
+        },
+        {
+          label: 'secrets/kv/0/',
+          mount_path: 'secrets/kv/0/',
+          mount_type: 'kv',
+          namespace_path: 'ns1/',
+          acme_clients: 0,
+          clients: 4810,
+          entity_clients: 0,
+          non_entity_clients: 0,
+          secret_syncs: 4810,
+        },
+      ],
+    },
+    {
+      label: 'root',
+      acme_clients: 4003,
+      clients: 16384,
+      entity_clients: 4002,
+      non_entity_clients: 4089,
+      secret_syncs: 4290,
+      mounts: [
+        {
+          label: 'auth/userpass/0/',
+          mount_path: 'auth/userpass/0/',
+          mount_type: 'userpass',
+          namespace_path: 'root',
+          acme_clients: 0,
+          clients: 8091,
+          entity_clients: 4002,
+          non_entity_clients: 4089,
+          secret_syncs: 0,
+        },
+        {
+          label: 'secrets/kv/0/',
+          mount_path: 'secrets/kv/0/',
+          mount_type: 'kv',
+          namespace_path: 'root',
+          acme_clients: 0,
+          clients: 4290,
+          entity_clients: 0,
+          non_entity_clients: 0,
+          secret_syncs: 4290,
+        },
+        {
+          label: 'acme/pki/0/',
+          mount_path: 'acme/pki/0/',
+          mount_type: 'pki',
+          namespace_path: 'root',
+          acme_clients: 4003,
+          clients: 4003,
+          entity_clients: 0,
+          non_entity_clients: 0,
+          secret_syncs: 0,
+        },
+      ],
+    },
+  ],
+  by_month: [
+    {
+      timestamp: '2023-06-01T00:00:00Z',
+      namespaces: [],
+      new_clients: {
+        timestamp: '2023-06-01T00:00:00Z',
+        namespaces: [],
+      },
+    },
+    {
+      timestamp: '2023-07-01T00:00:00Z',
+      acme_clients: 100,
+      clients: 400,
+      entity_clients: 100,
+      non_entity_clients: 100,
+      secret_syncs: 100,
+      namespaces: [
+        {
+          label: 'root',
+          acme_clients: 100,
+          clients: 400,
+          entity_clients: 100,
+          non_entity_clients: 100,
+          secret_syncs: 100,
+          mounts: [
+            {
+              label: 'auth/userpass/0/',
+              namespace_path: 'root',
+              mount_path: 'auth/userpass/0/',
+              mount_type: 'userpass',
+              acme_clients: 0,
+              clients: 200,
+              entity_clients: 100,
+              non_entity_clients: 100,
+              secret_syncs: 0,
+            },
+            {
+              label: 'acme/pki/0/',
+              namespace_path: 'root',
+              mount_path: 'acme/pki/0/',
+              mount_type: 'pki',
+              acme_clients: 100,
+              clients: 100,
+              entity_clients: 0,
+              non_entity_clients: 0,
+              secret_syncs: 0,
+            },
+            {
+              label: 'secrets/kv/0/',
+              namespace_path: 'root',
+              mount_path: 'secrets/kv/0/',
+              mount_type: 'kv',
+              acme_clients: 0,
+              clients: 100,
+              entity_clients: 0,
+              non_entity_clients: 0,
+              secret_syncs: 100,
+            },
+          ],
+        },
+      ],
+      new_clients: {
+        timestamp: '2023-07-01T00:00:00Z',
+        acme_clients: 100,
+        clients: 400,
+        entity_clients: 100,
+        non_entity_clients: 100,
+        secret_syncs: 100,
+        namespaces: [
+          {
+            label: 'root',
+            acme_clients: 100,
+            clients: 400,
+            entity_clients: 100,
+            non_entity_clients: 100,
+            secret_syncs: 100,
+            mounts: [
+              {
+                label: 'auth/userpass/0/',
+                mount_path: 'auth/userpass/0/',
+                mount_type: 'userpass',
+                namespace_path: 'root',
+                acme_clients: 0,
+                clients: 200,
+                entity_clients: 100,
+                non_entity_clients: 100,
+                secret_syncs: 0,
+              },
+              {
+                label: 'acme/pki/0/',
+                mount_path: 'acme/pki/0/',
+                namespace_path: 'root',
+                mount_type: 'pki',
+                acme_clients: 100,
+                clients: 100,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 0,
+              },
+              {
+                label: 'secrets/kv/0/',
+                mount_path: 'secrets/kv/0/',
+                mount_type: 'kv',
+                namespace_path: 'root',
+                acme_clients: 0,
+                clients: 100,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 100,
+              },
+            ],
+          },
+        ],
+      },
+    },
+    {
+      timestamp: '2023-08-01T00:00:00Z',
+      acme_clients: 100,
+      clients: 400,
+      entity_clients: 100,
+      non_entity_clients: 100,
+      secret_syncs: 100,
+      namespaces: [
+        {
+          label: 'root',
+          acme_clients: 100,
+          clients: 400,
+          entity_clients: 100,
+          non_entity_clients: 100,
+          secret_syncs: 100,
+          mounts: [
+            {
+              label: 'auth/userpass/0/',
+              mount_path: 'auth/userpass/0/',
+              namespace_path: 'root',
+              mount_type: 'userpass',
+              acme_clients: 0,
+              clients: 200,
+              entity_clients: 100,
+              non_entity_clients: 100,
+              secret_syncs: 0,
+            },
+            {
+              label: 'acme/pki/0/',
+              mount_path: 'acme/pki/0/',
+              namespace_path: 'root',
+              mount_type: 'pki',
+              acme_clients: 100,
+              clients: 100,
+              entity_clients: 0,
+              non_entity_clients: 0,
+              secret_syncs: 0,
+            },
+
+            {
+              label: 'secrets/kv/0/',
+              mount_path: 'secrets/kv/0/',
+              namespace_path: 'root',
+              mount_type: 'kv',
+              acme_clients: 0,
+              clients: 100,
+              entity_clients: 0,
+              non_entity_clients: 0,
+              secret_syncs: 100,
+            },
+          ],
+        },
+      ],
+      new_clients: {
+        timestamp: '2023-08-01T00:00:00Z',
+        namespaces: [],
+      },
+    },
+    {
+      timestamp: '2023-09-01T00:00:00Z',
+      acme_clients: 1928,
+      clients: 3928,
+      entity_clients: 832,
+      non_entity_clients: 930,
+      secret_syncs: 238,
+      namespaces: [
+        {
+          label: 'ns1/',
+          acme_clients: 934,
+          clients: 1981,
+          entity_clients: 708,
+          non_entity_clients: 182,
+          secret_syncs: 157,
+          mounts: [
+            {
+              label: 'acme/pki/0/',
+              mount_path: 'acme/pki/0/',
+              acme_clients: 934,
+              clients: 934,
+              entity_clients: 0,
+              non_entity_clients: 0,
+              secret_syncs: 0,
+            },
+            {
+              label: 'auth/userpass/0/',
+              mount_path: 'auth/userpass/0/',
+              acme_clients: 0,
+              clients: 890,
+              entity_clients: 708,
+              non_entity_clients: 182,
+              secret_syncs: 0,
+            },
+            {
+              label: 'secrets/kv/0/',
+              mount_path: 'secrets/kv/0/',
+              acme_clients: 0,
+              clients: 157,
+              entity_clients: 0,
+              non_entity_clients: 0,
+              secret_syncs: 157,
+            },
+          ],
+        },
+        {
+          label: 'root',
+          acme_clients: 994,
+          clients: 1947,
+          entity_clients: 124,
+          non_entity_clients: 748,
+          secret_syncs: 81,
+          mounts: [
+            {
+              label: 'acme/pki/0/',
+              mount_path: 'acme/pki/0/',
+              acme_clients: 994,
+              clients: 994,
+              entity_clients: 0,
+              non_entity_clients: 0,
+              secret_syncs: 0,
+            },
+            {
+              label: 'auth/userpass/0/',
+              mount_path: 'auth/userpass/0/',
+              acme_clients: 0,
+              clients: 872,
+              entity_clients: 124,
+              non_entity_clients: 748,
+              secret_syncs: 0,
+            },
+            {
+              label: 'secrets/kv/0/',
+              mount_path: 'secrets/kv/0/',
+              acme_clients: 0,
+              clients: 81,
+              entity_clients: 0,
+              non_entity_clients: 0,
+              secret_syncs: 81,
+            },
+          ],
+        },
+      ],
+      new_clients: {
+        timestamp: '2023-09-01T00:00:00Z',
+        acme_clients: 144,
+        clients: 364,
+        entity_clients: 59,
+        non_entity_clients: 112,
+        secret_syncs: 49,
+        namespaces: [
+          {
+            label: 'root',
+            acme_clients: 91,
+            clients: 191,
+            entity_clients: 25,
+            non_entity_clients: 50,
+            secret_syncs: 25,
+            mounts: [
+              {
+                label: 'acme/pki/0/',
+                mount_path: 'acme/pki/0/',
+                mount_type: 'pki',
+                acme_clients: 91,
+                clients: 91,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 0,
+              },
+              {
+                label: 'auth/userpass/0/',
+                mount_path: 'auth/userpass/0/',
+                mount_type: 'userpass',
+                acme_clients: 0,
+                clients: 75,
+                entity_clients: 25,
+                non_entity_clients: 50,
+                secret_syncs: 0,
+              },
+              {
+                label: 'secrets/kv/0/',
+                mount_path: 'secrets/kv/0/',
+                mount_type: 'kv',
+                acme_clients: 0,
+                clients: 25,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 25,
+              },
+            ],
+          },
+          {
+            label: 'ns1/',
+            acme_clients: 53,
+            clients: 173,
+            entity_clients: 34,
+            non_entity_clients: 62,
+            secret_syncs: 24,
+            mounts: [
+              {
+                label: 'auth/userpass/0/',
+                mount_path: 'auth/userpass/0/',
+                mount_type: 'userpass',
+                acme_clients: 0,
+                clients: 96,
+                entity_clients: 34,
+                non_entity_clients: 62,
+                secret_syncs: 0,
+              },
+              {
+                label: 'acme/pki/0/',
+                mount_path: 'acme/pki/0/',
+                mount_type: 'pki',
+                acme_clients: 53,
+                clients: 53,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 0,
+              },
+              {
+                label: 'secrets/kv/0/',
+                mount_path: 'secrets/kv/0/',
+                mount_type: 'kv',
+                acme_clients: 0,
+                clients: 24,
+                entity_clients: 0,
+                non_entity_clients: 0,
+                secret_syncs: 24,
+              },
+            ],
+          },
+        ],
+      },
+    },
+  ],
+};
+
+export const ENTITY_EXPORT = `{"entity_name":"entity_b3e2a7ff","entity_alias_name":"bob","local_entity_alias":false,"client_id":"5692c6ef-c871-128e-fb06-df2be7bfc0db","client_type":"entity","namespace_id":"vK5Bt","namespace_path":"ns1/","mount_accessor":"auth_userpass_f47ad0b4","mount_type":"userpass","mount_path":"auth/userpass/0/","token_creation_time":"2022-09-15T23:48:09Z","client_first_used_time":"2023-09-15T23:48:09Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":["7537e6b7-3b06-65c2-1fb2-c83116eb5e6f"]}
+{"entity_name":"entity_b3e2a7ff","entity_alias_name":"bob","local_entity_alias":false,"client_id":"daf8420c-0b6b-34e6-ff38-ee1ed093bea9","client_type":"entity","namespace_id":"root","namespace_path":"","mount_accessor":"auth_userpass_f47ad0b4","mount_type":"userpass","mount_path":"auth/userpass/","token_creation_time":"2020-08-15T23:48:09Z","client_first_used_time":"2025-07-15T23:48:09Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":["7537e6b7-3b06-65c2-1fb2-c83116eb5e6f"]}
+{"entity_name":"bob-smith","entity_alias_name":"bob","local_entity_alias":false,"client_id":"23a04911-5d72-ba98-11d3-527f2fcf3a81","client_type":"entity","namespace_id":"root","namespace_path":"","mount_accessor":"auth_userpass_de28062c","mount_type":"userpass","mount_path":"auth/userpass-test/","token_creation_time":"2020-08-15T23:52:38Z","client_first_used_time":"2025-08-15T23:53:19Z","policies":["base"],"entity_metadata":{"organization":"ACME Inc.","team":"QA"},"entity_alias_metadata":{},"entity_alias_custom_metadata":{"account":"Tester Account"},"entity_group_ids":["7537e6b7-3b06-65c2-1fb2-c83116eb5e6f"]}
+{"entity_name":"alice-johnson","entity_alias_name":"alice","local_entity_alias":false,"client_id":"a7c8d912-4f61-23b5-88e4-627a3dcf2b92","client_type":"entity","namespace_id":"root","namespace_path":"","mount_accessor":"auth_userpass_f47ad0b4","mount_type":"userpass","mount_path":"auth/userpass/","token_creation_time":"2020-08-16T09:15:42Z","client_first_used_time":"2025-09-16T09:16:03Z","policies":["admin","audit"],"entity_metadata":{"organization":"TechCorp","team":"DevOps","location":"San Francisco"},"entity_alias_metadata":{"department":"Engineering"},"entity_alias_custom_metadata":{"role":"Senior Engineer"},"entity_group_ids":["7537e6b7-3b06-65c2-1fb2-c83116eb5e6f","a1b2c3d4-5e6f-7g8h-9i0j-k1l2m3n4o5p6"]}
+{"entity_name":"charlie-brown","entity_alias_name":"charlie","local_entity_alias":true,"client_id":"b9e5f824-7c92-34d6-a1f8-738b4ecf5d73","client_type":"entity","namespace_id":"whUNi","namespace_path":"ns2/","mount_accessor":"auth_ldap_8a3b9c2d","mount_type":"ldap","mount_path":"auth/ldap/","token_creation_time":"2020-08-16T14:22:17Z","client_first_used_time":"2025-10-16T14:22:45Z","policies":["developer","read-only"],"entity_metadata":{"organization":"StartupXYZ","team":"Backend"},"entity_alias_metadata":{"cn":"charlie.brown","ou":"development"},"entity_alias_custom_metadata":{"project":"microservices"},"entity_group_ids":["c7d8e9f0-1a2b-3c4d-5e6f-789012345678"]}
+{"entity_name":"diana-prince","entity_alias_name":"diana","local_entity_alias":false,"client_id":"e4f7a935-2b68-47c9-b3e6-849c5dfb7a84","client_type":"entity","namespace_id":"aT9S5","namespace_path":"ns1/","mount_accessor":"auth_oidc_1f2e3d4c","mount_type":"oidc","mount_path":"auth/oidc/","token_creation_time":"2020-08-17T11:08:33Z","client_first_used_time":"2025-11-17T11:09:01Z","policies":["security","compliance"],"entity_metadata":{"organization":"SecureTech","team":"Security","clearance":"high"},"entity_alias_metadata":{"email":"diana.prince@securetech.com"},"entity_alias_custom_metadata":{"access_level":"L4"},"entity_group_ids":["f8e7d6c5-4b3a-2918-7654-321098765432"]}
+{"entity_name":"frank-castle","entity_alias_name":"frank","local_entity_alias":false,"client_id":"c6b9d248-5a71-39e4-c7f2-951d8eaf6b95","client_type":"entity","namespace_id":"root","namespace_path":"","mount_accessor":"auth_jwt_9d8c7b6a","mount_type":"jwt","mount_path":"auth/jwt/","token_creation_time":"2020-08-17T16:43:28Z","client_first_used_time":"2025-12-17T16:44:12Z","policies":["operations","monitoring"],"entity_metadata":{"organization":"CloudOps","team":"SRE","region":"us-east-1"},"entity_alias_metadata":{"sub":"frank.castle@cloudops.io","iss":"https://auth.cloudops.io"},"entity_alias_custom_metadata":{"on_call":"true","expertise":"kubernetes"},"entity_group_ids":["9a8b7c6d-5e4f-3210-9876-543210fedcba"]}
+{"entity_name":"grace-hopper","entity_alias_name":"grace","local_entity_alias":true,"client_id":"d8a3e517-6f94-42b7-d5c8-062f9bce4a73","client_type":"entity","namespace_id":"YMjS8","namespace_path":"ns5/","mount_accessor":"auth_userpass_3e2d1c0b","mount_type":"userpass","mount_path":"auth/userpass-legacy/","token_creation_time":"2020-08-18T08:17:55Z","client_first_used_time":"2025-06-18T08:18:23Z","policies":["legacy-admin","data-access"],"entity_metadata":{"organization":"LegacySystems","team":"Platform","tenure":"senior"},"entity_alias_metadata":{"legacy_id":"grace.hopper.001"},"entity_alias_custom_metadata":{"system_access":"mainframe","certification":"vault-admin"},"entity_group_ids":["1f2e3d4c-5b6a-7980-1234-567890abcdef"]}
+`;
+
+const NON_ENTITY_EXPORT = `{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"46dcOXXH+P1VEQiKTQjtWXEtBlbHdMOWwz+svXf3xuU=","client_type":"non-entity-token","namespace_id":"whUNi","namespace_path":"ns2/","mount_accessor":"auth_ns_token_3b2bf405","mount_type":"ns_token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:21Z","client_first_used_time":"2025-05-15T16:19:21Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"VKAJVITyTwyqF1GUzwYHwkaK6bbnL1zN8ZJ7viKR8no=","client_type":"non-entity-token","namespace_id":"omjn8","namespace_path":"ns8/","mount_accessor":"auth_ns_token_07b90be7","mount_type":"ns_token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:22Z","client_first_used_time":"2025-05-15T16:19:22Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"ww4L5n9WE32lPNh3UBgT3JxTDZb1a+m/3jqUffp04tQ=","client_type":"non-entity-token","namespace_id":"root","namespace_path":"","mount_accessor":"auth_token_360f591b","mount_type":"token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:23Z","client_first_used_time":"2025-05-15T16:19:23Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"cBLb9erIROCw7cczXpfkXTOdnZoVwfWF4EAPD9k61lU=","client_type":"non-entity-token","namespace_id":"aT9S5","namespace_path":"ns1/","mount_accessor":"auth_ns_token_62a4e52a","mount_type":"ns_token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:21Z","client_first_used_time":"2025-06-15T16:19:21Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"KMHoH3Kvr6nnW2ZIs+i37pYvyVtnuaL3DmyVxUL6boI=","client_type":"non-entity-token","namespace_id":"YMjS8","namespace_path":"ns5/","mount_accessor":"auth_ns_token_45cbc810","mount_type":"ns_token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:22Z","client_first_used_time":"2025-06-15T16:19:22Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"hcMH4P4IGAN13cJqkwIJLXYoPLTodtOj/wPTZKS0x4U=","client_type":"non-entity-token","namespace_id":"ZNdL5","namespace_path":"ns7/","mount_accessor":"auth_ns_token_8bbd9440","mount_type":"ns_token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:22Z","client_first_used_time":"2025-06-15T16:19:22Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"Oby0ABLmfhqYdfqGfljGHHhAA5zX+BwsGmFu4QGJZd0=","client_type":"non-entity-token","namespace_id":"bJIgY","namespace_path":"ns9/","mount_accessor":"auth_ns_token_8d188479","mount_type":"ns_token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:22Z","client_first_used_time":"2025-06-15T16:19:22Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"Z6MjZuH/VD7HU11efiKoM/hfoxssSbeu4c6DhC7zUZ4=","client_type":"non-entity-token","namespace_id":"root","namespace_path":"","mount_accessor":"auth_token_360f591b","mount_type":"token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:23Z","client_first_used_time":"2025-07-15T16:19:23Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"1UxaPHJUOPWrf0ivMgBURK6WHzbfXGkcn/C/xI3AeHQ=","client_type":"non-entity-token","namespace_id":"root","namespace_path":"","mount_accessor":"auth_token_360f591b","mount_type":"token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:24Z","client_first_used_time":"2025-07-15T16:19:24Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"hfFbwhMucs/f84p2QTOiBLT72i0WLVkIgCGV7RIuWlo=","client_type":"non-entity-token","namespace_id":"x6sKN","namespace_path":"ns4/","mount_accessor":"auth_ns_token_2aaebdc2","mount_type":"ns_token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:21Z","client_first_used_time":"2025-07-15T16:19:21Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"sOdIr+zoNqOUa4hq6Jv4LCGVr0sTLGbvcRPVGAtUA7g=","client_type":"non-entity-token","namespace_id":"Rsvk5","namespace_path":"ns6/","mount_accessor":"auth_ns_token_f603fd8d","mount_type":"ns_token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:22Z","client_first_used_time":"2025-07-15T16:19:22Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"vOIAwNhe6P6HFdJQgUIU/8K6Z5e+oxyVP5x3KtTKS6U=","client_type":"non-entity-token","namespace_id":"root","namespace_path":"","mount_accessor":"auth_token_360f591b","mount_type":"token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:23Z","client_first_used_time":"2025-08-15T16:19:23Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"ZOkJY3P7IzOqulsnEI0JAQQXwTPnXmpGUh9otqNUclc=","client_type":"non-entity-token","namespace_id":"root","namespace_path":"","mount_accessor":"auth_token_360f591b","mount_type":"token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:23Z","client_first_used_time":"2025-08-15T16:19:23Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"Lsha/HH+xLZq92XG4GYZVlwVQCiqPCUIuoego4aCybU=","client_type":"non-entity-token","namespace_id":"root","namespace_path":"","mount_accessor":"auth_token_360f591b","mount_type":"token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:23Z","client_first_used_time":"2025-08-15T16:19:23Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"Tsl/u7CDTYSXA9HRwlNTW7K/yyEe5PDkLOVTvTWy3q0=","client_type":"non-entity-token","namespace_id":"root","namespace_path":"","mount_accessor":"auth_token_360f591b","mount_type":"token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:23Z","client_first_used_time":"2025-09-15T16:19:23Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"vnq6JntpiGV4FN6GDICLECe2in31aanLA6Q1UWqBmL0=","client_type":"non-entity-token","namespace_id":"root","namespace_path":"","mount_accessor":"auth_token_360f591b","mount_type":"token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:24Z","client_first_used_time":"2025-09-15T16:19:24Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"MRMrywfPPL3QnKFMBGfRjjmaefBRH1VKpQVIfrd0Xb4=","client_type":"non-entity-token","namespace_id":"6aDiU","namespace_path":"ns3/","mount_accessor":"auth_ns_token_ef771c23","mount_type":"ns_token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:21Z","client_first_used_time":"2025-09-15T16:19:21Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"Rce6fjHs15+hDl5XdXbWmzGNYrTcQsJuaoqfs9Vrhvw=","client_type":"non-entity-token","namespace_id":"root","namespace_path":"","mount_accessor":"auth_token_360f591b","mount_type":"token","mount_path":"auth/token/","token_creation_time":"2020-08-15T16:19:24Z","client_first_used_time":"2025-09-15T16:19:24Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+`;
+
+const ACME_EXPORT = `{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.3U8nSB_yMBvrdu7PvAVykKurDiaH_vQGaEdAUsp-Cew","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:47:54Z","client_first_used_time":"2025-06-21T18:47:54Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.77tKDzxw0i81Nr4XLliTP9xRsztXLTuS16nN32B9jHA","client_type":"pki-acme","namespace_id":"whUNi","namespace_path":"ns2/","mount_accessor":"pki_06dad7b8","mount_type":"ns_pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:48:17Z","client_first_used_time":"2025-07-21T18:48:17Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.RoN77EahLU0wfem4z--ZqJSaqOZ7RvBWR3OkPHM_xaw","client_type":"pki-acme","namespace_id":"omjn8","namespace_path":"ns8/","mount_accessor":"pki_06dad7b8","mount_type":"ns_pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:49:26Z","client_first_used_time":"2025-08-21T18:49:26Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.5S7vaaJIrXormQSLHv4YkBhVfu6Ug0GERhTVTCrq-Fk","client_type":"pki-acme","namespace_id":"aT9S5","namespace_path":"ns1/","mount_accessor":"pki_06dad7b8","mount_type":"ns_pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:45:12Z","client_first_used_time":"2025-08-21T18:45:12Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.IeJQMwtkReJHVNL6fZLmqiu8-Re4JdKCQixXkfcaSRE","client_type":"pki-acme","namespace_id":"YMjS8","namespace_path":"ns5/","mount_accessor":"pki_06dad7b8","mount_type":"ns_pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:45:41Z","client_first_used_time":"2025-08-21T18:45:41Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.vTm3SCZom90qy3SuyIacpVsQgGLx7ASf3SeGpqn5XBA","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:47:19Z","client_first_used_time":"2025-08-21T18:47:19Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.64jWs15k6roUH6MiQ2u80K08Bmqw8IQOpqTpDZgZ1f4","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:47:25Z","client_first_used_time":"2025-08-21T18:47:25Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.RkjnwyIIn6bnc4LDdKQ9HNfnhuVXT7vQONXgGHJl4CE","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:49:21Z","client_first_used_time":"2025-08-21T18:49:21Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.uozIMLVXDMU7Fc2TFFwq0-uE1GFSui5rbTI1XyNAYBY","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:44:44Z","client_first_used_time":"2025-08-21T18:44:44Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.WiLdlzq93WtVmObB__CC2SPX6sI7EVLTTzxOIRHHN3o","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:44:49Z","client_first_used_time":"2025-08-21T18:44:49Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.P65jgamzwLYbKyxTlJFD5DL3sIUbusbXcQhYaysgzlU","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:45:59Z","client_first_used_time":"2025-08-21T18:45:59Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.2REWUkDLXAG2UB0ZJQcjPnHc4H39aq8fG3LMaHSHKow","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:46:05Z","client_first_used_time":"2025-08-21T18:46:05Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.Eeyq9-EfWv-iE9Aj3DzCU4r9P8V1Maewx51vcxMN-jA","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:46:10Z","client_first_used_time":"2025-08-21T18:46:10Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.vaeb2KR58sRuMUdUlv2TsbaOkSICTAxmJxhkuOs8ZiM","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:46:22Z","client_first_used_time":"2025-08-21T18:46:22Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.xEPG0eNfrAfRgXg6AKjsCrFPMs0IbLTCfUsCie_rfzY","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:46:51Z","client_first_used_time":"2025-08-21T18:46:51Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"pki-acme.Bkg4862LEoFXJUDWlfFtJHU9a69KRJPiEdw5XCbkkAI","client_type":"pki-acme","namespace_id":"root","namespace_path":"","mount_accessor":"pki_06dad7b8","mount_type":"pki","mount_path":"pki_int/","token_creation_time":"2020-08-21T18:47:42Z","client_first_used_time":"2025-08-21T18:47:42Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+`;
+
+const SECRET_SYNC_EXPORT = `{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"secret-sync.3U8nSB_yMBvrdu7PvAVykKurDiaH_vQGaEdAUsp-Cew","client_type":"secret-sync","namespace_id":"root","namespace_path":"","mount_accessor":"kv_06dad7b8","mount_type":"kv","mount_path":"secrets/kv/0/","token_creation_time":"2020-08-21T18:47:54Z","client_first_used_time":"2025-05-21T18:47:54Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"secret-sync.77tKDzxw0i81Nr4XLliTP9xRsztXLTuS16nN32B9jHA","client_type":"secret-sync","namespace_id":"ZNdL5","namespace_path":"ns7/","mount_accessor":"kv_06dad7b8","mount_type":"ns_kv","mount_path":"secrets/kv/0/","token_creation_time":"2020-08-21T18:48:17Z","client_first_used_time":"2025-05-21T18:48:17Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"secret-sync.RoN77EahLU0wfem4z--ZqJSaqOZ7RvBWR3OkPHM_xaw","client_type":"secret-sync","namespace_id":"bJIgY","namespace_path":"ns9/","mount_accessor":"kv_12abc3d4","mount_type":"ns_kv","mount_path":"secrets/kv/1","token_creation_time":"2020-08-21T18:49:26Z","client_first_used_time":"2025-06-21T18:49:26Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"secret-sync.5S7vaaJIrXormQSLHv4YkBhVfu6Ug0GERhTVTCrq-Fk","client_type":"secret-sync","namespace_id":"x6sKN","namespace_path":"ns4/","mount_accessor":"kv_06dad7b8","mount_type":"ns_kv","mount_path":"secrets/kv/0/","token_creation_time":"2020-08-21T18:45:12Z","client_first_used_time":"2025-06-21T18:45:12Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"secret-sync.IeJQMwtkReJHVNL6fZLmqiu8-Re4JdKCQixXkfcaSRE","client_type":"secret-sync","namespace_id":"Rsvk5","namespace_path":"ns6/","mount_accessor":"kv_12abc3d4","mount_type":"ns_kv","mount_path":"secrets/kv/1","token_creation_time":"2020-08-21T18:45:41Z","client_first_used_time":"2025-07-21T18:45:41Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"secret-sync.vTm3SCZom90qy3SuyIacpVsQgGLx7ASf3SeGpqn5XBA","client_type":"secret-sync","namespace_id":"root","namespace_path":"","mount_accessor":"kv_06dad7b8","mount_type":"kv","mount_path":"secrets/kv/0/","token_creation_time":"2020-08-21T18:47:19Z","client_first_used_time":"2025-08-21T18:47:19Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"secret-sync.64jWs15k6roUH6MiQ2u80K08Bmqw8IQOpqTpDZgZ1f4","client_type":"secret-sync","namespace_id":"6aDiU","namespace_path":"ns3/","mount_accessor":"kv_12abc3d4","mount_type":"kv","mount_path":"secrets/kv/1","token_creation_time":"2020-08-21T18:47:25Z","client_first_used_time":"2025-08-21T18:47:25Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+{"entity_name":"","entity_alias_name":"","local_entity_alias":false,"client_id":"secret-sync.RkjnwyIIn6bnc4LDdKQ9HNfnhuVXT7vQONXgGHJl4CE","client_type":"secret-sync","namespace_id":"root","namespace_path":"","mount_accessor":"kv_06dad7b8","mount_type":"kv","mount_path":"secrets/kv/0/","token_creation_time":"2020-08-21T18:49:21Z","client_first_used_time":"2025-08-21T18:49:21Z","policies":[],"entity_metadata":{},"entity_alias_metadata":{},"entity_alias_custom_metadata":{},"entity_group_ids":[]}
+`;
+
+export const ACTIVITY_EXPORT_STUB = ENTITY_EXPORT + NON_ENTITY_EXPORT + ACME_EXPORT + SECRET_SYNC_EXPORT;
diff --git a/ui/tests/helpers/clients/client-count-selectors.ts b/ui/tests/helpers/clients/client-count-selectors.ts
new file mode 100644
index 00000000000..6edf5aaf6fc
--- /dev/null
+++ b/ui/tests/helpers/clients/client-count-selectors.ts
@@ -0,0 +1,66 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+// TODO: separate nested into distinct exported consts
+export const CLIENT_COUNT = {
+  activityTimestamp: '[data-test-activity-timestamp]',
+  card: (name: string) => `[data-test-card="${name}"]`,
+  counts: {
+    description: '[data-test-counts-description]',
+    configDisabled: '[data-test-counts-disabled]',
+    namespaces: '[data-test-counts-namespaces]',
+    mountPaths: '[data-test-counts-auth-mounts]',
+  },
+  dateRange: {
+    dropdownOption: (idx: number | null) =>
+      typeof idx === 'number'
+        ? `[data-test-date-range-billing-start="${idx}"]`
+        : '[data-test-date-range-billing-start]',
+    dateDisplay: (name: string) => (name ? `[data-test-date-range="${name}"]` : '[data-test-date-range]'),
+    edit: '[data-test-date-range-edit]',
+    editModal: '[data-test-date-range-edit-modal]',
+    editDate: (name: string) => `[data-test-date-edit="${name}"]`,
+    reset: '[data-test-date-edit="reset"]',
+    defaultRangeAlert: '[data-test-range-default-alert]',
+    validation: '[data-test-date-range-validation]',
+  },
+  statLegendValue: (label: string) =>
+    label ? `[data-test-vault-reporting-legend-item="${label}"]` : '[data-test-vault-reporting-legend-item',
+  statText: (label: string) => `[data-test-stat-text="${label}"]`,
+  statTextValue: (label: string) =>
+    label ? `[data-test-stat-text="${label}"] .stat-value` : '[data-test-stat-text]',
+  usageStats: (title: string) => `[data-test-usage-stats="${title}"]`,
+  tableSummary: (tabName: string) => `[data-test-table-summary="${tabName}"]`,
+  upgradeWarning: '[data-test-clients-upgrade-warning]',
+  exportButton: '[data-test-export-button]',
+};
+
+export const CHARTS = {
+  // container
+  legend: '[data-test-counts-card-legend]',
+  legendDot: (nth: number) => `.legend-item:nth-child(${nth}) > span`,
+
+  // chart elements
+  chart: (title: string) => `[data-test-chart="${title}"]`,
+  hover: (area: string) => `[data-test-interactive-area="${area}"]`,
+  table: '[data-test-underlying-data]',
+  tooltip: '[data-test-tooltip]',
+  verticalBar: '[data-test-vertical-bar]',
+  xAxis: '[data-test-x-axis]',
+  yAxis: '[data-test-y-axis]',
+  xAxisLabel: '[data-test-x-axis] text',
+  plotPoint: '[data-test-plot-point]',
+};
+
+export const FILTERS = {
+  dropdown: (name: string) => `[data-test-dropdown="${name}"]`,
+  dropdownToggle: (name: string) => `[data-test-dropdown="${name}"] button`,
+  dropdownItem: (name: string) => `[data-test-dropdown-item="${name}"]`,
+  dropdownSearch: (name: string) => `[data-test-dropdown="${name}"] input`,
+  tag: (filter?: string, value?: string) =>
+    filter && value ? `[data-test-filter-tag="${filter} ${value}"]` : '[data-test-filter-tag]',
+  tagContainer: '[data-test-filter-tag-container]',
+  clearTag: (value: string) => `[aria-label="Dismiss ${value}"]`,
+};
diff --git a/ui/tests/helpers/codemirror.js b/ui/tests/helpers/codemirror.js
index 24766807941..1e2b5b11ed1 100644
--- a/ui/tests/helpers/codemirror.js
+++ b/ui/tests/helpers/codemirror.js
@@ -1,30 +1,93 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 /*
 returns an instance of CodeMirror, see docs for callable functions https://codemirror.net/5/doc/manual.html#api_constructor
+If you are targeting a specific CodeMirror instance, pass the selector of the parent element as an argument.
 sample use:
 
   import codemirror from 'vault/tests/helpers/codemirror';
 
   test('it renders initial value', function (assert) {
-
-    assert.strictEqual(codemirror.getValue(), 'some value')
+    // General use
+    assert.strictEqual(codemirror().getValue(), 'some other value')
+    // Specific selector
+    codemirror('#my-control').setValue('some value');
+    assert.strictEqual(codemirror('#my-control').getValue(), 'some value')
   )}
 */
 
-const invariant = (truthy, error) => {
-  if (!truthy) throw new Error(error);
-};
+import { find } from '@ember/test-helpers';
 
-export default function () {
-  const element = document.querySelector('.CodeMirror');
-  invariant(element, `Selector '.CodeMirror' matched no elements`);
+export default function (parent) {
+  const selector = parent ? `${parent} .hds-code-editor__editor` : '.hds-code-editor__editor';
+  const element = document.querySelector(selector);
+  invariant(element, `Selector '${selector}' matched no elements`);
 
-  const cm = element.CodeMirror;
-  invariant(cm, `No registered CodeMirror instance for '.CodeMirror'`);
+  const cm = element.editor;
+  invariant(cm, `No registered CodeMirror instance for ''${selector}'`);
 
   return cm;
 }
+
+export function setCodeEditorValue(editorView, value, { from, to } = {}) {
+  invariant(editorView, 'No editor view provided');
+  invariant(value != null, 'No value provided');
+
+  editorView.dispatch({
+    changes: [
+      {
+        from: from ?? 0,
+        to: to ?? editorView.state.doc.length,
+        insert: value,
+      },
+    ],
+  });
+}
+
+export function getCodeEditorValue(editorView) {
+  invariant(editorView, 'No editor view provided');
+
+  return editorView.state.doc.toString();
+}
+
+export function assertCodeBlockValue(assert, selector, expected) {
+  invariant(selector, 'No selector provided to assertCodeBlockValue');
+  invariant(
+    typeof expected === 'string' || typeof expected === 'object',
+    'Expected value must be a JSON string or an object'
+  );
+
+  const element = find(selector);
+  assert.ok(element, `Element "${selector}" should exist`);
+
+  const raw = element.textContent.trim();
+  assert.ok(raw.length > 0, `Element "${selector}" should not be empty`);
+
+  let actual;
+  try {
+    actual = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Could not parse JSON from "${selector}":\n${raw}`);
+  }
+
+  // normalize the expected value into an object
+  const expectedObj =
+    typeof expected === 'string'
+      ? (() => {
+          try {
+            return JSON.parse(expected);
+          } catch {
+            throw new Error(`Expected string was not valid JSON:\n${expected}`);
+          }
+        })()
+      : expected;
+
+  assert.deepEqual(actual, expectedObj);
+}
+
+const invariant = (truthy, error) => {
+  if (!truthy) throw new Error(error);
+};
diff --git a/ui/tests/helpers/commands.js b/ui/tests/helpers/commands.js
index 3cf3a19d189..2b2f89ff474 100644
--- a/ui/tests/helpers/commands.js
+++ b/ui/tests/helpers/commands.js
@@ -1,93 +1,146 @@
-import consoleClass from 'vault/tests/pages/components/console/ui-panel';
-import { create } from 'ember-cli-page-object';
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+import { click, fillIn, findAll, triggerKeyEvent, visit } from '@ember/test-helpers';
+
+// REPL selectors
+const REPL = {
+  toggle: '[data-test-console-toggle]',
+  consoleInput: '[data-test-component="console/command-input"] input',
+  logOutputItems: '[data-test-component="console/output-log"] > div',
+};
+
 /**
  * Helper functions to run common commands in the consoleComponent during tests.
- * Please note that a user must be logged in during the test context for the commands to run.
- * By default runCmd throws an error if the last log includes "Error". To override this,
- * pass boolean false to run the commands and not throw errors
+ * Note: A user must be logged in during the test context for the commands to run.
  *
  * Example:
- *
  * import { v4 as uuidv4 } from 'uuid';
  * import { runCmd, mountEngineCmd } from 'vault/tests/helpers/commands';
  *
- *
- * async function mountEngineExitOnError() {
- *    const backend = `pki-${uuidv4()}`;
- *    await runCmd(mountEngineCmd('pki', backend));
- *    return backend;
- * }
- *
- * async function mountEngineSquashErrors() {
- *    const backend = `pki-${uuidv4()}`;
- *    await runCmd(mountEngineCmd('pki', backend), false);
- *    return backend;
+ * async function mountEngine() {
+ *   const backend = `pki-${uuidv4()}`;
+ *   await runCmd(mountEngineCmd('pki', backend));
+ *   return backend;
  * }
  */
 
-const cc = create(consoleClass);
+// Command execution helpers
+export const runCmd = async (commands, throwErrors = true) => {
+  if (!commands) throw new Error('runCmd requires commands array passed in');
+  if (!Array.isArray(commands)) commands = [commands];
+
+  await click(REPL.toggle);
+  await enterCommands(commands);
+  const lastOutput = await lastLogOutput();
+  await click(REPL.toggle);
 
-/**
- * runCmd is used to run commands and throw an error if the output includes "Error"
- * @param {string || string[]} commands array of commands that should run
- * @param {boolean} throwErrors
- * @returns the last log output. Throws an error if it includes an error
- */
-export async function runCmd(commands, throwErrors = true) {
-  if (!commands) {
-    throw new Error('runCmd requires commands array passed in');
-  }
-  if (!Array.isArray(commands)) {
-    commands = [commands];
-  }
-  await cc.runCommands(commands);
-  const lastOutput = cc.lastLogOutput;
   if (throwErrors && lastOutput.includes('Error')) {
     throw new Error(`Error occurred while running commands: "${commands.join('; ')}" - ${lastOutput}`);
   }
+
   return lastOutput;
-}
+};
 
-// Common commands
-export function mountEngineCmd(type, customName = '') {
-  const name = customName || type;
-  if (type === 'kv-v2') {
-    return `write sys/mounts/${name} type=kv options=version=2`;
+export const enterCommands = async (commands) => {
+  const toExecute = Array.isArray(commands) ? commands : [commands];
+  for (const command of toExecute) {
+    await fillIn(REPL.consoleInput, command);
+    await triggerKeyEvent(REPL.consoleInput, 'keyup', 'Enter');
   }
-  return `write sys/mounts/${name} type=${type}`;
-}
+};
+
+export const lastLogOutput = async () => {
+  const items = findAll(REPL.logOutputItems);
+  if (!items.length) return '';
+  return items[items.length - 1].innerText;
+};
+
+// Command builders
+export const mountEngineCmd = (type, customName = '') => {
+  const name = customName || type;
+  return type === 'kv-v2'
+    ? `write sys/mounts/${name} type=kv options=version=2`
+    : `write sys/mounts/${name} type=${type}`;
+};
 
-export function deleteEngineCmd(name) {
-  return `delete sys/mounts/${name}`;
-}
+export const deleteEngineCmd = (name) => `delete sys/mounts/${name}`;
 
-export function mountAuthCmd(type, customName = '') {
+export const mountAuthCmd = (type, customName = '') => {
   const name = customName || type;
   return `write sys/auth/${name} type=${type}`;
-}
+};
 
-export function deleteAuthCmd(name) {
-  return `delete sys/auth/${name}`;
-}
+export const deleteAuthCmd = (name) => `delete sys/auth/${name}`;
 
-export function createPolicyCmd(name, contents) {
+export const createPolicyCmd = (name, contents) => {
   const policyContent = window.btoa(contents);
   return `write sys/policies/acl/${name} policy=${policyContent}`;
-}
+};
+
+export const createTokenCmd = (policyName = 'default') =>
+  `write -field=client_token auth/token/create policies=${policyName} ttl=1h`;
+
+export const tokenWithPolicyCmd = (name, policy) => [createPolicyCmd(name, policy), createTokenCmd(name)];
+
+export const createNS = (namespace) => `write sys/namespaces/${namespace} -f`;
+
+export const deleteNS = (namespace) => `delete sys/namespaces/${namespace} -f`;
+
+/**
+ * @description
+ * Iterates over an array of namespace paths and ensures each nested level is created.
+ * It visits the root namespace before attempting to create the next segment.
+ *
+ * @example input: ['foo/bar', 'baz/qux/quux']
+ * This will create: foo, foo/bar, baz, baz/qux, baz/qux/quux
+ *
+ * @param {string[]} namespaces - Array of strings of namespace paths (containing backslashes)
+ */
+export const createNSFromPaths = async (namespaces) => {
+  for (const ns of namespaces) {
+    const parts = ns.split('/');
+    let currentPath = '';
+
+    for (const part of parts) {
+      const url = `/vault/dashboard${currentPath && `?namespace=${currentPath.replaceAll('/', '%2F')}`}`;
+      await visit(url);
 
-export function createTokenCmd(policyName = 'default') {
-  return `write -field=client_token auth/token/create policies=${policyName} ttl=1h`;
-}
+      currentPath = currentPath ? `${currentPath}/${part}` : part;
+      await runCmd(createNS(part), false);
+    }
 
-export const tokenWithPolicyCmd = function (name, policy) {
-  return [createPolicyCmd(name, policy), createTokenCmd(name)];
+    // Reset to root namespace after creating each path
+    await visit('/vault/dashboard');
+  }
 };
 
-export function createNS(namespace) {
-  return `write sys/namespaces/${namespace} -f`;
-}
+/**
+ * @description
+ * Deletes namespaces by removing each segment of the path from deepest to top.
+ *
+ * @example input: ['foo/bar', 'baz/qux']
+ * This will delete: foo, baz
+ *
+ * @param {string[]} namespaces - Array of strings of namespace paths (containing backslashes)
+ */
+export const deleteNSFromPaths = async (namespaces) => {
+  for (const ns of namespaces) {
+    const parts = ns.split('/');
+    // Work from deepest child up to the top-level namespace
+    for (let i = parts.length - 1; i >= 0; i--) {
+      const parentPath = parts.slice(0, i).join('/');
+      const toDelete = parts[i];
+      // Build the URL for the parent namespace (or root if none)
+      const url = parentPath
+        ? `/vault/dashboard?namespace=${parentPath.replaceAll('/', '%2F')}`
+        : '/vault/dashboard';
+      await visit(url);
+      await runCmd(deleteNS(toDelete), false);
+    }
+    // Reset to root namespace after deleting each path
+    await visit('/vault/dashboard');
+  }
+};
diff --git a/ui/tests/helpers/components/control-group-selectors.ts b/ui/tests/helpers/components/control-group-selectors.ts
new file mode 100644
index 00000000000..02ab0dbef1b
--- /dev/null
+++ b/ui/tests/helpers/components/control-group-selectors.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const CONTROL_GROUP = {
+  accessorValue: '[data-test-accessor-value]',
+  authorizations: '[data-test-authorizations]',
+  bannerPrefix: '[data-test-banner-prefix]',
+  bannerText: '[data-test-banner-text]',
+  jsonViewer: '[data-test-json-viewer]',
+  navMessage: '[data-test-navigate-message]',
+  requestorText: '[data-test-requestor-text]',
+  successComponent: '[data-test-control-group-success]',
+  tokenValue: '[data-test-token-value]',
+  unwrapForm: '[data-test-unwrap-form]',
+};
diff --git a/ui/tests/helpers/components/dashboard/dashboard-selectors.js b/ui/tests/helpers/components/dashboard/dashboard-selectors.js
index 9f966c45490..c4302c4831c 100644
--- a/ui/tests/helpers/components/dashboard/dashboard-selectors.js
+++ b/ui/tests/helpers/components/dashboard/dashboard-selectors.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-export const SELECTORS = {
+export const DASHBOARD = {
   cardName: (name) => `[data-test-card="${name}"]`,
   emptyState: (name) => `[data-test-empty-state="${name}"]`,
   emptyStateTitle: (name) => `[data-test-empty-state="${name}"] [data-test-empty-state-title]`,
@@ -17,9 +17,8 @@ export const SELECTORS = {
   title: (name) => `[data-test-title="${name}"]`,
   subtitle: (name) => `[data-test-card-subtitle="${name}"]`,
   subtext: (name) => `[data-test-subtext="${name}"]`,
-  tooltipTitle: (name) => `[data-test-tooltip-title="${name}"]`,
-  tooltipIcon: (type, name, icon) =>
-    `[data-test-type="${type}"] [data-test-tooltip-title="${name}"] [data-test-icon="${icon}"]`,
+  tooltipTitle: (name) => `[data-test-replication-status-title="${name}"]`,
+  tooltipIcon: (type, name, icon) => `[data-test-type="${type}"] [data-test-replication-icon="${icon}"]`,
   statLabel: (name) => `[data-test-stat-text="${name}"] .stat-label`,
   statText: (name) => `[data-test-stat-text="${name}"] .stat-text`,
   statValue: (name) => `[data-test-stat-text="${name}"] .stat-value`,
diff --git a/ui/tests/helpers/components/mount-backend-form-helpers.js b/ui/tests/helpers/components/mount-backend-form-helpers.js
new file mode 100644
index 00000000000..983128beb24
--- /dev/null
+++ b/ui/tests/helpers/components/mount-backend-form-helpers.js
@@ -0,0 +1,18 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { fillIn, click } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+export const mountBackend = async (type, path) => {
+  await click(GENERAL.cardContainer(type));
+  if (path) {
+    await fillIn(GENERAL.inputByAttr('path'), path);
+    await click(GENERAL.submitButton);
+  } else {
+    // save with default path
+    await click(GENERAL.submitButton);
+  }
+};
diff --git a/ui/tests/helpers/components/secret-edit-toolbar.js b/ui/tests/helpers/components/secret-edit-toolbar.js
new file mode 100644
index 00000000000..a8a8547e98b
--- /dev/null
+++ b/ui/tests/helpers/components/secret-edit-toolbar.js
@@ -0,0 +1,17 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+const SELECTORS = {
+  dropdown: '[data-test-copy-menu-trigger]',
+};
+export async function assertSecretWrap(assert, server, path) {
+  server.get(path, () => {
+    assert.ok(true, `request made to ${path} when wrapping secret`);
+  });
+  await click(SELECTORS.dropdown);
+  await click(GENERAL.button('wrap'));
+}
diff --git a/ui/tests/helpers/components/shamir-selectors.ts b/ui/tests/helpers/components/shamir-selectors.ts
new file mode 100644
index 00000000000..a08dad49fe5
--- /dev/null
+++ b/ui/tests/helpers/components/shamir-selectors.ts
@@ -0,0 +1,14 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const SHAMIR_FORM = {
+  input: '[data-test-shamir-key-input]',
+  inputLabel: '[data-test-shamir-key-label]',
+  submitButton: '[data-test-shamir-submit]',
+  otpInfo: '[data-test-otp-info]',
+  otpCode: '[data-test-otp]',
+  progress: '.shamir-progress',
+  error: '[data-test-message-error]',
+};
diff --git a/ui/tests/helpers/components/shamir.js b/ui/tests/helpers/components/shamir.js
deleted file mode 100644
index 718888e8767..00000000000
--- a/ui/tests/helpers/components/shamir.js
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SHAMIR_FORM = {
-  input: '[data-test-shamir-key-input]',
-  inputLabel: '[data-test-shamir-key-label]',
-  submitButton: '[data-test-shamir-submit]',
-  otpInfo: '[data-test-otp-info]',
-  otpCode: '[data-test-otp]',
-  progress: '.shamir-progress',
-  error: '[data-test-message-error]',
-};
diff --git a/ui/tests/helpers/components/sidebar-nav.js b/ui/tests/helpers/components/sidebar-nav.js
index 55830a73b07..760cbf1bd01 100644
--- a/ui/tests/helpers/components/sidebar-nav.js
+++ b/ui/tests/helpers/components/sidebar-nav.js
@@ -1,21 +1,34 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { allFeatures } from 'vault/helpers/all-features';
 import sinon from 'sinon';
 
-export const stubFeaturesAndPermissions = (owner, isEnterprise = false, setCluster = false) => {
+/**
+ * Sets up the necessary shared test context for testing sidebar nav components
+ * @param {TestContext.owner} owner eg this.owner from within a test
+ * @param {boolean} isEnterprise [default false]
+ * @param {boolean} setCluster [default false] if true, will set the current cluster to one with replication & raft
+ * @param {string[]} features if not passed, defaults to all features
+ * @returns {hasNavPermission: sinon.SinonStub, features: string[]}
+ */
+export const stubFeaturesAndPermissions = (
+  owner,
+  isEnterprise = false,
+  setCluster = false,
+  features,
+  hasPermission = true
+) => {
   const permissions = owner.lookup('service:permissions');
   const hasNavPermission = sinon.stub(permissions, 'hasNavPermission');
-  hasNavPermission.returns(true);
+  hasNavPermission.returns(hasPermission);
   sinon.stub(permissions, 'navPathParams');
 
   const version = owner.lookup('service:version');
-  const features = sinon.stub(version, 'features');
-  features.value(allFeatures());
-  sinon.stub(version, 'isEnterprise').value(isEnterprise);
+  version.type = isEnterprise ? 'enterprise' : 'community';
+  version.features = features || allFeatures();
 
   const auth = owner.lookup('service:auth');
   sinon.stub(auth, 'authData').value({});
diff --git a/ui/tests/helpers/components/ttl-picker-selectors.ts b/ui/tests/helpers/components/ttl-picker-selectors.ts
new file mode 100644
index 00000000000..71f1f34e95c
--- /dev/null
+++ b/ui/tests/helpers/components/ttl-picker-selectors.ts
@@ -0,0 +1,16 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const TTL_PICKER = {
+  ttlFormGroup: '[data-test-ttl-inputs]',
+  toggle: '[data-test-ttl-toggle]',
+  toggleByLabel: (label: string) => `[data-test-ttl-toggle="${label}"]`,
+  label: '[data-test-ttl-form-label]',
+  subtext: '[data-test-ttl-form-subtext]',
+  ttlValue: '[data-test-ttl-value]',
+  ttlUnit: '[data-test-select="ttl-unit"]',
+  valueInputByLabel: (label: string) => `[data-test-ttl-value="${label}"]`,
+  unitInputByLabel: (label: string) => `[data-test-ttl-unit="${label}"] [data-test-select="ttl-unit"]`,
+};
diff --git a/ui/tests/helpers/components/ttl-picker.js b/ui/tests/helpers/components/ttl-picker.js
deleted file mode 100644
index 539a14df448..00000000000
--- a/ui/tests/helpers/components/ttl-picker.js
+++ /dev/null
@@ -1,19 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-const selectors = {
-  ttlFormGroup: '[data-test-ttl-inputs]',
-  toggle: '[data-test-ttl-toggle]',
-  toggleByLabel: (label) => `[data-test-ttl-toggle="${label}"]`,
-  label: '[data-test-ttl-form-label]',
-  subtext: '[data-test-ttl-form-subtext]',
-  tooltipTrigger: `[data-test-tooltip-trigger]`,
-  ttlValue: '[data-test-ttl-value]',
-  ttlUnit: '[data-test-select="ttl-unit"]',
-  valueInputByLabel: (label) => `[data-test-ttl-value="${label}"]`,
-  unitInputByLabel: (label) => `[data-test-ttl-unit="${label}"] [data-test-select="ttl-unit"]`,
-};
-
-export default selectors;
diff --git a/ui/tests/helpers/config-ui/message-selectors.js b/ui/tests/helpers/config-ui/message-selectors.js
deleted file mode 100644
index f33b433d3b8..00000000000
--- a/ui/tests/helpers/config-ui/message-selectors.js
+++ /dev/null
@@ -1,31 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
- */
-
-import { SELECTORS as GENERAL } from 'vault/tests/helpers/general-selectors';
-
-export const PAGE = {
-  // General selectors that are common between pages
-  ...GENERAL,
-  inlineErrorMessage: `[data-test-inline-error-message]`,
-  unauthCreateFormInfo: '[data-test-unauth-info]',
-  navLink: '[data-test-sidebar-nav-link="Custom Messages"]',
-  radio: (radioName) => `[data-test-radio="${radioName}"]`,
-  field: (fieldName) => `[data-test-field="${fieldName}"]`,
-  input: (input) => `[data-test-input="${input}"]`,
-  button: (buttonName) => `[data-test-button="${buttonName}"]`,
-  fieldValidation: (fieldName) => `[data-test-field-validation="${fieldName}"]`,
-  modal: (name) => `[data-test-modal="${name}"]`,
-  modalTitle: (title) => `[data-test-modal-title="${title}"]`,
-  modalBody: (name) => `[data-test-modal-body="${name}"]`,
-  modalButton: (name) => `[data-test-modal-button="${name}"]`,
-  alert: (name) => `data-test-custom-alert=${name}`,
-  alertTitle: (name) => `[data-test-custom-alert-title="${name}"]`,
-  alertDescription: (name) => `[data-test-custom-alert-description="${name}"]`,
-  alertAction: (name) => `[data-test-custom-alert-action="${name}"]`,
-  badge: (name) => `[data-test-badge="${name}"]`,
-  tab: (name) => `[data-test-custom-messages-tab="${name}"]`,
-  confirmActionButton: (name) => `[data-test-confirm-action="${name}"]`,
-  listItem: (name) => `[data-test-list-item="${name}"]`,
-};
diff --git a/ui/tests/helpers/config-ui/message-selectors.ts b/ui/tests/helpers/config-ui/message-selectors.ts
new file mode 100644
index 00000000000..a4a590b9aa2
--- /dev/null
+++ b/ui/tests/helpers/config-ui/message-selectors.ts
@@ -0,0 +1,24 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: MPL-2.0
+ */
+
+export const CUSTOM_MESSAGES = {
+  // General selectors that are common between custom messages
+  inlineErrorMessage: `[data-test-inline-error-message]`,
+  unauthCreateFormInfo: '[data-test-unauth-info]',
+  navLink: '[data-test-sidebar-nav-link="Custom Messages"]',
+  radio: (radioName: string) => `[data-test-radio="${radioName}"]`,
+  field: (fieldName: string) => `[data-test-field="${fieldName}"]`,
+  input: (input: string) => `[data-test-input="${input}"]`,
+  fieldValidation: (fieldName: string) => `[data-test-validation-error="${fieldName}"]`,
+  modal: (name: string) => `[data-test-modal="${name}"]`,
+  modalTitle: (title: string) => `[data-test-modal-title="${title}"]`,
+  modalBody: (name: string) => `[data-test-modal-body="${name}"]`,
+  alert: (name: string) => `data-test-custom-alert=${name}`,
+  alertTitle: (name: string) => `[data-test-custom-alert-title="${name}"]`,
+  alertDescription: (name: string) => `[data-test-custom-alert-description="${name}"]`,
+  alertAction: (name: string) => `[data-test-custom-alert-action="${name}"]`,
+  badge: (name: string) => `[data-test-badge="${name}"]`,
+  tab: (name: string) => `[data-test-custom-messages-tab="${name}"]`,
+};
diff --git a/ui/tests/helpers/control-groups.js b/ui/tests/helpers/control-groups.js
index c226ba15876..f5112f21749 100644
--- a/ui/tests/helpers/control-groups.js
+++ b/ui/tests/helpers/control-groups.js
@@ -1,16 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { click, visit } from '@ember/test-helpers';
-import { create } from 'ember-cli-page-object';
+import { click, visit, find } from '@ember/test-helpers';
 
 import { CONTROL_GROUP_PREFIX, TOKEN_SEPARATOR } from 'vault/services/control-group';
-import authPage from 'vault/tests/pages/auth';
-import controlGroup from 'vault/tests/pages/components/control-group';
+import { login, loginMethod } from 'vault/tests/helpers/auth/auth-helpers';
+import { CONTROL_GROUP } from 'vault/tests/helpers/components/control-group-selectors';
 import { createPolicyCmd, createTokenCmd, mountAuthCmd, runCmd } from './commands';
-const controlGroupComponent = create(controlGroup);
+import { GENERAL } from './general-selectors';
 
 const storageKey = (accessor, path) => {
   return `${CONTROL_GROUP_PREFIX}${accessor}${TOKEN_SEPARATOR}${path}`;
@@ -86,10 +85,13 @@ export async function grantAccessForWrite({
     throw new Error('missing required fields for grantAccessForWrite');
   }
   const userpassMount = `userpass-${backend}`;
-  await authPage.loginUsername(authorizerUser, authorizerPassword, userpassMount);
+  await loginMethod(
+    { username: authorizerUser, password: authorizerPassword, path: userpassMount },
+    { authType: 'userpass', toggleOptions: true }
+  );
   await visit(`/vault/access/control-groups/${accessor}`);
-  await controlGroupComponent.authorize();
-  await authPage.login(userToken);
+  await click(GENERAL.button('Authorize'));
+  await login(userToken);
   localStorage.setItem(
     storageKey(accessor, creation_path),
     JSON.stringify({
@@ -121,12 +123,15 @@ export async function grantAccess({
     throw new Error('missing required fields for grantAccess');
   }
   const userpassMount = `userpass-${backend}`;
-  const accessor = controlGroupComponent.accessor;
-  const controlGroupToken = controlGroupComponent.token;
-  await authPage.loginUsername(authorizerUser, authorizerPassword, userpassMount);
+  const accessor = find(CONTROL_GROUP.accessorValue).textContent.trim();
+  const controlGroupToken = find(CONTROL_GROUP.tokenValue).textContent.trim();
+  await loginMethod(
+    { username: authorizerUser, password: authorizerPassword, path: userpassMount },
+    { authType: 'userpass', toggleOptions: true }
+  );
   await visit(`/vault/access/control-groups/${accessor}`);
-  await controlGroupComponent.authorize();
-  await authPage.login(userToken);
+  await click(GENERAL.button('Authorize'));
+  await login(userToken);
   localStorage.setItem(
     storageKey(accessor, apiPath),
     JSON.stringify({
@@ -139,6 +144,6 @@ export async function grantAccess({
     })
   );
   await visit(`/vault/access/control-groups/${accessor}`);
-  await click(`[data-test-navigate-button]`);
+  await click(GENERAL.button('Visit'));
   /* end of control group authorization flow */
 }
diff --git a/ui/tests/helpers/flash-message.js b/ui/tests/helpers/flash-message.js
index fe35b65a9fc..ab2768685bc 100644
--- a/ui/tests/helpers/flash-message.js
+++ b/ui/tests/helpers/flash-message.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/helpers/general-selectors.js b/ui/tests/helpers/general-selectors.js
deleted file mode 100644
index 4a4641f410b..00000000000
--- a/ui/tests/helpers/general-selectors.js
+++ /dev/null
@@ -1,81 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { findAll } from '@ember/test-helpers';
-
-export const SELECTORS = {
-  breadcrumb: '[data-test-breadcrumbs] li',
-  breadcrumbAtIdx: (idx) => `[data-test-breadcrumbs] li:nth-child(${idx + 1}) a`,
-  breadcrumbs: '[data-test-breadcrumbs]',
-  breadcrumbLink: (label) => `[data-test-breadcrumb="${label}"] a`,
-  title: '[data-test-page-title]',
-  headerContainer: 'header.page-header',
-  icon: (name) => `[data-test-icon="${name}"]`,
-  tab: (name) => `[data-test-tab="${name}"]`,
-  filter: (name) => `[data-test-filter="${name}"]`,
-  filterInput: '[data-test-filter-input]',
-  confirmModalInput: '[data-test-confirmation-modal-input]',
-  confirmButton: '[data-test-confirm-button]',
-  confirmTrigger: '[data-test-confirm-action-trigger]',
-  emptyStateTitle: '[data-test-empty-state-title]',
-  emptyStateMessage: '[data-test-empty-state-message]',
-  emptyStateActions: '[data-test-empty-state-actions]',
-  menuTrigger: '[data-test-popup-menu-trigger]',
-  listItem: '[data-test-list-item-link]',
-  calendarWidget: {
-    trigger: '[data-test-calendar-widget-trigger]',
-    currentMonth: '[data-test-current-month]',
-    currentBillingPeriod: '[data-test-current-billing-period]',
-    customEndMonth: '[data-test-show-calendar]',
-    previousYear: '[data-test-previous-year]',
-    nextYear: '[data-test-next-year]',
-    calendarMonth: (month) => `[data-test-calendar-month="${month}"]`,
-  },
-  dateDropdown: {
-    toggleMonth: '[data-test-toggle-month]',
-    toggleYear: '[data-test-toggle-year]',
-    selectMonth: (month) => `[data-test-dropdown-month="${month}"]`,
-    selectYear: (year) => `[data-test-dropdown-year="${year}"]`,
-    submit: '[data-test-date-dropdown-submit]',
-  },
-  // FORMS
-  infoRowLabel: (label) => `[data-test-row-label="${label}"]`,
-  infoRowValue: (label) => `[data-test-value-div="${label}"]`,
-  inputByAttr: (attr) => `[data-test-input="${attr}"]`,
-  fieldByAttr: (attr) => `[data-test-field="${attr}"]`,
-  enableField: (attr) => `[data-test-enable-field="${attr}"] button`,
-  validation: (attr) => `[data-test-field-validation=${attr}]`,
-  validationWarning: (attr) => `[data-test-validation-warning=${attr}]`,
-  messageError: '[data-test-message-error]',
-  kvObjectEditor: {
-    deleteRow: (idx = 0) => `[data-test-kv-delete-row="${idx}"]`,
-  },
-  searchSelect: {
-    options: '.ember-power-select-option',
-    optionIndex: (text) => findAll('.ember-power-select-options li').findIndex((e) => e.innerText === text),
-    option: (index = 0) => `.ember-power-select-option:nth-child(${index + 1})`,
-    selectedOption: (index = 0) => `[data-test-selected-option="${index}"]`,
-    noMatch: '.ember-power-select-option--no-matches-message',
-    removeSelected: '[data-test-selected-list-button="delete"]',
-  },
-  overviewCard: {
-    title: (title) => `[data-test-overview-card-title="${title}"]`,
-    description: (title) => `[data-test-overview-card-subtitle="${title}"]`,
-    content: (title) => `[data-test-overview-card-content="${title}"]`,
-    action: (title) => `[data-test-overview-card-container="${title}"] [data-test-action-text]`,
-    actionLink: (label) => `[data-test-action-text="${label}"]`,
-  },
-  pagination: {
-    next: '.hds-pagination-nav__arrow--direction-next',
-    prev: '.hds-pagination-nav__arrow--direction-prev',
-  },
-  kvSuggestion: {
-    input: '[data-test-kv-suggestion-input]',
-    select: '[data-test-kv-suggestion-select]',
-  },
-  navLink: (label) => `[data-test-sidebar-nav-link="${label}"]`,
-  cancelButton: '[data-test-cancel]',
-  saveButton: '[data-test-save]',
-};
diff --git a/ui/tests/helpers/general-selectors.ts b/ui/tests/helpers/general-selectors.ts
new file mode 100644
index 00000000000..b17cbb1df63
--- /dev/null
+++ b/ui/tests/helpers/general-selectors.ts
@@ -0,0 +1,178 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { findAll } from '@ember/test-helpers';
+
+export const GENERAL = {
+  /* ────── Header / Breadcrumbs ────── */
+  breadcrumb: '[data-test-breadcrumbs] li',
+  breadcrumbAtIdx: (idx: string) => `[data-test-breadcrumbs] li:nth-child(${idx + 1}) a`,
+  breadcrumbLink: (label: string) => `[data-test-breadcrumb="${label}"] a`,
+  breadcrumbs: '[data-test-breadcrumbs]',
+  headerContainer: 'header.page-header',
+  title: '[data-test-page-title]',
+  hdsPageHeaderTitle: '.hds-page-header__title',
+  hdsPageHeaderSubtitle: '.hds-page-header__subtitle',
+  hdsPageHeaderDescription: '.hds-page-header__description',
+
+  /* ────── Tabs & Navigation ────── */
+  tab: (name: string) => `[data-test-tab="${name}"]`,
+  hdsTab: (name: string) => `[data-test-tab="${name}"] button`, // HDS tab buttons
+  secretTab: (name: string) => `[data-test-secret-list-tab="${name}"]`,
+  navLink: (label: string) => `[data-test-sidebar-nav-link="${label}"]`,
+  linkTo: (label: string) => `[data-test-link-to="${label}"]`,
+
+  /* ────── Buttons ────── */
+  backButton: '[data-test-back-button]',
+  cancelButton: '[data-test-cancel]',
+  confirmButton: '[data-test-confirm-button]', // used most often on modal or confirm popups
+  confirmTrigger: '[data-test-confirm-action-trigger]',
+  copyButton: '[data-test-copy-button]',
+  // there should only be one submit button per view (e.g. one per form) so this does not need to be dynamic
+  // this button should be used for any kind of "submit" on a form or "save" action.
+  submitButton: '[data-test-submit]',
+  button: (label: string) => (label ? `[data-test-button="${label}"]` : '[data-test-button]'),
+  copySnippet: (name: string) => `[data-test-copy-snippet=${name}]`,
+
+  /* ────── Menus & Lists ────── */
+  menuTrigger: '[data-test-popup-menu-trigger]',
+  menuItem: (name: string) => `[data-test-popup-menu="${name}"]`,
+  listItem: (label: string) => (label ? `[data-test-list-item="${label}"]` : '[data-test-list-item]'),
+  listItemLink: '[data-test-list-item-link]',
+  linkedBlock: (item: string) => `[data-test-linked-block="${item}"]`,
+
+  /* ────── Tables ────── */
+  table: (title: string) => `[data-test-table="${title}"]`,
+  tableRow: (idx?: number) => (idx ? `[data-test-table-row="${idx}"]` : '[data-test-table-row]'),
+  tableData: (idx?: number, key?: string) => `[data-test-table-row="${idx}"] [data-test-table-data="${key}"]`,
+  tableColumnHeader: (col: number, { isAdvanced = false } = {}) =>
+    `${isAdvanced ? '.hds-advanced-table__th' : 'hds-table__th'}:nth-child(${col})`, // number is not 0-indexed, first column header is 1
+
+  /* ────── Inputs / Form Fields ────── */
+  checkboxByAttr: (attr: string) => `[data-test-checkbox="${attr}"]`,
+  confirmModalInput: '[data-test-confirmation-modal-input]',
+  confirmMessage: '[data-test-confirm-action-message]',
+  docLinkByAttr: (attr: string) => `[data-test-doc-link="${attr}"]`,
+  enableField: (attr: string) => `[data-test-enable-field="${attr}"] button`,
+  fieldByAttr: (attr: string) => `[data-test-field="${attr}"]`,
+  fieldLabel: () => `[data-test-form-field-label]`,
+  fieldLabelbyAttr: (attr: string) => `[data-test-form-field-label="${attr}"]`,
+  groupControlByIndex: (index: number) => `.hds-form-group__control-field:nth-of-type(${index})`,
+  helpText: () => `[data-test-help-text]`,
+  helpTextByAttr: (attr: string) => `[data-test-help-text="${attr}"]`,
+  helpTextByGroupControlIndex: (index: number) =>
+    `.hds-form-group__control-field:nth-of-type(${index}) [data-test-help-text]`,
+  inputByAttr: (attr: string) => `[data-test-input="${attr}"]`,
+  inputGroupByAttr: (attr: string) => `[data-test-input-group="${attr}"]`,
+  inputSearch: (attr: string) => `[data-test-input-search="${attr}"]`,
+  filterInput: '[data-test-filter-input]',
+  filterInputExplicit: '[data-test-filter-input-explicit]',
+  labelById: (id: string) => `label[id="${id}"]`,
+  labelByGroupControlIndex: (index: number) => `.hds-form-group__control-field:nth-of-type(${index}) label`,
+  maskedInput: '[data-test-masked-input]',
+  radioByAttr: (attr: string) => `[data-test-radio="${attr}"]`,
+  selectByAttr: (attr: string) => `[data-test-select="${attr}"]`,
+  toggleInput: (attr: string) => `[data-test-toggle-input="${attr}"]`,
+  textToggle: '[data-test-text-toggle]',
+  filter: (name: string) => `[data-test-filter="${name}"]`,
+  textareaByAttr: (attr: string) => `textarea[name="${attr}"]`,
+
+  /* ────── Code Blocks / Editor ────── */
+  codemirror: `[data-test-component="code-mirror-modifier"]`,
+  codemirrorTextarea: `[data-test-component="code-mirror-modifier"] textarea`,
+  codeBlock: (label: string) => `[data-test-code-block="${label}"]`,
+
+  /* ────── Key/Value Editors ────── */
+  kvObjectEditor: {
+    key: (idx = 0) => `[data-test-kv-key="${idx}"]`,
+    value: (idx = 0) => `[data-test-kv-value="${idx}"]`,
+    addRow: '[data-test-kv-add-row]',
+    deleteRow: (idx = 0) => `[data-test-kv-delete-row="${idx}"]`,
+  },
+  kvSuggestion: {
+    input: '[data-test-kv-suggestion-input]',
+    select: '[data-test-kv-suggestion-select]',
+  },
+
+  /* ────── Search Select ────── */
+  searchSelect: {
+    trigger: (id: string) => `[data-test-component="search-select"]#${id} .ember-basic-dropdown-trigger`,
+    options: '.ember-power-select-option',
+    option: (index = 0) => `.ember-power-select-option:nth-child(${index + 1})`,
+    optionIndex: (text: string) =>
+      findAll('.ember-power-select-options li').findIndex((e) => e.textContent?.trim() === text),
+    selectedOption: (index = 0) => `[data-test-selected-option="${index}"]`,
+    noMatch: '.ember-power-select-option--no-matches-message',
+    removeSelected: '[data-test-selected-list-button="delete"]',
+    searchInput: '.ember-power-select-search-input',
+  },
+
+  /* ────── TTL Fields ────── */
+  ttl: {
+    toggle: (attr: string) => `[data-test-toggle-label="${attr}"]`,
+    input: (attr: string) => `[data-test-ttl-value="${attr}"]`,
+  },
+
+  /* ────── Info Table / Rows ────── */
+  infoRowLabel: (label: string) => `[data-test-row-label="${label}"]`,
+  infoRowValue: (label: string) => `[data-test-row-value="${label}"]`,
+
+  /* ────── Empty / Error / Alert States ────── */
+  emptyStateTitle: '[data-test-empty-state-title]',
+  emptyStateSubtitle: '[data-test-empty-state-subtitle]',
+  emptyStateMessage: '[data-test-empty-state-message]',
+  emptyStateActions: '[data-test-empty-state-actions]',
+  flashMessage: '[data-test-flash-message]',
+  latestFlashContent: '[data-test-flash-message]:last-of-type [data-test-flash-message-body]',
+  inlineAlert: '[data-test-inline-alert]',
+  inlineError: '[data-test-inline-error-message]',
+  messageError: '[data-test-message-error]',
+  messageDescription: '[data-test-message-error-description]',
+  notFound: '[data-test-not-found]',
+  validationErrorByAttr: (attr: string) => `[data-test-validation-error=${attr}]`,
+  validationWarningByAttr: (attr: string) => `[data-test-validation-warning=${attr}]`,
+
+  pageError: {
+    error: '[data-test-page-error]',
+    errorTitle: (httpStatus: number) => `[data-test-page-error-title="${httpStatus}"]`,
+    errorSubtitle: '[data-test-page-error-subtitle]',
+    errorMessage: '[data-test-page-error-message]',
+    errorDetails: '[data-test-page-error-details]',
+  },
+
+  /* ────── Pagination ────── */
+  pagination: '[data-test-pagination]',
+  paginationInfo: '.hds-pagination-info',
+  paginationSizeSelector: '.hds-pagination-size-selector select',
+  nextPage: '.hds-pagination-nav__arrow--direction-next',
+  prevPage: '.hds-pagination-nav__arrow--direction-prev',
+
+  /* ────── Overview Cards ────── */
+  overviewCard: {
+    container: (title: string) => `[data-test-overview-card-container="${title}"]`,
+    title: (title: string) => `[data-test-overview-card-title="${title}"]`,
+    description: (title: string) => `[data-test-overview-card-subtitle="${title}"]`,
+    content: (title: string) => `[data-test-overview-card-content="${title}"]`,
+    actionText: (text: string) => `[data-test-action-text="${text}"]`,
+    actionLink: (label: string) => `[data-test-overview-card="${label}"] a`,
+  },
+
+  /* ────── Cards ────── */
+  cardContainer: (title: string) => `[data-test-card-container="${title}"]`,
+
+  /* ────── Modals & Flyouts ────── */
+  flyout: '[data-test-flyout]',
+  modal: {
+    container: (title: string) => `[data-test-modal=${title}]`,
+    header: (title: string) => `[data-test-modal-header=${title}]`,
+    body: (title: string) => `[data-test-modal-body=${title}]`,
+  },
+
+  /* ────── Misc ────── */
+  icon: (name: string) => (name ? `[data-test-icon="${name}"]` : '[data-test-icon]'),
+  badge: (name: string) => (name ? `[data-test-badge="${name}"]` : '[data-test-badge]'),
+  tooltip: (label: string) => `[data-test-tooltip="${label}"]`,
+  tooltipText: '.hds-tooltip-container',
+};
diff --git a/ui/tests/helpers/index.js b/ui/tests/helpers/index.js
index cb8f694d240..bf5daaccd4d 100644
--- a/ui/tests/helpers/index.js
+++ b/ui/tests/helpers/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import {
   setupTest as upstreamSetupTest,
 } from 'ember-qunit';
 
-// This file exists to provide wrappers around ember-qunit's / ember-mocha's
+// This file exists to provide wrappers around ember-qunit's
 // test setup functions. This way, you can easily extend the setup that is
 // needed per test type.
 
diff --git a/ui/tests/helpers/kubernetes/kubernetes-selectors.ts b/ui/tests/helpers/kubernetes/kubernetes-selectors.ts
new file mode 100644
index 00000000000..ab5926a43e4
--- /dev/null
+++ b/ui/tests/helpers/kubernetes/kubernetes-selectors.ts
@@ -0,0 +1,15 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const KUBERNETES_OVERVIEW = {
+  // Page::Overview in the kubernetes engine
+  rolesCardTitle: '[data-test-overview-card-title="Roles"]',
+  rolesCardSubTitle: '[data-test-overview-card-subtitle="Roles"]',
+  rolesCardLink: '[data-test-overview-card="Roles"] a',
+  rolesCardNumRoles: '[data-test-roles-card-overview-num]',
+  generateCredentialsCardTitle: '[data-test-overview-card-title="Generate credentials"]',
+  generateCredentialsCardSubTitle: '[data-test-overview-card-subtitle="Generate credentials"]',
+  generateCredentialsCardButton: '[data-test-generate-credential-button]',
+};
diff --git a/ui/tests/helpers/kubernetes/overview.js b/ui/tests/helpers/kubernetes/overview.js
deleted file mode 100644
index 60fc2df2bb1..00000000000
--- a/ui/tests/helpers/kubernetes/overview.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  rolesCardTitle: '[data-test-overview-card-title="Roles"]',
-  rolesCardSubTitle: '[data-test-overview-card-subtitle="Roles"]',
-  rolesCardLink: '[data-test-overview-card="Roles"] a',
-  rolesCardNumRoles: '[data-test-roles-card-overview-num]',
-  generateCredentialsCardTitle: '[data-test-overview-card-title="Generate credentials"]',
-  generateCredentialsCardSubTitle: '[data-test-overview-card-subtitle="Generate credentials"]',
-  generateCredentialsCardButton: '[data-test-generate-credential-button]',
-  emptyStateTitle: '.empty-state .empty-state-title',
-  emptyStateMessage: '.empty-state .empty-state-message',
-  emptyStateActionText: '.empty-state .empty-state-actions',
-};
diff --git a/ui/tests/helpers/kv/kv-run-commands.js b/ui/tests/helpers/kv/kv-run-commands.js
index 9b4e6a05712..32e286fc88e 100644
--- a/ui/tests/helpers/kv/kv-run-commands.js
+++ b/ui/tests/helpers/kv/kv-run-commands.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,7 @@ import { encodePath } from 'vault/utils/path-encoding-helpers';
 // CUSTOM ACTIONS RELEVANT TO KV-V2
 
 export const writeSecret = async function (backend, path, key, val, ns = null) {
-  const url = `vault/secrets/${backend}/kv/create`;
+  const url = `vault/secrets-engines/${backend}/kv/create`;
   ns ? await visit(url + `?namespace=${ns}`) : await visit(url);
   await settled();
   await fillIn(FORM.inputByAttr('path'), path);
@@ -26,7 +26,7 @@ export const writeVersionedSecret = async function (backend, path, key, val, ver
   await writeSecret(backend, path, 'key-1', 'val-1', ns);
   await settled();
   for (let currentVersion = 2; currentVersion <= version; currentVersion++) {
-    const url = `/vault/secrets/${backend}/kv/${encodeURIComponent(path)}/details/edit`;
+    const url = `/vault/secrets-engines/${backend}/kv/${encodeURIComponent(path)}/details/edit`;
     ns ? await visit(url + `?namespace=${ns}`) : await visit(url);
     await settled();
     if (currentVersion === version) {
@@ -58,11 +58,3 @@ export const addSecretMetadataCmd = (backend, secret, options = { max_versions:
   }, '');
   return `write ${backend}/metadata/${secret} ${stringOptions}`;
 };
-
-// Clears kv-related data and capabilities so that admin
-// capabilities from setup don't rollover
-export function clearRecords(store) {
-  store.unloadAll('kv/data');
-  store.unloadAll('kv/metatata');
-  store.unloadAll('capabilities');
-}
diff --git a/ui/tests/helpers/kv/kv-selectors.js b/ui/tests/helpers/kv/kv-selectors.js
index 247e8730340..59b2d2444c3 100644
--- a/ui/tests/helpers/kv/kv-selectors.js
+++ b/ui/tests/helpers/kv/kv-selectors.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,9 +9,11 @@ export const PAGE = {
   breadcrumbs: '[data-test-breadcrumbs]',
   breadcrumb: '[data-test-breadcrumbs] li',
   breadcrumbAtIdx: (idx) => `[data-test-breadcrumbs] li:nth-child(${idx + 1}) a`,
+  breadcrumbCurrentAtIdx: (idx) =>
+    `[data-test-breadcrumbs] li:nth-child(${idx + 1}) .hds-breadcrumb__current`,
   infoRow: '[data-test-component="info-table-row"]',
-  infoRowValue: (label) => `[data-test-value-div="${label}"]`,
-  infoRowToggleMasked: (label) => `[data-test-value-div="${label}"] [data-test-button="toggle-masked"]`,
+  infoRowValue: (label) => `[data-test-row-value="${label}"]`, // TODO replace with GENERAL.infoRowValue
+  infoRowToggleMasked: (label) => `[data-test-row-value="${label}"] [data-test-button="toggle-masked"]`,
   secretTab: (tab) => (tab ? `[data-test-secrets-tab="${tab}"]` : '[data-test-secrets-tab]'),
   emptyStateTitle: '[data-test-empty-state-title]',
   emptyStateMessage: '[data-test-empty-state-message]',
@@ -25,10 +27,8 @@ export const PAGE = {
   toolbarAction: 'nav.toolbar-actions .toolbar-link, nav.toolbar-actions .toolbar-button',
   secretRow: '[data-test-component="info-table-row"]', // replace with infoRow
   // specific page selectors
-  backends: {
-    link: (backend) => `[data-test-secrets-backend-link="${backend}"]`,
-  },
   metadata: {
+    requestData: '[data-test-request-data]',
     editBtn: '[data-test-edit-metadata]',
     addCustomMetadataBtn: '[data-test-add-custom-metadata]',
     customMetadataSection: '[data-test-kv-custom-metadata-section]',
@@ -36,10 +36,11 @@ export const PAGE = {
     deleteMetadata: '[data-test-kv-delete="delete-metadata"]',
   },
   detail: {
-    versionTimestamp: '[data-test-kv-version-tooltip-trigger]',
+    versionTimestamp: '[data-test-tooltip="kv-version"]',
     versionDropdown: '[data-test-version-dropdown]',
     version: (number) => `[data-test-version="${number}"]`,
     createNewVersion: '[data-test-create-new-version]',
+    patchLatest: '[data-test-patch-latest-version]',
     delete: '[data-test-kv-delete="delete"]',
     destroy: '[data-test-kv-delete="destroy"]',
     undelete: '[data-test-kv-delete="undelete"]',
@@ -52,22 +53,15 @@ export const PAGE = {
     syncAlert: (name) => (name ? `[data-test-sync-alert="${name}"]` : '[data-test-sync-alert]'),
   },
   edit: {
-    toggleDiff: '[data-test-toggle-input="Show diff"',
     toggleDiffDescription: '[data-test-diff-description]',
   },
   list: {
     createSecret: '[data-test-toolbar-create-secret]',
     item: (secret) => (!secret ? '[data-test-list-item]' : `[data-test-list-item="${secret}"]`),
+    menuItem: (label) => `[data-test-list-menu-item="${label}"]`,
     filter: `[data-test-kv-list-filter]`,
-    listMenuDelete: `[data-test-popup-metadata-delete]`,
-    listMenuCreate: `[data-test-popup-create-new-version]`,
     overviewCard: '[data-test-overview-card-container="View secret"]',
     overviewInput: '[data-test-view-secret] input',
-    overviewButton: '[data-test-get-secret-detail]',
-    pagination: '[data-test-pagination]',
-    paginationInfo: '.hds-pagination-info',
-    paginationNext: '.hds-pagination-nav__arrow--direction-next',
-    paginationSelected: '.hds-pagination-nav__number--is-selected',
   },
   versions: {
     icon: (version) => `[data-test-icon-holder="${version}"]`,
@@ -85,9 +79,8 @@ export const PAGE = {
     metadataSection: '[data-test-metadata-section]',
   },
   paths: {
-    copyButton: (label) => `${PAGE.infoRowValue(label)} button`,
-    codeSnippet: (section) => `[data-test-commands="${section}"] code`,
-    snippetCopy: (section) => `[data-test-commands="${section}"] button`,
+    codeSnippet: (section) => `[data-test-code-block="${section}"] code`,
+    snippetCopy: (section) => `[data-test-code-block="${section}"] button`,
   },
 };
 
@@ -95,9 +88,6 @@ export const PAGE = {
 export const FORM = {
   inputByAttr: (attr) => `[data-test-input="${attr}"]`,
   fieldByAttr: (attr) => `[data=test=field="${attr}"]`, // formfield
-  toggleJson: '[data-test-toggle-input="json"]',
-  toggleJsonValues: '[data-test-toggle-input="revealValues"]',
-  toggleMasked: '[data-test-button="toggle-masked"]',
   toggleMetadata: '[data-test-metadata-toggle]',
   jsonEditor: '[data-test-component="code-mirror-modifier"]',
   ttlValue: (name) => `[data-test-ttl-value="${name}"]`,
@@ -109,13 +99,21 @@ export const FORM = {
   kvRow: '[data-test-kv-row]',
   keyInput: (idx = 0) => `[data-test-kv-key="${idx}"]`,
   valueInput: (idx = 0) => `[data-test-kv-value="${idx}"]`,
-  maskedValueInput: (idx = 0) => `[data-test-kv-value="${idx}"] [data-test-textarea]`,
+  maskedValueInput: (idx = 0) => `[data-test-kv-value="${idx}"] [data-test-input]`,
   addRow: (idx = 0) => `[data-test-kv-add-row="${idx}"]`,
   deleteRow: (idx = 0) => `[data-test-kv-delete-row="${idx}"]`,
+  // <KvPatchEditor>
+  patchEditorForm: '[data-test-kv-patch-editor]',
+  patchEdit: (idx = 0) => `[data-test-edit-button="${idx}"]`,
+  patchDelete: (idx = 0) => `[data-test-delete-button="${idx}"]`,
+  patchUndo: (idx = 0) => `[data-test-undo-button="${idx}"]`,
+  patchAdd: '[data-test-add-button]',
+  patchAlert: (type, idx) => `[data-test-alert-${type}="${idx}"]`,
   // Alerts & validation
   inlineAlert: '[data-test-inline-alert]',
   validation: (attr) => `[data-test-field="${attr}"] [data-test-inline-alert]`,
   messageError: '[data-test-message-error]',
+  validationError: (attr) => `[data-test-validation-error="${attr}"]`,
   validationWarning: '[data-test-validation-warning]',
   invalidFormAlert: '[data-test-invalid-form-alert]',
   versionAlert: '[data-test-secret-version-alert]',
@@ -128,3 +126,5 @@ export const FORM = {
 export const parseJsonEditor = (find) => {
   return JSON.parse(find(FORM.jsonEditor).innerText);
 };
+
+export const parseObject = (cm) => JSON.parse(cm().getValue());
diff --git a/ui/tests/helpers/kv/policy-generator.js b/ui/tests/helpers/kv/policy-generator.js
new file mode 100644
index 00000000000..16441f155a0
--- /dev/null
+++ b/ui/tests/helpers/kv/policy-generator.js
@@ -0,0 +1,116 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+const root = ['create', 'read', 'update', 'delete', 'list', 'patch'];
+
+// returns a string with each capability wrapped in double quotes => ["create", "read"]
+const format = (array) => array.map((c) => `"${c}"`).join(', ');
+
+export const adminPolicy = (backend) => {
+  return `
+    path "${backend}/*" {
+      capabilities = [${format(root)}]
+    },
+  `;
+};
+
+export const dataPolicy = ({ backend, secretPath = '*', capabilities = root }) => {
+  // "delete" capability on this path can delete latest version
+  return `
+    path "${backend}/data/${secretPath}" {
+      capabilities = [${format(capabilities)}]
+    }
+  `;
+};
+
+export const subkeysPolicy = ({ backend, secretPath = '*' }) => {
+  return `
+    path "${backend}/subkeys/${secretPath}" {
+      capabilities = ["read"]
+    }
+  `;
+};
+
+export const dataNestedPolicy = ({ backend, secretPath = '*', capabilities = root }) => {
+  return `
+    path "${backend}/data/app/${secretPath}" {
+      capabilities = [${format(capabilities)}]
+    }
+  `;
+};
+
+export const metadataPolicy = ({ backend, secretPath = '*', capabilities = root }) => {
+  // "delete" capability on this path can destroy all versions
+  return `
+    path "${backend}/metadata/${secretPath}" {
+        capabilities = [${format(capabilities)}]
+    }
+  `;
+};
+
+export const metadataNestedPolicy = ({ backend, secretPath = '*', capabilities = root }) => {
+  return `
+    path "${backend}/metadata/app/${secretPath}" {
+        capabilities = [${format(capabilities)}]
+    }
+  `;
+};
+
+export const metadataListPolicy = (backend) => {
+  return `
+    path "${backend}/metadata" {
+        capabilities = ["list"]
+    }
+  `;
+};
+
+export const deleteVersionsPolicy = ({ backend, secretPath = '*' }) => {
+  return `
+    path "${backend}/delete/${secretPath}" {
+        capabilities = ["update"]
+    }
+  `;
+};
+export const undeleteVersionsPolicy = ({ backend, secretPath = '*' }) => {
+  return `
+    path "${backend}/undelete/${secretPath}" {
+        capabilities = ["update"]
+    }
+  `;
+};
+export const destroyVersionsPolicy = ({ backend, secretPath = '*' }) => {
+  return `
+    path "${backend}/destroy/${secretPath}" {
+        capabilities = ["update"]
+    }
+  `;
+};
+
+// Personas for reuse in workflow tests
+export const personas = {
+  admin: (backend) => adminPolicy(backend) + subkeysPolicy({ backend }),
+  dataReader: (backend) => dataPolicy({ backend, capabilities: ['read'] }),
+  dataListReader: (backend) =>
+    dataPolicy({ backend, capabilities: ['read', 'delete'] }) + metadataListPolicy(backend),
+  metadataMaintainer: (backend) =>
+    metadataPolicy({ backend, capabilities: ['create', 'read', 'update', 'list'] }) +
+    deleteVersionsPolicy({ backend }) +
+    undeleteVersionsPolicy({ backend }) +
+    destroyVersionsPolicy({ backend }),
+  secretNestedCreator: (backend) =>
+    dataNestedPolicy({ backend, capabilities: ['create', 'update'] }) +
+    metadataNestedPolicy({ backend, capabilities: ['list', 'delete'] }),
+  secretCreator: (backend) =>
+    dataPolicy({ backend, capabilities: ['create', 'update'] }) +
+    metadataPolicy({ backend, capabilities: ['delete'] }),
+  secretPatcher: (backend) =>
+    // this persona should never have data "read"
+    dataPolicy({ backend, capabilities: ['patch'] }) +
+    metadataPolicy({ backend, capabilities: ['list', 'read'] }) +
+    subkeysPolicy({ backend }) +
+    // granting patcher persona delete/destroy capabilities because this matches policies from real customer use cases
+    deleteVersionsPolicy({ backend }) +
+    destroyVersionsPolicy({ backend }),
+};
diff --git a/ui/tests/helpers/ldap.js b/ui/tests/helpers/ldap.js
deleted file mode 100644
index 87c8c44350a..00000000000
--- a/ui/tests/helpers/ldap.js
+++ /dev/null
@@ -1,40 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { visit, currentURL } from '@ember/test-helpers';
-
-export const createSecretsEngine = (store) => {
-  store.pushPayload('secret-engine', {
-    modelName: 'secret-engine',
-    data: {
-      accessor: 'ldap_7e838627',
-      path: 'ldap-test/',
-      type: 'ldap',
-    },
-  });
-  return store.peekRecord('secret-engine', 'ldap-test');
-};
-
-export const generateBreadcrumbs = (backend, childRoute) => {
-  const breadcrumbs = [{ label: 'secrets', route: 'secrets', linkExternal: true }];
-  const root = { label: backend };
-  if (childRoute) {
-    root.route = 'overview';
-    breadcrumbs.push({ label: childRoute });
-  }
-  breadcrumbs.splice(1, 0, root);
-  return breadcrumbs;
-};
-
-const baseURL = '/vault/secrets/ldap-test/ldap/';
-const stripLeadingSlash = (uri) => (uri.charAt(0) === '/' ? uri.slice(1) : uri);
-
-export const isURL = (uri) => {
-  return currentURL() === `${baseURL}${stripLeadingSlash(uri)}`;
-};
-
-export const visitURL = (uri) => {
-  return visit(`${baseURL}${stripLeadingSlash(uri)}`);
-};
diff --git a/ui/tests/helpers/ldap/ldap-helpers.js b/ui/tests/helpers/ldap/ldap-helpers.js
new file mode 100644
index 00000000000..3c0059c43d3
--- /dev/null
+++ b/ui/tests/helpers/ldap/ldap-helpers.js
@@ -0,0 +1,44 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { visit, currentURL } from '@ember/test-helpers';
+
+export const createSecretsEngine = (store) => {
+  store.pushPayload('secret-engine', {
+    modelName: 'secret-engine',
+    data: {
+      accessor: 'ldap_7e838627',
+      path: 'ldap-test/',
+      type: 'ldap',
+    },
+  });
+  return store.peekRecord('secret-engine', 'ldap-test');
+};
+
+export const generateBreadcrumbs = (backend, childRoute) => {
+  const breadcrumbs = [{ label: 'Secrets', route: 'secrets', linkExternal: true }];
+  const root = { label: backend };
+  if (childRoute) {
+    root.route = 'overview';
+    breadcrumbs.push({ label: childRoute });
+  }
+  breadcrumbs.splice(1, 0, root);
+  return breadcrumbs;
+};
+
+const baseURL = (backend) => `/vault/secrets-engines/${backend}/ldap/`;
+const stripLeadingSlash = (uri) => (uri.charAt(0) === '/' ? uri.slice(1) : uri);
+
+export const isURL = (uri, backend = 'ldap-test') => {
+  return currentURL() === `${baseURL(backend)}${stripLeadingSlash(uri)}`;
+};
+
+export const assertURL = (assert, backend, path) => {
+  assert.strictEqual(currentURL(), baseURL(backend) + path, `url is ${path}`);
+};
+
+export const visitURL = (uri, backend = 'ldap-test') => {
+  return visit(`${baseURL(backend)}${stripLeadingSlash(uri)}`);
+};
diff --git a/ui/tests/helpers/ldap/ldap-selectors.ts b/ui/tests/helpers/ldap/ldap-selectors.ts
new file mode 100644
index 00000000000..898bcf7db07
--- /dev/null
+++ b/ui/tests/helpers/ldap/ldap-selectors.ts
@@ -0,0 +1,12 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const LDAP_SELECTORS = {
+  roleItem: (type: string, name: string) => `[data-test-role="${type} ${name}"]`,
+  libraryItem: (name: string) => `[data-test-library="${name}"]`,
+  roleMenu: (type: string, name: string) => `[data-test-popup-menu-trigger="${type} ${name}"]`,
+  libraryMenu: (name: string) => `[data-test-popup-menu-trigger="${name}"]`,
+  action: (action: string) => `[data-test-${action}]`,
+};
diff --git a/ui/tests/helpers/mfa/mfa-helpers.js b/ui/tests/helpers/mfa/mfa-helpers.js
new file mode 100644
index 00000000000..2ee71817473
--- /dev/null
+++ b/ui/tests/helpers/mfa/mfa-helpers.js
@@ -0,0 +1,26 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const constraintId = '7028db82-7de3-01d7-26b5-84b147c80966';
+
+export const setupTotpMfaResponse = (mountPath) => ({
+  auth: {
+    mfa_requirement: {
+      mfa_request_id: '0edf0945-da02-1300-9a0a-cb052cd94eb4',
+      mfa_constraints: {
+        [mountPath]: {
+          any: [
+            {
+              type: 'totp',
+              id: constraintId,
+              uses_passcode: true,
+            },
+          ],
+        },
+      },
+    },
+    num_uses: 0,
+  },
+});
diff --git a/ui/tests/helpers/mfa/mfa-selectors.ts b/ui/tests/helpers/mfa/mfa-selectors.ts
new file mode 100644
index 00000000000..fb423357b49
--- /dev/null
+++ b/ui/tests/helpers/mfa/mfa-selectors.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const MFA_SELECTORS = {
+  countdown: '[data-test-mfa-countdown]',
+  description: '[data-test-mfa-description]',
+  label: '[data-test-mfa-label]',
+  mfaForm: '[data-test-mfa-form]',
+  passcode: (idx: number) => (idx ? `[data-test-mfa-passcode="${idx}"]` : '[data-test-mfa-passcode]'),
+  push: '[data-test-mfa-push-instruction]',
+  verifyBadge: (label: string) => `[data-test-mfa-verified="${label}"]`,
+  qrCode: '[data-test-qrcode]',
+  select: (idx: number) => (idx ? `[data-test-mfa-select="${idx}"]` : '[data-test-mfa-select]'),
+  subheader: '[data-test-mfa-subheader]',
+  subtitle: '[data-test-mfa-subtitle]',
+  verifyForm: 'form#mfa-form',
+};
diff --git a/ui/tests/helpers/mirage-to-models.js b/ui/tests/helpers/mirage-to-models.js
deleted file mode 100644
index f754fa240b4..00000000000
--- a/ui/tests/helpers/mirage-to-models.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { getContext } from '@ember/test-helpers';
-
-export default (data) => {
-  const context = getContext();
-  const store = context.owner.lookup('service:store');
-  const modelName = Array.isArray(data) ? data[0].modelName : data.modelName;
-  const json = context.server.serializerOrRegistry.serialize(data);
-  store.push(json);
-  return Array.isArray(data)
-    ? data.map(({ id }) => store.peekRecord(modelName, id))
-    : store.peekRecord(modelName, data.id);
-};
diff --git a/ui/tests/helpers/noop-all-api-requests.js b/ui/tests/helpers/noop-all-api-requests.js
deleted file mode 100644
index 88e44034083..00000000000
--- a/ui/tests/helpers/noop-all-api-requests.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Pretender from 'pretender';
-import { noopStub } from './stubs';
-
-/**
- * DEPRECATED prefer to use `setupMirage` along with stubs in vault/tests/helpers/stubs
- */
-export default function (options = { usePassthrough: false }) {
-  return new Pretender(function () {
-    let fn = noopStub();
-    if (options.usePassthrough) {
-      fn = this.passthrough;
-    }
-    this.post('/v1/**', fn);
-    this.put('/v1/**', fn);
-    this.get('/v1/**', fn);
-    this.delete('/v1/**', fn || noopStub(204));
-  });
-}
diff --git a/ui/tests/helpers/oidc-config.js b/ui/tests/helpers/oidc-config.js
index a226d8e1df8..5e9f5852041 100644
--- a/ui/tests/helpers/oidc-config.js
+++ b/ui/tests/helpers/oidc-config.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { Response } from 'miragejs';
+import { debug } from '@ember/debug';
 
 export const OIDC_BASE_URL = `/vault/access/oidc`;
 
@@ -12,7 +12,6 @@ export const SELECTORS = {
   oidcClientCreateButton: '[data-test-oidc-configure]',
   oidcRouteTabs: '[data-test-oidc-tabs]',
   oidcLandingImg: '[data-test-oidc-img]',
-  confirmActionButton: '[data-test-confirm-button]',
   inlineAlert: '[data-test-inline-alert]',
   // client route
   clientSaveButton: '[data-test-oidc-client-save]',
@@ -57,49 +56,6 @@ export const SELECTORS = {
   providerClientsTab: '[data-test-oidc-provider-clients]',
 };
 
-export function overrideMirageResponse(httpStatus, data) {
-  if (httpStatus === 403) {
-    return new Response(
-      403,
-      { 'Content-Type': 'application/json' },
-      JSON.stringify({ errors: ['permission denied'] })
-    );
-  }
-  if (httpStatus === 404) {
-    return new Response(404, { 'Content-Type': 'application/json' });
-  }
-  if (httpStatus === 200) {
-    return new Response(200, { 'Content-Type': 'application/json' }, JSON.stringify(data));
-  }
-  return {
-    request_id: crypto.randomUUID(),
-    lease_id: '',
-    renewable: false,
-    lease_duration: 0,
-    wrap_info: null,
-    warnings: null,
-    auth: null,
-    data: { ...data },
-  };
-}
-
-export function overrideCapabilities(requestPath, capabilitiesArray) {
-  // sample of capabilitiesArray: ['read', 'update']
-  return {
-    request_id: '40f7e44d-af5c-9b60-bd20-df72eb17e294',
-    lease_id: '',
-    renewable: false,
-    lease_duration: 0,
-    data: {
-      capabilities: capabilitiesArray,
-      [requestPath]: capabilitiesArray,
-    },
-    wrap_info: null,
-    warnings: null,
-    auth: null,
-  };
-}
-
 export async function clearRecord(store, modelType, id) {
   await store
     .findRecord(modelType, id)
@@ -107,6 +63,7 @@ export async function clearRecord(store, modelType, id) {
       deleteModelRecord(model);
     })
     .catch(() => {
+      debug(`Clearing record failed for ${modelType} with id: ${id}`);
       // swallow error
     });
 }
diff --git a/ui/tests/helpers/oidc-window-stub.js b/ui/tests/helpers/oidc-window-stub.js
index 8a69fd55192..7f3ba87a509 100644
--- a/ui/tests/helpers/oidc-window-stub.js
+++ b/ui/tests/helpers/oidc-window-stub.js
@@ -1,38 +1,42 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
+import sinon from 'sinon';
 
-import EmberObject, { computed } from '@ember/object';
-import Evented from '@ember/object/evented';
+export const DELAY_IN_MS = 500;
 
-export const fakeWindow = EmberObject.extend(Evented, {
-  init() {
-    this._super(...arguments);
-    this.on('close', () => {
-      this.set('closed', true);
-    });
-  },
-  screen: computed(function () {
-    return {
-      height: 600,
-      width: 500,
-    };
-  }),
-  origin: 'https://my-vault.com',
-  closed: false,
-  open() {},
-  close() {},
-});
+// suggestions for a custom popup
+// passing { close: true } automatically closes popups opened from window.open()
+// passing { closed: true } sets value on popup window
+export const windowStub = ({ stub, popup } = {}) => {
+  // if already stubbed, don't re-stub
+  const openStub = stub ? stub : sinon.stub(window, 'open');
+
+  const defaultPopup = { close: () => true };
+  openStub.returns(popup || defaultPopup);
+  return openStub;
+};
 
 export const buildMessage = (opts) => ({
   isTrusted: true,
   origin: 'https://my-vault.com',
-  data: {
-    source: 'oidc-callback',
-    path: 'foo',
-    state: 'state',
-    code: 'code',
-  },
+  data: callbackData(),
   ...opts,
 });
+
+export const callbackData = (data = {}) => ({
+  source: 'oidc-callback',
+  path: 'foo',
+  state: 'state',
+  code: 'code',
+  ...data,
+});
+
+// Simulates the OIDC popup message event the OIDC auth method waits for
+// mountPath is necessary because it builds the callback URL
+export const triggerMessageEvent = (mountPath, delay = DELAY_IN_MS) => {
+  setTimeout(() => {
+    window.postMessage(callbackData({ path: mountPath }), window.origin);
+  }, delay);
+};
diff --git a/ui/tests/helpers/openapi/auth-model-attributes.js b/ui/tests/helpers/openapi/auth-model-attributes.js
deleted file mode 100644
index d4ca32c3ee3..00000000000
--- a/ui/tests/helpers/openapi/auth-model-attributes.js
+++ /dev/null
@@ -1,1320 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-const userpass = {
-  user: {
-    username: {
-      editType: 'string',
-      helpText: 'Username for this user.',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Username',
-      type: 'string',
-    },
-    password: {
-      editType: 'string',
-      helpText: 'Password for this user.',
-      fieldGroup: 'default',
-      sensitive: true,
-      type: 'string',
-    },
-    tokenBoundCidrs: {
-      editType: 'stringArray',
-      helpText:
-        'A list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Bound CIDRs",
-    },
-    tokenExplicitMaxTtl: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Explicit Maximum TTL",
-    },
-    tokenMaxTtl: {
-      editType: 'ttl',
-      helpText: 'The maximum lifetime of the generated token',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Maximum TTL",
-    },
-    tokenNoDefaultPolicy: {
-      editType: 'boolean',
-      helpText: "If true, the 'default' policy will not automatically be added to generated tokens",
-      fieldGroup: 'Tokens',
-      label: "Do Not Attach 'default' Policy To Generated Tokens",
-      type: 'boolean',
-    },
-    tokenNumUses: {
-      editType: 'number',
-      helpText: 'The maximum number of times a token may be used, a value of zero means unlimited',
-      fieldGroup: 'Tokens',
-      label: 'Maximum Uses of Generated Tokens',
-      type: 'number',
-    },
-    tokenPeriod: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h").',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Period",
-    },
-    tokenPolicies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies that will apply to the generated token for this user.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Policies",
-    },
-    tokenTtl: {
-      editType: 'ttl',
-      helpText: 'The initial ttl of the token to generate',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Initial TTL",
-    },
-    tokenType: {
-      editType: 'string',
-      helpText: 'The type of token to generate, service or batch',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Type",
-      type: 'string',
-    },
-  },
-};
-
-const azure = {
-  'auth-config/azure': {
-    clientId: {
-      editType: 'string',
-      fieldGroup: 'default',
-      helpText:
-        'The OAuth2 client id to connection to Azure. This value can also be provided with the AZURE_CLIENT_ID environment variable.',
-      label: 'Client ID',
-      type: 'string',
-    },
-    clientSecret: {
-      editType: 'string',
-      fieldGroup: 'default',
-      helpText:
-        'The OAuth2 client secret to connection to Azure. This value can also be provided with the AZURE_CLIENT_SECRET environment variable.',
-      type: 'string',
-    },
-    environment: {
-      editType: 'string',
-      fieldGroup: 'default',
-      helpText:
-        'The Azure environment name. If not provided, AzurePublicCloud is used. This value can also be provided with the AZURE_ENVIRONMENT environment variable.',
-      type: 'string',
-    },
-    maxRetries: {
-      editType: 'number',
-      fieldGroup: 'default',
-      helpText:
-        'The maximum number of attempts a failed operation will be retried before producing an error.',
-      type: 'number',
-    },
-    maxRetryDelay: {
-      editType: 'ttl',
-      fieldGroup: 'default',
-      helpText: 'The maximum delay allowed before retrying an operation.',
-    },
-    resource: {
-      editType: 'string',
-      fieldGroup: 'default',
-      helpText:
-        'The resource URL for the vault application in Azure Active Directory. This value can also be provided with the AZURE_AD_RESOURCE environment variable.',
-      type: 'string',
-    },
-    retryDelay: {
-      editType: 'ttl',
-      fieldGroup: 'default',
-      helpText: 'The initial amount of delay to use before retrying an operation, increasing exponentially.',
-    },
-    rootPasswordTtl: {
-      editType: 'ttl',
-      fieldGroup: 'default',
-      helpText:
-        'The TTL of the root password in Azure. This can be either a number of seconds or a time formatted duration (ex: 24h, 48ds)',
-    },
-    tenantId: {
-      editType: 'string',
-      fieldGroup: 'default',
-      helpText:
-        'The tenant id for the Azure Active Directory. This is sometimes referred to as Directory ID in AD. This value can also be provided with the AZURE_TENANT_ID environment variable.',
-      label: 'Tenant ID',
-      type: 'string',
-    },
-  },
-};
-
-const cert = {
-  'auth-config/cert': {
-    disableBinding: {
-      editType: 'boolean',
-      helpText:
-        'If set, during renewal, skips the matching of presented client identity with the client identity used during login. Defaults to false.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    enableIdentityAliasMetadata: {
-      editType: 'boolean',
-      helpText:
-        'If set, metadata of the certificate including the metadata corresponding to allowed_metadata_extensions will be stored in the alias. Defaults to false.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    ocspCacheSize: {
-      editType: 'number',
-      helpText: 'The size of the in memory OCSP response cache, shared by all configured certs',
-      fieldGroup: 'default',
-      type: 'number',
-    },
-    roleCacheSize: {
-      editType: 'number',
-      fieldGroup: 'default',
-      helpText: 'The size of the in memory role cache',
-      type: 'number',
-    },
-  },
-  cert: {
-    name: {
-      editType: 'string',
-      helpText: 'The name of the certificate',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Name',
-      type: 'string',
-    },
-    allowedCommonNames: {
-      editType: 'stringArray',
-      helpText: 'A list of names. At least one must exist in the Common Name. Supports globbing.',
-      fieldGroup: 'Constraints',
-    },
-    allowedDnsSans: {
-      editType: 'stringArray',
-      helpText: 'A list of DNS names. At least one must exist in the SANs. Supports globbing.',
-      fieldGroup: 'Constraints',
-      label: 'Allowed DNS SANs',
-    },
-    allowedEmailSans: {
-      editType: 'stringArray',
-      helpText: 'A list of Email Addresses. At least one must exist in the SANs. Supports globbing.',
-      fieldGroup: 'Constraints',
-      label: 'Allowed Email SANs',
-    },
-    allowedMetadataExtensions: {
-      editType: 'stringArray',
-      helpText:
-        'A list of OID extensions. Upon successful authentication, these extensions will be added as metadata if they are present in the certificate. The metadata key will be the string consisting of the OID numbers separated by a dash (-) instead of a dot (.) to allow usage in ACL templates.',
-      fieldGroup: 'default',
-    },
-    allowedNames: {
-      editType: 'stringArray',
-      helpText:
-        'A list of names. At least one must exist in either the Common Name or SANs. Supports globbing. This parameter is deprecated, please use allowed_common_names, allowed_dns_sans, allowed_email_sans, allowed_uri_sans.',
-      fieldGroup: 'Constraints',
-    },
-    allowedOrganizationalUnits: {
-      editType: 'stringArray',
-      helpText: 'A list of Organizational Units names. At least one must exist in the OU field.',
-      fieldGroup: 'Constraints',
-    },
-    allowedUriSans: {
-      editType: 'stringArray',
-      helpText: 'A list of URIs. At least one must exist in the SANs. Supports globbing.',
-      fieldGroup: 'Constraints',
-      label: 'Allowed URI SANs',
-    },
-    certificate: {
-      editType: 'file',
-      helpText: 'The public certificate that should be trusted. Must be x509 PEM encoded.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    displayName: {
-      editType: 'string',
-      helpText: 'The display name to use for clients using this certificate.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    ocspCaCertificates: {
-      editType: 'file',
-      helpText: 'Any additional CA certificates needed to communicate with OCSP servers',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    ocspEnabled: {
-      editType: 'boolean',
-      helpText: 'Whether to attempt OCSP verification of certificates at login',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    ocspFailOpen: {
-      editType: 'boolean',
-      helpText:
-        'If set to true, if an OCSP revocation cannot be made successfully, login will proceed rather than failing. If false, failing to get an OCSP status fails the request.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    ocspQueryAllServers: {
-      editType: 'boolean',
-      helpText:
-        'If set to true, rather than accepting the first successful OCSP response, query all servers and consider the certificate valid only if all servers agree.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    ocspServersOverride: {
-      editType: 'stringArray',
-      helpText:
-        'A list of OCSP server addresses. If unset, the OCSP server is determined from the AuthorityInformationAccess extension on the certificate being inspected.',
-      fieldGroup: 'default',
-    },
-    requiredExtensions: {
-      editType: 'stringArray',
-      helpText:
-        "A list of extensions formatted as 'oid:value'. Expects the extension value to be some type of ASN1 encoded string. All values much match. Supports globbing on 'value'.",
-      fieldGroup: 'default',
-    },
-    tokenBoundCidrs: {
-      editType: 'stringArray',
-      helpText:
-        'A list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Bound CIDRs",
-    },
-    tokenExplicitMaxTtl: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Explicit Maximum TTL",
-    },
-    tokenMaxTtl: {
-      editType: 'ttl',
-      helpText: 'The maximum lifetime of the generated token',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Maximum TTL",
-    },
-    tokenNoDefaultPolicy: {
-      editType: 'boolean',
-      helpText: "If true, the 'default' policy will not automatically be added to generated tokens",
-      fieldGroup: 'Tokens',
-      label: "Do Not Attach 'default' Policy To Generated Tokens",
-      type: 'boolean',
-    },
-    tokenNumUses: {
-      editType: 'number',
-      helpText: 'The maximum number of times a token may be used, a value of zero means unlimited',
-      fieldGroup: 'Tokens',
-      label: 'Maximum Uses of Generated Tokens',
-      type: 'number',
-    },
-    tokenPeriod: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h").',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Period",
-    },
-    tokenPolicies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies that will apply to the generated token for this user.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Policies",
-    },
-    tokenTtl: {
-      editType: 'ttl',
-      helpText: 'The initial ttl of the token to generate',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Initial TTL",
-    },
-    tokenType: {
-      editType: 'string',
-      helpText: 'The type of token to generate, service or batch',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Type",
-      type: 'string',
-    },
-  },
-};
-
-const gcp = {
-  'auth-config/gcp': {
-    credentials: {
-      editType: 'string',
-      helpText:
-        'Google credentials JSON that Vault will use to verify users against GCP APIs. If not specified, will use application default credentials',
-      fieldGroup: 'default',
-      label: 'Credentials',
-      type: 'string',
-    },
-    customEndpoint: {
-      editType: 'object',
-      helpText: 'Specifies overrides for various Google API Service Endpoints used in requests.',
-      fieldGroup: 'default',
-      type: 'object',
-    },
-    gceAlias: {
-      editType: 'string',
-      helpText: 'Indicates what value to use when generating an alias for GCE authentications.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    gceMetadata: {
-      editType: 'stringArray',
-      helpText:
-        "The metadata to include on the aliases and audit logs generated by this plugin. When set to 'default', includes: instance_creation_timestamp, instance_id, instance_name, project_id, project_number, role, service_account_id, service_account_email, zone. Not editing this field means the 'default' fields are included. Explicitly setting this field to empty overrides the 'default' and means no metadata will be included. If not using 'default', explicit fields must be sent like: 'field1,field2'.",
-      fieldGroup: 'default',
-      defaultValue: 'field1,field2',
-      label: 'gce_metadata',
-    },
-    iamAlias: {
-      editType: 'string',
-      helpText: 'Indicates what value to use when generating an alias for IAM authentications.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    iamMetadata: {
-      editType: 'stringArray',
-      helpText:
-        "The metadata to include on the aliases and audit logs generated by this plugin. When set to 'default', includes: project_id, role, service_account_id, service_account_email. Not editing this field means the 'default' fields are included. Explicitly setting this field to empty overrides the 'default' and means no metadata will be included. If not using 'default', explicit fields must be sent like: 'field1,field2'.",
-      fieldGroup: 'default',
-      defaultValue: 'field1,field2',
-      label: 'iam_metadata',
-    },
-  },
-};
-
-const github = {
-  'auth-config/github': {
-    baseUrl: {
-      editType: 'string',
-      helpText:
-        'The API endpoint to use. Useful if you are running GitHub Enterprise or an API-compatible authentication server.',
-      fieldGroup: 'GitHub Options',
-      label: 'Base URL',
-      type: 'string',
-    },
-    organization: {
-      editType: 'string',
-      helpText: 'The organization users must be part of',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    organizationId: {
-      editType: 'number',
-      helpText: 'The ID of the organization users must be part of',
-      fieldGroup: 'default',
-      type: 'number',
-    },
-    tokenBoundCidrs: {
-      editType: 'stringArray',
-      helpText:
-        'A list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Bound CIDRs",
-    },
-    tokenExplicitMaxTtl: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Explicit Maximum TTL",
-    },
-    tokenMaxTtl: {
-      editType: 'ttl',
-      helpText: 'The maximum lifetime of the generated token',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Maximum TTL",
-    },
-    tokenNoDefaultPolicy: {
-      editType: 'boolean',
-      helpText: "If true, the 'default' policy will not automatically be added to generated tokens",
-      fieldGroup: 'Tokens',
-      label: "Do Not Attach 'default' Policy To Generated Tokens",
-      type: 'boolean',
-    },
-    tokenNumUses: {
-      editType: 'number',
-      helpText: 'The maximum number of times a token may be used, a value of zero means unlimited',
-      fieldGroup: 'Tokens',
-      label: 'Maximum Uses of Generated Tokens',
-      type: 'number',
-    },
-    tokenPeriod: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h").',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Period",
-    },
-    tokenPolicies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies that will apply to the generated token for this user.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Policies",
-    },
-    tokenTtl: {
-      editType: 'ttl',
-      helpText: 'The initial ttl of the token to generate',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Initial TTL",
-    },
-    tokenType: {
-      editType: 'string',
-      helpText: 'The type of token to generate, service or batch',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Type",
-      type: 'string',
-    },
-  },
-};
-
-const jwt = {
-  'auth-config/jwt': {
-    boundIssuer: {
-      editType: 'string',
-      helpText: "The value against which to match the 'iss' claim in a JWT. Optional.",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    defaultRole: {
-      editType: 'string',
-      helpText:
-        'The default role to use if none is provided during login. If not set, a role is required during login.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    jwksCaPem: {
-      editType: 'string',
-      helpText:
-        'The CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    jwksPairs: {
-      editType: 'objectArray',
-      fieldGroup: 'default',
-      helpText:
-        'Set of JWKS Url and CA certificate (or chain of certificates) pairs. CA certificates must be in PEM format. Cannot be used with "jwks_url" or "jwks_ca_pem".',
-    },
-    jwksUrl: {
-      editType: 'string',
-      helpText:
-        'JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    jwtSupportedAlgs: {
-      editType: 'stringArray',
-      helpText: 'A list of supported signing algorithms. Defaults to RS256.',
-      fieldGroup: 'default',
-    },
-    jwtValidationPubkeys: {
-      editType: 'stringArray',
-      helpText:
-        'A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with "jwks_url" or "oidc_discovery_url".',
-      fieldGroup: 'default',
-    },
-    namespaceInState: {
-      editType: 'boolean',
-      helpText:
-        'Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs.',
-      fieldGroup: 'default',
-      defaultValue: true,
-      label: 'Namespace in OIDC state',
-      type: 'boolean',
-    },
-    oidcClientId: {
-      editType: 'string',
-      helpText: 'The OAuth Client ID configured with your OIDC provider.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    oidcClientSecret: {
-      editType: 'string',
-      helpText: 'The OAuth Client Secret configured with your OIDC provider.',
-      fieldGroup: 'default',
-      sensitive: true,
-      type: 'string',
-    },
-    oidcDiscoveryCaPem: {
-      editType: 'string',
-      helpText:
-        'The CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    oidcDiscoveryUrl: {
-      editType: 'string',
-      helpText:
-        'OIDC Discovery URL, without any .well-known component (base path). Cannot be used with "jwks_url" or "jwt_validation_pubkeys".',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    oidcResponseMode: {
-      editType: 'string',
-      helpText:
-        "The response mode to be used in the OAuth2 request. Allowed values are 'query' and 'form_post'.",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    oidcResponseTypes: {
-      editType: 'stringArray',
-      helpText:
-        "The response types to request. Allowed values are 'code' and 'id_token'. Defaults to 'code'.",
-      fieldGroup: 'default',
-    },
-    providerConfig: {
-      editType: 'object',
-      helpText: 'Provider-specific configuration. Optional.',
-      fieldGroup: 'default',
-      label: 'Provider Config',
-      type: 'object',
-    },
-  },
-};
-
-const kubernetes = {
-  'auth-config/kubernetes': {
-    disableLocalCaJwt: {
-      editType: 'boolean',
-      helpText:
-        'Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod',
-      fieldGroup: 'default',
-      label: 'Disable use of local CA and service account JWT',
-      type: 'boolean',
-    },
-    kubernetesCaCert: {
-      editType: 'string',
-      helpText: 'PEM encoded CA cert for use by the TLS client used to talk with the API.',
-      fieldGroup: 'default',
-      label: 'Kubernetes CA Certificate',
-      type: 'string',
-    },
-    kubernetesHost: {
-      editType: 'string',
-      helpText:
-        'Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    pemKeys: {
-      editType: 'stringArray',
-      helpText:
-        'Optional list of PEM-formated public keys or certificates used to verify the signatures of kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys.',
-      fieldGroup: 'default',
-      label: 'Service account verification keys',
-    },
-    tokenReviewerJwt: {
-      editType: 'string',
-      helpText:
-        'A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API.',
-      fieldGroup: 'default',
-      label: 'Token Reviewer JWT',
-      type: 'string',
-    },
-    useAnnotationsAsAliasMetadata: {
-      editType: 'boolean',
-      fieldGroup: 'default',
-      helpText:
-        'Use annotations from the client token\'s associated service account as alias metadata for the Vault entity. Only annotations with the prefix "vault.hashicorp.com/alias-metadata-" will be used. Note that Vault will need permission to read service accounts from the Kubernetes API.',
-      label: 'Use annotations of JWT service account as alias metadata',
-      type: 'boolean',
-    },
-  },
-  role: {
-    name: {
-      editType: 'string',
-      helpText: 'Name of the role.',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Name',
-      type: 'string',
-    },
-    aliasNameSource: {
-      editType: 'string',
-      helpText:
-        'Source to use when deriving the Alias name. valid choices: "serviceaccount_uid" : <token.uid> e.g. 474b11b5-0f20-4f9d-8ca5-65715ab325e0 (most secure choice) "serviceaccount_name" : <namespace>/<serviceaccount> e.g. vault/vault-agent default: "serviceaccount_uid"',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    audience: {
-      editType: 'string',
-      helpText: 'Optional Audience claim to verify in the jwt.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    boundServiceAccountNames: {
-      editType: 'stringArray',
-      helpText:
-        'List of service account names able to access this role. If set to "*" all names are allowed.',
-      fieldGroup: 'default',
-    },
-    boundServiceAccountNamespaces: {
-      editType: 'stringArray',
-      helpText: 'List of namespaces allowed to access this role. If set to "*" all namespaces are allowed.',
-      fieldGroup: 'default',
-    },
-    tokenBoundCidrs: {
-      editType: 'stringArray',
-      helpText:
-        'A list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Bound CIDRs",
-    },
-    tokenExplicitMaxTtl: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Explicit Maximum TTL",
-    },
-    tokenMaxTtl: {
-      editType: 'ttl',
-      helpText: 'The maximum lifetime of the generated token',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Maximum TTL",
-    },
-    tokenNoDefaultPolicy: {
-      editType: 'boolean',
-      helpText: "If true, the 'default' policy will not automatically be added to generated tokens",
-      fieldGroup: 'Tokens',
-      label: "Do Not Attach 'default' Policy To Generated Tokens",
-      type: 'boolean',
-    },
-    tokenNumUses: {
-      editType: 'number',
-      helpText: 'The maximum number of times a token may be used, a value of zero means unlimited',
-      fieldGroup: 'Tokens',
-      label: 'Maximum Uses of Generated Tokens',
-      type: 'number',
-    },
-    tokenPeriod: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h").',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Period",
-    },
-    tokenPolicies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies that will apply to the generated token for this user.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Policies",
-    },
-    tokenTtl: {
-      editType: 'ttl',
-      helpText: 'The initial ttl of the token to generate',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Initial TTL",
-    },
-    tokenType: {
-      editType: 'string',
-      helpText: 'The type of token to generate, service or batch',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Type",
-      type: 'string',
-    },
-  },
-};
-
-const ldap = {
-  'auth-config/ldap': {
-    anonymousGroupSearch: {
-      editType: 'boolean',
-      helpText:
-        'Use anonymous binds when performing LDAP group searches (if true the initial credentials will still be used for the initial connection test).',
-      fieldGroup: 'default',
-      label: 'Anonymous group search',
-      type: 'boolean',
-    },
-    binddn: {
-      editType: 'string',
-      helpText: 'LDAP DN for searching for the user DN (optional)',
-      fieldGroup: 'default',
-      label: 'Name of Object to bind (binddn)',
-      type: 'string',
-    },
-    bindpass: {
-      editType: 'string',
-      helpText: 'LDAP password for searching for the user DN (optional)',
-      fieldGroup: 'default',
-      sensitive: true,
-      type: 'string',
-    },
-    caseSensitiveNames: {
-      editType: 'boolean',
-      helpText:
-        'If true, case sensitivity will be used when comparing usernames and groups for matching policies.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    certificate: {
-      editType: 'file',
-      helpText:
-        'CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded (optional)',
-      fieldGroup: 'default',
-      label: 'CA certificate',
-      type: 'string',
-    },
-    clientTlsCert: {
-      editType: 'file',
-      helpText: 'Client certificate to provide to the LDAP server, must be x509 PEM encoded (optional)',
-      fieldGroup: 'default',
-      label: 'Client certificate',
-      type: 'string',
-    },
-    clientTlsKey: {
-      editType: 'file',
-      helpText: 'Client certificate key to provide to the LDAP server, must be x509 PEM encoded (optional)',
-      fieldGroup: 'default',
-      label: 'Client key',
-      type: 'string',
-    },
-    connectionTimeout: {
-      editType: 'ttl',
-      helpText:
-        'Timeout, in seconds, when attempting to connect to the LDAP server before trying the next URL in the configuration.',
-      fieldGroup: 'default',
-    },
-    denyNullBind: {
-      editType: 'boolean',
-      helpText:
-        "Denies an unauthenticated LDAP bind request if the user's password is empty; defaults to true",
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    dereferenceAliases: {
-      editType: 'string',
-      helpText:
-        "When aliases should be dereferenced on search operations. Accepted values are 'never', 'finding', 'searching', 'always'. Defaults to 'never'.",
-      possibleValues: ['never', 'finding', 'searching', 'always'],
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    discoverdn: {
-      editType: 'boolean',
-      helpText: 'Use anonymous bind to discover the bind DN of a user (optional)',
-      fieldGroup: 'default',
-      label: 'Discover DN',
-      type: 'boolean',
-    },
-    groupattr: {
-      editType: 'string',
-      helpText:
-        'LDAP attribute to follow on objects returned by <groupfilter> in order to enumerate user group membership. Examples: "cn" or "memberOf", etc. Default: cn',
-      fieldGroup: 'default',
-      defaultValue: 'cn',
-      label: 'Group Attribute',
-      type: 'string',
-    },
-    groupdn: {
-      editType: 'string',
-      helpText: 'LDAP search base to use for group membership search (eg: ou=Groups,dc=example,dc=org)',
-      fieldGroup: 'default',
-      label: 'Group DN',
-      type: 'string',
-    },
-    groupfilter: {
-      editType: 'string',
-      helpText:
-        'Go template for querying group membership of user (optional) The template can access the following context variables: UserDN, Username Example: (&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}})) Default: (|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))',
-      fieldGroup: 'default',
-      label: 'Group Filter',
-      type: 'string',
-    },
-    insecureTls: {
-      editType: 'boolean',
-      helpText: 'Skip LDAP server SSL Certificate verification - VERY insecure (optional)',
-      fieldGroup: 'default',
-      label: 'Insecure TLS',
-      type: 'boolean',
-    },
-    maxPageSize: {
-      editType: 'number',
-      helpText:
-        "If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control to request pages of up to the given size. This can be used to avoid hitting the LDAP server's maximum result size limit. Otherwise, the LDAP backend will not use the paged search control.",
-      fieldGroup: 'default',
-      type: 'number',
-    },
-    passwordPolicy: {
-      editType: 'string',
-      fieldGroup: 'default',
-      helpText: 'Password policy to use to rotate the root password',
-      type: 'string',
-    },
-    requestTimeout: {
-      editType: 'ttl',
-      helpText:
-        'Timeout, in seconds, for the connection when making requests against the server before returning back an error.',
-      fieldGroup: 'default',
-    },
-    starttls: {
-      editType: 'boolean',
-      helpText: 'Issue a StartTLS command after establishing unencrypted connection (optional)',
-      fieldGroup: 'default',
-      label: 'Issue StartTLS',
-      type: 'boolean',
-    },
-    tlsMaxVersion: {
-      editType: 'string',
-      helpText:
-        "Maximum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'",
-      possibleValues: ['tls10', 'tls11', 'tls12', 'tls13'],
-      fieldGroup: 'default',
-      label: 'Maximum TLS Version',
-      type: 'string',
-    },
-    tlsMinVersion: {
-      editType: 'string',
-      helpText:
-        "Minimum TLS version to use. Accepted values are 'tls10', 'tls11', 'tls12' or 'tls13'. Defaults to 'tls12'",
-      possibleValues: ['tls10', 'tls11', 'tls12', 'tls13'],
-      fieldGroup: 'default',
-      label: 'Minimum TLS Version',
-      type: 'string',
-    },
-    tokenBoundCidrs: {
-      editType: 'stringArray',
-      helpText:
-        'A list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Bound CIDRs",
-    },
-    tokenExplicitMaxTtl: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Explicit Maximum TTL",
-    },
-    tokenMaxTtl: {
-      editType: 'ttl',
-      helpText: 'The maximum lifetime of the generated token',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Maximum TTL",
-    },
-    tokenNoDefaultPolicy: {
-      editType: 'boolean',
-      helpText: "If true, the 'default' policy will not automatically be added to generated tokens",
-      fieldGroup: 'Tokens',
-      label: "Do Not Attach 'default' Policy To Generated Tokens",
-      type: 'boolean',
-    },
-    tokenNumUses: {
-      editType: 'number',
-      helpText: 'The maximum number of times a token may be used, a value of zero means unlimited',
-      fieldGroup: 'Tokens',
-      label: 'Maximum Uses of Generated Tokens',
-      type: 'number',
-    },
-    tokenPeriod: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h").',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Period",
-    },
-    tokenPolicies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies that will apply to the generated token for this user.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Policies",
-    },
-    tokenTtl: {
-      editType: 'ttl',
-      helpText: 'The initial ttl of the token to generate',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Initial TTL",
-    },
-    tokenType: {
-      editType: 'string',
-      helpText: 'The type of token to generate, service or batch',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Type",
-      type: 'string',
-    },
-    upndomain: {
-      editType: 'string',
-      helpText: 'Enables userPrincipalDomain login with [username]@UPNDomain (optional)',
-      fieldGroup: 'default',
-      label: 'User Principal (UPN) Domain',
-      type: 'string',
-    },
-    url: {
-      editType: 'string',
-      helpText:
-        'LDAP URL to connect to (default: ldap://127.0.0.1). Multiple URLs can be specified by concatenating them with commas; they will be tried in-order.',
-      fieldGroup: 'default',
-      label: 'URL',
-      type: 'string',
-    },
-    usePre111GroupCnBehavior: {
-      editType: 'boolean',
-      helpText:
-        'In Vault 1.1.1 a fix for handling group CN values of different cases unfortunately introduced a regression that could cause previously defined groups to not be found due to a change in the resulting name. If set true, the pre-1.1.1 behavior for matching group CNs will be used. This is only needed in some upgrade scenarios for backwards compatibility. It is enabled by default if the config is upgraded but disabled by default on new configurations.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    useTokenGroups: {
-      editType: 'boolean',
-      helpText:
-        'If true, use the Active Directory tokenGroups constructed attribute of the user to find the group memberships. This will find all security groups including nested ones.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    userattr: {
-      editType: 'string',
-      helpText: 'Attribute used for users (default: cn)',
-      fieldGroup: 'default',
-      defaultValue: 'cn',
-      label: 'User Attribute',
-      type: 'string',
-    },
-    userdn: {
-      editType: 'string',
-      helpText: 'LDAP domain to use for users (eg: ou=People,dc=example,dc=org)',
-      fieldGroup: 'default',
-      label: 'User DN',
-      type: 'string',
-    },
-    userfilter: {
-      editType: 'string',
-      helpText:
-        'Go template for LDAP user search filer (optional) The template can access the following context variables: UserAttr, Username Default: ({{.UserAttr}}={{.Username}})',
-      fieldGroup: 'default',
-      label: 'User Search Filter',
-      type: 'string',
-    },
-    usernameAsAlias: {
-      editType: 'boolean',
-      helpText: 'If true, sets the alias name to the username',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-  },
-  group: {
-    name: {
-      editType: 'string',
-      helpText: 'Name of the LDAP group.',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Name',
-      type: 'string',
-    },
-    policies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies associated to the group.',
-      fieldGroup: 'default',
-    },
-  },
-  user: {
-    name: {
-      editType: 'string',
-      helpText: 'Name of the LDAP user.',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Name',
-      type: 'string',
-    },
-    groups: {
-      editType: 'stringArray',
-      helpText: 'A list of additional groups associated with the user.',
-      fieldGroup: 'default',
-    },
-    policies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies associated with the user.',
-      fieldGroup: 'default',
-    },
-  },
-};
-
-const okta = {
-  'auth-config/okta': {
-    apiToken: {
-      editType: 'string',
-      helpText: 'Okta API key.',
-      fieldGroup: 'default',
-      label: 'API Token',
-      type: 'string',
-    },
-    baseUrl: {
-      editType: 'string',
-      helpText:
-        'The base domain to use for the Okta API. When not specified in the configuration, "okta.com" is used.',
-      fieldGroup: 'default',
-      label: 'Base URL',
-      type: 'string',
-    },
-    bypassOktaMfa: {
-      editType: 'boolean',
-      helpText:
-        'When set true, requests by Okta for a MFA check will be bypassed. This also disallows certain status checks on the account, such as whether the password is expired.',
-      fieldGroup: 'default',
-      label: 'Bypass Okta MFA',
-      type: 'boolean',
-    },
-    orgName: {
-      editType: 'string',
-      helpText: 'Name of the organization to be used in the Okta API.',
-      fieldGroup: 'default',
-      label: 'Organization Name',
-      type: 'string',
-    },
-    tokenBoundCidrs: {
-      editType: 'stringArray',
-      helpText:
-        'A list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Bound CIDRs",
-    },
-    tokenExplicitMaxTtl: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Explicit Maximum TTL",
-    },
-    tokenMaxTtl: {
-      editType: 'ttl',
-      helpText: 'The maximum lifetime of the generated token',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Maximum TTL",
-    },
-    tokenNoDefaultPolicy: {
-      editType: 'boolean',
-      helpText: "If true, the 'default' policy will not automatically be added to generated tokens",
-      fieldGroup: 'Tokens',
-      label: "Do Not Attach 'default' Policy To Generated Tokens",
-      type: 'boolean',
-    },
-    tokenNumUses: {
-      editType: 'number',
-      helpText: 'The maximum number of times a token may be used, a value of zero means unlimited',
-      fieldGroup: 'Tokens',
-      label: 'Maximum Uses of Generated Tokens',
-      type: 'number',
-    },
-    tokenPeriod: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h").',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Period",
-    },
-    tokenPolicies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies that will apply to the generated token for this user.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Policies",
-    },
-    tokenTtl: {
-      editType: 'ttl',
-      helpText: 'The initial ttl of the token to generate',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Initial TTL",
-    },
-    tokenType: {
-      editType: 'string',
-      helpText: 'The type of token to generate, service or batch',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Type",
-      type: 'string',
-    },
-  },
-  group: {
-    name: {
-      editType: 'string',
-      helpText: 'Name of the Okta group.',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Name',
-      type: 'string',
-    },
-    policies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies associated to the group.',
-      fieldGroup: 'default',
-    },
-  },
-  user: {
-    name: {
-      editType: 'string',
-      helpText: 'Name of the user.',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Name',
-      type: 'string',
-    },
-    groups: {
-      editType: 'stringArray',
-      helpText: 'List of groups associated with the user.',
-      fieldGroup: 'default',
-    },
-    policies: {
-      editType: 'stringArray',
-      helpText: 'List of policies associated with the user.',
-      fieldGroup: 'default',
-    },
-  },
-};
-
-const radius = {
-  'auth-config/radius': {
-    dialTimeout: {
-      editType: 'ttl',
-      helpText: 'Number of seconds before connect times out (default: 10)',
-      fieldGroup: 'default',
-      defaultValue: 10,
-    },
-    host: {
-      editType: 'string',
-      helpText: 'RADIUS server host',
-      fieldGroup: 'default',
-      label: 'Host',
-      type: 'string',
-    },
-    nasIdentifier: {
-      editType: 'string',
-      helpText: 'RADIUS NAS Identifier field (optional)',
-      fieldGroup: 'default',
-      label: 'NAS Identifier',
-      type: 'string',
-    },
-    nasPort: {
-      editType: 'number',
-      helpText: 'RADIUS NAS port field (default: 10)',
-      fieldGroup: 'default',
-      defaultValue: 10,
-      label: 'NAS Port',
-      type: 'number',
-    },
-    port: {
-      editType: 'number',
-      helpText: 'RADIUS server port (default: 1812)',
-      fieldGroup: 'default',
-      defaultValue: 1812,
-      type: 'number',
-    },
-    readTimeout: {
-      editType: 'ttl',
-      helpText: 'Number of seconds before response times out (default: 10)',
-      fieldGroup: 'default',
-      defaultValue: 10,
-    },
-    secret: {
-      editType: 'string',
-      helpText: 'Secret shared with the RADIUS server',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    tokenBoundCidrs: {
-      editType: 'stringArray',
-      helpText:
-        'A list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Bound CIDRs",
-    },
-    tokenExplicitMaxTtl: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Explicit Maximum TTL",
-    },
-    tokenMaxTtl: {
-      editType: 'ttl',
-      helpText: 'The maximum lifetime of the generated token',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Maximum TTL",
-    },
-    tokenNoDefaultPolicy: {
-      editType: 'boolean',
-      helpText: "If true, the 'default' policy will not automatically be added to generated tokens",
-      fieldGroup: 'Tokens',
-      label: "Do Not Attach 'default' Policy To Generated Tokens",
-      type: 'boolean',
-    },
-    tokenNumUses: {
-      editType: 'number',
-      helpText: 'The maximum number of times a token may be used, a value of zero means unlimited',
-      fieldGroup: 'Tokens',
-      label: 'Maximum Uses of Generated Tokens',
-      type: 'number',
-    },
-    tokenPeriod: {
-      editType: 'ttl',
-      helpText:
-        'If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h").',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Period",
-    },
-    tokenPolicies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies that will apply to the generated token for this user.',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Policies",
-    },
-    tokenTtl: {
-      editType: 'ttl',
-      helpText: 'The initial ttl of the token to generate',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Initial TTL",
-    },
-    tokenType: {
-      editType: 'string',
-      helpText: 'The type of token to generate, service or batch',
-      fieldGroup: 'Tokens',
-      label: "Generated Token's Type",
-      type: 'string',
-    },
-    unregisteredUserPolicies: {
-      editType: 'string',
-      helpText:
-        'List of policies to grant upon successful RADIUS authentication of an unregistered user (default: empty)',
-      fieldGroup: 'default',
-      label: 'Policies for unregistered users',
-      type: 'string',
-    },
-  },
-  user: {
-    name: {
-      editType: 'string',
-      helpText: 'Name of the RADIUS user.',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Name',
-      type: 'string',
-    },
-    policies: {
-      editType: 'stringArray',
-      helpText: 'A list of policies associated to the user.',
-      fieldGroup: 'default',
-    },
-  },
-};
-
-export default {
-  azure,
-  userpass,
-  cert,
-  gcp,
-  github,
-  jwt,
-  kubernetes,
-  ldap,
-  okta,
-  radius,
-  // aws is the only method that doesn't leverage OpenApi in practice
-};
diff --git a/ui/tests/helpers/openapi/secret-model-attributes.js b/ui/tests/helpers/openapi/secret-model-attributes.js
deleted file mode 100644
index bc1d8493e27..00000000000
--- a/ui/tests/helpers/openapi/secret-model-attributes.js
+++ /dev/null
@@ -1,1496 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// The constants within this file represent the expected model attributes as parsed from OpenAPI
-// if changes are made to the OpenAPI spec, that may result in changes that must be reflected
-// here AND ensured to not cause breaking changes within the UI.
-
-const ssh = {
-  'role-ssh': {
-    role: {
-      editType: 'string',
-      helpText: '[Required for all types] Name of the role being created.',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Role',
-      type: 'string',
-    },
-    algorithmSigner: {
-      editType: 'string',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] When supplied, this value specifies a signing algorithm for the key. Possible values: ssh-rsa, rsa-sha2-256, rsa-sha2-512, default, or the empty string.',
-      possibleValues: ['', 'default', 'ssh-rsa', 'rsa-sha2-256', 'rsa-sha2-512'],
-      fieldGroup: 'default',
-      label: 'Signing Algorithm',
-      type: 'string',
-    },
-    allowBareDomains: {
-      editType: 'boolean',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] If set, host certificates that are requested are allowed to use the base domains listed in "allowed_domains", e.g. "example.com". This is a separate option as in some cases this can be considered a security threat.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowHostCertificates: {
-      editType: 'boolean',
-      helpText:
-        "[Not applicable for OTP type] [Optional for CA type] If set, certificates are allowed to be signed for use as a 'host'.",
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowSubdomains: {
-      editType: 'boolean',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] If set, host certificates that are requested are allowed to use subdomains of those listed in "allowed_domains".',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowUserCertificates: {
-      editType: 'boolean',
-      helpText:
-        "[Not applicable for OTP type] [Optional for CA type] If set, certificates are allowed to be signed for use as a 'user'.",
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowUserKeyIds: {
-      editType: 'boolean',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] If true, users can override the key ID for a signed certificate with the "key_id" field. When false, the key ID will always be the token display name. The key ID is logged by the SSH server and can be useful for auditing.',
-      fieldGroup: 'default',
-      label: 'Allow User Key IDs',
-      type: 'boolean',
-    },
-    allowedCriticalOptions: {
-      editType: 'string',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] A comma-separated list of critical options that certificates can have when signed. To allow any critical options, set this to an empty string.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    allowedDomains: {
-      editType: 'string',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] If this option is not specified, client can request for a signed certificate for any valid host. If only certain domains are allowed, then this list enforces it.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    allowedDomainsTemplate: {
-      editType: 'boolean',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] If set, Allowed domains can be specified using identity template policies. Non-templated domains are also permitted.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowedExtensions: {
-      editType: 'string',
-      helpText:
-        "[Not applicable for OTP type] [Optional for CA type] A comma-separated list of extensions that certificates can have when signed. An empty list means that no extension overrides are allowed by an end-user; explicitly specify '*' to allow any extensions to be set.",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    allowedUserKeyLengths: {
-      editType: 'object',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] If set, allows the enforcement of key types and minimum key sizes to be signed.',
-      fieldGroup: 'default',
-      type: 'object',
-    },
-    allowedUsers: {
-      editType: 'string',
-      helpText:
-        "[Optional for all types] [Works differently for CA type] If this option is not specified, or is '*', client can request a credential for any valid user at the remote host, including the admin user. If only certain usernames are to be allowed, then this list enforces it. If this field is set, then credentials can only be created for default_user and usernames present in this list. Setting this option will enable all the users with access to this role to fetch credentials for all other usernames in this list. Use with caution. N.B.: with the CA type, an empty list means that no users are allowed; explicitly specify '*' to allow any user.",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    allowedUsersTemplate: {
-      editType: 'boolean',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] If set, Allowed users can be specified using identity template policies. Non-templated users are also permitted.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    cidrList: {
-      editType: 'string',
-      helpText:
-        '[Optional for OTP type] [Not applicable for CA type] Comma separated list of CIDR blocks for which the role is applicable for. CIDR blocks can belong to more than one role.',
-      fieldGroup: 'default',
-      label: 'CIDR List',
-      type: 'string',
-    },
-    defaultCriticalOptions: {
-      editType: 'object',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] Critical options certificates should have if none are provided when signing. This field takes in key value pairs in JSON format. Note that these are not restricted by "allowed_critical_options". Defaults to none.',
-      fieldGroup: 'default',
-      type: 'object',
-    },
-    defaultExtensions: {
-      editType: 'object',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] Extensions certificates should have if none are provided when signing. This field takes in key value pairs in JSON format. Note that these are not restricted by "allowed_extensions". Defaults to none.',
-      fieldGroup: 'default',
-      type: 'object',
-    },
-    defaultExtensionsTemplate: {
-      editType: 'boolean',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] If set, Default extension values can be specified using identity template policies. Non-templated extension values are also permitted.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    defaultUser: {
-      editType: 'string',
-      helpText:
-        "[Required for OTP type] [Optional for CA type] Default username for which a credential will be generated. When the endpoint 'creds/' is used without a username, this value will be used as default username.",
-      fieldGroup: 'default',
-      label: 'Default Username',
-      type: 'string',
-    },
-    defaultUserTemplate: {
-      editType: 'boolean',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] If set, Default user can be specified using identity template policies. Non-templated users are also permitted.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    excludeCidrList: {
-      editType: 'string',
-      helpText:
-        '[Optional for OTP type] [Not applicable for CA type] Comma separated list of CIDR blocks. IP addresses belonging to these blocks are not accepted by the role. This is particularly useful when big CIDR blocks are being used by the role and certain parts of it needs to be kept out.',
-      fieldGroup: 'default',
-      label: 'Exclude CIDR List',
-      type: 'string',
-    },
-    keyIdFormat: {
-      editType: 'string',
-      helpText:
-        "[Not applicable for OTP type] [Optional for CA type] When supplied, this value specifies a custom format for the key id of a signed certificate. The following variables are available for use: '{{token_display_name}}' - The display name of the token used to make the request. '{{role_name}}' - The name of the role signing the request. '{{public_key_hash}}' - A SHA256 checksum of the public key that is being signed.",
-      fieldGroup: 'default',
-      label: 'Key ID Format',
-      type: 'string',
-    },
-    keyType: {
-      editType: 'string',
-      helpText:
-        "[Required for all types] Type of key used to login to hosts. It can be either 'otp' or 'ca'. 'otp' type requires agent to be installed in remote hosts.",
-      possibleValues: ['otp', 'ca'],
-      fieldGroup: 'default',
-      defaultValue: 'ca',
-      type: 'string',
-    },
-    maxTtl: {
-      editType: 'ttl',
-      helpText: '[Not applicable for OTP type] [Optional for CA type] The maximum allowed lease duration',
-      fieldGroup: 'default',
-      label: 'Max TTL',
-    },
-    notBeforeDuration: {
-      editType: 'ttl',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] The duration that the SSH certificate should be backdated by at issuance.',
-      fieldGroup: 'default',
-      defaultValue: 30,
-      label: 'Not before duration',
-    },
-    port: {
-      editType: 'number',
-      helpText:
-        "[Optional for OTP type] [Not applicable for CA type] Port number for SSH connection. Default is '22'. Port number does not play any role in creation of OTP. For 'otp' type, this is just a way to inform client about the port number to use. Port number will be returned to client by Vault server along with OTP.",
-      fieldGroup: 'default',
-      defaultValue: 22,
-      type: 'number',
-    },
-    ttl: {
-      editType: 'ttl',
-      helpText:
-        '[Not applicable for OTP type] [Optional for CA type] The lease duration if no specific lease duration is requested. The lease duration controls the expiration of certificates issued by this backend. Defaults to the value of max_ttl.',
-      fieldGroup: 'default',
-      label: 'TTL',
-    },
-  },
-};
-
-const kmip = {
-  'kmip/config': {
-    defaultTlsClientKeyBits: {
-      editType: 'number',
-      helpText: 'Client certificate key bits, valid values depend on key type',
-      fieldGroup: 'default',
-      defaultValue: 256,
-      label: 'Default TLS Client Key bits',
-      type: 'number',
-    },
-    defaultTlsClientKeyType: {
-      editType: 'string',
-      helpText: 'Client certificate key type, rsa or ec',
-      possibleValues: ['rsa', 'ec'],
-      fieldGroup: 'default',
-      defaultValue: 'ec',
-      label: 'Default TLS Client Key type',
-      type: 'string',
-    },
-    defaultTlsClientTtl: {
-      editType: 'ttl',
-      helpText:
-        'Client certificate TTL in either an integer number of seconds (3600) or an integer time unit (1h)',
-      fieldGroup: 'default',
-      defaultValue: '336h',
-      label: 'Default TLS Client TTL',
-    },
-    listenAddrs: {
-      editType: 'stringArray',
-      helpText:
-        'A list of address:port to listen on. A bare address without port may be provided, in which case port 5696 is assumed.',
-      fieldGroup: 'default',
-      defaultValue: '127.0.0.1:5696',
-    },
-    serverHostnames: {
-      editType: 'stringArray',
-      helpText:
-        "A list of hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).",
-      fieldGroup: 'default',
-    },
-    serverIps: {
-      editType: 'stringArray',
-      helpText: "A list of IP to include in the server's TLS certificate as SAN IP addresses.",
-      fieldGroup: 'default',
-    },
-    tlsCaKeyBits: {
-      editType: 'number',
-      helpText: 'CA key bits, valid values depend on key type',
-      fieldGroup: 'default',
-      defaultValue: 256,
-      label: 'TLS CA Key bits',
-      type: 'number',
-    },
-    tlsCaKeyType: {
-      editType: 'string',
-      helpText: 'CA key type, rsa or ec',
-      possibleValues: ['rsa', 'ec'],
-      fieldGroup: 'default',
-      defaultValue: 'ec',
-      label: 'TLS CA Key type',
-      type: 'string',
-    },
-    tlsMinVersion: {
-      editType: 'string',
-      helpText: 'Min TLS version',
-      fieldGroup: 'default',
-      defaultValue: 'tls12',
-      label: 'Minimum TLS Version',
-      type: 'string',
-    },
-  },
-  'kmip/role': {
-    role: {
-      editType: 'string',
-      helpText: 'Name of the role.',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Role',
-      type: 'string',
-    },
-    operationActivate: {
-      editType: 'boolean',
-      helpText: 'Allow the "Activate" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Activate',
-      type: 'boolean',
-    },
-    operationAddAttribute: {
-      editType: 'boolean',
-      helpText: 'Allow the "Add Attribute" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Add Attribute',
-      type: 'boolean',
-    },
-    operationAll: {
-      editType: 'boolean',
-      helpText:
-        'Allow ALL operations to be performed by this role. This can be overridden if other allowed operations are set to false within the same request.',
-      fieldGroup: 'default',
-      label: 'All',
-      type: 'boolean',
-    },
-    operationCreate: {
-      editType: 'boolean',
-      helpText: 'Allow the "Create" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Create',
-      type: 'boolean',
-    },
-    operationCreateKeyPair: {
-      editType: 'boolean',
-      helpText: 'Allow the "Create Key Pair" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Create Key Pair',
-      type: 'boolean',
-    },
-    operationDecrypt: {
-      editType: 'boolean',
-      helpText: 'Allow the "Decrypt" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Decrypt',
-      type: 'boolean',
-    },
-    operationDeleteAttribute: {
-      editType: 'boolean',
-      helpText: 'Allow the "Delete Attribute" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Delete Attribute',
-      type: 'boolean',
-    },
-    operationDestroy: {
-      editType: 'boolean',
-      helpText: 'Allow the "Destroy" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Destroy',
-      type: 'boolean',
-    },
-    operationDiscoverVersions: {
-      editType: 'boolean',
-      helpText: 'Allow the "Discover Versions" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Discover Versions',
-      type: 'boolean',
-    },
-    operationEncrypt: {
-      editType: 'boolean',
-      helpText: 'Allow the "Encrypt" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Encrypt',
-      type: 'boolean',
-    },
-    operationGet: {
-      editType: 'boolean',
-      helpText: 'Allow the "Get" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Get',
-      type: 'boolean',
-    },
-    operationGetAttributeList: {
-      editType: 'boolean',
-      helpText: 'Allow the "Get Attribute List" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Get Attribute List',
-      type: 'boolean',
-    },
-    operationGetAttributes: {
-      editType: 'boolean',
-      helpText: 'Allow the "Get Attributes" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Get Attributes',
-      type: 'boolean',
-    },
-    operationImport: {
-      editType: 'boolean',
-      helpText: 'Allow the "Import" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Import',
-      type: 'boolean',
-    },
-    operationLocate: {
-      editType: 'boolean',
-      helpText: 'Allow the "Locate" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Locate',
-      type: 'boolean',
-    },
-    operationMac: {
-      editType: 'boolean',
-      helpText: 'Allow the "Mac" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Mac',
-      type: 'boolean',
-    },
-    operationMacVerify: {
-      editType: 'boolean',
-      helpText: 'Allow the "Mac Verify" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Mac Verify',
-      type: 'boolean',
-    },
-    operationModifyAttribute: {
-      editType: 'boolean',
-      helpText: 'Allow the "Modify Attribute" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Modify Attribute',
-      type: 'boolean',
-    },
-    operationNone: {
-      editType: 'boolean',
-      helpText:
-        'Allow NO operations to be performed by this role. This can be overridden if other allowed operations are set to true within the same request.',
-      fieldGroup: 'default',
-      label: 'None',
-      type: 'boolean',
-    },
-    operationQuery: {
-      editType: 'boolean',
-      helpText: 'Allow the "Query" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Query',
-      type: 'boolean',
-    },
-    operationRegister: {
-      editType: 'boolean',
-      helpText: 'Allow the "Register" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Register',
-      type: 'boolean',
-    },
-    operationRekey: {
-      editType: 'boolean',
-      helpText: 'Allow the "Rekey" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Rekey',
-      type: 'boolean',
-    },
-    operationRekeyKeyPair: {
-      editType: 'boolean',
-      helpText: 'Allow the "Rekey Key Pair" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Rekey Key Pair',
-      type: 'boolean',
-    },
-    operationRevoke: {
-      editType: 'boolean',
-      helpText: 'Allow the "Revoke" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Revoke',
-      type: 'boolean',
-    },
-    operationRngRetrieve: {
-      editType: 'boolean',
-      helpText: 'Allow the "Rng Retrieve" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Rng Retrieve',
-      type: 'boolean',
-    },
-    operationRngSeed: {
-      editType: 'boolean',
-      helpText: 'Allow the "Rng Seed" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Rng Seed',
-      type: 'boolean',
-    },
-    operationSign: {
-      editType: 'boolean',
-      helpText: 'Allow the "Sign" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Sign',
-      type: 'boolean',
-    },
-    operationSignatureVerify: {
-      editType: 'boolean',
-      helpText: 'Allow the "Signature Verify" operation to be performed by this role',
-      fieldGroup: 'default',
-      label: 'Signature Verify',
-      type: 'boolean',
-    },
-    tlsClientKeyBits: {
-      editType: 'number',
-      helpText: 'Client certificate key bits, valid values depend on key type',
-      fieldGroup: 'default',
-      defaultValue: 521,
-      label: 'TLS Client Key bits',
-      type: 'number',
-    },
-    tlsClientKeyType: {
-      editType: 'string',
-      helpText: 'Client certificate key type, rsa or ec',
-      possibleValues: ['rsa', 'ec'],
-      fieldGroup: 'default',
-      defaultValue: 'ec',
-      label: 'TLS Client Key type',
-      type: 'string',
-    },
-    tlsClientTtl: {
-      editType: 'ttl',
-      helpText:
-        'Client certificate TTL in either an integer number of seconds (10) or an integer time unit (10s)',
-      fieldGroup: 'default',
-      defaultValue: '86400',
-      label: 'TLS Client TTL',
-    },
-  },
-};
-
-const pki = {
-  'pki/config/acme': {
-    allowRoleExtKeyUsage: {
-      editType: 'boolean',
-      helpText:
-        'whether the ExtKeyUsage field from a role is used, defaults to false meaning that certificate will be signed with ServerAuth.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowedIssuers: {
-      editType: 'stringArray',
-      helpText:
-        'which issuers are allowed for use with ACME; by default, this will only be the primary (default) issuer',
-      fieldGroup: 'default',
-    },
-    allowedRoles: {
-      editType: 'stringArray',
-      helpText:
-        "which roles are allowed for use with ACME; by default via '*', these will be all roles including sign-verbatim; when concrete role names are specified, any default_directory_policy role must be included to allow usage of the default acme directories under /pki/acme/directory and /pki/issuer/:issuer_id/acme/directory.",
-      fieldGroup: 'default',
-    },
-    defaultDirectoryPolicy: {
-      editType: 'string',
-      helpText:
-        'the policy to be used for non-role-qualified ACME requests; by default ACME issuance will be otherwise unrestricted, equivalent to the sign-verbatim endpoint; one may also specify a role to use as this policy, as "role:<role_name>", the specified role must be allowed by allowed_roles',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    dnsResolver: {
-      editType: 'string',
-      helpText:
-        'DNS resolver to use for domain resolution on this mount. Defaults to using the default system resolver. Must be in the format <host>:<port>, with both parts mandatory.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    eabPolicy: {
-      editType: 'string',
-      helpText:
-        "Specify the policy to use for external account binding behaviour, 'not-required', 'new-account-required' or 'always-required'",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    enabled: {
-      editType: 'boolean',
-      helpText:
-        'whether ACME is enabled, defaults to false meaning that clusters will by default not get ACME support',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-  },
-  'pki/certificate/generate': {
-    role: {
-      editType: 'string',
-      helpText: 'The desired role with configuration for this request',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Role',
-      type: 'string',
-    },
-    altNames: {
-      editType: 'string',
-      helpText:
-        'The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses.',
-      fieldGroup: 'default',
-      label: 'DNS/Email Subject Alternative Names (SANs)',
-      type: 'string',
-    },
-    commonName: {
-      editType: 'string',
-      helpText:
-        'The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    excludeCnFromSans: {
-      editType: 'boolean',
-      helpText:
-        'If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).',
-      fieldGroup: 'default',
-      label: 'Exclude Common Name from Subject Alternative Names (SANs)',
-      type: 'boolean',
-    },
-    format: {
-      editType: 'string',
-      helpText:
-        'Format for returned data. Can be "pem", "der", or "pem_bundle". If "pem_bundle", any private key and issuing cert will be appended to the certificate pem. If "der", the value will be base64 encoded. Defaults to "pem".',
-      possibleValues: ['pem', 'der', 'pem_bundle'],
-      fieldGroup: 'default',
-      defaultValue: 'pem',
-      type: 'string',
-    },
-    ipSans: {
-      editType: 'stringArray',
-      helpText: 'The requested IP SANs, if any, in a comma-delimited list',
-      fieldGroup: 'default',
-      label: 'IP Subject Alternative Names (SANs)',
-    },
-    issuerRef: {
-      editType: 'string',
-      helpText:
-        'Reference to a existing issuer; either "default" for the configured default issuer, an identifier or the name assigned to the issuer.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    notAfter: {
-      editType: 'string',
-      helpText:
-        'Set the not after field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    otherSans: {
-      editType: 'stringArray',
-      helpText:
-        'Requested other SANs, in an array with the format <oid>;UTF8:<utf8 string value> for each entry.',
-      fieldGroup: 'default',
-      label: 'Other SANs',
-    },
-    privateKeyFormat: {
-      editType: 'string',
-      helpText:
-        'Format for the returned private key. Generally the default will be controlled by the "format" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to "pkcs8" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to "der".',
-      possibleValues: ['', 'der', 'pem', 'pkcs8'],
-      fieldGroup: 'default',
-      defaultValue: 'der',
-      type: 'string',
-    },
-    removeRootsFromChain: {
-      editType: 'boolean',
-      helpText: 'Whether or not to remove self-signed CA certificates in the output of the ca_chain field.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    serialNumber: {
-      editType: 'string',
-      helpText:
-        "The Subject's requested serial number, if any. See RFC 4519 Section 2.31 'serialNumber' for a description of this field. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5. This has no impact on the final certificate's Serial Number field.",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    ttl: {
-      editType: 'ttl',
-      helpText:
-        'The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL.',
-      fieldGroup: 'default',
-      label: 'TTL',
-    },
-    uriSans: {
-      editType: 'stringArray',
-      helpText: 'The requested URI SANs, if any, in a comma-delimited list.',
-      fieldGroup: 'default',
-      label: 'URI Subject Alternative Names (SANs)',
-    },
-    userIds: {
-      editType: 'stringArray',
-      helpText:
-        'The requested user_ids value to place in the subject, if any, in a comma-delimited list. Restricted by allowed_user_ids. Any values are added with OID 0.9.2342.19200300.100.1.1.',
-      fieldGroup: 'default',
-      label: 'User ID(s)',
-    },
-  },
-  'pki/certificate/sign': {
-    role: {
-      editType: 'string',
-      helpText: 'The desired role with configuration for this request',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Role',
-      type: 'string',
-    },
-    altNames: {
-      editType: 'string',
-      helpText:
-        'The requested Subject Alternative Names, if any, in a comma-delimited list. If email protection is enabled for the role, this may contain email addresses.',
-      fieldGroup: 'default',
-      label: 'DNS/Email Subject Alternative Names (SANs)',
-      type: 'string',
-    },
-    commonName: {
-      editType: 'string',
-      helpText:
-        'The requested common name; if you want more than one, specify the alternative names in the alt_names map. If email protection is enabled in the role, this may be an email address.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    csr: {
-      editType: 'string',
-      helpText: 'PEM-format CSR to be signed.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    excludeCnFromSans: {
-      editType: 'boolean',
-      helpText:
-        'If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).',
-      fieldGroup: 'default',
-      label: 'Exclude Common Name from Subject Alternative Names (SANs)',
-      type: 'boolean',
-    },
-    format: {
-      editType: 'string',
-      helpText:
-        'Format for returned data. Can be "pem", "der", or "pem_bundle". If "pem_bundle", any private key and issuing cert will be appended to the certificate pem. If "der", the value will be base64 encoded. Defaults to "pem".',
-      possibleValues: ['pem', 'der', 'pem_bundle'],
-      fieldGroup: 'default',
-      defaultValue: 'pem',
-      type: 'string',
-    },
-    ipSans: {
-      editType: 'stringArray',
-      helpText: 'The requested IP SANs, if any, in a comma-delimited list',
-      fieldGroup: 'default',
-      label: 'IP Subject Alternative Names (SANs)',
-    },
-    issuerRef: {
-      editType: 'string',
-      helpText:
-        'Reference to a existing issuer; either "default" for the configured default issuer, an identifier or the name assigned to the issuer.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    notAfter: {
-      editType: 'string',
-      helpText:
-        'Set the not after field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    otherSans: {
-      editType: 'stringArray',
-      helpText:
-        'Requested other SANs, in an array with the format <oid>;UTF8:<utf8 string value> for each entry.',
-      fieldGroup: 'default',
-      label: 'Other SANs',
-    },
-    privateKeyFormat: {
-      editType: 'string',
-      helpText:
-        'Format for the returned private key. Generally the default will be controlled by the "format" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to "pkcs8" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to "der".',
-      possibleValues: ['', 'der', 'pem', 'pkcs8'],
-      fieldGroup: 'default',
-      defaultValue: 'der',
-      type: 'string',
-    },
-    removeRootsFromChain: {
-      editType: 'boolean',
-      helpText: 'Whether or not to remove self-signed CA certificates in the output of the ca_chain field.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    serialNumber: {
-      editType: 'string',
-      helpText:
-        "The Subject's requested serial number, if any. See RFC 4519 Section 2.31 'serialNumber' for a description of this field. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5. This has no impact on the final certificate's Serial Number field.",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    ttl: {
-      editType: 'ttl',
-      helpText:
-        'The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the role max TTL.',
-      fieldGroup: 'default',
-      label: 'TTL',
-    },
-    uriSans: {
-      editType: 'stringArray',
-      helpText: 'The requested URI SANs, if any, in a comma-delimited list.',
-      fieldGroup: 'default',
-      label: 'URI Subject Alternative Names (SANs)',
-    },
-    userIds: {
-      editType: 'stringArray',
-      helpText:
-        'The requested user_ids value to place in the subject, if any, in a comma-delimited list. Restricted by allowed_user_ids. Any values are added with OID 0.9.2342.19200300.100.1.1.',
-      fieldGroup: 'default',
-      label: 'User ID(s)',
-    },
-  },
-  'pki/config/cluster': {
-    aiaPath: {
-      editType: 'string',
-      helpText:
-        "Optional URI to this mount's AIA distribution point; may refer to an external non-Vault responder. This is for resolving AIA URLs and providing the {{cluster_aia_path}} template parameter and will not be used for other purposes. As such, unlike path above, this could safely be an insecure transit mechanism (like HTTP without TLS). For example: http://cdn.example.com/pr1/pki",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    path: {
-      editType: 'string',
-      helpText:
-        "Canonical URI to this mount on this performance replication cluster's external address. This is for resolving AIA URLs and providing the {{cluster_path}} template parameter but might be used for other purposes in the future. This should only point back to this particular PR replica and should not ever point to another PR cluster. It may point to any node in the PR replica, including standby nodes, and need not always point to the active node. For example: https://pr1.vault.example.com:8200/v1/pki",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-  },
-  'pki/role': {
-    name: {
-      editType: 'string',
-      helpText: 'Name of the role',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Name',
-      type: 'string',
-    },
-    allowAnyName: {
-      editType: 'boolean',
-      helpText:
-        'If set, clients can request certificates for any domain, regardless of allowed_domains restrictions. See the documentation for more information.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowBareDomains: {
-      editType: 'boolean',
-      helpText:
-        'If set, clients can request certificates for the base domains themselves, e.g. "example.com" of domains listed in allowed_domains. This is a separate option as in some cases this can be considered a security threat. See the documentation for more information.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowGlobDomains: {
-      editType: 'boolean',
-      helpText:
-        'If set, domains specified in allowed_domains can include shell-style glob patterns, e.g. "ftp*.example.com". See the documentation for more information.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowIpSans: {
-      editType: 'boolean',
-      helpText:
-        'If set, IP Subject Alternative Names are allowed. Any valid IP is accepted and No authorization checking is performed.',
-      fieldGroup: 'default',
-      defaultValue: true,
-      label: 'Allow IP Subject Alternative Names',
-      type: 'boolean',
-    },
-    allowLocalhost: {
-      editType: 'boolean',
-      helpText:
-        'Whether to allow "localhost" and "localdomain" as a valid common name in a request, independent of allowed_domains value.',
-      fieldGroup: 'default',
-      defaultValue: true,
-      type: 'boolean',
-    },
-    allowSubdomains: {
-      editType: 'boolean',
-      helpText:
-        'If set, clients can request certificates for subdomains of domains listed in allowed_domains, including wildcard subdomains. See the documentation for more information.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowWildcardCertificates: {
-      editType: 'boolean',
-      helpText:
-        'If set, allows certificates with wildcards in the common name to be issued, conforming to RFC 6125\'s Section 6.4.3; e.g., "*.example.net" or "b*z.example.net". See the documentation for more information.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowedDomains: {
-      editType: 'stringArray',
-      helpText:
-        'Specifies the domains this role is allowed to issue certificates for. This is used with the allow_bare_domains, allow_subdomains, and allow_glob_domains to determine matches for the common name, DNS-typed SAN entries, and Email-typed SAN entries of certificates. See the documentation for more information. This parameter accepts a comma-separated string or list of domains.',
-      fieldGroup: 'default',
-    },
-    allowedDomainsTemplate: {
-      editType: 'boolean',
-      helpText:
-        'If set, Allowed domains can be specified using identity template policies. Non-templated domains are also permitted.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowedOtherSans: {
-      editType: 'stringArray',
-      helpText:
-        'If set, an array of allowed other names to put in SANs. These values support globbing and must be in the format <oid>;<type>:<value>. Currently only "utf8" is a valid type. All values, including globbing values, must use this syntax, with the exception being a single "*" which allows any OID and any value (but type must still be utf8).',
-      fieldGroup: 'default',
-      label: 'Allowed Other Subject Alternative Names',
-    },
-    allowedSerialNumbers: {
-      editType: 'stringArray',
-      helpText:
-        'If set, an array of allowed serial numbers to put in Subject. These values support globbing.',
-      fieldGroup: 'default',
-    },
-    allowedUriSans: {
-      editType: 'stringArray',
-      helpText:
-        'If set, an array of allowed URIs for URI Subject Alternative Names. Any valid URI is accepted, these values support globbing.',
-      fieldGroup: 'default',
-      label: 'Allowed URI Subject Alternative Names',
-    },
-    allowedUriSansTemplate: {
-      editType: 'boolean',
-      helpText:
-        'If set, Allowed URI SANs can be specified using identity template policies. Non-templated URI SANs are also permitted.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    allowedUserIds: {
-      editType: 'stringArray',
-      helpText:
-        'If set, an array of allowed user-ids to put in user system login name specified here: https://www.rfc-editor.org/rfc/rfc1274#section-9.3.1',
-      fieldGroup: 'default',
-    },
-    backend: {
-      editType: 'string',
-      helpText: 'Backend Type',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    basicConstraintsValidForNonCa: {
-      editType: 'boolean',
-      helpText: 'Mark Basic Constraints valid when issuing non-CA certificates.',
-      fieldGroup: 'default',
-      label: 'Basic Constraints Valid for Non-CA',
-      type: 'boolean',
-    },
-    clientFlag: {
-      editType: 'boolean',
-      helpText:
-        'If set, certificates are flagged for client auth use. Defaults to true. See also RFC 5280 Section 4.2.1.12.',
-      fieldGroup: 'default',
-      defaultValue: true,
-      type: 'boolean',
-    },
-    cnValidations: {
-      editType: 'stringArray',
-      helpText:
-        "List of allowed validations to run against the Common Name field. Values can include 'email' to validate the CN is a email address, 'hostname' to validate the CN is a valid hostname (potentially including wildcards). When multiple validations are specified, these take OR semantics (either email OR hostname are allowed). The special value 'disabled' allows disabling all CN name validations, allowing for arbitrary non-Hostname, non-Email address CNs.",
-      fieldGroup: 'default',
-      label: 'Common Name Validations',
-    },
-    codeSigningFlag: {
-      editType: 'boolean',
-      helpText:
-        'If set, certificates are flagged for code signing use. Defaults to false. See also RFC 5280 Section 4.2.1.12.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    country: {
-      editType: 'stringArray',
-      helpText: 'If set, Country will be set to this value in certificates issued by this role.',
-      fieldGroup: 'default',
-    },
-    emailProtectionFlag: {
-      editType: 'boolean',
-      helpText:
-        'If set, certificates are flagged for email protection use. Defaults to false. See also RFC 5280 Section 4.2.1.12.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    enforceHostnames: {
-      editType: 'boolean',
-      helpText:
-        'If set, only valid host names are allowed for CN and DNS SANs, and the host part of email addresses. Defaults to true.',
-      fieldGroup: 'default',
-      defaultValue: true,
-      type: 'boolean',
-    },
-    extKeyUsage: {
-      editType: 'stringArray',
-      helpText:
-        'A comma-separated string or list of extended key usages. Valid values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage -- simply drop the "ExtKeyUsage" part of the name. To remove all key usages from being set, set this value to an empty list. See also RFC 5280 Section 4.2.1.12.',
-      fieldGroup: 'default',
-      label: 'Extended Key Usage',
-    },
-    extKeyUsageOids: {
-      editType: 'stringArray',
-      helpText: 'A comma-separated string or list of extended key usage oids.',
-      fieldGroup: 'default',
-      label: 'Extended Key Usage OIDs',
-    },
-    generateLease: {
-      editType: 'boolean',
-      helpText:
-        'If set, certificates issued/signed against this role will have Vault leases attached to them. Defaults to "false". Certificates can be added to the CRL by "vault revoke <lease_id>" when certificates are associated with leases. It can also be done using the "pki/revoke" endpoint. However, when lease generation is disabled, invoking "pki/revoke" would be the only way to add the certificates to the CRL. When large number of certificates are generated with long lifetimes, it is recommended that lease generation be disabled, as large amount of leases adversely affect the startup time of Vault.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    issuerRef: {
-      editType: 'string',
-      helpText: 'Reference to the issuer used to sign requests serviced by this role.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    keyBits: {
-      editType: 'number',
-      helpText:
-        'The number of bits to use. Allowed values are 0 (universal default); with rsa key_type: 2048 (default), 3072, or 4096; with ec key_type: 224, 256 (default), 384, or 521; ignored with ed25519.',
-      fieldGroup: 'default',
-      type: 'number',
-    },
-    keyType: {
-      editType: 'string',
-      helpText:
-        'The type of key to use; defaults to RSA. "rsa" "ec", "ed25519" and "any" are the only valid values.',
-      possibleValues: ['rsa', 'ec', 'ed25519', 'any'],
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    keyUsage: {
-      editType: 'stringArray',
-      helpText:
-        'A comma-separated string or list of key usages (not extended key usages). Valid values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage -- simply drop the "KeyUsage" part of the name. To remove all key usages from being set, set this value to an empty list. See also RFC 5280 Section 4.2.1.3.',
-      fieldGroup: 'default',
-      defaultValue: 'DigitalSignature,KeyAgreement,KeyEncipherment',
-    },
-    locality: {
-      editType: 'stringArray',
-      helpText: 'If set, Locality will be set to this value in certificates issued by this role.',
-      fieldGroup: 'default',
-      label: 'Locality/City',
-    },
-    maxTtl: {
-      editType: 'ttl',
-      helpText: 'The maximum allowed lease duration. If not set, defaults to the system maximum lease TTL.',
-      fieldGroup: 'default',
-      label: 'Max TTL',
-    },
-    noStore: {
-      editType: 'boolean',
-      helpText:
-        'If set, certificates issued/signed against this role will not be stored in the storage backend. This can improve performance when issuing large numbers of certificates. However, certificates issued in this way cannot be enumerated or revoked, so this option is recommended only for certificates that are non-sensitive, or extremely short-lived. This option implies a value of "false" for "generate_lease".',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    notAfter: {
-      editType: 'string',
-      helpText:
-        'Set the not after field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    notBeforeDuration: {
-      editType: 'ttl',
-      helpText: 'The duration before now which the certificate needs to be backdated by.',
-      fieldGroup: 'default',
-      defaultValue: 30,
-    },
-    organization: {
-      editType: 'stringArray',
-      helpText: 'If set, O (Organization) will be set to this value in certificates issued by this role.',
-      fieldGroup: 'default',
-    },
-    ou: {
-      editType: 'stringArray',
-      helpText:
-        'If set, OU (OrganizationalUnit) will be set to this value in certificates issued by this role.',
-      fieldGroup: 'default',
-      label: 'Organizational Unit',
-    },
-    policyIdentifiers: {
-      editType: 'stringArray',
-      helpText:
-        'A comma-separated string or list of policy OIDs, or a JSON list of qualified policy information, which must include an oid, and may include a notice and/or cps url, using the form [{"oid"="1.3.6.1.4.1.7.8","notice"="I am a user Notice"}, {"oid"="1.3.6.1.4.1.44947.1.2.4 ","cps"="https://example.com"}].',
-      fieldGroup: 'default',
-    },
-    postalCode: {
-      editType: 'stringArray',
-      helpText: 'If set, Postal Code will be set to this value in certificates issued by this role.',
-      fieldGroup: 'default',
-    },
-    province: {
-      editType: 'stringArray',
-      helpText: 'If set, Province will be set to this value in certificates issued by this role.',
-      fieldGroup: 'default',
-      label: 'Province/State',
-    },
-    requireCn: {
-      editType: 'boolean',
-      helpText: "If set to false, makes the 'common_name' field optional while generating a certificate.",
-      fieldGroup: 'default',
-      label: 'Require Common Name',
-      type: 'boolean',
-    },
-    serverFlag: {
-      editType: 'boolean',
-      helpText:
-        'If set, certificates are flagged for server auth use. Defaults to true. See also RFC 5280 Section 4.2.1.12.',
-      fieldGroup: 'default',
-      defaultValue: true,
-      type: 'boolean',
-    },
-    signatureBits: {
-      editType: 'number',
-      helpText:
-        'The number of bits to use in the signature algorithm; accepts 256 for SHA-2-256, 384 for SHA-2-384, and 512 for SHA-2-512. Defaults to 0 to automatically detect based on key length (SHA-2-256 for RSA keys, and matching the curve size for NIST P-Curves).',
-      fieldGroup: 'default',
-      type: 'number',
-    },
-    streetAddress: {
-      editType: 'stringArray',
-      helpText: 'If set, Street Address will be set to this value in certificates issued by this role.',
-      fieldGroup: 'default',
-    },
-    ttl: {
-      editType: 'ttl',
-      helpText:
-        'The lease duration (validity period of the certificate) if no specific lease duration is requested. The lease duration controls the expiration of certificates issued by this backend. Defaults to the system default value or the value of max_ttl, whichever is shorter.',
-      fieldGroup: 'default',
-      label: 'TTL',
-    },
-    useCsrCommonName: {
-      editType: 'boolean',
-      helpText:
-        'If set, when used with a signing profile, the common name in the CSR will be used. This does *not* include any requested Subject Alternative Names; use use_csr_sans for that. Defaults to true.',
-      fieldGroup: 'default',
-      defaultValue: true,
-      label: 'Use CSR Common Name',
-      type: 'boolean',
-    },
-    useCsrSans: {
-      editType: 'boolean',
-      helpText:
-        'If set, when used with a signing profile, the SANs in the CSR will be used. This does *not* include the Common Name (cn); use use_csr_common_name for that. Defaults to true.',
-      fieldGroup: 'default',
-      defaultValue: true,
-      label: 'Use CSR Subject Alternative Names',
-      type: 'boolean',
-    },
-    usePss: {
-      editType: 'boolean',
-      helpText: 'Whether or not to use PSS signatures when using a RSA key-type issuer. Defaults to false.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-  },
-  'pki/sign-intermediate': {
-    issuerRef: {
-      editType: 'string',
-      helpText:
-        'Reference to a existing issuer; either "default" for the configured default issuer, an identifier or the name assigned to the issuer.',
-      fieldValue: 'mutableId',
-      fieldGroup: 'default',
-      readOnly: true,
-      label: 'Issuer ref',
-      type: 'string',
-    },
-    altNames: {
-      editType: 'string',
-      helpText:
-        'The requested Subject Alternative Names, if any, in a comma-delimited list. May contain both DNS names and email addresses.',
-      fieldGroup: 'default',
-      label: 'DNS/Email Subject Alternative Names (SANs)',
-      type: 'string',
-    },
-    commonName: {
-      editType: 'string',
-      helpText:
-        'The requested common name; if you want more than one, specify the alternative names in the alt_names map. If not specified when signing, the common name will be taken from the CSR; other names must still be specified in alt_names or ip_sans.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    country: {
-      editType: 'stringArray',
-      helpText: 'If set, Country will be set to this value.',
-      fieldGroup: 'default',
-    },
-    csr: {
-      editType: 'string',
-      helpText: 'PEM-format CSR to be signed.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    excludeCnFromSans: {
-      editType: 'boolean',
-      helpText:
-        'If true, the Common Name will not be included in DNS or Email Subject Alternate Names. Defaults to false (CN is included).',
-      fieldGroup: 'default',
-      label: 'Exclude Common Name from Subject Alternative Names (SANs)',
-      type: 'boolean',
-    },
-    format: {
-      editType: 'string',
-      helpText:
-        'Format for returned data. Can be "pem", "der", or "pem_bundle". If "pem_bundle", any private key and issuing cert will be appended to the certificate pem. If "der", the value will be base64 encoded. Defaults to "pem".',
-      possibleValues: ['pem', 'der', 'pem_bundle'],
-      fieldGroup: 'default',
-      defaultValue: 'pem',
-      type: 'string',
-    },
-    ipSans: {
-      editType: 'stringArray',
-      helpText: 'The requested IP SANs, if any, in a comma-delimited list',
-      fieldGroup: 'default',
-      label: 'IP Subject Alternative Names (SANs)',
-    },
-    issuerName: {
-      editType: 'string',
-      helpText:
-        "Provide a name to the generated or existing issuer, the name must be unique across all issuers and not be the reserved value 'default'",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    locality: {
-      editType: 'stringArray',
-      helpText: 'If set, Locality will be set to this value.',
-      fieldGroup: 'default',
-      label: 'Locality/City',
-    },
-    maxPathLength: {
-      editType: 'number',
-      helpText: 'The maximum allowable path length',
-      fieldGroup: 'default',
-      type: 'number',
-    },
-    notAfter: {
-      editType: 'string',
-      helpText:
-        'Set the not after field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    notBeforeDuration: {
-      editType: 'ttl',
-      helpText: 'The duration before now which the certificate needs to be backdated by.',
-      fieldGroup: 'default',
-      defaultValue: 30,
-    },
-    organization: {
-      editType: 'stringArray',
-      helpText: 'If set, O (Organization) will be set to this value.',
-      fieldGroup: 'default',
-    },
-    otherSans: {
-      editType: 'stringArray',
-      helpText:
-        'Requested other SANs, in an array with the format <oid>;UTF8:<utf8 string value> for each entry.',
-      fieldGroup: 'default',
-      label: 'Other SANs',
-    },
-    ou: {
-      editType: 'stringArray',
-      helpText: 'If set, OU (OrganizationalUnit) will be set to this value.',
-      fieldGroup: 'default',
-      label: 'OU (Organizational Unit)',
-    },
-    permittedDnsDomains: {
-      editType: 'stringArray',
-      helpText:
-        'Domains for which this certificate is allowed to sign or issue child certificates. If set, all DNS names (subject and alt) on child certs must be exact matches or subsets of the given domains (see https://tools.ietf.org/html/rfc5280#section-4.2.1.10).',
-      fieldGroup: 'default',
-      label: 'Permitted DNS Domains',
-    },
-    postalCode: {
-      editType: 'stringArray',
-      helpText: 'If set, Postal Code will be set to this value.',
-      fieldGroup: 'default',
-      label: 'Postal Code',
-    },
-    privateKeyFormat: {
-      editType: 'string',
-      helpText:
-        'Format for the returned private key. Generally the default will be controlled by the "format" parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to "pkcs8" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Defaults to "der".',
-      possibleValues: ['', 'der', 'pem', 'pkcs8'],
-      fieldGroup: 'default',
-      defaultValue: 'der',
-      type: 'string',
-    },
-    province: {
-      editType: 'stringArray',
-      helpText: 'If set, Province will be set to this value.',
-      fieldGroup: 'default',
-      label: 'Province/State',
-    },
-    serialNumber: {
-      editType: 'string',
-      helpText:
-        "The Subject's requested serial number, if any. See RFC 4519 Section 2.31 'serialNumber' for a description of this field. If you want more than one, specify alternative names in the alt_names map using OID 2.5.4.5. This has no impact on the final certificate's Serial Number field.",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    signatureBits: {
-      editType: 'number',
-      helpText:
-        'The number of bits to use in the signature algorithm; accepts 256 for SHA-2-256, 384 for SHA-2-384, and 512 for SHA-2-512. Defaults to 0 to automatically detect based on key length (SHA-2-256 for RSA keys, and matching the curve size for NIST P-Curves).',
-      fieldGroup: 'default',
-      type: 'number',
-    },
-    skid: {
-      editType: 'string',
-      helpText:
-        "Value for the Subject Key Identifier field (RFC 5280 Section 4.2.1.2). This value should ONLY be used when cross-signing to mimic the existing certificate's SKID value; this is necessary to allow certain TLS implementations (such as OpenSSL) which use SKID/AKID matches in chain building to restrict possible valid chains. Specified as a string in hex format. Default is empty, allowing Vault to automatically calculate the SKID according to method one in the above RFC section.",
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    streetAddress: {
-      editType: 'stringArray',
-      helpText: 'If set, Street Address will be set to this value.',
-      fieldGroup: 'default',
-      label: 'Street Address',
-    },
-    ttl: {
-      editType: 'ttl',
-      helpText:
-        'The requested Time To Live for the certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA.',
-      fieldGroup: 'default',
-      label: 'TTL',
-    },
-    uriSans: {
-      editType: 'stringArray',
-      helpText: 'The requested URI SANs, if any, in a comma-delimited list.',
-      fieldGroup: 'default',
-      label: 'URI Subject Alternative Names (SANs)',
-    },
-    useCsrValues: {
-      editType: 'boolean',
-      helpText:
-        'If true, then: 1) Subject information, including names and alternate names, will be preserved from the CSR rather than using values provided in the other parameters to this path; 2) Any key usages requested in the CSR will be added to the basic set of key usages used for CA certs signed by this path; for instance, the non-repudiation flag; 3) Extensions requested in the CSR will be copied into the issued certificate.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    usePss: {
-      editType: 'boolean',
-      helpText: 'Whether or not to use PSS signatures when using a RSA key-type issuer. Defaults to false.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-  },
-  'pki/tidy': {
-    acmeAccountSafetyBuffer: {
-      editType: 'ttl',
-      helpText:
-        'The amount of time that must pass after creation that an account with no orders is marked revoked, and the amount of time after being marked revoked or deactivated.',
-      fieldGroup: 'default',
-    },
-    enabled: {
-      editType: 'boolean',
-      helpText: 'Set to true to enable automatic tidy operations.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    intervalDuration: {
-      editType: 'ttl',
-      helpText:
-        'Interval at which to run an auto-tidy operation. This is the time between tidy invocations (after one finishes to the start of the next). Running a manual tidy will reset this duration.',
-      fieldGroup: 'default',
-    },
-    issuerSafetyBuffer: {
-      editType: 'ttl',
-      helpText:
-        "The amount of extra time that must have passed beyond issuer's expiration before it is removed from the backend storage. Defaults to 8760 hours (1 year).",
-      fieldGroup: 'default',
-    },
-    maintainStoredCertificateCounts: {
-      editType: 'boolean',
-      helpText:
-        'This configures whether stored certificates are counted upon initialization of the backend, and whether during normal operation, a running count of certificates stored is maintained.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    pauseDuration: {
-      editType: 'string',
-      helpText:
-        'The amount of time to wait between processing certificates. This allows operators to change the execution profile of tidy to take consume less resources by slowing down how long it takes to run. Note that the entire list of certificates will be stored in memory during the entire tidy operation, but resources to read/process/update existing entries will be spread out over a greater period of time. By default this is zero seconds.',
-      fieldGroup: 'default',
-      type: 'string',
-    },
-    publishStoredCertificateCountMetrics: {
-      editType: 'boolean',
-      helpText:
-        'This configures whether the stored certificate count is published to the metrics consumer. It does not affect if the stored certificate count is maintained, and if maintained, it will be available on the tidy-status endpoint.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    revocationQueueSafetyBuffer: {
-      editType: 'ttl',
-      helpText:
-        'The amount of time that must pass from the cross-cluster revocation request being initiated to when it will be slated for removal. Setting this too low may remove valid revocation requests before the owning cluster has a chance to process them, especially if the cluster is offline.',
-      fieldGroup: 'default',
-    },
-    safetyBuffer: {
-      editType: 'ttl',
-      helpText:
-        'The amount of extra time that must have passed beyond certificate expiration before it is removed from the backend storage and/or revocation list. Defaults to 72 hours.',
-      fieldGroup: 'default',
-    },
-    tidyAcme: {
-      editType: 'boolean',
-      helpText:
-        'Set to true to enable tidying ACME accounts, orders and authorizations. ACME orders are tidied (deleted) safety_buffer after the certificate associated with them expires, or after the order and relevant authorizations have expired if no certificate was produced. Authorizations are tidied with the corresponding order. When a valid ACME Account is at least acme_account_safety_buffer old, and has no remaining orders associated with it, the account is marked as revoked. After another acme_account_safety_buffer has passed from the revocation or deactivation date, a revoked or deactivated ACME account is deleted.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    tidyCertStore: {
-      editType: 'boolean',
-      helpText: 'Set to true to enable tidying up the certificate store',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    tidyCrossClusterRevokedCerts: {
-      editType: 'boolean',
-      helpText:
-        'Set to true to enable tidying up the cross-cluster revoked certificate store. Only runs on the active primary node.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    tidyExpiredIssuers: {
-      editType: 'boolean',
-      helpText:
-        'Set to true to automatically remove expired issuers past the issuer_safety_buffer. No keys will be removed as part of this operation.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    tidyMoveLegacyCaBundle: {
-      editType: 'boolean',
-      helpText:
-        'Set to true to move the legacy ca_bundle from /config/ca_bundle to /config/ca_bundle.bak. This prevents downgrades to pre-Vault 1.11 versions (as older PKI engines do not know about the new multi-issuer storage layout), but improves the performance on seal wrapped PKI mounts. This will only occur if at least issuer_safety_buffer time has occurred after the initial storage migration. This backup is saved in case of an issue in future migrations. Operators may consider removing it via sys/raw if they desire. The backup will be removed via a DELETE /root call, but note that this removes ALL issuers within the mount (and is thus not desirable in most operational scenarios).',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    tidyRevocationList: {
-      editType: 'boolean',
-      helpText: "Deprecated; synonym for 'tidy_revoked_certs",
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    tidyRevocationQueue: {
-      editType: 'boolean',
-      helpText:
-        "Set to true to remove stale revocation queue entries that haven't been confirmed by any active cluster. Only runs on the active primary node",
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    tidyRevokedCertIssuerAssociations: {
-      editType: 'boolean',
-      helpText:
-        'Set to true to validate issuer associations on revocation entries. This helps increase the performance of CRL building and OCSP responses.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    tidyRevokedCerts: {
-      editType: 'boolean',
-      helpText:
-        'Set to true to expire all revoked and expired certificates, removing them both from the CRL and from storage. The CRL will be rotated if this causes any values to be removed.',
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-  },
-  'pki/config/urls': {
-    crlDistributionPoints: {
-      editType: 'stringArray',
-      helpText:
-        'Comma-separated list of URLs to be used for the CRL distribution points attribute. See also RFC 5280 Section 4.2.1.13.',
-      fieldGroup: 'default',
-    },
-    enableTemplating: {
-      editType: 'boolean',
-      helpText:
-        "Whether or not to enabling templating of the above AIA fields. When templating is enabled the special values '{{issuer_id}}', '{{cluster_path}}', and '{{cluster_aia_path}}' are available, but the addresses are not checked for URI validity until issuance time. Using '{{cluster_path}}' requires /config/cluster's 'path' member to be set on all PR Secondary clusters and using '{{cluster_aia_path}}' requires /config/cluster's 'aia_path' member to be set on all PR secondary clusters.",
-      fieldGroup: 'default',
-      type: 'boolean',
-    },
-    issuingCertificates: {
-      editType: 'stringArray',
-      helpText:
-        'Comma-separated list of URLs to be used for the issuing certificate attribute. See also RFC 5280 Section 4.2.2.1.',
-      fieldGroup: 'default',
-    },
-    ocspServers: {
-      editType: 'stringArray',
-      helpText:
-        'Comma-separated list of URLs to be used for the OCSP servers attribute. See also RFC 5280 Section 4.2.2.1.',
-      fieldGroup: 'default',
-    },
-  },
-};
-
-// export object by backend name. keys of each object are model names
-export default {
-  kmip,
-  ssh,
-  pki,
-};
diff --git a/ui/tests/helpers/openapi/test-helpers.js b/ui/tests/helpers/openapi/test-helpers.js
deleted file mode 100644
index 04307aea4f5..00000000000
--- a/ui/tests/helpers/openapi/test-helpers.js
+++ /dev/null
@@ -1,56 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import authModelAttributes from './auth-model-attributes';
-import secretModelAttributes from './secret-model-attributes';
-
-export const secretEngineHelper = (test, secretEngine) => {
-  const engineData = secretModelAttributes[secretEngine];
-  if (!engineData)
-    throw new Error(`No engine attributes found in secret-model-attributes for ${secretEngine}`);
-
-  const modelNames = Object.keys(engineData);
-  // A given secret engine might have multiple models that are openApi driven
-  modelNames.forEach((modelName) => {
-    test(`${modelName} model getProps returns correct attributes`, async function (assert) {
-      const model = this.store.createRecord(modelName, {});
-      const helpUrl = model.getHelpUrl(this.backend);
-      const result = await this.pathHelp.getProps(helpUrl, this.backend);
-      const expected = engineData[modelName];
-      assert.deepEqual(result, expected, `getProps returns expected attributes for ${modelName}`);
-    });
-  });
-};
-
-export const authEngineHelper = (test, authBackend) => {
-  const authData = authModelAttributes[authBackend];
-  if (!authData) throw new Error(`No auth attributes found in auth-model-attributes for ${authBackend}`);
-
-  const itemNames = Object.keys(authData);
-  itemNames.forEach((itemName) => {
-    if (itemName.startsWith('auth-config/')) {
-      // Config test doesn't need to instantiate a new model
-      test(`${itemName} model`, async function (assert) {
-        const model = this.store.createRecord(itemName, {});
-        const helpUrl = model.getHelpUrl(this.mount);
-        const result = await this.pathHelp.getProps(helpUrl, this.mount);
-        const expected = authData[itemName];
-        assert.deepEqual(result, expected, `getProps returns expected attributes for ${itemName}`);
-      });
-    } else {
-      test.skip(`generated-${itemName}-${authBackend} model`, async function (assert) {
-        const modelName = `generated-${itemName}-${authBackend}`;
-        // Generated items need to instantiate the model first via getNewModel
-        await this.pathHelp.getNewModel(modelName, this.mount, `auth/${this.mount}/`, itemName);
-        const model = this.store.createRecord(modelName, {});
-        // Generated items don't have this method -- helpUrl is calculated in path-help.js line 101
-        const helpUrl = model.getHelpUrl(this.mount);
-        const result = await this.pathHelp.getProps(helpUrl, this.mount);
-        const expected = authData[modelName];
-        assert.deepEqual(result, expected, `getProps returns expected attributes for ${modelName}`);
-      });
-    }
-  });
-};
diff --git a/ui/tests/helpers/pagination.js b/ui/tests/helpers/pagination.js
new file mode 100644
index 00000000000..a26a3e662ed
--- /dev/null
+++ b/ui/tests/helpers/pagination.js
@@ -0,0 +1,10 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const STANDARD_META = {
+  total: 2,
+  currentPage: 1,
+  pageSize: 100,
+};
diff --git a/ui/tests/helpers/pki.js b/ui/tests/helpers/pki.js
deleted file mode 100644
index 441fa6131a3..00000000000
--- a/ui/tests/helpers/pki.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  caChain: '[data-test-value-div="CA chain"] [data-test-certificate-card]',
-  certificate: '[data-test-value-div="Certificate"] [data-test-certificate-card]',
-  commonName: '[data-test-row-value="Common name"]',
-  csr: '[data-test-value-div="CSR"] [data-test-certificate-card]',
-  expiryDate: '[data-test-row-value="Expiration date"]',
-  issueDate: '[data-test-row-value="Issue date"]',
-  issuingCa: '[data-test-value-div="Issuing CA"] [data-test-certificate-card]',
-  privateKey: '[data-test-value-div="Private key"] [data-test-certificate-card]',
-  revocationTime: '[data-test-row-value="Revocation time"]',
-  serialNumber: '[data-test-row-value="Serial number"]',
-};
-
-export const STANDARD_META = {
-  total: 2,
-  currentPage: 1,
-  pageSize: 100,
-};
diff --git a/ui/tests/helpers/pki/overview.js b/ui/tests/helpers/pki/overview.js
deleted file mode 100644
index e3cd1f251d4..00000000000
--- a/ui/tests/helpers/pki/overview.js
+++ /dev/null
@@ -1,27 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  issuersCardTitle: '[data-test-overview-card-title="Issuers"]',
-  issuersCardSubtitle: '[data-test-overview-card-subtitle="Issuers"]',
-  issuersCardLink: '[data-test-overview-card-container="Issuers"] a',
-  issuersCardOverviewNum: '[data-test-overview-card-container="Issuers"] h2',
-  rolesCardTitle: '[data-test-overview-card-title="Roles"]',
-  rolesCardSubtitle: '[data-test-overview-card-subtitle="Roles"]',
-  rolesCardLink: '[data-test-overview-card-container="Roles"] a',
-  rolesCardOverviewNum: '[data-test-overview-card-container="Roles"] h2',
-  issueCertificate: '[data-test-overview-card-title="Issue certificate"]',
-  issueCertificateInput: '[data-test-issue-certificate-input]',
-  issueCertificatePowerSearch: '[data-test-issue-certificate-input] span',
-  issueCertificateButton: '[data-test-issue-certificate-button]',
-  viewCertificate: '[data-test-overview-card-title="View certificate"]',
-  viewCertificateInput: '[data-test-view-certificate-input]',
-  viewCertificatePowerSearch: '[data-test-view-certificate-input] span',
-  viewCertificateButton: '[data-test-view-certificate-button]',
-  viewIssuerInput: '[data-test-issue-issuer-input]',
-  viewIssuerPowerSearch: '[data-test-issue-issuer-input] span',
-  viewIssuerButton: '[data-test-view-issuer-button]',
-  firstPowerSelectOption: '[data-option-index="0"]',
-};
diff --git a/ui/tests/helpers/pki/page/pki-configuration-edit.js b/ui/tests/helpers/pki/page/pki-configuration-edit.js
deleted file mode 100644
index ac63caf0182..00000000000
--- a/ui/tests/helpers/pki/page/pki-configuration-edit.js
+++ /dev/null
@@ -1,25 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  errorBanner: '[data-test-config-edit-error]',
-  acmeEditSection: '[data-test-acme-edit-section]',
-  configEditSection: '[data-test-cluster-config-edit-section]',
-  configInput: (attr) => `[data-test-input="${attr}"]`,
-  stringListInput: (attr) => `[data-test-input="${attr}"] [data-test-string-list-input="0"]`,
-  urlsEditSection: '[data-test-urls-edit-section]',
-  urlFieldInput: (attr) => `[data-test-input="${attr}"] textarea`,
-  urlFieldLabel: (attr) => `[data-test-input="${attr}"] label`,
-  crlEditSection: '[data-test-crl-edit-section]',
-  crlToggleInput: (attr) => `[data-test-input="${attr}"] input`,
-  crlTtlInput: (attr) => `[data-test-ttl-value="${attr}"]`,
-  crlFieldLabel: (attr) => `[data-test-input="${attr}"] label`,
-  saveButton: '[data-test-configuration-edit-save]',
-  cancelButton: '[data-test-configuration-edit-cancel]',
-  validationAlert: '[data-test-configuration-edit-validation-alert]',
-  deleteButton: (attr) => `[data-test-input="${attr}"] [data-test-string-list-button="delete"]`,
-  groupHeader: (group) => `[data-test-crl-header="${group}"]`,
-  checkboxInput: (attr) => `[data-test-input="${attr}"]`,
-};
diff --git a/ui/tests/helpers/pki/page/pki-keys.js b/ui/tests/helpers/pki/page/pki-keys.js
deleted file mode 100644
index 6026f9bcde9..00000000000
--- a/ui/tests/helpers/pki/page/pki-keys.js
+++ /dev/null
@@ -1,26 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  // key index
-  importKey: '[data-test-pki-key-import]',
-  generateKey: '[data-test-pki-key-generate]',
-  keyId: '[data-test-key="id"]',
-  keyName: '[data-test-key="name"]',
-  popupMenuTrigger: '[data-test-popup-menu-trigger]',
-  popupMenuDetails: '[data-test-key-menu-link="details"]',
-  popupMenuEdit: '[data-test-key-menu-link="edit"]',
-  // key details
-  title: '[data-test-key-details-title]',
-  keyIdValue: '[data-test-value-div="Key ID"]',
-  keyNameValue: '[data-test-value-div="Key name"]',
-  keyTypeValue: '[data-test-value-div="Key type"]',
-  keyBitsValue: '[data-test-value-div="Key bits"]',
-  keyDeleteButton: '[data-test-pki-key-delete]',
-  downloadButton: '[data-test-download-button]',
-  keyEditLink: '[data-test-pki-key-edit]',
-  confirmDelete: '[data-test-confirm-button]',
-  nextStepsAlert: '[data-test-pki-key-next-steps]',
-};
diff --git a/ui/tests/helpers/pki/page/pki-role-details.js b/ui/tests/helpers/pki/page/pki-role-details.js
deleted file mode 100644
index 52b4d0eadc1..00000000000
--- a/ui/tests/helpers/pki/page/pki-role-details.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  issuerLabel: '[data-test-row-label="Issuer"]',
-  noStoreValue: '[data-test-value-div="Store in storage backend"]',
-  keyUsageValue: '[data-test-value-div="Key usage"]',
-  extKeyUsageValue: '[data-test-value-div="Ext key usage"]',
-  customTtlValue: '[data-test-value-div="Issued certificates expire after"]',
-};
diff --git a/ui/tests/helpers/pki/page/pki-tidy-form.js b/ui/tests/helpers/pki/page/pki-tidy-form.js
deleted file mode 100644
index e1c4f754ceb..00000000000
--- a/ui/tests/helpers/pki/page/pki-tidy-form.js
+++ /dev/null
@@ -1,18 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  tidyFormName: (attr) => `[data-test-tidy-form="${attr}"]`,
-  inputByAttr: (attr) => `[data-test-input="${attr}"]`,
-  toggleInput: (attr) => `[data-test-input="${attr}"] input`,
-  intervalDuration: '[data-test-ttl-value="Automatic tidy enabled"]',
-  acmeAccountSafetyBuffer: '[data-test-ttl-value="Tidy ACME enabled"]',
-  toggleLabel: (label) => `[data-test-toggle-label="${label}"]`,
-  tidySectionHeader: (header) => `[data-test-tidy-header="${header}"]`,
-  tidySave: '[data-test-pki-tidy-button]',
-  tidyCancel: '[data-test-pki-tidy-cancel]',
-  tidyPauseDuration: '[data-test-ttl-value="Pause duration"]',
-  editAutoTidyButton: '[data-test-pki-edit-tidy-auto-link]',
-};
diff --git a/ui/tests/helpers/pki/page/pki-tidy.js b/ui/tests/helpers/pki/page/pki-tidy.js
deleted file mode 100644
index 901c3edf4e6..00000000000
--- a/ui/tests/helpers/pki/page/pki-tidy.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-import { SELECTORS as TIDY_FORM } from './pki-tidy-form';
-
-export const SELECTORS = {
-  hdsAlertTitle: '[data-test-tidy-status-alert-title]',
-  hdsAlertDescription: '[data-test-tidy-status-alert-description]',
-  alertUpdatedAt: '[data-test-tidy-status-alert-updated-at]',
-  cancelTidyAction: '[data-test-cancel-tidy-action]',
-  hdsAlertButtonText: '[data-test-cancel-tidy-action] .hds-button__text',
-  timeStartedRow: '[data-test-value-div="Time started"]',
-  timeFinishedRow: '[data-test-value-div="Time finished"]',
-  cancelTidyModalBackground: '#pki-cancel-tidy-modal',
-  tidyEmptyStateConfigure: '[data-test-tidy-empty-state-configure]',
-  manualTidyToolbar: '[data-test-pki-manual-tidy-config]',
-  autoTidyToolbar: '[data-test-pki-auto-tidy-config]',
-  tidyConfigureModal: {
-    configureTidyModal: '#pki-tidy-modal',
-    tidyModalAutoButton: '[data-test-tidy-modal-auto-button]',
-    tidyModalManualButton: '[data-test-tidy-modal-manual-button]',
-    tidyModalCancelButton: '[data-test-tidy-modal-cancel-button]',
-    tidyOptionsModal: '[data-test-pki-tidy-options-modal]',
-  },
-  tidyEmptyState: '[data-test-component="empty-state"]',
-  tidyForm: {
-    ...TIDY_FORM,
-  },
-};
diff --git a/ui/tests/helpers/pki/pki-configure-create.js b/ui/tests/helpers/pki/pki-configure-create.js
deleted file mode 100644
index 209b32db4a3..00000000000
--- a/ui/tests/helpers/pki/pki-configure-create.js
+++ /dev/null
@@ -1,30 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { SELECTORS as GENERATE_ROOT } from './pki-generate-root';
-
-export const SELECTORS = {
-  // page::pki-configure-create
-  breadcrumbContainer: '[data-test-breadcrumbs]',
-  title: '[data-test-pki-engine-page-title]',
-  option: '[data-test-pki-config-option]',
-  optionByKey: (key) => `[data-test-pki-config-option="${key}"]`,
-  cancelButton: '[data-test-pki-config-cancel]',
-  saveButton: '[data-test-pki-config-save]',
-  doneButton: '[data-test-done]',
-  configureButton: '[data-test-configure-pki-button]',
-  // pki-generate-root
-  ...GENERATE_ROOT,
-  generateRootOption: '[data-test-pki-config-option="generate-root"]',
-  // pki-ca-cert-import
-  importForm: '[data-test-pki-import-pem-bundle-form]',
-  importSubmit: '[data-test-pki-import-pem-bundle]',
-  importSectionLabel: '[data-test-import-section-label]',
-  importMapping: '[data-test-imported-bundle-mapping]',
-  importedIssuer: '[data-test-imported-issuer]',
-  importedKey: '[data-test-imported-key]',
-  // generate-intermediate
-  csrDetails: '[data-test-generate-csr-result]',
-};
diff --git a/ui/tests/helpers/pki/pki-delete-all-issuers.js b/ui/tests/helpers/pki/pki-delete-all-issuers.js
deleted file mode 100644
index 22112e27847..00000000000
--- a/ui/tests/helpers/pki/pki-delete-all-issuers.js
+++ /dev/null
@@ -1,11 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  issuerLink: '[data-test-delete-all-issuers-link]',
-  deleteAllIssuerModal: '#confirmation-modal',
-  deleteAllIssuerInput: '[data-test-confirmation-modal-input="Delete all issuers?"]',
-  deleteAllIssuerButton: '[data-test-confirm-button="Delete all issuers?"]',
-};
diff --git a/ui/tests/helpers/pki/pki-generate-root.js b/ui/tests/helpers/pki/pki-generate-root.js
deleted file mode 100644
index 45cfc05f5f8..00000000000
--- a/ui/tests/helpers/pki/pki-generate-root.js
+++ /dev/null
@@ -1,35 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  mainSectionTitle: '[data-test-generate-root-title="Root parameters"]',
-  urlSectionTitle: '[data-test-generate-root-title="Issuer URLs"]',
-  keyParamsGroupToggle: '[data-test-toggle-group="Key parameters"]',
-  sanGroupToggle: '[data-test-toggle-group="Subject Alternative Name (SAN) Options"]',
-  additionalGroupToggle: '[data-test-toggle-group="Additional subject fields"]',
-  toggleGroupDescription: '[data-test-toggle-group-description]',
-  formField: '[data-test-field]',
-  typeField: '[data-test-input="type"]',
-  inputByName: (name) => `[data-test-input="${name}"]`,
-  fieldByName: (name) => `[data-test-field="${name}"]`,
-  generateRootSave: '[data-test-pki-generate-root-save]',
-  generateRootCancel: '[data-test-pki-generate-root-cancel]',
-  generateRootCommonNameField: '[data-test-input="commonName"]',
-  generateRootIssuerNameField: '[data-test-input="issuerName"]',
-  formInvalidError: '[data-test-pki-generate-root-validation-error]',
-  urlsSection: '[data-test-urls-section]',
-  urlField: '[data-test-urls-section] [data-test-input]',
-  // Shown values after save
-  saved: {
-    certificate: '[data-test-value-div="Certificate"] [data-test-certificate-card]',
-    commonName: '[data-test-row-value="Common name"]',
-    issuerName: '[data-test-row-value="Issuer name"]',
-    issuerLink: '[data-test-value-div="Issuer ID"] a',
-    keyName: '[data-test-row-value="Key name"]',
-    keyLink: '[data-test-value-div="Key ID"] a',
-    privateKey: '[data-test-value-div="Private key"] [data-test-certificate-card]',
-    serialNumber: '[data-test-row-value="Serial number"]',
-  },
-};
diff --git a/ui/tests/helpers/pki/pki-helpers.ts b/ui/tests/helpers/pki/pki-helpers.ts
new file mode 100644
index 00000000000..5799d1244db
--- /dev/null
+++ b/ui/tests/helpers/pki/pki-helpers.ts
@@ -0,0 +1,251 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type Store from '@ember-data/store';
+
+export const PKI_BASE_URL = `/vault/cluster/secrets/backend/pki/roles`;
+
+// Clears pki-related data and capabilities so that admin
+// capabilities from setup don't rollover
+export function clearRecords(store: Store) {
+  store.unloadAll('pki/action');
+  store.unloadAll('pki/issuer');
+  store.unloadAll('pki/key');
+  store.unloadAll('pki/role');
+  store.unloadAll('pki/sign-intermediate');
+  store.unloadAll('pki/tidy');
+  store.unloadAll('pki/config/urls');
+  store.unloadAll('pki/config/crl');
+  store.unloadAll('pki/config/cluster');
+  store.unloadAll('pki/config/acme');
+  store.unloadAll('pki/certificate/generate');
+  store.unloadAll('pki/certificate/sign');
+  store.unloadAll('capabilities');
+}
+
+/**
+ * The following are certificate values used for testing. They are exported under the CERTIFICATES object.
+ */
+// Expires Jan 10, 2033
+const rootPem = `-----BEGIN CERTIFICATE-----
+MIIDezCCAmOgAwIBAgIUTBbQcZijQsmd0rjd6COikPsrGyowDQYJKoZIhvcNAQEL
+BQAwFDESMBAGA1UEAxMJdGVzdC1yb290MB4XDTIzMDEyMDE3NTcxMloXDTIzMDIy
+MTE3NTc0MlowFDESMBAGA1UEAxMJdGVzdC1yb290MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAlUHfvQLsocXtvwRCpTnXGzwMCD+3KKK7y1+SUCgpAD9Y
+RV2xLAbqh0iK3x2WI4+Pek1Ub6dYaWczzBob6wRq9iFB72uLPpbL8yRf+tc1egmP
+wwJQS9qidb1hcSi4p6x/JwOpr2v2PDqJPDoHrfaHeJgCuBGS00qUFH7oHQz9Usim
+lHjIbVNF3Qa1Hq2bgwkZmRjRn3Bez/xy3YEiQ41GTicUBqY4NAGWuS1LiHyEUW81
+iQ+1iGlbpuAL4H7lpKmrhv1xZXEsF9vNL6H0Y7kjjAImTQnmo+ozcArnKnwh2wmS
+f/TrVnN4RRc8dvN8P8nWvVsJYK/D40yc7YMljIESKQIDAQABo4HEMIHBMA4GA1Ud
+DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBT6rcf5twb19wLL
+JjhPOVywd41d2jAfBgNVHSMEGDAWgBT6rcf5twb19wLLJjhPOVywd41d2jArBggr
+BgEFBQcBAQQfMB0wGwYIKwYBBQUHMAKGD2Z1bmZvcmVjYXN0LmNvbTAUBgNVHREE
+DTALggl0ZXN0LXJvb3QwGwYDVR0fBBQwEjAQoA6gDIYKZ29vZ2xlLmNvbTANBgkq
+hkiG9w0BAQsFAAOCAQEAjG7km+QsIuW7KNY3h8YHJZhdr+tIx57k9tUR4w1+d8QI
+t44FTdCYdN8n89lsFK9bONZatd0LY3qqcOARE2ni0Hg/zV9u8TTVKTKAOOx8zBd1
+TnwzhXb8mssqnXK9lcECexuWf/s5lkyHjcWOuzNVI0PohrX9tGZwdzsZEgH4Y49i
+o8I9DD+uBHknwByRLXSDmgggwgOYsyTg/IfYoHlLHDD3CaOpkCvUCZvM9bI7nrlx
+2GByQ/WDT4ArAHcf+Z1iaSIbV6WG6QWoPsu2/WKybcuN2fznaXtJMwgRl50BUv2h
+DU3c2oZTc0mPYGft6U8mVwLqfYTcEduGidTLAQPE5w==
+-----END CERTIFICATE-----`;
+
+const rootDer = `MIIDJjCCAg6gAwIBAgIUZwx170kTAaGFKeyiG3Di
+GpwhKvcwDQYJKoZIhvcNAQELBQAwETEPMA0GA1UEAxMGMTExMTExMB4XDTIzMDgw
+OTIxMzk0NloXDTIzMDkxMDIxNDAxNlowETEPMA0GA1UEAxMGMTExMTExMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3Hm1gjKWDdXuRLZIk3dDabbzlH+Y
+2e4rklkMGlrnNqju2+7iIGZa2q8rQ4jEZ3sesSsqGHUEJ2sIG5HnRhl5yawCr9NS
+uJP+3zsNueQLQDj6tEnuN0STZQuEJKc+yeept8JGAD0SGnB+THGUYf3if0D8sDT1
+nHj3XihtnTG3fN62iKyx2Y95WKrVmT1MnpGjbp4HkRvrHSR8PKyq9Q6YyZkIYbfW
+DH3adq6gmiJITzozaUT6efftPOVPr5LLTPKAl3BAmoc8ypM/H1IPaE1Z7ef9lV9w
+gazvoJZEsc59hskTWF3ZLcWIxAjcq7u6IX2+dU/A0DmCY6GKmmcZ9W5A9wIDAQAB
+o3YwdDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
+b2qEtlDZl/ws00ftFQJX6bjoOckwHwYDVR0jBBgwFoAUb2qEtlDZl/ws00ftFQJX
+6bjoOckwEQYDVR0RBAowCIIGMTExMTExMA0GCSqGSIb3DQEBCwUAA4IBAQAFI1H8
+EOw+YcequlJp1ucCpTRArLUhH0t+l7hQAqwORGQevEP6Ml63dRrZCcke7esrpnL9
+7ijKw/PjgoyrM4QS3wAYm8nDm7cZH+f//A2X6WFnvozwKdmDRkacEjMOAe/XU+qh
+jdtiETEnUGVH65ulyimKitU5SHV0GNfToKnU/SFBks0bQvglIii0YwgHvSoW1++7
+arCjfZqWLdRe7MHfrLpLr4gaebfxSrZfn3utgm+DsJVba3B9JnOZO+yzTiEw6UkJ
+rcmZDy0x1/OaCcYHKai4RegsiQ0QrIEI+iC1N6U0PGiGf/V23eoTR0+5H6qngDz2
+GzXrbHFAPQbtweCf`;
+
+const issuerPemBundle = `
+-----BEGIN CERTIFICATE-----
+MIIDRTCCAi2gAwIBAgIUdKagCL6TnN5xLkwhPbNY8JEcY0YwDQYJKoZIhvcNAQEL
+BQAwGzEZMBcGA1UEAxMQd3d3LnRlc3QtaW50LmNvbTAeFw0yMzAxMDkxOTA1NTBa
+Fw0yMzAyMTAxOTA2MjBaMBsxGTAXBgNVBAMTEHd3dy50ZXN0LWludC5jb20wggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCfd5o9JfyRAXH+E1vE2U0xjSqs
+A/cxDqsDXRHBnNJvzAa+7gPKXCDQZbr6chjxLXpP6Bv2/O+dZHq1fo/f6q9PDDGW
+JYIluwbACpe7W1UB7q9xFkZg85yQsNYokGZlwv/AMGpFBxDwVlNGL+4fxvFTv7uF
+mIlDzSIPrzByyCrqAFMNNqNwlAerDt/C6DMZae/rTGXIXsTfUpxPy21bzkeA+70I
+YCV1ffK8UnAeBYNUJ+v8+XgTQ5KhRyQ+fscUkO3T2s6f3O9Q2sWxswkf2YmZB+V1
+cTZ5w6hqiuFdBXz7GRnACi1/gbWbaExQTJRplArFwIHka7dqJh8tYkXDjai3AgMB
+AAGjgYAwfjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
+FgQU68/xXIgvsleKkuA8clK/6YslB/IwHwYDVR0jBBgwFoAU68/xXIgvsleKkuA8
+clK/6YslB/IwGwYDVR0RBBQwEoIQd3d3LnRlc3QtaW50LmNvbTANBgkqhkiG9w0B
+AQsFAAOCAQEAWSff0BH3SJv/XqwN/flqc1CVzOios72/IJ+KBBv0AzFCZ8wJPi+c
+hH1bw7tqi01Bgh595TctogDFN1b6pjN+jrlIP4N+FF9Moj79Q+jHQMnuJomyPuI7
+i07vqUcxgSmvEBBWOWS+/vxe6TfWDg18nyPf127CWQN8IHTo1f/GavX+XmRve6XT
+EWoqcQshEk9i87oqCbaT7B40jgjTAd1r4Cc6P4s1fAGPt9e9eqMj13kTyVDNuCoD
+FSZYalrlkASpg+c9oDQIh2MikGQINXHv/zIEHOW93siKMWeA4ni6phHtMg/p5eJt
+SxnVZsSzj8QLy2uwX1AADR0QUvJzMxptyA==
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAn3eaPSX8kQFx/hNbxNlNMY0qrAP3MQ6rA10RwZzSb8wGvu4D
+ylwg0GW6+nIY8S16T+gb9vzvnWR6tX6P3+qvTwwxliWCJbsGwAqXu1tVAe6vcRZG
+YPOckLDWKJBmZcL/wDBqRQcQ8FZTRi/uH8bxU7+7hZiJQ80iD68wcsgq6gBTDTaj
+cJQHqw7fwugzGWnv60xlyF7E31KcT8ttW85HgPu9CGAldX3yvFJwHgWDVCfr/Pl4
+E0OSoUckPn7HFJDt09rOn9zvUNrFsbMJH9mJmQfldXE2ecOoaorhXQV8+xkZwAot
+f4G1m2hMUEyUaZQKxcCB5Gu3aiYfLWJFw42otwIDAQABAoIBADC+vZ4Ne4vTtkWl
+Izsj9Y29Chs0xx3uzuWjUGcvib/0zOcWGICF8t3hCuu9btRiQ24jlFDGdnRVH5FV
+E6OtuFLgdlPgOU1RQzn2wvTZcT26+VQHLBI8xVIRTBVwNmzK06Sq6AEbrNjaenAM
+/KwoAuLHzAmFXAgmr0++DIA5oayPWyi5IoyFO7EoRv79Xz5LWfu5j8CKOFXmI5MT
+vEVYM6Gb2xHRa2Ng0SJ4VzwC09GcXlHKRAz+CubJuncvjbcM/EryvexozKkUq4XA
+KqGr9xxdZ4XDlo3Rj9S9P9JaOin0I1mwwz6p+iwMF0zr+/ldjE4oPBdB1PUgSJ7j
+2CZcS1kCgYEAwIZ3UsMIXqkMlkMz/7nu2sqzV3EgQjY5QRoz98ligKg4fhYKz+K4
+yXvJrRyLkwEBaPdLppCZbs4xsuuv3jiqUHV5n7sfpUA5HVKkKh6XY7jnszbqV732
+iB1mQVEjzM92/amew2hDKLGQDW0nglrg6uV+bx0Lnp6Glahr8NOAyk0CgYEA1Ar3
+jTqTkU+NQX7utlxx0HPVL//JH/erp/Gnq9fN8dZhK/yjwX5savUlNHpgePoXf1pE
+lgi21/INQsvp7O2AUKuj96k+jBHQ0SS58AQGFv8iNDkLE57N74vCO6+Xdi1rHj/Y
+7jglr00box/7SOmvb4SZz2o0jm0Ejsg2M0aBuRMCgYEAgTB6F34qOqMDgD1eQka5
+QfXs/Es8E1Ihf08e+jIXuC+poOoXnUINL56ySUizXBS7pnzzNbUoUFNqxB4laF/r
+4YvC7m15ocED0mpnIKBghBlK2VaLUA93xAS+XiwdcszwkuzkTUnEbyUfffL2JSHo
+dZdEDTmXV3wW4Ywfyn2Sma0CgYAeNNG/FLEg6iw9QE/ROqob/+RGyjFklGunqQ0x
+tbRo1xlQotTRI6leMz3xk91aXoYqZjmPBf7GFH0/Hr1cOxkkZM8e4MVAPul4Ybr7
+LheP/xhoSBgD24OKtGYfCoyRETdJP98vUGBN8LYXLt8lK+UKBeHDYmXKRE156ZuP
+AmRIcQKBgFvp+xMoyAsBeOlTjVDZ0mTnFh1yp8f7N3yXdHPpFShwjXjlqLmLO5RH
+mZAvaH0Ux/wCfvwHhdC46jBrs9S4zLBvj3+44NYOzvz2dBWP/5MuXgzFe30h9Yd0
+zUlyEaWm0jY2Ylzax8ECKRL0td2bv36vxOYtTax8MSB15szsnPJ+
+-----END RSA PRIVATE KEY-----
+`;
+
+const csr = `-----BEGIN CERTIFICATE REQUEST-----
+MIICdDCCAVwCAQAwDjEMMAoGA1UEAxMDbG9sMIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEA4Dz2b/nAP/M6bqyk5mctqqYAAcoME//xPBy0wREHuZ776Pu4
+l45kDL3dPXiY8U2P9pn8WIr2KpLK6oWUfSsiG2P082bpWDL20UymkWqDhhrA4unf
+ZRq68UIDbcetlLw15YKnlNdvNZ7Qr8Se8KV0YGR/wFqI7QfS6VE3lhxZWEBUayI0
+egqOuDbXAcZTON1AZ92/F+WFSbc43iYdDk16XfAPFKhtvLr6zQQuzebAb7HG04Hc
+GhRskixxyJ8XY6XUplfsa1HcpUXE4f1GeUvq3g6ltVCSJ0p7qI9FFjV4t+DCLVVV
+LnwHUi9Vzz6i2wjMt7P6+gHR+RrOWBgRMn38fwIDAQABoCEwHwYJKoZIhvcNAQkO
+MRIwEDAOBgNVHREEBzAFggNsb2wwDQYJKoZIhvcNAQELBQADggEBAAm3AHQ1ctdV
+8HCrMOXGVLgI2cB1sFd6VYVxPBxIk812Y4wyO8Q6POE5VZNTIgMcSeIaFu5lgHNL
+Peeb54F+zEa+OJYkcWgCAX5mY/0HoML4p2bxFTSjllSpcX7ktjq4IEIY/LRpqSgc
+jgZHHRwanFfkeIOhN4Q5qJWgBPNhDAcNPE7T0M/4mxqYDqMSJvMYmC67hq1UOOug
+/QVDUDJRC1C0aDw9if+DbG/bt1V6HpMQhDIEUjzfu4zG8pcag3cJpOA8JhW1hnG0
+XA2ZOCA7s34/szr2FczXtIoKiYmv3UzPyO9/4mc0Q2+/nR4CG8NU9WW/XJCne9ID
+elRplAzrMF4=
+-----END CERTIFICATE REQUEST-----`;
+
+const csr2 = `-----BEGIN CERTIFICATE REQUEST-----
+MIIChDCCAWwCAQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCuW9C58M1wO0vdGmtLcJbbCkKyfsHJJae1j4LL
+xdGqs1j9UKD66UALSzZEeMCBdtTNNzThAgYJqCSA5swqpbRf6WZ3K/X7oHbfcrHi
+SAm8v/0QsJDF5Rphiy6wyggaoaHEsbSp83kYy9r+h48vFW5Dr8UvJTsp5kdRn31L
+bTHr56iqOaHQbu6hDj4Ompg/0OElPH1tV2X947o8timR+L89utZzR+d8x/eeTdPl
+H7TEkMEomRvt7NTRHGYRsm3Gzq4AA6PalzIxzwJrNgXfJDutNn/QwcVd5sImwYCO
+GaHsOvGfc02w+Vqqva9EOEQSr6B90kA+vc30I6uSiugzV9TFAgMBAAGgKTAnBgkq
+hkiG9w0BCQ4xGjAYMBYGA1UdEQQPMA2CC2V4YW1wbGUuY29tMA0GCSqGSIb3DQEB
+CwUAA4IBAQAjm6JTU7axU6TzLlXlOp7hZ4+nep2/8vvJ9EOXzL8x/qtTTizctdG9
+Op70gywoUxAS2tatwa4fmW9DbA2eGiLU+Ibj/5b0Veq5DQdp1Qg3MLBP/+AcM/7m
+rrgA9MhkpQahXCj4vXo6NeXYaTh6Jo/s8C9h3WxTD6ptDMiaPFcEuWcx0e3AjjH0
+pe7k9/MfB2wLfQ7+5wee/tCFWZN4tk8YfjQeQA1extXYKM/f8eu3Z/wjbbMOVpwb
+xst+VTY7X9T8cU/hjDEoNG677meI+W5MgiwX0rxTpoz991fqr3vp7PELYj3GMyii
+D1YfvqXieNij4UrduRqCXj1m8SVZlM+X
+-----END CERTIFICATE REQUEST-----`;
+
+const componentPemBundle = `-----BEGIN CERTIFICATE-----
+MIIDGjCCAgKgAwIBAgIUFvnhb2nQ8+KNS3SzjlfYDMHGIRgwDQYJKoZIhvcNAQEL
+BQAwDTELMAkGA1UEAxMCZmEwHhcNMTgwMTEwMTg1NDI5WhcNMTgwMjExMTg1NDU5
+WjANMQswCQYDVQQDEwJmYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AN2VtBn6EMlA4aYre/xoKHxlgNDxJnfSQWfs6yF/K201qPnt4QF9AXChatbmcKVn
+OaURq+XEJrGVgF/u2lSos3NRZdhWVe8o3/sOetsGxcrd0gXAieOSmkqJjp27bYdl
+uY3WsxhyiPvdfS6xz39OehsK/YCB6qCzwB4eEfSKqbkvfDL9sLlAiOlaoHC9pczf
+6/FANKp35UDwInSwmq5vxGbnWk9zMkh5Jq6hjOWHZnVc2J8J49PYvkIM8uiHDgOE
+w71T2xM5plz6crmZnxPCOcTKIdF7NTEP2lUfiqc9lONV9X1Pi4UclLPHJf5bwTmn
+JaWgbKeY+IlF61/mgxzhC7cCAwEAAaNyMHAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
+EwEB/wQFMAMBAf8wHQYDVR0OBBYEFLDtc6+HZN2lv60JSDAZq3+IHoq7MB8GA1Ud
+IwQYMBaAFLDtc6+HZN2lv60JSDAZq3+IHoq7MA0GA1UdEQQGMASCAmZhMA0GCSqG
+SIb3DQEBCwUAA4IBAQDVt6OddTV1MB0UvF5v4zL1bEB9bgXvWx35v/FdS+VGn/QP
+cC2c4ZNukndyHhysUEPdqVg4+up1aXm4eKXzNmGMY/ottN2pEhVEWQyoIIA1tH0e
+8Kv/bysYpHZKZuoGg5+mdlHS2p2Dh2bmYFyBLJ8vaeP83NpTs2cNHcmEvWh/D4UN
+UmYDODRN4qh9xYruKJ8i89iMGQfbdcq78dCC4JwBIx3bysC8oF4lqbTYoYNVTnAi
+LVqvLdHycEOMlqV0ecq8uMLhPVBalCmIlKdWNQFpXB0TQCsn95rCCdi7ZTsYk5zv
+Q4raFvQrZth3Cz/X5yPTtQL78oBYrmHzoQKDFJ2z
+-----END CERTIFICATE-----`;
+
+// for parse-pki-cert tests:
+// certificate contains all allowable params
+const loadedCert = `-----BEGIN CERTIFICATE-----\nMIIE7TCCA9WgAwIBAgIULcrWXSz3/kG81EgBo0A4Zt+ZgkYwDQYJKoZIhvcNAQEL\nBQAwga0xDzANBgNVBAYTBkZyYW5jZTESMBAGA1UECBMJQ2hhbXBhZ25lMQ4wDAYD\nVQQHEwVQYXJpczETMBEGA1UECRMKMjM0IHNlc2FtZTEPMA0GA1UEERMGMTIzNDU2\nMQ8wDQYDVQQKEwZXaWRnZXQxEDAOBgNVBAsTB0ZpbmFuY2UxGDAWBgNVBAMTD2Nv\nbW1vbi1uYW1lLmNvbTETMBEGA1UEBRMKY2VyZWFsMTI5MjAeFw0yMzAyMDMxNzI3\nMzNaFw0yMzAzMDcxNzI4MDNaMIGtMQ8wDQYDVQQGEwZGcmFuY2UxEjAQBgNVBAgT\nCUNoYW1wYWduZTEOMAwGA1UEBxMFUGFyaXMxEzARBgNVBAkTCjIzNCBzZXNhbWUx\nDzANBgNVBBETBjEyMzQ1NjEPMA0GA1UEChMGV2lkZ2V0MRAwDgYDVQQLEwdGaW5h\nbmNlMRgwFgYDVQQDEw9jb21tb24tbmFtZS5jb20xEzARBgNVBAUTCmNlcmVhbDEy\nOTIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8NO7LXHp28SzOqmQv\nns4fGogKydEklWG4JEN3pM+k9nTyEgA8DFhtSLvcqF0cqhEydw4FVU+LEUGySUer\nmM4VNl9qglFBgmYE8TNgWkUw9ZP6MNgx13I8zXTXOIDj0iwXks02x8451oPbqqdq\nXsCc4vSP7BPwQOjc0C56c54zyRC1zFm9jlh+As0QinuYcjFjVabCku6JSYc4kunh\nz7derU9cURUxB5/ja9zC7jGS8tg4XUWdUkbj1O/krEWfjQx9Kj8aEU1gFfAvW/Bd\nIqgAlHATYN6i8HDmAmdGty9zLht9wUgnAtVh3lK3939h/rI0qCLV6N/RjCC7csnz\n9I67AgMBAAGjggEBMIH+MA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/\nAgERMB0GA1UdDgQWBBSSdKle0wMGy0jvPmcoDanGduhLqzAfBgNVHSMEGDAWgBSS\ndKle0wMGy0jvPmcoDanGduhLqzAuBgNVHR4BAf8EJDAioCAwDoIMZG5zbmFtZTEu\nY29tMA6CDGRzbm5hbWUyLmNvbTBoBgNVHREEYTBfoB0GCCsBBAEFCQIGoBEMD3Nv\nbWUtdXRmLXN0cmluZ4IIYWx0bmFtZTGCCGFsdG5hbWUyhwTAngEmhxASNA/SViEA\nAQCJAAAAAEUAhgh0ZXN0dXJpMYYIdGVzdHVyaTIwDQYJKoZIhvcNAQELBQADggEB\nAAQukDwIg01QLQK2MQqjePNZlJleKLMK9LiabyGqc7u4bgmX3gYIrH7uopvO5cIv\nvqxcVBATQ6ez29t5MagzDu1+vnwE8fQhRoe0sp5TRLiGSlBJf53+0Wb3vbaOT0Fx\n/FFK0f2wHqYv3h/CTxu8YxDY4DwCRTPJ2KfTvT85BXtTUlzKIp1ytALSKcz0Owoe\neQPtQUdi8UHef8uHuWbk7DftMXojXbCqtHQdS3Rrl9zyc+Ds67flb5hKEseQZRgw\ntPtAIxhjSfZPTjl/3aasCBikESdeS8IOxIXL1bGun0xWnIBBc9uRe8hpdPjZj7Eh\nIt7ucIzFep0DLWCeQrAHeqo=\n-----END CERTIFICATE-----`;
+// use_pss = true
+const pssTrueCert = `-----BEGIN CERTIFICATE-----\nMIIDqTCCAl2gAwIBAgIUVY2PTRZl1t/fjfyEwrG4HvGjYekwQQYJKoZIhvcNAQEK\nMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF\nAKIDAgEgMBoxGDAWBgNVBAMTD2NvbW1vbi1uYW1lLmNvbTAeFw0yMzAxMjEwMTA3\nNDBaFw0yMzAyMjIwMTA4MTBaMBoxGDAWBgNVBAMTD2NvbW1vbi1uYW1lLmNvbTCC\nASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANlG6DuZ4B6Tv8u8rI+pUvQv\n2E7dFCu+i1YAbEJSnuAQ9XFUG5Uf3uHB8AFrOKRBAaFdBV4hKvBpfvMj3jl93d0b\nHdHeIM+sancDwpexpLvSW4yDpbIhAnkYzbUYgZyEAJeIgq/4ufT77TCK8XIzDywD\nhXZtDJkc6w3mm6hiqEQXLKnDQTfKLK8Fbsq4OuQ4vO5VIJrVZ1gKemDs7W/9WIzp\n0iSjzcIfWnUy1Dpk+AF8HhXok8CbhHfOGgbQZ6DcXOIJeb4XarJ9sgLJNAuhdcHR\ngP0TkPiOewbBG9Ish1p3F+pkI3vjQk4cghmilAuEkMc2NCNNy6q1bwSELVQnMiMC\nAwEAAaN/MH0wDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFAsrMoFu6tt1pybxx9ln6w5QK/2tMB8GA1UdIwQYMBaAFAsrMoFu6tt1pybx\nx9ln6w5QK/2tMBoGA1UdEQQTMBGCD2NvbW1vbi1uYW1lLmNvbTBBBgkqhkiG9w0B\nAQowNKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQC\nAQUAogMCASADggEBAFh+PMwEmxaZR6OtfB0Uvw2vA7Oodmm3W0bYjQlEz8U+Q+JZ\ncIPa4VnRy1QALmKbPCbRApA/gcWzIwtzo1JhLtcDINg2Tl0nj4WvgpIvj0/lQNMq\nmwP7G/K4PyJTv3+y5XwVfepZAZITB0w5Sg5dLC6HP8AGVIaeb3hGNHYvPlE+pbT+\njL0xxzFjOorWoy5fxbWoVyVv9iZ4j0zRnbkYHIi3d8g56VV6Rbyw4WJt6p87lmQ8\n0wbiJTtuew/0Rpuc3PEcR9XfB5ct8bvaGGTSTwh6JQ33ohKKAKjbBNmhBDSP1thQ\n2mTkms/mbDRaTiQKHZx25TmOlLN5Ea1TSS0K6yw=\n-----END CERTIFICATE-----`;
+// only has common name
+const skeletonCert = `-----BEGIN CERTIFICATE-----\nMIIDQTCCAimgAwIBAgIUVQy58VgdVpAK9c8SfS31idSv6FUwDQYJKoZIhvcNAQEL\nBQAwGjEYMBYGA1UEAxMPY29tbW9uLW5hbWUuY29tMB4XDTIzMDEyMTAxMjAyOVoX\nDTIzMDIyMjAxMjA1OVowGjEYMBYGA1UEAxMPY29tbW9uLW5hbWUuY29tMIIBIjAN\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2UboO5ngHpO/y7ysj6lS9C/YTt0U\nK76LVgBsQlKe4BD1cVQblR/e4cHwAWs4pEEBoV0FXiEq8Gl+8yPeOX3d3Rsd0d4g\nz6xqdwPCl7Gku9JbjIOlsiECeRjNtRiBnIQAl4iCr/i59PvtMIrxcjMPLAOFdm0M\nmRzrDeabqGKoRBcsqcNBN8osrwVuyrg65Di87lUgmtVnWAp6YOztb/1YjOnSJKPN\nwh9adTLUOmT4AXweFeiTwJuEd84aBtBnoNxc4gl5vhdqsn2yAsk0C6F1wdGA/ROQ\n+I57BsEb0iyHWncX6mQje+NCThyCGaKUC4SQxzY0I03LqrVvBIQtVCcyIwIDAQAB\no38wfTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU\nCysygW7q23WnJvHH2WfrDlAr/a0wHwYDVR0jBBgwFoAUCysygW7q23WnJvHH2Wfr\nDlAr/a0wGgYDVR0RBBMwEYIPY29tbW9uLW5hbWUuY29tMA0GCSqGSIb3DQEBCwUA\nA4IBAQDPco+FIHXczf0HTwFAmIVu4HKaeIwDsVPxoUqqWEix8AyCsB5uqpKZasby\nedlrdBohM4dnoV+VmV0de04y95sdo3Ot60hm/czLog3tHg4o7AmfA7saS+5hCL1M\nCJWqoJHRFo0hOWJHpLJRWz5DqRZWspASoVozLOYyjRD+tNBjO5hK4FtaG6eri38t\nOpTt7sdInVODlntpNuuCVprPpHGj4kPOcViQULoFQq5fwyadpdjqSXmEGlt0to5Y\nMbTb4Jhj0HywgO53BUUmMzzY9idXh/8A7ThrM5LtqhxaYHLVhyeo+5e0mgiXKp+n\nQ8Uh4TNNTCvOUlAHycZNaxYTlEPn\n-----END CERTIFICATE-----`;
+// contains unsupported subject and extension OIDs
+const unsupportedOids = `-----BEGIN CERTIFICATE-----\nMIIEjDCCA3SgAwIBAgIUD4EeORgh/i+ZZFOk8KsGKQPWsoIwDQYJKoZIhvcNAQEL\nBQAwgZIxMTAvBgNVBAMMKGZhbmN5LWNlcnQtdW5zdXBwb3J0ZWQtc3Viai1hbmQt\nZXh0LW9pZHMxCzAJBgNVBAYTAlVTMQ8wDQYDVQQIDAZLYW5zYXMxDzANBgNVBAcM\nBlRvcGVrYTESMBAGA1UECgwJQWNtZSwgSW5jMRowGAYJKoZIhvcNAQkBFgtmb29A\nYmFyLmNvbTAeFw0yMzAxMjMxODQ3MjNaFw0zMzAxMjAxODQ3MjNaMIGSMTEwLwYD\nVQQDDChmYW5jeS1jZXJ0LXVuc3VwcG9ydGVkLXN1YmotYW5kLWV4dC1vaWRzMQsw\nCQYDVQQGEwJVUzEPMA0GA1UECAwGS2Fuc2FzMQ8wDQYDVQQHDAZUb3Bla2ExEjAQ\nBgNVBAoMCUFjbWUsIEluYzEaMBgGCSqGSIb3DQEJARYLZm9vQGJhci5jb20wggEi\nMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDyYH5qS7krfZ2tA5uZsY2qXbTb\ntGNG1BsyDhZ/qqVlQybjDsHJZwNUbpfhBcCLaKyAwH1R9n54NOOOn6bYgfKWTgy3\nL7224YDAqYe7Y/GPjgI2MRvRfn6t2xzQxtJ0l0k8LeyNcwhiqYLQyOOfDdc127fm\nW40r2nmhLpH0i9e2I/YP1HQ+ldVgVBqeUTntgVSBfrQF56v9mAcvvHEa5sdHqmX4\nJ2lhWTnx9jqb7NZxCem76BlX1Gt5TpP3Ym2ZFVQI9fuPK4O8JVhk1KBCmIgR3Ft+\nPpFUs/c41EMunKJNzveYrInSDScaC6voIJpK23nMAiM1HckLfUUc/4UojD+VAgMB\nAAGjgdcwgdQwHQYDVR0OBBYEFH7tt4enejKTZtYjUKUUx6PXyzlgMB8GA1UdIwQY\nMBaAFH7tt4enejKTZtYjUKUUx6PXyzlgMA4GA1UdDwEB/wQEAwIFoDAgBgNVHSUB\nAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBCjBM\nBgNVHREERTBDhwTAngEmhgx1cmlTdXBwb3J0ZWSCEWRucy1OYW1lU3VwcG9ydGVk\noBoGAyoDBKATDBFleGFtcGxlIG90aGVybmFtZTANBgkqhkiG9w0BAQsFAAOCAQEA\nP6ckVJgbcJue+MK3RVDuG+Mh7dl89ynC7NwpQFRjLVZQuoMHZT/dcLlVeFejVXu5\nR+IPLmQU6NV7JAmy4zGap8awf12QTy3g410ecrSF94WWlu8bPoekfUnnP+kfzLPH\nCUAkRKxWDSRKX5C8cMMxacVBBaBIayuusLcHkHmxLLDw34PFzyz61gtZOJq7JYnD\nhU9YsNh6bCDmnBDBsDMOI7h8lBRQwTiWVoSD9YNVvFiY29YvFbJQGdh+pmBtf7E+\n1B/0t5NbvqlQSbhMM0QgYFhuCxr3BGNob7kRjgW4i+oh+Nc5ptA5q70QMaYudqRS\nd8SYWhRdxmH3qcHNPcR1iw==\n-----END CERTIFICATE-----`;
+// unsupportedPem is same cert as above, formatted differently
+const unsupportedPem = `
+-----BEGIN CERTIFICATE-----
+MIIEjDCCA3SgAwIBAgIUD4EeORgh/i+ZZFOk8KsGKQPWsoIwDQYJKoZIhvcNAQEL
+BQAwgZIxMTAvBgNVBAMMKGZhbmN5LWNlcnQtdW5zdXBwb3J0ZWQtc3Viai1hbmQt
+ZXh0LW9pZHMxCzAJBgNVBAYTAlVTMQ8wDQYDVQQIDAZLYW5zYXMxDzANBgNVBAcM
+BlRvcGVrYTESMBAGA1UECgwJQWNtZSwgSW5jMRowGAYJKoZIhvcNAQkBFgtmb29A
+YmFyLmNvbTAeFw0yMzAxMjMxODQ3MjNaFw0zMzAxMjAxODQ3MjNaMIGSMTEwLwYD
+VQQDDChmYW5jeS1jZXJ0LXVuc3VwcG9ydGVkLXN1YmotYW5kLWV4dC1vaWRzMQsw
+CQYDVQQGEwJVUzEPMA0GA1UECAwGS2Fuc2FzMQ8wDQYDVQQHDAZUb3Bla2ExEjAQ
+BgNVBAoMCUFjbWUsIEluYzEaMBgGCSqGSIb3DQEJARYLZm9vQGJhci5jb20wggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDyYH5qS7krfZ2tA5uZsY2qXbTb
+tGNG1BsyDhZ/qqVlQybjDsHJZwNUbpfhBcCLaKyAwH1R9n54NOOOn6bYgfKWTgy3
+L7224YDAqYe7Y/GPjgI2MRvRfn6t2xzQxtJ0l0k8LeyNcwhiqYLQyOOfDdc127fm
+W40r2nmhLpH0i9e2I/YP1HQ+ldVgVBqeUTntgVSBfrQF56v9mAcvvHEa5sdHqmX4
+J2lhWTnx9jqb7NZxCem76BlX1Gt5TpP3Ym2ZFVQI9fuPK4O8JVhk1KBCmIgR3Ft+
+PpFUs/c41EMunKJNzveYrInSDScaC6voIJpK23nMAiM1HckLfUUc/4UojD+VAgMB
+AAGjgdcwgdQwHQYDVR0OBBYEFH7tt4enejKTZtYjUKUUx6PXyzlgMB8GA1UdIwQY
+MBaAFH7tt4enejKTZtYjUKUUx6PXyzlgMA4GA1UdDwEB/wQEAwIFoDAgBgNVHSUB
+Af8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBCjBM
+BgNVHREERTBDhwTAngEmhgx1cmlTdXBwb3J0ZWSCEWRucy1OYW1lU3VwcG9ydGVk
+oBoGAyoDBKATDBFleGFtcGxlIG90aGVybmFtZTANBgkqhkiG9w0BAQsFAAOCAQEA
+P6ckVJgbcJue+MK3RVDuG+Mh7dl89ynC7NwpQFRjLVZQuoMHZT/dcLlVeFejVXu5
+R+IPLmQU6NV7JAmy4zGap8awf12QTy3g410ecrSF94WWlu8bPoekfUnnP+kfzLPH
+CUAkRKxWDSRKX5C8cMMxacVBBaBIayuusLcHkHmxLLDw34PFzyz61gtZOJq7JYnD
+hU9YsNh6bCDmnBDBsDMOI7h8lBRQwTiWVoSD9YNVvFiY29YvFbJQGdh+pmBtf7E+
+1B/0t5NbvqlQSbhMM0QgYFhuCxr3BGNob7kRjgW4i+oh+Nc5ptA5q70QMaYudqRS
+d8SYWhRdxmH3qcHNPcR1iw==
+-----END CERTIFICATE-----`;
+const certWithoutCN = `-----BEGIN CERTIFICATE-----\nMIIDUDCCAjigAwIBAgIUEUpM5i7XMd/imZkR9XvonMaqPyYwDQYJKoZIhvcNAQEL\nBQAwHDEaMBgGCSqGSIb3DQEJARYLZm9vQGJhci5jb20wHhcNMjMwMTIzMjMyODEw\nWhcNMzMwMTIwMjMyODEwWjAcMRowGAYJKoZIhvcNAQkBFgtmb29AYmFyLmNvbTCC\nASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPGSdeqLICZcoUzxk88F8Tp+\nVNI+mS74L8pHyb9ZNZfeXPo0E9L5pi+KKI7rkxAtBGUecG1ENSxDDK9p6XZhWHSU\nZ6bdjOsjcIlfiM+1hhtDclIVxIDnz2Jt1/Vmnm8DXwdwVATWiFLTnfm288deNwsT\npl0ehAR3BadkZvteC6t+giEw/4qm1/FP53GEBOQeUWJDZRvtL37rdx4joFv3cR4w\nV0dukOjc5AGXtIOorO145OSZj8s7RsW3pfGcFUcOg7/flDxfK1UqFflQa7veLvKa\nWE/fOMyB/711QjSkTuQ5Rw3Rf9Fr2pqVJQgElTIW1SKaX5EJTB9mtGB34UqUXtsC\nAwEAAaOBiTCBhjAdBgNVHQ4EFgQUyhFP/fm+798mErPD5VQvEaAZQrswHwYDVR0j\nBBgwFoAUyhFP/fm+798mErPD5VQvEaAZQrswDgYDVR0PAQH/BAQDAgWgMCAGA1Ud\nJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEK\nMA0GCSqGSIb3DQEBCwUAA4IBAQCishzVkhuSAtqxgsZdYzBs3GpakGIio5zReW27\n6dk96hYCbbe4K3DtcFbRD1B8t6aTJlHxkFRaOWErSXu9WP3fUhIDNRE64Qsrg1zk\n3Km430qBlorXmTp6xhYHQfY5bn5rT2YY7AmaYIlIFxRhod43i5GDbBP+e+d/vTqR\nv1AJflYofeR4LeATP64B6a4R+QQVoxI43+pyH3ka+nRHwJBR9h8SMtJoqBy7x9pl\nYlBDa8lSn05doA3+e03VIzitvBBWI4oX1XB0tShSLk6YJXayIwe0ZNVvfYLIRKCp\nb4DUwChYzG/FwFSssUAqzVFhu3i+uU3Z47bsLVm0R5m7hLiZ\n-----END CERTIFICATE-----`;
+
+// CROSS-SIGNING:
+const newCSR = {
+  common_name: 'Short-Lived Int R1',
+  csr: `-----BEGIN CERTIFICATE REQUEST-----\nMIICYjCCAUoCAQAwHTEbMBkGA1UEAxMSU2hvcnQtTGl2ZWQgSW50IFIxMIIBIjAN\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqsvFU7lzt06n1w6BL+Waf9zd+Z3G\n90Kv0HAksoLaWYinhkxNIUTU8ar9HLa2WV4EoJbNq91Hn+jFc2SYEXtRV+jm0kEh\nz4C4AoQ4D0s83JcYNssiNbVA04wa5ovD0iA/pzwVz8TnJSfAAuZ3vXFlyIbQ3ESo\nzt9hGjo/JOpoBh67E7xkuzw4lnC2rXGHdh9pk1Di+wqREnKU4nuhDLnTC/LL+Mkm\n07F1aMAW3Z/PWFmmsDJHMhZnaYo2LGCwU4A0U1ED0XpwflobVbkzZDmCXOPEI8UX\nG6VcL36zWnzEQnlZKN91MAa+s0E4z40KHKVSblSkjYD1K6n0y787ic2mDwIDAQAB\noAAwDQYJKoZIhvcNAQELBQADggEBAFQtiJaRfaQS3jHr7aFeszB/JmDRQiOoML3g\nhA3EcVd2rvDjiqikwD9EFdLTJyYJfb+9yiKDJqB7Fw2GPSrFxrd+jC9qZRI3VEWK\n8VdflLbruc1FcqJcE/0z2hWa11eud1bMLq8U6AfxNHL4r4ukrp2D5elrdsrDnhZj\nwMi3FtEFd4RZVaWZYVmWcQTeH7Zz/LYwkVDgBuvC+SOCaNNo/dCurkAAoxw8obBj\n1FS2F/3oHQxMui8vS8j6sMWMPZ5D3Q0xSC3HBUNoI2ZC77Mxn9yfj6ianUXKOOlf\nQMRaPBVajxZm9ovV64QKr+7HK7W7U/fNEqvoKBUDCqEuWmSsxMk=\n-----END CERTIFICATE REQUEST-----`,
+};
+
+const oldParentIssuerCert = `-----BEGIN CERTIFICATE-----\nMIIDKzCCAhOgAwIBAgIUMCEF+bzBC4NQIWjE1sv/RbnYfUgwDQYJKoZIhvcNAQEL\nBQAwHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgxMB4XDTIzMDEyNTAwMjQz\nM1oXDTIzMDIyNjAwMjUwM1owHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgx\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0zrpJvjWcBV49Eor+zfh\nGW40xH6PcPSpzWGCCFiMPFwKrBSjuGRwwkLsXU7u2P15jIV/IU2kPS+WOW+EIe0x\ns5X2SoujZGOmM6du/6HIo9lz9yjb5G1SHdv/e65Q45QWb6wQcuO4axffvPzmAU9L\nQcunEF4g3rCz4cHYumi0osybbwR45z+8owNhykdbu7AwV0Cyz3C/lT1wxDxbFr0Y\n1NEjQ8AF4oRzqkmGoLp6ixDxp8zMpOlKWWYem1mx0RbqlwLP7khiS5YKi8+j8aog\nOhHA/W4i+ihrBzkv4GtOSdkhJz5qacifydUXtJ7SmvYs9Fi+hFgw61sw23ywbr3+\nywIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV\nHQ4EFgQUQsdYFMtsNMYNDIhZHMd77kcLLi8wHwYDVR0jBBgwFoAUQsdYFMtsNMYN\nDIhZHMd77kcLLi8wDQYJKoZIhvcNAQELBQADggEBAFNKTnNUzjZGHpXVK9Go8k/i\nVMNBktjGp58z+EN32TJnq/tOW1eVswUmq71S3R16Iho4XZDZVchuK+zhqSwlAmgM\no1vs6L5IJ0rVZcLZpysxFtawlbA362zBOX0F7tqStdEeBWaXw6J+MQ26xAPgHjXo\nc3fqqNWGbrOPt1uFoXWD+0Bg8M90a7OT0ijubh/PcuCe1yF9G2BqRQruB05gZiHl\n0NGbUka1ntD/lxYfLeSnp+FHJVDrcAHwPhKQS8HHr/ZBjKEGY8In+JIi/KBV/M8b\nGeW2k5odl6r2UIR6PWSei1WKKHe09WzO7rGJaN6uKLP14c0nSF3/q+AQY3m+tPY=\n-----END CERTIFICATE-----\n`;
+const parentIssuerCert = `-----BEGIN CERTIFICATE-----\nMIIDKzCCAhOgAwIBAgIUBxLeuD3K0hF5dGpaEgZqytTN3lswDQYJKoZIhvcNAQEL\nBQAwHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgyMB4XDTIzMDEyNTAwMjQz\nM1oXDTIzMDIyNjAwMjUwM1owHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgy\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuqkwN4m5dFLwFi0iYs4r\nTO4HWzloF4yCOaNfVksh1cOafVu9vjFwOWgHZFe6h8BOn6biKdFtvGTyIzlMHe5t\nyFmec9pfjX243bH9Ev4n2RTMKs818g9LdoZT6SI7DxHEu3yuHBg9TM87+GB+dA1V\nkRsK5hgtNCSMdgFSljM169sYbNilpk8M7O2hr+AmgRi0c1nUEPCe4JAr0Zv8iweJ\ntFRVHiQJXD9WIVxaWVxqWFsHoXseZS7H76RSdf4jNfENmBguHZMAPhtqlc/pMan8\nu0IJETWjWENn+WYC7DnnfQtNqyebU2LdT3oKO8tELqITygjT2tCS1Zavmsy69VY0\nYwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV\nHQ4EFgQUxgchIBo+1F++IFW0F586I5QDFGYwHwYDVR0jBBgwFoAUxgchIBo+1F++\nIFW0F586I5QDFGYwDQYJKoZIhvcNAQELBQADggEBAI6DdnW8q/FqGqk/Y0k7iUrZ\nYkfMRlss6uBTzLev53eXqFIJ3+EFVfV+ohDEedlYYm2QCELzQcJSR7Q2I22PQj8X\nTO0yqk6LOCMv/4yiDhF4D+haiDU4joq5GX1dpFdlNSQ5fJmnLKu8HYbOhbwUo4ns\n4yGzIMulZR1Zqf/HGEOCYPDQ0ZHucmHn7uGhmV+kgYGoKVEZ8XxfmyNPKuwTAUHL\nfInPJZtbxXTVmiWWy3iraeI4XcUvaD0JtVnsVphYrqrSZ60DjgFsjiyenxePGHXf\nYXV9HIS6OXlvWhJKlSINOTv9fAa+e+JtK7frdvxJNHoTG34PiGXfOV2swTvLJQo=\n-----END CERTIFICATE-----\n`;
+const intIssuerCert = `-----BEGIN CERTIFICATE-----\nMIIDKzCCAhOgAwIBAgIUPt5VyO6gyA4hVaMkdpNyBlP+I64wDQYJKoZIhvcNAQEL\nBQAwHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgxMB4XDTIzMDEyNTAwMjQz\nM1oXDTIzMDIyNjAwMjUwM1owHTEbMBkGA1UEAxMSU2hvcnQtTGl2ZWQgSW50IFIx\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqsvFU7lzt06n1w6BL+Wa\nf9zd+Z3G90Kv0HAksoLaWYinhkxNIUTU8ar9HLa2WV4EoJbNq91Hn+jFc2SYEXtR\nV+jm0kEhz4C4AoQ4D0s83JcYNssiNbVA04wa5ovD0iA/pzwVz8TnJSfAAuZ3vXFl\nyIbQ3ESozt9hGjo/JOpoBh67E7xkuzw4lnC2rXGHdh9pk1Di+wqREnKU4nuhDLnT\nC/LL+Mkm07F1aMAW3Z/PWFmmsDJHMhZnaYo2LGCwU4A0U1ED0XpwflobVbkzZDmC\nXOPEI8UXG6VcL36zWnzEQnlZKN91MAa+s0E4z40KHKVSblSkjYD1K6n0y787ic2m\nDwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV\nHQ4EFgQUkBK+oGpo5DNj2pCKoUE08WFOxQUwHwYDVR0jBBgwFoAUQsdYFMtsNMYN\nDIhZHMd77kcLLi8wDQYJKoZIhvcNAQELBQADggEBAIf4Bp/NYftiN8LmQrVzPWAe\nc4Bxm/NFFtkwQEvFhndMN68MUyXa5yxAdnYAHN+fRpYPxbjoZNXjW/jx3Kjft44r\ntyNGrrkjR80TI9FbL53nN7hLtZQdizsQD0Wype4Q1JOIxYw2Wd5Hr/PVPrJZ3PGg\nwNeI5IRu/cVbVT/vkRaHqYSwpa+V2cZTaEk6h62KPaKu3ui+omoeitU6qXHOysXQ\nrdGkJl/x831sIKmN0dMiGeoJdHGAr/E2f3ijKbVPsjIxZbm2SSumldOFYWn9cNYD\nI6sizFH976Wpde/GRIvBIzJnlK3xgfy0D9AUvwKyt75PVEnshc9tlhxoSVlKaUE=\n-----END CERTIFICATE-----\n`;
+const newlySignedCert = `-----BEGIN CERTIFICATE-----\nMIIDKzCCAhOgAwIBAgIUKapKK5Coau2sfIJgqA9jcC6BkWIwDQYJKoZIhvcNAQEL\nBQAwHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgyMB4XDTIzMDEyNTIyMjky\nNVoXDTIzMDIyNjIyMjk1NVowHTEbMBkGA1UEAxMSU2hvcnQtTGl2ZWQgSW50IFIx\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqsvFU7lzt06n1w6BL+Wa\nf9zd+Z3G90Kv0HAksoLaWYinhkxNIUTU8ar9HLa2WV4EoJbNq91Hn+jFc2SYEXtR\nV+jm0kEhz4C4AoQ4D0s83JcYNssiNbVA04wa5ovD0iA/pzwVz8TnJSfAAuZ3vXFl\nyIbQ3ESozt9hGjo/JOpoBh67E7xkuzw4lnC2rXGHdh9pk1Di+wqREnKU4nuhDLnT\nC/LL+Mkm07F1aMAW3Z/PWFmmsDJHMhZnaYo2LGCwU4A0U1ED0XpwflobVbkzZDmC\nXOPEI8UXG6VcL36zWnzEQnlZKN91MAa+s0E4z40KHKVSblSkjYD1K6n0y787ic2m\nDwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV\nHQ4EFgQUkBK+oGpo5DNj2pCKoUE08WFOxQUwHwYDVR0jBBgwFoAUxgchIBo+1F++\nIFW0F586I5QDFGYwDQYJKoZIhvcNAQELBQADggEBAJaems1vgEjxgb3d1y9PYxzN\nLZbuf/+0+BCVa9k4bEsbuhXhEecFdIi2OKS6fabeoEOF97Gvqrgc+LEpNsU6lIRA\nkJ/nHe0CD2hf0aBQsGsOllYy/4QnrPlbowb4KizPknEMWdGcvfnlzzOJzo4/UuMk\nMZ9vn2GrINzfml/sLocOzP/MsPd8bBhXI2Emh2O9tJ4+zeHLhEzcM1gdNk8pp+wP\nEOks0EcN4UBkpEnDZcDTJVgp9XpWy19EEGqsxjBq6rlpIvPW8XHoH1jZSGY1KWBJ\nRGtDcGugwTxO9jYHz/a1qu4BVt5FFcb0L3IOvcr+3QCCeiJQHcVY8QRbO9M4AQk=\n-----END CERTIFICATE-----\n`;
+// both certs generated with key type ed25519
+const unsupportedSignatureRoot = `-----BEGIN CERTIFICATE-----\nMIIBXTCCAQ+gAwIBAgIUcp9CkzsU5Pkv2ZJO8Gp+tJrzuJYwBQYDK2VwMBIxEDAO\nBgNVBAMTB215LXJvb3QwHhcNMjMwNzE4MTYyNzQ3WhcNMjMwODE5MTYyODE3WjAS\nMRAwDgYDVQQDEwdteS1yb290MCowBQYDK2VwAyEAmZ+By07QvgAEX1HRjhltJlgK\nA8il2LYUpH0uw7f2lXCjdzB1MA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTAD\nAQH/MB0GA1UdDgQWBBTAcYaOaiKhDmYqSe6vg/lAtYspkDAfBgNVHSMEGDAWgBTA\ncYaOaiKhDmYqSe6vg/lAtYspkDASBgNVHREECzAJggdteS1yb290MAUGAytlcANB\nAG9xXZnKNEXRyfa91hm9S80PwlwIMh4MkWetwfPBn3M74cHzDK1okANmweca4RRq\nQHDPT7shx3CuosvL2Ori/ws=\n-----END CERTIFICATE-----`;
+const unsupportedSignatureInt = `-----BEGIN CERTIFICATE-----\nMIICfTCCAWWgAwIBAgIUei2XIhhsP1/ytDciEGfA1C7t/sMwDQYJKoZIhvcNAQEL\nBQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wHhcNMjMwNzE4MTg1NDA3WhcNMjMw\nODE5MTg1NDM3WjASMRAwDgYDVQQDEwdpbnQtY3NyMCowBQYDK2VwAyEAa9vHnJA3\nnzA/fYiTUg8EhomjMtVp5O2c01nQRXEv72OjgcAwgb0wDgYDVR0PAQH/BAQDAgEG\nMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGtjjUwrRGmFmYBHrUE38tSxvVM3\nMB8GA1UdIwQYMBaAFNng9+uArFyIUcD23XdvCSIfYiDPMEYGCCsGAQUFBwEBBDow\nODAZBggrBgEFBQcwAoYNaGFzaGljb3JwLmNvbTAbBggrBgEFBQcwAoYPdmF1bHRw\ncm9qZWN0LmlvMBIGA1UdEQQLMAmCB2ludC1jc3IwDQYJKoZIhvcNAQELBQADggEB\nAAOSNgZjesJG4BgLU8jQmOO7n6W8WcR+dT+ELDC1nLlEZ2BJCDSXXUX8AihIHKxn\nA9W4slABUacyJlAZo/o/wcxyfbA6PUXmHnoqEPZ3zXMwuLN/iRW7/uQvI6TIwnpH\nXETFARLmK8cfGgbhi24STkHTF4ljczkOab7sTUQTHELlo+F2gNtmgnyaBFCGUYor\nX1pkMBcBa9BWRsfhy8E+tBVVUrNNUddwzC/5nMLqT8XqENMndDoG7eeT9Ex6otZy\nzURkcq09FtcmyY2RBYkV4UzyHN7cESMIk/J33ZCNAfHaDGuOqTy5nYU5fTtjJcit\nwEcWiSesrKPCletBpuMpgiU=\n-----END CERTIFICATE-----\n`;
+
+export const CERTIFICATES = {
+  rootPem,
+  rootDer,
+  issuerPemBundle,
+  csr,
+  csr2,
+  componentPemBundle,
+  loadedCert,
+  pssTrueCert,
+  skeletonCert,
+  unsupportedOids,
+  unsupportedPem,
+  certWithoutCN,
+  newCSR,
+  oldParentIssuerCert,
+  parentIssuerCert,
+  intIssuerCert,
+  newlySignedCert,
+  unsupportedSignatureRoot,
+  unsupportedSignatureInt,
+};
diff --git a/ui/tests/helpers/pki/pki-issuer-cross-sign.js b/ui/tests/helpers/pki/pki-issuer-cross-sign.js
deleted file mode 100644
index 20fc5934182..00000000000
--- a/ui/tests/helpers/pki/pki-issuer-cross-sign.js
+++ /dev/null
@@ -1,23 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { SELECTORS as CONFIGURE } from './pki-configure-create';
-import { SELECTORS as DETAILS } from './pki-issuer-details';
-
-export const SELECTORS = {
-  objectListInput: (key, row = 0) => `[data-test-object-list-input="${key}-${row}"]`,
-  inputByName: (name) => `[data-test-input="${name}"]`,
-  addRow: '[data-test-object-list-add-button',
-  submitButton: '[data-test-cross-sign-submit]',
-  cancelButton: '[data-test-cross-sign-cancel]',
-  statusCount: '[data-test-cross-sign-status-count]',
-  signedIssuerRow: (row = 0) => `[data-test-info-table-row="${row}"]`,
-  signedIssuerCol: (attr) => `[data-test-info-table-column="${attr}"]`,
-  // for cross signing acceptance tests
-  configure: { ...CONFIGURE },
-  details: { ...DETAILS },
-  rowValue: (attr) => `[data-test-row-value="${attr}"]`,
-  copyButton: (attr) => `[data-test-value-div="${attr}"] [data-test-copy-button]`,
-};
diff --git a/ui/tests/helpers/pki/pki-issuer-details.js b/ui/tests/helpers/pki/pki-issuer-details.js
deleted file mode 100644
index 94bb801e98d..00000000000
--- a/ui/tests/helpers/pki/pki-issuer-details.js
+++ /dev/null
@@ -1,21 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  configure: '[data-test-pki-issuer-configure]',
-  copyButtonByName: (name) => `[data-test-value-div="${name}"] [data-test-copy-button]`,
-  crossSign: '[data-test-pki-issuer-cross-sign]',
-  defaultGroup: '[data-test-details-group="default"]',
-  download: '[data-test-issuer-download]',
-  groupTitle: '[data-test-group-title]',
-  parsingAlertBanner: '[data-test-parsing-error-alert-banner]',
-  rotateModal: '#pki-rotate-root-modal',
-  rotateModalGenerate: '[data-test-root-rotate-step-one]',
-  rotateRoot: '[data-test-pki-issuer-rotate-root]',
-  row: '[data-test-component="info-table-row"]',
-  signIntermediate: '[data-test-pki-issuer-sign-int]',
-  urlsGroup: '[data-test-details-group="Issuer URLs"]',
-  valueByName: (name) => `[data-test-value-div="${name}"]`,
-};
diff --git a/ui/tests/helpers/pki/pki-key-form.js b/ui/tests/helpers/pki/pki-key-form.js
deleted file mode 100644
index cc1e738a2c1..00000000000
--- a/ui/tests/helpers/pki/pki-key-form.js
+++ /dev/null
@@ -1,15 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  keyCreateButton: '[data-test-pki-key-save]',
-  keyCancelButton: '[data-test-pki-key-cancel]',
-  keyNameInput: '[data-test-input="keyName"]',
-  typeInput: '[data-test-input="type"]',
-  keyTypeInput: '[data-test-input="keyType"]',
-  keyBitsInput: '[data-test-input="keyBits"]',
-  validationError: '[data-test-pki-key-validation-error]',
-  fieldErrorByName: (name) => `[data-test-field-validation="${name}"]`,
-};
diff --git a/ui/tests/helpers/pki/pki-not-valid-after-form.js b/ui/tests/helpers/pki/pki-not-valid-after-form.js
deleted file mode 100644
index 4f7ed34f8f9..00000000000
--- a/ui/tests/helpers/pki/pki-not-valid-after-form.js
+++ /dev/null
@@ -1,15 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  radioTtl: '[data-test-radio-button="ttl"]',
-  radioTtlLabel: '[data-test-radio-label="ttl"]',
-  radioDate: '[data-test-radio-button="not_after"]',
-  radioDateLabel: '[data-test-radio-label="specificDate"]',
-  ttlForm: '[data-test-ttl-inputs]',
-  ttlTimeInput: '[data-test-ttl-value="TTL"]',
-  ttlUnitInput: '[data-test-select="ttl-unit"]',
-  dateInput: '[data-test-input="not_after"]',
-};
diff --git a/ui/tests/helpers/pki/pki-role-form.js b/ui/tests/helpers/pki/pki-role-form.js
deleted file mode 100644
index 49a9d36b30d..00000000000
--- a/ui/tests/helpers/pki/pki-role-form.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const PKI_BASE_URL = `/vault/cluster/secrets/backend/pki/roles`;
-
-export const SELECTORS = {
-  roleName: '[data-test-input="name"]',
-  issuerRef: '[data-test-input="issuerRef"]',
-  issuerRefSelect: '[data-test-select="issuerRef"]',
-  issuerRefToggle: '[data-test-toggle-label="issuerRef-toggle"]',
-  customTtl: '[data-test-field="customTtl"]',
-  backdateValidity: '[data-test-ttl-value="Backdate validity"]',
-  maxTtl: '[data-test-toggle-label="Max TTL"]',
-  generateLease: '[data-test-field="generateLease"]',
-  noStore: '[data-test-field="noStore"]',
-  addBasicConstraints: '[data-test-input="addBasicConstraints"]',
-  domainHandling: '[data-test-toggle-group="Domain handling"]',
-  keyParams: '[data-test-toggle-group="Key parameters"]',
-  keyType: '[data-test-input="keyType"]',
-  keyBits: '[data-test-input="keyBits"]',
-  signatureBits: '[data-test-input="signatureBits"]',
-  keyUsage: '[data-test-toggle-group="Key usage"]',
-  extKeyUsageOids: '[data-test-input="extKeyUsageOids"]',
-  digitalSignature: '[data-test-checkbox="DigitalSignature"]',
-  keyAgreement: '[data-test-checkbox="KeyAgreement"]',
-  keyEncipherment: '[data-test-checkbox="KeyEncipherment"]',
-  any: '[data-test-checkbox="Any"]',
-  serverAuth: '[data-test-checkbox="ServerAuth"]',
-  policyIdentifiers: '[data-test-toggle-group="Policy identifiers"]',
-  san: '[data-test-toggle-group="Subject Alternative Name (SAN) Options"]',
-  additionalSubjectFields: '[data-test-toggle-group="Additional subject fields"]',
-  roleCreateButton: '[data-test-pki-role-save]',
-  roleCancelButton: '[data-test-pki-role-cancel]',
-};
diff --git a/ui/tests/helpers/pki/pki-role-generate.js b/ui/tests/helpers/pki/pki-role-generate.js
deleted file mode 100644
index 26a101763e9..00000000000
--- a/ui/tests/helpers/pki/pki-role-generate.js
+++ /dev/null
@@ -1,19 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export const SELECTORS = {
-  form: '[data-test-pki-generate-cert-form]',
-  commonNameField: '[data-test-input="commonName"]',
-  optionsToggle: '[data-test-toggle-group="Subject Alternative Name (SAN) Options"]',
-  generateButton: '[data-test-pki-generate-button]',
-  cancelButton: '[data-test-pki-generate-cancel]',
-  downloadButton: '[data-test-pki-cert-download-button]',
-  revokeButton: '[data-test-pki-cert-revoke-button]',
-  serialNumber: '[data-test-value-div="Serial number"]',
-  certificate: '[data-test-value-div="Certificate"]',
-  inlineAlert: '[data-test-alert]',
-  commonNameInlineError: '[data-test-field="commonName"] [data-test-inline-alert]',
-  commonNameErrorBorder: '[data-test-input="commonName"]',
-};
diff --git a/ui/tests/helpers/pki/pki-run-commands.js b/ui/tests/helpers/pki/pki-run-commands.js
deleted file mode 100644
index 631a6507c54..00000000000
--- a/ui/tests/helpers/pki/pki-run-commands.js
+++ /dev/null
@@ -1,22 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// Clears pki-related data and capabilities so that admin
-// capabilities from setup don't rollover
-export function clearRecords(store) {
-  store.unloadAll('pki/action');
-  store.unloadAll('pki/issuer');
-  store.unloadAll('pki/key');
-  store.unloadAll('pki/role');
-  store.unloadAll('pki/sign-intermediate');
-  store.unloadAll('pki/tidy');
-  store.unloadAll('pki/config/urls');
-  store.unloadAll('pki/config/crl');
-  store.unloadAll('pki/config/cluster');
-  store.unloadAll('pki/config/acme');
-  store.unloadAll('pki/certificate/generate');
-  store.unloadAll('pki/certificate/sign');
-  store.unloadAll('capabilities');
-}
diff --git a/ui/tests/helpers/pki/pki-selectors.ts b/ui/tests/helpers/pki/pki-selectors.ts
new file mode 100644
index 00000000000..66d2a49ed38
--- /dev/null
+++ b/ui/tests/helpers/pki/pki-selectors.ts
@@ -0,0 +1,215 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { GENERAL } from '../general-selectors';
+
+export const PKI_OVERVIEW = {
+  issueCertificateInput: '[data-test-issue-certificate-input]',
+  issueCertificatePowerSearch: '[data-test-issue-certificate-input] span',
+  issueCertificateButton: '[data-test-issue-certificate-button]',
+  viewCertificateInput: '[data-test-view-certificate-input]',
+  viewCertificatePowerSearch: '[data-test-view-certificate-input] span',
+  viewCertificateButton: '[data-test-view-certificate-button]',
+  viewIssuerPowerSearch: '[data-test-issue-issuer-input] span',
+  viewIssuerButton: '[data-test-view-issuer-button]',
+  firstPowerSelectOption: '[data-option-index="0"]',
+};
+
+// COMPONENTS
+export const PKI_CONFIGURE_CREATE = {
+  // page::pki-configure-create
+  nextStepsBanner: '[data-test-config-next-steps]',
+  option: '[data-test-pki-config-option]',
+  optionByKey: (key: string) => `[data-test-pki-config-option="${key}"]`,
+  doneButton: '[data-test-done]',
+  configureButton: '[data-test-configure-pki-button]',
+  // pki-generate-root
+  generateRootOption: '[data-test-pki-config-option="generate-root"]',
+  // pki-ca-cert-import
+  importForm: '[data-test-pki-import-pem-bundle-form]',
+  importSubmit: '[data-test-pki-import-pem-bundle]',
+  importSectionLabel: '[data-test-import-section-label]',
+  importMapping: '[data-test-imported-bundle-mapping]',
+  importedIssuer: '[data-test-imported-issuer]',
+  importedKey: '[data-test-imported-key]',
+  // generate-intermediate
+  csrDetails: '[data-test-generate-csr-result]',
+};
+
+export const PKI_DELETE_ALL_ISSUERS = {
+  issuerLink: '[data-test-delete-all-issuers-link]',
+  deleteAllIssuerModal: '#confirmation-modal',
+  deleteAllIssuerInput: '[data-test-confirmation-modal-input="Delete all issuers?"]',
+};
+
+export const PKI_GENERATE_ROOT = {
+  mainSectionTitle: '[data-test-generate-root-title="Root parameters"]',
+  urlSectionTitle: '[data-test-generate-root-title="Issuer URLs"]',
+  toggleGroupDescription: '[data-test-toggle-group-description]',
+  groupFields: (group: string) => `[data-test-group="${group}"] [data-test-field]`,
+  formInvalidError: '[data-test-pki-generate-root-validation-error]',
+  urlsSection: '[data-test-urls-section]',
+  urlField: '[data-test-urls-section] [data-test-input]',
+  // Shown values after save
+  saved: {
+    certificate: `${GENERAL.infoRowValue('Certificate')} [data-test-certificate-card]`,
+    commonName: GENERAL.infoRowValue('Common name'),
+    issuerName: GENERAL.infoRowValue('Issuer name'),
+    issuerLink: `${GENERAL.infoRowValue('Issuer ID')} a`,
+    keyName: GENERAL.infoRowValue('Key name'),
+    keyLink: `${GENERAL.infoRowValue('Key ID')} a`,
+    privateKey: `${GENERAL.infoRowValue('Private key')} [data-test-certificate-card]`,
+    serialNumber: GENERAL.infoRowValue('Serial number'),
+  },
+};
+
+export const PKI_CROSS_SIGN = {
+  objectListInput: (key: string, row = 0) => `[data-test-object-list-input="${key}-${row}"]`,
+  addRow: '[data-test-object-list-add-button',
+  statusCount: '[data-test-cross-sign-status-count]',
+  signedIssuerRow: (row = 0) => `[data-test-info-table-row="${row}"]`,
+  signedIssuerCol: (attr: string) => `[data-test-info-table-column="${attr}"]`,
+  rowValue: (attr: string) => `[data-test-row-value="${attr}"]`, // TODO replace with the GENERAL.infoRowValue
+  copyButton: (attr: string) => `[data-test-row-value="${attr}"] ${GENERAL.copyButton}`,
+};
+
+export const PKI_ISSUER_DETAILS = {
+  configure: '[data-test-pki-issuer-configure]',
+  copyButtonByName: (name: string) => `[data-test-row-value="${name}"] ${GENERAL.copyButton}`,
+  crossSign: '[data-test-pki-issuer-cross-sign]',
+  defaultGroup: '[data-test-details-group="default"]',
+  download: '[data-test-issuer-download]',
+  groupTitle: '[data-test-group-title]',
+  parsingAlertBanner: '[data-test-parsing-error-alert-banner]',
+  rotateModal: '#pki-rotate-root-modal',
+  rotateModalGenerate: '[data-test-root-rotate-step-one]',
+  rotateRoot: '[data-test-pki-issuer-rotate-root]',
+  row: '[data-test-component="info-table-row"]',
+  signIntermediate: '[data-test-pki-issuer-sign-int]',
+  urlsGroup: '[data-test-details-group="Issuer URLs"]',
+};
+
+export const PKI_KEY_FORM = {
+  validationError: '[data-test-pki-key-validation-error]',
+};
+
+export const PKI_NOT_VALID_AFTER = {
+  radioTtl: '[data-test-radio-button="ttl"]',
+  radioTtlLabel: '[data-test-radio-label="ttl"]',
+  radioDate: '[data-test-radio-button="not_after"]',
+  radioDateLabel: '[data-test-radio-label="specificDate"]',
+  ttlForm: '[data-test-ttl-inputs]',
+  ttlTimeInput: '[data-test-ttl-value="TTL"]',
+  ttlUnitInput: '[data-test-select="ttl-unit"]',
+  dateInput: '[data-test-input="not_after"]',
+};
+
+export const PKI_ROLE_FORM = {
+  digitalSignature: '[data-test-checkbox="DigitalSignature"]',
+  keyAgreement: '[data-test-checkbox="KeyAgreement"]',
+  keyEncipherment: '[data-test-checkbox="KeyEncipherment"]',
+  any: '[data-test-checkbox="Any"]',
+  serverAuth: '[data-test-checkbox="ServerAuth"]',
+};
+
+export const PKI_ROLE_GENERATE = {
+  form: '[data-test-pki-generate-cert-form]',
+  downloadButton: '[data-test-pki-cert-download-button]',
+  revokeButton: '[data-test-pki-cert-revoke-button]',
+};
+
+// PAGES
+export const PKI_CONFIG_EDIT = {
+  errorBanner: '[data-test-config-edit-error]',
+  acmeEditSection: '[data-test-acme-edit-section]',
+  configEditSection: '[data-test-cluster-config-edit-section]',
+  configInput: (attr: string) => `[data-test-input="${attr}"]`,
+  stringListInput: (attr: string) => `[data-test-input="${attr}"] [data-test-string-list-input="0"]`,
+  urlsEditSection: '[data-test-urls-edit-section]',
+  urlFieldInput: (attr: string) => `[data-test-input="${attr}"] textarea`,
+  urlFieldLabel: (attr: string) => `[data-test-input="${attr}"] label`,
+  crlEditSection: '[data-test-crl-edit-section]',
+  crlToggleInput: (attr: string) => `[data-test-input="${attr}"] input`,
+  crlTtlInput: (attr: string) => `[data-test-ttl-value="${attr}"]`,
+  crlFieldLabel: (attr: string) => `[data-test-input="${attr}"] label`,
+  saveButton: '[data-test-configuration-edit-save]',
+  cancelButton: '[data-test-configuration-edit-cancel]',
+  validationAlert: '[data-test-configuration-edit-validation-alert]',
+  deleteButton: (attr: string) => `[data-test-input="${attr}"] [data-test-string-list-button="delete"]`,
+  groupHeader: (group: string) => `[data-test-crl-header="${group}"]`,
+  checkboxInput: (attr: string) => `[data-test-input="${attr}"]`,
+};
+
+export const PKI_ISSUER_LIST = {
+  // Page::PkiIssuerList
+  issuerListItem: (id: string) => `[data-test-issuer-list="${id}"]`,
+  importIssuerLink: '[data-test-generate-issuer="import"]',
+  generateIssuerDropdown: '[data-test-issuer-generate-dropdown]',
+  generateIssuerRoot: '[data-test-generate-issuer="root"]',
+  generateIssuerIntermediate: '[data-test-generate-issuer="intermediate"]',
+  issuerPopupDetails: '[data-test-pki-issuer-details]',
+};
+
+export const PKI_KEYS = {
+  // key index
+  importKey: '[data-test-pki-key-import]',
+  generateKey: '[data-test-pki-key-generate]',
+  keyId: '[data-test-key="id"]',
+  keyName: '[data-test-key="name"]',
+  popupMenuDetails: '[data-test-key-menu-link="details"]',
+  popupMenuEdit: '[data-test-key-menu-link="edit"]',
+  // key details
+  keyDeleteButton: '[data-test-pki-key-delete]',
+  keyEditLink: '[data-test-pki-key-edit]',
+  nextStepsAlert: '[data-test-pki-key-next-steps]',
+};
+
+export const PKI_ROLE_DETAILS = {
+  issuerLabel: '[data-test-row-label="Issuer"]',
+  noStoreValue: GENERAL.infoRowValue('Store in storage backend'),
+  noStoreMetadataValue: GENERAL.infoRowValue('Store metadata in storage backend'),
+  keyUsageValue: GENERAL.infoRowValue('Key usage'),
+  extKeyUsageValue: GENERAL.infoRowValue('Ext key usage'),
+  customTtlValue: GENERAL.infoRowValue('Issued certificates expire after'),
+  deleteRoleButton: '[data-test-pki-role-delete]',
+  generateCertLink: '[data-test-pki-role-generate-cert]',
+  signCertLink: '[data-test-pki-role-sign-cert]',
+  editRoleLink: '[data-test-pki-role-edit-link]',
+  createRoleLink: '[data-test-pki-role-create-link]',
+};
+
+export const PKI_TIDY_FORM = {
+  tidyFormName: (attr: string) => `[data-test-tidy-form="${attr}"]`,
+  inputByAttr: (attr: string) => `[data-test-input="${attr}"]`,
+  toggleInput: (attr: string) => `[data-test-input="${attr}"] input`,
+  acmeAccountSafetyBuffer: '[data-test-ttl-value="Tidy ACME enabled"]',
+  toggleLabel: (label: string) => `[data-test-toggle-label="${label}"]`,
+  tidySectionHeader: (header: string) => `[data-test-tidy-header="${header}"]`,
+  tidySave: '[data-test-pki-tidy-button]',
+  tidyCancel: '[data-test-pki-tidy-cancel]',
+  tidyPauseDuration: '[data-test-ttl-value="Pause duration"]',
+  editAutoTidyButton: '[data-test-pki-edit-tidy-auto-link]',
+};
+
+export const PKI_TIDY = {
+  hdsAlertTitle: '[data-test-tidy-status-alert-title]',
+  hdsAlertDescription: '[data-test-tidy-status-alert-description]',
+  alertUpdatedAt: '[data-test-tidy-status-alert-updated-at]',
+  cancelTidyAction: '[data-test-cancel-tidy-action]',
+  hdsAlertButtonText: '[data-test-cancel-tidy-action] .hds-button__text',
+  timeStartedRow: GENERAL.infoRowValue('Time started'),
+  timeFinishedRow: GENERAL.infoRowValue('Time finished'),
+  cancelTidyModalBackground: '#pki-cancel-tidy-modal',
+  tidyEmptyStateConfigure: '[data-test-tidy-empty-state-configure]',
+  manualTidyToolbar: '[data-test-pki-manual-tidy-config]',
+  autoTidyToolbar: '[data-test-pki-auto-tidy-config]',
+  tidyConfigureModal: {
+    configureTidyModal: '#pki-tidy-modal',
+    tidyModalAutoButton: '[data-test-tidy-modal-auto-button]',
+    tidyModalManualButton: '[data-test-tidy-modal-manual-button]',
+    tidyModalCancelButton: '[data-test-tidy-modal-cancel-button]',
+    tidyOptionsModal: '[data-test-pki-tidy-options-modal]',
+  },
+};
diff --git a/ui/tests/helpers/pki/policy-generator.ts b/ui/tests/helpers/pki/policy-generator.ts
new file mode 100644
index 00000000000..a35d8274155
--- /dev/null
+++ b/ui/tests/helpers/pki/policy-generator.ts
@@ -0,0 +1,57 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { singularize } from 'ember-inflector';
+
+export const adminPolicy = (mountPath: string) => {
+  return `
+    path "${mountPath}/*" {
+      capabilities = ["create", "read", "update", "delete", "list"]
+    },
+  `;
+};
+
+// keys require singularized paths for GET
+export const readerPolicy = (mountPath: string, resource: string) => {
+  return `
+    path "${mountPath}/${resource}" {
+      capabilities = ["read", "list"]
+    },
+    path "${mountPath}/${resource}/*" {
+      capabilities = ["read", "list"]
+    },
+    path "${mountPath}/${singularize(resource)}" {
+      capabilities = ["read", "list"]
+    },
+    path "${mountPath}/${singularize(resource)}/*" {
+      capabilities = ["read", "list"]
+    },
+  `;
+};
+export const updatePolicy = (mountPath: string, resource: string) => {
+  return `
+    path "${mountPath}/${resource}" {
+      capabilities = ["read", "list"]
+    },
+    path "${mountPath}/${resource}/*" {
+      capabilities = ["read", "update"]
+    },
+    path "${mountPath}/${singularize(resource)}/*" {
+      capabilities = ["read", "update"]
+    },
+    path "${mountPath}/issue/*" {
+      capabilities = ["update"]
+    },
+    path "${mountPath}/generate/*" {
+      capabilities = ["update"]
+    },
+    path "${mountPath}/import" {
+      capabilities = ["update"]
+    },
+    path "${mountPath}/sign/*" {
+      capabilities = ["update"]
+    },
+  `;
+};
diff --git a/ui/tests/helpers/pki/values.js b/ui/tests/helpers/pki/values.js
deleted file mode 100644
index dcea169d30f..00000000000
--- a/ui/tests/helpers/pki/values.js
+++ /dev/null
@@ -1,204 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// Expires Jan 10, 2033
-export const rootPem = `-----BEGIN CERTIFICATE-----
-MIIDezCCAmOgAwIBAgIUTBbQcZijQsmd0rjd6COikPsrGyowDQYJKoZIhvcNAQEL
-BQAwFDESMBAGA1UEAxMJdGVzdC1yb290MB4XDTIzMDEyMDE3NTcxMloXDTIzMDIy
-MTE3NTc0MlowFDESMBAGA1UEAxMJdGVzdC1yb290MIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEAlUHfvQLsocXtvwRCpTnXGzwMCD+3KKK7y1+SUCgpAD9Y
-RV2xLAbqh0iK3x2WI4+Pek1Ub6dYaWczzBob6wRq9iFB72uLPpbL8yRf+tc1egmP
-wwJQS9qidb1hcSi4p6x/JwOpr2v2PDqJPDoHrfaHeJgCuBGS00qUFH7oHQz9Usim
-lHjIbVNF3Qa1Hq2bgwkZmRjRn3Bez/xy3YEiQ41GTicUBqY4NAGWuS1LiHyEUW81
-iQ+1iGlbpuAL4H7lpKmrhv1xZXEsF9vNL6H0Y7kjjAImTQnmo+ozcArnKnwh2wmS
-f/TrVnN4RRc8dvN8P8nWvVsJYK/D40yc7YMljIESKQIDAQABo4HEMIHBMA4GA1Ud
-DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBT6rcf5twb19wLL
-JjhPOVywd41d2jAfBgNVHSMEGDAWgBT6rcf5twb19wLLJjhPOVywd41d2jArBggr
-BgEFBQcBAQQfMB0wGwYIKwYBBQUHMAKGD2Z1bmZvcmVjYXN0LmNvbTAUBgNVHREE
-DTALggl0ZXN0LXJvb3QwGwYDVR0fBBQwEjAQoA6gDIYKZ29vZ2xlLmNvbTANBgkq
-hkiG9w0BAQsFAAOCAQEAjG7km+QsIuW7KNY3h8YHJZhdr+tIx57k9tUR4w1+d8QI
-t44FTdCYdN8n89lsFK9bONZatd0LY3qqcOARE2ni0Hg/zV9u8TTVKTKAOOx8zBd1
-TnwzhXb8mssqnXK9lcECexuWf/s5lkyHjcWOuzNVI0PohrX9tGZwdzsZEgH4Y49i
-o8I9DD+uBHknwByRLXSDmgggwgOYsyTg/IfYoHlLHDD3CaOpkCvUCZvM9bI7nrlx
-2GByQ/WDT4ArAHcf+Z1iaSIbV6WG6QWoPsu2/WKybcuN2fznaXtJMwgRl50BUv2h
-DU3c2oZTc0mPYGft6U8mVwLqfYTcEduGidTLAQPE5w==
------END CERTIFICATE-----`;
-
-export const rootDer = `MIIDJjCCAg6gAwIBAgIUZwx170kTAaGFKeyiG3Di
-GpwhKvcwDQYJKoZIhvcNAQELBQAwETEPMA0GA1UEAxMGMTExMTExMB4XDTIzMDgw
-OTIxMzk0NloXDTIzMDkxMDIxNDAxNlowETEPMA0GA1UEAxMGMTExMTExMIIBIjAN
-BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3Hm1gjKWDdXuRLZIk3dDabbzlH+Y
-2e4rklkMGlrnNqju2+7iIGZa2q8rQ4jEZ3sesSsqGHUEJ2sIG5HnRhl5yawCr9NS
-uJP+3zsNueQLQDj6tEnuN0STZQuEJKc+yeept8JGAD0SGnB+THGUYf3if0D8sDT1
-nHj3XihtnTG3fN62iKyx2Y95WKrVmT1MnpGjbp4HkRvrHSR8PKyq9Q6YyZkIYbfW
-DH3adq6gmiJITzozaUT6efftPOVPr5LLTPKAl3BAmoc8ypM/H1IPaE1Z7ef9lV9w
-gazvoJZEsc59hskTWF3ZLcWIxAjcq7u6IX2+dU/A0DmCY6GKmmcZ9W5A9wIDAQAB
-o3YwdDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
-b2qEtlDZl/ws00ftFQJX6bjoOckwHwYDVR0jBBgwFoAUb2qEtlDZl/ws00ftFQJX
-6bjoOckwEQYDVR0RBAowCIIGMTExMTExMA0GCSqGSIb3DQEBCwUAA4IBAQAFI1H8
-EOw+YcequlJp1ucCpTRArLUhH0t+l7hQAqwORGQevEP6Ml63dRrZCcke7esrpnL9
-7ijKw/PjgoyrM4QS3wAYm8nDm7cZH+f//A2X6WFnvozwKdmDRkacEjMOAe/XU+qh
-jdtiETEnUGVH65ulyimKitU5SHV0GNfToKnU/SFBks0bQvglIii0YwgHvSoW1++7
-arCjfZqWLdRe7MHfrLpLr4gaebfxSrZfn3utgm+DsJVba3B9JnOZO+yzTiEw6UkJ
-rcmZDy0x1/OaCcYHKai4RegsiQ0QrIEI+iC1N6U0PGiGf/V23eoTR0+5H6qngDz2
-GzXrbHFAPQbtweCf`;
-
-export const issuerPemBundle = `
------BEGIN CERTIFICATE-----
-MIIDRTCCAi2gAwIBAgIUdKagCL6TnN5xLkwhPbNY8JEcY0YwDQYJKoZIhvcNAQEL
-BQAwGzEZMBcGA1UEAxMQd3d3LnRlc3QtaW50LmNvbTAeFw0yMzAxMDkxOTA1NTBa
-Fw0yMzAyMTAxOTA2MjBaMBsxGTAXBgNVBAMTEHd3dy50ZXN0LWludC5jb20wggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCfd5o9JfyRAXH+E1vE2U0xjSqs
-A/cxDqsDXRHBnNJvzAa+7gPKXCDQZbr6chjxLXpP6Bv2/O+dZHq1fo/f6q9PDDGW
-JYIluwbACpe7W1UB7q9xFkZg85yQsNYokGZlwv/AMGpFBxDwVlNGL+4fxvFTv7uF
-mIlDzSIPrzByyCrqAFMNNqNwlAerDt/C6DMZae/rTGXIXsTfUpxPy21bzkeA+70I
-YCV1ffK8UnAeBYNUJ+v8+XgTQ5KhRyQ+fscUkO3T2s6f3O9Q2sWxswkf2YmZB+V1
-cTZ5w6hqiuFdBXz7GRnACi1/gbWbaExQTJRplArFwIHka7dqJh8tYkXDjai3AgMB
-AAGjgYAwfjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
-FgQU68/xXIgvsleKkuA8clK/6YslB/IwHwYDVR0jBBgwFoAU68/xXIgvsleKkuA8
-clK/6YslB/IwGwYDVR0RBBQwEoIQd3d3LnRlc3QtaW50LmNvbTANBgkqhkiG9w0B
-AQsFAAOCAQEAWSff0BH3SJv/XqwN/flqc1CVzOios72/IJ+KBBv0AzFCZ8wJPi+c
-hH1bw7tqi01Bgh595TctogDFN1b6pjN+jrlIP4N+FF9Moj79Q+jHQMnuJomyPuI7
-i07vqUcxgSmvEBBWOWS+/vxe6TfWDg18nyPf127CWQN8IHTo1f/GavX+XmRve6XT
-EWoqcQshEk9i87oqCbaT7B40jgjTAd1r4Cc6P4s1fAGPt9e9eqMj13kTyVDNuCoD
-FSZYalrlkASpg+c9oDQIh2MikGQINXHv/zIEHOW93siKMWeA4ni6phHtMg/p5eJt
-SxnVZsSzj8QLy2uwX1AADR0QUvJzMxptyA==
------END CERTIFICATE-----
------BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAn3eaPSX8kQFx/hNbxNlNMY0qrAP3MQ6rA10RwZzSb8wGvu4D
-ylwg0GW6+nIY8S16T+gb9vzvnWR6tX6P3+qvTwwxliWCJbsGwAqXu1tVAe6vcRZG
-YPOckLDWKJBmZcL/wDBqRQcQ8FZTRi/uH8bxU7+7hZiJQ80iD68wcsgq6gBTDTaj
-cJQHqw7fwugzGWnv60xlyF7E31KcT8ttW85HgPu9CGAldX3yvFJwHgWDVCfr/Pl4
-E0OSoUckPn7HFJDt09rOn9zvUNrFsbMJH9mJmQfldXE2ecOoaorhXQV8+xkZwAot
-f4G1m2hMUEyUaZQKxcCB5Gu3aiYfLWJFw42otwIDAQABAoIBADC+vZ4Ne4vTtkWl
-Izsj9Y29Chs0xx3uzuWjUGcvib/0zOcWGICF8t3hCuu9btRiQ24jlFDGdnRVH5FV
-E6OtuFLgdlPgOU1RQzn2wvTZcT26+VQHLBI8xVIRTBVwNmzK06Sq6AEbrNjaenAM
-/KwoAuLHzAmFXAgmr0++DIA5oayPWyi5IoyFO7EoRv79Xz5LWfu5j8CKOFXmI5MT
-vEVYM6Gb2xHRa2Ng0SJ4VzwC09GcXlHKRAz+CubJuncvjbcM/EryvexozKkUq4XA
-KqGr9xxdZ4XDlo3Rj9S9P9JaOin0I1mwwz6p+iwMF0zr+/ldjE4oPBdB1PUgSJ7j
-2CZcS1kCgYEAwIZ3UsMIXqkMlkMz/7nu2sqzV3EgQjY5QRoz98ligKg4fhYKz+K4
-yXvJrRyLkwEBaPdLppCZbs4xsuuv3jiqUHV5n7sfpUA5HVKkKh6XY7jnszbqV732
-iB1mQVEjzM92/amew2hDKLGQDW0nglrg6uV+bx0Lnp6Glahr8NOAyk0CgYEA1Ar3
-jTqTkU+NQX7utlxx0HPVL//JH/erp/Gnq9fN8dZhK/yjwX5savUlNHpgePoXf1pE
-lgi21/INQsvp7O2AUKuj96k+jBHQ0SS58AQGFv8iNDkLE57N74vCO6+Xdi1rHj/Y
-7jglr00box/7SOmvb4SZz2o0jm0Ejsg2M0aBuRMCgYEAgTB6F34qOqMDgD1eQka5
-QfXs/Es8E1Ihf08e+jIXuC+poOoXnUINL56ySUizXBS7pnzzNbUoUFNqxB4laF/r
-4YvC7m15ocED0mpnIKBghBlK2VaLUA93xAS+XiwdcszwkuzkTUnEbyUfffL2JSHo
-dZdEDTmXV3wW4Ywfyn2Sma0CgYAeNNG/FLEg6iw9QE/ROqob/+RGyjFklGunqQ0x
-tbRo1xlQotTRI6leMz3xk91aXoYqZjmPBf7GFH0/Hr1cOxkkZM8e4MVAPul4Ybr7
-LheP/xhoSBgD24OKtGYfCoyRETdJP98vUGBN8LYXLt8lK+UKBeHDYmXKRE156ZuP
-AmRIcQKBgFvp+xMoyAsBeOlTjVDZ0mTnFh1yp8f7N3yXdHPpFShwjXjlqLmLO5RH
-mZAvaH0Ux/wCfvwHhdC46jBrs9S4zLBvj3+44NYOzvz2dBWP/5MuXgzFe30h9Yd0
-zUlyEaWm0jY2Ylzax8ECKRL0td2bv36vxOYtTax8MSB15szsnPJ+
------END RSA PRIVATE KEY-----
-`;
-
-export const csr = `-----BEGIN CERTIFICATE REQUEST-----
-MIICdDCCAVwCAQAwDjEMMAoGA1UEAxMDbG9sMIIBIjANBgkqhkiG9w0BAQEFAAOC
-AQ8AMIIBCgKCAQEA4Dz2b/nAP/M6bqyk5mctqqYAAcoME//xPBy0wREHuZ776Pu4
-l45kDL3dPXiY8U2P9pn8WIr2KpLK6oWUfSsiG2P082bpWDL20UymkWqDhhrA4unf
-ZRq68UIDbcetlLw15YKnlNdvNZ7Qr8Se8KV0YGR/wFqI7QfS6VE3lhxZWEBUayI0
-egqOuDbXAcZTON1AZ92/F+WFSbc43iYdDk16XfAPFKhtvLr6zQQuzebAb7HG04Hc
-GhRskixxyJ8XY6XUplfsa1HcpUXE4f1GeUvq3g6ltVCSJ0p7qI9FFjV4t+DCLVVV
-LnwHUi9Vzz6i2wjMt7P6+gHR+RrOWBgRMn38fwIDAQABoCEwHwYJKoZIhvcNAQkO
-MRIwEDAOBgNVHREEBzAFggNsb2wwDQYJKoZIhvcNAQELBQADggEBAAm3AHQ1ctdV
-8HCrMOXGVLgI2cB1sFd6VYVxPBxIk812Y4wyO8Q6POE5VZNTIgMcSeIaFu5lgHNL
-Peeb54F+zEa+OJYkcWgCAX5mY/0HoML4p2bxFTSjllSpcX7ktjq4IEIY/LRpqSgc
-jgZHHRwanFfkeIOhN4Q5qJWgBPNhDAcNPE7T0M/4mxqYDqMSJvMYmC67hq1UOOug
-/QVDUDJRC1C0aDw9if+DbG/bt1V6HpMQhDIEUjzfu4zG8pcag3cJpOA8JhW1hnG0
-XA2ZOCA7s34/szr2FczXtIoKiYmv3UzPyO9/4mc0Q2+/nR4CG8NU9WW/XJCne9ID
-elRplAzrMF4=
------END CERTIFICATE REQUEST-----`;
-
-export const csr2 = `-----BEGIN CERTIFICATE REQUEST-----
-MIIChDCCAWwCAQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3
-DQEBAQUAA4IBDwAwggEKAoIBAQCuW9C58M1wO0vdGmtLcJbbCkKyfsHJJae1j4LL
-xdGqs1j9UKD66UALSzZEeMCBdtTNNzThAgYJqCSA5swqpbRf6WZ3K/X7oHbfcrHi
-SAm8v/0QsJDF5Rphiy6wyggaoaHEsbSp83kYy9r+h48vFW5Dr8UvJTsp5kdRn31L
-bTHr56iqOaHQbu6hDj4Ompg/0OElPH1tV2X947o8timR+L89utZzR+d8x/eeTdPl
-H7TEkMEomRvt7NTRHGYRsm3Gzq4AA6PalzIxzwJrNgXfJDutNn/QwcVd5sImwYCO
-GaHsOvGfc02w+Vqqva9EOEQSr6B90kA+vc30I6uSiugzV9TFAgMBAAGgKTAnBgkq
-hkiG9w0BCQ4xGjAYMBYGA1UdEQQPMA2CC2V4YW1wbGUuY29tMA0GCSqGSIb3DQEB
-CwUAA4IBAQAjm6JTU7axU6TzLlXlOp7hZ4+nep2/8vvJ9EOXzL8x/qtTTizctdG9
-Op70gywoUxAS2tatwa4fmW9DbA2eGiLU+Ibj/5b0Veq5DQdp1Qg3MLBP/+AcM/7m
-rrgA9MhkpQahXCj4vXo6NeXYaTh6Jo/s8C9h3WxTD6ptDMiaPFcEuWcx0e3AjjH0
-pe7k9/MfB2wLfQ7+5wee/tCFWZN4tk8YfjQeQA1extXYKM/f8eu3Z/wjbbMOVpwb
-xst+VTY7X9T8cU/hjDEoNG677meI+W5MgiwX0rxTpoz991fqr3vp7PELYj3GMyii
-D1YfvqXieNij4UrduRqCXj1m8SVZlM+X
------END CERTIFICATE REQUEST-----`;
-
-export const componentPemBundle = `-----BEGIN CERTIFICATE-----
-MIIDGjCCAgKgAwIBAgIUFvnhb2nQ8+KNS3SzjlfYDMHGIRgwDQYJKoZIhvcNAQEL
-BQAwDTELMAkGA1UEAxMCZmEwHhcNMTgwMTEwMTg1NDI5WhcNMTgwMjExMTg1NDU5
-WjANMQswCQYDVQQDEwJmYTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-AN2VtBn6EMlA4aYre/xoKHxlgNDxJnfSQWfs6yF/K201qPnt4QF9AXChatbmcKVn
-OaURq+XEJrGVgF/u2lSos3NRZdhWVe8o3/sOetsGxcrd0gXAieOSmkqJjp27bYdl
-uY3WsxhyiPvdfS6xz39OehsK/YCB6qCzwB4eEfSKqbkvfDL9sLlAiOlaoHC9pczf
-6/FANKp35UDwInSwmq5vxGbnWk9zMkh5Jq6hjOWHZnVc2J8J49PYvkIM8uiHDgOE
-w71T2xM5plz6crmZnxPCOcTKIdF7NTEP2lUfiqc9lONV9X1Pi4UclLPHJf5bwTmn
-JaWgbKeY+IlF61/mgxzhC7cCAwEAAaNyMHAwDgYDVR0PAQH/BAQDAgEGMA8GA1Ud
-EwEB/wQFMAMBAf8wHQYDVR0OBBYEFLDtc6+HZN2lv60JSDAZq3+IHoq7MB8GA1Ud
-IwQYMBaAFLDtc6+HZN2lv60JSDAZq3+IHoq7MA0GA1UdEQQGMASCAmZhMA0GCSqG
-SIb3DQEBCwUAA4IBAQDVt6OddTV1MB0UvF5v4zL1bEB9bgXvWx35v/FdS+VGn/QP
-cC2c4ZNukndyHhysUEPdqVg4+up1aXm4eKXzNmGMY/ottN2pEhVEWQyoIIA1tH0e
-8Kv/bysYpHZKZuoGg5+mdlHS2p2Dh2bmYFyBLJ8vaeP83NpTs2cNHcmEvWh/D4UN
-UmYDODRN4qh9xYruKJ8i89iMGQfbdcq78dCC4JwBIx3bysC8oF4lqbTYoYNVTnAi
-LVqvLdHycEOMlqV0ecq8uMLhPVBalCmIlKdWNQFpXB0TQCsn95rCCdi7ZTsYk5zv
-Q4raFvQrZth3Cz/X5yPTtQL78oBYrmHzoQKDFJ2z
------END CERTIFICATE-----`;
-
-// for parse-pki-cert tests:
-// certificate contains all allowable params
-export const loadedCert = `-----BEGIN CERTIFICATE-----\nMIIE7TCCA9WgAwIBAgIULcrWXSz3/kG81EgBo0A4Zt+ZgkYwDQYJKoZIhvcNAQEL\nBQAwga0xDzANBgNVBAYTBkZyYW5jZTESMBAGA1UECBMJQ2hhbXBhZ25lMQ4wDAYD\nVQQHEwVQYXJpczETMBEGA1UECRMKMjM0IHNlc2FtZTEPMA0GA1UEERMGMTIzNDU2\nMQ8wDQYDVQQKEwZXaWRnZXQxEDAOBgNVBAsTB0ZpbmFuY2UxGDAWBgNVBAMTD2Nv\nbW1vbi1uYW1lLmNvbTETMBEGA1UEBRMKY2VyZWFsMTI5MjAeFw0yMzAyMDMxNzI3\nMzNaFw0yMzAzMDcxNzI4MDNaMIGtMQ8wDQYDVQQGEwZGcmFuY2UxEjAQBgNVBAgT\nCUNoYW1wYWduZTEOMAwGA1UEBxMFUGFyaXMxEzARBgNVBAkTCjIzNCBzZXNhbWUx\nDzANBgNVBBETBjEyMzQ1NjEPMA0GA1UEChMGV2lkZ2V0MRAwDgYDVQQLEwdGaW5h\nbmNlMRgwFgYDVQQDEw9jb21tb24tbmFtZS5jb20xEzARBgNVBAUTCmNlcmVhbDEy\nOTIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC8NO7LXHp28SzOqmQv\nns4fGogKydEklWG4JEN3pM+k9nTyEgA8DFhtSLvcqF0cqhEydw4FVU+LEUGySUer\nmM4VNl9qglFBgmYE8TNgWkUw9ZP6MNgx13I8zXTXOIDj0iwXks02x8451oPbqqdq\nXsCc4vSP7BPwQOjc0C56c54zyRC1zFm9jlh+As0QinuYcjFjVabCku6JSYc4kunh\nz7derU9cURUxB5/ja9zC7jGS8tg4XUWdUkbj1O/krEWfjQx9Kj8aEU1gFfAvW/Bd\nIqgAlHATYN6i8HDmAmdGty9zLht9wUgnAtVh3lK3939h/rI0qCLV6N/RjCC7csnz\n9I67AgMBAAGjggEBMIH+MA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/\nAgERMB0GA1UdDgQWBBSSdKle0wMGy0jvPmcoDanGduhLqzAfBgNVHSMEGDAWgBSS\ndKle0wMGy0jvPmcoDanGduhLqzAuBgNVHR4BAf8EJDAioCAwDoIMZG5zbmFtZTEu\nY29tMA6CDGRzbm5hbWUyLmNvbTBoBgNVHREEYTBfoB0GCCsBBAEFCQIGoBEMD3Nv\nbWUtdXRmLXN0cmluZ4IIYWx0bmFtZTGCCGFsdG5hbWUyhwTAngEmhxASNA/SViEA\nAQCJAAAAAEUAhgh0ZXN0dXJpMYYIdGVzdHVyaTIwDQYJKoZIhvcNAQELBQADggEB\nAAQukDwIg01QLQK2MQqjePNZlJleKLMK9LiabyGqc7u4bgmX3gYIrH7uopvO5cIv\nvqxcVBATQ6ez29t5MagzDu1+vnwE8fQhRoe0sp5TRLiGSlBJf53+0Wb3vbaOT0Fx\n/FFK0f2wHqYv3h/CTxu8YxDY4DwCRTPJ2KfTvT85BXtTUlzKIp1ytALSKcz0Owoe\neQPtQUdi8UHef8uHuWbk7DftMXojXbCqtHQdS3Rrl9zyc+Ds67flb5hKEseQZRgw\ntPtAIxhjSfZPTjl/3aasCBikESdeS8IOxIXL1bGun0xWnIBBc9uRe8hpdPjZj7Eh\nIt7ucIzFep0DLWCeQrAHeqo=\n-----END CERTIFICATE-----`;
-// use_pss = true
-export const pssTrueCert = `-----BEGIN CERTIFICATE-----\nMIIDqTCCAl2gAwIBAgIUVY2PTRZl1t/fjfyEwrG4HvGjYekwQQYJKoZIhvcNAQEK\nMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF\nAKIDAgEgMBoxGDAWBgNVBAMTD2NvbW1vbi1uYW1lLmNvbTAeFw0yMzAxMjEwMTA3\nNDBaFw0yMzAyMjIwMTA4MTBaMBoxGDAWBgNVBAMTD2NvbW1vbi1uYW1lLmNvbTCC\nASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANlG6DuZ4B6Tv8u8rI+pUvQv\n2E7dFCu+i1YAbEJSnuAQ9XFUG5Uf3uHB8AFrOKRBAaFdBV4hKvBpfvMj3jl93d0b\nHdHeIM+sancDwpexpLvSW4yDpbIhAnkYzbUYgZyEAJeIgq/4ufT77TCK8XIzDywD\nhXZtDJkc6w3mm6hiqEQXLKnDQTfKLK8Fbsq4OuQ4vO5VIJrVZ1gKemDs7W/9WIzp\n0iSjzcIfWnUy1Dpk+AF8HhXok8CbhHfOGgbQZ6DcXOIJeb4XarJ9sgLJNAuhdcHR\ngP0TkPiOewbBG9Ish1p3F+pkI3vjQk4cghmilAuEkMc2NCNNy6q1bwSELVQnMiMC\nAwEAAaN/MH0wDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O\nBBYEFAsrMoFu6tt1pybxx9ln6w5QK/2tMB8GA1UdIwQYMBaAFAsrMoFu6tt1pybx\nx9ln6w5QK/2tMBoGA1UdEQQTMBGCD2NvbW1vbi1uYW1lLmNvbTBBBgkqhkiG9w0B\nAQowNKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQC\nAQUAogMCASADggEBAFh+PMwEmxaZR6OtfB0Uvw2vA7Oodmm3W0bYjQlEz8U+Q+JZ\ncIPa4VnRy1QALmKbPCbRApA/gcWzIwtzo1JhLtcDINg2Tl0nj4WvgpIvj0/lQNMq\nmwP7G/K4PyJTv3+y5XwVfepZAZITB0w5Sg5dLC6HP8AGVIaeb3hGNHYvPlE+pbT+\njL0xxzFjOorWoy5fxbWoVyVv9iZ4j0zRnbkYHIi3d8g56VV6Rbyw4WJt6p87lmQ8\n0wbiJTtuew/0Rpuc3PEcR9XfB5ct8bvaGGTSTwh6JQ33ohKKAKjbBNmhBDSP1thQ\n2mTkms/mbDRaTiQKHZx25TmOlLN5Ea1TSS0K6yw=\n-----END CERTIFICATE-----`;
-// only has common name
-export const skeletonCert = `-----BEGIN CERTIFICATE-----\nMIIDQTCCAimgAwIBAgIUVQy58VgdVpAK9c8SfS31idSv6FUwDQYJKoZIhvcNAQEL\nBQAwGjEYMBYGA1UEAxMPY29tbW9uLW5hbWUuY29tMB4XDTIzMDEyMTAxMjAyOVoX\nDTIzMDIyMjAxMjA1OVowGjEYMBYGA1UEAxMPY29tbW9uLW5hbWUuY29tMIIBIjAN\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2UboO5ngHpO/y7ysj6lS9C/YTt0U\nK76LVgBsQlKe4BD1cVQblR/e4cHwAWs4pEEBoV0FXiEq8Gl+8yPeOX3d3Rsd0d4g\nz6xqdwPCl7Gku9JbjIOlsiECeRjNtRiBnIQAl4iCr/i59PvtMIrxcjMPLAOFdm0M\nmRzrDeabqGKoRBcsqcNBN8osrwVuyrg65Di87lUgmtVnWAp6YOztb/1YjOnSJKPN\nwh9adTLUOmT4AXweFeiTwJuEd84aBtBnoNxc4gl5vhdqsn2yAsk0C6F1wdGA/ROQ\n+I57BsEb0iyHWncX6mQje+NCThyCGaKUC4SQxzY0I03LqrVvBIQtVCcyIwIDAQAB\no38wfTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU\nCysygW7q23WnJvHH2WfrDlAr/a0wHwYDVR0jBBgwFoAUCysygW7q23WnJvHH2Wfr\nDlAr/a0wGgYDVR0RBBMwEYIPY29tbW9uLW5hbWUuY29tMA0GCSqGSIb3DQEBCwUA\nA4IBAQDPco+FIHXczf0HTwFAmIVu4HKaeIwDsVPxoUqqWEix8AyCsB5uqpKZasby\nedlrdBohM4dnoV+VmV0de04y95sdo3Ot60hm/czLog3tHg4o7AmfA7saS+5hCL1M\nCJWqoJHRFo0hOWJHpLJRWz5DqRZWspASoVozLOYyjRD+tNBjO5hK4FtaG6eri38t\nOpTt7sdInVODlntpNuuCVprPpHGj4kPOcViQULoFQq5fwyadpdjqSXmEGlt0to5Y\nMbTb4Jhj0HywgO53BUUmMzzY9idXh/8A7ThrM5LtqhxaYHLVhyeo+5e0mgiXKp+n\nQ8Uh4TNNTCvOUlAHycZNaxYTlEPn\n-----END CERTIFICATE-----`;
-// contains unsupported subject and extension OIDs
-export const unsupportedOids = `-----BEGIN CERTIFICATE-----\nMIIEjDCCA3SgAwIBAgIUD4EeORgh/i+ZZFOk8KsGKQPWsoIwDQYJKoZIhvcNAQEL\nBQAwgZIxMTAvBgNVBAMMKGZhbmN5LWNlcnQtdW5zdXBwb3J0ZWQtc3Viai1hbmQt\nZXh0LW9pZHMxCzAJBgNVBAYTAlVTMQ8wDQYDVQQIDAZLYW5zYXMxDzANBgNVBAcM\nBlRvcGVrYTESMBAGA1UECgwJQWNtZSwgSW5jMRowGAYJKoZIhvcNAQkBFgtmb29A\nYmFyLmNvbTAeFw0yMzAxMjMxODQ3MjNaFw0zMzAxMjAxODQ3MjNaMIGSMTEwLwYD\nVQQDDChmYW5jeS1jZXJ0LXVuc3VwcG9ydGVkLXN1YmotYW5kLWV4dC1vaWRzMQsw\nCQYDVQQGEwJVUzEPMA0GA1UECAwGS2Fuc2FzMQ8wDQYDVQQHDAZUb3Bla2ExEjAQ\nBgNVBAoMCUFjbWUsIEluYzEaMBgGCSqGSIb3DQEJARYLZm9vQGJhci5jb20wggEi\nMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDyYH5qS7krfZ2tA5uZsY2qXbTb\ntGNG1BsyDhZ/qqVlQybjDsHJZwNUbpfhBcCLaKyAwH1R9n54NOOOn6bYgfKWTgy3\nL7224YDAqYe7Y/GPjgI2MRvRfn6t2xzQxtJ0l0k8LeyNcwhiqYLQyOOfDdc127fm\nW40r2nmhLpH0i9e2I/YP1HQ+ldVgVBqeUTntgVSBfrQF56v9mAcvvHEa5sdHqmX4\nJ2lhWTnx9jqb7NZxCem76BlX1Gt5TpP3Ym2ZFVQI9fuPK4O8JVhk1KBCmIgR3Ft+\nPpFUs/c41EMunKJNzveYrInSDScaC6voIJpK23nMAiM1HckLfUUc/4UojD+VAgMB\nAAGjgdcwgdQwHQYDVR0OBBYEFH7tt4enejKTZtYjUKUUx6PXyzlgMB8GA1UdIwQY\nMBaAFH7tt4enejKTZtYjUKUUx6PXyzlgMA4GA1UdDwEB/wQEAwIFoDAgBgNVHSUB\nAf8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBCjBM\nBgNVHREERTBDhwTAngEmhgx1cmlTdXBwb3J0ZWSCEWRucy1OYW1lU3VwcG9ydGVk\noBoGAyoDBKATDBFleGFtcGxlIG90aGVybmFtZTANBgkqhkiG9w0BAQsFAAOCAQEA\nP6ckVJgbcJue+MK3RVDuG+Mh7dl89ynC7NwpQFRjLVZQuoMHZT/dcLlVeFejVXu5\nR+IPLmQU6NV7JAmy4zGap8awf12QTy3g410ecrSF94WWlu8bPoekfUnnP+kfzLPH\nCUAkRKxWDSRKX5C8cMMxacVBBaBIayuusLcHkHmxLLDw34PFzyz61gtZOJq7JYnD\nhU9YsNh6bCDmnBDBsDMOI7h8lBRQwTiWVoSD9YNVvFiY29YvFbJQGdh+pmBtf7E+\n1B/0t5NbvqlQSbhMM0QgYFhuCxr3BGNob7kRjgW4i+oh+Nc5ptA5q70QMaYudqRS\nd8SYWhRdxmH3qcHNPcR1iw==\n-----END CERTIFICATE-----`;
-// unsupportedPem is same cert as above, formatted differently
-export const unsupportedPem = `
------BEGIN CERTIFICATE-----
-MIIEjDCCA3SgAwIBAgIUD4EeORgh/i+ZZFOk8KsGKQPWsoIwDQYJKoZIhvcNAQEL
-BQAwgZIxMTAvBgNVBAMMKGZhbmN5LWNlcnQtdW5zdXBwb3J0ZWQtc3Viai1hbmQt
-ZXh0LW9pZHMxCzAJBgNVBAYTAlVTMQ8wDQYDVQQIDAZLYW5zYXMxDzANBgNVBAcM
-BlRvcGVrYTESMBAGA1UECgwJQWNtZSwgSW5jMRowGAYJKoZIhvcNAQkBFgtmb29A
-YmFyLmNvbTAeFw0yMzAxMjMxODQ3MjNaFw0zMzAxMjAxODQ3MjNaMIGSMTEwLwYD
-VQQDDChmYW5jeS1jZXJ0LXVuc3VwcG9ydGVkLXN1YmotYW5kLWV4dC1vaWRzMQsw
-CQYDVQQGEwJVUzEPMA0GA1UECAwGS2Fuc2FzMQ8wDQYDVQQHDAZUb3Bla2ExEjAQ
-BgNVBAoMCUFjbWUsIEluYzEaMBgGCSqGSIb3DQEJARYLZm9vQGJhci5jb20wggEi
-MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDyYH5qS7krfZ2tA5uZsY2qXbTb
-tGNG1BsyDhZ/qqVlQybjDsHJZwNUbpfhBcCLaKyAwH1R9n54NOOOn6bYgfKWTgy3
-L7224YDAqYe7Y/GPjgI2MRvRfn6t2xzQxtJ0l0k8LeyNcwhiqYLQyOOfDdc127fm
-W40r2nmhLpH0i9e2I/YP1HQ+ldVgVBqeUTntgVSBfrQF56v9mAcvvHEa5sdHqmX4
-J2lhWTnx9jqb7NZxCem76BlX1Gt5TpP3Ym2ZFVQI9fuPK4O8JVhk1KBCmIgR3Ft+
-PpFUs/c41EMunKJNzveYrInSDScaC6voIJpK23nMAiM1HckLfUUc/4UojD+VAgMB
-AAGjgdcwgdQwHQYDVR0OBBYEFH7tt4enejKTZtYjUKUUx6PXyzlgMB8GA1UdIwQY
-MBaAFH7tt4enejKTZtYjUKUUx6PXyzlgMA4GA1UdDwEB/wQEAwIFoDAgBgNVHSUB
-Af8EFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBCjBM
-BgNVHREERTBDhwTAngEmhgx1cmlTdXBwb3J0ZWSCEWRucy1OYW1lU3VwcG9ydGVk
-oBoGAyoDBKATDBFleGFtcGxlIG90aGVybmFtZTANBgkqhkiG9w0BAQsFAAOCAQEA
-P6ckVJgbcJue+MK3RVDuG+Mh7dl89ynC7NwpQFRjLVZQuoMHZT/dcLlVeFejVXu5
-R+IPLmQU6NV7JAmy4zGap8awf12QTy3g410ecrSF94WWlu8bPoekfUnnP+kfzLPH
-CUAkRKxWDSRKX5C8cMMxacVBBaBIayuusLcHkHmxLLDw34PFzyz61gtZOJq7JYnD
-hU9YsNh6bCDmnBDBsDMOI7h8lBRQwTiWVoSD9YNVvFiY29YvFbJQGdh+pmBtf7E+
-1B/0t5NbvqlQSbhMM0QgYFhuCxr3BGNob7kRjgW4i+oh+Nc5ptA5q70QMaYudqRS
-d8SYWhRdxmH3qcHNPcR1iw==
------END CERTIFICATE-----`;
-export const certWithoutCN = `-----BEGIN CERTIFICATE-----\nMIIDUDCCAjigAwIBAgIUEUpM5i7XMd/imZkR9XvonMaqPyYwDQYJKoZIhvcNAQEL\nBQAwHDEaMBgGCSqGSIb3DQEJARYLZm9vQGJhci5jb20wHhcNMjMwMTIzMjMyODEw\nWhcNMzMwMTIwMjMyODEwWjAcMRowGAYJKoZIhvcNAQkBFgtmb29AYmFyLmNvbTCC\nASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPGSdeqLICZcoUzxk88F8Tp+\nVNI+mS74L8pHyb9ZNZfeXPo0E9L5pi+KKI7rkxAtBGUecG1ENSxDDK9p6XZhWHSU\nZ6bdjOsjcIlfiM+1hhtDclIVxIDnz2Jt1/Vmnm8DXwdwVATWiFLTnfm288deNwsT\npl0ehAR3BadkZvteC6t+giEw/4qm1/FP53GEBOQeUWJDZRvtL37rdx4joFv3cR4w\nV0dukOjc5AGXtIOorO145OSZj8s7RsW3pfGcFUcOg7/flDxfK1UqFflQa7veLvKa\nWE/fOMyB/711QjSkTuQ5Rw3Rf9Fr2pqVJQgElTIW1SKaX5EJTB9mtGB34UqUXtsC\nAwEAAaOBiTCBhjAdBgNVHQ4EFgQUyhFP/fm+798mErPD5VQvEaAZQrswHwYDVR0j\nBBgwFoAUyhFP/fm+798mErPD5VQvEaAZQrswDgYDVR0PAQH/BAQDAgWgMCAGA1Ud\nJQEB/wQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEK\nMA0GCSqGSIb3DQEBCwUAA4IBAQCishzVkhuSAtqxgsZdYzBs3GpakGIio5zReW27\n6dk96hYCbbe4K3DtcFbRD1B8t6aTJlHxkFRaOWErSXu9WP3fUhIDNRE64Qsrg1zk\n3Km430qBlorXmTp6xhYHQfY5bn5rT2YY7AmaYIlIFxRhod43i5GDbBP+e+d/vTqR\nv1AJflYofeR4LeATP64B6a4R+QQVoxI43+pyH3ka+nRHwJBR9h8SMtJoqBy7x9pl\nYlBDa8lSn05doA3+e03VIzitvBBWI4oX1XB0tShSLk6YJXayIwe0ZNVvfYLIRKCp\nb4DUwChYzG/FwFSssUAqzVFhu3i+uU3Z47bsLVm0R5m7hLiZ\n-----END CERTIFICATE-----`;
-
-// CROSS-SIGNING:
-export const newCSR = {
-  common_name: 'Short-Lived Int R1',
-  csr: `-----BEGIN CERTIFICATE REQUEST-----\nMIICYjCCAUoCAQAwHTEbMBkGA1UEAxMSU2hvcnQtTGl2ZWQgSW50IFIxMIIBIjAN\nBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqsvFU7lzt06n1w6BL+Waf9zd+Z3G\n90Kv0HAksoLaWYinhkxNIUTU8ar9HLa2WV4EoJbNq91Hn+jFc2SYEXtRV+jm0kEh\nz4C4AoQ4D0s83JcYNssiNbVA04wa5ovD0iA/pzwVz8TnJSfAAuZ3vXFlyIbQ3ESo\nzt9hGjo/JOpoBh67E7xkuzw4lnC2rXGHdh9pk1Di+wqREnKU4nuhDLnTC/LL+Mkm\n07F1aMAW3Z/PWFmmsDJHMhZnaYo2LGCwU4A0U1ED0XpwflobVbkzZDmCXOPEI8UX\nG6VcL36zWnzEQnlZKN91MAa+s0E4z40KHKVSblSkjYD1K6n0y787ic2mDwIDAQAB\noAAwDQYJKoZIhvcNAQELBQADggEBAFQtiJaRfaQS3jHr7aFeszB/JmDRQiOoML3g\nhA3EcVd2rvDjiqikwD9EFdLTJyYJfb+9yiKDJqB7Fw2GPSrFxrd+jC9qZRI3VEWK\n8VdflLbruc1FcqJcE/0z2hWa11eud1bMLq8U6AfxNHL4r4ukrp2D5elrdsrDnhZj\nwMi3FtEFd4RZVaWZYVmWcQTeH7Zz/LYwkVDgBuvC+SOCaNNo/dCurkAAoxw8obBj\n1FS2F/3oHQxMui8vS8j6sMWMPZ5D3Q0xSC3HBUNoI2ZC77Mxn9yfj6ianUXKOOlf\nQMRaPBVajxZm9ovV64QKr+7HK7W7U/fNEqvoKBUDCqEuWmSsxMk=\n-----END CERTIFICATE REQUEST-----`,
-};
-
-export const oldParentIssuerCert = `-----BEGIN CERTIFICATE-----\nMIIDKzCCAhOgAwIBAgIUMCEF+bzBC4NQIWjE1sv/RbnYfUgwDQYJKoZIhvcNAQEL\nBQAwHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgxMB4XDTIzMDEyNTAwMjQz\nM1oXDTIzMDIyNjAwMjUwM1owHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgx\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0zrpJvjWcBV49Eor+zfh\nGW40xH6PcPSpzWGCCFiMPFwKrBSjuGRwwkLsXU7u2P15jIV/IU2kPS+WOW+EIe0x\ns5X2SoujZGOmM6du/6HIo9lz9yjb5G1SHdv/e65Q45QWb6wQcuO4axffvPzmAU9L\nQcunEF4g3rCz4cHYumi0osybbwR45z+8owNhykdbu7AwV0Cyz3C/lT1wxDxbFr0Y\n1NEjQ8AF4oRzqkmGoLp6ixDxp8zMpOlKWWYem1mx0RbqlwLP7khiS5YKi8+j8aog\nOhHA/W4i+ihrBzkv4GtOSdkhJz5qacifydUXtJ7SmvYs9Fi+hFgw61sw23ywbr3+\nywIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV\nHQ4EFgQUQsdYFMtsNMYNDIhZHMd77kcLLi8wHwYDVR0jBBgwFoAUQsdYFMtsNMYN\nDIhZHMd77kcLLi8wDQYJKoZIhvcNAQELBQADggEBAFNKTnNUzjZGHpXVK9Go8k/i\nVMNBktjGp58z+EN32TJnq/tOW1eVswUmq71S3R16Iho4XZDZVchuK+zhqSwlAmgM\no1vs6L5IJ0rVZcLZpysxFtawlbA362zBOX0F7tqStdEeBWaXw6J+MQ26xAPgHjXo\nc3fqqNWGbrOPt1uFoXWD+0Bg8M90a7OT0ijubh/PcuCe1yF9G2BqRQruB05gZiHl\n0NGbUka1ntD/lxYfLeSnp+FHJVDrcAHwPhKQS8HHr/ZBjKEGY8In+JIi/KBV/M8b\nGeW2k5odl6r2UIR6PWSei1WKKHe09WzO7rGJaN6uKLP14c0nSF3/q+AQY3m+tPY=\n-----END CERTIFICATE-----\n`;
-export const parentIssuerCert = `-----BEGIN CERTIFICATE-----\nMIIDKzCCAhOgAwIBAgIUBxLeuD3K0hF5dGpaEgZqytTN3lswDQYJKoZIhvcNAQEL\nBQAwHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgyMB4XDTIzMDEyNTAwMjQz\nM1oXDTIzMDIyNjAwMjUwM1owHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgy\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuqkwN4m5dFLwFi0iYs4r\nTO4HWzloF4yCOaNfVksh1cOafVu9vjFwOWgHZFe6h8BOn6biKdFtvGTyIzlMHe5t\nyFmec9pfjX243bH9Ev4n2RTMKs818g9LdoZT6SI7DxHEu3yuHBg9TM87+GB+dA1V\nkRsK5hgtNCSMdgFSljM169sYbNilpk8M7O2hr+AmgRi0c1nUEPCe4JAr0Zv8iweJ\ntFRVHiQJXD9WIVxaWVxqWFsHoXseZS7H76RSdf4jNfENmBguHZMAPhtqlc/pMan8\nu0IJETWjWENn+WYC7DnnfQtNqyebU2LdT3oKO8tELqITygjT2tCS1Zavmsy69VY0\nYwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV\nHQ4EFgQUxgchIBo+1F++IFW0F586I5QDFGYwHwYDVR0jBBgwFoAUxgchIBo+1F++\nIFW0F586I5QDFGYwDQYJKoZIhvcNAQELBQADggEBAI6DdnW8q/FqGqk/Y0k7iUrZ\nYkfMRlss6uBTzLev53eXqFIJ3+EFVfV+ohDEedlYYm2QCELzQcJSR7Q2I22PQj8X\nTO0yqk6LOCMv/4yiDhF4D+haiDU4joq5GX1dpFdlNSQ5fJmnLKu8HYbOhbwUo4ns\n4yGzIMulZR1Zqf/HGEOCYPDQ0ZHucmHn7uGhmV+kgYGoKVEZ8XxfmyNPKuwTAUHL\nfInPJZtbxXTVmiWWy3iraeI4XcUvaD0JtVnsVphYrqrSZ60DjgFsjiyenxePGHXf\nYXV9HIS6OXlvWhJKlSINOTv9fAa+e+JtK7frdvxJNHoTG34PiGXfOV2swTvLJQo=\n-----END CERTIFICATE-----\n`;
-export const intIssuerCert = `-----BEGIN CERTIFICATE-----\nMIIDKzCCAhOgAwIBAgIUPt5VyO6gyA4hVaMkdpNyBlP+I64wDQYJKoZIhvcNAQEL\nBQAwHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgxMB4XDTIzMDEyNTAwMjQz\nM1oXDTIzMDIyNjAwMjUwM1owHTEbMBkGA1UEAxMSU2hvcnQtTGl2ZWQgSW50IFIx\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqsvFU7lzt06n1w6BL+Wa\nf9zd+Z3G90Kv0HAksoLaWYinhkxNIUTU8ar9HLa2WV4EoJbNq91Hn+jFc2SYEXtR\nV+jm0kEhz4C4AoQ4D0s83JcYNssiNbVA04wa5ovD0iA/pzwVz8TnJSfAAuZ3vXFl\nyIbQ3ESozt9hGjo/JOpoBh67E7xkuzw4lnC2rXGHdh9pk1Di+wqREnKU4nuhDLnT\nC/LL+Mkm07F1aMAW3Z/PWFmmsDJHMhZnaYo2LGCwU4A0U1ED0XpwflobVbkzZDmC\nXOPEI8UXG6VcL36zWnzEQnlZKN91MAa+s0E4z40KHKVSblSkjYD1K6n0y787ic2m\nDwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV\nHQ4EFgQUkBK+oGpo5DNj2pCKoUE08WFOxQUwHwYDVR0jBBgwFoAUQsdYFMtsNMYN\nDIhZHMd77kcLLi8wDQYJKoZIhvcNAQELBQADggEBAIf4Bp/NYftiN8LmQrVzPWAe\nc4Bxm/NFFtkwQEvFhndMN68MUyXa5yxAdnYAHN+fRpYPxbjoZNXjW/jx3Kjft44r\ntyNGrrkjR80TI9FbL53nN7hLtZQdizsQD0Wype4Q1JOIxYw2Wd5Hr/PVPrJZ3PGg\nwNeI5IRu/cVbVT/vkRaHqYSwpa+V2cZTaEk6h62KPaKu3ui+omoeitU6qXHOysXQ\nrdGkJl/x831sIKmN0dMiGeoJdHGAr/E2f3ijKbVPsjIxZbm2SSumldOFYWn9cNYD\nI6sizFH976Wpde/GRIvBIzJnlK3xgfy0D9AUvwKyt75PVEnshc9tlhxoSVlKaUE=\n-----END CERTIFICATE-----\n`;
-export const newlySignedCert = `-----BEGIN CERTIFICATE-----\nMIIDKzCCAhOgAwIBAgIUKapKK5Coau2sfIJgqA9jcC6BkWIwDQYJKoZIhvcNAQEL\nBQAwHTEbMBkGA1UEAxMSTG9uZy1MaXZlZCBSb290IFgyMB4XDTIzMDEyNTIyMjky\nNVoXDTIzMDIyNjIyMjk1NVowHTEbMBkGA1UEAxMSU2hvcnQtTGl2ZWQgSW50IFIx\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqsvFU7lzt06n1w6BL+Wa\nf9zd+Z3G90Kv0HAksoLaWYinhkxNIUTU8ar9HLa2WV4EoJbNq91Hn+jFc2SYEXtR\nV+jm0kEhz4C4AoQ4D0s83JcYNssiNbVA04wa5ovD0iA/pzwVz8TnJSfAAuZ3vXFl\nyIbQ3ESozt9hGjo/JOpoBh67E7xkuzw4lnC2rXGHdh9pk1Di+wqREnKU4nuhDLnT\nC/LL+Mkm07F1aMAW3Z/PWFmmsDJHMhZnaYo2LGCwU4A0U1ED0XpwflobVbkzZDmC\nXOPEI8UXG6VcL36zWnzEQnlZKN91MAa+s0E4z40KHKVSblSkjYD1K6n0y787ic2m\nDwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNV\nHQ4EFgQUkBK+oGpo5DNj2pCKoUE08WFOxQUwHwYDVR0jBBgwFoAUxgchIBo+1F++\nIFW0F586I5QDFGYwDQYJKoZIhvcNAQELBQADggEBAJaems1vgEjxgb3d1y9PYxzN\nLZbuf/+0+BCVa9k4bEsbuhXhEecFdIi2OKS6fabeoEOF97Gvqrgc+LEpNsU6lIRA\nkJ/nHe0CD2hf0aBQsGsOllYy/4QnrPlbowb4KizPknEMWdGcvfnlzzOJzo4/UuMk\nMZ9vn2GrINzfml/sLocOzP/MsPd8bBhXI2Emh2O9tJ4+zeHLhEzcM1gdNk8pp+wP\nEOks0EcN4UBkpEnDZcDTJVgp9XpWy19EEGqsxjBq6rlpIvPW8XHoH1jZSGY1KWBJ\nRGtDcGugwTxO9jYHz/a1qu4BVt5FFcb0L3IOvcr+3QCCeiJQHcVY8QRbO9M4AQk=\n-----END CERTIFICATE-----\n`;
-// both certs generated with key type ed25519
-export const unsupportedSignatureRoot = `-----BEGIN CERTIFICATE-----\nMIIBXTCCAQ+gAwIBAgIUcp9CkzsU5Pkv2ZJO8Gp+tJrzuJYwBQYDK2VwMBIxEDAO\nBgNVBAMTB215LXJvb3QwHhcNMjMwNzE4MTYyNzQ3WhcNMjMwODE5MTYyODE3WjAS\nMRAwDgYDVQQDEwdteS1yb290MCowBQYDK2VwAyEAmZ+By07QvgAEX1HRjhltJlgK\nA8il2LYUpH0uw7f2lXCjdzB1MA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTAD\nAQH/MB0GA1UdDgQWBBTAcYaOaiKhDmYqSe6vg/lAtYspkDAfBgNVHSMEGDAWgBTA\ncYaOaiKhDmYqSe6vg/lAtYspkDASBgNVHREECzAJggdteS1yb290MAUGAytlcANB\nAG9xXZnKNEXRyfa91hm9S80PwlwIMh4MkWetwfPBn3M74cHzDK1okANmweca4RRq\nQHDPT7shx3CuosvL2Ori/ws=\n-----END CERTIFICATE-----`;
-export const unsupportedSignatureInt = `-----BEGIN CERTIFICATE-----\nMIICfTCCAWWgAwIBAgIUei2XIhhsP1/ytDciEGfA1C7t/sMwDQYJKoZIhvcNAQEL\nBQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wHhcNMjMwNzE4MTg1NDA3WhcNMjMw\nODE5MTg1NDM3WjASMRAwDgYDVQQDEwdpbnQtY3NyMCowBQYDK2VwAyEAa9vHnJA3\nnzA/fYiTUg8EhomjMtVp5O2c01nQRXEv72OjgcAwgb0wDgYDVR0PAQH/BAQDAgEG\nMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFGtjjUwrRGmFmYBHrUE38tSxvVM3\nMB8GA1UdIwQYMBaAFNng9+uArFyIUcD23XdvCSIfYiDPMEYGCCsGAQUFBwEBBDow\nODAZBggrBgEFBQcwAoYNaGFzaGljb3JwLmNvbTAbBggrBgEFBQcwAoYPdmF1bHRw\ncm9qZWN0LmlvMBIGA1UdEQQLMAmCB2ludC1jc3IwDQYJKoZIhvcNAQELBQADggEB\nAAOSNgZjesJG4BgLU8jQmOO7n6W8WcR+dT+ELDC1nLlEZ2BJCDSXXUX8AihIHKxn\nA9W4slABUacyJlAZo/o/wcxyfbA6PUXmHnoqEPZ3zXMwuLN/iRW7/uQvI6TIwnpH\nXETFARLmK8cfGgbhi24STkHTF4ljczkOab7sTUQTHELlo+F2gNtmgnyaBFCGUYor\nX1pkMBcBa9BWRsfhy8E+tBVVUrNNUddwzC/5nMLqT8XqENMndDoG7eeT9Ex6otZy\nzURkcq09FtcmyY2RBYkV4UzyHN7cESMIk/J33ZCNAfHaDGuOqTy5nYU5fTtjJcit\nwEcWiSesrKPCletBpuMpgiU=\n-----END CERTIFICATE-----\n`;
diff --git a/ui/tests/helpers/pki/workflow.js b/ui/tests/helpers/pki/workflow.js
deleted file mode 100644
index c962265dd63..00000000000
--- a/ui/tests/helpers/pki/workflow.js
+++ /dev/null
@@ -1,82 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { SELECTORS as ROLEFORM } from './pki-role-form';
-import { SELECTORS as GENERATECERT } from './pki-role-generate';
-import { SELECTORS as KEYFORM } from './pki-key-form';
-import { SELECTORS as KEYPAGES } from './page/pki-keys';
-import { SELECTORS as ISSUERDETAILS } from './pki-issuer-details';
-import { SELECTORS as CONFIGURATION } from './pki-configure-create';
-import { SELECTORS as DELETE } from './pki-delete-all-issuers';
-import { SELECTORS as TIDY } from './page/pki-tidy-form';
-import { SELECTORS as CONFIGEDIT } from './page/pki-configuration-edit';
-import { SELECTORS as GENROOT } from './pki-generate-root';
-
-export const SELECTORS = {
-  breadcrumbContainer: '[data-test-breadcrumbs]',
-  breadcrumbs: '[data-test-breadcrumbs] li',
-  overviewBreadcrumb: '[data-test-breadcrumbs] li:nth-of-type(2) > a',
-  pageTitle: '[data-test-pki-role-page-title]',
-  emptyState: '[data-test-component="empty-state"]',
-  emptyStateTitle: '[data-test-empty-state-title]',
-  emptyStateLink: '.empty-state-actions a',
-  emptyStateMessage: '[data-test-empty-state-message]',
-  // TABS
-  overviewTab: '[data-test-secret-list-tab="Overview"]',
-  rolesTab: '[data-test-secret-list-tab="Roles"]',
-  issuersTab: '[data-test-secret-list-tab="Issuers"]',
-  certsTab: '[data-test-secret-list-tab="Certificates"]',
-  keysTab: '[data-test-secret-list-tab="Keys"]',
-  tidyTab: '[data-test-secret-list-tab="Tidy"]',
-  configTab: '[data-test-secret-list-tab="Configuration"]',
-  // ROLES
-  deleteRoleButton: '[data-test-pki-role-delete]',
-  generateCertLink: '[data-test-pki-role-generate-cert]',
-  signCertLink: '[data-test-pki-role-sign-cert]',
-  editRoleLink: '[data-test-pki-role-edit-link]',
-  createRoleLink: '[data-test-pki-role-create-link]',
-  roleForm: {
-    ...ROLEFORM,
-  },
-  generateCertForm: {
-    ...GENERATECERT,
-  },
-  // KEYS
-  keyForm: {
-    ...KEYFORM,
-  },
-  keyPages: {
-    ...KEYPAGES,
-  },
-  // ISSUERS
-  issuerListItem: (id) => `[data-test-issuer-list="${id}"]`,
-  importIssuerLink: '[data-test-generate-issuer="import"]',
-  generateIssuerDropdown: '[data-test-issuer-generate-dropdown]',
-  generateIssuerRoot: '[data-test-generate-issuer="root"]',
-  generateIssuerIntermediate: '[data-test-generate-issuer="intermediate"]',
-  issuerPopupMenu: '[data-test-popup-menu-trigger]',
-  issuerPopupDetails: '[data-test-popup-menu-details]',
-  issuerDetails: {
-    title: '[data-test-pki-issuer-page-title]',
-    ...ISSUERDETAILS,
-  },
-  // CONFIGURATION
-  configuration: {
-    title: '[data-test-pki-configuration-page-title]',
-    emptyState: '[data-test-configuration-empty-state]',
-    nextStepsBanner: '[data-test-config-next-steps]',
-    importError: '[data-test-message-error]',
-    pkiBetaBanner: '[data-test-pki-configuration-banner]',
-    pkiBetaBannerLink: '[data-test-pki-configuration-banner] a',
-    ...CONFIGURATION,
-    ...DELETE,
-    ...TIDY,
-    ...GENROOT,
-  },
-  // EDIT CONFIGURATION
-  configEdit: {
-    ...CONFIGEDIT,
-  },
-};
diff --git a/ui/tests/helpers/policy-generator/kv.js b/ui/tests/helpers/policy-generator/kv.js
deleted file mode 100644
index d032a9f21f0..00000000000
--- a/ui/tests/helpers/policy-generator/kv.js
+++ /dev/null
@@ -1,100 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-const root = ['create', 'read', 'update', 'delete', 'list'];
-
-// returns a string with each capability wrapped in double quotes => ["create", "read"]
-const format = (array) => array.map((c) => `"${c}"`).join(', ');
-
-export const adminPolicy = (backend) => {
-  return `
-    path "${backend}/*" {
-      capabilities = [${format(root)}]
-    },
-  `;
-};
-
-export const dataPolicy = ({ backend, secretPath = '*', capabilities = root }) => {
-  // "delete" capability on this path can delete latest version
-  return `
-    path "${backend}/data/${secretPath}" {
-      capabilities = [${format(capabilities)}]
-    }
-  `;
-};
-
-export const dataNestedPolicy = ({ backend, secretPath = '*', capabilities = root }) => {
-  return `
-    path "${backend}/data/app/${secretPath}" {
-      capabilities = [${format(capabilities)}]
-    }
-  `;
-};
-
-export const metadataPolicy = ({ backend, secretPath = '*', capabilities = root }) => {
-  // "delete" capability on this path can destroy all versions
-  return `
-    path "${backend}/metadata/${secretPath}" {
-        capabilities = [${format(capabilities)}]
-    }
-  `;
-};
-
-export const metadataNestedPolicy = ({ backend, secretPath = '*', capabilities = root }) => {
-  return `
-    path "${backend}/metadata/app/${secretPath}" {
-        capabilities = [${format(capabilities)}]
-    }
-  `;
-};
-
-export const metadataListPolicy = (backend) => {
-  return `
-    path "${backend}/metadata" {
-        capabilities = ["list"]
-    }
-  `;
-};
-
-export const deleteVersionsPolicy = ({ backend, secretPath = '*' }) => {
-  return `
-    path "${backend}/delete/${secretPath}" {
-        capabilities = ["update"]
-    }
-  `;
-};
-export const undeleteVersionsPolicy = ({ backend, secretPath = '*' }) => {
-  return `
-    path "${backend}/undelete/${secretPath}" {
-        capabilities = ["update"]
-    }
-  `;
-};
-export const destroyVersionsPolicy = ({ backend, secretPath = '*' }) => {
-  return `
-    path "${backend}/destroy/${secretPath}" {
-        capabilities = ["update"]
-    }
-  `;
-};
-
-// Personas for reuse in workflow tests
-export const personas = {
-  admin: (backend) => adminPolicy(backend),
-  dataReader: (backend) => dataPolicy({ backend, capabilities: ['read'] }),
-  dataListReader: (backend) =>
-    dataPolicy({ backend, capabilities: ['read', 'delete'] }) + metadataListPolicy(backend),
-  metadataMaintainer: (backend) =>
-    metadataPolicy({ backend, capabilities: ['create', 'read', 'update', 'list'] }) +
-    deleteVersionsPolicy({ backend }) +
-    undeleteVersionsPolicy({ backend }) +
-    destroyVersionsPolicy({ backend }),
-  secretNestedCreator: (backend) =>
-    dataNestedPolicy({ backend, capabilities: ['create', 'update'] }) +
-    metadataNestedPolicy({ backend, capabilities: ['list', 'delete'] }),
-  secretCreator: (backend) =>
-    dataPolicy({ backend, capabilities: ['create', 'update'] }) +
-    metadataPolicy({ backend, capabilities: ['delete'] }),
-};
diff --git a/ui/tests/helpers/policy-generator/pki.js b/ui/tests/helpers/policy-generator/pki.js
deleted file mode 100644
index 9b306c942e5..00000000000
--- a/ui/tests/helpers/policy-generator/pki.js
+++ /dev/null
@@ -1,57 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { singularize } from 'ember-inflector';
-
-export const adminPolicy = (mountPath) => {
-  return `
-    path "${mountPath}/*" {
-      capabilities = ["create", "read", "update", "delete", "list"]
-    },
-  `;
-};
-
-// keys require singularized paths for GET
-export const readerPolicy = (mountPath, resource) => {
-  return `
-    path "${mountPath}/${resource}" {
-      capabilities = ["read", "list"]
-    },
-    path "${mountPath}/${resource}/*" {
-      capabilities = ["read", "list"]
-    },
-    path "${mountPath}/${singularize(resource)}" {
-      capabilities = ["read", "list"]
-    },
-    path "${mountPath}/${singularize(resource)}/*" {
-      capabilities = ["read", "list"]
-    },
-  `;
-};
-export const updatePolicy = (mountPath, resource) => {
-  return `
-    path "${mountPath}/${resource}" {
-      capabilities = ["read", "list"]
-    },
-    path "${mountPath}/${resource}/*" {
-      capabilities = ["read", "update"]
-    },
-    path "${mountPath}/${singularize(resource)}/*" {
-      capabilities = ["read", "update"]
-    },
-    path "${mountPath}/issue/*" {
-      capabilities = ["update"]
-    },
-    path "${mountPath}/generate/*" {
-      capabilities = ["update"]
-    },
-    path "${mountPath}/import" {
-      capabilities = ["update"]
-    },
-    path "${mountPath}/sign/*" {
-      capabilities = ["update"]
-    },
-  `;
-};
diff --git a/ui/tests/helpers/poll-cluster.js b/ui/tests/helpers/poll-cluster.js
index 2c46b6f0e1e..3da728fad74 100644
--- a/ui/tests/helpers/poll-cluster.js
+++ b/ui/tests/helpers/poll-cluster.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/helpers/replication.js b/ui/tests/helpers/replication.js
index 3024ee9d0e8..50f7c516dd7 100644
--- a/ui/tests/helpers/replication.js
+++ b/ui/tests/helpers/replication.js
@@ -1,9 +1,45 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { click, fillIn, findAll, currentURL, visit, settled, waitUntil } from '@ember/test-helpers';
+import ss from 'vault/tests/pages/components/search-select';
+import { create } from 'ember-cli-page-object';
+import { clickTrigger } from 'ember-power-select/test-support/helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+const searchSelect = create(ss);
+/**
+ * Enables replication mode.
+ * @param {string} type - The replication type ('performance' or 'dr').
+ * @param {string} mode - The cluster mode ('primary' or 'secondary').
+ */
+export async function enableReplication(type, mode) {
+  await visit('/vault/replication');
+  await click(`[data-test-replication-type-select="${type}"]`);
+  await fillIn('[data-test-replication-cluster-mode-select]', mode);
+  await click(GENERAL.submitButton);
+}
+
+/**
+ * Adds a secondary cluster.
+ * @param {string} secondaryName - The name of the secondary cluster.
+ * @param {string} mountFilterMode - The mount filter mode ('deny' or 'allow').
+ */
+export async function addSecondary(secondaryName, mountFilterMode = null) {
+  await click('[data-test-replication-link="secondaries"]');
+  await click('[data-test-secondary-add]');
+  await fillIn('[data-test-input="Secondary ID"]', secondaryName);
+
+  if (mountFilterMode) {
+    await click(`#${mountFilterMode}`);
+    await clickTrigger();
+    await searchSelect.options.objectAt(0).click();
+  }
+
+  await click(GENERAL.submitButton);
+}
 
 export const disableReplication = async (type, assert) => {
   // disable performance replication
@@ -16,16 +52,15 @@ export const disableReplication = async (type, assert) => {
 
     const typeDisplay = type === 'dr' ? 'Disaster Recovery' : 'Performance';
     await fillIn('[data-test-confirmation-modal-input="Disable Replication?"]', typeDisplay);
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
     await settled(); // eslint-disable-line
 
     if (assert) {
-      // bypassing for now -- remove if tests pass reliably
-      // assert.strictEqual(
-      //   flash.latestMessage,
-      //   'This cluster is having replication disabled. Vault will be unavailable for a brief period and will resume service shortly.',
-      //   'renders info flash when disabled'
-      // );
+      assert
+        .dom(GENERAL.latestFlashContent)
+        .hasText(
+          'This cluster is having replication disabled. Vault will be unavailable for a brief period and will resume service shortly.'
+        );
       assert.ok(
         await waitUntil(() => currentURL() === '/vault/replication'),
         'redirects to the replication page'
diff --git a/ui/tests/helpers/secret-edit-toolbar.js b/ui/tests/helpers/secret-edit-toolbar.js
deleted file mode 100644
index bb0797c2850..00000000000
--- a/ui/tests/helpers/secret-edit-toolbar.js
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { click } from '@ember/test-helpers';
-const SELECTORS = {
-  dropdown: '[data-test-copy-menu-trigger]',
-  wrapButton: '[data-test-wrap-button]',
-};
-export default async function assertSecretWrap(assert, server, path) {
-  server.get(path, () => {
-    assert.ok(true, `request made to ${path} when wrapping secret`);
-  });
-  await click(SELECTORS.dropdown);
-  await click(SELECTORS.wrapButton);
-}
diff --git a/ui/tests/helpers/secret-engine/database-helpers.ts b/ui/tests/helpers/secret-engine/database-helpers.ts
new file mode 100644
index 00000000000..ab597b64733
--- /dev/null
+++ b/ui/tests/helpers/secret-engine/database-helpers.ts
@@ -0,0 +1,347 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+// If we refactor the database/connection model we can move this const to a util and use it in a form component.
+// The ideal (future) scenario is the API provides this and we don't have to manually write the schema :)
+export const EXPECTED_FIELDS = {
+  'elasticsearch-database-plugin': {
+    default: [
+      'url',
+      'username',
+      'password',
+      'ca_cert',
+      'ca_path',
+      'client_cert',
+      'client_key',
+      'tls_server_name',
+      'insecure',
+      'username_template',
+    ],
+    showAttrs: [
+      'plugin_name',
+      'name',
+      'password_policy',
+      'url',
+      'ca_cert',
+      'ca_path',
+      'client_cert',
+      'client_key',
+      'tls_server_name',
+      'insecure',
+      'username_template',
+      'allowed_roles',
+    ],
+    fieldAttrs: ['plugin_name', 'name', 'verify_connection', 'password_policy'],
+    pluginFieldGroups: undefined,
+    statementFields: [],
+  },
+  'mongodb-database-plugin': {
+    default: ['username', 'password', 'write_concern', 'username_template'],
+    showAttrs: [
+      'plugin_name',
+      'name',
+      'connection_url',
+      'password_policy',
+      'write_concern',
+      'username_template',
+      'tls',
+      'tls_ca',
+      'root_rotation_statements',
+      'allowed_roles',
+    ],
+    fieldAttrs: ['plugin_name', 'name', 'connection_url', 'verify_connection', 'password_policy'],
+    pluginFieldGroups: ['username', 'password', 'write_concern', 'username_template'],
+    statementFields: [
+      {
+        name: 'root_rotation_statements',
+        options: {
+          defaultShown: 'Default',
+          editType: 'stringArray',
+          subText:
+            "The database statements to be executed to rotate the root user's credentials. If nothing is entered, Vault will use a reasonable default.",
+        },
+        type: undefined,
+      },
+    ],
+    'TLS options': ['tls', 'tls_ca'],
+  },
+  'mssql-database-plugin': {
+    default: [
+      'username',
+      'password',
+      'username_template',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+    ],
+    showAttrs: [
+      'plugin_name',
+      'name',
+      'connection_url',
+      'password_policy',
+      'username_template',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'root_rotation_statements',
+      'allowed_roles',
+    ],
+    fieldAttrs: ['plugin_name', 'name', 'connection_url', 'verify_connection', 'password_policy'],
+    statementFields: [
+      {
+        name: 'root_rotation_statements',
+        options: {
+          defaultShown: 'Default',
+          editType: 'stringArray',
+          subText:
+            "The database statements to be executed to rotate the root user's credentials. If nothing is entered, Vault will use a reasonable default.",
+        },
+        type: undefined,
+      },
+    ],
+  },
+  'mysql-aurora-database-plugin': {
+    default: [
+      'connection_url',
+      'username',
+      'password',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'username_template',
+    ],
+    showAttrs: [
+      'plugin_name',
+      'name',
+      'password_policy',
+      'connection_url',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'username_template',
+      'tls',
+      'tls_ca',
+      'root_rotation_statements',
+      'allowed_roles',
+    ],
+    fieldAttrs: ['plugin_name', 'name', 'verify_connection', 'password_policy'],
+    statementFields: [
+      {
+        name: 'root_rotation_statements',
+        options: {
+          defaultShown: 'Default',
+          editType: 'stringArray',
+          subText:
+            "The database statements to be executed to rotate the root user's credentials. If nothing is entered, Vault will use a reasonable default.",
+        },
+        type: undefined,
+      },
+    ],
+    'TLS options': ['tls', 'tls_ca'],
+  },
+  'mysql-legacy-database-plugin': {
+    default: [
+      'connection_url',
+      'username',
+      'password',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'username_template',
+    ],
+    showAttrs: [
+      'plugin_name',
+      'name',
+      'password_policy',
+      'connection_url',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'username_template',
+      'tls',
+      'tls_ca',
+      'root_rotation_statements',
+      'allowed_roles',
+    ],
+    fieldAttrs: ['plugin_name', 'name', 'verify_connection', 'password_policy'],
+    statementFields: [
+      {
+        name: 'root_rotation_statements',
+        options: {
+          defaultShown: 'Default',
+          editType: 'stringArray',
+          subText:
+            "The database statements to be executed to rotate the root user's credentials. If nothing is entered, Vault will use a reasonable default.",
+        },
+        type: undefined,
+      },
+    ],
+    'TLS options': ['tls', 'tls_ca'],
+  },
+  'mysql-database-plugin': {
+    default: [
+      'connection_url',
+      'username',
+      'password',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'username_template',
+    ],
+    showAttrs: [
+      'plugin_name',
+      'name',
+      'password_policy',
+      'connection_url',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'username_template',
+      'tls',
+      'tls_ca',
+      'root_rotation_statements',
+      'allowed_roles',
+    ],
+    fieldAttrs: ['plugin_name', 'name', 'verify_connection', 'password_policy'],
+    statementFields: [
+      {
+        name: 'root_rotation_statements',
+        options: {
+          defaultShown: 'Default',
+          editType: 'stringArray',
+          subText:
+            "The database statements to be executed to rotate the root user's credentials. If nothing is entered, Vault will use a reasonable default.",
+        },
+        type: undefined,
+      },
+    ],
+    'TLS options': ['tls', 'tls_ca'],
+  },
+  'mysql-rds-database-plugin': {
+    default: [
+      'connection_url',
+      'username',
+      'password',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'username_template',
+    ],
+    showAttrs: [
+      'plugin_name',
+      'name',
+      'password_policy',
+      'connection_url',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'username_template',
+      'tls',
+      'tls_ca',
+      'root_rotation_statements',
+      'allowed_roles',
+    ],
+    fieldAttrs: ['plugin_name', 'name', 'verify_connection', 'password_policy'],
+    statementFields: [
+      {
+        name: 'root_rotation_statements',
+        options: {
+          defaultShown: 'Default',
+          editType: 'stringArray',
+          subText:
+            "The database statements to be executed to rotate the root user's credentials. If nothing is entered, Vault will use a reasonable default.",
+        },
+        type: undefined,
+      },
+    ],
+    'TLS options': ['tls', 'tls_ca'],
+  },
+  'vault-plugin-database-oracle': {
+    default: [
+      'connection_url',
+      'username',
+      'password',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'username_template',
+    ],
+    showAttrs: [
+      'plugin_name',
+      'name',
+      'password_policy',
+      'connection_url',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'username_template',
+      'root_rotation_statements',
+      'allowed_roles',
+    ],
+    fieldAttrs: ['plugin_name', 'name', 'verify_connection', 'password_policy'],
+    statementFields: [
+      {
+        name: 'root_rotation_statements',
+        options: {
+          defaultShown: 'Default',
+          editType: 'stringArray',
+          subText:
+            "The database statements to be executed to rotate the root user's credentials. If nothing is entered, Vault will use a reasonable default.",
+        },
+        type: undefined,
+      },
+    ],
+  },
+  'postgresql-database-plugin': {
+    default: [
+      'connection_url',
+      'username',
+      'password',
+      'password_authentication',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'auth_type',
+      'service_account_json',
+      'use_private_ip',
+      'username_template',
+      'disable_escaping',
+    ],
+    showAttrs: [
+      'plugin_name',
+      'name',
+      'password_policy',
+      'connection_url',
+      'password_authentication',
+      'max_open_connections',
+      'max_idle_connections',
+      'max_connection_lifetime',
+      'auth_type',
+      'service_account_json',
+      'use_private_ip',
+      'username_template',
+      'disable_escaping',
+      'root_rotation_statements',
+      'private_key',
+      'tls_ca',
+      'tls_certificate',
+      'allowed_roles',
+    ],
+    fieldAttrs: ['plugin_name', 'name', 'verify_connection', 'password_policy'],
+    statementFields: [
+      {
+        name: 'root_rotation_statements',
+        options: {
+          defaultShown: 'Default',
+          editType: 'stringArray',
+          subText:
+            "The database statements to be executed to rotate the root user's credentials. If nothing is entered, Vault will use a reasonable default.",
+        },
+        type: undefined,
+      },
+    ],
+    enterpriseOnly: 'self_managed',
+  },
+};
diff --git a/ui/tests/helpers/secret-engine/general-settings-selectors.ts b/ui/tests/helpers/secret-engine/general-settings-selectors.ts
new file mode 100644
index 00000000000..72cb800dcb1
--- /dev/null
+++ b/ui/tests/helpers/secret-engine/general-settings-selectors.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const SELECTORS = {
+  manageDropdown: '[data-test-manage-dropdown]',
+  manageDropdownItem: (name: string) => `[data-test-manage-dropdown-item="${name}"]`,
+  label: (name: string) => `[data-test-label="${name}"]`,
+  helperText: (name: string) => `[data-test-helper-text="${name}"]`,
+  ttlPickerV2: '[data-test-ttl-picker-v2]',
+  versionCard: {
+    engineType: '[data-test-engine-type]',
+    currentVersion: '[data-test-engine-current-version]',
+    versionsDropdown: `[data-test-versions-dropdown]`,
+  },
+};
diff --git a/ui/tests/helpers/secret-engine/mocks.ts b/ui/tests/helpers/secret-engine/mocks.ts
new file mode 100644
index 00000000000..5f8116fa4f1
--- /dev/null
+++ b/ui/tests/helpers/secret-engine/mocks.ts
@@ -0,0 +1,30 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const keyMgmtMockModel = {
+  secretsEngine: {
+    accessor: 'keymgmt_accessor',
+    config: {
+      default_lease_ttl: 2073600,
+      force_no_cache: false,
+      listing_visibility: 'hidden',
+      max_lease_ttl: 4320000,
+    },
+    description: 'hello',
+    external_entropy_access: false,
+    local: true,
+    options: {},
+    path: 'keymgmt/',
+    plugin_version: '',
+    running_plugin_version: 'v0.17.1+builtin',
+    running_sha256: '',
+    seal_wrap: false,
+    type: 'keymgmt',
+    uuid: '4ea92618-5b52-f89a-9cbe-b65dc7e65689',
+    id: 'keymgmt',
+    backendConfigurationLink: `vault.cluster.secrets.backend.configuration`,
+  },
+  versions: ['v0.17.1+builtin'],
+};
diff --git a/ui/tests/helpers/secret-engine/policy-generator.ts b/ui/tests/helpers/secret-engine/policy-generator.ts
new file mode 100644
index 00000000000..778e90511d5
--- /dev/null
+++ b/ui/tests/helpers/secret-engine/policy-generator.ts
@@ -0,0 +1,36 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+// This policy can mount a secret engine
+// and list and create oidc keys, relevant for setting identity_key_token for WIF
+export const adminOidcCreateRead = (mountPath: string) => {
+  return `
+    path "sys/mounts/*" {
+      capabilities = ["create", "read", "update", "delete", "list"]
+    },
+    path "identity/oidc/key/*" {
+      capabilities = ["create", "read", "update", "delete", "list"]
+    },
+   path "${mountPath}/*" {
+      capabilities = ["create", "read", "update", "delete", "list"]
+    },
+  `;
+};
+
+// This policy can mount the engine
+// But does not have access to oidc/key list or read
+export const adminOidcCreate = (mountPath: string) => {
+  return `
+    path "sys/mounts/*" {
+      capabilities = ["create", "read", "update", "delete", "list"]
+    },
+    path "${mountPath}/*" {
+      capabilities = ["create", "read", "update", "delete", "list"]
+    },
+    path "identity/oidc/key/*" {
+      capabilities = ["create", "update"]
+    },
+  `;
+};
diff --git a/ui/tests/helpers/secret-engine/secret-engine-helpers.js b/ui/tests/helpers/secret-engine/secret-engine-helpers.js
new file mode 100644
index 00000000000..85ff009e066
--- /dev/null
+++ b/ui/tests/helpers/secret-engine/secret-engine-helpers.js
@@ -0,0 +1,403 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, fillIn, find } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { v4 as uuidv4 } from 'uuid';
+import SecretsEngineResource from 'vault/resources/secrets/engine';
+
+/* Secret Create/Edit methods */
+// ARG TODO unsure if should be moved to another file
+export async function createSecret(path, key, value) {
+  await fillIn(SES.secretPath('create'), path);
+  await fillIn('[data-test-secret-key]', key);
+  await fillIn('[data-test-secret-value] textarea', value);
+  await click(GENERAL.submitButton);
+  return;
+}
+
+export const createSecretsEngine = (store, type, path, version) => {
+  if (store) {
+    store.pushPayload('secret-engine', {
+      modelName: 'secret-engine',
+      id: path,
+      path: `${path}/`,
+      type: type,
+      running_plugin_version: version,
+      data: {
+        type: type,
+      },
+    });
+    return store.peekRecord('secret-engine', path);
+  }
+
+  return new SecretsEngineResource({
+    path: `${path}/`,
+    type,
+    running_plugin_version: version,
+  });
+};
+/* Create configurations methods
+ * for each configuration we create the record and then push it to the store.
+ */
+export function configUrl(type, backend) {
+  switch (type) {
+    case 'aws':
+      return `/${backend}/config/root`;
+    case 'aws-lease':
+      return `/${backend}/config/lease`;
+    case 'ssh':
+      return `/${backend}/config/ca`;
+    default:
+      return `/${backend}/config`;
+  }
+}
+
+const createAwsRootConfig = (accessType = 'iam') => {
+  if (accessType === 'wif') {
+    return {
+      role_arn: '123-role',
+      identity_token_audience: '123-audience',
+      identity_token_ttl: 7200,
+    };
+  } else if (accessType === 'no-access') {
+    // set root config options that are not associated with accessType 'wif' or 'iam'
+    return {
+      region: 'ap-northeast-1',
+    };
+  } else {
+    return {
+      region: 'us-west-2',
+      access_key: '123-key',
+      iam_endpoint: 'iam-endpoint',
+      sts_endpoint: 'sts-endpoint',
+      max_retries: 1,
+    };
+  }
+};
+
+const createAwsLeaseConfig = () => {
+  return {
+    lease: '50s',
+    lease_max: '55s',
+  };
+};
+
+const createSshCaConfig = () => {
+  return {
+    public_key: 'public-key',
+    generate_signing_key: true,
+  };
+};
+
+const createAzureConfig = (accessType = 'generic') => {
+  // note: allowed "environment" params for testing https://github.com/hashicorp/vault-plugin-secrets-azure/blob/main/client.go#L35-L37
+  if (accessType === 'azure') {
+    return {
+      client_secret: 'client-secret',
+      subscription_id: 'subscription-id',
+      tenant_id: 'tenant-id',
+      client_id: 'client-id',
+      root_password_ttl: '1800000s',
+      environment: 'AZUREPUBLICCLOUD',
+    };
+  } else if (accessType === 'wif') {
+    return {
+      subscription_id: 'subscription-id',
+      tenant_id: 'tenant-id',
+      client_id: 'client-id',
+      identity_token_audience: 'audience',
+      identity_token_ttl: 7200,
+      root_password_ttl: '1800000s',
+      environment: 'AZUREPUBLICCLOUD',
+    };
+  } else {
+    return {
+      subscription_id: 'subscription-id-2',
+      tenant_id: 'tenant-id-2',
+      client_id: 'client-id-2',
+      environment: 'AZUREPUBLICCLOUD',
+      root_password_ttl: '1800000s',
+    };
+  }
+};
+
+const createGcpConfig = (accessType = 'gcp') => {
+  if (accessType === 'wif') {
+    return {
+      service_account_email: 'service-email',
+      identity_token_audience: 'audience',
+      identity_token_ttl: 7200,
+    };
+  } else {
+    return {
+      credentials: '{"some-key":"some-value"}',
+      ttl: '100s',
+      max_ttl: '101s',
+    };
+  }
+};
+
+export const createConfig = (type) => {
+  switch (type) {
+    case 'aws':
+    case 'aws-generic':
+      return createAwsRootConfig();
+    case 'aws-wif':
+      return createAwsRootConfig('wif');
+    case 'aws-no-access':
+      return createAwsRootConfig('no-access');
+    case 'aws-lease':
+      return createAwsLeaseConfig();
+    case 'ssh':
+      return createSshCaConfig();
+    case 'azure':
+      return createAzureConfig('azure');
+    case 'azure-wif':
+      return createAzureConfig('wif');
+    case 'azure-generic':
+      return createAzureConfig('generic');
+    case 'gcp':
+    case 'gcp-generic':
+      return createGcpConfig();
+    case 'gcp-wif':
+      return createGcpConfig('wif');
+  }
+};
+/* Manually create the configuration by filling in the configuration form */
+export const fillInAwsConfig = async (situation = 'withAccess') => {
+  if (situation === 'withAccess') {
+    await fillIn(GENERAL.inputByAttr('access_key'), 'foo');
+    await fillIn(GENERAL.inputByAttr('secret_key'), 'bar');
+  }
+  if (situation === 'withAccessOptions') {
+    await click(GENERAL.button('Root config options'));
+    await fillIn(GENERAL.inputByAttr('region'), 'ca-central-1');
+    await fillIn(GENERAL.inputByAttr('iam_endpoint'), 'iam-endpoint');
+    await fillIn(GENERAL.inputByAttr('sts_endpoint'), 'sts-endpoint');
+    await fillIn(GENERAL.inputByAttr('max_retries'), '3');
+  }
+  if (situation === 'withLease') {
+    await click(GENERAL.ttl.toggle('Default Lease TTL'));
+    await fillIn(GENERAL.ttl.input('Default Lease TTL'), '33');
+    await click(GENERAL.ttl.toggle('Max Lease TTL'));
+    await fillIn(GENERAL.ttl.input('Max Lease TTL'), '44');
+  }
+  if (situation === 'withWif') {
+    await click(SES.wif.accessType('wif')); // toggle to wif
+    await fillIn(GENERAL.inputByAttr('issuer'), `http://bar.${uuidv4()}`); // make random because global setting
+    await fillIn(GENERAL.inputByAttr('role_arn'), 'foo-role');
+    await fillIn(GENERAL.inputByAttr('identity_token_audience'), 'foo-audience');
+    await click(GENERAL.ttl.toggle('Identity token TTL'));
+    await fillIn(GENERAL.ttl.input('Identity token TTL'), '7200');
+  }
+};
+
+export const fillInAzureConfig = async (withWif = false) => {
+  await fillIn(GENERAL.inputByAttr('subscription_id'), 'subscription-id');
+  await fillIn(GENERAL.inputByAttr('tenant_id'), 'tenant-id');
+  await fillIn(GENERAL.inputByAttr('client_id'), 'client-id');
+  // options may already be toggled so check before clicking
+  if (!find(GENERAL.inputByAttr('environment'))) {
+    await click(GENERAL.button('More options'));
+  }
+  await fillIn(GENERAL.inputByAttr('environment'), 'AZUREPUBLICCLOUD');
+  // similarly, the root password TTL may already be toggled
+  if (!find(GENERAL.ttl.input('Root password TTL'))) {
+    await click(GENERAL.ttl.toggle('Root password TTL'));
+  }
+  await fillIn(GENERAL.ttl.input('Root password TTL'), '200');
+
+  if (withWif) {
+    await click(SES.wif.accessType('wif')); // toggle to wif
+    await fillIn(GENERAL.inputByAttr('identity_token_audience'), 'azure-audience');
+    await click(GENERAL.ttl.toggle('Identity token TTL'));
+    await fillIn(GENERAL.ttl.input('Identity token TTL'), '7200');
+  } else {
+    await fillIn(GENERAL.inputByAttr('client_secret'), 'client-secret');
+  }
+};
+
+export const fillInGcpConfig = async (withWif = false) => {
+  if (withWif) {
+    await click(SES.wif.accessType('wif')); // toggle to wif
+    await fillIn(GENERAL.inputByAttr('identity_token_audience'), 'azure-audience');
+    await click(GENERAL.ttl.toggle('Identity token TTL'));
+    await fillIn(GENERAL.ttl.input('Identity token TTL'), '7200');
+    await fillIn(GENERAL.inputByAttr('service_account_email'), 'some@email.com');
+  } else {
+    await click(GENERAL.button('More options'));
+    await click(GENERAL.ttl.toggle('Config TTL'));
+    await fillIn(GENERAL.ttl.input('Config TTL'), '7200');
+    await click(GENERAL.ttl.toggle('Max TTL'));
+    await fillIn(GENERAL.ttl.input('Max TTL'), '8200');
+    await click(GENERAL.textToggle);
+    await fillIn(GENERAL.maskedInput, '{"some-key":"some-value"}');
+  }
+};
+
+/* Generate arrays of keys to iterate over.
+ * used to check details of the secret engine configuration
+ * and used to check the form to configure the secret engine
+ */
+// WIF specific keys
+const genericWifKeys = ['Identity token audience', 'Identity token TTL'];
+// AWS specific keys
+const awsLeaseKeys = ['Default Lease TTL', 'Max Lease TTL'];
+const awsKeys = ['Access key', 'Secret key', 'Region', 'IAM endpoint', 'STS endpoint', 'Max retries'];
+const awsWifKeys = ['Issuer', 'Role ARN', ...genericWifKeys];
+// Azure specific keys
+const genericAzureKeys = ['Subscription ID', 'Tenant ID', 'Client ID', 'Environment', 'Root password TTL'];
+const azureKeys = [...genericAzureKeys, 'Client secret'];
+const azureWifKeys = [...genericAzureKeys, ...genericWifKeys];
+// GCP specific keys
+const genericGcpKeys = ['Config TTL', 'Max TTL'];
+const gcpKeys = [...genericGcpKeys, 'Credentials'];
+const gcpWifKeys = [...genericWifKeys, 'Service account email'];
+// SSH specific keys
+const sshKeys = ['Private key', 'Public key', 'Generate signing key'];
+
+export const expectedConfigKeys = (type, snake_case = false) => {
+  const getKeys = (keys) => (snake_case ? keys.map((str) => str.replace(/\s+/g, '_').toLowerCase()) : keys);
+
+  switch (type) {
+    case 'aws':
+      return getKeys(awsKeys);
+    case 'aws-wif':
+      return getKeys(awsWifKeys);
+    case 'aws-lease':
+      return getKeys(awsLeaseKeys);
+    case 'azure':
+      return getKeys(azureKeys);
+    case 'azure-wif':
+      return getKeys(azureWifKeys);
+    case 'gcp':
+      return getKeys(gcpKeys);
+    case 'gcp-wif':
+      return getKeys(gcpWifKeys);
+    case 'ssh':
+      return getKeys(sshKeys);
+  }
+};
+
+const valueOfAwsKeys = (string) => {
+  switch (string) {
+    case 'Access key':
+      return '123-key';
+    case 'Region':
+      return 'us-west-2';
+    case 'IAM endpoint':
+      return 'iam-endpoint';
+    case 'STS endpoint':
+      return 'sts-endpoint';
+    case 'Max retries':
+      return '1';
+  }
+};
+
+const valueOfAzureKeys = (string) => {
+  switch (string) {
+    case 'Subscription ID':
+      return 'subscription-id';
+    case 'Tenant ID':
+      return 'tenant-id';
+    case 'Client ID':
+      return 'client-id';
+    case 'Environment':
+      return 'AZUREPUBLICCLOUD';
+    case 'Root password TTL':
+      return '20 days 20 hours';
+    case 'Identity token audience':
+      return 'audience';
+    case 'Identity token TTL':
+      return '8 days 8 hours';
+  }
+};
+
+const valueOfGcpKeys = (string) => {
+  switch (string) {
+    case 'Credentials':
+      return '"{"some-key":"some-value"}",';
+    case 'Service account email':
+      return 'service-email';
+    case 'Config TTL':
+      return '1 minute 40 seconds';
+    case 'Max TTL':
+      return '1 minute 41 seconds';
+    case 'Identity token audience':
+      return 'audience';
+    case 'Identity token TTL':
+      return '8 days 8 hours';
+  }
+};
+
+const valueOfSshKeys = (string) => {
+  switch (string) {
+    case 'Public key':
+      return '***********';
+    case 'Generate signing key':
+      return 'Yes';
+  }
+};
+// Used in tests to assert the expected values in the config details of configurable secret engines
+export const expectedValueOfConfigKeys = (type, string) => {
+  switch (type) {
+    case 'aws':
+      return valueOfAwsKeys(string);
+    case 'azure':
+      return valueOfAzureKeys(string);
+    case 'gcp':
+      return valueOfGcpKeys(string);
+    case 'ssh':
+      return valueOfSshKeys(string);
+  }
+};
+
+// Example usage
+// createLongJson (2, 3) will create a json object with 2 original keys, each with 3 nested keys
+// {
+// 	"key-0": {
+// 		"nested-key-0": {
+// 			"nested-key-1": {
+// 				"nested-key-2": "nested-value"
+// 			}
+// 		}
+// 	},
+// 	"key-1": {
+// 		"nested-key-0": {
+// 			"nested-key-1": {
+// 				"nested-key-2": "nested-value"
+// 			}
+// 		}
+// 	}
+// }
+
+export function createLongJson(lines = 10, nestLevel = 3) {
+  const keys = Array.from({ length: nestLevel }, (_, i) => `nested-key-${i}`);
+  const jsonObject = {};
+
+  for (let i = 0; i < lines; i++) {
+    nestLevel > 0
+      ? (jsonObject[`key-${i}`] = createNestedObject({}, keys, 'nested-value'))
+      : (jsonObject[`key-${i}`] = 'non-nested-value');
+  }
+  return jsonObject;
+}
+
+function createNestedObject(obj = {}, keys, value) {
+  let current = obj;
+
+  for (let i = 0; i < keys.length - 1; i++) {
+    const key = keys[i];
+    if (!current[key]) {
+      current[key] = {};
+    }
+    current = current[key];
+  }
+
+  current[keys[keys.length - 1]] = value;
+  return obj;
+}
diff --git a/ui/tests/helpers/secret-engine/secret-engine-selectors.ts b/ui/tests/helpers/secret-engine/secret-engine-selectors.ts
new file mode 100644
index 00000000000..49e68689376
--- /dev/null
+++ b/ui/tests/helpers/secret-engine/secret-engine-selectors.ts
@@ -0,0 +1,50 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const SECRET_ENGINE_SELECTORS = {
+  configTab: '[data-test-configuration-tab]',
+  configure: '[data-test-secret-backend-configure]',
+  configureNote: (name: string) => `[data-test-configure-note="${name}"]`,
+  configureTitle: (type: string) => `[data-test-backend-configure-title="${type}"]`,
+  configurationToggle: '[data-test-mount-config-toggle]',
+  crumb: (path: string) => `[data-test-secret-breadcrumb="${path}"] a`,
+  error: {
+    title: '[data-test-backend-error-title]',
+  },
+  generateLink: '[data-test-backend-credentials]',
+  // ARG TODO try without the optional path because it should always have an id passed in
+  secretsBackendLink: (path: string) =>
+    path ? `[data-test-secrets-backend-link="${path}"]` : '[data-test-secrets-backend-link]',
+  createSecretLink: '[data-test-create-secret-link]',
+  secretPath: (name: string) => (name ? `[data-test-secret-path="${name}"]` : '[data-test-secret-path]'),
+  secretKey: (name: string) => `[data-test-secret-key="${name}"]`,
+  secretHeader: '[data-test-secret-header]',
+  secretLink: (name: string) => (name ? `[data-test-secret-link="${name}"]` : '[data-test-secret-link]'),
+  secretLinkMenu: (name: string) => `[data-test-secret-link="${name}"] [data-test-popup-menu-trigger]`,
+  secretLinkATag: (name: string) =>
+    name ? `[data-test-secret-item-link="${name}"]` : '[data-test-secret-item-link]',
+  viewBackend: '[data-test-backend-view-link]',
+  warning: '[data-test-warning]',
+  configureForm: '[data-test-configure-form]',
+  additionalConfigModelTitle: '[data-test-additional-config-model-title]',
+  wif: {
+    accessTypeSection: '[data-test-access-type-section]',
+    accessTitle: '[data-test-access-title]',
+    accessType: (type: string) => `[data-test-access-type="${type}"]`,
+    accessTypeSubtext: '[data-test-access-type-subtext]',
+    issuerWarningCancel: '[data-test-issuer-cancel]',
+    issuerWarningMessage: '[data-test-issuer-warning-message]',
+    issuerWarningModal: '[data-test-issuer-warning]',
+    issuerWarningSave: '[data-test-issuer-save]',
+  },
+  aws: {
+    deleteRole: (role: string) => `[data-test-aws-role-delete="${role}"]`,
+  },
+  ssh: {
+    editConfigSection: '[data-test-edit-config-section]',
+    createRole: '[data-test-role-ssh-create]',
+    deleteRole: '[data-test-ssh-role-delete]',
+  },
+};
diff --git a/ui/tests/helpers/stubs.js b/ui/tests/helpers/stubs.js
index 887fb82d1d1..53692f0645b 100644
--- a/ui/tests/helpers/stubs.js
+++ b/ui/tests/helpers/stubs.js
@@ -1,13 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+import { Response } from 'miragejs';
+
 export function capabilitiesStub(requestPath, capabilitiesArray) {
   // sample of capabilitiesArray: ['read', 'update']
   return {
-    [requestPath]: capabilitiesArray,
-    capabilities: capabilitiesArray,
     request_id: '40f7e44d-af5c-9b60-bd20-df72eb17e294',
     lease_id: '',
     renewable: false,
@@ -57,3 +57,26 @@ export function allowAllCapabilitiesStub(capabilitiesList = ['root']) {
     };
   };
 }
+
+/**
+ * returns a response with the given httpStatus and data based on status
+ * @param {number} httpStatus 403, 404, 204, or 200 (default)
+ * @param {object} payload what to return in the response if status is 200
+ * @returns {Response}
+ */
+export function overrideResponse(httpStatus = 200, payload = {}) {
+  if (httpStatus === 403) {
+    return new Response(
+      403,
+      { 'Content-Type': 'application/json' },
+      JSON.stringify({ errors: ['permission denied'] })
+    );
+  }
+  if (httpStatus === 404) {
+    return new Response(404, { 'Content-Type': 'application/json' });
+  }
+  if (httpStatus === 204) {
+    return new Response(204, { 'Content-Type': 'application/json' });
+  }
+  return new Response(httpStatus, { 'Content-Type': 'application/json' }, payload);
+}
diff --git a/ui/tests/helpers/sync/setup-hooks.js b/ui/tests/helpers/sync/setup-hooks.js
new file mode 100644
index 00000000000..79f0b9a995f
--- /dev/null
+++ b/ui/tests/helpers/sync/setup-hooks.js
@@ -0,0 +1,79 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+// creates destination and association model for use in sync integration tests
+// ensure that setupMirage is used prior to setupModels since this.server is used
+export function setupDataStubs(hooks) {
+  hooks.beforeEach(function () {
+    // most tests are good with the default data generated here
+    // allow for this to be overridden to test different types
+    this.setupStubsForType = (destType) => {
+      const {
+        id, // eslint-disable-line no-unused-vars
+        name,
+        type,
+        granularity,
+        secret_name_template,
+        custom_tags,
+        purge_initiated_at,
+        purge_error,
+        ...connection_details
+      } = this.server.create('sync-destination', destType);
+
+      this.destination = {
+        name,
+        type,
+        connection_details,
+        options: {
+          granularity_level: granularity,
+          secret_name_template,
+          custom_tags,
+        },
+        purge_initiated_at,
+        purge_error,
+      };
+
+      this.destinations = [this.destination];
+      this.destinations.meta = {
+        filteredTotal: this.destinations.length,
+        currentPage: 1,
+        pageSize: 5,
+      };
+
+      const association = this.server.create('sync-association', {
+        type: this.destination.type,
+        name: this.destination.name,
+        mount: 'kv',
+        secret_name: 'my-secret',
+        sync_status: 'SYNCED',
+        updated_at: '2023-09-20T10:51:53.961861096', // removed tz offset so time is consistently displayed
+      });
+      this.association = {
+        ...association,
+        destination_type: this.destination.type,
+        destination_name: this.destination.name,
+      };
+      this.associations = [this.association];
+      this.associations.meta = {
+        filteredTotal: this.associations.length,
+        currentPage: 1,
+        pageSize: 5,
+      };
+
+      const capabilitiesService = this.owner.lookup('service:capabilities');
+      const paths = [
+        capabilitiesService.pathFor('syncDestination', this.destination),
+        capabilitiesService.pathFor('syncSetAssociation', this.destination),
+        capabilitiesService.pathFor('syncRemoveAssociation', this.destination),
+      ];
+      this.capabilities = paths.reduce((obj, path) => {
+        obj[path] = { canRead: true, canCreate: true, canUpdate: true, canDelete: true };
+        return obj;
+      }, {});
+    };
+
+    this.setupStubsForType('aws-sm');
+  });
+}
diff --git a/ui/tests/helpers/sync/setup-models.js b/ui/tests/helpers/sync/setup-models.js
deleted file mode 100644
index 00a3a851da3..00000000000
--- a/ui/tests/helpers/sync/setup-models.js
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// creates destination and association model for use in sync integration tests
-// ensure that setupMirage is used prior to setupModels since this.server is used
-export function setupModels(hooks) {
-  hooks.beforeEach(function () {
-    this.store = this.owner.lookup('service:store');
-
-    const destination = this.server.create('sync-destination', 'aws-sm', { name: 'us-west-1' });
-    const destinationModelName = 'sync/destinations/aws-sm';
-    this.store.pushPayload(destinationModelName, {
-      modelName: destinationModelName,
-      ...destination,
-      id: destination.name,
-    });
-    this.destination = this.store.peekRecord(destinationModelName, destination.name);
-    this.destinations = this.store.peekAll(destinationModelName).toArray();
-    this.destinations.meta = {
-      filteredTotal: this.destinations.length,
-      currentPage: 1,
-      pageSize: 5,
-    };
-
-    const association = this.server.create('sync-association', {
-      type: 'aws-sm',
-      name: 'us-west-1',
-      mount: 'kv',
-      secret_name: 'my-secret',
-      sync_status: 'SYNCED',
-      updated_at: '2023-09-20T10:51:53.961861096', // removed tz offset so time is consistently displayed
-    });
-    const associationModelName = 'sync/association';
-    const associationId = `${association.mount}/${association.secret_name}`;
-    this.store.pushPayload(associationModelName, {
-      modelName: associationModelName,
-      ...association,
-      destinationType: 'aws-sm',
-      destinationName: 'us-west-1',
-      id: associationId,
-    });
-
-    this.association = this.store.peekRecord(associationModelName, associationId);
-    this.associations = this.store.peekAll(associationModelName).toArray();
-    this.associations.meta = {
-      filteredTotal: this.associations.length,
-      currentPage: 1,
-      pageSize: 5,
-    };
-  });
-}
diff --git a/ui/tests/helpers/sync/sync-selectors.js b/ui/tests/helpers/sync/sync-selectors.js
index 7c3afb3b727..2ff747d8f77 100644
--- a/ui/tests/helpers/sync/sync-selectors.js
+++ b/ui/tests/helpers/sync/sync-selectors.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { click, fillIn } from '@ember/test-helpers';
-import { SELECTORS as GENERAL } from 'vault/tests/helpers/general-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 export const PAGE = {
   ...GENERAL,
@@ -34,8 +34,6 @@ export const PAGE = {
     sync: {
       mountSelect: '[data-test-sync-mount-select]',
       mountInput: '[data-test-sync-mount-input]',
-      submit: '[data-test-sync-submit]',
-      cancel: '[data-test-sync-cancel]',
       successMessage: '[data-test-sync-success-message]',
     },
     list: {
@@ -51,6 +49,19 @@ export const PAGE = {
     },
   },
   overview: {
+    optInBanner: {
+      container: '[data-test-secrets-sync-opt-in-banner]',
+      enable: '[data-test-secrets-sync-opt-in-banner-enable]',
+      description: '[data-test-secrets-sync-opt-in-banner-description]',
+      dismiss: '[data-test-secrets-sync-opt-in-banner] [data-test-icon="x"]',
+    },
+    activationModal: {
+      container: '[data-test-secrets-sync-opt-in-modal]',
+      checkbox: '[data-test-opt-in-check]',
+      confirm: '[data-test-opt-in-confirm]',
+      cancel: '[data-test-opt-in-cancel]',
+    },
+    optInError: '[data-test-opt-in-error]',
     createDestination: '[data-test-create-destination]',
     table: {
       row: '[data-test-overview-table-row]',
@@ -63,31 +74,32 @@ export const PAGE = {
       action: (name) => `[data-test-overview-table-action="${name}"]`,
     },
   },
-  syncBadge: {
+  badgeText: {
     icon: (name) => `[data-test-icon="${name}"]`,
     text: '.hds-badge__text',
   },
   selectType: (type) => `[data-test-select-destination="${type}"]`,
   createCancel: '[data-test-destination-create-cancel]',
-  saveButton: '[data-test-save]',
   toolbar: (btnText) => `[data-test-toolbar="${btnText}"]`,
   form: {
-    enableInput: (attr) => `[data-test-enable-field="${attr}"] [data-test-icon="edit"]`,
+    enableInput: (attr) => `[data-test-enable-field="${attr}"] [data-test-icon="edit"]`, // TODO duplicated in general-selectors as this component became more widely used
+    fieldGroupHeader: (group) => `[data-test-destination-header="${group}"]`,
+    fieldGroupSubtext: (group) => `[data-test-destination-subText="${group}"]`,
     fillInByAttr: async (attr, value) => {
       // for handling more complex form input elements by attr name
       switch (attr) {
         case 'granularity':
-          return await click(`[data-test-radio="secret-key"]`);
+          return await click(`${GENERAL.radioByAttr('secret-key')}`);
         case 'credentials':
-          await click('[data-test-text-toggle]');
-          return fillIn('[data-test-text-file-textarea]', value);
-        case 'customTags':
+          await click(GENERAL.textToggle);
+          return fillIn(GENERAL.maskedInput, value);
+        case 'custom_tags':
           await fillIn('[data-test-kv-key="0"]', 'foo');
           return fillIn('[data-test-kv-value="0"]', value);
-        case 'deploymentEnvironments':
-          await click('[data-test-input="deploymentEnvironments"] input#development');
-          await click('[data-test-input="deploymentEnvironments"] input#preview');
-          return await click('[data-test-input="deploymentEnvironments"] input#production');
+        case 'deployment_environments':
+          await click(`${GENERAL.inputGroupByAttr('deployment_environments')} input#development`);
+          await click(`${GENERAL.inputGroupByAttr('deployment_environments')} input#preview`);
+          return await click(`${GENERAL.inputGroupByAttr('deployment_environments')} input#production`);
         default:
           return fillIn(`[data-test-input="${attr}"]`, value);
       }
diff --git a/ui/tests/helpers/tools-selectors.ts b/ui/tests/helpers/tools-selectors.ts
new file mode 100644
index 00000000000..b9d3ed7f1d7
--- /dev/null
+++ b/ui/tests/helpers/tools-selectors.ts
@@ -0,0 +1,8 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const TOOLS_SELECTORS = {
+  toolsInput: (attr: string) => `[data-test-tools-input="${attr}"]`,
+};
diff --git a/ui/tests/helpers/vault-usage/mocks.ts b/ui/tests/helpers/vault-usage/mocks.ts
new file mode 100644
index 00000000000..967cc375dbb
--- /dev/null
+++ b/ui/tests/helpers/vault-usage/mocks.ts
@@ -0,0 +1,37 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export const mockedEmptyResponse = {
+  data: {
+    auth_methods: {},
+    kvv1_secrets: 0,
+    kvv2_secrets: 0,
+    lease_count_quotas: {},
+    leases_by_auth_method: {},
+    replication_status: {},
+    secret_engines: {},
+  },
+};
+
+export const mockedResponseWithData = {
+  data: {
+    auth_methods: { aws: 42, userpass: 43, kubernetes: 44 },
+    kvv1_secrets: 60,
+    kvv2_secrets: 40,
+    lease_count_quotas: {
+      global_lease_count_quota: { capacity: 420000, count: 210000, name: 'default' },
+      total_lease_count_quotas: 1,
+    },
+    namespaces: 1,
+    replication_status: {
+      dr_primary: true,
+      dr_state: 'enabled',
+      pr_primary: false,
+      pr_state: 'enabled',
+    },
+    secret_engines: { cubbyhole: 45, nomad: 46, aws: 47 },
+    secret_sync: { total_destinations: 1, destinations: { aws: 1 } },
+  },
+};
diff --git a/ui/tests/helpers/wait-for-error.js b/ui/tests/helpers/wait-for-error.js
index e8c9ba18908..06d5e401a43 100644
--- a/ui/tests/helpers/wait-for-error.js
+++ b/ui/tests/helpers/wait-for-error.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/index.html b/ui/tests/index.html
index caf9b008ea3..ab1fe05c98d 100644
--- a/ui/tests/index.html
+++ b/ui/tests/index.html
@@ -1,6 +1,6 @@
 <!DOCTYPE html>
 <!--
- Copyright (c) HashiCorp, Inc.
+ Copyright IBM Corp. 2016, 2025
  SPDX-License-Identifier: BUSL-1.1
 -->
 
diff --git a/ui/tests/integration/components/alert-inline-test.js b/ui/tests/integration/components/alert-inline-test.js
index a992257ede3..e8724cddc7b 100644
--- a/ui/tests/integration/components/alert-inline-test.js
+++ b/ui/tests/integration/components/alert-inline-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/app-footer-test.js b/ui/tests/integration/components/app-footer-test.js
index cc9ee555510..73cf18d0c6e 100644
--- a/ui/tests/integration/components/app-footer-test.js
+++ b/ui/tests/integration/components/app-footer-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/auth-config-form/config-test.js b/ui/tests/integration/components/auth-config-form/config-test.js
new file mode 100644
index 00000000000..b1322c0087c
--- /dev/null
+++ b/ui/tests/integration/components/auth-config-form/config-test.js
@@ -0,0 +1,96 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { click, render } from '@ember/test-helpers';
+import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+import Form from 'vault/forms/form';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import AuthMethodResource from 'vault/resources/auth/method';
+
+const TEST_CASES = [
+  {
+    methodType: 'aws',
+    endpoint: '/auth/aws-test/config/client',
+    section: 'client',
+  },
+  {
+    methodType: 'aws',
+    endpoint: '/auth/aws-test/config/tidy/identity-accesslist',
+    section: 'identity-accesslist',
+  },
+  {
+    methodType: 'aws',
+    endpoint: '/auth/aws-test/config/tidy/roletag-denylist',
+    section: 'roletag-denylist',
+  },
+  { methodType: 'azure', endpoint: '/auth/azure-test/config' },
+  { methodType: 'github', endpoint: '/auth/github-test/config' },
+  { methodType: 'gcp', endpoint: '/auth/gcp-test/config' },
+  { methodType: 'jwt', endpoint: '/auth/jwt-test/config' },
+  { methodType: 'oidc', endpoint: '/auth/oidc-test/config' },
+  { methodType: 'kubernetes', endpoint: '/auth/kubernetes-test/config' },
+  { methodType: 'ldap', endpoint: '/auth/ldap-test/config' },
+  { methodType: 'okta', endpoint: '/auth/okta-test/config' },
+  { methodType: 'radius', endpoint: '/auth/radius-test/config' },
+];
+
+module('Integration | Component | auth-config-form config', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.flashSuccessSpy = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
+    this.router = this.owner.lookup('service:router');
+    this.transitionStub = sinon
+      .stub(this.router, 'transitionTo')
+      .returns({ followRedirects: () => Promise.resolve() });
+
+    this.renderComponent = (path, methodType, section = 'configuration') => {
+      // This component actually receives and OpenApiForm class, but this component test
+      // is not testing the openapi parameters and just the form submit so we just use the Form class.
+      this.form = new Form();
+      this.section = section;
+      this.method = new AuthMethodResource({ path, type: methodType }, this);
+      return render(hbs`
+        <AuthConfigForm::Config
+         @form={{this.form}}
+         @section={{this.section}}
+         @method={{this.method}}
+         />`);
+    };
+  });
+
+  test.each('it makes save request to the expected endpoint', TEST_CASES, async function (assert, data) {
+    assert.expect(3);
+    const { methodType, endpoint, section } = data;
+    const testId = methodType + `${section ? ` "${section}" section` : ''}`;
+    this.server.post(endpoint, () => {
+      assert.true(true, `${testId}: it calls expected endpoint "${endpoint}" on save.`);
+    });
+    await this.renderComponent(`${methodType}-test`, methodType, section);
+    await click(GENERAL.submitButton);
+    assert.true(this.flashSuccessSpy.calledOnce, `${testId}: flash success is called`);
+    assert.true(this.transitionStub.calledOnce, `${testId}: transitionTo is called`);
+  });
+
+  test.each('it renders error banner', TEST_CASES, async function (assert, data) {
+    assert.expect(3);
+    const { methodType, endpoint, section } = data;
+    const testId = methodType + `${section ? ` "${section}" section` : ''}`;
+    this.server.post(endpoint, () => {
+      return overrideResponse(400, { errors: ['uh oh'] });
+    });
+    await this.renderComponent(`${methodType}-test`, methodType, section);
+    await click(GENERAL.submitButton);
+    assert.false(this.flashSuccessSpy.calledOnce, `${testId}: flash success is NOT called`);
+    assert.false(this.transitionStub.calledOnce, `${testId}: transitionTo is NOT called`);
+    assert.dom(GENERAL.messageError).hasText('Error uh oh', `${testId}: it renders error message`);
+  });
+});
diff --git a/ui/tests/integration/components/auth-config-form/options-test.js b/ui/tests/integration/components/auth-config-form/options-test.js
index f267dad0f19..c422513100b 100644
--- a/ui/tests/integration/components/auth-config-form/options-test.js
+++ b/ui/tests/integration/components/auth-config-form/options-test.js
@@ -1,58 +1,224 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { resolve } from 'rsvp';
-import EmberObject from '@ember/object';
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, settled } from '@ember/test-helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { click, fillIn, render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
+import AuthMethodForm from 'vault/forms/auth/method';
 import sinon from 'sinon';
-import { create } from 'ember-cli-page-object';
-import authConfigForm from 'vault/tests/pages/components/auth-config-form/options';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
 
-const component = create(authConfigForm);
+const userLockoutSupported = ['approle', 'ldap', 'userpass'];
+const userLockoutUnsupported = filterEnginesByMountCategory({ mountCategory: 'auth', isEnterprise: false })
+  .map((m) => m.type)
+  .filter((m) => !userLockoutSupported.includes(m));
 
 module('Integration | Component | auth-config-form options', function (hooks) {
   setupRenderingTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.owner.lookup('service:flash-messages').registerTypes(['success']);
+    this.flashSuccessSpy = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
     this.router = this.owner.lookup('service:router');
-    this.router.reopen({
-      transitionTo() {
-        return {
-          followRedirects() {
-            return resolve();
+    this.transitionStub = sinon
+      .stub(this.router, 'transitionTo')
+      .returns({ followRedirects: () => Promise.resolve() });
+
+    this.renderComponent = (path, type) => {
+      this.form = new AuthMethodForm({
+        path,
+        config: { listing_visibility: false },
+        user_lockout_config: {},
+      });
+      this.form.type = type;
+      return render(hbs`<AuthConfigForm::Options @form={{this.form}} />`);
+    };
+  });
+
+  test('it submits data correctly for token auth method', async function (assert) {
+    assert.expect(8);
+
+    const type = 'token';
+    const path = `my-${type}-auth`;
+
+    this.server.post(`sys/mounts/auth/${path}/tune`, (schema, req) => {
+      const payload = JSON.parse(req.requestBody);
+      const expected = {
+        default_lease_ttl: '30s',
+        listing_visibility: 'unauth',
+      };
+      assert.propEqual(payload, expected, `${type} method payload contains tune parameters`);
+      return { payload };
+    });
+
+    await this.renderComponent(path, type);
+    assert
+      .dom(GENERAL.inputByAttr('config.token_type'))
+      .doesNotExist('does not render token_type for token auth method');
+
+    await click(GENERAL.toggleInput('toggle-config.listing_visibility'));
+    await click(GENERAL.ttl.toggle('Default Lease TTL'));
+    await fillIn(GENERAL.ttl.input('Default Lease TTL'), '30');
+
+    assert.dom('[data-test-user-lockout-section]').doesNotExist('token does not render user lockout section');
+    assert
+      .dom(GENERAL.inputByAttr('user_lockout_config.lockout_threshold'))
+      .doesNotExist('token method does not render lockout threshold');
+    assert
+      .dom(GENERAL.ttl.toggle('Lockout duration'))
+      .doesNotExist('token method does not render lockout duration ');
+    assert
+      .dom(GENERAL.ttl.toggle('Lockout counter reset'))
+      .doesNotExist('token method does not render lockout counter reset');
+    assert
+      .dom(GENERAL.inputByAttr('user_lockout_config.lockout_disable'))
+      .doesNotExist('token method does not render lockout disable');
+
+    await click(GENERAL.submitButton);
+
+    assert.true(
+      this.transitionStub.calledWith('vault.cluster.access.methods'),
+      'transitions to access methods list on save'
+    );
+  });
+
+  for (const type of userLockoutSupported) {
+    test(`it submits data correctly for ${type} method (supports user_lockout_config)`, async function (assert) {
+      assert.expect(3);
+
+      const path = `my-${type}-auth`;
+
+      this.server.post(`sys/mounts/auth/${path}/tune`, (schema, req) => {
+        const payload = JSON.parse(req.requestBody);
+        const expected = {
+          default_lease_ttl: '30s',
+          listing_visibility: 'unauth',
+          token_type: 'default-batch',
+          user_lockout_config: {
+            lockout_threshold: '7',
+            lockout_duration: '600s',
+            lockout_counter_reset: '5s',
+            lockout_disable: true,
           },
         };
-      },
-      replaceWith() {
-        return resolve();
-      },
+        assert.propEqual(payload, expected, `${type} method payload contains tune parameters`);
+        return { payload };
+      });
+
+      await this.renderComponent(path, type);
+
+      assert.dom('[data-test-user-lockout-section]').hasText('User lockout configuration');
+
+      await click(GENERAL.toggleInput('toggle-config.listing_visibility'));
+      await fillIn(GENERAL.inputByAttr('config.token_type'), 'default-batch');
+
+      await click(GENERAL.ttl.toggle('Default Lease TTL'));
+      await fillIn(GENERAL.ttl.input('Default Lease TTL'), '30');
+
+      await fillIn(GENERAL.inputByAttr('user_lockout_config.lockout_threshold'), '7');
+
+      await click(GENERAL.ttl.toggle('Lockout duration'));
+      await fillIn(GENERAL.ttl.input('Lockout duration'), '10');
+      await fillIn(
+        `${GENERAL.inputByAttr('user_lockout_config.lockout_duration')} ${GENERAL.selectByAttr('ttl-unit')}`,
+        'm'
+      );
+      await click(GENERAL.ttl.toggle('Lockout counter reset'));
+      await fillIn(GENERAL.ttl.input('Lockout counter reset'), '5');
+
+      await click(GENERAL.inputByAttr('user_lockout_config.lockout_disable'));
+
+      await click(GENERAL.submitButton);
+
+      assert.true(
+        this.transitionStub.calledWith('vault.cluster.access.methods'),
+        'transitions to access methods list on save'
+      );
     });
-  });
 
-  test('it submits data correctly', async function (assert) {
-    assert.expect(1);
-    const model = EmberObject.create({
-      tune() {
-        return resolve();
-      },
-      config: {
-        serialize() {
-          return {};
-        },
-      },
+    test(`${type}: it renders error banner`, async function (assert) {
+      assert.expect(3);
+      const path = `my-${type}-auth`;
+      this.server.post(`sys/mounts/auth/${path}/tune`, () => {
+        return overrideResponse(400, { errors: ['uh oh'] });
+      });
+      await this.renderComponent(path, type);
+      await click(GENERAL.submitButton);
+      assert.false(this.flashSuccessSpy.calledOnce, 'flash success is NOT called');
+      assert.false(this.transitionStub.calledOnce, 'transitionTo is NOT called');
+      assert.dom(GENERAL.messageError).hasText('Error uh oh');
+    });
+  }
+
+  for (const type of userLockoutUnsupported) {
+    if (type === 'token') return; // separate test below because does not include tokenType field
+
+    test(`it submits data correctly for ${type} auth method`, async function (assert) {
+      assert.expect(7);
+
+      const path = `my-${type}-auth`;
+
+      this.server.post(`sys/mounts/auth/${path}/tune`, (schema, req) => {
+        const payload = JSON.parse(req.requestBody);
+        const expected = {
+          default_lease_ttl: '30s',
+          listing_visibility: 'unauth',
+          token_type: 'default-batch',
+        };
+        assert.propEqual(payload, expected, `${type} method payload contains tune parameters`);
+        return { payload };
+      });
+
+      await this.renderComponent(path, type);
+
+      assert
+        .dom('[data-test-user-lockout-section]')
+        .doesNotExist(`${type} method does not render user lockout section`);
+
+      await click(GENERAL.toggleInput('toggle-config.listing_visibility'));
+      await fillIn(GENERAL.inputByAttr('config.token_type'), 'default-batch');
+
+      await click(GENERAL.ttl.toggle('Default Lease TTL'));
+      await fillIn(GENERAL.ttl.input('Default Lease TTL'), '30');
+
+      assert
+        .dom(GENERAL.inputByAttr('user_lockout_config.lockout_threshold'))
+        .doesNotExist(`${type} method does not render lockout threshold`);
+      assert
+        .dom(GENERAL.ttl.toggle('Lockout duration'))
+        .doesNotExist(`${type} method does not render lockout duration `);
+      assert
+        .dom(GENERAL.ttl.toggle('Lockout counter reset'))
+        .doesNotExist(`${type} method does not render lockout counter reset`);
+      assert
+        .dom(GENERAL.inputByAttr('user_lockout_config.lockout_disable'))
+        .doesNotExist(`${type} method does not render lockout disable`);
+
+      await click(GENERAL.submitButton);
+
+      assert.true(
+        this.transitionStub.calledWith('vault.cluster.access.methods'),
+        'transitions to access methods list on save'
+      );
     });
-    sinon.spy(model.config, 'serialize');
-    this.set('model', model);
-    await render(hbs`<AuthConfigForm::Options @model={{this.model}} />`);
-    component.save();
-    return settled().then(() => {
-      assert.strictEqual(model.config.serialize.callCount, 1, 'config serialize was called once');
+
+    test(`${type}: it renders error banner`, async function (assert) {
+      assert.expect(3);
+      const path = `my-${type}-auth`;
+      this.server.post(`sys/mounts/auth/${path}/tune`, () => {
+        return overrideResponse(400, { errors: ['uh oh'] });
+      });
+      await this.renderComponent(path, type);
+      await click(GENERAL.submitButton);
+      assert.false(this.flashSuccessSpy.calledOnce, 'flash success is NOT called');
+      assert.false(this.transitionStub.calledOnce, 'transitionTo is NOT called');
+      assert.dom(GENERAL.messageError).hasText('Error uh oh');
     });
-  });
+  }
 });
diff --git a/ui/tests/integration/components/auth-form-test.js b/ui/tests/integration/components/auth-form-test.js
deleted file mode 100644
index 8e1dd06f3a3..00000000000
--- a/ui/tests/integration/components/auth-form-test.js
+++ /dev/null
@@ -1,357 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { later, _cancelTimers as cancelTimers } from '@ember/runloop';
-import EmberObject from '@ember/object';
-import { resolve } from 'rsvp';
-import Service from '@ember/service';
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { render, settled } from '@ember/test-helpers';
-import hbs from 'htmlbars-inline-precompile';
-import sinon from 'sinon';
-import Pretender from 'pretender';
-import { create } from 'ember-cli-page-object';
-import authForm from '../../pages/components/auth-form';
-import { validate } from 'uuid';
-
-const component = create(authForm);
-
-const workingAuthService = Service.extend({
-  authenticate() {
-    return resolve({});
-  },
-  handleError() {},
-  setLastFetch() {},
-});
-
-const routerService = Service.extend({
-  transitionTo() {
-    return {
-      followRedirects() {
-        return resolve();
-      },
-    };
-  },
-});
-
-module('Integration | Component | auth form', function (hooks) {
-  setupRenderingTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.owner.register('service:router', routerService);
-    this.router = this.owner.lookup('service:router');
-    this.onSuccess = sinon.spy();
-  });
-
-  const CSP_ERR_TEXT = `Error This is a standby Vault node but can't communicate with the active node via request forwarding. Sign in at the active node to use the Vault UI.`;
-  test('it renders error on CSP violation', async function (assert) {
-    assert.expect(2);
-    this.set('cluster', EmberObject.create({ standby: true }));
-    this.set('selectedAuth', 'token');
-    await render(hbs`{{auth-form cluster=this.cluster selectedAuth=this.selectedAuth}}`);
-    assert.false(component.errorMessagePresent, false);
-    this.owner.lookup('service:csp-event').events.addObject({ violatedDirective: 'connect-src' });
-    await settled();
-    assert.strictEqual(component.errorText, CSP_ERR_TEXT);
-  });
-
-  test('it renders with vault style errors', async function (assert) {
-    assert.expect(1);
-    const server = new Pretender(function () {
-      this.get('/v1/auth/**', () => {
-        return [
-          400,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify({
-            errors: ['Not allowed'],
-          }),
-        ];
-      });
-      this.get('/v1/sys/internal/ui/mounts', this.passthrough);
-    });
-
-    this.set('cluster', EmberObject.create({}));
-    this.set('selectedAuth', 'token');
-    await render(hbs`{{auth-form cluster=this.cluster selectedAuth=this.selectedAuth}}`);
-    return component.login().then(() => {
-      assert.strictEqual(component.errorText, 'Error Authentication failed: Not allowed');
-      server.shutdown();
-    });
-  });
-
-  test('it renders AdapterError style errors', async function (assert) {
-    assert.expect(1);
-    const server = new Pretender(function () {
-      this.get('/v1/auth/**', () => {
-        return [400, { 'Content-Type': 'application/json' }];
-      });
-      this.get('/v1/sys/internal/ui/mounts', this.passthrough);
-    });
-
-    this.set('cluster', EmberObject.create({}));
-    this.set('selectedAuth', 'token');
-    await render(hbs`{{auth-form cluster=this.cluster selectedAuth=this.selectedAuth}}`);
-    // returns null because test does not return details of failed network request. On the app it will return the details of the error instead of null.
-    return component.login().then(() => {
-      assert.strictEqual(component.errorText, 'Error Authentication failed: null');
-      server.shutdown();
-    });
-  });
-
-  test('it renders no tabs when no methods are passed', async function (assert) {
-    const methods = {
-      'approle/': {
-        type: 'approle',
-      },
-    };
-    const server = new Pretender(function () {
-      this.get('/v1/sys/internal/ui/mounts', () => {
-        return [200, { 'Content-Type': 'application/json' }, JSON.stringify({ data: { auth: methods } })];
-      });
-    });
-    await render(hbs`<AuthForm @cluster={{this.cluster}} />`);
-
-    assert.strictEqual(component.tabs.length, 0, 'renders a tab for every backend');
-    server.shutdown();
-  });
-
-  test('it renders all the supported methods and Other tab when methods are present', async function (assert) {
-    const methods = {
-      'foo/': {
-        type: 'userpass',
-      },
-      'approle/': {
-        type: 'approle',
-      },
-    };
-    const server = new Pretender(function () {
-      this.get('/v1/sys/internal/ui/mounts', () => {
-        return [200, { 'Content-Type': 'application/json' }, JSON.stringify({ data: { auth: methods } })];
-      });
-    });
-
-    this.set('cluster', EmberObject.create({}));
-    await render(hbs`{{auth-form cluster=this.cluster }}`);
-
-    assert.strictEqual(component.tabs.length, 2, 'renders a tab for userpass and Other');
-    assert.strictEqual(component.tabs.objectAt(0).name, 'foo', 'uses the path in the label');
-    assert.strictEqual(component.tabs.objectAt(1).name, 'Other', 'second tab is the Other tab');
-    server.shutdown();
-  });
-
-  test('it renders the description', async function (assert) {
-    const methods = {
-      'approle/': {
-        type: 'userpass',
-        description: 'app description',
-      },
-    };
-    const server = new Pretender(function () {
-      this.get('/v1/sys/internal/ui/mounts', () => {
-        return [200, { 'Content-Type': 'application/json' }, JSON.stringify({ data: { auth: methods } })];
-      });
-    });
-    this.set('cluster', EmberObject.create({}));
-    await render(hbs`{{auth-form cluster=this.cluster }}`);
-
-    assert.strictEqual(
-      component.descriptionText,
-      'app description',
-      'renders a description for auth methods'
-    );
-    server.shutdown();
-  });
-
-  test('it calls authenticate with the correct path', async function (assert) {
-    this.owner.unregister('service:auth');
-    this.owner.register('service:auth', workingAuthService);
-    this.auth = this.owner.lookup('service:auth');
-    const authSpy = sinon.spy(this.auth, 'authenticate');
-    const methods = {
-      'foo/': {
-        type: 'userpass',
-      },
-    };
-    const server = new Pretender(function () {
-      this.get('/v1/sys/internal/ui/mounts', () => {
-        return [200, { 'Content-Type': 'application/json' }, JSON.stringify({ data: { auth: methods } })];
-      });
-    });
-
-    this.set('cluster', EmberObject.create({}));
-    this.set('selectedAuth', 'foo/');
-    await render(hbs`{{auth-form cluster=this.cluster selectedAuth=this.selectedAuth}}`);
-    await component.login();
-
-    await settled();
-    assert.ok(authSpy.calledOnce, 'a call to authenticate was made');
-    const { data } = authSpy.getCall(0).args[0];
-    assert.strictEqual(data.path, 'foo', 'uses the id for the path');
-    authSpy.restore();
-    server.shutdown();
-  });
-
-  test('it renders no tabs when no supported methods are present in passed methods', async function (assert) {
-    const methods = {
-      'approle/': {
-        type: 'approle',
-      },
-    };
-    const server = new Pretender(function () {
-      this.get('/v1/sys/internal/ui/mounts', () => {
-        return [200, { 'Content-Type': 'application/json' }, JSON.stringify({ data: { auth: methods } })];
-      });
-    });
-    this.set('cluster', EmberObject.create({}));
-    await render(hbs`<AuthForm @cluster={{this.cluster}} />`);
-
-    server.shutdown();
-    assert.strictEqual(component.tabs.length, 0, 'renders a tab for every backend');
-  });
-
-  test('it makes a request to unwrap if passed a wrappedToken and logs in', async function (assert) {
-    this.owner.register('service:auth', workingAuthService);
-    this.auth = this.owner.lookup('service:auth');
-    const authSpy = sinon.spy(this.auth, 'authenticate');
-    const server = new Pretender(function () {
-      this.post('/v1/sys/wrapping/unwrap', () => {
-        return [
-          200,
-          { 'content-type': 'application/json' },
-          JSON.stringify({
-            auth: {
-              client_token: '12345',
-            },
-          }),
-        ];
-      });
-    });
-
-    const wrappedToken = '54321';
-    this.set('wrappedToken', wrappedToken);
-    this.set('cluster', EmberObject.create({}));
-    await render(
-      hbs`<AuthForm @cluster={{this.cluster}} @wrappedToken={{this.wrappedToken}} @onSuccess={{this.onSuccess}} />`
-    );
-    later(() => cancelTimers(), 50);
-    await settled();
-    assert.strictEqual(
-      server.handledRequests[0].url,
-      '/v1/sys/wrapping/unwrap',
-      'makes call to unwrap the token'
-    );
-    assert.strictEqual(
-      server.handledRequests[0].requestHeaders['x-vault-token'],
-      wrappedToken,
-      'uses passed wrapped token for the unwrap'
-    );
-    assert.ok(authSpy.calledOnce, 'a call to authenticate was made');
-    server.shutdown();
-    authSpy.restore();
-  });
-
-  test('it shows an error if unwrap errors', async function (assert) {
-    const server = new Pretender(function () {
-      this.post('/v1/sys/wrapping/unwrap', () => {
-        return [
-          400,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify({
-            errors: ['There was an error unwrapping!'],
-          }),
-        ];
-      });
-    });
-
-    this.set('wrappedToken', '54321');
-    await render(hbs`{{auth-form cluster=this.cluster wrappedToken=this.wrappedToken}}`);
-    later(() => cancelTimers(), 50);
-
-    await settled();
-    assert.strictEqual(
-      component.errorText,
-      'Error Token unwrap failed: There was an error unwrapping!',
-      'shows the error'
-    );
-    server.shutdown();
-  });
-
-  test('it should retain oidc role when mount path is changed', async function (assert) {
-    assert.expect(1);
-
-    const auth_url = 'http://dev-foo-bar.com';
-    const server = new Pretender(function () {
-      this.post('/v1/auth/:path/oidc/auth_url', (req) => {
-        const { role, redirect_uri } = JSON.parse(req.requestBody);
-        const goodRequest =
-          req.params.path === 'foo-oidc' &&
-          role === 'foo' &&
-          redirect_uri.includes('/auth/foo-oidc/oidc/callback');
-
-        return [
-          goodRequest ? 200 : 400,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify(
-            goodRequest ? { data: { auth_url } } : { errors: [`role "${role}" could not be found`] }
-          ),
-        ];
-      });
-      this.get('/v1/sys/internal/ui/mounts', this.passthrough);
-    });
-
-    window.open = (url) => {
-      assert.strictEqual(url, auth_url, 'auth_url is returned when required params are passed');
-    };
-
-    this.owner.lookup('service:router').reopen({
-      urlFor(route, { auth_path }) {
-        return `/auth/${auth_path}/oidc/callback`;
-      },
-    });
-
-    this.set('cluster', EmberObject.create({}));
-    await render(hbs`<AuthForm @cluster={{this.cluster}} />`);
-
-    await component.selectMethod('oidc');
-    await component.oidcRole('foo');
-    await component.oidcMoreOptions();
-    await component.oidcMountPath('foo-oidc');
-    await component.login();
-
-    server.shutdown();
-  });
-
-  test('it should set nonce value as uuid for okta method type', async function (assert) {
-    assert.expect(1);
-
-    const server = new Pretender(function () {
-      this.post('/v1/auth/okta/login/foo', (req) => {
-        const { nonce } = JSON.parse(req.requestBody);
-        assert.true(validate(nonce), 'Nonce value passed as uuid for okta login');
-        return [
-          200,
-          { 'content-type': 'application/json' },
-          JSON.stringify({
-            auth: {
-              client_token: '12345',
-            },
-          }),
-        ];
-      });
-      this.get('/v1/sys/internal/ui/mounts', this.passthrough);
-    });
-
-    this.set('cluster', EmberObject.create({}));
-    await render(hbs`<AuthForm @cluster={{this.cluster}} />`);
-
-    await component.selectMethod('okta');
-    await component.username('foo');
-    await component.password('bar');
-    await component.login();
-
-    server.shutdown();
-  });
-});
diff --git a/ui/tests/integration/components/auth-jwt-test.js b/ui/tests/integration/components/auth-jwt-test.js
deleted file mode 100644
index 55302a7bca7..00000000000
--- a/ui/tests/integration/components/auth-jwt-test.js
+++ /dev/null
@@ -1,257 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { _cancelTimers as cancelTimers } from '@ember/runloop';
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { render, settled, waitUntil } from '@ember/test-helpers';
-import hbs from 'htmlbars-inline-precompile';
-import sinon from 'sinon';
-import Pretender from 'pretender';
-import { resolve } from 'rsvp';
-import { create } from 'ember-cli-page-object';
-import form from '../../pages/components/auth-jwt';
-import { ERROR_WINDOW_CLOSED, ERROR_MISSING_PARAMS, ERROR_JWT_LOGIN } from 'vault/components/auth-jwt';
-import { fakeWindow, buildMessage } from '../../helpers/oidc-window-stub';
-
-const component = create(form);
-const windows = [];
-
-fakeWindow.reopen({
-  init() {
-    this._super(...arguments);
-    windows.push(this);
-  },
-  open() {
-    return fakeWindow.create();
-  },
-  close() {
-    windows.forEach((w) => w.trigger('close'));
-  },
-});
-
-const OIDC_AUTH_RESPONSE = {
-  auth: {
-    client_token: 'token',
-  },
-};
-
-const renderIt = async (context, path = 'jwt') => {
-  const handler = (data, e) => {
-    if (e && e.preventDefault) e.preventDefault();
-    return resolve();
-  };
-  const fake = fakeWindow.create();
-  context.set('window', fake);
-  context.set('handler', sinon.spy(handler));
-  context.set('roleName', '');
-  context.set('selectedAuthPath', path);
-  await render(hbs`
-    <AuthJwt
-      @window={{this.window}}
-      @roleName={{this.roleName}}
-      @selectedAuthPath={{this.selectedAuthPath}}
-      @onError={{action (mut this.error)}}
-      @onLoading={{action (mut this.isLoading)}}
-      @onNamespace={{action (mut this.namespace)}}
-      @onSelectedAuth={{action (mut this.selectedAuth)}}
-      @onSubmit={{action this.handler}}
-      @onRoleName={{action (mut this.roleName)}}
-    />
-    `);
-};
-module('Integration | Component | auth jwt', function (hooks) {
-  setupRenderingTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.openSpy = sinon.spy(fakeWindow.proto(), 'open');
-    this.owner.lookup('service:router').reopen({
-      urlFor() {
-        return 'http://example.com';
-      },
-    });
-    this.server = new Pretender(function () {
-      this.get('/v1/auth/:path/oidc/callback', function () {
-        return [200, { 'Content-Type': 'application/json' }, JSON.stringify(OIDC_AUTH_RESPONSE)];
-      });
-      this.post('/v1/auth/:path/oidc/auth_url', (request) => {
-        const { role } = JSON.parse(request.requestBody);
-        if (['test', 'okta', 'bar'].includes(role)) {
-          const auth_url = role === 'test' ? 'http://example.com' : role === 'okta' ? 'http://okta.com' : '';
-          return [
-            200,
-            { 'Content-Type': 'application/json' },
-            JSON.stringify({
-              data: { auth_url },
-            }),
-          ];
-        }
-        const errors = role === 'foo' ? ['role "foo" could not be found'] : [ERROR_JWT_LOGIN];
-        return [400, { 'Content-Type': 'application/json' }, JSON.stringify({ errors })];
-      });
-    });
-  });
-
-  hooks.afterEach(function () {
-    this.openSpy.restore();
-    this.server.shutdown();
-  });
-
-  test('it renders the yield', async function (assert) {
-    await render(hbs`<AuthJwt @onSubmit={{action (mut this.submit)}}>Hello!</AuthJwt>`);
-    assert.strictEqual(component.yieldContent, 'Hello!', 'yields properly');
-  });
-
-  test('jwt: it renders and makes auth_url requests', async function (assert) {
-    await renderIt(this);
-    await settled();
-    assert.ok(component.jwtPresent, 'renders jwt field');
-    assert.ok(component.rolePresent, 'renders jwt field');
-    assert.strictEqual(this.server.handledRequests.length, 1, 'request to the default path is made');
-    assert.strictEqual(this.server.handledRequests[0].url, '/v1/auth/jwt/oidc/auth_url');
-    this.set('selectedAuthPath', 'foo');
-    await settled();
-    assert.strictEqual(this.server.handledRequests.length, 2, 'a second request was made');
-    assert.strictEqual(
-      this.server.handledRequests[1].url,
-      '/v1/auth/foo/oidc/auth_url',
-      'requests when path is set'
-    );
-  });
-
-  test('jwt: it calls passed action on login', async function (assert) {
-    await renderIt(this);
-    await component.login();
-    assert.ok(this.handler.calledOnce);
-  });
-
-  test('oidc: test role: it renders', async function (assert) {
-    await renderIt(this);
-    await settled();
-    this.set('selectedAuthPath', 'foo');
-    await component.role('test');
-    await settled();
-    assert.notOk(component.jwtPresent, 'does not show jwt input for OIDC type login');
-    assert.strictEqual(component.loginButtonText, 'Sign in with OIDC Provider');
-
-    await component.role('okta');
-    // 1 for initial render, 1 for each time role changed = 3
-    assert.strictEqual(this.server.handledRequests.length, 3, 'fetches the auth_url when the path changes');
-    assert.strictEqual(
-      component.loginButtonText,
-      'Sign in with Okta',
-      'recognizes auth methods with certain urls'
-    );
-  });
-
-  test('oidc: it calls window.open popup window on login', async function (assert) {
-    await renderIt(this);
-    this.set('selectedAuthPath', 'foo');
-    await component.role('test');
-    component.login();
-    await waitUntil(() => {
-      return this.openSpy.calledOnce;
-    });
-    cancelTimers();
-    const call = this.openSpy.getCall(0);
-    assert.deepEqual(
-      call.args,
-      ['http://example.com', 'vaultOIDCWindow', 'width=500,height=600,resizable,scrollbars=yes,top=0,left=0'],
-      'called with expected args'
-    );
-  });
-
-  test('oidc: it calls error handler when popup is closed', async function (assert) {
-    await renderIt(this);
-    this.set('selectedAuthPath', 'foo');
-    await component.role('test');
-    component.login();
-    await waitUntil(() => {
-      return this.openSpy.calledOnce;
-    });
-    this.window.close();
-    await settled();
-    assert.strictEqual(this.error, ERROR_WINDOW_CLOSED, 'calls onError with error string');
-  });
-
-  test('oidc: shows error when message posted with state key, wrong params', async function (assert) {
-    await renderIt(this);
-    this.set('selectedAuthPath', 'foo');
-    await component.role('test');
-    component.login();
-    await waitUntil(() => {
-      return this.openSpy.calledOnce;
-    });
-    this.window.trigger(
-      'message',
-      buildMessage({ data: { source: 'oidc-callback', state: 'state', foo: 'bar' } })
-    );
-    cancelTimers();
-    assert.strictEqual(this.error, ERROR_MISSING_PARAMS, 'calls onError with params missing error');
-  });
-
-  test('oidc: storage event fires with state key, correct params', async function (assert) {
-    await renderIt(this);
-    this.set('selectedAuthPath', 'foo');
-    await component.role('test');
-    component.login();
-    await waitUntil(() => {
-      return this.openSpy.calledOnce;
-    });
-    this.window.trigger('message', buildMessage());
-    await settled();
-    assert.ok(this.handler.withArgs(null, null, 'token').calledOnce, 'calls the onSubmit handler with token');
-  });
-
-  test('oidc: fails silently when event origin does not match window origin', async function (assert) {
-    await renderIt(this);
-    this.set('selectedAuthPath', 'foo');
-    await component.role('test');
-    component.login();
-    await waitUntil(() => {
-      return this.openSpy.calledOnce;
-    });
-    this.window.trigger('message', buildMessage({ origin: 'http://hackerz.com' }));
-    cancelTimers();
-    await settled();
-    assert.notOk(this.handler.called, 'should not call the submit handler');
-  });
-
-  test('oidc: fails silently when event is not trusted', async function (assert) {
-    await renderIt(this);
-    this.set('selectedAuthPath', 'foo');
-    await component.role('test');
-    component.login();
-    await waitUntil(() => {
-      return this.openSpy.calledOnce;
-    });
-    this.window.trigger('message', buildMessage({ isTrusted: false }));
-    cancelTimers();
-    await settled();
-    assert.notOk(this.handler.called, 'should not call the submit handler');
-  });
-
-  test('oidc: it should trigger error callback when role is not found', async function (assert) {
-    await renderIt(this, 'oidc');
-    await component.role('foo');
-    await component.login();
-    assert.strictEqual(
-      this.error,
-      'Invalid role. Please try again.',
-      'Error message is returned when role is not found'
-    );
-  });
-
-  test('oidc: it should trigger error callback when role is returned without auth_url', async function (assert) {
-    await renderIt(this, 'oidc');
-    await component.role('bar');
-    await component.login();
-    assert.strictEqual(
-      this.error,
-      'Missing auth_url. Please check that allowed_redirect_uris for the role include this mount path.',
-      'Error message is returned when role is returned without auth_url'
-    );
-  });
-});
diff --git a/ui/tests/integration/components/auth-method/configuration-test.js b/ui/tests/integration/components/auth-method/configuration-test.js
new file mode 100644
index 00000000000..e14338ce120
--- /dev/null
+++ b/ui/tests/integration/components/auth-method/configuration-test.js
@@ -0,0 +1,44 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render } from '@ember/test-helpers';
+import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import AuthMethodResource from 'vault/resources/auth/method';
+
+module('Integration | Component | auth-method/configuration', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.store = this.owner.lookup('service:store');
+    this.createMethod = (path, type) => {
+      this.method = new AuthMethodResource({ path, type, config: { listing_visibility: 'hidden' } }, this);
+    };
+    this.renderComponent = () => render(hbs`<AuthMethod::Configuration @method={{this.method}} />`);
+  });
+
+  test('it renders direct link for supported method', async function (assert) {
+    this.createMethod('token/', 'token');
+    await this.renderComponent();
+    assert.dom(GENERAL.infoRowValue('UI login link')).hasText(`${window.origin}/ui/vault/auth?with=token%2F`);
+  });
+
+  test('it does not render direct link for unsupported method', async function (assert) {
+    this.createMethod('my-approle/', 'approle');
+    await this.renderComponent();
+    assert.dom(GENERAL.infoRowValue('UI login link')).doesNotExist();
+  });
+
+  test('it renders direct link if within a namespace', async function (assert) {
+    this.owner.lookup('service:namespace').set('path', 'foo/bar');
+    this.createMethod('token/', 'token');
+    await this.renderComponent();
+    assert
+      .dom(GENERAL.infoRowValue('UI login link'))
+      .hasText(`${window.origin}/ui/vault/auth?namespace=foo%2Fbar&with=token%2F`);
+  });
+});
diff --git a/ui/tests/integration/components/auth/fields-test.js b/ui/tests/integration/components/auth/fields-test.js
new file mode 100644
index 00000000000..44d1a084e96
--- /dev/null
+++ b/ui/tests/integration/components/auth/fields-test.js
@@ -0,0 +1,89 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import hbs from 'htmlbars-inline-precompile';
+import { find, render } from '@ember/test-helpers';
+import { capitalize } from '@ember/string';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | auth | fields', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.loginFields = [
+      { name: 'username' },
+      { name: 'role', helperText: 'Wow neat role!' },
+      { name: 'token', label: 'Super secret token' },
+      { name: 'password' },
+    ];
+    this.renderComponent = () => {
+      return render(hbs`<Auth::Fields @loginFields={{this.loginFields}} />`);
+    };
+  });
+
+  test('it renders field name as input label if "label" key is not specified', async function (assert) {
+    await this.renderComponent();
+    for (const field of ['username', 'password', 'role']) {
+      const id = find(GENERAL.inputByAttr(field)).id;
+      assert
+        .dom(`#label-${id}`)
+        .hasText(capitalize(field), `${field} it renders name if "label" key is not present`);
+    }
+  });
+
+  test('it does NOT render "helperText" if not present', async function (assert) {
+    await this.renderComponent();
+    for (const field of ['username', 'password', 'token']) {
+      const id = find(GENERAL.inputByAttr(field)).id;
+      assert
+        .dom(`#helper-text-${id}`)
+        .doesNotExist(`${field}: it does not render helperText if key is not present`);
+    }
+  });
+
+  test('it renders "helperText" if specified', async function (assert) {
+    await this.renderComponent();
+    const id = find(GENERAL.inputByAttr('role')).id;
+    assert.dom(`#helper-text-${id}`).hasText('Wow neat role!');
+  });
+
+  test('it renders "label" if specified', async function (assert) {
+    await this.renderComponent();
+    const id = find(GENERAL.inputByAttr('token')).id;
+    assert.dom(`#label-${id}`).hasText('Super secret token', 'it renders "label" instead of "name"');
+  });
+
+  test('it renders password input types for token and password fields', async function (assert) {
+    await this.renderComponent();
+    assert.dom(GENERAL.inputByAttr('token')).hasAttribute('type', 'password');
+    assert.dom(GENERAL.inputByAttr('password')).hasAttribute('type', 'password');
+  });
+
+  test('it renders text input types for other fields', async function (assert) {
+    await this.renderComponent();
+    assert.dom(GENERAL.inputByAttr('username')).hasAttribute('type', 'text');
+    assert.dom(GENERAL.inputByAttr('role')).hasAttribute('type', 'text');
+  });
+
+  test('it renders expected autocomplete values', async function (assert) {
+    await this.renderComponent();
+    const expectedValues = {
+      username: 'off',
+      role: 'off',
+      token: 'off',
+      password: 'off',
+    };
+
+    for (const field of this.loginFields) {
+      const { name } = field;
+      const expected = expectedValues[name];
+      assert
+        .dom(GENERAL.inputByAttr(name))
+        .hasAttribute('autocomplete', expected, `${name}: it renders autocomplete value "${expected}"`);
+    }
+  });
+});
diff --git a/ui/tests/integration/components/auth/form-template-test.js b/ui/tests/integration/components/auth/form-template-test.js
new file mode 100644
index 00000000000..1c804371619
--- /dev/null
+++ b/ui/tests/integration/components/auth/form-template-test.js
@@ -0,0 +1,379 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { click, fillIn, find, findAll, render } from '@ember/test-helpers';
+import hbs from 'htmlbars-inline-precompile';
+import sinon from 'sinon';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { AUTH_METHOD_LOGIN_DATA } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { ENTERPRISE_LOGIN_METHODS, ERROR_JWT_LOGIN, supportedTypes } from 'vault/utils/auth-form-helpers';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { getErrorResponse } from 'vault/tests/helpers/api/error-response';
+
+module('Integration | Component | auth | form template', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    window.localStorage.clear();
+    this.version = this.owner.lookup('service:version');
+    this.router = this.owner.lookup('service:router');
+    this.cluster = { id: '1' };
+
+    this.alternateView = null;
+    this.defaultView = { view: 'dropdown', tabData: null };
+    this.initialFormState = { initialAuthType: 'token', showAlternate: false };
+    this.handleAuthResponse = sinon.spy();
+    this.visibleMountTypes = null;
+
+    this.renderComponent = () => {
+      return render(hbs`
+         <Auth::FormTemplate
+          @alternateView={{this.alternateView}}
+          @cluster={{this.cluster}}
+          @defaultView={{this.defaultView}}
+          @initialFormState={{this.initialFormState}}
+          @handleAuthResponse={{this.handleAuthResponse}}
+          @visibleMountTypes={{this.visibleMountTypes}}
+        />`);
+    };
+  });
+
+  // test to select each method is in "ent" module to include enterprise methods
+  test('it selects token by default', async function (assert) {
+    await this.renderComponent();
+    assert.dom(GENERAL.selectByAttr('auth type')).hasValue('token');
+  });
+
+  test('it does not show toggle buttons if @alternateView does not exist', async function (assert) {
+    await this.renderComponent();
+    assert.dom(GENERAL.backButton).doesNotExist('"Back" button does not render');
+    assert
+      .dom(GENERAL.button('Sign in with other methods'))
+      .doesNotExist('"Sign in with other methods" does not render');
+  });
+
+  test('it initializes with preset auth type', async function (assert) {
+    this.initialFormState = { initialAuthType: 'userpass' };
+    await this.renderComponent();
+    assert.dom(GENERAL.selectByAttr('auth type')).hasValue('userpass');
+  });
+
+  test('it displays errors', async function (assert) {
+    const api = this.owner.lookup('service:api');
+    // stub auth request for "token" method because it's selected by default
+    const tokenLookUpSelfStub = sinon.stub(api.auth, 'tokenLookUpSelf');
+    tokenLookUpSelfStub.rejects(getErrorResponse({ errors: ['uh oh!'] }, 400));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.messageError).hasText('Error Authentication failed: uh oh!');
+    tokenLookUpSelfStub.restore();
+  });
+
+  test('dropdown does not include enterprise methods on community versions', async function (assert) {
+    this.version.type = 'community';
+    const supported = supportedTypes(false);
+    const unsupported = ENTERPRISE_LOGIN_METHODS.map((m) => m.type);
+    assert.expect(supported.length + unsupported.length);
+    await this.renderComponent();
+    const dropdownOptions = findAll(`${GENERAL.selectByAttr('auth type')} option`).map((o) => o.value);
+
+    supported.forEach((m) => {
+      assert.true(dropdownOptions.includes(m), `dropdown includes supported method: ${m}`);
+    });
+    unsupported.forEach((m) => {
+      assert.false(dropdownOptions.includes(m), `dropdown does NOT include unsupported method: ${m}`);
+    });
+  });
+
+  module('listing visibility', function (hooks) {
+    hooks.beforeEach(function () {
+      const defaultTabs = {
+        userpass: [
+          {
+            path: 'userpass/',
+            description: '',
+            options: {},
+            type: 'userpass',
+          },
+          {
+            path: 'userpass2/',
+            description: '',
+            options: {},
+            type: 'userpass',
+          },
+        ],
+        ldap: [
+          {
+            path: 'my-ldap/',
+            description: '',
+            options: {},
+            type: 'ldap',
+          },
+        ],
+        token: [
+          {
+            path: 'token/',
+            description: 'token based credentials',
+            options: null,
+            type: 'token',
+          },
+        ],
+      };
+      // all computed by the parent, in this case the initial tabs are the same as visible mount types
+      // but that isn't always the case
+      this.visibleMountTypes = Object.keys(defaultTabs);
+      this.defaultView = { type: 'tabs', tabData: defaultTabs };
+      this.alternateView = { type: 'dropdown', tabData: null };
+      this.initialFormState = { initialAuthType: 'userpass', showAlternate: false };
+    });
+
+    test('it selects each auth tab and renders form for that type', async function (assert) {
+      await this.renderComponent();
+      const assertSelected = (type) => {
+        assert.dom(AUTH_FORM.authForm(type)).exists(`${type}: form renders when tab is selected`);
+        assert.dom(AUTH_FORM.tabBtn(type)).hasAttribute('aria-selected', 'true');
+      };
+      const assertUnselected = (type) => {
+        assert.dom(AUTH_FORM.authForm(type)).doesNotExist(`${type}: form does NOT render`);
+        assert.dom(AUTH_FORM.tabBtn(type)).hasAttribute('aria-selected', 'false');
+      };
+      // click through each tab
+      await click(AUTH_FORM.tabBtn('userpass'));
+      assertSelected('userpass');
+      assertUnselected('ldap');
+      assertUnselected('token');
+      assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+
+      await click(AUTH_FORM.tabBtn('ldap'));
+      assertSelected('ldap');
+      assertUnselected('token');
+      assertUnselected('userpass');
+      assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+
+      await click(AUTH_FORM.tabBtn('token'));
+      assertSelected('token');
+      assertUnselected('ldap');
+      assertUnselected('userpass');
+      assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+    });
+
+    test('it clicks "Sign in with other methods" and toggles to other view', async function (assert) {
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.tabs).exists({ count: 3 }, 'tabs render by default');
+      assert.dom(GENERAL.backButton).doesNotExist();
+      await click(GENERAL.button('Sign in with other methods'));
+      assert
+        .dom(GENERAL.button('Sign in with other methods'))
+        .doesNotExist('"Sign in with other methods" does not render after it is clicked');
+      assert
+        .dom(GENERAL.selectByAttr('auth type'))
+        .exists('clicking "Sign in with other methods" renders dropdown instead of tabs');
+      await click(GENERAL.backButton);
+      assert.dom(GENERAL.backButton).doesNotExist('"Back" button does not render after it is clicked');
+      assert.dom(AUTH_FORM.tabs).exists({ count: 3 }, 'clicking "Back" renders tabs again');
+      assert
+        .dom(GENERAL.button('Sign in with other methods'))
+        .exists('"Sign in with other methods" renders again');
+    });
+
+    test('it resets selected tab after clicking "Sign in with other methods" and then "Back"', async function (assert) {
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'true');
+      assert.dom(AUTH_FORM.tabBtn('ldap')).hasAttribute('aria-selected', 'false');
+      assert.dom(AUTH_FORM.tabBtn('token')).hasAttribute('aria-selected', 'false');
+
+      // select a different tab before clicking "Sign in with other methods"
+      await click(AUTH_FORM.tabBtn('ldap'));
+      assert.dom(AUTH_FORM.tabBtn('ldap')).hasAttribute('aria-selected', 'true');
+      assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'false');
+      await click(GENERAL.button('Sign in with other methods'));
+      assert.dom(GENERAL.selectByAttr('auth type')).exists('it renders dropdown instead of tabs');
+      await click(GENERAL.backButton);
+      // assert tab selection is reset
+      assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'true');
+      assert.dom(AUTH_FORM.tabBtn('ldap')).hasAttribute('aria-selected', 'false');
+      assert.dom(AUTH_FORM.tabBtn('token')).hasAttribute('aria-selected', 'false');
+    });
+
+    test('it preselects tab from initialFormState', async function (assert) {
+      this.initialFormState = { initialAuthType: 'ldap', showAlternate: false };
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.authForm('ldap')).exists('ldap form renders');
+      assert.dom(AUTH_FORM.tabBtn('ldap')).hasAttribute('aria-selected', 'true');
+    });
+
+    test('it renders dropdown and preselects type if initialFormState is not a tab', async function (assert) {
+      this.initialFormState = { initialAuthType: 'okta', showAlternate: true };
+      await this.renderComponent();
+      assert.dom(GENERAL.selectByAttr('auth type')).hasValue('okta');
+      assert.dom(GENERAL.inputByAttr('username')).exists();
+      assert.dom(GENERAL.inputByAttr('password')).exists();
+
+      assert.dom(GENERAL.backButton).exists('"Back" button renders');
+      assert
+        .dom(GENERAL.button('Sign in with other methods'))
+        .doesNotExist('"Sign in with other methods" does not render');
+    });
+  });
+
+  // tests with "enterprise" in the title are filtered out from CE test runs
+  // naming the module 'ent' so these tests still run on the CE repo
+  module('ent', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.type = 'enterprise';
+      this.namespaceQueryParam = '';
+    });
+
+    // in the ent module to test ALL supported login methods
+    // iterating in tests should generally be avoided, but the for loop below is intentional
+    // to test the component renders as expected when auth types change
+    test('it selects each supported auth type and renders its form and relevant fields', async function (assert) {
+      const routerStub = sinon.stub(this.router, 'urlFor').returns('123-example.com');
+      // Setup so jwt auth mount is configured for jwt login and not oidc (jwt/oidc are interchangeable)
+      this.server.post(`/auth/jwt/oidc/auth_url`, () => overrideResponse(400, { errors: [ERROR_JWT_LOGIN] }));
+      const authMethodTypes = supportedTypes(true);
+      const totalFields = Object.values(AUTH_METHOD_LOGIN_DATA).reduce(
+        (sum, obj) => sum + Object.keys(obj).length,
+        0
+      );
+      // 3 assertions per method, plus an assertion for each expected field
+      assert.expect(3 * authMethodTypes.length + totalFields); // count at time of writing is 40
+
+      await this.renderComponent();
+      for (const authType of authMethodTypes) {
+        const loginData = AUTH_METHOD_LOGIN_DATA[authType];
+        await fillIn(GENERAL.selectByAttr('auth type'), authType);
+        assert.dom(GENERAL.selectByAttr('auth type')).hasValue(authType), `${authType}: it selects type`;
+        assert.dom(AUTH_FORM.authForm(authType)).exists(`${authType}: it renders form component`);
+
+        // token is the only method that does not support a custom mount path
+        if (authType !== 'token') {
+          // jwt and oidc render the same component so the toggle remains open switching between those types
+          const element = find(AUTH_FORM.advancedSettings);
+          if (element.ariaExpanded === 'false') {
+            await click(AUTH_FORM.advancedSettings);
+          }
+        }
+
+        const assertion = authType === 'token' ? 'doesNotExist' : 'exists';
+        assert.dom(GENERAL.inputByAttr('path'))[assertion](`${authType}: mount path input ${assertion}`);
+
+        Object.keys(loginData).forEach((field) => {
+          assert.dom(GENERAL.inputByAttr(field)).exists(`${authType}: ${field} input renders`);
+        });
+      }
+      routerStub.restore();
+    });
+
+    test('dropdown includes enterprise methods', async function (assert) {
+      const supported = supportedTypes(true);
+      assert.expect(supported.length);
+      await this.renderComponent();
+
+      const dropdownOptions = findAll(`${GENERAL.selectByAttr('auth type')} option`).map((o) => o.value);
+      supported.forEach((m) => {
+        assert.true(dropdownOptions.includes(m), `dropdown includes supported method: ${m}`);
+      });
+    });
+  });
+
+  // AUTH METHOD SPECIFIC TESTS
+  // since the template yields each auth <form> some assertions are best done here instead of
+  // in the corresponding the Auth::Form::<Type> integration tests
+  module('oidc-jwt', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.routerStub = (path) => sinon.stub(this.router, 'urlFor').returns(`/auth/${path}/oidc/callback`);
+    });
+
+    test('it re-requests the auth_url when authType changes', async function (assert) {
+      this.routerStub('oidc');
+      assert.expect(2); // auth_url should be hit twice, one for each type selection
+      let expectedType = 'oidc';
+      this.server.post(`/auth/:path/oidc/auth_url`, (_, req) => {
+        assert.strictEqual(
+          req.params.path,
+          expectedType,
+          `it makes request to auth_url for selected type: ${expectedType}`
+        );
+        return { data: { auth_url: '123-example.com' } };
+      });
+      await this.renderComponent();
+      // auth_url should be requested once when "oidc" is selected
+      await fillIn(GENERAL.selectByAttr('auth type'), 'oidc');
+      // auth_url should be requested again when "jwt" is selected
+      expectedType = 'jwt';
+      await fillIn(GENERAL.selectByAttr('auth type'), 'jwt');
+    });
+
+    // for simplicity the auth types are configured as their namesake but type isn't relevant.
+    // these tests assert that CONFIG changes from OIDC -> JWT render correctly and vice versa
+    // so the order the requests are hit is what matters.
+    test('"OIDC" to "JWT" configuration: it updates the form when the auth_url response changes', async function (assert) {
+      this.routerStub('oidc');
+      this.server.post(`/auth/oidc/oidc/auth_url`, () => ({ data: { auth_url: '123-example.com' } })); // this return means mount is configured as oidc
+      this.server.post(`/auth/jwt/oidc/auth_url`, () => overrideResponse(400, { errors: [ERROR_JWT_LOGIN] })); // this return means the mount is configured as jwt
+      await this.renderComponent();
+
+      // select mount configured for OIDC first
+      await fillIn(GENERAL.selectByAttr('auth type'), 'oidc');
+      assert.dom(GENERAL.inputByAttr('jwt')).doesNotExist();
+      // then select mount configured for JWT
+      await fillIn(GENERAL.selectByAttr('auth type'), 'jwt');
+      assert.dom(GENERAL.inputByAttr('jwt')).exists();
+    });
+
+    test('"JWT" to "OIDC" configuration: it updates the form when the auth_url response changes', async function (assert) {
+      this.routerStub('oidc');
+      this.server.post(`/auth/jwt/oidc/auth_url`, () => overrideResponse(400, { errors: [ERROR_JWT_LOGIN] })); // this return means the mount is configured as jwt
+      this.server.post(`/auth/oidc/oidc/auth_url`, () => ({ data: { auth_url: '123-example.com' } })); // this return means mount is configured as oidc
+      await this.renderComponent();
+
+      // select mount configured for JWT first
+      await fillIn(GENERAL.selectByAttr('auth type'), 'jwt');
+      assert.dom(GENERAL.inputByAttr('jwt')).exists();
+
+      // then select mount configured for OIDC
+      await fillIn(GENERAL.selectByAttr('auth type'), 'oidc');
+      assert.dom(GENERAL.inputByAttr('jwt')).doesNotExist();
+    });
+
+    test('it should retain role input value when mount path changes', async function (assert) {
+      assert.expect(2);
+      this.routerStub('foo-oidc');
+      const auth_url = 'http://dev-foo-bar.com';
+      this.server.post('/auth/:path/oidc/auth_url', (_, req) => {
+        const { role, redirect_uri } = JSON.parse(req.requestBody);
+        const goodRequest =
+          req.params.path === 'foo-oidc' &&
+          role === 'foo' &&
+          redirect_uri.includes('/auth/foo-oidc/oidc/callback');
+        if (goodRequest) {
+          return { data: { auth_url } };
+        } else {
+          return overrideResponse(400, { errors: [ERROR_JWT_LOGIN] });
+        }
+      });
+
+      window.open = (url) => {
+        assert.strictEqual(url, auth_url, 'auth_url is returned when required params are passed');
+      };
+
+      await this.renderComponent();
+
+      await fillIn(GENERAL.selectByAttr('auth type'), 'oidc');
+      await fillIn(GENERAL.inputByAttr('role'), 'foo');
+      await click(AUTH_FORM.advancedSettings);
+      await fillIn(GENERAL.inputByAttr('role'), 'foo');
+      await fillIn(GENERAL.inputByAttr('path'), 'foo-oidc');
+      assert.dom(GENERAL.inputByAttr('role')).hasValue('foo', 'role is retained when mount path is changed');
+      await click(GENERAL.submitButton);
+    });
+  });
+});
diff --git a/ui/tests/integration/components/auth/form/auth-form-test-helper.js b/ui/tests/integration/components/auth/form/auth-form-test-helper.js
new file mode 100644
index 00000000000..509e9faad40
--- /dev/null
+++ b/ui/tests/integration/components/auth/form/auth-form-test-helper.js
@@ -0,0 +1,73 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { click, findAll } from '@ember/test-helpers';
+import { getErrorResponse } from 'vault/tests/helpers/api/error-response';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { fillInLoginFields } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+/*
+NOTE: In the app these components are actually rendered dynamically by Auth::FormTemplate
+and so the components rendered in these tests does not represent "real world" situations.
+This is intentional to test component logic specific to auth/form/base or auth/form/<type> 
+separately from auth/form-template.
+
+See beforeEach hooks in auth/form/base-test to see setup for each method.
+*/
+
+export default (test) => {
+  test('it renders fields', async function (assert) {
+    const expectedFields = Object.keys(this.loginData);
+    await this.renderComponent();
+    assert.dom(AUTH_FORM.authForm(this.authType)).exists(`${this.authType}: it renders form component`);
+    const fields = findAll('input');
+    for (const field of fields) {
+      assert.true(expectedFields.includes(field.name), `it renders field: ${field.name}`);
+    }
+  });
+
+  test('it fires onError callback', async function (assert) {
+    this.authenticateStub.rejects(getErrorResponse({ errors: ['uh oh!'] }, 500));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+
+    const [actual] = this.onError.lastCall.args;
+    assert.strictEqual(actual, 'Authentication failed: uh oh!', 'it calls onError');
+  });
+
+  test('it fires handleAuthResponse callback', async function (assert) {
+    this.authenticateStub.resolves(this.authResponse);
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+
+    // Only checking for authMethodType because this test just asserts the handleAuthResponse callback fires.
+    const [{ authMethodType }] = this.handleAuthResponse.lastCall.args;
+    assert.strictEqual(authMethodType, this.authType, 'it calls handleAuthResponse');
+  });
+
+  test('it submits form data with defaults', async function (assert) {
+    await this.renderComponent();
+    await fillInLoginFields(this.loginData);
+    await click(GENERAL.submitButton);
+
+    // Since each login method accepts different args
+    // the submit assertion is setup in each method's beforeEach hook
+    this.assertSubmit(assert, this.authenticateStub.lastCall.args, this.loginData);
+  });
+
+  // not for testing real-world submit, that happens in acceptance tests.
+  // component here just yields <:advancedSettings> to test form submits data from yielded inputs
+  test('it submits form data from yielded inputs', async function (assert) {
+    const customPath = `custom-${this.authType}`;
+    const loginData = { ...this.loginData, path: customPath };
+    await this.renderComponent({ yieldBlock: true });
+    await fillInLoginFields(loginData);
+    await click(GENERAL.submitButton);
+    // Since each login method accepts different args
+    // the submit assertion is setup in each method's beforeEach hook
+    this.assertSubmit(assert, this.authenticateStub.lastCall.args, loginData);
+  });
+};
diff --git a/ui/tests/integration/components/auth/form/base-test.js b/ui/tests/integration/components/auth/form/base-test.js
new file mode 100644
index 00000000000..3f14d0f1508
--- /dev/null
+++ b/ui/tests/integration/components/auth/form/base-test.js
@@ -0,0 +1,250 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import hbs from 'htmlbars-inline-precompile';
+import { find, render } from '@ember/test-helpers';
+import sinon from 'sinon';
+import authFormTestHelper from './auth-form-test-helper';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { AUTH_METHOD_LOGIN_DATA } from 'vault/tests/helpers/auth/auth-helpers';
+import { RESPONSE_STUBS } from 'vault/tests/helpers/auth/response-stubs';
+
+// These auth types all use the default methods in auth/form/base
+// Any auth types with custom logic should be in a separate test file, i.e. okta
+
+module('Integration | Component | auth | form | base', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.cluster = { id: 1 };
+    this.onError = sinon.spy();
+    this.handleAuthResponse = sinon.spy();
+    const api = this.owner.lookup('service:api');
+    this.setup = (authType, loginMethod) => {
+      this.authType = authType;
+      this.authenticateStub = sinon.stub(api.auth, loginMethod);
+      this.authResponse = RESPONSE_STUBS[authType];
+      this.loginData = AUTH_METHOD_LOGIN_DATA[authType];
+    };
+  });
+
+  module('github', function (hooks) {
+    hooks.beforeEach(function () {
+      this.setup('github', 'githubLogin');
+      this.assertSubmit = (assert, loginRequestArgs, loginData) => {
+        const [path, { token }] = loginRequestArgs;
+        // if path is included in loginData, a custom path was submitted
+        const expectedPath = loginData?.path || this.authType;
+        assert.strictEqual(path, expectedPath, 'it calls githubLogin with expected path');
+        assert.strictEqual(token, loginData.token, 'it calls githubLogin with token');
+      };
+      this.renderComponent = ({ yieldBlock = false } = {}) => {
+        if (yieldBlock) {
+          return render(hbs`
+            <Auth::Form::Github 
+              @authType={{this.authType}} 
+              @cluster={{this.cluster}}
+              @onError={{this.onError}}
+              @handleAuthResponse={{this.handleAuthResponse}}
+            >
+             <:advancedSettings>
+             <label for="path">Mount path</label>
+             <input data-test-input="path" id="path" name="path" type="text" /> 
+             </:advancedSettings>
+            </Auth::Form::Github>`);
+        }
+        return render(hbs`
+          <Auth::Form::Github       
+            @authType={{this.authType}}
+            @cluster={{this.cluster}}
+            @onError={{this.onError}}
+            @handleAuthResponse={{this.handleAuthResponse}}
+          />`);
+      };
+    });
+
+    hooks.afterEach(function () {
+      this.authenticateStub.restore();
+    });
+
+    authFormTestHelper(test);
+
+    test('it renders custom label', async function (assert) {
+      await this.renderComponent();
+      const id = find(GENERAL.inputByAttr('token')).id;
+      assert.dom(`#label-${id}`).hasText('Github token');
+    });
+  });
+
+  module('ldap', function (hooks) {
+    hooks.beforeEach(function () {
+      this.setup('ldap', 'ldapLogin');
+      this.assertSubmit = (assert, loginRequestArgs, loginData) => {
+        const [username, path, { password }] = loginRequestArgs;
+        // if path is included in loginData, a custom path was submitted
+        const expectedPath = loginData?.path || this.authType;
+        assert.strictEqual(path, expectedPath, 'it calls ldapLogin with expected path');
+        assert.strictEqual(username, loginData.username, 'it calls ldapLogin with username');
+        assert.strictEqual(password, loginData.password, 'it calls ldapLogin with password');
+      };
+      this.renderComponent = ({ yieldBlock = false } = {}) => {
+        if (yieldBlock) {
+          return render(hbs`
+            <Auth::Form::Ldap 
+              @authType={{this.authType}} 
+              @cluster={{this.cluster}}
+              @onError={{this.onError}}
+              @handleAuthResponse={{this.handleAuthResponse}}
+            >
+             <:advancedSettings>
+             <label for="path">Mount path</label>
+             <input data-test-input="path" id="path" name="path" type="text" /> 
+             </:advancedSettings>
+            </Auth::Form::Ldap>`);
+        }
+        return render(hbs`
+          <Auth::Form::Ldap       
+            @authType={{this.authType}}
+            @cluster={{this.cluster}}
+            @onError={{this.onError}}
+            @handleAuthResponse={{this.handleAuthResponse}}
+          />`);
+      };
+    });
+
+    hooks.afterEach(function () {
+      this.authenticateStub.restore();
+    });
+
+    authFormTestHelper(test);
+  });
+
+  module('radius', function (hooks) {
+    hooks.beforeEach(function () {
+      this.setup('radius', 'radiusLoginWithUsername');
+      this.assertSubmit = (assert, loginRequestArgs, loginData) => {
+        const [username, path, { password }] = loginRequestArgs;
+        // if path is included in loginData, a custom path was submitted
+        const expectedPath = loginData?.path || this.authType;
+        assert.strictEqual(username, loginData.username, 'it calls radiusLoginWithUsername with username');
+        assert.strictEqual(path, expectedPath, 'it calls radiusLoginWithUsername with expected path');
+        assert.strictEqual(password, loginData.password, 'it calls radiusLoginWithUsername with password');
+      };
+      this.renderComponent = ({ yieldBlock = false } = {}) => {
+        if (yieldBlock) {
+          return render(hbs`
+            <Auth::Form::Radius 
+              @authType={{this.authType}} 
+              @cluster={{this.cluster}}
+              @onError={{this.onError}}
+              @handleAuthResponse={{this.handleAuthResponse}}
+            >
+             <:advancedSettings>
+              <label for="path">Mount path</label>
+              <input data-test-input="path" id="path" name="path" type="text" /> 
+             </:advancedSettings>
+            </Auth::Form::Radius>`);
+        }
+        return render(hbs`
+          <Auth::Form::Radius       
+            @authType={{this.authType}}
+            @cluster={{this.cluster}}
+            @onError={{this.onError}}
+            @handleAuthResponse={{this.handleAuthResponse}}
+          />`);
+      };
+    });
+
+    hooks.afterEach(function () {
+      this.authenticateStub.restore();
+    });
+
+    authFormTestHelper(test);
+  });
+
+  module('token', function (hooks) {
+    hooks.beforeEach(function () {
+      this.setup('token', 'tokenLookUpSelf');
+      this.assertSubmit = (assert, loginRequestArgs) => {
+        const [{ headers }] = loginRequestArgs;
+        assert.strictEqual(headers['X-Vault-Token'], 'mysupersecuretoken', 'token is submitted as header');
+      };
+      this.renderComponent = ({ yieldBlock = false } = {}) => {
+        if (yieldBlock) {
+          return render(hbs`
+            <Auth::Form::Token 
+              @authType={{this.authType}} 
+              @cluster={{this.cluster}}
+              @onError={{this.onError}}
+              @handleAuthResponse={{this.handleAuthResponse}}
+            >
+             <:advancedSettings>
+                <label for="path">Mount path</label>
+                <input data-test-input="path" id="path" name="path" type="text" /> 
+             </:advancedSettings>
+            </Auth::Form::Token>`);
+        }
+        return render(hbs`
+          <Auth::Form::Token       
+            @authType={{this.authType}}
+            @cluster={{this.cluster}}
+            @onError={{this.onError}}
+            @handleAuthResponse={{this.handleAuthResponse}}
+          />`);
+      };
+    });
+
+    hooks.afterEach(function () {
+      this.authenticateStub.restore();
+    });
+
+    authFormTestHelper(test);
+  });
+
+  module('userpass', function (hooks) {
+    hooks.beforeEach(function () {
+      this.setup('userpass', 'userpassLogin');
+      this.assertSubmit = (assert, loginRequestArgs, loginData) => {
+        const [username, path, { password }] = loginRequestArgs;
+        // if path is included in loginData, a custom path was submitted
+        const expectedPath = loginData?.path || this.authType;
+        assert.strictEqual(path, expectedPath, 'it calls userpassLogin with expected path');
+        assert.strictEqual(username, loginData.username, 'it calls userpassLogin with username');
+        assert.strictEqual(password, loginData.password, 'it calls userpassLogin with password');
+      };
+      this.renderComponent = ({ yieldBlock = false } = {}) => {
+        if (yieldBlock) {
+          return render(hbs`
+            <Auth::Form::Userpass 
+              @authType={{this.authType}} 
+              @cluster={{this.cluster}}
+              @onError={{this.onError}}
+              @handleAuthResponse={{this.handleAuthResponse}}
+            >
+             <:advancedSettings>
+              <label for="path">Mount path</label>
+              <input data-test-input="path" id="path" name="path" type="text" /> 
+             </:advancedSettings>
+            </Auth::Form::Userpass>`);
+        }
+        return render(hbs`
+          <Auth::Form::Userpass       
+            @authType={{this.authType}}
+            @cluster={{this.cluster}}
+            @onError={{this.onError}}
+            @handleAuthResponse={{this.handleAuthResponse}}
+          />`);
+      };
+    });
+
+    hooks.afterEach(function () {
+      this.authenticateStub.restore();
+    });
+
+    authFormTestHelper(test);
+  });
+});
diff --git a/ui/tests/integration/components/auth/form/oidc-jwt-test.js b/ui/tests/integration/components/auth/form/oidc-jwt-test.js
new file mode 100644
index 00000000000..0fd0e2e44e6
--- /dev/null
+++ b/ui/tests/integration/components/auth/form/oidc-jwt-test.js
@@ -0,0 +1,418 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import hbs from 'htmlbars-inline-precompile';
+import { click, fillIn, find, render, settled, waitUntil } from '@ember/test-helpers';
+import { _cancelTimers as cancelTimers } from '@ember/runloop';
+import { callbackData } from 'vault/tests/helpers/oidc-window-stub';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import * as parseURL from 'core/utils/parse-url';
+import sinon from 'sinon';
+import authFormTestHelper from './auth-form-test-helper';
+import { RESPONSE_STUBS } from 'vault/tests/helpers/auth/response-stubs';
+import { DOMAIN_PROVIDER_MAP, ERROR_JWT_LOGIN } from 'vault/utils/auth-form-helpers';
+import { dasherize } from '@ember/string';
+
+/* 
+The OIDC and JWT mounts call the same endpoint (see docs https://developer.hashicorp.com/vault/docs/auth/jwt )
+because of this the same component is used to render both method types. 
+The module name refers to the selected auth type and there is test coverage in each to cover
+1. auth url request (fetching role) is made when expected
+2. JWT token login flow
+2. OIDC exchange/login situation
+*/
+
+const authUrlRequestTests = (test) => {
+  test('it requests auth_url when it initially renders', async function (assert) {
+    assert.expect(2);
+    this.server.post(`/auth/${this.authType}/oidc/auth_url`, (_, req) => {
+      const { role } = JSON.parse(req.requestBody);
+      assert.true(true, 'it makes request to auth_url');
+      assert.strictEqual(role, '', 'role is empty');
+      return { data: { auth_url: '123-example.com' } };
+    });
+    await this.renderComponent();
+  });
+
+  test('it re-requests auth_url when input changes: role', async function (assert) {
+    // request assertions should be hit twice, once on initial render and again on role change
+    assert.expect(4);
+    let count = 0;
+    this.server.post(`/auth/${this.authType}/oidc/auth_url`, (_, req) => {
+      count++;
+      const { role } = JSON.parse(req.requestBody);
+      assert.true(true, 'it makes request to auth_url');
+      const expectedRole = count === 1 ? '' : 'myrole';
+      assert.strictEqual(role, expectedRole, 'payload has expected role');
+      return { data: { auth_url: '123-example.com' } };
+    });
+    await this.renderComponent({ yieldBlock: true });
+    await fillIn(GENERAL.inputByAttr('role'), 'myrole');
+  });
+
+  test('it re-requests auth_url when input changes: path', async function (assert) {
+    assert.expect(2);
+    let firstRequest, secondRequest;
+    this.server.post(`/auth/${this.authType}/oidc/auth_url`, () => {
+      firstRequest = true;
+      return { data: { auth_url: '123-example.com' } };
+    });
+    this.server.post(`/auth/mypath/oidc/auth_url`, () => {
+      secondRequest = true;
+      return { data: { auth_url: '123-example.com' } };
+    });
+    await this.renderComponent({ yieldBlock: true });
+    await fillIn(GENERAL.inputByAttr('path'), 'mypath');
+
+    // asserting this way instead of inside the request to ensure each endpoint is hit.
+    // (asserting within each request would rely on assertion count and could result in a false positive)
+    assert.true(firstRequest, 'it makes FIRST request to auth_url with default path');
+    assert.true(secondRequest, 'it makes SECOND request to auth_url with custom path');
+  });
+};
+
+const jwtLoginTests = (test) => {
+  test('it renders sign in button text', async function (assert) {
+    await this.renderComponent();
+    assert.dom(GENERAL.submitButton).hasText('Sign in');
+  });
+
+  test('it does NOT re-request the auth_url when jwt token changes', async function (assert) {
+    assert.expect(1); // the assertion in the stubbed request should not be hit
+    await this.renderComponent();
+    this.server.post(`/auth/${this.authType}/oidc/auth_url`, () => {
+      // we can't throw an error here because the component catches error handling.
+      // setting this assertion to fail intentionally because this request should not have been made
+      assert.false(true, 'request made to auth_url and it should not have been requested');
+    });
+    await fillIn(GENERAL.inputByAttr('jwt'), 'mytoken');
+    assert.dom(GENERAL.inputByAttr('jwt')).hasValue('mytoken');
+  });
+};
+
+const oidcLoginTests = (test) => {
+  // true success has to be asserted in acceptance tests because it's not possible to mock a trusted message event
+  test('it opens the popup window on submit', async function (assert) {
+    this.server.post(`/auth/${this.authType}/oidc/auth_url`, () => {
+      return { data: { auth_url: '123-example.com' } };
+    });
+    sinon.replaceGetter(window, 'screen', () => ({ height: 600, width: 500 }));
+    await this.renderComponent();
+    await fillIn(GENERAL.inputByAttr('role'), 'test');
+    await click(GENERAL.submitButton);
+    await waitUntil(() => {
+      return this.windowStub.calledOnce;
+    });
+
+    const [authURL, windowName, windowDimensions] = this.windowStub.lastCall.args;
+
+    assert.strictEqual(authURL, '123-example.com', 'window stub called with auth_url');
+    assert.strictEqual(windowName, 'vaultOIDCWindow', 'window stub called with name');
+    assert.strictEqual(
+      windowDimensions,
+      'width=500,height=600,resizable,scrollbars=yes,top=0,left=0',
+      'window stub called with dimensions'
+    );
+    sinon.restore();
+  });
+
+  /* Tests for auth_url error handling on submit */
+  test('it fires onError callback on submit when auth_url request fails with 400', async function (assert) {
+    this.server.post('/auth/:path/oidc/auth_url', () => overrideResponse(400));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+
+    const [actual] = this.onError.lastCall.args;
+    assert.strictEqual(actual, 'Authentication failed: Invalid role. Please try again.');
+  });
+
+  test('it fires onError callback on submit when auth_url request fails with 403', async function (assert) {
+    this.server.post('/auth/:path/oidc/auth_url', () => overrideResponse(403));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+
+    const [actual] = this.onError.lastCall.args;
+    assert.strictEqual(actual, 'Authentication failed: Error fetching role: permission denied');
+  });
+
+  test('it fires onError callback on submit when auth_url request is successful but missing auth_url', async function (assert) {
+    this.server.post('/auth/:path/oidc/auth_url', () => ({ data: { auth_url: '' } }));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+
+    const [actual] = this.onError.lastCall.args;
+    assert.strictEqual(
+      actual,
+      'Authentication failed: Missing auth_url. Please check that allowed_redirect_uris for the role include this mount path.',
+      'it calls onError'
+    );
+  });
+  /* END auth_url error handling */
+
+  /* test for prepareForOIDC logic */
+  test('fails silently when event is not trusted', async function (assert) {
+    assert.expect(2);
+    this.server.post(`/auth/${this.authType}/oidc/auth_url`, () => {
+      return { data: { auth_url: '123-example.com' } };
+    });
+    // prevent test incorrectly passing because the event isn't triggered at all
+    // by also asserting that the message event fires
+    const messageData = callbackData();
+    const assertEvent = (event) => {
+      assert.propEqual(event.data, messageData, 'message event fires');
+    };
+    window.addEventListener('message', assertEvent);
+
+    await this.renderComponent();
+    await fillIn(GENERAL.inputByAttr('role'), 'test');
+    await click(GENERAL.submitButton);
+    await waitUntil(() => {
+      return this.windowStub.calledOnce;
+    });
+    // mocking a message event is always untrusted (there is no way to override isTrusted on the window object)
+    window.dispatchEvent(new MessageEvent('message', { data: messageData }));
+
+    cancelTimers();
+    await settled();
+    assert.false(this.handleAuthResponse.called, 'handleAuthResponse is not called');
+
+    // Cleanup
+    window.removeEventListener('message', assertEvent);
+  });
+
+  // not the greatest test because this assertion would also pass if the event.origin === window.origin.
+  // because event.isTrusted is always false (another condition checked by the component)
+  // but this is good enough because the origin logic is checked first in the conditional.
+  test('it fails silently when event origin does not match window origin', async function (assert) {
+    assert.expect(3);
+    this.server.post(`/auth/${this.authType}/oidc/auth_url`, () => {
+      return { data: { auth_url: '123-example.com' } };
+    });
+    // prevent test incorrectly passing because the event isn't triggered at all
+    // by also asserting that the message event fires
+    const message = { data: callbackData(), origin: 'http://hackerz.com' };
+    const assertEvent = (event) => {
+      assert.propEqual(event.data, message.data, 'message has expected data');
+      assert.strictEqual(event.origin, message.origin, 'message has expected origin');
+    };
+    window.addEventListener('message', assertEvent);
+
+    await this.renderComponent();
+    await fillIn(GENERAL.inputByAttr('role'), 'test');
+    await click(GENERAL.submitButton);
+    await waitUntil(() => {
+      return this.windowStub.calledOnce;
+    });
+
+    window.dispatchEvent(new MessageEvent('message', message));
+    cancelTimers();
+    await settled();
+    assert.false(this.handleAuthResponse.called, 'handleAuthResponse is not called');
+
+    // Cleanup
+    window.removeEventListener('message', assertEvent);
+  });
+  /* end of tests for prepareForOIDC logic */
+};
+
+module('Integration | Component | auth | form | oidc-jwt', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.cluster = { id: 1 };
+    this.onError = sinon.spy();
+    this.handleAuthResponse = sinon.spy();
+    this.routerStub = sinon.stub(this.owner.lookup('service:router'), 'urlFor').returns('123-example.com');
+    const api = this.owner.lookup('service:api');
+
+    this.oidcLoginSetup = () => {
+      // authentication request called on submit for oidc login
+      this.authenticateStub = sinon.stub(api.auth, 'jwtOidcCallback');
+      this.authResponse = RESPONSE_STUBS.oidc['oidc/callback'];
+      this.windowStub = sinon.stub(window, 'open');
+    };
+
+    this.jwtLoginSetup = () => {
+      // stubbing this request shows JWT token input and does not perform OIDC
+      this.server.post(`/auth/:path/oidc/auth_url`, () => {
+        return overrideResponse(400, { errors: [ERROR_JWT_LOGIN] });
+      });
+      // authentication request called on submit for jwt tokens
+      this.authenticateStub = sinon.stub(api.auth, 'jwtLogin');
+      this.authResponse = RESPONSE_STUBS.jwt.login;
+    };
+
+    this.assertSubmit = (assert, loginRequestArgs, loginData) => {
+      const [path, payload] = loginRequestArgs;
+      // if path is included in loginData, a custom path was submitted
+      const expectedPath = loginData?.path || this.authType;
+      assert.strictEqual(path, expectedPath, `auth request made with path: ${expectedPath}`);
+
+      // iterate through each item in the payload and check its value
+      for (const field in payload) {
+        const actualValue = payload[field];
+        const expectedValue = loginData[field];
+        assert.strictEqual(actualValue, expectedValue, `payload includes field: ${field}`);
+      }
+    };
+
+    this.renderComponent = ({ yieldBlock = false } = {}) => {
+      if (yieldBlock) {
+        return render(hbs`
+          <Auth::Form::OidcJwt 
+            @authType={{this.authType}} 
+            @cluster={{this.cluster}}
+            @onError={{this.onError}}
+            @handleAuthResponse={{this.handleAuthResponse}}
+          >
+            <:advancedSettings>
+              <label for="path">Mount path</label>
+              <input data-test-input="path" id="path" name="path" type="text" /> 
+            </:advancedSettings>
+          </Auth::Form::OidcJwt>`);
+      }
+      return render(hbs`
+        <Auth::Form::OidcJwt       
+        @authType={{this.authType}}
+        @cluster={{this.cluster}}
+        @onError={{this.onError}}
+        @handleAuthResponse={{this.handleAuthResponse}}
+        />
+        `);
+    };
+  });
+
+  hooks.afterEach(function () {
+    this.routerStub.restore();
+  });
+
+  /* TESTS FOR BASE COMPONENT FUNCTIONALITY
+   These tests intentionally do not set authType as they are asserting type agnostic functionality.
+   This means the /auth_url request is missing the :path param and the console will output this request error:
+   403 http://localhost:7357/v1/auth//oidc/auth_url
+   */
+  test('it renders helper text', async function (assert) {
+    await this.renderComponent();
+    const id = find(GENERAL.inputByAttr('role')).id;
+    assert
+      .dom(`#helper-text-${id}`)
+      .hasText('Vault will use the default role to sign in if this field is left blank.');
+  });
+
+  for (const domain in DOMAIN_PROVIDER_MAP) {
+    const provider = DOMAIN_PROVIDER_MAP[domain];
+
+    test(`${provider}: it renders provider icon and name`, async function (assert) {
+      // parseUrl uses the actual window origin, so stub the util's return instead of authUrl
+      const parseURLStub = sinon.stub(parseURL, 'default').returns({ hostname: domain });
+      await this.renderComponent();
+      assert.dom(GENERAL.submitButton).hasText(`Sign in with ${provider}`);
+
+      // Right now there is a bug in HDS where the ping-identity icon name has a trailing whitespace.
+      // This test should fail when upgrading to an HDS version with the corrected icon name and then we can remove this conditional.
+      const iconName = domain === 'ping.com' ? 'ping-identity ' : dasherize(provider.toLowerCase());
+      // convenience message for HDS upgrade failure, can be removed when we upgrade
+      const message =
+        iconName === 'ping-identity '
+          ? `If you are attempting to upgrade @hashicorp/design-system-components and this test is failing, please remove the icon override for Ping Identity in oidc-jwt.ts`
+          : `it renders icon for ${domain}`;
+      assert.dom(GENERAL.icon(iconName)).exists(message);
+      parseURLStub.restore();
+    });
+  }
+
+  test('it does not return provider unless domain matches completely', async function (assert) {
+    assert.expect(2);
+    // parseUrl uses the actual window origin, so stub the return
+    const parseURLStub = sinon
+      .stub(parseURL, 'default')
+      .returns({ hostname: `http://custom-auth0-provider.com` });
+    await this.renderComponent();
+    assert.dom(GENERAL.submitButton).hasText('Sign in with OIDC Provider');
+    assert.dom(GENERAL.icon()).doesNotExist();
+    parseURLStub.restore();
+  });
+
+  module('@authType: oidc', function (hooks) {
+    hooks.beforeEach(function () {
+      this.authType = 'oidc';
+    });
+
+    // base component functionality so outside login workflow modules
+    authUrlRequestTests(test);
+
+    module('login workflow: jwt token', function (hooks) {
+      hooks.beforeEach(function () {
+        this.jwtLoginSetup();
+        this.loginData = { role: 'some-dev', jwt: 'some-jwt-token' };
+      });
+
+      hooks.afterEach(function () {
+        this.authenticateStub.restore();
+      });
+
+      authFormTestHelper(test);
+
+      jwtLoginTests(test);
+    });
+
+    module('login workflow: oidc', function (hooks) {
+      hooks.beforeEach(function () {
+        this.oidcLoginSetup();
+        this.loginData = { role: 'some-dev' };
+      });
+
+      hooks.afterEach(function () {
+        this.authenticateStub.restore();
+        this.windowStub.restore();
+      });
+
+      oidcLoginTests(test);
+    });
+  });
+
+  module('@authType: jwt', function (hooks) {
+    hooks.beforeEach(function () {
+      this.authType = 'jwt';
+    });
+
+    // base component functionality so outside login workflow modules
+    authUrlRequestTests(test);
+
+    module('login workflow: jwt token', function (hooks) {
+      hooks.beforeEach(function () {
+        this.jwtLoginSetup();
+        this.loginData = { role: 'some-dev', jwt: 'some-jwt-token' };
+      });
+
+      hooks.afterEach(function () {
+        this.authenticateStub.restore();
+      });
+
+      authFormTestHelper(test);
+
+      jwtLoginTests(test);
+    });
+
+    module('login workflow: oidc', function (hooks) {
+      hooks.beforeEach(function () {
+        this.oidcLoginSetup();
+        this.loginData = { role: 'some-dev' };
+      });
+
+      hooks.afterEach(function () {
+        this.authenticateStub.restore();
+        this.windowStub.restore();
+      });
+
+      oidcLoginTests(test);
+    });
+  });
+});
diff --git a/ui/tests/integration/components/auth/form/okta-test.js b/ui/tests/integration/components/auth/form/okta-test.js
new file mode 100644
index 00000000000..0f8f3454a47
--- /dev/null
+++ b/ui/tests/integration/components/auth/form/okta-test.js
@@ -0,0 +1,140 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import hbs from 'htmlbars-inline-precompile';
+import { click, render } from '@ember/test-helpers';
+import sinon from 'sinon';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { AUTH_METHOD_LOGIN_DATA, fillInLoginFields } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import * as uuid from 'core/utils/uuid';
+import { Response } from 'miragejs';
+import authFormTestHelper from './auth-form-test-helper';
+import { RESPONSE_STUBS } from 'vault/tests/helpers/auth/response-stubs';
+
+module('Integration | Component | auth | form | okta', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.authType = 'okta';
+    this.cluster = { id: 1 };
+    this.onError = sinon.spy();
+    this.handleAuthResponse = sinon.spy();
+
+    // stub uuid so auth/okta/verify request can be stubbed using mirage
+    this.nonce = '12345';
+    this.nonceStub = sinon.stub(uuid, 'default').returns(this.nonce);
+    this.verifyResponse = { data: { correct_answer: 68 } };
+    this.server.get(`/auth/:path/verify/${this.nonce}`, () => this.verifyResponse);
+
+    // Auth request stub
+    const api = this.owner.lookup('service:api');
+    this.authenticateStub = sinon.stub(api.auth, 'oktaLogin');
+    this.authResponse = RESPONSE_STUBS.okta;
+    this.loginData = AUTH_METHOD_LOGIN_DATA.okta;
+    // Resolve response by default, specific tests override this as needed
+    this.authenticateStub.resolves(this.authResponse);
+
+    this.assertSubmit = (assert, loginRequestArgs, loginData) => {
+      const [username, path, { nonce, password }] = loginRequestArgs;
+      // if path is included in loginData, a custom path was submitted
+      const expectedPath = loginData?.path || this.authType;
+      assert.strictEqual(path, expectedPath, 'it calls oktaLogin with expected path');
+      assert.strictEqual(username, loginData.username, 'it calls oktaLogin with username');
+      assert.strictEqual(password, loginData.password, 'it calls oktaLogin with password');
+      assert.strictEqual(nonce, this.nonce, 'it calls oktaLogin with nonce');
+    };
+
+    this.renderComponent = ({ yieldBlock = false } = {}) => {
+      if (yieldBlock) {
+        return render(hbs`
+          <Auth::Form::Okta 
+            @authType={{this.authType}} 
+            @cluster={{this.cluster}}
+            @onError={{this.onError}}
+            @handleAuthResponse={{this.handleAuthResponse}}
+          >
+            <:advancedSettings>
+              <label for="path">Mount path</label>
+              <input data-test-input="path" id="path" name="path" type="text" /> 
+            </:advancedSettings>
+          </Auth::Form::Okta>`);
+      }
+      return render(hbs`
+      <Auth::Form::Okta       
+        @authType={{this.authType}}
+        @cluster={{this.cluster}}
+        @onError={{this.onError}}
+        @handleAuthResponse={{this.handleAuthResponse}}
+      />`);
+    };
+  });
+
+  hooks.afterEach(function () {
+    this.authenticateStub.restore();
+    this.nonceStub.restore();
+  });
+
+  authFormTestHelper(test);
+
+  test('it displays okta number challenge answer', async function (assert) {
+    await this.renderComponent();
+    await fillInLoginFields(this.loginData);
+    await click(GENERAL.submitButton);
+    assert
+      .dom('[data-test-okta-number-challenge]')
+      .hasText(
+        'To finish signing in, you will need to complete an additional MFA step. Okta verification Select the following number to complete verification: 68 Back to login'
+      );
+  });
+
+  test('it returns to login when "Back to login" is clicked', async function (assert) {
+    await this.renderComponent();
+    await fillInLoginFields(this.loginData);
+    await click(GENERAL.submitButton);
+    assert.dom('[data-test-okta-number-challenge]').exists();
+    await click(GENERAL.backButton);
+    assert.dom(AUTH_FORM.authForm('okta')).exists('it returns to okta form');
+    assert.dom('[data-test-okta-number-challenge]').doesNotExist();
+    assert.dom(GENERAL.inputByAttr('username')).hasValue('', 'username is cleared');
+    assert.dom(GENERAL.inputByAttr('password')).hasValue('', 'password is cleared');
+  });
+
+  test('it shows loading state when polling okta verify request', async function (assert) {
+    assert.expect(2);
+    let count = 0;
+    this.server.get(`/auth/okta/verify/${this.nonce}`, () => {
+      count++;
+      assert.dom('[data-test-okta-number-challenge]').hasText(
+        'To finish signing in, you will need to complete an additional MFA step. Please wait... Back to login',
+        count === 1
+          ? // the response hasn't returned anything yet, so the first assertion is just the initial state
+            'it shows loading message before polling initiates'
+          : // by now the response has returned a 404 so this asserts error handling works as expected
+            'it shows loading message while response returns 404'
+      );
+      // okta/verify returns a 404 until the user interacts with okta via their configured MFA app.
+      // to simulate this interaction we return data on the third request - which ends the polling.
+      const response = count < 2 ? new Response(404) : this.verifyResponse;
+      return response;
+    });
+
+    await this.renderComponent();
+    await fillInLoginFields(this.loginData);
+    await click(GENERAL.submitButton);
+  });
+
+  test('it renders error message when okta verify request errors', async function (assert) {
+    this.server.get(`/auth/okta/verify/${this.nonce}`, () => new Response(500, {}, { errors: ['oh no!!'] }));
+    await this.renderComponent();
+    await fillInLoginFields(this.loginData);
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.messageError).hasText('Error oh no!!');
+  });
+});
diff --git a/ui/tests/integration/components/auth/form/saml-test.js b/ui/tests/integration/components/auth/form/saml-test.js
new file mode 100644
index 00000000000..7c449946864
--- /dev/null
+++ b/ui/tests/integration/components/auth/form/saml-test.js
@@ -0,0 +1,210 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import hbs from 'htmlbars-inline-precompile';
+import { click, fillIn, find, render } from '@ember/test-helpers';
+import sinon from 'sinon';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { windowStub } from 'vault/tests/helpers/oidc-window-stub';
+import * as uuid from 'core/utils/uuid';
+import { getErrorResponse } from 'vault/tests/helpers/api/error-response';
+import { RESPONSE_STUBS } from 'vault/tests/helpers/auth/response-stubs';
+import { AUTH_METHOD_LOGIN_DATA } from 'vault/tests/helpers/auth/auth-helpers';
+import authFormTestHelper from './auth-form-test-helper';
+
+module('Integration | Component | auth | form | saml', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.authType = 'saml';
+    this.expectedFields = ['role'];
+
+    this.tokenPollId = '4fe2ec01-1f56-b665-0ba2-09c7bca10ae8';
+    this.cluster = { id: 1 };
+    this.onError = sinon.spy();
+    this.handleAuthResponse = sinon.spy();
+    // Window stub
+    this.windowStub = windowStub();
+    sinon.replaceGetter(window, 'screen', () => ({ height: 600, width: 500 }));
+    // Auth request stub
+    const api = this.owner.lookup('service:api');
+    this.authenticateStub = sinon.stub(api.auth, 'samlWriteToken');
+    this.authResponse = RESPONSE_STUBS.saml['saml/token'];
+    this.loginData = AUTH_METHOD_LOGIN_DATA.saml;
+    // stub uuid so verifier can be asserted
+    this.verifier = uuid.default();
+    sinon.stub(uuid, 'default').returns(this.verifier);
+    // role request
+    this.server.post('/auth/:path/sso_service_url', () => {
+      return {
+        data: {
+          sso_service_url: 'https://my-single-sign-on-url.com',
+          token_poll_id: this.tokenPollId,
+        },
+      };
+    });
+
+    this.assertSubmit = (assert, loginRequestArgs, loginData) => {
+      const [path, { client_verifier, token_poll_id }] = loginRequestArgs;
+      // if path is included in loginData, a custom path was submitted
+      const expectedPath = loginData?.path || this.authType;
+      assert.strictEqual(path, expectedPath, 'it calls samlWriteToken with expected path');
+      assert.strictEqual(client_verifier, this.verifier, 'it calls samlWriteToken with verifier');
+      assert.strictEqual(token_poll_id, this.tokenPollId, 'it calls samlWriteToken with tokenPollId');
+    };
+
+    this.renderComponent = ({ yieldBlock = false } = {}) => {
+      if (yieldBlock) {
+        return render(hbs`
+          <Auth::Form::Saml 
+            @authType={{this.authType}} 
+            @cluster={{this.cluster}}
+            @onError={{this.onError}}
+            @handleAuthResponse={{this.handleAuthResponse}}
+          >
+            <:advancedSettings>
+              <label for="path">Mount path</label>
+              <input data-test-input="path" id="path" name="path" type="text" /> 
+            </:advancedSettings>
+          </Auth::Form::Saml>`);
+      }
+      return render(hbs`
+      <Auth::Form::Saml       
+        @authType={{this.authType}}
+        @cluster={{this.cluster}}
+        @onError={{this.onError}}
+        @handleAuthResponse={{this.handleAuthResponse}}
+      />`);
+    };
+  });
+
+  hooks.afterEach(function () {
+    this.windowStub.restore();
+    this.authenticateStub.restore();
+  });
+
+  authFormTestHelper(test);
+
+  test('it renders helper text', async function (assert) {
+    await this.renderComponent();
+    const id = find(GENERAL.inputByAttr('role')).id;
+    assert
+      .dom(`#helper-text-${id}`)
+      .hasText('Vault will use the default role to sign in if this field is left blank.');
+  });
+
+  test('it renders warning if insecure context is detected', async function (assert) {
+    sinon.replaceGetter(window, 'isSecureContext', () => false);
+
+    await this.renderComponent();
+    assert
+      .dom('[data-test-saml-auth-not-allowed]')
+      .hasText(
+        'Insecure context detected Logging in with a SAML auth method requires a browser in a secure context. Read more about secure contexts.'
+      );
+  });
+
+  test('it requests sso_service_url and opens popup on submit if role is empty', async function (assert) {
+    assert.expect(6);
+    this.server.post('/auth/saml/sso_service_url', (_, req) => {
+      const { acs_url, role } = JSON.parse(req.requestBody);
+      assert.strictEqual(acs_url, `${window.origin}/v1/auth/saml/callback`, 'it builds acs_url for payload');
+      assert.strictEqual(role, '', 'role has no value');
+      return {
+        data: {
+          sso_service_url: 'https://my-single-sign-on-url.com',
+          token_poll_id: this.tokenPollId,
+        },
+      };
+    });
+
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+
+    const [sso_service_url, name, dimensions] = this.windowStub.lastCall.args;
+    assert.strictEqual(
+      sso_service_url,
+      'https://my-single-sign-on-url.com',
+      'it calls window opener with sso_service_url returned by role request'
+    );
+    assert.strictEqual(sso_service_url, 'https://my-single-sign-on-url.com');
+    assert.strictEqual(name, 'vaultSAMLWindow', 'it calls window opener with expected name');
+    assert.strictEqual(
+      dimensions,
+      'width=500,height=600,resizable,scrollbars=yes,top=0,left=0',
+      'it calls window opener with expected dimensions'
+    );
+  });
+
+  test('it requests sso_service_url with inputted role and default path', async function (assert) {
+    assert.expect(6);
+    this.server.post('/auth/saml/sso_service_url', (_, req) => {
+      const { acs_url, role } = JSON.parse(req.requestBody);
+      assert.strictEqual(acs_url, `${window.origin}/v1/auth/saml/callback`, 'it builds acs_url for payload');
+      assert.strictEqual(role, 'some-dev', 'payload contains role');
+      return {
+        data: {
+          sso_service_url: 'https://my-single-sign-on-url.com',
+          token_poll_id: this.tokenPollId,
+        },
+      };
+    });
+
+    await this.renderComponent();
+    await fillIn(GENERAL.inputByAttr('role'), 'some-dev');
+    await click(GENERAL.submitButton);
+
+    const [sso_service_url, name, dimensions] = this.windowStub.lastCall.args;
+    assert.strictEqual(
+      sso_service_url,
+      'https://my-single-sign-on-url.com',
+      'it calls window opener with sso_service_url returned by role request'
+    );
+    assert.strictEqual(sso_service_url, 'https://my-single-sign-on-url.com');
+    assert.strictEqual(name, 'vaultSAMLWindow', 'it calls window opener with expected name');
+    assert.strictEqual(
+      dimensions,
+      'width=500,height=600,resizable,scrollbars=yes,top=0,left=0',
+      'it calls window opener with expected dimensions'
+    );
+  });
+
+  test('it re-requests samlWriteToken if 401 is returned', async function (assert) {
+    assert.expect(1);
+    this.authenticateStub.onFirstCall().rejects(getErrorResponse({}, 401));
+    this.authenticateStub.onSecondCall().rejects(getErrorResponse({}, 401));
+    // MAX_TRIES in the component is set to 3 for tests
+    this.authenticateStub.onThirdCall().resolves(this.authResponse);
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    assert.strictEqual(this.authenticateStub.callCount, 3, 'it polls token request until request resolves');
+  });
+
+  test('it calls onError if sso_service_url request fails', async function (assert) {
+    // role request
+    this.server.post('/auth/saml/sso_service_url', () => overrideResponse(403));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    const [actual] = this.onError.lastCall.args;
+    assert.strictEqual(
+      actual,
+      'Authentication failed: permission denied',
+      'onError called with sso_service_url failure'
+    );
+  });
+
+  test('it calls onError if polling token errors in status code that is NOT 401', async function (assert) {
+    this.authenticateStub.rejects(getErrorResponse({ errors: ['uh oh!'] }), 500);
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    const [actual] = this.onError.lastCall.args;
+    assert.strictEqual(actual, 'Authentication failed: uh oh!', 'onError called with expected failure');
+  });
+});
diff --git a/ui/tests/integration/components/auth/namespace-input-test.js b/ui/tests/integration/components/auth/namespace-input-test.js
new file mode 100644
index 00000000000..2fbd63db886
--- /dev/null
+++ b/ui/tests/integration/components/auth/namespace-input-test.js
@@ -0,0 +1,85 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { fillIn, find, render } from '@ember/test-helpers';
+import hbs from 'htmlbars-inline-precompile';
+import sinon from 'sinon';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | auth | namespace input', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.disabled = false;
+    this.oidcProviderQueryParam = '';
+    this.handleNamespaceUpdate = sinon.spy();
+    this.shouldRefocusNamespaceInput = false;
+
+    this.renderComponent = () => {
+      return render(hbs`
+      <Auth::NamespaceInput
+        @disabled={{this.disabled}}
+        @handleNamespaceUpdate={{this.handleNamespaceUpdate}}
+        @namespaceQueryParam={{this.namespaceQueryParam}}
+        @shouldRefocusNamespaceInput={{this.shouldRefocusNamespaceInput}}
+      />`);
+    };
+  });
+
+  test('it fires @handleNamespaceUpdate callback', async function (assert) {
+    assert.expect(1);
+    await this.renderComponent();
+    await fillIn(GENERAL.inputByAttr('namespace'), 'ns-1');
+    const [actual] = this.handleNamespaceUpdate.lastCall.args;
+    assert.strictEqual(actual, 'ns-1', `handleNamespaceUpdate called with: ${actual}`);
+  });
+
+  test('it disables the input if @disabled is true', async function (assert) {
+    this.disabled = true;
+    await this.renderComponent();
+    assert.dom(GENERAL.inputByAttr('namespace')).isDisabled();
+  });
+
+  test('it does not focus the input if @shouldRefocusNamespaceInput is false', async function (assert) {
+    await this.renderComponent();
+    const element = find(GENERAL.inputByAttr('namespace'));
+    assert.notStrictEqual(document.activeElement, element, 'the namespace input is NOT focused');
+  });
+
+  test('it focuses the input if @shouldRefocusNamespaceInput is true', async function (assert) {
+    this.shouldRefocusNamespaceInput = true;
+    await this.renderComponent();
+    const element = find(GENERAL.inputByAttr('namespace'));
+    assert.strictEqual(document.activeElement, element, 'the namespace input is focused');
+  });
+
+  module('HVD managed', function (hooks) {
+    hooks.beforeEach(function () {
+      this.owner.lookup('service:flags').featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+    });
+
+    test('it sets namespace', async function (assert) {
+      this.namespaceQueryParam = 'admin/west-coast';
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.managedNsRoot).hasValue('/admin');
+      assert.dom(AUTH_FORM.managedNsRoot).hasAttribute('readonly');
+      assert.dom(GENERAL.inputByAttr('namespace')).hasValue('/west-coast');
+    });
+
+    test('it calls onNamespaceUpdate', async function (assert) {
+      assert.expect(2);
+      this.namespaceQueryParam = 'admin';
+      await this.renderComponent();
+
+      assert.dom(GENERAL.inputByAttr('namespace')).hasValue('');
+      await fillIn(GENERAL.inputByAttr('namespace'), 'ns-1');
+      const [actual] = this.handleNamespaceUpdate.lastCall.args;
+      assert.strictEqual(actual, 'ns-1', `handleNamespaceUpdate called with: ${actual}`);
+    });
+  });
+});
diff --git a/ui/tests/integration/components/auth/page/listing-visibility-test.js b/ui/tests/integration/components/auth/page/listing-visibility-test.js
new file mode 100644
index 00000000000..10a005e0276
--- /dev/null
+++ b/ui/tests/integration/components/auth/page/listing-visibility-test.js
@@ -0,0 +1,164 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { click, fillIn, waitFor } from '@ember/test-helpers';
+import { fillInLoginFields, formatAuthMounts } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { module, test } from 'qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { setupRenderingTest } from 'ember-qunit';
+import { setupTotpMfaResponse } from 'vault/tests/helpers/mfa/mfa-helpers';
+import setupTestContext from './setup-test-context';
+import sinon from 'sinon';
+
+module('Integration | Component | auth | page | listing visibility', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    setupTestContext(this);
+    this.api = this.owner.lookup('service:api');
+    this.visibleAuthMounts = formatAuthMounts(this.api);
+    // extra setup for when the "oidc" is selected and the oidc-jwt component renders
+    this.routerStub = sinon.stub(this.owner.lookup('service:router'), 'urlFor').returns('123-example.com');
+  });
+
+  hooks.afterEach(function () {
+    this.routerStub.restore();
+  });
+
+  test('it formats and renders tabs if visible auth mounts exist', async function (assert) {
+    await this.renderComponent();
+    const expectedTabs = [
+      { type: 'userpass', display: 'Userpass' },
+      { type: 'oidc', display: 'OIDC' },
+      { type: 'ldap', display: 'LDAP' },
+    ];
+
+    assert.dom(GENERAL.selectByAttr('auth type')).doesNotExist('dropdown does not render');
+    // there are 4 mount paths returned in visibleAuthMounts above,
+    // but two are of the same type so only expect 3 tabs
+    assert.dom(AUTH_FORM.tabs).exists({ count: 3 }, 'it groups mount paths by type and renders 3 tabs');
+    expectedTabs.forEach((m) => {
+      assert.dom(AUTH_FORM.tabBtn(m.type)).exists(`${m.type} renders as a tab`);
+      assert.dom(AUTH_FORM.tabBtn(m.type)).hasText(m.display, `${m.type} renders expected display name`);
+    });
+    assert
+      .dom(AUTH_FORM.tabBtn('userpass'))
+      .hasAttribute('aria-selected', 'true', 'it selects the first type by default');
+  });
+
+  test('it renders dropdown as alternate view', async function (assert) {
+    await this.renderComponent();
+    assert.dom(AUTH_FORM.tabs).exists({ count: 3 }, 'tabs render by default');
+    assert.dom(GENERAL.backButton).doesNotExist();
+    await click(GENERAL.button('Sign in with other methods'));
+    assert
+      .dom(GENERAL.button('Sign in with other methods'))
+      .doesNotExist('button disappears after it is clicked');
+    assert.dom(GENERAL.selectByAttr('auth type')).hasValue('userpass', 'dropdown has userpass selected');
+    assert.dom(AUTH_FORM.advancedSettings).exists('toggle renders even though userpass has visible mounts');
+    await click(AUTH_FORM.advancedSettings);
+    assert.dom(GENERAL.inputByAttr('path')).exists({ count: 1 });
+    assert.dom(GENERAL.inputByAttr('path')).hasValue('', 'it renders empty custom path input');
+
+    await fillIn(GENERAL.selectByAttr('auth type'), 'oidc');
+    assert.dom(AUTH_FORM.advancedSettings).exists('toggle renders even though oidc has a visible mount');
+    await click(AUTH_FORM.advancedSettings);
+    assert.dom(GENERAL.inputByAttr('path')).exists({ count: 1 });
+    assert.dom(GENERAL.inputByAttr('path')).hasValue('', 'it renders empty custom path input');
+    await click(GENERAL.backButton);
+    assert.dom(GENERAL.backButton).doesNotExist('"Back" button does not render after it is clicked');
+    assert.dom(AUTH_FORM.tabs).exists({ count: 3 }, 'clicking "Back" renders tabs again');
+    assert
+      .dom(GENERAL.button('Sign in with other methods'))
+      .exists('"Sign in with other methods" renders again');
+  });
+
+  test('it renders tabs for types prefixed with "ns_"', async function (assert) {
+    this.visibleAuthMounts = formatAuthMounts(this.api, { 'token/': { type: 'ns_token' } });
+    await this.renderComponent();
+    assert.dom(GENERAL.selectByAttr('auth type')).doesNotExist('dropdown does not render');
+    assert.dom(AUTH_FORM.tabs).exists({ count: 1 }, 'it renders 1 tab');
+    assert.dom(AUTH_FORM.tabBtn('token')).exists(`token renders as a tab`);
+    assert
+      .dom(AUTH_FORM.tabBtn('token'))
+      .hasAttribute('aria-selected', 'true', 'it selects the first type by default');
+  });
+
+  // integration tests for ?with= query param
+  module('with a direct link', function (hooks) {
+    hooks.beforeEach(function () {
+      // if path exists, the mount has listing_visibility="unauth"
+      this.directLinkIsVisibleMount = { path: 'my_oidc/', type: 'oidc' };
+      this.directLinkIsJustType = { type: 'okta' };
+    });
+
+    test('it selects type in the dropdown if direct link is just type', async function (assert) {
+      this.directLinkData = this.directLinkIsJustType;
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.tabBtn('okta')).doesNotExist('tab does not render');
+      assert.dom(GENERAL.selectByAttr('auth type')).hasValue('okta', 'dropdown has type selected');
+      assert.dom(AUTH_FORM.authForm('okta')).exists();
+      assert.dom(GENERAL.inputByAttr('username')).exists();
+      assert.dom(GENERAL.inputByAttr('password')).exists();
+      await click(AUTH_FORM.advancedSettings);
+      assert.dom(GENERAL.inputByAttr('path')).exists({ count: 1 });
+      assert
+        .dom(GENERAL.button('Sign in with other methods'))
+        .doesNotExist('"Sign in with other methods" does not render');
+      assert.dom(GENERAL.backButton).exists('back button renders because tabs exist for other methods');
+      await click(GENERAL.backButton);
+      assert
+        .dom(AUTH_FORM.tabBtn('userpass'))
+        .hasAttribute('aria-selected', 'true', 'first tab is selected on back');
+    });
+
+    test('it renders single method view instead of tabs if direct link includes path', async function (assert) {
+      this.directLinkData = this.directLinkIsVisibleMount;
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.authForm('oidc')).exists;
+      assert.dom(AUTH_FORM.tabBtn('oidc')).hasText('OIDC', 'it renders tab for type');
+      assert.dom(AUTH_FORM.tabs).exists({ count: 1 }, 'only one tab renders');
+      assert.dom(GENERAL.inputByAttr('role')).exists();
+      assert.dom(GENERAL.inputByAttr('path')).hasAttribute('type', 'hidden');
+      assert.dom(GENERAL.inputByAttr('path')).hasValue('my_oidc/');
+      assert.dom(GENERAL.button('Sign in with other methods')).exists('"Sign in with other methods" renders');
+      assert.dom(GENERAL.selectByAttr('auth type')).doesNotExist();
+      assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+      assert.dom(GENERAL.backButton).doesNotExist();
+    });
+
+    test('it prioritizes auth type from canceled mfa instead of direct link for path', async function (assert) {
+      assert.expect(1);
+      this.directLinkData = this.directLinkIsVisibleMount; // type is "oidc"
+      const authType = 'okta'; // set to a type that differs from direct link
+      this.server.post(`/auth/okta/login/matilda`, () => setupTotpMfaResponse(authType));
+      await this.renderComponent();
+      await click(GENERAL.button('Sign in with other methods'));
+      await fillIn(AUTH_FORM.selectMethod, authType);
+      await fillInLoginFields({ username: 'matilda', password: 'password' });
+      await click(GENERAL.submitButton);
+      await waitFor('[data-test-mfa-description]'); // wait until MFA validation renders
+      await click(GENERAL.cancelButton);
+      assert.dom(AUTH_FORM.selectMethod).hasValue(authType, 'Okta is selected in dropdown');
+    });
+
+    test('it prioritizes auth type from canceled mfa instead of direct link with type', async function (assert) {
+      assert.expect(1);
+      this.directLinkData = this.directLinkIsJustType; // type is "okta"
+      const authType = 'userpass'; // set to a type that differs from direct link
+      this.server.post(`/auth/userpass/login/matilda`, () => setupTotpMfaResponse(authType));
+      await this.renderComponent();
+      await fillIn(AUTH_FORM.selectMethod, authType);
+      await fillInLoginFields({ username: 'matilda', password: 'password' });
+      await click(GENERAL.submitButton);
+      await waitFor('[data-test-mfa-description]'); // wait until MFA validation renders
+      await click(GENERAL.cancelButton);
+      assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'true');
+    });
+  });
+});
diff --git a/ui/tests/integration/components/auth/page/login-settings-test.js b/ui/tests/integration/components/auth/page/login-settings-test.js
new file mode 100644
index 00000000000..05cdd5a01e5
--- /dev/null
+++ b/ui/tests/integration/components/auth/page/login-settings-test.js
@@ -0,0 +1,380 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { click } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { formatAuthMounts, SYS_INTERNAL_UI_MOUNTS } from 'vault/tests/helpers/auth/auth-helpers';
+import setupTestContext from './setup-test-context';
+import sinon from 'sinon';
+import AuthMethodResource from 'vault/resources/auth/method';
+
+/* 
+  Login settings are an enterprise only feature but the component is version agnostic (and subsequently so are these tests) 
+  because fetching login settings happens in the route only for enterprise versions.
+  Each combination must be tested with and without visible mounts (i.e. tuned with listing_visibility="unauth")
+  1. default+backups: default type set, backup types set 
+  2. default only: no backup types
+  3. backup only: backup types set without a default
+   */
+module('Integration | Component | auth | page | ent login settings', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    setupTestContext(this);
+    this.loginSettings = {
+      defaultType: 'oidc',
+      backupTypes: ['userpass', 'ldap'],
+    };
+    // extra setup for when the "oidc" is selected and the oidc-jwt component renders
+    this.routerStub = sinon.stub(this.owner.lookup('service:router'), 'urlFor').returns('123-example.com');
+
+    this.assertPathInput = async (assert, { isHidden = false, value = '' } = {}) => {
+      // the path input can render behind the "Advanced settings" toggle or as a hidden input.
+      // Assert it only renders once and is the expected input
+      if (!isHidden) {
+        await click(AUTH_FORM.advancedSettings);
+        assert.dom(GENERAL.inputByAttr('path')).exists('it renders mount path input');
+      }
+      if (isHidden) {
+        assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+        assert.dom(GENERAL.inputByAttr('path')).hasAttribute('type', 'hidden');
+        assert.dom(GENERAL.inputByAttr('path')).hasValue(value);
+      }
+      assert.dom(GENERAL.inputByAttr('path')).exists({ count: 1 });
+    };
+  });
+
+  hooks.afterEach(function () {
+    this.routerStub.restore();
+  });
+
+  test('(default+backups): it initially renders default type and toggles to view backup methods', async function (assert) {
+    await this.renderComponent();
+    assert.dom(AUTH_FORM.tabBtn('oidc')).hasText('OIDC', 'it renders default method');
+    assert.dom(AUTH_FORM.tabs).exists({ count: 1 }, 'only one tab renders');
+    assert.dom(AUTH_FORM.authForm('oidc')).exists();
+    assert.dom(GENERAL.backButton).doesNotExist();
+    await this.assertPathInput(assert);
+    await click(GENERAL.button('Sign in with other methods'));
+    assert.dom(GENERAL.backButton).exists();
+    assert.dom(AUTH_FORM.tabs).exists({ count: 2 }, 'it renders 2 backup type tabs');
+    assert
+      .dom(AUTH_FORM.tabBtn('userpass'))
+      .hasAttribute('aria-selected', 'true', 'it selects the first backup type');
+    await this.assertPathInput(assert);
+    await click(AUTH_FORM.tabBtn('ldap'));
+    assert.dom(AUTH_FORM.tabBtn('ldap')).hasAttribute('aria-selected', 'true', 'it selects ldap tab');
+    await this.assertPathInput(assert);
+  });
+
+  test('(default+backups): it initially renders default type if backup types include the default method', async function (assert) {
+    this.loginSettings = {
+      defaultType: 'userpass',
+      backupTypes: ['ldap', 'userpass', 'oidc'],
+    };
+    await this.renderComponent();
+    assert.dom(GENERAL.backButton).doesNotExist('it renders default view');
+    assert.dom(AUTH_FORM.tabBtn('userpass')).hasText('Userpass', 'it renders default method');
+    assert
+      .dom(AUTH_FORM.tabs)
+      .exists({ count: 1 }, 'it is rendering the default view because only one tab renders');
+    await click(GENERAL.button('Sign in with other methods'));
+    assert.dom(GENERAL.backButton).exists('it toggles to backup method view');
+    assert.dom(AUTH_FORM.tabs).exists({ count: 3 }, 'it renders 3 backup type tabs');
+    assert
+      .dom(AUTH_FORM.tabBtn('ldap'))
+      .hasAttribute('aria-selected', 'true', 'it selects the first backup type');
+  });
+
+  test('(default only): it renders default type without backup methods', async function (assert) {
+    this.loginSettings.backupTypes = null;
+    await this.renderComponent();
+    assert.dom(AUTH_FORM.tabBtn('oidc')).hasText('OIDC', 'it renders default method');
+    assert.dom(AUTH_FORM.tabs).exists({ count: 1 }, 'only one tab renders');
+    assert.dom(GENERAL.backButton).doesNotExist();
+    assert.dom(GENERAL.button('Sign in with other methods')).doesNotExist();
+  });
+
+  test('(backups only): it initially renders backup types if no default is set', async function (assert) {
+    this.loginSettings.defaultType = '';
+    await this.renderComponent();
+    assert.dom(AUTH_FORM.tabBtn('oidc')).doesNotExist();
+    assert.dom(AUTH_FORM.tabs).exists({ count: 2 }, 'it renders 2 backup type tabs');
+    assert
+      .dom(AUTH_FORM.tabBtn('userpass'))
+      .hasAttribute('aria-selected', 'true', 'it selects the first backup type');
+    await this.assertPathInput(assert);
+    assert.dom(GENERAL.backButton).doesNotExist();
+    assert.dom(GENERAL.button('Sign in with other methods')).doesNotExist();
+  });
+
+  module('all methods have visible mounts', function (hooks) {
+    hooks.beforeEach(function () {
+      this.loginSettings = {
+        defaultType: 'oidc',
+        backupTypes: ['userpass', 'ldap'],
+      };
+      this.visibleAuthMounts = formatAuthMounts(this.api);
+    });
+
+    test('(default+backups): it hides advanced settings for both views', async function (assert) {
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.tabBtn('oidc')).hasText('OIDC', 'it renders default method');
+      assert.dom(AUTH_FORM.tabs).exists({ count: 1 }, 'only one tab renders');
+      this.assertPathInput(assert, { isHidden: true, value: 'my_oidc/' });
+      await click(GENERAL.button('Sign in with other methods'));
+      assert.dom(AUTH_FORM.tabs).exists({ count: 2 }, 'it renders 2 backup type tabs');
+      assert
+        .dom(AUTH_FORM.tabBtn('userpass'))
+        .hasAttribute('aria-selected', 'true', 'it selects the first backup type');
+      assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+      assert.dom(GENERAL.inputByAttr('path')).doesNotExist();
+      assert.dom(GENERAL.selectByAttr('path')).exists(); // dropdown renders because userpass has 2 mount paths
+      await click(AUTH_FORM.tabBtn('ldap'));
+      this.assertPathInput(assert, { isHidden: true, value: 'ldap/' });
+    });
+
+    test('(default only): it hides advanced settings and renders hidden input', async function (assert) {
+      this.loginSettings.backupTypes = null;
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.tabBtn('oidc')).hasText('OIDC', 'it renders default method');
+      assert.dom(AUTH_FORM.tabs).exists({ count: 1 }, 'only one tab renders');
+      assert.dom(AUTH_FORM.authForm('oidc')).exists();
+      this.assertPathInput(assert, { isHidden: true, value: 'my_oidc/' });
+      assert.dom(GENERAL.backButton).doesNotExist();
+      assert.dom(GENERAL.button('Sign in with other methods')).doesNotExist();
+    });
+
+    test('(backups only): it hides advanced settings and renders hidden input', async function (assert) {
+      this.loginSettings.defaultType = '';
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.tabs).exists({ count: 2 }, 'it renders 2 backup type tabs');
+      assert
+        .dom(AUTH_FORM.tabBtn('userpass'))
+        .hasAttribute('aria-selected', 'true', 'it selects the first backup type');
+      assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+      assert.dom(GENERAL.backButton).doesNotExist();
+      assert.dom(GENERAL.button('Sign in with other methods')).doesNotExist();
+    });
+  });
+
+  module('only some methods have visible mounts', function (hooks) {
+    hooks.beforeEach(function () {
+      this.loginSettings = {
+        defaultType: 'oidc',
+        backupTypes: ['userpass', 'ldap'],
+      };
+      this.setVisibleMounts = (...paths) => {
+        // Builds an object in the shape of SYS_INTERNAL_UI_MOUNTS response with only the provided ...paths
+        const mounts = Object.fromEntries(
+          paths
+            .filter((path) => SYS_INTERNAL_UI_MOUNTS[path])
+            .map((path) => [path, SYS_INTERNAL_UI_MOUNTS[path]])
+        );
+        // Format stubbed response the same way the auth route does
+        return formatAuthMounts(this.api, mounts);
+      };
+    });
+
+    test('(default+backups): it hides advanced settings for default with visible mount but it renders for backups', async function (assert) {
+      this.visibleAuthMounts = this.setVisibleMounts('my_oidc/');
+      await this.renderComponent();
+      this.assertPathInput(assert, { isHidden: true, value: 'my_oidc/' });
+      await click(GENERAL.button('Sign in with other methods'));
+      assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'true');
+      await this.assertPathInput(assert);
+      await click(AUTH_FORM.tabBtn('ldap'));
+      await this.assertPathInput(assert);
+    });
+
+    test('(default+backups): it only renders advanced settings for method without mounts', async function (assert) {
+      // default and only one backup method have visible mounts
+      this.visibleAuthMounts = this.setVisibleMounts('my_oidc/', 'userpass/', 'userpass2/');
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+      await click(GENERAL.button('Sign in with other methods'));
+      assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'true');
+      assert.dom(GENERAL.selectByAttr('path')).exists();
+      assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+      await click(AUTH_FORM.tabBtn('ldap'));
+      assert.dom(AUTH_FORM.advancedSettings).exists();
+    });
+
+    test('(default+backups): it hides advanced settings for single backup method with mounts', async function (assert) {
+      this.visibleAuthMounts = this.setVisibleMounts('ldap/');
+
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.authForm('oidc')).exists();
+      assert.dom(AUTH_FORM.advancedSettings).exists();
+      await click(GENERAL.button('Sign in with other methods'));
+      assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'true');
+      assert.dom(AUTH_FORM.advancedSettings).exists();
+      await click(AUTH_FORM.tabBtn('ldap'));
+      this.assertPathInput(assert, { isHidden: true, value: 'ldap/' });
+    });
+
+    test('(backups only): it hides advanced settings for single method with mounts', async function (assert) {
+      this.loginSettings.defaultType = '';
+      this.visibleAuthMounts = this.setVisibleMounts('ldap/');
+      await this.renderComponent();
+      assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'true');
+      assert.dom(AUTH_FORM.advancedSettings).exists();
+      await click(AUTH_FORM.tabBtn('ldap'));
+      this.assertPathInput(assert, { isHidden: true, value: 'ldap/' });
+    });
+  });
+
+  module('@directLinkData overrides login settings', function (hooks) {
+    hooks.beforeEach(function () {
+      this.mountData = formatAuthMounts(this.api);
+    });
+
+    module('when there are no visible mounts at all', function (hooks) {
+      hooks.beforeEach(function () {
+        this.visibleAuthMounts = null;
+        this.directLinkData = { type: 'okta' };
+      });
+
+      const testHelper = (assert) => {
+        assert.dom(AUTH_FORM.selectMethod).hasValue('okta');
+        assert.dom(AUTH_FORM.authForm('okta')).exists();
+        assert.dom(GENERAL.button('Sign in with other methods')).doesNotExist();
+        assert.dom(GENERAL.backButton).doesNotExist();
+      };
+
+      test('(default+backups): it renders standard view and selects @directLinkData type from dropdown', async function (assert) {
+        await this.renderComponent();
+        testHelper(assert);
+      });
+
+      test('(default only): it renders standard view and selects @directLinkData type from dropdown', async function (assert) {
+        this.loginSettings.backupTypes = null;
+        await this.renderComponent();
+        testHelper(assert);
+      });
+
+      test('(backups only): it renders standard view and selects @directLinkData type from dropdown', async function (assert) {
+        this.loginSettings.defaultType = '';
+        await this.renderComponent();
+        testHelper(assert);
+      });
+    });
+
+    module('when param matches a visible mount path and other visible mounts exist', function (hooks) {
+      hooks.beforeEach(function () {
+        this.visibleAuthMounts = [
+          ...this.mountData,
+          new AuthMethodResource({ path: 'my-okta/', type: 'okta' }),
+        ];
+        this.directLinkData = { path: 'my-okta/', type: 'okta' };
+      });
+
+      const testHelper = async (assert) => {
+        assert.dom(AUTH_FORM.tabBtn('okta')).hasText('Okta', 'it renders preferred method');
+        assert.dom(AUTH_FORM.tabs).exists({ count: 1 }, 'only one tab renders');
+        assert.dom(AUTH_FORM.authForm('okta'));
+        assert.dom(AUTH_FORM.advancedSettings).doesNotExist();
+        assert.dom(GENERAL.inputByAttr('path')).hasAttribute('type', 'hidden');
+        assert.dom(GENERAL.inputByAttr('path')).hasValue('my-okta/');
+        assert.dom(GENERAL.inputByAttr('path')).exists({ count: 1 });
+        await click(GENERAL.button('Sign in with other methods'));
+        assert
+          .dom(GENERAL.selectByAttr('auth type'))
+          .exists('it renders dropdown after clicking "Sign in with other"');
+      };
+
+      test('(default+backups): it renders single mount view for @directLinkData', async function (assert) {
+        await this.renderComponent();
+        await testHelper(assert);
+      });
+
+      test('(default only): it renders single mount view for @directLinkData', async function (assert) {
+        this.loginSettings.backupTypes = null;
+        await this.renderComponent();
+        await testHelper(assert);
+      });
+
+      test('(backups only): it renders single mount view for @directLinkData', async function (assert) {
+        this.loginSettings.defaultType = '';
+        await this.renderComponent();
+        await testHelper(assert);
+      });
+    });
+
+    module('when param matches a type and other visible mounts exist', function (hooks) {
+      hooks.beforeEach(function () {
+        // only type is present in directLinkData because the query param does not match a path with listing_visibility="unauth"
+        this.directLinkData = { type: 'okta' };
+        this.visibleAuthMounts = this.mountData;
+      });
+
+      const testHelper = async (assert) => {
+        assert.dom(GENERAL.backButton).exists('back button renders because other methods have tabs');
+        assert.dom(AUTH_FORM.selectMethod).hasValue('okta');
+        assert.dom(AUTH_FORM.authForm('okta')).exists();
+        assert.dom(GENERAL.button('Sign in with other methods')).doesNotExist();
+        await click(GENERAL.backButton);
+        assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'true');
+        await click(GENERAL.button('Sign in with other methods'));
+        assert.dom(AUTH_FORM.selectMethod).exists('it toggles back to dropdown');
+      };
+
+      test('(default+backups): it selects @directLinkData type from dropdown and toggles to tab view', async function (assert) {
+        await this.renderComponent();
+        await testHelper(assert);
+      });
+
+      test('(default only): it selects @directLinkData type from dropdown and toggles to tab view', async function (assert) {
+        this.loginSettings.backupTypes = null;
+        await this.renderComponent();
+        await testHelper(assert);
+      });
+
+      test('(backups only): it selects @directLinkData type from dropdown and toggles to tab view', async function (assert) {
+        this.loginSettings.defaultType = '';
+        await this.renderComponent();
+        await testHelper(assert);
+      });
+    });
+
+    module('when param matches a type that matches other visible mounts', function (hooks) {
+      hooks.beforeEach(function () {
+        // only type exists because the query param does not match a path with listing_visibility="unauth"
+        this.directLinkData = { type: 'oidc' };
+        this.visibleAuthMounts = this.mountData;
+      });
+
+      const testHelper = async (assert) => {
+        assert.dom(AUTH_FORM.tabBtn('oidc')).hasAttribute('aria-selected', 'true');
+        assert.dom(AUTH_FORM.authForm('oidc')).exists();
+        assert.dom(GENERAL.backButton).doesNotExist();
+        await click(GENERAL.button('Sign in with other methods'));
+        assert.dom(AUTH_FORM.selectMethod).exists('it toggles to view dropdown');
+        await click(GENERAL.backButton);
+        assert.dom(AUTH_FORM.tabs).exists('it toggles back to tabs');
+      };
+
+      test('(default+backups): it selects @directLinkData type tab and toggles to dropdown view', async function (assert) {
+        await this.renderComponent();
+        await testHelper(assert);
+      });
+
+      test('(default only): it selects @directLinkData type tab and toggles to dropdown view', async function (assert) {
+        this.loginSettings.backupTypes = null;
+        await this.renderComponent();
+        await testHelper(assert);
+      });
+
+      test('(backups only): it selects @directLinkData type tab and toggles to dropdown view', async function (assert) {
+        this.loginSettings.defaultType = '';
+        await this.renderComponent();
+        await testHelper(assert);
+      });
+    });
+  });
+});
diff --git a/ui/tests/integration/components/auth/page/method-authentication-test.js b/ui/tests/integration/components/auth/page/method-authentication-test.js
new file mode 100644
index 00000000000..5617bfa00a7
--- /dev/null
+++ b/ui/tests/integration/components/auth/page/method-authentication-test.js
@@ -0,0 +1,311 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { click, fillIn, waitUntil } from '@ember/test-helpers';
+import { ERROR_JWT_LOGIN } from 'vault/utils/auth-form-helpers';
+import { fillInLoginFields } from 'vault/tests/helpers/auth/auth-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { module, test } from 'qunit';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { RESPONSE_STUBS, TOKEN_DATA } from 'vault/tests/helpers/auth/response-stubs';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { setupRenderingTest } from 'ember-qunit';
+import { triggerMessageEvent, windowStub } from 'vault/tests/helpers/oidc-window-stub';
+import setupTestContext from './setup-test-context';
+import sinon from 'sinon';
+
+const methodAuthenticationTests = (test) => {
+  test('it sets token data on login for default path', async function (assert) {
+    const count = this.assertTokenLookup ? 6 : 5;
+    assert.expect(count);
+    // Setup
+    this.stubRequests();
+    if (this.assertTokenLookup) {
+      this.assertTokenLookup(assert);
+    }
+
+    // Render and log in
+    await this.renderComponent();
+    await fillIn(AUTH_FORM.selectMethod, this.authType);
+    await fillInLoginFields(this.loginData);
+    if (this.authType === 'oidc') {
+      triggerMessageEvent(this.path);
+    }
+    await click(GENERAL.submitButton);
+    await waitUntil(() => this.setTokenDataSpy.calledOnce);
+    const [tokenName, persistedTokenData] = this.setTokenDataSpy.lastCall.args;
+
+    const expectedData = {
+      ...TOKEN_DATA[this.authType],
+      // there are other tests that confirm this calculation happens as expected, just copy value from spy
+      tokenExpirationEpoch: persistedTokenData.tokenExpirationEpoch,
+    };
+
+    assert.strictEqual(tokenName, this.tokenName, 'setTokenData is called with expected token name');
+    assert.propEqual(persistedTokenData, expectedData, 'setTokenData is called with expected data');
+
+    // propEqual failures are challenging to parse in CI so pulling out a couple of important attrs
+    const { token, displayName, entity_id } = expectedData;
+    assert.strictEqual(persistedTokenData.token, token, 'setTokenData has expected token');
+    assert.strictEqual(persistedTokenData.displayName, displayName, 'setTokenData has expected display name');
+    assert.strictEqual(persistedTokenData.entity_id, entity_id, 'setTokenData has expected entity_id');
+  });
+
+  test('it calls loginAndTransition on submit for custom path', async function (assert) {
+    assert.expect(1);
+    // Setup
+    this.path = `${this.authType}-custom`;
+    this.loginData = { ...this.loginData, path: this.path };
+    this.stubRequests();
+    // Render and log in
+    await this.renderComponent();
+    await fillIn(AUTH_FORM.selectMethod, this.authType);
+    // toggle mount path input to specify custom path
+    await fillInLoginFields(this.loginData, { toggleOptions: true });
+    if (this.authType === 'oidc') {
+      triggerMessageEvent(this.path);
+    }
+    await click(GENERAL.submitButton);
+
+    await waitUntil(() => this.loginAndTransition.perform.calledOnce);
+    const [actual] = this.loginAndTransition.perform.lastCall.args;
+    const expected = { namespace: '', token: this.tokenName, isRoot: false };
+    assert.propEqual(actual, expected, `loginAndTransition task called with: ${JSON.stringify(actual)}`);
+  });
+};
+
+module('Integration | Component | auth | page | method authentication', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    setupTestContext(this);
+    this.auth = this.owner.lookup('service:auth');
+    this.setTokenDataSpy = sinon.spy(this.auth, 'setTokenData');
+  });
+
+  hooks.afterEach(function () {
+    window.localStorage.clear();
+  });
+
+  module('github', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'github';
+      this.loginData = { token: 'mysupersecuretoken' };
+      this.path = this.authType;
+      this.response = RESPONSE_STUBS.github;
+      this.tokenName = 'vault-github☃1';
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/login`, () => this.response);
+      };
+    });
+
+    methodAuthenticationTests(test);
+  });
+
+  module('jwt', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'jwt';
+      this.loginData = { role: 'some-dev', jwt: 'jwttoken' };
+      this.path = this.authType;
+      this.response = RESPONSE_STUBS.jwt.login;
+      this.tokenName = 'vault-jwt☃1';
+      this.routerStub = sinon.stub(this.owner.lookup('service:router'), 'urlFor').returns('123-example.com');
+      // Requests are stubbed in the order they are hit
+      this.stubRequests = () => {
+        // passing a dynamic path so that even the OIDC form renders the JWT token input
+        // (there is test coverage elsewhere to assert switching between methods updates the form)
+        this.server.post('/auth/:path/oidc/auth_url', () =>
+          overrideResponse(400, { errors: [ERROR_JWT_LOGIN] })
+        );
+        this.server.post(`/auth/${this.path}/login`, () => this.response);
+      };
+      this.assertTokenLookup = (assert) => {
+        this.server.get(`/auth/token/lookup-self`, () => {
+          assert.true(true, 'request made to auth/token/lookup-self after jwt login');
+          return RESPONSE_STUBS.jwt['lookup-self'];
+        });
+      };
+    });
+
+    hooks.afterEach(function () {
+      this.routerStub.restore();
+    });
+
+    methodAuthenticationTests(test);
+  });
+
+  module('ldap', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'ldap';
+      this.loginData = { username: 'matilda', password: 'password' };
+      this.path = this.authType;
+      this.response = RESPONSE_STUBS.ldap;
+      this.tokenName = 'vault-ldap☃1';
+
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/login/${this.loginData.username}`, () => this.response);
+      };
+    });
+
+    methodAuthenticationTests(test);
+  });
+
+  module('oidc', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'oidc';
+      this.loginData = { role: 'some-dev' };
+      this.path = this.authType;
+      this.response = RESPONSE_STUBS.oidc['oidc/callback'];
+      this.tokenName = 'vault-oidc☃1';
+      // Requests are stubbed in the order they are hit
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/oidc/auth_url`, () => {
+          return { data: { auth_url: 'http://dev-foo-bar.com' } };
+        });
+        this.server.get(`/auth/${this.path}/oidc/callback`, () => this.response);
+      };
+      this.assertTokenLookup = (assert) => {
+        this.server.get(`/auth/token/lookup-self`, () => {
+          // there was a bug that would result in the /auth/:path/login endpoint hit with an empty payload rather than lookup-self
+          // ensure that the correct endpoint is hit after the oidc callback
+          assert.true(true, 'request made to auth/token/lookup-self after oidc callback');
+          return RESPONSE_STUBS.oidc['lookup-self'];
+        });
+      };
+
+      // additional OIDC setup
+      this.routerStub = sinon.stub(this.owner.lookup('service:router'), 'urlFor').returns('123-example.com');
+      this.windowStub = windowStub();
+    });
+
+    hooks.afterEach(function () {
+      this.routerStub.restore();
+      this.windowStub.restore();
+    });
+
+    methodAuthenticationTests(test);
+  });
+
+  module('okta', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'okta';
+      this.loginData = { username: 'matilda', password: 'password' };
+      this.path = this.authType;
+      this.response = RESPONSE_STUBS.okta;
+      this.tokenName = 'vault-okta☃1';
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/login/${this.loginData.username}`, () => this.response);
+      };
+    });
+
+    methodAuthenticationTests(test);
+  });
+
+  module('radius', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'radius';
+      this.loginData = { username: 'matilda', password: 'password' };
+      this.path = this.authType;
+      this.response = RESPONSE_STUBS.radius;
+      this.tokenName = 'vault-radius☃1';
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/login/${this.loginData.username}`, () => this.response);
+      };
+    });
+
+    methodAuthenticationTests(test);
+  });
+
+  module('token', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'token';
+      this.tokenName = 'vault-token☃1';
+      this.server.get('/auth/token/lookup-self', () => RESPONSE_STUBS.token);
+    });
+
+    test('it sets token data and calls loginAndTransition', async function (assert) {
+      assert.expect(6);
+      await this.renderComponent();
+      await fillIn(AUTH_FORM.selectMethod, this.authType);
+      await fillInLoginFields({ token: 'mysupersecuretoken' });
+      await click(GENERAL.submitButton);
+      await waitUntil(() => this.loginAndTransition.perform.calledOnce);
+      const [actual] = this.loginAndTransition.perform.lastCall.args;
+      const expected = { namespace: '', token: this.tokenName, isRoot: false };
+      assert.propEqual(actual, expected, `loginAndTransition task called with: ${JSON.stringify(actual)}`);
+
+      const [tokenName, persistedTokenData] = this.setTokenDataSpy.lastCall.args;
+      const expectedTokenData = {
+        ...TOKEN_DATA[this.authType],
+        // there are other tests that confirm this calculation happens as expected, just copy value from spy
+        tokenExpirationEpoch: persistedTokenData.tokenExpirationEpoch,
+      };
+      assert.strictEqual(tokenName, this.tokenName, 'setTokenData is called with expected token name');
+      assert.propEqual(persistedTokenData, expectedTokenData, 'setTokenData is called with expected data');
+
+      // propEqual failures are challenging to parse in CI so pulling out a couple of important attrs
+      const { token, displayName, entity_id } = expectedTokenData;
+      assert.strictEqual(persistedTokenData.token, token, 'setTokenData has expected token');
+      assert.strictEqual(
+        persistedTokenData.displayName,
+        displayName,
+        'setTokenData has expected display name'
+      );
+      assert.strictEqual(persistedTokenData.entity_id, entity_id, 'setTokenData has expected entity_id');
+    });
+  });
+
+  module('userpass', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'userpass';
+      this.loginData = { username: 'matilda', password: 'password' };
+      this.path = this.authType;
+      this.response = RESPONSE_STUBS.userpass;
+      this.tokenName = 'vault-userpass☃1';
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/login/${this.loginData.username}`, () => this.response);
+      };
+    });
+
+    methodAuthenticationTests(test);
+  });
+
+  // ENTERPRISE METHODS
+  module('saml', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.version.type = 'enterprise';
+      this.authType = 'saml';
+      this.path = this.authType;
+      this.loginData = { role: 'some-dev' };
+      this.response = RESPONSE_STUBS.saml['saml/token'];
+      this.tokenName = 'vault-saml☃1';
+      // Requests are stubbed in the order they are hit
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/sso_service_url`, () => ({
+          data: {
+            sso_service_url: 'test/fake/sso/route',
+            token_poll_id: '1234',
+          },
+        }));
+        this.server.post(`/auth/${this.path}/token`, () => this.response);
+      };
+      this.assertTokenLookup = (assert) => {
+        this.server.get(`/auth/token/lookup-self`, () => {
+          assert.true(true, 'request made to auth/token/lookup-self after saml token exchange and login');
+          return RESPONSE_STUBS.saml['lookup-self'];
+        });
+      };
+      this.windowStub = windowStub();
+    });
+
+    hooks.afterEach(function () {
+      this.windowStub.restore();
+    });
+
+    methodAuthenticationTests(test);
+  });
+});
diff --git a/ui/tests/integration/components/auth/page/mfa-test.js b/ui/tests/integration/components/auth/page/mfa-test.js
new file mode 100644
index 00000000000..61263a4f669
--- /dev/null
+++ b/ui/tests/integration/components/auth/page/mfa-test.js
@@ -0,0 +1,275 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { constraintId, setupTotpMfaResponse } from 'vault/tests/helpers/mfa/mfa-helpers';
+import setupTestContext from './setup-test-context';
+import { ERROR_JWT_LOGIN } from 'vault/utils/auth-form-helpers';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import sinon from 'sinon';
+import { triggerMessageEvent, windowStub } from 'vault/tests/helpers/oidc-window-stub';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { MFA_SELECTORS } from 'vault/tests/helpers/mfa/mfa-selectors';
+import { fillInLoginFields } from 'vault/tests/helpers/auth/auth-helpers';
+import { click, fillIn, waitFor } from '@ember/test-helpers';
+
+const mfaTests = (test) => {
+  test('it displays mfa requirement for default paths', async function (assert) {
+    const loginKeys = Object.keys(this.loginData);
+    assert.expect(5 + loginKeys.length);
+    this.stubRequests();
+    await this.renderComponent();
+
+    // Fill in login form
+    await fillIn(AUTH_FORM.selectMethod, this.authType);
+    await fillInLoginFields(this.loginData);
+
+    if (this.authType === 'oidc') {
+      // fires "message" event which methods that rely on popup windows wait for
+      // pass mount path which is used to set :mount param in the callback url => /auth/:mount/oidc/callback
+      triggerMessageEvent(this.path);
+    }
+
+    await click(GENERAL.submitButton);
+    await waitFor(MFA_SELECTORS.mfaForm);
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(MFA_SELECTORS.subheader).hasText('Multi-factor authentication is enabled for your account.');
+    assert.dom(MFA_SELECTORS.description).hasText('Enter your authentication code to log in.');
+    await click(GENERAL.cancelButton);
+    assert.dom(AUTH_FORM.form).exists('clicking back returns to auth form');
+    assert.dom(AUTH_FORM.selectMethod).hasValue(this.authType, 'preserves method type on back');
+    for (const field of loginKeys) {
+      assert.dom(GENERAL.inputByAttr(field)).hasValue('', `${field} input clears on back`);
+    }
+  });
+
+  test('it displays mfa requirement for custom paths', async function (assert) {
+    this.path = `${this.authType}-custom`;
+    const loginKeys = Object.keys(this.loginData);
+    assert.expect(5 + loginKeys.length);
+    this.stubRequests();
+    await this.renderComponent();
+
+    // Fill in login form
+    await fillIn(AUTH_FORM.selectMethod, this.authType);
+    // Toggle more options to input a custom mount path
+    await fillInLoginFields({ ...this.loginData, path: this.path }, { toggleOptions: true });
+
+    if (this.authType === 'oidc') {
+      // fires "message" event which methods that rely on popup windows wait for
+      triggerMessageEvent(this.path);
+    }
+
+    await click(GENERAL.submitButton);
+    await waitFor(MFA_SELECTORS.mfaForm);
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(MFA_SELECTORS.subheader).hasText('Multi-factor authentication is enabled for your account.');
+    assert.dom(MFA_SELECTORS.description).hasText('Enter your authentication code to log in.');
+    await click(GENERAL.cancelButton);
+    assert.dom(AUTH_FORM.form).exists('clicking back returns to auth form');
+    assert.dom(AUTH_FORM.selectMethod).hasValue(this.authType, 'preserves method type on back');
+    for (const field of loginKeys) {
+      assert.dom(GENERAL.inputByAttr(field)).hasValue('', `${field} input clears on back`);
+    }
+  });
+
+  test('it submits mfa requirement for default paths', async function (assert) {
+    assert.expect(2);
+    this.stubRequests();
+    await this.renderComponent();
+
+    const expectedOtp = '12345';
+    this.server.post('/sys/mfa/validate', async (_, req) => {
+      const [actualOtp] = JSON.parse(req.requestBody).mfa_payload[constraintId];
+      assert.true(true, 'it makes request to mfa validate endpoint');
+      assert.strictEqual(actualOtp, expectedOtp, 'payload contains otp');
+    });
+
+    // Fill in login form
+    await fillIn(AUTH_FORM.selectMethod, this.authType);
+    await fillInLoginFields(this.loginData);
+
+    if (this.authType === 'oidc') {
+      // fires "message" event which methods that rely on popup windows wait for
+      triggerMessageEvent(this.path);
+    }
+
+    await click(GENERAL.submitButton);
+    await waitFor(MFA_SELECTORS.mfaForm);
+    await fillIn(MFA_SELECTORS.passcode(0), expectedOtp);
+    await click(GENERAL.button('Verify'));
+  });
+
+  test('it submits mfa requirement for custom paths', async function (assert) {
+    assert.expect(2);
+    this.path = `${this.authType}-custom`;
+    this.stubRequests();
+    await this.renderComponent();
+
+    const expectedOtp = '12345';
+    this.server.post('/sys/mfa/validate', async (_, req) => {
+      const [actualOtp] = JSON.parse(req.requestBody).mfa_payload[constraintId];
+      assert.true(true, 'it makes request to mfa validate endpoint');
+      assert.strictEqual(actualOtp, expectedOtp, 'payload contains otp');
+    });
+
+    // Fill in login form
+    await fillIn(AUTH_FORM.selectMethod, this.authType);
+    // Toggle more options to input a custom mount path
+    await fillInLoginFields({ ...this.loginData, path: this.path }, { toggleOptions: true });
+
+    if (this.authType === 'oidc') {
+      triggerMessageEvent(this.path);
+    }
+
+    await click(GENERAL.submitButton);
+    await waitFor(MFA_SELECTORS.mfaForm);
+    await fillIn(MFA_SELECTORS.passcode(0), expectedOtp);
+    await click(GENERAL.button('Verify'));
+  });
+};
+
+module('Integration | Component | auth | page | mfa', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    setupTestContext(this);
+    // additional setup for oidc-jwt component
+    this.routerStub = sinon.stub(this.owner.lookup('service:router'), 'urlFor').returns('123-example.com');
+  });
+
+  hooks.afterEach(function () {
+    this.routerStub.restore();
+  });
+
+  module('github', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'github';
+      this.loginData = { token: 'mysupersecuretoken' };
+      this.path = this.authType;
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/login`, () => setupTotpMfaResponse(this.path));
+      };
+    });
+
+    mfaTests(test);
+  });
+
+  module('jwt', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'jwt';
+      this.loginData = { role: 'some-dev', jwt: 'jwttoken' };
+      this.path = this.authType;
+
+      this.stubRequests = () => {
+        this.server.post('/auth/:path/oidc/auth_url', () =>
+          overrideResponse(400, { errors: [ERROR_JWT_LOGIN] })
+        );
+        this.server.post(`/auth/${this.path}/login`, () => setupTotpMfaResponse(this.path));
+      };
+    });
+
+    mfaTests(test);
+  });
+
+  module('oidc', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.authType = 'oidc';
+      this.loginData = { role: 'some-dev' };
+      this.path = this.authType;
+      // Requests are stubbed in the order they are hit
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/oidc/auth_url`, () => {
+          return { data: { auth_url: 'http://dev-foo-bar.com' } };
+        });
+        this.server.get(`/auth/${this.path}/oidc/callback`, () => setupTotpMfaResponse(this.path));
+      };
+
+      this.windowStub = windowStub();
+    });
+
+    hooks.afterEach(function () {
+      this.windowStub.restore();
+    });
+
+    mfaTests(test);
+  });
+
+  module('username and password methods', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.loginData = { username: 'matilda', password: 'password' };
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/login/matilda`, () => setupTotpMfaResponse(this.path));
+      };
+    });
+
+    module('ldap', function (hooks) {
+      hooks.beforeEach(async function () {
+        this.authType = 'ldap';
+        this.path = this.authType;
+      });
+
+      mfaTests(test);
+    });
+
+    module('okta', function (hooks) {
+      hooks.beforeEach(async function () {
+        this.authType = 'okta';
+        this.path = this.authType;
+      });
+
+      mfaTests(test);
+    });
+
+    module('radius', function (hooks) {
+      hooks.beforeEach(async function () {
+        this.authType = 'radius';
+        this.path = this.authType;
+      });
+
+      mfaTests(test);
+    });
+
+    module('userpass', function (hooks) {
+      hooks.beforeEach(async function () {
+        this.authType = 'userpass';
+        this.path = this.authType;
+      });
+
+      mfaTests(test);
+    });
+  });
+
+  // ENTERPRISE METHODS
+  module('saml', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.version.type = 'enterprise';
+      this.authType = 'saml';
+      this.path = this.authType;
+      this.loginData = { role: 'some-dev' };
+      // Requests are stubbed in the order they are hit
+      this.stubRequests = () => {
+        this.server.post(`/auth/${this.path}/sso_service_url`, () => ({
+          data: {
+            sso_service_url: 'test/fake/sso/route',
+            token_poll_id: '1234',
+          },
+        }));
+        this.server.post(`/auth/${this.path}/token`, () => setupTotpMfaResponse(this.authType));
+      };
+      this.windowStub = windowStub();
+    });
+
+    hooks.afterEach(function () {
+      this.windowStub.restore();
+    });
+
+    mfaTests(test);
+  });
+});
diff --git a/ui/tests/integration/components/auth/page/page-test.js b/ui/tests/integration/components/auth/page/page-test.js
new file mode 100644
index 00000000000..8bf984e7088
--- /dev/null
+++ b/ui/tests/integration/components/auth/page/page-test.js
@@ -0,0 +1,97 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { click, fillIn, waitFor } from '@ember/test-helpers';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CSP_ERROR } from 'vault/components/auth/page';
+import setupTestContext from './setup-test-context';
+import sinon from 'sinon';
+
+/*
+The AuthPage parents much of the authentication workflow and so it can be used to test lots of auth functionality.
+This file tests the base component functionality. The other files test method authentication, listing visibility, 
+login settings (enterprise feature), and mfa.
+*/
+module('Integration | Component | auth | page', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    setupTestContext(this);
+  });
+
+  test('it renders error on CSP violation', async function (assert) {
+    assert.expect(2);
+    this.cluster.standby = true;
+    await this.renderComponent();
+    assert.dom(GENERAL.pageError.error).doesNotExist();
+    this.owner.lookup('service:csp-event').handleEvent({ violatedDirective: 'connect-src' });
+    await waitFor(GENERAL.pageError.error);
+    assert.dom(GENERAL.pageError.error).hasText(CSP_ERROR);
+  });
+
+  test('it renders splash logo and disables namespace input when oidc provider query param is present', async function (assert) {
+    this.oidcProviderQueryParam = 'myprovider';
+    this.version.features = ['Namespaces'];
+    await this.renderComponent();
+    assert.dom(AUTH_FORM.logo).exists();
+    assert.dom(GENERAL.inputByAttr('namespace')).isDisabled();
+    assert
+      .dom(AUTH_FORM.helpText)
+      .hasText(
+        'Once you log in, you will be redirected back to your application. If you require login credentials, contact your administrator.'
+      );
+  });
+
+  test('it calls onNamespaceUpdate', async function (assert) {
+    assert.expect(1);
+    this.version.features = ['Namespaces'];
+    await this.renderComponent();
+    await fillIn(GENERAL.inputByAttr('namespace'), 'mynamespace');
+    const [actual] = this.onNamespaceUpdate.lastCall.args;
+    assert.strictEqual(actual, 'mynamespace', `onNamespaceUpdate called with: ${actual}`);
+  });
+
+  test('it passes query param to namespace input', async function (assert) {
+    this.version.features = ['Namespaces'];
+    this.namespaceQueryParam = 'ns-1';
+    await this.renderComponent();
+    assert.dom(GENERAL.inputByAttr('namespace')).hasValue(this.namespaceQueryParam);
+  });
+
+  test('it does not render the namespace input on community', async function (assert) {
+    this.version.type = 'community';
+    this.version.features = [];
+    await this.renderComponent();
+    assert.dom(GENERAL.inputByAttr('namespace')).doesNotExist();
+  });
+
+  test('it does not render the namespace input on enterprise without the "Namespaces" feature', async function (assert) {
+    this.version.type = 'enterprise';
+    this.version.features = [];
+    await this.renderComponent();
+    assert.dom(GENERAL.inputByAttr('namespace')).doesNotExist();
+  });
+
+  test('it selects type in the dropdown if direct link just has type', async function (assert) {
+    const stub = sinon.stub(this.owner.lookup('service:router'), 'urlFor').returns('123-example.com');
+
+    this.directLinkData = { type: 'oidc' };
+    await this.renderComponent();
+    assert.dom(AUTH_FORM.tabBtn('oidc')).doesNotExist('tab does not render');
+    assert.dom(GENERAL.selectByAttr('auth type')).hasValue('oidc', 'dropdown has type selected');
+    assert.dom(AUTH_FORM.authForm('oidc')).exists();
+    assert.dom(GENERAL.inputByAttr('role')).exists();
+    await click(AUTH_FORM.advancedSettings);
+    assert.dom(GENERAL.inputByAttr('path')).exists({ count: 1 });
+    assert.dom(GENERAL.backButton).doesNotExist();
+    assert
+      .dom(GENERAL.button('Sign in with other methods'))
+      .doesNotExist('"Sign in with other methods" does not render');
+    stub.restore();
+  });
+});
diff --git a/ui/tests/integration/components/auth/page/setup-test-context.js b/ui/tests/integration/components/auth/page/setup-test-context.js
new file mode 100644
index 00000000000..d2ad0313694
--- /dev/null
+++ b/ui/tests/integration/components/auth/page/setup-test-context.js
@@ -0,0 +1,35 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { render } from '@ember/test-helpers';
+import hbs from 'htmlbars-inline-precompile';
+import sinon from 'sinon';
+
+export default (context) => {
+  context.version = context.owner.lookup('service:version');
+  context.api = context.owner.lookup('service:api');
+  context.cluster = { id: '1' };
+  context.directLinkData = null;
+  context.loginSettings = null;
+  context.namespaceQueryParam = '';
+  context.oidcProviderQueryParam = '';
+  // mocking as an object with the `perform()` method because loginAndTransition is a concurrency task
+  context.loginAndTransition = { perform: sinon.spy() };
+  context.onNamespaceUpdate = sinon.spy();
+  context.visibleAuthMounts = null;
+
+  context.renderComponent = () => {
+    return render(hbs`<Auth::Page
+  @cluster={{this.cluster}}
+  @directLinkData={{this.directLinkData}}
+  @loginSettings={{this.loginSettings}}
+  @namespaceQueryParam={{this.namespaceQueryParam}}
+  @oidcProviderQueryParam={{this.oidcProviderQueryParam}}
+  @loginAndTransition={{this.loginAndTransition}}
+  @onNamespaceUpdate={{this.onNamespaceUpdate}}
+  @visibleAuthMounts={{this.visibleAuthMounts}}
+/>`);
+  };
+};
diff --git a/ui/tests/integration/components/auth/tabs-test.js b/ui/tests/integration/components/auth/tabs-test.js
new file mode 100644
index 00000000000..d430cae7f2b
--- /dev/null
+++ b/ui/tests/integration/components/auth/tabs-test.js
@@ -0,0 +1,152 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { click, fillIn, findAll, render } from '@ember/test-helpers';
+import hbs from 'htmlbars-inline-precompile';
+import sinon from 'sinon';
+import { AUTH_FORM } from 'vault/tests/helpers/auth/auth-form-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | auth | tabs', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.tabData = {
+      userpass: [
+        {
+          path: 'userpass/',
+          description: 'platform team only',
+          options: {},
+          type: 'userpass',
+        },
+        {
+          path: 'userpass2/',
+          description: 'backup login method',
+          options: {},
+          type: 'userpass',
+        },
+      ],
+      oidc: [
+        {
+          path: 'my_oidc/',
+          description: '',
+          options: {},
+          type: 'oidc',
+        },
+      ],
+      token: [
+        {
+          path: 'token/',
+          description: 'token based credentials',
+          options: null,
+          type: 'token',
+        },
+      ],
+    };
+    this.selectedAuthMethod = '';
+    this.handleTabClick = sinon.spy();
+    this.renderComponent = () => {
+      return render(hbs`
+      <Auth::Tabs
+        @authTabData={{this.tabData}}
+        @handleTabClick={{this.handleTabClick}}
+        @selectedAuthMethod={{this.selectedAuthMethod}}
+      />`);
+    };
+  });
+
+  test('it renders tabs', async function (assert) {
+    const expectedTabs = [
+      { type: 'userpass', display: 'Userpass' },
+      { type: 'oidc', display: 'OIDC' },
+      { type: 'token', display: 'Token' },
+    ];
+
+    await this.renderComponent();
+    expectedTabs.forEach((m) => {
+      assert.dom(AUTH_FORM.tabBtn(m.type)).exists(`${m.type} renders as a tab`);
+      assert.dom(AUTH_FORM.tabBtn(m.type)).hasText(m.display, `${m.type} renders expected display name`);
+    });
+  });
+
+  test('it selects first tab if no @selectedAuthMethod exists', async function (assert) {
+    await this.renderComponent();
+    assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'true');
+  });
+
+  test('it renders a dropdown if multiple mount paths are returned', async function (assert) {
+    this.selectedAuthMethod = 'userpass';
+    await this.renderComponent();
+    const dropdownOptions = findAll(`${GENERAL.selectByAttr('path')} option`).map((o) => o.value);
+    const expectedPaths = ['userpass/', 'userpass2/'];
+    expectedPaths.forEach((p) => {
+      assert.true(dropdownOptions.includes(p), `dropdown includes path: ${p}`);
+    });
+  });
+
+  test('it renders a description for the selected mount path', async function (assert) {
+    // if a method type does not have any mounts with listing_visibility="unauth" its value is `null`
+    // add a tab that has no mount data
+    this.tabData.ldap = null;
+    // update selected method and re-render component when a tab is clicked
+    this.handleTabClick = async (selection) => {
+      this.selectedAuthMethod = selection;
+      await this.renderComponent();
+    };
+    this.selectedAuthMethod = 'userpass';
+
+    await this.renderComponent();
+    assert
+      .dom(GENERAL.selectByAttr('path'))
+      .hasValue('userpass/', 'it preselects first mount for "userpass"');
+    assert.dom(AUTH_FORM.description).hasText('platform team only', 'it renders the mount description');
+    await fillIn(GENERAL.selectByAttr('path'), 'userpass2/');
+    assert.dom(GENERAL.selectByAttr('path')).hasValue('userpass2/', 'it selects the second mount');
+    assert
+      .dom(AUTH_FORM.description)
+      .hasText('backup login method', 'it renders relevant description when mount dropdown updates');
+    // select a different tab
+    await click(AUTH_FORM.tabBtn('token'));
+    assert
+      .dom(AUTH_FORM.description)
+      .hasText('token based credentials', 'it updates the mount description when a new tab is selected');
+    // select method without a description
+    await click(AUTH_FORM.tabBtn('oidc'));
+    assert.dom(AUTH_FORM.tabBtn('oidc')).hasAttribute('aria-selected', 'true');
+    assert.dom(GENERAL.inputByAttr('path')).hasValue('my_oidc/');
+    assert.dom(AUTH_FORM.description).doesNotExist();
+    // select method with no mount data
+    await click(AUTH_FORM.tabBtn('ldap'));
+    assert.dom(AUTH_FORM.tabBtn('ldap')).hasAttribute('aria-selected', 'true');
+    assert.dom(GENERAL.inputByAttr('path')).doesNotExist();
+    assert.dom(AUTH_FORM.description).doesNotExist();
+  });
+
+  test('it does not render a description if only one tab exists and it does not have mount data', async function (assert) {
+    // if a method type does not have any mounts with listing_visibility="unauth" its value is `null`
+    this.tabData = { userpass: null };
+    this.selectedAuthMethod = 'userpass';
+    await this.renderComponent();
+    assert.dom(AUTH_FORM.tabBtn('userpass')).hasAttribute('aria-selected', 'true');
+    assert.dom(GENERAL.inputByAttr('path')).doesNotExist();
+    assert.dom(AUTH_FORM.description).doesNotExist();
+  });
+
+  test('it renders hidden input if only one mount path is returned', async function (assert) {
+    this.selectedAuthMethod = 'oidc';
+    await this.renderComponent();
+    assert.dom(GENERAL.inputByAttr('path')).hasAttribute('type', 'hidden');
+    assert.dom(GENERAL.inputByAttr('path')).hasValue('my_oidc/');
+  });
+
+  test('it calls handleTabClick with tab method type', async function (assert) {
+    await this.renderComponent();
+    await click(AUTH_FORM.tabBtn('oidc'));
+    const [actual] = this.handleTabClick.lastCall.args;
+    assert.strictEqual(actual, 'oidc');
+  });
+});
diff --git a/ui/tests/integration/components/autocomplete-input-test.js b/ui/tests/integration/components/autocomplete-input-test.js
index ab24c5467dd..247b147e566 100644
--- a/ui/tests/integration/components/autocomplete-input-test.js
+++ b/ui/tests/integration/components/autocomplete-input-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/b64-toggle-test.js b/ui/tests/integration/components/b64-toggle-test.js
index be20dba8726..30d4dfbdd02 100644
--- a/ui/tests/integration/components/b64-toggle-test.js
+++ b/ui/tests/integration/components/b64-toggle-test.js
@@ -1,24 +1,24 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, click, find } from '@ember/test-helpers';
+import { render, rerender, click, find } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 
 module('Integration | Component | b64 toggle', function (hooks) {
   setupRenderingTest(hooks);
 
   test('it renders', async function (assert) {
-    await render(hbs`{{b64-toggle}}`);
+    await render(hbs`<B64Toggle />`);
     assert.dom('button').exists({ count: 1 });
   });
 
   test('it toggles encoding on the passed string', async function (assert) {
     this.set('value', 'value');
-    await render(hbs`{{b64-toggle value=this.value}}`);
+    await render(hbs`<B64Toggle @value={{this.value}} @onUpdate={{fn this.set 'value'}}/>`);
     await click('button');
     assert.strictEqual(this.value, btoa('value'), 'encodes to base64');
     await click('button');
@@ -27,20 +27,26 @@ module('Integration | Component | b64 toggle', function (hooks) {
 
   test('it toggles encoding starting with base64', async function (assert) {
     this.set('value', btoa('value'));
-    await render(hbs`{{b64-toggle value=this.value initialEncoding='base64'}}`);
-    assert.ok(find('button').textContent.includes('Decode'), 'renders as on when in b64 mode');
+    await render(
+      hbs`<B64Toggle @value={{this.value}} @initialEncoding="base64" @onUpdate={{fn this.set 'value'}} />`
+    );
+    assert.true(find('button').textContent.includes('Decode'), 'renders as on when in b64 mode');
     await click('button');
     assert.strictEqual(this.value, 'value', 'decodes from base64');
   });
 
   test('it detects changes to value after encoding', async function (assert) {
     this.set('value', btoa('value'));
-    await render(hbs`{{b64-toggle value=this.value initialEncoding='base64'}}`);
-    assert.ok(find('button').textContent.includes('Decode'), 'renders as on when in b64 mode');
+    await render(
+      hbs`<B64Toggle @value={{this.value}} @initialEncoding="base64" @onUpdate={{fn this.set 'value'}} />`
+    );
+    assert.true(find('button').textContent.includes('Decode'), 'renders as on when in b64 mode');
     this.set('value', btoa('value') + '=');
-    assert.ok(find('button').textContent.includes('Encode'), 'toggles off since value has changed');
+    await rerender();
+    assert.true(find('button').textContent.includes('Encode'), 'toggles off since value has changed');
     this.set('value', btoa('value'));
-    assert.ok(
+    await rerender();
+    assert.true(
       find('button').textContent.includes('Decode'),
       'toggles on since value is equal to the original'
     );
@@ -48,8 +54,8 @@ module('Integration | Component | b64 toggle', function (hooks) {
 
   test('it does not toggle when the value is empty', async function (assert) {
     this.set('value', '');
-    await render(hbs`{{b64-toggle value=this.value}}`);
+    await render(hbs`<B64Toggle @value={{this.value}} @onUpdate={{fn this.set 'value'}} />`);
     await click('button');
-    assert.ok(find('button').textContent.includes('Encode'));
+    assert.true(find('button').textContent.includes('Encode'));
   });
 });
diff --git a/ui/tests/integration/components/calendar-widget-test.js b/ui/tests/integration/components/calendar-widget-test.js
deleted file mode 100644
index 649200b22f8..00000000000
--- a/ui/tests/integration/components/calendar-widget-test.js
+++ /dev/null
@@ -1,245 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { render, click } from '@ember/test-helpers';
-import sinon from 'sinon';
-import hbs from 'htmlbars-inline-precompile';
-import calendarDropdown from 'vault/tests/pages/components/calendar-widget';
-import { ARRAY_OF_MONTHS } from 'core/utils/date-formatters';
-import { subMonths, subYears } from 'date-fns';
-import timestamp from 'core/utils/timestamp';
-
-module('Integration | Component | calendar-widget', function (hooks) {
-  setupRenderingTest(hooks);
-
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => new Date('2018-04-03T14:15:30'));
-  });
-  hooks.beforeEach(function () {
-    const CURRENT_DATE = timestamp.now();
-    this.set('currentDate', CURRENT_DATE);
-    this.set('calendarStartDate', subMonths(CURRENT_DATE, 12));
-    this.set('calendarEndDate', CURRENT_DATE);
-    this.set('startTimestamp', subMonths(CURRENT_DATE, 12).toISOString());
-    this.set('endTimestamp', CURRENT_DATE.toISOString());
-    this.set('handleClientActivityQuery', sinon.spy());
-  });
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
-
-  test('it renders and disables correct months when start date is 12 months ago', async function (assert) {
-    assert.expect(14);
-    await render(hbs`
-      <CalendarWidget
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.endTimestamp}}
-        @selectMonth={{this.handleClientActivityQuery}}
-      />
-    `);
-    assert
-      .dom('[data-test-calendar-widget-trigger]')
-      .hasText(`Apr 2017 - Apr 2018`, 'renders and formats start and end dates');
-    await calendarDropdown.openCalendar();
-    assert.ok(calendarDropdown.showsCalendar, 'renders the calendar component');
-    // assert months in current year are disabled/enabled correctly
-    const enabledMonths = ['January', 'February', 'March', 'April'];
-    ARRAY_OF_MONTHS.forEach(function (month) {
-      if (enabledMonths.includes(month)) {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isNotDisabled(`${month} is enabled`);
-      } else {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isDisabled(`${month} is disabled`);
-      }
-    });
-  });
-
-  test('it renders and disables months before start timestamp', async function (assert) {
-    await render(hbs`
-      <CalendarWidget
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.endTimestamp}}
-        @selectMonth={{this.handleClientActivityQuery}}
-      />
-    `);
-
-    await calendarDropdown.openCalendar();
-    assert.dom('[data-test-next-year]').isDisabled('Future year is disabled');
-    await calendarDropdown.clickPreviousYear();
-    assert
-      .dom('[data-test-display-year]')
-      .hasText(`${subYears(this.currentDate, 1).getFullYear()}`, 'shows the previous year');
-    assert.dom('[data-test-previous-year]').isDisabled('disables previous year');
-
-    // assert months in previous year are disabled/enabled correctly
-    const disabledMonths = ['January', 'February', 'March'];
-    ARRAY_OF_MONTHS.forEach(function (month) {
-      if (disabledMonths.includes(month)) {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isDisabled(`${month} is disabled`);
-      } else {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isNotDisabled(`${month} is enabled`);
-      }
-    });
-  });
-
-  test('it calls parent callback with correct arg when clicking "Current billing period"', async function (assert) {
-    await render(hbs`
-      <CalendarWidget
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.endTimestamp}}
-        @selectMonth={{this.handleClientActivityQuery}}
-      />
-    `);
-    await calendarDropdown.menuToggle();
-    await calendarDropdown.clickCurrentBillingPeriod();
-    assert.propEqual(
-      this.handleClientActivityQuery.args[0][0],
-      { dateType: 'reset' },
-      'it calls parent function with reset dateType'
-    );
-  });
-
-  test('it calls parent callback with correct arg when clicking "Current month"', async function (assert) {
-    await render(hbs`
-      <CalendarWidget
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.endTimestamp}}
-        @selectMonth={{this.handleClientActivityQuery}}
-      />
-    `);
-    await calendarDropdown.menuToggle();
-    await calendarDropdown.clickCurrentMonth();
-    assert.propEqual(
-      this.handleClientActivityQuery.args[0][0],
-      { dateType: 'currentMonth' },
-      'it calls parent function with currentMoth dateType'
-    );
-  });
-
-  test('it calls parent callback with correct arg when selecting a month', async function (assert) {
-    await render(hbs`
-      <CalendarWidget
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.endTimestamp}}
-        @selectMonth={{this.handleClientActivityQuery}}
-      />
-    `);
-    await calendarDropdown.openCalendar();
-    await click(`[data-test-calendar-month="April"`);
-    assert.propEqual(
-      this.handleClientActivityQuery.lastCall.lastArg,
-      {
-        dateType: 'endDate',
-        monthIdx: 3,
-        monthName: 'April',
-        year: 2018,
-      },
-      'it calls parent function with end date (current) month/year'
-    );
-
-    await calendarDropdown.openCalendar();
-    await calendarDropdown.clickPreviousYear();
-    await click(`[data-test-calendar-month="May"]`);
-    assert.propEqual(
-      this.handleClientActivityQuery.lastCall.lastArg,
-      {
-        dateType: 'endDate',
-        monthIdx: 4,
-        monthName: 'May',
-        year: 2017,
-      },
-      'it calls parent function with selected start date month/year'
-    );
-  });
-
-  test('it disables correct months when start date 6 months ago', async function (assert) {
-    this.set('calendarStartDate', subMonths(this.currentDate, 6)); // Nov 3, 2017
-    this.set('startTimestamp', subMonths(this.currentDate, 6).toISOString());
-    await render(hbs`
-      <CalendarWidget
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.endTimestamp}}
-        @selectMonth={{this.handleClientActivityQuery}}
-      />
-    `);
-
-    await calendarDropdown.openCalendar();
-    assert.dom('[data-test-next-year]').isDisabled('Future year is disabled');
-
-    // Check start year disables correct months
-    await calendarDropdown.clickPreviousYear();
-    assert.dom('[data-test-previous-year]').isDisabled('previous year is disabled');
-    const prevYearEnabled = ['October', 'November', 'December'];
-    ARRAY_OF_MONTHS.forEach(function (month) {
-      if (prevYearEnabled.includes(month)) {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isNotDisabled(`${month} is enabled`);
-      } else {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isDisabled(`${month} is read only`);
-      }
-    });
-
-    // Check end year disables correct months
-    await click('[data-test-next-year]');
-    const currYearEnabled = ['January', 'February', 'March', 'April'];
-    ARRAY_OF_MONTHS.forEach(function (month) {
-      if (currYearEnabled.includes(month)) {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isNotDisabled(`${month} is enabled`);
-      } else {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isDisabled(`${month} is disabled`);
-      }
-    });
-  });
-
-  test('it disables correct months when start date 36 months ago', async function (assert) {
-    this.set('calendarStartDate', subMonths(this.currentDate, 36)); // April 3 2015
-    this.set('startTimestamp', subMonths(this.currentDate, 36).toISOString());
-    await render(hbs`
-      <CalendarWidget
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.endTimestamp}}
-        @selectMonth={{this.handleClientActivityQuery}}
-      />
-    `);
-
-    await calendarDropdown.openCalendar();
-    assert.dom('[data-test-next-year]').isDisabled('Future year is disabled');
-    for (const year of [2017, 2016, 2015]) {
-      await calendarDropdown.clickPreviousYear();
-      assert.dom('[data-test-display-year]').hasText(year.toString());
-    }
-
-    assert.dom('[data-test-previous-year]').isDisabled('previous year is disabled');
-    assert.dom('[data-test-next-year]').isEnabled('next year is enabled');
-
-    const disabledMonths = ['January', 'February', 'March'];
-    ARRAY_OF_MONTHS.forEach(function (month) {
-      if (disabledMonths.includes(month)) {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isDisabled(`${month} is disabled`);
-      } else {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isNotDisabled(`${month} is enabled`);
-      }
-    });
-
-    await click('[data-test-next-year]');
-    ARRAY_OF_MONTHS.forEach(function (month) {
-      assert.dom(`[data-test-calendar-month="${month}"]`).isNotDisabled(`${month} is enabled for 2016`);
-    });
-    await click('[data-test-next-year]');
-    ARRAY_OF_MONTHS.forEach(function (month) {
-      assert.dom(`[data-test-calendar-month="${month}"]`).isNotDisabled(`${month} is enabled for 2017`);
-    });
-    await click('[data-test-next-year]');
-
-    const enabledMonths = ['January', 'February', 'March', 'April'];
-    ARRAY_OF_MONTHS.forEach(function (month) {
-      if (enabledMonths.includes(month)) {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isNotDisabled(`${month} is enabled`);
-      } else {
-        assert.dom(`[data-test-calendar-month="${month}"]`).isDisabled(`${month} is disabled`);
-      }
-    });
-  });
-});
diff --git a/ui/tests/integration/components/certificate-card-test.js b/ui/tests/integration/components/certificate-card-test.js
index 66800476549..ed41d10df8c 100644
--- a/ui/tests/integration/components/certificate-card-test.js
+++ b/ui/tests/integration/components/certificate-card-test.js
@@ -1,21 +1,23 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
-import { render } from '@ember/test-helpers';
+import { render, click } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { rootPem, rootDer } from 'vault/tests/helpers/pki/values';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
 
 const SELECTORS = {
   label: '[data-test-certificate-label]',
   value: '[data-test-certificate-value]',
   icon: '[data-test-certificate-icon]',
-  copyButton: '[data-test-copy-button]',
   copyIcon: '[data-test-icon="clipboard-copy"]',
 };
+const { rootPem, rootDer } = CERTIFICATES;
 
 module('Integration | Component | certificate-card', function (hooks) {
   setupRenderingTest(hooks);
@@ -30,29 +32,47 @@ module('Integration | Component | certificate-card', function (hooks) {
   });
 
   test('it renders with an example PEM Certificate', async function (assert) {
+    // Sinon spy for clipboard
+    const clipboardSpy = sinon.stub(navigator.clipboard, 'writeText').resolves();
+
     this.certificate = rootPem;
     await render(hbs`<CertificateCard @data={{this.certificate}} />`);
 
     assert.dom(SELECTORS.label).hasText('PEM Format', 'The label text is PEM Format');
     assert.dom(SELECTORS.value).hasText(this.certificate, 'The data rendered is correct');
     assert.dom(SELECTORS.icon).exists('The certificate icon exists');
-    assert.dom(SELECTORS.copyButton).exists('The copy button exists');
-    assert
-      .dom(SELECTORS.copyButton)
-      .hasAttribute('data-test-copy-button', this.certificate, 'copy value is the same as data');
+
+    await click(GENERAL.copyButton);
+    assert.true(clipboardSpy.calledOnce, 'Clipboard was called once');
+    assert.strictEqual(
+      clipboardSpy.firstCall.args[0],
+      this.certificate,
+      'copy certificate copied the correct text'
+    );
+    // Restore original clipboard
+    clipboardSpy.restore(); // cleanup
   });
 
   test('it renders with an example DER Certificate', async function (assert) {
+    // Sinon spy for clipboard
+    const clipboardSpy = sinon.stub(navigator.clipboard, 'writeText').resolves();
+
     this.certificate = rootDer;
     await render(hbs`<CertificateCard @data={{this.certificate}} />`);
 
     assert.dom(SELECTORS.label).hasText('DER Format', 'The label text is DER Format');
     assert.dom(SELECTORS.value).hasText(this.certificate, 'The data rendered is correct');
     assert.dom(SELECTORS.icon).exists('The certificate icon exists');
-    assert.dom(SELECTORS.copyButton).exists('The copy button exists');
-    assert
-      .dom(SELECTORS.copyButton)
-      .hasAttribute('data-test-copy-button', this.certificate, 'copy value is the same as data');
+
+    await click(GENERAL.copyButton);
+    assert.true(clipboardSpy.calledOnce, 'Clipboard was called once');
+    assert.strictEqual(
+      clipboardSpy.firstCall.args[0],
+      this.certificate,
+      'copy certificate copied the correct text'
+    );
+    // Restore original clipboard
+    clipboardSpy.restore(); // cleanup
   });
 
   test('it renders with the PEM Format label regardless of the value provided when @isPem is true', async function (assert) {
@@ -64,6 +84,9 @@ module('Integration | Component | certificate-card', function (hooks) {
   });
 
   test('it renders with an example CA Chain', async function (assert) {
+    // Sinon spy for clipboard
+    const clipboardSpy = sinon.stub(navigator.clipboard, 'writeText').resolves();
+
     this.caChain = [
       '-----BEGIN CERTIFICATE-----\nMIIDIDCCA...\n-----END CERTIFICATE-----\n',
       '-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBA...\n-----END RSA PRIVATE KEY-----\n',
@@ -74,13 +97,15 @@ module('Integration | Component | certificate-card', function (hooks) {
     assert.dom(SELECTORS.label).hasText('PEM Format', 'The label text is PEM Format');
     assert.dom(SELECTORS.value).hasText(this.caChain.join(','), 'The data rendered is correct');
     assert.dom(SELECTORS.icon).exists('The certificate icon exists');
-    assert.dom(SELECTORS.copyButton).exists('The copy button exists');
-    assert
-      .dom(SELECTORS.copyButton)
-      .hasAttribute(
-        'data-test-copy-button',
-        this.caChain.join('\n'),
-        'copy value is array converted to a string'
-      );
+
+    await click(GENERAL.copyButton);
+    assert.true(clipboardSpy.calledOnce, 'Clipboard was called once');
+    assert.strictEqual(
+      clipboardSpy.firstCall.args[0],
+      this.caChain.join('\n'),
+      'copy value is array converted to a string'
+    );
+    // Restore original clipboard
+    clipboardSpy.restore(); // cleanup
   });
 });
diff --git a/ui/tests/integration/components/charts/vertical-bar-basic-test.js b/ui/tests/integration/components/charts/vertical-bar-basic-test.js
index fbb968fd65e..b55ac2df041 100644
--- a/ui/tests/integration/components/charts/vertical-bar-basic-test.js
+++ b/ui/tests/integration/components/charts/vertical-bar-basic-test.js
@@ -1,11 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
-import { render, triggerEvent } from '@ember/test-helpers';
+import { findAll, render, triggerEvent } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 
 const EXAMPLE = [
@@ -40,15 +40,34 @@ module('Integration | Component | clients/charts/vertical-bar-basic', function (
 
   hooks.beforeEach(function () {
     this.data = EXAMPLE;
+    this.showTable = false;
+    this.renderComponent = async () => {
+      await render(
+        hbs`<Clients::Charts::VerticalBarBasic @data={{this.data}} @dataKey="secret_syncs" @chartTitle="My chart" @showTable={{this.showTable}} />`
+      );
+    };
+  });
+
+  test('it renders bars the expected color', async function (assert) {
+    await this.renderComponent();
+    // the first bar has no data and doesn't render so get the second one
+    const bars = findAll('.lineal-chart-bar');
+    const actualColor = getComputedStyle(bars[1]).fill;
+    const expectedColor = 'rgb(28, 52, 95)';
+    assert.strictEqual(
+      actualColor,
+      expectedColor,
+      `actual color: ${actualColor}, expected color: ${expectedColor}`
+    );
   });
 
   test('it renders when some months have no data', async function (assert) {
-    assert.expect(10);
-    await render(hbs`<Clients::Charts::VerticalBarBasic @data={{this.data}} @dataKey="secret_syncs" />`);
-    assert.dom('[data-test-sync-bar-chart]').exists('renders chart container');
+    await this.renderComponent();
+    assert.dom('[data-test-chart="My chart"]').exists('renders chart container');
     assert.dom('[data-test-vertical-bar]').exists({ count: 3 }, 'renders 3 vertical bars');
 
     // Tooltips
+    assert.dom('[data-test-interactive-area="9/22"]').exists('interactive area exists');
     await triggerEvent('[data-test-interactive-area="9/22"]', 'mouseover');
     assert.dom('[data-test-tooltip]').exists({ count: 1 }, 'renders tooltip on mouseover');
     assert.dom('[data-test-tooltip-count]').hasText('5,802 secret syncs', 'tooltip has exact count');
@@ -68,8 +87,6 @@ module('Integration | Component | clients/charts/vertical-bar-basic', function (
 
   // 0 is different than null (no data)
   test('it renders when all months have 0 clients', async function (assert) {
-    assert.expect(9);
-
     this.data = [
       {
         month: '6/22',
@@ -88,9 +105,9 @@ module('Integration | Component | clients/charts/vertical-bar-basic', function (
         secret_syncs: 0,
       },
     ];
-    await render(hbs`<Clients::Charts::VerticalBarBasic @data={{this.data}} @dataKey="secret_syncs" />`);
+    await this.renderComponent();
 
-    assert.dom('[data-test-sync-bar-chart]').exists('renders chart container');
+    assert.dom('[data-test-chart="My chart"]').exists('renders chart container');
     assert.dom('[data-test-vertical-bar]').exists({ count: 2 }, 'renders 2 vertical bars');
     assert.dom('[data-test-vertical-bar]').hasAttribute('height', '0', 'rectangles have 0 height');
     // Tooltips
@@ -106,14 +123,12 @@ module('Integration | Component | clients/charts/vertical-bar-basic', function (
   });
 
   test('it renders underlying data', async function (assert) {
-    assert.expect(3);
-    await render(
-      hbs`<Clients::Charts::VerticalBarBasic @data={{this.data}} @dataKey="secret_syncs" @showTable={{true}} />`
-    );
-    assert.dom('[data-test-sync-bar-chart]').exists('renders chart container');
+    this.showTable = true;
+    await this.renderComponent();
+    assert.dom('[data-test-chart="My chart"]').exists('renders chart container');
     assert.dom('[data-test-underlying-data]').exists('renders underlying data when showTable=true');
     assert
       .dom('[data-test-underlying-data] thead')
-      .hasText('Month Count of secret syncs', 'renders correct table headers');
+      .hasText('Month Secret syncs Count', 'renders correct table headers');
   });
 });
diff --git a/ui/tests/integration/components/charts/vertical-bar-stacked-test.js b/ui/tests/integration/components/charts/vertical-bar-stacked-test.js
new file mode 100644
index 00000000000..516a1bb6dfb
--- /dev/null
+++ b/ui/tests/integration/components/charts/vertical-bar-stacked-test.js
@@ -0,0 +1,172 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { findAll, render, triggerEvent } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { CHARTS } from 'vault/tests/helpers/clients/client-count-selectors';
+
+const EXAMPLE = [
+  {
+    timestamp: '2022-09-01T00:00:00',
+    total: null,
+    fuji_apples: null,
+    gala_apples: null,
+    red_delicious: null,
+    honey_crisp: null,
+  },
+  {
+    timestamp: '2022-10-01T00:00:00',
+    total: 6440,
+    fuji_apples: 1471,
+    gala_apples: 4389,
+    red_delicious: 4207,
+    honey_crisp: 1234,
+  },
+  {
+    timestamp: '2022-11-01T00:00:00',
+    total: 9583,
+    fuji_apples: 149,
+    gala_apples: 20,
+    red_delicious: 5802,
+    honey_crisp: 134,
+  },
+];
+
+module('Integration | Component | clients/charts/vertical-bar-stacked', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.data = EXAMPLE;
+    this.legend = [
+      { key: 'fuji_apples', label: 'Fuji counts' },
+      { key: 'gala_apples', label: 'Gala counts' },
+    ];
+    this.showTable = false;
+    this.renderComponent = async () => {
+      await render(
+        hbs`<Clients::Charts::VerticalBarStacked @data={{this.data}} @chartLegend={{this.legend}} @chartTitle="My chart" @showTable={{this.showTable}} />`
+      );
+    };
+  });
+
+  test('it renders bars the expected color', async function (assert) {
+    this.legend = [
+      { key: 'fuji_apples', label: 'Fuji counts' },
+      { key: 'gala_apples', label: 'Gala counts' },
+      { key: 'red_delicious', label: 'Red Delicious counts' },
+      { key: 'honey_crisp', label: 'Honey Crisp counts' },
+    ];
+    await this.renderComponent();
+    const barClasses = ['.stacked-bar-1', '.stacked-bar-2', '.stacked-bar-3', '.stacked-bar-4'];
+    const expectedFills = [
+      'rgb(66, 105, 208)',
+      'rgb(239, 177, 23)',
+      'rgb(255, 114, 92)',
+      'rgb(108, 197, 176)',
+    ];
+    barClasses.forEach((className, idx) => {
+      const bars = findAll(className);
+      // Skip the first set of bars because they have no data
+      const bar = bars[1];
+      const actual = getComputedStyle(bar).fill;
+      const expected = expectedFills[idx];
+      assert.strictEqual(actual, expected, `${className} has expected fill color: ${expected}`);
+    });
+  });
+
+  test('it renders when some months have no data', async function (assert) {
+    assert.expect(10);
+    await this.renderComponent();
+
+    assert.dom(CHARTS.chart('My chart')).exists('renders chart container');
+
+    const visibleBars = findAll(CHARTS.verticalBar).filter((e) => e.getAttribute('height') !== '0');
+    const count = this.data.filter((d) => d.total !== null).length * 2;
+    assert.strictEqual(visibleBars.length, count, `renders ${count} vertical bars`);
+
+    // Tooltips
+    await triggerEvent(CHARTS.hover('2022-09-01T00:00:00'), 'mouseover');
+    assert.dom(CHARTS.tooltip).isVisible('renders tooltip on mouseover');
+    assert
+      .dom(CHARTS.tooltip)
+      .hasText('September 2022 No data', 'renders formatted timestamp with no data message');
+    await triggerEvent(CHARTS.hover('2022-09-01T00:00:00'), 'mouseout');
+    assert.dom(CHARTS.tooltip).doesNotExist('removes tooltip on mouseout');
+
+    await triggerEvent(CHARTS.hover('2022-10-01T00:00:00'), 'mouseover');
+    assert
+      .dom(CHARTS.tooltip)
+      .hasText('October 2022 1,471 Fuji counts 4,389 Gala counts', 'October tooltip has exact count');
+    await triggerEvent(CHARTS.hover('2022-10-01T00:00:00'), 'mouseout');
+
+    await triggerEvent(CHARTS.hover('2022-11-01T00:00:00'), 'mouseover');
+    assert
+      .dom(CHARTS.tooltip)
+      .hasText('November 2022 149 Fuji counts 20 Gala counts', 'November tooltip has exact count');
+    await triggerEvent(CHARTS.hover('2022-11-01T00:00:00'), 'mouseout');
+
+    // Axis
+    assert.dom(CHARTS.xAxis).hasText('9/22 10/22 11/22', 'renders x-axis labels');
+    assert.dom(CHARTS.yAxis).hasText('0 2k 4k', 'renders y-axis labels');
+    // Table
+    assert.dom(CHARTS.table).doesNotExist('does not render underlying data by default');
+  });
+
+  // 0 is different than null (no data)
+  test('it renders when all months have 0 clients', async function (assert) {
+    assert.expect(14);
+
+    this.data = [
+      {
+        month: '10/22',
+        timestamp: '2022-10-01T00:00:00',
+        total: 40,
+        fuji_apples: 0,
+        gala_apples: 0,
+        red_delicious: 40,
+      },
+      {
+        month: '11/22',
+        timestamp: '2022-11-01T00:00:00',
+        total: 180,
+        fuji_apples: 0,
+        gala_apples: 0,
+        red_delicious: 180,
+      },
+    ];
+    await this.renderComponent();
+    assert.dom(CHARTS.chart('My chart')).exists('renders chart container');
+    findAll(CHARTS.verticalBar).forEach((b, idx) =>
+      assert.dom(b).isNotVisible(`bar: ${idx} does not render`)
+    );
+    findAll(CHARTS.verticalBar).forEach((b, idx) =>
+      assert.dom(b).hasAttribute('height', '0', `rectangle: ${idx} have 0 height`)
+    );
+
+    // Tooltips
+    await triggerEvent(CHARTS.hover('2022-10-01T00:00:00'), 'mouseover');
+    assert.dom(CHARTS.tooltip).isVisible('renders tooltip on mouseover');
+    assert.dom(CHARTS.tooltip).hasText('October 2022 0 Fuji counts 0 Gala counts', 'tooltip has 0 counts');
+    await triggerEvent(CHARTS.hover('2022-10-01T00:00:00'), 'mouseout');
+    assert.dom(CHARTS.tooltip).isNotVisible('removes tooltip on mouseout');
+
+    // Axis
+    assert.dom(CHARTS.xAxis).hasText('10/22 11/22', 'renders x-axis labels');
+    assert.dom(CHARTS.yAxis).hasText('0 1 2 3 4', 'renders y-axis labels');
+  });
+
+  test('it renders underlying data', async function (assert) {
+    assert.expect(3);
+    this.showTable = true;
+    await this.renderComponent();
+    assert.dom(CHARTS.chart('My chart')).exists('renders chart container');
+    assert.dom(CHARTS.table).exists('renders underlying data when showTable=true');
+    assert
+      .dom(`${CHARTS.table} thead`)
+      .hasText('Timestamp Fuji apples Gala apples', 'renders correct table headers');
+  });
+});
diff --git a/ui/tests/integration/components/checkbox-grid-test.js b/ui/tests/integration/components/checkbox-grid-test.js
index f887c29370e..de97d5169c4 100644
--- a/ui/tests/integration/components/checkbox-grid-test.js
+++ b/ui/tests/integration/components/checkbox-grid-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/chevron-test.js b/ui/tests/integration/components/chevron-test.js
index fc07e184431..5d244464138 100644
--- a/ui/tests/integration/components/chevron-test.js
+++ b/ui/tests/integration/components/chevron-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,13 +17,13 @@ module('Integration | Component | chevron', function (hooks) {
     // Handle any actions with this.set('myAction', function(val) { ... });
 
     await render(hbs`<Chevron />`);
-    assert.dom('.flight-icon').exists('renders');
+    assert.dom('.hds-icon').exists('renders');
 
     await render(hbs`<Chevron @isButton={{true}} />`);
-    assert.dom('.flight-icon').hasClass('hs-icon-button-right', 'renders');
+    assert.dom('.hds-icon').hasClass('hs-icon-button-right', 'renders');
 
     await render(hbs`<Chevron @direction='left' @isButton={{true}} />`);
-    assert.dom('.flight-icon').doesNotHaveClass('hs-icon-button-right', 'renders');
+    assert.dom('.hds-icon').doesNotHaveClass('hs-icon-button-right', 'renders');
 
     const promise = waitForError();
     render(hbs`<Chevron @direction='lol' />`);
diff --git a/ui/tests/integration/components/choose-pgp-key-form-test.js b/ui/tests/integration/components/choose-pgp-key-form-test.js
index 4e87e3e3952..47813a1dcc6 100644
--- a/ui/tests/integration/components/choose-pgp-key-form-test.js
+++ b/ui/tests/integration/components/choose-pgp-key-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,18 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { click, fillIn, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
+const CHOOSE_PGP = {
+  begin: '[data-test-choose-pgp-key-form="begin"]',
+  description: '[data-test-choose-pgp-key-description]',
+  useKeyButton: '[data-test-use-pgp-key-button]',
+  pgpTextArea: '[data-test-pgp-file-textarea]',
+  confirm: '[data-test-pgp-key-confirm]',
+  base64Output: '[data-test-pgp-key-copy]',
+  submit: '[data-test-confirm-pgp-key-submit]',
+  cancel: '[data-test-use-pgp-key-cancel]',
+};
 module('Integration | Component | choose-pgp-key-form', function (hooks) {
   setupRenderingTest(hooks);
 
@@ -22,25 +33,24 @@ module('Integration | Component | choose-pgp-key-form', function (hooks) {
       hbs`<ChoosePgpKeyForm @onSubmit={{this.onSubmit}} @onCancel={{this.onCancel}} @formText="my custom form text" @buttonText="Do it" />`
     );
 
-    assert.dom('[data-test-choose-pgp-key-form="begin"]').exists('PGP key selection form exists');
+    assert.dom(CHOOSE_PGP.begin).exists('PGP key selection form exists');
+    assert.dom(CHOOSE_PGP.description).hasText('my custom form text', 'uses custom form text');
+    await click(GENERAL.textToggle);
+    assert.dom(CHOOSE_PGP.useKeyButton).isDisabled('use pgp button is disabled');
+    await fillIn(CHOOSE_PGP.pgpTextArea, 'base64-pgp-key');
+    assert.dom(CHOOSE_PGP.useKeyButton).isNotDisabled('use pgp button is no longer disabled');
+    await click(CHOOSE_PGP.useKeyButton);
     assert
-      .dom('[data-test-choose-pgp-key-description]')
-      .hasText('my custom form text', 'uses custom form text');
-    await click('[data-test-text-toggle]');
-    assert.dom('[data-test-use-pgp-key-button]').isDisabled('use pgp button is disabled');
-    await fillIn('[data-test-pgp-file-textarea]', 'base64-pgp-key');
-    assert.dom('[data-test-use-pgp-key-button]').isNotDisabled('use pgp button is no longer disabled');
-    await click('[data-test-use-pgp-key-button]');
-    assert
-      .dom('[data-test-pgp-key-confirm]')
+      .dom(CHOOSE_PGP.confirm)
       .hasText(
         'Below is the base-64 encoded PGP Key that will be used. Click the "Do it" button to proceed.',
         'Incorporates button text in confirmation'
       );
-    assert.dom('[data-test-pgp-key-copy]').hasText('base64-pgp-key', 'Shows PGP key contents');
-    assert.dom('[data-test-confirm-pgp-key-submit]').hasText('Do it', 'uses passed buttonText');
-    await click('[data-test-confirm-pgp-key-submit]');
+    assert.dom(CHOOSE_PGP.base64Output).hasText('base64-pgp-key', 'Shows PGP key contents');
+    assert.dom(CHOOSE_PGP.submit).hasText('Do it', 'uses passed buttonText');
+    await click(CHOOSE_PGP.submit);
   });
+
   test('it calls onSubmit correctly', async function (assert) {
     const submitSpy = sinon.spy();
     this.set('onSubmit', submitSpy);
@@ -48,24 +58,24 @@ module('Integration | Component | choose-pgp-key-form', function (hooks) {
       hbs`<ChoosePgpKeyForm @onSubmit={{this.onSubmit}} @onCancel={{this.onCancel}} @buttonText="Submit" />`
     );
 
-    assert.dom('[data-test-choose-pgp-key-form="begin"]').exists('PGP key selection form exists');
+    assert.dom(CHOOSE_PGP.begin).exists('PGP key selection form exists');
     assert
-      .dom('[data-test-choose-pgp-key-description]')
+      .dom(CHOOSE_PGP.description)
       .hasText('Choose a PGP Key from your computer or paste the contents of one in the form below.');
-    await click('[data-test-text-toggle]');
-    assert.dom('[data-test-use-pgp-key-button]').isDisabled('use pgp button is disabled');
-    await fillIn('[data-test-pgp-file-textarea]', 'base64-pgp-key');
-    assert.dom('[data-test-use-pgp-key-button]').isNotDisabled('use pgp button is no longer disabled');
-    await click('[data-test-use-pgp-key-button]');
+    await click(GENERAL.textToggle);
+    assert.dom(CHOOSE_PGP.useKeyButton).isDisabled('use pgp button is disabled');
+    await fillIn(CHOOSE_PGP.pgpTextArea, 'base64-pgp-key');
+    assert.dom(CHOOSE_PGP.useKeyButton).isNotDisabled('use pgp button is no longer disabled');
+    await click(CHOOSE_PGP.useKeyButton);
     assert
-      .dom('[data-test-pgp-key-confirm]')
+      .dom(CHOOSE_PGP.confirm)
       .hasText(
         'Below is the base-64 encoded PGP Key that will be used. Click the "Submit" button to proceed.',
         'Confirmation text has buttonText'
       );
-    assert.dom('[data-test-pgp-key-copy]').hasText('base64-pgp-key', 'Shows PGP key contents');
-    assert.dom('[data-test-confirm-pgp-key-submit]').hasText('Submit', 'uses passed buttonText');
-    await click('[data-test-confirm-pgp-key-submit]');
+    assert.dom(CHOOSE_PGP.base64Output).hasText('base64-pgp-key', 'Shows PGP key contents');
+    assert.dom(CHOOSE_PGP.submit).hasText('Submit', 'uses passed buttonText');
+    await click(CHOOSE_PGP.submit);
     assert.ok(submitSpy.calledOnceWith('base64-pgp-key'));
   });
 
@@ -76,9 +86,9 @@ module('Integration | Component | choose-pgp-key-form', function (hooks) {
       hbs`<ChoosePgpKeyForm @onSubmit={{this.onSubmit}} @onCancel={{this.onCancel}} @buttonText="Submit" />`
     );
 
-    await click('[data-test-text-toggle]');
-    await fillIn('[data-test-pgp-file-textarea]', 'base64-pgp-key');
-    await click('[data-test-use-pgp-key-cancel]');
+    await click(GENERAL.textToggle);
+    await fillIn(CHOOSE_PGP.pgpTextArea, 'base64-pgp-key');
+    await click(CHOOSE_PGP.cancel);
     assert.ok(cancelSpy.calledOnce);
   });
 });
diff --git a/ui/tests/integration/components/clients/attribution-test.js b/ui/tests/integration/components/clients/attribution-test.js
deleted file mode 100644
index 204bd361a71..00000000000
--- a/ui/tests/integration/components/clients/attribution-test.js
+++ /dev/null
@@ -1,230 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import sinon from 'sinon';
-import { setupRenderingTest } from 'ember-qunit';
-import { render } from '@ember/test-helpers';
-import { hbs } from 'ember-cli-htmlbars';
-import { endOfMonth, formatRFC3339 } from 'date-fns';
-import { click } from '@ember/test-helpers';
-import subMonths from 'date-fns/subMonths';
-import timestamp from 'core/utils/timestamp';
-
-module('Integration | Component | clients/attribution', function (hooks) {
-  setupRenderingTest(hooks);
-
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => new Date('2018-04-03T14:15:30'));
-  });
-  hooks.beforeEach(function () {
-    const mockNow = timestamp.now();
-    this.mockNow = mockNow;
-    this.set('startTimestamp', formatRFC3339(subMonths(mockNow, 6)));
-    this.set('timestamp', formatRFC3339(mockNow));
-    this.set('selectedNamespace', null);
-    this.set('chartLegend', [
-      { label: 'entity clients', key: 'entity_clients' },
-      { label: 'non-entity clients', key: 'non_entity_clients' },
-    ]);
-    this.set('totalUsageCounts', { clients: 15, entity_clients: 10, non_entity_clients: 5 });
-    this.set('totalClientAttribution', [
-      { label: 'second', clients: 10, entity_clients: 7, non_entity_clients: 3 },
-      { label: 'first', clients: 5, entity_clients: 3, non_entity_clients: 2 },
-    ]);
-    this.set('totalMountsData', { clients: 5, entity_clients: 3, non_entity_clients: 2 });
-    this.set('namespaceMountsData', [
-      { label: 'auth1/', clients: 3, entity_clients: 2, non_entity_clients: 1 },
-      { label: 'auth2/', clients: 2, entity_clients: 1, non_entity_clients: 1 },
-    ]);
-  });
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
-
-  test('it renders empty state with no data', async function (assert) {
-    await render(hbs`
-      <Clients::Attribution />
-    `);
-
-    assert.dom('[data-test-component="empty-state"]').exists();
-    assert.dom('[data-test-empty-state-title]').hasText('No data found');
-    assert.dom('[data-test-attribution-description]').hasText('There is a problem gathering data');
-    assert.dom('[data-test-attribution-export-button]').doesNotExist();
-    assert.dom('[data-test-attribution-timestamp]').doesNotHaveTextContaining('Updated');
-  });
-
-  test('it renders with data for namespaces', async function (assert) {
-    await render(hbs`
-      <Clients::Attribution
-        @totalClientAttribution={{this.totalClientAttribution}}
-        @totalUsageCounts={{this.totalUsageCounts}}
-        @responseTimestamp={{this.timestamp}}
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.timestamp}}
-        @selectedNamespace={{this.selectedNamespace}}
-        @isHistoricalMonth={{false}}
-        />
-    `);
-
-    assert.dom('[data-test-component="empty-state"]').doesNotExist();
-    assert.dom('[data-test-horizontal-bar-chart]').exists('chart displays');
-    assert.dom('[data-test-attribution-export-button]').exists();
-    assert
-      .dom('[data-test-attribution-description]')
-      .hasText(
-        'This data shows the top ten namespaces by client count and can be used to understand where clients are originating. Namespaces are identified by path. To see all namespaces, export this data.'
-      );
-    assert
-      .dom('[data-test-attribution-subtext]')
-      .hasText(
-        'The total clients in the namespace for this date range. This number is useful for identifying overall usage volume.'
-      );
-    assert.dom('[data-test-top-attribution]').includesText('namespace').includesText('second');
-    assert.dom('[data-test-attribution-clients]').includesText('namespace').includesText('10');
-  });
-
-  test('it renders two charts and correct text for single, historical month', async function (assert) {
-    this.start = formatRFC3339(subMonths(this.mockNow, 1));
-    this.end = formatRFC3339(subMonths(endOfMonth(this.mockNow), 1));
-    await render(hbs`
-      <Clients::Attribution
-        @totalClientAttribution={{this.totalClientAttribution}}
-        @totalUsageCounts={{this.totalUsageCounts}}
-        @responseTimestamp={{this.timestamp}}
-        @startTimestamp={{this.start}}
-        @endTimestamp={{this.end}}
-        @selectedNamespace={{this.selectedNamespace}}
-        @isHistoricalMonth={{true}}
-        />
-    `);
-    assert
-      .dom('[data-test-attribution-description]')
-      .includesText(
-        'This data shows the top ten namespaces by client count and can be used to understand where clients are originating. Namespaces are identified by path. To see all namespaces, export this data.',
-        'renders correct auth attribution description'
-      );
-    assert
-      .dom('[data-test-chart-container="total-clients"] .chart-description')
-      .includesText(
-        'The total clients in the namespace for this month. This number is useful for identifying overall usage volume.',
-        'renders total monthly namespace text'
-      );
-    assert
-      .dom('[data-test-chart-container="new-clients"] .chart-description')
-      .includesText(
-        'The new clients in the namespace for this month. This aids in understanding which namespaces create and use new clients.',
-        'renders new monthly namespace text'
-      );
-    this.set('selectedNamespace', 'second');
-
-    assert
-      .dom('[data-test-attribution-description]')
-      .includesText(
-        'This data shows the top ten authentication methods by client count within this namespace, and can be used to understand where clients are originating. Authentication methods are organized by path.',
-        'renders correct auth attribution description'
-      );
-    assert
-      .dom('[data-test-chart-container="total-clients"] .chart-description')
-      .includesText(
-        'The total clients used by the auth method for this month. This number is useful for identifying overall usage volume.',
-        'renders total monthly auth method text'
-      );
-    assert
-      .dom('[data-test-chart-container="new-clients"] .chart-description')
-      .includesText(
-        'The new clients used by the auth method for this month. This aids in understanding which auth methods create and use new clients.',
-        'renders new monthly auth method text'
-      );
-  });
-
-  test('it renders single chart for current month', async function (assert) {
-    await render(hbs`
-      <Clients::Attribution
-        @totalClientAttribution={{this.totalClientAttribution}}
-        @totalUsageCounts={{this.totalUsageCounts}}
-        @responseTimestamp={{this.timestamp}}
-        @startTimestamp={{this.timestamp}}
-        @endTimestamp={{this.timestamp}}
-        @selectedNamespace={{this.selectedNamespace}}
-        @isHistoricalMonth={{false}}
-        />
-    `);
-    assert
-      .dom('[data-test-chart-container="single-chart"]')
-      .exists('renders single chart with total clients');
-    assert
-      .dom('[data-test-attribution-subtext]')
-      .hasTextContaining('this month', 'renders total monthly namespace text');
-  });
-
-  test('it renders single chart and correct text for for date range', async function (assert) {
-    await render(hbs`
-      <Clients::Attribution
-        @totalClientAttribution={{this.totalClientAttribution}}
-        @totalUsageCounts={{this.totalUsageCounts}}
-        @responseTimestamp={{this.timestamp}}
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.timestamp}}
-        @selectedNamespace={{this.selectedNamespace}}
-        @isHistoricalMonth={{false}}
-        />
-    `);
-
-    assert
-      .dom('[data-test-chart-container="single-chart"]')
-      .exists('renders single chart with total clients');
-    assert
-      .dom('[data-test-attribution-subtext]')
-      .hasTextContaining('date range', 'renders total monthly namespace text');
-  });
-
-  test('it renders with data for selected namespace auth methods for a date range', async function (assert) {
-    this.set('selectedNamespace', 'second');
-    await render(hbs`
-      <Clients::Attribution
-        @totalClientAttribution={{this.namespaceMountsData}}
-        @totalUsageCounts={{this.totalUsageCounts}}
-        @responseTimestamp={{this.timestamp}}
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.timestamp}}
-        @selectedNamespace={{this.selectedNamespace}}
-        @isHistoricalMonth={{this.isHistoricalMonth}}
-        />
-    `);
-
-    assert.dom('[data-test-component="empty-state"]').doesNotExist();
-    assert.dom('[data-test-horizontal-bar-chart]').exists('chart displays');
-    assert.dom('[data-test-attribution-export-button]').exists();
-    assert
-      .dom('[data-test-attribution-description]')
-      .hasText(
-        'This data shows the top ten authentication methods by client count within this namespace, and can be used to understand where clients are originating. Authentication methods are organized by path.'
-      );
-    assert
-      .dom('[data-test-attribution-subtext]')
-      .hasText(
-        'The total clients used by the auth method for this date range. This number is useful for identifying overall usage volume.'
-      );
-    assert.dom('[data-test-top-attribution]').includesText('auth method').includesText('auth1/');
-    assert.dom('[data-test-attribution-clients]').includesText('auth method').includesText('3');
-  });
-
-  test('it renders modal', async function (assert) {
-    await render(hbs`
-      <Clients::Attribution
-        @totalClientAttribution={{this.namespaceMountsData}}
-        @responseTimestamp={{this.timestamp}}
-        @startTimestamp="2022-06-01T23:00:11.050Z"
-        @endTimestamp="2022-12-01T23:00:11.050Z"
-        />
-    `);
-    await click('[data-test-attribution-export-button]');
-    assert
-      .dom('[data-test-export-modal-title]')
-      .hasText('Export attribution data', 'modal appears to export csv');
-    assert.dom('[ data-test-export-date-range]').includesText('June 2022 - December 2022');
-  });
-});
diff --git a/ui/tests/integration/components/clients/config-test.js b/ui/tests/integration/components/clients/config-test.js
index 489f56b5138..42330ee79e1 100644
--- a/ui/tests/integration/components/clients/config-test.js
+++ b/ui/tests/integration/components/clients/config-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,7 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render, find, click, fillIn } from '@ember/test-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 
@@ -18,7 +19,7 @@ module('Integration | Component | client count config', function (hooks) {
     this.router = this.owner.lookup('service:router');
     this.transitionStub = sinon.stub(this.router, 'transitionTo');
     const store = this.owner.lookup('service:store');
-    this.createModel = (enabled = 'enable', reporting_enabled = false, minimum_retention_months = 24) => {
+    this.createModel = (enabled = 'enable', reporting_enabled = false, minimum_retention_months = 48) => {
       store.pushPayload('clients/config', {
         modelName: 'clients/config',
         id: 'foo',
@@ -26,7 +27,7 @@ module('Integration | Component | client count config', function (hooks) {
           enabled,
           reporting_enabled,
           minimum_retention_months,
-          retention_months: 24,
+          retention_months: 49,
         },
       });
       this.model = store.peekRecord('clients/config', 'foo');
@@ -46,18 +47,18 @@ module('Integration | Component | client count config', function (hooks) {
       'Enabled value matches model'
     );
     assert.ok(
-      find('[data-test-row-value="Retention period"]').textContent.includes('24'),
+      find('[data-test-row-value="Retention period"]').textContent.includes('49'),
       'Retention period value matches model'
     );
   });
 
   test('it should function in edit mode when reporting is disabled', async function (assert) {
-    assert.expect(12);
-
+    assert.expect(13);
+    const retentionMonths = 60;
     this.server.put('/sys/internal/counters/config', (schema, req) => {
       const { enabled, retention_months } = JSON.parse(req.requestBody);
-      const expected = { enabled: 'enable', retention_months: 24 };
-      assert.deepEqual(expected, { enabled, retention_months }, 'Correct data sent in PUT request');
+      const expected = { enabled: 'enable', retention_months: retentionMonths };
+      assert.deepEqual({ enabled, retention_months }, expected, 'Correct data sent in PUT request (1)');
       return {};
     });
 
@@ -71,20 +72,28 @@ module('Integration | Component | client count config', function (hooks) {
     assert
       .dom('label[for="enabled"]')
       .hasText('Data collection is off', 'Correct label renders when data collection is off');
-    assert.dom('[data-test-input="retentionMonths"]').hasValue('24', 'Retention months render');
+    assert.dom('[data-test-input="retentionMonths"]').hasValue('49', 'Retention months render');
 
     await click('[data-test-input="enabled"]');
-    await fillIn('[data-test-input="retentionMonths"]', -3);
-    await click('[data-test-clients-config-save]');
+    await fillIn('[data-test-input="retentionMonths"]', 20);
+    await click(GENERAL.submitButton);
     assert
-      .dom('[data-test-inline-error-message]')
+      .dom(GENERAL.validationErrorByAttr('retentionMonths'))
       .hasText(
-        'Retention period must be greater than or equal to 24.',
-        'Validation error shows for incorrect retention period'
+        'Retention period must be greater than or equal to 48.',
+        'Validation error shows for min retention period'
+      );
+    await fillIn('[data-test-input="retentionMonths"]', 90);
+    await click(GENERAL.submitButton);
+    assert
+      .dom(GENERAL.validationErrorByAttr('retentionMonths'))
+      .hasText(
+        'Retention period must be less than or equal to 60.',
+        'Validation error shows for max retention period'
       );
 
-    await fillIn('[data-test-input="retentionMonths"]', 24);
-    await click('[data-test-clients-config-save]');
+    await fillIn('[data-test-input="retentionMonths"]', retentionMonths);
+    await click(GENERAL.submitButton);
     assert
       .dom('[data-test-clients-config-modal="title"]')
       .hasText('Turn usage tracking on?', 'Correct modal title renders');
@@ -96,8 +105,11 @@ module('Integration | Component | client count config', function (hooks) {
       'Route transitions correctly on save success'
     );
 
+    // we need to close the modal
+    await click('[data-test-clients-config-modal="cancel"]');
+
     await click('[data-test-input="enabled"]');
-    await click('[data-test-clients-config-save]');
+    await click(GENERAL.submitButton);
     assert.dom('[data-test-clients-config-modal]').exists('Modal renders');
     assert
       .dom('[data-test-clients-config-modal="title"]')
@@ -114,7 +126,7 @@ module('Integration | Component | client count config', function (hooks) {
     this.server.put('/sys/internal/counters/config', (schema, req) => {
       const { enabled, retention_months } = JSON.parse(req.requestBody);
       const expected = { enabled: 'enable', retention_months: 48 };
-      assert.deepEqual(expected, { enabled, retention_months }, 'Correct data sent in PUT request');
+      assert.deepEqual({ enabled, retention_months }, expected, 'Correct data sent in PUT request (2)');
       return {};
     });
 
@@ -125,19 +137,19 @@ module('Integration | Component | client count config', function (hooks) {
     `);
 
     assert.dom('[data-test-input="enabled"]').doesNotExist('Data collection input not shown ');
-    assert.dom('[data-test-input="retentionMonths"]').hasValue('24', 'Retention months render');
+    assert.dom('[data-test-input="retentionMonths"]').hasValue('49', 'Retention months render');
 
     await fillIn('[data-test-input="retentionMonths"]', 5);
-    await click('[data-test-clients-config-save]');
+    await click(GENERAL.submitButton);
     assert
-      .dom('[data-test-inline-error-message]')
+      .dom(GENERAL.validationErrorByAttr('retentionMonths'))
       .hasText(
         'Retention period must be greater than or equal to 24.',
         'Validation error shows for incorrect retention period'
       );
 
     await fillIn('[data-test-input="retentionMonths"]', 48);
-    await click('[data-test-clients-config-save]');
+    await click(GENERAL.submitButton);
   });
 
   test('it should not show modal when data collection is not changed', async function (assert) {
@@ -145,8 +157,8 @@ module('Integration | Component | client count config', function (hooks) {
 
     this.server.put('/sys/internal/counters/config', (schema, req) => {
       const { enabled, retention_months } = JSON.parse(req.requestBody);
-      const expected = { enabled: 'enable', retention_months: 24 };
-      assert.deepEqual(expected, { enabled, retention_months }, 'Correct data sent in PUT request');
+      const expected = { enabled: 'enable', retention_months: 48 };
+      assert.deepEqual({ enabled, retention_months }, expected, 'Correct data sent in PUT request (3)');
       return {};
     });
 
@@ -155,7 +167,7 @@ module('Integration | Component | client count config', function (hooks) {
     await render(hbs`
       <Clients::Config @model={{this.model}} @mode="edit" />
     `);
-    await fillIn('[data-test-input="retentionMonths"]', 24);
-    await click('[data-test-clients-config-save]');
+    await fillIn('[data-test-input="retentionMonths"]', 48);
+    await click(GENERAL.submitButton);
   });
 });
diff --git a/ui/tests/integration/components/clients/counts/nav-bar-test.js b/ui/tests/integration/components/clients/counts/nav-bar-test.js
new file mode 100644
index 00000000000..2d8aaa641d3
--- /dev/null
+++ b/ui/tests/integration/components/clients/counts/nav-bar-test.js
@@ -0,0 +1,27 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | clients/counts/nav-bar', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.renderComponent = async () => {
+      await render(hbs`<Clients::Counts::NavBar />`);
+    };
+  });
+
+  test('it renders default tabs', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(GENERAL.tab('overview')).hasText('Overview');
+    assert.dom(GENERAL.tab('client list')).hasText('Client list');
+  });
+});
diff --git a/ui/tests/integration/components/clients/date-range-test.js b/ui/tests/integration/components/clients/date-range-test.js
new file mode 100644
index 00000000000..8b826a6d39b
--- /dev/null
+++ b/ui/tests/integration/components/clients/date-range-test.js
@@ -0,0 +1,129 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { click, fillIn, findAll, render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import Sinon from 'sinon';
+import timestamp from 'core/utils/timestamp';
+import { format } from 'date-fns';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CLIENT_COUNT } from 'vault/tests/helpers/clients/client-count-selectors';
+
+const DATE_RANGE = CLIENT_COUNT.dateRange;
+module('Integration | Component | clients/date-range', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    Sinon.replace(timestamp, 'now', Sinon.fake.returns(new Date('2018-04-03T14:15:30')));
+    this.now = timestamp.now();
+    this.startTimestamp = '2018-01-01T14:15:30';
+    this.endTimestamp = '2019-01-31T14:15:30';
+    this.billingStartTime = '';
+    this.retentionMonths = 48;
+    this.onChange = Sinon.spy();
+    this.setEditModalVisible = Sinon.stub().callsFake((visible) => {
+      this.set('showEditModal', visible);
+    });
+    this.showEditModal = false;
+    this.renderComponent = async () => {
+      await render(
+        hbs`<Clients::DateRange @startTimestamp={{this.startTimestamp}} @endTimestamp={{this.endTimestamp}} @onChange={{this.onChange}} @billingStartTime={{this.billingStartTime}} @retentionMonths={{this.retentionMonths}} @setEditModalVisible={{this.setEditModalVisible}} @showEditModal={{this.showEditModal}}/>`
+      );
+    };
+  });
+
+  test('it formats modal inputs to ISO string timestamps', async function (assert) {
+    this.startTimestamp = undefined;
+    await this.renderComponent();
+
+    assert.dom(DATE_RANGE.dateDisplay('start')).doesNotExist();
+    assert.dom(DATE_RANGE.dateDisplay('end')).doesNotExist();
+    assert.dom(DATE_RANGE.edit).hasText('Set date range');
+
+    await click(DATE_RANGE.edit);
+    assert.dom(DATE_RANGE.editModal).exists();
+    assert.dom(DATE_RANGE.editDate('start')).hasValue('');
+    await fillIn(DATE_RANGE.editDate('start'), '2018-01');
+    await fillIn(DATE_RANGE.editDate('end'), '2018-03');
+    await click(GENERAL.submitButton);
+    const { start_time, end_time } = this.onChange.lastCall.args[0];
+    assert.strictEqual(start_time, '2018-01-01T00:00:00Z', 'it formats start_time param');
+    assert.strictEqual(end_time, '2018-03-31T23:59:59Z', 'it formats end_time param');
+    assert.dom(DATE_RANGE.editModal).doesNotExist('closes modal');
+  });
+
+  test('it does not trigger onChange if dates are invalid', async function (assert) {
+    this.owner.lookup('service:version').type = 'community';
+    this.endTimestamp = undefined;
+    await this.renderComponent();
+    await click(DATE_RANGE.edit);
+    await fillIn(DATE_RANGE.editDate('end'), '');
+    assert.dom(DATE_RANGE.validation).hasText('You must supply both start and end dates.');
+    await click(GENERAL.submitButton);
+    assert.false(this.onChange.called);
+
+    await fillIn(DATE_RANGE.editDate('start'), '2018-01');
+    await fillIn(DATE_RANGE.editDate('end'), '2018-04');
+    assert.dom(DATE_RANGE.validation).hasText('You cannot select the current month or beyond.');
+    await fillIn(DATE_RANGE.editDate('end'), '2017-05');
+    assert.dom(DATE_RANGE.validation).hasText('Start date must be before end date.');
+    await click(GENERAL.submitButton);
+    assert.false(this.onChange.called);
+
+    await click(GENERAL.cancelButton);
+    assert.false(this.onChange.called);
+    assert.dom(DATE_RANGE.editModal).doesNotExist();
+  });
+
+  test('it does not allow the current month to be selected as a start date or as an end date', async function (assert) {
+    this.owner.lookup('service:version').type = 'community';
+    this.endTimestamp = undefined;
+    const currentMonth = format(timestamp.now(), 'yyyy-MM');
+
+    await this.renderComponent();
+    await click(DATE_RANGE.edit);
+    await fillIn(DATE_RANGE.editDate('start'), currentMonth);
+    await fillIn(DATE_RANGE.editDate('end'), currentMonth);
+
+    assert.dom(DATE_RANGE.validation).hasText('You cannot select the current month or beyond.');
+    await click(GENERAL.submitButton);
+    assert.false(this.onChange.called);
+
+    //  This tests validation when the end date is the current month and start is valid.
+    //  If start is current month and end is a valid prior selection, it will run into the validation error of start being after end date
+    //  which is covered by prior tests.
+    await fillIn(DATE_RANGE.editDate('start'), '2018-01');
+    await fillIn(DATE_RANGE.editDate('end'), currentMonth);
+    await click(GENERAL.submitButton);
+    assert.false(this.onChange.called);
+  });
+
+  module('enterprise', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version = this.owner.lookup('service:version');
+      this.version.type = 'enterprise';
+      this.billingStartTime = '2018-01-01T14:15:30';
+    });
+
+    test('it billing start date dropdown for enterprise', async function (assert) {
+      await this.renderComponent();
+      await click(DATE_RANGE.edit);
+      const expectedPeriods = [
+        'January 2018',
+        'January 2017',
+        'January 2016',
+        'January 2015',
+        'January 2014',
+      ];
+      const dropdownList = findAll(DATE_RANGE.dropdownOption(null));
+      dropdownList.forEach((item, idx) => {
+        const month = expectedPeriods[idx];
+        assert.dom(item).hasText(month, `dropdown index: ${idx} renders ${month}`);
+      });
+    });
+  });
+});
diff --git a/ui/tests/integration/components/clients/filter-toolbar-test.js b/ui/tests/integration/components/clients/filter-toolbar-test.js
new file mode 100644
index 00000000000..93126aaf028
--- /dev/null
+++ b/ui/tests/integration/components/clients/filter-toolbar-test.js
@@ -0,0 +1,447 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { click, fillIn, findAll, render, typeIn, waitUntil } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+import { FILTERS } from 'vault/tests/helpers/clients/client-count-selectors';
+import { ClientFilters } from 'core/utils/client-count-utils';
+import { parseAPITimestamp } from 'core/utils/date-formatters';
+
+module('Integration | Component | clients/filter-toolbar', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.generateData = ({ withTimestamps = false }) => {
+      const timestamps = [
+        '2025-04-27T07:36:21Z',
+        '2025-04-01T00:00:00Z',
+        '2025-03-21T05:36:21Z',
+        '2025-03-21T07:26:21Z',
+        '2025-02-06T03:36:21Z',
+        '2025-01-29T01:36:21Z',
+      ];
+      const data = [
+        { namespace_path: '', mount_type: 'userpass/', mount_path: 'auth/auto/eng/core/auth/core-gh-auth/' },
+        { namespace_path: '', mount_type: 'userpass/', mount_path: 'auth/auto/eng/core/auth/core-gh-auth/' },
+        { namespace_path: '', mount_type: 'userpass/', mount_path: 'auth/userpass-root/' },
+        { namespace_path: 'admin/', mount_type: 'token/', mount_path: 'auth/token/' },
+        { namespace_path: 'ns1/', mount_type: 'token/', mount_path: 'auth/token/' },
+        { namespace_path: 'ns1/', mount_type: 'ns_token/', mount_path: 'auth/token/' },
+      ];
+      // Only activity export data from Vault versions 1.21 or later will have a `client_first_used_time`
+      return withTimestamps
+        ? data.map((d, idx) => ({ ...d, client_first_used_time: timestamps[idx] }))
+        : data;
+    };
+
+    this.onFilter = sinon.spy();
+    this.filterQueryParams = { namespace_path: '', mount_path: '', mount_type: '', month: '' };
+    this.dataset = undefined;
+    this.dropdownMonths = undefined;
+    this.isExportData = undefined;
+    this.renderComponent = async () => {
+      await render(hbs`
+    <Clients::FilterToolbar
+      @dataset={{this.dataset}}
+      @onFilter={{this.onFilter}}
+      @filterQueryParams={{this.filterQueryParams}}
+      @isExportData={{this.isExportData}}
+      @dropdownMonths={{this.dropdownMonths}}
+    />`);
+    };
+
+    this.presetFilters = () => {
+      this.filterQueryParams = {
+        namespace_path: 'admin/',
+        mount_path: 'auth/userpass-root/',
+        mount_type: 'token/',
+        month: '2025-04-01T00:00:00Z',
+      };
+    };
+
+    this.selectFilters = async () => {
+      // select namespace
+      await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+      await click(FILTERS.dropdownItem('admin/'));
+      // select mount path
+      await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+      await click(FILTERS.dropdownItem('auth/userpass-root/'));
+      // select mount type
+      await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+      await click(FILTERS.dropdownItem('token/'));
+      // select month
+      await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+      await click(FILTERS.dropdownItem('2025-04-01T00:00:00Z'));
+    };
+  });
+
+  test('it renders dropdowns when there is no data', async function (assert) {
+    await this.renderComponent();
+    assert.dom(FILTERS.dropdownToggle(ClientFilters.NAMESPACE)).hasText('Namespace');
+    assert.dom(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH)).hasText('Mount path');
+    assert.dom(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE)).hasText('Mount type');
+    assert.dom(FILTERS.dropdownToggle(ClientFilters.MONTH)).hasText('Month');
+    assert.dom(FILTERS.tagContainer).hasText('Filters applied: None');
+  });
+
+  test('it renders dropdown items and does not include duplicates', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    await this.renderComponent();
+    const expectedNamespaces = ['root', 'admin/', 'ns1/'];
+    const expectedMountPaths = [
+      'auth/auto/eng/core/auth/core-gh-auth/',
+      'auth/userpass-root/',
+      'auth/token/',
+    ];
+    const expectedMountTypes = ['userpass/', 'token/', 'ns_token/'];
+    // The component normalizes timestamps to the first of the month
+    const expectedMonths = [
+      '2025-04-01T00:00:00Z',
+      '2025-03-01T00:00:00Z',
+      '2025-02-01T00:00:00Z',
+      '2025-01-01T00:00:00Z',
+    ];
+
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    assert.dom('li button').exists({ count: 3 }, 'list renders 3 namespaces');
+    findAll('li button').forEach((item, idx) => {
+      const ns = expectedNamespaces[idx];
+      const msg =
+        idx === 0 ? 'it renders empty string as "root" namespace_path' : `it renders namespace_path: ${ns}`;
+      assert.dom(item).hasText(ns, msg);
+    });
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    assert.dom('li button').exists({ count: 3 }, 'list renders 3 mount paths');
+    findAll('li button').forEach((item, idx) => {
+      const m = expectedMountPaths[idx];
+      assert.dom(item).hasText(m, `it renders mount_path: ${m}`);
+    });
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    assert.dom('li button').exists({ count: 3 }, 'list renders 3 mount types');
+    findAll('li button').forEach((item, idx) => {
+      const m = expectedMountTypes[idx];
+      assert.dom(item).hasText(m, `it renders mount_type: ${m}`);
+    });
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    assert.dom('li button').exists({ count: 4 }, 'list renders 4 months');
+    findAll('li button').forEach((item, idx) => {
+      const m = expectedMonths[idx];
+      const display = parseAPITimestamp(m, 'MMMM yyyy');
+      assert.dom(item).hasText(display, `it renders month: ${m}`);
+    });
+  });
+
+  test('it renders months passed in as an arg instead of from dataset', async function (assert) {
+    // Include timestamps in the dataset AND pass in months to ensure @dropdownMonths overrides the timestamps in dataset
+    this.dataset = this.generateData({ withTimestamps: true });
+    this.dropdownMonths = ['2025-10-01T07:36:21Z', '2025-09-01T02:38:21Z', '2025-08-01T03:56:21Z'];
+    await this.renderComponent();
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    assert.dom('li button').exists({ count: 3 }, 'list renders 3 months');
+    findAll('li button').forEach((item, idx) => {
+      const m = this.dropdownMonths[idx];
+      const display = parseAPITimestamp(m, 'MMMM yyyy');
+      assert.dom(item).hasText(display, `it renders month: ${m}`);
+    });
+  });
+
+  test('it searches dropdown items', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    await this.renderComponent();
+
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    await fillIn(FILTERS.dropdownSearch(ClientFilters.NAMESPACE), 'n');
+    let dropdownItems = findAll('li button');
+    await waitUntil(() => dropdownItems.length === 2);
+    assert.dom('ul').hasText('admin/ ns1/', 'it renders matching namespaces');
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    await typeIn(FILTERS.dropdownSearch(ClientFilters.MOUNT_PATH), 'eng');
+    dropdownItems = findAll('li button');
+    await waitUntil(() => dropdownItems.length === 1);
+    assert.dom('ul').hasText('auth/auto/eng/core/auth/core-gh-auth/', 'it renders matching mount paths');
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    await typeIn(FILTERS.dropdownSearch(ClientFilters.MOUNT_TYPE), 'token');
+    dropdownItems = findAll('li button');
+    await waitUntil(() => dropdownItems.length === 2);
+    assert.dom('ul').hasText('token/ ns_token/', 'it renders matching mount types');
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    await typeIn(FILTERS.dropdownSearch(ClientFilters.MONTH), 'y');
+    dropdownItems = findAll('li button');
+    await waitUntil(() => dropdownItems.length === 2);
+    assert.dom('ul').hasText('February 2025 January 2025', 'it renders matching months');
+    // Months can be searched by the ISO timestamp or the display value
+    await fillIn(FILTERS.dropdownSearch(ClientFilters.MONTH), '4');
+    dropdownItems = findAll('li button');
+    await waitUntil(() => dropdownItems.length === 1);
+    assert.dom('ul').hasText('April 2025', 'it renders matching months');
+
+    // Re-open each dropdown to confirm search input and dropdown reset after close
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    assert.dom('ul').hasText('root admin/ ns1/', 'namespace dropdown resets on close');
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    assert
+      .dom('ul')
+      .hasText(
+        'auth/auto/eng/core/auth/core-gh-auth/ auth/userpass-root/ auth/token/',
+        'mount path dropdown resets on close'
+      );
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    assert.dom('ul').hasText('userpass/ token/ ns_token/', 'mount types dropdown resets on close');
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    assert
+      .dom('ul')
+      .hasText('April 2025 March 2025 February 2025 January 2025', 'months dropdown resets on close');
+  });
+
+  test('it searches and renders no matches found message', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    await this.renderComponent();
+
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    await fillIn(FILTERS.dropdownSearch(ClientFilters.NAMESPACE), 'no matches');
+    let dropdownItems = findAll('li button');
+    await waitUntil(() => dropdownItems.length === 0);
+    assert.dom('ul').hasText('No matching namespaces');
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    await fillIn(FILTERS.dropdownSearch(ClientFilters.MOUNT_PATH), 'no matches');
+    dropdownItems = findAll('li button');
+    await waitUntil(() => dropdownItems.length === 0);
+    assert.dom('ul').hasText('No matching mount paths');
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    await fillIn(FILTERS.dropdownSearch(ClientFilters.MOUNT_TYPE), 'no matches');
+    dropdownItems = findAll('li button');
+    await waitUntil(() => dropdownItems.length === 0);
+    assert.dom('ul').hasText('No matching mount types');
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    await fillIn(FILTERS.dropdownSearch(ClientFilters.MONTH), 'no matches');
+    dropdownItems = findAll('li button');
+    await waitUntil(() => dropdownItems.length === 0);
+    assert.dom('ul').hasText('No matching months');
+  });
+
+  test('it renders no items to filter if dropdown is empty', async function (assert) {
+    this.dataset = [{ namespace_path: null, mount_type: null, mount_path: null, months: null }];
+    await this.renderComponent();
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    assert.dom('ul').hasText('No namespaces to filter');
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    assert.dom('ul').hasText('No mount paths to filter');
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    assert.dom('ul').hasText('No mount types to filter');
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    assert.dom('ul').hasText('No months to filter');
+  });
+
+  test('it renders version message when no month data exists and @isExportData is true', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: false });
+    this.isExportData = true;
+    await this.renderComponent();
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    assert
+      .dom('ul')
+      .hasText(
+        'Filtering by month is only available for clients initially used after upgrading to version 1.21.'
+      );
+  });
+
+  test('it renders no months to filter message when data has no client_first_used_time', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: false });
+    await this.renderComponent();
+    assert.dom(FILTERS.dropdownToggle(ClientFilters.MONTH)).hasText('Month');
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    assert.dom('ul').hasText('No months to filter');
+  });
+
+  test('it renders no months to filter message when @dropdownMonths is empty', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    this.dropdownMonths = [];
+    await this.renderComponent();
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    assert.dom('ul').hasText('No months to filter');
+  });
+
+  test('it renders no items to filter if dataset does not contain expected keys', async function (assert) {
+    this.dataset = [{ foo: null, bar: null, baz: null }];
+    await this.renderComponent();
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    assert.dom('ul').hasText('No namespaces to filter');
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    assert.dom('ul').hasText('No mount paths to filter');
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    assert.dom('ul').hasText('No mount types to filter');
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    assert.dom('ul').hasText('No months to filter');
+  });
+
+  test('it selects dropdown items and renders a filter tag', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    await this.renderComponent();
+
+    // select namespace
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    await click(FILTERS.dropdownItem('admin/'));
+    assert.dom(FILTERS.tag(ClientFilters.NAMESPACE, 'admin/')).exists();
+    assert.dom(FILTERS.tag()).exists({ count: 1 }, '1 filter tag renders');
+    // dropdown should close after an item is selected, reopen to assert the correct item is selected
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    assert.dom(FILTERS.dropdownItem('admin/')).hasAttribute('aria-selected', 'true');
+    assert.dom(`${FILTERS.dropdownItem('admin/')} ${GENERAL.icon('check')}`).exists();
+
+    // select mount path
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    await click(FILTERS.dropdownItem('auth/userpass-root/'));
+    assert.dom(FILTERS.tag(ClientFilters.MOUNT_PATH, 'auth/userpass-root/')).exists();
+    assert.dom(FILTERS.tag()).exists({ count: 2 }, '2 filter tags render');
+    // dropdown should close after an item is selected, reopen to assert the correct item is selected
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    assert.dom(FILTERS.dropdownItem('auth/userpass-root/')).hasAttribute('aria-selected', 'true');
+    assert.dom(`${FILTERS.dropdownItem('auth/userpass-root/')} ${GENERAL.icon('check')}`).exists();
+
+    // select mount type
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    await click(FILTERS.dropdownItem('token/'));
+    assert.dom(FILTERS.tag(ClientFilters.MOUNT_TYPE, 'token/')).exists();
+    assert.dom(FILTERS.tag()).exists({ count: 3 }, '3 filter tags render');
+    // dropdown should close after an item is selected, reopen to assert the correct item is selected
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    assert.dom(FILTERS.dropdownItem('token/')).hasAttribute('aria-selected', 'true');
+    assert.dom(`${FILTERS.dropdownItem('token/')} ${GENERAL.icon('check')}`).exists();
+
+    // select month
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    await click(FILTERS.dropdownItem('2025-02-01T00:00:00Z'));
+    assert.dom(FILTERS.tag(ClientFilters.MONTH, '2025-02-01T00:00:00Z')).exists();
+    assert.dom(FILTERS.tag()).exists({ count: 4 }, '4 filter tags render');
+    // dropdown should close after an item is selected, reopen to assert the correct item is selected
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    assert.dom(FILTERS.dropdownItem('2025-02-01T00:00:00Z')).hasAttribute('aria-selected', 'true');
+    assert.dom(`${FILTERS.dropdownItem('2025-02-01T00:00:00Z')} ${GENERAL.icon('check')}`).exists();
+  });
+
+  test('it fires callback when a filter is selected', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    await this.renderComponent();
+
+    // select namespace
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    await click(FILTERS.dropdownItem('admin/'));
+    let lastCall = this.onFilter.lastCall.args[0];
+    // this.filterQueryParams has empty values for each filter type
+    let expectedObject = { ...this.filterQueryParams, [ClientFilters.NAMESPACE]: 'admin/' };
+    assert.propEqual(lastCall, expectedObject, `callback includes value for ${ClientFilters.NAMESPACE}`);
+
+    // select mount path
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    await click(FILTERS.dropdownItem('auth/userpass-root/'));
+    lastCall = this.onFilter.lastCall.args[0];
+    expectedObject = { ...expectedObject, [ClientFilters.MOUNT_PATH]: 'auth/userpass-root/' };
+    assert.propEqual(lastCall, expectedObject, `callback includes value for ${ClientFilters.MOUNT_PATH}`);
+
+    // select mount type
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    await click(FILTERS.dropdownItem('token/'));
+    lastCall = this.onFilter.lastCall.args[0];
+    expectedObject = { ...expectedObject, [ClientFilters.MOUNT_TYPE]: 'token/' };
+    assert.propEqual(lastCall, expectedObject, `callback includes value for ${ClientFilters.MOUNT_TYPE}`);
+  });
+
+  test('it renders filter tags when initialized with @filterQueryParams', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    this.presetFilters();
+    await this.renderComponent();
+
+    assert.dom(FILTERS.tag()).exists({ count: 4 }, '4 filter tags render');
+    assert.dom(FILTERS.tag(ClientFilters.NAMESPACE, 'admin/')).exists();
+    assert.dom(FILTERS.tag(ClientFilters.MOUNT_PATH, 'auth/userpass-root/')).exists();
+    assert.dom(FILTERS.tag(ClientFilters.MOUNT_TYPE, 'token/')).exists();
+    assert.dom(FILTERS.tag(ClientFilters.MONTH, '2025-04-01T00:00:00Z')).exists();
+  });
+
+  test('it updates filters tags when initialized with @filterQueryParams', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    this.filterQueryParams = {
+      namespace_path: 'ns1/',
+      mount_path: 'auth/token/',
+      mount_type: 'ns_token/',
+      month: '2025-03-01T00:00:00Z',
+    };
+    await this.renderComponent();
+    // Check initial filters
+    assert
+      .dom(FILTERS.tagContainer)
+      .hasText('Filters applied: ns1/ auth/token/ ns_token/ March 2025 Clear filters');
+    // Change filters and confirm callback has updated values
+    await this.selectFilters();
+    const [afterUpdate] = this.onFilter.lastCall.args;
+    assert.propEqual(
+      afterUpdate,
+      {
+        namespace_path: 'admin/',
+        mount_path: 'auth/userpass-root/',
+        mount_type: 'token/',
+        month: '2025-04-01T00:00:00Z',
+      },
+      'callback fires with updated selection'
+    );
+    assert
+      .dom(FILTERS.tagContainer)
+      .hasText('Filters applied: admin/ auth/userpass-root/ token/ April 2025 Clear filters');
+  });
+
+  test('it clears all filters', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    this.presetFilters();
+    await this.renderComponent();
+    await click(GENERAL.button('Clear filters'));
+    const [afterClear] = this.onFilter.lastCall.args;
+    assert.propEqual(
+      afterClear,
+      { namespace_path: '', mount_path: '', mount_type: '', month: '' },
+      'onFilter callback has empty values when "Clear filters" is clicked'
+    );
+    assert.dom(FILTERS.tagContainer).hasText('Filters applied: None');
+  });
+
+  test('it clears individual filters', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    this.presetFilters();
+    await this.renderComponent();
+    await click(FILTERS.clearTag('admin/'));
+    const afterClear = this.onFilter.lastCall.args[0];
+    assert.propEqual(
+      afterClear,
+      {
+        namespace_path: '',
+        mount_path: 'auth/userpass-root/',
+        mount_type: 'token/',
+        month: '2025-04-01T00:00:00Z',
+      },
+      'onFilter callback fires with empty namespace_path'
+    );
+  });
+
+  test('it renders an alert when initialized with @filterQueryParams that are not present in the dropdown', async function (assert) {
+    this.dataset = this.generateData({ withTimestamps: true });
+    this.filterQueryParams = { namespace_path: 'admin/', mount_path: '', mount_type: 'banana', month: '' };
+    await this.renderComponent();
+    assert.dom(FILTERS.tag()).exists({ count: 2 }, '2 filter tags render');
+    assert.dom(FILTERS.tagContainer).hasText('Filters applied: admin/ banana Clear filters');
+    assert.dom(GENERAL.inlineAlert).hasText(`Mount type "banana" not found in the current data.`);
+  });
+});
diff --git a/ui/tests/integration/components/clients/horizontal-bar-chart-test.js b/ui/tests/integration/components/clients/horizontal-bar-chart-test.js
deleted file mode 100644
index bea40d8c8c8..00000000000
--- a/ui/tests/integration/components/clients/horizontal-bar-chart-test.js
+++ /dev/null
@@ -1,92 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { findAll, render } from '@ember/test-helpers';
-import { hbs } from 'ember-cli-htmlbars';
-
-module('Integration | Component | clients/horizontal-bar-chart', function (hooks) {
-  setupRenderingTest(hooks);
-  hooks.beforeEach(function () {
-    this.set('chartLegend', [
-      { label: 'entity clients', key: 'entity_clients' },
-      { label: 'non-entity clients', key: 'non_entity_clients' },
-    ]);
-  });
-
-  test('it renders chart and tooltip', async function (assert) {
-    const totalObject = { clients: 5, entity_clients: 2, non_entity_clients: 3 };
-    const dataArray = [
-      { label: 'second', clients: 3, entity_clients: 1, non_entity_clients: 2 },
-      { label: 'first', clients: 2, entity_clients: 1, non_entity_clients: 1 },
-    ];
-    this.set('totalCounts', totalObject);
-    this.set('totalClientAttribution', dataArray);
-
-    await render(hbs`
-    <Clients::HorizontalBarChart
-      @dataset={{this.totalClientAttribution}}
-      @chartLegend={{this.chartLegend}}
-      @totalCounts={{this.totalCounts}}
-    />`);
-
-    assert.dom('[data-test-horizontal-bar-chart]').exists();
-    const dataBars = findAll('[data-test-horizontal-bar-chart] rect.data-bar');
-    const actionBars = findAll('[data-test-horizontal-bar-chart] rect.action-bar');
-
-    assert.strictEqual(actionBars.length, dataArray.length, 'renders correct number of hover bars');
-    assert.strictEqual(dataBars.length, dataArray.length * 2, 'renders correct number of data bars');
-
-    const textLabels = this.element.querySelectorAll('[data-test-horizontal-bar-chart] .tick text');
-    const textTotals = this.element.querySelectorAll('[data-test-horizontal-bar-chart] text.total-value');
-    textLabels.forEach((label, index) => {
-      assert.dom(label).hasText(dataArray[index].label, 'label renders correct text');
-    });
-    textTotals.forEach((label, index) => {
-      assert.dom(label).hasText(`${dataArray[index].clients}`, 'total value renders correct number');
-    });
-
-    // FLAKY after adding a11y testing, skip for now
-    // for (const [i, bar] of actionBars.entries()) {
-    //   const percent = Math.round((dataArray[i].clients / totalObject.clients) * 100);
-    //   await triggerEvent(bar, 'mouseover');
-    //   const tooltip = document.querySelector('.ember-modal-dialog');
-    //   assert.dom(tooltip).includesText(`${percent}%`, 'tooltip renders correct percentage');
-    // }
-  });
-
-  test('it renders data with a large range', async function (assert) {
-    const totalObject = { clients: 5929393, entity_clients: 1391997, non_entity_clients: 4537396 };
-    const dataArray = [
-      { label: 'second', clients: 5929093, entity_clients: 1391896, non_entity_clients: 4537100 },
-      { label: 'first', clients: 300, entity_clients: 101, non_entity_clients: 296 },
-    ];
-    this.set('totalCounts', totalObject);
-    this.set('totalClientAttribution', dataArray);
-
-    await render(hbs`
-    <Clients::HorizontalBarChart
-      @dataset={{this.totalClientAttribution}}
-      @chartLegend={{this.chartLegend}}
-      @totalCounts={{this.totalCounts}}
-    />`);
-
-    assert.dom('[data-test-horizontal-bar-chart]').exists();
-    const dataBars = findAll('[data-test-horizontal-bar-chart] rect.data-bar');
-    const actionBars = findAll('[data-test-horizontal-bar-chart] rect.action-bar');
-
-    assert.strictEqual(actionBars.length, dataArray.length, 'renders correct number of hover bars');
-    assert.strictEqual(dataBars.length, dataArray.length * 2, 'renders correct number of data bars');
-
-    // FLAKY after adding a11y testing, skip for now
-    // for (const [i, bar] of actionBars.entries()) {
-    //   const percent = Math.round((dataArray[i].clients / totalObject.clients) * 100);
-    //   await triggerEvent(bar, 'mouseover');
-    //   const tooltip = document.querySelector('.ember-modal-dialog');
-    //   assert.dom(tooltip).includesText(`${percent}%`, 'tooltip renders correct percentage');
-    // }
-  });
-});
diff --git a/ui/tests/integration/components/clients/line-chart-test.js b/ui/tests/integration/components/clients/line-chart-test.js
deleted file mode 100644
index e3f76de34a5..00000000000
--- a/ui/tests/integration/components/clients/line-chart-test.js
+++ /dev/null
@@ -1,399 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import sinon from 'sinon';
-import { setupRenderingTest } from 'ember-qunit';
-import { find, render, findAll } from '@ember/test-helpers';
-import { hbs } from 'ember-cli-htmlbars';
-import { format, formatRFC3339, subMonths } from 'date-fns';
-import timestamp from 'core/utils/timestamp';
-
-module('Integration | Component | clients/line-chart', function (hooks) {
-  setupRenderingTest(hooks);
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => new Date('2018-04-03T14:15:30'));
-  });
-  hooks.beforeEach(function () {
-    this.set('xKey', 'foo');
-    this.set('yKey', 'bar');
-    this.set('dataset', [
-      {
-        foo: '2018-04-03T14:15:30',
-        bar: 4,
-        expectedLabel: '4/18',
-      },
-      {
-        foo: '2018-05-03T14:15:30',
-        bar: 8,
-        expectedLabel: '5/18',
-      },
-      {
-        foo: '2018-06-03T14:15:30',
-        bar: 14,
-        expectedLabel: '6/18',
-      },
-      {
-        foo: '2018-07-03T14:15:30',
-        bar: 10,
-        expectedLabel: '7/18',
-      },
-    ]);
-  });
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
-
-  test('it renders', async function (assert) {
-    await render(hbs`
-    <div class="chart-container-wide">
-      <Clients::Charts::Line @dataset={{this.dataset}} @xKey={{this.xKey}} @yKey={{this.yKey}} />
-      </div>
-    `);
-
-    assert.dom('[data-test-line-chart]').exists('Chart is rendered');
-    assert
-      .dom('[data-test-line-chart="plot-point"]')
-      .exists({ count: this.dataset.length }, `renders ${this.dataset.length} plot points`);
-    findAll('[data-test-x-axis] text').forEach((e, i) => {
-      // For some reason the first axis label is not rendered
-      assert
-        .dom(e)
-        .hasText(
-          `${this.dataset[i].expectedLabel}`,
-          `renders x-axis label: ${this.dataset[i].expectedLabel}`
-        );
-    });
-    assert.dom('[data-test-y-axis] text').hasText('0', `y-axis starts at 0`);
-  });
-
-  test('it renders upgrade data', async function (assert) {
-    const now = timestamp.now();
-    this.set('dataset', [
-      {
-        foo: formatRFC3339(subMonths(now, 4)),
-        bar: 4,
-        month: format(subMonths(now, 4), 'M/yy'),
-      },
-      {
-        foo: formatRFC3339(subMonths(now, 3)),
-        bar: 8,
-        month: format(subMonths(now, 3), 'M/yy'),
-      },
-      {
-        foo: formatRFC3339(subMonths(now, 2)),
-        bar: 14,
-        month: format(subMonths(now, 2), 'M/yy'),
-      },
-      {
-        foo: formatRFC3339(subMonths(now, 1)),
-        bar: 10,
-        month: format(subMonths(now, 1), 'M/yy'),
-      },
-    ]);
-    this.set('upgradeData', [
-      {
-        id: '1.10.1',
-        previousVersion: '1.9.2',
-        timestampInstalled: formatRFC3339(subMonths(now, 2)),
-      },
-    ]);
-    await render(hbs`
-    <div class="chart-container-wide">
-      <Clients::Charts::Line
-        @dataset={{this.dataset}}
-        @upgradeData={{this.upgradeData}}
-        @xKey={{this.xKey}}
-        @yKey={{this.yKey}}
-      />
-    </div>
-    `);
-    assert.dom('[data-test-line-chart]').exists('Chart is rendered');
-    assert
-      .dom('[data-test-line-chart="plot-point"]')
-      .exists({ count: this.dataset.length }, `renders ${this.dataset.length} plot points`);
-    assert
-      .dom(find(`[data-test-line-chart="upgrade-${this.dataset[2].month}"]`))
-      .hasStyle(
-        { fill: 'rgb(253, 238, 186)' },
-        `upgrade data point ${this.dataset[2].month} has yellow highlight`
-      );
-  });
-
-  test('it renders tooltip', async function (assert) {
-    assert.expect(1);
-    const now = timestamp.now();
-    const tooltipData = [
-      {
-        month: format(subMonths(now, 4), 'M/yy'),
-        timestamp: formatRFC3339(subMonths(now, 4)),
-        clients: 4,
-        new_clients: {
-          clients: 0,
-        },
-      },
-      {
-        month: format(subMonths(now, 3), 'M/yy'),
-        timestamp: formatRFC3339(subMonths(now, 3)),
-        clients: 8,
-        new_clients: {
-          clients: 4,
-        },
-      },
-      {
-        month: format(subMonths(now, 2), 'M/yy'),
-        timestamp: formatRFC3339(subMonths(now, 2)),
-        clients: 14,
-        new_clients: {
-          clients: 6,
-        },
-      },
-      {
-        month: format(subMonths(now, 1), 'M/yy'),
-        timestamp: formatRFC3339(subMonths(now, 1)),
-        clients: 20,
-        new_clients: {
-          clients: 4,
-        },
-      },
-    ];
-    this.set('dataset', tooltipData);
-    this.set('upgradeData', [
-      {
-        id: '1.10.1',
-        previousVersion: '1.9.2',
-        timestampInstalled: formatRFC3339(subMonths(now, 2)),
-      },
-    ]);
-    await render(hbs`
-    <div class="chart-container-wide">
-      <Clients::Charts::Line
-        @dataset={{this.dataset}}
-        @upgradeData={{this.upgradeData}}
-      />
-    </div>
-    `);
-
-    const tooltipHoverCircles = findAll('[data-test-hover-circle]');
-    assert.strictEqual(tooltipHoverCircles.length, tooltipData.length, 'all data circles are rendered');
-
-    // FLAKY after adding a11y testing, skip for now
-    // for (const [i, bar] of tooltipHoverCircles.entries()) {
-    //   await triggerEvent(bar, 'mouseover');
-    //   const tooltip = document.querySelector('.ember-modal-dialog');
-    //   const { month, clients, new_clients } = tooltipData[i];
-    //   assert
-    //     .dom(tooltip)
-    //     .includesText(
-    //       `${formatChartDate(month)} ${clients} total clients ${new_clients.clients} new clients`,
-    //       `tooltip text is correct for ${month}`
-    //     );
-    // }
-  });
-
-  test('it fails gracefully when data is not formatted correctly', async function (assert) {
-    this.set('dataset', [
-      {
-        foo: 1,
-        bar: 4,
-      },
-      {
-        foo: 2,
-        bar: 8,
-      },
-      {
-        foo: 3,
-        bar: 14,
-      },
-      {
-        foo: 4,
-        bar: 10,
-      },
-    ]);
-    await render(hbs`
-    <div class="chart-container-wide">
-      <Clients::Charts::Line
-        @dataset={{this.dataset}}
-        @xKey={{this.xKey}}
-        @yKey={{this.yKey}}
-      />
-    </div>
-    `);
-
-    assert.dom('[data-test-line-chart]').doesNotExist('Chart is not rendered');
-    assert
-      .dom('[data-test-component="empty-state"]')
-      .hasText('No data to display', 'Shows empty state when time date is not formatted correctly');
-  });
-
-  test('it fails gracefully when upgradeData is an object', async function (assert) {
-    this.set('upgradeData', { some: 'object' });
-    await render(hbs`
-    <div class="chart-container-wide">
-    <Clients::Charts::Line
-    @dataset={{this.dataset}}
-    @upgradeData={{this.upgradeData}}
-    @xKey={{this.xKey}}
-    @yKey={{this.yKey}}
-    />
-    </div>
-    `);
-
-    assert
-      .dom('[data-test-line-chart="plot-point"]')
-      .exists({ count: this.dataset.length }, 'chart still renders when upgradeData is not an array');
-  });
-
-  test('it fails gracefully when upgradeData has incorrect key names', async function (assert) {
-    this.set('upgradeData', [{ incorrect: 'key names' }]);
-    await render(hbs`
-    <div class="chart-container-wide">
-    <Clients::Charts::Line
-    @dataset={{this.dataset}}
-    @upgradeData={{this.upgradeData}}
-    @xKey={{this.xKey}}
-    @yKey={{this.yKey}}
-    />
-    </div>
-    `);
-
-    assert
-      .dom('[data-test-line-chart="plot-point"]')
-      .exists({ count: this.dataset.length }, 'chart still renders when upgradeData has incorrect keys');
-  });
-
-  test('it renders empty state when no dataset', async function (assert) {
-    await render(hbs`
-    <div class="chart-container-wide">
-    <Clients::Charts::Line @noDataMessage="this is a custom message to explain why you're not seeing a line chart"/>
-    </div>
-    `);
-
-    assert.dom('[data-test-component="empty-state"]').exists('renders empty state when no data');
-    assert
-      .dom('[data-test-empty-state-subtext]')
-      .hasText(
-        `this is a custom message to explain why you're not seeing a line chart`,
-        'custom message renders'
-      );
-  });
-
-  test('it updates axis when dataset updates', async function (assert) {
-    const datasets = {
-      small: [
-        {
-          foo: '2020-04-01',
-          bar: 4,
-          month: '4/20',
-        },
-        {
-          foo: '2020-05-01',
-          bar: 8,
-          month: '5/20',
-        },
-        {
-          foo: '2020-06-01',
-          bar: 1,
-        },
-        {
-          foo: '2020-07-01',
-          bar: 10,
-        },
-      ],
-      large: [
-        {
-          foo: '2020-08-01',
-          bar: 4586,
-          month: '8/20',
-        },
-        {
-          foo: '2020-09-01',
-          bar: 8928,
-          month: '9/20',
-        },
-        {
-          foo: '2020-10-01',
-          bar: 11948,
-          month: '10/20',
-        },
-        {
-          foo: '2020-11-01',
-          bar: 16943,
-          month: '11/20',
-        },
-      ],
-      broken: [
-        {
-          foo: '2020-01-01',
-          bar: null,
-          month: '1/20',
-        },
-        {
-          foo: '2020-02-01',
-          bar: 0,
-          month: '2/20',
-        },
-        {
-          foo: '2020-03-01',
-          bar: 22,
-          month: '3/20',
-        },
-        {
-          foo: '2020-04-01',
-          bar: null,
-          month: '4/20',
-        },
-        {
-          foo: '2020-05-01',
-          bar: 70,
-          month: '5/20',
-        },
-        {
-          foo: '2020-06-01',
-          bar: 50,
-          month: '6/20',
-        },
-      ],
-    };
-    this.set('dataset', datasets.small);
-    await render(hbs`
-    <div class="chart-container-wide">
-      <Clients::Charts::Line
-        @dataset={{this.dataset}}
-        @upgradeData={{this.upgradeData}}
-        @xKey={{this.xKey}}
-        @yKey={{this.yKey}}
-      />
-    </div>
-    `);
-    assert.dom('[data-test-y-axis]').hasText('0 2 4 6 8 10', 'y-axis renders correctly for small values');
-    assert
-      .dom('[data-test-x-axis]')
-      .hasText('4/20 5/20 6/20 7/20', 'x-axis renders correctly for small values');
-
-    // Update to large dataset
-    this.set('dataset', datasets.large);
-    assert.dom('[data-test-y-axis]').hasText('0 5k 10k 15k', 'y-axis renders correctly for new large values');
-    assert
-      .dom('[data-test-x-axis]')
-      .hasText('8/20 9/20 10/20 11/20', 'x-axis renders correctly for small values');
-
-    // Update to broken dataset
-    this.set('dataset', datasets.broken);
-    assert.dom('[data-test-y-axis]').hasText('0 20 40 60', 'y-axis renders correctly for new broken values');
-    assert
-      .dom('[data-test-x-axis]')
-      .hasText('1/20 2/20 3/20 4/20 5/20 6/20', 'x-axis renders correctly for small values');
-    assert.dom('[data-test-hover-circle]').exists({ count: 4 }, 'only render circles for non-null values');
-
-    assert
-      .dom('[data-test-hover-circle="1/20"]')
-      .doesNotExist('first month dot does not exist because value is null');
-    assert
-      .dom('[data-test-hover-circle="4/20"]')
-      .doesNotExist('other null count month dot also does not render');
-    // Note: the line should also show a gap, but this is difficult to test for
-  });
-});
diff --git a/ui/tests/integration/components/clients/no-data-test.js b/ui/tests/integration/components/clients/no-data-test.js
new file mode 100644
index 00000000000..ffa300e79d9
--- /dev/null
+++ b/ui/tests/integration/components/clients/no-data-test.js
@@ -0,0 +1,93 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+
+module('Integration | Component | clients/no-data', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
+    this.store = this.owner.lookup('service:store');
+    this.setConfig = async (data) => {
+      // the clients/config model does some funky serializing for the "enabled" param
+      // so stubbing the request here instead of just the model for additional coverage
+      this.server.get('sys/internal/counters/config', () => {
+        return {
+          request_id: '25a94b99-b49a-c4ac-cb7b-5ba0eb390a25',
+          data,
+        };
+      });
+      return this.store.queryRecord('clients/config', {});
+    };
+    this.renderComponent = async () => {
+      return render(hbs`<Clients::NoData @config={{this.config}} />`);
+    };
+  });
+
+  test('it renders empty state when enabled is "on"', async function (assert) {
+    assert.expect(2);
+    const data = {
+      enabled: 'default-enabled',
+      reporting_enabled: false,
+    };
+    ``;
+    this.config = await this.setConfig(data);
+    await this.renderComponent();
+    assert.dom(GENERAL.emptyStateTitle).hasText('No data received');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText('Tracking is turned on and Vault is gathering data. It should appear here within 30 minutes.');
+  });
+
+  test('it renders empty state when reporting_enabled is true', async function (assert) {
+    assert.expect(2);
+    const data = {
+      enabled: 'default-disabled',
+      reporting_enabled: true,
+    };
+    this.config = await this.setConfig(data);
+    await this.renderComponent();
+    assert.dom(GENERAL.emptyStateTitle).hasText('No data received');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText('Tracking is turned on and Vault is gathering data. It should appear here within 30 minutes.');
+  });
+
+  test('it renders empty state when reporting is fully disabled', async function (assert) {
+    assert.expect(2);
+    const data = {
+      enabled: 'default-disabled',
+      reporting_enabled: false,
+    };
+    this.config = await this.setConfig(data);
+    await this.renderComponent();
+    assert.dom(GENERAL.emptyStateTitle).hasText('Data tracking is disabled');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'Tracking is disabled, and no data is being collected. To turn it on, edit the configuration.'
+      );
+  });
+
+  test('it renders empty state when config data is not available', async function (assert) {
+    assert.expect(2);
+    this.config = null;
+    await this.renderComponent();
+    assert.dom(GENERAL.emptyStateTitle).hasText('Activity configuration data is unavailable');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'Reporting status is unknown and could be enabled or disabled. Check the Vault logs for more information.'
+      );
+  });
+});
diff --git a/ui/tests/integration/components/clients/page-header-test.js b/ui/tests/integration/components/clients/page-header-test.js
new file mode 100644
index 00000000000..2e69787a2bc
--- /dev/null
+++ b/ui/tests/integration/components/clients/page-header-test.js
@@ -0,0 +1,262 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { click, fillIn, render, waitFor, waitUntil } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { Response } from 'miragejs';
+import Sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { capabilitiesStub, overrideResponse } from 'vault/tests/helpers/stubs';
+import { CLIENT_COUNT } from 'vault/tests/helpers/clients/client-count-selectors';
+import timestamp from 'core/utils/timestamp';
+
+// this test coverage mostly is around the export button functionality
+// since everything else is static
+module('Integration | Component | clients/page-header', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.downloadStub = Sinon.stub(this.owner.lookup('service:download'), 'download');
+    this.startTimestamp = '2022-06-01T23:00:11.050Z';
+    this.endTimestamp = '2022-12-01T23:00:11.050Z';
+    this.upgradesDuringActivity = [];
+    this.noData = undefined;
+    this.server.post('/sys/capabilities-self', () =>
+      capabilitiesStub('sys/internal/counters/activity/export', ['sudo'])
+    );
+
+    this.renderComponent = async () => {
+      return render(hbs`
+        <Clients::PageHeader
+          @startTimestamp={{this.startTimestamp}}
+          @endTimestamp={{this.endTimestamp}}
+          @upgradesDuringActivity={{this.upgradesDuringActivity}}
+          @noData={{this.noData}}
+          @activityTimestamp={{this.activityTimestamp}}
+        />`);
+    };
+  });
+
+  test('it shows the export button if user does has SUDO capabilities', async function (assert) {
+    await this.renderComponent();
+    assert.dom(CLIENT_COUNT.exportButton).exists();
+  });
+
+  test('it hides the export button if user does has SUDO capabilities but there is no data', async function (assert) {
+    this.noData = true;
+    await this.renderComponent();
+    assert.dom(CLIENT_COUNT.exportButton).doesNotExist();
+  });
+
+  test('it hides the export button if user does not have SUDO capabilities', async function (assert) {
+    this.server.post('/sys/capabilities-self', () =>
+      capabilitiesStub('sys/internal/counters/activity/export', ['read'])
+    );
+
+    await this.renderComponent();
+    assert.dom(CLIENT_COUNT.exportButton).doesNotExist();
+  });
+
+  test('defaults to show the export button if capabilities cannot be read', async function (assert) {
+    this.server.post('/sys/capabilities-self', () => overrideResponse(403));
+
+    await this.renderComponent();
+    assert.dom(CLIENT_COUNT.exportButton).exists();
+  });
+
+  test('it shows the export API error on the modal', async function (assert) {
+    this.server.get('/sys/internal/counters/activity/export', function () {
+      return overrideResponse(403);
+    });
+
+    await this.renderComponent();
+
+    await click(CLIENT_COUNT.exportButton);
+    await click(GENERAL.confirmButton);
+    await waitFor('[data-test-export-error]');
+    assert.dom('[data-test-export-error]').hasText('permission denied');
+  });
+
+  test('it exports when json format', async function (assert) {
+    assert.expect(2);
+    this.server.get('/sys/internal/counters/activity/export', function (_, req) {
+      assert.deepEqual(req.queryParams, {
+        format: 'json',
+        start_time: '2022-06-01T23:00:11.050Z',
+        end_time: '2022-12-01T23:00:11.050Z',
+      });
+      return new Response(200, { 'Content-Type': 'application/json' }, { example: 'data' });
+    });
+
+    await this.renderComponent();
+
+    await click(CLIENT_COUNT.exportButton);
+    await fillIn('[data-test-download-format]', 'jsonl');
+    await click(GENERAL.confirmButton);
+    await waitUntil(() => this.downloadStub.calledOnce);
+    const extension = this.downloadStub.lastCall.args[2];
+    assert.strictEqual(extension, 'jsonl');
+  });
+
+  test('it exports when csv format', async function (assert) {
+    assert.expect(2);
+
+    this.server.get('/sys/internal/counters/activity/export', function (_, req) {
+      assert.deepEqual(req.queryParams, {
+        format: 'csv',
+        start_time: '2022-06-01T23:00:11.050Z',
+        end_time: '2022-12-01T23:00:11.050Z',
+      });
+      return new Response(200, { 'Content-Type': 'text/csv' }, 'example,data');
+    });
+
+    await this.renderComponent();
+
+    await click(CLIENT_COUNT.exportButton);
+    await fillIn('[data-test-download-format]', 'csv');
+    await click(GENERAL.confirmButton);
+    await waitUntil(() => this.downloadStub.calledOnce);
+    const extension = this.downloadStub.lastCall.args[2];
+    assert.strictEqual(extension, 'csv');
+  });
+
+  test('it sends the current namespace in export request', async function (assert) {
+    assert.expect(2);
+    const namespaceSvc = this.owner.lookup('service:namespace');
+    namespaceSvc.path = 'foo';
+    this.server.get('/sys/internal/counters/activity/export', function (_, req) {
+      assert.strictEqual(req.requestHeaders['X-Vault-Namespace'], 'foo');
+      return new Response(200, { 'Content-Type': 'text/csv' }, '');
+    });
+
+    await this.renderComponent();
+
+    assert.dom(CLIENT_COUNT.exportButton).exists();
+    await click(CLIENT_COUNT.exportButton);
+    await click(GENERAL.confirmButton);
+  });
+
+  test('it shows a no data message if export returns 204', async function (assert) {
+    this.server.get('/sys/internal/counters/activity/export', () => overrideResponse(204));
+    await this.renderComponent();
+
+    await click(CLIENT_COUNT.exportButton);
+    await click(GENERAL.confirmButton);
+    await waitFor('[data-test-export-error]');
+    assert.dom('[data-test-export-error]').hasText('No data to export in provided time range.');
+  });
+
+  test('it shows upgrade data in export modal', async function (assert) {
+    this.upgradesDuringActivity = [
+      { version: '1.10.1', previousVersion: '1.9.9', timestampInstalled: '2021-11-18T10:23:16Z' },
+    ];
+    await this.renderComponent();
+    await click(CLIENT_COUNT.exportButton);
+    await waitFor('[data-test-export-upgrade-warning]');
+    assert.dom('[data-test-export-upgrade-warning]').includesText('1.10.1 (Nov 18, 2021)');
+  });
+
+  test('it refreshes route after clicking "Refresh page" button', async function (assert) {
+    const routeName = 'vault.cluster.clients.counts';
+    const router = this.owner.lookup('service:router');
+    Sinon.stub(router, 'currentRoute').value({ parent: { name: routeName } });
+    const refreshStub = Sinon.stub(router, 'refresh');
+    this.activityTimestamp = timestamp.now().toISOString();
+    await this.renderComponent();
+    await click(GENERAL.button('Refresh page'));
+    const [transitionRoute] = refreshStub.lastCall.args;
+    assert.true(refreshStub.calledOnce, 'clicking "Refresh page" calls refresh()');
+    assert.strictEqual(transitionRoute, routeName, 'it calls refresh() with parent route name');
+  });
+
+  module('download naming', function () {
+    test('is correct for date range', async function (assert) {
+      assert.expect(2);
+      this.server.get('/sys/internal/counters/activity/export', function (_, req) {
+        assert.deepEqual(req.queryParams, {
+          format: 'csv',
+          start_time: '2022-06-01T23:00:11.050Z',
+          end_time: '2022-12-01T23:00:11.050Z',
+        });
+        return new Response(200, { 'Content-Type': 'text/csv' }, '');
+      });
+
+      await this.renderComponent();
+      await click(CLIENT_COUNT.exportButton);
+      await click(GENERAL.confirmButton);
+      await waitUntil(() => this.downloadStub.calledOnce);
+      const args = this.downloadStub.lastCall.args;
+      const [filename] = args;
+      assert.strictEqual(filename, 'clients_export_June 2022-December 2022', 'csv has expected filename');
+    });
+
+    test('is correct for a single month', async function (assert) {
+      assert.expect(2);
+      this.endTimestamp = '2022-06-21T23:00:11.050Z';
+      this.server.get('/sys/internal/counters/activity/export', function (_, req) {
+        assert.deepEqual(req.queryParams, {
+          format: 'csv',
+          start_time: '2022-06-01T23:00:11.050Z',
+          end_time: '2022-06-21T23:00:11.050Z',
+        });
+        return new Response(200, { 'Content-Type': 'text/csv' }, '');
+      });
+      await this.renderComponent();
+
+      await click(CLIENT_COUNT.exportButton);
+      await click(GENERAL.confirmButton);
+      await waitUntil(() => this.downloadStub.calledOnce);
+      const [filename] = this.downloadStub.lastCall.args;
+      assert.strictEqual(filename, 'clients_export_June 2022', 'csv has single month in filename');
+    });
+    test('omits date if no start/end timestamp', async function (assert) {
+      assert.expect(2);
+      this.startTimestamp = undefined;
+      this.endTimestamp = undefined;
+
+      this.server.get('/sys/internal/counters/activity/export', function (_, req) {
+        assert.deepEqual(req.queryParams, {
+          format: 'csv',
+        });
+        return new Response(200, { 'Content-Type': 'text/csv' }, '');
+      });
+
+      await this.renderComponent();
+
+      await click(CLIENT_COUNT.exportButton);
+      await click(GENERAL.confirmButton);
+      await waitUntil(() => this.downloadStub.calledOnce);
+      const [filename] = this.downloadStub.lastCall.args;
+      assert.strictEqual(filename, 'clients_export');
+    });
+
+    test('includes current namespace', async function (assert) {
+      assert.expect(2);
+      this.startTimestamp = undefined;
+      this.endTimestamp = undefined;
+      const namespace = this.owner.lookup('service:namespace');
+      namespace.path = 'bar';
+
+      this.server.get('/sys/internal/counters/activity/export', function (_, req) {
+        assert.deepEqual(req.queryParams, {
+          format: 'csv',
+        });
+        return new Response(200, { 'Content-Type': 'text/csv' }, '');
+      });
+
+      await this.renderComponent();
+
+      await click(CLIENT_COUNT.exportButton);
+      await click(GENERAL.confirmButton);
+      await waitUntil(() => this.downloadStub.calledOnce);
+      const [filename] = this.downloadStub.lastCall.args;
+      assert.strictEqual(filename, 'clients_export_bar');
+    });
+  });
+});
diff --git a/ui/tests/integration/components/clients/page/client-list-test.js b/ui/tests/integration/components/clients/page/client-list-test.js
new file mode 100644
index 00000000000..05b7ffdb76d
--- /dev/null
+++ b/ui/tests/integration/components/clients/page/client-list-test.js
@@ -0,0 +1,276 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { click, find, findAll, render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { ACTIVITY_EXPORT_STUB } from 'vault/tests/helpers/clients/client-count-helpers';
+import { CLIENT_COUNT, FILTERS } from 'vault/tests/helpers/clients/client-count-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+import { ClientFilters } from 'core/utils/client-count-utils';
+
+const EXPORT_TAB_TO_TYPE = {
+  Entity: 'entity',
+  'Non-entity': 'non-entity-token',
+  ACME: 'pki-acme',
+  'Secret sync': 'secret-sync',
+};
+
+module('Integration | Component | clients/page/client-list', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(async function () {
+    this.exportData = ACTIVITY_EXPORT_STUB.trim()
+      .split('\n')
+      .map((line) => JSON.parse(line));
+    this.onFilterChange = sinon.spy();
+    this.filterQueryParams = { namespace_path: '', mount_path: '', mount_type: '' };
+
+    this.expectedData = (type, { key, value } = {}) =>
+      this.exportData.filter((d) => {
+        const isClientType = d.client_type === type;
+        return key && value ? isClientType && d[key] === value : isClientType;
+      });
+
+    this.expectedOptions = (type) => [...new Set(this.exportData.map((m) => m[type]))];
+    this.expectedNamespaces = this.expectedOptions('namespace_path');
+    this.expectedMountPaths = this.expectedOptions('mount_path');
+    this.expectedMountTypes = this.expectedOptions('mount_type');
+
+    this.renderComponent = () =>
+      render(hbs`
+      <Clients::Page::ClientList
+        @exportData={{this.exportData}}
+        @onFilterChange={{this.onFilterChange}}
+        @filterQueryParams={{this.filterQueryParams}}
+      />`);
+
+    // Filter key is one of ClientFilterTypes
+    this.assertTabData = async (assert, filterKey, filterValue) => {
+      // Iterate over each tab and assert rendered table data
+      for (const [tabName, clientType] of Object.entries(EXPORT_TAB_TO_TYPE)) {
+        const expectedData = this.expectedData(clientType, { key: filterKey, value: filterValue });
+        const length = expectedData.length;
+        await click(GENERAL.hdsTab(tabName));
+        assert
+          .dom(GENERAL.hdsTab(tabName))
+          .hasText(`${tabName} ${length}`, `${tabName} tab counts match dataset length`);
+        const noun = length === 1 ? 'client' : 'clients';
+        const verb = length === 1 ? 'matches' : 'match';
+        assert
+          .dom(CLIENT_COUNT.tableSummary(tabName))
+          .hasText(`Summary: ${length} ${noun} ${verb} the filter criteria.`);
+        assert
+          .dom(GENERAL.hdsTab(tabName))
+          .hasAttribute('aria-selected', 'true', `it selects the tab: ${tabName}`);
+        assert.dom(GENERAL.tableRow()).exists({ count: length });
+
+        // Find all rendered rows and assert they satisfy the filter value and client IDs match
+        const rows = findAll(GENERAL.tableRow());
+        rows.forEach((_, idx) => {
+          assert.dom(GENERAL.tableData(idx, filterKey)).hasText(filterValue);
+          const clientId = find(GENERAL.tableData(idx, 'client_id')).innerText;
+          // Make sure the rendered client id exists in the expected data
+          const isValid = expectedData.find((d) => d.client_id === clientId);
+          assert.true(!!isValid, `client_id: ${clientId} exists in expected dataset`);
+        });
+      }
+    };
+  });
+
+  test('it renders export data by client type in tabs organized by client type', async function (assert) {
+    await this.renderComponent();
+    assert.dom(GENERAL.hdsTab('Entity')).hasAttribute('aria-selected', 'true', 'the first tab is selected');
+
+    for (const [tabName, clientType] of Object.entries(EXPORT_TAB_TO_TYPE)) {
+      const expectedData = this.expectedData(clientType);
+      await click(GENERAL.hdsTab(tabName));
+      assert
+        .dom(GENERAL.hdsTab(tabName))
+        .hasText(`${tabName} ${expectedData.length}`, `${tabName} tab counts match dataset length`);
+      assert
+        .dom(GENERAL.hdsTab(tabName))
+        .hasAttribute('aria-selected', 'true', `it selects the tab: ${tabName}`);
+
+      // Find all rendered rows and assert they match the client type tab
+      const rows = findAll(GENERAL.tableRow());
+      rows.forEach((_, idx) => {
+        assert
+          .dom(GENERAL.tableData(idx, 'client_type'))
+          .hasText(clientType, `it renders ${clientType} data when ${tabName} is selected`);
+      });
+    }
+  });
+
+  test('it renders expected columns for each client type', async function (assert) {
+    const expectedColumns = (isEntity = false) => {
+      const base = [
+        { label: 'Client ID' },
+        { label: 'Client type' },
+        { label: 'Namespace path' },
+        { label: 'Namespace ID' },
+        { label: 'Initial usage More information for' }, // renders a tooltip which is why "More information for" is included
+        { label: 'Mount path' },
+        { label: 'Mount type' },
+        { label: 'Mount accessor' },
+      ];
+      const entityOnly = [
+        { label: 'Entity name More information for' }, // renders a tooltip which is why "More information for" is included
+        { label: 'Entity alias name' },
+        { label: 'Local entity alias' },
+        { label: 'Policies' },
+        { label: 'Entity metadata' },
+        { label: 'Entity alias metadata' },
+        { label: 'Entity alias custom metadata' },
+        { label: 'Entity group IDs' },
+      ];
+      return isEntity ? [...base, ...entityOnly] : base;
+    };
+    await this.renderComponent();
+
+    for (const tabName of Object.keys(EXPORT_TAB_TO_TYPE)) {
+      await click(GENERAL.hdsTab(tabName));
+      expectedColumns(tabName === 'Entity').forEach((col, idx) => {
+        assert
+          .dom(GENERAL.tableColumnHeader(idx + 1, { isAdvanced: true }))
+          .hasText(col.label, `${tabName} renders ${col.label} column`);
+      });
+    }
+  });
+
+  test('it renders dropdown lists from activity response to filter table data', async function (assert) {
+    await this.renderComponent();
+    // Select each filter
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    findAll(`${FILTERS.dropdown(ClientFilters.NAMESPACE)} li button`).forEach((item, idx) => {
+      const expected = this.expectedNamespaces[idx] === '' ? 'root' : this.expectedNamespaces[idx];
+      assert.dom(item).hasText(expected, `namespace dropdown renders: ${expected}`);
+    });
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    findAll(`${FILTERS.dropdown(ClientFilters.MOUNT_PATH)} li button`).forEach((item, idx) => {
+      const expected = this.expectedMountPaths[idx];
+      assert.dom(item).hasText(expected, `mount_path dropdown renders: ${expected}`);
+    });
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    findAll(`${FILTERS.dropdown(ClientFilters.MOUNT_TYPE)} li button`).forEach((item, idx) => {
+      const expected = this.expectedMountTypes[idx];
+      assert.dom(item).hasText(expected, `mount_type dropdown renders: ${expected}`);
+    });
+  });
+
+  test('it fires @onFilterChange when filters are selected', async function (assert) {
+    const ns = 'root';
+    const { mount_path, mount_type } = this.exportData[0];
+    await this.renderComponent();
+
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    await click(FILTERS.dropdownItem(ns));
+    // select mount path
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    await click(FILTERS.dropdownItem(mount_path));
+    // select mount type
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    await click(FILTERS.dropdownItem(mount_type));
+
+    const [actual] = this.onFilterChange.lastCall.args;
+    assert.strictEqual(actual.namespace_path, ns, `@onFilterChange called with: ${ns}`);
+    assert.strictEqual(actual.mount_path, mount_path, `@onFilterChange called with: ${mount_path}`);
+    assert.strictEqual(actual.mount_type, mount_type, `@onFilterChange called with: ${mount_type}`);
+  });
+
+  // *FILTERING TESTS
+  test('it filters data if @filterQueryParams specify a namespace_path', async function (assert) {
+    const filterKey = 'namespace_path';
+    const filterValue = 'ns2/';
+    this.filterQueryParams[filterKey] = filterValue;
+    await this.renderComponent();
+    await this.assertTabData(assert, filterKey, filterValue);
+  });
+
+  test('it filters data if @filterQueryParams specify a mount_path', async function (assert) {
+    const filterKey = 'mount_path';
+    const filterValue = 'auth/token/';
+    this.filterQueryParams[filterKey] = filterValue;
+    await this.renderComponent();
+    await this.assertTabData(assert, filterKey, filterValue);
+  });
+
+  test('it filters data if @filterQueryParams specify a mount_type', async function (assert) {
+    const filterKey = 'mount_type';
+    const filterValue = 'auth/ns_token/';
+    this.filterQueryParams[filterKey] = filterValue;
+    await this.renderComponent();
+    await this.assertTabData(assert, filterKey, filterValue);
+  });
+
+  test('it filters data if @filterQueryParams specify a multiple filters', async function (assert) {
+    this.filterQueryParams = { namespace_path: 'ns5/', mount_path: 'auth/token/', mount_type: 'ns_token' };
+    const { namespace_path, mount_path, mount_type } = this.filterQueryParams;
+    await this.renderComponent();
+
+    for (const [tabName, clientType] of Object.entries(EXPORT_TAB_TO_TYPE)) {
+      const expectedData = this.expectedData(clientType).filter(
+        (d) =>
+          d.namespace_path == namespace_path && d.mount_path === mount_path && d.mount_type === mount_type
+      );
+      const length = expectedData.length;
+      await click(GENERAL.hdsTab(tabName));
+      assert
+        .dom(GENERAL.hdsTab(tabName))
+        .hasText(`${tabName} ${length}`, `${tabName} tab counts match dataset length`);
+      const noun = length === 1 ? 'client' : 'clients';
+      const verb = length === 1 ? 'matches' : 'match';
+      assert
+        .dom(CLIENT_COUNT.tableSummary(tabName))
+        .hasText(`Summary: ${length} ${noun} ${verb} the filter criteria.`);
+      assert
+        .dom(GENERAL.hdsTab(tabName))
+        .hasAttribute('aria-selected', 'true', `it selects the tab: ${tabName}`);
+      assert.dom(GENERAL.tableRow()).exists({ count: length });
+
+      // Find all rendered rows and assert they satisfy the filter value and client IDs match
+      const rows = findAll(GENERAL.tableRow());
+      rows.forEach((_, idx) => {
+        assert.dom(GENERAL.tableData(idx, 'namespace_path')).hasText('ns5/');
+        assert.dom(GENERAL.tableData(idx, 'mount_path')).hasText('auth/token/');
+        assert.dom(GENERAL.tableData(idx, 'mount_type')).hasText('ns_token');
+        // client_id is the unique identifier for each row
+        const clientId = find(GENERAL.tableData(idx, 'client_id')).innerText;
+        // Make sure the rendered client id exists in the expected data
+        const isValid = expectedData.find((d) => d.client_id === clientId);
+        assert.true(!!isValid, `client_id: ${clientId} exists in expected dataset`);
+      });
+    }
+  });
+
+  test('it renders empty state message when filter selections yield no results', async function (assert) {
+    const flags = this.owner.lookup('service:flags');
+    flags.activatedFlags = ['secrets-sync'];
+    this.filterQueryParams = { namespace_path: 'dev/', mount_path: 'pluto/', mount_type: 'banana' };
+    await this.renderComponent();
+
+    for (const tabName of Object.keys(EXPORT_TAB_TO_TYPE)) {
+      await click(GENERAL.hdsTab(tabName));
+      assert
+        .dom(CLIENT_COUNT.card('table empty state'))
+        .hasText('No data found Select another client type or update filters to view client count data.');
+    }
+  });
+
+  test('it renders empty state message when secret sync is not activated', async function (assert) {
+    this.filterQueryParams = { namespace_path: 'dev/', mount_path: 'pluto/', mount_type: 'banana' };
+    await this.renderComponent();
+    await click(GENERAL.hdsTab('Secret sync'));
+    assert
+      .dom(CLIENT_COUNT.card('table empty state'))
+      .hasText(
+        'No secret sync clients No data is available because Secrets Sync has not been activated. Activate Secrets Sync'
+      );
+  });
+});
diff --git a/ui/tests/integration/components/clients/page/counts-test.js b/ui/tests/integration/components/clients/page/counts-test.js
index 03e8602cb12..cd04ab8cfe9 100644
--- a/ui/tests/integration/components/clients/page/counts-test.js
+++ b/ui/tests/integration/components/clients/page/counts-test.js
@@ -1,95 +1,68 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { render, click, settled } from '@ember/test-helpers';
+import { render, click, findAll, fillIn } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
-import clientsHandler from 'vault/mirage/handlers/clients';
-import { getUnixTime } from 'date-fns';
-import { SELECTORS as ts, dateDropdownSelect } from 'vault/tests/helpers/clients';
-import { selectChoose } from 'ember-power-select/test-support/helpers';
+import clientsHandler, {
+  LICENSE_START,
+  STATIC_NOW,
+  STATIC_PREVIOUS_MONTH,
+} from 'vault/mirage/handlers/clients';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CLIENT_COUNT } from 'vault/tests/helpers/clients/client-count-selectors';
 import timestamp from 'core/utils/timestamp';
 import sinon from 'sinon';
+import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
 
-const STATIC_NOW = new Date('2024-01-25T23:59:59Z');
-const START_TIME = getUnixTime(new Date('2023-10-01T00:00:00Z'));
-const END_TIME = getUnixTime(STATIC_NOW);
+const START_TIME = LICENSE_START.toISOString();
+const END_TIME = STATIC_PREVIOUS_MONTH.toISOString();
+const START_ISO = LICENSE_START.toISOString();
+const END_ISO = STATIC_PREVIOUS_MONTH.toISOString();
 
 module('Integration | Component | clients | Page::Counts', function (hooks) {
   setupRenderingTest(hooks);
   setupMirage(hooks);
 
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => STATIC_NOW);
-  });
-
   hooks.beforeEach(async function () {
+    sinon.replace(timestamp, 'now', sinon.fake.returns(STATIC_NOW));
     clientsHandler(this.server);
-    const store = this.owner.lookup('service:store');
+    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
+    this.store = this.owner.lookup('service:store');
     const activityQuery = {
-      start_time: { timestamp: START_TIME },
-      end_time: { timestamp: END_TIME },
+      start_time: START_TIME,
+      end_time: END_TIME,
     };
-    this.activity = await store.queryRecord('clients/activity', activityQuery);
-    this.config = await store.queryRecord('clients/config', {});
-    this.startTimestamp = START_TIME;
-    this.endTimestamp = END_TIME;
+    this.activity = await this.store.queryRecord('clients/activity', activityQuery);
+    this.config = await this.store.queryRecord('clients/config', {});
+    this.startTimestamp = START_ISO;
+    this.endTimestamp = END_ISO;
+    this.versionHistory = [];
     this.renderComponent = () =>
       render(hbs`
       <Clients::Page::Counts
         @activity={{this.activity}}
         @activityError={{this.activityError}}
         @config={{this.config}}
+        @versionHistory={{this.versionHistory}}
         @startTimestamp={{this.startTimestamp}}
         @endTimestamp={{this.endTimestamp}}
-        @namespace={{this.namespace}}
-        @mountPath={{this.mountPath}}
         @onFilterChange={{this.onFilterChange}}
       >
         <div data-test-yield>Yield block</div>
       </Clients::Page::Counts>
     `);
   });
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
-
-  test('it should render start date label and description based on version', async function (assert) {
-    const versionService = this.owner.lookup('service:version');
-
-    await this.renderComponent();
-
-    assert.dom(ts.counts.startLabel).hasText('Client counting start date', 'Label renders for OSS');
-    assert
-      .dom(ts.counts.description)
-      .hasText(
-        'This date is when client counting starts. Without this starting point, the data shown is not reliable.',
-        'Description renders for OSS'
-      );
-
-    versionService.set('type', 'enterprise');
-    await settled();
-
-    assert.dom(ts.counts.startLabel).hasText('Billing start month', 'Label renders for Enterprise');
-    assert
-      .dom(ts.counts.description)
-      .hasText(
-        'This date comes from your license, and defines when client counting starts. Without this starting point, the data shown is not reliable.',
-        'Description renders for Enterprise'
-      );
-  });
 
   test('it should populate start and end month displays', async function (assert) {
     await this.renderComponent();
 
-    assert.dom(ts.counts.startMonth).hasText('October 2023', 'Start month renders');
-    assert
-      .dom(ts.calendarWidget.trigger)
-      .hasText('Oct 2023 - Jan 2024', 'Start and end months render in filter bar');
+    assert.dom(CLIENT_COUNT.dateRange.dateDisplay('start')).hasText('July 2023', 'Start month renders');
+    assert.dom(CLIENT_COUNT.dateRange.dateDisplay('end')).hasText('December 2023', 'End month renders');
   });
 
   test('it should render no data empty state', async function (assert) {
@@ -97,9 +70,7 @@ module('Integration | Component | clients | Page::Counts', function (hooks) {
 
     await this.renderComponent();
 
-    assert
-      .dom(ts.emptyStateTitle)
-      .hasText('No data received from October 2023 to January 2024', 'No data empty state renders');
+    assert.dom(GENERAL.emptyStateTitle).hasText('No data received', 'No data empty state renders');
   });
 
   test('it should render activity error', async function (assert) {
@@ -108,7 +79,9 @@ module('Integration | Component | clients | Page::Counts', function (hooks) {
 
     await this.renderComponent();
 
-    assert.dom(ts.emptyStateTitle).hasText('You are not authorized', 'Activity error empty state renders');
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('You are not authorized', 'Activity error empty state renders');
   });
 
   test('it should render config disabled alert', async function (assert) {
@@ -116,95 +89,129 @@ module('Integration | Component | clients | Page::Counts', function (hooks) {
 
     await this.renderComponent();
 
-    assert.dom(ts.counts.configDisabled).hasText('Tracking is disabled', 'Config disabled alert renders');
+    assert
+      .dom(CLIENT_COUNT.counts.configDisabled)
+      .hasText('Tracking is disabled', 'Config disabled alert renders');
   });
 
-  test('it should send correct values on start and end date change', async function (assert) {
-    assert.expect(4);
-
-    let expected = { start_time: getUnixTime(new Date('2023-01-01T00:00:00Z')), end_time: END_TIME };
-    this.onFilterChange = (params) => {
-      assert.deepEqual(params, expected, 'Correct values sent on filter change');
-      this.startTimestamp = params.start_time || START_TIME;
-      this.endTimestamp = params.end_time || END_TIME;
-    };
-
-    await this.renderComponent();
-    await dateDropdownSelect('January', '2023');
-
-    expected.start_time = END_TIME;
-    await click(ts.calendarWidget.trigger);
-    await click(ts.calendarWidget.currentMonth);
-
-    expected.start_time = getUnixTime(this.config.billingStartTimestamp);
-    await click(ts.calendarWidget.trigger);
-    await click(ts.calendarWidget.currentBillingPeriod);
-
-    expected = { end_time: getUnixTime(new Date('2023-12-31T00:00:00Z')) };
-    await click(ts.calendarWidget.trigger);
-    await click(ts.calendarWidget.customEndMonth);
-    await click(ts.calendarWidget.previousYear);
-    await click(ts.calendarWidget.calendarMonth('December'));
+  const jan23start = '2023-01-01T00:00:00Z';
+  // license start is July 2, 2024 on date change it recalculates start to beginning of the month
+  const july23start = '2023-07-01T00:00:00Z';
+  const dec23end = '2023-12-31T23:59:59Z';
+  const testCases = [
+    {
+      scenario: 'changing start only',
+      expected: { start_time: jan23start, end_time: dec23end },
+      editStart: '2023-01',
+      expectedStart: 'January 2023',
+      expectedEnd: 'December 2023',
+    },
+    {
+      scenario: 'changing end only',
+      expected: { start_time: july23start, end_time: dec23end },
+      editEnd: '2023-12',
+      expectedStart: 'July 2023',
+      expectedEnd: 'December 2023',
+    },
+    {
+      scenario: 'changing both',
+      expected: { start_time: jan23start, end_time: dec23end },
+      editStart: '2023-01',
+      editEnd: '2023-12',
+      expectedStart: 'January 2023',
+      expectedEnd: 'December 2023',
+    },
+  ];
+  testCases.forEach((testCase) => {
+    test(`it should send correct timestamp on filter change when ${testCase.scenario}`, async function (assert) {
+      assert.expect(5);
+      this.owner.lookup('service:version').type = 'community';
+      this.onFilterChange = (params) => {
+        assert.deepEqual(params, testCase.expected, 'Correct values sent on filter change');
+        this.set('startTimestamp', params?.start_time ? params.start_time : START_ISO);
+        this.set('endTimestamp', params?.end_time ? params.end_time : END_ISO);
+      };
+      await this.renderComponent();
+      await click(CLIENT_COUNT.dateRange.edit);
+
+      // page starts with default billing dates, which are july 23 - dec 23
+      assert.dom(CLIENT_COUNT.dateRange.editDate('start')).hasValue('2023-07');
+      assert.dom(CLIENT_COUNT.dateRange.editDate('end')).hasValue('2023-12');
+
+      if (testCase.editStart) {
+        await fillIn(CLIENT_COUNT.dateRange.editDate('start'), testCase.editStart);
+      }
+      if (testCase.editEnd) {
+        await fillIn(CLIENT_COUNT.dateRange.editDate('end'), testCase.editEnd);
+      }
+      if (testCase.reset) {
+        await click(CLIENT_COUNT.dateRange.reset);
+      }
+      await click(GENERAL.submitButton);
+      assert.dom(CLIENT_COUNT.dateRange.dateDisplay('start')).hasText(testCase.expectedStart);
+      assert.dom(CLIENT_COUNT.dateRange.dateDisplay('end')).hasText(testCase.expectedEnd);
+    });
   });
 
-  test('it should render namespace and auth mount filters', async function (assert) {
+  test('it renders alert if upgrade happened within queried activity', async function (assert) {
     assert.expect(5);
-
-    this.namespace = 'root';
-    this.mountPath = 'auth/authid0';
-
-    let assertion = (params) =>
-      assert.deepEqual(params, { ns: undefined, mountPath: undefined }, 'Auth mount cleared with namespace');
-    this.onFilterChange = (params) => {
-      if (assertion) {
-        assertion(params);
-      }
-      const keys = Object.keys(params);
-      this.namespace = keys.includes('ns') ? params.ns : this.namespace;
-      this.mountPath = keys.includes('mountPath') ? params.mountPath : this.mountPath;
-    };
+    this.versionHistory = await this.store.findAll('clients/version-history').then((resp) => {
+      return resp.map(({ version, previousVersion, timestampInstalled }) => {
+        return {
+          version,
+          previousVersion,
+          timestampInstalled,
+        };
+      });
+    });
 
     await this.renderComponent();
 
-    assert.dom(ts.counts.namespaces).includesText(this.namespace, 'Selected namespace renders');
-    assert.dom(ts.counts.mountPaths).includesText(this.mountPath, 'Selected auth mount renders');
-
-    await click(`${ts.counts.namespaces} button`);
-    // this is only necessary in tests since SearchSelect does not respond to initialValue changes
-    // in the app the component is rerender on query param change
-    assertion = null;
-    await click(`${ts.counts.mountPaths} button`);
-
-    assertion = (params) => assert.true(params.ns.includes('ns/'), 'Namespace value sent on change');
-    await selectChoose(ts.counts.namespaces, '.ember-power-select-option', 0);
-
-    assertion = (params) =>
-      assert.true(params.mountPath.includes('auth/'), 'Auth mount value sent on change');
-    await selectChoose(ts.counts.mountPaths, 'auth/authid0');
-  });
-
-  test('it should render start time discrepancy alert', async function (assert) {
-    this.startTimestamp = getUnixTime(new Date('2022-06-01T00:00:00Z'));
-
-    await this.renderComponent();
+    assert
+      .dom(CLIENT_COUNT.upgradeWarning)
+      .hasTextContaining(
+        `Client count data contains 3 upgrades Vault was upgraded during this time period. Keep this in mind while looking at the data. Visit our Client count FAQ for more information.`,
+        'it renders title and subtext'
+      );
 
+    const [first, second, third] = findAll(`${CLIENT_COUNT.upgradeWarning} li`);
     assert
-      .dom(ts.counts.startDiscrepancy)
+      .dom(first)
       .hasText(
-        'Warning You requested data from June 2022. We only have data from October 2023, and that is what is being shown here.',
-        'Start discrepancy alert renders'
+        `1.9.1 (upgraded on Aug 2, 2023) - We introduced changes to non-entity token and local auth mount logic for client counting in 1.9.`,
+        'alert includes 1.9.1 upgrade'
+      );
+    assert
+      .dom(second)
+      .hasTextContaining(
+        `1.10.1 (upgraded on Sep 2, 2023) - We added monthly breakdowns and mount level attribution starting in 1.10.`,
+        'alert includes 1.10.1 upgrade'
+      );
+    assert
+      .dom(third)
+      .hasTextContaining(
+        `1.17.0 (upgraded on Dec 2, 2023) - We separated ACME clients from non-entity clients starting in 1.17.`,
+        'alert includes 1.17.0 upgrade'
+      );
+    assert
+      .dom(`${CLIENT_COUNT.upgradeWarning} ul`)
+      .doesNotHaveTextContaining(
+        '1.10.3',
+        'Warning does not include subsequent patch releases (e.g. 1.10.3) of the same notable upgrade.'
       );
   });
 
-  test('it should render empty state for no start or license start time', async function (assert) {
+  test('it should render empty state for no start or no end when CE', async function (assert) {
+    this.owner.lookup('service:version').type = 'community';
     this.startTimestamp = null;
-    this.config.billingStartTimestamp = null;
     this.activity = {};
 
     await this.renderComponent();
 
-    assert.dom(ts.emptyStateTitle).hasText('No start date found', 'Empty state renders');
-    assert.dom(ts.counts.startDropdown).exists('Date dropdown renders when start time is not provided');
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('Input the start and end dates to view client attribution by path.', 'Empty state renders');
+    assert.dom(CLIENT_COUNT.dateRange.edit).hasText('Set date range');
   });
 
   test('it should render catch all empty state', async function (assert) {
@@ -212,8 +219,20 @@ module('Integration | Component | clients | Page::Counts', function (hooks) {
 
     await this.renderComponent();
 
-    assert
-      .dom(ts.emptyStateTitle)
-      .hasText('No data received from October 2023 to January 2024', 'Empty state renders');
+    assert.dom(GENERAL.emptyStateTitle).hasText('No data received', 'Empty state renders');
+  });
+
+  test('it resets the tracked values on close', async function (assert) {
+    await this.renderComponent();
+    const DATE_RANGE = CLIENT_COUNT.dateRange;
+
+    await click(DATE_RANGE.edit);
+    await fillIn(DATE_RANGE.editDate('start'), '2017-04');
+    await fillIn(DATE_RANGE.editDate('end'), '2018-05');
+    await click(GENERAL.cancelButton);
+
+    await click(DATE_RANGE.edit);
+    assert.dom(DATE_RANGE.editDate('start')).hasValue('2023-07');
+    assert.dom(DATE_RANGE.editDate('end')).hasValue('2023-12');
   });
 });
diff --git a/ui/tests/integration/components/clients/page/overview-test.js b/ui/tests/integration/components/clients/page/overview-test.js
new file mode 100644
index 00000000000..1bc7398281f
--- /dev/null
+++ b/ui/tests/integration/components/clients/page/overview-test.js
@@ -0,0 +1,212 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { click, find, findAll, render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { ACTIVITY_RESPONSE_STUB } from 'vault/tests/helpers/clients/client-count-helpers';
+import { CLIENT_COUNT, FILTERS } from 'vault/tests/helpers/clients/client-count-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+import { ClientFilters, flattenMounts } from 'core/utils/client-count-utils';
+import { parseAPITimestamp } from 'core/utils/date-formatters';
+
+module('Integration | Component | clients/page/overview', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    this.server.get('sys/internal/counters/activity', () => {
+      return {
+        request_id: 'some-activity-id',
+        data: ACTIVITY_RESPONSE_STUB,
+      };
+    });
+
+    this.store = this.owner.lookup('service:store');
+    this.activity = await this.store.queryRecord('clients/activity', {});
+    this.mostRecentMonth = this.activity.byMonth[this.activity.byMonth.length - 1];
+    this.onFilterChange = sinon.spy();
+    this.filterQueryParams = { namespace_path: '', mount_path: '', mount_type: '', month: '' };
+    this.renderComponent = () =>
+      render(hbs`
+      <Clients::Page::Overview 
+        @activity={{this.activity}} 
+        @onFilterChange={{this.onFilterChange}} 
+        @filterQueryParams={{this.filterQueryParams}} 
+      />`);
+
+    this.assertTableData = async (assert, filterKey, filterValue) => {
+      const expectedData = flattenMounts(this.activity.byNamespace).filter(
+        (d) => d[filterKey] === filterValue
+      );
+      // Find all rendered rows and assert they satisfy the filter value and table data matches expected values
+      const rows = findAll(GENERAL.tableRow());
+      rows.forEach((_, idx) => {
+        assert.dom(GENERAL.tableData(idx, filterKey)).hasText(filterValue);
+        // Get namespace and mount paths to find original data in expectedData
+        const rowMountPath = find(GENERAL.tableData(idx, 'mount_path')).innerText;
+        const rowNsPath = find(GENERAL.tableData(idx, 'namespace_path')).innerText;
+        // find the expected clients from the response and assert the table matches
+        const { clients: expectedClients } = expectedData.find(
+          (d) => d.mount_path === rowMountPath && d.namespace_path === rowNsPath
+        );
+        assert.dom(GENERAL.tableData(idx, 'clients')).hasText(`${expectedClients}`);
+      });
+    };
+  });
+
+  test('it hides attribution when there is no data', async function (assert) {
+    // Stub activity response when there's no activity data
+    this.server.get('sys/internal/counters/activity', () => {
+      return {
+        request_id: 'some-activity-id',
+        data: {
+          by_namespace: [],
+          end_time: '2024-08-31T23:59:59Z',
+          months: [],
+          start_time: '2024-01-01T00:00:00Z',
+          total: {
+            distinct_entities: 0,
+            entity_clients: 0,
+            non_entity_tokens: 0,
+            non_entity_clients: 0,
+            clients: 0,
+            secret_syncs: 0,
+          },
+        },
+      };
+    });
+    this.activity = await this.store.queryRecord('clients/activity', {});
+    await this.renderComponent();
+    assert.dom(CLIENT_COUNT.card('Client attribution')).doesNotExist('it does not render attribution card');
+  });
+
+  test('it initially renders attribution with by_namespace data', async function (assert) {
+    await this.renderComponent();
+    const topNamespace = this.activity.byNamespace[0];
+    const topMount = topNamespace.mounts[0];
+    // Assert table renders namespace with the highest counts at the top
+    assert.dom(GENERAL.tableData(0, 'namespace_path')).hasText(topNamespace.label);
+    assert.dom(GENERAL.tableData(0, 'clients')).hasText(`${topMount.clients}`);
+  });
+
+  test('it renders dropdown lists from activity response to filter table data', async function (assert) {
+    const expectedMonths = this.activity.byMonth
+      .map((m) => parseAPITimestamp(m.timestamp, 'MMMM yyyy'))
+      .reverse();
+    const mounts = flattenMounts(this.activity.byNamespace);
+    const expectedNamespaces = [...new Set(mounts.map((m) => m.namespace_path))];
+    const expectedMountPaths = [...new Set(mounts.map((m) => m.mount_path))];
+    const expectedMountTypes = [...new Set(mounts.map((m) => m.mount_type))];
+    await this.renderComponent();
+
+    // Select each filter
+    await click(FILTERS.dropdownToggle(ClientFilters.MONTH));
+    findAll(`${FILTERS.dropdown(ClientFilters.MONTH)} li button`).forEach((item, idx) => {
+      const expected = expectedMonths[idx];
+      assert.dom(item).hasText(expected, `month dropdown renders: ${expected}`);
+    });
+
+    await click(FILTERS.dropdownToggle(ClientFilters.NAMESPACE));
+    findAll(`${FILTERS.dropdown(ClientFilters.NAMESPACE)} li button`).forEach((item, idx) => {
+      const expected = expectedNamespaces[idx];
+      assert.dom(item).hasText(expected, `namespace dropdown renders: ${expected}`);
+    });
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_PATH));
+    findAll(`${FILTERS.dropdown(ClientFilters.MOUNT_PATH)} li button`).forEach((item, idx) => {
+      const expected = expectedMountPaths[idx];
+      assert.dom(item).hasText(expected, `mount_path dropdown renders: ${expected}`);
+    });
+
+    await click(FILTERS.dropdownToggle(ClientFilters.MOUNT_TYPE));
+    findAll(`${FILTERS.dropdown(ClientFilters.MOUNT_TYPE)} li button`).forEach((item, idx) => {
+      const expected = expectedMountTypes[idx];
+      assert.dom(item).hasText(expected, `mount_type dropdown renders: ${expected}`);
+    });
+  });
+
+  // * FILTERING ASSERTIONS
+  // Filtering tests are split between integration and acceptance tests
+  // because changing filters updates the URL query params
+
+  test('it shows correct empty state message when selected month has no data', async function (assert) {
+    this.filterQueryParams[ClientFilters.MONTH] = '2023-06-01T00:00:00Z';
+    await this.renderComponent();
+    assert
+      .dom(CLIENT_COUNT.card('table empty state'))
+      .hasText('No data found Clear or change filters to view client count data. Client count documentation');
+  });
+
+  test('it filters data if @filterQueryParams specify a month', async function (assert) {
+    const filterKey = 'month';
+    const filterValue = this.mostRecentMonth.timestamp;
+    this.filterQueryParams[filterKey] = filterValue;
+    await this.renderComponent();
+    // Drill down to new_clients then grab the first mount
+    const sortedMounts = flattenMounts(this.mostRecentMonth.new_clients.namespaces).sort(
+      (a, b) => b.clients - a.clients
+    );
+    const topMount = sortedMounts[0];
+    assert.dom(GENERAL.tableData(0, 'namespace_path')).hasText(topMount.namespace_path);
+    assert.dom(GENERAL.tableData(0, 'clients')).hasText(`${topMount.clients}`);
+    assert.dom(GENERAL.tableData(0, 'mount_path')).hasText(topMount.mount_path);
+  });
+
+  test('it filters data if @filterQueryParams specify a namespace_path', async function (assert) {
+    const filterKey = 'namespace_path';
+    const filterValue = 'ns1/';
+    this.filterQueryParams[filterKey] = filterValue;
+    await this.renderComponent();
+    await this.assertTableData(assert, filterKey, filterValue);
+  });
+
+  test('it filters data if @filterQueryParams specify a mount_path', async function (assert) {
+    const filterKey = 'mount_path';
+    const filterValue = 'acme/pki/0/';
+    this.filterQueryParams[filterKey] = filterValue;
+    await this.renderComponent();
+    await this.assertTableData(assert, filterKey, filterValue);
+  });
+
+  test('it filters data if @filterQueryParams specify a mount_type', async function (assert) {
+    const filterKey = 'mount_type';
+    const filterValue = 'kv';
+    this.filterQueryParams[filterKey] = filterValue;
+    await this.renderComponent();
+    await this.assertTableData(assert, filterKey, filterValue);
+  });
+
+  test('it filters data if @filterQueryParams specify a multiple filters', async function (assert) {
+    this.filterQueryParams = {
+      month: this.mostRecentMonth.timestamp,
+      namespace_path: 'ns1/',
+      mount_path: 'auth/userpass/0/',
+      mount_type: 'userpass',
+    };
+
+    const { namespace_path, mount_path, mount_type } = this.filterQueryParams;
+    await this.renderComponent();
+    const expectedData = flattenMounts(this.mostRecentMonth.new_clients.namespaces).find(
+      (d) => d.namespace_path === namespace_path && d.mount_path === mount_path && d.mount_type === mount_type
+    );
+    assert.dom(GENERAL.tableRow()).exists({ count: 1 });
+    assert.dom(GENERAL.tableData(0, 'namespace_path')).hasText(expectedData.namespace_path);
+    assert.dom(GENERAL.tableData(0, 'mount_path')).hasText(expectedData.mount_path);
+    assert.dom(GENERAL.tableData(0, 'mount_type')).hasText(expectedData.mount_type);
+    assert.dom(GENERAL.tableData(0, 'clients')).hasText(`${expectedData.clients}`);
+  });
+
+  test('it renders empty state message when filter selections yield no results', async function (assert) {
+    this.filterQueryParams = { namespace_path: 'dev/', mount_path: 'pluto/', mount_type: 'banana' };
+    await this.renderComponent();
+    assert
+      .dom(CLIENT_COUNT.card('table empty state'))
+      .hasText('No data found Clear or change filters to view client count data. Client count documentation');
+  });
+});
diff --git a/ui/tests/integration/components/clients/page/sync-test.js b/ui/tests/integration/components/clients/page/sync-test.js
deleted file mode 100644
index f992ff41d68..00000000000
--- a/ui/tests/integration/components/clients/page/sync-test.js
+++ /dev/null
@@ -1,122 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { render, findAll } from '@ember/test-helpers';
-import hbs from 'htmlbars-inline-precompile';
-import clientsHandler from 'vault/mirage/handlers/clients';
-import { getUnixTime } from 'date-fns';
-import { SELECTORS } from 'vault/tests/helpers/clients';
-import { formatNumber } from 'core/helpers/format-number';
-import { calculateAverage } from 'vault/utils/chart-helpers';
-import { dateFormat } from 'core/helpers/date-format';
-
-const START_TIME = getUnixTime(new Date('2023-10-01T00:00:00Z'));
-const END_TIME = getUnixTime(new Date('2024-01-31T23:59:59Z'));
-const { syncTab, charts, usageStats } = SELECTORS;
-
-module('Integration | Component | clients | Clients::Page::Sync', function (hooks) {
-  setupRenderingTest(hooks);
-  setupMirage(hooks);
-
-  hooks.beforeEach(async function () {
-    clientsHandler(this.server);
-    this.store = this.owner.lookup('service:store');
-    const activityQuery = {
-      start_time: { timestamp: START_TIME },
-      end_time: { timestamp: END_TIME },
-    };
-    this.activity = await this.store.queryRecord('clients/activity', activityQuery);
-    this.startTimestamp = START_TIME;
-    this.endTimestamp = END_TIME;
-    this.renderComponent = () =>
-      render(hbs`
-      <Clients::Page::Sync
-        @activity={{this.activity}}
-        @versionHistory={{this.versionHistory}}
-        @startTimestamp={{this.startTimestamp}}
-        @endTimestamp={{this.endTimestamp}}
-        @namespace={{this.countsController.ns}}
-        @mountPath={{this.countsController.mountPath}}
-      />
-    `);
-  });
-
-  test('it should render with full month activity data', async function (assert) {
-    assert.expect(4 + this.activity.byMonth.length);
-    const expectedTotal = formatNumber([this.activity.total.secret_syncs]);
-    const expectedAvg = formatNumber([calculateAverage(this.activity.byMonth, 'secret_syncs')]);
-    await this.renderComponent();
-    assert
-      .dom(syncTab.total)
-      .hasText(
-        `Total sync clients The total number of secrets synced from Vault to other destinations during this date range. ${expectedTotal}`,
-        `renders correct total sync stat ${expectedTotal}`
-      );
-    assert
-      .dom(syncTab.average)
-      .hasText(
-        `Average sync clients per month ${expectedAvg}`,
-        `renders correct average sync stat ${expectedAvg}`
-      );
-
-    const formattedTimestamp = dateFormat([this.activity.responseTimestamp, 'MMM d yyyy, h:mm:ss aaa'], {
-      withTimeZone: true,
-    });
-    assert.dom(charts.timestamp).hasText(`Updated ${formattedTimestamp}`, 'renders response timestamp');
-
-    // assert bar chart is correct
-    findAll(`${charts.chart('Secrets sync usage')} ${charts.xAxisLabel}`).forEach((e, i) => {
-      assert
-        .dom(e)
-        .hasText(
-          `${this.activity.byMonth[i].month}`,
-          `renders x-axis labels for bar chart: ${this.activity.byMonth[i].month}`
-        );
-    });
-    assert
-      .dom(charts.dataBar)
-      .exists(
-        { count: this.activity.byMonth.filter((m) => m.counts !== null).length },
-        'renders correct number of data bars'
-      );
-  });
-
-  test('it should render empty state for no monthly data', async function (assert) {
-    assert.expect(5);
-    this.activity.set('byMonth', []);
-
-    await this.renderComponent();
-
-    assert.dom(charts.chart('Secrets sync usage')).doesNotExist('vertical bar chart does not render');
-    assert.dom(SELECTORS.emptyStateTitle).hasText('No monthly secrets sync clients');
-    const formattedTimestamp = dateFormat([this.activity.responseTimestamp, 'MMM d yyyy, h:mm:ss aaa'], {
-      withTimeZone: true,
-    });
-    assert.dom(charts.timestamp).hasText(`Updated ${formattedTimestamp}`, 'renders timestamp');
-    assert.dom(syncTab.total).doesNotExist('total sync counts does not exist');
-    assert.dom(syncTab.average).doesNotExist('average sync client counts does not exist');
-  });
-
-  test('it should render stats without chart for a single month', async function (assert) {
-    assert.expect(4);
-    const activityQuery = { start_time: { timestamp: START_TIME }, end_time: { timestamp: START_TIME } };
-    this.activity = await this.store.queryRecord('clients/activity', activityQuery);
-    const total = formatNumber([this.activity.total.secret_syncs]);
-    await this.renderComponent();
-
-    assert.dom(charts.chart('Secrets sync usage')).doesNotExist('vertical bar chart does not render');
-    assert
-      .dom(usageStats)
-      .hasText(
-        `Secrets sync usage This data can be used to understand how many secrets sync clients have been used for this date range. A secret with a configured sync destination would qualify as a unique and active client. Total sync clients ${total}`,
-        'renders sync stats instead of chart'
-      );
-    assert.dom(syncTab.total).doesNotExist('total sync counts does not exist');
-    assert.dom(syncTab.average).doesNotExist('average sync client counts does not exist');
-  });
-});
diff --git a/ui/tests/integration/components/clients/page/token-test.js b/ui/tests/integration/components/clients/page/token-test.js
deleted file mode 100644
index 15368fd1dd5..00000000000
--- a/ui/tests/integration/components/clients/page/token-test.js
+++ /dev/null
@@ -1,188 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { render, findAll } from '@ember/test-helpers';
-import hbs from 'htmlbars-inline-precompile';
-import clientsHandler from 'vault/mirage/handlers/clients';
-import { getUnixTime } from 'date-fns';
-import { calculateAverage } from 'vault/utils/chart-helpers';
-import { formatNumber } from 'core/helpers/format-number';
-import { dateFormat } from 'core/helpers/date-format';
-import { SELECTORS as ts } from 'vault/tests/helpers/clients';
-
-const START_TIME = getUnixTime(new Date('2023-10-01T00:00:00Z'));
-const END_TIME = getUnixTime(new Date('2024-01-31T23:59:59Z'));
-
-module('Integration | Component | clients | Page::Token', function (hooks) {
-  setupRenderingTest(hooks);
-  setupMirage(hooks);
-
-  hooks.beforeEach(async function () {
-    clientsHandler(this.server);
-    const store = this.owner.lookup('service:store');
-    const activityQuery = {
-      start_time: { timestamp: START_TIME },
-      end_time: { timestamp: END_TIME },
-    };
-    this.activity = await store.queryRecord('clients/activity', activityQuery);
-    this.newActivity = this.activity.byMonth.map((d) => d.new_clients);
-    this.versionHistory = await store
-      .findAll('clients/version-history')
-      .then((response) => {
-        return response.map(({ version, previousVersion, timestampInstalled }) => {
-          return {
-            version,
-            previousVersion,
-            timestampInstalled,
-          };
-        });
-      })
-      .catch(() => []);
-    this.startTimestamp = START_TIME;
-    this.endTimestamp = END_TIME;
-    this.renderComponent = () =>
-      render(hbs`
-        <Clients::Page::Token
-          @activity={{this.activity}}
-          @versionHistory={{this.versionHistory}}
-          @startTimestamp={{this.startTimestamp}}
-          @endTimestamp={{this.endTimestamp}}
-          @namespace={{this.ns}}
-          @mountPath={{this.mountPath}}
-        />
-      `);
-  });
-
-  test('it should render monthly total chart', async function (assert) {
-    const getAverage = (data) => {
-      const average = ['entity_clients', 'non_entity_clients'].reduce((count, key) => {
-        return (count += calculateAverage(data, key) || 0);
-      }, 0);
-      return formatNumber([average]);
-    };
-    const expectedTotal = getAverage(this.activity.byMonth);
-    const expectedNew = getAverage(this.newActivity);
-    const chart = ts.charts.chart('monthly total');
-
-    await this.renderComponent();
-
-    assert
-      .dom(ts.charts.statTextValue('Average total clients per month'))
-      .hasText(expectedTotal, 'renders correct total clients');
-    assert
-      .dom(ts.charts.statTextValue('Average new clients per month'))
-      .hasText(expectedNew, 'renders correct new clients');
-    // assert bar chart is correct
-    findAll(`${chart} ${ts.charts.bar.xAxisLabel}`).forEach((e, i) => {
-      assert
-        .dom(e)
-        .hasText(
-          `${this.activity.byMonth[i].month}`,
-          `renders x-axis labels for bar chart: ${this.activity.byMonth[i].month}`
-        );
-    });
-    assert
-      .dom(`${chart} ${ts.charts.bar.dataBar}`)
-      .exists(
-        { count: this.activity.byMonth.filter((m) => m.counts !== null).length * 2 },
-        'renders correct number of data bars'
-      );
-    const formattedTimestamp = dateFormat([this.activity.responseTimestamp, 'MMM d yyyy, h:mm:ss aaa'], {
-      withTimeZone: true,
-    });
-    assert
-      .dom(`${chart} ${ts.charts.timestamp}`)
-      .hasText(`Updated ${formattedTimestamp}`, 'renders timestamp');
-    assert.dom(`${chart} ${ts.charts.legendLabel(1)}`).hasText('Entity clients', 'Legend label renders');
-    assert.dom(`${chart} ${ts.charts.legendLabel(2)}`).hasText('Non-entity clients', 'Legend label renders');
-  });
-
-  test('it should render monthly new chart', async function (assert) {
-    const expectedNewEntity = formatNumber([calculateAverage(this.newActivity, 'entity_clients')]);
-    const expectedNewNonEntity = formatNumber([calculateAverage(this.newActivity, 'non_entity_clients')]);
-    const chart = ts.charts.chart('monthly new');
-
-    await this.renderComponent();
-
-    assert
-      .dom(ts.charts.statTextValue('Average new entity clients per month'))
-      .hasText(expectedNewEntity, 'renders correct new entity clients');
-    assert
-      .dom(ts.charts.statTextValue('Average new non-entity clients per month'))
-      .hasText(expectedNewNonEntity, 'renders correct new nonentity clients');
-    // assert bar chart is correct
-    findAll(`${chart} ${ts.charts.bar.xAxisLabel}`).forEach((e, i) => {
-      assert
-        .dom(e)
-        .hasText(
-          `${this.activity.byMonth[i].month}`,
-          `renders x-axis labels for bar chart: ${this.activity.byMonth[i].month}`
-        );
-    });
-    assert
-      .dom(`${chart} ${ts.charts.bar.dataBar}`)
-      .exists(
-        { count: this.activity.byMonth.filter((m) => m.counts !== null).length * 2 },
-        'renders correct number of data bars'
-      );
-    const formattedTimestamp = dateFormat([this.activity.responseTimestamp, 'MMM d yyyy, h:mm:ss aaa'], {
-      withTimeZone: true,
-    });
-    assert
-      .dom(`${chart} ${ts.charts.timestamp}`)
-      .hasText(`Updated ${formattedTimestamp}`, 'renders timestamp');
-    assert.dom(`${chart} ${ts.charts.legendLabel(1)}`).hasText('Entity clients', 'Legend label renders');
-    assert.dom(`${chart} ${ts.charts.legendLabel(2)}`).hasText('Non-entity clients', 'Legend label renders');
-  });
-
-  test('it should render empty state for no new monthly data', async function (assert) {
-    this.activity.byMonth = this.activity.byMonth.map((d) => ({
-      ...d,
-      new_clients: { month: d.month },
-    }));
-    const chart = ts.charts.chart('monthly-new');
-
-    await this.renderComponent();
-
-    assert.dom(`${chart} ${ts.charts.verticalBar}`).doesNotExist('Chart does not render');
-    assert.dom(`${chart} ${ts.charts.legend}`).doesNotExist('Legend does not render');
-    assert.dom(ts.emptyStateTitle).hasText('No new clients');
-    assert.dom(ts.tokenTab.entity).doesNotExist('New client counts does not exist');
-    assert.dom(ts.tokenTab.nonentity).doesNotExist('Average new client counts does not exist');
-  });
-
-  test('it should render usage stats', async function (assert) {
-    assert.expect(6);
-
-    this.activity.endTime = this.activity.startTime;
-    const {
-      total: { entity_clients, non_entity_clients },
-    } = this.activity;
-
-    const checkUsage = () => {
-      assert
-        .dom(ts.charts.statTextValue('Total clients'))
-        .hasText(formatNumber([entity_clients + non_entity_clients]), 'Total clients value renders');
-      assert
-        .dom(ts.charts.statTextValue('Entity clients'))
-        .hasText(formatNumber([entity_clients]), 'Entity clients value renders');
-      assert
-        .dom(ts.charts.statTextValue('Non-entity clients'))
-        .hasText(formatNumber([non_entity_clients]), 'Non-entity clients value renders');
-    };
-
-    // total usage should display for single month query
-    await this.renderComponent();
-    checkUsage();
-
-    // total usage should display when there is no monthly data
-    this.activity.byMonth = null;
-    await this.renderComponent();
-    checkUsage();
-  });
-});
diff --git a/ui/tests/integration/components/clients/running-total-test.js b/ui/tests/integration/components/clients/running-total-test.js
index 90cd5aafd1c..54270ed7e78 100644
--- a/ui/tests/integration/components/clients/running-total-test.js
+++ b/ui/tests/integration/components/clients/running-total-test.js
@@ -1,33 +1,33 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { render } from '@ember/test-helpers';
+import { click, find, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import clientsHandler from 'vault/mirage/handlers/clients';
+import clientsHandler, { LICENSE_START, STATIC_NOW } from 'vault/mirage/handlers/clients';
 import sinon from 'sinon';
-import { formatRFC3339, getUnixTime } from 'date-fns';
+import { getUnixTime } from 'date-fns';
 import { findAll } from '@ember/test-helpers';
 import { formatNumber } from 'core/helpers/format-number';
 import timestamp from 'core/utils/timestamp';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
-import { SELECTORS as ts } from 'vault/tests/helpers/clients';
+import { CLIENT_COUNT, CHARTS } from 'vault/tests/helpers/clients/client-count-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { parseAPITimestamp } from 'core/utils/date-formatters';
 
-const START_TIME = getUnixTime(new Date('2023-10-01T00:00:00Z'));
+const START_TIME = getUnixTime(LICENSE_START);
 
 module('Integration | Component | clients/running-total', function (hooks) {
   setupRenderingTest(hooks);
   setupMirage(hooks);
 
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => new Date('2024-01-31T23:59:59Z'));
-  });
-
   hooks.beforeEach(async function () {
+    this.flags = this.owner.lookup('service:flags');
+    this.flags.activatedFlags = ['secrets-sync'];
+    sinon.replace(timestamp, 'now', sinon.fake.returns(STATIC_NOW));
     clientsHandler(this.server);
     const store = this.owner.lookup('service:store');
     const activityQuery = {
@@ -35,160 +35,162 @@ module('Integration | Component | clients/running-total', function (hooks) {
       end_time: { timestamp: getUnixTime(timestamp.now()) },
     };
     this.activity = await store.queryRecord('clients/activity', activityQuery);
-    this.newActivity = this.activity.byMonth.map((d) => d.new_clients);
-    this.totalUsageCounts = this.activity.total;
-    this.set('timestamp', formatRFC3339(timestamp.now()));
-    this.set('chartLegend', [
-      { label: 'entity clients', key: 'entity_clients' },
-      { label: 'non-entity clients', key: 'non_entity_clients' },
-    ]);
-    // Fails on #ember-testing-container
-    setRunOptions({
-      rules: {
-        'scrollable-region-focusable': { enabled: false },
-      },
-    });
-  });
-
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
+    this.byMonthNewClients = this.activity.byMonth.map((d) => d.new_clients);
 
-  test('it renders with full monthly activity data', async function (assert) {
-    const expectedTotalEntity = formatNumber([this.totalUsageCounts.entity_clients]);
-    const expectedTotalNonEntity = formatNumber([this.totalUsageCounts.non_entity_clients]);
-    // const expectedTotalSync = formatNumber([this.totalUsageCounts.secret_syncs]);
-
-    await render(hbs`
+    this.renderComponent = async () => {
+      await render(hbs`
       <Clients::RunningTotal
-        @byMonthActivityData={{this.activity.byMonth}}
-        @runningTotals={{this.totalUsageCounts}}
-        @upgradeData={{this.upgradeDuringActivity}}
-        @responseTimestamp={{this.timestamp}}
-        @isHistoricalMonth={{false}}
+        @byMonthNewClients={{this.byMonthNewClients}}
+        @runningTotals={{this.activity.total}}
       />
     `);
+    };
+  });
+
+  test('it renders with full monthly activity data', async function (assert) {
+    await this.renderComponent();
 
-    assert.dom(ts.charts.chart('running total')).exists('running total component renders');
-    assert.dom(ts.charts.lineChart).exists('line chart renders');
-    assert
-      .dom(ts.charts.statTextValue('Entity clients'))
-      .hasText(`${expectedTotalEntity}`, `renders correct total entity average ${expectedTotalEntity}`);
     assert
-      .dom(ts.charts.statTextValue('Non-entity clients'))
-      .hasText(
-        `${expectedTotalNonEntity}`,
-        `renders correct total nonentity average ${expectedTotalNonEntity}`
-      );
-    // * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-    // assert
-    //   .dom(ts.charts.statTextValue('Secrets sync clients'))
-    //   .hasText(`${expectedTotalSync}`, `renders correct total sync ${expectedTotalSync}`);
+      .dom(CLIENT_COUNT.card('Client usage trends for selected billing period'))
+      .exists('running total component renders');
+    assert.dom(CHARTS.chart('Client usage by month')).exists('bar chart renders');
+    assert.dom(CHARTS.legend).hasText('New clients');
+    const expectedColor = 'rgb(28, 52, 95)';
+    const color = getComputedStyle(find(CHARTS.legendDot(1))).backgroundColor;
+    assert.strictEqual(color, expectedColor, `actual color: ${color}, expected color: ${expectedColor}`);
 
-    // assert line chart is correct
-    findAll(ts.charts.line.xAxisLabel).forEach((e, i) => {
+    const expectedValues = {
+      'Entity clients': formatNumber([this.activity.total.entity_clients]),
+      'Non-entity clients': formatNumber([this.activity.total.non_entity_clients]),
+      'ACME clients': formatNumber([this.activity.total.acme_clients]),
+      'Secret sync clients': formatNumber([this.activity.total.secret_syncs]),
+    };
+    for (const label in expectedValues) {
       assert
-        .dom(e)
+        .dom(CLIENT_COUNT.statLegendValue(label))
         .hasText(
-          `${this.activity.byMonth[i].month}`,
-          `renders x-axis labels for line chart: ${this.activity.byMonth[i].month}`
+          `${expectedValues[label]} ${label}`,
+          `stat label: ${label} renders correct total: ${expectedValues[label]}`
         );
+    }
+
+    // assert bar chart is correct
+    findAll(CHARTS.xAxisLabel).forEach((e, i) => {
+      const timestamp = this.byMonthNewClients[i].timestamp;
+      const displayMonth = parseAPITimestamp(timestamp, 'M/yy');
+      assert.dom(e).hasText(displayMonth, `renders x-axis labels for bar chart: ${displayMonth}`);
     });
     assert
-      .dom(ts.charts.line.plotPoint)
-      .exists(
-        { count: this.activity.byMonth.filter((m) => m.counts !== null).length },
-        'renders correct number of plot points'
-      );
+      .dom(CHARTS.verticalBar)
+      .exists({ count: this.byMonthNewClients.length }, 'renders correct number of bars ');
   });
 
-  test('it renders with no new monthly data', async function (assert) {
-    this.set(
-      'monthlyWithoutNew',
-      this.activity.byMonth.map((d) => ({
-        ...d,
-        new_clients: { month: d.month },
-      }))
-    );
-    const expectedTotalEntity = formatNumber([this.totalUsageCounts.entity_clients]);
-    const expectedTotalNonEntity = formatNumber([this.totalUsageCounts.non_entity_clients]);
-    // const expectedTotalSync = formatNumber([this.totalUsageCounts.secret_syncs]);
-
-    await render(hbs`
-      <Clients::RunningTotal
-        @byMonthActivityData={{this.monthlyWithoutNew}}
-        @runningTotals={{this.totalUsageCounts}}
-        @responseTimestamp={{this.timestamp}}
-        @isHistoricalMonth={{false}}
-      />
-    `);
-    assert.dom(ts.charts.chart('running total')).exists('running total component renders');
-    assert.dom(ts.charts.lineChart).exists('line chart renders');
+  test('it toggles to split chart by client type', async function (assert) {
+    await this.renderComponent();
+    await click(GENERAL.inputByAttr('toggle view'));
 
     assert
-      .dom(ts.charts.statTextValue('Entity clients'))
-      .hasText(`${expectedTotalEntity}`, `renders correct total entity average ${expectedTotalEntity}`);
+      .dom(CLIENT_COUNT.card('Client usage trends for selected billing period'))
+      .exists('running total component renders');
+    assert.dom(CHARTS.chart('Client usage by month')).exists('bar chart renders');
     assert
-      .dom(ts.charts.statTextValue('Non-entity clients'))
+      .dom(CHARTS.legend)
       .hasText(
-        `${expectedTotalNonEntity}`,
-        `renders correct total nonentity average ${expectedTotalNonEntity}`
+        'Entity clients Non-entity clients ACME clients Secret sync clients',
+        'it renders legend in order that matches the stacked bar data and secret sync clients is last'
       );
-    // * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-    // assert
-    //   .dom(ts.charts.statTextValue('Secrets sync clients'))
-    //   .hasText(`${expectedTotalSync}`, `renders correct total sync ${expectedTotalSync}`);
-  });
 
-  test('it renders with single historical month data', async function (assert) {
-    const singleMonth = this.activity.byMonth[this.activity.byMonth.length - 1];
-    const singleMonthNew = this.newActivity[this.newActivity.length - 1];
-    this.set('singleMonth', [singleMonth]);
-    const expectedTotalClients = formatNumber([singleMonth.clients]);
-    const expectedTotalEntity = formatNumber([singleMonth.entity_clients]);
-    const expectedTotalNonEntity = formatNumber([singleMonth.non_entity_clients]);
-    // const expectedTotalSync = formatNumber([singleMonth.secret_syncs]);
-    const expectedNewClients = formatNumber([singleMonthNew.clients]);
-    const expectedNewEntity = formatNumber([singleMonthNew.entity_clients]);
-    const expectedNewNonEntity = formatNumber([singleMonthNew.non_entity_clients]);
-    // const expectedNewSyncs = formatNumber([singleMonthNew.secret_syncs]);
-    const { statTextValue } = ts.charts;
-
-    await render(hbs`
-      <Clients::RunningTotal
-        @byMonthActivityData={{this.singleMonth}}
-        @runningTotals={{this.totalUsageCounts}}
-        @responseTimestamp={{this.timestamp}}
-        @isHistoricalMonth={{true}}
-      />
-    `);
-    assert.dom(ts.charts.lineChart).doesNotExist('line chart does not render');
-    assert.dom(statTextValue()).exists({ count: 6 }, 'renders 6 stat text containers'); // after SYNC BETA update to 8
-    assert
-      .dom(`[data-test-new] ${statTextValue('New clients')}`)
-      .hasText(`${expectedNewClients}`, `renders correct total new clients: ${expectedNewClients}`);
+    // assert each legend item is correct
+    const expectedLegend = [
+      { label: 'Entity clients', color: 'rgb(66, 105, 208)' },
+      { label: 'Non-entity clients', color: 'rgb(239, 177, 23)' },
+      { label: 'ACME clients', color: 'rgb(255, 114, 92)' },
+      { label: 'Secret sync clients', color: 'rgb(108, 197, 176)' },
+    ];
+
+    findAll('.legend-item').forEach((e, i) => {
+      const { label, color } = expectedLegend[i];
+      assert.dom(e).hasText(label, `legend renders label: ${label}`);
+      const dotColor = getComputedStyle(find(CHARTS.legendDot(i + 1))).backgroundColor;
+      assert.strictEqual(dotColor, color, `${label} - actual color: ${dotColor}, expected: ${color}`);
+    });
+
+    // assert bar chart is correct
+    findAll(CHARTS.xAxisLabel).forEach((e, i) => {
+      const timestamp = this.byMonthNewClients[i].timestamp;
+      const displayMonth = parseAPITimestamp(timestamp, 'M/yy');
+      assert.dom(e).hasText(`${displayMonth}`, `renders x-axis labels for bar chart: ${displayMonth}`);
+    });
+
+    const months = this.byMonthNewClients.length;
+    const barsPerMonth = expectedLegend.length;
     assert
-      .dom(`[data-test-new] ${statTextValue('Entity clients')}`)
-      .hasText(`${expectedNewEntity}`, `renders correct total new entity: ${expectedNewEntity}`);
+      .dom(CHARTS.verticalBar)
+      .exists({ count: months * barsPerMonth }, `renders ${barsPerMonth} bars per month`);
+  });
+
+  test('it renders when no monthly breakdown is available', async function (assert) {
+    this.byMonthNewClients = [];
+    await this.renderComponent();
+    const expectedStats = {
+      Entity: formatNumber([this.activity.total.entity_clients]),
+      'Non-entity': formatNumber([this.activity.total.non_entity_clients]),
+      ACME: formatNumber([this.activity.total.acme_clients]),
+      'Secret sync': formatNumber([this.activity.total.secret_syncs]),
+    };
+    for (const label in expectedStats) {
+      assert
+        .dom(CLIENT_COUNT.statTextValue(label))
+        .hasText(
+          `${expectedStats[label]}`,
+          `stat label: ${label} renders single month new clients: ${expectedStats[label]}`
+        );
+    }
+    assert.dom(CHARTS.chart('Client usage by month')).doesNotExist('bar chart does not render');
+    assert.dom(CLIENT_COUNT.statTextValue()).exists({ count: 5 }, 'renders 5 stat text containers');
+  });
+
+  test('it hides secret sync totals when feature is not activated', async function (assert) {
+    this.flags.activatedFlags = [];
+    // reset secret sync clients to 0
+    this.byMonthNewClients = this.byMonthNewClients.map((obj) => ({ ...obj, secret_syncs: 0 }));
+
+    await this.renderComponent();
+
     assert
-      .dom(`[data-test-new] ${statTextValue('Non-entity clients')}`)
-      .hasText(`${expectedNewNonEntity}`, `renders correct total new non-entity: ${expectedNewNonEntity}`);
-    // * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-    // assert
-    //   .dom(`[data-test-new] ${statTextValue('Secrets sync clients')}`)
-    //   .hasText(`${expectedNewSyncs}`, `renders correct total new non-entity: ${expectedNewSyncs}`);
+      .dom(CLIENT_COUNT.card('Client usage trends for selected billing period'))
+      .exists('running total component renders');
+    assert.dom(CHARTS.chart('Client usage by month')).exists('bar chart renders');
+    assert.dom(CLIENT_COUNT.statLegendValue('Entity clients')).exists();
+    assert.dom(CLIENT_COUNT.statLegendValue('Non-entity clients')).exists();
     assert
-      .dom(`[data-test-total] ${statTextValue('Total monthly clients')}`)
-      .hasText(`${expectedTotalClients}`, `renders correct total clients: ${expectedTotalClients}`);
+      .dom(CLIENT_COUNT.statLegendValue('Secret sync clients'))
+      .doesNotExist('does not render secret syncs');
+
+    // check toggle view
+    await click(GENERAL.inputByAttr('toggle view'));
     assert
-      .dom(`[data-test-total] ${statTextValue('Entity clients')}`)
-      .hasText(`${expectedTotalEntity}`, `renders correct total entity: ${expectedTotalEntity}`);
+      .dom(CHARTS.legend)
+      .hasText('Entity clients Non-entity clients ACME clients', 'legend does not include sync clients');
+
+    // assert each legend item is correct
+    const expectedLegend = [
+      { label: 'Entity clients', color: 'rgb(66, 105, 208)' },
+      { label: 'Non-entity clients', color: 'rgb(239, 177, 23)' },
+      { label: 'ACME clients', color: 'rgb(255, 114, 92)' },
+    ];
+
+    findAll('.legend-item').forEach((e, i) => {
+      const { label, color } = expectedLegend[i];
+      assert.dom(e).hasText(label, `legend renders label: ${label}`);
+      const dotColor = getComputedStyle(find(CHARTS.legendDot(i + 1))).backgroundColor;
+      assert.strictEqual(dotColor, color, `${label} - actual color: ${dotColor}, expected: ${color}`);
+    });
+
+    const months = this.byMonthNewClients.length;
+    const barsPerMonth = expectedLegend.length;
     assert
-      .dom(`[data-test-total] ${statTextValue('Non-entity clients')}`)
-      .hasText(`${expectedTotalNonEntity}`, `renders correct total non-entity: ${expectedTotalNonEntity}`);
-    // * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-    // assert
-    //   .dom(`[data-test-total] ${statTextValue('Secrets sync clients')}`)
-    //   .hasText(`${expectedTotalSync}`, `renders correct total sync: ${expectedTotalSync}`);
+      .dom(CHARTS.verticalBar)
+      .exists({ count: months * barsPerMonth }, `renders ${barsPerMonth} bars per month`);
   });
 });
diff --git a/ui/tests/integration/components/clients/table-test.js b/ui/tests/integration/components/clients/table-test.js
new file mode 100644
index 00000000000..5d472d621db
--- /dev/null
+++ b/ui/tests/integration/components/clients/table-test.js
@@ -0,0 +1,231 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { click, fillIn, findAll, render, waitFor } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CLIENT_COUNT } from 'vault/tests/helpers/clients/client-count-selectors';
+
+const MOCK_DATA = [
+  { island: 'Maldives', visit_length: 5, is_booked: false, trip_date: '2025-06-22T00:00:00.000Z' },
+  { island: 'Bora Bora', visit_length: 7, is_booked: true, trip_date: '2025-03-15T00:00:00.000Z' },
+  { island: 'Fiji', visit_length: 10, is_booked: true, trip_date: '2025-09-08T00:00:00.000Z' },
+  { island: 'Santorini', visit_length: 4, is_booked: false, trip_date: '2026-04-10T00:00:00.000Z' },
+  { island: 'Maui', visit_length: 8, is_booked: true, trip_date: '2026-01-18T00:00:00.000Z' },
+  { island: 'Seychelles', visit_length: 6, is_booked: false, trip_date: '2025-12-03T00:00:00.000Z' },
+];
+module('Integration | Component | clients/table', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(async function () {
+    this.data = undefined;
+    this.columns = [
+      { key: 'island', label: 'Islands', isSortable: true },
+      { key: 'visit_length', label: 'Visit length', isSortable: true },
+      { key: 'is_booked', label: 'Vacation booking status', isSortable: true },
+      { key: 'trip_date', label: 'Date trip starts', isSortable: true },
+    ];
+    this;
+    this.initiallySortBy = undefined;
+    this.setPageSize = undefined;
+    this.showPaginationSizeSelector = undefined;
+    // helper function to setup table with X number of simple objects for pagination tests
+    this.mockMoreData = (recordNumber) => {
+      const record = (i) => ({ id: i, name: `record-${i}` });
+      this.columns = [
+        { key: 'id', label: 'ID', isSortable: true },
+        { key: 'name', label: 'Name', isSortable: true },
+      ];
+      this.data = Array.from({ length: recordNumber }, (_, i) => record(i));
+    };
+    this.renderComponent = async () => {
+      return render(hbs`
+          <Clients::Table
+            @columns={{this.columns}}
+            @data={{this.data}}
+            @initiallySortBy={{this.initiallySortBy}}
+            @setPageSize={{this.setPageSize}}
+            @showPaginationSizeSelector={{this.showPaginationSizeSelector}}
+          />`);
+    };
+  });
+
+  test('it renders default empty state when no data exists', async function (assert) {
+    await this.renderComponent();
+    assert.dom(CLIENT_COUNT.card('table empty state')).hasText('No data to display');
+  });
+
+  test('it renders yielded empty state block when no data exists', async function (assert) {
+    await render(hbs`
+      <Clients::Table @columns={{this.columns}} @data={{this.data}}>
+      <:emptyState>Oh no, there's no data!</:emptyState>
+      </Clients::Table>`);
+    assert.dom(CLIENT_COUNT.card('table empty state')).hasText("Oh no, there's no data!");
+  });
+
+  test('it renders and paginates data', async function (assert) {
+    this.data = MOCK_DATA;
+    await this.renderComponent();
+    assert.dom(CLIENT_COUNT.card('table empty state')).doesNotExist();
+    assert.dom(GENERAL.paginationInfo).hasText(`1–5 of ${this.data.length}`);
+    await click(GENERAL.nextPage);
+    assert.dom(GENERAL.tableData(0, 'island')).hasText('Seychelles', 'it paginates the data');
+  });
+
+  test('it sorts table data', async function (assert) {
+    this.data = MOCK_DATA;
+    const assertSortOrder = (expectedValues, { column, page }) => {
+      expectedValues.forEach((value, idx) => {
+        assert
+          .dom(GENERAL.tableData(idx, column))
+          .hasText(value, `page ${page}, row ${idx} has ${column}: ${value}`);
+      });
+    };
+
+    await this.renderComponent();
+    const [firstColumn, secondColumn, thirdColumn, fourthColumn] = findAll(GENERAL.icon('swap-vertical'));
+    await click(firstColumn);
+    assertSortOrder(['Bora Bora', 'Fiji', 'Maldives', 'Maui', 'Santorini'], { column: 'island', page: 1 });
+    await click(GENERAL.nextPage);
+    assertSortOrder(['Seychelles'], { column: 'island', page: 2 });
+
+    await click(GENERAL.prevPage);
+    await click(secondColumn);
+    assertSortOrder(['4', '5', '6', '7', '8'], { column: 'visit_length', page: 1 });
+    await click(GENERAL.nextPage);
+    assertSortOrder(['10'], { column: 'visit_length', page: 2 });
+
+    await click(GENERAL.prevPage);
+    await click(thirdColumn);
+    assertSortOrder(['false', 'false', 'false', 'true', 'true'], { column: 'is_booked', page: 1 });
+    await click(GENERAL.nextPage);
+    assertSortOrder(['true'], { column: 'is_booked', page: 2 });
+
+    await click(GENERAL.prevPage);
+    await click(fourthColumn);
+    assertSortOrder(
+      [
+        '2025-03-15T00:00:00.000Z',
+        '2025-06-22T00:00:00.000Z',
+        '2025-09-08T00:00:00.000Z',
+        '2025-12-03T00:00:00.000Z',
+        '2026-01-18T00:00:00.000Z',
+      ],
+      {
+        column: 'trip_date',
+        page: 1,
+      }
+    );
+    await click(GENERAL.nextPage);
+    assertSortOrder(['2026-04-10T00:00:00.000Z'], {
+      column: 'trip_date',
+      page: 2,
+    });
+  });
+
+  test('it pre-sorts table data if @initiallySortBy is set', async function (assert) {
+    this.data = MOCK_DATA;
+    this.initiallySortBy = { column: 'visit_length', direction: 'desc' };
+    await this.renderComponent();
+    assert.dom(GENERAL.tableColumnHeader(2, { isAdvanced: true })).hasAttribute('aria-sort', 'descending');
+    assert
+      .dom(`${GENERAL.tableColumnHeader(2, { isAdvanced: true })} ${GENERAL.icon('arrow-down')}`)
+      .exists();
+    const firstPage = ['Fiji', 'Maui', 'Bora Bora', 'Seychelles', 'Maldives'];
+    firstPage.forEach((value, idx) => {
+      assert.dom(GENERAL.tableData(idx, 'island')).hasText(value, `page 1, row ${idx} has ${value}`);
+    });
+    await click(GENERAL.nextPage);
+    const secondPage = ['Santorini'];
+    secondPage.forEach((value, idx) => {
+      assert.dom(GENERAL.tableData(idx, 'island')).hasText(value, `page 2, row ${idx} has ${value}`);
+    });
+  });
+
+  test('it sets page size if @setPageSize has a value', async function (assert) {
+    this.mockMoreData(15);
+    this.setPageSize = 8; // component default for testing is 3, so set to anything but 3
+    await this.renderComponent();
+    assert.dom(GENERAL.paginationInfo).hasText(`1–${this.setPageSize} of ${this.data.length}`);
+    let idx = 7; // 8th item, table items are 0-indexed
+    assert
+      .dom(GENERAL.tableData(idx, 'name'))
+      .hasText(this.data[idx].name, 'last row is 8th item in dataset');
+    await click(GENERAL.nextPage);
+    idx = 8; // 9th item, table items are 0-indexed
+    assert
+      .dom(GENERAL.tableData(0, 'name'))
+      .hasText(this.data[idx].name, 'first row on page 2 is 9th item in dataset');
+  });
+
+  test('it renders size selector if @showPaginationSizeSelector is true', async function (assert) {
+    this.mockMoreData(10);
+    this.setPageSize = 5;
+    this.showPaginationSizeSelector = true;
+    await this.renderComponent();
+
+    assert.dom(GENERAL.tableRow()).exists({ count: 5 }, '5 rows render');
+    assert.dom(GENERAL.paginationInfo).hasText(`1–${this.setPageSize} of ${this.data.length}`);
+    assert.dom(GENERAL.paginationSizeSelector).hasValue('5');
+    let idx = 4; // rows and ids are 0-indexed
+    assert.dom(GENERAL.tableData(idx, 'id')).hasText(`${idx}`, `last row is ${idx + 1}th item in dataset`);
+    await fillIn(GENERAL.paginationSizeSelector, '10');
+    idx = 9;
+    assert.dom(GENERAL.tableRow()).exists({ count: 10 }, '10 rows render');
+    assert.dom(GENERAL.paginationSizeSelector).hasValue('10', 'it updates the size selector to 10');
+    assert.dom(GENERAL.tableData(idx, 'id')).hasText(`${idx}`, `last row is ${idx + 1}th item in dataset`);
+  });
+
+  test('it renders "Deleted" badge for "mount_type" keys if the value is "deleted mount"', async function (assert) {
+    this.columns = [
+      { key: 'mount_type', label: 'Mount type' },
+      { key: 'mount_path', label: 'Mount path' },
+    ];
+    this.data = [
+      { mount_type: 'deleted mount', mount_path: 'auth/userpass/' },
+      { mount_type: 'ns_token', mount_path: 'auth/token/' },
+    ];
+    await this.renderComponent();
+    assert.dom('.hds-badge').exists({ count: 1 }, 'only one badge renders');
+    assert
+      .dom(`${GENERAL.tableData(0, 'mount_type')} .hds-badge`)
+      .exists('it renders a badge for the deleted mount')
+      .hasText('Deleted');
+  });
+
+  test('it resets pagination when data changes', async function (assert) {
+    // We need more than 5 rows, so here's more mock data!
+    const moreData = [
+      { island: 'Tahiti', visit_length: 12, is_booked: true, trip_date: '2025-05-10T00:00:00.000Z' },
+      { island: 'Barbados', visit_length: 6, is_booked: false, trip_date: '2025-08-25T00:00:00.000Z' },
+      { island: 'Cyprus', visit_length: 9, is_booked: true, trip_date: '2026-03-12T00:00:00.000Z' },
+      { island: 'Jamaica', visit_length: 7, is_booked: false, trip_date: '2025-11-05T00:00:00.000Z' },
+      { island: 'Crete', visit_length: 11, is_booked: true, trip_date: '2026-06-18T00:00:00.000Z' },
+      { island: 'Aruba', visit_length: 5, is_booked: false, trip_date: '2025-10-14T00:00:00.000Z' },
+    ];
+    this.data = [...MOCK_DATA, ...moreData];
+    this.showPaginationSizeSelector = true;
+    await this.renderComponent();
+    await fillIn(GENERAL.paginationSizeSelector, '10'); // Default is 5, so change to something else
+    await click(GENERAL.nextPage);
+    assert.dom(GENERAL.paginationInfo).hasText(`11–12 of ${this.data.length}`, 'it navigates to next page');
+    assert.dom(GENERAL.tableRow()).exists({ count: 2 }, '2 row renders');
+    // Changing the @data arg should trigger an update and reset pagination
+    // We have to use `this.set` to trigger did-update
+    this.set('data', [
+      { island: 'Palawan', visit_length: 9, is_booked: true, trip_date: '2025-11-14T00:00:00.000Z' },
+      { island: 'Mykonos', visit_length: 3, is_booked: false, trip_date: '2026-02-28T00:00:00.000Z' },
+    ]);
+
+    // There's a workaround using next() from @ember/runloop because the Hds::Pagination::Numbered component
+    // doesn't re-render when @currentPage updates. When that's fixed at the source we should be able to remove waitFor
+    await waitFor(GENERAL.paginationInfo);
+    assert.dom(GENERAL.paginationInfo).hasText(`1–2 of ${this.data.length}`);
+    assert.dom(GENERAL.tableRow()).exists({ count: 2 }, '2 rows render');
+    assert.dom(GENERAL.paginationSizeSelector).hasValue('10', 'page selector is unchanged when data updates');
+  });
+});
diff --git a/ui/tests/integration/components/clients/usage-stats-test.js b/ui/tests/integration/components/clients/usage-stats-test.js
index 36dbc2ce684..f5c7fdc19e2 100644
--- a/ui/tests/integration/components/clients/usage-stats-test.js
+++ b/ui/tests/integration/components/clients/usage-stats-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,68 +11,22 @@ import { hbs } from 'ember-cli-htmlbars';
 module('Integration | Component | clients/usage-stats', function (hooks) {
   setupRenderingTest(hooks);
 
-  test('it renders defaults', async function (assert) {
-    await render(hbs`<Clients::UsageStats />`);
+  test('it renders', async function (assert) {
+    await render(
+      hbs`
+        <Clients::UsageStats @title="My stats" @description="a very important description">
+         yielded content!
+        </Clients::UsageStats>`
+    );
 
-    assert.dom('[data-test-stat-text]').exists({ count: 3 }, 'Renders 3 Stat texts even with no data passed');
-    assert.dom('[data-test-stat-text="total-clients"]').exists('Total clients exists');
-    assert.dom('[data-test-stat-text="total-clients"] .stat-value').hasText('-', 'renders dash when no data');
-    assert.dom('[data-test-stat-text="entity-clients"]').exists('Entity clients exists');
+    assert.dom('[data-test-usage-stats="My stats"]').exists();
+    assert.dom('h3').hasText('My stats', 'title renders in h3 tag');
+    assert.dom('p').hasText('a very important description', 'description renders in p tag');
     assert
-      .dom('[data-test-stat-text="entity-clients"] .stat-value')
-      .hasText('-', 'renders dash when no data');
-    assert.dom('[data-test-stat-text="non-entity-clients"]').exists('Non entity clients exists');
-    assert
-      .dom('[data-test-stat-text="non-entity-clients"] .stat-value')
-      .hasText('-', 'renders dash when no data');
+      .dom('[data-test-usage-stats="My stats"]')
+      .hasTextContaining('yielded content!', 'it renders yielded content');
     assert
       .dom('a')
-      .hasAttribute('href', 'https://developer.hashicorp.com/vault/tutorials/monitoring/usage-metrics');
-  });
-
-  test('it renders with token data', async function (assert) {
-    this.set('counts', {
-      clients: 17,
-      entity_clients: 7,
-      non_entity_clients: 10,
-    });
-    await render(hbs`<Clients::UsageStats @totalUsageCounts={{this.counts}} />`);
-
-    assert.dom('[data-test-stat-text]').exists({ count: 3 }, 'Renders 3 Stat texts');
-    assert
-      .dom('[data-test-stat-text="total-clients"] .stat-value')
-      .hasText('17', 'Total clients shows passed value');
-    assert
-      .dom('[data-test-stat-text="entity-clients"] .stat-value')
-      .hasText('7', 'entity clients shows passed value');
-    assert
-      .dom('[data-test-stat-text="non-entity-clients"] .stat-value')
-      .hasText('10', 'non entity clients shows passed value');
-  });
-
-  test('it renders with full totals data', async function (assert) {
-    this.set('counts', {
-      clients: 22,
-      entity_clients: 7,
-      non_entity_clients: 10,
-      secret_syncs: 5,
-    });
-
-    await render(hbs`<Clients::UsageStats @totalUsageCounts={{this.counts}} />`);
-
-    assert.dom('[data-test-stat-text]').exists({ count: 3 }, 'Renders 3 Stat texts'); // after SYNC BETA update to 4
-    assert
-      .dom('[data-test-stat-text="total-clients"] .stat-value')
-      .hasText('22', 'Total clients shows passed value');
-    assert
-      .dom('[data-test-stat-text="entity-clients"] .stat-value')
-      .hasText('7', 'entity clients shows passed value');
-    assert
-      .dom('[data-test-stat-text="non-entity-clients"] .stat-value')
-      .hasText('10', 'non entity clients shows passed value');
-    // * unavailable during SYNC BETA (1.16.0), planned for 1.16.1 release
-    // assert
-    //   .dom('[data-test-stat-text="secret-syncs"] .stat-value')
-    //   .hasText('5', 'secrets sync clients shows passed value');
+      .hasAttribute('href', 'https://developer.hashicorp.com/vault/docs/concepts/client-count/client-usage');
   });
 });
diff --git a/ui/tests/integration/components/clients/vertical-bar-chart-test.js b/ui/tests/integration/components/clients/vertical-bar-chart-test.js
deleted file mode 100644
index 678d5a563a0..00000000000
--- a/ui/tests/integration/components/clients/vertical-bar-chart-test.js
+++ /dev/null
@@ -1,114 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { render, findAll, find } from '@ember/test-helpers';
-import { hbs } from 'ember-cli-htmlbars';
-
-module('Integration | Component | clients/vertical-bar-chart', function (hooks) {
-  setupRenderingTest(hooks);
-  hooks.beforeEach(function () {
-    this.set('chartLegend', [
-      { label: 'entity clients', key: 'entity_clients' },
-      { label: 'non-entity clients', key: 'non_entity_clients' },
-    ]);
-  });
-
-  test('it renders chart and tooltip for total clients', async function (assert) {
-    const barChartData = [
-      { month: 'january', clients: 141, entity_clients: 91, non_entity_clients: 50, new_clients: 5 },
-      { month: 'february', clients: 251, entity_clients: 101, non_entity_clients: 150, new_clients: 5 },
-    ];
-    this.set('barChartData', barChartData);
-
-    await render(hbs`
-    <div class="chart-container-wide">
-      <Clients::VerticalBarChart
-        @dataset={{this.barChartData}}
-        @chartLegend={{this.chartLegend}}
-      />
-    </div>
-    `);
-    assert.dom('[data-test-vertical-bar-chart]').exists('renders chart');
-    assert
-      .dom('[data-test-vertical-chart="data-bar"]')
-      .exists({ count: barChartData.length * 2 }, 'renders correct number of bars'); // multiply length by 2 because bars are stacked
-
-    assert.dom(find('[data-test-vertical-chart="y-axis-labels"] text')).hasText('0', `y-axis starts at 0`);
-    findAll('[data-test-vertical-chart="x-axis-labels"] text').forEach((e, i) => {
-      assert.dom(e).hasText(`${barChartData[i].month}`, `renders x-axis label: ${barChartData[i].month}`);
-    });
-
-    // FLAKY after adding a11y testing, skip for now
-    // const tooltipHoverBars = findAll('[data-test-vertical-bar-chart] rect.tooltip-rect');
-    // for (const [i, bar] of tooltipHoverBars.entries()) {
-    //   await triggerEvent(bar, 'mouseover');
-    //   const tooltip = document.querySelector('.ember-modal-dialog');
-    //   assert
-    //     .dom(tooltip)
-    //     .includesText(
-    //       `${barChartData[i].clients} total clients ${barChartData[i].entity_clients} entity clients ${barChartData[i].non_entity_clients} non-entity clients`,
-    //       'tooltip text is correct'
-    //     );
-    // }
-  });
-
-  test('it renders chart and tooltip for new clients', async function (assert) {
-    const barChartData = [
-      { month: 'january', entity_clients: 91, non_entity_clients: 50, clients: 0 },
-      { month: 'february', entity_clients: 101, non_entity_clients: 150, clients: 110 },
-    ];
-    this.set('barChartData', barChartData);
-
-    await render(hbs`
-    <div class="chart-container-wide">
-      <Clients::VerticalBarChart
-        @dataset={{this.barChartData}}
-        @chartLegend={{this.chartLegend}}
-      />
-    </div>
-    `);
-
-    assert.dom('[data-test-vertical-bar-chart]').exists('renders chart');
-    assert
-      .dom('[data-test-vertical-chart="data-bar"]')
-      .exists({ count: barChartData.length * 2 }, 'renders correct number of bars'); // multiply length by 2 because bars are stacked
-
-    assert.dom(find('[data-test-vertical-chart="y-axis-labels"] text')).hasText('0', `y-axis starts at 0`);
-    findAll('[data-test-vertical-chart="x-axis-labels"] text').forEach((e, i) => {
-      assert.dom(e).hasText(`${barChartData[i].month}`, `renders x-axis label: ${barChartData[i].month}`);
-    });
-
-    // FLAKY after adding a11y testing, skip for now
-    // const tooltipHoverBars = findAll('[data-test-vertical-bar-chart] rect.tooltip-rect');
-    // for (const [i, bar] of tooltipHoverBars.entries()) {
-    //   await triggerEvent(bar, 'mouseover');
-    //   const tooltip = document.querySelector('.ember-modal-dialog');
-    //   assert
-    //     .dom(tooltip)
-    //     .includesText(
-    //       `${barChartData[i].clients} new clients ${barChartData[i].entity_clients} entity clients ${barChartData[i].non_entity_clients} non-entity clients`,
-    //       'tooltip text is correct'
-    //     );
-    // }
-  });
-
-  test('it renders empty state when no dataset', async function (assert) {
-    await render(hbs`
-    <div class="chart-container-wide">
-    <Clients::VerticalBarChart @noDataMessage="this is a custom message to explain why you're not seeing a vertical bar chart"/>
-    </div>
-    `);
-
-    assert.dom('[data-test-component="empty-state"]').exists('renders empty state when no data');
-    assert
-      .dom('[data-test-empty-state-subtext]')
-      .hasText(
-        `this is a custom message to explain why you're not seeing a vertical bar chart`,
-        'custom message renders'
-      );
-  });
-});
diff --git a/ui/tests/integration/components/config-ui/messages/page/create-and-edit-test.js b/ui/tests/integration/components/config-ui/messages/page/create-and-edit-test.js
index 7d81aed19c2..ed23f533658 100644
--- a/ui/tests/integration/components/config-ui/messages/page/create-and-edit-test.js
+++ b/ui/tests/integration/components/config-ui/messages/page/create-and-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,11 @@ import { render, click, fillIn } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { datetimeLocalStringFormat } from 'core/utils/date-formatters';
 import { format, addDays, startOfDay } from 'date-fns';
-import { PAGE } from 'vault/tests/helpers/config-ui/message-selectors';
+import { CUSTOM_MESSAGES } from 'vault/tests/helpers/config-ui/message-selectors';
+import timestamp from 'core/utils/timestamp';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+import CustomMessage from 'vault/forms/custom-message';
 
 module('Integration | Component | messages/page/create-and-edit', function (hooks) {
   setupRenderingTest(hooks);
@@ -19,61 +23,76 @@ module('Integration | Component | messages/page/create-and-edit', function (hook
   setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.context = { owner: this.engine };
-    this.store = this.owner.lookup('service:store');
-    this.message = this.store.createRecord('config-ui/message');
+    const now = new Date('2023-07-02T00:00:00Z'); // stub "now" for testing
+    sinon.replace(timestamp, 'now', sinon.fake.returns(now));
+
+    this.message = new CustomMessage(
+      {
+        authenticated: true,
+        type: 'banner',
+        start_time: addDays(startOfDay(timestamp.now()), 1).toISOString(),
+      },
+      { isNew: true }
+    );
+
+    this.renderComponent = () =>
+      render(hbs`<Messages::Page::CreateAndEdit @message={{this.message}} @messages={{this.messages}} />`, {
+        owner: this.engine,
+      });
   });
 
   test('it should display all the create form fields and default radio button values', async function (assert) {
-    assert.expect(17);
+    await this.renderComponent();
 
-    await render(hbs`<Messages::Page::CreateAndEdit @message={{this.message}} />`, {
-      owner: this.engine,
-    });
-
-    assert.dom(PAGE.title).hasText('Create message');
-    assert.dom(PAGE.radio('authenticated')).exists();
-    assert.dom(PAGE.radio('unauthenticated')).exists();
-    assert.dom(PAGE.radio('authenticated')).isChecked();
-    assert.dom(PAGE.radio('unauthenticated')).isNotChecked();
-    assert.dom(PAGE.radio('banner')).exists();
-    assert.dom(PAGE.radio('modal')).exists();
-    assert.dom(PAGE.radio('banner')).isChecked();
-    assert.dom(PAGE.radio('modal')).isNotChecked();
-    assert.dom(PAGE.field('title')).exists();
-    assert.dom(PAGE.field('message')).exists();
+    assert.dom(GENERAL.title).hasText('Create message');
+    assert.dom(GENERAL.fieldLabelbyAttr('authenticated')).hasText('Where should we display this message?');
+    assert.dom(CUSTOM_MESSAGES.radio('authenticated')).exists();
+    assert.dom(CUSTOM_MESSAGES.radio('unauthenticated')).exists();
+    assert.dom(CUSTOM_MESSAGES.radio('authenticated')).isChecked();
+    assert.dom(CUSTOM_MESSAGES.radio('unauthenticated')).isNotChecked();
+    assert.dom(GENERAL.fieldLabelbyAttr('type')).hasText('Type');
+    assert.dom(CUSTOM_MESSAGES.radio('banner')).exists();
+    assert.dom(CUSTOM_MESSAGES.radio('modal')).exists();
+    assert.dom(CUSTOM_MESSAGES.radio('banner')).isChecked();
+    assert.dom(CUSTOM_MESSAGES.radio('modal')).isNotChecked();
+    assert.dom(CUSTOM_MESSAGES.field('title')).exists();
+    assert.dom(CUSTOM_MESSAGES.field('message')).exists();
     assert.dom('[data-test-kv-key="0"]').exists();
     assert.dom('[data-test-kv-value="0"]').exists();
-    assert.dom(PAGE.input('startTime')).exists();
     assert
-      .dom(PAGE.input('startTime'))
-      .hasValue(format(addDays(startOfDay(new Date()), 1), datetimeLocalStringFormat));
-    assert.dom(PAGE.input('endTime')).exists();
-    assert.dom(PAGE.input('endTime')).hasValue('');
+      .dom(CUSTOM_MESSAGES.input('start_time'))
+      .hasValue(
+        format(addDays(startOfDay(timestamp.now()), 1), datetimeLocalStringFormat),
+        `message start_time defaults to midnight of following day. test context start_time: ${
+          this.message.start_time
+        }, now: ${timestamp.now().toISOString()}`
+      );
+    assert.dom(CUSTOM_MESSAGES.input('end_time')).hasValue('');
   });
 
   test('it should display validation errors for invalid form fields', async function (assert) {
     assert.expect(8);
-    await render(hbs`<Messages::Page::CreateAndEdit @message={{this.message}} />`, {
-      owner: this.engine,
-    });
 
-    await fillIn(PAGE.input('startTime'), '2024-01-20T00:00');
-    await fillIn(PAGE.input('endTime'), '2024-01-01T00:00');
-    await click(PAGE.button('create-message'));
-    assert.dom(PAGE.input('title')).hasClass('has-error-border');
-    assert.dom(`${PAGE.fieldValidation('title')} ${PAGE.inlineErrorMessage}`).hasText('Title is required.');
-    assert.dom(PAGE.input('message')).hasClass('has-error-border');
+    await this.renderComponent();
+
+    await fillIn(CUSTOM_MESSAGES.input('start_time'), '2024-01-20T00:00');
+    await fillIn(CUSTOM_MESSAGES.input('end_time'), '2024-01-01T00:00');
+    await click(GENERAL.submitButton);
+    assert
+      .dom(GENERAL.validationErrorByAttr('title'))
+      .exists('Validation error for field `title` renders')
+      .hasText('Title is required.');
     assert
-      .dom(`${PAGE.fieldValidation('message')} ${PAGE.inlineErrorMessage}`)
+      .dom(GENERAL.validationErrorByAttr('message'))
+      .exists('Validation error for field `message` renders')
       .hasText('Message is required.');
-    assert.dom(PAGE.input('startTime')).hasClass('has-error-border');
     assert
-      .dom(`${PAGE.fieldValidation('startTime')} ${PAGE.inlineErrorMessage}`)
+      .dom(GENERAL.validationErrorByAttr('start_time'))
+      .exists('Validation error for field `start_time` renders')
       .hasText('Start time is after end time.');
-    assert.dom(PAGE.input('endTime')).hasClass('has-error-border');
     assert
-      .dom(`${PAGE.fieldValidation('endTime')} ${PAGE.inlineErrorMessage}`)
+      .dom(GENERAL.validationErrorByAttr('end_time'))
+      .exists('Validation error for field `end_time` renders')
       .hasText('End time is before start time.');
   });
 
@@ -81,173 +100,158 @@ module('Integration | Component | messages/page/create-and-edit', function (hook
     assert.expect(1);
 
     this.server.post('/sys/config/ui/custom-messages', () => {
-      assert.ok(true, 'POST request made to create message');
+      assert.true(true, 'POST request made to create message');
     });
 
-    await render(hbs`<Messages::Page::CreateAndEdit @message={{this.message}} />`, {
-      owner: this.engine,
-    });
-    await fillIn(PAGE.input('title'), 'Awesome custom message title');
+    await this.renderComponent();
+
+    await fillIn(CUSTOM_MESSAGES.input('title'), 'create new message title from component');
     await fillIn(
-      PAGE.input('message'),
-      'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Pulvinar mattis nunc sed blandit libero volutpat sed cras ornare.'
+      CUSTOM_MESSAGES.input('message'),
+      'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'
     );
     await fillIn(
-      PAGE.input('startTime'),
+      CUSTOM_MESSAGES.input('start_time'),
       format(addDays(startOfDay(new Date('2023-12-12')), 1), datetimeLocalStringFormat)
     );
     await click('#specificDate');
     await fillIn(
-      PAGE.input('endTime'),
+      CUSTOM_MESSAGES.input('end_time'),
       format(addDays(startOfDay(new Date('2023-12-12')), 10), datetimeLocalStringFormat)
     );
     await fillIn('[data-test-kv-key="0"]', 'Learn more');
     await fillIn('[data-test-kv-value="0"]', 'www.learn.com');
-    await click(PAGE.button('create-message'));
+    await click(GENERAL.submitButton);
   });
 
   test('it should have form vaildations', async function (assert) {
-    assert.expect(4);
-    await render(hbs`<Messages::Page::CreateAndEdit @message={{this.message}} />`, {
-      owner: this.engine,
-    });
-    await click(PAGE.button('create-message'));
-    assert.dom(PAGE.input('title')).hasClass('has-error-border', 'show error border for title field');
-    assert.dom(`${PAGE.fieldValidation('title')} ${PAGE.inlineErrorMessage}`).hasText('Title is required.');
-    assert.dom(PAGE.input('message')).hasClass('has-error-border', 'show error border for message field');
-    assert
-      .dom(`${PAGE.fieldValidation('message')} ${PAGE.inlineErrorMessage}`)
-      .hasText('Message is required.');
+    assert.expect(2);
+
+    await this.renderComponent();
+
+    await click(GENERAL.submitButton);
+    assert.dom(`${GENERAL.validationErrorByAttr('title')}`).hasText('Title is required.');
+    assert.dom(`${GENERAL.validationErrorByAttr('message')}`).hasText('Message is required.');
   });
 
   test('it should prepopulate form if form is in edit mode', async function (assert) {
     assert.expect(13);
-    this.store.pushPayload('config-ui/message', {
-      modelName: 'config-ui/message',
+
+    this.message = new CustomMessage({
       id: 'hhhhh-iiii-lllll-dddd',
       type: 'modal',
       authenticated: false,
       title: 'Hello world',
       message: 'Blah blah blah. Some super long message.',
-      start_time: '2023-12-12T08:00:00.000Z',
-      end_time: '2023-12-21T08:00:00.000Z',
+      start_time: new Date('2023-12-12T08:00:00.000Z'),
+      end_time: new Date('2023-12-21T08:00:00.000Z'),
       link: { 'Learn more': 'www.learnmore.com' },
     });
-    this.message = this.store.peekRecord('config-ui/message', 'hhhhh-iiii-lllll-dddd');
-    await render(hbs`<Messages::Page::CreateAndEdit @message={{this.message}} />`, {
-      owner: this.engine,
-    });
 
-    assert.dom(PAGE.title).hasText('Edit message');
-    assert.dom(PAGE.radio('authenticated')).exists();
-    assert.dom(PAGE.radio('unauthenticated')).isChecked();
-    assert.dom(PAGE.radio('modal')).exists();
-    assert.dom(PAGE.radio('modal')).isChecked();
-    assert.dom(PAGE.input('title')).hasValue('Hello world');
-    assert.dom(PAGE.input('message')).hasValue('Blah blah blah. Some super long message.');
+    await this.renderComponent();
+
+    assert.dom(GENERAL.title).hasText('Edit message');
+    assert.dom(CUSTOM_MESSAGES.radio('authenticated')).exists();
+    assert.dom(CUSTOM_MESSAGES.radio('unauthenticated')).isChecked();
+    assert.dom(CUSTOM_MESSAGES.radio('modal')).exists();
+    assert.dom(CUSTOM_MESSAGES.radio('modal')).isChecked();
+    assert.dom(CUSTOM_MESSAGES.input('title')).hasValue('Hello world');
+    assert.dom(CUSTOM_MESSAGES.input('message')).hasValue('Blah blah blah. Some super long message.');
     assert.dom('[data-test-kv-key="0"]').exists();
     assert.dom('[data-test-kv-key="0"]').hasValue('Learn more');
     assert.dom('[data-test-kv-value="0"]').exists();
     assert.dom('[data-test-kv-value="0"]').hasValue('www.learnmore.com');
     await click('#specificDate');
     assert
-      .dom(PAGE.input('startTime'))
-      .hasValue(format(new Date(this.message.startTime), datetimeLocalStringFormat));
+      .dom(CUSTOM_MESSAGES.input('start_time'))
+      .hasValue(format(new Date(this.message.start_time), datetimeLocalStringFormat));
     assert
-      .dom(PAGE.input('endTime'))
-      .hasValue(format(new Date(this.message.endTime), datetimeLocalStringFormat));
+      .dom(CUSTOM_MESSAGES.input('end_time'))
+      .hasValue(format(new Date(this.message.end_time), datetimeLocalStringFormat));
   });
 
   test('it should show a preview image modal when preview is clicked', async function (assert) {
-    assert.expect(6);
-    await render(hbs`<Messages::Page::CreateAndEdit @message={{this.message}} />`, {
-      owner: this.engine,
-    });
-    await fillIn(PAGE.input('title'), 'Awesome custom message title');
+    await this.renderComponent();
+
+    await fillIn(CUSTOM_MESSAGES.input('title'), 'preview modal component test');
     await fillIn(
-      PAGE.input('message'),
-      'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Pulvinar mattis nunc sed blandit libero volutpat sed cras ornare.'
+      CUSTOM_MESSAGES.input('message'),
+      'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'
     );
-    await click(PAGE.button('preview'));
-    assert.dom(PAGE.modal('preview modal')).doesNotExist();
-    assert.dom(PAGE.modal('preview image')).exists();
-    assert.dom(PAGE.alertTitle('Awesome custom message title')).hasText('Awesome custom message title');
+    await click(GENERAL.button('preview'));
+    assert.dom(CUSTOM_MESSAGES.modal('preview modal')).doesNotExist();
+    assert.dom(CUSTOM_MESSAGES.modal('preview image')).exists();
     assert
-      .dom(PAGE.alertDescription('Awesome custom message title'))
-      .hasText(
-        'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Pulvinar mattis nunc sed blandit libero volutpat sed cras ornare.'
-      );
+      .dom(CUSTOM_MESSAGES.alertTitle('preview modal component test'))
+      .hasText('preview modal component test');
+    assert
+      .dom(CUSTOM_MESSAGES.alertDescription('preview modal component test'))
+      .hasText('Lorem ipsum dolor sit amet, consectetur adipiscing elit.');
     assert.dom('img').hasAttribute('src', '/ui/images/custom-messages-dashboard.png');
-    await click(PAGE.modalButton('Close'));
+
+    await click(GENERAL.button('Close preview'));
     await click('#unauthenticated');
-    await click(PAGE.button('preview'));
+    await click(GENERAL.button('preview'));
     assert.dom('img').hasAttribute('src', '/ui/images/custom-messages-login.png');
   });
 
   test('it should show a preview modal when preview is clicked', async function (assert) {
-    assert.expect(4);
-    await render(hbs`<Messages::Page::CreateAndEdit @message={{this.message}} />`, {
-      owner: this.engine,
-    });
-    await click(PAGE.radio('modal'));
-    await fillIn(PAGE.input('title'), 'Preview modal title');
-    await fillIn(PAGE.input('message'), 'Some preview modal message thats super long.');
-    await click(PAGE.button('preview'));
-    assert.dom(PAGE.modal('preview modal')).exists();
-    assert.dom(PAGE.modal('preview image')).doesNotExist();
-    assert.dom(PAGE.modalTitle('Preview modal title')).hasText('Preview modal title');
-    assert.dom(PAGE.modalBody('Preview modal title')).hasText('Some preview modal message thats super long.');
+    await this.renderComponent();
+
+    await click(CUSTOM_MESSAGES.radio('modal'));
+    await fillIn(CUSTOM_MESSAGES.input('title'), 'Preview modal title');
+    await fillIn(CUSTOM_MESSAGES.input('message'), 'Some preview modal message thats super long.');
+    await click(GENERAL.button('preview'));
+    assert.dom(CUSTOM_MESSAGES.modal('preview modal')).exists();
+    assert.dom(CUSTOM_MESSAGES.modal('preview image')).doesNotExist();
+    assert.dom(CUSTOM_MESSAGES.modalTitle('Preview modal title')).hasText('Preview modal title');
+    assert
+      .dom(CUSTOM_MESSAGES.modalBody('Preview modal title'))
+      .hasText('Some preview modal message thats super long.');
   });
 
   test('it should show multiple modal message', async function (assert) {
-    assert.expect(2);
-
-    this.store.pushPayload('config-ui/message', {
-      modelName: 'config-ui/message',
-      id: '01234567-89ab-cdef-0123-456789abcdef',
-      active: true,
-      type: 'modal',
-      authenticated: true,
-      title: 'Message title 1',
-      message: 'Some long long long message',
-      link: { here: 'www.example.com' },
-      startTime: '2021-08-01T00:00:00Z',
-      endTime: '',
-    });
-    this.store.pushPayload('config-ui/message', {
-      modelName: 'config-ui/message',
-      id: '01234567-89ab-vvvv-0123-456789abcdef',
-      active: true,
-      type: 'modal',
-      authenticated: false,
-      title: 'Message title 2',
-      message: 'Some long long long message',
-      link: { here: 'www.example.com' },
-      startTime: '2021-08-01T00:00:00Z',
-      endTime: '2090-08-01T00:00:00Z',
-    });
+    this.messages = [
+      {
+        id: '01234567-89ab-cdef-0123-456789abcdef',
+        active: true,
+        type: 'modal',
+        authenticated: true,
+        title: 'Message title 1',
+        message: 'Some long long long message',
+        link: { here: 'www.example.com' },
+        start_time: new Date('2021-08-01T00:00:00Z'),
+        end_time: '',
+      },
+      {
+        id: '01234567-89ab-vvvv-0123-456789abcdef',
+        active: true,
+        type: 'modal',
+        authenticated: false,
+        title: 'Message title 2',
+        message: 'Some long long long message',
+        link: { here: 'www.example.com' },
+        start_time: new Date('2021-08-01T00:00:00Z'),
+        end_time: new Date('2090-08-01T00:00:00Z'),
+      },
+    ];
 
-    this.messages = this.store.peekAll('config-ui/message');
+    await this.renderComponent();
 
-    await render(
-      hbs`<Messages::Page::CreateAndEdit @message={{this.message}} @messages={{this.messages}} @hasSomeActiveModals={{true}} />`,
-      {
-        owner: this.engine,
-      }
-    );
-    await fillIn(PAGE.input('title'), 'Awesome custom message title');
+    await fillIn(CUSTOM_MESSAGES.input('title'), 'multiple modal message component test');
     await fillIn(
-      PAGE.input('message'),
-      'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Pulvinar mattis nunc sed blandit libero volutpat sed cras ornare.'
+      CUSTOM_MESSAGES.input('message'),
+      'Lorem ipsum dolor sit amet, consectetur adipiscing elit.'
     );
-    await click(PAGE.radio('modal'));
-    await click(PAGE.button('create-message'));
-    assert.dom(PAGE.modalTitle('Warning: more than one modal')).exists();
+    await click(CUSTOM_MESSAGES.radio('modal'));
+    await click(GENERAL.submitButton);
+    assert.dom(CUSTOM_MESSAGES.modalTitle('Warning: more than one modal')).exists();
     assert
-      .dom(PAGE.modalBody('Warning: more than one modal'))
+      .dom(CUSTOM_MESSAGES.modalBody('Warning: more than one modal'))
       .hasText(
         'You have an active modal configured after the user logs in and are trying to create another one. It is recommended to avoid having more than one modal at once as it can be intrusive for users. Would you like to continue creating your message? Click “Confirm” to continue.'
       );
-    await click(PAGE.modalButton('confirm'));
+
+    await click(GENERAL.button('confirm-multiple'));
   });
 });
diff --git a/ui/tests/integration/components/config-ui/messages/page/details-test.js b/ui/tests/integration/components/config-ui/messages/page/details-test.js
index 84473f1dc6c..77a40a07173 100644
--- a/ui/tests/integration/components/config-ui/messages/page/details-test.js
+++ b/ui/tests/integration/components/config-ui/messages/page/details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,6 +10,7 @@ import { setupEngine } from 'ember-engines/test-support';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { dateFormat } from 'core/helpers/date-format';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const allFields = [
   { label: 'Active', key: 'active' },
@@ -17,8 +18,8 @@ const allFields = [
   { label: 'Authenticated', key: 'authenticated' },
   { label: 'Title', key: 'title' },
   { label: 'Message', key: 'message' },
-  { label: 'Start time', key: 'startTime' },
-  { label: 'End time', key: 'endTime' },
+  { label: 'Start time', key: 'start_time' },
+  { label: 'End time', key: 'end_time' },
   { label: 'Link', key: 'link' },
 ];
 
@@ -29,7 +30,6 @@ module('Integration | Component | messages/page/details', function (hooks) {
 
   hooks.beforeEach(function () {
     this.context = { owner: this.engine };
-    this.store = this.owner.lookup('service:store');
 
     this.server.post('/sys/capabilities-self', () => ({
       data: {
@@ -37,8 +37,7 @@ module('Integration | Component | messages/page/details', function (hooks) {
       },
     }));
 
-    this.store.pushPayload('config-ui/message', {
-      modelName: 'config-ui/message',
+    this.message = {
       id: '01234567-89ab-cdef-0123-456789abcdef',
       active: true,
       type: 'banner',
@@ -46,47 +45,45 @@ module('Integration | Component | messages/page/details', function (hooks) {
       title: 'Message title 1',
       message: 'Some long long long message',
       link: { here: 'www.example.com' },
-      start_time: '2021-08-01T00:00:00Z',
-      end_time: '',
-      canDeleteCustomMessages: true,
-      canEditCustomMessages: true,
-    });
+      start_time: new Date('2021-08-01T00:00:00Z'),
+      end_time: undefined,
+    };
+    this.capabilities = { canDelete: true, canUpdate: true };
   });
 
   test('it should show the message details', async function (assert) {
-    this.message = await this.store.peekRecord('config-ui/message', '01234567-89ab-cdef-0123-456789abcdef');
-
-    await render(hbs`<Messages::Page::Details @message={{this.message}} />`, {
-      owner: this.engine,
-    });
-    assert.dom('[data-test-page-title]').hasText('Message title 1');
+    await render(
+      hbs`<Messages::Page::Details @message={{this.message}} @capabilities={{this.capabilities}} />`,
+      this.context
+    );
+    assert.dom(GENERAL.title).hasText('Message title 1');
     assert
       .dom('[data-test-component="info-table-row"]')
       .exists({ count: allFields.length }, 'Correct number of filtered fields render');
 
     allFields.forEach((field) => {
-      assert
-        .dom(`[data-test-row-label="${field.label}"]`)
-        .hasText(field.label, `${field.label} label renders`);
-      if (field.key === 'startTime' || field.key === 'endTime') {
+      assert.dom(GENERAL.infoRowLabel(field.label)).hasText(field.label, `${field.label} label renders`);
+      if (field.key === 'start_time' || field.key === 'end_time') {
         const formattedDate = dateFormat([this.message[field.key], 'MMM d, yyyy hh:mm aaa'], {
           withTimeZone: true,
         });
         assert
-          .dom(`[data-test-row-value="${field.label}"]`)
+          .dom(GENERAL.infoRowValue(field.label))
           .hasText(formattedDate || 'Never', `${field.label} value renders`);
       } else if (field.key === 'authenticated' || field.key === 'active') {
         assert
-          .dom(`[data-test-value-div="${field.label}"]`)
+          .dom(GENERAL.infoRowValue(field.label))
           .hasText(this.message[field.key] ? 'Yes' : 'No', `${field.label} value renders`);
       } else if (field.key === 'link') {
-        assert.dom('[data-test-value-div="Link"]').exists();
-        assert.dom('[data-test-value-div="Link"] [data-test-link="message link"]').hasText('here');
+        assert.dom(GENERAL.infoRowValue('Link')).hasText('here');
       } else {
         assert
-          .dom(`[data-test-row-value="${field.label}"]`)
+          .dom(GENERAL.infoRowValue(field.label))
           .hasText(this.message[field.key], `${field.label} value renders`);
       }
     });
+
+    assert.dom(GENERAL.confirmTrigger).exists('delete button exists');
+    assert.dom(GENERAL.linkTo('edit')).exists();
   });
 });
diff --git a/ui/tests/integration/components/config-ui/messages/page/list-test.js b/ui/tests/integration/components/config-ui/messages/page/list-test.js
index 94e9bb355b3..ad5f6b6f837 100644
--- a/ui/tests/integration/components/config-ui/messages/page/list-test.js
+++ b/ui/tests/integration/components/config-ui/messages/page/list-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,16 +9,18 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { setupEngine } from 'ember-engines/test-support';
 import { render, click } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { PAGE } from 'vault/tests/helpers/config-ui/message-selectors';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { CUSTOM_MESSAGES } from 'vault/tests/helpers/config-ui/message-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const META = {
-  currentPage: 1,
-  lastPage: 1,
-  nextPage: 1,
-  prevPage: 1,
-  total: 3,
-  pageSize: 15,
+  value: {
+    currentPage: 1,
+    lastPage: 1,
+    nextPage: 1,
+    prevPage: 1,
+    total: 3,
+    pageSize: 15,
+  },
 };
 
 module('Integration | Component | messages/page/list', function (hooks) {
@@ -27,52 +29,62 @@ module('Integration | Component | messages/page/list', function (hooks) {
   setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
-    this.store = this.owner.lookup('service:store');
+    this.messages = [
+      {
+        id: '0',
+        active: true,
+        type: 'banner',
+        authenticated: true,
+        title: 'Message title 1',
+        message: 'Some long long long message',
+        link: { title: 'here', href: 'www.example.com' },
+        start_time: new Date('2021-08-01T00:00:00Z'),
+        end_time: undefined,
+      },
+      {
+        id: '1',
+        active: false,
+        type: 'modal',
+        authenticated: true,
+        title: 'Message title 2',
+        message: 'Some long long long message blah blah blah',
+        link: { title: 'here', href: 'www.example2.com' },
+        start_time: new Date('2023-07-01T00:00:00Z'),
+        end_time: new Date('2023-08-01T00:00:00Z'),
+      },
+      {
+        id: '2',
+        active: false,
+        type: 'banner',
+        authenticated: false,
+        title: 'Message title 3',
+        message: 'Some long long long message',
+        link: { title: 'here', href: 'www.example.com' },
+      },
+    ];
+    Object.defineProperty(this.messages, 'meta', META);
 
-    this.store.pushPayload('config-ui/message', {
-      modelName: 'config-ui/message',
-      id: '0',
-      active: true,
-      type: 'banner',
-      authenticated: true,
-      title: 'Message title 1',
-      message: 'Some long long long message',
-      link: { title: 'here', href: 'www.example.com' },
-      start_time: '2021-08-01T00:00:00Z',
-      end_time: '',
-    });
-    this.store.pushPayload('config-ui/message', {
-      modelName: 'config-ui/message',
-      id: '1',
-      active: false,
-      type: 'modal',
-      authenticated: true,
-      title: 'Message title 2',
-      message: 'Some long long long message blah blah blah',
-      link: { title: 'here', href: 'www.example2.com' },
-      start_time: '2023-07-01T00:00:00Z',
-      end_time: '2023-08-01T00:00:00Z',
-    });
-    this.store.pushPayload('config-ui/message', {
-      modelName: 'config-ui/message',
-      id: '2',
-      active: false,
-      type: 'banner',
-      authenticated: false,
-      title: 'Message title 3',
-      message: 'Some long long long message',
-      link: { title: 'here', href: 'www.example.com' },
-    });
+    this.renderComponent = () => {
+      const capabilitiesService = this.owner.lookup('service:capabilities');
+      this.capabilities = this.messages.reduce((obj, { id }) => {
+        const path = capabilitiesService.pathFor('customMessages', { id });
+        obj[path] = { canUpdate: true, canDelete: true };
+        return obj;
+      }, {});
+
+      return render(
+        hbs`<Messages::Page::List @messages={{this.messages}} @capabilities={{this.capabilities}} />`,
+        {
+          owner: this.engine,
+        }
+      );
+    };
   });
 
   test('it should show the messages empty state', async function (assert) {
     this.messages = [];
 
-    await render(hbs`<Messages::Page::List @messages={{this.messages}} />`, {
-      owner: this.engine,
-    });
-
+    await this.renderComponent();
     assert.dom('[data-test-empty-state-title]').hasText('No messages yet');
     assert
       .dom('[data-test-empty-state-message]')
@@ -82,22 +94,16 @@ module('Integration | Component | messages/page/list', function (hooks) {
   });
 
   test('it should show the list of custom messages', async function (assert) {
-    this.messages = this.store.peekAll('config-ui/message', {});
-    this.messages.meta = META;
-    await render(hbs`<Messages::Page::List @messages={{this.messages}} />`, {
-      owner: this.engine,
-    });
+    await this.renderComponent();
     assert.dom('[data-test-icon="message-circle"]').exists();
     for (const message of this.messages) {
-      assert.dom(PAGE.listItem('Message title 1')).exists();
-      assert.dom(`[data-linked-block-title="${message.id}"]`).hasText(message.title);
+      assert.dom(GENERAL.listItem(message.title)).exists('Message title is displayed');
     }
   });
 
   test('it should show max message warning modal', async function (assert) {
     for (let i = 0; i < 97; i++) {
-      this.store.pushPayload('config-ui/message', {
-        modelName: 'config-ui/message',
+      this.messages.push({
         id: `${i}-a`,
         active: true,
         type: 'banner',
@@ -105,40 +111,22 @@ module('Integration | Component | messages/page/list', function (hooks) {
         title: `Message title ${i}`,
         message: 'Some long long long message',
         link: { title: 'here', href: 'www.example.com' },
-        start_time: '2021-08-01T00:00:00Z',
+        start_time: new Date('2021-08-01T00:00:00Z'),
       });
     }
+    this.messages.meta.total = this.messages.length;
+    this.messages.meta.pageSize = 100;
 
-    this.messages = this.store.peekAll('config-ui/message', {});
-    this.messages.meta = {
-      currentPage: 1,
-      lastPage: 1,
-      nextPage: 1,
-      prevPage: 1,
-      total: this.messages.length,
-      pageSize: 100,
-    };
-    await render(hbs`<Messages::Page::List @messages={{this.messages}} />`, {
-      owner: this.engine,
-    });
-    await click(PAGE.button('create message'));
-    assert.dom(PAGE.modalTitle('maximum-message-modal')).hasText('Maximum number of messages reached');
+    await this.renderComponent();
+    await click(GENERAL.button('Create message'));
+    assert
+      .dom(CUSTOM_MESSAGES.modalTitle('maximum-message-modal'))
+      .hasText('Maximum number of messages reached');
     assert
-      .dom(PAGE.modalBody('maximum-message-modal'))
+      .dom(CUSTOM_MESSAGES.modalBody('maximum-message-modal'))
       .hasText(
         'Vault can only store up to 100 messages. To create a message, delete one of your messages to clear up space.'
       );
-    await click(PAGE.modalButton('maximum-message-modal'));
-  });
-
-  test('it should show the correct badge colors based on badge status', async function (assert) {
-    this.messages = this.store.peekAll('config-ui/message', {});
-    this.messages.meta = META;
-    await render(hbs`<Messages::Page::List @messages={{this.messages}} />`, {
-      owner: this.engine,
-    });
-    assert.dom(PAGE.badge('0')).hasClass('hds-badge--color-success');
-    assert.dom(PAGE.badge('1')).hasClass('hds-badge--color-neutral');
-    assert.dom(PAGE.badge('2')).hasClass('hds-badge--color-highlight');
+    await click(GENERAL.button('close-maximum-message'));
   });
 });
diff --git a/ui/tests/integration/components/confirm-action-test.js b/ui/tests/integration/components/confirm-action-test.js
index 2bf6bbc492b..a5897d8dce8 100644
--- a/ui/tests/integration/components/confirm-action-test.js
+++ b/ui/tests/integration/components/confirm-action-test.js
@@ -1,21 +1,19 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, click, find } from '@ember/test-helpers';
+import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const SELECTORS = {
-  modalToggle: '[data-test-confirm-action-trigger]',
   title: '[data-test-confirm-action-title]',
   message: '[data-test-confirm-action-message]',
-  confirm: '[data-test-confirm-button]',
-  cancel: '[data-test-confirm-cancel-button]',
 };
 module('Integration | Component | confirm-action', function (hooks) {
   setupRenderingTest(hooks);
@@ -32,23 +30,22 @@ module('Integration | Component | confirm-action', function (hooks) {
       />
       `);
 
-    assert.dom(SELECTORS.modalToggle).hasText('DELETE', 'renders button text');
-    await click(SELECTORS.modalToggle);
-    // hasClass assertion wasn't working so this is the workaround
-    assert.strictEqual(
-      find('#confirm-action-modal').className,
-      'hds-modal hds-modal--size-small hds-modal--color-critical has-text-left',
-      'renders critical modal color by default'
-    );
-    assert.dom(SELECTORS.confirm).hasClass('hds-button--color-critical', 'renders critical confirm button');
+    assert.dom(GENERAL.confirmTrigger).hasText('DELETE', 'renders button text');
+    await click(GENERAL.confirmTrigger);
+    assert
+      .dom('#confirm-action-modal')
+      .hasClass('hds-modal--color-critical', 'renders critical modal color by default');
+    assert
+      .dom(GENERAL.confirmButton)
+      .hasClass('hds-button--color-critical', 'renders critical confirm button');
     assert.dom(SELECTORS.title).hasText('Are you sure?', 'renders default title');
     assert
       .dom(SELECTORS.message)
       .hasText('You will not be able to recover it later.', 'renders default body text');
-    await click(SELECTORS.cancel);
+    await click(GENERAL.cancelButton);
     assert.false(this.onConfirm.called, 'does not call the action when Cancel is clicked');
-    await click(SELECTORS.modalToggle);
-    await click(SELECTORS.confirm);
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
     assert.true(this.onConfirm.called, 'calls the action when Confirm is clicked');
     assert.dom(SELECTORS.title).doesNotExist('modal closes after confirm is clicked');
   });
@@ -68,17 +65,17 @@ module('Integration | Component | confirm-action', function (hooks) {
       />
       `);
 
-    assert.dom(`li ${SELECTORS.modalToggle}`).exists('element renders inside <li>');
-    assert.dom(SELECTORS.modalToggle).hasClass('hds-confirm-action-critical', 'button has dropdown styling');
-    await click(SELECTORS.modalToggle);
+    assert.dom(`li ${GENERAL.confirmTrigger}`).exists('element renders inside <li>');
+    assert.dom(GENERAL.confirmTrigger).hasClass('hds-confirm-action-critical', 'button has dropdown styling');
+    await click(GENERAL.confirmTrigger);
     assert.dom(SELECTORS.title).hasText('Are you sure?', 'renders default title');
     assert
       .dom(SELECTORS.message)
       .hasText('You will not be able to recover it later.', 'renders default body text');
-    await click('[data-test-confirm-cancel-button]');
+    await click(GENERAL.cancelButton);
     assert.false(this.onConfirm.called, 'does not call the action when Cancel is clicked');
-    await click(SELECTORS.modalToggle);
-    await click(SELECTORS.confirm);
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
     assert.true(this.onConfirm.called, 'calls the action when Confirm is clicked');
     assert.dom(SELECTORS.title).doesNotExist('modal closes after confirm is clicked');
   });
@@ -92,36 +89,33 @@ module('Integration | Component | confirm-action', function (hooks) {
       />
       `);
 
-    await click(SELECTORS.modalToggle);
+    await click(GENERAL.confirmTrigger);
 
-    assert.dom(SELECTORS.confirm).isDisabled('disables confirm button when loading');
+    assert.dom(GENERAL.confirmButton).isDisabled('disables confirm button when loading');
     assert.dom('[data-test-confirm-button] [data-test-icon="loading"]').exists('it renders loading icon');
   });
 
   test('it renders disabledMessage modal', async function (assert) {
-    this.condition = true;
     await render(hbs`
       <ConfirmAction
         @buttonText="Open!"
         @onConfirmAction={{this.onConfirm}}
         @confirmTitle="Do this?"
         @confirmMessage="Are you really, really sure?"
-        @disabledMessage={{if this.condition "This is the reason you cannot do the thing"}}
+        @disabledMessage="This is the reason you cannot do the thing"
       />
       `);
 
-    await click(SELECTORS.modalToggle);
-    assert.strictEqual(
-      find('#confirm-action-modal').className,
-      'hds-modal hds-modal--size-small hds-modal--color-neutral has-text-left',
-      'renders critical modal color by default'
-    );
+    await click(GENERAL.confirmTrigger);
+    assert
+      .dom('#confirm-action-modal')
+      .hasClass('hds-modal--color-neutral', 'renders neutral modal because disabledMessage is present');
     assert.dom(SELECTORS.title).hasText('Not allowed', 'renders disabled title');
     assert
       .dom(SELECTORS.message)
       .hasText('This is the reason you cannot do the thing', 'renders disabled message as body text');
-    assert.dom(SELECTORS.confirm).doesNotExist('does not render confirm action button');
-    assert.dom(SELECTORS.cancel).hasText('Close');
+    assert.dom(GENERAL.confirmButton).doesNotExist('does not render confirm action button');
+    assert.dom(GENERAL.cancelButton).hasText('Close');
   });
 
   test('it renders passed args', async function (assert) {
@@ -138,12 +132,14 @@ module('Integration | Component | confirm-action', function (hooks) {
       />
       `);
 
-    assert.dom(SELECTORS.modalToggle).hasClass('hds-button--color-secondary', 'renders @buttonColor classes');
-    await click(SELECTORS.modalToggle);
+    assert
+      .dom(GENERAL.confirmTrigger)
+      .hasClass('hds-button--color-secondary', 'renders @buttonColor classes');
+    await click(GENERAL.confirmTrigger);
     assert.dom('#confirm-action-modal').hasClass('hds-modal--color-warning', 'renders warning modal');
-    assert.dom(SELECTORS.confirm).hasClass('hds-button--color-primary', 'renders primary confirm button');
+    assert.dom(GENERAL.confirmButton).hasClass('hds-button--color-primary', 'renders primary confirm button');
     assert.dom(SELECTORS.title).hasText('Do this?', 'renders passed title');
     assert.dom(SELECTORS.message).hasText('Are you really, really sure?', 'renders passed body text');
-    assert.dom(SELECTORS.confirm).hasText('Confirm');
+    assert.dom(GENERAL.confirmButton).hasText('Confirm');
   });
 });
diff --git a/ui/tests/integration/components/confirm-modal-test.js b/ui/tests/integration/components/confirm-modal-test.js
index 464db30283c..bdfbb32ab63 100644
--- a/ui/tests/integration/components/confirm-modal-test.js
+++ b/ui/tests/integration/components/confirm-modal-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,30 +8,54 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | confirm-modal', function (hooks) {
   setupRenderingTest(hooks);
 
   hooks.beforeEach(function () {
-    this.onConfirm = sinon.spy();
-    this.onClose = sinon.spy();
+    this.onConfirm = sinon.stub();
+    this.onClose = sinon.stub();
   });
 
   test('it renders a reasonable default', async function (assert) {
     await render(hbs`<ConfirmModal @onConfirm={{this.onConfirm}} @onClose={{this.onClose}} />`);
+
     assert
       .dom('[data-test-confirm-modal]')
       .hasClass('hds-modal--color-warning', 'renders warning modal color');
-    assert
-      .dom('[data-test-confirm-button]')
-      .hasClass('hds-button--color-primary', 'renders primary confirm button');
+    assert.dom(GENERAL.confirmButton).hasClass('hds-button--color-primary', 'renders primary confirm button');
     assert.dom('[data-test-confirm-action-title]').hasText('Are you sure?', 'renders default title');
     assert
       .dom('[data-test-confirm-action-message]')
       .hasText('You will not be able to recover it later.', 'renders default body text');
-    await click('[data-test-confirm-cancel-button]');
-    assert.ok(this.onClose.called, 'calls the onClose action when Cancel is clicked');
-    await click('[data-test-confirm-button]');
-    assert.ok(this.onConfirm.called, 'calls the onConfirm action when Confirm is clicked');
+  });
+
+  test('it renders a custom title and message', async function (assert) {
+    await render(
+      hbs`<ConfirmModal @onConfirm={{this.onConfirm}} @onClose={{this.onClose}} @confirmTitle="Fancy Title" @confirmMessage="Riveting message" />`
+    );
+
+    assert.dom('[data-test-confirm-action-title]').hasText('Fancy Title', 'renders custom title');
+    assert.dom('[data-test-confirm-action-message]').hasText('Riveting message', 'renders custom body text');
+  });
+
+  test('it renders a disabled message', async function (assert) {
+    await render(
+      hbs`<ConfirmModal @onConfirm={{this.onConfirm}} @onClose={{this.onClose}} @disabledMessage="Nope" />`
+    );
+
+    assert.dom('[data-test-confirm-action-title]').hasText('Not allowed', 'renders disabled title');
+
+    assert.dom('[data-test-confirm-action-message]').hasText('Nope', 'renders disabled message');
+
+    assert.dom(GENERAL.confirmButton).doesNotExist('confirm button is not rendered when action is disabled');
+  });
+
+  test('it calls onConfirm when the modal is confirmed', async function (assert) {
+    await render(hbs`<ConfirmModal @onConfirm={{this.onConfirm}} @onClose={{this.onClose}} />`);
+
+    await click(GENERAL.confirmButton);
+    assert.true(this.onConfirm.called);
   });
 });
diff --git a/ui/tests/integration/components/confirmation-modal-test.js b/ui/tests/integration/components/confirmation-modal-test.js
index 3c08cee34c2..7bd94ba04ac 100644
--- a/ui/tests/integration/components/confirmation-modal-test.js
+++ b/ui/tests/integration/components/confirmation-modal-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,7 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import sinon from 'sinon';
 import { click, fillIn, render } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import hbs from 'htmlbars-inline-precompile';
 
 module('Integration | Component | confirmation-modal', function (hooks) {
@@ -28,18 +29,18 @@ module('Integration | Component | confirmation-modal', function (hooks) {
       />
     `);
 
-    assert.dom('[data-test-confirm-button]').isDisabled();
+    assert.dom(GENERAL.confirmButton).isDisabled();
     assert.dom('#confirmation-modal').exists('modal is active');
-    assert.dom('[data-test-confirm-button]').hasText('Plz Continue', 'Confirm button has specified value');
+    assert.dom(GENERAL.confirmButton).hasText('Plz Continue', 'Confirm button has specified value');
     assert
       .dom('[data-test-confirmation-modal-title] [data-test-icon="alert-triangle"]')
       .exists('title has with warning icon');
     await fillIn('[data-test-confirmation-modal-input="Confirmation Modal"]', 'Destructive Thing');
     assert.dom('[data-test-confirm-button="Confirmation Modal"]').isNotDisabled();
 
-    await click('[data-test-cancel-button]');
+    await click(GENERAL.cancelButton);
     assert.true(closeAction.called, 'executes passed in onClose function');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
     assert.true(confirmAction.called, 'executes passed in onConfirm function');
   });
 });
diff --git a/ui/tests/integration/components/console/log-command-test.js b/ui/tests/integration/components/console/log-command-test.js
index c610a944606..a8bfeaa23a7 100644
--- a/ui/tests/integration/components/console/log-command-test.js
+++ b/ui/tests/integration/components/console/log-command-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/console/log-error-test.js b/ui/tests/integration/components/console/log-error-test.js
index 608761a8c25..070a702c4af 100644
--- a/ui/tests/integration/components/console/log-error-test.js
+++ b/ui/tests/integration/components/console/log-error-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/console/log-json-test.js b/ui/tests/integration/components/console/log-json-test.js
index d6d8944bca6..4f195ec897c 100644
--- a/ui/tests/integration/components/console/log-json-test.js
+++ b/ui/tests/integration/components/console/log-json-test.js
@@ -1,27 +1,17 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, find } from '@ember/test-helpers';
+import { render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { assertCodeBlockValue } from 'vault/tests/helpers/codemirror';
 
 module('Integration | Component | console/log json', function (hooks) {
   setupRenderingTest(hooks);
 
-  hooks.beforeEach(function () {
-    this.codeMirror = this.owner.lookup('service:code-mirror');
-    // TODO: Fix JSONEditor/CodeMirror
-    setRunOptions({
-      rules: {
-        label: { enabled: false },
-      },
-    });
-  });
-
   test('it renders', async function (assert) {
     // Set any properties with this.set('myProperty', 'value');
     // Handle any actions with this.on('myAction', function(val) { ... });
@@ -30,8 +20,7 @@ module('Integration | Component | console/log json', function (hooks) {
 
     this.set('content', objectContent);
 
-    await render(hbs`{{console/log-json content=this.content}}`);
-    const instance = find('[data-test-component=code-mirror-modifier]').innerText;
-    assert.strictEqual(instance, expectedText);
+    await render(hbs`<Console::LogJson @content={{this.content}} />`);
+    assertCodeBlockValue(assert, '.hds-code-block__code', expectedText);
   });
 });
diff --git a/ui/tests/integration/components/console/log-list-test.js b/ui/tests/integration/components/console/log-list-test.js
index 7d5a444cc71..51d1c662622 100644
--- a/ui/tests/integration/components/console/log-list-test.js
+++ b/ui/tests/integration/components/console/log-list-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/console/log-object-test.js b/ui/tests/integration/components/console/log-object-test.js
index c90b5473aba..eedf528d6b4 100644
--- a/ui/tests/integration/components/console/log-object-test.js
+++ b/ui/tests/integration/components/console/log-object-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/console/log-text-test.js b/ui/tests/integration/components/console/log-text-test.js
index 5203db51391..0f926f4bafd 100644
--- a/ui/tests/integration/components/console/log-text-test.js
+++ b/ui/tests/integration/components/console/log-text-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/console/ui-panel-test.js b/ui/tests/integration/components/console/ui-panel-test.js
index 9275d43e9db..b312ea3a18c 100644
--- a/ui/tests/integration/components/console/ui-panel-test.js
+++ b/ui/tests/integration/components/console/ui-panel-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,20 +23,21 @@ module('Integration | Component | console/ui panel', function (hooks) {
 
   test('it clears console input on enter', async function (assert) {
     await render(hbs`{{console/ui-panel}}`);
-
-    await component.runCommands('list this/thing/here');
+    await component.runCommands('list this/thing/here', false);
     await settled();
     assert.strictEqual(component.consoleInputValue, '', 'empties input field on enter');
   });
 
   test('it clears the log when using clear command', async function (assert) {
     await render(hbs`{{console/ui-panel}}`);
-
-    await component.runCommands(['list this/thing/here', 'list this/other/thing', 'read another/thing']);
+    await component.runCommands(
+      ['list this/thing/here', 'list this/other/thing', 'read another/thing'],
+      false
+    );
     await settled();
     assert.notEqual(component.logOutput, '', 'there is output in the log');
 
-    await component.runCommands('clear');
+    await component.runCommands('clear', false);
     await settled();
     await component.up();
     await settled();
@@ -51,7 +52,7 @@ module('Integration | Component | console/ui panel', function (hooks) {
   test('it adds command to history on enter', async function (assert) {
     await render(hbs`{{console/ui-panel}}`);
 
-    await component.runCommands('list this/thing/here');
+    await component.runCommands('list this/thing/here', false);
     await settled();
     await component.up();
     await settled();
@@ -67,8 +68,7 @@ module('Integration | Component | console/ui panel', function (hooks) {
 
   test('it cycles through history with more than one command', async function (assert) {
     await render(hbs`{{console/ui-panel}}`);
-
-    await component.runCommands(['list this/thing/here', 'read that/thing/there', 'qwerty']);
+    await component.runCommands(['list this/thing/here', 'read that/thing/there', 'qwerty'], false);
     await settled();
     await component.up();
     await settled();
diff --git a/ui/tests/integration/components/control-group-success-test.js b/ui/tests/integration/components/control-group-success-test.js
index bda51e70bfa..874f159b398 100644
--- a/ui/tests/integration/components/control-group-success-test.js
+++ b/ui/tests/integration/components/control-group-success-test.js
@@ -1,95 +1,73 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { later, run, _cancelTimers as cancelTimers } from '@ember/runloop';
-import { resolve } from 'rsvp';
-import Service from '@ember/service';
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, settled } from '@ember/test-helpers';
+import { click, fillIn, find, render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
-import { create } from 'ember-cli-page-object';
-import controlGroupSuccess from '../../pages/components/control-group-success';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
-
-const component = create(controlGroupSuccess);
-
-const controlGroupService = Service.extend({
-  deleteControlGroupToken: sinon.stub(),
-  markTokenForUnwrap: sinon.stub(),
-});
-
-const storeService = Service.extend({
-  adapterFor() {
-    return {
-      toolAction() {
-        return resolve({ data: { foo: 'bar' } });
-      },
-    };
-  },
-});
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CONTROL_GROUP } from 'vault/tests/helpers/components/control-group-selectors';
 
 module('Integration | Component | control group success', function (hooks) {
   setupRenderingTest(hooks);
 
   hooks.beforeEach(function () {
-    run(() => {
-      this.owner.unregister('service:store');
-      this.owner.register('service:control-group', controlGroupService);
-      this.controlGroup = this.owner.lookup('service:control-group');
-      this.owner.register('service:store', storeService);
-      this.router = this.owner.lookup('service:router');
-      this.router.reopen({
-        transitionTo: sinon.stub().returns(resolve()),
-      });
-      setRunOptions({
-        rules: {
-          // TODO: swap out JsonEditor with Hds::CodeBlock for display
-          'color-contrast': { enabled: false },
-          label: { enabled: false },
-        },
-      });
-    });
+    this.transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
+    this.controlGroup = this.owner.lookup('service:control-group');
+    this.markTokenForUnwrapStub = sinon.stub(this.controlGroup, 'markTokenForUnwrap');
+    this.model = {
+      approved: false,
+      requestPath: 'foo/bar',
+      id: 'accessor',
+      requestEntity: { id: 'requestor', name: 'entity8509' },
+      reload: sinon.stub(),
+    };
   });
 
-  const MODEL = {
-    approved: false,
-    requestPath: 'foo/bar',
-    id: 'accessor',
-    requestEntity: { id: 'requestor', name: 'entity8509' },
-    reload: sinon.stub(),
-  };
   test('render with saved token', async function (assert) {
     assert.expect(3);
     const response = {
       uiParams: { url: '/foo' },
       token: 'token',
     };
-    this.set('model', MODEL);
     this.set('response', response);
     await render(hbs`<ControlGroupSuccess @model={{this.model}} @controlGroupResponse={{this.response}} />`);
-    assert.ok(component.showsNavigateMessage, 'shows unwrap message');
-    await component.navigate();
-    later(() => cancelTimers(), 50);
-    return settled().then(() => {
-      assert.ok(this.controlGroup.markTokenForUnwrap.calledOnce, 'marks token for unwrap');
-      assert.ok(this.router.transitionTo.calledOnce, 'calls router transition');
-    });
+    assert
+      .dom(CONTROL_GROUP.navMessage)
+      .hasText(
+        'You have been granted access to foo/bar. Be careful, you can only access this data once. If you need access again in the future you will need to get authorized again. Visit'
+      );
+
+    await click(GENERAL.button('Visit'));
+    const [transition] = this.transitionStub.lastCall.args;
+    const [accessor] = this.markTokenForUnwrapStub.lastCall.args;
+    assert.strictEqual(accessor, 'accessor', 'marks token for unwrap');
+    assert.strictEqual(transition, '/foo', 'calls router transition');
   });
 
   test('render without token', async function (assert) {
     assert.expect(2);
-    this.set('model', MODEL);
     await render(hbs`<ControlGroupSuccess @model={{this.model}} />`);
-    assert.ok(component.showsUnwrapForm, 'shows unwrap form');
-    await component.token('token');
-    component.unwrap();
-    later(() => cancelTimers(), 50);
-    return settled().then(() => {
-      assert.ok(component.showsJsonViewer, 'shows unwrapped data');
-    });
+    assert.dom(CONTROL_GROUP.unwrapForm).exists();
+    assert.dom(GENERAL.inputByAttr('token')).hasValue('');
+  });
+
+  test('it unwraps data on submit', async function (assert) {
+    assert.expect(2);
+
+    sinon.stub(this.owner.lookup('service:api').sys, 'unwrap').resolves({ data: { foo: 'bar' } });
+
+    await render(hbs`<ControlGroupSuccess @model={{this.model}} />`);
+    assert.dom(GENERAL.inputByAttr('token')).hasValue('');
+
+    await fillIn(GENERAL.inputByAttr('token'), 'token');
+    await click(GENERAL.submitButton);
+
+    const actual = find(CONTROL_GROUP.jsonViewer).innerText;
+    const expected = JSON.stringify({ foo: 'bar' }, null, 2);
+    assert.strictEqual(actual, expected, `it renders unwrapped data: ${actual}`);
   });
 });
diff --git a/ui/tests/integration/components/control-group-test.js b/ui/tests/integration/components/control-group-test.js
index b5adc844124..0eb64d4b00c 100644
--- a/ui/tests/integration/components/control-group-test.js
+++ b/ui/tests/integration/components/control-group-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,10 +9,8 @@ import { setupRenderingTest } from 'ember-qunit';
 import { render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
-import { create } from 'ember-cli-page-object';
-import controlGroup from '../../pages/components/control-group';
-
-const component = create(controlGroup);
+import { CONTROL_GROUP } from 'vault/tests/helpers/components/control-group-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const controlGroupService = Service.extend({
   init() {
@@ -44,7 +42,7 @@ module('Integration | Component | control group', function (hooks) {
       requestEntity: { id: 'requestor', name: 'entity8509' },
       reload: sinon.stub(),
     };
-    const authDataDefaults = { entity_id: 'requestor' };
+    const authDataDefaults = { entityId: 'requestor' };
 
     return {
       model: {
@@ -62,14 +60,14 @@ module('Integration | Component | control group', function (hooks) {
     const { model, authData } = setup();
     this.set('model', model);
     this.set('auth.authData', authData);
-    await render(hbs`{{control-group model=this.model}}`);
-    assert.ok(component.showsAccessorCallout, 'shows accessor callout');
-    assert.strictEqual(component.bannerPrefix, 'Locked');
-    assert.strictEqual(component.bannerText, 'The path you requested is locked by a Control Group');
-    assert.strictEqual(component.requestorText, `You are requesting access to ${model.requestPath}`);
-    assert.false(component.showsTokenText, 'does not show token message when there is no token');
-    assert.ok(component.showsRefresh, 'shows refresh button');
-    assert.ok(component.authorizationText, 'Awaiting authorization.');
+    await render(hbs`<ControlGroup @model={{this.model}} />`);
+    assert.dom(GENERAL.inlineAlert).exists('shows accessor callout');
+    assert.dom(CONTROL_GROUP.bannerPrefix).hasText('Locked');
+    assert.dom(CONTROL_GROUP.bannerText).hasText('The path you requested is locked by a Control Group');
+    assert.dom(CONTROL_GROUP.requestorText).hasText(`You are requesting access to ${model.requestPath}`);
+    assert.dom(CONTROL_GROUP.tokenValue).doesNotExist('does not show token message when there is no token');
+    assert.dom(GENERAL.button('Refresh')).exists('shows refresh button');
+    assert.dom(CONTROL_GROUP.authorizations).hasText('Awaiting authorization.');
   });
 
   test('requestor rendering: with token', async function (assert) {
@@ -77,30 +75,30 @@ module('Integration | Component | control group', function (hooks) {
     this.set('model', model);
     this.set('auth.authData', authData);
     this.set('controlGroup.wrapInfo', { token: 'token' });
-    await render(hbs`{{control-group model=this.model}}`);
-    assert.true(component.showsTokenText, 'shows token message');
-    assert.strictEqual(component.token, 'token', 'shows token value');
+    await render(hbs`<ControlGroup @model={{this.model}} />`);
+    assert.dom(CONTROL_GROUP.tokenValue).exists('shows token message');
+    assert.dom(CONTROL_GROUP.tokenValue).hasText('token', 'shows token value');
   });
 
   test('requestor rendering: some approvals', async function (assert) {
     const { model, authData } = setup({ authorizations: [{ name: 'manager 1' }, { name: 'manager 2' }] });
     this.set('model', model);
     this.set('auth.authData', authData);
-    await render(hbs`{{control-group model=this.model}}`);
-    assert.ok(component.authorizationText, 'Already approved by manager 1, manager 2');
+    await render(hbs`<ControlGroup @model={{this.model}} />`);
+    assert.dom(CONTROL_GROUP.authorizations).hasText('Already approved by manager 1, manager 2');
   });
 
   test('requestor rendering: approved with no token', async function (assert) {
     const { model, authData } = setup({ approved: true });
     this.set('model', model);
     this.set('auth.authData', authData);
-    await render(hbs`{{control-group model=this.model}}`);
+    await render(hbs`<ControlGroup @model={{this.model}} />`);
 
-    assert.strictEqual(component.bannerPrefix, 'Success!');
-    assert.strictEqual(component.bannerText, 'You have been given authorization');
-    assert.false(component.showsTokenText, 'does not show token message when there is no token');
-    assert.notOk(component.showsRefresh, 'does not shows refresh button');
-    assert.ok(component.showsSuccessComponent, 'renders control group success');
+    assert.dom(CONTROL_GROUP.bannerPrefix).hasText('Success!');
+    assert.dom(CONTROL_GROUP.bannerText).hasText('You have been given authorization');
+    assert.dom(CONTROL_GROUP.tokenValue).doesNotExist('does not show token message when there is no token');
+    assert.dom(GENERAL.button('Refresh')).doesNotExist('does not shows refresh button');
+    assert.dom(CONTROL_GROUP.successComponent).exists('renders control group success');
   });
 
   test('requestor rendering: approved with token', async function (assert) {
@@ -108,80 +106,77 @@ module('Integration | Component | control group', function (hooks) {
     this.set('model', model);
     this.set('auth.authData', authData);
     this.set('controlGroup.wrapInfo', { token: 'token' });
-    await render(hbs`{{control-group model=this.model}}`);
-    assert.true(component.showsTokenText, 'shows token');
-    assert.notOk(component.showsRefresh, 'does not shows refresh button');
-    assert.ok(component.showsSuccessComponent, 'renders control group success');
+    await render(hbs`<ControlGroup @model={{this.model}} />`);
+    assert.dom(CONTROL_GROUP.tokenValue).exists('shows token');
+    assert.dom(GENERAL.button('Refresh')).doesNotExist('does not shows refresh button');
+    assert.dom(CONTROL_GROUP.successComponent).exists('renders control group success');
   });
 
   test('authorizer rendering', async function (assert) {
-    const { model, authData } = setup({ canAuthorize: true }, { entity_id: 'manager' });
+    const { model, authData } = setup({ canAuthorize: true }, { entityId: 'manager' });
 
     this.set('model', model);
     this.set('auth.authData', authData);
-    await render(hbs`{{control-group model=this.model}}`);
-
-    assert.strictEqual(component.bannerPrefix, 'Locked');
-    assert.strictEqual(
-      component.bannerText,
-      'Someone is requesting access to a path locked by a Control Group'
-    );
-    assert.strictEqual(
-      component.requestorText,
-      `${model.requestEntity.name} is requesting access to ${model.requestPath}`
-    );
-    assert.false(component.showsTokenText, 'does not show token message when there is no token');
-
-    assert.ok(component.showsAuthorize, 'shows authorize button');
+    await render(hbs`<ControlGroup @model={{this.model}} />`);
+
+    assert.dom(CONTROL_GROUP.bannerPrefix).hasText('Locked');
+    assert
+      .dom(CONTROL_GROUP.bannerText)
+      .hasText('Someone is requesting access to a path locked by a Control Group');
+    assert
+      .dom(CONTROL_GROUP.requestorText)
+      .hasText(`${model.requestEntity.name} is requesting access to ${model.requestPath}`);
+    assert.dom(CONTROL_GROUP.tokenValue).doesNotExist('does not show token message when there is no token');
+
+    assert.dom(GENERAL.button('Authorize')).exists('shows authorize button');
   });
 
   test('authorizer rendering:authorized', async function (assert) {
     const { model, authData } = setup(
       { canAuthorize: true, authorizations: [{ id: 'manager', name: 'manager' }] },
-      { entity_id: 'manager' }
+      { entityId: 'manager' }
     );
 
     this.set('model', model);
     this.set('auth.authData', authData);
-    await render(hbs`{{control-group model=this.model}}`);
+    await render(hbs`<ControlGroup @model={{this.model}} />`);
 
-    assert.strictEqual(component.bannerPrefix, 'Thanks!');
-    assert.strictEqual(component.bannerText, 'You have given authorization');
-    assert.ok(component.showsBackLink, 'back link is visible');
+    assert.dom(CONTROL_GROUP.bannerPrefix).hasText('Thanks!');
+    assert.dom(CONTROL_GROUP.bannerText).hasText('You have given authorization');
+    assert.dom(GENERAL.backButton).exists('back link is visible');
   });
 
   test('authorizer rendering: authorized and success', async function (assert) {
     const { model, authData } = setup(
       { approved: true, canAuthorize: true, authorizations: [{ id: 'manager', name: 'manager' }] },
-      { entity_id: 'manager' }
+      { entityId: 'manager' }
     );
 
     this.set('model', model);
     this.set('auth.authData', authData);
-    await render(hbs`{{control-group model=this.model}}`);
-
-    assert.strictEqual(component.bannerPrefix, 'Thanks!');
-    assert.strictEqual(component.bannerText, 'You have given authorization');
-    assert.ok(component.showsBackLink, 'back link is visible');
-    assert.strictEqual(
-      component.requestorText,
-      `${model.requestEntity.name} is authorized to access ${model.requestPath}`
-    );
-    assert.notOk(component.showsSuccessComponent, 'does not render control group success');
+    await render(hbs`<ControlGroup @model={{this.model}} />`);
+
+    assert.dom(CONTROL_GROUP.bannerPrefix).hasText('Thanks!');
+    assert.dom(CONTROL_GROUP.bannerText).hasText('You have given authorization');
+    assert.dom(GENERAL.backButton).exists('back link is visible');
+    assert
+      .dom(CONTROL_GROUP.requestorText)
+      .hasText(`${model.requestEntity.name} is authorized to access ${model.requestPath}`);
+    assert.dom(CONTROL_GROUP.successComponent).doesNotExist('does not render control group success');
   });
 
   test('third-party: success', async function (assert) {
     const { model, authData } = setup(
       { approved: true, canAuthorize: true, authorizations: [{ id: 'foo', name: 'foo' }] },
-      { entity_id: 'manager' }
+      { entityId: 'manager' }
     );
 
     this.set('model', model);
     this.set('auth.authData', authData);
-    await render(hbs`{{control-group model=this.model}}`);
-    assert.strictEqual(component.bannerPrefix, 'Success!');
-    assert.strictEqual(component.bannerText, 'This Control Group has been authorized');
-    assert.ok(component.showsBackLink, 'back link is visible');
-    assert.notOk(component.showsSuccessComponent, 'does not render control group success');
+    await render(hbs`<ControlGroup @model={{this.model}} />`);
+    assert.dom(CONTROL_GROUP.bannerPrefix).hasText('Success!');
+    assert.dom(CONTROL_GROUP.bannerText).hasText('This Control Group has been authorized');
+    assert.dom(GENERAL.backButton).exists('back link is visible');
+    assert.dom(CONTROL_GROUP.successComponent).doesNotExist('does not render control group success');
   });
 });
diff --git a/ui/tests/integration/components/copy-secret-dropdown-test.js b/ui/tests/integration/components/copy-secret-dropdown-test.js
index 3729c07e7d1..0fdd1617467 100644
--- a/ui/tests/integration/components/copy-secret-dropdown-test.js
+++ b/ui/tests/integration/components/copy-secret-dropdown-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,25 +7,29 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
 
 const SELECTORS = {
   dropdown: '[data-test-copy-menu-trigger]',
-  copyButton: '[data-test-copy-button]',
-  clipboard: 'data-test-copy-button',
-  wrapButton: '[data-test-wrap-button]',
   masked: '[data-test-masked-input]',
 };
 
 module('Integration | Component | copy-secret-dropdown', function (hooks) {
   setupRenderingTest(hooks);
   hooks.beforeEach(function () {
-    this.onWrap = () => {};
+    this.onWrap = sinon.stub().returns('wrapped-data');
     this.onClose = () => {};
+    this.data = `{ foo: 'bar' }`;
+    this.wrappedData = 'wrapped-data';
+    this.clipboardSpy = sinon.stub(navigator.clipboard, 'writeText').resolves();
+  });
+
+  hooks.afterEach(function () {
+    sinon.restore(); // resets all stubs, including clipboard
   });
 
   test('it renders and fires callback functions', async function (assert) {
-    assert.expect(5);
-    this.data = `{ foo: 'bar' }`;
     this.onWrap = () => assert.ok(true, 'onWrap callback fires Wrap secret is clicked');
     this.onClose = () => assert.ok(true, 'onClose callback fires when dropdown closes');
 
@@ -40,54 +44,63 @@ module('Integration | Component | copy-secret-dropdown', function (hooks) {
     );
 
     await click(SELECTORS.dropdown);
-    assert.dom(SELECTORS.copyButton).hasText('Copy JSON');
-    assert.dom(SELECTORS.wrapButton).hasText('Wrap secret');
-    assert
-      .dom(SELECTORS.copyButton)
-      .hasAttribute('data-test-copy-button', `${this.data}`, 'it renders copyable data');
+    assert.dom(GENERAL.copyButton).hasText('Copy JSON');
+    assert.dom(GENERAL.button('wrap')).hasText('Wrap secret');
 
-    await click(SELECTORS.wrapButton);
+    await click(GENERAL.button('wrap'));
     await click(SELECTORS.dropdown);
   });
 
-  test('it renders loading wrap button', async function (assert) {
-    assert.expect(2);
+  test('it copies JSON', async function (assert) {
+    this.onWrap = () => assert.ok(true, 'onWrap callback fires Wrap secret is clicked');
+    this.onClose = () => assert.ok(true, 'onClose callback fires when dropdown closes');
+
     await render(
       hbs`<ToolbarActions>
   <CopySecretDropdown
     @clipboardText={{this.data}}
     @onWrap={{this.onWrap}}
-    @isWrapping={{true}}
-    @wrappedData={{this.wrappedData}}
     @onClose={{this.onClose}}
   />
 </ToolbarActions>`
     );
 
     await click(SELECTORS.dropdown);
-    assert.dom(`${SELECTORS.wrapButton} [data-test-icon="loading"]`).exists('renders loading icon');
-    assert.dom(SELECTORS.wrapButton).isDisabled();
+    await click(GENERAL.copyButton);
+    assert.true(this.clipboardSpy.calledOnce, 'Clipboard was called once');
+    assert.strictEqual(this.clipboardSpy.firstCall.args[0], this.data, 'copy value is the json secret data');
   });
 
-  test('it wrapped data', async function (assert) {
-    assert.expect(1);
-    this.wrappedData = 'my-token';
+  test('it renders loading wrap button', async function (assert) {
+    await render(
+      hbs`<ToolbarActions>
+  <CopySecretDropdown
+    @clipboardText={{this.data}}
+    @onWrap={{this.onWrap}}
+    @isWrapping={{true}}
+    @onClose={{this.onClose}}
+  />
+</ToolbarActions>`
+    );
+    await click(SELECTORS.dropdown);
+    assert.dom(`[data-test-icon="loading"]`).exists('renders loading icon');
+  });
 
+  test('it wraps data', async function (assert) {
+    this.data = '';
     await render(
       hbs`<ToolbarActions>
   <CopySecretDropdown
     @clipboardText={{this.data}}
     @onWrap={{this.onWrap}}
     @isWrapping={{false}}
-    @wrappedData={{this.wrappedData}}
     @onClose={{this.onClose}}
   />
 </ToolbarActions>`
     );
 
     await click(SELECTORS.dropdown);
-    assert
-      .dom(`${SELECTORS.masked} ${SELECTORS.copyButton}`)
-      .hasAttribute('data-test-copy-button', this.wrappedData, 'it renders wrapped data');
+    await click(GENERAL.button('wrap'));
+    assert.true(this.onWrap.calledOnce, 'onWrap was called');
   });
 });
diff --git a/ui/tests/integration/components/dashboard/client-count-card-test.js b/ui/tests/integration/components/dashboard/client-count-card-test.js
index 8bed582d63c..68b1d61648d 100644
--- a/ui/tests/integration/components/dashboard/client-count-card-test.js
+++ b/ui/tests/integration/components/dashboard/client-count-card-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,135 +8,109 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { render, click } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { Response } from 'miragejs';
+import sinon from 'sinon';
+import { STATIC_NOW } from 'vault/mirage/handlers/clients';
 import timestamp from 'core/utils/timestamp';
-import { parseAPITimestamp } from 'core/utils/date-formatters';
+import { ACTIVITY_RESPONSE_STUB } from 'vault/tests/helpers/clients/client-count-helpers';
+import { formatNumber } from 'core/helpers/format-number';
+import { CLIENT_COUNT } from 'vault/tests/helpers/clients/client-count-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | dashboard/client-count-card', function (hooks) {
   setupRenderingTest(hooks);
   setupMirage(hooks);
 
-  hooks.beforeEach(function () {
-    this.license = {
-      startTime: '2018-04-03T14:15:30',
-    };
-  });
-
   test('it should display client count information', async function (assert) {
+    assert.expect(6);
+    sinon.replace(timestamp, 'now', sinon.fake.returns(STATIC_NOW)); // 1/25/24
+    const { months, total } = ACTIVITY_RESPONSE_STUB;
+    const [latestMonth] = months.slice(-1);
     this.server.get('sys/internal/counters/activity', () => {
-      return {
-        request_id: 'some-activity-id',
-        data: {
-          months: [
-            {
-              timestamp: '2023-08-01T00:00:00-07:00',
-              counts: {},
-              namespaces: [
-                {
-                  namespace_id: 'root',
-                  namespace_path: '',
-                  counts: {},
-                  mounts: [{ mount_path: 'auth/up2/', counts: {} }],
-                },
-              ],
-              new_clients: {
-                counts: {
-                  clients: 12,
-                },
-                namespaces: [
-                  {
-                    namespace_id: 'root',
-                    namespace_path: '',
-                    counts: {
-                      clients: 12,
-                    },
-                    mounts: [{ mount_path: 'auth/up2/', counts: {} }],
-                  },
-                ],
-              },
-            },
-          ],
-          total: {
-            clients: 300417,
-            entity_clients: 73150,
-            non_entity_clients: 227267,
-          },
-        },
-      };
+      // this assertion should be hit twice, once initially and then again clicking 'refresh'
+      assert.true(true, 'makes request to sys/internal/counters/activity');
+      return { data: ACTIVITY_RESPONSE_STUB };
     });
 
-    await render(hbs`<Dashboard::ClientCountCard @license={{this.license}} />`);
+    await render(hbs`<Dashboard::ClientCountCard />`);
     assert.dom('[data-test-client-count-title]').hasText('Client count');
-    assert.dom('[data-test-stat-text="total-clients"] .stat-label').hasText('Total');
     assert
-      .dom('[data-test-stat-text="total-clients"] .stat-text')
+      .dom(CLIENT_COUNT.statText('Total'))
       .hasText(
-        `The number of clients in this billing period (Apr 2018 - ${parseAPITimestamp(
-          timestamp.now().toISOString(),
-          'MMM yyyy'
-        )}).`
+        `Total The number of clients in this billing period (Jun 2023 - Sep 2023). ${formatNumber([
+          total.clients,
+        ])}`
       );
-    assert.dom('[data-test-stat-text="total-clients"] .stat-value').hasText('300,417');
-    assert.dom('[data-test-stat-text="new-clients"] .stat-label').hasText('New');
     assert
-      .dom('[data-test-stat-text="new-clients"] .stat-text')
-      .hasText('The number of clients new to Vault in the current month.');
-    assert.dom('[data-test-stat-text="new-clients"] .stat-value').hasText('12');
+      .dom(CLIENT_COUNT.statText('New'))
+      .hasText(
+        `New The number of clients new to Vault in the current month. ${formatNumber([
+          latestMonth.new_clients.counts.clients,
+        ])}`
+      );
+    assert.dom('[data-test-updated-timestamp]').hasTextContaining('Updated Jan 25 2024');
+
+    // fires second request to /activity
+    await click('[data-test-refresh]');
+  });
+
+  test('it shows no data subtext if no start or end timestamp', async function (assert) {
+    assert.expect(2);
+    // as far as I know, responses will always have a start/end time
+    // stubbing this unrealistic response just to test component subtext logic
     this.server.get('sys/internal/counters/activity', () => {
       return {
-        request_id: 'some-activity-id',
-        data: {
-          months: [
-            {
-              timestamp: '2023-09-01T00:00:00-07:00',
-              counts: {},
-              namespaces: [
-                {
-                  namespace_id: 'root',
-                  namespace_path: '',
-                  counts: {},
-                  mounts: [{ mount_path: 'auth/up2/', counts: {} }],
-                },
-              ],
-              new_clients: {
-                counts: {
-                  clients: 5,
-                },
-                namespaces: [
-                  {
-                    namespace_id: 'root',
-                    namespace_path: '',
-                    counts: {
-                      clients: 12,
-                    },
-                    mounts: [{ mount_path: 'auth/up2/', counts: {} }],
-                  },
-                ],
-              },
-            },
-          ],
-          total: {
-            clients: 120,
-            entity_clients: 100,
-            non_entity_clients: 100,
-          },
-        },
+        data: { by_namespace: [], months: [], total: {} },
       };
     });
-    await click('[data-test-refresh]');
-    assert.dom('[data-test-stat-text="total-clients"] .stat-label').hasText('Total');
+
+    await render(hbs`<Dashboard::ClientCountCard />`);
+    assert.dom(CLIENT_COUNT.statText('Total')).hasText('Total No total client data available. -');
+    assert.dom(CLIENT_COUNT.statText('New')).hasText('New No new client data available. -');
+  });
+
+  test('it shows empty state if no activity data and reporting is enabled', async function (assert) {
+    // the activity response has changed and now should ALWAYS return something
+    // but adding this test until we update the adapter to reflect that
+    assert.expect(4);
+    this.server.get('sys/internal/counters/activity', () => {
+      assert.true(true, 'makes request to sys/internal/counters/activity');
+      return { data: {} };
+    });
+    this.server.get('sys/internal/counters/config', () => {
+      assert.true(true, 'makes request to sys/internal/counters/config');
+      return {
+        request_id: '25a94b99-b49a-c4ac-cb7b-5ba0eb390a25',
+        data: { reporting_enabled: true },
+      };
+    });
+    await render(hbs`<Dashboard::ClientCountCard />`);
+    assert.dom(GENERAL.emptyStateTitle).hasText('No data received');
     assert
-      .dom('[data-test-stat-text="total-clients"] .stat-text')
-      .hasText(
-        `The number of clients in this billing period (Apr 2018 - ${parseAPITimestamp(
-          timestamp.now().toISOString(),
-          'MMM yyyy'
-        )}).`
+      .dom(GENERAL.emptyStateMessage)
+      .hasText('Tracking is turned on and Vault is gathering data. It should appear here within 30 minutes.');
+  });
+
+  test('it shows empty state if no activity data and config data is unavailable', async function (assert) {
+    assert.expect(4);
+    this.server.get('sys/internal/counters/activity', () => {
+      assert.true(true, 'makes request to sys/internal/counters/activity');
+      return { data: {} };
+    });
+    this.server.get('sys/internal/counters/config', () => {
+      assert.true(true, 'makes request to sys/internal/counters/config');
+      return new Response(
+        403,
+        { 'Content-Type': 'application/json' },
+        JSON.stringify({ errors: ['permission denied'] })
       );
-    assert.dom('[data-test-stat-text="total-clients"] .stat-value').hasText('120');
-    assert.dom('[data-test-stat-text="new-clients"] .stat-label').hasText('New');
+    });
+    await render(hbs`<Dashboard::ClientCountCard />`);
+    assert.dom(GENERAL.emptyStateTitle).hasText('Activity configuration data is unavailable');
     assert
-      .dom('[data-test-stat-text="new-clients"] .stat-text')
-      .hasText('The number of clients new to Vault in the current month.');
-    assert.dom('[data-test-stat-text="new-clients"] .stat-value').hasText('5');
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'Reporting status is unknown and could be enabled or disabled. Check the Vault logs for more information.'
+      );
   });
 });
diff --git a/ui/tests/integration/components/dashboard/overview-test.js b/ui/tests/integration/components/dashboard/overview-test.js
index b5a0ef429ed..e2287938e01 100644
--- a/ui/tests/integration/components/dashboard/overview-test.js
+++ b/ui/tests/integration/components/dashboard/overview-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,25 +8,23 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { SELECTORS } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
+import { DASHBOARD } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
 
 module('Integration | Component | dashboard/overview', function (hooks) {
   setupRenderingTest(hooks);
   setupMirage(hooks);
 
   hooks.beforeEach(function () {
+    this.flags = this.owner.lookup('service:flags');
+    this.namespace = this.owner.lookup('service:namespace');
+    this.permissions = this.owner.lookup('service:permissions');
     this.store = this.owner.lookup('service:store');
-
+    this.version = this.owner.lookup('service:version');
+    this.isRootNamespace = true;
     this.replication = {
-      dr: {
-        clusterId: '123',
-        state: 'running',
-      },
-      performance: {
-        clusterId: 'abc-1',
-        state: 'running',
-        isPrimary: true,
-      },
+      dr: { clusterId: '123', state: 'running' },
+      performance: { clusterId: 'abc-1', state: 'running', isPrimary: true },
     };
     this.store.pushPayload('secret-engine', {
       modelName: 'secret-engine',
@@ -60,201 +58,254 @@ module('Integration | Component | dashboard/overview', function (hooks) {
       ],
     };
     this.refreshModel = () => {};
-  });
-
-  test('it should show dashboard empty states', async function (assert) {
-    this.version = this.owner.lookup('service:version');
-    this.version.version = '1.13.1';
-    this.isRootNamespace = true;
-    await render(
-      hbs`
-        <Dashboard::Overview
-          @version={{this.version}}
-          @isRootNamespace={{this.isRootNamespace}}
-          @refreshModel={{this.refreshModel}} />
-      `
-    );
-    assert.dom(SELECTORS.cardHeader('Vault version')).exists();
-    assert.dom(SELECTORS.cardName('secrets-engines')).exists();
-    assert.dom(SELECTORS.emptyState('secrets-engines')).exists();
-    assert.dom(SELECTORS.cardName('learn-more')).exists();
-    assert.dom(SELECTORS.cardName('quick-actions')).exists();
-    assert.dom(SELECTORS.emptyState('quick-actions')).exists();
-    assert.dom(SELECTORS.cardName('configuration-details')).doesNotExist();
-    assert.dom(SELECTORS.cardName('replication')).doesNotExist();
-    assert.dom(SELECTORS.cardName('client-count')).doesNotExist();
-  });
-
-  test('it should hide client count and replication card on community', async function (assert) {
-    this.version = this.owner.lookup('service:version');
-    this.version.version = '1.13.1';
-    this.isRootNamespace = true;
-
-    await render(
-      hbs`
+    this.renderComponent = async () => {
+      return render(
+        hbs`
         <Dashboard::Overview
           @secretsEngines={{this.secretsEngines}}
           @vaultConfiguration={{this.vaultConfiguration}}
           @replication={{this.replication}}
           @version={{this.version}}
           @isRootNamespace={{this.isRootNamespace}}
-          @refreshModel={{this.refreshModel}} />
+          @refreshModel={{this.refreshModel}} 
+          @replicationUpdatedAt={{this.replicationUpdatedAt}}
+          />
       `
-    );
-
-    assert.dom(SELECTORS.cardHeader('Vault version')).exists();
-    assert.dom(SELECTORS.cardName('secrets-engines')).exists();
-    assert.dom(SELECTORS.cardName('learn-more')).exists();
-    assert.dom(SELECTORS.cardName('quick-actions')).exists();
-    assert.dom(SELECTORS.cardName('configuration-details')).exists();
-    assert.dom(SELECTORS.cardName('replication')).doesNotExist();
-    assert.dom(SELECTORS.cardName('client-count')).doesNotExist();
+      );
+    };
   });
 
-  test('it should show client count on enterprise w/ license', async function (assert) {
-    this.version = this.owner.lookup('service:version');
-    this.version.version = '1.13.1+ent';
-    this.version.type = 'enterprise';
-    this.license = {
-      autoloaded: {
-        license_id: '7adbf1f4-56ef-35cd-3a6c-50ef2627865d',
-      },
-    };
+  test('it should show dashboard empty states in root namespace', async function (assert) {
+    this.version.version = '1.13.1';
+    this.secretsEngines = null;
+    this.replication = null;
+    this.vaultConfiguration = null;
+    await this.renderComponent();
+    assert.dom(DASHBOARD.cardHeader('Vault version')).exists();
+    assert.dom(DASHBOARD.cardName('secrets-engines')).exists();
+    assert.dom(DASHBOARD.emptyState('secrets-engines')).exists();
+    assert.dom(DASHBOARD.cardName('learn-more')).exists();
+    assert.dom(DASHBOARD.cardName('quick-actions')).exists();
+    assert.dom(DASHBOARD.emptyState('quick-actions')).exists();
+    assert.dom(DASHBOARD.cardName('configuration-details')).doesNotExist();
+    assert.dom(DASHBOARD.cardName('replication')).doesNotExist();
+    assert.dom(DASHBOARD.cardName('client-count')).doesNotExist();
+  });
 
-    await render(
-      hbs`
-      <Dashboard::Overview
-      @secretsEngines={{this.secretsEngines}}
-      @vaultConfiguration={{this.vaultConfiguration}}
-      @replication={{this.replication}}
-      @version={{this.version}}
-      @isRootNamespace={{true}}
-      @license={{this.license}}
-      @refreshModel={{this.refreshModel}} />`
-    );
-    assert.dom(SELECTORS.cardHeader('Vault version')).exists();
-    assert.dom(SELECTORS.cardName('secrets-engines')).exists();
-    assert.dom(SELECTORS.cardName('learn-more')).exists();
-    assert.dom(SELECTORS.cardName('quick-actions')).exists();
-    assert.dom(SELECTORS.cardName('configuration-details')).exists();
-    assert.dom(SELECTORS.cardName('client-count')).exists();
+  test('it renders the secrets engine card', async function (assert) {
+    assert.expect(3);
+    await this.renderComponent();
+    assert.dom(DASHBOARD.cardHeader('Secrets engines')).hasText('Secrets engines');
+    assert.dom(SES.secretPath('kv-1/')).exists();
+    assert.dom(SES.secretPath('kv-test/')).exists();
   });
 
-  test('it should hide client count on enterprise w/o license ', async function (assert) {
-    this.version = this.owner.lookup('service:version');
-    this.version.version = '1.13.1+ent';
-    this.version.type = 'enterprise';
-    this.isRootNamespace = true;
+  module('client count and replication card', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.version = '1.13.1+ent';
+      this.version.type = 'enterprise';
+    });
 
-    await render(
-      hbs`
-      <Dashboard::Overview
-        @secretsEngines={{this.secretsEngines}}
-        @vaultConfiguration={{this.vaultConfiguration}}
-        @replication={{this.replication}}
-        @version={{this.version}}
-        @isRootNamespace={{this.isRootNamespace}}
-        @refreshModel={{this.refreshModel}}
-      />`
-    );
-
-    assert.dom(SELECTORS.cardHeader('Vault version')).exists();
-    assert.dom('[data-test-badge-namespace]').exists();
-    assert.dom(SELECTORS.cardName('secrets-engines')).exists();
-    assert.dom(SELECTORS.cardName('learn-more')).exists();
-    assert.dom(SELECTORS.cardName('quick-actions')).exists();
-    assert.dom(SELECTORS.cardName('configuration-details')).exists();
-    assert.dom(SELECTORS.cardName('client-count')).doesNotExist();
-  });
+    test('it should hide cards on community in root namespace', async function (assert) {
+      this.version.version = '1.13.1';
+      this.version.type = 'community';
+      this.server.get(
+        'sys/internal/counters/activity',
+        () => new Error('uh oh! a request was made to sys/internal/counters/activity')
+      );
+      await this.renderComponent();
 
-  test('it should hide replication on enterprise not on root namespace', async function (assert) {
-    this.version = this.owner.lookup('service:version');
-    this.version.version = '1.13.1+ent';
-    this.version.type = 'enterprise';
-    this.isRootNamespace = false;
-    this.license = {
-      autoloaded: {
-        license_id: '7adbf1f4-56ef-35cd-3a6c-50ef2627865d',
-      },
-    };
+      assert.dom(DASHBOARD.cardHeader('Vault version')).exists();
+      assert.dom(DASHBOARD.cardName('secrets-engines')).exists();
+      assert.dom(DASHBOARD.cardName('learn-more')).exists();
+      assert.dom(DASHBOARD.cardName('quick-actions')).exists();
+      assert.dom(DASHBOARD.cardName('configuration-details')).exists();
+      assert.dom(DASHBOARD.cardName('replication')).doesNotExist();
+      assert.dom(DASHBOARD.cardName('client-count')).doesNotExist();
+    });
 
-    await render(
-      hbs`
-      <Dashboard::Overview
-        @version={{this.version}}
-        @isRootNamespace={{this.isRootNamespace}}
-        @secretsEngines={{this.secretsEngines}}
-        @vaultConfiguration={{this.vaultConfiguration}}
-        @replication={{this.replication}}
-        @license={{this.license}}
-        @refreshModel={{this.refreshModel}} />`
-    );
-
-    assert.dom(SELECTORS.cardHeader('Vault version')).exists();
-    assert.dom('[data-test-badge-namespace]').exists();
-    assert.dom(SELECTORS.cardName('secrets-engines')).exists();
-    assert.dom(SELECTORS.cardName('learn-more')).exists();
-    assert.dom(SELECTORS.cardName('quick-actions')).exists();
-    assert.dom(SELECTORS.cardName('configuration-details')).exists();
-    assert.dom(SELECTORS.cardName('replication')).doesNotExist();
-    assert.dom(SELECTORS.cardName('client-count')).exists();
-  });
+    test('it should hide cards on enterprise if permission but not in root namespace', async function (assert) {
+      this.permissions.exactPaths = {
+        'sys/internal/counters/activity': {
+          capabilities: ['read'],
+        },
+        'sys/replication/status': {
+          capabilities: ['read'],
+        },
+      };
+      this.isRootNamespace = false;
+      await this.renderComponent();
+      assert.dom(DASHBOARD.cardName('client-count')).doesNotExist();
+      assert.dom(DASHBOARD.cardName('replication')).doesNotExist();
+    });
 
-  module('learn more card', function () {
-    test('shows the learn more card on community', async function (assert) {
-      await render(
-        hbs`<Dashboard::Overview @secretsEngines={{this.secretsEngines}} @vaultConfiguration={{this.vaultConfiguration}} @replication={{this.replication}} @refreshModel={{this.refreshModel}} />`
-      );
+    test('it should show cards on enterprise if has permission and in root namespace', async function (assert) {
+      this.permissions.exactPaths = {
+        'sys/internal/counters/activity': {
+          capabilities: ['read'],
+        },
+        'sys/replication/status': {
+          capabilities: ['read'],
+        },
+      };
+      await this.renderComponent();
+      assert.dom(DASHBOARD.cardHeader('Vault version')).exists();
+      assert.dom(DASHBOARD.cardName('secrets-engines')).exists();
+      assert.dom(DASHBOARD.cardName('learn-more')).exists();
+      assert.dom(DASHBOARD.cardName('quick-actions')).exists();
+      assert.dom(DASHBOARD.cardName('configuration-details')).exists();
+      assert.dom(DASHBOARD.cardName('client-count')).exists();
+      assert.dom(DASHBOARD.cardName('replication')).exists();
+    });
+
+    test('it should show client count on enterprise in admin namespace when running a managed mode', async function (assert) {
+      this.permissions.exactPaths = {
+        'admin/sys/internal/counters/activity': {
+          capabilities: ['read'],
+        },
+        'admin/sys/replication/status': {
+          capabilities: ['read'],
+        },
+      };
 
-      assert.dom('[data-test-learn-more-title]').hasText('Learn more');
-      assert
-        .dom('[data-test-learn-more-subtext]')
-        .hasText(
-          'Explore the features of Vault and learn advance practices with the following tutorials and documentation.'
-        );
-      assert.dom('[data-test-learn-more-links] a').exists({ count: 3 });
-      assert
-        .dom('[data-test-feedback-form]')
-        .hasText("Don't see what you're looking for on this page? Let us know via our feedback form .");
+      this.version.type = 'enterprise';
+      this.flags.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+      this.namespace.path = 'admin';
+      this.isRootNamespace = false;
+
+      await this.renderComponent();
+
+      assert.dom(DASHBOARD.cardName('client-count')).exists();
     });
-    test('shows the learn more card on enterprise', async function (assert) {
-      this.version = this.owner.lookup('service:version');
-      this.version.version = '1.13.1+ent';
+
+    test('it should show not show client count on enterprise in child namespaces called "admin" when running a managed mode', async function (assert) {
+      this.permissions.exactPaths = {
+        'admin/sys/internal/counters/activity': {
+          capabilities: ['read'],
+        },
+        'admin/sys/replication/status': {
+          capabilities: ['read'],
+        },
+      };
+
       this.version.type = 'enterprise';
-      this.version.features = [
-        'Performance Replication',
-        'DR Replication',
-        'Namespaces',
-        'Transform Secrets Engine',
-      ];
-      this.isRootNamespace = true;
-      this.license = {
-        autoloaded: {
-          license_id: '7adbf1f4-56ef-35cd-3a6c-50ef2627865d',
+      this.flags.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+      this.namespace.path = 'ns1/admin';
+      this.isRootNamespace = false;
+
+      await this.renderComponent();
+
+      assert.dom(DASHBOARD.cardName('client-count')).doesNotExist();
+    });
+
+    test('it should hide client count on enterprise in any other namespace when running a managed mode', async function (assert) {
+      this.permissions.exactPaths = {
+        'sys/internal/counters/activity': {
+          capabilities: ['read'],
+        },
+        'sys/replication/status': {
+          capabilities: ['read'],
         },
       };
-      await render(
-        hbs`
-          <Dashboard::Overview
-            @version={{this.version}}
-            @isRootNamespace={{this.isRootNamespace}}
-            @license={{this.license}}
-            @secretsEngines={{this.secretsEngines}}
-            @vaultConfiguration={{this.vaultConfiguration}}
-            @replication={{this.replication}}
-            @refreshModel={{this.refreshModel}} />
-        `
-      );
-      assert.dom('[data-test-learn-more-title]').hasText('Learn more');
-      assert
-        .dom('[data-test-learn-more-subtext]')
-        .hasText(
-          'Explore the features of Vault and learn advance practices with the following tutorials and documentation.'
-        );
-      assert.dom('[data-test-learn-more-links] a').exists({ count: 4 });
-      assert
-        .dom('[data-test-feedback-form]')
-        .hasText("Don't see what you're looking for on this page? Let us know via our feedback form .");
+
+      this.version.type = 'enterprise';
+      this.flags.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+      this.namespace.path = 'groceries';
+      this.isRootNamespace = false;
+
+      await this.renderComponent();
+
+      assert.dom(DASHBOARD.cardName('client-count')).doesNotExist();
+    });
+
+    test('it should hide cards on enterprise in root namespace but no permission', async function (assert) {
+      await this.renderComponent();
+      assert.dom(DASHBOARD.cardName('client-count')).doesNotExist();
+      assert.dom(DASHBOARD.cardName('replication')).doesNotExist();
+    });
+
+    test('it should hide cards on enterprise if no permission and not in root namespace', async function (assert) {
+      this.isRootNamespace = false;
+      await this.renderComponent();
+      assert.dom(DASHBOARD.cardName('client-count')).doesNotExist();
+      assert.dom(DASHBOARD.cardName('replication')).doesNotExist();
     });
+
+    test('it should hide client count on enterprise in root namespace if no activity permission', async function (assert) {
+      this.permissions.exactPaths = {
+        'sys/internal/counters/activity': {
+          capabilities: ['deny'],
+        },
+        'sys/replication/status': {
+          capabilities: ['read'],
+        },
+      };
+
+      await this.renderComponent();
+      assert.dom(DASHBOARD.cardName('client-count')).doesNotExist();
+      assert.dom(DASHBOARD.cardName('replication')).exists();
+    });
+
+    test('it should hide replication on enterprise in root namespace if no replication status permission', async function (assert) {
+      this.permissions.exactPaths = {
+        'sys/internal/counters/activity': {
+          capabilities: ['read'],
+        },
+        'sys/replication/status': {
+          capabilities: ['deny'],
+        },
+      };
+
+      await this.renderComponent();
+      assert.dom(DASHBOARD.cardName('client-count')).exists();
+      assert.dom(DASHBOARD.cardName('replication')).doesNotExist();
+    });
+
+    test('it should hide replication on enterprise if has permission and in root namespace but is empty', async function (assert) {
+      this.permissions.exactPaths = {
+        'sys/internal/counters/activity': {
+          capabilities: ['read'],
+        },
+        'sys/replication/status': {
+          capabilities: ['read'],
+        },
+      };
+      this.replication = {};
+      await this.renderComponent();
+      assert.dom(DASHBOARD.cardName('client-count')).exists();
+      assert.dom(DASHBOARD.cardName('replication')).doesNotExist();
+    });
+  });
+
+  test('it shows the learn more card on community', async function (assert) {
+    this.version.version = '1.13.1';
+    this.version.type = 'community';
+    await this.renderComponent();
+
+    assert.dom('[data-test-learn-more-title]').hasText('Learn more');
+    assert
+      .dom('[data-test-learn-more-subtext]')
+      .hasText(
+        'Explore the features of Vault and learn advance practices with the following tutorials and documentation.'
+      );
+    assert.dom('[data-test-learn-more-links] a').exists({ count: 3 });
+  });
+
+  test('it shows the learn more card on enterprise', async function (assert) {
+    this.version.type = 'enterprise';
+    this.version.features = [
+      'Performance Replication',
+      'DR Replication',
+      'Namespaces',
+      'Transform Secrets Engine',
+    ];
+    await this.renderComponent();
+    assert.dom('[data-test-learn-more-title]').hasText('Learn more');
+    assert
+      .dom('[data-test-learn-more-subtext]')
+      .hasText(
+        'Explore the features of Vault and learn advance practices with the following tutorials and documentation.'
+      );
+    assert.dom('[data-test-learn-more-links] a').exists({ count: 4 });
   });
 });
diff --git a/ui/tests/integration/components/dashboard/quick-actions-card-test.js b/ui/tests/integration/components/dashboard/quick-actions-card-test.js
index 8122f9260f3..c6b6c39e071 100644
--- a/ui/tests/integration/components/dashboard/quick-actions-card-test.js
+++ b/ui/tests/integration/components/dashboard/quick-actions-card-test.js
@@ -1,94 +1,44 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { render, findAll, click } from '@ember/test-helpers';
+import { clickTrigger } from 'ember-power-select/test-support/helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { fillIn } from '@ember/test-helpers';
-import { selectChoose } from 'ember-power-select/test-support/helpers';
-
-import { SELECTORS } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
+import { selectChoose } from 'ember-power-select/test-support';
+import sinon from 'sinon';
+import { DASHBOARD } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 module('Integration | Component | dashboard/quick-actions-card', function (hooks) {
   setupRenderingTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.store = this.owner.lookup('service:store');
-    this.store.pushPayload('secret-engine', {
-      modelName: 'secret-engine',
-      data: {
-        accessor: 'kubernetes_f3400dee',
-        path: 'kubernetes-test/',
-        type: 'kubernetes',
-      },
-    });
-    this.store.pushPayload('secret-engine', {
-      modelName: 'secret-engine',
-      data: {
-        accessor: 'database_f3400dee',
-        path: 'database-test/',
-        type: 'database',
-      },
-    });
-    this.store.pushPayload('secret-engine', {
-      modelName: 'secret-engine',
-      data: {
-        accessor: 'pki_i1234dd',
-        path: 'apki-test/',
-        type: 'pki',
-      },
-    });
-    this.store.pushPayload('secret-engine', {
-      modelName: 'secret-engine',
-      data: {
-        accessor: 'secrets_j2350ii',
-        path: 'secrets-test/',
-        type: 'kv',
-      },
-    });
-    this.store.pushPayload('secret-engine', {
-      modelName: 'secret-engine',
-      data: {
-        accessor: 'nomad_123hh',
-        path: 'nomad/',
-        type: 'nomad',
-      },
-    });
-    this.store.pushPayload('secret-engine', {
-      modelName: 'secret-engine',
-      data: {
-        accessor: 'pki_f3400dee',
-        path: 'pki-0-test/',
-        type: 'pki',
-      },
-    });
-    this.store.pushPayload('secret-engine', {
-      modelName: 'secret-engine',
-      data: {
-        accessor: 'pki_i1234dd',
-        path: 'pki-1-test/',
-        description: 'pki-1-path-description',
-        type: 'pki',
-      },
-    });
-    this.store.pushPayload('secret-engine', {
-      modelName: 'secret-engine',
-      data: {
-        accessor: 'secrets_j2350ii',
-        path: 'kv-v2-test/',
-        options: {
-          version: 2,
-        },
-        type: 'kv',
-      },
-    });
-
-    this.secretsEngines = this.store.peekAll('secret-engine', {});
+    const store = this.owner.lookup('service:store');
+    const router = this.owner.lookup('service:router');
+    this.transitionStub = sinon.stub(router, 'transitionTo');
 
+    const models = [
+      { accessor: 'kubernetes_f3400dee', path: 'kubernetes-test/', type: 'kubernetes' },
+      { accessor: 'database_f3400dee', path: 'database-test/', type: 'database' },
+      { accessor: 'pki_i1234dd', path: 'apki-test/', type: 'pki' },
+      { accessor: 'secrets_j2350ii', path: 'secrets-test/', type: 'kv' },
+      { accessor: 'nomad_123hh', path: 'nomad/', type: 'nomad' },
+      { accessor: 'pki_f3400dee', path: 'pki-0-test/', type: 'pki' },
+      { accessor: 'pki_i1234dd', path: 'pki-1-test/', description: 'pki-1-path-description', type: 'pki' },
+      { accessor: 'secrets_j2350ii', path: 'kv-v2-test/', options: { version: 2 }, type: 'kv' },
+      { accessor: 'secrets_j2350ii', path: 'kv-v1-test/', options: { version: 1 }, type: 'kv' },
+    ];
+    models.forEach((modelData) => {
+      store.pushPayload('secret-engine', { modelName: 'secret-engine', data: modelData });
+    });
+    this.secretsEngines = store.peekAll('secret-engine', {});
     this.renderComponent = () => {
       return render(hbs`<Dashboard::QuickActionsCard @secretsEngines={{this.secretsEngines}} />`);
     };
@@ -102,48 +52,128 @@ module('Integration | Component | dashboard/quick-actions-card', function (hooks
     });
   });
 
+  hooks.afterEach(function () {
+    this.transitionStub.restore();
+  });
+
+  test('it does not include kvv1 mounts', async function (assert) {
+    await this.renderComponent();
+    await clickTrigger('#type-to-select-a-mount');
+
+    findAll('.ember-power-select-option').forEach((o) => {
+      assert.dom(o).doesNotHaveTextContaining('kv-v1-test');
+    });
+  });
+
   test('it should show quick action empty state if no engine is selected', async function (assert) {
     await this.renderComponent();
     assert.dom('.title').hasText('Quick actions');
-    assert.dom(SELECTORS.searchSelect('secrets-engines')).exists({ count: 1 });
-    assert.dom(SELECTORS.emptyState('no-mount-selected')).exists({ count: 1 });
+    assert.dom(DASHBOARD.searchSelect('secrets-engines')).exists({ count: 1 });
+    assert.dom(DASHBOARD.emptyState('no-mount-selected')).exists({ count: 1 });
   });
 
-  test('it should show correct actions for pki', async function (assert) {
+  test('it selects a pki role and issues a leaf certificate', async function (assert) {
+    const backend = 'pki-0-test';
+    this.server.get(`/${backend}/roles`, () => ({ data: { keys: ['some-role'] } }));
     await this.renderComponent();
-    await selectChoose(SELECTORS.searchSelect('secrets-engines'), 'pki-0-test');
-    await fillIn(SELECTORS.selectEl, 'Issue certificate');
-    assert.dom(SELECTORS.emptyState('quick-actions')).doesNotExist();
-    await fillIn(SELECTORS.selectEl, 'Issue certificate');
-    assert.dom(SELECTORS.actionButton('Issue leaf certificate')).exists({ count: 1 });
-    assert.dom(SELECTORS.subtitle('param')).hasText('Role to use');
-    await fillIn(SELECTORS.selectEl, 'View certificate');
-    assert.dom(SELECTORS.subtitle('param')).hasText('Certificate serial number');
-    assert.dom(SELECTORS.actionButton('View certificate')).exists({ count: 1 });
-    await fillIn(SELECTORS.selectEl, 'View issuer');
-    assert.dom(SELECTORS.subtitle('param')).hasText('Issuer');
-    assert.dom(SELECTORS.actionButton('View issuer')).exists({ count: 1 });
+
+    await selectChoose(DASHBOARD.searchSelect('secrets-engines'), backend);
+    await fillIn(DASHBOARD.selectEl, 'Issue certificate');
+    assert.dom(DASHBOARD.emptyState('quick-actions')).doesNotExist();
+    assert.dom(DASHBOARD.subtitle('param')).hasText('Role to use');
+    await selectChoose(DASHBOARD.searchSelect('params'), 'some-role');
+    assert.dom(DASHBOARD.actionButton('Issue leaf certificate')).exists({ count: 1 });
+    await click(DASHBOARD.actionButton('Issue leaf certificate'));
+    const [route, backendParam, roleParam] = this.transitionStub.lastCall.args;
+    assert.strictEqual(
+      route,
+      'vault.cluster.secrets.backend.pki.roles.role.generate',
+      'transition is called with expected route'
+    );
+    assert.strictEqual(backendParam, backend, 'transition has expected backend param');
+    assert.strictEqual(roleParam, 'some-role', 'transition has expected role param');
   });
-  test('it should show correct actions for database', async function (assert) {
+
+  test('it views a pki certificate', async function (assert) {
+    const backend = 'pki-0-test';
+    this.server.get(`/${backend}/certs`, () => ({ data: { keys: ['51:1c:39:42:ba'] } }));
     await this.renderComponent();
-    await selectChoose(SELECTORS.searchSelect('secrets-engines'), 'database-test');
-    assert.dom(SELECTORS.emptyState('quick-actions')).doesNotExist();
-    await fillIn(SELECTORS.selectEl, 'Generate credentials for database');
-    assert.dom(SELECTORS.subtitle('param')).hasText('Role to use');
-    assert.dom(SELECTORS.actionButton('Generate credentials')).exists({ count: 1 });
+
+    await selectChoose(DASHBOARD.searchSelect('secrets-engines'), backend);
+    await fillIn(DASHBOARD.selectEl, 'View certificate');
+    assert.dom(DASHBOARD.emptyState('quick-actions')).doesNotExist();
+    assert.dom(DASHBOARD.subtitle('param')).hasText('Certificate serial number');
+    assert.dom(DASHBOARD.actionButton('View certificate')).exists({ count: 1 });
+    await selectChoose(DASHBOARD.searchSelect('params'), '.ember-power-select-option', 0);
+    await click(DASHBOARD.actionButton('View certificate'));
+    const [route, backendParam, certParam] = this.transitionStub.lastCall.args;
+    assert.strictEqual(
+      route,
+      'vault.cluster.secrets.backend.pki.certificates.certificate.details',
+      'transition is called with expected route'
+    );
+    assert.strictEqual(backendParam, backend, 'transition has expected backend param');
+    assert.strictEqual(certParam, '51:1c:39:42:ba', 'transition has expected cert param');
   });
+
+  test('it views a pki issuer', async function (assert) {
+    const backend = 'pki-0-test';
+    this.server.get(`/${backend}/issuers`, () => {
+      return { data: { key_info: { '101709a1': { issuer_name: 'test' } }, keys: ['101709a1'] } };
+    });
+    await this.renderComponent();
+
+    await selectChoose(DASHBOARD.searchSelect('secrets-engines'), backend);
+    await fillIn(DASHBOARD.selectEl, 'View issuer');
+    assert.dom(DASHBOARD.emptyState('quick-actions')).doesNotExist();
+    assert.dom(DASHBOARD.subtitle('param')).hasText('Issuer');
+    assert.dom(DASHBOARD.actionButton('View issuer')).exists({ count: 1 });
+    await selectChoose(DASHBOARD.searchSelect('params'), '.ember-power-select-option', 0);
+    await click(DASHBOARD.actionButton('View issuer'));
+    const [route, backendParam, issuerParam] = this.transitionStub.lastCall.args;
+    assert.strictEqual(
+      route,
+      'vault.cluster.secrets.backend.pki.issuers.issuer.details',
+      'transition is called with expected route'
+    );
+    assert.strictEqual(backendParam, backend, 'transition has expected backend param');
+    assert.strictEqual(issuerParam, '101709a1', 'transition has expected issuer param');
+  });
+
+  test('it selects a role and generates credentials for a database', async function (assert) {
+    const backend = 'database-test';
+    this.server.get(`/${backend}/roles`, () => ({ data: { keys: ['my-role'] } }));
+    await this.renderComponent();
+
+    await selectChoose(DASHBOARD.searchSelect('secrets-engines'), backend);
+    await fillIn(DASHBOARD.selectEl, 'Generate credentials for database');
+    assert.dom(DASHBOARD.emptyState('quick-actions')).doesNotExist();
+    assert.dom(DASHBOARD.subtitle('param')).hasText('Role to use');
+    assert.dom(DASHBOARD.actionButton('Generate credentials')).exists({ count: 1 });
+    await selectChoose(DASHBOARD.searchSelect('params'), '.ember-power-select-option', 0);
+    await click(DASHBOARD.actionButton('Generate credentials'));
+    const [route, backendParam, issuerParam] = this.transitionStub.lastCall.args;
+    assert.strictEqual(
+      route,
+      'vault.cluster.secrets.backend.credentials',
+      'transition is called with expected route'
+    );
+    assert.strictEqual(backendParam, backend, 'transition has expected backend param');
+    assert.strictEqual(issuerParam, 'my-role', 'transition has expected role param');
+  });
+
   test('it should show correct actions for kv', async function (assert) {
     await this.renderComponent();
-    await click('[data-test-component="search-select"]#secrets-engines-select .ember-basic-dropdown-trigger');
+    await clickTrigger('#type-to-select-a-mount');
     assert.strictEqual(
       findAll('li.ember-power-select-option').length,
       5,
       'renders only kv v2, pki and db engines'
     );
-    await selectChoose(SELECTORS.searchSelect('secrets-engines'), 'kv-v2-test');
-    assert.dom(SELECTORS.emptyState('quick-actions')).doesNotExist();
-    await fillIn(SELECTORS.selectEl, 'Find KV secrets');
-    assert.dom(SELECTORS.kvSearchSelect).exists('Shows option to search fo KVv2 secret');
-    assert.dom(SELECTORS.actionButton('Read secrets')).exists({ count: 1 });
+    await selectChoose(DASHBOARD.searchSelect('secrets-engines'), 'kv-v2-test');
+    assert.dom(DASHBOARD.emptyState('quick-actions')).doesNotExist();
+    await fillIn(DASHBOARD.selectEl, 'Find KV secrets');
+    assert.dom(DASHBOARD.kvSearchSelect).exists('Shows option to search fo KVv2 secret');
+    assert.dom(DASHBOARD.actionButton('Read secrets')).exists({ count: 1 });
   });
 });
diff --git a/ui/tests/integration/components/dashboard/replication-card-test.js b/ui/tests/integration/components/dashboard/replication-card-test.js
index 7ee7d0d2f45..9ed1db6db9b 100644
--- a/ui/tests/integration/components/dashboard/replication-card-test.js
+++ b/ui/tests/integration/components/dashboard/replication-card-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import timestamp from 'core/utils/timestamp';
-import { SELECTORS } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
+import { DASHBOARD } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
 
 module('Integration | Component | dashboard/replication-card', function (hooks) {
   setupRenderingTest(hooks);
@@ -20,11 +20,12 @@ module('Integration | Component | dashboard/replication-card', function (hooks)
       dr: {
         clusterId: '123',
         state: 'running',
+        mode: 'primary',
       },
       performance: {
         clusterId: 'abc-1',
         state: 'running',
-        isPrimary: true,
+        mode: 'primary',
       },
     };
     this.version = {
@@ -45,24 +46,16 @@ module('Integration | Component | dashboard/replication-card', function (hooks)
           @refresh={{this.refresh}} />
           `
     );
-    assert.dom(SELECTORS.title('DR primary')).hasText('DR primary');
-    assert.dom(SELECTORS.tooltipTitle('DR primary')).hasText('running');
-    assert.dom(SELECTORS.tooltipIcon('dr-perf', 'DR primary', 'check-circle')).exists();
-    assert.dom(SELECTORS.title('Performance primary')).hasText('Performance primary');
-    assert.dom(SELECTORS.tooltipTitle('Performance primary')).hasText('running');
-    assert.dom(SELECTORS.tooltipIcon('dr-perf', 'Performance primary', 'check-circle')).exists();
+    assert.dom(DASHBOARD.title('DR primary')).hasText('DR primary');
+    assert.dom(DASHBOARD.tooltipTitle('DR primary')).hasText('running');
+    assert.dom(DASHBOARD.tooltipIcon('dr-perf', 'DR primary', 'check-circle')).exists();
+    assert.dom(DASHBOARD.title('Performance primary')).hasText('Performance primary');
+    assert.dom(DASHBOARD.tooltipTitle('Performance primary')).hasText('running');
+    assert.dom(DASHBOARD.tooltipIcon('dr-perf', 'Performance primary', 'check-circle')).exists();
   });
+
   test('it should display replication information if both dr and performance replication are enabled as features and only dr is setup', async function (assert) {
-    this.replication = {
-      dr: {
-        clusterId: '123',
-        state: 'running',
-      },
-      performance: {
-        clusterId: '',
-        isPrimary: true,
-      },
-    };
+    this.replication.performance = { mode: 'disabled' };
     await render(
       hbs`
         <Dashboard::ReplicationCard
@@ -72,18 +65,15 @@ module('Integration | Component | dashboard/replication-card', function (hooks)
           @refresh={{this.refresh}} />
           `
     );
-    assert.dom(SELECTORS.title('DR primary')).hasText('DR primary');
-    assert.dom(SELECTORS.tooltipTitle('DR primary')).hasText('running');
-    assert.dom(SELECTORS.tooltipIcon('dr-perf', 'DR primary', 'check-circle')).exists();
-    assert.dom(SELECTORS.tooltipIcon('dr-perf', 'DR primary', 'check-circle')).hasClass('has-text-success');
-
-    assert.dom(SELECTORS.title('Performance primary')).hasText('Performance primary');
+    assert.dom(DASHBOARD.title('DR primary')).hasText('DR primary');
+    assert.dom(DASHBOARD.tooltipTitle('DR primary')).hasText('running');
+    assert.dom(DASHBOARD.tooltipIcon('dr-perf', 'DR primary', 'check-circle')).exists();
+    assert.dom(DASHBOARD.tooltipIcon('dr-perf', 'DR primary', 'check-circle')).hasClass('has-text-success');
 
-    assert.dom(SELECTORS.tooltipTitle('Performance primary')).hasText('not set up');
-    assert.dom(SELECTORS.tooltipIcon('dr-perf', 'Performance primary', 'x-circle')).exists();
-    assert
-      .dom(SELECTORS.tooltipIcon('dr-perf', 'Performance primary', 'x-circle'))
-      .hasClass('has-text-danger');
+    assert.dom(DASHBOARD.title('Performance')).hasText('Performance');
+    assert.dom(DASHBOARD.tooltipTitle('Performance')).hasText('not set up');
+    assert.dom(DASHBOARD.tooltipIcon('dr-perf', 'Performance', 'x-circle')).exists();
+    assert.dom(DASHBOARD.tooltipIcon('dr-perf', 'Performance', 'x-circle')).hasClass('has-text-danger');
   });
 
   test('it should display only dr replication information if vault version only has hasDRReplication', async function (assert) {
@@ -107,16 +97,16 @@ module('Integration | Component | dashboard/replication-card', function (hooks)
           @refresh={{this.refresh}} />
           `
     );
-    assert.dom(SELECTORS.title('state')).hasText('state');
-    assert.dom(SELECTORS.subtext('state')).hasText('The current operating state of the cluster.');
-    assert.dom(SELECTORS.tooltipTitle('state')).hasText('running');
-    assert.dom(SELECTORS.tooltipIcon('dr', 'state', 'check-circle')).exists();
-    assert.dom(SELECTORS.tooltipIcon('dr', 'state', 'check-circle')).hasClass('has-text-success');
-    assert.dom(SELECTORS.statLabel('known secondaries')).hasText('known secondaries');
+    assert.dom(DASHBOARD.title('state')).hasText('state');
+    assert.dom(DASHBOARD.subtext('state')).hasText('The current operating state of the cluster.');
+    assert.dom(DASHBOARD.tooltipTitle('state')).hasText('running');
+    assert.dom(DASHBOARD.tooltipIcon('dr', 'state', 'check-circle')).exists();
+    assert.dom(DASHBOARD.tooltipIcon('dr', 'state', 'check-circle')).hasClass('has-text-success');
+    assert.dom(DASHBOARD.statLabel('known secondaries')).hasText('known secondaries');
     assert
-      .dom(SELECTORS.statText('known secondaries'))
+      .dom(DASHBOARD.statText('known secondaries'))
       .hasText('Number of secondaries connected to this primary.');
-    assert.dom(SELECTORS.statValue('known secondaries')).hasText('1');
+    assert.dom(DASHBOARD.statValue('known secondaries')).hasText('1');
   });
 
   test('it should show correct icons if dr and performance replication is idle or shutdown states', async function (assert) {
@@ -124,11 +114,12 @@ module('Integration | Component | dashboard/replication-card', function (hooks)
       dr: {
         clusterId: 'abc',
         state: 'idle',
+        mode: 'primary',
       },
       performance: {
         clusterId: 'def',
         state: 'shutdown',
-        isPrimary: true,
+        mode: 'primary',
       },
     };
     await render(
@@ -140,16 +131,16 @@ module('Integration | Component | dashboard/replication-card', function (hooks)
           @refresh={{this.refresh}} />
           `
     );
-    assert.dom(SELECTORS.title('DR primary')).hasText('DR primary');
-    assert.dom(SELECTORS.tooltipTitle('DR primary')).hasText('idle');
-    assert.dom(SELECTORS.tooltipIcon('dr-perf', 'DR primary', 'x-square')).exists();
-    assert.dom(SELECTORS.tooltipIcon('dr-perf', 'DR primary', 'x-square')).hasClass('has-text-danger');
+    assert.dom(DASHBOARD.title('DR primary')).hasText('DR primary');
+    assert.dom(DASHBOARD.tooltipTitle('DR primary')).hasText('idle');
+    assert.dom(DASHBOARD.tooltipIcon('dr-perf', 'DR primary', 'x-square')).exists();
+    assert.dom(DASHBOARD.tooltipIcon('dr-perf', 'DR primary', 'x-square')).hasClass('has-text-danger');
 
-    assert.dom(SELECTORS.title('Performance primary')).hasText('Performance primary');
-    assert.dom(SELECTORS.tooltipTitle('Performance primary')).hasText('shutdown');
-    assert.dom(SELECTORS.tooltipIcon('dr-perf', 'Performance primary', 'x-circle')).exists();
+    assert.dom(DASHBOARD.title('Performance primary')).hasText('Performance primary');
+    assert.dom(DASHBOARD.tooltipTitle('Performance primary')).hasText('shutdown');
+    assert.dom(DASHBOARD.tooltipIcon('dr-perf', 'Performance primary', 'x-circle')).exists();
     assert
-      .dom(SELECTORS.tooltipIcon('dr-perf', 'Performance primary', 'x-circle'))
+      .dom(DASHBOARD.tooltipIcon('dr-perf', 'Performance primary', 'x-circle'))
       .hasClass('has-text-danger');
   });
 
@@ -158,10 +149,11 @@ module('Integration | Component | dashboard/replication-card', function (hooks)
       dr: {
         clusterId: 'abc',
         state: 'running',
+        mode: 'primary',
       },
       performance: {
         clusterId: 'def',
-        isPrimary: true,
+        mode: 'primary',
       },
     };
     await render(
@@ -173,19 +165,10 @@ module('Integration | Component | dashboard/replication-card', function (hooks)
           @refresh={{this.refresh}} />
           `
     );
-    assert.dom(SELECTORS.title('DR primary')).hasText('DR primary');
-    assert.dom(SELECTORS.title('Performance primary')).hasText('Performance primary');
+    assert.dom(DASHBOARD.title('DR primary')).hasText('DR primary');
+    assert.dom(DASHBOARD.title('Performance primary')).hasText('Performance primary');
 
-    this.replication = {
-      dr: {
-        clusterId: 'abc',
-        state: 'running',
-      },
-      performance: {
-        clusterId: 'def',
-        isPrimary: false,
-      },
-    };
+    this.replication.performance.mode = 'secondary';
     await render(
       hbs`
           <Dashboard::ReplicationCard
@@ -195,7 +178,7 @@ module('Integration | Component | dashboard/replication-card', function (hooks)
             @refresh={{this.refresh}} />
             `
     );
-    assert.dom(SELECTORS.title('Performance secondary')).hasText('Performance secondary');
+    assert.dom(DASHBOARD.title('Performance secondary')).hasText('Performance secondary');
   });
 
   test('it should show empty state', async function (assert) {
@@ -216,11 +199,11 @@ module('Integration | Component | dashboard/replication-card', function (hooks)
           @refresh={{this.refresh}} />
           `
     );
-    assert.dom(SELECTORS.emptyState('replication')).exists();
-    assert.dom(SELECTORS.emptyStateTitle('replication')).hasText('Replication not set up');
+    assert.dom(DASHBOARD.emptyState('replication')).exists();
+    assert.dom(DASHBOARD.emptyStateTitle('replication')).hasText('Replication not set up');
     assert
-      .dom(SELECTORS.emptyStateMessage('replication'))
+      .dom(DASHBOARD.emptyStateMessage('replication'))
       .hasText('Data will be listed here. Enable a primary replication cluster to get started.');
-    assert.dom(SELECTORS.emptyStateActions('replication')).hasText('Enable replication');
+    assert.dom(DASHBOARD.emptyStateActions('replication')).hasText('Enable replication');
   });
 });
diff --git a/ui/tests/integration/components/dashboard/replication-state-text.js b/ui/tests/integration/components/dashboard/replication-state-text.js
index ff849f84148..d6555cbe93f 100644
--- a/ui/tests/integration/components/dashboard/replication-state-text.js
+++ b/ui/tests/integration/components/dashboard/replication-state-text.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/dashboard/secrets-engines-card-test.js b/ui/tests/integration/components/dashboard/secrets-engines-card-test.js
index c17238b0f5a..2e35a5d9019 100644
--- a/ui/tests/integration/components/dashboard/secrets-engines-card-test.js
+++ b/ui/tests/integration/components/dashboard/secrets-engines-card-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,16 +7,14 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { SELECTORS } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
+import { DASHBOARD } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
 
 module('Integration | Component | dashboard/secrets-engines-card', function (hooks) {
   setupRenderingTest(hooks);
 
   hooks.beforeEach(function () {
     this.store = this.owner.lookup('service:store');
-  });
-
-  test('it should hide show all button', async function (assert) {
     this.store.pushPayload('secret-engine', {
       modelName: 'secret-engine',
       data: {
@@ -25,14 +23,37 @@ module('Integration | Component | dashboard/secrets-engines-card', function (hoo
         type: 'kubernetes',
       },
     });
+  });
 
+  test('it should hide show all button', async function (assert) {
     this.secretsEngines = this.store.peekAll('secret-engine', {});
 
     await render(hbs`<Dashboard::SecretsEnginesCard @secretsEngines={{this.secretsEngines}} />`);
 
+    // verify truncate class style exists on secret engine path text
+    assert
+      .dom(SES.secretPath('kubernetes-test/'))
+      .hasClass('truncate-first-line', 'secret engine name has truncate class to handle overflow');
+
     assert.dom('[data-test-secrets-engines-card-show-all]').doesNotExist();
   });
 
+  test('it disables unsupported secret engines', async function (assert) {
+    this.store.pushPayload('secret-engine', {
+      modelName: 'secret-engine',
+      data: {
+        accessor: 'nomad_f3400dee',
+        path: 'nomad-test/',
+        type: 'nomad',
+      },
+    });
+    this.secretsEngines = this.store.peekAll('secret-engine', {});
+
+    await render(hbs`<Dashboard::SecretsEnginesCard @secretsEngines={{this.secretsEngines}} />`);
+    assert.dom('[data-test-secrets-engines-row="nomad"] [data-test-view]').doesNotExist();
+    assert.dom(SES.secretPath('nomad-test/')).hasClass('has-text-grey');
+  });
+
   module('secrets engines with 5 or more enabled', function (hooks) {
     hooks.beforeEach(function () {
       this.store.pushPayload('secret-engine', {
@@ -102,8 +123,8 @@ module('Integration | Component | dashboard/secrets-engines-card', function (hoo
 
     test('it should display only five secrets engines and show help text for more than 5 engines', async function (assert) {
       await this.renderComponent();
-      assert.dom(SELECTORS.cardHeader('Secrets engines')).hasText('Secrets engines');
-      assert.dom(SELECTORS.tableRow('Secrets engines')).exists({ count: 5 });
+      assert.dom(DASHBOARD.cardHeader('Secrets engines')).hasText('Secrets engines');
+      assert.dom(DASHBOARD.tableRow('Secrets engines')).exists({ count: 5 });
       assert.dom('[data-test-secrets-engine-total-help-text]').exists();
       assert
         .dom('[data-test-secrets-engine-total-help-text]')
@@ -114,18 +135,18 @@ module('Integration | Component | dashboard/secrets-engines-card', function (hoo
 
     test('it should display the secrets engines accessor and path', async function (assert) {
       await this.renderComponent();
-      assert.dom(SELECTORS.cardHeader('Secrets engines')).hasText('Secrets engines');
-      assert.dom(SELECTORS.tableRow('Secrets engines')).exists({ count: 5 });
+      assert.dom(DASHBOARD.cardHeader('Secrets engines')).hasText('Secrets engines');
+      assert.dom(DASHBOARD.tableRow('Secrets engines')).exists({ count: 5 });
 
       this.secretsEngines.slice(0, 5).forEach((engine) => {
-        assert.dom(SELECTORS.secretsEnginesCard.secretEngineAccessorRow(engine.id)).hasText(engine.accessor);
+        assert.dom(DASHBOARD.secretsEnginesCard.secretEngineAccessorRow(engine.id)).hasText(engine.accessor);
         if (engine.description) {
           assert
-            .dom(SELECTORS.secretsEnginesCard.secretEngineDescription(engine.id))
+            .dom(DASHBOARD.secretsEnginesCard.secretEngineDescription(engine.id))
             .hasText(engine.description);
         } else {
           assert
-            .dom(SELECTORS.secretsEnginesCard.secretEngineDescription(engine.id))
+            .dom(DASHBOARD.secretsEnginesCard.secretEngineDescription(engine.id))
             .doesNotExist(engine.description);
         }
       });
@@ -133,8 +154,12 @@ module('Integration | Component | dashboard/secrets-engines-card', function (hoo
 
     test('it adds disabled css styling to unsupported secret engines', async function (assert) {
       await this.renderComponent();
-      assert.dom('[data-test-secrets-engines-row="nomad"] [data-test-view]').doesNotExist();
-      assert.dom('[data-test-secrets-engines-row="nomad"] [data-test-secret-path]').hasClass('has-text-grey');
+      assert
+        .dom(SES.secretPath('secrets-test/'))
+        .hasClass('has-text-black', 'does not apply disabled class to supported secret engine');
+      assert
+        .dom(SES.secretPath('nomad/'))
+        .hasClass('has-text-grey', 'nomad is not a supported secret engine and has disabled class');
     });
   });
 });
diff --git a/ui/tests/integration/components/dashboard/vault-configuration-details-card-test.js b/ui/tests/integration/components/dashboard/vault-configuration-details-card-test.js
new file mode 100644
index 00000000000..3e999f98318
--- /dev/null
+++ b/ui/tests/integration/components/dashboard/vault-configuration-details-card-test.js
@@ -0,0 +1,147 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { DASHBOARD } from 'vault/tests/helpers/components/dashboard/dashboard-selectors';
+
+module('Integration | Component | dashboard/vault-configuration-details-card', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.data = {
+      api_addr: 'http://127.0.0.1:8200',
+      cache_size: 0,
+      cluster_addr: 'https://127.0.0.1:8201',
+      cluster_cipher_suites: '',
+      cluster_name: '',
+      default_lease_ttl: 0,
+      default_max_request_duration: 0,
+      detect_deadlocks: '',
+      disable_cache: false,
+      disable_clustering: false,
+      disable_indexing: false,
+      disable_mlock: true,
+      disable_performance_standby: false,
+      disable_printable_check: false,
+      disable_sealwrap: false,
+      disable_sentinel_trace: false,
+      enable_response_header_hostname: false,
+      enable_response_header_raft_node_id: false,
+      enable_ui: true,
+      experiments: null,
+      introspection_endpoint: false,
+      listeners: [
+        {
+          config: {
+            address: '0.0.0.0:8200',
+            cluster_address: '0.0.0.0:8201',
+            tls_disable: true,
+          },
+          type: 'tcp',
+        },
+      ],
+      log_format: '',
+      log_level: 'debug',
+      log_requests_level: '',
+      max_lease_ttl: '48h',
+      pid_file: '',
+      plugin_directory: '',
+      plugin_file_permissions: 0,
+      plugin_file_uid: 0,
+      raw_storage_endpoint: true,
+      seals: [
+        {
+          disabled: false,
+          type: 'shamir',
+        },
+      ],
+      storage: {
+        cluster_addr: 'https://127.0.0.1:8201',
+        disable_clustering: false,
+        raft: {
+          max_entry_size: '',
+        },
+        redirect_addr: 'http://127.0.0.1:8200',
+        type: 'raft',
+      },
+      telemetry: {
+        add_lease_metrics_namespace_labels: false,
+        circonus_api_app: '',
+        circonus_api_token: '',
+        circonus_api_url: '',
+        circonus_broker_id: '',
+        circonus_broker_select_tag: '',
+        circonus_check_display_name: '',
+        circonus_check_force_metric_activation: '',
+        circonus_check_id: '',
+        circonus_check_instance_id: '',
+        circonus_check_search_tag: '',
+        circonus_check_tags: '',
+        circonus_submission_interval: '',
+        circonus_submission_url: '',
+        disable_hostname: true,
+        dogstatsd_addr: '',
+        dogstatsd_tags: null,
+        lease_metrics_epsilon: 3600000000000,
+        maximum_gauge_cardinality: 500,
+        metrics_prefix: '',
+        num_lease_metrics_buckets: 168,
+        prometheus_retention_time: 86400000000000,
+        stackdriver_debug_logs: false,
+        stackdriver_location: '',
+        stackdriver_namespace: '',
+        stackdriver_project_id: '',
+        statsd_address: '',
+        statsite_address: '',
+        usage_gauge_period: 5000000000,
+      },
+    };
+
+    this.renderComponent = () => {
+      return render(hbs`<Dashboard::VaultConfigurationDetailsCard @vaultConfiguration={{this.data}} />`);
+    };
+  });
+
+  test('it renders configuration details', async function (assert) {
+    await this.renderComponent();
+    assert.dom(DASHBOARD.cardHeader('configuration')).hasText('Configuration details');
+    assert
+      .dom(DASHBOARD.vaultConfigurationCard.configDetailsField('api_addr'))
+      .hasText('http://127.0.0.1:8200');
+    assert.dom(DASHBOARD.vaultConfigurationCard.configDetailsField('default_lease_ttl')).hasText('0');
+    assert.dom(DASHBOARD.vaultConfigurationCard.configDetailsField('max_lease_ttl')).hasText('2 days');
+    assert.dom(DASHBOARD.vaultConfigurationCard.configDetailsField('tls')).hasText('Disabled'); // tls_disable=true
+    assert.dom(DASHBOARD.vaultConfigurationCard.configDetailsField('log_format')).hasText('None');
+    assert.dom(DASHBOARD.vaultConfigurationCard.configDetailsField('log_level')).hasText('debug');
+    assert.dom(DASHBOARD.vaultConfigurationCard.configDetailsField('type')).hasText('raft');
+  });
+
+  test('it should show tls as enabled if tls_disable, tls_cert_file and tls_key_file are in the config', async function (assert) {
+    this.data.listeners[0].config.tls_disable = false;
+    this.data.listeners[0].config.tls_cert_file = './cert.pem';
+    this.data.listeners[0].config.tls_key_file = './key.pem';
+
+    await this.renderComponent();
+    assert.dom(DASHBOARD.vaultConfigurationCard.configDetailsField('tls')).hasText('Enabled');
+  });
+
+  test('it should show tls as enabled if only cert and key exist in config', async function (assert) {
+    delete this.data.listeners[0].config.tls_disable;
+    this.data.listeners[0].config.tls_cert_file = './cert.pem';
+    this.data.listeners[0].config.tls_key_file = './key.pem';
+
+    await this.renderComponent();
+    assert.dom(DASHBOARD.vaultConfigurationCard.configDetailsField('tls')).hasText('Enabled');
+  });
+
+  test('it should show tls as disabled if there is no tls information in the config', async function (assert) {
+    this.data.listeners = [];
+    await this.renderComponent();
+    assert.dom(DASHBOARD.vaultConfigurationCard.configDetailsField('tls')).hasText('Disabled');
+  });
+});
diff --git a/ui/tests/integration/components/database-role-edit-test.js b/ui/tests/integration/components/database-role-edit-test.js
index 15cfe3c74d5..83961ce02bc 100644
--- a/ui/tests/integration/components/database-role-edit-test.js
+++ b/ui/tests/integration/components/database-role-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,17 +9,22 @@ import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { capabilitiesStub } from 'vault/tests/helpers/stubs';
+import { click, fillIn } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | database-role-edit', function (hooks) {
   setupRenderingTest(hooks);
   setupMirage(hooks);
 
   hooks.beforeEach(function () {
+    this.version = this.owner.lookup('service:version');
     this.store = this.owner.lookup('service:store');
     this.store.pushPayload('database-role', {
       modelName: 'database/role',
       database: ['my-mongodb-database'],
       backend: 'database',
+      username: 'staticTestUser',
+      skip_import_rotation: false,
       type: 'static',
       name: 'my-static-role',
       id: 'my-static-role',
@@ -32,19 +37,117 @@ module('Integration | Component | database-role-edit', function (hooks) {
       name: 'my-dynamic-role',
       id: 'my-dynamic-role',
     });
+    this.store.pushPayload('database-role', {
+      modelName: 'database/role',
+      database: ['my-mongodb-database'],
+      id: 'test-role',
+      type: 'static',
+      name: 'test-role',
+    });
     this.modelStatic = this.store.peekRecord('database/role', 'my-static-role');
     this.modelDynamic = this.store.peekRecord('database/role', 'my-dynamic-role');
+    this.modelEmpty = this.store.peekRecord('database/role', 'test-role');
+  });
+
+  test('it should display form errors when trying to create a role without required fields', async function (assert) {
+    this.server.post('/sys/capabilities-self', capabilitiesStub('database/static-creds/my-role', ['create']));
+
+    await render(hbs`<DatabaseRoleEdit @model={{this.modelEmpty}} @mode="create"/>`);
+    await click(GENERAL.submitButton);
+
+    assert.dom('[data-test-inline-error-message]').exists('Inline form errors exist');
+  });
+
+  test('it should let user edit a static role when given update capability', async function (assert) {
+    this.server.post('/sys/capabilities-self', capabilitiesStub('database/static-creds/my-role', ['update']));
+
+    this.server.post(`/database/static-roles/my-static-role`, (schema, req) => {
+      assert.true(true, 'request made to update static role');
+      assert.propEqual(
+        JSON.parse(req.requestBody),
+        {
+          username: 'staticTestUser',
+          rotation_period: '1728000s', // 20 days in seconds
+        },
+        'it updates static role with correct payload'
+      );
+    });
+
+    await render(hbs`<DatabaseRoleEdit @model={{this.modelStatic}} @mode="edit"/>`);
+    await fillIn('[data-test-ttl-value="Rotation period"]', '20');
+    await click(GENERAL.submitButton);
+  });
+
+  test('enterprise: it should successfully create user that does not rotate immediately', async function (assert) {
+    this.version.type = 'enterprise';
+    this.server.post('/sys/capabilities-self', capabilitiesStub('database/static-creds/my-role', ['create']));
+    this.server.post(`/database/static-roles/my-static-role`, (schema, req) => {
+      assert.true(true, 'request made to create static role');
+      assert.propEqual(
+        JSON.parse(req.requestBody),
+        {
+          path: 'static-roles',
+          username: 'staticTestUser',
+          password: 'testPassword',
+          rotation_period: '172800s', // 2 days in seconds
+          skip_import_rotation: true,
+        },
+        'it creates a static role with correct payload'
+      );
+    });
+
+    await render(hbs`<DatabaseRoleEdit @model={{this.modelStatic}} @mode="create"/>`);
+    await fillIn(GENERAL.ttl.input('Rotation period'), '2');
+    await click(GENERAL.toggleInput('toggle-skip_import_rotation'));
+    await fillIn(GENERAL.inputByAttr('password'), 'testPassword'); // fill in password field
+
+    await click(GENERAL.submitButton);
+
+    await render(hbs`<DatabaseRoleEdit @model={{this.modelStatic}} @mode="show"/>`);
+    assert.dom(GENERAL.infoRowValue('Rotate immediately')).containsText('No');
+    assert.dom(GENERAL.infoRowValue('password')).doesNotExist(); // verify password field doesn't show on details view
+  });
+
+  test('enterprise: it should show edit button for password when role has not been rotated', async function (assert) {
+    this.version.type = 'enterprise';
+    this.server.post('/sys/capabilities-self', capabilitiesStub('database/static-creds/my-role', ['update']));
+
+    await render(hbs`<DatabaseRoleEdit @model={{this.modelStatic}} @mode="edit"/>`);
+    assert.dom(GENERAL.icon('edit')).exists(); // verify password field is enabled for edit & enable button is rendered bc role hasn't been rotated
+  });
+
+  test('enterprise: it should not show edit button for password when role has been rotated', async function (assert) {
+    this.version.type = 'enterprise';
+    this.server.post('/sys/capabilities-self', capabilitiesStub('database/static-creds/my-role', ['update']));
+
+    this.modelStatic.last_vault_rotation = '2025-04-21T12:51:59.063124-04:00'; // Setting a sample rotation time here to simulate what returns from BE after rotation
+    await render(hbs`<DatabaseRoleEdit @model={{this.modelStatic}} @mode="edit"/>`);
+    assert.dom(GENERAL.icon('edit')).doesNotExist(); // verify password field is disabled for edit & enable button isn't rendered bc role has already been rotated
+  });
+
+  test('enterprise: it should successfully create user that does rotate immediately & verify warning modal pops up', async function (assert) {
+    this.version.type = 'enterprise';
+    this.server.post('/sys/capabilities-self', capabilitiesStub('database/static-creds/my-role', ['create']));
+
+    await render(hbs`<DatabaseRoleEdit @model={{this.modelStatic}} @mode="create"/>`);
+    await click(GENERAL.submitButton);
+
+    assert.dom('[data-test-issuer-warning]').exists(); // check if warning modal shows after clicking save
+    await click('[data-test-issuer-save]'); // click continue button on modal
+
+    await render(hbs`<DatabaseRoleEdit @model={{this.modelStatic}} @mode="show"/>`);
+    assert.dom(GENERAL.infoRowValue('Rotate immediately')).containsText('Yes');
   });
 
   test('it should show Get credentials button when a user has the correct policy', async function (assert) {
     this.server.post('/sys/capabilities-self', capabilitiesStub('database/static-creds/my-role', ['read']));
     await render(hbs`<DatabaseRoleEdit @model={{this.modelStatic}} @mode="show"/>`);
-    assert.dom('[data-test-database-role-creds="static"]').exists('Get credentials button exists');
+    assert.dom(GENERAL.button('static')).exists('Get credentials button exists');
   });
 
   test('it should show Generate credentials button when a user has the correct policy', async function (assert) {
     this.server.post('/sys/capabilities-self', capabilitiesStub('database/creds/my-role', ['read']));
     await render(hbs`<DatabaseRoleEdit @model={{this.modelDynamic}} @mode="show"/>`);
-    assert.dom('[data-test-database-role-creds="dynamic"]').exists('Generate credentials button exists');
+    assert.dom(GENERAL.button('dynamic')).exists('Generate credentials button exists');
   });
 });
diff --git a/ui/tests/integration/components/database-role-setting-form-test.js b/ui/tests/integration/components/database-role-setting-form-test.js
index 0c64346c4b6..9ded81a9d24 100644
--- a/ui/tests/integration/components/database-role-setting-form-test.js
+++ b/ui/tests/integration/components/database-role-setting-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,59 +11,45 @@ import hbs from 'htmlbars-inline-precompile';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
 
 const testCases = [
-  {
-    // default case should show all possible fields for each type
-    pluginType: '',
-    staticRoleFields: ['name', 'username', 'rotation_period', 'rotation_statements'],
-    dynamicRoleFields: [
-      'name',
-      'default_ttl',
-      'max_ttl',
-      'creation_statements',
-      'revocation_statements',
-      'rollback_statements',
-      'renew_statements',
-    ],
-  },
   {
     pluginType: 'elasticsearch-database-plugin',
-    staticRoleFields: ['username', 'rotation_period'],
+    staticRoleFields: ['username', 'rotation_period', 'skip_import_rotation'],
     dynamicRoleFields: ['creation_statement', 'default_ttl', 'max_ttl'],
   },
   {
     pluginType: 'mongodb-database-plugin',
-    staticRoleFields: ['username', 'rotation_period'],
+    staticRoleFields: ['username', 'rotation_period', 'skip_import_rotation'],
     dynamicRoleFields: ['creation_statement', 'revocation_statement', 'default_ttl', 'max_ttl'],
     statementsHidden: true,
   },
   {
     pluginType: 'mssql-database-plugin',
-    staticRoleFields: ['username', 'rotation_period'],
+    staticRoleFields: ['username', 'rotation_period', 'skip_import_rotation'],
     dynamicRoleFields: ['creation_statements', 'revocation_statements', 'default_ttl', 'max_ttl'],
   },
   {
     pluginType: 'mysql-database-plugin',
-    staticRoleFields: ['username', 'rotation_period'],
+    staticRoleFields: ['username', 'rotation_period', 'skip_import_rotation'],
     dynamicRoleFields: ['creation_statements', 'revocation_statements', 'default_ttl', 'max_ttl'],
   },
   {
     pluginType: 'mysql-aurora-database-plugin',
-    staticRoleFields: ['username', 'rotation_period'],
+    staticRoleFields: ['username', 'rotation_period', 'skip_import_rotation'],
     dynamicRoleFields: ['creation_statements', 'revocation_statements', 'default_ttl', 'max_ttl'],
   },
   {
     pluginType: 'mysql-rds-database-plugin',
-    staticRoleFields: ['username', 'rotation_period'],
+    staticRoleFields: ['username', 'rotation_period', 'skip_import_rotation'],
     dynamicRoleFields: ['creation_statements', 'revocation_statements', 'default_ttl', 'max_ttl'],
   },
   {
     pluginType: 'mysql-legacy-database-plugin',
-    staticRoleFields: ['username', 'rotation_period'],
+    staticRoleFields: ['username', 'rotation_period', 'skip_import_rotation'],
     dynamicRoleFields: ['creation_statements', 'revocation_statements', 'default_ttl', 'max_ttl'],
   },
   {
     pluginType: 'vault-plugin-database-oracle',
-    staticRoleFields: ['username', 'rotation_period'],
+    staticRoleFields: ['username', 'rotation_period', 'skip_import_rotation'],
     dynamicRoleFields: ['creation_statements', 'revocation_statements', 'default_ttl', 'max_ttl'],
   },
 ];
@@ -73,6 +59,7 @@ const ALL_ATTRS = [
   { name: 'default_ttl', type: 'string', options: {} },
   { name: 'max_ttl', type: 'string', options: {} },
   { name: 'username', type: 'string', options: {} },
+  { name: 'skip_import_rotation', type: 'boolean', options: {} },
   { name: 'rotation_period', type: 'string', options: {} },
   { name: 'creation_statements', type: 'string', options: {} },
   { name: 'creation_statement', type: 'string', options: {} },
@@ -114,20 +101,19 @@ module('Integration | Component | database-role-setting-form', function (hooks)
 
   test('it shows appropriate fields based on roleType and db plugin', async function (assert) {
     this.set('roleType', 'static');
-    this.set('dbType', '');
+    this.set('dbParams', { plugin_name: '', skip_static_role_rotation_import: false });
     await render(hbs`
       <DatabaseRoleSettingForm
         @attrs={{this.model.attrs}}
         @model={{this.model}}
         @roleType={{this.roleType}}
-        @dbType={{this.dbType}}
+        @dbParams={{this.dbParams}}
       />
     `);
-    assert.dom('[data-test-component="empty-state"]').doesNotExist('Does not show empty states');
     for (const testCase of testCases) {
       const staticFields = getFields(testCase.staticRoleFields);
       const dynamicFields = getFields(testCase.dynamicRoleFields);
-      this.set('dbType', testCase.pluginType);
+      this.set('dbParams', { plugin_name: testCase.pluginType, skip_static_role_rotation_import: false });
       this.set('roleType', 'static');
       staticFields.show.forEach((attr) => {
         assert
diff --git a/ui/tests/integration/components/date-dropdown-test.js b/ui/tests/integration/components/date-dropdown-test.js
deleted file mode 100644
index 867282edb4e..00000000000
--- a/ui/tests/integration/components/date-dropdown-test.js
+++ /dev/null
@@ -1,168 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import sinon from 'sinon';
-import { setupRenderingTest } from 'ember-qunit';
-import { click, render } from '@ember/test-helpers';
-import { hbs } from 'ember-cli-htmlbars';
-import { ARRAY_OF_MONTHS } from 'core/utils/date-formatters';
-import timestamp from 'core/utils/timestamp';
-
-const SELECTORS = {
-  monthDropdown: '[data-test-toggle-month]',
-  specificMonth: (m) => `[data-test-dropdown-month="${m}"]`,
-  yearDropdown: '[data-test-toggle-year]',
-  specificYear: (y) => `[data-test-dropdown-year="${y}"]`,
-  submitButton: '[data-test-date-dropdown-submit]',
-  monthOptions: '[data-test-dropdown-month]',
-};
-
-module('Integration | Component | date-dropdown', function (hooks) {
-  setupRenderingTest(hooks);
-
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => new Date('2018-04-03T14:15:30'));
-  });
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
-
-  test('it renders dropdown', async function (assert) {
-    await render(hbs`
-      <div class="has-padding-l">
-        <DateDropdown/>
-      </div>
-    `);
-    assert.dom(SELECTORS.submitButton).hasText('Submit', 'button renders default text');
-  });
-
-  test('it renders dropdown and selects month and year', async function (assert) {
-    assert.expect(26);
-    const parentAction = (args) => {
-      assert.propEqual(
-        args,
-        {
-          dateType: 'start',
-          monthIdx: 1,
-          monthName: 'February',
-          year: 2016,
-        },
-        'sends correct args to parent'
-      );
-    };
-    this.set('parentAction', parentAction);
-
-    await render(hbs`
-    <div class="has-padding-l">
-    <DateDropdown
-      @handleSubmit={{this.parentAction}}
-      @dateType="start"
-    />
-    </div>
-    `);
-    assert.dom(SELECTORS.submitButton).isDisabled('button is disabled when no month or year selected');
-
-    await click(SELECTORS.monthDropdown);
-
-    assert.dom(SELECTORS.monthOptions).exists({ count: 12 }, 'dropdown has 12 months');
-    ARRAY_OF_MONTHS.forEach((month) => {
-      assert.dom(SELECTORS.specificMonth(month)).hasText(`${month}`, `dropdown includes ${month}`);
-    });
-
-    await click(SELECTORS.specificMonth('February'));
-    assert.dom(SELECTORS.monthDropdown).hasText('February', 'dropdown shows selected month');
-    assert.dom('.ember-basic-dropdown-content').doesNotExist('dropdown closes after selecting month');
-
-    await click(SELECTORS.yearDropdown);
-
-    assert.dom('[data-test-dropdown-year]').exists({ count: 5 }, 'dropdown has 5 years');
-    for (const year of [2018, 2017, 2016, 2015, 2014]) {
-      assert.dom(SELECTORS.specificYear(year)).exists();
-    }
-
-    await click('[data-test-dropdown-year="2016"]');
-    assert.dom(SELECTORS.yearDropdown).hasText(`2016`, `dropdown shows selected year`);
-    assert.dom('.ember-basic-dropdown-content').doesNotExist('dropdown closes after selecting year');
-    assert.dom(SELECTORS.submitButton).isNotDisabled('button enabled when month and year selected');
-
-    await click(SELECTORS.submitButton);
-  });
-
-  test('selecting month first: current year enabled when current month selected', async function (assert) {
-    assert.expect(5);
-    await render(hbs`
-    <div class="has-padding-l">
-      <DateDropdown/>
-    </div>
-    `);
-    // select current month
-    await click(SELECTORS.monthDropdown);
-    await click(SELECTORS.specificMonth('January'));
-    await click(SELECTORS.yearDropdown);
-    // all years should be selectable
-    for (const year of [2018, 2017, 2016, 2015, 2014]) {
-      assert.dom(SELECTORS.specificYear(year)).isNotDisabled(`year ${year} is selectable`);
-    }
-  });
-
-  test('selecting month first: it disables current year when future months selected', async function (assert) {
-    assert.expect(5);
-    await render(hbs`
-    <div class="has-padding-l">
-      <DateDropdown/>
-    </div>
-    `);
-
-    // select future month
-    await click(SELECTORS.monthDropdown);
-    await click(SELECTORS.specificMonth('June'));
-    await click(SELECTORS.yearDropdown);
-
-    assert.dom(SELECTORS.specificYear(2018)).isDisabled(`current year is disabled`);
-    // previous years should be selectable
-    for (const year of [2017, 2016, 2015, 2014]) {
-      assert.dom(SELECTORS.specificYear(year)).isNotDisabled(`year ${year} is selectable`);
-    }
-  });
-
-  test('selecting year first: it disables future months when current year selected', async function (assert) {
-    assert.expect(12);
-    await render(hbs`
-    <div class="has-padding-l">
-      <DateDropdown/>
-    </div>
-    `);
-    await click(SELECTORS.yearDropdown);
-    await click(SELECTORS.specificYear(2018));
-    await click(SELECTORS.monthDropdown);
-
-    const expectedSelectable = ['January', 'February', 'March', 'April'];
-    ARRAY_OF_MONTHS.forEach((month) => {
-      if (expectedSelectable.includes(month)) {
-        assert.dom(SELECTORS.specificMonth(month)).isNotDisabled(`${month} is selectable for current year`);
-      } else {
-        assert.dom(SELECTORS.specificMonth(month)).isDisabled(`${month} is disabled for current year`);
-      }
-    });
-  });
-
-  test('selecting year first: it enables all months when past year is selected', async function (assert) {
-    assert.expect(12);
-    await render(hbs`
-    <div class="has-padding-l">
-      <DateDropdown/>
-    </div>
-    `);
-
-    await click(SELECTORS.yearDropdown);
-    await click(SELECTORS.specificYear(2017));
-    await click(SELECTORS.monthDropdown);
-
-    ARRAY_OF_MONTHS.forEach((month) => {
-      assert.dom(SELECTORS.specificMonth(month)).isNotDisabled(`${month} is selectable for previous year`);
-    });
-  });
-});
diff --git a/ui/tests/integration/components/disabled-plugin-card-test.js b/ui/tests/integration/components/disabled-plugin-card-test.js
new file mode 100644
index 00000000000..882ca78c3d6
--- /dev/null
+++ b/ui/tests/integration/components/disabled-plugin-card-test.js
@@ -0,0 +1,114 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render, click, triggerKeyEvent } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+
+module('Integration | Component | disabled-plugin-card', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.handleDisabledPluginClick = sinon.spy();
+    this.handleDisabledPluginKeyDown = sinon.spy();
+    this.type = {
+      type: 'external-plugin',
+      displayName: 'External Plugin',
+      glyph: 'folder',
+    };
+  });
+
+  test('it renders disabled plugin card', async function (assert) {
+    await render(hbs`
+      <DisabledPluginCard 
+        @type={{this.type}} 
+        @handleDisabledPluginClick={{this.handleDisabledPluginClick}}
+        @handleDisabledPluginKeyDown={{this.handleDisabledPluginKeyDown}}
+      />
+    `);
+
+    assert.dom(GENERAL.cardContainer('external-plugin')).exists('renders disabled plugin card');
+    assert
+      .dom(`${GENERAL.cardContainer('external-plugin')} h3`)
+      .hasText('External Plugin', 'displays plugin name');
+    assert
+      .dom(`${GENERAL.cardContainer('external-plugin')} ${GENERAL.icon()}`)
+      .exists('displays plugin icon');
+    assert.dom(GENERAL.cardContainer('external-plugin')).exists('plugin card is rendered');
+  });
+
+  test('it handles click events', async function (assert) {
+    await render(hbs`
+      <DisabledPluginCard 
+        @type={{this.type}} 
+        @handleDisabledPluginClick={{this.handleDisabledPluginClick}}
+        @handleDisabledPluginKeyDown={{this.handleDisabledPluginKeyDown}}
+      />
+    `);
+
+    await click(GENERAL.cardContainer('external-plugin'));
+
+    assert.ok(this.handleDisabledPluginClick.calledOnce, 'calls handleDisabledPluginClick on click');
+    assert.ok(this.handleDisabledPluginClick.calledWith(this.type), 'passes correct plugin type');
+  });
+
+  test('it handles keyboard events', async function (assert) {
+    await render(hbs`
+      <DisabledPluginCard 
+        @type={{this.type}} 
+        @handleDisabledPluginClick={{this.handleDisabledPluginClick}}
+        @handleDisabledPluginKeyDown={{this.handleDisabledPluginKeyDown}}
+      />
+    `);
+
+    await triggerKeyEvent(GENERAL.cardContainer('external-plugin'), 'keydown', 'Enter');
+
+    assert.ok(this.handleDisabledPluginKeyDown.calledOnce, 'calls handleDisabledPluginKeyDown on keydown');
+    assert.ok(this.handleDisabledPluginKeyDown.calledWith(this.type), 'passes correct arguments');
+  });
+
+  test('it renders without icon when no glyph provided', async function (assert) {
+    this.type = {
+      type: 'no-icon-plugin',
+      displayName: 'No Icon Plugin',
+    };
+
+    await render(hbs`
+      <DisabledPluginCard 
+        @type={{this.type}} 
+        @handleDisabledPluginClick={{this.handleDisabledPluginClick}}
+        @handleDisabledPluginKeyDown={{this.handleDisabledPluginKeyDown}}
+      />
+    `);
+
+    assert.dom(GENERAL.icon()).doesNotExist('does not render icon when no glyph');
+    assert
+      .dom(GENERAL.cardContainer('no-icon-plugin'))
+      .hasText('No Icon Plugin', 'still displays plugin name');
+  });
+
+  test('it renders and displays plugin information correctly', async function (assert) {
+    await render(hbs`
+      <DisabledPluginCard 
+        @type={{this.type}} 
+        @handleDisabledPluginClick={{this.handleDisabledPluginClick}}
+        @handleDisabledPluginKeyDown={{this.handleDisabledPluginKeyDown}}
+      />
+    `);
+
+    // Test that the basic elements are rendered
+    assert.dom(GENERAL.cardContainer('external-plugin')).exists('renders disabled plugin card');
+
+    assert
+      .dom(`${GENERAL.cardContainer('external-plugin')} h3`)
+      .hasText('External Plugin', 'displays correct plugin name');
+
+    // Verify it's actually rendered as expected
+    assert.dom(GENERAL.cardContainer('external-plugin')).exists();
+  });
+});
diff --git a/ui/tests/integration/components/download-button-test.js b/ui/tests/integration/components/download-button-test.js
index e5f67ccf4cc..e689dd45a98 100644
--- a/ui/tests/integration/components/download-button-test.js
+++ b/ui/tests/integration/components/download-button-test.js
@@ -1,18 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { click, render, resetOnerror, setupOnerror } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 
-const SELECTORS = {
-  button: '[data-test-download-button]',
-  icon: '[data-test-icon="download"]',
-};
 module('Integration | Component | download button', function (hooks) {
   setupRenderingTest(hooks);
 
@@ -28,15 +25,15 @@ module('Integration | Component | download button', function (hooks) {
   test('it renders', async function (assert) {
     await render(hbs`
      <DownloadButton /> `);
-    assert.dom(SELECTORS.icon).exists('renders download icon');
-    assert.dom(SELECTORS.button).hasText('Download', 'renders default text');
+    assert.dom(GENERAL.icon('download')).exists('renders download icon');
+    assert.dom(GENERAL.button('Download')).hasText('Download', 'renders default text');
   });
 
   test('it renders passed args', async function (assert) {
     await render(hbs`
      <DownloadButton @text="I do something" @hideIcon={{true}} /> `);
-    assert.dom(SELECTORS.icon).doesNotExist('hides icon');
-    assert.dom(SELECTORS.button).hasText('I do something', 'renders passed text');
+    assert.dom(GENERAL.icon('download')).doesNotExist('hides icon');
+    assert.dom(GENERAL.button('Download')).hasText('I do something', 'renders passed text');
   });
 
   test('it downloads with defaults when only passed @data arg', async function (assert) {
@@ -45,7 +42,7 @@ module('Integration | Component | download button', function (hooks) {
     await render(hbs`
       <DownloadButton @data={{this.data}} />
     `);
-    await click(SELECTORS.button);
+    await click(GENERAL.button('Download'));
     const [filename, content, extension] = this.downloadSpy.getCall(0).args;
     assert.ok(filename.includes('Z'), 'filename defaults to ISO string');
     assert.strictEqual(content, this.data, 'called with correct data');
@@ -63,7 +60,7 @@ module('Integration | Component | download button', function (hooks) {
         @extension={{this.extension}}
       />
     `);
-    await click(SELECTORS.button);
+    await click(GENERAL.button('Download'));
     const [filename, content, extension] = this.downloadSpy.getCall(0).args;
     assert.ok(filename.includes(`${this.filename}-`), 'filename added to ISO string');
     assert.strictEqual(content, this.data, 'called with correct data');
@@ -77,7 +74,7 @@ module('Integration | Component | download button', function (hooks) {
       <DownloadButton @fetchData={{this.fetchData}} />
     `);
 
-    await click(SELECTORS.button);
+    await click(GENERAL.button('Download'));
     const [filename, content, extension] = this.downloadSpy.getCall(0).args;
     assert.ok(filename.includes('Z'), 'filename defaults to ISO string');
     assert.strictEqual(content, this.fetchData(), 'called with fetched data');
diff --git a/ui/tests/integration/components/edit-form-kmip-role-test.js b/ui/tests/integration/components/edit-form-kmip-role-test.js
deleted file mode 100644
index a949ca2e8c3..00000000000
--- a/ui/tests/integration/components/edit-form-kmip-role-test.js
+++ /dev/null
@@ -1,238 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { later, run, _cancelTimers as cancelTimers } from '@ember/runloop';
-import { resolve } from 'rsvp';
-import EmberObject, { computed } from '@ember/object';
-import Service from '@ember/service';
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { click, render, settled } from '@ember/test-helpers';
-import hbs from 'htmlbars-inline-precompile';
-import sinon from 'sinon';
-import { setupEngine } from 'ember-engines/test-support';
-import { COMPUTEDS } from 'vault/models/kmip/role';
-
-const flash = Service.extend({
-  success: sinon.stub(),
-});
-const namespace = Service.extend({});
-
-const fieldToCheckbox = (field) => ({ name: field, type: 'boolean' });
-
-const createModel = (options) => {
-  const model = EmberObject.extend(COMPUTEDS, {
-    /* eslint-disable ember/avoid-leaking-state-in-ember-objects */
-    newFields: [
-      'role',
-      'operationActivate',
-      'operationAddAttribute',
-      'operationAll',
-      'operationCreate',
-      'operationDestroy',
-      'operationDiscoverVersion',
-      'operationGet',
-      'operationGetAttributes',
-      'operationLocate',
-      'operationNone',
-      'operationRekey',
-      'operationRevoke',
-      'tlsClientKeyBits',
-      'tlsClientKeyType',
-      'tlsClientTtl',
-    ],
-    fields: computed('operationFields', function () {
-      return this.operationFields.map(fieldToCheckbox);
-    }),
-    destroyRecord() {
-      return resolve();
-    },
-    save() {
-      return resolve();
-    },
-    rollbackAttributes() {},
-  });
-  return model.create({
-    ...options,
-  });
-};
-
-module('Integration | Component | edit form kmip role', function (hooks) {
-  setupRenderingTest(hooks);
-  setupEngine(hooks, 'kmip');
-
-  hooks.beforeEach(function () {
-    this.context = { owner: this.engine }; // this.engine set by setupEngine
-    run(() => {
-      this.engine.unregister('service:flash-messages');
-      this.engine.register('service:flash-messages', flash);
-      this.engine.register('service:namespace', namespace);
-    });
-  });
-
-  test('it renders: new model', async function (assert) {
-    assert.expect(3);
-    const model = createModel({ isNew: true });
-    this.set('model', model);
-    this.onSave = ({ model }) => {
-      assert.false(model.operationNone, 'callback fires with operationNone as false');
-      assert.true(model.operationAll, 'callback fires with operationAll as true');
-    };
-    await render(hbs`<EditFormKmipRole @model={{this.model}} @onSave={{this.onSave}} />`, this.context);
-
-    assert.dom('[data-test-input="operationAll"]').isChecked('sets operationAll');
-    await click('[data-test-edit-form-submit]');
-  });
-
-  test('it renders: operationAll', async function (assert) {
-    assert.expect(3);
-    const model = createModel({ operationAll: true });
-    this.set('model', model);
-    this.onSave = ({ model }) => {
-      assert.false(model.operationNone, 'callback fires with operationNone as false');
-      assert.true(model.operationAll, 'callback fires with operationAll as true');
-    };
-    await render(hbs`<EditFormKmipRole @model={{this.model}} @onSave={{this.onSave}} />`, this.context);
-    assert.dom('[data-test-input="operationAll"]').isChecked('sets operationAll');
-    await click('[data-test-edit-form-submit]');
-  });
-
-  test('it renders: operationNone', async function (assert) {
-    assert.expect(2);
-    const model = createModel({ operationNone: true, operationAll: undefined });
-    this.set('model', model);
-
-    this.onSave = ({ model }) => {
-      assert.true(model.operationNone, 'callback fires with operationNone as true');
-    };
-    await render(hbs`<EditFormKmipRole @model={{this.model}} @onSave={{this.onSave}} />`, this.context);
-    assert.dom('[data-test-input="operationNone"]').isNotChecked('sets operationNone');
-    await click('[data-test-edit-form-submit]');
-  });
-
-  test('it renders: choose operations', async function (assert) {
-    assert.expect(3);
-    const model = createModel({ operationGet: true });
-    this.set('model', model);
-    this.onSave = ({ model }) => {
-      assert.false(model.operationNone, 'callback fires with operationNone as false');
-    };
-    await render(hbs`<EditFormKmipRole @model={{this.model}} @onSave={{this.onSave}} />`, this.context);
-
-    assert.dom('[data-test-input="operationNone"]').isChecked('sets operationNone');
-    assert.dom('[data-test-input="operationAll"]').isNotChecked('sets operationAll');
-    await click('[data-test-edit-form-submit]');
-  });
-
-  test('it saves operationNone=true when unchecking operationAll box', async function (assert) {
-    assert.expect(15);
-    const model = createModel({ isNew: true });
-    this.set('model', model);
-    this.onSave = ({ model }) => {
-      assert.true(model.operationNone, 'callback fires with operationNone as true');
-      assert.false(model.operationAll, 'callback fires with operationAll as false');
-    };
-
-    await render(hbs`<EditFormKmipRole @model={{this.model}} @onSave={{this.onSave}} />`, this.context);
-    await click('[data-test-input="operationAll"]');
-    for (const field of model.fields) {
-      const { name } = field;
-      if (name === 'operationNone') continue;
-      assert.dom(`[data-test-input="${name}"]`).isNotChecked(`${name} is unchecked`);
-    }
-
-    assert.dom('[data-test-input="operationAll"]').isNotChecked('sets operationAll');
-    assert
-      .dom('[data-test-input="operationNone"]')
-      .isChecked('operationNone toggle is true which means allow operations');
-    await click('[data-test-edit-form-submit]');
-  });
-
-  const savingTests = [
-    [
-      'setting operationAll',
-      { operationNone: true, operationGet: true },
-      'operationNone',
-      {
-        operationAll: true,
-        operationNone: false,
-        operationGet: true,
-      },
-      {
-        operationGet: null,
-        operationNone: false,
-      },
-      5,
-    ],
-    [
-      'setting operationNone',
-      { operationAll: true, operationCreate: true },
-      'operationNone',
-      {
-        operationAll: false,
-        operationNone: true,
-        operationCreate: true,
-      },
-      {
-        operationNone: true,
-        operationCreate: null,
-        operationAll: false,
-      },
-      6,
-    ],
-
-    [
-      'setting choose, and selecting an additional item',
-      { operationAll: true, operationGet: true, operationCreate: true },
-      'operationAll,operationDestroy',
-      {
-        operationAll: false,
-        operationCreate: true,
-        operationGet: true,
-      },
-      {
-        operationGet: true,
-        operationCreate: true,
-        operationDestroy: true,
-        operationAll: false,
-      },
-      7,
-    ],
-  ];
-  for (const testCase of savingTests) {
-    const [name, initialState, displayClicks, stateBeforeSave, stateAfterSave, assertionCount] = testCase;
-    test(name, async function (assert) {
-      assert.expect(assertionCount);
-      const model = createModel(initialState);
-      this.set('model', model);
-      const clickTargets = displayClicks.split(',');
-      await render(hbs`<EditFormKmipRole @model={{this.model}} />`, this.context);
-
-      for (const clickTarget of clickTargets) {
-        await click(`label[for=${clickTarget}]`);
-      }
-      for (const beforeStateKey of Object.keys(stateBeforeSave)) {
-        assert.strictEqual(
-          model.get(beforeStateKey),
-          stateBeforeSave[beforeStateKey],
-          `sets ${beforeStateKey}`
-        );
-      }
-
-      click('[data-test-edit-form-submit]');
-
-      later(() => cancelTimers(), 50);
-      return settled().then(() => {
-        for (const afterStateKey of Object.keys(stateAfterSave)) {
-          assert.strictEqual(
-            model.get(afterStateKey),
-            stateAfterSave[afterStateKey],
-            `sets ${afterStateKey} on save`
-          );
-        }
-      });
-    });
-  }
-});
diff --git a/ui/tests/integration/components/edit-form-test.js b/ui/tests/integration/components/edit-form-test.js
index ee4f9ebf726..49967895d6f 100644
--- a/ui/tests/integration/components/edit-form-test.js
+++ b/ui/tests/integration/components/edit-form-test.js
@@ -1,79 +1,53 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { later, run, _cancelTimers as cancelTimers } from '@ember/runloop';
-import { resolve } from 'rsvp';
 import EmberObject from '@ember/object';
-import Service from '@ember/service';
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, settled } from '@ember/test-helpers';
+import { click, render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
-import { create } from 'ember-cli-page-object';
-import editForm from 'vault/tests/pages/components/edit-form';
-
-const component = create(editForm);
-
-const flash = Service.extend({
-  success: sinon.stub(),
-});
-
-const createModel = (canDelete = true) => {
-  return EmberObject.create({
-    fields: [
-      { name: 'one', type: 'string' },
-      { name: 'two', type: 'boolean' },
-    ],
-    canDelete,
-    destroyRecord() {
-      return resolve();
-    },
-    save() {
-      return resolve();
-    },
-    rollbackAttributes() {},
-  });
-};
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | edit form', function (hooks) {
   setupRenderingTest(hooks);
 
   hooks.beforeEach(function () {
-    run(() => {
-      this.owner.unregister('service:flash-messages');
-      this.owner.register('service:flash-messages', flash);
+    this.model = EmberObject.create({
+      fields: [
+        { name: 'one', type: 'string' },
+        { name: 'two', type: 'boolean' },
+      ],
+      destroyRecord() {},
+      save() {},
+      rollbackAttributes() {},
     });
+    this.onSave = sinon.spy();
+    this.renderComponent = () =>
+      render(hbs`
+      <EditForm @model={{this.model}} @onSave={{this.onSave}} />
+    `);
   });
 
   test('it renders', async function (assert) {
-    this.set('model', createModel());
-    await render(hbs`{{edit-form model=this.model}}`);
-
-    assert.ok(component.fields.length, 2);
+    await this.renderComponent();
+    assert.dom(GENERAL.fieldByAttr('one')).exists();
+    assert.dom(GENERAL.fieldByAttr('two')).exists();
   });
 
   test('it calls flash message fns on save', async function (assert) {
     assert.expect(4);
-    const onSave = () => {
-      return resolve();
-    };
-    this.set('model', createModel());
-    this.set('onSave', onSave);
-    const saveSpy = sinon.spy(this, 'onSave');
-
-    await render(hbs`{{edit-form model=this.model onSave=this.onSave}}`);
-
-    component.submit();
-    later(() => cancelTimers(), 50);
-    return settled().then(() => {
-      assert.ok(saveSpy.calledOnce, 'calls passed onSave');
-      assert.strictEqual(saveSpy.getCall(0).args[0].saveType, 'save');
-      assert.deepEqual(saveSpy.getCall(0).args[0].model, this.model, 'passes model to onSave');
-      const flash = this.owner.lookup('service:flash-messages');
-      assert.strictEqual(flash.success.callCount, 1, 'calls flash message success');
-    });
+    const flash = this.owner.lookup('service:flash-messages');
+    this.flashSuccessSpy = sinon.spy(flash, 'success');
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    const { saveType, model } = this.onSave.lastCall.args[0];
+    const [flashMessage] = this.flashSuccessSpy.lastCall.args;
+    assert.strictEqual(flashMessage, 'Saved!');
+    assert.strictEqual(saveType, 'save');
+    assert.strictEqual(saveType, 'save');
+    assert.deepEqual(model, this.model, 'passes model to onSave');
   });
 });
diff --git a/ui/tests/integration/components/empty-state-test.js b/ui/tests/integration/components/empty-state-test.js
index d1eb75aaac8..546f80df399 100644
--- a/ui/tests/integration/components/empty-state-test.js
+++ b/ui/tests/integration/components/empty-state-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/enable-input-test.js b/ui/tests/integration/components/enable-input-test.js
index a27343b314d..357c6679d38 100644
--- a/ui/tests/integration/components/enable-input-test.js
+++ b/ui/tests/integration/components/enable-input-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/enable-replication-form-test.js b/ui/tests/integration/components/enable-replication-form-test.js
new file mode 100644
index 00000000000..7becefead9d
--- /dev/null
+++ b/ui/tests/integration/components/enable-replication-form-test.js
@@ -0,0 +1,306 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import sinon from 'sinon';
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupEngine } from 'ember-engines/test-support';
+import { render, fillIn, click, settled } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+const ENABLE_FORM = {
+  clusterMode: '[data-test-replication-cluster-mode-select]',
+  clusterAddr: '[data-test-input="primary_cluster_addr"]',
+  secondaryToken: '[data-test-textarea="secondary-token"]',
+  primaryAddr: '[data-test-input="primary_api_addr"]',
+  caFile: '[data-test-input="ca_file"]',
+  caPath: '[data-test-input="ca_path"]',
+  notAllowed: '[data-test-not-allowed]',
+  inlineMessage: '[data-test-inline-error-message]',
+  cannotEnable: '[data-test-disable-to-continue]',
+  cannotEnableExplanation: '[data-test-disable-explanation]',
+  error: '[data-test-message-error-description]',
+};
+module('Integration | Component | enable-replication-form', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+  setupEngine(hooks, 'replication');
+
+  hooks.beforeEach(function () {
+    this.context = { owner: this.engine };
+    this.version = this.owner.lookup('service:version');
+  });
+
+  ['performance', 'dr'].forEach((replicationMode) => {
+    test(`it renders correct form inputs when ${replicationMode} replication mode`, async function (assert) {
+      assert.expect(10);
+      this.version.features = ['Performance Replication', 'DR Replication'];
+      this.set('replicationMode', replicationMode);
+      await render(
+        hbs`<EnableReplicationForm
+      @replicationMode={{this.replicationMode}}
+      @canEnablePrimary={{true}}
+      @canEnableSecondary={{true}}
+      @performanceMode="disabled"
+    />`,
+        this.context
+      );
+
+      assert.dom(ENABLE_FORM.clusterMode).hasValue('primary');
+      ['clusterAddr'].forEach((field) => {
+        assert.dom(ENABLE_FORM[field]).hasNoValue();
+      });
+      assert.dom(GENERAL.submitButton).isNotDisabled();
+
+      await fillIn(ENABLE_FORM.clusterMode, 'secondary');
+      assert.dom(ENABLE_FORM.inlineMessage).hasText('This will immediately clear all data in this cluster!');
+      ['secondaryToken', 'primaryAddr', 'caFile', 'caPath'].forEach((field) => {
+        assert.dom(ENABLE_FORM[field]).hasNoValue();
+      });
+      assert.dom(GENERAL.submitButton).isDisabled();
+      await fillIn(ENABLE_FORM.secondaryToken, 'some-token');
+      await fillIn(ENABLE_FORM.primaryAddr, 'some-addr');
+      assert.dom(GENERAL.submitButton).isNotDisabled();
+    });
+    test(`it shows warning when capabilities restricted for ${replicationMode} replication mode`, async function (assert) {
+      assert.expect(10);
+      this.version.features = ['Performance Replication', 'DR Replication'];
+      this.set('replicationMode', replicationMode);
+      await render(
+        hbs`<EnableReplicationForm
+          @replicationMode={{this.replicationMode}}
+          @canEnablePrimary={{false}}
+          @canEnableSecondary={{false}}
+          @performanceMode="disabled"
+        />`,
+        this.context
+      );
+      assert.dom(ENABLE_FORM.clusterMode).hasValue('primary');
+      assert
+        .dom(ENABLE_FORM.notAllowed)
+        .hasText('The token you are using is not authorized to enable primary replication.');
+      ['clusterAddr'].forEach((field) => {
+        assert
+          .dom(ENABLE_FORM[field])
+          .doesNotExist(`${field}: field does not exist on primary form when not allowed`);
+      });
+      assert
+        .dom(GENERAL.submitButton)
+        .doesNotExist('on a primary the submit button does not exist when not allowed');
+
+      await fillIn(ENABLE_FORM.clusterMode, 'secondary');
+      assert
+        .dom(ENABLE_FORM.notAllowed)
+        .hasText('The token you are using is not authorized to enable secondary replication.');
+      ['secondaryToken', 'primaryAddr', 'caFile', 'caPath'].forEach((field) => {
+        assert.dom(ENABLE_FORM[field]).doesNotExist();
+      });
+      assert
+        .dom(GENERAL.submitButton)
+        .doesNotExist('on a secondary the submit button does not exist when not allowed');
+    });
+  });
+
+  test('enable DR when cluster is perf primary', async function (assert) {
+    this.version.features = ['Performance Replication', 'DR Replication'];
+    this.set('replicationMode', 'dr');
+    this.set('performanceMode', 'primary');
+    await render(
+      hbs`<EnableReplicationForm
+        @replicationMode={{this.replicationMode}}
+        @canEnablePrimary={{true}}
+        @canEnableSecondary={{true}}
+        @performanceMode={{this.performanceMode}}
+      />`,
+      this.context
+    );
+    assert.dom(ENABLE_FORM.clusterMode).hasValue('primary');
+    ['clusterAddr'].forEach((field) => {
+      assert.dom(ENABLE_FORM[field]).hasNoValue();
+    });
+    assert.dom(GENERAL.submitButton).isNotDisabled();
+
+    await fillIn(ENABLE_FORM.clusterMode, 'secondary');
+    assert
+      .dom(ENABLE_FORM.cannotEnable)
+      .hasText('Disable Performance Replication in order to enable this cluster as a DR secondary.');
+    await click(ENABLE_FORM.cannotEnable);
+    assert
+      .dom(ENABLE_FORM.cannotEnableExplanation)
+      .hasText(
+        "When running as a DR Secondary Vault is read only. For this reason, we don't allow other Replication modes to operate at the same time. This cluster is also currently operating as a Performance Primary."
+      );
+    assert.dom(GENERAL.submitButton).isDisabled();
+
+    this.set('performanceMode', 'secondary');
+    await settled();
+    assert
+      .dom(ENABLE_FORM.cannotEnableExplanation)
+      .hasText(
+        "When running as a DR Secondary Vault is read only. For this reason, we don't allow other Replication modes to operate at the same time. This cluster is also currently operating as a Performance Secondary."
+      );
+  });
+
+  module('only DR replication in features', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.features = ['DR Replication'];
+    });
+    test('attempting to enable performance replication', async function (assert) {
+      await render(
+        hbs`<EnableReplicationForm
+          @replicationMode="performance"
+          @canEnablePrimary={{true}}
+          @canEnableSecondary={{true}}
+          @performanceMode="disabled"
+        />`,
+        this.context
+      );
+      assert.dom(GENERAL.submitButton).isDisabled();
+    });
+  });
+
+  module('successful enable', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.features = ['Performance Replication', 'DR Replication'];
+      this.successSpy = sinon.spy();
+      this.set('onSuccess', this.successSpy);
+    });
+    ['dr', 'performance'].forEach((replicationMode) => {
+      test(`${replicationMode} primary`, async function (assert) {
+        assert.expect(4);
+        this.set('replicationMode', replicationMode);
+        this.server.post(`/sys/replication/${replicationMode}/primary/enable`, (_, req) => {
+          const body = JSON.parse(req.requestBody);
+          assert.deepEqual(body, {
+            primary_cluster_addr: 'some-addr',
+          });
+          return {
+            returned: 'value',
+          };
+        });
+        await render(
+          hbs`<EnableReplicationForm
+            @replicationMode={{this.replicationMode}}
+            @canEnablePrimary={{true}}
+            @canEnableSecondary={{true}}
+            @performanceMode="disabled"
+            @onSuccess={{this.onSuccess}}
+            @doTransition={{false}}
+          />`,
+          this.context
+        );
+        await fillIn(ENABLE_FORM.clusterAddr, 'some-addr');
+        await click(GENERAL.submitButton);
+        // after success
+        assert.dom(ENABLE_FORM.clusterAddr).hasNoValue();
+        assert.true(this.successSpy.calledOnce, 'called once');
+        assert.deepEqual(
+          this.successSpy.getCall(0).args,
+          [{ returned: 'value' }, replicationMode, 'primary', false],
+          'called with correct args'
+        );
+      });
+      test(`${replicationMode} secondary`, async function (assert) {
+        assert.expect(5);
+        this.set('replicationMode', replicationMode);
+        this.server.post(`/sys/replication/${replicationMode}/secondary/enable`, (_, req) => {
+          const body = JSON.parse(req.requestBody);
+          assert.deepEqual(
+            body,
+            {
+              primary_api_addr: 'http://127.0.0.1:8200',
+              token: 'some-token-value',
+            },
+            'does not include empty values'
+          );
+          return {
+            returned: 'value',
+          };
+        });
+        await render(
+          hbs`<EnableReplicationForm
+          @replicationMode={{this.replicationMode}}
+            @canEnablePrimary={{true}}
+            @canEnableSecondary={{true}}
+            @performanceMode="disabled"
+            @onSuccess={{this.onSuccess}}
+            @doTransition={{true}}
+          />`,
+          this.context
+        );
+        await fillIn(ENABLE_FORM.clusterMode, 'secondary');
+        await fillIn(ENABLE_FORM.secondaryToken, 'some-token-value');
+        await fillIn(ENABLE_FORM.primaryAddr, 'http://127.0.0.1:8200');
+        // Fill in then clear ca path
+        await fillIn(ENABLE_FORM.caPath, 'some-path');
+        await fillIn(ENABLE_FORM.caPath, '');
+        await click(GENERAL.submitButton);
+        // after success
+        assert.dom(ENABLE_FORM.secondaryToken).hasValue('');
+        assert.dom(ENABLE_FORM.primaryAddr).hasNoValue();
+        assert.true(this.successSpy.calledOnce, 'called once');
+        assert.deepEqual(
+          this.successSpy.getCall(0).args,
+          [{ returned: 'value' }, replicationMode, 'secondary', true],
+          'called with correct args'
+        );
+      });
+    });
+  });
+
+  module('shows API errors', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.features = ['Performance Replication', 'DR Replication'];
+      this.successSpy = sinon.spy();
+      this.set('onSuccess', this.successSpy);
+    });
+    ['dr', 'performance'].forEach((replicationMode) => {
+      test(`${replicationMode} primary`, async function (assert) {
+        this.set('replicationMode', replicationMode);
+        this.server.post(`/sys/replication/${replicationMode}/primary/enable`, overrideResponse(403));
+        await render(
+          hbs`<EnableReplicationForm
+            @replicationMode={{this.replicationMode}}
+            @canEnablePrimary={{true}}
+            @canEnableSecondary={{true}}
+            @performanceMode="disabled"
+            @onSuccess={{this.onSuccess}}
+          />`,
+          this.context
+        );
+        await fillIn(ENABLE_FORM.clusterAddr, 'some-addr');
+        await click(GENERAL.submitButton);
+        assert.dom(ENABLE_FORM.error).hasText('permission denied', 'shows error returned from API');
+        assert.dom(ENABLE_FORM.clusterAddr).hasValue('some-addr', 'does not clear form');
+        assert.false(this.successSpy.calledOnce, 'success spy not called');
+      });
+      test(`${replicationMode} secondary`, async function (assert) {
+        this.set('replicationMode', replicationMode);
+        this.server.post(`/sys/replication/${replicationMode}/secondary/enable`, overrideResponse(403));
+        await render(
+          hbs`<EnableReplicationForm
+          @replicationMode={{this.replicationMode}}
+            @canEnablePrimary={{true}}
+            @canEnableSecondary={{true}}
+            @performanceMode="disabled"
+            @onSuccess={{this.onSuccess}}
+          />`,
+          this.context
+        );
+        await fillIn(ENABLE_FORM.clusterMode, 'secondary');
+        await fillIn(ENABLE_FORM.secondaryToken, 'some-token-value');
+        await fillIn(ENABLE_FORM.primaryAddr, 'http://127.0.0.1:8200');
+        await click(GENERAL.submitButton);
+        // after error
+        assert.dom(ENABLE_FORM.error).hasText('permission denied', 'shows error returned from API');
+        assert.dom(ENABLE_FORM.secondaryToken).hasValue('some-token-value', 'does not clear form');
+        assert.false(this.successSpy.calledOnce, 'success spy not called');
+      });
+    });
+  });
+});
diff --git a/ui/tests/integration/components/enabled-plugin-card-test.js b/ui/tests/integration/components/enabled-plugin-card-test.js
new file mode 100644
index 00000000000..801505f2258
--- /dev/null
+++ b/ui/tests/integration/components/enabled-plugin-card-test.js
@@ -0,0 +1,197 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render, click, triggerKeyEvent } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | enabled-plugin-card', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.setMountType = sinon.spy();
+    this.type = {
+      type: 'kv',
+      displayName: 'KV',
+      glyph: 'key-values',
+    };
+    this.version = this.owner.lookup('service:version');
+  });
+
+  test('it renders basic plugin card', async function (assert) {
+    await render(hbs`
+      <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+    `);
+
+    assert.dom(GENERAL.cardContainer('kv')).exists('renders plugin card');
+    assert.dom(`${GENERAL.cardContainer('kv')} h3`).hasText('KV', 'displays plugin name');
+    assert.dom(`${GENERAL.cardContainer('kv')} [data-test-icon]`).exists('displays plugin icon');
+  });
+
+  test('it handles click to select plugin', async function (assert) {
+    await render(hbs`
+      <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+    `);
+
+    await click(GENERAL.cardContainer('kv'));
+
+    assert.ok(this.setMountType.calledOnce, 'calls setMountType on click');
+    assert.ok(this.setMountType.calledWith('kv'), 'passes correct plugin type');
+  });
+
+  test('it handles keyboard navigation', async function (assert) {
+    await render(hbs`
+      <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+    `);
+
+    await triggerKeyEvent(GENERAL.cardContainer('kv'), 'keydown', 'Enter');
+    assert.ok(this.setMountType.calledOnce, 'calls setMountType on Enter key');
+
+    this.setMountType.resetHistory();
+    await triggerKeyEvent(GENERAL.cardContainer('kv'), 'keydown', ' ');
+    assert.ok(this.setMountType.calledOnce, 'calls setMountType on Space key');
+
+    this.setMountType.resetHistory();
+    await triggerKeyEvent(GENERAL.cardContainer('kv'), 'keydown', 'Escape');
+    assert.notOk(this.setMountType.called, 'does not call setMountType on other keys');
+  });
+
+  module('enterprise features', function () {
+    test('it shows enterprise badge when required and not enterprise', async function (assert) {
+      this.type = {
+        ...this.type,
+        requiresEnterprise: true,
+      };
+      sinon.stub(this.version, 'isEnterprise').value(false);
+
+      await render(hbs`
+        <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+      `);
+
+      assert.dom(`${GENERAL.cardContainer('kv')} .hds-badge`).hasText('Enterprise', 'shows enterprise badge');
+      assert.dom(GENERAL.cardContainer('kv')).hasClass('disabled', 'adds disabled class');
+    });
+
+    test('it does not show enterprise badge when enterprise license present', async function (assert) {
+      this.type = {
+        ...this.type,
+        requiresEnterprise: true,
+      };
+      sinon.stub(this.version, 'isEnterprise').value(true);
+
+      await render(hbs`
+        <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+      `);
+
+      assert.dom(`${GENERAL.cardContainer('kv')} .hds-badge`).doesNotExist('does not show enterprise badge');
+      assert.dom(GENERAL.cardContainer('kv')).doesNotHaveClass('disabled', 'does not add disabled class');
+    });
+
+    test('it shows enterprise badge for required feature not available', async function (assert) {
+      this.type = {
+        ...this.type,
+        requiredFeature: 'Advanced Data Protection',
+      };
+      this.version.set('features', []);
+
+      await render(hbs`
+        <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+      `);
+
+      assert.dom(`${GENERAL.cardContainer('kv')} .hds-badge`).hasText('Enterprise', 'shows enterprise badge');
+      assert.dom(GENERAL.cardContainer('kv')).hasClass('disabled', 'adds disabled class');
+    });
+
+    test('it does not show enterprise badge when feature is available', async function (assert) {
+      this.type = {
+        ...this.type,
+        requiredFeature: 'Advanced Data Protection',
+      };
+      this.version.set('features', ['Advanced Data Protection']);
+
+      await render(hbs`
+        <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+      `);
+
+      assert.dom(`${GENERAL.cardContainer('kv')} .hds-badge`).doesNotExist('does not show enterprise badge');
+      assert.dom(GENERAL.cardContainer('kv')).doesNotHaveClass('disabled', 'does not add disabled class');
+    });
+
+    test('it does not call setMountType when disabled', async function (assert) {
+      this.type = {
+        ...this.type,
+        requiresEnterprise: true,
+      };
+      sinon.stub(this.version, 'isEnterprise').value(false);
+
+      await render(hbs`
+        <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+      `);
+
+      await click(GENERAL.cardContainer('kv'));
+      assert.notOk(this.setMountType.called, 'does not call setMountType when disabled');
+    });
+  });
+
+  module('deprecation status', function () {
+    test('it shows deprecation badge when deprecated', async function (assert) {
+      this.type = {
+        ...this.type,
+        deprecationStatus: 'deprecated',
+      };
+
+      await render(hbs`
+        <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+      `);
+
+      assert
+        .dom(`${GENERAL.cardContainer('kv')} .hds-badge`)
+        .hasText('Deprecated', 'shows deprecation badge');
+    });
+
+    test('it shows pending removal badge', async function (assert) {
+      this.type = {
+        ...this.type,
+        deprecationStatus: 'pending removal',
+      };
+
+      await render(hbs`
+        <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+      `);
+
+      assert
+        .dom(`${GENERAL.cardContainer('kv')} .hds-badge`)
+        .hasText('Pending removal', 'shows pending removal badge');
+    });
+
+    test('it does not show badge when supported', async function (assert) {
+      this.type = {
+        ...this.type,
+        deprecationStatus: 'supported',
+      };
+
+      await render(hbs`
+        <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+      `);
+
+      assert
+        .dom(`${GENERAL.cardContainer('kv')} .hds-badge`)
+        .doesNotExist('does not show badge for supported');
+    });
+
+    test('it does not show badge when no deprecation status', async function (assert) {
+      await render(hbs`
+        <EnabledPluginCard @type={{this.type}} @setMountType={{this.setMountType}} />
+      `);
+
+      assert
+        .dom(`${GENERAL.cardContainer('kv')} .hds-badge`)
+        .doesNotExist('does not show badge when no status');
+    });
+  });
+});
diff --git a/ui/tests/integration/components/features-selection-test.js b/ui/tests/integration/components/features-selection-test.js
deleted file mode 100644
index ca49cd68e95..00000000000
--- a/ui/tests/integration/components/features-selection-test.js
+++ /dev/null
@@ -1,58 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { render } from '@ember/test-helpers';
-import { create } from 'ember-cli-page-object';
-import featuresSelection from 'vault/tests/pages/components/wizard/features-selection';
-import hbs from 'htmlbars-inline-precompile';
-import Service from '@ember/service';
-
-const component = create(featuresSelection);
-
-const permissionsService = Service.extend({
-  hasPermission(path) {
-    // This enables the Secrets and Authentication wizard items and disables the others.
-    const allowedPaths = ['sys/mounts/example', 'sys/auth', 'sys/auth/foo', 'sys/wrapping/wrap'];
-    if (allowedPaths.includes(path)) {
-      return true;
-    }
-    return false;
-  },
-});
-
-module('Integration | Component | features-selection', function (hooks) {
-  setupRenderingTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.owner.register('service:permissions', permissionsService);
-  });
-
-  test('it disables and enables wizard items according to user permissions', async function (assert) {
-    assert.expect(4);
-    const enabled = { Secrets: true, Authentication: true, Policies: false, Tools: false };
-    await render(hbs`<Wizard::FeaturesSelection/>`);
-
-    component.wizardItems.forEach((i) => {
-      assert.strictEqual(
-        i.hasDisabledTooltip,
-        !enabled[i.text],
-        'shows a tooltip only when the wizard item is not enabled'
-      );
-    });
-  });
-
-  test('it disables the start button if no wizard items are checked', async function (assert) {
-    await render(hbs`<Wizard::FeaturesSelection/>`);
-    assert.true(component.hasDisabledStartButton);
-  });
-
-  test('it enables the start button when user has permission and wizard items are checked', async function (assert) {
-    await render(hbs`<Wizard::FeaturesSelection/>`);
-    await component.selectSecrets();
-    assert.false(component.hasDisabledStartButton);
-  });
-});
diff --git a/ui/tests/integration/components/filter-input-explicit-test.js b/ui/tests/integration/components/filter-input-explicit-test.js
new file mode 100644
index 00000000000..bb4767a4009
--- /dev/null
+++ b/ui/tests/integration/components/filter-input-explicit-test.js
@@ -0,0 +1,61 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render, typeIn, click } from '@ember/test-helpers';
+import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+
+const handler = (e) => {
+  // required because filter-input-explicit passes handleSearch on form submit
+  if (e && e.preventDefault) e.preventDefault();
+  return;
+};
+
+module('Integration | Component | filter-input-explicit', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.handleSearch = sinon.spy(handler);
+    this.handleInput = sinon.spy();
+    this.handleKeyDown = sinon.spy();
+    this.query = '';
+    this.placeholder = 'Filter roles';
+
+    this.renderComponent = () => {
+      return render(
+        hbs`<FilterInputExplicit aria-label="test-component" @placeholder={{this.placeholder}} @query={{this.query}} @handleSearch={{this.handleSearch}} @handleInput={{this.handleInput}} @handleKeyDown={{this.handleKeyDown}} />`
+      );
+    };
+  });
+
+  test('it renders', async function (assert) {
+    this.query = 'foo';
+    await this.renderComponent();
+
+    assert
+      .dom(GENERAL.filterInputExplicit)
+      .hasAttribute('placeholder', 'Filter roles', 'Placeholder passed to input element');
+    assert.dom(GENERAL.filterInputExplicit).hasValue('foo', 'Value passed to input element');
+  });
+
+  test('it should call handleSearch on submit', async function (assert) {
+    await this.renderComponent();
+    await typeIn(GENERAL.filterInputExplicit, 'bar');
+    await click(GENERAL.button('Search'));
+    assert.ok(this.handleSearch.calledOnce, 'handleSearch was called once');
+  });
+
+  test('it should send keydown event on keydown', async function (assert) {
+    await this.renderComponent();
+    await typeIn(GENERAL.filterInputExplicit, 'a');
+    await typeIn(GENERAL.filterInputExplicit, 'b');
+
+    assert.ok(this.handleKeyDown.calledTwice, 'handle keydown was called twice');
+    assert.ok(this.handleSearch.notCalled, 'handleSearch was not called on a keydown event');
+  });
+});
diff --git a/ui/tests/integration/components/filter-input-test.js b/ui/tests/integration/components/filter-input-test.js
index 1760e9c8ba6..2614a9dc06c 100644
--- a/ui/tests/integration/components/filter-input-test.js
+++ b/ui/tests/integration/components/filter-input-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,7 +17,7 @@ module('Integration | Component | filter-input', function (hooks) {
     this.onClick = () => assert.ok(true, 'on click modifier passed to input element');
 
     await render(
-      hbs`<FilterInput aria-label="test-component" placeholder="Filter roles" value="foo" {{on "click" this.onClick}} />`
+      hbs`<FilterInput aria-label="test-component" placeholder="Filter roles" @value="foo" {{on "click" this.onClick}} />`
     );
     await click('[data-test-filter-input]');
     assert
@@ -26,11 +26,6 @@ module('Integration | Component | filter-input', function (hooks) {
     assert.dom('[data-test-filter-input]').hasValue('foo', 'Value passed to input element');
   });
 
-  test('it should focus input on insert', async function (assert) {
-    await render(hbs`<FilterInput id="hello" aria-label="test-component" @autofocus={{true}} />`);
-    assert.dom('[data-test-filter-input]').isFocused('Input is focussed');
-  });
-
   test('it should send input event', async function (assert) {
     assert.expect(1);
 
@@ -41,20 +36,4 @@ module('Integration | Component | filter-input', function (hooks) {
     await render(hbs`<FilterInput aria-label="test-component" @wait={{0}} @onInput={{this.onInput}} />`);
     await fillIn('[data-test-filter-input]', 'foo');
   });
-
-  test('it should render icon', async function (assert) {
-    await render(hbs`<FilterInput aria-label="test-component" />`);
-    assert
-      .dom('[data-test-filter-input-container]')
-      .hasClass('has-icons-left', 'Icon class exists on container');
-    assert.dom('[data-test-filter-input-icon]').exists('Icon renders');
-  });
-
-  test('it should hide icon', async function (assert) {
-    await render(hbs`<FilterInput aria-label="test-component" @hideIcon={{true}} />`);
-    assert
-      .dom('[data-test-filter-input-container]')
-      .doesNotHaveClass('has-icons-left', 'Icon class does not exist on container');
-    assert.dom('[data-test-filter-input-icon]').doesNotExist('Icon is hidden');
-  });
 });
diff --git a/ui/tests/integration/components/flash-toast-test.js b/ui/tests/integration/components/flash-toast-test.js
index ee648f7d3f3..1df1552831f 100644
--- a/ui/tests/integration/components/flash-toast-test.js
+++ b/ui/tests/integration/components/flash-toast-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/form-error-test.js b/ui/tests/integration/components/form-error-test.js
deleted file mode 100644
index 69046aeab78..00000000000
--- a/ui/tests/integration/components/form-error-test.js
+++ /dev/null
@@ -1,31 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { render } from '@ember/test-helpers';
-import hbs from 'htmlbars-inline-precompile';
-
-module('Integration | Component | form-error', function (hooks) {
-  setupRenderingTest(hooks);
-
-  test('it renders', async function (assert) {
-    // Set any properties with this.set('myProperty', 'value');
-    // Handle any actions with this.set('myAction', function(val) { ... });
-
-    await render(hbs`{{form-error}}`);
-
-    assert.dom(this.element).hasText('');
-
-    // Template block usage:
-    await render(hbs`
-      <FormError>
-        template block text
-      </FormError>
-    `);
-
-    assert.dom(this.element).hasText('template block text');
-  });
-});
diff --git a/ui/tests/integration/components/form-field-label-test.js b/ui/tests/integration/components/form-field-label-test.js
index d254227ee92..7fde80e63d3 100644
--- a/ui/tests/integration/components/form-field-label-test.js
+++ b/ui/tests/integration/components/form-field-label-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,6 +8,7 @@ import { setupRenderingTest } from 'ember-qunit';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { click } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | form-field-label', function (hooks) {
   setupRenderingTest(hooks);
@@ -32,14 +33,14 @@ module('Integration | Component | form-field-label', function (hooks) {
 
     assert.dom('label').hasAttribute('for', 'some-input', 'Attributes passed to label element');
     assert.dom('label').hasText(this.label, 'Label text renders');
-    assert.dom('[data-test-help-text]').doesNotExist('Help text hidden when not provided');
+    assert.dom(GENERAL.tooltipText).doesNotExist('Help text hidden when not provided');
     assert.dom('.sub-text').doesNotExist('Sub text hidden when not provided');
     this.setProperties({
       helpText: 'More info',
       subText: 'Some description',
     });
-    await click('[data-test-tool-tip-trigger]');
-    assert.dom('[data-test-help-text]').hasText(this.helpText, 'Help text renders in tooltip');
+    await click(GENERAL.tooltip('form field label'));
+    assert.dom(GENERAL.tooltipText).hasText(this.helpText, 'Help text renders in tooltip');
     assert.dom('.sub-text').hasText(this.subText, 'Sub text renders');
     assert.dom('a').doesNotExist('docLink hidden when not provided');
     this.set('docLink', '/doc/path');
diff --git a/ui/tests/integration/components/form-field-test.js b/ui/tests/integration/components/form-field-test.js
index 6df822f7472..09503316197 100644
--- a/ui/tests/integration/components/form-field-test.js
+++ b/ui/tests/integration/components/form-field-test.js
@@ -1,18 +1,21 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import EmberObject from '@ember/object';
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, click, fillIn } from '@ember/test-helpers';
+import { render, click, fillIn, findAll, setupOnerror, waitFor } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { create } from 'ember-cli-page-object';
 import sinon from 'sinon';
 import formFields from '../../pages/components/form-field';
 import { format, startOfDay } from 'date-fns';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import codemirror, { getCodeEditorValue, setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import AuthMethodForm from 'vault/forms/auth/method';
 
 const component = create(formFields);
 
@@ -43,80 +46,132 @@ module('Integration | Component | form field', function (hooks) {
     this.attr = { name: 'foo' };
     this.model = model;
     await render(hbs`<FormField @attr={{this.attr}} @model={{this.model}} />`);
-    assert.strictEqual(component.fields.objectAt(0).labelText[0], 'Foo', 'renders a label');
+    assert.strictEqual(component.fields.objectAt(0).labelValue, 'Foo', 'renders a label');
     assert.notOk(component.hasInput, 'renders only the label');
   });
 
-  test('it renders: string', async function (assert) {
-    const [model, spy] = await setup.call(this, createAttr('foo', 'string', { defaultValue: 'default' }));
-    assert.strictEqual(component.fields.objectAt(0).labelText[0], 'Foo', 'renders a label');
-    assert.strictEqual(component.fields.objectAt(0).inputValue, 'default', 'renders default value');
-    assert.ok(component.hasInput, 'renders input for string');
-    await component.fields.objectAt(0).input('bar').change();
-
-    assert.strictEqual(model.get('foo'), 'bar');
-    assert.ok(spy.calledWith('foo', 'bar'), 'onChange called with correct args');
+  test('it throws an error when @attr does not include a "name" key', async function (assert) {
+    assert.expect(1);
+    this.model = EmberObject.create({});
+    this.attr = { options: { fieldValue: 'foo' } };
+    setupOnerror((error) => {
+      assert.strictEqual(
+        error.message,
+        'Assertion Failed: @name is required',
+        'throws assertion error when @attr does not include a "name" key'
+      );
+    });
+    await render(hbs`<FormField @attr={{this.attr}} @model={{this.model}} />`);
   });
 
-  test('it renders: boolean', async function (assert) {
-    const [model, spy] = await setup.call(this, createAttr('foo', 'boolean', { defaultValue: false }));
-    assert.strictEqual(component.fields.objectAt(0).labelText[0], 'Foo', 'renders a label');
-    assert.notOk(component.fields.objectAt(0).inputChecked, 'renders default value');
-    assert.ok(component.hasCheckbox, 'renders a checkbox for boolean');
-    await component.fields.objectAt(0).clickLabel();
-
-    assert.true(model.get('foo'));
-    assert.ok(spy.calledWith('foo', true), 'onChange called with correct args');
+  test('it throws an error when @model is not present', async function (assert) {
+    assert.expect(1);
+    this.attr = { name: 'foo' };
+    setupOnerror((error) => {
+      assert.strictEqual(
+        error.message,
+        'Assertion Failed: @model (or resource object being updated) is required',
+        'throws assertion error when @model arg does not exist'
+      );
+    });
+    await render(hbs`<FormField @attr={{this.attr}} />`);
   });
 
-  test('it renders: number', async function (assert) {
-    const [model, spy] = await setup.call(this, createAttr('foo', 'number', { defaultValue: 5 }));
-    assert.strictEqual(component.fields.objectAt(0).labelText[0], 'Foo', 'renders a label');
-    assert.strictEqual(component.fields.objectAt(0).inputValue, '5', 'renders default value');
-    assert.ok(component.hasInput, 'renders input for number');
-    await component.fields.objectAt(0).input(8).change();
+  test('it throws an error when "name" is "ID"', async function (assert) {
+    assert.expect(1);
+    this.model = EmberObject.create({});
+    this.attr = { name: 'id' };
+    setupOnerror((error) => {
+      assert.strictEqual(
+        error.message,
+        'Assertion Failed: Form is attempting to modify an ID. Ember-data does not allow this.',
+        'throws assertion error when component attempts to modify an ID'
+      );
+    });
+    await render(hbs`<FormField @attr={{this.attr}} @model={{this.model}} />`);
+  });
 
-    assert.strictEqual(model.get('foo'), '8');
-    assert.ok(spy.calledWith('foo', '8'), 'onChange called with correct args');
+  test('it throws an error when "fieldValue" is "ID"', async function (assert) {
+    assert.expect(1);
+    this.model = EmberObject.create({});
+    this.attr = { name: 'foo', options: { fieldValue: 'id' } };
+    setupOnerror((error) => {
+      assert.strictEqual(
+        error.message,
+        'Assertion Failed: Form is attempting to modify an ID. Ember-data does not allow this.',
+        'throws assertion error when component attempts to modify an ID'
+      );
+    });
+    await render(hbs`<FormField @attr={{this.attr}} @model={{this.model}} />`);
   });
 
+  // ------------------
+  // LEGACY FORM FIELDS
+  // ------------------
+
   test('it renders: object', async function (assert) {
-    // TODO: Fix JSONEditor/CodeMirror
-    setRunOptions({
-      rules: {
-        label: { enabled: false },
-      },
-    });
     await setup.call(this, createAttr('foo', 'object'));
-    assert.strictEqual(component.fields.objectAt(0).labelText[0], 'Foo', 'renders a label');
+    assert.dom('[data-test-component="json-editor-title"]').hasText('Foo', 'renders a label');
     assert.ok(component.hasJSONEditor, 'renders the json editor');
   });
 
-  test('it renders: string as json with clear button', async function (assert) {
-    // TODO: Fix JSONEditor/CodeMirror
-    setRunOptions({
-      rules: {
-        label: { enabled: false },
-      },
-    });
+  test('it renders: string as json with clear button and resets input', async function (assert) {
     await setup.call(this, createAttr('foo', 'string', { editType: 'json', allowReset: true }));
-    assert.strictEqual(component.fields.objectAt(0).labelText[0], 'Foo', 'renders a label');
+    assert.dom('[data-test-component="json-editor-title"]').hasText('Foo', 'renders a label');
     assert.ok(component.hasJSONEditor, 'renders the json editor');
     assert.ok(component.hasJSONClearButton, 'renders button that will clear the JSON value');
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    setCodeEditorValue(editor, 'some input');
+    await click('[data-test-json-clear-button]');
+    assert.strictEqual(getCodeEditorValue(editor), '', 'it clears the editor');
   });
 
-  test('it renders: editType textarea', async function (assert) {
+  test('it renders: toggleButton', async function (assert) {
     const [model, spy] = await setup.call(
       this,
-      createAttr('foo', 'string', { defaultValue: 'goodbye', editType: 'textarea' })
+      createAttr('foobar', 'boolean', {
+        defaultValue: false,
+        editType: 'toggleButton',
+        helperTextEnabled: 'Toggled on',
+        helperTextDisabled: 'Toggled off',
+      })
     );
-    assert.strictEqual(component.fields.objectAt(0).labelText[0], 'Foo', 'renders a label');
-    assert.ok(component.hasTextarea, 'renders a textarea');
-    assert.strictEqual(component.fields.objectAt(0).textareaValue, 'goodbye', 'renders default value');
-    await component.fields.objectAt(0).textarea('hello');
+    assert.dom(GENERAL.toggleInput('toggle-foobar')).exists('Toggle button exists');
+    assert.dom(GENERAL.toggleInput('toggle-foobar')).isNotChecked();
+    assert.dom('[data-test-toggle-subtext]').hasText('Toggled off');
+
+    await click(GENERAL.toggleInput('toggle-foobar'));
 
-    assert.strictEqual(model.get('foo'), 'hello');
-    assert.ok(spy.calledWith('foo', 'hello'), 'onChange called with correct args');
+    assert.true(model.get('foobar'));
+    assert.ok(spy.calledWith('foobar', true), 'onChange called with correct args');
+  });
+
+  test('it sets nested attribute value for toggleButton', async function (assert) {
+    this.setProperties({
+      attr: createAttr('config.foo', 'boolean', {
+        editType: 'toggleButton',
+        defaultValue: false,
+      }),
+      model: { config: { foo: true } },
+      onChange: () => {},
+    });
+    await render(hbs`<FormField @attr={{this.attr}} @model={{this.model}} @onChange={{this.onChange}} />`);
+    assert.dom(GENERAL.toggleInput('toggle-config.foo')).isChecked();
+  });
+
+  test('it sets nested attribute value for optionalText', async function (assert) {
+    this.setProperties({
+      attr: createAttr('foo.bar', 'string', {
+        editType: 'optionalText',
+        defaultValue: 'lemon',
+      }),
+      model: { foo: { bar: 'apple' } },
+      onChange: () => {},
+    });
+    await render(hbs`<FormField @attr={{this.attr}} @model={{this.model}} @onChange={{this.onChange}} />`);
+    assert.dom(GENERAL.toggleInput('show-foo.bar')).isChecked();
+    assert.dom(GENERAL.inputByAttr('foo.bar')).hasValue('apple');
   });
 
   test('it renders: editType file', async function (assert) {
@@ -130,88 +185,63 @@ module('Integration | Component | form field', function (hooks) {
         'renders subtext'
       );
     assert.dom('.hds-form-helper-text a').exists('renders doc link');
-    await click('[data-test-text-toggle]');
+    await click(GENERAL.textToggle);
     // assert again after toggling because subtext is rendered differently for each input
     assert
       .dom('.hds-form-helper-text')
       .hasText(`Enter the value as text. ${subText} See our documentation for help.`, 'renders subtext');
     assert.dom('.hds-form-helper-text a').exists('renders doc link');
-    await fillIn('[data-test-text-file-textarea]', 'hello world');
+    await fillIn(GENERAL.maskedInput, 'hello world');
   });
 
   test('it renders: editType ttl', async function (assert) {
-    const [model, spy] = await setup.call(this, createAttr('foo', null, { editType: 'ttl' }));
-    assert.ok(component.hasTTLPicker, 'renders the ttl-picker component');
-    await component.fields.objectAt(0).toggleTtl();
-    await component.fields.objectAt(0).select('h').change();
-    await component.fields.objectAt(0).ttlTime('3');
-    const expectedSeconds = `${3 * 3600}s`;
-    assert.strictEqual(model.get('foo'), expectedSeconds);
-    assert.ok(spy.calledWith('foo', expectedSeconds), 'onChange called with correct args');
-  });
-
-  test('it renders: editType ttl without toggle', async function (assert) {
     const [model, spy] = await setup.call(
       this,
-      createAttr('foo', null, { editType: 'ttl', hideToggle: true })
+      createAttr('foo', null, {
+        editType: 'ttl',
+        helperTextDisabled: 'TTL is disabled',
+        helperTextEnabled: 'TTL is enabled',
+      })
     );
+    assert.dom(GENERAL.toggleInput('Foo')).exists('renders the ttl-picker component');
+    assert.dom('[data-test-ttl-form-subtext]').hasText('TTL is disabled');
+    assert.dom('[data-test-ttl-toggle]').isNotChecked();
+    await click(GENERAL.toggleInput('Foo'));
     await component.fields.objectAt(0).select('h').change();
     await component.fields.objectAt(0).ttlTime('3');
     const expectedSeconds = `${3 * 3600}s`;
     assert.strictEqual(model.get('foo'), expectedSeconds);
     assert.ok(spy.calledWith('foo', expectedSeconds), 'onChange called with correct args');
+    await click(GENERAL.toggleInput('Foo'));
+    assert.ok(spy.calledWith('foo', '0'), 'onChange called with 0 when toggle off');
   });
 
-  test('it renders: radio buttons for possible values', async function (assert) {
-    const [model, spy] = await setup.call(
-      this,
-      createAttr('foo', null, { editType: 'radio', possibleValues: ['SHA1', 'SHA256'] })
-    );
-    assert.ok(component.hasRadio, 'renders radio buttons');
-    const selectedValue = 'SHA256';
-    await component.selectRadioInput(selectedValue);
-    assert.strictEqual(model.get('foo'), selectedValue);
-    assert.ok(spy.calledWith('foo', selectedValue), 'onChange called with correct args');
-  });
-  test('it renders: radio buttons for possible values, labels, and subtext', async function (assert) {
+  test('it renders: editType ttl with special settings', async function (assert) {
     const [model, spy] = await setup.call(
       this,
       createAttr('foo', null, {
-        editType: 'radio',
-        possibleValues: [
-          { label: 'Label 1', subText: 'Some subtext 1', value: 'SHA1' },
-          { label: 'Label 2', subText: 'Some subtext 2', value: 'SHA256' },
-          { subText: 'Some subtext 3', value: 'SHA256' },
-        ],
+        editType: 'ttl',
+        setDefault: '3600s',
+        ttlOffValue: '',
       })
     );
-    assert.ok(component.hasRadio, 'renders radio buttons');
-    const selectedValue = 'SHA256';
-    await component.selectRadioInput(selectedValue);
-    assert.dom('[data-test-radio-label="Label 1"]').hasTextContaining('Label 1');
-    assert.dom('[data-test-radio-label="Label 2"]').hasTextContaining('Label 2');
-    assert.dom('[data-test-radio-label="SHA256"]').hasTextContaining('SHA256');
-    assert.dom('[data-test-radio-subText="Some subtext 1"]').hasText('Some subtext 1');
-    assert.dom('[data-test-radio-subText="Some subtext 2"]').hasText('Some subtext 2');
-    assert.dom('[data-test-radio-subText="Some subtext 3"]').hasText('Some subtext 3');
-    assert.strictEqual(model.get('foo'), selectedValue);
-    assert.ok(spy.calledWith('foo', selectedValue), 'onChange called with correct args');
-  });
-  test('it renders: datetimelocal', async function (assert) {
-    const [model] = await setup.call(
+    assert.dom(GENERAL.toggleInput('Foo')).exists('renders the ttl-picker component');
+    assert.dom('[data-test-ttl-toggle]').isChecked();
+    await click(GENERAL.toggleInput('Foo'));
+    assert.strictEqual(model.get('foo'), '');
+    assert.ok(spy.calledWith('foo', ''), 'onChange called with correct args');
+  });
+
+  test('it renders: editType ttl without toggle', async function (assert) {
+    const [model, spy] = await setup.call(
       this,
-      createAttr('bar', null, {
-        editType: 'dateTimeLocal',
-      })
-    );
-    assert.dom("[data-test-input='bar']").exists();
-    await fillIn(
-      "[data-test-input='bar']",
-      format(startOfDay(new Date('2023-12-17T03:24:00')), "yyyy-MM-dd'T'HH:mm")
+      createAttr('foo', null, { editType: 'ttl', hideToggle: true })
     );
-    // add a click label to focus out the date we filled in above
-    await click('.is-label');
-    assert.deepEqual(model.get('bar'), '2023-12-17T00:00', 'sets the value on the model');
+    await component.fields.objectAt(0).select('h').change();
+    await component.fields.objectAt(0).ttlTime('3');
+    const expectedSeconds = `${3 * 3600}s`;
+    assert.strictEqual(model.get('foo'), expectedSeconds);
+    assert.ok(spy.calledWith('foo', expectedSeconds), 'onChange called with correct args');
   });
 
   test('it renders: editType stringArray', async function (assert) {
@@ -231,19 +261,20 @@ module('Integration | Component | form field', function (hooks) {
     assert.ok(spy.calledWith('password', 'secret'), 'onChange called with correct args');
   });
 
+  // --- common elements (legacy) ---
+
   test('it uses a passed label', async function (assert) {
     await setup.call(this, createAttr('foo', 'string', { label: 'Not Foo' }));
-    assert.strictEqual(
-      component.fields.objectAt(0).labelText[0],
-      'Not Foo',
-      'renders the label from options'
-    );
+    assert.strictEqual(component.fields.objectAt(0).labelValue, 'Not Foo', 'renders the label from options');
   });
 
   test('it renders a help tooltip', async function (assert) {
-    await setup.call(this, createAttr('foo', 'string', { helpText: 'Here is some help text' }));
-    await component.tooltipTrigger();
-    assert.ok(component.hasTooltip, 'renders the tooltip component');
+    await setup.call(
+      this,
+      createAttr('foo', 'string', { editType: 'stringArray', helpText: 'Here is some help text' })
+    );
+    await click(GENERAL.tooltip('string-list'));
+    assert.dom(GENERAL.tooltipText).exists('renders the tooltip component');
   });
 
   test('it should not expand and toggle ttl when default 0s value is present', async function (assert) {
@@ -257,7 +288,7 @@ module('Integration | Component | form field', function (hooks) {
 
     await render(hbs`<FormField @attr={{this.attr}} @model={{this.model}} @onChange={{this.onChange}} />`);
     assert
-      .dom('[data-test-toggle-input="Foo"]')
+      .dom(GENERAL.toggleInput('Foo'))
       .isNotChecked('Toggle is initially unchecked when given default value');
     assert.dom('[data-test-ttl-picker-group="Foo"]').doesNotExist('Ttl input is hidden');
   });
@@ -272,23 +303,1015 @@ module('Integration | Component | form field', function (hooks) {
     });
 
     await render(hbs`<FormField @attr={{this.attr}} @model={{this.model}} @onChange={{this.onChange}} />`);
-    assert.dom('[data-test-toggle-input="Foo"]').isChecked('Toggle is initially checked when given value');
+    assert.dom(GENERAL.toggleInput('Foo')).isChecked('Toggle is initially checked when given value');
     assert.dom('[data-test-ttl-value="Foo"]').hasValue('1', 'Ttl input displays with correct value');
   });
 
   test('it should show validation warning', async function (assert) {
-    const model = this.owner.lookup('service:store').createRecord('auth-method');
-    model.path = 'foo bar';
-    this.validations = model.validate().state;
+    this.model = new AuthMethodForm({ path: 'foo bar' });
+    this.attr = createAttr('path', 'string');
+    this.onChange = () => {};
+    this.validations = this.model.toJSON().state;
+
+    await render(
+      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @modelValidations={{this.validations}} @onChange={{this.onChange}} />`
+    );
+    assert.dom(GENERAL.validationWarningByAttr('path')).exists('Validation warning renders');
+  });
+
+  // ---------------
+  // HDS FORM FIELDS
+  // ---------------
+  // Note: some tests may be duplicative of the generic tests above
+  //
+
+  // ––––– editType === 'radio' / possibleValues –––––
+
+  test('it renders: editType=radio / possibleValues - as Hds::Form::Radio::Group', async function (assert) {
+    const possibleValues = ['foo', 'bar', 'baz'];
+    await setup.call(this, createAttr('myfield', '-', { editType: 'radio', possibleValues }));
+    const labels = findAll(`${GENERAL.inputGroupByAttr('myfield')} label`);
+    const inputs = findAll(`${GENERAL.inputGroupByAttr('myfield')} input[type="radio"]`);
+    assert
+      .dom('.field fieldset[class^="hds-form-group"] input[type="radio"].hds-form-radio')
+      .exists('renders as Hds::Form::Radio::Group');
+    assert.strictEqual(inputs.length, 3, 'renders a fieldset element with 3 radio elements');
+    possibleValues.forEach((possibleValue, index) => {
+      assert
+        .dom(labels[index])
+        .hasAttribute('id', `label-${possibleValue}`, 'label has correct id')
+        .hasText(possibleValue, 'label has correct text');
+      assert
+        .dom(inputs[index])
+        .hasAttribute('id', possibleValue, 'input[type="radio"] has correct `id` attribute')
+        .hasAttribute('name', 'myfield', 'input[type="radio"] has correct `name` attribute')
+        .hasAttribute('value', possibleValue, 'input[type="radio"] has correct `value` attribute')
+        .hasAttribute(
+          'data-test-radio',
+          possibleValue,
+          'input[type="radio"] has correct `data-test-radio` attribute'
+        );
+    });
+  });
+
+  test('it renders: editType=radio / possibleValues - horizontal layout (no `subText/helpText`)', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', '-', { editType: 'radio', possibleValues: ['foo', 'bar', 'baz'] })
+    );
+    assert
+      .dom('.field fieldset[class^="hds-form-group"].hds-form-group--layout-horizontal')
+      .exists('renders the Hds::Form::Radio::Group with an horizontal layout');
+  });
+
+  test('it renders: editType=radio / possibleValues - vertical layout (with `subText`)', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        editType: 'radio',
+        possibleValues: [{ value: 'foo', subText: 'Some subtext' }, { value: 'bar' }, { value: 'baz' }],
+      })
+    );
+    assert
+      .dom('.field fieldset[class^="hds-form-group"].hds-form-group--layout-vertical')
+      .exists('renders the Hds::Form::Radio::Group with a vertical layout');
+  });
+
+  test('it renders: editType=radio / possibleValues - vertical layout (with `helpText`)', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        editType: 'radio',
+        possibleValues: [{ value: 'foo', helpText: 'Some help text' }, { value: 'bar' }, { value: 'baz' }],
+      })
+    );
+    assert
+      .dom('.field fieldset[class^="hds-form-group"].hds-form-group--layout-vertical')
+      .exists('renders the Hds::Form::Radio::Group with a vertical layout');
+  });
+
+  test('it renders: editType=radio / possibleValues - with no selected radio', async function (assert) {
+    const possibleValues = ['foo', 'bar', 'baz'];
+    await setup.call(this, createAttr('myfield', '-', { editType: 'radio', possibleValues }));
+    possibleValues.forEach((possibleValue) => {
+      assert
+        .dom(GENERAL.radioByAttr(possibleValue))
+        .isNotChecked(`input[type="radio"] "${possibleValue}" is not checked`);
+    });
+  });
+
+  test('it renders: editType=radio / possibleValues - with selected value and changes it', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        editType: 'radio',
+        possibleValues: ['foo', 'bar', 'baz'],
+        defaultValue: 'baz',
+      })
+    );
+    assert.dom(GENERAL.radioByAttr('baz')).isChecked(`input[type="radio"] "baz" is checked`);
+    await click(GENERAL.radioByAttr('foo'));
+    assert.strictEqual(model.get('myfield'), 'foo');
+    assert.ok(spy.calledWith('myfield', 'foo'), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=radio / possibleValues - disabled inputs', async function (assert) {
+    const possibleValues = ['foo', 'bar', 'baz'];
+    await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        editType: 'radio',
+        editDisabled: true,
+        possibleValues: ['foo', 'bar', 'baz'],
+        defaultValue: 'baz',
+      })
+    );
+    const inputs = findAll(`${GENERAL.inputGroupByAttr('myfield')} input[type="radio"]`);
+    possibleValues.forEach((possibleValue, index) => {
+      assert.dom(inputs[index]).hasAttribute('disabled', '', 'input[type="radio"] has `disabled` attribute');
+    });
+  });
+
+  test('it renders: editType=radio / possibleValues - with `true/false` boolean values', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        editType: 'radio',
+        // we need to pass custom ID or the `true` value will not be assigned as `for` argument to the label
+        // see bug in HDS: https://github.com/hashicorp/design-system/pull/2863
+        // once the bug is fixed, we can change this to `possibleValues: [true, false],`
+        possibleValues: [
+          { value: true, id: 'true-option' },
+          { value: false, id: 'false-option' },
+        ],
+        defaultValue: true,
+      })
+    );
+    assert.dom(GENERAL.radioByAttr('true-option')).isChecked(`input[type="radio"] "true" is checked`);
+    await click(GENERAL.radioByAttr('false-option'));
+    // eslint-disable-next-line qunit/no-assert-equal-boolean
+    assert.strictEqual(model.get('myfield'), false);
+    assert.ok(spy.calledWith('myfield', false), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=radio / possibleValues - with passed custom id, label, subtext, help text for options and doc link, help text, subtext for field', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        docLink: '/docs',
+        editType: 'radio',
+        helpText: 'Some help text',
+        label: 'Radio group legend',
+        possibleValues: [
+          { value: 'foo', id: 'custom-id-1' },
+          { value: 'bar', label: 'Custom label 2', subText: 'Some subtext 2' },
+          { value: 'baz', label: 'Custom label 3', helpText: 'Some help text 3' },
+          { value: 'qux', label: 'Custom label 4', subText: 'Some subtext 4', helpText: 'Some help text 2' },
+        ],
+        subText: 'Some subtext',
+      })
+    );
+    assert.dom(GENERAL.fieldLabel()).hasText('Radio group legend', 'it renders attribute label as legend');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some subtext'))
+      .hasText(
+        'Some subtext See our documentation for help.',
+        'renders the right subtext string from options'
+      );
+    assert
+      .dom(`${GENERAL.helpTextByAttr('Some subtext')} ${GENERAL.docLinkByAttr('/docs')}`)
+      .exists('renders `docLink` option as as link inside the subtext');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some help text'))
+      .hasText('Some help text', 'renders the right help text string from options');
+
+    // first item should have custom ID, label `foo`, and no subText/helpText
+    assert
+      .dom(GENERAL.radioByAttr('custom-id-1'))
+      .hasAttribute('id', 'custom-id-1', 'renders the radio input with a custom `id` attribute');
+    assert.dom(GENERAL.labelByGroupControlIndex(1)).hasText('foo', 'renders default label from `foo` value');
+    assert
+      .dom(GENERAL.helpTextByGroupControlIndex(1))
+      .doesNotExist('does not render subtext/help text for `foo`');
+    // second item should have custom label and subText but no helpText
+    assert
+      .dom(GENERAL.labelByGroupControlIndex(2))
+      .hasText('Custom label 2', 'renders the custom label for `bar` from options');
+    assert
+      .dom(GENERAL.helpTextByGroupControlIndex(2))
+      .hasText('Some subtext 2', 'renders the right subtext string for `bar` from options');
+    // third item should have custom label and no subText/helpText (helpText is visible only if no subText is defined for any of the items)
+    assert
+      .dom(GENERAL.labelByGroupControlIndex(3))
+      .hasText('Custom label 3', 'renders the custom label for `baz` from options');
+    assert
+      .dom(GENERAL.helpTextByGroupControlIndex(3))
+      .doesNotExist('does not render the help text for `baz`');
+    // fourth item should have custom label and subText but no helpText (helpText is visible only if no subText is defined for any of the items)
+    assert
+      .dom(GENERAL.labelByGroupControlIndex(4))
+      .hasText('Custom label 4', 'renders the custom label for `qux` from options');
+    assert
+      .dom(GENERAL.helpTextByGroupControlIndex(4))
+      .exists({ count: 1 }, 'renders only the subtext for `qux` and not the help text')
+      .hasText('Some subtext 4', 'renders the right subtext string for `qux` from options');
+  });
+
+  // note: this test is not a duplicate of the one above, but is meant to test the condition
+  // where there is a `helpText` provided for one of the controls, but no `subText` for any of them
+  // in which case the template logic for the `HelperText` block of the inputs hits the `else` block
+  test('it renders: editType=radio / possibleValues - with passed helptext and subtext not defined', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        editType: 'radio',
+        possibleValues: [{ value: 'foo' }, { value: 'bar', helpText: 'Some helptext 2' }],
+      })
+    );
+    // first item should not have helpText
+    assert.dom(GENERAL.helpTextByGroupControlIndex(1)).doesNotExist('does not render helptext for `foo`');
+    // second item should have helpText
+    assert
+      .dom(GENERAL.helpTextByGroupControlIndex(2))
+      .hasText('Some helptext 2', 'renders the right helptext string for `bar` from options');
+  });
+
+  test('it renders: editType=radio / possibleValues - with validation errors and warnings', async function (assert) {
     this.setProperties({
-      model,
-      attr: createAttr('path', 'string'),
+      attr: createAttr('myfield', '-', { editType: 'radio', possibleValues: ['foo', 'bar', 'baz'] }),
+      model: { myfield: 'bar' },
+      modelValidations: {
+        myfield: {
+          isValid: false,
+          errors: ['Error message #1', 'Error message #2'],
+          warnings: ['Warning message #1', 'Warning message #2'],
+        },
+      },
       onChange: () => {},
     });
 
     await render(
-      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @modelValidations={{this.validations}} @onChange={{this.onChange}} />`
+      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @modelValidations={{this.modelValidations}} @onChange={{this.onChange}} />`
+    );
+    assert
+      .dom(GENERAL.validationErrorByAttr('myfield'))
+      .exists('Validation error renders')
+      .hasText('Error message #1 Error message #2', 'Validation errors are combined');
+    assert
+      .dom(GENERAL.validationWarningByAttr('myfield'))
+      .exists('Validation warning renders')
+      .hasText('Warning message #1 Warning message #2', 'Validation warnings are combined');
+  });
+
+  // ––––– editType === 'checkboxList' / possibleValues –––––
+
+  test('it renders: editType=checkboxList / possibleValues - as Hds::Form::Checkbox::Group', async function (assert) {
+    const possibleValues = ['foo', 'bar', 'baz'];
+    await setup.call(this, createAttr('myfield', '-', { editType: 'checkboxList', possibleValues }));
+    const labels = findAll(`${GENERAL.inputGroupByAttr('myfield')} label`);
+    const inputs = findAll(`${GENERAL.inputGroupByAttr('myfield')} input[type="checkbox"]`);
+    assert
+      .dom('.field [class^="hds-form-group"] input[type="checkbox"].hds-form-checkbox')
+      .exists('renders as Hds::Form::Checkbox::Group');
+    assert.strictEqual(inputs.length, 3, 'renders a fieldset element with 3 checkbox elements');
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the input group label');
+    possibleValues.forEach((possibleValue, index) => {
+      assert
+        .dom(labels[index])
+        .hasAttribute('id', `label-${possibleValue}`, 'label has correct id')
+        .hasText(possibleValue, 'label has correct text');
+      assert
+        .dom(inputs[index])
+        .hasAttribute('id', possibleValue, 'input[type="checkbox"] has correct `id` attribute')
+        .hasAttribute('name', 'myfield', 'input[type="checkbox"] has correct `name` attribute')
+        .hasAttribute('value', possibleValue, 'input[type="checkbox"] has correct `value` attribute')
+        .hasAttribute(
+          'data-test-checkbox',
+          possibleValue,
+          'input[type="checkbox"] has correct `data-test-checkbox` attribute'
+        );
+    });
+  });
+
+  test('it renders: editType=checkboxList / possibleValues - with no selected checkbox', async function (assert) {
+    const possibleValues = ['foo', 'bar', 'baz'];
+    await setup.call(this, createAttr('myfield', '-', { editType: 'checkboxList', possibleValues }));
+    possibleValues.forEach((possibleValue) => {
+      assert
+        .dom(GENERAL.checkboxByAttr(possibleValue))
+        .isNotChecked(`input[type="checkbox"] "${possibleValue}" is not checked`);
+    });
+  });
+
+  test('it renders: editType=checkboxList / possibleValues - with selected value and changes it', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        editType: 'checkboxList',
+        possibleValues: ['foo', 'bar', 'baz'],
+        defaultValue: ['baz'],
+      })
+    );
+    assert.dom(GENERAL.checkboxByAttr('baz')).isChecked('input[type="checkbox"] "baz" is checked');
+    // select the remaining items (they're appended to the model)
+    await click(GENERAL.checkboxByAttr('foo'));
+    await click(GENERAL.checkboxByAttr('bar'));
+    // notice: we can't use `strictEqual` here because they're different objects
+    assert.deepEqual(model.get('myfield'), ['baz', 'foo', 'bar']);
+    assert.ok(spy.calledWith('myfield', ['baz', 'foo', 'bar']), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=checkboxList / possibleValues - with passed label, subtext, help text, doclink', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        editType: 'checkboxList',
+        possibleValues: ['foo', 'bar', 'baz'],
+        label: 'Custom label',
+        subText: 'Some subtext',
+        helpText: 'Some help text',
+        docLink: '/docs',
+      })
+    );
+    assert.dom(GENERAL.fieldLabel()).hasText('Custom label', 'renders the custom label from options');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some subtext'))
+      .exists('renders `subText` option as HelperText')
+      .hasText(
+        'Some subtext See our documentation for help.',
+        'renders the right subtext string from options'
+      );
+    assert
+      .dom(`${GENERAL.helpTextByAttr('Some subtext')} ${GENERAL.docLinkByAttr('/docs')}`)
+      .exists('renders `docLink` option as as link inside the subtext');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some help text'))
+      .exists('renders `help text` option as HelperText')
+      .hasText('Some help text', 'renders the right help text string from options');
+  });
+
+  test('it renders: editType=checkboxList / possibleValues - with validation errors and warnings', async function (assert) {
+    this.setProperties({
+      attr: createAttr('myfield', '-', { editType: 'checkboxList', possibleValues: ['foo', 'bar', 'baz'] }),
+      model: { myfield: 'bar' },
+      modelValidations: {
+        myfield: {
+          isValid: false,
+          errors: ['Error message #1', 'Error message #2'],
+          warnings: ['Warning message #1', 'Warning message #2'],
+        },
+      },
+      onChange: () => {},
+    });
+
+    await render(
+      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @modelValidations={{this.modelValidations}} @onChange={{this.onChange}} />`
+    );
+    assert
+      .dom(GENERAL.validationErrorByAttr('myfield'))
+      .exists('Validation error renders')
+      .hasText('Error message #1 Error message #2', 'Validation errors are combined');
+    assert
+      .dom(GENERAL.validationWarningByAttr('myfield'))
+      .exists('Validation warning renders')
+      .hasText('Warning message #1 Warning message #2', 'Validation warnings are combined');
+  });
+
+  // ––––– editType === 'select' / possibleValues –––––
+
+  test('it renders: editType=select / possibleValues - as Hds::Form::Select', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', 'string', { editType: 'select', possibleValues: ['foo', 'bar', 'baz'] })
+    );
+    assert
+      .dom('.field [class^="hds-form-field"] select.hds-form-select')
+      .exists('renders as Hds::Form::Select');
+    assert
+      .dom('select')
+      .hasAttribute('id', 'myfield', 'select has correct `id` attribute')
+      .hasAttribute('name', 'myfield', 'select has correct `name` attribute')
+      .hasAttribute('data-test-input', 'myfield', 'select has correct `data-test-input` attribute');
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the select label');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('foo', 'has first option value');
+    await fillIn(GENERAL.inputByAttr('myfield'), 'bar');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('bar', 'has selected option value');
+    assert.strictEqual(model.get('myfield'), 'bar');
+    assert.ok(spy.calledWith('myfield', 'bar'), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=select / possibleValues - with no default', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', 'string', {
+        editType: 'select',
+        possibleValues: ['foo', 'bar', 'baz'],
+        noDefault: true,
+      })
+    );
+
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('', 'has no initial value');
+    await fillIn(GENERAL.inputByAttr('myfield'), 'foo');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('foo', 'has selected option value');
+    assert.strictEqual(model.get('myfield'), 'foo');
+    assert.ok(spy.calledWith('myfield', 'foo'), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=select / possibleValues - with selected value', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', 'string', {
+        editType: 'select',
+        possibleValues: ['foo', 'bar', 'baz'],
+        defaultValue: 'baz',
+      })
+    );
+
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('baz', 'has initial value selected');
+    await fillIn(GENERAL.inputByAttr('myfield'), 'foo');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('foo', 'has selected option value');
+    assert.strictEqual(model.get('myfield'), 'foo');
+    assert.ok(spy.calledWith('myfield', 'foo'), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=select / possibleValues - with passed label, subtext, help text, doclink', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', 'string', {
+        editType: 'select',
+        possibleValues: ['foo', 'bar', 'baz'],
+        label: 'Custom label',
+        subText: 'Some subtext',
+        helpText: 'Some help text',
+        docLink: '/docs',
+      })
+    );
+    assert.dom(GENERAL.fieldLabel()).hasText('Custom label', 'renders the custom label from options');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some subtext'))
+      .exists('renders `subText` option as HelperText')
+      .hasText(
+        'Some subtext See our documentation for help.',
+        'renders the right subtext string from options'
+      );
+    assert
+      .dom(`${GENERAL.helpTextByAttr('Some subtext')} ${GENERAL.docLinkByAttr('/docs')}`)
+      .exists('renders `docLink` option as as link inside the subtext');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some help text'))
+      .exists('renders `help text` option as HelperText')
+      .hasText('Some help text', 'renders the right help text string from options');
+  });
+
+  test('it renders: editType=select / possibleValues - with validation errors and warnings', async function (assert) {
+    this.setProperties({
+      attr: createAttr('myfield', 'string', { editType: 'select', possibleValues: ['foo', 'bar', 'baz'] }),
+      model: { myfield: 'bar' },
+      modelValidations: {
+        myfield: {
+          isValid: false,
+          errors: ['Error message #1', 'Error message #2'],
+          warnings: ['Warning message #1', 'Warning message #2'],
+        },
+      },
+      onChange: () => {},
+    });
+
+    await render(
+      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @modelValidations={{this.modelValidations}} @onChange={{this.onChange}} />`
+    );
+    assert
+      .dom(GENERAL.validationErrorByAttr('myfield'))
+      .exists('Validation error renders')
+      .hasText('Error message #1 Error message #2', 'Validation errors are combined');
+    assert
+      .dom(GENERAL.validationWarningByAttr('myfield'))
+      .exists('Validation warning renders')
+      .hasText('Warning message #1 Warning message #2', 'Validation warnings are combined');
+  });
+
+  // ––––– editType === 'datetime-local' –––––
+
+  test('it renders: editType=dateTimeLocal - as Hds::Form::TextInput [@type=datetime-local]', async function (assert) {
+    const dateTimeValue1 = format(startOfDay(new Date('2023-12-17T03:24:00')), "yyyy-MM-dd'T'HH:mm");
+    const dateTimeValue2 = format(startOfDay(new Date('2025-05-28T16:12:00')), "yyyy-MM-dd'T'HH:mm");
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', '-', { editType: 'dateTimeLocal', defaultValue: dateTimeValue1 })
+    );
+    assert
+      .dom('.field [class^="hds-form-field"] input[type="datetime-local"].hds-form-text-input')
+      .exists('renders as Hds::Form::TextInput["type=datetime-local"]');
+    assert
+      .dom(`input[type="datetime-local"]`)
+      .exists('renders input with type=datetime-local')
+      .hasAttribute(
+        'data-test-input',
+        'myfield',
+        'input[type="datetime-local"] has correct `data-test-input` attribute'
+      );
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the input label');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('2023-12-17T00:00', 'renders default value');
+    await fillIn(GENERAL.inputByAttr('myfield'), dateTimeValue2);
+    // add a click label to focus out the date we filled in above
+    await click(GENERAL.fieldLabel());
+    assert.strictEqual(model.get('myfield'), dateTimeValue2, 'sets the value on the model');
+    assert.true(spy.calledWith('myfield', dateTimeValue2), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=dateTimeLocal - with passed label, subtext, helptext, doclink', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        editType: 'dateTimeLocal',
+        label: 'Custom label',
+        subText: 'Some subtext',
+        helpText: 'Some helptext',
+        docLink: '/docs',
+      })
+    );
+    assert.dom(GENERAL.fieldLabel()).hasText('Custom label', 'renders the custom label from options');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some subtext'))
+      .exists('renders `subText` option as HelperText')
+      .hasText(
+        'Some subtext See our documentation for help.',
+        'renders the right subtext string from options'
+      );
+    assert
+      .dom(`${GENERAL.helpTextByAttr('Some subtext')} ${GENERAL.docLinkByAttr('/docs')}`)
+      .exists('renders `docLink` option as as link inside the subtext');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some helptext'))
+      .exists('renders `helptext` option as HelperText')
+      .hasText('Some helptext', 'renders the right help text string from options');
+  });
+
+  test('it renders: editType=dateTimeLocal - with validation errors and warnings', async function (assert) {
+    this.setProperties({
+      attr: createAttr('myfield', '-', { editType: 'dateTimeLocal' }),
+      model: { myfield: '2023-12-17T00:00' },
+      modelValidations: {
+        myfield: {
+          isValid: false,
+          errors: ['Error message #1', 'Error message #2'],
+          warnings: ['Warning message #1', 'Warning message #2'],
+        },
+      },
+      onChange: () => {},
+    });
+
+    await render(
+      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @modelValidations={{this.modelValidations}} @onChange={{this.onChange}} />`
+    );
+    assert
+      .dom(GENERAL.validationErrorByAttr('myfield'))
+      .exists('Validation error renders')
+      .hasText('Error message #1 Error message #2', 'Validation errors are combined');
+    assert
+      .dom(GENERAL.validationWarningByAttr('myfield'))
+      .exists('Validation warning renders')
+      .hasText('Warning message #1 Warning message #2', 'Validation warnings are combined');
+  });
+
+  // ––––– editType === 'password' –––––
+
+  test('it renders: editType=password / type=string - as Hds::Form::TextInput [@type=password]', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', 'string', { editType: 'password', defaultValue: 'default' })
+    );
+    assert
+      .dom('.field [class^="hds-form-field"] input.hds-form-text-input')
+      .exists('renders as Hds::Form::TextInput');
+    assert
+      .dom(`input[type="password"]`)
+      .exists('renders input with type=password')
+      .hasAttribute('name', 'myfield', 'input[type="password"] has correct `id` attribute')
+      .doesNotHaveAttribute(
+        'placeholder',
+        'input[type="password"] does not have `placeholder` attribute by default'
+      )
+      .hasAttribute(
+        'autocomplete',
+        'new-password',
+        'input[type="password"] has correct `autocomplete` attribute'
+      )
+      .hasAttribute('spellcheck', 'false', 'input[type="password"] has correct `spellcheck` attribute')
+      .hasAttribute(
+        'data-test-input',
+        'myfield',
+        'input[type="password"] has correct `data-test-input` attribute'
+      );
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the input label');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('default', 'renders default value');
+    await fillIn(GENERAL.inputByAttr('myfield'), 'bar');
+    assert.strictEqual(model.get('myfield'), 'bar');
+    assert.ok(spy.calledWith('myfield', 'bar'), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=password / type=number - as Hds::Form::TextInput [@type=password]', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', 'number', { editType: 'password', defaultValue: 123 })
+    );
+    assert
+      .dom('.field [class^="hds-form-field"] input.hds-form-text-input')
+      .exists('renders as Hds::Form::TextInput');
+    assert
+      .dom(`input${GENERAL.inputByAttr('myfield')}[type="password"]`)
+      .exists('renders input with type=password');
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the input label');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('123', 'renders default value');
+    await fillIn(GENERAL.inputByAttr('myfield'), 987);
+    assert.strictEqual(model.get('myfield'), '987');
+    assert.ok(spy.calledWith('myfield', '987'), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=password / type=string - with passed label, placeholder, subtext, help text, doclink', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', 'string', {
+        editType: 'password',
+        placeholder: 'Custom placeholder',
+        label: 'Custom label',
+        subText: 'Some subtext',
+        helpText: 'Some help text',
+        docLink: '/docs',
+      })
+    );
+    assert.dom(GENERAL.fieldLabel()).hasText('Custom label', 'renders the custom label from options');
+    assert
+      .dom(GENERAL.inputByAttr('myfield'))
+      .hasAttribute('placeholder', 'Custom placeholder', 'renders the placeholder from options');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some subtext'))
+      .exists('renders `subText` option as HelperText')
+      .hasText(
+        'Some subtext See our documentation for help.',
+        'renders the right subtext string from options'
+      );
+    assert
+      .dom(`${GENERAL.helpTextByAttr('Some subtext')} ${GENERAL.docLinkByAttr('/docs')}`)
+      .exists('renders `docLink` option as as link inside the subtext');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some help text'))
+      .exists('renders `help text` option as HelperText')
+      .hasText('Some help text', 'renders the right help text string from options');
+  });
+
+  test('it renders: editType=password / type=string - with validation errors and warnings', async function (assert) {
+    this.setProperties({
+      attr: createAttr('myfield', 'string', { editType: 'password' }),
+      model: { myfield: 'bar' },
+      modelValidations: {
+        myfield: {
+          isValid: false,
+          errors: ['Error message #1', 'Error message #2'],
+          warnings: ['Warning message #1', 'Warning message #2'],
+        },
+      },
+      onChange: () => {},
+    });
+
+    await render(
+      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @modelValidations={{this.modelValidations}} @onChange={{this.onChange}} />`
+    );
+    assert
+      .dom(GENERAL.validationErrorByAttr('myfield'))
+      .exists('Validation error renders')
+      .hasText('Error message #1 Error message #2', 'Validation errors are combined');
+    assert
+      .dom(GENERAL.validationWarningByAttr('myfield'))
+      .exists('Validation warning renders')
+      .hasText('Warning message #1 Warning message #2', 'Validation warnings are combined');
+  });
+
+  // ––––– editType === 'textarea' –––––
+
+  test('it renders: editType=textarea / type=string - as Hds::Form::Textarea', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', 'string', { editType: 'textarea', defaultValue: 'default' })
+    );
+    assert
+      .dom('.field [class^="hds-form-field"] textarea.hds-form-textarea')
+      .exists('renders as Hds::Form::Textarea');
+    assert
+      .dom(`textarea`)
+      .exists('renders textarea')
+      .hasAttribute('data-test-input', 'myfield', 'textarea has correct `data-test-input` attribute');
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the input label');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('default', 'renders default value');
+    await fillIn(GENERAL.inputByAttr('myfield'), 'bar');
+    assert.strictEqual(model.get('myfield'), 'bar');
+    assert.true(spy.calledWith('myfield', 'bar'), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=textarea / type=number - as Hds::Form::Textarea', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', 'number', { editType: 'textarea', defaultValue: 123 })
+    );
+    assert
+      .dom('.field [class^="hds-form-field"] textarea.hds-form-textarea')
+      .exists('renders as Hds::Form::Textarea');
+    assert
+      .dom(`textarea`)
+      .exists('renders textarea')
+      .hasAttribute('data-test-input', 'myfield', 'textarea has correct `data-test-input` attribute');
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the input label');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('123', 'renders default value');
+    await fillIn(GENERAL.inputByAttr('myfield'), 'bar');
+    assert.strictEqual(model.get('myfield'), 'bar');
+    assert.true(spy.calledWith('myfield', 'bar'), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=textarea / type=string - with passed docLink, helpText, label, placeholder, subText', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', 'string', {
+        editType: 'textarea',
+        docLink: '/docs',
+        helpText: 'Some helpText',
+        label: 'Custom label',
+        placeholder: 'Custom placeholder',
+        subText: 'Some subText',
+      })
+    );
+    assert.dom(GENERAL.fieldLabel()).hasText('Custom label', 'renders the custom label from options');
+    assert
+      .dom(GENERAL.inputByAttr('myfield'))
+      .hasAttribute('placeholder', 'Custom placeholder', 'renders the placeholder from options');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some subText'))
+      .exists('renders `subText` option as HelperText')
+      .hasText(
+        'Some subText See our documentation for help.',
+        'renders the right subText string from options'
+      );
+    assert
+      .dom(`${GENERAL.helpTextByAttr('Some subText')} ${GENERAL.docLinkByAttr('/docs')}`)
+      .exists('renders `docLink` option as as link inside the subText');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some helpText'))
+      .exists('renders `helpText` option as HelperText')
+      .hasText('Some helpText', 'renders the right help text string from options');
+  });
+
+  test('it renders: editType=textarea / type=string - with validation errors and warnings', async function (assert) {
+    this.setProperties({
+      attr: createAttr('myfield', 'string', { editType: 'textarea' }),
+      model: { myfield: 'bar' },
+      modelValidations: {
+        myfield: {
+          isValid: false,
+          errors: ['Error message #1', 'Error message #2'],
+          warnings: ['Warning message #1', 'Warning message #2'],
+        },
+      },
+      onChange: () => {},
+    });
+
+    await render(
+      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @modelValidations={{this.modelValidations}} @onChange={{this.onChange}} />`
+    );
+    assert
+      .dom(GENERAL.validationErrorByAttr('myfield'))
+      .exists('Validation error renders')
+      .hasText('Error message #1 Error message #2', 'Validation errors are combined');
+    assert
+      .dom(GENERAL.validationWarningByAttr('myfield'))
+      .exists('Validation warning renders')
+      .hasText('Warning message #1 Warning message #2', 'Validation warnings are combined');
+  });
+
+  // ––––– type/editType === 'boolean' –––––
+
+  test('it renders: type=boolean - as Hds::Form::Checkbox', async function (assert) {
+    await setup.call(this, createAttr('myfield', 'boolean', { defaultValue: 'false' }));
+    assert
+      .dom('.field [class^="hds-form-field"] input[type="checkbox"].hds-form-checkbox')
+      .exists('renders as Hds::Form::Checkbox::Field');
+    assert
+      .dom(`input[type=checkbox]`)
+      .exists('renders input[type="checkbox"]')
+      .hasAttribute(
+        'data-test-input',
+        'myfield',
+        'input[type="checkbox"] has correct `data-test-input` attribute'
+      );
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the input[type="checkbox"] label');
+  });
+
+  test('it renders: editType=boolean - as Hds::Form::Checkbox', async function (assert) {
+    await setup.call(this, createAttr('myfield', '-', { editType: 'boolean', defaultValue: 'false' }));
+    assert
+      .dom('.field [class^="hds-form-field"] input[type="checkbox"].hds-form-checkbox')
+      .exists('renders as Hds::Form::Checkbox::Field');
+    assert
+      .dom(`input[type=checkbox]`)
+      .exists('renders input[type="checkbox"]')
+      .hasAttribute(
+        'data-test-input',
+        'myfield',
+        'input[type="checkbox"] has correct `data-test-input` attribute'
+      );
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the input[type="checkbox"] label');
+  });
+
+  test('it renders: editType=boolean - unselected by default', async function (assert) {
+    await setup.call(this, createAttr('myfield', '-', { editType: 'boolean' }));
+    assert.dom(GENERAL.inputByAttr('myfield')).isNotChecked('input[type="checkbox"] is not checked');
+  });
+
+  test('it renders: editType=boolean - selected and changes it', async function (assert) {
+    const [model, spy] = await setup.call(
+      this,
+      createAttr('myfield', '-', { editType: 'boolean', defaultValue: 'true' })
+    );
+    assert.dom(GENERAL.inputByAttr('myfield')).isChecked('input[type="checkbox"] is checked');
+    await click(GENERAL.inputByAttr('myfield'));
+    assert.false(model.get('myfield'));
+    assert.true(spy.calledWith('myfield', false), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=boolean - with passed label, subtext, helptext, doclink', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', '-', {
+        editType: 'boolean',
+        label: 'Custom label',
+        subText: 'Some subtext',
+        helpText: 'Some helptext',
+        docLink: '/docs',
+      })
+    );
+    assert.dom(GENERAL.fieldLabel()).hasText('Custom label', 'renders the custom label from options');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some subtext'))
+      .exists('renders `subText` option as HelperText')
+      .hasText('Some subtext Learn more here.', 'renders the right subtext string from options');
+    assert
+      .dom(`${GENERAL.helpTextByAttr('Some subtext')} ${GENERAL.docLinkByAttr('/docs')}`)
+      .exists('renders `docLink` option as as link inside the subtext');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some helptext'))
+      .exists('renders `helptext` option as HelperText')
+      .hasText('Some helptext', 'renders the right help text string from options');
+  });
+
+  test('it renders: editType=boolean - with validation errors and warnings', async function (assert) {
+    this.setProperties({
+      attr: createAttr('myfield', '-', { editType: 'boolean' }),
+      model: { myfield: false },
+      modelValidations: {
+        myfield: {
+          isValid: false,
+          errors: ['Error message #1', 'Error message #2'],
+          warnings: ['Warning message #1', 'Warning message #2'],
+        },
+      },
+      onChange: () => {},
+    });
+
+    await render(
+      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @modelValidations={{this.modelValidations}} @onChange={{this.onChange}} />`
     );
-    assert.dom('[data-test-validation-warning]').exists('Validation warning renders');
+    assert
+      .dom(GENERAL.validationErrorByAttr('myfield'))
+      .exists('Validation error renders')
+      .hasText('Error message #1 Error message #2', 'Validation errors are combined');
+    assert
+      .dom(GENERAL.validationWarningByAttr('myfield'))
+      .exists('Validation warning renders')
+      .hasText('Warning message #1 Warning message #2', 'Validation warnings are combined');
+  });
+
+  // ––––– editType === undefined && (type === 'string' || type === 'number') –––––
+
+  test('it renders: editType=undefined type=string - as Hds::Form::TextInput', async function (assert) {
+    const [model, spy] = await setup.call(this, createAttr('myfield', 'string', { defaultValue: 'default' }));
+    assert
+      .dom('.field [class^="hds-form-field"] input[type="text"].hds-form-text-input')
+      .exists('renders as Hds::Form::TextInput::Field');
+    assert
+      .dom(`input[type=text]`)
+      .exists('renders input[type="text"]')
+      .hasAttribute(
+        'data-test-input',
+        'myfield',
+        'input[type="text"] has correct `data-test-input` attribute'
+      )
+      .hasAttribute('name', 'myfield', 'input[type="text"] has correct `name` attribute')
+      .hasAttribute('id', 'myfield', 'input[type="text"] has correct `id` attribute');
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the input[type="text"] label');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('default', 'renders default value');
+    await fillIn(GENERAL.inputByAttr('myfield'), 'bar');
+    assert.strictEqual(model.get('myfield'), 'bar');
+    assert.true(spy.calledWith('myfield', 'bar'), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=undefined type=number - as Hds::Form::TextInput', async function (assert) {
+    const [model, spy] = await setup.call(this, createAttr('myfield', 'number', { defaultValue: 123 }));
+    assert
+      .dom('.field [class^="hds-form-field"] input[type="text"].hds-form-text-input')
+      .exists('renders as Hds::Form::TextInput::Field');
+    assert
+      .dom(`input[type=text]`)
+      .exists('renders input[type="text"]')
+      .hasAttribute(
+        'data-test-input',
+        'myfield',
+        'input[type="text"] has correct `data-test-input` attribute'
+      )
+      .hasAttribute('name', 'myfield', 'input[type="text"] has correct `name` attribute')
+      .hasAttribute('id', 'myfield', 'input[type="text"] has correct `id` attribute');
+    assert.dom(GENERAL.fieldLabel()).hasText('Myfield', 'renders the input[type="text"] label');
+    assert.dom(GENERAL.inputByAttr('myfield')).hasValue('123', 'renders default value');
+    await fillIn(GENERAL.inputByAttr('myfield'), 1234);
+    assert.strictEqual(model.get('myfield'), '1234');
+    assert.true(spy.calledWith('myfield', '1234'), 'onChange called with correct args');
+  });
+
+  test('it renders: editType=undefined - with passed characterLimit, docLink, editDisabled, helpText, label, placeholder, subText', async function (assert) {
+    await setup.call(
+      this,
+      createAttr('myfield', 'string', {
+        characterLimit: 10,
+        docLink: '/docs',
+        editDisabled: true,
+        helpText: 'Some helpText',
+        label: 'Custom label',
+        placeholder: 'Custom placeholder',
+        subText: 'Some subText',
+      })
+    );
+    assert.dom(GENERAL.fieldLabel()).hasText('Custom label', 'renders the custom label from options');
+    assert
+      .dom('.hds-form-field__character-count')
+      .containsText('10', 'renders the characterLimit helper text from options');
+    assert
+      .dom(GENERAL.inputByAttr('myfield'))
+      .hasAttribute('placeholder', 'Custom placeholder', 'renders the placeholder from options')
+      .hasAttribute('disabled', '', 'renders the disabled attribute from options')
+      .hasAttribute('maxlength', '10', 'renders the characterLimit from options');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some subText'))
+      .exists('renders `subText` option as HelperText')
+      .hasText(
+        'Some subText See our documentation for help.',
+        'renders the right subText string from options'
+      );
+    assert
+      .dom(`${GENERAL.helpTextByAttr('Some subText')} ${GENERAL.docLinkByAttr('/docs')}`)
+      .exists('renders `docLink` option as as link inside the subText');
+    assert
+      .dom(GENERAL.helpTextByAttr('Some helpText'))
+      .exists('renders `helpText` option as HelperText')
+      .hasText('Some helpText', 'renders the right helpText string from options');
+  });
+
+  test('it renders: editType=undefined - with readOnly when mode=edit', async function (assert) {
+    this.setProperties({
+      attr: createAttr('myfield', 'string', { readOnly: true }),
+      mode: 'edit',
+      model: { myfield: false },
+      onChange: () => {},
+    });
+
+    await render(
+      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @mode={{this.mode}} @onChange={{this.onChange}} />`
+    );
+    assert
+      .dom(GENERAL.inputByAttr('myfield'))
+      .hasAttribute('readonly', '', 'renders the readOnly attribute from options');
+  });
+
+  test('it renders: editType=undefined - with validation errors and warnings', async function (assert) {
+    this.setProperties({
+      attr: createAttr('myfield', 'string'),
+      model: { myfield: false },
+      modelValidations: {
+        myfield: {
+          isValid: false,
+          errors: ['Error message #1', 'Error message #2'],
+          warnings: ['Warning message #1', 'Warning message #2'],
+        },
+      },
+      onChange: () => {},
+    });
+
+    await render(
+      hbs`<FormField @attr={{this.attr}} @model={{this.model}} @modelValidations={{this.modelValidations}} @onChange={{this.onChange}} />`
+    );
+    assert
+      .dom(GENERAL.validationErrorByAttr('myfield'))
+      .exists('Validation error renders')
+      .hasText('Error message #1 Error message #2', 'Validation errors are combined');
+    assert
+      .dom(GENERAL.validationWarningByAttr('myfield'))
+      .exists('Validation warning renders')
+      .hasText('Warning message #1 Warning message #2', 'Validation warnings are combined');
   });
 });
diff --git a/ui/tests/integration/components/get-credentials-card-test.js b/ui/tests/integration/components/get-credentials-card-test.js
index 4d83858ed8a..1a6ae5520a9 100644
--- a/ui/tests/integration/components/get-credentials-card-test.js
+++ b/ui/tests/integration/components/get-credentials-card-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,10 +7,12 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import Service from '@ember/service';
 import { click, render } from '@ember/test-helpers';
-import { selectChoose, clickTrigger } from 'ember-power-select/test-support/helpers';
+import { clickTrigger } from 'ember-power-select/test-support/helpers';
+import { selectChoose } from 'ember-power-select/test-support';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const storeService = Service.extend({
   query(modelType) {
@@ -55,8 +57,8 @@ module('Integration | Component | get-credentials-card', function (hooks) {
   test('it shows a disabled button when no item is selected', async function (assert) {
     assert.expect(2);
     await render(hbs`<GetCredentialsCard @title={{this.title}} @searchLabel={{this.searchLabel}}/>`);
-    assert.dom('[data-test-get-credentials]').isDisabled();
-    assert.dom('[data-test-get-credentials]').hasText('Get credentials', 'Button has default text');
+    assert.dom(GENERAL.button('Get credentials')).isDisabled();
+    assert.dom(GENERAL.button('Get credentials')).hasText('Get credentials', 'Button has default text');
   });
 
   test('it shows button that can be clicked to credentials route when an item is selected', async function (assert) {
@@ -74,8 +76,8 @@ module('Integration | Component | get-credentials-card', function (hooks) {
       .hasText('Search for a role...', 'renders placeholder text passed to search select');
     await clickTrigger();
     await selectChoose('', 'my-role');
-    assert.dom('[data-test-get-credentials]').isEnabled();
-    await click('[data-test-get-credentials]');
+    assert.dom(GENERAL.button('Get credentials')).isEnabled();
+    await click(GENERAL.button('Get credentials'));
     assert.propEqual(
       this.router.transitionTo.lastCall.args,
       ['vault.cluster.secrets.backend.credentials', 'my-role'],
diff --git a/ui/tests/integration/components/icon-test.js b/ui/tests/integration/components/icon-test.js
index f94d824e495..986fd242d5a 100644
--- a/ui/tests/integration/components/icon-test.js
+++ b/ui/tests/integration/components/icon-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,26 +12,6 @@ import waitForError from 'vault/tests/helpers/wait-for-error';
 module('Integration | Component | icon', function (hooks) {
   setupRenderingTest(hooks);
 
-  test('it renders', async function (assert) {
-    await render(hbs`<Icon @name="vault-color" class="i-con" />`);
-    assert.dom('.i-con').exists('renders');
-
-    // non-flight icon
-    await render(hbs`<Icon @name="vault-logo" />`);
-    assert.dom('.vault-logo').exists('inlines the SVG');
-    assert.dom('.hs-icon').hasClass('hs-icon-l', 'Default hs class applied');
-
-    await render(hbs`<Icon @name="vault-color" class="ah" aria-hidden="true" />`);
-    assert.dom('.ah').hasAttribute('aria-hidden', 'true', 'renders aria-hidden');
-
-    await render(hbs`<Icon @name="vault-color" class="al" aria-label="Testing" />`);
-    assert.dom('.al').hasAttribute('aria-label', 'Testing', 'renders aria-label');
-
-    // non-flight icon
-    await render(hbs`<Icon @name="vault-logo" @size="24"/>`);
-    assert.dom('.hs-icon').hasClass('hs-icon-xlm', 'adds the larger size class');
-  });
-
   test('it throws error when size attribute is invalid', async function (assert) {
     const promise = waitForError();
     render(hbs`<Icon @name="vault-color" @size="12"/>`);
@@ -54,14 +34,14 @@ module('Integration | Component | icon', function (hooks) {
     );
   });
 
-  test('it should render FlightIcon', async function (assert) {
+  test('it should render Hds::Icon', async function (assert) {
     assert.expect(3);
 
     await render(hbs`<Icon @name="x" />`);
-    assert.dom('.flight-icon').exists('FlightIcon renders when provided name of icon in set');
-    assert.dom('.flight-icon').hasAttribute('width', '16', 'Default size applied svg');
+    assert.dom('.hds-icon').exists('Hds::Icon renders when provided name of icon in set');
+    assert.dom('.hds-icon').hasAttribute('width', '16', 'Default size applied svg');
 
     await render(hbs`<Icon @name="x" @size="24" />`);
-    assert.dom('.flight-icon').hasAttribute('width', '24', 'Size applied to svg');
+    assert.dom('.hds-icon').hasAttribute('width', '24', 'Size applied to svg');
   });
 });
diff --git a/ui/tests/integration/components/identity/item-details-test.js b/ui/tests/integration/components/identity/item-details-test.js
index 1eb67efe9ce..0696dbae640 100644
--- a/ui/tests/integration/components/identity/item-details-test.js
+++ b/ui/tests/integration/components/identity/item-details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/info-table-item-array-test.js b/ui/tests/integration/components/info-table-item-array-test.js
index 05a7ac3a649..652637c03eb 100644
--- a/ui/tests/integration/components/info-table-item-array-test.js
+++ b/ui/tests/integration/components/info-table-item-array-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -70,6 +70,7 @@ module('Integration | Component | InfoTableItemArray', function (hooks) {
   test('it renders', async function (assert) {
     await render(hbs`<InfoTableItemArray
         @displayArray={{this.displayArray}}
+        @label="my label"
       />`);
 
     assert.dom('[data-test-info-table-item-array]').exists();
@@ -86,6 +87,7 @@ module('Integration | Component | InfoTableItemArray', function (hooks) {
       <InfoTableItemArray
         @displayArray={{this.displayArray}}
         @isLink={{this.isLink}}
+        @label="my label"
         @modelType={{this.modelType}}
         @queryParam={{this.queryParam}}
         @backend={{this.backend}}
diff --git a/ui/tests/integration/components/info-table-row-test.js b/ui/tests/integration/components/info-table-row-test.js
index 37b53e60e3e..48d3fc77b08 100644
--- a/ui/tests/integration/components/info-table-row-test.js
+++ b/ui/tests/integration/components/info-table-row-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,8 +7,9 @@ import { module, test } from 'qunit';
 import { resolve } from 'rsvp';
 import Service from '@ember/service';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, triggerEvent } from '@ember/test-helpers';
+import { click, render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const VALUE = 'test value';
 const LABEL = 'test label';
@@ -52,11 +53,19 @@ module('Integration | Component | InfoTableRow', function (hooks) {
       />`);
 
     assert.dom('[data-test-component="info-table-row"]').exists();
-    assert.dom('[data-test-row-value]').hasText(VALUE, 'renders value as passed through');
+    assert.dom(GENERAL.infoRowValue(this.label)).hasText(VALUE, 'renders value as passed through');
+  });
 
+  test('it does not render if a value is empty and alwaysRender is false (even if default exists)', async function (assert) {
     this.set('value', '');
+    await render(hbs`<InfoTableRow
+        @value={{this.value}}
+        @label={{this.label}}
+        @defaultShown={{this.default}}
+      />`);
+
     assert
-      .dom('[data-test-label-div]')
+      .dom(GENERAL.infoRowValue(this.label))
       .doesNotExist('does not render if no value and alwaysRender is false (even if default exists)');
   });
 
@@ -69,34 +78,8 @@ module('Integration | Component | InfoTableRow', function (hooks) {
         @tooltipText={{this.tooltipText}}
       />`);
 
-    await triggerEvent('[data-test-value-div="test label"] .ember-basic-dropdown-trigger', 'mouseenter');
-
-    const tooltip = document.querySelector('div.box').textContent.trim();
-    assert.strictEqual(tooltip, 'Tooltip text!', 'renders tooltip text');
-  });
-
-  test('it should copy tooltip', async function (assert) {
-    assert.expect(3);
-
-    this.set('isCopyable', false);
-
-    await render(hbs`
-      <InfoTableRow
-        @label={{this.label}}
-        @value={{this.value}}
-        @tooltipText="Foo bar"
-        @isTooltipCopyable={{this.isCopyable}}
-      />
-    `);
-
-    await triggerEvent('[data-test-value-div="test label"] .ember-basic-dropdown-trigger', 'mouseenter');
-
-    assert.dom('[data-test-tooltip-copy]').doesNotExist('Tooltip has no copy button');
-    this.set('isCopyable', true);
-    assert.dom('[data-test-tooltip-copy]').exists('Tooltip has copy button');
-    assert
-      .dom('[data-test-tooltip-copy]')
-      .hasAttribute('data-test-tooltip-copy', 'Foo bar', 'Copy button will copy the tooltip text');
+    await click(GENERAL.tooltip('info table row'));
+    assert.dom(GENERAL.tooltipText).hasText('Tooltip text!', 'renders tooltip text');
   });
 
   test('it renders a string with no link if isLink is true and the item type is not an array.', async function (assert) {
@@ -133,25 +116,25 @@ module('Integration | Component | InfoTableRow', function (hooks) {
       @defaultShown={{this.default}}
     />`);
 
-    assert.dom('div.column.is-one-quarter .flight-icon').exists('Renders a dash (-) for the label');
+    assert.dom('div.column.is-one-quarter .hds-icon').exists('Renders a dash (-) for the label');
 
     this.set('value', '');
     this.set('label', LABEL);
-    assert.dom('div.column.is-flex-center .flight-icon').exists('Renders a dash (-) for empty string value');
+    assert.dom('div.column.is-flex-center .hds-icon').exists('Renders a dash (-) for empty string value');
 
     this.set('value', null);
-    assert.dom('div.column.is-flex-center .flight-icon').exists('Renders a dash (-) for null value');
+    assert.dom('div.column.is-flex-center .hds-icon').exists('Renders a dash (-) for null value');
 
     this.set('value', undefined);
-    assert.dom('div.column.is-flex-center .flight-icon').exists('Renders a dash (-) for undefined value');
+    assert.dom('div.column.is-flex-center .hds-icon').exists('Renders a dash (-) for undefined value');
 
     this.set('default', DEFAULT);
-    assert.dom('[data-test-value-div]').hasText(DEFAULT, 'Renders default text if value is empty');
+    assert.dom(GENERAL.infoRowValue(this.label)).hasText(DEFAULT, 'Renders default text if value is empty');
 
     this.set('value', '');
     this.set('label', '');
     this.set('default', '');
-    const dashCount = document.querySelectorAll('.flight-icon').length;
+    const dashCount = document.querySelectorAll('.hds-icon').length;
     assert.strictEqual(
       dashCount,
       2,
@@ -167,7 +150,7 @@ module('Integration | Component | InfoTableRow', function (hooks) {
       Block content is here
       </InfoTableRow>`);
 
-    const block = document.querySelector('[data-test-value-div]').textContent.trim();
+    const block = document.querySelector(GENERAL.infoRowValue(this.label)).textContent.trim();
     assert.strictEqual(block, 'Block content is here', 'renders block passed through');
   });
 
@@ -177,8 +160,8 @@ module('Integration | Component | InfoTableRow', function (hooks) {
       @alwaysRender={{false}}>
       Block content
     </InfoTableRow>`);
-    assert.dom('[data-test-value-div]').exists('renders block');
-    assert.dom('[data-test-value-div]').hasText('Block content', 'renders block');
+    assert.dom(GENERAL.infoRowValue(this.label)).exists('renders block');
+    assert.dom(GENERAL.infoRowValue(this.label)).hasText('Block content', 'renders block');
   });
 
   test('Row does not render empty block content when alwaysRender = false', async function (assert) {
@@ -195,6 +178,7 @@ module('Integration | Component | InfoTableRow', function (hooks) {
     assert.dom('[data-test-component="info-table-row"]').exists();
     assert.dom('[data-test-icon="minus"]').exists('renders dash when no label');
   });
+
   test('Truncates the label if too long', async function (assert) {
     this.set('label', 'abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz');
     await render(hbs`<div style="width: 100px;">
@@ -204,26 +188,29 @@ module('Integration | Component | InfoTableRow', function (hooks) {
       />
     </div>`);
     assert.dom('[data-test-component="info-table-row"]').exists('Row renders');
-    assert.dom('[data-test-label-div].label-overflow').exists('Label has class label-overflow');
-    await triggerEvent('[data-test-row-label]', 'mouseenter');
-    assert.dom('[data-test-label-tooltip]').exists('Label tooltip exists on hover');
+    await click(GENERAL.tooltip('info table row'));
+    assert.dom(GENERAL.tooltipText).exists('Label tooltip exists');
   });
+
   test('Renders if block value and alwaysrender=false', async function (assert) {
     await render(hbs`<InfoTableRow @alwaysRender={{false}}>{{this.value}}</InfoTableRow>`);
     assert.dom('[data-test-component="info-table-row"]').exists();
   });
+
   test('Does not render if value is empty and alwaysrender=false', async function (assert) {
     await render(hbs`<InfoTableRow @alwaysRender={{false}} @value="" />`);
     assert.dom('[data-test-component="info-table-row"]').doesNotExist();
   });
+
   test('Renders dash for value if value empty and alwaysRender=true', async function (assert) {
     await render(hbs`<InfoTableRow
         @label={{this.label}}
         @alwaysRender={{true}}
       />`);
     assert.dom('[data-test-component="info-table-row"]').exists();
-    assert.dom('[data-test-value-div] [data-test-icon="minus"]').exists('renders dash for value');
+    assert.dom(GENERAL.infoRowValue(this.label)).exists('renders dash for value');
   });
+
   test('Renders block over @value or @defaultShown', async function (assert) {
     await render(hbs`<InfoTableRow
         @label={{this.label}}
@@ -233,8 +220,9 @@ module('Integration | Component | InfoTableRow', function (hooks) {
         foo
       </InfoTableRow>`);
     assert.dom('[data-test-component="info-table-row"]').exists();
-    assert.dom('[data-test-value-div]').hasText('foo', 'renders block value');
+    assert.dom(GENERAL.infoRowValue(this.label)).hasText('foo', 'renders block value');
   });
+
   test('Renders icons if value is boolean', async function (assert) {
     this.set('value', true);
     await render(hbs`<InfoTableRow
@@ -243,10 +231,10 @@ module('Integration | Component | InfoTableRow', function (hooks) {
     />`);
 
     assert.dom('[data-test-boolean-true]').exists('check icon exists');
-    assert.dom('[data-test-value-div]').hasText('Yes', 'Renders yes text');
+    assert.dom(GENERAL.infoRowValue(this.label)).hasText('Yes', 'Renders yes text');
     this.set('value', false);
     assert.dom('[data-test-boolean-false]').exists('x icon exists');
-    assert.dom('[data-test-value-div]').hasText('No', 'renders no text');
+    assert.dom(GENERAL.infoRowValue(this.label)).hasText('No', 'renders no text');
   });
   test('Renders data-test attrs passed from parent', async function (assert) {
     this.set('value', true);
@@ -267,7 +255,7 @@ module('Integration | Component | InfoTableRow', function (hooks) {
       @formatDate={{'yyyy'}}
     />`);
 
-    assert.dom('[data-test-value-div]').hasText('2018', 'Renders date with passed format');
+    assert.dom(GENERAL.infoRowValue(this.label)).hasText('2018', 'Renders date with passed format');
   });
 
   test('Formats the value as TTL when formatTtl present', async function (assert) {
@@ -279,7 +267,7 @@ module('Integration | Component | InfoTableRow', function (hooks) {
     />`);
 
     assert
-      .dom('[data-test-value-div]')
+      .dom(GENERAL.infoRowValue(this.label))
       .hasText('1 hour 40 minutes', 'Translates number value to largest unit with carryover of minutes');
   });
 
@@ -291,6 +279,6 @@ module('Integration | Component | InfoTableRow', function (hooks) {
       @formatTtl={{true}}
     />`);
 
-    assert.dom('[data-test-value-div]').hasText('45 minutes', 'it formats string duration');
+    assert.dom(GENERAL.infoRowValue(this.label)).hasText('45 minutes', 'it formats string duration');
   });
 });
diff --git a/ui/tests/integration/components/json-editor-test.js b/ui/tests/integration/components/json-editor-test.js
index 35a0ab78565..0cbec9d4522 100644
--- a/ui/tests/integration/components/json-editor-test.js
+++ b/ui/tests/integration/components/json-editor-test.js
@@ -1,18 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { create } from 'ember-cli-page-object';
-import { render, fillIn, find, waitUntil, click } from '@ember/test-helpers';
+import { render, click, triggerKeyEvent, waitFor, setupOnerror } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
-import jsonEditor from '../../pages/components/json-editor';
+import { SELECTORS } from '../../pages/components/json-editor';
 import sinon from 'sinon';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
-
-const component = create(jsonEditor);
+import { createLongJson } from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
+import codemirror, { getCodeEditorValue, setCodeEditorValue } from 'vault/tests/helpers/codemirror';
 
 module('Integration | Component | json-editor', function (hooks) {
   setupRenderingTest(hooks);
@@ -29,15 +27,8 @@ module('Integration | Component | json-editor', function (hooks) {
     this.set('onFocusOut', sinon.spy());
     this.set('json_blob', JSON_BLOB);
     this.set('bad_json_blob', BAD_JSON_BLOB);
+    this.set('long_json', JSON.stringify(createLongJson(), null, `\t`));
     this.set('hashi-read-only-theme', 'hashi-read-only auto-height');
-    setRunOptions({
-      rules: {
-        // CodeMirror has a secret textarea without a label that causes this problem
-        label: { enabled: false },
-        // TODO: investigate and fix Codemirror styling
-        'color-contrast': { enabled: false },
-      },
-    });
   });
 
   test('it renders', async function (assert) {
@@ -48,44 +39,45 @@ module('Integration | Component | json-editor', function (hooks) {
         @readOnly={{true}}
       />`);
 
-    assert.strictEqual(component.title, 'Test title', 'renders the provided title');
-    assert.true(component.hasToolbar, 'renders the toolbar');
-    assert.true(component.hasCopyButton, 'renders the copy button');
-    assert.true(component.hasJSONEditor, 'renders the code mirror modifier');
-    assert.ok(component.canEdit, 'json editor can be edited');
+    assert.dom(SELECTORS.title).hasText('Test title', 'renders the provided title');
+    assert.dom(SELECTORS.toolbar).exists('renders the toolbar');
+    assert.dom(SELECTORS.copy).exists('renders the copy button');
+    assert.dom(SELECTORS.codeBlock).exists('renders the code block');
   });
 
-  test('it handles editing and linting and styles to json', async function (assert) {
-    await render(hbs`<JsonEditor
-      @value={{this.json_blob}}
-      @readOnly={{false}}
-      @valueUpdated={{this.valueUpdated}}
-      @onFocusOut={{this.onFocusOut}}
-    />`);
-    // check for json styling
-    assert.dom('.cm-property').hasStyle({
-      color: 'rgb(158, 132, 197)',
+  test('it requires @valueUpdated arg when component is not @readOnly', async function (assert) {
+    assert.expect(1);
+    // catch error so qunit test doesn't fail
+    setupOnerror((error) => {
+      assert.strictEqual(
+        error.message,
+        'Assertion Failed: @valueUpdated callback is required when component is not @readOnly',
+        'it throws error when component is editable (not @readOnly) and @valueUpdated is not provided'
+      );
     });
-    assert.dom('.cm-string:nth-child(2)').hasStyle({
-      color: 'rgb(29, 219, 163)',
-    });
-
-    await fillIn('textarea', this.bad_json_blob);
-    await waitUntil(() => find('.CodeMirror-lint-marker-error'));
-    assert.dom('.CodeMirror-lint-marker-error').exists('throws linting error');
-    assert.dom('.CodeMirror-linenumber').exists('shows line numbers');
+    await render(hbs`<JsonEditor
+        @value={{"{}"}}
+        @title={{"Test title"}}
+        @showToolbar={{true}}
+      />`);
   });
 
-  test('it renders the correct theme and expected styling', async function (assert) {
-    await render(hbs`<JsonEditor
-      @value={{this.json_blob}}
-      @theme={{this.hashi-read-only-theme}}
-      @readOnly={{true}}
-    />`);
-    assert.dom('.cm-s-hashi-read-only').hasStyle({
-      background: 'rgb(247, 248, 250) none repeat scroll 0% 0% / auto padding-box border-box',
-    });
-    assert.dom('.CodeMirror-linenumber').doesNotExist('on readOnly does not show line numbers');
+  test('onSetup returns instance of codemirror', async function (assert) {
+    let codemirror;
+    this.onSetup = (editor) => {
+      codemirror = editor;
+    };
+    await render(hbs`
+      <JsonEditor
+        @value={{this.value}}
+        @example={{this.example}}
+        @mode="ruby"
+        @valueUpdated={{fn (mut this.value)}}
+        @onSetup={{this.onSetup}}
+      />
+    `);
+    await waitFor('.cm-editor');
+    assert.true(codemirror.viewState.inView, 'onSetup returns instance of codemirror');
   });
 
   test('it should render example and restore it', async function (assert) {
@@ -101,33 +93,46 @@ module('Integration | Component | json-editor', function (hooks) {
       />
     `);
 
-    assert.dom('.CodeMirror-code').hasText(`1${this.example}`, 'Example renders when there is no value');
+    await waitFor('.cm-editor');
+    let view = codemirror();
+
+    let editorValue = getCodeEditorValue(view);
+    assert.strictEqual(editorValue, this.example, 'Example renders when there is no value');
     assert.dom('[data-test-restore-example]').isDisabled('Restore button disabled when showing example');
-    await fillIn('textarea', '');
-    await fillIn('textarea', 'adding a value should allow the example to be restored');
+
+    setCodeEditorValue(view, '');
+    setCodeEditorValue(view, 'adding a value should allow the example to be restored');
     await click('[data-test-restore-example]');
-    assert.dom('.CodeMirror-code').hasText(`1${this.example}`, 'Example is restored');
+
+    view = codemirror();
+    await waitFor('.cm-editor');
+    editorValue = getCodeEditorValue(view);
+
+    assert.deepEqual(editorValue, this.example, 'Example is restored');
     assert.strictEqual(this.value, null, 'Value is cleared on restore example');
   });
 
-  test('obscure option works correctly', async function (assert) {
-    this.set('readOnly', true);
-    await render(hbs`<JsonEditor
-      @value={{this.json_blob}}
-      @allowObscure={{true}}
-      @readOnly={{this.readOnly}}
-      @valueUpdated={{this.valueUpdated}}
-      @onFocusOut={{this.onFocusOut}}
-    />`);
-    assert.dom('.CodeMirror-code').hasText(`{ "test": "********"}`, 'shows data with obscured values');
-    assert.dom('[data-test-toggle-input="revealValues"]').isNotChecked('reveal values toggle is unchecked');
-    await click('[data-test-toggle-input="revealValues"]');
-    assert.dom('.CodeMirror-code').hasText(JSON_BLOB, 'shows data with real values');
-    assert.dom('[data-test-toggle-input="revealValues"]').isChecked('reveal values toggle is checked');
-    // turn obscure back on to ensure readonly overrides reveal setting
-    await click('[data-test-toggle-input="revealValues"]');
-    this.set('readOnly', false);
-    assert.dom('[data-test-toggle-input="revealValues"]').doesNotExist('reveal values toggle is hidden');
-    assert.dom('.CodeMirror-code').hasText(JSON_BLOB, 'shows data with real values on edit mode');
+  test('code-mirror modifier sets value correctly on non json object', async function (assert) {
+    // this.value is a tracked property, so anytime it changes the modifier is called. We're testing non-json content by setting the mode to ruby and adding a comment
+    this.value = null;
+    await render(hbs`
+      <JsonEditor
+        @value={{this.value}}
+        @mode="ruby"
+        @valueUpdated={{fn (mut this.value)}}
+      />
+    `);
+
+    await waitFor('.cm-editor');
+    const view = codemirror();
+    setCodeEditorValue(view, '#A comment');
+    assert.strictEqual(this.value, '#A comment', 'value is set correctly');
+
+    await triggerKeyEvent('.cm-content', 'keydown', 'Enter');
+    assert.strictEqual(
+      this.value,
+      `\n#A comment`,
+      'even after hitting enter the value is still set correctly'
+    );
   });
 });
diff --git a/ui/tests/integration/components/keymgmt/distribute-test.js b/ui/tests/integration/components/keymgmt/distribute-test.js
index 744b2a37378..a97da2a7782 100644
--- a/ui/tests/integration/components/keymgmt/distribute-test.js
+++ b/ui/tests/integration/components/keymgmt/distribute-test.js
@@ -1,17 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import Pretender from 'pretender';
 import { render, settled, select } from '@ember/test-helpers';
 import { create } from 'ember-cli-page-object';
 import { hbs } from 'ember-cli-htmlbars';
 import { typeInSearch, clickTrigger } from 'ember-power-select/test-support/helpers';
 import searchSelect from '../../../pages/components/search-select';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 const SELECTORS = {
   form: '[data-test-keymgmt-distribution-form]',
@@ -30,84 +29,55 @@ const ssComponent = create(searchSelect);
 
 module('Integration | Component | keymgmt/distribute', function (hooks) {
   setupRenderingTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
     this.set('backend', 'keymgmt');
     this.set('providers', ['provider-aws', 'provider-gcp', 'provider-azure']);
-    this.server = new Pretender(function () {
-      this.get('/v1/keymgmt/key', (response) => {
-        return [
-          response,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify({
-            data: {
-              keys: ['example-1', 'example-2', 'example-3'],
-            },
-          }),
-        ];
-      });
-      this.get('/v1/keymgmt/key/:name', (response) => {
-        const name = response.params.name;
-        return [
-          response,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify({
-            data: {
-              name,
-              type: 'aes256-gcm96', // incompatible with azurekeyvault only
-            },
-          }),
-        ];
-      });
-      this.get('/v1/keymgmt/kms/:name', (response) => {
-        const name = response.params.name;
-        let provider;
-        switch (name) {
-          case 'provider-aws':
-            provider = 'awskms';
-            break;
-          case 'provider-azure':
-            provider = 'azurekeyvault';
-            break;
-          default:
-            provider = 'gcpckms';
-            break;
-        }
-        return [
-          response,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify({
-            data: {
-              name,
-              provider,
-            },
-          }),
-        ];
-      });
-      this.get('/v1/keymgmt/kms', (response) => {
-        return [
-          response,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify({
-            data: {
-              keys: ['provider-aws', 'provider-azure', 'provider-gcp'],
-            },
-          }),
-        ];
-      });
+    this.server.get('/keymgmt/key', () => {
+      return {
+        data: {
+          keys: ['example-1', 'example-2', 'example-3'],
+        },
+      };
     });
-    setRunOptions({
-      rules: {
-        // TODO: Fix SearchSelect component
-        'aria-required-attr': { enabled: false },
-        label: { enabled: false },
-        'color-contrast': { enabled: false },
-      },
+    this.server.get('/keymgmt/key/:name', (_, req) => {
+      const name = req.params.name;
+      return {
+        data: {
+          name,
+          type: 'aes256-gcm96', // incompatible with azurekeyvault only
+        },
+      };
+    });
+    this.server.get('/keymgmt/kms/:name', (_, req) => {
+      const name = req.params.name;
+      let provider;
+      switch (name) {
+        case 'provider-aws':
+          provider = 'awskms';
+          break;
+        case 'provider-azure':
+          provider = 'azurekeyvault';
+          break;
+        default:
+          provider = 'gcpckms';
+          break;
+      }
+      return {
+        data: {
+          name,
+          provider,
+        },
+      };
+    });
+    this.server.get('/keymgmt/kms', () => {
+      return {
+        data: {
+          keys: ['provider-aws', 'provider-azure', 'provider-gcp'],
+        },
+      };
     });
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
   });
 
   test('it does not allow operation selection until valid key/provider combo selected', async function (assert) {
diff --git a/ui/tests/integration/components/keymgmt/key-edit-test.js b/ui/tests/integration/components/keymgmt/key-edit-test.js
index 019cdb2fe7a..1caefb05753 100644
--- a/ui/tests/integration/components/keymgmt/key-edit-test.js
+++ b/ui/tests/integration/components/keymgmt/key-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,10 +15,10 @@ module('Integration | Component | keymgmt/key-edit', function (hooks) {
   setupRenderingTest(hooks);
 
   hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => new Date('2018-04-03T14:15:30'));
+    this.timestampStub = sinon.replace(timestamp, 'now', sinon.fake.returns(new Date('2018-04-03T14:15:30')));
   });
   hooks.beforeEach(function () {
-    const now = timestamp.now();
+    const now = this.timestampStub();
     const model = EmberObject.create({
       name: 'Unicorns',
       id: 'Unicorns',
@@ -38,9 +38,6 @@ module('Integration | Component | keymgmt/key-edit', function (hooks) {
     this.model = model;
     this.tab = '';
   });
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
 
   // TODO: Add capabilities tests
   test('it renders show view as default', async function (assert) {
diff --git a/ui/tests/integration/components/keymgmt/provider-edit-test.js b/ui/tests/integration/components/keymgmt/provider-edit-test.js
index b4615a29195..7d07618a28a 100644
--- a/ui/tests/integration/components/keymgmt/provider-edit-test.js
+++ b/ui/tests/integration/components/keymgmt/provider-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,6 +10,7 @@ import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { click, settled, fillIn } from '@ember/test-helpers';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const ts = 'data-test-kms-provider';
 const root = {
@@ -40,7 +41,7 @@ module('Integration | Component | keymgmt/provider-edit', function (hooks) {
     this.model = this.store.peekRecord('keymgmt/provider', 'foo-bar');
     this.root = root;
     this.owner.lookup('service:router').reopen({
-      currentURL: '/ui/vault/secrets/keymgmt/show/foo-bar',
+      currentURL: '/ui/vault/secrets-engines/keymgmt/show/foo-bar',
       currentRouteName: 'secrets.keymgmt.provider.show',
       urlFor() {
         return '';
@@ -109,7 +110,7 @@ module('Integration | Component | keymgmt/provider-edit', function (hooks) {
         'This provider cannot be deleted until all 2 key(s) distributed to it are revoked. This can be done from the Keys tab.',
         'Renders disabled message'
       );
-    await click('[data-test-confirm-cancel-button]');
+    await click(GENERAL.cancelButton);
   });
 
   test('it should delete a provider', async function (assert) {
@@ -150,11 +151,11 @@ module('Integration | Component | keymgmt/provider-edit', function (hooks) {
       />`);
 
     assert
-      .dom('[data-test-value-div="Keys"]')
+      .dom(GENERAL.infoRowValue('Keys'))
       .hasText('None', 'None is displayed when no keys exist for provider');
 
     await click(`[${ts}-delete]`);
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
   });
 
   test('it should render create view', async function (assert) {
@@ -198,7 +199,7 @@ module('Integration | Component | keymgmt/provider-edit', function (hooks) {
     assert.dom(`[${ts}-creds-title]`).doesNotExist('New credentials header hidden in create mode');
 
     await click(`[${ts}-submit]`);
-    assert.dom('[data-test-inline-error-message]').exists('Validation error messages shown');
+    assert.dom('[data-test-validation-error]').exists('Validation error messages shown');
 
     await fillIn('[data-test-input="provider"]', 'azurekeyvault');
     ['client_id', 'client_secret', 'tenant_id'].forEach((prop) => {
diff --git a/ui/tests/integration/components/known-secondaries-card-test.js b/ui/tests/integration/components/known-secondaries-card-test.js
index ac343147659..682ac2f5901 100644
--- a/ui/tests/integration/components/known-secondaries-card-test.js
+++ b/ui/tests/integration/components/known-secondaries-card-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/known-secondaries-table-test.js b/ui/tests/integration/components/known-secondaries-table-test.js
index e0c9f8ebb8c..ea23aaad2dd 100644
--- a/ui/tests/integration/components/known-secondaries-table-test.js
+++ b/ui/tests/integration/components/known-secondaries-table-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -29,6 +29,14 @@ module('Integration | Component | replication known-secondaries-table', function
     await render(hbs`<KnownSecondariesTable @secondaries={{this.secondaries}} />`, this.context);
 
     assert.dom('[data-test-known-secondaries-table]').exists();
+
+    // Verify table has overflow and word break classes applied
+    assert
+      .dom('[data-test-known-secondaries-table]')
+      .hasClass('overflow-wrap', 'it has the overflow-wrap class applied');
+    assert
+      .dom('[data-test-known-secondaries-table]')
+      .hasClass('word-break', 'it has the word-break class applied');
   });
 
   test('it shows the secondary URL and connection_status', async function (assert) {
diff --git a/ui/tests/integration/components/kubernetes/config-cta-test.js b/ui/tests/integration/components/kubernetes/config-cta-test.js
index 31cd127a74a..1cf10ac2a4e 100644
--- a/ui/tests/integration/components/kubernetes/config-cta-test.js
+++ b/ui/tests/integration/components/kubernetes/config-cta-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/kubernetes/page/configuration-test.js b/ui/tests/integration/components/kubernetes/page/configuration-test.js
index 6f3ed0e9b9d..a264aefdd4d 100644
--- a/ui/tests/integration/components/kubernetes/page/configuration-test.js
+++ b/ui/tests/integration/components/kubernetes/page/configuration-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | kubernetes | Page::Configuration', function (hooks) {
   setupRenderingTest(hooks);
@@ -42,7 +43,7 @@ module('Integration | Component | kubernetes | Page::Configuration', function (h
     };
 
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: this.backend.id },
     ];
 
@@ -58,7 +59,7 @@ module('Integration | Component | kubernetes | Page::Configuration', function (h
 
   test('it should render tab page header, config cta and mount config', async function (assert) {
     await this.renderComponent();
-    assert.dom('.title svg').hasClass('flight-icon-kubernetes-color', 'Kubernetes icon renders in title');
+    assert.dom('.title svg').hasClass('hds-icon-kubernetes-color', 'Kubernetes icon renders in title');
     assert.dom('.title').hasText('kubernetes-test', 'Mount path renders in title');
     assert
       .dom('[data-test-toolbar-config-action]')
@@ -72,7 +73,7 @@ module('Integration | Component | kubernetes | Page::Configuration', function (h
     await this.renderComponent();
     assert
       .dom('[data-test-inferred-message] svg')
-      .hasClass('flight-icon-check-circle-fill', 'Inferred message icon renders');
+      .hasClass('hds-icon-check-circle-fill', 'Inferred message icon renders');
     const message =
       'These details were successfully inferred from Vault’s kubernetes environment and were not explicity set in this config.';
     assert.dom('[data-test-inferred-message]').hasText(message, 'Inferred message renders');
@@ -91,12 +92,8 @@ module('Integration | Component | kubernetes | Page::Configuration', function (h
 
     assert.dom('[data-test-row-label="Certificate"]').exists('Certificate label renders');
     assert.dom('[data-test-certificate-card]').exists('Certificate card component renders');
-    assert
-      .dom('[data-test-certificate-icon]')
-      .hasClass('flight-icon-certificate', 'Certificate icon renders');
-    assert
-      .dom('[data-test-certificate-card] [data-test-copy-button]')
-      .exists('Certificate copy button renders');
+    assert.dom('[data-test-certificate-icon]').hasClass('hds-icon-certificate', 'Certificate icon renders');
+    assert.dom(GENERAL.copyButton).exists('Certificate copy button renders');
     assert.dom('[data-test-certificate-label]').hasText('PEM Format', 'Certificate label renders');
     assert
       .dom('[data-test-certificate-value]')
diff --git a/ui/tests/integration/components/kubernetes/page/configure-test.js b/ui/tests/integration/components/kubernetes/page/configure-test.js
index 4d78e5124db..f153beb22e5 100644
--- a/ui/tests/integration/components/kubernetes/page/configure-test.js
+++ b/ui/tests/integration/components/kubernetes/page/configure-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,6 +12,7 @@ import hbs from 'htmlbars-inline-precompile';
 import { Response } from 'miragejs';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | kubernetes | Page::Configure', function (hooks) {
   setupRenderingTest(hooks);
@@ -34,9 +35,9 @@ module('Integration | Component | kubernetes | Page::Configure', function (hooks
     });
     this.editModel = this.store.peekRecord('kubernetes/config', 'kubernetes-edit');
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: 'kubernetes', route: 'overview' },
-      { label: 'configure' },
+      { label: 'Configure' },
     ];
     this.expectedInferred = {
       disable_local_ca_jwt: false,
@@ -230,7 +231,7 @@ module('Integration | Component | kubernetes | Page::Configure', function (hooks
     await click('[data-test-config-save]');
 
     assert
-      .dom('[data-test-field-validation="kubernetesHost"] [data-test-inline-error-message]')
+      .dom(GENERAL.validationErrorByAttr('kubernetesHost'))
       .hasText('Kubernetes host is required', 'Error renders for required field');
     assert.dom('[data-test-alert]').hasText('There is an error with this form.', 'Alert renders');
   });
diff --git a/ui/tests/integration/components/kubernetes/page/credentials-test.js b/ui/tests/integration/components/kubernetes/page/credentials-test.js
index 50e47ee952b..1b547b44f86 100644
--- a/ui/tests/integration/components/kubernetes/page/credentials-test.js
+++ b/ui/tests/integration/components/kubernetes/page/credentials-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,6 +10,7 @@ import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click, fillIn } from '@ember/test-helpers';
 import { Response } from 'miragejs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import hbs from 'htmlbars-inline-precompile';
 import timestamp from 'core/utils/timestamp';
 
@@ -18,10 +19,8 @@ module('Integration | Component | kubernetes | Page::Credentials', function (hoo
   setupEngine(hooks, 'kubernetes');
   setupMirage(hooks);
 
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => new Date('2018-04-03T14:15:30'));
-  });
   hooks.beforeEach(function () {
+    sinon.replace(timestamp, 'now', sinon.fake.returns(new Date('2018-04-03T14:15:30')));
     this.backend = 'kubernetes-test';
     this.roleName = 'role-0';
 
@@ -40,9 +39,9 @@ module('Integration | Component | kubernetes | Page::Credentials', function (hoo
     };
     this.breadcrumbs = [
       { label: this.backend, route: 'overview' },
-      { label: 'roles', route: 'roles' },
+      { label: 'Roles', route: 'roles' },
       { label: this.roleName, route: 'roles.role.details' },
-      { label: 'credentials' },
+      { label: 'Credentials' },
     ];
     this.renderComponent = () => {
       return render(
@@ -53,9 +52,6 @@ module('Integration | Component | kubernetes | Page::Credentials', function (hoo
       );
     };
   });
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
 
   test('it should display generate credentials form', async function (assert) {
     await this.renderComponent();
@@ -96,7 +92,7 @@ module('Integration | Component | kubernetes | Page::Credentials', function (hoo
     assert.expect(15);
 
     this.server.post('/kubernetes-test/creds/role-0', () => {
-      assert.ok('POST request made to generate credentials');
+      assert.true(true, 'POST request made to generate credentials');
       return {
         request_id: '58fefc6c-5195-c17a-94f2-8f889f3df57c',
         lease_id: 'kubernetes/creds/default-role/aWczfcfJ7NKUdiirJrPXIs38',
@@ -113,9 +109,8 @@ module('Integration | Component | kubernetes | Page::Credentials', function (hoo
     await this.renderComponent();
     await fillIn('[data-test-kubernetes-namespace]', 'kubernetes-test');
     assert.dom('[data-test-kubernetes-namespace]').hasValue('kubernetes-test', 'kubernetes-test');
-
-    await click('[data-test-toggle-input]');
-    await click('[data-test-toggle-input="Time-to-Live (TTL)"]');
+    await click(GENERAL.toggleInput('kubernetes-clusterRoleBinding'));
+    await click(GENERAL.toggleInput('Time-to-Live (TTL)'));
     await fillIn('[data-test-ttl-value="Time-to-Live (TTL)"]', 2);
     await click('[data-test-generate-credentials-button]');
 
@@ -125,20 +120,20 @@ module('Integration | Component | kubernetes | Page::Credentials', function (hoo
       .dom('[data-test-k8-alert-message]')
       .hasText("You won't be able to access these credentials later, so please copy them now.");
     assert.dom('[data-test-row-label="Service account token"]').hasText('Service account token');
-    await click('[data-test-value-div="Service account token"] [data-test-button]');
+    await click(`${GENERAL.infoRowValue('Service account token')} [data-test-button]`);
     assert
-      .dom('[data-test-value-div="Service account token"] .display-only')
+      .dom(`${GENERAL.infoRowValue('Service account token')} .display-only`)
       .hasText('eyJhbGciOiJSUzI1NiIsImtpZCI6Imlr');
     assert.dom('[data-test-row-label="Namespace"]').hasText('Namespace');
-    assert.dom('[data-test-value-div="Namespace"]').exists();
+    assert.dom(GENERAL.infoRowValue('Namespace')).exists();
     assert.dom('[data-test-row-label="Service account name"]').hasText('Service account name');
-    assert.dom('[data-test-value-div="Service account name"]').exists();
+    assert.dom(GENERAL.infoRowValue('Service account name')).exists();
 
     assert.dom('[data-test-row-label="Lease expiry"]').hasText('Lease expiry');
-    assert.dom('[data-test-value-div="Lease expiry"]').hasText('April 3rd 2018, 3:15:30 PM');
+    assert.dom(GENERAL.infoRowValue('Lease expiry')).hasText('April 3rd 2018, 3:15:30 PM');
     assert.dom('[data-test-row-label="lease_id"]').hasText('lease_id');
     assert
-      .dom('[data-test-value-div="lease_id"] [data-test-row-value="lease_id"]')
+      .dom(GENERAL.infoRowValue('lease_id'))
       .hasText('kubernetes/creds/default-role/aWczfcfJ7NKUdiirJrPXIs38');
   });
 });
diff --git a/ui/tests/integration/components/kubernetes/page/overview-test.js b/ui/tests/integration/components/kubernetes/page/overview-test.js
index 5de7159310b..41f22522b72 100644
--- a/ui/tests/integration/components/kubernetes/page/overview-test.js
+++ b/ui/tests/integration/components/kubernetes/page/overview-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,10 +8,12 @@ import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render } from '@ember/test-helpers';
-import { typeInSearch, clickTrigger, selectChoose } from 'ember-power-select/test-support/helpers';
-import { SELECTORS } from 'vault/tests/helpers/kubernetes/overview';
+import { selectChoose } from 'ember-power-select/test-support';
+import { typeInSearch, clickTrigger } from 'ember-power-select/test-support/helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { KUBERNETES_OVERVIEW } from 'vault/tests/helpers/kubernetes/kubernetes-selectors';
 
 module('Integration | Component | kubernetes | Page::Overview', function (hooks) {
   setupRenderingTest(hooks);
@@ -41,7 +43,7 @@ module('Integration | Component | kubernetes | Page::Overview', function (hooks)
     this.backend = this.store.peekRecord('secret-engine', 'kubernetes-test');
     this.roles = this.store.peekAll('kubernetes/role');
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: this.backend.id },
     ];
     this.promptConfig = false;
@@ -62,35 +64,35 @@ module('Integration | Component | kubernetes | Page::Overview', function (hooks)
 
   test('it should display role card', async function (assert) {
     await this.renderComponent();
-    assert.dom(SELECTORS.rolesCardTitle).hasText('Roles');
+    assert.dom(KUBERNETES_OVERVIEW.rolesCardTitle).hasText('Roles');
     assert
-      .dom(SELECTORS.rolesCardSubTitle)
+      .dom(KUBERNETES_OVERVIEW.rolesCardSubTitle)
       .hasText('The number of Vault roles being used to generate Kubernetes credentials.');
-    assert.dom(SELECTORS.rolesCardLink).hasText('View Roles');
+    assert.dom(KUBERNETES_OVERVIEW.rolesCardLink).hasText('View Roles');
 
     this.roles = [];
 
     await this.renderComponent();
-    assert.dom(SELECTORS.rolesCardLink).hasText('Create Role');
+    assert.dom(KUBERNETES_OVERVIEW.rolesCardLink).hasText('Create Role');
   });
 
   test('it should display correct number of roles in role card', async function (assert) {
     await this.renderComponent();
-    assert.dom(SELECTORS.rolesCardNumRoles).hasText('2');
+    assert.dom(KUBERNETES_OVERVIEW.rolesCardNumRoles).hasText('2');
 
     this.roles = [];
 
     await this.renderComponent();
 
-    assert.dom(SELECTORS.rolesCardNumRoles).hasText('None');
+    assert.dom(KUBERNETES_OVERVIEW.rolesCardNumRoles).hasText('None');
   });
 
   test('it should display generate credentials card', async function (assert) {
     await this.renderComponent();
 
-    assert.dom(SELECTORS.generateCredentialsCardTitle).hasText('Generate credentials');
+    assert.dom(KUBERNETES_OVERVIEW.generateCredentialsCardTitle).hasText('Generate credentials');
     assert
-      .dom(SELECTORS.generateCredentialsCardSubTitle)
+      .dom(KUBERNETES_OVERVIEW.generateCredentialsCardSubTitle)
       .hasText('Quickly generate credentials by typing the role name.');
   });
 
@@ -100,21 +102,21 @@ module('Integration | Component | kubernetes | Page::Overview', function (hooks)
     assert.strictEqual(this.element.querySelectorAll('.ember-power-select-option').length, 2);
     await typeInSearch('role-0');
     assert.strictEqual(this.element.querySelectorAll('.ember-power-select-option').length, 1);
-    assert.dom(SELECTORS.generateCredentialsCardButton).isDisabled();
+    assert.dom(KUBERNETES_OVERVIEW.generateCredentialsCardButton).isDisabled();
     await selectChoose('', '.ember-power-select-option', 2);
-    assert.dom(SELECTORS.generateCredentialsCardButton).isNotDisabled();
+    assert.dom(KUBERNETES_OVERVIEW.generateCredentialsCardButton).isNotDisabled();
   });
 
   test('it should show ConfigCta when no config is set up', async function (assert) {
     this.promptConfig = true;
 
     await this.renderComponent();
-    assert.dom(SELECTORS.emptyStateTitle).hasText('Kubernetes not configured');
+    assert.dom(GENERAL.emptyStateTitle).hasText('Kubernetes not configured');
     assert
-      .dom(SELECTORS.emptyStateMessage)
+      .dom(GENERAL.emptyStateMessage)
       .hasText(
         'Get started by establishing the URL of the Kubernetes API to connect to, along with some additional options.'
       );
-    assert.dom(SELECTORS.emptyStateActionText).hasText('Configure Kubernetes');
+    assert.dom(GENERAL.emptyStateActions).hasText('Configure Kubernetes');
   });
 });
diff --git a/ui/tests/integration/components/kubernetes/page/role/create-and-edit-test.js b/ui/tests/integration/components/kubernetes/page/role/create-and-edit-test.js
index c6b1d3c1f9d..2a4846fd976 100644
--- a/ui/tests/integration/components/kubernetes/page/role/create-and-edit-test.js
+++ b/ui/tests/integration/components/kubernetes/page/role/create-and-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,10 +7,12 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { render, click, fillIn } from '@ember/test-helpers';
+import { render, click, fillIn, waitFor, settled } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import codemirror, { getCodeEditorValue, setCodeEditorValue } from 'vault/tests/helpers/codemirror';
 
 module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', function (hooks) {
   setupRenderingTest(hooks);
@@ -40,16 +42,14 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
     this.newModel = store.createRecord('kubernetes/role', { backend: 'kubernetes-test' });
     this.breadcrumbs = [
       { label: this.newModel.backend, route: 'overview' },
-      { label: 'roles', route: 'roles' },
-      { label: 'create' },
+      { label: 'Roles', route: 'roles' },
+      { label: 'Create' },
     ];
     setRunOptions({
       rules: {
         // TODO: fix RadioCard component (replace with HDS)
         'aria-valid-attr-value': { enabled: false },
         'nested-interactive': { enabled: false },
-        // TODO: fix JSONEditor/CodeMirror
-        label: { enabled: false },
       },
     });
   });
@@ -59,16 +59,14 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
       hbs`<Page::Role::CreateAndEdit @model={{this.newModel}} @breadcrumbs={{this.breadcrumbs}} />`,
       { owner: this.engine }
     );
+    assert.dom(GENERAL.emptyStateTitle).hasText('Choose an option above', 'Empty state title renders');
     assert
-      .dom('[data-test-empty-state-title]')
-      .hasText('Choose an option above', 'Empty state title renders');
-    assert
-      .dom('[data-test-empty-state-message]')
+      .dom(GENERAL.emptyStateMessage)
       .hasText(
         'To configure a Vault role, choose what should be generated in Kubernetes by Vault.',
         'Empty state message renders'
       );
-    assert.dom('[data-test-save]').isDisabled('Save button is disabled');
+    assert.dom(GENERAL.submitButton).isDisabled('Save button is disabled');
   });
 
   test('it should display different form fields based on generation preference selection', async function (assert) {
@@ -86,17 +84,17 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
 
     await click('[data-test-radio-card="basic"]');
     ['serviceAccountName', ...commonFields].forEach((field) => {
-      assert.dom(`[data-test-field="${field}"]`).exists(`${field} field renders`);
+      assert.dom(GENERAL.fieldByAttr(field)).exists(`${field} field renders`);
     });
 
     await click('[data-test-radio-card="expanded"]');
     ['kubernetesRoleType', 'kubernetesRoleName', 'nameTemplate', ...commonFields].forEach((field) => {
-      assert.dom(`[data-test-field="${field}"]`).exists(`${field} field renders`);
+      assert.dom(GENERAL.fieldByAttr(field)).exists(`${field} field renders`);
     });
 
     await click('[data-test-radio-card="full"]');
     ['kubernetesRoleType', 'nameTemplate', ...commonFields].forEach((field) => {
-      assert.dom(`[data-test-field="${field}"]`).exists(`${field} field renders`);
+      assert.dom(GENERAL.fieldByAttr(field)).exists(`${field} field renders`);
     });
     assert.dom('[data-test-generated-role-rules]').exists('Generated role rules section renders');
   });
@@ -108,7 +106,7 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
     );
 
     await click('[data-test-radio-card="basic"]');
-    await fillIn('[data-test-input="serviceAccountName"]', 'test');
+    await fillIn(GENERAL.inputByAttr('serviceAccountName'), 'test');
     await click('[data-test-radio-card="expanded"]');
     assert.strictEqual(
       this.newModel.serviceAccountName,
@@ -116,7 +114,7 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
       'Service account name cleared when switching from basic to expanded'
     );
 
-    await fillIn('[data-test-input="kubernetesRoleName"]', 'test');
+    await fillIn(GENERAL.inputByAttr('kubernetesRoleName'), 'test');
     await click('[data-test-radio-card="full"]');
     assert.strictEqual(
       this.newModel.kubernetesRoleName,
@@ -124,9 +122,9 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
       'Kubernetes role name cleared when switching from expanded to full'
     );
 
-    await click('[data-test-input="kubernetesRoleType"] input');
-    await click('[data-test-toggle-input="show-nameTemplate"]');
-    await fillIn('[data-test-input="nameTemplate"]', 'bar');
+    await click(`${GENERAL.inputGroupByAttr('kubernetesRoleType')} input`);
+    await click(GENERAL.toggleInput('show-nameTemplate'));
+    await fillIn(GENERAL.inputByAttr('nameTemplate'), 'bar');
     await fillIn('[data-test-select-template]', '6');
     await click('[data-test-radio-card="expanded"]');
     assert.strictEqual(
@@ -153,6 +151,49 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
     );
   });
 
+  test('it should update code editor when template selection changes', async function (assert) {
+    await render(
+      hbs`<Page::Role::CreateAndEdit @model={{this.newModel}} @breadcrumbs={{this.breadcrumbs}} />`,
+      { owner: this.engine }
+    );
+
+    await click('[data-test-radio-card="full"]');
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    const expectedInitialValue = `# The below is an example that you can use as a starting point.
+#
+# rules:
+#   - apiGroups: [""]
+#     resources: ["serviceaccounts", "serviceaccounts/token"]
+#     verbs: ["create", "update", "delete"]
+#   - apiGroups: ["rbac.authorization.k8s.io"]
+#     resources: ["rolebindings", "clusterrolebindings"]
+#     verbs: ["create", "update", "delete"]
+#   - apiGroups: ["rbac.authorization.k8s.io"]
+#     resources: ["roles", "clusterroles"]
+#     verbs: ["bind", "escalate", "create", "update", "delete"]
+`;
+    assert.strictEqual(
+      getCodeEditorValue(editor),
+      expectedInitialValue,
+      'editor initially renders rules from example template'
+    );
+    // Select a different template
+    await fillIn('[data-test-select-template]', '6');
+    const expectedRule = `rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames:
+  - <list of policies to authorize>
+`;
+    assert.strictEqual(
+      getCodeEditorValue(editor),
+      expectedRule,
+      'code editor updates and renders rules from selected template'
+    );
+  });
+
   test('it should create new role', async function (assert) {
     assert.expect(3);
 
@@ -163,11 +204,13 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
       { owner: this.engine }
     );
     await click('[data-test-radio-card="basic"]');
-    await click('[data-test-save]');
-    assert.dom('[data-test-inline-error-message]').hasText('Name is required', 'Validation error renders');
-    await fillIn('[data-test-input="name"]', 'role-1');
-    await fillIn('[data-test-input="serviceAccountName"]', 'default');
-    await click('[data-test-save]');
+
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.validationErrorByAttr('name')).hasText('Name is required', 'Validation error renders');
+    await fillIn(GENERAL.inputByAttr('name'), 'role-1');
+    await fillIn(GENERAL.inputByAttr('serviceAccountName'), 'default');
+    await click(GENERAL.submitButton);
+
     assert.ok(
       this.transitionCalledWith('roles.role.details', this.newModel.name),
       'Transitions to details route on save'
@@ -187,11 +230,11 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
         { owner: this.engine }
       );
       assert.dom(`[data-test-radio-card="${pref}"] input`).isChecked('Correct radio card is checked');
-      assert.dom('[data-test-input="name"]').hasValue(this.role.name, 'Role name is populated');
+      assert.dom(GENERAL.inputByAttr('name')).hasValue(this.role.name, 'Role name is populated');
       const selector = {
-        basic: { name: '[data-test-input="serviceAccountName"]', method: 'hasValue', value: 'default' },
+        basic: { name: GENERAL.inputByAttr('serviceAccountName'), method: 'hasValue', value: 'default' },
         expanded: {
-          name: '[data-test-input="kubernetesRoleName"]',
+          name: GENERAL.inputByAttr('kubernetesRoleName'),
           method: 'hasValue',
           value: 'vault-k8s-secrets-role',
         },
@@ -202,7 +245,7 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
         },
       }[pref];
       assert.dom(selector.name)[selector.method](selector.value);
-      await click('[data-test-save]');
+      await click(GENERAL.submitButton);
       assert.ok(
         this.transitionCalledWith('roles.role.details', this.role.name),
         'Transitions to details route on save'
@@ -218,15 +261,15 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
     await click('[data-test-radio-card="basic"]');
     assert.dom('[data-test-annotations]').doesNotExist('Annotations and labels are hidden');
 
-    await click('[data-test-field="annotations"]');
+    await click(GENERAL.fieldByAttr('annotations'));
     await fillIn('[data-test-kv="annotations"] [data-test-kv-key]', 'foo');
     await fillIn('[data-test-kv="annotations"] [data-test-kv-value]', 'bar');
-    await click('[data-test-kv="annotations"] [data-test-kv-add-row]');
+    await click(`[data-test-kv="annotations"] ${GENERAL.kvObjectEditor.addRow}`);
     assert.deepEqual(this.newModel.extraAnnotations, { foo: 'bar' }, 'Annotations set');
 
     await fillIn('[data-test-kv="labels"] [data-test-kv-key]', 'bar');
     await fillIn('[data-test-kv="labels"] [data-test-kv-value]', 'baz');
-    await click('[data-test-kv="labels"] [data-test-kv-add-row]');
+    await click(`[data-test-kv="labels"]  ${GENERAL.kvObjectEditor.addRow}`);
     assert.deepEqual(this.newModel.extraLabels, { bar: 'baz' }, 'Labels set');
   });
 
@@ -253,9 +296,20 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
       owner: this.engine,
     });
     const addedText = 'this will be add to the start of the first line in the JsonEditor';
-    await fillIn('[data-test-component="code-mirror-modifier"] textarea', addedText);
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    setCodeEditorValue(editor, addedText);
+    await settled();
+    assert.strictEqual(getCodeEditorValue(editor), addedText, 'code editor contains addedText');
     await click('[data-test-restore-example]');
-    assert.dom('.CodeMirror-code').doesNotContainText(addedText, 'Role rules example restored');
+    const expectedValue = `rules:
+- apiGroups: [""]
+  resources: ["secrets", "services"]
+  verbs: ["get", "watch", "list", "create", "delete", "deletecollection", "patch", "update"]
+`;
+    assert.strictEqual(getCodeEditorValue(editor), expectedValue, 'code editor is reset to initial value');
+    assert.strictEqual(this.role.generatedRoleRules, expectedValue, 'model value matches code editor');
+    assert.dom('.cm-content').doesNotContainText(addedText, 'editor does not contain added text');
   });
 
   test('it should set generatedRoleRoles model prop on save', async function (assert) {
@@ -276,9 +330,9 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
       { owner: this.engine }
     );
     await click('[data-test-radio-card="full"]');
-    await fillIn('[data-test-input="name"]', 'role-1');
+    await fillIn(GENERAL.inputByAttr('name'), 'role-1');
     await fillIn('[data-test-select-template]', '5');
-    await click('[data-test-save]');
+    await click(GENERAL.submitButton);
   });
 
   test('it should unset selectedTemplateId when switching from full generation preference', async function (assert) {
@@ -294,11 +348,11 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
       { owner: this.engine }
     );
     await click('[data-test-radio-card="full"]');
-    await fillIn('[data-test-input="name"]', 'role-1');
+    await fillIn(GENERAL.inputByAttr('name'), 'role-1');
     await fillIn('[data-test-select-template]', '5');
     await click('[data-test-radio-card="basic"]');
-    await fillIn('[data-test-input="serviceAccountName"]', 'default');
-    await click('[data-test-save]');
+    await fillIn(GENERAL.inputByAttr('serviceAccountName'), 'default');
+    await click(GENERAL.submitButton);
   });
 
   test('it should go back to list route and clean up model', async function (assert) {
@@ -307,7 +361,7 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
       hbs`<Page::Role::CreateAndEdit @model={{this.newModel}} @breadcrumbs={{this.breadcrumbs}}/>`,
       { owner: this.engine }
     );
-    await click('[data-test-cancel]');
+    await click(GENERAL.cancelButton);
     assert.ok(unloadSpy.calledOnce, 'New model is unloaded on cancel');
     assert.ok(this.transitionCalledWith('roles'), 'Transitions to roles list on cancel');
 
@@ -316,7 +370,7 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
     await render(hbs`<Page::Role::CreateAndEdit @model={{this.role}} @breadcrumbs={{this.breadcrumbs}} />`, {
       owner: this.engine,
     });
-    await click('[data-test-cancel]');
+    await click(GENERAL.cancelButton);
     assert.ok(rollbackSpy.calledOnce, 'Attributes are rolled back for existing model on cancel');
     assert.ok(this.transitionCalledWith('roles'), 'Transitions to roles list on cancel');
   });
@@ -327,13 +381,12 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
       { owner: this.engine }
     );
     await click('[data-test-radio-card="basic"]');
-    await click('[data-test-save]');
-    assert
-      .dom('[data-test-input="name"]')
-      .hasClass('has-error-border', 'shows border error on input with error');
-    assert.dom('[data-test-inline-error-message]').hasText('Name is required');
+
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.validationErrorByAttr('name')).hasText('Name is required');
+
     assert
-      .dom('[data-test-invalid-form-alert] [data-test-inline-error-message]')
+      .dom(`[data-test-invalid-form-alert] ${GENERAL.inlineError}`)
       .hasText('There is an error with this form.');
   });
 
@@ -359,7 +412,7 @@ module('Integration | Component | kubernetes | Page::Role::CreateAndEdit', funct
       owner: this.engine,
     });
 
-    await fillIn('[data-test-input="serviceAccountName"]', 'demo');
-    await click('[data-test-save]');
+    await fillIn(GENERAL.inputByAttr('serviceAccountName'), 'demo');
+    await click(GENERAL.submitButton);
   });
 });
diff --git a/ui/tests/integration/components/kubernetes/page/role/details-test.js b/ui/tests/integration/components/kubernetes/page/role/details-test.js
index b5b92673605..a4db1e8bb22 100644
--- a/ui/tests/integration/components/kubernetes/page/role/details-test.js
+++ b/ui/tests/integration/components/kubernetes/page/role/details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,7 @@ import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 import { duration } from 'core/helpers/format-duration';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const allFields = [
   { label: 'Role name', key: 'name' },
@@ -46,7 +46,7 @@ module('Integration | Component | kubernetes | Page::Role::Details', function (h
       this.model = store.peekRecord('kubernetes/role', data.name);
       this.breadcrumbs = [
         { label: this.model.backend, route: 'overview' },
-        { label: 'roles', route: 'roles' },
+        { label: 'Roles', route: 'roles' },
         { label: this.model.name },
       ];
       return render(hbs`<Page::Role::Details @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />`, {
@@ -79,12 +79,6 @@ module('Integration | Component | kubernetes | Page::Role::Details', function (h
         }
       });
     };
-    setRunOptions({
-      rules: {
-        // TODO: Fix JSONEditor component
-        label: { enabled: false },
-      },
-    });
   });
 
   test('it should render header with role name and breadcrumbs', async function (assert) {
@@ -93,7 +87,7 @@ module('Integration | Component | kubernetes | Page::Role::Details', function (h
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(1)')
       .containsText(this.model.backend, 'Overview breadcrumb renders');
-    assert.dom('[data-test-breadcrumbs] li:nth-child(2) a').containsText('roles', 'Roles breadcrumb renders');
+    assert.dom('[data-test-breadcrumbs] li:nth-child(2) a').containsText('Roles', 'Roles breadcrumb renders');
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(3)')
       .containsText(this.model.name, 'Role breadcrumb renders');
@@ -118,7 +112,7 @@ module('Integration | Component | kubernetes | Page::Role::Details', function (h
     assert.dom('[data-test-edit]').hasText('Edit role', 'Edit action renders');
 
     await click('[data-test-delete]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
     assert.ok(
       transitionStub.calledWith('vault.cluster.secrets.backend.kubernetes.roles'),
       'Transitions to roles route on delete success'
diff --git a/ui/tests/integration/components/kubernetes/page/roles-test.js b/ui/tests/integration/components/kubernetes/page/roles-test.js
index 59899983ab4..10889f764be 100644
--- a/ui/tests/integration/components/kubernetes/page/roles-test.js
+++ b/ui/tests/integration/components/kubernetes/page/roles-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,6 +10,7 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | kubernetes | Page::Roles', function (hooks) {
   setupRenderingTest(hooks);
@@ -36,7 +37,7 @@ module('Integration | Component | kubernetes | Page::Roles', function (hooks) {
     this.roles = this.store.peekAll('kubernetes/role');
     this.filterValue = '';
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: this.backend.id },
     ];
     this.promptConfig = false;
@@ -52,13 +53,13 @@ module('Integration | Component | kubernetes | Page::Roles', function (hooks) {
   test('it should render tab page header and config cta', async function (assert) {
     this.promptConfig = true;
     await this.renderComponent();
-    assert.dom('.title svg').hasClass('flight-icon-kubernetes-color', 'Kubernetes icon renders in title');
+    assert.dom('.title svg').hasClass('hds-icon-kubernetes-color', 'Kubernetes icon renders in title');
     assert.dom('.title').hasText('kubernetes-test', 'Mount path renders in title');
     assert
       .dom('[data-test-toolbar-roles-action]')
       .doesNotExist('Create role', 'Toolbar action does not render when not configured');
     assert
-      .dom('[data-test-nav-input]')
+      .dom(GENERAL.filterInputExplicit)
       .doesNotExist('Roles filter input does not render when not configured');
     assert.dom('[data-test-config-cta]').exists('Config cta renders');
   });
@@ -69,8 +70,8 @@ module('Integration | Component | kubernetes | Page::Roles', function (hooks) {
     assert.dom('[data-test-toolbar-roles-action]').hasText('Create role', 'Toolbar action has correct text');
     assert
       .dom('[data-test-toolbar-roles-action] svg')
-      .hasClass('flight-icon-plus', 'Toolbar action has correct icon');
-    assert.dom('[data-test-nav-input]').exists('Roles filter input renders');
+      .hasClass('hds-icon-plus', 'Toolbar action has correct icon');
+    assert.dom(GENERAL.filterInputExplicit).exists('Roles filter input renders');
     assert.dom('[data-test-empty-state-title]').hasText('No roles yet', 'Title renders');
     assert
       .dom('[data-test-empty-state-message]')
@@ -91,9 +92,9 @@ module('Integration | Component | kubernetes | Page::Roles', function (hooks) {
 
   test('it should render roles list', async function (assert) {
     await this.renderComponent();
-    assert.dom('[data-test-list-item-content] svg').hasClass('flight-icon-user', 'List item icon renders');
+    assert.dom('[data-test-list-item-content] svg').hasClass('hds-icon-user', 'List item icon renders');
     assert.dom('[data-test-list-item-content]').hasText(this.roles[0].name, 'List item name renders');
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     assert.dom('[data-test-details]').hasText('Details', 'Details link renders in menu');
     assert.dom('[data-test-edit]').hasText('Edit', 'Edit link renders in menu');
     assert.dom('[data-test-delete]').hasText('Delete', 'Details link renders in menu');
diff --git a/ui/tests/integration/components/kubernetes/tab-page-header-test.js b/ui/tests/integration/components/kubernetes/tab-page-header-test.js
index fe658242a4c..7d56439a799 100644
--- a/ui/tests/integration/components/kubernetes/tab-page-header-test.js
+++ b/ui/tests/integration/components/kubernetes/tab-page-header-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,8 @@ import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
 
 module('Integration | Component | kubernetes | TabPageHeader', function (hooks) {
   setupRenderingTest(hooks);
@@ -27,14 +29,20 @@ module('Integration | Component | kubernetes | TabPageHeader', function (hooks)
     });
     this.model = this.store.peekRecord('secret-engine', 'kubernetes-test');
     this.mount = this.model.path.slice(0, -1);
-    this.breadcrumbs = [{ label: 'secrets', route: 'secrets', linkExternal: true }, { label: this.mount }];
+    this.breadcrumbs = [{ label: 'Secrets', route: 'secrets', linkExternal: true }, { label: this.mount }];
+    this.handleSearch = sinon.spy();
+    this.handleInput = sinon.spy();
+    this.handleKeyDown = sinon.spy();
   });
 
   test('it should render breadcrumbs', async function (assert) {
-    await render(hbs`<TabPageHeader @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />`, {
-      owner: this.engine,
-    });
-    assert.dom('[data-test-breadcrumbs] li:nth-child(1) a').hasText('secrets', 'Secrets breadcrumb renders');
+    await render(
+      hbs`<TabPageHeader @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} @handleSearch={{this.handleSearch}} @handleInput={{this.handleInput}} @handleKeyDown={{this.handleKeyDown}} />`,
+      {
+        owner: this.engine,
+      }
+    );
+    assert.dom('[data-test-breadcrumbs] li:nth-child(1) a').hasText('Secrets', 'Secrets breadcrumb renders');
 
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(2)')
@@ -42,19 +50,25 @@ module('Integration | Component | kubernetes | TabPageHeader', function (hooks)
   });
 
   test('it should render title', async function (assert) {
-    await render(hbs`<TabPageHeader @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />`, {
-      owner: this.engine,
-    });
+    await render(
+      hbs`<TabPageHeader @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} @handleSearch={{this.handleSearch}} @handleInput={{this.handleInput}} @handleKeyDown={{this.handleKeyDown}} />`,
+      {
+        owner: this.engine,
+      }
+    );
     assert
       .dom('[data-test-header-title] svg')
-      .hasClass('flight-icon-kubernetes-color', 'Correct icon renders in title');
+      .hasClass('hds-icon-kubernetes-color', 'Correct icon renders in title');
     assert.dom('[data-test-header-title]').hasText(this.mount, 'Mount path renders in title');
   });
 
   test('it should render tabs', async function (assert) {
-    await render(hbs`<TabPageHeader @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />`, {
-      owner: this.engine,
-    });
+    await render(
+      hbs`<TabPageHeader @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} @handleSearch={{this.handleSearch}} @handleInput={{this.handleInput}} @handleKeyDown={{this.handleKeyDown}}/>`,
+      {
+        owner: this.engine,
+      }
+    );
     assert.dom('[data-test-tab="overview"]').hasText('Overview', 'Overview tab renders');
     assert.dom('[data-test-tab="roles"]').hasText('Roles', 'Roles tab renders');
     assert.dom('[data-test-tab="config"]').hasText('Configuration', 'Configuration tab renders');
@@ -62,16 +76,16 @@ module('Integration | Component | kubernetes | TabPageHeader', function (hooks)
 
   test('it should render filter for roles', async function (assert) {
     await render(
-      hbs`<TabPageHeader @model={{this.model}} @filterRoles={{true}} @rolesFilterValue="test" @breadcrumbs={{this.breadcrumbs}} />`,
+      hbs`<TabPageHeader @model={{this.model}} @filterRoles={{true}} @query="test" @breadcrumbs={{this.breadcrumbs}} @handleSearch={{this.handleSearch}} @handleInput={{this.handleInput}} @handleKeyDown={{this.handleKeyDown}} />`,
       { owner: this.engine }
     );
-    assert.dom('[data-test-nav-input] input').hasValue('test', 'Filter renders with provided value');
+    assert.dom(GENERAL.filterInputExplicit).hasValue('test', 'Filter renders with provided value');
   });
 
   test('it should yield block for toolbar actions', async function (assert) {
     await render(
       hbs`
-      <TabPageHeader @model={{this.model}} @breadcrumbs={{this.breadcrumbs}}>
+      <TabPageHeader @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} @handleSearch={{this.handleSearch}} @handleInput={{this.handleInput}} @handleKeyDown={{this.handleKeyDown}}>
         <span data-test-yield>It yields!</span>
       </TabPageHeader>
     `,
diff --git a/ui/tests/integration/components/kv-object-editor-test.js b/ui/tests/integration/components/kv-object-editor-test.js
index 97c82fa083c..598d2acf384 100644
--- a/ui/tests/integration/components/kv-object-editor-test.js
+++ b/ui/tests/integration/components/kv-object-editor-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/kv-suggestion-input-test.js b/ui/tests/integration/components/kv-suggestion-input-test.js
index 6fae4067cd6..adc3c309ee1 100644
--- a/ui/tests/integration/components/kv-suggestion-input-test.js
+++ b/ui/tests/integration/components/kv-suggestion-input-test.js
@@ -1,32 +1,32 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { render, click, fillIn, settled, typeIn } from '@ember/test-helpers';
+import { render, click, fillIn, typeIn } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
-import { SELECTORS } from 'vault/tests/helpers/general-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
 
 const {
   searchSelect: { option, options },
   kvSuggestion: { input },
-} = SELECTORS;
+} = GENERAL;
 
 module('Integration | Component | kv-suggestion-input', function (hooks) {
   setupRenderingTest(hooks);
-  setupMirage(hooks);
 
   hooks.beforeEach(function () {
     this.label = 'Input something';
     this.mountPath = 'secret/';
-    this.keys = ['foo/', 'my-secret'];
-    const response = () => ({ data: { keys: this.keys } });
-    this.server.get('/:mount/metadata', response);
-    this.server.get('/:mount/metadata/*', response);
-    return render(hbs`
+    this.apiStub = sinon
+      .stub(this.owner.lookup('service:api').secrets, 'kvV2List')
+      .resolves({ keys: ['foo/', 'my-secret'] });
+
+    this.renderComponent = () =>
+      render(hbs`
       <KvSuggestionInput
         @label={{this.label}}
         @subText="Suggestions will display"
@@ -38,19 +38,23 @@ module('Integration | Component | kv-suggestion-input', function (hooks) {
   });
 
   test('it should render label and sub text', async function (assert) {
+    await this.renderComponent();
     assert.dom('label').hasText('Input something', 'Label renders');
     assert.dom('[data-test-label-subtext]').hasText('Suggestions will display', 'Label subtext renders');
-    this.set('label', null);
-    await settled();
+
+    this.label = null;
+    await this.renderComponent();
     assert.dom('label').doesNotExist('Label is hidden when arg is not provided');
   });
 
   test('it should disable input when mountPath is not provided', async function (assert) {
-    this.set('mountPath', null);
+    this.mountPath = null;
+    await this.renderComponent();
     assert.dom(input).isDisabled('Input is disabled when mountPath is not provided');
   });
 
   test('it should fetch suggestions for initial mount path', async function (assert) {
+    await this.renderComponent();
     assert.dom(options).doesNotExist('Suggestions are hidden initially');
     await click(input);
     ['foo/', 'my-secret'].forEach((secret, index) => {
@@ -59,14 +63,15 @@ module('Integration | Component | kv-suggestion-input', function (hooks) {
   });
 
   test('it should fetch secrets and update suggestions on mountPath change', async function (assert) {
-    this.keys = ['test1'];
-    this.set('mountPath', 'foo/');
-    await settled();
+    this.apiStub.resolves({ keys: ['test1'] });
+    this.mountPath = 'foo/';
+    await this.renderComponent();
     await click(input);
     assert.dom(option()).hasText('test1', 'Suggestions are fetched and render on mountPath change');
   });
 
   test('it should filter current result set', async function (assert) {
+    await this.renderComponent();
     await click(input);
     await typeIn(input, 'sec');
     assert.dom(options).exists({ count: 1 }, 'Correct number of options render based on input value');
@@ -74,12 +79,13 @@ module('Integration | Component | kv-suggestion-input', function (hooks) {
   });
 
   test('it should replace filter terms with full path to secret', async function (assert) {
+    await this.renderComponent();
     await fillIn(input, 'sec');
     await click(option());
     assert.dom(input).hasValue('my-secret', 'Partial term replaced with selected secret');
 
     await fillIn(input, '');
-    this.keys = ['secret-nested', 'bar', 'baz'];
+    this.apiStub.resolves({ keys: ['secret-nested', 'bar', 'baz'] });
     await click(option());
     await fillIn(input, 'nest');
     await click(option());
@@ -89,23 +95,25 @@ module('Integration | Component | kv-suggestion-input', function (hooks) {
   });
 
   test('it should fetch secrets at nested paths', async function (assert) {
-    this.keys = ['bar/'];
+    await this.renderComponent();
+    this.apiStub.resolves({ keys: ['bar/'] });
     await click(input);
     await click(option());
     assert.dom(input).hasValue('foo/', 'Input value updates on select');
     assert.dom(option()).hasText('bar/', 'Suggestions are fetched at new path');
 
-    this.keys = ['baz/'];
+    this.apiStub.resolves({ keys: ['baz/'] });
     await click(option());
     assert.dom(input).hasValue('foo/bar/', 'Input value updates on select');
     assert.dom(option()).hasText('baz/', 'Suggestions are fetched at new path');
 
-    this.keys = ['nested-secret'];
+    this.apiStub.resolves({ keys: ['nested-secret'] });
     await typeIn(input, 'baz/');
     assert.dom(option()).hasText('nested-secret', 'Suggestions are fetched at new path');
   });
 
   test('it should only render dropdown when suggestions exist', async function (assert) {
+    await this.renderComponent();
     await click(input);
     assert.dom(options).exists({ count: 2 }, 'Suggestions render');
 
@@ -115,7 +123,7 @@ module('Integration | Component | kv-suggestion-input', function (hooks) {
     await fillIn(input, '');
     assert.dom(options).exists({ count: 2 }, 'Suggestions render');
 
-    this.keys = [];
+    this.apiStub.resolves({ keys: [] });
     await click(option());
     assert.dom(options).doesNotExist('Drop down is hidden when there are no suggestions');
   });
diff --git a/ui/tests/integration/components/kv/kv-create-edit-form-test.js b/ui/tests/integration/components/kv/kv-create-edit-form-test.js
new file mode 100644
index 00000000000..43d6c1fdc56
--- /dev/null
+++ b/ui/tests/integration/components/kv/kv-create-edit-form-test.js
@@ -0,0 +1,228 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupEngine } from 'ember-engines/test-support';
+import { hbs } from 'ember-cli-htmlbars';
+import { fillIn, typeIn, render, click, waitFor, findAll } from '@ember/test-helpers';
+import codemirror, { getCodeEditorValue, setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+import { FORM } from 'vault/tests/helpers/kv/kv-selectors';
+import { setRunOptions } from 'ember-a11y-testing/test-support';
+import KvForm from 'vault/forms/secrets/kv';
+import sinon from 'sinon';
+import { getErrorResponse } from 'vault/tests/helpers/api/error-response';
+
+module('Integration | Component | kv-v2 | KvCreateEditForm', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'kv');
+
+  hooks.beforeEach(function () {
+    this.backend = 'my-kv-engine';
+    this.showJson = false;
+    this.onChange = sinon.stub();
+
+    this.renderComponent = (isNew = false) => {
+      this.path = isNew ? undefined : 'my-secret';
+      const options = isNew ? undefined : { cas: 2 };
+      const secretData = isNew ? undefined : { foo: 'bar' };
+      this.form = new KvForm(
+        {
+          path: this.path,
+          secretData,
+          max_versions: 0,
+          delete_version_after: '0s',
+          cas_required: false,
+          options,
+        },
+        { isNew }
+      );
+      return render(
+        hbs`
+          <KvCreateEditForm
+            @form={{this.form}}
+            @path={{this.path}}
+            @backend={{this.backend}}
+            @showJson={{this.showJson}}
+            @onChange={{this.onChange}}
+            as |modelValidations|
+          >
+            <span data-test-yield-block>{{modelValidations.invalidFormMessage}}</span>
+          </KvCreateEditForm>
+        `,
+        { owner: this.engine }
+      );
+    };
+
+    const api = this.owner.lookup('service:api');
+    this.dataWrite = sinon.stub(api.secrets, 'kvV2Write').resolves();
+    this.metadataWrite = sinon.stub(api.secrets, 'kvV2WriteMetadata').resolves();
+
+    this.transitionTo = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
+
+    setRunOptions({
+      rules: {
+        // failing on .CodeMirror-scroll
+        'scrollable-region-focusable': { enabled: false },
+      },
+    });
+  });
+
+  test('it should render namespace reminder', async function (assert) {
+    this.owner.lookup('service:namespace').path = 'test';
+    await this.renderComponent();
+    assert.dom('#namespace-reminder').hasText('This secret will be created in the test/ namespace.');
+  });
+
+  test('it should render validation errors and warnings', async function (assert) {
+    await this.renderComponent(true);
+
+    await click(FORM.saveBtn);
+
+    assert.dom(FORM.validationError('path')).hasText(`Path can't be blank.`);
+    assert.dom(FORM.invalidFormAlert).hasText('There is an error with this form.');
+
+    await typeIn(FORM.inputByAttr('path'), 'my secret');
+    assert
+      .dom(FORM.validationWarning)
+      .hasText(
+        `Path contains whitespace. If this is desired, you'll need to encode it with %20 in API requests.`
+      );
+  });
+
+  test('it should render JSON editor and add new secretData', async function (assert) {
+    assert.expect(4);
+
+    this.showJson = true;
+    await this.renderComponent(true);
+    await waitFor('.cm-editor');
+
+    const editor = codemirror();
+    const editorValue = getCodeEditorValue(editor);
+    assert.strictEqual(
+      editorValue,
+      `{\n  "": ""\n}`,
+      'json editor initializes with empty object that includes whitespace'
+    );
+    setCodeEditorValue(editor, 'blah');
+
+    await waitFor('.cm-lint-marker');
+    const lintMarkers = findAll('.cm-lint-marker');
+
+    assert.strictEqual(lintMarkers.length, 1, 'codemirror lints input');
+    setCodeEditorValue(editor, `{ "hello": "there"}`);
+    assert.propEqual(this.form.data.secretData, { hello: 'there' }, 'json editor updates secret data');
+    assert.true(
+      this.onChange.calledWith({ hello: 'there' }),
+      'onChange is called with secretData on json editor change'
+    );
+  });
+
+  test('it should create new secret', async function (assert) {
+    const path = 'new-secret';
+    const secretData = { foo: 'bar' };
+
+    await this.renderComponent(true);
+    await fillIn(FORM.inputByAttr('path'), path);
+    await fillIn(FORM.keyInput(), 'foo');
+    await fillIn(FORM.maskedValueInput(), 'bar');
+
+    assert.dom(FORM.dataInputLabel({})).hasText('Secret data', 'Correct data label renders');
+    assert.true(
+      this.onChange.calledWith(secretData),
+      'onChange is called with secretData on kv object change'
+    );
+
+    await click(FORM.saveBtn);
+    assert.true(this.dataWrite.calledWith(path, this.backend, { data: secretData }), 'secret data is saved');
+    assert.true(this.metadataWrite.notCalled, 'metadata is not saved when there are no changes');
+    assert.true(
+      this.transitionTo.calledWith('vault.cluster.secrets.backend.kv.secret.index', path),
+      'transitions to secret on success'
+    );
+
+    // metadata is updated outside of component
+    // simulate metadata change by updating form data
+    this.form.data.max_versions = 5;
+    await click(FORM.saveBtn);
+
+    assert.true(this.dataWrite.calledWith(path, this.backend, { data: secretData }), 'secret data is saved');
+    assert.true(
+      this.metadataWrite.calledWith(path, this.backend, {
+        max_versions: 5,
+        delete_version_after: '0s',
+        cas_required: false,
+      }),
+      'metadata is saved when there are changes'
+    );
+    assert.true(
+      this.transitionTo.calledWith('vault.cluster.secrets.backend.kv.secret.index', path),
+      'transitions to secret on success'
+    );
+  });
+
+  test('it should create new secret version', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(FORM.inputByAttr('path')).isDisabled();
+    assert.dom(FORM.inputByAttr('path')).hasValue(this.path);
+    assert.dom(FORM.dataInputLabel({})).hasText('Version data', 'Correct data label renders');
+    assert.dom(FORM.keyInput()).hasValue('foo');
+    await click(`${FORM.valueInput()} button`); // reveal value
+    assert.dom(FORM.maskedValueInput()).hasValue('bar');
+
+    await fillIn(FORM.keyInput(1), 'bar');
+    await fillIn(FORM.maskedValueInput(1), 'baz');
+    await click(FORM.saveBtn);
+
+    assert.true(
+      this.dataWrite.calledWith(this.path, this.backend, {
+        data: { foo: 'bar', bar: 'baz' },
+        options: { cas: 2 },
+      }),
+      'secret data is saved'
+    );
+    assert.true(this.metadataWrite.notCalled, 'metadata is not saved when there are no changes');
+    assert.true(
+      this.transitionTo.calledWith('vault.cluster.secrets.backend.kv.secret.index', this.path),
+      'transitions to secret on success'
+    );
+  });
+
+  test('it should handle save errors', async function (assert) {
+    await this.renderComponent();
+    this.form.data.max_versions = 5;
+
+    // data save failure
+    const dataError = getErrorResponse({ errors: ['error saving secret data'] }, 400);
+    this.dataWrite.rejects(dataError);
+    await click(FORM.saveBtn);
+
+    assert.dom(FORM.messageError).includesText('error saving secret data', 'data error message renders');
+    assert.true(this.metadataWrite.notCalled, 'metadata is not saved on data save failure');
+
+    // data control group error
+    sinon
+      .stub(this.owner.lookup('service:control-group'), 'logFromError')
+      .returns({ content: 'A Control Group was encountered' });
+    const ctrlError = getErrorResponse({ accessor: 'foobar', isControlGroupError: true }, 500);
+    this.dataWrite.rejects(ctrlError);
+    await click(FORM.saveBtn);
+
+    assert
+      .dom(FORM.messageError)
+      .includesText('A Control Group was encountered', 'control group error message renders');
+
+    // data success and metadata failure
+    this.dataWrite.resolves();
+    const metaError = getErrorResponse({ errors: ['error saving secret metadata'] }, 400);
+    this.metadataWrite.rejects(metaError);
+    const flashStub = sinon.stub(this.owner.lookup('service:flash-messages'), 'danger');
+    await click(FORM.saveBtn);
+
+    const flashMessage = 'Secret data was saved but metadata was not: error saving secret metadata';
+    assert.true(flashStub.calledWith(flashMessage), 'flash message displays with metadata save error');
+  });
+});
diff --git a/ui/tests/integration/components/kv/kv-data-fields-test.js b/ui/tests/integration/components/kv/kv-data-fields-test.js
deleted file mode 100644
index b60877941f3..00000000000
--- a/ui/tests/integration/components/kv/kv-data-fields-test.js
+++ /dev/null
@@ -1,118 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'vault/tests/helpers';
-import { setupEngine } from 'ember-engines/test-support';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { hbs } from 'ember-cli-htmlbars';
-import { fillIn, render, click } from '@ember/test-helpers';
-import codemirror from 'vault/tests/helpers/codemirror';
-import { PAGE, FORM } from 'vault/tests/helpers/kv/kv-selectors';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
-
-module('Integration | Component | kv-v2 | KvDataFields', function (hooks) {
-  setupRenderingTest(hooks);
-  setupEngine(hooks, 'kv');
-  setupMirage(hooks);
-
-  hooks.beforeEach(function () {
-    this.store = this.owner.lookup('service:store');
-    this.backend = 'my-kv-engine';
-    this.path = 'my-secret';
-    this.secret = this.store.createRecord('kv/data', { backend: this.backend });
-    // TODO: Fix JSONEditor/CodeMirror
-    setRunOptions({
-      rules: {
-        label: { enabled: false },
-      },
-    });
-  });
-
-  test('it updates the secret model', async function (assert) {
-    assert.expect(2);
-
-    await render(hbs`<KvDataFields @showJson={{false}} @secret={{this.secret}} @type="create" />`, {
-      owner: this.engine,
-    });
-    await fillIn(FORM.inputByAttr('path'), this.path);
-    await fillIn(FORM.keyInput(), 'foo');
-    await fillIn(FORM.maskedValueInput(), 'bar');
-    assert.strictEqual(this.secret.path, this.path);
-    assert.propEqual(this.secret.secretData, { foo: 'bar' });
-  });
-
-  test('it JSON editor initializes with empty object and modifies secretData', async function (assert) {
-    assert.expect(3);
-
-    await render(hbs`<KvDataFields @showJson={{true}} @secret={{this.secret}} />`, { owner: this.engine });
-    assert.strictEqual(
-      codemirror().getValue(' '),
-      `{ \"\": \"\" }`, // eslint-disable-line no-useless-escape
-      'json editor initializes with empty object'
-    );
-    await fillIn(`${FORM.jsonEditor} textarea`, 'blah');
-    assert.strictEqual(codemirror().state.lint.marked.length, 1, 'codemirror lints input');
-    codemirror().setValue(`{ "hello": "there"}`);
-    assert.propEqual(this.secret.secretData, { hello: 'there' }, 'json editor updates secret data');
-  });
-
-  test('it disables path and prefills secret data when creating a new secret version', async function (assert) {
-    assert.expect(5);
-    this.secret.secretData = { foo: 'bar' };
-    this.secret.path = this.path;
-
-    this.newVersion = this.store.createRecord('kv/data', {
-      backend: this.backend,
-      path: this.path,
-      secretData: this.secret.secretData,
-    });
-
-    await render(hbs`<KvDataFields @showJson={{false}} @secret={{this.secret}} @type="edit" />`, {
-      owner: this.engine,
-    });
-
-    assert.dom(FORM.inputByAttr('path')).isDisabled();
-    assert.dom(FORM.inputByAttr('path')).hasValue(this.path);
-    assert.dom(FORM.keyInput()).hasValue('foo');
-    assert.dom(FORM.maskedValueInput()).hasValue('bar');
-    assert.dom(FORM.dataInputLabel({ isJson: false })).hasText('Version data');
-  });
-
-  test('it shows readonly info rows when viewing secret details of simple secret', async function (assert) {
-    assert.expect(3);
-    this.secret.secretData = { foo: 'bar' };
-    this.secret.path = this.path;
-
-    await render(hbs`<KvDataFields @showJson={{false}} @secret={{this.secret}} @type="details" />`, {
-      owner: this.engine,
-    });
-    assert.dom(PAGE.infoRow).exists({ count: 1 }, '1 row of data shows');
-    assert.dom(PAGE.infoRowValue('foo')).hasText('***********');
-    await click(PAGE.infoRowToggleMasked('foo'));
-    assert.dom(PAGE.infoRowValue('foo')).hasText('bar', 'secret value shows after toggle');
-  });
-
-  test('it shows readonly json editor when viewing secret details of complex secret', async function (assert) {
-    assert.expect(4);
-    this.secret.secretData = {
-      foo: {
-        bar: 'baz',
-      },
-    };
-    this.secret.path = this.path;
-
-    await render(hbs`<KvDataFields @showJson={{true}} @secret={{this.secret}} @type="details" />`, {
-      owner: this.engine,
-    });
-    assert.dom(PAGE.infoRowValue('foo')).doesNotExist('does not render rows of secret data');
-    assert.dom('[data-test-component="code-mirror-modifier"]').hasClass('readonly-codemirror');
-    assert
-      .dom('[data-test-component="code-mirror-modifier"]')
-      .includesText(`{ "foo": { "bar": "********" }}`);
-    await click(FORM.toggleJsonValues);
-    assert.dom('[data-test-component="code-mirror-modifier"]').includesText(`{ "foo": { "bar": "baz" }}`);
-  });
-});
diff --git a/ui/tests/integration/components/kv/kv-list-filter-test.js b/ui/tests/integration/components/kv/kv-list-filter-test.js
index 9bb185449ce..1a7d654e17b 100644
--- a/ui/tests/integration/components/kv/kv-list-filter-test.js
+++ b/ui/tests/integration/components/kv/kv-list-filter-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/kv/kv-page-header-test.js b/ui/tests/integration/components/kv/kv-page-header-test.js
index c51c29fa96d..c4b39aa2ee7 100644
--- a/ui/tests/integration/components/kv/kv-page-header-test.js
+++ b/ui/tests/integration/components/kv/kv-page-header-test.js
@@ -1,52 +1,60 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { setupEngine } from 'ember-engines/test-support';
-import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { kvDataPath } from 'vault/utils/kv-path';
 
 module('Integration | Component | kv | kv-page-header', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'kv');
-  setupMirage(hooks);
+
   hooks.beforeEach(function () {
-    this.store = this.owner.lookup('service:store');
     this.backend = 'kv-engine';
     this.path = 'my-secret';
-    this.version = 2;
-    this.id = kvDataPath(this.backend, this.path, this.version);
-    this.payload = {
-      backend: this.backend,
-      path: this.path,
-      version: 2,
-    };
-    this.store.pushPayload('kv/data', {
-      modelName: 'kv/data',
-      id: this.id,
-      ...this.payload,
-    });
 
-    this.model = this.store.peekRecord('kv/data', this.id);
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.model.backend, route: 'secrets' },
-      { label: this.model.path, route: 'secrets.secret.details', model: this.model.path },
-      { label: 'edit' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.backend, route: 'secrets' },
+      { label: this.path, route: 'secrets.secret.details', model: this.path },
+      { label: 'Edit' },
     ];
+
+    this.renderComponent = () =>
+      render(
+        hbs`
+          <KvPageHeader
+            @breadcrumbs={{this.breadcrumbs}}
+            @pageTitle={{this.pageTitle}}
+            @mountName={{this.mountName}}
+            @secretPath={{this.secretPath}}
+          >
+            <:tabLinks>
+              <li><LinkTo @route="list" data-test-secrets-tab="Secrets">Secrets</LinkTo></li>
+              <li><LinkTo @route="configuration" data-test-secrets-tab="Configuration">Configuration</LinkTo></li>
+            </:tabLinks>
+
+            <:toolbarActions>
+              <ToolbarLink @route="secrets.create" @type="add">Create secret</ToolbarLink>
+            </:toolbarActions>
+
+            <:toolbarFilters>
+              <p>stuff here</p>
+            </:toolbarFilters>
+          </KvPageHeader>
+        `,
+        { owner: this.engine }
+      );
   });
 
   test('it renders breadcrumbs', async function (assert) {
     assert.expect(4);
-    await render(hbs`<KvPageHeader @breadcrumbs={{this.breadcrumbs}} @pageTitle="Create new version"/>`, {
-      owner: this.engine,
-    });
-    assert.dom('[data-test-breadcrumbs] li:nth-child(1) a').hasText('secrets', 'Secrets breadcrumb renders');
+    await this.renderComponent();
+    assert.dom('[data-test-breadcrumbs] li:nth-child(1) a').hasText('Secrets', 'Secrets breadcrumb renders');
     assert.dom('[data-test-breadcrumbs] li:nth-child(2) a').hasText(this.backend, 'engine name renders');
     assert.dom('[data-test-breadcrumbs] li:nth-child(3) a').hasText(this.path, 'secret path renders');
     assert
@@ -54,20 +62,27 @@ module('Integration | Component | kv | kv-page-header', function (hooks) {
       .exists('final breadcrumb renders and it is not a link.');
   });
 
-  test('it renders a custom title for a non engine view', async function (assert) {
+  test('it renders a custom title for @pageTitle', async function (assert) {
     assert.expect(2);
-    await render(hbs`<KvPageHeader @breadcrumbs={{this.breadcrumbs}} @pageTitle="Create new version"/>`, {
-      owner: this.engine,
-    });
+    this.pageTitle = 'Create new version';
+    await this.renderComponent();
     assert.dom('[data-test-header-title]').hasText('Create new version', 'displays custom title.');
     assert.dom('[data-test-header-title] svg').doesNotExist('Does not show icon if not at engine level.');
   });
 
+  test('it renders a title and copy button for @secretPath', async function (assert) {
+    assert.expect(3);
+    this.secretPath = 'my/secret/path';
+    await this.renderComponent();
+    assert.dom('[data-test-header-title]').hasText('my/secret/path', 'displays path');
+    assert.dom('[data-test-header-title] button').exists('renders copy button for path');
+    assert.dom('[data-test-icon="clipboard-copy"]').exists('renders copy icon');
+  });
+
   test('it renders a title, icon and tag if engine view', async function (assert) {
     assert.expect(2);
-    await render(hbs`<KvPageHeader @breadcrumbs={{this.breadcrumbs}} @mountName={{this.backend}} />`, {
-      owner: this.engine,
-    });
+    this.mountName = this.backend;
+    await this.renderComponent();
     assert
       .dom('[data-test-header-title]')
       .hasText(`${this.backend} version 2`, 'Mount path and version tag render for title.');
@@ -78,18 +93,7 @@ module('Integration | Component | kv | kv-page-header', function (hooks) {
 
   test('it renders tabs', async function (assert) {
     assert.expect(2);
-    await render(
-      hbs`<KvPageHeader @breadcrumbs={{this.breadcrumbs}} @mountName="my-engine">
-  <:tabLinks>
-    <li><LinkTo @route="list" data-test-secrets-tab="Secrets">Secrets</LinkTo></li>
-    <li><LinkTo @route="configuration" data-test-secrets-tab="Configuration">Configuration</LinkTo></li>
-  </:tabLinks>
-  </KvPageHeader>
-    `,
-      {
-        owner: this.engine,
-      }
-    );
+    await this.renderComponent();
     assert.dom('[data-test-secrets-tab="Secrets"]').hasText('Secrets', 'Secrets tab renders');
     assert
       .dom('[data-test-secrets-tab="Configuration"]')
@@ -98,29 +102,13 @@ module('Integration | Component | kv | kv-page-header', function (hooks) {
 
   test('it should yield block for toolbar actions', async function (assert) {
     assert.expect(1);
-    await render(
-      hbs`<KvPageHeader @breadcrumbs={{this.breadcrumbs}} @mountName="my-engine">
-      <:toolbarActions>
-      <ToolbarLink @route="secrets.create" @type="add">Create secret</ToolbarLink>
-    </:toolbarActions>
-  </KvPageHeader>
-    `,
-      { owner: this.engine }
-    ),
-      assert.dom('.toolbar-actions').exists('Block is yielded for toolbar actions');
+    await this.renderComponent();
+    assert.dom('.toolbar-actions').exists('Block is yielded for toolbar actions');
   });
 
   test('it should yield block for toolbar filters', async function (assert) {
     assert.expect(1);
-    await render(
-      hbs`<KvPageHeader @breadcrumbs={{this.breadcrumbs}} @mountName="my-engine">
-      <:toolbarFilters>
-      <p>stuff here</p>
-    </:toolbarFilters>
-  </KvPageHeader>
-    `,
-      { owner: this.engine }
-    ),
-      assert.dom('.toolbar-filters').exists('Block is yielded for toolbar filters');
+    await this.renderComponent();
+    assert.dom('.toolbar-filters').exists('Block is yielded for toolbar filters');
   });
 });
diff --git a/ui/tests/integration/components/kv/kv-patch/editor/alerts-test.js b/ui/tests/integration/components/kv/kv-patch/editor/alerts-test.js
new file mode 100644
index 00000000000..5c1a53d77eb
--- /dev/null
+++ b/ui/tests/integration/components/kv/kv-patch/editor/alerts-test.js
@@ -0,0 +1,80 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupEngine } from 'ember-engines/test-support';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { FORM } from 'vault/tests/helpers/kv/kv-selectors';
+
+module('Integration | Component | kv | kv-patch/editor/alerts', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'kv');
+
+  hooks.beforeEach(function () {
+    this.keyError = '';
+    this.keyWarning = '';
+    this.valueWarning = '';
+    this.renderComponent = async () => {
+      return render(
+        hbs`
+      <KvPatch::Editor::Alerts
+        @idx={{1}}
+        @keyError={{this.keyError}}
+        @keyWarning={{this.keyWarning}}
+        @valueWarning={{this.valueWarning}}
+      />`,
+        { owner: this.engine }
+      );
+    };
+  });
+
+  test('it renders', async function (assert) {
+    await this.renderComponent();
+    assert.dom(FORM.patchAlert('validation', 1)).doesNotExist();
+    assert.dom(FORM.patchAlert('value-warning', 1)).doesNotExist();
+    assert.dom(FORM.patchAlert('key-warning', 1)).doesNotExist();
+  });
+
+  test('it renders key error', async function (assert) {
+    this.keyError = "There's a problem with your key";
+    await this.renderComponent();
+    assert.dom(FORM.patchAlert('validation', 1)).hasClass('hds-alert--color-critical');
+    assert.dom(`${FORM.patchAlert('validation', 1)} ${GENERAL.icon('alert-diamond-fill')}`).exists();
+
+    assert.dom(FORM.patchAlert('key-warning', 1)).doesNotExist();
+    assert.dom(FORM.patchAlert('value-warning', 1)).doesNotExist();
+  });
+
+  test('it renders key warning', async function (assert) {
+    this.keyWarning = 'Key warning';
+    await this.renderComponent();
+    assert.dom(FORM.patchAlert('key-warning', 1)).hasClass('hds-alert--color-warning');
+    assert.dom(`${FORM.patchAlert('key-warning', 1)} ${GENERAL.icon('alert-triangle-fill')}`).exists();
+    assert.dom(FORM.patchAlert('validation', 1)).doesNotExist();
+    assert.dom(FORM.patchAlert('value-warning', 1)).doesNotExist();
+  });
+
+  test('it renders value warning', async function (assert) {
+    this.valueWarning = 'Value warning';
+    await this.renderComponent();
+    assert.dom(FORM.patchAlert('value-warning', 1)).hasClass('hds-alert--color-warning');
+    assert.dom(`${FORM.patchAlert('value-warning', 1)} ${GENERAL.icon('alert-triangle-fill')}`).exists();
+    assert.dom(FORM.patchAlert('validation', 1)).doesNotExist();
+    assert.dom(FORM.patchAlert('key-warning', 1)).doesNotExist();
+  });
+
+  test('it renders all three alerts', async function (assert) {
+    this.keyError = "There's a problem with your key";
+    this.keyWarning = 'Key warning';
+    this.valueWarning = 'Value warning';
+    await this.renderComponent();
+    assert.dom(FORM.patchAlert('validation', 1)).hasText(this.keyError);
+    assert.dom(FORM.patchAlert('key-warning', 1)).hasText(this.keyWarning);
+    assert.dom(FORM.patchAlert('value-warning', 1)).hasText(this.valueWarning);
+  });
+});
diff --git a/ui/tests/integration/components/kv/kv-patch/editor/form-test.js b/ui/tests/integration/components/kv/kv-patch/editor/form-test.js
new file mode 100644
index 00000000000..e3d7787ef21
--- /dev/null
+++ b/ui/tests/integration/components/kv/kv-patch/editor/form-test.js
@@ -0,0 +1,569 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupEngine } from 'ember-engines/test-support';
+import { blur, click, fillIn, typeIn, render, focus } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { FORM } from 'vault/tests/helpers/kv/kv-selectors';
+import { NON_STRING_WARNING, WHITESPACE_WARNING } from 'vault/utils/forms/validators';
+
+module('Integration | Component | kv | kv-patch/editor/form', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'kv');
+
+  hooks.beforeEach(function () {
+    this.subkeys = {
+      foo: null,
+      baz: {
+        nested: null,
+        bar: {
+          hello: null,
+        },
+      },
+    };
+    this.onSubmit = sinon.spy();
+    this.onCancel = sinon.spy();
+    this.isSaving = false;
+    this.submitError = '';
+
+    this.renderComponent = async () => {
+      return render(
+        hbs`
+    <KvPatch::Editor::Form
+      @subkeys={{this.subkeys}}
+      @onSubmit={{this.onSubmit}}
+      @onCancel={{this.onCancel}}
+      @isSaving={{this.isSaving}}
+      @submitError={{this.submitError}}
+    />`,
+        { owner: this.engine }
+      );
+    };
+
+    // HELPERS
+    this.assertDefaultRow = (idx, key, assert) => {
+      assert.dom(FORM.keyInput(idx)).hasValue(key);
+      assert.dom(FORM.keyInput(idx)).isDisabled();
+      assert.dom(FORM.valueInput(idx)).hasValue('');
+      assert.dom(FORM.valueInput(idx)).isDisabled();
+      assert.dom(FORM.patchEdit(idx)).exists();
+      assert.dom(FORM.patchDelete(idx)).exists();
+    };
+
+    this.assertEmptyRow = (assert) => {
+      assert.dom(FORM.keyInput('new')).hasValue('');
+      assert.dom(FORM.keyInput('new')).isNotDisabled();
+      assert.dom(FORM.keyInput('new')).hasAttribute('placeholder', 'key');
+      assert.dom(FORM.valueInput('new')).hasValue('');
+      assert.dom(FORM.valueInput('new')).isNotDisabled();
+      assert.dom(FORM.patchAdd).exists({ count: 1 });
+    };
+  });
+
+  test('it renders', async function (assert) {
+    await this.renderComponent();
+
+    this.assertDefaultRow(0, 'foo', assert);
+    this.assertDefaultRow(1, 'baz', assert);
+    this.assertEmptyRow(assert);
+
+    await click(FORM.saveBtn);
+    assert.true(this.onSubmit.calledOnce, 'clicking "Save" calls @onSubmit');
+    await click(FORM.cancelBtn);
+    assert.true(this.onCancel.calledOnce, 'clicking "Cancel" calls @onCancel');
+  });
+
+  test('it renders with no subkeys', async function (assert) {
+    this.subkeys = {};
+    await this.renderComponent();
+
+    this.assertEmptyRow(assert);
+  });
+
+  test('it renders submit error from parent', async function (assert) {
+    this.submitError = 'There was a problem submitting this form.';
+    await this.renderComponent();
+    assert.dom(GENERAL.inlineError).hasText(this.submitError);
+  });
+
+  test('it reveals subkeys', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(GENERAL.toggleInput('Reveal subkeys')).isNotChecked('toggle is initially unchecked');
+    assert.dom(GENERAL.codeBlock('subkeys')).doesNotExist();
+    await click(GENERAL.toggleInput('Reveal subkeys'));
+    assert.dom(GENERAL.toggleInput('Reveal subkeys')).isChecked();
+    assert.dom(GENERAL.codeBlock('subkeys')).hasText(JSON.stringify(this.subkeys, null, 2));
+
+    await click(GENERAL.toggleInput('Reveal subkeys'));
+    assert.dom(GENERAL.toggleInput('Reveal subkeys')).isNotChecked();
+    assert.dom(GENERAL.codeBlock('subkeys')).doesNotExist('unchecking re-hides subkeys');
+  });
+
+  test('it enables and disables inputs', async function (assert) {
+    await this.renderComponent();
+
+    const enableAndAssert = async (idx, key) => {
+      await click(FORM.patchEdit(idx));
+      assert.dom(FORM.valueInput(idx)).isEnabled('clicking edit enables value input');
+      assert.dom(FORM.keyInput(idx)).hasAttribute('readonly', '', `${key} input updates to readonly`);
+      assert.dom(FORM.patchEdit(idx)).doesNotExist('edit button disappears');
+      assert.dom(FORM.patchDelete(idx)).doesNotExist('delete button disappears');
+      assert
+        .dom(FORM.patchUndo(idx))
+        .hasText('Cancel', 'Undo button reads "Cancel" and replaces edit and delete');
+    };
+
+    await enableAndAssert(0, 'foo');
+    await click(FORM.patchUndo(0));
+    this.assertDefaultRow(0, 'foo', assert);
+
+    await enableAndAssert(1, 'baz');
+    await click(FORM.patchUndo(1));
+    this.assertDefaultRow(1, 'baz', assert);
+  });
+
+  test('it adds a new row', async function (assert) {
+    await this.renderComponent();
+
+    await click(FORM.patchAdd);
+    assert
+      .dom('[data-test-kv-key]')
+      .exists({ count: 3 }, 'clicking add does not create a new row if key input is empty');
+
+    await fillIn(FORM.keyInput('new'), 'aKey');
+    await fillIn(FORM.valueInput('new'), 'aValue');
+    await click(FORM.patchAdd);
+
+    assert.dom(FORM.keyInput(2)).hasValue('aKey');
+    assert.dom(FORM.keyInput(2)).isEnabled('new key inputs are enabled');
+    assert.dom(FORM.valueInput(2)).isEnabled('new value inputs are enabled');
+    assert.dom(FORM.patchUndo(2)).hasText('Remove', 'Undo button reads "Remove" for new keys');
+
+    // assert a new row is added
+    this.assertEmptyRow(assert);
+  });
+
+  test('it renders loading state', async function (assert) {
+    this.isSaving = true;
+    await this.renderComponent();
+
+    assert.dom(FORM.saveBtn).isDisabled();
+    assert.dom(FORM.cancelBtn).isDisabled();
+    assert.dom(`${FORM.saveBtn} ${GENERAL.icon('loading')}`).exists();
+  });
+
+  module('it submits', function () {
+    test('patch data for existing, deleted and new keys', async function (assert) {
+      await this.renderComponent();
+
+      // patch existing key
+      await click(FORM.patchEdit());
+      await fillIn(FORM.valueInput(), 'bar');
+      // in qunit we have to unfocus the input so the following click event works on first try
+      await blur(FORM.valueInput());
+
+      // delete existing key
+      await click(FORM.patchDelete(1));
+      assert.dom(FORM.patchAlert('delete', 1)).hasText('This key value pair is marked for deletion.');
+      assert.dom(FORM.keyInput(1)).hasClass('line-through');
+      assert.dom(`${FORM.patchAlert('delete', 1)} ${GENERAL.icon('trash')}`).exists();
+      // value is set to null under the hood, confirm the non-string warning doesn't display
+      assert
+        .dom(FORM.patchAlert('value-warning', 1))
+        .doesNotExist('non-string warning does not render for null values');
+
+      // add new key and click add
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+
+      // add new key and do NOT click add
+      await fillIn(FORM.keyInput('new'), 'bKey');
+      await fillIn(FORM.valueInput('new'), 'bValue');
+
+      await click(FORM.saveBtn);
+
+      const [data] = this.onSubmit.lastCall.args;
+      assert.propEqual(
+        data,
+        { baz: null, foo: 'bar', aKey: 'aValue', bKey: 'bValue' },
+        `onSubmit called with ${JSON.stringify(data)}`
+      );
+    });
+
+    test('patch data when every action is canceled', async function (assert) {
+      await this.renderComponent();
+
+      await click(FORM.patchEdit());
+      await fillIn(FORM.valueInput(), 'bar');
+      // in qunit we have to unfocus the input so the following click event works on the first try
+      await blur(FORM.valueInput());
+      await click(FORM.patchDelete(1));
+
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+
+      // undo every action
+      await click(FORM.patchUndo(0)); // undo edit
+      await click(FORM.patchUndo(1)); // undo delete
+      await click(FORM.patchUndo(2)); // remove new row
+      await click(FORM.saveBtn);
+
+      const [data] = this.onSubmit.lastCall.args;
+      assert.propEqual(data, {}, `onSubmit called with ${JSON.stringify(data)}`);
+    });
+  });
+
+  module('it does not submit', function () {
+    test('new keys that duplicate original subkeys', async function (assert) {
+      await this.renderComponent();
+      // patch existing key
+      await click(FORM.patchEdit());
+      await fillIn(FORM.valueInput(), 'bar');
+      // add duplicate
+      await fillIn(FORM.keyInput('new'), 'foo');
+      await fillIn(FORM.valueInput('new'), 'duplicate');
+      await click(FORM.saveBtn);
+
+      assert
+        .dom(GENERAL.inlineError)
+        .hasText('This form contains validations errors, please resolve those before submitting.');
+    });
+
+    test('newly added keys edited to duplicate original subkeys', async function (assert) {
+      await this.renderComponent();
+
+      // patch existing key
+      await click(FORM.patchEdit());
+      await fillIn(FORM.valueInput(), 'bar');
+      // add new key and click add
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+      // go back and edit "aKey" to match pre-existing subkey 'foo'
+      await fillIn(FORM.keyInput(2), 'foo');
+      await click(FORM.saveBtn);
+
+      assert
+        .dom(GENERAL.inlineError)
+        .hasText('This form contains validations errors, please resolve those before submitting.');
+    });
+
+    test('new keys that duplicate recently added keys', async function (assert) {
+      await this.renderComponent();
+
+      // create new key and click add
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+      // add same key name as above
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'duplicate');
+      await click(FORM.saveBtn);
+
+      assert
+        .dom(GENERAL.inlineError)
+        .hasText('This form contains validations errors, please resolve those before submitting.');
+    });
+  });
+
+  module('duplicate keys error', function () {
+    const validationMessage = (name) =>
+      `"${name}" key already exists. Update the value of the existing key or rename this one.`;
+
+    test('it renders for new keys that duplicate original subkeys', async function (assert) {
+      await this.renderComponent();
+
+      await fillIn(FORM.keyInput('new'), 'foo');
+      await blur(FORM.keyInput('new')); // unfocus input to fire input change event and validation
+      assert.dom(FORM.patchAlert('validation', 'new')).hasText(validationMessage('foo'));
+
+      await click(FORM.patchAdd);
+      assert
+        .dom(FORM.keyInput('new'))
+        .hasValue('foo', 'clicking "Add" is a noop, new row still has invalid value');
+
+      await typeIn(FORM.keyInput('new'), '2'); // input value is now "foo2"
+      await blur(FORM.keyInput('new')); // unfocus input
+      assert
+        .dom(FORM.patchAlert('validation', 'new'))
+        .doesNotExist('error disappears when key no longer matches');
+
+      await click(FORM.patchAdd);
+      assert.dom(FORM.keyInput('new')).hasValue('', 'clicking "Add" creates a new row');
+    });
+
+    test('it renders for newly added keys edited to duplicate original subkeys', async function (assert) {
+      // if a key is a duplicate then clicking "Add" does not work
+      // this test asserts an error appears if a user goes back to rename a previously added key
+      // to a duplicate and that it is not added to the payload
+      await this.renderComponent();
+
+      // add new key and click add
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+
+      // add another
+      await fillIn(FORM.keyInput('new'), 'bKey');
+      await fillIn(FORM.valueInput('new'), 'bValue');
+
+      // go back and update "aKey" to match a pre-existing subkey
+      await fillIn(FORM.keyInput(2), 'foo');
+      await blur(FORM.keyInput(2)); // unfocus input
+      assert.dom(FORM.patchAlert('validation', 2)).hasText(validationMessage('foo'));
+      await typeIn(FORM.keyInput(2), '2');
+      await blur(FORM.keyInput(2)); // unfocus input
+      assert
+        .dom(FORM.patchAlert('validation', 2))
+        .doesNotExist('error disappears when key no longer matches');
+    });
+
+    test('it renders for new keys that duplicate recently added keys', async function (assert) {
+      await this.renderComponent();
+
+      // create new key and click add
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+
+      // add same key name as above
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'bValue');
+      await blur(FORM.keyInput('new')); // unfocus input
+      assert.dom(FORM.patchAlert('validation', 'new')).hasText(validationMessage('aKey'));
+
+      await typeIn(FORM.keyInput('new'), '2');
+      await blur(FORM.keyInput('new')); // unfocus input
+      assert
+        .dom(FORM.patchAlert('validation', 'new'))
+        .doesNotExist('error disappears when key no longer matches');
+    });
+
+    test('it disappears after clicking "Remove" for duplicate', async function (assert) {
+      await this.renderComponent();
+
+      // create new key and click add
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+
+      // add same key name as above
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'bValue');
+      await blur(FORM.keyInput('new')); // unfocus input
+      assert.dom(FORM.patchAlert('validation', 'new')).hasText(validationMessage('aKey'));
+
+      await click(FORM.patchUndo(2));
+      assert.dom(FORM.patchAlert('validation', 'new')).doesNotExist('error clears when duplicate is removed');
+      await click(FORM.patchAdd);
+      // assert a new row is added
+      this.assertEmptyRow(assert);
+    });
+
+    test('it disappears after clicking "Remove" for multiple duplicates', async function (assert) {
+      await this.renderComponent();
+
+      // create new key and click add
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+
+      await fillIn(FORM.keyInput('new'), 'bKey');
+      await fillIn(FORM.valueInput('new'), 'bValue');
+      await click(FORM.patchAdd);
+
+      // and add another duplicate
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+
+      // edit key to be same as first
+      await fillIn(FORM.keyInput(3), 'aKey');
+
+      // remove all but latest key
+      await click(FORM.patchUndo(3));
+      await click(FORM.patchUndo(2));
+      await click(FORM.patchAdd);
+
+      // assert a new row is added
+      this.assertEmptyRow(assert);
+    });
+
+    test('it does not render when refocusing a previously inputted key', async function (assert) {
+      await this.renderComponent();
+
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+      // focus and unfocus
+      await focus(FORM.keyInput(2));
+      await blur(FORM.keyInput(2));
+      assert.dom(FORM.patchAlert('validation', 2)).doesNotExist();
+    });
+
+    // accounts for an edge case where not setting invalid key values caused
+    // error to show for outdated keys and then updating the key did not remove error
+    test('it disappears for new key when another duplicate key is edited', async function (assert) {
+      await this.renderComponent();
+
+      // create new key and click add
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+      // edit key to be a duplicate of original subkey, "foo"
+      // since "foo" is invalid it does not update the tracked KV.key value.
+      // the input value reads "foo" but underlying KV class key value is still "aKey"
+      await fillIn(FORM.keyInput(2), 'foo');
+      // fill in new key that matches underlying value of input above
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      // validation errors now show for both inputs even though no visible input reads "aKey" (while strange UX, it's a super edge case)
+      // editing input at index 2 ("foo") should make both disappear
+      await fillIn(FORM.keyInput(2), 'foo2');
+      await blur(FORM.keyInput(2)); // unfocus input
+      assert.dom(FORM.patchAlert('validation', 2)).doesNotExist();
+      assert.dom(FORM.patchAlert('validation', 'new')).doesNotExist();
+    });
+  });
+
+  module('it shows whitespace warning', function () {
+    test('for new keys with whitespace', async function (assert) {
+      await this.renderComponent();
+
+      await fillIn(FORM.keyInput('new'), 'a space');
+      await blur(FORM.keyInput('new')); // unfocus input
+      assert.dom(FORM.patchAlert('key-warning', 'new')).hasText(WHITESPACE_WARNING('this key'));
+
+      await fillIn(FORM.keyInput('new'), 'nospace');
+      await blur(FORM.keyInput('new')); // unfocus input
+      assert.dom(FORM.patchAlert('key-warning', 'new')).doesNotExist('warning disappears when key updates');
+    });
+
+    test('for newly added keys edited to have whitespace', async function (assert) {
+      await this.renderComponent();
+
+      // add new key and click add
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+
+      // add another
+      await fillIn(FORM.keyInput('new'), 'bKey');
+      await fillIn(FORM.valueInput('new'), 'bValue');
+
+      // go back and change "aKey" to have a space
+      await fillIn(FORM.keyInput(2), 'a key');
+      await blur(FORM.keyInput(2)); // unfocus input
+      assert.dom(FORM.patchAlert('key-warning', 2)).hasText(WHITESPACE_WARNING('this key'));
+
+      await fillIn(FORM.keyInput(2), 'aKey');
+      await blur(FORM.keyInput(2)); // unfocus input
+      assert.dom(FORM.patchAlert('key-warning', 2)).doesNotExist('warning disappears when key updates');
+    });
+
+    test('for keys with whitespace after clicking "Add"', async function (assert) {
+      await this.renderComponent();
+
+      // add new key with space and click add
+      await fillIn(FORM.keyInput('new'), 'a key');
+      await click(FORM.patchAdd);
+      assert
+        .dom(FORM.patchAlert('key-warning', 2))
+        .hasText(WHITESPACE_WARNING('this key'), 'warning is attached to relevant key');
+      assert
+        .dom(FORM.patchAlert('key-warning', 'new'))
+        .doesNotExist('there is no whitespace warning for the new empty row');
+
+      // add another
+      await fillIn(FORM.keyInput('new'), 'b key');
+      await blur(FORM.keyInput('new')); // unfocus input
+      assert
+        .dom(FORM.patchAlert('key-warning', 2))
+        .hasText(WHITESPACE_WARNING('this key'), 'warning is still attached to relevant key');
+      assert
+        .dom(FORM.patchAlert('key-warning', 'new'))
+        .hasText(WHITESPACE_WARNING('this key'), 'new key also has whitespace warning');
+    });
+  });
+
+  module('it shows non-string warning', function () {
+    const NON_STRING_VALUES = [0, 123, '{ "a": "b" }', 'null'];
+
+    NON_STRING_VALUES.forEach((value) => {
+      test(`for new non-string values: ${value}`, async function (assert) {
+        await this.renderComponent();
+        await fillIn(FORM.keyInput('new'), 'aKey');
+        await fillIn(FORM.valueInput('new'), value);
+        await blur(FORM.valueInput('new')); // unfocus input
+        assert.dom(FORM.patchAlert('value-warning', 'new')).hasText(NON_STRING_WARNING);
+
+        await typeIn(FORM.valueInput('new'), 'abc');
+        await blur(FORM.valueInput('new')); // unfocus input
+        assert
+          .dom(FORM.patchAlert('value-warning', 'new'))
+          .doesNotExist(`warning disappears when ${value} includes a non-parsable string`);
+      });
+    });
+
+    NON_STRING_VALUES.forEach((value) => {
+      test(`for newly added values edited to non-string values: ${value}`, async function (assert) {
+        await this.renderComponent();
+
+        // add new key and click add
+        await fillIn(FORM.keyInput('new'), 'aKey');
+        await fillIn(FORM.valueInput('new'), 'aValue');
+        await click(FORM.patchAdd);
+
+        // add another
+        await fillIn(FORM.keyInput('new'), 'bKey');
+        await fillIn(FORM.valueInput('new'), 'bValue');
+
+        // go back and change "aKey" to have a non-string
+        await fillIn(FORM.valueInput(2), value);
+        await blur(FORM.valueInput(2)); // unfocus input
+        assert.dom(FORM.patchAlert('value-warning', 2)).hasText(NON_STRING_WARNING);
+
+        await fillIn(FORM.valueInput(2), 'abc');
+        await blur(FORM.valueInput(2)); // unfocus input
+        assert
+          .dom(FORM.patchAlert('value-warning', 2))
+          .doesNotExist(`warning disappears when ${value} is replaced with a string`);
+      });
+    });
+
+    NON_STRING_VALUES.forEach((value) => {
+      test(`for non-string values after clicking "Add": ${value}`, async function (assert) {
+        await this.renderComponent();
+
+        // add non-string value and click add
+        await fillIn(FORM.keyInput('new'), 'aKey');
+        await fillIn(FORM.valueInput('new'), value);
+        await click(FORM.patchAdd);
+        assert
+          .dom(FORM.patchAlert('value-warning', 2))
+          .hasText(NON_STRING_WARNING, 'warning is attached to relevant row');
+        assert
+          .dom(FORM.patchAlert('value-warning', 'new'))
+          .doesNotExist('there is no non-string warning for the new empty row');
+
+        // add another
+        await fillIn(FORM.keyInput('new'), 'bKey');
+        await fillIn(FORM.valueInput('new'), value);
+        await blur(FORM.valueInput('new')); // unfocus input
+        assert
+          .dom(FORM.patchAlert('value-warning', 2))
+          .hasText(NON_STRING_WARNING, 'warning is still attached to relevant row');
+        assert
+          .dom(FORM.patchAlert('value-warning', 'new'))
+          .hasText(NON_STRING_WARNING, 'new row also has non-string warning');
+      });
+    });
+  });
+});
diff --git a/ui/tests/integration/components/kv/kv-patch/editor/row-test.js b/ui/tests/integration/components/kv/kv-patch/editor/row-test.js
new file mode 100644
index 00000000000..48d1fd26b03
--- /dev/null
+++ b/ui/tests/integration/components/kv/kv-patch/editor/row-test.js
@@ -0,0 +1,169 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupEngine } from 'ember-engines/test-support';
+import { blur, click, fillIn, render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { FORM } from 'vault/tests/helpers/kv/kv-selectors';
+import sinon from 'sinon';
+
+module('Integration | Component | kv | kv-patch/editor/row', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'kv');
+
+  hooks.beforeEach(function () {
+    // for simplicity using an object to test views
+    this.updateKey = sinon.spy();
+    this.undoKey = sinon.spy();
+    this.updateValue = sinon.spy();
+    this.updateState = sinon.spy();
+    this.kvClass = {
+      key: 'foo',
+      value: undefined,
+      state: 'disabled',
+      updateValue: this.updateValue,
+      updateState: this.updateState,
+    };
+
+    this.renderComponent = async () => {
+      return render(
+        hbs`
+      <KvPatch::Editor::Row
+        @idx={{0}}
+        @kvClass={{this.kvClass}}
+        @isOriginalSubkey={{this.isOriginalSubkey}}
+        @updateKey={{this.updateKey}}
+        @undoKey={{this.undoKey}}
+      />`,
+        { owner: this.engine }
+      );
+    };
+  });
+
+  module('it renders original subkeys', function (hooks) {
+    hooks.beforeEach(function () {
+      this.isOriginalSubkey = () => true;
+    });
+
+    test('in disabled state', async function (assert) {
+      await this.renderComponent();
+      assert.dom(FORM.keyInput()).hasValue('foo');
+      assert.dom(FORM.keyInput()).isDisabled();
+
+      assert.dom(FORM.valueInput()).hasValue('');
+      assert.dom(FORM.valueInput()).isDisabled();
+
+      assert.dom(FORM.patchEdit()).exists();
+      assert.dom(FORM.patchDelete()).exists();
+      assert.dom(FORM.patchUndo()).doesNotExist();
+    });
+
+    test('in enabled state', async function (assert) {
+      this.kvClass.state = 'enabled';
+      await this.renderComponent();
+      assert.dom(FORM.keyInput()).hasValue('foo');
+      assert.dom(FORM.keyInput()).hasAttribute('readonly');
+
+      assert.dom(FORM.valueInput()).hasValue('');
+      assert.dom(FORM.valueInput()).isEnabled();
+
+      assert.dom(FORM.patchEdit()).doesNotExist();
+      assert.dom(FORM.patchDelete()).doesNotExist();
+      assert.dom(FORM.patchUndo()).hasText('Cancel');
+    });
+
+    test('in deleted state', async function (assert) {
+      this.kvClass.state = 'deleted';
+      await this.renderComponent();
+      assert.dom(FORM.keyInput()).hasValue('foo');
+      assert.dom(FORM.keyInput()).hasAttribute('readonly');
+
+      assert.dom(FORM.valueInput()).hasValue('');
+      assert.dom(FORM.keyInput()).hasAttribute('readonly');
+
+      assert.dom(FORM.patchEdit()).doesNotExist();
+      assert.dom(FORM.patchDelete()).doesNotExist();
+      assert.dom(FORM.patchUndo()).hasText('Cancel');
+      assert.dom(FORM.patchAlert('delete', 0)).hasText('This key value pair is marked for deletion.');
+    });
+
+    test('it clicks undo', async function (assert) {
+      this.kvClass.state = 'enabled';
+      await this.renderComponent();
+      await click(FORM.patchUndo());
+
+      const [arg] = this.undoKey.lastCall.args;
+      assert.propEqual(arg, this.kvClass, 'undoKey is called with class');
+    });
+  });
+
+  module('it renders new subkeys', function (hooks) {
+    hooks.beforeEach(function () {
+      this.isOriginalSubkey = () => false;
+      this.kvClass = { ...this.kvClass, value: 'bar', state: 'enabled' };
+    });
+
+    // only test this state because new keys are only ever 'enabled'
+    test('in enabled state', async function (assert) {
+      await this.renderComponent();
+      assert.dom(FORM.keyInput()).hasValue('foo');
+      assert.dom(FORM.keyInput()).isNotDisabled();
+
+      assert.dom(FORM.valueInput()).hasValue('bar');
+      assert.dom(FORM.valueInput()).isNotDisabled();
+
+      assert.dom(FORM.patchEdit()).doesNotExist();
+      assert.dom(FORM.patchDelete()).doesNotExist();
+      assert.dom(FORM.patchUndo()).hasText('Remove');
+    });
+
+    test('it updates key', async function (assert) {
+      this.kvClass.key = '';
+      await this.renderComponent();
+      await fillIn(FORM.keyInput(), 'foo');
+      await blur(FORM.keyInput());
+
+      const [arg, event] = this.updateKey.lastCall.args;
+      assert.propEqual(arg, this.kvClass, 'updateKey is called with class object');
+      assert.strictEqual(event.target.value, 'foo', 'updateKey is called with event');
+    });
+
+    test('it clicks undo', async function (assert) {
+      await this.renderComponent();
+      await click(FORM.patchUndo());
+
+      const [arg] = this.undoKey.lastCall.args;
+      assert.propEqual(arg, this.kvClass, 'undoKey is called with class');
+    });
+  });
+
+  test('it updates value', async function (assert) {
+    this.kvClass.state = 'enabled';
+    await this.renderComponent();
+    await fillIn(FORM.valueInput(), 'bar');
+    await blur(FORM.valueInput());
+
+    const [event] = this.updateValue.lastCall.args;
+    assert.strictEqual(event.target.value, 'bar', 'updateValue is called with blur event');
+  });
+
+  test('it clicks enable', async function (assert) {
+    await this.renderComponent();
+    await click(FORM.patchEdit());
+
+    const [state] = this.updateState.lastCall.args;
+    assert.strictEqual(state, 'enabled', 'updateState is called with "enabled"');
+  });
+
+  test('it clicks delete', async function (assert) {
+    await this.renderComponent();
+    await click(FORM.patchDelete());
+
+    const [state] = this.updateState.lastCall.args;
+    assert.strictEqual(state, 'deleted', 'updateState is called with "deleted"');
+  });
+});
diff --git a/ui/tests/integration/components/kv/kv-patch/json-form-test.js b/ui/tests/integration/components/kv/kv-patch/json-form-test.js
new file mode 100644
index 00000000000..b4442881da2
--- /dev/null
+++ b/ui/tests/integration/components/kv/kv-patch/json-form-test.js
@@ -0,0 +1,109 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupEngine } from 'ember-engines/test-support';
+import { click, render, waitFor, settled } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+import { FORM } from 'vault/tests/helpers/kv/kv-selectors';
+import codemirror, { getCodeEditorValue, setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+
+module('Integration | Component | kv | kv-patch/editor/json-form', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'kv');
+
+  hooks.beforeEach(function () {
+    this.onSubmit = sinon.spy();
+    this.onCancel = sinon.spy();
+    this.isSaving = false;
+    this.submitError = '';
+    this.subkeys = {
+      foo: null,
+      bar: {
+        baz: null,
+        quux: {
+          hello: null,
+        },
+      },
+    };
+    this.renderComponent = async () => {
+      await render(
+        hbs`
+    <KvPatch::JsonForm
+      @onSubmit={{this.onSubmit}}
+      @onCancel={{this.onCancel}}
+      @isSaving={{this.isSaving}}
+      @subkeys={{this.subkeys}}
+      @submitError={{this.submitError}}
+    />`,
+        { owner: this.engine }
+      );
+      return waitFor('.cm-editor');
+    };
+  });
+
+  test('it renders', async function (assert) {
+    await this.renderComponent();
+    const editor = codemirror();
+    const editorValue = getCodeEditorValue(editor);
+    assert.strictEqual(
+      editorValue,
+      `{
+  "": ""
+}`,
+      'json editor initializes with empty object'
+    );
+    await click(FORM.saveBtn);
+    assert.true(this.onSubmit.calledOnce, 'clicking "Save" calls @onSubmit');
+    await click(FORM.cancelBtn);
+    assert.true(this.onCancel.calledOnce, 'clicking "Cancel" calls @onCancel');
+  });
+
+  test('it reveals subkeys', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(GENERAL.toggleInput('Reveal subkeys')).isNotChecked('toggle is initially unchecked');
+    assert.dom(GENERAL.codeBlock('subkeys')).doesNotExist();
+    await click(GENERAL.toggleInput('Reveal subkeys'));
+    assert.dom(GENERAL.toggleInput('Reveal subkeys')).isChecked();
+    assert.dom(GENERAL.codeBlock('subkeys')).hasText(JSON.stringify(this.subkeys, null, 2));
+
+    await click(GENERAL.toggleInput('Reveal subkeys'));
+    assert.dom(GENERAL.toggleInput('Reveal subkeys')).isNotChecked();
+    assert.dom(GENERAL.codeBlock('subkeys')).doesNotExist('unchecking re-hides subkeys');
+  });
+
+  test('it renders linting errors', async function (assert) {
+    await this.renderComponent();
+    const editor = codemirror();
+    setCodeEditorValue(editor, '{ "foo3":  }');
+    await settled();
+    assert
+      .dom(GENERAL.inlineError)
+      .hasText('JSON is unparsable. Fix linting errors to avoid data discrepancies.');
+    setCodeEditorValue(editor, '{ "foo": "bar" }');
+    await settled();
+    assert.dom(GENERAL.inlineError).doesNotExist('error disappears when linting is fixed');
+  });
+
+  test('it renders submit error from parent', async function (assert) {
+    this.submitError = 'There was a problem';
+    await this.renderComponent();
+    assert.dom(GENERAL.inlineError).hasText(this.submitError);
+  });
+
+  test('it submits data', async function (assert) {
+    this.submitError = 'There was a problem';
+    await this.renderComponent();
+    const editor = codemirror();
+    setCodeEditorValue(editor, '{ "foo": "bar" }');
+    await click(FORM.saveBtn);
+    const [data] = this.onSubmit.lastCall.args;
+    assert.propEqual(data, { foo: 'bar' }, `onSubmit called with ${JSON.stringify(data)}`);
+  });
+});
diff --git a/ui/tests/integration/components/kv/kv-paths-card-test.js b/ui/tests/integration/components/kv/kv-paths-card-test.js
new file mode 100644
index 00000000000..e3d3195445d
--- /dev/null
+++ b/ui/tests/integration/components/kv/kv-paths-card-test.js
@@ -0,0 +1,153 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { setupEngine } from 'ember-engines/test-support';
+import { render, click, findAll } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+/* eslint-disable no-useless-escape */
+
+module('Integration | Component | kv-v2 | KvPathsCard', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'kv');
+
+  hooks.beforeEach(async function () {
+    this.backend = 'kv-engine';
+    this.path = 'my-secret';
+    this.isCondensed = false;
+    this.clipboardSpy = sinon.stub(navigator.clipboard, 'writeText').resolves();
+
+    this.assertClipboard = async (assert, expected, index) => {
+      const buttons = findAll(GENERAL.copyButton);
+      await click(buttons[index]);
+      assert.true(this.clipboardSpy.called, 'clipboard.writeText was called');
+
+      const call = this.clipboardSpy.getCall(index);
+      assert.strictEqual(
+        call.args[0],
+        expected,
+        `Expected clipboard text to match: ${expected} (at index ${index})`
+      );
+    };
+
+    this.renderComponent = async () => {
+      return render(
+        hbs`<KvPathsCard @backend={{this.backend}} @path={{this.path}} @isCondensed={{this.isCondensed}} />`,
+        {
+          owner: this.engine,
+        }
+      );
+    };
+  });
+
+  hooks.afterEach(function () {
+    this.clipboardSpy.restore(); // Restore original clipboard
+  });
+
+  test('it renders condensed version', async function (assert) {
+    this.isCondensed = true;
+
+    await this.renderComponent();
+
+    assert.dom('[data-test-component="info-table-row"] .helper-text').doesNotExist('subtext does not render');
+
+    assert.dom('[data-test-component="info-table-row"] div').hasClass('is-one-quarter');
+    assert.dom(PAGE.paths.codeSnippet('cli')).doesNotExist();
+    assert.dom(PAGE.paths.codeSnippet('api')).doesNotExist();
+
+    const paths = [
+      { label: 'API path', expected: `/v1/${this.backend}/data/${this.path}` },
+      { label: 'CLI path', expected: `-mount="${this.backend}" "${this.path}"` },
+    ];
+    for (const [index, path] of paths.entries()) {
+      assert.dom(PAGE.infoRowValue(path.label)).hasText(path.expected);
+      await this.assertClipboard(assert, path.expected, index);
+    }
+  });
+
+  test('it renders uncondensed version', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom('[data-test-component="info-table-row"] .helper-text').exists('subtext renders');
+    assert.dom('[data-test-component="info-table-row"] div').hasClass('is-one-third');
+    assert.dom(PAGE.infoRowValue('API path for metadata')).exists();
+    assert.dom(PAGE.paths.codeSnippet('cli')).exists();
+    assert.dom(PAGE.paths.codeSnippet('api')).exists();
+  });
+
+  test('it renders copyable paths', async function (assert) {
+    const paths = [
+      { label: 'API path', expected: `/v1/${this.backend}/data/${this.path}` },
+      { label: 'CLI path', expected: `-mount="${this.backend}" "${this.path}"` },
+      { label: 'API path for metadata', expected: `/v1/${this.backend}/metadata/${this.path}` },
+    ];
+
+    await this.renderComponent();
+
+    for (const [index, path] of paths.entries()) {
+      assert.dom(PAGE.infoRowValue(path.label)).hasText(path.expected);
+      await this.assertClipboard(assert, path.expected, index);
+    }
+  });
+
+  test('it renders copyable encoded mount and secret paths', async function (assert) {
+    this.path = `my spacey!"secret`;
+    this.backend = `my fancy!"backend`;
+    const backend = encodeURIComponent(this.backend);
+    const path = encodeURIComponent(this.path);
+    const paths = [
+      {
+        label: 'API path',
+        expected: `/v1/${backend}/data/${path}`,
+      },
+      { label: 'CLI path', expected: `-mount="${this.backend}" "${this.path}"` },
+      {
+        label: 'API path for metadata',
+        expected: `/v1/${backend}/metadata/${path}`,
+      },
+    ];
+
+    await this.renderComponent();
+
+    for (const [index, path] of paths.entries()) {
+      assert.dom(PAGE.infoRowValue(path.label)).hasText(path.expected);
+      await this.assertClipboard(assert, path.expected, index);
+    }
+  });
+
+  test('it renders copyable commands', async function (assert) {
+    const url = `https://127.0.0.1:8200/v1/${this.backend}/data/${this.path}`;
+    const expected = {
+      cli: `vault kv get -mount="${this.backend}" "${this.path}"`,
+      api: `curl \\ --header \"X-Vault-Token: ...\" \\ --request GET \\ ${url}`,
+    };
+    await this.renderComponent();
+
+    assert.dom(PAGE.paths.codeSnippet('cli')).hasText(expected.cli);
+    assert.dom(PAGE.paths.codeSnippet('api')).hasText(expected.api);
+  });
+
+  test('it renders copyable encoded mount and path commands', async function (assert) {
+    this.path = `my spacey!"secret`;
+    this.backend = `my fancy!"backend`;
+
+    const backend = encodeURIComponent(this.backend);
+    const path = encodeURIComponent(this.path);
+    const url = `https://127.0.0.1:8200/v1/${backend}/data/${path}`;
+
+    const expected = {
+      cli: `vault kv get -mount="${this.backend}" "${this.path}"`,
+      api: `curl \\ --header \"X-Vault-Token: ...\" \\ --request GET \\ ${url}`,
+    };
+    await this.renderComponent();
+
+    assert.dom(PAGE.paths.codeSnippet('cli')).hasText(expected.cli);
+    assert.dom(PAGE.paths.codeSnippet('api')).hasText(expected.api);
+  });
+});
diff --git a/ui/tests/integration/components/kv/kv-subkeys-card-test.js b/ui/tests/integration/components/kv/kv-subkeys-card-test.js
new file mode 100644
index 00000000000..cc900d4fdac
--- /dev/null
+++ b/ui/tests/integration/components/kv/kv-subkeys-card-test.js
@@ -0,0 +1,67 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupEngine } from 'ember-engines/test-support';
+import { render, click } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+const { overviewCard } = GENERAL;
+module('Integration | Component | kv | kv-subkeys-card', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'kv');
+  hooks.beforeEach(function () {
+    this.isPatchAllowed = true;
+    this.subkeys = {
+      foo: null,
+      bar: {
+        baz: null,
+      },
+    };
+    this.renderComponent = async () => {
+      return render(
+        hbs`<KvSubkeysCard @subkeys={{this.subkeys}} @isPatchAllowed={{this.isPatchAllowed}} />`,
+        {
+          owner: this.engine,
+        }
+      );
+    };
+  });
+
+  test('it renders', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(overviewCard.title('Subkeys')).exists();
+    assert
+      .dom(overviewCard.description('Subkeys'))
+      .hasText(
+        'The table is displaying the top level subkeys. Toggle on the JSON view to see the full depth.'
+      );
+    assert.dom(overviewCard.content('Subkeys')).hasText('Keys foo bar');
+    assert.dom(GENERAL.toggleInput('kv-subkeys')).isNotChecked('JSON toggle is not checked by default');
+    assert.dom(overviewCard.actionText('Patch secret')).exists();
+  });
+
+  test('it hides patch action when isPatchAllowed is false', async function (assert) {
+    this.isPatchAllowed = false;
+    await this.renderComponent();
+    assert.dom(overviewCard.title('Subkeys')).exists();
+    assert.dom(overviewCard.actionText('Patch secret')).doesNotExist();
+  });
+
+  test('it toggles to JSON', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(GENERAL.toggleInput('kv-subkeys')).isNotChecked();
+    await click(GENERAL.toggleInput('kv-subkeys'));
+    assert.dom(GENERAL.toggleInput('kv-subkeys')).isChecked('JSON toggle is checked');
+    assert.dom(overviewCard.description('Subkeys')).hasText(
+      'These are the subkeys within this secret. All underlying values of leaf keys are not retrieved and are replaced with null instead. Subkey API documentation .' // space is intentional because a trailing icon renders after the inline link
+    );
+    assert.dom(overviewCard.content('Subkeys')).hasText(JSON.stringify(this.subkeys, null, 2));
+  });
+});
diff --git a/ui/tests/integration/components/kv/page/kv-page-configuration-test.js b/ui/tests/integration/components/kv/page/kv-page-configuration-test.js
index b495ce9940f..28b0d35f3c5 100644
--- a/ui/tests/integration/components/kv/page/kv-page-configuration-test.js
+++ b/ui/tests/integration/components/kv/page/kv-page-configuration-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,94 +15,57 @@ module('Integration | Component | kv-v2 | Page::Configuration', function (hooks)
   setupEngine(hooks, 'kv');
 
   hooks.beforeEach(async function () {
-    this.store = this.owner.lookup('service:store');
-    this.mountData = {
-      id: 'my-kv',
-      accessor: 'kv_80616825',
-      config: this.store.createRecord('mount-config', {
-        defaultLeaseTtl: '72h',
-        forceNoCache: false,
-        maxLeaseTtl: '123h',
-      }),
-      options: {
-        version: '2',
-      },
-      description: '',
-      path: 'my-kv',
-      sealWrap: false,
+    this.config = {
+      cas_required: true,
+      max_versions: 0,
+      delete_version_after: '0s',
       type: 'kv',
-      uuid: 'f1739f9d-dfc0-83c8-011f-ec17103a06a1',
-      // TODO: remove when attrs aren't duplicated across models
-      // these kv specific attrs exist on the secret-engine model (for POST request when mounting the engine)
-      // we want to make sure we're rendering values from kv/config while duplicates exist
-      maxVersions: 'this should never render',
-      casRequired: 'test is failing if this shows',
-      deleteVersionAfter: `definitely shouldn't render this`,
-    };
-    this.store.pushPayload('kv/config', {
-      modelName: 'kv/config',
-      id: 'my-config',
-      data: { max_versions: 0, cas_required: false, delete_version_after: '0s' },
-    });
-
-    // this is the route model, not an ember data model
-    this.model = {
-      engineConfig: this.store.peekRecord('kv/config', 'my-config'),
-      mountConfig: this.store.createRecord('secret-engine', this.mountData),
+      path: 'my-kv',
+      accessor: 'kv_80616825',
+      running_plugin_version: '2.7.0',
+      local: false,
+      seal_wrap: false,
+      default_lease_ttl: '72h',
+      max_lease_ttl: '123h',
+      version: '2',
     };
-
+    this.backend = 'my-kv';
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.model.mountConfig.path, route: 'list' },
-      { label: 'configuration' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: 'my-kv', route: 'list' },
+      { label: 'Configuration' },
     ];
   });
 
   test('it renders kv configuration details', async function (assert) {
-    assert.expect(11);
+    assert.expect(15);
 
     await render(
       hbs`
       <Page::Configuration
-        @engineConfig={{this.model.engineConfig}}
-        @mountConfig={{this.model.mountConfig}}
+        @config={{this.config}}
+        @backend={{this.backend}}
         @breadcrumbs={{this.breadcrumbs}}
       />
       `,
       { owner: this.engine }
     );
 
-    assert.dom(PAGE.title).includesText(this.mountData.path, 'renders engine path as page title');
-    assert.dom(PAGE.infoRowValue('Require check and set')).hasText('No');
+    assert.dom(PAGE.title).includesText('my-kv', 'renders engine path as page title');
+    assert.dom(PAGE.secretTab('Secrets')).exists('renders Secrets tab');
+    assert.dom(PAGE.secretTab('Configuration')).exists('renders Configuration tab');
+
+    assert.dom(PAGE.infoRowValue('Require check and set')).hasText('Yes');
     assert.dom(PAGE.infoRowValue('Automate secret deletion')).hasText('Never delete');
     assert.dom(PAGE.infoRowValue('Maximum number of versions')).hasText('0');
-    assert.dom(PAGE.infoRowValue('Accessor')).hasText(this.mountData.accessor);
-    assert.dom(PAGE.infoRowValue('Path')).hasText(this.mountData.path);
-    assert.dom(PAGE.infoRowValue('Type')).hasText(this.mountData.type);
-    assert.dom(PAGE.infoRowValue('Description')).doesNotExist();
+    assert.dom(PAGE.infoRowValue('Type')).hasText('kv');
+    assert.dom(PAGE.infoRowValue('Path')).hasText('my-kv');
+    assert.dom(PAGE.infoRowValue('Accessor')).hasText('kv_80616825');
+    assert.dom(PAGE.infoRowValue('Running plugin version')).hasText('2.7.0');
+    assert.dom(PAGE.infoRowValue('Local')).hasText('No');
     assert.dom(PAGE.infoRowValue('Seal wrap')).hasText('No');
     assert.dom(PAGE.infoRowValue('Default Lease TTL')).hasText('3 days');
     assert.dom(PAGE.infoRowValue('Max Lease TTL')).hasText('5 days 3 hours');
-  });
-
-  test('it renders non default kv engine config data', async function (assert) {
-    assert.expect(3);
-    this.model.engineConfig.maxVersions = 10;
-    this.model.engineConfig.casRequired = true;
-    this.model.engineConfig.deleteVersionAfter = '10d';
-
-    await render(
-      hbs`
-      <Page::Configuration
-        @engineConfig={{this.model.engineConfig}}
-        @mountConfig={{this.model.mountConfig}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
-    assert.dom(PAGE.infoRowValue('Require check and set')).hasText('Yes');
-    assert.dom(PAGE.infoRowValue('Automate secret deletion')).hasText('10 days');
-    assert.dom(PAGE.infoRowValue('Maximum number of versions')).hasText('10');
+    assert.dom(PAGE.infoRowValue('Version')).hasText('2');
   });
 });
diff --git a/ui/tests/integration/components/kv/page/kv-page-list-test.js b/ui/tests/integration/components/kv/page/kv-page-list-test.js
index 12c8de3abd0..792d9ecde1d 100644
--- a/ui/tests/integration/components/kv/page/kv-page-list-test.js
+++ b/ui/tests/integration/components/kv/page/kv-page-list-test.js
@@ -1,49 +1,62 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { render, click } from '@ember/test-helpers';
+import { render, click, fillIn, typeIn } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { kvMetadataPath } from 'vault/utils/kv-path';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
 import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
 
-const CREATE_RECORDS = (number, store, server) => {
-  const mirageList = server.createList('kv-metadatum', number, 'withCustomPath');
-  mirageList.forEach((record) => {
-    record.data.path = record.path;
-    record.id = kvMetadataPath(record.data.backend, record.data.path);
-    store.pushPayload('kv/metadata', {
-      modelName: 'kv/metadata',
-      ...record,
-    });
-  });
-};
-
-const META = {
-  currentPage: 1,
-  lastPage: 2,
-  nextPage: 2,
-  prevPage: 1,
-  total: 16,
-  filteredTotal: 16,
-  pageSize: 15,
-};
-
-module('Integration | Component | kv | Page::List', function (hooks) {
+module('Integration | Component | kv-v2 | Page::List', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'kv');
-  setupMirage(hooks);
 
   hooks.beforeEach(async function () {
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
-    this.store = this.owner.lookup('service:store');
+    const paginationMeta = {
+      currentPage: 1,
+      lastPage: 2,
+      nextPage: 2,
+      prevPage: 1,
+      total: 5,
+      filteredTotal: 5,
+      pageSize: 3,
+    };
+    this.secrets = ['secret-1', 'my-path/', 'secret-2'];
+    this.secrets.meta = paginationMeta;
+    this.pathToSecret = 'my-kv/';
+    this.backend = 'kv-engine';
+    this.filterValue = '';
+    this.failedDirectoryQuery = false;
+    this.breadcrumbs = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.backend, route: 'list' },
+    ];
+    this.capabilities = { canRead: true, canDelete: true };
+
+    this.renderComponent = () =>
+      render(
+        hbs`
+        <Page::List
+          @secrets={{this.secrets}}
+          @backend={{this.backend}}
+          @pathToSecret={{this.pathToSecret}}
+          @filterValue={{this.filterValue}}
+          @failedDirectoryQuery={{this.failedDirectoryQuery}}
+          @breadcrumbs={{this.breadcrumbs}}
+          @currentRouteParams={{array this.backend}}
+          @capabilities={{this.capabilities}}
+        />`,
+        { owner: this.engine }
+      );
+
+    this.transitionTo = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
+
     setRunOptions({
       rules: {
         // TODO: ConfirmAction renders modal within list when @isInDropdown
@@ -52,46 +65,95 @@ module('Integration | Component | kv | Page::List', function (hooks) {
     });
   });
 
-  test('it renders Pagination and allows you to delete a kv/metadata record', async function (assert) {
-    assert.expect(20);
-    CREATE_RECORDS(15, this.store, this.server);
-    this.model = await this.store.peekAll('kv/metadata');
-    this.model.meta = META;
-    this.backend = 'kv-engine';
-    this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.backend, route: 'list' },
-    ];
-    this.failedDirectoryQuery = false;
-    await render(
-      hbs`<Page::List
-      @secrets={{this.model}}
-      @backend={{this.backend}}
-      @failedDirectoryQuery={{this.failedDirectoryQuery}}
-      @breadcrumbs={{this.breadcrumbs}}
-      @meta={{this.model.meta}}
-    />`,
-      {
-        owner: this.engine,
-      }
+  test('it should render page title and toolbar elements', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(PAGE.title).includesText(this.backend, 'renders mount path as page title');
+    assert.dom(PAGE.secretTab('Secrets')).exists('renders Secrets tab');
+    assert.dom(PAGE.secretTab('Configuration')).exists('renders Configuration tab');
+    assert.dom(PAGE.list.filter).exists('renders filter input');
+    assert.dom(PAGE.list.createSecret).exists('renders create secret action');
+  });
+
+  test('it should render 403 state', async function (assert) {
+    this.secrets = 403;
+    this.failedDirectoryQuery = true;
+    await this.renderComponent();
+
+    assert.dom(PAGE.list.filter).doesNotExist('filter input is hidden');
+    assert.dom(PAGE.list.overviewCard).exists('renders overview card');
+    assert.dom(PAGE.list.overviewInput).hasValue('my-kv/', 'shows correct path in overview card input');
+
+    await typeIn(PAGE.list.overviewInput, 'my-dir/');
+    await click(GENERAL.submitButton);
+    assert.true(
+      this.transitionTo.calledWith('vault.cluster.secrets.backend.kv.list-directory', 'my-kv/my-dir/'),
+      'transitions to correct route if path is directory'
     );
+    assert
+      .dom(GENERAL.inlineAlert)
+      .hasText(
+        'You do not have the required permissions or the directory does not exist.',
+        'alert renders for failed directory query'
+      );
 
-    assert.dom(PAGE.list.pagination).exists('shows hds pagination component');
-    assert.dom(PAGE.list.paginationInfo).hasText('1–15 of 16', 'shows correct page of pages');
-    assert.dom(PAGE.title).includesText(this.backend, 'shows backend as title');
+    await fillIn(PAGE.list.overviewInput, '');
+    await typeIn(PAGE.list.overviewInput, 'secret');
+    await click(GENERAL.submitButton);
+    assert.true(
+      this.transitionTo.calledWith('vault.cluster.secrets.backend.kv.secret.index', 'secret'),
+      'transitions to correct route if path is not a directory'
+    );
+  });
 
-    this.model.forEach((record) => {
-      assert.dom(PAGE.list.item(record.path)).exists('lists all records from 0-14 on the first page');
-    });
+  test('it should render empty states', async function (assert) {
+    this.secrets = [];
+    await this.renderComponent();
+    assert.dom(GENERAL.emptyStateTitle).hasText('No secrets yet', 'empty state renders for no secrets');
 
-    this.server.delete(kvMetadataPath('kv-engine', 'my-secret-0'), () => {
-      assert.ok(true, 'request made to correct endpoint on delete metadata.');
-    });
+    this.filterValue = 'foo';
+    await this.renderComponent();
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('There are no secrets matching "foo".', 'empty state renders for no filter results');
+  });
 
-    const popupSelector = `${PAGE.list.item('my-secret-0')} ${PAGE.popup}`;
-    await click(popupSelector);
-    await click('[data-test-popup-metadata-delete]');
-    await click('[data-test-confirm-button]');
-    assert.dom(PAGE.list.item('my-secret-0')).doesNotExist('deleted the first record from the list');
+  test('it should render paginated secrets', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(PAGE.list.item()).exists({ count: 3 }, 'renders 3 secrets for first page');
+    assert.dom(PAGE.list.item('secret-1')).hasText('secret-1', 'secret path renders');
+    assert.dom(GENERAL.pagination).exists('renders hds pagination component');
+    assert.dom(GENERAL.paginationInfo).hasText('1–3 of 5', 'renders correct page information');
+  });
+
+  test('it should render list item menu', async function (assert) {
+    await this.renderComponent();
+
+    await click(`${PAGE.list.item('my-path/')} ${PAGE.popup}`);
+    assert.dom(PAGE.list.menuItem('Content')).exists('renders content menu item for directory');
+
+    await click(`${PAGE.list.item('secret-1')} ${PAGE.popup}`);
+    assert.dom(PAGE.list.menuItem('Overview')).exists('renders overview menu item');
+    assert.dom(PAGE.list.menuItem('Secret data')).exists('renders secret data menu item');
+    assert.dom(PAGE.list.menuItem('View version history')).exists('renders version history menu item');
+    assert.dom(PAGE.list.menuItem('Permanently delete')).exists('renders delete menu item');
+
+    await click(PAGE.list.menuItem('Permanently delete'));
+    assert
+      .dom(GENERAL.confirmMessage)
+      .hasText(
+        'This will permanently delete this secret and all its versions.',
+        'renders confirm modal on delete click'
+      );
+
+    this.deleteStub = sinon
+      .stub(this.owner.lookup('service:api').secrets, 'kvV2DeleteMetadataAndAllVersions')
+      .resolves();
+    await click(GENERAL.confirmButton);
+    assert.true(
+      this.deleteStub.calledWith('my-kv/secret-1', this.backend),
+      'makes request to delete secret on confirm'
+    );
   });
 });
diff --git a/ui/tests/integration/components/kv/page/kv-page-metadata-details-test.js b/ui/tests/integration/components/kv/page/kv-page-metadata-details-test.js
index 5063b1cbf63..7fdf72342b2 100644
--- a/ui/tests/integration/components/kv/page/kv-page-metadata-details-test.js
+++ b/ui/tests/integration/components/kv/page/kv-page-metadata-details-test.js
@@ -1,137 +1,118 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
-import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { kvDataPath, kvMetadataPath } from 'vault/utils/kv-path';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
 import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
+import { dateFormat } from 'core/helpers/date-format';
 
 module('Integration | Component | kv-v2 | Page::Secret::Metadata::Details', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'kv');
-  setupMirage(hooks);
 
   hooks.beforeEach(async function () {
-    this.store = this.owner.lookup('service:store');
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
+    this.metadata = {
+      custom_metadata: null,
+      max_versions: 15,
+      cas_required: true,
+      delete_version_after: '4h30m',
+      updated_time: '2025-09-16T22:19:59.916935Z',
+    };
     this.backend = 'kv-engine';
     this.path = 'my-secret';
-    this.dataId = kvDataPath(this.backend, this.path);
-    this.metadataId = kvMetadataPath(this.backend, this.path);
-
-    this.metadataModel = (withCustom = false) => {
-      const metadata = withCustom
-        ? this.server.create('kv-metadatum', 'withCustomMetadata')
-        : this.server.create('kv-metadatum');
-      metadata.id = this.metadataId;
-      this.store.pushPayload('kv/metadata', {
-        modelName: 'kv/metadata',
-        ...metadata,
-      });
-      return this.store.peekRecord('kv/metadata', this.metadataId);
+    this.capabilities = {
+      canReadMetadata: true,
+      canUpdateMetadata: true,
+      canDeleteMetadata: true,
+      canReadData: true,
     };
+    this.breadcrumbs = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.backend, route: 'list' },
+      { label: this.path },
+    ];
 
-    this.metadata = this.metadataModel();
+    this.renderComponent = () =>
+      render(
+        hbs`
+          <Page::Secret::Metadata::Details
+            @backend={{this.backend}}
+            @breadcrumbs={{this.breadcrumbs}}
+            @capabilities={{this.capabilities}}
+            @metadata={{this.metadata}}
+            @path={{this.path}}
+          />
+        `,
+        { owner: this.engine }
+      );
+  });
 
-    // empty secret model always exists for permissions
-    this.store.pushPayload('kv/data', {
-      modelName: 'kv/data',
-      id: this.dataId,
-      custom_metadata: null,
-    });
-    this.secret = this.store.peekRecord('kv/data', this.dataId);
+  test('it should render page title and toolbar elements', async function (assert) {
+    await this.renderComponent();
 
-    // this is the route model, not an ember data model
-    this.model = {
-      backend: this.backend,
-      path: this.path,
-      secret: this.secret,
-      metadata: this.metadata,
-    };
-    this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.model.backend, route: 'list' },
-      { label: this.model.path },
-    ];
+    assert.dom(PAGE.title).includesText(this.path, 'renders secret path as page title');
+    assert.dom(PAGE.secretTab('Overview')).exists('renders Secrets tab');
+    assert.dom(PAGE.secretTab('Secret')).exists('renders Secret tab');
+    assert.dom(PAGE.secretTab('Metadata')).exists('renders Metadata tab');
+    assert.dom(PAGE.secretTab('Paths')).exists('renders Paths tab');
+    assert.dom(PAGE.secretTab('Version History')).exists('renders Version History tab');
   });
 
   test('it renders metadata details', async function (assert) {
-    assert.expect(8);
-    this.metadata = this.metadataModel();
-    await render(
-      hbs`
-       <Page::Secret::Metadata::Details
-        @path={{this.model.path}}
-        @secret={{this.model.secret}}
-        @metadata={{this.model.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
+    assert.expect(7);
+    await this.renderComponent();
 
-    assert.dom(PAGE.title).includesText(this.model.path, 'renders secret path as page title');
     assert.dom(PAGE.emptyStateTitle).hasText('No custom metadata', 'renders the correct empty state');
     assert.dom(PAGE.metadata.deleteMetadata).exists();
     assert.dom(PAGE.metadata.editBtn).exists();
 
     // Metadata details
+    const expectedTime = dateFormat([this.metadata.updated_time, 'MMM d, yyyy hh:mm aa'], {});
     assert
       .dom(PAGE.infoRowValue('Last updated'))
-      .hasTextContaining('Mar', 'Displays updated date with formatting');
+      .hasTextContaining(expectedTime, 'Displays updated date with formatting');
     assert.dom(PAGE.infoRowValue('Maximum versions')).hasText('15');
     assert.dom(PAGE.infoRowValue('Check-and-Set required')).hasText('Yes');
     assert
       .dom(PAGE.infoRowValue('Delete version after'))
-      .hasText('3 hours 25 minutes 19 seconds', 'correctly shows and formats the timestamp.');
+      .hasText('4 hours 30 minutes', 'correctly shows and formats the timestamp.');
   });
 
-  test('it renders custom metadata from secret model', async function (assert) {
-    assert.expect(2);
-    this.metadata = this.metadataModel();
-    this.secret.customMetadata = { hi: 'there' };
-    await render(
-      hbs`
-       <Page::Secret::Metadata::Details
-        @path={{this.model.path}}
-        @secret={{this.model.secret}}
-        @metadata={{this.model.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
-
-    assert.dom(PAGE.emptyStateTitle).doesNotExist();
-    assert.dom(PAGE.infoRowValue('hi')).hasText('there', 'renders custom metadata from secret');
+  test('it renders empty state if cannot read metadata but can read data', async function (assert) {
+    // this.metadata = null;
+    this.capabilities.canReadMetadata = false;
+    this.capabilities.canReadData = true;
+    await this.renderComponent();
+    assert
+      .dom(`${PAGE.metadata.customMetadataSection} ${PAGE.emptyStateTitle}`)
+      .hasText('Request custom metadata?');
   });
 
-  test('it renders custom metadata from metadata model', async function (assert) {
-    assert.expect(4);
-    this.metadata = this.metadataModel({ withCustom: true });
-    await render(
-      hbs`
-       <Page::Secret::Metadata::Details
-        @path={{this.model.path}}
-        @secret={{this.model.secret}}
-        @metadata={{this.model.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
+  test('it renders custom metadata', async function (assert) {
+    assert.expect(3);
+    this.metadata.custom_metadata = { foo: 'bar', bar: 'baz' };
+    await this.renderComponent();
 
     assert.dom(PAGE.emptyStateTitle).doesNotExist();
     // Metadata details
-    assert.dom(PAGE.infoRowValue('foo')).hasText('abc');
-    assert.dom(PAGE.infoRowValue('bar')).hasText('123');
-    assert.dom(PAGE.infoRowValue('baz')).hasText('5c07d823-3810-48f6-a147-4c06b5219e84');
+    assert.dom(PAGE.infoRowValue('foo')).hasText('bar');
+    assert.dom(PAGE.infoRowValue('bar')).hasText('baz');
+  });
+
+  test('it hides delete modal when no permissions', async function (assert) {
+    this.capabilities.canDeleteMetadata = false;
+    await this.renderComponent();
+    assert.dom(PAGE.metadata.deleteMetadata).doesNotExist();
+  });
+
+  test('it hides edit action when no permissions', async function (assert) {
+    this.capabilities.canUpdateMetadata = false;
+    await this.renderComponent();
+    assert.dom(PAGE.metadata.editBtn).doesNotExist();
   });
 });
diff --git a/ui/tests/integration/components/kv/page/kv-page-metadata-edit-test.js b/ui/tests/integration/components/kv/page/kv-page-metadata-edit-test.js
index 8170e44c532..1dd59e06a69 100644
--- a/ui/tests/integration/components/kv/page/kv-page-metadata-edit-test.js
+++ b/ui/tests/integration/components/kv/page/kv-page-metadata-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,56 +10,61 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, fillIn, click } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import sinon from 'sinon';
-import { kvMetadataPath } from 'vault/utils/kv-path';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
 import { FORM, PAGE } from 'vault/tests/helpers/kv/kv-selectors';
+import KvForm from 'vault/forms/secrets/kv';
 
-module('Integration | Component | kv | Page::Secret::Metadata::Edit', function (hooks) {
+module('Integration | Component | kv-v2 | Page::Secret::Metadata::Edit', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'kv');
   setupMirage(hooks);
 
   hooks.beforeEach(async function () {
-    this.onCancel = sinon.spy();
-    const store = this.owner.lookup('service:store');
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
-    const data = this.server.create('kv-metadatum', 'withCustomMetadata');
-    data.id = kvMetadataPath('kv-engine', 'my-secret');
-    store.pushPayload('kv/metadatum', {
-      modelName: 'kv/metadata',
-      ...data,
-    });
-    // Used to test a model with custom_metadata and non-default inputs.
-    this.metadataModelEdit = store.peekRecord('kv/metadata', data.id);
-    // Used to test a model with no custom_metadata and default values.
-    this.metadataModelCreate = store.createRecord('kv/metadata', {
-      backend: 'kv-engine-new',
-      path: 'my-secret-new',
+    this.path = 'my-secret';
+    this.form = new KvForm({
+      path: this.path,
+      custom_metadata: { foo: 'bar' },
+      max_versions: 15,
+      cas_required: true,
+      delete_version_after: '4h30m',
     });
+    this.backend = 'my-kv';
+    this.breadcrumbs = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.backend, route: 'list' },
+      { label: this.path, route: 'secret.details', model: this.path },
+      { label: 'Metadata' },
+    ];
+    this.capabilities = { canUpdateMetadata: true };
+    this.onCancel = sinon.spy();
+    this.onSave = sinon.spy();
+
+    this.renderComponent = () =>
+      render(
+        hbs`
+          <Page::Secret::Metadata::Edit
+            @form={{this.form}}
+            @backend={{this.backend}}
+            @breadcrumbs={{this.breadcrumbs}}
+            @capabilities={{this.capabilities}}
+            @onCancel={{this.onCancel}}
+            @onSave={{this.onSave}}
+          />
+        `,
+        { owner: this.engine }
+      );
   });
 
   test('it renders all inputs for a model that has all default values', async function (assert) {
     assert.expect(5);
-    this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.metadataModelCreate.backend, route: 'list' },
-      { label: this.metadataModelCreate.path, route: 'secret.details', model: this.metadataModelCreate.path },
-      { label: 'metadata' },
-    ];
-    await render(
-      hbs`
-      <Page::Secret::Metadata::Edit
-        @metadata={{this.metadataModelCreate}}
-        @breadcrumbs={{this.breadcrumbs}}
-        @onCancel={{this.onCancel}}
-        @onSave={{this.onSave}} />`,
-      {
-        owner: this.engine,
-      }
-    );
-    assert.dom(FORM.kvRow).exists({ count: 1 }, 'renders one kv row when model is new.');
-    assert.dom(FORM.inputByAttr('maxVersions')).exists('renders Max versions.');
-    assert.dom(FORM.inputByAttr('casRequired')).exists('renders Required Check and Set.');
+
+    this.form.data.custom_metadata = null;
+    this.form.data.delete_version_after = null;
+
+    await this.renderComponent();
+
+    assert.dom(FORM.kvRow).exists({ count: 1 }, 'renders one kv row for custom metadata');
+    assert.dom(FORM.inputByAttr('max_versions')).exists('renders Max versions.');
+    assert.dom(FORM.inputByAttr('cas_required')).exists('renders Required Check and Set.');
     assert
       .dom('[data-test-toggle-label="Automate secret deletion"]')
       .exists('the label for automate secret deletion renders.');
@@ -69,112 +74,66 @@ module('Integration | Component | kv | Page::Secret::Metadata::Edit', function (
   });
 
   test('it displays previous inputs from metadata record and saves new values', async function (assert) {
-    assert.expect(5);
-    this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.metadataModelEdit.backend, route: 'list' },
-      { label: this.metadataModelEdit.path, route: 'secret.details', model: this.metadataModelEdit.path },
-      { label: 'metadata' },
-    ];
-    await render(
-      hbs`
-      <Page::Secret::Metadata::Edit
-        @metadata={{this.metadataModelEdit}}
-        @breadcrumbs={{this.breadcrumbs}}
-        @onCancel={{this.onCancel}}
-        @onSave={{this.onSave}} />`,
-      {
-        owner: this.engine,
-      }
-    );
-    assert
-      .dom(FORM.kvRow)
-      .exists({ count: 4 }, 'renders all kv rows including previous data and one extra to fill out.');
+    assert.expect(7);
+
+    await this.renderComponent();
+
+    assert.dom(FORM.keyInput()).hasValue('foo', 'renders custom metadata key');
+    assert.dom(FORM.valueInput()).hasValue('bar', 'renders custom metadata value');
     assert
-      .dom(FORM.inputByAttr('maxVersions'))
+      .dom(FORM.inputByAttr('max_versions'))
       .hasValue('15', 'renders Max versions that was on the record.');
     assert
-      .dom(FORM.inputByAttr('casRequired'))
+      .dom(FORM.inputByAttr('cas_required'))
       .hasValue('on', 'renders Required Check and Set that was on the record.');
     assert
       .dom(FORM.ttlValue('Automate secret deletion'))
-      .hasValue('12319', 'renders Automate secret deletion that was on the record.');
-
-    // change the "Additional option" values
-    await click(FORM.deleteRow()); // delete the first kv row
-    await fillIn(FORM.keyInput(2), 'last');
-    await fillIn(FORM.valueInput(2), 'value');
-    await fillIn(FORM.inputByAttr('maxVersions'), '8');
-    await click(FORM.inputByAttr('casRequired'));
-    await fillIn(FORM.ttlValue('Automate secret deletion'), '1000');
-    // save test and check record
-    this.server.post('/kv-engine/metadata/my-secret', (schema, req) => {
-      const data = JSON.parse(req.requestBody);
-      const expected = {
-        max_versions: 8,
-        cas_required: false,
-        delete_version_after: '1000s',
-        custom_metadata: {
-          baz: '5c07d823-3810-48f6-a147-4c06b5219e84',
-          foo: 'abc',
-          last: 'value',
-        },
-      };
-      assert.propEqual(data, expected, 'POST request made to save metadata with correct properties.');
-    });
+      .hasValue('270', 'renders Automate secret deletion that was on the record.'); // 4h30m = 270m
+
+    // update values
+    await fillIn(FORM.keyInput(1), 'last');
+    await fillIn(FORM.valueInput(1), 'value');
+    await fillIn(FORM.inputByAttr('max_versions'), '8');
+    await click(FORM.inputByAttr('cas_required'));
+    await fillIn(FORM.ttlValue('Automate secret deletion'), '60'); // 60m = 3600s
+
+    this.writeStub = sinon.stub(this.owner.lookup('service:api').secrets, 'kvV2WriteMetadata').resolves();
+    const metadata = {
+      max_versions: '8',
+      cas_required: false,
+      delete_version_after: '3600s',
+      custom_metadata: {
+        foo: 'bar',
+        last: 'value',
+      },
+    };
     await click(FORM.saveBtn);
+    assert.true(this.writeStub.calledWith(this.path, this.backend, metadata), 'updated metadata is saved');
+    assert.true(this.onSave.called, 'onSave action is called');
   });
 
   test('it displays validation errors and does not save inputs on cancel', async function (assert) {
     assert.expect(2);
-    this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.metadataModelEdit.backend, route: 'list' },
-      { label: this.metadataModelEdit.path, route: 'secret.details', model: this.metadataModelEdit.path },
-      { label: 'metadata' },
-    ];
-    await render(
-      hbs`
-      <Page::Secret::Metadata::Edit
-        @metadata={{this.metadataModelEdit}}
-        @breadcrumbs={{this.breadcrumbs}}
-        @onCancel={{this.onCancel}}
-        @onSave={{this.onSave}} />`,
-      {
-        owner: this.engine,
-      }
-    );
+
+    await this.renderComponent();
+
     // trigger validation error
-    await fillIn(FORM.inputByAttr('maxVersions'), 'a');
+    await fillIn(FORM.inputByAttr('max_versions'), 'a');
     await click(FORM.saveBtn);
     assert
-      .dom(FORM.inlineAlert)
+      .dom(FORM.validationError('max_versions'))
       .hasText('Maximum versions must be a number.', 'Validation message is shown for max_versions');
 
     await click(FORM.cancelBtn);
-    assert.strictEqual(this.metadataModelEdit.maxVersions, 15, 'Model is rolled back on cancel.');
+    assert.true(this.onCancel.called, 'onCancel action is called');
   });
 
   test('it shows an empty state if user does not have metadata update permissions', async function (assert) {
     assert.expect(1);
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub('list'));
-    this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.metadataModelEdit.backend, route: 'list' },
-      { label: this.metadataModelEdit.path, route: 'secret.details', model: this.metadataModelEdit.path },
-      { label: 'metadata' },
-    ];
-    await render(
-      hbs`
-      <Page::Secret::Metadata::Edit
-        @metadata={{this.metadataModelEdit}}
-        @breadcrumbs={{this.breadcrumbs}}
-        @onCancel={{this.onCancel}}
-        @onSave={{this.onSave}} />`,
-      {
-        owner: this.engine,
-      }
-    );
+
+    this.capabilities.canUpdateMetadata = false;
+    await this.renderComponent();
+
     assert.dom(PAGE.emptyStateTitle).hasText('You do not have permissions to edit metadata');
   });
 });
diff --git a/ui/tests/integration/components/kv/page/kv-page-overview-test.js b/ui/tests/integration/components/kv/page/kv-page-overview-test.js
new file mode 100644
index 00000000000..33a5a601fae
--- /dev/null
+++ b/ui/tests/integration/components/kv/page/kv-page-overview-test.js
@@ -0,0 +1,363 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { setupEngine } from 'ember-engines/test-support';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { dateFormat } from 'core/helpers/date-format';
+import { dateFromNow } from 'core/helpers/date-from-now';
+
+const { overviewCard } = GENERAL;
+
+// subkeys access is enterprise only (in the GUI) but we don't have any version testing here because the @subkeys arg is null for non-enterprise versions
+module('Integration | Component | kv-v2 | Page::Secret::Overview', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'kv');
+
+  hooks.beforeEach(async function () {
+    this.backend = 'kv-engine';
+    this.path = 'my-secret';
+    this.breadcrumbs = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.backend, route: 'list' },
+      { label: this.path },
+    ];
+    this.metadata = {
+      current_version: 1,
+      updated_time: '2023-07-21T03:11:58.095971Z',
+      versions: {
+        1: {
+          created_time: '2018-03-22T02:24:06.945319214Z',
+          deletion_time: '',
+          destroyed: false,
+        },
+        2: {
+          created_time: '2023-07-20T02:15:35.86465Z',
+          deletion_time: '2023-07-25T00:36:19.950545Z',
+          destroyed: false,
+        },
+      },
+    };
+    this.subkeys = {
+      subkeys: {
+        foo: null,
+        bar: {
+          baz: null,
+        },
+        quux: null,
+      },
+      metadata: {
+        created_time: '2021-12-14T20:28:00.773477Z',
+        custom_metadata: null,
+        deletion_time: '',
+        destroyed: false,
+        version: 1,
+      },
+    };
+    this.capabilities = { canReadMetadata: true, canUpdateData: true };
+    this.isPatchAllowed = false;
+
+    this.format = (time) => dateFormat([time, 'MMM d yyyy, h:mm:ss aa'], {});
+    this.renderComponent = async () => {
+      return render(
+        hbs`
+          <Page::Secret::Overview
+            @backend={{this.backend}}
+            @breadcrumbs={{this.breadcrumbs}}
+            @capabilities={{this.capabilities}}
+            @isPatchAllowed={{this.isPatchAllowed}}
+            @metadata={{this.metadata}}
+            @path={{this.path}}
+            @subkeys={{this.subkeys}}
+          />
+        `,
+        { owner: this.engine }
+      );
+    };
+  });
+
+  module('active secret (version not deleted or destroyed)', function () {
+    test('it renders tabs', async function (assert) {
+      await this.renderComponent();
+      const tabs = ['Overview', 'Secret', 'Metadata', 'Paths', 'Version History'];
+      for (const tab of tabs) {
+        assert.dom(PAGE.secretTab(tab)).hasText(tab);
+      }
+    });
+
+    test('it renders header', async function (assert) {
+      await this.renderComponent();
+      assert.dom(PAGE.breadcrumbs).hasText(`Secrets ${this.backend} ${this.path}`);
+      assert.dom(PAGE.title).hasText(this.path);
+    });
+
+    test('it renders with full permissions', async function (assert) {
+      await this.renderComponent();
+      const fromNow = dateFromNow([this.metadata.updated_time]); // uses date-fns so can't stub timestamp util
+      assert.dom(`${overviewCard.container('Current version')} .hds-badge`).doesNotExist();
+      assert
+        .dom(overviewCard.container('Current version'))
+        .hasText(
+          `Current version Create new The current version of this secret. ${this.metadata.current_version}`
+        );
+      assert
+        .dom(overviewCard.container('Secret age'))
+        .hasText(
+          `Secret age View metadata Current secret version age. Last updated on ${this.format(
+            this.metadata.updated_time
+          )}. ${fromNow}`
+        );
+      assert
+        .dom(overviewCard.container('Paths'))
+        .hasText(
+          `Paths The paths to use when referring to this secret in API or CLI. API path /v1/${this.backend}/data/${this.path} CLI path -mount="${this.backend}" "${this.path}"`
+        );
+      assert
+        .dom(overviewCard.container('Subkeys'))
+        .hasText(
+          `Subkeys JSON The table is displaying the top level subkeys. Toggle on the JSON view to see the full depth. Keys ${Object.keys(
+            this.subkeys.subkeys
+          ).join(' ')}`
+        );
+    });
+
+    test('it hides link when no secret update permissions', async function (assert) {
+      // creating a new version of a secret is updating a secret
+      // the overview only exists after an initial version is created
+      // which is why we just check for update and not also create
+      this.capabilities.canUpdateData = false;
+      await this.renderComponent();
+      assert
+        .dom(`${overviewCard.container('Current version')} a`)
+        .doesNotExist('create link does not render');
+      assert
+        .dom(overviewCard.container('Current version'))
+        .hasText(`Current version The current version of this secret. ${this.metadata.current_version}`);
+    });
+
+    test('it renders with no metadata permissions', async function (assert) {
+      this.metadata = null;
+      this.capabilities.canReadMetadata = false;
+      // all secret metadata instead comes from subkeys endpoint
+      const subkeyMeta = this.subkeys.metadata;
+      await this.renderComponent();
+      const fromNow = dateFromNow([subkeyMeta.created_time]); // uses date-fns so can't stub timestamp util
+      assert
+        .dom(overviewCard.container('Current version'))
+        .hasText(`Current version Create new The current version of this secret. ${subkeyMeta.version}`);
+      assert
+        .dom(overviewCard.container('Secret age'))
+        .hasText(
+          `Secret age Current secret version age. Last updated on ${this.format(
+            subkeyMeta.created_time
+          )}. ${fromNow}`
+        );
+      assert.dom(`${overviewCard.container('Secret age')} a`).doesNotExist('metadata link does not render');
+      assert
+        .dom(overviewCard.container('Paths'))
+        .hasText(
+          `Paths The paths to use when referring to this secret in API or CLI. API path /v1/${this.backend}/data/${this.path} CLI path -mount="${this.backend}" "${this.path}"`
+        );
+      assert
+        .dom(overviewCard.container('Subkeys'))
+        .hasText(
+          `Subkeys JSON The table is displaying the top level subkeys. Toggle on the JSON view to see the full depth. Keys ${Object.keys(
+            this.subkeys.subkeys
+          ).join(' ')}`
+        );
+    });
+
+    test('it renders with no subkeys permissions', async function (assert) {
+      this.subkeys = null;
+      await this.renderComponent();
+      const fromNow = dateFromNow([this.metadata.updated_time]); // uses date-fns so can't stub timestamp util
+      const expectedTime = this.format(this.metadata.updated_time);
+      assert
+        .dom(overviewCard.container('Current version'))
+        .hasText(
+          `Current version Create new The current version of this secret. ${this.metadata.current_version}`
+        );
+      assert
+        .dom(overviewCard.container('Secret age'))
+        .hasText(
+          `Secret age View metadata Current secret version age. Last updated on ${expectedTime}. ${fromNow}`
+        );
+      assert
+        .dom(overviewCard.container('Paths'))
+        .hasText(
+          `Paths The paths to use when referring to this secret in API or CLI. API path /v1/${this.backend}/data/${this.path} CLI path -mount="${this.backend}" "${this.path}"`
+        );
+      assert.dom(overviewCard.container('Subkeys')).doesNotExist();
+    });
+
+    test('it renders with no subkey or metadata permissions', async function (assert) {
+      this.subkeys = null;
+      this.metadata = null;
+      await this.renderComponent();
+      assert.dom(overviewCard.container('Current version')).doesNotExist();
+      assert.dom(overviewCard.container('Secret age')).doesNotExist();
+      assert.dom(overviewCard.container('Subkeys')).doesNotExist();
+      assert
+        .dom(overviewCard.container('Paths'))
+        .hasText(
+          `Paths The paths to use when referring to this secret in API or CLI. API path /v1/${this.backend}/data/${this.path} CLI path -mount="${this.backend}" "${this.path}"`
+        );
+    });
+  });
+
+  module('deleted version', function (hooks) {
+    hooks.beforeEach(async function () {
+      // subkeys is null but metadata still has data
+      this.subkeys = {
+        subkeys: null,
+        metadata: {
+          created_time: '2021-12-14T20:28:00.773477Z',
+          custom_metadata: null,
+          deletion_time: '2023-07-25T00:36:19.950545Z',
+          destroyed: false,
+          version: 1,
+        },
+      };
+      this.metadata.current_version = 2;
+      this.assertBadge = (assert) => {
+        assert
+          .dom(`${overviewCard.container('Current version')} .hds-badge`)
+          .hasClass('hds-badge--color-neutral');
+        assert
+          .dom(`${overviewCard.container('Current version')} .hds-badge`)
+          .hasClass('hds-badge--type-inverted');
+        assert.dom(`${overviewCard.container('Current version')} .hds-badge`).hasText('Deleted');
+      };
+    });
+
+    test('with full permissions', async function (assert) {
+      const expectedTime = this.format(this.metadata.versions[2].deletion_time);
+      await this.renderComponent();
+      this.assertBadge(assert);
+      assert
+        .dom(overviewCard.container('Current version'))
+        .hasText(
+          `Current version Deleted Create new The current version of this secret was deleted ${expectedTime}. ${this.metadata.current_version}`
+        );
+      assert.dom(overviewCard.container('Secret age')).doesNotExist();
+      assert.dom(overviewCard.container('Subkeys')).doesNotExist();
+      assert
+        .dom(overviewCard.container('Paths'))
+        .hasText(
+          `Paths The paths to use when referring to this secret in API or CLI. API path /v1/${this.backend}/data/${this.path} CLI path -mount="${this.backend}" "${this.path}"`
+        );
+    });
+
+    test('with no metadata permissions', async function (assert) {
+      this.metadata = null;
+      const expectedTime = this.format(this.subkeys.metadata.deletion_time);
+      await this.renderComponent();
+      this.assertBadge(assert);
+      assert
+        .dom(overviewCard.container('Current version'))
+        .hasText(
+          `Current version Deleted Create new The current version of this secret was deleted ${expectedTime}. ${this.subkeys.metadata.version}`
+        );
+    });
+
+    test('with no subkey permissions', async function (assert) {
+      this.subkeys = null;
+      const expectedTime = this.format(this.metadata.versions[2].deletion_time);
+      await this.renderComponent();
+      this.assertBadge(assert);
+      assert
+        .dom(overviewCard.container('Current version'))
+        .hasText(
+          `Current version Deleted Create new The current version of this secret was deleted ${expectedTime}. ${this.metadata.current_version}`
+        );
+      assert.dom(overviewCard.container('Subkeys')).doesNotExist();
+    });
+
+    test('with no permissions', async function (assert) {
+      this.subkeys = null;
+      this.metadata = null;
+      await this.renderComponent();
+      assert.dom(overviewCard.container('Current version')).doesNotExist();
+    });
+  });
+
+  module('destroyed version', function (hooks) {
+    hooks.beforeEach(async function () {
+      // subkeys is null but metadata still has data
+      this.subkeys = {
+        subkeys: null,
+        metadata: {
+          created_time: '2024-08-15T01:24:43.658478Z',
+          custom_metadata: null,
+          deletion_time: '',
+          destroyed: true,
+          version: 1,
+        },
+      };
+      this.metadata.versions[2].destroyed = true;
+      this.metadata.current_version = 2;
+      this.assertBadge = (assert) => {
+        assert
+          .dom(`${overviewCard.container('Current version')} .hds-badge`)
+          .hasClass('hds-badge--color-critical');
+        assert
+          .dom(`${overviewCard.container('Current version')} .hds-badge`)
+          .hasClass('hds-badge--type-outlined');
+        assert.dom(`${overviewCard.container('Current version')} .hds-badge`).hasText('Destroyed');
+      };
+    });
+
+    test('with full permissions', async function (assert) {
+      await this.renderComponent();
+      this.assertBadge(assert);
+      assert
+        .dom(overviewCard.container('Current version'))
+        .hasText(
+          `Current version Destroyed Create new The current version of this secret has been permanently deleted and cannot be restored. ${this.metadata.current_version}`
+        );
+      assert.dom(overviewCard.container('Secret age')).doesNotExist();
+      assert.dom(overviewCard.container('Subkeys')).doesNotExist();
+      assert
+        .dom(overviewCard.container('Paths'))
+        .hasText(
+          `Paths The paths to use when referring to this secret in API or CLI. API path /v1/${this.backend}/data/${this.path} CLI path -mount="${this.backend}" "${this.path}"`
+        );
+    });
+
+    test('with no metadata permissions', async function (assert) {
+      this.metadata = null;
+      await this.renderComponent();
+      this.assertBadge(assert);
+      assert
+        .dom(overviewCard.container('Current version'))
+        .hasText(
+          `Current version Destroyed Create new The current version of this secret has been permanently deleted and cannot be restored. ${this.subkeys.metadata.version}`
+        );
+    });
+
+    test('with no subkeys permissions', async function (assert) {
+      this.subkeys = null;
+      await this.renderComponent();
+      this.assertBadge(assert);
+      assert
+        .dom(overviewCard.container('Current version'))
+        .hasText(
+          `Current version Destroyed Create new The current version of this secret has been permanently deleted and cannot be restored. ${this.metadata.current_version}`
+        );
+      assert.dom(overviewCard.container('Subkeys')).doesNotExist();
+    });
+
+    test('with no permissions', async function (assert) {
+      this.subkeys = null;
+      this.metadata = null;
+      await this.renderComponent();
+      assert.dom(overviewCard.container('Current version')).doesNotExist();
+    });
+  });
+});
diff --git a/ui/tests/integration/components/kv/page/kv-page-patch-test.js b/ui/tests/integration/components/kv/page/kv-page-patch-test.js
new file mode 100644
index 00000000000..5c1acb661e3
--- /dev/null
+++ b/ui/tests/integration/components/kv/page/kv-page-patch-test.js
@@ -0,0 +1,351 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { setupEngine } from 'ember-engines/test-support';
+import { blur, click, fillIn, find, render, waitUntil } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import sinon from 'sinon';
+import { FORM, PAGE } from 'vault/tests/helpers/kv/kv-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import codemirror, { setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+import { encodePath } from 'vault/utils/path-encoding-helpers';
+import { getErrorResponse } from 'vault/tests/helpers/api/error-response';
+
+module('Integration | Component | kv-v2 | Page::Secret::Patch', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'kv');
+
+  hooks.beforeEach(async function () {
+    this.transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
+    this.backend = 'kv-engine';
+    this.path = 'my-secret';
+    this.metadata = { current_version: 4 };
+    this.breadcrumbs = [
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.backend, route: 'list' },
+      { label: this.path, route: 'index' },
+      { label: 'Patch' },
+    ];
+    this.subkeys = {
+      foo: null,
+      bar: {
+        baz: null,
+      },
+      quux: null,
+    };
+    this.subkeysMeta = {
+      created_time: '2021-12-14T20:28:00.773477Z',
+      custom_metadata: null,
+      deletion_time: '',
+      destroyed: false,
+      version: 1,
+    };
+
+    this.renderComponent = async () => {
+      return render(
+        hbs`
+        <Page::Secret::Patch
+          @backend={{this.backend}}
+          @breadcrumbs={{this.breadcrumbs}}
+          @metadata={{this.metadata}}
+          @path={{this.path}}
+          @subkeys={{this.subkeys}}
+          @subkeysMeta={{this.subkeysMeta}}
+        />`,
+        { owner: this.engine }
+      );
+    };
+  });
+
+  test('it renders', async function (assert) {
+    await this.renderComponent();
+    assert.dom(PAGE.breadcrumbs).hasText(`Secrets ${this.backend} ${this.path} Patch`);
+    assert.dom(PAGE.title).hasText('Patch Secret to New Version');
+    assert.dom(GENERAL.fieldByAttr('Path')).isDisabled();
+    assert.dom(GENERAL.fieldByAttr('Path')).hasValue(this.path);
+    assert.dom(GENERAL.inputByAttr('JSON')).isNotChecked();
+    assert.dom(GENERAL.inputByAttr('UI')).isChecked();
+    assert.dom(FORM.patchEditorForm).exists('it renders editor form by default');
+    assert.dom(GENERAL.codemirror).doesNotExist();
+    Object.keys(this.subkeys).forEach((key, idx) => {
+      assert.dom(FORM.keyInput(idx)).hasValue(key);
+      assert.dom(FORM.keyInput(idx)).isDisabled();
+    });
+  });
+
+  test('it selects JSON as an edit option', async function (assert) {
+    await this.renderComponent();
+    assert.dom(FORM.patchEditorForm).exists();
+    await click(GENERAL.inputByAttr('JSON'));
+    assert.dom(GENERAL.inputByAttr('JSON')).isChecked();
+    assert.dom(GENERAL.inputByAttr('UI')).isNotChecked();
+    assert.dom(FORM.patchEditorForm).doesNotExist();
+    assert.dom(GENERAL.codemirror).exists();
+  });
+
+  test('it transitions on cancel', async function (assert) {
+    await this.renderComponent();
+    await click(FORM.cancelBtn);
+    const [route] = this.transitionStub.lastCall.args;
+    assert.strictEqual(
+      route,
+      'vault.cluster.secrets.backend.kv.secret.index',
+      `it transitions on cancel to: ${route}`
+    );
+  });
+
+  module('it submits', function (hooks) {
+    const EXAMPLE_KV_DATA_CREATE_RESPONSE = {
+      request_id: 'foobar',
+      data: {
+        created_time: '2023-06-21T16:18:31.479993Z',
+        custom_metadata: null,
+        deletion_time: '',
+        destroyed: false,
+        version: 1,
+      },
+    };
+
+    hooks.beforeEach(async function () {
+      this.endpoint = `${encodePath(this.backend)}/data/${encodePath(this.path)}`;
+      this.patchStub = sinon
+        .stub(this.owner.lookup('service:api').secrets, 'kvV2Patch')
+        .resolves(EXAMPLE_KV_DATA_CREATE_RESPONSE);
+    });
+
+    test('patch data from kv editor form', async function (assert) {
+      assert.expect(2);
+
+      await this.renderComponent();
+      // patch existing, delete and create a new key key
+      await click(FORM.patchEdit());
+      await fillIn(FORM.valueInput(), 'foovalue');
+      await blur(FORM.valueInput());
+      await click(FORM.patchDelete(1));
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), '1');
+      await click(FORM.patchAdd);
+      // add new key and do NOT click add
+      await fillIn(FORM.keyInput('new'), 'bKey');
+      await fillIn(FORM.valueInput('new'), 'null');
+      await click(FORM.saveBtn);
+
+      const payload = {
+        data: { bar: null, foo: 'foovalue', aKey: '1', bKey: 'null' },
+        options: {
+          cas: this.metadata.current_version,
+        },
+      };
+      assert.true(
+        this.patchStub.calledWith(this.path, this.backend, payload),
+        'Patch request made with correct args'
+      );
+      assert.true(
+        this.transitionStub.calledWith('vault.cluster.secrets.backend.kv.secret.index'),
+        'transitions to overview route on save'
+      );
+    });
+
+    test('patch data from json form', async function (assert) {
+      assert.expect(2);
+
+      await this.renderComponent();
+      await click(GENERAL.inputByAttr('JSON'));
+      await waitUntil(() => find('.cm-editor'));
+      const editor = codemirror();
+      setCodeEditorValue(editor, '{ "foo": "foovalue", "bar":null, "number":1 }');
+      await click(FORM.saveBtn);
+
+      const payload = {
+        data: { foo: 'foovalue', bar: null, number: 1 },
+        options: {
+          cas: this.metadata.current_version,
+        },
+      };
+      assert.true(
+        this.patchStub.calledWith(this.path, this.backend, payload),
+        'Patch request made with correct args'
+      );
+      assert.true(
+        this.transitionStub.calledWith('vault.cluster.secrets.backend.kv.secret.index'),
+        'transitions to overview route on save'
+      );
+    });
+
+    // this assertion confirms submit allows empty values
+    test('empty string values from kv editor form', async function (assert) {
+      assert.expect(1);
+
+      await this.renderComponent();
+      await click(FORM.patchEdit());
+      // edit existing key's value
+      await fillIn(FORM.valueInput(), '');
+      // add a new key with empty value, click add
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), '');
+      await click(FORM.patchAdd);
+      // add new key and do NOT click add
+      await fillIn(FORM.keyInput('new'), 'bKey');
+      await fillIn(FORM.valueInput('new'), '');
+      await click(FORM.saveBtn);
+
+      const payload = {
+        data: { foo: '', aKey: '', bKey: '' },
+        options: {
+          cas: this.metadata.current_version,
+        },
+      };
+      assert.true(
+        this.patchStub.calledWith(this.path, this.backend, payload),
+        'Patch request made with correct args'
+      );
+    });
+
+    // this assertion confirms submit allows empty values
+    test('empty string value from json form', async function (assert) {
+      assert.expect(1);
+
+      await this.renderComponent();
+      await click(GENERAL.inputByAttr('JSON'));
+      await waitUntil(() => find('.cm-editor'));
+      const editor = codemirror();
+      setCodeEditorValue(editor, '{ "foo": "" }');
+      await click(FORM.saveBtn);
+
+      const payload = {
+        data: { foo: '' },
+        options: {
+          cas: this.metadata.current_version,
+        },
+      };
+      assert.true(
+        this.patchStub.calledWith(this.path, this.backend, payload),
+        'Patch request made with correct args'
+      );
+    });
+
+    test('patch data without metadata permissions', async function (assert) {
+      assert.expect(2);
+      this.metadata = null;
+
+      await this.renderComponent();
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), '1');
+      await click(FORM.saveBtn);
+
+      const payload = {
+        data: { aKey: '1' },
+        options: {
+          cas: this.subkeysMeta.version,
+        },
+      };
+      assert.true(
+        this.patchStub.calledWith(this.path, this.backend, payload),
+        'Patch request made with correct args'
+      );
+      assert.true(
+        this.transitionStub.calledWith('vault.cluster.secrets.backend.kv.secret.index'),
+        'transitions to overview route on save'
+      );
+    });
+  });
+
+  module('it does not submit', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.endpoint = `${encodePath(this.backend)}/data/${encodePath(this.path)}`;
+      this.flashSpy = sinon.spy(this.owner.lookup('service:flash-messages'), 'info');
+      const errors = { errors: ['Something went wrong. This should not have happened!'] };
+      this.patchStub = sinon
+        .stub(this.owner.lookup('service:api').secrets, 'kvV2Patch')
+        .rejects(getErrorResponse(errors, 500));
+    });
+
+    test('if no changes from kv editor form', async function (assert) {
+      assert.expect(3);
+
+      await this.renderComponent();
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.messageError).doesNotExist('PATCH request is not made');
+      const route = this.transitionStub.lastCall?.args[0] || '';
+      const flash = this.flashSpy.lastCall?.args[0] || '';
+      assert.strictEqual(
+        route,
+        'vault.cluster.secrets.backend.kv.secret.index',
+        `it transitions to overview route: ${route}`
+      );
+      assert.strictEqual(
+        flash,
+        `No changes to submit. No updates made to "${this.path}".`,
+        `flash message has message: "${flash}"`
+      );
+    });
+
+    test('if no changes from json form', async function (assert) {
+      assert.expect(3);
+
+      await this.renderComponent();
+      await click(GENERAL.inputByAttr('JSON'));
+      await waitUntil(() => find('.cm-editor'));
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.messageError).doesNotExist('PATCH request is not made');
+      const route = this.transitionStub.lastCall?.args[0] || '';
+      const flash = this.flashSpy.lastCall?.args[0] || '';
+      assert.strictEqual(
+        route,
+        'vault.cluster.secrets.backend.kv.secret.index',
+        `it transitions to overview route: ${route}`
+      );
+      assert.strictEqual(
+        flash,
+        `No changes to submit. No updates made to "${this.path}".`,
+        `flash message has message: "${flash}"`
+      );
+    });
+  });
+
+  module('it passes error', function (hooks) {
+    hooks.beforeEach(async function () {
+      const errors = { errors: ['permission denied'] };
+      this.patchStub = sinon
+        .stub(this.owner.lookup('service:api').secrets, 'kvV2Patch')
+        .rejects(getErrorResponse(errors, 403));
+    });
+
+    test('to kv editor form', async function (assert) {
+      assert.expect(2);
+
+      await this.renderComponent();
+      // patch existing, delete and create a new key key
+      await click(FORM.patchEdit());
+      await fillIn(FORM.valueInput(), 'foovalue');
+      await blur(FORM.valueInput());
+      await click(FORM.patchDelete(1));
+      await fillIn(FORM.keyInput('new'), 'aKey');
+      await fillIn(FORM.valueInput('new'), 'aValue');
+      await click(FORM.patchAdd);
+      // add new key and do NOT click add
+      await fillIn(FORM.keyInput('new'), 'bKey');
+      await fillIn(FORM.valueInput('new'), 'bValue');
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.messageError).hasText('Error permission denied');
+      assert.dom(GENERAL.inlineError).hasText('There was an error submitting this form.');
+    });
+
+    test('to json form', async function (assert) {
+      assert.expect(2);
+      await this.renderComponent();
+      await click(GENERAL.inputByAttr('JSON'));
+      await waitUntil(() => find('.cm-editor'));
+      const editor = codemirror();
+      setCodeEditorValue(editor, '{ "foo": "foovalue", "bar":null, "number":1 }');
+      await click(FORM.saveBtn);
+      await click(FORM.saveBtn);
+      assert.dom(GENERAL.messageError).hasText('Error permission denied');
+      assert.dom(GENERAL.inlineError).hasText('There was an error submitting this form.');
+    });
+  });
+});
diff --git a/ui/tests/integration/components/kv/page/kv-page-secret-details-test.js b/ui/tests/integration/components/kv/page/kv-page-secret-details-test.js
index 6567f72f670..c035cf3965a 100644
--- a/ui/tests/integration/components/kv/page/kv-page-secret-details-test.js
+++ b/ui/tests/integration/components/kv/page/kv-page-secret-details-test.js
@@ -1,180 +1,130 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { click, find, render } from '@ember/test-helpers';
+import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { kvDataPath, kvMetadataPath } from 'vault/utils/kv-path';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
-import { FORM, PAGE, parseJsonEditor } from 'vault/tests/helpers/kv/kv-selectors';
-import { syncStatusResponse } from 'vault/mirage/handlers/sync';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+import { getErrorResponse } from 'vault/tests/helpers/api/error-response';
 
 module('Integration | Component | kv-v2 | Page::Secret::Details', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'kv');
-  setupMirage(hooks);
 
   hooks.beforeEach(async function () {
-    this.store = this.owner.lookup('service:store');
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
     this.backend = 'kv-engine';
     this.path = 'my-secret';
-    this.pathComplex = 'my-secret-object';
-    this.version = 2;
-    this.dataId = kvDataPath(this.backend, this.path);
-    this.dataIdComplex = kvDataPath(this.backend, this.pathComplex);
-    this.metadataId = kvMetadataPath(this.backend, this.path);
-
     this.secretData = { foo: 'bar' };
-    this.store.pushPayload('kv/data', {
-      modelName: 'kv/data',
-      id: this.dataId,
-      secret_data: this.secretData,
-      created_time: '2023-07-20T02:12:17.379762Z',
-      custom_metadata: null,
-      deletion_time: '',
-      destroyed: false,
-      version: this.version,
-      backend: this.backend,
-      path: this.path,
-    });
-    // nested secret
-    this.secretDataComplex = {
+    this.secretDataNested = {
       foo: {
         bar: 'baz',
       },
     };
-    this.store.pushPayload('kv/data', {
-      modelName: 'kv/data',
-      id: this.dataIdComplex,
-      secret_data: this.secretDataComplex,
-      created_time: '2023-08-20T02:12:17.379762Z',
-      custom_metadata: null,
-      deletion_time: '',
+    this.secret = {
+      secretData: this.secretData,
+      version: 1,
       destroyed: false,
-      version: this.version,
-    });
-
-    const metadata = this.server.create('kv-metadatum');
-    metadata.id = this.metadataId;
-    this.store.pushPayload('kv/metadata', {
-      modelName: 'kv/metadata',
-      ...metadata,
-    });
-
-    this.metadata = this.store.peekRecord('kv/metadata', this.metadataId);
-    this.secret = this.store.peekRecord('kv/data', this.dataId);
-    this.secretComplex = this.store.peekRecord('kv/data', this.dataIdComplex);
-
-    // this is the route model, not an ember data model
-    this.model = {
-      backend: this.backend,
-      path: this.path,
-      secret: this.secret,
-      metadata: this.metadata,
+      deletion_time: '',
+      created_time: '2023-07-20T02:12:17.379762Z',
+      custom_metadata: null,
     };
+    this.metadata = {
+      current_version: 1,
+      updated_time: '2023-07-21T03:11:58.095971Z',
+      versions: {
+        1: {
+          created_time: '2018-03-22T02:24:06.945319214Z',
+          deletion_time: '',
+          destroyed: false,
+        },
+      },
+    };
+    this.capabilities = { canReadData: true, canReadMetadata: true, canUpdateData: true };
+    this.isPatchAllowed = true;
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.model.backend, route: 'list' },
-      { label: this.model.path },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.backend, route: 'list' },
+      { label: this.path },
     ];
-    this.modelComplex = {
-      backend: this.backend,
-      path: this.pathComplex,
-      secret: this.secretComplex,
-      metadata: this.metadata,
-    };
-    setRunOptions({
-      rules: {
-        // TODO: Fix JSONEditor component
-        label: { enabled: false },
-      },
-    });
+
+    this.api = this.owner.lookup('service:api');
+    this.queryParamsStub = sinon.stub(this.api, 'addQueryParams');
+    this.syncStub = sinon
+      .stub(this.api.sys, 'systemReadSyncAssociationsDestinations')
+      .callsFake((initOverride) => {
+        initOverride();
+        return Promise.reject(getErrorResponse({ errors: [] }, 404));
+      });
+
+    this.renderComponent = () =>
+      render(
+        hbs`
+          <Page::Secret::Details
+            @backend={{this.backend}}
+            @breadcrumbs={{this.breadcrumbs}}
+            @capabilities={{this.capabilities}}
+            @isPatchAllowed={{this.isPatchAllowed}}
+            @metadata={{this.metadata}}
+            @path={{this.path}}
+            @secret={{this.secret}}
+          />
+        `,
+        { owner: this.engine }
+      );
   });
 
   test('it renders secret details and toggles json view', async function (assert) {
     assert.expect(9);
-    this.server.get(`sys/sync/associations/destinations`, (schema, req) => {
-      assert.ok(true, 'request made to fetch sync status');
-      assert.propEqual(
-        req.queryParams,
-        {
-          mount: this.backend,
-          secret_name: this.path,
-        },
-        'query params include mount and secret name'
-      );
-      // no records so response returns 404
-      return syncStatusResponse(schema, req);
-    });
 
-    await render(
-      hbs`
-       <Page::Secret::Details
-        @path={{this.model.path}}
-        @secret={{this.model.secret}}
-        @metadata={{this.model.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
+    await this.renderComponent();
+    assert.true(this.syncStub.calledOnce, 'sync status request made');
+    assert.deepEqual(
+      this.queryParamsStub.lastCall.args[1],
+      { mount: this.backend, secret_name: this.path },
+      'sync query params include mount and secret name'
     );
-
     assert
       .dom(PAGE.detail.syncAlert())
       .doesNotExist('sync page alert banner does not render when sync status errors');
-    assert.dom(PAGE.title).includesText(this.model.path, 'renders secret path as page title');
+    assert.dom(PAGE.title).includesText(this.path, 'renders secret path as page title');
     assert.dom(PAGE.infoRowValue('foo')).exists('renders row for secret data');
     assert.dom(PAGE.infoRowValue('foo')).hasText('***********');
-    await click(FORM.toggleMasked);
+    await click(GENERAL.button('toggle-masked'));
     assert.dom(PAGE.infoRowValue('foo')).hasText('bar', 'renders secret value');
-    await click(FORM.toggleJson);
-    await click(FORM.toggleJsonValues);
-    assert.propEqual(parseJsonEditor(find), this.secretData, 'json editor renders secret data');
+    await click(GENERAL.toggleInput('json'));
+    assert.dom(GENERAL.codeBlock('secret-data')).hasText(
+      `Version data {
+  "foo": "bar"
+}`,
+      'json editor renders secret data'
+    );
     assert
       .dom(PAGE.detail.versionTimestamp)
-      .includesText(`Version ${this.version} created`, 'renders version and time created');
+      .includesText(`Version ${this.secret.version} created`, 'renders version and time created');
   });
 
-  test('it renders json view when secret is complex', async function (assert) {
+  test('it renders hds codeblock view when secret is complex', async function (assert) {
     assert.expect(4);
-    await render(
-      hbs`
-       <Page::Secret::Details
-        @path={{this.modelComplex.path}}
-        @secret={{this.modelComplex.secret}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
+    this.secret.secretData = this.secretDataNested;
+    await this.renderComponent();
     assert.dom(PAGE.infoRowValue('foo')).doesNotExist('does not render rows of secret data');
-    assert.dom(FORM.toggleJson).isChecked();
-    assert.dom(FORM.toggleJson).isNotDisabled();
-    assert.dom('[data-test-component="code-mirror-modifier"]').exists('shows json editor');
+    assert.dom(GENERAL.toggleInput('json')).isChecked();
+    assert.dom(GENERAL.toggleInput('json')).isNotDisabled();
+    assert.dom(GENERAL.codeBlock('secret-data')).exists('hds codeBlock exists');
   });
 
   test('it renders deleted empty state', async function (assert) {
     assert.expect(3);
-    this.secret.deletionTime = '2023-07-23T02:12:17.379762Z';
-    await render(
-      hbs`
-       <Page::Secret::Details
-        @path={{this.model.path}}
-        @secret={{this.model.secret}}
-        @metadata={{this.model.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
-    assert.dom(PAGE.emptyStateTitle).hasText('Version 2 of this secret has been deleted');
+    this.secret.deletion_time = '2023-07-23T02:12:17.379762Z';
+    await this.renderComponent();
+
+    assert.dom(PAGE.emptyStateTitle).hasText('Version 1 of this secret has been deleted');
     assert
       .dom(PAGE.emptyStateMessage)
       .hasText(
@@ -182,24 +132,15 @@ module('Integration | Component | kv-v2 | Page::Secret::Details', function (hook
       );
     assert
       .dom(PAGE.detail.versionTimestamp)
-      .includesText(`Version ${this.version} deleted`, 'renders version and time deleted');
+      .includesText(`Version ${this.secret.version} deleted`, 'renders version and time deleted');
   });
 
   test('it renders destroyed empty state', async function (assert) {
     assert.expect(2);
     this.secret.destroyed = true;
-    await render(
-      hbs`
-       <Page::Secret::Details
-        @path={{this.model.path}}
-        @secret={{this.model.secret}}
-        @metadata={{this.model.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
-    assert.dom(PAGE.emptyStateTitle).hasText('Version 2 of this secret has been permanently destroyed');
+    await this.renderComponent();
+
+    assert.dom(PAGE.emptyStateTitle).hasText('Version 1 of this secret has been permanently destroyed');
     assert
       .dom(PAGE.emptyStateMessage)
       .hasText(
@@ -208,21 +149,15 @@ module('Integration | Component | kv-v2 | Page::Secret::Details', function (hook
   });
 
   test('it renders secret version dropdown', async function (assert) {
-    assert.expect(9);
-
-    await render(
-      hbs`
-       <Page::Secret::Details
-        @path={{this.model.path}}
-        @secret={{this.model.secret}}
-        @metadata={{this.model.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
+    assert.expect(6);
+    this.metadata.versions[2] = {
+      created_time: '2023-07-20T02:15:35.86465Z',
+      deletion_time: '2023-07-25T00:36:19.950545Z',
+      destroyed: false,
+    };
+    await this.renderComponent();
 
-    assert.dom(PAGE.detail.versionTimestamp).includesText(this.version, 'renders version');
+    assert.dom(PAGE.detail.versionTimestamp).includesText(this.secret.version, 'renders version');
     assert.dom(PAGE.detail.versionDropdown).hasText(`Version ${this.secret.version}`);
     await click(PAGE.detail.versionDropdown);
 
@@ -238,47 +173,27 @@ module('Integration | Component | kv-v2 | Page::Secret::Details', function (hook
     }
 
     assert
-      .dom(`${PAGE.detail.version(this.metadata.currentVersion)} [data-test-icon="check-circle"]`)
+      .dom(`${PAGE.detail.version(this.metadata.current_version)} [data-test-icon="check-circle"]`)
       .exists('renders current version icon');
   });
 
   test('it renders sync status page alert and refreshes', async function (assert) {
-    assert.expect(6); // assert count important because confirms request made to fetch sync status twice
-    const destinationName = 'my-destination';
-    this.server.create('sync-association', {
-      type: 'aws-sm',
-      name: destinationName,
-      mount: this.backend,
-      secret_name: this.path,
-    });
-    this.server.get(`sys/sync/associations/destinations`, (schema, req) => {
-      // these assertions should be hit twice, once on init and again when the 'Refresh' button is clicked
-      assert.ok(true, 'request made to fetch sync status');
-      assert.propEqual(
-        req.queryParams,
-        {
-          mount: this.backend,
-          secret_name: this.path,
+    assert.expect(3);
+
+    this.syncStub.resolves({
+      associated_destinations: {
+        'aws-sm': {
+          sync_status: 'SYNCED',
+          name: 'my-destination',
+          type: 'aws-sm',
+          updated_at: '2023-09-01T12:00:00Z',
         },
-        'query params include mount and secret name'
-      );
-      return syncStatusResponse(schema, req);
+      },
     });
 
-    await render(
-      hbs`
-       <Page::Secret::Details
-        @path={{this.model.path}}
-        @secret={{this.model.secret}}
-        @metadata={{this.model.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
-
+    await this.renderComponent();
     assert
-      .dom(PAGE.detail.syncAlert(destinationName))
+      .dom(PAGE.detail.syncAlert('my-destination'))
       .hasTextContaining(
         'Synced my-destination - last updated September',
         'renders sync status alert banner'
@@ -291,37 +206,46 @@ module('Integration | Component | kv-v2 | Page::Secret::Details', function (hook
       );
     // sync status refresh button
     await click(`${PAGE.detail.syncAlert()} button`);
+    assert.true(this.syncStub.calledTwice, 'sync status request made on refresh click');
+  });
+
+  test('it makes request to wrap a secret', async function (assert) {
+    const wrapStub = sinon.stub(this.api.sys, 'wrap').resolves({ wrap_info: { token: 'hvs.token' } });
+
+    await this.renderComponent();
+
+    await click(PAGE.detail.copy);
+    await click(GENERAL.button('wrap'));
+
+    const { secretData: data, ...metadata } = this.secret;
+    assert.true(
+      wrapStub.calledWith({ data, metadata }, { headers: { 'X-Vault-Wrap-TTL': 1800 } }),
+      'makes request to wrap secret with correct data'
+    );
   });
 
   test('it renders sync status page alert for multiple destinations', async function (assert) {
-    assert.expect(3); // assert count important because confirms request made to fetch sync status twice
-    this.server.create('sync-association', {
-      type: 'aws-sm',
-      name: 'aws-dest',
-      mount: this.backend,
-      secret_name: this.path,
-    });
-    this.server.create('sync-association', {
-      type: 'gh',
-      name: 'gh-dest',
-      mount: this.backend,
-      secret_name: this.path,
-    });
-    this.server.get(`sys/sync/associations/destinations`, (schema, req) => {
-      return syncStatusResponse(schema, req);
+    assert.expect(3);
+
+    this.syncStub.resolves({
+      associated_destinations: {
+        'aws-sm': {
+          sync_status: 'SYNCED',
+          name: 'aws-dest',
+          type: 'aws-sm',
+          updated_at: '2023-09-01T12:00:00Z',
+        },
+        'gh-dest': {
+          sync_status: 'SYNCING',
+          name: 'gh-dest',
+          type: 'gh',
+          updated_at: '2023-09-01T12:00:00Z',
+        },
+      },
     });
 
-    await render(
-      hbs`
-       <Page::Secret::Details
-        @path={{this.model.path}}
-        @secret={{this.model.secret}}
-        @metadata={{this.model.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
+    await this.renderComponent();
+
     assert
       .dom(PAGE.detail.syncAlert('aws-dest'))
       .hasTextContaining('Synced aws-dest - last updated September', 'renders status for aws destination');
diff --git a/ui/tests/integration/components/kv/page/kv-page-secret-edit-test.js b/ui/tests/integration/components/kv/page/kv-page-secret-edit-test.js
index 900479b56b9..82557f8c7fc 100644
--- a/ui/tests/integration/components/kv/page/kv-page-secret-edit-test.js
+++ b/ui/tests/integration/components/kv/page/kv-page-secret-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,13 +7,14 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { Response } from 'miragejs';
 import { hbs } from 'ember-cli-htmlbars';
-import { click, fillIn, render } from '@ember/test-helpers';
-import codemirror from 'vault/tests/helpers/codemirror';
+import { click, fillIn, render, settled, waitFor } from '@ember/test-helpers';
+import codemirror, { setCodeEditorValue } from 'vault/tests/helpers/codemirror';
 import { FORM, PAGE } from 'vault/tests/helpers/kv/kv-selectors';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import KvForm from 'vault/forms/secrets/kv';
 
 module('Integration | Component | kv-v2 | Page::Secret::Edit', function (hooks) {
   setupRenderingTest(hooks);
@@ -21,22 +22,44 @@ module('Integration | Component | kv-v2 | Page::Secret::Edit', function (hooks)
   setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.store = this.owner.lookup('service:store');
-    this.router = this.owner.lookup('service:router');
-    this.transitionStub = sinon.stub(this.router, 'transitionTo');
     this.backend = 'my-kv-engine';
     this.path = 'my-secret';
-    this.secret = this.store.createRecord('kv/data', {
-      backend: this.backend,
-      path: this.path,
+    this.secret = {
       secretData: { foo: 'bar' },
-      casVersion: 1,
+      version: 1,
+    };
+    this.metadata = { current_version: 1 };
+    this.form = new KvForm({
+      path: this.path,
+      secretData: this.secret.secretData,
+      max_versions: 0,
+      options: {
+        cas: this.secret.version,
+      },
     });
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: this.backend, route: 'list' },
-      { label: 'edit' },
+      { label: 'Edit' },
     ];
+
+    this.transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
+    this.writeStub = sinon.stub(this.owner.lookup('service:api').secrets, 'kvV2Write').resolves();
+
+    this.renderComponent = () =>
+      render(
+        hbs`
+          <Page::Secret::Edit
+            @form={{this.form}}
+            @secret={{this.secret}}
+            @metadata={{this.metadata}}
+            @path={{this.path}}
+            @backend={{this.backend}}
+            @breadcrumbs={{this.breadcrumbs}}
+        />`,
+        { owner: this.engine }
+      );
+
     setRunOptions({
       rules: {
         // TODO fix JSONEditor, KVObjectEditor, MaskedInput
@@ -46,239 +69,62 @@ module('Integration | Component | kv-v2 | Page::Secret::Edit', function (hooks)
     });
   });
 
-  hooks.afterEach(function () {
-    this.router.transitionTo.restore();
-  });
-
-  test('it saves a new secret version', async function (assert) {
-    assert.expect(10);
-    this.server.post(`${this.backend}/data/${this.path}`, (schema, req) => {
-      assert.ok(true, 'Request made to save secret');
-      const payload = JSON.parse(req.requestBody);
-      assert.propEqual(payload, {
-        data: { foo: 'bar', foo2: 'bar2' },
-        options: { cas: 1 },
-      });
-      return {
-        request_id: 'bd76db73-605d-fcbc-0dad-d44a008f9b95',
-        data: {
-          created_time: '2023-07-28T18:47:32.924809Z',
-          custom_metadata: null,
-          deletion_time: '',
-          destroyed: false,
-          version: 2,
-        },
-      };
-    });
+  test('it should toggle json editor', async function (assert) {
+    assert.expect(4);
 
-    await render(
-      hbs`<Page::Secret::Edit
-  @secret={{this.secret}}
-  @previousVersion={{4}}
-  @currentVersion={{4}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
+    await this.renderComponent();
 
-    assert.dom(FORM.inputByAttr('path')).isDisabled();
-    assert.dom(FORM.inputByAttr('path')).hasValue(this.path);
-    assert.dom(FORM.keyInput()).hasValue('foo');
-    assert.dom(FORM.maskedValueInput()).hasValue('bar');
     assert.dom(FORM.dataInputLabel({ isJson: false })).hasText('Version data');
-    await click(FORM.toggleJson);
-    assert.strictEqual(
-      codemirror().getValue(' '),
-      `{   \"foo": \"bar" }`, // eslint-disable-line no-useless-escape
-      'json editor initializes with empty object'
-    );
+    assert.dom('.cm-editor').doesNotExist('CodeMirror editor is not rendered');
+
+    await click(GENERAL.toggleInput('json'));
     assert.dom(FORM.dataInputLabel({ isJson: true })).hasText('Version data');
-    await click(FORM.toggleJson);
-    await fillIn(FORM.keyInput(1), 'foo2');
-    await fillIn(FORM.maskedValueInput(1), 'bar2');
-    await click(FORM.saveBtn);
-    assert.ok(
-      this.transitionStub.calledWith('vault.cluster.secrets.backend.kv.secret.details'),
-      'router transitions to secret details route on save'
-    );
+    await waitFor('.cm-editor');
+    assert.dom('.cm-editor').exists('CodeMirror editor is rendered');
+  });
+
+  test('it should show old version alert', async function (assert) {
+    this.metadata.current_version = 2;
+    await this.renderComponent();
+    assert
+      .dom(FORM.versionAlert)
+      .hasText(
+        `Warning You are creating a new version based on data from Version 1. The current version for my-secret is Version 2.`
+      );
+  });
+
+  test('it should render fail read error', async function (assert) {
+    this.secret.failReadErrorCode = 403;
+    await this.renderComponent();
+    assert.dom(FORM.noReadAlert).exists('it renders no read alert');
   });
 
-  test('diff works correctly', async function (assert) {
-    await render(
-      hbs`<Page::Secret::Edit
-  @secret={{this.secret}}
-  @previousVersion={{4}}
-  @currentVersion={{4}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
+  test('it should render diff view', async function (assert) {
+    await this.renderComponent();
 
-    assert.dom(PAGE.edit.toggleDiff).isNotDisabled('Diff toggle is not disabled');
+    assert.dom(GENERAL.toggleInput('Show diff')).isNotDisabled('Diff toggle is not disabled');
     assert.dom(PAGE.edit.toggleDiffDescription).hasText('No changes to show. Update secret to view diff');
     assert.dom(PAGE.diff.visualDiff).doesNotExist('Does not show visual diff');
 
     await fillIn(FORM.keyInput(1), 'foo2');
     await fillIn(FORM.maskedValueInput(1), 'bar2');
 
-    assert.dom(PAGE.edit.toggleDiff).isNotDisabled('Diff toggle is not disabled');
+    assert.dom(GENERAL.toggleInput('Show diff')).isNotDisabled('Diff toggle is not disabled');
     assert.dom(PAGE.edit.toggleDiffDescription).hasText('Showing the diff will reveal secret values');
     assert.dom(PAGE.diff.visualDiff).doesNotExist('Does not show visual diff');
-    await click(PAGE.edit.toggleDiff);
+    await click(GENERAL.toggleInput('Show diff'));
     assert.dom(PAGE.diff.visualDiff).exists('Shows visual diff');
     assert.dom(PAGE.diff.added).hasText(`foo2"bar2"`);
 
-    await click(FORM.toggleJson);
-    codemirror().setValue('{ "foo3": "bar3" }');
+    await click(GENERAL.toggleInput('json'));
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+
+    setCodeEditorValue(editor, '{ "foo3": "bar3" }');
+    await settled();
 
     assert.dom(PAGE.diff.visualDiff).exists('Visual diff updates');
     assert.dom(PAGE.diff.deleted).hasText(`foo"bar"`);
     assert.dom(PAGE.diff.added).hasText(`foo3"bar3"`);
   });
-
-  test('it saves nested secrets', async function (assert) {
-    assert.expect(3);
-    const nestedSecret = 'path/to/secret';
-    this.secret.path = nestedSecret;
-    this.server.post(`${this.backend}/data/${nestedSecret}`, (schema, req) => {
-      assert.ok(true, 'Request made to save secret');
-      const payload = JSON.parse(req.requestBody);
-      assert.propEqual(payload, {
-        data: { foo: 'bar' },
-        options: { cas: 1 },
-      });
-      return {
-        request_id: 'bd76db73-605d-fcbc-0dad-d44a008f9b95',
-        data: {
-          created_time: '2023-07-28T18:47:32.924809Z',
-          custom_metadata: null,
-          deletion_time: '',
-          destroyed: false,
-          version: 2,
-        },
-      };
-    });
-
-    await render(
-      hbs`<Page::Secret::Edit
-  @secret={{this.secret}}
-  @previousVersion={{4}}
-  @currentVersion={{4}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
-
-    assert.dom(FORM.inputByAttr('path')).hasValue(nestedSecret);
-    await click(FORM.saveBtn);
-  });
-
-  test('it renders API errors', async function (assert) {
-    assert.expect(3);
-    this.server.post(`${this.backend}/data/${this.path}`, () => {
-      return new Response(500, {}, { errors: ['nope'] });
-    });
-
-    await render(
-      hbs`<Page::Secret::Edit
-  @secret={{this.secret}}
-  @previousVersion={{4}}
-  @currentVersion={{4}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
-
-    await click(FORM.saveBtn);
-    assert.dom(FORM.messageError).hasText('Error nope', 'it renders API error');
-    assert.dom(FORM.inlineAlert).hasText('There was an error submitting this form.');
-    await click(FORM.cancelBtn);
-    assert.ok(
-      this.transitionStub.calledWith('vault.cluster.secrets.backend.kv.secret.details'),
-      'router transitions to details on cancel'
-    );
-  });
-
-  test('it renders kv secret validations', async function (assert) {
-    assert.expect(2);
-
-    await render(
-      hbs`<Page::Secret::Edit
-  @secret={{this.secret}}
-  @previousVersion={{4}}
-  @currentVersion={{4}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
-
-    await click(FORM.toggleJson);
-    codemirror().setValue('i am a string and not JSON');
-    assert
-      .dom(FORM.inlineAlert)
-      .hasText('JSON is unparsable. Fix linting errors to avoid data discrepancies.');
-
-    codemirror().setValue(`""`);
-    await click(FORM.saveBtn);
-    assert.dom(FORM.inlineAlert).hasText('Vault expects data to be formatted as an JSON object.');
-  });
-
-  test('it toggles JSON view and saves modified data', async function (assert) {
-    assert.expect(4);
-
-    this.server.post(`${this.backend}/data/${this.path}`, (schema, req) => {
-      assert.ok(true, 'Request made to save secret');
-      const payload = JSON.parse(req.requestBody);
-      assert.propEqual(payload, {
-        data: { hello: 'there' },
-        options: { cas: 1 },
-      });
-      return {
-        request_id: 'bd76db73-605d-fcbc-0dad-d44a008f9b95',
-        data: {
-          created_time: '2023-07-28T18:47:32.924809Z',
-          custom_metadata: null,
-          deletion_time: '',
-          destroyed: false,
-          version: 2,
-        },
-      };
-    });
-
-    await render(
-      hbs`<Page::Secret::Edit
-  @secret={{this.secret}}
-  @previousVersion={{3}}
-  @currentVersion={{4}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
-    assert.dom(FORM.dataInputLabel({ isJson: false })).hasText('Version data');
-    await click(FORM.toggleJson);
-    assert.dom(FORM.dataInputLabel({ isJson: true })).hasText('Version data');
-
-    codemirror().setValue(`{ "hello": "there"}`);
-    await click(FORM.saveBtn);
-  });
-
-  test('it renders alert when creating a new secret version from an old version', async function (assert) {
-    assert.expect(1);
-
-    await render(
-      hbs`<Page::Secret::Edit
-  @secret={{this.secret}}
-  @previousVersion={{1}}
-  @currentVersion={{4}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
-
-    assert
-      .dom(FORM.versionAlert)
-      .hasText(
-        `Warning You are creating a new version based on data from Version 1. The current version for my-secret is Version 4.`
-      );
-  });
 });
diff --git a/ui/tests/integration/components/kv/page/kv-page-secret-paths-test.js b/ui/tests/integration/components/kv/page/kv-page-secret-paths-test.js
index 5588fbd4ea8..84be1d74d44 100644
--- a/ui/tests/integration/components/kv/page/kv-page-secret-paths-test.js
+++ b/ui/tests/integration/components/kv/page/kv-page-secret-paths-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,8 +9,6 @@ import { setupEngine } from 'ember-engines/test-support';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
-/* eslint-disable no-useless-escape */
-
 module('Integration | Component | kv-v2 | Page::Secret::Paths', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'kv');
@@ -18,123 +16,55 @@ module('Integration | Component | kv-v2 | Page::Secret::Paths', function (hooks)
   hooks.beforeEach(async function () {
     this.backend = 'kv-engine';
     this.path = 'my-secret';
+    this.canReadMetadata = true;
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: this.backend, route: 'list' },
       { label: this.path },
     ];
 
-    this.assertClipboard = (assert, element, expected) => {
-      assert.dom(element).hasAttribute('data-test-copy-button', expected);
+    this.renderComponent = async () => {
+      await render(
+        hbs`
+      <Page::Secret::Paths
+        @path={{this.path}}
+        @backend={{this.backend}}
+        @breadcrumbs={{this.breadcrumbs}}
+        @canReadMetadata={{this.canReadMetadata}}
+      />
+      `,
+        { owner: this.engine }
+      );
     };
   });
 
-  test('it renders copyable paths', async function (assert) {
-    assert.expect(6);
-
-    const paths = [
-      { label: 'API path', expected: `/v1/${this.backend}/data/${this.path}` },
-      { label: 'CLI path', expected: `-mount="${this.backend}" "${this.path}"` },
-      { label: 'API path for metadata', expected: `/v1/${this.backend}/metadata/${this.path}` },
-    ];
-
-    await render(
-      hbs`
-<Page::Secret::Paths
-  @path={{this.path}}
-  @backend={{this.backend}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>
-      `,
-      { owner: this.engine }
-    );
-
-    for (const path of paths) {
-      assert.dom(PAGE.infoRowValue(path.label)).hasText(path.expected);
-      this.assertClipboard(assert, PAGE.paths.copyButton(path.label), path.expected);
+  test('it renders tabs', async function (assert) {
+    await this.renderComponent();
+    const tabs = ['Secret', 'Metadata', 'Paths', 'Version History'];
+    for (const tab of tabs) {
+      assert.dom(PAGE.secretTab(tab)).hasText(tab);
     }
   });
 
-  test('it renders copyable encoded mount and secret paths', async function (assert) {
-    assert.expect(6);
-    this.path = `my spacey!"secret`;
-    this.backend = `my fancy!"backend`;
-    const backend = encodeURIComponent(this.backend);
-    const path = encodeURIComponent(this.path);
-    const paths = [
-      {
-        label: 'API path',
-        expected: `/v1/${backend}/data/${path}`,
-      },
-      { label: 'CLI path', expected: `-mount="${this.backend}" "${this.path}"` },
-      {
-        label: 'API path for metadata',
-        expected: `/v1/${backend}/metadata/${path}`,
-      },
-    ];
-
-    await render(
-      hbs`
-<Page::Secret::Paths
-  @path={{this.path}}
-  @backend={{this.backend}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>
-      `,
-      { owner: this.engine }
-    );
-
-    for (const path of paths) {
-      assert.dom(PAGE.infoRowValue(path.label)).hasText(path.expected);
-      this.assertClipboard(assert, PAGE.paths.copyButton(path.label), path.expected);
+  test('it hides version history when cannot READ metadata', async function (assert) {
+    this.canReadMetadata = false;
+    await this.renderComponent();
+    const tabs = ['Secret', 'Metadata', 'Paths'];
+    for (const tab of tabs) {
+      assert.dom(PAGE.secretTab(tab)).hasText(tab);
     }
+    assert.dom(PAGE.secretTab('Version History')).doesNotExist();
   });
 
-  test('it renders copyable commands', async function (assert) {
-    const url = `https://127.0.0.1:8200/v1/${this.backend}/data/${this.path}`;
-    const expected = {
-      cli: `vault kv get -mount="${this.backend}" "${this.path}"`,
-      api: `curl \\ --header \"X-Vault-Token: ...\" \\ --request GET \\ ${url}`,
-    };
-    await render(
-      hbs`
-<Page::Secret::Paths
-  @path={{this.path}}
-  @backend={{this.backend}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>
-      `,
-      { owner: this.engine }
-    );
-
-    assert.dom(PAGE.paths.codeSnippet('cli')).hasText(expected.cli);
-    assert.dom(PAGE.paths.codeSnippet('api')).hasText(expected.api);
+  test('it renders header', async function (assert) {
+    await this.renderComponent();
+    assert.dom(PAGE.breadcrumbs).hasText(`Secrets ${this.backend} ${this.path}`);
+    assert.dom(PAGE.title).hasText(this.path);
   });
 
-  test('it renders copyable encoded mount and path commands', async function (assert) {
-    this.path = `my spacey!"secret`;
-    this.backend = `my fancy!"backend`;
-
-    const backend = encodeURIComponent(this.backend);
-    const path = encodeURIComponent(this.path);
-    const url = `https://127.0.0.1:8200/v1/${backend}/data/${path}`;
-
-    const expected = {
-      cli: `vault kv get -mount="${this.backend}" "${this.path}"`,
-      api: `curl \\ --header \"X-Vault-Token: ...\" \\ --request GET \\ ${url}`,
-    };
-    await render(
-      hbs`
-<Page::Secret::Paths
-  @path={{this.path}}
-  @backend={{this.backend}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>
-      `,
-      { owner: this.engine }
-    );
-
-    assert.dom(PAGE.paths.codeSnippet('cli')).hasText(expected.cli);
-    assert.dom(PAGE.paths.codeSnippet('api')).hasText(expected.api);
+  test('it renders commands which is the uncondensed version of KvPathsCard', async function (assert) {
+    await this.renderComponent();
+    assert.dom(PAGE.paths.codeSnippet('cli')).exists();
+    assert.dom(PAGE.paths.codeSnippet('api')).exists();
   });
 });
diff --git a/ui/tests/integration/components/kv/page/kv-page-secrets-create-test.js b/ui/tests/integration/components/kv/page/kv-page-secrets-create-test.js
index 3c1d98607b7..8a04d6e6d0c 100644
--- a/ui/tests/integration/components/kv/page/kv-page-secrets-create-test.js
+++ b/ui/tests/integration/components/kv/page/kv-page-secrets-create-test.js
@@ -1,39 +1,56 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { setupEngine } from 'ember-engines/test-support';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { Response } from 'miragejs';
 import { hbs } from 'ember-cli-htmlbars';
-import { click, fillIn, findAll, render, typeIn } from '@ember/test-helpers';
-import codemirror from 'vault/tests/helpers/codemirror';
-import { FORM } from 'vault/tests/helpers/kv/kv-selectors';
+import { click, render, waitFor } from '@ember/test-helpers';
+import { FORM, PAGE } from 'vault/tests/helpers/kv/kv-selectors';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import KvForm from 'vault/forms/secrets/kv';
 
 module('Integration | Component | kv-v2 | Page::Secrets::Create', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'kv');
-  setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.store = this.owner.lookup('service:store');
-    this.router = this.owner.lookup('service:router');
-    this.transitionStub = sinon.stub(this.router, 'transitionTo');
     this.backend = 'my-kv-engine';
     this.path = 'my-secret';
-    this.maxVersions = 10;
-    this.secret = this.store.createRecord('kv/data', { backend: this.backend, casVersion: 0 });
-    this.metadata = this.store.createRecord('kv/metadata', { backend: this.backend });
+    this.form = new KvForm(
+      {
+        path: this.path,
+        max_versions: 0,
+        delete_version_after: '0s',
+        cas_required: false,
+      },
+      { isNew: true }
+    );
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
       { label: this.backend, route: 'list' },
-      { label: 'create' },
+      { label: 'Create' },
     ];
+
+    this.renderComponent = () =>
+      render(
+        hbs`
+        <Page::Secrets::Create
+          @form={{this.form}}
+          @path={{this.path}}
+          @backend={{this.backend}}
+          @breadcrumbs={{this.breadcrumbs}}
+        />
+      `,
+        { owner: this.engine }
+      );
+
+    this.transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
+
     setRunOptions({
       rules: {
         // TODO fix JSONEditor, KVObjectEditor, MaskedInput
@@ -43,260 +60,27 @@ module('Integration | Component | kv-v2 | Page::Secrets::Create', function (hook
     });
   });
 
-  hooks.afterEach(function () {
-    this.router.transitionTo.restore();
-  });
-
-  test('it saves secret data and metadata', async function (assert) {
-    assert.expect(5);
-    this.server.post(`${this.backend}/data/${this.path}`, (schema, req) => {
-      assert.ok(true, 'Request made to save secret');
-      const payload = JSON.parse(req.requestBody);
-      assert.propEqual(payload, {
-        data: { foo: 'bar' },
-        options: { cas: 0 },
-      });
-      return {
-        request_id: 'bd76db73-605d-fcbc-0dad-d44a008f9b95',
-        data: {
-          created_time: '2023-07-28T18:47:32.924809Z',
-          custom_metadata: null,
-          deletion_time: '',
-          destroyed: false,
-          version: 1,
-        },
-      };
-    });
-
-    this.server.post(`${this.backend}/metadata/${this.path}`, (schema, req) => {
-      assert.ok(true, 'Request made to save metadata');
-      const payload = JSON.parse(req.requestBody);
-      assert.propEqual(payload, {
-        cas_required: false,
-        custom_metadata: {
-          'my-custom': 'metadata',
-        },
-        delete_version_after: '0s',
-        max_versions: 10,
-      });
-    });
-
-    await render(
-      hbs`<Page::Secrets::Create
-  @secret={{this.secret}}
-  @metadata={{this.metadata}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
-
-    await fillIn(FORM.inputByAttr('path'), this.path);
-    await fillIn(FORM.keyInput(), 'foo');
-    await fillIn(FORM.maskedValueInput(), 'bar');
-
-    await click(FORM.toggleMetadata);
-    await fillIn(`[data-test-field="customMetadata"] ${FORM.keyInput()}`, 'my-custom');
-    await fillIn(`[data-test-field="customMetadata"] ${FORM.valueInput()}`, 'metadata');
-    await fillIn(FORM.inputByAttr('maxVersions'), this.maxVersions);
-
-    await click(FORM.saveBtn);
-
-    assert.ok(
-      this.transitionStub.calledWith('vault.cluster.secrets.backend.kv.secret.details'),
-      'router transitions to secret details route on save'
-    );
-  });
-
-  test('it does not send request to save secret metadata if fields are unchanged', async function (assert) {
-    // this test contains two assertions, but only expects one because a request to kv/metadata
-    // should NOT happen if its form inputs have not been edited
-    assert.expect(1);
-    this.server.post(`${this.backend}/data/${this.path}`, () => {
-      assert.ok(true, 'Request only made to save secret');
-      return {
-        request_id: 'bd76db73-605d-fcbc-0dad-d44a008f9b95',
-        data: {
-          created_time: '2023-07-28T18:47:32.924809Z',
-          custom_metadata: null,
-          deletion_time: '',
-          destroyed: false,
-          version: 1,
-        },
-      };
-    });
-
-    this.server.post(`${this.backend}/metadata/${this.path}`, () => {
-      // this assertion should not be hit!!
-      assert.notOk(true, 'Request should not be made to save metadata');
-      return new Response(403, {}, { errors: ['This request should not have been made'] });
-    });
-
-    await render(
-      hbs`<Page::Secrets::Create
-  @secret={{this.secret}}
-  @metadata={{this.metadata}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
-
-    await fillIn(FORM.inputByAttr('path'), this.path);
-    await fillIn(FORM.keyInput(), 'foo');
-    await fillIn(FORM.maskedValueInput(), 'bar');
-    await click(FORM.saveBtn);
-  });
-
-  test('it saves nested secrets', async function (assert) {
-    assert.expect(3);
-    const pathToSecret = 'path/to/secret/';
-    this.secret.path = pathToSecret;
-    this.server.post(`${this.backend}/data/${pathToSecret + this.path}`, (schema, req) => {
-      assert.ok(true, 'Request made to save secret');
-      const payload = JSON.parse(req.requestBody);
-      assert.propEqual(payload, {
-        data: { foo: 'bar' },
-        options: { cas: 0 },
-      });
-      return {
-        request_id: 'bd76db73-605d-fcbc-0dad-d44a008f9b95',
-        data: {
-          created_time: '2023-07-28T18:47:32.924809Z',
-          custom_metadata: null,
-          deletion_time: '',
-          destroyed: false,
-          version: 1,
-        },
-      };
-    });
-
-    await render(
-      hbs`<Page::Secrets::Create
-  @secret={{this.secret}}
-  @metadata={{this.metadata}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
-
-    assert.dom(FORM.inputByAttr('path')).hasValue(pathToSecret);
-    await typeIn(FORM.inputByAttr('path'), this.path);
-    await fillIn(FORM.keyInput(), 'foo');
-    await fillIn(FORM.maskedValueInput(), 'bar');
-    await click(FORM.saveBtn);
-  });
-
-  test('it renders API errors', async function (assert) {
-    // this test contains an extra assertion because a request to kv/metadata
-    // should NOT happen if kv/data fails
-    assert.expect(3);
-    this.server.post(`${this.backend}/data/${this.path}`, () => {
-      return new Response(500, {}, { errors: ['nope'] });
-    });
-
-    this.server.post(`${this.backend}/metadata/${this.path}`, () => {
-      // this assertion should not be hit because the request to save secret data failed!!
-      assert.ok(true, 'Request made to save metadata');
-      return new Response(403, {}, { errors: ['This request should not have been made'] });
-    });
-
-    await render(
-      hbs`<Page::Secrets::Create
-  @secret={{this.secret}}
-  @metadata={{this.metadata}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
-
-    await fillIn(FORM.inputByAttr('path'), this.path);
-    await click(FORM.saveBtn);
-    assert.dom(FORM.messageError).hasText('Error nope', 'it renders API error');
-    assert.dom(FORM.inlineAlert).hasText('There was an error submitting this form.');
-    await click(FORM.cancelBtn);
-    assert.ok(
-      this.transitionStub.calledWith('vault.cluster.secrets.backend.kv.list'),
-      'router transitions to secret list route on cancel'
-    );
-  });
-
-  test('it renders kv secret validations', async function (assert) {
-    assert.expect(6);
-
-    await render(
-      hbs`<Page::Secrets::Create
-  @secret={{this.secret}}
-  @metadata={{this.metadata}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
-
-    await typeIn(FORM.inputByAttr('path'), 'space ');
-    assert
-      .dom(FORM.validation('path'))
-      .hasText(
-        `Path contains whitespace. If this is desired, you'll need to encode it with %20 in API requests.`
-      );
-
-    await fillIn(FORM.inputByAttr('path'), ''); // clear input
-    await typeIn(FORM.inputByAttr('path'), 'slash/');
-    assert.dom(FORM.validation('path')).hasText(`Path can't end in forward slash '/'.`);
-
-    await typeIn(FORM.inputByAttr('path'), 'secret');
-    assert
-      .dom(FORM.validation('path'))
-      .doesNotExist('it removes validation on key up when secret contains slash but does not end in one');
-
-    await click(FORM.toggleJson);
-    codemirror().setValue('i am a string and not JSON');
-    assert
-      .dom(FORM.inlineAlert)
-      .hasText('JSON is unparsable. Fix linting errors to avoid data discrepancies.');
-
-    codemirror().setValue('{}'); // clear linting error
-    await fillIn(FORM.inputByAttr('path'), '');
-    await click(FORM.saveBtn);
-    const [pathValidation, formAlert] = findAll(FORM.inlineAlert);
-    assert.dom(pathValidation).hasText(`Path can't be blank.`);
-    assert.dom(formAlert).hasText('There is an error with this form.');
-  });
-
-  test('it toggles JSON view and saves modified data', async function (assert) {
+  test('it should toggle json editor', async function (assert) {
     assert.expect(4);
-    this.server.post(`${this.backend}/data/${this.path}`, (schema, req) => {
-      assert.ok(true, 'Request made to save secret');
-      const payload = JSON.parse(req.requestBody);
-      assert.propEqual(payload, {
-        data: { hello: 'there' },
-        options: { cas: 0 },
-      });
-      return {
-        request_id: 'bd76db73-605d-fcbc-0dad-d44a008f9b95',
-        data: {
-          created_time: '2023-07-28T18:47:32.924809Z',
-          custom_metadata: null,
-          deletion_time: '',
-          destroyed: false,
-          version: 1,
-        },
-      };
-    });
 
-    await render(
-      hbs`<Page::Secrets::Create
-  @secret={{this.secret}}
-  @metadata={{this.metadata}}
-  @breadcrumbs={{this.breadcrumbs}}
-/>`,
-      { owner: this.engine }
-    );
+    await this.renderComponent();
 
     assert.dom(FORM.dataInputLabel({ isJson: false })).hasText('Secret data');
-    await click(FORM.toggleJson);
+    assert.dom('.cm-editor').doesNotExist('CodeMirror editor is not rendered');
+
+    await click(GENERAL.toggleInput('json'));
     assert.dom(FORM.dataInputLabel({ isJson: true })).hasText('Secret data');
+    await waitFor('.cm-editor');
+    assert.dom('.cm-editor').exists('CodeMirror editor is rendered');
+  });
 
-    codemirror().setValue(`{ "hello": "there"}`);
-    await fillIn(FORM.inputByAttr('path'), this.path);
-    await click(FORM.saveBtn);
+  test('it should toggle metadata', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(FORM.toggleMetadata).hasText('Show secret metadata');
+    assert.dom(PAGE.create.metadataSection).doesNotExist('metadata section is hidden');
+    await click(FORM.toggleMetadata);
+    assert.dom(FORM.toggleMetadata).hasText('Hide secret metadata');
+    assert.dom(PAGE.create.metadataSection).exists('metadata section is shown');
   });
 });
diff --git a/ui/tests/integration/components/kv/page/kv-page-version-diff-test.js b/ui/tests/integration/components/kv/page/kv-page-version-diff-test.js
index 31017a635e6..888c318ae59 100644
--- a/ui/tests/integration/components/kv/page/kv-page-version-diff-test.js
+++ b/ui/tests/integration/components/kv/page/kv-page-version-diff-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,11 +9,10 @@ import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { click, findAll, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { kvMetadataPath, kvDataPath } from 'vault/utils/kv-path';
 import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import sinon from 'sinon';
 
-module('Integration | Component | kv | Page::Secret::Metadata::VersionDiff', function (hooks) {
+module('Integration | Component | kv-v2 | Page::Secret::Metadata::VersionDiff', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'kv');
   setupMirage(hooks);
@@ -21,51 +20,82 @@ module('Integration | Component | kv | Page::Secret::Metadata::VersionDiff', fun
   hooks.beforeEach(async function () {
     this.backend = 'kv-engine';
     this.path = 'my-secret';
-    this.breadcrumbs = [{ label: 'version history', route: 'secret.metadata.versions' }, { label: 'diff' }];
-
-    this.store = this.owner.lookup('service:store');
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
-
-    const metadata = this.server.create('kv-metadatum');
-    metadata.id = kvMetadataPath(this.backend, this.path);
-    this.store.pushPayload('kv/metadata', { modelName: 'kv/metadata', ...metadata });
-    this.metadata = this.store.peekRecord('kv/metadata', metadata.id);
-    // push current secret version record into the store to assert only one request is made
-    const dataId = kvDataPath(this.backend, this.path, 4);
-    this.store.pushPayload('kv/data', {
-      modelName: 'kv/data',
-      id: dataId,
-      secret_data: { foo: 'bar' },
-      version: this.metadata.currentVersion,
+    this.metadata = {
+      current_version: 4,
+      updated_time: '2023-07-21T03:11:58.095971Z',
+      versions: {
+        1: {
+          created_time: '2018-03-22T02:24:06.945319214Z',
+          deletion_time: '',
+          destroyed: false,
+        },
+        2: {
+          created_time: '2023-07-20T02:15:35.86465Z',
+          deletion_time: '2023-07-25T00:36:19.950545Z',
+          destroyed: false,
+        },
+        3: {
+          created_time: '2023-07-20T02:15:40.164549Z',
+          deletion_time: '',
+          destroyed: true,
+        },
+        4: {
+          created_time: '2023-07-21T03:11:58.095971Z',
+          deletion_time: '',
+          destroyed: false,
+        },
+      },
+    };
+    this.breadcrumbs = [{ label: 'Version History', route: 'secret.metadata.versions' }, { label: 'Diff' }];
+
+    this.renderComponent = () =>
+      render(
+        hbs`
+          <Page::Secret::Metadata::VersionDiff
+            @metadata={{this.metadata}}
+            @path={{this.path}}
+            @backend={{this.backend}}
+            @breadcrumbs={{this.breadcrumbs}}
+          />
+        `,
+        { owner: this.engine }
+      );
+
+    this.api = this.owner.lookup('service:api');
+    this.queryParamsStub = sinon.stub(this.api, 'addQueryParams');
+    this.fetchStub = sinon.stub(this.api.secrets, 'kvV2Read').callsFake((path, backend, initOverride) => {
+      initOverride();
+      return Promise.resolve({});
     });
   });
 
   test('it renders empty states when current version is deleted or destroyed', async function (assert) {
-    assert.expect(4);
-    this.server.get(`/${this.backend}/data/${this.path}`, () => {});
-    const { currentVersion } = this.metadata;
+    assert.expect(7);
 
+    const { current_version } = this.metadata;
     // destroyed
-    this.metadata.versions[currentVersion].destroyed = true;
-    await render(
-      hbs`
-       <Page::Secret::Metadata::VersionDiff
-        @metadata={{this.metadata}} 
-        @path={{this.path}}
-        @backend={{this.backend}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
+    this.metadata.versions[current_version].destroyed = true;
+    await this.renderComponent();
+
+    assert.true(this.fetchStub.calledWith(this.path, this.backend));
+    assert.deepEqual(
+      this.queryParamsStub.firstCall.args[1],
+      { version: 1 },
+      'correct version passed as query param to first request'
+    );
+    assert.deepEqual(
+      this.queryParamsStub.secondCall.args[1],
+      { version: 4 },
+      'correct version passed as query param to second request'
     );
-    assert.dom(PAGE.emptyStateTitle).hasText(`Version ${currentVersion} has been destroyed`);
+    assert.dom(PAGE.emptyStateTitle).hasText(`Version ${current_version} has been destroyed`);
     assert
       .dom(PAGE.emptyStateMessage)
       .hasText('The current version of this secret has been destroyed. Select another version to compare.');
 
     // deleted
-    this.metadata.versions[currentVersion].destroyed = false;
-    this.metadata.versions[currentVersion].deletion_time = '2023-07-25T00:36:19.950545Z';
+    this.metadata.versions[current_version].destroyed = false;
+    this.metadata.versions[current_version].deletion_time = '2023-07-25T00:36:19.950545Z';
     await render(
       hbs`
        <Page::Secret::Metadata::VersionDiff
@@ -78,48 +108,23 @@ module('Integration | Component | kv | Page::Secret::Metadata::VersionDiff', fun
       { owner: this.engine }
     );
 
-    assert.dom(PAGE.emptyStateTitle).hasText(`Version ${currentVersion} has been deleted`);
+    assert.dom(PAGE.emptyStateTitle).hasText(`Version ${current_version} has been deleted`);
     assert
       .dom(PAGE.emptyStateMessage)
       .hasText('The current version of this secret has been deleted. Select another version to compare.');
   });
 
   test('it renders compared data of the two versions and shows icons for deleted, destroyed and current', async function (assert) {
-    assert.expect(14);
-    this.server.get(`/${this.backend}/data/${this.path}`, (schema, req) => {
-      assert.ok('request made to the fetch version 1 data.');
-      // request should not be made for version 4 (current version) because that record already exists in the store
-      assert.strictEqual(req.queryParams.version, '1', 'request includes version param');
-      return {
-        request_id: 'foobar',
-        data: {
-          data: { hello: 'world' },
-          metadata: {
-            created_time: '2023-06-20T21:26:47.592306Z',
-            custom_metadata: null,
-            deletion_time: '',
-            destroyed: false,
-            version: 1,
-          },
-        },
-      };
-    });
+    assert.expect(12);
 
-    await render(
-      hbs`
-       <Page::Secret::Metadata::VersionDiff
-        @metadata={{this.metadata}} 
-        @path={{this.path}}
-        @backend={{this.backend}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
+    this.fetchStub.onFirstCall().resolves({ data: { hello: 'world' } }); // version 1
+    this.fetchStub.onSecondCall().resolves({ data: { foo: 'bar' } }); // version 4 (current version)
+
+    await this.renderComponent();
 
     const [left, right] = findAll(PAGE.detail.versionDropdown);
     assert.dom(PAGE.diff.visualDiff).hasText(
-      `foo\"bar\"hello\"world\"`, // eslint-disable-line no-useless-escape
+      `hello\"world\"foo\"bar\"`, // eslint-disable-line no-useless-escape
       'correctly pull in the data from version 4 and compared to version 1.'
     );
     assert.dom(PAGE.diff.deleted).hasText(`hello"world"`);
diff --git a/ui/tests/integration/components/kv/page/kv-page-version-history-test.js b/ui/tests/integration/components/kv/page/kv-page-version-history-test.js
index 6461d6d0a64..3fab7022437 100644
--- a/ui/tests/integration/components/kv/page/kv-page-version-history-test.js
+++ b/ui/tests/integration/components/kv/page/kv-page-version-history-test.js
@@ -1,61 +1,77 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
-import { setupMirage } from 'ember-cli-mirage/test-support';
 import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { kvMetadataPath } from 'vault/utils/kv-path';
 import { PAGE } from 'vault/tests/helpers/kv/kv-selectors';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import isDeleted from 'kv/helpers/is-deleted';
 
-module('Integration | Component | kv | Page::Secret::Metadata::Version-History', function (hooks) {
+module('Integration | Component | kv-v2 | Page::Secret::Metadata::Version-History', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'kv');
-  setupMirage(hooks);
 
   hooks.beforeEach(async function () {
-    const store = this.owner.lookup('service:store');
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
-    const metadata = this.server.create('kv-metadatum');
+    this.backend = 'kv-engine';
+    this.path = 'my-secret';
     // we want to test a scenario where the current version is also destroyed so there are two icons.
-    // we override the mirage factory to account for this use case.
-    metadata.data.versions[4] = {
-      created_time: '2023-07-21T03:11:58.095971Z',
-      deletion_time: '',
-      destroyed: true,
+    this.metadata = {
+      current_version: 4,
+      updated_time: '2023-07-21T03:11:58.095971Z',
+      versions: {
+        1: {
+          created_time: '2018-03-22T02:24:06.945319214Z',
+          deletion_time: '',
+          destroyed: false,
+        },
+        2: {
+          created_time: '2023-07-20T02:15:35.86465Z',
+          deletion_time: '2023-07-25T00:36:19.950545Z',
+          destroyed: false,
+        },
+        3: {
+          created_time: '2023-07-20T02:15:40.164549Z',
+          deletion_time: '',
+          destroyed: true,
+        },
+        4: {
+          created_time: '2023-07-21T03:11:58.095971Z',
+          deletion_time: '',
+          destroyed: true,
+        },
+      },
     };
-    metadata.id = kvMetadataPath('kv-engine', 'my-secret');
-    store.pushPayload('kv/metadatum', {
-      modelName: 'kv/metadata',
-      ...metadata,
-    });
-    this.metadata = store.peekRecord('kv/metadata', metadata.id);
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: this.metadata.backend, route: 'list' },
-      { label: this.metadata.path, route: 'secret.details', model: this.metadata.path },
-      { label: 'version history' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: this.backend, route: 'list' },
+      { label: this.path, route: 'secret.details', model: this.path },
+      { label: 'Version History' },
     ];
+    this.capabilities = { canReadMetadata: true, canCreateVersionData: true };
+
+    this.renderComponent = () =>
+      render(
+        hbs`
+          <Page::Secret::Metadata::VersionHistory
+            @metadata={{this.metadata}}
+            @path={{this.path}}
+            @backend={{this.backend}}
+            @breadcrumbs={{this.breadcrumbs}}
+            @capabilities={{this.capabilities}}
+          />
+      `,
+        { owner: this.engine }
+      );
   });
 
   test('it renders version history and shows icons for deleted, destroyed and current', async function (assert) {
     assert.expect(7); // 4 linked blocks, 2 destroyed, 1 deleted.
 
-    await render(
-      hbs`
-       <Page::Secret::Metadata::VersionHistory
-        @path={{this.metadata.path}}
-        @metadata={{this.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
+    await this.renderComponent();
 
     for (const version in this.metadata.versions) {
       const data = this.metadata.versions[version];
@@ -64,9 +80,9 @@ module('Integration | Component | kv | Page::Secret::Metadata::Version-History',
       if (data.destroyed) {
         assert
           .dom(`${PAGE.versions.icon(version)} [data-test-icon="x-square-fill"]`)
-          .hasStyle({ color: 'rgb(199, 52, 69)' });
+          .hasStyle({ color: 'rgb(229, 34, 40)' });
       }
-      if (data.isSecretDeleted) {
+      if (isDeleted(data.deletion_time)) {
         assert
           .dom(`${PAGE.versions.icon(version)} [data-test-icon="x-square-fill"]`)
           .hasStyle({ color: 'rgb(101, 106, 118)' });
@@ -76,16 +92,8 @@ module('Integration | Component | kv | Page::Secret::Metadata::Version-History',
 
   test('it gives the option to create a new version from a secret from the popup menu', async function (assert) {
     assert.expect(1);
-    await render(
-      hbs`
-       <Page::Secret::Metadata::VersionHistory
-        @path={{this.metadata.path}}
-        @metadata={{this.metadata}}
-        @breadcrumbs={{this.breadcrumbs}}
-      />
-      `,
-      { owner: this.engine }
-    );
+
+    await this.renderComponent();
     // because the popup menu is nested in a linked block we must combine the two selectors
     const popupSelector = `${PAGE.versions.linkedBlock(1)} ${PAGE.popup}`;
     await click(popupSelector);
diff --git a/ui/tests/integration/components/ldap/accounts-checked-out-test.js b/ui/tests/integration/components/ldap/accounts-checked-out-test.js
index f48fc67598b..885e9d02b3e 100644
--- a/ui/tests/integration/components/ldap/accounts-checked-out-test.js
+++ b/ui/tests/integration/components/ldap/accounts-checked-out-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -57,6 +57,10 @@ module('Integration | Component | ldap | AccountsCheckedOut', function (hooks) {
     };
   });
 
+  hooks.afterEach(function () {
+    this.authStub.restore();
+  });
+
   test('it should render empty state when no accounts are checked out', async function (assert) {
     this.statuses = [
       { account: 'foo', available: true, library: 'test-library' },
@@ -74,7 +78,7 @@ module('Integration | Component | ldap | AccountsCheckedOut', function (hooks) {
   });
 
   test('it should filter accounts for root user', async function (assert) {
-    this.authStub.value({});
+    this.authStub.value({ entityId: '' });
 
     await this.renderComponent();
 
@@ -85,7 +89,7 @@ module('Integration | Component | ldap | AccountsCheckedOut', function (hooks) {
   });
 
   test('it should filter accounts for non root user', async function (assert) {
-    this.authStub.value({ entity_id: '456' });
+    this.authStub.value({ entityId: '456' });
 
     await this.renderComponent();
 
@@ -107,7 +111,7 @@ module('Integration | Component | ldap | AccountsCheckedOut', function (hooks) {
   });
 
   test('it should display details in table', async function (assert) {
-    this.authStub.value({ entity_id: '456' });
+    this.authStub.value({ entityId: '456' });
 
     await this.renderComponent();
 
diff --git a/ui/tests/integration/components/ldap/config-cta-test.js b/ui/tests/integration/components/ldap/config-cta-test.js
index 6c80068d9b1..3d9c2de46b1 100644
--- a/ui/tests/integration/components/ldap/config-cta-test.js
+++ b/ui/tests/integration/components/ldap/config-cta-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/ldap/page/configuration-test.js b/ui/tests/integration/components/ldap/page/configuration-test.js
index 9a881fcd4c5..9531636a8e7 100644
--- a/ui/tests/integration/components/ldap/page/configuration-test.js
+++ b/ui/tests/integration/components/ldap/page/configuration-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,17 +10,16 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { duration } from 'core/helpers/format-duration';
-import { createSecretsEngine, generateBreadcrumbs } from 'vault/tests/helpers/ldap';
+import { createSecretsEngine, generateBreadcrumbs } from 'vault/tests/helpers/ldap/ldap-helpers';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const selectors = {
   rotateAction: '[data-test-toolbar-rotate-action]',
-  confirmRotate: '[data-test-confirm-button]',
   configAction: '[data-test-toolbar-config-action]',
   configCta: '[data-test-config-cta]',
   mountConfig: '[data-test-mount-config]',
   pageError: '[data-test-page-error]',
-  fieldValue: (label) => `[data-test-value-div="${label}"]`,
 };
 
 module('Integration | Component | ldap | Page::Configuration', function (hooks) {
@@ -68,7 +67,7 @@ module('Integration | Component | ldap | Page::Configuration', function (hooks)
 
     await this.renderComponent();
 
-    assert.dom('.title svg').hasClass('flight-icon-folder-users', 'LDAP icon renders in title');
+    assert.dom('.title svg').hasClass('hds-icon-folder-users', 'LDAP icon renders in title');
     assert.dom('.title').hasText('ldap-test', 'Mount path renders in title');
     assert
       .dom(selectors.rotateAction)
@@ -84,27 +83,27 @@ module('Integration | Component | ldap | Page::Configuration', function (hooks)
 
     await this.renderComponent();
 
-    assert.dom(selectors.pageError).exists('Config fetch error is rendered');
+    assert.dom(GENERAL.pageError.error).exists('Config fetch error is rendered');
   });
 
   test('it should render display fields', async function (assert) {
     await this.renderComponent();
 
-    assert.dom(selectors.fieldValue('Administrator Distinguished Name')).hasText(this.config.binddn);
-    assert.dom(selectors.fieldValue('URL')).hasText(this.config.url);
-    assert.dom(selectors.fieldValue('Schema')).hasText(this.config.schema);
-    assert.dom(selectors.fieldValue('Password Policy')).hasText(this.config.password_policy);
-    assert.dom(selectors.fieldValue('Userdn')).hasText(this.config.userdn);
-    assert.dom(selectors.fieldValue('Userattr')).hasText(this.config.userattr);
+    assert.dom(GENERAL.infoRowValue('Administrator Distinguished Name')).hasText(this.config.binddn);
+    assert.dom(GENERAL.infoRowValue('URL')).hasText(this.config.url);
+    assert.dom(GENERAL.infoRowValue('Schema')).hasText(this.config.schema);
+    assert.dom(GENERAL.infoRowValue('Password Policy')).hasText(this.config.password_policy);
+    assert.dom(GENERAL.infoRowValue('Userdn')).hasText(this.config.userdn);
+    assert.dom(GENERAL.infoRowValue('Userattr')).hasText(this.config.userattr);
     assert
-      .dom(selectors.fieldValue('Connection Timeout'))
+      .dom(GENERAL.infoRowValue('Connection Timeout'))
       .hasText(duration([this.config.connection_timeout]));
-    assert.dom(selectors.fieldValue('Request Timeout')).hasText(duration([this.config.request_timeout]));
-    assert.dom(selectors.fieldValue('CA Certificate')).hasText(this.config.certificate);
-    assert.dom(selectors.fieldValue('Start TLS')).includesText('No');
-    assert.dom(selectors.fieldValue('Insecure TLS')).includesText('No');
-    assert.dom(selectors.fieldValue('Client TLS Certificate')).hasText(this.config.client_tls_cert);
-    assert.dom(selectors.fieldValue('Client TLS Key')).hasText(this.config.client_tls_key);
+    assert.dom(GENERAL.infoRowValue('Request Timeout')).hasText(duration([this.config.request_timeout]));
+    assert.dom(GENERAL.infoRowValue('CA Certificate')).hasText(this.config.certificate);
+    assert.dom(GENERAL.infoRowValue('Start TLS')).includesText('No');
+    assert.dom(GENERAL.infoRowValue('Insecure TLS')).includesText('No');
+    assert.dom(GENERAL.infoRowValue('Client TLS Certificate')).hasText(this.config.client_tls_cert);
+    assert.dom(GENERAL.infoRowValue('Client TLS Key')).hasText(this.config.client_tls_key);
   });
 
   test('it should rotate root password', async function (assert) {
@@ -116,6 +115,6 @@ module('Integration | Component | ldap | Page::Configuration', function (hooks)
 
     await this.renderComponent();
     await click(selectors.rotateAction);
-    await click(selectors.confirmRotate);
+    await click(GENERAL.confirmButton);
   });
 });
diff --git a/ui/tests/integration/components/ldap/page/configure-test.js b/ui/tests/integration/components/ldap/page/configure-test.js
index b2b3ed958ca..89cf0f89e4c 100644
--- a/ui/tests/integration/components/ldap/page/configure-test.js
+++ b/ui/tests/integration/components/ldap/page/configure-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,8 @@ import { render, click, fillIn } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { Response } from 'miragejs';
 import sinon from 'sinon';
-import { generateBreadcrumbs } from 'vault/tests/helpers/ldap';
+import { generateBreadcrumbs } from 'vault/tests/helpers/ldap/ldap-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const selectors = {
   radioCard: '[data-test-radio-card="OpenLDAP"]',
@@ -30,7 +31,8 @@ module('Integration | Component | ldap | Page::Configure', function (hooks) {
     await fillIn(selectors.binddn, 'foo');
     await fillIn(selectors.bindpass, 'bar');
     await click(selectors.save);
-    await click(`[data-test-save-${rotate}-rotate]`);
+    const buttonLabel = rotate === 'without' ? 'Save without rotating' : 'Save and rotate';
+    await click(GENERAL.button(buttonLabel));
   };
 
   hooks.beforeEach(function () {
@@ -79,10 +81,10 @@ module('Integration | Component | ldap | Page::Configure', function (hooks) {
     await click(selectors.save);
 
     assert
-      .dom('[data-test-field="binddn"] [data-test-inline-error-message]')
+      .dom(GENERAL.validationErrorByAttr('binddn'))
       .hasText('Administrator distinguished name is required.', 'Validation message renders for binddn');
     assert
-      .dom('[data-test-field="bindpass"] [data-test-inline-error-message]')
+      .dom(GENERAL.validationErrorByAttr('bindpass'))
       .hasText('Administrator password is required.', 'Validation message renders for bindpass');
     assert
       .dom('[data-test-invalid-form-message]')
diff --git a/ui/tests/integration/components/ldap/page/libraries-test.js b/ui/tests/integration/components/ldap/page/libraries-test.js
index 32ff5450cb6..3e7e52afa88 100644
--- a/ui/tests/integration/components/ldap/page/libraries-test.js
+++ b/ui/tests/integration/components/ldap/page/libraries-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,8 +10,9 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click, fillIn } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
-import { createSecretsEngine, generateBreadcrumbs } from 'vault/tests/helpers/ldap';
+import { createSecretsEngine, generateBreadcrumbs } from 'vault/tests/helpers/ldap/ldap-helpers';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { LDAP_SELECTORS } from 'vault/tests/helpers/ldap/ldap-selectors';
 
 module('Integration | Component | ldap | Page::Libraries', function (hooks) {
   setupRenderingTest(hooks);
@@ -25,7 +26,7 @@ module('Integration | Component | ldap | Page::Libraries', function (hooks) {
     this.backend = createSecretsEngine(this.store);
     this.breadcrumbs = generateBreadcrumbs(this.backend.id);
 
-    for (const name of ['foo', 'bar']) {
+    for (const name of ['foo', 'bar', 'foo/']) {
       this.store.pushPayload('ldap/library', {
         modelName: 'ldap/library',
         backend: 'ldap-test',
@@ -58,7 +59,7 @@ module('Integration | Component | ldap | Page::Libraries', function (hooks) {
 
     await this.renderComponent();
 
-    assert.dom('.title svg').hasClass('flight-icon-folder-users', 'LDAP icon renders in title');
+    assert.dom('.title svg').hasClass('hds-icon-folder-users', 'LDAP icon renders in title');
     assert.dom('.title').hasText('ldap-test', 'Mount path renders in title');
     assert
       .dom('[data-test-toolbar-action="config"]')
@@ -76,7 +77,7 @@ module('Integration | Component | ldap | Page::Libraries', function (hooks) {
       .hasText('Create library', 'Toolbar action has correct text');
     assert
       .dom('[data-test-toolbar-action="library"] svg')
-      .hasClass('flight-icon-plus', 'Toolbar action has correct icon');
+      .hasClass('hds-icon-plus', 'Toolbar action has correct icon');
     assert
       .dom('[data-test-filter-input]')
       .doesNotExist('Libraries filter input is hidden when libraries have not been created');
@@ -92,13 +93,20 @@ module('Integration | Component | ldap | Page::Libraries', function (hooks) {
   test('it should render libraries list', async function (assert) {
     await this.renderComponent();
 
-    assert.dom('[data-test-list-item-content] svg').hasClass('flight-icon-folder', 'List item icon renders');
-    assert.dom('[data-test-library]').hasText(this.libraries[0].name, 'List item name renders');
+    assert.dom('[data-test-list-item-content] svg').hasClass('hds-icon-folder', 'List item icon renders');
+    assert.dom('[data-test-library="foo"]').hasText('foo', 'List item name renders');
 
-    await click('[data-test-popup-menu-trigger]');
+    await click(LDAP_SELECTORS.libraryMenu('foo'));
+    assert.dom('[data-test-subdirectory]').doesNotExist();
     assert.dom('[data-test-edit]').hasText('Edit', 'Edit link renders in menu');
     assert.dom('[data-test-details]').hasText('Details', 'Details link renders in menu');
     assert.dom('[data-test-delete]').hasText('Delete', 'Details link renders in menu');
+
+    await click(LDAP_SELECTORS.libraryMenu('foo/'));
+    assert.dom('[data-test-subdirectory]').hasText('Content', 'Content link renders in menu');
+    assert.dom('[data-test-edit]').doesNotExist();
+    assert.dom('[data-test-details]').doesNotExist();
+    assert.dom('[data-test-delete]').doesNotExist();
   });
 
   test('it should filter libraries', async function (assert) {
@@ -110,11 +118,11 @@ module('Integration | Component | ldap | Page::Libraries', function (hooks) {
       .hasText('There are no libraries matching "baz"', 'Filter message renders');
 
     await fillIn('[data-test-filter-input]', 'foo');
-    assert.dom('[data-test-list-item-content]').exists({ count: 1 }, 'List is filtered with correct results');
+    assert.dom('[data-test-list-item-content]').exists({ count: 2 }, 'List is filtered with correct results');
 
     await fillIn('[data-test-filter-input]', '');
     assert
       .dom('[data-test-list-item-content]')
-      .exists({ count: 2 }, 'All libraries are displayed when filter is cleared');
+      .exists({ count: 3 }, 'All libraries are displayed when filter is cleared');
   });
 });
diff --git a/ui/tests/integration/components/ldap/page/library/check-out-test.js b/ui/tests/integration/components/ldap/page/library/check-out-test.js
index bf38ccd28e4..f3091a5ca76 100644
--- a/ui/tests/integration/components/ldap/page/library/check-out-test.js
+++ b/ui/tests/integration/components/ldap/page/library/check-out-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,6 +8,7 @@ import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 
@@ -26,9 +27,9 @@ module('Integration | Component | ldap | Page::Library::CheckOut', function (hoo
     };
     this.breadcrumbs = [
       { label: 'ldap-test', route: 'overview' },
-      { label: 'libraries', route: 'libraries' },
+      { label: 'Libraries', route: 'libraries' },
       { label: 'test-library', route: 'libraries.library' },
-      { label: 'check-out' },
+      { label: 'Check-Out' },
     ];
 
     this.renderComponent = () => {
@@ -48,13 +49,13 @@ module('Integration | Component | ldap | Page::Library::CheckOut', function (hoo
       .containsText('ldap-test', 'Overview breadcrumb renders');
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(2) a')
-      .containsText('libraries', 'Libraries breadcrumb renders');
+      .containsText('Libraries', 'Libraries breadcrumb renders');
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(3)')
       .containsText('test-library', 'Library breadcrumb renders');
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(4)')
-      .containsText('check-out', 'Check-out breadcrumb renders');
+      .containsText('Check-Out', 'Check-out breadcrumb renders');
   });
 
   test('it should render check out information and credentials', async function (assert) {
@@ -69,28 +70,28 @@ module('Integration | Component | ldap | Page::Library::CheckOut', function (hoo
         'Warning alert renders'
       );
     assert.dom('[data-test-row-value="Account name"]').hasText('foo.bar', 'Account name renders');
-    await click('[data-test-button="toggle-masked"]');
-    assert.dom('[data-test-value-div="Password"] .masked-value').hasText('password', 'Password renders');
+    await click(GENERAL.button('toggle-masked'));
+    assert.dom(`${GENERAL.infoRowValue('Password')} .masked-value`).hasText('password', 'Password renders');
     assert
       .dom('[data-test-row-value="Lease ID"]')
       .hasText('ldap/library/test/check-out/123', 'Lease ID renders');
     assert
-      .dom('[data-test-value-div="Lease renewable"] svg')
-      .hasClass('flight-icon-check-circle', 'Lease renewable true icon renders');
+      .dom(`${GENERAL.infoRowValue('Lease renewable')} svg`)
+      .hasClass('hds-icon-check-circle', 'Lease renewable true icon renders');
     assert
-      .dom('[data-test-value-div="Lease renewable"] svg')
+      .dom(`${GENERAL.infoRowValue('Lease renewable')} svg`)
       .hasClass('has-text-success', 'Lease renewable true icon color renders');
-    assert.dom('[data-test-value-div="Lease renewable"] span').hasText('True', 'Lease renewable renders');
+    assert.dom(`${GENERAL.infoRowValue('Lease renewable')} span`).hasText('True', 'Lease renewable renders');
 
     this.creds.renewable = false;
     await this.renderComponent();
     assert
-      .dom('[data-test-value-div="Lease renewable"] svg')
-      .hasClass('flight-icon-x-circle', 'Lease renewable false icon renders');
+      .dom(`${GENERAL.infoRowValue('Lease renewable')} svg`)
+      .hasClass('hds-icon-x-circle', 'Lease renewable false icon renders');
     assert
-      .dom('[data-test-value-div="Lease renewable"] svg')
+      .dom(`${GENERAL.infoRowValue('Lease renewable')} svg`)
       .hasClass('has-text-danger', 'Lease renewable false icon color renders');
-    assert.dom('[data-test-value-div="Lease renewable"] span').hasText('False', 'Lease renewable renders');
+    assert.dom(`${GENERAL.infoRowValue('Lease renewable')} span`).hasText('False', 'Lease renewable renders');
 
     await click('[data-test-done]');
     const didTransition = transitionStub.calledWith(
diff --git a/ui/tests/integration/components/ldap/page/library/create-and-edit-test.js b/ui/tests/integration/components/ldap/page/library/create-and-edit-test.js
index 2466a2cbf2b..1c2456ec369 100644
--- a/ui/tests/integration/components/ldap/page/library/create-and-edit-test.js
+++ b/ui/tests/integration/components/ldap/page/library/create-and-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,6 +10,7 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click, fillIn } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | ldap | Page::Library::CreateAndEdit', function (hooks) {
   setupRenderingTest(hooks);
@@ -37,8 +38,8 @@ module('Integration | Component | ldap | Page::Library::CreateAndEdit', function
 
     this.breadcrumbs = [
       { label: 'ldap', route: 'overview' },
-      { label: 'libraries', route: 'libraries' },
-      { label: 'create' },
+      { label: 'Libraries', route: 'libraries' },
+      { label: 'Create' },
     ];
 
     this.renderComponent = () => {
@@ -65,7 +66,7 @@ module('Integration | Component | ldap | Page::Library::CreateAndEdit', function
     assert.dom('[data-test-ttl-value="Max lease TTL"]').hasAnyValue('Max lease ttl renders');
     const checkInValue = this.libraryData.disable_check_in_enforcement ? 'Disabled' : 'Enabled';
     assert
-      .dom(`[data-test-input="disable_check_in_enforcement"] input#${checkInValue}`)
+      .dom(`[data-test-input-group="disable_check_in_enforcement"] input#${checkInValue}`)
       .isChecked('Correct radio is checked for check-in enforcement');
   });
 
@@ -84,13 +85,13 @@ module('Integration | Component | ldap | Page::Library::CreateAndEdit', function
     this.model = this.newModel;
 
     await this.renderComponent();
-    await click('[data-test-save]');
+    await click('[data-test-submit]');
 
     assert
-      .dom('[data-test-field-validation="name"]')
+      .dom(GENERAL.validationErrorByAttr('name'))
       .hasText('Library name is required.', 'Name validation error renders');
     assert
-      .dom('[data-test-field-validation="service_account_names"]')
+      .dom(GENERAL.validationErrorByAttr('service_account_names'))
       .hasText('At least one service account is required.', 'Service account name validation error renders');
     assert
       .dom('[data-test-invalid-form-message]')
@@ -120,8 +121,8 @@ module('Integration | Component | ldap | Page::Library::CreateAndEdit', function
     await click('[data-test-string-list-button="add"]');
     await fillIn('[data-test-string-list-input="1"]', 'bar@baz.com');
     await click('[data-test-string-list-button="add"]');
-    await click('[data-test-input="disable_check_in_enforcement"] input#Disabled');
-    await click('[data-test-save]');
+    await click('[data-test-input-group="disable_check_in_enforcement"] input#Disabled');
+    await click('[data-test-submit]');
 
     assert.ok(
       this.transitionCalledWith('libraries.library.details', 'new-library'),
@@ -147,9 +148,9 @@ module('Integration | Component | ldap | Page::Library::CreateAndEdit', function
 
     await this.renderComponent();
 
-    await click('[data-test-string-list-button="delete"]');
-    await click('[data-test-input="disable_check_in_enforcement"] input#Disabled');
-    await click('[data-test-save]');
+    await click('[data-test-string-list-row="0"] [data-test-string-list-button="delete"]');
+    await click('[data-test-input-group="disable_check_in_enforcement"] input#Disabled');
+    await click('[data-test-submit]');
 
     assert.ok(
       this.transitionCalledWith('libraries.library.details', 'test-library'),
diff --git a/ui/tests/integration/components/ldap/page/library/details-test.js b/ui/tests/integration/components/ldap/page/library/details-test.js
index ae9e634f6e2..9cc2bddf25d 100644
--- a/ui/tests/integration/components/ldap/page/library/details-test.js
+++ b/ui/tests/integration/components/ldap/page/library/details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,6 +10,7 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | ldap | Page::Library::Details', function (hooks) {
   setupRenderingTest(hooks);
@@ -34,7 +35,7 @@ module('Integration | Component | ldap | Page::Library::Details', function (hook
 
     this.breadcrumbs = [
       { label: 'ldap-test', route: 'overview' },
-      { label: 'libraries', route: 'libraries' },
+      { label: 'Libraries', route: 'libraries' },
       { label: 'test-library' },
     ];
   });
@@ -57,7 +58,7 @@ module('Integration | Component | ldap | Page::Library::Details', function (hook
       .containsText(this.model.backend, 'Overview breadcrumb renders');
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(2) a')
-      .containsText('libraries', 'Libraries breadcrumb renders');
+      .containsText('Libraries', 'Libraries breadcrumb renders');
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(3)')
       .containsText(this.model.name, 'Library breadcrumb renders');
@@ -70,7 +71,7 @@ module('Integration | Component | ldap | Page::Library::Details', function (hook
 
     const transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
     await click('[data-test-delete]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
     assert.ok(
       transitionStub.calledWith('vault.cluster.secrets.backend.ldap.libraries'),
       'Transitions to libraries route on delete success'
diff --git a/ui/tests/integration/components/ldap/page/library/details/accounts-test.js b/ui/tests/integration/components/ldap/page/library/details/accounts-test.js
index 94b0048cc51..d81dd27588e 100644
--- a/ui/tests/integration/components/ldap/page/library/details/accounts-test.js
+++ b/ui/tests/integration/components/ldap/page/library/details/accounts-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,6 +11,7 @@ import { render, click, fillIn } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
 import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | ldap | Page::Library::Details::Accounts', function (hooks) {
   setupRenderingTest(hooks);
@@ -76,7 +77,10 @@ module('Integration | Component | ldap | Page::Library::Details::Accounts', func
     assert.dom('[data-test-checked-out-card]').exists('Accounts checked out card renders');
 
     assert
-      .dom('[data-test-accounts-code-block] code')
-      .hasText('vault lease renew ad/library/test-library/check-out/:lease_id', 'Renew cli command renders');
+      .dom(`${GENERAL.codeBlock('accounts')} code`)
+      .hasText(
+        'vault lease renew ldap-test/library/test-library/check-out/:lease_id',
+        'Renew cli command renders with backend path'
+      );
   });
 });
diff --git a/ui/tests/integration/components/ldap/page/library/details/configuration-test.js b/ui/tests/integration/components/ldap/page/library/details/configuration-test.js
index aae3ef0baff..48a287c9ee8 100644
--- a/ui/tests/integration/components/ldap/page/library/details/configuration-test.js
+++ b/ui/tests/integration/components/ldap/page/library/details/configuration-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,6 +10,7 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { duration } from 'core/helpers/format-duration';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | ldap | Page::Library::Details::Configuration', function (hooks) {
   setupRenderingTest(hooks);
@@ -46,13 +47,13 @@ module('Integration | Component | ldap | Page::Library::Details::Configuration',
       const value = label.includes('TTL') ? duration([this.model[key]]) : this.model[key];
       const method = key === 'disable_check_in_enforcement' ? 'includesText' : 'hasText';
 
-      assert.dom(`[data-test-row-label="${label}"]`).hasText(label, `${label} info row label renders`);
-      assert.dom(`[data-test-value-div="${label}"]`)[method](value, `${label} info row label renders`);
+      assert.dom(GENERAL.infoRowLabel(label)).hasText(label, `${label} info row label renders`);
+      assert.dom(GENERAL.infoRowValue(label))[method](value, `${label} info row value renders`);
     });
 
     assert
       .dom('[data-test-check-in-icon]')
-      .hasClass('flight-icon-check-circle', 'Correct icon renders for enabled check in enforcement');
+      .hasClass('hds-icon-check-circle', 'Correct icon renders for enabled check in enforcement');
     assert
       .dom('[data-test-check-in-icon]')
       .hasClass('icon-true', 'Correct class renders for enabled check in enforcement');
@@ -62,7 +63,7 @@ module('Integration | Component | ldap | Page::Library::Details::Configuration',
 
     assert
       .dom('[data-test-check-in-icon]')
-      .hasClass('flight-icon-x-square', 'Correct icon renders for disabled check in enforcement');
+      .hasClass('hds-icon-x-square', 'Correct icon renders for disabled check in enforcement');
     assert
       .dom('[data-test-check-in-icon]')
       .hasClass('icon-false', 'Correct class renders for disabled check in enforcement');
diff --git a/ui/tests/integration/components/ldap/page/overview-test.js b/ui/tests/integration/components/ldap/page/overview-test.js
index 19cc7f1ec88..6101becec5f 100644
--- a/ui/tests/integration/components/ldap/page/overview-test.js
+++ b/ui/tests/integration/components/ldap/page/overview-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
-import { createSecretsEngine, generateBreadcrumbs } from 'vault/tests/helpers/ldap';
+import { createSecretsEngine, generateBreadcrumbs } from 'vault/tests/helpers/ldap/ldap-helpers';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
 
@@ -70,7 +70,7 @@ module('Integration | Component | ldap | Page::Overview', function (hooks) {
 
     await this.renderComponent();
 
-    assert.dom('.title svg').hasClass('flight-icon-folder-users', 'LDAP icon renders in title');
+    assert.dom('.title svg').hasClass('hds-icon-folder-users', 'LDAP icon renders in title');
     assert.dom('.title').hasText('ldap-test', 'Mount path renders in title');
     assert.dom('[data-test-toolbar-action="config"]').hasText('Configure LDAP', 'Toolbar action renders');
     assert.dom('[data-test-config-cta]').exists('Config cta renders');
diff --git a/ui/tests/integration/components/ldap/page/role/create-and-edit-test.js b/ui/tests/integration/components/ldap/page/role/create-and-edit-test.js
index 505c05adefc..5d7b1b3e9e0 100644
--- a/ui/tests/integration/components/ldap/page/role/create-and-edit-test.js
+++ b/ui/tests/integration/components/ldap/page/role/create-and-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,7 +10,8 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click, fillIn } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { ldapRoleID } from 'vault/adapters/ldap/role';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | ldap | Page::Role::CreateAndEdit', function (hooks) {
   setupRenderingTest(hooks);
@@ -30,7 +31,8 @@ module('Integration | Component | ldap | Page::Role::CreateAndEdit', function (h
     this.newModel = this.store.createRecord('ldap/role', { backend: 'ldap-test' });
 
     ['static', 'dynamic'].forEach((type) => {
-      this[`${type}RoleData`] = this.server.create('ldap-role', type, { name: `${type}-role` });
+      const name = `${type}-role`;
+      this[`${type}RoleData`] = this.server.create('ldap-role', type, { name, id: ldapRoleID(type, name) });
       this.store.pushPayload('ldap/role', {
         modelName: 'ldap/role',
         backend: 'ldap-test',
@@ -41,22 +43,18 @@ module('Integration | Component | ldap | Page::Role::CreateAndEdit', function (h
 
     this.breadcrumbs = [
       { label: 'ldap', route: 'overview' },
-      { label: 'roles', route: 'roles' },
-      { label: 'create' },
+      { label: 'Roles', route: 'roles' },
+      { label: 'Create' },
     ];
 
+    this.fetchModel = (type, name) => this.store.peekRecord('ldap/role', ldapRoleID(type, name));
+
     this.renderComponent = () => {
       return render(
         hbs`<Page::Role::CreateAndEdit @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />`,
         { owner: this.engine }
       );
     };
-    setRunOptions({
-      rules: {
-        // TODO: Fix JsonEditor component
-        label: { enabled: false },
-      },
-    });
   });
 
   test('it should display different form fields based on type', async function (assert) {
@@ -69,9 +67,7 @@ module('Integration | Component | ldap | Page::Role::CreateAndEdit', function (h
 
     const checkFields = (fields) => {
       fields.forEach((field) => {
-        assert
-          .dom(`[data-test-field="${field}"]`)
-          .exists(`${field} field renders when static type is selected`);
+        assert.dom(GENERAL.fieldByAttr(field)).exists(`${field} field renders when static type is selected`);
       });
     };
 
@@ -96,37 +92,37 @@ module('Integration | Component | ldap | Page::Role::CreateAndEdit', function (h
         const isLdif = field.includes('ldif');
         const method = isLdif ? 'includesText' : 'hasValue';
         const value = isLdif ? 'dn: cn={{.Username}},ou=users,dc=learn,dc=example' : this.model[field];
-        assert.dom(`[data-test-field="${field}"] ${element}`)[method](value, `${field} field value renders`);
+        assert.dom(`${GENERAL.fieldByAttr(field)} ${element}`)[method](value, `${field} field value renders`);
       });
     };
     const checkTtl = (fields) => {
       fields.forEach((field) => {
         assert
-          .dom(`[data-test-field="${field}"] [data-test-ttl-inputs] input`)
+          .dom(`${GENERAL.fieldByAttr(field)} [data-test-ttl-inputs] input`)
           .hasAnyValue(`${field} field ttl value renders`);
       });
     };
 
-    this.model = this.store.peekRecord('ldap/role', 'static-role');
+    this.model = this.fetchModel('static', 'static-role');
     await this.renderComponent();
     assert.dom('[data-test-radio-card="static"]').isDisabled('Type selection is disabled when editing');
-    assert.dom('[data-test-input="name"]').isDisabled('Name field is disabled when editing');
+    assert.dom(GENERAL.inputByAttr('name')).isDisabled('Name field is disabled when editing');
     checkFields(['name', 'dn', 'username']);
     checkTtl(['rotation_period']);
 
-    this.model = this.store.peekRecord('ldap/role', 'dynamic-role');
+    this.model = this.fetchModel('dynamic', 'dynamic-role');
     await this.renderComponent();
     checkFields(['name', 'username_template']);
     checkTtl(['default_ttl', 'max_ttl']);
-    checkFields(['creation_ldif', 'deletion_ldif', 'rollback_ldif'], '.CodeMirror-code');
+    checkFields(['creation_ldif', 'deletion_ldif', 'rollback_ldif'], '.cm-content');
   });
 
   test('it should go back to list route and clean up model on cancel', async function (assert) {
-    this.model = this.store.peekRecord('ldap/role', 'static-role');
+    this.model = this.fetchModel('static', 'static-role');
     const spy = sinon.spy(this.model, 'rollbackAttributes');
 
     await this.renderComponent();
-    await click('[data-test-cancel]');
+    await click(GENERAL.cancelButton);
 
     assert.ok(spy.calledOnce, 'Model is rolled back on cancel');
     assert.ok(this.transitionCalledWith('roles'), 'Transitions to roles list route on cancel');
@@ -135,12 +131,10 @@ module('Integration | Component | ldap | Page::Role::CreateAndEdit', function (h
   test('it should validate form fields', async function (assert) {
     const renderAndAssert = async (fields) => {
       await this.renderComponent();
-      await click('[data-test-save]');
+      await click(GENERAL.submitButton);
 
       fields.forEach((field) => {
-        assert
-          .dom(`[data-test-field="${field}"] [data-test-inline-error-message]`)
-          .exists('Validation message renders');
+        assert.dom(GENERAL.validationErrorByAttr(field)).exists('Validation message renders');
       });
 
       assert
@@ -167,11 +161,11 @@ module('Integration | Component | ldap | Page::Role::CreateAndEdit', function (h
     this.model = this.newModel;
     await this.renderComponent();
 
-    await fillIn('[data-test-input="name"]', 'test-role');
-    await fillIn('[data-test-input="dn"]', 'foo');
-    await fillIn('[data-test-input="username"]', 'bar');
-    await fillIn('[data-test-ttl-value="Rotation period"]', 5);
-    await click('[data-test-save]');
+    await fillIn(GENERAL.inputByAttr('name'), 'test-role');
+    await fillIn(GENERAL.inputByAttr('dn'), 'foo');
+    await fillIn(GENERAL.inputByAttr('username'), 'bar');
+    await fillIn(GENERAL.ttl.input('Rotation period'), 5);
+    await click(GENERAL.submitButton);
 
     assert.ok(
       this.transitionCalledWith('roles.role.details', 'static', 'test-role'),
@@ -188,13 +182,13 @@ module('Integration | Component | ldap | Page::Role::CreateAndEdit', function (h
       assert.deepEqual(expected, data, 'POST request made to save role with correct properties');
     });
 
-    this.model = this.store.peekRecord('ldap/role', 'static-role');
+    this.model = this.fetchModel('static', 'static-role');
     await this.renderComponent();
 
-    await fillIn('[data-test-input="dn"]', 'foo');
-    await fillIn('[data-test-input="username"]', 'bar');
-    await fillIn('[data-test-ttl-value="Rotation period"]', 30);
-    await click('[data-test-save]');
+    await fillIn(GENERAL.inputByAttr('dn'), 'foo');
+    await fillIn(GENERAL.inputByAttr('username'), 'bar');
+    await fillIn(GENERAL.ttl.input('Rotation period'), 30);
+    await click(GENERAL.submitButton);
 
     assert.ok(
       this.transitionCalledWith('roles.role.details', 'static', 'test-role'),
diff --git a/ui/tests/integration/components/ldap/page/role/credentials-test.js b/ui/tests/integration/components/ldap/page/role/credentials-test.js
index 579d1292373..41e16cb32e9 100644
--- a/ui/tests/integration/components/ldap/page/role/credentials-test.js
+++ b/ui/tests/integration/components/ldap/page/role/credentials-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,6 +12,7 @@ import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 import { duration } from 'core/helpers/format-duration';
 import { dateFormat } from 'core/helpers/date-format';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | ldap | Page::Role::Credentials', function (hooks) {
   setupRenderingTest(hooks);
@@ -21,9 +22,9 @@ module('Integration | Component | ldap | Page::Role::Credentials', function (hoo
   hooks.beforeEach(function () {
     this.breadcrumbs = [
       { label: 'ldap-test', route: 'overview' },
-      { label: 'roles', route: 'roles' },
+      { label: 'Roles', route: 'roles' },
       { label: 'test-role', route: 'roles.role' },
-      { label: 'credentials' },
+      { label: 'Credentials' },
     ];
     this.transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
   });
@@ -39,13 +40,13 @@ module('Integration | Component | ldap | Page::Role::Credentials', function (hoo
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(1)')
       .containsText('ldap-test', 'Overview breadcrumb renders');
-    assert.dom('[data-test-breadcrumbs] li:nth-child(2) a').containsText('roles', 'Roles breadcrumb renders');
+    assert.dom('[data-test-breadcrumbs] li:nth-child(2) a').containsText('Roles', 'Roles breadcrumb renders');
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(3)')
       .containsText('test-role', 'Role breadcrumb renders');
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(4)')
-      .containsText('credentials', 'Credentials breadcrumb renders');
+      .containsText('Credentials', 'Credentials breadcrumb renders');
   });
 
   test('it should render error', async function (assert) {
@@ -77,16 +78,14 @@ module('Integration | Component | ldap | Page::Role::Credentials', function (hoo
     );
 
     for (const field of fields) {
-      assert
-        .dom(`[data-test-row-label="${field.label}"]`)
-        .hasText(field.label, `${field.label} label renders`);
+      assert.dom(GENERAL.infoRowLabel(field.label)).hasText(field.label, `${field.label} label renders`);
 
       if (field.isMasked) {
-        await click(`[data-test-value-div="${field.label}"] [data-test-button="toggle-masked"]`);
+        await click(`${GENERAL.infoRowValue(field.label)} ${GENERAL.button('toggle-masked')}`);
       }
 
       const value = field.value ? field.value() : this.creds[field.key];
-      assert.dom(`[data-test-value-div="${field.label}"]`).hasText(value, `${field.label} value renders`);
+      assert.dom(GENERAL.infoRowValue(field.label)).hasText(value, `${field.label} value renders`);
     }
 
     await click('[data-test-done]');
@@ -120,16 +119,14 @@ module('Integration | Component | ldap | Page::Role::Credentials', function (hoo
       );
 
     for (const field of fields) {
-      assert
-        .dom(`[data-test-row-label="${field.label}"]`)
-        .hasText(field.label, `${field.label} label renders`);
+      assert.dom(GENERAL.infoRowLabel(field.label)).hasText(field.label, `${field.label} label renders`);
 
       if (field.isMasked) {
-        await click(`[data-test-value-div="${field.label}"] [data-test-button="toggle-masked"]`);
+        await click(`${GENERAL.infoRowValue(field.label)} ${GENERAL.button('toggle-masked')}`);
       }
 
       const value = field.value ? field.value() : this.creds[field.key];
-      assert.dom(`[data-test-value-div="${field.label}"]`).hasText(value, `${field.label} value renders`);
+      assert.dom(GENERAL.infoRowValue(field.label)).hasText(value, `${field.label} value renders`);
     }
 
     await click('[data-test-done]');
diff --git a/ui/tests/integration/components/ldap/page/role/details-test.js b/ui/tests/integration/components/ldap/page/role/details-test.js
index 51dc9405805..1a7c0bc2748 100644
--- a/ui/tests/integration/components/ldap/page/role/details-test.js
+++ b/ui/tests/integration/components/ldap/page/role/details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,6 +11,8 @@ import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 import { duration } from 'core/helpers/format-duration';
+import { ldapRoleID } from 'vault/adapters/ldap/role';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | ldap | Page::Role::Details', function (hooks) {
   setupRenderingTest(hooks);
@@ -25,6 +27,7 @@ module('Integration | Component | ldap | Page::Role::Details', function (hooks)
     }));
     this.renderComponent = (type) => {
       const data = this.server.create('ldap-role', type);
+      data.id = ldapRoleID(type, data.name);
       const store = this.owner.lookup('service:store');
       store.pushPayload('ldap/role', {
         modelName: 'ldap/role',
@@ -32,10 +35,10 @@ module('Integration | Component | ldap | Page::Role::Details', function (hooks)
         type,
         ...data,
       });
-      this.model = store.peekRecord('ldap/role', data.name);
+      this.model = store.peekRecord('ldap/role', ldapRoleID(type, data.name));
       this.breadcrumbs = [
         { label: this.model.backend, route: 'overview' },
-        { label: 'roles', route: 'roles' },
+        { label: 'Roles', route: 'roles' },
         { label: this.model.name },
       ];
       return render(hbs`<Page::Role::Details @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />`, {
@@ -50,7 +53,7 @@ module('Integration | Component | ldap | Page::Role::Details', function (hooks)
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(1)')
       .containsText(this.model.backend, 'Overview breadcrumb renders');
-    assert.dom('[data-test-breadcrumbs] li:nth-child(2) a').containsText('roles', 'Roles breadcrumb renders');
+    assert.dom('[data-test-breadcrumbs] li:nth-child(2) a').containsText('Roles', 'Roles breadcrumb renders');
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(3)')
       .containsText(this.model.name, 'Role breadcrumb renders');
@@ -62,7 +65,9 @@ module('Integration | Component | ldap | Page::Role::Details', function (hooks)
     await this.renderComponent('static');
 
     assert.dom('[data-test-delete]').hasText('Delete role', 'Delete action renders');
-    assert.dom('[data-test-get-credentials]').hasText('Get credentials', 'Get credentials action renders');
+    assert
+      .dom(GENERAL.button('Get credentials'))
+      .hasText('Get credentials', 'Get credentials action renders');
     assert.dom('[data-test-rotate-credentials]').exists('Rotate credentials action renders for static role');
     assert.dom('[data-test-edit]').hasText('Edit role', 'Edit action renders');
 
@@ -79,7 +84,7 @@ module('Integration | Component | ldap | Page::Role::Details', function (hooks)
       .doesNotExist('Rotate credentials action is hidden for dynamic role');
 
     await click('[data-test-delete]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
     assert.ok(
       transitionStub.calledWith('vault.cluster.secrets.backend.ldap.roles'),
       'Transitions to roles route on delete success'
diff --git a/ui/tests/integration/components/ldap/page/roles-test.js b/ui/tests/integration/components/ldap/page/roles-test.js
index ff5807992fd..f07aff1253c 100644
--- a/ui/tests/integration/components/ldap/page/roles-test.js
+++ b/ui/tests/integration/components/ldap/page/roles-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,8 +10,10 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click, fillIn } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
-import { createSecretsEngine, generateBreadcrumbs } from 'vault/tests/helpers/ldap';
+import { createSecretsEngine, generateBreadcrumbs } from 'vault/tests/helpers/ldap/ldap-helpers';
 import sinon from 'sinon';
+import { LDAP_SELECTORS } from 'vault/tests/helpers/ldap/ldap-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | ldap | Page::Roles', function (hooks) {
   setupRenderingTest(hooks);
@@ -62,7 +64,7 @@ module('Integration | Component | ldap | Page::Roles', function (hooks) {
 
     await this.renderComponent();
 
-    assert.dom('.title svg').hasClass('flight-icon-folder-users', 'LDAP icon renders in title');
+    assert.dom('.title svg').hasClass('hds-icon-folder-users', 'LDAP icon renders in title');
     assert.dom('.title').hasText('ldap-test', 'Mount path renders in title');
     assert
       .dom('[data-test-toolbar-action="config"]')
@@ -78,7 +80,7 @@ module('Integration | Component | ldap | Page::Roles', function (hooks) {
     assert.dom('[data-test-toolbar-action="role"]').hasText('Create role', 'Toolbar action has correct text');
     assert
       .dom('[data-test-toolbar-action="role"] svg')
-      .hasClass('flight-icon-plus', 'Toolbar action has correct icon');
+      .hasClass('hds-icon-plus', 'Toolbar action has correct icon');
     assert
       .dom('[data-test-filter-input]')
       .doesNotExist('Roles filter input is hidden when roles have not been created');
@@ -94,13 +96,15 @@ module('Integration | Component | ldap | Page::Roles', function (hooks) {
   test('it should render roles list', async function (assert) {
     await this.renderComponent();
 
-    assert.dom('[data-test-list-item-content] svg').hasClass('flight-icon-user', 'List item icon renders');
-    assert.dom('[data-test-role="static-test"]').hasText(this.roles[0].name, 'List item name renders');
+    assert.dom('[data-test-list-item-content] svg').hasClass('hds-icon-user', 'List item icon renders');
+    assert
+      .dom(LDAP_SELECTORS.roleItem('static', 'static-test'))
+      .hasText(this.roles[0].name, 'List item name renders');
     assert
       .dom('[data-test-role-type-badge="static-test"]')
       .hasText(this.roles[0].type, 'List item type badge renders');
 
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     assert.dom('[data-test-edit]').hasText('Edit', 'Edit link renders in menu');
     assert.dom('[data-test-get-creds]').hasText('Get credentials', 'Get credentials link renders in menu');
     assert
@@ -110,12 +114,20 @@ module('Integration | Component | ldap | Page::Roles', function (hooks) {
     assert.dom('[data-test-delete]').hasText('Delete', 'Details link renders in menu');
 
     await click('[data-test-popup-menu-trigger]:last-of-type');
-    assert.dom('[data-test-rotate-creds]').doesNotExist('Rotate credentials link is hidden for dynamic type');
+    assert
+      .dom('[data-test-popup-menu-trigger]:last-of-type [data-test-rotate-creds]')
+      .doesNotExist('Rotate credentials link is hidden for dynamic type');
   });
 
   test('it should filter roles', async function (assert) {
-    const transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
-
+    const currentRouteName = 'vault.cluster.secrets.backend.ldap.roles';
+    this.router = this.owner.lookup('service:router');
+    const transitionStub = sinon.stub(this.router, 'transitionTo');
+    // stub because the component calls either "roles.subdirectory" or "roles.index"
+    // depending on where it renders
+    sinon.stub(this.router, 'currentRoute').value({
+      name: currentRouteName,
+    });
     this.roles.meta.filteredTotal = 0;
     this.pageFilter = 'foo';
 
@@ -127,10 +139,13 @@ module('Integration | Component | ldap | Page::Roles', function (hooks) {
 
     await fillIn('[data-test-filter-input]', 'bar');
 
-    assert.true(
-      transitionStub.calledWith('vault.cluster.secrets.backend.ldap.roles', {
+    const [calledRoute, calledParams] = transitionStub.lastCall.args;
+    assert.strictEqual(calledRoute, currentRouteName);
+    assert.propEqual(
+      calledParams,
+      {
         queryParams: { pageFilter: 'bar' },
-      }),
+      },
       'Transition called with correct query params on filter change'
     );
   });
diff --git a/ui/tests/integration/components/ldap/tab-page-header-test.js b/ui/tests/integration/components/ldap/tab-page-header-test.js
index fe6f77c4dd9..8b219f73255 100644
--- a/ui/tests/integration/components/ldap/tab-page-header-test.js
+++ b/ui/tests/integration/components/ldap/tab-page-header-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -27,14 +27,14 @@ module('Integration | Component | ldap | TabPageHeader', function (hooks) {
     });
     this.model = this.store.peekRecord('secret-engine', 'ldap-test');
     this.mount = this.model.path.slice(0, -1);
-    this.breadcrumbs = [{ label: 'secrets', route: 'secrets', linkExternal: true }, { label: this.mount }];
+    this.breadcrumbs = [{ label: 'Secrets', route: 'secrets', linkExternal: true }, { label: this.mount }];
   });
 
   test('it should render breadcrumbs', async function (assert) {
     await render(hbs`<TabPageHeader @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />`, {
       owner: this.engine,
     });
-    assert.dom('[data-test-breadcrumbs] li:nth-child(1) a').hasText('secrets', 'Secrets breadcrumb renders');
+    assert.dom('[data-test-breadcrumbs] li:nth-child(1) a').hasText('Secrets', 'Secrets breadcrumb renders');
 
     assert
       .dom('[data-test-breadcrumbs] li:nth-child(2)')
@@ -47,7 +47,7 @@ module('Integration | Component | ldap | TabPageHeader', function (hooks) {
     });
     assert
       .dom('[data-test-header-title] svg')
-      .hasClass('flight-icon-folder-users', 'Correct icon renders in title');
+      .hasClass('hds-icon-folder-users', 'Correct icon renders in title');
     assert.dom('[data-test-header-title]').hasText(this.mount, 'Mount path renders in title');
   });
 
diff --git a/ui/tests/integration/components/license-banners-test.js b/ui/tests/integration/components/license-banners-test.js
index 2df72bebf68..d574240425c 100644
--- a/ui/tests/integration/components/license-banners-test.js
+++ b/ui/tests/integration/components/license-banners-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,12 +16,9 @@ import timestamp from 'core/utils/timestamp';
 module('Integration | Component | license-banners', function (hooks) {
   setupRenderingTest(hooks);
 
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => new Date('2018-04-03T14:15:30'));
-  });
   hooks.beforeEach(function () {
+    sinon.replace(timestamp, 'now', sinon.fake.returns(new Date('2018-04-03T14:15:30')));
     const mockNow = timestamp.now();
-    this.now = mockNow;
     this.yesterday = subDays(mockNow, 1);
     this.nextMonth = addDays(mockNow, 30);
     this.outside30 = addDays(mockNow, 32);
@@ -30,9 +27,6 @@ module('Integration | Component | license-banners', function (hooks) {
     this.version.version = '1.13.1+ent';
     this.version.type = 'enterprise';
   });
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
 
   test('it does not render if no expiry', async function (assert) {
     assert.expect(2);
diff --git a/ui/tests/integration/components/license-info-test.js b/ui/tests/integration/components/license-info-test.js
index 9a24cb62bd7..87785cc9815 100644
--- a/ui/tests/integration/components/license-info-test.js
+++ b/ui/tests/integration/components/license-info-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/link-status-test.js b/ui/tests/integration/components/link-status-test.js
index 815384a2072..7c872dd43df 100644
--- a/ui/tests/integration/components/link-status-test.js
+++ b/ui/tests/integration/components/link-status-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/list-table-test.js b/ui/tests/integration/components/list-table-test.js
new file mode 100644
index 00000000000..ce1685ad169
--- /dev/null
+++ b/ui/tests/integration/components/list-table-test.js
@@ -0,0 +1,139 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { click, fillIn, render, waitFor, find } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+const MOCK_DATA = [
+  { island: 'Maldives', visit_length: 5, trip_date: '2025-06-22T00:00:00.000Z' },
+  { island: 'Bora Bora', visit_length: 7, trip_date: '2025-03-15T00:00:00.000Z' },
+  { island: 'Fiji', visit_length: 10, trip_date: '2025-09-08T00:00:00.000Z' },
+  { island: 'Santorini', visit_length: 4, trip_date: '2026-04-10T00:00:00.000Z' },
+  { island: 'Maui', visit_length: 8, trip_date: '2026-01-18T00:00:00.000Z' },
+  { island: 'Seychelles', visit_length: 6, trip_date: '2025-12-03T00:00:00.000Z' },
+];
+module('Integration | Component | list-table', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(async function () {
+    this.data = undefined;
+    this.columns = [
+      { key: 'island', label: 'Islands', isSortable: true },
+      { key: 'visit_length', label: 'Visit length', customTableItem: true },
+      { key: 'trip_date', label: 'Date trip starts' },
+      { key: 'popupMenu', label: 'Action' },
+    ];
+    this;
+
+    this.renderComponent = async () => {
+      return render(hbs`
+          <ListTable
+            @columns={{this.columns}}
+            @data={{this.data}}
+            @selectionKey="island"
+          >
+            <:customTableItem as |itemData|>
+            Custom Table Item rendered!
+            </:customTableItem>
+
+            <:popupMenu as |rowData|>
+            <Hds::Dropdown as |D|>
+            <D.ToggleButton @text="Menu" data-test-popup-menu-trigger />
+            <D.Title @text="Title Text" />
+            <D.Description @text="Sample text" />
+            <D.Interactive @route="components" @icon="trash" @color="critical">Delete</D.Interactive>
+            </Hds::Dropdown>
+            </:popupMenu>
+
+          </ListTable>`);
+    };
+  });
+
+  test('it renders and paginates data', async function (assert) {
+    this.data = MOCK_DATA;
+    await this.renderComponent();
+    assert.dom(GENERAL.paginationInfo).hasText(`1–6 of ${this.data.length}`);
+
+    await fillIn(GENERAL.paginationSizeSelector, '5'); // Default is 10, so change to something else
+    await click(GENERAL.nextPage);
+    assert.dom(GENERAL.tableRow('Seychelles', 'island')).exists('it paginates the data');
+  });
+
+  test('it sorts table data by a sortable column', async function (assert) {
+    this.data = MOCK_DATA;
+    const assertSortOrder = (expectedValues, { column, page }) => {
+      expectedValues.forEach((value, idx) => {
+        assert
+          .dom(GENERAL.tableData(value, column))
+          .hasText(value, `page ${page}, row ${idx} has ${column}: ${value}`);
+      });
+    };
+
+    await this.renderComponent();
+    const column = find(GENERAL.icon('swap-vertical'));
+    await click(column);
+    assertSortOrder(['Bora Bora', 'Fiji', 'Maldives', 'Maui', 'Santorini', 'Seychelles'], {
+      column: 'island',
+      page: 1,
+    });
+  });
+
+  test('action column renders provided yield block with popup menu', async function (assert) {
+    this.data = MOCK_DATA;
+    await this.renderComponent();
+
+    assert.dom(GENERAL.tableData('Maldives', 'popupMenu')).exists('action column renders');
+    assert.dom(GENERAL.menuTrigger).exists('button trigger exists for popup menu');
+  });
+
+  test('selectable column renders when isSelectable is true', async function (assert) {
+    this.data = MOCK_DATA;
+    await this.renderComponent();
+
+    assert
+      .dom(`${GENERAL.tableRow('Maldives')} > th`)
+      .hasClass('hds-table__th--is-selectable', 'selectable column renders for row');
+  });
+
+  // check that a custom item block will render
+  test('custom item renders provided yield block with customTableItem for a column has customTableItem set to true', async function (assert) {
+    this.data = MOCK_DATA;
+    await this.renderComponent();
+
+    assert
+      .dom(GENERAL.tableData('Maldives', 'visit_length'))
+      .hasText('Custom Table Item rendered!', 'custom item renders');
+  });
+
+  test('it resets pagination when data changes', async function (assert) {
+    const moreData = [
+      { island: 'Tahiti', visit_length: 12, trip_date: '2025-05-10T00:00:00.000Z' },
+      { island: 'Barbados', visit_length: 6, trip_date: '2025-08-25T00:00:00.000Z' },
+      { island: 'Cyprus', visit_length: 9, trip_date: '2026-03-12T00:00:00.000Z' },
+      { island: 'Jamaica', visit_length: 7, trip_date: '2025-11-05T00:00:00.000Z' },
+      { island: 'Crete', visit_length: 11, trip_date: '2026-06-18T00:00:00.000Z' },
+      { island: 'Aruba', visit_length: 5, trip_date: '2025-10-14T00:00:00.000Z' },
+    ];
+    this.data = [...MOCK_DATA, ...moreData];
+    await this.renderComponent();
+    await click(GENERAL.nextPage);
+    ``;
+    assert.dom(GENERAL.paginationInfo).hasText(`11–12 of ${this.data.length}`, 'it navigates to next page');
+    // Changing the @data arg should trigger an update and reset pagination
+    this.set('data', [
+      { island: 'Palawan', visit_length: 9, trip_date: '2025-11-14T00:00:00.000Z' },
+      { island: 'Mykonos', visit_length: 3, trip_date: '2026-02-28T00:00:00.000Z' },
+    ]);
+
+    // There's a workaround using next() from @ember/runloop because the Hds::Pagination::Numbered component
+    // doesn't re-render when @currentPage updates. When that's fixed at the source we should be able to remove waitFor
+    await waitFor(GENERAL.paginationInfo);
+    assert.dom(GENERAL.paginationInfo).hasText(`1–2 of ${this.data.length}`);
+    assert.dom(GENERAL.paginationSizeSelector).hasValue('10', 'page selector is unchanged when data updates');
+  });
+});
diff --git a/ui/tests/integration/components/list-test.js b/ui/tests/integration/components/list-test.js
new file mode 100644
index 00000000000..ad43638b75d
--- /dev/null
+++ b/ui/tests/integration/components/list-test.js
@@ -0,0 +1,175 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render, click, findAll, triggerEvent, fillIn, find } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { v4 as uuidv4 } from 'uuid';
+import sinon from 'sinon';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { createSecretsEngine } from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | secret-engine/list', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.server.post('/sys/capabilities-self', () => ({
+      data: {
+        capabilities: ['root'],
+      },
+    }));
+    this.version = this.owner.lookup('service:version');
+    this.router = this.owner.lookup('service:router');
+    this.router.transitionTo = sinon.stub();
+    this.flashMessages = this.owner.lookup('service:flash-messages');
+    this.flashMessages.registerTypes(['success', 'danger']);
+    this.flashSuccessSpy = sinon.spy(this.flashMessages, 'success');
+    this.flashDangerSpy = sinon.spy(this.flashMessages, 'danger');
+    this.uid = uuidv4();
+    // generate a model of cubbyhole, kv, and nomad
+    this.secretEngineModels = [
+      createSecretsEngine(undefined, 'cubbyhole', 'cubbyhole-test'),
+      createSecretsEngine(undefined, 'kv', 'kv-test'),
+      createSecretsEngine(undefined, 'aws', 'aws-1', 'v1.0.0'),
+      createSecretsEngine(undefined, 'aws', 'aws-2', 'v2.0.0'),
+      createSecretsEngine(undefined, 'nomad', 'nomad-test'),
+      createSecretsEngine(undefined, 'badType', 'external-test'),
+    ];
+  });
+
+  test('it allows you to disable an engine', async function (assert) {
+    const enginePath = 'kv-test';
+    this.server.delete(`sys/mounts/${enginePath}`, () => {
+      assert.true(true, 'Request is made to delete engine');
+      return overrideResponse(204);
+    });
+    await render(hbs`<SecretEngine::List @secretEngines={{this.secretEngineModels}} />`);
+
+    assert
+      .dom(GENERAL.tableData(`${enginePath}/`, 'path'))
+      .exists('shows the link for the kvv2 secrets engine');
+    const row = GENERAL.tableRow(`${enginePath}/`);
+    await click(`${row} ${GENERAL.menuTrigger}`);
+    await click(GENERAL.menuItem('disable-engine'));
+    await click(GENERAL.confirmButton);
+
+    assert.true(
+      this.flashSuccessSpy.calledWith(`The kv Secrets Engine at ${enginePath}/ has been disabled.`),
+      'Flash message shows that engine was disabled.'
+    );
+  });
+
+  test('hovering over the icon of an external unrecognized engine type sets unrecognized tooltip text', async function (assert) {
+    await render(hbs`<SecretEngine::List @secretEngines={{this.secretEngineModels}} />`);
+    await fillIn(GENERAL.inputSearch('secret-engine-path'), 'external-test');
+
+    const engineTooltip = document.querySelector(GENERAL.tooltip('Backend type'));
+    await triggerEvent(engineTooltip, 'mouseenter');
+
+    assert
+      .dom(engineTooltip.nextSibling)
+      .hasText(
+        `This engine's type is not recognized by the UI. Please use the CLI to manage this engine.`,
+        'shows tooltip text for unknown engine'
+      );
+  });
+
+  test('hovering over the icon of an unsupported engine sets unsupported tooltip text', async function (assert) {
+    await render(hbs`<SecretEngine::List @secretEngines={{this.secretEngineModels}} />`);
+    await fillIn(GENERAL.inputSearch('secret-engine-path'), 'nomad');
+
+    const engineTooltip = document.querySelector(GENERAL.tooltip('Backend type'));
+    await triggerEvent(engineTooltip, 'mouseenter');
+
+    assert
+      .dom(engineTooltip.nextSibling)
+      .hasText(
+        'The UI only supports configuration views for these secret engines. The CLI must be used to manage other engine resources.',
+        'shows tooltip text for unsupported engine'
+      );
+  });
+
+  test('hovering over the icon of a supported engine sets engine name as tooltip', async function (assert) {
+    await render(hbs`<SecretEngine::List @secretEngines={{this.secretEngineModels}} />`);
+    await fillIn(GENERAL.inputSearch('secret-engine-path'), 'aws-1');
+
+    const engineTooltip = document.querySelector(GENERAL.tooltip('Backend type'));
+    await triggerEvent(engineTooltip, 'mouseenter');
+
+    assert.dom(engineTooltip.nextSibling).hasText('AWS', 'shows tooltip text for supported engine with name');
+  });
+
+  test('hovering over the icon of a kv engine shows engine name and version', async function (assert) {
+    await render(hbs`<SecretEngine::List @secretEngines={{this.secretEngineModels}}/>`);
+    await fillIn(GENERAL.inputSearch('secret-engine-path'), `kv-test`);
+
+    const engineTooltip = document.querySelector(GENERAL.tooltip('Backend type'));
+    await triggerEvent(engineTooltip, 'mouseenter');
+    assert
+      .dom(engineTooltip.nextSibling)
+      .hasText('KV version 1', 'shows tooltip text for kv engine with version');
+  });
+
+  test('path name does not render as link for unsupported secret engines', async function (assert) {
+    await render(hbs`<SecretEngine::List @secretEngines={{this.secretEngineModels}} />`);
+    const unsupportedPath = find(`${GENERAL.tableData('nomad-test/', 'path')} a`);
+    assert
+      .dom(unsupportedPath)
+      .doesNotExist(`path text doesn't render as a link for unsupported nomad engine.`);
+
+    const supportedPath = find(`${GENERAL.tableData('aws-1/', 'path')} a`);
+    assert.dom(supportedPath).exists(`path text renders as a link for supported aws engines.`);
+  });
+
+  test('it filters by engine path and engine type', async function (assert) {
+    await render(hbs`<SecretEngine::List @secretEngines={{this.secretEngineModels}} />`);
+    // filter by type
+    await click(GENERAL.toggleInput('filter-by-engine-type'));
+    await click(GENERAL.checkboxByAttr('aws'));
+
+    const rows = findAll(SES.secretPath());
+    const rowsAws = Array.from(rows).filter((row) => row.innerText.includes('aws'));
+    assert.strictEqual(rows.length, rowsAws.length, 'all rows returned are aws');
+
+    // clear filter by type
+    await click(GENERAL.button('Clear all'));
+    assert.true(document.querySelectorAll(GENERAL.tableRow()).length > 1, 'filter has been removed');
+
+    // filter by path
+    await fillIn(GENERAL.inputSearch('secret-engine-path'), 'kv');
+    const singleRow = document.querySelectorAll(SES.secretPath());
+    assert.dom(singleRow[0]).includesText('kv', 'shows the filtered by path engine');
+
+    // clear filter by engine path
+    await fillIn(GENERAL.inputSearch('secret-engine-path'), '');
+    const rowsAgain = document.querySelectorAll(GENERAL.tableRow());
+    assert.true(rowsAgain.length > 1, 'search filter text has been removed');
+  });
+
+  test('it filters by engine version', async function (assert) {
+    await render(hbs`<SecretEngine::List @secretEngines={{this.secretEngineModels}} />`);
+    // select engine type
+    await click(GENERAL.toggleInput('filter-by-engine-type'));
+    await click(GENERAL.checkboxByAttr('aws'));
+
+    // filter by version
+    await click(GENERAL.toggleInput('filter-by-engine-version'));
+    await click(GENERAL.checkboxByAttr('v2.0.0'));
+    const singleRow = document.querySelectorAll(SES.secretPath());
+    assert.dom(singleRow[0]).includesText('aws-2', 'shows the single engine filtered by version');
+  });
+
+  test('it applies overflow styling', async function (assert) {
+    await render(hbs`<SecretEngine::List @secretEngines={{this.secretEngineModels}} />`);
+    assert
+      .dom(GENERAL.tableData('aws-1/', 'path'))
+      .hasClass('text-overflow-ellipsis', 'secret engine name has text overflow class ');
+  });
+});
diff --git a/ui/tests/integration/components/masked-input-test.js b/ui/tests/integration/components/masked-input-test.js
index ce56f3f6586..3f906e67270 100644
--- a/ui/tests/integration/components/masked-input-test.js
+++ b/ui/tests/integration/components/masked-input-test.js
@@ -1,18 +1,18 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render, focus, triggerKeyEvent, typeIn, fillIn, click } from '@ember/test-helpers';
-import { create } from 'ember-cli-page-object';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
-import maskedInput from 'vault/tests/pages/components/masked-input';
-
-const component = create(maskedInput);
 
+const SELECTORS = {
+  stringify: '[data-test-stringify-toggle]',
+};
 module('Integration | Component | masked input', function (hooks) {
   setupRenderingTest(hooks);
 
@@ -26,14 +26,14 @@ module('Integration | Component | masked input', function (hooks) {
   test('it renders', async function (assert) {
     await render(hbs`<MaskedInput />`);
     assert.dom('[data-test-masked-input]').exists('shows masked input');
-    assert.ok(component.textareaIsPresent);
-    assert.dom('[data-test-textarea]').hasClass('masked-font', 'it renders an input with obscure font');
-    assert.notOk(component.copyButtonIsPresent, 'does not render copy button by default');
-    assert.notOk(component.downloadButtonIsPresent, 'does not render download button by default');
+    assert.dom('textarea').exists();
+    assert.dom('textarea').hasClass('masked-font', 'it renders an input with obscure font');
+    assert.dom(GENERAL.copyButton).doesNotExist('does not render copy button by default');
+    assert.dom(GENERAL.button('Download')).doesNotExist('does not render download button by default');
 
-    await component.toggleMasked();
+    await click(GENERAL.button('toggle-masked'));
     assert.dom('.masked-value').doesNotHaveClass('masked-font', 'it unmasks when show button is clicked');
-    await component.toggleMasked();
+    await click(GENERAL.button('toggle-masked'));
     assert.dom('.masked-value').hasClass('masked-font', 'it remasks text when button is clicked');
   });
 
@@ -42,21 +42,21 @@ module('Integration | Component | masked input', function (hooks) {
     await render(hbs`<MaskedInput @displayOnly={{true}} @value={{this.value}} />`);
 
     assert.dom('.masked-value').hasClass('masked-font', 'value has obscured font');
-    assert.notOk(component.textareaIsPresent, 'it does not render a textarea when displayOnly is true');
+    assert.dom('textarea').doesNotExist('it does not render a textarea when displayOnly is true');
   });
 
   test('it renders a copy button when allowCopy is true', async function (assert) {
     this.set('value', { some: 'object' });
     await render(hbs`<MaskedInput @allowCopy={{true}} @value={{this.value}} />`);
-    assert.ok(component.copyButtonIsPresent);
+    assert.dom(GENERAL.copyButton).exists();
   });
 
   test('it renders a download button when allowDownload is true', async function (assert) {
     await render(hbs`<MaskedInput @allowDownload={{true}} /> `);
-    assert.ok(component.downloadIconIsPresent);
+    assert.dom(GENERAL.button('Download secret value')).exists();
 
-    await click('[data-test-download-icon]');
-    assert.ok(component.downloadButtonIsPresent, 'clicking download icon opens modal with download button');
+    await click(GENERAL.button('Download secret value'));
+    assert.dom(GENERAL.button('Download')).exists('clicking download icon opens modal with download button');
   });
 
   test('it shortens all outputs when displayOnly and masked', async function (assert) {
@@ -65,7 +65,7 @@ module('Integration | Component | masked input', function (hooks) {
     const maskedValue = document.querySelector('.masked-value').innerText;
     assert.strictEqual(maskedValue.length, 11);
 
-    await component.toggleMasked();
+    await click(GENERAL.button('toggle-masked'));
     const unMaskedValue = document.querySelector('.masked-value').innerText;
     assert.strictEqual(unMaskedValue.length, this.value.length);
   });
@@ -83,7 +83,7 @@ module('Integration | Component | masked input', function (hooks) {
     this.set('value', 'before');
     this.set('onChange', changeSpy);
     await render(hbs`<MaskedInput @value={{this.value}} @onChange={{this.onChange}} />`);
-    await fillIn('[data-test-textarea]', 'after');
+    await fillIn('textarea', 'after');
     assert.true(changeSpy.calledWith('after'));
   });
 
@@ -92,7 +92,7 @@ module('Integration | Component | masked input', function (hooks) {
     this.set('value', '');
     this.set('onKeyUp', keyupSpy);
     await render(hbs`<MaskedInput @name="foo" @value={{this.value}} @onKeyUp={{this.onKeyUp}} />`);
-    await typeIn('[data-test-textarea]', 'baz');
+    await typeIn('textarea', 'baz');
     assert.true(keyupSpy.calledThrice, 'calls for each letter of typing');
     assert.true(keyupSpy.firstCall.calledWithExactly('foo', 'b'));
     assert.true(keyupSpy.secondCall.calledWithExactly('foo', 'ba'));
@@ -102,8 +102,8 @@ module('Integration | Component | masked input', function (hooks) {
   test('it does not remove value on tab', async function (assert) {
     this.set('value', 'hello');
     await render(hbs`<MaskedInput @value={{this.value}} />`);
-    await triggerKeyEvent('[data-test-textarea]', 'keydown', 9);
-    await component.toggleMasked();
+    await triggerKeyEvent('textarea', 'keydown', 9);
+    await click(GENERAL.button('toggle-masked'));
     const unMaskedValue = document.querySelector('.masked-value').value;
     assert.strictEqual(unMaskedValue, this.value);
   });
@@ -119,11 +119,11 @@ module('Integration | Component | masked input', function (hooks) {
       />
     `);
     assert.dom('[data-test-masked-input]').exists('shows masked input');
-    assert.ok(component.copyButtonIsPresent);
-    assert.ok(component.downloadIconIsPresent);
-    assert.dom('[data-test-button="toggle-masked"]').exists('shows toggle mask button');
+    assert.dom(GENERAL.copyButton).exists();
+    assert.dom(GENERAL.button('Download secret value')).exists();
+    assert.dom(GENERAL.button('toggle-masked')).exists('shows toggle mask button');
 
-    await component.toggleMasked();
+    await click(GENERAL.button('toggle-masked'));
     assert.dom('.masked-value').doesNotHaveClass('masked-font', 'it unmasks when show button is clicked');
     assert
       .dom('[data-test-icon="minus"]')
@@ -154,12 +154,12 @@ module('Integration | Component | masked input', function (hooks) {
       />
     `);
 
-    await click('[data-test-download-icon]');
-    assert.dom('[data-test-stringify-toggle]').isNotChecked('Stringify toggle off as default');
-    await click('[data-test-download-button]');
+    await click(GENERAL.button('Download secret value'));
+    assert.dom(SELECTORS.stringify).isNotChecked('Stringify toggle off as default');
+    await click(GENERAL.button('Download'));
 
-    await click('[data-test-download-icon]');
-    await click('[data-test-stringify-toggle]');
-    await click('[data-test-download-button]');
+    await click(GENERAL.button('Download secret value'));
+    await click(SELECTORS.stringify);
+    await click(GENERAL.button('Download'));
   });
 });
diff --git a/ui/tests/integration/components/message-error-test.js b/ui/tests/integration/components/message-error-test.js
new file mode 100644
index 00000000000..a4063a62c54
--- /dev/null
+++ b/ui/tests/integration/components/message-error-test.js
@@ -0,0 +1,113 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { click, findAll, render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+
+module('Integration | Component | message-error', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.errorMessage = undefined;
+    this.errors = undefined;
+    this.model = undefined;
+    this.onDismiss = sinon.spy();
+
+    this.renderComponent = () => {
+      return render(hbs`
+        <MessageError 
+        @errorMessage={{this.errorMessage}} 
+        @errors={{this.errors}} 
+        @model={{this.model}} 
+        @onDismiss={{this.onDismiss}} 
+        />`);
+    };
+  });
+
+  test('it does not render if args have no value', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(GENERAL.messageError).doesNotExist();
+  });
+
+  test('it renders a single error message', async function (assert) {
+    this.errorMessage = 'Something went wrong';
+    await this.renderComponent();
+
+    assert.dom(GENERAL.messageError).exists({ count: 1 });
+    assert.dom(GENERAL.messageDescription).hasText('Something went wrong');
+  });
+
+  test('it renders an array of error objects', async function (assert) {
+    this.errors = [new Error('oh dear'), new Error('uh oh')];
+    await render(hbs`<MessageError @errors={{this.errors}} />`);
+
+    assert.dom(GENERAL.messageError).exists({ count: 2 });
+    findAll(GENERAL.messageDescription).forEach((e, idx) => {
+      assert.dom(e).hasText(`Error: ${this.errors[idx].message}`);
+    });
+  });
+
+  test('it renders an array of error strings', async function (assert) {
+    this.errors = ['problem 1', 'problem 2'];
+    await render(hbs`<MessageError @errors={{this.errors}} />`);
+
+    assert.dom(GENERAL.messageError).exists({ count: 2 });
+    findAll(GENERAL.messageDescription).forEach((e, idx) => {
+      assert.dom(e).hasText(this.errors[idx]);
+    });
+  });
+
+  test('it handles model errors', async function (assert) {
+    this.model = {
+      isError: true,
+      adapterError: {
+        errors: [new Error('there was a problem')],
+      },
+    };
+    await this.renderComponent();
+
+    assert.dom(GENERAL.messageError).exists({ count: 1 });
+    assert.dom(GENERAL.messageDescription).hasText('there was a problem');
+  });
+
+  test('it formats CLI-style errors', async function (assert) {
+    const apiError =
+      'failed to satisfy enforcement just-duo. error: 2 errors occurred:\n\t* duo authentication failed: "Login request denied."\n\t* login MFA validation failed';
+    const expectedDescriptions = [
+      'duo authentication failed: "Login request denied."',
+      'login MFA validation failed',
+    ];
+    this.errorMessage = apiError;
+    await this.renderComponent();
+
+    assert.dom(GENERAL.messageError).exists({ count: 1 });
+    assert.dom(GENERAL.messageDescription).hasTextContaining('failed to satisfy enforcement just-duo');
+    assert.dom(`${GENERAL.messageDescription} li`).exists({ count: 2 });
+    findAll(`${GENERAL.messageDescription} li`).forEach((e, idx) => {
+      assert.dom(e).hasText(expectedDescriptions[idx]);
+    });
+  });
+
+  test('it returns null for invalid formatted errors', async function (assert) {
+    const invalidFormat = '* some error without proper format';
+    this.errorMessage = invalidFormat;
+    await this.renderComponent();
+
+    assert.dom(GENERAL.messageError).exists({ count: 1 });
+    assert.dom(GENERAL.messageDescription).hasText(invalidFormat);
+  });
+
+  test('it fires on dismiss callback', async function (assert) {
+    this.errorMessage = 'Some issue occurred';
+    await this.renderComponent();
+    await click(GENERAL.icon('x'));
+    assert.true(this.onDismiss.calledOnce, '@onDismiss is called once');
+  });
+});
diff --git a/ui/tests/integration/components/mfa-form-test.js b/ui/tests/integration/components/mfa-form-test.js
deleted file mode 100644
index c5c65ed6960..00000000000
--- a/ui/tests/integration/components/mfa-form-test.js
+++ /dev/null
@@ -1,217 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { render } from '@ember/test-helpers';
-import { hbs } from 'ember-cli-htmlbars';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { fillIn, click, waitUntil } from '@ember/test-helpers';
-import { _cancelTimers as cancelTimers, later } from '@ember/runloop';
-import { TOTP_VALIDATION_ERROR } from 'vault/components/mfa/mfa-form';
-
-module('Integration | Component | mfa-form', function (hooks) {
-  setupRenderingTest(hooks);
-  setupMirage(hooks);
-
-  hooks.beforeEach(function () {
-    this.clusterId = '123456';
-    this.mfaAuthData = {
-      backend: 'userpass',
-      data: { username: 'foo', password: 'bar' },
-    };
-    this.authService = this.owner.lookup('service:auth');
-    // setup basic totp mfa_requirement
-    // override in tests that require different scenarios
-    this.totpConstraint = this.server.create('mfa-method', { type: 'totp' });
-    const { mfa_requirement } = this.authService._parseMfaResponse({
-      mfa_request_id: 'test-mfa-id',
-      mfa_constraints: { test_mfa: { any: [this.totpConstraint] } },
-    });
-    this.mfaAuthData.mfa_requirement = mfa_requirement;
-  });
-
-  test('it should render correct descriptions', async function (assert) {
-    const totpConstraint = this.server.create('mfa-method', { type: 'totp' });
-    const oktaConstraint = this.server.create('mfa-method', { type: 'okta' });
-    const duoConstraint = this.server.create('mfa-method', { type: 'duo' });
-
-    this.mfaAuthData.mfa_requirement = this.authService._parseMfaResponse({
-      mfa_request_id: 'test-mfa-id',
-      mfa_constraints: { test_mfa_1: { any: [totpConstraint] } },
-    }).mfa_requirement;
-
-    await render(
-      hbs`<Mfa::MfaForm @clusterId={{this.clusterId}} @authData={{this.mfaAuthData}} @onError={{fn (mut this.error)}} />`
-    );
-    assert
-      .dom('[data-test-mfa-description]')
-      .includesText(
-        'Enter your authentication code to log in.',
-        'Correct description renders for single passcode'
-      );
-
-    this.mfaAuthData.mfa_requirement = this.authService._parseMfaResponse({
-      mfa_request_id: 'test-mfa-id',
-      mfa_constraints: { test_mfa_1: { any: [duoConstraint, oktaConstraint] } },
-    }).mfa_requirement;
-
-    await render(
-      hbs`<Mfa::MfaForm @clusterId={{this.clusterId}} @authData={{this.mfaAuthData}} @onError={{fn (mut this.error)}} />`
-    );
-    assert
-      .dom('[data-test-mfa-description]')
-      .includesText(
-        'Select the MFA method you wish to use.',
-        'Correct description renders for multiple methods'
-      );
-
-    this.mfaAuthData.mfa_requirement = this.authService._parseMfaResponse({
-      mfa_request_id: 'test-mfa-id',
-      mfa_constraints: { test_mfa_1: { any: [oktaConstraint] }, test_mfa_2: { any: [duoConstraint] } },
-    }).mfa_requirement;
-
-    await render(
-      hbs`<Mfa::MfaForm @clusterId={{this.clusterId}} @authData={{this.mfaAuthData}} @onError={{fn (mut this.error)}} />`
-    );
-    assert
-      .dom('[data-test-mfa-description]')
-      .includesText(
-        'Two methods are required for successful authentication.',
-        'Correct description renders for multiple constraints'
-      );
-  });
-
-  test('it should render method selects and passcode inputs', async function (assert) {
-    assert.expect(2);
-    const duoConstraint = this.server.create('mfa-method', { type: 'duo', uses_passcode: true });
-    const oktaConstraint = this.server.create('mfa-method', { type: 'okta' });
-    const pingidConstraint = this.server.create('mfa-method', { type: 'pingid' });
-    const { mfa_requirement } = this.authService._parseMfaResponse({
-      mfa_request_id: 'test-mfa-id',
-      mfa_constraints: {
-        test_mfa_1: {
-          any: [pingidConstraint, oktaConstraint],
-        },
-        test_mfa_2: {
-          any: [duoConstraint],
-        },
-      },
-    });
-    this.mfaAuthData.mfa_requirement = mfa_requirement;
-
-    this.server.post('/sys/mfa/validate', (schema, req) => {
-      const json = JSON.parse(req.requestBody);
-      const payload = {
-        mfa_request_id: 'test-mfa-id',
-        mfa_payload: { [oktaConstraint.id]: [], [duoConstraint.id]: ['passcode=test-code'] },
-      };
-      assert.deepEqual(json, payload, 'Correct mfa payload passed to validate endpoint');
-      return {};
-    });
-
-    this.owner.lookup('service:auth').reopen({
-      // override to avoid authSuccess method since it expects an auth payload
-      async totpValidate({ mfa_requirement }) {
-        await this.clusterAdapter().mfaValidate(mfa_requirement);
-        return 'test response';
-      },
-    });
-
-    this.onSuccess = (resp) =>
-      assert.strictEqual(resp, 'test response', 'Response is returned in onSuccess callback');
-
-    await render(
-      hbs`<Mfa::MfaForm @clusterId={{this.clusterId}} @authData={{this.mfaAuthData}} @onSuccess={{this.onSuccess}} />`
-    );
-    await fillIn('[data-test-mfa-select="0"] select', oktaConstraint.id);
-    await fillIn('[data-test-mfa-passcode="1"]', 'test-code');
-    await click('[data-test-mfa-validate]');
-  });
-
-  test('it should validate mfa requirement', async function (assert) {
-    assert.expect(5);
-    this.server.post('/sys/mfa/validate', (schema, req) => {
-      const json = JSON.parse(req.requestBody);
-      const payload = {
-        mfa_request_id: 'test-mfa-id',
-        mfa_payload: { [this.totpConstraint.id]: ['test-code'] },
-      };
-      assert.deepEqual(json, payload, 'Correct mfa payload passed to validate endpoint');
-      return {};
-    });
-
-    const expectedAuthData = { clusterId: this.clusterId, ...this.mfaAuthData };
-    this.owner.lookup('service:auth').reopen({
-      // override to avoid authSuccess method since it expects an auth payload
-      async totpValidate(authData) {
-        await waitUntil(() =>
-          assert
-            .dom('[data-test-mfa-validate] [data-test-icon="loading"]')
-            .exists('Loading icon shows on button')
-        );
-        assert.dom('[data-test-mfa-validate]').isDisabled('Button is disabled while loading');
-        assert.deepEqual(authData, expectedAuthData, 'Mfa auth data passed to validate method');
-        await this.clusterAdapter().mfaValidate(authData.mfa_requirement);
-        return 'test response';
-      },
-    });
-
-    this.onSuccess = (resp) =>
-      assert.strictEqual(resp, 'test response', 'Response is returned in onSuccess callback');
-
-    await render(
-      hbs`<Mfa::MfaForm @clusterId={{this.clusterId}} @authData={{this.mfaAuthData}} @onSuccess={{this.onSuccess}} />`
-    );
-
-    await fillIn('[data-test-mfa-passcode]', 'test-code');
-    await click('[data-test-mfa-validate]');
-  });
-
-  // TODO JLR: It doesn't appear that cancelTimers is working and tests wait for the full countdown
-  test('it should show countdown on passcode already used and rate limit errors', async function (assert) {
-    const messages = {
-      used: 'code already used; new code is available in 45 seconds',
-      limit:
-        'maximum TOTP validation attempts 4 exceeded the allowed attempts 3. Please try again in 15 seconds',
-    };
-    const codes = ['used', 'limit'];
-    for (const code of codes) {
-      this.owner.lookup('service:auth').reopen({
-        totpValidate() {
-          throw { errors: [messages[code]] };
-        },
-      });
-      await render(hbs`<Mfa::MfaForm @clusterId={{this.clusterId}} @authData={{this.mfaAuthData}} />`);
-
-      await fillIn('[data-test-mfa-passcode]', code);
-      later(() => cancelTimers(), 50);
-      await click('[data-test-mfa-validate]');
-      const expectedTime = code === 'used' ? '45' : '15';
-      assert
-        .dom('[data-test-mfa-countdown]')
-        .includesText(expectedTime, 'countdown renders with correct initial value from error response');
-      assert.dom('[data-test-mfa-validate]').isDisabled('Button is disabled during countdown');
-      assert.dom('[data-test-mfa-passcode]').isDisabled('Input is disabled during countdown');
-      assert.dom('[data-test-inline-error-message]').exists('Alert message renders');
-    }
-  });
-
-  test('it should show error message for passcode invalid error', async function (assert) {
-    this.owner.lookup('service:auth').reopen({
-      totpValidate() {
-        throw { errors: ['failed to validate'] };
-      },
-    });
-    await render(hbs`<Mfa::MfaForm @clusterId={{this.clusterId}} @authData={{this.mfaAuthData}} />`);
-
-    await fillIn('[data-test-mfa-passcode]', 'test-code');
-    later(() => cancelTimers(), 50);
-    await click('[data-test-mfa-validate]');
-    assert
-      .dom('[data-test-message-error]')
-      .includesText(TOTP_VALIDATION_ERROR, 'Generic error message renders for passcode validation error');
-  });
-});
diff --git a/ui/tests/integration/components/mfa-login-enforcement-form-test.js b/ui/tests/integration/components/mfa-login-enforcement-form-test.js
index b605d6d523f..865022d18d9 100644
--- a/ui/tests/integration/components/mfa-login-enforcement-form-test.js
+++ b/ui/tests/integration/components/mfa-login-enforcement-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { render, click, fillIn } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | mfa-login-enforcement-form', function (hooks) {
   setupRenderingTest(hooks);
@@ -152,9 +153,9 @@ module('Integration | Component | mfa-login-enforcement-form', function (hooks)
 
   test('it should populate fields with model data', async function (assert) {
     this.model.name = 'foo';
-    const [method] = (await this.store.query('mfa-method', {})).toArray();
-    this.model.mfa_methods.addObject(method);
-    this.model.auth_method_accessors.addObject('auth_userpass_1234');
+    const [method] = await this.store.query('mfa-method', {});
+    this.model.mfa_methods = [method];
+    this.model.auth_method_accessors = ['auth_userpass_1234'];
 
     await render(hbs`
       <Mfa::MfaLoginEnforcementForm
@@ -170,10 +171,10 @@ module('Integration | Component | mfa-login-enforcement-form', function (hooks)
       .dom('.search-select-list-item small')
       .hasText('123456', 'MFA method id renders in selected option');
     assert
-      .dom('[data-test-row-label="Authentication mount"]')
+      .dom(GENERAL.infoRowLabel('Authentication mount'))
       .hasText('Authentication mount', 'Selected target type renders');
     assert
-      .dom('[data-test-value-div="Authentication mount"]')
+      .dom(GENERAL.infoRowValue('Authentication mount'))
       .hasText('auth_userpass_1234', 'Selected target value renders');
 
     await click('[data-test-mlef-remove-target]');
@@ -207,12 +208,12 @@ module('Integration | Component | mfa-login-enforcement-form', function (hooks)
         keys: ['1234'],
       },
     }));
-    this.model.auth_method_accessors.addObject('auth_userpass_1234');
-    this.model.auth_method_types.addObject('userpass');
-    const [entity] = (await this.store.query('identity/entity', {})).toArray();
-    this.model.identity_entities.addObject(entity);
-    const [group] = (await this.store.query('identity/group', {})).toArray();
-    this.model.identity_groups.addObject(group);
+    this.model.auth_method_accessors = ['auth_userpass_1234'];
+    this.model.auth_method_types = ['userpass'];
+    const [entity] = await this.store.query('identity/entity', {});
+    this.model.identity_entities = [entity];
+    const [group] = await this.store.query('identity/group', {});
+    this.model.identity_groups = [group];
 
     await render(hbs`
       <Mfa::MfaLoginEnforcementForm
@@ -237,10 +238,10 @@ module('Integration | Component | mfa-login-enforcement-form', function (hooks)
     for (const [index, target] of targets.entries()) {
       // target populated from model
       assert
-        .dom(`[data-test-row-label="${target.label}"]`)
+        .dom(GENERAL.infoRowLabel(target.label))
         .hasText(target.label, `${target.label} target populated with correct type label`);
       assert
-        .dom(`[data-test-value-div="${target.label}"]`)
+        .dom(GENERAL.infoRowValue(target.label))
         .hasText(target.value, `${target.label} target populated with correct value`);
       // remove target
       await click(`[data-test-mlef-remove-target="${target.label}"]`);
diff --git a/ui/tests/integration/components/mfa-login-enforcement-header-test.js b/ui/tests/integration/components/mfa-login-enforcement-header-test.js
index 5e3eb2ef81b..ffceab90ae4 100644
--- a/ui/tests/integration/components/mfa-login-enforcement-header-test.js
+++ b/ui/tests/integration/components/mfa-login-enforcement-header-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -32,7 +32,7 @@ module('Integration | Component | mfa-login-enforcement-header', function (hooks
     await render(hbs`<Mfa::MfaLoginEnforcementHeader @heading="New enforcement" />`);
 
     assert.dom('[data-test-mleh-title]').includesText('New enforcement');
-    assert.dom('[data-test-mleh-title] svg').hasClass('flight-icon-lock', 'Lock icon renders');
+    assert.dom('[data-test-mleh-title] svg').hasClass('hds-icon-lock', 'Lock icon renders');
     assert
       .dom('[data-test-mleh-description]')
       .includesText('An enforcement will define which auth types', 'Description renders');
diff --git a/ui/tests/integration/components/mfa-method-list-item-test.js b/ui/tests/integration/components/mfa-method-list-item-test.js
index cf8e8111eb0..2bba6e34767 100644
--- a/ui/tests/integration/components/mfa-method-list-item-test.js
+++ b/ui/tests/integration/components/mfa-method-list-item-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/mfa/method-form-test.js b/ui/tests/integration/components/mfa/method-form-test.js
index ef3f970a1c0..4f319cac890 100644
--- a/ui/tests/integration/components/mfa/method-form-test.js
+++ b/ui/tests/integration/components/mfa/method-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -33,7 +33,9 @@ module('Integration | Component | mfa-method-form', function (hooks) {
     assert.dom('[data-test-input="period"]').exists('Period field ttl renders');
     assert.dom('[data-test-input="key_size"]').exists('Key size field input renders');
     assert.dom('[data-test-input="qr_size"]').exists('QR size field input renders');
-    assert.dom('[data-test-input="algorithm"]').exists(`Algorithm field radio input renders`);
+    assert
+      .dom('[data-test-input-group="algorithm"]')
+      .hasText('Algorithm The hashing algorithm used to generate the TOTP code. SHA1 SHA256 SHA512');
     assert
       .dom('[data-test-input="max_validation_attempts"]')
       .exists(`Max validation attempts field input renders`);
diff --git a/ui/tests/integration/components/mfa/mfa-form-test.js b/ui/tests/integration/components/mfa/mfa-form-test.js
new file mode 100644
index 00000000000..301a2177707
--- /dev/null
+++ b/ui/tests/integration/components/mfa/mfa-form-test.js
@@ -0,0 +1,572 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render, settled, fillIn, click, waitUntil, waitFor } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { _cancelTimers as cancelTimers, later } from '@ember/runloop';
+import { TOTP_VALIDATION_ERROR } from 'vault/components/mfa/mfa-form';
+import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { MFA_SELECTORS } from 'vault/tests/helpers/mfa/mfa-selectors';
+import { QR_CODE_URL } from 'vault/mirage/handlers/mfa-login';
+
+module('Integration | Component | mfa-form', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.onCancel = sinon.spy();
+    // mocking as an object with the `perform()` method because loginAndTransition is a concurrency task
+    this.loginAndTransition = { perform: sinon.spy() };
+    this.onError = sinon.spy();
+    this.authService = this.owner.lookup('service:auth');
+    // setup basic totp mfaRequirement
+    // override in tests that require different scenarios
+    this.totpConstraint = this.server.create('mfa-method', { type: 'totp' });
+    const mfaRequirement = this.authService.parseMfaResponse({
+      mfa_request_id: 'test-mfa-id',
+      mfa_constraints: { test_mfa: { any: [this.totpConstraint] } },
+    });
+
+    this.renderComponent = () => {
+      return render(hbs`
+  <Mfa::MfaForm
+    @authData={{this.mfaAuthData}}
+    @clusterId="123456"
+    @onCancel={{this.onCancel}}
+    @onError={{this.onError}}
+    @loginAndTransition={{this.loginAndTransition}}
+  />`);
+    };
+    this.setMfaAuthData = (mfaRequirement) => {
+      this.mfaAuthData = {
+        mfaRequirement: mfaRequirement,
+        authMethodType: 'userpass',
+        authMountPath: 'userpass',
+      };
+    };
+    this.setMfaAuthData(mfaRequirement);
+  });
+
+  test('it renders correct text for single passcode', async function (assert) {
+    const totpConstraint = this.server.create('mfa-method', { type: 'totp' });
+    this.mfaAuthData.mfaRequirement = this.authService.parseMfaResponse({
+      mfa_request_id: 'test-mfa-id',
+      mfa_constraints: { test_mfa_1: { any: [totpConstraint] } },
+    });
+
+    await this.renderComponent();
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(MFA_SELECTORS.subheader).hasText('Multi-factor authentication is enabled for your account.');
+    assert.dom(MFA_SELECTORS.description).hasText('Enter your authentication code to log in.');
+  });
+
+  test('it renders correct text for single push notification', async function (assert) {
+    const oktaConstraint = this.server.create('mfa-method', { type: 'okta' });
+    this.mfaAuthData.mfaRequirement = this.authService.parseMfaResponse({
+      mfa_request_id: 'test-mfa-id',
+      mfa_constraints: { test_mfa_1: { any: [oktaConstraint] } },
+    });
+
+    await this.renderComponent();
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(MFA_SELECTORS.subheader).hasText('Multi-factor authentication is enabled for your account.');
+    assert.dom(MFA_SELECTORS.description).doesNotExist();
+  });
+
+  test('it renders correct text for a single constraint with multiple methods', async function (assert) {
+    const oktaConstraint = this.server.create('mfa-method', { type: 'okta' });
+    const duoConstraint = this.server.create('mfa-method', { type: 'duo' });
+    this.mfaAuthData.mfaRequirement = this.authService.parseMfaResponse({
+      mfa_request_id: 'test-mfa-id',
+      mfa_constraints: { test_mfa_1: { any: [duoConstraint, oktaConstraint] } },
+    });
+
+    await this.renderComponent();
+    assert.dom(GENERAL.title).hasText('Verify your identity');
+    assert.dom(MFA_SELECTORS.subheader).hasText('Multi-factor authentication is enabled for your account.');
+    assert.dom(MFA_SELECTORS.description).hasText('Choose one of the following methods to continue:');
+  });
+
+  test('it renders correct text for multiple constraints', async function (assert) {
+    const oktaConstraint = this.server.create('mfa-method', { type: 'okta' });
+    const duoConstraint = this.server.create('mfa-method', { type: 'duo' });
+    this.mfaAuthData.mfaRequirement = this.authService.parseMfaResponse({
+      mfa_request_id: 'test-mfa-id',
+      mfa_constraints: { test_mfa_1: { any: [oktaConstraint] }, test_mfa_2: { any: [duoConstraint] } },
+    });
+
+    await this.renderComponent();
+    assert.dom(MFA_SELECTORS.subheader).hasText('Multi-factor authentication is enabled for your account.');
+    assert.dom(MFA_SELECTORS.description).hasText('Two methods are required for successful authentication.');
+  });
+
+  test('it should render a submit button', async function (assert) {
+    await this.renderComponent();
+    assert.dom(GENERAL.button('Verify')).isNotDisabled('Button is not disabled by default');
+  });
+
+  test('it should render method selects and passcode inputs', async function (assert) {
+    assert.expect(2);
+    const duoConstraint = this.server.create('mfa-method', { type: 'duo', uses_passcode: true });
+    const oktaConstraint = this.server.create('mfa-method', { type: 'okta' });
+    const pingidConstraint = this.server.create('mfa-method', { type: 'pingid' });
+    const mfaRequirement = this.authService.parseMfaResponse({
+      mfa_request_id: 'test-mfa-id',
+      mfa_constraints: {
+        test_mfa_1: {
+          any: [pingidConstraint, oktaConstraint],
+        },
+        test_mfa_2: {
+          any: [duoConstraint],
+        },
+      },
+    });
+    this.mfaAuthData.mfaRequirement = mfaRequirement;
+
+    this.server.post('/sys/mfa/validate', (schema, req) => {
+      const json = JSON.parse(req.requestBody);
+      const payload = {
+        mfa_request_id: 'test-mfa-id',
+        mfa_payload: { [oktaConstraint.id]: [], [duoConstraint.id]: ['passcode=test-code'] },
+      };
+      assert.deepEqual(json, payload, 'Correct mfa payload passed to validate endpoint');
+      return {};
+    });
+
+    this.owner.lookup('service:auth').reopen({
+      // override to avoid authSuccess method since it expects an auth payload
+      async totpValidate({ mfaRequirement }) {
+        await this.clusterAdapter().mfaValidate(mfaRequirement);
+        return 'test response';
+      },
+    });
+
+    const callbackAssertion = (resp) =>
+      assert.strictEqual(resp, 'test response', 'Response is returned in loginAndTransition callback');
+
+    this.loginAndTransition = {
+      unlinked: () => ({ perform: callbackAssertion }),
+    };
+
+    await this.renderComponent();
+    await fillIn(MFA_SELECTORS.select(0), oktaConstraint.id);
+    await fillIn(MFA_SELECTORS.passcode(1), 'test-code');
+    await click(GENERAL.button('Verify'));
+  });
+
+  test('it should validate mfa requirement', async function (assert) {
+    assert.expect(5);
+    this.server.post('/sys/mfa/validate', (schema, req) => {
+      const json = JSON.parse(req.requestBody);
+      const payload = {
+        mfa_request_id: 'test-mfa-id',
+        mfa_payload: { [this.totpConstraint.id]: ['test-code'] },
+      };
+      assert.deepEqual(json, payload, 'Correct mfa payload passed to validate endpoint');
+      return {};
+    });
+    const expectedAuthData = {
+      clusterId: '123456',
+      authMethodType: 'userpass',
+      authMountPath: 'userpass',
+      mfaRequirement: {
+        mfa_constraints: [
+          {
+            methods: [this.totpConstraint],
+            passcode: 'test-code', // Added by the MfaForm
+            selectedMethod: this.totpConstraint,
+          },
+        ],
+        mfa_request_id: 'test-mfa-id',
+      },
+    };
+    this.owner.lookup('service:auth').reopen({
+      // override to avoid authSuccess method since it expects an auth payload
+      async totpValidate(authData) {
+        await waitUntil(() =>
+          assert
+            .dom(`${GENERAL.button('Verify')} ${GENERAL.icon('loading')}`)
+            .exists('Loading icon shows on button')
+        );
+        assert.dom(GENERAL.button('Verify')).isDisabled('Button is disabled while loading');
+        assert.deepEqual(authData, expectedAuthData, 'Mfa auth data passed to validate method');
+        await this.clusterAdapter().mfaValidate(authData.mfaRequirement);
+        return 'test response';
+      },
+    });
+
+    const callbackAssertion = (resp) =>
+      assert.strictEqual(resp, 'test response', 'Response is returned in loginAndTransition callback');
+
+    this.loginAndTransition = {
+      unlinked: () => ({ perform: callbackAssertion }),
+    };
+
+    await this.renderComponent();
+
+    await fillIn(MFA_SELECTORS.passcode(), 'test-code');
+    await click(GENERAL.button('Verify'));
+  });
+
+  test('it should show countdown on passcode already used and rate limit errors', async function (assert) {
+    const messages = {
+      used: 'code already used; new code is available in 30 seconds',
+      // note: the backend returns a duplicate "s" in "30s seconds" in the limit message below. we have intentionally left it as is to ensure our regex for parsing the delay time can handle it
+      limit:
+        'failed to satisfy enforcement userpass2-not-self-enroll. error: 2 errors occurred:\n\t* maximum TOTP validation attempts 2 exceeded the allowed attempts 1. Please try again in 30s seconds\n\t* login MFA validation failed for methodID: [1f260334-ee5f-6e47-8e86-57be05d457d2]\n\n',
+    };
+    const codes = ['used', 'limit'];
+    for (const code of codes) {
+      this.owner.lookup('service:auth').reopen({
+        totpValidate() {
+          throw new Error(messages[code]);
+        },
+      });
+
+      await this.renderComponent();
+      await fillIn(MFA_SELECTORS.passcode(), 'foo');
+      await click(GENERAL.button('Verify'));
+
+      await waitFor(MFA_SELECTORS.countdown);
+
+      assert
+        .dom(MFA_SELECTORS.countdown)
+        .includesText('30', 'countdown renders with correct initial value from error response');
+      assert.dom(GENERAL.button('Verify')).isDisabled();
+      assert.dom(GENERAL.cancelButton).isDisabled();
+      assert.dom(MFA_SELECTORS.passcode()).isDisabled('Input is disabled during countdown');
+      assert.dom(GENERAL.inlineError).exists('Alert message renders');
+    }
+  });
+
+  test('it defaults countdown to 30 seconds if error message does not indicate when user can try again ', async function (assert) {
+    const msg = 'maximum TOTP validation attempts 4 exceeded the allowed attempts 3. Beep-boop.';
+    this.owner.lookup('service:auth').reopen({
+      totpValidate() {
+        throw new Error(msg);
+      },
+    });
+    await this.renderComponent();
+
+    await fillIn(MFA_SELECTORS.passcode(), 'foo');
+    await click(GENERAL.button('Verify'));
+
+    await waitFor(MFA_SELECTORS.countdown);
+
+    assert
+      .dom(MFA_SELECTORS.countdown)
+      .includesText('30', 'countdown renders with correct initial value from error response');
+    assert.dom(GENERAL.button('Verify')).isDisabled('Button is disabled during countdown');
+    assert.dom(MFA_SELECTORS.passcode()).isDisabled('Input is disabled during countdown');
+    assert.dom(GENERAL.inlineError).exists('Alert message renders');
+  });
+
+  test('it should show error message for passcode invalid error', async function (assert) {
+    this.owner.lookup('service:auth').reopen({
+      totpValidate() {
+        throw { errors: ['failed to validate'] };
+      },
+    });
+    await this.renderComponent();
+    await fillIn(MFA_SELECTORS.passcode(), 'test-code');
+    later(() => cancelTimers(), 50);
+    await settled();
+
+    await click(GENERAL.button('Verify'));
+    assert
+      .dom(GENERAL.messageError)
+      .includesText(TOTP_VALIDATION_ERROR, 'Generic error message renders for passcode validation error');
+  });
+
+  test('it should call onCancel callback', async function (assert) {
+    await this.renderComponent();
+    await click(GENERAL.cancelButton);
+    assert.true(this.onCancel.calledOnce, 'it fires onCancel callback');
+  });
+
+  module('self-enrollment', function (hooks) {
+    hooks.beforeEach(function () {
+      // Self-enrollment is an enterprise only feature
+      this.version = this.owner.lookup('service:version');
+      this.version.type = 'enterprise';
+      this.server.post('/identity/mfa/method/totp/self-enroll', async () => {
+        return {
+          data: {
+            barcode:
+              'iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BAAAG50lEQVR4nOydwW4kNwxE42D//5c3h74oYFh4lDTZ6kG9k6FRS7ILJEiKPf71+/dfwYi///QBwr+JIGZEEDMiiBkRxIwIYkYEMSOCmBFBzIggZkQQMyKIGRHEjAhiRgQxI4KYEUHMiCBmRBAzftGJPz905npLvz71jD8j68/107pafarbpXuK/F5kze5ZDe9ciIWYEUHMwC7rgZu//rRzJtVpENfRfVpXm7rKehJ95gp3aw+xEDMiiBlDl/XAIxAdWXVOoDNzHrPp+KpzXN0unVvTZ97rCY2FmBFBzNhyWRyd0PE5df50dx1f6dhMz79LLMSMCGLGh13Wio5Vpolbjan0Ot1JSJrZxWOfIBZiRgQxY8tlTc22Rjt1vK5P6ktdzDYt1+s1CbdcWSzEjAhixtBlTYvJ0/qVvh8kz9Z9b63ZjU//JppYiBkRxIyfTyU6pFTe7U1K9+vKel/+qd79/yEWYkYEMWPYl0XuzmoCSNYkn3YxG9/lVvGf/x2mxELMiCBmXCq/77VZTtOx9SnSosDbHrp19F7ksmAap8VCzIggZhy4LG6eOo5a53ROYB3vqkkkuiMl/Tre7b7nljWxEDMiiBm4lrXXPLBXmp7Wu07G6xxykunMRFmvJYKYsXVjuFe45k6P7MgbPvm+pNKlz3BetI+FmBFBzDh+x5AkU9N+ct4IUdfRxXnex1VX7kbudnnFQsyIIGYMmxxISljH6wqkq5wkX9NyPT9nhbjW86aIWIgZEcSMA5fFYyTuQKaOSz+lHRSPrPTv20F6wCqxEDMiiBkHL+xwt1PH9X3cOn7e8MB7sUjjRHeSW8RCzIggZmxFWdP0aq9ds4O0TJBnp9GX3l2fIVHWa4kgZmy9sEMqSA8kydIzu6duxVfdLpq9ahghFmJGBDFj2JfVQRoyb/UyTcvyvKZEqnBkfsrvX0QEMeM4MSQ1H+J89m7ieNm8O78+5/TmUa9GiIWYEUHMOH4teh3fS6nqOGkc1T1gpG9Kn3B6iTBNUTtiIWZEEDOOmxy6cd4OUVfTa/LuLH3+lb1kcBrjEWIhZkQQM46bHLpxEml06/C4iF8EdCeszRXTfe+W4mMhZkQQMw5uDAkkCjppFtX7rjOnbq3OIfWrOjNR1suJIGZs1bIetGGu0YsugJ80i+pnu5pbfXbqXqYNHqllvZYIYsbBd793CR0pUJO+qYpOJEniuVenqs92+543PMRCzIggZmCXdXKtr28Ju8iNr8NjHs7JlUFqWV9EBDHj0hcpTys8dUQ3NnQ7kjI7Py13Nfr33bvNfIiFmBFBzLj6r1dJhWra5U5uJ+s4OSc5wzpHP7tXqK/EQsyIIGZcesfwpMOqztEz9XlI51i3y3TkE8RCzIggZmzdGPK+LJL0kb534i6m/WB6hHPrrvAhFmJGBDHj6j8FI2X26nxICjl1U2R37nJ1ilpPuJcSPsRCzIggZnyglvVAzLxzGp3r6GbqHbuYZy/ZrJ92v8sesRAzIogZH/g/huun+tn6VJd+kvYJ7eimJXGe5OoVpsRCzIggZlx6LbqbyYvtHXwXfdp1tWlJv1utrknOrImFmBFBzDj+p2ArPA4hc7pXfgidw+TJ47QZo1snfVkvJ4KYsdXk8B/LYBehi+080atzOk56rrrVyKnWdeKyXksEMePgHcO9iIL3ydef676ksWEvyup2nyabaXJ4ORHEjINvcujK5udF+G6ErEDu+HRZnkeJXSJ5QizEjAhixvC16AeS4umZ66d1F70+OaEe1z1XNcqaJncnpfhYiBkRxIyDKKvCC9TdOK9cTSO66flJL1b3W+jUVRMLMSOCmLFVy+J94OuIjpG4IyLrT1tMdQm9O+f070CIhZgRQczY+r6svUSJ1510fUmfcJ1fV9NxlHZie7tMiYWYEUHMOOjL4ndzZM2ui75zHXoOd4/dGchIPc95ET4WYkYEMeP4hR09Qp7tnA8p73dzeJTV1cempX5945la1muJIGYMy+8EfelP+pdO6kvdavXn+uz0plJHVqllfQURxIwPvLBTf+bVJBKZEFfWdUzxwv60K6zuu5cqxkLMiCBmbCWGPP7RSdzeLjx969oPuvXrXutMUmEjDaiaWIgZEcSMq9+X1UHaNevP9Vmymn62wuNGMp/P6YiFmBFBzPiwy9Il7nXOw60a1LStYprGTps0OLEQMyKIGVsua9q6MG1I4LvUvUgCOK1inTQwpJb1ciKIGQff5MBnknRvhRfeu6emt43rHJ5m6hgyN4ZfQQQx49L3ZYVbxELMiCBmRBAzIogZEcSMCGJGBDEjgpgRQcyIIGZEEDMiiBkRxIwIYkYEMSOCmBFBzIggZkQQMyKIGf8EAAD//zl1N+YGOSI8AAAAAElFTkSuQmCC',
+            url: QR_CODE_URL,
+          },
+        };
+      });
+    });
+
+    test('it should render qr code and copy button', async function (assert) {
+      const clipboardSpy = sinon.stub(navigator.clipboard, 'writeText').resolves();
+      const totpConstraint = this.server.create('mfa-method', {
+        type: 'totp',
+        self_enrollment_enabled: true,
+      });
+      const mfaRequirement = this.authService.parseMfaResponse({
+        mfa_request_id: 'test-mfa-id',
+        mfa_constraints: { test_mfa: { any: [totpConstraint] } },
+      });
+      this.setMfaAuthData(mfaRequirement);
+      await this.renderComponent();
+      await waitFor(MFA_SELECTORS.qrCode);
+      assert
+        .dom(MFA_SELECTORS.mfaForm)
+        .hasText(
+          'Set up MFA TOTP to continue Your organization has enforced MFA TOTP to protect your accounts. Set up to continue. Scan the QR code to continue Scan the QR code with your authenticator app. If you currently do not have a device on hand, you can copy the MFA secret below and enter it manually. Or Copy TOTP setup URL For your security, this code is only shown once. Please scan or copy the setup URL into your authenticator app now. Continue Cancel',
+          'it renders self-enrollment text'
+        );
+      assert.dom(MFA_SELECTORS.qrCode).exists('it renders qr code');
+      assert.dom(GENERAL.cancelButton).exists();
+      assert.dom(MFA_SELECTORS.verifyForm).doesNotExist('it does not render input field for TOTP code');
+      assert.dom(GENERAL.button('Verify')).doesNotExist('it does not render Validate button');
+      await click(GENERAL.copyButton);
+      assert.strictEqual(clipboardSpy.firstCall.args[0], QR_CODE_URL, 'copy value is qr code URL');
+      // Restore original clipboard
+      clipboardSpy.restore(); // cleanup
+    });
+
+    test('it makes request to self-enroll endpoint when self_enrollment_enabled is true', async function (assert) {
+      assert.expect(3);
+      const request_id = crypto.randomUUID();
+      const totpConstraint = this.server.create('mfa-method', {
+        type: 'totp',
+        self_enrollment_enabled: true,
+      });
+      this.mfaAuthData.mfaRequirement = this.authService.parseMfaResponse({
+        mfa_request_id: request_id,
+        mfa_constraints: { test_mfa_1: { any: [totpConstraint] } },
+      });
+
+      this.server.post('/identity/mfa/method/totp/self-enroll', async (schema, req) => {
+        const { mfa_method_id, mfa_request_id } = JSON.parse(req.requestBody);
+        assert.true(true, 'Request made to /self-enroll');
+        assert.strictEqual(mfa_request_id, request_id, 'payload has expected request id');
+        assert.strictEqual(mfa_method_id, totpConstraint.id, 'payload has expected method id');
+        return {
+          data: {
+            barcode:
+              'iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BAAAG50lEQVR4nOydwW4kNwxE42D//5c3h74oYFh4lDTZ6kG9k6FRS7ILJEiKPf71+/dfwYi///QBwr+JIGZEEDMiiBkRxIwIYkYEMSOCmBFBzIggZkQQMyKIGRHEjAhiRgQxI4KYEUHMiCBmRBAzftGJPz905npLvz71jD8j68/107pafarbpXuK/F5kze5ZDe9ciIWYEUHMwC7rgZu//rRzJtVpENfRfVpXm7rKehJ95gp3aw+xEDMiiBlDl/XAIxAdWXVOoDNzHrPp+KpzXN0unVvTZ97rCY2FmBFBzNhyWRyd0PE5df50dx1f6dhMz79LLMSMCGLGh13Wio5Vpolbjan0Ot1JSJrZxWOfIBZiRgQxY8tlTc22Rjt1vK5P6ktdzDYt1+s1CbdcWSzEjAhixtBlTYvJ0/qVvh8kz9Z9b63ZjU//JppYiBkRxIyfTyU6pFTe7U1K9+vKel/+qd79/yEWYkYEMWPYl0XuzmoCSNYkn3YxG9/lVvGf/x2mxELMiCBmXCq/77VZTtOx9SnSosDbHrp19F7ksmAap8VCzIggZhy4LG6eOo5a53ROYB3vqkkkuiMl/Tre7b7nljWxEDMiiBm4lrXXPLBXmp7Wu07G6xxykunMRFmvJYKYsXVjuFe45k6P7MgbPvm+pNKlz3BetI+FmBFBzDh+x5AkU9N+ct4IUdfRxXnex1VX7kbudnnFQsyIIGYMmxxISljH6wqkq5wkX9NyPT9nhbjW86aIWIgZEcSMA5fFYyTuQKaOSz+lHRSPrPTv20F6wCqxEDMiiBkHL+xwt1PH9X3cOn7e8MB7sUjjRHeSW8RCzIggZmxFWdP0aq9ds4O0TJBnp9GX3l2fIVHWa4kgZmy9sEMqSA8kydIzu6duxVfdLpq9ahghFmJGBDFj2JfVQRoyb/UyTcvyvKZEqnBkfsrvX0QEMeM4MSQ1H+J89m7ieNm8O78+5/TmUa9GiIWYEUHMOH4teh3fS6nqOGkc1T1gpG9Kn3B6iTBNUTtiIWZEEDOOmxy6cd4OUVfTa/LuLH3+lb1kcBrjEWIhZkQQM46bHLpxEml06/C4iF8EdCeszRXTfe+W4mMhZkQQMw5uDAkkCjppFtX7rjOnbq3OIfWrOjNR1suJIGZs1bIetGGu0YsugJ80i+pnu5pbfXbqXqYNHqllvZYIYsbBd793CR0pUJO+qYpOJEniuVenqs92+543PMRCzIggZmCXdXKtr28Ju8iNr8NjHs7JlUFqWV9EBDHj0hcpTys8dUQ3NnQ7kjI7Py13Nfr33bvNfIiFmBFBzLj6r1dJhWra5U5uJ+s4OSc5wzpHP7tXqK/EQsyIIGZcesfwpMOqztEz9XlI51i3y3TkE8RCzIggZmzdGPK+LJL0kb534i6m/WB6hHPrrvAhFmJGBDHj6j8FI2X26nxICjl1U2R37nJ1ilpPuJcSPsRCzIggZnyglvVAzLxzGp3r6GbqHbuYZy/ZrJ92v8sesRAzIogZH/g/huun+tn6VJd+kvYJ7eimJXGe5OoVpsRCzIggZlx6LbqbyYvtHXwXfdp1tWlJv1utrknOrImFmBFBzDj+p2ArPA4hc7pXfgidw+TJ47QZo1snfVkvJ4KYsdXk8B/LYBehi+080atzOk56rrrVyKnWdeKyXksEMePgHcO9iIL3ydef676ksWEvyup2nyabaXJ4ORHEjINvcujK5udF+G6ErEDu+HRZnkeJXSJ5QizEjAhixvC16AeS4umZ66d1F70+OaEe1z1XNcqaJncnpfhYiBkRxIyDKKvCC9TdOK9cTSO66flJL1b3W+jUVRMLMSOCmLFVy+J94OuIjpG4IyLrT1tMdQm9O+f070CIhZgRQczY+r6svUSJ1510fUmfcJ1fV9NxlHZie7tMiYWYEUHMOOjL4ndzZM2ui75zHXoOd4/dGchIPc95ET4WYkYEMeP4hR09Qp7tnA8p73dzeJTV1cempX5945la1muJIGYMy+8EfelP+pdO6kvdavXn+uz0plJHVqllfQURxIwPvLBTf+bVJBKZEFfWdUzxwv60K6zuu5cqxkLMiCBmbCWGPP7RSdzeLjx969oPuvXrXutMUmEjDaiaWIgZEcSMq9+X1UHaNevP9Vmymn62wuNGMp/P6YiFmBFBzPiwy9Il7nXOw60a1LStYprGTps0OLEQMyKIGVsua9q6MG1I4LvUvUgCOK1inTQwpJb1ciKIGQff5MBnknRvhRfeu6emt43rHJ5m6hgyN4ZfQQQx49L3ZYVbxELMiCBmRBAzIogZEcSMCGJGBDEjgpgRQcyIIGZEEDMiiBkRxIwIYkYEMSOCmBFBzIggZkQQMyKIGf8EAAD//zl1N+YGOSI8AAAAAElFTkSuQmCC',
+            url: QR_CODE_URL,
+          },
+        };
+      });
+
+      await this.renderComponent();
+      await click(GENERAL.button('Continue'));
+    });
+
+    test('it renders correct text for single passcode', async function (assert) {
+      const totpConstraint = this.server.create('mfa-method', {
+        type: 'totp',
+        self_enrollment_enabled: true,
+      });
+      this.mfaAuthData.mfaRequirement = this.authService.parseMfaResponse({
+        mfa_request_id: 'test-mfa-id',
+        mfa_constraints: { test_mfa_1: { any: [totpConstraint] } },
+      });
+
+      await this.renderComponent();
+      assert.dom(GENERAL.title).hasText('Set up MFA TOTP to continue');
+      assert
+        .dom(MFA_SELECTORS.subheader)
+        .hasText('Your organization has enforced MFA TOTP to protect your accounts. Set up to continue.');
+      assert.dom(MFA_SELECTORS.subtitle).hasText('Scan the QR code to continue');
+      assert
+        .dom(MFA_SELECTORS.description)
+        .hasText(
+          'Scan the QR code with your authenticator app. If you currently do not have a device on hand, you can copy the MFA secret below and enter it manually.',
+          'Correct description renders for single passcode'
+        );
+      assert.dom(GENERAL.button('Continue')).exists();
+      assert.dom(GENERAL.cancelButton).exists();
+
+      // Go on to next step which is input code to verify device
+      await click(GENERAL.button('Continue'));
+      assert.dom(GENERAL.title).hasText('Set up MFA TOTP to continue');
+      assert
+        .dom(MFA_SELECTORS.subheader)
+        .hasText('Your organization has enforced MFA TOTP to protect your accounts. Set up to continue.');
+      assert.dom(MFA_SELECTORS.subtitle).doesNotExist();
+      assert
+        .dom(MFA_SELECTORS.description)
+        .hasText('To verify your device, enter the code generated from your authenticator.');
+      assert.dom(MFA_SELECTORS.label).hasText('Enter your one-time code');
+      assert.dom(GENERAL.button('Verify')).exists();
+      assert.dom(GENERAL.cancelButton).exists();
+    });
+
+    test('it renders correct text for multiple methods (1 passcode 1 push)', async function (assert) {
+      const oktaConstraint = this.server.create('mfa-method', { type: 'okta' });
+      const totpConstraint = this.server.create('mfa-method', {
+        type: 'totp',
+        self_enrollment_enabled: true,
+      });
+      this.mfaAuthData.mfaRequirement = this.authService.parseMfaResponse({
+        mfa_request_id: 'test-mfa-id',
+        mfa_constraints: { test_mfa_1: { any: [totpConstraint, oktaConstraint] } },
+      });
+      await this.renderComponent();
+      assert.dom(GENERAL.title).hasText('Verify your identity');
+      assert.dom(MFA_SELECTORS.subheader).hasText('Multi-factor authentication is enabled for your account.');
+      assert.dom(MFA_SELECTORS.description).hasText('Choose one of the following methods to continue:');
+      assert.dom(MFA_SELECTORS.subtitle).doesNotExist();
+      assert.dom(GENERAL.button('Verify')).doesNotExist();
+      assert.dom(GENERAL.cancelButton).exists();
+
+      // Select TOTP
+      await click(GENERAL.button('Setup to verify with TOTP'));
+      await waitFor(MFA_SELECTORS.qrCode);
+      assert.dom(GENERAL.title).hasText('Set up MFA TOTP to continue');
+      assert
+        .dom(MFA_SELECTORS.subheader)
+        .hasText('Your organization has enforced MFA TOTP to protect your accounts. Set up to continue.');
+      assert.dom(MFA_SELECTORS.subtitle).hasText('Scan the QR code to continue');
+      assert
+        .dom(MFA_SELECTORS.description)
+        .hasText(
+          'Scan the QR code with your authenticator app. If you currently do not have a device on hand, you can copy the MFA secret below and enter it manually.',
+          'Correct description renders for single passcode'
+        );
+      assert.dom(GENERAL.button('Continue')).exists();
+      assert.dom(GENERAL.cancelButton).exists();
+
+      // Go on to next step
+      await click(GENERAL.button('Continue'));
+      assert.dom(GENERAL.title).hasText('Set up MFA TOTP to continue');
+      assert
+        .dom(MFA_SELECTORS.subheader)
+        .hasText('Your organization has enforced MFA TOTP to protect your accounts. Set up to continue.');
+      assert.dom(MFA_SELECTORS.subtitle).doesNotExist();
+      assert
+        .dom(MFA_SELECTORS.description)
+        .hasText('To verify your device, enter the code generated from your authenticator.');
+      assert.dom(MFA_SELECTORS.label).hasText('Enter your one-time code');
+      assert.dom(GENERAL.button('Verify')).exists();
+      assert.dom(GENERAL.cancelButton).exists('it renders "Cancel" after self-enroll workflow');
+    });
+
+    test('it renders correct text for multiple methods (2 passcodes)', async function (assert) {
+      const duoConstraint = this.server.create('mfa-method', { type: 'duo', uses_passcode: true });
+      const totpConstraint = this.server.create('mfa-method', {
+        type: 'totp',
+        self_enrollment_enabled: true,
+      });
+      this.mfaAuthData.mfaRequirement = this.authService.parseMfaResponse({
+        mfa_request_id: 'test-mfa-id',
+        mfa_constraints: { test_mfa_1: { any: [totpConstraint, duoConstraint] } },
+      });
+      await this.renderComponent();
+      assert.dom(GENERAL.title).hasText('Verify your identity');
+      assert.dom(MFA_SELECTORS.subheader).hasText('Multi-factor authentication is enabled for your account.');
+      assert.dom(MFA_SELECTORS.description).hasText('Choose one of the following methods to continue:');
+      assert.dom(MFA_SELECTORS.subtitle).doesNotExist();
+      assert.dom(GENERAL.button('Verify')).doesNotExist();
+      assert.dom(GENERAL.cancelButton).exists();
+
+      // Select TOTP
+      await click(GENERAL.button('Setup to verify with TOTP'));
+      await waitFor(MFA_SELECTORS.qrCode);
+      assert.dom(GENERAL.title).hasText('Set up MFA TOTP to continue');
+      assert
+        .dom(MFA_SELECTORS.subheader)
+        .hasText('Your organization has enforced MFA TOTP to protect your accounts. Set up to continue.');
+      assert.dom(MFA_SELECTORS.subtitle).hasText('Scan the QR code to continue');
+      assert
+        .dom(MFA_SELECTORS.description)
+        .hasText(
+          'Scan the QR code with your authenticator app. If you currently do not have a device on hand, you can copy the MFA secret below and enter it manually.',
+          'Correct description renders for single passcode'
+        );
+      assert.dom(GENERAL.button('Continue')).exists();
+      assert.dom(GENERAL.cancelButton).exists();
+
+      // Go on to next step
+      await click(GENERAL.button('Continue'));
+      assert.dom(GENERAL.title).hasText('Set up MFA TOTP to continue');
+      assert
+        .dom(MFA_SELECTORS.subheader)
+        .hasText('Your organization has enforced MFA TOTP to protect your accounts. Set up to continue.');
+      assert.dom(MFA_SELECTORS.subtitle).doesNotExist();
+      assert
+        .dom(MFA_SELECTORS.description)
+        .hasText('To verify your device, enter the code generated from your authenticator.');
+      assert.dom(MFA_SELECTORS.label).hasText('Enter your one-time code');
+      assert.dom(GENERAL.button('Verify')).exists();
+      assert.dom(GENERAL.cancelButton).exists('it renders "Cancel" after self-enroll workflow');
+    });
+
+    test('it renders correct text for multiple constraints (1 passcode 1 push)', async function (assert) {
+      const oktaConstraint = this.server.create('mfa-method', { type: 'okta' });
+      const totpConstraint = this.server.create('mfa-method', {
+        type: 'totp',
+        self_enrollment_enabled: true,
+      });
+      this.mfaAuthData.mfaRequirement = this.authService.parseMfaResponse({
+        mfa_request_id: 'test-mfa-id',
+        mfa_constraints: { test_mfa_1: { any: [oktaConstraint] }, test_mfa_2: { any: [totpConstraint] } },
+      });
+
+      await this.renderComponent();
+      await waitFor(MFA_SELECTORS.qrCode);
+      assert.dom(MFA_SELECTORS.qrCode).exists('it renders QR code');
+      assert.dom(GENERAL.title).hasText('Set up MFA TOTP to continue');
+      assert.dom(GENERAL.button('Verify')).doesNotExist();
+      assert.dom(GENERAL.cancelButton).exists();
+
+      // Click "Continue" for second setup step to verify passcode
+      await click(GENERAL.button('Continue'));
+      assert.dom(GENERAL.button('Continue')).doesNotExist('"Continue" button is replaced by "Verify"');
+      assert.dom(MFA_SELECTORS.qrCode).doesNotExist('Clicking "Continue" removes QR code');
+      assert.dom(GENERAL.title).hasText('Set up MFA TOTP to continue');
+      assert
+        .dom(MFA_SELECTORS.description)
+        .hasText('To verify your device, enter the code generated from your authenticator.');
+      await click(GENERAL.button('Verify'));
+
+      // Final view which manages the loading state while validate task runs
+      assert.dom(GENERAL.title).hasText('Verify your identity');
+      assert.dom(MFA_SELECTORS.subheader).hasText('Multi-factor authentication is enabled for your account.');
+      assert
+        .dom(MFA_SELECTORS.description)
+        .hasText('Two methods are required for successful authentication.');
+      assert.dom(MFA_SELECTORS.label).hasText('Okta push notification');
+      assert.dom(MFA_SELECTORS.push).hasText('Check device for push notification');
+      assert.dom(MFA_SELECTORS.verifyBadge('TOTP passcode')).hasText('TOTP passcode');
+    });
+
+    // Unlikely in the real-world, but test coverage just in case
+    test('it renders correct text for multiple constraints, one with multiple methods including self-enroll', async function (assert) {
+      const oktaConstraint = this.server.create('mfa-method', { type: 'okta' });
+      const duoConstraint = this.server.create('mfa-method', { type: 'duo' });
+      const totpConstraint = this.server.create('mfa-method', {
+        type: 'totp',
+        self_enrollment_enabled: true,
+      });
+      this.mfaAuthData.mfaRequirement = this.authService.parseMfaResponse({
+        mfa_request_id: 'test-mfa-id',
+        mfa_constraints: {
+          test_mfa_1: { any: [oktaConstraint, totpConstraint] },
+          test_mfa_2: { any: [totpConstraint, duoConstraint] },
+        },
+      });
+
+      await this.renderComponent();
+      assert.dom(MFA_SELECTORS.subheader).hasText('Multi-factor authentication is enabled for your account.');
+      assert
+        .dom(MFA_SELECTORS.description)
+        .hasText(
+          'Select a method for each enforcement to continue. Choosing a self-enroll method will redirect you to setup your device.'
+        );
+    });
+  });
+});
diff --git a/ui/tests/integration/components/mount-accessor-select-test.js b/ui/tests/integration/components/mount-accessor-select-test.js
index 85486071b55..a7f66912f1f 100644
--- a/ui/tests/integration/components/mount-accessor-select-test.js
+++ b/ui/tests/integration/components/mount-accessor-select-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/mount-backend-form-test.js b/ui/tests/integration/components/mount-backend-form-test.js
index f1acedc1fe2..6bc07a0d638 100644
--- a/ui/tests/integration/components/mount-backend-form-test.js
+++ b/ui/tests/integration/components/mount-backend-form-test.js
@@ -1,22 +1,20 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { later, _cancelTimers as cancelTimers } from '@ember/runloop';
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, settled } from '@ember/test-helpers';
+import { render, click, fillIn } from '@ember/test-helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { allowAllCapabilitiesStub, noopStub } from 'vault/tests/helpers/stubs';
-import hbs from 'htmlbars-inline-precompile';
-
-import { create } from 'ember-cli-page-object';
-import mountBackendForm from '../../pages/components/mount-backend-form';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
+import { filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
 
+import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
-
-const component = create(mountBackendForm);
+import AuthMethodForm from 'vault/forms/auth/method';
 
 module('Integration | Component | mount backend form', function (hooks) {
   setupRenderingTest(hooks);
@@ -29,70 +27,75 @@ module('Integration | Component | mount backend form', function (hooks) {
     this.store = this.owner.lookup('service:store');
     this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
     this.server.post('/sys/auth/foo', noopStub());
-    this.server.post('/sys/mounts/foo', noopStub());
     this.onMountSuccess = sinon.spy();
   });
 
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
-
   module('auth method', function (hooks) {
     hooks.beforeEach(function () {
-      this.model = this.store.createRecord('auth-method');
-      this.model.set('config', this.store.createRecord('mount-config'));
+      const defaults = {
+        config: { listing_visibility: false },
+      };
+      this.model = new AuthMethodForm(defaults, { isNew: true });
     });
 
     test('it renders default state', async function (assert) {
+      assert.expect(15);
       await render(
         hbs`<MountBackendForm @mountModel={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
       );
-      assert.strictEqual(
-        component.header,
-        'Enable an Authentication Method',
-        'renders auth header in default state'
-      );
-      assert.ok(component.types.length > 0, 'renders type picker');
+      assert
+        .dom(GENERAL.title)
+        .hasText('Enable an Authentication Method', 'renders auth header in default state');
+
+      for (const method of filterEnginesByMountCategory({
+        mountCategory: 'auth',
+        isEnterprise: false,
+      }).filter((engine) => engine.type !== 'token')) {
+        assert
+          .dom(GENERAL.cardContainer(method.type))
+          .hasText(method.displayName, `renders type:${method.displayName} picker`);
+      }
     });
 
     test('it changes path when type is changed', async function (assert) {
       await render(
         hbs`<MountBackendForm @mountModel={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
       );
-      await component.selectType('aws');
-      assert.strictEqual(component.pathValue, 'aws', 'sets the value of the type');
-      await component.back();
-      await component.selectType('approle');
-      assert.strictEqual(component.pathValue, 'approle', 'updates the value of the type');
+
+      await click(GENERAL.cardContainer('aws'));
+      assert.dom(GENERAL.inputByAttr('path')).hasValue('aws', 'sets the value of the type');
+      await click(GENERAL.backButton);
+      await click(GENERAL.cardContainer('approle'));
+      assert.dom(GENERAL.inputByAttr('path')).hasValue('approle', 'updates the value of the type');
     });
 
     test('it keeps path value if the user has changed it', async function (assert) {
       await render(
         hbs`<MountBackendForm @mountModel={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
       );
-      await component.selectType('approle');
+      await click(GENERAL.cardContainer('approle'));
       assert.strictEqual(this.model.type, 'approle', 'Updates type on model');
-      assert.strictEqual(component.pathValue, 'approle', 'defaults to approle (first in the list)');
-      await component.path('newpath');
+      assert.dom(GENERAL.inputByAttr('path')).hasValue('approle', 'defaults to approle (first in the list)');
+      await fillIn(GENERAL.inputByAttr('path'), 'newpath');
       assert.strictEqual(this.model.path, 'newpath', 'Updates path on model');
-      await component.back();
+      await click(GENERAL.backButton);
       assert.strictEqual(this.model.type, '', 'Clears type on back');
       assert.strictEqual(this.model.path, 'newpath', 'Path is still newPath');
-      await component.selectType('aws');
+      await click(GENERAL.cardContainer('aws'));
       assert.strictEqual(this.model.type, 'aws', 'Updates type on model');
-      assert.strictEqual(component.pathValue, 'newpath', 'keeps custom path value');
+      assert.dom(GENERAL.inputByAttr('path')).hasValue('newpath', 'keeps custom path value');
     });
 
     test('it does not show a selected token type when first mounting an auth method', async function (assert) {
       await render(
         hbs`<MountBackendForm @mountModel={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
       );
-      await component.selectType('github');
-      await component.toggleOptions();
+      await click(GENERAL.cardContainer('github'));
+      await click(GENERAL.button('Method Options'));
       assert
-        .dom('[data-test-input="config.tokenType"]')
+        .dom(GENERAL.inputByAttr('config.token_type'))
         .hasValue('', 'token type does not have a default value.');
-      const selectOptions = document.querySelector('[data-test-input="config.tokenType"]').options;
+      const selectOptions = document.querySelector(GENERAL.inputByAttr('config.token_type')).options;
       assert.strictEqual(selectOptions[1].text, 'default-service', 'first option is default-service');
       assert.strictEqual(selectOptions[2].text, 'default-batch', 'second option is default-batch');
       assert.strictEqual(selectOptions[3].text, 'batch', 'third option is batch');
@@ -112,83 +115,13 @@ module('Integration | Component | mount backend form', function (hooks) {
       await render(
         hbs`<MountBackendForm @mountModel={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
       );
-      await component.mount('approle', 'foo');
-      later(() => cancelTimers(), 50);
-      await settled();
+      await mountBackend('approle', 'foo');
 
-      assert.ok(spy.calledOnce, 'calls the passed success method');
-      assert.ok(
+      assert.true(spy.calledOnce, 'calls the passed success method');
+      assert.true(
         this.flashSuccessSpy.calledWith('Successfully mounted the approle auth method at foo.'),
         'Renders correct flash message'
       );
     });
   });
-
-  module('secrets engine', function (hooks) {
-    hooks.beforeEach(function () {
-      this.model = this.store.createRecord('secret-engine');
-      this.model.set('config', this.store.createRecord('mount-config'));
-    });
-
-    test('it renders secret specific headers', async function (assert) {
-      await render(
-        hbs`<MountBackendForm  @mountType="secret" @mountModel={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
-      );
-      assert.strictEqual(component.header, 'Enable a Secrets Engine', 'renders secrets header');
-      assert.ok(component.types.length > 0, 'renders type picker');
-    });
-
-    test('it changes path when type is changed', async function (assert) {
-      await render(
-        hbs`<MountBackendForm @mountType="secret" @mountModel={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
-      );
-      await component.selectType('azure');
-      assert.strictEqual(component.pathValue, 'azure', 'sets the value of the type');
-      await component.back();
-      await component.selectType('nomad');
-      assert.strictEqual(component.pathValue, 'nomad', 'updates the value of the type');
-    });
-
-    test('it keeps path value if the user has changed it', async function (assert) {
-      await render(
-        hbs`<MountBackendForm @mountType="secret" @mountModel={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
-      );
-      await component.selectType('kv');
-      assert.strictEqual(this.model.type, 'kv', 'Updates type on model');
-      assert.strictEqual(component.pathValue, 'kv', 'path matches mount type');
-      await component.path('newpath');
-      assert.strictEqual(this.model.path, 'newpath', 'Updates path on model');
-      await component.back();
-      assert.strictEqual(this.model.type, '', 'Clears type on back');
-      assert.strictEqual(this.model.path, 'newpath', 'path is still newpath');
-      await component.selectType('ssh');
-      assert.strictEqual(this.model.type, 'ssh', 'Updates type on model');
-      assert.strictEqual(component.pathValue, 'newpath', 'path stays the same');
-    });
-
-    test('it calls mount success', async function (assert) {
-      assert.expect(3);
-
-      this.server.post('/sys/mounts/foo', () => {
-        assert.ok(true, 'it calls enable on an secrets engine');
-        return [204, { 'Content-Type': 'application/json' }];
-      });
-      const spy = sinon.spy();
-      this.set('onMountSuccess', spy);
-
-      await render(
-        hbs`<MountBackendForm @mountType="secret" @mountModel={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
-      );
-
-      await component.mount('ssh', 'foo');
-      later(() => cancelTimers(), 50);
-      await settled();
-
-      assert.ok(spy.calledOnce, 'calls the passed success method');
-      assert.ok(
-        this.flashSuccessSpy.calledWith('Successfully mounted the ssh secrets engine at foo.'),
-        'Renders correct flash message'
-      );
-    });
-  });
 });
diff --git a/ui/tests/integration/components/mount-backend-type-form-enhancements-test.js b/ui/tests/integration/components/mount-backend-type-form-enhancements-test.js
new file mode 100644
index 00000000000..a3f55ec4af0
--- /dev/null
+++ b/ui/tests/integration/components/mount-backend-type-form-enhancements-test.js
@@ -0,0 +1,35 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+
+module('Integration | Component | mount-backend/type-form | plugin catalog enhancements', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.setMountType = sinon.spy();
+    this.version = this.owner.lookup('service:version');
+    this.store = this.owner.lookup('service:store');
+  });
+
+  test('it renders basic form elements', async function (assert) {
+    await render(hbs`
+      <MountBackend::TypeForm 
+        @mountCategory="secret" 
+        @setMountType={{this.setMountType}} 
+      />
+    `);
+
+    assert.dom('.field.is-grouped').exists('renders action buttons');
+    assert.dom(`${GENERAL.cancelButton}`).exists('shows cancel button');
+  });
+});
diff --git a/ui/tests/integration/components/mount-backend/type-form-test.js b/ui/tests/integration/components/mount-backend/type-form-test.js
index 2c988fb1f19..997bac71469 100644
--- a/ui/tests/integration/components/mount-backend/type-form-test.js
+++ b/ui/tests/integration/components/mount-backend/type-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,14 +8,22 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import sinon from 'sinon';
-import { allEngines, mountableEngines } from 'vault/helpers/mountable-secret-engines';
-import { allMethods, methods } from 'vault/helpers/mountable-auth-methods';
+import { filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
-const secretTypes = mountableEngines().map((engine) => engine.type);
-const allSecretTypes = allEngines().map((engine) => engine.type);
-const authTypes = methods().map((auth) => auth.type);
-const allAuthTypes = allMethods().map((auth) => auth.type);
+const secretTypes = filterEnginesByMountCategory({ mountCategory: 'secret', isEnterprise: false })
+  .filter((engine) => engine.type !== 'cubbyhole')
+  .map((engine) => engine.type);
+const allSecretTypes = filterEnginesByMountCategory({ mountCategory: 'secret', isEnterprise: true })
+  .filter((engine) => engine.type !== 'cubbyhole')
+  .map((engine) => engine.type);
+const authTypes = filterEnginesByMountCategory({ mountCategory: 'auth', isEnterprise: false })
+  .filter((engine) => engine.type !== 'token')
+  .map((auth) => auth.type);
+const allAuthTypes = filterEnginesByMountCategory({ mountCategory: 'auth', isEnterprise: true })
+  .filter((engine) => engine.type !== 'token')
+  .map((auth) => auth.type);
 
 module('Integration | Component | mount-backend/type-form', function (hooks) {
   setupRenderingTest(hooks);
@@ -25,26 +33,28 @@ module('Integration | Component | mount-backend/type-form', function (hooks) {
   });
 
   test('it calls secrets setMountType when type is selected', async function (assert) {
+    assert.expect(secretTypes.length + 1, 'renders all mountable engines plus calls a spy');
     const spy = sinon.spy();
     this.set('setType', spy);
-    await render(hbs`<MountBackend::TypeForm @mountType="secret" @setMountType={{this.setType}} />`);
+    await render(hbs`<MountBackend::TypeForm @mountCategory="secret" @setMountType={{this.setType}} />`);
 
-    assert
-      .dom('[data-test-mount-type]')
-      .exists({ count: secretTypes.length }, 'Renders all mountable engines');
-    await click(`[data-test-mount-type="ssh"]`);
+    for (const type of secretTypes) {
+      assert.dom(GENERAL.cardContainer(type)).exists(`Renders ${type} mountable secret engine`);
+    }
+    await click(GENERAL.cardContainer('ssh'));
     assert.ok(spy.calledOnceWith('ssh'));
   });
 
   test('it calls auth setMountType when type is selected', async function (assert) {
+    assert.expect(authTypes.length + 1, 'renders all mountable auth methods plus calls a spy');
     const spy = sinon.spy();
     this.set('setType', spy);
     await render(hbs`<MountBackend::TypeForm @setMountType={{this.setType}} />`);
 
-    assert
-      .dom('[data-test-mount-type]')
-      .exists({ count: authTypes.length }, 'Renders all mountable auth methods');
-    await click(`[data-test-mount-type="okta"]`);
+    for (const type of authTypes) {
+      assert.dom(GENERAL.cardContainer(type)).exists(`Renders ${type} mountable auth engine`);
+    }
+    await click(GENERAL.cardContainer('okta'));
     assert.ok(spy.calledOnceWith('okta'));
   });
 
@@ -55,21 +65,25 @@ module('Integration | Component | mount-backend/type-form', function (hooks) {
     });
 
     test('it renders correct items for enterprise secrets', async function (assert) {
+      assert.expect(allSecretTypes.length, 'renders all enterprise secret engines');
       setRunOptions({
         rules: {
           // TODO: Fix disabled enterprise options with enterprise badge
           'color-contrast': { enabled: false },
         },
       });
-      await render(hbs`<MountBackend::TypeForm @mountType="secret" @setMountType={{this.setType}} />`);
-      assert
-        .dom('[data-test-mount-type]')
-        .exists({ count: allSecretTypes.length }, 'Renders all secret engines');
+      await render(hbs`<MountBackend::TypeForm @mountCategory="secret" @setMountType={{this.setType}} />`);
+      for (const type of allSecretTypes) {
+        assert.dom(GENERAL.cardContainer(type)).exists(`Renders ${type} secret engine`);
+      }
     });
 
     test('it renders correct items for enterprise auth methods', async function (assert) {
-      await render(hbs`<MountBackend::TypeForm @mountType="auth" @setMountType={{this.setType}} />`);
-      assert.dom('[data-test-mount-type]').exists({ count: allAuthTypes.length }, 'Renders all auth methods');
+      assert.expect(allAuthTypes.length, 'renders all enterprise auth engines');
+      await render(hbs`<MountBackend::TypeForm @mountCategory="auth" @setMountType={{this.setType}} />`);
+      for (const type of allAuthTypes) {
+        assert.dom(GENERAL.cardContainer(type)).exists(`Renders ${type} auth engine`);
+      }
     });
   });
 });
diff --git a/ui/tests/integration/components/mount/secrets-engine-form-test.js b/ui/tests/integration/components/mount/secrets-engine-form-test.js
new file mode 100644
index 00000000000..7a834647e25
--- /dev/null
+++ b/ui/tests/integration/components/mount/secrets-engine-form-test.js
@@ -0,0 +1,231 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render, click, typeIn, fillIn } from '@ember/test-helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import {
+  allowAllCapabilitiesStub,
+  capabilitiesStub,
+  noopStub,
+  overrideResponse,
+} from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { ALL_ENGINES } from 'vault/utils/all-engines-metadata';
+
+import hbs from 'htmlbars-inline-precompile';
+import sinon from 'sinon';
+import SecretsEngineForm from 'vault/forms/secrets/engine';
+
+const WIF_ENGINES = ALL_ENGINES.filter((e) => e.isWIF).map((e) => e.type);
+
+module('Integration | Component | mount/secrets-engine-form', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.flashMessages = this.owner.lookup('service:flash-messages');
+    this.flashSuccessSpy = sinon.spy(this.flashMessages, 'success');
+    this.flashWarningSpy = sinon.spy(this.flashMessages, 'warning');
+    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
+    this.server.post('/sys/mounts/foo', noopStub());
+    this.onMountSuccess = sinon.spy();
+
+    const defaults = {
+      config: { listing_visibility: false },
+      kv_config: {
+        max_versions: 0,
+        cas_required: false,
+        delete_version_after: 0,
+      },
+      options: { version: 2 },
+    };
+    this.model = new SecretsEngineForm(defaults, { isNew: true });
+  });
+
+  test('it renders secret engine form', async function (assert) {
+    await render(
+      hbs`<Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
+    );
+    assert.dom(GENERAL.breadcrumbs).exists('renders breadcrumbs');
+    assert.dom(GENERAL.submitButton).hasText('Enable engine', 'renders submit button');
+    assert.dom(GENERAL.backButton).hasText('Back', 'renders back button');
+  });
+
+  test('it changes path when type is set', async function (assert) {
+    this.model.type = 'azure';
+    this.model.data.path = 'azure'; // Set path to match type as would happen in the route
+    await render(
+      hbs`<Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
+    );
+    assert.dom(GENERAL.inputByAttr('path')).hasValue('azure', 'path matches type');
+  });
+
+  test('it keeps custom path value', async function (assert) {
+    this.model.type = 'kv';
+    this.model.data.path = 'custom-path';
+    await render(
+      hbs`<Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
+    );
+    assert.dom(GENERAL.inputByAttr('path')).hasValue('custom-path', 'keeps custom path');
+  });
+
+  test('it calls mount success', async function (assert) {
+    assert.expect(3);
+
+    this.server.post('/sys/mounts/foo', () => {
+      assert.ok(true, 'it calls enable on a secrets engine');
+      return [204, { 'Content-Type': 'application/json' }];
+    });
+    const spy = sinon.spy();
+    this.set('onMountSuccess', spy);
+
+    this.model.type = 'ssh';
+    this.model.data.path = 'foo';
+
+    await render(
+      hbs`<Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
+    );
+
+    await click(GENERAL.submitButton);
+
+    assert.true(spy.calledOnce, 'calls the passed success method');
+    assert.true(
+      this.flashSuccessSpy.calledWith('Successfully mounted the ssh secrets engine at foo.'),
+      'Renders correct flash message'
+    );
+  });
+
+  module('KV engine', function (hooks) {
+    hooks.beforeEach(function () {
+      this.model.type = 'kv';
+    });
+
+    test('it shows KV specific fields when type is kv', async function (assert) {
+      await render(
+        hbs`<Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
+      );
+      assert.dom(GENERAL.inputByAttr('kv_config.max_versions')).exists('shows max versions field');
+      assert.dom(GENERAL.inputByAttr('kv_config.cas_required')).exists('shows CAS required field');
+      assert.dom(GENERAL.inputByAttr('kv_config.delete_version_after')).exists('shows delete after field');
+    });
+
+    test('version 2 with no update to config endpoint still allows mount of secret engine', async function (assert) {
+      assert.expect(6);
+      this.server.post('/sys/capabilities-self', () => capabilitiesStub('my-kv-engine/config', ['deny']));
+      this.server.post('/sys/mounts/my-kv-engine', (schema, req) => {
+        assert.true(true, 'it makes request to mount engine');
+        const payload = JSON.parse(req.requestBody);
+        const expected = {
+          config: { listing_visibility: 'hidden', force_no_cache: false },
+          options: { version: 2 },
+          type: 'kv',
+        };
+        assert.propEqual(payload, expected, 'mount request has expected payload');
+        return overrideResponse(204);
+      });
+
+      await render(
+        hbs`<Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
+      );
+      await fillIn(GENERAL.inputByAttr('path'), 'my-kv-engine');
+      await fillIn(GENERAL.inputByAttr('kv_config.max_versions'), '101');
+      await click(GENERAL.submitButton);
+      const [message] = this.flashWarningSpy.lastCall.args;
+      assert.strictEqual(
+        message,
+        `You do not have access to the config endpoint. The secret engine was mounted, but the configuration settings were not saved.`,
+        'it calls warning flash with expected message'
+      );
+      const [type, enginePath, useEngineRoute] = this.onMountSuccess.lastCall.args;
+      assert.strictEqual(type, 'kv', 'onMountSuccess called with expected type');
+      assert.strictEqual(enginePath, 'my-kv-engine', 'onMountSuccess called with expected engine path');
+      assert.true(useEngineRoute, 'onMountSuccess called useEngineRoute: true');
+    });
+  });
+
+  module('WIF secret engines', function () {
+    test('it shows identity_token_key when type is a WIF engine and hides when its not', async function (assert) {
+      // Test AWS (a WIF engine)
+      this.model.type = 'aws';
+      this.model.applyTypeSpecificDefaults();
+
+      // Initialize config object for WIF engines
+      if (!this.model.data.config) {
+        this.model.data.config = {};
+      }
+
+      await render(
+        hbs`<Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
+      );
+
+      // First check if the Method Options group is being rendered at all
+      assert.dom('[data-test-button="Method Options"]').exists('Method Options toggle button exists');
+
+      // Click to expand Method Options if it's collapsed
+      await click('[data-test-button="Method Options"]');
+
+      assert
+        .dom(GENERAL.fieldByAttr('config.identity_token_key'))
+        .exists('Identity token key field shows for AWS engine');
+
+      // Test KV (not a WIF engine)
+      this.model.type = 'kv';
+      this.model.applyTypeSpecificDefaults();
+
+      await render(
+        hbs`<Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
+      );
+
+      assert
+        .dom(GENERAL.fieldByAttr('config.identity_token_key'))
+        .doesNotExist('Identity token key field hidden for KV engine');
+    });
+
+    test('it updates identity_token_key if user has changed it', async function (assert) {
+      this.model.type = WIF_ENGINES[0]; // Use first WIF engine
+      this.model.applyTypeSpecificDefaults();
+      // Initialize config object
+      if (!this.model.data.config) {
+        this.model.data.config = {};
+      }
+      await render(
+        hbs`<Mount::SecretsEngineForm @model={{this.model}} @onMountSuccess={{this.onMountSuccess}} />`
+      );
+
+      // Expand Method Options section to show identity_token_key field
+      await click(GENERAL.button('Method Options'));
+
+      assert.strictEqual(
+        this.model.data.config.identity_token_key,
+        undefined,
+        'On init identity_token_key is not set on the model'
+      );
+
+      // SearchSelectWithModal likely uses fallback component when no OIDC models are found
+      await typeIn(GENERAL.inputSearch('key'), 'specialKey');
+
+      assert.strictEqual(
+        this.model.data.config.identity_token_key,
+        'specialKey',
+        'updates model with custom identity_token_key'
+      );
+    });
+  });
+
+  module('PKI engine', function () {
+    test('it sets default max lease TTL for PKI', async function (assert) {
+      this.model.type = 'pki';
+      this.model.applyTypeSpecificDefaults();
+
+      assert.strictEqual(
+        this.model.data.config.max_lease_ttl,
+        '3650d',
+        'sets PKI default max lease TTL to 10 years'
+      );
+    });
+  });
+});
diff --git a/ui/tests/integration/components/namespace-picker-test.js b/ui/tests/integration/components/namespace-picker-test.js
new file mode 100644
index 00000000000..020e0443fb9
--- /dev/null
+++ b/ui/tests/integration/components/namespace-picker-test.js
@@ -0,0 +1,188 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render, fillIn, findAll, click, find } from '@ember/test-helpers';
+import sinon from 'sinon';
+import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { capabilitiesStub, overrideResponse } from 'vault/tests/helpers/stubs';
+
+const INITIALIZED_NAMESPACES = ['root', 'parent1', 'parent1/child1'];
+
+module('Integration | Component | namespace-picker', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    const authService = this.owner.lookup('service:auth');
+    this.authStub = sinon.stub(authService, 'authData');
+    this.authStub.value({ userRootNamespace: '' });
+
+    this.nsService = this.owner.lookup('service:namespace');
+    // the path in the namespace service denotes the current namespace context a user is in
+    this.nsService.path = 'parent1/child1';
+    this.server.get('/sys/internal/ui/namespaces', () => {
+      return { data: { keys: ['parent1/', 'parent1/child1/'] } };
+    });
+  });
+
+  hooks.afterEach(function () {
+    this.authStub.restore();
+  });
+
+  test('it focuses the search input field when the component is loaded', async function (assert) {
+    await render(hbs`<NamespacePicker />`);
+    await click(GENERAL.button('namespace-picker'));
+
+    // Verify that the search input field is focused
+    const searchInput = find(GENERAL.inputByAttr('Search namespaces'));
+    assert.strictEqual(
+      document.activeElement,
+      searchInput,
+      'The search input field is focused on component load'
+    );
+  });
+
+  test('it selects the current namespace', async function (assert) {
+    await render(hbs`<NamespacePicker />`);
+    assert.dom(GENERAL.button('namespace-picker')).hasText('child1', 'it just displays the namespace node');
+    await click(GENERAL.button('namespace-picker'));
+    assert
+      .dom(GENERAL.button(this.nsService.path))
+      .hasAttribute('aria-selected', 'true', 'the current namespace path is selected');
+    assert.dom(`${GENERAL.button(this.nsService.path)} ${GENERAL.icon('check')}`).exists();
+  });
+
+  test('it filters namespace options based on search input', async function (assert) {
+    await render(hbs`<NamespacePicker/>`);
+    await click(GENERAL.button('namespace-picker'));
+
+    // Verify all namespaces are displayed initially which are pre-populated in the NamespaceService
+    for (const namespace of INITIALIZED_NAMESPACES) {
+      assert.dom(GENERAL.button(namespace)).exists(`Namespace "${namespace}" is displayed initially`);
+    }
+    // Simulate typing into the search input
+    await fillIn(GENERAL.inputByAttr('Search namespaces'), 'child1');
+
+    // Verify that only namespaces matching the search input are displayed
+    assert.strictEqual(
+      findAll(GENERAL.inputByAttr('Search namespaces')).length,
+      1,
+      'Only matching namespaces are displayed after filtering'
+    );
+
+    // Clear the search input
+    await fillIn(GENERAL.inputByAttr('Search namespaces'), '');
+
+    // Verify all namespaces are displayed after clearing the search input
+    assert.dom(GENERAL.button('root')).exists('Namespace "root" is displayed');
+    assert.dom(GENERAL.button('parent1')).exists('Namespace "parent1" is displayed');
+    assert.dom(GENERAL.button('parent1/child1')).exists('Namespace "parent1/child1" is displayed');
+    assert.strictEqual(
+      findAll(`ul ${GENERAL.button()}`).length,
+      3,
+      'Three namespaces are displayed after clearing the search input'
+    );
+  });
+
+  module('capabilities', function (hooks) {
+    hooks.beforeEach(function () {
+      // the capabilities service prepends the user's root namespace to API paths when checking permissions.
+      // For simplicity, test permissions from the "root" namespace context
+      this.nsService.path = '';
+    });
+
+    test('it shows the "Manage" action when user has canList permissions', async function (assert) {
+      this.server.post('/sys/capabilities-self', () => capabilitiesStub('sys/namespaces', ['list']));
+
+      await render(hbs`<NamespacePicker />`);
+      await click(GENERAL.button('namespace-picker'));
+
+      assert.dom(GENERAL.button('Manage')).exists('Manage button is visible');
+    });
+
+    test('it hides the "Manage" button when canList is false', async function (assert) {
+      this.server.post('/sys/capabilities-self', capabilitiesStub(`sys/namespaces`, ['deny']));
+      await render(hbs`<NamespacePicker />`);
+      await click(GENERAL.button('namespace-picker'));
+
+      // Verify that the buttons are hidden
+      assert.dom(GENERAL.button('Manage')).doesNotExist('Manage button is hidden');
+    });
+
+    test('it shows "Manage" button when the capabilities request throws an error', async function (assert) {
+      // It's rare for the capabilities request to fail (if it does, it's usually because the request is made in the wrong namespace context).
+      // If it fails, the UI should show resources and rely on the API to gate them appropriately.
+      this.server.post('/sys/capabilities-self', () => overrideResponse(403));
+
+      await render(hbs`<NamespacePicker />`);
+      await click(GENERAL.button('namespace-picker'));
+      assert.dom(GENERAL.button('Manage')).exists();
+    });
+  });
+
+  test('it updates the namespace list after clicking "Refresh list"', async function (assert) {
+    await render(hbs`<NamespacePicker />`);
+    await click(GENERAL.button('namespace-picker'));
+
+    // Verify initial namespaces are displayed
+    assert.dom(GENERAL.button('parent1')).exists('Namespace "parent1" is displayed');
+    assert.dom(GENERAL.button('parent1/child1')).exists('Namespace "parent1/child1" is displayed');
+    assert.dom(GENERAL.button('root')).exists('Namespace "root" is displayed');
+    assert
+      .dom(GENERAL.button('new-namespace'))
+      .doesNotExist('Namespace "new-namespace" is not displayed initially');
+
+    // Re-stub request from beforeEach hook with a new namespace
+    this.server.get('/sys/internal/ui/namespaces', () => {
+      return {
+        data: { keys: ['parent1/', 'parent1/child1/', 'new-namespace/'] },
+      };
+    });
+    // Click the "Refresh list" button
+    await click(GENERAL.button('Refresh list'));
+
+    // Verify the new namespace is displayed
+    assert
+      .dom(GENERAL.button('new-namespace'))
+      .exists('Namespace "new-namespace" is displayed after refreshing');
+  });
+
+  test("it should display the user's root namespace if it is not true root (an empty string)", async function (assert) {
+    this.authStub.value({ userRootNamespace: 'admin' }); // User's root namespace is "admin"
+    this.nsService.path = 'admin'; // User is current in the "admin" namespace
+    // The user also has access to a child namespace. This additional setup is important because as a fallback
+    // the current namespace is displayed in the dropdown if nothing is returned from this endpoint.
+    this.server.get('/sys/internal/ui/namespaces', () => {
+      return { data: { keys: ['child1/'] } };
+    });
+    await render(hbs`<NamespacePicker />`);
+    assert
+      .dom(GENERAL.button('namespace-picker'))
+      .hasText('admin', `shows the namespace 'admin' in the toggle component`);
+    await click(GENERAL.button('namespace-picker'));
+    assert.dom(`li ${GENERAL.button()}`).exists({ count: 2 }, 'namespace picker only contains 2 options');
+    assert.dom(GENERAL.button('admin')).exists();
+    assert.dom(GENERAL.button('admin/child1')).exists();
+  });
+
+  test('it selects the correct namespace when matching nodes exist', async function (assert) {
+    // stub response so that two namespaces have matching node names 'child1'
+    this.server.get('/sys/internal/ui/namespaces', () => {
+      return { data: { keys: ['parent1/', 'parent1/child1', 'anotherParent/', 'anotherParent/child1'] } };
+    });
+    await render(hbs`<NamespacePicker />`);
+    assert.dom(GENERAL.button('namespace-picker')).hasText('child1', 'it displays the namespace node');
+    await click(GENERAL.button('namespace-picker'));
+    assert
+      .dom(GENERAL.button(this.nsService.path))
+      .hasAttribute('aria-selected', 'true', 'the current namespace path is selected');
+    assert.dom('[aria-selected="true"]').exists({ count: 1 }, 'only one option is selected');
+    assert.dom(GENERAL.icon('check')).exists({ count: 1 }, 'only one check mark renders');
+  });
+});
diff --git a/ui/tests/integration/components/object-list-input-test.js b/ui/tests/integration/components/object-list-input-test.js
index 20f19f895f1..2cf18f68c51 100644
--- a/ui/tests/integration/components/object-list-input-test.js
+++ b/ui/tests/integration/components/object-list-input-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/oidc-consent-block-test.js b/ui/tests/integration/components/oidc-consent-block-test.js
index 0a294937d80..d4f8c455bda 100644
--- a/ui/tests/integration/components/oidc-consent-block-test.js
+++ b/ui/tests/integration/components/oidc-consent-block-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,6 +8,7 @@ import { setupRenderingTest } from 'ember-qunit';
 import { render, click } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const redirectBase = 'https://hashicorp.com';
 
@@ -27,8 +28,8 @@ module('Integration | Component | oidc-consent-block', function (hooks) {
         'In order to complete the login process, you must consent to Vault sharing your profile, email, address, and phone with the client.',
         'shows the correct copy for consent form'
       );
-    assert.dom('[data-test-edit-form-submit]').hasText('Yes', 'form button has correct submit text');
-    assert.dom('[data-test-cancel-button]').hasText('No', 'form button has correct cancel text');
+    assert.dom(GENERAL.submitButton).hasText('Yes', 'form button has correct submit text');
+    assert.dom(GENERAL.cancelButton).hasText('No', 'form button has correct cancel text');
   });
 
   test('it calls the success callback when user clicks "Yes"', async function (assert) {
@@ -48,7 +49,7 @@ module('Integration | Component | oidc-consent-block', function (hooks) {
         'In order to complete the login process, you must consent to Vault sharing your profile, email, address, and phone with the client.',
         'shows the correct copy for consent form'
       );
-    await click('[data-test-edit-form-submit]');
+    await click(GENERAL.submitButton);
     assert.ok(spy.calledWith(`${redirectBase}/?code=1234`), 'Redirects to correct route');
   });
 
@@ -69,7 +70,7 @@ module('Integration | Component | oidc-consent-block', function (hooks) {
         'In order to complete the login process, you must consent to Vault sharing your profile, email, address, and phone with the client.',
         'shows the correct copy for consent form'
       );
-    await click('[data-test-cancel-button]');
+    await click(GENERAL.cancelButton);
     assert.dom('[data-test-consent-title]').hasText('Consent Not Given', 'Title changes to not given');
     assert.dom('[data-test-consent-form]').doesNotExist('Consent form is hidden');
 
@@ -100,7 +101,7 @@ module('Integration | Component | oidc-consent-block', function (hooks) {
         'In order to complete the login process, you must consent to Vault sharing your profile, email, address, and phone with the client.',
         'shows the correct copy for consent form'
       );
-    await click('[data-test-edit-form-submit]');
+    await click(GENERAL.submitButton);
     assert.ok(
       spy.calledWith(`${redirectBase}/?code=unescaped%3Cstring&state=foo`),
       'Redirects to correct route, with escaped values and without superflous params'
diff --git a/ui/tests/integration/components/oidc/assignment-form-test.js b/ui/tests/integration/components/oidc/assignment-form-test.js
index 16bc99096a9..196fa983c50 100644
--- a/ui/tests/integration/components/oidc/assignment-form-test.js
+++ b/ui/tests/integration/components/oidc/assignment-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,8 +9,8 @@ import { render, fillIn, click, findAll } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import oidcConfigHandlers from 'vault/mirage/handlers/oidc-config';
-import { overrideMirageResponse } from 'vault/tests/helpers/oidc-config';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
 
 module('Integration | Component | oidc/assignment-form', function (hooks) {
   setupRenderingTest(hooks);
@@ -95,8 +95,8 @@ module('Integration | Component | oidc/assignment-form', function (hooks) {
   test('it should use fallback component on create if no permissions for entities or groups', async function (assert) {
     assert.expect(2);
     this.model = this.store.createRecord('oidc/assignment');
-    this.server.get('/identity/entity/id', () => overrideMirageResponse(403));
-    this.server.get('/identity/group/id', () => overrideMirageResponse(403));
+    this.server.get('/identity/entity/id', () => overrideResponse(403));
+    this.server.get('/identity/group/id', () => overrideResponse(403));
 
     await render(hbs`
       <Oidc::AssignmentForm
@@ -123,8 +123,8 @@ module('Integration | Component | oidc/assignment-form', function (hooks) {
       group_ids: ['abcdef-123'],
     });
     this.model = this.store.peekRecord('oidc/assignment', 'test');
-    this.server.get('/identity/entity/id', () => overrideMirageResponse(403));
-    this.server.get('/identity/group/id', () => overrideMirageResponse(403));
+    this.server.get('/identity/entity/id', () => overrideResponse(403));
+    this.server.get('/identity/group/id', () => overrideResponse(403));
 
     await render(hbs`
     <Oidc::AssignmentForm
diff --git a/ui/tests/integration/components/oidc/client-form-test.js b/ui/tests/integration/components/oidc/client-form-test.js
index fa5f5992e21..b689f242a56 100644
--- a/ui/tests/integration/components/oidc/client-form-test.js
+++ b/ui/tests/integration/components/oidc/client-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,13 +12,10 @@ import { clickTrigger } from 'ember-power-select/test-support/helpers';
 import ss from 'vault/tests/pages/components/search-select';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import oidcConfigHandlers from 'vault/mirage/handlers/oidc-config';
-import {
-  OIDC_BASE_URL,
-  SELECTORS,
-  overrideMirageResponse,
-  overrideCapabilities,
-} from 'vault/tests/helpers/oidc-config';
+import { OIDC_BASE_URL, SELECTORS } from 'vault/tests/helpers/oidc-config';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { capabilitiesStub, overrideResponse } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const searchSelect = create(ss);
 
@@ -85,7 +82,7 @@ module('Integration | Component | oidc/client-form', function (hooks) {
         @onSave={{this.onSave}}
       />
     `);
-    await click('[data-test-toggle-group="More options"]');
+    await click(GENERAL.button('More options'));
     assert
       .dom('[data-test-oidc-client-title]')
       .hasText('Create Application', 'Form title renders correct text');
@@ -105,10 +102,12 @@ module('Integration | Component | oidc/client-form', function (hooks) {
 
     const validationErrors = findAll(SELECTORS.inlineAlert);
     assert
-      .dom(validationErrors[0])
+      .dom(GENERAL.validationErrorByAttr('name'))
       .hasText('Name is required. Name cannot contain whitespace.', 'Validation messages are shown for name');
-    assert.dom(validationErrors[1]).hasText('Key is required.', 'Validation message is shown for key');
-    assert.dom(validationErrors[2]).hasText('There are 3 errors with this form.', 'Renders form error count');
+    assert
+      .dom(GENERAL.validationErrorByAttr('key'))
+      .hasText('Key is required.', 'Validation message is shown for key');
+    assert.dom(validationErrors[1]).hasText('There are 3 errors with this form.', 'Renders form error count');
 
     // fill out form with valid inputs
     await clickTrigger();
@@ -150,16 +149,18 @@ module('Integration | Component | oidc/client-form', function (hooks) {
         @onSave={{this.onSave}}
       />
     `);
-    await click('[data-test-toggle-group="More options"]');
+    await click(GENERAL.button('More options'));
     assert.dom('[data-test-oidc-client-title]').hasText('Edit Application', 'Title renders correct text');
     assert.dom(SELECTORS.clientSaveButton).hasText('Update', 'Save button has correct text');
     assert.dom('[data-test-input="name"]').isDisabled('Name input is disabled when editing');
     assert.dom('[data-test-input="name"]').hasValue('test-app', 'Name input is populated with model value');
     assert.dom('[data-test-input="key"]').isDisabled('Signing key input is disabled');
     assert.dom('[data-test-input="key"]').hasValue('default', 'Key input populated with default');
-    assert.dom('[data-test-input="clientType"] input').isDisabled('client type input is disabled on edit');
     assert
-      .dom('[data-test-input="clientType"] input#confidential')
+      .dom('[data-test-input-group="clientType"] input')
+      .isDisabled('client type input is disabled on edit');
+    assert
+      .dom('[data-test-input-group="clientType"] input#confidential')
       .isChecked('Correct radio button is selected');
     assert.dom('[data-test-oidc-radio="allow-all"] input').isChecked('Allow all radio button is selected');
     await click(SELECTORS.clientSaveButton);
@@ -227,7 +228,7 @@ module('Integration | Component | oidc/client-form', function (hooks) {
   test('it should render fallback for search select', async function (assert) {
     assert.expect(1);
     this.model = this.store.createRecord('oidc/client');
-    this.server.get('/identity/oidc/assignment', () => overrideMirageResponse(403));
+    this.server.get('/identity/oidc/assignment', () => overrideResponse(403));
     await render(hbs`
       <Oidc::ClientForm
         @model={{this.model}}
@@ -245,7 +246,7 @@ module('Integration | Component | oidc/client-form', function (hooks) {
   test('it should render error alerts when API returns an error', async function (assert) {
     assert.expect(2);
     this.model = this.store.createRecord('oidc/client');
-    this.server.post('/sys/capabilities-self', () => overrideCapabilities(OIDC_BASE_URL + '/clients'));
+    this.server.post('/sys/capabilities-self', () => capabilitiesStub(OIDC_BASE_URL + '/clients'));
     await render(hbs`
       <Oidc::ClientForm
         @model={{this.model}}
diff --git a/ui/tests/integration/components/oidc/client-list-test.js b/ui/tests/integration/components/oidc/client-list-test.js
index e6506316489..3f06a7e9f86 100644
--- a/ui/tests/integration/components/oidc/client-list-test.js
+++ b/ui/tests/integration/components/oidc/client-list-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,8 +8,8 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { overrideCapabilities } from 'vault/tests/helpers/oidc-config';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { allowAllCapabilitiesStub, capabilitiesStub } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | oidc/client-list', function (hooks) {
   setupRenderingTest(hooks);
@@ -39,15 +39,15 @@ module('Integration | Component | oidc/client-list', function (hooks) {
     this.server.post('/sys/capabilities-self', (schema, req) => {
       const { paths } = JSON.parse(req.requestBody);
       if (paths[0] === 'identity/oidc/client/first-client') {
-        return overrideCapabilities('identity/oidc/client/first-client', ['read']);
+        return capabilitiesStub('identity/oidc/client/first-client', ['read']);
       } else {
-        return overrideCapabilities('identity/oidc/client/second-client', ['deny']);
+        return capabilitiesStub('identity/oidc/client/second-client', ['deny']);
       }
     });
     await render(hbs`<Oidc::ClientList @model={{this.model}} />`);
 
     assert.dom('[data-test-popup-menu-trigger]').exists({ count: 1 }, 'Only one popup menu is rendered');
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     assert.dom('[data-test-oidc-client-menu-link="details"]').exists('Details link is rendered');
     assert.dom('[data-test-oidc-client-menu-link="edit"]').doesNotExist('Edit link is not rendered');
   });
diff --git a/ui/tests/integration/components/oidc/key-form-test.js b/ui/tests/integration/components/oidc/key-form-test.js
index a77e6915a0c..e7392fa3c73 100644
--- a/ui/tests/integration/components/oidc/key-form-test.js
+++ b/ui/tests/integration/components/oidc/key-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,14 +9,10 @@ import { render, fillIn, click, findAll } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import oidcConfigHandlers from 'vault/mirage/handlers/oidc-config';
-import {
-  OIDC_BASE_URL,
-  CLIENT_LIST_RESPONSE,
-  SELECTORS,
-  overrideMirageResponse,
-  overrideCapabilities,
-} from 'vault/tests/helpers/oidc-config';
+import { OIDC_BASE_URL, CLIENT_LIST_RESPONSE, SELECTORS } from 'vault/tests/helpers/oidc-config';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { capabilitiesStub, overrideResponse } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | oidc/key-form', function (hooks) {
   setupRenderingTest(hooks);
@@ -25,7 +21,7 @@ module('Integration | Component | oidc/key-form', function (hooks) {
   hooks.beforeEach(function () {
     oidcConfigHandlers(this.server);
     this.store = this.owner.lookup('service:store');
-    this.server.get('/identity/oidc/client', () => overrideMirageResponse(null, CLIENT_LIST_RESPONSE));
+    this.server.get('/identity/oidc/client', () => overrideResponse(null, { data: CLIENT_LIST_RESPONSE }));
     setRunOptions({
       rules: {
         // TODO: fix RadioCard component (replace with HDS)
@@ -39,7 +35,7 @@ module('Integration | Component | oidc/key-form', function (hooks) {
   });
 
   test('it should save new key', async function (assert) {
-    assert.expect(9);
+    assert.expect(8);
     this.server.post('/identity/oidc/key/test-key', (schema, req) => {
       assert.ok(true, 'Request made to save key');
       return JSON.parse(req.requestBody);
@@ -54,7 +50,6 @@ module('Integration | Component | oidc/key-form', function (hooks) {
     />
     `);
 
-    assert.dom('[data-test-oidc-key-title]').hasText('Create Key', 'Form title renders correct text');
     assert.dom(SELECTORS.keySaveButton).hasText('Create', 'Save button has correct text');
     assert.dom('[data-test-input="algorithm"]').hasValue('RS256', 'default algorithm is correct');
     assert.strictEqual(findAll('[data-test-field]').length, 4, 'renders all input fields');
@@ -63,11 +58,12 @@ module('Integration | Component | oidc/key-form', function (hooks) {
     await fillIn('[data-test-input="name"]', ' ');
     await click(SELECTORS.keySaveButton);
 
-    const validationErrors = findAll(SELECTORS.inlineAlert);
     assert
-      .dom(validationErrors[0])
+      .dom(GENERAL.validationErrorByAttr('name'))
       .hasText('Name is required. Name cannot contain whitespace.', 'Validation messages are shown for name');
-    assert.dom(validationErrors[1]).hasText('There are 2 errors with this form.', 'Renders form error count');
+    assert
+      .dom(SELECTORS.inlineAlert)
+      .hasText('There are 2 errors with this form.', 'Renders form error count');
 
     assert.dom('[data-test-oidc-radio="limited"] input').isDisabled('limit radio button disabled on create');
     await fillIn('[data-test-input="name"]', 'test-key');
@@ -75,7 +71,7 @@ module('Integration | Component | oidc/key-form', function (hooks) {
   });
 
   test('it should update key and limit access to selected applications', async function (assert) {
-    assert.expect(12);
+    assert.expect(11);
 
     this.server.post('/identity/oidc/key/test-key', (schema, req) => {
       assert.ok(true, 'Request made to update key');
@@ -99,7 +95,6 @@ module('Integration | Component | oidc/key-form', function (hooks) {
       />
     `);
 
-    assert.dom('[data-test-oidc-key-title]').hasText('Edit Key', 'Title renders correct text');
     assert.dom(SELECTORS.keySaveButton).hasText('Update', 'Save button has correct text');
     assert.dom('[data-test-input="name"]').isDisabled('Name input is disabled when editing');
     assert.dom('[data-test-input="name"]').hasValue('test-key', 'Name input is populated with model value');
@@ -177,7 +172,7 @@ module('Integration | Component | oidc/key-form', function (hooks) {
 
     this.model = this.store.peekRecord('oidc/key', 'test-key');
 
-    this.server.get('/identity/oidc/client', () => overrideMirageResponse(403));
+    this.server.get('/identity/oidc/client', () => overrideResponse(403));
     await render(hbs`
       <Oidc::KeyForm
         @model={{this.model}}
@@ -195,7 +190,7 @@ module('Integration | Component | oidc/key-form', function (hooks) {
   test('it should render error alerts when API returns an error', async function (assert) {
     assert.expect(2);
     this.model = this.store.createRecord('oidc/key');
-    this.server.post('/sys/capabilities-self', () => overrideCapabilities(OIDC_BASE_URL + '/keys'));
+    this.server.post('/sys/capabilities-self', () => capabilitiesStub(OIDC_BASE_URL + '/keys'));
     await render(hbs`
       <Oidc::KeyForm
         @model={{this.model}}
diff --git a/ui/tests/integration/components/oidc/provider-form-test.js b/ui/tests/integration/components/oidc/provider-form-test.js
index 801a76a4bdb..14b4f55e770 100644
--- a/ui/tests/integration/components/oidc/provider-form-test.js
+++ b/ui/tests/integration/components/oidc/provider-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,15 +9,11 @@ import { render, fillIn, click, findAll } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import oidcConfigHandlers from 'vault/mirage/handlers/oidc-config';
-import {
-  SELECTORS,
-  OIDC_BASE_URL,
-  CLIENT_LIST_RESPONSE,
-  overrideMirageResponse,
-  overrideCapabilities,
-} from 'vault/tests/helpers/oidc-config';
+import { SELECTORS, OIDC_BASE_URL, CLIENT_LIST_RESPONSE } from 'vault/tests/helpers/oidc-config';
 import parseURL from 'core/utils/parse-url';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { capabilitiesStub, overrideResponse } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const ISSUER_URL = 'http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider';
 
@@ -42,7 +38,7 @@ module('Integration | Component | oidc/provider-form', function (hooks) {
         auth: null,
       };
     });
-    this.server.get('/identity/oidc/client', () => overrideMirageResponse(null, CLIENT_LIST_RESPONSE));
+    this.server.get('/identity/oidc/client', () => overrideResponse(null, { data: CLIENT_LIST_RESPONSE }));
     setRunOptions({
       rules: {
         // TODO: Fix SearchSelect component
@@ -86,11 +82,12 @@ module('Integration | Component | oidc/provider-form', function (hooks) {
     await fillIn('[data-test-input="name"]', ' ');
     await click(SELECTORS.providerSaveButton);
 
-    const validationErrors = findAll(SELECTORS.inlineAlert);
     assert
-      .dom(validationErrors[0])
+      .dom(GENERAL.validationErrorByAttr('name'))
       .hasText('Name is required. Name cannot contain whitespace.', 'Validation messages are shown for name');
-    assert.dom(validationErrors[1]).hasText('There are 2 errors with this form.', 'Renders form error count');
+    assert
+      .dom(SELECTORS.inlineAlert)
+      .hasText('There are 2 errors with this form.', 'Renders form error count');
 
     await click('[data-test-oidc-radio="limited"]');
     assert
@@ -193,8 +190,8 @@ module('Integration | Component | oidc/provider-form', function (hooks) {
   test('it should render fallback for search select', async function (assert) {
     assert.expect(2);
     this.model = this.store.createRecord('oidc/provider');
-    this.server.get('/identity/oidc/scope', () => overrideMirageResponse(403));
-    this.server.get('/identity/oidc/client', () => overrideMirageResponse(403));
+    this.server.get('/identity/oidc/scope', () => overrideResponse(403));
+    this.server.get('/identity/oidc/client', () => overrideResponse(403));
     await render(hbs`
       <Oidc::ProviderForm
         @model={{this.model}}
@@ -215,7 +212,7 @@ module('Integration | Component | oidc/provider-form', function (hooks) {
   test('it should render error alerts when API returns an error', async function (assert) {
     assert.expect(2);
     this.model = this.store.createRecord('oidc/provider');
-    this.server.post('/sys/capabilities-self', () => overrideCapabilities(OIDC_BASE_URL + '/providers'));
+    this.server.post('/sys/capabilities-self', () => capabilitiesStub(OIDC_BASE_URL + '/providers'));
     await render(hbs`
       <Oidc::ProviderForm
         @model={{this.model}}
diff --git a/ui/tests/integration/components/oidc/provider-list-test.js b/ui/tests/integration/components/oidc/provider-list-test.js
index 6bb194954cb..bd841985978 100644
--- a/ui/tests/integration/components/oidc/provider-list-test.js
+++ b/ui/tests/integration/components/oidc/provider-list-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,8 +8,8 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { overrideCapabilities } from 'vault/tests/helpers/oidc-config';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { allowAllCapabilitiesStub, capabilitiesStub } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | oidc/provider-list', function (hooks) {
   setupRenderingTest(hooks);
@@ -41,14 +41,14 @@ module('Integration | Component | oidc/provider-list', function (hooks) {
     this.server.post('/sys/capabilities-self', (schema, req) => {
       const { paths } = JSON.parse(req.requestBody);
       if (paths[0] === 'identity/oidc/provider/first-provider') {
-        return overrideCapabilities('identity/oidc/provider/first-provider', ['read']);
+        return capabilitiesStub('identity/oidc/provider/first-provider', ['read']);
       } else {
-        return overrideCapabilities('identity/oidc/provider/second-provider', ['deny']);
+        return capabilitiesStub('identity/oidc/provider/second-provider', ['deny']);
       }
     });
     await render(hbs`<Oidc::ProviderList @model={{this.model}} />`);
     assert.dom('[data-test-popup-menu-trigger]').exists({ count: 1 }, 'Only one popup menu is rendered');
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     assert.dom('[data-test-oidc-provider-menu-link="details"]').exists('Details link is rendered');
     assert.dom('[data-test-oidc-provider-menu-link="edit"]').doesNotExist('Edit link is not rendered');
   });
diff --git a/ui/tests/integration/components/oidc/scope-form-test.js b/ui/tests/integration/components/oidc/scope-form-test.js
index 15a5390ea4e..0569b061aa9 100644
--- a/ui/tests/integration/components/oidc/scope-form-test.js
+++ b/ui/tests/integration/components/oidc/scope-form-test.js
@@ -1,15 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, fillIn, click, findAll } from '@ember/test-helpers';
+import { render, fillIn, click } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { SELECTORS, OIDC_BASE_URL, overrideCapabilities } from 'vault/tests/helpers/oidc-config';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { SELECTORS, OIDC_BASE_URL } from 'vault/tests/helpers/oidc-config';
+import { capabilitiesStub } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | oidc/scope-form', function (hooks) {
   setupRenderingTest(hooks);
@@ -17,16 +18,10 @@ module('Integration | Component | oidc/scope-form', function (hooks) {
 
   hooks.beforeEach(function () {
     this.store = this.owner.lookup('service:store');
-    setRunOptions({
-      rules: {
-        // TODO: fix JSONEditor/CodeMirror
-        label: { enabled: false },
-      },
-    });
   });
 
   test('it should save new scope', async function (assert) {
-    assert.expect(9);
+    assert.expect(8);
 
     this.server.post('/identity/oidc/scope/test', (schema, req) => {
       assert.ok(true, 'Request made to save scope');
@@ -51,23 +46,21 @@ module('Integration | Component | oidc/scope-form', function (hooks) {
     // check validation errors
     await click(SELECTORS.scopeSaveButton);
 
-    const validationErrors = findAll(SELECTORS.inlineAlert);
-    assert.dom(validationErrors[0]).hasText('Name is required.', 'Validation messages are shown for name');
-    assert.dom(validationErrors[1]).hasText('There is an error with this form.', 'Renders form error count');
-
     assert
-      .dom('[data-test-inline-error-message]')
-      .hasText('Name is required.', 'Validation message is shown for name');
+      .dom(GENERAL.validationErrorByAttr('name'))
+      .hasText('Name is required.', 'Validation messages are shown for name');
+    assert
+      .dom(SELECTORS.inlineAlert)
+      .hasText('There is an error with this form.', 'Renders form error count');
+
     // json editor has test coverage so let's just confirm that it renders
     assert
-      .dom('[data-test-input="template"] [data-test-component="json-editor-toolbar"]')
+      .dom(`${GENERAL.inputByAttr('template')} .hds-code-editor__header`)
       .exists('JsonEditor toolbar renders');
-    assert
-      .dom('[data-test-input="template"] [data-test-component="code-mirror-modifier"]')
-      .exists('Code mirror renders');
+    assert.dom(`${GENERAL.inputByAttr('template')} ${GENERAL.codemirror}`).exists('Code mirror renders');
 
-    await fillIn('[data-test-input="name"]', 'test');
-    await fillIn('[data-test-input="description"]', 'this is a test');
+    await fillIn(GENERAL.inputByAttr('name'), 'test');
+    await fillIn(GENERAL.inputByAttr('description'), 'this is a test');
     await click(SELECTORS.scopeSaveButton);
   });
 
@@ -97,20 +90,20 @@ module('Integration | Component | oidc/scope-form', function (hooks) {
 
     assert.dom('[data-test-oidc-scope-title]').hasText('Edit Scope', 'Form title renders');
     assert.dom(SELECTORS.scopeSaveButton).hasText('Update', 'Save button has correct label');
-    assert.dom('[data-test-input="name"]').isDisabled('Name input is disabled when editing');
-    assert.dom('[data-test-input="name"]').hasValue('test', 'Name input is populated with model value');
+    assert.dom(GENERAL.inputByAttr('name')).isDisabled('Name input is disabled when editing');
+    assert.dom(GENERAL.inputByAttr('name')).hasValue('test', 'Name input is populated with model value');
     assert
-      .dom('[data-test-input="description"]')
+      .dom(GENERAL.inputByAttr('description'))
       .hasValue('this is a test', 'Description input is populated with model value');
     // json editor has test coverage so let's just confirm that it renders
     assert
-      .dom('[data-test-input="template"] [data-test-component="json-editor-toolbar"]')
+      .dom(`${GENERAL.inputByAttr('template')} .hds-code-editor__header`)
       .exists('JsonEditor toolbar renders');
     assert
-      .dom('[data-test-input="template"] [data-test-component="code-mirror-modifier"]')
+      .dom(`${GENERAL.inputByAttr('template')} [data-test-component="code-mirror-modifier"]`)
       .exists('Code mirror renders');
 
-    await fillIn('[data-test-input="description"]', 'this is an edit test');
+    await fillIn(GENERAL.inputByAttr('description'), 'this is an edit test');
     await click(SELECTORS.scopeSaveButton);
   });
 
@@ -147,7 +140,7 @@ module('Integration | Component | oidc/scope-form', function (hooks) {
     />
       `);
 
-    await fillIn('[data-test-input="description"]', 'changed description attribute');
+    await fillIn(GENERAL.inputByAttr('description'), 'changed description attribute');
     await click(SELECTORS.scopeCancelButton);
     assert.strictEqual(
       this.model.description,
@@ -161,16 +154,6 @@ module('Integration | Component | oidc/scope-form', function (hooks) {
     const MODAL = (e) => `[data-test-scope-modal="${e}"]`;
     this.model = this.store.createRecord('oidc/scope');
 
-    // formatting here is purposeful so that it matches formatting in the template modal
-    const exampleTemplate = `{
-  "username": {{identity.entity.aliases.$MOUNT_ACCESSOR.name}},
-  "contact": {
-    "email": {{identity.entity.metadata.email}},
-    "phone_number": {{identity.entity.metadata.phone_number}}
-  },
-  "groups": {{identity.entity.groups.names}}
-}`;
-
     await render(hbs`
       <Oidc::ScopeForm
         @model={{this.model}}
@@ -182,14 +165,8 @@ module('Integration | Component | oidc/scope-form', function (hooks) {
     await click('[data-test-oidc-scope-example]');
     assert.dom(MODAL('title')).hasText('Scope template', 'Modal title renders');
     assert.dom(MODAL('text')).hasText('Example of a JSON template for scopes:', 'Modal text renders');
-    assert
-      .dom('#scope-template-modal [data-test-copy-button]')
-      .hasAttribute(
-        'data-test-copy-button',
-        exampleTemplate,
-        'Modal copy button copies the example template'
-      );
-    assert.dom('.cm-string').hasText('"username"', 'Example template json renders');
+    assert.dom('#scope-template-modal .hds-icon-clipboard-copy').exists('Modal copy button exists');
+    assert.dom('.token .string').hasText('"username"', 'Example template json renders');
     await click('[data-test-close-modal]');
     assert.dom('.hds#scope-template-modal').doesNotExist('Modal is hidden');
   });
@@ -197,7 +174,7 @@ module('Integration | Component | oidc/scope-form', function (hooks) {
   test('it should render error alerts when API returns an error', async function (assert) {
     assert.expect(2);
     this.model = this.store.createRecord('oidc/scope');
-    this.server.post('/sys/capabilities-self', () => overrideCapabilities(OIDC_BASE_URL + '/scopes'));
+    this.server.post('/sys/capabilities-self', () => capabilitiesStub(OIDC_BASE_URL + '/scopes'));
     await render(hbs`
       <Oidc::ScopeForm
         @model={{this.model}}
@@ -205,11 +182,11 @@ module('Integration | Component | oidc/scope-form', function (hooks) {
         @onSave={{this.onSave}}
       />
     `);
-    await fillIn('[data-test-input="name"]', 'test-scope');
+    await fillIn(GENERAL.inputByAttr('name'), 'test-scope');
     await click(SELECTORS.scopeSaveButton);
     assert
-      .dom(SELECTORS.inlineAlert)
+      .dom(GENERAL.inlineAlert)
       .hasText('There was an error submitting this form.', 'form error alert renders ');
-    assert.dom('[data-test-message-error]').exists('alert banner renders');
+    assert.dom(GENERAL.messageError).exists('alert banner renders');
   });
 });
diff --git a/ui/tests/integration/components/okta-number-challenge-test.js b/ui/tests/integration/components/okta-number-challenge-test.js
index d1871dd5b5b..dc9c08d00e2 100644
--- a/ui/tests/integration/components/okta-number-challenge-test.js
+++ b/ui/tests/integration/components/okta-number-challenge-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,32 +7,41 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render, click } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
+import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
-module('Integration | Component | okta-number-challenge', function (hooks) {
+module('Integration | Component | auth | okta-number-challenge', function (hooks) {
   setupRenderingTest(hooks);
 
   hooks.beforeEach(function () {
     this.oktaNumberChallengeAnswer = null;
     this.hasError = false;
+    this.onCancel = sinon.spy();
+    this.renderComponent = async () => {
+      return render(hbs`
+  <OktaNumberChallenge
+    @correctAnswer={{this.oktaNumberChallengeAnswer}}
+    @hasError={{this.hasError}}
+    @onReturnToLogin={{this.onCancel}}
+  />
+  `);
+    };
   });
 
   test('it should render correct descriptions', async function (assert) {
-    await render(hbs`<OktaNumberChallenge @correctAnswer={{this.oktaNumberChallengeAnswer}}/>`);
-
+    await this.renderComponent();
     assert
       .dom('[data-test-okta-number-challenge-description]')
       .includesText(
         'To finish signing in, you will need to complete an additional MFA step.',
         'Correct description renders'
       );
-    assert
-      .dom('[data-test-okta-number-challenge-loading]')
-      .includesText('Please wait...', 'Correct loading description renders');
+    assert.dom('[data-test-loading]').includesText('Please wait...', 'Correct loading description renders');
   });
 
   test('it should show correct number for okta number challenge', async function (assert) {
-    this.set('oktaNumberChallengeAnswer', 1);
-    await render(hbs`<OktaNumberChallenge @correctAnswer={{this.oktaNumberChallengeAnswer}}/>`);
+    this.oktaNumberChallengeAnswer = 1;
+    await this.renderComponent();
     assert
       .dom('[data-test-okta-number-challenge-description]')
       .includesText(
@@ -40,35 +49,30 @@ module('Integration | Component | okta-number-challenge', function (hooks) {
         'Correct description renders'
       );
     assert
-      .dom('[data-test-okta-number-challenge-verification-type]')
+      .dom('[data-test-verification-type]')
       .includesText('Okta verification', 'Correct verification type renders');
 
     assert
-      .dom('[data-test-okta-number-challenge-verification-description]')
+      .dom('[data-test-description]')
       .includesText(
         'Select the following number to complete verification:',
         'Correct verification description renders'
       );
-    assert
-      .dom('[data-test-okta-number-challenge-answer]')
-      .includesText('1', 'Correct okta number challenge answer renders');
+    assert.dom('[data-test-answer]').includesText('1', 'Correct okta number challenge answer renders');
   });
 
   test('it should show error screen', async function (assert) {
-    this.set('hasError', true);
-    await render(
-      hbs`<OktaNumberChallenge @correctAnswer={{this.oktaNumberChallengeAnswer}} @hasError={{this.hasError}} @onReturnToLogin={{fn (mut this.returnToLogin) true}}/>`
-    );
+    this.hasError = 'Authentication failed: multi-factor authentication denied';
+    await this.renderComponent();
+
     assert
       .dom('[data-test-okta-number-challenge-description]')
-      .includesText(
+      .hasTextContaining(
         'To finish signing in, you will need to complete an additional MFA step.',
         'Correct description renders'
       );
-    assert
-      .dom('[data-test-message-error]')
-      .includesText('There was a problem', 'Displays error that there was a problem');
-    await click('[data-test-return-from-okta-number-challenge]');
-    assert.true(this.returnToLogin, 'onReturnToLogin was triggered');
+    assert.dom('[data-test-message-error]').hasText(`Error ${this.hasError}`);
+    await click(GENERAL.backButton);
+    assert.true(this.onCancel.calledOnce, 'onCancel is called');
   });
 });
diff --git a/ui/tests/integration/components/open-api-explorer/swagger-ui-test.js b/ui/tests/integration/components/open-api-explorer/swagger-ui-test.js
index a78cdc3a6e3..29c268c756e 100644
--- a/ui/tests/integration/components/open-api-explorer/swagger-ui-test.js
+++ b/ui/tests/integration/components/open-api-explorer/swagger-ui-test.js
@@ -1,38 +1,157 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
-import { waitUntil, find } from '@ember/test-helpers';
+import { click, render, waitFor, waitUntil } from '@ember/test-helpers';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
+import sinon from 'sinon';
+import config from 'vault/config/environment';
+import { camelize } from '@ember/string';
+
+const SELECTORS = {
+  container: '[data-test-swagger-ui]',
+  searchInput: 'input.operation-filter-input',
+  apiPathBlock: '.opblock',
+  operationId: '.opblock-summary-operation-id',
+  controlArrowButton: '.opblock-control-arrow',
+  copyButton: '.copy-to-clipboard',
+  tryItOutButton: '.try-out button',
+};
+
+// for some reason search filtering does not update with ember test helpers
+// possibly due to swagger-ui event implementation
+// using native window fn to workaround
+const setNativeInputValue = (value) => {
+  const input = document.querySelector(SELECTORS.searchInput);
+  const nativeInputValueSetter = Object.getOwnPropertyDescriptor(
+    window.HTMLInputElement.prototype,
+    'value'
+  ).set;
+  nativeInputValueSetter.call(input, value);
+  input.dispatchEvent(new Event('input', { bubbles: true }));
+};
 
 module('Integration | Component | open-api-explorer | swagger-ui', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'open-api-explorer');
   setupMirage(hooks);
+
   hooks.beforeEach(function () {
     this.store = this.owner.lookup('service:store');
+
+    this.openApiResponse = this.server.create('open-api-explorer');
+    this.server.get('sys/internal/specs/openapi', () => {
+      return this.openApiResponse;
+    });
+
+    this.totalApiPaths = Object.keys(this.openApiResponse.paths).length;
+
+    this.renderComponent = () => render(hbs`<SwaggerUi/>`, { owner: this.engine });
   });
 
   test('it renders', async function (assert) {
-    assert.expect(2);
-    const openApiResponse = this.server.create('open-api-explorer');
-    this.server.get('sys/internal/specs/openapi', () => {
-      return openApiResponse;
+    await this.renderComponent();
+
+    assert.dom(SELECTORS.container).exists('renders component');
+    assert.dom(SELECTORS.apiPathBlock).exists({ count: this.totalApiPaths }, 'renders all api paths');
+  });
+
+  test('it can search', async function (assert) {
+    await this.renderComponent();
+
+    setNativeInputValue('token');
+    assert.dom(SELECTORS.searchInput).hasValue('token', 'search input has value');
+    assert.dom(SELECTORS.apiPathBlock).exists({ count: 2 }, 'renders filtered api paths');
+  });
+
+  test('it should render camelized operation ids', async function (assert) {
+    const envStub = sinon.stub(config, 'environment').value('development');
+
+    await this.renderComponent();
+
+    const id = this.openApiResponse.paths['/auth/token/create'].post.operationId;
+    assert.dom(SELECTORS.operationId).hasText(camelize(id), 'renders camelized operation id');
+
+    envStub.restore();
+  });
+
+  test('it should not render operation ids in production', async function (assert) {
+    const envStub = sinon.stub(config, 'environment').value('production');
+
+    await this.renderComponent();
+
+    assert.dom(SELECTORS.operationId).doesNotExist('operation ids are hidden in production environment');
+
+    envStub.restore();
+  });
+
+  test('it contains a11y fixes', async function (assert) {
+    const envStub = sinon.stub(config, 'environment').value('development');
+
+    await this.renderComponent();
+
+    await waitUntil(() => {
+      return document.querySelector(SELECTORS.controlArrowButton).getAttribute('tabindex') === '0';
+    });
+    assert.dom(SELECTORS.controlArrowButton).hasAttribute('tabindex', '0');
+
+    await waitUntil(() => {
+      return document.querySelector(SELECTORS.copyButton).getAttribute('tabindex') === '0';
+    });
+    assert.dom(SELECTORS.copyButton).hasAttribute('tabindex', '0');
+
+    const controlArrowButton = document.querySelectorAll(SELECTORS.controlArrowButton)[1];
+    await click(controlArrowButton);
+    await waitFor(SELECTORS.tryItOutButton);
+
+    const input = document.querySelector('.parameters input:read-only');
+    assert.dom(input).exists('parameter input is readonly');
+
+    assert
+      .dom(SELECTORS.tryItOutButton)
+      .hasAttribute(
+        'aria-description',
+        'Caution: This will make requests to the Vault server on your behalf which may create or delete items.'
+      );
+
+    envStub.restore();
+  });
+
+  test('it retains a11y fixes after filtering', async function (assert) {
+    const envStub = sinon.stub(config, 'environment').value('development');
+
+    await this.renderComponent();
+
+    setNativeInputValue('token');
+
+    await waitUntil(() => {
+      return document.querySelector(SELECTORS.controlArrowButton).getAttribute('tabindex') === '0';
     });
+    assert.dom(SELECTORS.controlArrowButton).hasAttribute('tabindex', '0');
 
-    await render(hbs`<SwaggerUi/>`, {
-      owner: this.engine,
+    await waitUntil(() => {
+      return document.querySelector(SELECTORS.copyButton).getAttribute('tabindex') === '0';
     });
+    assert.dom(SELECTORS.copyButton).hasAttribute('tabindex', '0');
+
+    const controlArrowButton = document.querySelectorAll(SELECTORS.controlArrowButton)[1];
+    await click(controlArrowButton);
+    await waitFor(SELECTORS.tryItOutButton);
+
+    const input = document.querySelector('.parameters input:read-only');
+    assert.dom(input).exists('parameter input is readonly');
+    assert
+      .dom(SELECTORS.tryItOutButton)
+      .hasAttribute(
+        'aria-description',
+        'Caution: This will make requests to the Vault server on your behalf which may create or delete items.'
+      );
 
-    await waitUntil(() => find('[data-test-swagger-ui]'));
-    assert.dom('[data-test-swagger-ui]').exists('renders component');
-    await waitUntil(() => find('.operation-filter-input'));
-    assert.dom('.opblock-post').exists({ count: 2 }, 'renders two blocks');
+    envStub.restore();
   });
 });
diff --git a/ui/tests/integration/components/overview-card-test.js b/ui/tests/integration/components/overview-card-test.js
index 2d2b9e8f8a4..70b93c1e5c2 100644
--- a/ui/tests/integration/components/overview-card-test.js
+++ b/ui/tests/integration/components/overview-card-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,12 +13,14 @@ const ACTION_TEXT = 'View card';
 const SUBTEXT = 'This is subtext for card';
 
 const SELECTORS = {
+  container: '[data-test-overview-card-container]',
   title: '[data-test-overview-card-title]',
   subtitle: '[data-test-overview-card-subtitle]',
   action: '[data-test-action-text]',
+  customSubtext: '[data-test-custom-subtext]',
 };
 
-module('Integration | Component overview-card', function (hooks) {
+module('Integration | Component | overview-card', function (hooks) {
   setupRenderingTest(hooks);
 
   hooks.beforeEach(function () {
@@ -27,18 +29,51 @@ module('Integration | Component overview-card', function (hooks) {
     this.set('subText', SUBTEXT);
   });
 
-  test('it returns card title, ', async function (assert) {
+  test('it returns card title', async function (assert) {
     await render(hbs`<OverviewCard @cardTitle={{this.cardTitle}}/>`);
     assert.dom(SELECTORS.title).hasText('Card title');
   });
-  test('it returns card subtext, ', async function (assert) {
+  test('it returns custom title if both exist', async function (assert) {
+    await render(hbs`
+      <OverviewCard @cardTitle={{this.cardTitle}}>
+        <:customTitle>
+          Fancy custom title
+        </:customTitle>
+      </OverviewCard>
+      `);
+    assert.dom(SELECTORS.container).hasText('Fancy custom title');
+    assert.dom(SELECTORS.container).doesNotIncludeText(this.cardTitle);
+  });
+  test('it renders card @subText arg, ', async function (assert) {
     await render(hbs`<OverviewCard @cardTitle={{this.cardTitle}}  @subText={{this.subText}} />`);
     assert.dom(SELECTORS.subtitle).hasText('This is subtext for card');
   });
-  test('it returns card action text', async function (assert) {
+  test('it renders card action text', async function (assert) {
     await render(
-      hbs`<OverviewCard @cardTitle={{this.cardTitle}} @actionText={{this.actionText}} @actionTo="route"/>`
+      hbs`
+      <OverviewCard @cardTitle={{this.cardTitle}}>
+        <:action>
+        <div data-test-action-text>
+        {{this.actionText}}
+        </div>
+        </:action>
+      </OverviewCard>
+      `
     );
     assert.dom(SELECTORS.action).hasText('View card');
   });
+  test('it renders custom subtext text', async function (assert) {
+    await render(
+      hbs`
+      <OverviewCard @cardTitle={{this.cardTitle}}>
+        <:customSubtext>
+          <div data-test-custom-subtext>
+            Fancy yielded subtext
+          </div>
+        </:customSubtext>
+      </OverviewCard>
+      `
+    );
+    assert.dom(SELECTORS.customSubtext).hasText('Fancy yielded subtext');
+  });
 });
diff --git a/ui/tests/integration/components/page/breadcrumbs-test.js b/ui/tests/integration/components/page/breadcrumbs-test.js
index 1e30db15954..05ffc36c389 100644
--- a/ui/tests/integration/components/page/breadcrumbs-test.js
+++ b/ui/tests/integration/components/page/breadcrumbs-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/page/error-test.js b/ui/tests/integration/components/page/error-test.js
index 01ecec348e5..147c62e90a6 100644
--- a/ui/tests/integration/components/page/error-test.js
+++ b/ui/tests/integration/components/page/error-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,8 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
+import { getErrorResponse } from 'vault/tests/helpers/api/error-response';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | page/error', function (hooks) {
   setupRenderingTest(hooks);
@@ -55,4 +57,29 @@ module('Integration | Component | page/error', function (hooks) {
         .hasText(this.error.errors[index], 'Error detail renders');
     });
   });
+
+  test('it should handle api client errors', async function (assert) {
+    this.error = getErrorResponse();
+
+    await render(hbs`<Page::Error @error={{this.error}} />`);
+
+    assert
+      .dom(GENERAL.pageError.errorTitle('404'))
+      .hasText('404 Not Found', 'Error title renders based on status');
+    assert
+      .dom(GENERAL.pageError.errorSubtitle)
+      .hasText(
+        'Sorry, we were unable to find any content at /v1/test/error/parsing.',
+        'Error subtitle renders'
+      );
+
+    const error = { errors: ['something bad happened'], message: 'bad things occurred' };
+    this.error = getErrorResponse(error, 400);
+
+    await render(hbs`<Page::Error @error={{this.error}} />`);
+
+    assert.dom(GENERAL.pageError.errorTitle('400')).hasText('Error', 'Error title renders');
+    assert.dom(GENERAL.pageError.errorMessage).hasText(error.message, 'Error message renders');
+    assert.dom(GENERAL.pageError.errorDetails).hasText(error.errors[0], 'Error details render');
+  });
 });
diff --git a/ui/tests/integration/components/page/header-test.js b/ui/tests/integration/components/page/header-test.js
new file mode 100644
index 00000000000..30c87702078
--- /dev/null
+++ b/ui/tests/integration/components/page/header-test.js
@@ -0,0 +1,42 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | page/header', function (hooks) {
+  setupRenderingTest(hooks);
+
+  test('it renders', async function (assert) {
+    this.breadcrumbs = [
+      { label: 'Home', route: 'home' },
+      { label: 'Details', route: 'home.details' },
+      { label: 'Edit item' },
+    ];
+
+    await render(
+      hbs`<Page::Header @title="Test title" @subtitle="Test subtitle" @description="Test description" @icon="key" @breadcrumbs={{this.breadcrumbs}}>
+        <:breadcrumbs>
+          <Page::Breadcrumbs @breadcrumbs={{this.breadcrumbs}} />
+        </:breadcrumbs>
+        <:badges>
+          <Hds::Badge @text="Default badge" data-test-badge>Info Badge</Hds::Badge>
+        </:badges>
+        <:actions>
+          <Hds::Button @variant="primary" @text="Manage" data-test-button />
+        </:actions>
+      </Page::Header>`
+    );
+    assert.dom(GENERAL.breadcrumbs).exists('renders passed in breadcrumbs');
+    assert.dom(GENERAL.badge()).exists('renders passed in badges');
+    assert.dom(GENERAL.button()).exists('renders passed in button');
+    assert.dom(GENERAL.hdsPageHeaderTitle).hasText('Test title', 'renders passed in title');
+    assert.dom(GENERAL.hdsPageHeaderDescription).hasText('Test description', 'renders passed in description');
+    assert.dom(GENERAL.hdsPageHeaderSubtitle).hasText('Test subtitle', 'renders passed in subtitle');
+  });
+});
diff --git a/ui/tests/integration/components/page/mode-index-test.js b/ui/tests/integration/components/page/mode-index-test.js
new file mode 100644
index 00000000000..e8c33d8d01f
--- /dev/null
+++ b/ui/tests/integration/components/page/mode-index-test.js
@@ -0,0 +1,116 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupEngine } from 'ember-engines/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+const S = {
+  title: 'h1',
+  subtitle: 'h2',
+  enableForm: '[data-test-replication-enable-form]',
+  summary: '[data-test-replication-summary]',
+  notAllowed: '[data-test-not-allowed]',
+};
+module('Integration | Component | replication page/mode-index', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'replication');
+
+  hooks.beforeEach(function () {
+    this.store = this.owner.lookup('service:store');
+    this.onEnable = () => {};
+    this.clusterModel = { replicationAttrs: {} };
+    this.replicationMode = '';
+    this.replicationDisabled = true;
+
+    this.renderComponent = () => {
+      return render(
+        hbs`<Page::ModeIndex @replicationDisabled={{this.replicationDisabled}} @replicationMode={{this.replicationMode}} @cluster={{this.clusterModel}} @onEnableSuccess={{this.onEnable}} />`,
+        { owner: this.engine }
+      );
+    };
+  });
+
+  module('DR mode', function (hooks) {
+    hooks.beforeEach(function () {
+      this.replicationMode = 'dr';
+    });
+    test('it renders correctly when replication disabled', async function (assert) {
+      await this.renderComponent();
+
+      assert.dom(S.title).hasText('Enable Disaster Recovery Replication');
+      assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).doesNotExist();
+      assert.dom(GENERAL.submitButton).exists('Enable button shows by default if no permissions available');
+    });
+    test('it renders correctly when replication enabled', async function (assert) {
+      this.replicationDisabled = false;
+      await this.renderComponent();
+
+      assert.dom(S.enableForm).doesNotExist();
+      assert.dom(S.summary).exists();
+    });
+
+    test('it hides enable button if no permissions', async function (assert) {
+      this.clusterModel.canEnablePrimaryDr = false;
+      await this.renderComponent();
+
+      assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).exists();
+      assert.dom(GENERAL.submitButton).doesNotExist();
+    });
+
+    test('it shows enable button if has permissions', async function (assert) {
+      this.clusterModel.canEnablePrimaryDr = true;
+      await this.renderComponent();
+
+      assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).doesNotExist();
+      assert.dom(GENERAL.submitButton).exists();
+    });
+  });
+
+  module('Performance mode', function (hooks) {
+    hooks.beforeEach(function () {
+      this.replicationMode = 'performance';
+    });
+    test('it renders correctly when replication disabled', async function (assert) {
+      await this.renderComponent();
+
+      assert.dom(S.title).hasText('Enable Performance Replication');
+      assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).doesNotExist();
+      assert.dom(GENERAL.submitButton).exists('Enable button shows by default if no permissions available');
+    });
+    test('it renders correctly when replication enabled', async function (assert) {
+      this.replicationDisabled = false;
+      await this.renderComponent();
+
+      assert.dom(S.enableForm).doesNotExist();
+      assert.dom(S.summary).exists();
+    });
+
+    test('it hides enable button if no permissions', async function (assert) {
+      this.clusterModel.canEnablePrimaryPerformance = false;
+      await this.renderComponent();
+
+      assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).exists();
+      assert.dom(GENERAL.submitButton).doesNotExist();
+    });
+
+    test('it shows enable button if has permissions', async function (assert) {
+      this.clusterModel.canEnablePrimaryPerformance = true;
+      await this.renderComponent();
+
+      assert.dom(S.enableForm).exists();
+      assert.dom(S.notAllowed).doesNotExist();
+      assert.dom(GENERAL.submitButton).exists();
+    });
+  });
+});
diff --git a/ui/tests/integration/components/page/userpass-reset-password-test.js b/ui/tests/integration/components/page/userpass-reset-password-test.js
index c995e10f7f1..0537b500abf 100644
--- a/ui/tests/integration/components/page/userpass-reset-password-test.js
+++ b/ui/tests/integration/components/page/userpass-reset-password-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,12 +9,12 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { Response } from 'miragejs';
 import { click, fillIn, render, settled } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const S = {
   infoBanner: '[data-test-current-user-banner]',
-  save: '[data-test-reset-password-save]',
   error: '[data-test-reset-password-error]',
-  input: '[data-test-textarea]',
+  input: '[data-test-input="reset-password"]',
 };
 module('Integration | Component | page/userpass-reset-password', function (hooks) {
   setupRenderingTest(hooks);
@@ -43,7 +43,7 @@ module('Integration | Component | page/userpass-reset-password', function (hooks
       );
 
     await fillIn(S.input, 'new');
-    await click(S.save);
+    await click(GENERAL.submitButton);
     // eslint-disable-next-line ember/no-settled-after-test-helper
     await settled();
 
@@ -60,11 +60,11 @@ module('Integration | Component | page/userpass-reset-password', function (hooks
       .dom(S.infoBanner)
       .hasText(`You are updating the password for ${this.username} on the ${this.backend} auth mount.`);
 
-    await click(S.save);
+    await click(GENERAL.submitButton);
     assert.dom(S.error).hasText('Error Please provide a new password.');
 
     await fillIn(S.input, 'invalid-pw');
-    await click(S.save);
+    await click(GENERAL.submitButton);
 
     // eslint-disable-next-line ember/no-settled-after-test-helper
     await settled();
diff --git a/ui/tests/integration/components/path-filter-config-list-test.js b/ui/tests/integration/components/path-filter-config-list-test.js
index 5666fa36a19..04afa029705 100644
--- a/ui/tests/integration/components/path-filter-config-list-test.js
+++ b/ui/tests/integration/components/path-filter-config-list-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,6 @@ import hbs from 'htmlbars-inline-precompile';
 import { setupEngine } from 'ember-engines/test-support';
 import Service from '@ember/service';
 import sinon from 'sinon';
-import { Promise } from 'rsvp';
 import { create } from 'ember-cli-page-object';
 import ss from 'vault/tests/pages/components/search-select';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
@@ -41,7 +40,7 @@ module('Integration | Component | path filter config list', function (hooks) {
 
   hooks.beforeEach(function () {
     this.context = { owner: this.engine }; // this.engine set by setupEngine
-    const ajaxStub = sinon.stub().usingPromise(Promise);
+    const ajaxStub = sinon.stub();
     ajaxStub.withArgs('/v1/sys/internal/ui/mounts', 'GET').resolves(MOUNTS_RESPONSE);
     ajaxStub
       .withArgs('/v1/sys/internal/ui/mounts', 'GET', { namespace: 'ns1' })
@@ -159,6 +158,7 @@ module('Integration | Component | path filter config list', function (hooks) {
     await clickTrigger();
     await searchSelect.deleteButtons.objectAt(1).click();
     await clickTrigger();
+    await typeInSearch('ns1');
     assert.dom('.ember-power-select-group').hasText('Namespaces ns1', 'puts ns back within group');
     await clickTrigger();
   });
diff --git a/ui/tests/integration/components/pgp-file-test.js b/ui/tests/integration/components/pgp-file-test.js
index 769addf7615..ce10f1c18d9 100644
--- a/ui/tests/integration/components/pgp-file-test.js
+++ b/ui/tests/integration/components/pgp-file-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,7 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render, click, fillIn, triggerEvent, waitUntil, find } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 let file;
 const fileEvent = () => {
@@ -87,7 +88,7 @@ module('Integration | Component | pgp file', function (hooks) {
         @onChange={{action this.change}}
       />
     `);
-    await click('[data-test-text-toggle]');
+    await click(GENERAL.textToggle);
     assert.dom('[data-test-pgp-file-textarea]').exists({ count: 1 }, 'renders the textarea on toggle');
 
     fillIn('[data-test-pgp-file-textarea]', text);
@@ -112,7 +113,7 @@ module('Integration | Component | pgp file', function (hooks) {
     `);
     await triggerEvent('[data-test-pgp-file-input]', ...event);
     await waitUntil(() => find('[data-test-pgp-file-input-label]').innerText === 'file.json');
-    await click('[data-test-text-toggle]');
+    await click(GENERAL.textToggle);
     assert.dom('[data-test-pgp-file-textarea]').exists({ count: 1 }, 'renders the textarea on toggle');
     assert
       .dom('[data-test-pgp-file-textarea]')
diff --git a/ui/tests/integration/components/pgp-list-test.js b/ui/tests/integration/components/pgp-list-test.js
index 119e526eee0..b1b1179a869 100644
--- a/ui/tests/integration/components/pgp-list-test.js
+++ b/ui/tests/integration/components/pgp-list-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/pki-paginated-list-test.js b/ui/tests/integration/components/pki-paginated-list-test.js
index 8ad3d1f8a7c..d23e606099d 100644
--- a/ui/tests/integration/components/pki-paginated-list-test.js
+++ b/ui/tests/integration/components/pki-paginated-list-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,7 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { setupEngine } from 'ember-engines/test-support';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { STANDARD_META } from 'vault/tests/helpers/pki';
+import { STANDARD_META } from 'vault/tests/helpers/pagination';
 
 module('Integration | Component | pki-paginated-list', function (hooks) {
   setupRenderingTest(hooks);
@@ -34,8 +34,8 @@ module('Integration | Component | pki-paginated-list', function (hooks) {
         key_name: 'another-key',
       },
     });
-    // toArray to mimic what happens in lazyPaginatedQuery
-    const keyModels = this.store.peekAll('pki/key').toArray();
+    // mimic what happens in lazyPaginatedQuery
+    const keyModels = this.store.peekAll('pki/key');
     keyModels.meta = STANDARD_META;
     this.list = keyModels;
     const emptyList = this.store.peekAll('pki/foo');
@@ -53,7 +53,7 @@ module('Integration | Component | pki-paginated-list', function (hooks) {
     this.set('hasConfig', null);
     await render(
       hbs`
-      <PkiPaginatedList @list={{this.list}} @hasConfig={{this.hasConfig}}>
+      <PkiPaginatedList @backend="pki-mount" @list={{this.list}} @hasConfig={{this.hasConfig}}>
         <:list as |items|>
           {{#each items as |item|}}
             <div data-test-item={{item.keyId}}>{{item.keyName}}</div>
@@ -87,7 +87,7 @@ module('Integration | Component | pki-paginated-list', function (hooks) {
     this.set('hasConfig', true);
     await render(
       hbs`
-      <PkiPaginatedList @list={{this.emptyList}} @hasConfig={{this.hasConfig}}>
+      <PkiPaginatedList @backend="pki-mount" @list={{this.emptyList}} @hasConfig={{this.hasConfig}}>
         <:list>
           List item
         </:list>
@@ -118,7 +118,7 @@ module('Integration | Component | pki-paginated-list', function (hooks) {
     this.set('model', this.list);
     await render(
       hbs`
-      <PkiPaginatedList @list={{this.model}} @hasConfig={{this.hasConfig}}>
+      <PkiPaginatedList @backend="pki-mount" @list={{this.model}} @hasConfig={{this.hasConfig}}>
         <:actions>
           <div data-test-button>Action</div>
         </:actions>
diff --git a/ui/tests/integration/components/pki/page/pki-certificate-details-test.js b/ui/tests/integration/components/pki/page/pki-certificate-details-test.js
index ffa59572273..1b764cc4c4a 100644
--- a/ui/tests/integration/components/pki/page/pki-certificate-details-test.js
+++ b/ui/tests/integration/components/pki/page/pki-certificate-details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import sinon from 'sinon';
 
 module('Integration | Component | pki | Page::PkiCertificateDetails', function (hooks) {
@@ -91,9 +92,9 @@ module('Integration | Component | pki | Page::PkiCertificateDetails', function (
       .dom('[data-test-component="info-table-row"]')
       .exists({ count: 5 }, 'Correct number of fields render when certificate has not been revoked');
     assert
-      .dom('[data-test-value-div="Certificate"] [data-test-certificate-card]')
+      .dom(`${GENERAL.infoRowValue('Certificate')} [data-test-certificate-card]`)
       .exists('Certificate card renders for certificate');
-    assert.dom('[data-test-value-div="Serial number"] code').exists('Serial number renders as monospace');
+    assert.dom(`${GENERAL.infoRowValue('Serial number')} code`).exists('Serial number renders as monospace');
 
     await click('[data-test-pki-cert-download-button]');
     const { serialNumber, certificate } = this.model;
@@ -102,10 +103,10 @@ module('Integration | Component | pki | Page::PkiCertificateDetails', function (
       'Download pem method called with correct args'
     );
 
-    await click('[data-test-confirm-action-trigger]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
 
-    assert.dom('[data-test-value-div="Revocation time"]').exists('Revocation time is displayed');
+    assert.dom(GENERAL.infoRowValue('Revocation time')).exists('Revocation time is displayed');
   });
 
   test('it should render actions and fields for generated cert', async function (assert) {
@@ -132,17 +133,17 @@ module('Integration | Component | pki | Page::PkiCertificateDetails', function (
       .dom('[data-test-component="info-table-row"]')
       .exists({ count: 9 }, 'Correct number of fields render when certificate has not been revoked');
     assert
-      .dom('[data-test-value-div="Certificate"] [data-test-certificate-card]')
+      .dom(`${GENERAL.infoRowValue('Certificate')} [data-test-certificate-card]`)
       .exists('Certificate card renders for certificate');
-    assert.dom('[data-test-value-div="Serial number"] code').exists('Serial number renders as monospace');
+    assert.dom(`${GENERAL.infoRowValue('Serial number')} code`).exists('Serial number renders as monospace');
     assert
-      .dom('[data-test-value-div="CA Chain"] [data-test-certificate-card]')
+      .dom(`${GENERAL.infoRowValue('CA Chain')} [data-test-certificate-card]`)
       .exists('Certificate card renders for CA Chain');
     assert
-      .dom('[data-test-value-div="Issuing CA"] [data-test-certificate-card]')
+      .dom(`${GENERAL.infoRowValue('Issuing CA')} [data-test-certificate-card]`)
       .exists('Certificate card renders for Issuing CA');
     assert
-      .dom('[data-test-value-div="Private key"] [data-test-certificate-card]')
+      .dom(`${GENERAL.infoRowValue('Private key')} [data-test-certificate-card]`)
       .exists('Certificate card renders for private key');
 
     await click('[data-test-pki-cert-download-button]');
@@ -152,10 +153,10 @@ module('Integration | Component | pki | Page::PkiCertificateDetails', function (
       'Download pem method called with correct args'
     );
 
-    await click('[data-test-confirm-action-trigger]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
 
-    assert.dom('[data-test-value-div="Revocation time"]').exists('Revocation time is displayed');
+    assert.dom(GENERAL.infoRowValue('Revocation time')).exists('Revocation time is displayed');
   });
 
   test('it should render back button', async function (assert) {
@@ -184,7 +185,7 @@ module('Integration | Component | pki | Page::PkiCertificateDetails', function (
     await render(hbs`<Page::PkiCertificateDetails @model={{this.model}} @onRevoke={{this.revoked}} />`, {
       owner: this.engine,
     });
-    await click('[data-test-confirm-action-trigger]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmTrigger);
+    await click(GENERAL.confirmButton);
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-configuration-details-test.js b/ui/tests/integration/components/pki/page/pki-configuration-details-test.js
index e6be8a26f7e..6a98db38d05 100644
--- a/ui/tests/integration/components/pki/page/pki-configuration-details-test.js
+++ b/ui/tests/integration/components/pki/page/pki-configuration-details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,11 +9,10 @@ import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const SELECTORS = {
-  rowLabel: (attr) => `[data-test-row-label="${attr}"]`,
-  rowValue: (attr) => `[data-test-value-div="${attr}"]`,
-  rowIcon: (attr, icon) => `[data-test-row-value="${attr}"] [data-test-icon="${icon}"]`,
+  rowIcon: (attr, icon) => `${GENERAL.infoRowValue(attr)} ${GENERAL.icon(icon)}`,
 };
 
 module('Integration | Component | Page::PkiConfigurationDetails', function (hooks) {
@@ -60,9 +59,9 @@ module('Integration | Component | Page::PkiConfigurationDetails', function (hook
       owner: this.engine,
     });
     assert
-      .dom(SELECTORS.rowValue("Mount's API path"))
+      .dom(GENERAL.infoRowValue("Mount's API path"))
       .hasText('https://pr-a.vault.example.com/v1/ns1/pki-root', 'mount API path row renders');
-    assert.dom(SELECTORS.rowValue('AIA path')).hasText('None', "renders 'None' when no data");
+    assert.dom(GENERAL.infoRowValue('AIA path')).hasText('None', "renders 'None' when no data");
   });
 
   test('shows the correct information on global urls section', async function (assert) {
@@ -72,10 +71,10 @@ module('Integration | Component | Page::PkiConfigurationDetails', function (hook
     );
 
     assert
-      .dom(SELECTORS.rowLabel('Issuing certificates'))
+      .dom(GENERAL.infoRowLabel('Issuing certificates'))
       .hasText('Issuing certificates', 'issuing certificate row label renders');
     assert
-      .dom(SELECTORS.rowValue('Issuing certificates'))
+      .dom(GENERAL.infoRowValue('Issuing certificates'))
       .hasText('example.com', 'issuing certificate value renders');
     this.urls.issuingCertificates = null;
     await render(
@@ -83,13 +82,13 @@ module('Integration | Component | Page::PkiConfigurationDetails', function (hook
       { owner: this.engine }
     );
     assert
-      .dom(SELECTORS.rowValue('Issuing certificates'))
+      .dom(GENERAL.infoRowValue('Issuing certificates'))
       .hasText('None', 'issuing certificate value renders None if none is configured');
     assert
-      .dom(SELECTORS.rowLabel('CRL distribution points'))
+      .dom(GENERAL.infoRowLabel('CRL distribution points'))
       .hasText('CRL distribution points', 'crl distribution points row label renders');
     assert
-      .dom(SELECTORS.rowValue('CRL distribution points'))
+      .dom(GENERAL.infoRowValue('CRL distribution points'))
       .hasText('None', 'crl distribution points value renders None if none is configured');
   });
 
@@ -99,24 +98,24 @@ module('Integration | Component | Page::PkiConfigurationDetails', function (hook
       { owner: this.engine }
     );
 
-    assert.dom(SELECTORS.rowLabel('CRL building')).hasText('CRL building', 'crl expiry row label renders');
-    assert.dom(SELECTORS.rowValue('CRL building')).hasText('Enabled', 'enabled renders');
-    assert.dom(SELECTORS.rowValue('Expiry')).hasText('20h', 'expiry value renders');
-    assert.dom(SELECTORS.rowLabel('Auto-rebuild')).hasText('Auto-rebuild', 'auto rebuild label renders');
-    assert.dom(SELECTORS.rowValue('Auto-rebuild')).hasText('On', 'it renders truthy auto build');
+    assert.dom(GENERAL.infoRowLabel('CRL building')).hasText('CRL building', 'crl expiry row label renders');
+    assert.dom(GENERAL.infoRowValue('CRL building')).hasText('Enabled', 'enabled renders');
+    assert.dom(GENERAL.infoRowValue('Expiry')).hasText('20h', 'expiry value renders');
+    assert.dom(GENERAL.infoRowLabel('Auto-rebuild')).hasText('Auto-rebuild', 'auto rebuild label renders');
+    assert.dom(GENERAL.infoRowValue('Auto-rebuild')).hasText('On', 'it renders truthy auto build');
     assert.dom(SELECTORS.rowIcon('Auto-rebuild', 'check-circle'));
     assert
-      .dom(SELECTORS.rowValue('Auto-rebuild grace period'))
+      .dom(GENERAL.infoRowValue('Auto-rebuild grace period'))
       .hasText('13h', 'it renders auto build grace period');
-    assert.dom(SELECTORS.rowValue('Delta CRL building')).hasText('On', 'it renders truthy delta crl build');
+    assert.dom(GENERAL.infoRowValue('Delta CRL building')).hasText('On', 'it renders truthy delta crl build');
     assert.dom(SELECTORS.rowIcon('Delta CRL building', 'check-circle'));
     assert
-      .dom(SELECTORS.rowValue('Delta rebuild interval'))
+      .dom(GENERAL.infoRowValue('Delta rebuild interval'))
       .hasText('15m', 'it renders delta build duration');
     assert
-      .dom(SELECTORS.rowValue('Responder APIs'))
+      .dom(GENERAL.infoRowValue('Responder APIs'))
       .hasText('Enabled', 'responder apis value renders Enabled if ocsp_disable=false');
-    assert.dom(SELECTORS.rowValue('Interval')).hasText('77h', 'interval value renders');
+    assert.dom(GENERAL.infoRowValue('Interval')).hasText('77h', 'interval value renders');
     // check falsy aut_rebuild and _enable_delta hides duration values
     this.crl.autoRebuild = false;
     this.crl.enableDelta = false;
@@ -124,15 +123,15 @@ module('Integration | Component | Page::PkiConfigurationDetails', function (hook
       hbs`<Page::PkiConfigurationDetails @urls={{this.urls}} @crl={{this.crl}} @hasConfig={{true}} />,`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.rowValue('Auto-rebuild')).hasText('Off', 'it renders falsy auto build');
+    assert.dom(GENERAL.infoRowValue('Auto-rebuild')).hasText('Off', 'it renders falsy auto build');
     assert.dom(SELECTORS.rowIcon('Auto-rebuild', 'x-square'));
     assert
-      .dom(SELECTORS.rowValue('Auto-rebuild grace period'))
+      .dom(GENERAL.infoRowValue('Auto-rebuild grace period'))
       .doesNotExist('does not render auto-rebuild grace period');
-    assert.dom(SELECTORS.rowValue('Delta CRL building')).hasText('Off', 'it renders falsy delta cr build');
+    assert.dom(GENERAL.infoRowValue('Delta CRL building')).hasText('Off', 'it renders falsy delta cr build');
     assert.dom(SELECTORS.rowIcon('Delta CRL building', 'x-square'));
     assert
-      .dom(SELECTORS.rowValue('Delta rebuild interval'))
+      .dom(GENERAL.infoRowValue('Delta rebuild interval'))
       .doesNotExist('does not render delta rebuild duration');
 
     // check falsy disable and ocsp_disable hides duration values and other params
@@ -144,16 +143,16 @@ module('Integration | Component | Page::PkiConfigurationDetails', function (hook
       hbs`<Page::PkiConfigurationDetails @urls={{this.urls}} @crl={{this.crl}} @hasConfig={{true}} />,`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.rowValue('CRL building')).hasText('Disabled', 'disabled renders');
-    assert.dom(SELECTORS.rowValue('Expiry')).doesNotExist();
+    assert.dom(GENERAL.infoRowValue('CRL building')).hasText('Disabled', 'disabled renders');
+    assert.dom(GENERAL.infoRowValue('Expiry')).doesNotExist();
     assert
-      .dom(SELECTORS.rowValue('Responder APIs'))
+      .dom(GENERAL.infoRowValue('Responder APIs'))
       .hasText('Disabled', 'responder apis value renders Disabled');
-    assert.dom(SELECTORS.rowValue('Interval')).doesNotExist();
-    assert.dom(SELECTORS.rowValue('Auto-rebuild')).doesNotExist();
-    assert.dom(SELECTORS.rowValue('Auto-rebuild grace period')).doesNotExist();
-    assert.dom(SELECTORS.rowValue('Delta CRL building')).doesNotExist();
-    assert.dom(SELECTORS.rowValue('Delta rebuild interval')).doesNotExist();
+    assert.dom(GENERAL.infoRowValue('Interval')).doesNotExist();
+    assert.dom(GENERAL.infoRowValue('Auto-rebuild')).doesNotExist();
+    assert.dom(GENERAL.infoRowValue('Auto-rebuild grace period')).doesNotExist();
+    assert.dom(GENERAL.infoRowValue('Delta CRL building')).doesNotExist();
+    assert.dom(GENERAL.infoRowValue('Delta rebuild interval')).doesNotExist();
   });
 
   test('it renders enterprise params in crl section', async function (assert) {
@@ -163,11 +162,11 @@ module('Integration | Component | Page::PkiConfigurationDetails', function (hook
       hbs`<Page::PkiConfigurationDetails @urls={{this.urls}} @crl={{this.crl}} @hasConfig={{true}} />,`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.rowValue('Cross-cluster revocation')).hasText('Yes');
+    assert.dom(GENERAL.infoRowValue('Cross-cluster revocation')).hasText('Yes');
     assert.dom(SELECTORS.rowIcon('Cross-cluster revocation', 'check-circle'));
-    assert.dom(SELECTORS.rowValue('Unified CRL')).hasText('Yes');
+    assert.dom(GENERAL.infoRowValue('Unified CRL')).hasText('Yes');
     assert.dom(SELECTORS.rowIcon('Unified CRL', 'check-circle'));
-    assert.dom(SELECTORS.rowValue('Unified CRL on existing paths')).hasText('Yes');
+    assert.dom(GENERAL.infoRowValue('Unified CRL on existing paths')).hasText('Yes');
     assert.dom(SELECTORS.rowIcon('Unified CRL on existing paths', 'check-circle'));
   });
 
@@ -178,8 +177,8 @@ module('Integration | Component | Page::PkiConfigurationDetails', function (hook
       hbs`<Page::PkiConfigurationDetails @urls={{this.urls}} @crl={{this.crl}} @hasConfig={{true}} />,`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.rowValue('Cross-cluster revocation')).doesNotExist();
-    assert.dom(SELECTORS.rowValue('Unified CRL')).doesNotExist();
-    assert.dom(SELECTORS.rowValue('Unified CRL on existing paths')).doesNotExist();
+    assert.dom(GENERAL.infoRowValue('Cross-cluster revocation')).doesNotExist();
+    assert.dom(GENERAL.infoRowValue('Unified CRL')).doesNotExist();
+    assert.dom(GENERAL.infoRowValue('Unified CRL on existing paths')).doesNotExist();
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-configuration-edit-test.js b/ui/tests/integration/components/pki/page/pki-configuration-edit-test.js
index cc8644921ec..e2f4b685f5c 100644
--- a/ui/tests/integration/components/pki/page/pki-configuration-edit-test.js
+++ b/ui/tests/integration/components/pki/page/pki-configuration-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,9 +10,9 @@ import { setupEngine } from 'ember-engines/test-support';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { Response } from 'miragejs';
-import { SELECTORS } from 'vault/tests/helpers/pki/page/pki-configuration-edit';
 import sinon from 'sinon';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { PKI_CONFIG_EDIT } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Integration | Component | page/pki-configuration-edit', function (hooks) {
   setupRenderingTest(hooks);
@@ -137,70 +137,70 @@ module('Integration | Component | page/pki-configuration-edit', function (hooks)
       this.context
     );
 
-    assert.dom(SELECTORS.configEditSection).exists('renders config section');
-    assert.dom(SELECTORS.urlsEditSection).exists('renders urls section');
-    assert.dom(SELECTORS.crlEditSection).exists('renders crl section');
-    assert.dom(SELECTORS.cancelButton).exists();
+    assert.dom(PKI_CONFIG_EDIT.configEditSection).exists('renders config section');
+    assert.dom(PKI_CONFIG_EDIT.urlsEditSection).exists('renders urls section');
+    assert.dom(PKI_CONFIG_EDIT.crlEditSection).exists('renders crl section');
+    assert.dom(PKI_CONFIG_EDIT.cancelButton).exists();
     this.urls.eachAttribute((name) => {
-      assert.dom(SELECTORS.urlFieldInput(name)).exists(`renders ${name} input`);
+      assert.dom(PKI_CONFIG_EDIT.urlFieldInput(name)).exists(`renders ${name} input`);
     });
-    assert.dom(SELECTORS.urlFieldInput('issuingCertificates')).hasValue('hashicorp.com');
-    assert.dom(SELECTORS.urlFieldInput('crlDistributionPoints')).hasValue('some-crl-distribution.com');
-    assert.dom(SELECTORS.urlFieldInput('ocspServers')).hasValue('ocsp-stuff.com');
+    assert.dom(PKI_CONFIG_EDIT.urlFieldInput('issuingCertificates')).hasValue('hashicorp.com');
+    assert.dom(PKI_CONFIG_EDIT.urlFieldInput('crlDistributionPoints')).hasValue('some-crl-distribution.com');
+    assert.dom(PKI_CONFIG_EDIT.urlFieldInput('ocspServers')).hasValue('ocsp-stuff.com');
 
     // cluster config
-    await fillIn(SELECTORS.configInput('path'), 'https://pr-a.vault.example.com/v1/ns1/pki-root');
-    await fillIn(SELECTORS.configInput('aiaPath'), 'http://another-path.com');
+    await fillIn(PKI_CONFIG_EDIT.configInput('path'), 'https://pr-a.vault.example.com/v1/ns1/pki-root');
+    await fillIn(PKI_CONFIG_EDIT.configInput('aiaPath'), 'http://another-path.com');
 
     // acme config;
-    await click(SELECTORS.configInput('enabled'));
-    await fillIn(SELECTORS.stringListInput('allowedRoles'), 'my-role');
-    await fillIn(SELECTORS.stringListInput('allowedIssuers'), '*');
-    await fillIn(SELECTORS.configInput('eabPolicy'), 'new-account-required');
-    await fillIn(SELECTORS.configInput('dnsResolver'), 'some-dns');
+    await click(PKI_CONFIG_EDIT.configInput('enabled'));
+    await fillIn(PKI_CONFIG_EDIT.stringListInput('allowedRoles'), 'my-role');
+    await fillIn(PKI_CONFIG_EDIT.stringListInput('allowedIssuers'), '*');
+    await fillIn(PKI_CONFIG_EDIT.configInput('eabPolicy'), 'new-account-required');
+    await fillIn(PKI_CONFIG_EDIT.configInput('dnsResolver'), 'some-dns');
 
     // urls
-    await fillIn(SELECTORS.urlFieldInput('issuingCertificates'), 'update-hashicorp.com');
-    await fillIn(SELECTORS.urlFieldInput('crlDistributionPoints'), 'test-crl.com');
-    await fillIn(SELECTORS.urlFieldInput('ocspServers'), 'ocsp.com');
+    await fillIn(PKI_CONFIG_EDIT.urlFieldInput('issuingCertificates'), 'update-hashicorp.com');
+    await fillIn(PKI_CONFIG_EDIT.urlFieldInput('crlDistributionPoints'), 'test-crl.com');
+    await fillIn(PKI_CONFIG_EDIT.urlFieldInput('ocspServers'), 'ocsp.com');
 
     // confirm default toggle state and text
     this.crl.eachAttribute((name, { options }) => {
       if (['expiry', 'ocspExpiry'].includes(name)) {
-        assert.dom(SELECTORS.crlToggleInput(name)).isChecked(`${name} defaults to toggled on`);
-        assert.dom(SELECTORS.crlFieldLabel(name)).hasTextContaining(options.label);
-        assert.dom(SELECTORS.crlFieldLabel(name)).hasTextContaining(options.helperTextEnabled);
+        assert.dom(PKI_CONFIG_EDIT.crlToggleInput(name)).isChecked(`${name} defaults to toggled on`);
+        assert.dom(PKI_CONFIG_EDIT.crlFieldLabel(name)).hasTextContaining(options.label);
+        assert.dom(PKI_CONFIG_EDIT.crlFieldLabel(name)).hasTextContaining(options.helperTextEnabled);
       }
       if (['autoRebuildGracePeriod', 'deltaRebuildInterval'].includes(name)) {
-        assert.dom(SELECTORS.crlToggleInput(name)).isNotChecked(`${name} defaults off`);
-        assert.dom(SELECTORS.crlFieldLabel(name)).hasTextContaining(options.labelDisabled);
-        assert.dom(SELECTORS.crlFieldLabel(name)).hasTextContaining(options.helperTextDisabled);
+        assert.dom(PKI_CONFIG_EDIT.crlToggleInput(name)).isNotChecked(`${name} defaults off`);
+        assert.dom(PKI_CONFIG_EDIT.crlFieldLabel(name)).hasTextContaining(options.labelDisabled);
+        assert.dom(PKI_CONFIG_EDIT.crlFieldLabel(name)).hasTextContaining(options.helperTextDisabled);
       }
     });
 
     // toggle everything on
-    await click(SELECTORS.crlToggleInput('autoRebuildGracePeriod'));
+    await click(PKI_CONFIG_EDIT.crlToggleInput('autoRebuildGracePeriod'));
     assert
-      .dom(SELECTORS.crlFieldLabel('autoRebuildGracePeriod'))
+      .dom(PKI_CONFIG_EDIT.crlFieldLabel('autoRebuildGracePeriod'))
       .hasTextContaining(
         'Auto-rebuild on Vault will rebuild the CRL in the below grace period before expiration',
         'it renders auto rebuild toggled on text'
       );
-    await click(SELECTORS.crlToggleInput('deltaRebuildInterval'));
+    await click(PKI_CONFIG_EDIT.crlToggleInput('deltaRebuildInterval'));
     assert
-      .dom(SELECTORS.crlFieldLabel('deltaRebuildInterval'))
+      .dom(PKI_CONFIG_EDIT.crlFieldLabel('deltaRebuildInterval'))
       .hasTextContaining(
         'Delta CRL building on Vault will rebuild the delta CRL at the interval below:',
         'it renders delta crl build toggled on text'
       );
 
     // assert ttl values update model attributes
-    await fillIn(SELECTORS.crlTtlInput('Expiry'), '48');
-    await fillIn(SELECTORS.crlTtlInput('Auto-rebuild on'), '24');
-    await fillIn(SELECTORS.crlTtlInput('Delta CRL building on'), '45');
-    await fillIn(SELECTORS.crlTtlInput('OCSP responder APIs enabled'), '24');
+    await fillIn(PKI_CONFIG_EDIT.crlTtlInput('Expiry'), '48');
+    await fillIn(PKI_CONFIG_EDIT.crlTtlInput('Auto-rebuild on'), '24');
+    await fillIn(PKI_CONFIG_EDIT.crlTtlInput('Delta CRL building on'), '45');
+    await fillIn(PKI_CONFIG_EDIT.crlTtlInput('OCSP responder APIs enabled'), '24');
 
-    await click(SELECTORS.saveButton);
+    await click(PKI_CONFIG_EDIT.saveButton);
   });
 
   test('it removes urls and sends false crl values', async function (assert) {
@@ -249,28 +249,28 @@ module('Integration | Component | page/pki-configuration-edit', function (hooks)
       this.context
     );
 
-    await click(SELECTORS.deleteButton('issuingCertificates'));
-    await click(SELECTORS.deleteButton('crlDistributionPoints'));
-    await click(SELECTORS.deleteButton('ocspServers'));
+    await click(PKI_CONFIG_EDIT.deleteButton('issuingCertificates'));
+    await click(PKI_CONFIG_EDIT.deleteButton('crlDistributionPoints'));
+    await click(PKI_CONFIG_EDIT.deleteButton('ocspServers'));
 
     // toggle everything off
-    await click(SELECTORS.crlToggleInput('expiry'));
-    assert.dom(SELECTORS.crlFieldLabel('expiry')).hasText('No expiry The CRL will not be built.');
+    await click(PKI_CONFIG_EDIT.crlToggleInput('expiry'));
+    assert.dom(PKI_CONFIG_EDIT.crlFieldLabel('expiry')).hasText('No expiry The CRL will not be built.');
     assert
-      .dom(SELECTORS.crlToggleInput('autoRebuildGracePeriod'))
+      .dom(PKI_CONFIG_EDIT.crlToggleInput('autoRebuildGracePeriod'))
       .doesNotExist('expiry off hides the auto rebuild toggle');
     assert
-      .dom(SELECTORS.crlToggleInput('deltaRebuildInterval'))
+      .dom(PKI_CONFIG_EDIT.crlToggleInput('deltaRebuildInterval'))
       .doesNotExist('expiry off hides delta crl toggle');
-    await click(SELECTORS.crlToggleInput('ocspExpiry'));
+    await click(PKI_CONFIG_EDIT.crlToggleInput('ocspExpiry'));
     assert
-      .dom(SELECTORS.crlFieldLabel('ocspExpiry'))
+      .dom(PKI_CONFIG_EDIT.crlFieldLabel('ocspExpiry'))
       .hasTextContaining(
         'OCSP responder APIs disabled Requests cannot be made to check if an individual certificate is valid.',
         'it renders correct toggled off text'
       );
 
-    await click(SELECTORS.saveButton);
+    await click(PKI_CONFIG_EDIT.saveButton);
   });
 
   test('it renders enterprise only params', async function (assert) {
@@ -315,13 +315,13 @@ module('Integration | Component | page/pki-configuration-edit', function (hooks)
       this.context
     );
 
-    assert.dom(SELECTORS.groupHeader('Certificate Revocation List (CRL)')).exists();
-    assert.dom(SELECTORS.groupHeader('Online Certificate Status Protocol (OCSP)')).exists();
-    assert.dom(SELECTORS.groupHeader('Unified Revocation')).exists();
-    await click(SELECTORS.checkboxInput('crossClusterRevocation'));
-    await click(SELECTORS.checkboxInput('unifiedCrl'));
-    await click(SELECTORS.checkboxInput('unifiedCrlOnExistingPaths'));
-    await click(SELECTORS.saveButton);
+    assert.dom(PKI_CONFIG_EDIT.groupHeader('Certificate Revocation List (CRL)')).exists();
+    assert.dom(PKI_CONFIG_EDIT.groupHeader('Online Certificate Status Protocol (OCSP)')).exists();
+    assert.dom(PKI_CONFIG_EDIT.groupHeader('Unified Revocation')).exists();
+    await click(PKI_CONFIG_EDIT.checkboxInput('crossClusterRevocation'));
+    await click(PKI_CONFIG_EDIT.checkboxInput('unifiedCrl'));
+    await click(PKI_CONFIG_EDIT.checkboxInput('unifiedCrlOnExistingPaths'));
+    await click(PKI_CONFIG_EDIT.saveButton);
   });
 
   test('it does not render enterprise only params for OSS', async function (assert) {
@@ -363,13 +363,13 @@ module('Integration | Component | page/pki-configuration-edit', function (hooks)
       this.context
     );
 
-    assert.dom(SELECTORS.checkboxInput('crossClusterRevocation')).doesNotExist();
-    assert.dom(SELECTORS.checkboxInput('unifiedCrl')).doesNotExist();
-    assert.dom(SELECTORS.checkboxInput('unifiedCrlOnExistingPaths')).doesNotExist();
-    assert.dom(SELECTORS.groupHeader('Certificate Revocation List (CRL)')).exists();
-    assert.dom(SELECTORS.groupHeader('Online Certificate Status Protocol (OCSP)')).exists();
-    assert.dom(SELECTORS.groupHeader('Unified Revocation')).doesNotExist();
-    await click(SELECTORS.saveButton);
+    assert.dom(PKI_CONFIG_EDIT.checkboxInput('crossClusterRevocation')).doesNotExist();
+    assert.dom(PKI_CONFIG_EDIT.checkboxInput('unifiedCrl')).doesNotExist();
+    assert.dom(PKI_CONFIG_EDIT.checkboxInput('unifiedCrlOnExistingPaths')).doesNotExist();
+    assert.dom(PKI_CONFIG_EDIT.groupHeader('Certificate Revocation List (CRL)')).exists();
+    assert.dom(PKI_CONFIG_EDIT.groupHeader('Online Certificate Status Protocol (OCSP)')).exists();
+    assert.dom(PKI_CONFIG_EDIT.groupHeader('Unified Revocation')).doesNotExist();
+    await click(PKI_CONFIG_EDIT.saveButton);
   });
 
   test('it renders empty states if no update capabilities', async function (assert) {
@@ -390,22 +390,22 @@ module('Integration | Component | page/pki-configuration-edit', function (hooks)
     );
 
     assert
-      .dom(`${SELECTORS.configEditSection} [data-test-component="empty-state"]`)
+      .dom(`${PKI_CONFIG_EDIT.configEditSection} [data-test-component="empty-state"]`)
       .hasText(
         "You do not have permission to set this mount's the cluster config Ask your administrator if you think you should have access to: POST /pki-engine/config/cluster"
       );
     assert
-      .dom(`${SELECTORS.acmeEditSection} [data-test-component="empty-state"]`)
+      .dom(`${PKI_CONFIG_EDIT.acmeEditSection} [data-test-component="empty-state"]`)
       .hasText(
         "You do not have permission to set this mount's ACME config Ask your administrator if you think you should have access to: POST /pki-engine/config/acme"
       );
     assert
-      .dom(`${SELECTORS.urlsEditSection} [data-test-component="empty-state"]`)
+      .dom(`${PKI_CONFIG_EDIT.urlsEditSection} [data-test-component="empty-state"]`)
       .hasText(
         "You do not have permission to set this mount's URLs Ask your administrator if you think you should have access to: POST /pki-engine/config/urls"
       );
     assert
-      .dom(`${SELECTORS.crlEditSection} [data-test-component="empty-state"]`)
+      .dom(`${PKI_CONFIG_EDIT.crlEditSection} [data-test-component="empty-state"]`)
       .hasText(
         "You do not have permission to set this mount's revocation configuration Ask your administrator if you think you should have access to: POST /pki-engine/config/crl"
       );
@@ -438,21 +438,21 @@ module('Integration | Component | page/pki-configuration-edit', function (hooks)
       this.context
     );
 
-    await click(SELECTORS.saveButton);
+    await click(PKI_CONFIG_EDIT.saveButton);
     assert
-      .dom(SELECTORS.errorBanner)
+      .dom(PKI_CONFIG_EDIT.errorBanner)
       .hasText(
         'Error POST config/cluster: something wrong with cluster POST config/acme: something wrong with acme POST config/urls: something wrong with urls POST config/crl: something wrong with crl'
       );
-    assert.dom(`${SELECTORS.errorBanner} ul`).hasClass('bullet');
+    assert.dom(`${PKI_CONFIG_EDIT.errorBanner} ul`).hasClass('bullet');
 
     // change 3 out of 4 requests to be successful to assert single error renders correctly
     this.server.post(`/${this.backend}/config/acme`, () => new Response(200));
     this.server.post(`/${this.backend}/config/cluster`, () => new Response(200));
     this.server.post(`/${this.backend}/config/crl`, () => new Response(200));
 
-    await click(SELECTORS.saveButton);
-    assert.dom(SELECTORS.errorBanner).hasText('Error POST config/urls: something wrong with urls');
-    assert.dom(`${SELECTORS.errorBanner} ul`).doesNotHaveClass('bullet');
+    await click(PKI_CONFIG_EDIT.saveButton);
+    assert.dom(PKI_CONFIG_EDIT.errorBanner).hasText('Error POST config/urls: something wrong with urls');
+    assert.dom(`${PKI_CONFIG_EDIT.errorBanner} ul`).doesNotHaveClass('bullet');
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-configure-create-test.js b/ui/tests/integration/components/pki/page/pki-configure-create-test.js
index 3574f8bc804..d35796d8b4a 100644
--- a/ui/tests/integration/components/pki/page/pki-configure-create-test.js
+++ b/ui/tests/integration/components/pki/page/pki-configure-create-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,8 +8,9 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { click, render } from '@ember/test-helpers';
 import { setupEngine } from 'ember-engines/test-support';
 import { hbs } from 'ember-cli-htmlbars';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-configure-create';
 import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { PKI_CONFIGURE_CREATE } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Integration | Component | page/pki-configure-create', function (hooks) {
   setupRenderingTest(hooks);
@@ -20,9 +21,9 @@ module('Integration | Component | page/pki-configure-create', function (hooks) {
     this.store = this.owner.lookup('service:store');
     this.cancelSpy = sinon.spy();
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: 'pki', route: 'overview' },
-      { label: 'configure' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: 'pki', route: 'overview', model: 'pki' },
+      { label: 'Configure' },
     ];
     this.config = this.store.createRecord('pki/action');
     this.urls = this.store.createRecord('pki/config/urls');
@@ -40,22 +41,22 @@ module('Integration | Component | page/pki-configure-create', function (hooks) {
     `,
       this.context
     );
-    assert.dom(SELECTORS.breadcrumbContainer).exists('breadcrumbs exist');
-    assert.dom(SELECTORS.title).hasText('Configure PKI');
-    assert.dom(SELECTORS.option).exists({ count: 3 }, 'Three configuration options are shown');
-    assert.dom(SELECTORS.cancelButton).exists('Cancel link is shown');
-    assert.dom(SELECTORS.saveButton).isDisabled('Done button is disabled');
+    assert.dom(GENERAL.breadcrumbs).exists();
+    assert.dom(GENERAL.title).hasText('Configure PKI');
+    assert.dom(PKI_CONFIGURE_CREATE.option).exists({ count: 3 });
+    assert.dom(GENERAL.cancelButton).exists('Cancel link is shown');
+    assert.dom(GENERAL.submitButton).isDisabled('Done button is disabled');
 
-    await click(SELECTORS.optionByKey('import'));
-    assert.dom(SELECTORS.optionByKey('import')).isChecked('Selected item is checked');
+    await click(PKI_CONFIGURE_CREATE.optionByKey('import'));
+    assert.dom(PKI_CONFIGURE_CREATE.optionByKey('import')).isChecked();
 
-    await click(SELECTORS.optionByKey('generate-csr'));
-    assert.dom(SELECTORS.optionByKey('generate-csr')).isChecked('Selected item is checked');
+    await click(PKI_CONFIGURE_CREATE.optionByKey('generate-csr'));
+    assert.dom(PKI_CONFIGURE_CREATE.optionByKey('generate-csr')).isChecked();
 
-    await click(SELECTORS.optionByKey('generate-root'));
-    assert.dom(SELECTORS.optionByKey('generate-root')).isChecked('Selected item is checked');
+    await click(PKI_CONFIGURE_CREATE.optionByKey('generate-root'));
+    assert.dom(PKI_CONFIGURE_CREATE.optionByKey('generate-root')).isChecked();
 
-    await click(SELECTORS.generateRootCancel);
-    assert.ok(this.cancelSpy.calledOnce);
+    await click(GENERAL.cancelButton);
+    assert.true(this.cancelSpy.calledOnce, 'cancel action is called');
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-issuer-edit-test.js b/ui/tests/integration/components/pki/page/pki-issuer-edit-test.js
index 0c6d61df14e..9aa80e0144b 100644
--- a/ui/tests/integration/components/pki/page/pki-issuer-edit-test.js
+++ b/ui/tests/integration/components/pki/page/pki-issuer-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,6 +10,7 @@ import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { Response } from 'miragejs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import sinon from 'sinon';
 
 const selectors = {
@@ -27,7 +28,6 @@ const selectors = {
   certUrlRemove: '[data-test-string-list-button="delete"]',
   crlDist: '[data-test-input="crlDistributionPoints"] [data-test-string-list-input="0"]',
   ocspServers: '[data-test-input="ocspServers"]  [data-test-string-list-input="0"]',
-  save: '[data-test-save]',
   cancel: '[data-test-cancel]',
   error: '[data-test-message-error]',
   alert: '[data-test-inline-error-message]',
@@ -79,7 +79,7 @@ module('Integration | Component | pki | Page::PkiIssuerEditPage::PkiIssuerEdit',
     assert
       .dom(selectors.leafOption)
       .hasText(
-        'Error if the computed NotAfter exceeds that of this issuer',
+        'Error if the computed NotAfter exceeds that of this issuer in all circumstances (leaf, CA issuance and ACME)',
         'Correct text renders for leaf option'
       );
     assert.dom(selectors.usageCert).isChecked('Usage issuing certificates is checked');
@@ -132,7 +132,7 @@ module('Integration | Component | pki | Page::PkiIssuerEditPage::PkiIssuerEdit',
     await render(hbs`<Page::PkiIssuerEdit @model={{this.model}} />`, { owner: this.engine });
 
     await this.update();
-    await click(selectors.save);
+    await click(GENERAL.submitButton);
     assert.ok(this.transitionCalled(), 'Transitions to details route on save success');
   });
 
@@ -140,7 +140,7 @@ module('Integration | Component | pki | Page::PkiIssuerEditPage::PkiIssuerEdit',
     this.server.post('/pki/issuer/test', () => new Response(404, {}, { errors: ['Some error occurred'] }));
 
     await render(hbs`<Page::PkiIssuerEdit @model={{this.model}} />`, { owner: this.engine });
-    await click(selectors.save);
+    await click(GENERAL.submitButton);
 
     assert
       .dom(selectors.alert)
diff --git a/ui/tests/integration/components/pki/page/pki-issuer-generate-intermediate-test.js b/ui/tests/integration/components/pki/page/pki-issuer-generate-intermediate-test.js
index b1f7da478a6..979fc357a90 100644
--- a/ui/tests/integration/components/pki/page/pki-issuer-generate-intermediate-test.js
+++ b/ui/tests/integration/components/pki/page/pki-issuer-generate-intermediate-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,8 +12,8 @@ import { Response } from 'miragejs';
 import { v4 as uuidv4 } from 'uuid';
 
 import { setupRenderingTest } from 'vault/tests/helpers';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-configure-create';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 /**
  * this test is for the page component only. A separate test is written for the form rendered
@@ -53,11 +53,11 @@ module('Integration | Component | page/pki-issuer-generate-intermediate', functi
         owner: this.engine,
       }
     );
-    assert.dom('[data-test-pki-page-title]').hasText('Generate intermediate CSR');
-    await fillIn(SELECTORS.typeField, 'internal');
-    await fillIn(SELECTORS.inputByName('commonName'), 'foobar');
-    await click('[data-test-save]');
-    assert.dom('[data-test-pki-page-title]').hasText('View Generated CSR');
+    assert.dom(GENERAL.title).hasText('Generate intermediate CSR');
+    await fillIn(GENERAL.inputByAttr('type'), 'internal');
+    await fillIn(GENERAL.inputByAttr('commonName'), 'foobar');
+    await click('[data-test-submit]');
+    assert.dom(GENERAL.title).hasText('View Generated CSR');
   });
 
   test('it does not update title if API response is an error', async function (assert) {
@@ -73,13 +73,13 @@ module('Integration | Component | page/pki-issuer-generate-intermediate', functi
         owner: this.engine,
       }
     );
-    assert.dom('[data-test-pki-page-title]').hasText('Generate intermediate CSR');
+    assert.dom(GENERAL.title).hasText('Generate intermediate CSR');
     // Fill in
-    await fillIn(SELECTORS.typeField, 'internal');
-    await fillIn(SELECTORS.inputByName('commonName'), 'foobar');
-    await click('[data-test-save]');
+    await fillIn(GENERAL.inputByAttr('type'), 'internal');
+    await fillIn(GENERAL.inputByAttr('commonName'), 'foobar');
+    await click('[data-test-submit]');
     assert
-      .dom('[data-test-pki-page-title]')
+      .dom(GENERAL.title)
       .hasText('Generate intermediate CSR', 'title does not change if response is unsuccessful');
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-issuer-generate-root-test.js b/ui/tests/integration/components/pki/page/pki-issuer-generate-root-test.js
index bedc774af09..25a3fbd434c 100644
--- a/ui/tests/integration/components/pki/page/pki-issuer-generate-root-test.js
+++ b/ui/tests/integration/components/pki/page/pki-issuer-generate-root-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,9 +12,9 @@ import { Response } from 'miragejs';
 import { v4 as uuidv4 } from 'uuid';
 
 import { setupRenderingTest } from 'vault/tests/helpers';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-configure-create';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 /**
  * this test is for the page component only. A separate test is written for the form rendered
@@ -63,11 +63,11 @@ module('Integration | Component | page/pki-issuer-generate-root', function (hook
         owner: this.engine,
       }
     );
-    assert.dom('[data-test-pki-page-title]').hasText('Generate root');
-    await fillIn(SELECTORS.typeField, 'internal');
-    await fillIn(SELECTORS.inputByName('commonName'), 'foobar');
-    await click(SELECTORS.generateRootSave);
-    assert.dom('[data-test-pki-page-title]').hasText('View generated root');
+    assert.dom(GENERAL.title).hasText('Generate root');
+    await fillIn(GENERAL.inputByAttr('type'), 'internal');
+    await fillIn(GENERAL.inputByAttr('commonName'), 'foobar');
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.title).hasText('View generated root');
   });
 
   test('it does not update title if API response is an error', async function (assert) {
@@ -80,13 +80,11 @@ module('Integration | Component | page/pki-issuer-generate-root', function (hook
         owner: this.engine,
       }
     );
-    assert.dom('[data-test-pki-page-title]').hasText('Generate root');
+    assert.dom(GENERAL.title).hasText('Generate root');
     // Fill in
-    await fillIn(SELECTORS.typeField, 'internal');
-    await fillIn(SELECTORS.inputByName('commonName'), 'foobar');
-    await click(SELECTORS.generateRootSave);
-    assert
-      .dom('[data-test-pki-page-title]')
-      .hasText('Generate root', 'title does not change if response is unsuccessful');
+    await fillIn(GENERAL.inputByAttr('type'), 'internal');
+    await fillIn(GENERAL.inputByAttr('commonName'), 'foobar');
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.title).hasText('Generate root', 'title does not change if response is unsuccessful');
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-issuer-import-test.js b/ui/tests/integration/components/pki/page/pki-issuer-import-test.js
index dae6192da0c..4cf4d7367f6 100644
--- a/ui/tests/integration/components/pki/page/pki-issuer-import-test.js
+++ b/ui/tests/integration/components/pki/page/pki-issuer-import-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,6 +12,8 @@ import { Response } from 'miragejs';
 import { v4 as uuidv4 } from 'uuid';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { PKI_CONFIGURE_CREATE } from 'vault/tests/helpers/pki/pki-selectors';
 
 /**
  * this test is for the page component only. A separate test is written for the form rendered
@@ -45,28 +47,25 @@ module('Integration | Component | page/pki-issuer-import', function (hooks) {
     await render(hbs`<Page::PkiIssuerImport @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />`, {
       owner: this.engine,
     });
-    assert.dom('[data-test-pki-page-title]').hasText('Import a CA');
-    await click('[data-test-text-toggle]');
-    await fillIn('[data-test-text-file-textarea]', 'dummy-pem-bundle');
-    await click('[data-test-pki-import-pem-bundle]');
-    assert.dom('[data-test-pki-page-title]').hasText('View imported items');
+    assert.dom(GENERAL.title).hasText('Import a CA');
+    await click(GENERAL.textToggle);
+    await fillIn(GENERAL.maskedInput, 'dummy-pem-bundle');
+    await click(PKI_CONFIGURE_CREATE.importSubmit);
+    assert.dom(GENERAL.title).hasText('View imported items');
   });
 
   test('it does not update title if API response is an error', async function (assert) {
     assert.expect(2);
-    // this.server.post('/pki-component/issuers/import/bundle', () => new Response(404, {}, { errors: ['Some error occurred'] }));
     this.server.post(`/pki-component/issuers/import/bundle`, () => new Response(404, {}, { errors: [] }));
 
     await render(hbs`<Page::PkiIssuerImport @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />`, {
       owner: this.engine,
     });
-    assert.dom('[data-test-pki-page-title]').hasText('Import a CA');
+    assert.dom(GENERAL.title).hasText('Import a CA');
     // Fill in
-    await click('[data-test-text-toggle]');
-    await fillIn('[data-test-text-file-textarea]', 'dummy-pem-bundle');
-    await click('[data-test-pki-import-pem-bundle]');
-    assert
-      .dom('[data-test-pki-page-title]')
-      .hasText('Import a CA', 'title does not change if response is unsuccessful');
+    await click(GENERAL.textToggle);
+    await fillIn(GENERAL.maskedInput, 'dummy-pem-bundle');
+    await click(PKI_CONFIGURE_CREATE.importSubmit);
+    assert.dom(GENERAL.title).hasText('Import a CA', 'title does not change if response is unsuccessful');
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-issuer-list-test.js b/ui/tests/integration/components/pki/page/pki-issuer-list-test.js
index e2fc2c7e1c5..a253889165f 100644
--- a/ui/tests/integration/components/pki/page/pki-issuer-list-test.js
+++ b/ui/tests/integration/components/pki/page/pki-issuer-list-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupRenderingTest } from 'vault/tests/helpers';
-import { STANDARD_META } from 'vault/tests/helpers/pki';
+import { STANDARD_META } from 'vault/tests/helpers/pagination';
 
 /**
  * this test is for the page component only. A separate test is written for the form rendered
@@ -47,9 +47,12 @@ module('Integration | Component | page/pki-issuer-list', function (hooks) {
     issuers.meta = STANDARD_META;
     this.issuers = issuers;
 
-    await render(hbs`<Page::PkiIssuerList @issuers={{this.issuers}} @mountPoint={{this.engineId}} />`, {
-      owner: this.engine,
-    });
+    await render(
+      hbs`<Page::PkiIssuerList @backend="pki-mount" @issuers={{this.issuers}} @mountPoint={{this.engineId}} />`,
+      {
+        owner: this.engine,
+      }
+    );
 
     this.issuers.forEach(async (issuer, idx) => {
       assert
@@ -76,9 +79,12 @@ module('Integration | Component | page/pki-issuer-list', function (hooks) {
     const issuers = this.store.peekAll('pki/issuer');
     issuers.meta = STANDARD_META;
     this.issuers = issuers;
-    await render(hbs`<Page::PkiIssuerList @issuers={{this.issuers}} @mountPoint={{this.engineId}} />`, {
-      owner: this.engine,
-    });
+    await render(
+      hbs`<Page::PkiIssuerList @backend="pki-mount" @issuers={{this.issuers}} @mountPoint={{this.engineId}} />`,
+      {
+        owner: this.engine,
+      }
+    );
     assert.dom(`[data-test-is-default="1"]`).hasText('default issuer');
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-issuer-rotate-root-test.js b/ui/tests/integration/components/pki/page/pki-issuer-rotate-root-test.js
index b359e43f043..043886c39cc 100644
--- a/ui/tests/integration/components/pki/page/pki-issuer-rotate-root-test.js
+++ b/ui/tests/integration/components/pki/page/pki-issuer-rotate-root-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 import { module, test } from 'qunit';
@@ -9,14 +9,14 @@ import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import sinon from 'sinon';
 import { hbs } from 'ember-cli-htmlbars';
-import { loadedCert } from 'vault/tests/helpers/pki/values';
 import camelizeKeys from 'vault/utils/camelize-object-keys';
 import { parseCertificate } from 'vault/utils/parse-pki-cert';
-import { SELECTORS as S } from 'vault/tests/helpers/pki/pki-generate-root';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
+import { PKI_CONFIGURE_CREATE } from 'vault/tests/helpers/pki/pki-selectors';
 
 const SELECTORS = {
-  pageTitle: '[data-test-pki-page-title]',
   nextSteps: '[data-test-rotate-next-steps]',
   toolbarCrossSign: '[data-test-pki-issuer-cross-sign]',
   toolbarSignInt: '[data-test-pki-issuer-sign-int]',
@@ -24,17 +24,13 @@ const SELECTORS = {
   oldRadioSelect: 'input#use-old-root-settings',
   customRadioSelect: 'input#customize-new-root-certificate',
   toggle: '[data-test-details-toggle]',
-  input: (attr) => `[data-test-input="${attr}"]`,
-  infoRowValue: (attr) => `[data-test-value-div="${attr}"]`,
   validationError: '[data-test-pki-rotate-root-validation-error]',
   rotateRootForm: '[data-test-pki-rotate-old-settings-form]',
-  rotateRootSave: '[data-test-pki-rotate-root-save]',
-  rotateRootCancel: '[data-test-pki-rotate-root-cancel]',
   doneButton: '[data-test-done]',
   // root form
   generateRootForm: '[data-test-pki-config-generate-root-form]',
-  ...S,
 };
+const { loadedCert } = CERTIFICATES;
 
 module('Integration | Component | page/pki-issuer-rotate-root', function (hooks) {
   setupRenderingTest(hooks);
@@ -96,19 +92,19 @@ module('Integration | Component | page/pki-issuer-rotate-root', function (hooks)
     `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.pageTitle).hasText('Generate New Root');
+    assert.dom(GENERAL.title).hasText('Generate New Root');
     assert.dom(SELECTORS.oldRadioSelect).isChecked('defaults to use-old-settings');
     assert.dom(SELECTORS.rotateRootForm).exists('it renders old settings form');
     assert
-      .dom(SELECTORS.input('commonName'))
+      .dom(GENERAL.inputByAttr('commonName'))
       .hasValue(this.parsedRootCert.commonName, 'common name prefilled with root cert cn');
     assert.dom(SELECTORS.toggle).hasText('Old root settings', 'toggle renders correct text');
-    assert.dom(SELECTORS.input('issuerName')).exists('renders issuer name input');
+    assert.dom(GENERAL.inputByAttr('issuerName')).exists('renders issuer name input');
     assert.strictEqual(findAll('[data-test-row-label]').length, 0, 'it hides the old root info table rows');
     await click(SELECTORS.toggle);
     assert.strictEqual(findAll('[data-test-row-label]').length, 19, 'it shows the old root info table rows');
     assert
-      .dom(SELECTORS.infoRowValue('Issuer name'))
+      .dom(GENERAL.infoRowValue('Issuer name'))
       .hasText(this.oldRoot.issuerName, 'renders correct issuer data');
     await click(SELECTORS.toggle);
     assert.strictEqual(findAll('[data-test-row-label]').length, 0, 'it hides again');
@@ -117,21 +113,21 @@ module('Integration | Component | page/pki-issuer-rotate-root', function (hooks)
     await click(SELECTORS.customRadioSelect);
     assert.dom(SELECTORS.generateRootForm).exists('it renders generate root form');
     assert
-      .dom(SELECTORS.input('permittedDnsDomains'))
+      .dom(GENERAL.inputByAttr('permittedDnsDomains'))
       .hasValue(this.parsedRootCert.permittedDnsDomains, 'form is prefilled with values from old root');
-    await click(SELECTORS.generateRootCancel);
+    await click(GENERAL.cancelButton);
     assert.ok(this.onCancel.calledOnce, 'custom form calls @onCancel passed from parent');
     await click(SELECTORS.oldRadioSelect);
-    await click(SELECTORS.rotateRootCancel);
+    await click(GENERAL.cancelButton);
     assert.ok(this.onCancel.calledTwice, 'old root settings form calls @onCancel from parent');
 
     // validations
-    await fillIn(SELECTORS.input('commonName'), '');
-    await fillIn(SELECTORS.input('issuerName'), 'default');
-    await click(SELECTORS.rotateRootSave);
+    await fillIn(GENERAL.inputByAttr('commonName'), '');
+    await fillIn(GENERAL.inputByAttr('issuerName'), 'default');
+    await click(GENERAL.submitButton);
     assert.dom(SELECTORS.validationError).hasText('There are 2 errors with this form.');
-    assert.dom(SELECTORS.input('commonName')).hasClass('has-error-border', 'common name has error border');
-    assert.dom(SELECTORS.input('issuerName')).hasClass('has-error-border', 'issuer name has error border');
+    assert.dom(GENERAL.validationErrorByAttr('commonName')).exists();
+    assert.dom(GENERAL.validationErrorByAttr('issuerName')).exists();
   });
 
   test('it sends request to rotate/internal on save when using old root settings', async function (assert) {
@@ -151,7 +147,7 @@ module('Integration | Component | page/pki-issuer-rotate-root', function (hooks)
     `,
       { owner: this.engine }
     );
-    await click(SELECTORS.rotateRootSave);
+    await click(GENERAL.submitButton);
   });
 
   function testEndpoint(test, type) {
@@ -173,8 +169,8 @@ module('Integration | Component | page/pki-issuer-rotate-root', function (hooks)
         { owner: this.engine }
       );
       await click(SELECTORS.customRadioSelect);
-      await fillIn(SELECTORS.typeField, type);
-      await click(SELECTORS.generateRootSave);
+      await fillIn(GENERAL.inputByAttr('type'), type);
+      await click(GENERAL.submitButton);
     });
   }
   testEndpoint(test, 'internal');
@@ -205,21 +201,21 @@ module('Integration | Component | page/pki-issuer-rotate-root', function (hooks)
       `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.pageTitle).hasText('View Issuer Certificate');
+    assert.dom(GENERAL.title).hasText('View Issuer Certificate');
     assert
       .dom(SELECTORS.nextSteps)
       .hasText(
         'Next steps Your new root has been generated. Make sure to copy and save the private_key as it is only available once. If you’re ready, you can begin cross-signing issuers now. If not, the option to cross-sign is available when you use this certificate. Cross-sign issuers'
       );
-    assert.dom(SELECTORS.infoRowValue('Certificate')).exists();
-    assert.dom(SELECTORS.infoRowValue('Issuer name')).exists();
-    assert.dom(SELECTORS.infoRowValue('Issuing CA')).exists();
-    assert.dom(SELECTORS.infoRowValue('Private key')).exists();
-    assert.dom(`${SELECTORS.infoRowValue('Private key type')} span`).hasText('rsa');
-    assert.dom(SELECTORS.infoRowValue('Serial number')).hasText(this.returnedData.serial_number);
-    assert.dom(SELECTORS.infoRowValue('Key ID')).hasText(this.returnedData.key_id);
+    assert.dom(GENERAL.infoRowValue('Certificate')).exists();
+    assert.dom(GENERAL.infoRowValue('Issuer name')).exists();
+    assert.dom(GENERAL.infoRowValue('Issuing CA')).exists();
+    assert.dom(GENERAL.infoRowValue('Private key')).exists();
+    assert.dom(`${GENERAL.infoRowValue('Private key type')}`).hasText('rsa');
+    assert.dom(GENERAL.infoRowValue('Serial number')).hasText(this.returnedData.serial_number);
+    assert.dom(GENERAL.infoRowValue('Key ID')).hasText(this.returnedData.key_id);
 
-    await click(SELECTORS.doneButton);
+    await click(PKI_CONFIGURE_CREATE.doneButton);
     assert.ok(this.onComplete.calledOnce, 'clicking done fires @onComplete from parent');
   });
 
@@ -242,7 +238,7 @@ module('Integration | Component | page/pki-issuer-rotate-root', function (hooks)
       `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.pageTitle).hasText('View Issuer Certificate');
+    assert.dom(GENERAL.title).hasText('View Issuer Certificate');
     assert.dom(SELECTORS.toolbarCrossSign).exists();
     assert.dom(SELECTORS.toolbarSignInt).exists();
     assert.dom(SELECTORS.toolbarDownload).exists();
@@ -251,13 +247,13 @@ module('Integration | Component | page/pki-issuer-rotate-root', function (hooks)
       .hasText(
         'Next steps Your new root has been generated. If you’re ready, you can begin cross-signing issuers now. If not, the option to cross-sign is available when you use this certificate. Cross-sign issuers'
       );
-    assert.dom(SELECTORS.infoRowValue('Certificate')).exists();
-    assert.dom(SELECTORS.infoRowValue('Issuer name')).exists();
-    assert.dom(SELECTORS.infoRowValue('Issuing CA')).exists();
-    assert.dom(`${SELECTORS.infoRowValue('Private key')} span`).hasText('internal');
-    assert.dom(`${SELECTORS.infoRowValue('Private key type')} span`).hasText('internal');
-    assert.dom(SELECTORS.infoRowValue('Serial number')).hasText(this.returnedData.serial_number);
-    assert.dom(SELECTORS.infoRowValue('Key ID')).hasText(this.returnedData.key_id);
+    assert.dom(GENERAL.infoRowValue('Certificate')).exists();
+    assert.dom(GENERAL.infoRowValue('Issuer name')).exists();
+    assert.dom(GENERAL.infoRowValue('Issuing CA')).exists();
+    assert.dom(`${GENERAL.infoRowValue('Private key')} div`).hasText('internal');
+    assert.dom(`${GENERAL.infoRowValue('Private key type')} div`).hasText('internal');
+    assert.dom(GENERAL.infoRowValue('Serial number')).hasText(this.returnedData.serial_number);
+    assert.dom(GENERAL.infoRowValue('Key ID')).hasText(this.returnedData.key_id);
 
     await click(SELECTORS.doneButton);
     assert.ok(this.onComplete.calledOnce, 'clicking done fires @onComplete from parent');
diff --git a/ui/tests/integration/components/pki/page/pki-key-details-test.js b/ui/tests/integration/components/pki/page/pki-key-details-test.js
index f0dc9619d94..82f087f0062 100644
--- a/ui/tests/integration/components/pki/page/pki-key-details-test.js
+++ b/ui/tests/integration/components/pki/page/pki-key-details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,8 @@ import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/page/pki-keys';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { PKI_KEYS } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Integration | Component | pki key details page', function (hooks) {
   setupRenderingTest(hooks);
@@ -48,14 +49,16 @@ module('Integration | Component | pki key details page', function (hooks) {
       { owner: this.engine }
     );
 
-    assert.dom(SELECTORS.keyIdValue).hasText(' 724862ff-6438-bad0-b598-77a6c7f4e934', 'key id renders');
-    assert.dom(SELECTORS.keyNameValue).hasText('test-key', 'key name renders');
-    assert.dom(SELECTORS.keyTypeValue).hasText('ec', 'key type renders');
-    assert.dom(SELECTORS.keyBitsValue).doesNotExist('does not render empty value');
-    assert.dom(SELECTORS.keyEditLink).exists('renders edit link');
-    assert.dom(SELECTORS.keyDeleteButton).exists('renders delete button');
-    await click(SELECTORS.keyDeleteButton);
-    await click(SELECTORS.confirmDelete);
+    assert
+      .dom(GENERAL.infoRowValue('Key ID'))
+      .hasText(' 724862ff-6438-bad0-b598-77a6c7f4e934', 'key id renders');
+    assert.dom(GENERAL.infoRowValue('Key name')).hasText('test-key', 'key name renders');
+    assert.dom(GENERAL.infoRowValue('Key type')).hasText('ec', 'key type renders');
+    assert.dom(GENERAL.infoRowLabel('Key bits')).doesNotExist('does not render empty value');
+    assert.dom(PKI_KEYS.keyEditLink).exists('renders edit link');
+    assert.dom(PKI_KEYS.keyDeleteButton).exists('renders delete button');
+    await click(PKI_KEYS.keyDeleteButton);
+    await click(GENERAL.confirmButton);
   });
 
   test('it does not render actions when capabilities are false', async function (assert) {
@@ -72,8 +75,8 @@ module('Integration | Component | pki key details page', function (hooks) {
       { owner: this.engine }
     );
 
-    assert.dom(SELECTORS.keyDeleteButton).doesNotExist('does not render delete button if no permission');
-    assert.dom(SELECTORS.keyEditLink).doesNotExist('does not render edit button if no permission');
+    assert.dom(PKI_KEYS.keyDeleteButton).doesNotExist('does not render delete button if no permission');
+    assert.dom(PKI_KEYS.keyEditLink).doesNotExist('does not render edit button if no permission');
   });
 
   test('it renders the private key as a <CertificateCard> component when there is a private key', async function (assert) {
@@ -81,9 +84,9 @@ module('Integration | Component | pki key details page', function (hooks) {
     await render(
       hbs`
         <Page::PkiKeyDetails
-          @key={{this.model}} 
+          @key={{this.model}}
           @canDelete={{false}}
-          @canEdit={{false}} 
+          @canEdit={{false}}
         />
       `,
       { owner: this.engine }
diff --git a/ui/tests/integration/components/pki/page/pki-key-list-test.js b/ui/tests/integration/components/pki/page/pki-key-list-test.js
index a9f56c30153..af1afdfeeb3 100644
--- a/ui/tests/integration/components/pki/page/pki-key-list-test.js
+++ b/ui/tests/integration/components/pki/page/pki-key-list-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,8 +9,9 @@ import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/page/pki-keys';
-import { STANDARD_META } from 'vault/tests/helpers/pki';
+import { STANDARD_META } from 'vault/tests/helpers/pagination';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { PKI_KEYS } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Integration | Component | pki key list page', function (hooks) {
   setupRenderingTest(hooks);
@@ -61,8 +62,8 @@ module('Integration | Component | pki key list page', function (hooks) {
     assert
       .dom('[data-test-empty-state-title]')
       .hasText('No keys yet', 'renders empty state that no keys exist');
-    assert.dom(SELECTORS.importKey).exists('renders toolbar with import action');
-    assert.dom(SELECTORS.generateKey).exists('renders toolbar with generate action');
+    assert.dom(PKI_KEYS.importKey).exists('renders toolbar with import action');
+    assert.dom(PKI_KEYS.generateKey).exists('renders toolbar with generate action');
   });
 
   test('it renders list of keys and actions when permission allowed', async function (assert) {
@@ -80,15 +81,15 @@ module('Integration | Component | pki key list page', function (hooks) {
       `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.keyName).hasText('test-key', 'linked block renders key id');
+    assert.dom(PKI_KEYS.keyName).hasText('test-key', 'linked block renders key id');
     assert
-      .dom(SELECTORS.keyId)
+      .dom(PKI_KEYS.keyId)
       .hasText('724862ff-6438-bad0-b598-77a6c7f4e934', 'linked block renders key name');
-    assert.dom(SELECTORS.importKey).exists('renders import action');
-    assert.dom(SELECTORS.generateKey).exists('renders generate action');
-    await click(SELECTORS.popupMenuTrigger);
-    assert.dom(SELECTORS.popupMenuDetails).exists('details link exists');
-    assert.dom(SELECTORS.popupMenuEdit).exists('edit link exists');
+    assert.dom(PKI_KEYS.importKey).exists('renders import action');
+    assert.dom(PKI_KEYS.generateKey).exists('renders generate action');
+    await click(GENERAL.menuTrigger);
+    assert.dom(PKI_KEYS.popupMenuDetails).exists('details link exists');
+    assert.dom(PKI_KEYS.popupMenuEdit).exists('edit link exists');
   });
 
   test('it hides actions when permission denied', async function (assert) {
@@ -106,8 +107,8 @@ module('Integration | Component | pki key list page', function (hooks) {
       `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.importKey).doesNotExist('renders import action');
-    assert.dom(SELECTORS.generateKey).doesNotExist('renders generate action');
-    assert.dom(SELECTORS.popupMenuTrigger).doesNotExist('does not render popup menu when no permission');
+    assert.dom(PKI_KEYS.importKey).doesNotExist('renders import action');
+    assert.dom(PKI_KEYS.generateKey).doesNotExist('renders generate action');
+    assert.dom(GENERAL.menuTrigger).doesNotExist('does not render popup menu when no permission');
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-overview-test.js b/ui/tests/integration/components/pki/page/pki-overview-test.js
index dbb5562ddca..b8114bfce37 100644
--- a/ui/tests/integration/components/pki/page/pki-overview-test.js
+++ b/ui/tests/integration/components/pki/page/pki-overview-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,8 +9,10 @@ import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/overview';
+import { PKI_OVERVIEW } from 'vault/tests/helpers/pki/pki-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
+const { overviewCard } = GENERAL;
 module('Integration | Component | Page::PkiOverview', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'pki');
@@ -39,9 +41,11 @@ module('Integration | Component | Page::PkiOverview', function (hooks) {
       hbs`<Page::PkiOverview @issuers={{this.issuers}} @roles={{this.roles}} @engine={{this.engineId}} />,`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.issuersCardTitle).hasText('Issuers');
-    assert.dom(SELECTORS.issuersCardOverviewNum).hasText('2');
-    assert.dom(SELECTORS.issuersCardLink).hasText('View issuers');
+    assert
+      .dom(overviewCard.container('Issuers'))
+      .hasText(
+        'Issuers View issuers The total number of issuers in this PKI mount. Includes both root and intermediate certificates. 2'
+      );
   });
 
   test('shows the correct information on roles card', async function (assert) {
@@ -49,15 +53,21 @@ module('Integration | Component | Page::PkiOverview', function (hooks) {
       hbs`<Page::PkiOverview @issuers={{this.issuers}} @roles={{this.roles}} @engine={{this.engineId}} />,`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.rolesCardTitle).hasText('Roles');
-    assert.dom(SELECTORS.rolesCardOverviewNum).hasText('3');
-    assert.dom(SELECTORS.rolesCardLink).hasText('View roles');
+    assert
+      .dom(overviewCard.container('Roles'))
+      .hasText(
+        'Roles View roles The total number of roles in this PKI mount that have been created to generate certificates. 3'
+      );
     this.roles = 404;
     await render(
       hbs`<Page::PkiOverview @issuers={{this.issuers}} @roles={{this.roles}} @engine={{this.engineId}} />,`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.rolesCardOverviewNum).hasText('0');
+    assert
+      .dom(overviewCard.container('Roles'))
+      .hasText(
+        'Roles View roles The total number of roles in this PKI mount that have been created to generate certificates. 0'
+      );
   });
 
   test('shows the input search fields for View Certificates card', async function (assert) {
@@ -65,9 +75,9 @@ module('Integration | Component | Page::PkiOverview', function (hooks) {
       hbs`<Page::PkiOverview @issuers={{this.issuers}} @roles={{this.roles}} @engine={{this.engineId}} />,`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.issueCertificate).hasText('Issue certificate');
-    assert.dom(SELECTORS.issueCertificateInput).exists();
-    assert.dom(SELECTORS.issueCertificateButton).hasText('Issue');
+    assert.dom(overviewCard.title('Issue certificate')).hasText('Issue certificate');
+    assert.dom(PKI_OVERVIEW.issueCertificateInput).exists();
+    assert.dom(PKI_OVERVIEW.issueCertificateButton).hasText('Issue');
   });
 
   test('shows the input search fields for Issue Certificates card', async function (assert) {
@@ -75,8 +85,8 @@ module('Integration | Component | Page::PkiOverview', function (hooks) {
       hbs`<Page::PkiOverview @issuers={{this.issuers}} @roles={{this.roles}} @engine={{this.engineId}} />,`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.viewCertificate).hasText('View certificate');
-    assert.dom(SELECTORS.viewCertificateInput).exists();
-    assert.dom(SELECTORS.viewCertificateButton).hasText('View');
+    assert.dom(overviewCard.title('View certificate')).hasText('View certificate');
+    assert.dom(PKI_OVERVIEW.viewCertificateInput).exists();
+    assert.dom(PKI_OVERVIEW.viewCertificateButton).hasText('View');
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-role-details-test.js b/ui/tests/integration/components/pki/page/pki-role-details-test.js
index 018a2883b6b..f549d6556de 100644
--- a/ui/tests/integration/components/pki/page/pki-role-details-test.js
+++ b/ui/tests/integration/components/pki/page/pki-role-details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,7 @@ import { setupRenderingTest } from 'ember-qunit';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/page/pki-role-details';
+import { PKI_ROLE_DETAILS } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Integration | Component | pki role details page', function (hooks) {
   setupRenderingTest(hooks);
@@ -20,6 +20,7 @@ module('Integration | Component | pki role details page', function (hooks) {
       name: 'Foobar',
       backend: 'pki',
       noStore: false,
+      noStoreMetadata: true,
       keyUsage: [],
       extKeyUsage: ['bar', 'baz'],
       ttl: 600,
@@ -27,22 +28,40 @@ module('Integration | Component | pki role details page', function (hooks) {
   });
 
   test('it should render the page component', async function (assert) {
-    assert.expect(5);
     await render(
       hbs`
       <Page::PkiRoleDetails @role={{this.model}} />
   `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.issuerLabel).hasText('Issuer', 'Label is');
+    assert.dom(PKI_ROLE_DETAILS.issuerLabel).hasText('Issuer', 'Label is');
     assert
-      .dom(`${SELECTORS.keyUsageValue} [data-test-icon="minus"]`)
+      .dom(`${PKI_ROLE_DETAILS.keyUsageValue} [data-test-icon="minus"]`)
       .exists('Key usage shows dash when array is empty');
     assert
-      .dom(SELECTORS.extKeyUsageValue)
+      .dom(PKI_ROLE_DETAILS.extKeyUsageValue)
       .hasText('bar,baz', 'Key usage shows comma-joined values when array has items');
-    assert.dom(SELECTORS.noStoreValue).containsText('Yes', 'noStore shows opposite of what the value is');
-    assert.dom(SELECTORS.customTtlValue).containsText('10 minutes', 'TTL shown as duration');
+    assert
+      .dom(PKI_ROLE_DETAILS.noStoreValue)
+      .containsText('Yes', 'noStore shows opposite of what the value is');
+    assert
+      .dom(PKI_ROLE_DETAILS.noStoreMetadataValue)
+      .doesNotExist('does not render value for enterprise-only field');
+    assert.dom(PKI_ROLE_DETAILS.customTtlValue).containsText('10 minutes', 'TTL shown as duration');
+  });
+
+  test('it should render the enterprise-only values in enterprise edition', async function (assert) {
+    const version = this.owner.lookup('service:version');
+    version.type = 'enterprise';
+    await render(
+      hbs`
+      <Page::PkiRoleDetails @role={{this.model}} />
+  `,
+      { owner: this.engine }
+    );
+    assert
+      .dom(PKI_ROLE_DETAILS.noStoreMetadataValue)
+      .containsText('No', 'noStoreMetadata shows opposite of what the value is');
   });
 
   test('it should render the notAfter date if present', async function (assert) {
@@ -61,6 +80,8 @@ module('Integration | Component | pki role details page', function (hooks) {
   `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.customTtlValue).containsText('May', 'Formats the notAfter date instead of TTL');
+    assert
+      .dom(PKI_ROLE_DETAILS.customTtlValue)
+      .containsText('May', 'Formats the notAfter date instead of TTL');
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-tidy-auto-settings-test.js b/ui/tests/integration/components/pki/page/pki-tidy-auto-settings-test.js
index 04ca72e753e..a1f1daff21c 100644
--- a/ui/tests/integration/components/pki/page/pki-tidy-auto-settings-test.js
+++ b/ui/tests/integration/components/pki/page/pki-tidy-auto-settings-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,6 +8,7 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | page/pki-tidy-auto-settings', function (hooks) {
   setupRenderingTest(hooks);
@@ -21,10 +22,10 @@ module('Integration | Component | page/pki-tidy-auto-settings', function (hooks)
     this.store = this.owner.lookup('service:store');
 
     this.breadcrumbs = [
-      { label: 'secrets', route: 'secrets', linkExternal: true },
-      { label: backend, route: 'overview' },
-      { label: 'tidy', route: 'tidy.index' },
-      { label: 'auto' },
+      { label: 'Secrets', route: 'secrets', linkExternal: true },
+      { label: backend, route: 'overview', model: backend },
+      { label: 'Tidy', route: 'tidy.index', model: backend },
+      { label: 'Auto' },
     ];
   });
 
@@ -50,23 +51,26 @@ module('Integration | Component | page/pki-tidy-auto-settings', function (hooks)
       .dom('[data-test-pki-edit-tidy-auto-link]')
       .hasText('Edit auto-tidy', 'toolbar edit link has correct text');
 
-    assert.dom('[data-test-row="enabled"] [data-test-label-div]').hasText('Automatic tidy enabled');
-    assert.dom('[data-test-row="intervalDuration"] [data-test-label-div]').hasText('Automatic tidy duration');
+    assert.dom('[data-test-row="enabled"] [data-test-row-label]').hasText('Automatic tidy enabled');
+    assert.dom(GENERAL.infoRowValue('Automatic tidy enabled')).hasText('No');
+    assert.dom(GENERAL.infoRowValue('Interval duration')).hasText('2 days');
     // Universal operations
     assert.dom('[data-test-group-title="Universal operations"]').hasText('Universal operations');
     assert
-      .dom('[data-test-value-div="Tidy the certificate store"]')
+      .dom(GENERAL.infoRowValue('Tidy the certificate store'))
       .exists('Renders universal field when value exists');
+    assert.dom(GENERAL.infoRowValue('Tidy the certificate store')).hasText('No');
     assert
-      .dom('[data-test-value-div="Tidy revoked certificates"]')
+      .dom(GENERAL.infoRowValue('Tidy revoked certificates'))
       .doesNotExist('Does not render universal field when value null');
     // Issuer operations
     assert.dom('[data-test-group-title="Issuer operations"]').hasText('Issuer operations');
     assert
-      .dom('[data-test-value-div="Tidy expired issuers"]')
+      .dom(GENERAL.infoRowValue('Tidy expired issuers'))
       .exists('Renders issuer op field when value exists');
+    assert.dom(GENERAL.infoRowValue('Tidy expired issuers')).hasText('Yes');
     assert
-      .dom('[data-test-value-div="Tidy legacy CA bundle"]')
+      .dom(GENERAL.infoRowValue('Tidy legacy CA bundle'))
       .doesNotExist('Does not render issuer op field when value null');
   });
 });
diff --git a/ui/tests/integration/components/pki/page/pki-tidy-status-test.js b/ui/tests/integration/components/pki/page/pki-tidy-status-test.js
index 610d91bd2dc..001d2df0b29 100644
--- a/ui/tests/integration/components/pki/page/pki-tidy-status-test.js
+++ b/ui/tests/integration/components/pki/page/pki-tidy-status-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,7 @@ import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/page/pki-tidy';
+import { PKI_TIDY } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Integration | Component | Page::PkiTidyStatus', function (hooks) {
   setupRenderingTest(hooks);
@@ -62,44 +62,44 @@ module('Integration | Component | Page::PkiTidyStatus', function (hooks) {
       { owner: this.engine }
     );
     // running state
-    assert.dom(SELECTORS.hdsAlertTitle).hasText('Tidy in progress');
-    assert.dom(SELECTORS.cancelTidyAction).exists();
-    assert.dom(SELECTORS.hdsAlertButtonText).hasText('Cancel tidy');
+    assert.dom(PKI_TIDY.hdsAlertTitle).hasText('Tidy in progress');
+    assert.dom(PKI_TIDY.cancelTidyAction).exists();
+    assert.dom(PKI_TIDY.hdsAlertButtonText).hasText('Cancel tidy');
     // inactive state
     this.tidyStatus.state = 'Inactive';
     await render(
       hbs`<Page::PkiTidyStatus @autoTidyConfig={{this.autoTidyConfig}} @tidyStatus={{this.tidyStatus}} />`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.hdsAlertTitle).hasText('Tidy is inactive');
+    assert.dom(PKI_TIDY.hdsAlertTitle).hasText('Tidy is inactive');
     // finished state
     this.tidyStatus.state = 'Finished';
     await render(
       hbs`<Page::PkiTidyStatus @autoTidyConfig={{this.autoTidyConfig}} @tidyStatus={{this.tidyStatus}} />`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.hdsAlertTitle).hasText('Tidy operation finished');
+    assert.dom(PKI_TIDY.hdsAlertTitle).hasText('Tidy operation finished');
     // error state
     this.tidyStatus.state = 'Error';
     await render(
       hbs`<Page::PkiTidyStatus @autoTidyConfig={{this.autoTidyConfig}} @tidyStatus={{this.tidyStatus}} />`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.hdsAlertTitle).hasText('Tidy operation failed');
+    assert.dom(PKI_TIDY.hdsAlertTitle).hasText('Tidy operation failed');
     // cancelling state
     this.tidyStatus.state = 'Cancelling';
     await render(
       hbs`<Page::PkiTidyStatus @autoTidyConfig={{this.autoTidyConfig}} @tidyStatus={{this.tidyStatus}} />`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.hdsAlertTitle).hasText('Tidy operation cancelling');
+    assert.dom(PKI_TIDY.hdsAlertTitle).hasText('Tidy operation cancelling');
     // cancelled state
     this.tidyStatus.state = 'Cancelled';
     await render(
       hbs`<Page::PkiTidyStatus @autoTidyConfig={{this.autoTidyConfig}} @tidyStatus={{this.tidyStatus}} />`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.hdsAlertTitle).hasText('Tidy operation cancelled');
+    assert.dom(PKI_TIDY.hdsAlertTitle).hasText('Tidy operation cancelled');
   });
   test('shows the fields even if the data returns null values', async function (assert) {
     this.tidyStatus.time_started = null;
@@ -108,7 +108,7 @@ module('Integration | Component | Page::PkiTidyStatus', function (hooks) {
       hbs`<Page::PkiTidyStatus @autoTidyConfig={{this.autoTidyConfig}} @tidyStatus={{this.tidyStatus}} />`,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.timeStartedRow).exists();
-    assert.dom(SELECTORS.timeFinishedRow).exists();
+    assert.dom(PKI_TIDY.timeStartedRow).exists();
+    assert.dom(PKI_TIDY.timeFinishedRow).exists();
   });
 });
diff --git a/ui/tests/integration/components/pki/parsed-certificate-info-rows-test.js b/ui/tests/integration/components/pki/parsed-certificate-info-rows-test.js
index aa318e31c78..74568aa9748 100644
--- a/ui/tests/integration/components/pki/parsed-certificate-info-rows-test.js
+++ b/ui/tests/integration/components/pki/parsed-certificate-info-rows-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,6 +8,7 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | parsed-certificate-info-rows', function (hooks) {
   setupRenderingTest(hooks);
@@ -37,10 +38,10 @@ module('Integration | Component | parsed-certificate-info-rows', function (hooks
     });
     assert.dom('[data-test-component="info-table-row"]').exists({ count: 2 }, 'renders 2 rows');
 
-    assert.dom('[data-test-value-div="Common name"]').doesNotExist('common name is never rendered');
+    assert.dom(GENERAL.infoRowValue('Common name')).doesNotExist('common name is never rendered');
     assert.dom('[data-test-row-value="Subject Alternative Names (SANs)"]').hasText('something,here');
-    assert.dom('[data-test-value-div="Use PSS"]').hasText('No', 'Booleans are rendered');
-    assert.dom('[data-test-value-div="ttl"]').doesNotExist('ttl is not rendered because value undefined');
+    assert.dom(GENERAL.infoRowValue('Use PSS')).hasText('No', 'Booleans are rendered');
+    assert.dom(GENERAL.infoRowValue('ttl')).doesNotExist('ttl is not rendered because value undefined');
     assert
       .dom('[data-test-parsing-error-alert-banner]')
       .doesNotExist('does not render parsing error info banner');
diff --git a/ui/tests/integration/components/pki/pki-generate-csr-test.js b/ui/tests/integration/components/pki/pki-generate-csr-test.js
index 7f4d6aa3f2a..dcacdd74b46 100644
--- a/ui/tests/integration/components/pki/pki-generate-csr-test.js
+++ b/ui/tests/integration/components/pki/pki-generate-csr-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,6 +10,8 @@ import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
 
 module('Integration | Component | pki-generate-csr', function (hooks) {
   setupRenderingTest(hooks);
@@ -36,10 +38,15 @@ module('Integration | Component | pki-generate-csr', function (hooks) {
         'link-name': { enabled: false },
       },
     });
+    this.clipboardSpy = sinon.stub(navigator.clipboard, 'writeText').resolves();
+  });
+
+  hooks.afterEach(function () {
+    sinon.restore(); // resets all stubs, including clipboard
   });
 
   test('it should render fields and save', async function (assert) {
-    assert.expect(9);
+    assert.expect(11);
 
     this.server.post('/pki-test/issuers/generate/intermediate/exported', (schema, req) => {
       const payload = JSON.parse(req.requestBody);
@@ -66,11 +73,15 @@ module('Integration | Component | pki-generate-csr', function (hooks) {
       assert.dom(`[data-test-input="${key}"]`).exists(`${key} form field renders`);
     });
 
-    assert.dom('[data-test-toggle-group]').exists({ count: 3 }, 'Toggle groups render');
+    assert.dom(GENERAL.button('Key parameters')).exists('Key parameters toggle renders');
+    assert.dom(GENERAL.button('Subject Alternative Name (SAN) Options')).exists('SAN options toggle renders');
+    assert
+      .dom(GENERAL.button('Additional subject fields'))
+      .exists('Additional subject fields toggle renders');
 
-    await fillIn('[data-test-input="type"]', 'exported');
-    await fillIn('[data-test-input="commonName"]', 'foo');
-    await click('[data-test-save]');
+    await fillIn(GENERAL.inputByAttr('type'), 'exported');
+    await fillIn(GENERAL.inputByAttr('commonName'), 'foo');
+    await click(GENERAL.submitButton);
 
     const savedRecord = this.store.peekAll('pki/action')[0];
     assert.false(savedRecord.isNew, 'record is saved');
@@ -88,13 +99,13 @@ module('Integration | Component | pki-generate-csr', function (hooks) {
       }
     );
 
-    await click('[data-test-save]');
+    await click(GENERAL.submitButton);
 
     assert
-      .dom('[data-test-field-validation="type"]')
+      .dom(GENERAL.validationErrorByAttr('type'))
       .hasText('Type is required.', 'Type validation error renders');
     assert
-      .dom('[data-test-field="commonName"] [data-test-inline-alert]')
+      .dom(GENERAL.validationErrorByAttr('commonName'))
       .hasText('Common name is required.', 'Common name validation error renders');
     assert.dom('[data-test-alert]').hasText('There are 2 errors with this form.', 'Alert renders');
 
@@ -120,17 +131,21 @@ module('Integration | Component | pki-generate-csr', function (hooks) {
         'renders Next steps alert banner'
       );
 
+    await click(`${GENERAL.infoRowValue('CSR')} ${GENERAL.copyButton}`);
+    assert.strictEqual(this.clipboardSpy.firstCall.args[0], this.model.csr, 'copy value is csr');
+
+    await click(`${GENERAL.infoRowValue('Key ID')} ${GENERAL.copyButton}`);
+    assert.strictEqual(this.clipboardSpy.secondCall.args[0], this.model.keyId, 'copy value is key_id');
+
+    await click(`${GENERAL.infoRowValue('Private key')} ${GENERAL.copyButton}`);
+    assert.strictEqual(
+      this.clipboardSpy.thirdCall.args[0],
+      this.model.privateKey,
+      'copy value is private_key'
+    );
+
     assert
-      .dom('[data-test-value-div="CSR"] [data-test-certificate-card] button')
-      .hasAttribute('data-test-copy-button', this.model.csr, 'it renders copyable csr');
-    assert
-      .dom('[data-test-value-div="Key ID"] button')
-      .hasAttribute('data-test-copy-button', this.model.keyId, 'it renders copyable key_id');
-    assert
-      .dom('[data-test-value-div="Private key"] [data-test-certificate-card] button')
-      .hasAttribute('data-test-copy-button', this.model.privateKey, 'it renders copyable private_key');
-    assert
-      .dom('[data-test-value-div="Private key type"]')
+      .dom(GENERAL.infoRowValue('Private key type'))
       .hasText(this.model.privateKeyType, 'renders private_key_type');
     await click('[data-test-done]');
   });
@@ -151,15 +166,15 @@ module('Integration | Component | pki-generate-csr', function (hooks) {
         'Next steps Copy the CSR below for a parent issuer to sign and then import the signed certificate back into this mount.',
         'renders Next steps alert banner'
       );
+    await click(`${GENERAL.infoRowValue('CSR')} ${GENERAL.copyButton}`);
+    assert.strictEqual(this.clipboardSpy.firstCall.args[0], this.model.csr, 'copy value is csr');
+
+    await click(`${GENERAL.infoRowValue('Key ID')} ${GENERAL.copyButton}`);
+    assert.strictEqual(this.clipboardSpy.secondCall.args[0], this.model.keyId, 'copy value is key_id');
+
+    assert.dom(GENERAL.infoRowValue('Private key')).hasText('internal', 'does not render private key');
     assert
-      .dom('[data-test-value-div="CSR"] [data-test-certificate-card] button')
-      .hasAttribute('data-test-copy-button', this.model.csr, 'it renders copyable csr');
-    assert
-      .dom('[data-test-value-div="Key ID"] button')
-      .hasAttribute('data-test-copy-button', this.model.keyId, 'it renders copyable key_id');
-    assert.dom('[data-test-value-div="Private key"]').hasText('internal', 'does not render private key');
-    assert
-      .dom('[data-test-value-div="Private key type"]')
+      .dom(GENERAL.infoRowValue('Private key type'))
       .hasText('internal', 'does not render private key type');
   });
 });
diff --git a/ui/tests/integration/components/pki/pki-generate-root-test.js b/ui/tests/integration/components/pki/pki-generate-root-test.js
index 9e7c6120b53..39a5a67aad9 100644
--- a/ui/tests/integration/components/pki/pki-generate-root-test.js
+++ b/ui/tests/integration/components/pki/pki-generate-root-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,8 @@ import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import Sinon from 'sinon';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-generate-root';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { PKI_GENERATE_ROOT } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Integration | Component | pki-generate-root', function (hooks) {
   setupRenderingTest(hooks);
@@ -38,8 +39,12 @@ module('Integration | Component | pki-generate-root', function (hooks) {
     );
 
     assert.dom('h2').exists({ count: 1 }, 'One H2 title without @urls');
-    assert.dom(SELECTORS.mainSectionTitle).hasText('Root parameters');
-    assert.dom('[data-test-toggle-group]').exists({ count: 3 }, '3 toggle groups shown');
+    assert.dom(PKI_GENERATE_ROOT.mainSectionTitle).hasText('Root parameters');
+    assert.dom(GENERAL.button('Key parameters')).exists('Key parameters toggle renders');
+    assert.dom(GENERAL.button('Subject Alternative Name (SAN) Options')).exists('SAN options toggle renders');
+    assert
+      .dom(GENERAL.button('Additional subject fields'))
+      .exists('Additional subject fields toggle renders');
   });
 
   test('it shows the appropriate fields under the toggles', async function (assert) {
@@ -50,33 +55,33 @@ module('Integration | Component | pki-generate-root', function (hooks) {
       }
     );
 
-    await click(SELECTORS.additionalGroupToggle);
+    await click(GENERAL.button('Additional subject fields'));
     assert
-      .dom(SELECTORS.toggleGroupDescription)
+      .dom(PKI_GENERATE_ROOT.toggleGroupDescription)
       .hasText('These fields provide more information about the client to which the certificate belongs.');
     assert
-      .dom(`[data-test-group="Additional subject fields"] ${SELECTORS.formField}`)
+      .dom(PKI_GENERATE_ROOT.groupFields('Additional subject fields'))
       .exists({ count: 7 }, '7 form fields under Additional Fields toggle');
 
-    await click(SELECTORS.sanGroupToggle);
+    await click(GENERAL.button('Subject Alternative Name (SAN) Options'));
     assert
-      .dom(SELECTORS.toggleGroupDescription)
+      .dom(PKI_GENERATE_ROOT.toggleGroupDescription)
       .hasText(
         'SAN fields are an extension that allow you specify additional host names (sites, IP addresses, common names, etc.) to be protected by a single certificate.'
       );
     assert
-      .dom(`[data-test-group="Subject Alternative Name (SAN) Options"] ${SELECTORS.formField}`)
+      .dom(PKI_GENERATE_ROOT.groupFields('Subject Alternative Name (SAN) Options'))
       .exists({ count: 6 }, '7 form fields under SANs toggle');
 
-    await click(SELECTORS.keyParamsGroupToggle);
+    await click(GENERAL.button('Key parameters'));
     assert
-      .dom(SELECTORS.toggleGroupDescription)
+      .dom(PKI_GENERATE_ROOT.toggleGroupDescription)
       .hasText(
         'Please choose a type to see key parameter options.',
         'Shows empty state description before type is selected'
       );
     assert
-      .dom(`[data-test-group="Key parameters"] ${SELECTORS.formField}`)
+      .dom(PKI_GENERATE_ROOT.groupFields('Key parameters'))
       .exists({ count: 0 }, '0 form fields under keyParams toggle');
   });
 
@@ -88,75 +93,75 @@ module('Integration | Component | pki-generate-root', function (hooks) {
         owner: this.engine,
       }
     );
-    await click(SELECTORS.keyParamsGroupToggle);
+    await click(GENERAL.button('Key parameters'));
     assert
-      .dom(`[data-test-group="Key parameters"] ${SELECTORS.formField}`)
+      .dom(PKI_GENERATE_ROOT.groupFields('Key parameters'))
       .exists({ count: 0 }, '0 form fields under keyParams toggle');
 
     this.set('type', 'exported');
-    await fillIn(SELECTORS.typeField, this.type);
+    await fillIn(GENERAL.inputByAttr('type'), this.type);
     assert
-      .dom(SELECTORS.toggleGroupDescription)
+      .dom(PKI_GENERATE_ROOT.toggleGroupDescription)
       .hasText(
         'This certificate type is exported. This means the private key will be returned in the response. Below, you will name the key and define its type and key bits.',
         `has correct description for type=${this.type}`
       );
     assert.strictEqual(this.model.type, this.type);
     assert
-      .dom(`[data-test-group="Key parameters"] ${SELECTORS.formField}`)
+      .dom(PKI_GENERATE_ROOT.groupFields('Key parameters'))
       .exists({ count: 4 }, '4 form fields under keyParams toggle');
-    assert.dom(SELECTORS.fieldByName('keyName')).exists(`Key name field shown when type=${this.type}`);
-    assert.dom(SELECTORS.fieldByName('keyType')).exists(`Key type field shown when type=${this.type}`);
-    assert.dom(SELECTORS.fieldByName('keyBits')).exists(`Key bits field shown when type=${this.type}`);
+    assert.dom(GENERAL.fieldByAttr('keyName')).exists(`Key name field shown when type=${this.type}`);
+    assert.dom(GENERAL.fieldByAttr('keyType')).exists(`Key type field shown when type=${this.type}`);
+    assert.dom(GENERAL.fieldByAttr('keyBits')).exists(`Key bits field shown when type=${this.type}`);
 
     this.set('type', 'internal');
-    await fillIn(SELECTORS.typeField, this.type);
+    await fillIn(GENERAL.inputByAttr('type'), this.type);
     assert
-      .dom(SELECTORS.toggleGroupDescription)
+      .dom(PKI_GENERATE_ROOT.toggleGroupDescription)
       .hasText(
         'This certificate type is internal. This means that the private key will not be returned and cannot be retrieved later. Below, you will name the key and define its type and key bits.',
         `has correct description for type=${this.type}`
       );
     assert.strictEqual(this.model.type, this.type);
     assert
-      .dom(`[data-test-group="Key parameters"] ${SELECTORS.formField}`)
+      .dom(PKI_GENERATE_ROOT.groupFields('Key parameters'))
       .exists({ count: 3 }, '3 form fields under keyParams toggle');
-    assert.dom(SELECTORS.fieldByName('keyName')).exists(`Key name field shown when type=${this.type}`);
-    assert.dom(SELECTORS.fieldByName('keyType')).exists(`Key type field shown when type=${this.type}`);
-    assert.dom(SELECTORS.fieldByName('keyBits')).exists(`Key bits field shown when type=${this.type}`);
+    assert.dom(GENERAL.fieldByAttr('keyName')).exists(`Key name field shown when type=${this.type}`);
+    assert.dom(GENERAL.fieldByAttr('keyType')).exists(`Key type field shown when type=${this.type}`);
+    assert.dom(GENERAL.fieldByAttr('keyBits')).exists(`Key bits field shown when type=${this.type}`);
 
     this.set('type', 'existing');
-    await fillIn(SELECTORS.typeField, this.type);
+    await fillIn(GENERAL.inputByAttr('type'), this.type);
     assert
-      .dom(SELECTORS.toggleGroupDescription)
+      .dom(PKI_GENERATE_ROOT.toggleGroupDescription)
       .hasText(
         'You chose to use an existing key. This means that we’ll use the key reference to create the CSR or root. Please provide the reference to the key.',
         `has correct description for type=${this.type}`
       );
     assert.strictEqual(this.model.type, this.type);
     assert
-      .dom(`[data-test-group="Key parameters"] ${SELECTORS.formField}`)
+      .dom(PKI_GENERATE_ROOT.groupFields('Key parameters'))
       .exists({ count: 1 }, '1 form field under keyParams toggle');
-    assert.dom(SELECTORS.fieldByName('keyRef')).exists(`Key reference field shown when type=${this.type}`);
+    assert.dom(GENERAL.fieldByAttr('keyRef')).exists(`Key reference field shown when type=${this.type}`);
 
     this.set('type', 'kms');
-    await fillIn(SELECTORS.typeField, this.type);
+    await fillIn(GENERAL.inputByAttr('type'), this.type);
     assert
-      .dom(SELECTORS.toggleGroupDescription)
+      .dom(PKI_GENERATE_ROOT.toggleGroupDescription)
       .hasText(
         'This certificate type is kms, meaning managed keys will be used. Below, you will name the key and tell Vault where to find it in your KMS or HSM. Learn more about managed keys.',
         `has correct description for type=${this.type}`
       );
     assert.strictEqual(this.model.type, this.type);
     assert
-      .dom(`[data-test-group="Key parameters"] ${SELECTORS.formField}`)
+      .dom(PKI_GENERATE_ROOT.groupFields('Key parameters'))
       .exists({ count: 3 }, '3 form fields under keyParams toggle');
-    assert.dom(SELECTORS.fieldByName('keyName')).exists(`Key name field shown when type=${this.type}`);
+    assert.dom(GENERAL.fieldByAttr('keyName')).exists(`Key name field shown when type=${this.type}`);
     assert
-      .dom(SELECTORS.fieldByName('managedKeyName'))
+      .dom(GENERAL.fieldByAttr('managedKeyName'))
       .exists(`Managed key name field shown when type=${this.type}`);
     assert
-      .dom(SELECTORS.fieldByName('managedKeyId'))
+      .dom(GENERAL.fieldByAttr('managedKeyId'))
       .exists(`Managed key id field shown when type=${this.type}`);
   });
 
@@ -170,8 +175,8 @@ module('Integration | Component | pki-generate-root', function (hooks) {
       }
     );
 
-    await click(SELECTORS.generateRootSave);
-    assert.dom(SELECTORS.formInvalidError).exists('Shows overall error form');
+    await click(GENERAL.submitButton);
+    assert.dom(PKI_GENERATE_ROOT.formInvalidError).exists('Shows overall error form');
     assert.ok(saveSpy.notCalled);
   });
 
@@ -184,7 +189,7 @@ module('Integration | Component | pki-generate-root', function (hooks) {
         }
       );
 
-      assert.dom(SELECTORS.urlsSection).doesNotExist();
+      assert.dom(PKI_GENERATE_ROOT.urlsSection).doesNotExist();
     });
 
     test('it renders when urls model passed', async function (assert) {
@@ -194,9 +199,9 @@ module('Integration | Component | pki-generate-root', function (hooks) {
           owner: this.engine,
         }
       );
-      assert.dom(SELECTORS.urlsSection).exists();
+      assert.dom(PKI_GENERATE_ROOT.urlsSection).exists();
       assert.dom('h2').exists({ count: 2 }, 'two H2 titles are visible on page load');
-      assert.dom(SELECTORS.urlSectionTitle).hasText('Issuer URLs');
+      assert.dom(PKI_GENERATE_ROOT.urlSectionTitle).hasText('Issuer URLs');
     });
   });
 });
diff --git a/ui/tests/integration/components/pki/pki-generate-toggle-groups-test.js b/ui/tests/integration/components/pki/pki-generate-toggle-groups-test.js
index a6df76614ed..1e786126103 100644
--- a/ui/tests/integration/components/pki/pki-generate-toggle-groups-test.js
+++ b/ui/tests/integration/components/pki/pki-generate-toggle-groups-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,13 +8,7 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { click, render, settled } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
-
-const selectors = {
-  keys: '[data-test-toggle-group="Key parameters"]',
-  sanOptions: '[data-test-toggle-group="Subject Alternative Name (SAN) Options"]',
-  subjectFields: '[data-test-toggle-group="Additional subject fields"]',
-  toggleByName: (name) => `[data-test-toggle-group="${name}"]`,
-};
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | PkiGenerateToggleGroups', function (hooks) {
   setupRenderingTest(hooks);
@@ -29,9 +23,9 @@ module('Integration | Component | PkiGenerateToggleGroups', function (hooks) {
   test('it should render key parameters', async function (assert) {
     await render(hbs`<PkiGenerateToggleGroups @model={{this.model}} />`, { owner: this.engine });
 
-    assert.dom(selectors.keys).hasText('Key parameters', 'Key parameters group renders');
+    assert.dom(GENERAL.button('Key parameters')).hasText('Key parameters', 'Key parameters group renders');
 
-    await click(selectors.keys);
+    await click(GENERAL.button('Key parameters'));
 
     assert
       .dom('[data-test-toggle-group-description]')
@@ -61,10 +55,10 @@ module('Integration | Component | PkiGenerateToggleGroups', function (hooks) {
     await render(hbs`<PkiGenerateToggleGroups @model={{this.model}} />`, { owner: this.engine });
 
     assert
-      .dom(selectors.sanOptions)
+      .dom(GENERAL.button('Subject Alternative Name (SAN) Options'))
       .hasText('Subject Alternative Name (SAN) Options', 'SAN options group renders');
 
-    await click(selectors.sanOptions);
+    await click(GENERAL.button('Subject Alternative Name (SAN) Options'));
 
     const fields = ['excludeCnFromSans', 'subjectSerialNumber', 'altNames', 'ipSans', 'uriSans', 'otherSans'];
     assert.dom('[data-test-field]').exists({ count: 6 }, `Correct number of fields render`);
@@ -90,9 +84,11 @@ module('Integration | Component | PkiGenerateToggleGroups', function (hooks) {
   test('it should render additional subject fields', async function (assert) {
     await render(hbs`<PkiGenerateToggleGroups @model={{this.model}} />`, { owner: this.engine });
 
-    assert.dom(selectors.subjectFields).hasText('Additional subject fields', 'SAN options group renders');
+    assert
+      .dom(GENERAL.button('Additional subject fields'))
+      .hasText('Additional subject fields', 'SAN options group renders');
 
-    await click(selectors.subjectFields);
+    await click(GENERAL.button('Additional subject fields'));
 
     const fields = ['ou', 'organization', 'country', 'locality', 'province', 'streetAddress', 'postalCode'];
     assert.dom('[data-test-field]').exists({ count: fields.length }, 'Correct number of fields render');
@@ -113,16 +109,16 @@ module('Integration | Component | PkiGenerateToggleGroups', function (hooks) {
       owner: this.engine,
     });
 
-    assert.dom(selectors.toggleByName('Group A')).hasText('Group A', 'First group renders');
-    assert.dom(selectors.toggleByName('Group Z')).hasText('Group Z', 'Second group renders');
+    assert.dom(GENERAL.button('Group A')).hasText('Group A', 'First group renders');
+    assert.dom(GENERAL.button('Group Z')).hasText('Group Z', 'Second group renders');
 
-    await click(selectors.toggleByName('Group A'));
+    await click(GENERAL.button('Group A'));
     assert.dom('[data-test-field]').exists({ count: fieldsA.length }, 'Correct number of fields render');
     fieldsA.forEach((key) => {
       assert.dom(`[data-test-input="${key}"]`).exists(`${key} input renders`);
     });
 
-    await click(selectors.toggleByName('Group Z'));
+    await click(GENERAL.button('Group Z'));
     assert.dom('[data-test-field]').exists({ count: fieldsZ.length }, 'Correct number of fields render');
     fieldsZ.forEach((key) => {
       assert.dom(`[data-test-input="${key}"]`).exists(`${key} input renders`);
diff --git a/ui/tests/integration/components/pki/pki-import-pem-bundle-test.js b/ui/tests/integration/components/pki/pki-import-pem-bundle-test.js
index 9d66236426c..47fc57f17a4 100644
--- a/ui/tests/integration/components/pki/pki-import-pem-bundle-test.js
+++ b/ui/tests/integration/components/pki/pki-import-pem-bundle-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,8 +9,11 @@ import { render, click, fillIn } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { issuerPemBundle } from 'vault/tests/helpers/pki/values';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
+import { PKI_CONFIGURE_CREATE } from 'vault/tests/helpers/pki/pki-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
+const { issuerPemBundle } = CERTIFICATES;
 module('Integration | Component | PkiImportPemBundle', function (hooks) {
   setupRenderingTest(hooks);
   setupMirage(hooks);
@@ -42,8 +45,8 @@ module('Integration | Component | PkiImportPemBundle', function (hooks) {
 
     assert.dom('[data-test-pki-import-pem-bundle-form]').exists('renders form');
     assert.dom('[data-test-component="text-file"]').exists('renders text file input');
-    await click('[data-test-text-toggle]');
-    await fillIn('[data-test-text-file-textarea]', this.pemBundle);
+    await click(GENERAL.textToggle);
+    await fillIn(GENERAL.maskedInput, this.pemBundle);
     assert.strictEqual(this.model.pemBundle, this.pemBundle);
   });
 
@@ -82,10 +85,10 @@ module('Integration | Component | PkiImportPemBundle', function (hooks) {
       { owner: this.engine }
     );
 
-    await click('[data-test-text-toggle]');
-    await fillIn('[data-test-text-file-textarea]', this.pemBundle);
+    await click(GENERAL.textToggle);
+    await fillIn(GENERAL.maskedInput, this.pemBundle);
     assert.strictEqual(this.model.pemBundle, this.pemBundle, 'PEM bundle updated on model');
-    await click('[data-test-pki-import-pem-bundle]');
+    await click(PKI_CONFIGURE_CREATE.importSubmit);
   });
 
   test('it hits correct endpoint when userIssuer=false', async function (assert) {
@@ -123,10 +126,10 @@ module('Integration | Component | PkiImportPemBundle', function (hooks) {
       { owner: this.engine }
     );
 
-    await click('[data-test-text-toggle]');
-    await fillIn('[data-test-text-file-textarea]', this.pemBundle);
+    await click(GENERAL.textToggle);
+    await fillIn(GENERAL.maskedInput, this.pemBundle);
     assert.strictEqual(this.model.pemBundle, this.pemBundle);
-    await click('[data-test-pki-import-pem-bundle]');
+    await click(PKI_CONFIGURE_CREATE.importSubmit);
   });
 
   test('it shows the bundle mapping on success', async function (assert) {
@@ -158,9 +161,9 @@ module('Integration | Component | PkiImportPemBundle', function (hooks) {
       { owner: this.engine }
     );
 
-    await click('[data-test-text-toggle]');
-    await fillIn('[data-test-text-file-textarea]', this.pemBundle);
-    await click('[data-test-pki-import-pem-bundle]');
+    await click(GENERAL.textToggle);
+    await fillIn(GENERAL.maskedInput, this.pemBundle);
+    await click(PKI_CONFIGURE_CREATE.importSubmit);
 
     assert
       .dom('[data-test-import-pair]')
diff --git a/ui/tests/integration/components/pki/pki-issuer-cross-sign-test.js b/ui/tests/integration/components/pki/pki-issuer-cross-sign-test.js
index 2c8f87bbd5b..8073697c891 100644
--- a/ui/tests/integration/components/pki/pki-issuer-cross-sign-test.js
+++ b/ui/tests/integration/components/pki/pki-issuer-cross-sign-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,15 +10,9 @@ import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { Response } from 'miragejs';
 import { hbs } from 'ember-cli-htmlbars';
-import {
-  intIssuerCert,
-  newCSR,
-  newlySignedCert,
-  oldParentIssuerCert,
-  parentIssuerCert,
-  unsupportedOids,
-} from 'vault/tests/helpers/pki/values';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-issuer-cross-sign';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
+import { PKI_CROSS_SIGN } from 'vault/tests/helpers/pki/pki-selectors';
 
 const FIELDS = [
   {
@@ -40,6 +34,8 @@ const FIELDS = [
     helpText: `This is your new issuer’s name in the API.`,
   },
 ];
+const { intIssuerCert, newCSR, newlySignedCert, oldParentIssuerCert, parentIssuerCert, unsupportedOids } =
+  CERTIFICATES;
 module('Integration | Component | pki issuer cross sign', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'pki');
@@ -189,19 +185,19 @@ module('Integration | Component | pki issuer cross sign', function (hooks) {
     });
     // fill out form and submit
     for (const field of FIELDS) {
-      await fillIn(SELECTORS.objectListInput(field.key), this.testInputs[field.key]);
+      await fillIn(PKI_CROSS_SIGN.objectListInput(field.key), this.testInputs[field.key]);
     }
-    await click(SELECTORS.submitButton);
+    await click(GENERAL.submitButton);
 
-    assert.dom(SELECTORS.statusCount).hasText('Cross-signing complete (1 successful, 0 errors)');
+    assert.dom(PKI_CROSS_SIGN.statusCount).hasText('Cross-signing complete (1 successful, 0 errors)');
     assert
-      .dom(`${SELECTORS.signedIssuerRow()} [data-test-icon="check-circle"]`)
+      .dom(`${PKI_CROSS_SIGN.signedIssuerRow()} [data-test-icon="check-circle"]`)
       .exists('row has success icon');
     for (const field of FIELDS) {
       assert
-        .dom(`${SELECTORS.signedIssuerCol(field.key)}`)
+        .dom(`${PKI_CROSS_SIGN.signedIssuerCol(field.key)}`)
         .hasText(this.testInputs[field.key], `${field.key} displays correct value`);
-      assert.dom(`${SELECTORS.signedIssuerCol(field.key)} a`).hasTagName('a');
+      assert.dom(`${PKI_CROSS_SIGN.signedIssuerCol(field.key)} a`).hasTagName('a');
     }
   });
 
@@ -247,32 +243,32 @@ module('Integration | Component | pki issuer cross sign', function (hooks) {
 
     // fill out form and submit
     for (const field of FIELDS) {
-      await fillIn(SELECTORS.objectListInput(field.key), this.testInputs[field.key]);
+      await fillIn(PKI_CROSS_SIGN.objectListInput(field.key), this.testInputs[field.key]);
     }
-    await click(SELECTORS.addRow);
+    await click(PKI_CROSS_SIGN.addRow);
     for (const field of FIELDS) {
-      await fillIn(SELECTORS.objectListInput(field.key, 1), nonexistentIssuer[field.key]);
+      await fillIn(PKI_CROSS_SIGN.objectListInput(field.key, 1), nonexistentIssuer[field.key]);
     }
-    await click(SELECTORS.addRow);
+    await click(PKI_CROSS_SIGN.addRow);
     for (const field of FIELDS) {
-      await fillIn(SELECTORS.objectListInput(field.key, 2), unsupportedCert[field.key]);
+      await fillIn(PKI_CROSS_SIGN.objectListInput(field.key, 2), unsupportedCert[field.key]);
     }
-    await click(SELECTORS.submitButton);
+    await click(GENERAL.submitButton);
 
-    assert.dom(SELECTORS.statusCount).hasText('Cross-signing complete (0 successful, 3 errors)');
+    assert.dom(PKI_CROSS_SIGN.statusCount).hasText('Cross-signing complete (0 successful, 3 errors)');
     for (const field of FIELDS) {
       assert
-        .dom(`${SELECTORS.signedIssuerRow()} ${SELECTORS.signedIssuerCol(field.key)}`)
+        .dom(`${PKI_CROSS_SIGN.signedIssuerRow()} ${PKI_CROSS_SIGN.signedIssuerCol(field.key)}`)
         .hasText(this.testInputs[field.key], `first row has correct values`);
     }
     for (const field of FIELDS) {
       assert
-        .dom(`${SELECTORS.signedIssuerRow(1)} ${SELECTORS.signedIssuerCol(field.key)}`)
+        .dom(`${PKI_CROSS_SIGN.signedIssuerRow(1)} ${PKI_CROSS_SIGN.signedIssuerCol(field.key)}`)
         .hasText(nonexistentIssuer[field.key], `second row has correct values`);
     }
     for (const field of FIELDS) {
       assert
-        .dom(`${SELECTORS.signedIssuerRow(2)} ${SELECTORS.signedIssuerCol(field.key)}`)
+        .dom(`${PKI_CROSS_SIGN.signedIssuerRow(2)} ${PKI_CROSS_SIGN.signedIssuerCol(field.key)}`)
         .hasText(unsupportedCert[field.key], `third row has correct values`);
     }
   });
@@ -295,13 +291,13 @@ module('Integration | Component | pki issuer cross sign', function (hooks) {
 
     // fill out form and submit
     for (const field of FIELDS) {
-      await fillIn(SELECTORS.objectListInput(field.key), this.testInputs[field.key]);
+      await fillIn(PKI_CROSS_SIGN.objectListInput(field.key), this.testInputs[field.key]);
     }
-    await click(SELECTORS.submitButton);
+    await click(GENERAL.submitButton);
 
-    assert.dom(SELECTORS.statusCount).hasText('Cross-signing complete (0 successful, 1 error)');
+    assert.dom(PKI_CROSS_SIGN.statusCount).hasText('Cross-signing complete (0 successful, 1 error)');
     assert
-      .dom(`${SELECTORS.signedIssuerRow()} [data-test-icon="alert-circle-fill"]`)
+      .dom(`${PKI_CROSS_SIGN.signedIssuerRow()} [data-test-icon="alert-circle-fill"]`)
       .exists('row has failure icon');
 
     assert.dom('[data-test-cross-sign-alert-title]').hasText('Cross-sign failed');
@@ -311,7 +307,7 @@ module('Integration | Component | pki issuer cross sign', function (hooks) {
 
     for (const field of FIELDS) {
       assert
-        .dom(`${SELECTORS.signedIssuerCol(field.key)}`)
+        .dom(`${PKI_CROSS_SIGN.signedIssuerCol(field.key)}`)
         .hasText(this.testInputs[field.key], `${field.key} displays correct value`);
     }
   });
@@ -328,12 +324,12 @@ module('Integration | Component | pki issuer cross sign', function (hooks) {
     });
     // fill out form and submit
     for (const field of FIELDS) {
-      await fillIn(SELECTORS.objectListInput(field.key), this.testInputs[field.key]);
+      await fillIn(PKI_CROSS_SIGN.objectListInput(field.key), this.testInputs[field.key]);
     }
-    await click(SELECTORS.submitButton);
-    assert.dom(SELECTORS.statusCount).hasText('Cross-signing complete (0 successful, 1 error)');
+    await click(GENERAL.submitButton);
+    assert.dom(PKI_CROSS_SIGN.statusCount).hasText('Cross-signing complete (0 successful, 1 error)');
     assert
-      .dom(`${SELECTORS.signedIssuerRow()} [data-test-icon="alert-circle-fill"]`)
+      .dom(`${PKI_CROSS_SIGN.signedIssuerRow()} [data-test-icon="alert-circle-fill"]`)
       .exists('row has failure icon');
     assert
       .dom('[data-test-cross-sign-alert-title]')
@@ -346,7 +342,7 @@ module('Integration | Component | pki issuer cross sign', function (hooks) {
 
     for (const field of FIELDS) {
       assert
-        .dom(`${SELECTORS.signedIssuerCol(field.key)}`)
+        .dom(`${PKI_CROSS_SIGN.signedIssuerCol(field.key)}`)
         .hasText(this.testInputs[field.key], `${field.key} displays correct value`);
     }
   });
@@ -367,12 +363,12 @@ module('Integration | Component | pki issuer cross sign', function (hooks) {
     });
     // fill out form and submit
     for (const field of FIELDS) {
-      await fillIn(SELECTORS.objectListInput(field.key), this.testInputs[field.key]);
+      await fillIn(PKI_CROSS_SIGN.objectListInput(field.key), this.testInputs[field.key]);
     }
-    await click(SELECTORS.submitButton);
-    assert.dom(SELECTORS.statusCount).hasText('Cross-signing complete (0 successful, 1 error)');
+    await click(GENERAL.submitButton);
+    assert.dom(PKI_CROSS_SIGN.statusCount).hasText('Cross-signing complete (0 successful, 1 error)');
     assert
-      .dom(`${SELECTORS.signedIssuerRow()} [data-test-icon="alert-circle-fill"]`)
+      .dom(`${PKI_CROSS_SIGN.signedIssuerRow()} [data-test-icon="alert-circle-fill"]`)
       .exists('row has failure icon');
     assert.dom('[data-test-cross-sign-alert-title]').hasText('Cross-sign failed');
     assert
@@ -381,7 +377,7 @@ module('Integration | Component | pki issuer cross sign', function (hooks) {
 
     for (const field of FIELDS) {
       assert
-        .dom(`${SELECTORS.signedIssuerCol(field.key)}`)
+        .dom(`${PKI_CROSS_SIGN.signedIssuerCol(field.key)}`)
         .hasText(this.testInputs[field.key], `${field.key} displays correct value`);
     }
   });
diff --git a/ui/tests/integration/components/pki/pki-issuer-details-test.js b/ui/tests/integration/components/pki/pki-issuer-details-test.js
index b38f8e80470..f10ad5b21d3 100644
--- a/ui/tests/integration/components/pki/pki-issuer-details-test.js
+++ b/ui/tests/integration/components/pki/pki-issuer-details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,8 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { render, settled } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-issuer-details';
+import { PKI_ISSUER_DETAILS } from 'vault/tests/helpers/pki/pki-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | page/pki-issuer-details', function (hooks) {
   setupRenderingTest(hooks);
@@ -30,12 +31,12 @@ module('Integration | Component | page/pki-issuer-details', function (hooks) {
       this.context
     );
 
-    assert.dom(SELECTORS.rotateRoot).doesNotExist();
-    assert.dom(SELECTORS.crossSign).doesNotExist();
-    assert.dom(SELECTORS.signIntermediate).doesNotExist();
-    assert.dom(SELECTORS.download).hasText('Download');
-    assert.dom(SELECTORS.configure).doesNotExist();
-    assert.dom(SELECTORS.parsingAlertBanner).doesNotExist();
+    assert.dom(PKI_ISSUER_DETAILS.rotateRoot).doesNotExist();
+    assert.dom(PKI_ISSUER_DETAILS.crossSign).doesNotExist();
+    assert.dom(PKI_ISSUER_DETAILS.signIntermediate).doesNotExist();
+    assert.dom(PKI_ISSUER_DETAILS.download).hasText('Download');
+    assert.dom(PKI_ISSUER_DETAILS.configure).doesNotExist();
+    assert.dom(PKI_ISSUER_DETAILS.parsingAlertBanner).doesNotExist();
   });
 
   test('it renders toolbar actions depending on passed capabilities', async function (assert) {
@@ -59,12 +60,12 @@ module('Integration | Component | page/pki-issuer-details', function (hooks) {
       this.context
     );
 
-    assert.dom(SELECTORS.parsingAlertBanner).doesNotExist();
-    assert.dom(SELECTORS.rotateRoot).hasText('Rotate this root');
-    assert.dom(SELECTORS.crossSign).hasText('Cross-sign issuers');
-    assert.dom(SELECTORS.signIntermediate).hasText('Sign Intermediate');
-    assert.dom(SELECTORS.download).hasText('Download');
-    assert.dom(SELECTORS.configure).hasText('Configure');
+    assert.dom(PKI_ISSUER_DETAILS.parsingAlertBanner).doesNotExist();
+    assert.dom(PKI_ISSUER_DETAILS.rotateRoot).hasText('Rotate this root');
+    assert.dom(PKI_ISSUER_DETAILS.crossSign).hasText('Cross-sign issuers');
+    assert.dom(PKI_ISSUER_DETAILS.signIntermediate).hasText('Sign Intermediate');
+    assert.dom(PKI_ISSUER_DETAILS.download).hasText('Download');
+    assert.dom(PKI_ISSUER_DETAILS.configure).hasText('Configure');
 
     this.set('canRotate', false);
     this.set('canCrossSign', false);
@@ -72,11 +73,11 @@ module('Integration | Component | page/pki-issuer-details', function (hooks) {
     this.set('canConfigure', false);
     await settled();
 
-    assert.dom(SELECTORS.rotateRoot).doesNotExist();
-    assert.dom(SELECTORS.crossSign).doesNotExist();
-    assert.dom(SELECTORS.signIntermediate).doesNotExist();
-    assert.dom(SELECTORS.download).hasText('Download');
-    assert.dom(SELECTORS.configure).doesNotExist();
+    assert.dom(PKI_ISSUER_DETAILS.rotateRoot).doesNotExist();
+    assert.dom(PKI_ISSUER_DETAILS.crossSign).doesNotExist();
+    assert.dom(PKI_ISSUER_DETAILS.signIntermediate).doesNotExist();
+    assert.dom(PKI_ISSUER_DETAILS.download).hasText('Download');
+    assert.dom(PKI_ISSUER_DETAILS.configure).doesNotExist();
   });
 
   test('it renders correct details by default', async function (assert) {
@@ -88,24 +89,24 @@ module('Integration | Component | page/pki-issuer-details', function (hooks) {
     );
 
     // Default group details:
-    assert.dom(SELECTORS.defaultGroup).exists('Default group of details exists');
-    assert.dom(SELECTORS.valueByName('Certificate')).exists('Certificate detail exists');
-    assert.dom(SELECTORS.copyButtonByName('Certificate')).exists('Certificate is copyable');
-    assert.dom(SELECTORS.valueByName('CA Chain')).exists('CA Chain detail exists');
-    assert.dom(SELECTORS.copyButtonByName('CA Chain')).exists('CA Chain is copyable');
-    assert.dom(SELECTORS.valueByName('Common name')).exists('Common name detail exists');
-    assert.dom(SELECTORS.valueByName('Issuer name')).exists('Issuer name detail exists');
-    assert.dom(SELECTORS.valueByName('Issuer ID')).exists('Issuer ID detail exists');
-    assert.dom(SELECTORS.copyButtonByName('Issuer ID')).exists('Issuer ID is copyable');
-    assert.dom(SELECTORS.valueByName('Default key ID')).exists('Default key ID detail exists');
+    assert.dom(PKI_ISSUER_DETAILS.defaultGroup).exists('Default group of details exists');
+    assert.dom(GENERAL.infoRowValue('Certificate')).exists('Certificate detail exists');
+    assert.dom(PKI_ISSUER_DETAILS.copyButtonByName('Certificate')).exists('Certificate is copyable');
+    assert.dom(GENERAL.infoRowValue('CA Chain')).exists('CA Chain detail exists');
+    assert.dom(PKI_ISSUER_DETAILS.copyButtonByName('CA Chain')).exists('CA Chain is copyable');
+    assert.dom(GENERAL.infoRowValue('Common name')).exists('Common name detail exists');
+    assert.dom(GENERAL.infoRowValue('Issuer name')).exists('Issuer name detail exists');
+    assert.dom(GENERAL.infoRowValue('Issuer ID')).exists('Issuer ID detail exists');
+    assert.dom(PKI_ISSUER_DETAILS.copyButtonByName('Issuer ID')).exists('Issuer ID is copyable');
+    assert.dom(GENERAL.infoRowValue('Default key ID')).exists('Default key ID detail exists');
 
     // Issuer URLs group details:
-    assert.dom(SELECTORS.urlsGroup).exists('Issuer URLs group of details exists');
-    assert.dom(SELECTORS.valueByName('Issuing certificates')).exists('Issuing certificates detail exists');
+    assert.dom(PKI_ISSUER_DETAILS.urlsGroup).exists('Issuer URLs group of details exists');
+    assert.dom(GENERAL.infoRowValue('Issuing certificates')).exists('Issuing certificates detail exists');
     assert
-      .dom(SELECTORS.valueByName('CRL distribution points'))
+      .dom(GENERAL.infoRowValue('CRL distribution points'))
       .exists('CRL distribution points detail exists');
-    assert.dom(SELECTORS.valueByName('OCSP servers')).exists('OCSP servers detail exists');
+    assert.dom(GENERAL.infoRowValue('OCSP servers')).exists('OCSP servers detail exists');
   });
 
   test('it renders parsing error banner if issuer certificate contains unsupported OIDs', async function (assert) {
@@ -128,9 +129,9 @@ module('Integration | Component | page/pki-issuer-details', function (hooks) {
       this.context
     );
 
-    assert.dom(SELECTORS.parsingAlertBanner).exists();
+    assert.dom(PKI_ISSUER_DETAILS.parsingAlertBanner).exists();
     assert
-      .dom(SELECTORS.parsingAlertBanner)
+      .dom(PKI_ISSUER_DETAILS.parsingAlertBanner)
       .hasText(
         "There was an error parsing certificate metadata Vault cannot display unparsed values, but this will not interfere with the certificate's functionality. However, if you wish to cross-sign this issuer it must be done manually using the CLI. Parsing error(s): certificate contains stuff we cannot parse"
       );
@@ -156,9 +157,9 @@ module('Integration | Component | page/pki-issuer-details', function (hooks) {
       this.context
     );
 
-    assert.dom(SELECTORS.parsingAlertBanner).exists();
+    assert.dom(PKI_ISSUER_DETAILS.parsingAlertBanner).exists();
     assert
-      .dom(SELECTORS.parsingAlertBanner)
+      .dom(PKI_ISSUER_DETAILS.parsingAlertBanner)
       .hasText(
         "There was an error parsing certificate metadata Vault cannot display unparsed values, but this will not interfere with the certificate's functionality. However, if you wish to cross-sign this issuer it must be done manually using the CLI."
       );
@@ -184,9 +185,9 @@ module('Integration | Component | page/pki-issuer-details', function (hooks) {
       this.context
     );
 
-    assert.dom(SELECTORS.parsingAlertBanner).exists();
+    assert.dom(PKI_ISSUER_DETAILS.parsingAlertBanner).exists();
     assert
-      .dom(SELECTORS.parsingAlertBanner)
+      .dom(PKI_ISSUER_DETAILS.parsingAlertBanner)
       .hasText(
         "There was an error parsing certificate metadata Vault cannot display unparsed values, but this will not interfere with the certificate's functionality. However, if you wish to cross-sign this issuer it must be done manually using the CLI."
       );
diff --git a/ui/tests/integration/components/pki/pki-key-form-test.js b/ui/tests/integration/components/pki/pki-key-form-test.js
index d48c19217be..e07769ba655 100644
--- a/ui/tests/integration/components/pki/pki-key-form-test.js
+++ b/ui/tests/integration/components/pki/pki-key-form-test.js
@@ -1,16 +1,17 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
+import sinon from 'sinon';
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render, click, fillIn } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-key-form';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import sinon from 'sinon';
+import { PKI_KEY_FORM } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Integration | Component | pki key form', function (hooks) {
   setupRenderingTest(hooks);
@@ -38,20 +39,20 @@ module('Integration | Component | pki key form', function (hooks) {
       `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.keyNameInput).exists('renders name input');
-    assert.dom(SELECTORS.typeInput).exists('renders type input');
-    assert.dom(SELECTORS.keyTypeInput).exists('renders key type input');
-    assert.dom(SELECTORS.keyBitsInput).exists('renders key bits input');
+    assert.dom(GENERAL.inputByAttr('keyName')).exists('renders name input');
+    assert.dom(GENERAL.inputByAttr('type')).exists('renders type input');
+    assert.dom(GENERAL.inputByAttr('keyType')).exists('renders key type input');
+    assert.dom(GENERAL.inputByAttr('keyBits')).exists('renders key bits input');
 
-    await click(SELECTORS.keyCreateButton);
+    await click(GENERAL.submitButton);
     assert
-      .dom(SELECTORS.fieldErrorByName('type'))
+      .dom(GENERAL.validationErrorByAttr('type'))
       .hasTextContaining('Type is required.', 'renders presence validation for type of key');
     assert
-      .dom(SELECTORS.fieldErrorByName('keyType'))
+      .dom(GENERAL.validationErrorByAttr('keyType'))
       .hasTextContaining('Please select a key type.', 'renders selection prompt for key type');
     assert
-      .dom(SELECTORS.validationError)
+      .dom(PKI_KEY_FORM.validationError)
       .hasTextContaining('There are 2 errors with this form.', 'renders correct form error count');
   });
 
@@ -85,11 +86,11 @@ module('Integration | Component | pki key form', function (hooks) {
       { owner: this.engine }
     );
 
-    await fillIn(SELECTORS.keyNameInput, 'test-key');
-    await fillIn(SELECTORS.typeInput, 'exported');
-    assert.dom(SELECTORS.keyBitsInput).isDisabled('key bits disabled when no key type selected');
-    await fillIn(SELECTORS.keyTypeInput, 'rsa');
-    await click(SELECTORS.keyCreateButton);
+    await fillIn(GENERAL.inputByAttr('keyName'), 'test-key');
+    await fillIn(GENERAL.inputByAttr('type'), 'exported');
+    assert.dom(GENERAL.inputByAttr('keyBits')).isDisabled('key bits disabled when no key type selected');
+    await fillIn(GENERAL.inputByAttr('keyType'), 'rsa');
+    await click(GENERAL.submitButton);
   });
 
   test('it generates a key type=internal', async function (assert) {
@@ -121,10 +122,10 @@ module('Integration | Component | pki key form', function (hooks) {
       { owner: this.engine }
     );
 
-    await fillIn(SELECTORS.keyNameInput, 'test-key');
-    await fillIn(SELECTORS.typeInput, 'internal');
-    assert.dom(SELECTORS.keyBitsInput).isDisabled('key bits disabled when no key type selected');
-    await fillIn(SELECTORS.keyTypeInput, 'rsa');
-    await click(SELECTORS.keyCreateButton);
+    await fillIn(GENERAL.inputByAttr('keyName'), 'test-key');
+    await fillIn(GENERAL.inputByAttr('type'), 'internal');
+    assert.dom(GENERAL.inputByAttr('keyBits')).isDisabled('key bits disabled when no key type selected');
+    await fillIn(GENERAL.inputByAttr('keyType'), 'rsa');
+    await click(GENERAL.submitButton);
   });
 });
diff --git a/ui/tests/integration/components/pki/pki-key-parameters-test.js b/ui/tests/integration/components/pki/pki-key-parameters-test.js
index b41a2b14aab..c70fb41c5ac 100644
--- a/ui/tests/integration/components/pki/pki-key-parameters-test.js
+++ b/ui/tests/integration/components/pki/pki-key-parameters-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,8 +8,7 @@ import { setupRenderingTest } from 'ember-qunit';
 import { render, fillIn } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-role-form';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | pki key parameters', function (hooks) {
   setupRenderingTest(hooks);
@@ -19,12 +18,6 @@ module('Integration | Component | pki key parameters', function (hooks) {
     this.store = this.owner.lookup('service:store');
     this.model = this.store.createRecord('pki/role', { backend: 'pki' });
     [this.fields] = Object.values(this.model.formFieldGroups.find((g) => g['Key parameters']));
-    // TODO: remove Tooltip/ember-basic-dropdown
-    setRunOptions({
-      rules: {
-        'nested-interactive': { enabled: false },
-      },
-    });
   });
 
   test('it should render the component and display the correct defaults', async function (assert) {
@@ -40,9 +33,9 @@ module('Integration | Component | pki key parameters', function (hooks) {
   `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.keyType).hasValue('rsa');
-    assert.dom(SELECTORS.keyBits).hasValue('2048');
-    assert.dom(SELECTORS.signatureBits).hasValue('0');
+    assert.dom(GENERAL.inputByAttr('keyType')).hasValue('rsa');
+    assert.dom(GENERAL.inputByAttr('keyBits')).hasValue('2048');
+    assert.dom(GENERAL.inputByAttr('signatureBits')).hasValue('0');
   });
 
   test('it should set the model properties of key_type and key_bits when key_type changes', async function (assert) {
@@ -65,7 +58,7 @@ module('Integration | Component | pki key parameters', function (hooks) {
       '0',
       'sets the default value for signature_bits on the model.'
     );
-    await fillIn(SELECTORS.keyType, 'ec');
+    await fillIn(GENERAL.inputByAttr('keyType'), 'ec');
     assert.strictEqual(this.model.keyType, 'ec', 'sets the new selected value for key_type on the model.');
     assert.strictEqual(
       this.model.keyBits,
@@ -73,7 +66,7 @@ module('Integration | Component | pki key parameters', function (hooks) {
       'sets the new selected value for key_bits on the model based on the selection of key_type.'
     );
 
-    await fillIn(SELECTORS.keyType, 'ed25519');
+    await fillIn(GENERAL.inputByAttr('keyType'), 'ed25519');
     assert.strictEqual(
       this.model.keyType,
       'ed25519',
@@ -85,8 +78,8 @@ module('Integration | Component | pki key parameters', function (hooks) {
       'sets the new selected value for key_bits on the model based on the selection of key_type.'
     );
 
-    await fillIn(SELECTORS.keyType, 'ec');
-    await fillIn(SELECTORS.keyBits, '384');
+    await fillIn(GENERAL.inputByAttr('keyType'), 'ec');
+    await fillIn(GENERAL.inputByAttr('keyBits'), '384');
     assert.strictEqual(this.model.keyType, 'ec', 'sets the new selected value for key_type on the model.');
     assert.strictEqual(
       this.model.keyBits,
@@ -94,14 +87,14 @@ module('Integration | Component | pki key parameters', function (hooks) {
       'sets the new selected value for key_bits on the model based on the selection of key_type.'
     );
 
-    await fillIn(SELECTORS.signatureBits, '384');
+    await fillIn(GENERAL.inputByAttr('signatureBits'), '384');
     assert.strictEqual(
       this.model.signatureBits,
       '384',
       'sets the new selected value for signature_bits on the model.'
     );
 
-    await fillIn(SELECTORS.signatureBits, '0');
+    await fillIn(GENERAL.inputByAttr('signatureBits'), '0');
     assert.strictEqual(
       this.model.signatureBits,
       '0',
diff --git a/ui/tests/integration/components/pki/pki-key-usage-test.js b/ui/tests/integration/components/pki/pki-key-usage-test.js
index 55429b135c5..3d29f8f6eb4 100644
--- a/ui/tests/integration/components/pki/pki-key-usage-test.js
+++ b/ui/tests/integration/components/pki/pki-key-usage-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,8 @@ import { setupRenderingTest } from 'ember-qunit';
 import { render, click, findAll } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-role-form';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { PKI_ROLE_FORM } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Integration | Component | pki-key-usage', function (hooks) {
   setupRenderingTest(hooks);
@@ -33,11 +34,11 @@ module('Integration | Component | pki-key-usage', function (hooks) {
       { owner: this.engine }
     );
     assert.strictEqual(findAll('.b-checkbox').length, 19, 'it render 19 checkboxes');
-    assert.dom(SELECTORS.digitalSignature).isChecked('Digital Signature is true by default');
-    assert.dom(SELECTORS.keyAgreement).isChecked('Key Agreement is true by default');
-    assert.dom(SELECTORS.keyEncipherment).isChecked('Key Encipherment is true by default');
-    assert.dom(SELECTORS.any).isNotChecked('Any is false by default');
-    assert.dom(SELECTORS.extKeyUsageOids).exists('Extended Key usage oids renders');
+    assert.dom(PKI_ROLE_FORM.digitalSignature).isChecked('Digital Signature is true by default');
+    assert.dom(PKI_ROLE_FORM.keyAgreement).isChecked('Key Agreement is true by default');
+    assert.dom(PKI_ROLE_FORM.keyEncipherment).isChecked('Key Encipherment is true by default');
+    assert.dom(PKI_ROLE_FORM.any).isNotChecked('Any is false by default');
+    assert.dom(GENERAL.inputByAttr('extKeyUsageOids')).exists('Extended Key usage oids renders');
   });
 
   test('it should set the model properties of key_usage and ext_key_usage based on the checkbox selections', async function (assert) {
@@ -53,9 +54,9 @@ module('Integration | Component | pki-key-usage', function (hooks) {
       { owner: this.engine }
     );
 
-    await click(SELECTORS.digitalSignature);
-    await click(SELECTORS.any);
-    await click(SELECTORS.serverAuth);
+    await click(PKI_ROLE_FORM.digitalSignature);
+    await click(PKI_ROLE_FORM.any);
+    await click(PKI_ROLE_FORM.serverAuth);
 
     assert.deepEqual(
       this.model.keyUsage,
diff --git a/ui/tests/integration/components/pki/pki-not-valid-after-form-test.js b/ui/tests/integration/components/pki/pki-not-valid-after-form-test.js
index 5157c8b6d0a..bed14fb7fec 100644
--- a/ui/tests/integration/components/pki/pki-not-valid-after-form-test.js
+++ b/ui/tests/integration/components/pki/pki-not-valid-after-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,7 @@ import { setupRenderingTest } from 'ember-qunit';
 import { render, click, fillIn } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-not-valid-after-form';
+import { PKI_NOT_VALID_AFTER } from 'vault/tests/helpers/pki/pki-selectors';
 
 module('Integration | Component | pki-not-valid-after-form', function (hooks) {
   setupRenderingTest(hooks);
@@ -38,9 +38,9 @@ module('Integration | Component | pki-not-valid-after-form', function (hooks) {
   `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.ttlForm).exists('shows the TTL picker');
-    assert.dom(SELECTORS.ttlTimeInput).hasValue('', 'default TTL is empty');
-    assert.dom(SELECTORS.radioTtl).isChecked('ttl is selected by default');
+    assert.dom(PKI_NOT_VALID_AFTER.ttlForm).exists('shows the TTL picker');
+    assert.dom(PKI_NOT_VALID_AFTER.ttlTimeInput).hasValue('', 'default TTL is empty');
+    assert.dom(PKI_NOT_VALID_AFTER.radioTtl).isChecked('ttl is selected by default');
   });
 
   test('it clears and resets model properties from cache when changing radio selection', async function (assert) {
@@ -55,17 +55,17 @@ module('Integration | Component | pki-not-valid-after-form', function (hooks) {
   `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.radioTtl).isChecked('notBeforeDate radio is selected');
-    assert.dom(SELECTORS.ttlForm).exists({ count: 1 }, 'shows TTL form');
-    assert.dom(SELECTORS.radioDate).isNotChecked('NotAfter selection not checked');
-    assert.dom(SELECTORS.dateInput).doesNotExist('does not show date input field');
+    assert.dom(PKI_NOT_VALID_AFTER.radioTtl).isChecked('notBeforeDate radio is selected');
+    assert.dom(PKI_NOT_VALID_AFTER.ttlForm).exists({ count: 1 }, 'shows TTL form');
+    assert.dom(PKI_NOT_VALID_AFTER.radioDate).isNotChecked('NotAfter selection not checked');
+    assert.dom(PKI_NOT_VALID_AFTER.dateInput).doesNotExist('does not show date input field');
 
-    await click(SELECTORS.radioDateLabel);
+    await click(PKI_NOT_VALID_AFTER.radioDateLabel);
 
-    assert.dom(SELECTORS.radioDate).isChecked('selects NotAfter radio when label clicked');
-    assert.dom(SELECTORS.dateInput).exists({ count: 1 }, 'shows date input field');
-    assert.dom(SELECTORS.radioTtl).isNotChecked('notBeforeDate radio is deselected');
-    assert.dom(SELECTORS.ttlForm).doesNotExist('hides TTL form');
+    assert.dom(PKI_NOT_VALID_AFTER.radioDate).isChecked('selects NotAfter radio when label clicked');
+    assert.dom(PKI_NOT_VALID_AFTER.dateInput).exists({ count: 1 }, 'shows date input field');
+    assert.dom(PKI_NOT_VALID_AFTER.radioTtl).isNotChecked('notBeforeDate radio is deselected');
+    assert.dom(PKI_NOT_VALID_AFTER.ttlForm).doesNotExist('hides TTL form');
 
     const utcDate = '1994-11-05';
     const notAfterExpected = '1994-11-05T00:00:00.000Z';
@@ -106,13 +106,13 @@ module('Integration | Component | pki-not-valid-after-form', function (hooks) {
   `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.radioTtl).isChecked('notBeforeDate radio is selected');
-    assert.dom(SELECTORS.ttlForm).exists({ count: 1 }, 'shows TTL form');
-    assert.dom(SELECTORS.radioDate).isNotChecked('NotAfter selection not checked');
-    assert.dom(SELECTORS.dateInput).doesNotExist('does not show date input field');
+    assert.dom(PKI_NOT_VALID_AFTER.radioTtl).isChecked('notBeforeDate radio is selected');
+    assert.dom(PKI_NOT_VALID_AFTER.ttlForm).exists({ count: 1 }, 'shows TTL form');
+    assert.dom(PKI_NOT_VALID_AFTER.radioDate).isNotChecked('NotAfter selection not checked');
+    assert.dom(PKI_NOT_VALID_AFTER.dateInput).doesNotExist('does not show date input field');
 
-    assert.dom(SELECTORS.ttlTimeInput).hasValue('100', 'TTL value is correctly shown');
-    assert.dom(SELECTORS.ttlUnitInput).hasValue('m', 'TTL unit is correctly shown');
+    assert.dom(PKI_NOT_VALID_AFTER.ttlTimeInput).hasValue('100', 'TTL value is correctly shown');
+    assert.dom(PKI_NOT_VALID_AFTER.ttlUnitInput).hasValue('m', 'TTL unit is correctly shown');
   });
   test('Form renders properly for edit when notAfter present', async function (assert) {
     const utcDate = '1994-11-05T00:00:00.000Z';
@@ -128,11 +128,11 @@ module('Integration | Component | pki-not-valid-after-form', function (hooks) {
   `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.radioDate).isChecked('notAfter radio is selected');
-    assert.dom(SELECTORS.dateInput).exists({ count: 1 }, 'shows date picker');
-    assert.dom(SELECTORS.radioTtl).isNotChecked('ttl radio not selected');
-    assert.dom(SELECTORS.ttlForm).doesNotExist('does not show date TTL picker');
+    assert.dom(PKI_NOT_VALID_AFTER.radioDate).isChecked('notAfter radio is selected');
+    assert.dom(PKI_NOT_VALID_AFTER.dateInput).exists({ count: 1 }, 'shows date picker');
+    assert.dom(PKI_NOT_VALID_AFTER.radioTtl).isNotChecked('ttl radio not selected');
+    assert.dom(PKI_NOT_VALID_AFTER.ttlForm).doesNotExist('does not show date TTL picker');
     // Due to timezones, can't check specific match on input date
-    assert.dom(SELECTORS.dateInput).hasAnyValue('date input shows date');
+    assert.dom(PKI_NOT_VALID_AFTER.dateInput).hasAnyValue('date input shows date');
   });
 });
diff --git a/ui/tests/integration/components/pki/pki-page-header-test.js b/ui/tests/integration/components/pki/pki-page-header-test.js
index 54e922f4d7d..7366d953ea8 100644
--- a/ui/tests/integration/components/pki/pki-page-header-test.js
+++ b/ui/tests/integration/components/pki/pki-page-header-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/pki/pki-role-form-test.js b/ui/tests/integration/components/pki/pki-role-form-test.js
index 417316ff61c..0b1d1bbad5d 100644
--- a/ui/tests/integration/components/pki/pki-role-form-test.js
+++ b/ui/tests/integration/components/pki/pki-role-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,7 @@ import { setupRenderingTest } from 'ember-qunit';
 import { render, click, fillIn } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-role-form';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
@@ -36,7 +36,6 @@ module('Integration | Component | pki-role-form', function (hooks) {
   });
 
   test('it should render default fields and toggle groups', async function (assert) {
-    assert.expect(13);
     await render(
       hbs`
       <PkiRoleForm
@@ -48,24 +47,46 @@ module('Integration | Component | pki-role-form', function (hooks) {
   `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.issuerRefToggle).exists('shows issuer ref toggle');
-    assert.dom(SELECTORS.backdateValidity).exists('shows form-field backdate validity');
-    assert.dom(SELECTORS.customTtl).exists('shows custom yielded form field');
-    assert.dom(SELECTORS.maxTtl).exists('shows form-field max ttl');
-    assert.dom(SELECTORS.generateLease).exists('shows form-field generateLease');
-    assert.dom(SELECTORS.noStore).exists('shows form-field no store');
-    assert.dom(SELECTORS.addBasicConstraints).exists('shows form-field add basic constraints');
-    assert.dom(SELECTORS.domainHandling).exists('shows form-field group add domain handling');
-    assert.dom(SELECTORS.keyParams).exists('shows form-field group key params');
-    assert.dom(SELECTORS.keyUsage).exists('shows form-field group key usage');
-    assert.dom(SELECTORS.policyIdentifiers).exists('shows form-field group policy identifiers');
-    assert.dom(SELECTORS.san).exists('shows form-field group SAN');
-    assert.dom(SELECTORS.additionalSubjectFields).exists('shows form-field group additional subject fields');
+    assert.dom(GENERAL.ttl.toggle('issuerRef-toggle')).exists();
+    assert.dom(GENERAL.ttl.input('Backdate validity')).exists();
+    assert.dom(GENERAL.fieldByAttr('customTtl')).exists();
+    assert.dom(GENERAL.ttl.toggle('Max TTL')).exists();
+    assert.dom(GENERAL.fieldByAttr('generateLease')).exists();
+    assert.dom(GENERAL.fieldByAttr('noStore')).exists();
+    assert
+      .dom(GENERAL.fieldByAttr('noStoreMetadata'))
+      .doesNotExist('noStoreMetadata is not shown b/c not enterprise');
+    assert.dom(GENERAL.inputByAttr('addBasicConstraints')).exists();
+    assert.dom(GENERAL.button('Domain handling')).exists('shows form-field group add domain handling');
+    assert.dom(GENERAL.button('Key parameters')).exists('shows form-field group key params');
+    assert.dom(GENERAL.button('Key usage')).exists('shows form-field group key usage');
+    assert.dom(GENERAL.button('Policy identifiers')).exists('shows form-field group policy identifiers');
+    assert.dom(GENERAL.button('Subject Alternative Name (SAN) Options')).exists('shows form-field group SAN');
+    assert
+      .dom(GENERAL.button('Additional subject fields'))
+      .exists('shows form-field group additional subject fields');
+  });
+
+  test('it renders enterprise-only values in enterprise edition', async function (assert) {
+    const version = this.owner.lookup('service:version');
+    version.type = 'enterprise';
+    await render(
+      hbs`
+      <PkiRoleForm
+         @role={{this.role}}
+         @issuers={{this.issuers}}
+         @onCancel={{this.onCancel}}
+         @onSave={{this.onSave}}
+       />
+  `,
+      { owner: this.engine }
+    );
+    assert.dom(GENERAL.fieldByAttr('noStoreMetadata')).exists();
   });
 
   test('it should save a new pki role with various options selected', async function (assert) {
     // Key usage, Key params and Not valid after options are tested in their respective component tests
-    assert.expect(8);
+    assert.expect(7);
     this.server.post(`/${this.role.backend}/roles/test-role`, (schema, req) => {
       assert.ok(true, 'Request made to save role');
       const request = JSON.parse(req.requestBody);
@@ -99,30 +120,27 @@ module('Integration | Component | pki-role-form', function (hooks) {
       { owner: this.engine }
     );
 
-    await click(SELECTORS.roleCreateButton);
+    await click(GENERAL.submitButton);
 
     assert
-      .dom(SELECTORS.roleName)
-      .hasClass('has-error-border', 'shows border error on role name field when no role name is submitted');
-    assert
-      .dom('[data-test-inline-error-message]')
+      .dom(GENERAL.validationErrorByAttr('name'))
       .includesText('Name is required.', 'show correct error message');
 
-    await fillIn(SELECTORS.roleName, 'test-role');
+    await fillIn(GENERAL.inputByAttr('name'), 'test-role');
     await click('[data-test-input="addBasicConstraints"]');
-    await click(SELECTORS.domainHandling);
+    await click(GENERAL.button('Domain handling'));
     await click('[data-test-input="allowedDomainsTemplate"]');
-    await click(SELECTORS.policyIdentifiers);
+    await click(GENERAL.button('Policy identifiers'));
     await fillIn('[data-test-input="policyIdentifiers"] [data-test-string-list-input="0"]', 'some-oid');
-    await click(SELECTORS.san);
+    await click(GENERAL.button('Subject Alternative Name (SAN) Options'));
     await click('[data-test-input="allowUriSansTemplate"]');
-    await click(SELECTORS.additionalSubjectFields);
+    await click(GENERAL.button('Additional subject fields'));
     await fillIn(
       '[data-test-input="allowedSerialNumbers"] [data-test-string-list-input="0"]',
       'some-serial-number'
     );
 
-    await click(SELECTORS.roleCreateButton);
+    await click(GENERAL.submitButton);
   });
 
   test('it should update attributes on the model on update', async function (assert) {
@@ -148,9 +166,9 @@ module('Integration | Component | pki-role-form', function (hooks) {
       `,
       { owner: this.engine }
     );
-    await click(SELECTORS.issuerRefToggle);
-    await fillIn(SELECTORS.issuerRefSelect, 'issuer-1');
-    await click(SELECTORS.roleCreateButton);
+    await click(GENERAL.ttl.toggle('issuerRef-toggle'));
+    await fillIn(GENERAL.selectByAttr('issuerRef'), 'issuer-1');
+    await click(GENERAL.submitButton);
     assert.strictEqual(this.role.issuerRef, 'issuer-1', 'Issuer Ref correctly saved on create');
   });
 
@@ -169,6 +187,7 @@ module('Integration | Component | pki-role-form', function (hooks) {
           key_usage: ['DigitalSignature', 'KeyAgreement', 'KeyEncipherment'],
           not_before_duration: '30s',
           require_cn: true,
+          serial_number_source: 'json-csr',
           signature_bits: '384',
           use_csr_common_name: true,
           use_csr_sans: true,
@@ -202,21 +221,29 @@ module('Integration | Component | pki-role-form', function (hooks) {
       { owner: this.engine }
     );
 
-    await click(SELECTORS.issuerRefToggle);
-    await fillIn(SELECTORS.issuerRefSelect, 'issuer-1');
+    await click(GENERAL.ttl.toggle('issuerRef-toggle'));
+    await fillIn(GENERAL.selectByAttr('issuerRef'), 'issuer-1');
 
-    await click(SELECTORS.keyParams);
-    assert.dom(SELECTORS.keyType).hasValue('rsa');
-    assert.dom(SELECTORS.keyBits).hasValue('3072', 'dropdown has model value, not default value (2048)');
-    assert.dom(SELECTORS.signatureBits).hasValue('512', 'dropdown has model value, not default value (0)');
+    await click(GENERAL.button('Key parameters'));
+    assert.dom(GENERAL.inputByAttr('keyType')).hasValue('rsa');
+    assert
+      .dom(GENERAL.inputByAttr('keyBits'))
+      .hasValue('3072', 'dropdown has model value, not default value (2048)');
+    assert
+      .dom(GENERAL.inputByAttr('signatureBits'))
+      .hasValue('512', 'dropdown has model value, not default value (0)');
 
-    await fillIn(SELECTORS.keyType, 'ec');
-    await fillIn(SELECTORS.keyBits, '224');
-    assert.dom(SELECTORS.keyBits).hasValue('224', 'dropdown has selected value, not default value (256)');
-    await fillIn(SELECTORS.signatureBits, '384');
-    assert.dom(SELECTORS.signatureBits).hasValue('384', 'dropdown has selected value, not default value (0)');
+    await fillIn(GENERAL.inputByAttr('keyType'), 'ec');
+    await fillIn(GENERAL.inputByAttr('keyBits'), '224');
+    assert
+      .dom(GENERAL.inputByAttr('keyBits'))
+      .hasValue('224', 'dropdown has selected value, not default value (256)');
+    await fillIn(GENERAL.inputByAttr('signatureBits'), '384');
+    assert
+      .dom(GENERAL.inputByAttr('signatureBits'))
+      .hasValue('384', 'dropdown has selected value, not default value (0)');
 
-    await click(SELECTORS.roleCreateButton);
+    await click(GENERAL.submitButton);
     assert.strictEqual(this.role.issuerRef, 'issuer-1', 'Issuer Ref correctly saved on create');
   });
 });
diff --git a/ui/tests/integration/components/pki/pki-role-generate-test.js b/ui/tests/integration/components/pki/pki-role-generate-test.js
index 1eab0863dc1..77221f097db 100644
--- a/ui/tests/integration/components/pki/pki-role-generate-test.js
+++ b/ui/tests/integration/components/pki/pki-role-generate-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,7 +10,8 @@ import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { setupEngine } from 'ember-engines/test-support';
 import Sinon from 'sinon';
-import { SELECTORS } from 'vault/tests/helpers/pki/pki-role-generate';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { PKI_ROLE_GENERATE } from 'vault/tests/helpers/pki/pki-selectors';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
 
 module('Integration | Component | pki-role-generate', function (hooks) {
@@ -42,10 +43,10 @@ module('Integration | Component | pki-role-generate', function (hooks) {
   `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.form).exists('shows the cert generate form');
-    assert.dom(SELECTORS.commonNameField).exists('shows the common name field');
-    assert.dom(SELECTORS.optionsToggle).exists('toggle exists');
-    await fillIn(SELECTORS.commonNameField, 'example.com');
+    assert.dom(PKI_ROLE_GENERATE.form).exists('shows the cert generate form');
+    assert.dom(GENERAL.inputByAttr('commonName')).exists('shows the common name field');
+    assert.dom(GENERAL.button('Subject Alternative Name (SAN) Options')).exists('toggle exists');
+    await fillIn(GENERAL.inputByAttr('commonName'), 'example.com');
     assert.strictEqual(this.model.commonName, 'example.com', 'Filling in the form updates the model');
   });
 
@@ -68,10 +69,12 @@ module('Integration | Component | pki-role-generate', function (hooks) {
   `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.form).doesNotExist('Does not show the form');
-    assert.dom(SELECTORS.downloadButton).exists('shows the download button');
-    assert.dom(SELECTORS.revokeButton).exists('shows the revoke button');
-    assert.dom(SELECTORS.certificate).exists({ count: 1 }, 'shows certificate info row');
-    assert.dom(SELECTORS.serialNumber).hasText('abcd-efgh-ijkl', 'shows serial number info row');
+    assert.dom(PKI_ROLE_GENERATE.form).doesNotExist('Does not show the form');
+    assert.dom(PKI_ROLE_GENERATE.downloadButton).exists('shows the download button');
+    assert.dom(PKI_ROLE_GENERATE.revokeButton).exists('shows the revoke button');
+    assert.dom(GENERAL.infoRowValue('Certificate')).exists({ count: 1 }, 'shows certificate info row');
+    assert
+      .dom(GENERAL.infoRowValue('Serial number'))
+      .hasText('abcd-efgh-ijkl', 'shows serial number info row');
   });
 });
diff --git a/ui/tests/integration/components/pki/pki-sign-intermediate-form-test.js b/ui/tests/integration/components/pki/pki-sign-intermediate-form-test.js
index e3d4af60d69..b910ddbf29f 100644
--- a/ui/tests/integration/components/pki/pki-sign-intermediate-form-test.js
+++ b/ui/tests/integration/components/pki/pki-sign-intermediate-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,21 +10,14 @@ import { hbs } from 'ember-cli-htmlbars';
 import Sinon from 'sinon';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const selectors = {
   form: '[data-test-sign-intermediate-form]',
-  csrInput: '[data-test-input="csr"]',
-  toggleSigningOptions: '[data-test-toggle-group="Signing options"]',
-  toggleSANOptions: '[data-test-toggle-group="Subject Alternative Name (SAN) Options"]',
-  toggleAdditionalFields: '[data-test-toggle-group="Additional subject fields"]',
-  fieldByName: (name) => `[data-test-field="${name}"]`,
   saveButton: '[data-test-pki-sign-intermediate-save]',
   cancelButton: '[data-test-pki-sign-intermediate-cancel]',
-  fieldError: '[data-test-inline-alert]',
   formError: '[data-test-form-error]',
   resultsContainer: '[data-test-sign-intermediate-result]',
-  rowByName: (name) => `[data-test-row-label="${name}"]`,
-  valueByName: (name) => `[data-test-value-div="${name}"]`,
 };
 module('Integration | Component | pki-sign-intermediate-form', function (hooks) {
   setupRenderingTest(hooks);
@@ -40,7 +33,7 @@ module('Integration | Component | pki-sign-intermediate-form', function (hooks)
   });
 
   test('renders correctly on load', async function (assert) {
-    assert.expect(9);
+    assert.expect(10);
     await render(hbs`<PkiSignIntermediateForm @onCancel={{this.onCancel}} @model={{this.model}} />`, {
       owner: this.engine,
     });
@@ -48,18 +41,23 @@ module('Integration | Component | pki-sign-intermediate-form', function (hooks)
     assert.dom(selectors.form).exists('Form is rendered');
     assert.dom(selectors.resultsContainer).doesNotExist('Results display not rendered');
     assert.dom('[data-test-field]').exists({ count: 9 }, '9 default fields shown');
-    assert.dom(selectors.toggleSigningOptions).exists();
-    assert.dom(selectors.toggleSANOptions).exists();
-    assert.dom(selectors.toggleAdditionalFields).exists();
+    [
+      'Name constraints',
+      'Signing options',
+      'Subject Alternative Name (SAN) Options',
+      'Additional subject fields',
+    ].forEach((group) => {
+      assert.dom(GENERAL.button(group)).exists(`${group} renders`);
+    });
 
-    await click(selectors.toggleSigningOptions);
+    await click(GENERAL.button('Signing options'));
     ['usePss', 'skid', 'signatureBits'].forEach((name) => {
-      assert.dom(selectors.fieldByName(name)).exists();
+      assert.dom(GENERAL.fieldByAttr(name)).exists();
     });
   });
 
   test('it shows the returned values on successful save', async function (assert) {
-    assert.expect(13);
+    assert.expect(12);
     await render(hbs`<PkiSignIntermediateForm @onCancel={{this.onCancel}} @model={{this.model}} />`, {
       owner: this.engine,
     });
@@ -79,10 +77,9 @@ module('Integration | Component | pki-sign-intermediate-form', function (hooks)
     });
     await click(selectors.saveButton);
     assert.dom(selectors.formError).hasText('There is an error with this form.', 'Shows validation errors');
-    assert.dom(selectors.csrInput).hasClass('has-error-border');
-    assert.dom(selectors.fieldError).hasText('CSR is required.');
+    assert.dom(GENERAL.validationErrorByAttr('csr')).hasText('CSR is required.');
 
-    await fillIn(selectors.csrInput, 'example-data');
+    await fillIn(GENERAL.inputByAttr('csr'), 'example-data');
     await click(selectors.saveButton);
     [
       { label: 'Serial number' },
@@ -90,12 +87,12 @@ module('Integration | Component | pki-sign-intermediate-form', function (hooks)
       { label: 'Certificate', isCertificate: true },
       { label: 'Issuing CA', isCertificate: true },
     ].forEach(({ label, isCertificate }) => {
-      assert.dom(selectors.rowByName(label)).exists();
+      assert.dom(GENERAL.infoRowLabel(label)).exists();
       if (isCertificate) {
-        assert.dom(selectors.valueByName(label)).includesText('PEM Format', `${label} is isCertificate`);
+        assert.dom(GENERAL.infoRowValue(label)).includesText('PEM Format', `${label} is isCertificate`);
       } else {
-        assert.dom(selectors.valueByName(label)).hasText('31:52:b9:09:40', `Renders ${label}`);
-        assert.dom(`${selectors.valueByName(label)} a`).exists(`${label} is a link`);
+        assert.dom(GENERAL.infoRowValue(label)).hasText('31:52:b9:09:40', `Renders ${label}`);
+        assert.dom(`${GENERAL.infoRowValue(label)} a`).exists(`${label} is a link`);
       }
     });
   });
diff --git a/ui/tests/integration/components/pki/pki-tidy-form-test.js b/ui/tests/integration/components/pki/pki-tidy-form-test.js
index 1c7d6800f69..a6b8529bc58 100644
--- a/ui/tests/integration/components/pki/pki-tidy-form-test.js
+++ b/ui/tests/integration/components/pki/pki-tidy-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,7 +9,9 @@ import { click, render, fillIn } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { SELECTORS } from 'vault/tests/helpers/pki/page/pki-tidy-form';
+import { PKI_TIDY_FORM } from 'vault/tests/helpers/pki/pki-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { convertToSeconds } from 'core/utils/duration-utils';
 
 module('Integration | Component | pki tidy form', function (hooks) {
   setupRenderingTest(hooks);
@@ -24,21 +26,36 @@ module('Integration | Component | pki tidy form', function (hooks) {
     this.onSave = () => {};
     this.onCancel = () => {};
     this.manualTidy = this.store.createRecord('pki/tidy', { backend: 'pki-manual-tidy' });
+    this.autoTidyServerDefaults = {
+      enabled: false,
+      interval_duration: '12h',
+      safety_buffer: '3d',
+      issuer_safety_buffer: '365d',
+      min_startup_backoff_duration: '5m',
+      max_startup_backoff_duration: '15m',
+    };
     this.store.pushPayload('pki/tidy', {
       modelName: 'pki/tidy',
       id: 'pki-auto-tidy',
+      // setting defaults here to simulate how this form works in the app.
+      // on init, we retrieve these from the server and pre-populate form (instead of explicitly set on the model)
+      ...this.autoTidyServerDefaults,
     });
     this.autoTidy = this.store.peekRecord('pki/tidy', 'pki-auto-tidy');
+    this.numTidyAttrs = Object.keys(this.autoTidy.allByKey).length;
   });
 
   test('it hides or shows fields depending on auto-tidy toggle', async function (assert) {
-    assert.expect(37);
     const sectionHeaders = [
+      'Automatic tidy settings',
       'Universal operations',
       'ACME operations',
       'Issuer operations',
       'Cross-cluster operations',
     ];
+    const loopAssertCount = this.numTidyAttrs * 2 - 3; // loop skips 3 params
+    const headerAssertCount = sectionHeaders.length * 2;
+    assert.expect(loopAssertCount + headerAssertCount + 4);
 
     await render(
       hbs`
@@ -51,38 +68,42 @@ module('Integration | Component | pki tidy form', function (hooks) {
     `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.toggleInput('intervalDuration')).isNotChecked('Automatic tidy is disabled');
-    assert.dom(`[data-test-ttl-form-label="Automatic tidy disabled"]`).exists('renders disabled label text');
+    assert.dom(GENERAL.toggleInput('enabled')).isNotChecked();
+    assert
+      .dom(GENERAL.ttl.toggle('enabled'))
+      .hasText('Automatic tidy disabled Automatic tidy operations will not run.');
 
     this.autoTidy.eachAttribute((attr) => {
-      if (attr === 'enabled' || attr === 'intervalDuration') return;
-      assert.dom(SELECTORS.inputByAttr(attr)).doesNotExist(`does not render ${attr} when auto tidy disabled`);
+      if (attr === 'enabled') return;
+      assert
+        .dom(PKI_TIDY_FORM.inputByAttr(attr))
+        .doesNotExist(`does not render ${attr} when auto tidy disabled`);
     });
 
     sectionHeaders.forEach((group) => {
-      assert.dom(SELECTORS.tidySectionHeader(group)).doesNotExist(`does not render ${group} header`);
+      assert.dom(PKI_TIDY_FORM.tidySectionHeader(group)).doesNotExist(`does not render ${group} header`);
     });
 
     // ENABLE AUTO TIDY
-    await click(SELECTORS.toggleInput('intervalDuration'));
-    assert.dom(SELECTORS.toggleInput('intervalDuration')).isChecked('Automatic tidy is enabled');
-    assert.dom(`[data-test-ttl-form-label="Automatic tidy enabled"]`).exists('renders enabled text');
+    await click(GENERAL.toggleInput('enabled'));
+    assert.dom(GENERAL.toggleInput('enabled')).isChecked();
+    assert.dom(GENERAL.ttl.toggle('enabled')).hasText('Automatic tidy enabled');
 
     this.autoTidy.eachAttribute((attr) => {
-      const skipFields = ['enabled', 'tidyAcme', 'intervalDuration'];
+      const skipFields = ['enabled', 'tidyAcme'];
       if (skipFields.includes(attr)) return; // combined with duration ttl or asserted elsewhere
-      assert.dom(SELECTORS.inputByAttr(attr)).exists(`renders ${attr} when auto tidy enabled`);
+      assert.dom(PKI_TIDY_FORM.inputByAttr(attr)).exists(`renders ${attr} when auto tidy enabled`);
     });
 
     sectionHeaders.forEach((group) => {
-      assert.dom(SELECTORS.tidySectionHeader(group)).exists(`renders ${group} header`);
+      assert.dom(PKI_TIDY_FORM.tidySectionHeader(group)).exists(`renders ${group} header`);
     });
   });
 
   test('it renders all attribute fields, including enterprise', async function (assert) {
-    assert.expect(25);
+    assert.expect(35);
     this.autoTidy.enabled = true;
-    const skipFields = ['enabled', 'tidyAcme', 'intervalDuration']; // combined with duration ttl or asserted separately
+    const skipFields = ['enabled', 'tidyAcme']; // combined with duration ttl or asserted separately
     await render(
       hbs`
       <PkiTidyForm
@@ -97,9 +118,10 @@ module('Integration | Component | pki tidy form', function (hooks) {
 
     this.autoTidy.eachAttribute((attr) => {
       if (skipFields.includes(attr)) return;
-      assert.dom(SELECTORS.inputByAttr(attr)).exists(`renders ${attr} for auto tidyType`);
+      assert.dom(PKI_TIDY_FORM.inputByAttr(attr)).exists(`renders ${attr} for auto tidyType`);
     });
 
+    // MANUAL TIDY
     await render(
       hbs`
       <PkiTidyForm
@@ -111,16 +133,22 @@ module('Integration | Component | pki tidy form', function (hooks) {
     `,
       { owner: this.engine }
     );
-    assert.dom(SELECTORS.toggleInput('intervalDuration')).doesNotExist('hides automatic tidy toggle');
+    assert.dom(GENERAL.toggleInput('enabled')).doesNotExist('hides automatic tidy toggle');
 
     this.manualTidy.eachAttribute((attr) => {
       if (skipFields.includes(attr)) return;
-      assert.dom(SELECTORS.inputByAttr(attr)).exists(`renders ${attr} for manual tidyType`);
+      // auto tidy fields we shouldn't see in the manual tidy form
+      if (this.manualTidy.autoTidyConfigFields.includes(attr)) {
+        assert
+          .dom(PKI_TIDY_FORM.inputByAttr(attr))
+          .doesNotExist(`${attr} should not appear on manual tidyType`);
+      } else {
+        assert.dom(PKI_TIDY_FORM.inputByAttr(attr)).exists(`renders ${attr} for manual tidyType`);
+      }
     });
   });
 
-  test('it hides enterprise fields for OSS', async function (assert) {
-    assert.expect(7);
+  test('it hides enterprise fields for CE', async function (assert) {
     this.version.type = 'community';
     this.autoTidy.enabled = true;
 
@@ -144,11 +172,13 @@ module('Integration | Component | pki tidy form', function (hooks) {
     );
 
     assert
-      .dom(SELECTORS.tidySectionHeader('Cross-cluster operations'))
+      .dom(PKI_TIDY_FORM.tidySectionHeader('Cross-cluster operations'))
       .doesNotExist(`does not render ent header`);
 
     enterpriseFields.forEach((entAttr) => {
-      assert.dom(SELECTORS.inputByAttr(entAttr)).doesNotExist(`does not render ${entAttr} for auto tidyType`);
+      assert
+        .dom(PKI_TIDY_FORM.inputByAttr(entAttr))
+        .doesNotExist(`does not render ${entAttr} for auto tidyType`);
     });
 
     // tidyType = manual
@@ -166,26 +196,46 @@ module('Integration | Component | pki tidy form', function (hooks) {
 
     enterpriseFields.forEach((entAttr) => {
       assert
-        .dom(SELECTORS.inputByAttr(entAttr))
+        .dom(PKI_TIDY_FORM.inputByAttr(entAttr))
         .doesNotExist(`does not render ${entAttr} for manual tidyType`);
     });
   });
 
   test('it should change the attributes on the model', async function (assert) {
     assert.expect(12);
+    // ttl picker defaults to seconds, unless unit is set by default value (set in beforeEach hook)
+    // on submit, any user inputted values should be converted to seconds for the payload
+    const fillInValues = {
+      acmeAccountSafetyBuffer: { time: 680, unit: 'h' },
+      intervalDuration: { time: 10, unit: 'h' },
+      issuerSafetyBuffer: { time: 20, unit: 'd' },
+      maxStartupBackoffDuration: { time: 30, unit: 'm' },
+      minStartupBackoffDuration: { time: 10, unit: 'm' },
+      pauseDuration: { time: 30, unit: 's' },
+      revocationQueueSafetyBuffer: { time: 40, unit: 's' },
+      safetyBuffer: { time: 50, unit: 'd' },
+    };
+    const calcValue = (param) => {
+      const { time, unit } = fillInValues[param];
+      return `${convertToSeconds(time, unit)}s`;
+    };
     this.server.post('/pki-auto-tidy/config/auto-tidy', (schema, req) => {
       assert.propEqual(
         JSON.parse(req.requestBody),
         {
-          acme_account_safety_buffer: '60s',
+          acme_account_safety_buffer: '48h',
           enabled: true,
-          interval_duration: '10s',
-          issuer_safety_buffer: '20s',
-          pause_duration: '30s',
-          revocation_queue_safety_buffer: '40s',
-          safety_buffer: '50s',
+          min_startup_backoff_duration: calcValue('minStartupBackoffDuration'),
+          max_startup_backoff_duration: calcValue('maxStartupBackoffDuration'),
+          interval_duration: calcValue('intervalDuration'),
+          issuer_safety_buffer: calcValue('issuerSafetyBuffer'),
+          pause_duration: calcValue('pauseDuration'),
+          revocation_queue_safety_buffer: calcValue('revocationQueueSafetyBuffer'),
+          safety_buffer: calcValue('safetyBuffer'),
           tidy_acme: true,
+          tidy_cert_metadata: true,
           tidy_cert_store: true,
+          tidy_cmpv2_nonce_store: true,
           tidy_cross_cluster_revoked_certs: true,
           tidy_expired_issuers: true,
           tidy_move_legacy_ca_bundle: true,
@@ -208,45 +258,40 @@ module('Integration | Component | pki tidy form', function (hooks) {
       { owner: this.engine }
     );
 
-    assert.dom(SELECTORS.toggleInput('intervalDuration')).isNotChecked('Automatic tidy is disabled');
-    assert.dom(SELECTORS.toggleLabel('Automatic tidy disabled')).exists('auto tidy has disabled label');
+    assert.dom(GENERAL.toggleInput('enabled')).isNotChecked();
+    assert.dom(GENERAL.ttl.toggle('enabled')).hasTextContaining('Automatic tidy disabled');
     assert.false(this.autoTidy.enabled, 'enabled is false on model');
 
     // enable auto-tidy
-    await click(SELECTORS.toggleInput('intervalDuration'));
-    await fillIn(SELECTORS.intervalDuration, 10);
-
-    assert.dom(SELECTORS.toggleInput('intervalDuration')).isChecked('toggle enabled auto tidy');
-    assert.dom(SELECTORS.toggleLabel('Automatic tidy enabled')).exists('auto tidy has enabled label');
+    await click(GENERAL.toggleInput('enabled'));
+    assert.dom(GENERAL.toggleInput('enabled')).isChecked();
+    assert.dom(GENERAL.ttl.toggle('enabled')).hasText('Automatic tidy enabled');
 
-    assert.dom(SELECTORS.toggleInput('acmeAccountSafetyBuffer')).isNotChecked('ACME tidy is disabled');
-    assert.dom(SELECTORS.toggleLabel('Tidy ACME disabled')).exists('ACME label has correct disabled text');
+    assert.dom(PKI_TIDY_FORM.toggleInput('acmeAccountSafetyBuffer')).isNotChecked('ACME tidy is disabled');
+    assert
+      .dom(PKI_TIDY_FORM.toggleLabel('Tidy ACME disabled'))
+      .exists('ACME label has correct disabled text');
     assert.false(this.autoTidy.tidyAcme, 'tidyAcme is false on model');
 
-    await click(SELECTORS.toggleInput('acmeAccountSafetyBuffer'));
-    await fillIn(SELECTORS.acmeAccountSafetyBuffer, 60);
+    await click(PKI_TIDY_FORM.toggleInput('acmeAccountSafetyBuffer'));
+    await fillIn(PKI_TIDY_FORM.acmeAccountSafetyBuffer, 2); // units are days based on defaultValue
+    assert.dom(PKI_TIDY_FORM.toggleInput('acmeAccountSafetyBuffer')).isChecked('ACME tidy is enabled');
+    assert.dom(PKI_TIDY_FORM.toggleLabel('Tidy ACME enabled')).exists('ACME label has correct enabled text');
     assert.true(this.autoTidy.tidyAcme, 'tidyAcme toggles to true');
 
-    const fillInValues = {
-      issuerSafetyBuffer: 20,
-      pauseDuration: 30,
-      revocationQueueSafetyBuffer: 40,
-      safetyBuffer: 50,
-    };
     this.autoTidy.eachAttribute(async (attr, { type }) => {
-      const skipFields = ['enabled', 'tidyAcme', 'intervalDuration', 'acmeAccountSafetyBuffer']; // combined with duration ttl or asserted separately
+      const skipFields = ['enabled', 'tidyAcme', 'acmeAccountSafetyBuffer']; // combined with duration ttl or asserted separately
       if (skipFields.includes(attr)) return;
+      // all params right now are either a boolean or TTL, this if/else will need to be updated if that changes
       if (type === 'boolean') {
-        await click(SELECTORS.inputByAttr(attr));
-      }
-      if (type === 'string') {
-        await fillIn(SELECTORS.toggleInput(attr), `${fillInValues[attr]}`);
+        await click(PKI_TIDY_FORM.inputByAttr(attr));
+      } else {
+        const { time } = fillInValues[attr];
+        await fillIn(PKI_TIDY_FORM.toggleInput(attr), `${time}`);
       }
     });
 
-    assert.dom(SELECTORS.toggleInput('acmeAccountSafetyBuffer')).isChecked('ACME tidy is enabled');
-    assert.dom(SELECTORS.toggleLabel('Tidy ACME enabled')).exists('ACME label has correct enabled text');
-    await click(SELECTORS.tidySave);
+    await click(PKI_TIDY_FORM.tidySave);
   });
 
   test('it updates auto-tidy config', async function (assert) {
@@ -256,10 +301,11 @@ module('Integration | Component | pki tidy form', function (hooks) {
       assert.propEqual(
         JSON.parse(req.requestBody),
         {
-          enabled: false,
+          ...this.autoTidyServerDefaults,
+          acme_account_safety_buffer: '720h',
           tidy_acme: false,
         },
-        'response contains auto-tidy params'
+        'response contains default auto-tidy params'
       );
     });
     this.onSave = () => assert.ok(true, 'onSave callback fires on save success');
@@ -277,8 +323,8 @@ module('Integration | Component | pki tidy form', function (hooks) {
       { owner: this.engine }
     );
 
-    await click(SELECTORS.tidySave);
-    await click(SELECTORS.tidyCancel);
+    await click(PKI_TIDY_FORM.tidySave);
+    await click(PKI_TIDY_FORM.tidyCancel);
   });
 
   test('it saves and performs manual tidy', async function (assert) {
@@ -288,7 +334,7 @@ module('Integration | Component | pki tidy form', function (hooks) {
       assert.ok(true, 'Request made to perform manual tidy');
       assert.propEqual(
         JSON.parse(req.requestBody),
-        { tidy_acme: false },
+        { acme_account_safety_buffer: '720h', tidy_acme: false },
         'response contains manual tidy params'
       );
       return { id: 'pki-manual-tidy' };
@@ -308,7 +354,7 @@ module('Integration | Component | pki tidy form', function (hooks) {
       { owner: this.engine }
     );
 
-    await click(SELECTORS.tidySave);
-    await click(SELECTORS.tidyCancel);
+    await click(PKI_TIDY_FORM.tidySave);
+    await click(PKI_TIDY_FORM.tidyCancel);
   });
 });
diff --git a/ui/tests/integration/components/plugin-documentation-flyout-test.js b/ui/tests/integration/components/plugin-documentation-flyout-test.js
new file mode 100644
index 00000000000..772df853769
--- /dev/null
+++ b/ui/tests/integration/components/plugin-documentation-flyout-test.js
@@ -0,0 +1,166 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render, click } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | plugin-documentation-flyout', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.onClose = sinon.spy();
+  });
+
+  test('it does not render when closed', async function (assert) {
+    this.isOpen = false;
+
+    await render(hbs`
+      <PluginDocumentationFlyout 
+        @isOpen={{this.isOpen}}
+        @onClose={{this.onClose}}
+      />
+    `);
+
+    // Check that no flyout-related elements are present
+    assert.dom('.hds-flyout').doesNotExist('no flyout container when closed');
+    assert.dom(GENERAL.flyout).doesNotExist('no flyout element when closed');
+    assert.dom('.hds-flyout__header').doesNotExist('no flyout header when closed');
+    assert.dom('.hds-flyout__body').doesNotExist('no flyout body when closed');
+  });
+
+  test('it renders plugin-specific content', async function (assert) {
+    this.isOpen = true;
+    this.pluginName = 'aws';
+    this.pluginType = 'secret';
+    this.displayName = 'AWS';
+
+    await render(hbs`
+      <PluginDocumentationFlyout 
+        @isOpen={{this.isOpen}}
+        @pluginName={{this.pluginName}}
+        @pluginType={{this.pluginType}}
+        @displayName={{this.displayName}}
+        @onClose={{this.onClose}}
+      />
+    `);
+
+    assert.dom(GENERAL.flyout).exists('renders flyout when open');
+    assert
+      .dom(`${GENERAL.flyout} .hds-flyout__header`)
+      .containsText('AWS plugin information', 'shows plugin-specific header');
+    assert
+      .dom(`${GENERAL.flyout} .hds-flyout__body`)
+      .containsText('AWS secrets engine', 'shows plugin type in body');
+    assert
+      .dom(`${GENERAL.flyout} .hds-flyout__body`)
+      .containsText('not currently enabled', 'explains plugin is not enabled');
+  });
+
+  test('it renders generic external plugins content', async function (assert) {
+    this.isOpen = true;
+    // No pluginName means this is for external plugins help
+
+    await render(hbs`
+      <PluginDocumentationFlyout 
+        @isOpen={{this.isOpen}}
+        @onClose={{this.onClose}}
+      />
+    `);
+
+    assert.dom(GENERAL.flyout).exists('renders flyout when open');
+    assert
+      .dom(`${GENERAL.flyout} .hds-flyout__header`)
+      .containsText('External plugins information', 'shows external plugins header');
+    assert
+      .dom(`${GENERAL.flyout} .hds-flyout__body`)
+      .containsText('External plugins are plugins found in the plugin catalog', 'explains external plugins');
+    assert.dom(GENERAL.linkTo('Register and enable external plugins')).exists('shows register plugins link');
+    assert.dom(GENERAL.linkTo('Plugin development guide')).exists('shows plugin development link');
+  });
+
+  test('it renders auth method content', async function (assert) {
+    this.isOpen = true;
+    this.pluginName = 'ldap';
+    this.pluginType = 'auth';
+    this.displayName = 'LDAP';
+
+    await render(hbs`
+      <PluginDocumentationFlyout 
+        @isOpen={{this.isOpen}}
+        @pluginName={{this.pluginName}}
+        @pluginType={{this.pluginType}}
+        @displayName={{this.displayName}}
+        @onClose={{this.onClose}}
+      />
+    `);
+
+    assert
+      .dom(`${GENERAL.flyout} .hds-flyout__body`)
+      .containsText('LDAP auth method', 'shows auth method type in body');
+  });
+
+  test('it handles close action', async function (assert) {
+    this.isOpen = true;
+
+    await render(hbs`
+      <PluginDocumentationFlyout 
+        @isOpen={{this.isOpen}}
+        @onClose={{this.onClose}}
+      />
+    `);
+
+    await click(GENERAL.button('Close'));
+    assert.ok(this.onClose.calledOnce, 'calls onClose when close button clicked');
+  });
+
+  test('it shows documentation links', async function (assert) {
+    this.isOpen = true;
+    this.pluginName = 'aws';
+
+    await render(hbs`
+      <PluginDocumentationFlyout 
+        @isOpen={{this.isOpen}}
+        @pluginName={{this.pluginName}}
+        @onClose={{this.onClose}}
+      />
+    `);
+
+    assert
+      .dom(GENERAL.linkTo('Register and enable external plugins'))
+      .exists('shows register plugins documentation link');
+    assert
+      .dom(GENERAL.linkTo('Register and enable external plugins'))
+      .hasAttribute(
+        'href',
+        'https://developer.hashicorp.com/vault/docs/plugins/register',
+        'has correct documentation URL'
+      );
+    assert
+      .dom(GENERAL.linkTo('Register and enable external plugins'))
+      .hasAttribute('target', '_blank', 'opens in new tab');
+  });
+
+  test('it uses fallback display name when not provided', async function (assert) {
+    this.isOpen = true;
+    this.pluginName = 'my-custom-plugin';
+    // No displayName provided
+
+    await render(hbs`
+      <PluginDocumentationFlyout 
+        @isOpen={{this.isOpen}}
+        @pluginName={{this.pluginName}}
+        @onClose={{this.onClose}}
+      />
+    `);
+
+    assert
+      .dom(`${GENERAL.flyout} .hds-flyout__header`)
+      .containsText('my-custom-plugin plugin information', 'uses plugin name as fallback');
+  });
+});
diff --git a/ui/tests/integration/components/policy-example-test.js b/ui/tests/integration/components/policy-example-test.js
index 884b6dfe8a9..91799d0e340 100644
--- a/ui/tests/integration/components/policy-example-test.js
+++ b/ui/tests/integration/components/policy-example-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,7 +12,7 @@ import { setRunOptions } from 'ember-a11y-testing/test-support';
 const SELECTORS = {
   policyText: '[data-test-modal-title]',
   policyDescription: (type) => `[data-test-example-modal-text=${type}]`,
-  jsonText: '[data-test-component="code-mirror-modifier"]',
+  jsonText: '.hds-code-block',
   informationLink: '[data-test-example-modal-information-link]',
 };
 
@@ -22,8 +22,6 @@ module('Integration | Component | policy-example', function (hooks) {
   hooks.beforeEach(function () {
     setRunOptions({
       rules: {
-        // TODO: Fix JSONEditor/CodeMirror
-        label: { enabled: false },
         // failing on .CodeMirror-scroll
         'scrollable-region-focusable': { enabled: false },
       },
@@ -52,7 +50,7 @@ module('Integration | Component | policy-example', function (hooks) {
     assert
       .dom(SELECTORS.policyDescription('rgp'))
       .hasText(
-        'Role Governing Policies (RGPs) are tied to client tokens or identities which is similar to ACL policies . They use Sentinel as a language framework to enable fine-grained policy decisions.'
+        'Role Governing Policies (RGPs) are tied to client tokens or identities which is similar to ACL policies. They use Sentinel as a language framework to enable fine-grained policy decisions.'
       );
   });
 
diff --git a/ui/tests/integration/components/policy-form-test.js b/ui/tests/integration/components/policy-form-test.js
index bcb41c94aec..e2964bdf77f 100644
--- a/ui/tests/integration/components/policy-form-test.js
+++ b/ui/tests/integration/components/policy-form-test.js
@@ -1,26 +1,26 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { click, fillIn, render, triggerEvent } from '@ember/test-helpers';
+import { click, fillIn, render, settled, triggerEvent, waitFor } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
-import Pretender from 'pretender';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import codemirror, { setCodeEditorValue } from 'vault/tests/helpers/codemirror';
 
 const SELECTORS = {
   nameInput: '[data-test-policy-input="name"]',
   uploadFileToggle: '[data-test-policy-edit-toggle]',
   policyEditor: '[data-test-policy-editor]',
   policyUpload: '[data-test-text-file-input]',
-  saveButton: '[data-test-policy-save]',
-  cancelButton: '[data-test-policy-cancel]',
+  altTabMessage: '[data-test-alt-tab-message]',
   error: '[data-test-message-error]',
   // For example modal:
-  exampleButton: '[data-test-policy-example-button]',
   exampleModal: '[data-test-policy-example-modal]',
   exampleModalTitle: '[data-test-modal-title]',
   exampleModalClose: '[data-test-modal-close-button]',
@@ -29,42 +29,30 @@ const SELECTORS = {
   pathsInput: (index) => `[data-test-string-list-input="${index}"]`,
 };
 
+async function setEditorValue(value) {
+  await waitFor('.cm-editor');
+  const editor = codemirror(SELECTORS.policyEditor);
+  setCodeEditorValue(editor, value);
+  return settled();
+}
+
 module('Integration | Component | policy-form', function (hooks) {
   setupRenderingTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
     this.store = this.owner.lookup('service:store');
     this.model = this.store.createRecord('policy/acl');
     this.onSave = sinon.spy();
     this.onCancel = sinon.spy();
-    this.server = new Pretender(function () {
-      this.put('/v1/sys/policies/acl/bad-policy', () => {
-        return [
-          400,
-          { 'Content-Type': 'application/json' },
-          JSON.stringify({ errors: ['An error occurred'] }),
-        ];
-      });
-      this.put('/v1/sys/policies/acl/**', () => {
-        return [204, { 'Content-Type': 'application/json' }];
-      });
-      this.put('/v1/sys/policies/rgp/**', () => {
-        return [204, { 'Content-Type': 'application/json' }];
-      });
-      this.put('/v1/sys/policies/egp/**', () => {
-        return [204, { 'Content-Type': 'application/json' }];
-      });
-    });
-    setRunOptions({
-      rules: {
-        // TODO: fix JSONEditor/CodeMirror
-        label: { enabled: false },
-        'label-title-only': { enabled: false },
-      },
+    this.server.put('/sys/policies/acl/:name', (_, req) => {
+      if (req.params.name === 'bad-policy') {
+        return overrideResponse(400, { errors: ['An error occurred'] });
+      }
+      return overrideResponse(204);
     });
-  });
-  hooks.afterEach(function () {
-    this.server.shutdown();
+    this.server.put('/sys/policies/rgp/:name', () => overrideResponse(204));
+    this.server.put('/sys/policies/egp/:name', () => overrideResponse(204));
   });
 
   test('it renders the form for new ACL policy', async function (assert) {
@@ -85,11 +73,11 @@ module('Integration | Component | policy-form', function (hooks) {
     assert.dom(SELECTORS.uploadFileToggle).exists({ count: 1 }, 'Upload file toggle exists');
     await fillIn(SELECTORS.nameInput, 'Foo');
     assert.strictEqual(this.model.name, 'foo', 'Input sets name on model to lowercase input');
-    await fillIn(`${SELECTORS.policyEditor} textarea`, policy);
+    await setEditorValue(policy);
     assert.strictEqual(this.model.policy, policy, 'Policy editor sets policy on model');
     assert.ok(this.onSave.notCalled);
-    assert.dom(SELECTORS.saveButton).hasText('Create policy');
-    await click(SELECTORS.saveButton);
+    assert.dom(GENERAL.submitButton).hasText('Create policy');
+    await click(GENERAL.submitButton);
     assert.ok(this.onSave.calledOnceWith(this.model));
   });
 
@@ -113,11 +101,11 @@ module('Integration | Component | policy-form', function (hooks) {
     assert.dom(SELECTORS.uploadFileToggle).exists({ count: 1 }, 'Upload file toggle exists');
     await fillIn(SELECTORS.nameInput, 'Foo');
     assert.strictEqual(this.model.name, 'foo', 'Input sets name on model to lowercase input');
-    await fillIn(`${SELECTORS.policyEditor} textarea`, policy);
+    await setEditorValue(policy);
     assert.strictEqual(this.model.policy, policy, 'Policy editor sets policy on model');
     assert.ok(this.onSave.notCalled);
-    assert.dom(SELECTORS.saveButton).hasText('Create policy');
-    await click(SELECTORS.saveButton);
+    assert.dom(GENERAL.submitButton).hasText('Create policy');
+    await click(GENERAL.submitButton);
     assert.ok(this.onSave.calledOnceWith(this.model));
   });
 
@@ -141,14 +129,14 @@ module('Integration | Component | policy-form', function (hooks) {
     assert.dom(SELECTORS.uploadFileToggle).exists({ count: 1 }, 'Upload file toggle exists');
     await fillIn(SELECTORS.nameInput, 'Foo');
     assert.strictEqual(this.model.name, 'foo', 'Input sets name on model to lowercase input');
-    await fillIn(`${SELECTORS.policyEditor} textarea`, policy);
+    await setEditorValue(policy);
     assert.strictEqual(this.model.policy, policy, 'Policy editor sets policy on model');
     assert.dom(SELECTORS.fields('paths')).exists('Paths field exists');
     assert.dom(SELECTORS.pathsInput('0')).exists('0 field exists');
     await fillIn(SELECTORS.pathsInput('0'), 'my path');
     assert.ok(this.onSave.notCalled);
-    assert.dom(SELECTORS.saveButton).hasText('Create policy');
-    await click(SELECTORS.saveButton);
+    assert.dom(GENERAL.submitButton).hasText('Create policy');
+    await click(GENERAL.submitButton);
     assert.ok(this.onSave.calledOnceWith(this.model));
   });
 
@@ -173,7 +161,7 @@ module('Integration | Component | policy-form', function (hooks) {
     assert.dom(SELECTORS.policyEditor).doesNotExist('Policy editor is not shown');
     await triggerEvent(SELECTORS.policyUpload, 'change', { files: [this.file] });
     assert.dom(SELECTORS.nameInput).hasValue('test-policy', 'it fills in policy name');
-    await click(SELECTORS.saveButton);
+    await click(GENERAL.submitButton);
     assert.propEqual(this.onSave.lastCall.args[0].policy, policy, 'policy content saves in correct format');
   });
 
@@ -195,15 +183,11 @@ module('Integration | Component | policy-form', function (hooks) {
     assert.dom(SELECTORS.nameInput).doesNotExist('Name input is not rendered');
     assert.dom(SELECTORS.uploadFileToggle).doesNotExist('Upload file toggle does not exist');
 
-    await fillIn(`${SELECTORS.policyEditor} textarea`, 'updated-');
-    assert.strictEqual(
-      this.model.policy,
-      'updated-some policy content',
-      'Policy editor updates policy value on model'
-    );
+    await setEditorValue('updated');
+    assert.strictEqual(this.model.policy, 'updated', 'Policy editor updates policy value on model');
     assert.ok(this.onSave.notCalled);
-    assert.dom(SELECTORS.saveButton).hasText('Save', 'Save button text is correct');
-    await click(SELECTORS.saveButton);
+    assert.dom(GENERAL.submitButton).hasText('Save', 'Save button text is correct');
+    await click(GENERAL.submitButton);
     assert.ok(this.onSave.calledOnceWith(this.model));
   });
 
@@ -225,15 +209,11 @@ module('Integration | Component | policy-form', function (hooks) {
     assert.dom(SELECTORS.nameInput).doesNotExist('Name input is not rendered');
     assert.dom(SELECTORS.uploadFileToggle).doesNotExist('Upload file toggle does not exist');
 
-    await fillIn(`${SELECTORS.policyEditor} textarea`, 'updated-');
-    assert.strictEqual(
-      this.model.policy,
-      'updated-some policy content',
-      'Policy editor updates policy value on model'
-    );
+    await setEditorValue('updated');
+    assert.strictEqual(this.model.policy, 'updated', 'Policy editor updates policy value on model');
     assert.ok(this.onSave.notCalled);
-    assert.dom(SELECTORS.saveButton).hasText('Save', 'Save button text is correct');
-    await click(SELECTORS.saveButton);
+    assert.dom(GENERAL.submitButton).hasText('Save', 'Save button text is correct');
+    await click(GENERAL.submitButton);
     assert.ok(this.onSave.calledOnceWith(this.model));
   });
 
@@ -255,12 +235,8 @@ module('Integration | Component | policy-form', function (hooks) {
     `);
     assert.dom(SELECTORS.nameInput).doesNotExist('Name input is not rendered');
     assert.dom(SELECTORS.uploadFileToggle).doesNotExist('Upload file toggle does not exist');
-    await fillIn(`${SELECTORS.policyEditor} textarea`, 'updated-');
-    assert.strictEqual(
-      this.model.policy,
-      'updated-some policy content',
-      'Policy editor updates policy value on model'
-    );
+    await setEditorValue('updated');
+    assert.strictEqual(this.model.policy, 'updated', 'Policy editor updates policy value on model');
     await fillIn(SELECTORS.pathsInput('1'), 'second path');
     assert.strictEqual(
       JSON.stringify(this.model.paths),
@@ -268,8 +244,8 @@ module('Integration | Component | policy-form', function (hooks) {
       'Second path field is updated on model'
     );
     assert.ok(this.onSave.notCalled);
-    assert.dom(SELECTORS.saveButton).hasText('Save', 'Save button text is correct');
-    await click(SELECTORS.saveButton);
+    assert.dom(GENERAL.submitButton).hasText('Save', 'Save button text is correct');
+    await click(GENERAL.submitButton);
     assert.ok(this.onSave.calledOnceWith(this.model));
   });
 
@@ -287,7 +263,7 @@ module('Integration | Component | policy-form', function (hooks) {
       @onSave={{this.onSave}}
     />
     `);
-    await click(SELECTORS.saveButton);
+    await click(GENERAL.submitButton);
     assert.ok(this.onSave.notCalled);
     assert.dom(SELECTORS.error).includesText('An error occurred');
   });
@@ -307,10 +283,10 @@ module('Integration | Component | policy-form', function (hooks) {
     `);
     await fillIn(SELECTORS.nameInput, 'Foo');
     assert.strictEqual(this.model.name, 'foo', 'Input sets name on model to lowercase input');
-    await fillIn(`${SELECTORS.policyEditor} textarea`, policy);
+    await setEditorValue(policy);
     assert.strictEqual(this.model.policy, policy, 'Policy editor sets policy on model');
 
-    await click(SELECTORS.cancelButton);
+    await click(GENERAL.cancelButton);
     assert.ok(this.onSave.notCalled);
     assert.ok(this.onCancel.calledOnce, 'Form calls onCancel');
   });
@@ -330,13 +306,9 @@ module('Integration | Component | policy-form', function (hooks) {
       @onSave={{this.onSave}}
     />
     `);
-    await fillIn(`${SELECTORS.policyEditor} textarea`, 'updated-');
-    assert.strictEqual(
-      this.model.policy,
-      'updated-some policy content',
-      'Policy editor updates policy value on model'
-    );
-    await click(SELECTORS.cancelButton);
+    await setEditorValue('updated');
+    assert.strictEqual(this.model.policy, 'updated', 'Policy editor updates policy value on model');
+    await click(GENERAL.cancelButton);
     assert.ok(this.onSave.notCalled);
     assert.ok(this.onCancel.calledOnce, 'Form calls onCancel');
 
@@ -363,7 +335,9 @@ module('Integration | Component | policy-form', function (hooks) {
     />
     `);
     assert.dom(SELECTORS.exampleModal).doesNotExist('Modal for the policy example does not exist');
-    assert.dom(SELECTORS.exampleButton).doesNotExist('Button for the policy example modal does not exist');
+    assert
+      .dom(GENERAL.button('How to write a policy'))
+      .doesNotExist('Button for the policy example modal does not exist');
   });
 
   test('it renders the button and modal for the policy example when specified to', async function (assert) {
@@ -375,8 +349,12 @@ module('Integration | Component | policy-form', function (hooks) {
       @renderPolicyExampleModal={{true}}
     />
         `);
-    assert.dom(SELECTORS.exampleButton).exists({ count: 1 }, 'Modal for the policy example exists');
-    assert.dom(SELECTORS.exampleButton).exists({ count: 1 }, 'Button for the policy example modal exists');
+    assert
+      .dom(GENERAL.button('How to write a policy'))
+      .exists({ count: 1 }, 'Modal for the policy example exists');
+    assert
+      .dom(GENERAL.button('How to write a policy'))
+      .exists({ count: 1 }, 'Button for the policy example modal exists');
   });
 
   test('it renders the correct title for ACL example for the policy example modal', async function (assert) {
@@ -388,7 +366,7 @@ module('Integration | Component | policy-form', function (hooks) {
       @renderPolicyExampleModal={{true}}
     />
         `);
-    await click(SELECTORS.exampleButton);
+    await click(GENERAL.button('How to write a policy'));
     assert.dom(SELECTORS.exampleModalTitle).hasText('Example ACL Policy');
   });
 
@@ -403,7 +381,7 @@ module('Integration | Component | policy-form', function (hooks) {
       @renderPolicyExampleModal={{true}}
     />
         `);
-    await click(SELECTORS.exampleButton);
+    await click(GENERAL.button('How to write a policy'));
     assert.dom(SELECTORS.exampleModalTitle).hasText('Example RGP Policy');
   });
 
@@ -418,7 +396,7 @@ module('Integration | Component | policy-form', function (hooks) {
       @renderPolicyExampleModal={{true}}
     />
         `);
-    await click(SELECTORS.exampleButton);
+    await click(GENERAL.button('How to write a policy'));
     assert.dom(SELECTORS.exampleModalTitle).hasText('Example EGP Policy');
   });
 });
diff --git a/ui/tests/integration/components/radial-progress-test.js b/ui/tests/integration/components/radial-progress-test.js
index 85c5a2b7ade..5338f1ed23e 100644
--- a/ui/tests/integration/components/radial-progress-test.js
+++ b/ui/tests/integration/components/radial-progress-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/radio-button-test.js b/ui/tests/integration/components/radio-button-test.js
index a4272f2ac4d..14fbaf40130 100644
--- a/ui/tests/integration/components/radio-button-test.js
+++ b/ui/tests/integration/components/radio-button-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/raft-join-test.js b/ui/tests/integration/components/raft-join-test.js
index 36dd4dc6c73..ca9956bf8dd 100644
--- a/ui/tests/integration/components/raft-join-test.js
+++ b/ui/tests/integration/components/raft-join-test.js
@@ -1,11 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { click, render } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 
@@ -26,7 +27,7 @@ module('Integration | Component | raft-join', function (hooks) {
     await render(hbs`<RaftJoin />`);
     await click('[data-test-next]');
     assert.dom('[data-test-join-header]').exists();
-    await click('[data-test-cancel-button]');
+    await click(GENERAL.cancelButton);
     assert.dom('[data-test-join-choice]').exists();
   });
 
diff --git a/ui/tests/integration/components/raft-storage-overview-test.js b/ui/tests/integration/components/raft-storage-overview-test.js
index dc5a2913c3d..2455131f967 100644
--- a/ui/tests/integration/components/raft-storage-overview-test.js
+++ b/ui/tests/integration/components/raft-storage-overview-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/raft-storage-restore-test.js b/ui/tests/integration/components/raft-storage-restore-test.js
index e1962c5ec72..739298cf7af 100644
--- a/ui/tests/integration/components/raft-storage-restore-test.js
+++ b/ui/tests/integration/components/raft-storage-restore-test.js
@@ -1,13 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { render, triggerEvent, click } from '@ember/test-helpers';
+import { render, triggerEvent, click, waitFor } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | raft-storage-restore', function (hooks) {
   setupRenderingTest(hooks);
@@ -29,8 +30,9 @@ module('Integration | Component | raft-storage-restore', function (hooks) {
     await triggerEvent('[data-test-file-input]', 'change', {
       files: [new Blob(['Raft Snapshot'])],
     });
-    await click('[data-test-edit-form-submit]');
+    await click(GENERAL.submitButton);
+    await waitFor('#force-restore');
     await click('#force-restore');
-    await click('[data-test-edit-form-submit]');
+    await click(GENERAL.submitButton);
   });
 });
diff --git a/ui/tests/integration/components/read-more-test.js b/ui/tests/integration/components/read-more-test.js
index 984cf482d32..51500dcabf2 100644
--- a/ui/tests/integration/components/read-more-test.js
+++ b/ui/tests/integration/components/read-more-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/readonly-form-field-test.js b/ui/tests/integration/components/readonly-form-field-test.js
index 84f6482c942..a9442337caf 100644
--- a/ui/tests/integration/components/readonly-form-field-test.js
+++ b/ui/tests/integration/components/readonly-form-field-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/recovery/page/snapshot-manage-test.js b/ui/tests/integration/components/recovery/page/snapshot-manage-test.js
new file mode 100644
index 00000000000..2c5f770d309
--- /dev/null
+++ b/ui/tests/integration/components/recovery/page/snapshot-manage-test.js
@@ -0,0 +1,228 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { click, fillIn, find, render, waitFor } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import recoveryHandler from 'vault/mirage/handlers/recovery';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+
+module('Integration | Component | recovery/snapshots/snapshot-manage', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(async function () {
+    recoveryHandler(this.server);
+
+    const snapshot = this.server.create('snapshot');
+
+    const api = this.owner.lookup('service:api');
+    let namespaces = [];
+    try {
+      const response = await api.sys.internalUiListNamespaces();
+      namespaces = response.keys ?? [];
+    } catch {
+      namespaces = [];
+    }
+
+    this.model = {
+      snapshot,
+      namespaces,
+    };
+
+    this.version = this.owner.lookup('service:version');
+    this.version.type = 'enterprise';
+
+    this.renderComponent = () =>
+      render(hbs`<Recovery::Page::Snapshots::SnapshotManage @model={{this.model}}/>`);
+  });
+  const scenarios = [
+    {
+      engine: 'Cubbyhole',
+      namespace: 'root',
+      mount: 'cubbyhole',
+      path: 'nested/my-path',
+    },
+    {
+      engine: 'KV',
+      namespace: 'root',
+      mount: 'kv',
+      path: 'my-path',
+    },
+    {
+      engine: 'Cubbyhole',
+      namespace: 'root',
+      mount: 'cubbyhole',
+      path: 'nested/my-path',
+    },
+    {
+      engine: 'Database',
+      namespace: 'root',
+      mount: 'database',
+      path: 'test-static-path',
+    },
+  ];
+  scenarios.forEach((scenario) => {
+    test(`it performs a read operation in the root namespace context for ${scenario.namespace} namespace item - Engine: ${scenario.engine}`, async function (assert) {
+      await this.renderComponent();
+      await click(GENERAL.selectByAttr('namespace'));
+      await click(`[data-test-option="${scenario.namespace}"]`);
+      await click(GENERAL.selectByAttr('mount'));
+      await click(`[data-test-option="${scenario.mount}"]`);
+      await fillIn(GENERAL.inputByAttr('resourcePath'), scenario.path);
+
+      await click(GENERAL.button('read'));
+      await waitFor('[data-test-read-secrets]');
+
+      // Open modal
+      assert.dom('[data-test-read-secrets]').exists('renders read modal');
+      assert.dom(GENERAL.maskedInput).exists('renders secret data');
+
+      // Close modal
+      await click(GENERAL.button('close'));
+      assert.dom('[data-test-read-secrets]').doesNotExist('read modal closed');
+    });
+
+    test(`it performs a recover operation successfully in root namespace for ${scenario.namespace} namespace item - Engine: ${scenario.engine}`, async function (assert) {
+      await this.renderComponent();
+
+      await click(GENERAL.selectByAttr('namespace'));
+      await click(`[data-test-option="${scenario.namespace}"]`);
+      await click(GENERAL.selectByAttr('mount'));
+      await click(`[data-test-option="${scenario.mount}"]`);
+      await fillIn(GENERAL.inputByAttr('resourcePath'), scenario.path);
+
+      await click(GENERAL.button('recover'));
+
+      assert.dom(GENERAL.inlineAlert).containsText('Success', 'shows success message');
+      assert.dom(GENERAL.inlineAlert).containsText(scenario.path, 'shows the recovered path');
+
+      await click(GENERAL.inputByAttr('copy'));
+      await fillIn(GENERAL.inputByAttr('copyPath'), scenario.path + '-copy');
+      await click(GENERAL.button('recover'));
+
+      assert.dom(GENERAL.inlineAlert).containsText('Success', 'shows success message');
+      assert.dom(GENERAL.inlineAlert).containsText(scenario.path + '-copy', 'shows the recovered copy path');
+    });
+  });
+
+  test('it renders manual input if mounts request does not have data', async function (assert) {
+    assert.expect(2);
+    this.server.get('/sys/internal/ui/mounts', () => ({
+      // Cubbyhole is enabled by default and cannot be disabled so supportedMounts should always
+      // have values if the request was successful, but handling just in case.
+      data: { secret: {} },
+    }));
+    await render(hbs`<Recovery::Page::Snapshots::SnapshotManage @model={{this.model}}/>`);
+    assert.dom(GENERAL.inputByAttr('manual-mount-path')).exists();
+    assert.dom(GENERAL.selectByAttr('mount')).doesNotExist();
+  });
+
+  test('it renders manual input if mounts request errors', async function (assert) {
+    assert.expect(14);
+    this.server.get('/sys/internal/ui/mounts', () => overrideResponse(403));
+    await render(hbs`<Recovery::Page::Snapshots::SnapshotManage @model={{this.model}}/>`);
+    assert.dom(GENERAL.button('Type')).exists().hasText('Type');
+    assert.dom(GENERAL.inputByAttr('manual-mount-path')).exists().isDisabled();
+    assert.dom(GENERAL.selectByAttr('mount')).doesNotExist();
+    await click(GENERAL.button('Type'));
+    assert.dom(GENERAL.button('Type')).hasAttribute('aria-expanded', 'true');
+    // Select kv
+    await click(GENERAL.radioByAttr('kv'));
+    assert
+      .dom(GENERAL.button('Type'))
+      .hasAttribute('aria-expanded', 'false', 'toggle closes after selecting type');
+    assert
+      .dom(GENERAL.inputByAttr('manual-mount-path'))
+      .isNotDisabled('input is enabled after selecting a type');
+    assert.dom(GENERAL.button('Type')).hasText('KV v1');
+    await fillIn(GENERAL.inputByAttr('manual-mount-path'), 'kv-mount');
+    // Select cubbyhole
+    await click(GENERAL.button('Type'));
+    await click(GENERAL.radioByAttr('cubbyhole'));
+    assert
+      .dom(GENERAL.inputByAttr('manual-mount-path'))
+      .hasAttribute('readonly', '', 'cubbyhole input is readonly')
+      .hasValue('cubbyhole', 'input has default cubbyhole path');
+    assert.dom(GENERAL.button('Type')).hasText('Cubbyhole');
+    // Select database
+    await click(GENERAL.button('Type'));
+    await click(GENERAL.radioByAttr('database'));
+    assert
+      .dom(GENERAL.inputByAttr('manual-mount-path'))
+      .hasValue('', 'input clears when selecting a new type');
+    assert.dom(GENERAL.button('Type')).hasText('Database');
+  });
+
+  test('it displays loaded snapshot card', async function (assert) {
+    await render(hbs`<Recovery::Page::Snapshots::SnapshotManage @model={{this.model}}/>`);
+    assert.dom(GENERAL.badge('status')).hasText('Ready', 'status badge renders');
+  });
+
+  test('it displays namespace selector for root namespace', async function (assert) {
+    await render(hbs`<Recovery::Page::Snapshots::SnapshotManage @model={{this.model}}/>`);
+
+    assert.dom(GENERAL.selectByAttr('namespace')).exists('namespace selector is visible in root namespace');
+  });
+
+  test('it validates form fields before read/recover operations', async function (assert) {
+    await render(hbs`<Recovery::Page::Snapshots::SnapshotManage @model={{this.model}}/>`);
+    // Try to read without selecting mount or resource path
+    await click(GENERAL.button('read'));
+
+    assert.dom(GENERAL.validationErrorByAttr('mount')).hasText('Please select a secret mount');
+    assert.dom(GENERAL.validationErrorByAttr('resourcePath')).hasText('Please enter a resource path');
+  });
+
+  test('it clears form selections', async function (assert) {
+    await render(hbs`<Recovery::Page::Snapshots::SnapshotManage @model={{this.model}}/>`);
+
+    await click(GENERAL.selectByAttr('namespace'));
+    await click('[data-option-index="1"]');
+    await click(GENERAL.selectByAttr('mount'));
+    await click('[data-option-index]');
+    await fillIn(GENERAL.inputByAttr('resourcePath'), 'test-path');
+
+    await click(GENERAL.button('clear'));
+
+    const nsSelect = find(GENERAL.selectByAttr('namespace'));
+    assert.strictEqual(nsSelect.textContent.trim(), 'root', 'namespace was reset');
+
+    const mountSelect = find(GENERAL.selectByAttr('mount'));
+    assert.strictEqual(mountSelect.textContent.trim(), 'Select a mount here', 'mount is cleared');
+
+    assert.dom(GENERAL.inputByAttr('resourcePath')).hasValue('', 'resource path is cleared');
+  });
+
+  test('it displays error alert when read operation fails', async function (assert) {
+    await render(hbs`<Recovery::Page::Snapshots::SnapshotManage @model={{this.model}}/>`);
+
+    await fillIn(GENERAL.inputByAttr('resourcePath'), 'nonexistent-secret');
+    await click(GENERAL.selectByAttr('mount'));
+    await click('[data-option-index="1.0"]');
+    await click(GENERAL.button('read'));
+
+    assert.dom(GENERAL.inlineAlert).containsText('Error', 'shows error alert');
+  });
+
+  test('it toggles JSON view in read modal', async function (assert) {
+    await render(hbs`<Recovery::Page::Snapshots::SnapshotManage @model={{this.model}}/>`);
+
+    await fillIn(GENERAL.inputByAttr('resourcePath'), 'test-secret');
+    await click(GENERAL.selectByAttr('mount'));
+    await click('[data-option-index]');
+    await click(GENERAL.button('read'));
+    await waitFor('[data-test-read-secrets]');
+
+    assert.dom('[data-test-read-secrets]').exists('read modal opens');
+
+    await click(GENERAL.toggleInput('snapshot-read-secrets'));
+    assert.dom('.hds-code-block').exists('renders JSON view');
+  });
+});
diff --git a/ui/tests/integration/components/recovery/page/snapshots-load-test.js b/ui/tests/integration/components/recovery/page/snapshots-load-test.js
new file mode 100644
index 00000000000..3a03a4ce581
--- /dev/null
+++ b/ui/tests/integration/components/recovery/page/snapshots-load-test.js
@@ -0,0 +1,114 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { click, fillIn, render, triggerEvent, waitUntil } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import recoveryHandler from 'vault/mirage/handlers/recovery';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
+
+module('Integration | Component | recovery/snapshots-load', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    recoveryHandler(this.server);
+
+    this.model = {
+      configs: [],
+      configError: undefined,
+    };
+    this.breadcrumbs = [
+      { label: 'Secrets Recovery', route: 'vault.cluster.recovery.snapshots' },
+      { label: 'Upload', route: 'vault.cluster.recovery.snapshots.load' },
+    ];
+
+    this.version = this.owner.lookup('service:version');
+    this.version.type = 'enterprise';
+
+    this.router = this.owner.lookup('service:router');
+    this.transitionStub = sinon.stub(this.router, 'transitionTo');
+  });
+
+  test('it should validate form fields', async function (assert) {
+    await render(
+      hbs`<Recovery::Page::Snapshots::Load @breadcrumbs={{this.breadcrumbs}} @model={{this.model}} />`
+    );
+
+    await click(GENERAL.submitButton);
+
+    assert
+      .dom(GENERAL.validationErrorByAttr('config'))
+      .hasText('Please select a config', 'Config error renders.');
+
+    assert.dom(GENERAL.validationErrorByAttr('url')).hasText('Please enter a url', 'Url error renders');
+
+    await click(GENERAL.inputByAttr('manual'));
+    await click(GENERAL.submitButton);
+
+    assert
+      .dom(GENERAL.validationErrorByAttr('file'))
+      .hasText('Please upload a snapshot file', 'File error renders.');
+  });
+
+  test('it loads a manual snapshot successfully', async function (assert) {
+    assert.expect(3);
+    this.server.post('sys/storage/raft/snapshot-load', (schema, req) => {
+      assert.true(true, 'request is made to expected endpoint');
+      const decoder = new TextDecoder();
+      const bodyContent = decoder.decode(req.requestBody);
+      assert.strictEqual(bodyContent, 'some content for a file', 'payload contains file data');
+      return { data: {} };
+    });
+    const file = new Blob([['some content for a file']], { type: 'text/plain' });
+    file.name = 'snapshot.snap';
+
+    await render(
+      hbs`<Recovery::Page::Snapshots::Load @breadcrumbs={{this.breadcrumbs}} @model={{this.model}} />`
+    );
+
+    await click(GENERAL.inputByAttr('manual'));
+    await triggerEvent('[data-test-file-input]', 'change', { files: [file] });
+    await click(GENERAL.submitButton);
+
+    await waitUntil(() => this.transitionStub.called);
+
+    assert.true(
+      this.transitionStub.calledWith('vault.cluster.recovery.snapshots'),
+      'Route transitions correctly on submit success'
+    );
+  });
+
+  test('it loads an automated snapshot successfully', async function (assert) {
+    assert.expect(3);
+    this.server.post('sys/storage/raft/snapshot-auto/snapshot-load/:config_name', (schema, req) => {
+      const payload = JSON.parse(req.requestBody);
+      assert.strictEqual(payload.url, 'test-snapshot-url', 'payload contains url');
+      assert.strictEqual(req.params.config_name, 'test-config', 'request url is correct');
+      return { data: {} };
+    });
+
+    this.model.configs = ['test-config'];
+
+    await render(
+      hbs`<Recovery::Page::Snapshots::Load @breadcrumbs={{this.breadcrumbs}} @model={{this.model}} />`
+    );
+
+    await click(GENERAL.selectByAttr('config'));
+    await click('[data-option-index]');
+    await fillIn(GENERAL.inputByAttr('url'), 'test-snapshot-url');
+    await click(GENERAL.submitButton);
+
+    await waitUntil(() => this.transitionStub.called);
+
+    assert.true(
+      this.transitionStub.calledWith('vault.cluster.recovery.snapshots'),
+      'Route transitions correctly on submit success'
+    );
+  });
+});
diff --git a/ui/tests/integration/components/recovery/page/snapshots-test.js b/ui/tests/integration/components/recovery/page/snapshots-test.js
new file mode 100644
index 00000000000..7f6a5363685
--- /dev/null
+++ b/ui/tests/integration/components/recovery/page/snapshots-test.js
@@ -0,0 +1,95 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+
+import { setupMirage } from 'ember-cli-mirage/test-support';
+
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | recovery/snapshots', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.model = {
+      snapshots: [],
+      canLoadSnapshot: false,
+    };
+    this.renderComponent = () => render(hbs`<Recovery::Page::Snapshots @model={{this.model}}/>`);
+  });
+
+  test('it displays empty state in CE', async function (assert) {
+    this.model = { snapshots: [], showCommunityMessage: true };
+
+    await render(hbs`<Recovery::Page::Snapshots @model={{this.model}}/>`);
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('Secrets Recovery is an enterprise feature', 'CE empty state title renders');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'Secrets Recovery allows you to restore accidentally deleted or lost secrets from a snapshot. The snapshots can be provided via upload or loaded from external storage.',
+        'CE empty state message renders'
+      );
+    assert
+      .dom(GENERAL.emptyStateActions)
+      .hasText('Learn more about upgrading', 'CE empty state action renders');
+
+    assert.dom(GENERAL.badge('enterprise')).exists();
+  });
+
+  test('it displays empty state in non root namespace', async function (assert) {
+    const nsService = this.owner.lookup('service:namespace');
+    nsService.setNamespace('test-ns');
+
+    await this.renderComponent();
+
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('Snapshot upload is restricted', 'non root namespace empty state title renders');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'Snapshot uploading is only available in root namespace. Please navigate to root and upload your snapshot. ',
+        'non root empty state message renders'
+      );
+    assert
+      .dom(GENERAL.emptyStateActions)
+      .hasText('Take me to root namespace', 'non root empty state action renders');
+  });
+
+  test('it displays empty state when user cannot load snapshot', async function (assert) {
+    await this.renderComponent();
+    assert.dom(GENERAL.emptyStateTitle).hasText('No snapshot available', 'empty state title renders');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'Ready to restore secrets? Please contact your admin to either upload a snapshot or grant you uploading permissions to get started.',
+        'empty state message renders'
+      );
+    assert
+      .dom(GENERAL.emptyStateActions)
+      .hasText('Learn more about Secrets Recovery', 'empty state action renders');
+  });
+
+  test('it displays empty state when user can load snapshot', async function (assert) {
+    this.model.canLoadSnapshot = true;
+    await this.renderComponent();
+    assert
+      .dom(GENERAL.emptyStateTitle)
+      .hasText('Upload a snapshot to get started', 'empty state title renders');
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        'Secrets Recovery allows you to restore accidentally deleted or lost secrets from a snapshot. The snapshots can be provided via upload or loaded from external storage.',
+        'empty state message renders'
+      );
+    assert.dom(GENERAL.emptyStateActions).hasText('Upload snapshot', 'empty state action renders');
+  });
+});
diff --git a/ui/tests/integration/components/regex-validator-test.js b/ui/tests/integration/components/regex-validator-test.js
index 3085e7becaa..b3be89f83a0 100644
--- a/ui/tests/integration/components/regex-validator-test.js
+++ b/ui/tests/integration/components/regex-validator-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render, click, fillIn, settled } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | regex-validator', function (hooks) {
   setupRenderingTest(hooks);
@@ -32,10 +33,10 @@ module('Integration | Component | regex-validator', function (hooks) {
       />`
     );
     assert.dom('.regex-label label').hasText('Regex Example', 'Label is correct');
-    assert.dom('[data-test-toggle-input="example-validation-toggle"]').exists('Validation toggle exists');
+    assert.dom(GENERAL.toggleInput('example-validation-toggle')).exists('Validation toggle exists');
     assert.dom('[data-test-regex-validator-test-string]').doesNotExist('Test string input does not show');
 
-    await click('[data-test-toggle-input="example-validation-toggle"]');
+    await click(GENERAL.toggleInput('example-validation-toggle'));
     assert.dom('[data-test-regex-validator-test-string]').exists('Test string input shows after toggle');
     assert
       .dom('[data-test-regex-validator-test-string] label')
diff --git a/ui/tests/integration/components/replication-action-generate-token-test.js b/ui/tests/integration/components/replication-action-generate-token-test.js
index cc2d6b5d56c..4d1d032bd7a 100644
--- a/ui/tests/integration/components/replication-action-generate-token-test.js
+++ b/ui/tests/integration/components/replication-action-generate-token-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,6 +8,7 @@ import { setupRenderingTest } from 'ember-qunit';
 import { render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | replication-action-generate-token', function (hooks) {
   setupRenderingTest(hooks);
@@ -22,6 +23,6 @@ module('Integration | Component | replication-action-generate-token', function (
             {{replication-action-generate-token}}
     `);
     assert.dom('h4.title').hasText('Generate operation token', 'renders default title');
-    assert.dom('[data-test-replication-action-trigger]').hasText('Generate token', 'renders default CTA');
+    assert.dom(GENERAL.button('Generate token')).exists('renders default CTA');
   });
 });
diff --git a/ui/tests/integration/components/replication-actions-test.js b/ui/tests/integration/components/replication-actions-test.js
index 27f39d27006..b0c70d0ed20 100644
--- a/ui/tests/integration/components/replication-actions-test.js
+++ b/ui/tests/integration/components/replication-actions-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import Service from '@ember/service';
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { click, fillIn, render } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 
@@ -128,9 +129,9 @@ module('Integration | Component | replication actions', function (hooks) {
   ];
 
   for (const [replicationMode, clusterMode, action, headerText, fillInFn, expectedOnSubmit] of testCases) {
-    test(`replication mode ${replicationMode}, cluster mode: ${clusterMode}, action: ${action}`, async function (assert) {
+    const testCaseKey = `${replicationMode}-${clusterMode}-${action}`;
+    test(`replication and cluster mode action behavior: testCaseKey = ${testCaseKey}`, async function (assert) {
       assert.expect(1);
-      const testKey = `${replicationMode}-${clusterMode}-${action}`;
       this.set('model', {
         replicationAttrs: {
           modeForUrl: clusterMode,
@@ -151,7 +152,7 @@ module('Integration | Component | replication actions', function (hooks) {
         assert.deepEqual(
           JSON.stringify(actual),
           JSON.stringify(expectedOnSubmit),
-          `${testKey}: submitted values match expected`
+          `Submitted values match what is expected for the testCaseKey: ${testCaseKey}`
         );
         return resolve();
       });
@@ -168,13 +169,12 @@ module('Integration | Component | replication actions', function (hooks) {
       );
       assert
         .dom(`[data-test-${action}-replication] h3`)
-        .hasText(headerText, `${testKey}: renders the ${action} component header`);
-
-      await click(`[data-test-replication-action-trigger="${action}"]`);
+        .hasText(headerText, `Renders the component header for: ${testCaseKey}`);
+      await click(GENERAL.button(action));
       if (typeof fillInFn === 'function') {
         await fillInFn.call(this);
       }
-      await click('[data-test-confirm-button]');
+      await click(GENERAL.confirmButton);
     });
   }
 });
diff --git a/ui/tests/integration/components/replication-dashboard-test.js b/ui/tests/integration/components/replication-dashboard-test.js
index 80287e8cff3..761cd9c85b4 100644
--- a/ui/tests/integration/components/replication-dashboard-test.js
+++ b/ui/tests/integration/components/replication-dashboard-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/replication-header-test.js b/ui/tests/integration/components/replication-header-test.js
index 3f375e0e745..4c83c1e1332 100644
--- a/ui/tests/integration/components/replication-header-test.js
+++ b/ui/tests/integration/components/replication-header-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/replication-overview-mode-test.js b/ui/tests/integration/components/replication-overview-mode-test.js
new file mode 100644
index 00000000000..8795bc5fc48
--- /dev/null
+++ b/ui/tests/integration/components/replication-overview-mode-test.js
@@ -0,0 +1,124 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render, settled } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupEngine } from 'ember-engines/test-support';
+
+const OVERVIEW_MODE = {
+  title: '[data-test-overview-mode-title]',
+  body: '[data-test-overview-mode-body]',
+  detailsLink: '[data-test-replication-details-link]',
+};
+module('Integration | Component | replication-overview-mode', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'replication');
+
+  hooks.beforeEach(function () {
+    this.versionService = this.owner.lookup('service:version');
+    this.versionService.features = [];
+    this.mode = 'dr';
+    this.clusterName = 'foobar';
+    this.modeDetails = { mode: 'disabled' };
+
+    this.renderComponent = async () => {
+      return render(
+        hbs`
+        <ReplicationOverviewMode
+          @clusterName={{this.clusterName}}
+          @mode={{this.mode}}
+          @model={{this.modeDetails}}
+        />`,
+        { owner: this.engine }
+      );
+    };
+  });
+
+  test('without features', async function (assert) {
+    await this.renderComponent();
+    assert.dom(OVERVIEW_MODE.title).hasText('Disaster Recovery (DR)');
+    assert
+      .dom(OVERVIEW_MODE.body)
+      .includesText('Disaster Recovery is a feature of Vault Enterprise Premium. Upgrade');
+    assert.dom(OVERVIEW_MODE.detailsLink).doesNotExist('does not show link to replication (dr)');
+
+    this.set('mode', 'performance');
+    await settled();
+    assert.dom(OVERVIEW_MODE.title).hasText('Performance');
+    assert
+      .dom(OVERVIEW_MODE.body)
+      .includesText('Performance Replication is a feature of Vault Enterprise Premium. Upgrade');
+    assert.dom(OVERVIEW_MODE.detailsLink).doesNotExist('does not show link to replication (perf)');
+  });
+
+  module('with features', function (hooks) {
+    hooks.beforeEach(function () {
+      this.versionService.features = ['DR Replication', 'Performance Replication'];
+    });
+
+    test('it renders when replication disabled', async function (assert) {
+      await this.renderComponent();
+      assert.dom(OVERVIEW_MODE.title).hasText('Disaster Recovery (DR)');
+      assert
+        .dom(OVERVIEW_MODE.body)
+        .hasText(
+          'Disaster Recovery Replication is designed to protect against catastrophic failure of entire clusters. Secondaries do not forward service requests until they are elected and become a new primary.'
+        );
+      assert.dom(OVERVIEW_MODE.detailsLink).hasText('Enable');
+
+      this.set('mode', 'performance');
+      await settled();
+      assert.dom(OVERVIEW_MODE.title).hasText('Performance');
+      assert
+        .dom(OVERVIEW_MODE.body)
+        .hasText(
+          'Performance Replication scales workloads horizontally across clusters to make requests faster. Local secondaries handle read requests but forward writes to the primary to be handled.'
+        );
+      assert.dom(OVERVIEW_MODE.detailsLink).hasText('Enable');
+    });
+
+    test('it renders when replication enabled', async function (assert) {
+      this.mode = 'performance';
+      this.modeDetails = {
+        replicationEnabled: true,
+        mode: 'primary',
+        modeForUrl: 'primary',
+        clusterIdDisplay: 'foobar12',
+      };
+      await this.renderComponent();
+      assert.dom(OVERVIEW_MODE.title).hasText('Performance');
+      assert
+        .dom(OVERVIEW_MODE.body)
+        .includesText('ENABLED Primary foobar12', 'renders mode type and cluster ID if passed');
+      assert.dom(OVERVIEW_MODE.detailsLink).hasText('Details');
+
+      this.set('modeDetails', {
+        replicationEnabled: true,
+        mode: 'secondary',
+        modeForUrl: 'secondary',
+        clusterIdDisplay: 'foobar12',
+        secondaryId: 'some-secondary',
+      });
+      await settled();
+      assert.dom(OVERVIEW_MODE.title).hasText('Performance');
+      assert.dom(OVERVIEW_MODE.body).includesText('ENABLED Secondary some-secondary foobar12');
+      assert.dom(OVERVIEW_MODE.detailsLink).hasText('Details');
+    });
+
+    test('it renders when replication bootstrapping', async function (assert) {
+      this.modeDetails = {
+        replicationEnabled: true,
+        mode: 'bootstrapping',
+        modeForUrl: 'bootstrapping',
+      };
+      await this.renderComponent();
+      assert.dom(OVERVIEW_MODE.title).hasText('Disaster Recovery (DR)');
+      assert.dom(OVERVIEW_MODE.body).includesText('ENABLED Bootstrapping');
+      assert.dom(OVERVIEW_MODE.detailsLink).hasText('Details');
+    });
+  });
+});
diff --git a/ui/tests/integration/components/replication-page-test.js b/ui/tests/integration/components/replication-page-test.js
index 62c74f8081b..b88ea1308e9 100644
--- a/ui/tests/integration/components/replication-page-test.js
+++ b/ui/tests/integration/components/replication-page-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,21 +7,23 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
-
-const MODEL = {
-  replicationMode: 'dr',
-  replicationAttrs: {
-    mode: 'secondary',
-    clusterId: '12ab',
-    replicationDisabled: false,
-  },
-};
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 module('Integration | Component | replication-page', function (hooks) {
   setupRenderingTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.set('model', MODEL);
+    this.model = {
+      replicationMode: 'dr',
+      dr: { mode: 'primary' },
+      performance: { mode: 'primary' },
+      replicationAttrs: {
+        mode: 'secondary',
+        clusterId: '12ab',
+        replicationDisabled: false,
+      },
+    };
   });
 
   test('it renders', async function (assert) {
@@ -31,13 +33,40 @@ module('Integration | Component | replication-page', function (hooks) {
   });
 
   test('it renders loader when either clusterId is unknown or mode is bootstrapping', async function (assert) {
-    this.set('model.replicationAttrs.clusterId', '');
+    this.model.replicationAttrs.clusterId = '';
     await render(hbs`<ReplicationPage @model={{this.model}} />`);
     assert.dom('[data-test-layout-loading]').exists();
 
-    this.set('model.replicationAttrs.clusterId', '123456');
-    this.set('model.replicationAttrs.mode', 'bootstrapping');
+    this.model.replicationAttrs.clusterId = '123456';
+    this.model.replicationAttrs.mode = 'bootstrapping';
     await render(hbs`<ReplicationPage @model={{this.model}} />`);
     assert.dom('[data-test-layout-loading]').exists();
   });
+
+  test('it re-fetches data when replication mode changes', async function (assert) {
+    assert.expect(4);
+    this.server.get('sys/replication/:mode/status', (schema, req) => {
+      assert.strictEqual(
+        req.params.mode,
+        this.model.replicationMode,
+        `fetchStatus called with correct mode: ${this.model.replicationMode}`
+      );
+      return {
+        data: {
+          mode: 'primary',
+        },
+      };
+    });
+    await render(
+      hbs`<ReplicationPage @model={{this.model}} as |Page|><Page.header @showTabs={{false}} /></ReplicationPage>`
+    );
+    assert.dom('[data-test-replication-title="Disaster Recovery"]').hasText('Disaster Recovery');
+
+    this.model.replicationMode = 'performance';
+    await render(
+      hbs`<ReplicationPage @model={{this.model}} as |Page|><Page.header @showTabs={{false}} /></ReplicationPage>`
+    );
+
+    assert.dom('[data-test-replication-title="Performance"]').hasText('Performance');
+  });
 });
diff --git a/ui/tests/integration/components/replication-primary-card-test.js b/ui/tests/integration/components/replication-primary-card-test.js
index 656c2e1cdb9..88b89d59504 100644
--- a/ui/tests/integration/components/replication-primary-card-test.js
+++ b/ui/tests/integration/components/replication-primary-card-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/replication-secondary-card-test.js b/ui/tests/integration/components/replication-secondary-card-test.js
index 831f51d677c..0c42d52c8b5 100644
--- a/ui/tests/integration/components/replication-secondary-card-test.js
+++ b/ui/tests/integration/components/replication-secondary-card-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,6 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
 
 const TITLE = 'Status';
 
@@ -29,13 +28,6 @@ module('Integration | Component | replication-secondary-card', function (hooks)
   hooks.beforeEach(function () {
     this.set('replicationDetails', REPLICATION_DETAILS);
     this.set('title', TITLE);
-    // TODO: remove Tooltip/ember-basic-dropdown
-    setRunOptions({
-      rules: {
-        'aria-command-name': { enabled: false },
-        'nested-interactive': { enabled: false },
-      },
-    });
   });
 
   test('it renders', async function (assert) {
diff --git a/ui/tests/integration/components/replication-summary-card-test.js b/ui/tests/integration/components/replication-summary-card-test.js
index 86e98ed98cf..be647cd0378 100644
--- a/ui/tests/integration/components/replication-summary-card-test.js
+++ b/ui/tests/integration/components/replication-summary-card-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/replication-table-rows-test.js b/ui/tests/integration/components/replication-table-rows-test.js
index cb94d21bde1..1beb7ed8edf 100644
--- a/ui/tests/integration/components/replication-table-rows-test.js
+++ b/ui/tests/integration/components/replication-table-rows-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/resultant-acl-banner-test.js b/ui/tests/integration/components/resultant-acl-banner-test.js
index f64ad715468..b10a0c9efd6 100644
--- a/ui/tests/integration/components/resultant-acl-banner-test.js
+++ b/ui/tests/integration/components/resultant-acl-banner-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/seal-action-test.js b/ui/tests/integration/components/seal-action-test.js
index 65ca87e8739..3a8e2cb6ea3 100644
--- a/ui/tests/integration/components/seal-action-test.js
+++ b/ui/tests/integration/components/seal-action-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,6 +8,7 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { click, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import sinon from 'sinon';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const SEAL_WHEN_STANDBY_MSG = 'vault cannot seal when in standby mode; please restart instead';
 
@@ -25,7 +26,7 @@ module('Integration | Component | seal-action', function (hooks) {
 
     // attempt seal
     await click('[data-test-seal]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
 
     assert.ok(this.sealSuccess.calledOnce, 'called onSeal action');
     assert.dom('[data-test-seal-error]').doesNotExist('Does not show error when successful');
@@ -37,7 +38,7 @@ module('Integration | Component | seal-action', function (hooks) {
 
     // attempt seal
     await click('[data-test-seal]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
 
     assert.ok(this.sealError.calledOnce, 'called onSeal action');
     assert.dom('[data-test-seal-error]').includesText(SEAL_WHEN_STANDBY_MSG, 'Shows error returned from API');
diff --git a/ui/tests/integration/components/search-select-test.js b/ui/tests/integration/components/search-select-test.js
index 4557e951591..5158ecd2c08 100644
--- a/ui/tests/integration/components/search-select-test.js
+++ b/ui/tests/integration/components/search-select-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,7 +15,7 @@ import sinon from 'sinon';
 import waitForError from 'vault/tests/helpers/wait-for-error';
 import searchSelect from '../../pages/components/search-select';
 import { isWildcardString } from 'vault/helpers/is-wildcard-string';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const component = create(searchSelect);
 
@@ -86,21 +86,11 @@ module('Integration | Component | search select', function (hooks) {
         isWildcardString([selection]);
       return !modelExists ? 'The model associated with this id no longer exists' : false;
     };
-    this.set('renderInfoTooltip', mockFunctionFromParent);
+    this.set('renderTooltip', mockFunctionFromParent);
     run(() => {
       this.owner.unregister('service:store');
       this.owner.register('service:store', storeService);
     });
-    setRunOptions({
-      rules: {
-        // TODO: Fix this component
-        'color-contrast': { enabled: false },
-        label: { enabled: false },
-        'aria-input-field-name': { enabled: false },
-        'aria-required-attr': { enabled: false },
-        'aria-valid-attr-value': { enabled: false },
-      },
-    });
   });
 
   test('it renders', async function (assert) {
@@ -167,6 +157,10 @@ module('Integration | Component | search select', function (hooks) {
       component.selectedOptionText,
       'first object in list is focused'
     );
+
+    // verify overflow styling on input field exists
+    assert.dom('.list-item-text').exists('selected option field has width set');
+    assert.dom('.text-overflow-ellipsis').exists('selected option text has overflow class');
   });
 
   test('it filters options and adds option to create new item when text is entered', async function (assert) {
@@ -652,7 +646,7 @@ module('Integration | Component | search select', function (hooks) {
     await component.selectOption();
     assert.strictEqual(component.selectedOptions.length, 1, 'there is 1 selected option');
     assert
-      .dom('[data-test-selected-option]')
+      .dom(GENERAL.searchSelect.selectedOption(0))
       .hasText('model-a-id', 'does not render name if first objectKey is id');
     assert.ok(this.onChange.calledOnce);
     assert.ok(
@@ -706,7 +700,7 @@ module('Integration | Component | search select', function (hooks) {
     await component.selectOption();
     assert.strictEqual(component.selectedOptions.length, 1, 'there is 1 selected option');
     assert
-      .dom('[data-test-selected-option]')
+      .dom(GENERAL.searchSelect.selectedOption(0))
       .hasText('model-a a123', `renders name and ${objectKeys[0]} if first objectKey is not id`);
     assert.dom('[data-test-smaller-id]').exists();
     assert.propEqual(
@@ -746,7 +740,7 @@ module('Integration | Component | search select', function (hooks) {
     await component.selectOption();
     assert.strictEqual(component.selectedOptions.length, 1, 'there is 1 selected option');
     assert
-      .dom('[data-test-selected-option]')
+      .dom(GENERAL.searchSelect.selectedOption(0))
       .hasText('1', 'renders model id if does not have objectKey as an attribute');
     assert.propEqual(spy.args[0][0], ['1'], 'onClick is called with array of single id string');
   });
@@ -773,7 +767,9 @@ module('Integration | Component | search select', function (hooks) {
     // First select existing option
     await component.selectOption();
     assert.strictEqual(component.selectedOptions.length, 1, 'there is 1 selected option');
-    assert.dom('[data-test-selected-option]').hasText('1', 'renders model id if does not have objectKey');
+    assert
+      .dom(GENERAL.searchSelect.selectedOption(0))
+      .hasText('1', 'renders model id if does not have objectKey');
     assert.propEqual(
       spy.args[0][0],
       [
@@ -869,7 +865,7 @@ module('Integration | Component | search select', function (hooks) {
     assert.propEqual(spy.args[1][0], ['1', 'model-a-id'], 'onClick is called with array of id strings');
   });
 
-  test('it renders an info tooltip beside selection if does not match a record returned from query when passObject=false, passed objectKeys', async function (assert) {
+  test('it renders a tooltip beside selection if does not match a record returned from query when passObject=false, passed objectKeys', async function (assert) {
     const models = ['some/model'];
     const spy = sinon.spy();
     const objectKeys = ['uuid'];
@@ -885,22 +881,22 @@ module('Integration | Component | search select', function (hooks) {
         @onChange={{this.onChange}}
         @objectKeys={{this.objectKeys}}
         @inputValue={{this.inputValue}}
-        @renderInfoTooltip={{this.renderInfoTooltip}}
+        @renderTooltip={{this.renderTooltip}}
       />
       `);
     assert.strictEqual(component.selectedOptions.length, 2, 'there are two selected options');
-    assert.dom('[data-test-selected-option="0"]').hasText('model-a a123');
-    assert.dom('[data-test-selected-option="1"]').hasText('non-existent-model');
+    assert.dom(GENERAL.searchSelect.selectedOption(0)).hasText('model-a a123');
+    assert.dom(GENERAL.searchSelect.selectedOption(1)).hasText('non-existent-model');
     assert
-      .dom('[data-test-selected-option="0"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(0)} ${GENERAL.tooltip('search-select')}`)
       .doesNotExist('does not render info tooltip for model that exists');
 
     assert
-      .dom('[data-test-selected-option="1"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(1)} ${GENERAL.tooltip('search-select')}`)
       .exists('renders info tooltip for model not returned from query');
   });
 
-  test('it renders an info tooltip beside selection if does not match a record returned from query when passObject=true, passed objectKeys', async function (assert) {
+  test('it renders a tooltip beside selection if does not match a record returned from query when passObject=true, passed objectKeys', async function (assert) {
     const models = ['some/model'];
     const spy = sinon.spy();
     const objectKeys = ['uuid'];
@@ -917,23 +913,23 @@ module('Integration | Component | search select', function (hooks) {
         @objectKeys={{this.objectKeys}}
         @inputValue={{this.inputValue}}
         @passObject={{true}}
-        @renderInfoTooltip={{this.renderInfoTooltip}}
+        @renderTooltip={{this.renderTooltip}}
       />
     `);
 
     assert.strictEqual(component.selectedOptions.length, 2, 'there are two selected options');
-    assert.dom('[data-test-selected-option="0"]').hasText('model-a a123');
-    assert.dom('[data-test-selected-option="1"]').hasText('non-existent-model');
+    assert.dom(GENERAL.searchSelect.selectedOption(0)).hasText('model-a a123');
+    assert.dom(GENERAL.searchSelect.selectedOption(1)).hasText('non-existent-model');
     assert
-      .dom('[data-test-selected-option="0"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(0)} ${GENERAL.tooltip('search-select')}`)
       .doesNotExist('does not render info tooltip for model that exists');
 
     assert
-      .dom('[data-test-selected-option="1"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(1)} ${GENERAL.tooltip('search-select')}`)
       .exists('renders info tooltip for model not returned from query');
   });
 
-  test('it renders an info tooltip beside selection if does not match a record returned from query when passObject=true and idKey=id', async function (assert) {
+  test('it renders a tooltip beside selection if does not match a record returned from query when passObject=true and idKey=id', async function (assert) {
     const models = ['some/model'];
     const spy = sinon.spy();
     const inputValue = ['model-a-id', 'non-existent-model'];
@@ -947,23 +943,23 @@ module('Integration | Component | search select', function (hooks) {
         @onChange={{this.onChange}}
         @inputValue={{this.inputValue}}
         @passObject={{true}}
-        @renderInfoTooltip={{this.renderInfoTooltip}}
+        @renderTooltip={{this.renderTooltip}}
       />
     `);
 
     assert.strictEqual(component.selectedOptions.length, 2, 'there are two selected options');
-    assert.dom('[data-test-selected-option="0"]').hasText('model-a-id');
-    assert.dom('[data-test-selected-option="1"]').hasText('non-existent-model');
+    assert.dom(GENERAL.searchSelect.selectedOption(0)).hasText('model-a-id');
+    assert.dom(GENERAL.searchSelect.selectedOption(1)).hasText('non-existent-model');
     assert
-      .dom('[data-test-selected-option="0"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(0)} ${GENERAL.tooltip('search-select')}`)
       .doesNotExist('does not render info tooltip for model that exists');
 
     assert
-      .dom('[data-test-selected-option="1"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(1)} ${GENERAL.tooltip('search-select')}`)
       .exists('renders info tooltip for model not returned from query');
   });
 
-  test('it renders an info tooltip beside selection if does not match a record returned from query when passObject=false and idKey=id', async function (assert) {
+  test('it renders a tooltip beside selection if does not match a record returned from query when passObject=false and idKey=id', async function (assert) {
     const models = ['some/model'];
     const spy = sinon.spy();
     const inputValue = ['model-a-id', 'non-existent-model', 'wildcard*'];
@@ -977,25 +973,25 @@ module('Integration | Component | search select', function (hooks) {
         @onChange={{this.onChange}}
         @inputValue={{this.inputValue}}
         @passObject={{false}}
-        @renderInfoTooltip={{this.renderInfoTooltip}}
+        @renderTooltip={{this.renderTooltip}}
       />
     `);
     assert.strictEqual(component.selectedOptions.length, 3, 'there are three selected options');
-    assert.dom('[data-test-selected-option="0"]').hasText('model-a-id');
-    assert.dom('[data-test-selected-option="1"]').hasText('non-existent-model');
-    assert.dom('[data-test-selected-option="2"]').hasText('wildcard*');
+    assert.dom(GENERAL.searchSelect.selectedOption(0)).hasText('model-a-id');
+    assert.dom(GENERAL.searchSelect.selectedOption(1)).hasText('non-existent-model');
+    assert.dom(GENERAL.searchSelect.selectedOption(2)).hasText('wildcard*');
     assert
-      .dom('[data-test-selected-option="0"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(0)} ${GENERAL.tooltip('search-select')}`)
       .doesNotExist('does not render info tooltip for model that exists');
     assert
-      .dom('[data-test-selected-option="1"] [data-test-component="info-tooltip"]')
-      .exists('renders info tooltip for model not returned from query');
+      .dom(`${GENERAL.searchSelect.selectedOption(1)} ${GENERAL.tooltip('search-select')}`)
+      .exists('renders a tooltip for model not returned from query');
     assert
-      .dom('[data-test-selected-option="2"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(2)} ${GENERAL.tooltip('search-select')}`)
       .doesNotExist('does not render info tooltip for wildcard option');
   });
 
-  test('it does not render an info tooltip beside selection if not passed @renderInfoTooltip', async function (assert) {
+  test('it does not render a tooltip beside selection if not passed @renderTooltip', async function (assert) {
     const models = ['some/model'];
     const spy = sinon.spy();
     const inputValue = ['model-a-id', 'non-existent-model', 'wildcard*'];
@@ -1012,13 +1008,13 @@ module('Integration | Component | search select', function (hooks) {
       />
     `);
     assert
-      .dom('[data-test-selected-option="0"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(0)} ${GENERAL.tooltip('search-select')}`)
       .doesNotExist('does not render info tooltip for model that exists');
     assert
-      .dom('[data-test-selected-option="1"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(1)} ${GENERAL.tooltip('search-select')}`)
       .doesNotExist('does not render info tooltip for model not returned from query');
     assert
-      .dom('[data-test-selected-option="2"] [data-test-component="info-tooltip"]')
+      .dom(`${GENERAL.searchSelect.selectedOption(2)} ${GENERAL.tooltip('search-select')}`)
       .doesNotExist('does not render info tooltip for wildcard option');
   });
 });
diff --git a/ui/tests/integration/components/search-select-with-modal-test.js b/ui/tests/integration/components/search-select-with-modal-test.js
index 7ef9d7a8679..7572567bfe3 100644
--- a/ui/tests/integration/components/search-select-with-modal-test.js
+++ b/ui/tests/integration/components/search-select-with-modal-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,11 +9,13 @@ import { create } from 'ember-cli-page-object';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { Response } from 'miragejs';
 import { clickTrigger, typeInSearch } from 'ember-power-select/test-support/helpers';
-import { render, fillIn, click, findAll } from '@ember/test-helpers';
+import { render, fillIn, click, findAll, waitFor, settled } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import ss from 'vault/tests/pages/components/search-select';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import codemirror, { setCodeEditorValue } from 'vault/tests/helpers/codemirror';
 
 const component = create(ss);
 
@@ -156,7 +158,7 @@ module('Integration | Component | search select with modal', function (hooks) {
     await component.selectOption();
 
     assert.dom('#search-select-modal').exists('modal is active');
-    assert.dom('[data-test-empty-state-title]').hasText('No policy type selected');
+    assert.dom(GENERAL.emptyStateTitle).hasText('No policy type selected');
     assert.ok(this.onChange.notCalled, 'onChange is not called');
   });
 
@@ -193,21 +195,21 @@ module('Integration | Component | search select with modal', function (hooks) {
       'dropdown gives option to create new option'
     );
     await component.selectOption();
-    assert.dom('[data-test-empty-state-title]').hasText('No policy type selected');
-    await fillIn('[data-test-select="policyType"]', 'acl');
+    assert.dom(GENERAL.emptyStateTitle).hasText('No policy type selected');
+    await fillIn(GENERAL.selectByAttr('policyType'), 'acl');
     assert.dom('[data-test-policy-form]').exists('policy form renders after type is selected');
     await click('[data-test-tab-example-policy] button');
     assert.dom('[data-test-tab-example-policy] button').hasAttribute('aria-selected', 'true');
     await click('[data-test-tab-your-policy] button');
     assert.dom('[data-test-tab-your-policy] button').hasAttribute('aria-selected', 'true');
-    await fillIn(
-      '[data-test-component="code-mirror-modifier"] textarea',
-      'path "secret/super-secret" { capabilities = ["deny"] }'
-    );
-    await click('[data-test-policy-save]');
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    setCodeEditorValue(editor, 'path "secret/super-secret" { capabilities = ["deny"] }');
+    await settled();
+    await click(GENERAL.submitButton);
     assert.dom('[data-test-modal-div]').doesNotExist('modal closes after save');
     assert
-      .dom('[data-test-selected-option="0"]')
+      .dom(GENERAL.searchSelect.selectedOption(0))
       .hasText('acl-test-new', 'adds newly created policy to selected options');
     assert.ok(
       this.onChange.calledWithExactly(['acl-test-new']),
@@ -245,24 +247,35 @@ module('Integration | Component | search select with modal', function (hooks) {
     assert.ok(this.onChange.notCalled, 'onChange is not called');
   });
 
-  test('it renders fallback component if both models return 403', async function (assert) {
-    assert.expect(7);
-    this.server.get('sys/policies/acl', () => {
-      return new Response(
-        403,
-        { 'Content-Type': 'application/json' },
-        JSON.stringify({ errors: ['permission denied'] })
-      );
-    });
-    this.server.get('sys/policies/rgp', () => {
-      return new Response(
-        403,
-        { 'Content-Type': 'application/json' },
-        JSON.stringify({ errors: ['permission denied'] })
-      );
+  module('fallback component', function (hooks) {
+    hooks.beforeEach(function () {
+      this.server.get('sys/policies/acl', () => {
+        return new Response(
+          403,
+          { 'Content-Type': 'application/json' },
+          JSON.stringify({ errors: ['permission denied'] })
+        );
+      });
+      this.server.get('sys/policies/rgp', () => {
+        return new Response(
+          403,
+          { 'Content-Type': 'application/json' },
+          JSON.stringify({ errors: ['permission denied'] })
+        );
+      });
+      this.server.get('identity/oidc/key?list=true', () => {
+        return new Response(
+          403,
+          { 'Content-Type': 'application/json' },
+          JSON.stringify({ errors: ['permission denied'] })
+        );
+      });
     });
 
-    await render(hbs`
+    test('it renders fallback component if both models return 403', async function (assert) {
+      assert.expect(7);
+
+      await render(hbs`
     <SearchSelectWithModal
       @id="policies"
       @label="Policies"
@@ -274,23 +287,71 @@ module('Integration | Component | search select with modal', function (hooks) {
       @modalFormTemplate="modal-form/policy-template"
     />
       `);
-    assert.dom('[data-test-component="string-list"]').exists('renders fallback component');
-    assert.false(component.hasTrigger, 'does not render power select trigger');
-    await fillIn('[data-test-string-list-input="0"]', 'string-list-policy');
-    await click('[data-test-string-list-button="add"]');
-    assert
-      .dom('[data-test-string-list-input="0"]')
-      .hasValue('string-list-policy', 'first row renders inputted string');
-    assert
-      .dom('[data-test-string-list-row="0"] [data-test-string-list-button="delete"]')
-      .exists('first row renders delete icon');
-    assert.dom('[data-test-string-list-row="1"]').exists('renders second input row');
-    assert
-      .dom('[data-test-string-list-row="1"] [data-test-string-list-button="add"]')
-      .exists('second row renders add icon');
-    assert.ok(
-      this.onChange.calledWithExactly(['string-list-policy']),
-      'onChange is called only after item is created'
-    );
+      assert.dom('[data-test-component="string-list"]').exists('renders fallback component');
+      assert.false(component.hasTrigger, 'does not render power select trigger');
+      await fillIn('[data-test-string-list-input="0"]', 'string-list-policy');
+      await click('[data-test-string-list-button="add"]');
+      assert
+        .dom('[data-test-string-list-input="0"]')
+        .hasValue('string-list-policy', 'first row renders inputted string');
+      assert
+        .dom('[data-test-string-list-row="0"] [data-test-string-list-button="delete"]')
+        .exists('first row renders delete icon');
+      assert.dom('[data-test-string-list-row="1"]').exists('renders second input row');
+      assert
+        .dom('[data-test-string-list-row="1"] [data-test-string-list-button="add"]')
+        .exists('second row renders add icon');
+      assert.ok(
+        this.onChange.calledWithExactly(['string-list-policy']),
+        'onChange is called only after item is created'
+      );
+    });
+
+    test('it renders fallback placeholder text for fallback component', async function (assert) {
+      assert.expect(1);
+
+      await render(hbs`
+    <SearchSelectWithModal
+      @id="key"
+      @label="Keys"
+      @models={{array "oidc/key"}}
+      @inputValue={{this.policies}}
+      @onChange={{this.onChange}}
+      @fallbackComponent="input-search"
+      @modalFormTemplate="modal-form/oidc-key-template"
+      @selectLimit="1"
+      @placeholder="Search or type to create a key item"
+      @fallbackComponentPlaceholder="Input key name"
+    />
+      `);
+      assert
+        .dom(GENERAL.inputSearch('key'))
+        .hasAttribute('placeholder', 'Input key name', 'Fallback placeholder was passed to input search');
+    });
+
+    test('it renders placeholder text for fallback component', async function (assert) {
+      assert.expect(1);
+
+      await render(hbs`
+    <SearchSelectWithModal
+      @id="key"
+      @label="Keys"
+      @models={{array "oidc/key"}}
+      @inputValue={{this.policies}}
+      @onChange={{this.onChange}}
+      @fallbackComponent="input-search"
+      @modalFormTemplate="modal-form/oidc-key-template"
+      @selectLimit="1"
+      @placeholder="Search or type to create a key item"
+    />
+      `);
+      assert
+        .dom(GENERAL.inputSearch('key'))
+        .hasAttribute(
+          'placeholder',
+          'Search or type to create a key item',
+          'Placeholder was passed to input search'
+        );
+    });
   });
 });
diff --git a/ui/tests/integration/components/secret-edit-test.js b/ui/tests/integration/components/secret-edit-test.js
index 6cef7a95d26..e790810f811 100644
--- a/ui/tests/integration/components/secret-edit-test.js
+++ b/ui/tests/integration/components/secret-edit-test.js
@@ -1,16 +1,17 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, settled } from '@ember/test-helpers';
+import { render, settled, waitFor } from '@ember/test-helpers';
 import { resolve } from 'rsvp';
 import { run } from '@ember/runloop';
 import Service from '@ember/service';
 import hbs from 'htmlbars-inline-precompile';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import codemirror, { setCodeEditorValue } from 'vault/tests/helpers/codemirror';
 
 let capabilities;
 const storeService = Service.extend({
@@ -23,18 +24,11 @@ module('Integration | Component | secret edit', function (hooks) {
 
   hooks.beforeEach(function () {
     capabilities = null;
-    this.codeMirror = this.owner.lookup('service:code-mirror');
     this.set('key', { id: 'Foobar' });
     run(() => {
       this.owner.unregister('service:store');
       this.owner.register('service:store', storeService);
     });
-    setRunOptions({
-      rules: {
-        // TODO: Fix JSONEditor/CodeMirror
-        label: { enabled: false },
-      },
-    });
   });
 
   test('it disables JSON toggle in show mode when is an advanced format', async function (assert) {
@@ -47,8 +41,8 @@ module('Integration | Component | secret edit', function (hooks) {
       },
     });
 
-    await render(hbs`{{secret-edit mode=this.mode model=this.model key=this.key }}`);
-    assert.dom('[data-test-toggle-input="json"]').isDisabled();
+    await render(hbs`<SecretEdit @mode={{this.mode}} @model={{this.model}} @key={{this.key}} />`);
+    assert.dom(GENERAL.toggleInput('json')).isDisabled();
   });
 
   test('it does JSON toggle in show mode when showing string data', async function (assert) {
@@ -61,8 +55,8 @@ module('Integration | Component | secret edit', function (hooks) {
       },
     });
 
-    await render(hbs`{{secret-edit mode=this.mode model=this.model key=this.key }}`);
-    assert.dom('[data-test-toggle-input="json"]').isNotDisabled();
+    await render(hbs`<SecretEdit @mode={{this.mode}} @model={{this.model}} @key={{this.key}} />`);
+    assert.dom(GENERAL.toggleInput('json')).isNotDisabled();
   });
 
   test('it shows an error when creating and data is not an object', async function (assert) {
@@ -71,14 +65,15 @@ module('Integration | Component | secret edit', function (hooks) {
       secretData: null,
     });
 
-    await render(hbs`{{secret-edit mode=this.mode model=this.model preferAdvancedEdit=true key=this.key }}`);
+    await render(
+      hbs`<SecretEdit @mode={{this.mode}} @model={{this.model}} @preferAdvancedEdit={{true}} @key={{this.key}} />`
+    );
 
-    const instance = document.querySelector('.CodeMirror').CodeMirror;
-    instance.setValue(JSON.stringify([{ foo: 'bar' }]));
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    setCodeEditorValue(editor, JSON.stringify([{ foo: 'bar' }]));
     await settled();
-    assert
-      .dom('[data-test-message-error]')
-      .includesText('Vault expects data to be formatted as an JSON object');
+    assert.dom(GENERAL.messageError).includesText('Vault expects data to be formatted as an JSON object');
   });
 
   test('it allows saving when the model isError', async function (assert) {
@@ -91,8 +86,8 @@ module('Integration | Component | secret edit', function (hooks) {
         float: '1.234',
       },
     });
-    await render(hbs`<SecretEdit @mode={{this.mode}} @model={{this.model}} key="this.key" />`);
-    assert.dom('[data-test-secret-save]').isNotDisabled();
+    await render(hbs`<SecretEdit @mode={{this.mode}} @model={{this.model}} @key={{this.key}} />`);
+    assert.dom(GENERAL.submitButton).isNotDisabled();
   });
 
   test('it shows an error when editing and the data is not an object', async function (assert) {
@@ -109,13 +104,14 @@ module('Integration | Component | secret edit', function (hooks) {
       canReadSecretData: true,
     });
 
-    await render(hbs`{{secret-edit mode=this.mode model=this.model preferAdvancedEdit=true key=this.key }}`);
+    await render(
+      hbs`<SecretEdit @mode={{this.mode}} @model={{this.model}} @preferAdvancedEdit={{true}} @key={{this.key}} />`
+    );
 
-    const instance = document.querySelector('.CodeMirror').CodeMirror;
-    instance.setValue(JSON.stringify([{ foo: 'bar' }]));
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    setCodeEditorValue(editor, JSON.stringify([{ foo: 'bar' }]));
     await settled();
-    assert
-      .dom('[data-test-message-error]')
-      .includesText('Vault expects data to be formatted as an JSON object');
+    assert.dom(GENERAL.messageError).includesText('Vault expects data to be formatted as an JSON object');
   });
 });
diff --git a/ui/tests/integration/components/secret-engine/card/metadata-test.js b/ui/tests/integration/components/secret-engine/card/metadata-test.js
new file mode 100644
index 00000000000..13f0d54d573
--- /dev/null
+++ b/ui/tests/integration/components/secret-engine/card/metadata-test.js
@@ -0,0 +1,31 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render, fillIn } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { keyMgmtMockModel } from 'vault/tests/helpers/secret-engine/mocks';
+
+module('Integration | Component | SecretEngine::Card::Metadata', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.model = keyMgmtMockModel;
+  });
+
+  test('it shows metadata card information', async function (assert) {
+    assert.expect(4);
+    await render(hbs`
+      <SecretEngine::Card::Metadata @model={{this.model}} />
+    `);
+    assert.dom(`${GENERAL.cardContainer('metadata')} h2`).hasText('Metadata');
+    assert.dom(GENERAL.copySnippet('path')).hasText(this.model.secretsEngine.path);
+    assert.dom(GENERAL.copySnippet('accessor')).hasText(this.model.secretsEngine.accessor);
+    await fillIn(GENERAL.textareaByAttr('description'), 'Some awesome description');
+    assert.dom(GENERAL.textareaByAttr('description')).hasValue('Some awesome description');
+  });
+});
diff --git a/ui/tests/integration/components/secret-engine/card/secrets-duration-test.js b/ui/tests/integration/components/secret-engine/card/secrets-duration-test.js
new file mode 100644
index 00000000000..d32fdeafa6f
--- /dev/null
+++ b/ui/tests/integration/components/secret-engine/card/secrets-duration-test.js
@@ -0,0 +1,36 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { keyMgmtMockModel } from 'vault/tests/helpers/secret-engine/mocks';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SELECTORS } from 'vault/tests/helpers/secret-engine/general-settings-selectors';
+
+module('Integration | Component | SecretEngine::Card::LeaseDuration', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.model = keyMgmtMockModel;
+  });
+
+  test('it shows default and max ttl pickers', async function (assert) {
+    assert.expect(5);
+    await render(hbs`
+      <SecretEngine::Card::SecretsDuration @model={{this.model}} />
+    `);
+    assert.dom(SELECTORS.ttlPickerV2).exists({ count: 2 });
+    assert.dom(GENERAL.fieldLabelbyAttr('default_lease_ttl')).hasText('Default time-to-live (TTL)');
+    assert.dom(GENERAL.fieldLabelbyAttr('max_lease_ttl')).hasText('Maximum time-to-live (TTL)');
+    assert
+      .dom(GENERAL.helpTextByAttr('default_lease_ttl'))
+      .hasText('How long secrets in this engine stay valid.');
+    assert
+      .dom(GENERAL.helpTextByAttr('max_lease_ttl'))
+      .hasText('Maximum extension for the secrets life beyond default.');
+  });
+});
diff --git a/ui/tests/integration/components/secret-engine/card/security-test.js b/ui/tests/integration/components/secret-engine/card/security-test.js
new file mode 100644
index 00000000000..2bee77be965
--- /dev/null
+++ b/ui/tests/integration/components/secret-engine/card/security-test.js
@@ -0,0 +1,36 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { keyMgmtMockModel } from 'vault/tests/helpers/secret-engine/mocks';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SELECTORS } from 'vault/tests/helpers/secret-engine/general-settings-selectors';
+
+module('Integration | Component | SecretEngine::Card::Security', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.model = keyMgmtMockModel;
+  });
+
+  test('it shows security card information', async function (assert) {
+    assert.expect(7);
+    await render(hbs`
+      <SecretEngine::Card::Security @model={{this.model}} />
+    `);
+    assert.dom(`${GENERAL.cardContainer('security')} h2`).hasText('Security');
+    assert.dom(SELECTORS.label('local')).hasText('Local');
+    assert.dom(SELECTORS.helperText('local')).hasText('Secrets stay in one cluster and are not replicated.');
+    assert.dom(GENERAL.inputByAttr('local')).isChecked();
+    assert.dom(SELECTORS.label('seal_wrap')).hasText('Seal wrap');
+    assert
+      .dom(SELECTORS.helperText('seal_wrap'))
+      .hasText('Wrap secrets with an additional encryption layer using a seal.');
+    assert.dom(GENERAL.inputByAttr('seal_wrap')).isNotChecked();
+  });
+});
diff --git a/ui/tests/integration/components/secret-engine/card/version-test.js b/ui/tests/integration/components/secret-engine/card/version-test.js
new file mode 100644
index 00000000000..42c898a4b2f
--- /dev/null
+++ b/ui/tests/integration/components/secret-engine/card/version-test.js
@@ -0,0 +1,31 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { keyMgmtMockModel } from 'vault/tests/helpers/secret-engine/mocks';
+import { SELECTORS } from 'vault/tests/helpers/secret-engine/general-settings-selectors';
+
+module('Integration | Component | SecretEngine::Card::Version', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.model = keyMgmtMockModel;
+  });
+
+  test('it shows version card information', async function (assert) {
+    assert.expect(4);
+    await render(hbs`
+      <SecretEngine::Card::Version @model={{this.model}} />
+    `);
+    assert.dom(`${GENERAL.cardContainer('version')} h2`).hasText('Version');
+    assert.dom(SELECTORS.engineType).hasAnyText(keyMgmtMockModel.secretsEngine.type);
+    assert.dom(SELECTORS.currentVersion).hasAnyText(keyMgmtMockModel.secretsEngine.running_plugin_version);
+    assert.dom(SELECTORS.versionCard.versionsDropdown).doesNotExist();
+  });
+});
diff --git a/ui/tests/integration/components/secret-engine/configuration-details-test.js b/ui/tests/integration/components/secret-engine/configuration-details-test.js
new file mode 100644
index 00000000000..a625d64c928
--- /dev/null
+++ b/ui/tests/integration/components/secret-engine/configuration-details-test.js
@@ -0,0 +1,101 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import {
+  expectedConfigKeys,
+  expectedValueOfConfigKeys,
+} from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
+import { ALL_ENGINES } from 'vault/utils/all-engines-metadata';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+
+module('Integration | Component | SecretEngine::ConfigurationDetails', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.configs = {
+      aws: {
+        region: 'us-west-2',
+        access_key: '123-key',
+        iam_endpoint: 'iam-endpoint',
+        sts_endpoint: 'sts-endpoint',
+        max_retries: 1,
+      },
+      azure: {
+        client_secret: 'client-secret',
+        subscription_id: 'subscription-id',
+        tenant_id: 'tenant-id',
+        client_id: 'client-id',
+        root_password_ttl: '1800000s',
+        environment: 'AZUREPUBLICCLOUD',
+      },
+      gcp: {
+        credentials: '{"some-key":"some-value"}',
+        ttl: '100s',
+        max_ttl: '101s',
+      },
+      ssh: {
+        public_key: 'public-key',
+        generate_signing_key: true,
+      },
+    };
+  });
+
+  test('it shows prompt message if no config models are passed in', async function (assert) {
+    assert.expect(2);
+    await render(hbs`
+      <SecretEngine::ConfigurationDetails @typeDisplay="Display Name" />
+    `);
+    assert.dom(GENERAL.emptyStateTitle).hasText(`Display Name not configured`);
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(`Get started by configuring your Display Name secrets engine.`);
+  });
+
+  for (const type of ALL_ENGINES.filter((engine) => engine.isConfigurable ?? false).map(
+    (engine) => engine.type
+  )) {
+    test(`${type}: it shows config details if configModel(s) are passed in`, async function (assert) {
+      this.config = this.configs[type];
+      this.typeDisplay = engineDisplayData(type).displayName;
+
+      await render(
+        hbs`<SecretEngine::ConfigurationDetails @config={{this.config}} @typeDisplay={{this.typeDisplay}}/>`
+      );
+
+      for (const key of expectedConfigKeys(type)) {
+        if (
+          key === 'Secret key' ||
+          key === 'Client secret' ||
+          key === 'Private key' ||
+          key === 'Credentials'
+        ) {
+          // these keys are not returned by the API and should not show on the details page
+          assert
+            .dom(GENERAL.infoRowLabel(key))
+            .doesNotExist(`${key} on the ${type} config details does NOT exists.`);
+        } else {
+          // check the label appears
+          assert.dom(GENERAL.infoRowLabel(key)).exists(`${key} on the ${type} config details exists.`);
+          const responseKeyAndValue = expectedValueOfConfigKeys(type, key);
+          // check the value appears
+          assert
+            .dom(GENERAL.infoRowValue(key))
+            .hasText(responseKeyAndValue, `${key} value for the ${type} config details exists.`);
+          // make sure the values that should be masked are masked, and others are not.
+          if (key === 'Public Key') {
+            assert.dom(GENERAL.infoRowValue(key)).hasClass('masked-input', `${key} is masked`);
+          } else {
+            assert.dom(GENERAL.infoRowValue(key)).doesNotHaveClass('masked-input', `${key} is not masked`);
+          }
+        }
+      }
+    });
+  }
+});
diff --git a/ui/tests/integration/components/secret-engine/configure-ssh-test.js b/ui/tests/integration/components/secret-engine/configure-ssh-test.js
new file mode 100644
index 00000000000..9597ac3eb7e
--- /dev/null
+++ b/ui/tests/integration/components/secret-engine/configure-ssh-test.js
@@ -0,0 +1,154 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render, click, fillIn } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import sinon from 'sinon';
+import SshConfigForm from 'vault/forms/secrets/ssh-config';
+
+module('Integration | Component | SecretEngine/configure-ssh', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    const router = this.owner.lookup('service:router');
+    this.id = 'ssh-test';
+    this.form = new SshConfigForm({ generate_signing_key: true }, { isNew: true });
+    this.transitionStub = sinon.stub(router, 'transitionTo');
+    this.refreshStub = sinon.stub(router, 'refresh');
+  });
+
+  test('it shows create fields if not configured', async function (assert) {
+    await render(hbs`
+      <SecretEngine::ConfigureSsh
+        @configForm={{this.form}}
+        @id={{this.id}}
+      />
+    `);
+    assert.dom(GENERAL.inputByAttr('private_key')).hasNoText('Private key is empty and reset');
+    assert.dom(GENERAL.inputByAttr('public_key')).hasNoText('Public key is empty and reset');
+    assert
+      .dom(GENERAL.inputByAttr('generate_signing_key'))
+      .isChecked('Generate signing key is checked by default');
+  });
+
+  test('it should go back to parent route on cancel', async function (assert) {
+    await render(hbs`
+      <SecretEngine::ConfigureSsh
+        @configForm={{this.form}}
+        @id={{this.id}}
+      />
+    `);
+
+    await click(GENERAL.cancelButton);
+
+    assert.true(
+      this.transitionStub.calledWith('vault.cluster.secrets.backend.configuration', 'ssh-test'),
+      'On cancel the router transitions to the parent configuration index route.'
+    );
+  });
+
+  test('it should validate form fields', async function (assert) {
+    await render(hbs`
+      <SecretEngine::ConfigureSsh
+        @configForm={{this.form}}
+        @id={{this.id}}
+      />
+    `);
+    await fillIn(GENERAL.inputByAttr('public_key'), 'hello');
+    await click(GENERAL.submitButton);
+    assert
+      .dom(GENERAL.validationErrorByAttr('public_key'))
+      .hasText(
+        'You must provide a Public and Private keys or leave both unset.',
+        'Public key validation error renders.'
+      );
+
+    await click(GENERAL.inputByAttr('generate_signing_key'));
+    await click(GENERAL.submitButton);
+    assert
+      .dom(GENERAL.validationErrorByAttr('generate_signing_key'))
+      .hasText(
+        'Provide a Public and Private key or set "Generate Signing Key" to true.',
+        'Generate signing key validation message shows.'
+      );
+  });
+
+  test('it should generate signing key', async function (assert) {
+    assert.expect(2);
+    this.server.post('/ssh-test/config/ca', (schema, req) => {
+      const data = JSON.parse(req.requestBody);
+      const expected = {
+        generate_signing_key: true,
+      };
+      assert.deepEqual(expected, data, 'POST request made to save ca-config with correct properties');
+    });
+    await render(hbs`
+      <SecretEngine::ConfigureSsh
+        @configForm={{this.form}}
+        @id={{this.id}}
+      />
+    `);
+
+    await click(GENERAL.submitButton);
+    assert.true(
+      this.transitionStub.calledWith('vault.cluster.secrets.backend.configuration', this.id),
+      'Transitions to details route on save success.'
+    );
+  });
+
+  module('editing', function (hooks) {
+    hooks.beforeEach(function () {
+      this.editId = 'ssh-edit-me';
+      this.public_key = 'public-key';
+      this.form = new SshConfigForm({
+        public_key: this.public_key,
+        generate_signing_key: true,
+      });
+    });
+    test('it populates fields when editing', async function (assert) {
+      await render(hbs`
+        <SecretEngine::ConfigureSsh
+          @configForm={{this.form}}
+          @id={{this.editId}}
+        />
+      `);
+      assert
+        .dom(SES.ssh.editConfigSection)
+        .exists('renders the edit configuration section of the form and not the create part');
+      assert.dom(GENERAL.inputByAttr('public-key')).hasText('***********', 'public key is masked');
+      await click(GENERAL.button('toggle-masked'));
+      assert
+        .dom(GENERAL.inputByAttr('public-key'))
+        .hasText(this.public_key, 'public key is unmasked and shows the actual value');
+    });
+
+    test('it allows you to delete a public key', async function (assert) {
+      assert.expect(3);
+      this.server.delete('/ssh-edit-me/config/ca', () => {
+        assert.true(true, 'DELETE request made to ca-config with correct properties');
+      });
+      await render(hbs`
+        <SecretEngine::ConfigureSsh
+          @configForm={{this.form}}
+          @id={{this.editId}}
+        />
+      `);
+      // delete Public key
+      await click(GENERAL.button('delete-public-key'));
+      assert.dom(GENERAL.confirmMessage).hasText('Confirming will remove the CA certificate information.');
+      await click(GENERAL.confirmButton);
+      assert.true(
+        this.transitionStub.calledWith('vault.cluster.secrets.backend.configuration.edit', 'ssh-edit-me'),
+        'On delete the router transitions to the current route.'
+      );
+    });
+  });
+});
diff --git a/ui/tests/integration/components/secret-engine/configure-wif-test.js b/ui/tests/integration/components/secret-engine/configure-wif-test.js
new file mode 100644
index 00000000000..0d0a2ab291e
--- /dev/null
+++ b/ui/tests/integration/components/secret-engine/configure-wif-test.js
@@ -0,0 +1,928 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import sinon from 'sinon';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { SECRET_ENGINE_SELECTORS as SES } from 'vault/tests/helpers/secret-engine/secret-engine-selectors';
+import { render, click, fillIn } from '@ember/test-helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { v4 as uuidv4 } from 'uuid';
+import { hbs } from 'ember-cli-htmlbars';
+import { ALL_ENGINES } from 'vault/utils/all-engines-metadata';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import {
+  expectedConfigKeys,
+  createConfig,
+  configUrl,
+  fillInAzureConfig,
+  fillInAwsConfig,
+} from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
+import { capabilitiesStub } from 'vault/tests/helpers/stubs';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+import waitForError from 'vault/tests/helpers/wait-for-error';
+import AwsConfigForm from 'vault/forms/secrets/aws-config';
+import AzureConfigForm from 'vault/forms/secrets/azure-config';
+import GcpConfigForm from 'vault/forms/secrets/gcp-config';
+import SshConfigForm from 'vault/forms/secrets/ssh-config';
+
+const WIF_ENGINES = ALL_ENGINES.filter((e) => e.isWIF).map((e) => e.type);
+
+module('Integration | Component | SecretEngine::ConfigureWif', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.version = this.owner.lookup('service:version');
+    this.flashMessages = this.owner.lookup('service:flash-messages');
+    this.flashMessages.registerTypes(['success', 'danger']);
+    this.flashSuccessSpy = sinon.spy(this.flashMessages, 'success');
+    this.flashDangerSpy = sinon.spy(this.flashMessages, 'danger');
+    this.transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
+    this.uid = uuidv4();
+    // stub capabilities so that by default user can read and update issuer
+    this.server.post('/sys/capabilities-self', () => capabilitiesStub('identity/oidc/config', ['sudo']));
+    this.getForm = (type, data, options) => {
+      const form = {
+        aws: AwsConfigForm,
+        azure: AzureConfigForm,
+        gcp: GcpConfigForm,
+        ssh: SshConfigForm,
+      }[type];
+      return new form(data, options);
+    };
+    this.renderComponent = () =>
+      render(hbs`
+        <SecretEngine::ConfigureWif
+          @backendPath={{this.id}}
+          @displayName={{this.displayName}}
+          @type={{this.type}}
+          @configForm={{this.form}}
+        />
+      `);
+  });
+
+  module('Create view', function () {
+    module('Enterprise', function (hooks) {
+      hooks.beforeEach(function () {
+        this.version.type = 'enterprise';
+      });
+
+      for (const type of WIF_ENGINES) {
+        test(`${type}: it renders default fields`, async function (assert) {
+          this.id = `${type}-${this.uid}`;
+          this.displayName = engineDisplayData(type).displayName;
+          this.form = this.getForm(type, {}, { isNew: true });
+          this.type = type;
+
+          await this.renderComponent();
+
+          assert.dom(SES.configureForm).exists(`it lands on the ${type} configuration form`);
+          assert.dom(SES.wif.accessType(type)).isChecked(`defaults to showing ${type} access type checked`);
+          assert.dom(SES.wif.accessType('wif')).isNotChecked('wif access type is not checked');
+
+          let toggleGroup = GENERAL.button('More options');
+          if (type === 'aws') {
+            toggleGroup = GENERAL.button('Root config options');
+          }
+          await click(toggleGroup);
+
+          for (const key of expectedConfigKeys(type, true)) {
+            if (key === 'config_ttl' || key === 'maxTtl') {
+              // because toggle.hbs passes in the name rather than the camelized attr, we have a difference of data-test=attrName vs data-test="Item name" being passed into the data-test selectors. Long-term solution we should match toggle.hbs selectors to formField.hbs selectors syntax
+              assert
+                .dom(GENERAL.ttl.toggle(key === 'config_ttl' ? 'Config TTL' : 'Max TTL'))
+                .exists(
+                  `${key} shows for ${type} configuration create section when wif is not the access type.`
+                );
+            } else {
+              assert
+                .dom(GENERAL.inputByAttr(key))
+                .exists(
+                  `${key} shows for ${type} configuration create section when wif is not the access type`
+                );
+            }
+          }
+          assert
+            .dom(GENERAL.inputByAttr('issuer'))
+            .doesNotExist(`for ${type}, the issuer does not show when wif is not the access type`);
+        });
+      }
+
+      for (const type of WIF_ENGINES) {
+        test(`${type}: it renders wif fields when user selects wif access type`, async function (assert) {
+          this.id = `${type}-${this.uid}`;
+          this.displayName = engineDisplayData(type).displayName;
+          this.form = this.getForm(type, {}, { isNew: true });
+          this.type = type;
+
+          await this.renderComponent();
+          await click(SES.wif.accessType('wif'));
+
+          let toggleGroup = GENERAL.button('More options');
+          if (type === 'aws') {
+            toggleGroup = GENERAL.button('Root config options');
+          }
+          await click(toggleGroup);
+
+          // check for the wif fields only
+          for (const key of expectedConfigKeys(`${type}-wif`, true)) {
+            if (key === 'Identity token TTL') {
+              assert.dom(GENERAL.ttl.toggle(key)).exists(`${key} shows for ${type} wif section.`);
+            } else {
+              assert.dom(GENERAL.inputByAttr(key)).exists(`${key} shows for ${type} wif section.`);
+            }
+          }
+          assert.dom(GENERAL.inputByAttr('issuer')).exists(`issuer shows for ${type} wif section.`);
+        });
+      }
+      /* This module covers code that is the same for all engines. We run them once against one of the engines.*/
+      module('Engine agnostic', function () {
+        test('it transitions without sending a config or issuer payload on cancel', async function (assert) {
+          assert.expect(3);
+          this.id = `azure-${this.uid}`;
+          this.displayName = 'Azure';
+          this.type = 'azure';
+          this.form = this.getForm('azure', {}, { isNew: true });
+
+          this.server.post(configUrl('azure', this.id), () => {
+            throw new Error(
+              `Request was made to post the config when it should not have been because the user canceled out of the flow.`
+            );
+          });
+          this.server.post('/identity/oidc/config', () => {
+            throw new Error(
+              `Request was made to save the issuer when it should not have been because the user canceled out of the flow.`
+            );
+          });
+
+          await this.renderComponent();
+
+          await fillInAzureConfig(true);
+          await click(GENERAL.cancelButton);
+
+          assert.true(this.flashDangerSpy.notCalled, 'No danger flash messages called.');
+          assert.true(this.flashSuccessSpy.notCalled, 'No success flash messages called.');
+
+          assert.true(
+            this.transitionStub.calledWith('vault.cluster.secrets.backend.configuration', this.id),
+            'Transitioned to the configuration index route.'
+          );
+        });
+
+        test('it throws an error if the getter isWifPluginConfigured is not defined on the model', async function (assert) {
+          const promise = waitForError();
+          this.id = `azure-${this.uid}`;
+          this.displayName = 'Azure';
+          this.type = 'azure';
+          // creating a config that exists but will not have the attribute isWifPluginConfigured on it
+          this.form = this.getForm('ssh', {});
+
+          await this.renderComponent();
+          const err = await promise;
+          assert.true(
+            err.message.includes(
+              `'isWifPluginConfigured' is required to be defined on the config model. Must return a boolean.`
+            ),
+            'asserts without isWifPluginConfigured'
+          );
+        });
+
+        test('it allows user to submit the config even if API error occurs on issuer config', async function (assert) {
+          this.id = `aws-${this.uid}`;
+          this.displayName = 'AWS';
+          this.type = 'aws';
+          this.form = this.getForm('aws', {}, { isNew: true });
+
+          this.server.post(configUrl('aws', this.id), () => {
+            assert.true(true, 'post request was made to config/root when issuer failed. test should pass.');
+          });
+          this.server.post('/identity/oidc/config', () => {
+            return overrideResponse(400, { errors: ['bad request'] });
+          });
+
+          await this.renderComponent();
+
+          await fillInAwsConfig('withWif');
+          await click(GENERAL.submitButton);
+          await click(SES.wif.issuerWarningSave);
+
+          assert.true(
+            this.flashDangerSpy.calledWith('Issuer was not saved: bad request'),
+            'Flash message shows that issuer was not saved'
+          );
+          assert.true(
+            this.flashSuccessSpy.calledWith(`Successfully saved ${this.id}'s configuration.`),
+            'Flash message shows that root was saved even if issuer was not'
+          );
+          assert.true(
+            this.transitionStub.calledWith('vault.cluster.secrets.backend.configuration', this.id),
+            'Transitioned to the configuration index route.'
+          );
+        });
+
+        test('it surfaces the API error if config save fails, and prevents the user from transitioning', async function (assert) {
+          this.id = `aws-${this.uid}`;
+          this.displayName = 'AWS';
+          this.type = 'aws';
+          this.form = this.getForm('aws', {}, { isNew: true });
+
+          this.server.post(configUrl('aws', this.id), () => {
+            return overrideResponse(400, { errors: ['bad request'] });
+          });
+          this.server.post(configUrl('aws-lease', this.id), () => {
+            assert.true(
+              true,
+              'post request was made to config/lease when config/root failed. test should pass.'
+            );
+          });
+
+          await this.renderComponent();
+          // fill in both lease and root endpoints to ensure that both payloads are attempted to be sent
+          await fillInAwsConfig('withAccess');
+          await fillInAwsConfig('withLease');
+          await click(GENERAL.submitButton);
+          assert.dom(GENERAL.messageError).exists('API error surfaced to user');
+          assert.dom(GENERAL.inlineError).exists('User shown inline error message');
+        });
+      });
+
+      module('Azure specific', function (hooks) {
+        hooks.beforeEach(function () {
+          this.id = `azure-${this.uid}`;
+          this.displayName = 'Azure';
+          this.type = 'azure';
+          this.form = this.getForm('azure', {}, { isNew: true });
+        });
+        test('it clears access type inputs after toggling accessType', async function (assert) {
+          await this.renderComponent();
+          await fillInAzureConfig();
+          await click(SES.wif.accessType('wif'));
+          await fillInAzureConfig(true);
+          await click(SES.wif.accessType('azure'));
+
+          assert
+            .dom(GENERAL.toggleInput('Root password TTL'))
+            .isChecked('rootPasswordTtl is not cleared after toggling accessType');
+          assert
+            .dom(GENERAL.inputByAttr('client_secret'))
+            .hasValue('', 'client_secret is cleared after toggling accessType');
+
+          await click(SES.wif.accessType('wif'));
+          assert
+            .dom(GENERAL.inputByAttr('issuer'))
+            .hasValue('', 'issuer shows no value after toggling accessType');
+          assert
+            .dom(GENERAL.inputByAttr('issuer'))
+            .hasAttribute(
+              'placeholder',
+              'https://vault-test.com',
+              'issuer shows no value after toggling accessType'
+            );
+          assert
+            .dom(GENERAL.inputByAttr('identity_token_audience'))
+            .hasValue('', 'idTokenAudience is cleared after toggling accessType');
+          assert
+            .dom(GENERAL.toggleInput('Identity token TTL'))
+            .isNotChecked('identityTokenTtl is cleared after toggling accessType');
+        });
+
+        test('it shows the correct access type subtext', async function (assert) {
+          await this.renderComponent();
+
+          assert
+            .dom(SES.wif.accessTypeSubtext)
+            .hasText(
+              'Choose the way to configure access to Azure. Access can be configured either using Azure account credentials or with the Plugin Workload Identity Federation (WIF).'
+            );
+        });
+
+        test('it does not show aws specific note', async function (assert) {
+          await this.renderComponent();
+
+          assert
+            .dom(SES.configureNote('azure'))
+            .doesNotExist('Note specific to AWS does not show for Azure secret engine when configuring.');
+        });
+      });
+
+      module('AWS specific', function (hooks) {
+        hooks.beforeEach(function () {
+          this.id = `aws-${this.uid}`;
+          this.displayName = 'AWS';
+          this.type = 'aws';
+          this.form = this.getForm('aws', {}, { isNew: true });
+        });
+
+        test('it clears access type inputs after toggling accessType', async function (assert) {
+          await this.renderComponent();
+          await fillInAwsConfig('aws');
+          await click(SES.wif.accessType('wif'));
+          await fillInAwsConfig('with-wif');
+          await click(SES.wif.accessType('aws'));
+
+          assert
+            .dom(GENERAL.inputByAttr('access_key'))
+            .hasValue('', 'access_key is cleared after toggling accessType');
+
+          await click(SES.wif.accessType('wif'));
+          assert
+            .dom(GENERAL.inputByAttr('issuer'))
+            .hasValue('', 'issuer shows no value after toggling accessType');
+          assert
+            .dom(GENERAL.inputByAttr('issuer'))
+            .hasAttribute(
+              'placeholder',
+              'https://vault-test.com',
+              'issuer shows no value after toggling accessType'
+            );
+          assert
+            .dom(GENERAL.inputByAttr('identity_token_audience'))
+            .hasValue('', 'idTokenAudience is cleared after toggling accessType');
+          assert
+            .dom(GENERAL.toggleInput('Identity token TTL'))
+            .isNotChecked('identityTokenTtl is cleared after toggling accessType');
+        });
+
+        test('it shows the correct access type subtext', async function (assert) {
+          await this.renderComponent();
+
+          assert
+            .dom(SES.wif.accessTypeSubtext)
+            .hasText(
+              'Choose the way to configure access to AWS. Access can be configured either using IAM access keys or with the Plugin Workload Identity Federation (WIF).'
+            );
+        });
+
+        test('it shows validation error if default lease is entered but max lease is not', async function (assert) {
+          this.server.post(configUrl('aws-lease', this.id), () => {
+            throw new Error(
+              `Request was made to post the config/lease when it should not have been because no data was changed.`
+            );
+          });
+          this.server.post(configUrl('aws', this.id), () => {
+            throw new Error(
+              `Request was made to post the config/root when it should not have been because no data was changed.`
+            );
+          });
+
+          await this.renderComponent();
+
+          await click(GENERAL.ttl.toggle('Default Lease TTL'));
+          await fillIn(GENERAL.ttl.input('Default Lease TTL'), '33');
+          await click(GENERAL.submitButton);
+          assert
+            .dom(GENERAL.inlineError)
+            .hasText('Lease TTL and Max Lease TTL are both required if one of them is set.');
+          assert.dom(SES.configureForm).exists('remains on the configuration form');
+        });
+
+        test('it allows user to submit root config even if API error occurs on config/lease config', async function (assert) {
+          this.server.post(configUrl('aws', this.id), () => {
+            assert.true(
+              true,
+              'post request was made to config/root when config/lease failed. test should pass.'
+            );
+          });
+          this.server.post(configUrl('aws-lease', this.id), () => {
+            return overrideResponse(400, { errors: ['bad request!!'] });
+          });
+
+          await this.renderComponent();
+          // fill in both lease and root endpoints to ensure that both payloads are attempted to be sent
+          await fillInAwsConfig('withAccess');
+          await fillInAwsConfig('withLease');
+          await click(GENERAL.submitButton);
+          assert.true(
+            this.flashDangerSpy.calledWith('Error saving lease configuration: bad request!!'),
+            'Flash message shows that lease was not saved.'
+          );
+          assert.true(
+            this.transitionStub.calledWith('vault.cluster.secrets.backend.configuration', this.id),
+            'Transitioned to the configuration index route.'
+          );
+        });
+
+        test('it transitions without sending a lease, root, or issuer payload on cancel', async function (assert) {
+          this.server.post(configUrl('aws', this.id), () => {
+            throw new Error(
+              `Request was made to post the config/root when it should not have been because the user canceled out of the flow.`
+            );
+          });
+          this.server.post(configUrl('aws-lease', this.id), () => {
+            throw new Error(
+              `Request was made to post the config/lease when it should not have been because the user canceled out of the flow.`
+            );
+          });
+          this.server.post('/identity/oidc/config', () => {
+            throw new Error(
+              `Request was made to post the identity/oidc/config when it should not have been because the user canceled out of the flow.`
+            );
+          });
+
+          await this.renderComponent();
+          // fill in both lease and root endpoints to ensure that both payloads are attempted to be sent
+          await fillInAwsConfig('withWif');
+          await fillInAwsConfig('withLease');
+          await click(GENERAL.cancelButton);
+
+          assert.true(this.flashDangerSpy.notCalled, 'No danger flash messages called.');
+          assert.true(this.flashSuccessSpy.notCalled, 'No success flash messages called.');
+          assert.true(
+            this.transitionStub.calledWith('vault.cluster.secrets.backend.configuration', this.id),
+            'Transitioned to the configuration index route.'
+          );
+        });
+
+        test('it does show aws specific note', async function (assert) {
+          await this.renderComponent();
+
+          assert.dom(SES.configureNote('aws')).exists('Note specific to AWS does show when configuring.');
+        });
+      });
+
+      module('Issuer field tests', function (hooks) {
+        hooks.beforeEach(function () {
+          this.id = `azure-${this.uid}`;
+          this.displayName = 'Azure';
+          this.type = 'azure';
+          this.form = this.getForm('azure', {}, { isNew: true });
+        });
+        test('if issuer API error and user changes issuer value, shows specific warning message', async function (assert) {
+          await this.renderComponent();
+          await click(SES.wif.accessType('wif'));
+          await fillIn(GENERAL.inputByAttr('issuer'), 'http://change.me.no.read');
+          await click(GENERAL.submitButton);
+          assert
+            .dom(SES.wif.issuerWarningMessage)
+            .hasText(
+              `You are updating the global issuer config. This will overwrite Vault's current issuer if it exists and may affect other configurations using this value. Continue?`,
+              'modal shows message about overwriting value if it exists'
+            );
+        });
+
+        test('it shows placeholder issuer, and does not call APIs on canceling out of issuer modal', async function (assert) {
+          this.server.post('/identity/oidc/config', () => {
+            throw new Error(
+              'Request was made to post the identity/oidc/config when it should not have been because user canceled out of the modal.'
+            );
+          });
+          this.server.post(configUrl('azure', this.id), () => {
+            throw new Error(
+              `Request was made to post the config when it should not have been because the user canceled out of the flow.`
+            );
+          });
+
+          await this.renderComponent();
+          await click(SES.wif.accessType('wif'));
+          assert
+            .dom(GENERAL.inputByAttr('issuer'))
+            .hasAttribute('placeholder', 'https://vault-test.com', 'shows issuer placeholder');
+          assert.dom(GENERAL.inputByAttr('issuer')).hasValue('', 'shows issuer is empty when not passed');
+          await fillIn(GENERAL.inputByAttr('issuer'), 'http://bar.foo');
+          await click(GENERAL.submitButton);
+          assert.dom(SES.wif.issuerWarningMessage).exists('issuer modal exists');
+          assert
+            .dom(SES.wif.issuerWarningMessage)
+            .hasText(
+              `You are updating the global issuer config. This will overwrite Vault's current issuer if it exists and may affect other configurations using this value. Continue?`,
+              'modal shows message about overwriting value without the noRead: "if it exists" adage'
+            );
+          await click(SES.wif.issuerWarningCancel);
+          assert.dom(SES.wif.issuerWarningMessage).doesNotExist('issuer modal is removed on cancel');
+          assert.true(this.flashDangerSpy.notCalled, 'No danger flash messages called.');
+          assert.true(this.flashSuccessSpy.notCalled, 'No success flash messages called.');
+          assert.true(this.transitionStub.notCalled, 'Does not redirect');
+        });
+
+        test('it shows modal when updating issuer and calls correct APIs on save', async function (assert) {
+          const newIssuer = `http://bar.${uuidv4()}`;
+          this.server.post('/identity/oidc/config', (schema, req) => {
+            const payload = JSON.parse(req.requestBody);
+            assert.deepEqual(payload, { issuer: newIssuer }, 'payload for issuer is correct');
+            return {
+              id: 'identity-oidc-config', // id needs to match the id on secret-engine-helpers createIssuerConfig
+              data: null,
+              warnings: [
+                'If "issuer" is set explicitly, all tokens must be validated against that address, including those issued by secondary clusters. Setting issuer to "" will restore the default behavior of using the cluster\'s api_addr as the issuer.',
+              ],
+            };
+          });
+          this.server.post(configUrl('azure', this.id), () => {
+            assert.true(true, 'post request was made to azure config');
+            return {};
+          });
+
+          await this.renderComponent();
+          await click(SES.wif.accessType('wif'));
+          assert.dom(GENERAL.inputByAttr('issuer')).hasValue('', 'issuer defaults to empty string');
+          await fillIn(GENERAL.inputByAttr('issuer'), newIssuer);
+          await click(GENERAL.submitButton);
+          assert.dom(SES.wif.issuerWarningMessage).exists('issuer warning modal exists');
+
+          await click(SES.wif.issuerWarningSave);
+          assert.true(this.flashDangerSpy.notCalled, 'No danger flash messages called.');
+          assert.true(
+            this.transitionStub.calledWith('vault.cluster.secrets.backend.configuration', this.id),
+            'Transitioned to the configuration index route.'
+          );
+        });
+
+        test('shows modal when modifying the issuer, has correct payload, and shows flash message on fail', async function (assert) {
+          assert.expect(7);
+          this.server.post(configUrl('azure', this.id), () => {
+            assert.true(
+              true,
+              'post request was made to azure config when unsetting the issuer. test should pass.'
+            );
+          });
+          this.server.post('/identity/oidc/config', (_, req) => {
+            const payload = JSON.parse(req.requestBody);
+            assert.deepEqual(payload, { issuer: 'http://foo.bar' }, 'correctly sets the issuer');
+            return overrideResponse(403);
+          });
+
+          await this.renderComponent();
+          await click(SES.wif.accessType('wif'));
+          assert.dom(GENERAL.inputByAttr('issuer')).hasValue('');
+
+          await fillIn(GENERAL.inputByAttr('issuer'), 'http://foo.bar');
+          await fillIn(GENERAL.inputByAttr('identity_token_audience'), 'some-value');
+          await click(GENERAL.submitButton);
+          assert.dom(SES.wif.issuerWarningMessage).exists('issuer warning modal exists');
+          await click(SES.wif.issuerWarningSave);
+
+          assert.true(
+            this.flashDangerSpy.calledWith('Issuer was not saved: permission denied'),
+            'shows danger flash for issuer save'
+          );
+          assert.true(
+            this.flashSuccessSpy.calledWith(`Successfully saved ${this.id}'s configuration.`),
+            "calls the config flash message not the issuer's"
+          );
+          assert.true(
+            this.transitionStub.calledWith('vault.cluster.secrets.backend.configuration', this.id),
+            'Transitioned to the configuration index route.'
+          );
+        });
+
+        test('it does not clear global issuer when toggling accessType', async function (assert) {
+          this.form = this.getForm('azure', { issuer: 'issuer' }, { isNew: true });
+
+          await this.renderComponent();
+          await click(SES.wif.accessType('wif'));
+          assert
+            .dom(GENERAL.inputByAttr('issuer'))
+            .hasValue(this.form.issuer, 'issuer is what is sent in by the model on first load');
+          await fillIn(GENERAL.inputByAttr('issuer'), 'http://ive-changed');
+          await click(SES.wif.accessType('azure'));
+          await click(SES.wif.accessType('wif'));
+          assert
+            .dom(GENERAL.inputByAttr('issuer'))
+            .hasValue(
+              this.form.issuer,
+              'issuer value is still the same global value after toggling accessType'
+            );
+        });
+      });
+    });
+
+    module('Community', function (hooks) {
+      hooks.beforeEach(function () {
+        this.version.type = 'community';
+      });
+
+      for (const type of WIF_ENGINES) {
+        test(`${type}: it renders fields`, async function (assert) {
+          this.id = `${type}-${this.uid}`;
+          this.displayName = engineDisplayData(type).displayName;
+          this.form = this.getForm(type, {}, { isNew: true });
+          this.type = type;
+
+          await this.renderComponent();
+          assert.dom(SES.configureForm).exists(`lands on the ${type} configuration form`);
+          assert
+            .dom(SES.wif.accessTypeSection)
+            .doesNotExist('Access type section does not render for a community user');
+
+          let toggleGroup = GENERAL.button('More options');
+          if (type === 'aws') {
+            toggleGroup = GENERAL.button('Root config options');
+          }
+          await click(toggleGroup);
+
+          // check all the form fields are present
+          for (const key of expectedConfigKeys(type, true)) {
+            if (key === 'config_ttl' || key === 'maxTtl') {
+              assert
+                .dom(GENERAL.ttl.toggle(key === 'config_ttl' ? 'Config TTL' : 'Max TTL'))
+                .exists(`${key} shows for ${type} account access section.`);
+            } else {
+              assert.dom(GENERAL.inputByAttr(key)).exists(`${key} shows for ${type} account access section.`);
+            }
+          }
+          assert.dom(GENERAL.inputByAttr('issuer')).doesNotExist();
+        });
+      }
+    });
+  });
+
+  module('Edit view', function () {
+    module('Enterprise', function (hooks) {
+      hooks.beforeEach(function () {
+        this.version.type = 'enterprise';
+      });
+      for (const type of WIF_ENGINES) {
+        test(`${type}: it defaults to WIF accessType if WIF fields are already set`, async function (assert) {
+          this.id = `${type}-${this.uid}`;
+          this.displayName = engineDisplayData(type).displayName;
+          const config = createConfig(`${type}-wif`);
+          this.form = this.getForm(type, config);
+          this.type = type;
+
+          await this.renderComponent();
+          assert.dom(SES.wif.accessType('wif')).isChecked('WIF accessType is checked');
+          assert.dom(SES.wif.accessType('wif')).isDisabled('WIF accessType is disabled');
+          assert.dom(SES.wif.accessType(type)).isNotChecked(`${type} accessType is not checked`);
+          assert.dom(SES.wif.accessType(type)).isDisabled(`${type} accessType is disabled`);
+          assert
+            .dom(GENERAL.inputByAttr('identity_token_audience'))
+            .hasValue(this.form.identity_token_audience);
+          assert
+            .dom(SES.wif.accessTypeSubtext)
+            .hasText('You cannot edit Access Type if you have already saved access credentials.');
+          assert.dom(GENERAL.ttl.input('Identity token TTL')).hasValue('2'); // 7200 on payload is 2hrs in ttl picker
+        });
+      }
+
+      for (const type of WIF_ENGINES) {
+        test(`${type}: it renders issuer if global issuer is already set`, async function (assert) {
+          this.id = `${type}-${this.uid}`;
+          this.displayName = engineDisplayData(type).displayName;
+          this.issuer = 'https://foo-bar-blah.com';
+          const config = createConfig(`${type}-wif`);
+          this.form = this.getForm(type, { ...config, issuer: this.issuer });
+          this.type = type;
+
+          await this.renderComponent();
+
+          assert.dom(SES.wif.accessType('wif')).isChecked('WIF accessType is checked');
+          assert.dom(SES.wif.accessType('wif')).isDisabled('WIF accessType is disabled');
+          assert
+            .dom(GENERAL.inputByAttr('issuer'))
+            .hasValue(this.issuer, `it has the global issuer value of ${this.issuer}`);
+        });
+      }
+
+      module('Azure specific', function (hooks) {
+        // "client_secret" is the only mutually exclusive Azure account attr and it's never returned from the API. Thus, we can only check for the presence of configured wif fields to determine if the accessType should be preselected to wif and disabled.
+        hooks.beforeEach(function () {
+          this.id = `azure-${this.uid}`;
+          this.displayName = 'Azure';
+          this.type = 'azure';
+          const config = createConfig('azure');
+          this.form = this.getForm('azure', config);
+        });
+
+        test('it allows you to change access type if no wif fields are set', async function (assert) {
+          await this.renderComponent();
+
+          assert.dom(SES.wif.accessType('azure')).isChecked('Azure accessType is checked');
+          assert
+            .dom(SES.wif.accessType('azure'))
+            .isNotDisabled(
+              'Azure accessType is not disabled because we cannot determine if client secret was set as it is not returned by the api.'
+            );
+          assert.dom(SES.wif.accessType('wif')).isNotChecked('WIF accessType is not checked');
+          assert.dom(SES.wif.accessType('wif')).isNotDisabled('WIF accessType is disabled');
+          assert
+            .dom(SES.wif.accessTypeSubtext)
+            .hasText(
+              'Choose the way to configure access to Azure. Access can be configured either using Azure account credentials or with the Plugin Workload Identity Federation (WIF).'
+            );
+        });
+
+        test('it sets access type to wif if wif fields are set', async function (assert) {
+          const config = createConfig('azure-wif');
+          this.form = this.getForm('azure', config);
+
+          await this.renderComponent();
+
+          assert.dom(SES.wif.accessType('wif')).isChecked('WIF accessType is checked');
+          assert
+            .dom(SES.wif.accessType('azure'))
+            .isDisabled('Azure accessType IS disabled because wif attributes are set.');
+
+          assert
+            .dom(SES.wif.accessTypeSubtext)
+            .hasText('You cannot edit Access Type if you have already saved access credentials.');
+        });
+
+        test('it shows previously saved config information', async function (assert) {
+          this.id = `azure-${this.uid}`;
+          const config = createConfig('azure-generic');
+          this.form = this.getForm('azure', config);
+
+          await this.renderComponent();
+          assert.dom(GENERAL.inputByAttr('subscription_id')).hasValue(this.form.subscription_id);
+          assert.dom(GENERAL.inputByAttr('client_id')).hasValue(this.form.client_id);
+          assert.dom(GENERAL.inputByAttr('tenant_id')).hasValue(this.form.tenant_id);
+          assert
+            .dom(GENERAL.inputByAttr('client_secret'))
+            .hasValue('**********', 'client_secret is masked on edit the value');
+        });
+
+        test('it requires a double click to change the client secret', async function (assert) {
+          this.id = `azure-${this.uid}`;
+          await this.renderComponent();
+
+          this.server.post(configUrl('azure', this.id), (schema, req) => {
+            const payload = JSON.parse(req.requestBody);
+            assert.strictEqual(
+              payload.client_secret,
+              'new-secret',
+              'post request was made to azure/config with the updated client_secret.'
+            );
+          });
+
+          await click(GENERAL.enableField('client_secret'));
+          await click(GENERAL.button('toggle-masked'));
+          await fillIn(GENERAL.inputByAttr('client_secret'), 'new-secret');
+          await click(GENERAL.submitButton);
+        });
+      });
+
+      module('AWS specific', function (hooks) {
+        hooks.beforeEach(function () {
+          this.id = `aws-${this.uid}`;
+          this.type = 'aws';
+          this.displayName = 'AWS';
+          const config = createConfig('aws');
+          this.form = this.getForm('aws', config);
+        });
+
+        test('it defaults to IAM accessType if IAM fields are already set', async function (assert) {
+          await this.renderComponent();
+          assert.dom(SES.wif.accessType('aws')).isChecked('IAM accessType is checked');
+          assert.dom(SES.wif.accessType('aws')).isDisabled('IAM accessType is disabled');
+          assert.dom(SES.wif.accessType('wif')).isNotChecked('WIF accessType is not checked');
+          assert.dom(SES.wif.accessType('wif')).isDisabled('WIF accessType is disabled');
+          assert
+            .dom(SES.wif.accessTypeSubtext)
+            .hasText('You cannot edit Access Type if you have already saved access credentials.');
+        });
+
+        test('it allows you to change access type if record does not have wif or iam values already set', async function (assert) {
+          const config = createConfig('aws-no-access');
+          this.form = this.getForm('aws', config);
+
+          await this.renderComponent();
+          assert.dom(SES.wif.accessType('wif')).isNotDisabled('WIF accessType is NOT disabled');
+          assert.dom(SES.wif.accessType('aws')).isNotDisabled('IAM accessType is NOT disabled');
+        });
+
+        test('it shows previously saved root and lease information', async function (assert) {
+          const config = { ...createConfig('aws'), ...createConfig('aws-lease') };
+          this.form = this.getForm('aws', config);
+
+          await this.renderComponent();
+
+          assert.dom(GENERAL.inputByAttr('access_key')).hasValue(this.form.access_key);
+          assert
+            .dom(GENERAL.inputByAttr('secret_key'))
+            .hasValue('**********', 'secret_key is masked on edit the value');
+
+          await click(GENERAL.button('Root config options'));
+          assert.dom(GENERAL.inputByAttr('region')).hasValue(this.form.region);
+          assert.dom(GENERAL.inputByAttr('iam_endpoint')).hasValue(this.form.iam_endpoint);
+          assert.dom(GENERAL.inputByAttr('sts_endpoint')).hasValue(this.form.sts_endpoint);
+          assert.dom(GENERAL.inputByAttr('max_retries')).hasValue('1');
+          // Check lease config values
+          assert.dom(GENERAL.ttl.input('Default Lease TTL')).hasValue('50');
+          assert.dom(GENERAL.ttl.input('Max Lease TTL')).hasValue('55');
+        });
+
+        test('it requires a double click to change the secret key', async function (assert) {
+          this.server.post(configUrl('aws', this.id), (schema, req) => {
+            const payload = JSON.parse(req.requestBody);
+            assert.strictEqual(
+              payload.secret_key,
+              'new-secret',
+              'post request was made to config/root with the updated secret_key.'
+            );
+          });
+
+          await this.renderComponent();
+          await click(GENERAL.enableField('secret_key'));
+          await click(GENERAL.button('toggle-masked'));
+          await fillIn(GENERAL.inputByAttr('secret_key'), 'new-secret');
+          await click(GENERAL.submitButton);
+        });
+      });
+
+      module('GCP specific', function (hooks) {
+        // "credentials" is the only mutually exclusive GCP account attr and it's never returned from the API. Thus, we can only check for the presence of configured wif fields to determine if the accessType should be preselected to wif and disabled.
+        // If the user has configured the credentials field, the ui will not know until the user tries to save WIF fields. This is a limitation of the API and surfaced to the user in a descriptive API error.
+        // We cover some of this workflow here and error testing in the gcp-configuration acceptance test.
+        hooks.beforeEach(function () {
+          this.id = `gcp-${this.uid}`;
+          const config = createConfig('gcp');
+          this.form = this.getForm('gcp', config);
+          this.type = 'gcp';
+          this.displayName = 'Google Cloud';
+        });
+        test('it allows you to change access type if no wif fields are set', async function (assert) {
+          await this.renderComponent();
+
+          assert.dom(SES.wif.accessType('gcp')).isChecked('GCP accessType is checked');
+          assert
+            .dom(SES.wif.accessType('gcp'))
+            .isNotDisabled(
+              'GCP accessType is not disabled because we cannot determine if credentials was set as it is not returned by the api.'
+            );
+          assert.dom(SES.wif.accessType('wif')).isNotChecked('WIF accessType is not checked');
+          assert.dom(SES.wif.accessType('wif')).isNotDisabled('WIF accessType is not disabled');
+          assert
+            .dom(SES.wif.accessTypeSubtext)
+            .hasText(
+              'Choose the way to configure access to Google Cloud. Access can be configured either using Google Cloud account credentials or with the Plugin Workload Identity Federation (WIF).'
+            );
+        });
+
+        test('it sets access type to wif if wif fields are set', async function (assert) {
+          const config = createConfig('gcp-wif');
+          this.form = this.getForm('gcp', config);
+
+          await this.renderComponent();
+
+          assert.dom(SES.wif.accessType('wif')).isChecked('WIF accessType is checked');
+          assert
+            .dom(SES.wif.accessType('gcp'))
+            .isDisabled('GCP accessType IS disabled because wif attributes are set.');
+
+          assert
+            .dom(SES.wif.accessTypeSubtext)
+            .hasText('You cannot edit Access Type if you have already saved access credentials.');
+        });
+
+        test('it shows previously saved config information', async function (assert) {
+          const config = createConfig('gcp-generic');
+          this.form = this.getForm('gcp', config);
+          await this.renderComponent();
+          await click(GENERAL.button('More options'));
+          assert.dom(GENERAL.ttl.input('Config TTL')).hasValue('100');
+          assert.dom(GENERAL.ttl.input('Max TTL')).hasValue('101');
+        });
+      });
+    });
+
+    module('Community', function (hooks) {
+      hooks.beforeEach(function () {
+        this.version.type = 'community';
+      });
+      for (const type of WIF_ENGINES) {
+        test(`${type}:it does not show access type but defaults to type "account" fields`, async function (assert) {
+          this.id = `${type}-${this.uid}`;
+          const config = createConfig(`${type}-generic`);
+          this.form = this.getForm(type, config);
+          this.displayName = engineDisplayData(type).displayName;
+          this.type = type;
+
+          await this.renderComponent();
+          assert.dom(SES.wif.accessTypeSection).doesNotExist('Access type section does not render');
+
+          let toggleGroup = GENERAL.button('More options');
+          if (type === 'aws') {
+            toggleGroup = GENERAL.button('Root config options');
+          }
+          await click(toggleGroup);
+
+          for (const key of expectedConfigKeys(type, true)) {
+            if (key === 'secret_key' || key === 'client_secret' || key === 'credentials') return; // these keys are not returned by the API
+            // same issues noted in wif enterprise tests with how toggle.hbs passes in name vs how formField input passes in attr to data test selector
+            if (key === 'config_ttl') {
+              assert
+                .dom(GENERAL.ttl.input('Config TTL'))
+                .hasValue('100', `${key} for ${type}: has the expected value set on the config`);
+            } else if (key === 'max_ttl') {
+              assert
+                .dom(GENERAL.ttl.input('Max TTL'))
+                .hasValue('101', `${key} for ${type}: has the expected value set on the config`);
+            } else if (key === 'root_password_ttl') {
+              assert
+                .dom(GENERAL.ttl.input('Root password TTL'))
+                .hasValue('500', `${key} for ${type}: has the expected value set on the config`);
+            } else {
+              assert
+                .dom(GENERAL.inputByAttr(key))
+                .hasValue(this.form[key], `${key} for ${type}: has the expected value set on the config`);
+            }
+          }
+        });
+      }
+    });
+  });
+});
diff --git a/ui/tests/integration/components/secret-engine/page/general-setting-test.js b/ui/tests/integration/components/secret-engine/page/general-setting-test.js
new file mode 100644
index 00000000000..c7039ca44fa
--- /dev/null
+++ b/ui/tests/integration/components/secret-engine/page/general-setting-test.js
@@ -0,0 +1,65 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+const keyManagementMockModel = {
+  secretsEngine: {
+    accessor: 'keymgmt_accessor',
+    config: {
+      default_lease_ttl: 2073600,
+      force_no_cache: false,
+      listing_visibility: 'hidden',
+      max_lease_ttl: 4320000,
+    },
+    description: 'hello',
+    external_entropy_access: false,
+    local: true,
+    options: {},
+    path: 'keymgmt/',
+    plugin_version: '',
+    running_plugin_version: 'v0.17.1+builtin',
+    running_sha256: '',
+    seal_wrap: false,
+    type: 'keymgmt',
+    uuid: '4ea92618-5b52-f89a-9cbe-b65dc7e65689',
+    id: 'keymgmt',
+    backendConfigurationLink: `vault.cluster.secrets.backend.configuration`,
+  },
+  versions: ['v0.17.1+builtin'],
+};
+
+module('Integration | Component | SecretEngine::Page::GeneralSettings', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.model = keyManagementMockModel;
+    this.breadcrumbs = [
+      { label: 'Secrets', route: 'vault.cluster.secrets' },
+      {
+        label: this.model.secretsEngine.id,
+        route: 'vault.cluster.secrets.backend.list-root',
+        model: this.model.secretsEngine.id,
+      },
+      { label: 'Configuration' },
+    ];
+  });
+
+  test('it shows general settings form', async function (assert) {
+    assert.expect(4);
+
+    await render(hbs`
+      <SecretEngine::Page::GeneralSettings @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
+    `);
+    assert.dom(GENERAL.cardContainer('secrets duration')).exists(`Lease duration card exists`);
+    assert.dom(GENERAL.cardContainer('security')).exists(`Security card exists`);
+    assert.dom(GENERAL.cardContainer('version')).exists(`Version card exists`);
+    assert.dom(GENERAL.cardContainer('metadata')).exists(`Metadata card exists`);
+  });
+});
diff --git a/ui/tests/integration/components/secret-engine/page/plugin-settings-test.js b/ui/tests/integration/components/secret-engine/page/plugin-settings-test.js
new file mode 100644
index 00000000000..abf9d3399a9
--- /dev/null
+++ b/ui/tests/integration/components/secret-engine/page/plugin-settings-test.js
@@ -0,0 +1,146 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+
+import {
+  expectedConfigKeys,
+  expectedValueOfConfigKeys,
+} from 'vault/tests/helpers/secret-engine/secret-engine-helpers';
+import { ALL_ENGINES } from 'vault/utils/all-engines-metadata';
+
+module('Integration | Component | SecretEngine::Page::PluginSettings', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.models = {
+      keymgmt: {
+        secretsEngine: {
+          type: 'keymgmt',
+        },
+        config: null,
+      },
+      aws: {
+        secretsEngine: {
+          type: 'aws',
+        },
+        config: {
+          region: 'us-west-2',
+          access_key: '123-key',
+          iam_endpoint: 'iam-endpoint',
+          sts_endpoint: 'sts-endpoint',
+          max_retries: 1,
+        },
+      },
+      azure: {
+        secretsEngine: {
+          type: 'azure',
+        },
+        config: {
+          client_secret: 'client-secret',
+          subscription_id: 'subscription-id',
+          tenant_id: 'tenant-id',
+          client_id: 'client-id',
+          root_password_ttl: '1800000s',
+          environment: 'AZUREPUBLICCLOUD',
+        },
+      },
+      gcp: {
+        secretsEngine: {
+          type: 'gcp',
+        },
+        config: {
+          credentials: '{"some-key":"some-value"}',
+          ttl: '100s',
+          max_ttl: '101s',
+        },
+      },
+      ssh: {
+        secretsEngine: {
+          type: 'ssh',
+        },
+        config: {
+          public_key: 'public-key',
+          generate_signing_key: true,
+        },
+      },
+    };
+  });
+
+  test('it shows empty state when the engine is not configurable', async function (assert) {
+    assert.expect(2);
+    this.model = this.models['keymgmt'];
+    this.breadcrumbs = [
+      { label: 'Secrets', route: 'vault.cluster.secrets' },
+      {
+        label: this.model.secretsEngine.id,
+        route: 'vault.cluster.secrets.backend.list-root',
+        model: this.model.secretsEngine.id,
+      },
+      { label: 'Configuration' },
+    ];
+    await render(hbs`
+      <SecretEngine::Page::PluginSettings @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />
+    `);
+    assert.dom(GENERAL.emptyStateTitle).hasText(`No configuration details available`);
+    assert
+      .dom(GENERAL.emptyStateMessage)
+      .hasText(
+        `Key Management does not have any plugin specific configuration. All configurable parameters for this engine are under 'General Settings'.`
+      );
+  });
+
+  for (const type of ALL_ENGINES.filter((engine) => engine.isConfigurable ?? false).map(
+    (engine) => engine.type
+  )) {
+    test(`${type}: it shows config details if configModel(s) are passed in`, async function (assert) {
+      this.model = this.models[type];
+      this.breadcrumbs = [
+        { label: 'Secrets', route: 'vault.cluster.secrets' },
+        {
+          label: this.model.secretsEngine.id,
+          route: 'vault.cluster.secrets.backend.list-root',
+          model: this.model.secretsEngine.id,
+        },
+        { label: 'Configuration' },
+      ];
+      await render(
+        hbs`<SecretEngine::Page::PluginSettings @model={{this.model}} @breadcrumbs={{this.breadcrumbs}} />`
+      );
+
+      for (const key of expectedConfigKeys(type)) {
+        if (
+          key === 'Secret key' ||
+          key === 'Client secret' ||
+          key === 'Private key' ||
+          key === 'Credentials'
+        ) {
+          // these keys are not returned by the API and should not show on the details page
+          assert
+            .dom(GENERAL.infoRowLabel(key))
+            .doesNotExist(`${key} on the ${type} config details does NOT exists.`);
+        } else {
+          // check the label appears
+          assert.dom(GENERAL.infoRowLabel(key)).exists(`${key} on the ${type} config details exists.`);
+          const responseKeyAndValue = expectedValueOfConfigKeys(type, key);
+          // check the value appears
+          assert
+            .dom(GENERAL.infoRowValue(key))
+            .hasText(responseKeyAndValue, `${key} value for the ${type} config details exists.`);
+          // make sure the values that should be masked are masked, and others are not.
+          if (key === 'Public Key') {
+            assert.dom(GENERAL.infoRowValue(key)).hasClass('masked-input', `${key} is masked`);
+          } else {
+            assert.dom(GENERAL.infoRowValue(key)).doesNotHaveClass('masked-input', `${key} is not masked`);
+          }
+        }
+      }
+    });
+  }
+});
diff --git a/ui/tests/integration/components/secret-engine/ttl-picker-v2-test.js b/ui/tests/integration/components/secret-engine/ttl-picker-v2-test.js
new file mode 100644
index 00000000000..ded8bce164c
--- /dev/null
+++ b/ui/tests/integration/components/secret-engine/ttl-picker-v2-test.js
@@ -0,0 +1,61 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render, fillIn } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { keyMgmtMockModel } from 'vault/tests/helpers/secret-engine/mocks';
+
+module('Integration | Component | SecretEngine::TtlPickerV2', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.model = keyMgmtMockModel;
+  });
+
+  test('it shows default ttl picker', async function (assert) {
+    assert.expect(4);
+    this.ttlKey = 'default_lease_ttl';
+    await render(hbs`
+      <SecretEngine::TtlPickerV2 @model={{this.model}} @ttlKey={{this.ttlKey}} />
+    `);
+    assert.dom(GENERAL.fieldLabelbyAttr(this.ttlKey)).hasText('Default time-to-live (TTL)');
+    assert.dom(GENERAL.helpTextByAttr(this.ttlKey)).hasText('How long secrets in this engine stay valid.');
+    await fillIn(GENERAL.inputByAttr(this.ttlKey), 5);
+    await fillIn(GENERAL.selectByAttr(this.ttlKey), 'm');
+    assert.dom(GENERAL.inputByAttr(this.ttlKey)).hasValue('5');
+    assert.dom(GENERAL.selectByAttr(this.ttlKey)).hasValue('m');
+  });
+
+  test('it shows max ttl picker', async function (assert) {
+    assert.expect(4);
+    this.ttlKey = 'max_lease_duration';
+    await render(hbs`
+      <SecretEngine::TtlPickerV2 @model={{this.model}} @ttlKey={{this.ttlKey}} />
+    `);
+    assert.dom(GENERAL.fieldLabelbyAttr(this.ttlKey)).hasText('Maximum time-to-live (TTL)');
+    assert
+      .dom(GENERAL.helpTextByAttr(this.ttlKey))
+      .hasText('Maximum extension for the secrets life beyond default.');
+    await fillIn(GENERAL.inputByAttr(this.ttlKey), 10);
+    await fillIn(GENERAL.selectByAttr(this.ttlKey), 'm');
+    assert.dom(GENERAL.inputByAttr(this.ttlKey)).hasValue('10');
+    assert.dom(GENERAL.selectByAttr(this.ttlKey)).hasValue('m');
+  });
+
+  test('it shows an error message if ttl picker time is not a number value', async function (assert) {
+    assert.expect(2);
+    this.ttlKey = 'max_lease_duration';
+    await render(hbs`
+      <SecretEngine::TtlPickerV2 @model={{this.model}} @ttlKey={{this.ttlKey}} />
+    `);
+    await fillIn(GENERAL.inputByAttr(this.ttlKey), 'some text');
+    await fillIn(GENERAL.selectByAttr(this.ttlKey), 'm');
+    assert.dom(GENERAL.messageError).exists();
+    assert.dom(GENERAL.messageError).hasText('Only use numbers for this setting.');
+  });
+});
diff --git a/ui/tests/integration/components/secret-engines/catalog-test.js b/ui/tests/integration/components/secret-engines/catalog-test.js
new file mode 100644
index 00000000000..9d79ac538ab
--- /dev/null
+++ b/ui/tests/integration/components/secret-engines/catalog-test.js
@@ -0,0 +1,139 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render, click } from '@ember/test-helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { filterEnginesByMountCategory } from 'vault/utils/all-engines-metadata';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+import hbs from 'htmlbars-inline-precompile';
+import sinon from 'sinon';
+
+module('Integration | Component | secret-engines/catalog', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.setMountType = sinon.spy();
+    this.pluginCatalogData = null;
+    this.pluginCatalogError = false;
+  });
+
+  test('it renders secret engines catalog', async function (assert) {
+    const expectedEngines = filterEnginesByMountCategory({
+      mountCategory: 'secret',
+      isEnterprise: false,
+    }).filter((engine) => engine.type !== 'cubbyhole');
+
+    // Dynamic assertion count: 1 for title + number of engines
+    assert.expect(1 + expectedEngines.length);
+
+    await render(
+      hbs`<SecretEngines::Catalog 
+        @setMountType={{this.setMountType}} 
+        @pluginCatalogData={{this.pluginCatalogData}} 
+        @pluginCatalogError={{this.pluginCatalogError}} 
+      />`
+    );
+
+    assert.dom(GENERAL.breadcrumbs).exists('renders breadcrumbs');
+
+    for (const engine of expectedEngines) {
+      assert.dom(GENERAL.cardContainer(engine.type)).exists(`renders ${engine.displayName} engine card`);
+    }
+  });
+
+  test('it calls setMountType when engine is selected', async function (assert) {
+    await render(
+      hbs`<SecretEngines::Catalog 
+        @setMountType={{this.setMountType}} 
+        @pluginCatalogData={{this.pluginCatalogData}} 
+        @pluginCatalogError={{this.pluginCatalogError}} 
+      />`
+    );
+
+    await click(GENERAL.cardContainer('kv'));
+
+    assert.true(this.setMountType.calledOnce, 'setMountType was called');
+    assert.true(this.setMountType.calledWith('kv'), 'setMountType was called with kv');
+  });
+
+  test('it shows plugin catalog error when provided', async function (assert) {
+    this.pluginCatalogError = true;
+
+    await render(
+      hbs`<SecretEngines::Catalog 
+        @setMountType={{this.setMountType}} 
+        @pluginCatalogData={{this.pluginCatalogData}} 
+        @pluginCatalogError={{this.pluginCatalogError}} 
+      />`
+    );
+
+    assert.dom(GENERAL.inlineAlert).exists('shows plugin catalog error alert');
+    assert
+      .dom(GENERAL.inlineAlert)
+      .hasText(
+        'Plugin information unavailable Unable to fetch current plugin information. Using static plugin data instead. Some plugins may not show current details.',
+        'shows correct error title'
+      );
+  });
+
+  test('it shows flyout when clicking disabled plugin', async function (assert) {
+    // Set up plugin catalog data that creates both enabled and disabled engines
+    // An engine is disabled when it's not found in the plugin catalog detailed array
+    this.pluginCatalogData = {
+      detailed: [
+        // Include only some engines, leaving others as "disabled"
+        {
+          name: 'kv',
+          type: 'secret',
+          builtin: true,
+          deprecation_status: 'supported',
+          version: 'v1.0.0',
+        },
+        // AWS engine is NOT included, so it will be marked as isAvailable: false
+      ],
+    };
+
+    await render(
+      hbs`<SecretEngines::Catalog 
+        @setMountType={{this.setMountType}} 
+        @pluginCatalogData={{this.pluginCatalogData}} 
+        @pluginCatalogError={{this.pluginCatalogError}} 
+      />`
+    );
+
+    // Initially, flyout should not be visible
+    assert.dom(GENERAL.flyout).doesNotExist('flyout is not shown initially');
+
+    // Find a disabled plugin card - since AWS is not in our catalog data,
+    // it should be rendered as disabled
+    const awsCard = document.querySelector(GENERAL.cardContainer('aws'));
+
+    // Look for any disabled cards regardless of AWS card presence
+    const disabledCards = document.querySelectorAll(
+      '.selectable-engine-card.disabled, .selectable-engine-card[style*="opacity"]'
+    );
+
+    let clickedCard = false;
+
+    if (awsCard) {
+      await click(awsCard);
+      clickedCard = true;
+
+      // After clicking disabled plugin, flyout should appear
+      assert.dom(GENERAL.flyout).exists('flyout appears after clicking disabled plugin');
+    } else if (disabledCards.length > 0) {
+      await click(disabledCards[0]);
+      clickedCard = true;
+      assert.dom(GENERAL.flyout).exists('flyout appears after clicking any disabled plugin');
+    }
+
+    // Always verify we completed the test successfully
+    assert.ok(clickedCard, 'successfully clicked a disabled plugin card');
+  });
+});
diff --git a/ui/tests/integration/components/secret-list-header-test.js b/ui/tests/integration/components/secret-list-header-test.js
index da4340a3b05..d05cd67043c 100644
--- a/ui/tests/integration/components/secret-list-header-test.js
+++ b/ui/tests/integration/components/secret-list-header-test.js
@@ -1,15 +1,25 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render } from '@ember/test-helpers';
+import { getContext, render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { supportedSecretBackends } from 'vault/helpers/supported-secret-backends';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import mirageToModels from 'vault/tests/helpers/mirage-to-models';
+
+const mirageToModels = (data) => {
+  const context = getContext();
+  const store = context.owner.lookup('service:store');
+  const modelName = Array.isArray(data) ? data[0].modelName : data.modelName;
+  const json = context.server.serializerOrRegistry.serialize(data);
+  store.push(json);
+  return Array.isArray(data)
+    ? data.map(({ id }) => store.peekRecord(modelName, id))
+    : store.peekRecord(modelName, data.id);
+};
 
 module('Integration | Component | secret-list-header', function (hooks) {
   setupRenderingTest(hooks);
diff --git a/ui/tests/integration/components/secrets-engine-mount-config-test.js b/ui/tests/integration/components/secrets-engine-mount-config-test.js
index 6e947989e78..9359b00d0ee 100644
--- a/ui/tests/integration/components/secrets-engine-mount-config-test.js
+++ b/ui/tests/integration/components/secrets-engine-mount-config-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,38 +7,34 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import SecretsEngineResource from 'vault/resources/secrets/engine';
 
 const selectors = {
   toggle: '[data-test-mount-config-toggle]',
   field: '[data-test-mount-config-field]',
-  rowValue: (label) => `[data-test-value-div="${label}"]`,
 };
 
 module('Integration | Component | secrets-engine-mount-config', function (hooks) {
   setupRenderingTest(hooks);
 
   hooks.beforeEach(function () {
-    const store = this.owner.lookup('service:store');
-    store.pushPayload('secret-engine', {
-      modelName: 'secret-engine',
-      data: {
-        path: 'ldap-test/',
-        type: 'ldap',
-        accessor: 'ldap_7e838627',
-        local: false,
-        seal_wrap: true,
-        config: {
-          id: 'foo',
-          default_lease_ttl: 0,
-          max_lease_ttl: 10000,
-        },
+    this.secretsEngine = new SecretsEngineResource({
+      path: 'ldap-test/',
+      type: 'ldap',
+      accessor: 'ldap_7e838627',
+      local: false,
+      seal_wrap: true,
+      config: {
+        id: 'foo',
+        default_lease_ttl: 0,
+        max_lease_ttl: 10000,
       },
     });
-    this.model = store.peekRecord('secret-engine', 'ldap-test');
   });
 
   test('it should toggle config fields visibility', async function (assert) {
-    await render(hbs`<SecretsEngineMountConfig @model={{this.model}} />`);
+    await render(hbs`<SecretsEngineMountConfig @secretsEngine={{this.secretsEngine}} />`);
 
     assert
       .dom(selectors.toggle)
@@ -52,23 +48,25 @@ module('Integration | Component | secrets-engine-mount-config', function (hooks)
   });
 
   test('it should render correct config fields', async function (assert) {
-    await render(hbs`<SecretsEngineMountConfig @model={{this.model}} />`);
+    await render(hbs`<SecretsEngineMountConfig @secretsEngine={{this.secretsEngine}} />`);
     await click(selectors.toggle);
 
     assert
-      .dom(selectors.rowValue('Secret Engine Type'))
-      .hasText(this.model.engineType, 'Secret engine type renders');
-    assert.dom(selectors.rowValue('Path')).hasText(this.model.path, 'Path renders');
-    assert.dom(selectors.rowValue('Accessor')).hasText(this.model.accessor, 'Accessor renders');
-    assert.dom(selectors.rowValue('Local')).includesText('No', 'Local renders');
-    assert.dom(selectors.rowValue('Seal Wrap')).includesText('Yes', 'Seal wrap renders');
-    assert.dom(selectors.rowValue('Default Lease TTL')).includesText('0', 'Default Lease TTL renders');
-    assert.dom(selectors.rowValue('Max Lease TTL')).includesText('10000', 'Max Lease TTL renders');
+      .dom(GENERAL.infoRowValue('Secret engine type'))
+      .hasText(this.secretsEngine.engineType, 'Secret engine type renders');
+    assert.dom(GENERAL.infoRowValue('Path')).hasText(this.secretsEngine.path, 'Path renders');
+    assert.dom(GENERAL.infoRowValue('Accessor')).hasText(this.secretsEngine.accessor, 'Accessor renders');
+    assert.dom(GENERAL.infoRowValue('Local')).includesText('No', 'Local renders');
+    assert.dom(GENERAL.infoRowValue('Seal wrap')).includesText('Yes', 'Seal wrap renders');
+    assert.dom(GENERAL.infoRowValue('Default Lease TTL')).includesText('0', 'Default Lease TTL renders');
+    assert
+      .dom(GENERAL.infoRowValue('Max Lease TTL'))
+      .includesText('2 hours 46 minutes 40 seconds', 'Max Lease TTL renders');
   });
 
   test('it should yield block for additional fields', async function (assert) {
     await render(hbs`
-      <SecretsEngineMountConfig @model={{this.model}}>
+      <SecretsEngineMountConfig @secretsEngine={{this.secretsEngine}}>
         <span data-test-yield>It Yields!</span>
       </SecretsEngineMountConfig>
     `);
diff --git a/ui/tests/integration/components/select-test.js b/ui/tests/integration/components/select-test.js
index 12233991cf6..db3aaf0e738 100644
--- a/ui/tests/integration/components/select-test.js
+++ b/ui/tests/integration/components/select-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/selectable-card-test.js b/ui/tests/integration/components/selectable-card-test.js
index 8cbaf2ce525..9afb78fa26b 100644
--- a/ui/tests/integration/components/selectable-card-test.js
+++ b/ui/tests/integration/components/selectable-card-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -26,4 +26,10 @@ module('Integration | Component selectable-card', function (hooks) {
     await render(hbs`<SelectableCard  @onClick={{this.onClick}}>hello</SelectableCard>`);
     assert.dom('.selectable-card').hasText('hello');
   });
+
+  test('it does not process click event on disabled card', async function (assert) {
+    await render(hbs`<SelectableCard @onClick={{this.onClick}} @disabled={{true}}>disabled</SelectableCard>`);
+    await click('.selectable-card');
+    assert.notOk(this.onClick.calledOnce, 'does not call the click event');
+  });
 });
diff --git a/ui/tests/integration/components/shamir/dr-token-flow-test.js b/ui/tests/integration/components/shamir/dr-token-flow-test.js
index b3a3032e837..ecc198677d2 100644
--- a/ui/tests/integration/components/shamir/dr-token-flow-test.js
+++ b/ui/tests/integration/components/shamir/dr-token-flow-test.js
@@ -1,14 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import sinon from 'sinon';
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
-import { click, fillIn, find, render, waitUntil } from '@ember/test-helpers';
+import { click, fillIn, find, render, waitFor, waitUntil } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | shamir/dr-token-flow', function (hooks) {
   setupRenderingTest(hooks);
@@ -157,7 +159,7 @@ module('Integration | Component | shamir/dr-token-flow', function (hooks) {
     await render(hbs`<Shamir::DrTokenFlow @action="generate-dr-operation-token" />`);
     await click('[data-test-use-pgp-key-cta]');
     assert.dom('[data-test-choose-pgp-key-form="begin"]').exists('PGP form shows');
-    await click('[data-test-text-toggle]');
+    await click(GENERAL.textToggle);
     await fillIn('[data-test-pgp-file-textarea]', 'some-key-here');
     await click('[data-test-use-pgp-key-button]');
     await click('[data-test-confirm-pgp-key-submit]');
@@ -167,6 +169,25 @@ module('Integration | Component | shamir/dr-token-flow', function (hooks) {
     );
   });
 
+  test('it shows error with pgp key', async function (assert) {
+    assert.expect(2);
+    this.server.get('/sys/replication/dr/secondary/generate-operation-token/attempt', function () {
+      return {};
+    });
+    this.server.post('/sys/replication/dr/secondary/generate-operation-token/attempt', () =>
+      overrideResponse(400, { errors: ['error parsing PGP key'] })
+    );
+    await render(hbs`<Shamir::DrTokenFlow @action="generate-dr-operation-token" />`);
+    await click('[data-test-use-pgp-key-cta]');
+    assert.dom('[data-test-choose-pgp-key-form="begin"]').exists('PGP form shows');
+    await click(GENERAL.textToggle);
+    await fillIn('[data-test-pgp-file-textarea]', 'some-key-here');
+    await click('[data-test-use-pgp-key-button]');
+    await click('[data-test-confirm-pgp-key-submit]');
+    await waitFor(GENERAL.messageError);
+    assert.dom(GENERAL.messageError).hasText('Error error parsing PGP key');
+  });
+
   test('it cancels correctly when generation not started', async function (assert) {
     assert.expect(2);
     const cancelSpy = sinon.spy();
diff --git a/ui/tests/integration/components/shamir/flow-test.js b/ui/tests/integration/components/shamir/flow-test.js
index c29d4a401a0..80ce10ab86a 100644
--- a/ui/tests/integration/components/shamir/flow-test.js
+++ b/ui/tests/integration/components/shamir/flow-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -11,7 +11,7 @@ import { hbs } from 'ember-cli-htmlbars';
 import Service from '@ember/service';
 import { run } from '@ember/runloop';
 import { reject, resolve } from 'rsvp';
-import { SHAMIR_FORM } from 'vault/tests/helpers/components/shamir';
+import { SHAMIR_FORM } from 'vault/tests/helpers/components/shamir-selectors';
 
 const licenseError = { httpStatus: 500, errors: ['failed because licensing is in an invalid state'] };
 const response = {
@@ -111,24 +111,4 @@ module('Integration | Component | shamir/flow', function (hooks) {
     assert.ok(completeSpy.notCalled, 'checkComplete was not called');
     assert.ok(updateSpy.notCalled, 'updateProgress was not called');
   });
-
-  test.skip('it throws the error when adapter fails with license error', async function (assert) {
-    assert.expect(2);
-    try {
-      const licenseSpy = sinon.spy();
-      this.set('onLicenseError', licenseSpy);
-      await render(hbs`
-        <Shamir::Flow
-          @action="response-with-license"
-          @threshold={{3}}
-          @progress={{2}}
-          @onLicenseError={{this.onLicenseError}}
-        />`);
-      await fillIn(SHAMIR_FORM.input, this.keyPart);
-      await click(SHAMIR_FORM.submitButton);
-      assert.ok(licenseSpy.calledOnce, 'license error triggered');
-    } catch (e) {
-      assert.deepEqual(e, licenseError, 'throws the error');
-    }
-  });
 });
diff --git a/ui/tests/integration/components/shamir/form-test.js b/ui/tests/integration/components/shamir/form-test.js
index a4886af38f3..fd6b1e76525 100644
--- a/ui/tests/integration/components/shamir/form-test.js
+++ b/ui/tests/integration/components/shamir/form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,7 +8,7 @@ import sinon from 'sinon';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { click, render, settled, typeIn } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { SHAMIR_FORM } from 'vault/tests/helpers/components/shamir';
+import { SHAMIR_FORM } from 'vault/tests/helpers/components/shamir-selectors';
 
 module('Integration | Component | shamir/form', function (hooks) {
   setupRenderingTest(hooks);
diff --git a/ui/tests/integration/components/sidebar/frame-test.js b/ui/tests/integration/components/sidebar/frame-test.js
index 3bae4cc3fdc..9aab331ed2b 100644
--- a/ui/tests/integration/components/sidebar/frame-test.js
+++ b/ui/tests/integration/components/sidebar/frame-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | sidebar-frame', function (hooks) {
   setupRenderingTest(hooks);
@@ -35,7 +36,7 @@ module('Integration | Component | sidebar-frame', function (hooks) {
     assert.dom('[data-test-sidebar-nav]').doesNotExist('Sidebar is hidden');
   });
 
-  test('it should render link status, console ui panel and yield block for app content', async function (assert) {
+  test('it should render link status, console ui panel container and yield block for app content', async function (assert) {
     const currentCluster = this.owner.lookup('service:currentCluster');
     currentCluster.setCluster({ hcpLinkStatus: 'connected' });
     const version = this.owner.lookup('service:version');
@@ -50,7 +51,7 @@ module('Integration | Component | sidebar-frame', function (hooks) {
     `);
 
     assert.dom('[data-test-link-status]').exists('Link status component renders');
-    assert.dom('[data-test-component="console/ui-panel"]').exists('Console UI panel renders');
+    assert.dom('[data-test-console-panel]').exists('Console UI panel container renders');
     assert.dom('.page-container').exists('Block yields for app content');
   });
 
@@ -88,6 +89,6 @@ module('Integration | Component | sidebar-frame', function (hooks) {
       <Sidebar::Frame @showSidebar={{true}} />
     `);
 
-    assert.dom('.namespace-picker').exists('Namespace picker renders in sidebar footer');
+    assert.dom(GENERAL.button('namespace-picker')).exists('Namespace picker renders in sidebar footer');
   });
 });
diff --git a/ui/tests/integration/components/sidebar/nav/access-test.js b/ui/tests/integration/components/sidebar/nav/access-test.js
index efd864ffc61..b16922f3e5c 100644
--- a/ui/tests/integration/components/sidebar/nav/access-test.js
+++ b/ui/tests/integration/components/sidebar/nav/access-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -48,7 +48,7 @@ module('Integration | Component | sidebar-nav-access', function (hooks) {
     });
   });
 
-  test('it should hide links and headings user does not have access too', async function (assert) {
+  test('it should hide links and headings user does not have access to', async function (assert) {
     await renderComponent();
     assert
       .dom('[data-test-sidebar-nav-link]')
diff --git a/ui/tests/integration/components/sidebar/nav/cluster-test.js b/ui/tests/integration/components/sidebar/nav/cluster-test.js
index 079cf1a058b..2cf9bcc25ca 100644
--- a/ui/tests/integration/components/sidebar/nav/cluster-test.js
+++ b/ui/tests/integration/components/sidebar/nav/cluster-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { stubFeaturesAndPermissions } from 'vault/tests/helpers/components/sidebar-nav';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const renderComponent = () => {
   return render(hbs`
@@ -22,6 +23,7 @@ module('Integration | Component | sidebar-nav-cluster', function (hooks) {
   setupRenderingTest(hooks);
 
   hooks.beforeEach(function () {
+    this.flags = this.owner.lookup('service:flags');
     setRunOptions({
       rules: {
         // This is an issue with Hds::SideNav::Header::HomeLink
@@ -47,11 +49,12 @@ module('Integration | Component | sidebar-nav-cluster', function (hooks) {
     });
   });
 
-  test('it should hide links and headings user does not have access too', async function (assert) {
+  test('it should hide links and headings user does not have access to', async function (assert) {
     await renderComponent();
+
     assert
       .dom('[data-test-sidebar-nav-link]')
-      .exists({ count: 3 }, 'Nav links are hidden other than secrets, secrets sync and dashboard');
+      .exists({ count: 3 }, 'Nav links are hidden other than secrets, recovery and dashboard');
     assert
       .dom('[data-test-sidebar-nav-heading]')
       .exists({ count: 1 }, 'Headings are hidden other than Vault');
@@ -62,15 +65,18 @@ module('Integration | Component | sidebar-nav-cluster', function (hooks) {
       'Dashboard',
       'Secrets Engines',
       'Secrets Sync',
+      'Secrets Recovery',
       'Access',
       'Policies',
       'Tools',
       'Replication',
       'Raft Storage',
       'Client Count',
+      'Vault Usage',
       'License',
       'Seal Vault',
       'Custom Messages',
+      'UI Login Settings',
     ];
     stubFeaturesAndPermissions(this.owner, true, true);
     await renderComponent();
@@ -79,13 +85,8 @@ module('Integration | Component | sidebar-nav-cluster', function (hooks) {
       .dom('[data-test-sidebar-nav-link]')
       .exists({ count: links.length }, 'Correct number of links render');
     links.forEach((link) => {
-      if (link === 'Secrets Sync') return;
       assert.dom(`[data-test-sidebar-nav-link="${link}"]`).hasText(link, `${link} link renders`);
     });
-    // after SYNC BETA - remove assertion below and return on line 82
-    assert
-      .dom('[data-test-sidebar-nav-link="Secrets Sync"]')
-      .hasText('Secrets Sync Beta', 'Secrets Sync nav link includes beta tag');
   });
 
   test('it should hide enterprise related links in child namespace', async function (assert) {
@@ -115,4 +116,162 @@ module('Integration | Component | sidebar-nav-cluster', function (hooks) {
         .doesNotExist(`${link} is hidden in child namespace`);
     });
   });
+
+  test('it should hide client counts link in chroot namespace', async function (assert) {
+    this.owner.lookup('service:permissions').setPaths({
+      data: {
+        chroot_namespace: 'admin',
+        root: true,
+      },
+    });
+    this.owner.lookup('service:currentCluster').setCluster({
+      id: 'foo',
+      anyReplicationEnabled: true,
+      usingRaft: true,
+      hasChrootNamespace: true,
+    });
+    const links = ['Client Counts', 'Replication', 'Raft Storage', 'License', 'Seal Vault'];
+
+    await renderComponent();
+    assert
+      .dom('[data-test-sidebar-nav-heading="Monitoring"]')
+      .doesNotExist('Monitoring heading is hidden in chroot namespace');
+    links.forEach((link) => {
+      assert
+        .dom(`[data-test-sidebar-nav-link="${link}"]`)
+        .doesNotExist(`${link} is hidden in chroot namespace`);
+    });
+  });
+
+  test('it should render badge for promotional links on managed clusters', async function (assert) {
+    this.flags.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+    const promotionalLinks = ['Secrets Sync'];
+    stubFeaturesAndPermissions(this.owner, true, true);
+    await renderComponent();
+
+    promotionalLinks.forEach((link) => {
+      assert
+        .dom(`[data-test-sidebar-nav-link="${link}"]`)
+        .hasText(`${link} Plus`, `${link} link renders Plus badge`);
+    });
+  });
+
+  // Secrets Sync side nav link has multiple combinations of three variables to test:
+  // 1. cluster type: enterprise (on and off license), HVD managed or community
+  // 2. activation status: activated or not
+  // 3. permissions: policy access to sys/sync routes or not
+
+  test('community: it hides Secrets Sync nav link', async function (assert) {
+    stubFeaturesAndPermissions(this.owner, false, false);
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Secrets Sync')).doesNotExist();
+  });
+
+  test('ent but feature is not on license: it hides Secrets Sync nav link', async function (assert) {
+    stubFeaturesAndPermissions(this.owner, true, false, []);
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Secrets Sync')).doesNotExist();
+  });
+
+  test('ent (on license), activated and permissions: it shows Secrets Sync nav link', async function (assert) {
+    stubFeaturesAndPermissions(this.owner, true, false, ['Secrets Sync']);
+    this.flags.activatedFlags = ['secrets-sync'];
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Secrets Sync')).exists();
+  });
+
+  test('ent (on license), activated and no permissions: it hides Secrets Sync nav link', async function (assert) {
+    stubFeaturesAndPermissions(this.owner, true, false, ['Secrets Sync'], false);
+    this.flags.activatedFlags = ['secrets-sync'];
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Secrets Sync')).doesNotExist();
+  });
+
+  test('ent (on license), not activated and permissions: it shows Secrets Sync nav link', async function (assert) {
+    stubFeaturesAndPermissions(this.owner, true, false, ['Secrets Sync']);
+    this.flags.activatedFlags = [];
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Secrets Sync')).exists();
+  });
+
+  test('ent (on license), not activated and no permissions: it shows Secrets Sync nav link', async function (assert) {
+    stubFeaturesAndPermissions(this.owner, true, false, ['Secrets Sync'], false);
+    this.flags.activatedFlags = [];
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Secrets Sync')).exists();
+  });
+
+  test('hvd managed: it shows Secrets Sync nav link regardless of activation status or permissions', async function (assert) {
+    stubFeaturesAndPermissions(this.owner, true, false, [], false);
+    this.flags.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+    this.flags.activatedFlags = [];
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Secrets Sync')).exists();
+  });
+
+  test('it shows Vault Usage when user is enterprise and in root namespace', async function (assert) {
+    stubFeaturesAndPermissions(this.owner, true);
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Vault Usage')).exists();
+  });
+
+  test('it does NOT show Vault Usage when user is user is on CE || OSS || community', async function (assert) {
+    stubFeaturesAndPermissions(this.owner, false);
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Vault Usage')).doesNotExist();
+  });
+
+  test('it does NOT show Vault Usage when user is enterprise but not in root namespace', async function (assert) {
+    stubFeaturesAndPermissions(this.owner, true);
+
+    this.owner.lookup('service:namespace').set('path', 'foo');
+
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Vault Usage')).doesNotExist();
+  });
+
+  test('it does NOT show Vault Usage when user lacks the necessary permission', async function (assert) {
+    // no permissions
+    stubFeaturesAndPermissions(this.owner, true, false, [], false);
+
+    await renderComponent();
+    assert.dom(GENERAL.navLink('Vault Usage')).doesNotExist();
+  });
+
+  test('it does NOT Vault Usage if the user has the necessary permission but user is on CE || OSS || community', async function (assert) {
+    // no permissions
+    const stubs = stubFeaturesAndPermissions(this.owner, false, false, [], false);
+
+    // allow the route
+    stubs.hasNavPermission.callsFake((route) => route === 'monitoring');
+
+    await renderComponent();
+
+    assert.dom(GENERAL.navLink('Vault Usage')).doesNotExist();
+  });
+
+  test('it shows Vault Usage when user is in HVD admin namespace', async function (assert) {
+    const stubs = stubFeaturesAndPermissions(this.owner, true, false, [], false);
+    stubs.hasNavPermission.callsFake((route) => route === 'monitoring');
+
+    this.flags.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+
+    const namespace = this.owner.lookup('service:namespace');
+    namespace.setNamespace('admin');
+
+    await renderComponent();
+
+    assert.dom(GENERAL.navLink('Vault Usage')).exists();
+  });
+
+  test('it does NOT show Secrets Recovery when user is in HVD admin namespace', async function (assert) {
+    this.flags.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+
+    const namespace = this.owner.lookup('service:namespace');
+    namespace.setNamespace('admin');
+
+    await renderComponent();
+
+    assert.dom(GENERAL.navLink('Secrets Recovery')).doesNotExist();
+  });
 });
diff --git a/ui/tests/integration/components/sidebar/nav/policies-test.js b/ui/tests/integration/components/sidebar/nav/policies-test.js
index 9634219d40a..1379c9a36b6 100644
--- a/ui/tests/integration/components/sidebar/nav/policies-test.js
+++ b/ui/tests/integration/components/sidebar/nav/policies-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -32,7 +32,7 @@ module('Integration | Component | sidebar-nav-policies', function (hooks) {
     });
   });
 
-  test('it should hide links user does not have access too', async function (assert) {
+  test('it should hide links user does not have access to', async function (assert) {
     await renderComponent();
     assert
       .dom('[data-test-sidebar-nav-link]')
diff --git a/ui/tests/integration/components/sidebar/nav/tools-test.js b/ui/tests/integration/components/sidebar/nav/tools-test.js
index 2fda765e2b0..f7b224118ad 100644
--- a/ui/tests/integration/components/sidebar/nav/tools-test.js
+++ b/ui/tests/integration/components/sidebar/nav/tools-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -34,7 +34,7 @@ module('Integration | Component | sidebar-nav-tools', function (hooks) {
     });
   });
 
-  test('it should hide links user does not have access too', async function (assert) {
+  test('it should hide links user does not have access to', async function (assert) {
     await renderComponent();
     assert
       .dom('[data-test-sidebar-nav-link]')
diff --git a/ui/tests/integration/components/sidebar/user-menu-test.js b/ui/tests/integration/components/sidebar/user-menu-test.js
index 96ba92804a0..585524f2995 100644
--- a/ui/tests/integration/components/sidebar/user-menu-test.js
+++ b/ui/tests/integration/components/sidebar/user-menu-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | sidebar-user-menu', function (hooks) {
   setupRenderingTest(hooks);
@@ -29,9 +30,9 @@ module('Integration | Component | sidebar-user-menu', function (hooks) {
     await render(hbs`<Sidebar::UserMenu />`);
 
     assert
-      .dom('[data-test-user-menu-trigger] [data-test-icon="user"]')
+      .dom(`${GENERAL.button('user-menu-trigger')} [data-test-icon="user"]`)
       .exists('Correct icon renders for menu trigger');
-    await click('[data-test-user-menu-trigger]');
+    await click(GENERAL.button('user-menu-trigger'));
     assert.dom('[data-test-user-menu-content]').exists('User menu content renders');
   });
 
@@ -40,11 +41,11 @@ module('Integration | Component | sidebar-user-menu', function (hooks) {
     sinon.stub(this.auth, 'authData').value({ displayName: 'token' });
 
     await render(hbs`<Sidebar::UserMenu />`);
-    await click('[data-test-user-menu-trigger]');
+    await click(GENERAL.button('user-menu-trigger'));
 
     assert.dom('.menu-label').hasText('Token', 'Auth data display name renders');
     assert.dom('li').exists({ count: 2 }, 'Correct number of menu items render');
-    assert.dom('[data-test-copy-button="root"]').exists('Copy token action renders');
+    assert.dom(GENERAL.copyButton).exists('Copy token action renders');
     assert.dom('#logout').hasText('Log out', 'Log out action renders');
   });
 
@@ -55,17 +56,17 @@ module('Integration | Component | sidebar-user-menu', function (hooks) {
     const revokeStub = sinon.stub(this.auth, 'revokeCurrentToken').resolves();
     const date = new Date();
     sinon.stub(this.auth, 'tokenExpirationDate').value(date.setDate(date.getDate() + 1));
-    sinon.stub(this.auth, 'authData').value({ displayName: 'token', renewable: true, entity_id: 'foo' });
+    sinon.stub(this.auth, 'authData').value({ displayName: 'token', renewable: true, entityId: 'foo' });
     this.auth.set('allowExpiration', true);
 
     await render(hbs`<Sidebar::UserMenu />`);
-    await click('[data-test-user-menu-trigger]');
+    await click(GENERAL.button('user-menu-trigger'));
 
     assert.dom('[data-test-user-menu-item="token alert"]').exists('Token expiration alert renders');
     assert.dom('[data-test-user-menu-item="mfa"]').hasText('Multi-factor authentication', 'MFA link renders');
 
     await click('[data-test-user-menu-item="revoke token"]');
-    await click('[data-test-confirm-button]');
+    await click(GENERAL.confirmButton);
     assert.true(revokeStub.calledOnce, 'Auth revoke token method called on revoke confirm');
     assert.true(
       transitionStub.calledWith('vault.cluster.logout'),
diff --git a/ui/tests/integration/components/splash-page-test.js b/ui/tests/integration/components/splash-page-test.js
index 82ddef0c9e9..916f60d06df 100644
--- a/ui/tests/integration/components/splash-page-test.js
+++ b/ui/tests/integration/components/splash-page-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,14 +12,11 @@ module('Integration | Component | splash-page', function (hooks) {
   setupRenderingTest(hooks);
 
   test('it should render', async function (assert) {
-    assert.expect(4);
+    assert.expect(3);
     await render(hbs`<SplashPage>
     <:header>
       Header here
     </:header>
-    <:subHeader>
-      sub header
-    </:subHeader>
     <:content>
       content
     </:content>
@@ -30,7 +27,6 @@ module('Integration | Component | splash-page', function (hooks) {
     </SplashPage>
       `);
     assert.dom('[data-test-splash-page-header]').includesText('Header here', 'Header renders');
-    assert.dom('[data-test-splash-page-sub-header]').includesText('sub header', 'SubHeader renders');
     assert.dom('[data-test-splash-page-content]').includesText('content', 'Content renders');
     assert.dom('[data-test-footer]').includesText('footer', 'Footer renders');
   });
diff --git a/ui/tests/integration/components/stat-text-test.js b/ui/tests/integration/components/stat-text-test.js
index d3e398dfd45..a3f0a6035ba 100644
--- a/ui/tests/integration/components/stat-text-test.js
+++ b/ui/tests/integration/components/stat-text-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,7 +14,7 @@ module('Integration | Component | StatText', function (hooks) {
   test('it renders', async function (assert) {
     await render(hbs`<StatText />`);
 
-    assert.dom('[data-test-stat-text-container]').exists('renders element');
+    assert.dom('[data-test-stat-text]').exists('renders element');
   });
 
   test('it renders passed in attributes', async function (assert) {
diff --git a/ui/tests/integration/components/string-list-test.js b/ui/tests/integration/components/string-list-test.js
index 73c721ccce7..f4ad16f84ab 100644
--- a/ui/tests/integration/components/string-list-test.js
+++ b/ui/tests/integration/components/string-list-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/sync-status-badge-test.js b/ui/tests/integration/components/sync-status-badge-test.js
index 5624f9b9dca..c11bc05a5a8 100644
--- a/ui/tests/integration/components/sync-status-badge-test.js
+++ b/ui/tests/integration/components/sync-status-badge-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -35,8 +35,8 @@ module('Integration | Component | SyncStatusBadge', function (hooks) {
   test('it should render when status does not exist', async function (assert) {
     assert.expect(2);
     await this.renderComponent();
-    assert.dom(PAGE.syncBadge.icon('help')).exists('renders help icon');
-    assert.dom(PAGE.syncBadge.text).hasText(this.status);
+    assert.dom(PAGE.badgeText.icon('help')).exists('renders help icon');
+    assert.dom(PAGE.badgeText.text).hasText(this.status);
   });
 
   test('it renders badge and icon for each status type', async function (assert) {
@@ -46,8 +46,8 @@ module('Integration | Component | SyncStatusBadge', function (hooks) {
       const label = toLabel([status]);
       const { icon, color } = SYNC_STATUSES[status];
       await this.renderComponent();
-      assert.dom(PAGE.syncBadge.icon(icon)).exists(`status: ${status} renders icon: ${icon}`);
-      assert.dom(PAGE.syncBadge.text).hasText(label, `status: ${status} renders label: ${label}`);
+      assert.dom(PAGE.badgeText.icon(icon)).exists(`status: ${status} renders icon: ${icon}`);
+      assert.dom(PAGE.badgeText.text).hasText(label, `status: ${status} renders label: ${label}`);
       assert
         .dom('[data-test-badge]')
         .hasClass(`hds-badge--color-${color}`, `status: ${status} renders color: ${color}`);
diff --git a/ui/tests/integration/components/sync/secrets/destination-header-test.js b/ui/tests/integration/components/sync/secrets/destination-header-test.js
index 11c3c11ba78..a7667818b3f 100644
--- a/ui/tests/integration/components/sync/secrets/destination-header-test.js
+++ b/ui/tests/integration/components/sync/secrets/destination-header-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,10 +7,9 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { setupModels } from 'vault/tests/helpers/sync/setup-models';
+import { setupDataStubs } from 'vault/tests/helpers/sync/setup-hooks';
 import hbs from 'htmlbars-inline-precompile';
-import { click, fillIn, render, settled } from '@ember/test-helpers';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { click, fillIn, render } from '@ember/test-helpers';
 import { PAGE } from 'vault/tests/helpers/sync/sync-selectors';
 import sinon from 'sinon';
 
@@ -18,62 +17,65 @@ module('Integration | Component | sync | Secrets::DestinationHeader', function (
   setupRenderingTest(hooks);
   setupEngine(hooks, 'sync');
   setupMirage(hooks);
-  setupModels(hooks);
+  setupDataStubs(hooks);
 
   hooks.beforeEach(async function () {
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
-
-    await render(hbs`<Secrets::DestinationHeader @destination={{this.destination}} />`, {
-      owner: this.engine,
-    });
+    this.refreshList = sinon.stub();
+
+    this.renderComponent = () =>
+      render(
+        hbs`<Secrets::DestinationHeader @destination={{this.destination}} @capabilities={{this.capabilities}} @refreshList={{this.refreshList}} />`,
+        {
+          owner: this.engine,
+        }
+      );
   });
 
   test('it should render SyncHeader component', async function (assert) {
-    assert.dom(PAGE.title).includesText('us-west-1', 'SyncHeader component renders');
+    await this.renderComponent();
+    assert.dom(PAGE.title).includesText('destination-aws', 'SyncHeader component renders');
   });
 
   test('it should render tabs', async function (assert) {
+    await this.renderComponent();
     assert.dom(PAGE.tab('Secrets')).hasText('Secrets', 'Secrets tab renders');
     assert.dom(PAGE.tab('Details')).hasText('Details', 'Details tab renders');
   });
 
   test('it should render toolbar', async function (assert) {
+    await this.renderComponent();
     ['Delete destination', 'Sync secrets', 'Edit destination'].forEach((btn) => {
       assert.dom(PAGE.toolbar(btn)).hasText(btn, `${btn} toolbar action renders`);
     });
   });
 
   test('it should delete destination', async function (assert) {
-    assert.expect(3);
+    assert.expect(2);
 
     const transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
-    const clearDatasetStub = sinon.stub(this.store, 'clearDataset');
 
-    this.server.delete('/sys/sync/destinations/aws-sm/us-west-1', () => {
+    this.server.delete('/sys/sync/destinations/aws-sm/destination-aws', () => {
       assert.ok(true, 'Request made to delete destination');
       return {};
     });
 
+    await this.renderComponent();
     await click(PAGE.toolbar('Delete destination'));
     await fillIn(PAGE.confirmModalInput, 'DELETE');
     await click(PAGE.confirmButton);
 
-    assert.propEqual(
-      transitionStub.lastCall.args,
-      ['vault.cluster.sync.secrets.overview'],
+    assert.true(
+      transitionStub.calledWith('vault.cluster.sync.secrets.overview'),
       'Transition is triggered on delete success'
     );
-    assert.propEqual(
-      clearDatasetStub.lastCall.args,
-      ['sync/destination'],
-      'Store dataset is cleared on delete success'
-    );
   });
 
   test('it should render delete progress banner and hide actions', async function (assert) {
     assert.expect(5);
-    this.destination.set('purgeInitiatedAt', '2024-01-09T16:54:28.463879');
-    await settled();
+
+    this.destination.purge_initiated_at = '2024-01-09T16:54:28.463879';
+
+    await this.renderComponent();
     assert
       .dom(PAGE.destinations.deleteBanner)
       .hasText(
@@ -89,9 +91,11 @@ module('Integration | Component | sync | Secrets::DestinationHeader', function (
 
   test('it should render delete error banner', async function (assert) {
     assert.expect(2);
-    this.destination.set('purgeInitiatedAt', '2024-01-09T16:54:28.463879');
-    this.destination.set('purgeError', 'oh no! a problem occurred!');
-    await settled();
+
+    this.destination.purge_initiated_at = '2024-01-09T16:54:28.463879';
+    this.destination.purge_error = 'oh no! a problem occurred!';
+
+    await this.renderComponent();
     assert
       .dom(PAGE.destinations.deleteBanner)
       .hasText(
@@ -106,15 +110,8 @@ module('Integration | Component | sync | Secrets::DestinationHeader', function (
   test('it should render refresh list button', async function (assert) {
     assert.expect(1);
 
-    this.refreshList = () => assert.ok(true, 'Refresh list callback fires');
-
-    await render(
-      hbs`<Secrets::DestinationHeader @destination={{this.destination}} @refreshList={{this.refreshList}} />`,
-      {
-        owner: this.engine,
-      }
-    );
-
+    await this.renderComponent();
     await click(PAGE.associations.list.refresh);
+    assert.true(this.refreshList.calledOnce, 'Refresh list action is triggered');
   });
 });
diff --git a/ui/tests/integration/components/sync/secrets/landing-cta-test.js b/ui/tests/integration/components/sync/secrets/landing-cta-test.js
index 68a0859f3fc..411a96787fa 100644
--- a/ui/tests/integration/components/sync/secrets/landing-cta-test.js
+++ b/ui/tests/integration/components/sync/secrets/landing-cta-test.js
@@ -1,52 +1,53 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 import hbs from 'htmlbars-inline-precompile';
 import { render } from '@ember/test-helpers';
 import { PAGE } from 'vault/tests/helpers/sync/sync-selectors';
+import sinon from 'sinon';
+
+const { cta } = PAGE;
 
 module('Integration | Component | sync | Secrets::LandingCta', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'sync');
+  setupMirage(hooks);
+
   hooks.beforeEach(function () {
-    this.version = this.owner.lookup('service:version');
+    this.transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
   });
 
-  test('it should render promotional copy for community version', async function (assert) {
-    await render(
-      hbs`
-     <Secrets::LandingCta />
-    `,
-      { owner: this.engine }
-    );
+  test('it should render promotional copy if feature is not activated', async function (assert) {
+    await render(hbs`<Secrets::LandingCta @isActivated={{false}} /> `, {
+      owner: this.engine,
+    });
 
     assert
-      .dom(PAGE.cta.summary)
+      .dom(cta.summary)
       .hasText(
-        'This enterprise feature allows you to sync secrets to platforms and tools across your stack to get secrets when and where you need them. Learn more about secrets sync'
+        'This feature allows you to sync secrets to platforms and tools across your stack to get secrets when and where you need them. Learn more about Secrets Sync'
       );
-    assert.dom(PAGE.cta.link).hasText('Learn more about secrets sync');
+    assert.dom(cta.link).hasText('Learn more about Secrets Sync');
+    assert.dom(cta.button).doesNotExist('does not render create destination button');
   });
 
-  test('it should render enterprise copy', async function (assert) {
-    this.version.type = 'enterprise';
-    await render(
-      hbs`
-     <Secrets::LandingCta />
-    `,
-      { owner: this.engine }
-    );
+  test('it should render CTA copy and action if feature is activated', async function (assert) {
+    await render(hbs`<Secrets::LandingCta @isActivated={{true}} /> `, {
+      owner: this.engine,
+    });
 
     assert
-      .dom(PAGE.cta.summary)
+      .dom(cta.summary)
       .hasText(
-        'Sync secrets to platforms and tools across your stack to get secrets when and where you need them. Secrets sync tutorial'
+        'This feature allows you to sync secrets to platforms and tools across your stack to get secrets when and where you need them. Learn more about Secrets Sync'
       );
-    assert.dom(PAGE.cta.link).hasText('Secrets sync tutorial');
+    assert.dom(cta.link).hasText('Learn more about Secrets Sync');
+    assert.dom(cta.button).exists('it renders create destination button');
   });
 });
diff --git a/ui/tests/integration/components/sync/secrets/page/destinations-test.js b/ui/tests/integration/components/sync/secrets/page/destinations-test.js
index 69aabce25c7..74e1c9f8319 100644
--- a/ui/tests/integration/components/sync/secrets/page/destinations-test.js
+++ b/ui/tests/integration/components/sync/secrets/page/destinations-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,22 +9,12 @@ import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { render, click, fillIn } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
 import sinon from 'sinon';
 
 import { PAGE } from 'vault/tests/helpers/sync/sync-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
-const {
-  breadcrumb,
-  title,
-  tab,
-  filter,
-  searchSelect,
-  emptyStateTitle,
-  destinations,
-  menuTrigger,
-  confirmButton,
-} = PAGE;
+const { title, tab, filter, searchSelect, emptyStateTitle, destinations, confirmButton } = PAGE;
 
 module('Integration | Component | sync | Page::Destinations', function (hooks) {
   setupRenderingTest(hooks);
@@ -32,29 +22,34 @@ module('Integration | Component | sync | Page::Destinations', function (hooks) {
   setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.owner.lookup('service:version').type = 'enterprise';
-
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
-
-    const store = this.owner.lookup('service:store');
-    const modelName = 'sync/destinations/aws-sm';
-    const destination = this.server.create('sync-destination', 'aws-sm');
-    store.pushPayload(modelName, {
-      modelName,
-      ...destination,
-      id: destination.name,
-    });
-
-    this.destinations = store.peekAll(modelName).toArray();
+    this.version = this.owner.lookup('service:version');
+    this.version.type = 'enterprise';
+    this.version.features = ['Secrets Sync'];
+
+    this.destinations = [
+      {
+        id: 'aws-sm/destination-aws',
+        name: 'destination-aws',
+        type: 'aws-sm',
+        icon: 'aws-color',
+        type_display_name: 'AWS Secrets Manager',
+      },
+    ];
     this.destinations.meta = {
       filteredTotal: this.destinations.length,
       currentPage: 1,
       pageSize: 5,
     };
 
+    const path = this.owner.lookup('service:capabilities').pathFor('syncDestination', this.destinations[0]);
+    this.capabilities = {
+      [path]: { canRead: true, canUpdate: true, canDelete: true },
+    };
+
     this.renderComponent = () => {
       return render(
         hbs`<Secrets::Page::Destinations
+          @capabilities={{this.capabilities}}
           @destinations={{this.destinations}}
           @typeFilter={{this.typeFilter}}
           @nameFilter={{this.nameFilter}}
@@ -64,13 +59,12 @@ module('Integration | Component | sync | Page::Destinations', function (hooks) {
     };
 
     this.transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
-    this.clearDatasetStub = sinon.stub(store, 'clearDataset');
+    this.clearDatasetStub = sinon.stub(this.owner.lookup('service:pagination'), 'clearDataset');
   });
 
   test('it should render header and tabs', async function (assert) {
     await this.renderComponent();
-    assert.dom(breadcrumb).includesText('Secrets Sync', 'Breadcrumb renders');
-    assert.dom(title).hasText('Secrets Sync Beta', 'Page title renders');
+    assert.dom(title).hasText('Secrets Sync', 'Page title renders');
     assert.dom(tab('Overview')).exists('Overview tab renders');
     assert.dom(tab('Destinations')).exists('Destinations tab renders');
   });
@@ -107,7 +101,7 @@ module('Integration | Component | sync | Page::Destinations', function (hooks) {
 
   test('it should render empty state when there are no filtered results', async function (assert) {
     this.destinations = [];
-    this.typeFilter = 'foo';
+    this.typeFilter = 'aws-sm';
     this.nameFilter = 'bar';
 
     await this.renderComponent();
@@ -115,14 +109,17 @@ module('Integration | Component | sync | Page::Destinations', function (hooks) {
     assert
       .dom(emptyStateTitle)
       .hasText(
-        'There are no foo destinations matching "bar".',
+        'There are no AWS Secrets Manager destinations matching "bar".',
         'Renders correct empty state when both type and name filters are defined'
       );
 
     this.set('nameFilter', undefined);
     assert
       .dom(emptyStateTitle)
-      .hasText('There are no foo destinations.', 'Renders correct empty state when type filter is defined');
+      .hasText(
+        'There are no AWS Secrets Manager destinations.',
+        'Renders correct empty state when type filter is defined'
+      );
 
     this.setProperties({
       typeFilter: undefined,
@@ -132,7 +129,7 @@ module('Integration | Component | sync | Page::Destinations', function (hooks) {
   });
 
   test('it should render destination list items', async function (assert) {
-    assert.expect(6);
+    assert.expect(5);
 
     this.server.delete('/sys/sync/destinations/aws-sm/destination-aws', () => {
       assert.ok('Request made to delete destination');
@@ -141,15 +138,15 @@ module('Integration | Component | sync | Page::Destinations', function (hooks) {
 
     await this.renderComponent();
 
-    const { icon, name, type, deleteAction } = destinations.list;
+    const { icon, name, type } = destinations.list;
 
-    assert.dom(icon).hasClass('flight-icon-aws-color', 'Correct icon renders');
+    assert.dom(icon).hasClass('hds-icon-aws-color', 'Correct icon renders');
     assert.dom(name).hasText('destination-aws', 'Name renders');
     assert.dom(type).hasText('AWS Secrets Manager', 'Type renders');
 
-    await click(menuTrigger);
+    await click(GENERAL.menuTrigger);
 
-    await click(deleteAction);
+    await click(GENERAL.menuItem('delete'));
     await click(confirmButton);
 
     assert.propEqual(
@@ -157,10 +154,5 @@ module('Integration | Component | sync | Page::Destinations', function (hooks) {
       ['vault.cluster.sync.secrets.overview'],
       'Transition is triggered on delete success'
     );
-    assert.propEqual(
-      this.clearDatasetStub.lastCall.args,
-      ['sync/destination'],
-      'Store dataset is cleared on delete success'
-    );
   });
 });
diff --git a/ui/tests/integration/components/sync/secrets/page/destinations/create-and-edit-test.js b/ui/tests/integration/components/sync/secrets/page/destinations/create-and-edit-test.js
index c5d271163fb..8ed229f8881 100644
--- a/ui/tests/integration/components/sync/secrets/page/destinations/create-and-edit-test.js
+++ b/ui/tests/integration/components/sync/secrets/page/destinations/create-and-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,135 +7,209 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { setupDataStubs } from 'vault/tests/helpers/sync/setup-hooks';
 import hbs from 'htmlbars-inline-precompile';
 import sinon from 'sinon';
 import { Response } from 'miragejs';
-import { click, render, typeIn } from '@ember/test-helpers';
+import { click, fillIn, render, typeIn } from '@ember/test-helpers';
 import { PAGE } from 'vault/tests/helpers/sync/sync-selectors';
-import { syncDestinations } from 'vault/helpers/sync-destinations';
-import { decamelize, underscore } from '@ember/string';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { syncDestinations, findDestination } from 'vault/helpers/sync-destinations';
+import formResolver from 'vault/forms/sync/resolver';
 
 const SYNC_DESTINATIONS = syncDestinations();
 module('Integration | Component | sync | Secrets::Page::Destinations::CreateAndEdit', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'sync');
   setupMirage(hooks);
+  setupDataStubs(hooks);
 
   hooks.beforeEach(function () {
-    this.store = this.owner.lookup('service:store');
     this.transitionStub = sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
-    this.clearDatasetStub = sinon.stub(this.store, 'clearDataset');
+    this.apiPath = 'sys/sync/destinations/:type/:name';
 
-    this.renderFormComponent = () => {
-      return render(hbs` <Secrets::Page::Destinations::CreateAndEdit @destination={{this.model}} />`, {
-        owner: this.engine,
-      });
+    this.generateForm = (isNew = false, type = 'aws-sm') => {
+      const { defaultValues } = findDestination(type);
+      let data = defaultValues;
+
+      if (!isNew) {
+        if (type !== 'aws-sm') {
+          this.setupStubsForType(type);
+        }
+        const { name, connection_details, options } = this.destination;
+        options.granularity = options.granularity_level;
+        delete options.granularity_level;
+
+        data = { name, ...connection_details, ...options };
+      }
+
+      this.form = formResolver(type, data, { isNew });
+      this.formFields = this.form.formFieldGroups.reduce((arr, group) => {
+        const values = Object.values(group)[0] || [];
+        return [...arr, ...values];
+      }, []);
+      this.type = type;
     };
 
-    this.generateModel = (type = 'aws-sm') => {
-      const data = this.server.create('sync-destination', type);
-      const id = `${type}/${data.name}`;
-      data.id = id;
-      this.store.pushPayload(`sync/destinations/${type}`, {
-        modelName: `sync/destinations/${type}`,
-        ...data,
+    this.renderComponent = () =>
+      render(hbs` <Secrets::Page::Destinations::CreateAndEdit @form={{this.form}} @type={{this.type}} />`, {
+        owner: this.engine,
       });
-      return this.store.peekRecord(`sync/destinations/${type}`, id);
-    };
   });
 
-  test('create: it renders and navigates back to create on cancel', async function (assert) {
+  test('create: it renders breadcrumbs and navigates back to create on cancel', async function (assert) {
+    this.generateForm(true);
     assert.expect(2);
-    const { type } = SYNC_DESTINATIONS[0];
-    this.model = this.store.createRecord(`sync/destinations/${type}`, { type });
 
-    await this.renderFormComponent();
+    await this.renderComponent();
     assert.dom(PAGE.breadcrumbs).hasText('Secrets Sync Select Destination Create Destination');
     await click(PAGE.cancelButton);
     const transition = this.transitionStub.calledWith('vault.cluster.sync.secrets.destinations.create');
     assert.true(transition, 'transitions to vault.cluster.sync.secrets.destinations.create on cancel');
   });
 
-  test('edit: it renders and navigates back to details on cancel', async function (assert) {
+  test('create: it renders headers and fieldGroups subtext', async function (assert) {
+    this.generateForm(true);
     assert.expect(4);
-    this.model = this.generateModel();
 
-    await this.renderFormComponent();
+    await this.renderComponent();
+    assert
+      .dom(PAGE.form.fieldGroupHeader('Credentials'))
+      .hasText('Credentials', 'renders credentials section on create');
+    assert
+      .dom(PAGE.form.fieldGroupHeader('Advanced configuration'))
+      .hasText('Advanced configuration', 'renders advanced configuration section on create');
+    assert
+      .dom(PAGE.form.fieldGroupSubtext('Credentials'))
+      .hasText('Connection credentials are sensitive information used to authenticate with the destination.');
+    assert
+      .dom(PAGE.form.fieldGroupSubtext('Advanced configuration'))
+      .hasText('Configuration options for the destination.');
+  });
+
+  test('edit: it renders breadcrumbs and navigates back to details on cancel', async function (assert) {
+    this.generateForm();
+    assert.expect(2);
+
+    await this.renderComponent();
     assert.dom(PAGE.breadcrumbs).hasText('Secrets Sync Destinations Destination Edit Destination');
-    assert.dom('h2').hasText('Credentials', 'renders credentials section on edit');
+
+    await click(PAGE.cancelButton);
+    const transition = this.transitionStub.calledWith('vault.cluster.sync.secrets.destinations.destination');
+    assert.true(transition, 'transitions to vault.cluster.sync.secrets.destinations.destination on cancel');
+  });
+
+  test('edit: it renders headers and fieldGroup subtext', async function (assert) {
+    this.generateForm();
+    assert.expect(4);
+
+    await this.renderComponent();
+    assert
+      .dom(PAGE.form.fieldGroupHeader('Credentials'))
+      .hasText('Credentials', 'renders credentials section on edit');
     assert
-      .dom('p.hds-foreground-faint')
+      .dom(PAGE.form.fieldGroupHeader('Advanced configuration'))
+      .hasText('Advanced configuration', 'renders advanced configuration section on edit');
+    assert
+      .dom(PAGE.form.fieldGroupSubtext('Credentials'))
       .hasText(
         'Connection credentials are sensitive information and the value cannot be read. Enable the input to update.'
       );
-    await click(PAGE.cancelButton);
-    const transition = this.transitionStub.calledWith('vault.cluster.sync.secrets.destinations.destination');
-    assert.true(transition, 'transitions to vault.cluster.sync.secrets.destinations.destination on cancel');
+    assert
+      .dom(PAGE.form.fieldGroupSubtext('Advanced configuration'))
+      .hasText('Configuration options for the destination.');
   });
 
   test('edit: it PATCH updates custom_tags', async function (assert) {
-    assert.expect(1);
-    this.model = this.generateModel();
+    this.generateForm();
+    assert.expect(2);
 
-    this.server.patch(`sys/sync/destinations/${this.model.type}/${this.model.name}`, (schema, req) => {
+    this.server.patch(this.apiPath, (schema, req) => {
       const payload = JSON.parse(req.requestBody);
-      const expected = {
-        tags_to_remove: ['foo'],
-        custom_tags: { updated: 'bar', added: 'key' },
-      };
-      assert.propEqual(payload, expected, 'payload removes old tags and includes updated object');
-      return { payload };
+      assert.propEqual(
+        payload.custom_tags,
+        { updated: 'bar', added: 'key' },
+        'payload contains updated custom tags'
+      );
+      assert.propEqual(payload.tags_to_remove, ['foo'], 'payload contains tags to remove with expected keys');
+      return payload;
     });
 
-    // bypass form and manually set model attributes
-    this.model.set('customTags', {
-      updated: 'bar',
-      added: 'key',
-    });
-    await this.renderFormComponent();
-    await click(PAGE.saveButton);
+    await this.renderComponent();
+    await click(GENERAL.kvObjectEditor.deleteRow());
+    await fillIn(GENERAL.kvObjectEditor.key(), 'updated');
+    await fillIn(GENERAL.kvObjectEditor.value(), 'bar');
+    await click(GENERAL.kvObjectEditor.addRow);
+    await fillIn(GENERAL.kvObjectEditor.key(1), 'added');
+    await fillIn(GENERAL.kvObjectEditor.value(1), 'key');
+    await click(GENERAL.submitButton);
   });
 
   test('edit: it adds custom_tags when previously there are none', async function (assert) {
+    this.generateForm();
     assert.expect(1);
-    this.model = this.generateModel();
 
-    this.server.patch(`sys/sync/destinations/${this.model.type}/${this.model.name}`, (schema, req) => {
+    this.server.patch(this.apiPath, (schema, req) => {
       const payload = JSON.parse(req.requestBody);
-      const expected = { custom_tags: { foo: 'blah' } };
-      assert.propEqual(payload, expected, 'payload contains new custom tags');
-      return { payload };
+      assert.propEqual(payload.custom_tags, { foo: 'blah' }, 'payload contains new custom tags');
+      return payload;
     });
 
-    // bypass form and manually set model attributes
-    this.model.set('customTags', {});
+    this.destination.options.custom_tags = {};
 
-    await this.renderFormComponent();
-    await PAGE.form.fillInByAttr('customTags', 'blah');
-    await click(PAGE.saveButton);
+    await this.renderComponent();
+    await PAGE.form.fillInByAttr('custom_tags', 'blah');
+    await click(GENERAL.submitButton);
   });
 
   test('edit: payload does not contain any custom_tags when removed in form', async function (assert) {
-    assert.expect(1);
-    this.model = this.generateModel();
+    this.generateForm();
+    assert.expect(2);
 
-    this.server.patch(`sys/sync/destinations/${this.model.type}/${this.model.name}`, (schema, req) => {
+    this.server.patch(this.apiPath, (schema, req) => {
       const payload = JSON.parse(req.requestBody);
-      const expected = { tags_to_remove: ['foo'], custom_tags: {} };
-      assert.propEqual(payload, expected, 'payload removes old keys');
-      return { payload };
+      assert.propEqual(payload.tags_to_remove, ['foo'], 'payload removes old keys');
+      assert.propEqual(payload.custom_tags, {}, 'payload does not contain custom_tags');
+      return payload;
     });
 
-    await this.renderFormComponent();
+    await this.renderComponent();
     await click(PAGE.kvObjectEditor.deleteRow());
-    await click(PAGE.saveButton);
+    await click(GENERAL.submitButton);
+  });
+
+  test('edit: payload only contains masked inputs when they have changed', async function (assert) {
+    this.generateForm();
+    assert.expect(2);
+
+    this.server.patch(this.apiPath, (schema, req) => {
+      const payload = JSON.parse(req.requestBody);
+      assert.strictEqual(
+        payload.access_key_id,
+        undefined,
+        'payload does not contain the unchanged obfuscated field'
+      );
+      assert.strictEqual(
+        payload.secret_access_key,
+        'new-secret',
+        'payload contains the changed obfuscated field'
+      );
+      return payload;
+    });
+
+    await this.renderComponent();
+    await click(PAGE.enableField('access_key_id'));
+    await click(PAGE.inputByAttr('access_key_id')); // click on input but do not change value
+    await click(PAGE.enableField('secret_access_key'));
+    await fillIn(PAGE.inputByAttr('secret_access_key'), 'new-secret');
+    await click(GENERAL.submitButton);
   });
 
   test('it renders API errors', async function (assert) {
+    this.generateForm();
     assert.expect(1);
-    const name = 'my-failed-dest';
-    const type = SYNC_DESTINATIONS[0].type;
-    this.server.post(`sys/sync/destinations/${type}/${name}`, () => {
+
+    this.server.patch(this.apiPath, () => {
       return new Response(
         500,
         {},
@@ -147,10 +221,9 @@ module('Integration | Component | sync | Secrets::Page::Destinations::CreateAndE
       );
     });
 
-    this.model = this.store.createRecord(`sync/destinations/${type}`, { name, type });
-    await this.renderFormComponent();
+    await this.renderComponent();
 
-    await click(PAGE.saveButton);
+    await click(GENERAL.submitButton);
     assert
       .dom(PAGE.messageError)
       .hasText(
@@ -159,30 +232,23 @@ module('Integration | Component | sync | Secrets::Page::Destinations::CreateAndE
   });
 
   test('it renders warning validation only when editing vercel-project team_id', async function (assert) {
-    assert.expect(2);
     const type = 'vercel-project';
-    // new model
-    this.model = this.store.createRecord(`sync/destinations/${type}`, { type });
-    await this.renderFormComponent();
-    await typeIn(PAGE.inputByAttr('teamId'), 'id');
+    this.generateForm(true, type); // new destination
+
+    assert.expect(2);
+
+    await this.renderComponent();
+    await typeIn(PAGE.inputByAttr('team_id'), 'id');
     assert
-      .dom(PAGE.validationWarning('teamId'))
+      .dom(PAGE.validationWarningByAttr('team_id'))
       .doesNotExist('does not render warning validation for new vercel-project destination');
 
-    // existing model
-    const data = this.server.create('sync-destination', type);
-    const id = `${type}/${data.name}`;
-    data.id = id;
-    this.store.pushPayload(`sync/destinations/${type}`, {
-      modelName: `sync/destinations/${type}`,
-      ...data,
-    });
-    this.model = this.store.peekRecord(`sync/destinations/${type}`, id);
-    await this.renderFormComponent();
-    await PAGE.form.fillInByAttr('teamId', '');
-    await typeIn(PAGE.inputByAttr('teamId'), 'edit');
+    this.generateForm(false, type); // existing destination
+    await this.renderComponent();
+    await PAGE.form.fillInByAttr('team_id', '');
+    await typeIn(PAGE.inputByAttr('team_id'), 'edit');
     assert
-      .dom(PAGE.validationWarning('teamId'))
+      .dom(PAGE.validationWarningByAttr('team_id'))
       .hasText(
         'Team ID should only be updated if the project was transferred to another account.',
         'it renders validation warning'
@@ -192,104 +258,99 @@ module('Integration | Component | sync | Secrets::Page::Destinations::CreateAndE
   // CREATE FORM ASSERTIONS FOR EACH DESTINATION TYPE
   for (const destination of SYNC_DESTINATIONS) {
     const { name, type } = destination;
+    const obfuscatedFields = ['access_token', 'client_secret', 'secret_access_key', 'access_key_id'];
 
-    module(`create destination: ${type}`, function (hooks) {
-      hooks.beforeEach(function () {
-        this.model = this.store.createRecord(`sync/destinations/${type}`, { type });
-      });
-
+    module(`create destination: ${type}`, function () {
       test('it renders destination form', async function (assert) {
-        assert.expect(this.model.formFields.length + 1);
+        this.generateForm(true, type);
+        assert.expect(this.formFields.length + 1);
 
-        await this.renderFormComponent();
+        await this.renderComponent();
 
         assert.dom(PAGE.title).hasTextContaining(`Create Destination for ${name}`);
-        for (const attr of this.model.formFields) {
-          assert.dom(PAGE.fieldByAttr(attr.name)).exists();
+
+        for (const field of this.formFields) {
+          assert.dom(PAGE.fieldByAttr(field.name)).exists();
         }
       });
 
+      test('it masks obfuscated fields', async function (assert) {
+        this.generateForm(true, type);
+        const filteredObfuscatedFields = this.formFields.filter((field) =>
+          obfuscatedFields.includes(field.name)
+        );
+        assert.expect(filteredObfuscatedFields.length * 2);
+
+        await this.renderComponent();
+        // iterate over the form fields and filter for those that are obfuscated
+        // fill those in and assert that they are masked
+        filteredObfuscatedFields.forEach(async (field) => {
+          await fillIn(PAGE.inputByAttr(field.name), 'blah');
+
+          assert
+            .dom(PAGE.inputByAttr(field.name))
+            .hasClass('masked-font', `it renders ${field.name} for ${destination} with masked font`);
+          assert
+            .dom(PAGE.form.enableInput(field.name))
+            .doesNotExist(`it does not render enable input for ${field.name}`);
+        });
+      });
+
       test('it saves destination and transitions to details', async function (assert) {
-        assert.expect(5);
+        this.generateForm(true, type);
+        assert.expect(4);
+
         const name = 'my-name';
-        this.server.post(`sys/sync/destinations/${type}/${name}`, (schema, req) => {
+        const path = `sys/sync/destinations/${type}/my-name`;
+
+        this.server.post(path, (schema, req) => {
           const payload = JSON.parse(req.requestBody);
-          assert.ok(true, `makes request: POST sys/sync/destinations/${type}/${name}`);
-          assert.notPropContains(payload, { name: 'my-name', type }, 'name and type do not exist in payload');
 
+          assert.ok(true, `makes request: POST ${path}`);
+          assert.notPropContains(payload, { name, type }, 'name and type do not exist in payload');
           // instead of looping through all attrs, just grab the second one (first is 'name')
-          const testAttr = this.model.formFields[1].name;
-          assert.propContains(
-            payload,
-            { [underscore(testAttr)]: `my-${testAttr}` },
-            'payload contains expected attrs'
-          );
+          const testAttr = this.formFields[1].name;
+          assert.propContains(payload, { [testAttr]: `my-${testAttr}` }, 'payload contains expected attrs');
           return payload;
         });
 
-        await this.renderFormComponent();
+        await this.renderComponent();
 
-        for (const attr of this.model.formFields) {
-          await PAGE.form.fillInByAttr(attr.name, `my-${attr.name}`);
+        for (const field of this.formFields) {
+          await PAGE.form.fillInByAttr(field.name, `my-${field.name}`);
         }
-        await click(PAGE.saveButton);
+        await click(GENERAL.submitButton);
         const actualArgs = this.transitionStub.lastCall.args;
         const expectedArgs = ['vault.cluster.sync.secrets.destinations.destination.details', type, name];
         assert.propEqual(actualArgs, expectedArgs, 'transitionTo called with expected args');
-        assert.propEqual(
-          this.clearDatasetStub.lastCall.args,
-          ['sync/destination'],
-          'Store dataset is cleared on create success'
-        );
       });
 
       test('it validates inputs', async function (assert) {
-        const warningValidations = ['teamId'];
-        const validationAssertions = this.model._validations;
-        // remove warning validations to
+        this.generateForm(true, type);
+
+        const warningValidations = ['team_id'];
+        const validationAssertions = { ...this.form.validations };
+        // remove warning validations
         warningValidations.forEach((warning) => {
           delete validationAssertions[warning];
         });
         assert.expect(Object.keys(validationAssertions).length);
 
-        await this.renderFormComponent();
-
-        await click(PAGE.saveButton);
+        await this.renderComponent();
+        await click(GENERAL.submitButton);
 
         // only asserts validations for presence, refactor if validations change
         for (const attr in validationAssertions) {
           const { message } = validationAssertions[attr].find((v) => v.type === 'presence');
-          assert.dom(PAGE.validation(attr)).hasText(message, `renders validation: ${message}`);
+          assert.dom(PAGE.validationErrorByAttr(attr)).hasText(message, `renders validation: ${message}`);
         }
       });
     });
   }
 
   // EDIT FORM ASSERTIONS FOR EACH DESTINATION TYPE
-  // * test updates: if editable, add param here
-  //  if it is not a string type, add case to EXPECTED_VALUE and update
-  //  fillInByAttr() (in sync-selectors) to interact with the form
-  const EDITABLE_FIELDS = {
-    'aws-sm': [
-      'accessKeyId',
-      'secretAccessKey',
-      'roleArn',
-      'externalId',
-      'granularity',
-      'secretNameTemplate',
-      'customTags',
-    ],
-    'azure-kv': ['clientId', 'clientSecret', 'granularity', 'secretNameTemplate', 'customTags'],
-    'gcp-sm': ['projectId', 'credentials', 'granularity', 'secretNameTemplate', 'customTags'],
-    gh: ['accessToken', 'granularity', 'secretNameTemplate'],
-    'vercel-project': [
-      'accessToken',
-      'teamId',
-      'deploymentEnvironments',
-      'granularity',
-      'secretNameTemplate',
-    ],
-  };
+  // if field is not string type, add case to EXPECTED_VALUE and update
+  // fillInByAttr() (in sync-selectors) to interact with the form
   const EXPECTED_VALUE = (key) => {
     switch (key) {
       case 'custom_tags':
@@ -305,56 +366,63 @@ module('Integration | Component | sync | Secrets::Page::Destinations::CreateAndE
   };
 
   for (const destination of SYNC_DESTINATIONS) {
-    const { type, maskedParams } = destination;
-    module(`edit destination: ${type}`, function (hooks) {
-      hooks.beforeEach(function () {
-        this.model = this.generateModel(type);
-      });
-
+    const { type, maskedParams, readonlyParams } = destination;
+    module(`edit destination: ${type}`, function () {
       test('it renders destination form and PATCH updates a destination', async function (assert) {
-        const disabledAssertions = this.model.formFields.filter((f) => f.options.editDisabled).length;
-        const editable = EDITABLE_FIELDS[this.model.type];
-        assert.expect(5 + disabledAssertions + editable.length);
-        this.server.patch(`sys/sync/destinations/${type}/${this.model.name}`, (schema, req) => {
-          assert.ok(true, `makes request: PATCH sys/sync/destinations/${type}/${this.model.name}`);
+        this.generateForm(false, type);
+
+        const [disabledAssertions, editable] = this.formFields.reduce(
+          (arr, field) => {
+            if (field.options.editDisabled) {
+              arr[0]++;
+            }
+            if (!readonlyParams.includes(field.name)) {
+              arr[1].push(field.name);
+            }
+            return arr;
+          },
+          [0, []]
+        );
+
+        assert.expect(4 + disabledAssertions + editable.length);
+
+        const path = `sys/sync/destinations/${type}/${this.form.name}`;
+        this.server.patch(path, (schema, req) => {
+          assert.ok(true, `makes request: PATCH ${path}`);
           const payload = JSON.parse(req.requestBody);
           const payloadKeys = Object.keys(payload);
-          const expectedKeys = editable.map((k) => decamelize(k));
+          const expectedKeys = editable.sort();
           assert.propEqual(payloadKeys, expectedKeys, `${type} payload only contains editable attrs`);
           expectedKeys.forEach((key) => {
-            assert.deepEqual(payload[key], EXPECTED_VALUE(key), `destination: ${type} updates key: ${key}`);
+            assert.propEqual(payload[key], EXPECTED_VALUE(key), `destination: ${type} updates key: ${key}`);
           });
           return { payload };
         });
 
-        await this.renderFormComponent();
-        assert.dom(PAGE.title).hasTextContaining(`Edit ${this.model.name}`);
+        await this.renderComponent(false, type);
 
-        for (const attr of this.model.formFields) {
-          if (editable.includes(attr.name)) {
-            if (maskedParams.includes(attr.name)) {
+        assert.dom(PAGE.title).hasTextContaining(`Edit ${this.form.name}`);
+
+        for (const field of this.formFields) {
+          if (editable.includes(field.name)) {
+            if (maskedParams.includes(field.name)) {
               // Enable inputs with sensitive values
-              await click(PAGE.form.enableInput(attr.name));
+              await click(PAGE.form.enableInput(field.name));
             }
-            await PAGE.form.fillInByAttr(attr.name, `new-${decamelize(attr.name)}-value`);
+            await PAGE.form.fillInByAttr(field.name, `new-${field.name}-value`);
           } else {
-            assert.dom(PAGE.inputByAttr(attr.name)).isDisabled(`${attr.name} is disabled`);
+            assert.dom(PAGE.inputByAttr(field.name)).isDisabled(`${field.name} is disabled`);
           }
         }
 
-        await click(PAGE.saveButton);
+        await click(GENERAL.submitButton);
         const actualArgs = this.transitionStub.lastCall.args;
         const expectedArgs = [
           'vault.cluster.sync.secrets.destinations.destination.details',
           type,
-          this.model.name,
+          this.form.name,
         ];
         assert.propEqual(actualArgs, expectedArgs, 'transitionTo called with expected args');
-        assert.propEqual(
-          this.clearDatasetStub.lastCall.args,
-          ['sync/destination'],
-          'Store dataset is cleared on create success'
-        );
       });
     });
   }
diff --git a/ui/tests/integration/components/sync/secrets/page/destinations/destination/details-test.js b/ui/tests/integration/components/sync/secrets/page/destinations/destination/details-test.js
index 95e6a79fc8f..be97b56b09b 100644
--- a/ui/tests/integration/components/sync/secrets/page/destinations/destination/details-test.js
+++ b/ui/tests/integration/components/sync/secrets/page/destinations/destination/details-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,9 +10,9 @@ import { setupMirage } from 'ember-cli-mirage/test-support';
 import hbs from 'htmlbars-inline-precompile';
 import { render } from '@ember/test-helpers';
 import { PAGE } from 'vault/tests/helpers/sync/sync-selectors';
-import { syncDestinations } from 'vault/helpers/sync-destinations';
+import { syncDestinations, findDestination } from 'vault/helpers/sync-destinations';
 import { toLabel } from 'vault/helpers/to-label';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { setupDataStubs } from 'vault/tests/helpers/sync/setup-hooks';
 
 const SYNC_DESTINATIONS = syncDestinations();
 module(
@@ -21,15 +21,12 @@ module(
     setupRenderingTest(hooks);
     setupEngine(hooks, 'sync');
     setupMirage(hooks);
+    setupDataStubs(hooks);
 
     hooks.beforeEach(function () {
-      this.store = this.owner.lookup('service:store');
-
-      this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
-
-      this.renderFormComponent = () => {
+      this.renderComponent = () => {
         return render(
-          hbs` <Secrets::Page::Destinations::Destination::Details @destination={{this.model}} />`,
+          hbs` <Secrets::Page::Destinations::Destination::Details @destination={{this.destination}} @capabilities={{this.capabilities}} />`,
           { owner: this.engine }
         );
       };
@@ -37,18 +34,8 @@ module(
 
     test('it renders toolbar with actions', async function (assert) {
       assert.expect(3);
-      const type = SYNC_DESTINATIONS[0].type;
-      const data = this.server.create('sync-destination', type);
-
-      const id = `${type}/${data.name}`;
-      data.id = id;
-      this.store.pushPayload(`sync/destinations/${type}`, {
-        modelName: `sync/destinations/${type}`,
-        ...data,
-      });
-      this.model = this.store.peekRecord(`sync/destinations/${type}`, id);
 
-      await this.renderFormComponent();
+      await this.renderComponent();
 
       assert.dom(PAGE.toolbar('Delete destination')).exists();
       assert.dom(PAGE.toolbar('Sync secrets')).exists();
@@ -60,68 +47,84 @@ module(
       const { type } = destination;
       module(`destination: ${type}`, function (hooks) {
         hooks.beforeEach(function () {
-          const data = this.server.create('sync-destination', type);
-
-          const id = `${type}/${data.name}`;
-          data.id = id;
-          this.store.pushPayload(`sync/destinations/${type}`, {
-            modelName: `sync/destinations/${type}`,
-            ...data,
-          });
-          this.model = this.store.peekRecord(`sync/destinations/${type}`, id);
-          const { maskedParams } = this.model;
-          this.maskedAttrs = this.model.formFields.filter((attr) => maskedParams.includes(attr.name));
-          this.unmaskedAttrs = this.model.formFields.filter((attr) => !maskedParams.includes(attr.name));
+          this.setupStubsForType(type);
+
+          const { name, connection_details, options } = this.destination;
+          this.details = { name, ...connection_details, ...options };
+          this.fields = Object.keys(this.details).reduce((arr, key) => {
+            const noCustomTags = ['gh', 'vercel-project'].includes(type) && key === 'custom_tags';
+            return noCustomTags ? arr : [...arr, key];
+          }, []);
+
+          const { maskedParams } = findDestination(type);
+          this.maskedParams = maskedParams;
+
+          this.getLabel = (field) => {
+            const customLabel = {
+              granularity_level: 'Secret sync granularity',
+              access_key_id: 'Access key ID',
+              role_arn: 'Role ARN',
+              external_id: 'External ID',
+              key_vault_uri: 'Key Vault URI',
+              client_id: 'Client ID',
+              tenant_id: 'Tenant ID',
+              project_id: 'Project ID',
+              credentials: 'JSON credentials',
+              team_id: 'Team ID',
+            }[field];
+
+            return customLabel || toLabel([field]);
+          };
         });
 
         test('it renders destination details with connection_details and options', async function (assert) {
-          assert.expect(this.model.formFields.length);
-
-          await this.renderFormComponent();
+          assert.expect(this.fields.length);
 
-          // these values are returned by the API masked: '*****'
-          this.maskedAttrs.forEach((attr) => {
-            const label = attr.options?.label || toLabel([attr.name]);
-            assert.dom(PAGE.infoRowValue(label)).hasText('Destination credentials added');
-          });
+          await this.renderComponent();
 
-          // assert the remaining model attributes render
-          this.unmaskedAttrs.forEach(({ name, options, type }) => {
-            let label, value;
-            if (type === 'object') {
-              [label] = Object.keys(this.model[name]);
-              [value] = Object.values(this.model[name]);
+          this.fields.forEach((field) => {
+            if (this.maskedParams.includes(field)) {
+              // these values are returned by the API masked: '*****'
+              const label = this.getLabel(field);
+              assert.dom(PAGE.infoRowValue(label)).hasText('Destination credentials added');
             } else {
-              label = options.label || toLabel([name]);
-              value = Array.isArray(this.model[name]) ? this.model[name].join(',') : this.model[name];
+              // assert the remaining model attributes render
+              const fieldValue = this.details[field];
+              let label, value;
+              if (field === 'custom_tags') {
+                [label] = Object.keys(fieldValue);
+                [value] = Object.values(fieldValue);
+              } else {
+                label = this.getLabel(field);
+                value = Array.isArray(fieldValue) ? fieldValue.join(',') : fieldValue;
+              }
+              assert.dom(PAGE.infoRowValue(label)).hasText(value);
             }
-            assert.dom(PAGE.infoRowValue(label)).hasText(value);
           });
         });
 
         test('it renders destination details without connection_details or options', async function (assert) {
-          assert.expect(this.maskedAttrs.length + 4);
+          assert.expect(this.maskedParams.length + 4);
 
-          this.maskedAttrs.forEach((attr) => {
+          this.maskedParams.forEach((param) => {
             // these values are undefined when environment variables are set
-            this.model[attr.name] = undefined;
+            this.destination.connection_details[param] = undefined;
           });
+
           // assert custom tags section header does not render
-          if (this.model?.get('customTags')) {
-            this.model['customTags'] = undefined;
-          }
+          this.destination.options.custom_tags = undefined;
 
-          await this.renderFormComponent();
+          await this.renderComponent();
 
           assert
             .dom(PAGE.destinations.details.sectionHeader)
             .doesNotExist('does not render Custom tags header');
-          assert.dom(PAGE.title).hasTextContaining(this.model.name);
-          assert.dom(PAGE.icon(this.model.icon)).exists();
-          assert.dom(PAGE.infoRowValue('Name')).hasText(this.model.name);
+          assert.dom(PAGE.title).hasTextContaining(this.destination.name);
+          assert.dom(PAGE.icon(findDestination(destination.type).icon)).exists();
+          assert.dom(PAGE.infoRowValue('Name')).hasText(this.destination.name);
 
-          this.maskedAttrs.forEach((attr) => {
-            const label = attr.options?.label || toLabel([attr.name]);
+          this.maskedParams.forEach((param) => {
+            const label = this.getLabel(param);
             assert.dom(PAGE.infoRowValue(label)).hasText('Using environment variable');
           });
         });
diff --git a/ui/tests/integration/components/sync/secrets/page/destinations/destination/secrets-test.js b/ui/tests/integration/components/sync/secrets/page/destinations/destination/secrets-test.js
index d0f4834fc50..699fab39aeb 100644
--- a/ui/tests/integration/components/sync/secrets/page/destinations/destination/secrets-test.js
+++ b/ui/tests/integration/components/sync/secrets/page/destinations/destination/secrets-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,13 +7,14 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { setupModels } from 'vault/tests/helpers/sync/setup-models';
+import syncHandler from 'vault/mirage/handlers/sync';
+import { setupDataStubs } from 'vault/tests/helpers/sync/setup-hooks';
 import hbs from 'htmlbars-inline-precompile';
 import { click, render } from '@ember/test-helpers';
 import sinon from 'sinon';
+import { Response } from 'miragejs';
 
 import { PAGE } from 'vault/tests/helpers/sync/sync-selectors';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
 
 module(
   'Integration | Component | sync | Secrets::Page::Destinations::Destination::Secrets',
@@ -21,15 +22,16 @@ module(
     setupRenderingTest(hooks);
     setupEngine(hooks, 'sync');
     setupMirage(hooks);
-    setupModels(hooks);
+    setupDataStubs(hooks);
 
     hooks.beforeEach(async function () {
-      this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
+      syncHandler(this.server);
       sinon.stub(this.owner.lookup('service:router'), 'transitionTo');
 
       await render(
         hbs`
         <Secrets::Page::Destinations::Destination::Secrets
+          @capabilities={{this.capabilities}}
           @destination={{this.destination}}
           @associations={{this.associations}}
         />
@@ -39,7 +41,7 @@ module(
     });
 
     test('it should render DestinationHeader component', async function (assert) {
-      assert.dom(PAGE.title).includesText('us-west-1', 'DestinationHeader component renders');
+      assert.dom(PAGE.title).includesText('destination-aws', 'DestinationHeader component renders');
     });
 
     test('it should render empty list state', async function (assert) {
@@ -66,11 +68,14 @@ module(
     test('it should render list item menu actions', async function (assert) {
       assert.expect(5);
 
-      this.server.post('/sys/sync/destinations/aws-sm/us-west-1/associations/:action', (schema, req) => {
-        const { action } = req.params;
-        const operation = { set: 'sync', remove: 'unsync' }[action] || null;
-        assert.ok(operation, `Request made to ${operation} secret`);
-      });
+      this.server.post(
+        '/sys/sync/destinations/aws-sm/destination-aws/associations/:action',
+        (schema, req) => {
+          const { action } = req.params;
+          const operation = { set: 'sync', remove: 'unsync' }[action] || null;
+          assert.ok(operation, `Request made to ${operation} secret`);
+        }
+      );
 
       await click(PAGE.menuTrigger);
 
@@ -84,5 +89,55 @@ module(
       await click(menu.unsync);
       await click(PAGE.confirmButton);
     });
+
+    module('flash messages', function (hooks) {
+      hooks.beforeEach(function () {
+        const flashMessages = this.owner.lookup('service:flash-messages');
+
+        this.flashSuccessSpy = sinon.spy(flashMessages, 'success');
+        this.flashDangerSpy = sinon.spy(flashMessages, 'danger');
+      });
+
+      test('unsync should render flash messages', async function (assert) {
+        await click(PAGE.menuTrigger);
+
+        const { menu } = PAGE.associations.list;
+        await click(menu.unsync);
+        await click(PAGE.confirmButton);
+
+        assert.true(
+          this.flashSuccessSpy.calledWith('Unsync operation initiated.'),
+          'Success message is displayed'
+        );
+        assert.true(this.flashDangerSpy.notCalled);
+      });
+
+      test('sync now should render flash messages', async function (assert) {
+        await click(PAGE.menuTrigger);
+
+        const { menu } = PAGE.associations.list;
+        await click(menu.sync);
+
+        assert.true(
+          this.flashSuccessSpy.calledWith('Sync operation initiated.'),
+          'Success message is displayed'
+        );
+        assert.true(this.flashDangerSpy.notCalled);
+      });
+
+      test('it should show an error message when sync fails', async function (assert) {
+        this.server.post('/sys/sync/destinations/:type/:name/associations/set', () => {
+          return new Response(500);
+        });
+
+        await click(PAGE.menuTrigger);
+
+        const { menu } = PAGE.associations.list;
+        await click(menu.sync);
+
+        assert.true(this.flashSuccessSpy.notCalled);
+        assert.true(this.flashDangerSpy.calledOnce);
+      });
+    });
   }
 );
diff --git a/ui/tests/integration/components/sync/secrets/page/destinations/destination/sync-test.js b/ui/tests/integration/components/sync/secrets/page/destinations/destination/sync-test.js
index 596560d7865..22c3810a362 100644
--- a/ui/tests/integration/components/sync/secrets/page/destinations/destination/sync-test.js
+++ b/ui/tests/integration/components/sync/secrets/page/destinations/destination/sync-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,40 +7,38 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { setupModels } from 'vault/tests/helpers/sync/setup-models';
+import { setupDataStubs } from 'vault/tests/helpers/sync/setup-hooks';
 import hbs from 'htmlbars-inline-precompile';
-import { render, click, fillIn, settled } from '@ember/test-helpers';
+import { render, click, fillIn } from '@ember/test-helpers';
 import { PAGE } from 'vault/tests/helpers/sync/sync-selectors';
-import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
-import { selectChoose } from 'ember-power-select/test-support/helpers';
-import sinon from 'sinon';
+import { selectChoose } from 'ember-power-select/test-support';
 import { Response } from 'miragejs';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import sinon from 'sinon';
 
 const { destinations, searchSelect, messageError, kvSuggestion } = PAGE;
-const { mountSelect, mountInput, submit, cancel, successMessage } = destinations.sync;
+const { mountSelect, mountInput, successMessage } = destinations.sync;
 
 module('Integration | Component | sync | Secrets::Page::Destinations::Destination::Sync', function (hooks) {
   setupRenderingTest(hooks);
   setupEngine(hooks, 'sync');
   setupMirage(hooks);
-  setupModels(hooks);
+  setupDataStubs(hooks);
 
   hooks.beforeEach(async function () {
-    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
-
-    this.server.get('/sys/internal/ui/mounts', () => ({
-      data: { secret: { 'my-kv/': { type: 'kv', options: { version: '2' } } } },
-    }));
-    this.server.get('/my-kv/metadata', () => ({
-      data: { keys: ['my-path/', 'my-secret'] },
-    }));
-    this.server.get('/my-kv/metadata/my-path', () => ({
-      data: { keys: ['nested-secret'] },
-    }));
+    const api = this.owner.lookup('service:api');
+    this.mountsStub = sinon
+      .stub(api.sys, 'internalUiListEnabledVisibleMounts')
+      .resolves({ secret: { 'my-kv/': { type: 'kv', options: { version: '2' } } } });
 
-    await render(hbs`<Secrets::Page::Destinations::Destination::Sync @destination={{this.destination}} />`, {
-      owner: this.engine,
-    });
+    this.secretsStub = sinon.stub(api.secrets, 'kvV2List').resolves({ keys: ['my-path/', 'my-secret'] });
+
+    await render(
+      hbs`<Secrets::Page::Destinations::Destination::Sync @destination={{this.destination}} @capabilities={{this.capabilities}} />`,
+      {
+        owner: this.engine,
+      }
+    );
   });
 
   test('it should fetch and render kv mounts', async function (assert) {
@@ -62,6 +60,7 @@ module('Integration | Component | sync | Secrets::Page::Destinations::Destinatio
 
   test('it should render secret suggestions for nested paths', async function (assert) {
     await selectChoose(mountSelect, '.ember-power-select-option', 1);
+    this.secretsStub.resolves({ keys: ['nested-secret'] });
     await click(kvSuggestion.input);
     await click(searchSelect.option());
     assert
@@ -77,19 +76,18 @@ module('Integration | Component | sync | Secrets::Page::Destinations::Destinatio
       const data = JSON.parse(req.requestBody);
       const expected = { mount: 'my-kv', secret_name: 'my-secret' };
       assert.deepEqual(data, expected, 'Sync request made with mount and secret name');
-      return { data: { associated_secrets: {} } };
+      return { data: { associated_secrets: { 'my-kv_12345': data } } };
     });
-
-    assert.dom(submit).isDisabled('Submit button is disabled when mount is not selected');
-    assert.dom(cancel).hasText('Back', 'back button renders');
+    assert.dom(GENERAL.submitButton).isDisabled('Submit button is disabled when mount is not selected');
+    assert.dom(GENERAL.cancelButton).hasText('Back', 'back button renders');
     await selectChoose(mountSelect, '.ember-power-select-option', 1);
-    assert.dom(submit).isDisabled('Submit button is disabled when secret is not selected');
+    assert.dom(GENERAL.submitButton).isDisabled('Submit button is disabled when secret is not selected');
     await click(kvSuggestion.input);
     await click(searchSelect.option(1));
-    await click(submit);
-    assert.dom(cancel).hasText('View synced secrets', 'view secrets tertiary renders');
+    await click(GENERAL.submitButton);
+    assert.dom(GENERAL.cancelButton).hasText('View synced secrets', 'view secrets tertiary renders');
     assert.dom(kvSuggestion.input).hasNoValue('Secret path is unset after submit success');
-    assert.dom(submit).isDisabled('Submit button is disabled');
+    assert.dom(GENERAL.submitButton).isDisabled('Submit button is disabled');
     assert
       .dom(successMessage)
       .includesText('Sync operation successfully initiated for my-secret.', 'Success banner renders');
@@ -100,9 +98,7 @@ module('Integration | Component | sync | Secrets::Page::Destinations::Destinatio
   test('it should allow manual mount path input if kv mounts are not returned', async function (assert) {
     assert.expect(1);
 
-    this.server.get('/sys/internal/ui/mounts', () => ({
-      data: { secret: { 'cubbyhole/': { type: 'cubbyhole' } } },
-    }));
+    this.mountsStub.resolves({ secret: { 'cubbyhole/': { type: 'cubbyhole' } } });
 
     const { type, name } = this.destination;
     this.server.post(`/sys/sync/destinations/${type}/${name}/associations/set`, (schema, req) => {
@@ -119,7 +115,7 @@ module('Integration | Component | sync | Secrets::Page::Destinations::Destinatio
     await fillIn(mountInput, 'my-kv');
     await click(kvSuggestion.input);
     await click(searchSelect.option(1));
-    await click(submit);
+    await click(GENERAL.submitButton);
   });
 
   test('it should render alert banner on sync error', async function (assert) {
@@ -134,29 +130,7 @@ module('Integration | Component | sync | Secrets::Page::Destinations::Destinatio
     await selectChoose(mountSelect, '.ember-power-select-option', 1);
     await click(kvSuggestion.input);
     await click(searchSelect.option(1));
-    await click(submit);
-
+    await click(GENERAL.submitButton);
     assert.dom(messageError).hasTextContaining(error, 'Error renders in alert banner');
   });
-
-  test('it should clear sync associations from store in willDestroy hook', async function (assert) {
-    const clearDatasetStub = sinon.stub(this.store, 'clearDataset');
-
-    this.renderComponent = true;
-    await render(
-      hbs`
-      {{#if this.renderComponent}}
-        <Secrets::Page::Destinations::Destination::Sync @destination={{this.destination}} />
-      {{/if}}
-    `,
-      { owner: this.engine }
-    );
-    this.set('renderComponent', false);
-    await settled();
-
-    assert.true(
-      clearDatasetStub.calledWith('sync/association'),
-      'Sync associations are cleared from store on component teardown'
-    );
-  });
 });
diff --git a/ui/tests/integration/components/sync/secrets/page/destinations/select-type-test.js b/ui/tests/integration/components/sync/secrets/page/destinations/select-type-test.js
index 2d263a84353..8c4af7abd2c 100644
--- a/ui/tests/integration/components/sync/secrets/page/destinations/select-type-test.js
+++ b/ui/tests/integration/components/sync/secrets/page/destinations/select-type-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/sync/secrets/page/overview-test.js b/ui/tests/integration/components/sync/secrets/page/overview-test.js
index ea93bbde205..fb1e2a9a8b1 100644
--- a/ui/tests/integration/components/sync/secrets/page/overview-test.js
+++ b/ui/tests/integration/components/sync/secrets/page/overview-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,25 +8,18 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { setupEngine } from 'ember-engines/test-support';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { render, click, settled } from '@ember/test-helpers';
+import { render, click, settled, findAll } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import syncScenario from 'vault/mirage/scenarios/sync';
 import syncHandlers from 'vault/mirage/handlers/sync';
+import sinon from 'sinon';
 import { PAGE } from 'vault/tests/helpers/sync/sync-selectors';
 import { Response } from 'miragejs';
 import { dateFormat } from 'core/helpers/date-format';
+import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
+import { listDestinationsTransform } from 'sync/utils/api-transforms';
 
-const {
-  title,
-  breadcrumb,
-  tab,
-  overviewCard,
-  cta,
-  overview,
-  pagination,
-  emptyStateTitle,
-  emptyStateMessage,
-} = PAGE;
+const { title, tab, overviewCard, cta, overview, emptyStateTitle, emptyStateMessage } = PAGE;
 
 module('Integration | Component | sync | Page::Overview', function (hooks) {
   setupRenderingTest(hooks);
@@ -34,54 +27,268 @@ module('Integration | Component | sync | Page::Overview', function (hooks) {
   setupMirage(hooks);
 
   hooks.beforeEach(async function () {
+    // allow capabilities as root by default to allow users to POST to the secrets-sync/activate endpoint
+    this.server.post('/sys/capabilities-self', allowAllCapabilitiesStub());
     this.version = this.owner.lookup('service:version');
-    this.version.type = 'enterprise';
+    this.api = this.owner.lookup('service:api');
+    this.flags = this.owner.lookup('service:flags');
+
     syncScenario(this.server);
     syncHandlers(this.server);
 
-    const store = this.owner.lookup('service:store');
-    this.destinations = await store.query('sync/destination', {});
+    const destinations = await this.api.sys.systemListSyncDestinations(true);
+    this.destinations = listDestinationsTransform(destinations);
 
-    await render(
-      hbs`<Secrets::Page::Overview @destinations={{this.destinations}} @totalVaultSecrets={{7}} />`,
-      {
-        owner: this.engine,
-      }
-    );
-  });
+    this.setup = ({
+      canActivate = false,
+      isActivated = false,
+      isHvdManaged = false,
+      isEnterprise = false,
+      hasFeature = false,
+      hasDestinations = false,
+    } = {}) => {
+      // permissions are checked in the route model and passed to the page component
+      this.canActivate = canActivate;
 
-  test('it should render landing cta component for community', async function (assert) {
-    this.version.type = 'community';
-    this.set('destinations', []);
-    await settled();
-    assert.dom(title).hasText('Secrets Sync Enterprise feature', 'Page title renders');
-    assert.dom(cta.button).doesNotExist('Create first destination button does not render');
+      // sync has to be activated to use the feature
+      this.flags.activatedFlags = isActivated ? ['secrets-sync'] : [];
+
+      // cluster is HVD managed
+      this.flags.featureFlags = isHvdManaged ? ['VAULT_CLOUD_ADMIN_NAMESPACE'] : [];
+
+      // cluster is an enterprise version, HVD managed clusters are also enterprise
+      this.version.type = isEnterprise || isHvdManaged ? 'enterprise' : 'community';
+
+      // self-managed enterprise clusters need to have the sync feature on the license
+      // (does not apply to HVD managed clusters)
+      this.version.features = isEnterprise && hasFeature ? ['Secrets Sync'] : [];
+
+      if (!hasDestinations) this.destinations = [];
+    };
+
+    this.renderComponent = () => {
+      return render(
+        hbs`<Secrets::Page::Overview
+        @destinations={{this.destinations}}
+        @totalVaultSecrets={{7}}
+        @canActivateSecretsSync={{this.canActivate}} />`,
+        { owner: this.engine }
+      );
+    };
   });
 
-  test('it should render landing cta component for enterprise', async function (assert) {
-    this.set('destinations', []);
-    await settled();
-    assert.dom(title).hasText('Secrets Sync Beta', 'Page title renders');
-    assert.dom(cta.button).hasText('Create first destination', 'CTA action renders');
-    assert.dom(cta.summary).exists('CTA renders');
+  // navigating to this route is hidden for CE, but if for some reason this template were to show...
+  test('it should hide opt-in banner for community', async function (assert) {
+    this.setup();
+    await this.renderComponent();
+    assert.dom(overview.optInBanner.container).doesNotExist();
+    assert.dom(cta.summary).exists();
   });
 
-  test('it should render header, tabs and toolbar for overview state', async function (assert) {
-    assert.dom(title).hasText('Secrets Sync Beta', 'Page title renders');
-    assert.dom(breadcrumb).exists({ count: 1 }, 'Correct number of breadcrumbs render');
-    assert.dom(breadcrumb).includesText('Secrets Sync', 'Top level breadcrumb renders');
-    assert.dom(cta.button).doesNotExist('CTA does not render');
+  test('it should render header, tabs and toolbar for overview state if destinations exist', async function (assert) {
+    this.setup({
+      isActivated: true,
+      isEnterprise: true,
+      hasFeature: true,
+      hasDestinations: true,
+    });
+    await this.renderComponent();
+
+    assert.dom(title).hasText('Secrets Sync', 'Page title renders');
+    assert.dom(cta.summary).doesNotExist('CTA does not render');
     assert.dom(tab('Overview')).hasText('Overview', 'Overview tab renders');
     assert.dom(tab('Destinations')).hasText('Destinations', 'Destinations tab renders');
     assert.dom(overview.createDestination).hasText('Create new destination', 'Toolbar action renders');
   });
 
-  test('it should render secrets by destination table', async function (assert) {
+  // HVD MANAGED CLUSTERS
+  test('it should show the opt-in banner if feature is not activated', async function (assert) {
+    this.setup({ isHvdManaged: true });
+    await this.renderComponent();
+
+    assert.dom(overview.optInBanner.container).exists('Opt-in banner is shown');
+  });
+
+  test('it should show CTA if feature is activated', async function (assert) {
+    this.setup({ isActivated: true, isHvdManaged: true });
+    await this.renderComponent();
+
+    assert.dom(overview.optInBanner.container).doesNotExist('Opt-in banner is not shown');
+    assert.dom(title).hasText('Secrets Sync Plus feature');
+    assert.dom(cta.button).hasText('Create first destination', 'CTA action renders');
+    assert.dom(cta.summary).exists();
+  });
+
+  test('it should show activation error if cluster is not Plus tier', async function (assert) {
+    this.setup({ canActivate: true, isHvdManaged: true });
+    await this.renderComponent();
+
+    this.server.post(
+      '/sys/activation-flags/secrets-sync/activate',
+      () => new Response(403, {}, { errors: ['Something bad happened'] })
+    );
+
+    await click(overview.optInBanner.enable);
+    await click(overview.activationModal.checkbox);
+    await click(overview.activationModal.confirm);
+
+    assert.dom(overview.optInError).exists({ count: 2 }, 'shows the API and custom tier error banners');
+
+    const errorBanners = findAll(overview.optInError);
+
+    assert.dom(errorBanners[0]).containsText('Something bad happened', 'shows the API error message');
+
+    assert
+      .dom(errorBanners[1])
+      .containsText(
+        'Error Secrets Sync is available for Plus tier clusters only. Please check the tier of your cluster to enable Secrets Sync.',
+        'shows the custom tier-related error message'
+      );
+
+    assert.dom(overview.optInBanner.container).exists('banner is visible so user can try to opt-in again');
+  });
+
+  // ENTERPRISE CLUSTERS
+  test('it should show create CTA if activated and license has the secrets sync feature', async function (assert) {
+    this.setup({ isActivated: true, isEnterprise: true, hasFeature: true });
+
+    this.version.features = ['Secrets Sync'];
+    this.isActivated = true;
+    await this.renderComponent();
+
+    assert.dom(title).hasText('Secrets Sync');
+    assert.dom(cta.button).hasText('Create first destination', 'CTA action renders');
+    assert.dom(cta.summary).exists();
+  });
+
+  test('it should show the opt-in banner without permissions to activate', async function (assert) {
+    this.setup({ isEnterprise: true, hasFeature: true });
+    await this.renderComponent();
+
+    assert
+      .dom(overview.optInBanner.description)
+      .hasText(
+        'To use this feature, specific activation is required. Please contact your administrator to activate.'
+      );
+    assert.dom(overview.optInBanner.enable).doesNotExist('Opt-in enable button does not show');
+    assert.dom(overview.optInBanner.dismiss).doesNotExist('dismiss opt-in banner does not show');
+  });
+
+  test('it should show the opt-in banner with activate description with permissions to activate', async function (assert) {
+    this.setup({ canActivate: true, isEnterprise: true, hasFeature: true });
+    await this.renderComponent();
+
+    assert.dom(overview.optInBanner.container).exists('Opt-in banner is shown');
+    assert
+      .dom(overview.optInBanner.description)
+      .hasText(
+        "To use this feature, specific activation is required. Please review the feature documentation and enable it. If you're upgrading from beta, your previous data will be accessible after activation."
+      );
+    assert.dom(overview.optInBanner.dismiss).exists('dismiss opt-in banner shows');
+  });
+
+  test('it should navigate to the opt-in modal', async function (assert) {
+    this.setup({ canActivate: true, isEnterprise: true, hasFeature: true });
+    await this.renderComponent();
+
+    await click(overview.optInBanner.enable);
+
+    assert.dom(overview.activationModal.container).exists('Opt-in modal is shown');
+  });
+
+  test('it shows an error if activation fails', async function (assert) {
+    this.setup({ canActivate: true, isEnterprise: true, hasFeature: true });
+    await this.renderComponent();
+
+    this.server.post(
+      '/sys/activation-flags/secrets-sync/activate',
+      () => new Response(403, {}, { errors: ['Something bad happened'] })
+    );
+
+    await click(overview.optInBanner.enable);
+    await click(overview.activationModal.checkbox);
+    await click(overview.activationModal.confirm);
+
+    assert
+      .dom(overview.optInError)
+      .exists({ count: 1 })
+      .containsText('Something bad happened', 'shows an error banner with error message from the API');
+    assert.dom(overview.optInBanner.container).exists('banner is visible so user can try to opt-in again');
+  });
+
+  test('it should clear activation errors when the user tries to opt-in again', async function (assert) {
+    this.setup({ canActivate: true, isEnterprise: true, hasFeature: true });
+    // don't worry about transitioning the route in this test
+    sinon.stub(this.owner.lookup('service:router'), 'refresh');
+
+    await this.renderComponent();
+
+    let callCount = 0;
+
+    // first call fails, second call succeeds
+    this.server.post('/sys/activation-flags/secrets-sync/activate', () => {
+      callCount++;
+      if (callCount === 1) {
+        return new Response(403, {}, { errors: ['Something bad happened'] });
+      } else {
+        return {};
+      }
+    });
+
+    await click(overview.optInBanner.enable);
+    await click(overview.activationModal.checkbox);
+    await click(overview.activationModal.confirm);
+
+    assert.dom(overview.optInError).exists('shows an error banner');
+
+    await click(overview.optInBanner.enable);
+    await click(overview.activationModal.checkbox);
+    await click(overview.activationModal.confirm);
+
+    assert.dom(overview.optInError).doesNotExist('error banner is cleared upon trying to opt-in again');
+  });
+
+  test('it should show a CTA if activated and no destinations', async function (assert) {
+    this.setup({ isActivated: true, isEnterprise: true, hasFeature: true });
+    await this.renderComponent();
+
+    assert.dom(overview.optInBanner.container).doesNotExist();
+    assert.dom(cta.button).exists();
+
+    assert
+      .dom(overview.createDestination)
+      .doesNotExist('create new destination link is hidden if there are no pre-existing destinations');
+    assert
+      .dom(overviewCard.title('Secrets by destination'))
+      .doesNotExist('it does not show secrets by destination card if there are no destinations');
+    assert
+      .dom(overviewCard.title('Total destinations'))
+      .doesNotExist('it does not show total destinations card if there are no destinations');
+    assert
+      .dom(overviewCard.title('Total secrets'))
+      .doesNotExist('it does not show total secrets card if there are no destinations');
+  });
+
+  // WITH DESTINATIONS
+  test('it should show the overview cards when destinations exist', async function (assert) {
+    this.setup({ isActivated: true, isEnterprise: true, hasFeature: true, hasDestinations: true });
+    await this.renderComponent();
+
+    assert.dom(overviewCard.title('Secrets by destination')).exists();
+    assert.dom(overviewCard.title('Total destinations')).exists();
+    assert.dom(overviewCard.title('Total secrets')).exists();
+  });
+
+  test('it should show the table with correct columns, data, badges, and actions', async function (assert) {
+    this.setup({ isActivated: true, isEnterprise: true, hasFeature: true, hasDestinations: true });
     const { icon, name, badge, total, updated, actionToggle, action } = overview.table;
     const updatedDate = dateFormat(
       [new Date('2023-09-20T10:51:53.961861096-04:00'), 'MMMM do yyyy, h:mm:ss a'],
       {}
     );
+
+    await this.renderComponent();
+
     assert
       .dom(overviewCard.title('Secrets by destination'))
       .hasText('Secrets by destination', 'Overview card title renders for table');
@@ -109,53 +316,60 @@ module('Integration | Component | sync | Page::Overview', function (hooks) {
     assert.dom(action('details')).hasText('View synced secrets', 'View synced secrets action renders');
   });
 
-  test('it should paginate secrets by destination table', async function (assert) {
+  test('it should paginate the table', async function (assert) {
+    this.setup({ isActivated: true, isEnterprise: true, hasFeature: true, hasDestinations: true });
+    await this.renderComponent();
+
     const { name, row } = overview.table;
     assert.dom(row).exists({ count: 3 }, 'Correct number of table rows render based on page size');
     assert.dom(name(0)).hasText('destination-aws', 'First destination renders on page 1');
 
-    await click(pagination.next);
+    await click(PAGE.nextPage);
     await settled();
     assert.dom(overview.table.row).exists({ count: 3 }, 'New items are fetched and rendered on page change');
     assert.dom(name(0)).hasText('destination-gcp', 'First destination renders on page 2');
   });
 
-  test('it should display empty state for secrets by destination table', async function (assert) {
+  test('it should show an empty state if there is an error fetching associations', async function (assert) {
+    this.setup({ isActivated: true, isEnterprise: true, hasFeature: true, hasDestinations: true });
     this.server.get('/sys/sync/destinations/:type/:name/associations', () => {
       return new Response(403, {}, { errors: ['Permission denied'] });
     });
-    // since the request resolved trigger a page change and return an error from the associations endpoint
-    await click(pagination.next);
-    await settled();
+
+    await this.renderComponent();
+
     assert.dom(emptyStateTitle).hasText('Error fetching information', 'Empty state title renders');
     assert
       .dom(emptyStateMessage)
       .hasText('Ensure that the policy has access to read sync associations.', 'Empty state message renders');
   });
 
-  test('it should render totals cards', async function (assert) {
-    const { title, description, action, content } = overviewCard;
+  test('it should show the Totals cards', async function (assert) {
+    this.setup({ isActivated: true, isEnterprise: true, hasFeature: true, hasDestinations: true });
+    await this.renderComponent();
+
+    const { title, description, actionLink, content } = overviewCard;
     const cardData = [
       {
         cardTitle: 'Total destinations',
-        subText: 'The total number of connected destinations',
+        subText: 'The total number of connected destinations.',
         actionText: 'Create new',
         count: '6',
       },
       {
         cardTitle: 'Total secrets',
-        subText: 'The total number of secrets synced from Vault.',
-        // actionText: 'View billing',
+        subText:
+          'The total number of secrets that have been synced from Vault over time. One secret will be counted as one sync client.',
+        actionText: 'View billing',
         count: '7',
       },
     ];
 
     cardData.forEach(({ cardTitle, subText, actionText, count }) => {
-      assert.dom(title(cardTitle)).hasText(cardTitle, 'Overview card title renders');
-      assert.dom(description(cardTitle)).hasText(subText, 'Destinations overview card description renders');
+      assert.dom(title(cardTitle)).hasText(cardTitle, `${cardTitle} card title renders`);
+      assert.dom(description(cardTitle)).hasText(subText, ` ${cardTitle} card description renders`);
       assert.dom(content(cardTitle)).hasText(count, 'Total count renders');
-      if (cardTitle === 'Total secrets') return; // uncomment 'actionText' above and this return after SYNC BETA
-      assert.dom(action(cardTitle)).hasText(actionText, 'Card action renders');
+      assert.dom(actionLink(cardTitle)).hasText(actionText, 'Card action renders');
     });
   });
 });
diff --git a/ui/tests/integration/components/sync/secrets/sync-activation-modal-test.js b/ui/tests/integration/components/sync/secrets/sync-activation-modal-test.js
new file mode 100644
index 00000000000..490c62bf1ad
--- /dev/null
+++ b/ui/tests/integration/components/sync/secrets/sync-activation-modal-test.js
@@ -0,0 +1,158 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupEngine } from 'ember-engines/test-support';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { render, click } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import sinon from 'sinon';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { PAGE } from 'vault/tests/helpers/sync/sync-selectors';
+
+const SELECTORS = PAGE.overview.activationModal;
+
+module('Integration | Component | Secrets::SyncActivationModal', function (hooks) {
+  setupRenderingTest(hooks);
+  setupEngine(hooks, 'sync');
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.onClose = sinon.stub();
+    this.onError = sinon.stub();
+    this.onConfirm = sinon.stub();
+
+    this.renderComponent = async () => {
+      await render(
+        hbs`
+      <Secrets::SyncActivationModal @onClose={{this.onClose}} @onError={{this.onError}} @onConfirm={{this.onConfirm}}/>
+    `,
+        { owner: this.engine }
+      );
+    };
+  });
+
+  test('it renders with correct text', async function (assert) {
+    await this.renderComponent();
+
+    assert
+      .dom(SELECTORS.container)
+      .hasTextContaining(
+        "By enabling the Secrets Sync feature you may incur additional costs. Please review our documentation to learn more. I've read the above linked document"
+      );
+  });
+
+  test('it calls onClose', async function (assert) {
+    await this.renderComponent();
+
+    await click(SELECTORS.cancel);
+
+    assert.true(this.onClose.called);
+  });
+
+  test('it disables submit until user has confirmed docs', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom(SELECTORS.checkbox).isNotChecked('checkbox is initially unchecked');
+    assert.dom(SELECTORS.confirm).isDisabled('submit is disabled');
+    await click(SELECTORS.checkbox);
+
+    assert.dom(SELECTORS.checkbox).isChecked();
+    assert.dom(SELECTORS.confirm).isNotDisabled('submit is enabled once user has confirmed');
+  });
+
+  module('on submit', function (hooks) {
+    hooks.beforeEach(function () {
+      const router = this.owner.lookup('service:router');
+      this.refreshStub = sinon.stub(router, 'refresh');
+    });
+
+    test('it calls onConfirm', async function (assert) {
+      await this.renderComponent();
+
+      await click(SELECTORS.checkbox);
+      await click(SELECTORS.confirm);
+
+      assert.true(this.onConfirm.called);
+    });
+
+    module('success', function (hooks) {
+      hooks.beforeEach(function () {
+        this.server.post('/sys/activation-flags/secrets-sync/activate', () => {
+          return {};
+        });
+      });
+
+      test('HVD clusters: it calls the activate endpoint with correct namespace', async function (assert) {
+        this.flags = this.owner.lookup('service:flags');
+        this.flags.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+        assert.expect(1);
+
+        this.server.post('/sys/activation-flags/secrets-sync/activate', (_, req) => {
+          assert.strictEqual(
+            req.requestHeaders['x-vault-namespace'],
+            'admin',
+            'POST to secrets-sync/activate is called with admin namespace'
+          );
+          return {};
+        });
+
+        await this.renderComponent();
+
+        await click(SELECTORS.checkbox);
+        await click(SELECTORS.confirm);
+      });
+
+      test('non-HVD clusters: it calls the activate endpoint with no namespace', async function (assert) {
+        assert.expect(1);
+
+        this.server.post('/sys/activation-flags/secrets-sync/activate', (_, req) => {
+          assert.strictEqual(
+            req.requestHeaders['X-Vault-Namespace'],
+            undefined,
+            'POST to secrets-sync/activate is called with no namespace'
+          );
+          return {};
+        });
+
+        await this.renderComponent();
+
+        await click(SELECTORS.checkbox);
+        await click(SELECTORS.confirm);
+      });
+
+      test('it refreshes the sync overview route', async function (assert) {
+        await this.renderComponent();
+
+        await click(SELECTORS.checkbox);
+        await click(SELECTORS.confirm);
+
+        assert.true(this.refreshStub.called);
+      });
+    });
+
+    module('on error', function (hooks) {
+      hooks.beforeEach(function () {
+        this.server.post('/sys/activation-flags/secrets-sync/activate', () => {
+          return overrideResponse(403);
+        });
+
+        const flashMessages = this.owner.lookup('service:flash-messages');
+        this.flashDangerSpy = sinon.spy(flashMessages, 'danger');
+      });
+
+      test('it handles errors', async function (assert) {
+        await this.renderComponent();
+
+        await click(SELECTORS.checkbox);
+        await click(SELECTORS.confirm);
+
+        assert.true(this.onError.called, 'calls the onError arg');
+        assert.true(this.flashDangerSpy.called, 'triggers an error flash message');
+      });
+    });
+  });
+});
diff --git a/ui/tests/integration/components/sync/sync-header-test.js b/ui/tests/integration/components/sync/sync-header-test.js
index 263ada09198..556cb626f7b 100644
--- a/ui/tests/integration/components/sync/sync-header-test.js
+++ b/ui/tests/integration/components/sync/sync-header-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,7 +10,7 @@ import hbs from 'htmlbars-inline-precompile';
 import { render } from '@ember/test-helpers';
 import { PAGE } from 'vault/tests/helpers/sync/sync-selectors';
 
-const { breadcrumb, title } = PAGE;
+const { title, breadcrumb } = PAGE;
 
 module('Integration | Component | sync | SyncHeader', function (hooks) {
   setupRenderingTest(hooks);
@@ -18,7 +18,7 @@ module('Integration | Component | sync | SyncHeader', function (hooks) {
 
   hooks.beforeEach(function () {
     this.version = this.owner.lookup('service:version');
-    this.version.type = 'enterprise';
+    this.flags = this.owner.lookup('service:flags');
     this.title = 'Secrets Sync';
     this.renderComponent = () => {
       return render(hbs`<SyncHeader @title={{this.title}} @breadcrumbs={{this.breadcrumbs}} />`, {
@@ -27,27 +27,35 @@ module('Integration | Component | sync | SyncHeader', function (hooks) {
     };
   });
 
-  test('it should render default breadcrumb', async function (assert) {
-    await this.renderComponent();
-    assert.dom(breadcrumb).exists({ count: 1 }, 'Correct number of breadcrumbs render');
-    assert.dom(breadcrumb).includesText('Secrets Sync', 'renders default breadcrumb');
-  });
-
   test('it should render breadcrumbs', async function (assert) {
     this.breadcrumbs = [{ label: 'Destinations', route: 'destinations' }];
     await this.renderComponent();
     assert.dom(breadcrumb).includesText('Destinations', 'renders breadcrumb');
   });
 
-  test('it should just render title for enterprise version', async function (assert) {
-    await this.renderComponent();
-    assert.dom(title).hasText('Secrets Sync Beta');
+  module('ent', function (hooks) {
+    hooks.beforeEach(async function () {
+      this.version.type = 'enterprise';
+    });
+
+    test('it should render title if license has secrets sync feature', async function (assert) {
+      this.version.features = ['Secrets Sync'];
+      await this.renderComponent();
+
+      assert.dom(title).hasText('Secrets Sync');
+    });
   });
 
-  test('it should render title and promotional enterprise badge for community version', async function (assert) {
-    this.version.type = 'community';
-    await this.renderComponent();
-    assert.dom(title).hasText('Secrets Sync Enterprise feature');
+  module('managed', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.type = 'enterprise';
+      this.flags.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+    });
+
+    test('it should render title and plus badge', async function (assert) {
+      await this.renderComponent();
+      assert.dom(title).hasText('Secrets Sync Plus feature');
+    });
   });
 
   test('it should yield actions block', async function (assert) {
diff --git a/ui/tests/integration/components/text-file-test.js b/ui/tests/integration/components/text-file-test.js
index b857d3beb95..7d67ff1430d 100644
--- a/ui/tests/integration/components/text-file-test.js
+++ b/ui/tests/integration/components/text-file-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,15 +8,15 @@ import { setupRenderingTest } from 'vault/tests/helpers';
 import { click, fillIn, render, triggerEvent } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
 import sinon from 'sinon';
-import { componentPemBundle } from 'vault/tests/helpers/pki/values';
 import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const SELECTORS = {
   label: '[data-test-text-file-label]',
-  toggle: '[data-test-text-toggle]',
-  textarea: '[data-test-text-file-textarea]',
   fileUpload: '[data-test-text-file-input]',
 };
+const { componentPemBundle } = CERTIFICATES;
 module('Integration | Component | text-file', function (hooks) {
   setupRenderingTest(hooks);
 
@@ -30,7 +30,7 @@ module('Integration | Component | text-file', function (hooks) {
     await render(hbs`<TextFile @onChange={{this.onChange}} />`);
 
     assert.dom(SELECTORS.label).hasText('File', 'renders default label');
-    assert.dom(SELECTORS.toggle).exists({ count: 1 }, 'toggle exists');
+    assert.dom(GENERAL.textToggle).exists({ count: 1 }, 'toggle exists');
     assert.dom(SELECTORS.fileUpload).exists({ count: 1 }, 'File input shown');
   });
 
@@ -46,7 +46,7 @@ module('Integration | Component | text-file', function (hooks) {
     await render(hbs`<TextFile @onChange={{this.onChange}} @uploadOnly={{true}} />`);
 
     assert.dom(SELECTORS.label).doesNotExist('Label no longer rendered');
-    assert.dom(SELECTORS.toggle).doesNotExist('toggle no longer rendered');
+    assert.dom(GENERAL.textToggle).doesNotExist('toggle no longer rendered');
     assert.dom(SELECTORS.fileUpload).exists({ count: 1 }, 'File input shown');
   });
 
@@ -54,9 +54,9 @@ module('Integration | Component | text-file', function (hooks) {
     await render(hbs`<TextFile @onChange={{this.onChange}} />`);
 
     assert.dom(SELECTORS.fileUpload).exists({ count: 1 }, 'File input shown');
-    assert.dom(SELECTORS.textarea).doesNotExist('Texarea hidden');
-    await click(SELECTORS.toggle);
-    assert.dom(SELECTORS.textarea).exists({ count: 1 }, 'Textarea shown');
+    assert.dom(GENERAL.maskedInput).doesNotExist('Texarea hidden');
+    await click(GENERAL.textToggle);
+    assert.dom(GENERAL.maskedInput).exists({ count: 1 }, 'Textarea shown');
     assert.dom(SELECTORS.fileUpload).doesNotExist('File upload hidden');
   });
 
@@ -79,8 +79,8 @@ module('Integration | Component | text-file', function (hooks) {
     const PEM_BUNDLE = componentPemBundle;
 
     await render(hbs`<TextFile @onChange={{this.onChange}} />`);
-    await click(SELECTORS.toggle);
-    await fillIn(SELECTORS.textarea, PEM_BUNDLE);
+    await click(GENERAL.textToggle);
+    await fillIn(GENERAL.maskedInput, PEM_BUNDLE);
     assert.propEqual(
       this.onChange.lastCall.args[0],
       {
@@ -96,9 +96,7 @@ module('Integration | Component | text-file', function (hooks) {
     await render(hbs`<TextFile @onChange={{this.onChange}} />`);
 
     await triggerEvent(SELECTORS.fileUpload, 'change', { files: [this.file] });
-    assert
-      .dom('[data-test-field-validation="text-file"]')
-      .hasText('There was a problem uploading. Please try again.');
+    assert.dom(GENERAL.inlineAlert).hasText('There was a problem uploading. Please try again.');
     assert.propEqual(
       this.onChange.lastCall.args[0],
       {
diff --git a/ui/tests/integration/components/toggle-button-test.js b/ui/tests/integration/components/toggle-button-test.js
index b38c98079d3..ebf8917ed0a 100644
--- a/ui/tests/integration/components/toggle-button-test.js
+++ b/ui/tests/integration/components/toggle-button-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/toggle-test.js b/ui/tests/integration/components/toggle-test.js
index cd66b70b937..3392a34fb6b 100644
--- a/ui/tests/integration/components/toggle-test.js
+++ b/ui/tests/integration/components/toggle-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/token-expire-warning-test.js b/ui/tests/integration/components/token-expire-warning-test.js
index 4c1c70ecf06..2ae9318e1a0 100644
--- a/ui/tests/integration/components/token-expire-warning-test.js
+++ b/ui/tests/integration/components/token-expire-warning-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/tool-tip-test.js b/ui/tests/integration/components/tool-tip-test.js
deleted file mode 100644
index 2af816204af..00000000000
--- a/ui/tests/integration/components/tool-tip-test.js
+++ /dev/null
@@ -1,32 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupRenderingTest } from 'ember-qunit';
-import { render, triggerEvent } from '@ember/test-helpers';
-import hbs from 'htmlbars-inline-precompile';
-
-module('Integration | Component | tool-tip', function (hooks) {
-  setupRenderingTest(hooks);
-
-  test.skip('it should open and close on mouse enter and leave', async function (assert) {
-    await render(hbs`
-      <ToolTip as |T|>
-        <T.Trigger>
-          <span data-test-trigger>Trigger</span>
-        </T.Trigger>
-        <T.Content>
-          <span data-test-content>Tooltip</span>
-        </T.Content>
-      </ToolTip>
-    `);
-
-    assert.dom('[data-test-content]').doesNotExist('Tooltip is hidden');
-    await triggerEvent('[data-test-trigger]', 'mouseenter');
-    assert.dom('[data-test-content]').exists('Tooltip renders on mouse enter');
-    await triggerEvent('[data-test-content]', 'mouseleave');
-    assert.dom('[data-test-content]').doesNotExist('Tooltip is hidden on mouse leave');
-  });
-});
diff --git a/ui/tests/integration/components/toolbar-actions-test.js b/ui/tests/integration/components/toolbar-actions-test.js
index 9c1f0d4070a..e19cc2bba48 100644
--- a/ui/tests/integration/components/toolbar-actions-test.js
+++ b/ui/tests/integration/components/toolbar-actions-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/toolbar-filters-test.js b/ui/tests/integration/components/toolbar-filters-test.js
index d93eaa4f4de..508237b23ec 100644
--- a/ui/tests/integration/components/toolbar-filters-test.js
+++ b/ui/tests/integration/components/toolbar-filters-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/toolbar-link-test.js b/ui/tests/integration/components/toolbar-link-test.js
index c82dc0394ae..fda7ff08f9a 100644
--- a/ui/tests/integration/components/toolbar-link-test.js
+++ b/ui/tests/integration/components/toolbar-link-test.js
@@ -1,59 +1,34 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, triggerEvent } from '@ember/test-helpers';
-import { isPresent } from 'ember-cli-page-object';
-import hbs from 'htmlbars-inline-precompile';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | toolbar-link', function (hooks) {
   setupRenderingTest(hooks);
 
   test('it renders', async function (assert) {
     await render(hbs`<ToolbarLink @route="/secrets">Link</ToolbarLink>`);
-
-    assert.dom(this.element).hasText('Link');
-    assert.ok(isPresent('.toolbar-link'));
-    assert.ok(isPresent('.icon'));
+    assert.dom('.toolbar-link').hasText('Link');
+    assert.dom(GENERAL.icon('chevron-right')).exists('Default chevron right icon renders');
+    assert.dom(GENERAL.tooltip('toolbar-link')).doesNotExist('Tooltip is hidden when not provided');
   });
 
   test('it should render icons', async function (assert) {
-    assert.expect(2);
-
-    await render(hbs`
-      <ToolbarLink
-        @route="/secrets"
-        @type={{this.type}}
-      >
-        Test Link
-      </ToolbarLink>
-    `);
-
-    assert.dom('[data-test-icon="chevron-right"]').exists('Default chevron right icon renders');
-    this.set('type', 'add');
-    assert.dom('[data-test-icon="plus"]').exists('Icon can be overriden to show plus sign');
-  });
-
-  test('it should disable and show tooltip if provided', async function (assert) {
-    assert.expect(3);
-
     await render(hbs`
       <ToolbarLink
         @route="/secrets"
-        @disabled={{true}}
-        @disabledTooltip={{this.tooltip}}
+        @type='add'
       >
         Test Link
       </ToolbarLink>
     `);
 
-    assert.dom('a').hasClass('disabled', 'Link can be disabled');
-    assert.dom('[data-test-popup-menu-trigger]').doesNotExist('Tooltip is hidden when not provided');
-    this.set('tooltip', 'Test tooltip');
-    await triggerEvent('.ember-basic-dropdown-trigger', 'mouseenter');
-    assert.dom('[data-test-disabled-tooltip]').hasText(this.tooltip, 'Tooltip renders');
+    assert.dom(GENERAL.icon('plus')).exists('Icon can be overridden to show plus sign');
   });
 });
diff --git a/ui/tests/integration/components/toolbar-test.js b/ui/tests/integration/components/toolbar-test.js
index da366a2ef35..87be585658a 100644
--- a/ui/tests/integration/components/toolbar-test.js
+++ b/ui/tests/integration/components/toolbar-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/tools/hash-test.js b/ui/tests/integration/components/tools/hash-test.js
new file mode 100644
index 00000000000..14caf188d9a
--- /dev/null
+++ b/ui/tests/integration/components/tools/hash-test.js
@@ -0,0 +1,101 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { Response } from 'miragejs';
+import { click, fillIn, find, render, waitUntil } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { TOOLS_SELECTORS as TS } from 'vault/tests/helpers/tools-selectors';
+import sinon from 'sinon';
+
+module('Integration | Component | tools/hash', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.renderComponent = async () => {
+      await render(hbs`<Tools::Hash />`);
+    };
+  });
+
+  test('it renders form', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom('h1').hasText('Hash Data');
+    assert.dom(TS.toolsInput('hash-input')).hasValue('');
+    assert.dom('#algorithm').hasValue('sha2-256');
+    assert.dom('#format').hasValue('base64');
+    assert.dom(TS.toolsInput('sum')).doesNotExist();
+    assert.dom(GENERAL.button('Done')).doesNotExist();
+  });
+
+  test('it renders errors', async function (assert) {
+    this.server.post('sys/tools/hash', () => new Response(500, {}, { errors: ['Something is wrong'] }));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(GENERAL.messageError));
+    assert.dom(GENERAL.messageError).hasText('Error Something is wrong');
+  });
+
+  test('it submits with default values', async function (assert) {
+    const flashSpy = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
+    const sum = 'GmoKPULUXifIFSGPZx29CGSm8MFnBuk4SGPsmFlduGc=';
+    const data = {
+      algorithm: 'sha2-256',
+      format: 'base64',
+      input: 'blah',
+    };
+
+    this.server.post('sys/tools/hash', (schema, req) => {
+      assert.propEqual(JSON.parse(req.requestBody), data, `payload contains defaults: ${req.requestBody}`);
+      return { data: { sum } };
+    });
+
+    await this.renderComponent();
+
+    // test submit
+    await fillIn(TS.toolsInput('hash-input'), 'blah');
+    await click(GENERAL.submitButton);
+
+    // test sum view
+    await waitUntil(() => TS.toolsInput('sum'));
+    assert.true(flashSpy.calledWith('Hash was successful.'), 'it renders success flash');
+    assert.dom(TS.toolsInput('sum')).hasText(sum);
+    assert.dom('label').hasText('Sum');
+    assert.dom('#algorithm').doesNotExist();
+    assert.dom('#format').doesNotExist();
+
+    // test form reset clicking 'Done'
+    await click(GENERAL.button('Done'));
+    assert.dom('#algorithm').hasValue('sha2-256');
+    assert.dom('#format').hasValue('base64');
+    assert.dom(TS.toolsInput('hash-input')).hasValue('', 'inputs reset to default values');
+  });
+
+  test('it submits with updated values', async function (assert) {
+    const sum = '07a49af6947eaa5ddce0d40aa4584687a95f9c0be0d1d7df009d63da=';
+    const data = {
+      algorithm: 'sha2-224',
+      format: 'hex',
+      input: 'blah',
+    };
+
+    this.server.post('sys/tools/hash', (schema, req) => {
+      assert.propEqual(JSON.parse(req.requestBody), data, `payload has updated data: ${req.requestBody}`);
+      return { data: { sum } };
+    });
+
+    await this.renderComponent();
+
+    // submits updated values
+    await fillIn(TS.toolsInput('hash-input'), 'blah');
+    await fillIn('#algorithm', 'sha2-224');
+    await fillIn('#format', 'hex');
+    await click(GENERAL.submitButton);
+  });
+});
diff --git a/ui/tests/integration/components/tools/lookup-test.js b/ui/tests/integration/components/tools/lookup-test.js
new file mode 100644
index 00000000000..f95ab68075d
--- /dev/null
+++ b/ui/tests/integration/components/tools/lookup-test.js
@@ -0,0 +1,78 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { Response } from 'miragejs';
+import { click, fillIn, find, render, waitUntil } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { TOOLS_SELECTORS as TS } from 'vault/tests/helpers/tools-selectors';
+import { formatRFC3339, getYear } from 'date-fns';
+import sinon from 'sinon';
+
+module('Integration | Component | tools/lookup', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.renderComponent = async () => {
+      await render(hbs`
+    <Tools::Lookup />`);
+    };
+  });
+
+  test('it renders defaults', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom('h1').hasText('Lookup Token', 'Title renders');
+    assert.dom('label').hasText('Wrapped token');
+    assert.dom(TS.toolsInput('wrapping-token')).hasValue('');
+    assert.dom(GENERAL.button('Done')).doesNotExist();
+  });
+
+  test('it renders errors', async function (assert) {
+    this.server.post('sys/wrapping/lookup', () => new Response(500, {}, { errors: ['Something is wrong'] }));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(GENERAL.messageError));
+    assert.dom(GENERAL.messageError).hasText('Error Something is wrong', 'Error renders');
+  });
+
+  test('it submits', async function (assert) {
+    const flashSuccessSpy = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
+    // not stubbing the timestamp util here because this component uses the date-fns formatDistanceToNow method
+    // so we need an actual now date for testing (which is why we don't assert the timestamp below, just the day of the month)
+    const now = new Date();
+    const data = {
+      creation_path: 'sys/wrapping/wrap',
+      creation_time: formatRFC3339(now),
+      creation_ttl: 3.156e7, // one year in seconds
+    };
+    const token = 'token.OMZFbUurY0ppT2RTMGpRa0JOSUFqUzJUaGNqdWUQ6ooG';
+    this.server.post('sys/wrapping/lookup', (schema, req) => {
+      assert.propEqual(JSON.parse(req.requestBody), { token }, `payload trims token: ${req.requestBody}`);
+      return { data };
+    });
+    await this.renderComponent();
+    await fillIn(TS.toolsInput('wrapping-token'), `${token}   `);
+    await click(GENERAL.submitButton);
+
+    await waitUntil(() => find(GENERAL.infoRowValue('Creation path')));
+    assert.true(flashSuccessSpy.calledWith('Lookup was successful.'), 'it renders success flash');
+    assert.dom(GENERAL.infoRowValue('Creation path')).hasText(data.creation_path);
+    assert.dom(GENERAL.infoRowValue('Creation time')).hasText(now.toString());
+    assert.dom(GENERAL.infoRowValue('Creation TTL')).hasText(`${data.creation_ttl}`);
+    assert.dom(GENERAL.infoRowValue('Expiration date')).hasTextContaining(`${getYear(now) + 1}`);
+    assert.dom(GENERAL.infoRowValue('Expires in')).hasText('about 1 year');
+
+    // clicking done resets form
+    await click(GENERAL.button('Done'));
+    assert.dom('label').hasText('Wrapped token');
+    assert.dom(TS.toolsInput('wrapping-token')).hasValue('');
+    assert.dom(GENERAL.button('Done')).doesNotExist();
+  });
+});
diff --git a/ui/tests/integration/components/tools/random-test.js b/ui/tests/integration/components/tools/random-test.js
new file mode 100644
index 00000000000..fbc2b3695ec
--- /dev/null
+++ b/ui/tests/integration/components/tools/random-test.js
@@ -0,0 +1,92 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { Response } from 'miragejs';
+import { click, fillIn, find, render, waitUntil } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { TOOLS_SELECTORS as TS } from 'vault/tests/helpers/tools-selectors';
+import sinon from 'sinon';
+
+module('Integration | Component | tools/random', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.random_bytes = null;
+    this.bytes = 32;
+    this.format = 'base64';
+    this.renderComponent = async () => {
+      await render(hbs`<Tools::Random />`);
+    };
+  });
+
+  test('it renders defaults', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom('h1').hasText('Random Bytes', 'Title renders');
+    assert.dom('#bytes').hasValue('32');
+    assert.dom('#format').hasValue('base64');
+    assert.dom(GENERAL.submitButton).hasText('Generate');
+    assert.dom(TS.toolsInput('random-bytes')).doesNotExist();
+    assert.dom(GENERAL.button('Done')).doesNotExist();
+  });
+
+  test('it renders errors', async function (assert) {
+    this.server.post('sys/tools/random', () => new Response(500, {}, { errors: ['Something is wrong'] }));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(GENERAL.messageError));
+    assert.dom(GENERAL.messageError).hasText('Error Something is wrong');
+  });
+
+  test('it submits with default values', async function (assert) {
+    const flashSpy = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
+    const random_bytes = 'ekZtsOvSOvKEPUmJohRj1nwONQ1XafwcXGZEwy/0nbY==';
+    const data = { format: 'base64', bytes: 32 };
+
+    this.server.post('sys/tools/random', (schema, req) => {
+      assert.propEqual(JSON.parse(req.requestBody), data, `payload contains defaults: ${req.requestBody}`);
+      return { data: { random_bytes } };
+    });
+
+    await this.renderComponent();
+
+    // test submit
+    await click(GENERAL.submitButton);
+
+    // test random bytes view
+    await waitUntil(() => TS.toolsInput('random-bytes'));
+    assert.true(flashSpy.calledWith('Generated random bytes successfully.'), 'it renders success flash');
+    assert.dom(TS.toolsInput('random-bytes')).hasText(random_bytes);
+    assert.dom('label').hasText('Random bytes');
+    assert.dom('#bytes').doesNotExist();
+    assert.dom('#format').doesNotExist();
+
+    // clicking 'Done' resets form
+    await click(GENERAL.button('Done'));
+    assert.dom('#bytes').hasValue('32');
+    assert.dom('#format').hasValue('base64');
+  });
+
+  test('it submits with updated values', async function (assert) {
+    const random_bytes =
+      '23d0cfaf42c93afd878e77ee484bf0605ce5294459ef755f5780e77e5e162a27e64e3ebda62152ac88035d64';
+    const data = { format: 'hex', bytes: 44 };
+
+    this.server.post('sys/tools/random', (schema, req) => {
+      assert.propEqual(JSON.parse(req.requestBody), data, `payload has updated data: ${req.requestBody}`);
+      return { data: { random_bytes } };
+    });
+
+    await this.renderComponent();
+    await fillIn('#bytes', '44');
+    await fillIn('#format', 'hex');
+    await click(GENERAL.submitButton);
+  });
+});
diff --git a/ui/tests/integration/components/tools/rewrap-test.js b/ui/tests/integration/components/tools/rewrap-test.js
new file mode 100644
index 00000000000..bcdaf83f45b
--- /dev/null
+++ b/ui/tests/integration/components/tools/rewrap-test.js
@@ -0,0 +1,95 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { Response } from 'miragejs';
+import { click, fillIn, find, render, waitUntil } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { TOOLS_SELECTORS as TS } from 'vault/tests/helpers/tools-selectors';
+import sinon from 'sinon';
+
+module('Integration | Component | tools/rewrap', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.renderComponent = async () => {
+      await render(hbs`<Tools::Rewrap />`);
+    };
+  });
+
+  test('it renders defaults', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom('h1').hasText('Rewrap Token', 'title renders');
+    assert.dom('label').hasText('Wrapped token');
+    assert.dom(TS.toolsInput('original-token')).hasValue('');
+    assert.dom(TS.toolsInput('rewrapped-token')).doesNotExist();
+    assert.dom(GENERAL.button('Done')).doesNotExist();
+  });
+
+  test('it renders errors', async function (assert) {
+    this.server.post('sys/wrapping/rewrap', () => new Response(500, {}, { errors: ['Something is wrong'] }));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(GENERAL.messageError));
+    assert.dom(GENERAL.messageError).hasText('Error Something is wrong', 'Error renders');
+  });
+
+  test('it submits', async function (assert) {
+    const flashSpy = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
+    const original_token = 'original.OMZFbUurY0ppT2RTMGpRa0JOSUFqUzJUaGNqdWUQ6ooG=';
+    const rewrapped_token = 'rewrapped_token.OMZFbUurY0ppT2RTMGpRa0JOSUFqUzJUaGNqdWUQ6ooG=';
+    const data = { token: original_token };
+
+    this.server.post('sys/wrapping/rewrap', (schema, req) => {
+      assert.propEqual(JSON.parse(req.requestBody), data, `payload contains defaults: ${req.requestBody}`);
+      return {
+        wrap_info: {
+          token: rewrapped_token,
+          accessor: 'kfQad1FTIpXtdhWQMgpzcMFm',
+          ttl: 1800,
+          creation_time: '2024-06-05T13:57:28.827283-07:00',
+          creation_path: 'sys/wrapping/wrap',
+        },
+      };
+    });
+
+    await this.renderComponent();
+
+    // test submit
+    await fillIn(TS.toolsInput('original-token'), original_token);
+    await click(GENERAL.submitButton);
+
+    // test rewrapped token view
+    await waitUntil(() => TS.toolsInput('rewrapped-token'));
+    assert.true(flashSpy.calledWith('Rewrap was successful.'), 'it renders success flash');
+    assert.dom('label').hasText('Rewrapped token');
+    assert.dom(TS.toolsInput('rewrapped-token')).hasText(rewrapped_token);
+    assert.dom(TS.toolsInput('original-token')).doesNotExist();
+
+    // form resets clicking 'Done'
+    await click(GENERAL.button('Done'));
+    assert.dom('label').hasText('Wrapped token');
+    assert.dom(TS.toolsInput('original-token')).hasValue('', 'token input resets');
+  });
+
+  test('it trims token whitespace', async function (assert) {
+    const data = { token: 'token.OMZFbUurY0ppT2RTMGpRa0JOSUFqUzJUaGNqdWUQ6ooG' };
+    this.server.post('sys/wrapping/rewrap', (schema, req) => {
+      const payload = JSON.parse(req.requestBody);
+      assert.propEqual(payload, data, `token does not include whitespace: "${req.requestBody}"`);
+      return {};
+    });
+
+    await this.renderComponent();
+
+    await fillIn(TS.toolsInput('original-token'), `${data.token}  `);
+    await click(GENERAL.submitButton);
+  });
+});
diff --git a/ui/tests/integration/components/tools/unwrap-test.js b/ui/tests/integration/components/tools/unwrap-test.js
new file mode 100644
index 00000000000..b0511c7221c
--- /dev/null
+++ b/ui/tests/integration/components/tools/unwrap-test.js
@@ -0,0 +1,144 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { Response } from 'miragejs';
+import { click, fillIn, find, render, settled, waitFor, waitUntil } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { assertCodeBlockValue } from 'vault/tests/helpers/codemirror';
+import { TOOLS_SELECTORS as TS } from 'vault/tests/helpers/tools-selectors';
+import sinon from 'sinon';
+
+module('Integration | Component | tools/unwrap', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.renderComponent = async () => {
+      await render(hbs`
+    <Tools::Unwrap />`);
+    };
+  });
+
+  test('it renders defaults', async function (assert) {
+    await this.renderComponent();
+
+    assert.dom('h1').hasText('Unwrap Data', 'Title renders');
+    assert.dom(GENERAL.submitButton).hasText('Unwrap data');
+    assert.dom(TS.toolsInput('unwrap-token')).hasValue('');
+    assert.dom(GENERAL.hdsTab('data')).doesNotExist();
+    assert.dom(GENERAL.hdsTab('details')).doesNotExist();
+    assert.dom('.CodeMirror').doesNotExist();
+    assert.dom(GENERAL.button('Done')).doesNotExist();
+  });
+
+  test('it renders errors', async function (assert) {
+    this.server.post('sys/wrapping/unwrap', () => new Response(500, {}, { errors: ['Something is wrong'] }));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(GENERAL.messageError));
+    assert.dom(GENERAL.messageError).hasText('Error Something is wrong', 'Error renders');
+  });
+
+  test('it submits and renders falsy values', async function (assert) {
+    const flashSpy = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
+    const unwrapData = { foo: 'bar' };
+    const data = { token: 'token.OMZFbUurY0ppT2RTMGpRa0JOSUFqUzJUaGNqdWUQ6ooG' };
+    const expectedDetails = {
+      'Request ID': '291290a6-5602-e49a-389b-5870e6c02976',
+      'Lease ID': 'None',
+      Renewable: 'No',
+      'Lease Duration': 'None',
+    };
+    this.server.post('sys/wrapping/unwrap', (schema, req) => {
+      const payload = JSON.parse(req.requestBody);
+      assert.propEqual(payload, data, `payload contains token: ${req.requestBody}`);
+      return {
+        data: unwrapData,
+        lease_duration: 0,
+        lease_id: '',
+        renewable: false,
+        request_id: '291290a6-5602-e49a-389b-5870e6c02976',
+      };
+    });
+
+    await this.renderComponent();
+
+    // test submit
+    await fillIn(TS.toolsInput('unwrap-token'), data.token);
+    await click(GENERAL.submitButton);
+    await waitFor('.hds-code-block');
+    assert.true(flashSpy.calledWith('Unwrap was successful.'), 'it renders success flash');
+    assert.dom('.hds-code-block__title').hasText('Unwrapped Data');
+    await settled();
+    assertCodeBlockValue(assert, '.hds-code-block__code', '{   "foo": "bar" }');
+    assert.dom(GENERAL.hdsTab('data')).hasAttribute('aria-selected', 'true');
+
+    await click(GENERAL.hdsTab('details'));
+    assert.dom(GENERAL.hdsTab('details')).hasAttribute('aria-selected', 'true');
+    assert
+      .dom(`${GENERAL.infoRowValue('Renewable')} ${GENERAL.icon('x-square')}`)
+      .exists('renders falsy icon for renewable');
+    for (const detail in expectedDetails) {
+      assert.dom(GENERAL.infoRowValue(detail)).hasText(expectedDetails[detail]);
+    }
+
+    // form resets clicking 'Done'
+    await click(GENERAL.button('Done'));
+    assert.dom('label').hasText('Wrapped token');
+    assert.dom(TS.toolsInput('unwrap-token')).hasValue('', 'token input resets');
+  });
+
+  test('it submits and renders truthy values', async function (assert) {
+    const unwrapData = { foo: 'bar' };
+    const data = { token: 'token.OMZFbUurY0ppT2RTMGpRa0JOSUFqUzJUaGNqdWUQ6ooG' };
+    const expectedDetails = {
+      'Request ID': '291290a6-5602-e49a-389b-5870e6c02976',
+      'Lease ID': '123',
+      Renewable: 'Yes',
+      'Lease Duration': '1800',
+    };
+    this.server.post('sys/wrapping/unwrap', (schema, req) => {
+      const payload = JSON.parse(req.requestBody);
+      assert.propEqual(payload, data, `payload contains token: ${req.requestBody}`);
+      return {
+        data: unwrapData,
+        lease_duration: 1800,
+        lease_id: '123',
+        renewable: true,
+        request_id: '291290a6-5602-e49a-389b-5870e6c02976',
+      };
+    });
+
+    await this.renderComponent();
+
+    await fillIn(TS.toolsInput('unwrap-token'), data.token);
+    await click(GENERAL.submitButton);
+    await waitFor('.hds-code-block');
+    assert
+      .dom(`${GENERAL.infoRowValue('Renewable')} ${GENERAL.icon('check-circle')}`)
+      .exists('renders truthy icon for renewable');
+    for (const detail in expectedDetails) {
+      assert.dom(GENERAL.infoRowValue(detail)).hasText(expectedDetails[detail]);
+    }
+  });
+
+  test('it trims token whitespace', async function (assert) {
+    const data = { token: 'token.OMZFbUurY0ppT2RTMGpRa0JOSUFqUzJUaGNqdWUQ6ooG' };
+    this.server.post('sys/wrapping/unwrap', (schema, req) => {
+      const payload = JSON.parse(req.requestBody);
+      assert.propEqual(payload, data, `token does not include whitespace: "${req.requestBody}"`);
+      return {};
+    });
+
+    await this.renderComponent();
+
+    await fillIn(TS.toolsInput('unwrap-token'), `${data.token}  `);
+    await click(GENERAL.submitButton);
+  });
+});
diff --git a/ui/tests/integration/components/tools/wrap-test.js b/ui/tests/integration/components/tools/wrap-test.js
new file mode 100644
index 00000000000..41af855df0d
--- /dev/null
+++ b/ui/tests/integration/components/tools/wrap-test.js
@@ -0,0 +1,280 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { Response } from 'miragejs';
+import { click, fillIn, find, render, settled, waitFor, waitUntil } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+import { TTL_PICKER as TTL } from 'vault/tests/helpers/components/ttl-picker-selectors';
+import { TOOLS_SELECTORS as TS } from 'vault/tests/helpers/tools-selectors';
+import codemirror, { getCodeEditorValue, setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+import sinon from 'sinon';
+
+async function setEditorValue(value) {
+  await waitFor('.cm-editor');
+  const editor = codemirror();
+  setCodeEditorValue(editor, value);
+  return settled();
+}
+
+module('Integration | Component | tools/wrap', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.renderComponent = async () => {
+      await render(hbs`
+    <Tools::Wrap />`);
+    };
+    this.wrapData = `{"foo": "bar"}`;
+    this.token = 'blah.jhfel7SmsVeZwihaGiIKHGh2cy5XZWtEeEt5WmRwS1VYSTNDb1BBVUNsVFAQ3JIK';
+    // default mirage response here is overridden in some tests
+    this.server.post('sys/wrapping/wrap', () => {
+      // removed superfluous response data for this test
+      return { wrap_info: { token: this.token } };
+    });
+  });
+
+  test('it renders defaults', async function (assert) {
+    await this.renderComponent();
+
+    await waitFor('.cm-editor');
+
+    assert.dom('h1').hasText('Wrap Data', 'Title renders');
+    assert.dom('[data-test-toggle-label="json"]').hasText('JSON');
+    assert.dom('[data-test-component="json-editor-title"]').hasText('Data to wrap');
+    assert.dom('.hds-code-editor__description').hasText('json-formatted');
+
+    const editor = codemirror();
+    const editorValue = getCodeEditorValue(editor);
+
+    assert.strictEqual(
+      editorValue,
+      `{
+  "": ""
+}`,
+      'json editor initializes with empty object that includes whitespace'
+    );
+    assert.dom(TTL.toggleByLabel('Wrap TTL')).isNotChecked('Wrap TTL defaults to unchecked');
+    assert.dom(GENERAL.submitButton).isEnabled();
+    assert.dom(TS.toolsInput('wrapping-token')).doesNotExist();
+    assert.dom(GENERAL.button('Back')).doesNotExist();
+    assert.dom(GENERAL.button('Done')).doesNotExist();
+
+    await click(TTL.toggleByLabel('Wrap TTL'));
+    assert.dom(TTL.valueInputByLabel('Wrap TTL')).hasValue('30', 'ttl defaults to 30 when toggled');
+    assert.dom(TTL.ttlUnit).hasValue('m', 'ttl defaults to minutes when toggled');
+  });
+
+  test('it renders errors', async function (assert) {
+    this.server.post('sys/wrapping/wrap', () => new Response(500, {}, { errors: ['Something is wrong'] }));
+    await this.renderComponent();
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(GENERAL.messageError));
+    assert.dom(GENERAL.messageError).hasText('Error Something is wrong', 'Error renders');
+  });
+
+  test('it submits with defaults', async function (assert) {
+    assert.expect(6);
+    const flashSpy = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
+
+    this.server.post('sys/wrapping/wrap', (schema, { requestBody, requestHeaders }) => {
+      const payload = JSON.parse(requestBody);
+      assert.propEqual(payload, JSON.parse(this.wrapData), `payload contains data: ${requestBody}`);
+      assert.strictEqual(requestHeaders['x-vault-wrap-ttl'], '30m', 'request header has default wrap ttl');
+      return {
+        wrap_info: {
+          token: this.token,
+          accessor: '5yjKx6Om9NmBx1mjiN1aIrnm',
+          ttl: 1800,
+          creation_time: '2024-06-07T12:02:22.096254-07:00',
+          creation_path: 'sys/wrapping/wrap',
+        },
+      };
+    });
+
+    await this.renderComponent();
+    await setEditorValue(this.wrapData);
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(TS.toolsInput('wrapping-token')));
+    assert.true(flashSpy.calledWith('Wrap was successful.'), 'it renders success flash');
+    assert.dom(TS.toolsInput('wrapping-token')).hasText(this.token);
+    assert.dom('label').hasText('Wrapped token');
+    assert.dom('.CodeMirror').doesNotExist();
+  });
+
+  test('it submits with updated ttl', async function (assert) {
+    assert.expect(2);
+    this.server.post('sys/wrapping/wrap', (schema, { requestBody, requestHeaders }) => {
+      const payload = JSON.parse(requestBody);
+      assert.propEqual(payload, JSON.parse(this.wrapData), `payload contains data: ${requestBody}`);
+      assert.strictEqual(requestHeaders['x-vault-wrap-ttl'], '1200s', 'request header has updated wrap ttl');
+      // only testing payload/header assertions, no need for return here
+      return {};
+    });
+
+    await this.renderComponent();
+    await setEditorValue(this.wrapData);
+    await click(TTL.toggleByLabel('Wrap TTL'));
+    await fillIn(TTL.valueInputByLabel('Wrap TTL'), '20');
+    await click(GENERAL.submitButton);
+  });
+
+  test('it toggles between views and preserves input data', async function (assert) {
+    assert.expect(7);
+    await this.renderComponent();
+    await setEditorValue(this.wrapData);
+    assert.dom('[data-test-component="json-editor-title"]').hasText('Data to wrap');
+    assert.dom('.hds-code-editor__description').hasText('json-formatted');
+    await click(GENERAL.toggleInput('json'));
+
+    assert.dom('[data-test-component="json-editor-title"]').doesNotExist();
+    assert.dom(GENERAL.kvObjectEditor.key('0')).hasValue('foo');
+    assert.dom(GENERAL.kvObjectEditor.value('0')).hasValue('bar');
+    await click(GENERAL.toggleInput('json'));
+    assert.dom('[data-test-component="json-editor-title"]').exists();
+
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    const editorValue = getCodeEditorValue(editor);
+    assert.strictEqual(
+      editorValue,
+      `{
+  "foo": "bar"
+}`,
+      'json editor has original data'
+    );
+  });
+
+  test('it submits from kv view', async function (assert) {
+    assert.expect(6);
+
+    const multilineData = `this is a multi-line secret
+      that contains
+      some seriously important config`;
+    const flashSpy = sinon.spy(this.owner.lookup('service:flash-messages'), 'success');
+    const updatedWrapData = JSON.stringify({
+      ...JSON.parse(this.wrapData),
+      foo: 'bar',
+      foo2: multilineData,
+    });
+
+    this.server.post('sys/wrapping/wrap', (schema, { requestBody, requestHeaders }) => {
+      const payload = JSON.parse(requestBody);
+      assert.propEqual(payload, JSON.parse(updatedWrapData), `payload contains data: ${requestBody}`);
+      assert.strictEqual(requestHeaders['x-vault-wrap-ttl'], '30m', 'request header has default wrap ttl');
+      return {
+        wrap_info: {
+          token: this.token,
+          accessor: '5yjKx6Om9NmBx1mjiN1aIrnm',
+          ttl: 1800,
+          creation_time: '2024-06-07T12:02:22.096254-07:00',
+          creation_path: 'sys/wrapping/wrap',
+        },
+      };
+    });
+
+    await this.renderComponent();
+    await click(GENERAL.toggleInput('json'));
+    await fillIn(GENERAL.kvObjectEditor.key('0'), 'foo');
+    await fillIn(GENERAL.kvObjectEditor.value('0'), 'bar');
+    await click('[data-test-kv-add-row="0"]');
+    await fillIn(GENERAL.kvObjectEditor.key('1'), 'foo2');
+    await fillIn(GENERAL.kvObjectEditor.value('1'), multilineData);
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(TS.toolsInput('wrapping-token')));
+    assert.true(flashSpy.calledWith('Wrap was successful.'), 'it renders success flash');
+    assert.dom(TS.toolsInput('wrapping-token')).hasText(this.token);
+    assert.dom('label').hasText('Wrapped token');
+    assert.dom('.CodeMirror').doesNotExist();
+  });
+
+  test('it resets on done', async function (assert) {
+    await this.renderComponent();
+    await setEditorValue(this.wrapData);
+    await click(TTL.toggleByLabel('Wrap TTL'));
+    await fillIn(TTL.valueInputByLabel('Wrap TTL'), '20');
+    await click(GENERAL.submitButton);
+
+    await waitUntil(() => find(GENERAL.button('Done')));
+    await click(GENERAL.button('Done'));
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    const editorValue = getCodeEditorValue(editor);
+    assert.strictEqual(
+      editorValue,
+      `{
+  "": ""
+}`,
+      'json editor initializes with empty object that includes whitespace'
+    );
+    assert.dom(TTL.toggleByLabel('Wrap TTL')).isNotChecked('Wrap TTL resets to unchecked');
+    await click(TTL.toggleByLabel('Wrap TTL'));
+    assert.dom(TTL.valueInputByLabel('Wrap TTL')).hasValue('30', 'ttl resets to default when toggled');
+  });
+
+  test('it preserves input data on back', async function (assert) {
+    await this.renderComponent();
+    await setEditorValue(this.wrapData);
+    await click(GENERAL.submitButton);
+
+    await waitUntil(() => find(GENERAL.button('Back')));
+    await click(GENERAL.button('Back'));
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    const editorValue = getCodeEditorValue(editor);
+    assert.strictEqual(
+      editorValue,
+      `{
+  "foo": "bar"
+}`,
+      'json editor has original data'
+    );
+    assert.dom(TTL.toggleByLabel('Wrap TTL')).isNotChecked('Wrap TTL defaults to unchecked');
+  });
+
+  test('it renders/hides warning based on json linting', async function (assert) {
+    await this.renderComponent();
+    await setEditorValue(`{bad json}`);
+    assert
+      .dom(GENERAL.inlineAlert)
+      .hasText(
+        'JSON is unparsable. Fix linting errors to avoid data discrepancies.',
+        'Linting error message is shown for json view'
+      );
+    await setEditorValue(this.wrapData);
+    assert.dom(GENERAL.inlineAlert).doesNotExist();
+  });
+
+  test('it hides json warning on back and on done', async function (assert) {
+    await this.renderComponent();
+    await setEditorValue(`{bad json}`);
+    assert
+      .dom(GENERAL.inlineAlert)
+      .hasText(
+        'JSON is unparsable. Fix linting errors to avoid data discrepancies.',
+        'Linting error message is shown for json view'
+      );
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(GENERAL.button('Done')));
+    await click(GENERAL.button('Done'));
+    assert.dom(GENERAL.inlineAlert).doesNotExist();
+
+    await setEditorValue(`{bad json}`);
+    assert
+      .dom(GENERAL.inlineAlert)
+      .hasText(
+        'JSON is unparsable. Fix linting errors to avoid data discrepancies.',
+        'Linting error message is shown for json view'
+      );
+    await click(GENERAL.submitButton);
+    await waitUntil(() => find(GENERAL.button('Back')));
+    await click(GENERAL.button('Back'));
+    assert.dom(GENERAL.inlineAlert).doesNotExist();
+  });
+});
diff --git a/ui/tests/integration/components/totp/key-form-test.js b/ui/tests/integration/components/totp/key-form-test.js
new file mode 100644
index 00000000000..3a4af7d9106
--- /dev/null
+++ b/ui/tests/integration/components/totp/key-form-test.js
@@ -0,0 +1,163 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render, fillIn, click } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | totp/key-form', function (hooks) {
+  setupRenderingTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.store = this.owner.lookup('service:store');
+  });
+
+  test('it should save new key generated by Vault', async function (assert) {
+    assert.expect(7);
+
+    this.server.post('/totp/keys/test-key', (schema, req) => {
+      assert.ok(true, 'Request made to save key');
+      const payload = JSON.parse(req.requestBody);
+      const expected = {
+        account_name: 'test-account',
+        algorithm: 'SHA1',
+        digits: 6,
+        exported: true,
+        generate: true,
+        issuer: 'test-issuer',
+        key_size: 20,
+        period: 30,
+        qr_size: 200,
+        skew: 1,
+      };
+
+      assert.deepEqual(
+        payload,
+        expected,
+        'POST request made with correct properties when creating a key generated by Vault'
+      );
+    });
+
+    this.model = this.store.createRecord('totp-key', { backend: 'totp', id: 'totp-test' });
+    await render(hbs`
+      <TotpEdit
+        @mode="create"
+        @model={{this.model}}
+    />
+    `);
+
+    assert.dom('[data-test-secret-header]').hasText('Create a TOTP key', 'Form title renders');
+
+    // check validation errors
+    await click(GENERAL.submitButton);
+
+    assert
+      .dom(GENERAL.validationErrorByAttr('name'))
+      .hasText(`Name can't be blank.`, 'Validation messages are shown for name');
+    assert
+      .dom(GENERAL.validationErrorByAttr('issuer'))
+      .hasText(
+        `Issuer can't be blank when when the key is generated by Vault.`,
+        'Validation messages are shown for issuer'
+      );
+    assert
+      .dom(GENERAL.validationErrorByAttr('accountName'))
+      .hasText(
+        `Account name can't be blank when the key is generated by Vault.`,
+        'Validation messages are shown for account name'
+      );
+    assert.dom(GENERAL.inlineAlert).hasText('There are 3 errors with this form.', 'Renders form error count');
+
+    await fillIn('[data-test-input="name"]', 'test-key');
+    await fillIn('[data-test-input="issuer"]', 'test-issuer');
+    await fillIn('[data-test-input="accountName"]', 'test-account');
+
+    await click(GENERAL.submitButton);
+  });
+
+  test('it should save new key that is not generated by Vault', async function (assert) {
+    assert.expect(6);
+
+    this.server.post('/totp/keys/test-key', (schema, req) => {
+      assert.ok(true, 'Request made to save key');
+      const payload = JSON.parse(req.requestBody);
+      const expected = {
+        algorithm: 'SHA1',
+        digits: 6,
+        generate: false,
+        key: 'test-root-key',
+        period: 30,
+      };
+      assert.deepEqual(
+        payload,
+        expected,
+        'POST request made with correct properties when creating a key that is not generated by Vault'
+      );
+    });
+
+    this.model = this.store.createRecord('totp-key', { backend: 'totp', id: 'totp-test' });
+
+    await render(hbs`
+      <TotpEdit
+        @mode="create"
+        @model={{this.model}}
+    />
+    `);
+
+    assert.dom('[data-test-secret-header]').hasText('Create a TOTP key', 'Form title renders');
+
+    // switch to non-generated form fields
+    await click(GENERAL.radioByAttr('Other service'));
+
+    // check validation errors
+    await click(GENERAL.submitButton);
+
+    assert
+      .dom(GENERAL.validationErrorByAttr('name'))
+      .hasText(`Name can't be blank.`, 'Validation messages are shown for name');
+    assert
+      .dom(GENERAL.validationErrorByAttr('key'))
+      .hasText(
+        `Key can't be blank if key is being passed from another service and the URL is empty.`,
+        'Validation messages are shown for issuer'
+      );
+    assert.dom(GENERAL.inlineAlert).hasText('There are 2 errors with this form.', 'Renders form error count');
+
+    await fillIn('[data-test-input="name"]', 'test-key');
+    await fillIn('[data-test-input="key"]', 'test-root-key');
+
+    await click(GENERAL.submitButton);
+  });
+
+  test('it should toggle groups according to generate', async function (assert) {
+    assert.expect(4);
+
+    this.model = this.store.createRecord('totp-key', { backend: 'totp', id: 'totp-test' });
+    this.onSubmit = () => assert.ok(true, 'onSubmit callback fires on save success');
+
+    await render(hbs`
+      <TotpEdit
+        @mode="create"
+        @onSubmit={{this.onSubmit}}
+        @model={{this.model}}
+    />
+    `);
+
+    // check generated groups
+    assert.dom(GENERAL.button('TOTP Code Options')).exists('Common group is shown');
+    assert.dom(GENERAL.button('Provider Options')).exists('Generated exclusive group is shown');
+
+    // switch to non-generated form fields
+    await click(GENERAL.radioByAttr('Other service'));
+
+    // check non generated groups
+    assert.dom(GENERAL.button('TOTP Code Options')).exists('Common group is shown');
+    assert.dom(GENERAL.button('Provider Options')).doesNotExist('Generated exclusive group is not shown');
+  });
+});
diff --git a/ui/tests/integration/components/transform-advanced-templating-test.js b/ui/tests/integration/components/transform-advanced-templating-test.js
index f615d30a9a5..2b4ce86d980 100644
--- a/ui/tests/integration/components/transform-advanced-templating-test.js
+++ b/ui/tests/integration/components/transform-advanced-templating-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,18 +7,11 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { click, fillIn, render, triggerEvent } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
 
 module('Integration | Component | transform-advanced-templating', function (hooks) {
   setupRenderingTest(hooks);
 
   test('it should render', async function (assert) {
-    setRunOptions({
-      rules: {
-        // TODO: fix JSONEditor/CodeMirror
-        label: { enabled: false },
-      },
-    });
     this.model = {
       pattern: '(\\d{3})-(\\d{2})-(?<last>\\d{5})',
       encodeFormat: null,
diff --git a/ui/tests/integration/components/transform-edit-base-test.js b/ui/tests/integration/components/transform-edit-base-test.js
index 5a43e5e5956..980da326103 100644
--- a/ui/tests/integration/components/transform-edit-base-test.js
+++ b/ui/tests/integration/components/transform-edit-base-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/transform-list-item-test.js b/ui/tests/integration/components/transform-list-item-test.js
index 27e6c8ece37..516dd0eef4e 100644
--- a/ui/tests/integration/components/transform-list-item-test.js
+++ b/ui/tests/integration/components/transform-list-item-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,6 +8,7 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render, click } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | transform-list-item', function (hooks) {
   setupRenderingTest(hooks);
@@ -53,7 +54,7 @@ module('Integration | Component | transform-list-item', function (hooks) {
     />`);
 
     assert.dom('[data-test-secret-link="template/foo"]').exists('shows clickable list item');
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     assert.dom('.hds-dropdown li').exists({ count: 1 }, 'has one option');
   });
 
@@ -76,7 +77,7 @@ module('Integration | Component | transform-list-item', function (hooks) {
     />`);
 
     assert.dom('[data-test-secret-link="alphabet/foo"]').exists('shows clickable list item');
-    await click('[data-test-popup-menu-trigger]');
+    await click(GENERAL.menuTrigger);
     assert.dom('.hds-dropdown li').exists({ count: 2 }, 'has both options');
   });
 
diff --git a/ui/tests/integration/components/transform-role-edit-test.js b/ui/tests/integration/components/transform-role-edit-test.js
index 3ab945c5f47..ac1d6cea111 100644
--- a/ui/tests/integration/components/transform-role-edit-test.js
+++ b/ui/tests/integration/components/transform-role-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/transit-edit-test.js b/ui/tests/integration/components/transit-edit-test.js
index f44f2e1165d..b095836e1ff 100644
--- a/ui/tests/integration/components/transit-edit-test.js
+++ b/ui/tests/integration/components/transit-edit-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,8 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'vault/tests/helpers';
 import { click, fillIn, render } from '@ember/test-helpers';
 import { hbs } from 'ember-cli-htmlbars';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { capabilitiesStub } from 'vault/tests/helpers/stubs';
 
 const SELECTORS = {
   createForm: '[data-test-transit-create-form]',
@@ -16,10 +18,14 @@ const SELECTORS = {
 };
 module('Integration | Component | transit-edit', function (hooks) {
   setupRenderingTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
     this.store = this.owner.lookup('service:store');
-    this.model = this.store.createRecord('transit-key');
+    this.server.post('/sys/capabilities-self', () =>
+      capabilitiesStub('transit-backend/keys/some-key', ['sudo'])
+    );
+    this.model = this.store.createRecord('transit-key', { backend: 'transit-backend', id: 'some-key' });
     this.backendCrumb = {
       label: 'transit',
       text: 'transit',
@@ -30,7 +36,7 @@ module('Integration | Component | transit-edit', function (hooks) {
 
   test('it renders in create mode and updates model', async function (assert) {
     await render(hbs`
-    <TransitEdit 
+    <TransitEdit
       @key={{this.model}}
       @model={{this.model}}
       @mode="create"
@@ -58,14 +64,13 @@ module('Integration | Component | transit-edit', function (hooks) {
       1: 1684882652000,
     };
     await render(hbs`
-      <TransitEdit 
+      <TransitEdit
         @key={{this.model}}
         @model={{this.model}}
         @mode="edit"
         @root={{this.backendCrumb}}
         @preferAdvancedEdit={{false}}
       />`);
-
     assert.dom(SELECTORS.editForm).exists();
     assert.dom(SELECTORS.ttlToggle).isNotChecked();
 
@@ -86,7 +91,7 @@ module('Integration | Component | transit-edit', function (hooks) {
       1: 1684882652000,
     };
     await render(hbs`
-      <TransitEdit 
+      <TransitEdit
         @key={{this.model}}
         @model={{this.model}}
         @mode="edit"
diff --git a/ui/tests/integration/components/transit-key-actions-test.js b/ui/tests/integration/components/transit-key-actions-test.js
index b516a57f81c..3e839e28679 100644
--- a/ui/tests/integration/components/transit-key-actions-test.js
+++ b/ui/tests/integration/components/transit-key-actions-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,11 +8,12 @@ import { resolve } from 'rsvp';
 import Service from '@ember/service';
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { render, click, find, findAll, fillIn, blur, triggerEvent } from '@ember/test-helpers';
+import { render, click, find, fillIn, blur, triggerEvent, waitFor } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 import { encodeString } from 'vault/utils/b64';
 import waitForError from 'vault/tests/helpers/wait-for-error';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import codemirror, { getCodeEditorValue, setCodeEditorValue } from 'vault/tests/helpers/codemirror';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 const storeStub = Service.extend({
   callArgs: null,
@@ -46,12 +47,6 @@ module('Integration | Component | transit key actions', function (hooks) {
       this.owner.register('service:store', storeStub);
       this.storeService = this.owner.lookup('service:store');
     });
-    setRunOptions({
-      rules: {
-        // TODO: fix JSONEditor/CodeMirror
-        label: { enabled: false },
-      },
-    });
   });
 
   test('it requires `key`', async function (assert) {
@@ -101,6 +96,50 @@ module('Integration | Component | transit key actions', function (hooks) {
       .exists({ count: 1 }, 'renders signature_algorithm field on verify with rsa key');
   });
 
+  test('it renders: padding_scheme field for rsa key types', async function (assert) {
+    const supportedActions = ['datakey', 'decrypt', 'encrypt'];
+    const supportedKeyTypes = ['rsa-2048', 'rsa-3072', 'rsa-4096'];
+
+    for (const key of supportedKeyTypes) {
+      this.set('key', {
+        type: key,
+        backend: 'transit',
+        supportedActions,
+      });
+      for (const action of this.key.supportedActions) {
+        this.selectedAction = action;
+        await render(hbs`
+    <TransitKeyActions @selectedAction={{this.selectedAction}} @key={{this.key}} />`);
+        assert
+          .dom('[data-test-padding-scheme]')
+          .hasValue(
+            'oaep',
+            `key type: ${key} renders padding_scheme field with default value for action: ${action}`
+          );
+      }
+    }
+  });
+  test('it renders: decrypt_padding_scheme and encrypt_padding_scheme fields for rsa key types', async function (assert) {
+    this.selectedAction = 'rewrap';
+    const supportedKeyTypes = ['rsa-2048', 'rsa-3072', 'rsa-4096'];
+    const SELECTOR = (type) => `[data-test-padding-scheme="${type}"]`;
+    for (const key of supportedKeyTypes) {
+      this.set('key', {
+        type: key,
+        backend: 'transit',
+        supportedActions: [this.selectedAction],
+      });
+      await render(hbs`
+    <TransitKeyActions @selectedAction={{this.selectedAction}} @key={{this.key}} />`);
+      assert
+        .dom(SELECTOR('encrypt'))
+        .hasValue('oaep', `key type: ${key} renders ${SELECTOR('encrypt')} field with default value`);
+      assert
+        .dom(SELECTOR('decrypt'))
+        .hasValue('oaep', `key type: ${key} renders ${SELECTOR('decrypt')} field with default value`);
+    }
+  });
+
   async function doEncrypt(assert, actions = [], keyattrs = {}) {
     const keyDefaults = { backend: 'transit', id: 'akey', supportedActions: ['encrypt'].concat(actions) };
 
@@ -111,7 +150,10 @@ module('Integration | Component | transit key actions', function (hooks) {
     await render(hbs`
     <TransitKeyActions @selectedAction={{this.selectedAction}} @key={{this.key}} />`);
 
-    find('#plaintext-control .CodeMirror').CodeMirror.setValue('plaintext');
+    let editor;
+    await waitFor('.cm-editor');
+    editor = codemirror('#plaintext-control');
+    setCodeEditorValue(editor, 'plaintext');
     await click('button[type="submit"]');
     assert.deepEqual(
       this.storeService.callArgs,
@@ -132,7 +174,9 @@ module('Integration | Component | transit key actions', function (hooks) {
     await click('dialog button');
     // Encrypt again, with pre-encoded value and checkbox selected
     const preEncodedValue = encodeString('plaintext');
-    find('#plaintext-control .CodeMirror').CodeMirror.setValue(preEncodedValue);
+    await waitFor('.cm-editor');
+    editor = codemirror('#plaintext-control');
+    setCodeEditorValue(editor, preEncodedValue);
     await click('input[data-test-transit-input="encodedBase64"]');
     await click('button[type="submit"]');
 
@@ -148,6 +192,7 @@ module('Integration | Component | transit key actions', function (hooks) {
       },
       'passes expected args to the adapter'
     );
+    await click('dialog button');
   }
 
   test('it encrypts', doEncrypt);
@@ -161,7 +206,9 @@ module('Integration | Component | transit key actions', function (hooks) {
     await render(hbs`
     <TransitKeyActions @selectedAction="encrypt" @key={{this.key}} />`);
 
-    findAll('.CodeMirror')[0].CodeMirror.setValue('plaintext');
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    setCodeEditorValue(editor, 'plaintext');
     assert.dom('#key_version').exists({ count: 1 }, 'it renders the key version selector');
 
     await triggerEvent('#key_version', 'change');
@@ -190,8 +237,9 @@ module('Integration | Component | transit key actions', function (hooks) {
     await render(hbs`
     <TransitKeyActions @selectedAction="encrypt" @key={{this.key}} />`);
 
-    // await fillIn('#plaintext', 'plaintext');
-    find('#plaintext-control .CodeMirror').CodeMirror.setValue('plaintext');
+    await waitFor('.cm-editor');
+    const editor = codemirror('#plaintext-control');
+    setCodeEditorValue(editor, 'plaintext');
     assert.dom('#key_version').doesNotExist('it does not render the selector when there is only one key');
   });
 
@@ -202,11 +250,9 @@ module('Integration | Component | transit key actions', function (hooks) {
 
     this.set('storeService.keyActionReturnVal', { plaintext });
     this.set('selectedAction', 'decrypt');
-    assert.strictEqual(
-      find('#ciphertext-control .CodeMirror').CodeMirror.getValue(),
-      '',
-      'does not prefill ciphertext value'
-    );
+    await waitFor('.cm-editor');
+    const editor = codemirror('#ciphertext-control');
+    assert.strictEqual(getCodeEditorValue(editor), '', 'does not prefill ciphertext value');
   });
 
   const setupExport = async function () {
@@ -251,7 +297,7 @@ module('Integration | Component | transit key actions', function (hooks) {
     this.set('storeService.keyActionReturnVal', response);
     await setupExport.call(this);
     await click('[data-test-toggle-label="Wrap response"]');
-    await click('button[type="submit"]');
+    await click(GENERAL.submitButton);
     assert.dom('#transit-export-modal').exists('Modal opens after export');
     assert.deepEqual(
       JSON.parse(find('[data-test-encrypted-value="export"]').innerText),
@@ -267,7 +313,7 @@ module('Integration | Component | transit key actions', function (hooks) {
     await click('[data-test-toggle-label="Wrap response"]');
     await click('#exportVersion');
     await triggerEvent('#exportVersion', 'change');
-    await click('button[type="submit"]');
+    await click(GENERAL.submitButton);
     assert.dom('#transit-export-modal').exists('Modal opens after export');
     assert.deepEqual(
       JSON.parse(find('[data-test-encrypted-value="export"]').innerText),
@@ -301,9 +347,11 @@ module('Integration | Component | transit key actions', function (hooks) {
     <TransitKeyActions @key={{this.key}} @selectedAction="hmac" />`);
     await fillIn('#algorithm', 'sha2-384');
     await blur('#algorithm');
-    await fillIn('[data-test-component="code-mirror-modifier"] textarea', 'plaintext');
+    await waitFor('.cm-editor');
+    const editor = codemirror();
+    setCodeEditorValue(editor, 'plaintext');
     await click('input[data-test-transit-input="encodedBase64"]');
-    await click('button[type="submit"]');
+    await click(GENERAL.submitButton);
     assert.deepEqual(
       this.storeService.callArgs,
       {
diff --git a/ui/tests/integration/components/ttl-picker-test.js b/ui/tests/integration/components/ttl-picker-test.js
index fab1872b5d4..8f19308b078 100644
--- a/ui/tests/integration/components/ttl-picker-test.js
+++ b/ui/tests/integration/components/ttl-picker-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,8 +8,8 @@ import { setupRenderingTest } from 'ember-qunit';
 import { render, click, fillIn } from '@ember/test-helpers';
 import sinon from 'sinon';
 import hbs from 'htmlbars-inline-precompile';
-import selectors from 'vault/tests/helpers/components/ttl-picker';
-import { setRunOptions } from 'ember-a11y-testing/test-support';
+import { TTL_PICKER } from 'vault/tests/helpers/components/ttl-picker-selectors';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 module('Integration | Component | ttl-picker', function (hooks) {
   setupRenderingTest(hooks);
@@ -29,9 +29,9 @@ module('Integration | Component | ttl-picker', function (hooks) {
         @label={{this.label}}
         @hideToggle={{this.hideToggle}}
         @onChange={{this.onChange}} />`);
-      assert.dom(selectors.ttlFormGroup).exists('TTL Form fields exist');
-      assert.dom(selectors.ttlValue).hasValue('');
-      assert.dom(selectors.ttlUnit).hasValue('s');
+      assert.dom(TTL_PICKER.ttlFormGroup).exists('TTL Form fields exist');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('s');
     });
 
     test('it calls the change fn with the correct values', async function (assert) {
@@ -44,8 +44,8 @@ module('Integration | Component | ttl-picker', function (hooks) {
         @onChange={{this.onChange}}
         @initialValue="30m" />
       `);
-      assert.dom(selectors.ttlUnit).hasValue('m', 'unit value shows m (minutes)');
-      await fillIn(selectors.ttlValue, '10');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('m', 'unit value shows m (minutes)');
+      await fillIn(TTL_PICKER.ttlValue, '10');
       await assert.ok(changeSpy.calledOnce, 'it calls the passed onChange');
       assert.ok(
         changeSpy.calledWithExactly({
@@ -68,8 +68,8 @@ module('Integration | Component | ttl-picker', function (hooks) {
         />
       `);
 
-      assert.dom(selectors.ttlUnit).hasValue('h', 'unit value initially shows as h (hours)');
-      assert.dom(selectors.ttlValue).hasValue('3', 'time value initially shows as 3');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('h', 'unit value initially shows as h (hours)');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('3', 'time value initially shows as 3');
     });
 
     test('it fails gracefully when initialValue is not parseable', async function (assert) {
@@ -85,8 +85,8 @@ module('Integration | Component | ttl-picker', function (hooks) {
         />
       `);
 
-      assert.dom(selectors.ttlValue).hasValue('', 'time value initially shows as empty');
-      assert.dom(selectors.ttlUnit).hasValue('s', 'unit value initially shows as s (seconds)');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('', 'time value initially shows as empty');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('s', 'unit value initially shows as s (seconds)');
       assert.ok(changeSpy.notCalled, 'onChange is not called on init');
     });
 
@@ -102,11 +102,11 @@ module('Integration | Component | ttl-picker', function (hooks) {
         />
       `);
 
-      assert.dom(selectors.ttlUnit).hasValue('h', 'unit value initially shows as h (hours)');
-      assert.dom(selectors.ttlValue).hasValue('1', 'time value initially shows as 1');
-      await fillIn(selectors.ttlUnit, 'm');
-      assert.dom(selectors.ttlUnit).hasValue('m', 'unit value changed to m (minutes)');
-      assert.dom(selectors.ttlValue).hasValue('60', 'time value recalculates to fit unit');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('h', 'unit value initially shows as h (hours)');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('1', 'time value initially shows as 1');
+      await fillIn(TTL_PICKER.ttlUnit, 'm');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('m', 'unit value changed to m (minutes)');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('60', 'time value recalculates to fit unit');
       assert.ok(
         changeSpy.calledWithExactly({
           enabled: true,
@@ -130,11 +130,11 @@ module('Integration | Component | ttl-picker', function (hooks) {
         />
       `);
 
-      assert.dom(selectors.ttlUnit).hasValue('s', 'unit value starts as s (seconds)');
-      assert.dom(selectors.ttlValue).hasValue('30', 'time value starts as 30');
-      await fillIn(selectors.ttlUnit, 'm');
-      assert.dom(selectors.ttlUnit).hasValue('m', 'unit value changed to m (minutes)');
-      assert.dom(selectors.ttlValue).hasValue('30', 'time value is still 30');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('s', 'unit value starts as s (seconds)');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('30', 'time value starts as 30');
+      await fillIn(TTL_PICKER.ttlUnit, 'm');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('m', 'unit value changed to m (minutes)');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('30', 'time value is still 30');
       assert.ok(
         changeSpy.calledWithExactly({
           enabled: true,
@@ -183,16 +183,10 @@ module('Integration | Component | ttl-picker', function (hooks) {
 
       assert.dom('[data-test-ttl-form-label]').hasText('My Label', 'Renders label correctly');
       assert.dom('[data-test-ttl-form-subtext]').doesNotExist('Subtext not rendered');
-      assert.dom('[data-test-tooltip-trigger]').doesNotExist('Description tooltip not rendered');
+      assert.dom(GENERAL.tooltip('ttl-picker')).doesNotExist('Description tooltip icon not rendered');
     });
 
     test('it shows subtext and description when passed', async function (assert) {
-      setRunOptions({
-        rules: {
-          // TODO: remove Tooltip
-          'aria-command-name': { enabled: false },
-        },
-      });
       this.set('label', 'My Label');
       await render(hbs`
         <TtlPicker
@@ -207,7 +201,7 @@ module('Integration | Component | ttl-picker', function (hooks) {
       assert.dom('[data-test-ttl-form-label]').hasText('My Label', 'Renders label correctly');
       assert.dom('[data-test-ttl-form-subtext]').hasText('Subtext', 'Renders subtext when present');
       assert
-        .dom('[data-test-tooltip-trigger]')
+        .dom(GENERAL.tooltip('ttl-picker'))
         .exists({ count: 1 }, 'Description tooltip icon shows when description present');
     });
 
@@ -238,8 +232,8 @@ module('Integration | Component | ttl-picker', function (hooks) {
           @onChange={{this.onChange}}
         />
       `);
-      assert.dom(selectors.toggle).isNotChecked('Toggle is unchecked by default');
-      assert.dom(selectors.ttlFormGroup).doesNotExist('TTL Form is not rendered');
+      assert.dom(TTL_PICKER.toggle).isNotChecked('Toggle is unchecked by default');
+      assert.dom(TTL_PICKER.ttlFormGroup).doesNotExist('TTL Form is not rendered');
     });
 
     test('it shows time and unit inputs when initialEnabled', async function (assert) {
@@ -253,8 +247,8 @@ module('Integration | Component | ttl-picker', function (hooks) {
           @changeOnInit={{true}}
         />
       `);
-      assert.dom(selectors.toggle).isChecked('Toggle is checked when initialEnabled is true');
-      assert.dom(selectors.ttlFormGroup).exists('TTL Form is rendered');
+      assert.dom(TTL_PICKER.toggle).isChecked('Toggle is checked when initialEnabled is true');
+      assert.dom(TTL_PICKER.ttlFormGroup).exists('TTL Form is rendered');
       assert.ok(changeSpy.notCalled, 'onChange not called because initialValue not parsed');
     });
 
@@ -267,8 +261,8 @@ module('Integration | Component | ttl-picker', function (hooks) {
           @initialEnabled={{true}}
         />
       `);
-      assert.dom(selectors.ttlValue).hasValue('2', 'time value is 2');
-      assert.dom(selectors.ttlUnit).hasValue('h', 'unit is hours');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('2', 'time value is 2');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('h', 'unit is hours');
       assert.ok(
         this.onChange.notCalled,
         'it does not call onChange after render when changeOnInit is not set'
@@ -284,7 +278,7 @@ module('Integration | Component | ttl-picker', function (hooks) {
           @onChange={{this.onChange}}
         />
       `);
-      await click(selectors.toggle);
+      await click(TTL_PICKER.toggle);
       assert.ok(changeSpy.calledOnce, 'it calls the passed onChange');
       assert.ok(
         changeSpy.calledWith({
@@ -304,11 +298,11 @@ module('Integration | Component | ttl-picker', function (hooks) {
           @initialValue="100m"
         />
       `);
-      assert.dom(selectors.toggle).isNotChecked('Toggle is off');
-      assert.dom(selectors.ttlFormGroup).doesNotExist('TTL Form not shown on mount');
-      await click(selectors.toggle);
-      assert.dom(selectors.ttlValue).hasValue('100', 'time after toggle is 100');
-      assert.dom(selectors.ttlUnit).hasValue('m', 'Unit is minutes after toggle');
+      assert.dom(TTL_PICKER.toggle).isNotChecked('Toggle is off');
+      assert.dom(TTL_PICKER.ttlFormGroup).doesNotExist('TTL Form not shown on mount');
+      await click(TTL_PICKER.toggle);
+      assert.dom(TTL_PICKER.ttlValue).hasValue('100', 'time after toggle is 100');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('m', 'Unit is minutes after toggle');
     });
 
     test('it is enabled on init if initialEnabled is true', async function (assert) {
@@ -319,13 +313,13 @@ module('Integration | Component | ttl-picker', function (hooks) {
           @initialEnabled={{true}}
         />
       `);
-      assert.dom(selectors.toggle).isChecked('Toggle is on');
-      assert.dom(selectors.ttlFormGroup).exists();
-      assert.dom(selectors.ttlValue).hasValue('100', 'time is shown on mount');
-      assert.dom(selectors.ttlUnit).hasValue('m', 'Unit is shown on mount');
-      await click(selectors.toggle);
-      assert.dom(selectors.toggle).isNotChecked('Toggle is off');
-      assert.dom(selectors.ttlFormGroup).doesNotExist('TTL Form no longer shows after toggle');
+      assert.dom(TTL_PICKER.toggle).isChecked('Toggle is on');
+      assert.dom(TTL_PICKER.ttlFormGroup).exists();
+      assert.dom(TTL_PICKER.ttlValue).hasValue('100', 'time is shown on mount');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('m', 'Unit is shown on mount');
+      await click(TTL_PICKER.toggle);
+      assert.dom(TTL_PICKER.toggle).isNotChecked('Toggle is off');
+      assert.dom(TTL_PICKER.ttlFormGroup).doesNotExist('TTL Form no longer shows after toggle');
     });
 
     test('it is enabled on init if initialEnabled evals to truthy', async function (assert) {
@@ -336,9 +330,9 @@ module('Integration | Component | ttl-picker', function (hooks) {
           @initialEnabled="100m"
         />
       `);
-      assert.dom(selectors.toggle).isChecked('Toggle is enabled');
-      assert.dom(selectors.ttlValue).hasValue('100', 'time value is shown on mount');
-      assert.dom(selectors.ttlUnit).hasValue('m', 'Unit matches what is passed in');
+      assert.dom(TTL_PICKER.toggle).isChecked('Toggle is enabled');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('100', 'time value is shown on mount');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('m', 'Unit matches what is passed in');
     });
 
     test('it converts days to go safe time', async function (assert) {
@@ -348,7 +342,7 @@ module('Integration | Component | ttl-picker', function (hooks) {
           @onChange={{this.onChange}}
         />
       `);
-      await click(selectors.toggle);
+      await click(TTL_PICKER.toggle);
       assert.ok(this.onChange.calledOnce, 'it calls the passed onChange');
       assert.ok(
         this.onChange.calledWith({
@@ -369,8 +363,8 @@ module('Integration | Component | ttl-picker', function (hooks) {
           @initialEnabled="true"
         />
       `);
-      assert.dom(selectors.ttlValue).hasValue('1000', 'time value is converted');
-      assert.dom(selectors.ttlUnit).hasValue('m', 'unit value is m (minutes)');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('1000', 'time value is converted');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('m', 'unit value is m (minutes)');
     });
 
     test('it converts to the largest round unit on init when no unit provided', async function (assert) {
@@ -381,8 +375,8 @@ module('Integration | Component | ttl-picker', function (hooks) {
           @initialEnabled="true"
         />
       `);
-      assert.dom(selectors.ttlValue).hasValue('1', 'time value is converted');
-      assert.dom(selectors.ttlUnit).hasValue('d', 'unit value is d (days)');
+      assert.dom(TTL_PICKER.ttlValue).hasValue('1', 'time value is converted');
+      assert.dom(TTL_PICKER.ttlUnit).hasValue('d', 'unit value is d (days)');
     });
   });
 });
diff --git a/ui/tests/integration/components/unsaved-changes-modal-test.js b/ui/tests/integration/components/unsaved-changes-modal-test.js
new file mode 100644
index 00000000000..a00a88392c5
--- /dev/null
+++ b/ui/tests/integration/components/unsaved-changes-modal-test.js
@@ -0,0 +1,43 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'ember-qunit';
+import { render } from '@ember/test-helpers';
+import hbs from 'htmlbars-inline-precompile';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
+
+module('Integration | Component | UnsavedChangesModal', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.unsavedChanges = this.owner.lookup('service:unsavedChanges');
+    this.unsavedChanges.showModal = true;
+    this.unsavedChanges.changedFields = ['Description', 'Secrets duration'];
+    this.save = () => 'saved!';
+    this.discard = () => 'discarded!';
+  });
+
+  test('it shows unsaved changes modal', async function (assert) {
+    await render(hbs`<UnsavedChangesModal @onSave={{this.save}} @onDiscard={{this.discard}} />`);
+    assert.dom(GENERAL.modal.header('unsaved-changes')).hasText('Unsaved changes');
+    assert
+      .dom(GENERAL.modal.body('unsaved-changes'))
+      .hasText(
+        `You've made changes to the following: Description Secrets duration Would you like to apply them?`
+      );
+  });
+
+  test('it shows unsaved changes modal with custom changedFields', async function (assert) {
+    this.changedFields = ['Field 1', 'Field 2'];
+    await render(
+      hbs`<UnsavedChangesModal @onSave={{this.save}} @onDiscard={{this.discard}} @changedFields={{this.changedFields}}/>`
+    );
+    assert.dom(GENERAL.modal.header('unsaved-changes')).hasText('Unsaved changes');
+    assert
+      .dom(GENERAL.modal.body('unsaved-changes'))
+      .hasText(`You've made changes to the following: Field 1 Field 2 Would you like to apply them?`);
+  });
+});
diff --git a/ui/tests/integration/components/upgrade-page-test.js b/ui/tests/integration/components/upgrade-page-test.js
index de97c5a3455..a2ef728e4d5 100644
--- a/ui/tests/integration/components/upgrade-page-test.js
+++ b/ui/tests/integration/components/upgrade-page-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/components/usage/page-test.js b/ui/tests/integration/components/usage/page-test.js
new file mode 100644
index 00000000000..b7223cc0f96
--- /dev/null
+++ b/ui/tests/integration/components/usage/page-test.js
@@ -0,0 +1,27 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import sinon from 'sinon';
+
+module('Integration | Component | usage | Page::Usage', function (hooks) {
+  setupRenderingTest(hooks);
+
+  hooks.beforeEach(async function () {
+    this.api = this.owner.lookup('service:api');
+    this.generateUtilizationReportStub = sinon.stub(this.api.sys, 'generateUtilizationReport').resolves({});
+  });
+
+  hooks.afterEach(function () {
+    this.generateUtilizationReportStub.restore();
+  });
+
+  test('it provides the correct fetch function to the dashboard component', async function (assert) {
+    await render(hbs`<Usage::Page />`);
+    assert.true(this.generateUtilizationReportStub.calledOnce, 'fetch function is called on render');
+  });
+});
diff --git a/ui/tests/integration/components/wrap-ttl-test.js b/ui/tests/integration/components/wrap-ttl-test.js
index 9d0e8c5096b..f957b73d68c 100644
--- a/ui/tests/integration/components/wrap-ttl-test.js
+++ b/ui/tests/integration/components/wrap-ttl-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/helpers/add-to-array-test.js b/ui/tests/integration/helpers/add-to-array-test.js
index 3bce33fee06..c1cbc6f0f47 100644
--- a/ui/tests/integration/helpers/add-to-array-test.js
+++ b/ui/tests/integration/helpers/add-to-array-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,7 +12,7 @@ module('Integration | Helper | add-to-array', function (hooks) {
 
   test('it correctly adds a value to an array without mutating the original', function (assert) {
     const ARRAY = ['horse', 'cow', 'chicken'];
-    const result = addToArray([ARRAY, 'pig']);
+    const result = addToArray(ARRAY, 'pig');
     assert.deepEqual(result, [...ARRAY, 'pig'], 'Result has additional item');
     assert.deepEqual(ARRAY, ['horse', 'cow', 'chicken'], 'original array is not mutated');
   });
@@ -20,7 +20,7 @@ module('Integration | Helper | add-to-array', function (hooks) {
   test('it fails if the first value is not an array', function (assert) {
     let result;
     try {
-      result = addToArray(['not-array', 'string']);
+      result = addToArray('not-array', 'string');
     } catch (e) {
       result = e.message;
     }
@@ -29,13 +29,13 @@ module('Integration | Helper | add-to-array', function (hooks) {
 
   test('it works with non-string arrays', function (assert) {
     const ARRAY = ['five', 6, '7'];
-    const result = addToArray([ARRAY, 10]);
+    const result = addToArray(ARRAY, 10);
     assert.deepEqual(result, ['five', 6, '7', 10], 'added number value');
   });
 
   test('it de-dupes the result', function (assert) {
     const ARRAY = ['horse', 'cow', 'chicken'];
-    const result = addToArray([ARRAY, 'horse']);
+    const result = addToArray(ARRAY, 'horse');
     assert.deepEqual(result, ['horse', 'cow', 'chicken']);
   });
 });
diff --git a/ui/tests/integration/helpers/changelog-url-for-test.js b/ui/tests/integration/helpers/changelog-url-for-test.js
index 2e43c29a763..2c131d04008 100644
--- a/ui/tests/integration/helpers/changelog-url-for-test.js
+++ b/ui/tests/integration/helpers/changelog-url-for-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/helpers/date-format-test.js b/ui/tests/integration/helpers/date-format-test.js
index f55d583423e..ab38b24e8d9 100644
--- a/ui/tests/integration/helpers/date-format-test.js
+++ b/ui/tests/integration/helpers/date-format-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,6 +7,8 @@ import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { find, render, settled } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
+import { formatTimeZone } from 'core/helpers/date-format';
+import { isMatch } from 'date-fns';
 
 const TEST_DATE = new Date('2018-04-03T14:15:30');
 
@@ -41,6 +43,7 @@ module('Integration | Helper | date-format', function (hooks) {
   });
 
   test('displays time zone if withTimeZone=true', async function (assert) {
+    // this test may fail locally if you're in a non-US timezone
     this.set('withTimezone', true);
     this.set('timestampDate', TEST_DATE);
 
@@ -54,6 +57,14 @@ module('Integration | Helper | date-format', function (hooks) {
     assert.strictEqual(resultLengthWithTimezone - 4, 4, 'Adds 4 characters for timezone');
   });
 
+  test('it renders default format', async function (assert) {
+    this.set('timestampDate', TEST_DATE);
+    await render(hbs`<span data-test-formatted>{{date-format this.timestampDate}}</span>`);
+    const value = find('[data-test-formatted]').innerText;
+    const format = 'MMM d yyyy, h:mm:ss aa';
+    assert.true(isMatch(value, format), `${value} is formatted as ${format}`);
+  });
+
   test('fails gracefully if given a non-date value', async function (assert) {
     this.set('value', 'not a date');
 
@@ -68,4 +79,14 @@ module('Integration | Helper | date-format', function (hooks) {
     await settled();
     assert.dom(this.element).hasText('', 'renders empty string when falsey');
   });
+
+  test('it formats timezone', async function (assert) {
+    // compute expected because otherwise this fails locally because of differing timezones
+    const expected = ` ${TEST_DATE.toLocaleTimeString(undefined, { timeZoneName: 'short' }).split(' ')[2]}`;
+    const actual = formatTimeZone(TEST_DATE);
+
+    assert.notStrictEqual(actual, undefined, 'formatted timezone is not undefined');
+    assert.strictEqual(formatTimeZone('not a date'), '', 'returns an empty string for a non-date value');
+    assert.strictEqual(actual, expected, `formatted timezone: "${actual}" equals expected: "${expected}"`);
+  });
 });
diff --git a/ui/tests/integration/helpers/date-from-now-test.js b/ui/tests/integration/helpers/date-from-now-test.js
index a42392ce7e3..f7a417c06fe 100644
--- a/ui/tests/integration/helpers/date-from-now-test.js
+++ b/ui/tests/integration/helpers/date-from-now-test.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { subMinutes } from 'date-fns';
 import { setupRenderingTest } from 'ember-qunit';
-import { dateFromNow } from '../../../helpers/date-from-now';
+import { dateFromNow } from 'core/helpers/date-from-now';
 import { render } from '@ember/test-helpers';
 import hbs from 'htmlbars-inline-precompile';
 
diff --git a/ui/tests/integration/helpers/englines-display-data-test.js b/ui/tests/integration/helpers/englines-display-data-test.js
new file mode 100644
index 00000000000..4c1371b929d
--- /dev/null
+++ b/ui/tests/integration/helpers/englines-display-data-test.js
@@ -0,0 +1,58 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import engineDisplayData from 'vault/helpers/engines-display-data';
+import { ALL_ENGINES } from 'vault/utils/all-engines-metadata';
+
+module('Unit | Helper | engineDisplayData', function () {
+  test('it returns correct display data for a known engine type', function (assert) {
+    const awsData = engineDisplayData('aws');
+    const expected = ALL_ENGINES.find((e) => e.type === 'aws');
+    assert.propEqual(awsData, expected, 'Returns correct display data for aws');
+  });
+
+  test('it returns correct display data for an ent only engine', function (assert) {
+    const kmipData = engineDisplayData('kmip');
+    assert.true(kmipData.requiresEnterprise, 'KMIP requires enterprise');
+    assert.strictEqual(kmipData.displayName, 'KMIP', 'KMIP displayName is correct');
+  });
+
+  test('it returns fallback display data for unknown engine type', function (assert) {
+    const { displayName, type, mountCategory, glyph, isOldEngine } = engineDisplayData('not-an-engine');
+    assert.strictEqual(displayName, 'not-an-engine', 'it returns passed type as fallback displayName');
+    assert.strictEqual(type, 'unknown', 'it returns "unknown"" as fallback type');
+    assert.propEqual(mountCategory, ['secret', 'auth'], 'mountCategory is correct');
+    assert.strictEqual(glyph, 'lock', 'default glyph is a lock');
+    assert.true(isOldEngine, 'isOldEngine is true');
+  });
+
+  test('it returns fallback display data for empty string', function (assert) {
+    const { displayName, type, mountCategory, glyph, isOldEngine } = engineDisplayData('');
+    assert.strictEqual(displayName, 'Unknown plugin', 'it returns fallback displayName for empty string');
+    assert.strictEqual(type, 'unknown', 'it returns fallback type for empty string');
+    assert.propEqual(mountCategory, ['secret', 'auth'], 'mountCategory is correct');
+    assert.strictEqual(glyph, 'lock', 'default glyph is a lock');
+    assert.true(isOldEngine, 'isOldEngine is true');
+  });
+
+  test('it returns fallback display data for undefined', function (assert) {
+    const { displayName, type, mountCategory, glyph, isOldEngine } = engineDisplayData(undefined);
+    assert.strictEqual(displayName, 'Unknown plugin', 'it returns fallback displayName for undefined');
+    assert.strictEqual(type, 'unknown', 'it returns fallback type for undefined');
+    assert.propEqual(mountCategory, ['secret', 'auth'], 'mountCategory is correct');
+    assert.strictEqual(glyph, 'lock', 'default glyph is a lock');
+    assert.true(isOldEngine, 'isOldEngine is true');
+  });
+
+  test('it returns fallback display data for null', function (assert) {
+    const { displayName, type, mountCategory, glyph, isOldEngine } = engineDisplayData(null);
+    assert.strictEqual(displayName, 'Unknown plugin', 'it returns fallback displayName for null');
+    assert.strictEqual(type, 'unknown', 'it returns fallback type for null');
+    assert.propEqual(mountCategory, ['secret', 'auth'], 'mountCategory is correct');
+    assert.strictEqual(glyph, 'lock', 'default glyph is a lock');
+    assert.true(isOldEngine, 'isOldEngine is true');
+  });
+});
diff --git a/ui/tests/integration/helpers/format-duration-test.js b/ui/tests/integration/helpers/format-duration-test.js
index 2443ef0186c..7a5031f8b39 100644
--- a/ui/tests/integration/helpers/format-duration-test.js
+++ b/ui/tests/integration/helpers/format-duration-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/helpers/has-feature-test.js b/ui/tests/integration/helpers/has-feature-test.js
index 87af455faf9..2a0cc428d1c 100644
--- a/ui/tests/integration/helpers/has-feature-test.js
+++ b/ui/tests/integration/helpers/has-feature-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/helpers/has-permission-test.js b/ui/tests/integration/helpers/has-permission-test.js
index 6fef4541911..2dbfc9e7685 100644
--- a/ui/tests/integration/helpers/has-permission-test.js
+++ b/ui/tests/integration/helpers/has-permission-test.js
@@ -1,67 +1,127 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
 import { render, settled } from '@ember/test-helpers';
-import { run } from '@ember/runloop';
+import { tracked } from '@glimmer/tracking';
 import hbs from 'htmlbars-inline-precompile';
 import Service from '@ember/service';
 import sinon from 'sinon';
 
-const Permissions = Service.extend({
-  globPaths: null,
-  hasNavPermission() {
-    return this.globPaths ? true : false;
-  },
-});
+class PermissionsService extends Service {
+  @tracked globPaths = null;
+  @tracked exactPaths = null;
+  @tracked canViewAll = false;
+  @tracked chrootNamespace = null;
+
+  hasNavPermission(...args) {
+    const [route, routeParams, requireAll] = args;
+    void (typeof route === 'string');
+    void (routeParams === undefined || Array.isArray(routeParams));
+    void (requireAll === undefined || typeof requireAll === 'boolean');
+
+    if (this.canViewAll) return true;
+    if (this.globPaths || this.exactPaths) return true;
+    return false;
+  }
+}
+
+class NamespaceService extends Service {
+  @tracked path = '';
+}
 
 module('Integration | Helper | has-permission', function (hooks) {
   setupRenderingTest(hooks);
 
   hooks.beforeEach(function () {
-    this.owner.register('service:permissions', Permissions);
+    this.owner.register('service:permissions', PermissionsService);
+    this.owner.register('service:namespace', NamespaceService);
     this.permissions = this.owner.lookup('service:permissions');
+    this.namespace = this.owner.lookup('service:namespace');
   });
 
-  test('it renders', async function (assert) {
+  test('it recomputes when globPaths change', async function (assert) {
     await render(hbs`{{#if (has-permission)}}Yes{{else}}No{{/if}}`);
-
     assert.dom(this.element).hasText('No');
-    await run(() => {
-      this.permissions.set('globPaths', { 'test/': { capabilities: ['update'] } });
-    });
+    this.permissions.globPaths = { 'test/': { capabilities: ['update'] } };
     await settled();
     assert.dom(this.element).hasText('Yes', 'the helper re-computes when globPaths changes');
   });
 
+  test('it recomputes when exactPaths changes', async function (assert) {
+    await render(hbs`{{#if (has-permission)}}Yes{{else}}No{{/if}}`);
+    assert.dom(this.element).hasText('No');
+    this.permissions.exactPaths = { 'test/': { capabilities: ['update'] } };
+    await settled();
+    assert.dom(this.element).hasText('Yes', 'the helper re-computes when exactPaths changes');
+  });
+
+  test('it recomputes when canViewAll changes', async function (assert) {
+    await render(hbs`{{#if (has-permission)}}Yes{{else}}No{{/if}}`);
+    assert.dom(this.element).hasText('No');
+    this.permissions.canViewAll = true;
+    await settled();
+    assert.dom(this.element).hasText('Yes', 'the helper re-computes when canViewAll changes');
+  });
+
+  test('it recomputes when chrootNamespace changes', async function (assert) {
+    await render(hbs`{{#if (has-permission)}}Yes{{else}}No{{/if}}`);
+    assert.dom(this.element).hasText('No');
+    this.permissions.chrootNamespace = 'admin';
+    this.permissions.globPaths = { 'test/': { capabilities: ['update'] } };
+    await settled();
+    assert.dom(this.element).hasText('Yes', 'the helper re-computes when chrootNamespace changes');
+  });
+
+  test('it recomputes when namespace.path changes', async function (assert) {
+    await render(hbs`{{#if (has-permission)}}Yes{{else}}No{{/if}}`);
+    assert.dom(this.element).hasText('No');
+    this.namespace.path = 'new-ns';
+    this.permissions.globPaths = { 'test/': { capabilities: ['update'] } };
+    await settled();
+    assert.dom(this.element).hasText('Yes', 'the helper re-computes when namespace.path changes');
+  });
+
   test('it should pass args from helper to service method', async function (assert) {
     const stub = sinon.stub(this.permissions, 'hasNavPermission').returns(true);
-    this.permissions.set('exactPaths', {
-      'sys/auth': {
-        capabilities: ['read'],
-      },
-      'identity/mfa/method': {
-        capabilities: ['read'],
-      },
-    });
+
+    // seed some ACL so the helper would logically return true
+    this.permissions.exactPaths = {
+      'sys/auth': { capabilities: ['read'] },
+      'identity/mfa/method': { capabilities: ['read'] },
+    };
+
+    // strict-mode: define on context and use `this.` in template
     this.routeParams = ['methods', 'mfa'];
 
     await render(hbs`
-      {{#if (has-permission "access" routeParams=this.routeParams requireAll=true)}}
-        Yes
-      {{else}}
-        No
-      {{/if}}
-    `);
+    {{if (has-permission "access" routeParams=this.routeParams requireAll=true) "Yes" "No"}}
+  `);
 
+    // use deep/loose match for the array arg
     assert.true(
-      stub.withArgs('access', this.routeParams, true).calledOnce,
+      stub.calledWithMatch('access', ['methods', 'mfa'], true),
       'Args are passed from helper to service'
     );
+
     assert.dom(this.element).hasText('Yes', 'Helper returns value from service method');
     stub.restore();
   });
+
+  test('returns false for missing route', async function (assert) {
+    const stub = sinon.stub(this.permissions, 'hasNavPermission').returns(false);
+    await render(hbs`{{#if (has-permission "missing")}}Yes{{else}}No{{/if}}`);
+    assert.dom(this.element).hasText('No', 'Helper returns false for missing route');
+    stub.restore();
+  });
+
+  test('returns false for undefined params', async function (assert) {
+    const stub = sinon.stub(this.permissions, 'hasNavPermission').returns(false);
+    await render(hbs`{{#if (has-permission "access" routeParams=undefined)}}Yes{{else}}No{{/if}}`);
+    assert.dom(this.element).hasText('No', 'Helper returns false for undefined params');
+    stub.restore();
+  });
 });
diff --git a/ui/tests/integration/helpers/is-empty-value-test.js b/ui/tests/integration/helpers/is-empty-value-test.js
index 1f57f13b8f9..e6352f955d1 100644
--- a/ui/tests/integration/helpers/is-empty-value-test.js
+++ b/ui/tests/integration/helpers/is-empty-value-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/helpers/loose-equal-test.js b/ui/tests/integration/helpers/loose-equal-test.js
index 0a33fcb42da..a5b0040fc18 100644
--- a/ui/tests/integration/helpers/loose-equal-test.js
+++ b/ui/tests/integration/helpers/loose-equal-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/helpers/new-line-split-test.js b/ui/tests/integration/helpers/new-line-split-test.js
index fa5f5635e1b..d644f7e7399 100644
--- a/ui/tests/integration/helpers/new-line-split-test.js
+++ b/ui/tests/integration/helpers/new-line-split-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/helpers/remove-from-array-test.js b/ui/tests/integration/helpers/remove-from-array-test.js
index 3e87cd5ea6d..0e2ef26ded9 100644
--- a/ui/tests/integration/helpers/remove-from-array-test.js
+++ b/ui/tests/integration/helpers/remove-from-array-test.js
@@ -1,32 +1,32 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupRenderingTest } from 'ember-qunit';
-import { removeFromArray } from '../../../helpers/remove-from-array';
+import { removeManyFromArray, removeFromArray } from 'vault/helpers/remove-from-array';
 
 module('Integration | Helper | remove-from-array', function (hooks) {
   setupRenderingTest(hooks);
 
   test('it correctly removes a value from an array without mutating the original', function (assert) {
     const ARRAY = ['horse', 'cow', 'chicken'];
-    const result = removeFromArray([ARRAY, 'horse']);
+    const result = removeFromArray(ARRAY, 'horse');
     assert.deepEqual(result, ['cow', 'chicken'], 'Result does not have removed item');
     assert.deepEqual(ARRAY, ['horse', 'cow', 'chicken'], 'original array is not mutated');
   });
 
   test('it returns the same value if the item is not found', function (assert) {
     const ARRAY = ['horse', 'cow', 'chicken'];
-    const result = removeFromArray([ARRAY, 'pig']);
+    const result = removeFromArray(ARRAY, 'pig');
     assert.deepEqual(result, ARRAY, 'Results are the same as original array');
   });
 
   test('it fails if the first value is not an array', function (assert) {
     let result;
     try {
-      result = removeFromArray(['not-array', 'string']);
+      result = removeFromArray('not-array', 'string');
     } catch (e) {
       result = e.message;
     }
@@ -35,15 +35,23 @@ module('Integration | Helper | remove-from-array', function (hooks) {
 
   test('it works with non-string arrays', function (assert) {
     const ARRAY = ['five', 6, '7'];
-    const result1 = removeFromArray([ARRAY, 6]);
-    const result2 = removeFromArray([ARRAY, 7]);
+    const result1 = removeFromArray(ARRAY, 6);
+    const result2 = removeFromArray(ARRAY, 7);
     assert.deepEqual(result1, ['five', '7'], 'removed number value');
     assert.deepEqual(result2, ARRAY, 'did not match on different types');
   });
 
   test('it de-dupes the result', function (assert) {
     const ARRAY = ['horse', 'cow', 'chicken', 'cow'];
-    const result = removeFromArray([ARRAY, 'horse']);
+    const result = removeFromArray(ARRAY, 'horse');
     assert.deepEqual(result, ['cow', 'chicken']);
   });
+
+  test('it works with two arrays', function (assert) {
+    const ARRAY = ['five', 6, '7'];
+    const result1 = removeManyFromArray(ARRAY, [6, '7']);
+    const result2 = removeManyFromArray(ARRAY, ['foo', 'five']);
+    assert.deepEqual(result1, ['five'], 'removed multiple values');
+    assert.deepEqual(result2, [6, '7'], 'did nothing with values that were not in the array');
+  });
 });
diff --git a/ui/tests/integration/helpers/sanitized-html-test.js b/ui/tests/integration/helpers/sanitized-html-test.js
index a6c0addb216..81ea5f76754 100644
--- a/ui/tests/integration/helpers/sanitized-html-test.js
+++ b/ui/tests/integration/helpers/sanitized-html-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/integration/helpers/string-array-to-camel-test.js b/ui/tests/integration/helpers/string-array-to-camel-test.js
new file mode 100644
index 00000000000..a6225773eb3
--- /dev/null
+++ b/ui/tests/integration/helpers/string-array-to-camel-test.js
@@ -0,0 +1,60 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { stringArrayToCamelCase } from 'vault/helpers/string-array-to-camel';
+
+module('Integration | Helper | string-array-to-camel', function (hooks) {
+  setupRenderingTest(hooks);
+
+  test('it returns camelCase string with all caps and two words separated by space', async function (assert) {
+    const string = 'FOO Bar';
+    const expected = 'fooBar';
+    const result = stringArrayToCamelCase(string);
+
+    assert.strictEqual(
+      result,
+      expected,
+      'camelCase string returned for call caps and two words separated by space'
+    );
+  });
+
+  test('it returns an array of camelCased strings if an array of strings passed in', function (assert) {
+    const string = ['FOO Bar', 'Baz Qux', 'wibble wobble', 'wobble WIBBLes'];
+    const expected = ['fooBar', 'bazQux', 'wibbleWobble', 'wobbleWibbles'];
+    const result = stringArrayToCamelCase(string);
+    assert.deepEqual(result, expected, 'camelCase array of strings returned for all sorts of strings');
+  });
+
+  test('it returns string if string is numbers', function (assert) {
+    const string = '123';
+    const expected = '123';
+    const result = stringArrayToCamelCase(string);
+    assert.strictEqual(result, expected, 'camelCase kind of handles strings with numbers');
+  });
+
+  test('it returns error if str is not a string', function (assert) {
+    const string = { name: 'foo.bar*baz' };
+    let result;
+    try {
+      result = stringArrayToCamelCase(string);
+    } catch (e) {
+      result = e.message;
+    }
+    assert.deepEqual(result, 'Assertion Failed: must pass in a string or array of strings');
+  });
+
+  test('it returns error if str is not an array of string', function (assert) {
+    const string = [{ name: 'foo.bar*baz' }];
+    let result;
+    try {
+      result = stringArrayToCamelCase(string);
+    } catch (e) {
+      result = e.message;
+    }
+    assert.deepEqual(result, 'Assertion Failed: must pass in a string or array of strings');
+  });
+});
diff --git a/ui/tests/integration/helpers/transition-to-test.js b/ui/tests/integration/helpers/transition-to-test.js
new file mode 100644
index 00000000000..4af43b1284f
--- /dev/null
+++ b/ui/tests/integration/helpers/transition-to-test.js
@@ -0,0 +1,79 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupRenderingTest } from 'vault/tests/helpers';
+import { setupEngine } from 'ember-engines/test-support';
+import { click, render } from '@ember/test-helpers';
+import { hbs } from 'ember-cli-htmlbars';
+import Sinon from 'sinon';
+
+module('Integration | Helper | transition-to', function (hooks) {
+  setupRenderingTest(hooks);
+  // using 'kv' here for testing, but this could be any Ember engine in the app
+  // sets this.engine, which we use to set context for the component testing service:app-router
+  setupEngine(hooks, 'kv');
+
+  hooks.beforeEach(function () {
+    this.router = this.owner.lookup('service:router');
+    this.router.reopen({
+      transitionTo: Sinon.stub(),
+      transitionToExternal: Sinon.stub(),
+    });
+  });
+
+  test('it does not call transition on render', async function (assert) {
+    await render(
+      hbs`<button data-test-btn type="button" {{on "click" (transition-to "vault.cluster")}}>Click</button>`
+    );
+
+    assert.true(this.router.transitionTo.notCalled, 'transitionTo not called on render');
+    assert.true(this.router.transitionToExternal.notCalled, 'transitionToExternal not called on render');
+  });
+
+  test('it calls transitionTo correctly', async function (assert) {
+    await render(
+      hbs`<button data-test-btn type="button" {{on "click" (transition-to "vault.cluster" "foobar" "baz")}}>Click</button>`
+    );
+    await click('[data-test-btn]');
+
+    assert.true(this.router.transitionTo.calledOnce, 'transitionTo called once on click');
+    assert.deepEqual(
+      this.router.transitionTo.args[0],
+      ['vault.cluster', 'foobar', 'baz'],
+      'transitionTo called with positional params'
+    );
+    assert.true(this.router.transitionToExternal.notCalled, 'transitionToExternal not called');
+  });
+
+  test('it calls transitionToExternal correctly', async function (assert) {
+    await render(
+      hbs`<button data-test-btn type="button" {{on "click" (transition-to "vault.cluster" "foobar" "baz" external=true)}}>Click</button>`
+    );
+    await click('[data-test-btn]');
+
+    assert.true(this.router.transitionToExternal.calledOnce, 'transitionToExternal called');
+    assert.deepEqual(
+      this.router.transitionToExternal.args[0],
+      ['vault.cluster', 'foobar', 'baz'],
+      'transitionToExternal called with positional params'
+    );
+    assert.true(this.router.transitionTo.notCalled, 'transitionTo not called');
+  });
+
+  // This test is confusing (and admittedly not ideal) because stubbing routers gets strange,
+  // but if you go into the TransitionTo class and console.log owner.lookup('service:router') in get router()
+  // you'll see the getter returns 'service:app-router' (because of the context setup)
+  // so although we're asserting this.router, the TransitionTo helper is using "service:app-router" under the hood.
+  // This test passing, indirectly means the helper works as expected. Failures might be something like "global failure: TypeError: this.router is undefined"
+  test('it uses service:app-router when base router undefined', async function (assert) {
+    await render(
+      hbs`<button data-test-btn type="button" {{on "click" (transition-to "vault.cluster" "foobar" "baz" external=true)}}>Click</button>`,
+      { owner: this.engine }
+    );
+    await click('[data-test-btn]');
+    assert.true(this.router.transitionToExternal.calledOnce, 'transitionToExternal called');
+  });
+});
diff --git a/ui/tests/integration/services/auth-test.js b/ui/tests/integration/services/auth-test.js
index da00e65f2a9..47b8758ba3a 100644
--- a/ui/tests/integration/services/auth-test.js
+++ b/ui/tests/integration/services/auth-test.js
@@ -1,14 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { run } from '@ember/runloop';
-import { copy } from 'ember-copy';
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
 import { TOKEN_SEPARATOR, TOKEN_PREFIX, ROOT_PREFIX } from 'vault/services/auth';
-import Pretender from 'pretender';
+import { TOKEN_DATA } from 'vault/tests/helpers/auth/response-stubs';
 
 function storage() {
   return {
@@ -33,95 +32,21 @@ function storage() {
 }
 
 const ROOT_TOKEN_RESPONSE = {
-  request_id: 'e6674d7f-c96f-d51f-4463-cc95f0ad307e',
-  lease_id: '',
-  renewable: false,
-  lease_duration: 0,
-  data: {
-    accessor: '1dd25306-fdb9-0f43-8169-48ad702041b0',
-    creation_time: 1477671134,
-    creation_ttl: 0,
-    display_name: 'root',
-    explicit_max_ttl: 0,
-    id: '',
-    meta: null,
-    num_uses: 0,
-    orphan: true,
-    path: 'auth/token/root',
-    policies: ['root'],
-    ttl: 0,
-  },
-  wrap_info: null,
-  warnings: null,
-  auth: null,
+  ...TOKEN_DATA.token,
+  policies: ['root'],
+  ttl: 0, // root tokens have no expiration
 };
 
-const TOKEN_NON_ROOT_RESPONSE = function () {
-  return {
-    request_id: '3ca32cd9-fd40-891d-02d5-ea23138e8642',
-    lease_id: '',
-    renewable: false,
-    lease_duration: 0,
-    data: {
-      accessor: '4ef32471-a94c-79ee-c290-aeba4d63bdc9',
-      creation_time: Math.floor(Date.now() / 1000),
-      creation_ttl: 2764800,
-      display_name: 'token',
-      explicit_max_ttl: 0,
-      id: '6d83e912-1b21-9df9-b51a-d201b709f3d5',
-      meta: null,
-      num_uses: 0,
-      orphan: false,
-      path: 'auth/token/create',
-      policies: ['default', 'userpass'],
-      renewable: true,
-      ttl: 2763327,
-    },
-    wrap_info: null,
-    warnings: null,
-    auth: null,
-  };
-};
-
-const USERPASS_RESPONSE = {
-  request_id: '7e5e8d3d-599e-6ef7-7570-f7057fc7c53d',
-  lease_id: '',
+const BATCH_TOKEN_RESPONSE = {
+  ...TOKEN_DATA.token,
   renewable: false,
-  lease_duration: 0,
-  data: null,
-  wrap_info: null,
-  warnings: null,
-  auth: {
-    client_token: '5313ff81-05cb-699f-29d1-b82b4e2906dc',
-    accessor: '5c5303e7-56d6-ea13-72df-d85411bd9a7d',
-    policies: ['default'],
-    metadata: {
-      username: 'matthew',
-    },
-    lease_duration: 2764800,
-    renewable: true,
-  },
+  type: 'batch',
 };
 
-const GITHUB_RESPONSE = {
-  request_id: '4913f9cd-a95f-d1f9-5746-4c3af4e15660',
-  lease_id: '',
+const USERPASS_BATCH_TOKEN_RESPONSE = {
+  ...TOKEN_DATA.userpass,
   renewable: false,
-  lease_duration: 0,
-  data: null,
-  wrap_info: null,
-  warnings: null,
-  auth: {
-    client_token: '0d39b535-598e-54d9-96e3-97493492a5f7',
-    accessor: 'd8cd894f-bedf-5ce3-f1b5-98f7c6cf8ab4',
-    policies: ['default'],
-    metadata: {
-      org: 'hashicorp',
-      username: 'meirish',
-    },
-    lease_duration: 2764800,
-    renewable: true,
-  },
+  tokenType: 'batch',
 };
 
 module('Integration | Service | auth', function (hooks) {
@@ -131,42 +56,10 @@ module('Integration | Service | auth', function (hooks) {
     this.owner.lookup('service:flash-messages').registerTypes(['warning']);
     this.store = storage();
     this.memStore = storage();
-    this.server = new Pretender(function () {
-      this.get('/v1/auth/token/lookup-self', function (request) {
-        const resp = copy(ROOT_TOKEN_RESPONSE, true);
-        resp.id = request.requestHeaders['x-vault-token'];
-        resp.data.id = request.requestHeaders['x-vault-token'];
-        return [200, {}, resp];
-      });
-      this.post('/v1/auth/userpass/login/:username', function (request) {
-        const { username } = request.params;
-        const resp = copy(USERPASS_RESPONSE, true);
-        resp.auth.metadata.username = username;
-        return [200, {}, resp];
-      });
-
-      this.post('/v1/auth/github/login', function () {
-        const resp = copy(GITHUB_RESPONSE, true);
-        return [200, {}, resp];
-      });
-    });
-
-    this.server.prepareBody = function (body) {
-      return body ? JSON.stringify(body) : '{"error": "not found"}';
-    };
-
-    this.server.prepareHeaders = function (headers) {
-      headers['content-type'] = 'application/javascript';
-      return headers;
-    };
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
   });
 
   test('token authentication: root token', function (assert) {
-    assert.expect(6);
+    assert.expect(5);
     const done = assert.async();
     const self = this;
     const service = this.owner.factoryFor('service:auth').create({
@@ -184,25 +77,20 @@ module('Integration | Service | auth', function (hooks) {
     });
     run(() => {
       service
-        .authenticate({ clusterId: '1', backend: 'token', data: { token: 'test' } })
+        .authSuccess('1', ROOT_TOKEN_RESPONSE)
         .then(() => {
           const clusterTokenName = service.get('currentTokenName');
           const clusterToken = service.get('currentToken');
           const authData = service.get('authData');
 
           const expectedTokenName = `${TOKEN_PREFIX}${ROOT_PREFIX}${TOKEN_SEPARATOR}1`;
-          assert.strictEqual(clusterToken, 'test', 'token is saved properly');
+          assert.strictEqual(clusterToken, 'hvs.myvaultgeneratedtoken', 'token is saved properly');
           assert.strictEqual(
             `${TOKEN_PREFIX}${ROOT_PREFIX}${TOKEN_SEPARATOR}1`,
             clusterTokenName,
             'token name is saved properly'
           );
-          assert.strictEqual(authData.backend.type, 'token', 'backend is saved properly');
-          assert.strictEqual(
-            ROOT_TOKEN_RESPONSE.data.display_name,
-            authData.displayName,
-            'displayName is saved properly'
-          );
+          assert.strictEqual(authData.authMethodType, 'token', 'backend is saved properly');
           assert.ok(
             this.memStore.keys().includes(expectedTokenName),
             'root token is stored in the memory store'
@@ -231,50 +119,40 @@ module('Integration | Service | auth', function (hooks) {
       },
       environment: () => 'development',
     });
-    await service.authenticate({ clusterId: '1', backend: 'token', data: { token: 'test' } });
+    await service.authSuccess('1', ROOT_TOKEN_RESPONSE);
     const clusterTokenName = service.get('currentTokenName');
     const clusterToken = service.get('currentToken');
     const authData = service.get('authData');
 
     const expectedTokenName = `${TOKEN_PREFIX}${ROOT_PREFIX}${TOKEN_SEPARATOR}1`;
-    assert.strictEqual(clusterToken, 'test', 'token is saved properly');
+    assert.strictEqual(clusterToken, 'hvs.myvaultgeneratedtoken', 'token is saved properly');
     assert.strictEqual(
       `${TOKEN_PREFIX}${ROOT_PREFIX}${TOKEN_SEPARATOR}1`,
       clusterTokenName,
       'token name is saved properly'
     );
-    assert.strictEqual(authData.backend.type, 'token', 'backend is saved properly');
-    assert.strictEqual(
-      ROOT_TOKEN_RESPONSE.data.display_name,
-      authData.displayName,
-      'displayName is saved properly'
-    );
+    assert.strictEqual(authData.authMethodType, 'token', 'backend is saved properly');
     assert.ok(this.store.keys().includes(expectedTokenName), 'root token is stored in the store');
     assert.strictEqual(this.memStore.keys().length, 0, 'mem storage is empty');
   });
 
   test('github authentication', function (assert) {
-    assert.expect(6);
+    assert.expect(5);
     const done = assert.async();
     const service = this.owner.factoryFor('service:auth').create({
       storage: (type) => (type === 'memory' ? this.memStore : this.store),
     });
 
     run(() => {
-      service.authenticate({ clusterId: '1', backend: 'github', data: { token: 'test' } }).then(() => {
+      service.authSuccess('1', TOKEN_DATA.github).then(() => {
         const clusterTokenName = service.get('currentTokenName');
         const clusterToken = service.get('currentToken');
         const authData = service.get('authData');
         const expectedTokenName = `${TOKEN_PREFIX}github${TOKEN_SEPARATOR}1`;
 
-        assert.strictEqual(GITHUB_RESPONSE.auth.client_token, clusterToken, 'token is saved properly');
+        assert.strictEqual(TOKEN_DATA.github.token, clusterToken, 'token is saved properly');
         assert.strictEqual(expectedTokenName, clusterTokenName, 'token name is saved properly');
-        assert.strictEqual(authData.backend.type, 'github', 'backend is saved properly');
-        assert.strictEqual(
-          GITHUB_RESPONSE.auth.metadata.org + '/' + GITHUB_RESPONSE.auth.metadata.username,
-          authData.displayName,
-          'displayName is saved properly'
-        );
+        assert.strictEqual(authData.authMethodType, 'github', 'backend is saved properly');
         assert.strictEqual(this.memStore.keys().length, 0, 'mem storage is empty');
         assert.ok(this.store.keys().includes(expectedTokenName), 'normal storage contains the token');
         done();
@@ -283,73 +161,88 @@ module('Integration | Service | auth', function (hooks) {
   });
 
   test('userpass authentication', function (assert) {
-    assert.expect(4);
+    assert.expect(3);
     const done = assert.async();
     const service = this.owner.factoryFor('service:auth').create({ storage: () => this.store });
     run(() => {
-      service
-        .authenticate({
-          clusterId: '1',
-          backend: 'userpass',
-          data: { username: USERPASS_RESPONSE.auth.metadata.username, password: 'passoword' },
-        })
-        .then(() => {
-          const clusterTokenName = service.get('currentTokenName');
-          const clusterToken = service.get('currentToken');
-          const authData = service.get('authData');
+      service.authSuccess('1', TOKEN_DATA.userpass).then(() => {
+        const clusterTokenName = service.get('currentTokenName');
+        const clusterToken = service.get('currentToken');
+        const authData = service.get('authData');
 
-          assert.strictEqual(USERPASS_RESPONSE.auth.client_token, clusterToken, 'token is saved properly');
-          assert.strictEqual(
-            `${TOKEN_PREFIX}userpass${TOKEN_SEPARATOR}1`,
-            clusterTokenName,
-            'token name is saved properly'
-          );
-          assert.strictEqual(authData.backend.type, 'userpass', 'backend is saved properly');
-          assert.strictEqual(
-            USERPASS_RESPONSE.auth.metadata.username,
-            authData.displayName,
-            'displayName is saved properly'
-          );
-          done();
-        });
+        assert.strictEqual(TOKEN_DATA.userpass.token, clusterToken, 'token is saved properly');
+        assert.strictEqual(
+          `${TOKEN_PREFIX}userpass${TOKEN_SEPARATOR}1`,
+          clusterTokenName,
+          'token name is saved properly'
+        );
+        assert.strictEqual(authData.authMethodType, 'userpass', 'backend is saved properly');
+        done();
+      });
     });
   });
 
   test('token auth expiry with non-root token', function (assert) {
-    assert.expect(5);
-    const tokenResp = TOKEN_NON_ROOT_RESPONSE();
-    this.server.map(function () {
-      this.get('/v1/auth/token/lookup-self', function (request) {
-        const resp = copy(tokenResp, true);
-        resp.id = request.requestHeaders['x-vault-token'];
-        resp.data.id = request.requestHeaders['x-vault-token'];
-        return [200, {}, resp];
-      });
-    });
+    assert.expect(4);
 
     const done = assert.async();
     const service = this.owner.factoryFor('service:auth').create({ storage: () => this.store });
     run(() => {
-      service.authenticate({ clusterId: '1', backend: 'token', data: { token: 'test' } }).then(() => {
+      service.authSuccess('1', TOKEN_DATA.token).then(() => {
         const clusterTokenName = service.get('currentTokenName');
         const clusterToken = service.get('currentToken');
         const authData = service.get('authData');
 
-        assert.strictEqual(clusterToken, 'test', 'token is saved properly');
+        assert.strictEqual(clusterToken, 'hvs.myvaultgeneratedtoken', 'token is saved properly');
         assert.strictEqual(
           `${TOKEN_PREFIX}token${TOKEN_SEPARATOR}1`,
           clusterTokenName,
           'token name is saved properly'
         );
-        assert.strictEqual(authData.backend.type, 'token', 'backend is saved properly');
-        assert.strictEqual(
-          authData.displayName,
-          tokenResp.data.display_name,
-          'displayName is saved properly'
-        );
+        assert.strictEqual(authData.authMethodType, 'token', 'backend is saved properly');
         assert.false(service.get('tokenExpired'), 'token is not expired');
         done();
       });
     });
   });
+
+  module('token types', function (hooks) {
+    hooks.beforeEach(function () {
+      this.service = this.owner.factoryFor('service:auth').create({ storage: () => this.store });
+    });
+
+    test('batch tokens generated by token auth method', async function (assert) {
+      await this.service.authSuccess('1', BATCH_TOKEN_RESPONSE);
+
+      // exact expiration time is calculated in unit tests
+      assert.notEqual(
+        this.service.tokenExpirationDate,
+        undefined,
+        'expiration is calculated for batch tokens'
+      );
+    });
+
+    test('batch tokens generated by auth methods', async function (assert) {
+      await this.service.authSuccess('1', USERPASS_BATCH_TOKEN_RESPONSE);
+
+      // exact expiration time is calculated in unit tests
+      assert.notEqual(
+        this.service.tokenExpirationDate,
+        undefined,
+        'expiration is calculated for batch tokens'
+      );
+    });
+
+    test('service token authentication', async function (assert) {
+      await this.service.authSuccess('1', TOKEN_DATA.userpass);
+
+      // exact expiration time is calculated in unit tests
+      assert.notEqual(
+        this.service.tokenExpirationDate,
+        undefined,
+        'expiration is calculated for service tokens'
+      );
+      assert.false(this.service.allowExpiration, 'allowExpiration is false for service tokens');
+    });
+  });
 });
diff --git a/ui/tests/integration/utils/client-count-utils-test.js b/ui/tests/integration/utils/client-count-utils-test.js
index 9a15309eeb3..499c68dfac2 100644
--- a/ui/tests/integration/utils/client-count-utils-test.js
+++ b/ui/tests/integration/utils/client-count-utils-test.js
@@ -1,931 +1,616 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 import {
-  flattenDataset,
+  filterVersionHistory,
   formatByMonths,
   formatByNamespace,
-  homogenizeClientNaming,
+  destructureClientCounts,
   sortMonthsByTimestamp,
-  namespaceArrayToObject,
+  flattenMounts,
+  filterTableData,
 } from 'core/utils/client-count-utils';
-import { parseAPITimestamp } from 'core/utils/date-formatters';
-import isBefore from 'date-fns/isBefore';
-import isAfter from 'date-fns/isAfter';
-
-// import { setupMirage } from 'ember-cli-mirage/test-support';
-// import ENV from 'vault/config/environment';
-// import { formatRFC3339 } from 'date-fns';
-
+import clientsHandler from 'vault/mirage/handlers/clients';
+import {
+  ACTIVITY_RESPONSE_STUB as RESPONSE,
+  MIXED_ACTIVITY_RESPONSE_STUB as MIXED_RESPONSE,
+  SERIALIZED_ACTIVITY_RESPONSE,
+  ENTITY_EXPORT,
+} from 'vault/tests/helpers/clients/client-count-helpers';
+
+/*
+formatByNamespace, formatByMonths, destructureClientCounts are utils
+used to normalize the sys/counters/activity response in the clients/activity
+serializer. these functions are tested individually here, instead of all at once
+in a serializer test for easier debugging
+*/
 module('Integration | Util | client count utils', function (hooks) {
   setupTest(hooks);
-  // setupMirage(hooks);
-
-  // TODO: wire up to stubbed API/mirage?
-  // hooks.before(function () {
-  //   ENV['ember-cli-mirage'].handler = 'clients';
-  // });
-  // hooks.after(function () {
-  //   ENV['ember-cli-mirage'].handler = null;
-  // });
-
-  /* MONTHS array contains: (update when backend work done on months )
-  - one month with only old client naming
-  */
-
-  const MONTHS = [
-    {
-      timestamp: '2021-05-01T00:00:00Z',
-      counts: {
-        distinct_entities: 25,
-        non_entity_tokens: 25,
-        clients: 50,
-      },
-      namespaces: [
+
+  module('filterVersionHistory', function (hooks) {
+    setupMirage(hooks);
+
+    hooks.beforeEach(async function () {
+      clientsHandler(this.server);
+      const store = this.owner.lookup('service:store');
+      // format returned by model hook in routes/vault/cluster/clients.ts
+      this.versionHistory = await store.findAll('clients/version-history').then((resp) => {
+        return resp.map(({ version, previousVersion, timestampInstalled }) => {
+          return {
+            // order of keys needs to match expected order
+            previousVersion,
+            timestampInstalled,
+            version,
+          };
+        });
+      });
+    });
+
+    test('it returns version data for upgrade to notable versions: 1.9, 1.10, 1.17', async function (assert) {
+      assert.expect(3);
+      const original = [...this.versionHistory];
+      const expected = [
         {
-          namespace_id: 'root',
-          namespace_path: '',
-          counts: {
-            distinct_entities: 13,
-            non_entity_tokens: 7,
-            clients: 20,
-          },
-          mounts: [
-            {
-              mount_path: 'auth/up2/',
-              counts: {
-                distinct_entities: 8,
-                non_entity_tokens: 0,
-                clients: 8,
-              },
-            },
-            {
-              mount_path: 'auth/up1/',
-              counts: {
-                distinct_entities: 0,
-                non_entity_tokens: 7,
-                clients: 7,
-              },
-            },
-          ],
+          previousVersion: '1.9.0',
+          timestampInstalled: '2023-08-02T00:00:00Z',
+          version: '1.9.1',
         },
         {
-          namespace_id: 's07UR',
-          namespace_path: 'ns1/',
-          counts: {
-            distinct_entities: 5,
-            non_entity_tokens: 5,
-            clients: 10,
-          },
-          mounts: [
-            {
-              mount_path: 'auth/up1/',
-              counts: {
-                distinct_entities: 0,
-                non_entity_tokens: 5,
-                clients: 5,
-              },
-            },
-            {
-              mount_path: 'auth/up2/',
-              counts: {
-                distinct_entities: 5,
-                non_entity_tokens: 0,
-                clients: 5,
-              },
-            },
-          ],
+          previousVersion: '1.9.1',
+          timestampInstalled: '2023-09-02T00:00:00Z',
+          version: '1.10.1',
         },
-      ],
-      new_clients: {
-        counts: {
-          distinct_entities: 3,
-          non_entity_tokens: 2,
-          clients: 5,
+        {
+          previousVersion: '1.16.0',
+          timestampInstalled: '2023-12-02T00:00:00Z',
+          version: '1.17.0',
         },
-        namespaces: [
-          {
-            namespace_id: 'root',
-            namespace_path: '',
-            counts: {
-              distinct_entities: 3,
-              non_entity_tokens: 2,
-              clients: 5,
-            },
-            mounts: [
-              {
-                mount_path: 'auth/up2/',
-                counts: {
-                  distinct_entities: 3,
-                  non_entity_tokens: 0,
-                  clients: 3,
-                },
-              },
-              {
-                mount_path: 'auth/up1/',
-                counts: {
-                  distinct_entities: 0,
-                  non_entity_tokens: 2,
-                  clients: 2,
-                },
-              },
-            ],
-          },
-        ],
-      },
-    },
-    {
-      timestamp: '2021-10-01T00:00:00Z',
-      counts: {
-        distinct_entities: 20,
-        entity_clients: 20,
-        non_entity_tokens: 20,
-        non_entity_clients: 20,
-        clients: 40,
-      },
-      namespaces: [
+      ];
+      // set start/end times longer than version history to test all relevant upgrades return
+      const startTime = '2023-06-02T00:00:00Z'; // first upgrade installed '2023-07-02T00:00:00Z'
+      const endTime = '2024-03-04T16:14:21Z'; // latest upgrade installed '2023-12-02T00:00:00Z'
+      const filteredHistory = filterVersionHistory(this.versionHistory, startTime, endTime);
+      assert.deepEqual(
+        JSON.stringify(filteredHistory),
+        JSON.stringify(expected),
+        'it returns all notable upgrades'
+      );
+      assert.notPropContains(
+        filteredHistory,
         {
-          namespace_id: 'root',
-          namespace_path: '',
-          counts: {
-            distinct_entities: 8,
-            entity_clients: 8,
-            non_entity_tokens: 7,
-            non_entity_clients: 7,
-            clients: 15,
-          },
-          mounts: [
-            {
-              mount_path: 'auth/up2/',
-              counts: {
-                distinct_entities: 8,
-                entity_clients: 8,
-                non_entity_tokens: 0,
-                non_entity_clients: 0,
-                clients: 8,
-              },
-            },
-            {
-              mount_path: 'auth/up1/',
-              counts: {
-                distinct_entities: 0,
-                entity_clients: 0,
-                non_entity_tokens: 7,
-                non_entity_clients: 7,
-                clients: 7,
-              },
-            },
-          ],
+          version: '1.9.0',
+          previousVersion: null,
+          timestampInstalled: '2023-07-02T00:00:00Z',
         },
+        'does not include version history if previous_version is null'
+      );
+      assert.propEqual(this.versionHistory, original, 'it does not modify original array');
+    });
+
+    test('it only returns version data for initial upgrades between given date range', async function (assert) {
+      assert.expect(2);
+      const expected = [
         {
-          namespace_id: 's07UR',
-          namespace_path: 'ns1/',
-          counts: {
-            distinct_entities: 5,
-            entity_clients: 5,
-            non_entity_tokens: 5,
-            non_entity_clients: 5,
-            clients: 10,
-          },
-          mounts: [
-            {
-              mount_path: 'auth/up1/',
-              counts: {
-                distinct_entities: 0,
-                entity_clients: 0,
-                non_entity_tokens: 5,
-                non_entity_clients: 5,
-                clients: 5,
-              },
-            },
-            {
-              mount_path: 'auth/up2/',
-              counts: {
-                distinct_entities: 5,
-                entity_clients: 5,
-                non_entity_tokens: 0,
-                non_entity_clients: 0,
-                clients: 5,
-              },
-            },
-          ],
+          previousVersion: '1.9.0',
+          timestampInstalled: '2023-08-02T00:00:00Z',
+          version: '1.9.1',
         },
-      ],
-      new_clients: {
+        {
+          previousVersion: '1.9.1',
+          timestampInstalled: '2023-09-02T00:00:00Z',
+          version: '1.10.1',
+        },
+      ];
+      const startTime = '2023-08-02T00:00:00Z'; // same date as 1.9.1 install date to catch same day edge cases
+      const endTime = '2023-11-02T00:00:00Z';
+      const filteredHistory = filterVersionHistory(this.versionHistory, startTime, endTime);
+      assert.deepEqual(
+        JSON.stringify(filteredHistory),
+        JSON.stringify(expected),
+        'it only returns upgrades during date range'
+      );
+      assert.notPropContains(
+        filteredHistory,
+        {
+          version: '1.10.3',
+          previousVersion: '1.10.1',
+          timestampInstalled: '2023-09-23T00:00:00Z',
+        },
+        'it does not return subsequent patch versions of the same notable upgrade version'
+      );
+    });
+  });
+
+  test('flattenMounts: it flattens mount data', async function (assert) {
+    assert.expect(2);
+    const original = [...SERIALIZED_ACTIVITY_RESPONSE.by_namespace];
+    const expected = [
+      ...SERIALIZED_ACTIVITY_RESPONSE.by_namespace[0].mounts,
+      ...SERIALIZED_ACTIVITY_RESPONSE.by_namespace[1].mounts,
+    ];
+    const actual = flattenMounts(SERIALIZED_ACTIVITY_RESPONSE.by_namespace);
+
+    assert.propEqual(actual, expected, 'it returns mounts from each namespace object into a single array');
+    assert.propEqual(
+      SERIALIZED_ACTIVITY_RESPONSE.by_namespace,
+      original,
+      'it does not modify original by_namespace array'
+    );
+  });
+
+  test('formatByMonths: it formats the months array', async function (assert) {
+    assert.expect(7);
+    const original = [...RESPONSE.months];
+
+    const [formattedNoData, formattedWithActivity, formattedNoNew] = formatByMonths(RESPONSE.months);
+
+    // instead of asserting the whole expected response, broken up so tests are easier to debug
+    // but kept whole above to copy/paste updated response expectations in the future
+    const [expectedNoData, expectedWithActivity, expectedNoNew] = SERIALIZED_ACTIVITY_RESPONSE.by_month;
+
+    assert.propEqual(formattedNoData, expectedNoData, 'it formats months without data');
+    ['namespaces', 'new_clients'].forEach((key) => {
+      assert.propEqual(
+        formattedWithActivity[key],
+        expectedWithActivity[key],
+        `it formats ${key} array for months with data`
+      );
+      assert.propEqual(
+        formattedNoNew[key],
+        expectedNoNew[key],
+        `it formats the ${key} array for months with no new clients`
+      );
+    });
+
+    assert.propEqual(RESPONSE.months, original, 'it does not modify original months array');
+    assert.propEqual(formatByMonths([]), [], 'it returns an empty array if the months key is empty');
+  });
+
+  test('formatByNamespace: it formats namespace array with mounts', async function (assert) {
+    const original = [...RESPONSE.by_namespace];
+    const expectedNs1 = SERIALIZED_ACTIVITY_RESPONSE.by_namespace.find((ns) => ns.label === 'ns1/');
+    const formattedNs1 = formatByNamespace(RESPONSE.by_namespace).find((ns) => ns.label === 'ns1/');
+    assert.expect(2 + formattedNs1.mounts.length);
+
+    assert.propEqual(formattedNs1, expectedNs1, 'it formats ns1/ namespace');
+    assert.propEqual(RESPONSE.by_namespace, original, 'it does not modify original by_namespace array');
+
+    formattedNs1.mounts.forEach((mount) => {
+      const expectedMount = expectedNs1.mounts.find((m) => m.label === mount.label);
+      assert.propEqual(mount, expectedMount, `${mount.label} has expected key/value pairs`);
+    });
+  });
+
+  test('destructureClientCounts: it returns relevant key names when both old and new keys exist', async function (assert) {
+    assert.expect(2);
+    const original = { ...RESPONSE.total };
+    const expected = {
+      acme_clients: 9702,
+      clients: 35287,
+      entity_clients: 8258,
+      non_entity_clients: 8227,
+      secret_syncs: 9100,
+    };
+    assert.propEqual(destructureClientCounts(RESPONSE.total), expected);
+    assert.propEqual(RESPONSE.total, original, 'it does not modify original object');
+  });
+
+  test('sortMonthsByTimestamp: sorts timestamps chronologically, oldest to most recent', async function (assert) {
+    assert.expect(2);
+    // API returns them in order so this test is extra extra
+    const unOrdered = [RESPONSE.months[1], RESPONSE.months[0], RESPONSE.months[3], RESPONSE.months[2]]; // mixup order
+    const original = [...RESPONSE.months];
+    const expected = RESPONSE.months;
+    assert.propEqual(sortMonthsByTimestamp(unOrdered), expected);
+    assert.propEqual(RESPONSE.months, original, 'it does not modify original array');
+  });
+
+  // TESTS FOR COMBINED ACTIVITY DATA - no mount attribution < 1.10
+  test('it formats the namespaces array with no mount attribution (activity log data < 1.10)', async function (assert) {
+    assert.expect(2);
+    const noMounts = [
+      {
+        namespace_id: 'root',
+        namespace_path: '',
         counts: {
-          distinct_entities: 3,
-          entity_clients: 3,
-          non_entity_tokens: 2,
-          non_entity_clients: 2,
-          clients: 5,
+          entity_clients: 10,
+          non_entity_clients: 20,
+          secret_syncs: 0,
+          acme_clients: 0,
+          clients: 30,
         },
-        namespaces: [
+        mounts: [
           {
-            namespace_id: 'root',
-            namespace_path: '',
             counts: {
-              distinct_entities: 3,
-              entity_clients: 3,
-              non_entity_tokens: 2,
-              non_entity_clients: 2,
-              clients: 5,
+              entity_clients: 10,
+              non_entity_clients: 20,
+              secret_syncs: 0,
+              acme_clients: 0,
+              clients: 30,
             },
-            mounts: [
-              {
-                mount_path: 'auth/up2/',
-                counts: {
-                  distinct_entities: 3,
-                  entity_clients: 3,
-                  non_entity_tokens: 0,
-                  non_entity_clients: 0,
-                  clients: 3,
-                },
-              },
-              {
-                mount_path: 'auth/up1/',
-                counts: {
-                  distinct_entities: 0,
-                  entity_clients: 0,
-                  non_entity_tokens: 2,
-                  non_entity_clients: 2,
-                  clients: 2,
-                },
-              },
-            ],
+            mount_path: 'no mount accessor (pre-1.10 upgrade?)',
+            mount_type: '',
           },
         ],
       },
-    },
-    {
-      timestamp: '2021-09-01T00:00:00Z',
-      counts: {
-        distinct_entities: 0,
-        entity_clients: 17,
-        non_entity_tokens: 0,
-        non_entity_clients: 18,
-        clients: 35,
-      },
-      namespaces: [
-        {
-          namespace_id: 'oImjk',
-          namespace_path: 'ns2/',
-          counts: {
-            distinct_entities: 0,
-            entity_clients: 5,
-            non_entity_tokens: 0,
-            non_entity_clients: 5,
-            clients: 10,
-          },
-          mounts: [
-            {
-              mount_path: 'auth/up1/',
-              counts: {
-                distinct_entities: 0,
-                entity_clients: 0,
-                non_entity_tokens: 0,
-                non_entity_clients: 5,
-                clients: 5,
-              },
-            },
-            {
-              mount_path: 'auth/up2/',
-              counts: {
-                distinct_entities: 0,
-                entity_clients: 5,
-                non_entity_tokens: 0,
-                non_entity_clients: 0,
-                clients: 5,
-              },
-            },
-          ],
-        },
-        {
-          namespace_id: 'root',
-          namespace_path: '',
-          counts: {
-            distinct_entities: 0,
-            entity_clients: 2,
-            non_entity_tokens: 0,
-            non_entity_clients: 3,
-            clients: 5,
+    ];
+    const expected = [
+      {
+        acme_clients: 0,
+        clients: 30,
+        entity_clients: 10,
+        label: 'root',
+        mounts: [
+          {
+            acme_clients: 0,
+            clients: 30,
+            entity_clients: 10,
+            label: 'no mount accessor (pre-1.10 upgrade?)',
+            mount_path: 'no mount accessor (pre-1.10 upgrade?)',
+            mount_type: '',
+            namespace_path: 'root',
+            non_entity_clients: 20,
+            secret_syncs: 0,
           },
-          mounts: [
-            {
-              mount_path: 'auth/up1/',
-              counts: {
-                distinct_entities: 0,
-                entity_clients: 0,
-                non_entity_tokens: 0,
-                non_entity_clients: 3,
-                clients: 3,
-              },
-            },
-            {
-              mount_path: 'auth/up2/',
-              counts: {
-                distinct_entities: 0,
-                entity_clients: 2,
-                non_entity_tokens: 0,
-                non_entity_clients: 0,
-                clients: 2,
-              },
-            },
-          ],
-        },
+        ],
+        non_entity_clients: 20,
+        secret_syncs: 0,
+      },
+    ];
+    assert.propEqual(formatByNamespace(noMounts), expected, 'it formats namespace without mounts');
+    assert.propEqual(formatByNamespace([]), [], 'it returns an empty array if the by_namespace key is empty');
+  });
+
+  test('it formats the months array with mixed activity data', async function (assert) {
+    assert.expect(2);
+
+    const [, formattedWithActivity] = formatByMonths(MIXED_RESPONSE.months);
+    // mirage isn't set up to generate mixed data, so hardcoding the expected responses here
+    assert.propEqual(
+      formattedWithActivity.namespaces,
+      [
         {
-          namespace_id: 's07UR',
-          namespace_path: 'ns1/',
-          counts: {
-            distinct_entities: 0,
-            entity_clients: 3,
-            non_entity_tokens: 0,
-            non_entity_clients: 2,
-            clients: 5,
-          },
+          acme_clients: 0,
+          clients: 3,
+          entity_clients: 3,
+          label: 'root',
           mounts: [
             {
-              mount_path: 'auth/up2/',
-              counts: {
-                distinct_entities: 0,
-                entity_clients: 3,
-                non_entity_tokens: 0,
-                non_entity_clients: 0,
-                clients: 3,
-              },
+              acme_clients: 0,
+              clients: 2,
+              entity_clients: 2,
+              label: 'no mount accessor (pre-1.10 upgrade?)',
+              mount_path: 'no mount accessor (pre-1.10 upgrade?)',
+              mount_type: 'no mount path (pre-1.10 upgrade?)',
+              namespace_path: 'root',
+              non_entity_clients: 0,
+              secret_syncs: 0,
             },
             {
-              mount_path: 'auth/up1/',
-              counts: {
-                distinct_entities: 0,
-                entity_clients: 0,
-                non_entity_tokens: 0,
-                non_entity_clients: 2,
-                clients: 2,
-              },
+              acme_clients: 0,
+              clients: 1,
+              entity_clients: 1,
+              label: 'auth/userpass/0/',
+              mount_path: 'auth/userpass/0/',
+              mount_type: 'userpass',
+              namespace_path: 'root',
+              non_entity_clients: 0,
+              secret_syncs: 0,
             },
           ],
+          non_entity_clients: 0,
+          secret_syncs: 0,
         },
       ],
-      new_clients: {
-        counts: {
-          distinct_entities: 0,
-          entity_clients: 10,
-          non_entity_tokens: 0,
-          non_entity_clients: 10,
-          clients: 20,
-        },
+      'it formats combined data for monthly namespaces spanning upgrade to 1.10'
+    );
+    assert.propEqual(
+      formattedWithActivity.new_clients,
+      {
+        acme_clients: 0,
+        clients: 3,
+        entity_clients: 3,
+
         namespaces: [
           {
-            namespace_id: 'oImjk',
-            namespace_path: 'ns2/',
-            counts: {
-              distinct_entities: 0,
-              entity_clients: 5,
-              non_entity_tokens: 0,
-              non_entity_clients: 5,
-              clients: 10,
-            },
-            mounts: [
-              {
-                mount_path: 'auth/up1/',
-                counts: {
-                  distinct_entities: 0,
-                  entity_clients: 0,
-                  non_entity_tokens: 0,
-                  non_entity_clients: 5,
-                  clients: 5,
-                },
-              },
-              {
-                mount_path: 'auth/up2/',
-                counts: {
-                  distinct_entities: 0,
-                  entity_clients: 5,
-                  non_entity_tokens: 0,
-                  non_entity_clients: 0,
-                  clients: 5,
-                },
-              },
-            ],
-          },
-          {
-            namespace_id: 'root',
-            namespace_path: '',
-            counts: {
-              distinct_entities: 0,
-              entity_clients: 2,
-              non_entity_tokens: 0,
-              non_entity_clients: 3,
-              clients: 5,
-            },
-            mounts: [
-              {
-                mount_path: 'auth/up1/',
-                counts: {
-                  distinct_entities: 0,
-                  entity_clients: 0,
-                  non_entity_tokens: 0,
-                  non_entity_clients: 3,
-                  clients: 3,
-                },
-              },
-              {
-                mount_path: 'auth/up2/',
-                counts: {
-                  distinct_entities: 0,
-                  entity_clients: 2,
-                  non_entity_tokens: 0,
-                  non_entity_clients: 0,
-                  clients: 2,
-                },
-              },
-            ],
-          },
-          {
-            namespace_id: 's07UR',
-            namespace_path: 'ns1/',
-            counts: {
-              distinct_entities: 0,
-              entity_clients: 3,
-              non_entity_tokens: 0,
-              non_entity_clients: 2,
-              clients: 5,
-            },
+            acme_clients: 0,
+            clients: 3,
+            entity_clients: 3,
+            label: 'root',
             mounts: [
               {
-                mount_path: 'auth/up2/',
-                counts: {
-                  distinct_entities: 0,
-                  entity_clients: 3,
-                  non_entity_tokens: 0,
-                  non_entity_clients: 0,
-                  clients: 3,
-                },
+                acme_clients: 0,
+                clients: 2,
+                entity_clients: 2,
+                label: 'no mount accessor (pre-1.10 upgrade?)',
+                mount_path: 'no mount accessor (pre-1.10 upgrade?)',
+                mount_type: 'no mount path (pre-1.10 upgrade?)',
+                namespace_path: 'root',
+                non_entity_clients: 0,
+                secret_syncs: 0,
               },
               {
-                mount_path: 'auth/up1/',
-                counts: {
-                  distinct_entities: 0,
-                  entity_clients: 0,
-                  non_entity_tokens: 0,
-                  non_entity_clients: 2,
-                  clients: 2,
-                },
+                acme_clients: 0,
+                clients: 1,
+                entity_clients: 1,
+                label: 'auth/userpass/0/',
+                mount_path: 'auth/userpass/0/',
+                mount_type: 'userpass',
+                namespace_path: 'root',
+                non_entity_clients: 0,
+                secret_syncs: 0,
               },
             ],
+            non_entity_clients: 0,
+            secret_syncs: 0,
           },
         ],
+        non_entity_clients: 0,
+        secret_syncs: 0,
+        timestamp: '2024-04-01T00:00:00Z',
       },
-    },
-  ];
-
-  const BY_NAMESPACE = [
-    {
-      namespace_id: '96OwG',
-      namespace_path: 'test-ns/',
-      counts: {
-        distinct_entities: 18290,
-        entity_clients: 18290,
-        non_entity_tokens: 18738,
-        non_entity_clients: 18738,
-        clients: 37028,
-      },
-      mounts: [
-        {
-          mount_path: 'path-1',
-          counts: {
-            distinct_entities: 6403,
-            entity_clients: 6403,
-            non_entity_tokens: 6300,
-            non_entity_clients: 6300,
-            clients: 12703,
-          },
-        },
-        {
-          mount_path: 'path-2',
-          counts: {
-            distinct_entities: 5699,
-            entity_clients: 5699,
-            non_entity_tokens: 6777,
-            non_entity_clients: 6777,
-            clients: 12476,
-          },
-        },
-        {
-          mount_path: 'path-3',
-          counts: {
-            distinct_entities: 6188,
-            entity_clients: 6188,
-            non_entity_tokens: 5661,
-            non_entity_clients: 5661,
-            clients: 11849,
-          },
-        },
-      ],
-    },
-    {
-      namespace_id: 'root',
-      namespace_path: '',
-      counts: {
-        distinct_entities: 19099,
-        entity_clients: 19099,
-        non_entity_tokens: 17781,
-        non_entity_clients: 17781,
-        clients: 36880,
-      },
-      mounts: [
-        {
-          mount_path: 'path-3',
-          counts: {
-            distinct_entities: 6863,
-            entity_clients: 6863,
-            non_entity_tokens: 6801,
-            non_entity_clients: 6801,
-            clients: 13664,
-          },
-        },
-        {
-          mount_path: 'path-2',
-          counts: {
-            distinct_entities: 6047,
-            entity_clients: 6047,
-            non_entity_tokens: 5957,
-            non_entity_clients: 5957,
-            clients: 12004,
-          },
-        },
-        {
-          mount_path: 'path-1',
-          counts: {
-            distinct_entities: 6189,
-            entity_clients: 6189,
-            non_entity_tokens: 5023,
-            non_entity_clients: 5023,
-            clients: 11212,
-          },
-        },
-        {
-          mount_path: 'auth/up2/',
-          counts: {
-            distinct_entities: 0,
-            entity_clients: 50,
-            non_entity_tokens: 0,
-            non_entity_clients: 23,
-            clients: 73,
-          },
-        },
-        {
-          mount_path: 'auth/up1/',
-          counts: {
-            distinct_entities: 0,
-            entity_clients: 25,
-            non_entity_tokens: 0,
-            non_entity_clients: 15,
-            clients: 40,
-          },
-        },
-      ],
-    },
-  ];
-
-  const EMPTY_MONTHS = [
-    {
-      timestamp: '2021-06-01T00:00:00Z',
-      counts: null,
-      namespaces: null,
-      new_clients: null,
-    },
-    {
-      timestamp: '2021-07-01T00:00:00Z',
-      counts: null,
-      namespaces: null,
-      new_clients: null,
-    },
-  ];
-
-  const SOME_OBJECT = { foo: 'bar' };
-
-  test('formatByMonths: formats the months array', async function (assert) {
-    assert.expect(103);
-    const keyNameAssertions = (object, objectName) => {
-      const objectKeys = Object.keys(object);
-      assert.false(objectKeys.includes('counts'), `${objectName} doesn't include 'counts' key`);
-      assert.true(objectKeys.includes('clients'), `${objectName} includes 'clients' key`);
-      assert.true(objectKeys.includes('entity_clients'), `${objectName} includes 'entity_clients' key`);
-      assert.true(
-        objectKeys.includes('non_entity_clients'),
-        `${objectName} includes 'non_entity_clients' key`
-      );
-    };
-    const assertClientCounts = (object, originalObject) => {
-      const newObjectKeys = ['clients', 'entity_clients', 'non_entity_clients'];
-      const originalKeys = Object.keys(originalObject.counts).includes('entity_clients')
-        ? newObjectKeys
-        : ['clients', 'distinct_entities', 'non_entity_tokens'];
-
-      newObjectKeys.forEach((key, i) => {
-        assert.strictEqual(
-          object[key],
-          originalObject.counts[originalKeys[i]],
-          `${object.month} ${key} equal original counts`
-        );
-      });
-    };
-
-    const formattedMonths = formatByMonths(MONTHS);
-    assert.notEqual(formattedMonths, MONTHS, 'does not modify original array');
-
-    formattedMonths.forEach((month) => {
-      const originalMonth = MONTHS.find((m) => month.month === parseAPITimestamp(m.timestamp, 'M/yy'));
-      // if originalMonth is found (not undefined) then the formatted month has an accurate, parsed timestamp
-      assert.ok(originalMonth, `month has parsed timestamp of ${month.month}`);
-      assert.ok(month.namespaces_by_key, `month includes 'namespaces_by_key' key`);
-
-      keyNameAssertions(month, 'formatted month');
-      assertClientCounts(month, originalMonth);
-
-      assert.ok(month.new_clients.month, 'new clients key has a month key');
-      keyNameAssertions(month.new_clients, 'formatted month new_clients');
-      assertClientCounts(month.new_clients, originalMonth.new_clients);
+      'it formats combined data for monthly new_clients spanning upgrade to 1.10'
+    );
+  });
 
-      month.namespaces.forEach((namespace) => keyNameAssertions(namespace, 'namespace within month'));
-      month.new_clients.namespaces.forEach((namespace) =>
-        keyNameAssertions(namespace, 'new client namespaces within month')
-      );
+  module('filterTableData', function (hooks) {
+    hooks.beforeEach(async function () {
+      const activityByMount = flattenMounts(SERIALIZED_ACTIVITY_RESPONSE.by_namespace);
+      this.mockMountData = [...activityByMount];
+      // copy mock data before using the filterTableData function to assert filtering doesn't modify the original array
+      const original = [...this.mockMountData];
+      this.assertOriginal = (assert) =>
+        assert.propEqual(this.mockMountData, original, 'filtering does not mutate dataset');
     });
 
-    // method fails gracefully
-    const expected = [
-      {
-        counts: null,
-        month: '6/21',
-        namespaces: [],
-        namespaces_by_key: {},
-        new_clients: {
-          month: '6/21',
-          namespaces: [],
-          timestamp: '2021-06-01T00:00:00Z',
-        },
-        timestamp: '2021-06-01T00:00:00Z',
-      },
-      {
-        counts: null,
-        month: '7/21',
-        namespaces: [],
-        namespaces_by_key: {},
-        new_clients: {
-          month: '7/21',
-          namespaces: [],
-          timestamp: '2021-07-01T00:00:00Z',
-        },
-        timestamp: '2021-07-01T00:00:00Z',
-      },
-    ];
-    assert.strictEqual(formatByMonths(SOME_OBJECT), SOME_OBJECT, 'it returns if arg is not an array');
-    assert.propEqual(expected, formatByMonths(EMPTY_MONTHS), 'it does not error with null months');
-    assert.ok(formatByMonths([...EMPTY_MONTHS, ...MONTHS]), 'it does not error with combined data');
-  });
-
-  test('formatByNamespace: formats namespace arrays with and without mounts', async function (assert) {
-    assert.expect(102);
-    const keyNameAssertions = (object, objectName) => {
-      const objectKeys = Object.keys(object);
-      assert.false(objectKeys.includes('counts'), `${objectName} doesn't include 'counts' key`);
-      assert.true(objectKeys.includes('label'), `${objectName} includes 'label' key`);
-      assert.true(objectKeys.includes('clients'), `${objectName} includes 'clients' key`);
-      assert.true(objectKeys.includes('entity_clients'), `${objectName} includes 'entity_clients' key`);
-      assert.true(
-        objectKeys.includes('non_entity_clients'),
-        `${objectName} includes 'non_entity_clients' key`
-      );
-    };
-    const keyValueAssertions = (object, pathName, originalObject) => {
-      const keysToAssert = ['clients', 'entity_clients', 'non_entity_clients'];
-      assert.strictEqual(object.label, originalObject[pathName], `${pathName} matches label`);
+    test('it returns original data if no filters are passed', async function (assert) {
+      const emptyObject = filterTableData(this.mockMountData, {});
+      assert.propEqual(emptyObject, this.mockMountData, 'when filters arg is an empty object');
+      this.assertOriginal(assert);
 
-      keysToAssert.forEach((key) => {
-        assert.strictEqual(object[key], originalObject.counts[key], `number of ${key} equal original`);
+      const emptyValues = filterTableData(this.mockMountData, {
+        namespace_path: '',
+        mount_path: '',
+        mount_type: '',
       });
-    };
-
-    const formattedNamespaces = formatByNamespace(BY_NAMESPACE);
-    assert.notEqual(formattedNamespaces, MONTHS, 'does not modify original array');
+      assert.propEqual(emptyValues, this.mockMountData, 'when filters have are empty strings');
+      this.assertOriginal(assert);
 
-    formattedNamespaces.forEach((namespace) => {
-      const origNamespace = BY_NAMESPACE.find((ns) => ns.namespace_path === namespace.label);
-      keyNameAssertions(namespace, 'formatted namespace');
-      keyValueAssertions(namespace, 'namespace_path', origNamespace);
-
-      namespace.mounts.forEach((mount) => {
-        const origMount = origNamespace.mounts.find((m) => m.mount_path === mount.label);
-        keyNameAssertions(mount, 'formatted mount');
-        keyValueAssertions(mount, 'mount_path', origMount);
-      });
+      const nullFilter = filterTableData(this.mockMountData, null);
+      assert.propEqual(nullFilter, this.mockMountData, 'returns all data when no filters are null');
+      this.assertOriginal(assert);
     });
 
-    const nsWithoutMounts = {
-      namespace_id: '96OwG',
-      namespace_path: 'no-mounts-ns/',
-      counts: {
-        distinct_entities: 18290,
-        entity_clients: 18290,
-        non_entity_tokens: 18738,
-        non_entity_clients: 18738,
-        clients: 37028,
-      },
-      mounts: [],
-    };
-
-    const formattedNsWithoutMounts = formatByNamespace([nsWithoutMounts])[0];
-    keyNameAssertions(formattedNsWithoutMounts, 'namespace without mounts');
-    keyValueAssertions(formattedNsWithoutMounts, 'namespace_path', nsWithoutMounts);
-    assert.strictEqual(formattedNsWithoutMounts.mounts.length, 0, 'formatted namespace has no mounts');
-
-    assert.strictEqual(formatByNamespace(SOME_OBJECT), SOME_OBJECT, 'it returns if arg is not an array');
-  });
-
-  test('homogenizeClientNaming: homogenizes key names when both old and new keys exist, or just old key names', async function (assert) {
-    assert.expect(168);
-    const keyNameAssertions = (object, objectName) => {
-      const objectKeys = Object.keys(object);
-      assert.false(
-        objectKeys.includes('distinct_entities'),
-        `${objectName} doesn't include 'distinct_entities' key`
-      );
-      assert.false(
-        objectKeys.includes('non_entity_tokens'),
-        `${objectName} doesn't include 'non_entity_tokens' key`
-      );
-      assert.true(objectKeys.includes('entity_clients'), `${objectName} includes 'entity_clients' key`);
-      assert.true(
-        objectKeys.includes('non_entity_clients'),
-        `${objectName} includes 'non_entity_clients' key`
-      );
-    };
-
-    const transformedMonths = [...MONTHS];
-    transformedMonths.forEach((month) => {
-      month.counts = homogenizeClientNaming(month.counts);
-      keyNameAssertions(month.counts, 'month counts');
-
-      month.new_clients.counts = homogenizeClientNaming(month.new_clients.counts);
-      keyNameAssertions(month.new_clients.counts, 'month new counts');
-
-      month.namespaces.forEach((ns) => {
-        ns.counts = homogenizeClientNaming(ns.counts);
-        keyNameAssertions(ns.counts, 'namespace counts');
-
-        ns.mounts.forEach((mount) => {
-          mount.counts = homogenizeClientNaming(mount.counts);
-          keyNameAssertions(mount.counts, 'mount counts');
-        });
+    test('it filters data for a single filter', async function (assert) {
+      const namespaceFilter = filterTableData(this.mockMountData, {
+        namespace_path: 'root',
+        mount_path: '',
+        mount_type: '',
       });
-
-      month.new_clients.namespaces.forEach((ns) => {
-        ns.counts = homogenizeClientNaming(ns.counts);
-        keyNameAssertions(ns.counts, 'namespace new counts');
-
-        ns.mounts.forEach((mount) => {
-          mount.counts = homogenizeClientNaming(mount.counts);
-          keyNameAssertions(mount.counts, 'mount new counts');
-        });
+      const expectedNamespaceFilter = this.mockMountData.filter((m) => m.namespace_path === 'root');
+      assert.propEqual(namespaceFilter, expectedNamespaceFilter, 'it filters by namespace_path');
+      this.assertOriginal(assert);
+
+      const mountPathFilter = filterTableData(this.mockMountData, {
+        namespace_path: '',
+        mount_path: 'acme/pki/0/',
+        mount_type: '',
+      });
+      const expectedMountPathFilter = this.mockMountData.filter((m) => m.mount_path === 'acme/pki/0/');
+      assert.propEqual(mountPathFilter, expectedMountPathFilter, 'it filters by mount_path');
+      this.assertOriginal(assert);
+
+      const mountTypeFilter = filterTableData(this.mockMountData, {
+        namespace_path: '',
+        mount_path: '',
+        mount_type: 'userpass',
       });
+      const expectedMountTypeFilter = this.mockMountData.filter((m) => m.mount_type === 'userpass');
+      assert.propEqual(mountTypeFilter, expectedMountTypeFilter, 'it filters by mount_type');
+      this.assertOriginal(assert);
     });
-  });
 
-  test('flattenDataset: removes the counts key and flattens the dataset', async function (assert) {
-    assert.expect(22);
-    const flattenedNamespace = flattenDataset(BY_NAMESPACE[0]);
-    const flattenedMount = flattenDataset(BY_NAMESPACE[0].mounts[0]);
-    const flattenedMonth = flattenDataset(MONTHS[0]);
-    const flattenedNewMonthClients = flattenDataset(MONTHS[0].new_clients);
-    const objectNullCounts = { counts: null, foo: 'bar' };
-
-    const keyNameAssertions = (object, objectName) => {
-      const objectKeys = Object.keys(object);
-      assert.false(objectKeys.includes('counts'), `${objectName} doesn't include 'counts' key`);
-      assert.true(objectKeys.includes('clients'), `${objectName} includes 'clients' key`);
-      assert.true(objectKeys.includes('entity_clients'), `${objectName} includes 'entity_clients' key`);
-      assert.true(
-        objectKeys.includes('non_entity_clients'),
-        `${objectName} includes 'non_entity_clients' key`
+    test('it filters data for a multiple filters', async function (assert) {
+      const twoFilters = filterTableData(this.mockMountData, {
+        namespace_path: 'root',
+        mount_path: '',
+        mount_type: 'userpass',
+      });
+      const expectedTwoFilters = this.mockMountData.filter(
+        (m) => m.namespace_path === 'root' && m.mount_type === 'userpass'
       );
-    };
+      assert.propEqual(twoFilters, expectedTwoFilters, 'it filters by namespace_path and mount_type');
+      this.assertOriginal(assert);
 
-    keyNameAssertions(flattenedNamespace, 'namespace object');
-    keyNameAssertions(flattenedMount, 'mount object');
-    keyNameAssertions(flattenedMonth, 'month object');
-    keyNameAssertions(flattenedNewMonthClients, 'month new_clients object');
-
-    assert.strictEqual(
-      flattenDataset(SOME_OBJECT),
-      SOME_OBJECT,
-      "it returns original object if counts key doesn't exist"
-    );
-
-    assert.strictEqual(
-      flattenDataset(objectNullCounts),
-      objectNullCounts,
-      'it returns original object if counts are null'
-    );
-
-    assert.propEqual(
-      ['some array'],
-      flattenDataset(['some array']),
-      'it fails gracefully if an array is passed in'
-    );
-    assert.strictEqual(flattenDataset(null), null, 'it fails gracefully if null is passed in');
-    assert.strictEqual(
-      flattenDataset('some string'),
-      'some string',
-      'it fails gracefully if a string is passed in'
-    );
-    assert.propEqual(
-      new Object(),
-      flattenDataset(new Object()),
-      'it fails gracefully if an empty object is passed in'
-    );
-  });
-
-  test('sortMonthsByTimestamp: sorts timestamps chronologically, oldest to most recent', async function (assert) {
-    assert.expect(4);
-    const sortedMonths = sortMonthsByTimestamp(MONTHS);
-    assert.ok(
-      isBefore(parseAPITimestamp(sortedMonths[0].timestamp), parseAPITimestamp(sortedMonths[1].timestamp)),
-      'first timestamp date is earlier than second'
-    );
-    assert.ok(
-      isAfter(parseAPITimestamp(sortedMonths[2].timestamp), parseAPITimestamp(sortedMonths[1].timestamp)),
-      'third timestamp date is later second'
-    );
-    assert.notEqual(sortedMonths[1], MONTHS[1], 'it does not modify original array');
-    assert.strictEqual(sortedMonths[0], MONTHS[0], 'it does not modify original array');
-  });
-
-  test('namespaceArrayToObject: transforms data without modifying original', async function (assert) {
-    assert.expect(30);
-
-    const assertClientCounts = (object, originalObject) => {
-      const valuesToCheck = ['clients', 'entity_clients', 'non_entity_clients'];
-
-      valuesToCheck.forEach((key) => {
-        assert.strictEqual(object[key], originalObject[key], `${key} equal original counts`);
+      const allFilters = filterTableData(this.mockMountData, {
+        namespace_path: 'root',
+        mount_path: 'auth/userpass/0/',
+        mount_type: 'userpass',
       });
-    };
-    const totalClientsByNamespace = formatByNamespace(MONTHS[1].namespaces);
-    const newClientsByNamespace = formatByNamespace(MONTHS[1].new_clients.namespaces);
-
-    const byNamespaceKeyObject = namespaceArrayToObject(
-      totalClientsByNamespace,
-      newClientsByNamespace,
-      '10/21',
-      '2021-10-01T00:00:00Z'
-    );
-
-    assert.propEqual(
-      totalClientsByNamespace,
-      formatByNamespace(MONTHS[1].namespaces),
-      'it does not modify original array'
-    );
-    assert.propEqual(
-      newClientsByNamespace,
-      formatByNamespace(MONTHS[1].new_clients.namespaces),
-      'it does not modify original array'
-    );
+      const expectedAllFilters = [
+        {
+          label: 'auth/userpass/0/',
+          mount_path: 'auth/userpass/0/',
+          mount_type: 'userpass',
+          namespace_path: 'root',
+          acme_clients: 0,
+          clients: 8091,
+          entity_clients: 4002,
+          non_entity_clients: 4089,
+          secret_syncs: 0,
+        },
+      ];
+      assert.propEqual(allFilters, expectedAllFilters, 'it filters by all filters');
+      this.assertOriginal(assert);
+    });
 
-    const namespaceKeys = Object.keys(byNamespaceKeyObject);
-    namespaceKeys.forEach((nsKey) => {
-      const newNsObject = byNamespaceKeyObject[nsKey];
-      const originalNsData = totalClientsByNamespace.find((ns) => ns.label === nsKey);
-      assertClientCounts(newNsObject, originalNsData);
-      const mountKeys = Object.keys(newNsObject.mounts_by_key);
-      mountKeys.forEach((mKey) => {
-        const mountData = originalNsData.mounts.find((m) => m.label === mKey);
-        assertClientCounts(newNsObject.mounts_by_key[mKey], mountData);
+    test('it returns an empty array when there are no matches', async function (assert) {
+      const noMatches = filterTableData(this.mockMountData, {
+        namespace_path: 'does not exist',
+        mount_path: '',
+        mount_type: '',
       });
+      assert.propEqual(noMatches, [], 'returns an empty array when no data matches filters');
+      this.assertOriginal(assert);
     });
 
-    namespaceKeys.forEach((nsKey) => {
-      const newNsObject = byNamespaceKeyObject[nsKey];
-      const originalNsData = newClientsByNamespace.find((ns) => ns.label === nsKey);
-      if (!originalNsData) return;
-      assertClientCounts(newNsObject.new_clients, originalNsData);
-      const mountKeys = Object.keys(newNsObject.mounts_by_key);
+    test('it returns an empty array when filter includes keys the dataset does not contain', async function (assert) {
+      const noMatches = filterTableData(this.mockMountData, { foo: 'root', bar: '' });
+      assert.propEqual(noMatches, [], 'returns an empty array when no keys match dataset');
+      this.assertOriginal(assert);
+    });
 
-      mountKeys.forEach((mKey) => {
-        const mountData = originalNsData.mounts.find((m) => m.label === mKey);
-        assertClientCounts(newNsObject.mounts_by_key[mKey].new_clients, mountData);
+    test('it matches on empty strings or "root" for the root namespace', async function (assert) {
+      const mockExportData = ENTITY_EXPORT.trim()
+        .split('\n')
+        .map((line) => JSON.parse(line));
+      const combinedData = [...this.mockMountData, ...mockExportData];
+      const filteredData = filterTableData(combinedData, { namespace_path: 'root' });
+      const expected = [
+        {
+          acme_clients: 0,
+          clients: 8091,
+          entity_clients: 4002,
+          label: 'auth/userpass/0/',
+          mount_path: 'auth/userpass/0/',
+          mount_type: 'userpass',
+          namespace_path: 'root',
+          non_entity_clients: 4089,
+          secret_syncs: 0,
+        },
+        {
+          acme_clients: 0,
+          clients: 4290,
+          entity_clients: 0,
+          label: 'secrets/kv/0/',
+          mount_path: 'secrets/kv/0/',
+          mount_type: 'kv',
+          namespace_path: 'root',
+          non_entity_clients: 0,
+          secret_syncs: 4290,
+        },
+        {
+          acme_clients: 4003,
+          clients: 4003,
+          entity_clients: 0,
+          label: 'acme/pki/0/',
+          mount_path: 'acme/pki/0/',
+          mount_type: 'pki',
+          namespace_path: 'root',
+          non_entity_clients: 0,
+          secret_syncs: 0,
+        },
+        {
+          client_first_used_time: '2025-07-15T23:48:09Z',
+          client_id: 'daf8420c-0b6b-34e6-ff38-ee1ed093bea9',
+          client_type: 'entity',
+          entity_alias_custom_metadata: {},
+          entity_alias_metadata: {},
+          entity_alias_name: 'bob',
+          entity_group_ids: ['7537e6b7-3b06-65c2-1fb2-c83116eb5e6f'],
+          entity_metadata: {},
+          entity_name: 'entity_b3e2a7ff',
+          local_entity_alias: false,
+          mount_accessor: 'auth_userpass_f47ad0b4',
+          mount_path: 'auth/userpass/',
+          mount_type: 'userpass',
+          namespace_id: 'root',
+          namespace_path: '',
+          policies: [],
+          token_creation_time: '2020-08-15T23:48:09Z',
+        },
+        {
+          client_first_used_time: '2025-08-15T23:53:19Z',
+          client_id: '23a04911-5d72-ba98-11d3-527f2fcf3a81',
+          client_type: 'entity',
+          entity_alias_custom_metadata: {
+            account: 'Tester Account',
+          },
+          entity_alias_metadata: {},
+          entity_alias_name: 'bob',
+          entity_group_ids: ['7537e6b7-3b06-65c2-1fb2-c83116eb5e6f'],
+          entity_metadata: {
+            organization: 'ACME Inc.',
+            team: 'QA',
+          },
+          entity_name: 'bob-smith',
+          local_entity_alias: false,
+          mount_accessor: 'auth_userpass_de28062c',
+          mount_path: 'auth/userpass-test/',
+          mount_type: 'userpass',
+          namespace_id: 'root',
+          namespace_path: '',
+          policies: ['base'],
+          token_creation_time: '2020-08-15T23:52:38Z',
+        },
+        {
+          client_first_used_time: '2025-09-16T09:16:03Z',
+          client_id: 'a7c8d912-4f61-23b5-88e4-627a3dcf2b92',
+          client_type: 'entity',
+          entity_alias_custom_metadata: {
+            role: 'Senior Engineer',
+          },
+          entity_alias_metadata: {
+            department: 'Engineering',
+          },
+          entity_alias_name: 'alice',
+          entity_group_ids: ['7537e6b7-3b06-65c2-1fb2-c83116eb5e6f', 'a1b2c3d4-5e6f-7g8h-9i0j-k1l2m3n4o5p6'],
+          entity_metadata: {
+            location: 'San Francisco',
+            organization: 'TechCorp',
+            team: 'DevOps',
+          },
+          entity_name: 'alice-johnson',
+          local_entity_alias: false,
+          mount_accessor: 'auth_userpass_f47ad0b4',
+          mount_path: 'auth/userpass/',
+          mount_type: 'userpass',
+          namespace_id: 'root',
+          namespace_path: '',
+          policies: ['admin', 'audit'],
+          token_creation_time: '2020-08-16T09:15:42Z',
+        },
+        {
+          client_first_used_time: '2025-12-17T16:44:12Z',
+          client_id: 'c6b9d248-5a71-39e4-c7f2-951d8eaf6b95',
+          client_type: 'entity',
+          entity_alias_custom_metadata: {
+            expertise: 'kubernetes',
+            on_call: 'true',
+          },
+          entity_alias_metadata: {
+            iss: 'https://auth.cloudops.io',
+            sub: 'frank.castle@cloudops.io',
+          },
+          entity_alias_name: 'frank',
+          entity_group_ids: ['9a8b7c6d-5e4f-3210-9876-543210fedcba'],
+          entity_metadata: {
+            organization: 'CloudOps',
+            region: 'us-east-1',
+            team: 'SRE',
+          },
+          entity_name: 'frank-castle',
+          local_entity_alias: false,
+          mount_accessor: 'auth_jwt_9d8c7b6a',
+          mount_path: 'auth/jwt/',
+          mount_type: 'jwt',
+          namespace_id: 'root',
+          namespace_path: '',
+          policies: ['operations', 'monitoring'],
+          token_creation_time: '2020-08-17T16:43:28Z',
+        },
+      ];
+
+      filteredData.forEach((d, idx) => {
+        const identifier = idx < 3 ? `label: ${d.label}` : `client_id: ${d.client_id}`;
+        assert.propEqual(d, expected[idx], `filtered data contains ${identifier}`);
       });
+      this.assertOriginal(assert);
     });
-
-    assert.propEqual(
-      {},
-      namespaceArrayToObject(null, null, '10/21', 'timestamp-here'),
-      'returns an empty object when totalClientsByNamespace = null'
-    );
   });
 });
diff --git a/ui/tests/integration/utils/date-formatters-test.js b/ui/tests/integration/utils/date-formatters-test.js
index 3d285d146bf..d2a2a1877ac 100644
--- a/ui/tests/integration/utils/date-formatters-test.js
+++ b/ui/tests/integration/utils/date-formatters-test.js
@@ -1,41 +1,123 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
-import { formatRFC3339, isSameDay, isSameMonth, isSameYear } from 'date-fns';
-import { parseAPITimestamp, formatChartDate } from 'core/utils/date-formatters';
+import { buildISOTimestamp, isSameMonthUTC, parseAPITimestamp } from 'core/utils/date-formatters';
 
 module('Integration | Util | date formatters utils', function (hooks) {
   setupTest(hooks);
 
-  test('parseAPITimestamp: parses API timestamp string irrespective of timezone', async function (assert) {
-    assert.expect(6);
-    const DATE = new Date('2012-06-10T15:30:45');
-    const API_TIMESTAMP = formatRFC3339(DATE).split('T')[0].concat('T00:00:00Z');
-    const UNIX_TIME = DATE.getTime();
+  test('parseAPITimestamp: it returns a date object when a format is not passed', async function (assert) {
+    const timestamp = '2025-05-01T00:00:00Z';
+    const parsed = parseAPITimestamp(timestamp);
+    assert.true(parsed instanceof Date, 'parsed timestamp is a date object');
+    assert.strictEqual(parsed.getUTCFullYear(), 2025, 'parsed timestamp is correct year');
+    assert.strictEqual(parsed.getUTCMonth(), 4, 'parsed timestamp is correct month (months are 0-indexed)');
+    assert.strictEqual(parsed.getUTCDate(), 1, 'parsed timestamp is first of the month');
     assert.strictEqual(
-      parseAPITimestamp(UNIX_TIME),
-      undefined,
-      'it returns undefined if timestamp is not a string'
+      parsed.toISOString().replace('.000', ''),
+      timestamp,
+      'parsed ISO is the same date (in UTC)'
     );
+  });
+
+  test('parseAPITimestamp: it formats midnight timestamps in UTC', async function (assert) {
+    const timestamp = '2025-05-01T00:00:00Z';
+    const formatted = parseAPITimestamp(timestamp, 'MM dd yyyy');
+    // if parseISO was not used, this would return 04 30 2025 if new Date() is invoked in the pacific timezone
+    assert.strictEqual(formatted, '05 01 2025', 'it returns the expected year, month and day');
+  });
+
+  test('parseAPITimestamp: it formats end of the day timestamps in UTC', async function (assert) {
+    const timestamp = '2025-09-30T23:59:59Z';
+    const formatted = parseAPITimestamp(timestamp, 'MM dd yyyy');
+    assert.strictEqual(formatted, '09 30 2025', 'it formats the date in UTC');
+  });
+
+  test('parseAPITimestamp: it returns null for invalid timestamps', function (assert) {
+    const unix = new Date().getTime();
+    assert.strictEqual(parseAPITimestamp(unix), null, 'it returns null for unix arg');
+    assert.strictEqual(parseAPITimestamp(null), null, 'it returns null for null arg');
+    assert.strictEqual(parseAPITimestamp(undefined), null, 'it returns null for undefined arg');
+    assert.strictEqual(parseAPITimestamp(''), null, 'it returns null for an empty string arg');
+    assert.strictEqual(parseAPITimestamp('invalid'), null, 'it returns null for an invalid string');
+  });
 
-    const parsedTimestamp = parseAPITimestamp(API_TIMESTAMP);
+  test('parseAPITimestamp: it handles future dates to prep for the next y2k', function (assert) {
+    const futureDate = '9999-12-31T23:59:59Z';
+    const parsed = parseAPITimestamp(futureDate);
+    assert.true(parsed instanceof Date, 'parsed future date is a date object');
+    assert.strictEqual(parsed.getUTCFullYear(), 9999, 'parsed future date has correct year');
+    assert.strictEqual(parsed.getUTCMonth(), 11, 'parsed future date has correct month');
+    assert.strictEqual(parsed.getUTCDate(), 31, 'parsed future date has correct day');
+  });
+
+  test('buildISOTimestamp: it formats an ISO timestamp for the start of the month', async function (assert) {
+    const timestamp = buildISOTimestamp({ monthIdx: 0, year: 2025, isEndDate: false });
+    assert.strictEqual(
+      timestamp,
+      '2025-01-01T00:00:00Z',
+      'it returns an ISO string for the first of the month at midnight'
+    );
+  });
+
+  test('buildISOTimestamp: it formats an ISO timestamp for the end of the month', async function (assert) {
+    const timestamp = buildISOTimestamp({ monthIdx: 0, year: 2025, isEndDate: true });
+    assert.strictEqual(timestamp, '2025-01-31T23:59:59Z', 'ISO string is for the last day and hour');
+  });
 
-    assert.true(parsedTimestamp instanceof Date, 'parsed timestamp is a date object');
-    assert.true(isSameYear(parsedTimestamp, DATE), 'parsed timestamp is correct year');
-    assert.true(isSameMonth(parsedTimestamp, DATE), 'parsed timestamp is correct month');
-    assert.true(isSameDay(parsedTimestamp, DATE), 'parsed timestamp is correct day');
+  test('buildISOTimestamp: it formats an ISO timestamp for leap years', async function (assert) {
+    const timestamp = buildISOTimestamp({ monthIdx: 1, year: 2024, isEndDate: true });
+    assert.strictEqual(timestamp, '2024-02-29T23:59:59Z');
+  });
+
+  test('isSameMonthUTC: it returns true for timestamps in the same month', function (assert) {
+    const timestampA = '2025-07-01T00:00:00Z';
+    const timestampB = '2025-07-15T23:48:09Z';
+    assert.true(isSameMonthUTC(timestampA, timestampB));
+  });
+
+  test('isSameMonthUTC: it returns false for timestamps in different months', function (assert) {
+    const timestampA = '2025-09-01T00:00:00Z';
+    const timestampB = '2025-07-15T23:48:09Z';
+    assert.false(isSameMonthUTC(timestampA, timestampB));
+  });
+
+  test('isSameMonthUTC: it returns false for timestamps in different years', function (assert) {
+    const timestampA = '2025-12-31T23:59:59Z';
+    const timestampB = '2026-12-01T00:00:00Z';
+    assert.false(isSameMonthUTC(timestampA, timestampB));
+  });
+
+  test('isSameMonthUTC: it returns true when both timestamps are the same', function (assert) {
+    const timestamp = '2025-07-15T23:48:09Z';
+    assert.true(isSameMonthUTC(timestamp, timestamp));
+  });
+
+  test('isSameMonthUTC: it returns true for timestamps on the first and last day of the month', function (assert) {
+    const start = '2025-07-01T00:00:00Z';
+    const end = '2025-07-31T23:59:59Z';
+    assert.true(isSameMonthUTC(start, end));
+  });
+
+  test('isSameMonthUTC: it returns false for timestamps a second apart on different days', function (assert) {
+    const endJuly = '2025-07-31T23:59:59Z';
+    const startAugust = '2025-08-01T00:00:00Z';
+    assert.false(isSameMonthUTC(endJuly, startAugust));
+  });
 
-    const formattedTimestamp = parseAPITimestamp(API_TIMESTAMP, 'MM yyyy');
-    assert.strictEqual(formattedTimestamp, '06 2012', 'it formats the date');
+  test('isSameMonthUTC: it returns true if passed a timestamp with a timezone offset', function (assert) {
+    const utc = '2025-07-01T00:00:00Z';
+    const localTimezone = '2025-07-01T07:00:00+07:00'; // same time in UTC+7
+    assert.true(isSameMonthUTC(utc, localTimezone));
   });
 
-  test('formatChartDate: expand chart date to full month and year', async function (assert) {
-    assert.expect(1);
-    const chartDate = '03/21';
-    assert.strictEqual(formatChartDate(chartDate), 'March 2021', 'it re-formats the date');
+  test('isSameMonthUTC: it returns false for invalid inputs', function (assert) {
+    assert.false(isSameMonthUTC(null, '2025-07-01T00:00:00Z'), 'null input returns false');
+    assert.false(isSameMonthUTC('2025-07-01T00:00:00Z', undefined), 'undefined input returns false');
+    assert.false(isSameMonthUTC(12345, '2025-07-01T00:00:00Z'), 'non-string input returns false');
   });
 });
diff --git a/ui/tests/integration/utils/field-to-attrs-test.js b/ui/tests/integration/utils/field-to-attrs-test.js
index b28a5c01736..47e9c3c5566 100644
--- a/ui/tests/integration/utils/field-to-attrs-test.js
+++ b/ui/tests/integration/utils/field-to-attrs-test.js
@@ -1,9 +1,8 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { run } from '@ember/runloop';
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
 import fieldToAttrs, { expandAttributeMeta } from 'vault/utils/field-to-attrs';
@@ -35,129 +34,104 @@ module('Integration | Util | field to attrs', function (hooks) {
     options: { label: 'Max Lease TTL', editType: 'ttl' },
   };
 
+  hooks.beforeEach(function () {
+    this.model = this.owner.lookup('service:store').createRecord('test-form-model');
+  });
+
   test('it extracts attrs', function (assert) {
     assert.expect(1);
-    const model = run(() => this.owner.lookup('service:store').createRecord('test-form-model'));
-    run(() => {
-      const [attr] = expandAttributeMeta(model, ['path']);
-      assert.deepEqual(attr, PATH_ATTR, 'returns attribute meta');
-    });
+    const [attr] = expandAttributeMeta(this.model, ['path']);
+    assert.deepEqual(attr, PATH_ATTR, 'returns attribute meta');
   });
 
   test('it extracts more than one attr', function (assert) {
     assert.expect(2);
-    const model = run(() => this.owner.lookup('service:store').createRecord('test-form-model'));
-    run(() => {
-      const [path, desc] = expandAttributeMeta(model, ['path', 'description']);
-      assert.deepEqual(path, PATH_ATTR, 'returns attribute meta');
-      assert.deepEqual(desc, DESCRIPTION_ATTR, 'returns attribute meta');
-    });
+    const [path, desc] = expandAttributeMeta(this.model, ['path', 'description']);
+    assert.deepEqual(path, PATH_ATTR, 'returns attribute meta');
+    assert.deepEqual(desc, DESCRIPTION_ATTR, 'returns attribute meta');
   });
 
   test('it extracts fieldGroups', function (assert) {
     assert.expect(1);
-    const model = run(() => this.owner.lookup('service:store').createRecord('test-form-model'));
-    run(() => {
-      const groups = fieldToAttrs(model, [{ default: ['path'] }, { Options: ['description'] }]);
-      const expected = [{ default: [PATH_ATTR] }, { Options: [DESCRIPTION_ATTR] }];
-      assert.deepEqual(groups, expected, 'expands all given groups');
-    });
+    const groups = fieldToAttrs(this.model, [{ default: ['path'] }, { Options: ['description'] }]);
+    const expected = [{ default: [PATH_ATTR] }, { Options: [DESCRIPTION_ATTR] }];
+    assert.deepEqual(groups, expected, 'expands all given groups');
   });
 
   test('it extracts arrays as fieldGroups', function (assert) {
     assert.expect(1);
-    const model = run(() => this.owner.lookup('service:store').createRecord('test-form-model'));
-    run(() => {
-      const groups = fieldToAttrs(model, [
-        { default: ['path', 'description'] },
-        { Options: ['description'] },
-      ]);
-      const expected = [{ default: [PATH_ATTR, DESCRIPTION_ATTR] }, { Options: [DESCRIPTION_ATTR] }];
-      assert.deepEqual(groups, expected, 'expands all given groups');
-    });
+    const groups = fieldToAttrs(this.model, [
+      { default: ['path', 'description'] },
+      { Options: ['description'] },
+    ]);
+    const expected = [{ default: [PATH_ATTR, DESCRIPTION_ATTR] }, { Options: [DESCRIPTION_ATTR] }];
+    assert.deepEqual(groups, expected, 'expands all given groups');
   });
 
   test('it extracts model-fragment attributes with brace expansion', function (assert) {
     assert.expect(3);
-    const model = run(() => this.owner.lookup('service:store').createRecord('test-form-model'));
-    run(() => {
-      const [attr] = expandAttributeMeta(model, ['config.{defaultLeaseTtl}']);
-      assert.deepEqual(attr, DEFAULT_LEASE_ATTR, 'properly extracts model fragment attr');
-    });
-
-    run(() => {
-      const [defaultLease, maxLease] = expandAttributeMeta(model, ['config.{defaultLeaseTtl,maxLeaseTtl}']);
-      assert.deepEqual(defaultLease, DEFAULT_LEASE_ATTR, 'properly extracts default lease');
-      assert.deepEqual(maxLease, MAX_LEASE_ATTR, 'properly extracts max lease');
-    });
+    const [attr] = expandAttributeMeta(this.model, ['config.{defaultLeaseTtl}']);
+    assert.deepEqual(attr, DEFAULT_LEASE_ATTR, 'properly extracts model fragment attr');
+
+    const [defaultLease, maxLease] = expandAttributeMeta(this.model, [
+      'config.{defaultLeaseTtl,maxLeaseTtl}',
+    ]);
+    assert.deepEqual(defaultLease, DEFAULT_LEASE_ATTR, 'properly extracts default lease');
+    assert.deepEqual(maxLease, MAX_LEASE_ATTR, 'properly extracts max lease');
   });
 
   test('it extracts model-fragment attributes with double brace expansion', function (assert) {
     assert.expect(4);
-    const model = run(() => this.owner.lookup('service:store').createRecord('test-form-model'));
-    run(() => {
-      const [configDefault, configMax, otherConfigDefault, otherConfigMax] = expandAttributeMeta(model, [
-        '{config,otherConfig}.{defaultLeaseTtl,maxLeaseTtl}',
-      ]);
-      assert.deepEqual(configDefault, DEFAULT_LEASE_ATTR, 'properly extracts config.defaultLeaseTTL');
-      assert.deepEqual(
-        otherConfigDefault,
-        OTHER_DEFAULT_LEASE_ATTR,
-        'properly extracts otherConfig.defaultLeaseTTL'
-      );
-
-      assert.deepEqual(configMax, MAX_LEASE_ATTR, 'properly extracts config.maxLeaseTTL');
-      assert.deepEqual(otherConfigMax, OTHER_MAX_LEASE_ATTR, 'properly extracts otherConfig.maxLeaseTTL');
-    });
+    const [configDefault, configMax, otherConfigDefault, otherConfigMax] = expandAttributeMeta(this.model, [
+      '{config,otherConfig}.{defaultLeaseTtl,maxLeaseTtl}',
+    ]);
+    assert.deepEqual(configDefault, DEFAULT_LEASE_ATTR, 'properly extracts config.defaultLeaseTTL');
+    assert.deepEqual(
+      otherConfigDefault,
+      OTHER_DEFAULT_LEASE_ATTR,
+      'properly extracts otherConfig.defaultLeaseTTL'
+    );
+
+    assert.deepEqual(configMax, MAX_LEASE_ATTR, 'properly extracts config.maxLeaseTTL');
+    assert.deepEqual(otherConfigMax, OTHER_MAX_LEASE_ATTR, 'properly extracts otherConfig.maxLeaseTTL');
   });
 
   test('it extracts model-fragment attributes with dot notation', function (assert) {
     assert.expect(3);
-    const model = run(() => this.owner.lookup('service:store').createRecord('test-form-model'));
-    run(() => {
-      const [attr] = expandAttributeMeta(model, ['config.defaultLeaseTtl']);
-      assert.deepEqual(attr, DEFAULT_LEASE_ATTR, 'properly extracts model fragment attr');
-    });
-
-    run(() => {
-      const [defaultLease, maxLease] = expandAttributeMeta(model, [
-        'config.defaultLeaseTtl',
-        'config.maxLeaseTtl',
-      ]);
-      assert.deepEqual(defaultLease, DEFAULT_LEASE_ATTR, 'properly extracts model fragment attr');
-      assert.deepEqual(maxLease, MAX_LEASE_ATTR, 'properly extracts model fragment attr');
-    });
+    const [attr] = expandAttributeMeta(this.model, ['config.defaultLeaseTtl']);
+    assert.deepEqual(attr, DEFAULT_LEASE_ATTR, 'properly extracts model fragment attr');
+
+    const [defaultLease, maxLease] = expandAttributeMeta(this.model, [
+      'config.defaultLeaseTtl',
+      'config.maxLeaseTtl',
+    ]);
+    assert.deepEqual(defaultLease, DEFAULT_LEASE_ATTR, 'properly extracts model fragment attr');
+    assert.deepEqual(maxLease, MAX_LEASE_ATTR, 'properly extracts model fragment attr');
   });
 
   test('it extracts fieldGroups from model-fragment attributes with brace expansion', function (assert) {
     assert.expect(1);
-    const model = run(() => this.owner.lookup('service:store').createRecord('test-form-model'));
     const expected = [
       { default: [PATH_ATTR, DEFAULT_LEASE_ATTR, MAX_LEASE_ATTR] },
       { Options: [DESCRIPTION_ATTR] },
     ];
-    run(() => {
-      const groups = fieldToAttrs(model, [
-        { default: ['path', 'config.{defaultLeaseTtl,maxLeaseTtl}'] },
-        { Options: ['description'] },
-      ]);
-      assert.deepEqual(groups, expected, 'properly extracts fieldGroups with brace expansion');
-    });
+    const groups = fieldToAttrs(this.model, [
+      { default: ['path', 'config.{defaultLeaseTtl,maxLeaseTtl}'] },
+      { Options: ['description'] },
+    ]);
+    assert.deepEqual(groups, expected, 'properly extracts fieldGroups with brace expansion');
   });
 
   test('it extracts fieldGroups from model-fragment attributes with dot notation', function (assert) {
     assert.expect(1);
-    const model = run(() => this.owner.lookup('service:store').createRecord('test-form-model'));
     const expected = [
       { default: [DEFAULT_LEASE_ATTR, PATH_ATTR, MAX_LEASE_ATTR] },
       { Options: [DESCRIPTION_ATTR] },
     ];
-    run(() => {
-      const groups = fieldToAttrs(model, [
-        { default: ['config.defaultLeaseTtl', 'path', 'config.maxLeaseTtl'] },
-        { Options: ['description'] },
-      ]);
-      assert.deepEqual(groups, expected, 'properly extracts fieldGroups with dot notation');
-    });
+    const groups = fieldToAttrs(this.model, [
+      { default: ['config.defaultLeaseTtl', 'path', 'config.maxLeaseTtl'] },
+      { Options: ['description'] },
+    ]);
+    assert.deepEqual(groups, expected, 'properly extracts fieldGroups with dot notation');
   });
 });
diff --git a/ui/tests/integration/utils/parse-pki-cert-test.js b/ui/tests/integration/utils/parse-pki-cert-test.js
index 4b31833da47..8ca5d396f85 100644
--- a/ui/tests/integration/utils/parse-pki-cert-test.js
+++ b/ui/tests/integration/utils/parse-pki-cert-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,7 +12,10 @@ import { Certificate } from 'pkijs';
 import { addHours, fromUnixTime, isSameDay } from 'date-fns';
 import errorMessage from 'vault/utils/error-message';
 import { OTHER_OIDs, SAN_TYPES } from 'vault/utils/parse-pki-cert-oids';
-import {
+import { verifyCertificates, jsonToCertObject, verifySignature } from 'vault/utils/parse-pki-cert';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
+
+const {
   certWithoutCN,
   loadedCert,
   pssTrueCert,
@@ -20,10 +23,7 @@ import {
   unsupportedOids,
   unsupportedSignatureRoot,
   unsupportedSignatureInt,
-} from 'vault/tests/helpers/pki/values';
-import { verifyCertificates } from 'vault/utils/parse-pki-cert';
-import { jsonToCertObject } from 'vault/utils/parse-pki-cert';
-import { verifySignature } from 'vault/utils/parse-pki-cert';
+} = CERTIFICATES;
 
 module('Integration | Util | parse pki certificate', function (hooks) {
   setupTest(hooks);
diff --git a/ui/tests/pages/access/identity/aliases/add.js b/ui/tests/pages/access/identity/aliases/add.js
deleted file mode 100644
index 1a5c9d591ab..00000000000
--- a/ui/tests/pages/access/identity/aliases/add.js
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { create, visitable } from 'ember-cli-page-object';
-import editForm from 'vault/tests/pages/components/identity/edit-form';
-
-export default create({
-  visit: visitable('/vault/access/identity/:item_type/aliases/add/:id'),
-  editForm,
-});
diff --git a/ui/tests/pages/access/identity/aliases/index.js b/ui/tests/pages/access/identity/aliases/index.js
deleted file mode 100644
index 8fd07de9ceb..00000000000
--- a/ui/tests/pages/access/identity/aliases/index.js
+++ /dev/null
@@ -1,20 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { create, clickable, text, visitable, collection } from 'ember-cli-page-object';
-import flashMessage from 'vault/tests/pages/components/flash-message';
-
-export default create({
-  visit: visitable('/vault/access/identity/:item_type/aliases'),
-  flashMessage,
-  items: collection('[data-test-identity-row]', {
-    menu: clickable('[data-test-popup-menu-trigger]'),
-    name: text('[data-test-identity-link]'),
-  }),
-  delete: clickable('[data-test-popup-menu="delete"]', {
-    testContainer: '#ember-testing',
-  }),
-  confirmDelete: clickable('[data-test-confirm-button]'),
-});
diff --git a/ui/tests/pages/access/identity/aliases/show.js b/ui/tests/pages/access/identity/aliases/show.js
deleted file mode 100644
index 0710b96fbf7..00000000000
--- a/ui/tests/pages/access/identity/aliases/show.js
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { create, clickable, collection, contains, visitable } from 'ember-cli-page-object';
-import flashMessage from 'vault/tests/pages/components/flash-message';
-import infoTableRow from 'vault/tests/pages/components/info-table-row';
-
-export default create({
-  visit: visitable('/vault/access/identity/:item_type/aliases/:alias_id'),
-  flashMessage,
-  nameContains: contains('[data-test-alias-name]'),
-  rows: collection('[data-test-component="info-table-row"]', infoTableRow),
-  edit: clickable('[data-test-alias-edit-link]'),
-});
diff --git a/ui/tests/pages/access/identity/create.js b/ui/tests/pages/access/identity/create.js
deleted file mode 100644
index 34c70d78026..00000000000
--- a/ui/tests/pages/access/identity/create.js
+++ /dev/null
@@ -1,18 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { create, visitable } from 'ember-cli-page-object';
-import editForm from 'vault/tests/pages/components/identity/edit-form';
-
-export default create({
-  visit: visitable('/vault/access/identity/:item_type/create'),
-  editForm,
-  createItem(item_type, type) {
-    if (type) {
-      return this.visit({ item_type }).editForm.type(type).submit();
-    }
-    return this.visit({ item_type }).editForm.submit();
-  },
-});
diff --git a/ui/tests/pages/access/identity/index.js b/ui/tests/pages/access/identity/index.js
index a034edb7770..d6dddbee8d8 100644
--- a/ui/tests/pages/access/identity/index.js
+++ b/ui/tests/pages/access/identity/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -14,8 +14,7 @@ export default create({
     name: text('[data-test-identity-link]'),
   }),
 
-  delete: clickable('[data-test-popup-menu="delete"]', {
+  delete: clickable('[data-test-button="popup-delete"]', {
     testContainer: '#ember-testing',
   }),
-  confirmDelete: clickable('[data-test-confirm-button]'),
 });
diff --git a/ui/tests/pages/access/identity/show.js b/ui/tests/pages/access/identity/show.js
deleted file mode 100644
index 71fcf3da6cf..00000000000
--- a/ui/tests/pages/access/identity/show.js
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { create, clickable, collection, contains, visitable } from 'ember-cli-page-object';
-import flashMessage from 'vault/tests/pages/components/flash-message';
-import infoTableRow from 'vault/tests/pages/components/info-table-row';
-
-export default create({
-  visit: visitable('/vault/access/identity/:item_type/:item_id'),
-  flashMessage,
-  nameContains: contains('[data-test-identity-item-name]'),
-  rows: collection('[data-test-component="info-table-row"]', infoTableRow),
-  edit: clickable('[data-test-entity-edit-link]'),
-});
diff --git a/ui/tests/pages/access/methods.js b/ui/tests/pages/access/methods.js
deleted file mode 100644
index 67c4e03d7e5..00000000000
--- a/ui/tests/pages/access/methods.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { create, attribute, visitable, collection, hasClass, text } from 'ember-cli-page-object';
-
-export default create({
-  visit: visitable('/vault/access/'),
-  methodsLink: {
-    isActive: hasClass('active'),
-    text: text(),
-    scope: '[data-test-sidebar-nav-link="Authentication Methods"]',
-  },
-
-  backendLinks: collection('[data-test-auth-backend-link]', {
-    path: text('[data-test-path]'),
-    id: attribute('data-test-id', '[data-test-path]'),
-  }),
-
-  findLinkById(id) {
-    return this.backendLinks.filterBy('id', id)[0];
-  },
-});
diff --git a/ui/tests/pages/access/namespaces/index.js b/ui/tests/pages/access/namespaces/index.js
deleted file mode 100644
index 4ca5fe39318..00000000000
--- a/ui/tests/pages/access/namespaces/index.js
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { create, visitable } from 'ember-cli-page-object';
-
-export default create({
-  visit: visitable('/vault/access/namespaces'),
-});
diff --git a/ui/tests/pages/auth.js b/ui/tests/pages/auth.js
deleted file mode 100644
index aeff1f940f3..00000000000
--- a/ui/tests/pages/auth.js
+++ /dev/null
@@ -1,74 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { create, visitable, fillable, clickable } from 'ember-cli-page-object';
-import { click, settled } from '@ember/test-helpers';
-import VAULT_KEYS from 'vault/tests/helpers/vault-keys';
-
-const { rootToken } = VAULT_KEYS;
-
-export default create({
-  visit: visitable('/vault/auth'),
-  logout: visitable('/vault/logout'),
-  submit: clickable('[data-test-auth-submit]'),
-  tokenInput: fillable('[data-test-token]'),
-  usernameInput: fillable('[data-test-username]'),
-  passwordInput: fillable('[data-test-password]'),
-  namespaceInput: fillable('[data-test-auth-form-ns-input]'),
-  optionsToggle: clickable('[data-test-auth-form-options-toggle]'),
-  mountPath: fillable('[data-test-auth-form-mount-path]'),
-  authType: fillable('[data-test-select="auth-method"]'),
-
-  login: async function (token = rootToken) {
-    // make sure we're always logged out and logged back in
-    await this.logout();
-    await settled();
-    // clear session storage to ensure we have a clean state
-    window.localStorage.clear();
-    await this.visit({ with: 'token' });
-    await settled();
-    await this.tokenInput(token).submit();
-    await settled();
-    return;
-  },
-  loginUsername: async function (username, password, path) {
-    // make sure we're always logged out and logged back in
-    await this.logout();
-    await settled();
-    // clear local storage to ensure we have a clean state
-    window.localStorage.clear();
-    await this.visit({ with: 'userpass' });
-    await settled();
-    if (path) {
-      await this.optionsToggle();
-      await this.mountPath(path);
-    }
-    await this.usernameInput(username);
-    await this.passwordInput(password).submit();
-    return;
-  },
-  loginNs: async function (ns, token = rootToken) {
-    // make sure we're always logged out and logged back in
-    await this.logout();
-    await settled();
-    // clear session storage to ensure we have a clean state
-    window.localStorage.clear();
-    await this.visit({ with: 'token' });
-    await settled();
-    await this.namespaceInput(ns);
-    await settled();
-    await this.tokenInput(token).submit();
-    return;
-  },
-  clickLogout: async function (clearNamespace = false) {
-    await click('[data-test-user-menu-trigger]');
-    await click('[data-test-user-menu-content] a#logout');
-    if (clearNamespace) {
-      await this.namespaceInput('');
-    }
-    await settled();
-    return;
-  },
-});
diff --git a/ui/tests/pages/components/auth-config-form/options.js b/ui/tests/pages/components/auth-config-form/options.js
deleted file mode 100644
index ecf77082d0e..00000000000
--- a/ui/tests/pages/components/auth-config-form/options.js
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { clickable, fillable } from 'ember-cli-page-object';
-
-import fields from '../form-field';
-export default {
-  ...fields,
-  ttlValue: fillable('[data-test-ttl-value]'),
-  ttlUnit: fillable('[data-test-ttl-value]'),
-  save: clickable('[data-test-save-config]'),
-};
diff --git a/ui/tests/pages/components/auth-form.js b/ui/tests/pages/components/auth-form.js
deleted file mode 100644
index 198d0c84b80..00000000000
--- a/ui/tests/pages/components/auth-form.js
+++ /dev/null
@@ -1,25 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { collection, clickable, fillable, text, value, isPresent } from 'ember-cli-page-object';
-
-export default {
-  tabs: collection('[data-test-auth-method]', {
-    name: text(),
-    link: clickable('[data-test-auth-method-link]'),
-  }),
-  selectMethod: fillable('[data-test-select=auth-method]'),
-  username: fillable('[data-test-username]'),
-  token: fillable('[data-test-token]'),
-  tokenValue: value('[data-test-token]'),
-  password: fillable('[data-test-password]'),
-  errorText: text('[data-test-message-error]'),
-  errorMessagePresent: isPresent('[data-test-message-error]'),
-  descriptionText: text('[data-test-description]'),
-  login: clickable('[data-test-auth-submit]'),
-  oidcRole: fillable('[data-test-role]'),
-  oidcMoreOptions: clickable('[data-test-yield-content] button'),
-  oidcMountPath: fillable('#custom-path'),
-};
diff --git a/ui/tests/pages/components/auth-jwt.js b/ui/tests/pages/components/auth-jwt.js
deleted file mode 100644
index 8e489f5faf4..00000000000
--- a/ui/tests/pages/components/auth-jwt.js
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { text, isPresent, clickable, fillable } from 'ember-cli-page-object';
-
-export default {
-  jwt: fillable('[data-test-jwt]'),
-  jwtPresent: isPresent('[data-test-jwt]'),
-  role: fillable('[data-test-role]'),
-  rolePresent: isPresent('[data-test-role]'),
-  login: clickable('[data-test-auth-submit]'),
-  loginButtonText: text('[data-test-auth-submit]'),
-  yieldContent: text('[data-test-yield-content]'),
-};
diff --git a/ui/tests/pages/components/calendar-widget.js b/ui/tests/pages/components/calendar-widget.js
index 2b62d98c8f0..1c3b0ba2333 100644
--- a/ui/tests/pages/components/calendar-widget.js
+++ b/ui/tests/pages/components/calendar-widget.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,7 +12,6 @@ export default create({
   customEndMonthBtn: clickable('[data-test-show-calendar]'),
   menuToggle: clickable('[data-test-calendar-widget-trigger]'),
   showsCalendar: isPresent('[data-test-calendar-widget-container]'),
-  dateRangeTrigger: '[data-test-show-calendar]',
   async openCalendar() {
     await this.menuToggle();
     await this.customEndMonthBtn();
diff --git a/ui/tests/pages/components/console/ui-panel.js b/ui/tests/pages/components/console/ui-panel.js
index 3bb6503c315..c63897a0b5e 100644
--- a/ui/tests/pages/components/console/ui-panel.js
+++ b/ui/tests/pages/components/console/ui-panel.js
@@ -1,16 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { text, triggerable, clickable, collection, fillable, value, isPresent } from 'ember-cli-page-object';
 import { getter } from 'ember-cli-page-object/macros';
 import { settled } from '@ember/test-helpers';
-
-import keys from 'core/utils/key-codes';
+import keys from 'core/utils/keys';
 
 export default {
   toggle: clickable('[data-test-console-toggle]'),
+  dismissConsole: clickable(['data-test-dismiss-console-button']),
   consoleInput: fillable('[data-test-component="console/command-input"] input'),
   consoleInputValue: value('[data-test-component="console/command-input"] input'),
   logOutput: text('[data-test-component="console/output-log"]'),
@@ -45,21 +45,27 @@ export default {
     return this.logJSONItems.objectAt(count - 1).text;
   }),
   up: triggerable('keyup', '[data-test-component="console/command-input"] input', {
-    eventProperties: { keyCode: keys.UP },
+    eventProperties: { key: keys.UP },
   }),
   down: triggerable('keyup', '[data-test-component="console/command-input"] input', {
-    eventProperties: { keyCode: keys.DOWN },
+    eventProperties: { key: keys.DOWN },
   }),
   enter: triggerable('keyup', '[data-test-component="console/command-input"] input', {
-    eventProperties: { keyCode: keys.ENTER },
+    eventProperties: { key: keys.ENTER },
   }),
   hasInput: isPresent('[data-test-component="console/command-input"] input'),
-  runCommands: async function (commands) {
+  runCommands: async function (commands, shouldToggle = true) {
     const toExecute = Array.isArray(commands) ? commands : [commands];
+    if (shouldToggle) {
+      await this.toggle(); // toggle the console open
+    }
     for (const command of toExecute) {
       await this.consoleInput(command);
       await this.enter();
       await settled();
     }
+    if (shouldToggle) {
+      await this.toggle(); // toggle it closed
+    }
   },
 };
diff --git a/ui/tests/pages/components/control-group-success.js b/ui/tests/pages/components/control-group-success.js
deleted file mode 100644
index cb6f0966060..00000000000
--- a/ui/tests/pages/components/control-group-success.js
+++ /dev/null
@@ -1,15 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { isPresent, fillable, clickable } from 'ember-cli-page-object';
-
-export default {
-  showsJsonViewer: isPresent('[data-test-json-viewer]'),
-  showsNavigateMessage: isPresent('[data-test-navigate-message]'),
-  showsUnwrapForm: isPresent('[data-test-unwrap-form]'),
-  navigate: clickable('[data-test-navigate-button]'),
-  unwrap: clickable('[data-test-unwrap-button]'),
-  token: fillable('[data-test-token-input]'),
-};
diff --git a/ui/tests/pages/components/control-group.js b/ui/tests/pages/components/control-group.js
deleted file mode 100644
index 06374169160..00000000000
--- a/ui/tests/pages/components/control-group.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { isPresent, clickable, text } from 'ember-cli-page-object';
-
-export default {
-  showsAccessorCallout: isPresent('[data-test-accessor-callout]'),
-  authorizationText: text('[data-test-authorizations]'),
-  bannerPrefix: text('[data-test-banner-prefix]'),
-  bannerText: text('[data-test-banner-text]'),
-  requestorText: text('[data-test-requestor-text]'),
-  showsTokenText: isPresent('[data-test-token]'),
-  refresh: clickable('[data-test-refresh-button]'),
-  authorize: clickable('[data-test-authorize-button]'),
-  showsSuccessComponent: isPresent('[data-test-control-group-success]'),
-
-  accessor: text('[data-test-accessor-value]'),
-  token: text('[data-test-token-value]'),
-  showsRefresh: isPresent('[data-test-refresh-button]'),
-  showsAuthorize: isPresent('[data-test-authorize-button]'),
-  showsBackLink: isPresent('[data-test-back-link]'),
-};
diff --git a/ui/tests/pages/components/edit-form.js b/ui/tests/pages/components/edit-form.js
index c84f79f117d..6741d27627f 100644
--- a/ui/tests/pages/components/edit-form.js
+++ b/ui/tests/pages/components/edit-form.js
@@ -1,15 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { clickable, isPresent, text } from 'ember-cli-page-object';
+import { isPresent, text } from 'ember-cli-page-object';
 import fields from './form-field';
 export default {
   ...fields,
-  submit: clickable('[data-test-edit-form-submit]'),
-  deleteButton: clickable('[data-test-confirm-action-trigger]'),
-  deleteConfirm: clickable('[data-test-confirm-button]'),
   deleteText: text('[data-test-edit-delete-text]'),
   showsDelete: isPresent('[data-test-edit-delete-text]'),
   errorText: text('[data-test-edit-form-error]'),
diff --git a/ui/tests/pages/components/flash-message.js b/ui/tests/pages/components/flash-message.js
index 36945a3cd0b..673d4e9fef2 100644
--- a/ui/tests/pages/components/flash-message.js
+++ b/ui/tests/pages/components/flash-message.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/pages/components/form-field.js b/ui/tests/pages/components/form-field.js
index dbf295d1680..c0748d6741d 100644
--- a/ui/tests/pages/components/form-field.js
+++ b/ui/tests/pages/components/form-field.js
@@ -1,36 +1,29 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import {
   attribute,
-  focusable,
   value,
   clickable,
   isPresent,
   collection,
   fillable,
-  text,
   triggerable,
+  text,
 } from 'ember-cli-page-object';
 
 export default {
   hasStringList: isPresent('[data-test-component=string-list]'),
-  hasSearchSelect: isPresent('[data-test-component=search-select]'),
   hasTextFile: isPresent('[data-test-component=text-file]'),
-  hasTTLPicker: isPresent('[data-test-toggle-input="Foo"]'),
   hasJSONEditor: isPresent('[data-test-component="code-mirror-modifier"]'),
   hasJSONClearButton: isPresent('[data-test-json-clear-button]'),
-  hasSelect: isPresent('select'),
   hasInput: isPresent('input'),
   hasCheckbox: isPresent('input[type=checkbox]'),
   hasTextarea: isPresent('textarea'),
   hasMaskedInput: isPresent('[data-test-masked-input]'),
   hasTooltip: isPresent('[data-test-component=info-tooltip]'),
-  tooltipTrigger: focusable('[data-test-tool-tip-trigger]'),
-  tooltipContent: text('[data-test-help-text]'),
-  hasRadio: isPresent('[data-test-radio-input]'),
   radioButtons: collection('input[type=radio]', {
     select: clickable(),
     id: attribute('id'),
@@ -38,9 +31,7 @@ export default {
 
   fields: collection('[data-test-field]', {
     clickLabel: clickable('label'),
-    toggleTtl: clickable('[data-test-toggle-input="Foo"]'),
-    for: attribute('for', 'label', { multiple: true }),
-    labelText: text('label', { multiple: true }),
+    labelValue: text('[data-test-form-field-label]'),
     input: fillable('input'),
     ttlTime: fillable('[data-test-ttl-value]'),
     select: fillable('select'),
@@ -49,23 +40,8 @@ export default {
     inputValue: value('input'),
     textareaValue: value('textarea'),
     inputChecked: attribute('checked', 'input[type=checkbox]'),
-    selectValue: value('select'),
   }),
   selectRadioInput: async function (value) {
     return this.radioButtons.filterBy('id', value)[0].select();
   },
-  fillInTextarea: async function (name, value) {
-    return this.fields
-      .filter((field) => {
-        return field.for.includes(name);
-      })[0]
-      .textarea(value);
-  },
-  fillIn: async function (name, value) {
-    return this.fields
-      .filter((field) => {
-        return field.for.includes(name);
-      })[0]
-      .input(value);
-  },
 };
diff --git a/ui/tests/pages/components/identity/edit-form.js b/ui/tests/pages/components/identity/edit-form.js
deleted file mode 100644
index 1cd3e688730..00000000000
--- a/ui/tests/pages/components/identity/edit-form.js
+++ /dev/null
@@ -1,28 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { clickable, fillable, attribute } from 'ember-cli-page-object';
-import { waitFor } from '@ember/test-helpers';
-import fields from '../form-field';
-
-export default {
-  ...fields,
-  cancelLinkHref: attribute('href', '[data-test-cancel-link]'),
-  cancelLink: clickable('[data-test-cancel-link]'),
-  name: fillable('[data-test-input="name"]'),
-  disabled: clickable('[data-test-input="disabled"]'),
-  metadataKey: fillable('[data-test-kv-key]'),
-  metadataValue: fillable('[data-test-kv-value]'),
-  type: fillable('[data-test-input="type"]'),
-  submit: clickable('[data-test-identity-submit]'),
-  delete: clickable('[data-test-confirm-action-trigger]'),
-  confirmDelete: clickable('[data-test-confirm-button]'),
-  waitForConfirm() {
-    return waitFor('[data-test-confirm-button]');
-  },
-  waitForFlash() {
-    return waitFor('[data-test-flash-message-body]');
-  },
-};
diff --git a/ui/tests/pages/components/identity/item-details.js b/ui/tests/pages/components/identity/item-details.js
index 57da834a269..2090338bf15 100644
--- a/ui/tests/pages/components/identity/item-details.js
+++ b/ui/tests/pages/components/identity/item-details.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/pages/components/info-table-row.js b/ui/tests/pages/components/info-table-row.js
index 101f847b491..c2b4fb9363e 100644
--- a/ui/tests/pages/components/info-table-row.js
+++ b/ui/tests/pages/components/info-table-row.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/pages/components/json-editor.js b/ui/tests/pages/components/json-editor.js
index 1fe07551024..41bf1a8b733 100644
--- a/ui/tests/pages/components/json-editor.js
+++ b/ui/tests/pages/components/json-editor.js
@@ -1,14 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { isPresent, notHasClass, text } from 'ember-cli-page-object';
-
-export default {
-  title: text('[data-test-component=json-editor-title]'),
-  hasToolbar: isPresent('[data-test-component=json-editor-toolbar]'),
-  hasCopyButton: isPresent('[data-test-copy-button]'),
-  hasJSONEditor: isPresent('[data-test-component="code-mirror-modifier"]'),
-  canEdit: notHasClass('readonly-codemirror'),
+export const SELECTORS = {
+  codeBlock: '.hds-code-block__code',
+  copy: '.hds-code-block__copy-button',
+  title: '[data-test-component="json-editor-title"]',
+  toolbar: '.hds-code-block__header',
 };
diff --git a/ui/tests/pages/components/kv-object-editor.js b/ui/tests/pages/components/kv-object-editor.js
index 2f3263cf2b4..292b2aa5067 100644
--- a/ui/tests/pages/components/kv-object-editor.js
+++ b/ui/tests/pages/components/kv-object-editor.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/pages/components/license-info.js b/ui/tests/pages/components/license-info.js
index b6d71209561..5cac672500b 100644
--- a/ui/tests/pages/components/license-info.js
+++ b/ui/tests/pages/components/license-info.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/pages/components/list-view.js b/ui/tests/pages/components/list-view.js
index 5be88752a84..bec4c1844b0 100644
--- a/ui/tests/pages/components/list-view.js
+++ b/ui/tests/pages/components/list-view.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -19,10 +19,4 @@ export default {
   menuItems: collection('.ember-basic-dropdown-content li', {
     testContainer: '#ember-testing',
   }),
-  delete: clickable('[data-test-confirm-action-trigger]', {
-    testContainer: '#ember-testing',
-  }),
-  confirmDelete: clickable('[data-test-confirm-button]', {
-    testContainer: '#ember-testing',
-  }),
 };
diff --git a/ui/tests/pages/components/masked-input.js b/ui/tests/pages/components/masked-input.js
deleted file mode 100644
index b83d2a6018f..00000000000
--- a/ui/tests/pages/components/masked-input.js
+++ /dev/null
@@ -1,15 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { clickable, isPresent } from 'ember-cli-page-object';
-
-export default {
-  textareaIsPresent: isPresent('[data-test-textarea]'),
-  copyButtonIsPresent: isPresent('[data-test-copy-button]'),
-  downloadIconIsPresent: isPresent('[data-test-download-icon]'),
-  downloadButtonIsPresent: isPresent('[data-test-download-button]'),
-  toggleMasked: clickable('[data-test-button="toggle-masked"]'),
-  copyValue: clickable('[data-test-copy-button]'),
-};
diff --git a/ui/tests/pages/components/mount-backend-form.js b/ui/tests/pages/components/mount-backend-form.js
deleted file mode 100644
index 543a4b611be..00000000000
--- a/ui/tests/pages/components/mount-backend-form.js
+++ /dev/null
@@ -1,33 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { clickable, collection, fillable, text, value, attribute } from 'ember-cli-page-object';
-import fields from './form-field';
-
-export default {
-  ...fields,
-  header: text('[data-test-mount-form-header]'),
-  submit: clickable('[data-test-mount-submit]'),
-  back: clickable('[data-test-mount-back]'),
-  path: fillable('[data-test-input="path"]'),
-  toggleOptions: clickable('[data-test-toggle-group="Method Options"]'),
-  pathValue: value('[data-test-input="path"]'),
-  types: collection('[data-test-mount-type]', {
-    select: clickable(),
-    id: attribute('id'),
-  }),
-  type: fillable('[name="mount-type"]'),
-  async selectType(type) {
-    return this.types.filterBy('id', type)[0].select();
-  },
-  async mount(type, path) {
-    await this.selectType(type);
-    if (path) {
-      await this.path(path).submit();
-    } else {
-      await this.submit();
-    }
-  },
-};
diff --git a/ui/tests/pages/components/radial-progress.js b/ui/tests/pages/components/radial-progress.js
index 913296445d9..0b374c46197 100644
--- a/ui/tests/pages/components/radial-progress.js
+++ b/ui/tests/pages/components/radial-progress.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/pages/components/search-select.js b/ui/tests/pages/components/search-select.js
index 133806c8fdb..81c635c0815 100644
--- a/ui/tests/pages/components/search-select.js
+++ b/ui/tests/pages/components/search-select.js
@@ -1,12 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { isPresent, collection, text, clickable } from 'ember-cli-page-object';
 
 export default {
-  hasSearchSelect: isPresent('[data-test-component=search-select]'),
   hasTrigger: isPresent('.ember-power-select-trigger'),
   hasLabel: isPresent('[data-test-field-label]'),
   labelText: text('[data-test-field-label]'),
diff --git a/ui/tests/pages/components/wizard/features-selection.js b/ui/tests/pages/components/wizard/features-selection.js
deleted file mode 100644
index 487cc828e3b..00000000000
--- a/ui/tests/pages/components/wizard/features-selection.js
+++ /dev/null
@@ -1,14 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { collection, isPresent, property, clickable } from 'ember-cli-page-object';
-
-export default {
-  wizardItems: collection('[data-test-select-input]', {
-    hasDisabledTooltip: isPresent('[data-test-tooltip]'),
-  }),
-  hasDisabledStartButton: property('disabled', '[data-test-start-button]'),
-  selectSecrets: clickable('[data-test-checkbox=Secrets]'),
-};
diff --git a/ui/tests/pages/init.js b/ui/tests/pages/init.js
index c1cdd40fc5d..239104cc7b0 100644
--- a/ui/tests/pages/init.js
+++ b/ui/tests/pages/init.js
@@ -1,19 +1,17 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { text, create, collection, visitable, fillable, clickable } from 'ember-cli-page-object';
+import { create, collection, visitable, fillable } from 'ember-cli-page-object';
 
 export default create({
   visit: visitable('/vault/init'),
-  submit: clickable('[data-test-init-submit]'),
   shares: fillable('[data-test-key-shares]'),
   threshold: fillable('[data-test-key-threshold]'),
   keys: collection('[data-test-key-box]'),
-  buttonText: text('[data-test-advance-button]'),
   init: async function (shares, threshold) {
     await this.visit();
-    return this.shares(shares).threshold(threshold).submit();
+    return this.shares(shares).threshold(threshold);
   },
 });
diff --git a/ui/tests/pages/logout.js b/ui/tests/pages/logout.js
deleted file mode 100644
index d770d75f954..00000000000
--- a/ui/tests/pages/logout.js
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { create, visitable } from 'ember-cli-page-object';
-
-export default create({
-  visit: visitable('/vault/logout'),
-});
diff --git a/ui/tests/pages/policy/edit.js b/ui/tests/pages/policy/edit.js
index 5cc814b7ab1..2424d81a088 100644
--- a/ui/tests/pages/policy/edit.js
+++ b/ui/tests/pages/policy/edit.js
@@ -1,11 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { clickable, create, isPresent, visitable } from 'ember-cli-page-object';
+import { clickable, create, visitable } from 'ember-cli-page-object';
 export default create({
   visit: visitable('/vault/policy/:type/:name/edit'),
-  deleteIsPresent: isPresent('[data-test-confirm-action-trigger]'),
   toggleEdit: clickable('[data-test-policy-edit-toggle]'),
 });
diff --git a/ui/tests/pages/policy/show.js b/ui/tests/pages/policy/show.js
index c5f5fc5f922..77d203a5a25 100644
--- a/ui/tests/pages/policy/show.js
+++ b/ui/tests/pages/policy/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/pages/secrets/backend/configuration.js b/ui/tests/pages/secrets/backend/configuration.js
index fc02b0e824b..9d543097a00 100644
--- a/ui/tests/pages/secrets/backend/configuration.js
+++ b/ui/tests/pages/secrets/backend/configuration.js
@@ -1,12 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { create, visitable, text } from 'ember-cli-page-object';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 export default create({
-  visit: visitable('/vault/secrets/:backend/configuration'),
-  defaultTTL: text('[data-test-value-div="Default Lease TTL"]'),
-  maxTTL: text('[data-test-value-div="Max Lease TTL"]'),
+  visit: visitable('/vault/secrets-engines/:backend/configuration'),
+  defaultTTL: text(GENERAL.infoRowValue('Default Lease TTL')),
+  maxTTL: text(GENERAL.infoRowValue('Max Lease TTL')),
 });
diff --git a/ui/tests/pages/secrets/backend/create.js b/ui/tests/pages/secrets/backend/create.js
index 5b1576c39ef..deac3178bb4 100644
--- a/ui/tests/pages/secrets/backend/create.js
+++ b/ui/tests/pages/secrets/backend/create.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { create, visitable } from 'ember-cli-page-object';
 
 export const Base = {
-  visit: visitable('/vault/secrets/:backend/create/:id'),
-  visitRoot: visitable('/vault/secrets/:backend/create'),
+  visit: visitable('/vault/secrets-engines/:backend/create/:id'),
+  visitRoot: visitable('/vault/secrets-engines/:backend/create'),
 };
 export default create(Base);
diff --git a/ui/tests/pages/secrets/backend/credentials.js b/ui/tests/pages/secrets/backend/credentials.js
index ad2137bfdd9..c0c552f227c 100644
--- a/ui/tests/pages/secrets/backend/credentials.js
+++ b/ui/tests/pages/secrets/backend/credentials.js
@@ -1,13 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { create, visitable } from 'ember-cli-page-object';
 
 export const Base = {
-  visit: visitable('/vault/secrets/:backend/credentials/:id'),
-  visitRoot: visitable('/vault/secrets/:backend/credentials'),
+  visit: visitable('/vault/secrets-engines/:backend/credentials/:id'),
+  visitRoot: visitable('/vault/secrets-engines/:backend/credentials'),
 };
 
 export default create(Base);
diff --git a/ui/tests/pages/secrets/backend/database/connection.js b/ui/tests/pages/secrets/backend/database/connection.js
index 14f9de35ce6..2fb89aaf764 100644
--- a/ui/tests/pages/secrets/backend/database/connection.js
+++ b/ui/tests/pages/secrets/backend/database/connection.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,10 +8,9 @@ import ListView from 'vault/tests/pages/components/list-view';
 
 export default create({
   ...ListView,
-  visit: visitable('/vault/secrets/:backend/list'),
-  visitShow: visitable('/vault/secrets/:backend/show/:id'),
-  visitCreate: visitable('/vault/secrets/:backend/create'),
-  createLink: clickable('[data-test-secret-create]'),
+  visit: visitable('/vault/secrets-engines/:backend/list'),
+  visitShow: visitable('/vault/secrets-engines/:backend/show/:id'),
+  visitCreate: visitable('/vault/secrets-engines/:backend/create'),
   dbPlugin: selectable('[data-test-input="plugin_name"]'),
   name: fillable('[data-test-input="name"]'),
   toggleVerify: clickable('[data-test-input="verify_connection"]'),
@@ -20,7 +19,7 @@ export default create({
   username: fillable('[data-test-input="username"]'),
   password: fillable('[data-test-input="password"]'),
   save: clickable('[data-test-secret-save]'),
-  addRole: clickable('[data-test-secret-create]'), // only from connection show
+  addRole: clickable('[data-test-add-role]'),
   enable: clickable('[data-test-enable-connection]'),
   edit: clickable('[data-test-edit-link]'),
   delete: clickable('[data-test-database-connection-delete]'),
diff --git a/ui/tests/pages/secrets/backend/database/role.js b/ui/tests/pages/secrets/backend/database/role.js
index 2c12d8c5101..25d99841e0a 100644
--- a/ui/tests/pages/secrets/backend/database/role.js
+++ b/ui/tests/pages/secrets/backend/database/role.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,12 +8,11 @@ import ListView from 'vault/tests/pages/components/list-view';
 
 export default create({
   ...ListView,
-  visit: visitable('/vault/secrets/:backend/list?itemType=role'),
-  visitShow: visitable('/vault/secrets/:backend/show/role/:id'),
-  visitCreate: visitable('/vault/secrets/:backend/create?itemType=role'),
+  visit: visitable('/vault/secrets-engines/:backend/list?itemType=role'),
+  visitShow: visitable('/vault/secrets-engines/:backend/show/role/:id'),
+  visitCreate: visitable('/vault/secrets-engines/:backend/create?itemType=role'),
   createLink: clickable('[data-test-secret-create]'),
   name: fillable('[data-test-input="name"]'),
   roleType: selectable('[data-test-input="type"'),
-  save: clickable('[data-test-secret-save]'),
   edit: clickable('[data-test-edit-link]'),
 });
diff --git a/ui/tests/pages/secrets/backend/edit.js b/ui/tests/pages/secrets/backend/edit.js
index 589b4595b07..b8f359be0cc 100644
--- a/ui/tests/pages/secrets/backend/edit.js
+++ b/ui/tests/pages/secrets/backend/edit.js
@@ -1,11 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { create, visitable } from 'ember-cli-page-object';
 
 export default create({
-  visit: visitable('/vault/secrets/:backend/edit/:id'),
-  visitRoot: visitable('/vault/secrets/:backend/edit'),
+  visit: visitable('/vault/secrets-engines/:backend/edit/:id'),
+  visitRoot: visitable('/vault/secrets-engines/:backend/edit'),
 });
diff --git a/ui/tests/pages/secrets/backend/kmip/credentials.js b/ui/tests/pages/secrets/backend/kmip/credentials.js
index 439bed7c863..d52a9b29671 100644
--- a/ui/tests/pages/secrets/backend/kmip/credentials.js
+++ b/ui/tests/pages/secrets/backend/kmip/credentials.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,10 +8,11 @@ import ListView from 'vault/tests/pages/components/list-view';
 
 export default create({
   ...ListView,
-  visit: visitable('/vault/secrets/:backend/kmip/scopes/:scope/roles/:role/credentials'),
-  visitDetail: visitable('/vault/secrets/:backend/kmip/scopes/:scope/roles/:role/credentials/:serial'),
+  visit: visitable('/vault/secrets-engines/:backend/kmip/scopes/:scope/roles/:role/credentials'),
+  visitDetail: visitable(
+    '/vault/secrets-engines/:backend/kmip/scopes/:scope/roles/:role/credentials/:serial'
+  ),
   create: clickable('[data-test-role-create]'),
   generateCredentialsLink: clickable('[data-test-kmip-link-generate-credentials]'),
   backToRoleLink: clickable('[data-test-kmip-link-back-to-role]'),
-  submit: clickable('[data-test-edit-form-submit]'),
 });
diff --git a/ui/tests/pages/secrets/backend/kmip/roles.js b/ui/tests/pages/secrets/backend/kmip/roles.js
index aafaeba988a..6a1762cdd0b 100644
--- a/ui/tests/pages/secrets/backend/kmip/roles.js
+++ b/ui/tests/pages/secrets/backend/kmip/roles.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,11 +8,10 @@ import ListView from 'vault/tests/pages/components/list-view';
 
 export default create({
   ...ListView,
-  visit: visitable('/vault/secrets/:backend/kmip/scopes/:scope/roles'),
-  visitDetail: visitable('/vault/secrets/:backend/kmip/scopes/:scope/roles/:role'),
+  visit: visitable('/vault/secrets-engines/:backend/kmip/scopes/:scope/roles'),
+  visitDetail: visitable('/vault/secrets-engines/:backend/kmip/scopes/:scope/roles/:role'),
   create: clickable('[data-test-role-create]'),
-  roleName: fillable('[data-test-input="name"]'),
-  submit: clickable('[data-test-edit-form-submit]'),
+  roleName: fillable('[data-test-input="role"]'),
   detailEditLink: clickable('[data-test-kmip-link-edit-role]'),
   cancelLink: clickable('[data-test-edit-form-cancel]'),
 });
diff --git a/ui/tests/pages/secrets/backend/kmip/scopes.js b/ui/tests/pages/secrets/backend/kmip/scopes.js
index b72ab3e9924..608626b5181 100644
--- a/ui/tests/pages/secrets/backend/kmip/scopes.js
+++ b/ui/tests/pages/secrets/backend/kmip/scopes.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,11 +8,10 @@ import ListView from 'vault/tests/pages/components/list-view';
 
 export default create({
   ...ListView,
-  visit: visitable('/vault/secrets/:backend/kmip/scopes'),
-  visitCreate: visitable('/vault/secrets/:backend/kmip/scopes/create'),
+  visit: visitable('/vault/secrets-engines/:backend/kmip/scopes'),
+  visitCreate: visitable('/vault/secrets-engines/:backend/kmip/scopes/create'),
   createLink: clickable('[data-test-scope-create]'),
   scopeName: fillable('[data-test-input="name"]'),
-  submit: clickable('[data-test-edit-form-submit]'),
   configurationLink: clickable('[data-test-kmip-link-config]'),
   configureLink: clickable('[data-test-kmip-link-configure]'),
   scopesLink: clickable('[data-test-kmip-link-scopes]'),
diff --git a/ui/tests/pages/secrets/backend/kv/edit-secret.js b/ui/tests/pages/secrets/backend/kv/edit-secret.js
index 17336c7d0fb..e297a9b1425 100644
--- a/ui/tests/pages/secrets/backend/kv/edit-secret.js
+++ b/ui/tests/pages/secrets/backend/kv/edit-secret.js
@@ -1,22 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { Base } from '../create';
-import { clickable, create, fillable } from 'ember-cli-page-object';
-import { settled } from '@ember/test-helpers';
+import { create, fillable } from 'ember-cli-page-object';
 
 export default create({
   ...Base,
   path: fillable('[data-test-secret-path="true"]'),
   secretKey: fillable('[data-test-secret-key]'),
   secretValue: fillable('[data-test-secret-value] textarea'),
-  save: clickable('[data-test-secret-save]'),
-  toggleJSON: clickable('[data-test-toggle-input="json"]'),
-  createSecret: async function (path, key, value) {
-    await this.path(path).secretKey(key).secretValue(value).save();
-    await settled();
-    return;
-  },
 });
diff --git a/ui/tests/pages/secrets/backend/kv/show.js b/ui/tests/pages/secrets/backend/kv/show.js
index fd689d015e0..0c83cb996d0 100644
--- a/ui/tests/pages/secrets/backend/kv/show.js
+++ b/ui/tests/pages/secrets/backend/kv/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,12 +9,7 @@ import { create, clickable, collection, isPresent } from 'ember-cli-page-object'
 export default create({
   ...Base,
   deleteBtnV1: clickable('[data-test-secret-v1-delete]'),
-  confirmBtn: clickable('[data-test-confirm-button]'),
   rows: collection('data-test-row-label'),
   edit: clickable('[data-test-secret-edit]'),
   editIsPresent: isPresent('[data-test-secret-edit]'),
-
-  deleteSecretV1() {
-    return this.deleteBtnV1().confirmBtn();
-  },
 });
diff --git a/ui/tests/pages/secrets/backend/list.js b/ui/tests/pages/secrets/backend/list.js
index 263013ceef4..7c363e1dad5 100644
--- a/ui/tests/pages/secrets/backend/list.js
+++ b/ui/tests/pages/secrets/backend/list.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,10 +16,8 @@ import {
 import { getter } from 'ember-cli-page-object/macros';
 
 export default create({
-  visit: visitable('/vault/secrets/:backend/list/:id'),
-  visitRoot: visitable('/vault/secrets/:backend/list'),
-  create: clickable('[data-test-secret-create]'),
-  createIsPresent: isPresent('[data-test-secret-create]'),
+  visit: visitable('/vault/secrets-engines/:backend/list/:id'),
+  visitRoot: visitable('/vault/secrets-engines/:backend/list'),
   configure: clickable('[data-test-secret-backend-configure]'),
   configureIsPresent: isPresent('[data-test-secret-backend-configure]'),
   tabs: collection('[data-test-secret-list-tab]'),
@@ -33,8 +31,6 @@ export default create({
   menuItems: collection('.ember-basic-dropdown-content li', {
     testContainer: '#ember-testing',
   }),
-  delete: clickable('[data-test-confirm-action-trigger]'),
-  confirmDelete: clickable('[data-test-confirm-button]'),
   backendIsEmpty: getter(function () {
     return this.secrets.length === 0;
   }),
diff --git a/ui/tests/pages/secrets/backend/pki/edit-role.js b/ui/tests/pages/secrets/backend/pki/edit-role.js
deleted file mode 100644
index 9da0f8d2da5..00000000000
--- a/ui/tests/pages/secrets/backend/pki/edit-role.js
+++ /dev/null
@@ -1,35 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { Base } from '../create';
-import { settled } from '@ember/test-helpers';
-import { clickable, visitable, create, fillable } from 'ember-cli-page-object';
-
-export default create({
-  ...Base,
-  visitEdit: visitable('/vault/secrets/:backend/edit/:id'),
-  visitEditRoot: visitable('/vault/secrets/:backend/edit'),
-  toggleDomain: clickable('[data-test-toggle-group="Domain Handling"]'),
-  toggleOptions: clickable('[data-test-toggle-group="Options"]'),
-  name: fillable('[data-test-input="name"]'),
-  allowAnyName: clickable('[data-test-input="allowAnyName"]'),
-  allowedDomains: fillable('[data-test-input="allowedDomains"] .input'),
-  save: clickable('[data-test-role-create]'),
-
-  async createRole(name, allowedDomains) {
-    await this.toggleDomain();
-    await settled();
-    await this.toggleOptions();
-    await settled();
-    await this.name(name);
-    await settled();
-    await this.allowAnyName();
-    await settled();
-    await this.allowedDomains(allowedDomains);
-    await settled();
-    await this.save();
-    await settled();
-  },
-});
diff --git a/ui/tests/pages/secrets/backend/pki/generate-cert.js b/ui/tests/pages/secrets/backend/pki/generate-cert.js
deleted file mode 100644
index 77268e34796..00000000000
--- a/ui/tests/pages/secrets/backend/pki/generate-cert.js
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { Base } from '../credentials';
-import { clickable, text, value, create, fillable, isPresent } from 'ember-cli-page-object';
-
-export default create({
-  ...Base,
-  title: text('[data-test-title]'),
-  commonName: fillable('[data-test-input="commonName"]'),
-  commonNameValue: value('[data-test-input="commonName"]'),
-  csr: fillable('[data-test-input="csr"]'),
-  submit: clickable('[data-test-secret-generate]'),
-  back: clickable('[data-test-secret-generate-back]'),
-  certificate: text('[data-test-row-value="Certificate"]'),
-  toggleOptions: clickable('[data-test-toggle-group]'),
-  enableTtl: clickable('[data-test-toggle-input]'),
-  hasCert: isPresent('[data-test-row-value="Certificate"]'),
-  fillInTime: fillable('[data-test-ttl-value]'),
-  fillInField: fillable('[data-test-select="ttl-unit"]'),
-  issueCert: async function (commonName) {
-    await this.commonName(commonName).toggleOptions().enableTtl().fillInField('h').fillInTime('30').submit();
-  },
-
-  sign: async function (commonName, csr) {
-    return this.csr(csr)
-      .commonName(commonName)
-      .toggleOptions()
-      .enableTtl()
-      .fillInField('h')
-      .fillInTime('30')
-      .submit();
-  },
-});
diff --git a/ui/tests/pages/secrets/backend/pki/show.js b/ui/tests/pages/secrets/backend/pki/show.js
deleted file mode 100644
index f1a1a092254..00000000000
--- a/ui/tests/pages/secrets/backend/pki/show.js
+++ /dev/null
@@ -1,25 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { Base } from '../show';
-import { settled } from '@ember/test-helpers';
-import { create, clickable, collection, text, isPresent } from 'ember-cli-page-object';
-
-export default create({
-  ...Base,
-  rows: collection('data-test-row-label'),
-  certificate: text('[data-test-row-value="Certificate"]'),
-  hasCert: isPresent('[data-test-row-value="Certificate"]'),
-  edit: clickable('[data-test-edit-link]'),
-  generateCert: clickable('[data-test-credentials-link]'),
-  deleteBtn: clickable('[data-test-role-delete] button'),
-  confirmBtn: clickable('[data-test-confirm-button]'),
-  async deleteRole() {
-    await this.deleteBtn();
-    await settled();
-    await this.confirmBtn();
-    await settled();
-  },
-});
diff --git a/ui/tests/pages/secrets/backend/show.js b/ui/tests/pages/secrets/backend/show.js
index 27f9fe54854..fe32cc808e1 100644
--- a/ui/tests/pages/secrets/backend/show.js
+++ b/ui/tests/pages/secrets/backend/show.js
@@ -1,12 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { create, visitable } from 'ember-cli-page-object';
 
 export const Base = {
-  visit: visitable('/vault/secrets/:backend/show/:id'),
-  visitRoot: visitable('/vault/secrets/:backend/show'),
+  visit: visitable('/vault/secrets-engines/:backend/show/:id'),
+  visitRoot: visitable('/vault/secrets-engines/:backend/show'),
 };
 export default create(Base);
diff --git a/ui/tests/pages/secrets/backend/ssh/edit-role.js b/ui/tests/pages/secrets/backend/ssh/edit-role.js
deleted file mode 100644
index 3c7df375556..00000000000
--- a/ui/tests/pages/secrets/backend/ssh/edit-role.js
+++ /dev/null
@@ -1,24 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { Base } from '../create';
-import { clickable, visitable, create, fillable } from 'ember-cli-page-object';
-
-export default create({
-  ...Base,
-  visitEdit: visitable('/vault/secrets/:backend/edit/:id'),
-  visitEditRoot: visitable('/vault/secrets/:backend/edit'),
-  keyType: fillable('[data-test-input="keyType"]'),
-  defaultUser: fillable('[data-test-input="defaultUser"]'),
-  toggleMore: clickable('[data-test-toggle-group="Options"]'),
-  name: fillable('[data-test-input="name"]'),
-  CIDR: fillable('[data-test-input="cidrList"]'),
-  save: clickable('[data-test-role-ssh-create]'),
-
-  async createOTPRole(name) {
-    await this.name(name);
-    await this.toggleMore().keyType('otp').defaultUser('admin').CIDR('0.0.0.0/0').save();
-  },
-});
diff --git a/ui/tests/pages/secrets/backend/ssh/generate-otp.js b/ui/tests/pages/secrets/backend/ssh/generate-otp.js
index d4ed260a437..320c8d9106b 100644
--- a/ui/tests/pages/secrets/backend/ssh/generate-otp.js
+++ b/ui/tests/pages/secrets/backend/ssh/generate-otp.js
@@ -1,10 +1,10 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { Base } from '../credentials';
-import { clickable, value, create, fillable, isPresent } from 'ember-cli-page-object';
+import { value, create, fillable, isPresent } from 'ember-cli-page-object';
 
 export default create({
   ...Base,
@@ -14,9 +14,5 @@ export default create({
   ip: fillable('[data-test-input="ip"]'),
   warningIsPresent: isPresent('[data-test-warning]'),
   commonNameValue: value('[data-test-input="commonName"]'),
-  submit: clickable('[data-test-secret-generate]'),
-  back: clickable('[data-test-secret-generate-back]'),
-  generateOTP: async function () {
-    await this.user('admin').ip('192.168.1.1').submit();
-  },
+  generateOTP: async function () {},
 });
diff --git a/ui/tests/pages/secrets/backend/ssh/show.js b/ui/tests/pages/secrets/backend/ssh/show.js
index e4e23839fe0..9d659114383 100644
--- a/ui/tests/pages/secrets/backend/ssh/show.js
+++ b/ui/tests/pages/secrets/backend/ssh/show.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,9 +13,4 @@ export default create({
   editIsPresent: isPresent('[data-test-edit-link]'),
   generate: clickable('[data-test-backend-credentials]'),
   generateIsPresent: isPresent('[data-test-backend-credentials]'),
-  deleteBtn: clickable('[data-test-confirm-action-trigger]'),
-  confirmBtn: clickable('[data-test-confirm-button]'),
-  deleteRole() {
-    return this.deleteBtn().confirmBtn();
-  },
 });
diff --git a/ui/tests/pages/secrets/backend/transform/alphabets.js b/ui/tests/pages/secrets/backend/transform/alphabets.js
index bcfbf87104c..93217587218 100644
--- a/ui/tests/pages/secrets/backend/transform/alphabets.js
+++ b/ui/tests/pages/secrets/backend/transform/alphabets.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,9 +8,8 @@ import ListView from 'vault/tests/pages/components/list-view';
 
 export default create({
   ...ListView,
-  visit: visitable('/vault/secrets/:backend/list?tab=alphabet'),
-  visitCreate: visitable('/vault/secrets/:backend/create?itemType=alphabet'),
-  createLink: clickable('[data-test-secret-create]'),
+  visit: visitable('/vault/secrets-engines/:backend/list?tab=alphabet'),
+  visitCreate: visitable('/vault/secrets-engines/:backend/create?itemType=alphabet'),
   editLink: clickable('[data-test-edit-link]'),
   name: fillable('[data-test-input="name"]'),
   alphabet: fillable('[data-test-input="alphabet"'),
diff --git a/ui/tests/pages/secrets/backend/transform/roles.js b/ui/tests/pages/secrets/backend/transform/roles.js
index 3ec92f5685c..76ebd51df3a 100644
--- a/ui/tests/pages/secrets/backend/transform/roles.js
+++ b/ui/tests/pages/secrets/backend/transform/roles.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,11 +8,10 @@ import ListView from 'vault/tests/pages/components/list-view';
 
 export default create({
   ...ListView,
-  visit: visitable('/vault/secrets/:backend/list?tab=roles'),
-  visitCreate: visitable('/vault/secrets/:backend/create?itemType=role'),
+  visit: visitable('/vault/secrets-engines/:backend/list?tab=roles'),
+  visitCreate: visitable('/vault/secrets-engines/:backend/create?itemType=role'),
   createLink: clickable('[data-test-secret-create]'),
   name: fillable('[data-test-input="name"]'),
   transformations: fillable('[data-test-input="transformations"'),
-  submit: clickable('[data-test-role-transform-create]'),
   modalConfirm: clickable('[data-test-edit-confirm-button]'),
 });
diff --git a/ui/tests/pages/secrets/backend/transform/templates.js b/ui/tests/pages/secrets/backend/transform/templates.js
deleted file mode 100644
index cbede093b2b..00000000000
--- a/ui/tests/pages/secrets/backend/transform/templates.js
+++ /dev/null
@@ -1,21 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { create, clickable, fillable, visitable } from 'ember-cli-page-object';
-import ListView from 'vault/tests/pages/components/list-view';
-
-export default create({
-  ...ListView,
-  visit: visitable('/vault/secrets/:backend/list?tab=templates'),
-  visitCreate: visitable('/vault/secrets/:backend/create?itemType=template'),
-  createLink: clickable('[data-test-secret-create]'),
-  editLink: clickable('[data-test-edit-link]'),
-  deleteLink: clickable('[data-test-transformation-template-delete]'),
-  name: fillable('[data-test-input="name"]'),
-  pattern: fillable('[data-test-input="pattern"'),
-  alphabet: fillable('[data-test-input="alphabet"'),
-  submit: clickable('[data-test-template-transform-create]'),
-  removeAlphabet: clickable('#alphabet [data-test-selected-list-button="delete"]'),
-});
diff --git a/ui/tests/pages/secrets/backend/transform/transformations.js b/ui/tests/pages/secrets/backend/transform/transformations.js
index 53165803598..c0165657e73 100644
--- a/ui/tests/pages/secrets/backend/transform/transformations.js
+++ b/ui/tests/pages/secrets/backend/transform/transformations.js
@@ -1,21 +1,18 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { create, clickable, fillable, visitable } from 'ember-cli-page-object';
+import { create, fillable, visitable } from 'ember-cli-page-object';
 import ListView from 'vault/tests/pages/components/list-view';
 
 export default create({
   ...ListView,
-  visit: visitable('/vault/secrets/:backend/list'),
-  visitShow: visitable('/vault/secrets/:backend/show/:id'),
-  visitCreate: visitable('/vault/secrets/:backend/create'),
-  createLink: clickable('[data-test-secret-create]'),
+  visit: visitable('/vault/secrets-engines/:backend/list'),
+  visitShow: visitable('/vault/secrets-engines/:backend/show/:id'),
+  visitCreate: visitable('/vault/secrets-engines/:backend/create'),
   name: fillable('[data-test-input="name"]'),
-  submit: clickable('[data-test-transform-create]'),
   type: fillable('[data-test-input="type"'),
   tweakSource: fillable('[data-test-input="tweak_source"'),
   maskingChar: fillable('[data-test-input="masking_character"'),
-  save: clickable('[data-test-transformation-save-button]'),
 });
diff --git a/ui/tests/pages/secrets/backends.js b/ui/tests/pages/secrets/backends.js
index 1c10e85c8d9..2fb210ca71e 100644
--- a/ui/tests/pages/secrets/backends.js
+++ b/ui/tests/pages/secrets/backends.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,15 +8,10 @@ import uiPanel from 'vault/tests/pages/components/console/ui-panel';
 
 export default create({
   consoleToggle: clickable('[data-test-console-toggle]'),
-  visit: visitable('/vault/secrets'),
-  rows: collection('[data-test-secrets-backend-link]', {
-    path: text('[data-test-secret-path]'),
+  visit: visitable('/vault/secrets-engines'),
+  rows: collection('[data-test-table-row]', {
+    path: text('[data-test-table-data]'),
     menu: clickable('[data-test-popup-menu-trigger]'),
   }),
-  configLink: clickable('[data-test-engine-config]', {
-    testContainer: '#ember-testing',
-  }),
-  disableButton: clickable('[data-test-confirm-action-trigger]'),
-  confirmDisable: clickable('[data-test-confirm-button]'),
   console: uiPanel,
 });
diff --git a/ui/tests/pages/settings/auth/configure/index.js b/ui/tests/pages/settings/auth/configure/index.js
index 018a3504e93..c31b4964d0b 100644
--- a/ui/tests/pages/settings/auth/configure/index.js
+++ b/ui/tests/pages/settings/auth/configure/index.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/pages/settings/auth/configure/section.js b/ui/tests/pages/settings/auth/configure/section.js
index 1232a78c217..2434732e300 100644
--- a/ui/tests/pages/settings/auth/configure/section.js
+++ b/ui/tests/pages/settings/auth/configure/section.js
@@ -1,16 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { create, clickable, visitable, collection } from 'ember-cli-page-object';
+import { create, clickable, visitable } from 'ember-cli-page-object';
 import fields from '../../../components/form-field';
 import flashMessage from '../../../components/flash-message';
 
 export default create({
   ...fields,
-  tabs: collection('[data-test-auth-section-tab]'),
   visit: visitable('/vault/settings/auth/configure/:path/:section'),
   flash: flashMessage,
-  save: clickable('[data-test-save-config]'),
+  save: clickable('[data-test-submit-config]'),
 });
diff --git a/ui/tests/pages/settings/auth/enable.js b/ui/tests/pages/settings/auth/enable.js
index 34893885a31..ab74d0d3455 100644
--- a/ui/tests/pages/settings/auth/enable.js
+++ b/ui/tests/pages/settings/auth/enable.js
@@ -1,18 +1,17 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { create, visitable } from 'ember-cli-page-object';
-import backendForm from '../../components/mount-backend-form';
 import flashMessages from '../../components/flash-message';
+import { mountBackend } from 'vault/tests/helpers/components/mount-backend-form-helpers';
 
 export default create({
   visit: visitable('/vault/settings/auth/enable'),
-  ...backendForm,
   flash: flashMessages,
   enable: async function (type, path) {
     await this.visit();
-    await this.mount(type, path);
+    await mountBackend(type, path);
   },
 });
diff --git a/ui/tests/pages/settings/mount-secret-backend.js b/ui/tests/pages/settings/mount-secret-backend.js
index 6a4e58661ca..1a6bc6aedcc 100644
--- a/ui/tests/pages/settings/mount-secret-backend.js
+++ b/ui/tests/pages/settings/mount-secret-backend.js
@@ -1,29 +1,32 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { create, visitable, fillable, clickable } from 'ember-cli-page-object';
-import { settled } from '@ember/test-helpers';
-import mountForm from 'vault/tests/pages/components/mount-backend-form';
+import { visit, click, fillIn } from '@ember/test-helpers';
+import { GENERAL } from 'vault/tests/helpers/general-selectors';
 
 export default create({
-  visit: visitable('/vault/settings/mount-secret-backend'),
-  ...mountForm,
-  version: fillable('[data-test-input="version"]'),
-  setMaxVersion: fillable('[data-test-input="maxVersions"]'),
-  enableMaxTtl: clickable('[data-test-toggle-input="Max Lease TTL"]'),
+  visit: visitable('/vault/secrets-engines/enable'),
+  version: fillable('[data-test-input="options.version"]'),
+  setMaxVersion: fillable('[data-test-input="kv_config.max_versions"]'),
   maxTTLVal: fillable('[data-test-ttl-value="Max Lease TTL"]'),
   maxTTLUnit: fillable('[data-test-ttl-unit="Max Lease TTL"] [data-test-select="ttl-unit"]'),
-  enableDefaultTtl: clickable('[data-test-toggle-input="Default Lease TTL"]'),
   enableEngine: clickable('[data-test-enable-engine]'),
   secretList: clickable('[data-test-sidebar-nav-link="Secrets Engines"]'),
   defaultTTLVal: fillable('input[data-test-ttl-value="Default Lease TTL"]'),
   defaultTTLUnit: fillable('[data-test-ttl-unit="Default Lease TTL"] [data-test-select="ttl-unit"]'),
   enable: async function (type, path) {
-    await this.visit();
-    await settled();
-    await this.mount(type, path);
-    await settled();
+    // Navigate to the secrets engines catalog
+    await visit('/vault/secrets-engines/enable');
+    // Click the engine type card to proceed to configuration
+    await click(GENERAL.cardContainer(type));
+    // Fill in the path if provided
+    if (path) {
+      await fillIn(GENERAL.inputByAttr('path'), path);
+    }
+    // Submit the form to mount the engine
+    await click(GENERAL.submitButton);
   },
 });
diff --git a/ui/tests/test-helper.js b/ui/tests/test-helper.js
index 5213d456fd9..90d9dddb03e 100644
--- a/ui/tests/test-helper.js
+++ b/ui/tests/test-helper.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -13,6 +13,7 @@ import './helpers/flash-message';
 import preloadAssets from 'ember-asset-loader/test-support/preload-assets';
 import { setupGlobalA11yHooks, setRunOptions } from 'ember-a11y-testing/test-support';
 import manifest from 'vault/config/asset-manifest';
+import setupSinon from 'ember-sinon-qunit';
 
 preloadAssets(manifest).then(() => {
   setup(QUnit.assert);
@@ -26,7 +27,7 @@ preloadAssets(manifest).then(() => {
       values: ['wcag2a'],
     },
   });
-
+  setupSinon();
   start({
     setupTestIsolationValidation: true,
   });
diff --git a/ui/tests/unit/adapters/application-test.js b/ui/tests/unit/adapters/application-test.js
new file mode 100644
index 00000000000..b4053f6ccaa
--- /dev/null
+++ b/ui/tests/unit/adapters/application-test.js
@@ -0,0 +1,33 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { module, test } from 'qunit';
+import Sinon from 'sinon';
+
+import { setupTest } from 'vault/tests/helpers';
+
+module('Unit | Adapter | application', function (hooks) {
+  setupTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.server.get('/some-url', function () {
+      return {
+        warnings: ['this is a warning'],
+      };
+    });
+    this.adapter = this.owner.lookup('adapter:application');
+  });
+
+  test('it triggers info flash message when warnings returned from API', async function (assert) {
+    const flashSuccessSpy = Sinon.spy(this.owner.lookup('service:flash-messages'), 'info');
+    await this.adapter.ajax('/v1/some-url', 'GET', { skipWarnings: true });
+    assert.true(flashSuccessSpy.notCalled, 'flash is not called when skipWarnings option passed');
+    await this.adapter.ajax('/v1/some-url', 'GET', {});
+    assert.true(flashSuccessSpy.calledOnce);
+    assert.true(flashSuccessSpy.calledWith('this is a warning'));
+  });
+});
diff --git a/ui/tests/unit/adapters/aws-credential-test.js b/ui/tests/unit/adapters/aws-credential-test.js
index 5f804fdedf0..04e38bbf2f1 100644
--- a/ui/tests/unit/adapters/aws-credential-test.js
+++ b/ui/tests/unit/adapters/aws-credential-test.js
@@ -1,45 +1,50 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
-import apiStub from 'vault/tests/helpers/noop-all-api-requests';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
+const storeStub = {
+  pushPayload() {},
+  serializerFor() {
+    return {
+      serializeIntoHash() {},
+    };
+  },
+};
+
+const makeSnapshot = (obj) => {
+  obj.role = {
+    backend: 'aws',
+    name: 'foo',
+  };
+  obj.attr = (attr) => obj[attr];
+  return obj;
+};
+
+const type = {
+  modelName: 'aws-credential',
+};
 module('Unit | Adapter | aws credential', function (hooks) {
   setupTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.server = apiStub();
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
+    this.getAssertion = () => {};
+    this.postAssertion = () => {};
+    this.server.get('/aws/creds/foo', (schema, req) => {
+      this.getAssertion(req);
+      return {};
+    });
+    this.server.post('/aws/creds/foo', (schema, req) => {
+      this.postAssertion(req);
+      return {};
+    });
   });
 
-  const storeStub = {
-    pushPayload() {},
-    serializerFor() {
-      return {
-        serializeIntoHash() {},
-      };
-    },
-  };
-
-  const makeSnapshot = (obj) => {
-    obj.role = {
-      backend: 'aws',
-      name: 'foo',
-    };
-    obj.attr = (attr) => obj[attr];
-    return obj;
-  };
-
-  const type = {
-    modelName: 'aws-credential',
-  };
-
   const cases = [
     ['iam_user type', [storeStub, type, makeSnapshot({ credentialType: 'iam_user', ttl: '3h' })], 'GET'],
     [
@@ -69,6 +74,11 @@ module('Unit | Adapter | aws credential', function (hooks) {
       [storeStub, type, makeSnapshot({ credentialType: 'assumed_role' })],
       'POST',
     ],
+    [
+      'assumed_role type no arn, ttl empty',
+      [storeStub, type, makeSnapshot({ credentialType: 'assumed_role', ttl: '' })],
+      'POST',
+    ],
     [
       'assumed_role type no arn',
       [storeStub, type, makeSnapshot({ credentialType: 'assumed_role', ttl: '3h' })],
@@ -82,19 +92,19 @@ module('Unit | Adapter | aws credential', function (hooks) {
       { ttl: '3h', role_arn: 'arn' },
     ],
   ];
-  cases.forEach(([description, args, expectedMethod, expectedRequestBody]) => {
+
+  cases.forEach(([description, args, method, expectedRequestBody]) => {
     test(`aws-credential: ${description}`, function (assert) {
-      assert.expect(3);
+      assert.expect(2);
+      const assertionName = method === 'GET' ? 'getAssertion' : 'postAssertion';
+      this.set(assertionName, (req) => {
+        assert.strictEqual(req.method, method, `query calls the correct url with method ${method}`);
+        const body = JSON.parse(req.requestBody);
+        const expected = expectedRequestBody ? expectedRequestBody : null;
+        assert.deepEqual(body, expected);
+      });
       const adapter = this.owner.lookup('adapter:aws-credential');
       adapter.createRecord(...args);
-      const { method, url, requestBody } = this.server.handledRequests[0];
-      assert.strictEqual(url, '/v1/aws/creds/foo', `calls the correct url`);
-      assert.strictEqual(
-        method,
-        expectedMethod,
-        `${description} uses the correct http verb: ${expectedMethod}`
-      );
-      assert.strictEqual(requestBody, expectedRequestBody ? JSON.stringify(expectedRequestBody) : null);
     });
   });
 });
diff --git a/ui/tests/unit/adapters/capabilities-test.js b/ui/tests/unit/adapters/capabilities-test.js
index 0cd83a00079..89eb5dadb2f 100644
--- a/ui/tests/unit/adapters/capabilities-test.js
+++ b/ui/tests/unit/adapters/capabilities-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -10,61 +10,141 @@ import { setupTest } from 'ember-qunit';
 module('Unit | Adapter | capabilities', function (hooks) {
   setupTest(hooks);
 
-  test('calls the correct url', function (assert) {
-    let url, method, options;
-    const adapter = this.owner.factoryFor('adapter:capabilities').create({
-      ajax: (...args) => {
-        [url, method, options] = args;
-        return resolve();
-      },
+  module('findRecord', function () {
+    test('it calls the correct url', function (assert) {
+      let url, method, options;
+      const adapter = this.owner.factoryFor('adapter:capabilities').create({
+        ajax: (...args) => {
+          [url, method, options] = args;
+          return resolve();
+        },
+      });
+
+      adapter.findRecord(null, 'capabilities', 'foo');
+      assert.strictEqual(url, '/v1/sys/capabilities-self', 'calls the correct URL');
+      assert.deepEqual(options.data, { paths: ['foo'] }, 'data params OK');
+      assert.strictEqual(method, 'POST', 'method OK');
     });
 
-    adapter.findRecord(null, 'capabilities', 'foo');
-    assert.strictEqual(url, '/v1/sys/capabilities-self', 'calls the correct URL');
-    assert.deepEqual({ paths: ['foo'] }, options.data, 'data params OK');
-    assert.strictEqual(method, 'POST', 'method OK');
-  });
+    test('enterprise calls the correct url within namespace when userRoot = root', function (assert) {
+      const namespaceSvc = this.owner.lookup('service:namespace');
+      namespaceSvc.setNamespace('admin');
 
-  test('enterprise calls the correct url within namespace when userRoot = root', function (assert) {
-    const namespaceSvc = this.owner.lookup('service:namespace');
-    namespaceSvc.setNamespace('admin');
+      let url, method, options;
+      const adapter = this.owner.factoryFor('adapter:capabilities').create({
+        ajax: (...args) => {
+          [url, method, options] = args;
+          return resolve();
+        },
+      });
 
-    let url, method, options;
-    const adapter = this.owner.factoryFor('adapter:capabilities').create({
-      ajax: (...args) => {
-        [url, method, options] = args;
-        return resolve();
-      },
+      adapter.findRecord(null, 'capabilities', 'foo');
+      assert.strictEqual(url, '/v1/sys/capabilities-self', 'calls the correct URL');
+      assert.deepEqual(options.data, { paths: ['admin/foo'] }, 'data params prefix paths with namespace');
+      assert.strictEqual(options.namespace, '', 'sent with root namespace');
+      assert.strictEqual(method, 'POST', 'method OK');
     });
 
-    adapter.findRecord(null, 'capabilities', 'foo');
-    assert.strictEqual(url, '/v1/sys/capabilities-self', 'calls the correct URL');
-    assert.deepEqual({ paths: ['admin/foo'] }, options.data, 'data params prefix paths with namespace');
-    assert.strictEqual(options.namespace, '', 'sent with root namespace');
-    assert.strictEqual(method, 'POST', 'method OK');
+    test('enterprise calls the correct url within namespace when userRoot is not root', function (assert) {
+      const namespaceSvc = this.owner.lookup('service:namespace');
+      const auth = this.owner.lookup('service:auth');
+      namespaceSvc.setNamespace('admin/bar/baz');
+      // Set user root namespace
+      auth.setCluster('1');
+      auth.set('tokens', ['vault-_root_☃1']);
+      auth.setTokenData('vault-_root_☃1', {
+        userRootNamespace: 'admin/bar',
+        backend: { mountPath: 'token' },
+      });
+
+      let url, method, options;
+      const adapter = this.owner.factoryFor('adapter:capabilities').create({
+        ajax: (...args) => {
+          [url, method, options] = args;
+          return resolve();
+        },
+      });
+
+      adapter.findRecord(null, 'capabilities', 'foo');
+      assert.strictEqual(url, '/v1/sys/capabilities-self', 'calls the correct URL');
+      assert.deepEqual(
+        options.data,
+        { paths: ['baz/foo'] },
+        'data params prefix path with relative namespace'
+      );
+      assert.strictEqual(options.namespace, 'admin/bar', 'sent with root namespace');
+      assert.strictEqual(method, 'POST', 'method OK');
+    });
   });
 
-  test('enterprise calls the correct url within namespace when userRoot is not root', function (assert) {
-    const namespaceSvc = this.owner.lookup('service:namespace');
-    const auth = this.owner.lookup('service:auth');
-    namespaceSvc.setNamespace('admin/bar/baz');
-    // Set user root namespace
-    auth.setCluster('1');
-    auth.set('tokens', ['vault-_root_☃1']);
-    auth.setTokenData('vault-_root_☃1', { userRootNamespace: 'admin/bar', backend: { mountPath: 'token' } });
-
-    let url, method, options;
-    const adapter = this.owner.factoryFor('adapter:capabilities').create({
-      ajax: (...args) => {
-        [url, method, options] = args;
-        return resolve();
-      },
+  module('query', function () {
+    test('it calls the correct url', function (assert) {
+      let url, method, options;
+      const adapter = this.owner.factoryFor('adapter:capabilities').create({
+        ajax: (...args) => {
+          [url, method, options] = args;
+          return resolve();
+        },
+      });
+
+      adapter.query(null, 'capabilities', { paths: ['foo', 'my/path'] });
+      assert.strictEqual(url, '/v1/sys/capabilities-self', 'calls the correct URL');
+      assert.deepEqual(options.data, { paths: ['foo', 'my/path'] }, 'data params OK');
+      assert.strictEqual(method, 'POST', 'method OK');
     });
 
-    adapter.findRecord(null, 'capabilities', 'foo');
-    assert.strictEqual(url, '/v1/sys/capabilities-self', 'calls the correct URL');
-    assert.deepEqual({ paths: ['baz/foo'] }, options.data, 'data params prefix path with relative namespace');
-    assert.strictEqual(options.namespace, 'admin/bar', 'sent with root namespace');
-    assert.strictEqual(method, 'POST', 'method OK');
+    test('enterprise calls the correct url within namespace when userRoot = root', function (assert) {
+      const namespaceSvc = this.owner.lookup('service:namespace');
+      namespaceSvc.setNamespace('admin');
+
+      let url, method, options;
+      const adapter = this.owner.factoryFor('adapter:capabilities').create({
+        ajax: (...args) => {
+          [url, method, options] = args;
+          return resolve();
+        },
+      });
+
+      adapter.query(null, 'capabilities', { paths: ['foo', 'my/path'] });
+      assert.strictEqual(url, '/v1/sys/capabilities-self', 'calls the correct URL');
+      assert.deepEqual(
+        options.data,
+        { paths: ['admin/foo', 'admin/my/path'] },
+        'data params prefix paths with namespace'
+      );
+      assert.strictEqual(options.namespace, '', 'sent with root namespace');
+      assert.strictEqual(method, 'POST', 'method OK');
+    });
+
+    test('enterprise calls the correct url within namespace when userRoot is not root', function (assert) {
+      const namespaceSvc = this.owner.lookup('service:namespace');
+      const auth = this.owner.lookup('service:auth');
+      namespaceSvc.setNamespace('admin/bar/baz');
+      // Set user root namespace
+      auth.setCluster('1');
+      auth.set('tokens', ['vault-_root_☃1']);
+      auth.setTokenData('vault-_root_☃1', {
+        userRootNamespace: 'admin/bar',
+        backend: { mountPath: 'token' },
+      });
+
+      let url, method, options;
+      const adapter = this.owner.factoryFor('adapter:capabilities').create({
+        ajax: (...args) => {
+          [url, method, options] = args;
+          return resolve();
+        },
+      });
+
+      adapter.query(null, 'capabilities', { paths: ['foo', 'my/path'] });
+      assert.strictEqual(url, '/v1/sys/capabilities-self', 'calls the correct URL');
+      assert.deepEqual(
+        options.data,
+        { paths: ['baz/foo', 'baz/my/path'] },
+        'data params prefix path with relative namespace'
+      );
+      assert.strictEqual(options.namespace, 'admin/bar', 'sent with root namespace');
+      assert.strictEqual(method, 'POST', 'method OK');
+    });
   });
 });
diff --git a/ui/tests/unit/adapters/clients-activity-test.js b/ui/tests/unit/adapters/clients-activity-test.js
index ab6e4ffeb0a..af8977fdc89 100644
--- a/ui/tests/unit/adapters/clients-activity-test.js
+++ b/ui/tests/unit/adapters/clients-activity-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,7 @@ import { module, test } from 'qunit';
 import sinon from 'sinon';
 import { setupTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { subMonths, fromUnixTime, addMonths } from 'date-fns';
+import { subMonths, fromUnixTime } from 'date-fns';
 import { parseAPITimestamp } from 'core/utils/date-formatters';
 import timestamp from 'core/utils/timestamp';
 
@@ -15,25 +15,21 @@ module('Unit | Adapter | clients activity', function (hooks) {
   setupTest(hooks);
   setupMirage(hooks);
 
-  hooks.before(function () {
-    sinon.stub(timestamp, 'now').callsFake(() => new Date('2023-01-13T09:30:15'));
-  });
   hooks.beforeEach(function () {
+    this.timestampStub = sinon.replace(timestamp, 'now', sinon.fake.returns(new Date('2023-01-13T09:30:15')));
     this.store = this.owner.lookup('service:store');
     this.modelName = 'clients/activity';
-    this.startDate = subMonths(timestamp.now(), 6);
-    this.endDate = timestamp.now();
+    const mockNow = timestamp.now();
+    this.startDate = subMonths(mockNow, 6);
+    this.endDate = mockNow;
     this.readableUnix = (unix) => parseAPITimestamp(fromUnixTime(unix).toISOString(), 'MMMM dd yyyy');
   });
-  hooks.after(function () {
-    timestamp.now.restore();
-  });
 
   test('it does not format if both params are timestamp strings', async function (assert) {
     assert.expect(1);
     const queryParams = {
-      start_time: { timestamp: this.startDate.toISOString() },
-      end_time: { timestamp: this.endDate.toISOString() },
+      start_time: this.startDate.toISOString(),
+      end_time: this.endDate.toISOString(),
     };
     this.server.get('sys/internal/counters/activity', (schema, req) => {
       assert.propEqual(req.queryParams, {
@@ -45,98 +41,98 @@ module('Unit | Adapter | clients activity', function (hooks) {
     this.store.queryRecord(this.modelName, queryParams);
   });
 
-  test('it formats start_time if only end_time is a timestamp string', async function (assert) {
-    assert.expect(2);
-    const twoMonthsAhead = addMonths(this.startDate, 2);
-    const month = twoMonthsAhead.getMonth();
-    const year = twoMonthsAhead.getFullYear();
-    const queryParams = {
-      start_time: {
-        monthIdx: month,
-        year,
-      },
-      end_time: {
-        timestamp: this.endDate.toISOString(),
-      },
-    };
+  test('it sends without query if no dates provided', async function (assert) {
+    assert.expect(1);
 
     this.server.get('sys/internal/counters/activity', (schema, req) => {
-      const { start_time, end_time } = req.queryParams;
-      const readableStart = this.readableUnix(start_time);
-      assert.strictEqual(
-        readableStart,
-        `September 01 2022`,
-        `formatted unix start time is the first of the month: ${readableStart}`
-      );
-      assert.strictEqual(end_time, this.endDate.toISOString(), 'end time is a timestamp string');
+      assert.propEqual(req.queryParams, {});
     });
-    this.store.queryRecord(this.modelName, queryParams);
+
+    this.store.queryRecord(this.modelName, { foo: 'bar' });
   });
 
-  test('it formats end_time only if only start_time is a timestamp string', async function (assert) {
-    assert.expect(2);
-    const twoMothsAgo = subMonths(this.endDate, 2);
-    const endMonth = twoMothsAgo.getMonth();
-    const year = twoMothsAgo.getFullYear();
-    const queryParams = {
-      start_time: {
-        timestamp: this.startDate.toISOString(),
-      },
-      end_time: {
-        monthIdx: endMonth,
-        year,
-      },
-    };
+  test('it sends without query if no valid dates provided', async function (assert) {
+    assert.expect(1);
 
     this.server.get('sys/internal/counters/activity', (schema, req) => {
-      const { start_time, end_time } = req.queryParams;
-      const readableEnd = this.readableUnix(end_time);
-      assert.strictEqual(start_time, this.startDate.toISOString(), 'start time is a timestamp string');
-      assert.strictEqual(
-        readableEnd,
-        `November 30 2022`,
-        `formatted unix end time is the last day of the month: ${readableEnd}`
-      );
+      assert.propEqual(req.queryParams, {});
     });
 
-    this.store.queryRecord(this.modelName, queryParams);
+    this.store.queryRecord(this.modelName, { start_time: 'bar', end_time: 'baz' });
   });
 
-  test('it formats both params if neither are a timestamp', async function (assert) {
+  test('it handles empty query gracefully', async function (assert) {
+    assert.expect(1);
+
+    this.server.get('sys/internal/counters/activity', (schema, req) => {
+      assert.propEqual(req.queryParams, {});
+    });
+
+    this.store.queryRecord(this.modelName, {});
+  });
+
+  test('it adds the passed namespace to the request header', async function (assert) {
     assert.expect(2);
-    const startDate = subMonths(this.startDate, 2);
-    const endDate = addMonths(this.endDate, 2);
-    const startMonth = startDate.getMonth();
-    const startYear = startDate.getFullYear();
-    const endMonth = endDate.getMonth();
-    const endYear = endDate.getFullYear();
     const queryParams = {
-      start_time: {
-        monthIdx: startMonth,
-        year: startYear,
-      },
-      end_time: {
-        monthIdx: endMonth,
-        year: endYear,
-      },
+      start_time: this.startDate.toISOString(),
+      end_time: this.endDate.toISOString(),
+      // the adapter does not do any more transformations, so it must be called
+      // with the combined current + selected namespace
+      namespace: 'foobar/baz',
     };
-
     this.server.get('sys/internal/counters/activity', (schema, req) => {
-      const { start_time, end_time } = req.queryParams;
-      const readableEnd = this.readableUnix(end_time);
-      const readableStart = this.readableUnix(start_time);
-      assert.strictEqual(
-        readableStart,
-        `May 01 2022`,
-        `formatted unix start time is the first of the month: ${readableStart}`
-      );
-      assert.strictEqual(
-        readableEnd,
-        `March 31 2023`,
-        `formatted unix end time is the last day of the month: ${readableEnd}`
-      );
+      assert.propEqual(req.queryParams, {
+        start_time: this.startDate.toISOString(),
+        end_time: this.endDate.toISOString(),
+      });
+      assert.strictEqual(req.requestHeaders['X-Vault-Namespace'], 'foobar/baz');
     });
 
     this.store.queryRecord(this.modelName, queryParams);
   });
+
+  module('exportData', function (hooks) {
+    hooks.beforeEach(function () {
+      this.adapter = this.store.adapterFor('clients/activity');
+    });
+    test('it requests with correct params when no query', async function (assert) {
+      assert.expect(1);
+
+      this.server.get('sys/internal/counters/activity/export', (schema, req) => {
+        assert.propEqual(req.queryParams, { format: 'csv' });
+      });
+
+      await this.adapter.exportData();
+    });
+
+    test('it requests with correct params when start only', async function (assert) {
+      assert.expect(1);
+
+      this.server.get('sys/internal/counters/activity/export', (schema, req) => {
+        assert.propEqual(req.queryParams, { format: 'csv', start_time: '2024-04-01T00:00:00.000Z' });
+      });
+
+      await this.adapter.exportData({ start_time: '2024-04-01T00:00:00.000Z' });
+    });
+
+    test('it requests with correct params when all params', async function (assert) {
+      assert.expect(2);
+
+      this.server.get('sys/internal/counters/activity/export', (schema, req) => {
+        assert.strictEqual(req.requestHeaders['X-Vault-Namespace'], 'foo/bar');
+        assert.propEqual(req.queryParams, {
+          format: 'json',
+          start_time: '2024-04-01T00:00:00.000Z',
+          end_time: '2024-05-31T00:00:00.000Z',
+        });
+      });
+
+      await this.adapter.exportData({
+        start_time: '2024-04-01T00:00:00.000Z',
+        end_time: '2024-05-31T00:00:00.000Z',
+        format: 'json',
+        namespace: 'foo/bar',
+      });
+    });
+  });
 });
diff --git a/ui/tests/unit/adapters/cluster-test.js b/ui/tests/unit/adapters/cluster-test.js
index 9998a5545e9..b724048f9b6 100644
--- a/ui/tests/unit/adapters/cluster-test.js
+++ b/ui/tests/unit/adapters/cluster-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -37,7 +37,7 @@ module('Unit | Adapter | cluster', function (hooks) {
     assert.strictEqual(url, '/v1/sys/seal-status', 'health url OK');
     assert.strictEqual(method, 'GET', 'seal-status method OK');
 
-    let data = { someData: 1 };
+    const data = { someData: 1 };
     adapter.unseal(data);
     assert.strictEqual(url, '/v1/sys/unseal', 'unseal url OK');
     assert.strictEqual(method, 'PUT', 'unseal method OK');
@@ -47,100 +47,6 @@ module('Unit | Adapter | cluster', function (hooks) {
     assert.strictEqual(url, '/v1/sys/init', 'init url OK');
     assert.strictEqual(method, 'PUT', 'init method OK');
     assert.deepEqual({ data, unauthenticated: true }, options, 'init options OK');
-
-    data = { token: 'token', password: 'password', username: 'username' };
-
-    adapter.authenticate({ backend: 'token', data });
-    assert.strictEqual(url, '/v1/auth/token/lookup-self', 'auth:token url OK');
-    assert.strictEqual(method, 'GET', 'auth:token method OK');
-    assert.deepEqual(
-      { headers: { 'X-Vault-Token': 'token' }, unauthenticated: true },
-      options,
-      'auth:token options OK'
-    );
-
-    adapter.authenticate({ backend: 'github', data });
-    assert.strictEqual(url, '/v1/auth/github/login', 'auth:github url OK');
-    assert.strictEqual(method, 'POST', 'auth:github method OK');
-    assert.deepEqual(
-      { data: { password: 'password', token: 'token' }, unauthenticated: true },
-      options,
-      'auth:github options OK'
-    );
-
-    data = { jwt: 'token', role: 'test' };
-    adapter.authenticate({ backend: 'jwt', data });
-    assert.strictEqual(url, '/v1/auth/jwt/login', 'auth:jwt url OK');
-    assert.strictEqual(method, 'POST', 'auth:jwt method OK');
-    assert.deepEqual(
-      { data: { jwt: 'token', role: 'test' }, unauthenticated: true },
-      options,
-      'auth:jwt options OK'
-    );
-
-    data = { jwt: 'token', role: 'test', path: 'oidc' };
-    adapter.authenticate({ backend: 'jwt', data });
-    assert.strictEqual(url, '/v1/auth/oidc/login', 'auth:jwt custom mount path, url OK');
-
-    data = { token: 'token', password: 'password', username: 'username', path: 'path' };
-
-    adapter.authenticate({ backend: 'token', data });
-    assert.strictEqual(url, '/v1/auth/token/lookup-self', 'auth:token url with path OK');
-
-    adapter.authenticate({ backend: 'github', data });
-    assert.strictEqual(url, '/v1/auth/path/login', 'auth:github with path url OK');
-
-    data = { password: 'password', username: 'username' };
-
-    adapter.authenticate({ backend: 'userpass', data });
-    assert.strictEqual(url, '/v1/auth/userpass/login/username', 'auth:userpass url OK');
-    assert.strictEqual(method, 'POST', 'auth:userpass method OK');
-    assert.deepEqual(
-      { data: { password: 'password' }, unauthenticated: true },
-      options,
-      'auth:userpass options OK'
-    );
-
-    adapter.authenticate({ backend: 'radius', data });
-    assert.strictEqual(url, '/v1/auth/radius/login/username', 'auth:RADIUS url OK');
-    assert.strictEqual(method, 'POST', 'auth:RADIUS method OK');
-    assert.deepEqual(
-      { data: { password: 'password' }, unauthenticated: true },
-      options,
-      'auth:RADIUS options OK'
-    );
-
-    adapter.authenticate({ backend: 'LDAP', data });
-    assert.strictEqual(url, '/v1/auth/ldap/login/username', 'ldap:userpass url OK');
-    assert.strictEqual(method, 'POST', 'ldap:userpass method OK');
-    assert.deepEqual(
-      { data: { password: 'password' }, unauthenticated: true },
-      options,
-      'ldap:userpass options OK'
-    );
-
-    data = { password: 'password', username: 'username', nonce: 'uuid' };
-    adapter.authenticate({ backend: 'okta', data });
-    assert.strictEqual(url, '/v1/auth/okta/login/username', 'okta:userpass url OK');
-    assert.strictEqual(method, 'POST', 'ldap:userpass method OK');
-    assert.deepEqual(
-      { data: { password: 'password', nonce: 'uuid' }, unauthenticated: true },
-      options,
-      'okta:userpass options OK'
-    );
-
-    // use a custom mount path
-    data = { password: 'password', username: 'username', path: 'path' };
-
-    adapter.authenticate({ backend: 'userpass', data });
-    assert.strictEqual(url, '/v1/auth/path/login/username', 'auth:userpass with path url OK');
-
-    adapter.authenticate({ backend: 'LDAP', data });
-    assert.strictEqual(url, '/v1/auth/path/login/username', 'auth:LDAP with path url OK');
-
-    data = { password: 'password', username: 'username', path: 'path', nonce: 'uuid' };
-    adapter.authenticate({ backend: 'Okta', data });
-    assert.strictEqual(url, '/v1/auth/path/login/username', 'auth:Okta with path url OK');
   });
 
   test('cluster replication api urls', function (assert) {
diff --git a/ui/tests/unit/adapters/console-test.js b/ui/tests/unit/adapters/console-test.js
index 3aec9f976cc..de80d7357b1 100644
--- a/ui/tests/unit/adapters/console-test.js
+++ b/ui/tests/unit/adapters/console-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/identity/_test-cases.js b/ui/tests/unit/adapters/identity/_test-cases.js
index 2ea5d9d514a..c31be4da8be 100644
--- a/ui/tests/unit/adapters/identity/_test-cases.js
+++ b/ui/tests/unit/adapters/identity/_test-cases.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/identity/entity-alias-test.js b/ui/tests/unit/adapters/identity/entity-alias-test.js
index e6605140199..f9b0539251d 100644
--- a/ui/tests/unit/adapters/identity/entity-alias-test.js
+++ b/ui/tests/unit/adapters/identity/entity-alias-test.js
@@ -1,42 +1,36 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
 import testCases from './_test-cases';
-import apiStub from 'vault/tests/helpers/noop-all-api-requests';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 module('Unit | Adapter | identity/entity-alias', function (hooks) {
   setupTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.server = apiStub();
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
+  setupMirage(hooks);
 
   const cases = testCases('identity/entity-alias');
 
   cases.forEach((testCase) => {
     test(`entity-alias#${testCase.adapterMethod}`, function (assert) {
-      assert.expect(2);
+      assert.expect(3);
+      const method = testCase.method.toLowerCase();
+      const url = testCase.url.replace('/v1', '').split('?')[0];
+      const queryParams = testCase.url.includes('?list=true') ? { list: 'true' } : {};
+      this.server[method](url, (schema, req) => {
+        assert.true(
+          testCase.url.includes(url),
+          `${testCase.adapterMethod} calls the correct url: ${testCase.url}`
+        );
+        assert.strictEqual(req.method, testCase.method, `uses the correct http verb: ${testCase.method}`);
+        assert.deepEqual(req.queryParams, queryParams, 'calls with correct query params');
+        return {};
+      });
       const adapter = this.owner.lookup('adapter:identity/entity-alias');
       adapter[testCase.adapterMethod](...testCase.args);
-      const { url, method } = this.server.handledRequests[0];
-      assert.strictEqual(
-        url,
-        testCase.url,
-        `${testCase.adapterMethod} calls the correct url: ${testCase.url}`
-      );
-      assert.strictEqual(
-        method,
-        testCase.method,
-        `${testCase.adapterMethod} uses the correct http verb: ${testCase.method}`
-      );
     });
   });
 });
diff --git a/ui/tests/unit/adapters/identity/entity-merge-test.js b/ui/tests/unit/adapters/identity/entity-merge-test.js
index 538520e943d..88915d4e5c4 100644
--- a/ui/tests/unit/adapters/identity/entity-merge-test.js
+++ b/ui/tests/unit/adapters/identity/entity-merge-test.js
@@ -1,34 +1,26 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Pretender from 'pretender';
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
 import { storeMVP } from './_test-cases';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 module('Unit | Adapter | identity/entity-merge', function (hooks) {
   setupTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.server = new Pretender(function () {
-      this.post('/v1/**', (response) => {
-        return [response, { 'Content-Type': 'application/json' }, JSON.stringify({})];
-      });
-    });
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
+  setupMirage(hooks);
 
   test(`entity-merge#createRecord`, function (assert) {
     assert.expect(2);
+    this.server.post('/identity/entity/merge', (_, req) => {
+      const { url, method } = req;
+      assert.strictEqual(url, `/v1/identity/entity/merge`, ` calls the correct url`);
+      assert.strictEqual(method, 'POST', `uses the correct http verb: POST`);
+      return {};
+    });
     const adapter = this.owner.lookup('adapter:identity/entity-merge');
     adapter.createRecord(storeMVP, { modelName: 'identity/entity-merge' }, { attr: (x) => x });
-    const { url, method } = this.server.handledRequests[0];
-    assert.strictEqual(url, `/v1/identity/entity/merge`, ` calls the correct url`);
-    assert.strictEqual(method, 'POST', `uses the correct http verb: POST`);
   });
 });
diff --git a/ui/tests/unit/adapters/identity/entity-test.js b/ui/tests/unit/adapters/identity/entity-test.js
index a6211ec8bda..3eb2eda7925 100644
--- a/ui/tests/unit/adapters/identity/entity-test.js
+++ b/ui/tests/unit/adapters/identity/entity-test.js
@@ -1,42 +1,36 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
 import testCases from './_test-cases';
-import apiStub from 'vault/tests/helpers/noop-all-api-requests';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 module('Unit | Adapter | identity/entity', function (hooks) {
   setupTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.server = apiStub();
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
+  setupMirage(hooks);
 
   const cases = testCases('identit/entity');
 
   cases.forEach((testCase) => {
     test(`entity#${testCase.adapterMethod}`, function (assert) {
-      assert.expect(2);
+      assert.expect(3);
+      const method = testCase.method.toLowerCase();
+      const url = testCase.url.replace('/v1', '').split('?')[0];
+      const queryParams = testCase.url.includes('?list=true') ? { list: 'true' } : {};
+      this.server[method](url, (schema, req) => {
+        assert.true(
+          testCase.url.includes(url),
+          `${testCase.adapterMethod} calls the correct url: ${testCase.url}`
+        );
+        assert.strictEqual(req.method, testCase.method, `uses the correct http verb: ${testCase.method}`);
+        assert.deepEqual(req.queryParams, queryParams, 'calls with correct query params');
+        return {};
+      });
       const adapter = this.owner.lookup('adapter:identity/entity');
       adapter[testCase.adapterMethod](...testCase.args);
-      const { url, method } = this.server.handledRequests[0];
-      assert.strictEqual(
-        url,
-        testCase.url,
-        `${testCase.adapterMethod} calls the correct url: ${testCase.url}`
-      );
-      assert.strictEqual(
-        method,
-        testCase.method,
-        `${testCase.adapterMethod} uses the correct http verb: ${testCase.method}`
-      );
     });
   });
 });
diff --git a/ui/tests/unit/adapters/identity/group-alias-test.js b/ui/tests/unit/adapters/identity/group-alias-test.js
index a6d92478f55..e7f2239d57a 100644
--- a/ui/tests/unit/adapters/identity/group-alias-test.js
+++ b/ui/tests/unit/adapters/identity/group-alias-test.js
@@ -1,42 +1,36 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
 import testCases from './_test-cases';
-import apiStub from 'vault/tests/helpers/noop-all-api-requests';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 module('Unit | Adapter | identity/group-alias', function (hooks) {
   setupTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.server = apiStub();
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
+  setupMirage(hooks);
 
   const cases = testCases('identity/group-alias');
 
   cases.forEach((testCase) => {
     test(`group-alias#${testCase.adapterMethod}`, function (assert) {
-      assert.expect(2);
+      assert.expect(3);
+      const method = testCase.method.toLowerCase();
+      const url = testCase.url.replace('/v1', '').split('?')[0];
+      const queryParams = testCase.url.includes('?list=true') ? { list: 'true' } : {};
+      this.server[method](url, (schema, req) => {
+        assert.true(
+          testCase.url.includes(url),
+          `${testCase.adapterMethod} calls the correct url: ${testCase.url}`
+        );
+        assert.strictEqual(req.method, testCase.method, `usses the correct http verb: ${testCase.method}`);
+        assert.deepEqual(req.queryParams, queryParams, 'calls with correct query params');
+        return {};
+      });
       const adapter = this.owner.lookup('adapter:identity/group-alias');
       adapter[testCase.adapterMethod](...testCase.args);
-      const { url, method } = this.server.handledRequests[0];
-      assert.strictEqual(
-        url,
-        testCase.url,
-        `${testCase.adapterMethod} calls the correct url: ${testCase.url}`
-      );
-      assert.strictEqual(
-        method,
-        testCase.method,
-        `${testCase.adapterMethod} uses the correct http verb: ${testCase.method}`
-      );
     });
   });
 });
diff --git a/ui/tests/unit/adapters/identity/group-test.js b/ui/tests/unit/adapters/identity/group-test.js
index b314cb3b831..bb670ad816a 100644
--- a/ui/tests/unit/adapters/identity/group-test.js
+++ b/ui/tests/unit/adapters/identity/group-test.js
@@ -1,42 +1,36 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
 import testCases from './_test-cases';
-import apiStub from 'vault/tests/helpers/noop-all-api-requests';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 module('Unit | Adapter | identity/group', function (hooks) {
   setupTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.server = apiStub();
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
+  setupMirage(hooks);
 
   const cases = testCases('identit/entity');
 
   cases.forEach((testCase) => {
     test(`group#${testCase.adapterMethod}`, function (assert) {
-      assert.expect(2);
+      assert.expect(3);
+      const method = testCase.method.toLowerCase();
+      const url = testCase.url.replace('/v1', '').split('?')[0];
+      const queryParams = testCase.url.includes('?list=true') ? { list: 'true' } : {};
+      this.server[method](url, (schema, req) => {
+        assert.true(
+          testCase.url.includes(url),
+          `${testCase.adapterMethod} calls the correct url: ${testCase.url}`
+        );
+        assert.strictEqual(req.method, testCase.method, `usses the correct http verb: ${testCase.method}`);
+        assert.deepEqual(req.queryParams, queryParams, 'calls with correct query params');
+        return {};
+      });
       const adapter = this.owner.lookup('adapter:identity/group');
       adapter[testCase.adapterMethod](...testCase.args);
-      const { url, method } = this.server.handledRequests[0];
-      assert.strictEqual(
-        url,
-        testCase.url,
-        `${testCase.adapterMethod} calls the correct url: ${testCase.url}`
-      );
-      assert.strictEqual(
-        method,
-        testCase.method,
-        `${testCase.adapterMethod} uses the correct http verb: ${testCase.method}`
-      );
     });
   });
 });
diff --git a/ui/tests/unit/adapters/kmip/role-test.js b/ui/tests/unit/adapters/kmip/role-test.js
index a9d20d90045..77c0687cd81 100644
--- a/ui/tests/unit/adapters/kmip/role-test.js
+++ b/ui/tests/unit/adapters/kmip/role-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,8 @@ import { setupTest } from 'ember-qunit';
 module('Unit | Adapter | kmip/role', function (hooks) {
   setupTest(hooks);
 
+  // these are only some of the actual editable fields
+  const editableFields = ['tlsTtl', 'operationAll', 'operationNone', 'operationGet', 'operationCreate'];
   const serializeTests = [
     [
       'operation_all is the only operation item present after serialization',
@@ -17,7 +19,7 @@ module('Unit | Adapter | kmip/role', function (hooks) {
           return { operation_all: true, operation_get: true, operation_create: true, tls_ttl: '10s' };
         },
         record: {
-          nonOperationFields: ['tlsTtl'],
+          editableFields,
         },
       },
       {
@@ -32,7 +34,7 @@ module('Unit | Adapter | kmip/role', function (hooks) {
           return { operation_all: true, operation_get: true, operation_create: true };
         },
         record: {
-          nonOperationFields: ['tlsTtl'],
+          editableFields,
         },
       },
       {
@@ -46,7 +48,7 @@ module('Unit | Adapter | kmip/role', function (hooks) {
           return { operation_none: true, operation_get: true, operation_add_attribute: true, tls_ttl: '10s' };
         },
         record: {
-          nonOperationFields: ['tlsTtl'],
+          editableFields,
         },
       },
       {
@@ -67,7 +69,7 @@ module('Unit | Adapter | kmip/role', function (hooks) {
           };
         },
         record: {
-          nonOperationFields: ['tlsTtl'],
+          editableFields,
         },
       },
       {
diff --git a/ui/tests/unit/adapters/kubernetes/config-test.js b/ui/tests/unit/adapters/kubernetes/config-test.js
index 7ccf6dd88b9..81c51b327af 100644
--- a/ui/tests/unit/adapters/kubernetes/config-test.js
+++ b/ui/tests/unit/adapters/kubernetes/config-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/kubernetes/role-test.js b/ui/tests/unit/adapters/kubernetes/role-test.js
index 0db589e6df2..afbbbcb4c9a 100644
--- a/ui/tests/unit/adapters/kubernetes/role-test.js
+++ b/ui/tests/unit/adapters/kubernetes/role-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/kv/data-test.js b/ui/tests/unit/adapters/kv/data-test.js
deleted file mode 100644
index 20a0ed55d8b..00000000000
--- a/ui/tests/unit/adapters/kv/data-test.js
+++ /dev/null
@@ -1,367 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { kvDataPath } from 'vault/utils/kv-path';
-import { encodePath } from 'vault/utils/path-encoding-helpers';
-import { Response } from 'miragejs';
-
-const EXAMPLE_KV_DATA_CREATE_RESPONSE = {
-  request_id: 'foobar',
-  data: {
-    created_time: '2023-06-21T16:18:31.479993Z',
-    custom_metadata: null,
-    deletion_time: '',
-    destroyed: false,
-    version: 1,
-  },
-};
-
-const EXAMPLE_KV_DATA_GET_RESPONSE = {
-  request_id: 'foobar',
-  data: {
-    data: { foo: 'bar' },
-    metadata: {
-      created_time: '2023-06-20T21:26:47.592306Z',
-      custom_metadata: null,
-      deletion_time: '',
-      destroyed: false,
-      version: 2,
-    },
-  },
-};
-
-const EXAMPLE_CONTROL_GROUP_RESPONSE = {
-  data: null,
-  wrap_info: {
-    token: 'some-token',
-    accessor: 'some-accessor',
-    ttl: 86400,
-    creation_time: '2023-08-09T16:08:06-05:00',
-    creation_path: 'some/path/here',
-  },
-};
-
-const EXAMPLE_KV_DATA_DESTROYED = {
-  data: {
-    data: null,
-    metadata: {
-      created_time: '2023-08-09T20:10:24.4825Z',
-      custom_metadata: null,
-      deletion_time: '',
-      destroyed: true,
-      version: 2,
-    },
-  },
-};
-
-const EXAMPLE_KV_DATA_DELETED = {
-  data: {
-    data: null,
-    metadata: {
-      created_time: '2023-08-09T20:10:24.571332Z',
-      custom_metadata: null,
-      deletion_time: '2023-08-09T20:10:24.70176Z',
-      destroyed: false,
-      version: 2,
-    },
-  },
-};
-
-module('Unit | Adapter | kv/data', function (hooks) {
-  setupTest(hooks);
-  setupMirage(hooks);
-
-  hooks.beforeEach(function () {
-    this.store = this.owner.lookup('service:store');
-    this.version = this.owner.lookup('service:version');
-    this.version.type = 'enterprise'; // Required for testing control-group flow
-    this.secretMountPath = this.owner.lookup('service:secret-mount-path');
-    this.backend = 'my/kv-back&end';
-    this.secretMountPath.currentPath = this.backend;
-    this.path = 'beep/bop/my secret';
-    this.version = '2';
-    this.id = kvDataPath(this.backend, this.path, this.version);
-    this.data = {
-      options: {
-        cas: 2,
-      },
-      data: {
-        foo: 'bar',
-      },
-    };
-    this.payload = {
-      backend: this.backend,
-      path: this.path,
-      version: 2,
-    };
-    this.endpoint = (noun) => `${encodePath(this.backend)}/${noun}/${encodePath(this.path)}`;
-  });
-
-  test('it should make request to correct endpoint on createRecord', async function (assert) {
-    assert.expect(8);
-    this.server.post(this.endpoint('data'), (schema, req) => {
-      assert.ok('POST request made to correct endpoint when creating new record');
-      const body = JSON.parse(req.requestBody);
-      assert.deepEqual(body, {
-        data: {
-          foo: 'bar',
-        },
-        options: {
-          cas: 0,
-        },
-      });
-      return EXAMPLE_KV_DATA_CREATE_RESPONSE;
-    });
-    const record = this.store.createRecord('kv/data', {
-      backend: this.backend,
-      path: this.path,
-      secretData: { foo: 'bar' },
-      casVersion: 0,
-    });
-    await record.save();
-    assert.strictEqual(record.path, this.path, 'record has correct path');
-    assert.strictEqual(record.backend, this.backend, 'record has correct backend');
-    assert.strictEqual(record.version, 1, 'record has correct version');
-    assert.deepEqual(record.secretData, { foo: 'bar' }, 'record has correct data');
-    assert.strictEqual(record.createdTime, '2023-06-21T16:18:31.479993Z', 'record has correct createdTime');
-    assert.strictEqual(
-      record.id,
-      `${encodePath(this.backend)}/data/${encodePath(this.path)}?version=1`,
-      'record has correct id'
-    );
-  });
-
-  test('it should not send cas if casVersion is not a number', async function (assert) {
-    assert.expect(8);
-    this.server.post(this.endpoint('data'), (schema, req) => {
-      assert.ok('POST request made to correct endpoint when creating new record');
-      const body = JSON.parse(req.requestBody);
-      assert.deepEqual(body, {
-        data: {
-          foo: 'bar',
-        },
-      });
-      return EXAMPLE_KV_DATA_CREATE_RESPONSE;
-    });
-    const record = this.store.createRecord('kv/data', {
-      backend: this.backend,
-      path: this.path,
-      secretData: { foo: 'bar' },
-    });
-    await record.save();
-    assert.strictEqual(record.path, this.path, 'record has correct path');
-    assert.strictEqual(record.backend, this.backend, 'record has correct backend');
-    assert.strictEqual(record.version, 1, 'record has correct version');
-    assert.deepEqual(record.secretData, { foo: 'bar' }, 'record has correct data');
-    assert.strictEqual(record.createdTime, '2023-06-21T16:18:31.479993Z', 'record has correct createdTime');
-    assert.strictEqual(
-      record.id,
-      `${encodePath(this.backend)}/data/${encodePath(this.path)}?version=1`,
-      'record has correct id'
-    );
-  });
-
-  test('it should make request to correct endpoint on queryRecord', async function (assert) {
-    assert.expect(8);
-    this.server.get(this.endpoint('data'), (schema, req) => {
-      assert.ok(true, 'request is made to correct url on queryRecord.');
-      assert.strictEqual(
-        req.queryParams.version,
-        this.version,
-        'request includes the version flag on queryRecord.'
-      );
-      return EXAMPLE_KV_DATA_GET_RESPONSE;
-    });
-
-    const record = await this.store.queryRecord('kv/data', this.payload);
-    assert.strictEqual(record.path, this.path, 'record has correct path');
-    assert.strictEqual(record.backend, this.backend, 'record has correct backend');
-    assert.strictEqual(record.version, 2, 'record has correct version');
-    assert.deepEqual(record.secretData, { foo: 'bar' }, 'record has correct data');
-    assert.strictEqual(record.createdTime, '2023-06-20T21:26:47.592306Z', 'record has correct createdTime');
-    assert.strictEqual(
-      record.id,
-      `${encodePath(this.backend)}/data/${encodePath(this.path)}?version=${this.version}`,
-      'record has correct id'
-    );
-  });
-
-  test('it should handle a 404 not found response properly', async function (assert) {
-    assert.expect(1);
-    this.server.get(this.endpoint('data'), () => {
-      // This is what the API currently returns for not found
-      return new Response(404, {}, { errors: [] });
-    });
-
-    try {
-      await this.store.queryRecord('kv/data', this.payload);
-    } catch (e) {
-      assert.ok('throws the error');
-    }
-  });
-
-  test('it should handle a 403 permission denied properly', async function (assert) {
-    assert.expect(8);
-    this.server.get(this.endpoint('data'), (schema, req) => {
-      assert.ok(true, 'request is made to correct url on queryRecord.');
-      assert.strictEqual(
-        req.queryParams.version,
-        this.version,
-        'request includes the version flag on queryRecord.'
-      );
-      return new Response(403, {}, { errors: ['1 error occurred:\n\t* permission denied\n\n'] });
-    });
-
-    const record = await this.store.queryRecord('kv/data', this.payload);
-    assert.strictEqual(record.path, this.path, 'record has correct path');
-    assert.strictEqual(record.backend, this.backend, 'record has correct backend');
-    assert.strictEqual(record.version, 2, 'record has version based on request');
-    assert.strictEqual(record.secretData, undefined, 'record does not include data');
-    assert.strictEqual(record.failReadErrorCode, 403, 'record has error response recorded');
-    assert.strictEqual(
-      record.id,
-      `${encodePath(this.backend)}/data/${encodePath(this.path)}?version=${this.version}`,
-      'record has correct id'
-    );
-  });
-
-  test('it should handle a soft-deleted version properly', async function (assert) {
-    this.server.get(this.endpoint('data'), () => {
-      return new Response(404, {}, EXAMPLE_KV_DATA_DELETED);
-    });
-
-    const record = await this.store.queryRecord('kv/data', this.payload);
-    assert.strictEqual(record.path, this.path, 'record has correct path');
-    assert.strictEqual(record.backend, this.backend, 'record has correct backend');
-    assert.strictEqual(record.version, 2, 'record has version based on request');
-    assert.strictEqual(record.deletionTime, '2023-08-09T20:10:24.70176Z', 'record includes deletion time');
-    assert.strictEqual(record.failReadErrorCode, undefined, 'record does not have failed error code');
-    assert.strictEqual(
-      record.id,
-      `${encodePath(this.backend)}/data/${encodePath(this.path)}?version=${this.version}`,
-      'record has correct id'
-    );
-  });
-
-  test('it should handle a destroyed version properly', async function (assert) {
-    this.server.get(this.endpoint('data'), () => {
-      return new Response(404, {}, EXAMPLE_KV_DATA_DESTROYED);
-    });
-
-    const record = await this.store.queryRecord('kv/data', this.payload);
-    assert.strictEqual(record.path, this.path, 'record has correct path');
-    assert.strictEqual(record.backend, this.backend, 'record has correct backend');
-    assert.strictEqual(record.version, 2, 'record has version based on request');
-    assert.true(record.destroyed, 'record has destroyed value');
-    assert.strictEqual(record.failReadErrorCode, undefined, 'record does not have error code');
-    assert.strictEqual(
-      record.id,
-      `${encodePath(this.backend)}/data/${encodePath(this.path)}?version=${this.version}`,
-      'record has correct id'
-    );
-  });
-
-  test('it should handle a control group response properly', async function (assert) {
-    assert.expect(1);
-    this.server.get(this.endpoint('data'), () => {
-      return EXAMPLE_CONTROL_GROUP_RESPONSE;
-    });
-
-    try {
-      await this.store.queryRecord('kv/data', this.payload);
-    } catch (e) {
-      assert.ok('throws the error');
-    }
-  });
-
-  test('it should make request to correct endpoint on delete latest version', async function (assert) {
-    assert.expect(3);
-    this.server.delete(this.endpoint('data'), () => {
-      assert.ok(true, 'request made to correct endpoint on delete latest version.');
-      return new Response(204);
-    });
-
-    this.store.pushPayload('kv/data', {
-      modelName: 'kv/data',
-      id: this.id,
-      ...this.payload,
-    });
-    let record = await this.store.peekRecord('kv/data', this.id);
-    await record.destroyRecord({ adapterOptions: { deleteType: 'delete-latest-version' } });
-    assert.true(record.isDeleted, 'record is deleted');
-    record = await this.store.peekRecord('kv/data', this.id);
-    assert.strictEqual(record, null, 'record is no longer in store');
-  });
-
-  test('it should make request to correct endpoint on delete specific versions', async function (assert) {
-    assert.expect(4);
-    this.server.post(this.endpoint('delete'), (schema, req) => {
-      const { versions } = JSON.parse(req.requestBody);
-      assert.strictEqual(versions, 2, 'version array is sent in the payload.');
-      assert.ok(true, 'request made to correct endpoint on delete specific version.');
-    });
-
-    this.store.pushPayload('kv/data', {
-      modelName: 'kv/data',
-      id: this.id,
-      ...this.payload,
-    });
-    let record = await this.store.peekRecord('kv/data', this.id);
-    await record.destroyRecord({
-      adapterOptions: { deleteType: 'delete-version', deleteVersions: 2 },
-    });
-    assert.true(record.isDeleted, 'record is deleted');
-    record = await this.store.peekRecord('kv/data', this.id);
-    assert.strictEqual(record, null, 'record is no longer in store');
-  });
-
-  test('it should make request to correct endpoint on undelete', async function (assert) {
-    assert.expect(4);
-    this.server.post(`${this.backend}/undelete/${this.path}`, (schema, req) => {
-      const { versions } = JSON.parse(req.requestBody);
-      assert.strictEqual(versions, 2, 'version array is sent in the payload.');
-      assert.ok(true, 'request made to correct endpoint on undelete specific version.');
-    });
-
-    this.store.pushPayload('kv/data', {
-      modelName: 'kv/data',
-      id: this.id,
-      ...this.payload,
-    });
-    let record = await this.store.peekRecord('kv/data', this.id);
-
-    await record.destroyRecord({
-      adapterOptions: { deleteType: 'undelete', deleteVersions: 2 },
-    });
-    assert.true(record.isDeleted, 'record is deleted');
-    record = await this.store.peekRecord('kv/data', this.id);
-    assert.strictEqual(record, null, 'record is no longer in store');
-  });
-
-  test('it should make request to correct endpoint on destroy specific versions', async function (assert) {
-    assert.expect(4);
-    this.server.put(`${encodePath(this.backend)}/destroy/${encodePath(this.path)}`, (schema, req) => {
-      const { versions } = JSON.parse(req.requestBody);
-      assert.strictEqual(versions, 2, 'version array is sent in the payload.');
-      assert.ok(true, 'request made to correct endpoint on destroy specific version.');
-    });
-
-    this.store.pushPayload('kv/data', {
-      modelName: 'kv/data',
-      id: this.id,
-      ...this.payload,
-    });
-    let record = await this.store.peekRecord('kv/data', this.id);
-    await record.destroyRecord({
-      adapterOptions: { deleteType: 'destroy', deleteVersions: 2 },
-    });
-    assert.true(record.isDeleted, 'record is deleted');
-    record = await this.store.peekRecord('kv/data', this.id);
-    assert.strictEqual(record, null, 'record is no longer in store');
-  });
-});
diff --git a/ui/tests/unit/adapters/kv/metadata-test.js b/ui/tests/unit/adapters/kv/metadata-test.js
deleted file mode 100644
index 96db4fcdb18..00000000000
--- a/ui/tests/unit/adapters/kv/metadata-test.js
+++ /dev/null
@@ -1,189 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-import { kvMetadataPath } from 'vault/utils/kv-path';
-import { Response } from 'miragejs';
-
-const UTC_DATE = '1994-11-05T00:00:00.000Z';
-
-const EXAMPLE_KV_METADATA_GET_RESPONSE = {
-  request_id: 'foobar',
-  data: {
-    cas_required: true,
-    created_time: 'created-time',
-    current_version: 2,
-    custom_metadata: { application: 'staging' },
-    delete_version_after: '0s',
-    max_versions: 10,
-    oldest_version: 0, // TODO: is this a bug? payload from real API
-    updated_time: 'updated-time',
-    versions: {
-      1: {
-        created_time: 'created-time',
-        deletion_time: UTC_DATE,
-        destroyed: false,
-      },
-      2: { created_time: 'created-time', deletion_time: '', destroyed: false },
-    },
-  },
-};
-
-module('Unit | Adapter | kv/metadata', function (hooks) {
-  setupTest(hooks);
-  setupMirage(hooks);
-
-  hooks.beforeEach(function () {
-    this.store = this.owner.lookup('service:store');
-    this.secretMountPath = this.owner.lookup('service:secret-mount-path');
-    this.backend = 'some/kv-back&end';
-    this.secretMountPath.currentPath = this.backend;
-    this.path = 'beep/bop my/secret';
-    this.id = kvMetadataPath(this.backend, this.path);
-    this.data = {
-      options: {
-        cas: 2,
-      },
-      data: {
-        foo: 'bar',
-      },
-    };
-    this.payload = {
-      max_versions: 2,
-      cas_required: false,
-      delete_version_after: '0s',
-      custom_metadata: {
-        admin: 'bob',
-      },
-    };
-    this.endpoint = kvMetadataPath(this.backend, this.path);
-  });
-
-  test('it should make request to correct endpoint on createRecord', async function (assert) {
-    assert.expect(10);
-    const recordData = {
-      backend: this.backend,
-      path: this.path,
-      deleteVersionAfter: '45h',
-      customMetadata: { application: 'staging' },
-      oldestVersion: 4,
-      currentVersion: 6,
-      createdTime: 'created',
-      updatedTime: 'updated',
-      versions: {
-        1: {
-          created_time: 'created-time',
-          deletion_time: UTC_DATE,
-          destroyed: false,
-        },
-        2: {
-          created_time: 'created-time',
-          deletion_time: '',
-          destroyed: false,
-        },
-      },
-    };
-    const expectedBody = {
-      max_versions: 0,
-      delete_version_after: '45h',
-      cas_required: false,
-      custom_metadata: { application: 'staging' },
-    };
-    this.server.post(this.endpoint, (schema, req) => {
-      const body = JSON.parse(req.requestBody);
-      assert.ok('POST request made to correct endpoint when creating new record');
-      assert.propEqual(body, expectedBody, 'POST request has correct body');
-      return new Response(204);
-    });
-    const record = this.store.createRecord('kv/metadata', recordData);
-    await record.save();
-    assert.strictEqual(record.id, this.id, 'record has correct id');
-    assert.strictEqual(record.backend, this.backend, 'record has correct backend');
-    assert.strictEqual(record.path, this.path, 'record has correct path');
-    assert.strictEqual(record.maxVersions, 0, 'record has default maxVersions');
-    assert.false(record.casRequired, 'record has correct casRequired');
-    assert.strictEqual(record.deleteVersionAfter, '45h', 'record has correct deleteVersionAfter');
-    assert.deepEqual(record.customMetadata, { application: 'staging' }, 'record has correct customMetadata');
-    assert.deepEqual(
-      record.versions,
-      EXAMPLE_KV_METADATA_GET_RESPONSE.data.versions,
-      'record has correct versions data'
-    );
-  });
-
-  test('it should make request to correct endpoint on update record', async function (assert) {
-    assert.expect(1);
-    const data = this.server.create('kv-metadatum');
-    data.id = kvMetadataPath('kv-engine', 'my-secret');
-    this.store.pushPayload('kv/metadata', {
-      modelName: 'kv/metadata',
-      ...data,
-    });
-    this.server.post(kvMetadataPath('kv-engine', 'my-secret'), () => {
-      assert.ok(true, 'request made to correct endpoint on delete metadata.');
-    });
-
-    const record = await this.store.peekRecord('kv/metadata', data.id);
-    await record.save();
-  });
-
-  test('it should make request to correct endpoint on queryRecord', async function (assert) {
-    assert.expect(13);
-    this.server.get(this.endpoint, () => {
-      assert.ok(true, 'request is made to correct url on queryRecord.');
-      return EXAMPLE_KV_METADATA_GET_RESPONSE;
-    });
-
-    const record = await this.store.queryRecord('kv/metadata', { backend: this.backend, path: this.path });
-    assert.strictEqual(record.id, this.id, 'record has correct id');
-    assert.strictEqual(record.backend, this.backend, 'record has correct backend');
-    assert.strictEqual(record.path, this.path, 'record has correct path');
-    assert.strictEqual(record.maxVersions, 10, 'record has correct maxVersions');
-    assert.true(record.casRequired, 'record has correct casRequired');
-    assert.strictEqual(record.deleteVersionAfter, '0s', 'record has correct deleteVersionAfter');
-    assert.deepEqual(record.customMetadata, { application: 'staging' }, 'record has correct customMetadata');
-    assert.strictEqual(record.createdTime, 'created-time', 'record has correct createdTime');
-    assert.strictEqual(record.currentVersion, 2, 'record has correct currentVersion');
-    assert.strictEqual(record.oldestVersion, 0, 'record has correct oldestVersion');
-    assert.strictEqual(record.updatedTime, 'updated-time', 'record has correct updatedTime');
-    assert.deepEqual(
-      record.versions,
-      EXAMPLE_KV_METADATA_GET_RESPONSE.data.versions,
-      'record has correct versions data'
-    );
-  });
-
-  test('it should make request to correct endpoint on query', async function (assert) {
-    assert.expect(1);
-    this.server.get(kvMetadataPath(this.backend, 'directory/'), (schema, req) => {
-      assert.ok(req.queryParams.list, 'list query param sent when listing secrets');
-      return { data: { keys: [] } };
-    });
-
-    this.store.query('kv/metadata', { backend: this.backend, pathToSecret: 'directory/' });
-  });
-
-  test('it should make request to correct endpoint on delete metadata', async function (assert) {
-    assert.expect(3);
-    const data = this.server.create('kv-metadatum');
-    data.id = kvMetadataPath('kv-engine', 'my-secret');
-    this.store.pushPayload('kv/metadata', {
-      modelName: 'kv/metadata',
-      ...data,
-    });
-    this.server.delete(kvMetadataPath('kv-engine', 'my-secret'), () => {
-      assert.ok(true, 'request made to correct endpoint on delete metadata.');
-    });
-
-    let record = await this.store.peekRecord('kv/metadata', data.id);
-
-    await record.destroyRecord();
-    assert.true(record.isDestroyed, 'record is destroyed');
-    record = await this.store.peekRecord('kv/metadata', this.id);
-    assert.strictEqual(record, null, 'record is no longer in store');
-  });
-});
diff --git a/ui/tests/unit/adapters/ldap/config-test.js b/ui/tests/unit/adapters/ldap/config-test.js
index 7a37a17eb4c..25379f17387 100644
--- a/ui/tests/unit/adapters/ldap/config-test.js
+++ b/ui/tests/unit/adapters/ldap/config-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/ldap/library-test.js b/ui/tests/unit/adapters/ldap/library-test.js
index f98b1be59ca..283ddf9887c 100644
--- a/ui/tests/unit/adapters/ldap/library-test.js
+++ b/ui/tests/unit/adapters/ldap/library-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/ldap/role-test.js b/ui/tests/unit/adapters/ldap/role-test.js
index cb8c50dc4e4..6882eb1cd59 100644
--- a/ui/tests/unit/adapters/ldap/role-test.js
+++ b/ui/tests/unit/adapters/ldap/role-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -8,6 +8,7 @@ import { setupTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { Response } from 'miragejs';
 import sinon from 'sinon';
+import { ldapRoleID } from 'vault/adapters/ldap/role';
 
 module('Unit | Adapter | ldap/role', function (hooks) {
   setupTest(hooks);
@@ -17,233 +18,310 @@ module('Unit | Adapter | ldap/role', function (hooks) {
     this.store = this.owner.lookup('service:store');
     this.adapter = this.store.adapterFor('ldap/role');
     this.path = 'role';
-  });
-
-  test('it should make request to correct endpoints when listing records', async function (assert) {
-    assert.expect(6);
 
-    const assertRequest = (schema, req) => {
-      assert.ok(req.queryParams.list, 'list query param sent when listing roles');
-      const name = req.params.path === 'static-role' ? 'static-test' : 'dynamic-test';
-      return { data: { keys: [name] } };
+    this.getModel = (type, roleName) => {
+      const name = roleName || 'test-role';
+      this.store.pushPayload('ldap/role', {
+        modelName: 'ldap/role',
+        backend: 'ldap-test',
+        name,
+        type,
+        id: ldapRoleID(type, name),
+      });
+      return this.store.peekRecord('ldap/role', ldapRoleID(type, name));
     };
+  });
 
-    this.server.get('/ldap-test/static-role', assertRequest);
-    this.server.get('/ldap-test/role', assertRequest);
+  module('happy paths', function () {
+    test('it should make request to correct endpoints when listing records', async function (assert) {
+      assert.expect(6);
 
-    this.models = await this.store.query('ldap/role', { backend: 'ldap-test' });
+      const assertRequest = (schema, req) => {
+        assert.ok(req.queryParams.list, 'list query param sent when listing roles');
+        const name = req.url.includes('static-role') ? 'static-test' : 'dynamic-test';
+        return { data: { keys: [name] } };
+      };
 
-    const model = this.models[0];
-    assert.strictEqual(this.models.length, 2, 'Returns responses from both endpoints');
-    assert.strictEqual(model.backend, 'ldap-test', 'Backend value is set on records returned from query');
-    // sorted alphabetically by name so dynamic should be first
-    assert.strictEqual(model.type, 'dynamic', 'Type value is set on records returned from query');
-    assert.strictEqual(model.name, 'dynamic-test', 'Name value is set on records returned from query');
-  });
+      this.server.get('/ldap-test/static-role', assertRequest);
+      this.server.get('/ldap-test/role', assertRequest);
 
-  test('it should conditionally trigger info level flash message for single endpoint error from query', async function (assert) {
-    const flashMessages = this.owner.lookup('service:flashMessages');
-    const flashSpy = sinon.spy(flashMessages, 'info');
+      this.models = await this.store.query('ldap/role', { backend: 'ldap-test' });
 
-    this.server.get('/ldap-test/static-role', () => {
-      return new Response(403, {}, { errors: ['permission denied'] });
+      const model = this.models[0];
+      assert.strictEqual(this.models.length, 2, 'Returns responses from both endpoints');
+      assert.strictEqual(model.backend, 'ldap-test', 'Backend value is set on records returned from query');
+      // sorted alphabetically by name so dynamic should be first
+      assert.strictEqual(model.type, 'dynamic', 'Type value is set on records returned from query');
+      assert.strictEqual(model.name, 'dynamic-test', 'Name value is set on records returned from query');
     });
-    this.server.get('/ldap-test/role', () => ({ data: { keys: ['dynamic-test'] } }));
-
-    await this.store.query('ldap/role', { backend: 'ldap-test' });
-    await this.store.query(
-      'ldap/role',
-      { backend: 'ldap-test' },
-      { adapterOptions: { showPartialError: true } }
-    );
-
-    assert.true(
-      flashSpy.calledOnceWith('Error fetching roles from /v1/ldap-test/static-role: permission denied'),
-      'Partial error info only displays when adapter option is passed'
-    );
-  });
 
-  test('it should throw error for query when requests to both endpoints fail', async function (assert) {
-    assert.expect(2);
+    test('it should conditionally trigger info level flash message for single endpoint error from query', async function (assert) {
+      const flashMessages = this.owner.lookup('service:flashMessages');
+      const flashSpy = sinon.spy(flashMessages, 'info');
 
-    this.server.get('/ldap-test/:path', (schema, req) => {
-      const errors = {
-        'static-role': ['permission denied'],
-        role: ['server error'],
-      }[req.params.path];
-      return new Response(req.params.path === 'static-role' ? 403 : 500, {}, { errors });
-    });
+      this.server.get('/ldap-test/static-role', () => {
+        return new Response(403, {}, { errors: ['permission denied'] });
+      });
+      this.server.get('/ldap-test/role', () => ({ data: { keys: ['dynamic-test'] } }));
 
-    try {
       await this.store.query('ldap/role', { backend: 'ldap-test' });
-    } catch (error) {
-      assert.deepEqual(
-        error.errors,
-        ['/v1/ldap-test/static-role: permission denied', '/v1/ldap-test/role: server error'],
-        'Error messages is thrown with correct payload from query.'
-      );
-      assert.strictEqual(
-        error.message,
-        'Error fetching roles:',
-        'Error message is thrown with correct payload from query.'
+      await this.store.query(
+        'ldap/role',
+        { backend: 'ldap-test' },
+        { adapterOptions: { showPartialError: true } }
       );
-    }
-  });
 
-  test('it should make request to correct endpoints when querying record', async function (assert) {
-    assert.expect(5);
-
-    this.server.get('/ldap-test/:path/test-role', (schema, req) => {
-      assert.strictEqual(
-        req.params.path,
-        this.path,
-        'GET request made to correct endpoint when querying record'
+      assert.true(
+        flashSpy.calledOnceWith('Error fetching roles from /v1/ldap-test/static-role: permission denied'),
+        'Partial error info only displays when adapter option is passed'
       );
     });
 
-    for (const type of ['dynamic', 'static']) {
-      this.model = await this.store.queryRecord('ldap/role', {
-        backend: 'ldap-test',
-        type,
-        name: 'test-role',
+    test('it should throw error for query when requests to both endpoints fail', async function (assert) {
+      assert.expect(2);
+
+      this.server.get('/ldap-test/:path', (schema, req) => {
+        const errors = {
+          'static-role': ['permission denied'],
+          role: ['server error'],
+        }[req.params.path];
+        return new Response(req.params.path === 'static-role' ? 403 : 500, {}, { errors });
       });
-      this.path = 'static-role';
-    }
 
-    assert.strictEqual(
-      this.model.backend,
-      'ldap-test',
-      'Backend value is set on records returned from query'
-    );
-    assert.strictEqual(this.model.type, 'static', 'Type value is set on records returned from query');
-    assert.strictEqual(this.model.name, 'test-role', 'Name value is set on records returned from query');
-  });
+      try {
+        await this.store.query('ldap/role', { backend: 'ldap-test' });
+      } catch (error) {
+        assert.deepEqual(
+          error.errors,
+          ['/v1/ldap-test/static-role: permission denied', '/v1/ldap-test/role: server error'],
+          'Error messages is thrown with correct payload from query.'
+        );
+        assert.strictEqual(
+          error.message,
+          'Error fetching roles:',
+          'Error message is thrown with correct payload from query.'
+        );
+      }
+    });
+
+    test('it should make request to correct endpoints when querying record', async function (assert) {
+      assert.expect(5);
 
-  test('it should make request to correct endpoints when creating new dynamic role record', async function (assert) {
-    assert.expect(1);
+      this.server.get('/ldap-test/:path/test-role', (schema, req) => {
+        assert.strictEqual(
+          req.params.path,
+          this.path,
+          'GET request made to correct endpoint when querying record'
+        );
+      });
+
+      for (const type of ['dynamic', 'static']) {
+        this.model = await this.store.queryRecord('ldap/role', {
+          backend: 'ldap-test',
+          type,
+          name: 'test-role',
+        });
+        this.path = 'static-role';
+      }
 
-    this.server.post('/ldap-test/:path/:name', (schema, req) => {
       assert.strictEqual(
-        req.params.path,
-        this.path,
-        'POST request made to correct endpoint when creating new record for a dynamic role'
+        this.model.backend,
+        'ldap-test',
+        'Backend value is set on records returned from query'
       );
+      assert.strictEqual(this.model.type, 'static', 'Type value is set on records returned from query');
+      assert.strictEqual(this.model.name, 'test-role', 'Name value is set on records returned from query');
     });
 
-    const getModel = (type, name) => {
-      return this.store.createRecord('ldap/role', {
-        backend: 'ldap-test',
-        name,
-        type,
-      });
-    };
+    test('it should make request to correct endpoints when creating new dynamic role record', async function (assert) {
+      assert.expect(1);
 
-    const model = getModel('dynamic-role', 'dynamic-role-name');
-    await model.save();
-  });
+      this.server.post('/ldap-test/:path/:name', (schema, req) => {
+        assert.strictEqual(
+          req.params.path,
+          this.path,
+          'POST request made to correct endpoint when creating new record for a dynamic role'
+        );
+      });
 
-  test('it should make request to correct endpoints when creating new static role record', async function (assert) {
-    assert.expect(1);
+      const getModel = (type, name) => {
+        return this.store.createRecord('ldap/role', {
+          backend: 'ldap-test',
+          name,
+          type,
+        });
+      };
 
-    this.server.post('/ldap-test/:path/:name', (schema, req) => {
-      assert.strictEqual(
-        req.params.path,
-        this.path,
-        'POST request made to correct endpoint when creating new record for a static role'
-      );
+      const model = getModel('dynamic-role', 'dynamic-role-name');
+      await model.save();
     });
 
-    const getModel = (type, name) => {
-      return this.store.createRecord('ldap/role', {
-        backend: 'ldap-test',
-        name,
-        type,
+    test('it should make request to correct endpoints when creating new static role record', async function (assert) {
+      assert.expect(1);
+
+      this.server.post('/ldap-test/:path/:name', (schema, req) => {
+        assert.strictEqual(
+          req.params.path,
+          this.path,
+          'POST request made to correct endpoint when creating new record for a static role'
+        );
       });
-    };
 
-    const model = getModel('static-role', 'static-role-name');
-    await model.save();
-  });
+      const getModel = (type, name) => {
+        return this.store.createRecord('ldap/role', {
+          backend: 'ldap-test',
+          name,
+          type,
+        });
+      };
 
-  test('it should make request to correct endpoints when updating record', async function (assert) {
-    assert.expect(2);
+      const model = getModel('static-role', 'static-role-name');
+      await model.save();
+    });
 
-    this.server.post('/ldap-test/:path/test-role', (schema, req) => {
-      assert.strictEqual(
-        req.params.path,
-        this.path,
-        'POST request made to correct endpoint when updating record'
-      );
+    test('it should make request to correct endpoints when updating record', async function (assert) {
+      assert.expect(2);
+
+      this.server.post('/ldap-test/:path/test-role', (schema, req) => {
+        assert.strictEqual(
+          req.params.path,
+          this.path,
+          'POST request made to correct endpoint when updating record'
+        );
+      });
+
+      for (const type of ['dynamic', 'static']) {
+        const record = this.getModel(type);
+        await record.save();
+        this.path = 'static-role';
+      }
     });
 
-    this.store.pushPayload('ldap/role', {
-      modelName: 'ldap/role',
-      backend: 'ldap-test',
-      name: 'test-role',
+    test('it should make request to correct endpoints when deleting record', async function (assert) {
+      assert.expect(2);
+
+      this.server.delete('/ldap-test/:path/test-role', (schema, req) => {
+        assert.strictEqual(
+          req.params.path,
+          this.path,
+          'DELETE request made to correct endpoint when deleting record'
+        );
+      });
+
+      for (const type of ['dynamic', 'static']) {
+        const record = this.getModel(type);
+        await record.destroyRecord();
+        this.path = 'static-role';
+      }
     });
-    const record = this.store.peekRecord('ldap/role', 'test-role');
 
-    for (const type of ['dynamic', 'static']) {
-      record.type = type;
-      await record.save();
-      this.path = 'static-role';
-    }
-  });
+    test('it should make request to correct endpoints when fetching credentials', async function (assert) {
+      assert.expect(2);
 
-  test('it should make request to correct endpoints when deleting record', async function (assert) {
-    assert.expect(2);
+      this.path = 'creds';
 
-    this.server.delete('/ldap-test/:path/test-role', (schema, req) => {
-      assert.strictEqual(
-        req.params.path,
-        this.path,
-        'DELETE request made to correct endpoint when deleting record'
-      );
+      this.server.get('/ldap-test/:path/test-role', (schema, req) => {
+        assert.strictEqual(
+          req.params.path,
+          this.path,
+          'GET request made to correct endpoint when fetching credentials'
+        );
+      });
+
+      for (const type of ['dynamic', 'static']) {
+        await this.adapter.fetchCredentials('ldap-test', type, 'test-role');
+        this.path = 'static-cred';
+      }
     });
 
-    const getModel = () => {
-      this.store.pushPayload('ldap/role', {
-        modelName: 'ldap/role',
-        backend: 'ldap-test',
-        name: 'test-role',
+    test('it should make request to correct endpoint when rotating static role password', async function (assert) {
+      assert.expect(1);
+
+      this.server.post('/ldap-test/rotate-role/test-role', () => {
+        assert.ok('GET request made to correct endpoint when rotating static role password');
       });
-      return this.store.peekRecord('ldap/role', 'test-role');
-    };
 
-    for (const type of ['dynamic', 'static']) {
-      const record = getModel();
-      record.type = type;
-      await record.destroyRecord();
-      this.path = 'static-role';
-    }
+      await this.adapter.rotateStaticPassword('ldap-test', 'test-role');
+    });
   });
 
-  test('it should make request to correct endpoints when fetching credentials', async function (assert) {
-    assert.expect(2);
+  module('hierarchical paths', function () {
+    test('it should make request to correct endpoint when listing hierarchical records', async function (assert) {
+      assert.expect(2);
 
-    this.path = 'creds';
+      const staticAncestry = { path_to_role: 'static-admin/', type: 'static' };
+      const dynamicAncestry = { path_to_role: 'dynamic-admin/', type: 'dynamic' };
 
-    this.server.get('/ldap-test/:path/test-role', (schema, req) => {
-      assert.strictEqual(
-        req.params.path,
-        this.path,
-        'GET request made to correct endpoint when fetching credentials'
+      this.server.get(`/ldap-test/static-role/${staticAncestry.path_to_role}`, (schema, req) => {
+        assert.strictEqual(
+          req.queryParams.list,
+          'true',
+          `query request lists roles of type: ${staticAncestry.type}`
+        );
+        return { data: { keys: ['my-static-role'] } };
+      });
+      this.server.get(`/ldap-test/role/${dynamicAncestry.path_to_role}`, (schema, req) => {
+        assert.strictEqual(
+          req.queryParams.list,
+          'true',
+          `query request lists roles of type: ${dynamicAncestry.type}`
+        );
+        return { data: { keys: ['my-dynamic-role'] } };
+      });
+
+      await this.store.query(
+        'ldap/role',
+        { backend: 'ldap-test' },
+        { adapterOptions: { roleAncestry: staticAncestry } }
+      );
+      await this.store.query(
+        'ldap/role',
+        { backend: 'ldap-test' },
+        { adapterOptions: { roleAncestry: dynamicAncestry } }
       );
     });
 
     for (const type of ['dynamic', 'static']) {
-      await this.adapter.fetchCredentials('ldap-test', type, 'test-role');
-      this.path = 'static-cred';
+      test(`it should make request to correct endpoint when deleting a role for type: ${type}`, async function (assert) {
+        assert.expect(1);
+
+        const url =
+          type === 'static'
+            ? '/ldap-test/static-role/admin/my-static-role'
+            : '/ldap-test/role/admin/my-dynamic-role';
+
+        this.server.delete(url, () => {
+          assert.true(true, `DELETE request made to delete hierarchical role of type: ${type}`);
+        });
+
+        const record = this.getModel(type, `admin/my-${type}-role`);
+        await record.destroyRecord();
+      });
+
+      test(`it should make request to correct endpoints when fetching credentials for type: ${type}`, async function (assert) {
+        assert.expect(1);
+
+        const url =
+          type === 'static'
+            ? '/ldap-test/static-cred/admin/my-static-role'
+            : '/ldap-test/creds/admin/my-dynamic-role';
+
+        this.server.get(url, () => {
+          assert.true(true, `request made to fetch credentials for role type: ${type}`);
+        });
+
+        await this.adapter.fetchCredentials('ldap-test', type, `admin/my-${type}-role`);
+      });
     }
-  });
 
-  test('it should make request to correct endpoint when rotating static role password', async function (assert) {
-    assert.expect(1);
+    test('it should make request to correct endpoint when rotating static role password', async function (assert) {
+      assert.expect(1);
 
-    this.server.post('/ldap-test/rotate-role/test-role', () => {
-      assert.ok('GET request made to correct endpoint when rotating static role password');
-    });
+      this.server.post('/ldap-test/rotate-role/admin/test-role', () => {
+        assert.ok('GET request made to correct endpoint when rotating static role password');
+      });
 
-    await this.adapter.rotateStaticPassword('ldap-test', 'test-role');
+      await this.adapter.rotateStaticPassword('ldap-test', 'admin/test-role');
+    });
   });
 });
diff --git a/ui/tests/unit/adapters/oidc/assignment-test.js b/ui/tests/unit/adapters/oidc/assignment-test.js
index d898ac55c45..e20b0ab5dc3 100644
--- a/ui/tests/unit/adapters/oidc/assignment-test.js
+++ b/ui/tests/unit/adapters/oidc/assignment-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/oidc/client-test.js b/ui/tests/unit/adapters/oidc/client-test.js
index 98b2c077d18..d5decc0ab0e 100644
--- a/ui/tests/unit/adapters/oidc/client-test.js
+++ b/ui/tests/unit/adapters/oidc/client-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/oidc/key-test.js b/ui/tests/unit/adapters/oidc/key-test.js
index c472a7e9b21..1d5f0168dd2 100644
--- a/ui/tests/unit/adapters/oidc/key-test.js
+++ b/ui/tests/unit/adapters/oidc/key-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/oidc/provider-test.js b/ui/tests/unit/adapters/oidc/provider-test.js
index 8f447a668f5..bd5cf962c8e 100644
--- a/ui/tests/unit/adapters/oidc/provider-test.js
+++ b/ui/tests/unit/adapters/oidc/provider-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/oidc/scope-test.js b/ui/tests/unit/adapters/oidc/scope-test.js
index ecd25bc2033..f7dcac40079 100644
--- a/ui/tests/unit/adapters/oidc/scope-test.js
+++ b/ui/tests/unit/adapters/oidc/scope-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/oidc/test-helper.js b/ui/tests/unit/adapters/oidc/test-helper.js
index 87452faa7aa..492128e0c94 100644
--- a/ui/tests/unit/adapters/oidc/test-helper.js
+++ b/ui/tests/unit/adapters/oidc/test-helper.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/permissions-test.js b/ui/tests/unit/adapters/permissions-test.js
index d10230d4a6b..96b35edac4d 100644
--- a/ui/tests/unit/adapters/permissions-test.js
+++ b/ui/tests/unit/adapters/permissions-test.js
@@ -1,11 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
 import { setupMirage } from 'ember-cli-mirage/test-support';
+import { RESULTANT_ACL_PATH } from 'vault/services/permissions';
 
 module('Unit | Adapter | permissions', function (hooks) {
   setupTest(hooks);
@@ -21,7 +22,7 @@ module('Unit | Adapter | permissions', function (hooks) {
     auth.set('tokens', ['vault-_root_☃1']);
     auth.setTokenData('vault-_root_☃1', { userRootNamespace: 'admin/bar', backend: { mountPath: 'token' } });
 
-    this.server.get('/sys/internal/ui/resultant-acl', (schema, request) => {
+    this.server.get(`${RESULTANT_ACL_PATH}`, (schema, request) => {
       assert.strictEqual(
         request.requestHeaders['X-Vault-Namespace'],
         'admin/bar',
@@ -36,4 +37,29 @@ module('Unit | Adapter | permissions', function (hooks) {
     });
     await adapter.query();
   });
+  test('it calls resultant-acl with the users root namespace when root', async function (assert) {
+    assert.expect(1);
+    const adapter = this.owner.lookup('adapter:permissions');
+    const nsService = this.owner.lookup('service:namespace');
+    const auth = this.owner.lookup('service:auth');
+    nsService.setNamespace('admin');
+    auth.setCluster('1');
+    auth.set('tokens', ['vault-_root_☃1']);
+    auth.setTokenData('vault-_root_☃1', { userRootNamespace: '', backend: { mountPath: 'token' } });
+
+    this.server.get(`${RESULTANT_ACL_PATH}`, (schema, request) => {
+      assert.false(
+        Object.keys(request.requestHeaders).includes('X-Vault-Namespace'),
+        'request is called without namespace'
+      );
+
+      return {
+        data: {
+          exact_paths: {},
+          glob_paths: {},
+        },
+      };
+    });
+    await adapter.query();
+  });
 });
diff --git a/ui/tests/unit/adapters/pki/action-test.js b/ui/tests/unit/adapters/pki/action-test.js
index f08f13ff11a..eb7f06136dd 100644
--- a/ui/tests/unit/adapters/pki/action-test.js
+++ b/ui/tests/unit/adapters/pki/action-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,7 +7,9 @@ import { module, test } from 'qunit';
 import { setupTest } from 'vault/tests/helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
 import { allowAllCapabilitiesStub } from 'vault/tests/helpers/stubs';
-import { rootPem } from 'vault/tests/helpers/pki/values';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
+
+const { rootPem } = CERTIFICATES;
 
 module('Unit | Adapter | pki/action', function (hooks) {
   setupTest(hooks);
diff --git a/ui/tests/unit/adapters/pki/certificate/base-test.js b/ui/tests/unit/adapters/pki/certificate/base-test.js
index c5edba37341..191ad09138b 100644
--- a/ui/tests/unit/adapters/pki/certificate/base-test.js
+++ b/ui/tests/unit/adapters/pki/certificate/base-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/pki/certificate/generate-test.js b/ui/tests/unit/adapters/pki/certificate/generate-test.js
index 7fa97bee42c..fed65d1c710 100644
--- a/ui/tests/unit/adapters/pki/certificate/generate-test.js
+++ b/ui/tests/unit/adapters/pki/certificate/generate-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/pki/certificate/sign-test.js b/ui/tests/unit/adapters/pki/certificate/sign-test.js
index 02cbf0ca574..15efd48dbc1 100644
--- a/ui/tests/unit/adapters/pki/certificate/sign-test.js
+++ b/ui/tests/unit/adapters/pki/certificate/sign-test.js
@@ -1,13 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'vault/tests/helpers';
 import { setupMirage } from 'ember-cli-mirage/test-support';
-import { csr2 } from 'vault/tests/helpers/pki/values';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
 
+const { csr2 } = CERTIFICATES;
 module('Unit | Adapter | pki/certificate/sign', function (hooks) {
   setupTest(hooks);
   setupMirage(hooks);
diff --git a/ui/tests/unit/adapters/pki/config-test.js b/ui/tests/unit/adapters/pki/config-test.js
index 9be9dfdcc01..580d5ab6e1a 100644
--- a/ui/tests/unit/adapters/pki/config-test.js
+++ b/ui/tests/unit/adapters/pki/config-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/pki/key-test.js b/ui/tests/unit/adapters/pki/key-test.js
index 7fd5ae73d0a..5960ca9cb7d 100644
--- a/ui/tests/unit/adapters/pki/key-test.js
+++ b/ui/tests/unit/adapters/pki/key-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/pki/role-test.js b/ui/tests/unit/adapters/pki/role-test.js
index 3781ee42c49..70fdcddad09 100644
--- a/ui/tests/unit/adapters/pki/role-test.js
+++ b/ui/tests/unit/adapters/pki/role-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/pki/sign-intermediate-test.js b/ui/tests/unit/adapters/pki/sign-intermediate-test.js
index 6eefa3ad53a..b32e2491369 100644
--- a/ui/tests/unit/adapters/pki/sign-intermediate-test.js
+++ b/ui/tests/unit/adapters/pki/sign-intermediate-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/pki/tidy-test.js b/ui/tests/unit/adapters/pki/tidy-test.js
index 0cba31f1d12..3f593986318 100644
--- a/ui/tests/unit/adapters/pki/tidy-test.js
+++ b/ui/tests/unit/adapters/pki/tidy-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/secret-engine-test.js b/ui/tests/unit/adapters/secret-engine-test.js
index 38288d5847c..a20b58c76fa 100644
--- a/ui/tests/unit/adapters/secret-engine-test.js
+++ b/ui/tests/unit/adapters/secret-engine-test.js
@@ -1,22 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
-import apiStub from 'vault/tests/helpers/noop-all-api-requests';
+import { setupMirage } from 'ember-cli-mirage/test-support';
 
 module('Unit | Adapter | secret engine', function (hooks) {
   setupTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.server = apiStub();
-  });
-
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
+  setupMirage(hooks);
 
   const storeStub = {
     serializerFor() {
@@ -29,46 +22,120 @@ module('Unit | Adapter | secret engine', function (hooks) {
     modelName: 'secret-engine',
   };
 
-  const cases = [
-    {
-      description: 'Empty query',
-      adapterMethod: 'query',
-      args: [storeStub, type, {}],
-      url: '/v1/sys/internal/ui/mounts',
-      method: 'GET',
-    },
-    {
-      description: 'Query with a path',
-      adapterMethod: 'query',
-      args: [storeStub, type, { path: 'foo' }],
-      url: '/v1/sys/internal/ui/mounts/foo',
-      method: 'GET',
-    },
+  test('Empty query', function (assert) {
+    assert.expect(1);
+    this.server.get('/sys/internal/ui/mounts', () => {
+      assert.ok('query calls the correct url');
+      return {};
+    });
+    const adapter = this.owner.lookup('adapter:secret-engine');
+    adapter['query'](storeStub, type, {});
+  });
+  test('Query with a path', function (assert) {
+    assert.expect(1);
+    this.server.get('/sys/internal/ui/mounts/foo', () => {
+      assert.ok('query calls the correct url');
+      return {};
+    });
+    const adapter = this.owner.lookup('adapter:secret-engine');
+    adapter['query'](storeStub, type, { path: 'foo' });
+  });
 
-    {
-      description: 'Query with nested path',
-      adapterMethod: 'query',
-      args: [storeStub, type, { path: 'foo/bar/baz' }],
-      url: '/v1/sys/internal/ui/mounts/foo/bar/baz',
-      method: 'GET',
-    },
-  ];
-  cases.forEach((testCase) => {
-    test(`secret-engine: ${testCase.description}`, function (assert) {
-      assert.expect(2);
-      const adapter = this.owner.lookup('adapter:secret-engine');
-      adapter[testCase.adapterMethod](...testCase.args);
-      const { url, method } = this.server.handledRequests[0];
-      assert.strictEqual(
-        url,
-        testCase.url,
-        `${testCase.adapterMethod} calls the correct url: ${testCase.url}`
-      );
-      assert.strictEqual(
-        method,
-        testCase.method,
-        `${testCase.adapterMethod} uses the correct http verb: ${testCase.method}`
-      );
+  test('Query with nested path', function (assert) {
+    assert.expect(1);
+    this.server.get('/sys/internal/ui/mounts/foo/bar/baz', () => {
+      assert.ok('query calls the correct url');
+      return {};
+    });
+    const adapter = this.owner.lookup('adapter:secret-engine');
+    adapter['query'](storeStub, type, { path: 'foo/bar/baz' });
+  });
+
+  module('WIF secret engines', function (hooks) {
+    hooks.beforeEach(function () {
+      this.store = this.owner.lookup('service:store');
+    });
+
+    test('it should make request to correct endpoint when creating new record', async function (assert) {
+      assert.expect(1);
+      this.server.post('/sys/mounts/aws-wif', (schema, req) => {
+        assert.deepEqual(
+          JSON.parse(req.requestBody),
+          {
+            path: 'aws-wif',
+            type: 'aws',
+            config: { id: 'aws-wif', identity_token_key: 'test-key', listing_visibility: 'hidden' },
+          },
+          'Correct payload is sent when adding aws secret engine with identity_token_key set'
+        );
+        return {};
+      });
+      const mountData = {
+        id: 'aws-wif',
+        path: 'aws-wif',
+        type: 'aws',
+        config: this.store.createRecord('mount-config', {
+          identityTokenKey: 'test-key',
+        }),
+        uuid: 'f1739f9d-dfc0-83c8-011f-ec17103a06c2',
+      };
+      const record = this.store.createRecord('secret-engine', mountData);
+      await record.save();
+    });
+
+    test('it should not send identity_token_key if not set', async function (assert) {
+      assert.expect(1);
+      this.server.post('/sys/mounts/aws-wif', (schema, req) => {
+        assert.deepEqual(
+          JSON.parse(req.requestBody),
+          {
+            path: 'aws-wif',
+            type: 'aws',
+            config: { id: 'aws-wif', max_lease_ttl: '125h', listing_visibility: 'hidden' },
+          },
+          'Correct payload is sent when adding aws secret engine with no identity_token_key set'
+        );
+        return {};
+      });
+      const mountData = {
+        id: 'aws-wif',
+        path: 'aws-wif',
+        type: 'aws',
+        config: this.store.createRecord('mount-config', {
+          maxLeaseTtl: '125h',
+        }),
+        uuid: 'f1739f9d-dfc0-83c8-011f-ec17103a06c2',
+      };
+      const record = this.store.createRecord('secret-engine', mountData);
+      await record.save();
+    });
+
+    test('it should not send identity_token_key if set on a non-WIF secret engine', async function (assert) {
+      assert.expect(1);
+      this.server.post('/sys/mounts/cubbyhole-test', (schema, req) => {
+        assert.deepEqual(
+          JSON.parse(req.requestBody),
+          {
+            path: 'cubbyhole-test',
+            type: 'cubbyhole',
+            config: { id: 'cubbyhole-test', max_lease_ttl: '125h', listing_visibility: 'hidden' },
+          },
+          'Correct payload is sent when sending a non-wif secret engine with identity_token_key accidentally set'
+        );
+        return {};
+      });
+      const mountData = {
+        id: 'cubbyhole-test',
+        path: 'cubbyhole-test',
+        type: 'cubbyhole',
+        config: this.store.createRecord('mount-config', {
+          maxLeaseTtl: '125h',
+          identity_token_key: 'test-key',
+        }),
+        uuid: 'f1739f9d-dfc0-83c8-011f-ec17103a06c4',
+      };
+      const record = this.store.createRecord('secret-engine', mountData);
+      await record.save();
     });
   });
 });
diff --git a/ui/tests/unit/adapters/secret-test.js b/ui/tests/unit/adapters/secret-test.js
index fa6ec0c3971..d2976256d9f 100644
--- a/ui/tests/unit/adapters/secret-test.js
+++ b/ui/tests/unit/adapters/secret-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/sync/associations-test.js b/ui/tests/unit/adapters/sync/associations-test.js
index 61f4bd47c57..7bcb25129ae 100644
--- a/ui/tests/unit/adapters/sync/associations-test.js
+++ b/ui/tests/unit/adapters/sync/associations-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,6 +15,7 @@ module('Unit | Adapter | sync | association', function (hooks) {
 
   hooks.beforeEach(function () {
     this.store = this.owner.lookup('service:store');
+    this.pagination = this.owner.lookup('service:pagination');
 
     this.params = [
       { type: 'aws-sm', name: 'us-west-1' },
@@ -50,7 +51,7 @@ module('Unit | Adapter | sync | association', function (hooks) {
       return associationsResponse(schema, req);
     });
 
-    await this.store.lazyPaginatedQuery('sync/association', {
+    await this.pagination.lazyPaginatedQuery('sync/association', {
       responsePath: 'data.keys',
       page: 1,
       destinationType: 'aws-sm',
diff --git a/ui/tests/unit/adapters/sync/destinations-test.js b/ui/tests/unit/adapters/sync/destinations-test.js
index 2f6af4421c3..10cea3164b7 100644
--- a/ui/tests/unit/adapters/sync/destinations-test.js
+++ b/ui/tests/unit/adapters/sync/destinations-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/tools-test.js b/ui/tests/unit/adapters/tools-test.js
deleted file mode 100644
index 9a728102647..00000000000
--- a/ui/tests/unit/adapters/tools-test.js
+++ /dev/null
@@ -1,63 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { resolve } from 'rsvp';
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-
-module('Unit | Adapter | tools', function (hooks) {
-  setupTest(hooks);
-
-  test('wrapping api urls', function (assert) {
-    let url, method, options;
-    const adapter = this.owner.factoryFor('adapter:tools').create({
-      ajax: (...args) => {
-        [url, method, options] = args;
-        return resolve();
-      },
-    });
-
-    let clientToken;
-    let data = { foo: 'bar' };
-    adapter.toolAction('wrap', data, { wrapTTL: '30m' });
-    assert.strictEqual(url, '/v1/sys/wrapping/wrap', 'wrapping:wrap url OK');
-    assert.strictEqual(method, 'POST', 'wrapping:wrap method OK');
-    assert.deepEqual({ data: data, wrapTTL: '30m', clientToken }, options, 'wrapping:wrap options OK');
-
-    data = { token: 'token' };
-    adapter.toolAction('lookup', data);
-    assert.strictEqual(url, '/v1/sys/wrapping/lookup', 'wrapping:lookup url OK');
-    assert.strictEqual(method, 'POST', 'wrapping:lookup method OK');
-    assert.deepEqual({ data, clientToken }, options, 'wrapping:lookup options OK');
-
-    adapter.toolAction('unwrap', data);
-    assert.strictEqual(url, '/v1/sys/wrapping/unwrap', 'wrapping:unwrap url OK');
-    assert.strictEqual(method, 'POST', 'wrapping:unwrap method OK');
-    assert.deepEqual({ data, clientToken }, options, 'wrapping:unwrap options OK');
-
-    adapter.toolAction('rewrap', data);
-    assert.strictEqual(url, '/v1/sys/wrapping/rewrap', 'wrapping:rewrap url OK');
-    assert.strictEqual(method, 'POST', 'wrapping:rewrap method OK');
-    assert.deepEqual({ data, clientToken }, options, 'wrapping:rewrap options OK');
-  });
-
-  test('tools api urls', function (assert) {
-    let url, method;
-    const adapter = this.owner.factoryFor('adapter:tools').create({
-      ajax: (...args) => {
-        [url, method] = args;
-        return resolve();
-      },
-    });
-
-    adapter.toolAction('hash', { input: 'someBase64' });
-    assert.strictEqual(url, '/v1/sys/tools/hash', 'sys tools hash: url OK');
-    assert.strictEqual(method, 'POST', 'sys tools hash: method OK');
-
-    adapter.toolAction('random', { bytes: '32' });
-    assert.strictEqual(url, '/v1/sys/tools/random', 'sys tools random: url OK');
-    assert.strictEqual(method, 'POST', 'sys tools random: method OK');
-  });
-});
diff --git a/ui/tests/unit/adapters/transform-test.js b/ui/tests/unit/adapters/transform-test.js
index eea263af13a..1e536d4737b 100644
--- a/ui/tests/unit/adapters/transform-test.js
+++ b/ui/tests/unit/adapters/transform-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/adapters/transit-key-test.js b/ui/tests/unit/adapters/transit-key-test.js
index 719b4993e25..8347eb28673 100644
--- a/ui/tests/unit/adapters/transit-key-test.js
+++ b/ui/tests/unit/adapters/transit-key-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/components/auth-form-test.js b/ui/tests/unit/components/auth-form-test.js
deleted file mode 100644
index 81113101aa3..00000000000
--- a/ui/tests/unit/components/auth-form-test.js
+++ /dev/null
@@ -1,48 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-import { settled } from '@ember/test-helpers';
-
-module('Unit | Component | auth-form', function (hooks) {
-  setupTest(hooks);
-
-  test('it should use token for oidc and jwt auth method types when processing form submit', async function (assert) {
-    assert.expect(4);
-
-    const component = this.owner.lookup('component:auth-form');
-    component.reopen({
-      methods: [], // eslint-disable-line
-      // eslint-disable-next-line
-      authenticate: {
-        unlinked() {
-          return {
-            perform(type, data) {
-              assert.deepEqual(
-                type,
-                'token',
-                `Token type correctly passed to authenticate method for ${component.providerName}`
-              );
-              assert.deepEqual(
-                data,
-                { token: component.token },
-                `Token passed to authenticate method for ${component.providerName}`
-              );
-            },
-          };
-        },
-      },
-    });
-
-    const event = new Event('submit');
-
-    for (const type of ['oidc', 'jwt']) {
-      component.set('selectedAuth', type);
-      await settled();
-      await component.actions.doSubmit.apply(component, [undefined, event, 'foo-bar']);
-    }
-  });
-});
diff --git a/ui/tests/unit/components/auth-jwt-test.js b/ui/tests/unit/components/auth-jwt-test.js
deleted file mode 100644
index d4c3b0d0667..00000000000
--- a/ui/tests/unit/components/auth-jwt-test.js
+++ /dev/null
@@ -1,76 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-import EmberObject from '@ember/object';
-import Evented from '@ember/object/evented';
-import sinon from 'sinon';
-import { _cancelTimers as cancelTimers } from '@ember/runloop';
-
-const mockWindow = EmberObject.extend(Evented, {
-  origin: 'http://localhost:4200',
-  close: () => {},
-});
-
-module('Unit | Component | auth-jwt', function (hooks) {
-  setupTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.component = this.owner.lookup('component:auth-jwt');
-    this.component.set('window', mockWindow.create());
-    this.errorSpy = sinon.spy(this.component, 'handleOIDCError');
-  });
-
-  test('it should ignore messages from cross origin windows while waiting for oidc callback', async function (assert) {
-    assert.expect(2);
-    this.component.prepareForOIDC.perform(mockWindow.create());
-    this.component.window.trigger('message', { origin: 'http://anotherdomain.com', isTrusted: true });
-
-    assert.ok(this.errorSpy.notCalled, 'Error handler not triggered while waiting for oidc callback message');
-    assert.strictEqual(this.component.exchangeOIDC.performCount, 0, 'exchangeOIDC method not fired');
-    cancelTimers();
-  });
-
-  test('it should ignore untrusted messages while waiting for oidc callback', async function (assert) {
-    assert.expect(2);
-    this.component.prepareForOIDC.perform(mockWindow.create());
-    this.component.window.trigger('message', { origin: 'http://localhost:4200', isTrusted: false });
-    assert.ok(this.errorSpy.notCalled, 'Error handler not triggered while waiting for oidc callback message');
-    assert.strictEqual(this.component.exchangeOIDC.performCount, 0, 'exchangeOIDC method not fired');
-    cancelTimers();
-  });
-
-  // TODO: Flaky
-  // test case for https://github.com/hashicorp/vault/issues/12436
-  test('it should ignore messages sent from outside the app while waiting for oidc callback', async function (assert) {
-    assert.expect(2);
-    this.component.prepareForOIDC.perform(mockWindow.create());
-    const message = {
-      origin: 'http://localhost:4200',
-      isTrusted: true,
-      data: {
-        namespace: 'foobar',
-        path: '/foo/bar',
-        state: 'authorized',
-        code: 204,
-      },
-    };
-
-    this.component.window.trigger('message', message);
-    message.data.source = 'foo-bar';
-    this.component.window.trigger('message', message);
-    message.data.source = 'oidc-callback';
-    this.component.window.trigger('message', message);
-
-    assert.ok(this.errorSpy.notCalled, 'Error handler not triggered while waiting for oidc callback message');
-    assert.strictEqual(
-      this.component.exchangeOIDC.performCount,
-      1,
-      'exchangeOIDC method fires when oidc callback message is received'
-    );
-    cancelTimers();
-  });
-});
diff --git a/ui/tests/unit/components/identity/edit-form-test.js b/ui/tests/unit/components/identity/edit-form-test.js
index 58457ccfd87..ef1203a5ca3 100644
--- a/ui/tests/unit/components/identity/edit-form-test.js
+++ b/ui/tests/unit/components/identity/edit-form-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/decorators/fetch-secrets-engine-config-test.js b/ui/tests/unit/decorators/fetch-secrets-engine-config-test.js
index 7900bcf770a..223bf8eee52 100644
--- a/ui/tests/unit/decorators/fetch-secrets-engine-config-test.js
+++ b/ui/tests/unit/decorators/fetch-secrets-engine-config-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -17,7 +17,7 @@ module('Unit | Decorators | fetch-secrets-engine-config', function (hooks) {
   setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.spy = sinon.spy(console, 'error');
+    this.spy = sinon.spy(console, 'debug');
     this.store = this.owner.lookup('service:store');
     this.backend = 'test-path';
     this.owner.lookup('service:secretMountPath').update(this.backend);
diff --git a/ui/tests/unit/decorators/model-expanded-attributes-test.js b/ui/tests/unit/decorators/model-expanded-attributes-test.js
index 26c077fe954..781265ed792 100644
--- a/ui/tests/unit/decorators/model-expanded-attributes-test.js
+++ b/ui/tests/unit/decorators/model-expanded-attributes-test.js
@@ -1,61 +1,19 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
+import { setupApplicationTest } from 'ember-qunit';
 import sinon from 'sinon';
-import Model, { attr } from '@ember-data/model';
 import { withExpandedAttributes } from 'vault/decorators/model-expanded-attributes';
 
-// create class using decorator
-const createClass = () => {
-  @withExpandedAttributes()
-  class Foo extends Model {
-    @attr('string', {
-      label: 'Foo',
-      subText: 'A form field',
-    })
-    foo;
-    @attr('boolean', {
-      label: 'Bar',
-      subText: 'Maybe a checkbox',
-    })
-    bar;
-    @attr('number', {
-      label: 'Baz',
-      subText: 'A number field',
-    })
-    baz;
-
-    get fieldGroups() {
-      return [{ default: ['baz'] }, { 'Other options': ['foo', 'bar'] }];
-    }
-  }
-  return new Foo();
-};
-
 module('Unit | Decorators | model-expanded-attributes', function (hooks) {
-  setupTest(hooks);
+  setupApplicationTest(hooks);
 
   hooks.beforeEach(function () {
+    this.store = this.owner.lookup('service:store');
     this.spy = sinon.spy(console, 'error');
-    this.fooField = {
-      name: 'foo',
-      options: { label: 'Foo', subText: 'A form field' },
-      type: 'string',
-    };
-    this.barField = {
-      name: 'bar',
-      options: { label: 'Bar', subText: 'Maybe a checkbox' },
-      type: 'boolean',
-    };
-    this.bazField = {
-      name: 'baz',
-      options: { label: 'Baz', subText: 'A number field' },
-      type: 'number',
-    };
   });
   hooks.afterEach(function () {
     this.spy.restore();
@@ -71,28 +29,70 @@ module('Unit | Decorators | model-expanded-attributes', function (hooks) {
 
   test('it adds allByKey value to model', function (assert) {
     assert.expect(1);
-    const model = createClass();
+    const model = this.store.modelFor('namespace');
     assert.deepEqual(
-      { foo: this.fooField, bar: this.barField, baz: this.bazField },
-      model.allByKey,
+      model.prototype.allByKey,
+      {
+        path: {
+          name: 'path',
+          options: {},
+          type: 'string',
+        },
+      },
       'allByKey set on Model class'
     );
   });
 
   test('_expandGroups helper works correctly', function (assert) {
-    const model = createClass();
-    const result = model._expandGroups(model.fieldGroups);
+    const model = this.store.modelFor('aws-credential');
+    const result = model.prototype._expandGroups([
+      { default: ['roleArn'] },
+      { 'Other options': ['ttl', 'leaseId'] },
+    ]);
     assert.deepEqual(result, [
-      { default: [this.bazField] },
-      { 'Other options': [this.fooField, this.barField] },
+      {
+        default: [
+          {
+            name: 'roleArn',
+            options: {
+              helpText:
+                'The ARN of the role to assume if credential_type on the Vault role is assumed_role. Optional if the role has a single role ARN; required otherwise.',
+              label: 'Role ARN',
+            },
+            type: 'string',
+          },
+        ],
+      },
+      {
+        'Other options': [
+          {
+            name: 'ttl',
+            options: {
+              defaultValue: '3600s',
+              editType: 'ttl',
+              helpText:
+                'Specifies the TTL for the use of the STS token. Valid only when credential_type is assumed_role, federation_token, or session_token.',
+              label: 'TTL',
+              setDefault: true,
+              ttlOffValue: '',
+            },
+            type: undefined,
+          },
+          {
+            name: 'leaseId',
+            options: {},
+            type: 'string',
+          },
+        ],
+      },
     ]);
   });
 
   test('_expandGroups throws assertion when incorrect inputs', function (assert) {
     assert.expect(1);
-    const model = createClass();
+    const model = this.store.modelFor('aws-credential');
     try {
-      model._expandGroups({ foo: ['bar'] });
+      model.prototype._expandGroups({ foo: ['bar'] });
     } catch (e) {
       assert.strictEqual(e.message, '_expandGroups expects an array of objects');
     }
diff --git a/ui/tests/unit/decorators/model-form-fields-test.js b/ui/tests/unit/decorators/model-form-fields-test.js
index 33073643256..c6e9c4a0d1d 100644
--- a/ui/tests/unit/decorators/model-form-fields-test.js
+++ b/ui/tests/unit/decorators/model-form-fields-test.js
@@ -1,57 +1,19 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
+import { setupApplicationTest } from 'ember-qunit';
 import { withFormFields } from 'vault/decorators/model-form-fields';
 import sinon from 'sinon';
-import Model, { attr } from '@ember-data/model';
-
-// create class using decorator
-const createClass = (propertyNames, groups) => {
-  @withFormFields(propertyNames, groups)
-  class Foo extends Model {
-    @attr('string', {
-      label: 'Foo',
-      subText: 'A form field',
-    })
-    foo;
-    @attr('boolean', {
-      label: 'Bar',
-      subText: 'Maybe a checkbox',
-    })
-    bar;
-    @attr('number', {
-      label: 'Baz',
-      subText: 'A number field',
-    })
-    baz;
-  }
-  return new Foo();
-};
 
 module('Unit | Decorators | ModelFormFields', function (hooks) {
-  setupTest(hooks);
+  setupApplicationTest(hooks);
 
   hooks.beforeEach(function () {
     this.spy = sinon.spy(console, 'error');
-    this.fooField = {
-      name: 'foo',
-      options: { label: 'Foo', subText: 'A form field' },
-      type: 'string',
-    };
-    this.barField = {
-      name: 'bar',
-      options: { label: 'Bar', subText: 'Maybe a checkbox' },
-      type: 'boolean',
-    };
-    this.bazField = {
-      name: 'baz',
-      options: { label: 'Baz', subText: 'A number field' },
-      type: 'number',
-    };
+    this.store = this.owner.lookup('service:store');
   });
   hooks.afterEach(function () {
     this.spy.restore();
@@ -65,25 +27,154 @@ module('Unit | Decorators | ModelFormFields', function (hooks) {
     assert.ok(this.spy.calledWith(message), 'Error is printed to console');
   });
 
-  test('it return allFields when arguments not provided', function (assert) {
+  test('it returns allFields when arguments not provided', function (assert) {
     assert.expect(1);
-    const model = createClass();
+    // test by instantiating a record that uses this decorator
+    const record = this.store.createRecord('totp-key');
     assert.deepEqual(
-      [this.fooField, this.barField, this.bazField],
-      model.allFields,
+      record.allFields,
+      [
+        {
+          name: 'backend',
+          options: { readOnly: true },
+          type: 'string',
+        },
+        {
+          name: 'name',
+          options: {
+            subText: 'Specifies the name for this key.',
+          },
+          type: 'string',
+        },
+        {
+          name: 'accountName',
+          options: {
+            subText: 'The name of the account associated with the key. Required for keys generated by Vault.',
+          },
+          type: 'string',
+        },
+        {
+          name: 'algorithm',
+          options: { possibleValues: ['SHA1', 'SHA256', 'SHA512'], defaultValue: 'SHA1' },
+          type: 'string',
+        },
+        {
+          name: 'digits',
+          options: { possibleValues: [6, 8], defaultValue: 6 },
+          type: 'number',
+        },
+        {
+          name: 'issuer',
+          options: {
+            subText: `The name of the key's issuing organization. Required for keys generated by Vault.`,
+          },
+          type: 'string',
+        },
+        {
+          name: 'period',
+          options: {
+            editType: 'ttl',
+            helperTextEnabled: 'How long each generated TOTP is valid.',
+            defaultValue: 30,
+          },
+          type: undefined,
+        },
+        {
+          name: 'generate',
+          options: {
+            label: 'Key Provider',
+            defaultValue: true,
+            editType: 'radio',
+            possibleValues: ['Vault', 'Other service'],
+            fieldValue: 'generateString',
+            subText: 'Specifies if the key should be generated by Vault or passed from another service.',
+          },
+          type: undefined,
+        },
+        {
+          name: 'keySize',
+          options: { defaultValue: 20 },
+          type: 'number',
+        },
+        {
+          name: 'skew',
+          options: { possibleValues: [0, 1], defaultValue: 1 },
+          type: 'number',
+        },
+        {
+          name: 'exported',
+          options: {
+            editType: 'toggleButton',
+            defaultValue: true,
+            helperTextDisabled: 'Vault will not return QR code and url upon key creation.',
+            helperTextEnabled: 'QR code and URL will be returned upon generating a key.',
+          },
+          type: 'boolean',
+        },
+        {
+          name: 'qrSize',
+          options: { label: 'QR size', defaultValue: 200 },
+          type: 'number',
+        },
+        {
+          name: 'url',
+          options: {
+            label: 'URL',
+            helpText:
+              'If a URL is provided the other fields can be left empty. E.g. otpauth://totp/Vault:test@test.com?secret=Y64VEVMBTSXCYIWRSHRNDZW62MPGVU2G&issuer=Vault',
+            subText: 'The TOTP key url string that can be used to configure a key.',
+          },
+          type: 'string',
+        },
+        {
+          name: 'key',
+          options: {
+            subText: 'The root key used to generate a TOTP code.',
+          },
+          type: 'string',
+        },
+        {
+          name: 'barcode',
+          options: { readOnly: true },
+          type: 'string',
+        },
+      ],
       'allFields set on Model class'
     );
   });
 
   test('it should set formFields prop on Model class', function (assert) {
-    const model = createClass(['foo']);
-    assert.deepEqual([this.fooField], model.formFields, 'formFields set on Model class');
+    // this model uses withFormFields
+    const record = this.store.createRecord('clients/config');
+    assert.deepEqual(
+      record.formFields,
+      [
+        {
+          name: 'enabled',
+          options: {},
+          type: 'string',
+        },
+        {
+          name: 'retentionMonths',
+          options: {
+            label: 'Retention period',
+            subText: 'The number of months of activity logs to maintain for client tracking.',
+          },
+          type: 'number',
+        },
+      ],
+      'formFields set on Model class'
+    );
   });
 
   test('it should set formFieldGroups on Model class', function (assert) {
-    const groups = [{ default: ['foo'] }, { subgroup: ['bar'] }];
-    const model = createClass(null, groups);
-    const fieldGroups = [{ default: [this.fooField] }, { subgroup: [this.barField] }];
-    assert.deepEqual(fieldGroups, model.formFieldGroups, 'formFieldGroups set on Model class');
+    // this model uses withFormFields with groups
+    const record = this.store.createRecord('ldap/config');
+    const groups = record.formFieldGroups.map((group) => Object.keys(group)[0]);
+    assert.deepEqual(
+      groups,
+      ['default', 'TLS options', 'More options'],
+      'formFieldGroups set on Model class with correct group labels'
+    );
   });
 });
diff --git a/ui/tests/unit/decorators/model-validations-test.js b/ui/tests/unit/decorators/model-validations-test.js
index 94ca73b1bda..d95b1a67a17 100644
--- a/ui/tests/unit/decorators/model-validations-test.js
+++ b/ui/tests/unit/decorators/model-validations-test.js
@@ -1,14 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
 import { withModelValidations } from 'vault/decorators/model-validations';
-import validators from 'vault/utils/validators';
 import sinon from 'sinon';
 import Model from '@ember-data/model';
+import * as validateUtil from 'vault/utils/forms/validate';
 
 // create class using decorator
 const createClass = (validations) => {
@@ -27,9 +27,10 @@ module('Unit | Decorators | ModelValidations', function (hooks) {
 
   hooks.beforeEach(function () {
     this.spy = sinon.spy(console, 'error');
+    this.validateSpy = sinon.spy(validateUtil, 'validate');
   });
   hooks.afterEach(function () {
-    this.spy.restore();
+    sinon.restore();
   });
 
   test('it should throw error when validations object is not provided', function (assert) {
@@ -42,95 +43,16 @@ module('Unit | Decorators | ModelValidations', function (hooks) {
     }
   });
 
-  test('it should log error to console when validations are not passed as array', function (assert) {
-    const validations = {
-      foo: { type: 'presence', message: 'Foo is required' },
-    };
-    const fooClass = createClass(validations);
-    fooClass.validate();
-    const message = 'Must provide validations as an array for property "foo" on bar model';
-    assert.ok(this.spy.calledWith(message));
-  });
-
-  test('it should log error for incorrect validator type', function (assert) {
-    const validations = {
-      foo: [{ type: 'bar', message: 'Foo is bar' }],
-    };
-    const fooClass = createClass(validations);
-    fooClass.validate();
-    const message = `Validator type: "bar" not found. Available validators: ${Object.keys(validators).join(
-      ', '
-    )}`;
-    assert.ok(this.spy.calledWith(message));
-  });
-
   test('it should validate', function (assert) {
     const message = 'This field is required';
     const validations = {
       foo: [{ type: 'presence', message }],
     };
     const fooClass = createClass(validations);
-    const v1 = fooClass.validate();
-    assert.false(v1.isValid, 'isValid state is correct when errors exist');
-    assert.deepEqual(
-      v1.state,
-      { foo: { isValid: false, errors: [message], warnings: [] } },
-      'Correct state returned when property is invalid'
-    );
-
-    fooClass.foo = true;
-    const v2 = fooClass.validate();
-    assert.true(v2.isValid, 'isValid state is correct when no errors exist');
-    assert.deepEqual(
-      v2.state,
-      { foo: { isValid: true, errors: [], warnings: [] } },
-      'Correct state returned when property is valid'
-    );
-  });
-
-  test('invalid form message has correct error count', function (assert) {
-    const message = 'This field is required';
-    const messageII = 'This field must be a number';
-    const validations = {
-      foo: [{ type: 'presence', message }],
-      integer: [{ type: 'number', messageII }],
-    };
-    const fooClass = createClass(validations);
-    const v1 = fooClass.validate();
-    assert.strictEqual(
-      v1.invalidFormMessage,
-      'There are 2 errors with this form.',
-      'error message says form as 2 errors'
-    );
-
-    fooClass.integer = 9;
-    const v2 = fooClass.validate();
-    assert.strictEqual(
-      v2.invalidFormMessage,
-      'There is an error with this form.',
-      'error message says form has an error'
+    fooClass.validate();
+    assert.true(
+      this.validateSpy.calledWith(fooClass, validations),
+      'validate util called with correct arguments'
     );
-
-    fooClass.foo = true;
-    const v3 = fooClass.validate();
-    assert.strictEqual(v3.invalidFormMessage, null, 'invalidFormMessage is null when form is valid');
-  });
-
-  test('it should validate warnings', function (assert) {
-    const message = 'Value contains whitespace.';
-    const validations = {
-      foo: [
-        {
-          type: 'containsWhiteSpace',
-          message,
-          level: 'warn',
-        },
-      ],
-    };
-    const fooClass = createClass(validations);
-    fooClass.foo = 'foo bar';
-    const { state, isValid } = fooClass.validate();
-    assert.true(isValid, 'Model is considered valid when there are only warnings');
-    assert.strictEqual(state.foo.warnings.join(' '), message, 'Warnings are returned');
   });
 });
diff --git a/ui/tests/unit/forms/form-test.js b/ui/tests/unit/forms/form-test.js
new file mode 100644
index 00000000000..b2db7e9d7a0
--- /dev/null
+++ b/ui/tests/unit/forms/form-test.js
@@ -0,0 +1,84 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Form from 'vault/forms/form';
+import FormField from 'vault/utils/forms/field';
+import { module, test } from 'qunit';
+
+module('Unit | forms | form', function (hooks) {
+  hooks.beforeEach(function () {
+    this.data = {
+      foo: 'bar',
+    };
+    this.options = { isNew: true };
+    this.validations = {
+      foo: [{ type: 'presence', message: 'Foo is required' }],
+    };
+  });
+
+  test('it should set data, options and validations on class', async function (assert) {
+    const form = new Form(this.data, this.options, this.validations);
+    assert.deepEqual(form.data, this.data, 'Data is set correctly');
+    assert.true(form.isNew, 'isNew is set correctly');
+    assert.deepEqual(form.validations, this.validations, 'Validations are set correctly');
+  });
+
+  test('it should shim Ember object set method', async function (assert) {
+    const form = new Form(this.data);
+    form.set('data.foo', 'baz');
+    assert.strictEqual(form.data.foo, 'baz', 'Property is updated using set method');
+  });
+
+  test('it should return data as valid without validations from toJSON method', async function (assert) {
+    const expected = { isValid: true, state: {}, invalidFormMessage: '', data: this.data };
+    const form = new Form(this.data);
+    const json = form.toJSON();
+    assert.deepEqual(json, expected, 'toJSON returns correct data and state');
+  });
+
+  test('it should validate and return data from toJSON method', async function (assert) {
+    const state = { foo: { isValid: true, errors: [], warnings: [] } };
+    const expected = { isValid: true, state, invalidFormMessage: '', data: this.data };
+
+    const form = new Form(this.data, this.options, this.validations);
+    const json = form.toJSON();
+
+    assert.deepEqual(json, expected, 'toJSON returns correct data and validation state');
+  });
+
+  test('it should allow for custom data to be passed in toJSON method', async function (assert) {
+    this.data.foo = 'string with whitespace';
+    this.validations.foo = [{ type: 'containsWhiteSpace', message: 'Whitespace is not allowed' }];
+
+    const serializedData = { foo: this.data.foo.replace(/\s/g, '_') };
+    const state = { foo: { isValid: true, errors: [], warnings: [] } };
+    const expected = { isValid: true, state, invalidFormMessage: '', data: serializedData };
+
+    const form = new Form(this.data, this.options, this.validations);
+    const json = form.toJSON(serializedData);
+
+    assert.deepEqual(json, expected, 'toJSON allows data to be overridden');
+  });
+
+  test('it should proxy get/set to data object for form fields', async function (assert) {
+    class TestForm extends Form {
+      formFields = [new FormField('foo', 'string')];
+    }
+    const form = new TestForm(this.data);
+
+    assert.strictEqual(
+      form.foo,
+      'bar',
+      'data object value returned when accessing form field property on class'
+    );
+    form.foo = 'baz';
+    assert.strictEqual(
+      form.data.foo,
+      'baz',
+      'data object property is set when setting form field property on class'
+    );
+    assert.strictEqual(form.foo, 'baz', 'updated data object value is returned');
+  });
+});
diff --git a/ui/tests/unit/helpers/await-test.js b/ui/tests/unit/helpers/await-test.js
index 5cfda0cf730..fab8f3e6541 100644
--- a/ui/tests/unit/helpers/await-test.js
+++ b/ui/tests/unit/helpers/await-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/helpers/filter-wildcard-test.js b/ui/tests/unit/helpers/filter-wildcard-test.js
index 2165878220d..eafe70c66b1 100644
--- a/ui/tests/unit/helpers/filter-wildcard-test.js
+++ b/ui/tests/unit/helpers/filter-wildcard-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/helpers/has-capability-test.js b/ui/tests/unit/helpers/has-capability-test.js
new file mode 100644
index 00000000000..138a92da780
--- /dev/null
+++ b/ui/tests/unit/helpers/has-capability-test.js
@@ -0,0 +1,117 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import HasCapabilityHelper from 'core/helpers/has-capability';
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Helpers | has-capability', function (hooks) {
+  setupTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.helper = new HasCapabilityHelper(this.owner);
+    this.namedArgs = { pathKey: 'customMessages', params: { id: 'foobar' } };
+    const capabilities = {
+      'sys/config/ui/custom-messages/foobar': {
+        canList: false,
+        canRead: true,
+        canUpdate: true,
+        canCreate: false,
+        canDelete: false,
+      },
+    };
+    this.hasCapability = (types = [], namedArgs) => {
+      return this.helper.compute([capabilities, ...types], namedArgs || this.namedArgs);
+    };
+  });
+
+  test('it should throw an error if capabilities are not provided', async function (assert) {
+    try {
+      this.helper.compute([], {})();
+    } catch (error) {
+      assert.strictEqual(
+        error.message,
+        'First positional argument must be the capabilities map.',
+        'throws error when capabilities map is not provided'
+      );
+    }
+  });
+
+  test('it should throw an error when types are not provided', async function (assert) {
+    try {
+      this.hasCapability([]);
+    } catch (error) {
+      assert.strictEqual(
+        error.message,
+        'At least one capability type is required as a positional argument.',
+        'throws error when types are not provided'
+      );
+    }
+  });
+
+  test('it should throw an error for invalid types', async function (assert) {
+    try {
+      this.hasCapability(['doEverything']);
+    } catch (error) {
+      assert.strictEqual(
+        error.message,
+        'Invalid capability types: doEverything. Accepted types are: read, update, delete, list, create, patch, sudo.',
+        'throws error when invalid types are provided'
+      );
+    }
+  });
+
+  test('it should throw an error if pathKey is not provided', async function (assert) {
+    try {
+      this.hasCapability(['read'], {});
+    } catch (error) {
+      assert.strictEqual(
+        error.message,
+        'pathKey is a required named arg for path lookup in capabilities map',
+        'throws error when pathKey is not found'
+      );
+    }
+  });
+
+  test('it should throw error if path is not found', async function (assert) {
+    try {
+      this.hasCapability(['read'], { pathKey: 'notAnId' });
+    } catch (error) {
+      assert.strictEqual(
+        error.message,
+        'Path not found for key: notAnId',
+        'throws error when path is not found'
+      );
+    }
+  });
+
+  test('it should return correct value when evaluating single type', async function (assert) {
+    assert.true(this.hasCapability(['read']), 'returns correct true value for single type');
+    assert.false(this.hasCapability(['list']), 'returns correct false value for single type');
+  });
+
+  test('it should return correct value when evaluating multiple types when all is false', async function (assert) {
+    assert.true(
+      this.hasCapability(['list', 'read']),
+      'returns correct true value for multiple types when at least one is true'
+    );
+    assert.false(
+      this.hasCapability(['create', 'delete']),
+      'returns correct false value for multiple types when all are false'
+    );
+  });
+
+  test('it should return correct value when evaluating multiple types when all is true', async function (assert) {
+    this.namedArgs.all = true;
+    assert.true(
+      this.hasCapability(['update', 'read']),
+      'returns correct true value for multiple types when all are true'
+    );
+    assert.false(
+      this.hasCapability(['update', 'read', 'list']),
+      'returns correct false value for multiple types when at least one is false'
+    );
+  });
+});
diff --git a/ui/tests/unit/helpers/is-wildcard-string-test.js b/ui/tests/unit/helpers/is-wildcard-string-test.js
index b6012cd2e76..e5914c6a315 100644
--- a/ui/tests/unit/helpers/is-wildcard-string-test.js
+++ b/ui/tests/unit/helpers/is-wildcard-string-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/lib/attach-capabilities-test.js b/ui/tests/unit/lib/attach-capabilities-test.js
deleted file mode 100644
index 3a5568d1f16..00000000000
--- a/ui/tests/unit/lib/attach-capabilities-test.js
+++ /dev/null
@@ -1,168 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Model from '@ember-data/model';
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-import attachCapabilities from 'vault/lib/attach-capabilities';
-import apiPath from 'vault/utils/api-path';
-
-const MODEL_TYPE = 'test-form-model';
-
-const makeModelClass = () => {
-  return Model.extend();
-};
-
-module('Unit | lib | attach capabilities', function (hooks) {
-  setupTest(hooks);
-
-  test('it attaches passed capabilities', function (assert) {
-    let mc = makeModelClass();
-    mc = attachCapabilities(mc, {
-      updatePath: apiPath`update/{'id'}`,
-      deletePath: apiPath`delete/{'id'}`,
-    });
-    let relationship = mc.relationshipsByName.get('updatePath');
-
-    assert.strictEqual(relationship.key, 'updatePath', 'has updatePath relationship');
-    assert.strictEqual(relationship.kind, 'belongsTo', 'kind of relationship is belongsTo');
-    assert.strictEqual(relationship.type, 'capabilities', 'updatePath is a related capabilities model');
-
-    relationship = mc.relationshipsByName.get('deletePath');
-    assert.strictEqual(relationship.key, 'deletePath', 'has deletePath relationship');
-    assert.strictEqual(relationship.kind, 'belongsTo', 'kind of relationship is belongsTo');
-    assert.strictEqual(relationship.type, 'capabilities', 'deletePath is a related capabilities model');
-  });
-
-  test('it adds a static method to the model class', function (assert) {
-    let mc = makeModelClass();
-    mc = attachCapabilities(mc, {
-      updatePath: apiPath`update/{'id'}`,
-      deletePath: apiPath`delete/{'id'}`,
-    });
-    const relatedCapabilities = !!mc.relatedCapabilities && typeof mc.relatedCapabilities === 'function';
-    assert.true(relatedCapabilities, 'model class now has a relatedCapabilities static function');
-  });
-
-  test('calling static method with single response JSON-API document adds expected relationships', function (assert) {
-    let mc = makeModelClass();
-    mc = attachCapabilities(mc, {
-      updatePath: apiPath`update/${'id'}`,
-      deletePath: apiPath`delete/${'id'}`,
-    });
-    const jsonAPIDocSingle = {
-      data: {
-        id: 'test',
-        type: MODEL_TYPE,
-        attributes: {},
-        relationships: {},
-      },
-      included: [],
-    };
-
-    const expected = {
-      data: {
-        id: 'test',
-        type: MODEL_TYPE,
-        attributes: {},
-        relationships: {
-          updatePath: {
-            data: {
-              type: 'capabilities',
-              id: 'update/test',
-            },
-          },
-          deletePath: {
-            data: {
-              type: 'capabilities',
-              id: 'delete/test',
-            },
-          },
-        },
-      },
-      included: [],
-    };
-
-    mc.relatedCapabilities(jsonAPIDocSingle);
-
-    assert.strictEqual(
-      Object.keys(jsonAPIDocSingle.data.relationships).length,
-      2,
-      'document now has 2 relationships'
-    );
-    assert.deepEqual(jsonAPIDocSingle, expected, 'has the exected new document structure');
-  });
-
-  test('calling static method with an arrary response JSON-API document adds expected relationships', function (assert) {
-    let mc = makeModelClass();
-    mc = attachCapabilities(mc, {
-      updatePath: apiPath`update/${'id'}`,
-      deletePath: apiPath`delete/${'id'}`,
-    });
-    const jsonAPIDocSingle = {
-      data: [
-        {
-          id: 'test',
-          type: MODEL_TYPE,
-          attributes: {},
-          relationships: {},
-        },
-        {
-          id: 'foo',
-          type: MODEL_TYPE,
-          attributes: {},
-          relationships: {},
-        },
-      ],
-      included: [],
-    };
-
-    const expected = {
-      data: [
-        {
-          id: 'test',
-          type: MODEL_TYPE,
-          attributes: {},
-          relationships: {
-            updatePath: {
-              data: {
-                type: 'capabilities',
-                id: 'update/test',
-              },
-            },
-            deletePath: {
-              data: {
-                type: 'capabilities',
-                id: 'delete/test',
-              },
-            },
-          },
-        },
-        {
-          id: 'foo',
-          type: MODEL_TYPE,
-          attributes: {},
-          relationships: {
-            updatePath: {
-              data: {
-                type: 'capabilities',
-                id: 'update/foo',
-              },
-            },
-            deletePath: {
-              data: {
-                type: 'capabilities',
-                id: 'delete/foo',
-              },
-            },
-          },
-        },
-      ],
-      included: [],
-    };
-    mc.relatedCapabilities(jsonAPIDocSingle);
-    assert.deepEqual(jsonAPIDocSingle, expected, 'has the exected new document structure');
-  });
-});
diff --git a/ui/tests/unit/lib/console-helpers-test.js b/ui/tests/unit/lib/console-helpers-test.js
index b945885147c..215cd40e829 100644
--- a/ui/tests/unit/lib/console-helpers-test.js
+++ b/ui/tests/unit/lib/console-helpers-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/lib/kv-object-test.js b/ui/tests/unit/lib/kv-object-test.js
index e3b15a0e5c0..aa4fa1377e5 100644
--- a/ui/tests/unit/lib/kv-object-test.js
+++ b/ui/tests/unit/lib/kv-object-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/lib/local-storage-test.js b/ui/tests/unit/lib/local-storage-test.js
index 1b518ae5f2d..dfcdd073e07 100644
--- a/ui/tests/unit/lib/local-storage-test.js
+++ b/ui/tests/unit/lib/local-storage-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/lib/path-to-tree-test.js b/ui/tests/unit/lib/path-to-tree-test.js
deleted file mode 100644
index 40fa948c725..00000000000
--- a/ui/tests/unit/lib/path-to-tree-test.js
+++ /dev/null
@@ -1,113 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import pathToTree from 'vault/lib/path-to-tree';
-
-module('Unit | Lib | path to tree', function () {
-  const tests = [
-    [
-      'basic',
-      ['one', 'one/two', 'one/two/three/four/five'],
-      {
-        one: {
-          two: {
-            three: {
-              four: {
-                five: null,
-              },
-            },
-          },
-        },
-      },
-    ],
-    [
-      'multiple leaves on a level',
-      ['one', 'two', 'three/four/five', 'three/four/six', 'three/four/six/one'],
-      {
-        one: null,
-        three: {
-          four: {
-            five: null,
-            six: {
-              one: null,
-            },
-          },
-        },
-        two: null,
-      },
-    ],
-    [
-      'leaves with shared prefix',
-      ['ns1', 'ns1a', 'ns1a/ns2/ns3', 'ns1a/ns2a/ns3'],
-      {
-        ns1: null,
-        ns1a: {
-          ns2: {
-            ns3: null,
-          },
-          ns2a: {
-            ns3: null,
-          },
-        },
-      },
-    ],
-    [
-      'leaves with nested number and shared prefix',
-      ['ns1', 'ns1a', 'ns1a/99999/five9s', 'ns1a/999/ns3', 'ns1a/9999/ns3'],
-      {
-        ns1: null,
-        ns1a: {
-          999: {
-            ns3: null,
-          },
-          9999: {
-            ns3: null,
-          },
-          99999: {
-            five9s: null,
-          },
-        },
-      },
-    ],
-    [
-      'sorting lexicographically',
-      [
-        '99',
-        'bat',
-        'bat/bird',
-        'animal/flying/birds',
-        'animal/walking/dogs',
-        'animal/walking/cats',
-        '1/thing',
-      ],
-      {
-        1: {
-          thing: null,
-        },
-        99: null,
-        animal: {
-          flying: {
-            birds: null,
-          },
-          walking: {
-            cats: null,
-            dogs: null,
-          },
-        },
-        bat: {
-          bird: null,
-        },
-      },
-    ],
-  ];
-
-  tests.forEach(function ([name, input, expected]) {
-    test(`pathToTree: ${name}`, function (assert) {
-      const output = pathToTree(input);
-      assert.deepEqual(output, expected, 'has expected data');
-    });
-  });
-});
diff --git a/ui/tests/unit/machines/auth-machine-test.js b/ui/tests/unit/machines/auth-machine-test.js
deleted file mode 100644
index c5bf6531a2a..00000000000
--- a/ui/tests/unit/machines/auth-machine-test.js
+++ /dev/null
@@ -1,90 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { Machine } from 'xstate';
-import AuthMachineConfig from 'vault/machines/auth-machine';
-
-module('Unit | Machine | auth-machine', function () {
-  const authMachine = Machine(AuthMachineConfig);
-
-  const testCases = [
-    {
-      currentState: authMachine.initialState,
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: 'enable',
-        actions: [
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-          { component: 'wizard/auth-enable', level: 'step', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: 'config',
-        actions: [
-          { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-          { type: 'render', level: 'step', component: 'wizard/auth-config' },
-        ],
-      },
-    },
-    {
-      currentState: 'config',
-      event: 'CONTINUE',
-      expectedResults: {
-        value: 'details',
-        actions: [
-          { component: 'wizard/auth-details', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'details',
-      event: 'CONTINUE',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'details',
-      event: 'RESET',
-      params: null,
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.auth.enable'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/auth-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-  ];
-
-  testCases.forEach((testCase) => {
-    test(`transition: ${testCase.event} for currentState ${testCase.currentState} and componentState ${testCase.params}`, function (assert) {
-      const result = authMachine.transition(testCase.currentState, testCase.event, testCase.params);
-      assert.strictEqual(result.value, testCase.expectedResults.value);
-      assert.deepEqual(result.actions, testCase.expectedResults.actions);
-    });
-  });
-});
diff --git a/ui/tests/unit/machines/policies-machine-test.js b/ui/tests/unit/machines/policies-machine-test.js
deleted file mode 100644
index cfffea3e377..00000000000
--- a/ui/tests/unit/machines/policies-machine-test.js
+++ /dev/null
@@ -1,65 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { Machine } from 'xstate';
-import PoliciesMachineConfig from 'vault/machines/policies-machine';
-
-module('Unit | Machine | policies-machine', function () {
-  const policiesMachine = Machine(PoliciesMachineConfig);
-
-  const testCases = [
-    {
-      currentState: policiesMachine.initialState,
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: 'create',
-        actions: [{ component: 'wizard/policies-create', level: 'feature', type: 'render' }],
-      },
-    },
-    {
-      currentState: 'create',
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: 'details',
-        actions: [{ component: 'wizard/policies-details', level: 'feature', type: 'render' }],
-      },
-    },
-    {
-      currentState: 'details',
-      event: 'CONTINUE',
-      expectedResults: {
-        value: 'delete',
-        actions: [{ component: 'wizard/policies-delete', level: 'feature', type: 'render' }],
-      },
-    },
-    {
-      currentState: 'delete',
-      event: 'CONTINUE',
-      expectedResults: {
-        value: 'others',
-        actions: [{ component: 'wizard/policies-others', level: 'feature', type: 'render' }],
-      },
-    },
-    {
-      currentState: 'others',
-      event: 'CONTINUE',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-  ];
-
-  testCases.forEach((testCase) => {
-    test(`transition: ${testCase.event} for currentState ${testCase.currentState} and componentState ${testCase.params}`, function (assert) {
-      const result = policiesMachine.transition(testCase.currentState, testCase.event, testCase.params);
-      assert.strictEqual(result.value, testCase.expectedResults.value);
-      assert.deepEqual(result.actions, testCase.expectedResults.actions);
-    });
-  });
-});
diff --git a/ui/tests/unit/machines/replication-machine-test.js b/ui/tests/unit/machines/replication-machine-test.js
deleted file mode 100644
index 48bb8c27da4..00000000000
--- a/ui/tests/unit/machines/replication-machine-test.js
+++ /dev/null
@@ -1,41 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { Machine } from 'xstate';
-import ReplicationMachineConfig from 'vault/machines/replication-machine';
-
-module('Unit | Machine | replication-machine', function () {
-  const replicationMachine = Machine(ReplicationMachineConfig);
-
-  const testCases = [
-    {
-      currentState: replicationMachine.initialState,
-      event: 'ENABLEREPLICATION',
-      params: null,
-      expectedResults: {
-        value: 'details',
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/replication-details' }],
-      },
-    },
-    {
-      currentState: 'details',
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-  ];
-
-  testCases.forEach((testCase) => {
-    test(`transition: ${testCase.event} for currentState ${testCase.currentState} and componentState ${testCase.params}`, function (assert) {
-      const result = replicationMachine.transition(testCase.currentState, testCase.event, testCase.params);
-      assert.strictEqual(result.value, testCase.expectedResults.value);
-      assert.deepEqual(result.actions, testCase.expectedResults.actions);
-    });
-  });
-});
diff --git a/ui/tests/unit/machines/secrets-machine-test.js b/ui/tests/unit/machines/secrets-machine-test.js
deleted file mode 100644
index 34903222055..00000000000
--- a/ui/tests/unit/machines/secrets-machine-test.js
+++ /dev/null
@@ -1,1007 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, skip } from 'qunit';
-import { Machine } from 'xstate';
-import SecretsMachineConfig from 'vault/machines/secrets-machine';
-
-module('Unit | Machine | secrets-machine', function () {
-  const secretsMachine = Machine(SecretsMachineConfig);
-
-  const testCases = [
-    {
-      currentState: secretsMachine.initialState,
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: 'enable',
-        actions: [
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-          { component: 'wizard/secrets-enable', level: 'step', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'aws',
-      expectedResults: {
-        value: 'details',
-        actions: [
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-          { component: 'wizard/secrets-details', level: 'step', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'details',
-      event: 'CONTINUE',
-      params: 'aws',
-      expectedResults: {
-        value: 'role',
-        actions: [
-          { component: 'wizard/secrets-role', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'role',
-      event: 'CONTINUE',
-      params: 'aws',
-      expectedResults: {
-        value: 'displayRole',
-        actions: [
-          { component: 'wizard/secrets-display-role', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'displayRole',
-      event: 'CONTINUE',
-      params: 'aws',
-      expectedResults: {
-        value: 'credentials',
-        actions: [
-          { component: 'wizard/secrets-credentials', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'credentials',
-      event: 'CONTINUE',
-      params: 'aws',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'REPEAT',
-      params: 'aws',
-      expectedResults: {
-        value: 'role',
-        actions: [
-          {
-            params: ['vault.cluster.secrets.backend.create-root'],
-            type: 'routeTransition',
-          },
-          { component: 'wizard/secrets-role', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'aws',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'aws',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'aws',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'pki',
-      expectedResults: {
-        value: 'details',
-        actions: [
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-          { component: 'wizard/secrets-details', level: 'step', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'details',
-      event: 'CONTINUE',
-      params: 'pki',
-      expectedResults: {
-        value: 'role',
-        actions: [
-          { component: 'wizard/secrets-role', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'role',
-      event: 'CONTINUE',
-      params: 'pki',
-      expectedResults: {
-        value: 'displayRole',
-        actions: [
-          { component: 'wizard/secrets-display-role', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'displayRole',
-      event: 'CONTINUE',
-      params: 'pki',
-      expectedResults: {
-        value: 'credentials',
-        actions: [
-          { component: 'wizard/secrets-credentials', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'credentials',
-      event: 'CONTINUE',
-      params: 'pki',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'REPEAT',
-      params: 'pki',
-      expectedResults: {
-        value: 'role',
-        actions: [
-          {
-            params: ['vault.cluster.secrets.backend.create-root'],
-            type: 'routeTransition',
-          },
-          { component: 'wizard/secrets-role', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'pki',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'pki',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'pki',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'ssh',
-      expectedResults: {
-        value: 'details',
-        actions: [
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-          { component: 'wizard/secrets-details', level: 'step', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'details',
-      event: 'CONTINUE',
-      params: 'ssh',
-      expectedResults: {
-        value: 'role',
-        actions: [
-          { component: 'wizard/secrets-role', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'role',
-      event: 'CONTINUE',
-      params: 'ssh',
-      expectedResults: {
-        value: 'displayRole',
-        actions: [
-          { component: 'wizard/secrets-display-role', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'displayRole',
-      event: 'CONTINUE',
-      params: 'ssh',
-      expectedResults: {
-        value: 'credentials',
-        actions: [
-          { component: 'wizard/secrets-credentials', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'credentials',
-      event: 'CONTINUE',
-      params: 'ssh',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'REPEAT',
-      params: 'ssh',
-      expectedResults: {
-        value: 'role',
-        actions: [
-          {
-            params: ['vault.cluster.secrets.backend.create-root'],
-            type: 'routeTransition',
-          },
-          { component: 'wizard/secrets-role', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'ssh',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'ssh',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'ssh',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'consul',
-      expectedResults: {
-        value: 'list',
-        actions: [
-          { type: 'render', level: 'step', component: 'wizard/secrets-list' },
-          { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        ],
-      },
-    },
-    {
-      currentState: 'list',
-      event: 'CONTINUE',
-      params: 'consul',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'consul',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'consul',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'consul',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'database',
-      expectedResults: {
-        value: 'details',
-        actions: [
-          { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-          { type: 'render', level: 'step', component: 'wizard/secrets-details' },
-        ],
-      },
-    },
-    {
-      currentState: 'list',
-      event: 'CONTINUE',
-      params: 'database',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'database',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'database',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'database',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'gcp',
-      expectedResults: {
-        value: 'list',
-        actions: [
-          { type: 'render', level: 'step', component: 'wizard/secrets-list' },
-          { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        ],
-      },
-    },
-    {
-      currentState: 'list',
-      event: 'CONTINUE',
-      params: 'gcp',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'gcp',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'gcp',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'gcp',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'nomad',
-      expectedResults: {
-        value: 'list',
-        actions: [
-          { type: 'render', level: 'step', component: 'wizard/secrets-list' },
-          { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        ],
-      },
-    },
-    {
-      currentState: 'list',
-      event: 'CONTINUE',
-      params: 'nomad',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'nomad',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'nomad',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'nomad',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'rabbitmq',
-      expectedResults: {
-        value: 'list',
-        actions: [
-          { type: 'render', level: 'step', component: 'wizard/secrets-list' },
-          { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        ],
-      },
-    },
-    {
-      currentState: 'list',
-      event: 'CONTINUE',
-      params: 'rabbitmq',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'rabbitmq',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'rabbitmq',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'rabbitmq',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'totp',
-      expectedResults: {
-        value: 'list',
-        actions: [
-          { type: 'render', level: 'step', component: 'wizard/secrets-list' },
-          { type: 'render', level: 'feature', component: 'wizard/mounts-wizard' },
-        ],
-      },
-    },
-    {
-      currentState: 'list',
-      event: 'CONTINUE',
-      params: 'totp',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'totp',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'totp',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'totp',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'kv',
-      expectedResults: {
-        value: 'details',
-        actions: [
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-          { component: 'wizard/secrets-details', level: 'step', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'details',
-      event: 'CONTINUE',
-      params: 'kv',
-      expectedResults: {
-        value: 'secret',
-        actions: [
-          { component: 'wizard/secrets-secret', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'secret',
-      event: 'CONTINUE',
-      params: 'kv',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'REPEAT',
-      params: 'kv',
-      expectedResults: {
-        value: 'secret',
-        actions: [
-          {
-            params: ['vault.cluster.secrets.backend.create-root'],
-            type: 'routeTransition',
-          },
-          { component: 'wizard/secrets-secret', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'kv',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'kv',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'kv',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'enable',
-      event: 'CONTINUE',
-      params: 'transit',
-      expectedResults: {
-        value: 'details',
-        actions: [
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-          { component: 'wizard/secrets-details', level: 'step', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'details',
-      event: 'CONTINUE',
-      params: 'transit',
-      expectedResults: {
-        value: 'encryption',
-        actions: [
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-          { component: 'wizard/secrets-encryption', level: 'step', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'encryption',
-      event: 'CONTINUE',
-      params: 'transit',
-      expectedResults: {
-        value: 'display',
-        actions: [
-          { component: 'wizard/secrets-display', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'REPEAT',
-      params: 'transit',
-      expectedResults: {
-        value: 'encryption',
-        actions: [
-          {
-            params: ['vault.cluster.secrets.backend.create-root'],
-            type: 'routeTransition',
-          },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-          { component: 'wizard/secrets-encryption', level: 'step', type: 'render' },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'RESET',
-      params: 'transit',
-      expectedResults: {
-        value: 'idle',
-        actions: [
-          {
-            params: ['vault.cluster.settings.mount-secret-backend'],
-            type: 'routeTransition',
-          },
-          {
-            component: 'wizard/mounts-wizard',
-            level: 'feature',
-            type: 'render',
-          },
-          {
-            component: 'wizard/secrets-idle',
-            level: 'step',
-            type: 'render',
-          },
-        ],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'DONE',
-      params: 'transit',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-    {
-      currentState: 'display',
-      event: 'ERROR',
-      params: 'transit',
-      expectedResults: {
-        value: 'error',
-        actions: [
-          { component: 'wizard/tutorial-error', level: 'step', type: 'render' },
-          { component: 'wizard/mounts-wizard', level: 'feature', type: 'render' },
-        ],
-      },
-    },
-  ];
-
-  testCases.forEach((testCase) => {
-    // skipping see PR https://github.com/hashicorp/vault/pull/19220
-    skip(`transition: ${testCase.event} for currentState ${testCase.currentState} and componentState ${testCase.params}`, function (assert) {
-      const result = secretsMachine.transition(testCase.currentState, testCase.event, testCase.params);
-      assert.strictEqual(result.value, testCase.expectedResults.value);
-      assert.deepEqual(result.actions, testCase.expectedResults.actions);
-    });
-  });
-});
diff --git a/ui/tests/unit/machines/tools-machine-test.js b/ui/tests/unit/machines/tools-machine-test.js
deleted file mode 100644
index 607e46e274c..00000000000
--- a/ui/tests/unit/machines/tools-machine-test.js
+++ /dev/null
@@ -1,94 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { Machine } from 'xstate';
-import ToolsMachineConfig from 'vault/machines/tools-machine';
-
-module('Unit | Machine | tools-machine', function () {
-  const toolsMachine = Machine(ToolsMachineConfig);
-
-  const testCases = [
-    {
-      currentState: toolsMachine.initialState,
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: 'wrapped',
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/tools-wrapped' }],
-      },
-    },
-    {
-      currentState: 'wrapped',
-      event: 'LOOKUP',
-      params: null,
-      expectedResults: {
-        value: 'lookup',
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/tools-lookup' }],
-      },
-    },
-    {
-      currentState: 'lookup',
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: 'info',
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/tools-info' }],
-      },
-    },
-    {
-      currentState: 'info',
-      event: 'REWRAP',
-      params: null,
-      expectedResults: {
-        value: 'rewrap',
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/tools-rewrap' }],
-      },
-    },
-    {
-      currentState: 'rewrap',
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: 'rewrapped',
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/tools-rewrapped' }],
-      },
-    },
-    {
-      currentState: 'rewrapped',
-      event: 'UNWRAP',
-      params: null,
-      expectedResults: {
-        value: 'unwrap',
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/tools-unwrap' }],
-      },
-    },
-    {
-      currentState: 'unwrap',
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: 'unwrapped',
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/tools-unwrapped' }],
-      },
-    },
-    {
-      currentState: 'unwrapped',
-      event: 'CONTINUE',
-      expectedResults: {
-        value: 'complete',
-        actions: ['completeFeature'],
-      },
-    },
-  ];
-
-  testCases.forEach((testCase) => {
-    test(`transition: ${testCase.event} for currentState ${testCase.currentState} and componentState ${testCase.params}`, function (assert) {
-      const result = toolsMachine.transition(testCase.currentState, testCase.event, testCase.params);
-      assert.strictEqual(result.value, testCase.expectedResults.value);
-      assert.deepEqual(result.actions, testCase.expectedResults.actions);
-    });
-  });
-});
diff --git a/ui/tests/unit/machines/tutorial-machine-test.js b/ui/tests/unit/machines/tutorial-machine-test.js
deleted file mode 100644
index eae05534470..00000000000
--- a/ui/tests/unit/machines/tutorial-machine-test.js
+++ /dev/null
@@ -1,251 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { Machine } from 'xstate';
-import TutorialMachineConfig from 'vault/machines/tutorial-machine';
-
-module('Unit | Machine | tutorial-machine', function () {
-  const tutorialMachine = Machine(TutorialMachineConfig);
-
-  const testCases = [
-    {
-      currentState: 'init',
-      event: 'START',
-      params: null,
-      expectedResults: {
-        value: {
-          init: {
-            active: 'setup',
-          },
-        },
-        actions: [
-          { type: 'render', level: 'tutorial', component: 'wizard/tutorial-active' },
-          { type: 'render', level: 'feature', component: 'wizard/init-setup' },
-        ],
-      },
-    },
-    {
-      currentState: 'init.active.setup',
-      event: 'TOSAVE',
-      params: null,
-      expectedResults: {
-        value: {
-          init: {
-            active: 'save',
-          },
-        },
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/init-save-keys' }],
-      },
-    },
-    {
-      currentState: 'init',
-      event: 'SAVE',
-      params: null,
-      expectedResults: {
-        value: {
-          init: {
-            active: 'save',
-          },
-        },
-        actions: [
-          { type: 'render', level: 'tutorial', component: 'wizard/tutorial-active' },
-          { type: 'render', level: 'feature', component: 'wizard/init-save-keys' },
-        ],
-      },
-    },
-    {
-      currentState: 'init.active.save',
-      event: 'TOUNSEAL',
-      params: null,
-      expectedResults: {
-        value: {
-          init: {
-            active: 'unseal',
-          },
-        },
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/init-unseal' }],
-      },
-    },
-    {
-      currentState: 'init',
-      event: 'UNSEAL',
-      params: null,
-      expectedResults: {
-        value: {
-          init: {
-            active: 'unseal',
-          },
-        },
-        actions: [
-          { type: 'render', level: 'tutorial', component: 'wizard/tutorial-active' },
-          { type: 'render', level: 'feature', component: 'wizard/init-unseal' },
-        ],
-      },
-    },
-    {
-      currentState: 'init.active.unseal',
-      event: 'TOLOGIN',
-      params: null,
-      expectedResults: {
-        value: {
-          init: {
-            active: 'login',
-          },
-        },
-        actions: [{ type: 'render', level: 'feature', component: 'wizard/init-login' }],
-      },
-    },
-    {
-      currentState: 'init',
-      event: 'LOGIN',
-      params: null,
-      expectedResults: {
-        value: {
-          init: {
-            active: 'login',
-          },
-        },
-        actions: [
-          { type: 'render', level: 'tutorial', component: 'wizard/tutorial-active' },
-          { type: 'render', level: 'feature', component: 'wizard/init-login' },
-        ],
-      },
-    },
-    {
-      currentState: 'init.active.login',
-      event: 'INITDONE',
-      params: null,
-      expectedResults: {
-        value: {
-          active: 'select',
-        },
-        actions: [
-          'showTutorialWhenAuthenticated',
-          'clearFeatureData',
-          { type: 'render', level: 'tutorial', component: 'wizard/tutorial-active' },
-          { type: 'render', level: 'feature', component: 'wizard/features-selection' },
-        ],
-      },
-    },
-    {
-      currentState: 'active.select',
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: {
-          active: 'feature',
-        },
-        actions: [],
-      },
-    },
-    {
-      currentState: 'active.feature',
-      event: 'DISMISS',
-      params: null,
-      expectedResults: {
-        value: 'dismissed',
-        actions: [
-          { type: 'render', level: 'tutorial', component: null },
-          { type: 'render', level: 'feature', component: null },
-          { type: 'render', level: 'step', component: null },
-          { type: 'render', level: 'detail', component: null },
-          'handleDismissed',
-        ],
-      },
-    },
-    {
-      currentState: 'active.feature',
-      event: 'DONE',
-      params: null,
-      expectedResults: {
-        value: 'complete',
-        actions: [
-          { type: 'render', level: 'feature', component: null },
-          { type: 'render', level: 'step', component: null },
-          { type: 'render', level: 'detail', component: null },
-          { type: 'render', level: 'tutorial', component: 'wizard/tutorial-complete' },
-        ],
-      },
-    },
-    {
-      currentState: 'active.feature',
-      event: 'PAUSE',
-      params: null,
-      expectedResults: {
-        value: 'paused',
-        actions: [
-          { type: 'render', level: 'feature', component: null },
-          { type: 'render', level: 'step', component: null },
-          { type: 'render', level: 'detail', component: null },
-          { type: 'render', level: 'tutorial', component: 'wizard/tutorial-paused' },
-          'handlePaused',
-        ],
-      },
-    },
-    {
-      currentState: 'paused',
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: {
-          active: 'feature',
-        },
-        actions: ['handleResume', { type: 'render', level: 'tutorial', component: 'wizard/tutorial-active' }],
-      },
-    },
-    {
-      currentState: 'idle',
-      event: 'INIT',
-      params: null,
-      expectedResults: {
-        value: {
-          init: 'idle',
-        },
-        actions: [
-          'showTutorialAlways',
-          { type: 'render', level: 'tutorial', component: 'wizard/tutorial-idle' },
-          { type: 'render', level: 'feature', component: null },
-        ],
-      },
-    },
-    {
-      currentState: 'idle',
-      event: 'AUTH',
-      params: null,
-      expectedResults: {
-        value: {
-          active: 'select',
-        },
-        actions: [
-          { type: 'render', level: 'tutorial', component: 'wizard/tutorial-active' },
-          { type: 'render', level: 'feature', component: 'wizard/features-selection' },
-        ],
-      },
-    },
-    {
-      currentState: 'idle',
-      event: 'CONTINUE',
-      params: null,
-      expectedResults: {
-        value: {
-          active: 'select',
-        },
-        actions: [
-          { type: 'render', level: 'tutorial', component: 'wizard/tutorial-active' },
-          { type: 'render', level: 'feature', component: 'wizard/features-selection' },
-        ],
-      },
-    },
-  ];
-
-  testCases.forEach((testCase) => {
-    test(`transition: ${testCase.event} for currentState ${testCase.currentState} and componentState ${testCase.params}`, function (assert) {
-      const result = tutorialMachine.transition(testCase.currentState, testCase.event, testCase.params);
-      assert.deepEqual(result.value, testCase.expectedResults.value);
-      assert.deepEqual(result.actions, testCase.expectedResults.actions);
-    });
-  });
-});
diff --git a/ui/tests/unit/mixins/cluster-route-test.js b/ui/tests/unit/mixins/cluster-route-test.js
index 2a298baa25e..5f609b01dc7 100644
--- a/ui/tests/unit/mixins/cluster-route-test.js
+++ b/ui/tests/unit/mixins/cluster-route-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -134,7 +134,7 @@ module('Unit | Mixin | cluster route', function () {
   });
 
   test('#transitionToTargetRoute', function (assert) {
-    const redirectRouteURL = '/vault/secrets/secret/create';
+    const redirectRouteURL = '/vault/secrets-engines/secret/create';
     const subject = createClusterRoute({ needsInit: false, sealed: false });
     subject.router.currentURL = redirectRouteURL;
     const spy = sinon.spy(subject.router, 'transitionTo');
diff --git a/ui/tests/unit/models/capabilities-test.js b/ui/tests/unit/models/capabilities-test.js
index 99a5654be88..694179052b1 100644
--- a/ui/tests/unit/models/capabilities-test.js
+++ b/ui/tests/unit/models/capabilities-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,15 @@ import { SUDO_PATHS, SUDO_PATH_PREFIXES } from 'vault/models/capabilities';
 
 import { run } from '@ember/runloop';
 
+const CAPABILITIES = {
+  canCreate: 'create',
+  canRead: 'read',
+  canUpdate: 'update',
+  canDelete: 'delete',
+  canList: 'list',
+  canPatch: 'patch',
+};
+
 module('Unit | Model | capabilities', function (hooks) {
   setupTest(hooks);
 
@@ -17,7 +26,7 @@ module('Unit | Model | capabilities', function (hooks) {
     assert.ok(!!model);
   });
 
-  test('it reads capabilities', function (assert) {
+  test('it computes capabilities', function (assert) {
     const model = run(() =>
       this.owner.lookup('service:store').createRecord('capabilities', {
         path: 'foo',
@@ -31,6 +40,23 @@ module('Unit | Model | capabilities', function (hooks) {
     assert.notOk(model.get('canDelete'));
   });
 
+  for (const capability in CAPABILITIES) {
+    test(`it computes capability: ${capability}`, function (assert) {
+      const permission = CAPABILITIES[capability];
+      const model = run(() =>
+        this.owner.lookup('service:store').createRecord('capabilities', {
+          path: 'foo',
+          capabilities: [permission],
+        })
+      );
+      assert.true(model.get(capability), `${capability} is true`);
+      const falsyCapabilities = Object.keys(CAPABILITIES).filter((c) => c !== capability);
+      falsyCapabilities.forEach((c) => {
+        assert.false(model.get(c), `${c} is false`);
+      });
+    });
+  }
+
   test('it allows everything if root is present', function (assert) {
     const model = run(() =>
       this.owner.lookup('service:store').createRecord('capabilities', {
@@ -38,11 +64,10 @@ module('Unit | Model | capabilities', function (hooks) {
         capabilities: ['root', 'deny', 'read'],
       })
     );
-    assert.ok(model.get('canRead'));
-    assert.ok(model.get('canCreate'));
-    assert.ok(model.get('canUpdate'));
-    assert.ok(model.get('canDelete'));
-    assert.ok(model.get('canList'));
+
+    Object.keys(CAPABILITIES).forEach((c) => {
+      assert.true(model.get(c), `${c} is true`);
+    });
   });
 
   test('it denies everything if deny is present', function (assert) {
@@ -52,11 +77,9 @@ module('Unit | Model | capabilities', function (hooks) {
         capabilities: ['sudo', 'deny', 'read'],
       })
     );
-    assert.notOk(model.get('canRead'));
-    assert.notOk(model.get('canCreate'));
-    assert.notOk(model.get('canUpdate'));
-    assert.notOk(model.get('canDelete'));
-    assert.notOk(model.get('canList'));
+    Object.keys(CAPABILITIES).forEach((c) => {
+      assert.false(model.get(c), `${c} is false`);
+    });
   });
 
   test('it requires sudo on sudo paths', function (assert) {
diff --git a/ui/tests/unit/models/database-connection-test.js b/ui/tests/unit/models/database-connection-test.js
new file mode 100644
index 00000000000..91270cf91d3
--- /dev/null
+++ b/ui/tests/unit/models/database-connection-test.js
@@ -0,0 +1,95 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+import { EXPECTED_FIELDS } from 'vault/tests/helpers/secret-engine/database-helpers';
+
+import { AVAILABLE_PLUGIN_TYPES } from 'vault/utils/model-helpers/database-helpers';
+
+module('Unit | Model | database/connection', function (hooks) {
+  setupTest(hooks);
+
+  hooks.beforeEach(async function () {
+    this.store = this.owner.lookup('service:store');
+    this.version = this.owner.lookup('service:version');
+    // setting version here so tests can be run locally on CE or ENT
+    this.version.type = 'community';
+
+    this.createModel = (plugin) =>
+      this.store.createRecord('database/connection', {
+        plugin_name: plugin,
+      });
+  });
+
+  for (const plugin of AVAILABLE_PLUGIN_TYPES.map((p) => p.value)) {
+    module(`it computes fields for plugin_type: ${plugin}`, function (hooks) {
+      hooks.beforeEach(function () {
+        this.model = this.createModel(plugin);
+        this.getActual = (group) => this.model[group];
+        this.getExpected = (group) => EXPECTED_FIELDS[plugin][group];
+
+        const pluginFields = AVAILABLE_PLUGIN_TYPES.find((o) => o.value === plugin).fields;
+        this.pluginHasTlsOptions = pluginFields.some((f) => f.subgroup === 'TLS options');
+        this.pluginHasEnterpriseAttrs = pluginFields.some((f) => f.isEnterprise);
+      });
+
+      test('it computes showAttrs', function (assert) {
+        const actual = this.getActual('showAttrs').map((a) => a.name);
+        const expected = this.getExpected('showAttrs');
+        assert.propEqual(actual, expected, 'actual computed attrs match expected');
+      });
+
+      test('it computes fieldAttrs', function (assert) {
+        const actual = this.getActual('fieldAttrs').map((a) => a.name);
+        const expected = this.getExpected('fieldAttrs');
+        assert.propEqual(actual, expected, 'actual computed attrs match expected');
+      });
+
+      test('it computes default group', function (assert) {
+        // pluginFieldGroups is an array of group objects
+        const [actualDefault] = this.getActual('pluginFieldGroups');
+
+        assert.propEqual(
+          actualDefault.default.map((a) => a.name),
+          this.getExpected('default'),
+          'it has expected default group attributes'
+        );
+      });
+
+      test('it computes statementFields', function (assert) {
+        const actual = this.getActual('statementFields');
+        const expected = this.getExpected('statementFields');
+        assert.propEqual(actual, expected, 'actual computed attrs match expected');
+      });
+
+      if (this.pluginHasTlsOptions) {
+        test('it computes TLS options group', function (assert) {
+          // pluginFieldGroups is an array of group objects
+          const [, actualTlsOptions] = this.getActual('pluginFieldGroups');
+
+          assert.propEqual(
+            actualTlsOptions['TLS options'].map((a) => a.name),
+            this.getExpected('TLS options'),
+            'it has expected TLS options'
+          );
+        });
+      }
+
+      if (this.pluginHasEnterpriseAttrs) {
+        test('it includes enterprise fields', function (assert) {
+          this.version.type = 'enterprise';
+          const [actualDefault] = this.getActual('pluginFieldGroups');
+          const expected = this.getExpected('default').push(this.getExpected('enterpriseOnly'));
+          assert.propEqual(
+            actualDefault.default.map((a) => a.name),
+            expected,
+            'it includes enterprise attributes'
+          );
+        });
+      }
+    });
+  }
+});
diff --git a/ui/tests/unit/models/generated-item-test.js b/ui/tests/unit/models/generated-item-test.js
new file mode 100644
index 00000000000..0016d529990
--- /dev/null
+++ b/ui/tests/unit/models/generated-item-test.js
@@ -0,0 +1,18 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+
+import { setupTest } from 'vault/tests/helpers';
+
+module('Unit | Model | generated item', function (hooks) {
+  setupTest(hooks);
+
+  test('it exists', function (assert) {
+    const store = this.owner.lookup('service:store');
+    const model = store.createRecord('generated-item', {});
+    assert.ok(model, 'generated-item model exists');
+  });
+});
diff --git a/ui/tests/unit/models/role-jwt-test.js b/ui/tests/unit/models/role-jwt-test.js
deleted file mode 100644
index 71777c4c7ea..00000000000
--- a/ui/tests/unit/models/role-jwt-test.js
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-/* eslint qunit/no-conditional-assertions: "warn" */
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-import { DOMAIN_STRINGS, PROVIDER_WITH_LOGO } from 'vault/models/role-jwt';
-
-module('Unit | Model | role-jwt', function (hooks) {
-  setupTest(hooks);
-
-  test('it exists', function (assert) {
-    const model = this.owner.lookup('service:store').createRecord('role-jwt');
-    assert.ok(!!model);
-    assert.strictEqual(model.providerName, null, 'no providerName');
-    assert.strictEqual(model.providerIcon, null, 'no providerIcon');
-  });
-
-  test('it computes providerName when known provider url match fails', function (assert) {
-    const model = this.owner.lookup('service:store').createRecord('role-jwt', {
-      authUrl: 'http://example.com',
-    });
-
-    assert.strictEqual(model.providerName, null, 'no providerName');
-    assert.strictEqual(model.providerIcon, null, 'no providerIcon');
-  });
-
-  test('it provides a providerName for listed known providers', function (assert) {
-    assert.expect(12);
-    Object.keys(DOMAIN_STRINGS).forEach((domain) => {
-      const model = this.owner.lookup('service:store').createRecord('role-jwt', {
-        authUrl: `http://provider-${domain}`,
-      });
-
-      const expectedName = DOMAIN_STRINGS[domain];
-      assert.strictEqual(model.providerName, expectedName, `computes providerName: ${expectedName}`);
-      let expectedIcon = null;
-      if (PROVIDER_WITH_LOGO[expectedName]) {
-        expectedIcon = expectedName.toLowerCase();
-      }
-      assert.strictEqual(model.providerIcon, expectedIcon, `computes providerIcon: ${domain}`);
-    });
-  });
-
-  test('it does not return provider unless domain matches completely', function (assert) {
-    assert.expect(2);
-    const model = this.owner.lookup('service:store').createRecord('role-jwt', {
-      authUrl: `http://custom-auth0-provider.com`,
-    });
-    assert.strictEqual(model.providerName, null, `no providerName for custom URL`);
-    assert.strictEqual(model.providerIcon, null, 'no providerIcon for custom URL');
-  });
-});
diff --git a/ui/tests/unit/models/secret-engine-test.js b/ui/tests/unit/models/secret-engine-test.js
index bbcf09dfd87..4cfdd981bc1 100644
--- a/ui/tests/unit/models/secret-engine-test.js
+++ b/ui/tests/unit/models/secret-engine-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -25,6 +25,7 @@ module('Unit | Model | secret-engine', function (hooks) {
         'path',
         'description',
         'accessor',
+        'runningPluginVersion',
         'local',
         'sealWrap',
         'config.defaultLeaseTtl',
@@ -48,6 +49,7 @@ module('Unit | Model | secret-engine', function (hooks) {
         'path',
         'description',
         'accessor',
+        'runningPluginVersion',
         'local',
         'sealWrap',
         'config.defaultLeaseTtl',
@@ -73,6 +75,7 @@ module('Unit | Model | secret-engine', function (hooks) {
         'path',
         'description',
         'accessor',
+        'runningPluginVersion',
         'local',
         'sealWrap',
         'config.defaultLeaseTtl',
@@ -100,6 +103,7 @@ module('Unit | Model | secret-engine', function (hooks) {
         'path',
         'description',
         'accessor',
+        'runningPluginVersion',
         'local',
         'sealWrap',
         'config.allowedManagedKeys',
@@ -109,13 +113,38 @@ module('Unit | Model | secret-engine', function (hooks) {
         'config.allowedResponseHeaders',
       ]);
     });
+
+    test('it returns correct fields for aws', function (assert) {
+      assert.expect(1);
+      const model = this.store.createRecord('secret-engine', {
+        type: 'aws',
+      });
+
+      assert.deepEqual(model.get('formFields'), [
+        'type',
+        'path',
+        'description',
+        'accessor',
+        'runningPluginVersion',
+        'local',
+        'sealWrap',
+        'config.defaultLeaseTtl',
+        'config.maxLeaseTtl',
+        'config.allowedManagedKeys',
+        'config.auditNonHmacRequestKeys',
+        'config.auditNonHmacResponseKeys',
+        'config.passthroughRequestHeaders',
+        'config.allowedResponseHeaders',
+        'config.identityTokenKey',
+      ]);
+    });
   });
 
   module('formFieldGroups', function () {
     test('returns correct values by default', function (assert) {
       assert.expect(1);
       const model = this.store.createRecord('secret-engine', {
-        type: 'aws',
+        type: 'cubbyhole',
       });
 
       assert.deepEqual(model.get('formFieldGroups'), [
@@ -261,6 +290,33 @@ module('Unit | Model | secret-engine', function (hooks) {
         },
       ]);
     });
+
+    test('returns correct values for aws', function (assert) {
+      assert.expect(1);
+      const model = this.store.createRecord('secret-engine', {
+        type: 'aws',
+      });
+
+      assert.deepEqual(model.get('formFieldGroups'), [
+        { default: ['path'] },
+        {
+          'Method Options': [
+            'description',
+            'config.listingVisibility',
+            'local',
+            'sealWrap',
+            'config.defaultLeaseTtl',
+            'config.maxLeaseTtl',
+            'config.identityTokenKey',
+            'config.allowedManagedKeys',
+            'config.auditNonHmacRequestKeys',
+            'config.auditNonHmacResponseKeys',
+            'config.passthroughRequestHeaders',
+            'config.allowedResponseHeaders',
+          ],
+        },
+      ]);
+    });
   });
 
   module('engineType', function () {
@@ -346,80 +402,6 @@ module('Unit | Model | secret-engine', function (hooks) {
     });
   });
 
-  module('saveCA', function () {
-    test('does not call endpoint if type != ssh', async function (assert) {
-      assert.expect(1);
-      const model = this.store.createRecord('secret-engine', {
-        type: 'not-ssh',
-      });
-      const saveSpy = sinon.spy(model, 'save');
-      await model.saveCA({});
-      assert.ok(saveSpy.notCalled, 'save not called');
-    });
-    test('calls save with correct params', async function (assert) {
-      assert.expect(4);
-      const model = this.store.createRecord('secret-engine', {
-        type: 'ssh',
-        privateKey: 'private-key',
-        publicKey: 'public-key',
-        generateSigningKey: true,
-      });
-      const saveStub = sinon.stub(model, 'save').callsFake((params) => {
-        assert.deepEqual(
-          params,
-          {
-            adapterOptions: {
-              options: {},
-              apiPath: 'config/ca',
-              attrsToSend: ['privateKey', 'publicKey', 'generateSigningKey'],
-            },
-          },
-          'send correct params to save'
-        );
-        return;
-      });
-
-      await model.saveCA({});
-      assert.strictEqual(model.privateKey, 'private-key', 'value exists before save');
-      assert.strictEqual(model.publicKey, 'public-key', 'value exists before save');
-      assert.true(model.generateSigningKey, 'value true before save');
-
-      saveStub.restore();
-    });
-    test('sets properties when isDelete', async function (assert) {
-      assert.expect(7);
-      const model = this.store.createRecord('secret-engine', {
-        type: 'ssh',
-        privateKey: 'private-key',
-        publicKey: 'public-key',
-        generateSigningKey: true,
-      });
-      const saveStub = sinon.stub(model, 'save').callsFake((params) => {
-        assert.deepEqual(
-          params,
-          {
-            adapterOptions: {
-              options: { isDelete: true },
-              apiPath: 'config/ca',
-              attrsToSend: ['privateKey', 'publicKey', 'generateSigningKey'],
-            },
-          },
-          'send correct params to save'
-        );
-        return;
-      });
-      assert.strictEqual(model.privateKey, 'private-key', 'value exists before save');
-      assert.strictEqual(model.publicKey, 'public-key', 'value exists before save');
-      assert.true(model.generateSigningKey, 'value true before save');
-
-      await model.saveCA({ isDelete: true });
-      assert.strictEqual(model.privateKey, null, 'value null after save');
-      assert.strictEqual(model.publicKey, null, 'value null after save');
-      assert.false(model.generateSigningKey, 'value false after save');
-      saveStub.restore();
-    });
-  });
-
   module('saveZeroAddressConfig', function () {
     test('calls save with correct params', async function (assert) {
       assert.expect(1);
diff --git a/ui/tests/unit/models/transit-key-test.js b/ui/tests/unit/models/transit-key-test.js
index 2234039825a..a9ac11b47b7 100644
--- a/ui/tests/unit/models/transit-key-test.js
+++ b/ui/tests/unit/models/transit-key-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/routes/vault/cluster/dashboard-test.js b/ui/tests/unit/routes/vault/cluster/dashboard-test.js
index a9a4f95374b..4126c0350fe 100644
--- a/ui/tests/unit/routes/vault/cluster/dashboard-test.js
+++ b/ui/tests/unit/routes/vault/cluster/dashboard-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/routes/vault/cluster/oidc-callback-test.js b/ui/tests/unit/routes/vault/cluster/oidc-callback-test.js
index 99ce56d6a29..3426945c246 100644
--- a/ui/tests/unit/routes/vault/cluster/oidc-callback-test.js
+++ b/ui/tests/unit/routes/vault/cluster/oidc-callback-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/routes/vault/cluster/redirect-test.js b/ui/tests/unit/routes/vault/cluster/redirect-test.js
index 96f1b70103b..0856ad397a1 100644
--- a/ui/tests/unit/routes/vault/cluster/redirect-test.js
+++ b/ui/tests/unit/routes/vault/cluster/redirect-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/serializers/cluster-test.js b/ui/tests/unit/serializers/cluster-test.js
index b4e03889562..b04cc1389b9 100644
--- a/ui/tests/unit/serializers/cluster-test.js
+++ b/ui/tests/unit/serializers/cluster-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/serializers/config-ui/message-test.js b/ui/tests/unit/serializers/config-ui/message-test.js
deleted file mode 100644
index 40e5c83d757..00000000000
--- a/ui/tests/unit/serializers/config-ui/message-test.js
+++ /dev/null
@@ -1,72 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: MPL-2.0
- */
-
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-
-module('Unit | Serializer | config-ui/message', function (hooks) {
-  setupTest(hooks);
-
-  test('it should always encode message when creating/updating a message', function (assert) {
-    const store = this.owner.lookup('service:store');
-    const record = store.createRecord('config-ui/message', {
-      id: '01234567-89ab-cdef-0123-456789abcdef',
-      active: true,
-      type: 'banner',
-      authenticated: true,
-      title: 'Message title 1',
-      message: 'Some long long long message',
-      link: { title: '', href: '' },
-      startTime: '2024-01-03T20:54:29.802Z',
-      endTime: '',
-    });
-    const expectedResult = {
-      authenticated: true,
-      end_time: null,
-      link: {
-        href: '',
-        title: '',
-      },
-      message: 'U29tZSBsb25nIGxvbmcgbG9uZyBtZXNzYWdl',
-      start_time: '2024-01-03T20:54:29.802Z',
-      title: 'Message title 1',
-      type: 'banner',
-    };
-
-    const serializedRecord = record.serialize();
-    assert.deepEqual(serializedRecord, expectedResult, 'encode the message string');
-  });
-
-  test('it should always use ISO date format when creating/updating a message', function (assert) {
-    const store = this.owner.lookup('service:store');
-    const date = new Date();
-    const record = store.createRecord('config-ui/message', {
-      id: '01234567-89ab-cdef-0123-456789abcdef',
-      active: true,
-      type: 'banner',
-      authenticated: true,
-      title: 'Message title 1',
-      message: 'Some long long long message',
-      link: { title: '', href: '' },
-      startTime: date,
-      endTime: '',
-    });
-    const expectedResult = {
-      authenticated: true,
-      end_time: null,
-      link: {
-        href: '',
-        title: '',
-      },
-      message: 'U29tZSBsb25nIGxvbmcgbG9uZyBtZXNzYWdl',
-      start_time: date.toISOString(),
-      title: 'Message title 1',
-      type: 'banner',
-    };
-
-    const serializedRecord = record.serialize();
-    assert.deepEqual(serializedRecord, expectedResult, 'uses ISO date string');
-  });
-});
diff --git a/ui/tests/unit/serializers/database/connection-test.js b/ui/tests/unit/serializers/database/connection-test.js
index 13b73871aa9..1f65f4cebbf 100644
--- a/ui/tests/unit/serializers/database/connection-test.js
+++ b/ui/tests/unit/serializers/database/connection-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -26,6 +26,7 @@ module('Unit | Serializer | database/connection', function (hooks) {
       url: 'http://localhost:9200',
       username: 'elastic',
       password: 'changeme',
+      skip_static_role_rotation_import: false,
       tls_ca: 'some-value',
       ca_cert: undefined, // does not send undefined values
     });
@@ -38,6 +39,7 @@ module('Unit | Serializer | database/connection', function (hooks) {
       url: 'http://localhost:9200',
       username: 'elastic',
       password: 'changeme',
+      skip_static_role_rotation_import: false,
       insecure: false,
     };
 
@@ -79,12 +81,6 @@ module('Unit | Serializer | database/connection', function (hooks) {
     const expectedResult = {
       allowed_roles: ['readonly'],
       backend: 'database',
-      connection_details: {
-        backend: 'database',
-        insecure: false,
-        url: 'https://localhost:9200',
-        username: 'root',
-      },
       id: 'elastic-test',
       insecure: false,
       name: 'elastic-test',
@@ -98,4 +94,111 @@ module('Unit | Serializer | database/connection', function (hooks) {
     };
     assert.deepEqual(normalized, expectedResult, `Normalizes and flattens database response`);
   });
+
+  test('it should normalize values for the database type (oracle)', function (assert) {
+    const serializer = this.owner.lookup('serializer:database/connection');
+    const normalized = serializer.normalizeSecrets({
+      request_id: 'request-id',
+      lease_id: '',
+      renewable: false,
+      lease_duration: 0,
+      data: {
+        allowed_roles: ['*'],
+        connection_details: {
+          backend: 'database',
+          connection_url: '%7B%7Busername%7D%7D/%7B%7Bpassword%7D%7D@//localhost:1521/ORCLPDB1',
+          max_connection_lifetime: '0s',
+          max_idle_connections: 0,
+          max_open_connections: 3,
+          username: 'VAULTADMIN',
+        },
+        password_policy: '',
+        plugin_name: 'vault-plugin-database-oracle',
+        plugin_version: '',
+        root_credentials_rotate_statements: [],
+        verify_connection: true,
+      },
+      wrap_info: null,
+      warnings: null,
+      auth: null,
+      mount_type: 'database',
+      backend: 'database',
+      id: 'oracle-test',
+    });
+    const expectedResult = {
+      allowed_roles: ['*'],
+      backend: 'database',
+      connection_url: '{{username}}/{{password}}@//localhost:1521/ORCLPDB1',
+      id: 'oracle-test',
+      max_connection_lifetime: '0s',
+      max_idle_connections: 0,
+      max_open_connections: 3,
+      name: 'oracle-test',
+      password_policy: '',
+      plugin_name: 'vault-plugin-database-oracle',
+      plugin_version: '',
+      root_credentials_rotate_statements: [],
+      root_rotation_statements: [],
+      username: 'VAULTADMIN',
+      verify_connection: true,
+    };
+    assert.deepEqual(normalized, expectedResult, `Normalizes and flattens database response`);
+  });
+
+  test('it should normalize values if some params do not exist', function (assert) {
+    const serializer = this.owner.lookup('serializer:database/connection');
+    const normalized = serializer.normalizeSecrets({
+      request_id: 'request-id',
+      lease_id: '',
+      renewable: false,
+      lease_duration: 0,
+      data: {
+        allowed_roles: ['*'],
+        connection_details: { backend: 'database' }, // no connection_url param intentionally
+        plugin_name: 'vault-postgres-db',
+      },
+      wrap_info: null,
+      warnings: null,
+      auth: null,
+      mount_type: 'database',
+      backend: 'database',
+      id: 'db-test',
+    });
+    const expectedResult = {
+      allowed_roles: ['*'],
+      backend: 'database',
+      id: 'db-test',
+      name: 'db-test',
+      plugin_name: 'vault-postgres-db',
+    };
+    assert.deepEqual(normalized, expectedResult, `Normalizes and flattens database response`);
+  });
+
+  test('it should fail gracefully if no connection_details', function (assert) {
+    const serializer = this.owner.lookup('serializer:database/connection');
+    const normalized = serializer.normalizeSecrets({
+      request_id: 'request-id',
+      lease_id: '',
+      renewable: false,
+      lease_duration: 0,
+      data: {
+        allowed_roles: ['*'],
+        plugin_name: 'vault-postgres-db',
+      },
+      wrap_info: null,
+      warnings: null,
+      auth: null,
+      mount_type: 'database',
+      backend: 'database',
+      id: 'db-test',
+    });
+    const expectedResult = {
+      allowed_roles: ['*'],
+      backend: 'database',
+      id: 'db-test',
+      name: 'db-test',
+      plugin_name: 'vault-postgres-db',
+    };
+    assert.deepEqual(normalized, expectedResult, `Normalizes and flattens database response`);
+  });
 });
diff --git a/ui/tests/unit/serializers/kv/data-test.js b/ui/tests/unit/serializers/kv/data-test.js
deleted file mode 100644
index 611d0d0c1f4..00000000000
--- a/ui/tests/unit/serializers/kv/data-test.js
+++ /dev/null
@@ -1,31 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-
-module('Unit | Serializer | kv/data', function (hooks) {
-  setupTest(hooks);
-
-  test('it should always pass the cas option when creating/updating a secret', function (assert) {
-    const store = this.owner.lookup('service:store');
-    const record = store.createRecord('kv/data', {
-      path: 'my-secret-path',
-      backend: 'kv-test',
-      version: 2,
-      casVersion: 3,
-      secretData: { foo: 'bar' },
-    });
-    const expectedResult = {
-      data: { foo: 'bar' },
-      options: {
-        cas: 3,
-      },
-    };
-
-    const serializedRecord = record.serialize();
-    assert.deepEqual(serializedRecord, expectedResult, 'cas option was correctly added to the payload.');
-  });
-});
diff --git a/ui/tests/unit/serializers/kv/metadata-test.js b/ui/tests/unit/serializers/kv/metadata-test.js
deleted file mode 100644
index fa7116840ac..00000000000
--- a/ui/tests/unit/serializers/kv/metadata-test.js
+++ /dev/null
@@ -1,88 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-
-module('Unit | Serializer | kv/metadata', function (hooks) {
-  setupTest(hooks);
-
-  test('it should properly normalize a list response', function (assert) {
-    const serializer = this.owner.lookup('serializer:kv/metadata');
-    const serverData = {
-      request_id: 'foo',
-      backend: 'my-backend',
-      path: '',
-      data: {
-        keys: ['first', 'second', 'third/'],
-      },
-    };
-    const expectedData = [
-      {
-        id: 'my-backend/metadata/first',
-        path: 'first',
-        backend: 'my-backend',
-        full_secret_path: 'first',
-      },
-      {
-        id: 'my-backend/metadata/second',
-        path: 'second',
-        backend: 'my-backend',
-        full_secret_path: 'second',
-      },
-      {
-        id: 'my-backend/metadata/third/',
-        path: 'third/',
-        backend: 'my-backend',
-        full_secret_path: 'third/',
-      },
-    ];
-
-    const serializedRecord = serializer.normalizeItems(serverData);
-    assert.deepEqual(serializedRecord, expectedData, 'transformed keys into proper IDs');
-  });
-
-  test('it should properly normalize a nested secret list response', function (assert) {
-    const serializer = this.owner.lookup('serializer:kv/metadata');
-    const serverData = {
-      request_id: 'foo',
-      backend: 'my-backend',
-      path: 'beep/',
-      data: {
-        keys: ['boop/'],
-      },
-    };
-    const expectedData = [
-      {
-        id: 'my-backend/metadata/beep/boop/',
-        path: 'boop/',
-        backend: 'my-backend',
-        full_secret_path: 'beep/boop/',
-      },
-    ];
-    const serializedRecord = serializer.normalizeItems(serverData);
-    assert.deepEqual(serializedRecord, expectedData, 'transformed keys into proper IDs');
-  });
-
-  test('it throws an assertion if backend not on payload', function (assert) {
-    const serializer = this.owner.lookup('serializer:kv/metadata');
-    const serverData = {
-      request_id: 'foo',
-      data: {
-        keys: ['first', 'second'],
-      },
-    };
-    let result;
-    try {
-      result = serializer.normalizeItems(serverData);
-    } catch (e) {
-      result = e.message;
-    }
-    assert.strictEqual(
-      result,
-      'Assertion Failed: payload.backend must be provided on kv/metadata list response'
-    );
-  });
-});
diff --git a/ui/tests/unit/serializers/ldap/library-test.js b/ui/tests/unit/serializers/ldap/library-test.js
index 30dab84d1eb..6802ebe11e5 100644
--- a/ui/tests/unit/serializers/ldap/library-test.js
+++ b/ui/tests/unit/serializers/ldap/library-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/serializers/ldap/role-test.js b/ui/tests/unit/serializers/ldap/role-test.js
index 189fa069265..51445f9aa4e 100644
--- a/ui/tests/unit/serializers/ldap/role-test.js
+++ b/ui/tests/unit/serializers/ldap/role-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/serializers/mfa-login-enforcement-test.js b/ui/tests/unit/serializers/mfa-login-enforcement-test.js
index dd10c172aed..dafd49b66ab 100644
--- a/ui/tests/unit/serializers/mfa-login-enforcement-test.js
+++ b/ui/tests/unit/serializers/mfa-login-enforcement-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/serializers/pki/action-test.js b/ui/tests/unit/serializers/pki/action-test.js
index 6fa31c2845f..8913ffde268 100644
--- a/ui/tests/unit/serializers/pki/action-test.js
+++ b/ui/tests/unit/serializers/pki/action-test.js
@@ -1,11 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'vault/tests/helpers';
-import { rootPem } from 'vault/tests/helpers/pki/values';
+import { CERTIFICATES } from 'vault/tests/helpers/pki/pki-helpers';
+
+const { rootPem } = CERTIFICATES;
 
 module('Unit | Serializer | pki/action', function (hooks) {
   setupTest(hooks);
diff --git a/ui/tests/unit/serializers/policy-test.js b/ui/tests/unit/serializers/policy-test.js
index a6e172023d3..53dfbc8ac5e 100644
--- a/ui/tests/unit/serializers/policy-test.js
+++ b/ui/tests/unit/serializers/policy-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/serializers/secret-engine-test.js b/ui/tests/unit/serializers/secret-engine-test.js
index ede64c9e0fc..d5a979185f4 100644
--- a/ui/tests/unit/serializers/secret-engine-test.js
+++ b/ui/tests/unit/serializers/secret-engine-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/serializers/sync/associations-test.js b/ui/tests/unit/serializers/sync/associations-test.js
index b6728e2e047..bf5c7d91532 100644
--- a/ui/tests/unit/serializers/sync/associations-test.js
+++ b/ui/tests/unit/serializers/sync/associations-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -26,8 +26,8 @@ module('Unit | Serializer | sync | association', function (hooks) {
     const payload = {
       data: {
         associated_secrets: {
-          'foo/bar': associations[0],
-          'test/my-secret': associations[1],
+          'foo_12345/bar': associations[0],
+          'test_12345/my-secret': associations[1],
         },
         store_name: destinationName,
         store_type: destinationType,
@@ -46,13 +46,13 @@ module('Unit | Serializer | sync | association', function (hooks) {
     const payload = {
       data: {
         associated_secrets: {
-          'foo/bar': {
+          'foo_12345/bar': {
             mount: 'foo',
             secret_name: 'bar',
             sync_status: 'SYNCED',
             updated_at: '2023-09-20T10:51:53.961861096-04:00',
           },
-          'bar/baz': {
+          'bar_12345/baz': {
             mount: 'bar',
             secret_name: 'baz',
             sync_status: 'UNSYNCED',
@@ -69,13 +69,13 @@ module('Unit | Serializer | sync | association', function (hooks) {
       type: 'aws-sm',
       associationCount: 2,
       status: '1 Unsynced',
-      lastUpdated: new Date(payload.data.associated_secrets['bar/baz'].updated_at),
+      lastUpdated: new Date(payload.data.associated_secrets['bar_12345/baz'].updated_at),
     };
     let normalized = this.serializer.normalizeFetchByDestinations(payload);
 
     assert.deepEqual(normalized, expected, 'Response is normalized from fetchByDestinations request');
 
-    payload.data.associated_secrets['bar/baz'].sync_status = 'SYNCED';
+    payload.data.associated_secrets['bar_12345/baz'].sync_status = 'SYNCED';
     normalized = this.serializer.normalizeFetchByDestinations(payload);
 
     assert.strictEqual(
diff --git a/ui/tests/unit/serializers/sync/destinations-test.js b/ui/tests/unit/serializers/sync/destinations-test.js
index e98f7c94697..844e15cb071 100644
--- a/ui/tests/unit/serializers/sync/destinations-test.js
+++ b/ui/tests/unit/serializers/sync/destinations-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/serializers/transit-key-test.js b/ui/tests/unit/serializers/transit-key-test.js
index 96d533ec9c9..a77568715b4 100644
--- a/ui/tests/unit/serializers/transit-key-test.js
+++ b/ui/tests/unit/serializers/transit-key-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/services/analytics-test.js b/ui/tests/unit/services/analytics-test.js
new file mode 100644
index 00000000000..8f219b2c21d
--- /dev/null
+++ b/ui/tests/unit/services/analytics-test.js
@@ -0,0 +1,80 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+
+import sinon from 'sinon';
+
+import { setupTest } from 'vault/tests/helpers';
+
+class ProviderStub {
+  name = 'testing';
+
+  start = sinon.stub();
+  identify = sinon.stub();
+  trackPageView = sinon.stub();
+}
+
+module('Unit | Service | analytics', function (hooks) {
+  setupTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.service = this.owner.lookup('service:analytics');
+  });
+
+  hooks.afterEach(function () {
+    sinon.reset();
+  });
+
+  test('#identifyUser passes data to the provider', function (assert) {
+    const providerStub = new ProviderStub();
+    this.service.provider = providerStub;
+
+    const identifier = 'carl';
+    const traits = { apples: 'oranges' };
+
+    this.service.identifyUser(identifier, traits);
+
+    assert.true(providerStub.identify.calledOnce, 'the service calls identify on the provider');
+    assert.true(
+      providerStub.identify.calledWith(identifier, traits),
+      'the provider recieves the expected id and traits'
+    );
+  });
+
+  test('#trackPageView passes data to the provider', function (assert) {
+    const providerStub = new ProviderStub();
+    this.service.provider = providerStub;
+
+    this.service.trackPageView('test', { currentRouteName: 'ham' });
+
+    assert.true(providerStub.trackPageView.called, 'it calls the tracking method on the provider');
+    assert.true(
+      providerStub.trackPageView.calledWith('test', { currentRouteName: 'ham' }),
+      'it passes the correct args to the provider'
+    );
+  });
+
+  module('#log', function (hooks) {
+    hooks.beforeEach(function () {
+      // eslint-disable-next-line no-console
+      console.log = sinon.stub(console, 'log');
+    });
+
+    hooks.afterEach(function () {
+      // eslint-disable-next-line no-console
+      console.log.restore();
+    });
+
+    test('logging is not shown when inactive', function (assert) {
+      this.service.debug = false;
+      // for the next few lines, console.log WILL NOT WORK AS EXPECTED
+      this.service.trackPageView('a', null);
+
+      // eslint-disable-next-line no-console
+      assert.true(console.log.notCalled, 'console.log is called');
+    });
+  });
+});
diff --git a/ui/tests/unit/services/api-test.js b/ui/tests/unit/services/api-test.js
new file mode 100644
index 00000000000..086afec426c
--- /dev/null
+++ b/ui/tests/unit/services/api-test.js
@@ -0,0 +1,255 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+import sinon from 'sinon';
+import config from 'vault/config/environment';
+import { getErrorResponse } from 'vault/tests/helpers/api/error-response';
+
+module('Unit | Service | api', function (hooks) {
+  setupTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.apiService = this.owner.lookup('service:api');
+
+    const authService = this.owner.lookup('service:auth');
+    this.setLastFetch = sinon.spy(authService, 'setLastFetch');
+    this.currentToken = sinon.stub(authService, 'currentToken').value('foobar');
+
+    const namespaceService = this.owner.lookup('service:namespace');
+    this.namespace = sinon.stub(namespaceService, 'path').value('another-ns');
+
+    const controlGroupService = this.owner.lookup('service:control-group');
+    this.wrapInfo = { token: 'ctrl-group', accessor: '84tfdfd5pQ5vOOEMxC2o3Ymt' };
+    this.tokenForUrl = sinon.stub(controlGroupService, 'tokenForUrl').returns(this.wrapInfo);
+    this.tokenToUnwrap = sinon.stub(controlGroupService, 'tokenToUnwrap').value(this.wrapInfo);
+    this.deleteControlGroupToken = sinon.spy(controlGroupService, 'deleteControlGroupToken');
+    this.isRequestedPathLocked = sinon.stub(controlGroupService, 'isRequestedPathLocked').returns(true);
+
+    const flashMessageService = this.owner.lookup('service:flash-messages');
+    this.info = sinon.spy(flashMessageService, 'info');
+
+    this.url = '/v1/sys/capabilities-self';
+  });
+
+  test('it should set last fetch time', async function (assert) {
+    await this.apiService.setLastFetch({ url: '/v1/sys/health' });
+    assert.true(this.setLastFetch.notCalled, 'Last fetch is not set for polling url');
+
+    await this.apiService.setLastFetch({ url: '/v1/auth/token/lookup-self' });
+    assert.true(this.setLastFetch.calledOnce, 'Last fetch is set for non polling url');
+  });
+
+  test('it should get control group token', async function (assert) {
+    const context = {
+      url: this.url,
+      init: {
+        method: 'GET',
+        headers: { 'X-Vault-Token': 'root' },
+      },
+    };
+
+    this.tokenForUrl.returns(undefined);
+    const noTokenContext = await this.apiService.getControlGroupToken(context);
+
+    assert.true(this.tokenForUrl.calledWith(context.url), 'Url is passed to tokenForUrl method');
+    assert.deepEqual(context, noTokenContext, 'Original context is returned when no token is present');
+
+    this.tokenForUrl.returns(this.wrapInfo);
+
+    const { token } = this.wrapInfo;
+    const tokenContext = await this.apiService.getControlGroupToken(context);
+    const newContext = {
+      url: '/v1/sys/wrapping/unwrap',
+      init: {
+        method: 'POST',
+        headers: { 'X-Vault-Token': token },
+        body: JSON.stringify({ token }),
+      },
+    };
+
+    assert.deepEqual(tokenContext, newContext, 'New context is returned when token is present');
+  });
+
+  test('it should set default headers', async function (assert) {
+    const {
+      init: { headers },
+    } = await this.apiService.setHeaders({ init: { method: 'PATCH' } });
+
+    assert.strictEqual(
+      headers.get('X-Vault-Token'),
+      'foobar',
+      'Token header is set with value from auth service'
+    );
+    assert.strictEqual(
+      headers.get('X-Vault-Namespace'),
+      'another-ns',
+      'Namespace header is set with value from namespace service'
+    );
+    assert.strictEqual(
+      headers.get('Content-Type'),
+      'application/merge-patch+json',
+      'Content type header is set for PATCH method'
+    );
+  });
+
+  test('it should override default headers when set on request init', async function (assert) {
+    const initHeaders = {
+      'X-Vault-Token': 'root',
+      'X-Vault-Namespace': 'ns1',
+    };
+
+    const {
+      init: { headers },
+    } = await this.apiService.setHeaders({ init: { headers: initHeaders } });
+
+    assert.strictEqual(headers.get('X-Vault-Token'), 'root', 'Token header set on request init is preserved');
+    assert.strictEqual(
+      headers.get('X-Vault-Namespace'),
+      'ns1',
+      'Namespace header set on request init is preserved'
+    );
+  });
+
+  test('it should show warnings', async function (assert) {
+    const warnings = JSON.stringify({ warnings: ['warning1', 'warning2'] });
+    const response = new Response(warnings, { headers: { 'Content-Length': warnings.length } });
+
+    await this.apiService.showWarnings({ response });
+
+    assert.true(this.info.firstCall.calledWith('warning1'), 'First warning message is shown');
+    assert.true(this.info.secondCall.calledWith('warning2'), 'Second warning message is shown');
+  });
+
+  test('it should not attempt to set warnings for empty response', async function (assert) {
+    const response = new Response();
+    await this.apiService.showWarnings({ response });
+    assert.true(this.info.notCalled, 'No warning messages are shown');
+  });
+
+  test('it should check for control group', async function (assert) {
+    const headers = new Headers({ 'Content-Length': '100', 'X-Vault-Wrap-TTL': 1800 });
+    const body = { data: null, wrap_info: this.wrapInfo };
+    const init = { headers: new Headers({ 'X-Vault-Token': this.wrapInfo.token }) };
+    const apiResponse = new Response(JSON.stringify(body), { headers });
+
+    const response = await this.apiService.checkControlGroup({ url: this.url, response: apiResponse, init });
+
+    assert.true(
+      this.deleteControlGroupToken.calledWith(this.wrapInfo.accessor),
+      'Control group token is deleted'
+    );
+    assert.true(this.isRequestedPathLocked.calledWith(body, '1800'), 'isRequestedPathLocked called');
+
+    assert.strictEqual(response.status, 403, 'Response status is updated to 403 for control group error');
+    const ctrlError = await response.json();
+    const expectedError = {
+      message: 'Control Group encountered',
+      isControlGroupError: true,
+      ...this.wrapInfo,
+    };
+    assert.deepEqual(ctrlError, expectedError, 'Control group error is returned in response body');
+  });
+
+  test('it should build headers', async function (assert) {
+    const headerMap = {
+      token: 'foobar',
+      namespace: 'ns1',
+      wrap: '10s',
+    };
+
+    const token = await this.apiService.buildHeaders({ token: headerMap.token });
+    assert.deepEqual(token.headers, { 'X-Vault-Token': headerMap.token }, 'Token header is set');
+
+    const namespace = await this.apiService.buildHeaders({ namespace: headerMap.namespace });
+    assert.deepEqual(
+      namespace.headers,
+      { 'X-Vault-Namespace': headerMap.namespace },
+      'Namespace header is set'
+    );
+
+    const wrapTTL = await this.apiService.buildHeaders({ wrap: headerMap.wrap });
+    assert.deepEqual(wrapTTL.headers, { 'X-Vault-Wrap-TTL': '10s' }, 'Wrap TTL header is set');
+
+    const multi = await this.apiService.buildHeaders(headerMap);
+    assert.deepEqual(
+      multi.headers,
+      {
+        'X-Vault-Token': 'foobar',
+        'X-Vault-Namespace': 'ns1',
+        'X-Vault-Wrap-TTL': '10s',
+      },
+      'All supported headers are set'
+    );
+  });
+
+  test('it should map list response to array', async function (assert) {
+    const response = {
+      key_info: {
+        key1: { title: 'Title 1' },
+        key2: { title: 'Title 2' },
+      },
+      keys: ['key1', 'key2'],
+    };
+    const expectedResponse = [
+      { id: 'key1', title: 'Title 1' },
+      { id: 'key2', title: 'Title 2' },
+    ];
+    const listData = this.apiService.keyInfoToArray(response);
+    assert.deepEqual(listData, expectedResponse, 'List response is mapped to array');
+  });
+
+  module('Error parsing', function () {
+    test('it should correctly parse message from error', async function (assert) {
+      let e = await this.apiService.parseError(getErrorResponse());
+      assert.strictEqual(e.message, 'first error, second error', 'Builds message from errors');
+
+      e = await this.apiService.parseError(
+        getErrorResponse({ errors: [], message: 'there were some errors' })
+      );
+      assert.strictEqual(e.message, 'there were some errors', 'Returns message when errors are empty');
+
+      const error = new Error('some js type error');
+      e = await this.apiService.parseError(error);
+      assert.strictEqual(e.message, error.message, 'Returns message from generic Error');
+
+      e = await this.apiService.parseError('some random error');
+      assert.strictEqual(e.message, 'An error occurred, please try again', 'Returns default fallback');
+
+      const fallback = 'Everything is broken, sorry';
+      e = await this.apiService.parseError('some random error', fallback);
+      assert.strictEqual(e.message, fallback, 'Returns custom fallback');
+    });
+
+    test('it should return status', async function (assert) {
+      const { status } = await this.apiService.parseError(getErrorResponse());
+      assert.strictEqual(status, 404, 'Returns the status code from the response');
+    });
+
+    test('it should return path', async function (assert) {
+      const { path } = await this.apiService.parseError(getErrorResponse());
+      assert.strictEqual(path, '/v1/test/error/parsing', 'Returns the path from the request url');
+    });
+
+    test('it should return error response', async function (assert) {
+      const error = {
+        errors: ['something bad happened', 'something else bad too'],
+        message: 'all bad things occurred',
+      };
+      const { response } = await this.apiService.parseError(getErrorResponse(error));
+      assert.deepEqual(response, error, 'Returns the original error response');
+    });
+
+    test('it should log out error in development environment', async function (assert) {
+      const consoleStub = sinon.stub(console, 'log');
+      sinon.stub(config, 'environment').value('development');
+      const error = new Error('some js type error');
+      await this.apiService.parseError(error);
+      assert.true(consoleStub.calledWith('API Error:', error));
+      sinon.restore();
+    });
+  });
+});
diff --git a/ui/tests/unit/services/auth-test.js b/ui/tests/unit/services/auth-test.js
index fb6f41dcc96..06174b1f0d5 100644
--- a/ui/tests/unit/services/auth-test.js
+++ b/ui/tests/unit/services/auth-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,26 +9,74 @@ import { setupTest } from 'ember-qunit';
 module('Unit | Service | auth', function (hooks) {
   setupTest(hooks);
 
-  [
-    ['#calculateExpiration w/ttl', { ttl: 30 }, 30],
-    ['#calculateExpiration w/lease_duration', { ttl: 15 }, 15],
-  ].forEach(([testName, response, ttlValue]) => {
-    test(testName, function (assert) {
-      const now = Date.now();
-      const service = this.owner.factoryFor('service:auth').create({
-        now() {
-          return now;
-        },
-      });
+  hooks.beforeEach(function () {
+    this.service = this.owner.lookup('service:auth');
+  });
 
-      const resp = service.calculateExpiration(response);
+  module('#calculateExpiration', function () {
+    test('with a non-zero ttl value', function (assert) {
+      const now = Date.now();
+      const ttl = 30;
+      const expireTime = null;
+      const calculatedExpiry = this.service.calculateExpiration({ now, ttl, expireTime });
 
-      assert.strictEqual(resp.ttl, ttlValue, 'returns the ttl');
+      assert.strictEqual(calculatedExpiry.ttl, 30, 'returns the ttl');
       assert.strictEqual(
-        resp.tokenExpirationEpoch,
-        now + ttlValue * 1e3,
+        calculatedExpiry.tokenExpirationEpoch,
+        now + ttl * 1e3,
         'calculates expiration from ttl as epoch timestamp'
       );
     });
+
+    test('with a zero ttl value', function (assert) {
+      const now = Date.now();
+      const ttl = 0;
+      const expireTime = null;
+      const calculatedExpiry = this.service.calculateExpiration({ now, ttl, expireTime });
+
+      assert.strictEqual(calculatedExpiry.ttl, null, 'returns `null` for the ttl');
+      assert.strictEqual(calculatedExpiry.tokenExpirationEpoch, null, 'tokenExpirationEpoch is null');
+    });
+
+    test('#calculateExpiration w/ expireTime', function (assert) {
+      const now = Date.now();
+      const expirationString = '2024-06-13T09:10:21-07:00';
+      const expectedExpirationEpoch = new Date(expirationString).getTime();
+
+      const calculatedExpiry = this.service.calculateExpiration({
+        now,
+        ttl: 30,
+        expireTime: '2024-06-13T09:10:21-07:00',
+      });
+
+      assert.strictEqual(calculatedExpiry.ttl, 30, 'returns ttl');
+      assert.strictEqual(
+        calculatedExpiry.tokenExpirationEpoch,
+        expectedExpirationEpoch,
+        'calculates expiration from expireTime'
+      );
+    });
+  });
+
+  module('#setExpirationSettings', function () {
+    test('#setExpirationSettings for a renewable token', function (assert) {
+      const now = Date.now();
+      const renewable = true;
+
+      this.service.setExpirationSettings(renewable, now);
+
+      assert.false(this.service.allowExpiration, 'sets allowExpiration to false');
+      assert.strictEqual(this.service.expirationCalcTS, now, 'sets expirationCalcTS to now');
+    });
+
+    test('#setExpirationSettings for a non-renewable token', function (assert) {
+      const now = Date.now();
+      const renewable = false;
+
+      this.service.setExpirationSettings(renewable, now);
+
+      assert.true(this.service.allowExpiration, 'sets allowExpiration to true');
+      assert.strictEqual(this.service.expirationCalcTS, null, 'keeps expirationCalcTS as null');
+    });
   });
 });
diff --git a/ui/tests/unit/services/capabilities-test.js b/ui/tests/unit/services/capabilities-test.js
new file mode 100644
index 00000000000..48fb184b937
--- /dev/null
+++ b/ui/tests/unit/services/capabilities-test.js
@@ -0,0 +1,495 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import sinon from 'sinon';
+
+module('Unit | Service | capabilities', function (hooks) {
+  setupTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.capabilities = this.owner.lookup('service:capabilities');
+    this.generateResponse = ({ path, paths, capabilities }) => {
+      if (path) {
+        // "capabilities" is an array
+        return {
+          request_id: '6cc7a484-921a-a730-179c-eaf6c6fbe97e',
+          data: {
+            capabilities,
+            [path]: capabilities,
+          },
+        };
+      }
+      if (paths) {
+        // "capabilities" is an object, paths are keys and values are array of capabilities
+        const data = paths.reduce((obj, path) => {
+          obj[path] = capabilities[path];
+          return obj;
+        }, {});
+        return {
+          request_id: '6cc7a484-921a-a730-179c-eaf6c6fbe97e',
+          data,
+        };
+      }
+    };
+  });
+
+  test('fetch: it makes request to capabilities-self', async function (assert) {
+    const paths = ['/my/api/path', 'another/api/path'];
+    const expectedPayload = { paths };
+
+    this.server.post('/sys/capabilities-self', (schema, req) => {
+      const actual = JSON.parse(req.requestBody);
+      assert.true(true, 'request made to capabilities-self');
+      assert.propEqual(actual, expectedPayload, `request made with path: ${JSON.stringify(actual)}`);
+      return this.generateResponse({
+        paths,
+        capabilities: { '/my/api/path': ['read', 'list'], 'another/api/path': ['read', 'delete'] },
+      });
+    });
+
+    const actual = await this.capabilities.fetch(paths);
+    const expected = {
+      '/my/api/path': {
+        canCreate: false,
+        canDelete: false,
+        canList: true,
+        canPatch: false,
+        canRead: true,
+        canSudo: false,
+        canUpdate: false,
+      },
+      'another/api/path': {
+        canCreate: false,
+        canDelete: true,
+        canList: false,
+        canPatch: false,
+        canRead: true,
+        canSudo: false,
+        canUpdate: false,
+      },
+    };
+    assert.propEqual(actual, expected, `it returns expected response: ${JSON.stringify(actual)}`);
+  });
+
+  test('fetch: it defaults to true if the capabilities request fails', async function (assert) {
+    // don't stub endpoint which causes request to fail
+    const paths = ['/my/api/path', 'another/api/path'];
+    const actual = await this.capabilities.fetch(paths);
+    const expected = {
+      '/my/api/path': {
+        canCreate: true,
+        canDelete: true,
+        canList: true,
+        canPatch: true,
+        canRead: true,
+        canSudo: true,
+        canUpdate: true,
+      },
+      'another/api/path': {
+        canCreate: true,
+        canDelete: true,
+        canList: true,
+        canPatch: true,
+        canRead: true,
+        canSudo: true,
+        canUpdate: true,
+      },
+    };
+    assert.propEqual(actual, expected, `it returns expected response: ${JSON.stringify(actual)}`);
+  });
+
+  test('fetch: it defaults to true if no model is found', async function (assert) {
+    const paths = ['/my/api/path', 'another/api/path'];
+    const expectedPayload = { paths };
+
+    this.server.post('/sys/capabilities-self', (schema, req) => {
+      const actual = JSON.parse(req.requestBody);
+      assert.true(true, 'request made to capabilities-self');
+      assert.propEqual(actual, expectedPayload, `request made with path: ${JSON.stringify(actual)}`);
+      return this.generateResponse({
+        paths: ['/my/api/path'],
+        capabilities: { '/my/api/path': ['read', 'list'] },
+      });
+    });
+
+    const actual = await this.capabilities.fetch(paths);
+    const expected = {
+      '/my/api/path': {
+        canCreate: false,
+        canDelete: false,
+        canList: true,
+        canPatch: false,
+        canRead: true,
+        canSudo: false,
+        canUpdate: false,
+      },
+      'another/api/path': {
+        canCreate: true,
+        canDelete: true,
+        canList: true,
+        canPatch: true,
+        canRead: true,
+        canSudo: true,
+        canUpdate: true,
+      },
+    };
+    assert.propEqual(actual, expected, `it returns expected response: ${JSON.stringify(actual)}`);
+  });
+
+  test('fetchPathCapabilities: it makes request to capabilities-self and returns capabilities for single path', async function (assert) {
+    const path = '/my/api/path';
+    const expectedPayload = { paths: [path] };
+
+    this.server.post('/sys/capabilities-self', (schema, req) => {
+      const actual = JSON.parse(req.requestBody);
+      assert.true(true, 'request made to capabilities-self');
+      assert.propEqual(actual, expectedPayload, `request made with path: ${JSON.stringify(actual)}`);
+      return this.generateResponse({ path, capabilities: ['read'] });
+    });
+
+    const actual = await this.capabilities.fetchPathCapabilities(path);
+    const expected = {
+      canCreate: false,
+      canDelete: false,
+      canList: false,
+      canPatch: false,
+      canRead: true,
+      canSudo: false,
+      canUpdate: false,
+    };
+    assert.propEqual(actual, expected, 'returns capabilities for provided path');
+  });
+
+  test('pathFor: it should resolve the correct path to fetch capabilities', async function (assert) {
+    const syncActivate = this.capabilities.pathFor('syncActivate');
+    assert.strictEqual(
+      syncActivate,
+      'sys/activation-flags/secrets-sync/activate',
+      'pathFor returns expected path for syncActivate'
+    );
+
+    const syncDestination = this.capabilities.pathFor('syncDestination', { type: 'aws-sm', name: 'foo' });
+    assert.strictEqual(
+      syncDestination,
+      'sys/sync/destinations/aws-sm/foo',
+      'pathFor returns expected path for syncDestination'
+    );
+  });
+
+  test('for: it should fetch capabilities for single path using pathFor and fetchPathCapabilities methods', async function (assert) {
+    const pathForStub = sinon.spy(this.capabilities, 'pathFor');
+    const fetchPathCapabilitiesStub = sinon.stub(this.capabilities, 'fetchPathCapabilities').resolves();
+    await this.capabilities.for('customMessages', { id: 'foo' });
+    assert.true(pathForStub.calledWith('customMessages', { id: 'foo' }), 'pathFor called with expected args');
+    assert.true(
+      fetchPathCapabilitiesStub.calledWith('sys/config/ui/custom-messages/foo'),
+      'fetchPathCapabilities called with expected args'
+    );
+  });
+
+  module('specific methods', function () {
+    const path = '/my/api/path';
+    [
+      {
+        capabilities: ['read'],
+        expectedRead: true, // expected computed properties based on response
+        expectedUpdate: false,
+        expectedPatch: false,
+      },
+      {
+        capabilities: ['update'],
+        expectedRead: false,
+        expectedUpdate: true,
+        expectedPatch: false,
+      },
+      {
+        capabilities: ['patch'],
+        expectedRead: false,
+        expectedUpdate: false,
+        expectedPatch: true,
+      },
+      {
+        capabilities: ['deny'],
+        expectedRead: false,
+        expectedUpdate: false,
+        expectedPatch: false,
+      },
+      {
+        capabilities: ['read', 'update'],
+        expectedRead: true,
+        expectedUpdate: true,
+        expectedPatch: false,
+      },
+    ].forEach(({ capabilities, expectedRead, expectedUpdate, expectedPatch }) => {
+      test(`canRead returns expected value for "${capabilities.join(', ')}"`, async function (assert) {
+        this.server.post('/sys/capabilities-self', () => {
+          return this.generateResponse({ path, capabilities });
+        });
+
+        const response = await this.capabilities.canRead(path);
+        assert[expectedRead](response, `canRead returns ${expectedRead}`);
+      });
+
+      test(`canUpdate returns expected value for "${capabilities.join(', ')}"`, async function (assert) {
+        this.server.post('/sys/capabilities-self', () => {
+          return this.generateResponse({ path, capabilities });
+        });
+        const response = await this.capabilities.canUpdate(path);
+        assert[expectedUpdate](response, `canUpdate returns ${expectedUpdate}`);
+      });
+
+      test(`canPatch returns expected value for "${capabilities.join(', ')}"`, async function (assert) {
+        this.server.post('/sys/capabilities-self', () => {
+          return this.generateResponse({ path, capabilities });
+        });
+        const response = await this.capabilities.canPatch(path);
+        assert[expectedPatch](response, `canPatch returns ${expectedPatch}`);
+      });
+    });
+  });
+
+  module('within a namespace', function (hooks) {
+    // capabilities within namespaces are queried at the user's root namespace with a path that includes
+    // the relative namespace.
+    hooks.beforeEach(function () {
+      this.nsSvc = this.owner.lookup('service:namespace');
+      this.nsSvc.path = 'ns1';
+    });
+
+    test('fetchPathCapabilities works as expected', async function (assert) {
+      const ns = this.nsSvc.path;
+      const path = '/my/api/path';
+      const expectedAttrs = {
+        canCreate: false,
+        canDelete: false,
+        canList: true,
+        canPatch: false,
+        canRead: true,
+        canSudo: false,
+        canUpdate: false,
+      };
+
+      this.server.post('/sys/capabilities-self', (schema, req) => {
+        const actual = JSON.parse(req.requestBody);
+        assert.strictEqual(req.url, '/v1/sys/capabilities-self', 'request made to capabilities-self');
+        assert.propEqual(
+          actual.paths,
+          [`${ns}/my/api/path`],
+          `request made with path: ${JSON.stringify(actual)}`
+        );
+        return this.generateResponse({
+          path: `${ns}${path}`,
+          capabilities: ['read', 'list'],
+        });
+      });
+
+      const actual = await this.capabilities.fetchPathCapabilities(path);
+
+      Object.keys(expectedAttrs).forEach(function (key) {
+        assert.strictEqual(
+          actual[key],
+          expectedAttrs[key],
+          `record has expected value for ${key}: ${actual[key]}`
+        );
+      });
+    });
+
+    test('fetch works as expected', async function (assert) {
+      const ns = this.nsSvc.path;
+      // there was a bug when stripping the relativeNamespace from the key in the response data
+      // this would result in a leading slash in the returned key causing a mismatch if the path was provided without a leading slash
+      // ensure the provided path is returned by passing at least one path without a leading slash
+      const paths = ['my/api/path', '/another/api/path'];
+      const expectedPayload = [`${ns}/my/api/path`, `${ns}/another/api/path`];
+
+      this.server.post('/sys/capabilities-self', (schema, req) => {
+        const actual = JSON.parse(req.requestBody);
+        assert.strictEqual(req.url, '/v1/sys/capabilities-self', 'request made to capabilities-self');
+        assert.propEqual(actual.paths, expectedPayload, `request made with paths: ${JSON.stringify(actual)}`);
+        return this.generateResponse({
+          paths: expectedPayload,
+          capabilities: {
+            [`${ns}/my/api/path`]: ['read', 'list'],
+            [`${ns}/another/api/path`]: ['update', 'patch'],
+          },
+        });
+      });
+
+      const actual = await this.capabilities.fetch(paths);
+      const expected = {
+        'my/api/path': {
+          canCreate: false,
+          canDelete: false,
+          canList: true,
+          canPatch: false,
+          canRead: true,
+          canSudo: false,
+          canUpdate: false,
+        },
+        '/another/api/path': {
+          canCreate: false,
+          canDelete: false,
+          canList: false,
+          canPatch: true,
+          canRead: false,
+          canSudo: false,
+          canUpdate: true,
+        },
+      };
+      assert.propEqual(actual, expected, 'method returns expected response');
+    });
+
+    /* 
+    The setup in this test simulates a user whose auth method is mounted in the "root" namespace 
+    but their policy only grants access to paths in the context of the "ns1" namespace.
+
+    * ~Example policy paths~ *
+    # explicitly grants access to read "my-secret" in the kv engine mounted in the "ns1" namespace
+    path "ns1/kv/data/my-secret" {
+      capabilities = ["read", "delete"]
+    }
+    
+    # alternatively, their policy could grant access to read everything within the "ns1" namespace
+    path "ns1/*" {
+      capabilities = ["read"]
+    }
+  */
+    test(`if the user's root namespace is "root" and the resource is in a child namespace`, async function (assert) {
+      assert.expect(2);
+      const ns = this.nsSvc.path;
+      const paths = ['my/api/path', '/another/api/path'];
+      const expectedPayload = [`${ns}/my/api/path`, `${ns}/another/api/path`];
+
+      this.server.post('/sys/capabilities-self', (schema, req) => {
+        const nsHeader = req.requestHeaders['x-vault-namespace'];
+        const payload = JSON.parse(req.requestBody);
+        assert.strictEqual(nsHeader, '', 'request is made in the context of the "root" namespace');
+        assert.propEqual(payload.paths, expectedPayload, `paths include the relative namespace`);
+        return req.passthrough();
+      });
+      await this.capabilities.fetch(paths);
+    });
+
+    /* 
+    The setup in this test simulates a user whose root namespace is "root" and 
+    they are accessing a resource at a nested namespace: "ns1/child". 
+    */
+    test(`if the user's root namespace is "root" and the resource is in a grandchild`, async function (assert) {
+      assert.expect(2);
+      // the path in the namespace service is always the FULL namespace path of the current context
+      this.nsSvc.path = 'ns1/child';
+
+      const paths = ['my/api/path', '/another/api/path'];
+      const expectedPaths = ['ns1/child/my/api/path', 'ns1/child/another/api/path'];
+
+      this.server.post('/sys/capabilities-self', (schema, req) => {
+        const nsHeader = req.requestHeaders['x-vault-namespace'];
+        const payload = JSON.parse(req.requestBody);
+        assert.strictEqual(nsHeader, '', 'request is made in the context of the "root" namespace');
+        assert.propEqual(payload.paths, expectedPaths, `paths include the relative namespace`);
+        return req.passthrough();
+      });
+
+      await this.capabilities.fetch(paths);
+    });
+
+    /* 
+    The setup in this test simulates a user whose auth method is mounted in the "ns1" namespace and so cannot log in directly to "root" at all.
+    Since this user's context (along with their policy) is exclusively "ns1" the paths do not include the namespace.
+
+    * ~Example policy paths~ *
+    path "kv/data/my-secret" {
+      capabilities = ["read", "delete"]
+    }
+    */
+    test(`if the user's root namespace is an immediate child of "root" and they are accessing resources in the same namespace context`, async function (assert) {
+      assert.expect(2);
+
+      const ns = this.nsSvc.path;
+      const authService = this.owner.lookup('service:auth');
+      const authStub = sinon.stub(authService, 'authData').value({ userRootNamespace: ns });
+
+      const paths = ['my/api/path', '/another/api/path'];
+
+      this.server.post('/sys/capabilities-self', (schema, req) => {
+        const nsHeader = req.requestHeaders['x-vault-namespace'];
+        const payload = JSON.parse(req.requestBody);
+        assert.strictEqual(nsHeader, 'ns1', 'request is made in the context of the "ns1" namespace');
+        assert.propEqual(
+          payload.paths,
+          paths,
+          'paths do not include the namespace because request header manages context'
+        );
+        return req.passthrough();
+      });
+
+      await this.capabilities.fetch(paths);
+      authStub.restore();
+    });
+
+    /* 
+    The setup in this test simulates a user whose root namespace is "ns1" and 
+    they are accessing a resource at a namespace one level deeper in "ns1/child". 
+    */
+    test(`if the user's root namespace is a child of "root" and the resource is nested one more level`, async function (assert) {
+      assert.expect(2);
+      // the path in the namespace service is always the FULL namespace path of the current context
+      this.nsSvc.path = 'ns1/child';
+      const authService = this.owner.lookup('service:auth');
+      const authStub = sinon.stub(authService, 'authData').value({ userRootNamespace: 'ns1' });
+
+      const paths = ['my/api/path', '/another/api/path'];
+      const expectedPaths = ['child/my/api/path', 'child/another/api/path'];
+
+      this.server.post('/sys/capabilities-self', (schema, req) => {
+        const nsHeader = req.requestHeaders['x-vault-namespace'];
+        const payload = JSON.parse(req.requestBody);
+        assert.strictEqual(nsHeader, 'ns1', 'request is made in the context of the "ns1" namespace');
+        assert.propEqual(payload.paths, expectedPaths, 'paths include the relative namespace');
+        return req.passthrough();
+      });
+
+      await this.capabilities.fetch(paths);
+      authStub.restore();
+    });
+
+    /* 
+    The setup in this test simulates a user whose root namespace is "ns1/child" and 
+    they are accessing a resource in the same context. 
+    */
+    test(`if the user's root namespace is a grandchild of "root" and the resource is in the same context`, async function (assert) {
+      assert.expect(2);
+      // the path in the namespace service is always the FULL namespace path of the current context
+      this.nsSvc.path = 'ns1/child';
+      const authService = this.owner.lookup('service:auth');
+      const authStub = sinon.stub(authService, 'authData').value({ userRootNamespace: 'ns1/child' });
+
+      const paths = ['my/api/path', '/another/api/path'];
+
+      this.server.post('/sys/capabilities-self', (schema, req) => {
+        const nsHeader = req.requestHeaders['x-vault-namespace'];
+        const payload = JSON.parse(req.requestBody);
+        assert.strictEqual(
+          nsHeader,
+          'ns1/child',
+          'request is made in the context of the "ns1/child" namespace'
+        );
+        assert.propEqual(
+          payload.paths,
+          paths,
+          'paths do not include namespace because header manages namespace context'
+        );
+        return req.passthrough();
+      });
+
+      await this.capabilities.fetch(paths);
+      authStub.restore();
+    });
+  });
+});
diff --git a/ui/tests/unit/services/console-test.js b/ui/tests/unit/services/console-test.js
index edec5666053..b1b3a49b3e7 100644
--- a/ui/tests/unit/services/console-test.js
+++ b/ui/tests/unit/services/console-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/services/control-group-test.js b/ui/tests/unit/services/control-group-test.js
index b0c9089681d..7a3dab00452 100644
--- a/ui/tests/unit/services/control-group-test.js
+++ b/ui/tests/unit/services/control-group-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -45,7 +45,7 @@ module('Unit | Service | control group', function (hooks) {
     this.router.reopen({
       transitionTo: sinon.stub(),
       urlFor: sinon.stub().returns('/ui/vault/foo'),
-      currentURL: '/vault/secrets/kv/show/foo',
+      currentURL: '/vault/secrets-engines/kv/show/foo',
     });
   });
 
@@ -127,7 +127,7 @@ module('Unit | Service | control group', function (hooks) {
       creation_time: '2022-03-17T20:00:25.594Z',
       ttl: 400,
     };
-    const expected = { ...error, uiParams: { url: '/vault/secrets/kv/show/foo' } };
+    const expected = { ...error, uiParams: { url: '/vault/secrets-engines/kv/show/foo' } };
     const service = this.owner.factoryFor('service:control-group').create({
       storeControlGroupToken: sinon.spy(),
     });
diff --git a/ui/tests/unit/services/custom-messages-test.js b/ui/tests/unit/services/custom-messages-test.js
new file mode 100644
index 00000000000..24e557e7e5e
--- /dev/null
+++ b/ui/tests/unit/services/custom-messages-test.js
@@ -0,0 +1,119 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+import sinon from 'sinon';
+import { encodeString, decodeString } from 'core/utils/b64';
+
+module('Unit | Service | custom-messages', function (hooks) {
+  setupTest(hooks);
+
+  hooks.beforeEach(function () {
+    const payload = {
+      keys: ['1', '2'],
+      key_info: {
+        1: {
+          type: 'banner',
+          message: encodeString('This is a banner message'),
+          title: 'Look at banner Michael!',
+          active: true,
+        },
+        2: {
+          type: 'modal',
+          message: encodeString('This is a modal message'),
+          title: 'Otherwise known as a pop-up',
+          active: true,
+        },
+      },
+    };
+
+    const api = this.owner.lookup('service:api');
+    this.authMessagesApiStub = sinon
+      .stub(api.sys, 'internalUiReadAuthenticatedActiveCustomMessages')
+      .resolves(payload);
+    this.unauthMessagesApiStub = sinon
+      .stub(api.sys, 'internalUiReadUnauthenticatedActiveCustomMessages')
+      .resolves(payload);
+
+    this.customMessages = this.owner.lookup('service:custom-messages');
+
+    this.messages = payload.keys.map((id) => {
+      const data = payload.key_info[id];
+      return {
+        id,
+        ...data,
+        message: decodeString(data.message),
+      };
+    });
+
+    this.authServiceStub = sinon.stub(this.owner.lookup('service:auth'), 'currentToken').value('token');
+  });
+
+  test('it should fetch unauthenticated messages', async function (assert) {
+    this.authServiceStub.reset();
+    await this.customMessages.fetchMessages();
+
+    assert.true(this.unauthMessagesApiStub.called, 'API call made for unauthenticated messages');
+  });
+
+  test('it should fetch authenticated messages', async function (assert) {
+    await this.customMessages.fetchMessages();
+
+    assert.true(this.authMessagesApiStub.called, 'API call made for authenticated messages');
+  });
+
+  test('it should set messages from fetch response and decode message values', async function (assert) {
+    await this.customMessages.fetchMessages();
+
+    assert.deepEqual(
+      this.customMessages.messages,
+      this.messages,
+      'messages are set correctly from API response'
+    );
+    assert.true(this.customMessages.bannerState['1'], 'banner state is set correctly');
+  });
+
+  test('it should filter banner messages', async function (assert) {
+    await this.customMessages.fetchMessages();
+
+    assert.deepEqual(
+      this.customMessages.bannerMessages,
+      [this.messages[0]],
+      'only banner messages are returned'
+    );
+  });
+
+  test('it should filter modal messages', async function (assert) {
+    await this.customMessages.fetchMessages();
+
+    assert.deepEqual(
+      this.customMessages.modalMessages,
+      [this.messages[1]],
+      'only modal messages are returned'
+    );
+  });
+
+  test('it should clear messages', async function (assert) {
+    this.customMessages.messages = this.messages;
+
+    this.customMessages.clearCustomMessages();
+    assert.strictEqual(this.customMessages.messages.length, 0, 'messages are cleared');
+  });
+
+  test('it should clear messages on fetch error', async function (assert) {
+    this.customMessages.messages = this.messages;
+    this.authMessagesApiStub.rejects();
+
+    await this.customMessages.fetchMessages();
+
+    assert.strictEqual(this.customMessages.messages.length, 0, 'messages are cleared on fetch error');
+  });
+
+  test('it should update banner state on dismiss', async function (assert) {
+    this.customMessages.onBannerDismiss('1');
+    assert.false(this.customMessages.bannerState['1'], 'banner state is updated correctly on dismiss');
+  });
+});
diff --git a/ui/tests/unit/services/feature-flag-test.js b/ui/tests/unit/services/feature-flag-test.js
deleted file mode 100644
index cf1b3fdf555..00000000000
--- a/ui/tests/unit/services/feature-flag-test.js
+++ /dev/null
@@ -1,29 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-
-module('Unit | Service | feature-flag', function (hooks) {
-  setupTest(hooks);
-
-  test('it exists', function (assert) {
-    const service = this.owner.lookup('service:feature-flag');
-    assert.ok(service);
-  });
-
-  test('it returns the namespace root when flag is present', function (assert) {
-    const service = this.owner.lookup('service:feature-flag');
-    assert.strictEqual(service.managedNamespaceRoot, null, 'Managed namespace root is null by default');
-    service.setFeatureFlags(['VAULT_CLOUD_ADMIN_NAMESPACE']);
-    assert.strictEqual(service.managedNamespaceRoot, 'admin', 'Managed namespace is admin when flag present');
-    service.setFeatureFlags(['SOMETHING_ELSE']);
-    assert.strictEqual(
-      service.managedNamespaceRoot,
-      null,
-      'Flags were overwritten and root namespace is null again'
-    );
-  });
-});
diff --git a/ui/tests/unit/services/flags-test.js b/ui/tests/unit/services/flags-test.js
new file mode 100644
index 00000000000..a2d05060a25
--- /dev/null
+++ b/ui/tests/unit/services/flags-test.js
@@ -0,0 +1,146 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+
+const ACTIVATED_FLAGS_RESPONSE = {
+  data: {
+    activated: ['secrets-sync'],
+    unactivated: [],
+  },
+};
+
+const FEATURE_FLAGS_RESPONSE = {
+  feature_flags: ['VAULT_CLOUD_ADMIN_NAMESPACE'],
+};
+
+module('Unit | Service | flags', function (hooks) {
+  setupTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.service = this.owner.lookup('service:flags');
+    this.version = this.owner.lookup('service:version');
+    this.permissions = this.owner.lookup('service:permissions');
+  });
+
+  test('it loads with defaults', function (assert) {
+    assert.deepEqual(this.service.featureFlags, [], 'Flags are empty until fetched');
+    assert.deepEqual(this.service.activatedFlags, [], 'Activated flags are empty until fetched');
+  });
+
+  module('#fetchActivatedFlags', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.type = 'enterprise';
+    });
+
+    test('it returns activated flags', async function (assert) {
+      assert.expect(2);
+
+      this.server.get('sys/activation-flags', () => {
+        assert.true(true, 'GET request made to activation-flags endpoint');
+        return ACTIVATED_FLAGS_RESPONSE;
+      });
+
+      await this.service.fetchActivatedFlags();
+      assert.deepEqual(
+        this.service.activatedFlags,
+        ACTIVATED_FLAGS_RESPONSE.data.activated,
+        'Activated flags are fetched and set'
+      );
+    });
+
+    test('it returns an empty array if no flags are activated', async function (assert) {
+      this.server.get('sys/activation-flags', () => {
+        return {
+          data: {
+            activated: [],
+            unactivated: [],
+          },
+        };
+      });
+
+      await this.service.fetchActivatedFlags();
+      assert.deepEqual(this.service.activatedFlags, [], 'Activated flags are empty');
+    });
+
+    test('it does not call activation-flags endpoint if the cluster is OSS', async function (assert) {
+      this.version.type = 'community';
+
+      this.server.get(
+        'sys/activation-flags',
+        () =>
+          new Error(
+            'uh oh! a request was made to sys/activation-flags, this should not happen for community versions'
+          )
+      );
+
+      await this.service.fetchActivatedFlags();
+      assert.deepEqual(this.service.activatedFlags, [], 'Activated flags are empty');
+    });
+  });
+
+  module('#fetchFeatureFlags', function (hooks) {
+    hooks.beforeEach(function () {
+      this.version.type = 'enterprise';
+    });
+
+    test('it returns feature flags', async function (assert) {
+      assert.expect(2);
+
+      this.server.get('sys/internal/ui/feature-flags', () => {
+        assert.true(true, 'GET request made to feature-flags endpoint');
+        return FEATURE_FLAGS_RESPONSE;
+      });
+
+      await this.service.fetchFeatureFlags();
+
+      assert.deepEqual(
+        this.service.featureFlags,
+        FEATURE_FLAGS_RESPONSE.feature_flags,
+        'Feature flags are fetched and set'
+      );
+    });
+  });
+
+  module('#hvdManagedNamespaceRoot', function () {
+    test('it returns null when flag is not present', function (assert) {
+      assert.strictEqual(this.service.hvdManagedNamespaceRoot, null);
+    });
+
+    test('it returns the namespace root when flag is present', function (assert) {
+      this.service.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+      assert.strictEqual(
+        this.service.hvdManagedNamespaceRoot,
+        'admin',
+        'Managed namespace is admin when flag present'
+      );
+
+      this.service.featureFlags = ['SOMETHING_ELSE'];
+      assert.strictEqual(
+        this.service.hvdManagedNamespaceRoot,
+        null,
+        'Flags were overwritten and root namespace is null again'
+      );
+    });
+  });
+
+  test('secretsSyncIsActivated: it returns true when secrets sync is activated', function (assert) {
+    this.service.activatedFlags = ACTIVATED_FLAGS_RESPONSE.data.activated;
+    assert.true(this.service.secretsSyncIsActivated);
+  });
+
+  test('secretsSyncIsActivated: it returns false when secrets sync is not activated', function (assert) {
+    this.service.activatedFlags = [];
+    assert.false(this.service.secretsSyncIsActivated);
+  });
+
+  test('isHvdManaged: it returns true for HVD managed clusters', function (assert) {
+    this.service.featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+    assert.true(this.service.isHvdManaged);
+  });
+});
diff --git a/ui/tests/unit/services/pagination-test.js b/ui/tests/unit/services/pagination-test.js
new file mode 100644
index 00000000000..d248e190783
--- /dev/null
+++ b/ui/tests/unit/services/pagination-test.js
@@ -0,0 +1,288 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+import { keyForCache } from 'vault/services/pagination';
+import { dasherize } from '@ember/string';
+import clamp from 'vault/utils/clamp';
+import config from 'vault/config/environment';
+import Sinon from 'sinon';
+
+const { DEFAULT_PAGE_SIZE } = config.APP;
+
+module('Unit | Service | pagination', function (hooks) {
+  setupTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.pagination = this.owner.lookup('service:pagination');
+    this.store = this.owner.lookup('service:store');
+  });
+
+  test('pagination.setLazyCacheForModel', function (assert) {
+    const modelName = 'someModel';
+    const key = {
+      id: '',
+      backend: 'database',
+      responsePath: 'data.keys',
+      page: 1,
+      pageFilter: null,
+      size: 15,
+    };
+    const value = {
+      response: {
+        request_id: '1eb6473c-8df0-924e-1c8d-e016a6420aee',
+        lease_id: '',
+        renewable: false,
+        lease_duration: 0,
+        data: {
+          keys: null,
+        },
+        wrap_info: null,
+        warnings: null,
+        auth: null,
+        mount_type: 'database',
+        backend: 'database',
+      },
+      dataset: ['connection', 'connection2'],
+    };
+    this.pagination.setLazyCacheForModel(modelName, key, value);
+    const cacheEntry = this.pagination.lazyCaches.get(dasherize(modelName));
+    const actual = Object.fromEntries(cacheEntry); // convert from Map to Object for assertion
+    const expected = { '{"backend":"database","id":""}': value };
+    assert.propEqual(actual, expected, 'model name is dasherized and can be retrieved from lazyCache');
+  });
+
+  test('keyForCache', function (assert) {
+    const query = { id: 1 };
+    const queryWithSize = { id: 1, size: 1 };
+    assert.deepEqual(keyForCache(query), JSON.stringify(query), 'generated the correct cache key');
+    assert.deepEqual(keyForCache(queryWithSize), JSON.stringify(query), 'excludes size from query cache');
+  });
+
+  test('clamp', function (assert) {
+    assert.strictEqual(clamp('foo', 0, 100), 0, 'returns the min if passed a non-number');
+    assert.strictEqual(clamp(0, 1, 100), 1, 'returns the min when passed number is less than the min');
+    assert.strictEqual(clamp(200, 1, 100), 100, 'returns the max passed number is greater than the max');
+    assert.strictEqual(clamp(50, 1, 100), 50, 'returns the passed number when it is in range');
+  });
+
+  test('pagination.storeDataset', function (assert) {
+    const arr = ['one', 'two'];
+    const query = { id: 1 };
+    this.pagination.storeDataset('data', query, {}, arr);
+
+    assert.deepEqual(
+      this.pagination.getDataset('data', query).dataset,
+      arr,
+      'it stores the array as .dataset'
+    );
+    assert.deepEqual(
+      this.pagination.getDataset('data', query).response,
+      {},
+      'it stores the response as .response'
+    );
+    assert.ok(this.pagination.get('lazyCaches').has('data'), 'it stores model map');
+    assert.ok(
+      this.pagination.get('lazyCaches').get('data').has(keyForCache(query)),
+      'it stores data on the model map'
+    );
+  });
+
+  test('pagination.clearDataset with a prefix', function (assert) {
+    const arr = ['one', 'two'];
+    const arr2 = ['one', 'two', 'three', 'four'];
+    this.pagination.storeDataset('data', { id: 1 }, {}, arr);
+    this.pagination.storeDataset('transit-key', { id: 2 }, {}, arr2);
+    assert.strictEqual(this.pagination.get('lazyCaches').size, 2, 'it stores both keys');
+
+    this.pagination.clearDataset('transit-key');
+    assert.strictEqual(this.pagination.get('lazyCaches').size, 1, 'deletes one key');
+    assert.notOk(this.pagination.get('lazyCaches').has('transit-key'), 'cache is no longer stored');
+  });
+
+  test('pagination.clearDataset with no args clears entire cache', function (assert) {
+    const arr = ['one', 'two'];
+    const arr2 = ['one', 'two', 'three', 'four'];
+    this.pagination.storeDataset('data', { id: 1 }, {}, arr);
+    this.pagination.storeDataset('transit-key', { id: 2 }, {}, arr2);
+    assert.strictEqual(this.pagination.get('lazyCaches').size, 2, 'it stores both keys');
+
+    this.pagination.clearDataset();
+    assert.strictEqual(this.pagination.get('lazyCaches').size, 0, 'deletes all of the keys');
+    assert.notOk(this.pagination.get('lazyCaches').has('transit-key'), 'first cache key is no longer stored');
+    assert.notOk(this.pagination.get('lazyCaches').has('data'), 'second cache key is no longer stored');
+  });
+
+  test('pagination.getDataset', function (assert) {
+    const arr = ['one', 'two'];
+    this.pagination.storeDataset('data', { id: 1 }, {}, arr);
+
+    assert.deepEqual(this.pagination.getDataset('data', { id: 1 }), { response: {}, dataset: arr });
+  });
+
+  test('pagination.constructResponse', function (assert) {
+    const arr = ['one', 'two', 'three', 'fifteen', 'twelve'];
+    this.pagination.storeDataset('data', { id: 1 }, {}, arr);
+
+    assert.deepEqual(
+      this.pagination.constructResponse('data', {
+        id: 1,
+        pageFilter: 't',
+        page: 1,
+        size: 3,
+        responsePath: 'data',
+      }),
+      {
+        data: ['two', 'three', 'fifteen'],
+        meta: {
+          currentPage: 1,
+          lastPage: 2,
+          nextPage: 2,
+          prevPage: 1,
+          total: 5,
+          filteredTotal: 4,
+          pageSize: 3,
+        },
+      },
+      'it returns filtered results'
+    );
+  });
+
+  test('pagination.fetchPage', async function (assert) {
+    const keys = ['zero', 'one', 'two', 'three', 'four', 'five', 'six'];
+    const data = {
+      data: {
+        keys,
+      },
+    };
+    const pageSize = 2;
+    const query = {
+      size: pageSize,
+      page: 1,
+      responsePath: 'data.keys',
+    };
+    this.pagination.storeDataset('transit-key', query, data, keys);
+
+    let result;
+    result = await this.pagination.fetchPage('transit-key', query);
+    assert.strictEqual(result.get('length'), pageSize, 'returns the correct number of items');
+    assert.deepEqual(
+      result.map((r) => r.id),
+      keys.slice(0, pageSize),
+      'returns the first page of items'
+    );
+    assert.deepEqual(
+      result.get('meta'),
+      {
+        nextPage: 2,
+        prevPage: 1,
+        currentPage: 1,
+        lastPage: 4,
+        total: 7,
+        filteredTotal: 7,
+        pageSize: 2,
+      },
+      'returns correct meta values'
+    );
+
+    result = await this.pagination.fetchPage('transit-key', {
+      size: pageSize,
+      page: 3,
+      responsePath: 'data.keys',
+    });
+    const pageThreeEnd = 3 * pageSize;
+    const pageThreeStart = pageThreeEnd - pageSize;
+    assert.deepEqual(
+      result.map((r) => r.id),
+      keys.slice(pageThreeStart, pageThreeEnd),
+      'returns the third page of items'
+    );
+
+    result = await this.pagination.fetchPage('transit-key', {
+      size: pageSize,
+      page: 99,
+      responsePath: 'data.keys',
+    });
+
+    assert.deepEqual(
+      result.map((r) => r.id),
+      keys.slice(keys.length - 1),
+      'returns the last page when the page value is beyond the of bounds'
+    );
+
+    result = await this.pagination.fetchPage('transit-key', {
+      size: pageSize,
+      page: 0,
+      responsePath: 'data.keys',
+    });
+    assert.deepEqual(
+      result.map((r) => r.id),
+      keys.slice(0, pageSize),
+      'returns the first page when page value is under the bounds'
+    );
+  });
+
+  test('pagination.lazyPaginatedQuery', async function (assert) {
+    const response = {
+      data: ['foo'],
+    };
+    let queryArgs;
+    const adapterForStub = () => {
+      return {
+        query(store, modelName, query) {
+          queryArgs = query;
+          return Promise.resolve(response);
+        },
+      };
+    };
+    Sinon.stub(this.store, 'adapterFor').callsFake(adapterForStub);
+    // stub fetchPage because we test it separately
+    Sinon.stub(this.pagination, 'fetchPage').callsFake(() => {});
+    const query = { page: 1, size: 1, responsePath: 'data' };
+
+    await this.pagination.lazyPaginatedQuery('transit-key', query);
+    assert.deepEqual(
+      this.pagination.getDataset('transit-key', query),
+      { response: { data: null }, dataset: ['foo'] },
+      'stores returned dataset'
+    );
+
+    await this.pagination.lazyPaginatedQuery('secret', { page: 1, responsePath: 'data' });
+    assert.strictEqual(queryArgs.size, DEFAULT_PAGE_SIZE, 'calls query with DEFAULT_PAGE_SIZE');
+
+    assert.throws(
+      () => {
+        this.pagination.lazyPaginatedQuery('transit-key', {});
+      },
+      /responsePath is required/,
+      'requires responsePath'
+    );
+    assert.throws(
+      () => {
+        this.pagination.lazyPaginatedQuery('transit-key', { responsePath: 'foo' });
+      },
+      /page is required/,
+      'requires page'
+    );
+  });
+
+  test('pagination.filterData', async function (assert) {
+    const dataset = [
+      { id: 'foo', name: 'Foo', type: 'test' },
+      { id: 'bar', name: 'Bar', type: 'test' },
+      { id: 'bar-2', name: 'Bar', type: null },
+    ];
+
+    const defaultFiltering = this.pagination.filterData('foo', dataset);
+    assert.deepEqual(defaultFiltering, [{ id: 'foo', name: 'Foo', type: 'test' }]);
+
+    const filter = (data) => {
+      return data.filter((d) => d.name === 'Bar' && d.type === 'test');
+    };
+    const customFiltering = this.pagination.filterData(filter, dataset);
+    assert.deepEqual(customFiltering, [{ id: 'bar', name: 'Bar', type: 'test' }]);
+  });
+});
diff --git a/ui/tests/unit/services/path-help-test.js b/ui/tests/unit/services/path-help-test.js
new file mode 100644
index 00000000000..4303093b8a9
--- /dev/null
+++ b/ui/tests/unit/services/path-help-test.js
@@ -0,0 +1,118 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import Sinon from 'sinon';
+import { reject } from 'rsvp';
+
+const openapiStub = {
+  openapi: {
+    components: {
+      schemas: {
+        UsersRequest: {
+          type: 'object',
+          properties: {
+            password: {
+              description: 'Password for the user',
+              type: 'string',
+              'x-vault-displayAttrs': { sensitive: true },
+            },
+          },
+        },
+      },
+    },
+    paths: {
+      '/users/{username}': {
+        post: {
+          requestBody: {
+            content: {
+              'application/json': {
+                schema: { $ref: '#/components/schemas/UsersRequest' },
+              },
+            },
+          },
+        },
+        parameters: [
+          {
+            description: 'Username for this user.',
+            in: 'path',
+            name: 'username',
+            required: true,
+            schema: { type: 'string' },
+          },
+        ],
+        'x-vault-displayAttrs': { itemType: 'User', action: 'Create' },
+      },
+    },
+  },
+};
+
+module('Unit | Service | path-help', function (hooks) {
+  setupTest(hooks);
+  setupMirage(hooks);
+
+  hooks.beforeEach(function () {
+    this.pathHelp = this.owner.lookup('service:path-help');
+    this.store = this.owner.lookup('service:store');
+  });
+
+  module('getNewModel', function (hooks) {
+    hooks.beforeEach(function () {
+      this.server.get('/auth/userpass/', () => openapiStub);
+      this.server.get('/auth/userpass/users/example', () => openapiStub);
+    });
+    test('it generates a model with mutableId', async function (assert) {
+      assert.expect(2);
+      this.server.post('/auth/userpass/users/test', () => {
+        assert.true(true, 'POST request made to correct endpoint');
+        return;
+      });
+
+      const modelType = 'generated-user-userpass';
+      await this.pathHelp.getNewModel(modelType, 'userpass', 'auth/userpass/', 'user');
+      const model = this.store.createRecord(modelType);
+      model.set('mutableId', 'test');
+      await model.save();
+      assert.strictEqual(model.get('id'), 'test', 'model id is set to mutableId value on save success');
+    });
+
+    test('it only generates the model once', async function (assert) {
+      assert.expect(2);
+      Sinon.spy(this.pathHelp, 'getPaths');
+
+      const modelType = 'generated-user-userpass';
+      await this.pathHelp.getNewModel(modelType, 'userpass', 'auth/userpass/', 'user');
+      assert.true(this.pathHelp.getPaths.calledOnce, 'getPaths is called for new generated model');
+
+      await this.pathHelp.getNewModel(modelType, 'userpass2', 'auth/userpass/', 'user');
+      assert.true(this.pathHelp.getPaths.calledOnce, 'not called again even with different backend path');
+    });
+
+    test('it resolves without error if model already exists', async function (assert) {
+      Sinon.stub(this.pathHelp, 'getPaths').callsFake(() => {
+        assert.notOk(true, 'this method should not be called');
+        return reject();
+      });
+      const modelType = 'totp-key';
+      await this.pathHelp.getNewModel(modelType, 'my-kv').then(() => {
+        assert.true(true, 'getNewModel resolves');
+      });
+    });
+  });
+
+  module('hydrateModel', function () {
+    test('it should hydrate an existing model', async function (assert) {
+      this.server.get(`/pki2/roles/example`, () => openapiStub);
+
+      const modelType = 'pki/role';
+      await this.pathHelp.hydrateModel(modelType, 'pki2');
+      const model = this.store.createRecord(modelType);
+      model.set('username', 'foobar');
+      assert.strictEqual(model.username, 'foobar', 'sets value of key that only exists in openAPI response');
+    });
+  });
+});
diff --git a/ui/tests/unit/services/path-helper-test.js b/ui/tests/unit/services/path-helper-test.js
deleted file mode 100644
index 5612e9e3a38..00000000000
--- a/ui/tests/unit/services/path-helper-test.js
+++ /dev/null
@@ -1,78 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-import { setupMirage } from 'ember-cli-mirage/test-support';
-
-const openapiStub = {
-  openapi: {
-    components: {
-      schemas: {
-        UsersRequest: {
-          type: 'object',
-          properties: {
-            password: {
-              description: 'Password for the user',
-              type: 'string',
-              'x-vault-displayAttrs': { sensitive: true },
-            },
-          },
-        },
-      },
-    },
-    paths: {
-      '/users/{username}': {
-        post: {
-          requestBody: {
-            content: {
-              'application/json': {
-                schema: { $ref: '#/components/schemas/UsersRequest' },
-              },
-            },
-          },
-        },
-        parameters: [
-          {
-            description: 'Username for this user.',
-            in: 'path',
-            name: 'username',
-            required: true,
-            schema: { type: 'string' },
-          },
-        ],
-        'x-vault-displayAttrs': { itemType: 'User', action: 'Create' },
-      },
-    },
-  },
-};
-
-module('Unit | Service | path-help', function (hooks) {
-  setupTest(hooks);
-  setupMirage(hooks);
-
-  hooks.beforeEach(function () {
-    this.pathHelp = this.owner.lookup('service:path-help');
-    this.store = this.owner.lookup('service:store');
-  });
-
-  test('it should generate model with mutableId', async function (assert) {
-    assert.expect(2);
-
-    this.server.get('/auth/userpass/', () => openapiStub);
-    this.server.get('/auth/userpass/users/example', () => openapiStub);
-    this.server.post('/auth/userpass/users/test', () => {
-      assert.ok(true, 'POST request made to correct endpoint');
-      return;
-    });
-
-    const modelType = 'generated-user-userpass';
-    await this.pathHelp.getNewModel(modelType, 'userpass', 'auth/userpass/', 'user');
-    const model = this.store.createRecord(modelType);
-    model.set('mutableId', 'test');
-    await model.save();
-    assert.strictEqual(model.get('id'), 'test', 'model id is set to mutableId value on save success');
-  });
-});
diff --git a/ui/tests/unit/services/permissions-test.js b/ui/tests/unit/services/permissions-test.js
index c9483fc365a..4a23c618bdc 100644
--- a/ui/tests/unit/services/permissions-test.js
+++ b/ui/tests/unit/services/permissions-test.js
@@ -1,248 +1,283 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
 import { setupTest } from 'ember-qunit';
-import Pretender from 'pretender';
 import Service from '@ember/service';
+import { setupMirage } from 'ember-cli-mirage/test-support';
+import { overrideResponse } from 'vault/tests/helpers/stubs';
+import { PERMISSIONS_BANNER_STATES, RESULTANT_ACL_PATH } from 'vault/services/permissions';
 
 const PERMISSIONS_RESPONSE = {
   data: {
     exact_paths: {
-      foo: {
-        capabilities: ['read'],
-      },
-      'bar/bee': {
-        capabilities: ['create', 'list'],
-      },
-      boo: {
-        capabilities: ['deny'],
-      },
+      foo: { capabilities: ['read'] },
+      'bar/bee': { capabilities: ['create', 'list'] },
+      boo: { capabilities: ['deny'] },
     },
     glob_paths: {
-      'baz/biz': {
-        capabilities: ['read'],
-      },
-      'ends/in/slash/': {
-        capabilities: ['list'],
-      },
+      'baz/biz': { capabilities: ['read'] },
+      'ends/in/slash/': { capabilities: ['list'] },
     },
   },
 };
 
+// Small helper to DRY namespace registration across modules
+function registerNs(owner, path) {
+  const Ns = Service.extend({ path });
+  owner.register('service:namespace', Ns);
+}
+
+// Note: Policy matching follows Vault’s priority rules
+// (see: https://developer.hashicorp.com/vault/docs/concepts/policies#priority-matching).
+// In short:
+// - '+' = exactly one segment, '*' = wildcard, '/' = include base, '/*' = children-only.
+// - Most-specific (longest) match wins; deny beats allow.
+// - Exact and glob matches both apply; any deny blocks access.
+// - Special: '' key means allow-all (`path "*" { ... }`), but can still be overridden by a more specific deny.
+// - Root tokens short-circuit to allow; banners use canary-path heuristics.
+
 module('Unit | Service | permissions', function (hooks) {
   setupTest(hooks);
+  setupMirage(hooks);
 
   hooks.beforeEach(function () {
-    this.server = new Pretender();
-    this.server.get('/v1/sys/internal/ui/resultant-acl', () => {
-      return [200, { 'Content-Type': 'application/json' }, JSON.stringify(PERMISSIONS_RESPONSE)];
-    });
+    this.server.get(`/${RESULTANT_ACL_PATH}`, () => PERMISSIONS_RESPONSE);
     this.service = this.owner.lookup('service:permissions');
   });
 
-  hooks.afterEach(function () {
-    this.server.shutdown();
-  });
-
+  // ───────────────────────────────────────────────────────────────────────────
+  // Basics
+  // ───────────────────────────────────────────────────────────────────────────
   test('sets paths properly', async function (assert) {
     await this.service.getPaths.perform();
-    assert.deepEqual(this.service.get('exactPaths'), PERMISSIONS_RESPONSE.data.exact_paths);
-    assert.deepEqual(this.service.get('globPaths'), PERMISSIONS_RESPONSE.data.glob_paths);
+    assert.deepEqual(this.service.exactPaths, PERMISSIONS_RESPONSE.data.exact_paths);
+    assert.deepEqual(this.service.globPaths, PERMISSIONS_RESPONSE.data.glob_paths);
   });
 
   test('sets the root token', function (assert) {
     this.service.setPaths({ data: { root: true } });
-    assert.true(this.service.canViewAll);
+    assert.true(this.service.isRoot, 'isRoot is true with root token');
   });
 
   test('defaults to show all items when policy cannot be found', async function (assert) {
-    this.server.get('/v1/sys/internal/ui/resultant-acl', () => {
-      return [403, { 'Content-Type': 'application/json' }];
-    });
+    this.server.get(`${RESULTANT_ACL_PATH}`, () => overrideResponse(403));
     await this.service.getPaths.perform();
-    assert.true(this.service.canViewAll);
+    assert.true(this.service.hasFallbackAccess, 'hasFallbackAccess is true when policy cannot be found');
   });
 
+  // ───────────────────────────────────────────────────────────────────────────
+  // navPathParams
+  // ───────────────────────────────────────────────────────────────────────────
   test('returns the first allowed nav route for policies', function (assert) {
     const policyPaths = {
-      'sys/policies/acl': {
-        capabilities: ['deny'],
-      },
-      'sys/policies/rgp': {
-        capabilities: ['read'],
-      },
+      'sys/policies/acl': { capabilities: ['deny'] },
+      'sys/policies/rgp': { capabilities: ['read'] },
     };
-    this.service.set('exactPaths', policyPaths);
-    assert.strictEqual(this.service.navPathParams('policies').models[0], 'rgp');
+    this.service.setProperties({ exactPaths: policyPaths });
+    assert.strictEqual(
+      this.service.navPathParams('policies').models[0],
+      'rgp',
+      'first allowed route is returned'
+    );
   });
 
   test('returns the first allowed nav route for access', function (assert) {
     const accessPaths = {
-      'sys/auth': {
-        capabilities: ['deny'],
-      },
-      'identity/entity/id': {
-        capabilities: ['read'],
-      },
+      'sys/auth': { capabilities: ['deny'] },
+      'identity/entity/id': { capabilities: ['read'] },
     };
     const expected = { route: 'vault.cluster.access.identity', models: ['entities'] };
-    this.service.set('exactPaths', accessPaths);
+    this.service.setProperties({ exactPaths: accessPaths });
     assert.deepEqual(this.service.navPathParams('access'), expected);
   });
 
+  test('navPathParams uses canonical first route when a glob allows all', function (assert) {
+    this.service.setProperties({ globPaths: { 'sys/policies/*': { capabilities: ['read'] } } });
+    const result = this.service.navPathParams('policies');
+    assert.deepEqual(
+      result,
+      { models: ['acl'] },
+      'picks first in canonical order (acl → rgp → egp) when all allowed'
+    );
+  });
+
+  test('most-specific exact key wins (length-descending)', function (assert) {
+    this.service.setProperties({
+      exactPaths: {
+        'sys/auth': { capabilities: ['deny'] },
+        'sys/auth/methods': { capabilities: ['read'] },
+      },
+    });
+    // Querying base "sys/auth" should still be allowed if a deeper exact key is intended to satisfy children,
+    // BUT our matcher selects the most specific only when the base is equal or a parent. For "sys/auth/methods"
+    // we expect the deeper allow to win; for the base itself we respect the base entry.
+    assert.true(this.service.hasPermission('sys/auth/methods'), 'deeper exact allow applies');
+    assert.false(this.service.hasPermission('sys/auth'), 'base respects base deny');
+  });
+
   module('hasPermission', function () {
     test('returns true if a policy includes access to an exact path', function (assert) {
-      this.service.set('exactPaths', PERMISSIONS_RESPONSE.data.exact_paths);
-      assert.true(this.service.hasPermission('foo'));
+      this.service.setProperties({ exactPaths: PERMISSIONS_RESPONSE.data.exact_paths });
+      assert.true(this.service.hasPermission('foo'), 'policy includes access to foo exact path');
     });
 
-    test('returns true if a paths prefix is included in the policys exact paths', function (assert) {
-      this.service.set('exactPaths', PERMISSIONS_RESPONSE.data.exact_paths);
-      assert.true(this.service.hasPermission('bar'));
+    test("returns true if a path's base is included in the policy exact paths", function (assert) {
+      this.service.setProperties({ exactPaths: PERMISSIONS_RESPONSE.data.exact_paths });
+      assert.true(this.service.hasPermission('bar'), 'base "bar" satisfied by "bar/bee" key');
     });
 
-    test('it returns true if a policy includes access to a glob path', function (assert) {
-      this.service.set('globPaths', PERMISSIONS_RESPONSE.data.glob_paths);
-      assert.true(this.service.hasPermission('baz/biz/hi'));
+    // An empty string key here represents a policy of `path "*" { ... }`
+    // (wildcard for all paths). While it can be argued this doesn't guarantee meaningful access to canary endpoints,
+    // we are interpreting it to mean "allow all."
+    // This is consistent with the behavior of the root token, which also suppresses the banner.
+    test('empty-root glob key ("") (e.g. sys "*") interrupted as allow all', function (assert) {
+      this.service.setProperties({ globPaths: { '': { capabilities: ['read'] } } });
+      assert.true(this.service.hasPermission('sys/auth'), 'empty-root allows all');
     });
 
-    test('it returns true if a policy includes access to the * glob path', function (assert) {
-      const splatPath = { '': {} };
-      this.service.set('globPaths', splatPath);
-      assert.true(this.service.hasPermission('hi'));
+    test('most-specific deny overrides empty-root allow', function (assert) {
+      // "" = allow-all, but a longer, more specific deny should win
+      this.service.setProperties({
+        globPaths: {
+          '': { capabilities: ['read'] },
+          'sys/auth/*': { capabilities: ['deny'] },
+        },
+      });
+      assert.false(
+        this.service.hasPermission('sys/auth/methods'),
+        'specific deny on sys/auth/* wins over allow-all'
+      );
+      assert.true(
+        this.service.hasPermission('sys/policies/acl'),
+        'non-matching path remains allowed via empty-root allow'
+      );
     });
 
-    test('it returns false if the matched path includes the deny capability', function (assert) {
-      this.service.set('globPaths', PERMISSIONS_RESPONSE.data.glob_paths);
-      assert.false(this.service.hasPermission('boo'));
+    test('returns false if the matched exact path includes deny capability', function (assert) {
+      this.service.setProperties({ exactPaths: { boo: { capabilities: ['deny'] } } });
+      assert.false(this.service.hasPermission('boo'), 'deny capability blocks access');
     });
 
-    test('it returns true if passed path does not end in a slash but globPath does', function (assert) {
-      this.service.set('globPaths', PERMISSIONS_RESPONSE.data.glob_paths);
+    test('matches whether or not path ends with slash when glob ends with slash', function (assert) {
+      this.service.setProperties({ globPaths: { 'ends/in/slash/': { capabilities: ['list'] } } });
       assert.true(this.service.hasPermission('ends/in/slash'), 'matches without slash');
       assert.true(this.service.hasPermission('ends/in/slash/'), 'matches with slash');
     });
 
-    test('it returns false if a policy does not includes access to a path', function (assert) {
+    test('returns false if a policy does not include access to a path', function (assert) {
       assert.false(this.service.hasPermission('danger'));
     });
+
     test('returns true with the root token', function (assert) {
-      this.service.set('canViewAll', true);
+      this.service.setProperties({ isRoot: true });
       assert.true(this.service.hasPermission('hi'));
     });
-    test('it returns true if a policy has the specified capabilities on a path', function (assert) {
-      this.service.set('exactPaths', PERMISSIONS_RESPONSE.data.exact_paths);
-      this.service.set('globPaths', PERMISSIONS_RESPONSE.data.glob_paths);
+
+    test('returns true if policy has all requested capabilities on a path', function (assert) {
+      this.service.setProperties({
+        exactPaths: PERMISSIONS_RESPONSE.data.exact_paths,
+        globPaths: PERMISSIONS_RESPONSE.data.glob_paths,
+      });
       assert.true(this.service.hasPermission('bar/bee', ['create', 'list']));
       assert.true(this.service.hasPermission('baz/biz', ['read']));
     });
 
-    test('it returns false if a policy does not have the specified capabilities on a path', function (assert) {
-      this.service.set('exactPaths', PERMISSIONS_RESPONSE.data.exact_paths);
-      this.service.set('globPaths', PERMISSIONS_RESPONSE.data.glob_paths);
-      assert.false(this.service.hasPermission('bar/bee', ['create', 'delete']));
-      assert.false(this.service.hasPermission('foo', ['create']));
+    test('returns false if policy lacks any requested capability on a path', function (assert) {
+      this.service.setProperties({
+        exactPaths: PERMISSIONS_RESPONSE.data.exact_paths,
+        globPaths: PERMISSIONS_RESPONSE.data.glob_paths,
+      });
+      assert.false(this.service.hasPermission('bar/bee', ['create', 'delete']), 'delete missing');
+      assert.false(this.service.hasPermission('foo', ['create']), 'create missing');
+    });
+
+    test('returns false when an exact path matches but the requested capability is missing', function (assert) {
+      this.service.setProperties({ exactPaths: { 'bar/bee': { capabilities: ['list'] } } });
+      assert.false(this.service.hasPermission('bar/bee', ['update']), 'update not granted');
+      assert.false(
+        this.service.hasPermission('bar/bee', ['list', 'create']),
+        'require-all semantics: create not granted'
+      );
     });
   });
 
   module('hasNavPermission', function () {
     test('returns true if a policy includes the required capabilities for at least one path', function (assert) {
       const accessPaths = {
-        'sys/auth': {
-          capabilities: ['deny'],
-        },
-        'identity/group/id': {
-          capabilities: ['list', 'read'],
-        },
+        'sys/auth': { capabilities: ['deny'] },
+        'identity/group/id': { capabilities: ['list', 'read'] },
       };
-      this.service.set('exactPaths', accessPaths);
+      this.service.setProperties({ exactPaths: accessPaths });
       assert.true(this.service.hasNavPermission('access', 'groups'));
     });
 
-    test('returns false if a policy does not include the required capabilities for at least one path', function (assert) {
+    test('returns false if a policy lacks the required capabilities for the path', function (assert) {
       const accessPaths = {
-        'sys/auth': {
-          capabilities: ['deny'],
-        },
-        'identity/group/id': {
-          capabilities: ['read'],
-        },
+        'sys/auth': { capabilities: ['deny'] },
+        'identity/group/id': { capabilities: ['read'] },
       };
-      this.service.set('exactPaths', accessPaths);
+      this.service.setProperties({ exactPaths: accessPaths });
       assert.false(this.service.hasNavPermission('access', 'groups'));
     });
 
-    test('should handle routeParams as array', function (assert) {
+    test('handles routeParams as array with requireAll semantics', function (assert) {
       const getPaths = (override) => ({
-        'sys/auth': {
-          capabilities: [override || 'read'],
-        },
-        'identity/mfa/method': {
-          capabilities: [override || 'read'],
-        },
-        'identity/oidc/client': {
-          capabilities: [override || 'deny'],
-        },
+        'sys/auth': { capabilities: [override || 'read'] },
+        'identity/mfa/method': { capabilities: [override || 'read'] },
+        'identity/oidc/client': { capabilities: [override || 'deny'] },
       });
 
-      this.service.set('exactPaths', getPaths());
+      this.service.setProperties({ exactPaths: getPaths() });
       assert.true(
         this.service.hasNavPermission('access', ['methods', 'mfa', 'oidc']),
-        'hasNavPermission returns true for array of route params when any route is permitted'
+        'true when any route is permitted'
       );
       assert.false(
         this.service.hasNavPermission('access', ['methods', 'mfa', 'oidc'], true),
-        'hasNavPermission returns false for array of route params when any route is not permitted and requireAll is passed'
+        'false when any route is not permitted and requireAll is passed'
       );
 
-      this.service.set('exactPaths', getPaths('read'));
+      this.service.setProperties({ exactPaths: getPaths('read') });
       assert.true(
         this.service.hasNavPermission('access', ['methods', 'mfa', 'oidc'], true),
-        'hasNavPermission returns true for array of route params when all routes are permitted and requireAll is passed'
+        'true when all routes are permitted and requireAll is passed'
       );
 
-      this.service.set('exactPaths', getPaths('deny'));
+      this.service.setProperties({ exactPaths: getPaths('deny') });
       assert.false(
         this.service.hasNavPermission('access', ['methods', 'mfa', 'oidc']),
-        'hasNavPermission returns false for array of route params when no routes are permitted'
+        'false when no routes are permitted'
       );
       assert.false(
         this.service.hasNavPermission('access', ['methods', 'mfa', 'oidc'], true),
-        'hasNavPermission returns false for array of route params when no routes are permitted and requireAll is passed'
+        'false when no routes are permitted and requireAll is passed'
       );
     });
   });
 
-  module('pathWithNamespace', function () {
+  module('pathNameWithNamespace', function () {
     test('appends the namespace to the path if there is one', function (assert) {
-      const namespaceService = Service.extend({
-        path: 'marketing',
-      });
-      this.owner.register('service:namespace', namespaceService);
+      registerNs(this.owner, 'marketing');
       assert.strictEqual(this.service.pathNameWithNamespace('sys/auth'), 'marketing/sys/auth');
     });
 
     test('appends the chroot and namespace when both present', function (assert) {
-      const namespaceService = Service.extend({
-        path: 'marketing',
-      });
-      this.owner.register('service:namespace', namespaceService);
-      this.service.set('chrootNamespace', 'admin/');
+      registerNs(this.owner, 'marketing');
+      this.service.setProperties({ chrootNamespace: 'admin/' });
       assert.strictEqual(this.service.pathNameWithNamespace('sys/auth'), 'admin/marketing/sys/auth');
     });
+
     test('appends the chroot when no namespace', function (assert) {
-      this.service.set('chrootNamespace', 'admin');
+      this.service.setProperties({ chrootNamespace: 'admin' });
       assert.strictEqual(this.service.pathNameWithNamespace('sys/auth'), 'admin/sys/auth');
     });
+
     test('handles superfluous slashes', function (assert) {
-      const namespaceService = Service.extend({
-        path: '/marketing',
-      });
-      this.owner.register('service:namespace', namespaceService);
-      this.service.set('chrootNamespace', '/admin/');
+      registerNs(this.owner, '/marketing');
+      this.service.setProperties({ chrootNamespace: '/admin/' });
       assert.strictEqual(this.service.pathNameWithNamespace('/sys/auth'), 'admin/marketing/sys/auth');
       assert.strictEqual(
         this.service.pathNameWithNamespace('/sys/policies/'),
@@ -250,4 +285,421 @@ module('Unit | Service | permissions', function (hooks) {
       );
     });
   });
+
+  // ───────────────────────────────────────────────────────────────────────────
+  // Glob matching semantics (+ and *)
+  // ───────────────────────────────────────────────────────────────────────────
+  module('glob matching semantics', function () {
+    test('+ matches exactly one segment; trailing /* means any child (≥1)', function (assert) {
+      this.service.setProperties({ globPaths: { 'secret/+/*': { capabilities: ['read'] } } });
+
+      assert.true(
+        this.service.hasPermission('secret/team-a/foo'),
+        'one segment after secret, then a child → match'
+      );
+      assert.true(this.service.hasPermission('secret/team-a/foo/bar'), 'multiple children via /* → match');
+
+      // children-only: base MUST have at least one child
+      assert.false(
+        this.service.hasPermission('secret/foo'),
+        'zero segments after + (needs child due to /*) → no match'
+      );
+      assert.false(this.service.hasPermission('secret/team-a'), 'base-only (no child) with /* → no match');
+
+      // IMPORTANT CHANGE: with + matching "team-a", the /* tail matches any depth of children
+      assert.true(
+        this.service.hasPermission('secret/team-a/eng/foo/bar/baz'),
+        '/* tail matches one-or-more segments; deep children → match'
+      );
+    });
+
+    test('* greedy tail works', function (assert) {
+      this.service.set('globPaths', { 'sys/*': { capabilities: ['list'] } });
+      assert.true(this.service.hasPermission('sys/policies/acl'));
+      assert.true(this.service.hasPermission('sys/auth/methods'));
+    });
+
+    test('include-base semantics for keys ending with "/" (base OR children)', function (assert) {
+      this.service.set('globPaths', { 'sys/': { capabilities: ['list'] } });
+      assert.true(this.service.hasPermission('sys'), 'base matches');
+      assert.true(this.service.hasPermission('sys/'), 'normalized base matches');
+      assert.true(this.service.hasPermission('sys/auth'), 'child matches');
+    });
+
+    test('most-specific wins across multiple matching globs', function (assert) {
+      this.service.set('globPaths', {
+        'sys/*': { capabilities: ['deny'] }, // broad deny
+        'sys/auth/*': { capabilities: ['read'] }, // specific allow
+      });
+      assert.true(this.service.hasPermission('sys/auth/methods'), 'specific allow overrides broader deny');
+      assert.false(this.service.hasPermission('sys/policies/acl'), 'non-auth still denied by broad rule');
+    });
+
+    test('most-specific deny takes precedence when the most specific entry is deny', function (assert) {
+      this.service.set('globPaths', {
+        'sys/*': { capabilities: ['list'] }, // broad allow
+        'sys/auth/*': { capabilities: ['deny'] }, // specific deny
+      });
+      assert.false(this.service.hasPermission('sys/auth/methods'), 'specific deny blocks');
+      assert.true(this.service.hasPermission('sys/policies/acl'), 'non-auth remains allowed by broad rule');
+    });
+
+    test('capability filtering applies to glob matches', function (assert) {
+      this.service.set('globPaths', { 'sys/tools/*': { capabilities: ['update'] } });
+      assert.true(this.service.hasPermission('sys/tools/hash', ['update']));
+      assert.false(this.service.hasPermission('sys/tools/hash', ['read']));
+    });
+
+    test('deny precedence: exact deny beats glob allow', function (assert) {
+      // /ns/sys/auth matches BOTH exact (deny) and glob (allow) → expect false
+      this.service.setProperties({
+        exactPaths: { 'sys/auth': { capabilities: ['deny'] } },
+        globPaths: { 'sys/*': { capabilities: ['read'] } },
+      });
+      assert.false(this.service.hasPermission('sys/auth'), 'exact deny wins');
+    });
+
+    test('deny precedence: glob deny beats exact allow', function (assert) {
+      this.service.setProperties({
+        exactPaths: { 'sys/auth': { capabilities: ['read'] } },
+        globPaths: { 'sys/auth/*': { capabilities: ['deny'] } },
+      });
+      assert.false(this.service.hasPermission('sys/auth/methods'), 'glob deny wins');
+    });
+  });
+
+  module('permissionsBanner - fullCurrentNamespace (e.g. ns/<path>)', function () {
+    [
+      // First set: no chroot or user root
+      {
+        scenario: 'no chroot or user root → full ns is currentNs',
+        chroot: null,
+        userRoot: '',
+        currentNs: 'foo/bar',
+        expectedFullNs: 'foo/bar',
+      },
+      // Second set: chroot and user root (currentNs excludes chroot)
+      {
+        scenario: 'chroot + user root → both prefixed',
+        chroot: 'foo/',
+        userRoot: 'bar',
+        currentNs: 'bar/baz',
+        expectedFullNs: 'foo/bar/baz',
+      },
+      // Third set: chroot only
+      {
+        scenario: 'chroot only → chroot prefixed',
+        chroot: 'admin/',
+        userRoot: '',
+        currentNs: 'child',
+        expectedFullNs: 'admin/child',
+      },
+      // Fourth set: user root only
+      {
+        scenario: 'user root only → user root prefixed',
+        chroot: null,
+        userRoot: 'foo',
+        currentNs: 'foo/bing',
+        expectedFullNs: 'foo/bing',
+      },
+    ].forEach((testCase) => {
+      test(testCase.scenario, async function (assert) {
+        const Ns = Service.extend({ userRootNamespace: testCase.userRoot, path: testCase.currentNs });
+        this.owner.register('service:namespace', Ns);
+
+        this.service.setPaths({
+          data: { glob_paths: {}, exact_paths: {}, chroot_namespace: testCase.chroot },
+        });
+
+        const fullNamespace = this.service.fullCurrentNamespace;
+        assert.strictEqual(fullNamespace, testCase.expectedFullNs, 'full ns computed correctly');
+      });
+    });
+  });
+
+  module('permissionsBanner — namespace + globPaths coverage (e.g. +/<path>)', function () {
+    test('ACL not loaded → no banner (prevents flicker)', function (assert) {
+      registerNs(this.owner, 'ns1/child');
+      // Fresh service: exact/glob/canViewAll all null
+      assert.strictEqual(this.service.permissionsBanner, null, 'null while loading');
+    });
+
+    test('ACL load failed → read-failed banner', function (assert) {
+      registerNs(this.owner, 'ns1');
+      this.service.setProperties({
+        _aclLoadFailed: true,
+        exactPaths: null,
+        globPaths: null,
+        canViewAll: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, PERMISSIONS_BANNER_STATES.readFailed);
+    });
+
+    // If you want root to *always* suppress banners, flip getter order and update this.
+    test('root token → no banner regardless of namespace', function (assert) {
+      registerNs(this.owner, 'ns1/child');
+      this.service.setProperties({
+        isRoot: true,
+        exactPaths: {},
+        globPaths: {},
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, null);
+    });
+
+    test('no canaries allowed in ns → no-ns-access banner', function (assert) {
+      registerNs(this.owner, 'ns1');
+      this.service.setProperties({
+        exactPaths: { 'some/noncanary': { capabilities: ['read'] } }, // non-canary
+        globPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, PERMISSIONS_BANNER_STATES.noAccess);
+    });
+
+    // +/sys/auth (one ns segment) vs current ns depth 1
+    test('+/sys/auth (base-only) grants canary in one-segment ns (base only)', function (assert) {
+      registerNs(this.owner, 'ns1'); // full: ns1/sys/auth
+      this.service.setProperties({
+        globPaths: { '+/sys/auth': { capabilities: ['list'] } }, // no trailing slash → base only
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, null, 'base canary suppresses banner');
+    });
+
+    test('+/sys/auth/ (include-base) grants canary for base and children in one-segment ns', function (assert) {
+      registerNs(this.owner, 'ns1');
+      this.service.setProperties({
+        globPaths: { '+/sys/auth/': { capabilities: ['list'] } }, // include-base
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, null);
+    });
+
+    // +/+/sys/auth for two-segment namespace
+    test('+/+/sys/auth (base-only) grants canary in two-segment ns', function (assert) {
+      registerNs(this.owner, 'ns1/child'); // full: ns1/child/sys/auth
+      this.service.setProperties({
+        globPaths: { '+/+/sys/auth': { capabilities: ['read'] } },
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, null);
+    });
+
+    test('single + does NOT match two-segment ns → no-ns-access', function (assert) {
+      registerNs(this.owner, 'ns1/child');
+      this.service.setProperties({
+        globPaths: { '+/sys/auth': { capabilities: ['read'] } }, // only one '+'
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, PERMISSIONS_BANNER_STATES.noAccess);
+    });
+
+    test('+/+/sys/auth/ include-base still suppresses banner in two-segment ns', function (assert) {
+      registerNs(this.owner, 'ns1/child');
+      this.service.setProperties({
+        globPaths: { '+/+/sys/auth/': { capabilities: ['read'] } },
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, null);
+    });
+
+    test('chroot + one-segment ns matches +/+ canary', function (assert) {
+      registerNs(this.owner, 'marketing'); // full: admin/marketing/sys/auth
+      this.service.setProperties({
+        chrootNamespace: 'admin',
+        globPaths: { '+/+/sys/auth': { capabilities: ['list'] } },
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, null);
+    });
+
+    test('most-specific allow (+/+/sys/auth/) overrides broader deny (+/+/sys/*)', function (assert) {
+      registerNs(this.owner, 'ns1/child'); // full path prefix: ns1/child
+
+      this.service.setProperties({
+        globPaths: {
+          '+/+/sys/*': { capabilities: ['deny'] }, // children-only deny under sys
+          '+/+/sys/auth/': { capabilities: ['read'] }, // include-base allow for sys/auth
+        },
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+
+      assert.strictEqual(
+        this.service.permissionsBanner,
+        null,
+        'specific include-base allow suppresses banner even with broader children-only deny'
+      );
+    });
+
+    test('deny on the canary path blocks banner suppression when no other canaries are allowed', function (assert) {
+      registerNs(this.owner, 'ns1/child');
+
+      this.service.setProperties({
+        globPaths: {
+          '+/+/sys/auth/': { capabilities: ['deny'] }, // deny the canary
+          // no other canary allows present
+        },
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+
+      assert.strictEqual(
+        this.service.permissionsBanner,
+        PERMISSIONS_BANNER_STATES.noAccess,
+        'without other allowed canaries, deny on sys/auth shows the banner'
+      );
+    });
+
+    test('empty-root glob "" (aka `path "*"`) suppresses banner in namespaced paths', function (assert) {
+      registerNs(this.owner, 'ns1');
+      this.service.setProperties({
+        globPaths: { '': { capabilities: ['read'] } }, // allow-all
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(
+        this.service.permissionsBanner,
+        null,
+        'allow-all policy suppresses the no-access banner even in a namespace'
+      );
+    });
+
+    test('canary denied explicitly → no-ns-access', function (assert) {
+      registerNs(this.owner, 'ns1/child');
+      this.service.setProperties({
+        globPaths: { '+/+/sys/auth': { capabilities: ['deny'] } },
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, PERMISSIONS_BANNER_STATES.noAccess);
+    });
+
+    test('canary allowed with any non-deny capability suppresses banner', function (assert) {
+      registerNs(this.owner, 'ns1/child');
+      this.service.setProperties({
+        globPaths: { '+/+/sys/auth': { capabilities: ['list'] } }, // any non-deny is enough
+        exactPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, null);
+    });
+  });
+
+  module('permissionsBanner — canary checks (aka “standard mgmt endpoints”)', function () {
+    /**
+     * Canary endpoints are a curated set of safe, management-style API paths that the UI probes
+     * inside the *current* namespace to decide whether to suppress the “no access” banner.
+     * Heuristic: any non-deny capability on at least one canary → suppress banner.
+     * Examples (not exhaustive): 'sys/auth', 'identity/*', 'sys/leases/lookup', 'sys/policies/*',
+     * 'sys/tools/hash', 'sys/replication', 'sys/license', etc.
+     */
+
+    test('no banner when any canary path is allowed via exact path (e.g., sys/tools/hash)', function (assert) {
+      registerNs(this.owner, '');
+      this.service.setProperties({
+        exactPaths: { 'sys/tools/hash': { capabilities: ['update'] } }, // canary
+        globPaths: {},
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, null, 'canary access suppresses banner');
+    });
+
+    test('edge case: namespace-only engine access (+/kv/data/*) still shows banner', function (assert) {
+      registerNs(this.owner, 'ns1');
+      this.service.setProperties({
+        exactPaths: {},
+        globPaths: { '+/kv/data/*': { capabilities: ['read'] } }, // non-canary
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(
+        this.service.permissionsBanner,
+        PERMISSIONS_BANNER_STATES.noAccess,
+        'engine-only glob (+/kv/data/*) is not a canary → banner shows'
+      );
+    });
+
+    test('canary via glob (+/sys/auth/) suppresses banner in a one-segment namespace', function (assert) {
+      registerNs(this.owner, 'ns1');
+      this.service.setProperties({
+        exactPaths: {},
+        globPaths: { '+/sys/auth/': { capabilities: ['list'] } }, // include-base glob canary
+        canViewAll: false,
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(this.service.permissionsBanner, null, 'glob canary suppresses banner');
+    });
+  });
+
+  module('permissionsBanner — resultant-acl direct check', function () {
+    test('allow on resultant-acl (ns via + glob) suppresses banner', function (assert) {
+      // current namespace depth = 1 → use single '+'
+      registerNs(this.owner, 'ns1');
+      this.service.setProperties({
+        exactPaths: {},
+        globPaths: { [`+/${RESULTANT_ACL_PATH}`]: { capabilities: ['read'] } },
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(
+        this.service.permissionsBanner,
+        null,
+        'read capability to resultant-acl suppresses banner'
+      );
+    });
+
+    test('deny on resultant-acl (two-segment ns) with no other canaries → no-ns-access', function (assert) {
+      registerNs(this.owner, 'ns1/child'); // full path checked: ns1/child/sys/internal/ui/resultant-acl
+      this.service.setProperties({
+        exactPaths: {}, // no exact allows
+        globPaths: {
+          [`+/+/${RESULTANT_ACL_PATH}`]: { capabilities: ['deny'] }, // explicit deny
+        },
+        _aclLoadFailed: false,
+      });
+      assert.strictEqual(
+        this.service.permissionsBanner,
+        PERMISSIONS_BANNER_STATES.noAccess,
+        'deny to resultant-acl with no other canaries shows no-access banner'
+      );
+    });
+  });
+  // ───────────────────────────────────────────────────────────────────────────
+  // precedence test (document current getter order)
+  // ───────────────────────────────────────────────────────────────────────────
+  test('root overrides read-failed: no banner for canViewAll', function (assert) {
+    // namespace doesn’t matter; root short-circuits
+    const Ns = Service.extend({ path: '' });
+    this.owner.register('service:namespace', Ns);
+
+    this.service.setProperties({
+      _aclLoadFailed: true, // simulate fetch failure
+      isRoot: true,
+      canViewAll: true,
+      exactPaths: null,
+      globPaths: null,
+    });
+
+    assert.strictEqual(this.service.permissionsBanner, null, 'root sees no banner even if ACL fetch failed');
+  });
 });
diff --git a/ui/tests/unit/services/store-test.js b/ui/tests/unit/services/store-test.js
deleted file mode 100644
index 9510fac7348..00000000000
--- a/ui/tests/unit/services/store-test.js
+++ /dev/null
@@ -1,257 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { resolve } from 'rsvp';
-import { run } from '@ember/runloop';
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-import { normalizeModelName, keyForCache } from 'vault/services/store';
-import clamp from 'vault/utils/clamp';
-import config from 'vault/config/environment';
-
-const { DEFAULT_PAGE_SIZE } = config.APP;
-
-module('Unit | Service | store', function (hooks) {
-  setupTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.store = this.owner.lookup('service:store');
-  });
-
-  test('normalizeModelName', function (assert) {
-    assert.strictEqual(normalizeModelName('oneThing'), 'one-thing', 'dasherizes modelName');
-  });
-
-  test('keyForCache', function (assert) {
-    const query = { id: 1 };
-    const queryWithSize = { id: 1, size: 1 };
-    assert.deepEqual(keyForCache(query), JSON.stringify(query), 'generated the correct cache key');
-    assert.deepEqual(keyForCache(queryWithSize), JSON.stringify(query), 'excludes size from query cache');
-  });
-
-  test('clamp', function (assert) {
-    assert.strictEqual(clamp('foo', 0, 100), 0, 'returns the min if passed a non-number');
-    assert.strictEqual(clamp(0, 1, 100), 1, 'returns the min when passed number is less than the min');
-    assert.strictEqual(clamp(200, 1, 100), 100, 'returns the max passed number is greater than the max');
-    assert.strictEqual(clamp(50, 1, 100), 50, 'returns the passed number when it is in range');
-  });
-
-  test('store.storeDataset', function (assert) {
-    const arr = ['one', 'two'];
-    const query = { id: 1 };
-    this.store.storeDataset('data', query, {}, arr);
-
-    assert.deepEqual(this.store.getDataset('data', query).dataset, arr, 'it stores the array as .dataset');
-    assert.deepEqual(
-      this.store.getDataset('data', query).response,
-      {},
-      'it stores the response as .response'
-    );
-    assert.ok(this.store.get('lazyCaches').has('data'), 'it stores model map');
-    assert.ok(
-      this.store.get('lazyCaches').get('data').has(keyForCache(query)),
-      'it stores data on the model map'
-    );
-  });
-
-  test('store.clearDataset with a prefix', function (assert) {
-    const arr = ['one', 'two'];
-    const arr2 = ['one', 'two', 'three', 'four'];
-    this.store.storeDataset('data', { id: 1 }, {}, arr);
-    this.store.storeDataset('transit-key', { id: 2 }, {}, arr2);
-    assert.strictEqual(this.store.get('lazyCaches').size, 2, 'it stores both keys');
-
-    this.store.clearDataset('transit-key');
-    assert.strictEqual(this.store.get('lazyCaches').size, 1, 'deletes one key');
-    assert.notOk(this.store.get('lazyCaches').has('transit-key'), 'cache is no longer stored');
-  });
-
-  test('store.clearAllDatasets', function (assert) {
-    const arr = ['one', 'two'];
-    const arr2 = ['one', 'two', 'three', 'four'];
-    this.store.storeDataset('data', { id: 1 }, {}, arr);
-    this.store.storeDataset('transit-key', { id: 2 }, {}, arr2);
-    assert.strictEqual(this.store.get('lazyCaches').size, 2, 'it stores both keys');
-
-    this.store.clearAllDatasets();
-    assert.strictEqual(this.store.get('lazyCaches').size, 0, 'deletes all of the keys');
-    assert.notOk(this.store.get('lazyCaches').has('transit-key'), 'first cache key is no longer stored');
-    assert.notOk(this.store.get('lazyCaches').has('data'), 'second cache key is no longer stored');
-  });
-
-  test('store.getDataset', function (assert) {
-    const arr = ['one', 'two'];
-    this.store.storeDataset('data', { id: 1 }, {}, arr);
-
-    assert.deepEqual(this.store.getDataset('data', { id: 1 }), { response: {}, dataset: arr });
-  });
-
-  test('store.constructResponse', function (assert) {
-    const arr = ['one', 'two', 'three', 'fifteen', 'twelve'];
-    this.store.storeDataset('data', { id: 1 }, {}, arr);
-
-    assert.deepEqual(
-      this.store.constructResponse('data', {
-        id: 1,
-        pageFilter: 't',
-        page: 1,
-        size: 3,
-        responsePath: 'data',
-      }),
-      {
-        data: ['two', 'three', 'fifteen'],
-        meta: {
-          currentPage: 1,
-          lastPage: 2,
-          nextPage: 2,
-          prevPage: 1,
-          total: 5,
-          filteredTotal: 4,
-          pageSize: 3,
-        },
-      },
-      'it returns filtered results'
-    );
-  });
-
-  test('store.fetchPage', async function (assert) {
-    const keys = ['zero', 'one', 'two', 'three', 'four', 'five', 'six'];
-    const data = {
-      data: {
-        keys,
-      },
-    };
-    const pageSize = 2;
-    const query = {
-      size: pageSize,
-      page: 1,
-      responsePath: 'data.keys',
-    };
-    this.store.storeDataset('transit-key', query, data, keys);
-
-    let result;
-    result = await this.store.fetchPage('transit-key', query);
-    assert.strictEqual(result.get('length'), pageSize, 'returns the correct number of items');
-    assert.deepEqual(
-      result.map((r) => r.id),
-      keys.slice(0, pageSize),
-      'returns the first page of items'
-    );
-    assert.deepEqual(
-      result.get('meta'),
-      {
-        nextPage: 2,
-        prevPage: 1,
-        currentPage: 1,
-        lastPage: 4,
-        total: 7,
-        filteredTotal: 7,
-        pageSize: 2,
-      },
-      'returns correct meta values'
-    );
-
-    result = await this.store.fetchPage('transit-key', {
-      size: pageSize,
-      page: 3,
-      responsePath: 'data.keys',
-    });
-    const pageThreeEnd = 3 * pageSize;
-    const pageThreeStart = pageThreeEnd - pageSize;
-    assert.deepEqual(
-      result.map((r) => r.id),
-      keys.slice(pageThreeStart, pageThreeEnd),
-      'returns the third page of items'
-    );
-
-    result = await this.store.fetchPage('transit-key', {
-      size: pageSize,
-      page: 99,
-      responsePath: 'data.keys',
-    });
-
-    assert.deepEqual(
-      result.map((r) => r.id),
-      keys.slice(keys.length - 1),
-      'returns the last page when the page value is beyond the of bounds'
-    );
-
-    result = await this.store.fetchPage('transit-key', {
-      size: pageSize,
-      page: 0,
-      responsePath: 'data.keys',
-    });
-    assert.deepEqual(
-      result.map((r) => r.id),
-      keys.slice(0, pageSize),
-      'returns the first page when page value is under the bounds'
-    );
-  });
-
-  test('store.lazyPaginatedQuery', function (assert) {
-    const response = {
-      data: ['foo'],
-    };
-    let queryArgs;
-    const store = this.owner.factoryFor('service:store').create({
-      adapterFor() {
-        return {
-          query(store, modelName, query) {
-            queryArgs = query;
-            return resolve(response);
-          },
-        };
-      },
-      fetchPage() {},
-    });
-
-    const query = { page: 1, size: 1, responsePath: 'data' };
-    run(function () {
-      store.lazyPaginatedQuery('transit-key', query);
-    });
-    assert.deepEqual(
-      store.getDataset('transit-key', query),
-      { response: { data: null }, dataset: ['foo'] },
-      'stores returned dataset'
-    );
-
-    run(function () {
-      store.lazyPaginatedQuery('secret', { page: 1, responsePath: 'data' });
-    });
-    assert.strictEqual(queryArgs.size, DEFAULT_PAGE_SIZE, 'calls query with DEFAULT_PAGE_SIZE');
-
-    assert.throws(
-      () => {
-        store.lazyPaginatedQuery('transit-key', {});
-      },
-      /responsePath is required/,
-      'requires responsePath'
-    );
-    assert.throws(
-      () => {
-        store.lazyPaginatedQuery('transit-key', { responsePath: 'foo' });
-      },
-      /page is required/,
-      'requires page'
-    );
-  });
-
-  test('store.filterData', async function (assert) {
-    const dataset = [
-      { id: 'foo', name: 'Foo', type: 'test' },
-      { id: 'bar', name: 'Bar', type: 'test' },
-      { id: 'bar-2', name: 'Bar', type: null },
-    ];
-
-    const defaultFiltering = this.store.filterData('foo', dataset);
-    assert.deepEqual(defaultFiltering, [{ id: 'foo', name: 'Foo', type: 'test' }]);
-
-    const filter = (data) => {
-      return data.filter((d) => d.name === 'Bar' && d.type === 'test');
-    };
-    const customFiltering = this.store.filterData(filter, dataset);
-    assert.deepEqual(customFiltering, [{ id: 'bar', name: 'Bar', type: 'test' }]);
-  });
-});
diff --git a/ui/tests/unit/services/unsaved-changes-test.js b/ui/tests/unit/services/unsaved-changes-test.js
new file mode 100644
index 00000000000..b0845e3b3a7
--- /dev/null
+++ b/ui/tests/unit/services/unsaved-changes-test.js
@@ -0,0 +1,32 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+
+module('Unit | Service | unsaved-changes', function (hooks) {
+  setupTest(hooks);
+
+  hooks.beforeEach(function () {
+    this.unsavedChanges = this.owner.lookup('service:unsaved-changes');
+  });
+
+  test('it should set properties', async function (assert) {
+    const initialState = { title: 'Title 1', description: 'Old description' };
+    const currentState = { title: 'New Title 1', description: 'New description' };
+    this.unsavedChanges.setupProperties(initialState, currentState);
+    assert.deepEqual(this.unsavedChanges.initialState, initialState);
+    assert.deepEqual(this.unsavedChanges.currentState, currentState);
+  });
+
+  test('it should update changedFields when getDiff is called', async function (assert) {
+    const initialState = { title: 'Title 1', description: 'Old description' };
+    const currentState = { title: 'Title 1', description: 'New description' };
+    this.unsavedChanges.setupProperties(initialState, currentState);
+    assert.deepEqual(this.unsavedChanges.changedFields, []);
+    this.unsavedChanges.getDiff();
+    assert.deepEqual(this.unsavedChanges.changedFields, ['description']);
+  });
+});
diff --git a/ui/tests/unit/services/version-test.js b/ui/tests/unit/services/version-test.js
index f7ebf7b2f2f..434c5cb282f 100644
--- a/ui/tests/unit/services/version-test.js
+++ b/ui/tests/unit/services/version-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -23,6 +23,16 @@ module('Unit | Service | version', function (hooks) {
     assert.true(service.isEnterprise);
   });
 
+  test('calculates versionDisplay correctly', function (assert) {
+    const service = this.owner.lookup('service:version');
+    service.type = 'community';
+    service.version = '1.2.3';
+    assert.strictEqual(service.versionDisplay, 'v1.2.3');
+    service.type = 'enterprise';
+    service.version = '1.4.7+ent';
+    assert.strictEqual(service.versionDisplay, 'v1.4.7');
+  });
+
   test('hasPerfReplication', function (assert) {
     const service = this.owner.lookup('service:version');
     assert.false(service.hasPerfReplication);
@@ -36,4 +46,31 @@ module('Unit | Service | version', function (hooks) {
     service.features = ['DR Replication'];
     assert.true(service.hasDRReplication);
   });
+
+  // SHOW SECRETS SYNC TESTS
+  test('hasSecretsSync: it returns false when version is community', function (assert) {
+    const service = this.owner.lookup('service:version');
+    service.type = 'community';
+    assert.false(service.hasSecretsSync);
+  });
+
+  test('hasSecretsSync: it returns true when HVD managed', function (assert) {
+    this.owner.lookup('service:flags').featureFlags = ['VAULT_CLOUD_ADMIN_NAMESPACE'];
+    const service = this.owner.lookup('service:version');
+    service.type = 'enterprise';
+    assert.true(service.hasSecretsSync);
+  });
+
+  test('hasSecretsSync: it returns false when not on enterprise license', function (assert) {
+    const service = this.owner.lookup('service:version');
+    service.type = 'enterprise';
+    service.features = ['replication'];
+    assert.false(service.hasSecretsSync);
+  });
+  test('hasSecretsSync: it returns true when  on enterprise license', function (assert) {
+    const service = this.owner.lookup('service:version');
+    service.type = 'enterprise';
+    service.features = ['secrets-sync'];
+    assert.false(service.hasSecretsSync);
+  });
 });
diff --git a/ui/tests/unit/services/wizard-test.js b/ui/tests/unit/services/wizard-test.js
deleted file mode 100644
index 08dd5b21018..00000000000
--- a/ui/tests/unit/services/wizard-test.js
+++ /dev/null
@@ -1,374 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-/* eslint qunit/no-conditional-assertions: "warn" */
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-import sinon from 'sinon';
-import { STORAGE_KEYS, DEFAULTS } from 'vault/helpers/wizard-constants';
-
-module('Unit | Service | wizard', function (hooks) {
-  setupTest(hooks);
-
-  hooks.beforeEach(function () {
-    this.router = this.owner.lookup('service:router');
-    this.router.reopen({
-      transitionTo: sinon.stub().returns({
-        followRedirects: function () {
-          return {
-            then: function (callback) {
-              callback();
-            },
-          };
-        },
-      }),
-      urlFor: sinon.stub().returns('/ui/vault/foo'),
-    });
-  });
-
-  function storage() {
-    return {
-      items: {},
-      getItem(key) {
-        var item = this.items[key];
-        return item && JSON.parse(item);
-      },
-
-      setItem(key, val) {
-        return (this.items[key] = JSON.stringify(val));
-      },
-
-      removeItem(key) {
-        delete this.items[key];
-      },
-
-      keys() {
-        return Object.keys(this.items);
-      },
-    };
-  }
-
-  const testCases = [
-    {
-      method: 'getExtState',
-      args: [STORAGE_KEYS.TUTORIAL_STATE],
-      expectedResults: {
-        storage: [{ key: STORAGE_KEYS.TUTORIAL_STATE, value: 'idle' }],
-      },
-      assertCount: 1,
-    },
-    {
-      method: 'saveExtState',
-      args: [STORAGE_KEYS.TUTORIAL_STATE, 'test'],
-      expectedResults: {
-        storage: [{ key: STORAGE_KEYS.TUTORIAL_STATE, value: 'test' }],
-      },
-      assertCount: 1,
-    },
-    {
-      method: 'storageHasKey',
-      args: ['fake-key'],
-      expectedResults: { value: false },
-      assertCount: 1,
-    },
-    {
-      method: 'storageHasKey',
-      args: [STORAGE_KEYS.TUTORIAL_STATE],
-      expectedResults: { value: true },
-      assertCount: 1,
-    },
-    {
-      method: 'handleDismissed',
-      args: [],
-      expectedResults: {
-        storage: [
-          { key: STORAGE_KEYS.FEATURE_STATE, value: undefined },
-          { key: STORAGE_KEYS.FEATURE_LIST, value: undefined },
-          { key: STORAGE_KEYS.COMPONENT_STATE, value: undefined },
-        ],
-      },
-      assertCount: 3,
-    },
-    {
-      method: 'handlePaused',
-      args: [],
-      properties: {
-        expectedURL: 'this/is/a/url',
-        expectedRouteName: 'this.is.a.route',
-      },
-      expectedResults: {
-        storage: [
-          { key: STORAGE_KEYS.RESUME_URL, value: 'this/is/a/url' },
-          { key: STORAGE_KEYS.RESUME_ROUTE, value: 'this.is.a.route' },
-        ],
-      },
-      assertCount: 2,
-    },
-    {
-      method: 'handlePaused',
-      args: [],
-      expectedResults: {
-        storage: [
-          { key: STORAGE_KEYS.RESUME_URL, value: undefined },
-          { key: STORAGE_KEYS.RESUME_ROUTE, value: undefined },
-        ],
-      },
-      assertCount: 2,
-    },
-    {
-      method: 'handleResume',
-      storage: [
-        { key: STORAGE_KEYS.RESUME_URL, value: 'this/is/a/url' },
-        { key: STORAGE_KEYS.RESUME_ROUTE, value: 'this.is.a.route' },
-      ],
-      args: [],
-      expectedResults: {
-        props: [
-          { prop: 'expectedURL', value: 'this/is/a/url' },
-          { prop: 'expectedRouteName', value: 'this.is.a.route' },
-        ],
-        storage: [
-          { key: STORAGE_KEYS.RESUME_URL, value: undefined },
-          { key: STORAGE_KEYS.RESUME_ROUTE, value: 'this.is.a.route' },
-        ],
-      },
-      assertCount: 4,
-    },
-    {
-      method: 'handleResume',
-      args: [],
-      expectedResults: {
-        storage: [
-          { key: STORAGE_KEYS.RESUME_URL, value: undefined },
-          { key: STORAGE_KEYS.RESUME_ROUTE, value: undefined },
-        ],
-      },
-      assertCount: 2,
-    },
-    {
-      method: 'restartGuide',
-      args: [],
-      expectedResults: {
-        props: [
-          { prop: 'currentState', value: 'active.select' },
-          { prop: 'featureComponent', value: 'wizard/features-selection' },
-          { prop: 'tutorialComponent', value: 'wizard/tutorial-active' },
-        ],
-        storage: [
-          { key: STORAGE_KEYS.FEATURE_STATE, value: undefined },
-          { key: STORAGE_KEYS.FEATURE_STATE_HISTORY, value: undefined },
-          { key: STORAGE_KEYS.FEATURE_LIST, value: undefined },
-          { key: STORAGE_KEYS.COMPONENT_STATE, value: undefined },
-          { key: STORAGE_KEYS.TUTORIAL_STATE, value: 'active.select' },
-          { key: STORAGE_KEYS.COMPLETED_FEATURES, value: undefined },
-          { key: STORAGE_KEYS.RESUME_URL, value: undefined },
-          { key: STORAGE_KEYS.RESUME_ROUTE, value: undefined },
-        ],
-      },
-      assertCount: 11,
-    },
-    {
-      method: 'clearFeatureData',
-      args: [],
-      expectedResults: {
-        props: [
-          { prop: 'currentMachine', value: null },
-          { prop: 'featureMachineHistory', value: null },
-        ],
-        storage: [
-          { key: STORAGE_KEYS.FEATURE_STATE, value: undefined },
-          { key: STORAGE_KEYS.FEATURE_STATE_HISTORY, value: undefined },
-          { key: STORAGE_KEYS.FEATURE_LIST, value: undefined },
-          { key: STORAGE_KEYS.COMPONENT_STATE, value: undefined },
-        ],
-      },
-      assertCount: 6,
-    },
-    {
-      method: 'saveState',
-      args: [
-        'currentState',
-        {
-          value: {
-            init: {
-              active: 'login',
-            },
-          },
-          actions: [{ type: 'render', level: 'feature', component: 'wizard/init-login' }],
-        },
-      ],
-      expectedResults: {
-        props: [{ prop: 'currentState', value: 'init.active.login' }],
-      },
-      assertCount: 1,
-    },
-    {
-      method: 'saveState',
-      args: [
-        'currentState',
-        {
-          value: {
-            active: 'login',
-          },
-          actions: [{ type: 'render', level: 'feature', component: 'wizard/init-login' }],
-        },
-      ],
-      expectedResults: {
-        props: [{ prop: 'currentState', value: 'active.login' }],
-      },
-      assertCount: 1,
-    },
-    {
-      method: 'saveState',
-      args: ['currentState', 'login'],
-      expectedResults: {
-        props: [{ prop: 'currentState', value: 'login' }],
-      },
-      assertCount: 1,
-    },
-    {
-      method: 'saveFeatureHistory',
-      args: ['idle'],
-      properties: { featureList: ['policies', 'tools'] },
-      storage: [{ key: STORAGE_KEYS.COMPLETED_FEATURES, value: ['secrets'] }],
-      expectedResults: {
-        props: [{ prop: 'featureMachineHistory', value: null }],
-      },
-      assertCount: 1,
-    },
-    {
-      method: 'saveFeatureHistory',
-      args: ['idle'],
-      properties: { featureList: ['policies', 'tools'] },
-      storage: [],
-      expectedResults: {
-        props: [{ prop: 'featureMachineHistory', value: ['idle'] }],
-      },
-      assertCount: 1,
-    },
-    {
-      method: 'saveFeatureHistory',
-      args: ['idle'],
-      properties: { featureList: ['policies', 'tools'] },
-      storage: [],
-      expectedResults: {
-        props: [{ prop: 'featureMachineHistory', value: ['idle'] }],
-      },
-      assertCount: 1,
-    },
-    {
-      method: 'saveFeatureHistory',
-      args: ['idle'],
-      properties: { featureMachineHistory: [], featureList: ['policies', 'tools'] },
-      storage: [{ key: STORAGE_KEYS.COMPLETED_FEATURES, value: ['secrets'] }],
-      expectedResults: {
-        props: [{ prop: 'featureMachineHistory', value: ['idle'] }],
-        storage: [{ key: STORAGE_KEYS.FEATURE_STATE_HISTORY, value: ['idle'] }],
-      },
-      assertCount: 2,
-    },
-    {
-      method: 'saveFeatureHistory',
-      args: ['idle'],
-      properties: { featureMachineHistory: null, featureList: ['policies', 'tools'] },
-      storage: [{ key: STORAGE_KEYS.COMPLETED_FEATURES, value: ['secrets'] }],
-      expectedResults: {
-        props: [{ prop: 'featureMachineHistory', value: null }],
-      },
-      assertCount: 1,
-    },
-    {
-      method: 'saveFeatureHistory',
-      args: ['create'],
-      properties: { featureMachineHistory: ['idle'], featureList: ['policies', 'tools'] },
-      storage: [{ key: STORAGE_KEYS.COMPLETED_FEATURES, value: ['secrets'] }],
-      expectedResults: {
-        props: [{ prop: 'featureMachineHistory', value: ['idle', 'create'] }],
-        storage: [{ key: STORAGE_KEYS.FEATURE_STATE_HISTORY, value: ['idle', 'create'] }],
-      },
-      assertCount: 2,
-    },
-    {
-      method: 'saveFeatureHistory',
-      args: ['create'],
-      properties: { featureMachineHistory: ['idle'], featureList: ['policies', 'tools'] },
-      storage: [
-        { key: STORAGE_KEYS.COMPLETED_FEATURES, value: ['secrets'] },
-        { key: STORAGE_KEYS.FEATURE_STATE_HISTORY, value: ['idle', 'create'] },
-      ],
-      expectedResults: {
-        props: [{ prop: 'featureMachineHistory', value: ['idle', 'create'] }],
-        storage: [{ key: STORAGE_KEYS.FEATURE_STATE_HISTORY, value: ['idle', 'create'] }],
-      },
-      assertCount: 2,
-    },
-    {
-      method: 'startFeature',
-      args: [],
-      properties: { featureList: ['secrets', 'tools'] },
-      expectedResults: {
-        props: [
-          { prop: 'featureState', value: 'idle' },
-          { prop: 'currentMachine', value: 'secrets' },
-        ],
-      },
-      assertCount: 2,
-    },
-    {
-      method: 'saveFeatures',
-      args: [['secrets', 'tools']],
-      expectedResults: {
-        props: [{ prop: 'featureList', value: ['secrets', 'tools'] }],
-        storage: [{ key: STORAGE_KEYS.FEATURE_LIST, value: ['secrets', 'tools'] }],
-      },
-      assertCount: 2,
-    },
-  ];
-
-  testCases.forEach((testCase) => {
-    const store = storage();
-    test(`${testCase.method}`, function (assert) {
-      assert.expect(testCase.assertCount);
-      const wizard = this.owner.factoryFor('service:wizard').create({
-        storage() {
-          return store;
-        },
-      });
-
-      if (testCase.properties) {
-        wizard.setProperties(testCase.properties);
-      } else {
-        wizard.setProperties(DEFAULTS);
-      }
-
-      if (testCase.storage) {
-        testCase.storage.forEach((item) => wizard.storage().setItem(item.key, item.value));
-      }
-
-      const result = wizard[testCase.method](...testCase.args);
-      if (testCase.expectedResults.props) {
-        testCase.expectedResults.props.forEach((property) => {
-          assert.deepEqual(
-            wizard.get(property.prop),
-            property.value,
-            `${testCase.method} creates correct value for ${property.prop}`
-          );
-        });
-      }
-      if (testCase.expectedResults.storage) {
-        testCase.expectedResults.storage.forEach((item) => {
-          assert.deepEqual(
-            wizard.storage().getItem(item.key),
-            item.value,
-            `${testCase.method} creates correct storage state for ${item.key}`
-          );
-        });
-      }
-      if (testCase.expectedResults.value !== null && testCase.expectedResults.value !== undefined) {
-        assert.strictEqual(result, testCase.expectedResults.value, `${testCase.method} gives correct value`);
-      }
-    });
-  });
-});
diff --git a/ui/tests/unit/transforms/comma-string-test.js b/ui/tests/unit/transforms/comma-string-test.js
index 931530cdd2c..516186907ff 100644
--- a/ui/tests/unit/transforms/comma-string-test.js
+++ b/ui/tests/unit/transforms/comma-string-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/transforms/date-time-local-test.js b/ui/tests/unit/transforms/date-time-local-test.js
index 4581b8e7376..265a0765c10 100644
--- a/ui/tests/unit/transforms/date-time-local-test.js
+++ b/ui/tests/unit/transforms/date-time-local-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/transforms/mount-visibility-test.js b/ui/tests/unit/transforms/mount-visibility-test.js
index 4c334f46e7b..aeffadcf282 100644
--- a/ui/tests/unit/transforms/mount-visibility-test.js
+++ b/ui/tests/unit/transforms/mount-visibility-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/unload-test.js b/ui/tests/unit/unload-test.js
index ae090affb12..47d4618af6c 100644
--- a/ui/tests/unit/unload-test.js
+++ b/ui/tests/unit/unload-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -70,7 +70,7 @@ module('Unit | Model | unloadAll works as expected', function (hooks) {
 
     assert.strictEqual(this.store.peekAll('company').length, 0, 'peekAll 0 - companies unloaded');
     assert.strictEqual(
-      this.store.peekAll('company').toArray().length,
+      this.store.peekAll('company').slice().length,
       0,
       'peekAll array 0 - companies unloaded'
     );
@@ -106,7 +106,7 @@ module('Unit | Model | unloadAll works as expected', function (hooks) {
 
     assert.strictEqual(this.store.peekAll('company').length, 0, 'peekAll 0 - companies unloaded');
     assert.strictEqual(
-      this.store.peekAll('company').toArray().length,
+      this.store.peekAll('company').slice().length,
       0,
       'peekAll array 0 - companies unloaded'
     );
diff --git a/ui/tests/unit/utils/advanced-secret-test.js b/ui/tests/unit/utils/advanced-secret-test.js
index 1a58b38e68e..dfff63bdc42 100644
--- a/ui/tests/unit/utils/advanced-secret-test.js
+++ b/ui/tests/unit/utils/advanced-secret-test.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { isAdvancedSecret, obfuscateData } from 'core/utils/advanced-secret';
+import { isAdvancedSecret } from 'core/utils/advanced-secret';
 import { module, test } from 'qunit';
 
 module('Unit | Utility | advanced-secret', function () {
@@ -46,78 +46,4 @@ module('Unit | Utility | advanced-secret', function () {
       });
     });
   });
-  module('obfuscateData', function () {
-    test('it obfuscates values of an object', function (assert) {
-      assert.expect(4);
-      [
-        {
-          name: 'flat map',
-          data: {
-            first: 'one',
-            second: 'two',
-            third: 'three',
-          },
-          obscured: {
-            first: '********',
-            second: '********',
-            third: '********',
-          },
-        },
-        {
-          name: 'nested map',
-          data: {
-            first: 'one',
-            second: {
-              third: 'two',
-            },
-          },
-          obscured: {
-            first: '********',
-            second: {
-              third: '********',
-            },
-          },
-        },
-        {
-          name: 'numbers and arrays',
-          data: {
-            first: 1,
-            list: ['one', 'two'],
-            second: {
-              third: ['one', 'two'],
-              number: 5,
-            },
-          },
-          obscured: {
-            first: '********',
-            list: ['********', '********'],
-            second: {
-              third: ['********', '********'],
-              number: '********',
-            },
-          },
-        },
-        {
-          name: 'object arrays',
-          data: {
-            list: [{ one: 'one' }, { two: 'two' }],
-          },
-          obscured: {
-            list: ['********', '********'],
-          },
-        },
-      ].forEach((test) => {
-        const result = obfuscateData(test.data);
-        assert.deepEqual(result, test.obscured, `obfuscates values of ${test.name}`);
-      });
-    });
-
-    test('it does not obfuscate non-object values', function (assert) {
-      assert.expect(3);
-      ['some-string', 5, ['my', 'array']].forEach((test) => {
-        const result = obfuscateData(test);
-        assert.deepEqual(result, test, `does not obfuscate value ${JSON.stringify(test)}`);
-      });
-    });
-  });
 });
diff --git a/ui/tests/unit/utils/api-path-test.js b/ui/tests/unit/utils/api-path-test.js
index 8c723286e98..9ddf4580886 100644
--- a/ui/tests/unit/utils/api-path-test.js
+++ b/ui/tests/unit/utils/api-path-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/utils/chart-helpers-test.js b/ui/tests/unit/utils/chart-helpers-test.js
index 14dad1eb2d1..dc04fd5ff45 100644
--- a/ui/tests/unit/utils/chart-helpers-test.js
+++ b/ui/tests/unit/utils/chart-helpers-test.js
@@ -1,9 +1,9 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { formatNumbers, calculateAverage, calculateSum } from 'vault/utils/chart-helpers';
+import { numericalAxisLabel, calculateAverage, calculateSum } from 'vault/utils/chart-helpers';
 import { module, test } from 'qunit';
 
 const SMALL_NUMBERS = [0, 7, 27, 103, 999];
@@ -17,16 +17,16 @@ const LARGE_NUMBERS = {
 };
 
 module('Unit | Utility | chart-helpers', function () {
-  test('formatNumbers renders number correctly', function (assert) {
+  test('numericalAxisLabel renders number correctly', function (assert) {
     assert.expect(12);
-    const method = formatNumbers();
+    const method = numericalAxisLabel();
     assert.ok(method);
     SMALL_NUMBERS.forEach(function (num) {
-      assert.strictEqual(formatNumbers(num), num, `Does not format small number ${num}`);
+      assert.strictEqual(numericalAxisLabel(num), num, `Does not format small number ${num}`);
     });
     Object.keys(LARGE_NUMBERS).forEach(function (num) {
       const expected = LARGE_NUMBERS[num];
-      assert.strictEqual(formatNumbers(num), expected, `Formats ${num} as ${expected}`);
+      assert.strictEqual(numericalAxisLabel(num), expected, `Formats ${num} as ${expected}`);
     });
   });
 
diff --git a/ui/tests/unit/utils/common-prefix-test.js b/ui/tests/unit/utils/common-prefix-test.js
index 93d75dbf00a..6f230754e6a 100644
--- a/ui/tests/unit/utils/common-prefix-test.js
+++ b/ui/tests/unit/utils/common-prefix-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/utils/decode-config-from-jwt-test.js b/ui/tests/unit/utils/decode-config-from-jwt-test.js
index 32e23c378cc..0491d33cae1 100644
--- a/ui/tests/unit/utils/decode-config-from-jwt-test.js
+++ b/ui/tests/unit/utils/decode-config-from-jwt-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/utils/forms/field-test.js b/ui/tests/unit/utils/forms/field-test.js
new file mode 100644
index 00000000000..d667889bdc2
--- /dev/null
+++ b/ui/tests/unit/utils/forms/field-test.js
@@ -0,0 +1,31 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import FormField from 'vault/utils/forms/field';
+import { module, test } from 'qunit';
+
+module('Unit | Utility | forms | field', function (hooks) {
+  hooks.beforeEach(function () {
+    this.options = {
+      label: 'Test field',
+      subText: 'This is a form field',
+      fieldValue: 'custom.path',
+      editType: 'textarea',
+    };
+  });
+
+  test('it should set name, type and field options', async function (assert) {
+    const field = new FormField('test', 'string', this.options);
+    assert.strictEqual(field.name, 'test', 'Name is set correctly');
+    assert.strictEqual(field.type, 'string', 'Type is set correctly');
+    assert.deepEqual(field.options, this.options, 'Options are set correctly');
+  });
+
+  test('it should default field value', async function (assert) {
+    this.options.fieldValue = undefined;
+    const field = new FormField('test', 'string', this.options);
+    assert.strictEqual(field.options.fieldValue, 'test', 'Default field value is set correctly');
+  });
+});
diff --git a/ui/tests/unit/utils/forms/validate-test.js b/ui/tests/unit/utils/forms/validate-test.js
new file mode 100644
index 00000000000..f732435ffa2
--- /dev/null
+++ b/ui/tests/unit/utils/forms/validate-test.js
@@ -0,0 +1,129 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { validate } from 'vault/utils/forms/validate';
+import { module, test } from 'qunit';
+import sinon from 'sinon';
+import validators from 'vault/utils/forms/validators';
+
+module('Unit | Utility | forms | validate', function (hooks) {
+  hooks.beforeEach(function () {
+    this.data = {
+      foo: null,
+      integer: null,
+    };
+    this.consoleStub = sinon.stub(console, 'error');
+  });
+
+  hooks.afterEach(function () {
+    this.consoleStub.restore();
+  });
+
+  test('it should log error to console when validations are not passed as array', function (assert) {
+    const validations = {
+      foo: { type: 'presence', message: 'Foo is required' },
+    };
+    validate(this.data, validations);
+    const message = 'Must provide validations as an array for property "foo".';
+    assert.true(this.consoleStub.calledWith(message));
+  });
+
+  test('it should return valid when validations are not provided', async function (assert) {
+    const expected = { isValid: true, state: {}, invalidFormMessage: '' };
+    const validation = validate(this.data);
+    assert.deepEqual(validation, expected, 'Data is considered valid when validations are not provided');
+  });
+
+  test('it should log error for incorrect validator type', function (assert) {
+    const validations = {
+      foo: [{ type: 'bar', message: 'Foo is bar' }],
+    };
+    validate(this.data, validations);
+    const types = Object.keys(validators).join(', ');
+    const message = `Validator type: "bar" not found. Available validators: ${types}`;
+    assert.ok(this.consoleStub.calledWith(message));
+  });
+
+  test('it should validate', function (assert) {
+    const message = 'This field is required';
+    const validations = {
+      foo: [{ type: 'presence', message }],
+    };
+    const v1 = validate(this.data, validations);
+    assert.false(v1.isValid, 'isValid state is correct when errors exist');
+    assert.deepEqual(
+      v1.state,
+      { foo: { isValid: false, errors: [message], warnings: [] } },
+      'Correct state returned when property is invalid'
+    );
+
+    this.data.foo = true;
+    const v2 = validate(this.data, validations);
+    assert.true(v2.isValid, 'isValid state is correct when no errors exist');
+    assert.deepEqual(
+      v2.state,
+      { foo: { isValid: true, errors: [], warnings: [] } },
+      'Correct state returned when property is valid'
+    );
+  });
+
+  test('invalid form message has correct error count', function (assert) {
+    const message = 'This field is required';
+    const messageII = 'This field must be a number';
+    const validations = {
+      foo: [{ type: 'presence', message }],
+      integer: [{ type: 'number', messageII }],
+    };
+    const v1 = validate(this.data, validations);
+    assert.strictEqual(
+      v1.invalidFormMessage,
+      'There are 2 errors with this form.',
+      'error message says form as 2 errors'
+    );
+
+    this.data.integer = 9;
+    const v2 = validate(this.data, validations);
+    assert.strictEqual(
+      v2.invalidFormMessage,
+      'There is an error with this form.',
+      'error message says form has an error'
+    );
+
+    this.data.foo = true;
+    const v3 = validate(this.data, validations);
+    assert.strictEqual(v3.invalidFormMessage, '', 'invalidFormMessage is empty when form is valid');
+  });
+
+  test('it should validate warnings', function (assert) {
+    const message = 'Value contains whitespace.';
+    const validations = {
+      foo: [
+        {
+          type: 'containsWhiteSpace',
+          message,
+          level: 'warn',
+        },
+      ],
+    };
+    this.data.foo = 'foo bar';
+    const { state, isValid } = validate(this.data, validations);
+    assert.true(isValid, 'Data is considered valid when there are only warnings');
+    assert.strictEqual(state.foo.warnings.join(' '), message, 'Warnings are returned');
+  });
+
+  test('it should accept a key to map validations to in state object', async function (assert) {
+    this.data.foo = undefined;
+    const validations = {
+      foo: [{ type: 'presence', message: 'Foo is required' }],
+    };
+    const validation = validate(this.data, validations, 'data');
+    const expected = {
+      isValid: false,
+      state: { 'data.foo': { isValid: false, errors: ['Foo is required'], warnings: [] } },
+      invalidFormMessage: 'There is an error with this form.',
+    };
+    assert.deepEqual(validation, expected, 'Validation state is mapped to the correct key');
+  });
+});
diff --git a/ui/tests/unit/utils/forms/validators-test.js b/ui/tests/unit/utils/forms/validators-test.js
new file mode 100644
index 00000000000..5d4d99c51bb
--- /dev/null
+++ b/ui/tests/unit/utils/forms/validators-test.js
@@ -0,0 +1,170 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+import validators from 'vault/utils/forms/validators';
+
+module('Unit | Util | validators', function (hooks) {
+  setupTest(hooks);
+
+  // * MODEL VALIDATORS
+
+  test('it should validate presence', function (assert) {
+    let isValid;
+    const check = (value) => (isValid = validators.presence(value));
+    check(null);
+    assert.false(isValid, 'Invalid when value is null');
+    check('');
+    assert.false(isValid, 'Invalid when value is empty string');
+    check(true);
+    assert.true(isValid, 'Valid when value is true');
+    check(0);
+    assert.true(isValid, 'Valid when value is 0 as integer');
+    check('0');
+    assert.true(isValid, 'Valid when value is 0 as string');
+  });
+
+  test('it should validate length', function (assert) {
+    let isValid;
+    const options = { nullable: true, min: 3, max: 5 };
+    const check = (prop) => (isValid = validators.length(prop, options));
+    check(null);
+    assert.true(isValid, 'Valid when nullable is true');
+    options.nullable = false;
+    check(null);
+    assert.false(isValid, 'Invalid when nullable is false');
+    check('12');
+    assert.false(isValid, 'Invalid when string not min length');
+    check('123456');
+    assert.false(isValid, 'Invalid when string over max length');
+    check('1234');
+    assert.true(isValid, 'Valid when string between min and max length');
+    check(12);
+    assert.false(isValid, 'Invalid when integer not min length');
+    check(123456);
+    assert.false(isValid, 'Invalid when integer over max length');
+    check(1234);
+    assert.true(isValid, 'Valid when integer between min and max length');
+    options.min = 1;
+    check(0);
+    assert.true(isValid, 'Valid when integer is 0 and min is 1');
+    check('0');
+    assert.true(isValid, 'Valid when string is 0 and min is 1');
+  });
+
+  test('it should validate number', function (assert) {
+    let isValid;
+    const options = { nullable: true };
+    const check = (prop) => (isValid = validators.number(prop, options));
+    check(null);
+    assert.true(isValid, 'Valid when nullable is true');
+    options.nullable = false;
+    check(null);
+    assert.false(isValid, 'Invalid when nullable is false');
+    check(9);
+    assert.true(isValid, 'Valid for number');
+    check('9');
+    assert.true(isValid, 'Valid for number as string');
+    check('foo');
+    assert.false(isValid, 'Invalid for string that is not a number');
+    check('12foo');
+    assert.false(isValid, 'Invalid for string that contains a number');
+    check(0);
+    assert.true(isValid, 'Valid for 0 as an integer');
+    check('0');
+    assert.true(isValid, 'Valid for 0 as a string');
+  });
+
+  test('it should validate whitespace', function (assert) {
+    let isValid;
+    const check = (prop) => (isValid = validators.containsWhiteSpace(prop));
+    check('validText');
+    assert.true(isValid, 'Valid when text contains no spaces');
+    check('valid-text');
+    assert.true(isValid, 'Valid when text contains no spaces and hyphen');
+    check('some space');
+    assert.false(isValid, 'Invalid when text contains single space');
+    check('text with spaces');
+    assert.false(isValid, 'Invalid when text contains multiple spaces');
+    check(' leadingSpace');
+    assert.false(isValid, 'Invalid when text has leading whitespace');
+    check('trailingSpace ');
+    assert.false(isValid, 'Invalid when text has trailing whitespace');
+  });
+
+  test('it should validate value ends in a slash', function (assert) {
+    let isValid;
+    const check = (prop) => (isValid = validators.endsInSlash(prop));
+    check('validText');
+    assert.true(isValid, 'Valid when text does not end in slash');
+    check('valid/Text');
+    assert.true(isValid, 'Valid when text only contains slash');
+    check('invalid/');
+    assert.false(isValid, 'Invalid when text ends in slash');
+    check('also/invalid/');
+    assert.false(isValid, 'Invalid when text contains and ends in slash');
+  });
+
+  // * GENERAL VALIDATORS
+  test('it returns whether a value has whitespace or not', function (assert) {
+    let hasWhitespace;
+    const check = (value) => (hasWhitespace = validators.hasWhitespace(value));
+
+    check('someText');
+    assert.false(hasWhitespace, 'False when text contains no spaces');
+
+    check('some-text');
+    assert.false(hasWhitespace, 'False when text contains no spaces and hyphen');
+
+    check('some space');
+    assert.true(hasWhitespace, 'True when text contains single space');
+
+    check('text with spaces');
+    assert.true(hasWhitespace, 'True when text contains multiple spaces');
+
+    check(' leadingSpace');
+    assert.true(hasWhitespace, 'True when text has leading whitespace');
+
+    check('trailingSpace ');
+    assert.true(hasWhitespace, 'True when text has trailing whitespace');
+  });
+
+  test('it returns whether a string input values evaluated as non-strings', function (assert) {
+    let isNonString;
+    const check = (value) => (isNonString = validators.isNonString(value));
+    check(' {"foo": "bar"} ');
+    assert.true(isNonString, 'returns true when value contains an object');
+
+    check(' ["a", "b", "c"] ');
+    assert.true(isNonString, 'returns true when value contains an array');
+
+    check('123');
+    assert.true(isNonString, 'returns true when value is numbers');
+
+    check('123e6');
+    assert.true(isNonString, 'returns true when value is numbers with exponents');
+
+    check('true');
+    assert.true(isNonString, 'returns true when value is true');
+
+    // falsy values that return true because JSON.parse() is successful
+    check('null');
+    assert.true(isNonString, 'returns true when value is null');
+
+    check('false');
+    assert.true(isNonString, 'returns true when value is false');
+
+    check('0');
+    assert.true(isNonString, 'returns true when value is "0"');
+
+    // falsy
+    check('undefined');
+    assert.false(isNonString, 'returns false when value is undefined');
+
+    check('my string');
+    assert.false(isNonString, 'returns false when value is letters');
+  });
+});
diff --git a/ui/tests/unit/utils/key-utils-test.js b/ui/tests/unit/utils/key-utils-test.js
index 863511803f4..947e2aa53ed 100644
--- a/ui/tests/unit/utils/key-utils-test.js
+++ b/ui/tests/unit/utils/key-utils-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/utils/kmip-role-fields-test.js b/ui/tests/unit/utils/kmip-role-fields-test.js
new file mode 100644
index 00000000000..a8e080ede41
--- /dev/null
+++ b/ui/tests/unit/utils/kmip-role-fields-test.js
@@ -0,0 +1,52 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import { setupTest } from 'ember-qunit';
+import {
+  nonOperationFields,
+  operationFields,
+  operationFieldsWithoutSpecial,
+} from 'vault/utils/model-helpers/kmip-role-fields';
+
+module('Unit | Util | kmip role fields', function (hooks) {
+  setupTest(hooks);
+
+  [
+    {
+      name: 'when fields is empty',
+      fields: [],
+      opFields: [],
+      nonOpFields: [],
+      opWithoutSpecial: [],
+    },
+    {
+      name: 'when no op fields',
+      fields: ['foo', 'bar'],
+      opFields: [],
+      nonOpFields: ['foo', 'bar'],
+      opWithoutSpecial: [],
+    },
+    {
+      name: 'when op fields',
+      fields: ['foo', 'bar', 'operationFoo', 'operationBar', 'operationAll'],
+      opFields: ['operationFoo', 'operationBar', 'operationAll'],
+      nonOpFields: ['foo', 'bar'],
+      opWithoutSpecial: ['operationFoo', 'operationBar'],
+    },
+  ].forEach(({ name, fields, opFields, nonOpFields, opWithoutSpecial }) => {
+    test(`${name}`, function (assert) {
+      const originalFields = JSON.parse(JSON.stringify(fields));
+      assert.deepEqual(operationFields(fields), opFields, 'operation fields correct');
+      assert.deepEqual(nonOperationFields(fields), nonOpFields, 'non operation fields');
+      assert.deepEqual(
+        operationFieldsWithoutSpecial(fields),
+        opWithoutSpecial,
+        'operation fields without special'
+      );
+      assert.deepEqual(fields, originalFields, 'does not mutate the original');
+    });
+  });
+});
diff --git a/ui/tests/unit/utils/kv-breadcrumbs-test.js b/ui/tests/unit/utils/kv-breadcrumbs-test.js
index 086c4890999..1342ac71ae3 100644
--- a/ui/tests/unit/utils/kv-breadcrumbs-test.js
+++ b/ui/tests/unit/utils/kv-breadcrumbs-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -41,60 +41,63 @@ module('Unit | Utility | kv-breadcrumbs', function () {
   });
 
   test('breadcrumbsForSecret works', function (assert) {
-    let results = breadcrumbsForSecret('beep/bop/boop');
+    let results = breadcrumbsForSecret('kv-mount', 'beep/bop/boop');
     assert.deepEqual(
       results,
       [
-        { label: 'beep', route: 'list-directory', model: 'beep/' },
-        { label: 'bop', route: 'list-directory', model: 'beep/bop/' },
-        { label: 'boop', route: 'secret.details', model: 'beep/bop/boop' },
+        { label: 'beep', route: 'list-directory', models: ['kv-mount', 'beep/'] },
+        { label: 'bop', route: 'list-directory', models: ['kv-mount', 'beep/bop/'] },
+        { label: 'boop', route: 'secret.index', models: ['kv-mount', 'beep/bop/boop'] },
       ],
       'correct when full nested path to secret'
     );
 
-    results = breadcrumbsForSecret('beep/bop/boop', true);
+    results = breadcrumbsForSecret('kv-mount', 'beep/bop/boop', true);
     assert.deepEqual(
       results,
       [
-        { label: 'beep', route: 'list-directory', model: 'beep/' },
-        { label: 'bop', route: 'list-directory', model: 'beep/bop/' },
+        { label: 'beep', route: 'list-directory', models: ['kv-mount', 'beep/'] },
+        { label: 'bop', route: 'list-directory', models: ['kv-mount', 'beep/bop/'] },
         { label: 'boop' },
       ],
       'correct when full nested path to secret and last item current'
     );
 
-    results = breadcrumbsForSecret('beep');
+    results = breadcrumbsForSecret('kv-mount', 'beep');
     assert.deepEqual(
       results,
-      [{ label: 'beep', route: 'secret.details', model: 'beep' }],
+      [{ label: 'beep', route: 'secret.index', models: ['kv-mount', 'beep'] }],
       'correct when non-nested secret path'
     );
 
-    results = breadcrumbsForSecret('beep', true);
+    results = breadcrumbsForSecret('kv-mount', 'beep', true);
     assert.deepEqual(
       results,
       [{ label: 'beep' }],
       'correct when non-nested secret path and last item current'
     );
 
-    results = breadcrumbsForSecret('beep/bop/');
+    results = breadcrumbsForSecret('kv-mount', 'beep/bop/');
     assert.deepEqual(
       results,
       [
-        { label: 'beep', route: 'list-directory', model: 'beep/' },
-        { label: 'bop', route: 'list-directory', model: 'beep/bop/' },
+        { label: 'beep', route: 'list-directory', models: ['kv-mount', 'beep/'] },
+        { label: 'bop', route: 'list-directory', models: ['kv-mount', 'beep/bop/'] },
       ],
       'correct when path is directory'
     );
 
-    results = breadcrumbsForSecret('beep/bop/', true);
+    results = breadcrumbsForSecret('kv-mount', 'beep/bop/', true);
     assert.deepEqual(
       results,
-      [{ label: 'beep', route: 'list-directory', model: 'beep/' }, { label: 'bop' }],
+      [{ label: 'beep', route: 'list-directory', models: ['kv-mount', 'beep/'] }, { label: 'bop' }],
       'correct when path is directory and last item current'
     );
 
     results = breadcrumbsForSecret();
+    assert.deepEqual(results, [], 'fails gracefully if backend is undefined');
+
+    results = breadcrumbsForSecret('backend-only');
     assert.deepEqual(results, [], 'fails gracefully if secretPath is undefined');
   });
 });
diff --git a/ui/tests/unit/utils/kv-path-test.js b/ui/tests/unit/utils/kv-path-test.js
index 2e75b12bd19..e45be3a9605 100644
--- a/ui/tests/unit/utils/kv-path-test.js
+++ b/ui/tests/unit/utils/kv-path-test.js
@@ -1,12 +1,37 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { kvDataPath, kvDestroyPath, kvMetadataPath, kvUndeletePath } from 'vault/utils/kv-path';
+import {
+  buildKvPath,
+  kvDataPath,
+  kvDestroyPath,
+  kvMetadataPath,
+  kvUndeletePath,
+  kvSubkeysPath,
+} from 'vault/utils/kv-path';
 import { module, test } from 'qunit';
 
 module('Unit | Utility | kv-path utils', function () {
+  test('buildKvPath encodes and sanitizes path', function (assert) {
+    assert.expect(4);
+
+    assert.strictEqual(
+      buildKvPath('my-backend', '//my-secret/hello ', 'metadata'),
+      'my-backend/metadata/my-secret/hello'
+    );
+    assert.strictEqual(
+      buildKvPath('my-backend', 'my-secret/hello ', 'data'),
+      'my-backend/data/my-secret/hello'
+    );
+    assert.strictEqual(
+      buildKvPath('kv?engine', 'my-secret hello ', 'data'),
+      'kv%3Fengine/data/my-secret%20hello'
+    );
+    assert.strictEqual(buildKvPath('kv-engine', 'foo', 'data', 2), 'kv-engine/data/foo?version=2');
+  });
+
   module('kvDataPath', function () {
     [
       {
@@ -92,4 +117,39 @@ module('Unit | Utility | kv-path utils', function () {
       });
     });
   });
+
+  module('kvSubkeysPath', function () {
+    [
+      {
+        backend: 'some/back end',
+        path: 'my/secret/path',
+        expected: 'some/back%20end/subkeys/my/secret/path',
+      },
+      {
+        backend: 'some/back end',
+        path: 'my/secret/path',
+        version: 3,
+        expected: 'some/back%20end/subkeys/my/secret/path?version=3',
+      },
+      {
+        backend: 'some/back end',
+        path: 'my/secret/path',
+        depth: 0,
+        version: 3,
+        expected: 'some/back%20end/subkeys/my/secret/path?depth=0&version=3',
+      },
+      {
+        backend: 'some/back end',
+        path: 'my/secret/path',
+        depth: 4,
+        expected: 'some/back%20end/subkeys/my/secret/path?depth=4',
+      },
+    ].forEach((t, idx) => {
+      test(`kvSubkeysPath ${idx}`, function (assert) {
+        const query = { depth: t.depth, version: t.version };
+        const result = kvSubkeysPath(t.backend, t.path, query);
+        assert.strictEqual(result, t.expected);
+      });
+    });
+  });
 });
diff --git a/ui/tests/unit/utils/ldap-breadcrumbs-test.js b/ui/tests/unit/utils/ldap-breadcrumbs-test.js
new file mode 100644
index 00000000000..fd61aa764b9
--- /dev/null
+++ b/ui/tests/unit/utils/ldap-breadcrumbs-test.js
@@ -0,0 +1,79 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { ldapBreadcrumbs, roleRoutes } from 'ldap/utils/ldap-breadcrumbs';
+import { module, test } from 'qunit';
+
+module('Unit | Utility | ldap breadcrumbs', function (hooks) {
+  hooks.beforeEach(async function () {
+    this.mountPath = 'my-engine';
+    this.roleType = 'static';
+    const routeParams = (childResource) => {
+      return [this.mountPath, this.roleType, childResource];
+    };
+    this.testCrumbs = (path, { lastItemCurrent }) => {
+      return ldapBreadcrumbs(path, routeParams, roleRoutes, lastItemCurrent);
+    };
+  });
+
+  test('it generates crumbs when the path is a directory', function (assert) {
+    const path = 'prod/org/';
+    let actual = this.testCrumbs(path, { lastItemCurrent: true });
+    let expected = [
+      { label: 'prod', route: 'roles.subdirectory', models: [this.mountPath, this.roleType, 'prod/'] },
+      { label: 'org' },
+    ];
+    assert.propEqual(actual, expected, 'crumbs are correct when lastItemCurrent = true');
+
+    actual = this.testCrumbs(path, { lastItemCurrent: false });
+    expected = [
+      { label: 'prod', route: 'roles.subdirectory', models: [this.mountPath, this.roleType, 'prod/'] },
+      { label: 'org', route: 'roles.subdirectory', models: [this.mountPath, this.roleType, 'prod/org/'] },
+    ];
+    assert.propEqual(actual, expected, 'crumbs are correct when lastItemCurrent = false');
+  });
+
+  test('it generates crumbs when the path is not a directory', function (assert) {
+    const path = 'prod/org/admin';
+    let actual = this.testCrumbs(path, { lastItemCurrent: true });
+    let expected = [
+      { label: 'prod', route: 'roles.subdirectory', models: [this.mountPath, this.roleType, 'prod/'] },
+      { label: 'org', route: 'roles.subdirectory', models: [this.mountPath, this.roleType, 'prod/org/'] },
+      { label: 'admin' },
+    ];
+    assert.propEqual(actual, expected, 'crumbs are correct when lastItemCurrent = true');
+
+    actual = this.testCrumbs(path, { lastItemCurrent: false });
+    expected = [
+      { label: 'prod', route: 'roles.subdirectory', models: [this.mountPath, this.roleType, 'prod/'] },
+      { label: 'org', route: 'roles.subdirectory', models: [this.mountPath, this.roleType, 'prod/org/'] },
+      {
+        label: 'admin',
+        route: 'roles.role.details',
+        models: [this.mountPath, this.roleType, 'prod/org/admin'],
+      },
+    ];
+    assert.propEqual(actual, expected, 'crumbs are correct when lastItemCurrent = false');
+  });
+
+  test('it generates crumbs when the path is the top-level', function (assert) {
+    const path = 'prod/';
+    let actual = this.testCrumbs(path, { lastItemCurrent: true });
+    let expected = [{ label: 'prod' }];
+    assert.propEqual(actual, expected, 'crumbs are correct when lastItemCurrent = true');
+
+    actual = this.testCrumbs(path, { lastItemCurrent: false });
+    expected = [
+      { label: 'prod', route: 'roles.subdirectory', models: [this.mountPath, this.roleType, 'prod/'] },
+    ];
+    assert.propEqual(actual, expected, 'crumbs are correct when lastItemCurrent = false');
+  });
+
+  test('it fails gracefully when no path', function (assert) {
+    const path = undefined;
+    const actual = this.testCrumbs(path, { lastItemCurrent: false });
+    assert.propEqual(actual, [], 'returns empty array when path is null');
+  });
+});
diff --git a/ui/tests/unit/utils/openapi-helpers-test.js b/ui/tests/unit/utils/openapi-helpers-test.js
index 0b1d8c0e26c..36d582d6954 100644
--- a/ui/tests/unit/utils/openapi-helpers-test.js
+++ b/ui/tests/unit/utils/openapi-helpers-test.js
@@ -1,14 +1,24 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import { module, test } from 'qunit';
-import { _getPathParam, pathToHelpUrlSegment } from 'vault/utils/openapi-helpers';
+import {
+  _getPathParam,
+  combineOpenApiAttrs,
+  expandOpenApiProps,
+  getHelpUrlForModel,
+  pathToHelpUrlSegment,
+} from 'vault/utils/openapi-helpers';
+import Model, { attr } from '@ember-data/model';
+import { setupTest } from 'ember-qunit';
+import { camelize } from '@ember/string';
+
+module('Unit | Utility | OpenAPI helper utils', function (hooks) {
+  setupTest(hooks);
 
-module('Unit | Utility | OpenAPI helper utils', function () {
   test(`pathToHelpUrlSegment`, function (assert) {
-    assert.expect(5);
     [
       { path: '/auth/{username}', result: '/auth/example' },
       { path: '{username}/foo', result: 'example/foo' },
@@ -21,7 +31,6 @@ module('Unit | Utility | OpenAPI helper utils', function () {
   });
 
   test(`_getPathParam`, function (assert) {
-    assert.expect(7);
     [
       { path: '/auth/{username}', result: 'username' },
       { path: '{unicorn}/foo', result: 'unicorn' },
@@ -34,4 +43,252 @@ module('Unit | Utility | OpenAPI helper utils', function () {
       assert.strictEqual(_getPathParam(test.path), test.result, `returns first param for ${test.path}`);
     });
   });
+
+  test(`getHelpUrlForModel`, function (assert) {
+    [
+      { modelType: 'kmip/config', result: '/v1/foobar/config?help=1' },
+      { modelType: 'does-not-exist', result: null },
+      { modelType: 4, result: null },
+      { modelType: '', result: null },
+      { modelType: undefined, result: null },
+    ].forEach((test) => {
+      assert.strictEqual(
+        getHelpUrlForModel(test.modelType, 'foobar'),
+        test.result,
+        `returns first param for ${test.path}`
+      );
+    });
+  });
+
+  test('combineOpenApiAttrs should combine attributes correctly', async function (assert) {
+    class FooModel extends Model {
+      @attr('string', {
+        label: 'Foo',
+        subText: 'A form field',
+      })
+      foo;
+      @attr('boolean', {
+        label: 'Bar',
+        subText: 'Maybe a checkbox',
+      })
+      bar;
+      @attr('number', {
+        label: 'Baz',
+        subText: 'A number field',
+      })
+      baz;
+    }
+    this.owner.register('model:foo', FooModel);
+    const myModel = this.owner.lookup('service:store').modelFor('foo');
+    const newProps = {
+      foo: {
+        editType: 'ttl',
+      },
+      baz: {
+        type: 'number',
+        editType: 'slider',
+        label: 'Old label',
+      },
+      foobar: {
+        type: 'string',
+        label: 'Foo-bar',
+      },
+    };
+    const expected = [
+      {
+        name: 'foo',
+        type: 'string',
+        options: {
+          label: 'Foo',
+          subText: 'A form field',
+          editType: 'ttl',
+        },
+      },
+      {
+        name: 'bar',
+        type: 'boolean',
+        options: {
+          label: 'Bar',
+          subText: 'Maybe a checkbox',
+        },
+      },
+      {
+        name: 'baz',
+        type: 'number',
+        options: {
+          label: 'Baz', // uses the value we set on the model
+          editType: 'slider',
+          subText: 'A number field',
+        },
+      },
+      {
+        name: 'foobar',
+        type: 'string',
+        options: {
+          label: 'Foo-bar',
+        },
+      },
+    ];
+    const { attrs, newFields } = combineOpenApiAttrs(myModel.attributes, newProps);
+    assert.deepEqual(newFields, ['foobar'], 'correct newFields added');
+
+    // When combineOpenApiAttrs
+    assert.strictEqual(attrs.length, 4, 'correct number of attributes returned');
+    expected.forEach((exp) => {
+      const name = exp.name;
+      const attr = attrs.find((a) => a.name === name);
+      assert.deepEqual(attr, exp, `${name} combined properly`);
+    });
+  });
+
+  module('expandopenApiProps', function () {
+    const OPENAPI_RESPONSE_PROPS = {
+      ttl: {
+        type: 'string',
+        format: 'seconds',
+        description: 'this is a TTL!',
+        'x-vault-displayAttrs': {
+          name: 'TTL',
+        },
+      },
+      'awesome-people': {
+        type: 'array',
+        items: {
+          type: 'string',
+        },
+        'x-vault-displayAttrs': {
+          value: 'Grace Hopper,Lady Ada',
+        },
+      },
+      'favorite-ice-cream': {
+        type: 'string',
+        enum: ['vanilla', 'chocolate', 'strawberry'],
+      },
+      'default-value': {
+        default: 30,
+        'x-vault-displayAttrs': {
+          value: 300,
+        },
+        type: 'integer',
+      },
+      default: {
+        'x-vault-displayAttrs': {
+          value: 30,
+        },
+        type: 'integer',
+      },
+      'super-secret': {
+        type: 'string',
+        'x-vault-displayAttrs': {
+          sensitive: true,
+        },
+        description: 'A really secret thing',
+      },
+    };
+    const EXPANDED_PROPS = {
+      ttl: {
+        helpText: 'this is a TTL!',
+        editType: 'ttl',
+        label: 'TTL',
+        fieldGroup: 'default',
+      },
+      awesomePeople: {
+        editType: 'stringArray',
+        defaultValue: 'Grace Hopper,Lady Ada',
+        fieldGroup: 'default',
+      },
+      favoriteIceCream: {
+        editType: 'string',
+        type: 'string',
+        possibleValues: ['vanilla', 'chocolate', 'strawberry'],
+        fieldGroup: 'default',
+      },
+      defaultValue: {
+        editType: 'number',
+        type: 'number',
+        defaultValue: 300,
+        fieldGroup: 'default',
+      },
+      default: {
+        editType: 'number',
+        type: 'number',
+        defaultValue: 30,
+        fieldGroup: 'default',
+      },
+      superSecret: {
+        type: 'string',
+        editType: 'string',
+        sensitive: true,
+        helpText: 'A really secret thing',
+        fieldGroup: 'default',
+      },
+    };
+    const OPENAPI_DESCRIPTIONS = {
+      token_bound_cidrs: {
+        type: 'array',
+        description:
+          'Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
+        items: {
+          type: 'string',
+        },
+        'x-vault-displayAttrs': {
+          description:
+            'List of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
+          name: "Generated Token's Bound CIDRs",
+          group: 'Tokens',
+        },
+      },
+      blah_blah: {
+        type: 'array',
+        description: 'Comma-separated list of policies',
+        items: {
+          type: 'string',
+        },
+        'x-vault-displayAttrs': {
+          name: "Generated Token's Policies",
+          group: 'Tokens',
+        },
+      },
+      only_display_description: {
+        type: 'array',
+        items: {
+          type: 'string',
+        },
+        'x-vault-displayAttrs': {
+          description: 'Hello there, you look nice today',
+        },
+      },
+    };
+
+    const STRING_ARRAY_DESCRIPTIONS = {
+      token_bound_cidrs: {
+        helpText:
+          'List of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
+      },
+      blah_blah: {
+        helpText: 'Comma-separated list of policies',
+      },
+      only_display_description: {
+        helpText: 'Hello there, you look nice today',
+      },
+    };
+    test('it creates objects from OpenAPI schema props', function (assert) {
+      assert.expect(6);
+      const generatedProps = expandOpenApiProps(OPENAPI_RESPONSE_PROPS);
+      for (const propName in EXPANDED_PROPS) {
+        assert.deepEqual(EXPANDED_PROPS[propName], generatedProps[propName], `correctly expands ${propName}`);
+      }
+    });
+    test('it uses the description from the display attrs block if it exists', async function (assert) {
+      assert.expect(3);
+      const generatedProps = expandOpenApiProps(OPENAPI_DESCRIPTIONS);
+      for (const propName in STRING_ARRAY_DESCRIPTIONS) {
+        assert.strictEqual(
+          generatedProps[camelize(propName)].helpText,
+          STRING_ARRAY_DESCRIPTIONS[propName].helpText,
+          `correctly updates helpText for ${propName}`
+        );
+      }
+    });
+  });
 });
diff --git a/ui/tests/unit/utils/openapi-to-attrs-test.js b/ui/tests/unit/utils/openapi-to-attrs-test.js
index 3d4cd57081e..c92834d0232 100644
--- a/ui/tests/unit/utils/openapi-to-attrs-test.js
+++ b/ui/tests/unit/utils/openapi-to-attrs-test.js
@@ -1,217 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { attr } from '@ember-data/model';
-import { expandOpenApiProps, combineAttributes, combineFieldGroups } from 'vault/utils/openapi-to-attrs';
+import { combineFieldGroups } from 'vault/utils/openapi-to-attrs';
 import { module, test } from 'qunit';
-import { camelize } from '@ember/string';
-
-module('Unit | Util | OpenAPI Data Utilities', function () {
-  const OPENAPI_RESPONSE_PROPS = {
-    ttl: {
-      type: 'string',
-      format: 'seconds',
-      description: 'this is a TTL!',
-      'x-vault-displayAttrs': {
-        name: 'TTL',
-      },
-    },
-    'awesome-people': {
-      type: 'array',
-      items: {
-        type: 'string',
-      },
-      'x-vault-displayAttrs': {
-        value: 'Grace Hopper,Lady Ada',
-      },
-    },
-    'favorite-ice-cream': {
-      type: 'string',
-      enum: ['vanilla', 'chocolate', 'strawberry'],
-    },
-    'default-value': {
-      default: 30,
-      'x-vault-displayAttrs': {
-        value: 300,
-      },
-      type: 'integer',
-    },
-    default: {
-      'x-vault-displayAttrs': {
-        value: 30,
-      },
-      type: 'integer',
-    },
-    'super-secret': {
-      type: 'string',
-      'x-vault-displayAttrs': {
-        sensitive: true,
-      },
-      description: 'A really secret thing',
-    },
-  };
-  const EXPANDED_PROPS = {
-    ttl: {
-      helpText: 'this is a TTL!',
-      editType: 'ttl',
-      label: 'TTL',
-      fieldGroup: 'default',
-    },
-    awesomePeople: {
-      editType: 'stringArray',
-      defaultValue: 'Grace Hopper,Lady Ada',
-      fieldGroup: 'default',
-    },
-    favoriteIceCream: {
-      editType: 'string',
-      type: 'string',
-      possibleValues: ['vanilla', 'chocolate', 'strawberry'],
-      fieldGroup: 'default',
-    },
-    defaultValue: {
-      editType: 'number',
-      type: 'number',
-      defaultValue: 300,
-      fieldGroup: 'default',
-    },
-    default: {
-      editType: 'number',
-      type: 'number',
-      defaultValue: 30,
-      fieldGroup: 'default',
-    },
-    superSecret: {
-      type: 'string',
-      editType: 'string',
-      sensitive: true,
-      helpText: 'A really secret thing',
-      fieldGroup: 'default',
-    },
-  };
-
-  const EXISTING_MODEL_ATTRS = [
-    {
-      key: 'name',
-      value: {
-        isAttribute: true,
-        name: 'name',
-        options: {
-          editType: 'string',
-          label: 'Role name',
-        },
-      },
-    },
-    {
-      key: 'awesomePeople',
-      value: {
-        isAttribute: true,
-        name: 'awesomePeople',
-        options: {
-          label: 'People Who Are Awesome',
-        },
-      },
-    },
-  ];
-
-  const COMBINED_ATTRS = {
-    name: attr('string', {
-      editType: 'string',
-      type: 'string',
-      label: 'Role name',
-    }),
-    ttl: attr('string', {
-      editType: 'ttl',
-      label: 'TTL',
-      helpText: 'this is a TTL!',
-    }),
-    awesomePeople: attr({
-      label: 'People Who Are Awesome',
-      editType: 'stringArray',
-      defaultValue: 'Grace Hopper,Lady Ada',
-    }),
-    favoriteIceCream: attr('string', {
-      type: 'string',
-      editType: 'string',
-      possibleValues: ['vanilla', 'chocolate', 'strawberry'],
-    }),
-    superSecret: attr('string', {
-      type: 'string',
-      editType: 'string',
-      sensitive: true,
-      description: 'A really secret thing',
-    }),
-  };
 
+module('Unit | Util | combineFieldGroups', function () {
   const NEW_FIELDS = ['one', 'two', 'three'];
 
-  const OPENAPI_DESCRIPTIONS = {
-    token_bound_cidrs: {
-      type: 'array',
-      description:
-        'Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
-      items: {
-        type: 'string',
-      },
-      'x-vault-displayAttrs': {
-        description:
-          'List of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
-        name: "Generated Token's Bound CIDRs",
-        group: 'Tokens',
-      },
-    },
-    blah_blah: {
-      type: 'array',
-      description: 'Comma-separated list of policies',
-      items: {
-        type: 'string',
-      },
-      'x-vault-displayAttrs': {
-        name: "Generated Token's Policies",
-        group: 'Tokens',
-      },
-    },
-    only_display_description: {
-      type: 'array',
-      items: {
-        type: 'string',
-      },
-      'x-vault-displayAttrs': {
-        description: 'Hello there, you look nice today',
-      },
-    },
-  };
-
-  const STRING_ARRAY_DESCRIPTIONS = {
-    token_bound_cidrs: {
-      helpText:
-        'List of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token.',
-    },
-    blah_blah: {
-      helpText: 'Comma-separated list of policies',
-    },
-    only_display_description: {
-      helpText: 'Hello there, you look nice today',
-    },
-  };
-
-  test('it creates objects from OpenAPI schema props', function (assert) {
-    assert.expect(6);
-    const generatedProps = expandOpenApiProps(OPENAPI_RESPONSE_PROPS);
-    for (const propName in EXPANDED_PROPS) {
-      assert.deepEqual(EXPANDED_PROPS[propName], generatedProps[propName], `correctly expands ${propName}`);
-    }
-  });
-
-  test('it combines OpenAPI props with existing model attrs', function (assert) {
-    assert.expect(3);
-    const combined = combineAttributes(EXISTING_MODEL_ATTRS, EXPANDED_PROPS);
-    for (const propName in EXISTING_MODEL_ATTRS) {
-      assert.deepEqual(COMBINED_ATTRS[propName], combined[propName]);
-    }
-  });
-
   test('it adds new fields from OpenAPI to fieldGroups except for exclusions', function (assert) {
     assert.expect(3);
     const modelFieldGroups = [
@@ -280,16 +77,4 @@ module('Unit | Util | OpenAPI Data Utilities', function () {
       assert.deepEqual(fieldGroups[groupName], expectedGroups[groupName], 'it incorporates all new fields');
     }
   });
-
-  test('it uses the description from the display attrs block if it exists', async function (assert) {
-    assert.expect(3);
-    const generatedProps = expandOpenApiProps(OPENAPI_DESCRIPTIONS);
-    for (const propName in STRING_ARRAY_DESCRIPTIONS) {
-      assert.strictEqual(
-        generatedProps[camelize(propName)].helpText,
-        STRING_ARRAY_DESCRIPTIONS[propName].helpText,
-        `correctly updates helpText for ${propName}`
-      );
-    }
-  });
 });
diff --git a/ui/tests/unit/utils/paginate-list-test.js b/ui/tests/unit/utils/paginate-list-test.js
new file mode 100644
index 00000000000..616a5749708
--- /dev/null
+++ b/ui/tests/unit/utils/paginate-list-test.js
@@ -0,0 +1,73 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { paginate } from 'core/utils/paginate-list';
+import { module, test } from 'qunit';
+
+module('Unit | Utility | paginate-list', function (hooks) {
+  hooks.beforeEach(function () {
+    this.items = Array.from({ length: 20 }, (val, i) => i);
+  });
+
+  test('it should return data for non or empty arrays', function (assert) {
+    let items = 'not an array';
+    assert.strictEqual(paginate(items), items, 'returns the same data when input is not an array');
+
+    items = [];
+    assert.deepEqual(paginate(items), items, 'returns the same data when input is an empty array');
+  });
+
+  test('it should use default page and size', function (assert) {
+    const paginatedData = paginate(this.items, { page: 1 });
+    assert.strictEqual(paginatedData.length, 15, 'returns 15 items as default when no page size is set');
+    assert.deepEqual(this.items.slice(0, 15), paginatedData, 'returns first page of items by default');
+  });
+
+  test('it should return items for given page and size', function (assert) {
+    const paginatedData = paginate(this.items, { page: 3, pageSize: 5 });
+    assert.strictEqual(paginatedData.length, 5, 'returns correct number of items based on size');
+    assert.deepEqual(this.items.slice(10, 15), paginatedData, 'returns correct items for given page');
+  });
+
+  test('it should return remaining items on last page', function (assert) {
+    const paginatedData = paginate(this.items, { page: 3, pageSize: 8 });
+    assert.strictEqual(paginatedData.length, 4, 'returns correct number of items on last page');
+    assert.deepEqual(this.items.slice(16), paginatedData, 'returns correct items for last page');
+  });
+
+  test('it should filter items and then paginate', function (assert) {
+    let data = ['Test', 'foo', 'test', 'bar', 'test'];
+    let expected = ['Test', 'test'];
+    const options = { page: 1, pageSize: 2, filter: 'test' };
+
+    let paginatedData = paginate(data, options);
+    assert.deepEqual(paginatedData, expected, 'returns correct number of filtered items');
+
+    data = data.map((id) => ({ id }));
+    expected = [{ id: 'Test' }, { id: 'test' }];
+    paginatedData = paginate(data, { ...options, filterKey: 'id' });
+    assert.deepEqual(paginatedData, expected, 'returns correct number of filtered objects');
+  });
+
+  test('it should add meta data to returned object', function (assert) {
+    const { meta } = paginate(this.items, { page: 2, pageSize: 3 });
+    const expectedMeta = {
+      currentPage: 2,
+      lastPage: 7,
+      nextPage: 3,
+      prevPage: 1,
+      total: 20,
+      filteredTotal: 3,
+      pageSize: 3,
+    };
+    assert.deepEqual(meta, expectedMeta, 'returns correct meta data');
+  });
+
+  test('it should return remaining results on last page', async function (assert) {
+    const paginatedData = paginate(this.items, { page: 7, pageSize: 3 });
+    const expected = [18, 19];
+    assert.deepEqual(paginatedData, expected, 'returns correct items for last page');
+  });
+});
diff --git a/ui/tests/unit/utils/plugin-catalog-helpers-test.js b/ui/tests/unit/utils/plugin-catalog-helpers-test.js
new file mode 100644
index 00000000000..4536b2f95d0
--- /dev/null
+++ b/ui/tests/unit/utils/plugin-catalog-helpers-test.js
@@ -0,0 +1,285 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { module, test } from 'qunit';
+import {
+  enhanceEnginesWithCatalogData,
+  categorizeEnginesByStatus,
+  MOUNT_CATEGORIES,
+  PLUGIN_TYPES,
+  PLUGIN_CATEGORIES,
+} from 'vault/utils/plugin-catalog-helpers';
+
+module('Unit | Utility | plugin-catalog-helpers', function () {
+  module('enhanceEnginesWithCatalogData', function () {
+    test('it returns original engines when no catalog data provided', function (assert) {
+      const staticEngines = [
+        {
+          type: 'kv',
+          displayName: 'KV',
+          pluginCategory: PLUGIN_CATEGORIES.GENERIC,
+          mountCategory: [MOUNT_CATEGORIES.SECRET],
+        },
+      ];
+
+      const result = enhanceEnginesWithCatalogData(staticEngines, []);
+      assert.deepEqual(result, staticEngines, 'returns original engines when no catalog data');
+    });
+
+    test('it returns original engines when catalog data is null', function (assert) {
+      const staticEngines = [
+        {
+          type: 'kv',
+          displayName: 'KV',
+          pluginCategory: PLUGIN_CATEGORIES.GENERIC,
+          mountCategory: [MOUNT_CATEGORIES.SECRET],
+        },
+      ];
+
+      const result = enhanceEnginesWithCatalogData(staticEngines, null);
+      assert.deepEqual(result, staticEngines, 'handles null catalog data gracefully');
+    });
+
+    test('it enhances existing engines with catalog data', function (assert) {
+      const staticEngines = [
+        {
+          type: 'kv',
+          displayName: 'KV',
+          pluginCategory: PLUGIN_CATEGORIES.GENERIC,
+          mountCategory: [MOUNT_CATEGORIES.SECRET],
+        },
+        {
+          type: 'pki',
+          displayName: 'PKI',
+          pluginCategory: PLUGIN_CATEGORIES.GENERIC,
+          mountCategory: [MOUNT_CATEGORIES.SECRET],
+        },
+      ];
+
+      const catalogData = [
+        {
+          name: 'kv',
+          type: PLUGIN_TYPES.SECRET,
+          builtin: true,
+          version: '1.0.0',
+          deprecation_status: 'supported',
+        },
+      ];
+
+      const result = enhanceEnginesWithCatalogData(staticEngines, catalogData);
+
+      assert.strictEqual(result.length, 2, 'maintains original engine count');
+      assert.strictEqual(result[0].type, 'kv', 'preserves engine type');
+      assert.true(result[0].builtin, 'adds builtin flag from catalog');
+      assert.strictEqual(result[0].version, '1.0.0', 'adds version from catalog');
+      assert.strictEqual(result[0].deprecationStatus, 'supported', 'adds deprecation status');
+      assert.true(result[0].isAvailable, 'marks as available when in catalog');
+      assert.ok(result[0].pluginData, 'includes plugin data');
+
+      assert.false(result[1].isAvailable, 'marks as unavailable when not in catalog');
+      assert.notOk(result[1].builtin, 'no builtin flag when not in catalog');
+    });
+
+    test('it handles database engine specially', function (assert) {
+      const staticEngines = [
+        {
+          type: MOUNT_CATEGORIES.DATABASE,
+          displayName: 'Database',
+          pluginCategory: PLUGIN_CATEGORIES.GENERIC,
+          mountCategory: [MOUNT_CATEGORIES.SECRET],
+        },
+      ];
+
+      const databasePlugins = [
+        {
+          name: 'mysql-database-plugin',
+          type: PLUGIN_TYPES.DATABASE,
+          builtin: true,
+          version: '1.0.0',
+        },
+      ];
+
+      const result = enhanceEnginesWithCatalogData(staticEngines, [], databasePlugins);
+
+      assert.true(result[0].isAvailable, 'database engine is available when database plugins exist');
+      assert.true(result[0].builtin, 'uses representative database plugin data');
+      assert.strictEqual(result[0].version, '1.0.0', 'uses representative plugin version');
+    });
+
+    test('it discovers external plugins not in static metadata', function (assert) {
+      const staticEngines = [
+        {
+          type: 'kv',
+          displayName: 'KV',
+          pluginCategory: PLUGIN_CATEGORIES.GENERIC,
+          mountCategory: [MOUNT_CATEGORIES.SECRET],
+        },
+      ];
+
+      const catalogData = [
+        {
+          name: 'kv',
+          type: PLUGIN_TYPES.SECRET,
+          builtin: true,
+        },
+        {
+          name: 'my-custom-plugin',
+          type: PLUGIN_TYPES.SECRET,
+          builtin: false,
+          version: '2.1.0',
+        },
+      ];
+
+      const result = enhanceEnginesWithCatalogData(staticEngines, catalogData);
+
+      assert.strictEqual(result.length, 2, 'adds external plugin');
+      const externalPlugin = result.find((engine) => engine.type === 'my-custom-plugin');
+      assert.ok(externalPlugin, 'external plugin is present');
+      assert.strictEqual(externalPlugin.displayName, 'My Custom Plugin', 'converts name to Title Case');
+      assert.strictEqual(
+        externalPlugin.pluginCategory,
+        PLUGIN_CATEGORIES.EXTERNAL,
+        'marks as external category'
+      );
+      assert.true(externalPlugin.isAvailable, 'external plugin is available');
+      assert.false(externalPlugin.builtin, 'external plugin is not builtin');
+    });
+
+    test('it matches external plugins with existing static engine glyphs', function (assert) {
+      const staticEngines = [
+        {
+          type: 'aws',
+          displayName: 'AWS',
+          glyph: 'aws-color',
+          pluginCategory: PLUGIN_CATEGORIES.CLOUD,
+          mountCategory: [MOUNT_CATEGORIES.SECRET],
+        },
+      ];
+
+      const catalogData = [
+        {
+          name: 'my-custom-aws-plugin',
+          type: PLUGIN_TYPES.SECRET,
+          builtin: false,
+        },
+      ];
+
+      const result = enhanceEnginesWithCatalogData(staticEngines, catalogData);
+
+      const externalPlugin = result.find((engine) => engine.type === 'my-custom-aws-plugin');
+      assert.strictEqual(externalPlugin.glyph, 'aws-color', 'uses matching static engine glyph');
+    });
+
+    test('it handles deprecation status correctly', function (assert) {
+      const staticEngines = [
+        {
+          type: 'legacy-plugin',
+          displayName: 'Legacy Plugin',
+          pluginCategory: PLUGIN_CATEGORIES.GENERIC,
+          mountCategory: [MOUNT_CATEGORIES.SECRET],
+        },
+      ];
+
+      const catalogData = [
+        {
+          name: 'legacy-plugin',
+          type: PLUGIN_TYPES.SECRET,
+          builtin: true,
+          deprecation_status: 'deprecated',
+        },
+      ];
+
+      const result = enhanceEnginesWithCatalogData(staticEngines, catalogData);
+
+      assert.strictEqual(
+        result[0].deprecationStatus,
+        'deprecated',
+        'preserves deprecation status from catalog'
+      );
+    });
+  });
+
+  module('categorizeEnginesByStatus', function () {
+    test('it separates enabled and disabled engines', function (assert) {
+      const engines = [
+        {
+          type: 'kv',
+          displayName: 'KV',
+          isAvailable: true,
+        },
+        {
+          type: 'pki',
+          displayName: 'PKI',
+          isAvailable: false,
+        },
+        {
+          type: 'aws',
+          displayName: 'AWS',
+          // isAvailable not set (undefined)
+        },
+      ];
+
+      const result = categorizeEnginesByStatus(engines);
+
+      assert.strictEqual(result.enabled.length, 2, 'enabled includes available and undefined');
+      assert.strictEqual(result.disabled.length, 1, 'disabled includes only false');
+      assert.strictEqual(result.enabled[0].type, 'kv', 'includes available engine in enabled');
+      assert.strictEqual(result.enabled[1].type, 'aws', 'includes undefined availability as enabled');
+      assert.strictEqual(result.disabled[0].type, 'pki', 'includes unavailable engine in disabled');
+    });
+
+    test('it handles empty input', function (assert) {
+      const result = categorizeEnginesByStatus([]);
+
+      assert.strictEqual(result.enabled.length, 0, 'enabled is empty');
+      assert.strictEqual(result.disabled.length, 0, 'disabled is empty');
+    });
+
+    test('it handles all enabled engines', function (assert) {
+      const engines = [
+        { type: 'kv', isAvailable: true },
+        { type: 'pki' }, // undefined isAvailable
+      ];
+
+      const result = categorizeEnginesByStatus(engines);
+
+      assert.strictEqual(result.enabled.length, 2, 'all engines are enabled');
+      assert.strictEqual(result.disabled.length, 0, 'no engines are disabled');
+    });
+
+    test('it handles all disabled engines', function (assert) {
+      const engines = [
+        { type: 'kv', isAvailable: false },
+        { type: 'pki', isAvailable: false },
+      ];
+
+      const result = categorizeEnginesByStatus(engines);
+
+      assert.strictEqual(result.enabled.length, 0, 'no engines are enabled');
+      assert.strictEqual(result.disabled.length, 2, 'all engines are disabled');
+    });
+  });
+
+  module('constants', function () {
+    test('MOUNT_CATEGORIES contains expected values', function (assert) {
+      assert.strictEqual(MOUNT_CATEGORIES.SECRET, 'secret', 'SECRET category is correct');
+      assert.strictEqual(MOUNT_CATEGORIES.AUTH, 'auth', 'AUTH category is correct');
+      assert.strictEqual(MOUNT_CATEGORIES.DATABASE, 'database', 'DATABASE category is correct');
+    });
+
+    test('PLUGIN_TYPES contains expected values', function (assert) {
+      assert.strictEqual(PLUGIN_TYPES.SECRET, 'secret', 'SECRET type is correct');
+      assert.strictEqual(PLUGIN_TYPES.AUTH, 'auth', 'AUTH type is correct');
+      assert.strictEqual(PLUGIN_TYPES.DATABASE, 'database', 'DATABASE type is correct');
+    });
+
+    test('PLUGIN_CATEGORIES contains expected values', function (assert) {
+      assert.strictEqual(PLUGIN_CATEGORIES.GENERIC, 'generic', 'GENERIC category is correct');
+      assert.strictEqual(PLUGIN_CATEGORIES.CLOUD, 'cloud', 'CLOUD category is correct');
+      assert.strictEqual(PLUGIN_CATEGORIES.INFRA, 'infra', 'INFRA category is correct');
+      assert.strictEqual(PLUGIN_CATEGORIES.EXTERNAL, 'external', 'EXTERNAL category is correct');
+    });
+  });
+});
diff --git a/ui/tests/unit/utils/query-param-string-test.js b/ui/tests/unit/utils/query-param-string-test.js
new file mode 100644
index 00000000000..7ec72f3e934
--- /dev/null
+++ b/ui/tests/unit/utils/query-param-string-test.js
@@ -0,0 +1,47 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import queryParamString from 'vault/utils/query-param-string';
+import { module, test } from 'qunit';
+
+module('Unit | Utility | query-param-string', function () {
+  [
+    {
+      scenario: 'object with nonencoded keys and values',
+      obj: { redirect: 'https://hashicorp.com', some$key: 'normal-value', number: 7 },
+      expected: '?redirect=https%3A%2F%2Fhashicorp.com&some%24key=normal-value&number=7',
+    },
+    {
+      scenario: 'object with invalid values',
+      obj: { redirect: '', null: null, foo: 'bar', number: 0, undefined: undefined, false: false },
+      expected: '?foo=bar&number=0&false=false',
+    },
+    {
+      scenario: 'object where every value is invalid',
+      obj: { redirect: '', null: null, undefined: undefined },
+      expected: '',
+    },
+    {
+      scenario: 'empty object',
+      obj: {},
+      expected: '',
+    },
+    {
+      scenario: 'array',
+      obj: ['some', 'array'],
+      expected: '',
+    },
+    {
+      scenario: 'string',
+      obj: 'foobar',
+      expected: '',
+    },
+  ].forEach((testCase) => {
+    test(`it works when ${testCase.scenario}`, function (assert) {
+      const result = queryParamString(testCase.obj);
+      assert.strictEqual(result, testCase.expected);
+    });
+  });
+});
diff --git a/ui/tests/unit/utils/sanitize-path-test.js b/ui/tests/unit/utils/sanitize-path-test.js
index fe4fa998403..ff9be638504 100644
--- a/ui/tests/unit/utils/sanitize-path-test.js
+++ b/ui/tests/unit/utils/sanitize-path-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/utils/sort-objects-test.js b/ui/tests/unit/utils/sort-objects-test.js
index 40ccfb8f106..f0678b624e9 100644
--- a/ui/tests/unit/utils/sort-objects-test.js
+++ b/ui/tests/unit/utils/sort-objects-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/utils/timestamp-test.js b/ui/tests/unit/utils/timestamp-test.js
index 89196fbca41..57eb460632b 100644
--- a/ui/tests/unit/utils/timestamp-test.js
+++ b/ui/tests/unit/utils/timestamp-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -12,10 +12,8 @@ import { module, test } from 'qunit';
 */
 module('Unit | Utility | timestamp', function () {
   test('it can be overridden', function (assert) {
-    const stub = sinon.stub(timestamp, 'now').callsFake(() => new Date('2030-03-03T03:30:03'));
+    sinon.replace(timestamp, 'now', sinon.fake.returns(new Date('2030-03-03T03:30:03')));
     const result = timestamp.now();
     assert.strictEqual(result.toISOString(), new Date('2030-03-03T03:30:03').toISOString());
-    // Always make sure to restore the stub
-    stub.restore(); // timestamp.now.restore(); also works
   });
 });
diff --git a/ui/tests/unit/utils/trim-right-test.js b/ui/tests/unit/utils/trim-right-test.js
index 7615964663a..8eecc99bae3 100644
--- a/ui/tests/unit/utils/trim-right-test.js
+++ b/ui/tests/unit/utils/trim-right-test.js
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/tests/unit/utils/validators-test.js b/ui/tests/unit/utils/validators-test.js
deleted file mode 100644
index f8d292447ee..00000000000
--- a/ui/tests/unit/utils/validators-test.js
+++ /dev/null
@@ -1,108 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import { module, test } from 'qunit';
-import { setupTest } from 'ember-qunit';
-import validators from 'vault/utils/validators';
-
-module('Unit | Util | validators', function (hooks) {
-  setupTest(hooks);
-
-  test('it should validate presence', function (assert) {
-    let isValid;
-    const check = (value) => (isValid = validators.presence(value));
-    check(null);
-    assert.false(isValid, 'Invalid when value is null');
-    check('');
-    assert.false(isValid, 'Invalid when value is empty string');
-    check(true);
-    assert.true(isValid, 'Valid when value is true');
-    check(0);
-    assert.true(isValid, 'Valid when value is 0 as integer');
-    check('0');
-    assert.true(isValid, 'Valid when value is 0 as string');
-  });
-
-  test('it should validate length', function (assert) {
-    let isValid;
-    const options = { nullable: true, min: 3, max: 5 };
-    const check = (prop) => (isValid = validators.length(prop, options));
-    check(null);
-    assert.true(isValid, 'Valid when nullable is true');
-    options.nullable = false;
-    check(null);
-    assert.false(isValid, 'Invalid when nullable is false');
-    check('12');
-    assert.false(isValid, 'Invalid when string not min length');
-    check('123456');
-    assert.false(isValid, 'Invalid when string over max length');
-    check('1234');
-    assert.true(isValid, 'Valid when string between min and max length');
-    check(12);
-    assert.false(isValid, 'Invalid when integer not min length');
-    check(123456);
-    assert.false(isValid, 'Invalid when integer over max length');
-    check(1234);
-    assert.true(isValid, 'Valid when integer between min and max length');
-    options.min = 1;
-    check(0);
-    assert.true(isValid, 'Valid when integer is 0 and min is 1');
-    check('0');
-    assert.true(isValid, 'Valid when string is 0 and min is 1');
-  });
-
-  test('it should validate number', function (assert) {
-    let isValid;
-    const options = { nullable: true };
-    const check = (prop) => (isValid = validators.number(prop, options));
-    check(null);
-    assert.true(isValid, 'Valid when nullable is true');
-    options.nullable = false;
-    check(null);
-    assert.false(isValid, 'Invalid when nullable is false');
-    check(9);
-    assert.true(isValid, 'Valid for number');
-    check('9');
-    assert.true(isValid, 'Valid for number as string');
-    check('foo');
-    assert.false(isValid, 'Invalid for string that is not a number');
-    check('12foo');
-    assert.false(isValid, 'Invalid for string that contains a number');
-    check(0);
-    assert.true(isValid, 'Valid for 0 as an integer');
-    check('0');
-    assert.true(isValid, 'Valid for 0 as a string');
-  });
-
-  test('it should validate white space', function (assert) {
-    let isValid;
-    const check = (prop) => (isValid = validators.containsWhiteSpace(prop));
-    check('validText');
-    assert.true(isValid, 'Valid when text contains no spaces');
-    check('valid-text');
-    assert.true(isValid, 'Valid when text contains no spaces and hyphen');
-    check('some space');
-    assert.false(isValid, 'Invalid when text contains single space');
-    check('text with spaces');
-    assert.false(isValid, 'Invalid when text contains multiple spaces');
-    check(' leadingSpace');
-    assert.false(isValid, 'Invalid when text has leading whitespace');
-    check('trailingSpace ');
-    assert.false(isValid, 'Invalid when text has trailing whitespace');
-  });
-
-  test('it should validate value ends in a slash', function (assert) {
-    let isValid;
-    const check = (prop) => (isValid = validators.endsInSlash(prop));
-    check('validText');
-    assert.true(isValid, 'Valid when text does not end in slash');
-    check('valid/Text');
-    assert.true(isValid, 'Valid when text only contains slash');
-    check('invalid/');
-    assert.false(isValid, 'Invalid when text ends in slash');
-    check('also/invalid/');
-    assert.false(isValid, 'Invalid when text contains and ends in slash');
-  });
-});
diff --git a/ui/types/@ember-data/adapter/error.d.ts b/ui/types/@ember-data/adapter/error.d.ts
new file mode 100644
index 00000000000..1f5f06030bf
--- /dev/null
+++ b/ui/types/@ember-data/adapter/error.d.ts
@@ -0,0 +1,19 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Error from 'ember-data/adapter/errors';
+
+export type ApiError = string | { [key: string]: unknown; title?: string; message?: string };
+
+export default class AdapterError extends Error {
+  httpStatus: number;
+  path: string;
+  message: string;
+  errors: ApiError[];
+  data?: {
+    [key: string]: unknown;
+    error?: string;
+  };
+}
diff --git a/ui/types/@ember-data/store.d.ts b/ui/types/@ember-data/store.d.ts
new file mode 100644
index 00000000000..74da08d9b96
--- /dev/null
+++ b/ui/types/@ember-data/store.d.ts
@@ -0,0 +1,8 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Store from 'ember-data/store';
+
+export default Store;
diff --git a/ui/types/ember-cli-flash/services/flash-messages.d.ts b/ui/types/ember-cli-flash/services/flash-messages.d.ts
index e515b6a7fc2..17dfc7f04c7 100644
--- a/ui/types/ember-cli-flash/services/flash-messages.d.ts
+++ b/ui/types/ember-cli-flash/services/flash-messages.d.ts
@@ -1,12 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 declare module 'ember-cli-flash/services/flash-messages' {
   import Service from '@ember/service';
   import FlashObject from 'ember-cli-flash/flash/object';
-  import { A } from '@ember/array';
 
   type Partial<T> = { [K in keyof T]?: T[K] };
 
@@ -31,7 +30,7 @@ declare module 'ember-cli-flash/services/flash-messages' {
   }
 
   class FlashMessageService extends Service {
-    queue: A<FlashObject>;
+    queue: FlashObject[];
     success: FlashFunction;
     warning: FlashFunction;
     info: FlashFunction;
diff --git a/ui/types/ember-data/types/registries/adapter.d.ts b/ui/types/ember-data/types/registries/adapter.d.ts
index 928285d3167..04737eb3c87 100644
--- a/ui/types/ember-data/types/registries/adapter.d.ts
+++ b/ui/types/ember-data/types/registries/adapter.d.ts
@@ -1,36 +1,31 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Application from 'vault/adapters/application';
 import Adapter from 'ember-data/adapter';
 import ModelRegistry from 'ember-data/types/registries/model';
+
+import ClientsActivityAdapter from 'vault/vault/adapters/clients/activity';
+import LdapLibraryAdapter from 'vault/adapters/ldap/library';
+import LdapRoleAdapter from 'vault/adapters/ldap/role';
 import PkiIssuerAdapter from 'vault/adapters/pki/issuer';
 import PkiTidyAdapter from 'vault/adapters/pki/tidy';
-import LdapRoleAdapter from 'vault/adapters/ldap/role';
-import LdapLibraryAdapter from 'vault/adapters/ldap/library';
-import KvDataAdapter from 'vault/adapters/kv/data';
-import KvMetadataAdapter from 'vault/adapters/kv/metadata';
-import SyncDestinationAdapter from 'vault/adapters/sync/destination';
 import SyncAssociationAdapter from 'vault/adapters/sync/association';
+import SyncDestinationAdapter from 'vault/adapters/sync/destination';
 
 /**
  * Catch-all for ember-data.
  */
 export default interface AdapterRegistry {
+  'clients/activity': ClientsActivityAdapter;
   'ldap/library': LdapLibraryAdapter;
   'ldap/role': LdapRoleAdapter;
   'pki/issuer': PkiIssuerAdapter;
   'pki/tidy': PkiTidyAdapter;
-  'kv/data': KvDataAdapterAdapter;
-  'kv/metadata': KvMetadataAdapter;
   'sync/destination': SyncDestinationAdapter;
   'sync/association': SyncAssociationAdapter;
   application: Application;
   [key: keyof ModelRegistry]: Adapter;
 }
-
-export default interface AdapterError extends Error {
-  httpStatus: number;
-}
diff --git a/ui/types/ember-data/types/registries/model.d.ts b/ui/types/ember-data/types/registries/model.d.ts
index eb5485c7573..e42a874901f 100644
--- a/ui/types/ember-data/types/registries/model.d.ts
+++ b/ui/types/ember-data/types/registries/model.d.ts
@@ -1,13 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Model from '@ember-data/model';
-import KvSecretDataModel from 'vault/models/kv/data';
-import KvSecretMetadataModel from 'vault/models/kv/metadata';
 import PkiActionModel from 'vault/models/pki/action';
 import PkiCertificateGenerateModel from 'vault/models/pki/certificate/generate';
+import PkiConfigAcmeModel from 'vault/models/pki/config/acme';
+import PkiConfigClusterModel from 'vault/models/pki/config/cluster';
+import PkiConfigCrlModel from 'vault/models/pki/config/crl';
+import PkiConfigUrlsModel from 'vault/models/pki/config/urls';
 import ClientsActivityModel from 'vault/models/clients/activity';
 import ClientsConfigModel from 'vault/models/clients/config';
 import ClientsVersionHistoryModel from 'vault/models/clients/version-history';
@@ -16,8 +18,10 @@ declare module 'ember-data/types/registries/model' {
   export default interface ModelRegistry {
     'pki/action': PkiActionModel;
     'pki/certificate/generate': PkiCertificateGenerateModel;
-    'kv/data': KvSecretDataModel;
-    'kv/metadata': KvSecretMetadataModel;
+    'pki/config/acme': PkiConfigAcmeModel;
+    'pki/config/cluster': PkiConfigClusterModel;
+    'pki/config/crl': PkiConfigCrlModel;
+    'pki/config/urls': PkiConfigUrlModel;
     'clients/activity': ClientsActivityModel;
     'clients/config': ClientsConfigModel;
     'clients/version-history': ClientsVersionHistoryModel;
diff --git a/ui/types/forms.ts b/ui/types/forms.ts
index ec44b2c88da..5307cc6751f 100644
--- a/ui/types/forms.ts
+++ b/ui/types/forms.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/global.d.ts b/ui/types/global.d.ts
index f2c2d261017..ee00d44d527 100644
--- a/ui/types/global.d.ts
+++ b/ui/types/global.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,3 +15,5 @@ declare module '@icholy/duration' {
   import Duration from '@icholy/duration';
   export default Duration;
 }
+
+declare module 'vault/tests/helpers/vault-keys';
diff --git a/ui/types/vault/adapters/clients/activity.d.ts b/ui/types/vault/adapters/clients/activity.d.ts
new file mode 100644
index 00000000000..533822639e4
--- /dev/null
+++ b/ui/types/vault/adapters/clients/activity.d.ts
@@ -0,0 +1,18 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Store from '@ember-data/store';
+import { AdapterRegistry } from 'ember-data/adapter';
+
+interface ExportDataQuery {
+  format?: string;
+  start_time?: string;
+  end_time?: string;
+  namespace?: string;
+}
+
+export default interface ActivityAdapter extends AdapterRegistry {
+  exportData(query?: ExportDataQuery): Promise<Blob>;
+}
diff --git a/ui/types/vault/adapters/ldap/library.d.ts b/ui/types/vault/adapters/ldap/library.d.ts
index 944d39ba71f..32db1b3192c 100644
--- a/ui/types/vault/adapters/ldap/library.d.ts
+++ b/ui/types/vault/adapters/ldap/library.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/adapters/ldap/role.d.ts b/ui/types/vault/adapters/ldap/role.d.ts
index 7161c2ef365..9b48e7abed8 100644
--- a/ui/types/vault/adapters/ldap/role.d.ts
+++ b/ui/types/vault/adapters/ldap/role.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/adapters/pki/issuer.d.ts b/ui/types/vault/adapters/pki/issuer.d.ts
index 52ba06c2e03..30b7025725a 100644
--- a/ui/types/vault/adapters/pki/issuer.d.ts
+++ b/ui/types/vault/adapters/pki/issuer.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/adapters/pki/role.d.ts b/ui/types/vault/adapters/pki/role.d.ts
index 5c1f4ef3941..3197d318edf 100644
--- a/ui/types/vault/adapters/pki/role.d.ts
+++ b/ui/types/vault/adapters/pki/role.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/adapters/pki/tidy.d.ts b/ui/types/vault/adapters/pki/tidy.d.ts
index 8a75e5c3b5d..89ed08f95b2 100644
--- a/ui/types/vault/adapters/pki/tidy.d.ts
+++ b/ui/types/vault/adapters/pki/tidy.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/adapters/sync/association.d.ts b/ui/types/vault/adapters/sync/association.d.ts
index 7fbb65e940c..30374a3f98a 100644
--- a/ui/types/vault/adapters/sync/association.d.ts
+++ b/ui/types/vault/adapters/sync/association.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/adapters/sync/destination.d.ts b/ui/types/vault/adapters/sync/destination.d.ts
index ab9942ef0c3..d3695ae314a 100644
--- a/ui/types/vault/adapters/sync/destination.d.ts
+++ b/ui/types/vault/adapters/sync/destination.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/analytics.ts b/ui/types/vault/analytics.ts
new file mode 100644
index 00000000000..3746986ecc0
--- /dev/null
+++ b/ui/types/vault/analytics.ts
@@ -0,0 +1,16 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export interface AnalyticsProvider {
+  name: string;
+  identify: (identifier: string, traits: Record<string, string>) => void;
+  start: (config: Record<string, string | boolean>) => void;
+  trackPageView: (routeName: string, metadata: Record<string, string>) => void;
+  trackEvent: (eventName: string, metadata: Record<string, string>) => void;
+}
+
+export interface AnalyticsConfig extends Record<string, string | boolean> {
+  enabled: boolean;
+}
diff --git a/ui/types/vault/api.d.ts b/ui/types/vault/api.d.ts
new file mode 100644
index 00000000000..5228e12251f
--- /dev/null
+++ b/ui/types/vault/api.d.ts
@@ -0,0 +1,59 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export interface WrapInfo {
+  accessor: string;
+  creation_path: string;
+  creation_time: string;
+  wrapped_accessor: string;
+  token: string;
+  ttl: number;
+}
+
+export interface ApiResponse {
+  data: Record<string, unknown> | null;
+  auth: Record<string, unknown> | null;
+  lease_duration: number;
+  lease_id: string;
+  mount_type: string;
+  renewable: boolean;
+  request_id: string;
+  warnings: Array<string> | null;
+  wrap_info: WrapInfo | null;
+}
+
+export type HeaderMap =
+  | {
+      namespace: string;
+    }
+  | {
+      token: string;
+    }
+  | {
+      wrap: string;
+    }
+  | {
+      recoverSnapshotId: string;
+    }
+  | {
+      recoverSourcePath: string;
+    };
+
+export type XVaultHeaders =
+  | {
+      'X-Vault-Namespace': string;
+    }
+  | {
+      'X-Vault-Token': string;
+    }
+  | {
+      'X-Vault-Wrap-TTL': string;
+    }
+  | {
+      'X-Vault-Snapshot-Id': string;
+    }
+  | {
+      'X-Vault-Recover-Source-Path': string;
+    };
diff --git a/ui/types/vault/app-types.ts b/ui/types/vault/app-types.ts
index b00f4f0ff07..27696f75dc1 100644
--- a/ui/types/vault/app-types.ts
+++ b/ui/types/vault/app-types.ts
@@ -1,8 +1,8 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
-import type EmberDataModel from '@ember-data/model';
+import type EmberDataModel from 'ember-data/model'; // eslint-disable-line ember/use-ember-data-rfc-395-imports
 import type Owner from '@ember/owner';
 
 // Type that comes back from expandAttributeMeta
@@ -26,43 +26,112 @@ export interface FormFieldGroupOptions {
   [key: string]: Array<string>;
 }
 
+export type Validator =
+  | 'presence'
+  | 'length'
+  | 'number'
+  | 'containsWhiteSpace'
+  | 'endsInSlash'
+  | 'hasWhitespace'
+  | 'isNonString';
+
+export type ValidatorOption =
+  | {
+      nullable?: boolean;
+    }
+  | {
+      nullable?: boolean;
+      min?: number;
+      max?: number;
+    };
+
+export type Validation =
+  | {
+      message: string | ((data: unknown) => string);
+      type: Validator;
+      options?: ValidatorOption;
+      level?: 'warn';
+      validator?: never;
+    }
+  | {
+      message: string | ((data: unknown) => string);
+      type?: never;
+      options?: ValidatorOption;
+      level?: 'warn';
+      validator(data: unknown, options?: unknown): boolean;
+    };
+export interface Validations {
+  [key: string]: Validation[];
+}
 export interface ValidationMap {
   [key: string]: {
     isValid: boolean;
     errors: Array<string>;
+    warnings: Array<string>;
   };
 }
 export interface ModelValidations {
   isValid: boolean;
-  state: {
-    [key: string]: {
-      isValid: boolean;
-      errors: Array<string>;
-    };
-  };
+  state: ValidationMap;
   invalidFormMessage: string;
 }
+// TODO: [Ember Data] - ModelValidations can be renamed to FormValidations and this can be removed
+export type FormValidations = ModelValidations;
 
-export interface Model extends Omit<EmberDataModel, 'isNew'> {
+export type Model = Omit<EmberDataModel, 'isNew'> & {
   // override isNew which is a computed prop and ts will complain since it sees it as a function
   isNew: boolean;
-}
+};
 
-export interface WithFormFieldsModel extends Model {
+export type WithFormFieldsModel = Model & {
   formFields: Array<FormField>;
   formFieldGroups: FormFieldGroups;
   allFields: Array<FormField>;
-}
+};
+
+export type WithValidationsModel = Model & {
+  validate(): ModelValidations;
+};
 
-export interface WithValidationsModel extends Model {
+export type WithFormFieldsAndValidationsModel = WithFormFieldsModel & {
   validate(): ModelValidations;
+};
+
+// capabilities
+export interface Capabilities {
+  canCreate: boolean;
+  canDelete: boolean;
+  canList: boolean;
+  canPatch: boolean;
+  canRead: boolean;
+  canSudo: boolean;
+  canUpdate: boolean;
 }
 
-export interface WithFormFieldsAndValidationsModel extends WithFormFieldsModel, WithValidationsModel {}
+export interface CapabilitiesMap {
+  [key: string]: Capabilities;
+}
+
+export type CapabilityTypes =
+  | 'root'
+  | 'sudo'
+  | 'deny'
+  | 'create'
+  | 'read'
+  | 'update'
+  | 'delete'
+  | 'list'
+  | 'patch';
+export interface CapabilitiesData {
+  [key: string]: CapabilityTypes[];
+}
 
 export interface Breadcrumb {
   label: string;
   route?: string;
+  icon?: string;
+  model?: string;
+  models?: string[];
   linkExternal?: boolean;
 }
 
@@ -73,12 +142,6 @@ export interface TtlEvent {
   goSafeTimeString: string;
 }
 
-export interface Breadcrumb {
-  label: string;
-  route?: string;
-  linkExternal?: boolean;
-}
-
 export interface EngineOwner extends Owner {
   mountPoint: string;
 }
diff --git a/ui/types/vault/auth/form.d.ts b/ui/types/vault/auth/form.d.ts
new file mode 100644
index 00000000000..b117cbf587c
--- /dev/null
+++ b/ui/types/vault/auth/form.d.ts
@@ -0,0 +1,51 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export interface UnauthMountsByType {
+  // key is the auth method type
+  // if the value is "null" there is no mount data for that type
+  [key: string]: AuthTabMountData[] | null;
+}
+
+interface AuthTabMountData {
+  path: string;
+  type: string;
+  description?: string;
+  config?: object | null;
+}
+
+export type LoginFields = Partial<Record<(typeof POSSIBLE_FIELDS)[number], string | undefined>> & {
+  path?: string | undefined;
+  namespace?: string | undefined;
+};
+
+export interface VisibleAuthMounts {
+  // key is auth mount path
+  [key: string]: {
+    description: string;
+    type: string;
+    options: null | {};
+  };
+}
+
+// Auth data returned from each method's login response is
+// normalized so each method's information maps to the same key names
+export interface NormalizedAuthData extends NormalizeAuthResponseKeys {
+  authMethodType: string;
+  entityId?: string;
+  expireTime?: string;
+  renewable: boolean;
+  policies: string[];
+  mfaRequirement?: MfaRequirementApiResponse | null;
+}
+
+// This info is not returned within a consistent key name so each auth method is responsible for
+// normalizing it
+export interface NormalizeAuthResponseKeys {
+  authMountPath: string; // manually added because not a part of the auth response
+  displayName?: string; // if not from the "display_name" key, then this may be set from either "meta" or "metadata"
+  token: string; // was "client_token" or "id" key for some methods
+  ttl: number; // was "lease_duration" key for some methods
+}
diff --git a/ui/types/vault/auth/methods.d.ts b/ui/types/vault/auth/methods.d.ts
new file mode 100644
index 00000000000..9ae31636920
--- /dev/null
+++ b/ui/types/vault/auth/methods.d.ts
@@ -0,0 +1,101 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type { ApiResponse, WrapInfo } from 'vault/auth/api';
+import type { POSSIBLE_FIELDS } from 'vault/utils/auth-form-helpers';
+import type { MfaRequirementApiResponse } from './mfa';
+import { AuthEnableMethodRequest } from '@hashicorp/vault-client-typescript';
+import { MountConfig } from 'vault/mount';
+
+// ApiResponse includes top-level fields like request_id, etc.
+// Some auth methods return login data under the "auth" key,
+// while token exchange flows return it under the "data" key.
+// The structure of the returned data varies slightly between these cases.
+interface SharedAuthResponseData {
+  accessor: string;
+  entity_id: string;
+  policies: string[];
+  renewable: boolean;
+}
+
+// AuthResponseAuthKey defines login data inside the "auth" key
+interface AuthResponseAuthKey extends SharedAuthResponseData {
+  client_token: string;
+  lease_duration: number;
+  metadata: Record<string, string>;
+  mfa_requirement: MfaRequirementApiResponse | null;
+  token_type: 'service' | 'batch';
+}
+
+// AuthResponseDataKey defines login data inside the "data" key
+interface AuthResponseDataKey extends SharedAuthResponseData {
+  display_name: string;
+  expire_time: string;
+  id: string; // this is the Vault issued token (the equivalent of the clientToken for responses with the "auth" key)
+  meta: Record<string, string> | null;
+  namespace_path?: string;
+  ttl: number;
+  type: 'service' | 'batch'; // token type
+}
+
+// METHOD SPECIFIC RESPONSES
+export interface GithubLoginApiResponse extends ApiResponse {
+  auth: AuthResponseAuthKey & {
+    metadata: { org: string; username: string };
+  };
+}
+
+export interface JwtOidcLoginApiResponse extends ApiResponse {
+  auth: AuthResponseAuthKey;
+}
+
+export interface OidcApiResponse extends ApiResponse {
+  auth: AuthResponseData['auth'] & {
+    client_token: string;
+  };
+}
+
+export interface JwtOidcAuthUrlResponse extends ApiResponse {
+  data: { auth_url: string };
+}
+
+export interface OktaVerifyApiResponse extends ApiResponse {
+  data: { correct_answer: number };
+}
+
+export interface SamlLoginApiResponse extends ApiResponse {
+  auth: AuthResponseAuthKey;
+}
+
+export interface SamlSsoServiceUrlApiResponse extends ApiResponse {
+  data: {
+    sso_service_url: string;
+    token_poll_id: string;
+  };
+}
+
+export interface TokenLoginApiResponse extends ApiResponse {
+  data: AuthResponseDataKey;
+}
+
+// auth types: ldap, okta, radius, userpass
+export interface UsernameLoginResponse extends ApiResponse {
+  auth: AuthResponseAuthKey & {
+    metadata: { username: string };
+  };
+}
+
+export type UserLockoutConfig = {
+  lockout_threshold?: string;
+  lockout_duration?: string;
+  lockout_counter_reset?: string;
+  lockout_disable?: boolean;
+};
+
+export type AuthMethodFormData = AuthEnableMethodRequest & {
+  path: string;
+  config: MountConfig;
+  user_lockout_config: UserLockoutConfig;
+};
diff --git a/ui/types/vault/auth/mfa.d.ts b/ui/types/vault/auth/mfa.d.ts
new file mode 100644
index 00000000000..6570ea3d094
--- /dev/null
+++ b/ui/types/vault/auth/mfa.d.ts
@@ -0,0 +1,54 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export interface MfaRequirementApiResponse {
+  mfa_request_id: string;
+  mfa_constraints: MfaConstraints;
+}
+interface MfaTotpSelfEnrollApiResponse {
+  data: SelfEnrollmentData;
+}
+
+interface SelfEnrollmentData {
+  barcode: string;
+  url: string;
+}
+
+interface MfaConstraint {
+  type: string;
+  id: string;
+  uses_passcode: boolean;
+}
+
+interface MfaConstraints {
+  [key: string]: {
+    any: MfaConstraint[];
+  };
+}
+
+interface ParsedMfaRequirement {
+  mfa_request_id: string;
+  mfa_constraints: ParsedMfaConstraint[];
+}
+
+interface ParsedMfaConstraint {
+  name: string;
+  methods: ParsedMfaMethod[];
+  selectedMethod: ParsedMfaMethod | null;
+  passcode?: string; // DUMB
+}
+interface ParsedMfaMethod {
+  type: string;
+  id: string;
+  uses_passcode: boolean;
+  label: string;
+  self_enrollment_enabled?: boolean;
+}
+
+interface MfaAuthData {
+  mfaRequirement: ParsedMfaRequirement;
+  authMethodType: string;
+  authMountPath: string;
+}
diff --git a/ui/types/vault/charts/client-counts.d.ts b/ui/types/vault/charts/client-counts.d.ts
deleted file mode 100644
index 7edb8b1b6d3..00000000000
--- a/ui/types/vault/charts/client-counts.d.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// Count and EmptyCount are mutually exclusive
-// but that's hard to represent in an interface
-// so for now we just have both
-interface Count {
-  clients?: number;
-  entity_clients?: number;
-  non_entity_clients?: number;
-  secret_syncs?: number;
-}
-interface EmptyCount {
-  count?: null;
-}
-interface Timestamp {
-  month: string; // eg. 12/22
-  timestamp: string; // ISO 8601
-}
-
-export interface MonthlyChartData extends Count, EmptyCount, Timestamp {
-  new_clients?: Count;
-}
diff --git a/ui/types/vault/client-counts/activity-api.ts b/ui/types/vault/client-counts/activity-api.ts
new file mode 100644
index 00000000000..cf4bcb6d194
--- /dev/null
+++ b/ui/types/vault/client-counts/activity-api.ts
@@ -0,0 +1,127 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { CLIENT_TYPES, ClientFilters, EXPORT_CLIENT_TYPES } from 'core/utils/client-count-utils';
+
+// At time of writing ClientTypes are: 'acme_clients' | 'clients' | 'entity_clients' | 'non_entity_clients' | 'secret_syncs'
+export type ClientTypes = (typeof CLIENT_TYPES)[number];
+
+// 'namespace_path' | 'mount_path' | 'mount_type' | 'month'
+export type ClientFilterTypes = (typeof ClientFilters)[keyof typeof ClientFilters];
+
+// client_type in the exported activity data differs slightly from the types of client keys
+// returned by sys/internal/counters/activity endpoint (:
+// 'non-entity-token' | 'pki-acme' | 'secret-sync' | 'entity'
+type ActivityExportClientTypes = (typeof EXPORT_CLIENT_TYPES)[number];
+
+export interface TotalClients {
+  clients: number;
+  entity_clients: number;
+  non_entity_clients: number;
+  secret_syncs: number;
+  acme_clients: number;
+}
+
+// extend this type when the counts are optional (eg for new clients)
+interface TotalClientsSometimes {
+  clients?: number;
+  entity_clients?: number;
+  non_entity_clients?: number;
+  secret_syncs?: number;
+  acme_clients?: number;
+}
+
+export interface ByNamespaceClients extends TotalClients {
+  label: string;
+  mounts: MountClients[];
+}
+
+export interface MountClients extends TotalClients {
+  label: string;
+  mount_path: string;
+  mount_type: string;
+  namespace_path: string;
+}
+
+export interface ByMonthClients extends TotalClients {
+  timestamp: string;
+  namespaces: ByNamespaceClients[];
+  new_clients: ByMonthNewClients;
+}
+
+export interface ByMonthNewClients extends TotalClientsSometimes {
+  timestamp: string;
+  namespaces: ByNamespaceClients[];
+}
+
+export interface NamespaceNewClients extends TotalClientsSometimes {
+  timestamp: string;
+  label: string;
+  mounts: MountClients[];
+}
+
+export interface MountNewClients extends TotalClientsSometimes {
+  timestamp: string;
+  label: string;
+}
+
+// SERIALIZED RESPONSE DATA from activity/export API
+export interface ActivityExportData {
+  client_id: string;
+  client_type: ActivityExportClientTypes;
+  namespace_id: string;
+  namespace_path: string;
+  mount_accessor: string;
+  mount_type: string;
+  mount_path: string;
+  token_creation_time: string;
+  client_first_used_time: string;
+}
+
+// API RESPONSE SHAPE (prior to serialization)
+export interface NamespaceObject {
+  namespace_id: string;
+  namespace_path: string;
+  counts: Counts;
+  mounts: { mount_path: string; counts: Counts; mount_type: string }[];
+}
+
+export type ActivityMonthStandard = {
+  timestamp: string; // YYYY-MM-01T00:00:00Z (always the first day of the month)
+  counts: Counts;
+  namespaces: NamespaceObject[];
+  new_clients: {
+    counts: Counts;
+    namespaces: NamespaceObject[];
+    timestamp: string;
+  };
+};
+
+export type ActivityMonthNoNewClients = {
+  timestamp: string; // YYYY-MM-01T00:00:00Z (always the first day of the month)
+  counts: Counts;
+  namespaces: NamespaceObject[];
+  new_clients: {
+    counts: null;
+    namespaces: null;
+  };
+};
+
+export type ActivityMonthEmpty = {
+  timestamp: string; // YYYY-MM-01T00:00:00Z (always the first day of the month)
+  counts: null;
+  namespaces: null;
+  new_clients: null;
+};
+
+export type ActivityMonthBlock = ActivityMonthEmpty | ActivityMonthNoNewClients | ActivityMonthStandard;
+
+export interface Counts {
+  acme_clients: number;
+  clients: number;
+  entity_clients: number;
+  non_entity_clients: number;
+  secret_syncs: number;
+}
diff --git a/ui/types/vault/client-counts/charts.ts b/ui/types/vault/client-counts/charts.ts
new file mode 100644
index 00000000000..8cd2c8f4063
--- /dev/null
+++ b/ui/types/vault/client-counts/charts.ts
@@ -0,0 +1,21 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type { TotalClients } from './activity-api';
+
+// TotalClients and EmptyCount are mutually exclusive
+// but that's hard to represent in an interface
+// so for now we just have both
+interface EmptyCount {
+  count?: null;
+}
+interface Timestamp {
+  month: string; // eg. 12/22
+  timestamp: string; // ISO 8601
+}
+
+export interface MonthlyChartData extends TotalClients, EmptyCount, Timestamp {
+  new_clients?: TotalClients;
+}
diff --git a/ui/types/vault/helpers/sync-destinations.d.ts b/ui/types/vault/helpers/sync-destinations.d.ts
new file mode 100644
index 00000000000..2cf3089a17c
--- /dev/null
+++ b/ui/types/vault/helpers/sync-destinations.d.ts
@@ -0,0 +1,16 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { DestinationName, DestinationType } from 'vault/sync';
+
+export interface SyncDestination {
+  name: DestinationName;
+  type: DestinationType;
+  icon: 'aws-color' | 'azure-color' | 'gcp-color' | 'github-color' | 'vercel-color';
+  category: 'cloud' | 'dev-tools';
+  maskedParams: Array<string>;
+  readonlyParams: Array<string>;
+  defaultValues: object;
+}
diff --git a/ui/types/vault/helpers/sync-destinations.ts b/ui/types/vault/helpers/sync-destinations.ts
deleted file mode 100644
index b8859cd9ea4..00000000000
--- a/ui/types/vault/helpers/sync-destinations.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-export type SyncDestinationType = 'aws-sm' | 'azure-kv' | 'gcp-sm' | 'gh' | 'vercel-project';
-export type SyncDestinationName =
-  | 'AWS Secrets Manager'
-  | 'Azure Key Vault'
-  | 'Google Secret Manager'
-  | 'Github Actions'
-  | 'Vercel Project';
-
-export interface SyncDestination {
-  name: SyncDestinationName;
-  type: SyncDestinationType;
-  icon: 'aws-color' | 'azure-color' | 'gcp-color' | 'github-color' | 'vercel-color';
-  category: 'cloud' | 'dev-tools';
-  maskedParams: Array<string>;
-  defaultValues: object;
-}
diff --git a/ui/types/vault/index.d.ts b/ui/types/vault/index.d.ts
index e644f6b1936..8b93b189d11 100644
--- a/ui/types/vault/index.d.ts
+++ b/ui/types/vault/index.d.ts
@@ -1,16 +1,6 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Ember from 'ember';
-
-declare global {
-  // Prevents ESLint from "fixing" this via its auto-fix to turn it into a type
-  // alias (e.g. after running any Ember CLI generator)
-  // eslint-disable-next-line @typescript-eslint/no-empty-interface
-  interface Array<T> extends Ember.ArrayPrototypeExtensions<T> {}
-  // interface Function extends Ember.FunctionPrototypeExtensions {}
-}
-
-export {};
+import 'ember-source/types';
diff --git a/ui/types/vault/models/capabilities.d.ts b/ui/types/vault/models/capabilities.d.ts
index c56eb228ac4..da73acdeb32 100644
--- a/ui/types/vault/models/capabilities.d.ts
+++ b/ui/types/vault/models/capabilities.d.ts
@@ -1,25 +1,26 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import ComputedProperty from '@ember/object/computed';
-import Model from '@ember-data/model';
+import { Model } from 'vault/app-types';
 
-interface CapabilitiesModel extends Model {
+type CapabilitiesModel = Model & {
   path: string;
   capabilities: Array<string>;
-  canSudo: ComputedProperty<boolean | undefined>;
-  canRead: ComputedProperty<boolean | undefined>;
   canCreate: ComputedProperty<boolean | undefined>;
-  canUpdate: ComputedProperty<boolean | undefined>;
   canDelete: ComputedProperty<boolean | undefined>;
   canList: ComputedProperty<boolean | undefined>;
+  canPatch: ComputedProperty<boolean | undefined>;
+  canRead: ComputedProperty<boolean | undefined>;
+  canSudo: ComputedProperty<boolean | undefined>;
+  canUpdate: ComputedProperty<boolean | undefined>;
   // these don't seem to be used anywhere
   // inferring type from key name
   allowedParameters: Array<string>;
   deniedParameters: Array<string>;
-}
+};
 
 export default CapabilitiesModel;
 export const SUDO_PATHS: string[];
diff --git a/ui/types/vault/models/clients/activity.d.ts b/ui/types/vault/models/clients/activity.d.ts
index 4c1f43862a3..5f538e4ea9c 100644
--- a/ui/types/vault/models/clients/activity.d.ts
+++ b/ui/types/vault/models/clients/activity.d.ts
@@ -1,49 +1,19 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import type { Model } from 'vault/app-types';
-
-interface ClientActivityTotals {
-  clients: number;
-  entity_clients: number;
-  non_entity_clients: number;
-  secret_syncs: number;
-}
-
-interface ClientActivityNestedCount extends ClientActivityTotals {
-  label: string;
-}
-
-interface ClientActivityNewClients extends ClientActivityTotals {
-  month: string;
-  mounts?: ClientActivityNestedCount[];
-  namespaces?: ClientActivityNestedCount[];
-}
-
-interface ClientActivityNamespace extends ClientActivityNestedCount {
-  mounts: ClientActivityNestedCount[];
-}
-
-interface ClientActivityResourceByKey extends ClientActivityTotals {
-  month: 'string';
-  mounts_by_key: { [key: string]: ClientActivityResourceByKey };
-  new_clients: ClientActivityNewClients;
-}
-
-interface ClientActivityMonthly extends ClientActivityTotals {
-  month: string;
-  timestamp: string;
-  namespaces: ClientActivityNamespace[];
-  namespaces_by_key: { [key: string]: ClientActivityResourceByKey };
-  new_clients: ClientActivityNewClients;
-}
+import type {
+  ByMonthClients,
+  ByNamespaceClients,
+  TotalClients,
+} from 'vault/vault/client-counts/activity-api';
 
 export default interface ClientsActivityModel extends Model {
-  byMonth: ClientActivityMonthly[];
-  byNamespace: ClientActivityNamespace[];
-  total: ClientActivityTotals;
+  byMonth: ByMonthClients[];
+  byNamespace: ByNamespaceClients[];
+  total: TotalClients;
   startTime: string;
   endTime: string;
   responseTimestamp: string;
diff --git a/ui/types/vault/models/clients/config.d.ts b/ui/types/vault/models/clients/config.d.ts
index 86c1fa2b55f..c4228b2fa33 100644
--- a/ui/types/vault/models/clients/config.d.ts
+++ b/ui/types/vault/models/clients/config.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/models/clients/version-history.d.ts b/ui/types/vault/models/clients/version-history.d.ts
index 0e7ec41b7e9..62137a03ef2 100644
--- a/ui/types/vault/models/clients/version-history.d.ts
+++ b/ui/types/vault/models/clients/version-history.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/models/cluster.d.ts b/ui/types/vault/models/cluster.d.ts
new file mode 100644
index 00000000000..c1474bcb794
--- /dev/null
+++ b/ui/types/vault/models/cluster.d.ts
@@ -0,0 +1,42 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { Model } from 'vault/app-types';
+
+export default class ClusterModel extends Model {
+  id: string;
+  version: any;
+  nodes: any;
+  name: any;
+  status: any;
+  standby: any;
+  type: any;
+  license: any;
+  hasChrootNamespace: any;
+  replicationRedacted: any;
+  get licenseExpiry(): any;
+  get licenseState(): any;
+  get needsInit(): any;
+  get unsealed(): boolean;
+  get sealed(): boolean;
+  get leaderNode(): any;
+  get sealThreshold(): any;
+  get sealProgress(): any;
+  get sealType(): any;
+  get storageType(): any;
+  get hcpLinkStatus(): any;
+  get hasProgress(): boolean;
+  get usingRaft(): boolean;
+  mode: any;
+  get allReplicationDisabled(): any;
+  get anyReplicationEnabled(): any;
+  dr: any;
+  performance: any;
+  rm: any;
+  get drMode(): any;
+  get replicationMode(): any;
+  get replicationModeForDisplay(): 'Disaster Recovery' | 'Performance';
+  get replicationIsInitializing(): boolean;
+}
diff --git a/ui/types/vault/models/identity/oidc/config.d.ts b/ui/types/vault/models/identity/oidc/config.d.ts
new file mode 100644
index 00000000000..d53d51651c0
--- /dev/null
+++ b/ui/types/vault/models/identity/oidc/config.d.ts
@@ -0,0 +1,22 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type Model from '@ember-data/model';
+
+export default class IdentityOidcConfigModel extends Model {
+  issuer: string;
+  queryIssuerError: boolean;
+  get attrs(): any;
+  // for some reason the following Model attrs don't exist on the Model definition
+  changedAttributes(): {
+    [key: string]: unknown[];
+  };
+  rollbackAttributes(): { void };
+  hasDirtyAttributes: boolean;
+  isNew: boolean;
+  canRead: boolean;
+  save(): void;
+  unloadRecord(): void;
+}
diff --git a/ui/types/vault/models/kv/data.d.ts b/ui/types/vault/models/kv/data.d.ts
index d1bf3dc327d..afa9e98b446 100644
--- a/ui/types/vault/models/kv/data.d.ts
+++ b/ui/types/vault/models/kv/data.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/models/kv/metadata.d.ts b/ui/types/vault/models/kv/metadata.d.ts
index 4bdd7ac1164..86a8b07c827 100644
--- a/ui/types/vault/models/kv/metadata.d.ts
+++ b/ui/types/vault/models/kv/metadata.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/models/ldap/config.d.ts b/ui/types/vault/models/ldap/config.d.ts
index 2733e8fe085..b4f89f28f39 100644
--- a/ui/types/vault/models/ldap/config.d.ts
+++ b/ui/types/vault/models/ldap/config.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 import type { WithFormFieldsAndValidationsModel } from 'vault/app-types';
diff --git a/ui/types/vault/models/ldap/library.d.ts b/ui/types/vault/models/ldap/library.d.ts
index 1def4cc4f6f..b45c89e2740 100644
--- a/ui/types/vault/models/ldap/library.d.ts
+++ b/ui/types/vault/models/ldap/library.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 import type { WithFormFieldsAndValidationsModel } from 'vault/app-types';
@@ -13,10 +13,12 @@ import type {
 export default interface LdapLibraryModel extends WithFormFieldsAndValidationsModel {
   backend: string;
   name: string;
+  path_to_library: string;
   service_account_names: string;
   default_ttl: number;
   max_ttl: number;
   disable_check_in_enforcement: string;
+  get completeLibraryName(): string;
   get displayFields(): Array<FormField>;
   libraryPath: CapabilitiesModel;
   statusPath: CapabilitiesModel;
diff --git a/ui/types/vault/models/ldap/role.d.ts b/ui/types/vault/models/ldap/role.d.ts
index ec8d60281fd..55bd406182b 100644
--- a/ui/types/vault/models/ldap/role.d.ts
+++ b/ui/types/vault/models/ldap/role.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 import type { WithFormFieldsAndValidationsModel } from 'vault/app-types';
@@ -7,8 +7,10 @@ import type { FormField } from 'vault/app-types';
 import CapabilitiesModel from '../capabilities';
 import { LdapDynamicRoleCredentials, LdapStaticRoleCredentials } from 'ldap/routes/roles/role/credentials';
 export default interface LdapRoleModel extends WithFormFieldsAndValidationsModel {
+  id: string;
   type: string;
   backend: string;
+  path_to_role: string;
   name: string;
   dn: string;
   username: string;
@@ -18,6 +20,7 @@ export default interface LdapRoleModel extends WithFormFieldsAndValidationsModel
   username_template: string;
   creation_ldif: string;
   rollback_ldif: string;
+  get completeRoleName(): string;
   get isStatic(): string;
   get isDynamic(): string;
   get fieldsForType(): Array<string>;
diff --git a/ui/types/vault/models/mount-config.d.ts b/ui/types/vault/models/mount-config.d.ts
index a4632961121..9abf7412f0d 100644
--- a/ui/types/vault/models/mount-config.d.ts
+++ b/ui/types/vault/models/mount-config.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -15,4 +15,5 @@ export default class MountConfigModel extends Model {
   allowedResponseHeaders: string;
   tokenType: string;
   allowedManagedKeys: string;
+  identityTokenKey: string;
 }
diff --git a/ui/types/vault/models/pki/action.d.ts b/ui/types/vault/models/pki/action.d.ts
index 851049a0f4b..46bdba9be32 100644
--- a/ui/types/vault/models/pki/action.d.ts
+++ b/ui/types/vault/models/pki/action.d.ts
@@ -1,13 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Model from '@ember-data/model';
-import { FormField, ModelValidations, StringMap } from 'vault/app-types';
-import CapabilitiesModel from '../capabilities';
+import type { StringMap, WithFormFieldsAndValidationsModel } from 'vault/app-types';
+import type CapabilitiesModel from '../capabilities';
 
-export default class PkiActionModel extends Model {
+type PkiActionModel = WithFormFieldsAndValidationsModel & {
   secretMountPath: unknown;
   actionType: string | null;
   pemBundle: string;
@@ -51,11 +50,11 @@ export default class PkiActionModel extends Model {
   generateIssuerRootPath: Promise<CapabilitiesModel>;
   generateIssuerCsrPath: Promise<CapabilitiesModel>;
   crossSignPath: string;
-  allFields: Array<FormField>;
-  validate(): ModelValidations;
   // Capabilities
   get canImportBundle(): boolean;
   get canGenerateIssuerRoot(): boolean;
   get canGenerateIssuerIntermediate(): boolean;
   get canCrossSign(): boolean;
-}
+};
+
+export default PkiActionModel;
diff --git a/ui/types/vault/models/pki/certificate/base.d.ts b/ui/types/vault/models/pki/certificate/base.d.ts
index ddc3c2ab416..3a9b4342c3a 100644
--- a/ui/types/vault/models/pki/certificate/base.d.ts
+++ b/ui/types/vault/models/pki/certificate/base.d.ts
@@ -1,14 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Model from '@ember-data/model';
-export default class PkiCertificateBaseModel extends Model {
+import type { WithFormFieldsAndValidationsModel } from 'vault/app-types';
+
+type PkiCertificateBaseModel = WithFormFieldsAndValidationsModel & {
   secretMountPath: class;
-  get useOpenAPI(): boolean;
   get backend(): string;
-  getHelpUrl(): void;
   altNames: string;
   commonName: string;
   caChain: string;
@@ -26,4 +25,6 @@ export default class PkiCertificateBaseModel extends Model {
   revocationTime: number;
   serialNumber: string;
   get canRevoke(): boolean;
-}
+};
+
+export default PkiCertificateBaseModel;
diff --git a/ui/types/vault/models/pki/certificate/generate.d.ts b/ui/types/vault/models/pki/certificate/generate.d.ts
index db7ad7c03e8..a1e0f987ef9 100644
--- a/ui/types/vault/models/pki/certificate/generate.d.ts
+++ b/ui/types/vault/models/pki/certificate/generate.d.ts
@@ -1,13 +1,12 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import { FormField, FormFieldGroups } from 'vault/app-types';
-import PkiCertificateBaseModel from './base';
+import type PkiCertificateBaseModel from './base';
 
-export default class PkiCertificateGenerateModel extends PkiCertificateBaseModel {
+type PkiCertificateGenerateModel = PkiCertificateBaseModel & {
   role: string;
-  formFields: FormField[];
-  formFieldGroups: FormFieldGroups;
-}
+};
+
+export default PkiCertificateGenerateModel;
diff --git a/ui/types/vault/models/pki/certificate/sign-intermediate.d.ts b/ui/types/vault/models/pki/certificate/sign-intermediate.d.ts
index 75860dbe1dd..d1626dc0557 100644
--- a/ui/types/vault/models/pki/certificate/sign-intermediate.d.ts
+++ b/ui/types/vault/models/pki/certificate/sign-intermediate.d.ts
@@ -1,15 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import PkiCertificateBaseModel from './base';
-import { FormField, FormFieldGroups, ModelValidations } from 'vault/app-types';
-export default class PkiCertificateSignIntermediateModel extends PkiCertificateBaseModel {
+import type PkiCertificateBaseModel from './base';
+
+type PkiCertificateSignIntermediateModel = PkiCertificateBaseModel & {
   role: string;
   csr: string;
-  formFields: FormField[];
-  formFieldGroups: FormFieldGroups;
   issuerRef: string;
   maxPathLength: string;
   notBeforeDuration: string;
@@ -18,5 +16,6 @@ export default class PkiCertificateSignIntermediateModel extends PkiCertificateB
   usePss: boolean;
   skid: string;
   signatureBits: string;
-  validate(): ModelValidations;
-}
+};
+
+export default PkiCertificateSignIntermediateModel;
diff --git a/ui/types/vault/models/pki/certificate/sign.d.ts b/ui/types/vault/models/pki/certificate/sign.d.ts
index 1521cde9a66..97be26d71b5 100644
--- a/ui/types/vault/models/pki/certificate/sign.d.ts
+++ b/ui/types/vault/models/pki/certificate/sign.d.ts
@@ -1,15 +1,14 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import PkiCertificateBaseModel from './base';
-import { FormField, FormFieldGroups, ModelValidations } from 'vault/app-types';
-export default class PkiCertificateSignModel extends PkiCertificateBaseModel {
+import type PkiCertificateBaseModel from './base';
+
+export type PkiCertificateSignModel = PkiCertificateBaseModel & {
   role: string;
   csr: string;
-  formFields: FormField[];
-  formFieldGroups: FormFieldGroups;
   removeRootsFromChain: boolean;
-  validate(): ModelValidations;
-}
+};
+
+export default PkiCertificateSignModel;
diff --git a/ui/types/vault/models/pki/config/acme.d.ts b/ui/types/vault/models/pki/config/acme.d.ts
new file mode 100644
index 00000000000..3954126bd21
--- /dev/null
+++ b/ui/types/vault/models/pki/config/acme.d.ts
@@ -0,0 +1,22 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type { Model } from 'vault/app-types';
+import type CapabilitiesModel from 'vault/models/capabilities';
+
+type PkiConfigAcmeModel = Model & {
+  enabled: boolean;
+  defaultDirectoryPolicy: string;
+  allowedRoles: string[];
+  allowRoleExtKeyUsage: boolean;
+  allowedIssuers: string[];
+  eabPolicy: string;
+  dnsResolver: string;
+  maxTtl: string;
+  acmePath: CapabilitiesModel;
+  get canSet(): boolean;
+};
+
+export default PkiConfigAcmeModel;
diff --git a/ui/types/vault/models/pki/config/cluster.d.ts b/ui/types/vault/models/pki/config/cluster.d.ts
new file mode 100644
index 00000000000..ac5887db805
--- /dev/null
+++ b/ui/types/vault/models/pki/config/cluster.d.ts
@@ -0,0 +1,16 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type { Model } from 'vault/app-types';
+import type CapabilitiesModel from 'vault/models/capabilities';
+
+type PkiConfigClusterModel = Model & {
+  path: boolean;
+  aiaPath: string;
+  clusterPath: CapabilitiesModel;
+  get canSet(): boolean;
+};
+
+export default PkiConfigClusterModel;
diff --git a/ui/types/vault/models/pki/config/crl.d.ts b/ui/types/vault/models/pki/config/crl.d.ts
index b558f5f9cb6..34a9e55c87a 100644
--- a/ui/types/vault/models/pki/config/crl.d.ts
+++ b/ui/types/vault/models/pki/config/crl.d.ts
@@ -1,12 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Model from '@ember-data/model';
-import { FormField } from 'vault/app-types';
+import type { WithFormFieldsModel } from 'vault/app-types';
 
-export default class PkiConfigCrlModel extends Model {
+type PkiConfigCrlModel = WithFormFieldsModel & {
   autoRebuild: boolean;
   autoRebuildGracePeriod: string;
   enableDelta: boolean;
@@ -16,6 +15,7 @@ export default class PkiConfigCrlModel extends Model {
   ocspExpiry: string;
   ocspDisable: boolean;
   crlPath: string;
-  formFields: FormField[];
   get canSet(): boolean;
-}
+};
+
+export default PkiConfigCrlModel;
diff --git a/ui/types/vault/models/pki/config/urls.d.ts b/ui/types/vault/models/pki/config/urls.d.ts
index e6cc732c355..690cdf56e02 100644
--- a/ui/types/vault/models/pki/config/urls.d.ts
+++ b/ui/types/vault/models/pki/config/urls.d.ts
@@ -1,16 +1,16 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Model from '@ember-data/model';
+import type { Model } from 'vault/app-types';
 
-export default class PkiConfigUrlsModel extends Model {
-  get useOpenAPI(): boolean;
-  getHelpUrl(backendPath: string): string;
+type PkiConfigUrlsModel = Model & {
   issuingCertificates: array;
   crlDistributionPoints: array;
   ocspServers: array;
   urlsPath: string;
   get canSet(): boolean;
-}
+};
+
+export default PkiConfigUrlsModel;
diff --git a/ui/types/vault/models/pki/issuer.d.ts b/ui/types/vault/models/pki/issuer.d.ts
index a0becfec732..9c8f9050a1d 100644
--- a/ui/types/vault/models/pki/issuer.d.ts
+++ b/ui/types/vault/models/pki/issuer.d.ts
@@ -1,14 +1,13 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
+import type { WithFormFieldsAndValidationsModel } from 'vault/app-types';
+import type { ParsedCertificateData } from 'vault/utils/parse-pki-cert';
+import type CapabilitiesModel from 'vault/models/capabilities';
 
-import Model from '@ember-data/model';
-import { FormField, FormFieldGroups, ModelValidations } from 'vault/app-types';
-import { ParsedCertificateData } from 'vault/vault/utils/parse-pki-cert';
-export default class PkiIssuerModel extends Model {
+type PkiIssuerModel = WithFormFieldsAndValidationsModel & {
   secretMountPath: class;
-  get useOpenAPI(): boolean;
   get backend(): string;
   get issuerRef(): string;
   certificate: string;
@@ -23,22 +22,18 @@ export default class PkiIssuerModel extends Model {
   crlDistributionPoints: string;
   ocspServers: string;
   parsedCertificate: ParsedCertificateData;
-  /** these are all instances of the capabilities model which should be converted to native class and typed
-  rotateExported: any;
-  rotateInternal: any;
-  rotateExisting: any;
-  crossSignPath: any;
-  signIntermediate: any;
-  -------------------- **/
+  rotateExported: CapabilitiesModel;
+  rotateInternal: CapabilitiesModel;
+  rotateExisting: CapabilitiesModel;
+  crossSignPath: CapabilitiesModel;
+  signIntermediate: CapabilitiesModel;
   pemBundle: string;
   importedIssuers: string[];
   importedKeys: string[];
-  formFields: FormField[];
-  formFieldGroups: FormFieldGroups[];
-  allFields: FormField[];
   get canRotateIssuer(): boolean;
   get canCrossSign(): boolean;
   get canSignIntermediate(): boolean;
   get canConfigure(): boolean;
-  validate(): ModelValidations;
-}
+};
+
+export default PkiIssuerModel;
diff --git a/ui/types/vault/models/pki/key.d.ts b/ui/types/vault/models/pki/key.d.ts
index 7f82b2d1a15..c0452550c97 100644
--- a/ui/types/vault/models/pki/key.d.ts
+++ b/ui/types/vault/models/pki/key.d.ts
@@ -1,12 +1,11 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Model from '@ember-data/model';
-import { ModelValidations } from 'vault/app-types';
+import type { WithValidationsModel } from 'vault/app-types';
 
-export default class PkiKeyModel extends Model {
+type PkiKeyModel = WithValidationsModel & {
   secretMountPath: class;
   keyId: string;
   keyName: string;
@@ -15,12 +14,12 @@ export default class PkiKeyModel extends Model {
   keyBits: string;
   pemBundle: string;
   privateKey: string;
-  isNew: boolean;
   get backend(): string;
   get canRead(): boolean;
   get canEdit(): boolean;
   get canDelete(): boolean;
   get canGenerateKey(): boolean;
   get canImportKey(): boolean;
-  validate(): ModelValidations;
-}
+};
+
+export default PkiKeyModel;
diff --git a/ui/types/vault/models/pki/role.d.ts b/ui/types/vault/models/pki/role.d.ts
index 94f2e5376c4..0403866ddd5 100644
--- a/ui/types/vault/models/pki/role.d.ts
+++ b/ui/types/vault/models/pki/role.d.ts
@@ -1,18 +1,15 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Model from '@ember-data/model';
-import { ModelValidations } from 'vault/app-types';
+import type { WithValidationsModel } from 'vault/app-types';
 
-export default class PkiRoleModel extends Model {
-  get useOpenAPI(): boolean;
+type PkiRoleModel = WithValidationsModel & {
   name: string;
   issuerRef: string;
-  getHelpUrl(backendPath: string): string;
-  validate(): ModelValidations;
-  isNew: boolean;
   keyType: string;
   keyBits: string | undefined;
-}
+};
+
+export default PkiRoleModel;
diff --git a/ui/types/vault/models/pki/tidy.d.ts b/ui/types/vault/models/pki/tidy.d.ts
index b7fb7467792..3182db51163 100644
--- a/ui/types/vault/models/pki/tidy.d.ts
+++ b/ui/types/vault/models/pki/tidy.d.ts
@@ -1,21 +1,23 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
-import Model from '@ember-data/model';
-import { FormField, FormFieldGroups } from 'vault/vault/app-types';
+import type { FormField, FormFieldGroups, WithFormFieldsModel } from 'vault/app-types';
 
-export default class PkiTidyModel extends Model {
+type PkiTidyModel = WithFormFieldsModel & {
   version: string;
   acmeAccountSafetyBuffer: string;
   tidyAcme: boolean;
   enabled: boolean;
   intervalDuration: string;
+  minStartupBackoffDuration: string;
+  maxStartupBackoffDuration: string;
   issuerSafetyBuffer: string;
   pauseDuration: string;
   revocationQueueSafetyBuffer: string;
   safetyBuffer: string;
+  tidyCertMetadata: boolean;
   tidyCertStore: boolean;
   tidyCrossClusterRevokedCerts: boolean;
   tidyExpiredIssuers: boolean;
@@ -23,12 +25,10 @@ export default class PkiTidyModel extends Model {
   tidyRevocationQueue: boolean;
   tidyRevokedCertIssuerAssociations: boolean;
   tidyRevokedCerts: boolean;
-  get useOpenAPI(): boolean;
-  getHelpUrl(backend: string): string;
   allByKey: {
     intervalDuration: FormField[];
   };
-  get allGroups(): FormFieldGroups[];
   get sharedFields(): FormFieldGroups[];
-  get formFieldGroups(): FormFieldGroups[];
-}
+};
+
+export default PkiTidyModel;
diff --git a/ui/types/vault/models/secret-engine.d.ts b/ui/types/vault/models/secret-engine.d.ts
index cce4d0d6be9..bdef49e1188 100644
--- a/ui/types/vault/models/secret-engine.d.ts
+++ b/ui/types/vault/models/secret-engine.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -9,6 +9,7 @@ import type { ModelValidations, FormField, FormFieldGroups } from 'vault/app-typ
 import type MountConfigModel from 'vault/models/mount-config';
 
 export default class SecretEngineModel extends Model {
+  id: string;
   path: string;
   type: string;
   description: string;
@@ -26,6 +27,7 @@ export default class SecretEngineModel extends Model {
   maxVersions: number;
   casRequired: boolean;
   deleteVersionAfter: string;
+  runningPluginVersion: string;
   get modelTypeForKV(): string;
   get isV2KV(): boolean;
   get attrs(): Array<FormField>;
@@ -39,7 +41,7 @@ export default class SecretEngineModel extends Model {
   get localDisplay(): string;
   get formFields(): Array<FormField>;
   get formFieldGroups(): FormFieldGroups;
-  saveCA(options: object): Promise;
+  destroyRecord(): void;
   saveZeroAddressConfig(): Promise;
   validate(): ModelValidations;
   // need to override isNew which is a computed prop and ts will complain since it sees it as a function
diff --git a/ui/types/vault/models/secret-engine/additional-config.d.ts b/ui/types/vault/models/secret-engine/additional-config.d.ts
new file mode 100644
index 00000000000..2191f4c00c5
--- /dev/null
+++ b/ui/types/vault/models/secret-engine/additional-config.d.ts
@@ -0,0 +1,28 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type Model from '@ember-data/model';
+import type { ModelValidations, FormField } from 'vault/app-types';
+
+export default class SecretEngineAdditionalConfigModel extends Model {
+  backend: string;
+  type: string;
+  // aws lease
+  leaseMax: any;
+  lease: any;
+
+  get displayAttrs(): any;
+
+  formFields: FormField[];
+  changedAttributes(): {
+    [key: string]: unknown[];
+  };
+  isNew: boolean;
+  save(): void;
+  unloadRecord(): void;
+  destroyRecord(): void;
+  rollbackAttributes(): void;
+  validate(): ModelValidations;
+}
diff --git a/ui/types/vault/models/secret-engine/mount-config.d.ts b/ui/types/vault/models/secret-engine/mount-config.d.ts
new file mode 100644
index 00000000000..d136289b292
--- /dev/null
+++ b/ui/types/vault/models/secret-engine/mount-config.d.ts
@@ -0,0 +1,53 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type Model from '@ember-data/model';
+import type { ModelValidations, FormFieldGroups } from 'vault/app-types';
+
+export default class SecretEngineMountConfigModel extends Model {
+  backend: string;
+  type: string;
+  // aws
+  accessKey: any;
+  secretKey: any;
+  roleArn: any;
+  region: any;
+  iamEndpoint: any;
+  stsEndpoint: any;
+  maxRetries: any;
+  // azure
+  subscriptionId: string | undefined;
+  tenantId: string | undefined;
+  clientId: string | undefined;
+  clientSecret: string | undefined;
+  environment: string | undefined;
+  rootPasswordTtl: string | undefined;
+  // gcp
+  credentials: string | undefined;
+  ttl: any;
+  maxTtl: any;
+  secretAccountEmail: string | undefined;
+  // wif
+  identityTokenAudience: string | undefined;
+  identityTokenTtl: any;
+
+  get displayAttrs(): any;
+  get isConfigured(): boolean; // used only for secret engines that return a 200 when configuration has not be set.
+  get isWifPluginConfigured(): boolean;
+  get isAccountPluginConfigured(): boolean;
+  get fieldGroupsWif(): any;
+  get fieldGroupsAccount(): any;
+
+  formFieldGroups: FormFieldGroups[];
+
+  changedAttributes(): {
+    [key: string]: unknown[];
+  };
+  isNew: boolean;
+  save(): void;
+  unloadRecord(): void;
+  destroyRecord(): void;
+  rollbackAttributes(): void;
+}
diff --git a/ui/types/vault/models/ssh/ca-config.d.ts b/ui/types/vault/models/ssh/ca-config.d.ts
new file mode 100644
index 00000000000..db6044fddd1
--- /dev/null
+++ b/ui/types/vault/models/ssh/ca-config.d.ts
@@ -0,0 +1,17 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import { FormField, WithFormFieldsAndValidationsModel } from 'vault/app-types';
+
+export default interface SshCaConfig extends WithFormFieldsAndValidationsModel {
+  backend: string;
+  privateKey: string;
+  publicKey: string;
+  generateSigningKey: boolean;
+
+  configurableParams: ['privateKey', 'publicKey', 'generateSigningKey'];
+
+  get displayAttrs(): FormField[];
+}
diff --git a/ui/types/vault/models/sync/association.d.ts b/ui/types/vault/models/sync/association.d.ts
index 2f43e225093..71fece7267d 100644
--- a/ui/types/vault/models/sync/association.d.ts
+++ b/ui/types/vault/models/sync/association.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/models/sync/destination.d.ts b/ui/types/vault/models/sync/destination.d.ts
index e027da10259..74b0fd61431 100644
--- a/ui/types/vault/models/sync/destination.d.ts
+++ b/ui/types/vault/models/sync/destination.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/mount.d.ts b/ui/types/vault/mount.d.ts
new file mode 100644
index 00000000000..4915936dec8
--- /dev/null
+++ b/ui/types/vault/mount.d.ts
@@ -0,0 +1,38 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+export type MountConfig = {
+  allowed_managed_keys?: string[];
+  allowed_response_headers?: string[];
+  audit_non_hmac_request_keys?: string[];
+  audit_non_hmac_response_keys?: string[];
+  default_lease_ttl?: number | string;
+  force_no_cache?: boolean;
+  identity_token_key?: string;
+  listing_visibility?: string | boolean;
+  max_lease_ttl?: number | string;
+  passthrough_request_headers?: string[];
+  token_type?: string;
+};
+
+export type MountOptions = {
+  version: number;
+};
+
+export type Mount = {
+  path: string;
+  accessor: string;
+  config: MountConfig;
+  description: string;
+  external_entropy_access: boolean;
+  local: boolean;
+  options?: MountOptions;
+  plugin_version: string;
+  running_plugin_version: string;
+  running_sha256: string;
+  seal_wrap: boolean;
+  type: string;
+  uuid: string;
+};
diff --git a/ui/types/vault/route.d.ts b/ui/types/vault/route.d.ts
index 159718dafae..cf423cfc41e 100644
--- a/ui/types/vault/route.d.ts
+++ b/ui/types/vault/route.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 import Route from '@ember/routing/route';
diff --git a/ui/types/vault/secrets/engine.d.ts b/ui/types/vault/secrets/engine.d.ts
new file mode 100644
index 00000000000..7ba3278e7c1
--- /dev/null
+++ b/ui/types/vault/secrets/engine.d.ts
@@ -0,0 +1,75 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type {
+  MountsEnableSecretsEngineRequest,
+  AwsConfigureRootIamCredentialsRequest,
+  AwsConfigureLeaseRequest,
+  AzureConfigureRequest,
+  GoogleCloudConfigureRequest,
+} from '@hashicorp/vault-client-typescript';
+import type { MountConfig, MountOptions } from 'vault/mount';
+
+type CommonConfigParams = {
+  rotation_period: number;
+  rotation_schedule: string;
+  rotation_window: number;
+  identity_token_audience: string;
+  identity_token_ttl: number;
+  disable_automated_rotation: boolean;
+  issuer?: string;
+};
+
+export type AwsConfig = CommonConfigParams & {
+  access_key: string;
+  iam_endpoint: string;
+  max_retries: number;
+  region: string;
+  role_arn: string;
+  sts_endpoint: string;
+  sts_fallback_endpoints: string[];
+  sts_fallback_regions: string[];
+  sts_region: string;
+  username_template: string;
+  lease?: string;
+  lease_max?: string;
+};
+
+export type AzureConfig = CommonConfigParams & {
+  client_id: string;
+  environment: string;
+  subscription_id: string;
+  tenant_id: string;
+};
+
+export type GcpConfig = CommonConfigParams & {
+  max_ttl: number;
+  service_account_email: string;
+  ttl: number;
+};
+
+export type SshConfig = {
+  public_key: string;
+  generate_signing_key: boolean;
+};
+
+export type SecretsEngineFormData = MountsEnableSecretsEngineRequest & {
+  path: string;
+  config: MountConfig;
+  options?: MountOptions;
+  kv_config?: {
+    max_versions?: number;
+    cas_required?: boolean;
+    delete_version_after?: string;
+  };
+};
+
+type Issuer = {
+  issuer?: string;
+};
+
+export type AwsConfigFormData = AwsConfigureRootIamCredentialsRequest & AwsConfigureLeaseRequest & Issuer;
+export type AzureConfigFormData = AzureConfigureRequest & Issuer;
+export type GcpConfigFormData = GoogleCloudConfigureRequest & Issuer;
diff --git a/ui/types/vault/services/auth.d.ts b/ui/types/vault/services/auth.d.ts
index 976e8a9b211..f57e344db55 100644
--- a/ui/types/vault/services/auth.d.ts
+++ b/ui/types/vault/services/auth.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -7,16 +7,57 @@
 // add properties as needed
 
 import Service from '@ember/service';
+import type { MfaRequirementApiResponse, ParsedMfaRequirement } from 'vault/auth/mfa';
+import type { NormalizedAuthData, NormalizeAuthResponseKeys } from 'vault/auth/form';
+import type { AuthResponseAuthKey, AuthResponseDataKey } from 'vault/auth/methods';
 
-export interface AuthData {
+interface AuthData {
   userRootNamespace: string;
   token: string;
   policies: string[];
   renewable: boolean;
-  entity_id: string;
+  entityId: string;
   displayName?: string;
 }
 
+export interface AuthSuccessResponse {
+  namespace: string;
+  token: string; // the name of the token in local storage, not the actual token
+  isRoot: boolean;
+}
+export interface AuthResponseWithMfa {
+  mfa_requirement: MfaRequirementApiResponse;
+}
+
+type NormalizedProps = NormalizeAuthResponseKeys & {
+  authMethodType: string;
+};
+
 export default class AuthService extends Service {
   authData: AuthData;
+  currentToken: string;
+  mfaErrors: null | Errors[];
+  setLastFetch: (time: number) => void;
+  authSuccess(clusterId: string, authData: NormalizedAuthData): Promise<AuthSuccessResponse>;
+  ajax: (
+    url: string,
+    method: 'GET' | 'POST' | 'PUT' | 'DELETE',
+    options?: {
+      headers?: Record<string, string>;
+      namespace?: string;
+      data?: Record<string, unknown>;
+    }
+  ) => Promise<any>;
+  getAuthType(): string | undefined;
+  parseMfaResponse(mfaResponse: MfaRequirementApiResponse): ParsedMfaRequirement;
+  normalizeAuthData(
+    authResponse: AuthResponseAuthKey | AuthResponseDataKey,
+    normalizedProperties: NormalizedProps
+  ): NormalizedAuthData;
+  totpValidate({
+    clusterId: string,
+    mfaRequirement: ParsedMfaRequirement,
+    authMethodType: string,
+    authMountPath: string,
+  }): Promise<AuthSuccessResponse>;
 }
diff --git a/ui/types/vault/services/control-group.d.ts b/ui/types/vault/services/control-group.d.ts
new file mode 100644
index 00000000000..da0ff0dcb3f
--- /dev/null
+++ b/ui/types/vault/services/control-group.d.ts
@@ -0,0 +1,37 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Service from '@ember/service';
+
+import type localStorage from 'vault/lib/local-storage';
+import type memoryStorage from 'vault/lib/memory-storage';
+import type { ApiResponse, WrapInfo } from 'vault/api';
+import type Transition from '@ember/routing/transition';
+
+export interface ControlGroupErrorLog {
+  type: string;
+  content: string;
+  href: string;
+  token: string;
+  accessor: string;
+  creation_path: string;
+}
+
+export default class ControlGroupService extends Service {
+  tokenToUnwrap: WrapInfo | null;
+  storage(): localStorage | memoryStorage;
+  keyFromAccessor(accessor: string): string | null;
+  storeControlGroupToken(info: WrapInfo): void;
+  deleteControlGroupToken(accessor: string): void;
+  deleteTokens(): void;
+  wrapInfoForAccessor(accessor: string): string | null;
+  markTokenForUnwrap(accessor: string): void;
+  unmarkTokenForUnwrap(): void;
+  tokenForUrl(url: string): { token: string; accessor: string; creationTime: string } | null;
+  isRequestedPathLocked(response: ApiResponse, wrapTtl?: string | null): boolean;
+  checkForControlGroup(callbackArgs: unknown, response: ApiResponse, wrapTtl?: string): Promise<unknown>;
+  saveTokenFromError(error: WrapInfo): void;
+  logFromError(error: WrapInfo): ControlGroupErrorLog;
+}
diff --git a/ui/types/vault/services/namespace.d.ts b/ui/types/vault/services/namespace.d.ts
index b298ef74dc2..873337b2649 100644
--- a/ui/types/vault/services/namespace.d.ts
+++ b/ui/types/vault/services/namespace.d.ts
@@ -1,21 +1,28 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
 import Service from '@ember/service';
+import { TaskGenerator, Task } from 'ember-concurrency';
 
 interface PathsResponse {
   [key: string]: {
     capabilities: string[];
   };
 }
+
+export const ROOT_NAMESPACE: string;
+
 export default class NamespaceService extends Service {
+  accessibleNamespaces: string[];
   userRootNamespace: string;
   inRootNamespace: boolean;
+  inHvdAdminNamespace: boolean;
   currentNamespace: string;
   relativeNamespace: string;
+  path: string;
   setNamespace: () => void;
-  findNamespacesForUser: () => void;
+  findNamespacesForUser: Task<TaskGenerator<[string]>, []>;
   reset: () => void;
 }
diff --git a/ui/types/vault/services/pagination.d.ts b/ui/types/vault/services/pagination.d.ts
new file mode 100644
index 00000000000..5ae906ba223
--- /dev/null
+++ b/ui/types/vault/services/pagination.d.ts
@@ -0,0 +1,16 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Service from '@ember/service';
+import { RecordArray } from '@ember-data/store';
+
+export default class PaginationService extends Service {
+  lazyPaginatedQuery(
+    modelName: string,
+    query: object,
+    options?: { adapterOptions: object }
+  ): Promise<RecordArray>;
+  clearDataset(modelName: string);
+}
diff --git a/ui/types/vault/services/path-help.d.ts b/ui/types/vault/services/path-help.d.ts
new file mode 100644
index 00000000000..a5a662d01f0
--- /dev/null
+++ b/ui/types/vault/services/path-help.d.ts
@@ -0,0 +1,14 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import Service from '@ember/service';
+
+import type { PathInfo } from 'vault/utils/openapi-helpers';
+
+export default class PathHelpService extends Service {
+  getPaths(apiPath: string, backend: string, itemType?: string, itemID?: string): Promise<PathInfo>;
+  hydrateModel(modelType: string, backend: string): Promise<void>;
+  getNewModel(modelType: string, backend: string, apiPath: string, itemType?: string): Promise<void>;
+}
diff --git a/ui/types/vault/services/permissions.d.ts b/ui/types/vault/services/permissions.d.ts
index 232508240cc..cd503cf3838 100644
--- a/ui/types/vault/services/permissions.d.ts
+++ b/ui/types/vault/services/permissions.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
@@ -16,4 +16,5 @@ export default class PermissionsService extends Service {
   canViewAll: boolean | null;
   permissionsBanner: string | null;
   chrootNamespace: string | null | undefined;
+  hasNavPermission: (string) => boolean;
 }
diff --git a/ui/types/vault/services/store.d.ts b/ui/types/vault/services/store.d.ts
deleted file mode 100644
index af201ccb554..00000000000
--- a/ui/types/vault/services/store.d.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-import Store, { RecordArray } from '@ember-data/store';
-
-export default class StoreService extends Store {
-  lazyPaginatedQuery(
-    modelName: string,
-    query: Object,
-    options?: { adapterOptions: Object }
-  ): Promise<RecordArray>;
-
-  clearDataset(modelName: string);
-}
diff --git a/ui/types/vault/sync.d.ts b/ui/types/vault/sync.d.ts
new file mode 100644
index 00000000000..546a94c82c5
--- /dev/null
+++ b/ui/types/vault/sync.d.ts
@@ -0,0 +1,107 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type AwsSmForm from 'vault/forms/sync/aws-sm';
+import type AzureKvForm from 'vault/forms/sync/azure-kv';
+import type GcpSmForm from 'vault/forms/sync/gcp-sm';
+import type GhForm from 'vault/forms/sync/gh';
+import type VercelProjectForm from 'vault/forms/sync/vercel-project';
+
+export type ListDestination = {
+  id: string;
+  name: string;
+  type: DestinationType;
+  icon?: string;
+  type_display_name?: string;
+};
+
+export type AssociatedSecret = {
+  mount: string;
+  secret_name: string;
+  sync_status: string;
+  updated_at: Date;
+  destination_type: DestinationType;
+  destination_name: string;
+};
+
+export type AssociatedDestination = {
+  type: string;
+  name: string;
+  sync_status: string;
+  updated_at: Date;
+};
+
+export type SyncStatus = {
+  destination_type: string;
+  destination_name: string;
+  sync_status: string;
+  updated_at: string;
+};
+
+export type DestinationMetrics = {
+  icon?: string;
+  name?: string;
+  type?: DestinationType;
+  associationCount: number;
+  status: string | null;
+  lastUpdated?: Date;
+};
+
+export type AssociationMetrics = {
+  total_associations: number;
+  total_secrets: number;
+};
+
+export type DestinationType = 'aws-sm' | 'azure-kv' | 'gcp-sm' | 'gh' | 'vercel-project';
+
+export type DestinationName =
+  | 'AWS Secrets Manager'
+  | 'Azure Key Vault'
+  | 'Google Secret Manager'
+  | 'Github Actions'
+  | 'Vercel Project';
+
+export type Destination = {
+  name: string;
+  type: DestinationType;
+  connection_details: DestinationConnectionDetails;
+  options: DestinationOptions;
+  // only present if delete action has been initiated
+  purge_initiated_at?: string;
+  purge_error?: string;
+};
+
+export type DestinationConnectionDetails = {
+  // aws-sm
+  access_key_id?: string;
+  secret_access_key?: string;
+  region?: string;
+  // azure-kv
+  key_vault_uri?: string;
+  client_id?: string;
+  client_secret?: string;
+  tenant_id?: string;
+  cloud?: string;
+  // gcp
+  credentials?: string;
+  // gh
+  access_token?: string;
+  repository_owner?: string;
+  repository_name?: string;
+  // vercel project
+  access_token?: string;
+  project_id?: string;
+  team_id?: string;
+  deployment_environments?: array;
+};
+
+export type DestinationOptions = {
+  granularity?: string; // expected as granularity in request
+  granularity_level?: string; // returned as granularity_level from response
+  secret_name_template: string;
+  custom_tags?: Record<string, string>;
+};
+
+export type DestinationForm = AwsSmForm | AzureKvForm | GcpSmForm | GhForm | VercelProjectForm;
diff --git a/ui/types/vault/usage.d.ts b/ui/types/vault/usage.d.ts
new file mode 100644
index 00000000000..7a836644af9
--- /dev/null
+++ b/ui/types/vault/usage.d.ts
@@ -0,0 +1,45 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+import type { GenerateUtilizationReportResponse } from '@hashicorp/vault-client-typescript';
+import type {
+  REPLICATION_ENABLED_STATE,
+  REPLICATION_DISABLED_STATE,
+} from '@hashicorp-internal/vault-reporting/types/index';
+
+export type GlobalLeaseCountQuota = {
+  capacity: number;
+  count: number;
+  name: string;
+};
+
+export type LeaseCountQuotas = {
+  global_lease_count_quota: GlobalLeaseCountQuota;
+  total_lease_count_quotas: number;
+};
+
+export type SecretSync = {
+  total_destinations: number;
+  destinations: Record<string, number>;
+};
+
+export type Pki = {
+  total_issuers: number;
+  total_roles: number;
+};
+
+export type ReplicationStatus = {
+  dr_primary: boolean;
+  dr_state: REPLICATION_ENABLED_STATE | typeof REPLICATION_DISABLED_STATE;
+  pr_primary: boolean;
+  pr_state: REPLICATION_ENABLED_STATE | typeof REPLICATION_DISABLED_STATE;
+};
+
+export type UtilizationReport = GenerateUtilizationReportResponse & {
+  lease_count_quotas: LeaseCountQuotas;
+  secret_sync: SecretSync;
+  pki: Pki;
+  replication_status: ReplicationStatus;
+};
diff --git a/ui/types/vault/utils/camelize-object-keys.d.ts b/ui/types/vault/utils/camelize-object-keys.d.ts
index b5a7c0f8844..b2353e3afa3 100644
--- a/ui/types/vault/utils/camelize-object-keys.d.ts
+++ b/ui/types/vault/utils/camelize-object-keys.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/utils/field-to-attrs.d.ts b/ui/types/vault/utils/field-to-attrs.d.ts
index f56fcc71d00..5a59674334a 100644
--- a/ui/types/vault/utils/field-to-attrs.d.ts
+++ b/ui/types/vault/utils/field-to-attrs.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/types/vault/utils/parse-pki-cert.d.ts b/ui/types/vault/utils/parse-pki-cert.d.ts
index 27439f9b4cc..a4958e02757 100644
--- a/ui/types/vault/utils/parse-pki-cert.d.ts
+++ b/ui/types/vault/utils/parse-pki-cert.d.ts
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) HashiCorp, Inc.
+ * Copyright IBM Corp. 2016, 2025
  * SPDX-License-Identifier: BUSL-1.1
  */
 
diff --git a/ui/vault-reporting/0.5.1.tgz b/ui/vault-reporting/0.5.1.tgz
new file mode 100644
index 00000000000..ff9050b0b75
Binary files /dev/null and b/ui/vault-reporting/0.5.1.tgz differ
diff --git a/ui/vault-reporting/0.8.0.tgz b/ui/vault-reporting/0.8.0.tgz
new file mode 100644
index 00000000000..e5e223836d8
Binary files /dev/null and b/ui/vault-reporting/0.8.0.tgz differ
diff --git a/ui/vendor/.gitkeep b/ui/vendor/.gitkeep
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/ui/vendor/string-includes.js b/ui/vendor/string-includes.js
deleted file mode 100644
index 3f8211025c6..00000000000
--- a/ui/vendor/string-includes.js
+++ /dev/null
@@ -1,21 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-// By Mozilla Contributors licensed under CC-BY-SA 2.5 (http://creativecommons.org/licenses/by-sa/2.5/)
-// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes#Polyfill
-if (!String.prototype.includes) {
-  String.prototype.includes = function(search, start) {
-    'use strict';
-    if (typeof start !== 'number') {
-      start = 0;
-    }
-
-    if (start + search.length > this.length) {
-      return false;
-    } else {
-      return this.indexOf(search, start) !== -1;
-    }
-  };
-}
diff --git a/ui/webpack.jsondiffpatch.config.js b/ui/webpack.jsondiffpatch.config.js
new file mode 100644
index 00000000000..01df308ce57
--- /dev/null
+++ b/ui/webpack.jsondiffpatch.config.js
@@ -0,0 +1,24 @@
+/**
+ * Copyright IBM Corp. 2016, 2025
+ * SPDX-License-Identifier: BUSL-1.1
+ */
+
+/* eslint-env node */
+'use strict';
+
+const path = require('path');
+
+module.exports = {
+  entry: {
+    jsondiffpatch: require.resolve('jsondiffpatch'),
+    htmlformatter: require.resolve('jsondiffpatch/formatters/html'),
+  },
+  output: {
+    path: path.resolve(__dirname, 'vendor'),
+    filename: '[name].umd.js',
+    library: '[name]',
+    libraryTarget: 'umd',
+    globalObject: 'this',
+  },
+  mode: 'production',
+};
diff --git a/ui/yarn.lock b/ui/yarn.lock
index 5b0f0e4dd61..806a8ebdf0b 100644
--- a/ui/yarn.lock
+++ b/ui/yarn.lock
@@ -5,9869 +5,5270 @@ __metadata:
   version: 6
   cacheKey: 8
 
-"@aashutoshrathi/word-wrap@npm:^1.2.3":
-  version: 1.2.6
-  resolution: "@aashutoshrathi/word-wrap@npm:1.2.6"
-  checksum: ada901b9e7c680d190f1d012c84217ce0063d8f5c5a7725bb91ec3c5ed99bb7572680eb2d2938a531ccbaec39a95422fcd8a6b4a13110c7d98dd75402f66a0cd
+"@ampproject/remapping@npm:^2.2.0":
+  version: 2.3.0
+  resolution: "@ampproject/remapping@npm:2.3.0"
+  dependencies:
+    "@jridgewell/gen-mapping": ^0.3.5
+    "@jridgewell/trace-mapping": ^0.3.24
+  checksum: d3ad7b89d973df059c4e8e6d7c972cbeb1bb2f18f002a3bd04ae0707da214cb06cc06929b65aa2313b9347463df2914772298bae8b1d7973f246bb3f2ab3e8f0
   languageName: node
   linkType: hard
 
-"@ampproject/remapping@npm:^2.1.0":
-  version: 2.1.2
-  resolution: "@ampproject/remapping@npm:2.1.2"
+"@babel/cli@npm:~7.27.0":
+  version: 7.27.2
+  resolution: "@babel/cli@npm:7.27.2"
   dependencies:
-    "@jridgewell/trace-mapping": ^0.3.0
-  checksum: e023f92cdd9723f3042cde3b4d922adfeef0e198aa73486b0b6c034ad36af5f96e5c0cc72b335b30b2eb9852d907efc92af6bfcd3f4b4d286177ee32a189cf92
+    "@jridgewell/trace-mapping": ^0.3.25
+    "@nicolo-ribaudo/chokidar-2": 2.1.8-no-fsevents.3
+    chokidar: ^3.6.0
+    commander: ^6.2.0
+    convert-source-map: ^2.0.0
+    fs-readdir-recursive: ^1.1.0
+    glob: ^7.2.0
+    make-dir: ^2.1.0
+    slash: ^2.0.0
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  dependenciesMeta:
+    "@nicolo-ribaudo/chokidar-2":
+      optional: true
+    chokidar:
+      optional: true
+  bin:
+    babel: ./bin/babel.js
+    babel-external-helpers: ./bin/babel-external-helpers.js
+  checksum: 4444abef9801e23b6161a22f0f9de867271021ec7f32fd4f9957dee7b9f427377a36783276ded5e831e611ee75804fd78b23df5c64053e845486514f9ff5911e
   languageName: node
   linkType: hard
 
-"@ampproject/remapping@npm:^2.2.0":
-  version: 2.2.1
-  resolution: "@ampproject/remapping@npm:2.2.1"
+"@babel/code-frame@npm:^7.0.0, @babel/code-frame@npm:^7.26.2, @babel/code-frame@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/code-frame@npm:7.27.1"
   dependencies:
-    "@jridgewell/gen-mapping": ^0.3.0
-    "@jridgewell/trace-mapping": ^0.3.9
-  checksum: 03c04fd526acc64a1f4df22651186f3e5ef0a9d6d6530ce4482ec9841269cf7a11dbb8af79237c282d721c5312024ff17529cd72cc4768c11e999b58e2302079
+    "@babel/helper-validator-identifier": ^7.27.1
+    js-tokens: ^4.0.0
+    picocolors: ^1.1.1
+  checksum: 5874edc5d37406c4a0bb14cf79c8e51ad412fb0423d176775ac14fc0259831be1bf95bdda9c2aa651126990505e09a9f0ed85deaa99893bc316d2682c5115bdc
   languageName: node
   linkType: hard
 
-"@babel/code-frame@npm:^7.0.0":
-  version: 7.12.13
-  resolution: "@babel/code-frame@npm:7.12.13"
-  dependencies:
-    "@babel/highlight": ^7.12.13
-  checksum: d0491bb59fb8d7a763cb175c5504818cfd3647321d8eedb9173336d5c47dccce248628ee68b3ed3586c5efc753d8d990ceafe956f707dcf92572a1661b92b1ef
+"@babel/compat-data@npm:^7.20.5, @babel/compat-data@npm:^7.22.6, @babel/compat-data@npm:^7.26.8, @babel/compat-data@npm:^7.27.2":
+  version: 7.27.2
+  resolution: "@babel/compat-data@npm:7.27.2"
+  checksum: 8d4066324e5f1275adc43f2e22110cac29ee09fe926260c43f0eaa432c148859367df4152574a28ee02dbb3e3d11dd57145eed345d49cc07f9b6e11fee06535f
   languageName: node
   linkType: hard
 
-"@babel/code-frame@npm:^7.12.13, @babel/code-frame@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/code-frame@npm:7.16.0"
+"@babel/core@npm:^7.0.0, @babel/core@npm:^7.12.0, @babel/core@npm:^7.13.10, @babel/core@npm:^7.16.10, @babel/core@npm:^7.16.7, @babel/core@npm:^7.22.20, @babel/core@npm:^7.23.2, @babel/core@npm:^7.23.6, @babel/core@npm:^7.24.0, @babel/core@npm:^7.25.2, @babel/core@npm:^7.26.0, @babel/core@npm:^7.3.4":
+  version: 7.27.1
+  resolution: "@babel/core@npm:7.27.1"
   dependencies:
-    "@babel/highlight": ^7.16.0
-  checksum: 8961d0302ec6b8c2e9751a11e06a17617425359fd1645e4dae56a90a03464c68a0916115100fbcd030961870313f21865d0b85858360a2c68aabdda744393607
+    "@ampproject/remapping": ^2.2.0
+    "@babel/code-frame": ^7.27.1
+    "@babel/generator": ^7.27.1
+    "@babel/helper-compilation-targets": ^7.27.1
+    "@babel/helper-module-transforms": ^7.27.1
+    "@babel/helpers": ^7.27.1
+    "@babel/parser": ^7.27.1
+    "@babel/template": ^7.27.1
+    "@babel/traverse": ^7.27.1
+    "@babel/types": ^7.27.1
+    convert-source-map: ^2.0.0
+    debug: ^4.1.0
+    gensync: ^1.0.0-beta.2
+    json5: ^2.2.3
+    semver: ^6.3.1
+  checksum: fce205f9eea387ed8a9c6de64e5a8f50256359bfc8f1352c576c843b4c148a6c2ef187cfe8d729453e520fdcc997f65920aca6cb8911fb25dfd2286966b9b914
   languageName: node
   linkType: hard
 
-"@babel/code-frame@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/code-frame@npm:7.16.7"
+"@babel/core@npm:~7.26.10":
+  version: 7.26.10
+  resolution: "@babel/core@npm:7.26.10"
   dependencies:
-    "@babel/highlight": ^7.16.7
-  checksum: db2f7faa31bc2c9cf63197b481b30ea57147a5fc1a6fab60e5d6c02cdfbf6de8e17b5121f99917b3dabb5eeb572da078312e70697415940383efc140d4e0808b
+    "@ampproject/remapping": ^2.2.0
+    "@babel/code-frame": ^7.26.2
+    "@babel/generator": ^7.26.10
+    "@babel/helper-compilation-targets": ^7.26.5
+    "@babel/helper-module-transforms": ^7.26.0
+    "@babel/helpers": ^7.26.10
+    "@babel/parser": ^7.26.10
+    "@babel/template": ^7.26.9
+    "@babel/traverse": ^7.26.10
+    "@babel/types": ^7.26.10
+    convert-source-map: ^2.0.0
+    debug: ^4.1.0
+    gensync: ^1.0.0-beta.2
+    json5: ^2.2.3
+    semver: ^6.3.1
+  checksum: 0217325bd46fb9c828331c14dbe3f015ee13d9aecec423ef5acc0ce8b51a3d2a2d55f2ede252b99d0ab9b2f1a06e2881694a890f92006aeac9ebe5be2914c089
   languageName: node
   linkType: hard
 
-"@babel/code-frame@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/code-frame@npm:7.18.6"
+"@babel/eslint-parser@npm:~7.27.0":
+  version: 7.27.1
+  resolution: "@babel/eslint-parser@npm:7.27.1"
   dependencies:
-    "@babel/highlight": ^7.18.6
-  checksum: 195e2be3172d7684bf95cff69ae3b7a15a9841ea9d27d3c843662d50cdd7d6470fd9c8e64be84d031117e4a4083486effba39f9aef6bbb2c89f7f21bcfba33ba
+    "@nicolo-ribaudo/eslint-scope-5-internals": 5.1.1-v1
+    eslint-visitor-keys: ^2.1.0
+    semver: ^6.3.1
+  peerDependencies:
+    "@babel/core": ^7.11.0
+    eslint: ^7.5.0 || ^8.0.0 || ^9.0.0
+  checksum: 0e8aa37fe03e5e5f2db35e1e628c02012a9ea9aa14429495eacdb0418e8ebeaf7b6308f9f8931ee3fe64a61fd6ac7637c8ffcc2c0d85eee246b6115198418bc2
   languageName: node
   linkType: hard
 
-"@babel/code-frame@npm:^7.22.13, @babel/code-frame@npm:^7.23.5":
-  version: 7.23.5
-  resolution: "@babel/code-frame@npm:7.23.5"
+"@babel/generator@npm:^7.26.10, @babel/generator@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/generator@npm:7.27.1"
   dependencies:
-    "@babel/highlight": ^7.23.4
-    chalk: ^2.4.2
-  checksum: d90981fdf56a2824a9b14d19a4c0e8db93633fd488c772624b4e83e0ceac6039a27cd298a247c3214faa952bf803ba23696172ae7e7235f3b97f43ba278c569a
+    "@babel/parser": ^7.27.1
+    "@babel/types": ^7.27.1
+    "@jridgewell/gen-mapping": ^0.3.5
+    "@jridgewell/trace-mapping": ^0.3.25
+    jsesc: ^3.0.2
+  checksum: d5e220eb20aca1d93aef85c4c716237f84c5aab7d3ed8dfeb7060dcd73d20c593a687fe74cfb6d3dc1604ef9faff2ca24e6cfdb1af18e03e3a5f9f63a04c0bdc
   languageName: node
   linkType: hard
 
-"@babel/code-frame@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/code-frame@npm:7.22.5"
+"@babel/helper-annotate-as-pure@npm:^7.18.6, @babel/helper-annotate-as-pure@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-annotate-as-pure@npm:7.27.1"
   dependencies:
-    "@babel/highlight": ^7.22.5
-  checksum: cfe804f518f53faaf9a1d3e0f9f74127ab9a004912c3a16fda07fb6a633393ecb9918a053cb71804204c1b7ec3d49e1699604715e2cfb0c9f7bc4933d324ebb6
+    "@babel/types": ^7.27.1
+  checksum: 3f8e4d591458d6c0621a3d670f8798b8895580214287390126e3e621ddf3df0bd07cbcc9500c2671b9ec10162c2f9feb1194da5cf039d40df8cb69d181fc0cd8
   languageName: node
   linkType: hard
 
-"@babel/compat-data@npm:^7.13.11, @babel/compat-data@npm:^7.13.8, @babel/compat-data@npm:^7.14.0, @babel/compat-data@npm:^7.16.0":
-  version: 7.16.4
-  resolution: "@babel/compat-data@npm:7.16.4"
-  checksum: 4949ce54eafc4b38d5623696a872acaaced1a523605708d81c2c483253941917d90dae0de40fc01e152ae56075dadd89c23014da5a632b09c001a716fa689cae
+"@babel/helper-compilation-targets@npm:^7.12.0, @babel/helper-compilation-targets@npm:^7.20.7, @babel/helper-compilation-targets@npm:^7.22.6, @babel/helper-compilation-targets@npm:^7.26.5, @babel/helper-compilation-targets@npm:^7.27.1, @babel/helper-compilation-targets@npm:^7.27.2":
+  version: 7.27.2
+  resolution: "@babel/helper-compilation-targets@npm:7.27.2"
+  dependencies:
+    "@babel/compat-data": ^7.27.2
+    "@babel/helper-validator-option": ^7.27.1
+    browserslist: ^4.24.0
+    lru-cache: ^5.1.1
+    semver: ^6.3.1
+  checksum: 7b95328237de85d7af1dea010a4daa28e79f961dda48b652860d5893ce9b136fc8b9ea1f126d8e0a24963b09ba5c6631dcb907b4ce109b04452d34a6ae979807
   languageName: node
   linkType: hard
 
-"@babel/compat-data@npm:^7.16.8, @babel/compat-data@npm:^7.17.0, @babel/compat-data@npm:^7.17.7":
-  version: 7.17.7
-  resolution: "@babel/compat-data@npm:7.17.7"
-  checksum: bf13476676884ce9afc199747ff82f3bcd6d42a9cfb01ce91bdb762b83ea11ec619b6ec532d1a80469ab14f191f33b5d4b9f8796fa8be3bc728d42b0c5e737e3
+"@babel/helper-create-class-features-plugin@npm:^7.18.6, @babel/helper-create-class-features-plugin@npm:^7.21.0, @babel/helper-create-class-features-plugin@npm:^7.25.9, @babel/helper-create-class-features-plugin@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-create-class-features-plugin@npm:7.27.1"
+  dependencies:
+    "@babel/helper-annotate-as-pure": ^7.27.1
+    "@babel/helper-member-expression-to-functions": ^7.27.1
+    "@babel/helper-optimise-call-expression": ^7.27.1
+    "@babel/helper-replace-supers": ^7.27.1
+    "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1
+    "@babel/traverse": ^7.27.1
+    semver: ^6.3.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 406954b455e5b20924e7d1b41cf932e6e98e95c3a5224c7a70c3ad96a84e8fbde915ceff7ddbf9c7d121397c4e9274f061241648475122cf6fe54e0a95caae15
   languageName: node
   linkType: hard
 
-"@babel/compat-data@npm:^7.17.10":
-  version: 7.17.10
-  resolution: "@babel/compat-data@npm:7.17.10"
-  checksum: e85051087cd4690de5061909a2dd2d7f8b6434a3c2e30be6c119758db2027ae1845bcd75a81127423dd568b706ac6994a1a3d7d701069a23bf5cfe900728290b
+"@babel/helper-create-regexp-features-plugin@npm:^7.18.6, @babel/helper-create-regexp-features-plugin@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-create-regexp-features-plugin@npm:7.27.1"
+  dependencies:
+    "@babel/helper-annotate-as-pure": ^7.27.1
+    regexpu-core: ^6.2.0
+    semver: ^6.3.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 2ede6bbad0016a9262fd281ce8f1a5d69e6179dcec4ea282830e924c29a29b66b0544ecb92e4ef4acdaf2c4c990931d7dc442dbcd6a8bcec4bad73923ef70934
   languageName: node
   linkType: hard
 
-"@babel/compat-data@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/compat-data@npm:7.19.0"
-  checksum: f90d25a3779578c230ad0632e12ffd5ee1033614dee2786f7f1567823a78923da7185638eedd7166f31e4771a3398ae6a28ab8e680b96cc25bafb38a3b66ff11
+"@babel/helper-define-polyfill-provider@npm:^0.6.3, @babel/helper-define-polyfill-provider@npm:^0.6.4":
+  version: 0.6.4
+  resolution: "@babel/helper-define-polyfill-provider@npm:0.6.4"
+  dependencies:
+    "@babel/helper-compilation-targets": ^7.22.6
+    "@babel/helper-plugin-utils": ^7.22.5
+    debug: ^4.1.1
+    lodash.debounce: ^4.0.8
+    resolve: ^1.14.2
+  peerDependencies:
+    "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0
+  checksum: bfbcb41f005ba11497b459cf801650af558b533f383b2f57034e9ccce592a0af699b585898deef93598ed3d9bd14502327e18dfc8a92a3db48b2a49ae2886f86
   languageName: node
   linkType: hard
 
-"@babel/compat-data@npm:^7.22.6, @babel/compat-data@npm:^7.23.3, @babel/compat-data@npm:^7.23.5":
-  version: 7.23.5
-  resolution: "@babel/compat-data@npm:7.23.5"
-  checksum: 06ce244cda5763295a0ea924728c09bae57d35713b675175227278896946f922a63edf803c322f855a3878323d48d0255a2a3023409d2a123483c8a69ebb4744
+"@babel/helper-member-expression-to-functions@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-member-expression-to-functions@npm:7.27.1"
+  dependencies:
+    "@babel/traverse": ^7.27.1
+    "@babel/types": ^7.27.1
+  checksum: b13a3d120015a6fd2f6e6c2ff789cd12498745ef028710cba612cfb751b91ace700c3f96c1689228d1dcb41e9d4cf83d6dff8627dcb0c8da12d79440e783c6b8
   languageName: node
   linkType: hard
 
-"@babel/compat-data@npm:^7.22.9":
-  version: 7.22.9
-  resolution: "@babel/compat-data@npm:7.22.9"
-  checksum: bed77d9044ce948b4327b30dd0de0779fa9f3a7ed1f2d31638714ed00229fa71fc4d1617ae0eb1fad419338d3658d0e9a5a083297451e09e73e078d0347ff808
+"@babel/helper-module-imports@npm:^7.16.7, @babel/helper-module-imports@npm:^7.22.15, @babel/helper-module-imports@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-module-imports@npm:7.27.1"
+  dependencies:
+    "@babel/traverse": ^7.27.1
+    "@babel/types": ^7.27.1
+  checksum: 92d01c71c0e4aacdc2babce418a9a1a27a8f7d770a210ffa0f3933f321befab18b655bc1241bebc40767516731de0b85639140c42e45a8210abe1e792f115b28
   languageName: node
   linkType: hard
 
-"@babel/core@npm:^7.0.0, @babel/core@npm:^7.12.0, @babel/core@npm:^7.3.4":
-  version: 7.16.0
-  resolution: "@babel/core@npm:7.16.0"
+"@babel/helper-module-transforms@npm:^7.26.0, @babel/helper-module-transforms@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-module-transforms@npm:7.27.1"
   dependencies:
-    "@babel/code-frame": ^7.16.0
-    "@babel/generator": ^7.16.0
-    "@babel/helper-compilation-targets": ^7.16.0
-    "@babel/helper-module-transforms": ^7.16.0
-    "@babel/helpers": ^7.16.0
-    "@babel/parser": ^7.16.0
-    "@babel/template": ^7.16.0
-    "@babel/traverse": ^7.16.0
-    "@babel/types": ^7.16.0
-    convert-source-map: ^1.7.0
-    debug: ^4.1.0
-    gensync: ^1.0.0-beta.2
-    json5: ^2.1.2
-    semver: ^6.3.0
-    source-map: ^0.5.0
-  checksum: a140f669daa90c774016a76b1f85641975333c1c219ae0a8e65d8b4c316836e918276e0dfd55613b14f8e578406a92393d4368a63bdd5d0708122976ee2ee8e3
+    "@babel/helper-module-imports": ^7.27.1
+    "@babel/helper-validator-identifier": ^7.27.1
+    "@babel/traverse": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 816dd166f0a850616d01ca198715d78fef052a834dc155dd57e4405d702f288071077be3ed58e13c86ac9e63ca560e876cc6d70cf5ef0f1f62bd9321084d4c06
   languageName: node
   linkType: hard
 
-"@babel/core@npm:^7.1.6, @babel/core@npm:^7.12.3":
-  version: 7.14.0
-  resolution: "@babel/core@npm:7.14.0"
+"@babel/helper-optimise-call-expression@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-optimise-call-expression@npm:7.27.1"
   dependencies:
-    "@babel/code-frame": ^7.12.13
-    "@babel/generator": ^7.14.0
-    "@babel/helper-compilation-targets": ^7.13.16
-    "@babel/helper-module-transforms": ^7.14.0
-    "@babel/helpers": ^7.14.0
-    "@babel/parser": ^7.14.0
-    "@babel/template": ^7.12.13
-    "@babel/traverse": ^7.14.0
-    "@babel/types": ^7.14.0
-    convert-source-map: ^1.7.0
-    debug: ^4.1.0
-    gensync: ^1.0.0-beta.2
-    json5: ^2.1.2
-    semver: ^6.3.0
-    source-map: ^0.5.0
-  checksum: de02309584587690b6f184d808027676b7d827a502c0ccbfc0939fd168230ec5084b727a7de437216f9f20273cf04860b902ecf5edcfabcf876b5ac108be26d1
-  languageName: node
-  linkType: hard
-
-"@babel/core@npm:^7.13.10":
-  version: 7.17.8
-  resolution: "@babel/core@npm:7.17.8"
-  dependencies:
-    "@ampproject/remapping": ^2.1.0
-    "@babel/code-frame": ^7.16.7
-    "@babel/generator": ^7.17.7
-    "@babel/helper-compilation-targets": ^7.17.7
-    "@babel/helper-module-transforms": ^7.17.7
-    "@babel/helpers": ^7.17.8
-    "@babel/parser": ^7.17.8
-    "@babel/template": ^7.16.7
-    "@babel/traverse": ^7.17.3
-    "@babel/types": ^7.17.0
-    convert-source-map: ^1.7.0
-    debug: ^4.1.0
-    gensync: ^1.0.0-beta.2
-    json5: ^2.1.2
-    semver: ^6.3.0
-  checksum: 0e686b1be444d25494424065238931f2b3df908bf072b72bab973acfd6d27a481fc280c9cd8a3c6fe2c46beee50e0d2307468d8b15b64dc4036f025e75f6609d
+    "@babel/types": ^7.27.1
+  checksum: 0fb7ee824a384529d6b74f8a58279f9b56bfe3cce332168067dddeab2552d8eeb56dc8eaf86c04a3a09166a316cb92dfc79c4c623cd034ad4c563952c98b464f
   languageName: node
   linkType: hard
 
-"@babel/core@npm:^7.16.10":
-  version: 7.19.0
-  resolution: "@babel/core@npm:7.19.0"
-  dependencies:
-    "@ampproject/remapping": ^2.1.0
-    "@babel/code-frame": ^7.18.6
-    "@babel/generator": ^7.19.0
-    "@babel/helper-compilation-targets": ^7.19.0
-    "@babel/helper-module-transforms": ^7.19.0
-    "@babel/helpers": ^7.19.0
-    "@babel/parser": ^7.19.0
-    "@babel/template": ^7.18.10
-    "@babel/traverse": ^7.19.0
-    "@babel/types": ^7.19.0
-    convert-source-map: ^1.7.0
-    debug: ^4.1.0
-    gensync: ^1.0.0-beta.2
-    json5: ^2.2.1
-    semver: ^6.3.0
-  checksum: 0d5b52b552e215802d2fd7b266611c390d90b28dece09db8a142666c32928c5d404eb72a95630b4cb726c4d80a53fcdc2d6464cd7ad28bb26087475f1b2205e2
+"@babel/helper-plugin-utils@npm:^7.0.0, @babel/helper-plugin-utils@npm:^7.12.13, @babel/helper-plugin-utils@npm:^7.14.5, @babel/helper-plugin-utils@npm:^7.18.6, @babel/helper-plugin-utils@npm:^7.20.2, @babel/helper-plugin-utils@npm:^7.22.5, @babel/helper-plugin-utils@npm:^7.25.9, @babel/helper-plugin-utils@npm:^7.26.5, @babel/helper-plugin-utils@npm:^7.27.1, @babel/helper-plugin-utils@npm:^7.8.0":
+  version: 7.27.1
+  resolution: "@babel/helper-plugin-utils@npm:7.27.1"
+  checksum: 5d715055301badab62bdb2336075a77f8dc8bd290cad2bc1b37ea3bf1b3efc40594d308082229f239deb4d6b5b80b0a73bce000e595ea74416e0339c11037047
   languageName: node
   linkType: hard
 
-"@babel/core@npm:^7.16.7":
-  version: 7.18.2
-  resolution: "@babel/core@npm:7.18.2"
+"@babel/helper-remap-async-to-generator@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-remap-async-to-generator@npm:7.27.1"
   dependencies:
-    "@ampproject/remapping": ^2.1.0
-    "@babel/code-frame": ^7.16.7
-    "@babel/generator": ^7.18.2
-    "@babel/helper-compilation-targets": ^7.18.2
-    "@babel/helper-module-transforms": ^7.18.0
-    "@babel/helpers": ^7.18.2
-    "@babel/parser": ^7.18.0
-    "@babel/template": ^7.16.7
-    "@babel/traverse": ^7.18.2
-    "@babel/types": ^7.18.2
-    convert-source-map: ^1.7.0
-    debug: ^4.1.0
-    gensync: ^1.0.0-beta.2
-    json5: ^2.2.1
-    semver: ^6.3.0
-  checksum: 14a4142c12e004cd2477b7610408d5788ee5dd821ee9e4de204cbb72d9c399d858d9deabc3d49914d5d7c2927548160c19bdc7524b1a9f6acc1ec96a8d9848dd
+    "@babel/helper-annotate-as-pure": ^7.27.1
+    "@babel/helper-wrap-function": ^7.27.1
+    "@babel/traverse": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 0747397ba013f87dbf575454a76c18210d61c7c9af0f697546b4bcac670b54ddc156330234407b397f0c948738c304c228e0223039bc45eab4fbf46966a5e8cc
   languageName: node
   linkType: hard
 
-"@babel/core@npm:^7.21.0":
-  version: 7.22.9
-  resolution: "@babel/core@npm:7.22.9"
+"@babel/helper-replace-supers@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-replace-supers@npm:7.27.1"
   dependencies:
-    "@ampproject/remapping": ^2.2.0
-    "@babel/code-frame": ^7.22.5
-    "@babel/generator": ^7.22.9
-    "@babel/helper-compilation-targets": ^7.22.9
-    "@babel/helper-module-transforms": ^7.22.9
-    "@babel/helpers": ^7.22.6
-    "@babel/parser": ^7.22.7
-    "@babel/template": ^7.22.5
-    "@babel/traverse": ^7.22.8
-    "@babel/types": ^7.22.5
-    convert-source-map: ^1.7.0
-    debug: ^4.1.0
-    gensync: ^1.0.0-beta.2
-    json5: ^2.2.2
-    semver: ^6.3.1
-  checksum: 7bf069aeceb417902c4efdaefab1f7b94adb7dea694a9aed1bda2edf4135348a080820529b1a300c6f8605740a00ca00c19b2d5e74b5dd489d99d8c11d5e56d1
+    "@babel/helper-member-expression-to-functions": ^7.27.1
+    "@babel/helper-optimise-call-expression": ^7.27.1
+    "@babel/traverse": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 3690266c304f21008690ba68062f889a363583cabc13c3d033b94513953147af3e0a3fdb48fa1bb9fa3734b64e221fc65e5222ab70837f02321b7225f487c6ef
   languageName: node
   linkType: hard
 
-"@babel/core@npm:^7.21.4, @babel/core@npm:^7.23.6":
-  version: 7.23.7
-  resolution: "@babel/core@npm:7.23.7"
+"@babel/helper-skip-transparent-expression-wrappers@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-skip-transparent-expression-wrappers@npm:7.27.1"
   dependencies:
-    "@ampproject/remapping": ^2.2.0
-    "@babel/code-frame": ^7.23.5
-    "@babel/generator": ^7.23.6
-    "@babel/helper-compilation-targets": ^7.23.6
-    "@babel/helper-module-transforms": ^7.23.3
-    "@babel/helpers": ^7.23.7
-    "@babel/parser": ^7.23.6
-    "@babel/template": ^7.22.15
-    "@babel/traverse": ^7.23.7
-    "@babel/types": ^7.23.6
-    convert-source-map: ^2.0.0
-    debug: ^4.1.0
-    gensync: ^1.0.0-beta.2
-    json5: ^2.2.3
-    semver: ^6.3.1
-  checksum: 32d5bf73372a47429afaae9adb0af39e47bcea6a831c4b5dcbb4791380cda6949cb8cb1a2fea8b60bb1ebe189209c80e333903df1fa8e9dcb04798c0ce5bf59e
+    "@babel/traverse": ^7.27.1
+    "@babel/types": ^7.27.1
+  checksum: 4f380c5d0e0769fa6942a468b0c2d7c8f0c438f941aaa88f785f8752c103631d0904c7b4e76207a3b0e6588b2dec376595370d92ca8f8f1b422c14a69aa146d4
   languageName: node
   linkType: hard
 
-"@babel/eslint-parser@npm:^7.21.3":
-  version: 7.22.9
-  resolution: "@babel/eslint-parser@npm:7.22.9"
-  dependencies:
-    "@nicolo-ribaudo/eslint-scope-5-internals": 5.1.1-v1
-    eslint-visitor-keys: ^2.1.0
-    semver: ^6.3.1
-  peerDependencies:
-    "@babel/core": ">=7.11.0"
-    eslint: ^7.5.0 || ^8.0.0
-  checksum: 4f417796c803056aad2c8fa69b8a7a78a1fdacc307d95702f22894cab42b83554e47de7d0b3cfbee667f25014bca0179f859aa86ceb684b09803192e1200b48d
+"@babel/helper-string-parser@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-string-parser@npm:7.27.1"
+  checksum: 0a8464adc4b39b138aedcb443b09f4005d86207d7126e5e079177e05c3116107d856ec08282b365e9a79a9872f40f4092a6127f8d74c8a01c1ef789dacfc25d6
   languageName: node
   linkType: hard
 
-"@babel/generator@npm:^7.14.0, @babel/generator@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/generator@npm:7.16.0"
-  dependencies:
-    "@babel/types": ^7.16.0
-    jsesc: ^2.5.1
-    source-map: ^0.5.0
-  checksum: 9ff53e0db72a225c8783c4a277698b4efcead750542ebb9cff31732ba62d092090715a772df10a323446924712f6928ad60c03db4e7051bed3a9701b552d51fb
+"@babel/helper-validator-identifier@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-validator-identifier@npm:7.27.1"
+  checksum: 3c7e8391e59d6c85baeefe9afb86432f2ab821c6232b00ea9082a51d3e7e95a2f3fb083d74dc1f49ac82cf238e1d2295dafcb001f7b0fab479f3f56af5eaaa47
   languageName: node
   linkType: hard
 
-"@babel/generator@npm:^7.17.3, @babel/generator@npm:^7.17.7":
-  version: 7.17.7
-  resolution: "@babel/generator@npm:7.17.7"
-  dependencies:
-    "@babel/types": ^7.17.0
-    jsesc: ^2.5.1
-    source-map: ^0.5.0
-  checksum: e7344b9b4559115f2754ecc2ae9508412ea6a8f617544cd3d3f17cabc727bd30630765f96c8a4ebc8901ded1492a3a6c23d695a4f1e8f3042f860b30c891985c
+"@babel/helper-validator-option@npm:^7.25.9, @babel/helper-validator-option@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-validator-option@npm:7.27.1"
+  checksum: db73e6a308092531c629ee5de7f0d04390835b21a263be2644276cb27da2384b64676cab9f22cd8d8dbd854c92b1d7d56fc8517cf0070c35d1c14a8c828b0903
   languageName: node
   linkType: hard
 
-"@babel/generator@npm:^7.18.2":
-  version: 7.18.2
-  resolution: "@babel/generator@npm:7.18.2"
+"@babel/helper-wrap-function@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helper-wrap-function@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.18.2
-    "@jridgewell/gen-mapping": ^0.3.0
-    jsesc: ^2.5.1
-  checksum: d0661e95532ddd97566d41fec26355a7b28d1cbc4df95fe80cc084c413342935911b48db20910708db39714844ddd614f61c2ec4cca3fb10181418bdcaa2e7a3
+    "@babel/template": ^7.27.1
+    "@babel/traverse": ^7.27.1
+    "@babel/types": ^7.27.1
+  checksum: b0427765766494cb5455a188d4cdef5e6167f2835a8ed76f3c25fa3bbe2ec2a716588fa326c52fab0d184a9537200d76e48656e516580a914129d74528322821
   languageName: node
   linkType: hard
 
-"@babel/generator@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/generator@npm:7.19.0"
+"@babel/helpers@npm:^7.26.10, @babel/helpers@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/helpers@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.19.0
-    "@jridgewell/gen-mapping": ^0.3.2
-    jsesc: ^2.5.1
-  checksum: aa3d5785cf8f8e81672dcc61aef351188efeadb20d9f66d79113d82cbcf3bbbdeb829989fa14582108572ddbc4e4027bdceb06ccaf5ec40fa93c2dda8fbcd4aa
+    "@babel/template": ^7.27.1
+    "@babel/types": ^7.27.1
+  checksum: 19ede1e996cbd295fb3a881ff70bc0f91c5133ebac256441e9ecd69dfba89456e75cf7ecf06cd276c638a4de7bd6eff21151961c78038d0b23d94b4d23415ee4
   languageName: node
   linkType: hard
 
-"@babel/generator@npm:^7.22.7, @babel/generator@npm:^7.22.9":
-  version: 7.22.9
-  resolution: "@babel/generator@npm:7.22.9"
+"@babel/parser@npm:^7.20.15, @babel/parser@npm:^7.26.10, @babel/parser@npm:^7.27.1, @babel/parser@npm:^7.27.2, @babel/parser@npm:^7.4.5":
+  version: 7.27.2
+  resolution: "@babel/parser@npm:7.27.2"
   dependencies:
-    "@babel/types": ^7.22.5
-    "@jridgewell/gen-mapping": ^0.3.2
-    "@jridgewell/trace-mapping": ^0.3.17
-    jsesc: ^2.5.1
-  checksum: 7c9d2c58b8d5ac5e047421a6ab03ec2ff5d9a5ff2c2212130a0055e063ac349e0b19d435537d6886c999771aef394832e4f54cd9fc810100a7f23d982f6af06b
+    "@babel/types": ^7.27.1
+  bin:
+    parser: ./bin/babel-parser.js
+  checksum: 1ac70a75028f1cc10eefb10ed2d83cf700ca3e1ddb4cf556a003fc5c4ca53ae83350bbb8065020fcc70d476fcf7bf1c17191b72384f719614ae18397142289cf
   languageName: node
   linkType: hard
 
-"@babel/generator@npm:^7.23.6":
-  version: 7.23.6
-  resolution: "@babel/generator@npm:7.23.6"
+"@babel/plugin-bugfix-firefox-class-in-computed-class-key@npm:^7.25.9, @babel/plugin-bugfix-firefox-class-in-computed-class-key@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-bugfix-firefox-class-in-computed-class-key@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.23.6
-    "@jridgewell/gen-mapping": ^0.3.2
-    "@jridgewell/trace-mapping": ^0.3.17
-    jsesc: ^2.5.1
-  checksum: 1a1a1c4eac210f174cd108d479464d053930a812798e09fee069377de39a893422df5b5b146199ead7239ae6d3a04697b45fc9ac6e38e0f6b76374390f91fc6c
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/traverse": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 72f24b9487e445fa61cf8be552aad394a648c2bb445c38d39d1df003186d9685b87dd8d388c950f438ea0ca44c82099d9c49252fb681c719cc72edf02bbe0304
   languageName: node
   linkType: hard
 
-"@babel/helper-annotate-as-pure@npm:^7.12.13, @babel/helper-annotate-as-pure@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-annotate-as-pure@npm:7.16.0"
+"@babel/plugin-bugfix-safari-class-field-initializer-scope@npm:^7.25.9, @babel/plugin-bugfix-safari-class-field-initializer-scope@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-bugfix-safari-class-field-initializer-scope@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.0
-  checksum: 0db76106983e10ffc482c5f01e89c3b4687d2474bea69c44470b2acb6bd37f362f9057d6e69c617255390b5d0063d9932a931e83c3e130445b688ca1fcdb5bcd
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: eb7f4146dc01f1198ce559a90b077e58b951a07521ec414e3c7d4593bf6c4ab5c2af22242a7e9fec085e20299e0ba6ea97f44a45e84ab148141bf9eb959ad25e
   languageName: node
   linkType: hard
 
-"@babel/helper-annotate-as-pure@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-annotate-as-pure@npm:7.16.7"
+"@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:^7.25.9, @babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.7
-  checksum: d235be963fed5d48a8a4cfabc41c3f03fad6a947810dbcab9cebed7f819811457e10d99b4b2e942ad71baa7ee8e3cd3f5f38a4e4685639ddfddb7528d9a07179
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 621cfddfcc99a81e74f8b6f9101fd260b27500cb1a568e3ceae9cc8afe9aee45ac3bca3900a2b66c612b1a2366d29ef67d4df5a1c975be727eaad6906f98c2c6
   languageName: node
   linkType: hard
 
-"@babel/helper-annotate-as-pure@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/helper-annotate-as-pure@npm:7.18.6"
+"@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:^7.25.9, @babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.18.6
-  checksum: 88ccd15ced475ef2243fdd3b2916a29ea54c5db3cd0cfabf9d1d29ff6e63b7f7cd1c27264137d7a40ac2e978b9b9a542c332e78f40eb72abe737a7400788fc1b
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1
+    "@babel/plugin-transform-optional-chaining": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.13.0
+  checksum: f07aa80272bd7a46b7ba11a4644da6c9b6a5a64e848dfaffdad6f02663adefd512e1aaebe664c4dd95f7ed4f80c872c7f8db8d8e34b47aae0930b412a28711a0
   languageName: node
   linkType: hard
 
-"@babel/helper-annotate-as-pure@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-annotate-as-pure@npm:7.22.5"
+"@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@npm:^7.25.9, @babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.22.5
-  checksum: 53da330f1835c46f26b7bf4da31f7a496dee9fd8696cca12366b94ba19d97421ce519a74a837f687749318f94d1a37f8d1abcbf35e8ed22c32d16373b2f6198d
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/traverse": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 4d6792ccade2d6b9d5577b0a879ab22d05ac8a1206b1a636b6ffdb53a0c0bacaf0f7947e46de254f228ffd75456f4b95ccd82fdeaefc0b92d88af3c5991863ad
   languageName: node
   linkType: hard
 
-"@babel/helper-builder-binary-assignment-operator-visitor@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-builder-binary-assignment-operator-visitor@npm:7.16.0"
+"@babel/plugin-proposal-class-properties@npm:^7.16.5, @babel/plugin-proposal-class-properties@npm:^7.16.7, @babel/plugin-proposal-class-properties@npm:~7.18.6":
+  version: 7.18.6
+  resolution: "@babel/plugin-proposal-class-properties@npm:7.18.6"
   dependencies:
-    "@babel/helper-explode-assignable-expression": ^7.16.0
-    "@babel/types": ^7.16.0
-  checksum: 01beb9f3f2285b7b170cc167ec79b2fd657202cb25be9cb111951f94a04c97c5b446dd1498ede32f0052d67fc9f2f2ac2b7862351b364fe94f9b4de98488d863
+    "@babel/helper-create-class-features-plugin": ^7.18.6
+    "@babel/helper-plugin-utils": ^7.18.6
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 49a78a2773ec0db56e915d9797e44fd079ab8a9b2e1716e0df07c92532f2c65d76aeda9543883916b8e0ff13606afeffa67c5b93d05b607bc87653ad18a91422
   languageName: node
   linkType: hard
 
-"@babel/helper-builder-binary-assignment-operator-visitor@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-builder-binary-assignment-operator-visitor@npm:7.16.7"
+"@babel/plugin-proposal-decorators@npm:^7.13.5, @babel/plugin-proposal-decorators@npm:^7.16.7, @babel/plugin-proposal-decorators@npm:^7.20.13":
+  version: 7.27.1
+  resolution: "@babel/plugin-proposal-decorators@npm:7.27.1"
   dependencies:
-    "@babel/helper-explode-assignable-expression": ^7.16.7
-    "@babel/types": ^7.16.7
-  checksum: 1784f19a57ecfafca8e5c2e0f3eac53451cb13a857cbe0ca0cd9670922228d099ef8c3dd8cd318e2d7bce316fdb2ece3e527c30f3ecd83706e37ab6beb0c60eb
+    "@babel/helper-create-class-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/plugin-syntax-decorators": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 2dd1694ab94165b9b06d03354baf724b4b25b152c28e2aac251f703ab1c310ac8161b8786d4f8ad888417b48f8e009593b9f75b85ac8ef6c59fa18742937b7dd
   languageName: node
   linkType: hard
 
-"@babel/helper-builder-binary-assignment-operator-visitor@npm:^7.22.15":
-  version: 7.22.15
-  resolution: "@babel/helper-builder-binary-assignment-operator-visitor@npm:7.22.15"
+"@babel/plugin-proposal-decorators@npm:~7.25.9":
+  version: 7.25.9
+  resolution: "@babel/plugin-proposal-decorators@npm:7.25.9"
   dependencies:
-    "@babel/types": ^7.22.15
-  checksum: 639c697a1c729f9fafa2dd4c9af2e18568190299b5907bd4c2d0bc818fcbd1e83ffeecc2af24327a7faa7ac4c34edd9d7940510a5e66296c19bad17001cf5c7a
+    "@babel/helper-create-class-features-plugin": ^7.25.9
+    "@babel/helper-plugin-utils": ^7.25.9
+    "@babel/plugin-syntax-decorators": ^7.25.9
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: ff598127818ac8e704009f1a9a207766ada5f84f6ca74e9de662cb6ce32bcb846c28fd52d6c5df9c55b4eac9a2a3492aa71fbd5cef0569a14b6f12003df22af2
   languageName: node
   linkType: hard
 
-"@babel/helper-compilation-targets@npm:^7.12.0, @babel/helper-compilation-targets@npm:^7.13.0, @babel/helper-compilation-targets@npm:^7.13.16, @babel/helper-compilation-targets@npm:^7.13.8, @babel/helper-compilation-targets@npm:^7.16.0":
-  version: 7.16.3
-  resolution: "@babel/helper-compilation-targets@npm:7.16.3"
+"@babel/plugin-proposal-object-rest-spread@npm:~7.20.7":
+  version: 7.20.7
+  resolution: "@babel/plugin-proposal-object-rest-spread@npm:7.20.7"
   dependencies:
-    "@babel/compat-data": ^7.16.0
-    "@babel/helper-validator-option": ^7.14.5
-    browserslist: ^4.17.5
-    semver: ^6.3.0
+    "@babel/compat-data": ^7.20.5
+    "@babel/helper-compilation-targets": ^7.20.7
+    "@babel/helper-plugin-utils": ^7.20.2
+    "@babel/plugin-syntax-object-rest-spread": ^7.8.3
+    "@babel/plugin-transform-parameters": ^7.20.7
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 038bcd43ac914371c51bf6e72b5cedcae432f0d359285d74a9133c6a839bd625a7d5412d7471d50aa78a3e1c79b0a692b50a8d6a1299ebf69733b512ff199323
+    "@babel/core": ^7.0.0-0
+  checksum: 1329db17009964bc644484c660eab717cb3ca63ac0ab0f67c651a028d1bc2ead51dc4064caea283e46994f1b7221670a35cbc0b4beb6273f55e915494b5aa0b2
   languageName: node
   linkType: hard
 
-"@babel/helper-compilation-targets@npm:^7.16.7, @babel/helper-compilation-targets@npm:^7.17.7":
-  version: 7.17.7
-  resolution: "@babel/helper-compilation-targets@npm:7.17.7"
+"@babel/plugin-proposal-private-methods@npm:^7.16.5, @babel/plugin-proposal-private-methods@npm:^7.16.7":
+  version: 7.18.6
+  resolution: "@babel/plugin-proposal-private-methods@npm:7.18.6"
   dependencies:
-    "@babel/compat-data": ^7.17.7
-    "@babel/helper-validator-option": ^7.16.7
-    browserslist: ^4.17.5
-    semver: ^6.3.0
+    "@babel/helper-create-class-features-plugin": ^7.18.6
+    "@babel/helper-plugin-utils": ^7.18.6
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 24bf851539d5ec8e73779304b5d1ad5b0be09a74459ecc7d9baee9a0fa38ad016e9eaf4b5704504ae8da32f91ce0e31857bbbd9686854caeffd38f58226d3760
+    "@babel/core": ^7.0.0-0
+  checksum: 22d8502ee96bca99ad2c8393e8493e2b8d4507576dd054490fd8201a36824373440106f5b098b6d821b026c7e72b0424ff4aeca69ed5f42e48f029d3a156d5ad
   languageName: node
   linkType: hard
 
-"@babel/helper-compilation-targets@npm:^7.17.10, @babel/helper-compilation-targets@npm:^7.18.2":
-  version: 7.18.2
-  resolution: "@babel/helper-compilation-targets@npm:7.18.2"
-  dependencies:
-    "@babel/compat-data": ^7.17.10
-    "@babel/helper-validator-option": ^7.16.7
-    browserslist: ^4.20.2
-    semver: ^6.3.0
+"@babel/plugin-proposal-private-property-in-object@npm:7.21.0-placeholder-for-preset-env.2":
+  version: 7.21.0-placeholder-for-preset-env.2
+  resolution: "@babel/plugin-proposal-private-property-in-object@npm:7.21.0-placeholder-for-preset-env.2"
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 4f02e79f20c0b3f8db5049ba8c35027c41ccb3fc7884835d04e49886538e0f55702959db1bb75213c94a5708fec2dc81a443047559a4f184abb884c72c0059b4
+    "@babel/core": ^7.0.0-0
+  checksum: d97745d098b835d55033ff3a7fb2b895b9c5295b08a5759e4f20df325aa385a3e0bc9bd5ad8f2ec554a44d4e6525acfc257b8c5848a1345cb40f26a30e277e91
   languageName: node
   linkType: hard
 
-"@babel/helper-compilation-targets@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/helper-compilation-targets@npm:7.19.0"
+"@babel/plugin-proposal-private-property-in-object@npm:^7.16.5, @babel/plugin-proposal-private-property-in-object@npm:^7.20.5":
+  version: 7.21.11
+  resolution: "@babel/plugin-proposal-private-property-in-object@npm:7.21.11"
   dependencies:
-    "@babel/compat-data": ^7.19.0
-    "@babel/helper-validator-option": ^7.18.6
-    browserslist: ^4.20.2
-    semver: ^6.3.0
+    "@babel/helper-annotate-as-pure": ^7.18.6
+    "@babel/helper-create-class-features-plugin": ^7.21.0
+    "@babel/helper-plugin-utils": ^7.20.2
+    "@babel/plugin-syntax-private-property-in-object": ^7.14.5
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 5f1be9811d53a5e43eb4b9b402517dec79bfa3a55e9fbc131a106914a78b435bc08a4b35591e424665c36c2c1eceb864ec2ca2c2f3dcf240a1551a28530428f9
+    "@babel/core": ^7.0.0-0
+  checksum: 1b880543bc5f525b360b53d97dd30807302bb82615cd42bf931968f59003cac75629563d6b104868db50abd22235b3271fdf679fea5db59a267181a99cc0c265
   languageName: node
   linkType: hard
 
-"@babel/helper-compilation-targets@npm:^7.20.7, @babel/helper-compilation-targets@npm:^7.22.15, @babel/helper-compilation-targets@npm:^7.22.6":
-  version: 7.22.15
-  resolution: "@babel/helper-compilation-targets@npm:7.22.15"
+"@babel/plugin-syntax-decorators@npm:^7.16.7, @babel/plugin-syntax-decorators@npm:^7.23.3, @babel/plugin-syntax-decorators@npm:^7.25.9, @babel/plugin-syntax-decorators@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-syntax-decorators@npm:7.27.1"
   dependencies:
-    "@babel/compat-data": ^7.22.9
-    "@babel/helper-validator-option": ^7.22.15
-    browserslist: ^4.21.9
-    lru-cache: ^5.1.1
-    semver: ^6.3.1
-  checksum: ce85196769e091ae54dd39e4a80c2a9df1793da8588e335c383d536d54f06baf648d0a08fc873044f226398c4ded15c4ae9120ee18e7dfd7c639a68e3cdc9980
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: c085b6083d9ce71f47563e05dddfff18a7611e376297b5a9eb35ef70e5919822f87bfba5b25276dfa55bdb6465943ba5d8d9a00f870611d63eaa1a148adc275e
   languageName: node
   linkType: hard
 
-"@babel/helper-compilation-targets@npm:^7.22.9":
-  version: 7.22.9
-  resolution: "@babel/helper-compilation-targets@npm:7.22.9"
+"@babel/plugin-syntax-import-assertions@npm:^7.26.0, @babel/plugin-syntax-import-assertions@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-syntax-import-assertions@npm:7.27.1"
   dependencies:
-    "@babel/compat-data": ^7.22.9
-    "@babel/helper-validator-option": ^7.22.5
-    browserslist: ^4.21.9
-    lru-cache: ^5.1.1
-    semver: ^6.3.1
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: ea0006c6a93759025f4a35a25228ae260538c9f15023e8aac2a6d45ca68aef4cf86cfc429b19af9a402cbdd54d5de74ad3fbcf6baa7e48184dc079f1a791e178
+    "@babel/core": ^7.0.0-0
+  checksum: fb661d630808d67ecb85eabad25aac4e9696a20464bad4c4a6a0d3d40e4dc22557d47e9be3d591ec06429cf048cfe169b8891c373606344d51c4f3ac0f91d6d0
   languageName: node
   linkType: hard
 
-"@babel/helper-compilation-targets@npm:^7.23.6":
-  version: 7.23.6
-  resolution: "@babel/helper-compilation-targets@npm:7.23.6"
+"@babel/plugin-syntax-import-attributes@npm:^7.26.0, @babel/plugin-syntax-import-attributes@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-syntax-import-attributes@npm:7.27.1"
   dependencies:
-    "@babel/compat-data": ^7.23.5
-    "@babel/helper-validator-option": ^7.23.5
-    browserslist: ^4.22.2
-    lru-cache: ^5.1.1
-    semver: ^6.3.1
-  checksum: c630b98d4527ac8fe2c58d9a06e785dfb2b73ec71b7c4f2ddf90f814b5f75b547f3c015f110a010fd31f76e3864daaf09f3adcd2f6acdbfb18a8de3a48717590
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 97973982fff1bbf86b3d1df13380567042887c50e2ae13a400d02a8ff2c9742a60a75e279bfb73019e1cd9710f04be5e6ab81f896e6678dcfcec8b135e8896cf
   languageName: node
   linkType: hard
 
-"@babel/helper-create-class-features-plugin@npm:^7.13.0, @babel/helper-create-class-features-plugin@npm:^7.16.0, @babel/helper-create-class-features-plugin@npm:^7.8.3":
-  version: 7.16.0
-  resolution: "@babel/helper-create-class-features-plugin@npm:7.16.0"
+"@babel/plugin-syntax-jsx@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-syntax-jsx@npm:7.27.1"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.0
-    "@babel/helper-function-name": ^7.16.0
-    "@babel/helper-member-expression-to-functions": ^7.16.0
-    "@babel/helper-optimise-call-expression": ^7.16.0
-    "@babel/helper-replace-supers": ^7.16.0
-    "@babel/helper-split-export-declaration": ^7.16.0
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 0f7d1b8d413e5fbd719c95e22e3b59749b4c6c652f20e0fa1fa954112145a134c22709f1325574632d7262aeeeaaf4fc7c2eb8117e0d521e42b36d05c3e5a885
+    "@babel/core": ^7.0.0-0
+  checksum: c6d1324cff286a369aa95d99b8abd21dd07821b5d3affd5fe7d6058c84cff9190743287826463ee57a7beecd10fa1e4bc99061df532ee14e188c1c8937b13e3a
   languageName: node
   linkType: hard
 
-"@babel/helper-create-class-features-plugin@npm:^7.16.10, @babel/helper-create-class-features-plugin@npm:^7.16.7, @babel/helper-create-class-features-plugin@npm:^7.17.6":
-  version: 7.17.6
-  resolution: "@babel/helper-create-class-features-plugin@npm:7.17.6"
+"@babel/plugin-syntax-object-rest-spread@npm:^7.8.3":
+  version: 7.8.3
+  resolution: "@babel/plugin-syntax-object-rest-spread@npm:7.8.3"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.7
-    "@babel/helper-environment-visitor": ^7.16.7
-    "@babel/helper-function-name": ^7.16.7
-    "@babel/helper-member-expression-to-functions": ^7.16.7
-    "@babel/helper-optimise-call-expression": ^7.16.7
-    "@babel/helper-replace-supers": ^7.16.7
-    "@babel/helper-split-export-declaration": ^7.16.7
+    "@babel/helper-plugin-utils": ^7.8.0
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: d85a5b3f9a18a661372d77462e6ea2a6a03f1083f8b3055ed165284214af9ea6ad677f6bcc4b5ce215da27f95fa93064580d4b6723b578c480ecf17dd31a4307
+    "@babel/core": ^7.0.0-0
+  checksum: fddcf581a57f77e80eb6b981b10658421bc321ba5f0a5b754118c6a92a5448f12a0c336f77b8abf734841e102e5126d69110a306eadb03ca3e1547cab31f5cbf
   languageName: node
   linkType: hard
 
-"@babel/helper-create-class-features-plugin@npm:^7.17.12, @babel/helper-create-class-features-plugin@npm:^7.18.0":
-  version: 7.18.0
-  resolution: "@babel/helper-create-class-features-plugin@npm:7.18.0"
+"@babel/plugin-syntax-private-property-in-object@npm:^7.14.5":
+  version: 7.14.5
+  resolution: "@babel/plugin-syntax-private-property-in-object@npm:7.14.5"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.7
-    "@babel/helper-environment-visitor": ^7.16.7
-    "@babel/helper-function-name": ^7.17.9
-    "@babel/helper-member-expression-to-functions": ^7.17.7
-    "@babel/helper-optimise-call-expression": ^7.16.7
-    "@babel/helper-replace-supers": ^7.16.7
-    "@babel/helper-split-export-declaration": ^7.16.7
+    "@babel/helper-plugin-utils": ^7.14.5
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 9a6ef175350f1cf87abe7a738e8c9b603da7fcdb153c74e49af509183f8705278020baddb62a12c7f9ca059487fef97d75a4adea6a1446598ad9901d010e4296
+    "@babel/core": ^7.0.0-0
+  checksum: b317174783e6e96029b743ccff2a67d63d38756876e7e5d0ba53a322e38d9ca452c13354a57de1ad476b4c066dbae699e0ca157441da611117a47af88985ecda
   languageName: node
   linkType: hard
 
-"@babel/helper-create-class-features-plugin@npm:^7.18.6, @babel/helper-create-class-features-plugin@npm:^7.21.0, @babel/helper-create-class-features-plugin@npm:^7.22.15, @babel/helper-create-class-features-plugin@npm:^7.23.5":
-  version: 7.23.5
-  resolution: "@babel/helper-create-class-features-plugin@npm:7.23.5"
+"@babel/plugin-syntax-typescript@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-syntax-typescript@npm:7.27.1"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.22.5
-    "@babel/helper-environment-visitor": ^7.22.20
-    "@babel/helper-function-name": ^7.23.0
-    "@babel/helper-member-expression-to-functions": ^7.23.0
-    "@babel/helper-optimise-call-expression": ^7.22.5
-    "@babel/helper-replace-supers": ^7.22.20
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.22.5
-    "@babel/helper-split-export-declaration": ^7.22.6
-    semver: ^6.3.1
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: fe7c6c0baca1838bba76ac1330df47b661d932354115ea9e2ea65b179f80b717987d3c3da7e1525fd648e5f2d86c620efc959cabda4d7562b125a27c3ac780d0
+    "@babel/core": ^7.0.0-0
+  checksum: 87836f7e32af624c2914c73cd6b9803cf324e07d43f61dbb973c6a86f75df725e12540d91fac7141c14b697aa9268fd064220998daced156e96ac3062d7afb41
   languageName: node
   linkType: hard
 
-"@babel/helper-create-class-features-plugin@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/helper-create-class-features-plugin@npm:7.19.0"
+"@babel/plugin-syntax-unicode-sets-regex@npm:^7.18.6":
+  version: 7.18.6
+  resolution: "@babel/plugin-syntax-unicode-sets-regex@npm:7.18.6"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.18.6
-    "@babel/helper-environment-visitor": ^7.18.9
-    "@babel/helper-function-name": ^7.19.0
-    "@babel/helper-member-expression-to-functions": ^7.18.9
-    "@babel/helper-optimise-call-expression": ^7.18.6
-    "@babel/helper-replace-supers": ^7.18.9
-    "@babel/helper-split-export-declaration": ^7.18.6
+    "@babel/helper-create-regexp-features-plugin": ^7.18.6
+    "@babel/helper-plugin-utils": ^7.18.6
   peerDependencies:
     "@babel/core": ^7.0.0
-  checksum: f0c6fb77b6f113d70f308e7093f60dd465b697818badf5df0519d8dd12b6bfb1f4ad300b923207ce9f9c1c940ef58bff12ac4270c0863eadf9e303b7dd6d01b6
+  checksum: a651d700fe63ff0ddfd7186f4ebc24447ca734f114433139e3c027bc94a900d013cf1ef2e2db8430425ba542e39ae160c3b05f06b59fd4656273a3df97679e9c
   languageName: node
   linkType: hard
 
-"@babel/helper-create-class-features-plugin@npm:^7.22.6":
-  version: 7.22.9
-  resolution: "@babel/helper-create-class-features-plugin@npm:7.22.9"
+"@babel/plugin-transform-arrow-functions@npm:^7.25.9, @babel/plugin-transform-arrow-functions@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-arrow-functions@npm:7.27.1"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.22.5
-    "@babel/helper-environment-visitor": ^7.22.5
-    "@babel/helper-function-name": ^7.22.5
-    "@babel/helper-member-expression-to-functions": ^7.22.5
-    "@babel/helper-optimise-call-expression": ^7.22.5
-    "@babel/helper-replace-supers": ^7.22.9
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.22.5
-    "@babel/helper-split-export-declaration": ^7.22.6
-    semver: ^6.3.1
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 6c2436d1a5a3f1ff24628d78fa8c6d3120c40285aa3eda7815b1adbf8c5951e0dd73d368cf845825888fa3dc2f207dadce53309825598d7c67953e5ed9dd51d2
+    "@babel/core": ^7.0.0-0
+  checksum: 62c2cc0ae2093336b1aa1376741c5ed245c0987d9e4b4c5313da4a38155509a7098b5acce582b6781cc0699381420010da2e3086353344abe0a6a0ec38961eb7
   languageName: node
   linkType: hard
 
-"@babel/helper-create-class-features-plugin@npm:^7.5.5":
-  version: 7.14.0
-  resolution: "@babel/helper-create-class-features-plugin@npm:7.14.0"
+"@babel/plugin-transform-async-generator-functions@npm:^7.26.8, @babel/plugin-transform-async-generator-functions@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-async-generator-functions@npm:7.27.1"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.12.13
-    "@babel/helper-function-name": ^7.12.13
-    "@babel/helper-member-expression-to-functions": ^7.13.12
-    "@babel/helper-optimise-call-expression": ^7.12.13
-    "@babel/helper-replace-supers": ^7.13.12
-    "@babel/helper-split-export-declaration": ^7.12.13
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-remap-async-to-generator": ^7.27.1
+    "@babel/traverse": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 8ef001212b06c4a1958249ec447f6a0993d928ace882cf509fcde8b4deb66673588a11ff53572b3ed55bf46982d012225ff8db9df65d0315af33d7ebfe21b740
+    "@babel/core": ^7.0.0-0
+  checksum: 37e8b76c992066f81cc24af11a25f296add6ae39f51f2c37da565fc004dbf3ef9733b42808acbfb86792d73f73bfbb4396338abbd364b9103146b119508b49c7
   languageName: node
   linkType: hard
 
-"@babel/helper-create-regexp-features-plugin@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-create-regexp-features-plugin@npm:7.16.0"
+"@babel/plugin-transform-async-to-generator@npm:^7.25.9, @babel/plugin-transform-async-to-generator@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-async-to-generator@npm:7.27.1"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.0
-    regexpu-core: ^4.7.1
+    "@babel/helper-module-imports": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-remap-async-to-generator": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: d6230477e1997ed1fa0aee9ab34d3ce96400e0df25101879fdaf90ea613adec68ec06a609d8c78787c02a6275ef5a7403a38aa8fd42fef1a4d27bcfe577c81d6
+    "@babel/core": ^7.0.0-0
+  checksum: d79d7a7ae7d416f6a48200017d027a6ba94c09c7617eea8b4e9c803630f00094c1a4fc32bf20ce3282567824ce3fcbda51653aac4003c71ea4e681b331338979
   languageName: node
   linkType: hard
 
-"@babel/helper-create-regexp-features-plugin@npm:^7.16.7":
-  version: 7.17.0
-  resolution: "@babel/helper-create-regexp-features-plugin@npm:7.17.0"
+"@babel/plugin-transform-block-scoped-functions@npm:^7.26.5, @babel/plugin-transform-block-scoped-functions@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-block-scoped-functions@npm:7.27.1"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.7
-    regexpu-core: ^5.0.1
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: eb66d9241544c705e9ce96d2d122b595ef52d926e6e031653e09af8a01050bd9d7e7fee168bf33a863342774d7d6a8cc7e8e9e5a45b955e9c01121c7a2d51708
+    "@babel/core": ^7.0.0-0
+  checksum: 7fb4988ca80cf1fc8345310d5edfe38e86b3a72a302675cdd09404d5064fe1d1fe1283ebe658ad2b71445ecef857bfb29a748064306b5f6c628e0084759c2201
   languageName: node
   linkType: hard
 
-"@babel/helper-create-regexp-features-plugin@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/helper-create-regexp-features-plugin@npm:7.17.12"
+"@babel/plugin-transform-block-scoping@npm:^7.25.9, @babel/plugin-transform-block-scoping@npm:^7.27.1, @babel/plugin-transform-block-scoping@npm:~7.27.0":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-block-scoping@npm:7.27.1"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.7
-    regexpu-core: ^5.0.1
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: fe49d26b0f6c58d4c1748a4d0e98b343882b428e6db43c4ba5e0aa7ff2296b3a557f0a88de9f000599bb95640a6c47c0b0c9a952b58c11f61aabb06bcc304329
+    "@babel/core": ^7.0.0-0
+  checksum: 490773ee111fd298d74bd0ba454c941ae23a39db5cd08bf4258997f44f7584399fc4214a7c3816ee70f0273c263fe2ea4e11bb07939e57845702ba05258a9cb0
   languageName: node
   linkType: hard
 
-"@babel/helper-create-regexp-features-plugin@npm:^7.18.6, @babel/helper-create-regexp-features-plugin@npm:^7.22.15, @babel/helper-create-regexp-features-plugin@npm:^7.22.5":
-  version: 7.22.15
-  resolution: "@babel/helper-create-regexp-features-plugin@npm:7.22.15"
+"@babel/plugin-transform-class-properties@npm:^7.25.9, @babel/plugin-transform-class-properties@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-class-properties@npm:7.27.1"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.22.5
-    regexpu-core: ^5.3.1
-    semver: ^6.3.1
+    "@babel/helper-create-class-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 0243b8d4854f1dc8861b1029a46d3f6393ad72f366a5a08e36a4648aa682044f06da4c6e87a456260e1e1b33c999f898ba591a0760842c1387bcc93fbf2151a6
+    "@babel/core": ^7.0.0-0
+  checksum: 475a6e5a9454912fe1bdc171941976ca10ea4e707675d671cdb5ce6b6761d84d1791ac61b6bca81a2e5f6430cb7b9d8e4b2392404110e69c28207a754e196294
   languageName: node
   linkType: hard
 
-"@babel/helper-define-polyfill-provider@npm:^0.2.2":
-  version: 0.2.3
-  resolution: "@babel/helper-define-polyfill-provider@npm:0.2.3"
+"@babel/plugin-transform-class-static-block@npm:^7.16.7, @babel/plugin-transform-class-static-block@npm:^7.22.11, @babel/plugin-transform-class-static-block@npm:^7.26.0, @babel/plugin-transform-class-static-block@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-class-static-block@npm:7.27.1"
   dependencies:
-    "@babel/helper-compilation-targets": ^7.13.0
-    "@babel/helper-module-imports": ^7.12.13
-    "@babel/helper-plugin-utils": ^7.13.0
-    "@babel/traverse": ^7.13.0
-    debug: ^4.1.1
-    lodash.debounce: ^4.0.8
-    resolve: ^1.14.2
-    semver: ^6.1.2
+    "@babel/helper-create-class-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.4.0-0
-  checksum: 797699fe870e45bdbc7c4128963427f7d6240609b700b3f2c0a2f2f187e5f848ba704bcfe58d7d91796cabc5001fae01746b3efda113beb5b5b824927cf59fdb
+    "@babel/core": ^7.12.0
+  checksum: 69688fe1641ae0ea025b916b8c2336e8b5643a5ec292e8f546ecd35d9d9d4bb301d738910822a79d867098cf687d550d92cd906ae4cda03c0f69b1ece2149a58
   languageName: node
   linkType: hard
 
-"@babel/helper-define-polyfill-provider@npm:^0.2.4":
-  version: 0.2.4
-  resolution: "@babel/helper-define-polyfill-provider@npm:0.2.4"
+"@babel/plugin-transform-classes@npm:^7.25.9, @babel/plugin-transform-classes@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-classes@npm:7.27.1"
   dependencies:
-    "@babel/helper-compilation-targets": ^7.13.0
-    "@babel/helper-module-imports": ^7.12.13
-    "@babel/helper-plugin-utils": ^7.13.0
-    "@babel/traverse": ^7.13.0
-    debug: ^4.1.1
-    lodash.debounce: ^4.0.8
-    resolve: ^1.14.2
-    semver: ^6.1.2
+    "@babel/helper-annotate-as-pure": ^7.27.1
+    "@babel/helper-compilation-targets": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-replace-supers": ^7.27.1
+    "@babel/traverse": ^7.27.1
+    globals: ^11.1.0
   peerDependencies:
-    "@babel/core": ^7.4.0-0
-  checksum: 0b81df2fe8d4e7af1f0ed0f9c83bdb0fc1978e2cb2d4b5421dad7ee4afda79044d61de5b06026164ef52ee1afa59a15ee99bc7e532ad2b8a4bbe4341d3fa6b05
+    "@babel/core": ^7.0.0-0
+  checksum: a4275d3a9e2e4144c421baa49958191e4b33957fca6e87686ed8da0eb3240270d4f91a2a4b9491c87feb6c33f459d8aec013cec8d5f5099c794b740703802dc7
   languageName: node
   linkType: hard
 
-"@babel/helper-define-polyfill-provider@npm:^0.3.0":
-  version: 0.3.0
-  resolution: "@babel/helper-define-polyfill-provider@npm:0.3.0"
+"@babel/plugin-transform-computed-properties@npm:^7.25.9, @babel/plugin-transform-computed-properties@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-computed-properties@npm:7.27.1"
   dependencies:
-    "@babel/helper-compilation-targets": ^7.13.0
-    "@babel/helper-module-imports": ^7.12.13
-    "@babel/helper-plugin-utils": ^7.13.0
-    "@babel/traverse": ^7.13.0
-    debug: ^4.1.1
-    lodash.debounce: ^4.0.8
-    resolve: ^1.14.2
-    semver: ^6.1.2
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/template": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.4.0-0
-  checksum: 372378ac4235c4fe135f1cd6d0f63697e7cb3ef63a884eb14f4b439984846bcaec0b7a32cf8df6756a21557ae3ebb3c2ee18d9a191260705a583333e5e60df7c
+    "@babel/core": ^7.0.0-0
+  checksum: 48bd20f7d631b08c51155751bf75b698d4a22cca36f41c22921ab92e53039c9ec5c3544e5282e18692325ef85d2e4a18c27e12c62b5e20c26fb0c92447e35224
   languageName: node
   linkType: hard
 
-"@babel/helper-define-polyfill-provider@npm:^0.3.1":
-  version: 0.3.1
-  resolution: "@babel/helper-define-polyfill-provider@npm:0.3.1"
+"@babel/plugin-transform-destructuring@npm:^7.25.9, @babel/plugin-transform-destructuring@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-destructuring@npm:7.27.1"
   dependencies:
-    "@babel/helper-compilation-targets": ^7.13.0
-    "@babel/helper-module-imports": ^7.12.13
-    "@babel/helper-plugin-utils": ^7.13.0
-    "@babel/traverse": ^7.13.0
-    debug: ^4.1.1
-    lodash.debounce: ^4.0.8
-    resolve: ^1.14.2
-    semver: ^6.1.2
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.4.0-0
-  checksum: e3e93cb22febfc0449a210cdafb278e5e1a038af2ca2b02f5dee71c7a49e8ba26e469d631ee11a4243885961a62bb2e5b0a4deb3ec1d7918a33c953d05c3e584
+    "@babel/core": ^7.0.0-0
+  checksum: 492013fc4befd5f3554853f983b82cfa748dd2004a525f1f16a37f841ac402a51e891cac2084b03e2b89553f0e1e685cf5bf8bf9df8fed82114c580b3c567bb6
   languageName: node
   linkType: hard
 
-"@babel/helper-define-polyfill-provider@npm:^0.4.3":
-  version: 0.4.3
-  resolution: "@babel/helper-define-polyfill-provider@npm:0.4.3"
+"@babel/plugin-transform-dotall-regex@npm:^7.25.9, @babel/plugin-transform-dotall-regex@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-dotall-regex@npm:7.27.1"
   dependencies:
-    "@babel/helper-compilation-targets": ^7.22.6
-    "@babel/helper-plugin-utils": ^7.22.5
-    debug: ^4.1.1
-    lodash.debounce: ^4.0.8
-    resolve: ^1.14.2
+    "@babel/helper-create-regexp-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0
-  checksum: 5d21e3f47b320e4b5b644195ec405e7ebc3739e48e65899efc808c5fa9c3bf5b06ce0d8ff5246ca99d1411e368f4557bc66730196c5781a5c4e986ee703bee79
+    "@babel/core": ^7.0.0-0
+  checksum: 2173e5b13f403538ffc6bd57b190cedf4caf320abc13a99e5b2721864e7148dbd3bd7c82d92377136af80432818f665fdd9a1fd33bc5549a4c91e24e5ce2413c
   languageName: node
   linkType: hard
 
-"@babel/helper-environment-visitor@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-environment-visitor@npm:7.16.7"
+"@babel/plugin-transform-duplicate-keys@npm:^7.25.9, @babel/plugin-transform-duplicate-keys@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-duplicate-keys@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.7
-  checksum: c03a10105d9ebd1fe632a77356b2e6e2f3c44edba9a93b0dc3591b6a66bd7a2e323dd9502f9ce96fc6401234abff1907aa877b6674f7826b61c953f7c8204bbe
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: ef2112d658338e3ff0827f39a53c0cfa211f1cbbe60363bca833a5269df389598ec965e7283600b46533c39cdca82307d0d69c0f518290ec5b00bb713044715b
   languageName: node
   linkType: hard
 
-"@babel/helper-environment-visitor@npm:^7.18.2":
-  version: 7.18.2
-  resolution: "@babel/helper-environment-visitor@npm:7.18.2"
-  checksum: 1a9c8726fad454a082d077952a90f17188e92eabb3de236cb4782c49b39e3f69c327e272b965e9a20ff8abf37d30d03ffa6fd7974625a6c23946f70f7527f5e9
+"@babel/plugin-transform-duplicate-named-capturing-groups-regex@npm:^7.25.9, @babel/plugin-transform-duplicate-named-capturing-groups-regex@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-duplicate-named-capturing-groups-regex@npm:7.27.1"
+  dependencies:
+    "@babel/helper-create-regexp-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 2a109613535e6ac79240dced71429e988affd6a5b3d0cd0f563c8d6c208c51ce7bf2c300bc1150502376b26a51f279119b3358f1c0f2d2f8abca3bcd62e1ae46
   languageName: node
   linkType: hard
 
-"@babel/helper-environment-visitor@npm:^7.18.9":
-  version: 7.18.9
-  resolution: "@babel/helper-environment-visitor@npm:7.18.9"
-  checksum: b25101f6162ddca2d12da73942c08ad203d7668e06663df685634a8fde54a98bc015f6f62938e8554457a592a024108d45b8f3e651fd6dcdb877275b73cc4420
+"@babel/plugin-transform-dynamic-import@npm:^7.25.9, @babel/plugin-transform-dynamic-import@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-dynamic-import@npm:7.27.1"
+  dependencies:
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 7a9fbc8d17148b7f11a1d1ca3990d2c2cd44bd08a45dcaf14f20a017721235b9044b20e6168b6940282bb1b48fb78e6afbdfb9dd9d82fde614e15baa7d579932
   languageName: node
   linkType: hard
 
-"@babel/helper-environment-visitor@npm:^7.22.20":
-  version: 7.22.20
-  resolution: "@babel/helper-environment-visitor@npm:7.22.20"
-  checksum: d80ee98ff66f41e233f36ca1921774c37e88a803b2f7dca3db7c057a5fea0473804db9fb6729e5dbfd07f4bed722d60f7852035c2c739382e84c335661590b69
+"@babel/plugin-transform-exponentiation-operator@npm:^7.26.3, @babel/plugin-transform-exponentiation-operator@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-exponentiation-operator@npm:7.27.1"
+  dependencies:
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 4ff4a0f30babc457a5ae8564deda209599627c2ce647284a0e8e66f65b44f6d968cf77761a4cc31b45b61693f0810479248c79e681681d8ccb39d0c52944c1fd
   languageName: node
   linkType: hard
 
-"@babel/helper-environment-visitor@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-environment-visitor@npm:7.22.5"
-  checksum: 248532077d732a34cd0844eb7b078ff917c3a8ec81a7f133593f71a860a582f05b60f818dc5049c2212e5baa12289c27889a4b81d56ef409b4863db49646c4b1
+"@babel/plugin-transform-export-namespace-from@npm:^7.25.9, @babel/plugin-transform-export-namespace-from@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-export-namespace-from@npm:7.27.1"
+  dependencies:
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 85082923eca317094f08f4953d8ea2a6558b3117826c0b740676983902b7236df1f4213ad844cb38c2dae104753dbe8f1cc51f01567835d476d32f5f544a4385
   languageName: node
   linkType: hard
 
-"@babel/helper-explode-assignable-expression@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-explode-assignable-expression@npm:7.16.0"
+"@babel/plugin-transform-for-of@npm:^7.26.9, @babel/plugin-transform-for-of@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-for-of@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.0
-  checksum: 563352b5e9b0b9584187176723ea65ea6ac9348d612c2bdc76701634eae445fd05d18f7b7555f5c6bbe4ec4d9d30172633a56bf4cfbb1333b798f58444057652
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: c9224e08de5d80b2c834383d4359aa9e519db434291711434dd996a4f86b7b664ad67b45d65459b7ec11fa582e3e11a3c769b8a8ca71594bdd4e2f0503f84126
   languageName: node
   linkType: hard
 
-"@babel/helper-explode-assignable-expression@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-explode-assignable-expression@npm:7.16.7"
+"@babel/plugin-transform-function-name@npm:^7.25.9, @babel/plugin-transform-function-name@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-function-name@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.7
-  checksum: ea2135ba36da6a2be059ebc8f10fbbb291eb0e312da54c55c6f50f9cbd8601e2406ec497c5e985f7c07a97f31b3bef9b2be8df53f1d53b974043eaf74fe54bbc
+    "@babel/helper-compilation-targets": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/traverse": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 26a2a183c3c52a96495967420a64afc5a09f743a230272a131668abf23001e393afa6371e6f8e6c60f4182bea210ed31d1caf866452d91009c1daac345a52f23
   languageName: node
   linkType: hard
 
-"@babel/helper-function-name@npm:^7.12.13, @babel/helper-function-name@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-function-name@npm:7.16.0"
+"@babel/plugin-transform-json-strings@npm:^7.25.9, @babel/plugin-transform-json-strings@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-json-strings@npm:7.27.1"
   dependencies:
-    "@babel/helper-get-function-arity": ^7.16.0
-    "@babel/template": ^7.16.0
-    "@babel/types": ^7.16.0
-  checksum: 8c02371d28678f3bb492e69d4635b2fe6b1c5a93ce129bf883f1fafde2005f4dbc0e643f52103ca558b698c0774bfb84a93f188d71db1c077f754b6220629b92
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 2c05a02f63b49f47069271b3405a66c3c8038de5b995b0700b1bd9a5e2bb3e67abd01e4604629302a521f4d8122a4233944aefa16559fd4373d256cc5d3da57f
   languageName: node
   linkType: hard
 
-"@babel/helper-function-name@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-function-name@npm:7.16.7"
+"@babel/plugin-transform-literals@npm:^7.25.9, @babel/plugin-transform-literals@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-literals@npm:7.27.1"
   dependencies:
-    "@babel/helper-get-function-arity": ^7.16.7
-    "@babel/template": ^7.16.7
-    "@babel/types": ^7.16.7
-  checksum: fc77cbe7b10cfa2a262d7a37dca575c037f20419dfe0c5d9317f589599ca24beb5f5c1057748011159149eaec47fe32338c6c6412376fcded68200df470161e1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 0a76d12ab19f32dd139964aea7da48cecdb7de0b75e207e576f0f700121fe92367d788f328bf4fb44b8261a0f605c97b44e62ae61cddbb67b14e94c88b411f95
   languageName: node
   linkType: hard
 
-"@babel/helper-function-name@npm:^7.17.9":
-  version: 7.17.9
-  resolution: "@babel/helper-function-name@npm:7.17.9"
+"@babel/plugin-transform-logical-assignment-operators@npm:^7.25.9, @babel/plugin-transform-logical-assignment-operators@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-logical-assignment-operators@npm:7.27.1"
   dependencies:
-    "@babel/template": ^7.16.7
-    "@babel/types": ^7.17.0
-  checksum: a59b2e5af56d8f43b9b0019939a43774754beb7cb01a211809ca8031c71890999d07739e955343135ec566c4d8ff725435f1f60fb0af3bb546837c1f9f84f496
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 2757955d81d65cc4701c17b83720745f6858f7a1d1d58117e379c204f47adbeb066b778596b6168bdbf4a22c229aab595d79a9abc261d0c6bfd62d4419466e73
   languageName: node
   linkType: hard
 
-"@babel/helper-function-name@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/helper-function-name@npm:7.19.0"
+"@babel/plugin-transform-member-expression-literals@npm:^7.25.9, @babel/plugin-transform-member-expression-literals@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-member-expression-literals@npm:7.27.1"
   dependencies:
-    "@babel/template": ^7.18.10
-    "@babel/types": ^7.19.0
-  checksum: eac1f5db428ba546270c2b8d750c24eb528b8fcfe50c81de2e0bdebf0e20f24bec688d4331533b782e4a907fad435244621ca2193cfcf80a86731299840e0f6e
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 804121430a6dcd431e6ffe99c6d1fbbc44b43478113b79c677629e7f877b4f78a06b69c6bfb2747fd84ee91879fe2eb32e4620b53124603086cf5b727593ebe8
   languageName: node
   linkType: hard
 
-"@babel/helper-function-name@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-function-name@npm:7.22.5"
+"@babel/plugin-transform-modules-amd@npm:^7.13.0, @babel/plugin-transform-modules-amd@npm:^7.20.11, @babel/plugin-transform-modules-amd@npm:^7.25.9, @babel/plugin-transform-modules-amd@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-modules-amd@npm:7.27.1"
   dependencies:
-    "@babel/template": ^7.22.5
-    "@babel/types": ^7.22.5
-  checksum: 6b1f6ce1b1f4e513bf2c8385a557ea0dd7fa37971b9002ad19268ca4384bbe90c09681fe4c076013f33deabc63a53b341ed91e792de741b4b35e01c00238177a
+    "@babel/helper-module-transforms": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 8bb36d448e438d5d30f4faf19120e8c18aa87730269e65d805bf6032824d175ed738057cc392c2c8a650028f1ae0f346cad8d6b723f31a037b586e2092a7be18
   languageName: node
   linkType: hard
 
-"@babel/helper-function-name@npm:^7.23.0":
-  version: 7.23.0
-  resolution: "@babel/helper-function-name@npm:7.23.0"
+"@babel/plugin-transform-modules-commonjs@npm:^7.26.3, @babel/plugin-transform-modules-commonjs@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-modules-commonjs@npm:7.27.1"
   dependencies:
-    "@babel/template": ^7.22.15
-    "@babel/types": ^7.23.0
-  checksum: e44542257b2d4634a1f979244eb2a4ad8e6d75eb6761b4cfceb56b562f7db150d134bc538c8e6adca3783e3bc31be949071527aa8e3aab7867d1ad2d84a26e10
+    "@babel/helper-module-transforms": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: bc45c1beff9b145c982bd6a614af338893d38bce18a9df7d658c9084e0d8114b286dcd0e015132ae7b15dd966153cb13321e4800df9766d0ddd892d22bf09d2a
   languageName: node
   linkType: hard
 
-"@babel/helper-get-function-arity@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-get-function-arity@npm:7.16.0"
+"@babel/plugin-transform-modules-systemjs@npm:^7.25.9, @babel/plugin-transform-modules-systemjs@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-modules-systemjs@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.0
-  checksum: 1a68322c7b5fdffb1b51df32f7a53b1ff2268b5b99d698f0a1a426dcb355482a44ef3dae982a507907ba975314638dabb6d77ac1778098bdbe99707e6c29cae8
+    "@babel/helper-module-transforms": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-validator-identifier": ^7.27.1
+    "@babel/traverse": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 7c17a8973676c18525d87f277944616596f1b154cc2b9263bfd78ecdbf5f4288ec46c7f58017321ca3e3d6dfeb96875467b95311a39719b475d42a157525d87f
   languageName: node
   linkType: hard
 
-"@babel/helper-get-function-arity@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-get-function-arity@npm:7.16.7"
+"@babel/plugin-transform-modules-umd@npm:^7.25.9, @babel/plugin-transform-modules-umd@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-modules-umd@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.7
-  checksum: 25d969fb207ff2ad5f57a90d118f6c42d56a0171022e200aaa919ba7dc95ae7f92ec71cdea6c63ef3629a0dc962ab4c78e09ca2b437185ab44539193f796e0c3
+    "@babel/helper-module-transforms": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: b007dd89231f2eeccf1c71a85629bcb692573303977a4b1c5f19a835ea6b5142c18ef07849bc6d752b874a11bc0ddf3c67468b77c8ee8310290b688a4f01ef31
   languageName: node
   linkType: hard
 
-"@babel/helper-hoist-variables@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-hoist-variables@npm:7.16.0"
+"@babel/plugin-transform-named-capturing-groups-regex@npm:^7.25.9, @babel/plugin-transform-named-capturing-groups-regex@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-named-capturing-groups-regex@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.0
-  checksum: 2ee5b400c267c209a53c90eea406a8f09c30d4d7a2b13e304289d858a2e34a99272c062cfad6dad63705662943951c42ff20042ef539b2d3c4f8743183a28954
+    "@babel/helper-create-regexp-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: a711c92d9753df26cefc1792481e5cbff4fe4f32b383d76b25e36fa865d8023b1b9aa6338cf18f5c0e864c71a7fbe8115e840872ccd61a914d9953849c68de7d
   languageName: node
   linkType: hard
 
-"@babel/helper-hoist-variables@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-hoist-variables@npm:7.16.7"
+"@babel/plugin-transform-new-target@npm:^7.25.9, @babel/plugin-transform-new-target@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-new-target@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.7
-  checksum: 6ae1641f4a751cd9045346e3f61c3d9ec1312fd779ab6d6fecfe2a96e59a481ad5d7e40d2a840894c13b3fd6114345b157f9e3062fc5f1580f284636e722de60
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 32c8078d843bda001244509442d68fd3af088d7348ba883f45c262b2c817a27ffc553b0d78e7f7a763271b2ece7fac56151baad7a91fb21f5bb1d2f38e5acad7
   languageName: node
   linkType: hard
 
-"@babel/helper-hoist-variables@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/helper-hoist-variables@npm:7.18.6"
+"@babel/plugin-transform-nullish-coalescing-operator@npm:^7.26.6, @babel/plugin-transform-nullish-coalescing-operator@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-nullish-coalescing-operator@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.18.6
-  checksum: fd9c35bb435fda802bf9ff7b6f2df06308a21277c6dec2120a35b09f9de68f68a33972e2c15505c1a1a04b36ec64c9ace97d4a9e26d6097b76b4396b7c5fa20f
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 1c6b3730748782d2178cc30f5cc37be7d7666148260f3f2dfc43999908bdd319bdfebaaf19cf04ac1f9dee0f7081093d3fa730cda5ae1b34bcd73ce406a78be7
   languageName: node
   linkType: hard
 
-"@babel/helper-hoist-variables@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-hoist-variables@npm:7.22.5"
+"@babel/plugin-transform-numeric-separator@npm:^7.25.9, @babel/plugin-transform-numeric-separator@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-numeric-separator@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.22.5
-  checksum: 394ca191b4ac908a76e7c50ab52102669efe3a1c277033e49467913c7ed6f7c64d7eacbeabf3bed39ea1f41731e22993f763b1edce0f74ff8563fd1f380d92cc
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 049b958911de86d32408cd78017940a207e49c054ae9534ab53a32a57122cc592c0aae3c166d6f29bd1a7d75cc779d71883582dd76cb28b2fbb493e842d8ffca
   languageName: node
   linkType: hard
 
-"@babel/helper-member-expression-to-functions@npm:^7.13.12, @babel/helper-member-expression-to-functions@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-member-expression-to-functions@npm:7.16.0"
+"@babel/plugin-transform-object-rest-spread@npm:^7.25.9, @babel/plugin-transform-object-rest-spread@npm:^7.27.2":
+  version: 7.27.2
+  resolution: "@babel/plugin-transform-object-rest-spread@npm:7.27.2"
   dependencies:
-    "@babel/types": ^7.16.0
-  checksum: 58ef8e3a4af0c1dc43a2011f43f25502877ac1c5aa9a4a6586f0265ab857b65831f60560044bc9380df43c91ac21cad39a84095b91764b433d1acf18d27e38d6
+    "@babel/helper-compilation-targets": ^7.27.2
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/plugin-transform-destructuring": ^7.27.1
+    "@babel/plugin-transform-parameters": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 6d518c21cddfa436029d72409aac8f680d3ba3a10eb94477112869132226498474a61218893ac9958f8bc079109af0f684d1347d5036fee8e9b477daecf2d8f3
   languageName: node
   linkType: hard
 
-"@babel/helper-member-expression-to-functions@npm:^7.16.7, @babel/helper-member-expression-to-functions@npm:^7.17.7":
-  version: 7.17.7
-  resolution: "@babel/helper-member-expression-to-functions@npm:7.17.7"
+"@babel/plugin-transform-object-super@npm:^7.25.9, @babel/plugin-transform-object-super@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-object-super@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.17.0
-  checksum: 70f361bab627396c714c3938e94a569cb0da522179328477cdbc4318e4003c2666387ad4931d6bd5de103338c667c9e4bbe3e917fc8c527b3f3eb6175b888b7d
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-replace-supers": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 46b819cb9a6cd3cfefe42d07875fee414f18d5e66040366ae856116db560ad4e16f3899a0a7fddd6773e0d1458444f94b208b67c0e3b6977a27ea17a5c13dbf6
   languageName: node
   linkType: hard
 
-"@babel/helper-member-expression-to-functions@npm:^7.18.9":
-  version: 7.18.9
-  resolution: "@babel/helper-member-expression-to-functions@npm:7.18.9"
+"@babel/plugin-transform-optional-catch-binding@npm:^7.25.9, @babel/plugin-transform-optional-catch-binding@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-optional-catch-binding@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.18.9
-  checksum: fcf8184e3b55051c4286b2cbedf0eccc781d0f3c9b5cbaba582eca19bf0e8d87806cdb7efc8554fcb969ceaf2b187d5ea748d40022d06ec7739fbb18c1b19a7a
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: f4356b04cf21a98480f9788ea50f1f13ee88e89bb6393ba4b84d1f39a4a84c7928c9a4328e8f4c5b6deb218da68a8fd17bf4f46faec7653ddc20ffaaa5ba49f4
   languageName: node
   linkType: hard
 
-"@babel/helper-member-expression-to-functions@npm:^7.22.15, @babel/helper-member-expression-to-functions@npm:^7.23.0":
-  version: 7.23.0
-  resolution: "@babel/helper-member-expression-to-functions@npm:7.23.0"
+"@babel/plugin-transform-optional-chaining@npm:^7.25.9, @babel/plugin-transform-optional-chaining@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-optional-chaining@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.23.0
-  checksum: 494659361370c979ada711ca685e2efe9460683c36db1b283b446122596602c901e291e09f2f980ecedfe6e0f2bd5386cb59768285446530df10c14df1024e75
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: c4428d31f182d724db6f10575669aad3dbccceb0dea26aa9071fa89f11b3456278da3097fcc78937639a13c105a82cd452dc0218ce51abdbcf7626a013b928a5
   languageName: node
   linkType: hard
 
-"@babel/helper-member-expression-to-functions@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-member-expression-to-functions@npm:7.22.5"
+"@babel/plugin-transform-parameters@npm:^7.20.7, @babel/plugin-transform-parameters@npm:^7.25.9, @babel/plugin-transform-parameters@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-parameters@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.22.5
-  checksum: 4bd5791529c280c00743e8bdc669ef0d4cd1620d6e3d35e0d42b862f8262bc2364973e5968007f960780344c539a4b9cf92ab41f5b4f94560a9620f536de2a39
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 52dd9db2be63ca954dbf86bba3f1dedce5f8bcf0cbc2b9ab26981b6f9c3ad5ea3a1b7ba286d18ae05d7487763f2bd086533826ee82f7b8d76873265569e45125
   languageName: node
   linkType: hard
 
-"@babel/helper-module-imports@npm:^7.12.13, @babel/helper-module-imports@npm:^7.13.12, @babel/helper-module-imports@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-module-imports@npm:7.16.0"
+"@babel/plugin-transform-private-methods@npm:^7.25.9, @babel/plugin-transform-private-methods@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-private-methods@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.0
-  checksum: 8e1eb9ac39440e52080b87c78d8d318e7c93658bdd0f3ce0019c908de88cbddafdc241f392898c0b0ba81fc52c8c6d2f9cc1b163ac5ed2a474d49b11646b7516
+    "@babel/helper-create-class-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: c76f8f6056946466116e67eb9d8014a2d748ade2062636ab82045c1dac9c233aff10e597777bc5af6f26428beb845ceb41b95007abef7d0484da95789da56662
   languageName: node
   linkType: hard
 
-"@babel/helper-module-imports@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-module-imports@npm:7.16.7"
+"@babel/plugin-transform-private-property-in-object@npm:^7.25.9, @babel/plugin-transform-private-property-in-object@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-private-property-in-object@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.7
-  checksum: ddd2c4a600a2e9a4fee192ab92bf35a627c5461dbab4af31b903d9ba4d6b6e59e0ff3499fde4e2e9a0eebe24906f00b636f8b4d9bd72ff24d50e6618215c3212
+    "@babel/helper-annotate-as-pure": ^7.27.1
+    "@babel/helper-create-class-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: af539af1bd423aa46b9da83d649be716494ca80783841f47094b6741fa24e11141446027fd152ddff791dede9d4a76d0d5eb467402a2e584d7f5ea90e2673c7e
   languageName: node
   linkType: hard
 
-"@babel/helper-module-imports@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/helper-module-imports@npm:7.18.6"
+"@babel/plugin-transform-property-literals@npm:^7.25.9, @babel/plugin-transform-property-literals@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-property-literals@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.18.6
-  checksum: f393f8a3b3304b1b7a288a38c10989de754f01d29caf62ce7c4e5835daf0a27b81f3ac687d9d2780d39685aae7b55267324b512150e7b2be967b0c493b6a1def
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 7caec27d5ed8870895c9faf4f71def72745d69da0d8e77903146a4e135fd7bed5778f5f9cebb36c5fba86338e6194dd67a08c033fc84b4299b7eceab6d9630cb
   languageName: node
   linkType: hard
 
-"@babel/helper-module-imports@npm:^7.22.15":
-  version: 7.22.15
-  resolution: "@babel/helper-module-imports@npm:7.22.15"
+"@babel/plugin-transform-regenerator@npm:^7.25.9, @babel/plugin-transform-regenerator@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-regenerator@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.22.15
-  checksum: ecd7e457df0a46f889228f943ef9b4a47d485d82e030676767e6a2fdcbdaa63594d8124d4b55fd160b41c201025aec01fc27580352b1c87a37c9c6f33d116702
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: e1e28e08abf1c8fcdeaa8af5ab44cfda83bebc0ba6ebc155afdae243c51a2e941dd8ff6c51affb0447deb07a6bc66424fbf04482b050c061e272bc75c15853bf
   languageName: node
   linkType: hard
 
-"@babel/helper-module-imports@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-module-imports@npm:7.22.5"
+"@babel/plugin-transform-regexp-modifiers@npm:^7.26.0, @babel/plugin-transform-regexp-modifiers@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-regexp-modifiers@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.22.5
-  checksum: 9ac2b0404fa38b80bdf2653fbeaf8e8a43ccb41bd505f9741d820ed95d3c4e037c62a1bcdcb6c9527d7798d2e595924c4d025daed73283badc180ada2c9c49ad
+    "@babel/helper-create-regexp-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: f6cb385fe0e798bff7e9b20cf5912bf40e180895ff3610b1ccdce260f3c20daaebb3a99dc087c8168a99151cd3e16b94f4689fd5a4b01cf1834b45c133e620b2
   languageName: node
   linkType: hard
 
-"@babel/helper-module-transforms@npm:^7.14.0, @babel/helper-module-transforms@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-module-transforms@npm:7.16.0"
+"@babel/plugin-transform-reserved-words@npm:^7.25.9, @babel/plugin-transform-reserved-words@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-reserved-words@npm:7.27.1"
   dependencies:
-    "@babel/helper-module-imports": ^7.16.0
-    "@babel/helper-replace-supers": ^7.16.0
-    "@babel/helper-simple-access": ^7.16.0
-    "@babel/helper-split-export-declaration": ^7.16.0
-    "@babel/helper-validator-identifier": ^7.15.7
-    "@babel/template": ^7.16.0
-    "@babel/traverse": ^7.16.0
-    "@babel/types": ^7.16.0
-  checksum: a3d0e5556f26ebdf2ae422af3b9a1ba1848fead891f46bcd1c6a4be88ad8e9f348140f81d1843a3481574be1643a9c79b01469231f5b5801f5d5e691efdd11f3
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: dea0b66742d2863b369c06c053e11e15ba785892ea19cccf7aef3c1bdaa38b6ab082e19984c5ea7810d275d9445c5400fcc385ad71ce707ed9256fadb102af3b
   languageName: node
   linkType: hard
 
-"@babel/helper-module-transforms@npm:^7.16.7, @babel/helper-module-transforms@npm:^7.17.7":
-  version: 7.17.7
-  resolution: "@babel/helper-module-transforms@npm:7.17.7"
-  dependencies:
-    "@babel/helper-environment-visitor": ^7.16.7
-    "@babel/helper-module-imports": ^7.16.7
-    "@babel/helper-simple-access": ^7.17.7
-    "@babel/helper-split-export-declaration": ^7.16.7
-    "@babel/helper-validator-identifier": ^7.16.7
-    "@babel/template": ^7.16.7
-    "@babel/traverse": ^7.17.3
-    "@babel/types": ^7.17.0
-  checksum: 0b8f023aa7ff82dc4864349d54c4557865ad8ba54d78f6d78a86b05ca40f65c2d60acb4a54c5c309e7a4356beb9a89b876e54af4b3c4801ad25f62ec3721f0ae
+"@babel/plugin-transform-runtime@npm:^7.13.9":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-runtime@npm:7.27.1"
+  dependencies:
+    "@babel/helper-module-imports": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+    babel-plugin-polyfill-corejs2: ^0.4.10
+    babel-plugin-polyfill-corejs3: ^0.11.0
+    babel-plugin-polyfill-regenerator: ^0.6.1
+    semver: ^6.3.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 9328060b54e430732883cac672cfd4c952c2bf2d9fb5268c675ae01f74ccb224ecdf105f5ad52b6277ad8b34b6df1e7cec6d1c02a0d17be54414265414e8ac88
   languageName: node
   linkType: hard
 
-"@babel/helper-module-transforms@npm:^7.18.0":
-  version: 7.18.0
-  resolution: "@babel/helper-module-transforms@npm:7.18.0"
+"@babel/plugin-transform-shorthand-properties@npm:^7.25.9, @babel/plugin-transform-shorthand-properties@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-shorthand-properties@npm:7.27.1"
   dependencies:
-    "@babel/helper-environment-visitor": ^7.16.7
-    "@babel/helper-module-imports": ^7.16.7
-    "@babel/helper-simple-access": ^7.17.7
-    "@babel/helper-split-export-declaration": ^7.16.7
-    "@babel/helper-validator-identifier": ^7.16.7
-    "@babel/template": ^7.16.7
-    "@babel/traverse": ^7.18.0
-    "@babel/types": ^7.18.0
-  checksum: 824c3967c08d75bb36adc18c31dcafebcd495b75b723e2e17c6185e88daf5c6db62a6a75d9f791b5f38618a349e7cb32503e715a1b9a4e8bad4d0f43e3e6b523
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: fbba6e2aef0b69681acb68202aa249c0598e470cc0853d7ff5bd0171fd6a7ec31d77cfabcce9df6360fc8349eded7e4a65218c32551bd3fc0caaa1ac899ac6d4
   languageName: node
   linkType: hard
 
-"@babel/helper-module-transforms@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/helper-module-transforms@npm:7.19.0"
+"@babel/plugin-transform-spread@npm:^7.25.9, @babel/plugin-transform-spread@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-spread@npm:7.27.1"
   dependencies:
-    "@babel/helper-environment-visitor": ^7.18.9
-    "@babel/helper-module-imports": ^7.18.6
-    "@babel/helper-simple-access": ^7.18.6
-    "@babel/helper-split-export-declaration": ^7.18.6
-    "@babel/helper-validator-identifier": ^7.18.6
-    "@babel/template": ^7.18.10
-    "@babel/traverse": ^7.19.0
-    "@babel/types": ^7.19.0
-  checksum: 4483276c66f56cf3b5b063634092ad9438c2593725de5c143ba277dda82f1501e6d73b311c1b28036f181dbe36eaeff29f24726cde37a599d4e735af294e5359
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 58b08085ee9c29955ac3b68d61c1a79728d44d19a69cb5eb669794aeaf54c57c6647af7b979c1297e81ede3d08b3ddcb1936ef39a533f28ff3e399a9be54dab1
   languageName: node
   linkType: hard
 
-"@babel/helper-module-transforms@npm:^7.22.5, @babel/helper-module-transforms@npm:^7.22.9":
-  version: 7.22.9
-  resolution: "@babel/helper-module-transforms@npm:7.22.9"
+"@babel/plugin-transform-sticky-regex@npm:^7.25.9, @babel/plugin-transform-sticky-regex@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-sticky-regex@npm:7.27.1"
   dependencies:
-    "@babel/helper-environment-visitor": ^7.22.5
-    "@babel/helper-module-imports": ^7.22.5
-    "@babel/helper-simple-access": ^7.22.5
-    "@babel/helper-split-export-declaration": ^7.22.6
-    "@babel/helper-validator-identifier": ^7.22.5
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 2751f77660518cf4ff027514d6f4794f04598c6393be7b04b8e46c6e21606e11c19f3f57ab6129a9c21bacdf8b3ffe3af87bb401d972f34af2d0ffde02ac3001
+    "@babel/core": ^7.0.0-0
+  checksum: e1414a502efba92c7974681767e365a8cda6c5e9e5f33472a9eaa0ce2e75cea0a9bef881ff8dda37c7810ad902f98d3c00ead92a3ac3b73a79d011df85b5a189
   languageName: node
   linkType: hard
 
-"@babel/helper-module-transforms@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/helper-module-transforms@npm:7.23.3"
+"@babel/plugin-transform-template-literals@npm:^7.26.8, @babel/plugin-transform-template-literals@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-template-literals@npm:7.27.1"
   dependencies:
-    "@babel/helper-environment-visitor": ^7.22.20
-    "@babel/helper-module-imports": ^7.22.15
-    "@babel/helper-simple-access": ^7.22.5
-    "@babel/helper-split-export-declaration": ^7.22.6
-    "@babel/helper-validator-identifier": ^7.22.20
+    "@babel/helper-plugin-utils": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 5d0895cfba0e16ae16f3aa92fee108517023ad89a855289c4eb1d46f7aef4519adf8e6f971e1d55ac20c5461610e17213f1144097a8f932e768a9132e2278d71
+    "@babel/core": ^7.0.0-0
+  checksum: 93aad782503b691faef7c0893372d5243df3219b07f1f22cfc32c104af6a2e7acd6102c128439eab15336d048f1b214ca134b87b0630d8cd568bf447f78b25ce
   languageName: node
   linkType: hard
 
-"@babel/helper-optimise-call-expression@npm:^7.12.13, @babel/helper-optimise-call-expression@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-optimise-call-expression@npm:7.16.0"
+"@babel/plugin-transform-typeof-symbol@npm:^7.26.7, @babel/plugin-transform-typeof-symbol@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-typeof-symbol@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.0
-  checksum: 121ae6054fcec76ed2c4dd83f0281b901c1e3cfac1bbff79adc3667983903ad1030a0ad9a8bea58e52b225e13881cf316f371c65276976e7a6762758a98be8f6
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: ed8048c8de72c60969a64cf2273cc6d9275d8fa8db9bd25a1268273a00fb9cbd79931140311411bda1443aa56cb3961fb911d1795abacde7f0482f1d8fdf0356
   languageName: node
   linkType: hard
 
-"@babel/helper-optimise-call-expression@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-optimise-call-expression@npm:7.16.7"
+"@babel/plugin-transform-typescript@npm:^7.13.0, @babel/plugin-transform-typescript@npm:^7.16.8, @babel/plugin-transform-typescript@npm:^7.20.13, @babel/plugin-transform-typescript@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-typescript@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.16.7
-  checksum: 925feb877d5a30a71db56e2be498b3abbd513831311c0188850896c4c1ada865eea795dce5251a1539b0f883ef82493f057f84286dd01abccc4736acfafe15ea
+    "@babel/helper-annotate-as-pure": ^7.27.1
+    "@babel/helper-create-class-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-skip-transparent-expression-wrappers": ^7.27.1
+    "@babel/plugin-syntax-typescript": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 0037db32fedaacf42b5b3df774263bb7176d455859f77322f57135f7e50e457e5c95151280fc83bb9942fc1839e785489b098d73c9539d0f3c7dc9d42b3a8e86
   languageName: node
   linkType: hard
 
-"@babel/helper-optimise-call-expression@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/helper-optimise-call-expression@npm:7.18.6"
+"@babel/plugin-transform-unicode-escapes@npm:^7.25.9, @babel/plugin-transform-unicode-escapes@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-unicode-escapes@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.18.6
-  checksum: e518fe8418571405e21644cfb39cf694f30b6c47b10b006609a92469ae8b8775cbff56f0b19732343e2ea910641091c5a2dc73b56ceba04e116a33b0f8bd2fbd
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: d817154bc10758ddd85b716e0bc1af1a1091e088400289ab6b78a1a4d609907ce3d2f1fd51a6fd0e0c8ecbb5f8e3aab4957e0747776d132d2379e85c3ef0520a
   languageName: node
   linkType: hard
 
-"@babel/helper-optimise-call-expression@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-optimise-call-expression@npm:7.22.5"
+"@babel/plugin-transform-unicode-property-regex@npm:^7.25.9, @babel/plugin-transform-unicode-property-regex@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-unicode-property-regex@npm:7.27.1"
   dependencies:
-    "@babel/types": ^7.22.5
-  checksum: c70ef6cc6b6ed32eeeec4482127e8be5451d0e5282d5495d5d569d39eb04d7f1d66ec99b327f45d1d5842a9ad8c22d48567e93fc502003a47de78d122e355f7c
-  languageName: node
-  linkType: hard
-
-"@babel/helper-plugin-utils@npm:^7.0.0, @babel/helper-plugin-utils@npm:^7.10.4, @babel/helper-plugin-utils@npm:^7.12.13, @babel/helper-plugin-utils@npm:^7.13.0, @babel/helper-plugin-utils@npm:^7.14.5, @babel/helper-plugin-utils@npm:^7.8.0, @babel/helper-plugin-utils@npm:^7.8.3":
-  version: 7.14.5
-  resolution: "@babel/helper-plugin-utils@npm:7.14.5"
-  checksum: fe20e90a24d02770a60ebe80ab9f0dfd7258503cea8006c71709ac9af1aa3e47b0de569499673f11ea6c99597f8c0e4880ae1d505986e61101b69716820972fe
+    "@babel/helper-create-regexp-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 5d99c89537d1ebaac3f526c04b162cf95a47d363d4829f78c6701a2c06ab78a48da66a94f853f85f44a3d72153410ba923e072bed4b7166fa097f503eb14131d
   languageName: node
   linkType: hard
 
-"@babel/helper-plugin-utils@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-plugin-utils@npm:7.16.7"
-  checksum: d08dd86554a186c2538547cd537552e4029f704994a9201d41d82015c10ed7f58f9036e8d1527c3760f042409163269d308b0b3706589039c5f1884619c6d4ce
+"@babel/plugin-transform-unicode-regex@npm:^7.25.9, @babel/plugin-transform-unicode-regex@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-unicode-regex@npm:7.27.1"
+  dependencies:
+    "@babel/helper-create-regexp-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: a34d89a2b75fb78e66d97c3dc90d4877f7e31f43316b52176f95a5dee20e9bb56ecf158eafc42a001676ddf7b393d9e67650bad6b32f5405780f25fb83cd68e3
   languageName: node
   linkType: hard
 
-"@babel/helper-plugin-utils@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/helper-plugin-utils@npm:7.17.12"
-  checksum: 4813cf0ddb0f143de032cb88d4207024a2334951db330f8216d6fa253ea320c02c9b2667429ef1a34b5e95d4cfbd085f6cb72d418999751c31d0baf2422cc61d
+"@babel/plugin-transform-unicode-sets-regex@npm:^7.25.9, @babel/plugin-transform-unicode-sets-regex@npm:^7.27.1":
+  version: 7.27.1
+  resolution: "@babel/plugin-transform-unicode-sets-regex@npm:7.27.1"
+  dependencies:
+    "@babel/helper-create-regexp-features-plugin": ^7.27.1
+    "@babel/helper-plugin-utils": ^7.27.1
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 295126074c7388ab05c82ef3ed0907a1ee4666bbdd763477ead9aba6eb2c74bdf65669416861ac93d337a4a27640963bb214acadc2697275ce95aab14868d57f
   languageName: node
   linkType: hard
 
-"@babel/helper-plugin-utils@npm:^7.18.6, @babel/helper-plugin-utils@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/helper-plugin-utils@npm:7.19.0"
-  checksum: eedc996c633c8c207921c26ec2989eae0976336ecd9b9f1ac526498f52b5d136f7cd03c32b6fdf8d46a426f907c142de28592f383c42e5fba1e904cbffa05345
+"@babel/polyfill@npm:^7.11.5":
+  version: 7.12.1
+  resolution: "@babel/polyfill@npm:7.12.1"
+  dependencies:
+    core-js: ^2.6.5
+    regenerator-runtime: ^0.13.4
+  checksum: 3f59a9d85a41b390b044a1be13e11ae6d8efbfcf4e07217964585c7cef337b828eecfc5e164083227189146d2b6efc1affae8f59c831438eb40b848ab6fe5f39
   languageName: node
   linkType: hard
 
-"@babel/helper-plugin-utils@npm:^7.20.2, @babel/helper-plugin-utils@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-plugin-utils@npm:7.22.5"
-  checksum: c0fc7227076b6041acd2f0e818145d2e8c41968cc52fb5ca70eed48e21b8fe6dd88a0a91cbddf4951e33647336eb5ae184747ca706817ca3bef5e9e905151ff5
+"@babel/preset-env@npm:^7.16.5, @babel/preset-env@npm:^7.16.7, @babel/preset-env@npm:^7.20.2":
+  version: 7.27.2
+  resolution: "@babel/preset-env@npm:7.27.2"
+  dependencies:
+    "@babel/compat-data": ^7.27.2
+    "@babel/helper-compilation-targets": ^7.27.2
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-validator-option": ^7.27.1
+    "@babel/plugin-bugfix-firefox-class-in-computed-class-key": ^7.27.1
+    "@babel/plugin-bugfix-safari-class-field-initializer-scope": ^7.27.1
+    "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": ^7.27.1
+    "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": ^7.27.1
+    "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": ^7.27.1
+    "@babel/plugin-proposal-private-property-in-object": 7.21.0-placeholder-for-preset-env.2
+    "@babel/plugin-syntax-import-assertions": ^7.27.1
+    "@babel/plugin-syntax-import-attributes": ^7.27.1
+    "@babel/plugin-syntax-unicode-sets-regex": ^7.18.6
+    "@babel/plugin-transform-arrow-functions": ^7.27.1
+    "@babel/plugin-transform-async-generator-functions": ^7.27.1
+    "@babel/plugin-transform-async-to-generator": ^7.27.1
+    "@babel/plugin-transform-block-scoped-functions": ^7.27.1
+    "@babel/plugin-transform-block-scoping": ^7.27.1
+    "@babel/plugin-transform-class-properties": ^7.27.1
+    "@babel/plugin-transform-class-static-block": ^7.27.1
+    "@babel/plugin-transform-classes": ^7.27.1
+    "@babel/plugin-transform-computed-properties": ^7.27.1
+    "@babel/plugin-transform-destructuring": ^7.27.1
+    "@babel/plugin-transform-dotall-regex": ^7.27.1
+    "@babel/plugin-transform-duplicate-keys": ^7.27.1
+    "@babel/plugin-transform-duplicate-named-capturing-groups-regex": ^7.27.1
+    "@babel/plugin-transform-dynamic-import": ^7.27.1
+    "@babel/plugin-transform-exponentiation-operator": ^7.27.1
+    "@babel/plugin-transform-export-namespace-from": ^7.27.1
+    "@babel/plugin-transform-for-of": ^7.27.1
+    "@babel/plugin-transform-function-name": ^7.27.1
+    "@babel/plugin-transform-json-strings": ^7.27.1
+    "@babel/plugin-transform-literals": ^7.27.1
+    "@babel/plugin-transform-logical-assignment-operators": ^7.27.1
+    "@babel/plugin-transform-member-expression-literals": ^7.27.1
+    "@babel/plugin-transform-modules-amd": ^7.27.1
+    "@babel/plugin-transform-modules-commonjs": ^7.27.1
+    "@babel/plugin-transform-modules-systemjs": ^7.27.1
+    "@babel/plugin-transform-modules-umd": ^7.27.1
+    "@babel/plugin-transform-named-capturing-groups-regex": ^7.27.1
+    "@babel/plugin-transform-new-target": ^7.27.1
+    "@babel/plugin-transform-nullish-coalescing-operator": ^7.27.1
+    "@babel/plugin-transform-numeric-separator": ^7.27.1
+    "@babel/plugin-transform-object-rest-spread": ^7.27.2
+    "@babel/plugin-transform-object-super": ^7.27.1
+    "@babel/plugin-transform-optional-catch-binding": ^7.27.1
+    "@babel/plugin-transform-optional-chaining": ^7.27.1
+    "@babel/plugin-transform-parameters": ^7.27.1
+    "@babel/plugin-transform-private-methods": ^7.27.1
+    "@babel/plugin-transform-private-property-in-object": ^7.27.1
+    "@babel/plugin-transform-property-literals": ^7.27.1
+    "@babel/plugin-transform-regenerator": ^7.27.1
+    "@babel/plugin-transform-regexp-modifiers": ^7.27.1
+    "@babel/plugin-transform-reserved-words": ^7.27.1
+    "@babel/plugin-transform-shorthand-properties": ^7.27.1
+    "@babel/plugin-transform-spread": ^7.27.1
+    "@babel/plugin-transform-sticky-regex": ^7.27.1
+    "@babel/plugin-transform-template-literals": ^7.27.1
+    "@babel/plugin-transform-typeof-symbol": ^7.27.1
+    "@babel/plugin-transform-unicode-escapes": ^7.27.1
+    "@babel/plugin-transform-unicode-property-regex": ^7.27.1
+    "@babel/plugin-transform-unicode-regex": ^7.27.1
+    "@babel/plugin-transform-unicode-sets-regex": ^7.27.1
+    "@babel/preset-modules": 0.1.6-no-external-plugins
+    babel-plugin-polyfill-corejs2: ^0.4.10
+    babel-plugin-polyfill-corejs3: ^0.11.0
+    babel-plugin-polyfill-regenerator: ^0.6.1
+    core-js-compat: ^3.40.0
+    semver: ^6.3.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 318b123c8783ac3833bde5a5ff315970967ccd4c1e5c97e0843c0199fe9eab48a8cb40b367b784ae19a33667bee63eb8533eb924dab05bfc92ff9ef436109001
   languageName: node
   linkType: hard
 
-"@babel/helper-remap-async-to-generator@npm:^7.16.0, @babel/helper-remap-async-to-generator@npm:^7.16.4":
-  version: 7.16.4
-  resolution: "@babel/helper-remap-async-to-generator@npm:7.16.4"
+"@babel/preset-env@npm:~7.26.9":
+  version: 7.26.9
+  resolution: "@babel/preset-env@npm:7.26.9"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.0
-    "@babel/helper-wrap-function": ^7.16.0
-    "@babel/types": ^7.16.0
-  checksum: debe997695fe2c11813e88b2fa4afc89d4543f72457dda00c7296a728cd5eeb81d4ef8607a5fef7823da410a8579407c631a430e5bfc78290172ff6fc430355c
+    "@babel/compat-data": ^7.26.8
+    "@babel/helper-compilation-targets": ^7.26.5
+    "@babel/helper-plugin-utils": ^7.26.5
+    "@babel/helper-validator-option": ^7.25.9
+    "@babel/plugin-bugfix-firefox-class-in-computed-class-key": ^7.25.9
+    "@babel/plugin-bugfix-safari-class-field-initializer-scope": ^7.25.9
+    "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": ^7.25.9
+    "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": ^7.25.9
+    "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": ^7.25.9
+    "@babel/plugin-proposal-private-property-in-object": 7.21.0-placeholder-for-preset-env.2
+    "@babel/plugin-syntax-import-assertions": ^7.26.0
+    "@babel/plugin-syntax-import-attributes": ^7.26.0
+    "@babel/plugin-syntax-unicode-sets-regex": ^7.18.6
+    "@babel/plugin-transform-arrow-functions": ^7.25.9
+    "@babel/plugin-transform-async-generator-functions": ^7.26.8
+    "@babel/plugin-transform-async-to-generator": ^7.25.9
+    "@babel/plugin-transform-block-scoped-functions": ^7.26.5
+    "@babel/plugin-transform-block-scoping": ^7.25.9
+    "@babel/plugin-transform-class-properties": ^7.25.9
+    "@babel/plugin-transform-class-static-block": ^7.26.0
+    "@babel/plugin-transform-classes": ^7.25.9
+    "@babel/plugin-transform-computed-properties": ^7.25.9
+    "@babel/plugin-transform-destructuring": ^7.25.9
+    "@babel/plugin-transform-dotall-regex": ^7.25.9
+    "@babel/plugin-transform-duplicate-keys": ^7.25.9
+    "@babel/plugin-transform-duplicate-named-capturing-groups-regex": ^7.25.9
+    "@babel/plugin-transform-dynamic-import": ^7.25.9
+    "@babel/plugin-transform-exponentiation-operator": ^7.26.3
+    "@babel/plugin-transform-export-namespace-from": ^7.25.9
+    "@babel/plugin-transform-for-of": ^7.26.9
+    "@babel/plugin-transform-function-name": ^7.25.9
+    "@babel/plugin-transform-json-strings": ^7.25.9
+    "@babel/plugin-transform-literals": ^7.25.9
+    "@babel/plugin-transform-logical-assignment-operators": ^7.25.9
+    "@babel/plugin-transform-member-expression-literals": ^7.25.9
+    "@babel/plugin-transform-modules-amd": ^7.25.9
+    "@babel/plugin-transform-modules-commonjs": ^7.26.3
+    "@babel/plugin-transform-modules-systemjs": ^7.25.9
+    "@babel/plugin-transform-modules-umd": ^7.25.9
+    "@babel/plugin-transform-named-capturing-groups-regex": ^7.25.9
+    "@babel/plugin-transform-new-target": ^7.25.9
+    "@babel/plugin-transform-nullish-coalescing-operator": ^7.26.6
+    "@babel/plugin-transform-numeric-separator": ^7.25.9
+    "@babel/plugin-transform-object-rest-spread": ^7.25.9
+    "@babel/plugin-transform-object-super": ^7.25.9
+    "@babel/plugin-transform-optional-catch-binding": ^7.25.9
+    "@babel/plugin-transform-optional-chaining": ^7.25.9
+    "@babel/plugin-transform-parameters": ^7.25.9
+    "@babel/plugin-transform-private-methods": ^7.25.9
+    "@babel/plugin-transform-private-property-in-object": ^7.25.9
+    "@babel/plugin-transform-property-literals": ^7.25.9
+    "@babel/plugin-transform-regenerator": ^7.25.9
+    "@babel/plugin-transform-regexp-modifiers": ^7.26.0
+    "@babel/plugin-transform-reserved-words": ^7.25.9
+    "@babel/plugin-transform-shorthand-properties": ^7.25.9
+    "@babel/plugin-transform-spread": ^7.25.9
+    "@babel/plugin-transform-sticky-regex": ^7.25.9
+    "@babel/plugin-transform-template-literals": ^7.26.8
+    "@babel/plugin-transform-typeof-symbol": ^7.26.7
+    "@babel/plugin-transform-unicode-escapes": ^7.25.9
+    "@babel/plugin-transform-unicode-property-regex": ^7.25.9
+    "@babel/plugin-transform-unicode-regex": ^7.25.9
+    "@babel/plugin-transform-unicode-sets-regex": ^7.25.9
+    "@babel/preset-modules": 0.1.6-no-external-plugins
+    babel-plugin-polyfill-corejs2: ^0.4.10
+    babel-plugin-polyfill-corejs3: ^0.11.0
+    babel-plugin-polyfill-regenerator: ^0.6.1
+    core-js-compat: ^3.40.0
+    semver: ^6.3.1
+  peerDependencies:
+    "@babel/core": ^7.0.0-0
+  checksum: 7a657f947d069b7a27b02258012ce3ceb9383a8c10c249d4a3565c486294c3fe63ed08128ca3d124444d17eb821cfbf64a91fe8160af2e39f70d5cd2232f079e
   languageName: node
   linkType: hard
 
-"@babel/helper-remap-async-to-generator@npm:^7.16.8":
-  version: 7.16.8
-  resolution: "@babel/helper-remap-async-to-generator@npm:7.16.8"
+"@babel/preset-modules@npm:0.1.6-no-external-plugins":
+  version: 0.1.6-no-external-plugins
+  resolution: "@babel/preset-modules@npm:0.1.6-no-external-plugins"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.7
-    "@babel/helper-wrap-function": ^7.16.8
-    "@babel/types": ^7.16.8
-  checksum: 29282ee36872130085ca111539725abbf20210c2a1d674bee77f338a57c093c3154108d03a275f602e471f583bd2c7ae10d05534f87cbc22b95524fe2b569488
+    "@babel/helper-plugin-utils": ^7.0.0
+    "@babel/types": ^7.4.4
+    esutils: ^2.0.2
+  peerDependencies:
+    "@babel/core": ^7.0.0-0 || ^8.0.0-0 <8.0.0
+  checksum: 4855e799bc50f2449fb5210f78ea9e8fd46cf4f242243f1e2ed838e2bd702e25e73e822e7f8447722a5f4baa5e67a8f7a0e403f3e7ce04540ff743a9c411c375
   languageName: node
   linkType: hard
 
-"@babel/helper-remap-async-to-generator@npm:^7.22.20":
-  version: 7.22.20
-  resolution: "@babel/helper-remap-async-to-generator@npm:7.22.20"
+"@babel/preset-typescript@npm:~7.27.0":
+  version: 7.27.1
+  resolution: "@babel/preset-typescript@npm:7.27.1"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.22.5
-    "@babel/helper-environment-visitor": ^7.22.20
-    "@babel/helper-wrap-function": ^7.22.20
+    "@babel/helper-plugin-utils": ^7.27.1
+    "@babel/helper-validator-option": ^7.27.1
+    "@babel/plugin-syntax-jsx": ^7.27.1
+    "@babel/plugin-transform-modules-commonjs": ^7.27.1
+    "@babel/plugin-transform-typescript": ^7.27.1
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 2fe6300a6f1b58211dffa0aed1b45d4958506d096543663dba83bd9251fe8d670fa909143a65b45e72acb49e7e20fbdb73eae315d9ddaced467948c3329986e7
+    "@babel/core": ^7.0.0-0
+  checksum: 38020f1b23e88ec4fbffd5737da455d8939244bddfb48a2516aef93fb5947bd9163fb807ce6eff3e43fa5ffe9113aa131305fef0fb5053998410bbfcfe6ce0ec
   languageName: node
   linkType: hard
 
-"@babel/helper-replace-supers@npm:^7.13.12, @babel/helper-replace-supers@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-replace-supers@npm:7.16.0"
+"@babel/runtime@npm:7.27.0":
+  version: 7.27.0
+  resolution: "@babel/runtime@npm:7.27.0"
   dependencies:
-    "@babel/helper-member-expression-to-functions": ^7.16.0
-    "@babel/helper-optimise-call-expression": ^7.16.0
-    "@babel/traverse": ^7.16.0
-    "@babel/types": ^7.16.0
-  checksum: 61f04bbe05ff0987d5a8d5253cb101d47004a27951d6c5cd95457e30fcb3adaca85f0bcaa7f31f4d934f22386b935ac7281398c68982d4a4768769d95c028460
+    regenerator-runtime: ^0.14.0
+  checksum: 3e73d9e65f76fad8f99802b5364c941f4a60c693b3eca66147bb0bfa54cf0fbe017232155e16e3fd83c0a049b51b8d7239efbd73626534abe8b54a6dd57dcb1b
   languageName: node
   linkType: hard
 
-"@babel/helper-replace-supers@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-replace-supers@npm:7.16.7"
+"@babel/template@npm:^7.26.9, @babel/template@npm:^7.27.1":
+  version: 7.27.2
+  resolution: "@babel/template@npm:7.27.2"
   dependencies:
-    "@babel/helper-environment-visitor": ^7.16.7
-    "@babel/helper-member-expression-to-functions": ^7.16.7
-    "@babel/helper-optimise-call-expression": ^7.16.7
-    "@babel/traverse": ^7.16.7
-    "@babel/types": ^7.16.7
-  checksum: e5c0b6eb3dad8410a6255f93b580dde9b3c1564646c6ef751de59d5b2a65b5caa80cc9e568155f04bbae895ad0f54305c2e833dbd971a4f641f970c90b3d892b
+    "@babel/code-frame": ^7.27.1
+    "@babel/parser": ^7.27.2
+    "@babel/types": ^7.27.1
+  checksum: ff5628bc066060624afd970616090e5bba91c6240c2e4b458d13267a523572cbfcbf549391eec8217b94b064cf96571c6273f0c04b28a8567b96edc675c28e27
   languageName: node
   linkType: hard
 
-"@babel/helper-replace-supers@npm:^7.18.2":
-  version: 7.18.2
-  resolution: "@babel/helper-replace-supers@npm:7.18.2"
+"@babel/traverse@npm:^7.26.10, @babel/traverse@npm:^7.27.1, @babel/traverse@npm:^7.4.5":
+  version: 7.27.1
+  resolution: "@babel/traverse@npm:7.27.1"
   dependencies:
-    "@babel/helper-environment-visitor": ^7.18.2
-    "@babel/helper-member-expression-to-functions": ^7.17.7
-    "@babel/helper-optimise-call-expression": ^7.16.7
-    "@babel/traverse": ^7.18.2
-    "@babel/types": ^7.18.2
-  checksum: c0083b7933672dd2aed50b79021c46401c83f41bc2132def19c5414cf8f944251f6d91dd959b2bedada9a7436a80fab629adb486e008566290c82293e89fec05
+    "@babel/code-frame": ^7.27.1
+    "@babel/generator": ^7.27.1
+    "@babel/parser": ^7.27.1
+    "@babel/template": ^7.27.1
+    "@babel/types": ^7.27.1
+    debug: ^4.3.1
+    globals: ^11.1.0
+  checksum: 7ea3ec36a65e734f2921f5dba6f417f5dd0c90eb44a60f6addbacbbedb44e8c82eba415a74feb7d6df58e351519b81b11b6ca3c0c7c41a3f73ebeaf6895a826c
   languageName: node
   linkType: hard
 
-"@babel/helper-replace-supers@npm:^7.18.9":
-  version: 7.18.9
-  resolution: "@babel/helper-replace-supers@npm:7.18.9"
+"@babel/types@npm:^7.12.13, @babel/types@npm:^7.26.10, @babel/types@npm:^7.27.1, @babel/types@npm:^7.4.4, @babel/types@npm:^7.7.2":
+  version: 7.27.1
+  resolution: "@babel/types@npm:7.27.1"
   dependencies:
-    "@babel/helper-environment-visitor": ^7.18.9
-    "@babel/helper-member-expression-to-functions": ^7.18.9
-    "@babel/helper-optimise-call-expression": ^7.18.6
-    "@babel/traverse": ^7.18.9
-    "@babel/types": ^7.18.9
-  checksum: 2de8b29cc4bfa4e241da2de16abd5571709f6eb394206dc16e3a7816976d1691635dd4bc930881e9d798f44b48a5f1849dc7f51a62946f3e8270452be1ec5352
+    "@babel/helper-string-parser": ^7.27.1
+    "@babel/helper-validator-identifier": ^7.27.1
+  checksum: 357c13f37aaa2f2e2cfcdb63f986d5f7abc9f38df20182b620ace34387d2460620415770fe5856eb54d70c9f0ba2f71230d29465e789188635a948476b830ae4
   languageName: node
   linkType: hard
 
-"@babel/helper-replace-supers@npm:^7.22.20":
-  version: 7.22.20
-  resolution: "@babel/helper-replace-supers@npm:7.22.20"
+"@cnakazawa/watch@npm:^1.0.3":
+  version: 1.0.4
+  resolution: "@cnakazawa/watch@npm:1.0.4"
   dependencies:
-    "@babel/helper-environment-visitor": ^7.22.20
-    "@babel/helper-member-expression-to-functions": ^7.22.15
-    "@babel/helper-optimise-call-expression": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: a0008332e24daedea2e9498733e3c39b389d6d4512637e000f96f62b797e702ee24a407ccbcd7a236a551590a38f31282829a8ef35c50a3c0457d88218cae639
+    exec-sh: ^0.3.2
+    minimist: ^1.2.0
+  bin:
+    watch: cli.js
+  checksum: 88f395ca0af2f3c0665b8ce7bb29e83647ec5d141e8735712aeeee4117081555436712966b6957aa1c461f6f826a4d23b0034e379c443a10e919f81c8748bf29
   languageName: node
   linkType: hard
 
-"@babel/helper-replace-supers@npm:^7.22.5, @babel/helper-replace-supers@npm:^7.22.9":
-  version: 7.22.9
-  resolution: "@babel/helper-replace-supers@npm:7.22.9"
+"@codemirror/autocomplete@npm:^6.0.0, @codemirror/autocomplete@npm:^6.7.1":
+  version: 6.18.6
+  resolution: "@codemirror/autocomplete@npm:6.18.6"
   dependencies:
-    "@babel/helper-environment-visitor": ^7.22.5
-    "@babel/helper-member-expression-to-functions": ^7.22.5
-    "@babel/helper-optimise-call-expression": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: d41471f56ff2616459d35a5df1900d5f0756ae78b1027040365325ef332d66e08e3be02a9489756d870887585ff222403a228546e93dd7019e19e59c0c0fe586
+    "@codemirror/language": ^6.0.0
+    "@codemirror/state": ^6.0.0
+    "@codemirror/view": ^6.17.0
+    "@lezer/common": ^1.0.0
+  checksum: 1d3657d5fbd2bbf983edf7fb14568b1f813a15f03848bef3833835dd3a30985d881e093842f7b3def23789b542db4eb81ec07bfa313d1ee1d54cb1b273027dea
   languageName: node
   linkType: hard
 
-"@babel/helper-simple-access@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-simple-access@npm:7.16.0"
+"@codemirror/commands@npm:^6.8.0":
+  version: 6.8.1
+  resolution: "@codemirror/commands@npm:6.8.1"
   dependencies:
-    "@babel/types": ^7.16.0
-  checksum: 2d7155f318411788b42d2f4a3d406de12952ad620d0bd411a0f3b5803389692ad61d9e7fab5f93b23ad3d8a09db4a75ca9722b9873a606470f468bc301944af6
+    "@codemirror/language": ^6.0.0
+    "@codemirror/state": ^6.4.0
+    "@codemirror/view": ^6.27.0
+    "@lezer/common": ^1.1.0
+  checksum: 838365af4f12e985c35f4bc59e38eb809e951fd3e35d5ad43548e61c26deda050276346dd031b9c6ed7fe13a777d59c37b9b1e46609d1d79e622d908340a468e
   languageName: node
   linkType: hard
 
-"@babel/helper-simple-access@npm:^7.17.7":
-  version: 7.17.7
-  resolution: "@babel/helper-simple-access@npm:7.17.7"
+"@codemirror/lang-css@npm:^6.0.0":
+  version: 6.3.1
+  resolution: "@codemirror/lang-css@npm:6.3.1"
   dependencies:
-    "@babel/types": ^7.17.0
-  checksum: 58a9bfd054720024f6ff47fbb113c96061dc2bd31a5e5285756bd3c2e83918c6926900e00150d0fb175d899494fe7d69bf2a8b278c32ef6f6bea8d032e6a3831
+    "@codemirror/autocomplete": ^6.0.0
+    "@codemirror/language": ^6.0.0
+    "@codemirror/state": ^6.0.0
+    "@lezer/common": ^1.0.2
+    "@lezer/css": ^1.1.7
+  checksum: ed175d75d75bc0a059d1e60b3dcd8464d570da14fc97388439943c9c43e1e9146e37b83fe2ccaad9cd387420b7b411ea1d24ede78ecd1f2045a38acbb4dd36bc
   languageName: node
   linkType: hard
 
-"@babel/helper-simple-access@npm:^7.18.2":
-  version: 7.18.2
-  resolution: "@babel/helper-simple-access@npm:7.18.2"
+"@codemirror/lang-go@npm:^6.0.1":
+  version: 6.0.1
+  resolution: "@codemirror/lang-go@npm:6.0.1"
   dependencies:
-    "@babel/types": ^7.18.2
-  checksum: c0862b56db7e120754d89273a039b128c27517389f6a4425ff24e49779791e8fe10061579171fb986be81fa076778acb847c709f6f5e396278d9c5e01360c375
+    "@codemirror/autocomplete": ^6.0.0
+    "@codemirror/language": ^6.6.0
+    "@codemirror/state": ^6.0.0
+    "@lezer/common": ^1.0.0
+    "@lezer/go": ^1.0.0
+  checksum: 80138a4ead5757698468c26d888f877477a2567d86e835ca0c1fd8b8f87ad5107e60bcc3b377add1ce8cdcc6e7bb37983ca1c7694f18a03bec8c4280a51dc7bd
   languageName: node
   linkType: hard
 
-"@babel/helper-simple-access@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/helper-simple-access@npm:7.18.6"
+"@codemirror/lang-html@npm:^6.0.0":
+  version: 6.4.9
+  resolution: "@codemirror/lang-html@npm:6.4.9"
   dependencies:
-    "@babel/types": ^7.18.6
-  checksum: 37cd36eef199e0517845763c1e6ff6ea5e7876d6d707a6f59c9267c547a50aa0e84260ba9285d49acfaf2cfa0a74a772d92967f32ac1024c961517d40b6c16a5
+    "@codemirror/autocomplete": ^6.0.0
+    "@codemirror/lang-css": ^6.0.0
+    "@codemirror/lang-javascript": ^6.0.0
+    "@codemirror/language": ^6.4.0
+    "@codemirror/state": ^6.0.0
+    "@codemirror/view": ^6.17.0
+    "@lezer/common": ^1.0.0
+    "@lezer/css": ^1.1.0
+    "@lezer/html": ^1.3.0
+  checksum: ac8c3ceb0396f2e032752c5079bd950124dca708bc64e96fc147dc5fe7133e5cee0814fe951abdb953ec1d11fa540e4b30a712b5149d9a36016a197a28de45d7
   languageName: node
   linkType: hard
 
-"@babel/helper-simple-access@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-simple-access@npm:7.22.5"
+"@codemirror/lang-javascript@npm:^6.0.0, @codemirror/lang-javascript@npm:^6.2.2":
+  version: 6.2.4
+  resolution: "@codemirror/lang-javascript@npm:6.2.4"
   dependencies:
-    "@babel/types": ^7.22.5
-  checksum: fe9686714caf7d70aedb46c3cce090f8b915b206e09225f1e4dbc416786c2fdbbee40b38b23c268b7ccef749dd2db35f255338fb4f2444429874d900dede5ad2
+    "@codemirror/autocomplete": ^6.0.0
+    "@codemirror/language": ^6.6.0
+    "@codemirror/lint": ^6.0.0
+    "@codemirror/state": ^6.0.0
+    "@codemirror/view": ^6.17.0
+    "@lezer/common": ^1.0.0
+    "@lezer/javascript": ^1.0.0
+  checksum: 0350e9ac2df155c4ecf75d556f40b677c284c1d320620dc7228e2aa458e258dd1145c86e5ebf3451347ed6ef528f72c2eb60f5d3f6bd10af8aabb2819109e21a
   languageName: node
   linkType: hard
 
-"@babel/helper-skip-transparent-expression-wrappers@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-skip-transparent-expression-wrappers@npm:7.16.0"
+"@codemirror/lang-json@npm:^6.0.1":
+  version: 6.0.1
+  resolution: "@codemirror/lang-json@npm:6.0.1"
   dependencies:
-    "@babel/types": ^7.16.0
-  checksum: b9ed2896eb253e6a85f472b0d4098ed80403758ad1a4e34b02b11e8276e3083297526758b1a3e6886e292987266f10622d7dbced3508cc22b296a74903b41cfb
+    "@codemirror/language": ^6.0.0
+    "@lezer/json": ^1.0.0
+  checksum: e9e87d50ff7b81bd56a6ab50740b1dd54e9a93f1be585e1d59d0642e2148842ea1528ac7b7221eb4ddc7fe84bbc28065144cc3ab86f6e06c6aeb2d4b4e62acf1
   languageName: node
   linkType: hard
 
-"@babel/helper-skip-transparent-expression-wrappers@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-skip-transparent-expression-wrappers@npm:7.22.5"
+"@codemirror/lang-markdown@npm:^6.3.2":
+  version: 6.3.2
+  resolution: "@codemirror/lang-markdown@npm:6.3.2"
   dependencies:
-    "@babel/types": ^7.22.5
-  checksum: 1012ef2295eb12dc073f2b9edf3425661e9b8432a3387e62a8bc27c42963f1f216ab3124228015c748770b2257b4f1fda882ca8fa34c0bf485e929ae5bc45244
+    "@codemirror/autocomplete": ^6.7.1
+    "@codemirror/lang-html": ^6.0.0
+    "@codemirror/language": ^6.3.0
+    "@codemirror/state": ^6.0.0
+    "@codemirror/view": ^6.0.0
+    "@lezer/common": ^1.2.1
+    "@lezer/markdown": ^1.0.0
+  checksum: f136d50156f13619d7ceb4fae28fc2342064be371a6cb057ba304658d885cf029d2d0d69b03b3c591c86a2c9b46bb2b3820549d5ff936a9b6aabaf692923c84a
   languageName: node
   linkType: hard
 
-"@babel/helper-split-export-declaration@npm:^7.12.13, @babel/helper-split-export-declaration@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-split-export-declaration@npm:7.16.0"
+"@codemirror/lang-sql@npm:^6.8.0":
+  version: 6.8.0
+  resolution: "@codemirror/lang-sql@npm:6.8.0"
   dependencies:
-    "@babel/types": ^7.16.0
-  checksum: 8bd87b5ea2046b145f0f55bc75cbdb6df69eaeb32919ee3c1c758757025aebca03e567a4d48389eb4f16a55021adb6ed8fa58aa771e164b15fa5e0a0722f771d
+    "@codemirror/autocomplete": ^6.0.0
+    "@codemirror/language": ^6.0.0
+    "@codemirror/state": ^6.0.0
+    "@lezer/common": ^1.2.0
+    "@lezer/highlight": ^1.0.0
+    "@lezer/lr": ^1.0.0
+  checksum: 1b5a3c8129b09f24039d8c0906fc4cb8d0f706a424a1d56721057bd1e647797c2b1240bb53eed9bf2bac5806a4e0363e555a3963f04c478efa05829890c537f7
   languageName: node
   linkType: hard
 
-"@babel/helper-split-export-declaration@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-split-export-declaration@npm:7.16.7"
+"@codemirror/lang-yaml@npm:^6.1.2":
+  version: 6.1.2
+  resolution: "@codemirror/lang-yaml@npm:6.1.2"
   dependencies:
-    "@babel/types": ^7.16.7
-  checksum: e10aaf135465c55114627951b79115f24bc7af72ecbb58d541d66daf1edaee5dde7cae3ec8c3639afaf74526c03ae3ce723444e3b5b3dc77140c456cd84bcaa1
+    "@codemirror/autocomplete": ^6.0.0
+    "@codemirror/language": ^6.0.0
+    "@codemirror/state": ^6.0.0
+    "@lezer/common": ^1.2.0
+    "@lezer/highlight": ^1.2.0
+    "@lezer/lr": ^1.0.0
+    "@lezer/yaml": ^1.0.0
+  checksum: a33946f5928b6b52767d72149722c9156635830ca20861bcd1198ee2adb435b208b3423d3025a85dde3806e30746574a3eb18874a9f5556697ac0bd86e5b0b55
   languageName: node
   linkType: hard
 
-"@babel/helper-split-export-declaration@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/helper-split-export-declaration@npm:7.18.6"
+"@codemirror/language@npm:^6.0.0, @codemirror/language@npm:^6.10.3, @codemirror/language@npm:^6.3.0, @codemirror/language@npm:^6.4.0, @codemirror/language@npm:^6.6.0":
+  version: 6.11.0
+  resolution: "@codemirror/language@npm:6.11.0"
   dependencies:
-    "@babel/types": ^7.18.6
-  checksum: c6d3dede53878f6be1d869e03e9ffbbb36f4897c7cc1527dc96c56d127d834ffe4520a6f7e467f5b6f3c2843ea0e81a7819d66ae02f707f6ac057f3d57943a2b
+    "@codemirror/state": ^6.0.0
+    "@codemirror/view": ^6.23.0
+    "@lezer/common": ^1.1.0
+    "@lezer/highlight": ^1.0.0
+    "@lezer/lr": ^1.0.0
+    style-mod: ^4.0.0
+  checksum: 5556dc163d5bd1d771a4f64e2750d3d1dc1f39030bc6e4b9a4704e4de7501e8d3511002e0f8f96cd8deef782730e0b49b576e30f0ea820e1c632995bd75caddd
   languageName: node
   linkType: hard
 
-"@babel/helper-split-export-declaration@npm:^7.22.6":
-  version: 7.22.6
-  resolution: "@babel/helper-split-export-declaration@npm:7.22.6"
+"@codemirror/legacy-modes@npm:^6.4.2":
+  version: 6.5.1
+  resolution: "@codemirror/legacy-modes@npm:6.5.1"
   dependencies:
-    "@babel/types": ^7.22.5
-  checksum: e141cace583b19d9195f9c2b8e17a3ae913b7ee9b8120246d0f9ca349ca6f03cb2c001fd5ec57488c544347c0bb584afec66c936511e447fd20a360e591ac921
+    "@codemirror/language": ^6.0.0
+  checksum: ad92399fdd5f7342d2b8d1ef450ac01cee96f2266938ca09de5047998bf6ac7a085dfe9941feb9ef6a924fda80aa7a1dc0ddc5dd6ce9c3ceaa36bcc14c5b2264
   languageName: node
   linkType: hard
 
-"@babel/helper-string-parser@npm:^7.18.10":
-  version: 7.18.10
-  resolution: "@babel/helper-string-parser@npm:7.18.10"
-  checksum: d554a4393365b624916b5c00a4cc21c990c6617e7f3fe30be7d9731f107f12c33229a7a3db9d829bfa110d2eb9f04790745d421640e3bd245bb412dc0ea123c1
+"@codemirror/lint@npm:^6.0.0, @codemirror/lint@npm:^6.8.4":
+  version: 6.8.5
+  resolution: "@codemirror/lint@npm:6.8.5"
+  dependencies:
+    "@codemirror/state": ^6.0.0
+    "@codemirror/view": ^6.35.0
+    crelt: ^1.0.5
+  checksum: 76fa457c6664f333216aacb0112bce8a0e2fd7011c180b7c855027dbb871dc112a31bf828f5affc0e53973111dee3aac4c9c3b80ade8534ac9748f296fb77abc
   languageName: node
   linkType: hard
 
-"@babel/helper-string-parser@npm:^7.19.4":
-  version: 7.19.4
-  resolution: "@babel/helper-string-parser@npm:7.19.4"
-  checksum: b2f8a3920b30dfac81ec282ac4ad9598ea170648f8254b10f475abe6d944808fb006aab325d3eb5a8ad3bea8dfa888cfa6ef471050dae5748497c110ec060943
+"@codemirror/state@npm:^6.0.0, @codemirror/state@npm:^6.4.0, @codemirror/state@npm:^6.5.0":
+  version: 6.5.2
+  resolution: "@codemirror/state@npm:6.5.2"
+  dependencies:
+    "@marijn/find-cluster-break": ^1.0.0
+  checksum: 4473a79475070d73f2e72f2eaaee5b69d2833b5020faa9714609d95dd03f0e5ad02cad8031a541dcd748436842a300332a2925317b39ffa09e3b4831145d98bc
   languageName: node
   linkType: hard
 
-"@babel/helper-string-parser@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-string-parser@npm:7.22.5"
-  checksum: 836851ca5ec813077bbb303acc992d75a360267aa3b5de7134d220411c852a6f17de7c0d0b8c8dcc0f567f67874c00f4528672b2a4f1bc978a3ada64c8c78467
+"@codemirror/view@npm:^6.0.0, @codemirror/view@npm:^6.17.0, @codemirror/view@npm:^6.23.0, @codemirror/view@npm:^6.27.0, @codemirror/view@npm:^6.35.0, @codemirror/view@npm:^6.36.2":
+  version: 6.36.8
+  resolution: "@codemirror/view@npm:6.36.8"
+  dependencies:
+    "@codemirror/state": ^6.5.0
+    style-mod: ^4.1.0
+    w3c-keyname: ^2.2.4
+  checksum: 6b5bbbd6f73bf2486170e3ee6b13660b8919ec544dc527dbe6357034a534dbd7deea3e660fbcd67c5e53ea808d6411ddd355eb9cf3dc4dded2a7c3f95a7fb0ac
   languageName: node
   linkType: hard
 
-"@babel/helper-string-parser@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/helper-string-parser@npm:7.23.4"
-  checksum: c0641144cf1a7e7dc93f3d5f16d5327465b6cf5d036b48be61ecba41e1eece161b48f46b7f960951b67f8c3533ce506b16dece576baef4d8b3b49f8c65410f90
+"@colors/colors@npm:1.5.0":
+  version: 1.5.0
+  resolution: "@colors/colors@npm:1.5.0"
+  checksum: d64d5260bed1d5012ae3fc617d38d1afc0329fec05342f4e6b838f46998855ba56e0a73833f4a80fa8378c84810da254f76a8a19c39d038260dc06dc4e007425
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-identifier@npm:^7.14.0, @babel/helper-validator-identifier@npm:^7.15.7":
-  version: 7.15.7
-  resolution: "@babel/helper-validator-identifier@npm:7.15.7"
-  checksum: f041c28c531d1add5cc345b25d5df3c29c62bce3205b4d4a93dcd164ccf630350acba252d374fad8f5d8ea526995a215829f27183ba7ce7ce141843bf23068a6
+"@csstools/css-parser-algorithms@npm:^3.0.4":
+  version: 3.0.4
+  resolution: "@csstools/css-parser-algorithms@npm:3.0.4"
+  peerDependencies:
+    "@csstools/css-tokenizer": ^3.0.3
+  checksum: 5b6b2b97fbe0a0c5652e44613bcf62ec89a93f64069a48f6cd63b5757c7dc227970c54c50a8212b9feb90aff399490636a58366df3ca733d490d911768eaddaf
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-identifier@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-validator-identifier@npm:7.16.7"
-  checksum: dbb3db9d184343152520a209b5684f5e0ed416109cde82b428ca9c759c29b10c7450657785a8b5c5256aa74acc6da491c1f0cf6b784939f7931ef82982051b69
+"@csstools/css-tokenizer@npm:^3.0.3":
+  version: 3.0.3
+  resolution: "@csstools/css-tokenizer@npm:3.0.3"
+  checksum: 6b300beba1b29c546b720887be18a40bafded5dc96550fb87d61fbc2c550e9632e7baafa2bf34a66e0f25fb6b70558ee67ef3b45856aa5e621febc2124cf5039
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-identifier@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/helper-validator-identifier@npm:7.18.6"
-  checksum: e295254d616bbe26e48c196a198476ab4d42a73b90478c9842536cf910ead887f5af6b5c4df544d3052a25ccb3614866fa808dc1e3a5a4291acd444e243c0648
+"@csstools/media-query-list-parser@npm:^4.0.2":
+  version: 4.0.2
+  resolution: "@csstools/media-query-list-parser@npm:4.0.2"
+  peerDependencies:
+    "@csstools/css-parser-algorithms": ^3.0.4
+    "@csstools/css-tokenizer": ^3.0.3
+  checksum: 5265675655ffe2242c272c344bdb77932d44fa7bf45d4de26793406cc287047b64a007d26f32c40db242bc9866dc4020da308a3b590a9a3dc7561089ca18cdea
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-identifier@npm:^7.19.1":
-  version: 7.19.1
-  resolution: "@babel/helper-validator-identifier@npm:7.19.1"
-  checksum: 0eca5e86a729162af569b46c6c41a63e18b43dbe09fda1d2a3c8924f7d617116af39cac5e4cd5d431bb760b4dca3c0970e0c444789b1db42bcf1fa41fbad0a3a
+"@csstools/selector-specificity@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "@csstools/selector-specificity@npm:5.0.0"
+  peerDependencies:
+    postcss-selector-parser: ^7.0.0
+  checksum: 8df1a01a1fa52b66c7ba0286e1c77d1faff45009876f09ddcac542a1c4bca9f34ee92a10acf056b8e7b7ac93679c1635496c6cdfd7d88dbaff2b6afd1eb823ec
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-identifier@npm:^7.22.20":
-  version: 7.22.20
-  resolution: "@babel/helper-validator-identifier@npm:7.22.20"
-  checksum: 136412784d9428266bcdd4d91c32bcf9ff0e8d25534a9d94b044f77fe76bc50f941a90319b05aafd1ec04f7d127cd57a179a3716009ff7f3412ef835ada95bdc
+"@discoveryjs/json-ext@npm:^0.6.1":
+  version: 0.6.3
+  resolution: "@discoveryjs/json-ext@npm:0.6.3"
+  checksum: 8305a5feb9bbaedbfdb91f938cb577f98c34cb432535dbc7af5e5df7f1cb3d1895f7a9ec0d956b5bd9e980e5b7f8cd36684c4c9ed219e6e556e0dfe367c4cb66
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-identifier@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-validator-identifier@npm:7.22.5"
-  checksum: 7f0f30113474a28298c12161763b49de5018732290ca4de13cdaefd4fd0d635a6fe3f6686c37a02905fb1e64f21a5ee2b55140cf7b070e729f1bd66866506aea
+"@dmsnell/diff-match-patch@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "@dmsnell/diff-match-patch@npm:1.1.0"
+  checksum: 4472487045f0bed40abbf5708542f596bf9576e1e6bd4ae01d8ddb694f857be51ca56599c95c61d1433f3d57da2e6c6f3e175609864eea601a47a26a68750ca0
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-option@npm:^7.12.17, @babel/helper-validator-option@npm:^7.14.5":
-  version: 7.14.5
-  resolution: "@babel/helper-validator-option@npm:7.14.5"
-  checksum: 1b25c34a5cb3d8602280f33b9ab687d2a77895e3616458d0f70ddc450ada9b05e342c44f322bc741d51b252e84cff6ec44ae93d622a3354828579a643556b523
+"@docfy/core@npm:^0.8.0":
+  version: 0.8.0
+  resolution: "@docfy/core@npm:0.8.0"
+  dependencies:
+    debug: ^4.3.3
+    fast-glob: ^3.2.11
+    git-repo-info: ^2.1.1
+    github-slugger: ^1.4.0
+    hosted-git-info: ^3.0.8
+    mdast-util-to-string: ^2.0.0
+    mdast-util-toc: ^5.1.0
+    rehype-stringify: ^8.0.0
+    remark-extract-frontmatter: ^3.1.0
+    remark-frontmatter: ^3.0.0
+    remark-gfm: ^1.0.0
+    remark-normalize-headings: ^2.0.0
+    remark-parse: ^9.0.0
+    remark-rehype: ^8.0.0
+    remark-slug: ^6.0.0
+    to-vfile: ^6.1.0
+    trough: ^1.0.5
+    unified: ^9.0.0
+    unist-util-visit: ^2.0.2
+    yaml: ^2.2.2
+  checksum: 2666ce8bddf66160126a4cd525adc6dc97c0f32094331f21ebd214bb8bd4acb34218173b81b14123f3637a8c978fac78080e4c6cdf268a1f4a58751e40f463a2
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-option@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/helper-validator-option@npm:7.16.7"
-  checksum: c5ccc451911883cc9f12125d47be69434f28094475c1b9d2ada7c3452e6ac98a1ee8ddd364ca9e3f9855fcdee96cdeafa32543ebd9d17fee7a1062c202e80570
+"@docfy/ember@npm:~0.8.5":
+  version: 0.8.5
+  resolution: "@docfy/ember@npm:0.8.5"
+  dependencies:
+    "@docfy/core": ^0.8.0
+    broccoli-bridge: ^1.0.0
+    broccoli-file-creator: ^2.1.1
+    broccoli-funnel: ^3.0.8
+    broccoli-merge-trees: ^4.2.0
+    broccoli-node-api: ^1.7.0
+    broccoli-plugin: ^4.0.7
+    broccoli-source: ^3.0.1
+    calculate-cache-key-for-tree: 2.0.0
+    debug: ^4.3.3
+    ember-cli-babel: ^8.2.0
+    ember-cli-htmlbars: ^6.3.0
+    ember-cli-typescript: ^4.2.1
+    ember-get-config: ^1.0.2
+    mdast-util-to-string: ^2.0.0
+    remark-hbs: ^0.4.1
+    unist-builder: ^2.0.3
+    unist-util-find: ^1.0.2
+    unist-util-visit: ^2.0.2
+  checksum: eda0cf4b36dc3e90dab04208c5ea400ea3cd186cb41f16fe0d81c795082ddfbc9c778bc062f1d3d58130196e0998e2945ec6394d8990c4985ee30f952b3cf266
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-option@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/helper-validator-option@npm:7.18.6"
-  checksum: f9cc6eb7cc5d759c5abf006402180f8d5e4251e9198197428a97e05d65eb2f8ae5a0ce73b1dfd2d35af41d0eb780627a64edf98a4e71f064eeeacef8de58f2cf
+"@dual-bundle/import-meta-resolve@npm:^4.1.0":
+  version: 4.1.0
+  resolution: "@dual-bundle/import-meta-resolve@npm:4.1.0"
+  checksum: 8a79576624d66f3ee578cb4cd7f7dac9282dc4c6f757c7c1f4c364fdbabc99584e1407e49e1ef00c0b42dab01d1f8490ec1d08a02c1238bad657a7335303d462
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-option@npm:^7.22.15, @babel/helper-validator-option@npm:^7.23.5":
-  version: 7.23.5
-  resolution: "@babel/helper-validator-option@npm:7.23.5"
-  checksum: 537cde2330a8aede223552510e8a13e9c1c8798afee3757995a7d4acae564124fe2bf7e7c3d90d62d3657434a74340a274b3b3b1c6f17e9a2be1f48af29cb09e
+"@ember-data/adapter@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/adapter@npm:5.3.13"
+  dependencies:
+    "@ember/edition-utils": 1.2.0
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+    ember-cli-path-utils: ^1.0.0
+    ember-cli-string-utils: ^1.1.0
+    ember-cli-test-info: ^1.0.0
+  peerDependencies:
+    "@ember-data/legacy-compat": 5.3.13
+    "@ember-data/request-utils": 5.3.13
+    "@ember-data/store": 5.3.13
+    "@warp-drive/core-types": 0.0.3
+    ember-source: 3.28.12 || ^4.0.4 || ^5.0.0 || ^6.0.0
+  checksum: 108d7c887acf2863065429066e077268b3e85ef95d1359b187ef11eb2279cfdaee359dbc0b47f9ed50f5e792ecdace48bd9f00dcba5ebae74e3fb29300cdf1f6
   languageName: node
   linkType: hard
 
-"@babel/helper-validator-option@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/helper-validator-option@npm:7.22.5"
-  checksum: bbeca8a85ee86990215c0424997438b388b8d642d69b9f86c375a174d3cdeb270efafd1ff128bc7a1d370923d13b6e45829ba8581c027620e83e3a80c5c414b3
+"@ember-data/debug@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/debug@npm:5.3.13"
+  dependencies:
+    "@ember/edition-utils": ^1.2.0
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+  peerDependencies:
+    "@ember-data/model": 5.3.13
+    "@ember-data/request-utils": 5.3.13
+    "@ember-data/store": 5.3.13
+    "@warp-drive/core-types": 0.0.3
+    ember-source: 3.28.12 || ^4.0.4 || ^5.0.0 || ^6.0.0
+  checksum: aeba701964379ee1e61cfe14bb83c180f238277c958be39d489ecb77e9800b7c5909ed0bfeecc23f23ae7003cb00a2dff78820715014d1b453afc396ceb4aa42
   languageName: node
   linkType: hard
 
-"@babel/helper-wrap-function@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/helper-wrap-function@npm:7.16.0"
+"@ember-data/graph@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/graph@npm:5.3.13"
   dependencies:
-    "@babel/helper-function-name": ^7.16.0
-    "@babel/template": ^7.16.0
-    "@babel/traverse": ^7.16.0
-    "@babel/types": ^7.16.0
-  checksum: 2bb4e05f49cf217cc5890581284a051245ba0ddaccbe3ddd662010d7a6969f52d2027e310d26db2e030273c5fe9341448c7845fcb4795ad8eb56bdeabec148b8
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+  peerDependencies:
+    "@ember-data/store": 5.3.13
+    "@warp-drive/core-types": 0.0.3
+    ember-source: 3.28.12 || ^4.0.4 || ^5.0.0 || ^6.0.0
+  checksum: 020f3dedf1001fbc30b8f8d3e2b4cf7c621ef866ff31f4062b9c5d26ed1fd1fbd3cce4443330e15c7cff747a5aa65f7d706ccaacac77bb678167ace1f6f4691d
   languageName: node
   linkType: hard
 
-"@babel/helper-wrap-function@npm:^7.16.8":
-  version: 7.16.8
-  resolution: "@babel/helper-wrap-function@npm:7.16.8"
+"@ember-data/json-api@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/json-api@npm:5.3.13"
   dependencies:
-    "@babel/helper-function-name": ^7.16.7
-    "@babel/template": ^7.16.7
-    "@babel/traverse": ^7.16.8
-    "@babel/types": ^7.16.8
-  checksum: d8aae4bacaf138d47dca1421ba82b41eac954cbb0ad17ab1c782825c6f2afe20076fbed926ab265967758336de5112d193a363128cd1c6967c66e0151174f797
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+    fuse.js: 7.1.0
+    json-to-ast: 2.1.0
+  peerDependencies:
+    "@ember-data/graph": 5.3.13
+    "@ember-data/request-utils": 5.3.13
+    "@ember-data/store": 5.3.13
+    "@warp-drive/core-types": 0.0.3
+  checksum: d88d510c97bfb02c3863f49e3c078c03cf76a807decf97b380c81b234008cf096469c657c964bbeac652158cd5cf400265cb1acf0bf399994d9e2d08f08218d0
   languageName: node
   linkType: hard
 
-"@babel/helper-wrap-function@npm:^7.22.20":
-  version: 7.22.20
-  resolution: "@babel/helper-wrap-function@npm:7.22.20"
+"@ember-data/legacy-compat@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/legacy-compat@npm:5.3.13"
   dependencies:
-    "@babel/helper-function-name": ^7.22.5
-    "@babel/template": ^7.22.15
-    "@babel/types": ^7.22.19
-  checksum: 221ed9b5572612aeb571e4ce6a256f2dee85b3c9536f1dd5e611b0255e5f59a3d0ec392d8d46d4152149156a8109f92f20379b1d6d36abb613176e0e33f05fca
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+  peerDependencies:
+    "@ember-data/graph": 5.3.13
+    "@ember-data/json-api": 5.3.13
+    "@ember-data/request": 5.3.13
+    "@ember-data/request-utils": 5.3.13
+    "@ember-data/store": 5.3.13
+    "@ember/test-waiters": ^3.1.0 || >= 4.0.0
+    "@warp-drive/core-types": 0.0.3
+    ember-source: 3.28.12 || ^4.0.4 || ^5.0.0 || ^6.0.0
+  peerDependenciesMeta:
+    "@ember-data/graph":
+      optional: true
+    "@ember-data/json-api":
+      optional: true
+  checksum: 799056a9e366a717b84f0d6fc3073f675292402b2276c364c634a7ec57b5c055bf74d42aa717bf306d6e18ea5b7458e587703bf99a0fa7c545dae99186d274e4
   languageName: node
   linkType: hard
 
-"@babel/helpers@npm:^7.14.0, @babel/helpers@npm:^7.16.0":
-  version: 7.16.3
-  resolution: "@babel/helpers@npm:7.16.3"
+"@ember-data/model@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/model@npm:5.3.13"
   dependencies:
-    "@babel/template": ^7.16.0
-    "@babel/traverse": ^7.16.3
-    "@babel/types": ^7.16.0
-  checksum: b725b1aab734e9e1407247ee499880583855843fa2855377a2c26277bd9fbd7080219109189bc69b18d71cc30759666bfe66d534729b41452097866d1f5a66ef
+    "@ember/edition-utils": ^1.2.0
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+    ember-cli-string-utils: ^1.1.0
+    ember-cli-test-info: ^1.0.0
+    inflection: ~3.0.2
+  peerDependencies:
+    "@ember-data/graph": 5.3.13
+    "@ember-data/json-api": 5.3.13
+    "@ember-data/legacy-compat": 5.3.13
+    "@ember-data/request-utils": 5.3.13
+    "@ember-data/store": 5.3.13
+    "@ember-data/tracking": 5.3.13
+    "@warp-drive/core-types": 0.0.3
+    ember-source: 3.28.12 || ^4.0.4 || ^5.0.0 || ^6.0.0
+  peerDependenciesMeta:
+    "@ember-data/graph":
+      optional: true
+    "@ember-data/json-api":
+      optional: true
+  checksum: 3c72993075aca76429265d11aa5e4c52c089aa929d46e1ccc053181210a2c236c58e0620777f0feadcc799dcc864afbedeee56d3470e4fc2659dcf338dd6856e
   languageName: node
   linkType: hard
 
-"@babel/helpers@npm:^7.17.8":
-  version: 7.17.8
-  resolution: "@babel/helpers@npm:7.17.8"
+"@ember-data/request-utils@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/request-utils@npm:5.3.13"
   dependencies:
-    "@babel/template": ^7.16.7
-    "@babel/traverse": ^7.17.3
-    "@babel/types": ^7.17.0
-  checksum: 463dad58119fefebf2d0201bfa53ec9607aa00356908895640fc07589747fb3c2e0dfee4019f3e8c9781e57c9aa5dff4c72ec8d1b031c4ed8349f90b6aefe99d
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+  peerDependencies:
+    "@ember/string": ^3.1.1 || ^4.0.0
+    "@warp-drive/core-types": 0.0.3
+    ember-inflector: ^4.0.2 || ^5.0.0 || ^6.0.0
+    ember-source: 3.28.12 || ^4.0.4 || ^5.0.0 || ^6.0.0
+  peerDependenciesMeta:
+    "@ember/string":
+      optional: true
+    ember-inflector:
+      optional: true
+  checksum: 4a03d6e6ee88b5deafe12e1456a3f223d00544a80d040848dba8e7272ee3282c97ac61dc99c1ea9ed4ad2b2617872e77495e6cb43255c0ee5c3615be98da529a
   languageName: node
   linkType: hard
 
-"@babel/helpers@npm:^7.18.2":
-  version: 7.18.2
-  resolution: "@babel/helpers@npm:7.18.2"
+"@ember-data/request@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/request@npm:5.3.13"
   dependencies:
-    "@babel/template": ^7.16.7
-    "@babel/traverse": ^7.18.2
-    "@babel/types": ^7.18.2
-  checksum: 94620242f23f6d5f9b83a02b1aa1632ffb05b0815e1bb53d3b46d64aa8e771066bba1db8bd267d9091fb00134cfaeda6a8d69d1d4cc2c89658631adfa077ae70
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+  peerDependencies:
+    "@ember/test-waiters": ^3.1.0 || ^4.0.0
+    "@warp-drive/core-types": 0.0.3
+  checksum: a8e17f0cabf8230a2de41b235590d0b16971c0aa4c9b88cf02a3eb83a0eae2f2052ed367189ef770aa5f6444307cad328926df24b8c12b6e642c1b5bd6e2f219
   languageName: node
   linkType: hard
 
-"@babel/helpers@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/helpers@npm:7.19.0"
-  dependencies:
-    "@babel/template": ^7.18.10
-    "@babel/traverse": ^7.19.0
-    "@babel/types": ^7.19.0
-  checksum: e50e78e0dbb0435075fa3f85021a6bcae529589800bca0292721afd7f7c874bea54508d6dc57eca16e5b8224f8142c6b0e32e3b0140029dc09865da747da4623
+"@ember-data/rfc395-data@npm:^0.0.4":
+  version: 0.0.4
+  resolution: "@ember-data/rfc395-data@npm:0.0.4"
+  checksum: 59760b1f7b1cf131fe4a3b817b912e7e62e69e100acd813db37d11106a40c1b22da068cd7d4cdc1bb4c69b0dbde45c96ebff848b6b2380715eae7896bb2e109c
   languageName: node
   linkType: hard
 
-"@babel/helpers@npm:^7.22.6":
-  version: 7.22.6
-  resolution: "@babel/helpers@npm:7.22.6"
+"@ember-data/serializer@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/serializer@npm:5.3.13"
   dependencies:
-    "@babel/template": ^7.22.5
-    "@babel/traverse": ^7.22.6
-    "@babel/types": ^7.22.5
-  checksum: 5c1f33241fe7bf7709868c2105134a0a86dca26a0fbd508af10a89312b1f77ca38ebae43e50be3b208613c5eacca1559618af4ca236f0abc55d294800faeff30
+    "@ember/edition-utils": 1.2.0
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+    ember-cli-path-utils: ^1.0.0
+    ember-cli-string-utils: ^1.1.0
+    ember-cli-test-info: ^1.0.0
+  peerDependencies:
+    "@ember-data/legacy-compat": 5.3.13
+    "@ember-data/request-utils": 5.3.13
+    "@ember-data/store": 5.3.13
+    "@warp-drive/core-types": 0.0.3
+    ember-source: 3.28.12 || ^4.0.4 || ^5.0.0 || ^6.0.0
+  checksum: a9a16d8cfec11875100e2dedcdd80ec49178a774fe475f56c2cdf35bbc99bf6ac62e852fda9c69b475118cc52ae4515306928d6a9cb3b008902309bcf0679c4a
   languageName: node
   linkType: hard
 
-"@babel/helpers@npm:^7.23.7":
-  version: 7.23.7
-  resolution: "@babel/helpers@npm:7.23.7"
+"@ember-data/store@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/store@npm:5.3.13"
   dependencies:
-    "@babel/template": ^7.22.15
-    "@babel/traverse": ^7.23.7
-    "@babel/types": ^7.23.6
-  checksum: 4f3bdf35fb54ff79107c6020ba1e36a38213a15b05ca0fa06c553b65f566e185fba6339fb3344be04593ebc244ed0bbb0c6087e73effe0d053a30bcd2db3a013
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+  peerDependencies:
+    "@ember-data/request": 5.3.13
+    "@ember-data/request-utils": 5.3.13
+    "@ember-data/tracking": 5.3.13
+    "@warp-drive/core-types": 0.0.3
+    ember-source: 3.28.12 || ^4.0.4 || ^5.0.0 || ^6.0.0
+  checksum: 2e554a6a783a73fd334d1b27597f3fcde5165bfd648ee19bb7f1cbcd305e2ae856de640b1e7292b22e88aa1bb5520bc856c5fd3ac9790bbeda428c545774df28
   languageName: node
   linkType: hard
 
-"@babel/highlight@npm:^7.12.13, @babel/highlight@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/highlight@npm:7.16.0"
+"@ember-data/tracking@npm:5.3.13":
+  version: 5.3.13
+  resolution: "@ember-data/tracking@npm:5.3.13"
   dependencies:
-    "@babel/helper-validator-identifier": ^7.15.7
-    chalk: ^2.0.0
-    js-tokens: ^4.0.0
-  checksum: abf244c48fcff20ec87830e8b99c776f4dcdd9138e63decc195719a94148da35339639e0d8045eb9d1f3e67a39ab90a9c3f5ce2d579fb1a0368d911ddf29b4e5
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+  peerDependencies:
+    "@warp-drive/core-types": 0.0.3
+    ember-source: 3.28.12 || ^4.0.4 || ^5.0.0 || ^6.0.0
+  checksum: c09b7ab962d22877d07183752a63a381af617dcd66d0ce1f6955bf7ff8e6aaffab2b02a2ed355267c5bf537461e2cc086666273e4d0180106cf767357de1f5f2
   languageName: node
   linkType: hard
 
-"@babel/highlight@npm:^7.16.7":
-  version: 7.16.10
-  resolution: "@babel/highlight@npm:7.16.10"
-  dependencies:
-    "@babel/helper-validator-identifier": ^7.16.7
-    chalk: ^2.0.0
-    js-tokens: ^4.0.0
-  checksum: 1f1bdd752a90844f4efc22166a46303fb651ba0fd75a06daba3ebae2575ab3edc1da9827c279872a3aaf305f50a18473c5fa1966752726a2b253065fd4c0745e
+"@ember/edition-utils@npm:1.2.0, @ember/edition-utils@npm:^1.2.0":
+  version: 1.2.0
+  resolution: "@ember/edition-utils@npm:1.2.0"
+  checksum: eb1eeb08b66344054acb34a4695a80dbfaeb678d10cb11327eec4c0d03b2324ad7c05d0239a7d0298d5f8931e1698d85cba23dac37bff18ab52104f678a0e8c7
   languageName: node
   linkType: hard
 
-"@babel/highlight@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/highlight@npm:7.18.6"
+"@ember/legacy-built-in-components@npm:~0.4.2":
+  version: 0.4.2
+  resolution: "@ember/legacy-built-in-components@npm:0.4.2"
   dependencies:
-    "@babel/helper-validator-identifier": ^7.18.6
-    chalk: ^2.0.0
-    js-tokens: ^4.0.0
-  checksum: 92d8ee61549de5ff5120e945e774728e5ccd57fd3b2ed6eace020ec744823d4a98e242be1453d21764a30a14769ecd62170fba28539b211799bbaf232bbb2789
+    "@embroider/macros": ^1.0.0
+    ember-cli-babel: ^7.26.6
+    ember-cli-htmlbars: ^5.7.1
+    ember-cli-typescript: ^4.1.0
+  peerDependencies:
+    ember-source: "*"
+  checksum: bf32d1f943d8e28e8a1e6890797761fc2ea25faf593dc82aa61c7fd8177595826f453a4197c4ad674fb838e6ddbcaf45d60b4b0baaf73716564873d3e4c617c9
   languageName: node
   linkType: hard
 
-"@babel/highlight@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/highlight@npm:7.22.5"
+"@ember/optional-features@npm:~2.2.0":
+  version: 2.2.0
+  resolution: "@ember/optional-features@npm:2.2.0"
   dependencies:
-    "@babel/helper-validator-identifier": ^7.22.5
-    chalk: ^2.0.0
-    js-tokens: ^4.0.0
-  checksum: f61ae6de6ee0ea8d9b5bcf2a532faec5ab0a1dc0f7c640e5047fc61630a0edb88b18d8c92eb06566d30da7a27db841aca11820ecd3ebe9ce514c9350fbed39c4
+    chalk: ^4.1.2
+    ember-cli-version-checker: ^5.1.2
+    glob: ^7.1.7
+    inquirer: ^7.3.3
+    mkdirp: ^1.0.4
+    silent-error: ^1.1.1
+  checksum: f4a1e91e9a735b746de830d90388edcffd6034fcb9551e22d8ce8ed1455944e270d31777e83d269c9ad5cf6376efe396de52dc096f8b96d4c31ac8d37f32919c
   languageName: node
   linkType: hard
 
-"@babel/highlight@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/highlight@npm:7.23.4"
+"@ember/render-modifiers@npm:^2.0.0, @ember/render-modifiers@npm:^2.0.2, @ember/render-modifiers@npm:^2.0.5, @ember/render-modifiers@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "@ember/render-modifiers@npm:2.1.0"
   dependencies:
-    "@babel/helper-validator-identifier": ^7.22.20
-    chalk: ^2.4.2
-    js-tokens: ^4.0.0
-  checksum: 643acecdc235f87d925979a979b539a5d7d1f31ae7db8d89047269082694122d11aa85351304c9c978ceeb6d250591ccadb06c366f358ccee08bb9c122476b89
+    "@embroider/macros": ^1.0.0
+    ember-cli-babel: ^7.26.11
+    ember-modifier-manager-polyfill: ^1.2.0
+  peerDependencies:
+    "@glint/template": ^1.0.2
+    ember-source: ^3.8 || ^4.0.0 || ^5.0.0
+  peerDependenciesMeta:
+    "@glint/template":
+      optional: true
+  checksum: 6c4d617b67ee52e8e29e9a2b9f42a30e8ea333a7b7a4c5a61fdf5f15623da11f40d82218aeddfbe32bee1f508c569740e842a8233f4a372728d18b66bbc197d5
   languageName: node
   linkType: hard
 
-"@babel/parser@npm:^7.12.3, @babel/parser@npm:^7.4.5":
-  version: 7.14.0
-  resolution: "@babel/parser@npm:7.14.0"
-  bin:
-    parser: ./bin/babel-parser.js
-  checksum: d1d82e6c2ecd1d66d873f3ae4f070bd687ee0d4e19ecf6b63a5daa735982ea0554a2ff7afd463d6754f8f28c9bc4b83264787d5a215b729f9552745ce76130f9
-  languageName: node
-  linkType: hard
-
-"@babel/parser@npm:^7.14.0, @babel/parser@npm:^7.16.0, @babel/parser@npm:^7.16.3":
-  version: 7.16.4
-  resolution: "@babel/parser@npm:7.16.4"
-  bin:
-    parser: ./bin/babel-parser.js
-  checksum: ce0a8f92f440f2a12bc932f070a7b60c5133bf8a63f461841f9e39af0194f573707959d606c6fad1a2fd496a45148553afd9b74d3b8dd36cdb7861598d1f3e36
+"@ember/render-modifiers@npm:~3.0.0":
+  version: 3.0.0
+  resolution: "@ember/render-modifiers@npm:3.0.0"
+  dependencies:
+    "@babel/core": ^7.25.2
+    "@embroider/macros": ^1.0.0
+    ember-cli-babel: ^8.2.0
+    ember-modifier-manager-polyfill: ^1.2.0
+  peerDependencies:
+    "@glint/template": ^1.0.2
+    ember-source: ">= 4.0.0"
+  peerDependenciesMeta:
+    "@glint/template":
+      optional: true
+  checksum: f6f44cfd92402c8ee967638286342f22defa2dc1e9b1f852bcd5bf857698e1a15e231b9dda6f9dc098be3469e240d4aca9f0279a75c627867f22eafa6ccf8c17
   languageName: node
   linkType: hard
 
-"@babel/parser@npm:^7.16.7, @babel/parser@npm:^7.17.3, @babel/parser@npm:^7.17.8":
-  version: 7.17.8
-  resolution: "@babel/parser@npm:7.17.8"
-  bin:
-    parser: ./bin/babel-parser.js
-  checksum: 1771808491982cc47baa888a997aef6b58308e3844c8c00f730f8fd97defe57d32cdbf46075cd49aaee310fa31f3d2c80a0d41b41a4ee0ff336ee09e2ff6c222
+"@ember/string@npm:^3.1.1":
+  version: 3.1.1
+  resolution: "@ember/string@npm:3.1.1"
+  dependencies:
+    ember-cli-babel: ^7.26.6
+  checksum: a2496735cb8cfc2d9484f7756fbb3e528db0a9bdf3acc8e86cc56491302777d806d1039186bf6c045aa3e40e464fd8d1cdac89fe97da274f3200844a7d3162c9
   languageName: node
   linkType: hard
 
-"@babel/parser@npm:^7.18.0":
-  version: 7.18.4
-  resolution: "@babel/parser@npm:7.18.4"
-  bin:
-    parser: ./bin/babel-parser.js
-  checksum: e05b2dc720c4b200e088258f3c2a2de5041c140444edc38181d1217b10074e881a7133162c5b62356061f26279f08df5a06ec14c5842996ee8601ad03c57a44f
+"@ember/string@npm:~4.0.1":
+  version: 4.0.1
+  resolution: "@ember/string@npm:4.0.1"
+  checksum: 3a5288847073929f08bdcc1fc71e266c19890463ff604c2f8b78ec58baee1856f6fd3347a8bb4b894a822b7fdb8fb7dae45241d83396bb9ae69f2ca8e8f2bd1e
   languageName: node
   linkType: hard
 
-"@babel/parser@npm:^7.18.10, @babel/parser@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/parser@npm:7.19.0"
-  bin:
-    parser: ./bin/babel-parser.js
-  checksum: af86d829bfeb60e0dcf54a43489c2514674b6c8d9bb24cf112706772125752fcd517877ad30501d533fa85f70a439d02eebeec3be9c2e95499853367184e0da7
+"@ember/test-helpers@npm:~5.2.1":
+  version: 5.2.2
+  resolution: "@ember/test-helpers@npm:5.2.2"
+  dependencies:
+    "@ember/test-waiters": ^3.1.0 || ^4.0.0
+    "@embroider/addon-shim": ^1.8.7
+    "@embroider/macros": ^1.16.5
+    "@simple-dom/interface": ^1.4.0
+    decorator-transforms: ^2.0.0
+    dom-element-descriptors: ^0.5.0
+  checksum: 94b7e707e8771f4908014243a937633ac38dacfb8e685725e52a2779bca28c63264381ac0ea41272dc601906172048593985862e386460cedf0609cee9352f19
   languageName: node
   linkType: hard
 
-"@babel/parser@npm:^7.22.15":
-  version: 7.23.5
-  resolution: "@babel/parser@npm:7.23.5"
-  bin:
-    parser: ./bin/babel-parser.js
-  checksum: ea763629310f71580c4a3ea9d3705195b7ba994ada2cc98f9a584ebfdacf54e92b2735d351672824c2c2b03c7f19206899f4d95650d85ce514a822b19a8734c7
+"@ember/test-waiters@npm:^2.4.3 || ^3.0.0 || ^4.0.0, @ember/test-waiters@npm:^3.1.0 || ^4.0.0, @ember/test-waiters@npm:~4.1.0":
+  version: 4.1.0
+  resolution: "@ember/test-waiters@npm:4.1.0"
+  dependencies:
+    "@embroider/addon-shim": ^1.9.0
+    "@embroider/macros": ^1.16.9
+  checksum: 0671a7a73b4e8e27d638dd306cb5142913dffcca51345483c7468daeeb31ebcfb42769e331787eba2b0359e34beaa9d8af7efac046671112ff4b01a3e9d406fd
   languageName: node
   linkType: hard
 
-"@babel/parser@npm:^7.22.5, @babel/parser@npm:^7.22.7":
-  version: 7.22.7
-  resolution: "@babel/parser@npm:7.22.7"
-  bin:
-    parser: ./bin/babel-parser.js
-  checksum: 02209ddbd445831ee8bf966fdf7c29d189ed4b14343a68eb2479d940e7e3846340d7cc6bd654a5f3d87d19dc84f49f50a58cf9363bee249dc5409ff3ba3dab54
+"@ember/test-waiters@npm:^3.0.0, @ember/test-waiters@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "@ember/test-waiters@npm:3.1.0"
+  dependencies:
+    calculate-cache-key-for-tree: ^2.0.0
+    ember-cli-babel: ^7.26.6
+    ember-cli-version-checker: ^5.1.2
+    semver: ^7.3.5
+  checksum: f5d8c75ec060f01d038c4f8f419f844e50928b9d7af518b00318844238b43a7b740fc2ec941f45c61fdf698977f2f8a47b34898faa7da2d09e3a38a8137ac8cf
   languageName: node
   linkType: hard
 
-"@babel/parser@npm:^7.23.6":
-  version: 7.23.6
-  resolution: "@babel/parser@npm:7.23.6"
-  bin:
-    parser: ./bin/babel-parser.js
-  checksum: 140801c43731a6c41fd193f5c02bc71fd647a0360ca616b23d2db8be4b9739b9f951a03fc7c2db4f9b9214f4b27c1074db0f18bc3fa653783082d5af7c8860d5
+"@embroider/addon-shim@npm:^1.0.0, @embroider/addon-shim@npm:^1.10.0, @embroider/addon-shim@npm:^1.2.0, @embroider/addon-shim@npm:^1.6.0, @embroider/addon-shim@npm:^1.8.0, @embroider/addon-shim@npm:^1.8.3, @embroider/addon-shim@npm:^1.8.6, @embroider/addon-shim@npm:^1.8.7, @embroider/addon-shim@npm:^1.8.9, @embroider/addon-shim@npm:^1.9.0":
+  version: 1.10.0
+  resolution: "@embroider/addon-shim@npm:1.10.0"
+  dependencies:
+    "@embroider/shared-internals": ^3.0.0
+    broccoli-funnel: ^3.0.8
+    common-ancestor-path: ^1.0.1
+    semver: ^7.3.8
+  checksum: 285a89eeccda75f70216318ad7635158252bb87a4b927351faa243e5a0a7f7ba648de095376d532bf48650609b0077d915f10b0e9b7bcacfa2dc423387690ca9
   languageName: node
   linkType: hard
 
-"@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:7.16.7"
+"@embroider/macros@npm:1.15.0":
+  version: 1.15.0
+  resolution: "@embroider/macros@npm:1.15.0"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
+    "@babel/core": ^7.24.0
+    "@embroider/shared-internals": 2.5.2
+    assert-never: ^1.2.1
+    babel-import-util: ^2.0.0
+    ember-cli-babel: ^8.2.0
+    find-up: ^5.0.0
+    lodash: ^4.17.21
+    resolve: ^1.20.0
+    semver: ^7.3.2
   peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: bbb0f82a4cf297bdbb9110eea570addd4b883fd1b61535558d849822b087aa340fe4e9c31f8a39b087595c8310b58d0f5548d6be0b72c410abefb23a5734b7bc
+    "@glint/template": ^1.0.0
+  peerDependenciesMeta:
+    "@glint/template":
+      optional: true
+  checksum: ac78c4e0d8a553a6d45476acf9248b6ccfb6499e0eb1ddc7e953e1e52cc7a491ce72d4a28defcbe29aff69ed4c32fac5a7311445400836f6427281ef378f1f83
   languageName: node
   linkType: hard
 
-"@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:7.17.12"
+"@embroider/shared-internals@npm:2.5.2":
+  version: 2.5.2
+  resolution: "@embroider/shared-internals@npm:2.5.2"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 6ef739b3a2b0ac0b22b60ff472c118163ceb8d414dd08c8186cc563fddc2be62ad4d8681e02074a1c7f0056a72e7146493a85d12ded02e50904b0009ed85d8bf
+    babel-import-util: ^2.0.0
+    debug: ^4.3.2
+    ember-rfc176-data: ^0.3.17
+    fs-extra: ^9.1.0
+    js-string-escape: ^1.0.1
+    lodash: ^4.17.21
+    resolve-package-path: ^4.0.1
+    semver: ^7.3.5
+    typescript-memoize: ^1.0.1
+  checksum: ffa48bc708498f57482d7c1ebca44fccf46543d705a2dab698581ef5dee5f0981a9a67d7df3164940f8de1b7412f20cfd4d6204b13c2945f461660089908fe53
   languageName: node
   linkType: hard
 
-"@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@npm:7.23.3"
+"@embroider/shared-internals@npm:^2.0.0":
+  version: 2.9.0
+  resolution: "@embroider/shared-internals@npm:2.9.0"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: ddbaf2c396b7780f15e80ee01d6dd790db076985f3dfeb6527d1a8d4cacf370e49250396a3aa005b2c40233cac214a106232f83703d5e8491848bde273938232
+    babel-import-util: ^2.0.0
+    debug: ^4.3.2
+    ember-rfc176-data: ^0.3.17
+    fs-extra: ^9.1.0
+    is-subdir: ^1.2.0
+    js-string-escape: ^1.0.1
+    lodash: ^4.17.21
+    minimatch: ^3.0.4
+    pkg-entry-points: ^1.1.0
+    resolve-package-path: ^4.0.1
+    semver: ^7.3.5
+    typescript-memoize: ^1.0.1
+  checksum: 61e7b5ffccd3a76127dd0c1ca353e2b0bcc8225ad8fd0aa82fc9f2b7118190b6448ca41689fa94cf4c9a6fce2c83c8005a63b200f509ea8596af6c51b53f2bd9
   languageName: node
   linkType: hard
 
-"@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:^7.13.12":
-  version: 7.16.0
-  resolution: "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:7.16.0"
+"@embroider/shared-internals@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "@embroider/shared-internals@npm:3.0.0"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.16.0
-    "@babel/plugin-proposal-optional-chaining": ^7.16.0
-  peerDependencies:
-    "@babel/core": ^7.13.0
-  checksum: bb115479292e2c66671a62c46a64d8dae1fc8bbf604c83f82a421216e3d40632dbe86e8ba34e66318c215eddfc4f25e6e7fe19123517f1cf5b6003b1efbd911a
+    babel-import-util: ^3.0.1
+    debug: ^4.3.2
+    ember-rfc176-data: ^0.3.17
+    fs-extra: ^9.1.0
+    is-subdir: ^1.2.0
+    js-string-escape: ^1.0.1
+    lodash: ^4.17.21
+    minimatch: ^3.0.4
+    pkg-entry-points: ^1.1.0
+    resolve-package-path: ^4.0.1
+    resolve.exports: ^2.0.2
+    semver: ^7.3.5
+    typescript-memoize: ^1.0.1
+  checksum: 508b9729656f6a5ebd2dba65c7ff0ee204b9e092717eb701bfcc9bc91495b83f8cdb3e7ac38d38b48f1cf602e487f2b24308cf1702645d5621da82552cbcaba4
   languageName: node
   linkType: hard
 
-"@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:7.16.7"
+"@embroider/util@npm:^1.13.2":
+  version: 1.13.2
+  resolution: "@embroider/util@npm:1.13.2"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.16.0
-    "@babel/plugin-proposal-optional-chaining": ^7.16.7
+    "@embroider/macros": ^1.16.5
+    broccoli-funnel: ^3.0.5
+    ember-cli-babel: ^7.26.11
   peerDependencies:
-    "@babel/core": ^7.13.0
-  checksum: 81b372651a7d886a06596b02df7fb65ea90265a8bd60c9f0d5c1777590a598e6cccbdc3239033ee0719abf904813e69577eeb0ed5960b40e07978df023b17a6a
+    "@glint/environment-ember-loose": ^1.0.0
+    "@glint/template": ^1.0.0
+    ember-source: "*"
+  peerDependenciesMeta:
+    "@glint/environment-ember-loose":
+      optional: true
+    "@glint/template":
+      optional: true
+  checksum: 4b851e44960120a2a19d7d68812b3a14475c874866328ff13a17258b8373936e63dcdb97aa23e913d0700e762f0d497db5deb8aa1c8f1767e7f8e393adc6db5e
   languageName: node
   linkType: hard
 
-"@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:7.17.12"
+"@eslint-community/eslint-utils@npm:^4.1.2, @eslint-community/eslint-utils@npm:^4.2.0, @eslint-community/eslint-utils@npm:^4.4.0":
+  version: 4.7.0
+  resolution: "@eslint-community/eslint-utils@npm:4.7.0"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.16.0
-    "@babel/plugin-proposal-optional-chaining": ^7.17.12
+    eslint-visitor-keys: ^3.4.3
   peerDependencies:
-    "@babel/core": ^7.13.0
-  checksum: 68520a8f26e56bc8d90c22133537a9819e82598e3c82007f30bdaf8898b0e12a7bfa0cd3044aca35a7f362fd6bc04e4cd8052a571fc2eb40ad8f1cf24e0fc45f
+    eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
+  checksum: b177e3b75c0b8d0e5d71f1c532edb7e40b31313db61f0c879f9bf19c3abb2783c6c372b5deb2396dab4432f2946b9972122ac682e77010376c029dfd0149c681
   languageName: node
   linkType: hard
 
-"@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.22.5
-    "@babel/plugin-transform-optional-chaining": ^7.23.3
-  peerDependencies:
-    "@babel/core": ^7.13.0
-  checksum: 434b9d710ae856fa1a456678cc304fbc93915af86d581ee316e077af746a709a741ea39d7e1d4f5b98861b629cc7e87f002d3138f5e836775632466d4c74aef2
+"@eslint-community/regexpp@npm:^4.11.0, @eslint-community/regexpp@npm:^4.4.0, @eslint-community/regexpp@npm:^4.6.1":
+  version: 4.12.1
+  resolution: "@eslint-community/regexpp@npm:4.12.1"
+  checksum: 0d628680e204bc316d545b4993d3658427ca404ae646ce541fcc65306b8c712c340e5e573e30fb9f85f4855c0c5f6dca9868931f2fcced06417fbe1a0c6cd2d6
   languageName: node
   linkType: hard
 
-"@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@npm:7.23.3"
+"@eslint/eslintrc@npm:^2.1.4":
+  version: 2.1.4
+  resolution: "@eslint/eslintrc@npm:2.1.4"
   dependencies:
-    "@babel/helper-environment-visitor": ^7.22.20
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 4690123f0ef7c11d6bf1a9579e4f463ce363563b75ec3f6ca66cf68687e39d8d747a82c833847653962f79da367eca895d9095c60d8ebb224a1d4277003acc11
+    ajv: ^6.12.4
+    debug: ^4.3.2
+    espree: ^9.6.0
+    globals: ^13.19.0
+    ignore: ^5.2.0
+    import-fresh: ^3.2.1
+    js-yaml: ^4.1.0
+    minimatch: ^3.1.2
+    strip-json-comments: ^3.1.1
+  checksum: 10957c7592b20ca0089262d8c2a8accbad14b4f6507e35416c32ee6b4dbf9cad67dfb77096bbd405405e9ada2b107f3797fe94362e1c55e0b09d6e90dd149127
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-async-generator-functions@npm:^7.13.15":
-  version: 7.16.4
-  resolution: "@babel/plugin-proposal-async-generator-functions@npm:7.16.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/helper-remap-async-to-generator": ^7.16.4
-    "@babel/plugin-syntax-async-generators": ^7.8.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: dcd5a76ee12eacee93440e021a7e4a8e53b5d13d26c8fd7d412fc83341a1633a949bef1ef94301ae753164d39d303cb01b59234e6b48205377ca1d041f670ba5
+"@eslint/js@npm:8.57.1":
+  version: 8.57.1
+  resolution: "@eslint/js@npm:8.57.1"
+  checksum: 2afb77454c06e8316793d2e8e79a0154854d35e6782a1217da274ca60b5044d2c69d6091155234ed0551a1e408f86f09dd4ece02752c59568fa403e60611e880
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-async-generator-functions@npm:^7.16.8":
-  version: 7.16.8
-  resolution: "@babel/plugin-proposal-async-generator-functions@npm:7.16.8"
+"@floating-ui/core@npm:^1.7.0":
+  version: 1.7.0
+  resolution: "@floating-ui/core@npm:1.7.0"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/helper-remap-async-to-generator": ^7.16.8
-    "@babel/plugin-syntax-async-generators": ^7.8.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: abd2c2c67de262720d37c5509dafe2ce64d6cee2dc9a8e863bbba1796b77387214442f37618373c6a4521ca624bfc7dcdbeb1376300d16f2a474405ee0ca2e69
+    "@floating-ui/utils": ^0.2.9
+  checksum: 428a90e49024cfc9ac2276f6f28501aa06be8946a5619eed83de30084d35ee10a08c70fb2bde06f21d18d90714b7d3813770b5416d0d13e2d201616c49a4f611
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-async-generator-functions@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-proposal-async-generator-functions@npm:7.17.12"
+"@floating-ui/dom@npm:^1.6.12":
+  version: 1.7.0
+  resolution: "@floating-ui/dom@npm:1.7.0"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/helper-remap-async-to-generator": ^7.16.8
-    "@babel/plugin-syntax-async-generators": ^7.8.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 16a3c7f68a27031b4973b7c64ca009873c91b91afd7b3a4694ec7f1c6d8e91a6ee142eafd950113810fae122faa1031de71140333b2b1bd03d5367b1a05b1d91
+    "@floating-ui/core": ^1.7.0
+    "@floating-ui/utils": ^0.2.9
+  checksum: 86e35e0d9b849476c0a29623870146b5f0c94b6fb131d14e399b235ea01a8b6c2d2545682fa01364f2a7f81bbf8e58b4947241eb5cada164eeaca2df22dbc625
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-class-properties@npm:^7.1.0":
-  version: 7.13.0
-  resolution: "@babel/plugin-proposal-class-properties@npm:7.13.0"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.13.0
-    "@babel/helper-plugin-utils": ^7.13.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e3cdfacb2d36c66204e3bf99b85feb521daed6e2c3d424f10eb3f722fe20ca0a2560fe9f5a01e5170a34a4f160e9ff02eb678bed81ee130f1c9d990ce8cd711c
+"@floating-ui/utils@npm:^0.2.9":
+  version: 0.2.9
+  resolution: "@floating-ui/utils@npm:0.2.9"
+  checksum: d518b80cec5a323e54a069a1dd99a20f8221a4853ed98ac16c75275a0cc22f75de4f8ac5b121b4f8990bd45da7ad1fb015b9a1e4bac27bb1cd62444af84e9784
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-class-properties@npm:^7.13.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-class-properties@npm:7.16.0"
+"@glimmer/compiler@npm:0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/compiler@npm:0.87.1"
   dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: b1665ced553e5cdb95eec2fda321cb226c5f255edd1a94b226b9d81e97e026472184b6898af26f2bb9ee64101fad1afe215b6fc469d3103dec78c55e732e49aa
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/syntax": ^0.87.1
+    "@glimmer/util": ^0.87.1
+    "@glimmer/vm": ^0.87.1
+    "@glimmer/wire-format": ^0.87.1
+  checksum: cce261bcc862a6f73552c2c465076b1da16693d04acf7fe40b3ce079360d06a8c079ff3dbcc8c88996c5af0c447502e46c8c49a1866df6a78834e8f4c7e03eee
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-class-properties@npm:^7.16.5, @babel/plugin-proposal-class-properties@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-class-properties@npm:7.16.7"
+"@glimmer/component@npm:^1.1.0, @glimmer/component@npm:^1.1.2, @glimmer/component@npm:~1.1.2":
+  version: 1.1.2
+  resolution: "@glimmer/component@npm:1.1.2"
   dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 3977e841e17b45b47be749b9a5b67b9e8b25ff0840f9fdad3f00cbcb35db4f5ff15f074939fe19b01207a29688c432cc2c682351959350834d62920b7881f803
+    "@glimmer/di": ^0.1.9
+    "@glimmer/env": ^0.1.7
+    "@glimmer/util": ^0.44.0
+    broccoli-file-creator: ^2.1.1
+    broccoli-merge-trees: ^3.0.2
+    ember-cli-babel: ^7.7.3
+    ember-cli-get-component-path-option: ^1.0.0
+    ember-cli-is-package-missing: ^1.0.0
+    ember-cli-normalize-entity-name: ^1.0.0
+    ember-cli-path-utils: ^1.0.0
+    ember-cli-string-utils: ^1.1.0
+    ember-cli-typescript: 3.0.0
+    ember-cli-version-checker: ^3.1.3
+    ember-compatibility-helpers: ^1.1.2
+  checksum: 853b998105c1f77cf382b6f6459709515d39d560f2022e948e7b7f6b298b14197e45b20c1cbfca52970c0fef1a80a1bce55aea98c4da2311330d5420291254b7
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-class-properties@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-proposal-class-properties@npm:7.17.12"
+"@glimmer/debug@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/debug@npm:0.87.1"
   dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.17.12
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 884df6a4617a18cdc2a630096b2a10954bcc94757c893bb01abd6702fdc73343ca5c611f4884c4634e0608f5e86c3093ea6b973ce00bf21b248ba54de92c837d
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/util": ^0.87.1
+    "@glimmer/vm": ^0.87.1
+  checksum: 5522fc922a287182e2e4453337c3758e54501bb3f64bd77e8289811108cbf5590709cd2b09ae8221fcf0aa86b4e1044a16a37a5688fabaf79d09bd85cad2f0ae
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-class-static-block@npm:^7.13.11":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-class-static-block@npm:7.16.0"
+"@glimmer/destroyable@npm:0.87.1, @glimmer/destroyable@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/destroyable@npm:0.87.1"
   dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-class-static-block": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.12.0
-  checksum: 59c4bb3d6ad4828e7773fe1c63730c68bf646c3a8d042b9ed4062fd98a26c1656b7ee108c5f144fd8b24ff567baf3b2efa644be29c6c8bcfe60e09e485e22116
+    "@glimmer/env": 0.1.7
+    "@glimmer/global-context": ^0.87.1
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/util": ^0.87.1
+  checksum: 14baba57435837e232ff06e8a30e3e23650626362b6b1f956f2b6d9741c83fa0b13b65df22956d4d431dd2679a5fb6e123efcd9b8dc34d457d5b781f1e72a1e5
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-class-static-block@npm:^7.16.7":
-  version: 7.17.6
-  resolution: "@babel/plugin-proposal-class-static-block@npm:7.17.6"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.17.6
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/plugin-syntax-class-static-block": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.12.0
-  checksum: 0ef00d73b4a7667059f71614669fb5ec989a0a6d5fe58118310c892507f2556a6f3ae66f0c547cd06e50bdf3ff528ef486e611079d41ef321300c967d2c26e1d
+"@glimmer/di@npm:^0.1.9":
+  version: 0.1.11
+  resolution: "@glimmer/di@npm:0.1.11"
+  checksum: c93f6a511cf7f72f3a6824ce075e73952b8f451e4098eda2fc1f45b4b5b1016831459d32f3f298fdc21030cc03ebcc4561ca2780c59562e356519b2a296c5b48
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-class-static-block@npm:^7.18.0":
-  version: 7.18.0
-  resolution: "@babel/plugin-proposal-class-static-block@npm:7.18.0"
+"@glimmer/encoder@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/encoder@npm:0.87.1"
   dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.18.0
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/plugin-syntax-class-static-block": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.12.0
-  checksum: 70fd622fd7c62cca2aa99c70532766340a5c30105e35cb3f1187b450580d43adc78b3fcb1142ed339bcfccf84be95ea03407adf467331b318ce6874432736c89
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/vm": ^0.87.1
+  checksum: 463f57aa7b9b48844889139f8711cff5d4942e673bcac13a58531647f0da9fcfa4b119cb2098adf402d4ab56bc9ba1ffa65316c2e9e2653840b2dacb3decd873
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-decorators@npm:^7.13.5":
-  version: 7.16.4
-  resolution: "@babel/plugin-proposal-decorators@npm:7.16.4"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-decorators": ^7.16.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: de4f3187c60d14fca37f4edf9d27c61b22e62609708bbaa48bd25b705ab4d5d09457b1011bf6fb55607b11c7a227310f3db5ced4802ded96a79202af7fad7101
+"@glimmer/env@npm:0.1.7, @glimmer/env@npm:^0.1.7":
+  version: 0.1.7
+  resolution: "@glimmer/env@npm:0.1.7"
+  checksum: d46686da1b21615c177792794ed11f725fbb1c32936d69ca54a3ac40e2314638a529b81afb23759d35cdf36462a7a6b2c02604a366473cd6a8abadfe56e9c335
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-decorators@npm:^7.16.7":
-  version: 7.18.2
-  resolution: "@babel/plugin-proposal-decorators@npm:7.18.2"
+"@glimmer/global-context@npm:0.84.3":
+  version: 0.84.3
+  resolution: "@glimmer/global-context@npm:0.84.3"
   dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.18.0
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/helper-replace-supers": ^7.18.2
-    "@babel/helper-split-export-declaration": ^7.16.7
-    "@babel/plugin-syntax-decorators": ^7.17.12
-    charcodes: ^0.2.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: cb40e31afe5c414d748d90943910ff7e8015f89f5845046bcdc8ae9b09882b183c550a6bc32969826680d9c41866d5f39097f1cd7b0a7c2101285ec4e38dbded
+    "@glimmer/env": ^0.1.7
+  checksum: 89e699acfa1f23fe8ce8fd48455897781dfd935b7d1ef97d8d268ee38456a69a2ce09bcb18c250f17cb019a16cf0f2e4fdd5b178f9ddc233b42f1cc7e5c85157
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-decorators@npm:^7.20.13":
-  version: 7.23.5
-  resolution: "@babel/plugin-proposal-decorators@npm:7.23.5"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.23.5
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-replace-supers": ^7.22.20
-    "@babel/helper-split-export-declaration": ^7.22.6
-    "@babel/plugin-syntax-decorators": ^7.23.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e925fe7a82c03aa372b92b312e69a05453d55aaaf2fd48336c88f4fe2b7e81bf9e8e52b93d4f785a02f2b8deedee6964054153566b40c92886dcf795843a243e
+"@glimmer/global-context@npm:0.87.1, @glimmer/global-context@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/global-context@npm:0.87.1"
+  checksum: 1436b35eb12a9bb3689303f2ea98aeb127daa2e6eaa51ea0518b0a7b4585b7d5847d2ed680615fcffc2cad400d4e7f7b2ae03d6a5df440e4f30f70b7a8f2b427
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-decorators@npm:^7.21.0":
-  version: 7.22.7
-  resolution: "@babel/plugin-proposal-decorators@npm:7.22.7"
+"@glimmer/interfaces@npm:0.84.3":
+  version: 0.84.3
+  resolution: "@glimmer/interfaces@npm:0.84.3"
   dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.22.6
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-replace-supers": ^7.22.5
-    "@babel/helper-split-export-declaration": ^7.22.6
-    "@babel/plugin-syntax-decorators": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d9d6f7cc8b3f1450963d3f26909af025836189b81e43c48ad455db5db2319beaf4ad2fda5aa12a1afcf856de11ecd5ee6894a9e906e8de8ee445c79102b50d26
+    "@simple-dom/interface": ^1.4.0
+  checksum: f6a6757a2fc6fc0a8aeb9c1ce4acaec7adf03b31130c9c3149265a401d8fc4773dfb1ff6a567fc008c669cb3c5b9a94f505c68298f72f283d03a46bc0dcb1121
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-dynamic-import@npm:^7.13.8":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-dynamic-import@npm:7.16.0"
+"@glimmer/interfaces@npm:0.87.1, @glimmer/interfaces@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/interfaces@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-dynamic-import": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 4027da640443d8fd4a20637d1dd67cce1c13207b8c19fa77796a08b9eec9881b95322c1a5c489128adf3a12e9bbc02b31de9ddd536c909d072577a74a2a70b67
+    "@simple-dom/interface": ^1.4.0
+  checksum: 5218fd6b555fa33be4673fed43f42e81c7490aaa081461ac6fbca8b18230ba3e3a96932386d5a6890ce1ef85687bf1911b0e2a8c7d905b023cafacb8e52fb289
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-dynamic-import@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-dynamic-import@npm:7.16.7"
+"@glimmer/interfaces@npm:0.94.6":
+  version: 0.94.6
+  resolution: "@glimmer/interfaces@npm:0.94.6"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/plugin-syntax-dynamic-import": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 5992012484fb8bda1451369350e475091954ed414dd9ef8654a3c4daa2db0205d4f29c94f5d3dedfbc5a434996375c8304586904337d6af938ac0f27a0033e23
+    "@simple-dom/interface": ^1.4.0
+    type-fest: ^4.35.0
+  checksum: a3f7f474b5ffb352d397e5a5e5c1b8a8b62a618aa05829bb4a3baab059c7a1d97f1fc69207be715c93f947da2411f14caaebe8bb771200130bfb55ea50939974
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-export-namespace-from@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-export-namespace-from@npm:7.16.0"
+"@glimmer/manager@npm:0.87.1, @glimmer/manager@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/manager@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-export-namespace-from": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 0bdc166ac44d9a0579e6d14d07ed1364932b4b7852626f4ba0c0011464097ed23bec43a3e93793d888c2854918ce9937ac251a945abbe0d283eaa1df206e0b05
+    "@glimmer/debug": ^0.87.1
+    "@glimmer/destroyable": ^0.87.1
+    "@glimmer/env": 0.1.7
+    "@glimmer/global-context": ^0.87.1
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/reference": ^0.87.1
+    "@glimmer/util": ^0.87.1
+    "@glimmer/validator": ^0.87.1
+    "@glimmer/vm": ^0.87.1
+  checksum: 920a660c463f645e392092d297d83fbd70c694afefce02884d5dcebf454ba601de291d3fb6db9a70bf44f61f2ac12f246b4bfa57e31198175f1d567b8d0e3648
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-export-namespace-from@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-export-namespace-from@npm:7.16.7"
+"@glimmer/node@npm:0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/node@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/plugin-syntax-export-namespace-from": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 5016079a5305c1c130fea587b42cdce501574739cfefa5b63469dbc1f32d436df0ff42fabf04089fe8b6a00f4ea7563869e944744b457e186c677995983cb166
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/runtime": ^0.87.1
+    "@glimmer/util": ^0.87.1
+    "@simple-dom/document": ^1.4.0
+  checksum: 6e41dabeb584d6056c2f57dfbe089f0cdc796256185462b94d037de392393c820770ccb3c0612a86dfb23354c733b3f10e3673544c37b05620eaa31befabc2d9
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-export-namespace-from@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-proposal-export-namespace-from@npm:7.17.12"
+"@glimmer/opcode-compiler@npm:0.87.1, @glimmer/opcode-compiler@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/opcode-compiler@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/plugin-syntax-export-namespace-from": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 41c9cd4c0a5629b65725d2554867c15b199f534cea5538bd1ae379c0d13e7206d8590e23b23cb05a8b243e33e6eb88c1de3fd03a55cdbc6d4cf8634a6bebe43d
+    "@glimmer/debug": ^0.87.1
+    "@glimmer/encoder": ^0.87.1
+    "@glimmer/env": 0.1.7
+    "@glimmer/global-context": ^0.87.1
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/manager": ^0.87.1
+    "@glimmer/reference": ^0.87.1
+    "@glimmer/util": ^0.87.1
+    "@glimmer/vm": ^0.87.1
+    "@glimmer/wire-format": ^0.87.1
+  checksum: 22943e0bfe7e65306e7dc337cbb4a9a7490282bcd0ea3b53ad74a8918715b928e1ad613070387712967cdcaef06690289df14e9bb1ccc5846fbfbffbbdc62b82
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-json-strings@npm:^7.13.8":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-json-strings@npm:7.16.0"
+"@glimmer/owner@npm:0.87.1, @glimmer/owner@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/owner@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-json-strings": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: fa93be8eff22ced96a68c9db8c0e930414a4ffb44cf68b473717309c06a4feee2bac6e41415a699c829f29928653d67b4b7d29a45861784d235264d829055a1e
+    "@glimmer/util": ^0.87.1
+  checksum: 296e575ebf9e807bbea3ede47a9bee5fbe32a3ad65ab75b0bcd3dbd29c00132ce2772abed1aba39e02447e7e8cffba5f8d94848f83d6187dc15df849d34f063f
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-json-strings@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-json-strings@npm:7.16.7"
+"@glimmer/program@npm:0.87.1, @glimmer/program@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/program@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/plugin-syntax-json-strings": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: ea6487918f8d88322ac2a4e5273be6163b0d84a34330c31cee346e23525299de3b4f753bc987951300a79f55b8f4b1971b24d04c0cdfcb7ceb4d636975c215e8
+    "@glimmer/encoder": ^0.87.1
+    "@glimmer/env": 0.1.7
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/manager": ^0.87.1
+    "@glimmer/opcode-compiler": ^0.87.1
+    "@glimmer/util": ^0.87.1
+    "@glimmer/vm": ^0.87.1
+    "@glimmer/wire-format": ^0.87.1
+  checksum: 40d247fa7c931dfabdfb1354818a32260bb23ad1ad342d75c9128211e519b4f3e2f4c7d154c38ca5e3b47f347b2c169269ad6504abf14312837b9c59d559a3d3
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-json-strings@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-proposal-json-strings@npm:7.17.12"
+"@glimmer/reference@npm:0.87.1, @glimmer/reference@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/reference@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/plugin-syntax-json-strings": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 8ed4ee3fbc28e44fac17c48bd95b5b8c3ffc852053a9fffd36ab498ec0b0ba069b8b2f5658edc18332748948433b9d3e1e376f564a1d65cb54592ba9943be09b
+    "@glimmer/env": ^0.1.7
+    "@glimmer/global-context": ^0.87.1
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/util": ^0.87.1
+    "@glimmer/validator": ^0.87.1
+  checksum: 8232ff681a88d629cdbb08c13f8fdf708a8a415a98d5b4d939553310bbf3f8b2fe15109b3016f3ad8469fb81497d358af8e80dae8f14ac2ba5cfe0585ea3126c
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-logical-assignment-operators@npm:^7.13.8":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-logical-assignment-operators@npm:7.16.0"
+"@glimmer/reference@npm:^0.84.3":
+  version: 0.84.3
+  resolution: "@glimmer/reference@npm:0.84.3"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-logical-assignment-operators": ^7.10.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7e6cd10248803f0c5801805ef1a357314940c3204c3d2f00994711f272c21276f181d0e83ada5bce6185ae2c97c4417e778331505ffc2e71a2b9c4425a5dcc6d
+    "@glimmer/env": ^0.1.7
+    "@glimmer/global-context": 0.84.3
+    "@glimmer/interfaces": 0.84.3
+    "@glimmer/util": 0.84.3
+    "@glimmer/validator": 0.84.3
+  checksum: 856456c1211cb1c1ddc5c48b8aea924f1b1f19625be1984f2bc7147af49d89c70e3f356bf7d299aa519ee53a21ca4c7371277be14218c37d9206e4cac2f05b9e
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-logical-assignment-operators@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-logical-assignment-operators@npm:7.16.7"
+"@glimmer/runtime@npm:0.87.1, @glimmer/runtime@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/runtime@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/plugin-syntax-logical-assignment-operators": ^7.10.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: c4cf18e10f900d40eaa471c4adce4805e67bd845f997a4b9d5653eced4e653187b9950843b2bf7eab6c0c3e753aba222b1d38888e3e14e013f87295c5b014f19
+    "@glimmer/destroyable": ^0.87.1
+    "@glimmer/env": 0.1.7
+    "@glimmer/global-context": ^0.87.1
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/manager": ^0.87.1
+    "@glimmer/owner": ^0.87.1
+    "@glimmer/program": ^0.87.1
+    "@glimmer/reference": ^0.87.1
+    "@glimmer/util": ^0.87.1
+    "@glimmer/validator": ^0.87.1
+    "@glimmer/vm": ^0.87.1
+    "@glimmer/wire-format": ^0.87.1
+  checksum: ed7c28d839eef383b2283f8a51cfcc6cb7e566070952b0388b0e333ddb791c5b3b895863e5e28a04917d8e553eb186d16172beb10abd4ce3fba09b6c47b546b3
+  languageName: node
+  linkType: hard
+
+"@glimmer/syntax@npm:0.87.1, @glimmer/syntax@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/syntax@npm:0.87.1"
+  dependencies:
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/util": ^0.87.1
+    "@glimmer/wire-format": ^0.87.1
+    "@handlebars/parser": ~2.0.0
+    simple-html-tokenizer: ^0.5.11
+  checksum: 887ea4a4c975d9ae0d48b17725d55b5c6c886b49356d73ab60d322f5aa91fa8c7a3544f7f877babbf656c924e4655a75480d408e253f3a13200398522986d56f
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-logical-assignment-operators@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-proposal-logical-assignment-operators@npm:7.17.12"
+"@glimmer/syntax@npm:>= 0.94.9":
+  version: 0.94.9
+  resolution: "@glimmer/syntax@npm:0.94.9"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/plugin-syntax-logical-assignment-operators": ^7.10.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 0d48451836219b7beeca4be22a8aeb4a177a4944be4727afb94a4a11f201dde8b0b186dd2ad65b537d61e9af3fa1afda734f7096bec8602debd76d07aa342e21
+    "@glimmer/interfaces": 0.94.6
+    "@glimmer/util": 0.94.8
+    "@glimmer/wire-format": 0.94.8
+    "@handlebars/parser": ~2.0.0
+    simple-html-tokenizer: ^0.5.11
+  checksum: c823f4e97014f27337d592c0b3c304f9e14b0954739c609554f5dece4a0785d50783ecc5d2bd1cece01a34e16254127505a33aa73b72663df3a644aba4d2d34d
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-nullish-coalescing-operator@npm:^7.13.8, @babel/plugin-proposal-nullish-coalescing-operator@npm:^7.4.4":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-nullish-coalescing-operator@npm:7.16.0"
+"@glimmer/syntax@npm:^0.84.2, @glimmer/syntax@npm:^0.84.3":
+  version: 0.84.3
+  resolution: "@glimmer/syntax@npm:0.84.3"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-nullish-coalescing-operator": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e50f94929970cdc5c6ee22ec4c95c46ae25cdd8c391baf601f7f3d3a3cec417efc663a3fafa9ae5bca82a6815d49687b07cab9857f5a10e9ea862438ecb81e4a
+    "@glimmer/interfaces": 0.84.3
+    "@glimmer/util": 0.84.3
+    "@handlebars/parser": ~2.0.0
+    simple-html-tokenizer: ^0.5.11
+  checksum: afadea62f1c54735df723120a94f4da3cb663d762be1c9b130f8d22584ccc93a037198b60759706d3cf0d3658268170eae687dfdc7cb21e5c0a9af7005ebc727
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-nullish-coalescing-operator@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-nullish-coalescing-operator@npm:7.16.7"
+"@glimmer/tracking@npm:^1.0.0, @glimmer/tracking@npm:^1.1.2, @glimmer/tracking@npm:~1.1.2":
+  version: 1.1.2
+  resolution: "@glimmer/tracking@npm:1.1.2"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/plugin-syntax-nullish-coalescing-operator": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: bfafc2701697b5c763dbbb65dd97b56979bfb0922e35be27733699a837aeff22316313ddfdd0fb45129efa3f86617219b77110d05338bc4dca4385d8ce83dd19
+    "@glimmer/env": ^0.1.7
+    "@glimmer/validator": ^0.44.0
+  checksum: a36aaf70c831fbfd9fb6f6e7b9cacb7130b0dbb87206234cd8e5fcbfa42070cab48d7d9b16eb6918f266ac3ae0414d968b1903b520a69f0eac2a8f303179f8ff
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-nullish-coalescing-operator@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-proposal-nullish-coalescing-operator@npm:7.17.12"
+"@glimmer/util@npm:0.84.3":
+  version: 0.84.3
+  resolution: "@glimmer/util@npm:0.84.3"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/plugin-syntax-nullish-coalescing-operator": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7881d8005d0d4e17a94f3bfbfa4a0d8af016d2f62ed90912fabb8c5f8f0cc0a15fd412f09c230984c40b5c893086987d403c73198ef388ffcb3726ff72efc009
+    "@glimmer/env": 0.1.7
+    "@glimmer/interfaces": 0.84.3
+    "@simple-dom/interface": ^1.4.0
+  checksum: d0f8d461a7653a113e630ee45aa57e4efbc33f78ab7b7ce12bdaa699b3513df93a7ffba96b1863883fafe566b650dfb01c4122f79207d6267d1655255b9baa4a
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-numeric-separator@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-numeric-separator@npm:7.16.0"
+"@glimmer/util@npm:0.87.1, @glimmer/util@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/util@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-numeric-separator": ^7.10.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: eb7895a4f38263df644a0ded7042991190f23bdec4b53f3e2c8b40b82d2dbc537a6ca9afbfd490d1aa5dd33244e7a51bf1ae0c4c6890d9978bc1adc325b7e795
+    "@glimmer/env": 0.1.7
+    "@glimmer/interfaces": ^0.87.1
+  checksum: c3f74f6e00d8f5b7391f3c26921bb56b1c220afe2703164f1579a45dc6f154b7671e045729e0a36b8bd5ad28cdf045ef79a77e87a11905054b536f55e7fe83d1
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-numeric-separator@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-numeric-separator@npm:7.16.7"
+"@glimmer/util@npm:0.94.8":
+  version: 0.94.8
+  resolution: "@glimmer/util@npm:0.94.8"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/plugin-syntax-numeric-separator": ^7.10.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 8e2fb0b32845908c67f80bc637a0968e28a66727d7ffb22b9c801dc355d88e865dc24aec586b00c922c23833ae5d26301b443b53609ea73d8344733cd48a1eca
+    "@glimmer/interfaces": 0.94.6
+  checksum: 6c16fa28ea0af9231dd7f15f21b3604acc448f172b5f45c4ae7ad98bbaa0a943f644d9e25ef68dca64c7775c0472c0c6b46ba46b8c5f5fa3f18cb95600c8e4ca
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-object-rest-spread@npm:^7.12.1":
-  version: 7.13.8
-  resolution: "@babel/plugin-proposal-object-rest-spread@npm:7.13.8"
-  dependencies:
-    "@babel/compat-data": ^7.13.8
-    "@babel/helper-compilation-targets": ^7.13.8
-    "@babel/helper-plugin-utils": ^7.13.0
-    "@babel/plugin-syntax-object-rest-spread": ^7.8.3
-    "@babel/plugin-transform-parameters": ^7.13.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7ae92617c672e1d47979c809bd90b20c4e7d269769776dd705f519634a165d113de8ef05739a557b3aad0cb6884986b82d287dcb63211c07b66dca43ac66c8bb
+"@glimmer/util@npm:^0.44.0":
+  version: 0.44.0
+  resolution: "@glimmer/util@npm:0.44.0"
+  checksum: e1c5f74c265afb2ccdc10e183d6784dc29d2cb98f2aca10b068f3dce29e67a3967c760af750e88e0a2f1c80e2cfc0de5ee6e96bb90dcb97493a2e6f51d36b129
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-object-rest-spread@npm:^7.13.8":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-object-rest-spread@npm:7.16.0"
+"@glimmer/validator@npm:0.84.3, @glimmer/validator@npm:^0.84.3":
+  version: 0.84.3
+  resolution: "@glimmer/validator@npm:0.84.3"
   dependencies:
-    "@babel/compat-data": ^7.16.0
-    "@babel/helper-compilation-targets": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-object-rest-spread": ^7.8.3
-    "@babel/plugin-transform-parameters": ^7.16.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: c7716ba50e65aae613e553dd568d3f4b4c42fa8d9f1c3aca6cc227670fc792b600cd5a5c710451490f3d7d5916e77607cba45033e199534ca71feed451f63820
+    "@glimmer/env": ^0.1.7
+    "@glimmer/global-context": 0.84.3
+  checksum: 58ac3c49a1a601de8271cfcc0f27415fa2388283ae90dd2b4f785f5ab44fa12506c8b32cfc6c74d69bb60ca27745b4f6707fec07a8dff78f2d9da9f9aecc2afa
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-object-rest-spread@npm:^7.16.7":
-  version: 7.17.3
-  resolution: "@babel/plugin-proposal-object-rest-spread@npm:7.17.3"
+"@glimmer/validator@npm:0.87.1, @glimmer/validator@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/validator@npm:0.87.1"
   dependencies:
-    "@babel/compat-data": ^7.17.0
-    "@babel/helper-compilation-targets": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/plugin-syntax-object-rest-spread": ^7.8.3
-    "@babel/plugin-transform-parameters": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 02810f158db4aaf6883131621b5d2c7d901ea3c034df2c2b78663f8b26813795d78a346c37e56770a720c54773732fd1d7fe40947dbf11d1d8de0e9a38e856d3
+    "@glimmer/env": ^0.1.7
+    "@glimmer/global-context": ^0.87.1
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/util": ^0.87.1
+  checksum: c2d6f883e78795bf776206c6d5c53e001005547e72614b9f0b7aa7394133dd12683d93f0f4351851d436dc8efe5598e0ab70db6c8a4a6383e4d96a7649230d8b
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-object-rest-spread@npm:^7.18.0":
-  version: 7.18.0
-  resolution: "@babel/plugin-proposal-object-rest-spread@npm:7.18.0"
-  dependencies:
-    "@babel/compat-data": ^7.17.10
-    "@babel/helper-compilation-targets": ^7.17.10
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/plugin-syntax-object-rest-spread": ^7.8.3
-    "@babel/plugin-transform-parameters": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2b49bcf9a6b11fd8b6a1d4962a64f3c846a63f8340eca9824c907f75bfcff7422ca35b135607fc3ef2d4e7e77ce6b6d955b772dc3c1c39f7ed24a0d8a560ec78
+"@glimmer/validator@npm:^0.44.0":
+  version: 0.44.0
+  resolution: "@glimmer/validator@npm:0.44.0"
+  checksum: c68a169ee196a17a142b2375928d1b5b2bad2f1f7961a9a14b6a5ef0b8d5c66af7004d678502d2ae83f6b69c1745cbcecbf71607b140924dec9da96e413fd8d4
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-optional-catch-binding@npm:^7.13.8":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-optional-catch-binding@npm:7.16.0"
+"@glimmer/vm-babel-plugins@npm:0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/vm-babel-plugins@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-optional-catch-binding": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 5003a1d48fb6bac1661b481681baf7941de518f1f773d9745e65a650e750b715cb69181a4b723e28f4e43b94143b7b0fe5d12ff1ceceda9731f073cd6bf4e195
+    babel-plugin-debug-macros: ^0.3.4
+  checksum: 8f123d38a537e6602e837f4a8ea7d6d5dd0f00ff45f7ee776d7f7fa23ec25e7b563cffb38e8fb08e1fbb13f43e7aa51a720aff7d3560f3d8ca17e6964b34973f
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-optional-catch-binding@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-optional-catch-binding@npm:7.16.7"
+"@glimmer/vm@npm:0.87.1, @glimmer/vm@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/vm@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/plugin-syntax-optional-catch-binding": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 4a422bb19a23cf80a245c60bea7adbe5dac8ff3bc1a62f05d7155e1eb68d401b13339c94dfd1f3d272972feeb45746f30d52ca0f8d5c63edf6891340878403df
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/util": ^0.87.1
+  checksum: e2d4f6ab21c6cf3d5c2045955ce14194daa806cdc49af5f8aa68b99210516e1a7b535059db3006983ae50e97bdbc3f69bce88497fbf5fbed7992cd03c87cf0bb
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-optional-chaining@npm:^7.13.12, @babel/plugin-proposal-optional-chaining@npm:^7.16.0, @babel/plugin-proposal-optional-chaining@npm:^7.6.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-optional-chaining@npm:7.16.0"
+"@glimmer/wire-format@npm:0.94.8":
+  version: 0.94.8
+  resolution: "@glimmer/wire-format@npm:0.94.8"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.16.0
-    "@babel/plugin-syntax-optional-chaining": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 8301e0829220327c8b969b711c5c4ee5aef88b391e5fb7838381bd18c0fd0cf360d3a307ad5c6113414470ae920504dc2c41983af0ddf3762f5c88957e0c3a94
+    "@glimmer/interfaces": 0.94.6
+  checksum: 01d56368fd06f3aece97d5d062142e3700eac89af48e38156832ab84b09a68f01a843631a42b95e323a3254691cc2fc046c74747e19632ea9a1377c83189d63c
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-optional-chaining@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-optional-chaining@npm:7.16.7"
+"@glimmer/wire-format@npm:^0.87.1":
+  version: 0.87.1
+  resolution: "@glimmer/wire-format@npm:0.87.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.16.0
-    "@babel/plugin-syntax-optional-chaining": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e4a6c1ac7e6817b92a673ea52ab0b7dc1fb39d29fb0820cd414e10ae2cd132bd186b4238dcca881a29fc38fe9d38ed24fc111ba22ca20086481682d343f4f130
+    "@glimmer/interfaces": ^0.87.1
+    "@glimmer/util": ^0.87.1
+  checksum: 0695a515b5c45c9cea78ecceeb5ee47dc76c59601c5594a7294af309037cf704e1d6007b26173c75503e58b58649ff8275986d7b8a98663033874c6ddd956c79
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-optional-chaining@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-proposal-optional-chaining@npm:7.17.12"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.16.0
-    "@babel/plugin-syntax-optional-chaining": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a27b220573441a0ad3eecf8ddcb249556a64de45add236791d76cfa164a8fd34181857528fa7d21d03d6b004e7c043bd929cce068e611ee1ac72aaf4d397aa12
+"@handlebars/parser@npm:~2.0.0":
+  version: 2.0.0
+  resolution: "@handlebars/parser@npm:2.0.0"
+  checksum: add32d6678b18db73fb88266138bc358abf94c255f4464b936b5b66e3108205c6cc3b611a726e0a691633552b94c0f9f65aed43fd4c51ecbbfb562179c967d88
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-private-methods@npm:^7.13.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-private-methods@npm:7.16.0"
+"@hashicorp-internal/vault-reporting@file:vault-reporting/0.8.0.tgz::locator=vault%40workspace%3A.":
+  version: 0.8.0
+  resolution: "@hashicorp-internal/vault-reporting@file:vault-reporting/0.8.0.tgz::locator=vault%40workspace%3A."
   dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
+    "@embroider/macros": ^1.18.1
+    "@lineal-viz/lineal": ^0.5.1
+    decorator-transforms: ^2.3.0
+    ember-modifier: ^4.2.2
+  peerDependencies:
+    "@hashicorp/design-system-components": ^4.22.1
+  checksum: d5292fcd60b27553d71b765dc7be31800858e8f3c03931a68672b257473b8914dd3bfecbf5f5ac1efabb1055f3ffdf637fe3104d17b1afbbfb45478447e147df
+  languageName: node
+  linkType: hard
+
+"@hashicorp/design-system-components@npm:4.20.1":
+  version: 4.20.1
+  resolution: "@hashicorp/design-system-components@npm:4.20.1"
+  dependencies:
+    "@codemirror/commands": ^6.8.0
+    "@codemirror/lang-go": ^6.0.1
+    "@codemirror/lang-javascript": ^6.2.2
+    "@codemirror/lang-json": ^6.0.1
+    "@codemirror/lang-markdown": ^6.3.2
+    "@codemirror/lang-sql": ^6.8.0
+    "@codemirror/lang-yaml": ^6.1.2
+    "@codemirror/language": ^6.10.3
+    "@codemirror/legacy-modes": ^6.4.2
+    "@codemirror/lint": ^6.8.4
+    "@codemirror/state": ^6.5.0
+    "@codemirror/view": ^6.36.2
+    "@ember/render-modifiers": ^2.1.0
+    "@ember/string": ^3.1.1
+    "@ember/test-waiters": ^3.1.0
+    "@embroider/addon-shim": ^1.9.0
+    "@embroider/macros": ^1.16.12
+    "@embroider/util": ^1.13.2
+    "@floating-ui/dom": ^1.6.12
+    "@hashicorp/design-system-tokens": ^2.3.0
+    "@hashicorp/flight-icons": ^3.11.0
+    "@lezer/highlight": ^1.2.1
+    "@nullvoxpopuli/ember-composable-helpers": ^5.2.9
+    clipboard-polyfill: ^4.1.1
+    codemirror-lang-hcl: ^0.0.0-beta.2
+    decorator-transforms: ^2.3.0
+    ember-a11y-refocus: ^4.1.4
+    ember-cli-sass: ^11.0.1
+    ember-concurrency: ^4.0.2
+    ember-element-helper: ^0.8.6
+    ember-focus-trap: ^1.1.1
+    ember-get-config: ^2.1.1
+    ember-modifier: ^4.2.0
+    ember-power-select: ^8.6.2
+    ember-stargate: ^0.5.0
+    ember-style-modifier: ^4.4.0
+    ember-truth-helpers: ^4.0.3
+    luxon: ^3.4.2
+    prismjs: ^1.30.0
+    sass: ^1.83.0
+    tabbable: ^6.2.0
+    tippy.js: ^6.3.7
   peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 6f648f54ea1219262b7a05f86f94de7cb466dc81ffd86e4f37ba536037762457ef13408083eb4325d44d2a5aae27c097756efe1067f5c1fbddb8078b923580f5
+    ember-engines: ">= 0.11.0"
+  peerDependenciesMeta:
+    ember-engines:
+      optional: true
+  checksum: 1b8d77f255aaf4db2c5601403bb9a63704ebfdd23333d465fc4104866e2669021ab631c74c11ca0af696894f5b2fa3aac66043cfbed5d11c6fffb7c423126847
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-private-methods@npm:^7.16.11, @babel/plugin-proposal-private-methods@npm:^7.16.5":
-  version: 7.16.11
-  resolution: "@babel/plugin-proposal-private-methods@npm:7.16.11"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.16.10
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: b333e5aa91c265bb394a57b5f4ae1a34fc8ee73a8d75506b12df258d8b5342107cbd9261f95e606bd3264a5b023db77f1f95be30c2e526683916c57f793f7943
+"@hashicorp/design-system-tokens@npm:^2.3.0":
+  version: 2.3.0
+  resolution: "@hashicorp/design-system-tokens@npm:2.3.0"
+  checksum: d05650366d4397d4f0bda23398b0f7354212571bcc02e074407da2104c6e455d7435a9bf7a322a3d8d74152defda705d19b1c8c7ec2bc1a807f0bc9600ed6bcf
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-private-methods@npm:^7.16.7":
-  version: 7.18.6
-  resolution: "@babel/plugin-proposal-private-methods@npm:7.18.6"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.18.6
-    "@babel/helper-plugin-utils": ^7.18.6
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 22d8502ee96bca99ad2c8393e8493e2b8d4507576dd054490fd8201a36824373440106f5b098b6d821b026c7e72b0424ff4aeca69ed5f42e48f029d3a156d5ad
+"@hashicorp/flight-icons@npm:^3.11.0":
+  version: 3.12.0
+  resolution: "@hashicorp/flight-icons@npm:3.12.0"
+  checksum: 2a64c1498df3f3f20da467f3b861d41727d5d422c097b51c5a486bd2de172e24730e0ef85892c199ada74325b7adecc2f583949792f6da59d68aa053396102de
+  languageName: node
+  linkType: hard
+
+"@hashicorp/vault-client-typescript@hashicorp/vault-client-typescript":
+  version: 0.0.0
+  resolution: "@hashicorp/vault-client-typescript@https://github.com/hashicorp/vault-client-typescript.git#commit=192d6367eca00c22e887e5de00586b394a0be03f"
+  checksum: eed9bcd9c37377337a7a5e378f807c949926b39b8c2b36b8a442a2b9727a152cf73370a396f868a82d3318d69532089e25b2dc27f1072e0a709b06fe4c49b0f6
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-private-methods@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-proposal-private-methods@npm:7.17.12"
+"@humanwhocodes/config-array@npm:^0.13.0":
+  version: 0.13.0
+  resolution: "@humanwhocodes/config-array@npm:0.13.0"
   dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.17.12
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a1e5bd6a0a541af55d133d7bcf51ff8eb4ac7417a30f518c2f38107d7d033a3d5b7128ea5b3a910b458d7ceb296179b6ff9d972be60d1c686113d25fede8bed3
+    "@humanwhocodes/object-schema": ^2.0.3
+    debug: ^4.3.1
+    minimatch: ^3.0.5
+  checksum: eae69ff9134025dd2924f0b430eb324981494be26f0fddd267a33c28711c4db643242cf9fddf7dadb9d16c96b54b2d2c073e60a56477df86e0173149313bd5d6
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-private-property-in-object@npm:7.21.0-placeholder-for-preset-env.2":
-  version: 7.21.0-placeholder-for-preset-env.2
-  resolution: "@babel/plugin-proposal-private-property-in-object@npm:7.21.0-placeholder-for-preset-env.2"
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d97745d098b835d55033ff3a7fb2b895b9c5295b08a5759e4f20df325aa385a3e0bc9bd5ad8f2ec554a44d4e6525acfc257b8c5848a1345cb40f26a30e277e91
+"@humanwhocodes/module-importer@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "@humanwhocodes/module-importer@npm:1.0.1"
+  checksum: 0fd22007db8034a2cdf2c764b140d37d9020bbfce8a49d3ec5c05290e77d4b0263b1b972b752df8c89e5eaa94073408f2b7d977aed131faf6cf396ebb5d7fb61
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-private-property-in-object@npm:^7.14.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-private-property-in-object@npm:7.16.0"
-  dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.0
-    "@babel/helper-create-class-features-plugin": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-private-property-in-object": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 9098fb34f4abac376ec5823bf6aaedacd46e6925a6fc62559a8086a110bf39310ee308bfbbed052f047ad803b7148b87e43b6d83a759be0aeab1149efd4b8eeb
+"@humanwhocodes/object-schema@npm:^2.0.3":
+  version: 2.0.3
+  resolution: "@humanwhocodes/object-schema@npm:2.0.3"
+  checksum: d3b78f6c5831888c6ecc899df0d03bcc25d46f3ad26a11d7ea52944dc36a35ef543fad965322174238d677a43d5c694434f6607532cff7077062513ad7022631
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-private-property-in-object@npm:^7.16.5, @babel/plugin-proposal-private-property-in-object@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-private-property-in-object@npm:7.16.7"
-  dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.7
-    "@babel/helper-create-class-features-plugin": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/plugin-syntax-private-property-in-object": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 666d668f51d8c01aaf0dd87b27a83fc0392884d2c8e9d8e17b3b7011c0d348865dee94b44dc2d7070726e58e3b579728dc2588aaa8140d563f7390743ee90f0a
+"@icholy/duration@npm:~5.1.0":
+  version: 5.1.0
+  resolution: "@icholy/duration@npm:5.1.0"
+  checksum: 48c7c23697a510944bfc52cf0d354eba2b65d14633f910f2dc4c2a5e10e078d3b70bed9b310c37a574f0e6863084aa6cc65518cfc4af5cb2174605c7aad33352
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-private-property-in-object@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-proposal-private-property-in-object@npm:7.17.12"
-  dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.7
-    "@babel/helper-create-class-features-plugin": ^7.17.12
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/plugin-syntax-private-property-in-object": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 056cb77994b2ee367301cdf8c5b7ed71faf26d60859bbba1368b342977481b0884712a1b97fbd9b091750162923d0265bf901119d46002775aa66e4a9f30f411
+"@inquirer/figures@npm:^1.0.3":
+  version: 1.0.11
+  resolution: "@inquirer/figures@npm:1.0.11"
+  checksum: 6be2867050f5c179d9fcc389a4a3e9aca6ac45fd02106918eba2d6c27a7251a48693ac13fcf9f084e25bf963eb51045c23ca9e87c523e318b0e286d4173449a9
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-private-property-in-object@npm:^7.20.5":
-  version: 7.21.11
-  resolution: "@babel/plugin-proposal-private-property-in-object@npm:7.21.11"
+"@isaacs/cliui@npm:^8.0.2":
+  version: 8.0.2
+  resolution: "@isaacs/cliui@npm:8.0.2"
   dependencies:
-    "@babel/helper-annotate-as-pure": ^7.18.6
-    "@babel/helper-create-class-features-plugin": ^7.21.0
-    "@babel/helper-plugin-utils": ^7.20.2
-    "@babel/plugin-syntax-private-property-in-object": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 1b880543bc5f525b360b53d97dd30807302bb82615cd42bf931968f59003cac75629563d6b104868db50abd22235b3271fdf679fea5db59a267181a99cc0c265
+    string-width: ^5.1.2
+    string-width-cjs: "npm:string-width@^4.2.0"
+    strip-ansi: ^7.0.1
+    strip-ansi-cjs: "npm:strip-ansi@^6.0.1"
+    wrap-ansi: ^8.1.0
+    wrap-ansi-cjs: "npm:wrap-ansi@^7.0.0"
+  checksum: 4a473b9b32a7d4d3cfb7a614226e555091ff0c5a29a1734c28c72a182c2f6699b26fc6b5c2131dfd841e86b185aea714c72201d7c98c2fba5f17709333a67aeb
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-unicode-property-regex@npm:^7.12.13, @babel/plugin-proposal-unicode-property-regex@npm:^7.4.4":
-  version: 7.16.0
-  resolution: "@babel/plugin-proposal-unicode-property-regex@npm:7.16.0"
+"@isaacs/fs-minipass@npm:^4.0.0":
+  version: 4.0.1
+  resolution: "@isaacs/fs-minipass@npm:4.0.1"
   dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: f26b76c9aa680820fe693f768a36e3a2c4d969e72d7a362059fffad7c874eed8a89bde2be5bde650283a685bd879415f8937fb37a9a1397b287a81df0c6f7c23
+    minipass: ^7.0.4
+  checksum: 5d36d289960e886484362d9eb6a51d1ea28baed5f5d0140bbe62b99bac52eaf06cc01c2bc0d3575977962f84f6b2c4387b043ee632216643d4787b0999465bf2
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-unicode-property-regex@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-proposal-unicode-property-regex@npm:7.16.7"
+"@jridgewell/gen-mapping@npm:^0.3.5":
+  version: 0.3.8
+  resolution: "@jridgewell/gen-mapping@npm:0.3.8"
   dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2b8a33713d456183f0b7d011011e7bd932c08cc06216399a7b2015ab39284b511993dc10a89bbb15d1d728e6a2ef42ca08c3202619aa148cbd48052422ea3995
+    "@jridgewell/set-array": ^1.2.1
+    "@jridgewell/sourcemap-codec": ^1.4.10
+    "@jridgewell/trace-mapping": ^0.3.24
+  checksum: c0687b5227461717aa537fe71a42e356bcd1c43293b3353796a148bf3b0d6f59109def46c22f05b60e29a46f19b2e4676d027959a7c53a6c92b9d5b0d87d0420
   languageName: node
   linkType: hard
 
-"@babel/plugin-proposal-unicode-property-regex@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-proposal-unicode-property-regex@npm:7.17.12"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.17.12
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 0e4194510415ed11849f1617fcb32d996df746ba93cd05ebbabecb63cfc02c0e97b585c97da3dcf68acdd3c8b71cfae964abe5d5baba6bd3977a475d9225ad9e
+"@jridgewell/resolve-uri@npm:^3.1.0":
+  version: 3.1.2
+  resolution: "@jridgewell/resolve-uri@npm:3.1.2"
+  checksum: 83b85f72c59d1c080b4cbec0fef84528963a1b5db34e4370fa4bd1e3ff64a0d80e0cee7369d11d73c704e0286fb2865b530acac7a871088fbe92b5edf1000870
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-async-generators@npm:^7.8.4":
-  version: 7.8.4
-  resolution: "@babel/plugin-syntax-async-generators@npm:7.8.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.8.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7ed1c1d9b9e5b64ef028ea5e755c0be2d4e5e4e3d6cf7df757b9a8c4cfa4193d268176d0f1f7fbecdda6fe722885c7fda681f480f3741d8a2d26854736f05367
+"@jridgewell/set-array@npm:^1.2.1":
+  version: 1.2.1
+  resolution: "@jridgewell/set-array@npm:1.2.1"
+  checksum: 832e513a85a588f8ed4f27d1279420d8547743cc37fcad5a5a76fc74bb895b013dfe614d0eed9cb860048e6546b798f8f2652020b4b2ba0561b05caa8c654b10
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-class-properties@npm:^7.12.13":
-  version: 7.12.13
-  resolution: "@babel/plugin-syntax-class-properties@npm:7.12.13"
+"@jridgewell/source-map@npm:^0.3.3":
+  version: 0.3.6
+  resolution: "@jridgewell/source-map@npm:0.3.6"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.12.13
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 24f34b196d6342f28d4bad303612d7ff566ab0a013ce89e775d98d6f832969462e7235f3e7eaf17678a533d4be0ba45d3ae34ab4e5a9dcbda5d98d49e5efa2fc
+    "@jridgewell/gen-mapping": ^0.3.5
+    "@jridgewell/trace-mapping": ^0.3.25
+  checksum: c9dc7d899397df95e3c9ec287b93c0b56f8e4453cd20743e2b9c8e779b1949bc3cccf6c01bb302779e46560eb45f62ea38d19fedd25370d814734268450a9f30
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-class-static-block@npm:^7.12.13, @babel/plugin-syntax-class-static-block@npm:^7.14.5":
-  version: 7.14.5
-  resolution: "@babel/plugin-syntax-class-static-block@npm:7.14.5"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 3e80814b5b6d4fe17826093918680a351c2d34398a914ce6e55d8083d72a9bdde4fbaf6a2dcea0e23a03de26dc2917ae3efd603d27099e2b98380345703bf948
+"@jridgewell/sourcemap-codec@npm:^1.4.10, @jridgewell/sourcemap-codec@npm:^1.4.14, @jridgewell/sourcemap-codec@npm:^1.5.0":
+  version: 1.5.0
+  resolution: "@jridgewell/sourcemap-codec@npm:1.5.0"
+  checksum: 05df4f2538b3b0f998ea4c1cd34574d0feba216fa5d4ccaef0187d12abf82eafe6021cec8b49f9bb4d90f2ba4582ccc581e72986a5fcf4176ae0cfeb04cf52ec
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-decorators@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-syntax-decorators@npm:7.16.0"
+"@jridgewell/trace-mapping@npm:^0.3.24, @jridgewell/trace-mapping@npm:^0.3.25":
+  version: 0.3.25
+  resolution: "@jridgewell/trace-mapping@npm:0.3.25"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: afee8cc796f4e8e7ab407420f25d6241932a988036d9b49db289f5e71346e8e7e93157d3c0305f3d95acf4c901cfd6d2ad2d951701e208457788427dc38319c2
+    "@jridgewell/resolve-uri": ^3.1.0
+    "@jridgewell/sourcemap-codec": ^1.4.14
+  checksum: 9d3c40d225e139987b50c48988f8717a54a8c994d8a948ee42e1412e08988761d0754d7d10b803061cc3aebf35f92a5dbbab493bd0e1a9ef9e89a2130e83ba34
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-decorators@npm:^7.16.7":
-  version: 7.19.0
-  resolution: "@babel/plugin-syntax-decorators@npm:7.19.0"
+"@jsdoc/salty@npm:^0.2.1":
+  version: 0.2.9
+  resolution: "@jsdoc/salty@npm:0.2.9"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.19.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 105a13d581a8643ba145d4d0d31f34a492b352defa5b155e785702da6ce9c3ff0c1843ba9bee176e35f6e38afa19dc7bd12c120220af0495de4b128f1dd27f6e
+    lodash: ^4.17.21
+  checksum: 79969d40b4226f1a820e54cd8f96b2b0e75340c38fe494ac0be302062bae71e27ffce928347c59fdbf9783602e2349bca573389cd6481cf4bd2f22fc01264a52
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-decorators@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-syntax-decorators@npm:7.17.12"
+"@keyv/serialize@npm:^1.0.3":
+  version: 1.0.3
+  resolution: "@keyv/serialize@npm:1.0.3"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: cdbb7f92e43a85291845e38910aa1bed0c3e489ae2da187b2e9604d1f2769f72b712a5a8b5e45223c7f5856927557bc314e86f7f1832a47405fdf5e492baa164
+    buffer: ^6.0.3
+  checksum: 5f7b90e8ae76d2a1850a1982cf382aea3ff7cef1f82bea793657e47d8f700609597f317607de07245b40c30b764a19fc7d4efa177d4dc42f6ed4d0a7b5f4e173
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-decorators@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/plugin-syntax-decorators@npm:7.22.5"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 643c75a3b603320c499a0542ca97b5cced81e99de02ae9cbfca1a1ec6d938467546a65023b13df742e1b2f94ffe352ddfe908d14b9303fae7514ed9325886a97
+"@lezer/common@npm:^1.0.0, @lezer/common@npm:^1.0.2, @lezer/common@npm:^1.1.0, @lezer/common@npm:^1.2.0, @lezer/common@npm:^1.2.1":
+  version: 1.2.3
+  resolution: "@lezer/common@npm:1.2.3"
+  checksum: 9b5f52d949adae69d077f56c0b1c2295923108c3dfb241dd9f17654ff708f3eab81ff9fa7f0d0e4a668eabdcb9d961c73e75caca87c966ca1436e30e49130fcb
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-decorators@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-syntax-decorators@npm:7.23.3"
+"@lezer/css@npm:^1.1.0, @lezer/css@npm:^1.1.7":
+  version: 1.2.1
+  resolution: "@lezer/css@npm:1.2.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 07f6e488df0a061428e02629af9a1908b2e8abdcac2e5cfaa267be66dc30897be6e29df7c7f952d33f3679f9585ac9fcf6318f9c827790ab0b0928d5514305cd
+    "@lezer/common": ^1.2.0
+    "@lezer/highlight": ^1.0.0
+    "@lezer/lr": ^1.3.0
+  checksum: da94af5100868127eb3902f9cf1960ac37369ffa12e39df3bdf02e51f7186b2c0e4be42e5901c45822a8fc076a2fd8a750e0483ff0a347d59a52062d8231c9f6
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-dynamic-import@npm:^7.8.3":
-  version: 7.8.3
-  resolution: "@babel/plugin-syntax-dynamic-import@npm:7.8.3"
+"@lezer/go@npm:^1.0.0":
+  version: 1.0.1
+  resolution: "@lezer/go@npm:1.0.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.8.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: ce307af83cf433d4ec42932329fad25fa73138ab39c7436882ea28742e1c0066626d224e0ad2988724c82644e41601cef607b36194f695cb78a1fcdc959637bd
+    "@lezer/common": ^1.2.0
+    "@lezer/highlight": ^1.0.0
+    "@lezer/lr": ^1.3.0
+  checksum: fd67db90ed2a1ee2f060c000f8144d030fbf75f471bd1de1b912ccfb24985d5767f8f830fad73ee478eb0f79d4115eb458c9cd3a35cd38062d461026b96e9529
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-export-namespace-from@npm:^7.8.3":
-  version: 7.8.3
-  resolution: "@babel/plugin-syntax-export-namespace-from@npm:7.8.3"
+"@lezer/highlight@npm:^1.0.0, @lezer/highlight@npm:^1.1.3, @lezer/highlight@npm:^1.2.0, @lezer/highlight@npm:^1.2.1":
+  version: 1.2.1
+  resolution: "@lezer/highlight@npm:1.2.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 85740478be5b0de185228e7814451d74ab8ce0a26fcca7613955262a26e99e8e15e9da58f60c754b84515d4c679b590dbd3f2148f0f58025f4ae706f1c5a5d4a
+    "@lezer/common": ^1.0.0
+  checksum: a8822d7e37f79ff64669eb2df4a9f9d16580e88f2b276a646092e19a9bdccac304e92510e200e35869a8b1f6c27eba5972c508d347a277e9b722d582ab7a23d5
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-import-assertions@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-syntax-import-assertions@npm:7.17.12"
+"@lezer/html@npm:^1.3.0":
+  version: 1.3.10
+  resolution: "@lezer/html@npm:1.3.10"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: fef25c3247d18dc7b8e432ed07f4afb92d70113fcfc3db0ca52388f8083b4bd60f88fe9ec0085e8a5a6daf18a619042376e76e2b4bd9470cddb7362cd268bea5
+    "@lezer/common": ^1.2.0
+    "@lezer/highlight": ^1.0.0
+    "@lezer/lr": ^1.0.0
+  checksum: cce391aab9259704ae3079b3209f74b2f248594dd8b851c28aaff26765e00ebb890a5ff1fe600f2d03aaf4ade0e36de8048d9632b12bfbccd47b3e649c3b0ecd
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-import-assertions@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-syntax-import-assertions@npm:7.23.3"
+"@lezer/javascript@npm:^1.0.0":
+  version: 1.5.1
+  resolution: "@lezer/javascript@npm:1.5.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 883e6b35b2da205138caab832d54505271a3fee3fc1e8dc0894502434fc2b5d517cbe93bbfbfef8068a0fb6ec48ebc9eef3f605200a489065ba43d8cddc1c9a7
+    "@lezer/common": ^1.2.0
+    "@lezer/highlight": ^1.1.3
+    "@lezer/lr": ^1.3.0
+  checksum: 8de877c3f41a985211d0ef80c98966f1339f1a0ec1df0b199ce58d97cb4c0648cb3176d76ff426b9c5aa4a3bbb51bb6e673b5cc73763cb8dc4505f3853697fb5
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-import-attributes@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-syntax-import-attributes@npm:7.23.3"
+"@lezer/json@npm:^1.0.0":
+  version: 1.0.3
+  resolution: "@lezer/json@npm:1.0.3"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 9aed7661ffb920ca75df9f494757466ca92744e43072e0848d87fa4aa61a3f2ee5a22198ac1959856c036434b5614a8f46f1fb70298835dbe28220cdd1d4c11e
+    "@lezer/common": ^1.2.0
+    "@lezer/highlight": ^1.0.0
+    "@lezer/lr": ^1.0.0
+  checksum: 48e7b945fdfa2b5b6f862e27bc31f3991cba93f18df7fed0059b25f119b64dedd50bbc709d279e16e2b3eee10e7758d7d80c6d98d21bc15c284809d268837897
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-import-meta@npm:^7.10.4":
-  version: 7.10.4
-  resolution: "@babel/plugin-syntax-import-meta@npm:7.10.4"
+"@lezer/lr@npm:^1.0.0, @lezer/lr@npm:^1.3.0, @lezer/lr@npm:^1.4.0":
+  version: 1.4.2
+  resolution: "@lezer/lr@npm:1.4.2"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.10.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 166ac1125d10b9c0c430e4156249a13858c0366d38844883d75d27389621ebe651115cb2ceb6dc011534d5055719fa1727b59f39e1ab3ca97820eef3dcab5b9b
+    "@lezer/common": ^1.0.0
+  checksum: 94318ad046c7dfcc8d37e26cb85b99623c39aef60aa51ec2abb30928e7a649f38fa5520f34bd5b356f1db11b6991999589f039e87c8949b0f163be3764f029d8
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-json-strings@npm:^7.8.3":
-  version: 7.8.3
-  resolution: "@babel/plugin-syntax-json-strings@npm:7.8.3"
+"@lezer/markdown@npm:^1.0.0":
+  version: 1.4.3
+  resolution: "@lezer/markdown@npm:1.4.3"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.8.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: bf5aea1f3188c9a507e16efe030efb996853ca3cadd6512c51db7233cc58f3ac89ff8c6bdfb01d30843b161cfe7d321e1bf28da82f7ab8d7e6bc5464666f354a
+    "@lezer/common": ^1.0.0
+    "@lezer/highlight": ^1.0.0
+  checksum: d730c5b273f0fc9df0658c338f007e00838aa87d7ecdda181eb5def5253cf76aaac0671ef03e7459fd179128e77c2e8d74c2dc43402ee21cebb4fb9dd7db89c7
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-logical-assignment-operators@npm:^7.10.4":
-  version: 7.10.4
-  resolution: "@babel/plugin-syntax-logical-assignment-operators@npm:7.10.4"
+"@lezer/yaml@npm:^1.0.0":
+  version: 1.0.3
+  resolution: "@lezer/yaml@npm:1.0.3"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.10.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: aff33577037e34e515911255cdbb1fd39efee33658aa00b8a5fd3a4b903585112d037cce1cc9e4632f0487dc554486106b79ccd5ea63a2e00df4363f6d4ff886
+    "@lezer/common": ^1.2.0
+    "@lezer/highlight": ^1.0.0
+    "@lezer/lr": ^1.4.0
+  checksum: d794e5253e89471293744cb25bf765b2ba50ae60675e82f80b48203f6b53ee7b0209af6e487263dff8ee1490dc0ba797b7c7a77566d645c5213ed55d33ab1572
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-nullish-coalescing-operator@npm:^7.8.3":
-  version: 7.8.3
-  resolution: "@babel/plugin-syntax-nullish-coalescing-operator@npm:7.8.3"
+"@lineal-viz/lineal@npm:^0.5.1, @lineal-viz/lineal@npm:~0.5.1":
+  version: 0.5.1
+  resolution: "@lineal-viz/lineal@npm:0.5.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.8.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 87aca4918916020d1fedba54c0e232de408df2644a425d153be368313fdde40d96088feed6c4e5ab72aac89be5d07fef2ddf329a15109c5eb65df006bf2580d1
+    "@embroider/addon-shim": ^1.0.0
+    d3-array: ^3.2.0
+    d3-scale: ^4.0.2
+    d3-shape: ^3.1.0
+    ember-cached-decorator-polyfill: ^1.0.1
+    ember-modifier: ^3.2.7
+    ember-resize-modifier: ^0.4.1
+  checksum: be47dbac62d65f01121d78b8ed393c7c5aa7cb520755a504d912b44054a478a16b9834208f031cb3cd1710c3f04008a91aa41b36ed544d0a738a09607d3c29ac
   languageName: node
   linkType: hard
 
-"@babel/plugin-syntax-numeric-separator@npm:^7.10.4":
-  version: 7.10.4
-  resolution: "@babel/plugin-syntax-numeric-separator@npm:7.10.4"
+"@lint-todo/utils@npm:^13.1.1":
+  version: 13.1.1
+  resolution: "@lint-todo/utils@npm:13.1.1"
   dependencies:
-    "@babel/helper-plugin-utils": ^7.10.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 01ec5547bd0497f76cc903ff4d6b02abc8c05f301c88d2622b6d834e33a5651aa7c7a3d80d8d57656a4588f7276eba357f6b7e006482f5b564b7a6488de493a1
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-syntax-object-rest-spread@npm:^7.8.3":
-  version: 7.8.3
-  resolution: "@babel/plugin-syntax-object-rest-spread@npm:7.8.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.8.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: fddcf581a57f77e80eb6b981b10658421bc321ba5f0a5b754118c6a92a5448f12a0c336f77b8abf734841e102e5126d69110a306eadb03ca3e1547cab31f5cbf
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-syntax-optional-catch-binding@npm:^7.8.3":
-  version: 7.8.3
-  resolution: "@babel/plugin-syntax-optional-catch-binding@npm:7.8.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.8.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 910d90e72bc90ea1ce698e89c1027fed8845212d5ab588e35ef91f13b93143845f94e2539d831dc8d8ededc14ec02f04f7bd6a8179edd43a326c784e7ed7f0b9
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-syntax-optional-chaining@npm:^7.8.3":
-  version: 7.8.3
-  resolution: "@babel/plugin-syntax-optional-chaining@npm:7.8.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.8.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: eef94d53a1453361553c1f98b68d17782861a04a392840341bc91780838dd4e695209c783631cf0de14c635758beafb6a3a65399846ffa4386bff90639347f30
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-syntax-private-property-in-object@npm:^7.14.0, @babel/plugin-syntax-private-property-in-object@npm:^7.14.5":
-  version: 7.14.5
-  resolution: "@babel/plugin-syntax-private-property-in-object@npm:7.14.5"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: b317174783e6e96029b743ccff2a67d63d38756876e7e5d0ba53a322e38d9ca452c13354a57de1ad476b4c066dbae699e0ca157441da611117a47af88985ecda
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-syntax-top-level-await@npm:^7.12.13, @babel/plugin-syntax-top-level-await@npm:^7.14.5":
-  version: 7.14.5
-  resolution: "@babel/plugin-syntax-top-level-await@npm:7.14.5"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: bbd1a56b095be7820029b209677b194db9b1d26691fe999856462e66b25b281f031f3dfd91b1619e9dcf95bebe336211833b854d0fb8780d618e35667c2d0d7e
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-syntax-typescript@npm:^7.16.0, @babel/plugin-syntax-typescript@npm:^7.8.3":
-  version: 7.16.0
-  resolution: "@babel/plugin-syntax-typescript@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2da3bdd031230e515615fe39c50d40064d04f64f1d2b60113adff2c112a27e4f9425425e604297d5c2af2b635e7980f3677e434dfeb1d7320ad2cd1ffc8e8c2a
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-syntax-typescript@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/plugin-syntax-typescript@npm:7.18.6"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.18.6
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2cde73725ec51118ebf410bf02d78781c03fa4d3185993fcc9d253b97443381b621c44810084c5dd68b92eb8bdfae0e5b163e91b32bebbb33852383d1815c05d
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-syntax-typescript@npm:^7.2.0":
-  version: 7.12.13
-  resolution: "@babel/plugin-syntax-typescript@npm:7.12.13"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.12.13
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 3bd08315a82c6cd292e95087f4e9635a92a593112f9bd9e5581dd555d8fa102b4871ece7c54d9fa89f9b0cbd6b2829c7118eaa6fb9a09a3c8edb96868446013f
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-syntax-typescript@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-syntax-typescript@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: abfad3a19290d258b028e285a1f34c9b8a0cbe46ef79eafed4ed7ffce11b5d0720b5e536c82f91cbd8442cde35a3dd8e861fa70366d87ff06fdc0d4756e30876
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-syntax-unicode-sets-regex@npm:^7.18.6":
-  version: 7.18.6
-  resolution: "@babel/plugin-syntax-unicode-sets-regex@npm:7.18.6"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.18.6
-    "@babel/helper-plugin-utils": ^7.18.6
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: a651d700fe63ff0ddfd7186f4ebc24447ca734f114433139e3c027bc94a900d013cf1ef2e2db8430425ba542e39ae160c3b05f06b59fd4656273a3df97679e9c
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-arrow-functions@npm:^7.13.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-arrow-functions@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: ff647300424968d1cd6c6b015fd72d332042a94c7b08f3e785f32d22364bfad49258a41c53675de08573af98da1a623efa03da13a653f06988f79a9d571f7030
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-arrow-functions@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-arrow-functions@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2a6aa982c6fc80f4de7ccd973507ce5464fab129987cb6661136a7b9b6a020c2b329b912cbc46a68d39b5a18451ba833dcc8d1ca8d615597fec98624ac2add54
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-arrow-functions@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-arrow-functions@npm:7.17.12"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 48f99e74f523641696d5d9fb3f5f02497eca2e97bc0e9b8230a47f388e37dc5fd84b8b29e9f5a0c82d63403f7ba5f085a28e26939678f6e917d5c01afd884b50
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-arrow-functions@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-arrow-functions@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 1e99118176e5366c2636064d09477016ab5272b2a92e78b8edb571d20bc3eaa881789a905b20042942c3c2d04efc530726cf703f937226db5ebc495f5d067e66
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-async-generator-functions@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-async-generator-functions@npm:7.23.4"
-  dependencies:
-    "@babel/helper-environment-visitor": ^7.22.20
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-remap-async-to-generator": ^7.22.20
-    "@babel/plugin-syntax-async-generators": ^7.8.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e2fc132c9033711d55209f4781e1fc73f0f4da5e0ca80a2da73dec805166b73c92a6e83571a8994cd2c893a28302e24107e90856202b24781bab734f800102bb
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-async-to-generator@npm:^7.13.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-async-to-generator@npm:7.16.0"
-  dependencies:
-    "@babel/helper-module-imports": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/helper-remap-async-to-generator": ^7.16.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2ebf505f43350d246007d754577477ddb0132c4ab39c9fd420d36ebb6e489b2b3eb48f27fe58f7ad0c742946a1e81e3b150666507abab03fe6bd649ff585ed45
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-async-to-generator@npm:^7.16.8":
-  version: 7.16.8
-  resolution: "@babel/plugin-transform-async-to-generator@npm:7.16.8"
-  dependencies:
-    "@babel/helper-module-imports": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/helper-remap-async-to-generator": ^7.16.8
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 3a2e781800e3dea1f526324ed259d1f9064c5ea3c9909c0c22b445d4c648ad489c579f358ae20ada11f7725ba67e0ddeb1e0241efadc734771e87dabd4c6820a
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-async-to-generator@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-async-to-generator@npm:7.17.12"
-  dependencies:
-    "@babel/helper-module-imports": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/helper-remap-async-to-generator": ^7.16.8
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 052dd56eb3b10bc31f5aaced0f75fc7307713f74049ccfb91cd087bebfc890a6d462b59445c5299faaca9030814172cac290c941c76b731a38dcb267377c9187
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-async-to-generator@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-async-to-generator@npm:7.23.3"
-  dependencies:
-    "@babel/helper-module-imports": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-remap-async-to-generator": ^7.22.20
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2e9d9795d4b3b3d8090332104e37061c677f29a1ce65bcbda4099a32d243e5d9520270a44bbabf0fb1fb40d463bd937685b1a1042e646979086c546d55319c3c
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-block-scoped-functions@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-block-scoped-functions@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: f7efc5d8ce9242e11c94c82d9c940d4c534a751ff3679839d2f7d7a300c29ac4c4a3c26c238b5f2828201cac8a848bfb6342c285460f6ce5bc267cbdc1bb070b
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-block-scoped-functions@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-block-scoped-functions@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 591e9f75437bb32ebf9506d28d5c9659c66c0e8e0c19b12924d808d898e68309050aadb783ccd70bb4956555067326ecfa17a402bc77eb3ece3c6863d40b9016
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-block-scoped-functions@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-block-scoped-functions@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e63b16d94ee5f4d917e669da3db5ea53d1e7e79141a2ec873c1e644678cdafe98daa556d0d359963c827863d6b3665d23d4938a94a4c5053a1619c4ebd01d020
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-block-scoping@npm:^7.12.1":
-  version: 7.13.16
-  resolution: "@babel/plugin-transform-block-scoping@npm:7.13.16"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.13.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: f84f08c95654ca33962405c60f8109095405c3c6a8e126d09e3543675d1363a2ad4712bea1f6f878aee6a9f966dc627a8a5acd4ddf159c69a41b532ab610b324
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-block-scoping@npm:^7.13.16":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-block-scoping@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e5bcb9eeed7974ee6dd14c360c21ad2465f81342001e5468bbec5db483fffc78bb0e7f84155be6c32588bc0b43a6ca0050c7962400b33d134f6298c31c8073d4
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-block-scoping@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-block-scoping@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: f93b5441af573fc274655f1707aeb4f67a43e926b58f56d89cc35a27877ae0bf198648603cbc19f442579489138f93c3838905895f109aa356996dbc3ed97a68
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-block-scoping@npm:^7.17.12":
-  version: 7.18.4
-  resolution: "@babel/plugin-transform-block-scoping@npm:7.18.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 5fdc8fd2f56f43e275353123fa1cda3df475daf1e9d92c03d5aa1ae50d3a0ccabf80c6168356947d8eb8e6e29098c875bc27fda8c7d4fbca6ffc6eec5d5faa8d
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-block-scoping@npm:^7.20.5":
-  version: 7.22.5
-  resolution: "@babel/plugin-transform-block-scoping@npm:7.22.5"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 26987002cfe6e24544e60fa35f07052b6557f590c1a1cc5cf35d6dc341d7fea163c1222a2d70d5d2692f0b9860d942fd3ba979848b2995d4debffa387b9b19ae
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-block-scoping@npm:^7.21.0, @babel/plugin-transform-block-scoping@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-block-scoping@npm:7.23.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: fc4b2100dd9f2c47d694b4b35ae8153214ccb4e24ef545c259a9db17211b18b6a430f22799b56db8f6844deaeaa201af45a03331d0c80cc28b0c4e3c814570e4
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-class-properties@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-class-properties@npm:7.23.3"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 9c6f8366f667897541d360246de176dd29efc7a13d80a5b48361882f7173d9173be4646c3b7d9b003ccc0e01e25df122330308f33db921fa553aa17ad544b3fc
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-class-static-block@npm:^7.16.7, @babel/plugin-transform-class-static-block@npm:^7.22.11, @babel/plugin-transform-class-static-block@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-class-static-block@npm:7.23.4"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-class-static-block": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.12.0
-  checksum: c8bfaba19a674fc2eb54edad71e958647360474e3163e8226f1acd63e4e2dbec32a171a0af596c1dc5359aee402cc120fea7abd1fb0e0354b6527f0fc9e8aa1e
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-classes@npm:^7.13.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-classes@npm:7.16.0"
-  dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.0
-    "@babel/helper-function-name": ^7.16.0
-    "@babel/helper-optimise-call-expression": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/helper-replace-supers": ^7.16.0
-    "@babel/helper-split-export-declaration": ^7.16.0
-    globals: ^11.1.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7db47296045761b3f35a9075b4bcce99ad5aa93714cca235961fa596983ba6cfd4d84b29fa6745e4752bd2a60ac299b0dee3231ce20061b6798ae16a147e4992
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-classes@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-classes@npm:7.16.7"
-  dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.7
-    "@babel/helper-environment-visitor": ^7.16.7
-    "@babel/helper-function-name": ^7.16.7
-    "@babel/helper-optimise-call-expression": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/helper-replace-supers": ^7.16.7
-    "@babel/helper-split-export-declaration": ^7.16.7
-    globals: ^11.1.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 791526a1bf3c4659b94d619536e3181d3ad54887d50539066628c6e695789a3bb264dc1fbc8540169d62a222f623df54defb490c1811ae63bad1e3557d6b3bb0
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-classes@npm:^7.17.12":
-  version: 7.18.4
-  resolution: "@babel/plugin-transform-classes@npm:7.18.4"
-  dependencies:
-    "@babel/helper-annotate-as-pure": ^7.16.7
-    "@babel/helper-environment-visitor": ^7.18.2
-    "@babel/helper-function-name": ^7.17.9
-    "@babel/helper-optimise-call-expression": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/helper-replace-supers": ^7.18.2
-    "@babel/helper-split-export-declaration": ^7.16.7
-    globals: ^11.1.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 968711024c2ed1c08ced754243edde3a663ab40c414ca6fcad1a75f27789f3f52cc78fbafe21c6337c4c6a0dfbeddd1527caff1558ed477790b600a1e6f99cda
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-classes@npm:^7.23.5":
-  version: 7.23.5
-  resolution: "@babel/plugin-transform-classes@npm:7.23.5"
-  dependencies:
-    "@babel/helper-annotate-as-pure": ^7.22.5
-    "@babel/helper-compilation-targets": ^7.22.15
-    "@babel/helper-environment-visitor": ^7.22.20
-    "@babel/helper-function-name": ^7.23.0
-    "@babel/helper-optimise-call-expression": ^7.22.5
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-replace-supers": ^7.22.20
-    "@babel/helper-split-export-declaration": ^7.22.6
-    globals: ^11.1.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 6d0dd3b0828e84a139a51b368f33f315edee5688ef72c68ba25e0175c68ea7357f9c8810b3f61713e368a3063cdcec94f3a2db952e453b0b14ef428a34aa8169
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-computed-properties@npm:^7.13.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-computed-properties@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 0f86de419cf5daf28b01c5b2feafa426e5b0ec776290e731de3d7a6ec4ec742400e13436d67292e500ecd50e21ddab9ae34da79357a85a443d30dc94f2a4f6a3
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-computed-properties@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-computed-properties@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 28b17f7cfe643f45920b76dc040cab40d4e54eccf5074fba2658c484feacda9b4885b3854ffaf26292189783fdecc97211519c61831b6708fcbf739cfbcbf31c
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-computed-properties@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-computed-properties@npm:7.17.12"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 5d05418617e0967bec4818556b7febb6f8c40813e32035f0bd6b7dbd7b9d63e9ab7c7c8fd7bd05bab2a599dad58e7b69957d9559b41079d112c219bbc3649aa1
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-computed-properties@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-computed-properties@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/template": ^7.22.15
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 80452661dc25a0956f89fe98cb562e8637a9556fb6c00d312c57653ce7df8798f58d138603c7e1aad96614ee9ccd10c47e50ab9ded6b6eded5adeb230d2a982e
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-destructuring@npm:^7.13.17":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-destructuring@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 0a499c9abd6b50d4da6a3c8416e3cdf305f8002fddb3bd9ddd0774ba17ab1b10134f79fe8edc495c94344e5ab387626fb0ee124d31810758968a92d573ff9034
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-destructuring@npm:^7.16.7":
-  version: 7.17.7
-  resolution: "@babel/plugin-transform-destructuring@npm:7.17.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 767ecf6640fea9a06a4859f0c34daa30ac7d146a96476caa1f77081d5b6e43699f45e14acd52682078f2b7c230ff0814312b41f61b21ca2b5f9c5a2cc93c2b58
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-destructuring@npm:^7.18.0":
-  version: 7.18.0
-  resolution: "@babel/plugin-transform-destructuring@npm:7.18.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d85d60737c3b05c4db71bc94270e952122d360bd6ebf91b5f98cf16fb8564558b615d115354fe0ef41e2aae9c4540e6e16144284d881ecaef687693736cd2a79
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-destructuring@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-destructuring@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 9e015099877272501162419bfe781689aec5c462cd2aec752ee22288f209eec65969ff11b8fdadca2eaddea71d705d3bba5b9c60752fcc1be67874fcec687105
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-dotall-regex@npm:^7.12.13, @babel/plugin-transform-dotall-regex@npm:^7.4.4":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-dotall-regex@npm:7.16.0"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: c1f381f0d44a1b33714a68ffd60f2b9efac1be95caf3c21192cc8233afde2fae1da268e26b3cb40764736f090793b66946574c3310cfdd4906a7e72310239ff9
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-dotall-regex@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-dotall-regex@npm:7.16.7"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 554570dddfd5bfd87ab307be520f69a3d4ed2d2db677c165971b400d4c96656d0c165b318e69f1735612dcd12e04c0ee257697dc26800e8a572ca73bc05fa0f4
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-dotall-regex@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-dotall-regex@npm:7.23.3"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a2dbbf7f1ea16a97948c37df925cb364337668c41a3948b8d91453f140507bd8a3429030c7ce66d09c299987b27746c19a2dd18b6f17dcb474854b14fd9159a3
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-duplicate-keys@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-duplicate-keys@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 66f09487fdf737aa280c780a609bafc9a771b34b5f9a8dccf69752c22110893763f6c105062776f084ed872a55d1656b3f14e2a9c2031f3dbdf31da20d9c827b
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-duplicate-keys@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-duplicate-keys@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: b96f6e9f7b33a91ad0eb6b793e4da58b7a0108b58269109f391d57078d26e043b3872c95429b491894ae6400e72e44d9b744c9b112b8433c99e6969b767e30ed
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-duplicate-keys@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-duplicate-keys@npm:7.17.12"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: fb6ad550538830b0dc5b1b547734359f2d782209570e9d61fe9b84a6929af570fcc38ab579a67ee7cd6a832147db91a527f4cceb1248974f006fe815980816bb
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-duplicate-keys@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-duplicate-keys@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: c2a21c34dc0839590cd945192cbc46fde541a27e140c48fe1808315934664cdbf18db64889e23c4eeb6bad9d3e049482efdca91d29de5734ffc887c4fbabaa16
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-dynamic-import@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-dynamic-import@npm:7.23.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-dynamic-import": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 57a722604c430d9f3dacff22001a5f31250e34785d4969527a2ae9160fa86858d0892c5b9ff7a06a04076f8c76c9e6862e0541aadca9c057849961343aab0845
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-exponentiation-operator@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-exponentiation-operator@npm:7.16.0"
-  dependencies:
-    "@babel/helper-builder-binary-assignment-operator-visitor": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 22e1d4804a5fc522744a1cc13e2c35c5d81c2e303a634822fee59829477b3748dcf897a020c3083084350ab1d3b76752157b216971157763394021e2f2184094
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-exponentiation-operator@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-exponentiation-operator@npm:7.16.7"
-  dependencies:
-    "@babel/helper-builder-binary-assignment-operator-visitor": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 8082c79268f5b1552292bd3abbfed838a1131747e62000146e70670707b518602e907bbe3aef0fda824a2eebe995a9d897bd2336a039c5391743df01608673b0
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-exponentiation-operator@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-exponentiation-operator@npm:7.23.3"
-  dependencies:
-    "@babel/helper-builder-binary-assignment-operator-visitor": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 00d05ab14ad0f299160fcf9d8f55a1cc1b740e012ab0b5ce30207d2365f091665115557af7d989cd6260d075a252d9e4283de5f2b247dfbbe0e42ae586e6bf66
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-export-namespace-from@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-export-namespace-from@npm:7.23.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-export-namespace-from": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 9f770a81bfd03b48d6ba155d452946fd56d6ffe5b7d871e9ec2a0b15e0f424273b632f3ed61838b90015b25bbda988896b7a46c7d964fbf8f6feb5820b309f93
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-for-of@npm:^7.13.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-for-of@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 504d967b30b00d3e1a2784f6a215963fc0036871f8fd6ca61e41e67cdb3319511e9148164428144469416b35b0e02c896c144402ace7cd7a6c45b0d1e8746ae6
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-for-of@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-for-of@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 35c9264ee4bef814818123d70afe8b2f0a85753a0a9dc7b73f93a71cadc5d7de852f1a3e300a7c69a491705805704611de1e2ccceb5686f7828d6bca2e5a7306
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-for-of@npm:^7.18.1":
-  version: 7.18.1
-  resolution: "@babel/plugin-transform-for-of@npm:7.18.1"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: cdc6e1f1170218cc6ac5b26b4b8f011ec5c36666101e00e0061aaa5772969b093bad5b2af8ce908c184126d5bb0c26b89dd4debb96b2375aba2e20e427a623a8
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-for-of@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-for-of@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a6288122a5091d96c744b9eb23dc1b2d4cce25f109ac1e26a0ea03c4ea60330e6f3cc58530b33ba7369fa07163b71001399a145238b7e92bff6270ef3b9c32a0
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-function-name@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-function-name@npm:7.16.0"
-  dependencies:
-    "@babel/helper-function-name": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 289f4fce26e8b3a81fcae752cecdb78b363eb29e400aa4dc8318484156d908ddc6dd5b274b8fbcdb80ea59a362834554c4a5d3454e974957dbd2b30c3d00ad3f
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-function-name@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-function-name@npm:7.16.7"
-  dependencies:
-    "@babel/helper-compilation-targets": ^7.16.7
-    "@babel/helper-function-name": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 4d97d0b84461cdd5d5aa2d010cdaf30f1f83a92a0dedd3686cbc7e90dc1249a70246f5bac0c1f3cd3f1dbfb03f7aac437776525a0c90cafd459776ea4fcc6bde
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-function-name@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-function-name@npm:7.23.3"
-  dependencies:
-    "@babel/helper-compilation-targets": ^7.22.15
-    "@babel/helper-function-name": ^7.23.0
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 355c6dbe07c919575ad42b2f7e020f320866d72f8b79181a16f8e0cd424a2c761d979f03f47d583d9471b55dcd68a8a9d829b58e1eebcd572145b934b48975a6
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-json-strings@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-json-strings@npm:7.23.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-json-strings": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: f9019820233cf8955d8ba346df709a0683c120fe86a24ed1c9f003f2db51197b979efc88f010d558a12e1491210fc195a43cd1c7fee5e23b92da38f793a875de
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-literals@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-literals@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7291771c7626a27684053ceefc4e2e3e480a6ceab9f3c8abbdd9c90fcea63f035ace397e53bfc4b7311b835f7c79449be03226affa69e2e2a96c14b6da4d5db9
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-literals@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-literals@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a9565d999fc7a72a391ef843cf66028c38ca858537c7014d9ea8ea587a59e5f952d9754bdcca6ca0446e84653e297d417d4faedccb9e4221af1aa30f25d918e0
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-literals@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-literals@npm:7.17.12"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 09280fc1ed23b81deafd4fcd7a35d6c0944668de2317f14c1b8b78c5c201f71a063bb8d174d2fc97d86df480ff23104c8919d3aacf19f33c2b5ada584203bf1c
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-literals@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-literals@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 519a544cd58586b9001c4c9b18da25a62f17d23c48600ff7a685d75ca9eb18d2c5e8f5476f067f0a8f1fea2a31107eff950b9864833061e6076dcc4bdc3e71ed
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-logical-assignment-operators@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-logical-assignment-operators@npm:7.23.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-logical-assignment-operators": ^7.10.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2ae1dc9b4ff3bf61a990ff3accdecb2afe3a0ca649b3e74c010078d1cdf29ea490f50ac0a905306a2bcf9ac177889a39ac79bdcc3a0fdf220b3b75fac18d39b5
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-member-expression-literals@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-member-expression-literals@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d5ed6cf840b9fd8b88f719dea46dc26a1778f10aeab6878b3eabf2350cfa813bfeff09d91c6afc93dd3536a48bc892a0afcf9f99f3bad6b54b41638f3ae80fa9
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-member-expression-literals@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-member-expression-literals@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: fdf5b22abab2b770e69348ce7f99796c3e0e1e7ce266afdbe995924284704930fa989323bdbda7070db8adb45a72f39eaa1dbebf18b67fc44035ec00c6ae3300
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-member-expression-literals@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-member-expression-literals@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 95cec13c36d447c5aa6b8e4c778b897eeba66dcb675edef01e0d2afcec9e8cb9726baf4f81b4bbae7a782595aed72e6a0d44ffb773272c3ca180fada99bf92db
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-amd@npm:^7.13.0, @babel/plugin-transform-modules-amd@npm:^7.14.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-modules-amd@npm:7.16.0"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    babel-plugin-dynamic-import-node: ^2.3.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: c37ccb8cd7a301123fb5590712d957bf9f82bb0d89a83441b570a9f9793af76b99449c93f1079ad187fb598a5eeb5571561ff4d71af9192c7d6e407a464d6aff
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-amd@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-modules-amd@npm:7.16.7"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-    babel-plugin-dynamic-import-node: ^2.3.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 9ac251ee96183b10cf9b4ec8f9e8d52e14ec186a56103f6c07d0c69e99faa60391f6bac67da733412975e487bd36adb403e2fc99bae6b785bf1413e9d928bc71
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-amd@npm:^7.18.0":
-  version: 7.18.0
-  resolution: "@babel/plugin-transform-modules-amd@npm:7.18.0"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.18.0
-    "@babel/helper-plugin-utils": ^7.17.12
-    babel-plugin-dynamic-import-node: ^2.3.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: bed3ff5cd81f236981360fc4a6fd2262685c1202772c657ce3ab95b7930437f8fa22361021b481c977b6f47988dfcc07c7782a1c91b90d3a5552c91401f4631a
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-amd@npm:^7.20.11":
-  version: 7.22.5
-  resolution: "@babel/plugin-transform-modules-amd@npm:7.22.5"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.22.5
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7da4c4ebbbcf7d182abb59b2046b22d86eee340caf8a22a39ef6a727da2d8acfec1f714fcdcd5054110b280e4934f735e80a6848d192b6834c5d4459a014f04d
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-amd@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-modules-amd@npm:7.23.3"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.23.3
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d163737b6a3d67ea579c9aa3b83d4df4b5c34d9dcdf25f415f027c0aa8cded7bac2750d2de5464081f67a042ad9e1c03930c2fab42acd79f9e57c00cf969ddff
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-commonjs@npm:^7.14.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-modules-commonjs@npm:7.16.0"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/helper-simple-access": ^7.16.0
-    babel-plugin-dynamic-import-node: ^2.3.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a7e43670f503b31d6ad42977ddefb7bffc23f700a24252859652aa03efd666698567b0817060dd6f84a6cd23e7aac7464bc0dc7f7f929cad212263abcac9d470
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-commonjs@npm:^7.16.8":
-  version: 7.17.7
-  resolution: "@babel/plugin-transform-modules-commonjs@npm:7.17.7"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.17.7
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/helper-simple-access": ^7.17.7
-    babel-plugin-dynamic-import-node: ^2.3.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d84385d89465f8241cbeed8069dc54fb15ee0465119a3326c65ee93ce93019b7a9953b23e22a67203aa2ebf81ac444eadf6d37912d453ec7ba2dce9872bb6490
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-commonjs@npm:^7.18.2":
-  version: 7.18.2
-  resolution: "@babel/plugin-transform-modules-commonjs@npm:7.18.2"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.18.0
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/helper-simple-access": ^7.18.2
-    babel-plugin-dynamic-import-node: ^2.3.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 99c1c5ce9c353e29eb680ebb5bdf27c076c6403e133a066999298de642423cc7f38cfbac02372d33ed73278da13be23c4be7d60169c3e27bd900a373e61a599a
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-commonjs@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-modules-commonjs@npm:7.23.3"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.23.3
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-simple-access": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 720a231ceade4ae4d2632478db4e7fecf21987d444942b72d523487ac8d715ca97de6c8f415c71e939595e1a4776403e7dc24ed68fe9125ad4acf57753c9bff7
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-systemjs@npm:^7.13.8":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-modules-systemjs@npm:7.16.0"
-  dependencies:
-    "@babel/helper-hoist-variables": ^7.16.0
-    "@babel/helper-module-transforms": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/helper-validator-identifier": ^7.15.7
-    babel-plugin-dynamic-import-node: ^2.3.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 4aa9bd45a4c1f79a4abd92482b4f9ac6492b5e727ee34316c80a30b6524281d39959a2d556b231eae4b1031f35e0133e60270f9e4bfa5f25a8cb68ef145dfcd2
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-systemjs@npm:^7.16.7":
-  version: 7.17.8
-  resolution: "@babel/plugin-transform-modules-systemjs@npm:7.17.8"
-  dependencies:
-    "@babel/helper-hoist-variables": ^7.16.7
-    "@babel/helper-module-transforms": ^7.17.7
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/helper-validator-identifier": ^7.16.7
-    babel-plugin-dynamic-import-node: ^2.3.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 058c0e7987aab64c4019bc9eab3f80c5dd05bec737e230e5c60e9222dfb3d01b2dfa3aa1db6cbb75a4095c40af3bba2e3a60170b1570a158d3e781376569ce49
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-systemjs@npm:^7.18.0":
-  version: 7.18.4
-  resolution: "@babel/plugin-transform-modules-systemjs@npm:7.18.4"
-  dependencies:
-    "@babel/helper-hoist-variables": ^7.16.7
-    "@babel/helper-module-transforms": ^7.18.0
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/helper-validator-identifier": ^7.16.7
-    babel-plugin-dynamic-import-node: ^2.3.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: abe6948a1548b20055bf1c56ceab5b17dc283e7cdbcc0525b297b726f0785f1169333b5e685add81337fc749588adb8d96ccba9269565031db006a710e7eaf02
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-systemjs@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-modules-systemjs@npm:7.23.3"
-  dependencies:
-    "@babel/helper-hoist-variables": ^7.22.5
-    "@babel/helper-module-transforms": ^7.23.3
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-validator-identifier": ^7.22.20
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 0d2fdd993c785aecac9e0850cd5ed7f7d448f0fbb42992a950cc0590167144df25d82af5aac9a5c99ef913d2286782afa44e577af30c10901c5ee8984910fa1f
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-umd@npm:^7.14.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-modules-umd@npm:7.16.0"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: b07d41eae3a1163fdb2dca4bffb0de880981e6581163948a88b7665709e860612932f5a73e54d70057e834d3968e3b5f86222f1d302c9e1d34d95a764584af54
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-umd@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-modules-umd@npm:7.16.7"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d1433f8b0e0b3c9f892aa530f08fe3ba653a5e51fe1ed6034ac7d45d4d6f22c3ba99186b72e41ad9ce5d8dcf964104c3da2419f15fcdcf5ba05c5fda3ea2cefc
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-umd@npm:^7.18.0":
-  version: 7.18.0
-  resolution: "@babel/plugin-transform-modules-umd@npm:7.18.0"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.18.0
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 4081a79cfd4c6fda785c2137f9f2721e35c06a9d2f23c304172838d12e9317a24d3cb5b652a9db61e58319b370c57b1b44991429efe709679f98e114d98597fb
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-modules-umd@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-modules-umd@npm:7.23.3"
-  dependencies:
-    "@babel/helper-module-transforms": ^7.23.3
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 586a7a2241e8b4e753a37af9466a9ffa8a67b4ba9aa756ad7500712c05d8fa9a8c1ed4f7bd25fae2a8265e6cf8fe781ec85a8ee885dd34cf50d8955ee65f12dc
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-named-capturing-groups-regex@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-named-capturing-groups-regex@npm:7.16.0"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.16.0
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 758a87aca66ea7944c5f94ed7a798220c3b2986da4c38dc3f63221065ec96534bf39b3b043dd9759dbdff4026d340bbe51082d5ad4505c19b08893663130675b
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-named-capturing-groups-regex@npm:^7.16.8":
-  version: 7.16.8
-  resolution: "@babel/plugin-transform-named-capturing-groups-regex@npm:7.16.8"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 73e149f5ff690f5b8e3764a881e8e5240f12f394256e7d5217705d0cbeae074c3faff394783190fe1a41f9fc5a53b960b6021158b7e5174391b5fc38f4ba047a
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-named-capturing-groups-regex@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-named-capturing-groups-regex@npm:7.17.12"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.17.12
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: cff9d91d0abd87871da6574583e79093ed75d5faecea45b6a13350ba243b1a595d349a6e7d906f5dfdf6c69c643cba9df662c3d01eaa187c5b1a01cb5838e848
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-named-capturing-groups-regex@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/plugin-transform-named-capturing-groups-regex@npm:7.22.5"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.22.5
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 3ee564ddee620c035b928fdc942c5d17e9c4b98329b76f9cefac65c111135d925eb94ed324064cd7556d4f5123beec79abea1d4b97d1c8a2a5c748887a2eb623
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-new-target@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-new-target@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: c741ba3e84c182f1af3174cb7f00c4e434080ff882e72c7b2743d1d636eebcf12c865772be051a323c823bd4ebdfbae19cb78e95218d6b14c338f27a64608e31
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-new-target@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-new-target@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7410c3e68abc835f87a98d40269e65fb1a05c131decbb6721a80ed49a01bd0c53abb6b8f7f52d5055815509022790e1accca32e975c02f2231ac3cf13d8af768
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-new-target@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-new-target@npm:7.17.12"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: bec26350fa49c9a9431d23b4ff234f8eb60554b8cdffca432a94038406aae5701014f343568c0e0cc8afae6f95d492f6bae0d0e2c101c1a484fb20eec75b2c07
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-new-target@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-new-target@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e5053389316fce73ad5201b7777437164f333e24787fbcda4ae489cd2580dbbbdfb5694a7237bad91fabb46b591d771975d69beb1c740b82cb4761625379f00b
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-nullish-coalescing-operator@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-nullish-coalescing-operator@npm:7.23.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-nullish-coalescing-operator": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a27d73ea134d3d9560a6b2e26ab60012fba15f1db95865aa0153c18f5ec82cfef6a7b3d8df74e3c2fca81534fa5efeb6cacaf7b08bdb7d123e3dafdd079886a3
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-numeric-separator@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-numeric-separator@npm:7.23.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-numeric-separator": ^7.10.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 6ba0e5db3c620a3ec81f9e94507c821f483c15f196868df13fa454cbac719a5449baf73840f5b6eb7d77311b24a2cf8e45db53700d41727f693d46f7caf3eec3
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-object-rest-spread@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-object-rest-spread@npm:7.23.4"
-  dependencies:
-    "@babel/compat-data": ^7.23.3
-    "@babel/helper-compilation-targets": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-object-rest-spread": ^7.8.3
-    "@babel/plugin-transform-parameters": ^7.23.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 73fec495e327ca3959c1c03d07a621be09df00036c69fff0455af9a008291677ee9d368eec48adacdc6feac703269a649747568b4af4c4e9f134aa71cc5b378d
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-object-super@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-object-super@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/helper-replace-supers": ^7.16.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: b6ed0a8f5a1231b4dadb5edb2cef8fba7957cbad943c0018002719d066fda93b805da961e42b38d625e43e7c79f5c07d5719d6d63f9cf178501882a4aa5d30da
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-object-super@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-object-super@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/helper-replace-supers": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 46e3c879f4a93e904f2ecf83233d40c48c832bdbd82a67cab1f432db9aa51702e40d9e51e5800613e12299974f90f4ed3869e1273dbca8642984266320c5f341
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-object-super@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-object-super@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-replace-supers": ^7.22.20
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e495497186f621fa79026e183b4f1fbb172fd9df812cbd2d7f02c05b08adbe58012b1a6eb6dd58d11a30343f6ec80d0f4074f9b501d70aa1c94df76d59164c53
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-optional-catch-binding@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-optional-catch-binding@npm:7.23.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-optional-catch-binding": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d50b5ee142cdb088d8b5de1ccf7cea85b18b85d85b52f86618f6e45226372f01ad4cdb29abd4fd35ea99a71fefb37009e0107db7a787dcc21d4d402f97470faf
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-optional-chaining@npm:^7.23.3, @babel/plugin-transform-optional-chaining@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-optional-chaining@npm:7.23.4"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.22.5
-    "@babel/plugin-syntax-optional-chaining": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e7a4c08038288057b7a08d68c4d55396ada9278095509ca51ed8dfb72a7f13f26bdd7c5185de21079fe0a9d60d22c227cb32e300d266c1bda40f70eee9f4bc1e
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-parameters@npm:^7.13.0, @babel/plugin-transform-parameters@npm:^7.16.0":
-  version: 7.16.3
-  resolution: "@babel/plugin-transform-parameters@npm:7.16.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7c0154fa66f03f69f6767adc01e72ef00d50cae8eb87c65506adccccc1cf776730ecbb96a5de0127910554cc0e86e375bc437fa085f619783d368936736a4f58
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-parameters@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-parameters@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 4d6904376db82d0b35f0a6cce08f630daf8608d94e903d6c7aff5bd742b251651bd1f88cdf9f16cad98aba5fc7c61da8635199364865fad6367d5ae37cf56cc1
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-parameters@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-parameters@npm:7.17.12"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d9ed5ec61dc460835bade8fa710b42ec9f207bd448ead7e8abd46b87db0afedbb3f51284700fd2a6892fdf6544ec9b949c505c6542c5ba0a41ca4e8749af00f0
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-parameters@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-parameters@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a735b3e85316d17ec102e3d3d1b6993b429bdb3b494651c9d754e3b7d270462ee1f1a126ccd5e3d871af5e683727e9ef98c9d34d4a42204fffaabff91052ed16
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-private-methods@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-private-methods@npm:7.23.3"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: cedc1285c49b5a6d9a3d0e5e413b756ac40b3ac2f8f68bdfc3ae268bc8d27b00abd8bb0861c72756ff5dd8bf1eb77211b7feb5baf4fdae2ebbaabe49b9adc1d0
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-private-property-in-object@npm:^7.23.4":
-  version: 7.23.4
-  resolution: "@babel/plugin-transform-private-property-in-object@npm:7.23.4"
-  dependencies:
-    "@babel/helper-annotate-as-pure": ^7.22.5
-    "@babel/helper-create-class-features-plugin": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-private-property-in-object": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: fb7adfe94ea97542f250a70de32bddbc3e0b802381c92be947fec83ebffda57e68533c4d0697152719a3496fdd3ebf3798d451c024cd4ac848fc15ac26b70aa7
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-property-literals@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-property-literals@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e9eb9355db4cf18dc82879174fc2de6590521afea04f1c80c5805d3f759bfa25946bcac1095b5fe0e4ad3f5eb330cd7e308467626a0212f07b9f41b9f00affa8
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-property-literals@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-property-literals@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: b5674458991a9b0e8738989d70faa88c7f98ed3df923c119f1225069eed72fe5e0ce947b1adc91e378f5822fbdeb7a672f496fd1c75c4babcc88169e3a7c3229
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-property-literals@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-property-literals@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 16b048c8e87f25095f6d53634ab7912992f78e6997a6ff549edc3cf519db4fca01c7b4e0798530d7f6a05228ceee479251245cdd850a5531c6e6f404104d6cc9
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-regenerator@npm:^7.13.15":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-regenerator@npm:7.16.0"
-  dependencies:
-    regenerator-transform: ^0.14.2
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 32b1b43f8d55d9e78e87bbc6a19b0bb0ff968220e215e9a3984c0de140048c54c62cf46889bee16f987221eab112909318de391426df33cdbe3fd710480068f7
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-regenerator@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-regenerator@npm:7.16.7"
-  dependencies:
-    regenerator-transform: ^0.14.2
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 12b1f9a4f324027af69f49522fbe7feea2ac53285ca5c7e27a70de09f56c74938bfda8b09ac06e57fa1207e441f00efb7adbc462afc9be5e8abd0c2a07715e01
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-regenerator@npm:^7.18.0":
-  version: 7.18.0
-  resolution: "@babel/plugin-transform-regenerator@npm:7.18.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-    regenerator-transform: ^0.15.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: ebacf2bbe9e2fb6f2bd7996e19b41bfc9848628950ae06a1a832802a0b8e32a32003c6b89318da6ca521f79045c91324dcb4c97247ed56f86fa58d7401a7316f
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-regenerator@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-regenerator@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    regenerator-transform: ^0.15.2
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7fdacc7b40008883871b519c9e5cdea493f75495118ccc56ac104b874983569a24edd024f0f5894ba1875c54ee2b442f295d6241c3280e61c725d0dd3317c8e6
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-reserved-words@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-reserved-words@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7a8288cfe2375e43579d3786d5f6654b36d8344b1be3df4fbafe81ae49bf634f85f68fe5a1a280f56aa7d626deaaa6ba89e586422b3d8b13f7d4b0e0617362d6
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-reserved-words@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-reserved-words@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 00218a646e99a97c1f10b77c41c178ca1b91d0e6cf18dd4ca3c59b8a5ad721db04ef508f49be4cd0dcca7742490dbb145307b706a2dbea1917d5e5f7ba2f31b7
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-reserved-words@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-reserved-words@npm:7.17.12"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d8a617cb79ca5852ac2736a9f81c15a3b0760919720c3b9069a864e2288006ebcaab557dbb36a3eba936defd6699f82e3bf894915925aa9185f5d9bcbf3b29fd
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-reserved-words@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-reserved-words@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 298c4440ddc136784ff920127cea137168e068404e635dc946ddb5d7b2a27b66f1dd4c4acb01f7184478ff7d5c3e7177a127279479926519042948fb7fa0fa48
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-runtime@npm:^7.12.1":
-  version: 7.13.15
-  resolution: "@babel/plugin-transform-runtime@npm:7.13.15"
-  dependencies:
-    "@babel/helper-module-imports": ^7.13.12
-    "@babel/helper-plugin-utils": ^7.13.0
-    babel-plugin-polyfill-corejs2: ^0.2.0
-    babel-plugin-polyfill-corejs3: ^0.2.0
-    babel-plugin-polyfill-regenerator: ^0.2.0
-    semver: ^6.3.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d52bda711815a82674e390b8ef4887dbf8116eb66eca3c23b3ae4b3ed37022a09b80aed86b44d2a3399b281d8ca341329293e12d6f4aea9991459434537131ba
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-runtime@npm:^7.13.9":
-  version: 7.16.4
-  resolution: "@babel/plugin-transform-runtime@npm:7.16.4"
-  dependencies:
-    "@babel/helper-module-imports": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    babel-plugin-polyfill-corejs2: ^0.3.0
-    babel-plugin-polyfill-corejs3: ^0.4.0
-    babel-plugin-polyfill-regenerator: ^0.3.0
-    semver: ^6.3.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 3586fb1035a8233162c0dfb28f3466c3129b430bd351d7271894dc7dc29956cc2e6e348f5e21ae91f8b59ceddce02b32140e4bb629fdbbacad2ab04f6cec2ff5
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-shorthand-properties@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-shorthand-properties@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7ae0f218aaccd2f7e8b0027c558fbbc291f7df7c83749826075776de780d1ac421f9056c760c5eb2e486b7b1983a41cd8dc00589504904b833c810fdb80b3868
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-shorthand-properties@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-shorthand-properties@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: ca381ecf8f48696512172deca40af46b1f64e3497186fdc2c9009286d8f06b468c4d61cdc392dc8b0c165298117dda67be9e2ff0e99d7691b0503f1240d4c62b
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-shorthand-properties@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-shorthand-properties@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 5d677a03676f9fff969b0246c423d64d77502e90a832665dc872a5a5e05e5708161ce1effd56bb3c0f2c20a1112fca874be57c8a759d8b08152755519281f326
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-spread@npm:^7.13.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-spread@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.16.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: c295ef5e329fc31bd78e0aac3d6d848475a26e40cffff207dfd450416a25478bedb03402a0cc569bc5b7d3e92c22bff8a7cf76f1a9d896070e3cdeae1aee0316
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-spread@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-spread@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.16.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 6e961af1a70586bb72dd85e8296cee857c5dadd73225fccd0fe261c0d98652a82d69c65f3e9dc31ce019a12e9677262678479b96bd2d9140ddf6514618362828
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-spread@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-spread@npm:7.17.12"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.16.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 3a95e4f163d598c0efc9d983e5ce3e8716998dd2af62af8102b11cb8d6383c71b74c7106adbce73cda6e48d3d3e927627847d36d76c2eb688cd0e2e07f67fb51
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-spread@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-spread@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-skip-transparent-expression-wrappers": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 8fd5cac201e77a0b4825745f4e07a25f923842f282f006b3a79223c00f61075c8868d12eafec86b2642cd0b32077cdd32314e27bcb75ee5e6a68c0144140dcf2
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-sticky-regex@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-sticky-regex@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 80c7ccb797e4d31f112ace4614e8259ad0707eab3ed1c5a900ac0799dc23fded8bad57142ceb29222d6f0645f7b0d6a74fa133c945b8611d5db137b13ee68882
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-sticky-regex@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-sticky-regex@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d59e20121ff0a483e29364eff8bb42cd8a0b7a3158141eea5b6f219227e5b873ea70f317f65037c0f557887a692ac993b72f99641a37ea6ec0ae8000bfab1343
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-sticky-regex@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-sticky-regex@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 53e55eb2575b7abfdb4af7e503a2bf7ef5faf8bf6b92d2cd2de0700bdd19e934e5517b23e6dfed94ba50ae516b62f3f916773ef7d9bc81f01503f585051e2949
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-template-literals@npm:^7.13.0":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-template-literals@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 230638ee56bbe8c4237d2c3366d700eca1f66f93c37935f6d775f699c5d2593e3f176e81010cfb2d46f89e340c6c042649263c3b913ce269182fadfb4db01369
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-template-literals@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-template-literals@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: b55a519dd8b957247ebad3cab21918af5adca4f6e6c87819501cfe3d4d4bccda25bc296c7dfc8a30909b4ad905902aeb9d55ad955cb9f5cbc74b42dab32baa18
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-template-literals@npm:^7.18.2":
-  version: 7.18.2
-  resolution: "@babel/plugin-transform-template-literals@npm:7.18.2"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: bc0102ed8c789e5bc01053088e2de85b82cebcd4d57af9fdc32ca62f559d3dd19c33e9d26caa71c5fd8e94152e5ce4fc4da19badc2d537620e6dea83bce7eb05
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-template-literals@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-template-literals@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: b16c5cb0b8796be0118e9c144d15bdc0d20a7f3f59009c6303a6e9a8b74c146eceb3f05186f5b97afcba7cfa87e34c1585a22186e3d5b22f2fd3d27d959d92b2
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-typeof-symbol@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-typeof-symbol@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 60e91d57b3e5a5ca02cebbf9f6dacd06e8a3b7c92c54fd60616f01ac1c79b3ec5fd2e8c5fa5c86ffcd9da6fa811e6de8dc7602cf1e05da17def0ea06f1e8548e
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-typeof-symbol@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-typeof-symbol@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 739a8c439dacbd9af62cfbfa0a7cbc3f220849e5fc774e5ef708a09186689a724c41a1d11323e7d36588d24f5481c8b702c86ff7be8da2e2fed69bed0175f625
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-typeof-symbol@npm:^7.17.12":
-  version: 7.17.12
-  resolution: "@babel/plugin-transform-typeof-symbol@npm:7.17.12"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.17.12
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e30bd03c8abc1b095f8b2a10289df6850e3bc3cd0aea1cbc29050aa3b421cbb77d0428b0cd012333632a7a930dc8301cd888e762b2dd601e7dc5dac50f4140c9
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-typeof-symbol@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-typeof-symbol@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 0af7184379d43afac7614fc89b1bdecce4e174d52f4efaeee8ec1a4f2c764356c6dba3525c0685231f1cbf435b6dd4ee9e738d7417f3b10ce8bbe869c32f4384
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-typescript@npm:^7.13.0":
-  version: 7.16.1
-  resolution: "@babel/plugin-transform-typescript@npm:7.16.1"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-    "@babel/plugin-syntax-typescript": ^7.16.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 1b1efe62e8de828d52b996429718663705cbefb9a7382d2849725b6318051fcbe9671e9e8f761a94fddf46ea159810c97d1b6282c644f69c98ebf5d4d2687ef6
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-typescript@npm:^7.16.8":
-  version: 7.19.0
-  resolution: "@babel/plugin-transform-typescript@npm:7.19.0"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.19.0
-    "@babel/helper-plugin-utils": ^7.19.0
-    "@babel/plugin-syntax-typescript": ^7.18.6
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d5ed076c1cd7a41efe0da7d9afdcb6281db574b4307243b9f0f96ae255d9efdca47b4aeed5c306d1ad296e683498965c01ecaa147217559e01eceadc350ca4c2
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-typescript@npm:^7.20.13":
-  version: 7.23.5
-  resolution: "@babel/plugin-transform-typescript@npm:7.23.5"
-  dependencies:
-    "@babel/helper-annotate-as-pure": ^7.22.5
-    "@babel/helper-create-class-features-plugin": ^7.23.5
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/plugin-syntax-typescript": ^7.23.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d77b5cc22cf48fe461de07e4f058dc9c0d8c4e3ca49de0e3a336a94ab39bfa4f4732598e36c479bec0dd1bf4aff9154bc2dcbfbe3145a751e4771ccae5afaaf8
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-typescript@npm:~7.4.0":
-  version: 7.4.5
-  resolution: "@babel/plugin-transform-typescript@npm:7.4.5"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.0.0
-    "@babel/plugin-syntax-typescript": ^7.2.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2c3aadfba8db8726a1e0c5341578e65ab8a2d46c79844509ccc74bff1c8eaa4943e94f458e4f006a7d21a2ea93025ae3629bdeb9858c7b53967b9f7aee154543
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-typescript@npm:~7.5.0":
-  version: 7.5.5
-  resolution: "@babel/plugin-transform-typescript@npm:7.5.5"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.5.5
-    "@babel/helper-plugin-utils": ^7.0.0
-    "@babel/plugin-syntax-typescript": ^7.2.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a7a60f461e41db07dd04728c18b1ee9d5ba889f3666f8e209437b4007c2c02fe556ea03c70550077206ca3ac3f70f8da76d0f6a62eed1a9466249a5a1a316a81
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-typescript@npm:~7.8.0":
-  version: 7.8.7
-  resolution: "@babel/plugin-transform-typescript@npm:7.8.7"
-  dependencies:
-    "@babel/helper-create-class-features-plugin": ^7.8.3
-    "@babel/helper-plugin-utils": ^7.8.3
-    "@babel/plugin-syntax-typescript": ^7.8.3
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a6a0a85e79acd154573fddaa589da053109f334413c2bcc2fcac03b77385c174070b0ddcbe4d3086676b4ad7a9e4fb3ea27a499635e9472e244ccbef43d1ea08
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-unicode-escapes@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-unicode-escapes@npm:7.16.0"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 63ac80d6b7592a7a038cde0b7b8fd7fc8f478de107543fb20c0ee47e00c5cd4c12be936501f55e2fd9370056603d9c4e4c57cdf335674837475865f80b4ae734
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-unicode-escapes@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-unicode-escapes@npm:7.16.7"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: d10c3b5baa697ca2d9ecce2fd7705014d7e1ddd86ed684ccec378f7ad4d609ab970b5546d6cdbe242089ecfc7a79009d248cf4f8ee87d629485acfb20c0d9160
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-unicode-escapes@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-unicode-escapes@npm:7.23.3"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 561c429183a54b9e4751519a3dfba6014431e9cdc1484fad03bdaf96582dfc72c76a4f8661df2aeeae7c34efd0fa4d02d3b83a2f63763ecf71ecc925f9cc1f60
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-unicode-property-regex@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-unicode-property-regex@npm:7.23.3"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2298461a194758086d17c23c26c7de37aa533af910f9ebf31ebd0893d4aa317468043d23f73edc782ec21151d3c46cf0ff8098a83b725c49a59de28a1d4d6225
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-unicode-regex@npm:^7.12.13":
-  version: 7.16.0
-  resolution: "@babel/plugin-transform-unicode-regex@npm:7.16.0"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.16.0
-    "@babel/helper-plugin-utils": ^7.14.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 61e498425fb44951067e1d17cd66e97777a340118c06943cee9d1032a8bfec661f262738a9b2a00a498b0ad5ba56551ea81e76f0d6afe46c0301abc3a86bee22
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-unicode-regex@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/plugin-transform-unicode-regex@npm:7.16.7"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: ef7721cfb11b269809555b1c392732566c49f6ced58e0e990c0e81e58a934bbab3072dcbe92d3a20d60e3e41036ecf987bcc63a7cde90711a350ad774667e5e6
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-unicode-regex@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-unicode-regex@npm:7.23.3"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: c5f835d17483ba899787f92e313dfa5b0055e3deab332f1d254078a2bba27ede47574b6599fcf34d3763f0c048ae0779dc21d2d8db09295edb4057478dc80a9a
-  languageName: node
-  linkType: hard
-
-"@babel/plugin-transform-unicode-sets-regex@npm:^7.23.3":
-  version: 7.23.3
-  resolution: "@babel/plugin-transform-unicode-sets-regex@npm:7.23.3"
-  dependencies:
-    "@babel/helper-create-regexp-features-plugin": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 79d0b4c951955ca68235c87b91ab2b393c96285f8aeaa34d6db416d2ddac90000c9bd6e8c4d82b60a2b484da69930507245035f28ba63c6cae341cf3ba68fdef
-  languageName: node
-  linkType: hard
-
-"@babel/polyfill@npm:^7.11.5":
-  version: 7.12.1
-  resolution: "@babel/polyfill@npm:7.12.1"
-  dependencies:
-    core-js: ^2.6.5
-    regenerator-runtime: ^0.13.4
-  checksum: 3f59a9d85a41b390b044a1be13e11ae6d8efbfcf4e07217964585c7cef337b828eecfc5e164083227189146d2b6efc1affae8f59c831438eb40b848ab6fe5f39
-  languageName: node
-  linkType: hard
-
-"@babel/preset-env@npm:^7.10.2":
-  version: 7.14.0
-  resolution: "@babel/preset-env@npm:7.14.0"
-  dependencies:
-    "@babel/compat-data": ^7.14.0
-    "@babel/helper-compilation-targets": ^7.13.16
-    "@babel/helper-plugin-utils": ^7.13.0
-    "@babel/helper-validator-option": ^7.12.17
-    "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": ^7.13.12
-    "@babel/plugin-proposal-async-generator-functions": ^7.13.15
-    "@babel/plugin-proposal-class-properties": ^7.13.0
-    "@babel/plugin-proposal-class-static-block": ^7.13.11
-    "@babel/plugin-proposal-dynamic-import": ^7.13.8
-    "@babel/plugin-proposal-export-namespace-from": ^7.12.13
-    "@babel/plugin-proposal-json-strings": ^7.13.8
-    "@babel/plugin-proposal-logical-assignment-operators": ^7.13.8
-    "@babel/plugin-proposal-nullish-coalescing-operator": ^7.13.8
-    "@babel/plugin-proposal-numeric-separator": ^7.12.13
-    "@babel/plugin-proposal-object-rest-spread": ^7.13.8
-    "@babel/plugin-proposal-optional-catch-binding": ^7.13.8
-    "@babel/plugin-proposal-optional-chaining": ^7.13.12
-    "@babel/plugin-proposal-private-methods": ^7.13.0
-    "@babel/plugin-proposal-private-property-in-object": ^7.14.0
-    "@babel/plugin-proposal-unicode-property-regex": ^7.12.13
-    "@babel/plugin-syntax-async-generators": ^7.8.4
-    "@babel/plugin-syntax-class-properties": ^7.12.13
-    "@babel/plugin-syntax-class-static-block": ^7.12.13
-    "@babel/plugin-syntax-dynamic-import": ^7.8.3
-    "@babel/plugin-syntax-export-namespace-from": ^7.8.3
-    "@babel/plugin-syntax-json-strings": ^7.8.3
-    "@babel/plugin-syntax-logical-assignment-operators": ^7.10.4
-    "@babel/plugin-syntax-nullish-coalescing-operator": ^7.8.3
-    "@babel/plugin-syntax-numeric-separator": ^7.10.4
-    "@babel/plugin-syntax-object-rest-spread": ^7.8.3
-    "@babel/plugin-syntax-optional-catch-binding": ^7.8.3
-    "@babel/plugin-syntax-optional-chaining": ^7.8.3
-    "@babel/plugin-syntax-private-property-in-object": ^7.14.0
-    "@babel/plugin-syntax-top-level-await": ^7.12.13
-    "@babel/plugin-transform-arrow-functions": ^7.13.0
-    "@babel/plugin-transform-async-to-generator": ^7.13.0
-    "@babel/plugin-transform-block-scoped-functions": ^7.12.13
-    "@babel/plugin-transform-block-scoping": ^7.13.16
-    "@babel/plugin-transform-classes": ^7.13.0
-    "@babel/plugin-transform-computed-properties": ^7.13.0
-    "@babel/plugin-transform-destructuring": ^7.13.17
-    "@babel/plugin-transform-dotall-regex": ^7.12.13
-    "@babel/plugin-transform-duplicate-keys": ^7.12.13
-    "@babel/plugin-transform-exponentiation-operator": ^7.12.13
-    "@babel/plugin-transform-for-of": ^7.13.0
-    "@babel/plugin-transform-function-name": ^7.12.13
-    "@babel/plugin-transform-literals": ^7.12.13
-    "@babel/plugin-transform-member-expression-literals": ^7.12.13
-    "@babel/plugin-transform-modules-amd": ^7.14.0
-    "@babel/plugin-transform-modules-commonjs": ^7.14.0
-    "@babel/plugin-transform-modules-systemjs": ^7.13.8
-    "@babel/plugin-transform-modules-umd": ^7.14.0
-    "@babel/plugin-transform-named-capturing-groups-regex": ^7.12.13
-    "@babel/plugin-transform-new-target": ^7.12.13
-    "@babel/plugin-transform-object-super": ^7.12.13
-    "@babel/plugin-transform-parameters": ^7.13.0
-    "@babel/plugin-transform-property-literals": ^7.12.13
-    "@babel/plugin-transform-regenerator": ^7.13.15
-    "@babel/plugin-transform-reserved-words": ^7.12.13
-    "@babel/plugin-transform-shorthand-properties": ^7.12.13
-    "@babel/plugin-transform-spread": ^7.13.0
-    "@babel/plugin-transform-sticky-regex": ^7.12.13
-    "@babel/plugin-transform-template-literals": ^7.13.0
-    "@babel/plugin-transform-typeof-symbol": ^7.12.13
-    "@babel/plugin-transform-unicode-escapes": ^7.12.13
-    "@babel/plugin-transform-unicode-regex": ^7.12.13
-    "@babel/preset-modules": ^0.1.4
-    "@babel/types": ^7.14.0
-    babel-plugin-polyfill-corejs2: ^0.2.0
-    babel-plugin-polyfill-corejs3: ^0.2.0
-    babel-plugin-polyfill-regenerator: ^0.2.0
-    core-js-compat: ^3.9.0
-    semver: ^6.3.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: e62fa4196bed7f8fb2248b3a5309314c5411214c61e4e28a2dc00cd91fc2c83c8e5110e928e7ee55d4a5833476fe50ac4fc65b63d6e47e6bde3ca26b39b2ddbd
-  languageName: node
-  linkType: hard
-
-"@babel/preset-env@npm:^7.16.5":
-  version: 7.16.11
-  resolution: "@babel/preset-env@npm:7.16.11"
-  dependencies:
-    "@babel/compat-data": ^7.16.8
-    "@babel/helper-compilation-targets": ^7.16.7
-    "@babel/helper-plugin-utils": ^7.16.7
-    "@babel/helper-validator-option": ^7.16.7
-    "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": ^7.16.7
-    "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": ^7.16.7
-    "@babel/plugin-proposal-async-generator-functions": ^7.16.8
-    "@babel/plugin-proposal-class-properties": ^7.16.7
-    "@babel/plugin-proposal-class-static-block": ^7.16.7
-    "@babel/plugin-proposal-dynamic-import": ^7.16.7
-    "@babel/plugin-proposal-export-namespace-from": ^7.16.7
-    "@babel/plugin-proposal-json-strings": ^7.16.7
-    "@babel/plugin-proposal-logical-assignment-operators": ^7.16.7
-    "@babel/plugin-proposal-nullish-coalescing-operator": ^7.16.7
-    "@babel/plugin-proposal-numeric-separator": ^7.16.7
-    "@babel/plugin-proposal-object-rest-spread": ^7.16.7
-    "@babel/plugin-proposal-optional-catch-binding": ^7.16.7
-    "@babel/plugin-proposal-optional-chaining": ^7.16.7
-    "@babel/plugin-proposal-private-methods": ^7.16.11
-    "@babel/plugin-proposal-private-property-in-object": ^7.16.7
-    "@babel/plugin-proposal-unicode-property-regex": ^7.16.7
-    "@babel/plugin-syntax-async-generators": ^7.8.4
-    "@babel/plugin-syntax-class-properties": ^7.12.13
-    "@babel/plugin-syntax-class-static-block": ^7.14.5
-    "@babel/plugin-syntax-dynamic-import": ^7.8.3
-    "@babel/plugin-syntax-export-namespace-from": ^7.8.3
-    "@babel/plugin-syntax-json-strings": ^7.8.3
-    "@babel/plugin-syntax-logical-assignment-operators": ^7.10.4
-    "@babel/plugin-syntax-nullish-coalescing-operator": ^7.8.3
-    "@babel/plugin-syntax-numeric-separator": ^7.10.4
-    "@babel/plugin-syntax-object-rest-spread": ^7.8.3
-    "@babel/plugin-syntax-optional-catch-binding": ^7.8.3
-    "@babel/plugin-syntax-optional-chaining": ^7.8.3
-    "@babel/plugin-syntax-private-property-in-object": ^7.14.5
-    "@babel/plugin-syntax-top-level-await": ^7.14.5
-    "@babel/plugin-transform-arrow-functions": ^7.16.7
-    "@babel/plugin-transform-async-to-generator": ^7.16.8
-    "@babel/plugin-transform-block-scoped-functions": ^7.16.7
-    "@babel/plugin-transform-block-scoping": ^7.16.7
-    "@babel/plugin-transform-classes": ^7.16.7
-    "@babel/plugin-transform-computed-properties": ^7.16.7
-    "@babel/plugin-transform-destructuring": ^7.16.7
-    "@babel/plugin-transform-dotall-regex": ^7.16.7
-    "@babel/plugin-transform-duplicate-keys": ^7.16.7
-    "@babel/plugin-transform-exponentiation-operator": ^7.16.7
-    "@babel/plugin-transform-for-of": ^7.16.7
-    "@babel/plugin-transform-function-name": ^7.16.7
-    "@babel/plugin-transform-literals": ^7.16.7
-    "@babel/plugin-transform-member-expression-literals": ^7.16.7
-    "@babel/plugin-transform-modules-amd": ^7.16.7
-    "@babel/plugin-transform-modules-commonjs": ^7.16.8
-    "@babel/plugin-transform-modules-systemjs": ^7.16.7
-    "@babel/plugin-transform-modules-umd": ^7.16.7
-    "@babel/plugin-transform-named-capturing-groups-regex": ^7.16.8
-    "@babel/plugin-transform-new-target": ^7.16.7
-    "@babel/plugin-transform-object-super": ^7.16.7
-    "@babel/plugin-transform-parameters": ^7.16.7
-    "@babel/plugin-transform-property-literals": ^7.16.7
-    "@babel/plugin-transform-regenerator": ^7.16.7
-    "@babel/plugin-transform-reserved-words": ^7.16.7
-    "@babel/plugin-transform-shorthand-properties": ^7.16.7
-    "@babel/plugin-transform-spread": ^7.16.7
-    "@babel/plugin-transform-sticky-regex": ^7.16.7
-    "@babel/plugin-transform-template-literals": ^7.16.7
-    "@babel/plugin-transform-typeof-symbol": ^7.16.7
-    "@babel/plugin-transform-unicode-escapes": ^7.16.7
-    "@babel/plugin-transform-unicode-regex": ^7.16.7
-    "@babel/preset-modules": ^0.1.5
-    "@babel/types": ^7.16.8
-    babel-plugin-polyfill-corejs2: ^0.3.0
-    babel-plugin-polyfill-corejs3: ^0.5.0
-    babel-plugin-polyfill-regenerator: ^0.3.0
-    core-js-compat: ^3.20.2
-    semver: ^6.3.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: c8029c272073df787309d983ae458dd094b57f87152b8ccad95c7c8b1e82b042c1077e169538aae5f98b7659de0632d10708d9c85acf21a5e9406d7dd3656d8c
-  languageName: node
-  linkType: hard
-
-"@babel/preset-env@npm:^7.16.7":
-  version: 7.18.2
-  resolution: "@babel/preset-env@npm:7.18.2"
-  dependencies:
-    "@babel/compat-data": ^7.17.10
-    "@babel/helper-compilation-targets": ^7.18.2
-    "@babel/helper-plugin-utils": ^7.17.12
-    "@babel/helper-validator-option": ^7.16.7
-    "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": ^7.17.12
-    "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": ^7.17.12
-    "@babel/plugin-proposal-async-generator-functions": ^7.17.12
-    "@babel/plugin-proposal-class-properties": ^7.17.12
-    "@babel/plugin-proposal-class-static-block": ^7.18.0
-    "@babel/plugin-proposal-dynamic-import": ^7.16.7
-    "@babel/plugin-proposal-export-namespace-from": ^7.17.12
-    "@babel/plugin-proposal-json-strings": ^7.17.12
-    "@babel/plugin-proposal-logical-assignment-operators": ^7.17.12
-    "@babel/plugin-proposal-nullish-coalescing-operator": ^7.17.12
-    "@babel/plugin-proposal-numeric-separator": ^7.16.7
-    "@babel/plugin-proposal-object-rest-spread": ^7.18.0
-    "@babel/plugin-proposal-optional-catch-binding": ^7.16.7
-    "@babel/plugin-proposal-optional-chaining": ^7.17.12
-    "@babel/plugin-proposal-private-methods": ^7.17.12
-    "@babel/plugin-proposal-private-property-in-object": ^7.17.12
-    "@babel/plugin-proposal-unicode-property-regex": ^7.17.12
-    "@babel/plugin-syntax-async-generators": ^7.8.4
-    "@babel/plugin-syntax-class-properties": ^7.12.13
-    "@babel/plugin-syntax-class-static-block": ^7.14.5
-    "@babel/plugin-syntax-dynamic-import": ^7.8.3
-    "@babel/plugin-syntax-export-namespace-from": ^7.8.3
-    "@babel/plugin-syntax-import-assertions": ^7.17.12
-    "@babel/plugin-syntax-json-strings": ^7.8.3
-    "@babel/plugin-syntax-logical-assignment-operators": ^7.10.4
-    "@babel/plugin-syntax-nullish-coalescing-operator": ^7.8.3
-    "@babel/plugin-syntax-numeric-separator": ^7.10.4
-    "@babel/plugin-syntax-object-rest-spread": ^7.8.3
-    "@babel/plugin-syntax-optional-catch-binding": ^7.8.3
-    "@babel/plugin-syntax-optional-chaining": ^7.8.3
-    "@babel/plugin-syntax-private-property-in-object": ^7.14.5
-    "@babel/plugin-syntax-top-level-await": ^7.14.5
-    "@babel/plugin-transform-arrow-functions": ^7.17.12
-    "@babel/plugin-transform-async-to-generator": ^7.17.12
-    "@babel/plugin-transform-block-scoped-functions": ^7.16.7
-    "@babel/plugin-transform-block-scoping": ^7.17.12
-    "@babel/plugin-transform-classes": ^7.17.12
-    "@babel/plugin-transform-computed-properties": ^7.17.12
-    "@babel/plugin-transform-destructuring": ^7.18.0
-    "@babel/plugin-transform-dotall-regex": ^7.16.7
-    "@babel/plugin-transform-duplicate-keys": ^7.17.12
-    "@babel/plugin-transform-exponentiation-operator": ^7.16.7
-    "@babel/plugin-transform-for-of": ^7.18.1
-    "@babel/plugin-transform-function-name": ^7.16.7
-    "@babel/plugin-transform-literals": ^7.17.12
-    "@babel/plugin-transform-member-expression-literals": ^7.16.7
-    "@babel/plugin-transform-modules-amd": ^7.18.0
-    "@babel/plugin-transform-modules-commonjs": ^7.18.2
-    "@babel/plugin-transform-modules-systemjs": ^7.18.0
-    "@babel/plugin-transform-modules-umd": ^7.18.0
-    "@babel/plugin-transform-named-capturing-groups-regex": ^7.17.12
-    "@babel/plugin-transform-new-target": ^7.17.12
-    "@babel/plugin-transform-object-super": ^7.16.7
-    "@babel/plugin-transform-parameters": ^7.17.12
-    "@babel/plugin-transform-property-literals": ^7.16.7
-    "@babel/plugin-transform-regenerator": ^7.18.0
-    "@babel/plugin-transform-reserved-words": ^7.17.12
-    "@babel/plugin-transform-shorthand-properties": ^7.16.7
-    "@babel/plugin-transform-spread": ^7.17.12
-    "@babel/plugin-transform-sticky-regex": ^7.16.7
-    "@babel/plugin-transform-template-literals": ^7.18.2
-    "@babel/plugin-transform-typeof-symbol": ^7.17.12
-    "@babel/plugin-transform-unicode-escapes": ^7.16.7
-    "@babel/plugin-transform-unicode-regex": ^7.16.7
-    "@babel/preset-modules": ^0.1.5
-    "@babel/types": ^7.18.2
-    babel-plugin-polyfill-corejs2: ^0.3.0
-    babel-plugin-polyfill-corejs3: ^0.5.0
-    babel-plugin-polyfill-regenerator: ^0.3.0
-    core-js-compat: ^3.22.1
-    semver: ^6.3.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: f81892a7970cb34643b93917cbbc9b581d5066d892639867521f4a85ec258e69362a37bbb7b899b351e71d26095a97cd2d6e35e5f9ee110715146e0ccc19e700
-  languageName: node
-  linkType: hard
-
-"@babel/preset-env@npm:^7.20.2":
-  version: 7.23.5
-  resolution: "@babel/preset-env@npm:7.23.5"
-  dependencies:
-    "@babel/compat-data": ^7.23.5
-    "@babel/helper-compilation-targets": ^7.22.15
-    "@babel/helper-plugin-utils": ^7.22.5
-    "@babel/helper-validator-option": ^7.23.5
-    "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": ^7.23.3
-    "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": ^7.23.3
-    "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": ^7.23.3
-    "@babel/plugin-proposal-private-property-in-object": 7.21.0-placeholder-for-preset-env.2
-    "@babel/plugin-syntax-async-generators": ^7.8.4
-    "@babel/plugin-syntax-class-properties": ^7.12.13
-    "@babel/plugin-syntax-class-static-block": ^7.14.5
-    "@babel/plugin-syntax-dynamic-import": ^7.8.3
-    "@babel/plugin-syntax-export-namespace-from": ^7.8.3
-    "@babel/plugin-syntax-import-assertions": ^7.23.3
-    "@babel/plugin-syntax-import-attributes": ^7.23.3
-    "@babel/plugin-syntax-import-meta": ^7.10.4
-    "@babel/plugin-syntax-json-strings": ^7.8.3
-    "@babel/plugin-syntax-logical-assignment-operators": ^7.10.4
-    "@babel/plugin-syntax-nullish-coalescing-operator": ^7.8.3
-    "@babel/plugin-syntax-numeric-separator": ^7.10.4
-    "@babel/plugin-syntax-object-rest-spread": ^7.8.3
-    "@babel/plugin-syntax-optional-catch-binding": ^7.8.3
-    "@babel/plugin-syntax-optional-chaining": ^7.8.3
-    "@babel/plugin-syntax-private-property-in-object": ^7.14.5
-    "@babel/plugin-syntax-top-level-await": ^7.14.5
-    "@babel/plugin-syntax-unicode-sets-regex": ^7.18.6
-    "@babel/plugin-transform-arrow-functions": ^7.23.3
-    "@babel/plugin-transform-async-generator-functions": ^7.23.4
-    "@babel/plugin-transform-async-to-generator": ^7.23.3
-    "@babel/plugin-transform-block-scoped-functions": ^7.23.3
-    "@babel/plugin-transform-block-scoping": ^7.23.4
-    "@babel/plugin-transform-class-properties": ^7.23.3
-    "@babel/plugin-transform-class-static-block": ^7.23.4
-    "@babel/plugin-transform-classes": ^7.23.5
-    "@babel/plugin-transform-computed-properties": ^7.23.3
-    "@babel/plugin-transform-destructuring": ^7.23.3
-    "@babel/plugin-transform-dotall-regex": ^7.23.3
-    "@babel/plugin-transform-duplicate-keys": ^7.23.3
-    "@babel/plugin-transform-dynamic-import": ^7.23.4
-    "@babel/plugin-transform-exponentiation-operator": ^7.23.3
-    "@babel/plugin-transform-export-namespace-from": ^7.23.4
-    "@babel/plugin-transform-for-of": ^7.23.3
-    "@babel/plugin-transform-function-name": ^7.23.3
-    "@babel/plugin-transform-json-strings": ^7.23.4
-    "@babel/plugin-transform-literals": ^7.23.3
-    "@babel/plugin-transform-logical-assignment-operators": ^7.23.4
-    "@babel/plugin-transform-member-expression-literals": ^7.23.3
-    "@babel/plugin-transform-modules-amd": ^7.23.3
-    "@babel/plugin-transform-modules-commonjs": ^7.23.3
-    "@babel/plugin-transform-modules-systemjs": ^7.23.3
-    "@babel/plugin-transform-modules-umd": ^7.23.3
-    "@babel/plugin-transform-named-capturing-groups-regex": ^7.22.5
-    "@babel/plugin-transform-new-target": ^7.23.3
-    "@babel/plugin-transform-nullish-coalescing-operator": ^7.23.4
-    "@babel/plugin-transform-numeric-separator": ^7.23.4
-    "@babel/plugin-transform-object-rest-spread": ^7.23.4
-    "@babel/plugin-transform-object-super": ^7.23.3
-    "@babel/plugin-transform-optional-catch-binding": ^7.23.4
-    "@babel/plugin-transform-optional-chaining": ^7.23.4
-    "@babel/plugin-transform-parameters": ^7.23.3
-    "@babel/plugin-transform-private-methods": ^7.23.3
-    "@babel/plugin-transform-private-property-in-object": ^7.23.4
-    "@babel/plugin-transform-property-literals": ^7.23.3
-    "@babel/plugin-transform-regenerator": ^7.23.3
-    "@babel/plugin-transform-reserved-words": ^7.23.3
-    "@babel/plugin-transform-shorthand-properties": ^7.23.3
-    "@babel/plugin-transform-spread": ^7.23.3
-    "@babel/plugin-transform-sticky-regex": ^7.23.3
-    "@babel/plugin-transform-template-literals": ^7.23.3
-    "@babel/plugin-transform-typeof-symbol": ^7.23.3
-    "@babel/plugin-transform-unicode-escapes": ^7.23.3
-    "@babel/plugin-transform-unicode-property-regex": ^7.23.3
-    "@babel/plugin-transform-unicode-regex": ^7.23.3
-    "@babel/plugin-transform-unicode-sets-regex": ^7.23.3
-    "@babel/preset-modules": 0.1.6-no-external-plugins
-    babel-plugin-polyfill-corejs2: ^0.4.6
-    babel-plugin-polyfill-corejs3: ^0.8.5
-    babel-plugin-polyfill-regenerator: ^0.5.3
-    core-js-compat: ^3.31.0
-    semver: ^6.3.1
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: adddd58d14fc1b2e5f8cf90995f522879362a0543e316afe9e5783f1bd715bb1e92300cd49d7ce3a95c64a96d60788d0089651e2cf4cac937f5469aac1087bb1
-  languageName: node
-  linkType: hard
-
-"@babel/preset-modules@npm:0.1.6-no-external-plugins":
-  version: 0.1.6-no-external-plugins
-  resolution: "@babel/preset-modules@npm:0.1.6-no-external-plugins"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.0.0
-    "@babel/types": ^7.4.4
-    esutils: ^2.0.2
-  peerDependencies:
-    "@babel/core": ^7.0.0-0 || ^8.0.0-0 <8.0.0
-  checksum: 4855e799bc50f2449fb5210f78ea9e8fd46cf4f242243f1e2ed838e2bd702e25e73e822e7f8447722a5f4baa5e67a8f7a0e403f3e7ce04540ff743a9c411c375
-  languageName: node
-  linkType: hard
-
-"@babel/preset-modules@npm:^0.1.4, @babel/preset-modules@npm:^0.1.5":
-  version: 0.1.5
-  resolution: "@babel/preset-modules@npm:0.1.5"
-  dependencies:
-    "@babel/helper-plugin-utils": ^7.0.0
-    "@babel/plugin-proposal-unicode-property-regex": ^7.4.4
-    "@babel/plugin-transform-dotall-regex": ^7.4.4
-    "@babel/types": ^7.4.4
-    esutils: ^2.0.2
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 8430e0e9e9d520b53e22e8c4c6a5a080a12b63af6eabe559c2310b187bd62ae113f3da82ba33e9d1d0f3230930ca702843aae9dd226dec51f7d7114dc1f51c10
-  languageName: node
-  linkType: hard
-
-"@babel/regjsgen@npm:^0.8.0":
-  version: 0.8.0
-  resolution: "@babel/regjsgen@npm:0.8.0"
-  checksum: 89c338fee774770e5a487382170711014d49a68eb281e74f2b5eac88f38300a4ad545516a7786a8dd5702e9cf009c94c2f582d200f077ac5decd74c56b973730
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:7.12.18":
-  version: 7.12.18
-  resolution: "@babel/runtime@npm:7.12.18"
-  dependencies:
-    regenerator-runtime: ^0.13.4
-  checksum: 0ba38dc8d478584b0b5fb15fc2b7855f9f20561917bd434a66429d55d1165199d6161bc5fb087b87254712827f63561ff5196df66701e5647d67c7d0f557569a
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:^7.12.5":
-  version: 7.14.0
-  resolution: "@babel/runtime@npm:7.14.0"
-  dependencies:
-    regenerator-runtime: ^0.13.4
-  checksum: 257dc2594355dd8798455f25b6f2f9a00f162b427391265752933e0e3337b3b14661d09283187d5039ae3764f723890ffe767e995c73d662f1d515bdf48e5ade
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:^7.14.0":
-  version: 7.19.0
-  resolution: "@babel/runtime@npm:7.19.0"
-  dependencies:
-    regenerator-runtime: ^0.13.4
-  checksum: fa69c351bb05e1db3ceb9a02fdcf620c234180af68cdda02152d3561015f6d55277265d3109815992f96d910f3db709458cae4f8df1c3def66f32e0867d82294
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:^7.17.8":
-  version: 7.23.1
-  resolution: "@babel/runtime@npm:7.23.1"
-  dependencies:
-    regenerator-runtime: ^0.14.0
-  checksum: 0cd0d43e6e7dc7f9152fda8c8312b08321cda2f56ef53d6c22ebdd773abdc6f5d0a69008de90aa41908d00e2c1facb24715ff121274e689305c858355ff02c70
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:^7.21.0":
-  version: 7.21.5
-  resolution: "@babel/runtime@npm:7.21.5"
-  dependencies:
-    regenerator-runtime: ^0.13.11
-  checksum: 358f2779d3187f5c67ad302e8f8d435412925d0b991d133c7d4a7b1ddd5a3fda1b6f34537cb64628dfd96a27ae46df105bed3895b8d754b88cacdded8d1129dd
-  languageName: node
-  linkType: hard
-
-"@babel/runtime@npm:^7.8.4":
-  version: 7.16.3
-  resolution: "@babel/runtime@npm:7.16.3"
-  dependencies:
-    regenerator-runtime: ^0.13.4
-  checksum: ab8ac887096d76185ddbf291d28fb976cd32473696dc497ad4905b784acbd5aa462533ad83a5c5104e10ead28c2e0e119840ee28ed8eff90dcdde9d57f916eda
-  languageName: node
-  linkType: hard
-
-"@babel/template@npm:^7.12.13, @babel/template@npm:^7.16.0":
-  version: 7.16.0
-  resolution: "@babel/template@npm:7.16.0"
-  dependencies:
-    "@babel/code-frame": ^7.16.0
-    "@babel/parser": ^7.16.0
-    "@babel/types": ^7.16.0
-  checksum: 940f105cc6a6aee638cd8cfae80b8b80811e0ddd53b6a11f3a68431ebb998564815fb26511b5d9cb4cff66ea67130ba7498555ee015375d32f5f89ceaa6662ea
-  languageName: node
-  linkType: hard
-
-"@babel/template@npm:^7.16.7":
-  version: 7.16.7
-  resolution: "@babel/template@npm:7.16.7"
-  dependencies:
-    "@babel/code-frame": ^7.16.7
-    "@babel/parser": ^7.16.7
-    "@babel/types": ^7.16.7
-  checksum: 10cd112e89276e00f8b11b55a51c8b2f1262c318283a980f4d6cdb0286dc05734b9aaeeb9f3ad3311900b09bc913e02343fcaa9d4a4f413964aaab04eb84ac4a
-  languageName: node
-  linkType: hard
-
-"@babel/template@npm:^7.18.10":
-  version: 7.18.10
-  resolution: "@babel/template@npm:7.18.10"
-  dependencies:
-    "@babel/code-frame": ^7.18.6
-    "@babel/parser": ^7.18.10
-    "@babel/types": ^7.18.10
-  checksum: 93a6aa094af5f355a72bd55f67fa1828a046c70e46f01b1606e6118fa1802b6df535ca06be83cc5a5e834022be95c7b714f0a268b5f20af984465a71e28f1473
-  languageName: node
-  linkType: hard
-
-"@babel/template@npm:^7.22.15":
-  version: 7.22.15
-  resolution: "@babel/template@npm:7.22.15"
-  dependencies:
-    "@babel/code-frame": ^7.22.13
-    "@babel/parser": ^7.22.15
-    "@babel/types": ^7.22.15
-  checksum: 1f3e7dcd6c44f5904c184b3f7fe280394b191f2fed819919ffa1e529c259d5b197da8981b6ca491c235aee8dbad4a50b7e31304aa531271cb823a4a24a0dd8fd
-  languageName: node
-  linkType: hard
-
-"@babel/template@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/template@npm:7.22.5"
-  dependencies:
-    "@babel/code-frame": ^7.22.5
-    "@babel/parser": ^7.22.5
-    "@babel/types": ^7.22.5
-  checksum: c5746410164039aca61829cdb42e9a55410f43cace6f51ca443313f3d0bdfa9a5a330d0b0df73dc17ef885c72104234ae05efede37c1cc8a72dc9f93425977a3
-  languageName: node
-  linkType: hard
-
-"@babel/traverse@npm:^7.1.6, @babel/traverse@npm:^7.12.1, @babel/traverse@npm:^7.4.5":
-  version: 7.14.0
-  resolution: "@babel/traverse@npm:7.14.0"
-  dependencies:
-    "@babel/code-frame": ^7.12.13
-    "@babel/generator": ^7.14.0
-    "@babel/helper-function-name": ^7.12.13
-    "@babel/helper-split-export-declaration": ^7.12.13
-    "@babel/parser": ^7.14.0
-    "@babel/types": ^7.14.0
-    debug: ^4.1.0
-    globals: ^11.1.0
-  checksum: 98cfb223facc13a67031a3619285c0d71acbc57a473b1213d2c70e53c57b390e9256a93bd05d93be4d3405ea235c4758a6cac2afcbf7e79815c6c96a913d246f
-  languageName: node
-  linkType: hard
-
-"@babel/traverse@npm:^7.13.0, @babel/traverse@npm:^7.14.0, @babel/traverse@npm:^7.16.0, @babel/traverse@npm:^7.16.3":
-  version: 7.16.3
-  resolution: "@babel/traverse@npm:7.16.3"
-  dependencies:
-    "@babel/code-frame": ^7.16.0
-    "@babel/generator": ^7.16.0
-    "@babel/helper-function-name": ^7.16.0
-    "@babel/helper-hoist-variables": ^7.16.0
-    "@babel/helper-split-export-declaration": ^7.16.0
-    "@babel/parser": ^7.16.3
-    "@babel/types": ^7.16.0
-    debug: ^4.1.0
-    globals: ^11.1.0
-  checksum: abb14857b1104c73124612954865e28f95a86eb6741f35851369b4f9eabc17e394c9aa6f21fba6ce23813592353090d409772be828717cbe5154a5e981a753c1
-  languageName: node
-  linkType: hard
-
-"@babel/traverse@npm:^7.16.7, @babel/traverse@npm:^7.16.8, @babel/traverse@npm:^7.17.3":
-  version: 7.17.3
-  resolution: "@babel/traverse@npm:7.17.3"
-  dependencies:
-    "@babel/code-frame": ^7.16.7
-    "@babel/generator": ^7.17.3
-    "@babel/helper-environment-visitor": ^7.16.7
-    "@babel/helper-function-name": ^7.16.7
-    "@babel/helper-hoist-variables": ^7.16.7
-    "@babel/helper-split-export-declaration": ^7.16.7
-    "@babel/parser": ^7.17.3
-    "@babel/types": ^7.17.0
-    debug: ^4.1.0
-    globals: ^11.1.0
-  checksum: 780d7ecf711758174989794891af08d378f81febdb8932056c0d9979524bf0298e28f8e7708a872d7781151506c28f56c85c63ea3f1f654662c2fcb8a3eb9fdc
-  languageName: node
-  linkType: hard
-
-"@babel/traverse@npm:^7.18.0, @babel/traverse@npm:^7.18.2":
-  version: 7.18.2
-  resolution: "@babel/traverse@npm:7.18.2"
-  dependencies:
-    "@babel/code-frame": ^7.16.7
-    "@babel/generator": ^7.18.2
-    "@babel/helper-environment-visitor": ^7.18.2
-    "@babel/helper-function-name": ^7.17.9
-    "@babel/helper-hoist-variables": ^7.16.7
-    "@babel/helper-split-export-declaration": ^7.16.7
-    "@babel/parser": ^7.18.0
-    "@babel/types": ^7.18.2
-    debug: ^4.1.0
-    globals: ^11.1.0
-  checksum: e21c2d550bf610406cf21ef6fbec525cb1d80b9d6d71af67552478a24ee371203cb4025b23b110ae7288a62a874ad5898daad19ad23daa95dfc8ab47a47a092f
-  languageName: node
-  linkType: hard
-
-"@babel/traverse@npm:^7.18.9, @babel/traverse@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/traverse@npm:7.19.0"
-  dependencies:
-    "@babel/code-frame": ^7.18.6
-    "@babel/generator": ^7.19.0
-    "@babel/helper-environment-visitor": ^7.18.9
-    "@babel/helper-function-name": ^7.19.0
-    "@babel/helper-hoist-variables": ^7.18.6
-    "@babel/helper-split-export-declaration": ^7.18.6
-    "@babel/parser": ^7.19.0
-    "@babel/types": ^7.19.0
-    debug: ^4.1.0
-    globals: ^11.1.0
-  checksum: dcbd1316c9f4bf3cefee45b6f5194590563aa5d123500a60d3c8d714bef279205014c8e599ebafc469967199a7622e1444cd0235c16d4243da437e3f1281771e
-  languageName: node
-  linkType: hard
-
-"@babel/traverse@npm:^7.22.6, @babel/traverse@npm:^7.22.8":
-  version: 7.22.8
-  resolution: "@babel/traverse@npm:7.22.8"
-  dependencies:
-    "@babel/code-frame": ^7.22.5
-    "@babel/generator": ^7.22.7
-    "@babel/helper-environment-visitor": ^7.22.5
-    "@babel/helper-function-name": ^7.22.5
-    "@babel/helper-hoist-variables": ^7.22.5
-    "@babel/helper-split-export-declaration": ^7.22.6
-    "@babel/parser": ^7.22.7
-    "@babel/types": ^7.22.5
-    debug: ^4.1.0
-    globals: ^11.1.0
-  checksum: a381369bc3eedfd13ed5fef7b884657f1c29024ea7388198149f0edc34bd69ce3966e9f40188d15f56490a5e12ba250ccc485f2882b53d41b054fccefb233e33
-  languageName: node
-  linkType: hard
-
-"@babel/traverse@npm:^7.23.7":
-  version: 7.23.7
-  resolution: "@babel/traverse@npm:7.23.7"
-  dependencies:
-    "@babel/code-frame": ^7.23.5
-    "@babel/generator": ^7.23.6
-    "@babel/helper-environment-visitor": ^7.22.20
-    "@babel/helper-function-name": ^7.23.0
-    "@babel/helper-hoist-variables": ^7.22.5
-    "@babel/helper-split-export-declaration": ^7.22.6
-    "@babel/parser": ^7.23.6
-    "@babel/types": ^7.23.6
-    debug: ^4.3.1
-    globals: ^11.1.0
-  checksum: d4a7afb922361f710efc97b1e25ec343fab8b2a4ddc81ca84f9a153f22d4482112cba8f263774be8d297918b6c4767c7a98988ab4e53ac73686c986711dd002e
-  languageName: node
-  linkType: hard
-
-"@babel/types@npm:^7.1.6, @babel/types@npm:^7.7.2":
-  version: 7.14.0
-  resolution: "@babel/types@npm:7.14.0"
-  dependencies:
-    "@babel/helper-validator-identifier": ^7.14.0
-    to-fast-properties: ^2.0.0
-  checksum: e69829ade45feb140d5e146be5203533edff1ad41a892870e1c6e323a06cafaf5b7e4d83dcae1222deff3bff73cf095b48c2cbf8864b77140196879fafaaf859
-  languageName: node
-  linkType: hard
-
-"@babel/types@npm:^7.12.1, @babel/types@npm:^7.14.0, @babel/types@npm:^7.16.0, @babel/types@npm:^7.4.4":
-  version: 7.16.0
-  resolution: "@babel/types@npm:7.16.0"
-  dependencies:
-    "@babel/helper-validator-identifier": ^7.15.7
-    to-fast-properties: ^2.0.0
-  checksum: 5b483da5c6e6f2394fba7ee1da8787a0c9cddd33491271c4da702e49e6faf95ce41d7c8bf9a4ee47f2ef06bdb35096f4d0f6ae4b5bea35ebefe16309d22344b7
-  languageName: node
-  linkType: hard
-
-"@babel/types@npm:^7.12.13":
-  version: 7.19.3
-  resolution: "@babel/types@npm:7.19.3"
-  dependencies:
-    "@babel/helper-string-parser": ^7.18.10
-    "@babel/helper-validator-identifier": ^7.19.1
-    to-fast-properties: ^2.0.0
-  checksum: 34a5b3db3b99a1a80ec2a784c2bb0e48769a38f1526dc377a5753a3ac5e5704663c405a393117ecc7a9df9da07b01625be7c4c3fee43ae46aba23b0c40928d77
-  languageName: node
-  linkType: hard
-
-"@babel/types@npm:^7.16.7, @babel/types@npm:^7.16.8, @babel/types@npm:^7.17.0":
-  version: 7.17.0
-  resolution: "@babel/types@npm:7.17.0"
-  dependencies:
-    "@babel/helper-validator-identifier": ^7.16.7
-    to-fast-properties: ^2.0.0
-  checksum: 12e5a287986fe557188e87b2c5202223f1dc83d9239a196ab936fdb9f8c1eb0be717ff19f934b5fad4e29a75586d5798f74bed209bccea1c20376b9952056f0e
-  languageName: node
-  linkType: hard
-
-"@babel/types@npm:^7.18.0, @babel/types@npm:^7.18.2":
-  version: 7.18.4
-  resolution: "@babel/types@npm:7.18.4"
-  dependencies:
-    "@babel/helper-validator-identifier": ^7.16.7
-    to-fast-properties: ^2.0.0
-  checksum: 85df59beb99c1b95e9e41590442f2ffa1e5b1b558d025489db40c9f7c906bd03a17da26c3ec486e5800e80af27c42ca7eee9506d9212ab17766d2d68d30fbf52
-  languageName: node
-  linkType: hard
-
-"@babel/types@npm:^7.18.10, @babel/types@npm:^7.18.6, @babel/types@npm:^7.18.9, @babel/types@npm:^7.19.0":
-  version: 7.19.0
-  resolution: "@babel/types@npm:7.19.0"
-  dependencies:
-    "@babel/helper-string-parser": ^7.18.10
-    "@babel/helper-validator-identifier": ^7.18.6
-    to-fast-properties: ^2.0.0
-  checksum: 9b346715a68aeede70ba9c685a144b0b26c53bcd595d448e24c8fa8df4d5956a5712e56ebadb7c85dcc32f218ee42788e37b93d50d3295c992072224cb3ef3fe
-  languageName: node
-  linkType: hard
-
-"@babel/types@npm:^7.22.15, @babel/types@npm:^7.22.19, @babel/types@npm:^7.23.0":
-  version: 7.23.5
-  resolution: "@babel/types@npm:7.23.5"
-  dependencies:
-    "@babel/helper-string-parser": ^7.23.4
-    "@babel/helper-validator-identifier": ^7.22.20
-    to-fast-properties: ^2.0.0
-  checksum: 3d21774480a459ef13b41c2e32700d927af649e04b70c5d164814d8e04ab584af66a93330602c2925e1a6925c2b829cc153418a613a4e7d79d011be1f29ad4b2
-  languageName: node
-  linkType: hard
-
-"@babel/types@npm:^7.22.5":
-  version: 7.22.5
-  resolution: "@babel/types@npm:7.22.5"
-  dependencies:
-    "@babel/helper-string-parser": ^7.22.5
-    "@babel/helper-validator-identifier": ^7.22.5
-    to-fast-properties: ^2.0.0
-  checksum: c13a9c1dc7d2d1a241a2f8363540cb9af1d66e978e8984b400a20c4f38ba38ca29f06e26a0f2d49a70bad9e57615dac09c35accfddf1bb90d23cd3e0a0bab892
-  languageName: node
-  linkType: hard
-
-"@babel/types@npm:^7.23.6":
-  version: 7.23.6
-  resolution: "@babel/types@npm:7.23.6"
-  dependencies:
-    "@babel/helper-string-parser": ^7.23.4
-    "@babel/helper-validator-identifier": ^7.22.20
-    to-fast-properties: ^2.0.0
-  checksum: 68187dbec0d637f79bc96263ac95ec8b06d424396678e7e225492be866414ce28ebc918a75354d4c28659be6efe30020b4f0f6df81cc418a2d30645b690a8de0
-  languageName: node
-  linkType: hard
-
-"@babel/types@npm:^7.8.3":
-  version: 7.21.4
-  resolution: "@babel/types@npm:7.21.4"
-  dependencies:
-    "@babel/helper-string-parser": ^7.19.4
-    "@babel/helper-validator-identifier": ^7.19.1
-    to-fast-properties: ^2.0.0
-  checksum: 587bc55a91ce003b0f8aa10d70070f8006560d7dc0360dc0406d306a2cb2a10154e2f9080b9c37abec76907a90b330a536406cb75e6bdc905484f37b75c73219
-  languageName: node
-  linkType: hard
-
-"@cnakazawa/watch@npm:^1.0.3":
-  version: 1.0.4
-  resolution: "@cnakazawa/watch@npm:1.0.4"
-  dependencies:
-    exec-sh: ^0.3.2
-    minimist: ^1.2.0
-  bin:
-    watch: cli.js
-  checksum: 88f395ca0af2f3c0665b8ce7bb29e83647ec5d141e8735712aeeee4117081555436712966b6957aa1c461f6f826a4d23b0034e379c443a10e919f81c8748bf29
-  languageName: node
-  linkType: hard
-
-"@colors/colors@npm:1.5.0":
-  version: 1.5.0
-  resolution: "@colors/colors@npm:1.5.0"
-  checksum: d64d5260bed1d5012ae3fc617d38d1afc0329fec05342f4e6b838f46998855ba56e0a73833f4a80fa8378c84810da254f76a8a19c39d038260dc06dc4e007425
-  languageName: node
-  linkType: hard
-
-"@csstools/css-parser-algorithms@npm:^2.3.0":
-  version: 2.3.0
-  resolution: "@csstools/css-parser-algorithms@npm:2.3.0"
-  peerDependencies:
-    "@csstools/css-tokenizer": ^2.1.1
-  checksum: 3be22a0cfcfe0dc4bb140e2f266590addf21c5052d9e69334da860b3839fbd4369c3d158cbc396032d5ed96d01d2b5d8ebdb5497f75c9830ed9ce99853e3f915
-  languageName: node
-  linkType: hard
-
-"@csstools/css-tokenizer@npm:^2.1.1":
-  version: 2.1.1
-  resolution: "@csstools/css-tokenizer@npm:2.1.1"
-  checksum: d6ac4b08d7fdfc146755542f00b208af7248efd6cf2eb0f0f7d2ba3583a81f08ed9be6047d78b046925708b5bd0886f487edeeee2f90f0f34030dcbef4122d0e
-  languageName: node
-  linkType: hard
-
-"@csstools/media-query-list-parser@npm:^2.1.2":
-  version: 2.1.2
-  resolution: "@csstools/media-query-list-parser@npm:2.1.2"
-  peerDependencies:
-    "@csstools/css-parser-algorithms": ^2.3.0
-    "@csstools/css-tokenizer": ^2.1.1
-  checksum: 04936573ba837f14d7d637e172342c473665679c6497bbc0d548d93d08cb22e22151bb19e0e20422954c0b2aa50c3f38c9fc5f45c136e31bc863c656cb79df1b
-  languageName: node
-  linkType: hard
-
-"@csstools/selector-specificity@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "@csstools/selector-specificity@npm:3.0.0"
-  peerDependencies:
-    postcss-selector-parser: ^6.0.13
-  checksum: 4a2dfe69998a499155d9dab4c2a0e7ae7594d8db98bb8a487d2d5347c0c501655051eb5eacad3fe323c86b0ba8212fe092c27fc883621e6ac2a27662edfc3528
-  languageName: node
-  linkType: hard
-
-"@ember-data/adapter@npm:4.12.5":
-  version: 4.12.5
-  resolution: "@ember-data/adapter@npm:4.12.5"
-  dependencies:
-    "@ember-data/private-build-infra": 4.12.5
-    "@embroider/macros": ^1.10.0
-    ember-cli-babel: ^7.26.11
-    ember-cli-test-info: ^1.0.0
-  peerDependencies:
-    "@ember-data/store": 4.12.5
-    "@ember/string": ^3.0.1
-    ember-inflector: ^4.0.2
-  checksum: 224b66b96bd7b5e982d3c60720172b57c817153d97a1b396a36644e18571afaff2257af58ef7821bad7515f6aec37c78ceb82148c526f871cf3d11b2d1b2364b
-  languageName: node
-  linkType: hard
-
-"@ember-data/debug@npm:4.12.5":
-  version: 4.12.5
-  resolution: "@ember-data/debug@npm:4.12.5"
-  dependencies:
-    "@ember-data/private-build-infra": 4.12.5
-    "@ember/edition-utils": ^1.2.0
-    "@embroider/macros": ^1.10.0
-    ember-auto-import: ^2.6.1
-    ember-cli-babel: ^7.26.11
-  peerDependencies:
-    "@ember-data/store": 4.12.5
-    "@ember/string": ^3.0.1
-  checksum: 2fcca256b2f8e0a5636312df4d4f6b4ac05d95552131d64a96eeef482221ea6426ff5164d9ffcab88e2f5e651010c91f1810d777439a6ba35ae3da6f8b6ef737
-  languageName: node
-  linkType: hard
-
-"@ember-data/graph@npm:4.12.5":
-  version: 4.12.5
-  resolution: "@ember-data/graph@npm:4.12.5"
-  dependencies:
-    "@ember-data/private-build-infra": 4.12.5
-    "@ember/edition-utils": ^1.2.0
-    "@embroider/macros": ^1.10.0
-    ember-cli-babel: ^7.26.11
-  peerDependencies:
-    "@ember-data/store": 4.12.5
-  checksum: ed23005e79db2bb68269a168820f69404d60ea11e0c54ac12a8b3b5f156688f4e1d089b932bc8ee4737c4aa6b5dcc00b643ac9bce1ff24847b0f1719cd9bd0d4
-  languageName: node
-  linkType: hard
-
-"@ember-data/json-api@npm:4.12.5":
-  version: 4.12.5
-  resolution: "@ember-data/json-api@npm:4.12.5"
-  dependencies:
-    "@ember-data/private-build-infra": 4.12.5
-    "@ember/edition-utils": ^1.2.0
-    "@embroider/macros": ^1.10.0
-    ember-cli-babel: ^7.26.11
-  peerDependencies:
-    "@ember-data/graph": 4.12.5
-    "@ember-data/store": 4.12.5
-  checksum: 3b8f3d80f37e706edd829376a6d8184c7169fd1816fe4b91e8a67b142354be74ca3850263f7547f4c81cc51f6bef6c4408f5efd30aa07cfdaeec85f4fa12cf96
-  languageName: node
-  linkType: hard
-
-"@ember-data/legacy-compat@npm:4.12.5, @ember-data/legacy-compat@npm:~4.12.4":
-  version: 4.12.5
-  resolution: "@ember-data/legacy-compat@npm:4.12.5"
-  dependencies:
-    "@ember-data/private-build-infra": 4.12.5
-    "@embroider/macros": ^1.10.0
-    ember-cli-babel: ^7.26.11
-  peerDependencies:
-    "@ember-data/graph": 4.12.5
-    "@ember-data/json-api": 4.12.5
-  peerDependenciesMeta:
-    "@ember-data/graph":
-      optional: true
-    "@ember-data/json-api":
-      optional: true
-  checksum: e9cfa9f05534217f0eaa433f152251714937fcaead62beaf5e51a59b470bb8cbac4598abd6ba014ed39cd61ce35a033c78f0b9dfcd6c90cb62531ef098dfa8ce
-  languageName: node
-  linkType: hard
-
-"@ember-data/model@npm:4.12.5":
-  version: 4.12.5
-  resolution: "@ember-data/model@npm:4.12.5"
-  dependencies:
-    "@ember-data/private-build-infra": 4.12.5
-    "@ember/edition-utils": ^1.2.0
-    "@embroider/macros": ^1.10.0
-    ember-cached-decorator-polyfill: ^1.0.1
-    ember-cli-babel: ^7.26.11
-    ember-cli-string-utils: ^1.1.0
-    ember-cli-test-info: ^1.0.0
-    inflection: ~2.0.1
-  peerDependencies:
-    "@ember-data/debug": 4.12.5
-    "@ember-data/graph": 4.12.5
-    "@ember-data/json-api": 4.12.5
-    "@ember-data/legacy-compat": 4.12.5
-    "@ember-data/store": 4.12.5
-    "@ember-data/tracking": 4.12.5
-    "@ember/string": ^3.0.1
-    ember-inflector: ^4.0.2
-  peerDependenciesMeta:
-    "@ember-data/debug":
-      optional: true
-    "@ember-data/graph":
-      optional: true
-    "@ember-data/json-api":
-      optional: true
-  checksum: 2d17d16a665fac2c755e65ae690f6ade32d5dfd1d936ef0f1fab031b33977a659212dc384b73a4fb98df229ef254eeba9f3319592e0d4ff19150c6ba2ea67fa6
-  languageName: node
-  linkType: hard
-
-"@ember-data/private-build-infra@npm:4.12.5":
-  version: 4.12.5
-  resolution: "@ember-data/private-build-infra@npm:4.12.5"
-  dependencies:
-    "@babel/core": ^7.21.4
-    "@babel/plugin-transform-block-scoping": ^7.21.0
-    "@babel/runtime": ^7.21.0
-    "@ember/edition-utils": ^1.2.0
-    "@embroider/macros": ^1.10.0
-    babel-import-util: ^1.3.0
-    babel-plugin-debug-macros: ^0.3.4
-    babel-plugin-filter-imports: ^4.0.0
-    babel6-plugin-strip-class-callcheck: ^6.0.0
-    broccoli-debug: ^0.6.5
-    broccoli-file-creator: ^2.1.1
-    broccoli-funnel: ^3.0.8
-    broccoli-merge-trees: ^4.2.0
-    broccoli-rollup: ^5.0.0
-    calculate-cache-key-for-tree: ^2.0.0
-    chalk: ^4.1.2
-    ember-cli-babel: ^7.26.11
-    ember-cli-path-utils: ^1.0.0
-    ember-cli-string-utils: ^1.1.0
-    ember-cli-version-checker: ^5.1.2
-    git-repo-info: ^2.1.1
-    glob: ^9.3.4
-    npm-git-info: ^1.0.3
-    semver: ^7.3.8
-    silent-error: ^1.1.1
-  checksum: 0f16a66c7086ba263af43703e163a3a0d4d4701b3dbd0fd67236ea7247f6950263b878782c137c300610a3fae041f0d037908c435464a55fd2a8462ac6bc8af6
-  languageName: node
-  linkType: hard
-
-"@ember-data/request@npm:4.12.5":
-  version: 4.12.5
-  resolution: "@ember-data/request@npm:4.12.5"
-  dependencies:
-    "@ember-data/private-build-infra": 4.12.5
-    "@ember/test-waiters": ^3.0.2
-    "@embroider/macros": ^1.10.0
-    ember-cli-babel: ^7.26.11
-  checksum: e812e7a7bef347dcbb7f885ee848f8f47b61ecb6c4f8fc6aee0683da1207e195a04320d34b9766fdac7b9e96b139ab71d18d9200ec07d6bd6703d7d7e11c3fb3
-  languageName: node
-  linkType: hard
-
-"@ember-data/rfc395-data@npm:^0.0.4":
-  version: 0.0.4
-  resolution: "@ember-data/rfc395-data@npm:0.0.4"
-  checksum: 59760b1f7b1cf131fe4a3b817b912e7e62e69e100acd813db37d11106a40c1b22da068cd7d4cdc1bb4c69b0dbde45c96ebff848b6b2380715eae7896bb2e109c
-  languageName: node
-  linkType: hard
-
-"@ember-data/serializer@npm:4.12.5":
-  version: 4.12.5
-  resolution: "@ember-data/serializer@npm:4.12.5"
-  dependencies:
-    "@ember-data/private-build-infra": 4.12.5
-    "@embroider/macros": ^1.10.0
-    ember-cli-babel: ^7.26.11
-    ember-cli-test-info: ^1.0.0
-  peerDependencies:
-    "@ember-data/store": 4.12.5
-    "@ember/string": ^3.0.1
-    ember-inflector: ^4.0.2
-  checksum: ea866f07844987c97e2982e6be9e772182c656ba305562813084618d9eba8d7fd4920b239875aeb9a7473032ccfc8ee8393f1f17de664cd60b1d110f77628d09
-  languageName: node
-  linkType: hard
-
-"@ember-data/store@npm:4.12.5":
-  version: 4.12.5
-  resolution: "@ember-data/store@npm:4.12.5"
-  dependencies:
-    "@ember-data/private-build-infra": 4.12.5
-    "@embroider/macros": ^1.10.0
-    ember-cached-decorator-polyfill: ^1.0.1
-    ember-cli-babel: ^7.26.11
-  peerDependencies:
-    "@ember-data/graph": 4.12.5
-    "@ember-data/json-api": 4.12.5
-    "@ember-data/legacy-compat": 4.12.5
-    "@ember-data/model": 4.12.5
-    "@ember-data/tracking": 4.12.5
-    "@ember/string": ^3.0.1
-    "@glimmer/tracking": ^1.1.2
-  peerDependenciesMeta:
-    "@ember-data/graph":
-      optional: true
-    "@ember-data/json-api":
-      optional: true
-    "@ember-data/legacy-compat":
-      optional: true
-    "@ember-data/model":
-      optional: true
-  checksum: 3309d4c8960055915d7f8de0ae83cd9dc1d2b6db0e97d2a069a36f8ae99cd2a024a9a577bc86e63267c230b2ba1efba5aa7dfb54d6901f1b2c63dc2f08ebfb54
-  languageName: node
-  linkType: hard
-
-"@ember-data/tracking@npm:4.12.5":
-  version: 4.12.5
-  resolution: "@ember-data/tracking@npm:4.12.5"
-  dependencies:
-    "@ember-data/private-build-infra": 4.12.5
-    "@embroider/macros": ^1.10.0
-    ember-cli-babel: ^7.26.11
-  checksum: be07b307f9915b63369d7edb298cb1585f1eed57bb6c9fa45767f1c37ee563605240296cfeea815f87fd5c6957d6aaaa081bc3cd1c37958e0ca216b80465ba64
-  languageName: node
-  linkType: hard
-
-"@ember-decorators/component@npm:^6.1.1":
-  version: 6.1.1
-  resolution: "@ember-decorators/component@npm:6.1.1"
-  dependencies:
-    "@ember-decorators/utils": ^6.1.1
-    ember-cli-babel: ^7.1.3
-  checksum: 0b731884ff2d84db32eae9c006179153ad1d7f93eee040260d0622101017f363caf38db98e536ffd4008312af91cc57a8dda0d0f2c71f80d3643d5456658bee6
-  languageName: node
-  linkType: hard
-
-"@ember-decorators/object@npm:^6.1.1":
-  version: 6.1.1
-  resolution: "@ember-decorators/object@npm:6.1.1"
-  dependencies:
-    "@ember-decorators/utils": ^6.1.1
-    ember-cli-babel: ^7.1.3
-  checksum: 806f753a58ecca5924da110efa614e9a33b4ed7734aa5e67ea41a8a5f555734852e50e78dadcd269407efe1cc08756e8dbc55c077183892f9dc38a0701b8641d
-  languageName: node
-  linkType: hard
-
-"@ember-decorators/utils@npm:^6.1.0, @ember-decorators/utils@npm:^6.1.1":
-  version: 6.1.1
-  resolution: "@ember-decorators/utils@npm:6.1.1"
-  dependencies:
-    ember-cli-babel: ^7.1.3
-  checksum: 979075021ce824a263859dc236285b37afee98b1583060cfab9c3583a4888612155bb66a23a4f4d24ab0ca9f459b38a458d32f825f0df073ca38a7f6e0187dc1
-  languageName: node
-  linkType: hard
-
-"@ember/edition-utils@npm:^1.2.0":
-  version: 1.2.0
-  resolution: "@ember/edition-utils@npm:1.2.0"
-  checksum: eb1eeb08b66344054acb34a4695a80dbfaeb678d10cb11327eec4c0d03b2324ad7c05d0239a7d0298d5f8931e1698d85cba23dac37bff18ab52104f678a0e8c7
-  languageName: node
-  linkType: hard
-
-"@ember/legacy-built-in-components@npm:^0.4.1":
-  version: 0.4.1
-  resolution: "@ember/legacy-built-in-components@npm:0.4.1"
-  dependencies:
-    "@embroider/macros": ^1.0.0
-    ember-cli-babel: ^7.26.6
-    ember-cli-htmlbars: ^5.7.1
-    ember-cli-typescript: ^4.1.0
-  peerDependencies:
-    ember-source: "*"
-  checksum: e4e872eb0776f29ee066556f3ae99a65ddb75fbfe44f838c807b35d8c51927aae4a28e408529f6a4c42f1445f8addc033a010343e7884c6344aeacb9c4304614
-  languageName: node
-  linkType: hard
-
-"@ember/optional-features@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "@ember/optional-features@npm:2.0.0"
-  dependencies:
-    chalk: ^4.1.0
-    ember-cli-version-checker: ^5.1.1
-    glob: ^7.1.6
-    inquirer: ^7.3.3
-    mkdirp: ^1.0.4
-    silent-error: ^1.1.1
-  checksum: 8fce4edc03b95c364770468398b5163791f36d2c305a7ed7221506558d13d114b79a5e5a58fe98d260b38cff4eece2c2fd87ccdff1bc10a7de8270ab3b3f49d1
-  languageName: node
-  linkType: hard
-
-"@ember/render-modifiers@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "@ember/render-modifiers@npm:1.0.2"
-  dependencies:
-    ember-cli-babel: ^7.10.0
-    ember-modifier-manager-polyfill: ^1.1.0
-  checksum: 74220450d3a8635f1ce6c3d9ce5d7f4d8e7336e48a20b1e28b6acf9f671f0938855dff60a06eb1ad5700fadb42e2c0ffa3adef404788966da99db8ab393e9944
-  languageName: node
-  linkType: hard
-
-"@ember/render-modifiers@npm:^2.0.0, @ember/render-modifiers@npm:^2.0.5":
-  version: 2.1.0
-  resolution: "@ember/render-modifiers@npm:2.1.0"
-  dependencies:
-    "@embroider/macros": ^1.0.0
-    ember-cli-babel: ^7.26.11
-    ember-modifier-manager-polyfill: ^1.2.0
-  peerDependencies:
-    "@glint/template": ^1.0.2
-    ember-source: ^3.8 || ^4.0.0 || ^5.0.0
-  peerDependenciesMeta:
-    "@glint/template":
-      optional: true
-  checksum: 6c4d617b67ee52e8e29e9a2b9f42a30e8ea333a7b7a4c5a61fdf5f15623da11f40d82218aeddfbe32bee1f508c569740e842a8233f4a372728d18b66bbc197d5
-  languageName: node
-  linkType: hard
-
-"@ember/render-modifiers@npm:^2.0.2, @ember/render-modifiers@npm:^2.0.4":
-  version: 2.0.4
-  resolution: "@ember/render-modifiers@npm:2.0.4"
-  dependencies:
-    "@embroider/macros": ^1.0.0
-    ember-cli-babel: ^7.26.11
-    ember-modifier-manager-polyfill: ^1.2.0
-  peerDependencies:
-    ember-source: ^3.8 || 4
-  checksum: 6186a013349273f9eb0339a5b2ab7ccc7b9e6429d83b8cabba2842dfc35bd4b77b66979c2f2c25b062a7cdd359c6a500df27154880ac5f04a3ffa52ca6e343d6
-  languageName: node
-  linkType: hard
-
-"@ember/string@npm:^3.0.1, @ember/string@npm:^3.1.1":
-  version: 3.1.1
-  resolution: "@ember/string@npm:3.1.1"
-  dependencies:
-    ember-cli-babel: ^7.26.6
-  checksum: a2496735cb8cfc2d9484f7756fbb3e528db0a9bdf3acc8e86cc56491302777d806d1039186bf6c045aa3e40e464fd8d1cdac89fe97da274f3200844a7d3162c9
-  languageName: node
-  linkType: hard
-
-"@ember/test-helpers@npm:^2.9.3":
-  version: 2.9.4
-  resolution: "@ember/test-helpers@npm:2.9.4"
-  dependencies:
-    "@ember/test-waiters": ^3.0.0
-    "@embroider/macros": ^1.10.0
-    "@embroider/util": ^1.9.0
-    broccoli-debug: ^0.6.5
-    broccoli-funnel: ^3.0.8
-    ember-cli-babel: ^7.26.11
-    ember-cli-htmlbars: ^6.1.1
-    ember-destroyable-polyfill: ^2.0.3
-  peerDependencies:
-    ember-source: ">=3.8.0"
-  checksum: 55f73d6220db28e61a8a8a69b7768ac4adc89355d86d8d5f3773dd6c45b435ab358c9ce29407275bf9d195bcf1cdf25b39786401ff6c09afc7fae6307fe930ab
-  languageName: node
-  linkType: hard
-
-"@ember/test-waiters@npm:^2.4.3 || ^3.0.0, @ember/test-waiters@npm:^3.0.2, @ember/test-waiters@npm:^3.1.0":
-  version: 3.1.0
-  resolution: "@ember/test-waiters@npm:3.1.0"
-  dependencies:
-    calculate-cache-key-for-tree: ^2.0.0
-    ember-cli-babel: ^7.26.6
-    ember-cli-version-checker: ^5.1.2
-    semver: ^7.3.5
-  checksum: f5d8c75ec060f01d038c4f8f419f844e50928b9d7af518b00318844238b43a7b740fc2ec941f45c61fdf698977f2f8a47b34898faa7da2d09e3a38a8137ac8cf
-  languageName: node
-  linkType: hard
-
-"@ember/test-waiters@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "@ember/test-waiters@npm:3.0.0"
-  dependencies:
-    calculate-cache-key-for-tree: ^2.0.0
-    ember-cli-babel: ^7.26.6
-    ember-cli-version-checker: ^5.1.2
-    semver: ^7.3.5
-  checksum: 4998a8213b8800633485eaca342bd6e9b388d974def70ab794612d0c691b68599b2377b9a5467bdddea699099fec2897821c9127443ddac3c69c82d73ea21fa5
-  languageName: node
-  linkType: hard
-
-"@embroider/addon-shim@npm:1.8.3":
-  version: 1.8.3
-  resolution: "@embroider/addon-shim@npm:1.8.3"
-  dependencies:
-    "@embroider/shared-internals": ^1.8.3
-    semver: ^7.3.5
-  checksum: 11dfdb956631179656727599eb6d6223369f6a04f0e28ac04b793064338c577a89a77c59254a4a665acc46e174cf87196d0f335ab8049be7fe8a2c71ef695974
-  languageName: node
-  linkType: hard
-
-"@embroider/addon-shim@npm:^1.0.0, @embroider/addon-shim@npm:^1.2.0, @embroider/addon-shim@npm:^1.8.3":
-  version: 1.8.6
-  resolution: "@embroider/addon-shim@npm:1.8.6"
-  dependencies:
-    "@embroider/shared-internals": ^2.2.3
-    broccoli-funnel: ^3.0.8
-    semver: ^7.3.8
-  checksum: 63214fbc1b3f333b052791cdfc0c278c348dd6ca4ec2b53c96183150e3d5fe9882cdd3065853e3d6a2c964c962d718b87f2fd8a17414b53fc3a3997d5eedb30e
-  languageName: node
-  linkType: hard
-
-"@embroider/addon-shim@npm:^1.8.4":
-  version: 1.8.4
-  resolution: "@embroider/addon-shim@npm:1.8.4"
-  dependencies:
-    "@embroider/shared-internals": ^2.0.0
-    broccoli-funnel: ^3.0.8
-    semver: ^7.3.8
-  checksum: 107220e97bbd46ead81dfbbfc6cf7daa61731096a6e81b989659a9a0b29b48b3c97ebdd446b6dc0636c4be369f3744e514b7f5e5c0fdc54c1c0e026f54404cc2
-  languageName: node
-  linkType: hard
-
-"@embroider/core@npm:^0.33.0":
-  version: 0.33.0
-  resolution: "@embroider/core@npm:0.33.0"
-  dependencies:
-    "@babel/core": ^7.12.3
-    "@babel/parser": ^7.12.3
-    "@babel/plugin-syntax-dynamic-import": ^7.8.3
-    "@babel/plugin-transform-runtime": ^7.12.1
-    "@babel/runtime": ^7.12.5
-    "@babel/traverse": ^7.12.1
-    "@babel/types": ^7.12.1
-    "@embroider/macros": 0.33.0
-    assert-never: ^1.1.0
-    babel-plugin-syntax-dynamic-import: ^6.18.0
-    broccoli-node-api: ^1.7.0
-    broccoli-persistent-filter: ^3.1.2
-    broccoli-plugin: ^4.0.1
-    broccoli-source: ^3.0.0
-    debug: ^3.1.0
-    escape-string-regexp: ^4.0.0
-    fast-sourcemap-concat: ^1.4.0
-    filesize: ^4.1.2
-    fs-extra: ^7.0.1
-    fs-tree-diff: ^2.0.0
-    handlebars: ^4.4.2
-    js-string-escape: ^1.0.1
-    jsdom: ^16.4.0
-    json-stable-stringify: ^1.0.1
-    lodash: ^4.17.10
-    pkg-up: ^2.0.0
-    resolve: ^1.8.1
-    resolve-package-path: ^1.2.2
-    semver: ^7.3.2
-    strip-bom: ^3.0.0
-    typescript-memoize: ^1.0.0-alpha.3
-    walk-sync: ^1.1.3
-    wrap-legacy-hbs-plugin-if-needed: ^1.0.1
-  checksum: 8abe563e909461b18f9b86a616173a436a5cdaf3c455f0a46ab51cae24129d03bd2e5a06e26a4adba7eca10a1d34388ec5a51fcf790f2ac9fabafb7950668df1
-  languageName: node
-  linkType: hard
-
-"@embroider/macros@npm:^1.0.0":
-  version: 1.5.0
-  resolution: "@embroider/macros@npm:1.5.0"
-  dependencies:
-    "@embroider/shared-internals": 1.5.0
-    assert-never: ^1.2.1
-    babel-import-util: ^1.1.0
-    ember-cli-babel: ^7.26.6
-    find-up: ^5.0.0
-    lodash: ^4.17.21
-    resolve: ^1.20.0
-    semver: ^7.3.2
-  checksum: 5e0d5f8c89b0b31199b938848bb7afc5bcd8d3501cc8bfd3ad4a531d74c4e50e8648303e8adaf690c0f0f69a61025925ce55640d93aa3d1723c820efd9cecabc
-  languageName: node
-  linkType: hard
-
-"@embroider/shared-internals@npm:1.5.0, @embroider/shared-internals@npm:^1.0.0":
-  version: 1.5.0
-  resolution: "@embroider/shared-internals@npm:1.5.0"
-  dependencies:
-    babel-import-util: ^1.1.0
-    ember-rfc176-data: ^0.3.17
-    fs-extra: ^9.1.0
-    lodash: ^4.17.21
-    resolve-package-path: ^4.0.1
-    semver: ^7.3.5
-    typescript-memoize: ^1.0.1
-  checksum: 78f92e64f03f33a0d31489fe406ff58da8d5997b78156e3b8b73f6cd5ef14d8a810a7f65e3da96206a02a3c2277316ebdd5c6dae05abfe816eb9940d76e03004
-  languageName: node
-  linkType: hard
-
-"@embroider/shared-internals@npm:^1.8.3":
-  version: 1.8.3
-  resolution: "@embroider/shared-internals@npm:1.8.3"
-  dependencies:
-    babel-import-util: ^1.1.0
-    ember-rfc176-data: ^0.3.17
-    fs-extra: ^9.1.0
-    js-string-escape: ^1.0.1
-    lodash: ^4.17.21
-    resolve-package-path: ^4.0.1
-    semver: ^7.3.5
-    typescript-memoize: ^1.0.1
-  checksum: de636225b3e85379caad5bf4cb3c4f8cc8d95d1c9fab05668faf55654ae2cfe1ca2632c5cc4b81f0b52781d4fc5b80879e6cd143801976de46c591430957040f
-  languageName: node
-  linkType: hard
-
-"@embroider/shared-internals@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "@embroider/shared-internals@npm:2.0.0"
-  dependencies:
-    babel-import-util: ^1.1.0
-    ember-rfc176-data: ^0.3.17
-    fs-extra: ^9.1.0
-    js-string-escape: ^1.0.1
-    lodash: ^4.17.21
-    resolve-package-path: ^4.0.1
-    semver: ^7.3.5
-    typescript-memoize: ^1.0.1
-  checksum: 19d2754182b9e1373177843a354852c82b35d71af66edcdf0662597442062e5f5f51adbdf7a63a263ee0052064c222ff33ddb983ec3f17b68b7275de8de3680e
-  languageName: node
-  linkType: hard
-
-"@embroider/shared-internals@npm:^2.2.3":
-  version: 2.2.3
-  resolution: "@embroider/shared-internals@npm:2.2.3"
-  dependencies:
-    babel-import-util: ^1.1.0
-    ember-rfc176-data: ^0.3.17
-    fs-extra: ^9.1.0
-    js-string-escape: ^1.0.1
-    lodash: ^4.17.21
-    resolve-package-path: ^4.0.1
-    semver: ^7.3.5
-    typescript-memoize: ^1.0.1
-  checksum: bf9f3769af5a66b6e8935257c77fe49678ef0a24ec74b397134598c16f13cd791ac2107008b0ae5dc41d94810f5e15ad318100c03bf1fcb2209a62db966cc483
-  languageName: node
-  linkType: hard
-
-"@embroider/util@npm:^0.39.1 || ^0.40.0 || ^0.41.0 || ^1.0.0, @embroider/util@npm:^1.2.0":
-  version: 1.9.0
-  resolution: "@embroider/util@npm:1.9.0"
-  dependencies:
-    "@embroider/macros": ^1.9.0
-    broccoli-funnel: ^3.0.5
-    ember-cli-babel: ^7.23.1
-  peerDependencies:
-    ember-source: "*"
-  checksum: 0b2c45d11f633b30e36dc87b199ff9e6543597cce2e1c054c0392f9a7685e6845864ad57d404b9d67fb5dfcd4e93282ab8c3bbd7a491488b3ecdaaa7a0777d49
-  languageName: node
-  linkType: hard
-
-"@embroider/util@npm:^1.0.0":
-  version: 1.5.0
-  resolution: "@embroider/util@npm:1.5.0"
-  dependencies:
-    "@embroider/macros": 1.5.0
-    broccoli-funnel: ^3.0.5
-    ember-cli-babel: ^7.23.1
-  peerDependencies:
-    ember-source: "*"
-  checksum: f3656a8ae3df0d3b35a40c867258a621ef28311c5fbd3e8718593fd436e09816cc3331694695e40dcad384bda638986184dbe13d919314189ce31c154eebdd81
-  languageName: node
-  linkType: hard
-
-"@embroider/util@npm:^1.9.0":
-  version: 1.11.2
-  resolution: "@embroider/util@npm:1.11.2"
-  dependencies:
-    "@embroider/macros": ^1.12.3
-    broccoli-funnel: ^3.0.5
-    ember-cli-babel: ^7.26.11
-  peerDependencies:
-    "@glint/environment-ember-loose": ^1.0.0
-    "@glint/template": ^1.0.0
-    ember-source: "*"
-  peerDependenciesMeta:
-    "@glint/environment-ember-loose":
-      optional: true
-    "@glint/template":
-      optional: true
-  checksum: 1d9cc4e5b4d2f8bd3803460771665e251c88b1788791c8a2bb15baab33bb5ec4afd0da1203ed7f4797abb31d9565e5abb0aef2ba6dcfa20368f48dca191a9106
-  languageName: node
-  linkType: hard
-
-"@eslint-community/eslint-utils@npm:^4.2.0":
-  version: 4.4.0
-  resolution: "@eslint-community/eslint-utils@npm:4.4.0"
-  dependencies:
-    eslint-visitor-keys: ^3.3.0
-  peerDependencies:
-    eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
-  checksum: cdfe3ae42b4f572cbfb46d20edafe6f36fc5fb52bf2d90875c58aefe226892b9677fef60820e2832caf864a326fe4fc225714c46e8389ccca04d5f9288aabd22
-  languageName: node
-  linkType: hard
-
-"@eslint-community/regexpp@npm:^4.4.0":
-  version: 4.5.1
-  resolution: "@eslint-community/regexpp@npm:4.5.1"
-  checksum: 6d901166d64998d591fab4db1c2f872981ccd5f6fe066a1ad0a93d4e11855ecae6bfb76660869a469563e8882d4307228cebd41142adb409d182f2966771e57e
-  languageName: node
-  linkType: hard
-
-"@eslint/eslintrc@npm:^1.3.3":
-  version: 1.3.3
-  resolution: "@eslint/eslintrc@npm:1.3.3"
-  dependencies:
-    ajv: ^6.12.4
-    debug: ^4.3.2
-    espree: ^9.4.0
-    globals: ^13.15.0
-    ignore: ^5.2.0
-    import-fresh: ^3.2.1
-    js-yaml: ^4.1.0
-    minimatch: ^3.1.2
-    strip-json-comments: ^3.1.1
-  checksum: f03e9d6727efd3e0719da2051ea80c0c73d20e28c171121527dbb868cd34232ca9c1d0525a66e517a404afea26624b1e47895b6a92474678418c2f50c9566694
-  languageName: node
-  linkType: hard
-
-"@eslint/eslintrc@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "@eslint/eslintrc@npm:2.1.0"
-  dependencies:
-    ajv: ^6.12.4
-    debug: ^4.3.2
-    espree: ^9.6.0
-    globals: ^13.19.0
-    ignore: ^5.2.0
-    import-fresh: ^3.2.1
-    js-yaml: ^4.1.0
-    minimatch: ^3.1.2
-    strip-json-comments: ^3.1.1
-  checksum: d5ed0adbe23f6571d8c9bb0ca6edf7618dc6aed4046aa56df7139f65ae7b578874e0d9c796df784c25bda648ceb754b6320277d828c8b004876d7443b8dc018c
-  languageName: node
-  linkType: hard
-
-"@eslint/js@npm:8.44.0":
-  version: 8.44.0
-  resolution: "@eslint/js@npm:8.44.0"
-  checksum: fc539583226a28f5677356e9f00d2789c34253f076643d2e32888250e509a4e13aafe0880cb2425139051de0f3a48d25bfc5afa96b7304f203b706c17340e3cf
-  languageName: node
-  linkType: hard
-
-"@gar/promisify@npm:^1.1.3":
-  version: 1.1.3
-  resolution: "@gar/promisify@npm:1.1.3"
-  checksum: 4059f790e2d07bf3c3ff3e0fec0daa8144fe35c1f6e0111c9921bd32106adaa97a4ab096ad7dab1e28ee6a9060083c4d1a4ada42a7f5f3f7a96b8812e2b757c1
-  languageName: node
-  linkType: hard
-
-"@glimmer/component@npm:^1.0.4":
-  version: 1.0.4
-  resolution: "@glimmer/component@npm:1.0.4"
-  dependencies:
-    "@glimmer/di": ^0.1.9
-    "@glimmer/env": ^0.1.7
-    "@glimmer/util": ^0.44.0
-    broccoli-file-creator: ^2.1.1
-    broccoli-merge-trees: ^3.0.2
-    ember-cli-babel: ^7.7.3
-    ember-cli-get-component-path-option: ^1.0.0
-    ember-cli-is-package-missing: ^1.0.0
-    ember-cli-normalize-entity-name: ^1.0.0
-    ember-cli-path-utils: ^1.0.0
-    ember-cli-string-utils: ^1.1.0
-    ember-cli-typescript: 3.0.0
-    ember-cli-version-checker: ^3.1.3
-    ember-compatibility-helpers: ^1.1.2
-  checksum: 122009a24f06053647779dc79d4f5cd3ef6d2deac91c92bb3d1dd01a68dd5ef5002efaa48e4abba85287fd2a1aba711dee330cee9b82d283c05763391d10671d
-  languageName: node
-  linkType: hard
-
-"@glimmer/component@npm:^1.1.0, @glimmer/component@npm:^1.1.2":
-  version: 1.1.2
-  resolution: "@glimmer/component@npm:1.1.2"
-  dependencies:
-    "@glimmer/di": ^0.1.9
-    "@glimmer/env": ^0.1.7
-    "@glimmer/util": ^0.44.0
-    broccoli-file-creator: ^2.1.1
-    broccoli-merge-trees: ^3.0.2
-    ember-cli-babel: ^7.7.3
-    ember-cli-get-component-path-option: ^1.0.0
-    ember-cli-is-package-missing: ^1.0.0
-    ember-cli-normalize-entity-name: ^1.0.0
-    ember-cli-path-utils: ^1.0.0
-    ember-cli-string-utils: ^1.1.0
-    ember-cli-typescript: 3.0.0
-    ember-cli-version-checker: ^3.1.3
-    ember-compatibility-helpers: ^1.1.2
-  checksum: 853b998105c1f77cf382b6f6459709515d39d560f2022e948e7b7f6b298b14197e45b20c1cbfca52970c0fef1a80a1bce55aea98c4da2311330d5420291254b7
-  languageName: node
-  linkType: hard
-
-"@glimmer/di@npm:^0.1.9":
-  version: 0.1.11
-  resolution: "@glimmer/di@npm:0.1.11"
-  checksum: c93f6a511cf7f72f3a6824ce075e73952b8f451e4098eda2fc1f45b4b5b1016831459d32f3f298fdc21030cc03ebcc4561ca2780c59562e356519b2a296c5b48
-  languageName: node
-  linkType: hard
-
-"@glimmer/encoder@npm:^0.42.2":
-  version: 0.42.2
-  resolution: "@glimmer/encoder@npm:0.42.2"
-  dependencies:
-    "@glimmer/interfaces": ^0.42.2
-    "@glimmer/vm": ^0.42.2
-  checksum: 1e857e09176a6673c599a7b466b8cb20fde55df3dfd7e2d923ac2e065261ddf2ef82651a64c40c0209bb9fc684abcf6f79ea52e23b9f7463c7a244f0540bce50
-  languageName: node
-  linkType: hard
-
-"@glimmer/env@npm:0.1.7, @glimmer/env@npm:^0.1.7":
-  version: 0.1.7
-  resolution: "@glimmer/env@npm:0.1.7"
-  checksum: d46686da1b21615c177792794ed11f725fbb1c32936d69ca54a3ac40e2314638a529b81afb23759d35cdf36462a7a6b2c02604a366473cd6a8abadfe56e9c335
-  languageName: node
-  linkType: hard
-
-"@glimmer/global-context@npm:0.84.3":
-  version: 0.84.3
-  resolution: "@glimmer/global-context@npm:0.84.3"
-  dependencies:
-    "@glimmer/env": ^0.1.7
-  checksum: 89e699acfa1f23fe8ce8fd48455897781dfd935b7d1ef97d8d268ee38456a69a2ce09bcb18c250f17cb019a16cf0f2e4fdd5b178f9ddc233b42f1cc7e5c85157
-  languageName: node
-  linkType: hard
-
-"@glimmer/interfaces@npm:0.84.3":
-  version: 0.84.3
-  resolution: "@glimmer/interfaces@npm:0.84.3"
-  dependencies:
-    "@simple-dom/interface": ^1.4.0
-  checksum: f6a6757a2fc6fc0a8aeb9c1ce4acaec7adf03b31130c9c3149265a401d8fc4773dfb1ff6a567fc008c669cb3c5b9a94f505c68298f72f283d03a46bc0dcb1121
-  languageName: node
-  linkType: hard
-
-"@glimmer/interfaces@npm:^0.42.2":
-  version: 0.42.2
-  resolution: "@glimmer/interfaces@npm:0.42.2"
-  checksum: c9dfcba6456955d797e5e0746ba69655c0d99a4962adb0de875e8de4e826767bce1c544966468bc9da40468286572966e59ce2c19b3f3879bfd23922b7d57cc6
-  languageName: node
-  linkType: hard
-
-"@glimmer/low-level@npm:^0.42.2":
-  version: 0.42.2
-  resolution: "@glimmer/low-level@npm:0.42.2"
-  checksum: 7d7c5af8d127e588853ad590f4bfa4d06c545b27b86dfee102e036a5cf9a59971d735b8a13f7611cf8c4006c10349e93a15a7eb55e246cb2f047bf2d524b0f6d
-  languageName: node
-  linkType: hard
-
-"@glimmer/program@npm:^0.42.2":
-  version: 0.42.2
-  resolution: "@glimmer/program@npm:0.42.2"
-  dependencies:
-    "@glimmer/encoder": ^0.42.2
-    "@glimmer/interfaces": ^0.42.2
-    "@glimmer/util": ^0.42.2
-  checksum: 570c60a96b96c37c43bfae1fe9c5b29459d0c0c4eadc2da478ccfe38f1a3e3ab5d0dffa05d09ac4828899ccf610b9ff987e5cc76b5491570c16448b82db975aa
-  languageName: node
-  linkType: hard
-
-"@glimmer/reference@npm:^0.42.1, @glimmer/reference@npm:^0.42.2":
-  version: 0.42.2
-  resolution: "@glimmer/reference@npm:0.42.2"
-  dependencies:
-    "@glimmer/util": ^0.42.2
-  checksum: b5b66e2210b429d69a3287fed79b4fb4036282da2f31ea2b8c0a200e452fd21bcb4dff39b031d2cc98646d9443b2b8fb0c910aaf30cc3b0597df0f07532b361d
-  languageName: node
-  linkType: hard
-
-"@glimmer/reference@npm:^0.84.3":
-  version: 0.84.3
-  resolution: "@glimmer/reference@npm:0.84.3"
-  dependencies:
-    "@glimmer/env": ^0.1.7
-    "@glimmer/global-context": 0.84.3
-    "@glimmer/interfaces": 0.84.3
-    "@glimmer/util": 0.84.3
-    "@glimmer/validator": 0.84.3
-  checksum: 856456c1211cb1c1ddc5c48b8aea924f1b1f19625be1984f2bc7147af49d89c70e3f356bf7d299aa519ee53a21ca4c7371277be14218c37d9206e4cac2f05b9e
-  languageName: node
-  linkType: hard
-
-"@glimmer/runtime@npm:^0.42.1":
-  version: 0.42.2
-  resolution: "@glimmer/runtime@npm:0.42.2"
-  dependencies:
-    "@glimmer/interfaces": ^0.42.2
-    "@glimmer/low-level": ^0.42.2
-    "@glimmer/program": ^0.42.2
-    "@glimmer/reference": ^0.42.2
-    "@glimmer/util": ^0.42.2
-    "@glimmer/vm": ^0.42.2
-    "@glimmer/wire-format": ^0.42.2
-  checksum: 45345713e44033fac3fc8356ce5ab1b1e90ff998ed25bdd0b615a45f05574b65b8fc87dbc22ed79a7c8d448f1c634228ab5aa546ea50a2ba878a45453bfe4fe2
-  languageName: node
-  linkType: hard
-
-"@glimmer/syntax@npm:^0.42.1":
-  version: 0.42.2
-  resolution: "@glimmer/syntax@npm:0.42.2"
-  dependencies:
-    "@glimmer/interfaces": ^0.42.2
-    "@glimmer/util": ^0.42.2
-    handlebars: ^4.0.13
-    simple-html-tokenizer: ^0.5.8
-  checksum: 7597a643b88a967fbb85c3c3e0a8f57a4e7a328f78b9605fb31a5ee678531ca0b7935971cab8755af33f2b3ea71836a38e10dffbec259c6ab1ca411c2f1ec80d
-  languageName: node
-  linkType: hard
-
-"@glimmer/syntax@npm:^0.84.2, @glimmer/syntax@npm:^0.84.3":
-  version: 0.84.3
-  resolution: "@glimmer/syntax@npm:0.84.3"
-  dependencies:
-    "@glimmer/interfaces": 0.84.3
-    "@glimmer/util": 0.84.3
-    "@handlebars/parser": ~2.0.0
-    simple-html-tokenizer: ^0.5.11
-  checksum: afadea62f1c54735df723120a94f4da3cb663d762be1c9b130f8d22584ccc93a037198b60759706d3cf0d3658268170eae687dfdc7cb21e5c0a9af7005ebc727
-  languageName: node
-  linkType: hard
-
-"@glimmer/tracking@npm:^1.0.0, @glimmer/tracking@npm:^1.1.2":
-  version: 1.1.2
-  resolution: "@glimmer/tracking@npm:1.1.2"
-  dependencies:
-    "@glimmer/env": ^0.1.7
-    "@glimmer/validator": ^0.44.0
-  checksum: a36aaf70c831fbfd9fb6f6e7b9cacb7130b0dbb87206234cd8e5fcbfa42070cab48d7d9b16eb6918f266ac3ae0414d968b1903b520a69f0eac2a8f303179f8ff
-  languageName: node
-  linkType: hard
-
-"@glimmer/tracking@npm:^1.0.4":
-  version: 1.0.4
-  resolution: "@glimmer/tracking@npm:1.0.4"
-  dependencies:
-    "@glimmer/env": ^0.1.7
-    "@glimmer/validator": ^0.44.0
-  checksum: 5e6359c92a2937f9710d21ad5e2edf2ce579c18e4fc2905940088738cda2ddf1162279bb41248047ced3c948885db346c844556e784eb70ebadb349d0ab587a3
-  languageName: node
-  linkType: hard
-
-"@glimmer/util@npm:0.84.3":
-  version: 0.84.3
-  resolution: "@glimmer/util@npm:0.84.3"
-  dependencies:
-    "@glimmer/env": 0.1.7
-    "@glimmer/interfaces": 0.84.3
-    "@simple-dom/interface": ^1.4.0
-  checksum: d0f8d461a7653a113e630ee45aa57e4efbc33f78ab7b7ce12bdaa699b3513df93a7ffba96b1863883fafe566b650dfb01c4122f79207d6267d1655255b9baa4a
-  languageName: node
-  linkType: hard
-
-"@glimmer/util@npm:^0.42.2":
-  version: 0.42.2
-  resolution: "@glimmer/util@npm:0.42.2"
-  checksum: 996a84c3db284e47202a7daeccce31870a413dd6817a88908ad18484f2cd4559d19c8bc98e921cc00db72db3a1efa52931725abe4c71d4a3bb1bb78a50fb739a
-  languageName: node
-  linkType: hard
-
-"@glimmer/util@npm:^0.44.0":
-  version: 0.44.0
-  resolution: "@glimmer/util@npm:0.44.0"
-  checksum: e1c5f74c265afb2ccdc10e183d6784dc29d2cb98f2aca10b068f3dce29e67a3967c760af750e88e0a2f1c80e2cfc0de5ee6e96bb90dcb97493a2e6f51d36b129
-  languageName: node
-  linkType: hard
-
-"@glimmer/validator@npm:0.84.3, @glimmer/validator@npm:^0.84.3":
-  version: 0.84.3
-  resolution: "@glimmer/validator@npm:0.84.3"
-  dependencies:
-    "@glimmer/env": ^0.1.7
-    "@glimmer/global-context": 0.84.3
-  checksum: 58ac3c49a1a601de8271cfcc0f27415fa2388283ae90dd2b4f785f5ab44fa12506c8b32cfc6c74d69bb60ca27745b4f6707fec07a8dff78f2d9da9f9aecc2afa
-  languageName: node
-  linkType: hard
-
-"@glimmer/validator@npm:^0.44.0":
-  version: 0.44.0
-  resolution: "@glimmer/validator@npm:0.44.0"
-  checksum: c68a169ee196a17a142b2375928d1b5b2bad2f1f7961a9a14b6a5ef0b8d5c66af7004d678502d2ae83f6b69c1745cbcecbf71607b140924dec9da96e413fd8d4
-  languageName: node
-  linkType: hard
-
-"@glimmer/vm-babel-plugins@npm:0.84.2":
-  version: 0.84.2
-  resolution: "@glimmer/vm-babel-plugins@npm:0.84.2"
-  dependencies:
-    babel-plugin-debug-macros: ^0.3.4
-  checksum: 708434ad7535c26592f51d9cbacbc101c379903638d371e1e20d3a3ba7a3932e3a80045a126927e95e553dd2fbde2b3cb4d4f23328e5ff938b39bbe1eb5bb891
-  languageName: node
-  linkType: hard
-
-"@glimmer/vm@npm:^0.42.2":
-  version: 0.42.2
-  resolution: "@glimmer/vm@npm:0.42.2"
-  dependencies:
-    "@glimmer/interfaces": ^0.42.2
-    "@glimmer/util": ^0.42.2
-  checksum: 3adb1963fb5cfe9ee795e10f144ec0ba1c5e9289525a95b3e506d05477da47247f36e01837dbfe5f728d74a6d44f4d62e1a59e7ec9ebdaabf5cbe955c643dc34
-  languageName: node
-  linkType: hard
-
-"@glimmer/wire-format@npm:^0.42.2":
-  version: 0.42.2
-  resolution: "@glimmer/wire-format@npm:0.42.2"
-  dependencies:
-    "@glimmer/interfaces": ^0.42.2
-    "@glimmer/util": ^0.42.2
-  checksum: f1778ba0ec24a41f15b55e328854d9e9dbd3371269bc6912b633b5487f52f725a8f12b0ef9ba4b9614633b89abdc2b02ee7a25a07b28ab2452ffe6b854589adb
-  languageName: node
-  linkType: hard
-
-"@handlebars/parser@npm:~2.0.0":
-  version: 2.0.0
-  resolution: "@handlebars/parser@npm:2.0.0"
-  checksum: add32d6678b18db73fb88266138bc358abf94c255f4464b936b5b66e3108205c6cc3b611a726e0a691633552b94c0f9f65aed43fd4c51ecbbfb562179c967d88
-  languageName: node
-  linkType: hard
-
-"@hashicorp/design-system-components@npm:^3.4.0":
-  version: 3.4.0
-  resolution: "@hashicorp/design-system-components@npm:3.4.0"
-  dependencies:
-    "@ember/render-modifiers": ^2.0.5
-    "@ember/string": ^3.1.1
-    "@ember/test-waiters": ^3.1.0
-    "@hashicorp/design-system-tokens": ^1.9.0
-    "@hashicorp/ember-flight-icons": ^4.0.5
-    dialog-polyfill: ^0.5.6
-    ember-a11y-refocus: ^3.0.2
-    ember-auto-import: ^2.6.3
-    ember-cached-decorator-polyfill: ^1.0.2
-    ember-cli-babel: ^8.2.0
-    ember-cli-htmlbars: ^6.3.0
-    ember-cli-sass: ^11.0.1
-    ember-composable-helpers: ^5.0.0
-    ember-element-helper: ^0.8.5
-    ember-focus-trap: ^1.1.0
-    ember-keyboard: ^8.2.1
-    ember-stargate: ^0.4.3
-    ember-style-modifier: ^3.0.1
-    ember-truth-helpers: ^3.1.1
-    prismjs: ^1.29.0
-    sass: ^1.69.5
-    tippy.js: ^6.3.7
-  checksum: a206648f67d84849069264a25dd32cd6af0608853018925400958f89c1b590b037408ab38e616c9f8ba9bcc08955c50820c80f5a137164023f30858e472a9008
-  languageName: node
-  linkType: hard
-
-"@hashicorp/design-system-tokens@npm:^1.9.0":
-  version: 1.9.0
-  resolution: "@hashicorp/design-system-tokens@npm:1.9.0"
-  checksum: 72da214205dfca9e49726745e18f8a19674d36d656bd2e4ff3fec42b2ce06fbbba0ad673e6ec2333128e1b9bf67bfac2e4dd792ea37a1534a5040e6a4481855e
-  languageName: node
-  linkType: hard
-
-"@hashicorp/ember-flight-icons@npm:^4.0.5":
-  version: 4.0.5
-  resolution: "@hashicorp/ember-flight-icons@npm:4.0.5"
-  dependencies:
-    "@hashicorp/flight-icons": ^2.24.0
-    ember-auto-import: ^2.6.3
-    ember-cli-babel: ^8.2.0
-    ember-cli-htmlbars: ^6.3.0
-    ember-get-config: ^2.1.1
-  checksum: 68ed79595fdb7ed2cd9c33260c14f780a358eee9952f228897051f5994daa9e2a366b8f5c9992a2511c9ea0a79a5fefb1ac4e1068707bb8115708f3a91b60af6
-  languageName: node
-  linkType: hard
-
-"@hashicorp/flight-icons@npm:^2.24.0":
-  version: 2.24.0
-  resolution: "@hashicorp/flight-icons@npm:2.24.0"
-  checksum: f226e4e4aed2256680a0fd29bfeac215dc9a224f8ce7b532a64cc30917a2739d34e50e84f70d40b05193e5cb2fbbb603b7870d4a0da09c6335c7f94bfb6e18df
-  languageName: node
-  linkType: hard
-
-"@humanwhocodes/config-array@npm:^0.11.10":
-  version: 0.11.10
-  resolution: "@humanwhocodes/config-array@npm:0.11.10"
-  dependencies:
-    "@humanwhocodes/object-schema": ^1.2.1
-    debug: ^4.1.1
-    minimatch: ^3.0.5
-  checksum: 1b1302e2403d0e35bc43e66d67a2b36b0ad1119efc704b5faff68c41f791a052355b010fb2d27ef022670f550de24cd6d08d5ecf0821c16326b7dcd0ee5d5d8a
-  languageName: node
-  linkType: hard
-
-"@humanwhocodes/config-array@npm:^0.11.6":
-  version: 0.11.7
-  resolution: "@humanwhocodes/config-array@npm:0.11.7"
-  dependencies:
-    "@humanwhocodes/object-schema": ^1.2.1
-    debug: ^4.1.1
-    minimatch: ^3.0.5
-  checksum: cf506dc45d9488af7fbf108ea6ac2151ba1a25e6d2b94b9b4fc36d2c1e4099b89ff560296dbfa13947e44604d4ca4a90d97a4fb167370bf8dd01a6ca2b6d83ac
-  languageName: node
-  linkType: hard
-
-"@humanwhocodes/module-importer@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "@humanwhocodes/module-importer@npm:1.0.1"
-  checksum: 0fd22007db8034a2cdf2c764b140d37d9020bbfce8a49d3ec5c05290e77d4b0263b1b972b752df8c89e5eaa94073408f2b7d977aed131faf6cf396ebb5d7fb61
-  languageName: node
-  linkType: hard
-
-"@humanwhocodes/object-schema@npm:^1.2.1":
-  version: 1.2.1
-  resolution: "@humanwhocodes/object-schema@npm:1.2.1"
-  checksum: a824a1ec31591231e4bad5787641f59e9633827d0a2eaae131a288d33c9ef0290bd16fda8da6f7c0fcb014147865d12118df10db57f27f41e20da92369fcb3f1
-  languageName: node
-  linkType: hard
-
-"@icholy/duration@npm:^5.1.0":
-  version: 5.1.0
-  resolution: "@icholy/duration@npm:5.1.0"
-  checksum: 48c7c23697a510944bfc52cf0d354eba2b65d14633f910f2dc4c2a5e10e078d3b70bed9b310c37a574f0e6863084aa6cc65518cfc4af5cb2174605c7aad33352
-  languageName: node
-  linkType: hard
-
-"@isaacs/cliui@npm:^8.0.2":
-  version: 8.0.2
-  resolution: "@isaacs/cliui@npm:8.0.2"
-  dependencies:
-    string-width: ^5.1.2
-    string-width-cjs: "npm:string-width@^4.2.0"
-    strip-ansi: ^7.0.1
-    strip-ansi-cjs: "npm:strip-ansi@^6.0.1"
-    wrap-ansi: ^8.1.0
-    wrap-ansi-cjs: "npm:wrap-ansi@^7.0.0"
-  checksum: 4a473b9b32a7d4d3cfb7a614226e555091ff0c5a29a1734c28c72a182c2f6699b26fc6b5c2131dfd841e86b185aea714c72201d7c98c2fba5f17709333a67aeb
-  languageName: node
-  linkType: hard
-
-"@jridgewell/gen-mapping@npm:^0.3.0":
-  version: 0.3.1
-  resolution: "@jridgewell/gen-mapping@npm:0.3.1"
-  dependencies:
-    "@jridgewell/set-array": ^1.0.0
-    "@jridgewell/sourcemap-codec": ^1.4.10
-    "@jridgewell/trace-mapping": ^0.3.9
-  checksum: e9e7bb3335dea9e60872089761d4e8e089597360cdb1af90370e9d53b7d67232c1e0a3ab65fbfef4fc785745193fbc56bff9f3a6cab6c6ce3f15e12b4191f86b
-  languageName: node
-  linkType: hard
-
-"@jridgewell/gen-mapping@npm:^0.3.2":
-  version: 0.3.2
-  resolution: "@jridgewell/gen-mapping@npm:0.3.2"
-  dependencies:
-    "@jridgewell/set-array": ^1.0.1
-    "@jridgewell/sourcemap-codec": ^1.4.10
-    "@jridgewell/trace-mapping": ^0.3.9
-  checksum: 1832707a1c476afebe4d0fbbd4b9434fdb51a4c3e009ab1e9938648e21b7a97049fa6009393bdf05cab7504108413441df26d8a3c12193996e65493a4efb6882
-  languageName: node
-  linkType: hard
-
-"@jridgewell/resolve-uri@npm:3.1.0":
-  version: 3.1.0
-  resolution: "@jridgewell/resolve-uri@npm:3.1.0"
-  checksum: b5ceaaf9a110fcb2780d1d8f8d4a0bfd216702f31c988d8042e5f8fbe353c55d9b0f55a1733afdc64806f8e79c485d2464680ac48a0d9fcadb9548ee6b81d267
-  languageName: node
-  linkType: hard
-
-"@jridgewell/resolve-uri@npm:^3.0.3":
-  version: 3.0.5
-  resolution: "@jridgewell/resolve-uri@npm:3.0.5"
-  checksum: 1ee652b693da7979ac4007926cc3f0a32b657ffeb913e111f44e5b67153d94a2f28a1d560101cc0cf8087625468293a69a00f634a2914e1a6d0817ba2039a913
-  languageName: node
-  linkType: hard
-
-"@jridgewell/set-array@npm:^1.0.0":
-  version: 1.1.1
-  resolution: "@jridgewell/set-array@npm:1.1.1"
-  checksum: cc5d91e0381c347e3edee4ca90b3c292df9e6e55f29acbe0dd97de8651b4730e9ab761406fd572effa79972a0edc55647b627f8c72315e276d959508853d9bf2
-  languageName: node
-  linkType: hard
-
-"@jridgewell/set-array@npm:^1.0.1":
-  version: 1.1.2
-  resolution: "@jridgewell/set-array@npm:1.1.2"
-  checksum: 69a84d5980385f396ff60a175f7177af0b8da4ddb81824cb7016a9ef914eee9806c72b6b65942003c63f7983d4f39a5c6c27185bbca88eb4690b62075602e28e
-  languageName: node
-  linkType: hard
-
-"@jridgewell/source-map@npm:^0.3.2":
-  version: 0.3.2
-  resolution: "@jridgewell/source-map@npm:0.3.2"
-  dependencies:
-    "@jridgewell/gen-mapping": ^0.3.0
-    "@jridgewell/trace-mapping": ^0.3.9
-  checksum: 1b83f0eb944e77b70559a394d5d3b3f98a81fcc186946aceb3ef42d036762b52ef71493c6c0a3b7c1d2f08785f53ba2df1277fe629a06e6109588ff4cdcf7482
-  languageName: node
-  linkType: hard
-
-"@jridgewell/sourcemap-codec@npm:1.4.14":
-  version: 1.4.14
-  resolution: "@jridgewell/sourcemap-codec@npm:1.4.14"
-  checksum: 61100637b6d173d3ba786a5dff019e1a74b1f394f323c1fee337ff390239f053b87266c7a948777f4b1ee68c01a8ad0ab61e5ff4abb5a012a0b091bec391ab97
-  languageName: node
-  linkType: hard
-
-"@jridgewell/sourcemap-codec@npm:^1.4.10":
-  version: 1.4.11
-  resolution: "@jridgewell/sourcemap-codec@npm:1.4.11"
-  checksum: 3b2afaf8400fb07a36db60e901fcce6a746cdec587310ee9035939d89878e57b2dec8173b0b8f63176f647efa352294049a53c49739098eb907ff81fec2547c8
-  languageName: node
-  linkType: hard
-
-"@jridgewell/sourcemap-codec@npm:^1.4.13":
-  version: 1.4.15
-  resolution: "@jridgewell/sourcemap-codec@npm:1.4.15"
-  checksum: b881c7e503db3fc7f3c1f35a1dd2655a188cc51a3612d76efc8a6eb74728bef5606e6758ee77423e564092b4a518aba569bbb21c9bac5ab7a35b0c6ae7e344c8
-  languageName: node
-  linkType: hard
-
-"@jridgewell/trace-mapping@npm:^0.3.0":
-  version: 0.3.4
-  resolution: "@jridgewell/trace-mapping@npm:0.3.4"
-  dependencies:
-    "@jridgewell/resolve-uri": ^3.0.3
-    "@jridgewell/sourcemap-codec": ^1.4.10
-  checksum: ab8bce84bbbc8c34f3ba8325ed926f8f2d3098983c10442a80c55764c4eb6e47d5b92d8ff20a0dd868c3e76a3535651fd8a0138182c290dbfc8396195685c37b
-  languageName: node
-  linkType: hard
-
-"@jridgewell/trace-mapping@npm:^0.3.17":
-  version: 0.3.18
-  resolution: "@jridgewell/trace-mapping@npm:0.3.18"
-  dependencies:
-    "@jridgewell/resolve-uri": 3.1.0
-    "@jridgewell/sourcemap-codec": 1.4.14
-  checksum: 0572669f855260808c16fe8f78f5f1b4356463b11d3f2c7c0b5580c8ba1cbf4ae53efe9f627595830856e57dbac2325ac17eb0c3dd0ec42102e6f227cc289c02
-  languageName: node
-  linkType: hard
-
-"@jridgewell/trace-mapping@npm:^0.3.7, @jridgewell/trace-mapping@npm:^0.3.9":
-  version: 0.3.13
-  resolution: "@jridgewell/trace-mapping@npm:0.3.13"
-  dependencies:
-    "@jridgewell/resolve-uri": ^3.0.3
-    "@jridgewell/sourcemap-codec": ^1.4.10
-  checksum: e38254e830472248ca10a6ed1ae75af5e8514f0680245a5e7b53bc3c030fd8691d4d3115d80595b45d3badead68269769ed47ecbbdd67db1343a11f05700e75a
-  languageName: node
-  linkType: hard
-
-"@lineal-viz/lineal@npm:^0.5.1":
-  version: 0.5.1
-  resolution: "@lineal-viz/lineal@npm:0.5.1"
-  dependencies:
-    "@embroider/addon-shim": ^1.0.0
-    d3-array: ^3.2.0
-    d3-scale: ^4.0.2
-    d3-shape: ^3.1.0
-    ember-cached-decorator-polyfill: ^1.0.1
-    ember-modifier: ^3.2.7
-    ember-resize-modifier: ^0.4.1
-  checksum: be47dbac62d65f01121d78b8ed393c7c5aa7cb520755a504d912b44054a478a16b9834208f031cb3cd1710c3f04008a91aa41b36ed544d0a738a09607d3c29ac
-  languageName: node
-  linkType: hard
-
-"@lint-todo/utils@npm:^13.0.3":
-  version: 13.0.3
-  resolution: "@lint-todo/utils@npm:13.0.3"
-  dependencies:
-    "@types/eslint": ^7.2.13
-    find-up: ^5.0.0
-    fs-extra: ^9.1.0
-    proper-lockfile: ^4.1.2
-    slash: ^3.0.0
-    tslib: ^2.3.1
-    upath: ^2.0.1
-  checksum: be45ba795e166160a3cfb7fc5f5054cb7c9dd6fe0f5cd39cc15eff7fe70e3c78c8e12b26e97415f1f67e34c80a5d0fafec51b56e725919fabcc7abdf5dfc6244
-  languageName: node
-  linkType: hard
-
-"@mdn/browser-compat-data@npm:^3.3.14":
-  version: 3.3.14
-  resolution: "@mdn/browser-compat-data@npm:3.3.14"
-  checksum: 0363cc9cb3cef308b78b3ba82af0542ad928bacecc95ee1e849c134c3eb866f4771df9fb064fd4da42fdb28e2d6932e0abb6e47ed47fbc42a26a9b0a5aee1e9f
-  languageName: node
-  linkType: hard
-
-"@mdn/browser-compat-data@npm:^4.1.5":
-  version: 4.2.1
-  resolution: "@mdn/browser-compat-data@npm:4.2.1"
-  checksum: 76eaa7dafed154040e769ba6d23f2dcb58e805ed3ccb376a5c4b76326c92643753c20194faed363870800dc3c1af26c107b8562710c8bb37aaee8c5ffe2a89cd
-  languageName: node
-  linkType: hard
-
-"@messageformat/core@npm:^3.0.1":
-  version: 3.0.1
-  resolution: "@messageformat/core@npm:3.0.1"
-  dependencies:
-    "@messageformat/date-skeleton": ^1.0.0
-    "@messageformat/number-skeleton": ^1.0.0
-    "@messageformat/parser": ^5.0.0
-    "@messageformat/runtime": ^3.0.1
-    make-plural: ^7.0.0
-    safe-identifier: ^0.4.1
-  checksum: f08c982d54ef2ddf32de2a3425746e6efd37ce63154f97ff038edb1e02eb4e3e4c39f2aa42ef3d036e2f1b61eee0a2589e76158b0b91510355ef8348f2f8252f
-  languageName: node
-  linkType: hard
-
-"@messageformat/date-skeleton@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "@messageformat/date-skeleton@npm:1.0.1"
-  checksum: 0832029a18ae54c81d4473eaa764cebbabe084d1a3253a6d4975e5802bff7416a51d43522aad9292eb9663735282a7667e2818efc92905c497ca87424d822ceb
-  languageName: node
-  linkType: hard
-
-"@messageformat/number-skeleton@npm:^1.0.0":
-  version: 1.1.0
-  resolution: "@messageformat/number-skeleton@npm:1.1.0"
-  checksum: 03cf337ef4b95782546e8e2c831f7d2f1310ee9f49635adeef1259c17256c91cb68a59fb97b76a59fddaac284ee739c0a0e0003bcec8d92f6ff156a240a6c23f
-  languageName: node
-  linkType: hard
-
-"@messageformat/parser@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "@messageformat/parser@npm:5.0.0"
-  dependencies:
-    moo: ^0.5.1
-  checksum: e595910e8801e17b1e762a1824e4fc97baf6ccc21f5f896d6eae3e537ca2eaed0f699ac20b44d03c38ad20340b57ef0f7c7cf056213d31dd156e65b4d030c8c0
-  languageName: node
-  linkType: hard
-
-"@messageformat/runtime@npm:^3.0.1":
-  version: 3.0.1
-  resolution: "@messageformat/runtime@npm:3.0.1"
-  dependencies:
-    make-plural: ^7.0.0
-  checksum: e69c3b0b372e15af88c285f6884ac0e3ba5fc7227b8ddc7f4bef94cb5675057126dc0ae9001e2a623d7ec61727d9b5e69b8e61be8618afe0baf40081ad3b0568
-  languageName: node
-  linkType: hard
-
-"@miragejs/pretender-node-polyfill@npm:^0.1.0":
-  version: 0.1.2
-  resolution: "@miragejs/pretender-node-polyfill@npm:0.1.2"
-  checksum: bb55983a253dc0d4162acac090b062500595c9844bfbd21fe25bc1f926808d0070d710e622aa6285fa16c673a65cf3e05f4b32e888c469f1bde8888a7934ee44
-  languageName: node
-  linkType: hard
-
-"@nicolo-ribaudo/eslint-scope-5-internals@npm:5.1.1-v1":
-  version: 5.1.1-v1
-  resolution: "@nicolo-ribaudo/eslint-scope-5-internals@npm:5.1.1-v1"
-  dependencies:
-    eslint-scope: 5.1.1
-  checksum: f2e3b2d6a6e2d9f163ca22105910c9f850dc4897af0aea3ef0a5886b63d8e1ba6505b71c99cb78a3bba24a09557d601eb21c8dede3f3213753fcfef364eb0e57
-  languageName: node
-  linkType: hard
-
-"@nodelib/fs.scandir@npm:2.1.4":
-  version: 2.1.4
-  resolution: "@nodelib/fs.scandir@npm:2.1.4"
-  dependencies:
-    "@nodelib/fs.stat": 2.0.4
-    run-parallel: ^1.1.9
-  checksum: 18c2150ab52a042bd65babe5b70106e6586dc036644131c33d253ff99e5eeef2e65858ab40161530a6f22b512a65e7c7629f0f1e0f35c00ee4c606f960d375ba
-  languageName: node
-  linkType: hard
-
-"@nodelib/fs.scandir@npm:2.1.5":
-  version: 2.1.5
-  resolution: "@nodelib/fs.scandir@npm:2.1.5"
-  dependencies:
-    "@nodelib/fs.stat": 2.0.5
-    run-parallel: ^1.1.9
-  checksum: a970d595bd23c66c880e0ef1817791432dbb7acbb8d44b7e7d0e7a22f4521260d4a83f7f9fd61d44fda4610105577f8f58a60718105fb38352baed612fd79e59
-  languageName: node
-  linkType: hard
-
-"@nodelib/fs.stat@npm:2.0.4, @nodelib/fs.stat@npm:^2.0.2":
-  version: 2.0.4
-  resolution: "@nodelib/fs.stat@npm:2.0.4"
-  checksum: d0d9745f878816d041a8b36faf5797d88ba961274178f0ad1f7fe0efef8118ca9bd0e43e4d0d85a9af911bd35122ec1580e626a83d7595fc4d60f2c1c70e2665
-  languageName: node
-  linkType: hard
-
-"@nodelib/fs.stat@npm:2.0.5":
-  version: 2.0.5
-  resolution: "@nodelib/fs.stat@npm:2.0.5"
-  checksum: 012480b5ca9d97bff9261571dbbec7bbc6033f69cc92908bc1ecfad0792361a5a1994bc48674b9ef76419d056a03efadfce5a6cf6dbc0a36559571a7a483f6f0
-  languageName: node
-  linkType: hard
-
-"@nodelib/fs.walk@npm:^1.2.3":
-  version: 1.2.6
-  resolution: "@nodelib/fs.walk@npm:1.2.6"
-  dependencies:
-    "@nodelib/fs.scandir": 2.1.4
-    fastq: ^1.6.0
-  checksum: d156901823b3d3de368ad68047a964523e0ce5f796c0aa7712443b1f748d8e7fc24ce2c0f18d22a177e1f1c6092bca609ab5e4cb1792c41cdc8a6989bc391139
-  languageName: node
-  linkType: hard
-
-"@nodelib/fs.walk@npm:^1.2.8":
-  version: 1.2.8
-  resolution: "@nodelib/fs.walk@npm:1.2.8"
-  dependencies:
-    "@nodelib/fs.scandir": 2.1.5
-    fastq: ^1.6.0
-  checksum: 190c643f156d8f8f277bf2a6078af1ffde1fd43f498f187c2db24d35b4b4b5785c02c7dc52e356497b9a1b65b13edc996de08de0b961c32844364da02986dc53
-  languageName: node
-  linkType: hard
-
-"@npmcli/fs@npm:^2.1.0":
-  version: 2.1.2
-  resolution: "@npmcli/fs@npm:2.1.2"
-  dependencies:
-    "@gar/promisify": ^1.1.3
-    semver: ^7.3.5
-  checksum: 405074965e72d4c9d728931b64d2d38e6ea12066d4fad651ac253d175e413c06fe4350970c783db0d749181da8fe49c42d3880bd1cbc12cd68e3a7964d820225
-  languageName: node
-  linkType: hard
-
-"@npmcli/move-file@npm:^2.0.0":
-  version: 2.0.1
-  resolution: "@npmcli/move-file@npm:2.0.1"
-  dependencies:
-    mkdirp: ^1.0.4
-    rimraf: ^3.0.2
-  checksum: 52dc02259d98da517fae4cb3a0a3850227bdae4939dda1980b788a7670636ca2b4a01b58df03dd5f65c1e3cb70c50fa8ce5762b582b3f499ec30ee5ce1fd9380
-  languageName: node
-  linkType: hard
-
-"@pkgjs/parseargs@npm:^0.11.0":
-  version: 0.11.0
-  resolution: "@pkgjs/parseargs@npm:0.11.0"
-  checksum: 6ad6a00fc4f2f2cfc6bff76fb1d88b8ee20bc0601e18ebb01b6d4be583733a860239a521a7fbca73b612e66705078809483549d2b18f370eb346c5155c8e4a0f
-  languageName: node
-  linkType: hard
-
-"@popperjs/core@npm:^2.9.0":
-  version: 2.11.8
-  resolution: "@popperjs/core@npm:2.11.8"
-  checksum: e5c69fdebf52a4012f6a1f14817ca8e9599cb1be73dd1387e1785e2ed5e5f0862ff817f420a87c7fc532add1f88a12e25aeb010ffcbdc98eace3d55ce2139cf0
-  languageName: node
-  linkType: hard
-
-"@prettier/eslint@npm:prettier-eslint@^15.0.1":
-  version: 15.0.1
-  resolution: "prettier-eslint@npm:15.0.1"
-  dependencies:
-    "@types/eslint": ^8.4.2
-    "@types/prettier": ^2.6.0
-    "@typescript-eslint/parser": ^5.10.0
-    common-tags: ^1.4.0
-    dlv: ^1.1.0
-    eslint: ^8.7.0
-    indent-string: ^4.0.0
-    lodash.merge: ^4.6.0
-    loglevel-colored-level-prefix: ^1.0.0
-    prettier: ^2.5.1
-    pretty-format: ^23.0.1
-    require-relative: ^0.8.7
-    typescript: ^4.5.4
-    vue-eslint-parser: ^8.0.1
-  checksum: fad92d666ab92f6c773faf507ee15f2c0de8c8ac2b692a57a7c0621202f90d9e577f2664d8a701ec3b96bec3ecba586e49c3d9170de9392c0ee7c3362fdddcae
-  languageName: node
-  linkType: hard
-
-"@rollup/plugin-replace@npm:2.3.0":
-  version: 2.3.0
-  resolution: "@rollup/plugin-replace@npm:2.3.0"
-  dependencies:
-    magic-string: ^0.25.2
-    rollup-pluginutils: ^2.6.0
-  peerDependencies:
-    rollup: ^1.20.0
-  checksum: 561e483398d15f594ebc87fda2760a5528da9abfa1fe1c3865280e18201fafb4e60587dc38e8b7781b15db10acc39da5f6ec700ac129fc931d31c060b304b96b
-  languageName: node
-  linkType: hard
-
-"@scalvert/ember-setup-middleware-reporter@npm:^0.1.1":
-  version: 0.1.1
-  resolution: "@scalvert/ember-setup-middleware-reporter@npm:0.1.1"
-  dependencies:
-    "@types/fs-extra": ^9.0.12
-    body-parser: ^1.19.0
-    errorhandler: ^1.5.1
-    fs-extra: ^10.0.0
-  checksum: 4015fc0ede7d72a2a8a5e334c63fb7f570c89d2f53d45cdb453dd85e3de48734a5d083b4cf0cadf70a3b5e71ee7aca020b45d5798e8a6334db1f72aa7ab72cb4
-  languageName: node
-  linkType: hard
-
-"@simple-dom/interface@npm:^1.4.0":
-  version: 1.4.0
-  resolution: "@simple-dom/interface@npm:1.4.0"
-  checksum: e0ce8b6174208c5a369c2650094d16080230bf90cb95cc8258f9fd6b93be8afedbffb9d63da7f1d295a4e8d901f5fff907a69e1d55556db9e8544f2615b2f1d7
-  languageName: node
-  linkType: hard
-
-"@sinonjs/commons@npm:^1, @sinonjs/commons@npm:^1.3.0, @sinonjs/commons@npm:^1.4.0, @sinonjs/commons@npm:^1.7.0":
-  version: 1.8.3
-  resolution: "@sinonjs/commons@npm:1.8.3"
-  dependencies:
-    type-detect: 4.0.8
-  checksum: 6159726db5ce6bf9f2297f8427f7ca5b3dff45b31e5cee23496f1fa6ef0bb4eab878b23fb2c5e6446381f6a66aba4968ef2fc255c1180d753d4b8c271636a2e5
-  languageName: node
-  linkType: hard
-
-"@sinonjs/formatio@npm:^3.2.1":
-  version: 3.2.2
-  resolution: "@sinonjs/formatio@npm:3.2.2"
-  dependencies:
-    "@sinonjs/commons": ^1
-    "@sinonjs/samsam": ^3.1.0
-  checksum: ddc30698df9b0aa59204da93ca94fd04bc5672ac03c798c0a487c35d514d7d8e0ce0e4c72386fc80e29f59cb1cc54eeea3b7f804281b3c4e3dd2394de56c6e4a
-  languageName: node
-  linkType: hard
-
-"@sinonjs/samsam@npm:^3.1.0, @sinonjs/samsam@npm:^3.3.3":
-  version: 3.3.3
-  resolution: "@sinonjs/samsam@npm:3.3.3"
-  dependencies:
-    "@sinonjs/commons": ^1.3.0
-    array-from: ^2.1.1
-    lodash: ^4.17.15
-  checksum: 340f2f62dec3fa1e5e9300a75996bd12ab9d2da4f6b453fa5d1ee101cc5e58eb218af2e2584b496d41ba31c3c0854d47a691fd9a0d8b9092f3cb6a5c7a080856
-  languageName: node
-  linkType: hard
-
-"@sinonjs/text-encoding@npm:^0.7.1":
-  version: 0.7.1
-  resolution: "@sinonjs/text-encoding@npm:0.7.1"
-  checksum: 130de0bb568c5f8a611ec21d1a4e3f80ab0c5ec333010f49cfc1adc5cba6d8808699c8a587a46b0f0b016a1f4c1389bc96141e773e8460fcbb441875b2e91ba7
-  languageName: node
-  linkType: hard
-
-"@socket.io/component-emitter@npm:~3.1.0":
-  version: 3.1.0
-  resolution: "@socket.io/component-emitter@npm:3.1.0"
-  checksum: db069d95425b419de1514dffe945cc439795f6a8ef5b9465715acf5b8b50798e2c91b8719cbf5434b3fe7de179d6cdcd503c277b7871cb3dd03febb69bdd50fa
-  languageName: node
-  linkType: hard
-
-"@textlint/ast-node-types@npm:^12.1.1":
-  version: 12.1.1
-  resolution: "@textlint/ast-node-types@npm:12.1.1"
-  checksum: 6ccae9ac7f43cb172142098a3764c490feea311a741aa3fe981d6d3a1e06041d179e690b54b920dcaa067453f3220d46e6935728e4c9d72233f735f27410e86f
-  languageName: node
-  linkType: hard
-
-"@textlint/markdown-to-ast@npm:^12.1.1":
-  version: 12.1.1
-  resolution: "@textlint/markdown-to-ast@npm:12.1.1"
-  dependencies:
-    "@textlint/ast-node-types": ^12.1.1
-    debug: ^4.3.3
-    remark-footnotes: ^3.0.0
-    remark-frontmatter: ^3.0.0
-    remark-gfm: ^1.0.0
-    remark-parse: ^9.0.0
-    traverse: ^0.6.6
-    unified: ^9.2.2
-  checksum: c857a9e3b26fd96486cf96914c15c20d68d7d1b2f201295a75acec1ccc14725a54d76e9f9311170f56dd43a1666ac3a69b85f7e794af915bc6e23953cd5921a9
-  languageName: node
-  linkType: hard
-
-"@tootallnate/once@npm:2":
-  version: 2.0.0
-  resolution: "@tootallnate/once@npm:2.0.0"
-  checksum: ad87447820dd3f24825d2d947ebc03072b20a42bfc96cbafec16bff8bbda6c1a81fcb0be56d5b21968560c5359a0af4038a68ba150c3e1694fe4c109a063bed8
-  languageName: node
-  linkType: hard
-
-"@tsconfig/ember@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "@tsconfig/ember@npm:2.0.0"
-  checksum: 03ec9113bb454c61b1f06b843f14d53526f2e0cc111b347bc18bdb6dba2de40429e2b34baa66a408e6b7af3ebbb8d75cf1cb8ede948b329f18abb87016d11678
-  languageName: node
-  linkType: hard
-
-"@types/acorn@npm:^4.0.3":
-  version: 4.0.5
-  resolution: "@types/acorn@npm:4.0.5"
-  dependencies:
-    "@types/estree": "*"
-  checksum: 2079630adff1224120ac40c2f503fe602582d9d84f732a32550c7bbd0c87741a88bc5bc4cdba7888211d04bfa9fcb09c7c211889aa6c15ddb0150a30a36955ae
-  languageName: node
-  linkType: hard
-
-"@types/body-parser@npm:*":
-  version: 1.19.0
-  resolution: "@types/body-parser@npm:1.19.0"
-  dependencies:
-    "@types/connect": "*"
-    "@types/node": "*"
-  checksum: 15043566f1909e2a08dabb0a5d2642f8988545a1369bc5995fc40ee90c95200da2aa66f9240fcb19fc6af6ff4e27ff453f311b49363c14bb308c308c0751ca9b
-  languageName: node
-  linkType: hard
-
-"@types/broccoli-plugin@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "@types/broccoli-plugin@npm:3.0.0"
-  dependencies:
-    broccoli-plugin: "*"
-  checksum: c5daf3b3ff689a00fa18c90c08e2998c373b7ee11235fcd63ad5ad03ff5d9b844f2b84fca966682490853a443714db4d2f0b389208478a0c1d4e7666f85ca04f
-  languageName: node
-  linkType: hard
-
-"@types/chai-as-promised@npm:^7.1.2":
-  version: 7.1.3
-  resolution: "@types/chai-as-promised@npm:7.1.3"
-  dependencies:
-    "@types/chai": "*"
-  checksum: cf0232eb7bc450fc37c8f4688c91ef86528fb994f67036480cba4679299a99ad65a3a2dcaf34c748b30c0cf9f392761f11cee2a9f5c8e26d9ca07ae934aa4465
-  languageName: node
-  linkType: hard
-
-"@types/chai@npm:*, @types/chai@npm:^4.2.9":
-  version: 4.2.17
-  resolution: "@types/chai@npm:4.2.17"
-  checksum: a5657eea35d797d494cca1b479499ff129a051c7a74e4cbeb2a0660d9a263541c24f4bda9d827f806f36f90e0b46038069bad3eac7559c40f59f212ff09696f0
-  languageName: node
-  linkType: hard
-
-"@types/connect@npm:*":
-  version: 3.4.34
-  resolution: "@types/connect@npm:3.4.34"
-  dependencies:
-    "@types/node": "*"
-  checksum: c6e2aa299cf3979c00602f48ce9163700f0cbfec6ba2a8e1506d08f51da0279805a478ea094252fad7c369a563ee033b359c708ab34b1763397c58d7e2df07ad
-  languageName: node
-  linkType: hard
-
-"@types/cookie@npm:^0.4.1":
-  version: 0.4.1
-  resolution: "@types/cookie@npm:0.4.1"
-  checksum: 3275534ed69a76c68eb1a77d547d75f99fedc80befb75a3d1d03662fb08d697e6f8b1274e12af1a74c6896071b11510631ba891f64d30c78528d0ec45a9c1a18
-  languageName: node
-  linkType: hard
-
-"@types/cors@npm:^2.8.12":
-  version: 2.8.12
-  resolution: "@types/cors@npm:2.8.12"
-  checksum: 8c45f112c7d1d2d831b4b266f2e6ed33a1887a35dcbfe2a18b28370751fababb7cd045e745ef84a523c33a25932678097bf79afaa367c6cb3fa0daa7a6438257
-  languageName: node
-  linkType: hard
-
-"@types/ember-data@npm:*, @types/ember-data@npm:^4.4.6":
-  version: 4.4.6
-  resolution: "@types/ember-data@npm:4.4.6"
-  dependencies:
-    "@types/ember": "*"
-    "@types/ember__error": "*"
-    "@types/ember__object": "*"
-    "@types/rsvp": "*"
-  checksum: 641f43f5c82aab651ef00555ffe07cdf8c1e0ac581ade582479e48b3e89a258efbf083391b20b723c239eadac0418b1eb4c3ce14ec9a61477ac33f758379fae7
-  languageName: node
-  linkType: hard
-
-"@types/ember-data__adapter@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "@types/ember-data__adapter@npm:4.0.1"
-  dependencies:
-    "@types/ember-data": "*"
-  checksum: 5636fc85c2b7496d608af5494d1c6b82a3bf7f0d88f9037824bf203b0e4e167805544eebef63e019991a5a388e567851b211a041f4b3d12ddb1881748e5a65a9
-  languageName: node
-  linkType: hard
-
-"@types/ember-data__model@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "@types/ember-data__model@npm:4.0.0"
-  dependencies:
-    "@types/ember-data": "*"
-  checksum: 6a46583608af66018c9ce88d2d3cbe21f5526f479f9a442d3d3a0ab69f282437b8478fbcca4bafa9236c9e5cbc4ffe7ddadd2e1a6a81d6b58ebe553011970485
-  languageName: node
-  linkType: hard
-
-"@types/ember-data__serializer@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "@types/ember-data__serializer@npm:4.0.1"
-  dependencies:
-    "@types/ember-data": "*"
-  checksum: e2e14b8c99a3d33bff69aee1bdaf1b90fc5e87482fc49a22f4ff0aa9892494a0f8c72231ac600e8686d77598579c524587319f76520ce59b8a9ac3895a1de1e3
-  languageName: node
-  linkType: hard
-
-"@types/ember-data__store@npm:^4.0.2":
-  version: 4.0.2
-  resolution: "@types/ember-data__store@npm:4.0.2"
-  dependencies:
-    "@types/ember-data": "*"
-  checksum: 7b1ac271ab4fc327d495fd2abe32f780660c4daa5b2e3f720d61776dd235b7f9b8ea46d1b9b523f14975e0e2c7d3aa13990cd116a13440c8f43fa9e389393337
-  languageName: node
-  linkType: hard
-
-"@types/ember-qunit@npm:^5.0.2":
-  version: 5.0.2
-  resolution: "@types/ember-qunit@npm:5.0.2"
-  dependencies:
-    "@types/ember-resolver": "*"
-    "@types/ember__test": "*"
-    "@types/ember__test-helpers": "*"
-    "@types/qunit": "*"
-  checksum: f7c6e9e5721e0708e7290e68e2f14b55baa4dd5d27fd3bb760dc380e92aa03d3b7b93da090d40e34d47d85e6d4451a73e7a7f4398708047164bb10e46da60ad2
-  languageName: node
-  linkType: hard
-
-"@types/ember-resolver@npm:*, @types/ember-resolver@npm:^5.0.13":
-  version: 5.0.13
-  resolution: "@types/ember-resolver@npm:5.0.13"
-  dependencies:
-    "@types/ember__object": "*"
-    "@types/ember__owner": "*"
-  checksum: 3ece114d8368768d8198e3156b2df51b4be9d4f9ab8d60f2a1cb63a301b48ec485f51f5ddc8ad9b6f4d3739d252107463ff2508bec559efb7d8593e4975e3f48
-  languageName: node
-  linkType: hard
-
-"@types/ember@npm:*, @types/ember@npm:^4.0.2":
-  version: 4.0.2
-  resolution: "@types/ember@npm:4.0.2"
-  dependencies:
-    "@types/ember__application": "*"
-    "@types/ember__array": "*"
-    "@types/ember__component": "*"
-    "@types/ember__controller": "*"
-    "@types/ember__debug": "*"
-    "@types/ember__engine": "*"
-    "@types/ember__error": "*"
-    "@types/ember__object": "*"
-    "@types/ember__polyfills": "*"
-    "@types/ember__routing": "*"
-    "@types/ember__runloop": "*"
-    "@types/ember__service": "*"
-    "@types/ember__string": "*"
-    "@types/ember__template": "*"
-    "@types/ember__test": "*"
-    "@types/ember__utils": "*"
-    "@types/htmlbars-inline-precompile": "*"
-    "@types/rsvp": "*"
-  checksum: 94d3dfba4209ae66119bd1d1bd3aa00c04184d23393c1cffcaf325d984a9ddc0928956be48061d9ce4a6ab0ff371e917f0313b202aeda74c098a1528e6b8c741
-  languageName: node
-  linkType: hard
-
-"@types/ember__application@npm:*, @types/ember__application@npm:^4.0.4":
-  version: 4.0.4
-  resolution: "@types/ember__application@npm:4.0.4"
-  dependencies:
-    "@glimmer/component": ^1.1.0
-    "@types/ember": "*"
-    "@types/ember__application": "*"
-    "@types/ember__engine": "*"
-    "@types/ember__object": "*"
-    "@types/ember__owner": "*"
-    "@types/ember__routing": "*"
-  checksum: 4d5bd9793409d2814d1a068a1a9ee0db8036efb6975266703f5fcd5da21e4194602585e2343567f9f5dff47649a28e4174c7e6eb446f6285e80a2237344c391a
-  languageName: node
-  linkType: hard
-
-"@types/ember__array@npm:*, @types/ember__array@npm:^4.0.3":
-  version: 4.0.3
-  resolution: "@types/ember__array@npm:4.0.3"
-  dependencies:
-    "@types/ember": "*"
-    "@types/ember__array": "*"
-    "@types/ember__object": "*"
-  checksum: 682104300933d306be946d0d86821469800b9849a51b745b35872d3958dc9d0f6f7d1bd2e5da6d5c26bd0c3184639f94d7bde274a16bb8a6c58cef08ddb8a0a6
-  languageName: node
-  linkType: hard
-
-"@types/ember__component@npm:*, @types/ember__component@npm:^4.0.11":
-  version: 4.0.11
-  resolution: "@types/ember__component@npm:4.0.11"
-  dependencies:
-    "@types/ember": "*"
-    "@types/ember__component": "*"
-    "@types/ember__object": "*"
-  checksum: 8b3a012ab6915f43e5d756883e1a05e5a75514d03e4666702bbfeebe1dfab9d0cebbd377ff38908d097bed977ed5a4c4d0fb709d7f657d31386c1f80bbc6d51c
-  languageName: node
-  linkType: hard
-
-"@types/ember__controller@npm:*, @types/ember__controller@npm:^4.0.3":
-  version: 4.0.3
-  resolution: "@types/ember__controller@npm:4.0.3"
-  dependencies:
-    "@types/ember__object": "*"
-  checksum: 1648b656f4a0cc10a28351d893fa765234bf0d8ab123afe75ba2259b31296840ae00da0328bed19241bfa66c0a59a6d237041493440008cd0a8daf9ef8fd1fa3
-  languageName: node
-  linkType: hard
-
-"@types/ember__debug@npm:*, @types/ember__debug@npm:^4.0.3":
-  version: 4.0.3
-  resolution: "@types/ember__debug@npm:4.0.3"
-  dependencies:
-    "@types/ember__debug": "*"
-    "@types/ember__object": "*"
-    "@types/ember__owner": "*"
-  checksum: 69a31777a6ba3dba0c8733b59e06e3f5eae0350cf9665421fd7adf23b8d9e43abfdc423d615b9ac91a4208c804e59c5d5f2b3000a7ed957bb9114a381536009c
-  languageName: node
-  linkType: hard
-
-"@types/ember__destroyable@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "@types/ember__destroyable@npm:4.0.1"
-  checksum: 5cd5f22cc9f76a841a11f805444af9717d964fe72ad7020cbc211a359b9e4a0447ef08aa3b9fb7b4caed593f7aebb4025bc77338afd3fe5e55a5ae20ca6be948
-  languageName: node
-  linkType: hard
-
-"@types/ember__engine@npm:*, @types/ember__engine@npm:^4.0.4":
-  version: 4.0.4
-  resolution: "@types/ember__engine@npm:4.0.4"
-  dependencies:
-    "@types/ember__engine": "*"
-    "@types/ember__object": "*"
-    "@types/ember__owner": "*"
-  checksum: 1b387a89206263ba26dfc0cc6417e8a3aecbb12af3d16522eeb09c78273da12851c5fca614099070920ec17c51ff50ba31e487d73259ab5673d143956b97d35a
-  languageName: node
-  linkType: hard
-
-"@types/ember__error@npm:*, @types/ember__error@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "@types/ember__error@npm:4.0.1"
-  checksum: b4cd081d0efe57c584fb031c8d2b26b16c1e79e4bd115f289a0db438a134ae6a787d03dbc13fe0d80eec5a87942053e5f4d663a9a86006862a4b131f5a0ffd8e
-  languageName: node
-  linkType: hard
-
-"@types/ember__object@npm:*, @types/ember__object@npm:^4.0.5":
-  version: 4.0.5
-  resolution: "@types/ember__object@npm:4.0.5"
-  dependencies:
-    "@types/ember": "*"
-    "@types/ember__object": "*"
-    "@types/rsvp": "*"
-  checksum: 445b5eef70f37c9f06da284742758e4626a3421c1f2e425bdbc7c9952cff14d8ce539f93d1c83b2836f043d4f10c20524a0ca1c7d58dee5db8f68893c1fd9c1e
-  languageName: node
-  linkType: hard
-
-"@types/ember__owner@npm:*":
-  version: 4.0.2
-  resolution: "@types/ember__owner@npm:4.0.2"
-  checksum: fca38292256a423851231805b07f150a17ff7ab2cf74533507c016d85180d229fe75999bf8c138276c272a8ff74364a88bf77ae6ff322dc16c05598e7d71dcd9
-  languageName: node
-  linkType: hard
-
-"@types/ember__polyfills@npm:*, @types/ember__polyfills@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "@types/ember__polyfills@npm:4.0.1"
-  checksum: a2b6ed3b0637fdeb6d4c93a3a1d5b7902e57124c860bf9bf82f1ea4148264991b8f0311ea6a8a50f5b243804f93650fc2a5f97a53192e0687213b41a5499e4be
-  languageName: node
-  linkType: hard
-
-"@types/ember__routing@npm:*, @types/ember__routing@npm:^4.0.12":
-  version: 4.0.12
-  resolution: "@types/ember__routing@npm:4.0.12"
-  dependencies:
-    "@types/ember": "*"
-    "@types/ember__controller": "*"
-    "@types/ember__object": "*"
-    "@types/ember__routing": "*"
-    "@types/ember__service": "*"
-  checksum: 8c14b6de35c9b370175dc342610729dba51b315a09f538ca5ad4e95d15ae0938efec8a6fd5675b862f2ca95da46528160896a417040654c621c8dbca34d8185b
-  languageName: node
-  linkType: hard
-
-"@types/ember__runloop@npm:*, @types/ember__runloop@npm:^4.0.2":
-  version: 4.0.2
-  resolution: "@types/ember__runloop@npm:4.0.2"
-  dependencies:
-    "@types/ember": "*"
-    "@types/ember__runloop": "*"
-  checksum: c207b35187d082be1330836dd120886ca86e14b029c7d89451fe4340ca4c500264f03a42558de62aa08e3e5743f7ac8aef84b668316d8f5db031eed109267aae
-  languageName: node
-  linkType: hard
-
-"@types/ember__service@npm:*, @types/ember__service@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "@types/ember__service@npm:4.0.1"
-  dependencies:
-    "@types/ember__object": "*"
-  checksum: f4b8c161e13148d6fa3930a4fcd80e454aad1bb2688ec2c2da6cbb9b6e20a8c3b78308dfa10cb4ec5c42696ca77930d7133093d3c2cf8f41c883d456e2d444cf
-  languageName: node
-  linkType: hard
-
-"@types/ember__string@npm:*, @types/ember__string@npm:^3.0.10":
-  version: 3.0.10
-  resolution: "@types/ember__string@npm:3.0.10"
-  checksum: 1ff40f641efbd91fc65da9d1cd8206b5ff3a7627fbbe5d00e00ba4ff116eee1863cff5d556e616d4896f5dd6fd4ae3d7f7191f8c726bdac44a568bd4fec4164f
-  languageName: node
-  linkType: hard
-
-"@types/ember__template@npm:*, @types/ember__template@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "@types/ember__template@npm:4.0.1"
-  checksum: 55c1bdccc1f11d428795da20832a1e52d76139af0a2378eb2ac6c18cf2406cd0b80007de4eafa5934a5b61cdf5979d9ad3e3ce27586b5908099e7535462d0b40
-  languageName: node
-  linkType: hard
-
-"@types/ember__test-helpers@npm:*, @types/ember__test-helpers@npm:^2.8.2":
-  version: 2.8.2
-  resolution: "@types/ember__test-helpers@npm:2.8.2"
-  dependencies:
-    "@types/ember-resolver": "*"
-    "@types/ember__application": "*"
-    "@types/ember__error": "*"
-    "@types/ember__owner": "*"
-    "@types/ember__test-helpers": "*"
-    "@types/htmlbars-inline-precompile": "*"
-  checksum: 8f89692d1808133b98e225b48ca5e3d94a781d539f092529f18ff525f898e914b3de6393fe7ed97567b5a04ca1fea6325325fd3e54a03b97c14c9ae4e8ee033b
-  languageName: node
-  linkType: hard
-
-"@types/ember__test@npm:*, @types/ember__test@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "@types/ember__test@npm:4.0.1"
-  dependencies:
-    "@types/ember__application": "*"
-  checksum: e303ed97b0d63e9b2c91c8b7bd2445b8c013e485f458f0122c8a961593dafdc9428ffc055f51527032c970c2591094600f00233cda894e1775bc671bde67c570
-  languageName: node
-  linkType: hard
-
-"@types/ember__utils@npm:*, @types/ember__utils@npm:^4.0.2":
-  version: 4.0.2
-  resolution: "@types/ember__utils@npm:4.0.2"
-  dependencies:
-    "@types/ember": "*"
-  checksum: 8fc60ec9a902211502f33bba4c7cb774838f96fa21cfc798d42b8801f3654059eab96bae8b7fcb7ac60eb499363b263a97daf987bfd9f07feaf973046d1d39df
-  languageName: node
-  linkType: hard
-
-"@types/eslint-scope@npm:^3.7.3":
-  version: 3.7.3
-  resolution: "@types/eslint-scope@npm:3.7.3"
-  dependencies:
-    "@types/eslint": "*"
-    "@types/estree": "*"
-  checksum: 6772b05e1b92003d1f295e81bc847a61f4fbe8ddab77ffa49e84ed3f9552513bdde677eb53ef167753901282857dd1d604d9f82eddb34a233495932b2dc3dc17
-  languageName: node
-  linkType: hard
-
-"@types/eslint@npm:*":
-  version: 8.4.3
-  resolution: "@types/eslint@npm:8.4.3"
-  dependencies:
-    "@types/estree": "*"
-    "@types/json-schema": "*"
-  checksum: cc199be84e22754cc625b171c90852da2b563088d32f4161d310b70470eab47f9bc812774c61eab6530083a214fe634abc32d06ef38e0a5e29f68436331cfabb
-  languageName: node
-  linkType: hard
-
-"@types/eslint@npm:^7.2.13":
-  version: 7.29.0
-  resolution: "@types/eslint@npm:7.29.0"
-  dependencies:
-    "@types/estree": "*"
-    "@types/json-schema": "*"
-  checksum: df13991c554954353ce8f3bb03e19da6cc71916889443d68d178d4f858b561ba4cc4a4f291c6eb9eebb7f864b12b9b9313051b3a8dfea3e513dadf3188a77bdf
-  languageName: node
-  linkType: hard
-
-"@types/eslint@npm:^8.4.2":
-  version: 8.4.10
-  resolution: "@types/eslint@npm:8.4.10"
-  dependencies:
-    "@types/estree": "*"
-    "@types/json-schema": "*"
-  checksum: 21e009ed9ed9bc8920fdafc6e11ff321c4538b4cc18a56fdd59dc5184ea7bbf363c71638c9bdb59fc1254dddcdd567485136ed68b0ee4750948d4e32cb79c689
-  languageName: node
-  linkType: hard
-
-"@types/estree@npm:*":
-  version: 0.0.47
-  resolution: "@types/estree@npm:0.0.47"
-  checksum: aed5c940436250c25c5e140aa19e7199ba3452e72e1aecc515621507df9e5ed5076ddba84a1684c36d62be841ff3e2bafce8793f16fe6f69d10884449d4461e7
-  languageName: node
-  linkType: hard
-
-"@types/estree@npm:^0.0.51":
-  version: 0.0.51
-  resolution: "@types/estree@npm:0.0.51"
-  checksum: e56a3bcf759fd9185e992e7fdb3c6a5f81e8ff120e871641607581fb3728d16c811702a7d40fa5f869b7f7b4437ab6a87eb8d98ffafeee51e85bbe955932a189
-  languageName: node
-  linkType: hard
-
-"@types/express-serve-static-core@npm:*":
-  version: 4.17.30
-  resolution: "@types/express-serve-static-core@npm:4.17.30"
-  dependencies:
-    "@types/node": "*"
-    "@types/qs": "*"
-    "@types/range-parser": "*"
-  checksum: c40d9027884ab9e97fa29d9d41d1b75a5966109312e26594cf03c61b278b5bf8e095f53589e47899b34a2e224291a44043617695c3e8bd22284f988e48582ee6
-  languageName: node
-  linkType: hard
-
-"@types/express@npm:^4.17.2":
-  version: 4.17.2
-  resolution: "@types/express@npm:4.17.2"
-  dependencies:
-    "@types/body-parser": "*"
-    "@types/express-serve-static-core": "*"
-    "@types/serve-static": "*"
-  checksum: db8e85f84f040014a35b10f3f2e1d39b0f7b16c46cbe012ff2fa7eea7d49bc2a90e81ab81f052fd76f1790c02bf3f940571c406106d29f278f3259486ecc9ee9
-  languageName: node
-  linkType: hard
-
-"@types/fs-extra@npm:^5.0.5":
-  version: 5.1.0
-  resolution: "@types/fs-extra@npm:5.1.0"
-  dependencies:
-    "@types/node": "*"
-  checksum: 9b4abc891ad0dc3baa77b0ebcf91dff8e7a5936aa037de0bd6ded399ab38b5896be1ee02b5c0a18c0915cfc40ab590a915709e6f2beef8f6f7e16fd3759e469a
-  languageName: node
-  linkType: hard
-
-"@types/fs-extra@npm:^8.1.0":
-  version: 8.1.1
-  resolution: "@types/fs-extra@npm:8.1.1"
-  dependencies:
-    "@types/node": "*"
-  checksum: d7d564b84b86e51241984c9bec16f683056d45510e2c63e1bfe9282026685bd14e5ca406ee809453f1e2fd8c9aa76c5712a3019492eb946dd46de327ccb0e1b1
-  languageName: node
-  linkType: hard
-
-"@types/fs-extra@npm:^9.0.12":
-  version: 9.0.13
-  resolution: "@types/fs-extra@npm:9.0.13"
-  dependencies:
-    "@types/node": "*"
-  checksum: add79e212acd5ac76b97b9045834e03a7996aef60a814185e0459088fd290519a3c1620865d588fa36c4498bf614210d2a703af5cf80aa1dbc125db78f6edac3
-  languageName: node
-  linkType: hard
-
-"@types/glob@npm:*":
-  version: 7.2.0
-  resolution: "@types/glob@npm:7.2.0"
-  dependencies:
-    "@types/minimatch": "*"
-    "@types/node": "*"
-  checksum: 6ae717fedfdfdad25f3d5a568323926c64f52ef35897bcac8aca8e19bc50c0bd84630bbd063e5d52078b2137d8e7d3c26eabebd1a2f03ff350fff8a91e79fc19
-  languageName: node
-  linkType: hard
-
-"@types/glob@npm:^7.1.1":
-  version: 7.1.3
-  resolution: "@types/glob@npm:7.1.3"
-  dependencies:
-    "@types/minimatch": "*"
-    "@types/node": "*"
-  checksum: e0eef12285f548f15d887145590594a04ccce7f7e645fb047cbac18cb093f25d507ffbcc725312294c224bb78cf980fce33e5807de8d6f8a868b4186253499d4
-  languageName: node
-  linkType: hard
-
-"@types/htmlbars-inline-precompile@npm:*":
-  version: 3.0.0
-  resolution: "@types/htmlbars-inline-precompile@npm:3.0.0"
-  checksum: dd7b1f0a0f9ec560c521673c436329e9edb0197b382520179008b11afe38c3d7a129dc91f303ca0509852f9e081a353b9f9aee9d7043529d70c439aafb7f9a2c
-  languageName: node
-  linkType: hard
-
-"@types/json-schema@npm:*, @types/json-schema@npm:^7.0.5":
-  version: 7.0.9
-  resolution: "@types/json-schema@npm:7.0.9"
-  checksum: 259d0e25f11a21ba5c708f7ea47196bd396e379fddb79c76f9f4f62c945879dc21657904914313ec2754e443c5018ea8372362f323f30e0792897fdb2098a705
-  languageName: node
-  linkType: hard
-
-"@types/json-schema@npm:^7.0.8, @types/json-schema@npm:^7.0.9":
-  version: 7.0.11
-  resolution: "@types/json-schema@npm:7.0.11"
-  checksum: 527bddfe62db9012fccd7627794bd4c71beb77601861055d87e3ee464f2217c85fca7a4b56ae677478367bbd248dbde13553312b7d4dbc702a2f2bbf60c4018d
-  languageName: node
-  linkType: hard
-
-"@types/mdast@npm:^3.0.0":
-  version: 3.0.10
-  resolution: "@types/mdast@npm:3.0.10"
-  dependencies:
-    "@types/unist": "*"
-  checksum: 3f587bfc0a9a2403ecadc220e61031b01734fedaf82e27eb4d5ba039c0eb54db8c85681ccc070ab4df3f7ec711b736a82b990e69caa14c74bf7ac0ccf2ac7313
-  languageName: node
-  linkType: hard
-
-"@types/mime@npm:^1":
-  version: 1.3.2
-  resolution: "@types/mime@npm:1.3.2"
-  checksum: 0493368244cced1a69cb791b485a260a422e6fcc857782e1178d1e6f219f1b161793e9f87f5fae1b219af0f50bee24fcbe733a18b4be8fdd07a38a8fb91146fd
-  languageName: node
-  linkType: hard
-
-"@types/minimatch@npm:*, @types/minimatch@npm:^3.0.3, @types/minimatch@npm:^3.0.4":
-  version: 3.0.5
-  resolution: "@types/minimatch@npm:3.0.5"
-  checksum: c41d136f67231c3131cf1d4ca0b06687f4a322918a3a5adddc87ce90ed9dbd175a3610adee36b106ae68c0b92c637c35e02b58c8a56c424f71d30993ea220b92
-  languageName: node
-  linkType: hard
-
-"@types/minimist@npm:^1.2.2":
-  version: 1.2.2
-  resolution: "@types/minimist@npm:1.2.2"
-  checksum: b8da83c66eb4aac0440e64674b19564d9d86c80ae273144db9681e5eeff66f238ade9515f5006ffbfa955ceff8b89ad2bd8ec577d7caee74ba101431fb07045d
-  languageName: node
-  linkType: hard
-
-"@types/node@npm:*":
-  version: 16.11.11
-  resolution: "@types/node@npm:16.11.11"
-  checksum: 1c472bd63f23ca0e4effc96e6e0c693b83b027f613a1f41b6d1bd7791f65ce171a351e0a5c92575cb59e84ad0a930875397bfbbb91a7c925ddbbb558f7461af8
-  languageName: node
-  linkType: hard
-
-"@types/node@npm:>=10.0.0":
-  version: 18.7.16
-  resolution: "@types/node@npm:18.7.16"
-  checksum: 01a3d35c764a3f0e7370b56e1ad4203731131883c65784e020009014171b3f53c4649cde6c7aa4f1026b907ee87ef6ae6ece2bc518151dc7b81100fe8b1db3ad
-  languageName: node
-  linkType: hard
-
-"@types/node@npm:^9.6.0":
-  version: 9.6.61
-  resolution: "@types/node@npm:9.6.61"
-  checksum: c8caed1010c5eb94697024606a5cbcb9905251166daed6ec1b47d3c70a57435aba72547adf347b8d17785df89dbfc0ac20e63b9f807bc44cc0e11a3705ae5a91
-  languageName: node
-  linkType: hard
-
-"@types/normalize-package-data@npm:^2.4.0":
-  version: 2.4.1
-  resolution: "@types/normalize-package-data@npm:2.4.1"
-  checksum: e87bccbf11f95035c89a132b52b79ce69a1e3652fe55962363063c9c0dae0fe2477ebc585e03a9652adc6f381d24ba5589cc5e51849df4ced3d3e004a7d40ed5
-  languageName: node
-  linkType: hard
-
-"@types/parse-json@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "@types/parse-json@npm:4.0.0"
-  checksum: fd6bce2b674b6efc3db4c7c3d336bd70c90838e8439de639b909ce22f3720d21344f52427f1d9e57b265fcb7f6c018699b99e5e0c208a1a4823014269a6bf35b
-  languageName: node
-  linkType: hard
-
-"@types/prettier@npm:^2.6.0":
-  version: 2.7.1
-  resolution: "@types/prettier@npm:2.7.1"
-  checksum: 5e3f58e229d6c73b5f5cae2e8f96c1c4a5b5805f83459e17a045ba8e96152b1d38e86b63e3172fb159dac923388699660862b75b2d37e54220805f0e691e26f1
-  languageName: node
-  linkType: hard
-
-"@types/q@npm:^1.5.1":
-  version: 1.5.4
-  resolution: "@types/q@npm:1.5.4"
-  checksum: 0842d7d71b5f102dcc2d78f893d0b42c1149f8cdc194d09e7a00be3187999ee3041e535357344818f8fee1b5e216b06bb7df7754d0fe08bd8aca38d3c45f1af6
-  languageName: node
-  linkType: hard
-
-"@types/qs@npm:*":
-  version: 6.9.6
-  resolution: "@types/qs@npm:6.9.6"
-  checksum: 01871b1cf7062717ec76fcb9b29ddae1e04fcfadc1c76d86ec2571e72f27bf09ff31b094b295be8d4ca664aeec9b8965563680b31fcab7aba1ed93afac5181cd
-  languageName: node
-  linkType: hard
-
-"@types/qunit@npm:*":
-  version: 2.19.3
-  resolution: "@types/qunit@npm:2.19.3"
-  checksum: bbcea1082a2827f81ddb43f53abf6e6698cb690fa5a1cd59649eee5e9ecf0fe04fae7fb2aaf3015681ac8036f251f4d268819a4935ec5b38832056957ccfb265
-  languageName: node
-  linkType: hard
-
-"@types/qunit@npm:^2.19.4":
-  version: 2.19.10
-  resolution: "@types/qunit@npm:2.19.10"
-  checksum: 039d53d6397361da440616215202b42d4595d22ee9907c96d3ab9c10d01b78d5efaaf788f2d3d7e36f80bc8d3a3bc78e8d169861efad501d64c0d1c287bcfa6e
-  languageName: node
-  linkType: hard
-
-"@types/range-parser@npm:*":
-  version: 1.2.3
-  resolution: "@types/range-parser@npm:1.2.3"
-  checksum: a0a4218214d2c599e2128a8965e9183d1f0b8fc614def43a2183cf80534d10fcf86357c823c7907e779df0ab048fd1fa3818b4c8f0f6f99ba150a3f99df7d03d
-  languageName: node
-  linkType: hard
-
-"@types/rimraf@npm:^2.0.2":
-  version: 2.0.5
-  resolution: "@types/rimraf@npm:2.0.5"
-  dependencies:
-    "@types/glob": "*"
-    "@types/node": "*"
-  checksum: e388f546840704a240fb31536498921623bca4ec1230925013d6b6d7c7d2211c8ec07fcbbd2606151d7549cbbc28a01c18fb0df502107a9293860a5ff64bc147
-  languageName: node
-  linkType: hard
-
-"@types/rimraf@npm:^2.0.3":
-  version: 2.0.4
-  resolution: "@types/rimraf@npm:2.0.4"
-  dependencies:
-    "@types/glob": "*"
-    "@types/node": "*"
-  checksum: 8304d3d98f654f6c7b6256f368832436dc1d807bb899007fa823702052642166da25f37e849f0bc4ba4ec312e5a8f81e7a4d4a81de9c68f305d28f7822464c0c
-  languageName: node
-  linkType: hard
-
-"@types/rsvp@npm:*, @types/rsvp@npm:^4.0.4":
-  version: 4.0.4
-  resolution: "@types/rsvp@npm:4.0.4"
-  checksum: ed59be8246325c3676e67237c00d84830f801710af864dbf7d22e80441892e9a7beee07afcbdcd74ee8fbe3a24f37e93826dac1208199ac5601b663b7293cbed
-  languageName: node
-  linkType: hard
-
-"@types/semver@npm:^7.3.12":
-  version: 7.3.13
-  resolution: "@types/semver@npm:7.3.13"
-  checksum: 00c0724d54757c2f4bc60b5032fe91cda6410e48689633d5f35ece8a0a66445e3e57fa1d6e07eb780f792e82ac542948ec4d0b76eb3484297b79bd18b8cf1cb0
-  languageName: node
-  linkType: hard
-
-"@types/serve-static@npm:*":
-  version: 1.13.9
-  resolution: "@types/serve-static@npm:1.13.9"
-  dependencies:
-    "@types/mime": ^1
-    "@types/node": "*"
-  checksum: 5c5f3b64e9fe7c51fb428ef70f1f2365b897fc3c8400be6d6afc8db0f152639182b360361ebd3d0cbaeb607b125dee03bf0c50bf7e08642ff150028f05bb7381
-  languageName: node
-  linkType: hard
-
-"@types/shell-quote@npm:^1.7.1":
-  version: 1.7.1
-  resolution: "@types/shell-quote@npm:1.7.1"
-  checksum: 51e58326b8c6dcb72846b94cebe3dc4c84f3514469a8e52bd29c52c601e784b427b851d7477acbeef47bfcccf25d2a5768684d27e7fc95fdd003393c1bbb7bc3
-  languageName: node
-  linkType: hard
-
-"@types/symlink-or-copy@npm:^1.2.0":
-  version: 1.2.0
-  resolution: "@types/symlink-or-copy@npm:1.2.0"
-  checksum: 18fb73094b2cf6c84544939bd6344d7a8cd1ccf8496a1cfb1320f38491c8dfbea3248bb6e91495322a51a493e04a767582a214d5261f5c5b007aa6ef65fc8b50
-  languageName: node
-  linkType: hard
-
-"@types/tmp@npm:^0.0.33":
-  version: 0.0.33
-  resolution: "@types/tmp@npm:0.0.33"
-  checksum: b6963af74092bd56a1a9a7936a1a6de45ddbd5e774f9fc904f16b7e2ada79da8a769e0c5b9df083064b8080bb260c4973ba4307640b7b7a75ed1c47bda8c4110
+    "@types/eslint": ^8.4.9
+    find-up: ^5.0.0
+    fs-extra: ^9.1.0
+    proper-lockfile: ^4.1.2
+    slash: ^3.0.0
+    tslib: ^2.4.1
+    upath: ^2.0.1
+  checksum: 354cbe04c7285d252b45453f0ab69720bca63c74b4a837eba74cb4c38f388639f299ad9e4da29b033da30e0bab2cd9436c889f168fb6222c8cc3a2be5e16addb
   languageName: node
   linkType: hard
 
-"@types/unist@npm:*, @types/unist@npm:^2.0.0, @types/unist@npm:^2.0.2":
-  version: 2.0.6
-  resolution: "@types/unist@npm:2.0.6"
-  checksum: 25cb860ff10dde48b54622d58b23e66214211a61c84c0f15f88d38b61aa1b53d4d46e42b557924a93178c501c166aa37e28d7f6d994aba13d24685326272d5db
+"@marijn/find-cluster-break@npm:^1.0.0":
+  version: 1.0.2
+  resolution: "@marijn/find-cluster-break@npm:1.0.2"
+  checksum: 0d836de25e04d58325813401ef3c2d34caf040da985a5935fcbc9d84e7b47a21bdb15f57d70c2bf0960bd29ed3dbbb1afd00cdd0fc4fafbee7fd0ffe7d508ae1
   languageName: node
   linkType: hard
 
-"@typescript-eslint/eslint-plugin@npm:^5.19.0":
-  version: 5.44.0
-  resolution: "@typescript-eslint/eslint-plugin@npm:5.44.0"
-  dependencies:
-    "@typescript-eslint/scope-manager": 5.44.0
-    "@typescript-eslint/type-utils": 5.44.0
-    "@typescript-eslint/utils": 5.44.0
-    debug: ^4.3.4
-    ignore: ^5.2.0
-    natural-compare-lite: ^1.4.0
-    regexpp: ^3.2.0
-    semver: ^7.3.7
-    tsutils: ^3.21.0
-  peerDependencies:
-    "@typescript-eslint/parser": ^5.0.0
-    eslint: ^6.0.0 || ^7.0.0 || ^8.0.0
-  peerDependenciesMeta:
-    typescript:
-      optional: true
-  checksum: 88784e77e8e35ea50ca9c49d46df94cabc3447f4b332f3ca53974d3b5370cb5dcd85cc9ee0e317b91083812012369209574725dcfc3b2b4056b60371b68ca854
+"@mdn/browser-compat-data@npm:^5.3.13, @mdn/browser-compat-data@npm:^5.6.19":
+  version: 5.7.6
+  resolution: "@mdn/browser-compat-data@npm:5.7.6"
+  checksum: e54676a42614c075da8a7f1cd2f90ff6095411ea0786213d7574ec54cee8537ee15d6a64eb4920e41a570e1545777c7f3d2b7e341ac176f12f289012f75b4813
   languageName: node
   linkType: hard
 
-"@typescript-eslint/parser@npm:^5.10.0":
-  version: 5.42.1
-  resolution: "@typescript-eslint/parser@npm:5.42.1"
+"@messageformat/core@npm:^3.0.1":
+  version: 3.4.0
+  resolution: "@messageformat/core@npm:3.4.0"
   dependencies:
-    "@typescript-eslint/scope-manager": 5.42.1
-    "@typescript-eslint/types": 5.42.1
-    "@typescript-eslint/typescript-estree": 5.42.1
-    debug: ^4.3.4
-  peerDependencies:
-    eslint: ^6.0.0 || ^7.0.0 || ^8.0.0
-  peerDependenciesMeta:
-    typescript:
-      optional: true
-  checksum: 7208a085102be5c569ac2be5799d05e080a9c0b9157ed3efa5d7eadb675185bddfa05f2f27e20c235910193a2bd835e5375fb9fc13561a6e20d110e444f37caa
+    "@messageformat/date-skeleton": ^1.0.0
+    "@messageformat/number-skeleton": ^1.0.0
+    "@messageformat/parser": ^5.1.0
+    "@messageformat/runtime": ^3.0.1
+    make-plural: ^7.0.0
+    safe-identifier: ^0.4.1
+  checksum: c9b75b510a8b0193a4ee6d600c97f7adacbb98125bd7c0ef60c9ebfb97591d0ecf8247868373919e79adcff1fc6aecd04a905160e212976d2846e4f0dc3d705f
   languageName: node
   linkType: hard
 
-"@typescript-eslint/parser@npm:^5.19.0":
-  version: 5.44.0
-  resolution: "@typescript-eslint/parser@npm:5.44.0"
-  dependencies:
-    "@typescript-eslint/scope-manager": 5.44.0
-    "@typescript-eslint/types": 5.44.0
-    "@typescript-eslint/typescript-estree": 5.44.0
-    debug: ^4.3.4
-  peerDependencies:
-    eslint: ^6.0.0 || ^7.0.0 || ^8.0.0
-  peerDependenciesMeta:
-    typescript:
-      optional: true
-  checksum: 2d09a1a1547a7ae3f76c9a33a54e11d79a194fbb9dbae69988e7aed3370bdf12bafde669211152769d89db822e0cdee4173affc126664fa6f17abba56daa7261
+"@messageformat/date-skeleton@npm:^1.0.0":
+  version: 1.1.0
+  resolution: "@messageformat/date-skeleton@npm:1.1.0"
+  checksum: 599adc2aba1639b9505420bce61035ce8cbf1a38bf77b39be5de7b9ecb4c4a2290ae3ebc2ee94ba5aabf52d22654b5febb961694dc52d9a4e6fb859d758aaea8
   languageName: node
   linkType: hard
 
-"@typescript-eslint/scope-manager@npm:5.42.1":
-  version: 5.42.1
-  resolution: "@typescript-eslint/scope-manager@npm:5.42.1"
-  dependencies:
-    "@typescript-eslint/types": 5.42.1
-    "@typescript-eslint/visitor-keys": 5.42.1
-  checksum: cfad5f04328fae4bb6d965a94c980ac2f6fa0eee6183e9bed6d7ebdb067f01a0a9a3b5500fc3638d5e287f46f4412aa462e238c610c1fb96b794b83c575c7fb4
+"@messageformat/number-skeleton@npm:^1.0.0":
+  version: 1.2.0
+  resolution: "@messageformat/number-skeleton@npm:1.2.0"
+  checksum: deb38fc45248a774e142437c5687a4ba452ab4064ac7ac985da26376238a9f54bd43e6e90ab0756fedd35d4d83e36d2dfc336abf643d52ff3850f5d1eae59e0c
   languageName: node
   linkType: hard
 
-"@typescript-eslint/scope-manager@npm:5.44.0":
-  version: 5.44.0
-  resolution: "@typescript-eslint/scope-manager@npm:5.44.0"
+"@messageformat/parser@npm:^5.1.0":
+  version: 5.1.1
+  resolution: "@messageformat/parser@npm:5.1.1"
   dependencies:
-    "@typescript-eslint/types": 5.44.0
-    "@typescript-eslint/visitor-keys": 5.44.0
-  checksum: 4cfe4b55eb428eda740e6b967e3a87f3e1f9c4bbd8e1d6b8d64a11666abe33ffe7a21e4e614444ccde2da6930fa85f3e0ffca43d6e339943ff7a4fbccb09c8fc
+    moo: ^0.5.1
+  checksum: 530a53b1445709f3a0361c378892fe84a976a3977869dfb7e31580375f3ddb6e9fac933dfb4f1f214c22e716e8e52f6ada2c47c765c5f3d87ca4747f5076eeaa
   languageName: node
   linkType: hard
 
-"@typescript-eslint/type-utils@npm:5.44.0":
-  version: 5.44.0
-  resolution: "@typescript-eslint/type-utils@npm:5.44.0"
+"@messageformat/runtime@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "@messageformat/runtime@npm:3.0.1"
   dependencies:
-    "@typescript-eslint/typescript-estree": 5.44.0
-    "@typescript-eslint/utils": 5.44.0
-    debug: ^4.3.4
-    tsutils: ^3.21.0
-  peerDependencies:
-    eslint: "*"
-  peerDependenciesMeta:
-    typescript:
-      optional: true
-  checksum: 4c7b594f8afa52d57d0512951a874fa390eb791dcefcd0e1efff8817872293b2e4e04eff3c54d1595c1720a34d5fd315729af4e459882033d13cb6069ae9d28f
+    make-plural: ^7.0.0
+  checksum: e69c3b0b372e15af88c285f6884ac0e3ba5fc7227b8ddc7f4bef94cb5675057126dc0ae9001e2a623d7ec61727d9b5e69b8e61be8618afe0baf40081ad3b0568
   languageName: node
   linkType: hard
 
-"@typescript-eslint/types@npm:5.42.1":
-  version: 5.42.1
-  resolution: "@typescript-eslint/types@npm:5.42.1"
-  checksum: b0eb3df3792dd0e447abcf2b4fd79b2eaa6f944242d00afa8ef2d9f892ea63e52f200e7cb1758ddbc46154aa6764cec8bc796ed96f7554457a20db976f9f2089
+"@miragejs/pretender-node-polyfill@npm:^0.1.0":
+  version: 0.1.2
+  resolution: "@miragejs/pretender-node-polyfill@npm:0.1.2"
+  checksum: bb55983a253dc0d4162acac090b062500595c9844bfbd21fe25bc1f926808d0070d710e622aa6285fa16c673a65cf3e05f4b32e888c469f1bde8888a7934ee44
   languageName: node
   linkType: hard
 
-"@typescript-eslint/types@npm:5.44.0":
-  version: 5.44.0
-  resolution: "@typescript-eslint/types@npm:5.44.0"
-  checksum: ced7d32abecfc62ccb67cf27e30c0785b9c153ec7b1a05153ced58fa5a2031ab3845bc2e477b83e4cebdcc5881c5845d23053c6739c62549d41ae6208e547e85
+"@nicolo-ribaudo/chokidar-2@npm:2.1.8-no-fsevents.3":
+  version: 2.1.8-no-fsevents.3
+  resolution: "@nicolo-ribaudo/chokidar-2@npm:2.1.8-no-fsevents.3"
+  checksum: ee55cc9241aeea7eb94b8a8551bfa4246c56c53bc71ecda0a2104018fcc328ba5723b33686bdf9cc65d4df4ae65e8016b89e0bbdeb94e0309fe91bb9ced42344
   languageName: node
   linkType: hard
 
-"@typescript-eslint/typescript-estree@npm:5.42.1":
-  version: 5.42.1
-  resolution: "@typescript-eslint/typescript-estree@npm:5.42.1"
+"@nicolo-ribaudo/eslint-scope-5-internals@npm:5.1.1-v1":
+  version: 5.1.1-v1
+  resolution: "@nicolo-ribaudo/eslint-scope-5-internals@npm:5.1.1-v1"
   dependencies:
-    "@typescript-eslint/types": 5.42.1
-    "@typescript-eslint/visitor-keys": 5.42.1
-    debug: ^4.3.4
-    globby: ^11.1.0
-    is-glob: ^4.0.3
-    semver: ^7.3.7
-    tsutils: ^3.21.0
-  peerDependenciesMeta:
-    typescript:
-      optional: true
-  checksum: dfd3e20d41ba4b574a52d82cc40b38708b8c2c4277d6304a8d914fe2a4a9ce8779f4d79fdac140e77a3afd3c6a2a7e3f31620dc427cabd04e4e906bb0ca3a468
+    eslint-scope: 5.1.1
+  checksum: f2e3b2d6a6e2d9f163ca22105910c9f850dc4897af0aea3ef0a5886b63d8e1ba6505b71c99cb78a3bba24a09557d601eb21c8dede3f3213753fcfef364eb0e57
   languageName: node
   linkType: hard
 
-"@typescript-eslint/typescript-estree@npm:5.44.0":
-  version: 5.44.0
-  resolution: "@typescript-eslint/typescript-estree@npm:5.44.0"
+"@nodelib/fs.scandir@npm:2.1.5":
+  version: 2.1.5
+  resolution: "@nodelib/fs.scandir@npm:2.1.5"
   dependencies:
-    "@typescript-eslint/types": 5.44.0
-    "@typescript-eslint/visitor-keys": 5.44.0
-    debug: ^4.3.4
-    globby: ^11.1.0
-    is-glob: ^4.0.3
-    semver: ^7.3.7
-    tsutils: ^3.21.0
-  peerDependenciesMeta:
-    typescript:
-      optional: true
-  checksum: 758731108497cca7ff81cf0a78d086b5a85757a983979d6bb25ad8252b7acbc738c642ecb5f5df82f925a45926b9846e431d5cf9fee5ed2613300b4d0c5d6c3f
+    "@nodelib/fs.stat": 2.0.5
+    run-parallel: ^1.1.9
+  checksum: a970d595bd23c66c880e0ef1817791432dbb7acbb8d44b7e7d0e7a22f4521260d4a83f7f9fd61d44fda4610105577f8f58a60718105fb38352baed612fd79e59
   languageName: node
   linkType: hard
 
-"@typescript-eslint/utils@npm:5.44.0":
-  version: 5.44.0
-  resolution: "@typescript-eslint/utils@npm:5.44.0"
-  dependencies:
-    "@types/json-schema": ^7.0.9
-    "@types/semver": ^7.3.12
-    "@typescript-eslint/scope-manager": 5.44.0
-    "@typescript-eslint/types": 5.44.0
-    "@typescript-eslint/typescript-estree": 5.44.0
-    eslint-scope: ^5.1.1
-    eslint-utils: ^3.0.0
-    semver: ^7.3.7
-  peerDependencies:
-    eslint: ^6.0.0 || ^7.0.0 || ^8.0.0
-  checksum: bc5bb28e41898464d35b8eb47cc452103852541e3b6be56252c15a5a81c45e10aad3db4c749eb92d752b0c358df8074e23ec6f9e65f8089baadeda7f395c7e31
+"@nodelib/fs.stat@npm:2.0.5, @nodelib/fs.stat@npm:^2.0.2":
+  version: 2.0.5
+  resolution: "@nodelib/fs.stat@npm:2.0.5"
+  checksum: 012480b5ca9d97bff9261571dbbec7bbc6033f69cc92908bc1ecfad0792361a5a1994bc48674b9ef76419d056a03efadfce5a6cf6dbc0a36559571a7a483f6f0
   languageName: node
   linkType: hard
 
-"@typescript-eslint/visitor-keys@npm:5.42.1":
-  version: 5.42.1
-  resolution: "@typescript-eslint/visitor-keys@npm:5.42.1"
+"@nodelib/fs.walk@npm:^1.2.3, @nodelib/fs.walk@npm:^1.2.8":
+  version: 1.2.8
+  resolution: "@nodelib/fs.walk@npm:1.2.8"
   dependencies:
-    "@typescript-eslint/types": 5.42.1
-    eslint-visitor-keys: ^3.3.0
-  checksum: d36c59da7bf3b3c150c12cbe4b0331edc15253f59599ec3d8b873b2a3d9fc7a4fea11490c1b20d972afcdc9c842deb5ada527ea9c538aa7e87555699d9a59f24
+    "@nodelib/fs.scandir": 2.1.5
+    fastq: ^1.6.0
+  checksum: 190c643f156d8f8f277bf2a6078af1ffde1fd43f498f187c2db24d35b4b4b5785c02c7dc52e356497b9a1b65b13edc996de08de0b961c32844364da02986dc53
   languageName: node
   linkType: hard
 
-"@typescript-eslint/visitor-keys@npm:5.44.0":
-  version: 5.44.0
-  resolution: "@typescript-eslint/visitor-keys@npm:5.44.0"
+"@npmcli/agent@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "@npmcli/agent@npm:3.0.0"
   dependencies:
-    "@typescript-eslint/types": 5.44.0
-    eslint-visitor-keys: ^3.3.0
-  checksum: a012c888209e1d6ae684b2a44fd460ae5a80f5faf07bca4bda6c9c0d8c063ad3297d4c53f7151ae86cf1a43dee09625dc3ee72183323c91089c7288fd573c6f4
+    agent-base: ^7.1.0
+    http-proxy-agent: ^7.0.0
+    https-proxy-agent: ^7.0.1
+    lru-cache: ^10.0.1
+    socks-proxy-agent: ^8.0.3
+  checksum: e8fc25d536250ed3e669813b36e8c6d805628b472353c57afd8c4fde0fcfcf3dda4ffe22f7af8c9070812ec2e7a03fb41d7151547cef3508efe661a5a3add20f
   languageName: node
   linkType: hard
 
-"@webassemblyjs/ast@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/ast@npm:1.11.1"
+"@npmcli/fs@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "@npmcli/fs@npm:4.0.0"
   dependencies:
-    "@webassemblyjs/helper-numbers": 1.11.1
-    "@webassemblyjs/helper-wasm-bytecode": 1.11.1
-  checksum: 1eee1534adebeece635362f8e834ae03e389281972611408d64be7895fc49f48f98fddbbb5339bf8a72cb101bcb066e8bca3ca1bf1ef47dadf89def0395a8d87
+    semver: ^7.3.5
+  checksum: 68951c589e9a4328698a35fd82fe71909a257d6f2ede0434d236fa55634f0fbcad9bb8755553ce5849bd25ee6f019f4d435921ac715c853582c4a7f5983c8d4a
   languageName: node
   linkType: hard
 
-"@webassemblyjs/ast@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/ast@npm:1.9.0"
+"@nullvoxpopuli/ember-composable-helpers@npm:^5.2.9":
+  version: 5.2.10
+  resolution: "@nullvoxpopuli/ember-composable-helpers@npm:5.2.10"
   dependencies:
-    "@webassemblyjs/helper-module-context": 1.9.0
-    "@webassemblyjs/helper-wasm-bytecode": 1.9.0
-    "@webassemblyjs/wast-parser": 1.9.0
-  checksum: 8a9838dc7fdac358aee8daa75eefa35934ab18dafb594092ff7be79c467ebe9dabb2543e58313c905fd802bdcc3cb8320e4e19af7444e49853a7a24e25138f75
-  languageName: node
-  linkType: hard
-
-"@webassemblyjs/floating-point-hex-parser@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/floating-point-hex-parser@npm:1.11.1"
-  checksum: b8efc6fa08e4787b7f8e682182d84dfdf8da9d9c77cae5d293818bc4a55c1f419a87fa265ab85252b3e6c1fd323d799efea68d825d341a7c365c64bc14750e97
-  languageName: node
-  linkType: hard
-
-"@webassemblyjs/floating-point-hex-parser@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/floating-point-hex-parser@npm:1.9.0"
-  checksum: d3aeb19bc30da26f639698daa28e44e0c18d5aa135359ef3c54148e194eec46451a912d0506099d479a71a94bc3eef6ef52d6ec234799528a25a9744789852de
-  languageName: node
-  linkType: hard
-
-"@webassemblyjs/helper-api-error@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/helper-api-error@npm:1.11.1"
-  checksum: 0792813f0ed4a0e5ee0750e8b5d0c631f08e927f4bdfdd9fe9105dc410c786850b8c61bff7f9f515fdfb149903bec3c976a1310573a4c6866a94d49bc7271959
+    "@embroider/addon-shim": ^1.9.0
+    decorator-transforms: ^2.3.0
+    ember-functions-as-helper-polyfill: ^2.1.2
+  checksum: 2f333d1dc28d4a9b27ec1127eb68544def136720131c6437f7a2c067ffc469a1014bef22e486c4677e215528fab5e4c5011f7f49d911fb33724bddb9912c9132
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-api-error@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/helper-api-error@npm:1.9.0"
-  checksum: 9179d3148639cc202e89a118145b485cf834613260679a99af6ec487bbc15f238566ca713207394b336160a41bf8c1b75cf2e853b3e96f0cc73c1e5c735b3f64
+"@parcel/watcher-android-arm64@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-android-arm64@npm:2.5.1"
+  conditions: os=android & cpu=arm64
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-buffer@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/helper-buffer@npm:1.11.1"
-  checksum: a337ee44b45590c3a30db5a8b7b68a717526cf967ada9f10253995294dbd70a58b2da2165222e0b9830cd4fc6e4c833bf441a721128d1fe2e9a7ab26b36003ce
+"@parcel/watcher-darwin-arm64@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-darwin-arm64@npm:2.5.1"
+  conditions: os=darwin & cpu=arm64
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-buffer@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/helper-buffer@npm:1.9.0"
-  checksum: dcb85f630f8a2e22b7346ad4dd58c3237a2cad1457699423e8fd19592a0bd3eacbc2639178a1b9a873c3ac217bfc7a23a134ff440a099496b590e82c7a4968d5
+"@parcel/watcher-darwin-x64@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-darwin-x64@npm:2.5.1"
+  conditions: os=darwin & cpu=x64
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-code-frame@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/helper-code-frame@npm:1.9.0"
-  dependencies:
-    "@webassemblyjs/wast-printer": 1.9.0
-  checksum: a28fa057f7beff0fd14bff716561520f8edb8c9c56c7a5559451e6765acfb70aaeb8af718ea2bd2262e7baeba597545af407e28eb2eff8329235afe8605f20d1
+"@parcel/watcher-freebsd-x64@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-freebsd-x64@npm:2.5.1"
+  conditions: os=freebsd & cpu=x64
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-fsm@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/helper-fsm@npm:1.9.0"
-  checksum: 374cc510c8f5a7a07d4fe9eb7036cc475a96a670b5d25c31f16757ac8295be8d03a2f29657ff53eaefa9e8315670a48824d430ed910e7c1835788ac79f93124e
+"@parcel/watcher-linux-arm-glibc@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-linux-arm-glibc@npm:2.5.1"
+  conditions: os=linux & cpu=arm & libc=glibc
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-module-context@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/helper-module-context@npm:1.9.0"
-  dependencies:
-    "@webassemblyjs/ast": 1.9.0
-  checksum: 55e8f89c7ea1beaa78fad88403f3753b8413b0f3b6bb32d898ce95078b3e1d1b48ade0919c00b82fc2e3813c0ab6901e415f7a4d4fa9be50944e2431adde75a5
+"@parcel/watcher-linux-arm-musl@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-linux-arm-musl@npm:2.5.1"
+  conditions: os=linux & cpu=arm & libc=musl
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-numbers@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/helper-numbers@npm:1.11.1"
-  dependencies:
-    "@webassemblyjs/floating-point-hex-parser": 1.11.1
-    "@webassemblyjs/helper-api-error": 1.11.1
-    "@xtuc/long": 4.2.2
-  checksum: 44d2905dac2f14d1e9b5765cf1063a0fa3d57295c6d8930f6c59a36462afecc6e763e8a110b97b342a0f13376166c5d41aa928e6ced92e2f06b071fd0db59d3a
+"@parcel/watcher-linux-arm64-glibc@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-linux-arm64-glibc@npm:2.5.1"
+  conditions: os=linux & cpu=arm64 & libc=glibc
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-wasm-bytecode@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/helper-wasm-bytecode@npm:1.11.1"
-  checksum: eac400113127832c88f5826bcc3ad1c0db9b3dbd4c51a723cfdb16af6bfcbceb608170fdaac0ab7731a7e18b291be7af68a47fcdb41cfe0260c10857e7413d97
+"@parcel/watcher-linux-arm64-musl@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-linux-arm64-musl@npm:2.5.1"
+  conditions: os=linux & cpu=arm64 & libc=musl
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-wasm-bytecode@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/helper-wasm-bytecode@npm:1.9.0"
-  checksum: 280da4df3c556f73a1a02053277f8a4be481de32df4aa21050b015c8f4d27c46af89f0417eb88e486df117e5df4bccffae593f78cb1e79f212d3b3d4f3ed0f04
+"@parcel/watcher-linux-x64-glibc@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-linux-x64-glibc@npm:2.5.1"
+  conditions: os=linux & cpu=x64 & libc=glibc
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-wasm-section@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/helper-wasm-section@npm:1.11.1"
-  dependencies:
-    "@webassemblyjs/ast": 1.11.1
-    "@webassemblyjs/helper-buffer": 1.11.1
-    "@webassemblyjs/helper-wasm-bytecode": 1.11.1
-    "@webassemblyjs/wasm-gen": 1.11.1
-  checksum: 617696cfe8ecaf0532763162aaf748eb69096fb27950219bb87686c6b2e66e11cd0614d95d319d0ab1904bc14ebe4e29068b12c3e7c5e020281379741fe4bedf
+"@parcel/watcher-linux-x64-musl@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-linux-x64-musl@npm:2.5.1"
+  conditions: os=linux & cpu=x64 & libc=musl
   languageName: node
   linkType: hard
 
-"@webassemblyjs/helper-wasm-section@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/helper-wasm-section@npm:1.9.0"
-  dependencies:
-    "@webassemblyjs/ast": 1.9.0
-    "@webassemblyjs/helper-buffer": 1.9.0
-    "@webassemblyjs/helper-wasm-bytecode": 1.9.0
-    "@webassemblyjs/wasm-gen": 1.9.0
-  checksum: b8f7bb45d4194074c82210211a5d3e402a5b5fa63ecae26d2c356ae3978af5a530e91192fb260f32f9d561b18e2828b3da2e2f41c59efadb5f3c6d72446807f0
+"@parcel/watcher-win32-arm64@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-win32-arm64@npm:2.5.1"
+  conditions: os=win32 & cpu=arm64
   languageName: node
   linkType: hard
 
-"@webassemblyjs/ieee754@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/ieee754@npm:1.11.1"
-  dependencies:
-    "@xtuc/ieee754": ^1.2.0
-  checksum: 23a0ac02a50f244471631802798a816524df17e56b1ef929f0c73e3cde70eaf105a24130105c60aff9d64a24ce3b640dad443d6f86e5967f922943a7115022ec
+"@parcel/watcher-win32-ia32@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-win32-ia32@npm:2.5.1"
+  conditions: os=win32 & cpu=ia32
   languageName: node
   linkType: hard
 
-"@webassemblyjs/ieee754@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/ieee754@npm:1.9.0"
-  dependencies:
-    "@xtuc/ieee754": ^1.2.0
-  checksum: 7fe4a217ba0f7051e2cfef92919d4a64fac1a63c65411763779bd50907820f33f440255231a474fe3ba03bd1d9ee0328662d1eae3fce4c59b91549d6b62b839b
+"@parcel/watcher-win32-x64@npm:2.5.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher-win32-x64@npm:2.5.1"
+  conditions: os=win32 & cpu=x64
   languageName: node
   linkType: hard
 
-"@webassemblyjs/leb128@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/leb128@npm:1.11.1"
-  dependencies:
-    "@xtuc/long": 4.2.2
-  checksum: 33ccc4ade2f24de07bf31690844d0b1ad224304ee2062b0e464a610b0209c79e0b3009ac190efe0e6bd568b0d1578d7c3047fc1f9d0197c92fc061f56224ff4a
+"@parcel/watcher@npm:^2.4.1":
+  version: 2.5.1
+  resolution: "@parcel/watcher@npm:2.5.1"
+  dependencies:
+    "@parcel/watcher-android-arm64": 2.5.1
+    "@parcel/watcher-darwin-arm64": 2.5.1
+    "@parcel/watcher-darwin-x64": 2.5.1
+    "@parcel/watcher-freebsd-x64": 2.5.1
+    "@parcel/watcher-linux-arm-glibc": 2.5.1
+    "@parcel/watcher-linux-arm-musl": 2.5.1
+    "@parcel/watcher-linux-arm64-glibc": 2.5.1
+    "@parcel/watcher-linux-arm64-musl": 2.5.1
+    "@parcel/watcher-linux-x64-glibc": 2.5.1
+    "@parcel/watcher-linux-x64-musl": 2.5.1
+    "@parcel/watcher-win32-arm64": 2.5.1
+    "@parcel/watcher-win32-ia32": 2.5.1
+    "@parcel/watcher-win32-x64": 2.5.1
+    detect-libc: ^1.0.3
+    is-glob: ^4.0.3
+    micromatch: ^4.0.5
+    node-addon-api: ^7.0.0
+    node-gyp: latest
+  dependenciesMeta:
+    "@parcel/watcher-android-arm64":
+      optional: true
+    "@parcel/watcher-darwin-arm64":
+      optional: true
+    "@parcel/watcher-darwin-x64":
+      optional: true
+    "@parcel/watcher-freebsd-x64":
+      optional: true
+    "@parcel/watcher-linux-arm-glibc":
+      optional: true
+    "@parcel/watcher-linux-arm-musl":
+      optional: true
+    "@parcel/watcher-linux-arm64-glibc":
+      optional: true
+    "@parcel/watcher-linux-arm64-musl":
+      optional: true
+    "@parcel/watcher-linux-x64-glibc":
+      optional: true
+    "@parcel/watcher-linux-x64-musl":
+      optional: true
+    "@parcel/watcher-win32-arm64":
+      optional: true
+    "@parcel/watcher-win32-ia32":
+      optional: true
+    "@parcel/watcher-win32-x64":
+      optional: true
+  checksum: c6444cd20212929ef2296d5620c0d41343a1719232cb0c947ced51155b8afc1e470c09d238b92f6c3a589e0320048badf5b73cb41790229521be224cbf89e0f4
   languageName: node
   linkType: hard
 
-"@webassemblyjs/leb128@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/leb128@npm:1.9.0"
-  dependencies:
-    "@xtuc/long": 4.2.2
-  checksum: 4ca7cbb869530d78d42a414f34ae53249364cb1ecebbfb6ed5d562c2f209fce857502f088822ee82a23876f653a262ddc34ab64e45a7962510a263d39bb3f51a
+"@pkgjs/parseargs@npm:^0.11.0":
+  version: 0.11.0
+  resolution: "@pkgjs/parseargs@npm:0.11.0"
+  checksum: 6ad6a00fc4f2f2cfc6bff76fb1d88b8ee20bc0601e18ebb01b6d4be583733a860239a521a7fbca73b612e66705078809483549d2b18f370eb346c5155c8e4a0f
   languageName: node
   linkType: hard
 
-"@webassemblyjs/utf8@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/utf8@npm:1.11.1"
-  checksum: 972c5cfc769d7af79313a6bfb96517253a270a4bf0c33ba486aa43cac43917184fb35e51dfc9e6b5601548cd5931479a42e42c89a13bb591ffabebf30c8a6a0b
+"@pkgr/core@npm:^0.2.4":
+  version: 0.2.4
+  resolution: "@pkgr/core@npm:0.2.4"
+  checksum: 8544f0346c3f7035b9e2fdf60179c68b12d3c76b3fba9533844099af67cf5c0ce5257538f5faa05953d48cc1536d046f003231f321b2f75b3fb449db8410a2b7
   languageName: node
   linkType: hard
 
-"@webassemblyjs/utf8@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/utf8@npm:1.9.0"
-  checksum: e328a30ac8a503bbd015d32e75176e0dedcb45a21d4be051c25dfe89a00035ca7a6dbd8937b442dd5b4b334de3959d4f5fe0b330037bd226a28b9814cd49e84f
+"@pnpm/constants@npm:7.1.1":
+  version: 7.1.1
+  resolution: "@pnpm/constants@npm:7.1.1"
+  checksum: a8b6a8c633ba2099ee844a3dd7934352a2135872e86f8fe497d599837b8be7eac374839598b70030e63cb3a32f945e881d6c0e1542f0be2b74ec52d78f891649
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-edit@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/wasm-edit@npm:1.11.1"
+"@pnpm/error@npm:5.0.3":
+  version: 5.0.3
+  resolution: "@pnpm/error@npm:5.0.3"
   dependencies:
-    "@webassemblyjs/ast": 1.11.1
-    "@webassemblyjs/helper-buffer": 1.11.1
-    "@webassemblyjs/helper-wasm-bytecode": 1.11.1
-    "@webassemblyjs/helper-wasm-section": 1.11.1
-    "@webassemblyjs/wasm-gen": 1.11.1
-    "@webassemblyjs/wasm-opt": 1.11.1
-    "@webassemblyjs/wasm-parser": 1.11.1
-    "@webassemblyjs/wast-printer": 1.11.1
-  checksum: 6d7d9efaec1227e7ef7585a5d7ff0be5f329f7c1c6b6c0e906b18ed2e9a28792a5635e450aca2d136770d0207225f204eff70a4b8fd879d3ac79e1dcc26dbeb9
+    "@pnpm/constants": 7.1.1
+  checksum: b0c5b8b18c4302aeef59554b07107046679189d24eac6b34df59a28f6567f999bd589d7f64c75fcfee2e25f4175f5c0b1089fb2c5b633257836ced185e531726
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-edit@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/wasm-edit@npm:1.9.0"
+"@pnpm/find-workspace-dir@npm:^6.0.2":
+  version: 6.0.3
+  resolution: "@pnpm/find-workspace-dir@npm:6.0.3"
   dependencies:
-    "@webassemblyjs/ast": 1.9.0
-    "@webassemblyjs/helper-buffer": 1.9.0
-    "@webassemblyjs/helper-wasm-bytecode": 1.9.0
-    "@webassemblyjs/helper-wasm-section": 1.9.0
-    "@webassemblyjs/wasm-gen": 1.9.0
-    "@webassemblyjs/wasm-opt": 1.9.0
-    "@webassemblyjs/wasm-parser": 1.9.0
-    "@webassemblyjs/wast-printer": 1.9.0
-  checksum: 1997e0c2f4051c33239587fb143242919320bc861a0af03a873c7150a27d6404bd2e063c658193288b0aa88c35aadbe0c4fde601fe642bae0743a8c8eda52717
+    "@pnpm/error": 5.0.3
+    find-up: ^5.0.0
+  checksum: 87f045e148fa6532739ae10a19001a31d626da67ce705826e4884607854704f67a4a1dec69e9976732a6317684c3c8ba272c9460f995fcc10b465fefc6d06e9b
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-gen@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/wasm-gen@npm:1.11.1"
-  dependencies:
-    "@webassemblyjs/ast": 1.11.1
-    "@webassemblyjs/helper-wasm-bytecode": 1.11.1
-    "@webassemblyjs/ieee754": 1.11.1
-    "@webassemblyjs/leb128": 1.11.1
-    "@webassemblyjs/utf8": 1.11.1
-  checksum: 1f6921e640293bf99fb16b21e09acb59b340a79f986c8f979853a0ae9f0b58557534b81e02ea2b4ef11e929d946708533fd0693c7f3712924128fdafd6465f5b
+"@popperjs/core@npm:^2.9.0":
+  version: 2.11.8
+  resolution: "@popperjs/core@npm:2.11.8"
+  checksum: e5c69fdebf52a4012f6a1f14817ca8e9599cb1be73dd1387e1785e2ed5e5f0862ff817f420a87c7fc532add1f88a12e25aeb010ffcbdc98eace3d55ce2139cf0
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-gen@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/wasm-gen@npm:1.9.0"
+"@prettier/eslint@npm:prettier-eslint@^15.0.1":
+  version: 15.0.1
+  resolution: "prettier-eslint@npm:15.0.1"
   dependencies:
-    "@webassemblyjs/ast": 1.9.0
-    "@webassemblyjs/helper-wasm-bytecode": 1.9.0
-    "@webassemblyjs/ieee754": 1.9.0
-    "@webassemblyjs/leb128": 1.9.0
-    "@webassemblyjs/utf8": 1.9.0
-  checksum: 2456e84e8e6bedb7ab47f6333a0ee170f7ef62842c90862ca787c08528ca8041061f3f8bc257fc2a01bf6e8d1a76fddaddd43418c738f681066e5b50f88fe7df
+    "@types/eslint": ^8.4.2
+    "@types/prettier": ^2.6.0
+    "@typescript-eslint/parser": ^5.10.0
+    common-tags: ^1.4.0
+    dlv: ^1.1.0
+    eslint: ^8.7.0
+    indent-string: ^4.0.0
+    lodash.merge: ^4.6.0
+    loglevel-colored-level-prefix: ^1.0.0
+    prettier: ^2.5.1
+    pretty-format: ^23.0.1
+    require-relative: ^0.8.7
+    typescript: ^4.5.4
+    vue-eslint-parser: ^8.0.1
+  checksum: fad92d666ab92f6c773faf507ee15f2c0de8c8ac2b692a57a7c0621202f90d9e577f2664d8a701ec3b96bec3ecba586e49c3d9170de9392c0ee7c3362fdddcae
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-opt@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/wasm-opt@npm:1.11.1"
-  dependencies:
-    "@webassemblyjs/ast": 1.11.1
-    "@webassemblyjs/helper-buffer": 1.11.1
-    "@webassemblyjs/wasm-gen": 1.11.1
-    "@webassemblyjs/wasm-parser": 1.11.1
-  checksum: 21586883a20009e2b20feb67bdc451bbc6942252e038aae4c3a08e6f67b6bae0f5f88f20bfc7bd0452db5000bacaf5ab42b98cf9aa034a6c70e9fc616142e1db
+"@prettier/sync@npm:^0.2.1":
+  version: 0.2.1
+  resolution: "@prettier/sync@npm:0.2.1"
+  peerDependencies:
+    prettier: ^3.0.0
+  checksum: 708be7958a4d88b0299b4d856728981f9f68a1c4b8f99bf56490aee002b48d79ccb471b390908ab61951219b0b6cbdeb163f32a29cc92d438220c82cd4b6a7fe
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-opt@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/wasm-opt@npm:1.9.0"
-  dependencies:
-    "@webassemblyjs/ast": 1.9.0
-    "@webassemblyjs/helper-buffer": 1.9.0
-    "@webassemblyjs/wasm-gen": 1.9.0
-    "@webassemblyjs/wasm-parser": 1.9.0
-  checksum: 91242205bdbd1aa8045364a5338bfb34880cb2c65f56db8dd19382894209673699fb31a0e5279f25c7e5bcd8f3097d6c9ca84d8969d9613ef2cf166450cc3515
+"@ro0gr/ceibo@npm:^2.2.0":
+  version: 2.2.0
+  resolution: "@ro0gr/ceibo@npm:2.2.0"
+  checksum: 74f143b75b970acde9278c45f91a2ae82f8de44dd42c2817d225a1896fdb909b958a30cd6e95689f5ae99949be98a93c2f47568b584f068b51057fc56ee0133a
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-parser@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/wasm-parser@npm:1.11.1"
+"@rollup/plugin-replace@npm:2.3.0":
+  version: 2.3.0
+  resolution: "@rollup/plugin-replace@npm:2.3.0"
   dependencies:
-    "@webassemblyjs/ast": 1.11.1
-    "@webassemblyjs/helper-api-error": 1.11.1
-    "@webassemblyjs/helper-wasm-bytecode": 1.11.1
-    "@webassemblyjs/ieee754": 1.11.1
-    "@webassemblyjs/leb128": 1.11.1
-    "@webassemblyjs/utf8": 1.11.1
-  checksum: 1521644065c360e7b27fad9f4bb2df1802d134dd62937fa1f601a1975cde56bc31a57b6e26408b9ee0228626ff3ba1131ae6f74ffb7d718415b6528c5a6dbfc2
+    magic-string: ^0.25.2
+    rollup-pluginutils: ^2.6.0
+  peerDependencies:
+    rollup: ^1.20.0
+  checksum: 561e483398d15f594ebc87fda2760a5528da9abfa1fe1c3865280e18201fafb4e60587dc38e8b7781b15db10acc39da5f6ec700ac129fc931d31c060b304b96b
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wasm-parser@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/wasm-parser@npm:1.9.0"
+"@scalvert/ember-setup-middleware-reporter@npm:^0.1.1":
+  version: 0.1.1
+  resolution: "@scalvert/ember-setup-middleware-reporter@npm:0.1.1"
   dependencies:
-    "@webassemblyjs/ast": 1.9.0
-    "@webassemblyjs/helper-api-error": 1.9.0
-    "@webassemblyjs/helper-wasm-bytecode": 1.9.0
-    "@webassemblyjs/ieee754": 1.9.0
-    "@webassemblyjs/leb128": 1.9.0
-    "@webassemblyjs/utf8": 1.9.0
-  checksum: 493f6cfc63a5e16073056c81ff0526a9936f461327379ef3c83cc841000e03623b6352704f6bf9f7cb5b3610f0032020a61f9cca78c91b15b8e995854b29c098
+    "@types/fs-extra": ^9.0.12
+    body-parser: ^1.19.0
+    errorhandler: ^1.5.1
+    fs-extra: ^10.0.0
+  checksum: 4015fc0ede7d72a2a8a5e334c63fb7f570c89d2f53d45cdb453dd85e3de48734a5d083b4cf0cadf70a3b5e71ee7aca020b45d5798e8a6334db1f72aa7ab72cb4
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wast-parser@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/wast-parser@npm:1.9.0"
-  dependencies:
-    "@webassemblyjs/ast": 1.9.0
-    "@webassemblyjs/floating-point-hex-parser": 1.9.0
-    "@webassemblyjs/helper-api-error": 1.9.0
-    "@webassemblyjs/helper-code-frame": 1.9.0
-    "@webassemblyjs/helper-fsm": 1.9.0
-    "@xtuc/long": 4.2.2
-  checksum: 705dd48fbbceec7f6bed299b8813631b242fd9312f9594dbb2985dda86c9688048692357d684f6080fc2c5666287cefaa26b263d01abadb6a9049d4c8978b9db
+"@scarf/scarf@npm:=1.4.0":
+  version: 1.4.0
+  resolution: "@scarf/scarf@npm:1.4.0"
+  checksum: def62aa403f7e63165ccb219efd2c420fc0b7357b0ba43397f635e4aa813ace1cdf3855a93fc559b4619bcc0469ae4767b8cb72af30ea5c0522bf4a2ecb18198
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wast-printer@npm:1.11.1":
-  version: 1.11.1
-  resolution: "@webassemblyjs/wast-printer@npm:1.11.1"
+"@simple-dom/document@npm:^1.4.0":
+  version: 1.4.0
+  resolution: "@simple-dom/document@npm:1.4.0"
   dependencies:
-    "@webassemblyjs/ast": 1.11.1
-    "@xtuc/long": 4.2.2
-  checksum: f15ae4c2441b979a3b4fce78f3d83472fb22350c6dc3fd34bfe7c3da108e0b2360718734d961bba20e7716cb8578e964b870da55b035e209e50ec9db0378a3f7
+    "@simple-dom/interface": ^1.4.0
+  checksum: 5cb9b93079b0b01c461d4668829bf39986b032106fe3c337fbabecb43d19a37e6c5d6f2a938e8391aba4a50304367e9a59dccfe62320df4d77f7036ea09324c9
   languageName: node
   linkType: hard
 
-"@webassemblyjs/wast-printer@npm:1.9.0":
-  version: 1.9.0
-  resolution: "@webassemblyjs/wast-printer@npm:1.9.0"
-  dependencies:
-    "@webassemblyjs/ast": 1.9.0
-    "@webassemblyjs/wast-parser": 1.9.0
-    "@xtuc/long": 4.2.2
-  checksum: 3d1e1b2e84745a963f69acd1c02425b321dd2e608e11dabc467cae0c9a808962bc769ec9afc46fbcea7188cc1e47d72370da762d258f716fb367cb1a7865c54b
+"@simple-dom/interface@npm:^1.4.0":
+  version: 1.4.0
+  resolution: "@simple-dom/interface@npm:1.4.0"
+  checksum: e0ce8b6174208c5a369c2650094d16080230bf90cb95cc8258f9fd6b93be8afedbffb9d63da7f1d295a4e8d901f5fff907a69e1d55556db9e8544f2615b2f1d7
   languageName: node
   linkType: hard
 
-"@xmldom/xmldom@npm:^0.8.0":
-  version: 0.8.2
-  resolution: "@xmldom/xmldom@npm:0.8.2"
-  checksum: aeea8f670bfa52b3a1b2d355dab3bf4d58ef4969b1fd146a1ab91bf8acbb9d02953022e66e85279015a4e4027205620dfc001ed5d169b1711a09a0a079951e08
+"@sindresorhus/merge-streams@npm:^2.1.0":
+  version: 2.3.0
+  resolution: "@sindresorhus/merge-streams@npm:2.3.0"
+  checksum: e989d53dee68d7e49b4ac02ae49178d561c461144cea83f66fa91ff012d981ad0ad2340cbd13f2fdb57989197f5c987ca22a74eb56478626f04e79df84291159
   languageName: node
   linkType: hard
 
-"@xtuc/ieee754@npm:^1.2.0":
-  version: 1.2.0
-  resolution: "@xtuc/ieee754@npm:1.2.0"
-  checksum: ac56d4ca6e17790f1b1677f978c0c6808b1900a5b138885d3da21732f62e30e8f0d9120fcf8f6edfff5100ca902b46f8dd7c1e3f903728634523981e80e2885a
+"@sinonjs/commons@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "@sinonjs/commons@npm:3.0.1"
+  dependencies:
+    type-detect: 4.0.8
+  checksum: a7c3e7cc612352f4004873747d9d8b2d4d90b13a6d483f685598c945a70e734e255f1ca5dc49702515533c403b32725defff148177453b3f3915bcb60e9d4601
   languageName: node
   linkType: hard
 
-"@xtuc/long@npm:4.2.2":
-  version: 4.2.2
-  resolution: "@xtuc/long@npm:4.2.2"
-  checksum: 8ed0d477ce3bc9c6fe2bf6a6a2cc316bb9c4127c5a7827bae947fa8ec34c7092395c5a283cc300c05b5fa01cbbfa1f938f410a7bf75db7c7846fea41949989ec
+"@sinonjs/fake-timers@npm:^13.0.5":
+  version: 13.0.5
+  resolution: "@sinonjs/fake-timers@npm:13.0.5"
+  dependencies:
+    "@sinonjs/commons": ^3.0.1
+  checksum: b1c6ba87fadb7666d3aa126c9e8b4ac32b2d9e84c9e5fd074aa24cab3c8342fd655459de014b08e603be1e6c24c9f9716d76d6d2a36c50f59bb0091be61601dd
   languageName: node
   linkType: hard
 
-"JSV@npm:^4.0.x":
-  version: 4.0.2
-  resolution: "JSV@npm:4.0.2"
-  checksum: 9e2e070b2149d4ffed6c135dedb5f8cebb870dc63c0ca6d3cb647067248c7ca15d1a934ee46e9d2ac0e468436d0f70bc1b63cd5f93e705ee9aa0669430e6e66f
+"@sinonjs/samsam@npm:^8.0.1":
+  version: 8.0.2
+  resolution: "@sinonjs/samsam@npm:8.0.2"
+  dependencies:
+    "@sinonjs/commons": ^3.0.1
+    lodash.get: ^4.4.2
+    type-detect: ^4.1.0
+  checksum: 7dc24a388ea108e513c88edaaacf98cf4ebcbda8c715551b02954ce50db0e26d6071d98ba9594e737da7fe750079a2af94633d7d46ff1481cb940383b441f29b
   languageName: node
   linkType: hard
 
-"abab@npm:^2.0.3, abab@npm:^2.0.5":
-  version: 2.0.5
-  resolution: "abab@npm:2.0.5"
-  checksum: 0ec951b46d5418c2c2f923021ec193eaebdb4e802ffd5506286781b454be722a13a8430f98085cd3e204918401d9130ec6cc8f5ae19be315b3a0e857d83196e1
+"@socket.io/component-emitter@npm:~3.1.0":
+  version: 3.1.2
+  resolution: "@socket.io/component-emitter@npm:3.1.2"
+  checksum: 89888f00699eb34e3070624eb7b8161fa29f064aeb1389a48f02195d55dd7c52a504e52160016859f6d6dffddd54324623cdd47fd34b3d46f9ed96c18c456edc
   languageName: node
   linkType: hard
 
-"abbrev@npm:1, abbrev@npm:^1.0.0":
-  version: 1.1.1
-  resolution: "abbrev@npm:1.1.1"
-  checksum: a4a97ec07d7ea112c517036882b2ac22f3109b7b19077dc656316d07d308438aac28e4d9746dc4d84bf6b1e75b4a7b0a5f3cb30592419f128ca9a8cee3bcfa17
+"@textlint/ast-node-types@npm:^12.6.1":
+  version: 12.6.1
+  resolution: "@textlint/ast-node-types@npm:12.6.1"
+  checksum: be3bed9151b02ffdc53dda5af22742cdac49b3b8e844ba40b75622ac03335d5dedbbc30eb8c48be33baf64753d98af4293bfd3b2ca8e5d65351a0faf4dc89f9d
   languageName: node
   linkType: hard
 
-"abort-controller@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "abort-controller@npm:3.0.0"
+"@textlint/markdown-to-ast@npm:^12.1.1":
+  version: 12.6.1
+  resolution: "@textlint/markdown-to-ast@npm:12.6.1"
   dependencies:
-    event-target-shim: ^5.0.0
-  checksum: 170bdba9b47b7e65906a28c8ce4f38a7a369d78e2271706f020849c1bfe0ee2067d4261df8bbb66eb84f79208fd5b710df759d64191db58cfba7ce8ef9c54b75
+    "@textlint/ast-node-types": ^12.6.1
+    debug: ^4.3.4
+    mdast-util-gfm-autolink-literal: ^0.1.3
+    remark-footnotes: ^3.0.0
+    remark-frontmatter: ^3.0.0
+    remark-gfm: ^1.0.0
+    remark-parse: ^9.0.0
+    traverse: ^0.6.7
+    unified: ^9.2.2
+  checksum: a4d919ed93074ad5d48c9556b27bede3d4f28e811842716b158d1851c68247e422bcaf833f23b7d74a3d8cc82c3f1336fede32d7b3fb3d83f9c792bcc2dab54c
   languageName: node
   linkType: hard
 
-"abortcontroller-polyfill@npm:^1.7.3":
-  version: 1.7.3
-  resolution: "abortcontroller-polyfill@npm:1.7.3"
-  checksum: 55739d7f0c9bd6afa2aabb3148778967c4dd4dcff91f6b9259df38da34f9882d3f7730b0954e9767a19cc16a8dd9a58915da4e8a50220300d45af3817d7557b1
+"@tsconfig/ember@npm:~2.0.0":
+  version: 2.0.0
+  resolution: "@tsconfig/ember@npm:2.0.0"
+  checksum: 03ec9113bb454c61b1f06b843f14d53526f2e0cc111b347bc18bdb6dba2de40429e2b34baa66a408e6b7af3ebbb8d75cf1cb8ede948b329f18abb87016d11678
   languageName: node
   linkType: hard
 
-"accepts@npm:~1.3.4, accepts@npm:~1.3.5, accepts@npm:~1.3.7":
-  version: 1.3.7
-  resolution: "accepts@npm:1.3.7"
+"@types/body-parser@npm:*":
+  version: 1.19.5
+  resolution: "@types/body-parser@npm:1.19.5"
   dependencies:
-    mime-types: ~2.1.24
-    negotiator: 0.6.2
-  checksum: 27fc8060ffc69481ff6719cd3ee06387d2b88381cb0ce626f087781bbd02201a645a9febc8e7e7333558354b33b1d2f922ad13560be4ec1b7ba9e76fc1c1241d
+    "@types/connect": "*"
+    "@types/node": "*"
+  checksum: 1e251118c4b2f61029cc43b0dc028495f2d1957fe8ee49a707fb940f86a9bd2f9754230805598278fe99958b49e9b7e66eec8ef6a50ab5c1f6b93e1ba2aaba82
   languageName: node
   linkType: hard
 
-"accepts@npm:~1.3.8":
-  version: 1.3.8
-  resolution: "accepts@npm:1.3.8"
+"@types/chai-as-promised@npm:^7.1.2":
+  version: 7.1.8
+  resolution: "@types/chai-as-promised@npm:7.1.8"
   dependencies:
-    mime-types: ~2.1.34
-    negotiator: 0.6.3
-  checksum: 50c43d32e7b50285ebe84b613ee4a3aa426715a7d131b65b786e2ead0fd76b6b60091b9916d3478a75f11f162628a2139991b6c03ab3f1d9ab7c86075dc8eab4
+    "@types/chai": "*"
+  checksum: f0e5eab451b91bc1e289ed89519faf6591932e8a28d2ec9bbe95826eb73d28fe43713633e0c18706f3baa560a7d97e7c7c20dc53ce639e5d75bac46b2a50bf21
   languageName: node
   linkType: hard
 
-"acorn-dynamic-import@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "acorn-dynamic-import@npm:3.0.0"
+"@types/chai@npm:*":
+  version: 5.2.2
+  resolution: "@types/chai@npm:5.2.2"
   dependencies:
-    acorn: ^5.0.0
-  checksum: 60ba19103fdaa87e048a9480238faefd451dc39e21cf079812acd5e59ca064619a8c905b274f095b7c686736605547b089c6a5b75e926202afb8a4392d012659
+    "@types/deep-eql": "*"
+  checksum: 386887bd55ba684572cececd833ed91aba6cce2edd8cc1d8cefa78800b3a74db6dbf5c5c41af041d1d1f3ce672ea30b45c9520f948cdc75431eb7df3fbba8405
   languageName: node
   linkType: hard
 
-"acorn-globals@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "acorn-globals@npm:6.0.0"
-  dependencies:
-    acorn: ^7.1.1
-    acorn-walk: ^7.1.1
-  checksum: 72d95e5b5e585f9acd019b993ab8bbba68bb3cbc9d9b5c1ebb3c2f1fe5981f11deababfb4949f48e6262f9c57878837f5958c0cca396f81023814680ca878042
+"@types/chai@npm:^4.2.9":
+  version: 4.3.20
+  resolution: "@types/chai@npm:4.3.20"
+  checksum: 7c5b0c9148f1a844a8d16cb1e16c64f2e7749cab2b8284155b9e494a6b34054846e22fb2b38df6b290f9bf57e6beebb2e121940c5896bc086ad7bab7ed429f06
   languageName: node
   linkType: hard
 
-"acorn-import-assertions@npm:^1.7.6":
-  version: 1.8.0
-  resolution: "acorn-import-assertions@npm:1.8.0"
-  peerDependencies:
-    acorn: ^8
-  checksum: 5c4cf7c850102ba7ae0eeae0deb40fb3158c8ca5ff15c0bca43b5c47e307a1de3d8ef761788f881343680ea374631ae9e9615ba8876fee5268dbe068c98bcba6
+"@types/connect@npm:*":
+  version: 3.4.38
+  resolution: "@types/connect@npm:3.4.38"
+  dependencies:
+    "@types/node": "*"
+  checksum: 7eb1bc5342a9604facd57598a6c62621e244822442976c443efb84ff745246b10d06e8b309b6e80130026a396f19bf6793b7cecd7380169f369dac3bfc46fb99
   languageName: node
   linkType: hard
 
-"acorn-jsx@npm:^5.3.2":
-  version: 5.3.2
-  resolution: "acorn-jsx@npm:5.3.2"
-  peerDependencies:
-    acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
-  checksum: c3d3b2a89c9a056b205b69530a37b972b404ee46ec8e5b341666f9513d3163e2a4f214a71f4dfc7370f5a9c07472d2fd1c11c91c3f03d093e37637d95da98950
+"@types/cors@npm:^2.8.12":
+  version: 2.8.18
+  resolution: "@types/cors@npm:2.8.18"
+  dependencies:
+    "@types/node": "*"
+  checksum: 6e49b741345e67834cd19d766228509e4b37d6d5c272355bb059502b4787f5adf58776d9114ac5f0f407966e0347ae8d1f995d7ea41e6a24f716d36b3010401b
   languageName: node
   linkType: hard
 
-"acorn-walk@npm:^7.1.1":
-  version: 7.2.0
-  resolution: "acorn-walk@npm:7.2.0"
-  checksum: 9252158a79b9d92f1bc0dd6acc0fcfb87a67339e84bcc301bb33d6078936d27e35d606b4d35626d2962cd43c256d6f27717e70cbe15c04fff999ab0b2260b21f
+"@types/d3-array@npm:~3.2.1":
+  version: 3.2.1
+  resolution: "@types/d3-array@npm:3.2.1"
+  checksum: 8a41cee0969e53bab3f56cc15c4e6c9d76868d6daecb2b7d8c9ce71e0ececccc5a8239697cc52dadf5c665f287426de5c8ef31a49e7ad0f36e8846889a383df4
   languageName: node
   linkType: hard
 
-"acorn@npm:^5.0.0, acorn@npm:^5.1.1, acorn@npm:^5.5.3":
-  version: 5.7.4
-  resolution: "acorn@npm:5.7.4"
-  bin:
-    acorn: bin/acorn
-  checksum: f51392a4d25c7705fadb890f784c59cde4ac1c5452ccd569fa59bd2191b7951b4a6398348ab7ea08a54f0bc0a56c13776710f4e1bae9de441e4d33e2015ad1e0
+"@types/deep-eql@npm:*":
+  version: 4.0.2
+  resolution: "@types/deep-eql@npm:4.0.2"
+  checksum: 249a27b0bb22f6aa28461db56afa21ec044fa0e303221a62dff81831b20c8530502175f1a49060f7099e7be06181078548ac47c668de79ff9880241968d43d0c
   languageName: node
   linkType: hard
 
-"acorn@npm:^6.4.1":
-  version: 6.4.2
-  resolution: "acorn@npm:6.4.2"
-  bin:
-    acorn: bin/acorn
-  checksum: 44b07053729db7f44d28343eed32247ed56dc4a6ec6dff2b743141ecd6b861406bbc1c20bf9d4f143ea7dd08add5dc8c290582756539bc03a8db605050ce2fb4
+"@types/ember-data@npm:~4.4.16":
+  version: 4.4.16
+  resolution: "@types/ember-data@npm:4.4.16"
+  dependencies:
+    "@types/ember": "*"
+    "@types/ember__error": "*"
+    "@types/ember__object": "*"
+    "@types/rsvp": "*"
+  checksum: 7edbc8cd27d440e63b179df010064a580fa8c0b18b03f4efc091599848cb82bab266ea704947c5038d35b17d65b0f64d88a3de9cb1328466c1a35da6da2c5f08
   languageName: node
   linkType: hard
 
-"acorn@npm:^7.1.0, acorn@npm:^7.1.1":
-  version: 7.4.1
-  resolution: "acorn@npm:7.4.1"
-  bin:
-    acorn: bin/acorn
-  checksum: 1860f23c2107c910c6177b7b7be71be350db9e1080d814493fae143ae37605189504152d1ba8743ba3178d0b37269ce1ffc42b101547fdc1827078f82671e407
+"@types/ember@npm:*":
+  version: 4.0.11
+  resolution: "@types/ember@npm:4.0.11"
+  dependencies:
+    "@types/ember__application": "*"
+    "@types/ember__array": "*"
+    "@types/ember__component": "*"
+    "@types/ember__controller": "*"
+    "@types/ember__debug": "*"
+    "@types/ember__engine": "*"
+    "@types/ember__error": "*"
+    "@types/ember__object": "*"
+    "@types/ember__polyfills": "*"
+    "@types/ember__routing": "*"
+    "@types/ember__runloop": "*"
+    "@types/ember__service": "*"
+    "@types/ember__string": "*"
+    "@types/ember__template": "*"
+    "@types/ember__test": "*"
+    "@types/ember__utils": "*"
+    "@types/rsvp": "*"
+  checksum: cda022b2f439f20a60d0834f592459722819654cb48c8f6f3661ad64b3efc8230844f1b112b29995bac44e62b6c95a2caf1f0f330f0df9d56a141dcac6f2b7ca
   languageName: node
   linkType: hard
 
-"acorn@npm:^8.1.0":
-  version: 8.2.2
-  resolution: "acorn@npm:8.2.2"
-  bin:
-    acorn: bin/acorn
-  checksum: 46d3205ed296fa544b3d3f57880929ca7f7207e9aed7444ff1d73c21c7964e0c24a507799c334c0ab947cec3acb6dc9b831ec3ad01853e7db3da71ccdf4337f3
+"@types/ember__application@npm:*":
+  version: 4.0.11
+  resolution: "@types/ember__application@npm:4.0.11"
+  dependencies:
+    "@glimmer/component": ^1.1.0
+    "@types/ember": "*"
+    "@types/ember__engine": "*"
+    "@types/ember__object": "*"
+    "@types/ember__owner": "*"
+    "@types/ember__routing": "*"
+  checksum: ba9e913fd2d965f205923817cbdef1353cf05c496c76d6179f75af041b9a4fd0368f5dd96adfeb8df97bc398bfb34073cfd1c1a33bb10e63f065a2150b98c9ef
   languageName: node
   linkType: hard
 
-"acorn@npm:^8.5.0":
-  version: 8.7.1
-  resolution: "acorn@npm:8.7.1"
-  bin:
-    acorn: bin/acorn
-  checksum: aca0aabf98826717920ac2583fdcad0a6fbe4e583fdb6e843af2594e907455aeafe30b1e14f1757cd83ce1776773cf8296ffc3a4acf13f0bd3dfebcf1db6ae80
+"@types/ember__array@npm:*":
+  version: 4.0.10
+  resolution: "@types/ember__array@npm:4.0.10"
+  dependencies:
+    "@types/ember": "*"
+    "@types/ember__object": "*"
+  checksum: 3ec77e13466c130d1af8c468e4a8d33a35060ea89bbd7fdcaf48650f2a88e0a5cdfa3fd15a62e780531f0937e7115635600d6b7cd486398087391f5c900f5934
   languageName: node
   linkType: hard
 
-"acorn@npm:^8.7.1":
-  version: 8.8.2
-  resolution: "acorn@npm:8.8.2"
-  bin:
-    acorn: bin/acorn
-  checksum: f790b99a1bf63ef160c967e23c46feea7787e531292bb827126334612c234ed489a0dc2c7ba33156416f0ffa8d25bf2b0fdb7f35c2ba60eb3e960572bece4001
+"@types/ember__component@npm:*":
+  version: 4.0.22
+  resolution: "@types/ember__component@npm:4.0.22"
+  dependencies:
+    "@types/ember": "*"
+    "@types/ember__object": "*"
+  checksum: ef2b7141ca6dabbc311158a253ce6184d56ad691cb6fb22b0ff8f2ac0109fb4f929deef66ef56cf40a1b069cc52d23a1a6e3d511cab56fb29302b6be848e8259
   languageName: node
   linkType: hard
 
-"acorn@npm:^8.8.0":
-  version: 8.8.1
-  resolution: "acorn@npm:8.8.1"
-  bin:
-    acorn: bin/acorn
-  checksum: 4079b67283b94935157698831967642f24a075c52ce3feaaaafe095776dfbe15d86a1b33b1e53860fc0d062ed6c83f4284a5c87c85b9ad51853a01173da6097f
+"@types/ember__controller@npm:*":
+  version: 4.0.12
+  resolution: "@types/ember__controller@npm:4.0.12"
+  dependencies:
+    "@types/ember__object": "*"
+  checksum: 02001690069e1e537fc92d84d2de103693e499bc2c7ba12597a454aa7c45b7d1b93092232c44601d06915f28240ec189eb1ca0aaec139ebf39dd63e6b42b197b
   languageName: node
   linkType: hard
 
-"acorn@npm:^8.9.0":
-  version: 8.10.0
-  resolution: "acorn@npm:8.10.0"
-  bin:
-    acorn: bin/acorn
-  checksum: 538ba38af0cc9e5ef983aee196c4b8b4d87c0c94532334fa7e065b2c8a1f85863467bb774231aae91613fcda5e68740c15d97b1967ae3394d20faddddd8af61d
+"@types/ember__debug@npm:*":
+  version: 4.0.8
+  resolution: "@types/ember__debug@npm:4.0.8"
+  dependencies:
+    "@types/ember__object": "*"
+    "@types/ember__owner": "*"
+  checksum: a379664f6de9c63e37c6d834185e0609a7ee3e7993650912bf0a02c51770b94818b86fa7928b80f7df3b32e4cdcc5344917da65341d66d0950599ad11656e5a4
   languageName: node
   linkType: hard
 
-"agent-base@npm:6, agent-base@npm:^6.0.2":
-  version: 6.0.2
-  resolution: "agent-base@npm:6.0.2"
+"@types/ember__engine@npm:*":
+  version: 4.0.11
+  resolution: "@types/ember__engine@npm:4.0.11"
   dependencies:
-    debug: 4
-  checksum: f52b6872cc96fd5f622071b71ef200e01c7c4c454ee68bc9accca90c98cfb39f2810e3e9aa330435835eedc8c23f4f8a15267f67c6e245d2b33757575bdac49d
+    "@types/ember__object": "*"
+    "@types/ember__owner": "*"
+  checksum: 55a2fc9eb82f64e5d87d74b0624198b0ae898389ec5bb5ff845234aa60e4c8d72ccfe99bec449b3edd3f236f38d1ad5f07e64bb1daf9aacd0441a86041b4d56a
   languageName: node
   linkType: hard
 
-"agent-base@npm:^4.3.0":
-  version: 4.3.0
-  resolution: "agent-base@npm:4.3.0"
-  dependencies:
-    es6-promisify: ^5.0.0
-  checksum: 0c10891060e579c67efafd6b62223666c4b4129b521eac3e9ad272a137545bcedb54ce352273b7ad21a0024060e4f1360ae9a465ac87e2af18883c937d39979f
+"@types/ember__error@npm:*":
+  version: 4.0.6
+  resolution: "@types/ember__error@npm:4.0.6"
+  checksum: 8433d8960925ac59870f8152b32e9e2ee31fdcb89d2446d268a40fa68bd7551dc8cf168ff6d1dce66b56ad36a877c77e3c53da337259b76afc04b8553c995c84
   languageName: node
   linkType: hard
 
-"agentkeepalive@npm:^4.2.1":
-  version: 4.3.0
-  resolution: "agentkeepalive@npm:4.3.0"
+"@types/ember__object@npm:*":
+  version: 4.0.12
+  resolution: "@types/ember__object@npm:4.0.12"
   dependencies:
-    debug: ^4.1.0
-    depd: ^2.0.0
-    humanize-ms: ^1.2.1
-  checksum: 982453aa44c11a06826c836025e5162c846e1200adb56f2d075400da7d32d87021b3b0a58768d949d824811f5654223d5a8a3dad120921a2439625eb847c6260
+    "@types/ember": "*"
+    "@types/rsvp": "*"
+  checksum: 0c17e20b59e0c530be61cd539a01845aecebabb3750c0e2b5ca6af5118b3ddbffe75bedeaa1d279a19cbc216e1b6085207c130bf5c0cc9a172a354eb034c13d3
   languageName: node
   linkType: hard
 
-"aggregate-error@npm:^3.0.0":
-  version: 3.1.0
-  resolution: "aggregate-error@npm:3.1.0"
-  dependencies:
-    clean-stack: ^2.0.0
-    indent-string: ^4.0.0
-  checksum: 1101a33f21baa27a2fa8e04b698271e64616b886795fd43c31068c07533c7b3facfcaf4e9e0cab3624bd88f729a592f1c901a1a229c9e490eafce411a8644b79
+"@types/ember__owner@npm:*":
+  version: 4.0.9
+  resolution: "@types/ember__owner@npm:4.0.9"
+  checksum: b8e7aad0dac031e240f78b5b263e295da3d7450d6e4a76054be95b9e23e091edc4d7d728d098999722c7500616f33275d02f5b5c3095aa5f5b4c0d81e6052311
   languageName: node
   linkType: hard
 
-"ajv-errors@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "ajv-errors@npm:1.0.1"
-  peerDependencies:
-    ajv: ">=5.0.0"
-  checksum: 2c9fc02cf58f9aae5bace61ebd1b162e1ea372ae9db5999243ba5e32a9a78c0d635d29ae085f652c61c941a43af0b2b1acdb255e29d44dc43a6e021085716d8c
+"@types/ember__polyfills@npm:*":
+  version: 4.0.6
+  resolution: "@types/ember__polyfills@npm:4.0.6"
+  checksum: 331d2dd66d106ffd67866d20186da1d6321080692de174bc7f61618735228f67ae41bc435c79fbce9532bd0a63d3489f73843edefe555f63021d28ee70fb0ea8
   languageName: node
   linkType: hard
 
-"ajv-formats@npm:^2.1.1":
-  version: 2.1.1
-  resolution: "ajv-formats@npm:2.1.1"
+"@types/ember__routing@npm:*":
+  version: 4.0.22
+  resolution: "@types/ember__routing@npm:4.0.22"
   dependencies:
-    ajv: ^8.0.0
-  peerDependencies:
-    ajv: ^8.0.0
-  peerDependenciesMeta:
-    ajv:
-      optional: true
-  checksum: 4a287d937f1ebaad4683249a4c40c0fa3beed30d9ddc0adba04859026a622da0d317851316ea64b3680dc60f5c3c708105ddd5d5db8fe595d9d0207fd19f90b7
+    "@types/ember": "*"
+    "@types/ember__controller": "*"
+    "@types/ember__object": "*"
+    "@types/ember__service": "*"
+  checksum: 377ec37cc2e7062ae4d5423d056957825b7116fb749b55f505d9dce8c1e0affb330c4249c6db97eb76f0c738f1b45711e90a78c0d9af245015f8a8bfa9f6971c
   languageName: node
   linkType: hard
 
-"ajv-keywords@npm:^3.1.0, ajv-keywords@npm:^3.4.1, ajv-keywords@npm:^3.5.2":
-  version: 3.5.2
-  resolution: "ajv-keywords@npm:3.5.2"
-  peerDependencies:
-    ajv: ^6.9.1
-  checksum: 7dc5e5931677a680589050f79dcbe1fefbb8fea38a955af03724229139175b433c63c68f7ae5f86cf8f65d55eb7c25f75a046723e2e58296707617ca690feae9
+"@types/ember__runloop@npm:*":
+  version: 4.0.10
+  resolution: "@types/ember__runloop@npm:4.0.10"
+  dependencies:
+    "@types/ember": "*"
+  checksum: 9a25acc53969640324ef14b0802a57b1b34ba45d2bea4653d401be691c134584ccb43807218784ea8bcf4efcf680f941dc015bda9a8d63f13ed8f7fa4c4ed15a
   languageName: node
   linkType: hard
 
-"ajv-keywords@npm:^5.0.0":
-  version: 5.1.0
-  resolution: "ajv-keywords@npm:5.1.0"
+"@types/ember__service@npm:*":
+  version: 4.0.9
+  resolution: "@types/ember__service@npm:4.0.9"
   dependencies:
-    fast-deep-equal: ^3.1.3
-  peerDependencies:
-    ajv: ^8.8.2
-  checksum: c35193940b853119242c6757787f09ecf89a2c19bcd36d03ed1a615e710d19d450cb448bfda407b939aba54b002368c8bff30529cc50a0536a8e10bcce300421
+    "@types/ember__object": "*"
+  checksum: 1459e93f13a019a5d824349642aa39b7b7e1ddb6970f04592076b2c1f2027a98f43acf5bda20874cfe45821f8731e982abeff0f09bed6f00bdc468ba1ee28dfd
   languageName: node
   linkType: hard
 
-"ajv@npm:^6.1.0, ajv@npm:^6.10.0, ajv@npm:^6.10.2, ajv@npm:^6.12.3, ajv@npm:^6.12.4, ajv@npm:^6.12.5":
-  version: 6.12.6
-  resolution: "ajv@npm:6.12.6"
+"@types/ember__string@npm:*":
+  version: 3.16.3
+  resolution: "@types/ember__string@npm:3.16.3"
   dependencies:
-    fast-deep-equal: ^3.1.1
-    fast-json-stable-stringify: ^2.0.0
-    json-schema-traverse: ^0.4.1
-    uri-js: ^4.2.2
-  checksum: 874972efe5c4202ab0a68379481fbd3d1b5d0a7bd6d3cc21d40d3536ebff3352a2a1fabb632d4fd2cc7fe4cbdcd5ed6782084c9bbf7f32a1536d18f9da5007d4
+    "@types/ember__template": "*"
+  checksum: ee5998efc58c663dd316743ed91b1e0242321ccb79b83e2eae666e33570df8533a1ee25311ba156ec077ef63a8cbaadcf66d58cc440b86787e7a5f8e19f9f529
   languageName: node
   linkType: hard
 
-"ajv@npm:^8.0.0, ajv@npm:^8.8.0":
-  version: 8.11.0
-  resolution: "ajv@npm:8.11.0"
-  dependencies:
-    fast-deep-equal: ^3.1.1
-    json-schema-traverse: ^1.0.0
-    require-from-string: ^2.0.2
-    uri-js: ^4.2.2
-  checksum: 5e0ff226806763be73e93dd7805b634f6f5921e3e90ca04acdf8db81eed9d8d3f0d4c5f1213047f45ebbf8047ffe0c840fa1ef2ec42c3a644899f69aa72b5bef
+"@types/ember__template@npm:*":
+  version: 4.0.7
+  resolution: "@types/ember__template@npm:4.0.7"
+  checksum: 6641c12dc0d33d9dcf0d67306e42acbc3c9cca0d6c21d93d0c616eafa89a0ebb35f8253dc9bf6eeced3a84e3222f8b4f64bdf69de294e5a3e53e03ea414feac4
   languageName: node
   linkType: hard
 
-"ajv@npm:^8.0.1":
-  version: 8.2.0
-  resolution: "ajv@npm:8.2.0"
+"@types/ember__test@npm:*":
+  version: 4.0.6
+  resolution: "@types/ember__test@npm:4.0.6"
   dependencies:
-    fast-deep-equal: ^3.1.1
-    json-schema-traverse: ^1.0.0
-    require-from-string: ^2.0.2
-    uri-js: ^4.2.2
-  checksum: 36994bc227aac4c29ff967de5d53f087449ffab62d66f782f99c6aad8ac1d58db4eb7b0f78ce7961492eae00be51c2384b38b69e099d1021d41b2353dce91417
+    "@types/ember__application": "*"
+  checksum: aeea4a6b9f716e6205f2c7334f1047c2ed88573279d3b6fa6bf23780031ceaaa5f97bb9bf9f589b50dc77807d78d5fb868b727be34a8bb15bc673b5c5f6318a5
   languageName: node
   linkType: hard
 
-"amd-name-resolver@npm:1.2.0":
-  version: 1.2.0
-  resolution: "amd-name-resolver@npm:1.2.0"
+"@types/ember__utils@npm:*":
+  version: 4.0.7
+  resolution: "@types/ember__utils@npm:4.0.7"
   dependencies:
-    ensure-posix-path: ^1.0.1
-  checksum: f84474670f4ee5c36f78ed0fe3ff64039ff5c489e6c9a1b595fac32ede3ca33ec3c20ab58361f6ae7f191e5bff0347ac9dcff480f17824482d458bed6f7db6b9
+    "@types/ember": "*"
+  checksum: b14162ae496771afa41bbc2edf301edee62a52a43408c3c2b98337f8417ad47d187a205ab5235e11679af2002432f5bf447096ecdbc5e3a9b0b3aa163a1f603d
   languageName: node
   linkType: hard
 
-"amd-name-resolver@npm:1.3.1, amd-name-resolver@npm:^1.2.0, amd-name-resolver@npm:^1.3.1":
-  version: 1.3.1
-  resolution: "amd-name-resolver@npm:1.3.1"
+"@types/eslint@npm:^8.4.2, @types/eslint@npm:^8.4.9":
+  version: 8.56.12
+  resolution: "@types/eslint@npm:8.56.12"
   dependencies:
-    ensure-posix-path: ^1.0.1
-    object-hash: ^1.3.1
-  checksum: c48f68922f394078acaac97f1691a46dcb94fa3d5ee47b9a0c5b81bf66073005b75b5784f93ed6c1081b0afa92d41a5c581073960dbde9baa80b8abef4cccb2b
+    "@types/estree": "*"
+    "@types/json-schema": "*"
+  checksum: 0f7710ee02a256c499514251f527f84de964bb29487db840408e4cde79283124a38935597636d2265756c34dd1d902e1b00ae78930d4a0b55111909cb7b80d84
   languageName: node
   linkType: hard
 
-"amd-name-resolver@npm:^0.0.6":
-  version: 0.0.6
-  resolution: "amd-name-resolver@npm:0.0.6"
+"@types/estree@npm:*, @types/estree@npm:^1.0.5":
+  version: 1.0.7
+  resolution: "@types/estree@npm:1.0.7"
+  checksum: d9312b7075bdd08f3c9e1bb477102f5458aaa42a8eec31a169481ce314ca99ac716645cff4fca81ea65a2294b0276a0de63159d1baca0f8e7b5050a92de950ad
+  languageName: node
+  linkType: hard
+
+"@types/express-serve-static-core@npm:^4.17.33":
+  version: 4.19.6
+  resolution: "@types/express-serve-static-core@npm:4.19.6"
   dependencies:
-    ensure-posix-path: ^1.0.1
-  checksum: f0e4f03654b2b523a35a3ba5ae5fc6c9f637242cea75ef6470baea5f997a9206e60e23489f7d1c5adc4c3ac88c25008ca7ec4a92cf21b23b253141e2962c990c
+    "@types/node": "*"
+    "@types/qs": "*"
+    "@types/range-parser": "*"
+    "@types/send": "*"
+  checksum: b0576eddc2d25ccdf10e68ba09598b87a4d7b2ad04a81dc847cb39fe56beb0b6a5cc017b1e00aa0060cb3b38e700384ce96d291a116a0f1e54895564a104aae9
   languageName: node
   linkType: hard
 
-"amdefine@npm:>=0.0.4":
-  version: 1.0.1
-  resolution: "amdefine@npm:1.0.1"
-  checksum: 9d4e15b94641643a9385b2841b4cb2bcf4e8e2f741ea4bd475c93ad7bab261ad4ed827a32e9c549b38b98759c4526c173ae4e6dde8caeb75ee5cebedc9863762
+"@types/express@npm:^4.17.2":
+  version: 4.17.22
+  resolution: "@types/express@npm:4.17.22"
+  dependencies:
+    "@types/body-parser": "*"
+    "@types/express-serve-static-core": ^4.17.33
+    "@types/qs": "*"
+    "@types/serve-static": "*"
+  checksum: 977b1da93765983d823c32898c74c159f30b98341f4fd9400724f18196913fe0a07fa12eaa4efdad3cc8cf31e4036e06a16a88d43e9e1f78bbbb84365026aab0
   languageName: node
   linkType: hard
 
-"anchor-markdown-header@npm:^0.5.7":
-  version: 0.5.7
-  resolution: "anchor-markdown-header@npm:0.5.7"
+"@types/fs-extra@npm:^5.0.5":
+  version: 5.1.0
+  resolution: "@types/fs-extra@npm:5.1.0"
   dependencies:
-    emoji-regex: ~6.1.0
-  checksum: 97ed56c61ca8aacca635378de4959fd95929c4966f96e6483df06d5b22b541924e91569c819c49cbed8e8684b3b77eb5760216bc9bd11e54bb58389ce29cedaa
+    "@types/node": "*"
+  checksum: 9b4abc891ad0dc3baa77b0ebcf91dff8e7a5936aa037de0bd6ded399ab38b5896be1ee02b5c0a18c0915cfc40ab590a915709e6f2beef8f6f7e16fd3759e469a
   languageName: node
   linkType: hard
 
-"ansi-colors@npm:^4.1.1":
-  version: 4.1.1
-  resolution: "ansi-colors@npm:4.1.1"
-  checksum: 138d04a51076cb085da0a7e2d000c5c0bb09f6e772ed5c65c53cb118d37f6c5f1637506d7155fb5f330f0abcf6f12fa2e489ac3f8cdab9da393bf1bb4f9a32b0
+"@types/fs-extra@npm:^8.1.0":
+  version: 8.1.5
+  resolution: "@types/fs-extra@npm:8.1.5"
+  dependencies:
+    "@types/node": "*"
+  checksum: a76db2a9640a24c7cb7a75981113ccec1be8a876453beb0a4d51ea8df5980562b6a6d2adf70cab0a9ccb4f1fa677c7900c875ce0a73e48105bb100cb043461f0
   languageName: node
   linkType: hard
 
-"ansi-escapes@npm:^3.2.0":
-  version: 3.2.0
-  resolution: "ansi-escapes@npm:3.2.0"
-  checksum: 0f94695b677ea742f7f1eed961f7fd8d05670f744c6ad1f8f635362f6681dcfbc1575cb05b43abc7bb6d67e25a75fb8c7ea8f2a57330eb2c76b33f18cb2cef0a
+"@types/fs-extra@npm:^9.0.12":
+  version: 9.0.13
+  resolution: "@types/fs-extra@npm:9.0.13"
+  dependencies:
+    "@types/node": "*"
+  checksum: add79e212acd5ac76b97b9045834e03a7996aef60a814185e0459088fd290519a3c1620865d588fa36c4498bf614210d2a703af5cf80aa1dbc125db78f6edac3
   languageName: node
   linkType: hard
 
-"ansi-escapes@npm:^4.2.1, ansi-escapes@npm:^4.3.0":
-  version: 4.3.2
-  resolution: "ansi-escapes@npm:4.3.2"
+"@types/glob@npm:*":
+  version: 8.1.0
+  resolution: "@types/glob@npm:8.1.0"
   dependencies:
-    type-fest: ^0.21.3
-  checksum: 93111c42189c0a6bed9cdb4d7f2829548e943827ee8479c74d6e0b22ee127b2a21d3f8b5ca57723b8ef78ce011fbfc2784350eb2bde3ccfccf2f575fa8489815
+    "@types/minimatch": ^5.1.2
+    "@types/node": "*"
+  checksum: 9101f3a9061e40137190f70626aa0e202369b5ec4012c3fabe6f5d229cce04772db9a94fa5a0eb39655e2e4ad105c38afbb4af56a56c0996a8c7d4fc72350e3d
   languageName: node
   linkType: hard
 
-"ansi-html@npm:^0.0.7":
-  version: 0.0.7
-  resolution: "ansi-html@npm:0.0.7"
-  bin:
-    ansi-html: ./bin/ansi-html
-  checksum: 9b839ce99650b4c2d83621d67d68622d27e7948b54f7a4386f2218a3997ee4e684e5a6e8d290880c3f3260e8d90c2613c59c7028f04992ad5c8d99d3a0fcc02c
+"@types/glob@npm:^7.1.1":
+  version: 7.2.0
+  resolution: "@types/glob@npm:7.2.0"
+  dependencies:
+    "@types/minimatch": "*"
+    "@types/node": "*"
+  checksum: 6ae717fedfdfdad25f3d5a568323926c64f52ef35897bcac8aca8e19bc50c0bd84630bbd063e5d52078b2137d8e7d3c26eabebd1a2f03ff350fff8a91e79fc19
   languageName: node
   linkType: hard
 
-"ansi-regex@npm:^2.0.0":
-  version: 2.1.1
-  resolution: "ansi-regex@npm:2.1.1"
-  checksum: 190abd03e4ff86794f338a31795d262c1dfe8c91f7e01d04f13f646f1dcb16c5800818f886047876f1272f065570ab86b24b99089f8b68a0e11ff19aed4ca8f1
+"@types/http-errors@npm:*":
+  version: 2.0.4
+  resolution: "@types/http-errors@npm:2.0.4"
+  checksum: 1f3d7c3b32c7524811a45690881736b3ef741bf9849ae03d32ad1ab7062608454b150a4e7f1351f83d26a418b2d65af9bdc06198f1c079d75578282884c4e8e3
   languageName: node
   linkType: hard
 
-"ansi-regex@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "ansi-regex@npm:3.0.0"
-  checksum: 2ad11c416f81c39f5c65eafc88cf1d71aa91d76a2f766e75e457c2a3c43e8a003aadbf2966b61c497aa6a6940a36412486c975b3270cdfc3f413b69826189ec3
+"@types/jquery@npm:^3.5.14":
+  version: 3.5.32
+  resolution: "@types/jquery@npm:3.5.32"
+  dependencies:
+    "@types/sizzle": "*"
+  checksum: 7fe7251bda3fc9d80417ef7c88ad963ccb591706bca2fb84ea5d9600498a8f9911c32302f28fd1910bb212c34193f38f63818757a9833b70e1f46c3a98a17625
   languageName: node
   linkType: hard
 
-"ansi-regex@npm:^4.1.0":
-  version: 4.1.0
-  resolution: "ansi-regex@npm:4.1.0"
-  checksum: 97aa4659538d53e5e441f5ef2949a3cffcb838e57aeaad42c4194e9d7ddb37246a6526c4ca85d3940a9d1e19b11cc2e114530b54c9d700c8baf163c31779baf8
+"@types/json-schema@npm:*, @types/json-schema@npm:^7.0.5, @types/json-schema@npm:^7.0.8, @types/json-schema@npm:^7.0.9":
+  version: 7.0.15
+  resolution: "@types/json-schema@npm:7.0.15"
+  checksum: 97ed0cb44d4070aecea772b7b2e2ed971e10c81ec87dd4ecc160322ffa55ff330dace1793489540e3e318d90942064bb697cc0f8989391797792d919737b3b98
   languageName: node
   linkType: hard
 
-"ansi-regex@npm:^5.0.0":
+"@types/linkify-it@npm:^5":
   version: 5.0.0
-  resolution: "ansi-regex@npm:5.0.0"
-  checksum: b1bb4e992a5d96327bb4f72eaba9f8047f1d808d273ad19d399e266bfcc7fb19a4d1a127a32f7bc61fe46f1a94a4d04ec4c424e3fbe184929aa866323d8ed4ce
+  resolution: "@types/linkify-it@npm:5.0.0"
+  checksum: ec98e03aa883f70153a17a1e6ed9e28b39a604049b485daeddae3a1482ec65cac0817520be6e301d99fd1a934b3950cf0f855655aae6ec27da2bb676ba4a148e
   languageName: node
   linkType: hard
 
-"ansi-regex@npm:^5.0.1":
-  version: 5.0.1
-  resolution: "ansi-regex@npm:5.0.1"
-  checksum: 2aa4bb54caf2d622f1afdad09441695af2a83aa3fe8b8afa581d205e57ed4261c183c4d3877cee25794443fde5876417d859c108078ab788d6af7e4fe52eb66b
+"@types/markdown-it@npm:^14.1.1":
+  version: 14.1.2
+  resolution: "@types/markdown-it@npm:14.1.2"
+  dependencies:
+    "@types/linkify-it": ^5
+    "@types/mdurl": ^2
+  checksum: ad66e0b377d6af09a155bb65f675d1e2cb27d20a3d407377fe4508eb29cde1e765430b99d5129f89012e2524abb5525d629f7057a59ff9fd0967e1ff645b9ec6
   languageName: node
   linkType: hard
 
-"ansi-regex@npm:^6.0.1":
-  version: 6.0.1
-  resolution: "ansi-regex@npm:6.0.1"
-  checksum: 1ff8b7667cded1de4fa2c9ae283e979fc87036864317da86a2e546725f96406746411d0d85e87a2d12fa5abd715d90006de7fa4fa0477c92321ad3b4c7d4e169
+"@types/mdast@npm:^3.0.0, @types/mdast@npm:^3.0.3":
+  version: 3.0.15
+  resolution: "@types/mdast@npm:3.0.15"
+  dependencies:
+    "@types/unist": ^2
+  checksum: af85042a4e3af3f879bde4059fa9e76c71cb552dffc896cdcc6cf9dc1fd38e37035c2dbd6245cfa6535b433f1f0478f5549696234ccace47a64055a10c656530
   languageName: node
   linkType: hard
 
-"ansi-styles@npm:^2.2.1":
-  version: 2.2.1
-  resolution: "ansi-styles@npm:2.2.1"
-  checksum: ebc0e00381f2a29000d1dac8466a640ce11943cef3bda3cd0020dc042e31e1058ab59bf6169cd794a54c3a7338a61ebc404b7c91e004092dd20e028c432c9c2c
+"@types/mdurl@npm:^2":
+  version: 2.0.0
+  resolution: "@types/mdurl@npm:2.0.0"
+  checksum: 78746e96c655ceed63db06382da466fd52c7e9dc54d60b12973dfdd110cae06b9439c4b90e17bb8d4461109184b3ea9f3e9f96b3e4bf4aa9fe18b6ac35f283c8
   languageName: node
   linkType: hard
 
-"ansi-styles@npm:^3.0.0, ansi-styles@npm:^3.2.0, ansi-styles@npm:^3.2.1":
-  version: 3.2.1
-  resolution: "ansi-styles@npm:3.2.1"
-  dependencies:
-    color-convert: ^1.9.0
-  checksum: d85ade01c10e5dd77b6c89f34ed7531da5830d2cb5882c645f330079975b716438cd7ebb81d0d6e6b4f9c577f19ae41ab55f07f19786b02f9dfd9e0377395665
+"@types/mime@npm:^1":
+  version: 1.3.5
+  resolution: "@types/mime@npm:1.3.5"
+  checksum: e29a5f9c4776f5229d84e525b7cd7dd960b51c30a0fb9a028c0821790b82fca9f672dab56561e2acd9e8eed51d431bde52eafdfef30f643586c4162f1aecfc78
   languageName: node
   linkType: hard
 
-"ansi-styles@npm:^4.0.0, ansi-styles@npm:^4.1.0":
-  version: 4.3.0
-  resolution: "ansi-styles@npm:4.3.0"
-  dependencies:
-    color-convert: ^2.0.1
-  checksum: 513b44c3b2105dd14cc42a19271e80f386466c4be574bccf60b627432f9198571ebf4ab1e4c3ba17347658f4ee1711c163d574248c0c1cdc2d5917a0ad582ec4
+"@types/minimatch@npm:*, @types/minimatch@npm:^5.1.2":
+  version: 5.1.2
+  resolution: "@types/minimatch@npm:5.1.2"
+  checksum: 0391a282860c7cb6fe262c12b99564732401bdaa5e395bee9ca323c312c1a0f45efbf34dce974682036e857db59a5c9b1da522f3d6055aeead7097264c8705a8
   languageName: node
   linkType: hard
 
-"ansi-styles@npm:^6.1.0":
-  version: 6.2.1
-  resolution: "ansi-styles@npm:6.2.1"
-  checksum: ef940f2f0ced1a6347398da88a91da7930c33ecac3c77b72c5905f8b8fe402c52e6fde304ff5347f616e27a742da3f1dc76de98f6866c69251ad0b07a66776d9
+"@types/minimatch@npm:^3.0.3, @types/minimatch@npm:^3.0.4":
+  version: 3.0.5
+  resolution: "@types/minimatch@npm:3.0.5"
+  checksum: c41d136f67231c3131cf1d4ca0b06687f4a322918a3a5adddc87ce90ed9dbd175a3610adee36b106ae68c0b92c637c35e02b58c8a56c424f71d30993ea220b92
   languageName: node
   linkType: hard
 
-"ansi-styles@npm:~1.0.0":
-  version: 1.0.0
-  resolution: "ansi-styles@npm:1.0.0"
-  checksum: 6dd47dccb268b4cc1fd0dd6617067a7acd34ad2761f0438800fdd55c0d45f50a90787acd82806009c2bf467f4e2920166be03e19b23529038c1c4527d80f598b
+"@types/node@npm:*, @types/node@npm:>=10.0.0":
+  version: 22.15.21
+  resolution: "@types/node@npm:22.15.21"
+  dependencies:
+    undici-types: ~6.21.0
+  checksum: 989f1ce3a99916a7298ae885210385fbcb339b07f8ef420b015d69dd68863aca68aeae07833736b300720d9394b8e1875600ce74166c24957d9907d29de0b788
   languageName: node
   linkType: hard
 
-"ansi-to-html@npm:^0.6.15, ansi-to-html@npm:^0.6.6":
-  version: 0.6.15
-  resolution: "ansi-to-html@npm:0.6.15"
-  dependencies:
-    entities: ^2.0.0
-  bin:
-    ansi-to-html: bin/ansi-to-html
-  checksum: c899362a29b92c8ae075b72168b826f7c233875b475719304942f80695e0ce4a6812845021192da5fb0ac80b10209b4fae5aede42620a1b1b3d3b30f3ef77a86
+"@types/prettier@npm:^2.6.0":
+  version: 2.7.3
+  resolution: "@types/prettier@npm:2.7.3"
+  checksum: 705384209cea6d1433ff6c187c80dcc0b95d99d5c5ce21a46a9a58060c527973506822e428789d842761e0280d25e3359300f017fbe77b9755bc772ab3dc2f83
   languageName: node
   linkType: hard
 
-"ansicolors@npm:~0.2.1":
-  version: 0.2.1
-  resolution: "ansicolors@npm:0.2.1"
-  checksum: 7120ca45a780cf17d786070874776637adcc107cf2bb9b38934f92d88cb5c3d16e1e7092708ba0f64f2031e6c10844c26e8a13d9e27f7b058c36ad8950cbfd02
+"@types/qs@npm:*":
+  version: 6.14.0
+  resolution: "@types/qs@npm:6.14.0"
+  checksum: 1909205514d22b3cbc7c2314e2bd8056d5f05dfb21cf4377f0730ee5e338ea19957c41735d5e4806c746176563f50005bbab602d8358432e25d900bdf4970826
   languageName: node
   linkType: hard
 
-"anymatch@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "anymatch@npm:2.0.0"
-  dependencies:
-    micromatch: ^3.1.4
-    normalize-path: ^2.1.1
-  checksum: f7bb1929842b4585cdc28edbb385767d499ce7d673f96a8f11348d2b2904592ffffc594fe9229b9a1e9e4dccb9329b7692f9f45e6a11dcefbb76ecdc9ab740f6
+"@types/qunit@npm:~2.19.12":
+  version: 2.19.12
+  resolution: "@types/qunit@npm:2.19.12"
+  checksum: 00f29247692f3a59977d272474e7d3682d0149cbd4c26abe31025e51763f7cae0918e20545a1dad76c213fe6187473fbb41457c052c358fdde9ec4c002544b3e
   languageName: node
   linkType: hard
 
-"anymatch@npm:^3.1.1, anymatch@npm:~3.1.1":
-  version: 3.1.2
-  resolution: "anymatch@npm:3.1.2"
-  dependencies:
-    normalize-path: ^3.0.0
-    picomatch: ^2.0.4
-  checksum: 985163db2292fac9e5a1e072bf99f1b5baccf196e4de25a0b0b81865ebddeb3b3eb4480734ef0a2ac8c002845396b91aa89121f5b84f93981a4658164a9ec6e9
+"@types/range-parser@npm:*":
+  version: 1.2.7
+  resolution: "@types/range-parser@npm:1.2.7"
+  checksum: 95640233b689dfbd85b8c6ee268812a732cf36d5affead89e806fe30da9a430767af8ef2cd661024fd97e19d61f3dec75af2df5e80ec3bea000019ab7028629a
   languageName: node
   linkType: hard
 
-"anymatch@npm:~3.1.2":
-  version: 3.1.3
-  resolution: "anymatch@npm:3.1.3"
+"@types/rimraf@npm:^2.0.2, @types/rimraf@npm:^2.0.3":
+  version: 2.0.5
+  resolution: "@types/rimraf@npm:2.0.5"
   dependencies:
-    normalize-path: ^3.0.0
-    picomatch: ^2.0.4
-  checksum: 3e044fd6d1d26545f235a9fe4d7a534e2029d8e59fa7fd9f2a6eb21230f6b5380ea1eaf55136e60cbf8e613544b3b766e7a6fa2102e2a3a117505466e3025dc2
+    "@types/glob": "*"
+    "@types/node": "*"
+  checksum: e388f546840704a240fb31536498921623bca4ec1230925013d6b6d7c7d2211c8ec07fcbbd2606151d7549cbbc28a01c18fb0df502107a9293860a5ff64bc147
   languageName: node
   linkType: hard
 
-"aproba@npm:^1.0.3 || ^2.0.0":
-  version: 2.0.0
-  resolution: "aproba@npm:2.0.0"
-  checksum: 5615cadcfb45289eea63f8afd064ab656006361020e1735112e346593856f87435e02d8dcc7ff0d11928bc7d425f27bc7c2a84f6c0b35ab0ff659c814c138a24
+"@types/rsvp@npm:*, @types/rsvp@npm:~4.0.9":
+  version: 4.0.9
+  resolution: "@types/rsvp@npm:4.0.9"
+  checksum: 2c93a5bab22bd0ecfb6ecc238ca1e7e1dd0dff870d63eb63670d33148112f9d66b0af832e5c31cc0aa6534ab916092938a9b64072377070832808b7b36283a27
   languageName: node
   linkType: hard
 
-"aproba@npm:^1.1.1":
-  version: 1.2.0
-  resolution: "aproba@npm:1.2.0"
-  checksum: 0fca141966559d195072ed047658b6e6c4fe92428c385dd38e288eacfc55807e7b4989322f030faff32c0f46bb0bc10f1e0ac32ec22d25315a1e5bbc0ebb76dc
+"@types/semver@npm:^7.3.12":
+  version: 7.7.0
+  resolution: "@types/semver@npm:7.7.0"
+  checksum: d488eaeddb23879a0a8a759bed667e1a76cb0dd4d23e3255538e24c189db387357953ca9e7a3bda2bb7f95e84cac8fe0db4fbe6b3456e893043337732d1d23cc
   languageName: node
   linkType: hard
 
-"are-we-there-yet@npm:^3.0.0":
-  version: 3.0.1
-  resolution: "are-we-there-yet@npm:3.0.1"
+"@types/send@npm:*":
+  version: 0.17.4
+  resolution: "@types/send@npm:0.17.4"
   dependencies:
-    delegates: ^1.0.0
-    readable-stream: ^3.6.0
-  checksum: 52590c24860fa7173bedeb69a4c05fb573473e860197f618b9a28432ee4379049336727ae3a1f9c4cb083114601c1140cee578376164d0e651217a9843f9fe83
+    "@types/mime": ^1
+    "@types/node": "*"
+  checksum: cf4db48251bbb03cd6452b4de6e8e09e2d75390a92fd798eca4a803df06444adc94ed050246c94c7ed46fb97be1f63607f0e1f13c3ce83d71788b3e08640e5e0
   languageName: node
   linkType: hard
 
-"are-we-there-yet@npm:^4.0.0":
-  version: 4.0.1
-  resolution: "are-we-there-yet@npm:4.0.1"
+"@types/serve-static@npm:*":
+  version: 1.15.7
+  resolution: "@types/serve-static@npm:1.15.7"
   dependencies:
-    delegates: ^1.0.0
-    readable-stream: ^4.1.0
-  checksum: 16871ee259e138bfab60800ae5b53406fb1b72b5d356f98b13c1b222bb2a13d9bc4292d79f4521fb0eca10874eb3838ae0d9f721f3bb34ddd37ee8f949831800
+    "@types/http-errors": "*"
+    "@types/node": "*"
+    "@types/send": "*"
+  checksum: bbbf00dbd84719da2250a462270dc68964006e8d62f41fe3741abd94504ba3688f420a49afb2b7478921a1544d3793183ffa097c5724167da777f4e0c7f1a7d6
   languageName: node
   linkType: hard
 
-"argparse@npm:^1.0.7":
-  version: 1.0.10
-  resolution: "argparse@npm:1.0.10"
-  dependencies:
-    sprintf-js: ~1.0.2
-  checksum: 7ca6e45583a28de7258e39e13d81e925cfa25d7d4aacbf806a382d3c02fcb13403a07fb8aeef949f10a7cfe4a62da0e2e807b348a5980554cc28ee573ef95945
+"@types/shell-quote@npm:~1.7.5":
+  version: 1.7.5
+  resolution: "@types/shell-quote@npm:1.7.5"
+  checksum: 32b4d697c7d23dbadf40713692c47f1595f083a3b3deea76cb18e30a05d197aa9205d2b87f6d92edb60cda120b51e35d32bda96ed9b0a7e32921eed2deb4559e
   languageName: node
   linkType: hard
 
-"argparse@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "argparse@npm:2.0.1"
-  checksum: 83644b56493e89a254bae05702abf3a1101b4fa4d0ca31df1c9985275a5a5bd47b3c27b7fa0b71098d41114d8ca000e6ed90cad764b306f8a503665e4d517ced
+"@types/sinon@npm:^17.0.3":
+  version: 17.0.4
+  resolution: "@types/sinon@npm:17.0.4"
+  dependencies:
+    "@types/sinonjs__fake-timers": "*"
+  checksum: 487f43bda8d8b2ef32d1b3c08e5a68e17705d2c7470ea89c8fd62e3a086f9a35faf65d37a57bf189004c4e7adbc5f9562dfaa332c54e06a8d99fc7361f3ac004
   languageName: node
   linkType: hard
 
-"aria-query@npm:^5.0.2":
-  version: 5.1.3
-  resolution: "aria-query@npm:5.1.3"
-  dependencies:
-    deep-equal: ^2.0.5
-  checksum: 929ff95f02857b650fb4cbcd2f41072eee2f46159a6605ea03bf63aa572e35ffdff43d69e815ddc462e16e07de8faba3978afc2813650b4448ee18c9895d982b
+"@types/sinonjs__fake-timers@npm:*":
+  version: 8.1.5
+  resolution: "@types/sinonjs__fake-timers@npm:8.1.5"
+  checksum: 7e3c08f6c13df44f3ea7d9a5155ddf77e3f7314c156fa1c5a829a4f3763bafe2f75b1283b887f06e6b4296996a2f299b70f64ff82625f9af5885436e2524d10c
   languageName: node
   linkType: hard
 
-"arr-diff@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "arr-diff@npm:4.0.0"
-  checksum: ea7c8834842ad3869297f7915689bef3494fd5b102ac678c13ffccab672d3d1f35802b79e90c4cfec2f424af3392e44112d1ccf65da34562ed75e049597276a0
+"@types/sizzle@npm:*":
+  version: 2.3.9
+  resolution: "@types/sizzle@npm:2.3.9"
+  checksum: 413811a79e7e9f1d8f47e6047ae0aea1530449d612304cdda1c30018e3d053b8544861ec2c70bdeca75a0a010192e6bb78efc6fb4caaafdd65c4eee90066686a
   languageName: node
   linkType: hard
 
-"arr-flatten@npm:^1.1.0":
-  version: 1.1.0
-  resolution: "arr-flatten@npm:1.1.0"
-  checksum: 963fe12564fca2f72c055f3f6c206b9e031f7c433a0c66ca9858b484821f248c5b1e5d53c8e4989d80d764cd776cf6d9b160ad05f47bdc63022bfd63b5455e22
+"@types/symlink-or-copy@npm:^1.2.0":
+  version: 1.2.2
+  resolution: "@types/symlink-or-copy@npm:1.2.2"
+  checksum: fb8fc2a356d1d7ab222bbea772ca6bf1b4a90b1f14ea46c1522643d3afd018f3b938ead7ba04af88175432a07497c02904bf428008505acf8a4745f1bc6e3892
   languageName: node
   linkType: hard
 
-"arr-union@npm:^3.1.0":
-  version: 3.1.0
-  resolution: "arr-union@npm:3.1.0"
-  checksum: b5b0408c6eb7591143c394f3be082fee690ddd21f0fdde0a0a01106799e847f67fcae1b7e56b0a0c173290e29c6aca9562e82b300708a268bc8f88f3d6613cb9
+"@types/tmp@npm:^0.0.33":
+  version: 0.0.33
+  resolution: "@types/tmp@npm:0.0.33"
+  checksum: b6963af74092bd56a1a9a7936a1a6de45ddbd5e774f9fc904f16b7e2ada79da8a769e0c5b9df083064b8080bb260c4973ba4307640b7b7a75ed1c47bda8c4110
   languageName: node
   linkType: hard
 
-"array-buffer-byte-length@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "array-buffer-byte-length@npm:1.0.0"
-  dependencies:
-    call-bind: ^1.0.2
-    is-array-buffer: ^3.0.1
-  checksum: 044e101ce150f4804ad19c51d6c4d4cfa505c5b2577bd179256e4aa3f3f6a0a5e9874c78cd428ee566ac574c8a04d7ce21af9fe52e844abfdccb82b33035a7c3
+"@types/trusted-types@npm:^2.0.7":
+  version: 2.0.7
+  resolution: "@types/trusted-types@npm:2.0.7"
+  checksum: 8e4202766a65877efcf5d5a41b7dd458480b36195e580a3b1085ad21e948bc417d55d6f8af1fd2a7ad008015d4117d5fdfe432731157da3c68678487174e4ba3
   languageName: node
   linkType: hard
 
-"array-equal@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "array-equal@npm:1.0.0"
-  checksum: 3f68045806357db9b2fa1ad583e42a659de030633118a0cd35ee4975cb20db3b9a3d36bbec9b5afe70011cf989eefd215c12fe0ce08c498f770859ca6e70688a
+"@types/unist@npm:^2, @types/unist@npm:^2.0.0, @types/unist@npm:^2.0.2, @types/unist@npm:^2.0.3":
+  version: 2.0.11
+  resolution: "@types/unist@npm:2.0.11"
+  checksum: 6d436e832bc35c6dde9f056ac515ebf2b3384a1d7f63679d12358766f9b313368077402e9c1126a14d827f10370a5485e628bf61aa91117cf4fc882423191a4e
   languageName: node
   linkType: hard
 
-"array-flatten@npm:1.1.1":
-  version: 1.1.1
-  resolution: "array-flatten@npm:1.1.1"
-  checksum: a9925bf3512d9dce202112965de90c222cd59a4fbfce68a0951d25d965cf44642931f40aac72309c41f12df19afa010ecadceb07cfff9ccc1621e99d89ab5f3b
+"@typescript-eslint/eslint-plugin@npm:~5.62.0":
+  version: 5.62.0
+  resolution: "@typescript-eslint/eslint-plugin@npm:5.62.0"
+  dependencies:
+    "@eslint-community/regexpp": ^4.4.0
+    "@typescript-eslint/scope-manager": 5.62.0
+    "@typescript-eslint/type-utils": 5.62.0
+    "@typescript-eslint/utils": 5.62.0
+    debug: ^4.3.4
+    graphemer: ^1.4.0
+    ignore: ^5.2.0
+    natural-compare-lite: ^1.4.0
+    semver: ^7.3.7
+    tsutils: ^3.21.0
+  peerDependencies:
+    "@typescript-eslint/parser": ^5.0.0
+    eslint: ^6.0.0 || ^7.0.0 || ^8.0.0
+  peerDependenciesMeta:
+    typescript:
+      optional: true
+  checksum: fc104b389c768f9fa7d45a48c86d5c1ad522c1d0512943e782a56b1e3096b2cbcc1eea3fcc590647bf0658eef61aac35120a9c6daf979bf629ad2956deb516a1
   languageName: node
   linkType: hard
 
-"array-from@npm:^2.1.1":
-  version: 2.1.1
-  resolution: "array-from@npm:2.1.1"
-  checksum: 4cd5fa27aa6133b99a57c2881d2a8a66ec59b8e17a0c900f7e8ac9a0a2fae450ed682b67435467bfa71ac9328d025a760c5c46a95586a352180c5a79fc13015d
+"@typescript-eslint/parser@npm:^5.10.0, @typescript-eslint/parser@npm:~5.62.0":
+  version: 5.62.0
+  resolution: "@typescript-eslint/parser@npm:5.62.0"
+  dependencies:
+    "@typescript-eslint/scope-manager": 5.62.0
+    "@typescript-eslint/types": 5.62.0
+    "@typescript-eslint/typescript-estree": 5.62.0
+    debug: ^4.3.4
+  peerDependencies:
+    eslint: ^6.0.0 || ^7.0.0 || ^8.0.0
+  peerDependenciesMeta:
+    typescript:
+      optional: true
+  checksum: d168f4c7f21a7a63f47002e2d319bcbb6173597af5c60c1cf2de046b46c76b4930a093619e69faf2d30214c29ab27b54dcf1efc7046a6a6bd6f37f59a990e752
   languageName: node
   linkType: hard
 
-"array-to-error@npm:^1.0.0":
-  version: 1.1.1
-  resolution: "array-to-error@npm:1.1.1"
+"@typescript-eslint/scope-manager@npm:5.62.0":
+  version: 5.62.0
+  resolution: "@typescript-eslint/scope-manager@npm:5.62.0"
   dependencies:
-    array-to-sentence: ^1.1.0
-  checksum: c476c79249b4852f4ae6e2cff1463c3343986d1324e273c6404ccea1748a5b1900d05e774fc84f3f29c964aa4d36702d5c0426034856197da73557797c947e0f
+    "@typescript-eslint/types": 5.62.0
+    "@typescript-eslint/visitor-keys": 5.62.0
+  checksum: 6062d6b797fe1ce4d275bb0d17204c827494af59b5eaf09d8a78cdd39dadddb31074dded4297aaf5d0f839016d601032857698b0e4516c86a41207de606e9573
   languageName: node
   linkType: hard
 
-"array-to-sentence@npm:^1.1.0":
-  version: 1.1.0
-  resolution: "array-to-sentence@npm:1.1.0"
-  checksum: 7252ed7b93c6c5f07afcc67feef34b68f9b0b744f00fc7317e6d12f2c3320dc5417cedfc0c23497cc867ebdeca0573486ca8e6b09a515c5e6a90e860c668f2b6
+"@typescript-eslint/type-utils@npm:5.62.0":
+  version: 5.62.0
+  resolution: "@typescript-eslint/type-utils@npm:5.62.0"
+  dependencies:
+    "@typescript-eslint/typescript-estree": 5.62.0
+    "@typescript-eslint/utils": 5.62.0
+    debug: ^4.3.4
+    tsutils: ^3.21.0
+  peerDependencies:
+    eslint: "*"
+  peerDependenciesMeta:
+    typescript:
+      optional: true
+  checksum: fc41eece5f315dfda14320be0da78d3a971d650ea41300be7196934b9715f3fe1120a80207551eb71d39568275dbbcf359bde540d1ca1439d8be15e9885d2739
   languageName: node
   linkType: hard
 
-"array-union@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "array-union@npm:2.1.0"
-  checksum: 5bee12395cba82da674931df6d0fea23c4aa4660cb3b338ced9f828782a65caa232573e6bf3968f23e0c5eb301764a382cef2f128b170a9dc59de0e36c39f98d
+"@typescript-eslint/types@npm:5.62.0":
+  version: 5.62.0
+  resolution: "@typescript-eslint/types@npm:5.62.0"
+  checksum: 48c87117383d1864766486f24de34086155532b070f6264e09d0e6139449270f8a9559cfef3c56d16e3bcfb52d83d42105d61b36743626399c7c2b5e0ac3b670
   languageName: node
   linkType: hard
 
-"array-unique@npm:^0.3.2":
-  version: 0.3.2
-  resolution: "array-unique@npm:0.3.2"
-  checksum: da344b89cfa6b0a5c221f965c21638bfb76b57b45184a01135382186924f55973cd9b171d4dad6bf606c6d9d36b0d721d091afdc9791535ead97ccbe78f8a888
+"@typescript-eslint/typescript-estree@npm:5.62.0":
+  version: 5.62.0
+  resolution: "@typescript-eslint/typescript-estree@npm:5.62.0"
+  dependencies:
+    "@typescript-eslint/types": 5.62.0
+    "@typescript-eslint/visitor-keys": 5.62.0
+    debug: ^4.3.4
+    globby: ^11.1.0
+    is-glob: ^4.0.3
+    semver: ^7.3.7
+    tsutils: ^3.21.0
+  peerDependenciesMeta:
+    typescript:
+      optional: true
+  checksum: 3624520abb5807ed8f57b1197e61c7b1ed770c56dfcaca66372d584ff50175225798bccb701f7ef129d62c5989070e1ee3a0aa2d84e56d9524dcf011a2bb1a52
   languageName: node
   linkType: hard
 
-"arrify@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "arrify@npm:1.0.1"
-  checksum: 745075dd4a4624ff0225c331dacb99be501a515d39bcb7c84d24660314a6ec28e68131b137e6f7e16318170842ce97538cd298fc4cd6b2cc798e0b957f2747e7
+"@typescript-eslint/utils@npm:5.62.0":
+  version: 5.62.0
+  resolution: "@typescript-eslint/utils@npm:5.62.0"
+  dependencies:
+    "@eslint-community/eslint-utils": ^4.2.0
+    "@types/json-schema": ^7.0.9
+    "@types/semver": ^7.3.12
+    "@typescript-eslint/scope-manager": 5.62.0
+    "@typescript-eslint/types": 5.62.0
+    "@typescript-eslint/typescript-estree": 5.62.0
+    eslint-scope: ^5.1.1
+    semver: ^7.3.7
+  peerDependencies:
+    eslint: ^6.0.0 || ^7.0.0 || ^8.0.0
+  checksum: ee9398c8c5db6d1da09463ca7bf36ed134361e20131ea354b2da16a5fdb6df9ba70c62a388d19f6eebb421af1786dbbd79ba95ddd6ab287324fc171c3e28d931
   languageName: node
   linkType: hard
 
-"arrify@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "arrify@npm:2.0.1"
-  checksum: 067c4c1afd182806a82e4c1cb8acee16ab8b5284fbca1ce29408e6e91281c36bb5b612f6ddfbd40a0f7a7e0c75bf2696eb94c027f6e328d6e9c52465c98e4209
+"@typescript-eslint/visitor-keys@npm:5.62.0":
+  version: 5.62.0
+  resolution: "@typescript-eslint/visitor-keys@npm:5.62.0"
+  dependencies:
+    "@typescript-eslint/types": 5.62.0
+    eslint-visitor-keys: ^3.3.0
+  checksum: 976b05d103fe8335bef5c93ad3f76d781e3ce50329c0243ee0f00c0fcfb186c81df50e64bfdd34970148113f8ade90887f53e3c4938183afba830b4ba8e30a35
   languageName: node
   linkType: hard
 
-"asn1.js@npm:^5.2.0":
-  version: 5.4.1
-  resolution: "asn1.js@npm:5.4.1"
-  dependencies:
-    bn.js: ^4.0.0
-    inherits: ^2.0.1
-    minimalistic-assert: ^1.0.0
-    safer-buffer: ^2.1.0
-  checksum: 3786a101ac6f304bd4e9a7df79549a7561950a13d4bcaec0c7790d44c80d147c1a94ba3d4e663673406064642a40b23fcd6c82a9952468e386c1a1376d747f9a
+"@ungap/structured-clone@npm:^1.2.0":
+  version: 1.3.0
+  resolution: "@ungap/structured-clone@npm:1.3.0"
+  checksum: 64ed518f49c2b31f5b50f8570a1e37bde3b62f2460042c50f132430b2d869c4a6586f13aa33a58a4722715b8158c68cae2827389d6752ac54da2893c83e480fc
   languageName: node
   linkType: hard
 
-"asn1@npm:~0.2.3":
-  version: 0.2.4
-  resolution: "asn1@npm:0.2.4"
+"@warp-drive/build-config@npm:0.0.3":
+  version: 0.0.3
+  resolution: "@warp-drive/build-config@npm:0.0.3"
   dependencies:
-    safer-buffer: ~2.1.0
-  checksum: aa5d6f77b1e0597df53824c68cfe82d1d89ce41cb3520148611f025fbb3101b2d25dd6a40ad34e4fac10f6b19ed5e8628cd4b7d212261e80e83f02b39ee5663c
+    "@embroider/addon-shim": ^1.9.0
+    "@embroider/macros": ^1.16.12
+    babel-import-util: ^2.1.1
+    semver: ^7.7.1
+  checksum: 099a4ff188515ac810fafaa1a2f359a5f6010e9eca3fc9083f6c4a05d9eb4c7f1951c2794d6bbf2c85526f6221a816ad73655e0b0538515a5caedce51a3f19dc
   languageName: node
   linkType: hard
 
-"asn1js@npm:^2.1.1, asn1js@npm:^2.2.0":
-  version: 2.2.0
-  resolution: "asn1js@npm:2.2.0"
+"@warp-drive/core-types@npm:0.0.3":
+  version: 0.0.3
+  resolution: "@warp-drive/core-types@npm:0.0.3"
   dependencies:
-    pvutils: latest
-  checksum: 936e233b7453d7e9805c1637f02da7145d73d5158105710f9bc79efaf51aa935a8bce87b0efed59da4c32fc304bfe28eb22fad1e1bf2f926478e110c6f3da240
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+  checksum: f3c4ca79f8c60707910a2deddf176d751f5c4ea48fb9553cad0f0f7757a2196df57e795841f151a004b18eb89d9242e77ea94f681797905369630da3d4b66f3d
   languageName: node
   linkType: hard
 
-"assert-never@npm:^1.1.0, assert-never@npm:^1.2.1":
-  version: 1.2.1
-  resolution: "assert-never@npm:1.2.1"
-  checksum: ea4f1756d90f55254c4dc7a20d6c5d5bc169160562aefe3d8756b598c10e695daf568f21b6d6b12245d7f3782d3ff83ef6a01ab75d487adfc6909470a813bf8c
+"@webassemblyjs/ast@npm:1.14.1, @webassemblyjs/ast@npm:^1.12.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/ast@npm:1.14.1"
+  dependencies:
+    "@webassemblyjs/helper-numbers": 1.13.2
+    "@webassemblyjs/helper-wasm-bytecode": 1.13.2
+  checksum: f9154ad9ea14f6f2374ebe918c221fd69a4d4514126a1acc6fa4966e8d27ab28cb550a5e6880032cf620e19640578658a7e5a55bd2aad1e3db4e9d598b8f2099
   languageName: node
   linkType: hard
 
-"assert-plus@npm:1.0.0, assert-plus@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "assert-plus@npm:1.0.0"
-  checksum: 19b4340cb8f0e6a981c07225eacac0e9d52c2644c080198765d63398f0075f83bbc0c8e95474d54224e297555ad0d631c1dcd058adb1ddc2437b41a6b424ac64
+"@webassemblyjs/floating-point-hex-parser@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/floating-point-hex-parser@npm:1.13.2"
+  checksum: e866ec8433f4a70baa511df5e8f2ebcd6c24f4e2cc6274c7c5aabe2bcce3459ea4680e0f35d450e1f3602acf3913b6b8e4f15069c8cfd34ae8609fb9a7d01795
   languageName: node
   linkType: hard
 
-"assert@npm:^1.1.1":
-  version: 1.5.0
-  resolution: "assert@npm:1.5.0"
-  dependencies:
-    object-assign: ^4.1.1
-    util: 0.10.3
-  checksum: 9be48435f726029ae7020c5888a3566bf4d617687aab280827f2e4029644b6515a9519ea10d018b342147c02faf73d9e9419e780e8937b3786ee4945a0ca71e5
+"@webassemblyjs/helper-api-error@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/helper-api-error@npm:1.13.2"
+  checksum: 48b5df7fd3095bb252f59a139fe2cbd999a62ac9b488123e9a0da3906ad8a2f2da7b2eb21d328c01a90da987380928706395c2897d1f3ed9e2125b6d75a920d0
   languageName: node
   linkType: hard
 
-"assign-symbols@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "assign-symbols@npm:1.0.0"
-  checksum: c0eb895911d05b6b2d245154f70461c5e42c107457972e5ebba38d48967870dee53bcdf6c7047990586daa80fab8dab3cc6300800fbd47b454247fdedd859a2c
+"@webassemblyjs/helper-buffer@npm:1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/helper-buffer@npm:1.14.1"
+  checksum: b611e981dfd6a797c3d8fc3a772de29a6e55033737c2c09c31bb66c613bdbb2d25f915df1dee62a602c6acc057ca71128432fa8c3e22a893e1219dc454f14ede
   languageName: node
   linkType: hard
 
-"ast-metadata-inferer@npm:^0.7.0":
-  version: 0.7.0
-  resolution: "ast-metadata-inferer@npm:0.7.0"
+"@webassemblyjs/helper-numbers@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/helper-numbers@npm:1.13.2"
   dependencies:
-    "@mdn/browser-compat-data": ^3.3.14
-  checksum: 9bb633b680d537cd6d5066e48ed6ae68d7ddae663a380bdba78d4f40b53d4c03845dc3a7307d55ecf1248b447ee28d62bb20ade8b880abc2df629cda9414e32e
+    "@webassemblyjs/floating-point-hex-parser": 1.13.2
+    "@webassemblyjs/helper-api-error": 1.13.2
+    "@xtuc/long": 4.2.2
+  checksum: 49e2c9bf9b66997e480f6b44d80f895b3cde4de52ac135921d28e144565edca6903a519f627f4089b5509de1d7f9e5023f0e1a94ff78a36c9e2eb30e7c18ffd2
   languageName: node
   linkType: hard
 
-"ast-types@npm:0.13.3":
-  version: 0.13.3
-  resolution: "ast-types@npm:0.13.3"
-  checksum: 23d08bc589aacb787e22ac7efc086ebcc158e739c057dac74de409a97e26ec9c5bcb2d0709f5678bd5d90f67d93f62fba0e5fe98161a0a3a7534d55a155544d8
+"@webassemblyjs/helper-wasm-bytecode@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/helper-wasm-bytecode@npm:1.13.2"
+  checksum: 8e059e1c1f0294f4fc3df8e4eaff3c5ef6e2e1358f34ebc118eaf5070ed59e56ed7fc92b28be734ebde17c8d662d5d27e06ade686c282445135da083ae11c128
   languageName: node
   linkType: hard
 
-"astral-regex@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "astral-regex@npm:2.0.0"
-  checksum: 876231688c66400473ba505731df37ea436e574dd524520294cc3bbc54ea40334865e01fa0d074d74d036ee874ee7e62f486ea38bc421ee8e6a871c06f011766
+"@webassemblyjs/helper-wasm-section@npm:1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/helper-wasm-section@npm:1.14.1"
+  dependencies:
+    "@webassemblyjs/ast": 1.14.1
+    "@webassemblyjs/helper-buffer": 1.14.1
+    "@webassemblyjs/helper-wasm-bytecode": 1.13.2
+    "@webassemblyjs/wasm-gen": 1.14.1
+  checksum: 0a08d454a63192cd66abf91b6f060ac4b466cef341262246e9dcc828dd4c8536195dea9b46a1244b1eac65b59b8b502164a771a190052a92ff0a0a2ded0f8f53
   languageName: node
   linkType: hard
 
-"async-disk-cache@npm:^1.2.1":
-  version: 1.3.5
-  resolution: "async-disk-cache@npm:1.3.5"
+"@webassemblyjs/ieee754@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/ieee754@npm:1.13.2"
   dependencies:
-    debug: ^2.1.3
-    heimdalljs: ^0.2.3
-    istextorbinary: 2.1.0
-    mkdirp: ^0.5.0
-    rimraf: ^2.5.3
-    rsvp: ^3.0.18
-    username-sync: ^1.0.2
-  checksum: 1844554469dc4a0abc855ad3c46296ccf105923186a662c47a85e5fa6a818a2693f2f941b903f2e28ab29895bd41596a81b42f670b71772a8134374f7459f51e
+    "@xtuc/ieee754": ^1.2.0
+  checksum: d7e3520baa37a7309fa7db4d73d69fb869878853b1ebd4b168821bd03fcc4c0e1669c06231315b0039035d9a7a462e53de3ad982da4a426a4b0743b5888e8673
   languageName: node
   linkType: hard
 
-"async-disk-cache@npm:^2.0.0":
-  version: 2.1.0
-  resolution: "async-disk-cache@npm:2.1.0"
+"@webassemblyjs/leb128@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/leb128@npm:1.13.2"
   dependencies:
-    debug: ^4.1.1
-    heimdalljs: ^0.2.3
-    istextorbinary: ^2.5.1
-    mkdirp: ^0.5.0
-    rimraf: ^3.0.0
-    rsvp: ^4.8.5
-    username-sync: ^1.0.2
-  checksum: 08dbea2062961885d646d97f46a4309d8ca5254d326a7dd119c8769d31ccab063fa24acf08bce82e38e789997933e6480bcbf97be8e015023cd6685929b93bfb
+    "@xtuc/long": 4.2.2
+  checksum: 64083507f7cff477a6d71a9e325d95665cea78ec8df99ca7c050e1cfbe300fbcf0842ca3dcf3b4fa55028350135588a4f879398d3dd2b6a8de9913ce7faf5333
   languageName: node
   linkType: hard
 
-"async-each@npm:^1.0.1":
-  version: 1.0.3
-  resolution: "async-each@npm:1.0.3"
-  checksum: 868651cfeb209970b367fbb96df1e1c8dc0b22c681cda7238417005ab2a5fbd944ee524b43f2692977259a57b7cc2547e03ff68f2b5113dbdf953d48cc078dc3
+"@webassemblyjs/utf8@npm:1.13.2":
+  version: 1.13.2
+  resolution: "@webassemblyjs/utf8@npm:1.13.2"
+  checksum: 95ec6052f30eefa8d50c9b2a3394d08b17d53a4aa52821451d41d774c126fa8f39b988fbf5bff56da86852a87c16d676e576775a4071e5e5ccf020cc85a4b281
   languageName: node
   linkType: hard
 
-"async-promise-queue@npm:^1.0.3, async-promise-queue@npm:^1.0.5":
-  version: 1.0.5
-  resolution: "async-promise-queue@npm:1.0.5"
+"@webassemblyjs/wasm-edit@npm:^1.12.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/wasm-edit@npm:1.14.1"
   dependencies:
-    async: ^2.4.1
-    debug: ^2.6.8
-  checksum: 6f18b65e4bac8c12822d66c532aba6c8a8d81ee6e7d790bc7c399e882ff55b642a86379a58df9129db8560f57f76dea0af39b065f43568fb4bec4edf40e415a9
+    "@webassemblyjs/ast": 1.14.1
+    "@webassemblyjs/helper-buffer": 1.14.1
+    "@webassemblyjs/helper-wasm-bytecode": 1.13.2
+    "@webassemblyjs/helper-wasm-section": 1.14.1
+    "@webassemblyjs/wasm-gen": 1.14.1
+    "@webassemblyjs/wasm-opt": 1.14.1
+    "@webassemblyjs/wasm-parser": 1.14.1
+    "@webassemblyjs/wast-printer": 1.14.1
+  checksum: 9341c3146bb1b7863f03d6050c2a66990f20384ca137388047bbe1feffacb599e94fca7b7c18287d17e2449ffb4005fdc7f41f674a6975af9ad8522756f8ffff
   languageName: node
   linkType: hard
 
-"async@npm:^2.4.1":
-  version: 2.6.3
-  resolution: "async@npm:2.6.3"
+"@webassemblyjs/wasm-gen@npm:1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/wasm-gen@npm:1.14.1"
   dependencies:
-    lodash: ^4.17.14
-  checksum: 5e5561ff8fca807e88738533d620488ac03a5c43fce6c937451f7e35f943d33ad06c24af3f681a48cca3d2b0002b3118faff0a128dc89438a9bf0226f712c499
+    "@webassemblyjs/ast": 1.14.1
+    "@webassemblyjs/helper-wasm-bytecode": 1.13.2
+    "@webassemblyjs/ieee754": 1.13.2
+    "@webassemblyjs/leb128": 1.13.2
+    "@webassemblyjs/utf8": 1.13.2
+  checksum: 401b12bec7431c4fc29d9414bbe40d3c6dc5be04d25a116657c42329f5481f0129f3b5834c293f26f0e42681ceac9157bf078ce9bdb6a7f78037c650373f98b2
   languageName: node
   linkType: hard
 
-"async@npm:^2.6.4":
-  version: 2.6.4
-  resolution: "async@npm:2.6.4"
+"@webassemblyjs/wasm-opt@npm:1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/wasm-opt@npm:1.14.1"
   dependencies:
-    lodash: ^4.17.14
-  checksum: a52083fb32e1ebe1d63e5c5624038bb30be68ff07a6c8d7dfe35e47c93fc144bd8652cbec869e0ac07d57dde387aa5f1386be3559cdee799cb1f789678d88e19
+    "@webassemblyjs/ast": 1.14.1
+    "@webassemblyjs/helper-buffer": 1.14.1
+    "@webassemblyjs/wasm-gen": 1.14.1
+    "@webassemblyjs/wasm-parser": 1.14.1
+  checksum: 60c697a9e9129d8d23573856df0791ba33cea4a3bc2339044cae73128c0983802e5e50a42157b990eeafe1237eb8e7653db6de5f02b54a0ae7b81b02dcdf2ae9
   languageName: node
   linkType: hard
 
-"async@npm:~0.2.9":
-  version: 0.2.10
-  resolution: "async@npm:0.2.10"
-  checksum: 9ea83419ba67dc4ecf42d4eb0d93ce0ac80a67cabb612f160ed096aef5d001e3184ec9e9be5d4dc39b2c51a34e2ae16f9b21d737068b0f615fccb4eea16d0138
+"@webassemblyjs/wasm-parser@npm:1.14.1, @webassemblyjs/wasm-parser@npm:^1.12.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/wasm-parser@npm:1.14.1"
+  dependencies:
+    "@webassemblyjs/ast": 1.14.1
+    "@webassemblyjs/helper-api-error": 1.13.2
+    "@webassemblyjs/helper-wasm-bytecode": 1.13.2
+    "@webassemblyjs/ieee754": 1.13.2
+    "@webassemblyjs/leb128": 1.13.2
+    "@webassemblyjs/utf8": 1.13.2
+  checksum: 93f1fe2676da465b4e824419d9812a3d7218de4c3addd4e916c04bc86055fa134416c1b67e4b7cbde8d728c0dce2721d06cc0bfe7a7db7c093a0898009937405
   languageName: node
   linkType: hard
 
-"asynckit@npm:^0.4.0":
-  version: 0.4.0
-  resolution: "asynckit@npm:0.4.0"
-  checksum: 7b78c451df768adba04e2d02e63e2d0bf3b07adcd6e42b4cf665cb7ce899bedd344c69a1dcbce355b5f972d597b25aaa1c1742b52cffd9caccb22f348114f6be
+"@webassemblyjs/wast-printer@npm:1.14.1":
+  version: 1.14.1
+  resolution: "@webassemblyjs/wast-printer@npm:1.14.1"
+  dependencies:
+    "@webassemblyjs/ast": 1.14.1
+    "@xtuc/long": 4.2.2
+  checksum: 517881a0554debe6945de719d100b2d8883a2d24ddf47552cdeda866341e2bb153cd824a864bc7e2a61190a4b66b18f9899907e0074e9e820d2912ac0789ea60
   languageName: node
   linkType: hard
 
-"at-least-node@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "at-least-node@npm:1.0.0"
-  checksum: 463e2f8e43384f1afb54bc68485c436d7622acec08b6fad269b421cb1d29cebb5af751426793d0961ed243146fe4dc983402f6d5a51b720b277818dbf6f2e49e
+"@webpack-cli/configtest@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "@webpack-cli/configtest@npm:3.0.1"
+  peerDependencies:
+    webpack: ^5.82.0
+    webpack-cli: 6.x.x
+  checksum: a83301ff360de6c36fe98766f1f391db6149f0806450ce31484c49df3902584f73385453da23f3324a605d5afad4d2889654ada679afd49e35c59a2c4769ee97
   languageName: node
   linkType: hard
 
-"atob@npm:^2.1.2":
-  version: 2.1.2
-  resolution: "atob@npm:2.1.2"
-  bin:
-    atob: bin/atob.js
-  checksum: dfeeeb70090c5ebea7be4b9f787f866686c645d9f39a0d184c817252d0cf08455ed25267d79c03254d3be1f03ac399992a792edcd5ffb9c91e097ab5ef42833a
+"@webpack-cli/info@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "@webpack-cli/info@npm:3.0.1"
+  peerDependencies:
+    webpack: ^5.82.0
+    webpack-cli: 6.x.x
+  checksum: 0ddcfd8b370d924f71cc085b17b31a77b362d8046fedb38ac601042733568cda05b0c8c7b1e0e1e050dc926ee76f754cd9c4f351e2b361a0d157465f8b03b689
   languageName: node
   linkType: hard
 
-"autoprefixer@npm:^7.0.0":
-  version: 7.2.6
-  resolution: "autoprefixer@npm:7.2.6"
-  dependencies:
-    browserslist: ^2.11.3
-    caniuse-lite: ^1.0.30000805
-    normalize-range: ^0.1.2
-    num2fraction: ^1.2.2
-    postcss: ^6.0.17
-    postcss-value-parser: ^3.2.3
-  bin:
-    autoprefixer-info: ./bin/autoprefixer-info
-  checksum: 7ad12a58ca128d3e6b6dc5e4b3d83f2a12151216d30bcea1f1f2f8a91d2a019c58dd62fd039a6c1cf218f2ab557b03224703a4396c1b4f01b5c0818bc6ba4dd9
+"@webpack-cli/serve@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "@webpack-cli/serve@npm:3.0.1"
+  peerDependencies:
+    webpack: ^5.82.0
+    webpack-cli: 6.x.x
+  peerDependenciesMeta:
+    webpack-dev-server:
+      optional: true
+  checksum: 5bbd66548faa8adc7b0759f5880411b611c9a25e9303e2f580ab2d658ec105926a21c981fa7797e9f7c24093d0a0ff96d6f2d8f76f265d7760441cf138cab889
   languageName: node
   linkType: hard
 
-"autosize@npm:^4.0.0":
-  version: 4.0.2
-  resolution: "autosize@npm:4.0.2"
-  checksum: e19f1e64742cfd17d8dcd24b878871e36f1b295e4184ad7c5e036204b54c7a6346dd460e7c0b1562244632deb651394e79e656a144aa6fbc69803892713d550d
+"@xmldom/xmldom@npm:^0.8.0":
+  version: 0.8.10
+  resolution: "@xmldom/xmldom@npm:0.8.10"
+  checksum: 4c136aec31fb3b49aaa53b6fcbfe524d02a1dc0d8e17ee35bd3bf35e9ce1344560481cd1efd086ad1a4821541482528672306d5e37cdbd187f33d7fadd3e2cf0
   languageName: node
   linkType: hard
 
-"available-typed-arrays@npm:^1.0.5":
-  version: 1.0.5
-  resolution: "available-typed-arrays@npm:1.0.5"
-  checksum: 20eb47b3cefd7db027b9bbb993c658abd36d4edd3fe1060e83699a03ee275b0c9b216cc076ff3f2db29073225fb70e7613987af14269ac1fe2a19803ccc97f1a
+"@xtuc/ieee754@npm:^1.2.0":
+  version: 1.2.0
+  resolution: "@xtuc/ieee754@npm:1.2.0"
+  checksum: ac56d4ca6e17790f1b1677f978c0c6808b1900a5b138885d3da21732f62e30e8f0d9120fcf8f6edfff5100ca902b46f8dd7c1e3f903728634523981e80e2885a
   languageName: node
   linkType: hard
 
-"aws-sign2@npm:~0.7.0":
-  version: 0.7.0
-  resolution: "aws-sign2@npm:0.7.0"
-  checksum: b148b0bb0778098ad8cf7e5fc619768bcb51236707ca1d3e5b49e41b171166d8be9fdc2ea2ae43d7decf02989d0aaa3a9c4caa6f320af95d684de9b548a71525
+"@xtuc/long@npm:4.2.2":
+  version: 4.2.2
+  resolution: "@xtuc/long@npm:4.2.2"
+  checksum: 8ed0d477ce3bc9c6fe2bf6a6a2cc316bb9c4127c5a7827bae947fa8ec34c7092395c5a283cc300c05b5fa01cbbfa1f938f410a7bf75db7c7846fea41949989ec
   languageName: node
   linkType: hard
 
-"aws4@npm:^1.8.0":
-  version: 1.11.0
-  resolution: "aws4@npm:1.11.0"
-  checksum: 5a00d045fd0385926d20ebebcfba5ec79d4482fe706f63c27b324d489a04c68edb0db99ed991e19eda09cb8c97dc2452059a34d97545cebf591d7a2b5a10999f
+"JSV@npm:^4.0.x":
+  version: 4.0.2
+  resolution: "JSV@npm:4.0.2"
+  checksum: 9e2e070b2149d4ffed6c135dedb5f8cebb870dc63c0ca6d3cb647067248c7ca15d1a934ee46e9d2ac0e468436d0f70bc1b63cd5f93e705ee9aa0669430e6e66f
   languageName: node
   linkType: hard
 
-"axe-core@npm:^4.6.3":
-  version: 4.8.2
-  resolution: "axe-core@npm:4.8.2"
-  checksum: 8c19f507dabfcb8514e4280c7fc66e85143be303ddb57ec9f119338021228dc9b80560993938003837bda415fde7c07bba3a96560008ffa5f4145a248ed8f5fe
+"abbrev@npm:1":
+  version: 1.1.1
+  resolution: "abbrev@npm:1.1.1"
+  checksum: a4a97ec07d7ea112c517036882b2ac22f3109b7b19077dc656316d07d308438aac28e4d9746dc4d84bf6b1e75b4a7b0a5f3cb30592419f128ca9a8cee3bcfa17
   languageName: node
   linkType: hard
 
-"babel-code-frame@npm:^6.26.0":
-  version: 6.26.0
-  resolution: "babel-code-frame@npm:6.26.0"
-  dependencies:
-    chalk: ^1.1.3
-    esutils: ^2.0.2
-    js-tokens: ^3.0.2
-  checksum: 9410c3d5a921eb02fa409675d1a758e493323a49e7b9dddb7a2a24d47e61d39ab1129dd29f9175836eac9ce8b1d4c0a0718fcdc57ce0b865b529fd250dbab313
-  languageName: node
-  linkType: hard
-
-"babel-core@npm:^6.26.0, babel-core@npm:^6.26.3":
-  version: 6.26.3
-  resolution: "babel-core@npm:6.26.3"
-  dependencies:
-    babel-code-frame: ^6.26.0
-    babel-generator: ^6.26.0
-    babel-helpers: ^6.24.1
-    babel-messages: ^6.23.0
-    babel-register: ^6.26.0
-    babel-runtime: ^6.26.0
-    babel-template: ^6.26.0
-    babel-traverse: ^6.26.0
-    babel-types: ^6.26.0
-    babylon: ^6.18.0
-    convert-source-map: ^1.5.1
-    debug: ^2.6.9
-    json5: ^0.5.1
-    lodash: ^4.17.4
-    minimatch: ^3.0.4
-    path-is-absolute: ^1.0.1
-    private: ^0.1.8
-    slash: ^1.0.0
-    source-map: ^0.5.7
-  checksum: 3d6a37e5c69ea7f7d66c2a261cbd7219197f2f938700e6ebbabb6d84a03f2bf86691ffa066866dcb49ba6c4bd702d347c9e0e147660847d709705cf43c964752
+"abbrev@npm:^3.0.0":
+  version: 3.0.1
+  resolution: "abbrev@npm:3.0.1"
+  checksum: e70b209f5f408dd3a3bbd0eec4b10a2ffd64704a4a3821d0969d84928cc490a8eb60f85b78a95622c1841113edac10161c62e52f5e7d0027aa26786a8136e02e
   languageName: node
   linkType: hard
 
-"babel-generator@npm:^6.26.0":
-  version: 6.26.1
-  resolution: "babel-generator@npm:6.26.1"
+"accepts@npm:~1.3.4, accepts@npm:~1.3.7, accepts@npm:~1.3.8":
+  version: 1.3.8
+  resolution: "accepts@npm:1.3.8"
   dependencies:
-    babel-messages: ^6.23.0
-    babel-runtime: ^6.26.0
-    babel-types: ^6.26.0
-    detect-indent: ^4.0.0
-    jsesc: ^1.3.0
-    lodash: ^4.17.4
-    source-map: ^0.5.7
-    trim-right: ^1.0.1
-  checksum: 5397f4d4d1243e7157e3336be96c10fcb1f29f73bf2d9842229c71764d9a6431397d249483a38c4d8b1581459e67be4df6f32d26b1666f02d0f5bfc2c2f25193
+    mime-types: ~2.1.34
+    negotiator: 0.6.3
+  checksum: 50c43d32e7b50285ebe84b613ee4a3aa426715a7d131b65b786e2ead0fd76b6b60091b9916d3478a75f11f162628a2139991b6c03ab3f1d9ab7c86075dc8eab4
   languageName: node
   linkType: hard
 
-"babel-helper-builder-binary-assignment-operator-visitor@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-helper-builder-binary-assignment-operator-visitor@npm:6.24.1"
-  dependencies:
-    babel-helper-explode-assignable-expression: ^6.24.1
-    babel-runtime: ^6.22.0
-    babel-types: ^6.24.1
-  checksum: 6ef49597837d042980e78284df014972daac7f1f1f2635d978bb2d13990304322f5135f27b8f2d6eb8c4c2459b496ec76e21544e26afbb5dec88f53089e17476
+"acorn-import-attributes@npm:^1.9.5":
+  version: 1.9.5
+  resolution: "acorn-import-attributes@npm:1.9.5"
+  peerDependencies:
+    acorn: ^8
+  checksum: 1c0c49b6a244503964ae46ae850baccf306e84caf99bc2010ed6103c69a423987b07b520a6c619f075d215388bd4923eccac995886a54309eda049ab78a4be95
   languageName: node
   linkType: hard
 
-"babel-helper-call-delegate@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-helper-call-delegate@npm:6.24.1"
-  dependencies:
-    babel-helper-hoist-variables: ^6.24.1
-    babel-runtime: ^6.22.0
-    babel-traverse: ^6.24.1
-    babel-types: ^6.24.1
-  checksum: b6277d6e48c10cf416632f6dfbac77bdf6ba8ec4ac2f6359a77d6b731dae941c2a3ec7f35e1eba78aad2a7e0838197731d1ef75af529055096c4cb7d96432c88
+"acorn-jsx@npm:^5.3.2":
+  version: 5.3.2
+  resolution: "acorn-jsx@npm:5.3.2"
+  peerDependencies:
+    acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
+  checksum: c3d3b2a89c9a056b205b69530a37b972b404ee46ec8e5b341666f9513d3163e2a4f214a71f4dfc7370f5a9c07472d2fd1c11c91c3f03d093e37637d95da98950
   languageName: node
   linkType: hard
 
-"babel-helper-define-map@npm:^6.24.1":
-  version: 6.26.0
-  resolution: "babel-helper-define-map@npm:6.26.0"
-  dependencies:
-    babel-helper-function-name: ^6.24.1
-    babel-runtime: ^6.26.0
-    babel-types: ^6.26.0
-    lodash: ^4.17.4
-  checksum: 08e201eb009a7dbd020232fb7468ac772ebb8cfd33ec9a41113a54f4c90fd1e3474497783d635b8f87d797706323ca0c1758c516a630b0c95277112fc2fe4f13
+"acorn@npm:^5.1.1":
+  version: 5.7.4
+  resolution: "acorn@npm:5.7.4"
+  bin:
+    acorn: bin/acorn
+  checksum: f51392a4d25c7705fadb890f784c59cde4ac1c5452ccd569fa59bd2191b7951b4a6398348ab7ea08a54f0bc0a56c13776710f4e1bae9de441e4d33e2015ad1e0
   languageName: node
   linkType: hard
 
-"babel-helper-explode-assignable-expression@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-helper-explode-assignable-expression@npm:6.24.1"
-  dependencies:
-    babel-runtime: ^6.22.0
-    babel-traverse: ^6.24.1
-    babel-types: ^6.24.1
-  checksum: 1bafdb51ce3dd95cf25d712d24a0c3c2ae02ff58118c77462f14ede4d8161aaee42c5c759c3d3a3344a5851b8b0f8d16b395713413b8194e1c3264fc5b12b754
+"acorn@npm:^8.14.0, acorn@npm:^8.5.0, acorn@npm:^8.7.1, acorn@npm:^8.9.0":
+  version: 8.14.1
+  resolution: "acorn@npm:8.14.1"
+  bin:
+    acorn: bin/acorn
+  checksum: 260d9bb6017a1b6e42d31364687f0258f78eb20210b36ef2baad38fd619d78d4e95ff7dde9b3dbe0d81f137f79a8d651a845363a26e6985997f7b71145dc5e94
   languageName: node
   linkType: hard
 
-"babel-helper-function-name@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-helper-function-name@npm:6.24.1"
+"agent-base@npm:^4.3.0":
+  version: 4.3.0
+  resolution: "agent-base@npm:4.3.0"
   dependencies:
-    babel-helper-get-function-arity: ^6.24.1
-    babel-runtime: ^6.22.0
-    babel-template: ^6.24.1
-    babel-traverse: ^6.24.1
-    babel-types: ^6.24.1
-  checksum: d651db9e0b29e135877e90e7858405750a684220d22a6f7c78bb163305a1b322cc1c8bea1bc617625c34d92d0927fdbaa49ee46822e2f86b524eced4c88c7ff0
+    es6-promisify: ^5.0.0
+  checksum: 0c10891060e579c67efafd6b62223666c4b4129b521eac3e9ad272a137545bcedb54ce352273b7ad21a0024060e4f1360ae9a465ac87e2af18883c937d39979f
   languageName: node
   linkType: hard
 
-"babel-helper-get-function-arity@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-helper-get-function-arity@npm:6.24.1"
-  dependencies:
-    babel-runtime: ^6.22.0
-    babel-types: ^6.24.1
-  checksum: 37e344d6c5c00b67a3b378490a5d7ba924bab1c2ccd6ecf1b7da96ca679be12d75fbec6279366ae9772e482fb06a7b48293954dd79cbeba9b947e2db67252fbd
+"agent-base@npm:^7.1.0, agent-base@npm:^7.1.2":
+  version: 7.1.3
+  resolution: "agent-base@npm:7.1.3"
+  checksum: 87bb7ee54f5ecf0ccbfcba0b07473885c43ecd76cb29a8db17d6137a19d9f9cd443a2a7c5fd8a3f24d58ad8145f9eb49116344a66b107e1aeab82cf2383f4753
   languageName: node
   linkType: hard
 
-"babel-helper-hoist-variables@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-helper-hoist-variables@npm:6.24.1"
+"ajv-formats@npm:^2.1.1":
+  version: 2.1.1
+  resolution: "ajv-formats@npm:2.1.1"
   dependencies:
-    babel-runtime: ^6.22.0
-    babel-types: ^6.24.1
-  checksum: 6af1c165d5f0ad192df07daa194d13de77572bd914d2fc9a270d56b93b2705d98eebabf412b1211505535af131fbe95886fcfad8b3a07b4d501c24b9cb8e57fe
+    ajv: ^8.0.0
+  peerDependencies:
+    ajv: ^8.0.0
+  peerDependenciesMeta:
+    ajv:
+      optional: true
+  checksum: 4a287d937f1ebaad4683249a4c40c0fa3beed30d9ddc0adba04859026a622da0d317851316ea64b3680dc60f5c3c708105ddd5d5db8fe595d9d0207fd19f90b7
   languageName: node
   linkType: hard
 
-"babel-helper-optimise-call-expression@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-helper-optimise-call-expression@npm:6.24.1"
-  dependencies:
-    babel-runtime: ^6.22.0
-    babel-types: ^6.24.1
-  checksum: 16e6aba819b473dbf013391f759497df9f57bc7060bc4e5f7f6b60fb03670eb1dec65dd2227601d58f151e9d647e1f676a12466f5e6674379978820fa02c0fbb
+"ajv-keywords@npm:^3.5.2":
+  version: 3.5.2
+  resolution: "ajv-keywords@npm:3.5.2"
+  peerDependencies:
+    ajv: ^6.9.1
+  checksum: 7dc5e5931677a680589050f79dcbe1fefbb8fea38a955af03724229139175b433c63c68f7ae5f86cf8f65d55eb7c25f75a046723e2e58296707617ca690feae9
   languageName: node
   linkType: hard
 
-"babel-helper-regex@npm:^6.24.1":
-  version: 6.26.0
-  resolution: "babel-helper-regex@npm:6.26.0"
+"ajv-keywords@npm:^5.1.0":
+  version: 5.1.0
+  resolution: "ajv-keywords@npm:5.1.0"
   dependencies:
-    babel-runtime: ^6.26.0
-    babel-types: ^6.26.0
-    lodash: ^4.17.4
-  checksum: ab949a4c90ab255abaafd9ec11a4a6dc77dba360875af2bb0822b699c058858773792c1e969c425c396837f61009f30c9ee5ba4b9a8ca87b0779ae1622f89fb3
+    fast-deep-equal: ^3.1.3
+  peerDependencies:
+    ajv: ^8.8.2
+  checksum: c35193940b853119242c6757787f09ecf89a2c19bcd36d03ed1a615e710d19d450cb448bfda407b939aba54b002368c8bff30529cc50a0536a8e10bcce300421
   languageName: node
   linkType: hard
 
-"babel-helper-remap-async-to-generator@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-helper-remap-async-to-generator@npm:6.24.1"
+"ajv@npm:^6.12.4, ajv@npm:^6.12.5":
+  version: 6.12.6
+  resolution: "ajv@npm:6.12.6"
   dependencies:
-    babel-helper-function-name: ^6.24.1
-    babel-runtime: ^6.22.0
-    babel-template: ^6.24.1
-    babel-traverse: ^6.24.1
-    babel-types: ^6.24.1
-  checksum: f330943104b61e7f9248d222bd5fe5d3238904ee20643b76197571e14a724723d64a8096b292a60f64788f0efe30176882c376eeebde00657925678e304324f0
+    fast-deep-equal: ^3.1.1
+    fast-json-stable-stringify: ^2.0.0
+    json-schema-traverse: ^0.4.1
+    uri-js: ^4.2.2
+  checksum: 874972efe5c4202ab0a68379481fbd3d1b5d0a7bd6d3cc21d40d3536ebff3352a2a1fabb632d4fd2cc7fe4cbdcd5ed6782084c9bbf7f32a1536d18f9da5007d4
   languageName: node
   linkType: hard
 
-"babel-helper-replace-supers@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-helper-replace-supers@npm:6.24.1"
+"ajv@npm:^8.0.0, ajv@npm:^8.0.1, ajv@npm:^8.9.0":
+  version: 8.17.1
+  resolution: "ajv@npm:8.17.1"
   dependencies:
-    babel-helper-optimise-call-expression: ^6.24.1
-    babel-messages: ^6.23.0
-    babel-runtime: ^6.22.0
-    babel-template: ^6.24.1
-    babel-traverse: ^6.24.1
-    babel-types: ^6.24.1
-  checksum: ca1d216c5c6afc6af2ef55ea16777ba99e108780ea25da61d93edb09fd85f5e96c756306e2a21e737c3b0c7a16c99762b62a0e5f529d3865b14029fef7351cba
+    fast-deep-equal: ^3.1.3
+    fast-uri: ^3.0.1
+    json-schema-traverse: ^1.0.0
+    require-from-string: ^2.0.2
+  checksum: 1797bf242cfffbaf3b870d13565bd1716b73f214bb7ada9a497063aada210200da36e3ed40237285f3255acc4feeae91b1fb183625331bad27da95973f7253d9
   languageName: node
   linkType: hard
 
-"babel-helpers@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-helpers@npm:6.24.1"
+"amd-name-resolver@npm:1.3.1, amd-name-resolver@npm:^1.3.1":
+  version: 1.3.1
+  resolution: "amd-name-resolver@npm:1.3.1"
   dependencies:
-    babel-runtime: ^6.22.0
-    babel-template: ^6.24.1
-  checksum: 751c6010e18648eebae422adfea5f3b5eff70d592d693bfe0f53346227d74b38e6cd2553c4c18de1e64faac585de490eccbd3ab86ba0885bdac42ed4478bc6b0
+    ensure-posix-path: ^1.0.1
+    object-hash: ^1.3.1
+  checksum: c48f68922f394078acaac97f1691a46dcb94fa3d5ee47b9a0c5b81bf66073005b75b5784f93ed6c1081b0afa92d41a5c581073960dbde9baa80b8abef4cccb2b
   languageName: node
   linkType: hard
 
-"babel-import-util@npm:^0.2.0":
-  version: 0.2.0
-  resolution: "babel-import-util@npm:0.2.0"
-  checksum: 32a71d1de47cfbf99dba552e87c11798ef6116643f24429a654b09cb7d365db0dd5bbfe318eb1b63f0c9eae3a4a0c2aefd9c1e21f2b21f1e24ad703693429f95
+"amd-name-resolver@npm:^0.0.6":
+  version: 0.0.6
+  resolution: "amd-name-resolver@npm:0.0.6"
+  dependencies:
+    ensure-posix-path: ^1.0.1
+  checksum: f0e4f03654b2b523a35a3ba5ae5fc6c9f637242cea75ef6470baea5f997a9206e60e23489f7d1c5adc4c3ac88c25008ca7ec4a92cf21b23b253141e2962c990c
   languageName: node
   linkType: hard
 
-"babel-import-util@npm:^1.1.0":
-  version: 1.1.0
-  resolution: "babel-import-util@npm:1.1.0"
-  checksum: d4e965a18ebeee78cd69f1735ab10b64e693b5d837cd887c7ce9f03756d55a49a9f434e29077eafc5bb1f15589dad5ceb1efece78a750d4fc2f0451d5a69da9d
+"amdefine@npm:>=0.0.4":
+  version: 1.0.1
+  resolution: "amdefine@npm:1.0.1"
+  checksum: 9d4e15b94641643a9385b2841b4cb2bcf4e8e2f741ea4bd475c93ad7bab261ad4ed827a32e9c549b38b98759c4526c173ae4e6dde8caeb75ee5cebedc9863762
   languageName: node
   linkType: hard
 
-"babel-import-util@npm:^1.2.2":
-  version: 1.4.1
-  resolution: "babel-import-util@npm:1.4.1"
-  checksum: a7f43a10141f62f05c0b4b3c80ee31f5f362d5f7a7d614fcef836f3eca2ec3ae0a732f8550674542d1821e87c3fd3d986fea94ed12e2a283a1571b6d1249380a
+"anchor-markdown-header@npm:^0.6.0":
+  version: 0.6.0
+  resolution: "anchor-markdown-header@npm:0.6.0"
+  dependencies:
+    emoji-regex: ~10.1.0
+  checksum: 2fe51a4327d07d93fd7c2b4b5dc077598a29300217f876485ce91747e80823a58cbe34f80396f36b8abac24d1cbe080c27fd730dcf976200630f8ac754275606
   languageName: node
   linkType: hard
 
-"babel-import-util@npm:^1.3.0":
-  version: 1.3.0
-  resolution: "babel-import-util@npm:1.3.0"
-  checksum: 41c6b4276ceefd2263f59be97a99bf8d948899c76587b273d115e91fa9067b0d9cc80ba727a795732052e078c30a3665649c725aed966826bf7c0a258a5fcf03
+"ansi-escape-sequences@npm:^4.0.0":
+  version: 4.1.0
+  resolution: "ansi-escape-sequences@npm:4.1.0"
+  dependencies:
+    array-back: ^3.0.1
+  checksum: 709982bd669d37f5e4a698e10cd9c860c8e69b580ec3a62494afcb635bdcb9312ec5ee97c1e943445af96dc42e0ab5832cf31a904101c3fe7414aad42f27e348
   languageName: node
   linkType: hard
 
-"babel-import-util@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "babel-import-util@npm:2.0.0"
-  checksum: 8d9f62dcf522634ac340fb1380f45382d782f7202c98f7b0a6ad9e1aba50edef1f31f1e61e487953e35bcda98759aed7236398a9bb9798b68b6def697925293d
+"ansi-escapes@npm:^3.2.0":
+  version: 3.2.0
+  resolution: "ansi-escapes@npm:3.2.0"
+  checksum: 0f94695b677ea742f7f1eed961f7fd8d05670f744c6ad1f8f635362f6681dcfbc1575cb05b43abc7bb6d67e25a75fb8c7ea8f2a57330eb2c76b33f18cb2cef0a
   languageName: node
   linkType: hard
 
-"babel-loader@npm:^8.0.6":
-  version: 8.2.2
-  resolution: "babel-loader@npm:8.2.2"
+"ansi-escapes@npm:^4.2.1, ansi-escapes@npm:^4.3.2":
+  version: 4.3.2
+  resolution: "ansi-escapes@npm:4.3.2"
   dependencies:
-    find-cache-dir: ^3.3.1
-    loader-utils: ^1.4.0
-    make-dir: ^3.1.0
-    schema-utils: ^2.6.5
-  peerDependencies:
-    "@babel/core": ^7.0.0
-    webpack: ">=2"
-  checksum: df5092ef9886bb49aacb7c58ac40ed0681ced031c8d91e49d680cedace2aa1703390a31fbe7c0e409f739836e911c5c991119133d90d9289f681c0a8ff2447a1
+    type-fest: ^0.21.3
+  checksum: 93111c42189c0a6bed9cdb4d7f2829548e943827ee8479c74d6e0b22ee127b2a21d3f8b5ca57723b8ef78ce011fbfc2784350eb2bde3ccfccf2f575fa8489815
   languageName: node
   linkType: hard
 
-"babel-messages@npm:^6.23.0":
-  version: 6.23.0
-  resolution: "babel-messages@npm:6.23.0"
+"ansi-escapes@npm:^7.0.0":
+  version: 7.0.0
+  resolution: "ansi-escapes@npm:7.0.0"
   dependencies:
-    babel-runtime: ^6.22.0
-  checksum: c8075c17587a33869e1a5bd0a5b73bbe395b68188362dacd5418debbc7c8fd784bcd3295e81ee7e410dc2c2655755add6af03698c522209f6a68334c15e6d6ca
+    environment: ^1.0.0
+  checksum: 19baa61e68d1998c03b3b8bd023653a6c2667f0ed6caa9a00780ffd6f0a14f4a6563c57a38b3c0aba71bd704cd49c4c8df41be60bd81c957409f91e9dd49051f
   languageName: node
   linkType: hard
 
-"babel-plugin-check-es2015-constants@npm:^6.22.0":
-  version: 6.22.0
-  resolution: "babel-plugin-check-es2015-constants@npm:6.22.0"
-  dependencies:
-    babel-runtime: ^6.22.0
-  checksum: 39168cb4ff078911726bfaf9d111d1e18f3e99d8b6f6101d343249b28346c3869e415c97fe7e857e7f34b913f8a052634b2b9dcfb4c0272e5f64ed22df69c735
+"ansi-html@npm:0.0.8":
+  version: 0.0.8
+  resolution: "ansi-html@npm:0.0.8"
+  bin:
+    ansi-html: bin/ansi-html
+  checksum: aee57b90d7c0b2e661446b7c3cacc70511518ea434aaf299280ab3aa943757fd101ef5e7351850c64f55b8a3692b6df32b965f2645435a83cf4a82cbceb8b69e
   languageName: node
   linkType: hard
 
-"babel-plugin-compact-reexports@npm:^1.1.0":
-  version: 1.1.0
-  resolution: "babel-plugin-compact-reexports@npm:1.1.0"
-  checksum: b2e56896a53a010f96f90f3e13d8bb5485bbe8ebc7203d01d1360ec1a5e374f7bffe9c02a244d946ebff384611533e0b349c93f5da4c1a9c08b9e676fc76b22f
+"ansi-regex@npm:^2.0.0":
+  version: 2.1.1
+  resolution: "ansi-regex@npm:2.1.1"
+  checksum: 190abd03e4ff86794f338a31795d262c1dfe8c91f7e01d04f13f646f1dcb16c5800818f886047876f1272f065570ab86b24b99089f8b68a0e11ff19aed4ca8f1
   languageName: node
   linkType: hard
 
-"babel-plugin-debug-macros@npm:^0.2.0, babel-plugin-debug-macros@npm:^0.2.0-beta.6":
-  version: 0.2.0
-  resolution: "babel-plugin-debug-macros@npm:0.2.0"
-  dependencies:
-    semver: ^5.3.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-beta.42
-  checksum: 6ea36c7893940df58f08f9d0c72d2e02cf77a763084572d6f6c1291c462108af318eaa737549f96ba332b624efe0cdab6fcb49afa6466388012dbecd749f713c
+"ansi-regex@npm:^3.0.0":
+  version: 3.0.1
+  resolution: "ansi-regex@npm:3.0.1"
+  checksum: 09daf180c5f59af9850c7ac1bd7fda85ba596cc8cbeb210826e90755f06c818af86d9fa1e6e8322fab2c3b9e9b03f56c537b42241139f824dd75066a1e7257cc
   languageName: node
   linkType: hard
 
-"babel-plugin-debug-macros@npm:^0.3.4":
-  version: 0.3.4
-  resolution: "babel-plugin-debug-macros@npm:0.3.4"
-  dependencies:
-    semver: ^5.3.0
-  peerDependencies:
-    "@babel/core": ^7.0.0
-  checksum: 77762b945a4d4a24d973b659938e4ff9fe485f08c4ad5c8459f184669d946f5883870a6f05a39f09773bcd0923162dcad5fbf8773cf38b3176d71ca415e9e869
+"ansi-regex@npm:^4.1.0":
+  version: 4.1.1
+  resolution: "ansi-regex@npm:4.1.1"
+  checksum: b1a6ee44cb6ecdabaa770b2ed500542714d4395d71c7e5c25baa631f680fb2ad322eb9ba697548d498a6fd366949fc8b5bfcf48d49a32803611f648005b01888
   languageName: node
   linkType: hard
 
-"babel-plugin-dynamic-import-node@npm:^2.3.3":
-  version: 2.3.3
-  resolution: "babel-plugin-dynamic-import-node@npm:2.3.3"
-  dependencies:
-    object.assign: ^4.1.0
-  checksum: c9d24415bcc608d0db7d4c8540d8002ac2f94e2573d2eadced137a29d9eab7e25d2cbb4bc6b9db65cf6ee7430f7dd011d19c911a9a778f0533b4a05ce8292c9b
+"ansi-regex@npm:^5.0.1":
+  version: 5.0.1
+  resolution: "ansi-regex@npm:5.0.1"
+  checksum: 2aa4bb54caf2d622f1afdad09441695af2a83aa3fe8b8afa581d205e57ed4261c183c4d3877cee25794443fde5876417d859c108078ab788d6af7e4fe52eb66b
   languageName: node
   linkType: hard
 
-"babel-plugin-ember-data-packages-polyfill@npm:^0.1.2":
-  version: 0.1.2
-  resolution: "babel-plugin-ember-data-packages-polyfill@npm:0.1.2"
+"ansi-regex@npm:^6.0.1":
+  version: 6.1.0
+  resolution: "ansi-regex@npm:6.1.0"
+  checksum: 495834a53b0856c02acd40446f7130cb0f8284f4a39afdab20d5dc42b2e198b1196119fe887beed8f9055c4ff2055e3b2f6d4641d0be018cdfb64fedf6fc1aac
+  languageName: node
+  linkType: hard
+
+"ansi-styles@npm:^2.2.1":
+  version: 2.2.1
+  resolution: "ansi-styles@npm:2.2.1"
+  checksum: ebc0e00381f2a29000d1dac8466a640ce11943cef3bda3cd0020dc042e31e1058ab59bf6169cd794a54c3a7338a61ebc404b7c91e004092dd20e028c432c9c2c
+  languageName: node
+  linkType: hard
+
+"ansi-styles@npm:^3.0.0, ansi-styles@npm:^3.2.0, ansi-styles@npm:^3.2.1":
+  version: 3.2.1
+  resolution: "ansi-styles@npm:3.2.1"
   dependencies:
-    "@ember-data/rfc395-data": ^0.0.4
-  checksum: c61f9d70898db94feefea7a8cc958c52015fc23b17957eac2f360324b32b4d5b36aa7c2725102b44ee592e1e16b35fd8ee6cdfa949ffc0b11686387251226190
+    color-convert: ^1.9.0
+  checksum: d85ade01c10e5dd77b6c89f34ed7531da5830d2cb5882c645f330079975b716438cd7ebb81d0d6e6b4f9c577f19ae41ab55f07f19786b02f9dfd9e0377395665
   languageName: node
   linkType: hard
 
-"babel-plugin-ember-modules-api-polyfill@npm:^2.6.0":
-  version: 2.13.4
-  resolution: "babel-plugin-ember-modules-api-polyfill@npm:2.13.4"
+"ansi-styles@npm:^4.0.0, ansi-styles@npm:^4.1.0":
+  version: 4.3.0
+  resolution: "ansi-styles@npm:4.3.0"
   dependencies:
-    ember-rfc176-data: ^0.3.13
-  checksum: 6d647183bc4ab14a7eb80361970fc0050c320af865ca88921e8e1406b2be13ccd318805e9e59c3b3485abe89f1ce34e1ef530e5a78880747103409cc48b3abc0
+    color-convert: ^2.0.1
+  checksum: 513b44c3b2105dd14cc42a19271e80f386466c4be574bccf60b627432f9198571ebf4ab1e4c3ba17347658f4ee1711c163d574248c0c1cdc2d5917a0ad582ec4
   languageName: node
   linkType: hard
 
-"babel-plugin-ember-modules-api-polyfill@npm:^3.5.0":
-  version: 3.5.0
-  resolution: "babel-plugin-ember-modules-api-polyfill@npm:3.5.0"
-  dependencies:
-    ember-rfc176-data: ^0.3.17
-  checksum: 70a4926fe9c9a6553b877ecf09cd6a077e3c73ac13b5e269fee116c7dcaceaff28b317a7b68c16a9cb6d0470079fbbb3265c2cf755061341c9ccbde28c58d684
+"ansi-styles@npm:^6.0.0, ansi-styles@npm:^6.1.0, ansi-styles@npm:^6.2.1":
+  version: 6.2.1
+  resolution: "ansi-styles@npm:6.2.1"
+  checksum: ef940f2f0ced1a6347398da88a91da7930c33ecac3c77b72c5905f8b8fe402c52e6fde304ff5347f616e27a742da3f1dc76de98f6866c69251ad0b07a66776d9
   languageName: node
   linkType: hard
 
-"babel-plugin-ember-template-compilation@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "babel-plugin-ember-template-compilation@npm:1.0.1"
-  dependencies:
-    babel-import-util: ^0.2.0
-    line-column: ^1.0.2
-    magic-string: ^0.25.7
-    string.prototype.matchall: ^4.0.5
-  checksum: 4eeb31754025fb4b88413028b3d71aa1e50e10cf873c939a314b694a51f5c2771476db6270c5e4cf1863f5ae9d94b696b3c692747ff691078437170a65f2f9ea
+"ansi-styles@npm:~1.0.0":
+  version: 1.0.0
+  resolution: "ansi-styles@npm:1.0.0"
+  checksum: 6dd47dccb268b4cc1fd0dd6617067a7acd34ad2761f0438800fdd55c0d45f50a90787acd82806009c2bf467f4e2920166be03e19b23529038c1c4527d80f598b
   languageName: node
   linkType: hard
 
-"babel-plugin-ember-template-compilation@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "babel-plugin-ember-template-compilation@npm:2.0.0"
+"ansi-to-html@npm:^0.6.15":
+  version: 0.6.15
+  resolution: "ansi-to-html@npm:0.6.15"
   dependencies:
-    babel-import-util: ^1.3.0
-  checksum: 8abe8d6b3f20574ef824a1b6d04694892dae85055ff7aa370a183b383c9322ace64c1bbc4b9ccd54d8b8507e3bd673df10e9f1331ed2d7f23d8f719943f23660
+    entities: ^2.0.0
+  bin:
+    ansi-to-html: bin/ansi-to-html
+  checksum: c899362a29b92c8ae075b72168b826f7c233875b475719304942f80695e0ce4a6812845021192da5fb0ac80b10209b4fae5aede42620a1b1b3d3b30f3ef77a86
   languageName: node
   linkType: hard
 
-"babel-plugin-ember-template-compilation@npm:^2.0.1":
-  version: 2.1.1
-  resolution: "babel-plugin-ember-template-compilation@npm:2.1.1"
-  dependencies:
-    "@glimmer/syntax": ^0.84.3
-    babel-import-util: ^2.0.0
-  checksum: 68ee924151b2081472690fcb6178b884af350b97584431a8648cfff69bf267a0923b3f1575ca265c822355e2aa4bb99b0c3500a98bef54f2fc0b67509215eb5b
+"ansicolors@npm:~0.2.1":
+  version: 0.2.1
+  resolution: "ansicolors@npm:0.2.1"
+  checksum: 7120ca45a780cf17d786070874776637adcc107cf2bb9b38934f92d88cb5c3d16e1e7092708ba0f64f2031e6c10844c26e8a13d9e27f7b058c36ad8950cbfd02
   languageName: node
   linkType: hard
 
-"babel-plugin-filter-imports@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "babel-plugin-filter-imports@npm:4.0.0"
+"anymatch@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "anymatch@npm:2.0.0"
   dependencies:
-    "@babel/types": ^7.7.2
-    lodash: ^4.17.15
-  checksum: 757522ac26c3f9f957a1c94c7eaca7abc2c493072b17f8af713589a2b56e1b8321d9c26ca5d0f1060e7be22f55c89a09bde771f8708f0f672d240eb2640fd9d1
+    micromatch: ^3.1.4
+    normalize-path: ^2.1.1
+  checksum: f7bb1929842b4585cdc28edbb385767d499ce7d673f96a8f11348d2b2904592ffffc594fe9229b9a1e9e4dccb9329b7692f9f45e6a11dcefbb76ecdc9ab740f6
   languageName: node
   linkType: hard
 
-"babel-plugin-htmlbars-inline-precompile@npm:^3.2.0":
-  version: 3.2.0
-  resolution: "babel-plugin-htmlbars-inline-precompile@npm:3.2.0"
-  checksum: 87793c975af74fd02cabc3a652a0694c15389bc24a1eecd4f2e78b6094be194a6d6e220f0a0489561ea123c052be86544ad96839bf7d78fb6867ffb16dc42ca0
+"anymatch@npm:^3.1.1, anymatch@npm:~3.1.2":
+  version: 3.1.3
+  resolution: "anymatch@npm:3.1.3"
+  dependencies:
+    normalize-path: ^3.0.0
+    picomatch: ^2.0.4
+  checksum: 3e044fd6d1d26545f235a9fe4d7a534e2029d8e59fa7fd9f2a6eb21230f6b5380ea1eaf55136e60cbf8e613544b3b766e7a6fa2102e2a3a117505466e3025dc2
   languageName: node
   linkType: hard
 
-"babel-plugin-htmlbars-inline-precompile@npm:^5.0.0, babel-plugin-htmlbars-inline-precompile@npm:^5.2.1, babel-plugin-htmlbars-inline-precompile@npm:^5.3.0":
-  version: 5.3.1
-  resolution: "babel-plugin-htmlbars-inline-precompile@npm:5.3.1"
-  dependencies:
-    babel-plugin-ember-modules-api-polyfill: ^3.5.0
-    line-column: ^1.0.2
-    magic-string: ^0.25.7
-    parse-static-imports: ^1.1.0
-    string.prototype.matchall: ^4.0.5
-  checksum: 8c486d44037b9d87628f15823d93fdf03bf532f9456bb7012de0d6e3791b5fdc61a339400a71acd517d30d57e9812fa6fea83a3185447aac16d05054bf669de0
+"aproba@npm:^1.0.3 || ^2.0.0":
+  version: 2.0.0
+  resolution: "aproba@npm:2.0.0"
+  checksum: 5615cadcfb45289eea63f8afd064ab656006361020e1735112e346593856f87435e02d8dcc7ff0d11928bc7d425f27bc7c2a84f6c0b35ab0ff659c814c138a24
   languageName: node
   linkType: hard
 
-"babel-plugin-inline-json-import@npm:^0.3.2":
-  version: 0.3.2
-  resolution: "babel-plugin-inline-json-import@npm:0.3.2"
+"are-we-there-yet@npm:^3.0.0":
+  version: 3.0.1
+  resolution: "are-we-there-yet@npm:3.0.1"
   dependencies:
-    decache: ^4.5.1
-  checksum: cf0cf9802a01e506e4aab44202ce01b8277da22503a2c0f4d60f3cf924f0900bb9e9b3782bffb90a8a25193af923484a5b115e68f6c94a5c5e4c9e058d868394
+    delegates: ^1.0.0
+    readable-stream: ^3.6.0
+  checksum: 52590c24860fa7173bedeb69a4c05fb573473e860197f618b9a28432ee4379049336727ae3a1f9c4cb083114601c1140cee578376164d0e651217a9843f9fe83
   languageName: node
   linkType: hard
 
-"babel-plugin-module-resolver@npm:^3.2.0":
-  version: 3.2.0
-  resolution: "babel-plugin-module-resolver@npm:3.2.0"
-  dependencies:
-    find-babel-config: ^1.1.0
-    glob: ^7.1.2
-    pkg-up: ^2.0.0
-    reselect: ^3.0.1
-    resolve: ^1.4.0
-  checksum: ef4f7fdb6db97b8c5d7f70b85f54876a1bead35ee360b85a4153d02ce32eba4571afcc71ae11d43b2b6d4c5eeae865fc2127012f9534cfab07f998e2692671e5
+"are-we-there-yet@npm:^4.0.0":
+  version: 4.0.2
+  resolution: "are-we-there-yet@npm:4.0.2"
+  checksum: 29d562d3aad6428aa4d732f78b058f1025fda00305bb307b4cd6ee26a43e5b4c90c113e97e01fa43bfe04556a800ba7e5c947907891ae99bfb8a5ae2488078d0
   languageName: node
   linkType: hard
 
-"babel-plugin-module-resolver@npm:^4.1.0":
-  version: 4.1.0
-  resolution: "babel-plugin-module-resolver@npm:4.1.0"
+"argparse@npm:^1.0.7":
+  version: 1.0.10
+  resolution: "argparse@npm:1.0.10"
   dependencies:
-    find-babel-config: ^1.2.0
-    glob: ^7.1.6
-    pkg-up: ^3.1.0
-    reselect: ^4.0.0
-    resolve: ^1.13.1
-  checksum: 3907fba21ca3c66a081e01fbd16bb09c84781749db16aa57805becc376bb5ee8dc373d4b209613e1453d30ea6c836d13073e9e7b6d239ff1806dd1763a9ab18f
+    sprintf-js: ~1.0.2
+  checksum: 7ca6e45583a28de7258e39e13d81e925cfa25d7d4aacbf806a382d3c02fcb13403a07fb8aeef949f10a7cfe4a62da0e2e807b348a5980554cc28ee573ef95945
   languageName: node
   linkType: hard
 
-"babel-plugin-module-resolver@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "babel-plugin-module-resolver@npm:5.0.0"
-  dependencies:
-    find-babel-config: ^2.0.0
-    glob: ^8.0.3
-    pkg-up: ^3.1.0
-    reselect: ^4.1.7
-    resolve: ^1.22.1
-  checksum: d6880e49fc8e7bac509a2c183b4303ee054a47a80032a59a6f7844bb468ebe5e333b5dc5378443afdab5839e2da2b31a6c8d9a985a0047cd076b82bb9161cc78
+"argparse@npm:^2.0.1":
+  version: 2.0.1
+  resolution: "argparse@npm:2.0.1"
+  checksum: 83644b56493e89a254bae05702abf3a1101b4fa4d0ca31df1c9985275a5a5bd47b3c27b7fa0b71098d41114d8ca000e6ed90cad764b306f8a503665e4d517ced
   languageName: node
   linkType: hard
 
-"babel-plugin-polyfill-corejs2@npm:^0.2.0":
-  version: 0.2.3
-  resolution: "babel-plugin-polyfill-corejs2@npm:0.2.3"
-  dependencies:
-    "@babel/compat-data": ^7.13.11
-    "@babel/helper-define-polyfill-provider": ^0.2.4
-    semver: ^6.1.1
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: a379fdb5aa046fb96516796afb50888bd22de1590fbdaed15c613910f3208500e705dd2a605fb30c0bb8b3191ee9ba9c10b3f46121e0507bf396186941056090
+"aria-query@npm:^5.3.0":
+  version: 5.3.2
+  resolution: "aria-query@npm:5.3.2"
+  checksum: d971175c85c10df0f6d14adfe6f1292409196114ab3c62f238e208b53103686f46cc70695a4f775b73bc65f6a09b6a092fd963c4f3a5a7d690c8fc5094925717
   languageName: node
   linkType: hard
 
-"babel-plugin-polyfill-corejs2@npm:^0.3.0":
-  version: 0.3.0
-  resolution: "babel-plugin-polyfill-corejs2@npm:0.3.0"
+"array-back@npm:^1.0.2, array-back@npm:^1.0.3":
+  version: 1.0.4
+  resolution: "array-back@npm:1.0.4"
   dependencies:
-    "@babel/compat-data": ^7.13.11
-    "@babel/helper-define-polyfill-provider": ^0.3.0
-    semver: ^6.1.1
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: ffede597982066221291fe7c48ec1f1dda2b4ed3ee3e715436320697f35368223e1275bf095769d0b0c1115b90031dc525dd81b8ee9f6c8972cf1d2e10ad2b7d
+    typical: ^2.6.0
+  checksum: 37a8be4cd4920b3d07bdbef40dae83bb37948f5d49601da98a6e48ba5496e9a0008e7f3f2184bcf4d3501bd371a048c9bdca7dc3cc5c3d5b1eb189bbba7b55db
   languageName: node
   linkType: hard
 
-"babel-plugin-polyfill-corejs2@npm:^0.4.6":
-  version: 0.4.6
-  resolution: "babel-plugin-polyfill-corejs2@npm:0.4.6"
+"array-back@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "array-back@npm:2.0.0"
   dependencies:
-    "@babel/compat-data": ^7.22.6
-    "@babel/helper-define-polyfill-provider": ^0.4.3
-    semver: ^6.3.1
-  peerDependencies:
-    "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0
-  checksum: 08896811df31530be6a9bcdd630cb9fd4b5ae5181039d18db3796efbc54e38d57a42af460845c10a04434e1bc45c0d47743c7e6c860383cc6b141083cde22030
+    typical: ^2.6.1
+  checksum: ab36ab3504b25116b47541fb0ac78ff13d1e991f33d98c361edd3aada3ed818a900b619bd67b195dd4e41b9256c27e8cdd6a69ece507e482f1207d07670ed6bd
   languageName: node
   linkType: hard
 
-"babel-plugin-polyfill-corejs3@npm:^0.2.0":
-  version: 0.2.5
-  resolution: "babel-plugin-polyfill-corejs3@npm:0.2.5"
-  dependencies:
-    "@babel/helper-define-polyfill-provider": ^0.2.2
-    core-js-compat: ^3.16.2
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 7d464001f6cecc6b85aef71307e3ef17980b15aae4b2ae75d38a3fc3166005f6354932f9c694566970a3fb428f8fbc44f94c46e055a5a85b7fe8820ca16f85b6
+"array-back@npm:^3.0.1, array-back@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "array-back@npm:3.1.0"
+  checksum: 7205004fcd0f9edd926db921af901b083094608d5b265738d0290092f9822f73accb468e677db74c7c94ef432d39e5ed75a7b1786701e182efb25bbba9734209
   languageName: node
   linkType: hard
 
-"babel-plugin-polyfill-corejs3@npm:^0.4.0":
-  version: 0.4.0
-  resolution: "babel-plugin-polyfill-corejs3@npm:0.4.0"
-  dependencies:
-    "@babel/helper-define-polyfill-provider": ^0.3.0
-    core-js-compat: ^3.18.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 18dce9a09a608b4844bce468a1d7b3abfc8a2a4c0df317ad6eb5951c0c95f3d1cc99699d8e67642cdd629f5074499d481481ae5e203ce85b8ed73e8295e25da8
+"array-back@npm:^4.0.1":
+  version: 4.0.2
+  resolution: "array-back@npm:4.0.2"
+  checksum: f30603270771eeb54e5aad5f54604c62b3577a18b6db212a7272b2b6c32049121b49431f656654790ed1469411e45f387e7627c0de8fd0515995cc40df9b9294
   languageName: node
   linkType: hard
 
-"babel-plugin-polyfill-corejs3@npm:^0.5.0":
-  version: 0.5.2
-  resolution: "babel-plugin-polyfill-corejs3@npm:0.5.2"
-  dependencies:
-    "@babel/helper-define-polyfill-provider": ^0.3.1
-    core-js-compat: ^3.21.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 2f3184c73f80f00ac876a5ebcad945fd8d2ae70e5f85b7ab6cc3bc69bc74025f4f7070de7abbb2a7274c78e130bd34fc13f4c85342da28205930364a1ef0aa21
+"array-back@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "array-back@npm:5.0.0"
+  checksum: 4e42d54e4b748dff229981df778cef8b8093f8bd1b6f1cdbfb92e89f883ddafd3e0e7b20939eb3d7b8a85b478c1b77924545923e6aad571c16ebb022a54805d5
   languageName: node
   linkType: hard
 
-"babel-plugin-polyfill-corejs3@npm:^0.8.5":
-  version: 0.8.6
-  resolution: "babel-plugin-polyfill-corejs3@npm:0.8.6"
-  dependencies:
-    "@babel/helper-define-polyfill-provider": ^0.4.3
-    core-js-compat: ^3.33.1
-  peerDependencies:
-    "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0
-  checksum: 36951c2edac42ac0f05b200502e90d77bf66ccee5b52e2937d23496c6ef2372cce31b8c64144da374b77bd3eb65e2721703a52eac56cad16a152326c092cbf77
+"array-back@npm:^6.2.2":
+  version: 6.2.2
+  resolution: "array-back@npm:6.2.2"
+  checksum: baae1e3a1687300a307d3bdf09715f6415e1099b5729d3d8e397309fb1e43d90b939d694602892172aaca7e0aeed38da89d04aa4951637d31c2a21350809e003
   languageName: node
   linkType: hard
 
-"babel-plugin-polyfill-regenerator@npm:^0.2.0":
-  version: 0.2.3
-  resolution: "babel-plugin-polyfill-regenerator@npm:0.2.3"
+"array-buffer-byte-length@npm:^1.0.1, array-buffer-byte-length@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "array-buffer-byte-length@npm:1.0.2"
   dependencies:
-    "@babel/helper-define-polyfill-provider": ^0.2.4
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: 81be5914f241d785abdfa3b5fc9005792b1b675e3e0a48bbc12db25b49e965985a500fc2008c8026ec7625a757d6d43aa44a75369fece1a413bd9863369e5a9c
+    call-bound: ^1.0.3
+    is-array-buffer: ^3.0.5
+  checksum: 0ae3786195c3211b423e5be8dd93357870e6fb66357d81da968c2c39ef43583ef6eece1f9cb1caccdae4806739c65dea832b44b8593414313cd76a89795fca63
   languageName: node
   linkType: hard
 
-"babel-plugin-polyfill-regenerator@npm:^0.3.0":
-  version: 0.3.0
-  resolution: "babel-plugin-polyfill-regenerator@npm:0.3.0"
-  dependencies:
-    "@babel/helper-define-polyfill-provider": ^0.3.0
-  peerDependencies:
-    "@babel/core": ^7.0.0-0
-  checksum: ecca4389fd557554efc6de834f84f7c85e83c348d5283de2032d35429bc7121ed6f336553d3d704021f9bef22fca339fbee560d3b0fb8bb1d4eca2fecaaeebcb
+"array-equal@npm:^1.0.0":
+  version: 1.0.2
+  resolution: "array-equal@npm:1.0.2"
+  checksum: 5c37df0cad330516d1255663dfa4fa761fb0ea63878f535aa70dfefe5499853a8b372faf0a27b91781ca1230f4b4333bbeb751e9b1748527d96df2bee30032ea
   languageName: node
   linkType: hard
 
-"babel-plugin-polyfill-regenerator@npm:^0.5.3":
-  version: 0.5.3
-  resolution: "babel-plugin-polyfill-regenerator@npm:0.5.3"
-  dependencies:
-    "@babel/helper-define-polyfill-provider": ^0.4.3
-  peerDependencies:
-    "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0
-  checksum: 2bb546582cda1870d19e646a7183baeb2cccd56e0ef3e4eaeabd28e120daf17cb87399194a9ccdcf32506bcaa68d23e73440fc8ab990a7a0f8c5a77c12d5d4bc
+"array-flatten@npm:1.1.1":
+  version: 1.1.1
+  resolution: "array-flatten@npm:1.1.1"
+  checksum: a9925bf3512d9dce202112965de90c222cd59a4fbfce68a0951d25d965cf44642931f40aac72309c41f12df19afa010ecadceb07cfff9ccc1621e99d89ab5f3b
   languageName: node
   linkType: hard
 
-"babel-plugin-syntax-async-functions@npm:^6.8.0":
-  version: 6.13.0
-  resolution: "babel-plugin-syntax-async-functions@npm:6.13.0"
-  checksum: e982d9756869fa83eb6a4502490a90b0d31e8a41e2ee582045934f022ac8ff5fa6a3386366976fab3a391d5a7ab8ea5f9da623f35ed8ab328b8ab6d9b2feb1d3
+"array-to-error@npm:^1.0.0":
+  version: 1.1.1
+  resolution: "array-to-error@npm:1.1.1"
+  dependencies:
+    array-to-sentence: ^1.1.0
+  checksum: c476c79249b4852f4ae6e2cff1463c3343986d1324e273c6404ccea1748a5b1900d05e774fc84f3f29c964aa4d36702d5c0426034856197da73557797c947e0f
   languageName: node
   linkType: hard
 
-"babel-plugin-syntax-dynamic-import@npm:^6.18.0":
-  version: 6.18.0
-  resolution: "babel-plugin-syntax-dynamic-import@npm:6.18.0"
-  checksum: 0a7a98ecb63878d65d4fd35e5435b0a7ad8e5c43b394389ce82298733c7a5d95c4373f1dd68566694214dad64abd0fec1e4eb7ee9ca7d1ee06d502e630d61600
+"array-to-sentence@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "array-to-sentence@npm:1.1.0"
+  checksum: 7252ed7b93c6c5f07afcc67feef34b68f9b0b744f00fc7317e6d12f2c3320dc5417cedfc0c23497cc867ebdeca0573486ca8e6b09a515c5e6a90e860c668f2b6
   languageName: node
   linkType: hard
 
-"babel-plugin-syntax-exponentiation-operator@npm:^6.8.0":
-  version: 6.13.0
-  resolution: "babel-plugin-syntax-exponentiation-operator@npm:6.13.0"
-  checksum: cbcb3aeae7005240325f72d55c3c90575033123e8a1ddfa6bf9eac4ee7e246c2a23f5b5ab1144879590d947a3ed1d88838169d125e5d7c4f53678526482b020e
+"array-union@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "array-union@npm:2.1.0"
+  checksum: 5bee12395cba82da674931df6d0fea23c4aa4660cb3b338ced9f828782a65caa232573e6bf3968f23e0c5eb301764a382cef2f128b170a9dc59de0e36c39f98d
   languageName: node
   linkType: hard
 
-"babel-plugin-syntax-trailing-function-commas@npm:^6.22.0":
-  version: 6.22.0
-  resolution: "babel-plugin-syntax-trailing-function-commas@npm:6.22.0"
-  checksum: d8b9039ded835bb128e8e14eeeb6e0ac2a876b85250924bdc3a8dc2a6984d3bfade4de04d40fb15ea04a86d561ac280ae0d7306d7d4ef7a8c52c43b6a23909c6
+"arraybuffer.prototype.slice@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "arraybuffer.prototype.slice@npm:1.0.4"
+  dependencies:
+    array-buffer-byte-length: ^1.0.1
+    call-bind: ^1.0.8
+    define-properties: ^1.2.1
+    es-abstract: ^1.23.5
+    es-errors: ^1.3.0
+    get-intrinsic: ^1.2.6
+    is-array-buffer: ^3.0.4
+  checksum: b1d1fd20be4e972a3779b1569226f6740170dca10f07aa4421d42cefeec61391e79c557cda8e771f5baefe47d878178cd4438f60916ce831813c08132bced765
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-async-to-generator@npm:^6.22.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-async-to-generator@npm:6.24.1"
-  dependencies:
-    babel-helper-remap-async-to-generator: ^6.24.1
-    babel-plugin-syntax-async-functions: ^6.8.0
-    babel-runtime: ^6.22.0
-  checksum: ffe8b4b2ed6db1f413ede385bd1a36f39e02a64ed79ce02779440049af75215c98f8debdc70eb01430bfd889f792682b0136576fe966f7f9e1b30e2a54695a8d
+"arrify@npm:^2.0.1":
+  version: 2.0.1
+  resolution: "arrify@npm:2.0.1"
+  checksum: 067c4c1afd182806a82e4c1cb8acee16ab8b5284fbca1ce29408e6e91281c36bb5b612f6ddfbd40a0f7a7e0c75bf2696eb94c027f6e328d6e9c52465c98e4209
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-arrow-functions@npm:^6.22.0":
-  version: 6.22.0
-  resolution: "babel-plugin-transform-es2015-arrow-functions@npm:6.22.0"
+"asn1js@npm:^3.0.3, asn1js@npm:~3.0.6":
+  version: 3.0.6
+  resolution: "asn1js@npm:3.0.6"
   dependencies:
-    babel-runtime: ^6.22.0
-  checksum: 746e2be0fed20771c07f0984ba79ef0bab37d6e98434267ec96cef57272014fe53a180bfb9047bf69ed149d367a2c97baad54d6057531cd037684f371aab2333
+    pvtsutils: ^1.3.6
+    pvutils: ^1.1.3
+    tslib: ^2.8.1
+  checksum: 2b43a4c7964183cc2c6b45d7f757eeeb93d2c60e89250dae2826250580e2049a43a795af6ab6d8eb6cbb13c8f51674a430923b2981313c64503b7159e378b477
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-block-scoped-functions@npm:^6.22.0":
-  version: 6.22.0
-  resolution: "babel-plugin-transform-es2015-block-scoped-functions@npm:6.22.0"
-  dependencies:
-    babel-runtime: ^6.22.0
-  checksum: f251611f723d94b4068d2a873a2783e019bd81bd7144cfdbcfc31ef166f4d82fa2f1efba64342ba2630dab93a2b12284067725c0aa08315712419a2bc3b92a75
+"assert-never@npm:^1.2.1":
+  version: 1.4.0
+  resolution: "assert-never@npm:1.4.0"
+  checksum: e51e1fc4587405b929d07f1b033f7e92b9f59f9a9ced20f2bb2e5218b06a079fdf8c5b0e993366acc2ca25050a437a2df1f4e624959151e60f4893cad4e50d89
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-block-scoping@npm:^6.23.0":
-  version: 6.26.0
-  resolution: "babel-plugin-transform-es2015-block-scoping@npm:6.26.0"
+"ast-metadata-inferer@npm:^0.8.0":
+  version: 0.8.1
+  resolution: "ast-metadata-inferer@npm:0.8.1"
   dependencies:
-    babel-runtime: ^6.26.0
-    babel-template: ^6.26.0
-    babel-traverse: ^6.26.0
-    babel-types: ^6.26.0
-    lodash: ^4.17.4
-  checksum: 5e4dee33bf4aab0ce7751a9ae845c25d3bf03944ffdfc8d784e1de2123a3eec19657dd59274c9969461757f5e2ab75c517e978bafe5309a821a41e278ad38a63
+    "@mdn/browser-compat-data": ^5.6.19
+  checksum: 6a8d27f27f6af852ff3b167743285c8ace5a3fe4d14f6e7c9de61950143632e3fdee3dcb96799dcf4f64cd7e18e2db2ad6fcb3456dfb048381157194ed34f8d1
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-classes@npm:^6.23.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-classes@npm:6.24.1"
-  dependencies:
-    babel-helper-define-map: ^6.24.1
-    babel-helper-function-name: ^6.24.1
-    babel-helper-optimise-call-expression: ^6.24.1
-    babel-helper-replace-supers: ^6.24.1
-    babel-messages: ^6.23.0
-    babel-runtime: ^6.22.0
-    babel-template: ^6.24.1
-    babel-traverse: ^6.24.1
-    babel-types: ^6.24.1
-  checksum: 999392b47a83cf9297e49fbde00bc9b15fb6d71bc041f7b3d621ac45361486ec4b66f55c47f98dca6c398ceaa8bfc9f3c21257854822c4523e7475a92e6c000a
+"ast-types@npm:0.13.3":
+  version: 0.13.3
+  resolution: "ast-types@npm:0.13.3"
+  checksum: 23d08bc589aacb787e22ac7efc086ebcc158e739c057dac74de409a97e26ec9c5bcb2d0709f5678bd5d90f67d93f62fba0e5fe98161a0a3a7534d55a155544d8
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-computed-properties@npm:^6.22.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-computed-properties@npm:6.24.1"
-  dependencies:
-    babel-runtime: ^6.22.0
-    babel-template: ^6.24.1
-  checksum: 34e466bfd4b021aa3861db66cf10a9093fa6a4fcedbc8c82a55f6ca1fcbd212a9967f2df6c5f9e9a20046fa43c8967633a476f2bbc15cb8d3769cbba948a5c16
+"astral-regex@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "astral-regex@npm:2.0.0"
+  checksum: 876231688c66400473ba505731df37ea436e574dd524520294cc3bbc54ea40334865e01fa0d074d74d036ee874ee7e62f486ea38bc421ee8e6a871c06f011766
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-destructuring@npm:^6.23.0":
-  version: 6.23.0
-  resolution: "babel-plugin-transform-es2015-destructuring@npm:6.23.0"
+"async-disk-cache@npm:^1.2.1":
+  version: 1.3.5
+  resolution: "async-disk-cache@npm:1.3.5"
   dependencies:
-    babel-runtime: ^6.22.0
-  checksum: 1343d27f09846e6e1e48da7b83d0d4f2d5571559c468ad8ad4c3715b8ff3e21b2d553e90ad420dc6840de260b7f3b9f9c057606d527e3d838a52a3a7c5fffdbe
+    debug: ^2.1.3
+    heimdalljs: ^0.2.3
+    istextorbinary: 2.1.0
+    mkdirp: ^0.5.0
+    rimraf: ^2.5.3
+    rsvp: ^3.0.18
+    username-sync: ^1.0.2
+  checksum: 1844554469dc4a0abc855ad3c46296ccf105923186a662c47a85e5fa6a818a2693f2f941b903f2e28ab29895bd41596a81b42f670b71772a8134374f7459f51e
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-duplicate-keys@npm:^6.22.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-duplicate-keys@npm:6.24.1"
+"async-disk-cache@npm:^2.0.0":
+  version: 2.1.0
+  resolution: "async-disk-cache@npm:2.1.0"
   dependencies:
-    babel-runtime: ^6.22.0
-    babel-types: ^6.24.1
-  checksum: 756a7a13517c3e80c8312137b9872b9bc32fbfbb905e9f1e45bf321e2b464d0e6a6e6deca22c61b62377225bd8136b73580897cccb394995d6e00bc8ce882ba4
+    debug: ^4.1.1
+    heimdalljs: ^0.2.3
+    istextorbinary: ^2.5.1
+    mkdirp: ^0.5.0
+    rimraf: ^3.0.0
+    rsvp: ^4.8.5
+    username-sync: ^1.0.2
+  checksum: 08dbea2062961885d646d97f46a4309d8ca5254d326a7dd119c8769d31ccab063fa24acf08bce82e38e789997933e6480bcbf97be8e015023cd6685929b93bfb
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-for-of@npm:^6.23.0":
-  version: 6.23.0
-  resolution: "babel-plugin-transform-es2015-for-of@npm:6.23.0"
-  dependencies:
-    babel-runtime: ^6.22.0
-  checksum: 0124e320c32b25de84ddaba951a6f0ad031fa5019de54de32bd317d2a97b3f967026008f32e8c88728330c1cce7c4f1d0ecb15007020d50bd5ca1438a882e205
+"async-function@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "async-function@npm:1.0.0"
+  checksum: 9102e246d1ed9b37ac36f57f0a6ca55226876553251a31fc80677e71471f463a54c872dc78d5d7f80740c8ba624395cccbe8b60f7b690c4418f487d8e9fd1106
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-function-name@npm:^6.22.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-function-name@npm:6.24.1"
+"async-promise-queue@npm:^1.0.3, async-promise-queue@npm:^1.0.5":
+  version: 1.0.5
+  resolution: "async-promise-queue@npm:1.0.5"
   dependencies:
-    babel-helper-function-name: ^6.24.1
-    babel-runtime: ^6.22.0
-    babel-types: ^6.24.1
-  checksum: 629ecd824d53ec973a3ef85e74d9fd8c710203084ca2f7ac833879ddfa3b83a28f0270fe2ee5f3b8c078bb4b3e4b843173a646a7cd4abc49e8c1c563d31fb711
+    async: ^2.4.1
+    debug: ^2.6.8
+  checksum: 6f18b65e4bac8c12822d66c532aba6c8a8d81ee6e7d790bc7c399e882ff55b642a86379a58df9129db8560f57f76dea0af39b065f43568fb4bec4edf40e415a9
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-literals@npm:^6.22.0":
-  version: 6.22.0
-  resolution: "babel-plugin-transform-es2015-literals@npm:6.22.0"
+"async@npm:2.6.4":
+  version: 2.6.4
+  resolution: "async@npm:2.6.4"
   dependencies:
-    babel-runtime: ^6.22.0
-  checksum: 40e270580a0236990f2555f5dc7ae24b4db9f4709ca455ed1a6724b0078592482274be7448579b14122bd06481641a38e7b2e48d0b49b8c81c88e154a26865b4
+    lodash: ^4.17.14
+  checksum: a52083fb32e1ebe1d63e5c5624038bb30be68ff07a6c8d7dfe35e47c93fc144bd8652cbec869e0ac07d57dde387aa5f1386be3559cdee799cb1f789678d88e19
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-modules-amd@npm:^6.22.0, babel-plugin-transform-es2015-modules-amd@npm:^6.24.0, babel-plugin-transform-es2015-modules-amd@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-modules-amd@npm:6.24.1"
-  dependencies:
-    babel-plugin-transform-es2015-modules-commonjs: ^6.24.1
-    babel-runtime: ^6.22.0
-    babel-template: ^6.24.1
-  checksum: 084c7a1ef3bd0b2b9f4851b27cfb65f8ea1408349af05b4d88f994c23844a0754abfa4799bbc5f3f0ec94232b3a54a2e46d7f1dff1bdd40fa66a46f645197dfa
+"at-least-node@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "at-least-node@npm:1.0.0"
+  checksum: 463e2f8e43384f1afb54bc68485c436d7622acec08b6fad269b421cb1d29cebb5af751426793d0961ed243146fe4dc983402f6d5a51b720b277818dbf6f2e49e
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-modules-commonjs@npm:^6.23.0, babel-plugin-transform-es2015-modules-commonjs@npm:^6.24.1":
-  version: 6.26.2
-  resolution: "babel-plugin-transform-es2015-modules-commonjs@npm:6.26.2"
-  dependencies:
-    babel-plugin-transform-strict-mode: ^6.24.1
-    babel-runtime: ^6.26.0
-    babel-template: ^6.26.0
-    babel-types: ^6.26.0
-  checksum: 9cd93a84037855c1879bcc100229bee25b44c4805a9a9f040e8927f772c4732fa17a0706c81ea0db77b357dd9baf84388eec03ceb36597932c48fe32fb3d4171
+"autosize@npm:~6.0.1":
+  version: 6.0.1
+  resolution: "autosize@npm:6.0.1"
+  checksum: 116635be9479baee6dd9c4f0545fbd07318e83bcdb198f9c41c0594af82ca52a1e0cce38797dcbda9d321467805293e66a3b2f3e01a82952ff879c50e2c813e8
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-modules-systemjs@npm:^6.23.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-modules-systemjs@npm:6.24.1"
+"available-typed-arrays@npm:^1.0.7":
+  version: 1.0.7
+  resolution: "available-typed-arrays@npm:1.0.7"
   dependencies:
-    babel-helper-hoist-variables: ^6.24.1
-    babel-runtime: ^6.22.0
-    babel-template: ^6.24.1
-  checksum: b34877e201d7b4d293d87c04962a3575fe7727a9593e99ce3a7f8deea3da8883a08bd87a6a12927083ac26f47f6944a31cdbfe3d6eb4d18dd884cb2d304ee943
+    possible-typed-array-names: ^1.0.0
+  checksum: 1aa3ffbfe6578276996de660848b6e95669d9a95ad149e3dd0c0cda77db6ee1dbd9d1dd723b65b6d277b882dd0c4b91a654ae9d3cf9e1254b7e93e4908d78fd3
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-modules-umd@npm:^6.23.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-modules-umd@npm:6.24.1"
-  dependencies:
-    babel-plugin-transform-es2015-modules-amd: ^6.24.1
-    babel-runtime: ^6.22.0
-    babel-template: ^6.24.1
-  checksum: 735857b9f2ad0c41ceda31a1594fe2a063025f4428f9e243885a437b5bd415aca445a5e8495ff34b7120617735b1c3a2158033f0be23f1f5a90e655fff742a01
+"axe-core@npm:^4.10.3":
+  version: 4.10.3
+  resolution: "axe-core@npm:4.10.3"
+  checksum: e89fa5bcad9216f2de29bbdf95d6211d8c5b1025cbdcf56b6695c18b2e9a1eebd0b997a0141334169f6f062fc68fd39a5b97f86348d9f5be05958eade5c1ec78
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-object-super@npm:^6.22.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-object-super@npm:6.24.1"
-  dependencies:
-    babel-helper-replace-supers: ^6.24.1
-    babel-runtime: ^6.22.0
-  checksum: 97b2968f699ac94cb55f4f1e7ea53dc9e4264ec99cab826f40f181da9f6db5980cd8b4985f05c7b6f1e19fbc31681e6e63894dfc5ecf4b3a673d736c4ef0f9db
+"babel-import-util@npm:^0.2.0":
+  version: 0.2.0
+  resolution: "babel-import-util@npm:0.2.0"
+  checksum: 32a71d1de47cfbf99dba552e87c11798ef6116643f24429a654b09cb7d365db0dd5bbfe318eb1b63f0c9eae3a4a0c2aefd9c1e21f2b21f1e24ad703693429f95
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-parameters@npm:^6.23.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-parameters@npm:6.24.1"
-  dependencies:
-    babel-helper-call-delegate: ^6.24.1
-    babel-helper-get-function-arity: ^6.24.1
-    babel-runtime: ^6.22.0
-    babel-template: ^6.24.1
-    babel-traverse: ^6.24.1
-    babel-types: ^6.24.1
-  checksum: bb6c047dc10499be8ccebdffac22c77f14aee5d3106da8f2e96c801d2746403c809d8c6922e8ebd2eb31d8827b4bb2321ba43378fcdc9dca206417bb345c4f93
+"babel-import-util@npm:^1.2.2":
+  version: 1.4.1
+  resolution: "babel-import-util@npm:1.4.1"
+  checksum: a7f43a10141f62f05c0b4b3c80ee31f5f362d5f7a7d614fcef836f3eca2ec3ae0a732f8550674542d1821e87c3fd3d986fea94ed12e2a283a1571b6d1249380a
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-shorthand-properties@npm:^6.22.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-shorthand-properties@npm:6.24.1"
-  dependencies:
-    babel-runtime: ^6.22.0
-    babel-types: ^6.24.1
-  checksum: 9302c5de158a28432e932501a783560094c624c3659f4e0a472b6b2e9d6e8ab2634f82ef74d3e75363d46ccff6aad119267dbc34f67464c70625e24a651ad9e5
+"babel-import-util@npm:^2.0.0, babel-import-util@npm:^2.0.1, babel-import-util@npm:^2.1.1":
+  version: 2.1.1
+  resolution: "babel-import-util@npm:2.1.1"
+  checksum: a2aa8fd8c20ae2a9a89bd729791223761f565b1d717098546545021b0d6fcac6f20cc0d85fdcb06d19d0dd4b60d431c2e032dfcb8b137a114a9b554290b86fae
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-spread@npm:^6.22.0":
-  version: 6.22.0
-  resolution: "babel-plugin-transform-es2015-spread@npm:6.22.0"
-  dependencies:
-    babel-runtime: ^6.22.0
-  checksum: 8694a8a7802d905503194ab81c155354b36d39fc819ad2148f83146518dd37d2c6926c8568712f5aa890169afc9353fd4bcc49397959c6dc9da3480b449c0ae9
+"babel-import-util@npm:^3.0.0, babel-import-util@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "babel-import-util@npm:3.0.1"
+  checksum: 42c2480edb1dd469fafb743df0b7277f39d48ec125cc8f9a73eea7723431ee7c9c862c0983a1a4c8241034803fe44a3725cbe0653b2a45fa40621b318c9c4a14
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-sticky-regex@npm:^6.22.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-sticky-regex@npm:6.24.1"
+"babel-loader@npm:^8.0.6":
+  version: 8.4.1
+  resolution: "babel-loader@npm:8.4.1"
   dependencies:
-    babel-helper-regex: ^6.24.1
-    babel-runtime: ^6.22.0
-    babel-types: ^6.24.1
-  checksum: d9c45401caf0d74779a1170e886976d4c865b7de2e90dfffc7557481b9e73b6e37e9f1028aa07b813896c4df88f4d7e89968249a74547c7875e6c499c90c801d
+    find-cache-dir: ^3.3.1
+    loader-utils: ^2.0.4
+    make-dir: ^3.1.0
+    schema-utils: ^2.6.5
+  peerDependencies:
+    "@babel/core": ^7.0.0
+    webpack: ">=2"
+  checksum: fa02db1a7d3ebb7b4aab83e926fb51e627a00427943c9dd1b3302c8099c67fa6a242a2adeed37d95abcd39ba619edf558a1dec369ce0849c5a87dc290c90fe2f
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-template-literals@npm:^6.22.0":
-  version: 6.22.0
-  resolution: "babel-plugin-transform-es2015-template-literals@npm:6.22.0"
-  dependencies:
-    babel-runtime: ^6.22.0
-  checksum: 4fad2b7b383a2e784858ee7bf837419ee8ff9602afe218e1472f8c33a0c008f01d06f23ff2f2322fb23e1ed17e37237a818575fe88ecc5417d85331973b0ea4d
+"babel-plugin-compact-reexports@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "babel-plugin-compact-reexports@npm:1.1.0"
+  checksum: b2e56896a53a010f96f90f3e13d8bb5485bbe8ebc7203d01d1360ec1a5e374f7bffe9c02a244d946ebff384611533e0b349c93f5da4c1a9c08b9e676fc76b22f
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-typeof-symbol@npm:^6.23.0":
-  version: 6.23.0
-  resolution: "babel-plugin-transform-es2015-typeof-symbol@npm:6.23.0"
+"babel-plugin-debug-macros@npm:^0.2.0":
+  version: 0.2.0
+  resolution: "babel-plugin-debug-macros@npm:0.2.0"
   dependencies:
-    babel-runtime: ^6.22.0
-  checksum: 68a1609c6abcddf5f138c56bafcd9fad7c6b3b404fe40910148ab70eb21d6c7807a343a64eb81ce45daf4b70c384c528c55fad45e0d581e4b09efa4d574a6a1b
+    semver: ^5.3.0
+  peerDependencies:
+    "@babel/core": ^7.0.0-beta.42
+  checksum: 6ea36c7893940df58f08f9d0c72d2e02cf77a763084572d6f6c1291c462108af318eaa737549f96ba332b624efe0cdab6fcb49afa6466388012dbecd749f713c
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-es2015-unicode-regex@npm:^6.22.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-es2015-unicode-regex@npm:6.24.1"
+"babel-plugin-debug-macros@npm:^0.3.4":
+  version: 0.3.4
+  resolution: "babel-plugin-debug-macros@npm:0.3.4"
   dependencies:
-    babel-helper-regex: ^6.24.1
-    babel-runtime: ^6.22.0
-    regexpu-core: ^2.0.0
-  checksum: 739ddb02e5f77904f83ea45323c9a636e3aed34b2a49c7c68208b5f2834eecb6b655e772f870f16a7aaf09ac8219f754ad69d61741d088f5b681d13cda69265d
+    semver: ^5.3.0
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 77762b945a4d4a24d973b659938e4ff9fe485f08c4ad5c8459f184669d946f5883870a6f05a39f09773bcd0923162dcad5fbf8773cf38b3176d71ca415e9e869
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-exponentiation-operator@npm:^6.22.0":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-exponentiation-operator@npm:6.24.1"
+"babel-plugin-ember-data-packages-polyfill@npm:^0.1.2":
+  version: 0.1.2
+  resolution: "babel-plugin-ember-data-packages-polyfill@npm:0.1.2"
   dependencies:
-    babel-helper-builder-binary-assignment-operator-visitor: ^6.24.1
-    babel-plugin-syntax-exponentiation-operator: ^6.8.0
-    babel-runtime: ^6.22.0
-  checksum: 533ad53ba2cd6ff3c0f751563e1beea429c620038dc2efeeb8348ab4752ebcc95d1521857abfd08047400f1921b2d4df5e0cd266e65ddbe4c3edc58b9ad6fd3c
+    "@ember-data/rfc395-data": ^0.0.4
+  checksum: c61f9d70898db94feefea7a8cc958c52015fc23b17957eac2f360324b32b4d5b36aa7c2725102b44ee592e1e16b35fd8ee6cdfa949ffc0b11686387251226190
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-regenerator@npm:^6.22.0":
-  version: 6.26.0
-  resolution: "babel-plugin-transform-regenerator@npm:6.26.0"
+"babel-plugin-ember-modules-api-polyfill@npm:^3.5.0":
+  version: 3.5.0
+  resolution: "babel-plugin-ember-modules-api-polyfill@npm:3.5.0"
   dependencies:
-    regenerator-transform: ^0.10.0
-  checksum: 41a51d8f692bf4a5cbd705fa70f3cb6abebae66d9ba3dccfb5921da262f8c30f630e1fe9f7b132e29b96fe0d99385a801f6aa204278c5bd0af4284f7f93a665a
+    ember-rfc176-data: ^0.3.17
+  checksum: 70a4926fe9c9a6553b877ecf09cd6a077e3c73ac13b5e269fee116c7dcaceaff28b317a7b68c16a9cb6d0470079fbbb3265c2cf755061341c9ccbde28c58d684
   languageName: node
   linkType: hard
 
-"babel-plugin-transform-strict-mode@npm:^6.24.1":
-  version: 6.24.1
-  resolution: "babel-plugin-transform-strict-mode@npm:6.24.1"
+"babel-plugin-ember-template-compilation@npm:^2.0.0, babel-plugin-ember-template-compilation@npm:^2.0.1, babel-plugin-ember-template-compilation@npm:^2.1.1":
+  version: 2.4.1
+  resolution: "babel-plugin-ember-template-compilation@npm:2.4.1"
   dependencies:
-    babel-runtime: ^6.22.0
-    babel-types: ^6.24.1
-  checksum: 32d70ce9d8c8918a6a840e46df03dfe1e265eb9b25df5a800fedb5065ef1b4b5f24d7c62d92fca0e374db8b0b9b6f84e68edd02ad21883d48f608583ec29f638
+    "@glimmer/syntax": ">= 0.94.9"
+    babel-import-util: ^3.0.0
+  checksum: f759828f69e7b974ea9ef7f6e40481dbda223f5cbee46f8cb7bba4b871710174f097b49e7abe75602a5a4be1a242e48f3c7d3f4e6346c9fe5c847d0b4603084c
   languageName: node
   linkType: hard
 
-"babel-polyfill@npm:^6.26.0":
-  version: 6.26.0
-  resolution: "babel-polyfill@npm:6.26.0"
+"babel-plugin-filter-imports@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "babel-plugin-filter-imports@npm:4.0.0"
   dependencies:
-    babel-runtime: ^6.26.0
-    core-js: ^2.5.0
-    regenerator-runtime: ^0.10.5
-  checksum: 6fb1a3c0bfe1b6fc56ce1afcf531878aa629b309277a05fbf3fe950589b24cb4052a6e487db21d318eb5336b68730a21f5ef62166b6cc8aea3406261054d1118
+    "@babel/types": ^7.7.2
+    lodash: ^4.17.15
+  checksum: 757522ac26c3f9f957a1c94c7eaca7abc2c493072b17f8af713589a2b56e1b8321d9c26ca5d0f1060e7be22f55c89a09bde771f8708f0f672d240eb2640fd9d1
   languageName: node
   linkType: hard
 
-"babel-preset-env@npm:^1.7.0":
-  version: 1.7.0
-  resolution: "babel-preset-env@npm:1.7.0"
-  dependencies:
-    babel-plugin-check-es2015-constants: ^6.22.0
-    babel-plugin-syntax-trailing-function-commas: ^6.22.0
-    babel-plugin-transform-async-to-generator: ^6.22.0
-    babel-plugin-transform-es2015-arrow-functions: ^6.22.0
-    babel-plugin-transform-es2015-block-scoped-functions: ^6.22.0
-    babel-plugin-transform-es2015-block-scoping: ^6.23.0
-    babel-plugin-transform-es2015-classes: ^6.23.0
-    babel-plugin-transform-es2015-computed-properties: ^6.22.0
-    babel-plugin-transform-es2015-destructuring: ^6.23.0
-    babel-plugin-transform-es2015-duplicate-keys: ^6.22.0
-    babel-plugin-transform-es2015-for-of: ^6.23.0
-    babel-plugin-transform-es2015-function-name: ^6.22.0
-    babel-plugin-transform-es2015-literals: ^6.22.0
-    babel-plugin-transform-es2015-modules-amd: ^6.22.0
-    babel-plugin-transform-es2015-modules-commonjs: ^6.23.0
-    babel-plugin-transform-es2015-modules-systemjs: ^6.23.0
-    babel-plugin-transform-es2015-modules-umd: ^6.23.0
-    babel-plugin-transform-es2015-object-super: ^6.22.0
-    babel-plugin-transform-es2015-parameters: ^6.23.0
-    babel-plugin-transform-es2015-shorthand-properties: ^6.22.0
-    babel-plugin-transform-es2015-spread: ^6.22.0
-    babel-plugin-transform-es2015-sticky-regex: ^6.22.0
-    babel-plugin-transform-es2015-template-literals: ^6.22.0
-    babel-plugin-transform-es2015-typeof-symbol: ^6.23.0
-    babel-plugin-transform-es2015-unicode-regex: ^6.22.0
-    babel-plugin-transform-exponentiation-operator: ^6.22.0
-    babel-plugin-transform-regenerator: ^6.22.0
-    browserslist: ^3.2.6
-    invariant: ^2.2.2
-    semver: ^5.3.0
-  checksum: 6e459a6c76086a2a377707680148b94c3d0aba425b039b427ca01171ebada7f5db5d336b309548462f6ba015e13176a4724f912875c15084d4aa88d77020d185
+"babel-plugin-htmlbars-inline-precompile@npm:^5.0.0, babel-plugin-htmlbars-inline-precompile@npm:^5.2.1, babel-plugin-htmlbars-inline-precompile@npm:^5.3.0":
+  version: 5.3.1
+  resolution: "babel-plugin-htmlbars-inline-precompile@npm:5.3.1"
+  dependencies:
+    babel-plugin-ember-modules-api-polyfill: ^3.5.0
+    line-column: ^1.0.2
+    magic-string: ^0.25.7
+    parse-static-imports: ^1.1.0
+    string.prototype.matchall: ^4.0.5
+  checksum: 8c486d44037b9d87628f15823d93fdf03bf532f9456bb7012de0d6e3791b5fdc61a339400a71acd517d30d57e9812fa6fea83a3185447aac16d05054bf669de0
   languageName: node
   linkType: hard
 
-"babel-register@npm:^6.26.0":
-  version: 6.26.0
-  resolution: "babel-register@npm:6.26.0"
+"babel-plugin-inline-json-import@npm:~0.3.2":
+  version: 0.3.2
+  resolution: "babel-plugin-inline-json-import@npm:0.3.2"
   dependencies:
-    babel-core: ^6.26.0
-    babel-runtime: ^6.26.0
-    core-js: ^2.5.0
-    home-or-tmp: ^2.0.0
-    lodash: ^4.17.4
-    mkdirp: ^0.5.1
-    source-map-support: ^0.4.15
-  checksum: 75d5fe060e4850dbdbd5f56db2928cd0b6b6c93a65ba5f2a991465af4dc3f4adf46d575138f228b2169b1e25e3b4a7cdd16515a355fea41b873321bf56467583
+    decache: ^4.5.1
+  checksum: cf0cf9802a01e506e4aab44202ce01b8277da22503a2c0f4d60f3cf924f0900bb9e9b3782bffb90a8a25193af923484a5b115e68f6c94a5c5e4c9e058d868394
   languageName: node
   linkType: hard
 
-"babel-runtime@npm:^6.18.0, babel-runtime@npm:^6.22.0, babel-runtime@npm:^6.26.0":
-  version: 6.26.0
-  resolution: "babel-runtime@npm:6.26.0"
+"babel-plugin-module-resolver@npm:^3.2.0":
+  version: 3.2.0
+  resolution: "babel-plugin-module-resolver@npm:3.2.0"
   dependencies:
-    core-js: ^2.4.0
-    regenerator-runtime: ^0.11.0
-  checksum: 8aeade94665e67a73c1ccc10f6fd42ba0c689b980032b70929de7a6d9a12eb87ef51902733f8fefede35afea7a5c3ef7e916a64d503446c1eedc9e3284bd3d50
+    find-babel-config: ^1.1.0
+    glob: ^7.1.2
+    pkg-up: ^2.0.0
+    reselect: ^3.0.1
+    resolve: ^1.4.0
+  checksum: ef4f7fdb6db97b8c5d7f70b85f54876a1bead35ee360b85a4153d02ce32eba4571afcc71ae11d43b2b6d4c5eeae865fc2127012f9534cfab07f998e2692671e5
   languageName: node
   linkType: hard
 
-"babel-template@npm:^6.24.1, babel-template@npm:^6.26.0":
-  version: 6.26.0
-  resolution: "babel-template@npm:6.26.0"
+"babel-plugin-module-resolver@npm:^5.0.0":
+  version: 5.0.2
+  resolution: "babel-plugin-module-resolver@npm:5.0.2"
   dependencies:
-    babel-runtime: ^6.26.0
-    babel-traverse: ^6.26.0
-    babel-types: ^6.26.0
-    babylon: ^6.18.0
-    lodash: ^4.17.4
-  checksum: 028dd57380f09b5641b74874a19073c53c4fb3f1696e849575aae18f8c80eaf21db75209057db862f3b893ce2cd9b795d539efa591b58f4a0fb011df0a56fbed
+    find-babel-config: ^2.1.1
+    glob: ^9.3.3
+    pkg-up: ^3.1.0
+    reselect: ^4.1.7
+    resolve: ^1.22.8
+  checksum: f1d198acbbbd0b76c9c0c4aacbf9f1ef90f8d36b3d5209d9e7a75cadee2113a73711550ebddeb9464d143b71df19adc75e165dff99ada2614d7ea333affe3b5a
   languageName: node
   linkType: hard
 
-"babel-traverse@npm:^6.24.1, babel-traverse@npm:^6.26.0":
-  version: 6.26.0
-  resolution: "babel-traverse@npm:6.26.0"
+"babel-plugin-polyfill-corejs2@npm:^0.4.10":
+  version: 0.4.13
+  resolution: "babel-plugin-polyfill-corejs2@npm:0.4.13"
   dependencies:
-    babel-code-frame: ^6.26.0
-    babel-messages: ^6.23.0
-    babel-runtime: ^6.26.0
-    babel-types: ^6.26.0
-    babylon: ^6.18.0
-    debug: ^2.6.8
-    globals: ^9.18.0
-    invariant: ^2.2.2
-    lodash: ^4.17.4
-  checksum: fca037588d2791ae0409f1b7aa56075b798699cccc53ea04d82dd1c0f97b9e7ab17065f7dd3ecd69101d7874c9c8fd5e0f88fa53abbae1fe94e37e6b81ebcb8d
+    "@babel/compat-data": ^7.22.6
+    "@babel/helper-define-polyfill-provider": ^0.6.4
+    semver: ^6.3.1
+  peerDependencies:
+    "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0
+  checksum: 553b64eb11bad2cfc220e94f1fb2449755b5c7d54886dca6d8053b13b6e910f349a38bbc75aafd610f88217699db499548919bb5df653d635b9cdeb39d34a68d
   languageName: node
   linkType: hard
 
-"babel-types@npm:^6.19.0, babel-types@npm:^6.24.1, babel-types@npm:^6.26.0":
-  version: 6.26.0
-  resolution: "babel-types@npm:6.26.0"
+"babel-plugin-polyfill-corejs3@npm:^0.11.0":
+  version: 0.11.1
+  resolution: "babel-plugin-polyfill-corejs3@npm:0.11.1"
   dependencies:
-    babel-runtime: ^6.26.0
-    esutils: ^2.0.2
-    lodash: ^4.17.4
-    to-fast-properties: ^1.0.3
-  checksum: d16b0fa86e9b0e4c2623be81d0a35679faff24dd2e43cde4ca58baf49f3e39415a011a889e6c2259ff09e1228e4c3a3db6449a62de59e80152fe1ce7398fde76
+    "@babel/helper-define-polyfill-provider": ^0.6.3
+    core-js-compat: ^3.40.0
+  peerDependencies:
+    "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0
+  checksum: ee39440475ef377a1570ccbc06b1a1d274cbfbbe2e7c3d4c60f38781a47f00a28bd10d8e23430828b965820c41beb2c93c84596baf72583a2c9c3fdfa4397994
   languageName: node
   linkType: hard
 
-"babel6-plugin-strip-class-callcheck@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "babel6-plugin-strip-class-callcheck@npm:6.0.0"
-  checksum: e765ff21f9aee4e488a270cd8515a456c0de4f56739c2c285a7d8c72712fcca10cd89d24eec47dec0ce8b77a7e27257ece2674c781169a01a90bcb18c825b369
+"babel-plugin-polyfill-regenerator@npm:^0.6.1":
+  version: 0.6.4
+  resolution: "babel-plugin-polyfill-regenerator@npm:0.6.4"
+  dependencies:
+    "@babel/helper-define-polyfill-provider": ^0.6.4
+  peerDependencies:
+    "@babel/core": ^7.4.0 || ^8.0.0-0 <8.0.0
+  checksum: f4d4a803834ffa72713579d696586d8cc654c0025cbd5ec775fc5d37faa00381dcb80e5b97d4b16059443352653585596d87848b5590b1d8670c235408e73fb3
   languageName: node
   linkType: hard
 
-"babylon@npm:^6.18.0":
+"babel-plugin-syntax-dynamic-import@npm:^6.18.0":
   version: 6.18.0
-  resolution: "babylon@npm:6.18.0"
-  bin:
-    babylon: ./bin/babylon.js
-  checksum: 0777ae0c735ce1cbfc856d627589ed9aae212b84fb0c03c368b55e6c5d3507841780052808d0ad46e18a2ba516e93d55eeed8cd967f3b2938822dfeccfb2a16d
+  resolution: "babel-plugin-syntax-dynamic-import@npm:6.18.0"
+  checksum: 0a7a98ecb63878d65d4fd35e5435b0a7ad8e5c43b394389ce82298733c7a5d95c4373f1dd68566694214dad64abd0fec1e4eb7ee9ca7d1ee06d502e630d61600
   languageName: node
   linkType: hard
 
 "backbone@npm:^1.1.2":
-  version: 1.4.0
-  resolution: "backbone@npm:1.4.0"
+  version: 1.6.1
+  resolution: "backbone@npm:1.6.1"
   dependencies:
     underscore: ">=1.8.3"
-  checksum: 09abdf184c485a4cd2c68218298cf772fbefeaa166ef8eb795cdb0159b4ad1d2f6823dde089352eaf0be929e5bbef67c57555722f4d1886f969d954f77814870
+  checksum: 77b7e791803282b9652a9a17107fe089b2b34ee692df3e671ff779d218a9cc8d83fa465ddb1a7b3643cd231fc7dc3b8d46489edd42f1c56306bd127a20d4e0bd
+  languageName: node
+  linkType: hard
+
+"backburner.js@npm:^2.8.0":
+  version: 2.8.0
+  resolution: "backburner.js@npm:2.8.0"
+  checksum: 48fec3c8fa1006c40bcd6b0db560f7272f2d9335f14bead1e3bd27948dc5b9143c7a29258d2da2f69805b295f8b2a8a716fe4b1e64ce380f93dc88a9d6a33c6a
   languageName: node
   linkType: hard
 
@@ -9892,7 +5293,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"base64-js@npm:^1.0.2, base64-js@npm:^1.3.1":
+"base64-js@npm:^1.3.1, base64-js@npm:~1.5.1":
   version: 1.5.1
   resolution: "base64-js@npm:1.5.1"
   checksum: 669632eb3745404c2f822a18fc3a0122d2f9a7a13f7fb8b5823ee19d1d2ff9ee5b52c53367176ea4ad093c332fd5ab4bd0ebae5a8e27917a4105a4cfc86b1005
@@ -9906,21 +5307,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"base@npm:^0.11.1":
-  version: 0.11.2
-  resolution: "base@npm:0.11.2"
-  dependencies:
-    cache-base: ^1.0.1
-    class-utils: ^0.3.5
-    component-emitter: ^1.2.1
-    define-property: ^1.0.0
-    isobject: ^3.0.1
-    mixin-deep: ^1.2.0
-    pascalcase: ^0.1.1
-  checksum: a4a146b912e27eea8f66d09cb0c9eab666f32ce27859a7dfd50f38cd069a2557b39f16dba1bc2aecb3b44bf096738dd207b7970d99b0318423285ab1b1994edd
-  languageName: node
-  linkType: hard
-
 "basic-auth@npm:~2.0.1":
   version: 2.0.1
   resolution: "basic-auth@npm:2.0.1"
@@ -9930,12 +5316,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"bcrypt-pbkdf@npm:^1.0.0":
-  version: 1.0.2
-  resolution: "bcrypt-pbkdf@npm:1.0.2"
+"better-path-resolve@npm:1.0.0":
+  version: 1.0.0
+  resolution: "better-path-resolve@npm:1.0.0"
   dependencies:
-    tweetnacl: ^0.14.3
-  checksum: 4edfc9fe7d07019609ccf797a2af28351736e9d012c8402a07120c4453a3b789a15f2ee1530dc49eee8f7eb9379331a8dd4b3766042b9e502f74a68e7f662291
+    is-windows: ^1.0.0
+  checksum: 5392dbe04e7fe68b944eb37961d9dfa147aaac3ee9ee3f6e13d42e2c9fbe949e68d16e896c14ee9016fa5f8e6e53ec7fd8b5f01b50a32067a7d94ac9cfb9a050
   languageName: node
   linkType: hard
 
@@ -9946,17 +5332,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"binary-extensions@npm:^1.0.0":
-  version: 1.13.1
-  resolution: "binary-extensions@npm:1.13.1"
-  checksum: ad7747f33c07e94ba443055de130b50c8b8b130a358bca064c580d91769ca6a69c7ac65ca008ff044ed4541d2c6ad45496e1fadbef5218a68770996b6a2194d7
-  languageName: node
-  linkType: hard
-
 "binary-extensions@npm:^2.0.0":
-  version: 2.2.0
-  resolution: "binary-extensions@npm:2.2.0"
-  checksum: ccd267956c58d2315f5d3ea6757cf09863c5fc703e50fbeb13a7dc849b812ef76e3cf9ca8f35a0c48498776a7478d7b4a0418e1e2b8cb9cb9731f2922aaad7f8
+  version: 2.3.0
+  resolution: "binary-extensions@npm:2.3.0"
+  checksum: bcad01494e8a9283abf18c1b967af65ee79b0c6a9e6fcfafebfe91dbe6e0fc7272bafb73389e198b310516ae04f7ad17d79aacf6cb4c0d5d5202a7e2e52c7d98
   languageName: node
   linkType: hard
 
@@ -9967,15 +5346,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"bindings@npm:^1.5.0":
-  version: 1.5.0
-  resolution: "bindings@npm:1.5.0"
-  dependencies:
-    file-uri-to-path: 1.0.0
-  checksum: 65b6b48095717c2e6105a021a7da4ea435aa8d3d3cd085cb9e85bcb6e5773cf318c4745c3f7c504412855940b585bdf9b918236612a1c7a7942491de176f1ae7
-  languageName: node
-  linkType: hard
-
 "bl@npm:^4.1.0":
   version: 4.1.0
   resolution: "bl@npm:4.1.0"
@@ -9994,68 +5364,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"bluebird@npm:^3.4.6, bluebird@npm:^3.5.5, bluebird@npm:^3.7.2":
+"bluebird@npm:^3.4.6, bluebird@npm:^3.7.2":
   version: 3.7.2
   resolution: "bluebird@npm:3.7.2"
   checksum: 869417503c722e7dc54ca46715f70e15f4d9c602a423a02c825570862d12935be59ed9c7ba34a9b31f186c017c23cac6b54e35446f8353059c101da73eac22ef
   languageName: node
   linkType: hard
 
-"bn.js@npm:^4.0.0, bn.js@npm:^4.1.0, bn.js@npm:^4.11.9":
-  version: 4.12.0
-  resolution: "bn.js@npm:4.12.0"
-  checksum: 39afb4f15f4ea537b55eaf1446c896af28ac948fdcf47171961475724d1bb65118cca49fa6e3d67706e4790955ec0e74de584e45c8f1ef89f46c812bee5b5a12
-  languageName: node
-  linkType: hard
-
-"bn.js@npm:^5.0.0, bn.js@npm:^5.1.1":
-  version: 5.2.0
-  resolution: "bn.js@npm:5.2.0"
-  checksum: 6117170393200f68b35a061ecbf55d01dd989302e7b3c798a3012354fa638d124f0b2f79e63f77be5556be80322a09c40339eda6413ba7468524c0b6d4b4cb7a
-  languageName: node
-  linkType: hard
-
-"body-parser@npm:1.19.0, body-parser@npm:^1.17.0":
-  version: 1.19.0
-  resolution: "body-parser@npm:1.19.0"
-  dependencies:
-    bytes: 3.1.0
-    content-type: ~1.0.4
-    debug: 2.6.9
-    depd: ~1.1.2
-    http-errors: 1.7.2
-    iconv-lite: 0.4.24
-    on-finished: ~2.3.0
-    qs: 6.7.0
-    raw-body: 2.4.0
-    type-is: ~1.6.17
-  checksum: 490231b4c89bbd43112762f7ba8e5342c174a6c9f64284a3b0fcabf63277e332f8316765596f1e5b15e4f3a6cf0422e005f4bb3149ed3a224bb025b7a36b9ac1
-  languageName: node
-  linkType: hard
-
-"body-parser@npm:1.20.1":
-  version: 1.20.1
-  resolution: "body-parser@npm:1.20.1"
-  dependencies:
-    bytes: 3.1.2
-    content-type: ~1.0.4
-    debug: 2.6.9
-    depd: 2.0.0
-    destroy: 1.2.0
-    http-errors: 2.0.0
-    iconv-lite: 0.4.24
-    on-finished: 2.4.1
-    qs: 6.11.0
-    raw-body: 2.5.1
-    type-is: ~1.6.18
-    unpipe: 1.0.0
-  checksum: f1050dbac3bede6a78f0b87947a8d548ce43f91ccc718a50dd774f3c81f2d8b04693e52acf62659fad23101827dd318da1fb1363444ff9a8482b886a3e4a5266
-  languageName: node
-  linkType: hard
-
-"body-parser@npm:^1.19.0, body-parser@npm:^1.19.1":
-  version: 1.20.2
-  resolution: "body-parser@npm:1.20.2"
+"body-parser@npm:1.20.3":
+  version: 1.20.3
+  resolution: "body-parser@npm:1.20.3"
   dependencies:
     bytes: 3.1.2
     content-type: ~1.0.5
@@ -10065,11 +5383,11 @@ __metadata:
     http-errors: 2.0.0
     iconv-lite: 0.4.24
     on-finished: 2.4.1
-    qs: 6.11.0
+    qs: 6.13.0
     raw-body: 2.5.2
     type-is: ~1.6.18
     unpipe: 1.0.0
-  checksum: 14d37ec638ab5c93f6099ecaed7f28f890d222c650c69306872e00b9efa081ff6c596cd9afb9930656aae4d6c4e1c17537bea12bb73c87a217cb3cfea8896737
+  checksum: 1a35c59a6be8d852b00946330141c4f142c6af0f970faa87f10ad74f1ee7118078056706a05ae3093c54dabca9cd3770fa62a170a85801da1a4324f04381167d
   languageName: node
   linkType: hard
 
@@ -10085,13 +5403,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"boolbase@npm:^1.0.0, boolbase@npm:~1.0.0":
-  version: 1.0.0
-  resolution: "boolbase@npm:1.0.0"
-  checksum: 3e25c80ef626c3a3487c73dbfc70ac322ec830666c9ad915d11b701142fab25ec1e63eff2c450c74347acfd2de854ccde865cd79ef4db1683f7c7b046ea43bb0
-  languageName: node
-  linkType: hard
-
 "boolify@npm:^1.0.1":
   version: 1.0.1
   resolution: "boolify@npm:1.0.1"
@@ -10099,27 +5410,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"bower-config@npm:^1.4.3":
-  version: 1.4.3
-  resolution: "bower-config@npm:1.4.3"
-  dependencies:
-    graceful-fs: ^4.1.3
-    minimist: ^0.2.1
-    mout: ^1.0.0
-    osenv: ^0.1.3
-    untildify: ^2.1.0
-    wordwrap: ^0.0.3
-  checksum: 195d829d32b99a6c88d58f0e77b3aad2d32c5ecb913e6a078be5a540f0fc3d34888c8c2e3d7cf268e389711a7b231ef4397ac3cd02053fdd115db58a5c8b19a3
-  languageName: node
-  linkType: hard
-
-"bower-endpoint-parser@npm:0.2.2":
-  version: 0.2.2
-  resolution: "bower-endpoint-parser@npm:0.2.2"
-  checksum: e5752ae90a7950da4aa32448105fd50e050cf47042f89db79bbaf64e0cf4342b39dae450353848ea8a766c969e7b760afb4de85d2e808eedd7d1340b4251cda0
-  languageName: node
-  linkType: hard
-
 "brace-expansion@npm:^1.1.7":
   version: 1.1.11
   resolution: "brace-expansion@npm:1.1.11"
@@ -10130,44 +5420,25 @@ __metadata:
   languageName: node
   linkType: hard
 
-"braces@npm:^2.3.1, braces@npm:^2.3.2":
-  version: 2.3.2
-  resolution: "braces@npm:2.3.2"
-  dependencies:
-    arr-flatten: ^1.1.0
-    array-unique: ^0.3.2
-    extend-shallow: ^2.0.1
-    fill-range: ^4.0.0
-    isobject: ^3.0.1
-    repeat-element: ^1.1.2
-    snapdragon: ^0.8.1
-    snapdragon-node: ^2.0.1
-    split-string: ^3.0.2
-    to-regex: ^3.0.1
-  checksum: e30dcb6aaf4a31c8df17d848aa283a65699782f75ad61ae93ec25c9729c66cf58e66f0000a9fec84e4add1135bb7da40f7cb9601b36bebcfa9ca58e8d5c07de0
-  languageName: node
-  linkType: hard
-
-"braces@npm:^3.0.1, braces@npm:^3.0.2, braces@npm:~3.0.2":
-  version: 3.0.2
-  resolution: "braces@npm:3.0.2"
+"brace-expansion@npm:^2.0.1":
+  version: 2.0.1
+  resolution: "brace-expansion@npm:2.0.1"
   dependencies:
-    fill-range: ^7.0.1
-  checksum: e2a8e769a863f3d4ee887b5fe21f63193a891c68b612ddb4b68d82d1b5f3ff9073af066c343e9867a393fe4c2555dcb33e89b937195feb9c1613d259edfcd459
+    balanced-match: ^1.0.0
+  checksum: a61e7cd2e8a8505e9f0036b3b6108ba5e926b4b55089eeb5550cd04a471fe216c96d4fe7e4c7f995c728c554ae20ddfc4244cad10aef255e72b62930afd233d1
   languageName: node
   linkType: hard
 
-"broccoli-amd-funnel@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "broccoli-amd-funnel@npm:2.0.1"
+"braces@npm:3.0.3":
+  version: 3.0.3
+  resolution: "braces@npm:3.0.3"
   dependencies:
-    broccoli-plugin: ^1.3.0
-    symlink-or-copy: ^1.2.0
-  checksum: 1f9327d1291fbdd00366da710091fc3c4d1c3f5a5c697cc2eb9e1f29d8b906ba9eb93ab612c9c1367b91d64b9a2f7a446cfa8a1e6faf4ce05315ff0f2ebdadf6
+    fill-range: ^7.1.1
+  checksum: b95aa0b3bd909f6cd1720ffcf031aeaf46154dd88b4da01f9a1d3f7ea866a79eba76a6d01cbc3c422b2ee5cdc39a4f02491058d5df0d7bf6e6a162a832df1f69
   languageName: node
   linkType: hard
 
-"broccoli-asset-rev@npm:^3.0.0":
+"broccoli-asset-rev@npm:~3.0.0":
   version: 3.0.0
   resolution: "broccoli-asset-rev@npm:3.0.0"
   dependencies:
@@ -10190,56 +5461,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-autoprefixer@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "broccoli-autoprefixer@npm:5.0.0"
-  dependencies:
-    autoprefixer: ^7.0.0
-    broccoli-persistent-filter: ^1.1.6
-    postcss: ^6.0.1
-  checksum: 468df300b679e2afa3d14091f42313300424218d74911dba8dd61a16ce4b0888c76c517ac524f043c01304b3bb78d6e87927e931c96446f9921e4504f5361654
-  languageName: node
-  linkType: hard
-
-"broccoli-babel-transpiler@npm:^6.5.0":
-  version: 6.5.1
-  resolution: "broccoli-babel-transpiler@npm:6.5.1"
-  dependencies:
-    babel-core: ^6.26.0
-    broccoli-funnel: ^2.0.1
-    broccoli-merge-trees: ^2.0.0
-    broccoli-persistent-filter: ^1.4.3
-    clone: ^2.0.0
-    hash-for-dep: ^1.2.3
-    heimdalljs-logger: ^0.1.7
-    json-stable-stringify: ^1.0.0
-    rsvp: ^4.8.2
-    workerpool: ^2.3.0
-  checksum: 2e5273f2026dc27ca8ab984c49c00b967aa94f491b7e5059fc249e4c624a4901fd26c19c56f889b61eee1f2c1cb101944b2fd48e00156e503c7a3495cc7e270a
-  languageName: node
-  linkType: hard
-
 "broccoli-babel-transpiler@npm:^7.2.0, broccoli-babel-transpiler@npm:^7.8.0":
-  version: 7.8.0
-  resolution: "broccoli-babel-transpiler@npm:7.8.0"
-  dependencies:
-    "@babel/core": ^7.12.0
-    "@babel/polyfill": ^7.11.5
-    broccoli-funnel: ^2.0.2
-    broccoli-merge-trees: ^3.0.2
-    broccoli-persistent-filter: ^2.2.1
-    clone: ^2.1.2
-    hash-for-dep: ^1.4.7
-    heimdalljs: ^0.2.1
-    heimdalljs-logger: ^0.1.9
-    json-stable-stringify: ^1.0.1
-    rsvp: ^4.8.4
-    workerpool: ^3.1.1
-  checksum: 07fd89cc58bab2d6dd435b04b047d2bb843298761068cf7ae768819d1c8d8d4ac26746b0eb40e99ebceec6dfd1af97a25a7f1b00bd05136fa963b9c04033ca52
-  languageName: node
-  linkType: hard
-
-"broccoli-babel-transpiler@npm:^7.8.1":
   version: 7.8.1
   resolution: "broccoli-babel-transpiler@npm:7.8.1"
   dependencies:
@@ -10260,8 +5482,8 @@ __metadata:
   linkType: hard
 
 "broccoli-babel-transpiler@npm:^8.0.0":
-  version: 8.0.0
-  resolution: "broccoli-babel-transpiler@npm:8.0.0"
+  version: 8.0.2
+  resolution: "broccoli-babel-transpiler@npm:8.0.2"
   dependencies:
     broccoli-persistent-filter: ^3.0.0
     clone: ^2.1.2
@@ -10273,7 +5495,18 @@ __metadata:
     workerpool: ^6.0.2
   peerDependencies:
     "@babel/core": ^7.17.9
-  checksum: 5ca5f6664e5ef37e0927501256312ba66d0362180edcdbd9bf23fae2cf057294cc33e5c60e314c6d705c5f2c2dca5f5319b3fc1f1089589c7b16724a6f80e190
+  checksum: 41208ad87cf5be57744b44a13c1b792db38e44c2943299250399f5d80b064f0e395e92cd118bcfd08362ebac028194988e582546cb3ebb8069d832db9ebb8471
+  languageName: node
+  linkType: hard
+
+"broccoli-bridge@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "broccoli-bridge@npm:1.0.0"
+  dependencies:
+    broccoli-plugin: ^1.3.0
+    fs-extra: ^7.0.0
+    symlink-or-copy: ^1.2.0
+  checksum: e341480e83043e449ce11268c603fec1a98456fb90d527852bbc55abb007f9896317f7e39f3563fbd9dcbfeb64f24f9ab801b62b15cb1af7ec196ed0c524b92e
   languageName: node
   linkType: hard
 
@@ -10403,16 +5636,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-file-creator@npm:^1.1.1":
-  version: 1.2.0
-  resolution: "broccoli-file-creator@npm:1.2.0"
-  dependencies:
-    broccoli-plugin: ^1.1.0
-    mkdirp: ^0.5.1
-  checksum: 591be2b9a9e2aadd0f5c07fb85a2125eebf29a50ca8dbed4c67f8b75d7e5a296f7740f41e1a441d3861bb2b298a76201995ca2df59c34e1c641521e4f3555d50
-  languageName: node
-  linkType: hard
-
 "broccoli-file-creator@npm:^2.1.1":
   version: 2.1.1
   resolution: "broccoli-file-creator@npm:2.1.1"
@@ -10468,28 +5691,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-funnel@npm:^1.0.1, broccoli-funnel@npm:^1.1.0":
-  version: 1.2.0
-  resolution: "broccoli-funnel@npm:1.2.0"
-  dependencies:
-    array-equal: ^1.0.0
-    blank-object: ^1.0.1
-    broccoli-plugin: ^1.3.0
-    debug: ^2.2.0
-    exists-sync: 0.0.4
-    fast-ordered-set: ^1.0.0
-    fs-tree-diff: ^0.5.3
-    heimdalljs: ^0.2.0
-    minimatch: ^3.0.0
-    mkdirp: ^0.5.0
-    path-posix: ^1.0.0
-    rimraf: ^2.4.3
-    symlink-or-copy: ^1.0.0
-    walk-sync: ^0.3.1
-  checksum: dacd261a6ddbdd9ffa3bc6d6dd7653eace0896e1b7e281ed9cead4c5b5a4e04b0f1be5b9b09ccd576288d3a15a2dbace1920c7de17a9bba9e5564f7580f8f19a
-  languageName: node
-  linkType: hard
-
 "broccoli-funnel@npm:^2.0.0, broccoli-funnel@npm:^2.0.1, broccoli-funnel@npm:^2.0.2":
   version: 2.0.2
   resolution: "broccoli-funnel@npm:2.0.2"
@@ -10542,37 +5743,11 @@ __metadata:
   dependencies:
     glob: ^5.0.10
     mkdirp: ^0.5.1
-  checksum: c3af1f4a902ab69fa6e576430c2829cceaa2c34e6f6ff68eb5f6305c10835123b4644bfcb036452c7222d6853c720bf83ec1e5e125db7915d849c7968d0e652e
-  languageName: node
-  linkType: hard
-
-"broccoli-merge-trees@npm:^1.1.1":
-  version: 1.2.4
-  resolution: "broccoli-merge-trees@npm:1.2.4"
-  dependencies:
-    broccoli-plugin: ^1.3.0
-    can-symlink: ^1.0.0
-    fast-ordered-set: ^1.0.2
-    fs-tree-diff: ^0.5.4
-    heimdalljs: ^0.2.1
-    heimdalljs-logger: ^0.1.7
-    rimraf: ^2.4.3
-    symlink-or-copy: ^1.0.0
-  checksum: 7d5ae0c12582bcca4c6a697bd768b45f38b19d3b89f580ded973bf1c4ee2d581c2a50d1914eeab96d2c3502ccb792eb806298ce99bf0bcd9bf98f87c916390a5
-  languageName: node
-  linkType: hard
-
-"broccoli-merge-trees@npm:^2.0.0":
-  version: 2.0.1
-  resolution: "broccoli-merge-trees@npm:2.0.1"
-  dependencies:
-    broccoli-plugin: ^1.3.0
-    merge-trees: ^1.0.1
-  checksum: cf58d11761a3a362d80634e0f3b1b5fdb87572c9e54740fbc24803d79b44f2246b12b76aecb2f783d92c0cef55f7a3b7eb5314bc463fd94cb6d29f1b370a4289
+  checksum: c3af1f4a902ab69fa6e576430c2829cceaa2c34e6f6ff68eb5f6305c10835123b4644bfcb036452c7222d6853c720bf83ec1e5e125db7915d849c7968d0e652e
   languageName: node
   linkType: hard
 
-"broccoli-merge-trees@npm:^3.0.0, broccoli-merge-trees@npm:^3.0.1, broccoli-merge-trees@npm:^3.0.2":
+"broccoli-merge-trees@npm:^3.0.1, broccoli-merge-trees@npm:^3.0.2":
   version: 3.0.2
   resolution: "broccoli-merge-trees@npm:3.0.2"
   dependencies:
@@ -10625,15 +5800,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-output-wrapper@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "broccoli-output-wrapper@npm:2.0.0"
-  dependencies:
-    heimdalljs-logger: ^0.1.10
-  checksum: 9e2abb307e7d852827548fecfb2b5daa6efea70bcc23d39f1ad51494477a38d8049a3592f7a0e18aa20cb9bcad7b49389ec5052f3a368cbcdb94a4dbe0650381
-  languageName: node
-  linkType: hard
-
 "broccoli-output-wrapper@npm:^3.2.5":
   version: 3.2.5
   resolution: "broccoli-output-wrapper@npm:3.2.5"
@@ -10645,7 +5811,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-persistent-filter@npm:^1.1.5, broccoli-persistent-filter@npm:^1.1.6, broccoli-persistent-filter@npm:^1.4.3":
+"broccoli-persistent-filter@npm:^1.1.6, broccoli-persistent-filter@npm:^1.4.3":
   version: 1.4.6
   resolution: "broccoli-persistent-filter@npm:1.4.6"
   dependencies:
@@ -10666,7 +5832,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-persistent-filter@npm:^2.2.1, broccoli-persistent-filter@npm:^2.3.0, broccoli-persistent-filter@npm:^2.3.1":
+"broccoli-persistent-filter@npm:^2.2.1, broccoli-persistent-filter@npm:^2.3.0":
   version: 2.3.1
   resolution: "broccoli-persistent-filter@npm:2.3.1"
   dependencies:
@@ -10688,7 +5854,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-persistent-filter@npm:^3.0.0":
+"broccoli-persistent-filter@npm:^3.0.0, broccoli-persistent-filter@npm:^3.1.2, broccoli-persistent-filter@npm:^3.1.3":
   version: 3.1.3
   resolution: "broccoli-persistent-filter@npm:3.1.3"
   dependencies:
@@ -10707,40 +5873,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-persistent-filter@npm:^3.1.2":
-  version: 3.1.2
-  resolution: "broccoli-persistent-filter@npm:3.1.2"
-  dependencies:
-    async-disk-cache: ^2.0.0
-    async-promise-queue: ^1.0.3
-    broccoli-plugin: ^4.0.3
-    fs-tree-diff: ^2.0.0
-    hash-for-dep: ^1.5.0
-    heimdalljs: ^0.2.1
-    heimdalljs-logger: ^0.1.7
-    promise-map-series: ^0.2.1
-    rimraf: ^3.0.0
-    symlink-or-copy: ^1.0.1
-    sync-disk-cache: ^2.0.0
-  checksum: 15adca88e26cd8a105c786dc7d2ba57c2c98d4a43079c94753826c000c879fad627ec280e57f7d890be8583ea66967579db4c9e19ef73ccb2ef887a09e36fb85
-  languageName: node
-  linkType: hard
-
-"broccoli-plugin@npm:*, broccoli-plugin@npm:^4.0.1, broccoli-plugin@npm:^4.0.2, broccoli-plugin@npm:^4.0.3, broccoli-plugin@npm:^4.0.5, broccoli-plugin@npm:^4.0.7":
-  version: 4.0.7
-  resolution: "broccoli-plugin@npm:4.0.7"
-  dependencies:
-    broccoli-node-api: ^1.7.0
-    broccoli-output-wrapper: ^3.2.5
-    fs-merger: ^3.2.1
-    promise-map-series: ^0.3.0
-    quick-temp: ^0.1.8
-    rimraf: ^3.0.2
-    symlink-or-copy: ^1.3.1
-  checksum: 49d6a55ebfe1880e73956dc8bf23104ad81c1272d4a06755823e6e1eec5255583d2913de99427b3e0a620e3b56178fdd8ea03c832b7452f0440c166044aa555c
-  languageName: node
-  linkType: hard
-
 "broccoli-plugin@npm:1.1.0":
   version: 1.1.0
   resolution: "broccoli-plugin@npm:1.1.0"
@@ -10777,33 +5909,18 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-plugin@npm:^3.1.0":
-  version: 3.1.0
-  resolution: "broccoli-plugin@npm:3.1.0"
-  dependencies:
-    broccoli-node-api: ^1.6.0
-    broccoli-output-wrapper: ^2.0.0
-    fs-merger: ^3.0.1
-    promise-map-series: ^0.2.1
-    quick-temp: ^0.1.3
-    rimraf: ^2.3.4
-    symlink-or-copy: ^1.1.8
-  checksum: 6ae0eecb8f894de66445a8d7000a5f7fc6f0c07250ee788706ef7a6f9846c10e473be120999353b0ed89a0e60f96332586da01f40325d5df7d79e02a9f01d154
-  languageName: node
-  linkType: hard
-
-"broccoli-plugin@npm:^4.0.0":
-  version: 4.0.5
-  resolution: "broccoli-plugin@npm:4.0.5"
+"broccoli-plugin@npm:^4.0.0, broccoli-plugin@npm:^4.0.2, broccoli-plugin@npm:^4.0.3, broccoli-plugin@npm:^4.0.7":
+  version: 4.0.7
+  resolution: "broccoli-plugin@npm:4.0.7"
   dependencies:
     broccoli-node-api: ^1.7.0
     broccoli-output-wrapper: ^3.2.5
-    fs-merger: ^3.1.0
+    fs-merger: ^3.2.1
     promise-map-series: ^0.3.0
     quick-temp: ^0.1.8
     rimraf: ^3.0.2
     symlink-or-copy: ^1.3.1
-  checksum: 1e459b3f03929fc9515f905d2bc033ac23ab869d837fa4ca68fc47062aea61fb3c11f2e3604ad1c4bef38b22cb1e0c4d5d0d88715ae1cdc7f064f30fc11093c9
+  checksum: 49d6a55ebfe1880e73956dc8bf23104ad81c1272d4a06755823e6e1eec5255583d2913de99427b3e0a620e3b56178fdd8ea03c832b7452f0440c166044aa555c
   languageName: node
   linkType: hard
 
@@ -10825,52 +5942,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-rollup@npm:^2.1.1":
-  version: 2.1.1
-  resolution: "broccoli-rollup@npm:2.1.1"
-  dependencies:
-    "@types/node": ^9.6.0
-    amd-name-resolver: ^1.2.0
-    broccoli-plugin: ^1.2.1
-    fs-tree-diff: ^0.5.2
-    heimdalljs: ^0.2.1
-    heimdalljs-logger: ^0.1.7
-    magic-string: ^0.24.0
-    node-modules-path: ^1.0.1
-    rollup: ^0.57.1
-    symlink-or-copy: ^1.1.8
-    walk-sync: ^0.3.1
-  checksum: 6ddce6266854494da4875f6a1bd274c690b14fd7a82b47735118daaf5081304ef79fb781270ed6c09f312896c872fdbdf5619a77d50eb769bf977745242284d2
-  languageName: node
-  linkType: hard
-
-"broccoli-rollup@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "broccoli-rollup@npm:5.0.0"
-  dependencies:
-    "@types/broccoli-plugin": ^3.0.0
-    broccoli-plugin: ^4.0.7
-    fs-tree-diff: ^2.0.1
-    heimdalljs: ^0.2.6
-    node-modules-path: ^1.0.1
-    rollup: ^2.50.0
-    rollup-pluginutils: ^2.8.1
-    symlink-or-copy: ^1.2.0
-    walk-sync: ^2.2.0
-  checksum: 752725e1b78b8dc6b228b0156b44e293feb948c00bf3b505254ba1f9a706a14334727eb1505c8e01ee22500387cc3059f8cb0ecf7857935346768bdcf1939b1e
-  languageName: node
-  linkType: hard
-
 "broccoli-sass-source-maps@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "broccoli-sass-source-maps@npm:4.0.0"
+  version: 4.3.0
+  resolution: "broccoli-sass-source-maps@npm:4.3.0"
   dependencies:
     broccoli-caching-writer: ^3.0.3
     include-path-searcher: ^0.1.0
-    mkdirp: ^0.3.5
-    object-assign: ^2.0.0
-    rsvp: ^3.0.6
-  checksum: a90b04901782d4a903b491b0eb0660d6dde7ce6d39479675e61a7a98ec93172d3bc6960b21f3540d41209fe8eeddd25c52fc1bae5012c22bdcfaf54097131c0a
+    rsvp: ^4.8.5
+  checksum: a1ccdedd39a3a07891f8162984fa70dda890b8f9cd5b22e99b6d2341659438926dce31a3cd0d74019a583fe81797265f327786374eb8c0a3c790d8c54cf9e5ff
   languageName: node
   linkType: hard
 
@@ -10906,7 +5985,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-sri-hash@meirish/broccoli-sri-hash#rooturl, broccoli-sri-hash@npm:^2.1.0":
+"broccoli-sri-hash@meirish/broccoli-sri-hash#rooturl":
   version: 2.1.2
   resolution: "broccoli-sri-hash@https://github.com/meirish/broccoli-sri-hash.git#commit=5ebad6f345c38d45461676c7a298a0b61be4a39d"
   dependencies:
@@ -10919,6 +5998,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"broccoli-sri-hash@npm:^2.1.0":
+  version: 2.1.2
+  resolution: "broccoli-sri-hash@npm:2.1.2"
+  dependencies:
+    broccoli-caching-writer: ^2.2.0
+    mkdirp: ^0.5.1
+    rsvp: ^3.1.0
+    sri-toolbox: ^0.2.0
+    symlink-or-copy: ^1.0.1
+  checksum: af64a10b40004a9e2f538c2a892d0cb010f42f5554af6af14ad844a25c1e9eb3d34a30fc81b5b22de06640dc0c8c95fbb74ee56a0f038218767cdf2c18d7a5fd
+  languageName: node
+  linkType: hard
+
 "broccoli-stew@npm:^3.0.0":
   version: 3.0.0
   resolution: "broccoli-stew@npm:3.0.0"
@@ -10941,55 +6033,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli-string-replace@npm:^0.1.2":
-  version: 0.1.2
-  resolution: "broccoli-string-replace@npm:0.1.2"
-  dependencies:
-    broccoli-persistent-filter: ^1.1.5
-    minimatch: ^3.0.3
-  checksum: 853c89a2e764d4577a5f28b71a63cf47f23c226d57a7521b07617758d5d69bdf4d8667a46abeceee53b39bbcfd1f61edf365e678665577d3d0b08b25fceceaf1
-  languageName: node
-  linkType: hard
-
-"broccoli-svg-optimizer@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "broccoli-svg-optimizer@npm:2.1.0"
-  dependencies:
-    broccoli-persistent-filter: ^3.1.2
-    safe-stable-stringify: ^2.2.0
-    svgo: 1.3.0
-  checksum: a39f487a5eb5b3af2bed055d0da494f1cdc5670e20892901b702e7bbe60407f76e96f2ebd3c73bf1effb4d8411097628552ce628dc5c529a9660898811cf4d74
-  languageName: node
-  linkType: hard
-
-"broccoli-templater@npm:^2.0.1":
-  version: 2.0.2
-  resolution: "broccoli-templater@npm:2.0.2"
-  dependencies:
-    broccoli-plugin: ^1.3.1
-    fs-tree-diff: ^0.5.9
-    lodash.template: ^4.4.0
-    rimraf: ^2.6.2
-    walk-sync: ^0.3.3
-  checksum: 802e1e357dc4522b5f157dff2ab3b9b132b07639fffd3249f2ad22792f1eb225e86b7624c3a45af5b1063628049d16a53d6bf37358fe4c4b54bad6a776b503c3
-  languageName: node
-  linkType: hard
-
 "broccoli-terser-sourcemap@npm:^4.1.0":
-  version: 4.1.0
-  resolution: "broccoli-terser-sourcemap@npm:4.1.0"
+  version: 4.1.1
+  resolution: "broccoli-terser-sourcemap@npm:4.1.1"
   dependencies:
     async-promise-queue: ^1.0.5
-    broccoli-plugin: ^4.0.3
-    debug: ^4.1.0
+    broccoli-plugin: ^4.0.7
+    convert-source-map: ^2.0.0
+    debug: ^4.3.1
     lodash.defaultsdeep: ^4.6.1
     matcher-collection: ^2.0.1
-    source-map-url: ^0.4.0
     symlink-or-copy: ^1.3.1
-    terser: ^5.3.0
+    terser: ^5.7.0
     walk-sync: ^2.2.0
-    workerpool: ^6.0.0
-  checksum: 5251dd242487d92164f0453e618d67e92700892b282c99e6b7944295edce338b005edcb46e8da4e95d8d5771637c1e289c5c22abb979c2460bc4f9a1179944fe
+    workerpool: ^6.1.5
+  checksum: 9dd120d6445ad6e8b509c25e11962a09dda8b335d62808d4556056a72881907bc8b8355fb364b805d8728d1e1a3a1e2836cf5f95ec220faa9ad4cc048bc9618b
   languageName: node
   linkType: hard
 
@@ -11026,276 +6084,76 @@ __metadata:
   languageName: node
   linkType: hard
 
-"broccoli@npm:^2.0.0":
-  version: 2.3.0
-  resolution: "broccoli@npm:2.3.0"
-  dependencies:
-    broccoli-node-info: 1.1.0
-    broccoli-slow-trees: ^3.0.1
-    broccoli-source: ^1.1.0
-    commander: ^2.15.1
-    connect: ^3.6.6
-    esm: ^3.2.4
-    findup-sync: ^2.0.0
-    handlebars: ^4.0.11
-    heimdalljs: ^0.2.6
-    heimdalljs-logger: ^0.1.9
-    mime-types: ^2.1.19
-    promise.prototype.finally: ^3.1.0
-    resolve-path: ^1.4.0
-    rimraf: ^2.6.2
-    sane: ^4.0.0
-    tmp: 0.0.33
-    tree-sync: ^1.2.2
-    underscore.string: ^3.2.2
-    watch-detector: ^0.1.0
-  checksum: 34117904ae15bacd9780960b972f3549bad821aca9dc649cbc8e98bf3a89073d55c39f24d27a00303ce0be0e834315113667d7e117315a473b2fee4449b35634
-  languageName: node
-  linkType: hard
-
-"broccoli@npm:^3.5.2":
-  version: 3.5.2
-  resolution: "broccoli@npm:3.5.2"
-  dependencies:
-    "@types/chai": ^4.2.9
-    "@types/chai-as-promised": ^7.1.2
-    "@types/express": ^4.17.2
-    ansi-html: ^0.0.7
-    broccoli-node-info: ^2.1.0
-    broccoli-slow-trees: ^3.0.1
-    broccoli-source: ^3.0.0
-    commander: ^4.1.1
-    connect: ^3.6.6
-    console-ui: ^3.0.4
-    esm: ^3.2.4
-    findup-sync: ^4.0.0
-    handlebars: ^4.7.3
-    heimdalljs: ^0.2.6
-    heimdalljs-logger: ^0.1.9
-    https: ^1.0.0
-    mime-types: ^2.1.26
-    resolve-path: ^1.4.0
-    rimraf: ^3.0.2
-    sane: ^4.0.0
-    tmp: ^0.0.33
-    tree-sync: ^2.0.0
-    underscore.string: ^3.2.2
-    watch-detector: ^1.0.0
-  checksum: 765fa5c409d0d14a7429472989f311b51c46fb15b0fa0a8eb8b9be8cb3b957bf253172d61fd3c202597db573d40f8b5c7557e8416a93b6c99ce0b46962d46ccd
-  languageName: node
-  linkType: hard
-
-"brorand@npm:^1.0.1, brorand@npm:^1.1.0":
-  version: 1.1.0
-  resolution: "brorand@npm:1.1.0"
-  checksum: 8a05c9f3c4b46572dec6ef71012b1946db6cae8c7bb60ccd4b7dd5a84655db49fe043ecc6272e7ef1f69dc53d6730b9e2a3a03a8310509a3d797a618cbee52be
-  languageName: node
-  linkType: hard
-
-"browser-process-hrtime@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "browser-process-hrtime@npm:1.0.0"
-  checksum: e30f868cdb770b1201afb714ad1575dd86366b6e861900884665fb627109b3cc757c40067d3bfee1ff2a29c835257ea30725a8018a9afd02ac1c24b408b1e45f
-  languageName: node
-  linkType: hard
-
-"browserify-aes@npm:^1.0.0, browserify-aes@npm:^1.0.4":
-  version: 1.2.0
-  resolution: "browserify-aes@npm:1.2.0"
-  dependencies:
-    buffer-xor: ^1.0.3
-    cipher-base: ^1.0.0
-    create-hash: ^1.1.0
-    evp_bytestokey: ^1.0.3
-    inherits: ^2.0.1
-    safe-buffer: ^5.0.1
-  checksum: 4a17c3eb55a2aa61c934c286f34921933086bf6d67f02d4adb09fcc6f2fc93977b47d9d884c25619144fccd47b3b3a399e1ad8b3ff5a346be47270114bcf7104
-  languageName: node
-  linkType: hard
-
-"browserify-cipher@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "browserify-cipher@npm:1.0.1"
-  dependencies:
-    browserify-aes: ^1.0.4
-    browserify-des: ^1.0.0
-    evp_bytestokey: ^1.0.0
-  checksum: 2d8500acf1ee535e6bebe808f7a20e4c3a9e2ed1a6885fff1facbfd201ac013ef030422bec65ca9ece8ffe82b03ca580421463f9c45af6c8415fd629f4118c13
-  languageName: node
-  linkType: hard
-
-"browserify-des@npm:^1.0.0":
-  version: 1.0.2
-  resolution: "browserify-des@npm:1.0.2"
-  dependencies:
-    cipher-base: ^1.0.1
-    des.js: ^1.0.0
-    inherits: ^2.0.1
-    safe-buffer: ^5.1.2
-  checksum: b15a3e358a1d78a3b62ddc06c845d02afde6fc826dab23f1b9c016e643e7b1fda41de628d2110b712f6a44fb10cbc1800bc6872a03ddd363fb50768e010395b7
-  languageName: node
-  linkType: hard
-
-"browserify-rsa@npm:^4.0.0, browserify-rsa@npm:^4.0.1":
-  version: 4.1.0
-  resolution: "browserify-rsa@npm:4.1.0"
-  dependencies:
-    bn.js: ^5.0.0
-    randombytes: ^2.0.1
-  checksum: 155f0c135873efc85620571a33d884aa8810e40176125ad424ec9d85016ff105a07f6231650914a760cca66f29af0494087947b7be34880dd4599a0cd3c38e54
-  languageName: node
-  linkType: hard
-
-"browserify-sign@npm:^4.0.0":
-  version: 4.2.1
-  resolution: "browserify-sign@npm:4.2.1"
-  dependencies:
-    bn.js: ^5.1.1
-    browserify-rsa: ^4.0.1
-    create-hash: ^1.2.0
-    create-hmac: ^1.1.7
-    elliptic: ^6.5.3
-    inherits: ^2.0.4
-    parse-asn1: ^5.1.5
-    readable-stream: ^3.6.0
-    safe-buffer: ^5.2.0
-  checksum: 0221f190e3f5b2d40183fa51621be7e838d9caa329fe1ba773406b7637855f37b30f5d83e52ff8f244ed12ffe6278dd9983638609ed88c841ce547e603855707
-  languageName: node
-  linkType: hard
-
-"browserify-zlib@npm:^0.2.0":
-  version: 0.2.0
-  resolution: "browserify-zlib@npm:0.2.0"
-  dependencies:
-    pako: ~1.0.5
-  checksum: 5cd9d6a665190fedb4a97dfbad8dabc8698d8a507298a03f42c734e96d58ca35d3c7d4085e283440bbca1cd1938cff85031728079bedb3345310c58ab1ec92d6
-  languageName: node
-  linkType: hard
-
-"browserslist@npm:^2.11.3":
-  version: 2.11.3
-  resolution: "browserslist@npm:2.11.3"
-  dependencies:
-    caniuse-lite: ^1.0.30000792
-    electron-to-chromium: ^1.3.30
-  bin:
-    browserslist: ./cli.js
-  checksum: 2ff908162669461e881bad516885b703fd594a0b7a139bf150c1952a74fe4ed8668ac46367a0d136d39a717de65e51c867316951e9fe0f92664c65b205eb9d93
-  languageName: node
-  linkType: hard
-
-"browserslist@npm:^3.2.6":
-  version: 3.2.8
-  resolution: "browserslist@npm:3.2.8"
-  dependencies:
-    caniuse-lite: ^1.0.30000844
-    electron-to-chromium: ^1.3.47
-  bin:
-    browserslist: ./cli.js
-  checksum: 74d9ab1089a3813f54a7c4f9f6612faa6256799c8e42c7e00e4aae626c17f199049a01707a525a05b1673cd1493936583e51aad295e25249166e7e8fbd0273ba
-  languageName: node
-  linkType: hard
-
-"browserslist@npm:^4.0.0":
-  version: 4.16.6
-  resolution: "browserslist@npm:4.16.6"
-  dependencies:
-    caniuse-lite: ^1.0.30001219
-    colorette: ^1.2.2
-    electron-to-chromium: ^1.3.723
-    escalade: ^3.1.1
-    node-releases: ^1.1.71
-  bin:
-    browserslist: cli.js
-  checksum: 3dffc86892d2dcfcfc66b52519b7e5698ae070b4fc92ab047e760efc4cae0474e9e70bbe10d769c8d3491b655ef3a2a885b88e7196c83cc5dc0a46dfdba8b70c
-  languageName: node
-  linkType: hard
-
-"browserslist@npm:^4.14.5, browserslist@npm:^4.16.8, browserslist@npm:^4.20.2, browserslist@npm:^4.20.3":
-  version: 4.20.4
-  resolution: "browserslist@npm:4.20.4"
-  dependencies:
-    caniuse-lite: ^1.0.30001349
-    electron-to-chromium: ^1.4.147
-    escalade: ^3.1.1
-    node-releases: ^2.0.5
-    picocolors: ^1.0.0
-  bin:
-    browserslist: cli.js
-  checksum: 0e56c42da765524e5c31bc9a1f08afaa8d5dba085071137cf21e56dc78d0cf0283764143df4c7d1c0cd18c3187fc9494e1d93fa0255004f0be493251a28635f9
-  languageName: node
-  linkType: hard
-
-"browserslist@npm:^4.17.3":
-  version: 4.17.3
-  resolution: "browserslist@npm:4.17.3"
-  dependencies:
-    caniuse-lite: ^1.0.30001264
-    electron-to-chromium: ^1.3.857
-    escalade: ^3.1.1
-    node-releases: ^1.1.77
-    picocolors: ^0.2.1
-  bin:
-    browserslist: cli.js
-  checksum: 9295bdff6e054fdbb131275f88d282dddda7e8d54ddc1571b24374d6ba85e6d1f7cb72280543ea44a9726bb5076ded644d943b38cdc5610249699254ca951f46
-  languageName: node
-  linkType: hard
-
-"browserslist@npm:^4.17.5, browserslist@npm:^4.17.6, browserslist@npm:^4.18.1":
-  version: 4.18.1
-  resolution: "browserslist@npm:4.18.1"
-  dependencies:
-    caniuse-lite: ^1.0.30001280
-    electron-to-chromium: ^1.3.896
-    escalade: ^3.1.1
-    node-releases: ^2.0.1
-    picocolors: ^1.0.0
-  bin:
-    browserslist: cli.js
-  checksum: ae58322deef15960fc2e601d71bc081b571cfab6705999a3d24db5325b9cfadf5f676615f4460207a93e600549c33d60d37b4502007fe9e737b3cc19e20575d5
-  languageName: node
-  linkType: hard
-
-"browserslist@npm:^4.19.1":
-  version: 4.20.2
-  resolution: "browserslist@npm:4.20.2"
+"broccoli@npm:^2.0.0":
+  version: 2.3.0
+  resolution: "broccoli@npm:2.3.0"
   dependencies:
-    caniuse-lite: ^1.0.30001317
-    electron-to-chromium: ^1.4.84
-    escalade: ^3.1.1
-    node-releases: ^2.0.2
-    picocolors: ^1.0.0
-  bin:
-    browserslist: cli.js
-  checksum: 18e09beeae32e69fea45fc3642240fb63027b1460d90e24da86377177dca3d82c80f8fa44469d95109e3962f08eb2a23e03037bd5e1f1ec38e4866e2a8572435
+    broccoli-node-info: 1.1.0
+    broccoli-slow-trees: ^3.0.1
+    broccoli-source: ^1.1.0
+    commander: ^2.15.1
+    connect: ^3.6.6
+    esm: ^3.2.4
+    findup-sync: ^2.0.0
+    handlebars: ^4.0.11
+    heimdalljs: ^0.2.6
+    heimdalljs-logger: ^0.1.9
+    mime-types: ^2.1.19
+    promise.prototype.finally: ^3.1.0
+    resolve-path: ^1.4.0
+    rimraf: ^2.6.2
+    sane: ^4.0.0
+    tmp: 0.0.33
+    tree-sync: ^1.2.2
+    underscore.string: ^3.2.2
+    watch-detector: ^0.1.0
+  checksum: 34117904ae15bacd9780960b972f3549bad821aca9dc649cbc8e98bf3a89073d55c39f24d27a00303ce0be0e834315113667d7e117315a473b2fee4449b35634
   languageName: node
   linkType: hard
 
-"browserslist@npm:^4.21.9":
-  version: 4.21.9
-  resolution: "browserslist@npm:4.21.9"
+"broccoli@npm:^3.5.2":
+  version: 3.5.2
+  resolution: "broccoli@npm:3.5.2"
   dependencies:
-    caniuse-lite: ^1.0.30001503
-    electron-to-chromium: ^1.4.431
-    node-releases: ^2.0.12
-    update-browserslist-db: ^1.0.11
-  bin:
-    browserslist: cli.js
-  checksum: 80d3820584e211484ad1b1a5cfdeca1dd00442f47be87e117e1dda34b628c87e18b81ae7986fa5977b3e6a03154f6d13cd763baa6b8bf5dd9dd19f4926603698
+    "@types/chai": ^4.2.9
+    "@types/chai-as-promised": ^7.1.2
+    "@types/express": ^4.17.2
+    ansi-html: ^0.0.7
+    broccoli-node-info: ^2.1.0
+    broccoli-slow-trees: ^3.0.1
+    broccoli-source: ^3.0.0
+    commander: ^4.1.1
+    connect: ^3.6.6
+    console-ui: ^3.0.4
+    esm: ^3.2.4
+    findup-sync: ^4.0.0
+    handlebars: ^4.7.3
+    heimdalljs: ^0.2.6
+    heimdalljs-logger: ^0.1.9
+    https: ^1.0.0
+    mime-types: ^2.1.26
+    resolve-path: ^1.4.0
+    rimraf: ^3.0.2
+    sane: ^4.0.0
+    tmp: ^0.0.33
+    tree-sync: ^2.0.0
+    underscore.string: ^3.2.2
+    watch-detector: ^1.0.0
+  checksum: 765fa5c409d0d14a7429472989f311b51c46fb15b0fa0a8eb8b9be8cb3b957bf253172d61fd3c202597db573d40f8b5c7557e8416a93b6c99ce0b46962d46ccd
   languageName: node
   linkType: hard
 
-"browserslist@npm:^4.22.1, browserslist@npm:^4.22.2":
-  version: 4.22.2
-  resolution: "browserslist@npm:4.22.2"
+"browserslist@npm:^4.21.10, browserslist@npm:^4.24.0, browserslist@npm:^4.24.4":
+  version: 4.24.5
+  resolution: "browserslist@npm:4.24.5"
   dependencies:
-    caniuse-lite: ^1.0.30001565
-    electron-to-chromium: ^1.4.601
-    node-releases: ^2.0.14
-    update-browserslist-db: ^1.0.13
+    caniuse-lite: ^1.0.30001716
+    electron-to-chromium: ^1.5.149
+    node-releases: ^2.0.19
+    update-browserslist-db: ^1.1.3
   bin:
     browserslist: cli.js
-  checksum: 33ddfcd9145220099a7a1ac533cecfe5b7548ffeb29b313e1b57be6459000a1f8fa67e781cf4abee97268ac594d44134fcc4a6b2b4750ceddc9796e3a22076d9
+  checksum: 69310ade58b0cb2b2871022fdaba8388902f9a2d17a6fa05f383d046d6da87fd9f83018a66fe1c6296648ca7d52e3208c3fc68c82f17a0fd4bf12a452c036247
   languageName: node
   linkType: hard
 
@@ -11309,27 +6167,9 @@ __metadata:
   linkType: hard
 
 "buffer-from@npm:^1.0.0":
-  version: 1.1.1
-  resolution: "buffer-from@npm:1.1.1"
-  checksum: ccc53b69736008bff764497367c4d24879ba7122bc619ee499ff47eef3a5b885ca496e87272e7ebffa0bec3804c83f84041c616f6e3318f40624e27c1d80f045
-  languageName: node
-  linkType: hard
-
-"buffer-xor@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "buffer-xor@npm:1.0.3"
-  checksum: 10c520df29d62fa6e785e2800e586a20fc4f6dfad84bcdbd12e1e8a83856de1cb75c7ebd7abe6d036bbfab738a6cf18a3ae9c8e5a2e2eb3167ca7399ce65373a
-  languageName: node
-  linkType: hard
-
-"buffer@npm:^4.3.0":
-  version: 4.9.2
-  resolution: "buffer@npm:4.9.2"
-  dependencies:
-    base64-js: ^1.0.2
-    ieee754: ^1.1.4
-    isarray: ^1.0.0
-  checksum: 8801bc1ba08539f3be70eee307a8b9db3d40f6afbfd3cf623ab7ef41dffff1d0a31de0addbe1e66e0ca5f7193eeb667bfb1ecad3647f8f1b0750de07c13295c3
+  version: 1.1.2
+  resolution: "buffer-from@npm:1.1.2"
+  checksum: 0448524a562b37d4d7ed9efd91685a5b77a50672c556ea254ac9a6d30e3403a517d8981f10e565db24e8339413b43c97ca2951f10e399c6125a0d8911f5679bb
   languageName: node
   linkType: hard
 
@@ -11353,19 +6193,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"builtin-status-codes@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "builtin-status-codes@npm:3.0.0"
-  checksum: 1119429cf4b0d57bf76b248ad6f529167d343156ebbcc4d4e4ad600484f6bc63002595cbb61b67ad03ce55cd1d3c4711c03bbf198bf24653b8392420482f3773
+"builtin-modules@npm:^3.3.0":
+  version: 3.3.0
+  resolution: "builtin-modules@npm:3.3.0"
+  checksum: db021755d7ed8be048f25668fe2117620861ef6703ea2c65ed2779c9e3636d5c3b82325bd912244293959ff3ae303afa3471f6a15bf5060c103e4cc3a839749d
   languageName: node
   linkType: hard
 
-"builtins@npm:^5.0.0, builtins@npm:^5.0.1":
-  version: 5.0.1
-  resolution: "builtins@npm:5.0.1"
+"builtins@npm:^5.0.1":
+  version: 5.1.0
+  resolution: "builtins@npm:5.1.0"
   dependencies:
     semver: ^7.0.0
-  checksum: 66d204657fe36522822a95b288943ad11b58f5eaede235b11d8c4edaa28ce4800087d44a2681524c340494aadb120a0068011acabe99d30e8f11a7d826d83515
+  checksum: 76327fa85b8e253b26e52f79988148013ea742691b4ab15f7228ebee47dd757832da308c9d4e4fc89763a1773e3f25a9836fff6315df85c7c6c72190436bf11d
   languageName: node
   linkType: hard
 
@@ -11376,20 +6216,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"bytes@npm:3.0.0":
-  version: 3.0.0
-  resolution: "bytes@npm:3.0.0"
-  checksum: a2b386dd8188849a5325f58eef69c3b73c51801c08ffc6963eddc9be244089ba32d19347caf6d145c86f315ae1b1fc7061a32b0c1aa6379e6a719090287ed101
-  languageName: node
-  linkType: hard
-
-"bytes@npm:3.1.0":
-  version: 3.1.0
-  resolution: "bytes@npm:3.1.0"
-  checksum: 7c3b21c5d9d44ed455460d5d36a31abc6fa2ce3807964ba60a4b03fd44454c8cf07bb0585af83bfde1c5cc2ea4bbe5897bc3d18cd15e0acf25a3615a35aba2df
-  languageName: node
-  linkType: hard
-
 "bytes@npm:3.1.2":
   version: 3.1.2
   resolution: "bytes@npm:3.1.2"
@@ -11398,79 +6224,54 @@ __metadata:
   linkType: hard
 
 "bytestreamjs@npm:^1.0.29":
-  version: 1.0.29
-  resolution: "bytestreamjs@npm:1.0.29"
-  checksum: 0fd5e74ad0c6694e53f5fcf303f2124c128e4f837249e4361be8c3e022208558a27c353b03b3157a9d1ff15455e09041faa1134e03bcc914bbe6816eafc0362b
+  version: 1.1.3
+  resolution: "bytestreamjs@npm:1.1.3"
+  checksum: 3f8482f25d7104c44aed94036113e5007a13f2400291c9b4709932d30491a13fc2a7f1b38b4b02e22dbe8a07da98c9c3d5c61123fa9db47e5cfa307c5f747b8b
   languageName: node
   linkType: hard
 
-"cacache@npm:^12.0.2":
-  version: 12.0.4
-  resolution: "cacache@npm:12.0.4"
+"cacache@npm:^19.0.1":
+  version: 19.0.1
+  resolution: "cacache@npm:19.0.1"
   dependencies:
-    bluebird: ^3.5.5
-    chownr: ^1.1.1
-    figgy-pudding: ^3.5.1
-    glob: ^7.1.4
-    graceful-fs: ^4.1.15
-    infer-owner: ^1.0.3
-    lru-cache: ^5.1.1
-    mississippi: ^3.0.0
-    mkdirp: ^0.5.1
-    move-concurrently: ^1.0.1
-    promise-inflight: ^1.0.1
-    rimraf: ^2.6.3
-    ssri: ^6.0.1
-    unique-filename: ^1.1.1
-    y18n: ^4.0.0
-  checksum: c88a72f36939b2523533946ffb27828443db5bf5995d761b35ae17af1eb6c8e20ac55b00b74c2ca900b2e1e917f0afba6847bf8cc16bee05ccca6aa150e0830c
+    "@npmcli/fs": ^4.0.0
+    fs-minipass: ^3.0.0
+    glob: ^10.2.2
+    lru-cache: ^10.0.1
+    minipass: ^7.0.3
+    minipass-collect: ^2.0.1
+    minipass-flush: ^1.0.5
+    minipass-pipeline: ^1.2.4
+    p-map: ^7.0.2
+    ssri: ^12.0.0
+    tar: ^7.4.3
+    unique-filename: ^4.0.0
+  checksum: e95684717de6881b4cdaa949fa7574e3171946421cd8291769dd3d2417dbf7abf4aa557d1f968cca83dcbc95bed2a281072b09abfc977c942413146ef7ed4525
   languageName: node
   linkType: hard
 
-"cacache@npm:^16.1.0":
-  version: 16.1.3
-  resolution: "cacache@npm:16.1.3"
+"cache-point@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "cache-point@npm:2.0.0"
   dependencies:
-    "@npmcli/fs": ^2.1.0
-    "@npmcli/move-file": ^2.0.0
-    chownr: ^2.0.0
-    fs-minipass: ^2.1.0
-    glob: ^8.0.1
-    infer-owner: ^1.0.4
-    lru-cache: ^7.7.1
-    minipass: ^3.1.6
-    minipass-collect: ^1.0.2
-    minipass-flush: ^1.0.5
-    minipass-pipeline: ^1.2.4
-    mkdirp: ^1.0.4
-    p-map: ^4.0.0
-    promise-inflight: ^1.0.1
-    rimraf: ^3.0.2
-    ssri: ^9.0.0
-    tar: ^6.1.11
-    unique-filename: ^2.0.0
-  checksum: d91409e6e57d7d9a3a25e5dcc589c84e75b178ae8ea7de05cbf6b783f77a5fae938f6e8fda6f5257ed70000be27a681e1e44829251bfffe4c10216002f8f14e6
+    array-back: ^4.0.1
+    fs-then-native: ^2.0.0
+    mkdirp2: ^1.0.4
+  checksum: 700466a46596ff84a68d061a169a1f50892050a32cdd4ded0a69c44a9626cce599e22e7baaf26d19b12db4b86a86c727ddfa7d67fbd6e8025f1e2f436f68a318
   languageName: node
   linkType: hard
 
-"cache-base@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "cache-base@npm:1.0.1"
+"cacheable@npm:^1.9.0":
+  version: 1.9.0
+  resolution: "cacheable@npm:1.9.0"
   dependencies:
-    collection-visit: ^1.0.0
-    component-emitter: ^1.2.1
-    get-value: ^2.0.6
-    has-value: ^1.0.0
-    isobject: ^3.0.1
-    set-value: ^2.0.0
-    to-object-path: ^0.3.0
-    union-value: ^1.0.0
-    unset-value: ^1.0.0
-  checksum: 9114b8654fe2366eedc390bad0bcf534e2f01b239a888894e2928cb58cdc1e6ea23a73c6f3450dcfd2058aa73a8a981e723cd1e7c670c047bf11afdc65880107
+    hookified: ^1.8.2
+    keyv: ^5.3.3
+  checksum: c06eaf83dad9ef4a76e6dd7b58b1df43f091ee618231ecd31057027d5f6430a3aa764f557170e13ff794aca85b2f97dcb87129f1847268b7bff662080c2a4091
   languageName: node
   linkType: hard
 
-"calculate-cache-key-for-tree@npm:^2.0.0":
+"calculate-cache-key-for-tree@npm:2.0.0, calculate-cache-key-for-tree@npm:^2.0.0":
   version: 2.0.0
   resolution: "calculate-cache-key-for-tree@npm:2.0.0"
   dependencies:
@@ -11479,13 +6280,35 @@ __metadata:
   languageName: node
   linkType: hard
 
-"call-bind@npm:^1.0.0, call-bind@npm:^1.0.2":
+"call-bind-apply-helpers@npm:^1.0.0, call-bind-apply-helpers@npm:^1.0.1, call-bind-apply-helpers@npm:^1.0.2":
   version: 1.0.2
-  resolution: "call-bind@npm:1.0.2"
+  resolution: "call-bind-apply-helpers@npm:1.0.2"
+  dependencies:
+    es-errors: ^1.3.0
+    function-bind: ^1.1.2
+  checksum: b2863d74fcf2a6948221f65d95b91b4b2d90cfe8927650b506141e669f7d5de65cea191bf788838bc40d13846b7886c5bc5c84ab96c3adbcf88ad69a72fcdc6b
+  languageName: node
+  linkType: hard
+
+"call-bind@npm:^1.0.5, call-bind@npm:^1.0.7, call-bind@npm:^1.0.8":
+  version: 1.0.8
+  resolution: "call-bind@npm:1.0.8"
+  dependencies:
+    call-bind-apply-helpers: ^1.0.0
+    es-define-property: ^1.0.0
+    get-intrinsic: ^1.2.4
+    set-function-length: ^1.2.2
+  checksum: aa2899bce917a5392fd73bd32e71799c37c0b7ab454e0ed13af7f6727549091182aade8bbb7b55f304a5bc436d543241c14090fb8a3137e9875e23f444f4f5a9
+  languageName: node
+  linkType: hard
+
+"call-bound@npm:^1.0.2, call-bound@npm:^1.0.3, call-bound@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "call-bound@npm:1.0.4"
   dependencies:
-    function-bind: ^1.1.1
-    get-intrinsic: ^1.0.2
-  checksum: f8e31de9d19988a4b80f3e704788c4a2d6b6f3d17cfec4f57dc29ced450c53a49270dc66bf0fbd693329ee948dd33e6c90a329519aef17474a4d961e8d6426b0
+    call-bind-apply-helpers: ^1.0.2
+    get-intrinsic: ^1.3.0
+  checksum: 2f6399488d1c272f56306ca60ff696575e2b7f31daf23bc11574798c84d9f2759dceb0cb1f471a85b77f28962a7ac6411f51d283ea2e45319009a19b6ccab3b2
   languageName: node
   linkType: hard
 
@@ -11503,7 +6326,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"camelcase-keys@npm:^7.0.0, camelcase-keys@npm:^7.0.2":
+"camelcase-keys@npm:^7.0.2":
   version: 7.0.2
   resolution: "camelcase-keys@npm:7.0.2"
   dependencies:
@@ -11540,22 +6363,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"caniuse-api@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "caniuse-api@npm:3.0.0"
-  dependencies:
-    browserslist: ^4.0.0
-    caniuse-lite: ^1.0.0
-    lodash.memoize: ^4.1.2
-    lodash.uniq: ^4.5.0
-  checksum: db2a229383b20d0529b6b589dde99d7b6cb56ba371366f58cbbfa2929c9f42c01f873e2b6ef641d4eda9f0b4118de77dbb2805814670bdad4234bf08e720b0b4
-  languageName: node
-  linkType: hard
-
-"caniuse-lite@npm:^1.0.0, caniuse-lite@npm:^1.0.30000792, caniuse-lite@npm:^1.0.30000805, caniuse-lite@npm:^1.0.30000844, caniuse-lite@npm:^1.0.30001219, caniuse-lite@npm:^1.0.30001264, caniuse-lite@npm:^1.0.30001280, caniuse-lite@npm:^1.0.30001304, caniuse-lite@npm:^1.0.30001317, caniuse-lite@npm:^1.0.30001349, caniuse-lite@npm:^1.0.30001503, caniuse-lite@npm:^1.0.30001565":
-  version: 1.0.30001566
-  resolution: "caniuse-lite@npm:1.0.30001566"
-  checksum: 0f9084bf9f7d5c0a9ddb200c2baddb25dd2ad5a2f205f01e7b971f3e98e9a7bb23c2d86bae48237e9bc9782b682cffaaf3406d936937ab9844987dbe2a6401f2
+"caniuse-lite@npm:^1.0.30001524, caniuse-lite@npm:^1.0.30001716":
+  version: 1.0.30001718
+  resolution: "caniuse-lite@npm:1.0.30001718"
+  checksum: c6598b6eb2c4358fc9f8ead8982bf5f9efdc1f29bb74948b9481d314ced10675bd0beb99771094ac52d56c2cec121049d1f18e9405cab7d81807816d1836b38a
   languageName: node
   linkType: hard
 
@@ -11580,10 +6391,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"caseless@npm:~0.12.0":
-  version: 0.12.0
-  resolution: "caseless@npm:0.12.0"
-  checksum: b43bd4c440aa1e8ee6baefee8063b4850fd0d7b378f6aabc796c9ec8cb26d27fb30b46885350777d9bd079c5256c0e1329ad0dc7c2817e0bb466810ebb353751
+"catharsis@npm:^0.9.0":
+  version: 0.9.0
+  resolution: "catharsis@npm:0.9.0"
+  dependencies:
+    lodash: ^4.17.15
+  checksum: da867df1fd01823ea5a7283886ba382f6eb5b1fe5af356e00fd944a02d9b867f4ea2fc7f61416c53427f62760fdbd41614f6e8ae37686d2c3a4696871526df20
   languageName: node
   linkType: hard
 
@@ -11594,13 +6407,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ceibo@npm:~2.0.0":
-  version: 2.0.0
-  resolution: "ceibo@npm:2.0.0"
-  checksum: 5b61580221b8b145442b5076fe2d9389104899e712dce21bfabe907276e86cfc36f8aae68a4af592300db6eeedc53e885019475f0ffb41cf9c9217f500d9c9cf
-  languageName: node
-  linkType: hard
-
 "chalk@npm:^1.0.0, chalk@npm:^1.1.3":
   version: 1.1.3
   resolution: "chalk@npm:1.1.3"
@@ -11614,7 +6420,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"chalk@npm:^2.0.0, chalk@npm:^2.0.1, chalk@npm:^2.1.0, chalk@npm:^2.3.0, chalk@npm:^2.4.1, chalk@npm:^2.4.2":
+"chalk@npm:^2.0.0, chalk@npm:^2.0.1, chalk@npm:^2.1.0, chalk@npm:^2.4.1, chalk@npm:^2.4.2":
   version: 2.4.2
   resolution: "chalk@npm:2.4.2"
   dependencies:
@@ -11625,17 +6431,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"chalk@npm:^4.0.0, chalk@npm:^4.1.0, chalk@npm:^4.1.1":
-  version: 4.1.1
-  resolution: "chalk@npm:4.1.1"
-  dependencies:
-    ansi-styles: ^4.1.0
-    supports-color: ^7.1.0
-  checksum: 036e973e665ba1a32c975e291d5f3d549bceeb7b1b983320d4598fb75d70fe20c5db5d62971ec0fe76cdbce83985a00ee42372416abfc3a5584465005a7855ed
-  languageName: node
-  linkType: hard
-
-"chalk@npm:^4.1.2":
+"chalk@npm:^4.0.0, chalk@npm:^4.1.0, chalk@npm:^4.1.1, chalk@npm:^4.1.2":
   version: 4.1.2
   resolution: "chalk@npm:4.1.2"
   dependencies:
@@ -11645,10 +6441,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"chalk@npm:^5.2.0, chalk@npm:^5.3.0":
-  version: 5.3.0
-  resolution: "chalk@npm:5.3.0"
-  checksum: 623922e077b7d1e9dedaea6f8b9e9352921f8ae3afe739132e0e00c275971bdd331268183b2628cf4ab1727c45ea1f28d7e24ac23ce1db1eb653c414ca8a5a80
+"chalk@npm:^5.3.0, chalk@npm:^5.4.1":
+  version: 5.4.1
+  resolution: "chalk@npm:5.4.1"
+  checksum: 0c656f30b782fed4d99198825c0860158901f449a6b12b818b0aabad27ec970389e7e8767d0e00762175b23620c812e70c4fd92c0210e55fc2d993638b74e86e
   languageName: node
   linkType: hard
 
@@ -11663,6 +6459,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"character-entities-html4@npm:^1.0.0":
+  version: 1.1.4
+  resolution: "character-entities-html4@npm:1.1.4"
+  checksum: 22536aba07a378a2326420423ceadd65c0121032c527f80e84dfc648381992ed5aa666d7c2b267cd269864b3682d5b0315fc2f03a9e7c017d1a96d24ec292d5f
+  languageName: node
+  linkType: hard
+
 "character-entities-legacy@npm:^1.0.0":
   version: 1.1.4
   resolution: "character-entities-legacy@npm:1.1.4"
@@ -11684,13 +6487,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"charcodes@npm:^0.2.0":
-  version: 0.2.0
-  resolution: "charcodes@npm:0.2.0"
-  checksum: 972443ed359d54382e721b9db0a298eb95c4c454386f7e98886586f433e1e6686225416114e6f6bb2e6ef3facc9ba3b4ab9946a56a180fe64ef67816a05d4fe4
-  languageName: node
-  linkType: hard
-
 "chardet@npm:^0.7.0":
   version: 0.7.0
   resolution: "chardet@npm:0.7.0"
@@ -11707,38 +6503,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cheerio-select@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "cheerio-select@npm:2.1.0"
-  dependencies:
-    boolbase: ^1.0.0
-    css-select: ^5.1.0
-    css-what: ^6.1.0
-    domelementtype: ^2.3.0
-    domhandler: ^5.0.3
-    domutils: ^3.0.1
-  checksum: 843d6d479922f28a6c5342c935aff1347491156814de63c585a6eb73baf7bb4185c1b4383a1195dca0f12e3946d737c7763bcef0b9544c515d905c5c44c5308b
-  languageName: node
-  linkType: hard
-
-"cheerio@npm:^1.0.0-rc.12":
-  version: 1.0.0-rc.12
-  resolution: "cheerio@npm:1.0.0-rc.12"
-  dependencies:
-    cheerio-select: ^2.1.0
-    dom-serializer: ^2.0.0
-    domhandler: ^5.0.3
-    domutils: ^3.0.1
-    htmlparser2: ^8.0.1
-    parse5: ^7.0.0
-    parse5-htmlparser2-tree-adapter: ^7.0.0
-  checksum: 5d4c1b7a53cf22d3a2eddc0aff70cf23cbb30d01a4c79013e703a012475c02461aa1fcd99127e8d83a02216386ed6942b2c8103845fd0812300dd199e6e7e054
-  languageName: node
-  linkType: hard
-
-"chokidar@npm:>=3.0.0 <4.0.0":
-  version: 3.5.3
-  resolution: "chokidar@npm:3.5.3"
+"chokidar@npm:^3.6.0":
+  version: 3.6.0
+  resolution: "chokidar@npm:3.6.0"
   dependencies:
     anymatch: ~3.1.2
     braces: ~3.0.2
@@ -11751,99 +6518,44 @@ __metadata:
   dependenciesMeta:
     fsevents:
       optional: true
-  checksum: b49fcde40176ba007ff361b198a2d35df60d9bb2a5aab228279eb810feae9294a6b4649ab15981304447afe1e6ffbf4788ad5db77235dc770ab777c6e771980c
-  languageName: node
-  linkType: hard
-
-"chokidar@npm:^2.1.8":
-  version: 2.1.8
-  resolution: "chokidar@npm:2.1.8"
-  dependencies:
-    anymatch: ^2.0.0
-    async-each: ^1.0.1
-    braces: ^2.3.2
-    fsevents: ^1.2.7
-    glob-parent: ^3.1.0
-    inherits: ^2.0.3
-    is-binary-path: ^1.0.0
-    is-glob: ^4.0.0
-    normalize-path: ^3.0.0
-    path-is-absolute: ^1.0.0
-    readdirp: ^2.2.1
-    upath: ^1.1.1
-  dependenciesMeta:
-    fsevents:
-      optional: true
-  checksum: 0c43e89cbf0268ef1e1f41ce8ec5233c7ba022c6f3282c2ef6530e351d42396d389a1148c5a040f291cf1f4083a4c6b2f51dad3f31c726442ea9a337de316bcf
+  checksum: d2f29f499705dcd4f6f3bbed79a9ce2388cf530460122eed3b9c48efeab7a4e28739c6551fd15bec9245c6b9eeca7a32baa64694d64d9b6faeb74ddb8c4a413d
   languageName: node
   linkType: hard
 
-"chokidar@npm:^3.4.1":
-  version: 3.5.1
-  resolution: "chokidar@npm:3.5.1"
+"chokidar@npm:^4.0.0":
+  version: 4.0.3
+  resolution: "chokidar@npm:4.0.3"
   dependencies:
-    anymatch: ~3.1.1
-    braces: ~3.0.2
-    fsevents: ~2.3.1
-    glob-parent: ~5.1.0
-    is-binary-path: ~2.1.0
-    is-glob: ~4.0.1
-    normalize-path: ~3.0.0
-    readdirp: ~3.5.0
-  dependenciesMeta:
-    fsevents:
-      optional: true
-  checksum: b7774e6e3aeca084d39e8542041555a11452414c744122436101243f89580fad97154ae11525e46bfa816313ae32533e2a88e8587e4d50b14ea716a9e6538978
-  languageName: node
-  linkType: hard
-
-"chownr@npm:^1.1.1":
-  version: 1.1.4
-  resolution: "chownr@npm:1.1.4"
-  checksum: 115648f8eb38bac5e41c3857f3e663f9c39ed6480d1349977c4d96c95a47266fcacc5a5aabf3cb6c481e22d72f41992827db47301851766c4fd77ac21a4f081d
+    readdirp: ^4.0.1
+  checksum: a8765e452bbafd04f3f2fad79f04222dd65f43161488bb6014a41099e6ca18d166af613d59a90771908c1c823efa3f46ba36b86ac50b701c20c1b9908c5fe36e
   languageName: node
   linkType: hard
 
-"chownr@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "chownr@npm:2.0.0"
-  checksum: c57cf9dd0791e2f18a5ee9c1a299ae6e801ff58fee96dc8bfd0dcb4738a6ce58dd252a3605b1c93c6418fe4f9d5093b28ffbf4d66648cb2a9c67eaef9679be2f
+"chownr@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "chownr@npm:3.0.0"
+  checksum: fd73a4bab48b79e66903fe1cafbdc208956f41ea4f856df883d0c7277b7ab29fd33ee65f93b2ec9192fc0169238f2f8307b7735d27c155821d886b84aa97aa8d
   languageName: node
   linkType: hard
 
 "chrome-trace-event@npm:^1.0.2":
-  version: 1.0.3
-  resolution: "chrome-trace-event@npm:1.0.3"
-  checksum: cb8b1fc7e881aaef973bd0c4a43cd353c2ad8323fb471a041e64f7c2dd849cde4aad15f8b753331a32dda45c973f032c8a03b8177fc85d60eaa75e91e08bfb97
-  languageName: node
-  linkType: hard
-
-"ci-info@npm:^3.7.0, ci-info@npm:^3.8.0":
-  version: 3.8.0
-  resolution: "ci-info@npm:3.8.0"
-  checksum: d0a4d3160497cae54294974a7246202244fff031b0a6ea20dd57b10ec510aa17399c41a1b0982142c105f3255aff2173e5c0dd7302ee1b2f28ba3debda375098
+  version: 1.0.4
+  resolution: "chrome-trace-event@npm:1.0.4"
+  checksum: fcbbd9dd0cd5b48444319007cc0c15870fd8612cc0df320908aa9d5e8a244084d48571eb28bf3c58c19327d2c5838f354c2d89fac3956d8e992273437401ac19
   languageName: node
   linkType: hard
 
-"cipher-base@npm:^1.0.0, cipher-base@npm:^1.0.1, cipher-base@npm:^1.0.3":
-  version: 1.0.4
-  resolution: "cipher-base@npm:1.0.4"
-  dependencies:
-    inherits: ^2.0.1
-    safe-buffer: ^5.0.1
-  checksum: 47d3568dbc17431a339bad1fe7dff83ac0891be8206911ace3d3b818fc695f376df809bea406e759cdea07fff4b454fa25f1013e648851bec790c1d75763032e
+"ci-info@npm:^3.8.0":
+  version: 3.9.0
+  resolution: "ci-info@npm:3.9.0"
+  checksum: 6b19dc9b2966d1f8c2041a838217299718f15d6c4b63ae36e4674edd2bee48f780e94761286a56aa59eb305a85fbea4ddffb7630ec063e7ec7e7e5ad42549a87
   languageName: node
   linkType: hard
 
-"class-utils@npm:^0.3.5":
-  version: 0.3.6
-  resolution: "class-utils@npm:0.3.6"
-  dependencies:
-    arr-union: ^3.1.0
-    define-property: ^0.2.5
-    isobject: ^3.0.0
-    static-extend: ^0.1.1
-  checksum: be108900801e639e50f96a7e4bfa8867c753a7750a7603879f3981f8b0a89cba657497a2d5f40cd4ea557ff15d535a100818bb486baf6e26fe5d7872e75f1078
+"ci-info@npm:^4.0.0":
+  version: 4.2.0
+  resolution: "ci-info@npm:4.2.0"
+  checksum: 0e3726721526f54c5b17cf44ab2ed69b842c756bcb4d2b26ce279e595a80a856aec9fb38a2986a2baca3de73d15895f3a01d2771c4aad93c898aae7e3ca0ceb1
   languageName: node
   linkType: hard
 
@@ -11877,7 +6589,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"clean-stack@npm:^2.0.0, clean-stack@npm:^2.2.0":
+"clean-css@npm:^5.3.2":
+  version: 5.3.3
+  resolution: "clean-css@npm:5.3.3"
+  dependencies:
+    source-map: ~0.6.0
+  checksum: 941987c14860dd7d346d5cf121a82fd2caf8344160b1565c5387f7ccca4bbcaf885bace961be37c4f4713ce2d8c488dd89483c1add47bb779790edbfdcc79cbc
+  languageName: node
+  linkType: hard
+
+"clean-stack@npm:^2.2.0":
   version: 2.2.0
   resolution: "clean-stack@npm:2.2.0"
   checksum: 2ac8cd2b2f5ec986a3c743935ec85b07bc174d5421a5efc8017e1f146a1cf5f781ae962618f416352103b32c9cd7e203276e8c28241bbe946160cab16149fb68
@@ -11909,42 +6630,51 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cli-cursor@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "cli-cursor@npm:5.0.0"
+  dependencies:
+    restore-cursor: ^5.0.0
+  checksum: 1eb9a3f878b31addfe8d82c6d915ec2330cec8447ab1f117f4aa34f0137fbb3137ec3466e1c9a65bcb7557f6e486d343f2da57f253a2f668d691372dfa15c090
+  languageName: node
+  linkType: hard
+
 "cli-spinners@npm:^2.0.0, cli-spinners@npm:^2.5.0":
-  version: 2.6.0
-  resolution: "cli-spinners@npm:2.6.0"
-  checksum: bc5d06af9f896e95d0c277e2a5ee0adc5876767decca6b3c22e212934b96033453268cb59be904eccb6d59119e57dbb3fc8ca9bdf5f8476506283b3dd8728748
+  version: 2.9.2
+  resolution: "cli-spinners@npm:2.9.2"
+  checksum: 1bd588289b28432e4676cb5d40505cfe3e53f2e4e10fbe05c8a710a154d6fe0ce7836844b00d6858f740f2ffe67cdc36e0fce9c7b6a8430e80e6388d5aa4956c
   languageName: node
   linkType: hard
 
 "cli-table3@npm:^0.6.0":
-  version: 0.6.3
-  resolution: "cli-table3@npm:0.6.3"
+  version: 0.6.5
+  resolution: "cli-table3@npm:0.6.5"
   dependencies:
     "@colors/colors": 1.5.0
     string-width: ^4.2.0
   dependenciesMeta:
     "@colors/colors":
       optional: true
-  checksum: 09897f68467973f827c04e7eaadf13b55f8aec49ecd6647cc276386ea660059322e2dd8020a8b6b84d422dbdd619597046fa89cbbbdc95b2cea149a2df7c096c
+  checksum: ab7afbf4f8597f1c631f3ee6bb3481d0bfeac8a3b81cffb5a578f145df5c88003b6cfff46046a7acae86596fdd03db382bfa67f20973b6b57425505abc47e42c
   languageName: node
   linkType: hard
 
 "cli-table@npm:^0.3.1":
-  version: 0.3.6
-  resolution: "cli-table@npm:0.3.6"
+  version: 0.3.11
+  resolution: "cli-table@npm:0.3.11"
   dependencies:
     colors: 1.0.3
-  checksum: b0cd08578c810240920438cc2b3ffb4b4f5106b29f3362707f1d8cfc0c0440ad2afb70b96e30ce37f72f0ffe1e844ae7341dde4df17d51ad345eb186a5903af2
+  checksum: 59fb61f992ac9bc8610ed98c72bf7f5d396c5afb42926b6747b46b0f8bb98a0dfa097998e77542ac334c1eb7c18dbf4f104d5783493273c5ec4c34084aa7c663
   languageName: node
   linkType: hard
 
-"cli-truncate@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "cli-truncate@npm:2.1.0"
+"cli-truncate@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "cli-truncate@npm:4.0.0"
   dependencies:
-    slice-ansi: ^3.0.0
-    string-width: ^4.2.0
-  checksum: bf1e4e6195392dc718bf9cd71f317b6300dc4a9191d052f31046b8773230ece4fa09458813bf0e3455a5e68c0690d2ea2c197d14a8b85a7b5e01c97f4b5feb5d
+    slice-ansi: ^5.0.0
+    string-width: ^7.0.0
+  checksum: d5149175fd25ca985731bdeec46a55ec237475cf74c1a5e103baea696aceb45e372ac4acbaabf1316f06bd62e348123060f8191ffadfeedebd2a70a2a7fb199d
   languageName: node
   linkType: hard
 
@@ -11962,6 +6692,20 @@ __metadata:
   languageName: node
   linkType: hard
 
+"cli-width@npm:^4.1.0":
+  version: 4.1.0
+  resolution: "cli-width@npm:4.1.0"
+  checksum: 0a79cff2dbf89ef530bcd54c713703ba94461457b11e5634bd024c78796ed21401e32349c004995954e06f442d82609287e7aabf6a5f02c919a1cf3b9b6854ff
+  languageName: node
+  linkType: hard
+
+"clipboard-polyfill@npm:^4.1.1":
+  version: 4.1.1
+  resolution: "clipboard-polyfill@npm:4.1.1"
+  checksum: a3657e3250f6b73c8504afc67f41084c9470cf367c6cc81cef564b3dc8ee8a54fd36385f66dcddfa6a6a45d348ccc7670042ea887943416e839a7ee3dfd6e21e
+  languageName: node
+  linkType: hard
+
 "cliui@npm:^5.0.0":
   version: 5.0.0
   resolution: "cliui@npm:5.0.0"
@@ -11984,6 +6728,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"clone-deep@npm:^4.0.1":
+  version: 4.0.1
+  resolution: "clone-deep@npm:4.0.1"
+  dependencies:
+    is-plain-object: ^2.0.4
+    kind-of: ^6.0.2
+    shallow-clone: ^3.0.0
+  checksum: 770f912fe4e6f21873c8e8fbb1e99134db3b93da32df271d00589ea4a29dbe83a9808a322c93f3bcaf8584b8b4fa6fc269fc8032efbaa6728e0c9886c74467d2
+  languageName: node
+  linkType: hard
+
 "clone@npm:^1.0.2":
   version: 1.0.4
   resolution: "clone@npm:1.0.4"
@@ -11991,38 +6746,38 @@ __metadata:
   languageName: node
   linkType: hard
 
-"clone@npm:^2.0.0, clone@npm:^2.1.2":
+"clone@npm:^2.1.2":
   version: 2.1.2
   resolution: "clone@npm:2.1.2"
   checksum: aaf106e9bc025b21333e2f4c12da539b568db4925c0501a1bf4070836c9e848c892fa22c35548ce0d1132b08bbbfa17a00144fe58fccdab6fa900fec4250f67d
   languageName: node
   linkType: hard
 
-"coa@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "coa@npm:2.0.2"
-  dependencies:
-    "@types/q": ^1.5.1
-    chalk: ^2.4.1
-    q: ^1.1.2
-  checksum: 44736914aac2160d3d840ed64432a90a3bb72285a0cd6a688eb5cabdf15d15a85eee0915b3f6f2a4659d5075817b1cb577340d3c9cbb47d636d59ab69f819552
+"code-error-fragment@npm:0.0.230":
+  version: 0.0.230
+  resolution: "code-error-fragment@npm:0.0.230"
+  checksum: 6c5e800d6d70b30938cc85a2fc2c6069f028eadb58bceb65716b995ce6228c99906302f2c438ba50115fd81a1ee15dd95dc7d317b16a6c590e311ac7e50613f3
   languageName: node
   linkType: hard
 
-"codemirror@npm:^5.58.2":
-  version: 5.61.0
-  resolution: "codemirror@npm:5.61.0"
-  checksum: d9081d4937fc237c972e12538721b47817a08557a30d692b32e09849977e5d91ca6c8984cdea417cf11a163fdbc3c7139fd66cefc6fcf32047c8cbecd21d2715
+"codemirror-lang-hcl@npm:^0.0.0-beta.2":
+  version: 0.0.0-beta.2
+  resolution: "codemirror-lang-hcl@npm:0.0.0-beta.2"
+  dependencies:
+    "@codemirror/language": ^6.0.0
+    "@lezer/highlight": ^1.0.0
+    "@lezer/lr": ^1.0.0
+  checksum: 9fb6e15faaf4dadff680c5b7523b536bf913f0985e298e671a5f964b06b8fc862fa53a17cb226d2c9d774c32b5b67a0669803177908618964d8af6ad6b528377
   languageName: node
   linkType: hard
 
-"collection-visit@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "collection-visit@npm:1.0.0"
+"collect-all@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "collect-all@npm:1.0.4"
   dependencies:
-    map-visit: ^1.0.0
-    object-visit: ^1.0.0
-  checksum: 15d9658fe6eb23594728346adad5433b86bb7a04fd51bbab337755158722f9313a5376ef479de5b35fbc54140764d0d39de89c339f5d25b959ed221466981da9
+    stream-connect: ^1.0.2
+    stream-via: ^1.0.4
+  checksum: 48982103f1530696a931f5c26bc311d4273f6bc397f77c30bdb7491ef2d6283b0fe3197a051bc637b5b26bc591733cae5e8cf657ac7a67bb6648b79e551d8502
   languageName: node
   linkType: hard
 
@@ -12074,10 +6829,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"colorette@npm:^1.2.2":
-  version: 1.4.0
-  resolution: "colorette@npm:1.4.0"
-  checksum: 01c3c16058b182a4ab4c126a65a75faa4d38a20fa7c845090b25453acec6c371bb2c5dceb0a2338511f17902b9d1a9af0cadd8509c9403894b79311032c256c3
+"colorette@npm:^2.0.14, colorette@npm:^2.0.20":
+  version: 2.0.20
+  resolution: "colorette@npm:2.0.20"
+  checksum: 0c016fea2b91b733eb9f4bcdb580018f52c0bc0979443dad930e5037a968237ac53d9beb98e218d2e9235834f8eebce7f8e080422d6194e957454255bde71d3d
   languageName: node
   linkType: hard
 
@@ -12095,29 +6850,57 @@ __metadata:
   languageName: node
   linkType: hard
 
-"columnify@npm:^1.5.4":
-  version: 1.5.4
-  resolution: "columnify@npm:1.5.4"
+"columnify@npm:~1.6.0":
+  version: 1.6.0
+  resolution: "columnify@npm:1.6.0"
   dependencies:
-    strip-ansi: ^3.0.0
+    strip-ansi: ^6.0.1
     wcwidth: ^1.0.0
-  checksum: f0693937412ec41d387f8ae89ff8cd5811a07ad636f753f0276ba8394fd76c0f610621ebeb379d6adcb30d98696919546dbbf93a28bd4e546efc7e30d905edc2
+  checksum: 0d590023616a27bcd2135c0f6ddd6fac94543263f9995538bbe391068976e30545e5534d369737ec7c3e9db4e53e70a277462de46aeb5a36e6997b4c7559c335
   languageName: node
   linkType: hard
 
-"combined-stream@npm:^1.0.6, combined-stream@npm:~1.0.6":
+"comma-separated-tokens@npm:^1.0.0":
   version: 1.0.8
-  resolution: "combined-stream@npm:1.0.8"
+  resolution: "comma-separated-tokens@npm:1.0.8"
+  checksum: 0adcb07174fa4d08cf0f5c8e3aec40a36b5ff0c2c720e5e23f50fe02e6789d1d00a67036c80e0c1e1539f41d3e7f0101b074039dd833b4e4a59031b659d6ca0d
+  languageName: node
+  linkType: hard
+
+"command-line-args@npm:^5.0.0":
+  version: 5.2.1
+  resolution: "command-line-args@npm:5.2.1"
   dependencies:
-    delayed-stream: ~1.0.0
-  checksum: 49fa4aeb4916567e33ea81d088f6584749fc90c7abec76fd516bf1c5aa5c79f3584b5ba3de6b86d26ddd64bae5329c4c7479343250cfe71c75bb366eae53bb7c
+    array-back: ^3.1.0
+    find-replace: ^3.0.0
+    lodash.camelcase: ^4.3.0
+    typical: ^4.0.0
+  checksum: e759519087be3cf2e86af8b9a97d3058b4910cd11ee852495be881a067b72891f6a32718fb685ee6d41531ab76b2b7bfb6602f79f882cd4b7587ff1e827982c7
   languageName: node
   linkType: hard
 
-"commander@npm:2, commander@npm:^2.15.1, commander@npm:^2.20.0, commander@npm:^2.6.0":
-  version: 2.20.3
-  resolution: "commander@npm:2.20.3"
-  checksum: ab8c07884e42c3a8dbc5dd9592c606176c7eb5c1ca5ff274bcf907039b2c41de3626f684ea75ccf4d361ba004bbaff1f577d5384c155f3871e456bdf27becf9e
+"command-line-tool@npm:^0.8.0":
+  version: 0.8.0
+  resolution: "command-line-tool@npm:0.8.0"
+  dependencies:
+    ansi-escape-sequences: ^4.0.0
+    array-back: ^2.0.0
+    command-line-args: ^5.0.0
+    command-line-usage: ^4.1.0
+    typical: ^2.6.1
+  checksum: 03732bf52d7a4545d48b3a18368d24833b973af1c71675eaa08353322c427ad37a7f92c933007bb0051f0831c0036a0ebb884a3b18344273a1a1c995239385ea
+  languageName: node
+  linkType: hard
+
+"command-line-usage@npm:^4.1.0":
+  version: 4.1.0
+  resolution: "command-line-usage@npm:4.1.0"
+  dependencies:
+    ansi-escape-sequences: ^4.0.0
+    array-back: ^2.0.0
+    table-layout: ^0.4.2
+    typical: ^2.6.1
+  checksum: 8283146c9d1b9fb71577efcd2c813a8da0627d0edf38578de7433064dbeaa0befc518297c19839b4fa1f1b512fee2684f8874a3729203870eafa945aa9c40052
   languageName: node
   linkType: hard
 
@@ -12137,6 +6920,27 @@ __metadata:
   languageName: node
   linkType: hard
 
+"commander@npm:^12.1.0":
+  version: 12.1.0
+  resolution: "commander@npm:12.1.0"
+  checksum: 68e9818b00fc1ed9cdab9eb16905551c2b768a317ae69a5e3c43924c2b20ac9bb65b27e1cab36aeda7b6496376d4da908996ba2c0b5d79463e0fb1e77935d514
+  languageName: node
+  linkType: hard
+
+"commander@npm:^13.1.0":
+  version: 13.1.0
+  resolution: "commander@npm:13.1.0"
+  checksum: 8ca2fcb33caf2aa06fba3722d7a9440921331d54019dabf906f3603313e7bf334b009b862257b44083ff65d5a3ab19e83ad73af282bd5319f01dc228bdf87ef0
+  languageName: node
+  linkType: hard
+
+"commander@npm:^2.15.1, commander@npm:^2.20.0, commander@npm:^2.6.0":
+  version: 2.20.3
+  resolution: "commander@npm:2.20.3"
+  checksum: ab8c07884e42c3a8dbc5dd9592c606176c7eb5c1ca5ff274bcf907039b2c41de3626f684ea75ccf4d361ba004bbaff1f577d5384c155f3871e456bdf27becf9e
+  languageName: node
+  linkType: hard
+
 "commander@npm:^4.1.1":
   version: 4.1.1
   resolution: "commander@npm:4.1.1"
@@ -12158,14 +6962,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"common-tags@npm:^1.4.0":
-  version: 1.8.0
-  resolution: "common-tags@npm:1.8.0"
-  checksum: fb0cc9420d149176f2bd2b1fc9e6df622cd34eccaca60b276aa3253a7c9241e8a8ed1ec0702b2679eba7e47aeef721869c686bbd7257b75b5c44993c8462cd7f
+"common-ancestor-path@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "common-ancestor-path@npm:1.0.1"
+  checksum: 1d2e4186067083d8cc413f00fc2908225f04ae4e19417ded67faa6494fb313c4fcd5b28a52326d1a62b466e2b3a4325e92c31133c5fee628cdf8856b3a57c3d7
+  languageName: node
+  linkType: hard
+
+"common-sequence@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "common-sequence@npm:2.0.2"
+  checksum: 35c183bac415c6069840940145c7251121fcc13d2166af8e764bc98c40be7ffaaf050bdba2ec85f9c2ab6a41f115e642d6becf44e0fb2bbd3c19f49a794ee196
   languageName: node
   linkType: hard
 
-"common-tags@npm:^1.8.0, common-tags@npm:^1.8.2":
+"common-tags@npm:^1.4.0, common-tags@npm:^1.8.0, common-tags@npm:^1.8.2":
   version: 1.8.2
   resolution: "common-tags@npm:1.8.2"
   checksum: 767a6255a84bbc47df49a60ab583053bb29a7d9687066a18500a516188a062c4e4cd52de341f22de0b07062e699b1b8fe3cfa1cb55b241cb9301aeb4f45b4dff
@@ -12179,14 +6990,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"component-emitter@npm:^1.2.1":
-  version: 1.3.0
-  resolution: "component-emitter@npm:1.3.0"
-  checksum: b3c46de38ffd35c57d1c02488355be9f218e582aec72d72d1b8bbec95a3ac1b38c96cd6e03ff015577e68f550fbb361a3bfdbd9bb248be9390b7b3745691be6b
-  languageName: node
-  linkType: hard
-
-"compressible@npm:~2.0.16":
+"compressible@npm:~2.0.18":
   version: 2.0.18
   resolution: "compressible@npm:2.0.18"
   dependencies:
@@ -12196,17 +7000,17 @@ __metadata:
   linkType: hard
 
 "compression@npm:^1.7.4":
-  version: 1.7.4
-  resolution: "compression@npm:1.7.4"
+  version: 1.8.0
+  resolution: "compression@npm:1.8.0"
   dependencies:
-    accepts: ~1.3.5
-    bytes: 3.0.0
-    compressible: ~2.0.16
+    bytes: 3.1.2
+    compressible: ~2.0.18
     debug: 2.6.9
+    negotiator: ~0.6.4
     on-headers: ~1.0.2
-    safe-buffer: 5.1.2
+    safe-buffer: 5.2.1
     vary: ~1.1.2
-  checksum: 35c0f2eb1f28418978615dc1bc02075b34b1568f7f56c62d60f4214d4b7cc00d0f6d282b5f8a954f59872396bd770b6b15ffd8aa94c67d4bce9b8887b906999b
+  checksum: 12ca3e326b4ccb6b6e51e1d14d96fafd058ddb3be08fe888487d367d42fb4f81f25d4bf77acc517ba724370e7d74469280688baf2da8cad61062bdf62eb9fd45
   languageName: node
   linkType: hard
 
@@ -12217,35 +7021,30 @@ __metadata:
   languageName: node
   linkType: hard
 
-"concat-stream@npm:^1.5.0":
-  version: 1.6.2
-  resolution: "concat-stream@npm:1.6.2"
-  dependencies:
-    buffer-from: ^1.0.0
-    inherits: ^2.0.3
-    readable-stream: ^2.2.2
-    typedarray: ^0.0.6
-  checksum: 1ef77032cb4459dcd5187bd710d6fc962b067b64ec6a505810de3d2b8cc0605638551b42f8ec91edf6fcd26141b32ef19ad749239b58fae3aba99187adc32285
-  languageName: node
-  linkType: hard
-
-"concurrently@npm:^8.2.2":
-  version: 8.2.2
-  resolution: "concurrently@npm:8.2.2"
+"concurrently@npm:~9.1.2":
+  version: 9.1.2
+  resolution: "concurrently@npm:9.1.2"
   dependencies:
     chalk: ^4.1.2
-    date-fns: ^2.30.0
     lodash: ^4.17.21
     rxjs: ^7.8.1
     shell-quote: ^1.8.1
-    spawn-command: 0.0.2
     supports-color: ^8.1.1
     tree-kill: ^1.2.2
     yargs: ^17.7.2
   bin:
     conc: dist/bin/concurrently.js
     concurrently: dist/bin/concurrently.js
-  checksum: 8ac774df06869773438f1bf91025180c52d5b53139bc86cf47659136c0d97461d0579c515d848d1e945d4e3e0cafe646b2ea18af8d74259b46abddcfe39b2c6c
+  checksum: 9e25e8ee6272ada26739aff1fb43e96ac458fafca82f45b8360bdd9115d60bbc679d282dfc52001b861b6e9f32b3063aed975691d8dec9e62807a9679763a1d8
+  languageName: node
+  linkType: hard
+
+"config-master@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "config-master@npm:3.1.0"
+  dependencies:
+    walk-back: ^2.0.1
+  checksum: fc72291c693358b9173fc446edc1a5213211c20aa29a104129c8040cbc821593bd9b8b595e073afb33ef38f7b233e1ad2b8eeaa9906c49f2cbf54c2a7d61c6cb
   languageName: node
   linkType: hard
 
@@ -12275,13 +7074,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"console-browserify@npm:^1.1.0":
-  version: 1.2.0
-  resolution: "console-browserify@npm:1.2.0"
-  checksum: 226591eeff8ed68e451dffb924c1fb750c654d54b9059b3b261d360f369d1f8f70650adecf2c7136656236a4bfeb55c39281b5d8a55d792ebbb99efd3d848d52
-  languageName: node
-  linkType: hard
-
 "console-control-strings@npm:^1.1.0":
   version: 1.1.0
   resolution: "console-control-strings@npm:1.1.0"
@@ -12289,7 +7081,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"console-ui@npm:^3.0.4, console-ui@npm:^3.1.1, console-ui@npm:^3.1.2":
+"console-ui@npm:^3.0.4, console-ui@npm:^3.1.2":
   version: 3.1.2
   resolution: "console-ui@npm:3.1.2"
   dependencies:
@@ -12311,22 +7103,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"constants-browserify@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "constants-browserify@npm:1.0.0"
-  checksum: f7ac8c6d0b6e4e0c77340a1d47a3574e25abd580bfd99ad707b26ff7618596cf1a5e5ce9caf44715e9e01d4a5d12cb3b4edaf1176f34c19adb2874815a56e64f
-  languageName: node
-  linkType: hard
-
-"content-disposition@npm:0.5.3":
-  version: 0.5.3
-  resolution: "content-disposition@npm:0.5.3"
-  dependencies:
-    safe-buffer: 5.1.2
-  checksum: 95bf164c0b0b8199d3f44b7631e51b37f683c6a90b9baa4315bd3d405a6d1bc81b7346f0981046aa004331fb3d7a28b629514d01fc209a5251573fc7e4d33380
-  languageName: node
-  linkType: hard
-
 "content-disposition@npm:0.5.4":
   version: 0.5.4
   resolution: "content-disposition@npm:0.5.4"
@@ -12336,14 +7112,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"content-type@npm:~1.0.4":
-  version: 1.0.4
-  resolution: "content-type@npm:1.0.4"
-  checksum: 3d93585fda985d1554eca5ebd251994327608d2e200978fdbfba21c0c679914d5faf266d17027de44b34a72c7b0745b18584ecccaa7e1fdfb6a68ac7114f12e0
+"content-tag@npm:^1.2.2":
+  version: 1.2.2
+  resolution: "content-tag@npm:1.2.2"
+  checksum: 38087560728d3e2a0ea62786fb795a1b34d77e83e2729af0ef84f9f67a45a080a2ee2efac7f452c9e8bb95c81ef2f5f92c0dd00e5653799bfc48c997bca84ef2
   languageName: node
   linkType: hard
 
-"content-type@npm:~1.0.5":
+"content-type@npm:~1.0.4, content-type@npm:~1.0.5":
   version: 1.0.5
   resolution: "content-type@npm:1.0.5"
   checksum: 566271e0a251642254cde0f845f9dd4f9856e52d988f4eb0d0dcffbb7a1f8ec98de7a5215fc628f3bce30fe2fb6fd2bc064b562d721658c59b544e2d34ea2766
@@ -12357,15 +7133,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"convert-source-map@npm:^1.5.1, convert-source-map@npm:^1.7.0":
-  version: 1.8.0
-  resolution: "convert-source-map@npm:1.8.0"
-  dependencies:
-    safe-buffer: ~5.1.1
-  checksum: 985d974a2d33e1a2543ada51c93e1ba2f73eaed608dc39f229afc78f71dcc4c8b7d7c684aa647e3c6a3a204027444d69e53e169ce94e8d1fa8d7dee80c9c8fed
-  languageName: node
-  linkType: hard
-
 "convert-source-map@npm:^2.0.0":
   version: 2.0.0
   resolution: "convert-source-map@npm:2.0.0"
@@ -12380,38 +7147,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cookie@npm:0.4.0":
-  version: 0.4.0
-  resolution: "cookie@npm:0.4.0"
-  checksum: 760384ba0aef329c52523747e36a452b5e51bc49b34160363a6934e7b7df3f93fcc88b35e33450361535d40a92a96412da870e1816aba9aa6cc556a9fedd8492
-  languageName: node
-  linkType: hard
-
-"cookie@npm:0.5.0":
-  version: 0.5.0
-  resolution: "cookie@npm:0.5.0"
-  checksum: 1f4bd2ca5765f8c9689a7e8954183f5332139eb72b6ff783d8947032ec1fdf43109852c178e21a953a30c0dd42257828185be01b49d1eb1a67fd054ca588a180
-  languageName: node
-  linkType: hard
-
-"cookie@npm:~0.4.1":
-  version: 0.4.1
-  resolution: "cookie@npm:0.4.1"
-  checksum: bd7c47f5d94ab70ccdfe8210cde7d725880d2fcda06d8e375afbdd82de0c8d3b73541996e9ce57d35f67f672c4ee6d60208adec06b3c5fc94cebb85196084cf8
+"cookie@npm:0.7.1":
+  version: 0.7.1
+  resolution: "cookie@npm:0.7.1"
+  checksum: cec5e425549b3650eb5c3498a9ba3cde0b9cd419e3b36e4b92739d30b4d89e0b678b98c1ddc209ce7cf958cd3215671fd6ac47aec21f10c2a0cc68abd399d8a7
   languageName: node
   linkType: hard
 
-"copy-concurrently@npm:^1.0.0":
-  version: 1.0.5
-  resolution: "copy-concurrently@npm:1.0.5"
-  dependencies:
-    aproba: ^1.1.1
-    fs-write-stream-atomic: ^1.0.8
-    iferr: ^0.1.5
-    mkdirp: ^0.5.1
-    rimraf: ^2.5.4
-    run-queue: ^1.0.0
-  checksum: 63c169f582e09445260988f697b2d07793d439dfc31e97c8999707bd188dd94d1c7f2ca3533c7786fb75f03a3f2f54ad1ee08055f95f61bb8d2e862498c1d460
+"cookie@npm:~0.7.2":
+  version: 0.7.2
+  resolution: "cookie@npm:0.7.2"
+  checksum: 9bf8555e33530affd571ea37b615ccad9b9a34febbf2c950c86787088eb00a8973690833b0f8ebd6b69b753c62669ea60cec89178c1fb007bf0749abed74f93e
   languageName: node
   linkType: hard
 
@@ -12422,90 +7168,26 @@ __metadata:
   languageName: node
   linkType: hard
 
-"copy-descriptor@npm:^0.1.0":
-  version: 0.1.1
-  resolution: "copy-descriptor@npm:0.1.1"
-  checksum: d4b7b57b14f1d256bb9aa0b479241048afd7f5bcf22035fc7b94e8af757adeae247ea23c1a774fe44869fd5694efba4a969b88d966766c5245fdee59837fe45b
-  languageName: node
-  linkType: hard
-
-"core-js-compat@npm:^3.16.2":
-  version: 3.18.2
-  resolution: "core-js-compat@npm:3.18.2"
-  dependencies:
-    browserslist: ^4.17.3
-    semver: 7.0.0
-  checksum: 8358d4a14725b68ccb5fcdd590e603f08933c1f89b0fc5415054048771d6ae9182dca89d0280ed44535ce7a5f6f2f6280774aa0b0410842c940a9a2149ab83d2
-  languageName: node
-  linkType: hard
-
-"core-js-compat@npm:^3.18.0":
-  version: 3.19.2
-  resolution: "core-js-compat@npm:3.19.2"
-  dependencies:
-    browserslist: ^4.18.1
-    semver: 7.0.0
-  checksum: 6b9cca0dc341512c3494955ab87cf7e091dd98503af2b432979c6467385804d03cec9598691c0560c5ede992c0b8ee2ce3fc1af4062c31f5731da70211b61544
-  languageName: node
-  linkType: hard
-
-"core-js-compat@npm:^3.20.2, core-js-compat@npm:^3.21.0":
-  version: 3.21.1
-  resolution: "core-js-compat@npm:3.21.1"
-  dependencies:
-    browserslist: ^4.19.1
-    semver: 7.0.0
-  checksum: 6af1bcbc94ede50b109e54bf3f5a9ca28b8a303124e07c2bf76c2257a8a94a0b550cf4a318f6ec0594b351b6f9a5453fd4516e3681560b6d984b95d1988baf13
-  languageName: node
-  linkType: hard
-
-"core-js-compat@npm:^3.22.1":
-  version: 3.22.8
-  resolution: "core-js-compat@npm:3.22.8"
-  dependencies:
-    browserslist: ^4.20.3
-    semver: 7.0.0
-  checksum: 0c82d9110dcb267c2f5547c61b62f8043793d203523048169176b8badf0b73f3792624342b85d9c923df8eb8971b4aa468b160abb81a023d183c5951e4f05a66
-  languageName: node
-  linkType: hard
-
-"core-js-compat@npm:^3.31.0, core-js-compat@npm:^3.33.1":
-  version: 3.33.3
-  resolution: "core-js-compat@npm:3.33.3"
-  dependencies:
-    browserslist: ^4.22.1
-  checksum: cb121e83f0f5f18b2b75428cdfb19524936a18459f1e0358f9124c8ff8b75d6a5901495cb996560cfde3a416103973f78eb5947777bb8b2fd877cdf84471465d
-  languageName: node
-  linkType: hard
-
-"core-js-compat@npm:^3.9.0":
-  version: 3.19.1
-  resolution: "core-js-compat@npm:3.19.1"
+"core-js-compat@npm:^3.40.0":
+  version: 3.42.0
+  resolution: "core-js-compat@npm:3.42.0"
   dependencies:
-    browserslist: ^4.17.6
-    semver: 7.0.0
-  checksum: ed302c99814bd7227b549f639fe5f1a3b9d885c0f878c1203f10be0a33c7d0b199931cb904074cc988ab48411132d4f41adf1603e4eebe5c5d42bdc62a3f5c5d
+    browserslist: ^4.24.4
+  checksum: 4f0a7db9ed9a95c4edae0749fe9a4d4d4f8f51a53c7c3e06049887500e98763732e8afef9628d2145f875b6e262567e951a77e4d06273f9eac273f5241259fd3
   languageName: node
   linkType: hard
 
-"core-js@npm:^2.4.0, core-js@npm:^2.5.0, core-js@npm:^2.6.5":
+"core-js@npm:^2.6.5":
   version: 2.6.12
   resolution: "core-js@npm:2.6.12"
   checksum: 44fa9934a85f8c78d61e0c8b7b22436330471ffe59ec5076fe7f324d6e8cf7f824b14b1c81ca73608b13bdb0fef035bd820989bf059767ad6fa13123bb8bd016
   languageName: node
   linkType: hard
 
-"core-js@npm:^3.16.2":
-  version: 3.22.8
-  resolution: "core-js@npm:3.22.8"
-  checksum: c79bcfea37920a5da880ad1fc8336355e833c83998bb28cd45cc59eef4d9824dd8d59ccd24d6b18ff88f284d53d9eef021ddbd2b5ab1c6305b01e98c1402e510
-  languageName: node
-  linkType: hard
-
-"core-js@npm:^3.24.1":
-  version: 3.26.0
-  resolution: "core-js@npm:3.26.0"
-  checksum: 0149eb9d3909fde9c17626af3a6e625c326e8598d0bb5e6c5b48a18e5fcd4eaf48d4964d873667d8148542ff590fb98eb3f93618da114ca54999d6bc0349734b
+"core-js@npm:^3.24.1, core-js@npm:^3.38.1":
+  version: 3.41.0
+  resolution: "core-js@npm:3.41.0"
+  checksum: 05331e92f354d3b92fa296fb3fc90c7b25d1a65230046c68651be29d67245bb156bdde7bf5c8cf8b3ecddfff93273a9ba6567f5e4ee6ceb70f39cee430693509
   languageName: node
   linkType: hard
 
@@ -12518,13 +7200,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"core-util-is@npm:1.0.2":
-  version: 1.0.2
-  resolution: "core-util-is@npm:1.0.2"
-  checksum: 7a4c925b497a2c91421e25bf76d6d8190f0b2359a9200dbeed136e63b2931d6294d3b1893eda378883ed363cd950f44a12a401384c609839ea616befb7927dab
-  languageName: node
-  linkType: hard
-
 "core-util-is@npm:~1.0.0":
   version: 1.0.3
   resolution: "core-util-is@npm:1.0.3"
@@ -12542,108 +7217,51 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cosmiconfig@npm:^7.0.0":
-  version: 7.0.0
-  resolution: "cosmiconfig@npm:7.0.0"
-  dependencies:
-    "@types/parse-json": ^4.0.0
-    import-fresh: ^3.2.1
-    parse-json: ^5.0.0
-    path-type: ^4.0.0
-    yaml: ^1.10.0
-  checksum: 6801feaa0249e9b9fdde5b3d70dc33b4f9c69095bec94d67e3fe08b66eac24dc7e2099f053597cfbc94b743de269aa5d2cfa7da3fde765433423b06bd122941a
-  languageName: node
-  linkType: hard
-
-"cosmiconfig@npm:^8.2.0":
-  version: 8.2.0
-  resolution: "cosmiconfig@npm:8.2.0"
+"cosmiconfig@npm:^9.0.0":
+  version: 9.0.0
+  resolution: "cosmiconfig@npm:9.0.0"
   dependencies:
-    import-fresh: ^3.2.1
+    env-paths: ^2.2.1
+    import-fresh: ^3.3.0
     js-yaml: ^4.1.0
-    parse-json: ^5.0.0
-    path-type: ^4.0.0
-  checksum: 836d5d8efa750f3fb17b03d6ca74cd3154ed025dffd045304b3ef59637f662bde1e5dc88f8830080d180ec60841719cf4ea2ce73fb21ec694b16865c478ff297
-  languageName: node
-  linkType: hard
-
-"create-ecdh@npm:^4.0.0":
-  version: 4.0.4
-  resolution: "create-ecdh@npm:4.0.4"
-  dependencies:
-    bn.js: ^4.1.0
-    elliptic: ^6.5.3
-  checksum: 0dd7fca9711d09e152375b79acf1e3f306d1a25ba87b8ff14c2fd8e68b83aafe0a7dd6c4e540c9ffbdd227a5fa1ad9b81eca1f233c38bb47770597ba247e614b
-  languageName: node
-  linkType: hard
-
-"create-hash@npm:^1.1.0, create-hash@npm:^1.1.2, create-hash@npm:^1.2.0":
-  version: 1.2.0
-  resolution: "create-hash@npm:1.2.0"
-  dependencies:
-    cipher-base: ^1.0.1
-    inherits: ^2.0.1
-    md5.js: ^1.3.4
-    ripemd160: ^2.0.1
-    sha.js: ^2.4.0
-  checksum: 02a6ae3bb9cd4afee3fabd846c1d8426a0e6b495560a977ba46120c473cb283be6aa1cace76b5f927cf4e499c6146fb798253e48e83d522feba807d6b722eaa9
+    parse-json: ^5.2.0
+  peerDependencies:
+    typescript: ">=4.9.5"
+  peerDependenciesMeta:
+    typescript:
+      optional: true
+  checksum: a30c424b53d442ea0bdd24cb1b3d0d8687c8dda4a17ab6afcdc439f8964438801619cdb66e8e79f63b9caa3e6586b60d8bab9ce203e72df6c5e80179b971fe8f
   languageName: node
   linkType: hard
 
-"create-hmac@npm:^1.1.0, create-hmac@npm:^1.1.4, create-hmac@npm:^1.1.7":
-  version: 1.1.7
-  resolution: "create-hmac@npm:1.1.7"
-  dependencies:
-    cipher-base: ^1.0.3
-    create-hash: ^1.1.0
-    inherits: ^2.0.1
-    ripemd160: ^2.0.0
-    safe-buffer: ^5.0.1
-    sha.js: ^2.4.8
-  checksum: ba12bb2257b585a0396108c72830e85f882ab659c3320c83584b1037f8ab72415095167ced80dc4ce8e446a8ecc4b2acf36d87befe0707d73b26cf9dc77440ed
+"crelt@npm:^1.0.5":
+  version: 1.0.6
+  resolution: "crelt@npm:1.0.6"
+  checksum: dad842093371ad702afbc0531bfca2b0a8dd920b23a42f26e66dabbed9aad9acd5b9030496359545ef3937c3aced0fd4ac39f7a2d280a23ddf9eb7fdcb94a69f
   languageName: node
   linkType: hard
 
 "cross-spawn@npm:^6.0.0":
-  version: 6.0.5
-  resolution: "cross-spawn@npm:6.0.5"
+  version: 6.0.6
+  resolution: "cross-spawn@npm:6.0.6"
   dependencies:
     nice-try: ^1.0.4
     path-key: ^2.0.1
     semver: ^5.5.0
     shebang-command: ^1.2.0
     which: ^1.2.9
-  checksum: f893bb0d96cd3d5751d04e67145bdddf25f99449531a72e82dcbbd42796bbc8268c1076c6b3ea51d4d455839902804b94bc45dfb37ecbb32ea8e54a6741c3ab9
+  checksum: a6e2e5b04a0e0f806c1df45f92cd079b65f95fbe5a7650ee1ab60318c33a6c156a8a2f8b6898f57764f7363ec599a0625e9855dfa78d52d2d73dbd32eb11c25e
   languageName: node
   linkType: hard
 
-"cross-spawn@npm:^7.0.0, cross-spawn@npm:^7.0.2, cross-spawn@npm:^7.0.3":
-  version: 7.0.3
-  resolution: "cross-spawn@npm:7.0.3"
+"cross-spawn@npm:^7.0.0, cross-spawn@npm:^7.0.2, cross-spawn@npm:^7.0.3, cross-spawn@npm:^7.0.6":
+  version: 7.0.6
+  resolution: "cross-spawn@npm:7.0.6"
   dependencies:
     path-key: ^3.1.0
     shebang-command: ^2.0.0
     which: ^2.0.1
-  checksum: 671cc7c7288c3a8406f3c69a3ae2fc85555c04169e9d611def9a675635472614f1c0ed0ef80955d5b6d4e724f6ced67f0ad1bb006c2ea643488fcfef994d7f52
-  languageName: node
-  linkType: hard
-
-"crypto-browserify@npm:^3.11.0":
-  version: 3.12.0
-  resolution: "crypto-browserify@npm:3.12.0"
-  dependencies:
-    browserify-cipher: ^1.0.0
-    browserify-sign: ^4.0.0
-    create-ecdh: ^4.0.0
-    create-hash: ^1.1.0
-    create-hmac: ^1.1.0
-    diffie-hellman: ^5.0.0
-    inherits: ^2.0.1
-    pbkdf2: ^3.0.3
-    public-encrypt: ^4.0.0
-    randombytes: ^2.0.0
-    randomfill: ^1.0.3
-  checksum: c1609af82605474262f3eaa07daa0b2140026bd264ab316d4bf1170272570dbe02f0c49e29407fe0d3634f96c507c27a19a6765fb856fed854a625f9d15618e2
+  checksum: 8d306efacaf6f3f60e0224c287664093fa9185680b2d195852ba9a863f85d02dcc737094c6e512175f8ee0161f9b87c73c6826034c2422e39de7d6569cf4503b
   languageName: node
   linkType: hard
 
@@ -12654,10 +7272,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"css-functions-list@npm:^3.1.0":
-  version: 3.2.0
-  resolution: "css-functions-list@npm:3.2.0"
-  checksum: fe912ea852fad500aef9a4f04db9a0371c7b0eb1ac1a45fbd8df0156ae0538cee7492ebd620b9bb502fe5bf2b5ed3bf3c16b6659cf67c7144eff0b597bcc3891
+"css-functions-list@npm:^3.2.3":
+  version: 3.2.3
+  resolution: "css-functions-list@npm:3.2.3"
+  checksum: 25f12fb0ef1384b1cf45a6e7e0afd596a19bee90b90316d9e50f7820888f4a8f265be7a6a96b10a5c81e403bd7a5ff8010fa936144f84959d9d91c9350cda0d4
   languageName: node
   linkType: hard
 
@@ -12671,338 +7289,82 @@ __metadata:
     postcss-modules-extract-imports: ^3.0.0
     postcss-modules-local-by-default: ^4.0.0
     postcss-modules-scope: ^3.0.0
-    postcss-modules-values: ^4.0.0
-    postcss-value-parser: ^4.1.0
-    schema-utils: ^3.0.0
-    semver: ^7.3.5
-  peerDependencies:
-    webpack: ^4.27.0 || ^5.0.0
-  checksum: fb0742b30ac0919f94b99a323bdefe6d48ae46d66c7d966aae59031350532f368f8bba5951fcd268f2e053c5e6e4655551076268e9073ccb58e453f98ae58f8e
-  languageName: node
-  linkType: hard
-
-"css-select-base-adapter@npm:^0.1.1":
-  version: 0.1.1
-  resolution: "css-select-base-adapter@npm:0.1.1"
-  checksum: c107e9cfa53a23427e4537451a67358375e656baa3322345a982d3c2751fb3904002aae7e5d72386c59f766fe6b109d1ffb43eeab1c16f069f7a3828eb17851c
-  languageName: node
-  linkType: hard
-
-"css-select@npm:^2.0.0":
-  version: 2.1.0
-  resolution: "css-select@npm:2.1.0"
-  dependencies:
-    boolbase: ^1.0.0
-    css-what: ^3.2.1
-    domutils: ^1.7.0
-    nth-check: ^1.0.2
-  checksum: 0c4099910f2411e2a9103cf92ea6a4ad738b57da75bcf73d39ef2c14a00ef36e5f16cb863211c901320618b24ace74da6333442d82995cafd5040077307de462
-  languageName: node
-  linkType: hard
-
-"css-select@npm:^5.1.0":
-  version: 5.1.0
-  resolution: "css-select@npm:5.1.0"
-  dependencies:
-    boolbase: ^1.0.0
-    css-what: ^6.1.0
-    domhandler: ^5.0.2
-    domutils: ^3.0.1
-    nth-check: ^2.0.1
-  checksum: 2772c049b188d3b8a8159907192e926e11824aea525b8282981f72ba3f349cf9ecd523fdf7734875ee2cb772246c22117fc062da105b6d59afe8dcd5c99c9bda
-  languageName: node
-  linkType: hard
-
-"css-tree@npm:1.0.0-alpha.29":
-  version: 1.0.0-alpha.29
-  resolution: "css-tree@npm:1.0.0-alpha.29"
-  dependencies:
-    mdn-data: ~1.1.0
-    source-map: ^0.5.3
-  checksum: 1693a0ddb85fe6f94c5d1b4c79a5dbc67d0c4a10e9992d9c6685bfc84b9d40380799e30b22bca42e15e60d927ac54ac500dec785e8c9245ee782c89eb4d924f4
-  languageName: node
-  linkType: hard
-
-"css-tree@npm:1.0.0-alpha.33":
-  version: 1.0.0-alpha.33
-  resolution: "css-tree@npm:1.0.0-alpha.33"
-  dependencies:
-    mdn-data: 2.0.4
-    source-map: ^0.5.3
-  checksum: b7d1584d855ac01dd2fd7898869f8de90b6cd5b284ffc3d538cbf40891f65f82011964ab360314175bcec3d08838976f4a68823df51d74a456879f62cdf63026
-  languageName: node
-  linkType: hard
-
-"css-tree@npm:^2.0.4":
-  version: 2.1.0
-  resolution: "css-tree@npm:2.1.0"
-  dependencies:
-    mdn-data: 2.0.27
-    source-map-js: ^1.0.1
-  checksum: 254c66a76f6a01d5161605162b17c1792fb3f96966d1cabec3435c551372707c02f6ca6c15f967bee7699f0b254437037c3fdb5eea0cd76ac2377cc8ac1f1d1d
-  languageName: node
-  linkType: hard
-
-"css-tree@npm:^2.3.1":
-  version: 2.3.1
-  resolution: "css-tree@npm:2.3.1"
-  dependencies:
-    mdn-data: 2.0.30
-    source-map-js: ^1.0.1
-  checksum: 493cc24b5c22b05ee5314b8a0d72d8a5869491c1458017ae5ed75aeb6c3596637dbe1b11dac2548974624adec9f7a1f3a6cf40593dc1f9185eb0e8279543fbc0
-  languageName: node
-  linkType: hard
-
-"css-what@npm:^3.2.1":
-  version: 3.4.2
-  resolution: "css-what@npm:3.4.2"
-  checksum: 26bb5ec3ae718393d418016365c849fa14bd0de408c735dea3ddf58146b6cc54f3b336fb4afd31d95c06ca79583acbcdfec7ee93d31ff5c1a697df135b38dfeb
-  languageName: node
-  linkType: hard
-
-"css-what@npm:^6.1.0":
-  version: 6.1.0
-  resolution: "css-what@npm:6.1.0"
-  checksum: b975e547e1e90b79625918f84e67db5d33d896e6de846c9b584094e529f0c63e2ab85ee33b9daffd05bff3a146a1916bec664e18bb76dd5f66cbff9fc13b2bbe
-  languageName: node
-  linkType: hard
-
-"cssesc@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "cssesc@npm:3.0.0"
-  bin:
-    cssesc: bin/cssesc
-  checksum: f8c4ababffbc5e2ddf2fa9957dda1ee4af6048e22aeda1869d0d00843223c1b13ad3f5d88b51caa46c994225eacb636b764eb807a8883e2fb6f99b4f4e8c48b2
-  languageName: node
-  linkType: hard
-
-"csso@npm:^3.5.1":
-  version: 3.5.1
-  resolution: "csso@npm:3.5.1"
-  dependencies:
-    css-tree: 1.0.0-alpha.29
-  checksum: f5cca58d7b0a50cdab52c634d967f822c18aaa5f50dd1e145bb755f7ca4b32a029b72269a8a7e253e338e59833e6a934beca187172fb00efc6d096dba0d635b1
-  languageName: node
-  linkType: hard
-
-"cssom@npm:^0.4.4":
-  version: 0.4.4
-  resolution: "cssom@npm:0.4.4"
-  checksum: e3bc1076e7ee4213d4fef05e7ae03bfa83dc05f32611d8edc341f4ecc3d9647b89c8245474c7dd2cdcdb797a27c462e99da7ad00a34399694559f763478ff53f
-  languageName: node
-  linkType: hard
-
-"cssom@npm:~0.3.6":
-  version: 0.3.8
-  resolution: "cssom@npm:0.3.8"
-  checksum: 24beb3087c76c0d52dd458be9ee1fbc80ac771478a9baef35dd258cdeb527c68eb43204dd439692bb2b1ae5272fa5f2946d10946edab0d04f1078f85e06bc7f6
-  languageName: node
-  linkType: hard
-
-"cssstyle@npm:^2.3.0":
-  version: 2.3.0
-  resolution: "cssstyle@npm:2.3.0"
-  dependencies:
-    cssom: ~0.3.6
-  checksum: 5f05e6fd2e3df0b44695c2f08b9ef38b011862b274e320665176467c0725e44a53e341bc4959a41176e83b66064ab786262e7380fd1cabeae6efee0d255bb4e3
-  languageName: node
-  linkType: hard
-
-"csstype@npm:^3.1.3":
-  version: 3.1.3
-  resolution: "csstype@npm:3.1.3"
-  checksum: 8db785cc92d259102725b3c694ec0c823f5619a84741b5c7991b8ad135dfaa66093038a1cc63e03361a6cd28d122be48f2106ae72334e067dd619a51f49eddf7
-  languageName: node
-  linkType: hard
-
-"cyclist@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "cyclist@npm:1.0.1"
-  checksum: 3cc2fdeb358599ca0ea96f5ecf2fc530ccab7ed1f8aa1a894aebfacd2009281bd7380cb9b30db02a18cdd00b3ed1d7ce81a3b11fe56e33a6a0fe4424dc592fbe
-  languageName: node
-  linkType: hard
-
-"d3-array@npm:1, d3-array@npm:^1.1.1, d3-array@npm:^1.2.0":
-  version: 1.2.4
-  resolution: "d3-array@npm:1.2.4"
-  checksum: d0be1fa7d72dbfac8a3bcffbb669d42bcb9128d8818d84d2b1df0c60bbe4c8e54a798be0457c55a219b399e2c2fabcbd581cbb130eb638b5436b0618d7e56000
-  languageName: node
-  linkType: hard
-
-"d3-array@npm:2 - 3, d3-array@npm:2.10.0 - 3, d3-array@npm:^3.2.0":
-  version: 3.2.4
-  resolution: "d3-array@npm:3.2.4"
-  dependencies:
-    internmap: 1 - 2
-  checksum: a5976a6d6205f69208478bb44920dd7ce3e788c9dceb86b304dbe401a4bfb42ecc8b04c20facde486e9adcb488b5d1800d49393a3f81a23902b68158e12cddd0
-  languageName: node
-  linkType: hard
-
-"d3-axis@npm:1, d3-axis@npm:^1.0.8":
-  version: 1.0.12
-  resolution: "d3-axis@npm:1.0.12"
-  checksum: b1cf820fb6e95cc3371b340353b05272dba16ce6ad4fe9a0992d075ab48a08810f87f5e6c7cbb6c63fca1ee1e9b7c822307a1590187daa7627f45728a747c746
-  languageName: node
-  linkType: hard
-
-"d3-brush@npm:1":
-  version: 1.1.6
-  resolution: "d3-brush@npm:1.1.6"
-  dependencies:
-    d3-dispatch: 1
-    d3-drag: 1
-    d3-interpolate: 1
-    d3-selection: 1
-    d3-transition: 1
-  checksum: ffa23a5543699cc1199f45ac87d4e1293167c4bab0833657d77172d84d910448893569393290dba3689af1e5a1fc77503d94a2dec3976de8a7bc68ed0e32413a
-  languageName: node
-  linkType: hard
-
-"d3-chord@npm:1":
-  version: 1.0.6
-  resolution: "d3-chord@npm:1.0.6"
-  dependencies:
-    d3-array: 1
-    d3-path: 1
-  checksum: e4ca95ffff089f0eccf796d16a5574121e0ecbe658dcd9d5fa760af3573c3349264ce325c0adf1f32bcad67038d3938edd109712166cfb5b3bbe068e27c012e9
-  languageName: node
-  linkType: hard
-
-"d3-collection@npm:1, d3-collection@npm:^1.0.4":
-  version: 1.0.7
-  resolution: "d3-collection@npm:1.0.7"
-  checksum: 9c6b910a9da0efb021e294509f98263ca4f62d10b997bb30ccfb6edd582b703da36e176b968b5bac815fbb0f328e49643c38cf93b5edf8572a179ba55cf4a09d
-  languageName: node
-  linkType: hard
-
-"d3-color@npm:1":
-  version: 1.4.1
-  resolution: "d3-color@npm:1.4.1"
-  checksum: a214b61458b5fcb7ad1a84faed0e02918037bab6be37f2d437bf0e2915cbd854d89fbf93754f17b0781c89e39d46704633d05a2bfae77e6209f0f4b140f9894b
-  languageName: node
-  linkType: hard
-
-"d3-color@npm:1 - 3":
-  version: 3.1.0
-  resolution: "d3-color@npm:3.1.0"
-  checksum: 4931fbfda5d7c4b5cfa283a13c91a954f86e3b69d75ce588d06cde6c3628cebfc3af2069ccf225e982e8987c612aa7948b3932163ce15eb3c11cd7c003f3ee3b
+    postcss-modules-values: ^4.0.0
+    postcss-value-parser: ^4.1.0
+    schema-utils: ^3.0.0
+    semver: ^7.3.5
+  peerDependencies:
+    webpack: ^4.27.0 || ^5.0.0
+  checksum: fb0742b30ac0919f94b99a323bdefe6d48ae46d66c7d966aae59031350532f368f8bba5951fcd268f2e053c5e6e4655551076268e9073ccb58e453f98ae58f8e
   languageName: node
   linkType: hard
 
-"d3-contour@npm:1":
-  version: 1.3.2
-  resolution: "d3-contour@npm:1.3.2"
+"css-tree@npm:^2.0.4":
+  version: 2.3.1
+  resolution: "css-tree@npm:2.3.1"
   dependencies:
-    d3-array: ^1.1.1
-  checksum: c18a099a7f4af2adf788e96d07bfc7236661a6e40c017ef8e172fe0142561f3722f71263075c565a17b72e6cd6a2a05de3868fcc5420eb77b00d3a0179a69a0d
-  languageName: node
-  linkType: hard
-
-"d3-dispatch@npm:1":
-  version: 1.0.6
-  resolution: "d3-dispatch@npm:1.0.6"
-  checksum: b4ecb016b6dda8b99aa4263b2d0a0c7b12e7dea93e4b0ce3013c94dca4d360d9ba00f5bdc15dc944cc4543af8e341067bd628f061f7b8deb642257e2ac90d06c
+    mdn-data: 2.0.30
+    source-map-js: ^1.0.1
+  checksum: 493cc24b5c22b05ee5314b8a0d72d8a5869491c1458017ae5ed75aeb6c3596637dbe1b11dac2548974624adec9f7a1f3a6cf40593dc1f9185eb0e8279543fbc0
   languageName: node
   linkType: hard
 
-"d3-drag@npm:1":
-  version: 1.2.5
-  resolution: "d3-drag@npm:1.2.5"
+"css-tree@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "css-tree@npm:3.1.0"
   dependencies:
-    d3-dispatch: 1
-    d3-selection: 1
-  checksum: 6e86e89aa8d511979eea1b5326709c05c2a3c2d43a93a82ed6b6f98528b2ab03b2f58f5e4f66582f2f1c0ae44f9c19f6f4f857249eb66aabc46e4942295fa0a7
+    mdn-data: 2.12.2
+    source-map-js: ^1.0.1
+  checksum: 6b8c713c22b7223c0e71179575c3bbf421a13a61641204645d6c3b560bdc4ffed8d676220bbcb83777e07b46a934ec3b1c629aa61d57422c196c8e2e7417ee1a
   languageName: node
   linkType: hard
 
-"d3-dsv@npm:1":
-  version: 1.2.0
-  resolution: "d3-dsv@npm:1.2.0"
-  dependencies:
-    commander: 2
-    iconv-lite: 0.4
-    rw: 1
+"cssesc@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "cssesc@npm:3.0.0"
   bin:
-    csv2json: bin/dsv2json
-    csv2tsv: bin/dsv2dsv
-    dsv2dsv: bin/dsv2dsv
-    dsv2json: bin/dsv2json
-    json2csv: bin/json2dsv
-    json2dsv: bin/json2dsv
-    json2tsv: bin/json2dsv
-    tsv2csv: bin/dsv2dsv
-    tsv2json: bin/dsv2json
-  checksum: 96c6e3d5ca1566624ca613b5941bc6fa916082cbe4b2b71cb6c5978c471db58c489b17206e3e31fbe30719dbd75e9c8ed8ab12a9d353cff90a35102690de7823
+    cssesc: bin/cssesc
+  checksum: f8c4ababffbc5e2ddf2fa9957dda1ee4af6048e22aeda1869d0d00843223c1b13ad3f5d88b51caa46c994225eacb636b764eb807a8883e2fb6f99b4f4e8c48b2
   languageName: node
   linkType: hard
 
-"d3-ease@npm:1, d3-ease@npm:^1.0.5":
-  version: 1.0.7
-  resolution: "d3-ease@npm:1.0.7"
-  checksum: 117811d51dfc4a126e8d23d249252df792fbbe30a93615e1d67158c482eff69b900e45a4cc92746fe65b1143287455406a89aae04eb4ca1ba5b1dc2a42af5b85
+"csstype@npm:^3.1.3":
+  version: 3.1.3
+  resolution: "csstype@npm:3.1.3"
+  checksum: 8db785cc92d259102725b3c694ec0c823f5619a84741b5c7991b8ad135dfaa66093038a1cc63e03361a6cd28d122be48f2106ae72334e067dd619a51f49eddf7
   languageName: node
   linkType: hard
 
-"d3-fetch@npm:1":
-  version: 1.2.0
-  resolution: "d3-fetch@npm:1.2.0"
+"d3-array@npm:2 - 3, d3-array@npm:2.10.0 - 3, d3-array@npm:^3.2.0, d3-array@npm:~3.2.4":
+  version: 3.2.4
+  resolution: "d3-array@npm:3.2.4"
   dependencies:
-    d3-dsv: 1
-  checksum: 00f091945bff4afbd06e6ce9ad762f0e91b7aac912c1ae7fe0efdbcce3a997d4fa2a93c254a3ba9b3f53f2134d606b20fb13791adbf5c6ed5c0be329a775945f
+    internmap: 1 - 2
+  checksum: a5976a6d6205f69208478bb44920dd7ce3e788c9dceb86b304dbe401a4bfb42ecc8b04c20facde486e9adcb488b5d1800d49393a3f81a23902b68158e12cddd0
   languageName: node
   linkType: hard
 
-"d3-force@npm:1":
-  version: 1.2.1
-  resolution: "d3-force@npm:1.2.1"
-  dependencies:
-    d3-collection: 1
-    d3-dispatch: 1
-    d3-quadtree: 1
-    d3-timer: 1
-  checksum: b73fe29d6c9a9c432ae65166d71238d14578a3a9537df095bebff87b7814161cd2822aff54a38d2400edb98b7f6d9221a810dcad7a53c6e8ddff0973f44ab3fa
+"d3-axis@npm:~3.0.0":
+  version: 3.0.0
+  resolution: "d3-axis@npm:3.0.0"
+  checksum: 227ddaa6d4bad083539c1ec245e2228b4620cca941997a8a650cb0af239375dc20271993127eedac66f0543f331027aca09385e1e16eed023f93eac937cddf0b
   languageName: node
   linkType: hard
 
-"d3-format@npm:1":
-  version: 1.4.5
-  resolution: "d3-format@npm:1.4.5"
-  checksum: 1b8b2c0bca182173bccd290a43e8b635a83fc8cfe52ec878c7bdabb997d47daac11f2b175cebbe73f807f782ad655f542bdfe18180ca5eb3498a3a82da1e06ab
+"d3-color@npm:1 - 3":
+  version: 3.1.0
+  resolution: "d3-color@npm:3.1.0"
+  checksum: 4931fbfda5d7c4b5cfa283a13c91a954f86e3b69d75ce588d06cde6c3628cebfc3af2069ccf225e982e8987c612aa7948b3932163ce15eb3c11cd7c003f3ee3b
   languageName: node
   linkType: hard
 
-"d3-format@npm:1 - 3":
+"d3-format@npm:1 - 3, d3-format@npm:~3.1.0":
   version: 3.1.0
   resolution: "d3-format@npm:3.1.0"
   checksum: f345ec3b8ad3cab19bff5dead395bd9f5590628eb97a389b1dd89f0b204c7c4fc1d9520f13231c2c7cf14b7c9a8cf10f8ef15bde2befbab41454a569bd706ca2
   languageName: node
   linkType: hard
 
-"d3-geo@npm:1":
-  version: 1.12.1
-  resolution: "d3-geo@npm:1.12.1"
-  dependencies:
-    d3-array: 1
-  checksum: 8ede498e5fce65c127403646f5cc6181a858a1e401e23e2856ce50ad27e6fdf8b49aeb88d2fad02696879d5825a45420ca1b5db9fa9c935ee413fe15b5bc37c4
-  languageName: node
-  linkType: hard
-
-"d3-hierarchy@npm:1":
-  version: 1.1.9
-  resolution: "d3-hierarchy@npm:1.1.9"
-  checksum: 5fd8761c302252cb9abe9ce2a0934fc97104dd0df8d1b5de6472532903416f40e13b4b58d03ce215a0b816d7129c4ed4503bd4fdbc00a130fdcf46a63d734a52
-  languageName: node
-  linkType: hard
-
-"d3-interpolate@npm:1":
-  version: 1.4.0
-  resolution: "d3-interpolate@npm:1.4.0"
-  dependencies:
-    d3-color: 1
-  checksum: d98988bd1e2f59d01f100d0a19315ad8f82ef022aa09a65aff76f747a44f9b52f2d64c6578b8f47e01f2b14a8f0ef88f5460d11173c0dd2d58238c217ac0ec03
-  languageName: node
-  linkType: hard
-
 "d3-interpolate@npm:1.2.0 - 3":
   version: 3.0.1
   resolution: "d3-interpolate@npm:3.0.1"
@@ -13012,13 +7374,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"d3-path@npm:1":
-  version: 1.0.9
-  resolution: "d3-path@npm:1.0.9"
-  checksum: d4382573baf9509a143f40944baeff9fead136926aed6872f7ead5b3555d68925f8a37935841dd51f1d70b65a294fe35c065b0906fb6e42109295f6598fc16d0
-  languageName: node
-  linkType: hard
-
 "d3-path@npm:^3.1.0":
   version: 3.1.0
   resolution: "d3-path@npm:3.1.0"
@@ -13026,67 +7381,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"d3-polygon@npm:1":
-  version: 1.0.6
-  resolution: "d3-polygon@npm:1.0.6"
-  checksum: 4a9764c2064d15e9f4fc9018c975f127540f6e701c18442e2a2e9339e743726f40e017d5213982d983cac3c23802321c257f2a10e686c803ec5533c6ff42bb7a
-  languageName: node
-  linkType: hard
-
-"d3-quadtree@npm:1":
-  version: 1.0.7
-  resolution: "d3-quadtree@npm:1.0.7"
-  checksum: 32181f578cbd69eed6b240073fed7f977f8039a121a3b9fc58ea1eea0c3c14d1237ef48cb4f80abb833063f8b0e7b885ef6de734e7bcc4e5b37e53ec444830f8
-  languageName: node
-  linkType: hard
-
-"d3-random@npm:1":
-  version: 1.1.2
-  resolution: "d3-random@npm:1.1.2"
-  checksum: a27326319fa61d59b6ce8d5ce7547cc823dee1bc6dda35e9c233d709f43f76488c09353862463c9c5da99081482b0f7ea4177d78721b67bb677bb12354bffe42
-  languageName: node
-  linkType: hard
-
-"d3-scale-chromatic@npm:1":
-  version: 1.5.0
-  resolution: "d3-scale-chromatic@npm:1.5.0"
-  dependencies:
-    d3-color: 1
-    d3-interpolate: 1
-  checksum: 3bff7717f6e6b309b3347d48d6532e2295037a280bc5174f908ce5fc0e17a9470f6b202e49499b01a17a1f28cb76a61aae870a6c13c57195a362847f33747501
-  languageName: node
-  linkType: hard
-
-"d3-scale@npm:2":
-  version: 2.2.2
-  resolution: "d3-scale@npm:2.2.2"
-  dependencies:
-    d3-array: ^1.2.0
-    d3-collection: 1
-    d3-format: 1
-    d3-interpolate: 1
-    d3-time: 1
-    d3-time-format: 2
-  checksum: 42086d4b9db9f8492a99dbbdacf546983faef1bb6260fe875c0c1884f1ca9cf5fd233de3702c2f9e24145b1c5383945e929c8682d80fa57ab515ef2c4f2c61f6
-  languageName: node
-  linkType: hard
-
-"d3-scale@npm:^1.0.7":
-  version: 1.0.7
-  resolution: "d3-scale@npm:1.0.7"
-  dependencies:
-    d3-array: ^1.2.0
-    d3-collection: 1
-    d3-color: 1
-    d3-format: 1
-    d3-interpolate: 1
-    d3-time: 1
-    d3-time-format: 2
-  checksum: c889c510aa0380b23e3a595be6b143b7053351ab6fe212918aa1ae80353a9ccde81064c2afa95dbdcd936fbb0c69dd560de291cbbea80d068a4390a3f67596aa
-  languageName: node
-  linkType: hard
-
-"d3-scale@npm:^4.0.2":
+"d3-scale@npm:^4.0.2, d3-scale@npm:~4.0.2":
   version: 4.0.2
   resolution: "d3-scale@npm:4.0.2"
   dependencies:
@@ -13099,33 +7394,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"d3-selection-multi@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "d3-selection-multi@npm:1.0.1"
-  dependencies:
-    d3-selection: 1
-    d3-transition: 1
-  checksum: 16d94d1dc5fc9a86302c613ad4f4e008beaae92bb22d6d1cee066c02efa35ba9795f9544c7465e129467e34611417fc3a082d5d7cc6ab1fd7c8404b83378555e
-  languageName: node
-  linkType: hard
-
-"d3-selection@npm:1, d3-selection@npm:^1.1.0, d3-selection@npm:^1.3.0":
-  version: 1.4.2
-  resolution: "d3-selection@npm:1.4.2"
-  checksum: 2484b392259b087a98f546f2610e6a11c90f38dae6b6b20a3fc85171038fcab4c72e702788b1960a4fece88bed2e36f268096358b5b48d3c7f0d35cfbe305da6
-  languageName: node
-  linkType: hard
-
-"d3-shape@npm:1":
-  version: 1.3.7
-  resolution: "d3-shape@npm:1.3.7"
-  dependencies:
-    d3-path: 1
-  checksum: 46566a3ab64a25023653bf59d64e81e9e6c987e95be985d81c5cedabae5838bd55f4a201a6b69069ca862eb63594cd263cac9034afc2b0e5664dfe286c866129
+"d3-selection@npm:~3.0.0":
+  version: 3.0.0
+  resolution: "d3-selection@npm:3.0.0"
+  checksum: f4e60e133309115b99f5b36a79ae0a19d71ee6e2d5e3c7216ef3e75ebd2cb1e778c2ed2fa4c01bef35e0dcbd96c5428f5bd6ca2184fe2957ed582fde6841cbc5
   languageName: node
   linkType: hard
 
-"d3-shape@npm:^3.1.0":
+"d3-shape@npm:^3.1.0, d3-shape@npm:~3.2.0":
   version: 3.2.0
   resolution: "d3-shape@npm:3.2.0"
   dependencies:
@@ -13143,22 +7419,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"d3-time-format@npm:2, d3-time-format@npm:^2.1.1":
-  version: 2.3.0
-  resolution: "d3-time-format@npm:2.3.0"
-  dependencies:
-    d3-time: 1
-  checksum: 5445eaaf2b3b2095cdc1fa75dfd2f361a61c39b677dcc1c2ba4cb6bc0442953de0fbaaa397d7d7a9325ad99c63d869f162a713e150e826ff8af482615664cb3f
-  languageName: node
-  linkType: hard
-
-"d3-time@npm:1":
-  version: 1.1.0
-  resolution: "d3-time@npm:1.1.0"
-  checksum: 33fcfff94ff093dde2048c190ecca8b39fe0ec8b3c61e9fc39c5f6072ce5b86dd2b91823f086366995422bbbac7f74fd9abdb7efe4f292a73b1c6197c699cc78
-  languageName: node
-  linkType: hard
-
 "d3-time@npm:1 - 3, d3-time@npm:2.1.1 - 3":
   version: 3.1.0
   resolution: "d3-time@npm:3.1.0"
@@ -13168,133 +7428,63 @@ __metadata:
   languageName: node
   linkType: hard
 
-"d3-timer@npm:1":
-  version: 1.0.10
-  resolution: "d3-timer@npm:1.0.10"
-  checksum: f7040953672deb2dfa03830ace80dbbcb212f80890218eba15dcca6f33f74102d943023ccc2a563295195cd8c63639bb2410ef1691c8fecff4a114fdf5c666f4
+"dag-map@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "dag-map@npm:2.0.2"
+  checksum: c15b70127c32b5f674ce43d17ee2268d757777df88883468550b946fdd29cee59c3faff1ec6d3ce05a4cb220a708426ac33b2f0a3bb6654541e7295e2d3a654a
   languageName: node
   linkType: hard
 
-"d3-tip@npm:^0.9.1":
-  version: 0.9.1
-  resolution: "d3-tip@npm:0.9.1"
+"data-view-buffer@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "data-view-buffer@npm:1.0.2"
   dependencies:
-    d3-collection: ^1.0.4
-    d3-selection: ^1.3.0
-  checksum: 876711ec01a049c6864dcdeab095d4c6d55554a862d426446ec03bf707a0d65dcc2e8cfee87bb0f922cdea33a350fb0be471afdeef5363accf7ac6cf61f02f31
+    call-bound: ^1.0.3
+    es-errors: ^1.3.0
+    is-data-view: ^1.0.2
+  checksum: 1e1cd509c3037ac0f8ba320da3d1f8bf1a9f09b0be09394b5e40781b8cc15ff9834967ba7c9f843a425b34f9fe14ce44cf055af6662c44263424c1eb8d65659b
   languageName: node
   linkType: hard
 
-"d3-transition@npm:1, d3-transition@npm:^1.2.0":
-  version: 1.3.2
-  resolution: "d3-transition@npm:1.3.2"
+"data-view-byte-length@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "data-view-byte-length@npm:1.0.2"
   dependencies:
-    d3-color: 1
-    d3-dispatch: 1
-    d3-ease: 1
-    d3-interpolate: 1
-    d3-selection: ^1.1.0
-    d3-timer: 1
-  checksum: 1b4a0cfa7aeb4033ab20e26a310488cfac989de44c6c2bf10e9f0808af915a33add6dca23fbafcefe8c08613fd0d6a933e48b4de24c0779163c2852a1c7c16f4
-  languageName: node
-  linkType: hard
-
-"d3-voronoi@npm:1":
-  version: 1.1.4
-  resolution: "d3-voronoi@npm:1.1.4"
-  checksum: d28a74bc62f2b936b0d3b51d5be8d2366afca4fd7026d7ee8f655600650bf0c985da38a8c3ae46bfa315b5f524f3ca1c5211437cf1c8c737cc1da681e015baee
-  languageName: node
-  linkType: hard
-
-"d3-zoom@npm:1":
-  version: 1.8.3
-  resolution: "d3-zoom@npm:1.8.3"
-  dependencies:
-    d3-dispatch: 1
-    d3-drag: 1
-    d3-interpolate: 1
-    d3-selection: 1
-    d3-transition: 1
-  checksum: de408e5dc6df1481ef6854a3d495f8e963dbf5b0de41bcbd35def0602abda55b3f2c1fa751c75c2f0a9bafd3b278f30795c27503fe609b3dbe06a0720d01d5be
-  languageName: node
-  linkType: hard
-
-"d3@npm:^5.0.0":
-  version: 5.16.0
-  resolution: "d3@npm:5.16.0"
-  dependencies:
-    d3-array: 1
-    d3-axis: 1
-    d3-brush: 1
-    d3-chord: 1
-    d3-collection: 1
-    d3-color: 1
-    d3-contour: 1
-    d3-dispatch: 1
-    d3-drag: 1
-    d3-dsv: 1
-    d3-ease: 1
-    d3-fetch: 1
-    d3-force: 1
-    d3-format: 1
-    d3-geo: 1
-    d3-hierarchy: 1
-    d3-interpolate: 1
-    d3-path: 1
-    d3-polygon: 1
-    d3-quadtree: 1
-    d3-random: 1
-    d3-scale: 2
-    d3-scale-chromatic: 1
-    d3-selection: 1
-    d3-shape: 1
-    d3-time: 1
-    d3-time-format: 2
-    d3-timer: 1
-    d3-transition: 1
-    d3-voronoi: 1
-    d3-zoom: 1
-  checksum: 1462789c421c3ea3930a18b91be6c02c7b976fa4d714200ee2a042c62cbfb349448c79f1ae3dbaf186f79edb734b7aa7b734ee6ad61d81ab4305e6663623ab8e
+    call-bound: ^1.0.3
+    es-errors: ^1.3.0
+    is-data-view: ^1.0.2
+  checksum: 3600c91ced1cfa935f19ef2abae11029e01738de8d229354d3b2a172bf0d7e4ed08ff8f53294b715569fdf72dfeaa96aa7652f479c0f60570878d88e7e8bddf6
   languageName: node
   linkType: hard
 
-"dag-map@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "dag-map@npm:2.0.2"
-  checksum: c15b70127c32b5f674ce43d17ee2268d757777df88883468550b946fdd29cee59c3faff1ec6d3ce05a4cb220a708426ac33b2f0a3bb6654541e7295e2d3a654a
-  languageName: node
-  linkType: hard
-
-"dashdash@npm:^1.12.0":
-  version: 1.14.1
-  resolution: "dashdash@npm:1.14.1"
+"data-view-byte-offset@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "data-view-byte-offset@npm:1.0.1"
   dependencies:
-    assert-plus: ^1.0.0
-  checksum: 3634c249570f7f34e3d34f866c93f866c5b417f0dd616275decae08147dcdf8fccfaa5947380ccfb0473998ea3a8057c0b4cd90c875740ee685d0624b2983598
+    call-bound: ^1.0.2
+    es-errors: ^1.3.0
+    is-data-view: ^1.0.1
+  checksum: 8dd492cd51d19970876626b5b5169fbb67ca31ec1d1d3238ee6a71820ca8b80cafb141c485999db1ee1ef02f2cc3b99424c5eda8d59e852d9ebb79ab290eb5ee
   languageName: node
   linkType: hard
 
-"data-urls@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "data-urls@npm:2.0.0"
-  dependencies:
-    abab: ^2.0.3
-    whatwg-mimetype: ^2.3.0
-    whatwg-url: ^8.0.0
-  checksum: 97caf828aac25e25e04ba6869db0f99c75e6859bb5b424ada28d3e7841941ebf08ddff3c1b1bb4585986bd507a5d54c2a716853ea6cb98af877400e637393e71
+"date-fns-tz@npm:~1.3.8":
+  version: 1.3.8
+  resolution: "date-fns-tz@npm:1.3.8"
+  peerDependencies:
+    date-fns: ">=2.0.0"
+  checksum: dbf17cb88de7c7b71a9f86b815ac62ebdbf725c030e78d2421309456b5001a85284a5b6763f4af0ba660183f12e876c165e725a0723f642edb7846407db03133
   languageName: node
   linkType: hard
 
-"date-fns-tz@npm:^1.2.2":
-  version: 1.2.2
-  resolution: "date-fns-tz@npm:1.2.2"
-  peerDependencies:
-    date-fns: ">=2.0.0"
-  checksum: 90c5145499570736cd004cfb13f8a9bbc9de514ceb92224ccd6fd2e0d88e0d55ab1d4e279500653d2df7cca0002c88a1ce0768c8531cbf6063cce91a1e4e78d4
+"date-fns@npm:^3.6.0":
+  version: 3.6.0
+  resolution: "date-fns@npm:3.6.0"
+  checksum: 0daa1e9a436cf99f9f2ae9232b55e11f3dd46132bee10987164f3eebd29f245b2e066d7d7db40782627411ecf18551d8f4c9fcdf2226e48bb66545407d448ab7
   languageName: node
   linkType: hard
 
-"date-fns@npm:^2.29.2, date-fns@npm:^2.30.0":
+"date-fns@npm:~2.30.0":
   version: 2.30.0
   resolution: "date-fns@npm:2.30.0"
   dependencies:
@@ -13303,16 +7493,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"date-time@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "date-time@npm:2.1.0"
-  dependencies:
-    time-zone: ^1.0.0
-  checksum: 3eefeb2954b8a5a8a01f7935ef4b53f948eeecd6105f652cbeafec384cf80924247797e51eb517af1e18b356d2c94561ac0a29a60d8ba56c88376bd5b5a08c3c
-  languageName: node
-  linkType: hard
-
-"debug@npm:2.6.9, debug@npm:^2.1.0, debug@npm:^2.1.1, debug@npm:^2.1.3, debug@npm:^2.2.0, debug@npm:^2.3.3, debug@npm:^2.6.8, debug@npm:^2.6.9":
+"debug@npm:2.6.9, debug@npm:^2.1.1, debug@npm:^2.1.3, debug@npm:^2.2.0, debug@npm:^2.6.8":
   version: 2.6.9
   resolution: "debug@npm:2.6.9"
   dependencies:
@@ -13321,19 +7502,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"debug@npm:4, debug@npm:^4.3.2, debug@npm:^4.3.3, debug@npm:^4.3.4, debug@npm:~4.3.1, debug@npm:~4.3.2":
-  version: 4.3.4
-  resolution: "debug@npm:4.3.4"
-  dependencies:
-    ms: 2.1.2
-  peerDependenciesMeta:
-    supports-color:
-      optional: true
-  checksum: 3dbad3f94ea64f34431a9cbf0bafb61853eda57bff2880036153438f50fb5a84f27683ba0d8e5426bf41a8c6ff03879488120cf5b3a761e77953169c0600a708
-  languageName: node
-  linkType: hard
-
-"debug@npm:^3.0.1, debug@npm:^3.1.0, debug@npm:^3.2.7":
+"debug@npm:^3.0.1, debug@npm:^3.1.0":
   version: 3.2.7
   resolution: "debug@npm:3.2.7"
   dependencies:
@@ -13342,184 +7511,108 @@ __metadata:
   languageName: node
   linkType: hard
 
-"debug@npm:^4.0.0, debug@npm:^4.1.0, debug@npm:^4.1.1, debug@npm:^4.3.1":
-  version: 4.3.3
-  resolution: "debug@npm:4.3.3"
+"debug@npm:^4.0.0, debug@npm:^4.1.0, debug@npm:^4.1.1, debug@npm:^4.2.0, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.3, debug@npm:^4.3.4, debug@npm:^4.3.6, debug@npm:^4.3.7, debug@npm:^4.4.0":
+  version: 4.4.1
+  resolution: "debug@npm:4.4.1"
   dependencies:
-    ms: 2.1.2
+    ms: ^2.1.3
   peerDependenciesMeta:
     supports-color:
       optional: true
-  checksum: 14472d56fe4a94dbcfaa6dbed2dd3849f1d72ba78104a1a328047bb564643ca49df0224c3a17fa63533fd11dd3d4c8636cd861191232a2c6735af00cc2d4de16
+  checksum: a43826a01cda685ee4cec00fb2d3322eaa90ccadbef60d9287debc2a886be3e835d9199c80070ede75a409ee57828c4c6cd80e4b154f2843f0dc95a570dc0729
   languageName: node
   linkType: hard
 
-"debug@npm:^4.2.0":
-  version: 4.3.1
-  resolution: "debug@npm:4.3.1"
+"debug@npm:~4.3.1, debug@npm:~4.3.2, debug@npm:~4.3.4":
+  version: 4.3.7
+  resolution: "debug@npm:4.3.7"
   dependencies:
-    ms: 2.1.2
+    ms: ^2.1.3
   peerDependenciesMeta:
     supports-color:
       optional: true
-  checksum: 2c3352e37d5c46b0d203317cd45ea0e26b2c99f2d9dfec8b128e6ceba90dfb65425f5331bf3020fe9929d7da8c16758e737f4f3bfc0fce6b8b3d503bae03298b
+  checksum: 822d74e209cd910ef0802d261b150314bbcf36c582ccdbb3e70f0894823c17e49a50d3e66d96b633524263975ca16b6a833f3e3b7e030c157169a5fabac63160
   languageName: node
   linkType: hard
 
 "decache@npm:^4.5.1":
-  version: 4.6.0
-  resolution: "decache@npm:4.6.0"
+  version: 4.6.2
+  resolution: "decache@npm:4.6.2"
   dependencies:
     callsite: ^1.0.0
-  checksum: 65bd86440a84aeb7cf76a8dbd22d207e561eac621bc73500347a9a0802f14e72222fd794b4b778a419e3d736a01ec263124e1ba39db6778c3b86a42f487a279c
-  languageName: node
-  linkType: hard
-
-"decamelize-keys@npm:^1.1.0":
-  version: 1.1.1
-  resolution: "decamelize-keys@npm:1.1.1"
-  dependencies:
-    decamelize: ^1.1.0
-    map-obj: ^1.0.0
-  checksum: fc645fe20b7bda2680bbf9481a3477257a7f9304b1691036092b97ab04c0ab53e3bf9fcc2d2ae382536568e402ec41fb11e1d4c3836a9abe2d813dd9ef4311e0
+  checksum: e88d0c5b27266d3dcab96aed5c34c02551cea4b5ec4df452a07ea89b35426e63053ba5f07d6837ecb958f7ebfea5adaa12c353da7b2f242f89cdef1aa3ba30c2
   languageName: node
   linkType: hard
 
-"decamelize@npm:^1.1.0, decamelize@npm:^1.2.0":
+"decamelize@npm:^1.2.0":
   version: 1.2.0
   resolution: "decamelize@npm:1.2.0"
   checksum: ad8c51a7e7e0720c70ec2eeb1163b66da03e7616d7b98c9ef43cce2416395e84c1e9548dd94f5f6ffecfee9f8b94251fc57121a8b021f2ff2469b2bae247b8aa
   languageName: node
   linkType: hard
 
-"decamelize@npm:^5.0.0":
-  version: 5.0.1
-  resolution: "decamelize@npm:5.0.1"
-  checksum: 7c3b1ed4b3e60e7fbc00a35fb248298527c1cdfe603e41dfcf05e6c4a8cb9efbee60630deb677ed428908fb4e74e322966c687a094d1478ddc9c3a74e9dc7140
-  languageName: node
-  linkType: hard
-
-"decimal.js@npm:^10.2.1":
-  version: 10.2.1
-  resolution: "decimal.js@npm:10.2.1"
-  checksum: d2421adf209422d520c8f1a4d1fceffc2ccd0c041aa179f8d18a315ebda6a7be918f2634ac850df299dccccae6a3567c5761301a1c3693461fdef3d1de23b000
-  languageName: node
-  linkType: hard
-
-"decode-uri-component@npm:^0.2.0":
-  version: 0.2.0
-  resolution: "decode-uri-component@npm:0.2.0"
-  checksum: f3749344ab9305ffcfe4bfe300e2dbb61fc6359e2b736812100a3b1b6db0a5668cba31a05e4b45d4d63dbf1a18dfa354cd3ca5bb3ededddabb8cd293f4404f94
-  languageName: node
-  linkType: hard
-
-"dedent@npm:^0.7.0":
-  version: 0.7.0
-  resolution: "dedent@npm:0.7.0"
-  checksum: 87de191050d9a40dd70cad01159a0bcf05ecb59750951242070b6abf9569088684880d00ba92a955b4058804f16eeaf91d604f283929b4f614d181cd7ae633d2
+"decorator-transforms@npm:^1.0.1":
+  version: 1.2.1
+  resolution: "decorator-transforms@npm:1.2.1"
+  dependencies:
+    "@babel/plugin-syntax-decorators": ^7.23.3
+    babel-import-util: ^2.0.1
+  checksum: af060a1258bd138a5c0da197378c57bbc48076cfde51cbc2f2186a243634ec5f0ea827b540b7365faaaa2593ea1670dc1f531ba0a7131ad97edb80a7502fdaec
   languageName: node
   linkType: hard
 
-"deep-equal@npm:^2.0.5":
-  version: 2.2.1
-  resolution: "deep-equal@npm:2.2.1"
-  dependencies:
-    array-buffer-byte-length: ^1.0.0
-    call-bind: ^1.0.2
-    es-get-iterator: ^1.1.3
-    get-intrinsic: ^1.2.0
-    is-arguments: ^1.1.1
-    is-array-buffer: ^3.0.2
-    is-date-object: ^1.0.5
-    is-regex: ^1.1.4
-    is-shared-array-buffer: ^1.0.2
-    isarray: ^2.0.5
-    object-is: ^1.1.5
-    object-keys: ^1.1.1
-    object.assign: ^4.1.4
-    regexp.prototype.flags: ^1.5.0
-    side-channel: ^1.0.4
-    which-boxed-primitive: ^1.0.2
-    which-collection: ^1.0.1
-    which-typed-array: ^1.1.9
-  checksum: 561f0e001a07b2f1b80ff914d0b3d76964bbfc102f34c2128bc8039c0050e63b1a504a8911910e011d8cd1cd4b600a9686c049e327f4ef94420008efc42d25f4
+"decorator-transforms@npm:^2.0.0, decorator-transforms@npm:^2.3.0":
+  version: 2.3.0
+  resolution: "decorator-transforms@npm:2.3.0"
+  dependencies:
+    "@babel/plugin-syntax-decorators": ^7.23.3
+    babel-import-util: ^3.0.0
+  checksum: 00f9755366cede42cdb41e177e134492d24edbda624aadac28057c10480e7b2c4b3b6a8b362c8aac7e595f64b01c2e2264f8ca779f1d12677391e86fee3f51c6
   languageName: node
   linkType: hard
 
-"deep-is@npm:^0.1.3, deep-is@npm:~0.1.3":
-  version: 0.1.3
-  resolution: "deep-is@npm:0.1.3"
-  checksum: c15b04c3848a89880c94e25b077c19b47d9a30dd99048e70e5f95d943e7b246bee1da0c1376b56b01bc045be2cae7d9b1c856e68e47e9805634327de7c6cb6d5
+"deep-extend@npm:~0.6.0":
+  version: 0.6.0
+  resolution: "deep-extend@npm:0.6.0"
+  checksum: 7be7e5a8d468d6b10e6a67c3de828f55001b6eb515d014f7aeb9066ce36bd5717161eb47d6a0f7bed8a9083935b465bc163ee2581c8b128d29bf61092fdf57a7
   languageName: node
   linkType: hard
 
-"deepmerge@npm:^4.0.0":
-  version: 4.2.2
-  resolution: "deepmerge@npm:4.2.2"
-  checksum: a8c43a1ed8d6d1ed2b5bf569fa4c8eb9f0924034baf75d5d406e47e157a451075c4db353efea7b6bcc56ec48116a8ce72fccf867b6e078e7c561904b5897530b
+"deep-is@npm:^0.1.3":
+  version: 0.1.4
+  resolution: "deep-is@npm:0.1.4"
+  checksum: edb65dd0d7d1b9c40b2f50219aef30e116cedd6fc79290e740972c132c09106d2e80aa0bc8826673dd5a00222d4179c84b36a790eef63a4c4bca75a37ef90804
   languageName: node
   linkType: hard
 
 "defaults@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "defaults@npm:1.0.3"
+  version: 1.0.4
+  resolution: "defaults@npm:1.0.4"
   dependencies:
     clone: ^1.0.2
-  checksum: 96e2112da6553d376afd5265ea7cbdb2a3b45535965d71ab8bb1da10c8126d168fdd5268799625324b368356d21ba2a7b3d4ec50961f11a47b7feb9de3d4413e
+  checksum: 3a88b7a587fc076b84e60affad8b85245c01f60f38fc1d259e7ac1d89eb9ce6abb19e27215de46b98568dd5bc48471730b327637e6f20b0f1bc85cf00440c80a
   languageName: node
   linkType: hard
 
-"define-properties@npm:^1.1.3":
-  version: 1.1.3
-  resolution: "define-properties@npm:1.1.3"
+"define-data-property@npm:^1.0.1, define-data-property@npm:^1.1.4":
+  version: 1.1.4
+  resolution: "define-data-property@npm:1.1.4"
   dependencies:
-    object-keys: ^1.0.12
-  checksum: da80dba55d0cd76a5a7ab71ef6ea0ebcb7b941f803793e4e0257b384cb772038faa0c31659d244e82c4342edef841c1a1212580006a05a5068ee48223d787317
+    es-define-property: ^1.0.0
+    es-errors: ^1.3.0
+    gopd: ^1.0.1
+  checksum: 8068ee6cab694d409ac25936eb861eea704b7763f7f342adbdfe337fc27c78d7ae0eff2364b2917b58c508d723c7a074326d068eef2e45c4edcd85cf94d0313b
   languageName: node
   linkType: hard
 
-"define-properties@npm:^1.1.4, define-properties@npm:^1.2.0":
-  version: 1.2.0
-  resolution: "define-properties@npm:1.2.0"
+"define-properties@npm:^1.2.1":
+  version: 1.2.1
+  resolution: "define-properties@npm:1.2.1"
   dependencies:
+    define-data-property: ^1.0.1
     has-property-descriptors: ^1.0.0
     object-keys: ^1.1.1
-  checksum: e60aee6a19b102df4e2b1f301816804e81ab48bb91f00d0d935f269bf4b3f79c88b39e4f89eaa132890d23267335fd1140dfcd8d5ccd61031a0a2c41a54e33a6
-  languageName: node
-  linkType: hard
-
-"define-property@npm:^0.2.5":
-  version: 0.2.5
-  resolution: "define-property@npm:0.2.5"
-  dependencies:
-    is-descriptor: ^0.1.0
-  checksum: 85af107072b04973b13f9e4128ab74ddfda48ec7ad2e54b193c0ffb57067c4ce5b7786a7b4ae1f24bd03e87c5d18766b094571810b314d7540f86d4354dbd394
-  languageName: node
-  linkType: hard
-
-"define-property@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "define-property@npm:1.0.0"
-  dependencies:
-    is-descriptor: ^1.0.0
-  checksum: 5fbed11dace44dd22914035ba9ae83ad06008532ca814d7936a53a09e897838acdad5b108dd0688cc8d2a7cf0681acbe00ee4136cf36743f680d10517379350a
-  languageName: node
-  linkType: hard
-
-"define-property@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "define-property@npm:2.0.2"
-  dependencies:
-    is-descriptor: ^1.0.2
-    isobject: ^3.0.1
-  checksum: 3217ed53fc9eed06ba8da6f4d33e28c68a82e2f2a8ab4d562c4920d8169a166fe7271453675e6c69301466f36a65d7f47edf0cf7f474b9aa52a5ead9c1b13c99
-  languageName: node
-  linkType: hard
-
-"delayed-stream@npm:~1.0.0":
-  version: 1.0.0
-  resolution: "delayed-stream@npm:1.0.0"
-  checksum: 46fe6e83e2cb1d85ba50bd52803c68be9bd953282fa7096f51fc29edd5d67ff84ff753c51966061e5ba7cb5e47ef6d36a91924eddb7f3f3483b1c560f77a0020
+  checksum: b4ccd00597dd46cb2d4a379398f5b19fca84a16f3374e2249201992f36b30f6835949a9429669ee6b41b6e837205a163eadd745e472069e70dfc10f03e5fcc12
   languageName: node
   linkType: hard
 
@@ -13530,7 +7623,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"depd@npm:2.0.0, depd@npm:^2.0.0, depd@npm:~2.0.0":
+"depd@npm:2.0.0, depd@npm:~2.0.0":
   version: 2.0.0
   resolution: "depd@npm:2.0.0"
   checksum: abbe19c768c97ee2eed6282d8ce3031126662252c58d711f646921c9623f9052e3e1906443066beec1095832f534e57c523b7333f8e7e0d93051ab6baef5ab3a
@@ -13544,16 +7637,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"des.js@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "des.js@npm:1.0.1"
-  dependencies:
-    inherits: ^2.0.1
-    minimalistic-assert: ^1.0.0
-  checksum: 1ec2eedd7ed6bd61dd5e0519fd4c96124e93bb22de8a9d211b02d63e5dd152824853d919bb2090f965cc0e3eb9c515950a9836b332020d810f9c71feb0fd7df4
-  languageName: node
-  linkType: hard
-
 "destroy@npm:1.2.0":
   version: 1.2.0
   resolution: "destroy@npm:1.2.0"
@@ -13561,13 +7644,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"destroy@npm:~1.0.4":
-  version: 1.0.4
-  resolution: "destroy@npm:1.0.4"
-  checksum: da9ab4961dc61677c709da0c25ef01733042614453924d65636a7db37308fef8a24cd1e07172e61173d471ca175371295fbc984b0af5b2b4ff47cd57bd784c03
-  languageName: node
-  linkType: hard
-
 "detect-file@npm:^1.0.0":
   version: 1.0.0
   resolution: "detect-file@npm:1.0.0"
@@ -13575,19 +7651,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"detect-indent@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "detect-indent@npm:4.0.0"
-  dependencies:
-    repeating: ^2.0.0
-  checksum: 328f273915c1610899bc7d4784ce874413d0a698346364cd3ee5d79afba1c5cf4dbc97b85a801e20f4d903c0598bd5096af32b800dfb8696b81464ccb3dfda2c
+"detect-indent@npm:^6.0.0":
+  version: 6.1.0
+  resolution: "detect-indent@npm:6.1.0"
+  checksum: ab953a73c72dbd4e8fc68e4ed4bfd92c97eb6c43734af3900add963fd3a9316f3bc0578b018b24198d4c31a358571eff5f0656e81a1f3b9ad5c547d58b2d093d
   languageName: node
   linkType: hard
 
-"detect-indent@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "detect-indent@npm:6.0.0"
-  checksum: 0c38f362016e2d07af1c65b1ecd6ad8a91f06bfdd11383887c867a495ad286d04be2ab44027ac42444704d523982013115bd748c1541df7c9396ad76b22aaf5d
+"detect-libc@npm:^1.0.3":
+  version: 1.0.3
+  resolution: "detect-libc@npm:1.0.3"
+  bin:
+    detect-libc: ./bin/detect-libc.js
+  checksum: daaaed925ffa7889bd91d56e9624e6c8033911bb60f3a50a74a87500680652969dbaab9526d1e200a4c94acf80fc862a22131841145a0a8482d60a99c24f4a3e
   languageName: node
   linkType: hard
 
@@ -13598,42 +7674,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"dialog-polyfill@npm:^0.5.6":
-  version: 0.5.6
-  resolution: "dialog-polyfill@npm:0.5.6"
-  checksum: dde8d4b6a62b63b710e0d0d70b615d92ff08f3cb2b521e1f99b17e8220d9d55d0fdf9fc17fbe77b0ff1be817094e14b60c4c4bacd5456fba427ede48d2d90230
-  languageName: node
-  linkType: hard
-
-"diff-match-patch@npm:^1.0.0":
-  version: 1.0.5
-  resolution: "diff-match-patch@npm:1.0.5"
-  checksum: 841522d01b09cccbc4e4402cf61514a81b906349a7d97b67222390f2d35cf5df277cb23959eeed212d5e46afb5629cebab41b87918672c5a05c11c73688630e3
-  languageName: node
-  linkType: hard
-
-"diff@npm:^3.5.0":
-  version: 3.5.0
-  resolution: "diff@npm:3.5.0"
-  checksum: 00842950a6551e26ce495bdbce11047e31667deea546527902661f25cc2e73358967ebc78cf86b1a9736ec3e14286433225f9970678155753a6291c3bca5227b
-  languageName: node
-  linkType: hard
-
 "diff@npm:^5.1.0":
-  version: 5.1.0
-  resolution: "diff@npm:5.1.0"
-  checksum: c7bf0df7c9bfbe1cf8a678fd1b2137c4fb11be117a67bc18a0e03ae75105e8533dbfb1cda6b46beb3586ef5aed22143ef9d70713977d5fb1f9114e21455fba90
+  version: 5.2.0
+  resolution: "diff@npm:5.2.0"
+  checksum: 12b63ca9c36c72bafa3effa77121f0581b4015df18bc16bac1f8e263597735649f1a173c26f7eba17fb4162b073fee61788abe49610e6c70a2641fe1895443fd
   languageName: node
   linkType: hard
 
-"diffie-hellman@npm:^5.0.0":
-  version: 5.0.3
-  resolution: "diffie-hellman@npm:5.0.3"
-  dependencies:
-    bn.js: ^4.1.0
-    miller-rabin: ^4.0.0
-    randombytes: ^2.0.0
-  checksum: 0e620f322170c41076e70181dd1c24e23b08b47dbb92a22a644f3b89b6d3834b0f8ee19e37916164e5eb1ee26d2aa836d6129f92723995267250a0b541811065
+"diff@npm:^7.0.0":
+  version: 7.0.0
+  resolution: "diff@npm:7.0.0"
+  checksum: 5db0d339476b18dfbc8a08a7504fbcc74789eec626c8d20cf2cdd1871f1448962888128f4447c8f50a1e41a80decfe5e8489c375843b8cf1d42b7c2b611da4e1
   languageName: node
   linkType: hard
 
@@ -13653,19 +7704,39 @@ __metadata:
   languageName: node
   linkType: hard
 
-"doctoc@npm:^2.2.0":
-  version: 2.2.0
-  resolution: "doctoc@npm:2.2.0"
+"dmd@npm:^6.2.3":
+  version: 6.2.3
+  resolution: "dmd@npm:6.2.3"
+  dependencies:
+    array-back: ^6.2.2
+    cache-point: ^2.0.0
+    common-sequence: ^2.0.2
+    file-set: ^4.0.2
+    handlebars: ^4.7.8
+    marked: ^4.3.0
+    object-get: ^2.1.1
+    reduce-flatten: ^3.0.1
+    reduce-unique: ^2.0.1
+    reduce-without: ^1.0.1
+    test-value: ^3.0.0
+    walk-back: ^5.1.0
+  checksum: e3cdb5731361ab2b20eb1bb4476a50158c90ae35d46868d48ab50e31f60c2510fe57c120eed2fc0225d7863b5d80c18dcf7bc363cfbf05ae4b3bdb83c5c471b0
+  languageName: node
+  linkType: hard
+
+"doctoc@npm:~2.2.1":
+  version: 2.2.1
+  resolution: "doctoc@npm:2.2.1"
   dependencies:
     "@textlint/markdown-to-ast": ^12.1.1
-    anchor-markdown-header: ^0.5.7
+    anchor-markdown-header: ^0.6.0
     htmlparser2: ^7.2.0
     minimist: ^1.2.6
     underscore: ^1.13.2
     update-section: ^0.3.3
   bin:
     doctoc: doctoc.js
-  checksum: 78973a1275f056c044263d60546cf518beb15b79bd95a93dc5875d6dd46fa0873568661d74830b68e908c8a4465e9fd602eb49468e4d686e43ce4471d34012c3
+  checksum: 0643c5170fa8c5ec53bde585090c4c140f69eb498fea7d4d4a6a15455bff8b1d04632dcaec8909d2b3719a5f54760947f274aec99f4322fe098bce0c7fb30a0d
   languageName: node
   linkType: hard
 
@@ -13677,14 +7748,11 @@ __metadata:
   checksum: fd7673ca77fe26cd5cba38d816bc72d641f500f1f9b25b83e8ce28827fe2da7ad583a8da26ab6af85f834138cf8dae9f69b0cd6ab925f52ddab1754db44d99ce
   languageName: node
   linkType: hard
-
-"dom-serializer@npm:0":
-  version: 0.2.2
-  resolution: "dom-serializer@npm:0.2.2"
-  dependencies:
-    domelementtype: ^2.0.1
-    entities: ^2.0.0
-  checksum: 376344893e4feccab649a14ca1a46473e9961f40fe62479ea692d4fee4d9df1c00ca8654811a79c1ca7b020096987e1ca4fb4d7f8bae32c1db800a680a0e5d5e
+
+"dom-element-descriptors@npm:^0.5.0, dom-element-descriptors@npm:^0.5.1":
+  version: 0.5.1
+  resolution: "dom-element-descriptors@npm:0.5.1"
+  checksum: 19449c67de81ceffca094b9034f8876b6a17bb4d1149febb373dfd71457115e21317bbe23e2693d8f912632fa989a4cf8fcf8ac77594751bc179b35f45ef916e
   languageName: node
   linkType: hard
 
@@ -13699,47 +7767,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"dom-serializer@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "dom-serializer@npm:2.0.0"
-  dependencies:
-    domelementtype: ^2.3.0
-    domhandler: ^5.0.2
-    entities: ^4.2.0
-  checksum: cd1810544fd8cdfbd51fa2c0c1128ec3a13ba92f14e61b7650b5de421b88205fd2e3f0cc6ace82f13334114addb90ed1c2f23074a51770a8e9c1273acbc7f3e6
-  languageName: node
-  linkType: hard
-
-"domain-browser@npm:^1.1.1":
-  version: 1.2.0
-  resolution: "domain-browser@npm:1.2.0"
-  checksum: 8f1235c7f49326fb762f4675795246a6295e7dd566b4697abec24afdba2460daa7dfbd1a73d31efbf5606b3b7deadb06ce47cf06f0a476e706153d62a4ff2b90
-  languageName: node
-  linkType: hard
-
-"domelementtype@npm:1":
-  version: 1.3.1
-  resolution: "domelementtype@npm:1.3.1"
-  checksum: 7893da40218ae2106ec6ffc146b17f203487a52f5228b032ea7aa470e41dfe03e1bd762d0ee0139e792195efda765434b04b43cddcf63207b098f6ae44b36ad6
-  languageName: node
-  linkType: hard
-
-"domelementtype@npm:^2.0.1, domelementtype@npm:^2.2.0, domelementtype@npm:^2.3.0":
+"domelementtype@npm:^2.0.1, domelementtype@npm:^2.2.0":
   version: 2.3.0
   resolution: "domelementtype@npm:2.3.0"
   checksum: ee837a318ff702622f383409d1f5b25dd1024b692ef64d3096ff702e26339f8e345820f29a68bcdcea8cfee3531776b3382651232fbeae95612d6f0a75efb4f6
   languageName: node
   linkType: hard
 
-"domexception@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "domexception@npm:2.0.1"
-  dependencies:
-    webidl-conversions: ^5.0.0
-  checksum: d638e9cb05c52999f1b2eb87c374b03311ea5b1d69c2f875bc92da73e17db60c12142b45c950228642ff7f845c536b65305483350d080df59003a653da80b691
-  languageName: node
-  linkType: hard
-
 "domhandler@npm:^4.2.0, domhandler@npm:^4.2.2":
   version: 4.3.1
   resolution: "domhandler@npm:4.3.1"
@@ -13749,29 +7783,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"domhandler@npm:^5.0.1, domhandler@npm:^5.0.2, domhandler@npm:^5.0.3":
-  version: 5.0.3
-  resolution: "domhandler@npm:5.0.3"
-  dependencies:
-    domelementtype: ^2.3.0
-  checksum: 0f58f4a6af63e6f3a4320aa446d28b5790a009018707bce2859dcb1d21144c7876482b5188395a188dfa974238c019e0a1e610d2fc269a12b2c192ea2b0b131c
-  languageName: node
-  linkType: hard
-
-"dompurify@npm:^3.0.2":
-  version: 3.0.2
-  resolution: "dompurify@npm:3.0.2"
-  checksum: 768c3bb2f139ce1e1a53faf81aae6abe03e24d0b043e2fda0b70e91ef15bb1df854a35e82d8c519adfe5b81c24bfdad3e0b1085534bfbf427137cb742406c47f
-  languageName: node
-  linkType: hard
-
-"domutils@npm:^1.7.0":
-  version: 1.7.0
-  resolution: "domutils@npm:1.7.0"
+"dompurify@npm:~3.2.5":
+  version: 3.2.6
+  resolution: "dompurify@npm:3.2.6"
   dependencies:
-    dom-serializer: 0
-    domelementtype: 1
-  checksum: f60a725b1f73c1ae82f4894b691601ecc6ecb68320d87923ac3633137627c7865725af813ae5d188ad3954283853bcf46779eb50304ec5d5354044569fcefd2b
+    "@types/trusted-types": ^2.0.7
+  dependenciesMeta:
+    "@types/trusted-types":
+      optional: true
+  checksum: 4d002997dbae13f6bdf0e6be014384129c83b1ee8cd3fca9d96f95b9142d1e96256924466a2fc25e7ffb6ede54290e5c4a7d1bd10f9b14cfa07928dd799c3b42
   languageName: node
   linkType: hard
 
@@ -13786,17 +7806,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"domutils@npm:^3.0.1":
-  version: 3.0.1
-  resolution: "domutils@npm:3.0.1"
-  dependencies:
-    dom-serializer: ^2.0.0
-    domelementtype: ^2.3.0
-    domhandler: ^5.0.1
-  checksum: 23aa7a840572d395220e173cb6263b0d028596e3950100520870a125af33ff819e6f609e1606d6f7d73bd9e7feb03bb404286e57a39063b5384c62b724d987b3
-  languageName: node
-  linkType: hard
-
 "dot-case@npm:^3.0.4":
   version: 3.0.4
   resolution: "dot-case@npm:3.0.4"
@@ -13816,15 +7825,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"duplexify@npm:^3.4.2, duplexify@npm:^3.6.0":
-  version: 3.7.1
-  resolution: "duplexify@npm:3.7.1"
+"dunder-proto@npm:^1.0.0, dunder-proto@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "dunder-proto@npm:1.0.1"
   dependencies:
-    end-of-stream: ^1.0.0
-    inherits: ^2.0.1
-    readable-stream: ^2.0.0
-    stream-shift: ^1.0.0
-  checksum: 3c2ed2223d956a5da713dae12ba8295acb61d9acd966ccbba938090d04f4574ca4dca75cca089b5077c2d7e66101f32e6ea9b36a78ca213eff574e7a8b8accf2
+    call-bind-apply-helpers: ^1.0.1
+    es-errors: ^1.3.0
+    gopd: ^1.2.0
+  checksum: 149207e36f07bd4941921b0ca929e3a28f1da7bd6b6ff8ff7f4e2f2e460675af4576eeba359c635723dc189b64cdd4787e0255897d5b135ccc5d15cb8685fc90
   languageName: node
   linkType: hard
 
@@ -13835,16 +7843,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ecc-jsbn@npm:~0.1.1":
-  version: 0.1.2
-  resolution: "ecc-jsbn@npm:0.1.2"
-  dependencies:
-    jsbn: ~0.1.0
-    safer-buffer: ^2.1.0
-  checksum: 22fef4b6203e5f31d425f5b711eb389e4c6c2723402e389af394f8411b76a488fa414d309d866e2b577ce3e8462d344205545c88a8143cc21752a5172818888a
-  languageName: node
-  linkType: hard
-
 "editions@npm:^1.1.1":
   version: 1.3.4
   resolution: "editions@npm:1.3.4"
@@ -13869,117 +7867,46 @@ __metadata:
   languageName: node
   linkType: hard
 
-"electron-to-chromium@npm:^1.3.30":
-  version: 1.3.725
-  resolution: "electron-to-chromium@npm:1.3.725"
-  checksum: 90801f5cc30f76495412ce86cef141cd22924ec75c88c276eaa42435d09370d9df5d8127060dae4fdb96a3ea0b0a726ee228788affb997e7f4172f4e54001c5d
-  languageName: node
-  linkType: hard
-
-"electron-to-chromium@npm:^1.3.47":
-  version: 1.4.462
-  resolution: "electron-to-chromium@npm:1.4.462"
-  checksum: ee6e0318ca1144077131036ad87630f8b68c9c4d2c2ce97359731dc676df3518cb88223dc8057187d97e018983e08c003b64d03fba27f98fa53698e758672771
-  languageName: node
-  linkType: hard
-
-"electron-to-chromium@npm:^1.3.723":
-  version: 1.3.906
-  resolution: "electron-to-chromium@npm:1.3.906"
-  checksum: 087330249a424066cbdb882890164b3cb944f0ea293838a1445274428549e5b6c5edd25c353fed733d20d055ba276d4e3b069554b5e06ebfe511134c4f68cf87
-  languageName: node
-  linkType: hard
-
-"electron-to-chromium@npm:^1.3.857":
-  version: 1.3.866
-  resolution: "electron-to-chromium@npm:1.3.866"
-  checksum: 03b4cf46baf631d9022d7d2f1c058899152941a7d3b3e9df02c2fc48d2eb52362637337b3e2e793a533fa30ed9ec844b4a1d56a55c421d64e39cf8080b980d52
-  languageName: node
-  linkType: hard
-
-"electron-to-chromium@npm:^1.3.896":
-  version: 1.4.10
-  resolution: "electron-to-chromium@npm:1.4.10"
-  checksum: 00b9ca97267fc3c865f9888a490e2c1bc2eef80805d8b4337661901d498bf4c771a237f5f7beec294dc847f9096b3a58910da431e4e8cc8dc08871d4630a5860
-  languageName: node
-  linkType: hard
-
-"electron-to-chromium@npm:^1.4.147":
-  version: 1.4.148
-  resolution: "electron-to-chromium@npm:1.4.148"
-  checksum: 3730c2eb46c7d0602b418a5a80e8d37e673c61d7cdc6a431a0d23bf08b6db6375c5f842d9e4285549ef2c5bad9189da34f05f28993fdb43920df5befc72db87a
-  languageName: node
-  linkType: hard
-
-"electron-to-chromium@npm:^1.4.431":
-  version: 1.4.461
-  resolution: "electron-to-chromium@npm:1.4.461"
-  checksum: 84960b8fe41a1a97f47962f7ec509d94efffc8361286d55f360f81ce0804029af886796c576eb2c0a6011347ba0903c551476808f0614dc94b4564abaf415e70
-  languageName: node
-  linkType: hard
-
-"electron-to-chromium@npm:^1.4.601":
-  version: 1.4.602
-  resolution: "electron-to-chromium@npm:1.4.602"
-  checksum: a3e30fee47f377f180a99db26f1067acb72891fab720b6800221d74de0c962ac2f595bd977d1f1fd265e0b7f7258b4524c8f9053d17620d01bb8cfa2c0ae32de
-  languageName: node
-  linkType: hard
-
-"electron-to-chromium@npm:^1.4.84":
-  version: 1.4.99
-  resolution: "electron-to-chromium@npm:1.4.99"
-  checksum: 7efb73368db78b55bc1c9563364f69f2715f085ac2a0e9b8dab0f319025fbd6464e0eaf47eb5e447f1d4e76f9de919bec5e338bf87443ad8dcb34b2829fc82b7
-  languageName: node
-  linkType: hard
-
-"elliptic@npm:^6.5.3":
-  version: 6.5.4
-  resolution: "elliptic@npm:6.5.4"
-  dependencies:
-    bn.js: ^4.11.9
-    brorand: ^1.1.0
-    hash.js: ^1.0.0
-    hmac-drbg: ^1.0.1
-    inherits: ^2.0.4
-    minimalistic-assert: ^1.0.1
-    minimalistic-crypto-utils: ^1.0.1
-  checksum: d56d21fd04e97869f7ffcc92e18903b9f67f2d4637a23c860492fbbff5a3155fd9ca0184ce0c865dd6eb2487d234ce9551335c021c376cd2d3b7cb749c7d10f4
+"electron-to-chromium@npm:^1.5.149":
+  version: 1.5.157
+  resolution: "electron-to-chromium@npm:1.5.157"
+  checksum: 479d1bb9458f0e19d0853a7f423b8a2468ca0f4a36772bfe115460183bc94662d63d4a4cde98c4aaf3c06e1840646e85dd48ef854ddf634fd169c6504540ea44
   languageName: node
   linkType: hard
 
-"ember-a11y-refocus@npm:^3.0.2":
-  version: 3.0.2
-  resolution: "ember-a11y-refocus@npm:3.0.2"
+"ember-a11y-refocus@npm:^4.1.4":
+  version: 4.1.4
+  resolution: "ember-a11y-refocus@npm:4.1.4"
   dependencies:
     ember-cli-babel: ^7.26.11
     ember-cli-htmlbars: ^6.0.1
-  checksum: c192e80514adad4928207f4025975f225fde0b135a9156f257999dc49a8eb16b84d6f7a8c489b33a87a17c5b6325e48fc152055e6d4ecee45cdddfd2cd4d2c0a
+  checksum: c1a79f9b7792f3bac674e010b231561da4ca5fc2f3f6a9a6e2263908a6c781546e1baccdb84838f367ac9104e2c76b7f688a57f06f0bd6c194a6f1a71910e422
   languageName: node
   linkType: hard
 
-"ember-a11y-testing@npm:^5.2.1":
-  version: 5.2.1
-  resolution: "ember-a11y-testing@npm:5.2.1"
+"ember-a11y-testing@npm:~7.1.2":
+  version: 7.1.2
+  resolution: "ember-a11y-testing@npm:7.1.2"
   dependencies:
-    "@ember/test-waiters": ^2.4.3 || ^3.0.0
+    "@ember/test-waiters": ^2.4.3 || ^3.0.0 || ^4.0.0
+    "@glimmer/env": ^0.1.7
     "@scalvert/ember-setup-middleware-reporter": ^0.1.1
-    axe-core: ^4.6.3
-    body-parser: ^1.19.1
+    axe-core: ^4.10.3
     broccoli-persistent-filter: ^3.1.2
     ember-auto-import: ^2.2.4
     ember-cli-babel: ^7.26.11
+    ember-cli-htmlbars: ^6.3.0
     ember-cli-typescript: ^4.2.1
     ember-cli-version-checker: ^5.1.2
-    ember-destroyable-polyfill: ^2.0.1
-    fs-extra: ^10.0.0
+    fs-extra: ^11.2.0
     validate-peer-dependencies: ^2.0.0
   peerDependencies:
-    "@ember/test-helpers": ^2.0.0
+    "@ember/test-helpers": ^3.0.3 || ^4.0.2 || ^5.0.0
     qunit: ">= 2"
   peerDependenciesMeta:
     qunit:
       optional: true
-  checksum: 4c8a2c1a04751c995679f537af3c93036c648dc7e289a2bfa044b8cab189662a8c451507ae6a7777d1b77e0589c0e2304f0c5c76e2ee53e75cf2c3c0845d23da
+  checksum: 9f5e32fc1e0c05a2b665cdbdbf1c96e34462c1d83b1d6ecda2e4d37df1a20576752241ec4e1d16e00396c5e41b23fccf79590ddc4874def55fe6719de18eb531
   languageName: node
   linkType: hard
 
@@ -13998,212 +7925,30 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-assign-helper@npm:^0.4.0":
-  version: 0.4.0
-  resolution: "ember-assign-helper@npm:0.4.0"
-  dependencies:
-    ember-cli-babel: ^7.26.0
-    ember-cli-htmlbars: ^6.0.0
-  checksum: 32bbec384c8f78c919d7a6e24cc36c7a48bd0244d3b38c4aa8a17fc1f1b68822f4805a838fec7e1fe35dfcd2832eb9afa146606f625e737ea258127254a5b9d4
-  languageName: node
-  linkType: hard
-
-"ember-auto-import@npm:2.6.3, ember-auto-import@npm:^2.5.0, ember-auto-import@npm:^2.6.3":
-  version: 2.6.3
-  resolution: "ember-auto-import@npm:2.6.3"
-  dependencies:
-    "@babel/core": ^7.16.7
-    "@babel/plugin-proposal-class-properties": ^7.16.7
-    "@babel/plugin-proposal-decorators": ^7.16.7
-    "@babel/preset-env": ^7.16.7
-    "@embroider/macros": ^1.0.0
-    "@embroider/shared-internals": ^2.0.0
-    babel-loader: ^8.0.6
-    babel-plugin-ember-modules-api-polyfill: ^3.5.0
-    babel-plugin-ember-template-compilation: ^2.0.1
-    babel-plugin-htmlbars-inline-precompile: ^5.2.1
-    babel-plugin-syntax-dynamic-import: ^6.18.0
-    broccoli-debug: ^0.6.4
-    broccoli-funnel: ^3.0.8
-    broccoli-merge-trees: ^4.2.0
-    broccoli-plugin: ^4.0.0
-    broccoli-source: ^3.0.0
-    css-loader: ^5.2.0
-    debug: ^4.3.1
-    fs-extra: ^10.0.0
-    fs-tree-diff: ^2.0.0
-    handlebars: ^4.3.1
-    js-string-escape: ^1.0.1
-    lodash: ^4.17.19
-    mini-css-extract-plugin: ^2.5.2
-    parse5: ^6.0.1
-    resolve: ^1.20.0
-    resolve-package-path: ^4.0.3
-    semver: ^7.3.4
-    style-loader: ^2.0.0
-    typescript-memoize: ^1.0.0-alpha.3
-    walk-sync: ^3.0.0
-  checksum: e42c0f9dee74c94a16c8b4d701707f457e8955ad340e68be32375ff32fba030fcaa53aa4e4fd2d482fabe0a320ceabc034520c73601c8d69caa6268093dd0f65
-  languageName: node
-  linkType: hard
-
-"ember-auto-import@npm:^1.12.0":
-  version: 1.12.1
-  resolution: "ember-auto-import@npm:1.12.1"
-  dependencies:
-    "@babel/core": ^7.1.6
-    "@babel/preset-env": ^7.10.2
-    "@babel/traverse": ^7.1.6
-    "@babel/types": ^7.1.6
-    "@embroider/shared-internals": ^1.0.0
-    babel-core: ^6.26.3
-    babel-loader: ^8.0.6
-    babel-plugin-syntax-dynamic-import: ^6.18.0
-    babylon: ^6.18.0
-    broccoli-debug: ^0.6.4
-    broccoli-node-api: ^1.7.0
-    broccoli-plugin: ^4.0.0
-    broccoli-source: ^3.0.0
-    debug: ^3.1.0
-    ember-cli-babel: ^7.0.0
-    enhanced-resolve: ^4.0.0
-    fs-extra: ^6.0.1
-    fs-tree-diff: ^2.0.0
-    handlebars: ^4.3.1
-    js-string-escape: ^1.0.1
-    lodash: ^4.17.19
-    mkdirp: ^0.5.1
-    resolve-package-path: ^3.1.0
-    rimraf: ^2.6.2
-    semver: ^7.3.4
-    symlink-or-copy: ^1.2.0
-    typescript-memoize: ^1.0.0-alpha.3
-    walk-sync: ^0.3.3
-    webpack: ^4.43.0
-  checksum: 8230c3ff6fd222eee7179e0e5c2ea0268702b66400a4b51de4dbc608bdfa8d2236125999b7bfa25dc36acb51d9eb93bcc45aea5783bdf95ad74f7e898014013d
-  languageName: node
-  linkType: hard
-
-"ember-auto-import@npm:^1.2.19":
-  version: 1.11.3
-  resolution: "ember-auto-import@npm:1.11.3"
-  dependencies:
-    "@babel/core": ^7.1.6
-    "@babel/preset-env": ^7.10.2
-    "@babel/traverse": ^7.1.6
-    "@babel/types": ^7.1.6
-    "@embroider/core": ^0.33.0
-    babel-core: ^6.26.3
-    babel-loader: ^8.0.6
-    babel-plugin-syntax-dynamic-import: ^6.18.0
-    babylon: ^6.18.0
-    broccoli-debug: ^0.6.4
-    broccoli-node-api: ^1.7.0
-    broccoli-plugin: ^4.0.0
-    broccoli-source: ^3.0.0
-    debug: ^3.1.0
-    ember-cli-babel: ^7.0.0
-    enhanced-resolve: ^4.0.0
-    fs-extra: ^6.0.1
-    fs-tree-diff: ^2.0.0
-    handlebars: ^4.3.1
-    js-string-escape: ^1.0.1
-    lodash: ^4.17.19
-    mkdirp: ^0.5.1
-    resolve-package-path: ^3.1.0
-    rimraf: ^2.6.2
-    semver: ^7.3.4
-    symlink-or-copy: ^1.2.0
-    typescript-memoize: ^1.0.0-alpha.3
-    walk-sync: ^0.3.3
-    webpack: ^4.43.0
-  checksum: 2ac4e08696f46b4e9e1ada49c068d5ca7a338e063ea47e332f81e72613ae287479504b1246e97b31bed7ca6a84ec7928d250e0de6f5bc7c6412a7e537532684b
-  languageName: node
-  linkType: hard
-
-"ember-auto-import@npm:^2.2.4, ember-auto-import@npm:^2.6.0":
-  version: 2.7.0
-  resolution: "ember-auto-import@npm:2.7.0"
+"ember-assign-helper@npm:^0.5.0":
+  version: 0.5.1
+  resolution: "ember-assign-helper@npm:0.5.1"
   dependencies:
-    "@babel/core": ^7.16.7
-    "@babel/plugin-proposal-class-properties": ^7.16.7
-    "@babel/plugin-proposal-decorators": ^7.16.7
-    "@babel/plugin-proposal-private-methods": ^7.16.7
-    "@babel/plugin-transform-class-static-block": ^7.16.7
-    "@babel/preset-env": ^7.16.7
-    "@embroider/macros": ^1.0.0
-    "@embroider/shared-internals": ^2.0.0
-    babel-loader: ^8.0.6
-    babel-plugin-ember-modules-api-polyfill: ^3.5.0
-    babel-plugin-ember-template-compilation: ^2.0.1
-    babel-plugin-htmlbars-inline-precompile: ^5.2.1
-    babel-plugin-syntax-dynamic-import: ^6.18.0
-    broccoli-debug: ^0.6.4
-    broccoli-funnel: ^3.0.8
-    broccoli-merge-trees: ^4.2.0
-    broccoli-plugin: ^4.0.0
-    broccoli-source: ^3.0.0
-    css-loader: ^5.2.0
-    debug: ^4.3.1
-    fs-extra: ^10.0.0
-    fs-tree-diff: ^2.0.0
-    handlebars: ^4.3.1
-    js-string-escape: ^1.0.1
-    lodash: ^4.17.19
-    mini-css-extract-plugin: ^2.5.2
-    minimatch: ^3.0.0
-    parse5: ^6.0.1
-    resolve: ^1.20.0
-    resolve-package-path: ^4.0.3
-    semver: ^7.3.4
-    style-loader: ^2.0.0
-    typescript-memoize: ^1.0.0-alpha.3
-    walk-sync: ^3.0.0
-  checksum: abf483c7c2cd61d35fd26f779dd6b818bb83775bbab1834ab80cfbe396d9b753dfab5fdc0882b91467321dd23575419522e9e8b53e37e7149d4561dd753fd2d6
+    "@embroider/addon-shim": ^1.8.7
+  checksum: 2e77aad2a5258c837e3959fcd0b20ebc8ab832344d613b7d4c13194698d67baf6de20cf2ea26b3c8f2e508bf976043dbdc565ef722dd2b9845a4ae888dc90ef8
   languageName: node
   linkType: hard
 
-"ember-auto-import@npm:^2.4.1":
-  version: 2.4.2
-  resolution: "ember-auto-import@npm:2.4.2"
+"ember-async-data@npm:^1.0.1":
+  version: 1.0.3
+  resolution: "ember-async-data@npm:1.0.3"
   dependencies:
-    "@babel/core": ^7.16.7
-    "@babel/plugin-proposal-class-properties": ^7.16.7
-    "@babel/plugin-proposal-decorators": ^7.16.7
-    "@babel/preset-env": ^7.16.7
-    "@embroider/macros": ^1.0.0
-    "@embroider/shared-internals": ^1.0.0
-    babel-loader: ^8.0.6
-    babel-plugin-ember-modules-api-polyfill: ^3.5.0
-    babel-plugin-htmlbars-inline-precompile: ^5.2.1
-    babel-plugin-syntax-dynamic-import: ^6.18.0
-    broccoli-debug: ^0.6.4
-    broccoli-funnel: ^3.0.8
-    broccoli-merge-trees: ^4.2.0
-    broccoli-plugin: ^4.0.0
-    broccoli-source: ^3.0.0
-    css-loader: ^5.2.0
-    debug: ^4.3.1
-    fs-extra: ^10.0.0
-    fs-tree-diff: ^2.0.0
-    handlebars: ^4.3.1
-    js-string-escape: ^1.0.1
-    lodash: ^4.17.19
-    mini-css-extract-plugin: ^2.5.2
-    parse5: ^6.0.1
-    resolve: ^1.20.0
-    resolve-package-path: ^4.0.3
-    semver: ^7.3.4
-    style-loader: ^2.0.0
-    typescript-memoize: ^1.0.0-alpha.3
-    walk-sync: ^3.0.0
-  checksum: f7c4e4bab62b124c03955b8b382d6bf9c170c1ad5605bb019cbb1baf63065b482b8767a2e4922682fbc54c701f0296601e7ed50965bd4c741dab6cfff43c6de5
+    "@ember/test-waiters": ^3.0.0
+    "@embroider/addon-shim": ^1.8.6
+  peerDependencies:
+    ember-source: ">=4.8.4"
+  checksum: 0484ce4fd539700e48dd04adefdead83d058aec4facfb79b30dbee4206b7eab650eea1e657b5172d391ee16e522d9e96b5a76137465e31385841c31b3a6a52e6
   languageName: node
   linkType: hard
 
-"ember-auto-import@npm:^2.6.1, ember-auto-import@npm:^2.7.0":
-  version: 2.7.2
-  resolution: "ember-auto-import@npm:2.7.2"
+"ember-auto-import@npm:2.10.0, ember-auto-import@npm:^2.2.4, ember-auto-import@npm:^2.4.1, ember-auto-import@npm:^2.6.3, ember-auto-import@npm:^2.7.0":
+  version: 2.10.0
+  resolution: "ember-auto-import@npm:2.10.0"
   dependencies:
     "@babel/core": ^7.16.7
     "@babel/plugin-proposal-class-properties": ^7.16.7
@@ -14228,40 +7973,40 @@ __metadata:
     fs-extra: ^10.0.0
     fs-tree-diff: ^2.0.0
     handlebars: ^4.3.1
+    is-subdir: ^1.2.0
     js-string-escape: ^1.0.1
     lodash: ^4.17.19
     mini-css-extract-plugin: ^2.5.2
     minimatch: ^3.0.0
     parse5: ^6.0.1
+    pkg-entry-points: ^1.1.0
     resolve: ^1.20.0
     resolve-package-path: ^4.0.3
     semver: ^7.3.4
     style-loader: ^2.0.0
     typescript-memoize: ^1.0.0-alpha.3
     walk-sync: ^3.0.0
-  checksum: c998028f7330ecb9ffa5242b60b55f7e6722c3b45959b1b0910cdb9b82920abdefd36f393a80e79bdfd0ff6532641ff1a3fd5b668bfdecd883ecafb00620c15f
+  checksum: f122f7e42bd9c4cfd39e951d79531d23a5b03278bba762d7638951d017d9fe0ce32d2852284ea5761233cd4a66555b9e3dcadaa8c6370fc00581795f28c20f79
   languageName: node
   linkType: hard
 
-"ember-basic-dropdown@npm:6.0.1":
-  version: 6.0.1
-  resolution: "ember-basic-dropdown@npm:6.0.1"
+"ember-basic-dropdown@npm:~8.6.0":
+  version: 8.6.1
+  resolution: "ember-basic-dropdown@npm:8.6.1"
   dependencies:
-    "@ember/render-modifiers": ^2.0.4
-    "@embroider/macros": ^1.2.0
-    "@embroider/util": ^1.2.0
-    "@glimmer/component": ^1.0.4
-    "@glimmer/tracking": ^1.0.4
-    ember-cli-babel: ^7.26.11
-    ember-cli-htmlbars: ^6.0.1
-    ember-cli-typescript: ^4.2.1
-    ember-element-helper: ^0.6.0
-    ember-get-config: ^1.0.2 || ^2.0.0
-    ember-maybe-in-element: ^2.0.3
-    ember-modifier: ^3.2.7
-    ember-style-modifier: ^0.8.0
-    ember-truth-helpers: ^2.1.0 || ^3.0.0
-  checksum: d6f00f202140d09a0c3d62d9104c5f63eb6b0f7228a17a3f2f9e37da66c82d6ba01503261ed886190ebb0afc3d737f6bc6ad609115528176bd81f72e5930508f
+    "@embroider/addon-shim": ^1.10.0
+    "@embroider/macros": ^1.17.3
+    "@embroider/util": ^1.13.2
+    decorator-transforms: ^2.3.0
+    ember-element-helper: ^0.8.7
+    ember-lifeline: ^7.0.0
+    ember-modifier: ^4.2.0
+    ember-style-modifier: ^4.4.0
+    ember-truth-helpers: ^4.0.3
+  peerDependencies:
+    "@ember/test-helpers": ^2.9.4 || ^3.2.1 || ^4.0.2 || ^5.0.0
+    "@glimmer/component": ^1.1.2 || ^2.0.0
+  checksum: 04d213d75996834d868601a0da3f014be0d89b51b91721cdb0ea084bb1e9ab01edfc92ae82e4c999f786e5c70a62b9196a04aa8fa4061a26cb08af1bd577baff
   languageName: node
   linkType: hard
 
@@ -14271,29 +8016,13 @@ __metadata:
   dependencies:
     ember-cli-babel: ^7.22.1
     ember-cli-version-checker: ^5.1.1
-    ember-compatibility-helpers: ^1.2.1
-    silent-error: ^1.1.1
-  checksum: d0b091e940837e276364d14758d7149fb7b9e5eb99e271f97012f9b92952cf6854132195dc9c36b9fcd40d8495608e7044f9d6179f2f9e15003d9a4cbcf73b49
-  languageName: node
-  linkType: hard
-
-"ember-cached-decorator-polyfill@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "ember-cached-decorator-polyfill@npm:1.0.1"
-  dependencies:
-    "@embroider/macros": ^1.8.3
-    "@glimmer/tracking": ^1.1.2
-    babel-import-util: ^1.2.2
-    ember-cache-primitive-polyfill: ^1.0.1
-    ember-cli-babel: ^7.26.11
-    ember-cli-babel-plugin-helpers: ^1.1.1
-  peerDependencies:
-    ember-source: ^3.13.0 || ^4.0.0
-  checksum: b2589490d897da9f560abc1858c2090fc027a54267dfaa5780ee376e00cec1183b84400df9125f6c25bd7d2b465818d63abb98bb07b3eec0a18b3206a918b804
+    ember-compatibility-helpers: ^1.2.1
+    silent-error: ^1.1.1
+  checksum: d0b091e940837e276364d14758d7149fb7b9e5eb99e271f97012f9b92952cf6854132195dc9c36b9fcd40d8495608e7044f9d6179f2f9e15003d9a4cbcf73b49
   languageName: node
   linkType: hard
 
-"ember-cached-decorator-polyfill@npm:^1.0.2":
+"ember-cached-decorator-polyfill@npm:^1.0.1":
   version: 1.0.2
   resolution: "ember-cached-decorator-polyfill@npm:1.0.2"
   dependencies:
@@ -14309,45 +8038,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-autoprefixer@npm:^0.8.1":
-  version: 0.8.1
-  resolution: "ember-cli-autoprefixer@npm:0.8.1"
-  dependencies:
-    broccoli-autoprefixer: ^5.0.0
-    lodash: ^4.0.0
-  checksum: b756a311abe4d3e91cd170fa801d0cb5601f7e6d2b9d7406018719636479ee80e1ec3ca633ca1419971ec56bf5417bc6000fc2a128bd3e3f2ddbe4e22d8ea8da
-  languageName: node
-  linkType: hard
-
-"ember-cli-babel-plugin-helpers@npm:^1.0.0, ember-cli-babel-plugin-helpers@npm:^1.1.0, ember-cli-babel-plugin-helpers@npm:^1.1.1":
+"ember-cli-babel-plugin-helpers@npm:^1.1.1":
   version: 1.1.1
   resolution: "ember-cli-babel-plugin-helpers@npm:1.1.1"
   checksum: 3dc684317dbc4728d41a61de13d2fb1de5227105c1ba9194005647d2724b469d43aba3b1fa73622f2b5cd04c8283a15568b3a0044ec7a5036c17f336ac098ff5
   languageName: node
   linkType: hard
 
-"ember-cli-babel@npm:^6.6.0":
-  version: 6.18.0
-  resolution: "ember-cli-babel@npm:6.18.0"
-  dependencies:
-    amd-name-resolver: 1.2.0
-    babel-plugin-debug-macros: ^0.2.0-beta.6
-    babel-plugin-ember-modules-api-polyfill: ^2.6.0
-    babel-plugin-transform-es2015-modules-amd: ^6.24.0
-    babel-polyfill: ^6.26.0
-    babel-preset-env: ^1.7.0
-    broccoli-babel-transpiler: ^6.5.0
-    broccoli-debug: ^0.6.4
-    broccoli-funnel: ^2.0.0
-    broccoli-source: ^1.1.0
-    clone: ^2.0.0
-    ember-cli-version-checker: ^2.1.2
-    semver: ^5.5.0
-  checksum: 01f216a964f03660ee1d95ef73a7c07b315d7407b553d01410854f9421638fee084cec50fb7464c7bace72a7cf07053f95b377fd8399f69c7e0bbcba77e9655d
-  languageName: node
-  linkType: hard
-
-"ember-cli-babel@npm:^7.0.0, ember-cli-babel@npm:^7.1.2, ember-cli-babel@npm:^7.1.3, ember-cli-babel@npm:^7.10.0, ember-cli-babel@npm:^7.13.0, ember-cli-babel@npm:^7.13.2, ember-cli-babel@npm:^7.18.0, ember-cli-babel@npm:^7.19.0, ember-cli-babel@npm:^7.20.0, ember-cli-babel@npm:^7.21.0, ember-cli-babel@npm:^7.22.1, ember-cli-babel@npm:^7.23.0, ember-cli-babel@npm:^7.23.1, ember-cli-babel@npm:^7.26.0, ember-cli-babel@npm:^7.26.1, ember-cli-babel@npm:^7.26.11, ember-cli-babel@npm:^7.26.3, ember-cli-babel@npm:^7.26.4, ember-cli-babel@npm:^7.26.5, ember-cli-babel@npm:^7.26.6, ember-cli-babel@npm:^7.26.8, ember-cli-babel@npm:^7.5.0, ember-cli-babel@npm:^7.7.3":
+"ember-cli-babel@npm:^7.1.2, ember-cli-babel@npm:^7.10.0, ember-cli-babel@npm:^7.18.0, ember-cli-babel@npm:^7.22.1, ember-cli-babel@npm:^7.23.0, ember-cli-babel@npm:^7.26.11, ember-cli-babel@npm:^7.26.3, ember-cli-babel@npm:^7.26.4, ember-cli-babel@npm:^7.26.5, ember-cli-babel@npm:^7.26.6, ember-cli-babel@npm:^7.5.0, ember-cli-babel@npm:^7.7.3":
   version: 7.26.11
   resolution: "ember-cli-babel@npm:7.26.11"
   dependencies:
@@ -14385,7 +8083,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-babel@npm:^8.2.0":
+"ember-cli-babel@npm:^8.0.0, ember-cli-babel@npm:^8.2.0, ember-cli-babel@npm:~8.2.0":
   version: 8.2.0
   resolution: "ember-cli-babel@npm:8.2.0"
   dependencies:
@@ -14422,6 +8120,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ember-cli-clean-css@npm:~3.0.0":
+  version: 3.0.0
+  resolution: "ember-cli-clean-css@npm:3.0.0"
+  dependencies:
+    broccoli-persistent-filter: ^3.1.3
+    clean-css: ^5.3.2
+    json-stable-stringify: ^1.0.1
+  checksum: 1c05886e679b5f3207f1c2a364643378868120436f8ec3111c4db85d3ed3095c6c12137d205ad71423b282b894285ae7cfc17470aaa7022ca2517c9c4b1fb02d
+  languageName: node
+  linkType: hard
+
 "ember-cli-content-security-policy@npm:2.0.3":
   version: 2.0.3
   resolution: "ember-cli-content-security-policy@npm:2.0.3"
@@ -14435,30 +8144,30 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-dependency-checker@npm:^3.3.1":
-  version: 3.3.1
-  resolution: "ember-cli-dependency-checker@npm:3.3.1"
+"ember-cli-dependency-checker@npm:~3.3.3":
+  version: 3.3.3
+  resolution: "ember-cli-dependency-checker@npm:3.3.3"
   dependencies:
-    chalk: ^2.3.0
-    find-yarn-workspace-root: ^1.1.0
+    chalk: ^2.4.2
+    find-yarn-workspace-root: ^2.0.0
     is-git-url: ^1.0.0
-    resolve: ^1.5.0
-    semver: ^5.3.0
+    resolve: ^1.22.0
+    semver: ^5.7.1
   peerDependencies:
-    ember-cli: ^3.2.0 || ^4.0.0
-  checksum: 41d27cb4ccd056b9013ef00fa0f4e9133a5769b82bef8427ceaca3d9b773f901a4fbea6ad87748a6ae456d0051ed12f4e664212ca3c290d14704c3a2d710ad72
+    ember-cli: ^3.2.0 || >=4.0.0
+  checksum: cd14ef579efeba3fcfdc6639069f8492a35469e75148f86b9f462112922d2c063f7af8608d9d35b3d8936758edb2e21fb2485cf833c55644f767ab7fbea7b9e5
   languageName: node
   linkType: hard
 
-"ember-cli-deprecation-workflow@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "ember-cli-deprecation-workflow@npm:2.1.0"
+"ember-cli-deprecation-workflow@npm:~3.3.0":
+  version: 3.3.0
+  resolution: "ember-cli-deprecation-workflow@npm:3.3.0"
   dependencies:
-    broccoli-funnel: ^3.0.3
-    broccoli-merge-trees: ^4.2.0
-    broccoli-plugin: ^4.0.5
-    ember-cli-htmlbars: ^5.3.2
-  checksum: 3382d34001db61fa04069d0f5f143b39fbeeac124d961dbef932c5a15b67669b8124c504018c7333b2716e2d7a5b299eae53591d8e55bafe447fda7aefaa2deb
+    "@babel/core": ^7.23.2
+    ember-cli-babel: ^8.2.0
+  peerDependencies:
+    ember-source: ">= 4.0.0"
+  checksum: 0b17c1f3ee60edafcdef101a27afe966a5037ca77bcbd081702c4e350bfa282ae2bdebe6c671d9119938a13e4582a94c69dd4cafcbfbdc87b3c815e7639db45d
   languageName: node
   linkType: hard
 
@@ -14483,29 +8192,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-htmlbars@npm:^4.3.1":
-  version: 4.5.0
-  resolution: "ember-cli-htmlbars@npm:4.5.0"
-  dependencies:
-    "@ember/edition-utils": ^1.2.0
-    babel-plugin-htmlbars-inline-precompile: ^3.2.0
-    broccoli-debug: ^0.6.5
-    broccoli-persistent-filter: ^2.3.1
-    broccoli-plugin: ^3.1.0
-    common-tags: ^1.8.0
-    ember-cli-babel-plugin-helpers: ^1.1.0
-    fs-tree-diff: ^2.0.1
-    hash-for-dep: ^1.5.1
-    heimdalljs-logger: ^0.1.10
-    json-stable-stringify: ^1.0.1
-    semver: ^6.3.0
-    strip-bom: ^4.0.0
-    walk-sync: ^2.0.2
-  checksum: 4cecd9e5df64fc9df22ea944b2ab86dd88d3bd105b22b46e810856a050d617f73610645c1e91ff018836e73f4b488a14217a3d767557c1fa663494b54de93af6
-  languageName: node
-  linkType: hard
-
-"ember-cli-htmlbars@npm:^5.2.0, ember-cli-htmlbars@npm:^5.3.2":
+"ember-cli-htmlbars@npm:^5.3.1, ember-cli-htmlbars@npm:^5.7.1":
   version: 5.7.2
   resolution: "ember-cli-htmlbars@npm:5.7.2"
   dependencies:
@@ -14529,98 +8216,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-htmlbars@npm:^5.3.1, ember-cli-htmlbars@npm:^5.7.1":
-  version: 5.7.1
-  resolution: "ember-cli-htmlbars@npm:5.7.1"
-  dependencies:
-    "@ember/edition-utils": ^1.2.0
-    babel-plugin-htmlbars-inline-precompile: ^5.0.0
-    broccoli-debug: ^0.6.5
-    broccoli-persistent-filter: ^3.1.2
-    broccoli-plugin: ^4.0.3
-    common-tags: ^1.8.0
-    ember-cli-babel-plugin-helpers: ^1.1.1
-    ember-cli-version-checker: ^5.1.2
-    fs-tree-diff: ^2.0.1
-    hash-for-dep: ^1.5.1
-    heimdalljs-logger: ^0.1.10
-    json-stable-stringify: ^1.0.1
-    semver: ^7.3.4
-    silent-error: ^1.1.1
-    strip-bom: ^4.0.0
-    walk-sync: ^2.2.0
-  checksum: 6212c33dfc5c99fdac8bbd5381a9fd8cd855eb2f3e9c03e3cf3f9466bbc0163c7d4472593611de221e785eb19124330c01ba1f16224bd94a3804527b2a5d2efb
-  languageName: node
-  linkType: hard
-
-"ember-cli-htmlbars@npm:^6.0.0, ember-cli-htmlbars@npm:^6.0.1":
-  version: 6.0.1
-  resolution: "ember-cli-htmlbars@npm:6.0.1"
-  dependencies:
-    "@ember/edition-utils": ^1.2.0
-    babel-plugin-ember-template-compilation: ^1.0.0
-    babel-plugin-htmlbars-inline-precompile: ^5.3.0
-    broccoli-debug: ^0.6.5
-    broccoli-persistent-filter: ^3.1.2
-    broccoli-plugin: ^4.0.3
-    ember-cli-version-checker: ^5.1.2
-    fs-tree-diff: ^2.0.1
-    hash-for-dep: ^1.5.1
-    heimdalljs-logger: ^0.1.10
-    json-stable-stringify: ^1.0.1
-    semver: ^7.3.4
-    silent-error: ^1.1.1
-    strip-bom: ^4.0.0
-    walk-sync: ^2.2.0
-  checksum: ba5593c7ce2db52ac7171a6e7a9ebbcf5b9d3dc0f4e357acbb59f1eca1a6b4d16c00be7f8370c6fa95f364f4f3863b81d9477cfd461e0fd9ba56abbc527b6a14
-  languageName: node
-  linkType: hard
-
-"ember-cli-htmlbars@npm:^6.1.0":
-  version: 6.1.1
-  resolution: "ember-cli-htmlbars@npm:6.1.1"
-  dependencies:
-    "@ember/edition-utils": ^1.2.0
-    babel-plugin-ember-template-compilation: ^1.0.0
-    babel-plugin-htmlbars-inline-precompile: ^5.3.0
-    broccoli-debug: ^0.6.5
-    broccoli-persistent-filter: ^3.1.2
-    broccoli-plugin: ^4.0.3
-    ember-cli-version-checker: ^5.1.2
-    fs-tree-diff: ^2.0.1
-    hash-for-dep: ^1.5.1
-    heimdalljs-logger: ^0.1.10
-    js-string-escape: ^1.0.1
-    semver: ^7.3.4
-    silent-error: ^1.1.1
-    walk-sync: ^2.2.0
-  checksum: d75fbe973196bdc1df6a04a11310064125108eb105e903a842698f0dd6c133d2e1699860ea1c8237d0c62f92b01da4ebc7b672e862b2e572922f0f86f243a9a1
-  languageName: node
-  linkType: hard
-
-"ember-cli-htmlbars@npm:^6.1.1, ember-cli-htmlbars@npm:^6.2.0":
-  version: 6.2.0
-  resolution: "ember-cli-htmlbars@npm:6.2.0"
-  dependencies:
-    "@ember/edition-utils": ^1.2.0
-    babel-plugin-ember-template-compilation: ^2.0.0
-    babel-plugin-htmlbars-inline-precompile: ^5.3.0
-    broccoli-debug: ^0.6.5
-    broccoli-persistent-filter: ^3.1.2
-    broccoli-plugin: ^4.0.3
-    ember-cli-version-checker: ^5.1.2
-    fs-tree-diff: ^2.0.1
-    hash-for-dep: ^1.5.1
-    heimdalljs-logger: ^0.1.10
-    js-string-escape: ^1.0.1
-    semver: ^7.3.4
-    silent-error: ^1.1.1
-    walk-sync: ^2.2.0
-  checksum: 1a0f94152ae381aed4c0300f4d8e756d60bfc4dfd1357fd49a0d36d420d65d6dc3f5761e604976f63edd11bc264959dddbd1b4c8401e9922711eafc748f4df92
-  languageName: node
-  linkType: hard
-
-"ember-cli-htmlbars@npm:^6.3.0":
+"ember-cli-htmlbars@npm:^6.0.1, ember-cli-htmlbars@npm:^6.2.0, ember-cli-htmlbars@npm:^6.3.0, ember-cli-htmlbars@npm:~6.3.0":
   version: 6.3.0
   resolution: "ember-cli-htmlbars@npm:6.3.0"
   dependencies:
@@ -14642,7 +8238,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-inject-live-reload@npm:^2.1.0":
+"ember-cli-inject-live-reload@npm:~2.1.0":
   version: 2.1.0
   resolution: "ember-cli-inject-live-reload@npm:2.1.0"
   dependencies:
@@ -14666,47 +8262,36 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-mirage@npm:2.4.0":
-  version: 2.4.0
-  resolution: "ember-cli-mirage@npm:2.4.0"
+"ember-cli-mirage@npm:~3.0.4":
+  version: 3.0.4
+  resolution: "ember-cli-mirage@npm:3.0.4"
   dependencies:
-    "@embroider/macros": ^0.41.0
+    "@babel/core": ^7.22.20
+    "@embroider/macros": ^1.13.2
     broccoli-file-creator: ^2.1.1
     broccoli-funnel: ^3.0.3
     broccoli-merge-trees: ^4.2.0
-    ember-auto-import: ^1.12.0
-    ember-cli-babel: ^7.26.6
-    ember-destroyable-polyfill: ^2.0.3
-    ember-get-config: 0.2.4 - 0.5.0
-    ember-inflector: ^2.0.0 || ^3.0.0 || ^4.0.2
-    lodash-es: ^4.17.11
-    miragejs: ^0.1.43
+    ember-auto-import: ^2.6.3
+    ember-cli-babel: ^8.0.0
+    ember-get-config: 0.2.4 - 0.5.0 || ^1.0.0 || ^2.1.1
+    ember-inflector: ^2.0.0 || ^3.0.0 || ^4.0.2 || ^5.0.0
   peerDependencies:
+    "@ember-data/model": "*"
     "@ember/test-helpers": "*"
     ember-data: "*"
     ember-qunit: "*"
+    ember-source: ">= 3.28.0"
+    miragejs: ^0.1.43
   peerDependenciesMeta:
+    "@ember-data/model":
+      optional: true
     "@ember/test-helpers":
       optional: true
     ember-data:
       optional: true
     ember-qunit:
       optional: true
-  checksum: 459aed2d946ebb9d378e30b3b902157df4378ffc2f1686fa7179ee031240a1733d0b516c5813855ef701c2cc7359b2dccc7a60ddad87f7a5140a4057b5645b5a
-  languageName: node
-  linkType: hard
-
-"ember-cli-node-assets@npm:^0.2.2":
-  version: 0.2.2
-  resolution: "ember-cli-node-assets@npm:0.2.2"
-  dependencies:
-    broccoli-funnel: ^1.0.1
-    broccoli-merge-trees: ^1.1.1
-    broccoli-source: ^1.1.0
-    debug: ^2.2.0
-    lodash: ^4.5.1
-    resolve: ^1.1.7
-  checksum: 860abfe536ad951286b86f04d1700529b371396d4e742ba6cbdd371144ff018b91907e2997e8486423bbe1e086f2ab97169e648c5360cd0949d70050e84919be
+  checksum: 09abad623b3cc9f6104d7ef22948080ab3f75ae58f2b0d6d5f16d0e9d2963f5a11f2186a3d7497b69a0b8d729427006dfcec98a2ac2d3010b19467609ed306f0
   languageName: node
   linkType: hard
 
@@ -14719,19 +8304,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-page-object@npm:1.17.10":
-  version: 1.17.10
-  resolution: "ember-cli-page-object@npm:1.17.10"
+"ember-cli-page-object@npm:~2.3.1":
+  version: 2.3.1
+  resolution: "ember-cli-page-object@npm:2.3.1"
   dependencies:
-    broccoli-file-creator: ^2.1.1
-    broccoli-merge-trees: ^2.0.0
-    ceibo: ~2.0.0
-    ember-cli-babel: ^7.26.1
-    ember-cli-node-assets: ^0.2.2
-    ember-native-dom-helpers: ^0.7.0
-    jquery: ^3.4.1
-    rsvp: ^4.7.0
-  checksum: 214e8358b92d04875ce6f5c90d3f4fbf9aaddabcf096f1c4380a03259c4c8c62b043cb49748b4c29acf1295731ba27a270a2e01f16993c086f0166e8dbff34cd
+    "@embroider/addon-shim": ^1.8.0
+    "@ro0gr/ceibo": ^2.2.0
+    "@types/jquery": ^3.5.14
+    jquery: ^3.5.1
+  peerDependencies:
+    "@ember/jquery": "*"
+    "@ember/test-helpers": ">= 2.5.0"
+  peerDependenciesMeta:
+    "@ember/jquery":
+      optional: true
+  checksum: d688fb4dd8924345f91e0a34d9adc00adfe7932fdfd0e870eac782f8b5e183024f0795b2133d96433f93c49b752a32d41573d79ff5436fced60b496f88d714e8
   languageName: node
   linkType: hard
 
@@ -14754,6 +8341,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ember-cli-preprocess-registry@npm:^5.0.1":
+  version: 5.0.1
+  resolution: "ember-cli-preprocess-registry@npm:5.0.1"
+  dependencies:
+    broccoli-funnel: ^3.0.8
+    debug: ^4.3.2
+  checksum: 41b2d0b45a7e9423381965a43bc5c3f0d693d0d78aeeb8a9ebcbbe567f37fff21c56fb3ad9f7a941cdf3fa8a82f20b2c1a13fe9be6f10b33eb40d9553555acab
+  languageName: node
+  linkType: hard
+
 "ember-cli-sass@npm:11.0.1, ember-cli-sass@npm:^11.0.1":
   version: 11.0.1
   resolution: "ember-cli-sass@npm:11.0.1"
@@ -14794,7 +8391,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-terser@npm:^4.0.2":
+"ember-cli-terser@npm:~4.0.2":
   version: 4.0.2
   resolution: "ember-cli-terser@npm:4.0.2"
   dependencies:
@@ -14812,12 +8409,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-test-loader@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "ember-cli-test-loader@npm:3.0.0"
+"ember-cli-test-loader@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "ember-cli-test-loader@npm:3.1.0"
   dependencies:
-    ember-cli-babel: ^7.13.2
-  checksum: 1de13e06af31b3543e779f69b7d06cda0e1683cdfce7923e313d9cffcb33f4e979af75baf12f3988f8a2186db5d063d204e294f522ef517d845b19ce25cb9cdc
+    ember-cli-babel: ^7.23.0
+  checksum: f9831c6e39970dc31de596e8d46a08c30b02fa06c88f0437899bc9617e883e6ced80d1700a84e5cae065c94174f9fa6a3459c5906824e353d17da9edb1fb643f
   languageName: node
   linkType: hard
 
@@ -14831,106 +8428,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli-typescript@npm:3.0.0":
-  version: 3.0.0
-  resolution: "ember-cli-typescript@npm:3.0.0"
-  dependencies:
-    "@babel/plugin-transform-typescript": ~7.5.0
-    ansi-to-html: ^0.6.6
-    debug: ^4.0.0
-    ember-cli-babel-plugin-helpers: ^1.0.0
-    execa: ^2.0.0
-    fs-extra: ^8.0.0
-    resolve: ^1.5.0
-    rsvp: ^4.8.1
-    semver: ^6.0.0
-    stagehand: ^1.0.0
-    walk-sync: ^2.0.0
-  checksum: 4ef2732a0743113aa0167365afb972239e51ca227ca0858b1e240f8e449a34c02462973e1669eb7cd1982b0c1db225f1537f1d41360dc3945b6c2b54e566f96a
-  languageName: node
-  linkType: hard
-
-"ember-cli-typescript@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "ember-cli-typescript@npm:2.0.2"
-  dependencies:
-    "@babel/plugin-proposal-class-properties": ^7.1.0
-    "@babel/plugin-transform-typescript": ~7.4.0
-    ansi-to-html: ^0.6.6
-    debug: ^4.0.0
-    ember-cli-babel-plugin-helpers: ^1.0.0
-    execa: ^1.0.0
-    fs-extra: ^7.0.0
-    resolve: ^1.5.0
-    rsvp: ^4.8.1
-    semver: ^6.0.0
-    stagehand: ^1.0.0
-    walk-sync: ^1.0.0
-  checksum: a1eecb5733df78de96eee3d75f1d0425c8e2638fddcdfb4b2fa46b70131df78216fc341419ccdcf4c32ca480c2bc3d91c0390b81b5ad738a409335ae5ff7f993
-  languageName: node
-  linkType: hard
-
-"ember-cli-typescript@npm:^3.1.4":
-  version: 3.1.4
-  resolution: "ember-cli-typescript@npm:3.1.4"
-  dependencies:
-    "@babel/plugin-proposal-nullish-coalescing-operator": ^7.4.4
-    "@babel/plugin-proposal-optional-chaining": ^7.6.0
-    "@babel/plugin-transform-typescript": ~7.8.0
-    ansi-to-html: ^0.6.6
-    broccoli-stew: ^3.0.0
-    debug: ^4.0.0
-    ember-cli-babel-plugin-helpers: ^1.0.0
-    execa: ^3.0.0
-    fs-extra: ^8.0.0
-    resolve: ^1.5.0
-    rsvp: ^4.8.1
-    semver: ^6.3.0
-    stagehand: ^1.0.0
-    walk-sync: ^2.0.0
-  checksum: 775c20caadcca5a071728bad1a388297e3c9acfea342b654901c334a2d158fc2d78ebac7b785e718051f1ed8de584741545d2c6c35c4a72b4ddb3fbc1618666f
-  languageName: node
-  linkType: hard
-
-"ember-cli-typescript@npm:^4.1.0, ember-cli-typescript@npm:^4.2.0, ember-cli-typescript@npm:^4.2.1":
-  version: 4.2.1
-  resolution: "ember-cli-typescript@npm:4.2.1"
-  dependencies:
-    ansi-to-html: ^0.6.15
-    broccoli-stew: ^3.0.0
-    debug: ^4.0.0
-    execa: ^4.0.0
-    fs-extra: ^9.0.1
-    resolve: ^1.5.0
-    rsvp: ^4.8.1
-    semver: ^7.3.2
-    stagehand: ^1.0.0
-    walk-sync: ^2.2.0
-  checksum: bd31698536c0df7fc03b47aa1c7d3f9c6f7e34fae1500c88bdbbc4c0b98b2a7e69230dd71a01d7cd7f563484cf895333f559af68f91527d95e198924e3cb2c24
-  languageName: node
-  linkType: hard
-
-"ember-cli-typescript@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "ember-cli-typescript@npm:5.0.0"
-  dependencies:
-    ansi-to-html: ^0.6.15
-    broccoli-stew: ^3.0.0
-    debug: ^4.0.0
-    execa: ^4.0.0
-    fs-extra: ^9.0.1
-    resolve: ^1.5.0
-    rsvp: ^4.8.1
-    semver: ^7.3.2
-    stagehand: ^1.0.0
-    walk-sync: ^2.2.0
-  checksum: ac0d6088cd7e5bb17792e0db44e05f198eaea1484fd45f725b8caac8322b072d9d3dcf4d0d7a88fe66699ca88fe3ab564cc6dde98b63be92129c7acdb73c3da4
-  languageName: node
-  linkType: hard
-
-"ember-cli-typescript@npm:^5.2.1":
-  version: 5.2.1
-  resolution: "ember-cli-typescript@npm:5.2.1"
+"ember-cli-typescript@npm:5.3.0":
+  version: 5.3.0
+  resolution: "ember-cli-typescript@npm:5.3.0"
   dependencies:
     ansi-to-html: ^0.6.15
     broccoli-stew: ^3.0.0
@@ -14942,7 +8442,7 @@ __metadata:
     semver: ^7.3.2
     stagehand: ^1.0.0
     walk-sync: ^2.2.0
-  checksum: b4306b37e9a9e070cc61a67acf404b30636ad2681379589fbc349c7e83158a7b634d792ab5af4cd4dd0770eecb8a901fa84d29a15167826db9c97b664a115df0
+  checksum: 58bc9f73513056293c0661c8ff14181606c9c98f26a83a094fdc72fbc0598111b84ce52fb8a9eb18e9c4a30d469ca62f503ae033a95a86f7b63dd81de9904aeb
   languageName: node
   linkType: hard
 
@@ -14988,19 +8488,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-cli@npm:~4.12.1":
-  version: 4.12.1
-  resolution: "ember-cli@npm:4.12.1"
+"ember-cli@npm:~5.8.0":
+  version: 5.8.1
+  resolution: "ember-cli@npm:5.8.1"
   dependencies:
-    "@babel/core": ^7.21.0
-    "@babel/plugin-transform-modules-amd": ^7.20.11
-    amd-name-resolver: ^1.3.1
-    babel-plugin-module-resolver: ^4.1.0
-    bower-config: ^1.4.3
-    bower-endpoint-parser: 0.2.2
+    "@pnpm/find-workspace-dir": ^6.0.2
     broccoli: ^3.5.2
-    broccoli-amd-funnel: ^2.0.1
-    broccoli-babel-transpiler: ^7.8.1
     broccoli-builder: ^0.18.14
     broccoli-concat: ^4.2.5
     broccoli-config-loader: ^1.0.1
@@ -15016,28 +8509,29 @@ __metadata:
     calculate-cache-key-for-tree: ^2.0.0
     capture-exit: ^2.0.0
     chalk: ^4.1.2
-    ci-info: ^3.7.0
+    ci-info: ^3.8.0
     clean-base-url: ^1.0.0
     compression: ^1.7.4
     configstore: ^5.0.1
     console-ui: ^3.1.2
+    content-tag: ^1.2.2
     core-object: ^3.1.5
     dag-map: ^2.0.2
     diff: ^5.1.0
     ember-cli-is-package-missing: ^1.0.0
     ember-cli-lodash-subset: ^2.0.1
     ember-cli-normalize-entity-name: ^1.0.0
-    ember-cli-preprocess-registry: ^3.3.0
+    ember-cli-preprocess-registry: ^5.0.1
     ember-cli-string-utils: ^1.1.0
     ensure-posix-path: ^1.1.1
     execa: ^5.1.1
     exit: ^0.1.2
     express: ^4.18.1
-    filesize: ^10.0.5
+    filesize: ^10.0.8
     find-up: ^5.0.0
     find-yarn-workspace-root: ^2.0.0
     fixturify-project: ^2.1.1
-    fs-extra: ^11.1.0
+    fs-extra: ^11.1.1
     fs-tree-diff: ^2.0.1
     get-caller-file: ^2.0.5
     git-repo-info: ^2.1.1
@@ -15048,16 +8542,14 @@ __metadata:
     heimdalljs-logger: ^0.1.10
     http-proxy: ^1.18.1
     inflection: ^2.0.1
-    inquirer: ^8.2.1
+    inquirer: ^9.1.5
     is-git-url: ^1.0.0
     is-language-code: ^3.1.0
     isbinaryfile: ^5.0.0
-    js-yaml: ^4.1.0
-    leek: 0.0.24
-    lodash.template: ^4.5.0
+    lodash: ^4.17.21
     markdown-it: ^13.0.1
     markdown-it-terminal: ^0.4.0
-    minimatch: ^7.4.1
+    minimatch: ^7.4.3
     morgan: ^1.10.0
     nopt: ^3.0.6
     npm-package-arg: ^10.1.0
@@ -15070,7 +8562,7 @@ __metadata:
     remove-types: ^1.0.0
     resolve: ^1.22.1
     resolve-package-path: ^4.0.3
-    safe-stable-stringify: ^2.4.2
+    safe-stable-stringify: ^2.4.3
     sane: ^5.0.1
     semver: ^7.3.5
     silent-error: ^1.1.1
@@ -15080,55 +8572,30 @@ __metadata:
     testem: ^3.10.1
     tiny-lr: ^2.0.0
     tree-sync: ^2.1.0
-    uuid: ^9.0.0
     walk-sync: ^3.0.0
     watch-detector: ^1.0.2
     workerpool: ^6.4.0
     yam: ^1.0.0
   bin:
     ember: bin/ember
-  checksum: 3e6066637211d98994b44b85b33070cc4614f6f1500eebfdc64886880300602a49220b788c4359548d6f305c47844b18ef5bbe0b64d4d61d6865811a15a712b0
-  languageName: node
-  linkType: hard
-
-"ember-compatibility-helpers@npm:^1.1.2":
-  version: 1.2.4
-  resolution: "ember-compatibility-helpers@npm:1.2.4"
-  dependencies:
-    babel-plugin-debug-macros: ^0.2.0
-    ember-cli-version-checker: ^5.1.1
-    fs-extra: ^9.1.0
-    semver: ^5.4.1
-  checksum: f220953b2357173486e6d76f76253bce2d8b420d64f2517be41db39612c1becd9e0d078603d5c4445b73df7ff4bf039e777f0bcac8c67e7015abd2409417c819
-  languageName: node
-  linkType: hard
-
-"ember-compatibility-helpers@npm:^1.2.0, ember-compatibility-helpers@npm:^1.2.1":
-  version: 1.2.5
-  resolution: "ember-compatibility-helpers@npm:1.2.5"
-  dependencies:
-    babel-plugin-debug-macros: ^0.2.0
-    ember-cli-version-checker: ^5.1.1
-    fs-extra: ^9.1.0
-    semver: ^5.4.1
-  checksum: ee8625d240daa2ef6c6d14048d38808cb4c7054547c73715130817e3e226300fdf3489be9112205022543fc1d713bcbdea17b03b29480481e04d964e31fb3e86
+  checksum: cba88bd2ae0498500ccec2ac6245118388ef8e9245e2e5082265d4b5ef0e16f77f26aa1601cd58674e9efc460d1093bfe7b6da45b19bf445e0f4986a54e65793
   languageName: node
   linkType: hard
 
-"ember-compatibility-helpers@npm:^1.2.5":
-  version: 1.2.6
-  resolution: "ember-compatibility-helpers@npm:1.2.6"
+"ember-compatibility-helpers@npm:^1.1.2, ember-compatibility-helpers@npm:^1.2.0, ember-compatibility-helpers@npm:^1.2.1, ember-compatibility-helpers@npm:^1.2.5":
+  version: 1.2.7
+  resolution: "ember-compatibility-helpers@npm:1.2.7"
   dependencies:
     babel-plugin-debug-macros: ^0.2.0
     ember-cli-version-checker: ^5.1.1
     find-up: ^5.0.0
     fs-extra: ^9.1.0
     semver: ^5.4.1
-  checksum: 1ab8ea51c8d010e02f06668820f1a5ee572ffc0d0ca8eb8b740641e736c8ed67f294d3321876eb9d5dc994c789cd9432632dd748b040c256eabe87e3b941fafc
+  checksum: d889f3754610afe0e3869cb0109fbc09c24f37b9e72d1214f5969bf7c3dac39689c639acb7c26db23197b7e44213693fa3a74343323edc16be0f795e1cb7548d
   languageName: node
   linkType: hard
 
-"ember-composable-helpers@npm:5.0.0, ember-composable-helpers@npm:^5.0.0":
+"ember-composable-helpers@npm:5.0.0":
   version: 5.0.0
   resolution: "ember-composable-helpers@npm:5.0.0"
   dependencies:
@@ -15140,141 +8607,65 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-concurrency-decorators@npm:^2.0.0":
-  version: 2.0.3
-  resolution: "ember-concurrency-decorators@npm:2.0.3"
-  dependencies:
-    "@ember-decorators/utils": ^6.1.0
-    ember-cli-babel: ^7.19.0
-    ember-cli-htmlbars: ^4.3.1
-    ember-cli-typescript: ^3.1.4
-  checksum: c231097d74208759ee4e60fd10828693b41b3ab4dd77f280bd7559cd20c607fe518dcd49f347e91e9a5052126abb2414efa405dc54619a330b1b832b39871c95
-  languageName: node
-  linkType: hard
-
-"ember-concurrency@npm:2.3.4":
-  version: 2.3.4
-  resolution: "ember-concurrency@npm:2.3.4"
+"ember-concurrency@npm:^4.0.2, ember-concurrency@npm:~4.0.3":
+  version: 4.0.4
+  resolution: "ember-concurrency@npm:4.0.4"
   dependencies:
+    "@babel/helper-module-imports": ^7.22.15
     "@babel/helper-plugin-utils": ^7.12.13
     "@babel/types": ^7.12.13
-    "@glimmer/tracking": ^1.0.4
-    ember-cli-babel: ^7.26.11
-    ember-cli-babel-plugin-helpers: ^1.1.1
-    ember-cli-htmlbars: ^5.7.1
-    ember-compatibility-helpers: ^1.2.0
-    ember-destroyable-polyfill: ^2.0.2
-  checksum: 14b68d1da5575b14dc038af8146b8de29f5b0b961ca57275d1930cf77f8b0d8ba20105d40a5755b79c3f8ad65449195beb94029a687c72a07486c5024ab98154
-  languageName: node
-  linkType: hard
-
-"ember-concurrency@npm:>=1.0.0 <3":
-  version: 2.2.0
-  resolution: "ember-concurrency@npm:2.2.0"
-  dependencies:
-    "@glimmer/tracking": ^1.0.4
-    ember-cli-babel: ^7.26.6
-    ember-cli-htmlbars: ^5.7.1
-    ember-compatibility-helpers: ^1.2.0
-    ember-destroyable-polyfill: ^2.0.2
-  checksum: 3a9bb4c098b4407125e63bd1e25b598c0fae491db240dea2332e7116e5b6538ca2fb71e124b6da31a5f953a78fe7ebe03a7881c53e950203e808456997c7d187
-  languageName: node
-  linkType: hard
-
-"ember-copy@npm:2.0.1":
-  version: 2.0.1
-  resolution: "ember-copy@npm:2.0.1"
-  dependencies:
-    ember-cli-babel: ^7.22.1
-  checksum: addeba5ce864c1dcea4ec475bab51c4996dcd575adab28fb3a5fb082fa1db1f8530236ccfbb2c66fd594d8b11410f17eece6651957bd6b0804eaa870915e84ba
-  languageName: node
-  linkType: hard
-
-"ember-d3@npm:^0.5.1":
-  version: 0.5.1
-  resolution: "ember-d3@npm:0.5.1"
-  dependencies:
-    broccoli-funnel: ^2.0.0
-    broccoli-merge-trees: ^3.0.0
-    d3: ^5.0.0
-    d3-selection-multi: ^1.0.1
-    ember-cli-babel: ^7.1.2
-  checksum: 81256d9a3f7647c5b9689a2e9973fdbcc29fe03ff795a66a3fc6202fd978c6207d1655b44f9a1379f8d4c997283813f25acaf310a1005cc90b74344bf5ef04b5
-  languageName: node
-  linkType: hard
-
-"ember-data@npm:~4.12.4":
-  version: 4.12.5
-  resolution: "ember-data@npm:4.12.5"
-  dependencies:
-    "@ember-data/adapter": 4.12.5
-    "@ember-data/debug": 4.12.5
-    "@ember-data/graph": 4.12.5
-    "@ember-data/json-api": 4.12.5
-    "@ember-data/legacy-compat": 4.12.5
-    "@ember-data/model": 4.12.5
-    "@ember-data/private-build-infra": 4.12.5
-    "@ember-data/request": 4.12.5
-    "@ember-data/serializer": 4.12.5
-    "@ember-data/store": 4.12.5
-    "@ember-data/tracking": 4.12.5
-    "@ember/edition-utils": ^1.2.0
-    "@embroider/macros": ^1.10.0
-    "@glimmer/env": ^0.1.7
-    broccoli-merge-trees: ^4.2.0
-    ember-auto-import: ^2.6.1
-    ember-cli-babel: ^7.26.11
-    ember-inflector: ^4.0.2
+    "@embroider/addon-shim": ^1.8.7
+    decorator-transforms: ^1.0.1
   peerDependencies:
-    "@ember/string": ^3.0.1
-  checksum: c8649d42c534b8038a43bc3fd72bbfc390e39b9fd50f2903ac5aaed2d36cff86a48d6ab418c8055591e9a170cf310fae3cba8ab4d57e7d46bddf45b14b104e67
-  languageName: node
-  linkType: hard
-
-"ember-decorators@npm:^6.1.1":
-  version: 6.1.1
-  resolution: "ember-decorators@npm:6.1.1"
-  dependencies:
-    "@ember-decorators/component": ^6.1.1
-    "@ember-decorators/object": ^6.1.1
-    ember-cli-babel: ^7.7.3
-  checksum: ffe95d41dae393586190340c0e65d772c2132ff50269ef21a408d999e10fff79214ac9e14a49e1a94bf3fdd18c660759bc23c79de9ca41375f0e9ba8204b5168
-  languageName: node
-  linkType: hard
-
-"ember-destroyable-polyfill@npm:^2.0.1, ember-destroyable-polyfill@npm:^2.0.2, ember-destroyable-polyfill@npm:^2.0.3":
-  version: 2.0.3
-  resolution: "ember-destroyable-polyfill@npm:2.0.3"
-  dependencies:
-    ember-cli-babel: ^7.22.1
-    ember-cli-version-checker: ^5.1.1
-    ember-compatibility-helpers: ^1.2.1
-  checksum: 1c96c453a7be71a76a117421a5571a073cd85c56525a2de146728091f2c639fff93216eedae2baf437576d62906e885adce996619104bcc28c3af66bdf720099
+    "@glint/template": ">= 1.0.0"
+  peerDependenciesMeta:
+    "@glint/template":
+      optional: true
+  checksum: c2cb01f28843f20176a09ee8500a8ff104bb2776a40d8273784e8c87508fa927de76fa69bef37b49ab58451cb00b751e6da308b86761891a45f87a4e7c35a2d5
   languageName: node
   linkType: hard
 
-"ember-element-helper@npm:^0.6.0":
-  version: 0.6.1
-  resolution: "ember-element-helper@npm:0.6.1"
+"ember-data@npm:~5.3.13":
+  version: 5.3.13
+  resolution: "ember-data@npm:5.3.13"
   dependencies:
-    "@embroider/util": ^0.39.1 || ^0.40.0 || ^0.41.0 || ^1.0.0
-    ember-cli-babel: ^7.26.11
-    ember-cli-htmlbars: ^6.0.1
-  peerDependencies:
-    ember-source: ^3.8 || 4
-  checksum: 36110a5b5a504169abe80d004f8ad9eba56c0d8b602211606ad6ab88d541b93f7621a740c0a4a972036d5b390e42f59d638575dd4748b184e1d6f33586851e03
+    "@ember-data/adapter": 5.3.13
+    "@ember-data/debug": 5.3.13
+    "@ember-data/graph": 5.3.13
+    "@ember-data/json-api": 5.3.13
+    "@ember-data/legacy-compat": 5.3.13
+    "@ember-data/model": 5.3.13
+    "@ember-data/request": 5.3.13
+    "@ember-data/request-utils": 5.3.13
+    "@ember-data/serializer": 5.3.13
+    "@ember-data/store": 5.3.13
+    "@ember-data/tracking": 5.3.13
+    "@ember/edition-utils": ^1.2.0
+    "@embroider/macros": ^1.16.12
+    "@warp-drive/build-config": 0.0.3
+    "@warp-drive/core-types": 0.0.3
+  peerDependencies:
+    "@ember/test-helpers": ^3.3.0 || ^4.0.4 || ^5.1.0
+    "@ember/test-waiters": ^3.1.0 || ^4.0.0
+    ember-source: 3.28.12 || ^4.0.4 || ^5.0.0 || ^6.0.0
+    qunit: ^2.18.0
+  peerDependenciesMeta:
+    "@ember/test-helpers":
+      optional: true
+    "@ember/test-waiters":
+      optional: true
+    qunit:
+      optional: true
+  checksum: 1f86ca9caf0a2630045503c76ee2c715fd13e577ed827202cefa261df08845e643fa7b5c65eef586c10854cf8c4714ccf27ffdb4f753ea0a5c8b9c23238b91b9
   languageName: node
   linkType: hard
 
-"ember-element-helper@npm:^0.8.5":
-  version: 0.8.5
-  resolution: "ember-element-helper@npm:0.8.5"
+"ember-element-helper@npm:^0.8.6, ember-element-helper@npm:^0.8.7":
+  version: 0.8.8
+  resolution: "ember-element-helper@npm:0.8.8"
   dependencies:
-    "@embroider/addon-shim": 1.8.3
-    "@embroider/util": ^1.0.0
-  peerDependencies:
-    ember-source: ^3.8 || ^4.0.0 || >= 5.0.0
-  checksum: 7be5fa71b172dc74f24bd10bdc179d9e9dcbaaeab5c78763a24dd6f6d384768d6835291771839c6b530940c3ddd259bd7fdc8242576c9cc31e74d6bb35df435b
+    "@embroider/addon-shim": ^1.8.3
+  checksum: 9d9dbe10ed62073f68e68bc54bcfe53d2b7eae165e4e69c197676feba5043d0ada808dc87e8e0640a5c71a30323ba11ac99083b9c2ff3fb4435af92866c8dbd5
   languageName: node
   linkType: hard
 
@@ -15307,9 +8698,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-exam@npm:^9.0.0":
-  version: 9.0.0
-  resolution: "ember-exam@npm:9.0.0"
+"ember-exam@npm:~9.1.0":
+  version: 9.1.0
+  resolution: "ember-exam@npm:9.1.0"
   dependencies:
     "@babel/core": ^7.23.6
     chalk: ^5.3.0
@@ -15328,56 +8719,36 @@ __metadata:
     ember-qunit: "*"
     ember-source: ">= 4.0.0"
     qunit: "*"
-  checksum: 5ff9dd11d89d96d6ca018e145eefad558f38b93ee95d39108bb919514c66c731713b00c68725e2377da738c1cf4854ce89b6132d2df44be93a4d99900f589a7b
-  languageName: node
-  linkType: hard
-
-"ember-fetch@npm:^8.1.2":
-  version: 8.1.2
-  resolution: "ember-fetch@npm:8.1.2"
-  dependencies:
-    abortcontroller-polyfill: ^1.7.3
-    broccoli-concat: ^4.2.5
-    broccoli-debug: ^0.6.5
-    broccoli-merge-trees: ^4.2.0
-    broccoli-rollup: ^2.1.1
-    broccoli-stew: ^3.0.0
-    broccoli-templater: ^2.0.1
-    calculate-cache-key-for-tree: ^2.0.0
-    caniuse-api: ^3.0.0
-    ember-cli-babel: ^7.23.1
-    ember-cli-typescript: ^4.1.0
-    ember-cli-version-checker: ^5.1.2
-    node-fetch: ^2.6.1
-    whatwg-fetch: ^3.6.2
-  checksum: 00b864c04776493d7c6e06c71709edb9045d4fa6c25392988dad218487d5440a8b00e994e951c6279da2522c6bb12e0780983d0083f93524e68fcdcd77dec62b
+  checksum: 162b4a7a6adca4948c464a7eff78398afcab010a2210befc9198a443c08559fa457c9cf2d38b9dabe33a78a5dcd0b02f26f94c6798adc87deb13a1838a013225
   languageName: node
   linkType: hard
 
-"ember-focus-trap@npm:^1.1.0":
-  version: 1.1.0
-  resolution: "ember-focus-trap@npm:1.1.0"
+"ember-focus-trap@npm:^1.1.1":
+  version: 1.1.1
+  resolution: "ember-focus-trap@npm:1.1.1"
   dependencies:
     "@embroider/addon-shim": ^1.0.0
     focus-trap: ^6.7.1
   peerDependencies:
-    ember-source: ^4.0.0 || ^5.0.0
-  checksum: 1f19c50b92c56f04681cd59ac3a88a520a53403278105aab2f4edc64df6ce3d0ceb53409e3309822bd4ced60063d9e8657117c708f90da9038c8140737e8d831
+    ember-source: ">= 4.0.0"
+  checksum: a6119da9c0985d46dc28fff43b94f4d4a9e0865822eebce883de69e29fc199022a4f3fa74f9ae1564b63a504a12beb840dc334fdd0ebadd1d5e2263185a33224
   languageName: node
   linkType: hard
 
-"ember-get-config@npm:0.2.4 - 0.5.0":
-  version: 0.5.0
-  resolution: "ember-get-config@npm:0.5.0"
+"ember-functions-as-helper-polyfill@npm:^2.1.2":
+  version: 2.1.3
+  resolution: "ember-functions-as-helper-polyfill@npm:2.1.3"
   dependencies:
-    broccoli-file-creator: ^1.1.1
-    ember-cli-babel: ^7.26.6
-    ember-cli-htmlbars: ^5.7.1
-  checksum: c9ca75a44764705ea62324dba90770ae608d8614c1222ddc9f22ede506f056e65d0e2e518fbc3aa2665ea32e2d4c2735fff9fe4e031d1827c3ebaad3b03bfea2
+    ember-cli-babel: ^7.26.11
+    ember-cli-typescript: ^5.0.0
+    ember-cli-version-checker: ^5.1.2
+  peerDependencies:
+    ember-source: ^3.25.0 || >=4.0.0
+  checksum: b19b758a089450913b825ad72857f67cc0a4549558950f1dcaf987dfa89c28d4e23d2829198ab4640d5261975889066284e3ac313978d7339791a28458b2350e
   languageName: node
   linkType: hard
 
-"ember-get-config@npm:^1.0.2 || ^2.0.0, ember-get-config@npm:^2.1.1":
+"ember-get-config@npm:0.2.4 - 0.5.0 || ^1.0.0 || ^2.1.1, ember-get-config@npm:^2.1.1":
   version: 2.1.1
   resolution: "ember-get-config@npm:2.1.1"
   dependencies:
@@ -15387,19 +8758,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-in-element-polyfill@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "ember-in-element-polyfill@npm:1.0.1"
+"ember-get-config@npm:^1.0.2":
+  version: 1.1.0
+  resolution: "ember-get-config@npm:1.1.0"
   dependencies:
-    debug: ^4.3.1
-    ember-cli-babel: ^7.23.1
-    ember-cli-htmlbars: ^5.3.1
-    ember-cli-version-checker: ^5.1.2
-  checksum: fda95b1bd56dd2eefea014e9131eb03d5e3f34aa08c4f7b2fd4e717d001aa3a029c7a9d1725975085641924be7924c43f12ecade5642677d405f9566776c1507
+    "@embroider/macros": ^0.50.0 || ^1.0.0
+    ember-cli-babel: ^7.26.6
+  checksum: 5c9b7bb4cc691d8dd181a0883f6d2259f0f3aa05ea5aa1913127abe3560c95add502a3b080cfac273653c32d387dc96c0054157b5fc2b06076d057d83cab90eb
   languageName: node
   linkType: hard
 
-"ember-inflector@npm:4.0.2, ember-inflector@npm:^2.0.0 || ^3.0.0 || ^4.0.2, ember-inflector@npm:^4.0.2":
+"ember-inflector@npm:4.0.2":
   version: 4.0.2
   resolution: "ember-inflector@npm:4.0.2"
   dependencies:
@@ -15408,66 +8777,67 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-keyboard@npm:^8.2.1":
-  version: 8.2.1
-  resolution: "ember-keyboard@npm:8.2.1"
+"ember-inflector@npm:^2.0.0 || ^3.0.0 || ^4.0.2 || ^5.0.0":
+  version: 5.0.2
+  resolution: "ember-inflector@npm:5.0.2"
   dependencies:
-    "@embroider/addon-shim": ^1.8.4
-    ember-destroyable-polyfill: ^2.0.3
-    ember-modifier: ^2.1.2 || ^3.1.0 || ^4.0.0
-    ember-modifier-manager-polyfill: ^1.2.0
-  peerDependencies:
-    "@ember/test-helpers": ^2.6.0 || ^3.0.0
-  peerDependenciesMeta:
-    "@ember/test-helpers":
-      optional: true
-  checksum: cfb4120aaf3b1ff3aba8ba1619b0597c6738abde31d1e0719d8bbf69512fb9967fc76bc85557351ec42856bb9b6c47354634f22f0accab0e15743d9f0e3f2be4
+    "@embroider/addon-shim": ^1.8.7
+    decorator-transforms: ^2.0.0
+  checksum: 7bdc8a30559a514df0d423aa9155bee9a6be308d40a2644202a66d2aef916fc40ada329e3cbd2357e0aff719e87a650a0731dc6db5275852707faa625a0e0d90
   languageName: node
   linkType: hard
 
-"ember-load-initializers@npm:^2.1.2":
-  version: 2.1.2
-  resolution: "ember-load-initializers@npm:2.1.2"
+"ember-lifeline@npm:^7.0.0":
+  version: 7.0.0
+  resolution: "ember-lifeline@npm:7.0.0"
   dependencies:
-    ember-cli-babel: ^7.13.0
-    ember-cli-typescript: ^2.0.2
-  checksum: 104b38cb4b755894b65d39ab94f316bdb1b571884b8e52118ced0bfeb06de8e3e7685dcc4579fd8dae57fc6c62e2e50df042e782e960565e05a4cf4eaf6db337
+    "@embroider/addon-shim": ^1.6.0
+  peerDependencies:
+    "@ember/test-helpers": ">= 1.0.0"
+  peerDependenciesMeta:
+    "@ember/test-helpers":
+      optional: true
+  checksum: 8a363f8b374b58b74ed89eae1217e0556b6832aab420a347e5bc167c88c33ee1b57a4b1871bf5c71a25fbaa36988508bd8c31a19939f389a067ddf34408718c9
   languageName: node
   linkType: hard
 
-"ember-maybe-in-element@npm:^2.0.3":
-  version: 2.0.3
-  resolution: "ember-maybe-in-element@npm:2.0.3"
-  dependencies:
-    ember-cli-babel: ^7.21.0
-    ember-cli-htmlbars: ^5.2.0
-    ember-cli-version-checker: ^5.1.1
-    ember-in-element-polyfill: ^1.0.1
-  checksum: 4bd0e66f748eac053dc2fed2b19a227bd159eb84cb1084bea2941af454a1135969a6efb36c298a9c06c36a7697e34819e9ff0ef1dcb18fa64d11dce09b75b523
+"ember-load-initializers@npm:~3.0.1":
+  version: 3.0.1
+  resolution: "ember-load-initializers@npm:3.0.1"
+  peerDependencies:
+    ember-source: ">= 5"
+  checksum: 67d66085792585cd3674602c92a07a21033a15d0af33423dd94f5c9468824d4bf77860aed986f87e14250e0102e80277e3413d288ff7788cba4f93761588b79d
   languageName: node
   linkType: hard
 
-"ember-modal-dialog@npm:^4.0.1":
-  version: 4.0.1
-  resolution: "ember-modal-dialog@npm:4.0.1"
+"ember-modal-dialog@npm:~4.1.5":
+  version: 4.1.5
+  resolution: "ember-modal-dialog@npm:4.1.5"
   dependencies:
-    "@embroider/macros": ^1.0.0
-    "@embroider/util": ^1.0.0
-    ember-cli-babel: ^7.26.8
-    ember-cli-htmlbars: ^6.0.1
-    ember-cli-version-checker: ^2.1.0
-    ember-decorators: ^6.1.1
+    "@babel/core": ^7.26.0
+    "@embroider/macros": ^1.16.9
+    "@embroider/util": ^1.13.2
+    ember-cli-babel: ^8.2.0
+    ember-cli-htmlbars: ^6.3.0
+    ember-cli-version-checker: ^5.1.2
     ember-wormhole: ^0.6.0
   peerDependencies:
-    ember-tether: ^2.0.1
+    "@ember/string": ^3.0.0 || ^4.0.0
+    ember-tether: ^3.0.0
+    liquid-tether: ^2.0.7
+    liquid-wormhole: ^3.0.1
   peerDependenciesMeta:
     ember-tether:
       optional: true
-  checksum: d8005d3f9e0aab6fc4ce3f16a8bfb5ff9308e8ab9292b7e1be84e657f179f749414c9b0c029bf5c060526de0058fcb0acb38c3d19c80ad67e9ceb034de4b4e0c
+    liquid-tether:
+      optional: true
+    liquid-wormhole:
+      optional: true
+  checksum: 0f19d38d1e2dc1649ecc3a5739d68cf858e08943151ccce555c8fc7094d0efa9104f9880e31f79992bf2e990b9db7a622240c6776fc74aab498f01ef7204a9f3
   languageName: node
   linkType: hard
 
-"ember-modifier-manager-polyfill@npm:^1.1.0, ember-modifier-manager-polyfill@npm:^1.2.0":
+"ember-modifier-manager-polyfill@npm:^1.2.0":
   version: 1.2.0
   resolution: "ember-modifier-manager-polyfill@npm:1.2.0"
   dependencies:
@@ -15478,22 +8848,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-modifier@npm:^2.1.2 || ^3.1.0 || ^4.0.0, ember-modifier@npm:^3.2.7 || ^4.0.0, ember-modifier@npm:^4.1.0":
-  version: 4.1.0
-  resolution: "ember-modifier@npm:4.1.0"
-  dependencies:
-    "@embroider/addon-shim": ^1.8.4
-    ember-cli-normalize-entity-name: ^1.0.0
-    ember-cli-string-utils: ^1.1.0
-  peerDependencies:
-    ember-source: "*"
-  peerDependenciesMeta:
-    ember-source:
-      optional: true
-  checksum: 5e14a864de2184c07e59fb9bc76a09ae25d1bd37722a94751a3cef6165df22027007696c4dda03e1862cb3bbeefb046772810dda3104d05c7fe8476389c34a77
-  languageName: node
-  linkType: hard
-
 "ember-modifier@npm:^3.2.0, ember-modifier@npm:^3.2.7":
   version: 3.2.7
   resolution: "ember-modifier@npm:3.2.7"
@@ -15507,46 +8861,39 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-native-dom-helpers@npm:^0.7.0":
-  version: 0.7.0
-  resolution: "ember-native-dom-helpers@npm:0.7.0"
-  dependencies:
-    broccoli-funnel: ^1.1.0
-    ember-cli-babel: ^6.6.0
-  checksum: 958ed8ff1b1d31c598ba73dfb53d551448fcb377a02ed224e93360d39369c0937063fce1da72f1c2329d85b77701fc84646b248fb2bee83e0b8535566a9fa436
-  languageName: node
-  linkType: hard
-
-"ember-page-title@npm:^7.0.0":
-  version: 7.0.0
-  resolution: "ember-page-title@npm:7.0.0"
+"ember-modifier@npm:^3.2.7 || ^4.0.0, ember-modifier@npm:^4.2.0, ember-modifier@npm:^4.2.2, ember-modifier@npm:~4.2.0":
+  version: 4.2.2
+  resolution: "ember-modifier@npm:4.2.2"
   dependencies:
-    ember-cli-babel: ^7.26.6
-  checksum: 2533d6fa3aaeb37950f44dc8e50ce2e30008106fbded78136fb4bbfc8bc3240b24ccf0cfadb71154744b0483ae06a9d9b557edfbdbe397c0e8096448c76095ed
+    "@embroider/addon-shim": ^1.8.7
+    decorator-transforms: ^2.0.0
+    ember-cli-normalize-entity-name: ^1.0.0
+    ember-cli-string-utils: ^1.1.0
+  checksum: 11a57734ed7fe41bd481954f5e07df24fedf008238d301f3993907c99d282ef50ea83ba82efa2dad4447afa27cc2dbb5cbb416f7382794ab744d6f3581acf65f
   languageName: node
   linkType: hard
 
-"ember-power-select@npm:6.0.1":
-  version: 6.0.1
-  resolution: "ember-power-select@npm:6.0.1"
+"ember-power-select@npm:^8.6.2, ember-power-select@npm:~8.7.0":
+  version: 8.7.1
+  resolution: "ember-power-select@npm:8.7.1"
   dependencies:
-    "@embroider/util": ^1.0.0
-    "@glimmer/component": ^1.1.2
-    "@glimmer/tracking": ^1.1.2
-    ember-assign-helper: ^0.4.0
-    ember-basic-dropdown: ^6.0.0
-    ember-cli-babel: ^7.26.11
-    ember-cli-htmlbars: ^6.1.0
-    ember-cli-typescript: ^4.2.0
-    ember-concurrency: ">=1.0.0 <3"
-    ember-concurrency-decorators: ^2.0.0
-    ember-text-measurer: ^0.6.0
-    ember-truth-helpers: ^3.0.0
-  checksum: 3cefce209966a3d419796275f89252216e66c265186f22572962be961d071cfa46548ba067ec9af9c0e100c1979f845d71d2d86bfde46796ce56840e0d8eeedf
+    "@embroider/addon-shim": ^1.10.0
+    "@embroider/util": ^1.13.2
+    decorator-transforms: ^2.3.0
+    ember-assign-helper: ^0.5.0
+    ember-lifeline: ^7.0.0
+    ember-modifier: ^4.2.0
+    ember-truth-helpers: ^4.0.3
+  peerDependencies:
+    "@ember/test-helpers": ^2.9.4 || ^3.2.1 || ^4.0.2 || ^5.0.0
+    "@glimmer/component": ^1.1.2 || ^2.0.0
+    ember-basic-dropdown: ^8.5.1
+    ember-concurrency: ^4.0.4
+  checksum: a8263edbb930fde10edcdc62abaeb380886c5fc378d446e5015a3eafdc1ec76b6d43ba81c6556628adad4ae4e69ae844086f1ab06cdc44961e5afb4d21fa23f1
   languageName: node
   linkType: hard
 
-"ember-qrcode-shim@npm:^0.4.0":
+"ember-qrcode-shim@npm:~0.4.0":
   version: 0.4.0
   resolution: "ember-qrcode-shim@npm:0.4.0"
   dependencies:
@@ -15555,24 +8902,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-qunit@npm:^6.2.0":
-  version: 6.2.0
-  resolution: "ember-qunit@npm:6.2.0"
+"ember-qunit@npm:~8.1.1":
+  version: 8.1.1
+  resolution: "ember-qunit@npm:8.1.1"
   dependencies:
-    broccoli-funnel: ^3.0.8
-    broccoli-merge-trees: ^3.0.2
-    common-tags: ^1.8.0
-    ember-auto-import: ^2.6.0
-    ember-cli-babel: ^7.26.11
-    ember-cli-test-loader: ^3.0.0
-    resolve-package-path: ^4.0.3
-    silent-error: ^1.1.1
-    validate-peer-dependencies: ^2.2.0
+    "@embroider/addon-shim": ^1.8.6
+    "@embroider/macros": ^1.13.1
+    ember-cli-test-loader: ^3.1.0
+    qunit-theme-ember: ^1.0.0
   peerDependencies:
-    "@ember/test-helpers": ^2.9.3
-    ember-source: ">=3.28"
+    "@ember/test-helpers": ">=3.0.3"
+    ember-source: ">=4.0.0"
     qunit: ^2.13.0
-  checksum: c9058d02d78efe06887ee6993908d8f45592c4369e0f72a57045f5ae27df94ea7497866bdf484f12eaddfac23ae4051a259bae0280a70c0dd50a8260eae3126c
+  checksum: 9cacb25e1d26d04b469b2d5eddacb2970ecd038e74c517f0a0d02f6b6b4f386624eb3a44b27c414ac62107866ebae7bcd549de53e7b0bc91148fe80cf3bc2aa2
   languageName: node
   linkType: hard
 
@@ -15587,35 +8929,30 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-resolver@npm:^10.0.0":
-  version: 10.1.1
-  resolution: "ember-resolver@npm:10.1.1"
+"ember-resolver@npm:~13.1.0":
+  version: 13.1.1
+  resolution: "ember-resolver@npm:13.1.1"
   dependencies:
     ember-cli-babel: ^7.26.11
-  peerDependencies:
-    "@ember/string": ^3.0.1
-    ember-source: ^4.8.3 || >= 5.0.0
-  peerDependenciesMeta:
-    ember-source:
-      optional: true
-  checksum: 3ffbc0789f651d834455aeef4a248840dfea0ca6ab9192bbab66e4bff2f5f5e33c51c24e35d41bfeb08d980e1e7b287eecef9e73c39baee57468e5edc798fa29
+  checksum: 2e4644a270a22914c6aabe848e958f7708238a8a0b4727651360d94b1d03f00dabb8c88f970847b2b4e5f70fafd3b88a477ed1f49e474d7d1fe729481d55903c
   languageName: node
   linkType: hard
 
-"ember-resources@npm:^5.0.1":
-  version: 5.6.4
-  resolution: "ember-resources@npm:5.6.4"
+"ember-resources@npm:^6.0.0":
+  version: 6.5.2
+  resolution: "ember-resources@npm:6.5.2"
   dependencies:
     "@babel/runtime": ^7.17.8
     "@embroider/addon-shim": ^1.2.0
-    "@embroider/macros": ^1.2.0
-  peerDependencies:
-    "@ember/test-waiters": ^3.0.0
-    "@glimmer/component": ^1.1.2
-    "@glimmer/tracking": ^1.1.2
-    "@glint/template": ">= 0.8.3"
-    ember-concurrency: ^2.0.0
-    ember-source: ">= 3.28.0"
+    "@embroider/macros": ^1.12.3
+    ember-async-data: ^1.0.1
+  peerDependencies:
+    "@ember/test-waiters": ">= 3.0.0"
+    "@glimmer/component": ">= 1.1.2"
+    "@glimmer/tracking": ">= 1.1.2"
+    "@glint/template": ^1.0.0-beta.3 || >= 1.0.0
+    ember-concurrency: ^2.0.0 || >= 3.0.0
+    ember-source: ^3.28.0 || ^4.0.0 || >= 5.0.0
   peerDependenciesMeta:
     "@ember/test-waiters":
       optional: true
@@ -15623,7 +8960,7 @@ __metadata:
       optional: true
     ember-concurrency:
       optional: true
-  checksum: 9edb126ee307251080380d421aba42f330f76c6e295046ae59b48c3162d27e83223732e398f8373f933d120f38831e791e0fd31e63c70315982166db399d2b33
+  checksum: 77e85a7951a3ce6785d7355161366c3a2f680a72cfc68c543215c57ae826dc4125059da355d56be4a4c1c8469c37c0e35c10e8034703f3f020401716de252c54
   languageName: node
   linkType: hard
 
@@ -15636,20 +8973,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-rfc176-data@npm:^0.3.13":
+"ember-rfc176-data@npm:^0.3.15, ember-rfc176-data@npm:^0.3.17":
   version: 0.3.18
   resolution: "ember-rfc176-data@npm:0.3.18"
   checksum: 897ac88b54fae39b3bda1c3aefb807f5ffc394c34e33c47b20b8b983e090716492a7d61acadc06771988285fe4e2b18c22faaf0b3b340d810dbbce2fe1a2a3e5
   languageName: node
   linkType: hard
 
-"ember-rfc176-data@npm:^0.3.15, ember-rfc176-data@npm:^0.3.17":
-  version: 0.3.17
-  resolution: "ember-rfc176-data@npm:0.3.17"
-  checksum: bc35da90149178d4c0e67097446d46ab69910571fcd02308dead097ca21c6d86767c4031d2bba4df267213ce6c43d1fe5660ded9e061051c1d84ba171fd02366
-  languageName: node
-  linkType: hard
-
 "ember-router-generator@npm:^2.0.0":
   version: 2.0.0
   resolution: "ember-router-generator@npm:2.0.0"
@@ -15661,15 +8991,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-router-helpers@npm:^0.4.0":
-  version: 0.4.0
-  resolution: "ember-router-helpers@npm:0.4.0"
-  dependencies:
-    ember-cli-babel: ^7.20.0
-  checksum: e847ceb1061f87416d6bb5d72ef539fda738a24086051bc94d740117c6353b3406c65247ac8190b8572df008a70d9f801e224d38489170129c5ca6c4ec7f206e
-  languageName: node
-  linkType: hard
-
 "ember-service-worker@meirish/ember-service-worker#configurable-scope":
   version: 9.0.1
   resolution: "ember-service-worker@https://github.com/meirish/ember-service-worker.git#commit=dda14187aace0d73ecdb6a55beac2194a3aec01b"
@@ -15689,36 +9010,57 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-sinon@npm:^4.0.0":
-  version: 4.1.1
-  resolution: "ember-sinon@npm:4.1.1"
+"ember-sinon-qunit@npm:~7.5.0":
+  version: 7.5.0
+  resolution: "ember-sinon-qunit@npm:7.5.0"
   dependencies:
-    broccoli-funnel: ^2.0.0
-    broccoli-merge-trees: ^3.0.0
-    ember-cli-babel: ^7.7.3
-    sinon: ^7.4.2
-  checksum: 8781e420e1495728264599a770d786290a46eceb841ea6a0b86cf196efd9155e78931ea3c88bfd546bd4b9c1627c0bd0edb6cdd957abbe6faa71247de8184443
+    "@embroider/addon-shim": ^1.8.9
+    "@types/sinon": ^17.0.3
+    decorator-transforms: ^2.0.0
+  peerDependencies:
+    ember-source: ">=3.28.0"
+    qunit: ^2.0.0
+    sinon: ">=15.0.3"
+  checksum: d6ad80c1b28676f055b4e2b0638913c1ed6c721f1ffc839f185e48ceab9a5cbd3088de4a88d667fd2b82bb3109ea43d85efa12e463fe47276aa04b34589e31bd
   languageName: node
   linkType: hard
 
-"ember-source@npm:~4.12.0":
-  version: 4.12.3
-  resolution: "ember-source@npm:4.12.3"
+"ember-source@npm:~5.8.0":
+  version: 5.8.0
+  resolution: "ember-source@npm:5.8.0"
   dependencies:
     "@babel/helper-module-imports": ^7.16.7
-    "@babel/plugin-transform-block-scoping": ^7.20.5
     "@ember/edition-utils": ^1.2.0
-    "@glimmer/vm-babel-plugins": 0.84.2
+    "@glimmer/compiler": 0.87.1
+    "@glimmer/component": ^1.1.2
+    "@glimmer/destroyable": 0.87.1
+    "@glimmer/env": ^0.1.7
+    "@glimmer/global-context": 0.87.1
+    "@glimmer/interfaces": 0.87.1
+    "@glimmer/manager": 0.87.1
+    "@glimmer/node": 0.87.1
+    "@glimmer/opcode-compiler": 0.87.1
+    "@glimmer/owner": 0.87.1
+    "@glimmer/program": 0.87.1
+    "@glimmer/reference": 0.87.1
+    "@glimmer/runtime": 0.87.1
+    "@glimmer/syntax": 0.87.1
+    "@glimmer/util": 0.87.1
+    "@glimmer/validator": 0.87.1
+    "@glimmer/vm": 0.87.1
+    "@glimmer/vm-babel-plugins": 0.87.1
     "@simple-dom/interface": ^1.4.0
     babel-plugin-debug-macros: ^0.3.4
+    babel-plugin-ember-template-compilation: ^2.1.1
     babel-plugin-filter-imports: ^4.0.0
+    backburner.js: ^2.8.0
     broccoli-concat: ^4.2.5
     broccoli-debug: ^0.6.4
     broccoli-file-creator: ^2.1.1
     broccoli-funnel: ^3.0.8
     broccoli-merge-trees: ^4.2.0
     chalk: ^4.0.0
-    ember-auto-import: ^2.5.0
+    ember-auto-import: ^2.6.3
     ember-cli-babel: ^7.26.11
     ember-cli-get-component-path-option: ^1.0.0
     ember-cli-is-package-missing: ^1.0.0
@@ -15728,91 +9070,47 @@ __metadata:
     ember-cli-typescript-blueprint-polyfill: ^0.1.0
     ember-cli-version-checker: ^5.1.2
     ember-router-generator: ^2.0.0
-    inflection: ^1.13.2
-    resolve: ^1.22.0
-    semver: ^7.3.8
+    inflection: ^2.0.1
+    route-recognizer: ^0.3.4
+    router_js: ^8.0.3
+    semver: ^7.5.2
     silent-error: ^1.1.1
+    simple-html-tokenizer: ^0.5.11
   peerDependencies:
     "@glimmer/component": ^1.1.2
-  checksum: bd055bc4a4e3923fdd64065076f0443ef327db14e54f8ee4e801a19a7fcd9f283be617bb27a6ff20968069d58fce01d8dd07b395999537d4a286278f1e3863e9
+  checksum: c7108d512543cedae8929dfba06ee8f8eaeffeaa4553971174f52a2e9e7c8d50c1c5bd27ed3639987f6e6f96fcea045c02d5ca82ba29c7762c9aa293f71e525f
   languageName: node
   linkType: hard
 
-"ember-stargate@npm:^0.4.3":
-  version: 0.4.3
-  resolution: "ember-stargate@npm:0.4.3"
+"ember-stargate@npm:^0.5.0":
+  version: 0.5.0
+  resolution: "ember-stargate@npm:0.5.0"
   dependencies:
     "@ember/render-modifiers": ^2.0.0
     "@embroider/addon-shim": ^1.0.0
     "@glimmer/component": ^1.1.2
-    ember-resources: ^5.0.1
+    ember-resources: ^6.0.0
     tracked-maps-and-sets: ^3.0.1
-  checksum: b41c0dd65c59e298d0a9f9b31fd5035b7824d8ebc0a92b47d52dc559b553ade3e9126bc4f647521138f09b34f80ed297300b6d428583b9a294de5071d5890bf6
-  languageName: node
-  linkType: hard
-
-"ember-style-modifier@npm:^0.8.0":
-  version: 0.8.0
-  resolution: "ember-style-modifier@npm:0.8.0"
-  dependencies:
-    ember-cli-babel: ^7.26.6
-    ember-modifier: ^3.2.7
-  checksum: ae105c24d05be275d47eff3563f0df9d59c4047c4b6afcc2903dbbfa87d5833ccd66bf5e6bee6244505cba404289f5f302112bb4d83f4edf9400507bb4ffe877
-  languageName: node
-  linkType: hard
-
-"ember-style-modifier@npm:^3.0.1":
-  version: 3.0.1
-  resolution: "ember-style-modifier@npm:3.0.1"
-  dependencies:
-    ember-auto-import: ^2.5.0
-    ember-cli-babel: ^7.26.11
-    ember-modifier: ^3.2.7 || ^4.0.0
-  peerDependencies:
-    "@ember/string": ^3.0.1
-  checksum: 093a9affaaa7b3f1c782fa46616bd3f9a02f518c3eff22f1f4c2582f2411cc9d1eecb95d483aaeabf6ce050d95ff928201cd5287e950027b96cbe702e56ae68d
+  checksum: 0eff70822205580a5aad41e185dd726c45c9f3308de6f7cb16a5c333b690cdc6bb5b707520c9df258331194d0c66b3d4292d845fda91d62eac4ff1c9af1efe17
   languageName: node
   linkType: hard
 
-"ember-style-modifier@npm:^4.1.0":
-  version: 4.1.0
-  resolution: "ember-style-modifier@npm:4.1.0"
+"ember-style-modifier@npm:^4.4.0, ember-style-modifier@npm:~4.4.0":
+  version: 4.4.0
+  resolution: "ember-style-modifier@npm:4.4.0"
   dependencies:
-    "@babel/core": ^7.23.6
+    "@embroider/addon-shim": ^1.8.7
     csstype: ^3.1.3
-    ember-auto-import: ^2.7.0
-    ember-cli-babel: ^8.2.0
+    decorator-transforms: ^2.0.0
     ember-modifier: ^3.2.7 || ^4.0.0
   peerDependencies:
-    "@ember/string": ^3.0.1
-    ember-source: ">= 4.12.0"
-  checksum: a83a0328210d7ec6e12995ded1b8ace876245fcb025ba380cb034770bc717628d6ba142c947087c6500b9bf6993225b32d57f1e1371e009e4396a5fd3c65b190
-  languageName: node
-  linkType: hard
-
-"ember-svg-jar@npm:2.4.0":
-  version: 2.4.0
-  resolution: "ember-svg-jar@npm:2.4.0"
-  dependencies:
-    broccoli-caching-writer: ^3.0.3
-    broccoli-concat: ^4.2.5
-    broccoli-funnel: ^3.0.8
-    broccoli-merge-trees: ^4.2.0
-    broccoli-persistent-filter: ^3.1.2
-    broccoli-plugin: ^4.0.7
-    broccoli-string-replace: ^0.1.2
-    broccoli-svg-optimizer: ^2.1.0
-    cheerio: ^1.0.0-rc.12
-    console-ui: ^3.1.1
-    ember-cli-babel: ^7.26.6
-    ember-cli-htmlbars: ^5.7.1
-    lodash: ^4.17.15
-    safe-stable-stringify: ^2.2.0
-  checksum: d2c7eb54c3aab45fe80775470e52d5db93e4fe60c9ecd95d614897cb2275bce92a0b5389914b40ad84509dcf400e1ec384ea192a25a325f30f6b848d8637d145
+    "@ember/string": ^3.1.1 || ^4.0.0
+    ember-source: ^3.28.0 || ^4.0.0 || >=5.0.0
+  checksum: 0027a0c842f9db024781e32e3a04564a1ef6a14e1ac95aac63bcac8935c4277f10f21cc0d31c60ef221ac944fac6ed3b9e9cd40c29993dea1bc4fb7d7a51b912
   languageName: node
   linkType: hard
 
-"ember-template-imports@npm:^3.4.1, ember-template-imports@npm:^3.4.2":
+"ember-template-imports@npm:^3.4.2":
   version: 3.4.2
   resolution: "ember-template-imports@npm:3.4.2"
   dependencies:
@@ -15829,49 +9127,50 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-template-lint-plugin-prettier@npm:4.0.0":
-  version: 4.0.0
-  resolution: "ember-template-lint-plugin-prettier@npm:4.0.0"
+"ember-template-lint-plugin-prettier@npm:~5.0.0":
+  version: 5.0.0
+  resolution: "ember-template-lint-plugin-prettier@npm:5.0.0"
   dependencies:
+    "@prettier/sync": ^0.2.1
     prettier-linter-helpers: ^1.0.0
   peerDependencies:
-    ember-template-lint: ^4.0.0
-    prettier: ">=1.18.1"
-  checksum: 1b6d94803a51991f952a7a426578a677cbd04402c8236073b6b4bc0fd27871b07088463566e77ddd2ed381b4368dd8a1258af8d17f2cf4102e429d946448e3c1
+    ember-template-lint: ">= 4.0.0"
+    prettier: ">= 3.0.0"
+  checksum: 46f1c12d4238526a712588fbcd14c88398ce0a5519fd4bdd7d848fe7f16e35a9d34fc740772e48a26bbcc55ad0327dd411f870a71b4911ad5d7e3be956fe5569
   languageName: node
   linkType: hard
 
-"ember-template-lint@npm:5.7.2":
-  version: 5.7.2
-  resolution: "ember-template-lint@npm:5.7.2"
+"ember-template-lint@npm:~6.1.0":
+  version: 6.1.0
+  resolution: "ember-template-lint@npm:6.1.0"
   dependencies:
-    "@lint-todo/utils": ^13.0.3
-    aria-query: ^5.0.2
-    chalk: ^5.2.0
-    ci-info: ^3.8.0
-    date-fns: ^2.29.2
-    ember-template-imports: ^3.4.1
+    "@lint-todo/utils": ^13.1.1
+    aria-query: ^5.3.0
+    chalk: ^5.3.0
+    ci-info: ^4.0.0
+    date-fns: ^3.6.0
+    ember-template-imports: ^3.4.2
     ember-template-recast: ^6.1.4
     eslint-formatter-kakoune: ^1.0.0
-    find-up: ^6.3.0
-    fuse.js: ^6.5.3
+    find-up: ^7.0.0
+    fuse.js: ^7.0.0
     get-stdin: ^9.0.0
-    globby: ^13.1.3
+    globby: ^14.0.1
     is-glob: ^4.0.3
     language-tags: ^1.0.8
     micromatch: ^4.0.5
-    resolve: ^1.22.1
+    resolve: ^1.22.3
     v8-compile-cache: ^2.3.0
-    yargs: ^17.7.1
+    yargs: ^17.7.2
   bin:
     ember-template-lint: bin/ember-template-lint.js
-  checksum: 7f3848994cb73b3004ca21e726ad460fc54a6039a12c26b3fd787729211ed3d6ad34a1c30a4c8fb40581a61c0795dfdc5fe0e014369afcdea25f81c21a4e6f98
+  checksum: b5f87d3222795dde2095d5755ebbbe5441c831e4cbd64824ee116f4c08e883c423863716f48ea1fc3e48936aa52734ede858d67bbffa3e2bd1c67cbbf98ed531
   languageName: node
   linkType: hard
 
 "ember-template-recast@npm:^6.1.4":
-  version: 6.1.4
-  resolution: "ember-template-recast@npm:6.1.4"
+  version: 6.1.5
+  resolution: "ember-template-recast@npm:6.1.5"
   dependencies:
     "@glimmer/reference": ^0.84.3
     "@glimmer/syntax": ^0.84.3
@@ -15886,39 +9185,34 @@ __metadata:
     workerpool: ^6.4.0
   bin:
     ember-template-recast: lib/bin.js
-  checksum: a492e19c99080e0808fb7b4e3e3e9af47906a4a0b628c1c317414725e82b0c984fe327e1b7265718dc06e3f57b759bf432ef5b7a857cd68b571a7ed1d73d0225
+  checksum: 4473f1edf2b849706478d8807f414937eb1d04f5f37f8584ea93e6225211bc8c9ddf8df6ce1d58cd3d56e5b5ae8754ccc6804893dd5df310f8a033e1a67d43fd
   languageName: node
   linkType: hard
 
-"ember-test-selectors@npm:6.0.0":
-  version: 6.0.0
-  resolution: "ember-test-selectors@npm:6.0.0"
+"ember-test-selectors@npm:7.1.0":
+  version: 7.1.0
+  resolution: "ember-test-selectors@npm:7.1.0"
   dependencies:
     calculate-cache-key-for-tree: ^2.0.0
     ember-cli-babel: ^7.26.4
     ember-cli-version-checker: ^5.1.2
-  checksum: f03bd35caca4390613f68192b257b8edb836cec847ed966e75cd19ce58e5cf62c6a6107575feea0da9b6885cbf4141842b4de05a14edbf3e4164bd93d0c05601
-  languageName: node
-  linkType: hard
-
-"ember-tether@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "ember-tether@npm:2.0.1"
-  dependencies:
-    ember-auto-import: ^1.2.19
-    ember-cli-babel: ^7.1.2
-    tether: ^1.4.0
-  checksum: bfe7d52129b67a6dda79e67cf82d49e3fe5039b9bb8694c1c8f1ba48a7993b2355c4b624d0d95a2497263b8c1ab37d75a1bf650b72e1336c663c43ede9ddf7b0
+    strip-test-selectors: 0.1.0
+  checksum: f07bc04160bcdfca9511dfd212a0fedfdc470038104ae97c41594345e3a96f4a643c791245221967057ab9a923d21260943daf9ddd934daf368b4ffb3d670ba8
   languageName: node
   linkType: hard
 
-"ember-text-measurer@npm:^0.6.0":
-  version: 0.6.0
-  resolution: "ember-text-measurer@npm:0.6.0"
+"ember-tether@npm:3.0.0":
+  version: 3.0.0
+  resolution: "ember-tether@npm:3.0.0"
   dependencies:
-    ember-cli-babel: ^7.19.0
-    ember-cli-htmlbars: ^4.3.1
-  checksum: 27991766045bba77515ecf6e9609f580ee38b2e53026206d18155cbeac87e57979e613a73ca2fae51ed79e00ab6bf71aff7ce07e1e7a15851e2f013ff8c06c97
+    "@ember/render-modifiers": ^2.0.5
+    ember-auto-import: ^2.6.3
+    ember-cli-babel: ^7.26.11
+    ember-cli-htmlbars: ^6.2.0
+    tether: ^2.0.0
+  peerDependencies:
+    ember-source: ^4.0.0
+  checksum: 2b6b96aa9dd9edc89cd370b8fb065d49747a4abcdeac7b2ca2601bce41afc142c3e14f5354d8aaf3599dfeaac078c76538a70a4e5901a267fa6ec28b7f362d4d
   languageName: node
   linkType: hard
 
@@ -15932,21 +9226,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ember-truth-helpers@npm:3.0.0, ember-truth-helpers@npm:^2.1.0 || ^3.0.0":
-  version: 3.0.0
-  resolution: "ember-truth-helpers@npm:3.0.0"
-  dependencies:
-    ember-cli-babel: ^7.22.1
-  checksum: 2848f30eb35046be4d5c4ae6ab36aa374d860ba37dbd6f529467182ead80166e2fc881f615f3fa0b25fd2ecf73e237c6f61e67bd182149776240d9ee3852a343
-  languageName: node
-  linkType: hard
-
-"ember-truth-helpers@npm:^3.0.0, ember-truth-helpers@npm:^3.1.1":
-  version: 3.1.1
-  resolution: "ember-truth-helpers@npm:3.1.1"
+"ember-truth-helpers@npm:4.0.3, ember-truth-helpers@npm:^4.0.3":
+  version: 4.0.3
+  resolution: "ember-truth-helpers@npm:4.0.3"
   dependencies:
-    ember-cli-babel: ^7.22.1
-  checksum: 6f3a779ae714cec543b39ca93caa98121e65046e48929e1890aa24b2592c4e90a703148694bae9d7ca9bfc68d9ae1f7e00392f0f288158ee962aefbae1f3c0b0
+    "@embroider/addon-shim": ^1.8.6
+    ember-functions-as-helper-polyfill: ^2.1.2
+  peerDependencies:
+    ember-source: ">=3.28.0"
+  checksum: bcf81ab9848237fa336aa944a928e6894ab9fa50cf1ee37c9bd2721cba4a12728c61f08a52cb635aa9cd625c6451af5704030318e4b5a0b47ed141fe86e6f408
   languageName: node
   linkType: hard
 
@@ -15960,6 +9248,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"emoji-regex@npm:^10.3.0":
+  version: 10.4.0
+  resolution: "emoji-regex@npm:10.4.0"
+  checksum: a6d9a0e454829a52e664e049847776ee1fff5646617b06cd87de7c03ce1dfcce4102a3b154d5e9c8e90f8125bc120fc1fe114d523dddf60a8a161f26c72658d2
+  languageName: node
+  linkType: hard
+
 "emoji-regex@npm:^7.0.1":
   version: 7.0.3
   resolution: "emoji-regex@npm:7.0.3"
@@ -15981,10 +9276,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"emoji-regex@npm:~6.1.0":
-  version: 6.1.3
-  resolution: "emoji-regex@npm:6.1.3"
-  checksum: 348c4808cdc614e5522023c1f102eb06093ca24c693c7aa074fac93d3880c51948e9468bf91554d2e77ce47f0053411767aae21dd58fed12fdc54c2352a07976
+"emoji-regex@npm:~10.1.0":
+  version: 10.1.0
+  resolution: "emoji-regex@npm:10.1.0"
+  checksum: 5bc780fc4d75f89369155a87c55f7e83a0bf72bcccda7df7f2c570cde4738d8b17d112d12afdadfec16647d1faef6501307b4304f81d35c823a938fe6547df0f
   languageName: node
   linkType: hard
 
@@ -16002,6 +9297,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"encodeurl@npm:~2.0.0":
+  version: 2.0.0
+  resolution: "encodeurl@npm:2.0.0"
+  checksum: abf5cd51b78082cf8af7be6785813c33b6df2068ce5191a40ca8b1afe6a86f9230af9a9ce694a5ce4665955e5c1120871826df9c128a642e09c58d592e2807fe
+  languageName: node
+  linkType: hard
+
 "encoding@npm:^0.1.13":
   version: 0.1.13
   resolution: "encoding@npm:0.1.13"
@@ -16011,7 +9313,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"end-of-stream@npm:^1.0.0, end-of-stream@npm:^1.1.0":
+"end-of-stream@npm:^1.1.0":
   version: 1.4.4
   resolution: "end-of-stream@npm:1.4.4"
   dependencies:
@@ -16020,58 +9322,37 @@ __metadata:
   languageName: node
   linkType: hard
 
-"engine.io-parser@npm:~5.0.3":
-  version: 5.0.4
-  resolution: "engine.io-parser@npm:5.0.4"
-  checksum: d4ad0cef6ff63c350e35696da9bb3dbd180f67b56e93e90375010cc40393e6c0639b780d5680807e1d93a7e2e3d7b4a1c3b27cf75db28eb8cbf605bc1497da03
+"engine.io-parser@npm:~5.2.1":
+  version: 5.2.3
+  resolution: "engine.io-parser@npm:5.2.3"
+  checksum: a76d998b794ce8bbcade833064d949715781fdb9e9cf9b33ecf617d16355ddfd7772f12bb63aaec0f497d63266c6db441129c5aa24c60582270f810c696a6cf8
   languageName: node
   linkType: hard
 
-"engine.io@npm:~6.2.0":
-  version: 6.2.0
-  resolution: "engine.io@npm:6.2.0"
+"engine.io@npm:~6.6.0":
+  version: 6.6.4
+  resolution: "engine.io@npm:6.6.4"
   dependencies:
-    "@types/cookie": ^0.4.1
     "@types/cors": ^2.8.12
     "@types/node": ">=10.0.0"
     accepts: ~1.3.4
     base64id: 2.0.0
-    cookie: ~0.4.1
+    cookie: ~0.7.2
     cors: ~2.8.5
     debug: ~4.3.1
-    engine.io-parser: ~5.0.3
-    ws: ~8.2.3
-  checksum: cc485c5ba2e0c4f6ca02dcafd192b22f9dad89d01dc815005298780d3fb910db4cebab4696e8615290c473c2eeb259e8bee2a1fb7ab594d9c80f9f3485771911
-  languageName: node
-  linkType: hard
-
-"enhanced-resolve@npm:^4.0.0, enhanced-resolve@npm:^4.5.0":
-  version: 4.5.0
-  resolution: "enhanced-resolve@npm:4.5.0"
-  dependencies:
-    graceful-fs: ^4.1.2
-    memory-fs: ^0.5.0
-    tapable: ^1.0.0
-  checksum: 4d87488584c4d67d356ef4ba04978af4b2d4d18190cb859efac8e8475a34d5d6c069df33faa5a0a22920b0586dbf330f6a08d52bb15a8771a9ce4d70a2da74ba
+    engine.io-parser: ~5.2.1
+    ws: ~8.17.1
+  checksum: e2d98ed3adc2fe6cdcee7208a95114bc12d3792f69abedcaeaf7cd21aec478f82b84d36f2e59b03af5f6ffae028923c0e799774400c008a768c8ceb17610a7c4
   languageName: node
   linkType: hard
 
-"enhanced-resolve@npm:^5.10.0":
-  version: 5.14.0
-  resolution: "enhanced-resolve@npm:5.14.0"
+"enhanced-resolve@npm:^5.17.1":
+  version: 5.18.1
+  resolution: "enhanced-resolve@npm:5.18.1"
   dependencies:
     graceful-fs: ^4.2.4
     tapable: ^2.2.0
-  checksum: fff1aaebbf376371e5df4502e111967f6247c37611ad3550e4e7fca657f6dcb29ef7ffe88bf14e5010b78997f1ddd984a8db97af87ee0a5477771398fd326f5b
-  languageName: node
-  linkType: hard
-
-"enquirer@npm:^2.3.6":
-  version: 2.3.6
-  resolution: "enquirer@npm:2.3.6"
-  dependencies:
-    ansi-colors: ^4.1.1
-  checksum: 1c0911e14a6f8d26721c91e01db06092a5f7675159f0261d69c403396a385afd13dd76825e7678f66daffa930cfaa8d45f506fb35f818a2788463d022af1b884
+  checksum: de5bea7debe3576e78173bcc409c4aee7fcb56580c602d5c47c533b92952e55d7da3d9f53b864846ba62c8bd3efb0f9ecfe5f865e57de2f3e9b6e5cda03b4e7e
   languageName: node
   linkType: hard
 
@@ -16096,20 +9377,36 @@ __metadata:
   languageName: node
   linkType: hard
 
-"entities@npm:^4.2.0, entities@npm:^4.3.0, entities@npm:^4.4.0":
-  version: 4.4.0
-  resolution: "entities@npm:4.4.0"
-  checksum: 84d250329f4b56b40fa93ed067b194db21e8815e4eb9b59f43a086f0ecd342814f6bc483de8a77da5d64e0f626033192b1b4f1792232a7ea6b970ebe0f3187c2
+"entities@npm:^4.4.0":
+  version: 4.5.0
+  resolution: "entities@npm:4.5.0"
+  checksum: 853f8ebd5b425d350bffa97dd6958143179a5938352ccae092c62d1267c4e392a039be1bae7d51b6e4ffad25f51f9617531fedf5237f15df302ccfb452cbf2d7
   languageName: node
   linkType: hard
 
-"env-paths@npm:^2.2.0":
+"env-paths@npm:^2.2.0, env-paths@npm:^2.2.1":
   version: 2.2.1
   resolution: "env-paths@npm:2.2.1"
   checksum: 65b5df55a8bab92229ab2b40dad3b387fad24613263d103a97f91c9fe43ceb21965cd3392b1ccb5d77088021e525c4e0481adb309625d0cb94ade1d1fb8dc17e
   languageName: node
   linkType: hard
 
+"envinfo@npm:^7.14.0":
+  version: 7.15.0
+  resolution: "envinfo@npm:7.15.0"
+  bin:
+    envinfo: dist/cli.js
+  checksum: 38595c11134ecb66a40289980d8ca82e89fdcd68849dd72560c1bbc3cfc55c867573b4150967707ff9ff2e5cad6f1d0cb6cc56c333a6eccdcd3533452141c0a8
+  languageName: node
+  linkType: hard
+
+"environment@npm:^1.0.0":
+  version: 1.1.0
+  resolution: "environment@npm:1.1.0"
+  checksum: dd3c1b9825e7f71f1e72b03c2344799ac73f2e9ef81b78ea8b373e55db021786c6b9f3858ea43a436a2c4611052670ec0afe85bc029c384cc71165feee2f4ba6
+  languageName: node
+  linkType: hard
+
 "err-code@npm:^2.0.2":
   version: 2.0.3
   resolution: "err-code@npm:2.0.3"
@@ -16124,17 +9421,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"errno@npm:^0.1.3, errno@npm:~0.1.7":
-  version: 0.1.8
-  resolution: "errno@npm:0.1.8"
-  dependencies:
-    prr: ~1.0.1
-  bin:
-    errno: cli.js
-  checksum: 1271f7b9fbb3bcbec76ffde932485d1e3561856d21d847ec613a9722ee924cdd4e523a62dc71a44174d91e898fe21fdc8d5b50823f4b5e0ce8c35c8271e6ef4a
-  languageName: node
-  linkType: hard
-
 "error-ex@npm:^1.3.1":
   version: 1.3.2
   resolution: "error-ex@npm:1.3.2"
@@ -16163,143 +9449,115 @@ __metadata:
   languageName: node
   linkType: hard
 
-"es-abstract@npm:^1.17.2":
-  version: 1.18.0
-  resolution: "es-abstract@npm:1.18.0"
-  dependencies:
-    call-bind: ^1.0.2
-    es-to-primitive: ^1.2.1
-    function-bind: ^1.1.1
-    get-intrinsic: ^1.1.1
-    has: ^1.0.3
-    has-symbols: ^1.0.2
-    is-callable: ^1.2.3
-    is-negative-zero: ^2.0.1
-    is-regex: ^1.1.2
-    is-string: ^1.0.5
-    object-inspect: ^1.9.0
+"es-abstract@npm:^1.22.3, es-abstract@npm:^1.23.5, es-abstract@npm:^1.23.6, es-abstract@npm:^1.23.9":
+  version: 1.23.10
+  resolution: "es-abstract@npm:1.23.10"
+  dependencies:
+    array-buffer-byte-length: ^1.0.2
+    arraybuffer.prototype.slice: ^1.0.4
+    available-typed-arrays: ^1.0.7
+    call-bind: ^1.0.8
+    call-bound: ^1.0.4
+    data-view-buffer: ^1.0.2
+    data-view-byte-length: ^1.0.2
+    data-view-byte-offset: ^1.0.1
+    es-define-property: ^1.0.1
+    es-errors: ^1.3.0
+    es-object-atoms: ^1.1.1
+    es-set-tostringtag: ^2.1.0
+    es-to-primitive: ^1.3.0
+    function.prototype.name: ^1.1.8
+    get-intrinsic: ^1.3.0
+    get-proto: ^1.0.1
+    get-symbol-description: ^1.1.0
+    globalthis: ^1.0.4
+    gopd: ^1.2.0
+    has-property-descriptors: ^1.0.2
+    has-proto: ^1.2.0
+    has-symbols: ^1.1.0
+    hasown: ^2.0.2
+    internal-slot: ^1.1.0
+    is-array-buffer: ^3.0.5
+    is-callable: ^1.2.7
+    is-data-view: ^1.0.2
+    is-regex: ^1.2.1
+    is-shared-array-buffer: ^1.0.4
+    is-string: ^1.1.1
+    is-typed-array: ^1.1.15
+    is-weakref: ^1.1.1
+    math-intrinsics: ^1.1.0
+    object-inspect: ^1.13.4
     object-keys: ^1.1.1
-    object.assign: ^4.1.2
-    string.prototype.trimend: ^1.0.4
-    string.prototype.trimstart: ^1.0.4
-    unbox-primitive: ^1.0.0
-  checksum: 6783bea97f372fd4f1fc77e4e294d024b9f40559a83b40c46b69565511cf13d462a6189b822228c6bb818bd09d2f23b33500206d39bbdc69f7cc7ffebf6640a1
+    object.assign: ^4.1.7
+    own-keys: ^1.0.1
+    regexp.prototype.flags: ^1.5.4
+    safe-array-concat: ^1.1.3
+    safe-push-apply: ^1.0.0
+    safe-regex-test: ^1.1.0
+    set-proto: ^1.0.0
+    string.prototype.trim: ^1.2.10
+    string.prototype.trimend: ^1.0.9
+    string.prototype.trimstart: ^1.0.8
+    typed-array-buffer: ^1.0.3
+    typed-array-byte-length: ^1.0.3
+    typed-array-byte-offset: ^1.0.4
+    typed-array-length: ^1.0.7
+    unbox-primitive: ^1.1.0
+    which-typed-array: ^1.1.19
+  checksum: 0b1baf903096c4f19030ab3334062deb6df577441266223b44cb431d8733f21852e9ac8be1c73c28dddc8f0c214c668969195cee0a14d21967ca91628f5f4366
+  languageName: node
+  linkType: hard
+
+"es-define-property@npm:^1.0.0, es-define-property@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "es-define-property@npm:1.0.1"
+  checksum: 0512f4e5d564021c9e3a644437b0155af2679d10d80f21adaf868e64d30efdfbd321631956f20f42d655fedb2e3a027da479fad3fa6048f768eb453a80a5f80a
   languageName: node
   linkType: hard
 
-"es-abstract@npm:^1.18.0-next.2, es-abstract@npm:^1.19.1":
-  version: 1.19.1
-  resolution: "es-abstract@npm:1.19.1"
-  dependencies:
-    call-bind: ^1.0.2
-    es-to-primitive: ^1.2.1
-    function-bind: ^1.1.1
-    get-intrinsic: ^1.1.1
-    get-symbol-description: ^1.0.0
-    has: ^1.0.3
-    has-symbols: ^1.0.2
-    internal-slot: ^1.0.3
-    is-callable: ^1.2.4
-    is-negative-zero: ^2.0.1
-    is-regex: ^1.1.4
-    is-shared-array-buffer: ^1.0.1
-    is-string: ^1.0.7
-    is-weakref: ^1.0.1
-    object-inspect: ^1.11.0
-    object-keys: ^1.1.1
-    object.assign: ^4.1.2
-    string.prototype.trimend: ^1.0.4
-    string.prototype.trimstart: ^1.0.4
-    unbox-primitive: ^1.0.1
-  checksum: b6be8410672c5364db3fb01eb786e30c7b4bb32b4af63d381c08840f4382c4a168e7855cd338bf59d4f1a1a1138f4d748d1fd40ec65aaa071876f9e9fbfed949
-  languageName: node
-  linkType: hard
-
-"es-abstract@npm:^1.19.0, es-abstract@npm:^1.20.4":
-  version: 1.21.2
-  resolution: "es-abstract@npm:1.21.2"
-  dependencies:
-    array-buffer-byte-length: ^1.0.0
-    available-typed-arrays: ^1.0.5
-    call-bind: ^1.0.2
-    es-set-tostringtag: ^2.0.1
-    es-to-primitive: ^1.2.1
-    function.prototype.name: ^1.1.5
-    get-intrinsic: ^1.2.0
-    get-symbol-description: ^1.0.0
-    globalthis: ^1.0.3
-    gopd: ^1.0.1
-    has: ^1.0.3
-    has-property-descriptors: ^1.0.0
-    has-proto: ^1.0.1
-    has-symbols: ^1.0.3
-    internal-slot: ^1.0.5
-    is-array-buffer: ^3.0.2
-    is-callable: ^1.2.7
-    is-negative-zero: ^2.0.2
-    is-regex: ^1.1.4
-    is-shared-array-buffer: ^1.0.2
-    is-string: ^1.0.7
-    is-typed-array: ^1.1.10
-    is-weakref: ^1.0.2
-    object-inspect: ^1.12.3
-    object-keys: ^1.1.1
-    object.assign: ^4.1.4
-    regexp.prototype.flags: ^1.4.3
-    safe-regex-test: ^1.0.0
-    string.prototype.trim: ^1.2.7
-    string.prototype.trimend: ^1.0.6
-    string.prototype.trimstart: ^1.0.6
-    typed-array-length: ^1.0.4
-    unbox-primitive: ^1.0.2
-    which-typed-array: ^1.1.9
-  checksum: 037f55ee5e1cdf2e5edbab5524095a4f97144d95b94ea29e3611b77d852fd8c8a40e7ae7101fa6a759a9b9b1405f188c3c70928f2d3cd88d543a07fc0d5ad41a
+"es-errors@npm:^1.0.0, es-errors@npm:^1.3.0":
+  version: 1.3.0
+  resolution: "es-errors@npm:1.3.0"
+  checksum: ec1414527a0ccacd7f15f4a3bc66e215f04f595ba23ca75cdae0927af099b5ec865f9f4d33e9d7e86f512f252876ac77d4281a7871531a50678132429b1271b5
   languageName: node
   linkType: hard
 
-"es-get-iterator@npm:^1.1.3":
-  version: 1.1.3
-  resolution: "es-get-iterator@npm:1.1.3"
-  dependencies:
-    call-bind: ^1.0.2
-    get-intrinsic: ^1.1.3
-    has-symbols: ^1.0.3
-    is-arguments: ^1.1.1
-    is-map: ^2.0.2
-    is-set: ^2.0.2
-    is-string: ^1.0.7
-    isarray: ^2.0.5
-    stop-iteration-iterator: ^1.0.0
-  checksum: 8fa118da42667a01a7c7529f8a8cca514feeff243feec1ce0bb73baaa3514560bd09d2b3438873cf8a5aaec5d52da248131de153b28e2638a061b6e4df13267d
+"es-module-lexer@npm:^1.2.1":
+  version: 1.7.0
+  resolution: "es-module-lexer@npm:1.7.0"
+  checksum: 7858bb76ae387fdbf8a6fccc951bf18919768309850587553eca34698b9193fbc65fab03d3d9f69163d860321fbf66adf89d5821e7f4148c7cb7d7b997259211
   languageName: node
   linkType: hard
 
-"es-module-lexer@npm:^0.9.0":
-  version: 0.9.3
-  resolution: "es-module-lexer@npm:0.9.3"
-  checksum: 84bbab23c396281db2c906c766af58b1ae2a1a2599844a504df10b9e8dc77ec800b3211fdaa133ff700f5703d791198807bba25d9667392d27a5e9feda344da8
+"es-object-atoms@npm:^1.0.0, es-object-atoms@npm:^1.1.1":
+  version: 1.1.1
+  resolution: "es-object-atoms@npm:1.1.1"
+  dependencies:
+    es-errors: ^1.3.0
+  checksum: 214d3767287b12f36d3d7267ef342bbbe1e89f899cfd67040309fc65032372a8e60201410a99a1645f2f90c1912c8c49c8668066f6bdd954bcd614dda2e3da97
   languageName: node
   linkType: hard
 
-"es-set-tostringtag@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "es-set-tostringtag@npm:2.0.1"
+"es-set-tostringtag@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "es-set-tostringtag@npm:2.1.0"
   dependencies:
-    get-intrinsic: ^1.1.3
-    has: ^1.0.3
-    has-tostringtag: ^1.0.0
-  checksum: ec416a12948cefb4b2a5932e62093a7cf36ddc3efd58d6c58ca7ae7064475ace556434b869b0bbeb0c365f1032a8ccd577211101234b69837ad83ad204fff884
+    es-errors: ^1.3.0
+    get-intrinsic: ^1.2.6
+    has-tostringtag: ^1.0.2
+    hasown: ^2.0.2
+  checksum: 789f35de4be3dc8d11fdcb91bc26af4ae3e6d602caa93299a8c45cf05d36cc5081454ae2a6d3afa09cceca214b76c046e4f8151e092e6fc7feeb5efb9e794fc6
   languageName: node
   linkType: hard
 
-"es-to-primitive@npm:^1.2.1":
-  version: 1.2.1
-  resolution: "es-to-primitive@npm:1.2.1"
+"es-to-primitive@npm:^1.3.0":
+  version: 1.3.0
+  resolution: "es-to-primitive@npm:1.3.0"
   dependencies:
-    is-callable: ^1.1.4
-    is-date-object: ^1.0.1
-    is-symbol: ^1.0.2
-  checksum: 4ead6671a2c1402619bdd77f3503991232ca15e17e46222b0a41a5d81aebc8740a77822f5b3c965008e631153e9ef0580540007744521e72de8e33599fca2eed
+    is-callable: ^1.2.7
+    is-date-object: ^1.0.5
+    is-symbol: ^1.0.4
+  checksum: 966965880356486cd4d1fe9a523deda2084c81b3702d951212c098f5f2ee93605d1b7c1840062efb48a07d892641c7ed1bc194db563645c0dd2b919cb6d65b93
   languageName: node
   linkType: hard
 
@@ -16319,10 +9577,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"escalade@npm:^3.1.1":
-  version: 3.1.1
-  resolution: "escalade@npm:3.1.1"
-  checksum: a3e2a99f07acb74b3ad4989c48ca0c3140f69f923e56d0cba0526240ee470b91010f9d39001f2a4a313841d237ede70a729e92125191ba5d21e74b106800b133
+"escalade@npm:^3.1.1, escalade@npm:^3.2.0":
+  version: 3.2.0
+  resolution: "escalade@npm:3.2.0"
+  checksum: 47b029c83de01b0d17ad99ed766347b974b0d628e848de404018f3abee728e987da0d2d370ad4574aa3d5b5bfc368754fd085d69a30f8e75903486ec4b5b709e
   languageName: node
   linkType: hard
 
@@ -16340,7 +9598,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"escape-string-regexp@npm:^2.0.0":
+"escape-string-regexp@npm:^2.0.0, escape-string-regexp@npm:~2.0.0":
   version: 2.0.0
   resolution: "escape-string-regexp@npm:2.0.0"
   checksum: 9f8a2d5743677c16e85c810e3024d54f0c8dea6424fad3c79ef6666e81dd0846f7437f5e729dfcdac8981bc9e5294c39b4580814d114076b8d36318f46ae4395
@@ -16354,33 +9612,25 @@ __metadata:
   languageName: node
   linkType: hard
 
-"escodegen@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "escodegen@npm:2.0.0"
+"eslint-compat-utils@npm:^0.5.1":
+  version: 0.5.1
+  resolution: "eslint-compat-utils@npm:0.5.1"
   dependencies:
-    esprima: ^4.0.1
-    estraverse: ^5.2.0
-    esutils: ^2.0.2
-    optionator: ^0.8.1
-    source-map: ~0.6.1
-  dependenciesMeta:
-    source-map:
-      optional: true
-  bin:
-    escodegen: bin/escodegen.js
-    esgenerate: bin/esgenerate.js
-  checksum: 5aa6b2966fafe0545e4e77936300cc94ad57cfe4dc4ebff9950492eaba83eef634503f12d7e3cbd644ecc1bab388ad0e92b06fd32222c9281a75d1cf02ec6cef
+    semver: ^7.5.4
+  peerDependencies:
+    eslint: ">=6.0.0"
+  checksum: beccf2a5bd7c7974e3584b269f8a02667c83bca64cfd4c866f3055867f187e78b00ee826721765bdee9b13efaaa248f8068c581f7bb05803e8f47abb116e68fc
   languageName: node
   linkType: hard
 
-"eslint-config-prettier@npm:^8.8.0":
-  version: 8.8.0
-  resolution: "eslint-config-prettier@npm:8.8.0"
+"eslint-config-prettier@npm:~9.1.0":
+  version: 9.1.0
+  resolution: "eslint-config-prettier@npm:9.1.0"
   peerDependencies:
     eslint: ">=7.0.0"
   bin:
     eslint-config-prettier: bin/cli.js
-  checksum: 1e94c3882c4d5e41e1dcfa2c368dbccbfe3134f6ac7d40101644d3bfbe3eb2f2ffac757f3145910b5eacf20c0e85e02b91293d3126d770cbf3dc390b3564681c
+  checksum: 9229b768c879f500ee54ca05925f31b0c0bafff3d9f5521f98ff05127356de78c81deb9365c86a5ec4efa990cb72b74df8612ae15965b14136044c73e1f6a907
   languageName: node
   linkType: hard
 
@@ -16391,27 +9641,26 @@ __metadata:
   languageName: node
   linkType: hard
 
-"eslint-plugin-compat@npm:4.0.2":
-  version: 4.0.2
-  resolution: "eslint-plugin-compat@npm:4.0.2"
+"eslint-plugin-compat@npm:~4.2.0":
+  version: 4.2.0
+  resolution: "eslint-plugin-compat@npm:4.2.0"
   dependencies:
-    "@mdn/browser-compat-data": ^4.1.5
-    ast-metadata-inferer: ^0.7.0
-    browserslist: ^4.16.8
-    caniuse-lite: ^1.0.30001304
-    core-js: ^3.16.2
+    "@mdn/browser-compat-data": ^5.3.13
+    ast-metadata-inferer: ^0.8.0
+    browserslist: ^4.21.10
+    caniuse-lite: ^1.0.30001524
     find-up: ^5.0.0
-    lodash.memoize: 4.1.2
-    semver: 7.3.5
+    lodash.memoize: ^4.1.2
+    semver: ^7.5.4
   peerDependencies:
     eslint: ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
-  checksum: 2a1c1ebfd2d9a0e94064417f0f582b183d95bad08014e1f39dd1b4b599c1e909872ea344e016ec8fb297fcf8ab5d0c0b10032f1c2d6d4f9fb57a8a9fad67130e
+  checksum: 68c1f7f6cd1e6fa663568ba1d5c0cef9e42b1e3ec4e9b63a98a2bce18f39711a2313c47ba576a6583e7d92edc7beddc83a583dac8c12ac80c642741fee37e67d
   languageName: node
   linkType: hard
 
-"eslint-plugin-ember@npm:^11.5.0":
-  version: 11.10.0
-  resolution: "eslint-plugin-ember@npm:11.10.0"
+"eslint-plugin-ember@npm:~11.12.0":
+  version: 11.12.0
+  resolution: "eslint-plugin-ember@npm:11.12.0"
   dependencies:
     "@ember-data/rfc395-data": ^0.0.4
     "@glimmer/syntax": ^0.84.2
@@ -16428,62 +9677,71 @@ __metadata:
     snake-case: ^3.0.3
   peerDependencies:
     eslint: ">= 7"
-  checksum: d547ae89d05376d0a852861668fb9c2e119ea892c6b7631a833045146a4ee9f7beb3fe0da03e0edfee4061f90ea7479e7de85a1b29c6e27e958c965280f52807
+  checksum: 006d7c95b91d1ddcf0ebcf1d63fc6374271a9f272d99cb6409bea745b4f23070b4e5790d536630a83e9d7b703bf7605ac252c466a97cd68cc280a386db419a52
   languageName: node
   linkType: hard
 
-"eslint-plugin-es@npm:^4.1.0":
-  version: 4.1.0
-  resolution: "eslint-plugin-es@npm:4.1.0"
+"eslint-plugin-es-x@npm:^7.5.0":
+  version: 7.8.0
+  resolution: "eslint-plugin-es-x@npm:7.8.0"
   dependencies:
-    eslint-utils: ^2.0.0
-    regexpp: ^3.0.0
+    "@eslint-community/eslint-utils": ^4.1.2
+    "@eslint-community/regexpp": ^4.11.0
+    eslint-compat-utils: ^0.5.1
   peerDependencies:
-    eslint: ">=4.19.1"
-  checksum: 26b87a216d3625612b1d3ca8653ac8a1d261046d2a973bb0eb2759070267d2bfb0509051facdeb5ae03dc8dfb51a434be23aff7309a752ca901d637da535677f
+    eslint: ">=8"
+  checksum: c30fc6bd94f86781eaf34dec59e7d52ee68b8a12305ae76222d8d0ff6cc0a5c94e8306ed079b4234d64f7464bcd162a5fef59e7cc69a978ba77950e0395c79f8
   languageName: node
   linkType: hard
 
-"eslint-plugin-n@npm:^15.7.0":
-  version: 15.7.0
-  resolution: "eslint-plugin-n@npm:15.7.0"
+"eslint-plugin-n@npm:~16.6.2":
+  version: 16.6.2
+  resolution: "eslint-plugin-n@npm:16.6.2"
   dependencies:
+    "@eslint-community/eslint-utils": ^4.4.0
     builtins: ^5.0.1
-    eslint-plugin-es: ^4.1.0
-    eslint-utils: ^3.0.0
-    ignore: ^5.1.1
-    is-core-module: ^2.11.0
+    eslint-plugin-es-x: ^7.5.0
+    get-tsconfig: ^4.7.0
+    globals: ^13.24.0
+    ignore: ^5.2.4
+    is-builtin-module: ^3.2.1
+    is-core-module: ^2.12.1
     minimatch: ^3.1.2
-    resolve: ^1.22.1
-    semver: ^7.3.8
+    resolve: ^1.22.2
+    semver: ^7.5.3
   peerDependencies:
     eslint: ">=7.0.0"
-  checksum: cfbcc67e62adf27712afdeadf13223cb9717f95d4af8442056d9d4c97a8b88af76b7969f75deaac26fa98481023d6b7c9e43a28909e7f0468f40b3024b7bcfae
+  checksum: 3b468da0038cf25af582608983491b33ac2d481b6a94a0ff2e715d3b85e1ff8cb93df4cd67b689d520bea1bfb8f2b717f01606bf6b2ea19fe8f9c0999ea7057d
   languageName: node
   linkType: hard
 
-"eslint-plugin-prettier@npm:^4.2.1":
-  version: 4.2.1
-  resolution: "eslint-plugin-prettier@npm:4.2.1"
+"eslint-plugin-prettier@npm:~5.2.6":
+  version: 5.2.6
+  resolution: "eslint-plugin-prettier@npm:5.2.6"
   dependencies:
     prettier-linter-helpers: ^1.0.0
+    synckit: ^0.11.0
   peerDependencies:
-    eslint: ">=7.28.0"
-    prettier: ">=2.0.0"
+    "@types/eslint": ">=8.0.0"
+    eslint: ">=8.0.0"
+    eslint-config-prettier: ">= 7.0.0 <10.0.0 || >=10.1.0"
+    prettier: ">=3.0.0"
   peerDependenciesMeta:
+    "@types/eslint":
+      optional: true
     eslint-config-prettier:
       optional: true
-  checksum: b9e839d2334ad8ec7a5589c5cb0f219bded260839a857d7a486997f9870e95106aa59b8756ff3f37202085ebab658de382b0267cae44c3a7f0eb0bcc03a4f6d6
+  checksum: 2626c123916c4afe88d423bac9c3644d30af8beac4963b77bf447f42ba75ab592076716dfa9d43333bfde0ac482d8f8b6a49699403d128aee5effd609ca54bec
   languageName: node
   linkType: hard
 
-"eslint-plugin-qunit@npm:^7.3.4":
-  version: 7.3.4
-  resolution: "eslint-plugin-qunit@npm:7.3.4"
+"eslint-plugin-qunit@npm:~8.1.2":
+  version: 8.1.2
+  resolution: "eslint-plugin-qunit@npm:8.1.2"
   dependencies:
     eslint-utils: ^3.0.0
     requireindex: ^1.2.0
-  checksum: 078dae3d93b7e395c3409cf5855281cca994cbeaacd3e956697cf0ca14c4b45275e20d846173fe76d77655e5e7382b2287a5a324c190a425e4631b745312d5b7
+  checksum: a908a585e56c1de5e4de10e3d8386574a22102a550d63bbb97ddbad4599fdacf02a00038cb303f81687db83a7632b50204f50320bb7a0fb8e2bf178b00a1e92f
   languageName: node
   linkType: hard
 
@@ -16497,37 +9755,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"eslint-scope@npm:^4.0.3":
-  version: 4.0.3
-  resolution: "eslint-scope@npm:4.0.3"
-  dependencies:
-    esrecurse: ^4.1.0
-    estraverse: ^4.1.1
-  checksum: c5f835f681884469991fe58d76a554688d9c9e50811299ccd4a8f79993a039f5bcb0ee6e8de2b0017d97c794b5832ef3b21c9aac66228e3aa0f7a0485bcfb65b
-  languageName: node
-  linkType: hard
-
-"eslint-scope@npm:^7.0.0, eslint-scope@npm:^7.1.1":
-  version: 7.1.1
-  resolution: "eslint-scope@npm:7.1.1"
-  dependencies:
-    esrecurse: ^4.3.0
-    estraverse: ^5.2.0
-  checksum: 9f6e974ab2db641ca8ab13508c405b7b859e72afe9f254e8131ff154d2f40c99ad4545ce326fd9fde3212ff29707102562a4834f1c48617b35d98c71a97fbf3e
-  languageName: node
-  linkType: hard
-
-"eslint-scope@npm:^7.2.0":
-  version: 7.2.1
-  resolution: "eslint-scope@npm:7.2.1"
+"eslint-scope@npm:^7.0.0, eslint-scope@npm:^7.2.2":
+  version: 7.2.2
+  resolution: "eslint-scope@npm:7.2.2"
   dependencies:
     esrecurse: ^4.3.0
     estraverse: ^5.2.0
-  checksum: dccda5c8909216f6261969b72c77b95e385f9086bed4bc09d8a6276df8439d8f986810fd9ac3bd02c94c0572cefc7fdbeae392c69df2e60712ab8263986522c5
+  checksum: ec97dbf5fb04b94e8f4c5a91a7f0a6dd3c55e46bfc7bbcd0e3138c3a76977570e02ed89a1810c778dcd72072ff0e9621ba1379b4babe53921d71e2e4486fda3e
   languageName: node
   linkType: hard
 
-"eslint-utils@npm:^1.4.1":
+"eslint-utils@npm:1.4.3":
   version: 1.4.3
   resolution: "eslint-utils@npm:1.4.3"
   dependencies:
@@ -16550,89 +9788,34 @@ __metadata:
   languageName: node
   linkType: hard
 
-"eslint-visitor-keys@npm:^3.1.0, eslint-visitor-keys@npm:^3.3.0":
-  version: 3.3.0
-  resolution: "eslint-visitor-keys@npm:3.3.0"
-  checksum: d59e68a7c5a6d0146526b0eec16ce87fbf97fe46b8281e0d41384224375c4e52f5ffb9e16d48f4ea50785cde93f766b0c898e31ab89978d88b0e1720fbfb7808
-  languageName: node
-  linkType: hard
-
-"eslint-visitor-keys@npm:^3.4.1":
-  version: 3.4.1
-  resolution: "eslint-visitor-keys@npm:3.4.1"
-  checksum: f05121d868202736b97de7d750847a328fcfa8593b031c95ea89425333db59676ac087fa905eba438d0a3c5769632f828187e0c1a0d271832a2153c1d3661c2c
-  languageName: node
-  linkType: hard
-
-"eslint@npm:^8.21.0, eslint@npm:^8.7.0":
-  version: 8.27.0
-  resolution: "eslint@npm:8.27.0"
-  dependencies:
-    "@eslint/eslintrc": ^1.3.3
-    "@humanwhocodes/config-array": ^0.11.6
-    "@humanwhocodes/module-importer": ^1.0.1
-    "@nodelib/fs.walk": ^1.2.8
-    ajv: ^6.10.0
-    chalk: ^4.0.0
-    cross-spawn: ^7.0.2
-    debug: ^4.3.2
-    doctrine: ^3.0.0
-    escape-string-regexp: ^4.0.0
-    eslint-scope: ^7.1.1
-    eslint-utils: ^3.0.0
-    eslint-visitor-keys: ^3.3.0
-    espree: ^9.4.0
-    esquery: ^1.4.0
-    esutils: ^2.0.2
-    fast-deep-equal: ^3.1.3
-    file-entry-cache: ^6.0.1
-    find-up: ^5.0.0
-    glob-parent: ^6.0.2
-    globals: ^13.15.0
-    grapheme-splitter: ^1.0.4
-    ignore: ^5.2.0
-    import-fresh: ^3.0.0
-    imurmurhash: ^0.1.4
-    is-glob: ^4.0.0
-    is-path-inside: ^3.0.3
-    js-sdsl: ^4.1.4
-    js-yaml: ^4.1.0
-    json-stable-stringify-without-jsonify: ^1.0.1
-    levn: ^0.4.1
-    lodash.merge: ^4.6.2
-    minimatch: ^3.1.2
-    natural-compare: ^1.4.0
-    optionator: ^0.9.1
-    regexpp: ^3.2.0
-    strip-ansi: ^6.0.1
-    strip-json-comments: ^3.1.0
-    text-table: ^0.2.0
-  bin:
-    eslint: bin/eslint.js
-  checksum: 153b022d309e1b647a73b1bb0fa98912add699b06e279084155f23c6f2b5fc5abd05411fc1ba81608a24bbfaf044ca079544c16fffa6fc987b8f676c9960a2c4
+"eslint-visitor-keys@npm:^3.1.0, eslint-visitor-keys@npm:^3.3.0, eslint-visitor-keys@npm:^3.4.1, eslint-visitor-keys@npm:^3.4.3":
+  version: 3.4.3
+  resolution: "eslint-visitor-keys@npm:3.4.3"
+  checksum: 36e9ef87fca698b6fd7ca5ca35d7b2b6eeaaf106572e2f7fd31c12d3bfdaccdb587bba6d3621067e5aece31c8c3a348b93922ab8f7b2cbc6aaab5e1d89040c60
   languageName: node
   linkType: hard
 
-"eslint@npm:^8.37.0":
-  version: 8.45.0
-  resolution: "eslint@npm:8.45.0"
+"eslint@npm:^8.21.0, eslint@npm:^8.7.0, eslint@npm:~8.57.1":
+  version: 8.57.1
+  resolution: "eslint@npm:8.57.1"
   dependencies:
     "@eslint-community/eslint-utils": ^4.2.0
-    "@eslint-community/regexpp": ^4.4.0
-    "@eslint/eslintrc": ^2.1.0
-    "@eslint/js": 8.44.0
-    "@humanwhocodes/config-array": ^0.11.10
+    "@eslint-community/regexpp": ^4.6.1
+    "@eslint/eslintrc": ^2.1.4
+    "@eslint/js": 8.57.1
+    "@humanwhocodes/config-array": ^0.13.0
     "@humanwhocodes/module-importer": ^1.0.1
     "@nodelib/fs.walk": ^1.2.8
-    ajv: ^6.10.0
+    "@ungap/structured-clone": ^1.2.0
+    ajv: ^6.12.4
     chalk: ^4.0.0
     cross-spawn: ^7.0.2
     debug: ^4.3.2
     doctrine: ^3.0.0
     escape-string-regexp: ^4.0.0
-    eslint-scope: ^7.2.0
-    eslint-visitor-keys: ^3.4.1
-    espree: ^9.6.0
+    eslint-scope: ^7.2.2
+    eslint-visitor-keys: ^3.4.3
+    espree: ^9.6.1
     esquery: ^1.4.2
     esutils: ^2.0.2
     fast-deep-equal: ^3.1.3
@@ -16656,7 +9839,7 @@ __metadata:
     text-table: ^0.2.0
   bin:
     eslint: bin/eslint.js
-  checksum: 3e6dcce5cc43c5e301662db88ee26d1d188b22c177b9f104d7eefd1191236980bd953b3670fe2fac287114b26d7c5420ab48407d7ea1c3a446d6313c000009da
+  checksum: e2489bb7f86dd2011967759a09164e65744ef7688c310bc990612fc26953f34cc391872807486b15c06833bdff737726a23e9b4cdba5de144c311377dc41d91b
   languageName: node
   linkType: hard
 
@@ -16667,18 +9850,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"espree@npm:^9.0.0, espree@npm:^9.4.0":
-  version: 9.4.1
-  resolution: "espree@npm:9.4.1"
-  dependencies:
-    acorn: ^8.8.0
-    acorn-jsx: ^5.3.2
-    eslint-visitor-keys: ^3.3.0
-  checksum: 4d266b0cf81c7dfe69e542c7df0f246e78d29f5b04dda36e514eb4c7af117ee6cfbd3280e560571ed82ff6c9c3f0003c05b82583fc7a94006db7497c4fe4270e
-  languageName: node
-  linkType: hard
-
-"espree@npm:^9.6.0":
+"espree@npm:^9.0.0, espree@npm:^9.6.0, espree@npm:^9.6.1":
   version: 9.6.1
   resolution: "espree@npm:9.6.1"
   dependencies:
@@ -16689,7 +9861,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"esprima@npm:^4.0.0, esprima@npm:^4.0.1, esprima@npm:~4.0.0":
+"esprima@npm:^4.0.0, esprima@npm:~4.0.0":
   version: 4.0.1
   resolution: "esprima@npm:4.0.1"
   bin:
@@ -16709,25 +9881,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"esquery@npm:^1.4.0":
-  version: 1.4.0
-  resolution: "esquery@npm:1.4.0"
-  dependencies:
-    estraverse: ^5.1.0
-  checksum: a0807e17abd7fbe5fbd4fab673038d6d8a50675cdae6b04fbaa520c34581be0c5fa24582990e8acd8854f671dd291c78bb2efb9e0ed5b62f33bac4f9cf820210
-  languageName: node
-  linkType: hard
-
-"esquery@npm:^1.4.2":
-  version: 1.5.0
-  resolution: "esquery@npm:1.5.0"
+"esquery@npm:^1.4.0, esquery@npm:^1.4.2":
+  version: 1.6.0
+  resolution: "esquery@npm:1.6.0"
   dependencies:
     estraverse: ^5.1.0
-  checksum: aefb0d2596c230118656cd4ec7532d447333a410a48834d80ea648b1e7b5c9bc9ed8b5e33a89cb04e487b60d622f44cf5713bf4abed7c97343edefdc84a35900
+  checksum: 08ec4fe446d9ab27186da274d979558557fbdbbd10968fa9758552482720c54152a5640e08b9009e5a30706b66aba510692054d4129d32d0e12e05bbc0b96fb2
   languageName: node
   linkType: hard
 
-"esrecurse@npm:^4.1.0, esrecurse@npm:^4.3.0":
+"esrecurse@npm:^4.3.0":
   version: 4.3.0
   resolution: "esrecurse@npm:4.3.0"
   dependencies:
@@ -16744,9 +9907,9 @@ __metadata:
   linkType: hard
 
 "estraverse@npm:^5.1.0, estraverse@npm:^5.2.0":
-  version: 5.2.0
-  resolution: "estraverse@npm:5.2.0"
-  checksum: ec11b70d946bf5d7f76f91db38ef6f08109ac1b36cda293a26e678e58df4719f57f67b9ec87042afdd1f0267cee91865be3aa48d2161765a93defab5431be7b8
+  version: 5.3.0
+  resolution: "estraverse@npm:5.3.0"
+  checksum: 072780882dc8416ad144f8fe199628d2b3e7bbc9989d9ed43795d2c90309a2047e6bc5979d7e2322a341163d22cfad9e21f4110597fe487519697389497e4e2b
   languageName: node
   linkType: hard
 
@@ -16771,13 +9934,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"event-target-shim@npm:^5.0.0":
-  version: 5.0.1
-  resolution: "event-target-shim@npm:5.0.1"
-  checksum: 1ffe3bb22a6d51bdeb6bf6f7cf97d2ff4a74b017ad12284cc9e6a279e727dc30a5de6bb613e5596ff4dc3e517841339ad09a7eec44266eccb1aa201a30448166
-  languageName: node
-  linkType: hard
-
 "eventemitter3@npm:^4.0.0":
   version: 4.0.7
   resolution: "eventemitter3@npm:4.0.7"
@@ -16785,6 +9941,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"eventemitter3@npm:^5.0.1":
+  version: 5.0.1
+  resolution: "eventemitter3@npm:5.0.1"
+  checksum: 543d6c858ab699303c3c32e0f0f47fc64d360bf73c3daf0ac0b5079710e340d6fe9f15487f94e66c629f5f82cd1a8678d692f3dbb6f6fcd1190e1b97fcad36f8
+  languageName: node
+  linkType: hard
+
 "events-to-array@npm:^1.0.1":
   version: 1.1.2
   resolution: "events-to-array@npm:1.1.2"
@@ -16792,24 +9955,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"events@npm:^3.0.0, events@npm:^3.2.0, events@npm:^3.3.0":
+"events@npm:^3.2.0":
   version: 3.3.0
   resolution: "events@npm:3.3.0"
   checksum: f6f487ad2198aa41d878fa31452f1a3c00958f46e9019286ff4787c84aac329332ab45c9cdc8c445928fc6d7ded294b9e005a7fce9426488518017831b272780
   languageName: node
   linkType: hard
 
-"evp_bytestokey@npm:^1.0.0, evp_bytestokey@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "evp_bytestokey@npm:1.0.3"
-  dependencies:
-    md5.js: ^1.3.4
-    node-gyp: latest
-    safe-buffer: ^5.1.1
-  checksum: ad4e1577f1a6b721c7800dcc7c733fe01f6c310732bb5bf2240245c2a5b45a38518b91d8be2c610611623160b9d1c0e91f1ce96d639f8b53e8894625cf20fa45
-  languageName: node
-  linkType: hard
-
 "exec-sh@npm:^0.3.2, exec-sh@npm:^0.3.4":
   version: 0.3.6
   resolution: "exec-sh@npm:0.3.6"
@@ -16832,42 +9984,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"execa@npm:^2.0.0":
-  version: 2.1.0
-  resolution: "execa@npm:2.1.0"
-  dependencies:
-    cross-spawn: ^7.0.0
-    get-stream: ^5.0.0
-    is-stream: ^2.0.0
-    merge-stream: ^2.0.0
-    npm-run-path: ^3.0.0
-    onetime: ^5.1.0
-    p-finally: ^2.0.0
-    signal-exit: ^3.0.2
-    strip-final-newline: ^2.0.0
-  checksum: 93af9b816a555d0944e0876f4ccd97e0f4593d2049e713518fd5458a7699836449c516c6bb7e6357e11431ec40cce3150625b86d1b1254180faaa0d744265eca
-  languageName: node
-  linkType: hard
-
-"execa@npm:^3.0.0":
-  version: 3.4.0
-  resolution: "execa@npm:3.4.0"
-  dependencies:
-    cross-spawn: ^7.0.0
-    get-stream: ^5.0.0
-    human-signals: ^1.1.1
-    is-stream: ^2.0.0
-    merge-stream: ^2.0.0
-    npm-run-path: ^4.0.0
-    onetime: ^5.1.0
-    p-finally: ^2.0.0
-    signal-exit: ^3.0.2
-    strip-final-newline: ^2.0.0
-  checksum: 72832ff72f79f9082dc3567775cbb52f4682452f7d8015714d924e476a37c36a98183fd669317327ed2e7800ffe7ec2a7be4bfe704a2173ef22ae00109fe9123
-  languageName: node
-  linkType: hard
-
-"execa@npm:^4.0.0, execa@npm:^4.1.0":
+"execa@npm:^4.0.0":
   version: 4.1.0
   resolution: "execa@npm:4.1.0"
   dependencies:
@@ -16918,13 +10035,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"exists-sync@npm:0.0.4":
-  version: 0.0.4
-  resolution: "exists-sync@npm:0.0.4"
-  checksum: bb80d4570253bd1f932f3d62adada3acd7df9dddeba1c19181ed2f77111cad48e02913c341cac5079ad97e03b718f92a69b8e427946d7939c9487299a62035b4
-  languageName: node
-  linkType: hard
-
 "exit@npm:^0.1.2":
   version: 0.1.2
   resolution: "exit@npm:0.1.2"
@@ -16932,21 +10042,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"expand-brackets@npm:^2.1.4":
-  version: 2.1.4
-  resolution: "expand-brackets@npm:2.1.4"
-  dependencies:
-    debug: ^2.3.3
-    define-property: ^0.2.5
-    extend-shallow: ^2.0.1
-    posix-character-classes: ^0.1.0
-    regex-not: ^1.0.0
-    snapdragon: ^0.8.1
-    to-regex: ^3.0.1
-  checksum: 1781d422e7edfa20009e2abda673cadb040a6037f0bd30fcd7357304f4f0c284afd420d7622722ca4a016f39b6d091841ab57b401c1f7e2e5131ac65b9f14fa1
-  languageName: node
-  linkType: hard
-
 "expand-tilde@npm:^2.0.0, expand-tilde@npm:^2.0.2":
   version: 2.0.2
   resolution: "expand-tilde@npm:2.0.2"
@@ -16956,110 +10051,60 @@ __metadata:
   languageName: node
   linkType: hard
 
-"express@npm:^4.10.7":
-  version: 4.17.1
-  resolution: "express@npm:4.17.1"
-  dependencies:
-    accepts: ~1.3.7
-    array-flatten: 1.1.1
-    body-parser: 1.19.0
-    content-disposition: 0.5.3
-    content-type: ~1.0.4
-    cookie: 0.4.0
-    cookie-signature: 1.0.6
-    debug: 2.6.9
-    depd: ~1.1.2
-    encodeurl: ~1.0.2
-    escape-html: ~1.0.3
-    etag: ~1.8.1
-    finalhandler: ~1.1.2
-    fresh: 0.5.2
-    merge-descriptors: 1.0.1
-    methods: ~1.1.2
-    on-finished: ~2.3.0
-    parseurl: ~1.3.3
-    path-to-regexp: 0.1.7
-    proxy-addr: ~2.0.5
-    qs: 6.7.0
-    range-parser: ~1.2.1
-    safe-buffer: 5.1.2
-    send: 0.17.1
-    serve-static: 1.14.1
-    setprototypeof: 1.1.1
-    statuses: ~1.5.0
-    type-is: ~1.6.18
-    utils-merge: 1.0.1
-    vary: ~1.1.2
-  checksum: d964e9e17af331ea6fa2f84999b063bc47189dd71b4a735df83f9126d3bb2b92e830f1cb1d7c2742530eb625e2689d7a9a9c71f0c3cc4dd6015c3cd32a01abd5
+"exponential-backoff@npm:^3.1.1":
+  version: 3.1.2
+  resolution: "exponential-backoff@npm:3.1.2"
+  checksum: 7e191e3dd6edd8c56c88f2c8037c98fbb8034fe48778be53ed8cb30ccef371a061a4e999a469aab939b92f8f12698f3b426d52f4f76b7a20da5f9f98c3cbc862
   languageName: node
   linkType: hard
 
-"express@npm:^4.18.1":
-  version: 4.18.2
-  resolution: "express@npm:4.18.2"
+"express@npm:^4.10.7, express@npm:^4.18.1":
+  version: 4.21.2
+  resolution: "express@npm:4.21.2"
   dependencies:
     accepts: ~1.3.8
     array-flatten: 1.1.1
-    body-parser: 1.20.1
+    body-parser: 1.20.3
     content-disposition: 0.5.4
     content-type: ~1.0.4
-    cookie: 0.5.0
+    cookie: 0.7.1
     cookie-signature: 1.0.6
     debug: 2.6.9
     depd: 2.0.0
-    encodeurl: ~1.0.2
+    encodeurl: ~2.0.0
     escape-html: ~1.0.3
     etag: ~1.8.1
-    finalhandler: 1.2.0
+    finalhandler: 1.3.1
     fresh: 0.5.2
     http-errors: 2.0.0
-    merge-descriptors: 1.0.1
+    merge-descriptors: 1.0.3
     methods: ~1.1.2
     on-finished: 2.4.1
     parseurl: ~1.3.3
-    path-to-regexp: 0.1.7
+    path-to-regexp: 0.1.12
     proxy-addr: ~2.0.7
-    qs: 6.11.0
+    qs: 6.13.0
     range-parser: ~1.2.1
     safe-buffer: 5.2.1
-    send: 0.18.0
-    serve-static: 1.15.0
+    send: 0.19.0
+    serve-static: 1.16.2
     setprototypeof: 1.2.0
     statuses: 2.0.1
     type-is: ~1.6.18
     utils-merge: 1.0.1
     vary: ~1.1.2
-  checksum: 3c4b9b076879442f6b968fe53d85d9f1eeacbb4f4c41e5f16cc36d77ce39a2b0d81b3f250514982110d815b2f7173f5561367f9110fcc541f9371948e8c8b037
-  languageName: node
-  linkType: hard
-
-"extend-shallow@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "extend-shallow@npm:2.0.1"
-  dependencies:
-    is-extendable: ^0.1.0
-  checksum: 8fb58d9d7a511f4baf78d383e637bd7d2e80843bd9cd0853649108ea835208fb614da502a553acc30208e1325240bb7cc4a68473021612496bb89725483656d8
-  languageName: node
-  linkType: hard
-
-"extend-shallow@npm:^3.0.0, extend-shallow@npm:^3.0.2":
-  version: 3.0.2
-  resolution: "extend-shallow@npm:3.0.2"
-  dependencies:
-    assign-symbols: ^1.0.0
-    is-extendable: ^1.0.1
-  checksum: a920b0cd5838a9995ace31dfd11ab5e79bf6e295aa566910ce53dff19f4b1c0fda2ef21f26b28586c7a2450ca2b42d97bd8c0f5cec9351a819222bf861e02461
+  checksum: 3aef1d355622732e20b8f3a7c112d4391d44e2131f4f449e1f273a309752a41abfad714e881f177645517cbe29b3ccdc10b35e7e25c13506114244a5b72f549d
   languageName: node
   linkType: hard
 
-"extend@npm:^3.0.0, extend@npm:~3.0.2":
+"extend@npm:^3.0.0, extend@npm:^3.0.2":
   version: 3.0.2
   resolution: "extend@npm:3.0.2"
   checksum: a50a8309ca65ea5d426382ff09f33586527882cf532931cb08ca786ea3146c0553310bda688710ff61d7668eba9f96b923fe1420cdf56a2c3eaf30fcab87b515
   languageName: node
   linkType: hard
 
-"external-editor@npm:^3.0.3":
+"external-editor@npm:^3.0.3, external-editor@npm:^3.1.0":
   version: 3.1.0
   resolution: "external-editor@npm:3.1.0"
   dependencies:
@@ -17070,22 +10115,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"extglob@npm:^2.0.4":
-  version: 2.0.4
-  resolution: "extglob@npm:2.0.4"
-  dependencies:
-    array-unique: ^0.3.2
-    define-property: ^1.0.0
-    expand-brackets: ^2.1.4
-    extend-shallow: ^2.0.1
-    fragment-cache: ^0.2.1
-    regex-not: ^1.0.0
-    snapdragon: ^0.8.1
-    to-regex: ^3.0.1
-  checksum: a41531b8934735b684cef5e8c5a01d0f298d7d384500ceca38793a9ce098125aab04ee73e2d75d5b2901bc5dddd2b64e1b5e3bf19139ea48bac52af4a92f1d00
-  languageName: node
-  linkType: hard
-
 "extract-stack@npm:^2.0.0":
   version: 2.0.0
   resolution: "extract-stack@npm:2.0.0"
@@ -17093,21 +10122,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"extsprintf@npm:1.3.0":
-  version: 1.3.0
-  resolution: "extsprintf@npm:1.3.0"
-  checksum: cee7a4a1e34cffeeec18559109de92c27517e5641991ec6bab849aa64e3081022903dd53084f2080d0d2530803aa5ee84f1e9de642c365452f9e67be8f958ce2
-  languageName: node
-  linkType: hard
-
-"extsprintf@npm:^1.2.0":
-  version: 1.4.0
-  resolution: "extsprintf@npm:1.4.0"
-  checksum: 184dc8a413eb4b1ff16bdce797340e7ded4d28511d56a1c9afa5a95bcff6ace154063823eaf0206dbbb0d14059d74f382a15c34b7c0636fa74a7e681295eb67e
-  languageName: node
-  linkType: hard
-
-"fake-xml-http-request@npm:^2.1.1, fake-xml-http-request@npm:^2.1.2":
+"fake-xml-http-request@npm:^2.1.2":
   version: 2.1.2
   resolution: "fake-xml-http-request@npm:2.1.2"
   checksum: 7b1ebea1955c46cbda0e0c3308716cc82beca7bb6c549f1d1c2a8134203c9d6c5a21194e2c1e17650ff073ecbcd3e56cf1e21f248a86cbcb3567fd7a9ca4850e
@@ -17122,49 +10137,22 @@ __metadata:
   linkType: hard
 
 "fast-diff@npm:^1.1.2":
-  version: 1.2.0
-  resolution: "fast-diff@npm:1.2.0"
-  checksum: 1b5306eaa9e826564d9e5ffcd6ebd881eb5f770b3f977fcbf38f05c824e42172b53c79920e8429c54eb742ce15a0caf268b0fdd5b38f6de52234c4a8368131ae
-  languageName: node
-  linkType: hard
-
-"fast-glob@npm:^3.0.3, fast-glob@npm:^3.1.1":
-  version: 3.2.5
-  resolution: "fast-glob@npm:3.2.5"
-  dependencies:
-    "@nodelib/fs.stat": ^2.0.2
-    "@nodelib/fs.walk": ^1.2.3
-    glob-parent: ^5.1.0
-    merge2: ^1.3.0
-    micromatch: ^4.0.2
-    picomatch: ^2.2.1
-  checksum: 5d6772c9b63dbb739d60b5630851e1f2cbf9744119e0968eac44c9f8cbc2d3d5cb4f2f0c74715ccb23daa336c87bea42186ed367e6c991afee61cd3d967320eb
-  languageName: node
-  linkType: hard
-
-"fast-glob@npm:^3.2.9":
-  version: 3.2.12
-  resolution: "fast-glob@npm:3.2.12"
-  dependencies:
-    "@nodelib/fs.stat": ^2.0.2
-    "@nodelib/fs.walk": ^1.2.3
-    glob-parent: ^5.1.2
-    merge2: ^1.3.0
-    micromatch: ^4.0.4
-  checksum: 0b1990f6ce831c7e28c4d505edcdaad8e27e88ab9fa65eedadb730438cfc7cde4910d6c975d6b7b8dc8a73da4773702ebcfcd6e3518e73938bb1383badfe01c2
+  version: 1.3.0
+  resolution: "fast-diff@npm:1.3.0"
+  checksum: d22d371b994fdc8cce9ff510d7b8dc4da70ac327bcba20df607dd5b9cae9f908f4d1028f5fe467650f058d1e7270235ae0b8230809a262b4df587a3b3aa216c3
   languageName: node
   linkType: hard
 
-"fast-glob@npm:^3.3.0":
-  version: 3.3.0
-  resolution: "fast-glob@npm:3.3.0"
+"fast-glob@npm:^3.0.3, fast-glob@npm:^3.2.11, fast-glob@npm:^3.2.9, fast-glob@npm:^3.3.3":
+  version: 3.3.3
+  resolution: "fast-glob@npm:3.3.3"
   dependencies:
     "@nodelib/fs.stat": ^2.0.2
     "@nodelib/fs.walk": ^1.2.3
     glob-parent: ^5.1.2
     merge2: ^1.3.0
-    micromatch: ^4.0.4
-  checksum: 20df62be28eb5426fe8e40e0d05601a63b1daceb7c3d87534afcad91bdcf1e4b1743cf2d5247d6e225b120b46df0b9053a032b2691ba34ee121e033acd81f547
+    micromatch: ^4.0.8
+  checksum: 0704d7b85c0305fd2cef37777337dfa26230fdd072dce9fb5c82a4b03156f3ffb8ed3e636033e65d45d2a5805a4e475825369a27404c0307f2db0c8eb3366fbd
   languageName: node
   linkType: hard
 
@@ -17175,14 +10163,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fast-levenshtein@npm:^2.0.6, fast-levenshtein@npm:~2.0.6":
+"fast-levenshtein@npm:^2.0.6":
   version: 2.0.6
   resolution: "fast-levenshtein@npm:2.0.6"
   checksum: 92cfec0a8dfafd9c7a15fba8f2cc29cd0b62b85f056d99ce448bbcd9f708e18ab2764bda4dd5158364f4145a7c72788538994f0d1787b956ef0d1062b0f7c24c
   languageName: node
   linkType: hard
 
-"fast-ordered-set@npm:^1.0.0, fast-ordered-set@npm:^1.0.2":
+"fast-ordered-set@npm:^1.0.0":
   version: 1.0.3
   resolution: "fast-ordered-set@npm:1.0.3"
   dependencies:
@@ -17191,9 +10179,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fast-sourcemap-concat@npm:^1.4.0":
-  version: 1.4.0
-  resolution: "fast-sourcemap-concat@npm:1.4.0"
+"fast-sourcemap-concat@npm:^2.1.0":
+  version: 2.1.1
+  resolution: "fast-sourcemap-concat@npm:2.1.1"
   dependencies:
     chalk: ^2.0.0
     fs-extra: ^5.0.0
@@ -17202,28 +10190,18 @@ __metadata:
     mkdirp: ^0.5.0
     source-map: ^0.4.2
     source-map-url: ^0.3.0
-    sourcemap-validator: ^1.1.0
-  checksum: d657d8cf5bf23a41a77014e795babfbca77a025ec3840437c42efa882f23f6fad023fdf6108672adc0f7e183c1b619b8dc28de7e297beebebb28aee3bb43be75
+  checksum: 0eb14eb6683541e1f793a359145f06341572d0a7ce5d2c04fd0004dc385d2454ee1f98c46b7bf7e0aac06115bfb00712f2061f058ce491e11a8560df16d5c6ed
   languageName: node
   linkType: hard
 
-"fast-sourcemap-concat@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "fast-sourcemap-concat@npm:2.1.0"
-  dependencies:
-    chalk: ^2.0.0
-    fs-extra: ^5.0.0
-    heimdalljs-logger: ^0.1.9
-    memory-streams: ^0.1.3
-    mkdirp: ^0.5.0
-    source-map: ^0.4.2
-    source-map-url: ^0.3.0
-    sourcemap-validator: ^1.1.0
-  checksum: d8ee2f37ec483f4ff30988186497652e065df81f2286c3f11e2934209736d3662d9f8140d8d1d41cfb9529aff9f1a9a7960d08ac2d92f6fb2ffba3358f32f4d4
+"fast-uri@npm:^3.0.1":
+  version: 3.0.6
+  resolution: "fast-uri@npm:3.0.6"
+  checksum: 7161ba2a7944778d679ba8e5f00d6a2bb479a2142df0982f541d67be6c979b17808f7edbb0ce78161c85035974bde3fa52b5137df31da46c0828cb629ba67c4e
   languageName: node
   linkType: hard
 
-"fastest-levenshtein@npm:^1.0.16":
+"fastest-levenshtein@npm:^1.0.12, fastest-levenshtein@npm:^1.0.16":
   version: 1.0.16
   resolution: "fastest-levenshtein@npm:1.0.16"
   checksum: a78d44285c9e2ae2c25f3ef0f8a73f332c1247b7ea7fb4a191e6bb51aa6ee1ef0dfb3ed113616dcdc7023e18e35a8db41f61c8d88988e877cf510df8edafbc71
@@ -17231,11 +10209,11 @@ __metadata:
   linkType: hard
 
 "fastq@npm:^1.6.0":
-  version: 1.11.0
-  resolution: "fastq@npm:1.11.0"
+  version: 1.19.1
+  resolution: "fastq@npm:1.19.1"
   dependencies:
     reusify: ^1.0.4
-  checksum: 9db0ceea9280c5f207da40c562a4e574913c18933cd74b880b01bf8e81a9a6e368ec71e89c9c1b9f4066d0275cc22600efd6dde87f713217acbf67076481734b
+  checksum: 7691d1794fb84ad0ec2a185f10e00f0e1713b894e2c9c4d42f0bc0ba5f8c00e6e655a202074ca0b91b9c3d977aab7c30c41a8dc069fb5368576ac0054870a0e6
   languageName: node
   linkType: hard
 
@@ -17249,27 +10227,39 @@ __metadata:
   linkType: hard
 
 "faye-websocket@npm:^0.11.3":
-  version: 0.11.3
-  resolution: "faye-websocket@npm:0.11.3"
+  version: 0.11.4
+  resolution: "faye-websocket@npm:0.11.4"
   dependencies:
     websocket-driver: ">=0.5.1"
-  checksum: d7b2d68546812ea24e3079bd1e08bf1d79cd6d6137bfcea565d1cb1f6a5fc8fc29b689df2c1aff8b8b291d60fc808e1b27aa2896b86ba77ded10f1d9734c8e9f
+  checksum: d49a62caf027f871149fc2b3f3c7104dc6d62744277eb6f9f36e2d5714e847d846b9f7f0d0b7169b25a012e24a594cde11a93034b30732e4c683f20b8a5019fa
   languageName: node
   linkType: hard
 
 "fb-watchman@npm:^2.0.0, fb-watchman@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "fb-watchman@npm:2.0.1"
+  version: 2.0.2
+  resolution: "fb-watchman@npm:2.0.2"
   dependencies:
     bser: 2.1.1
-  checksum: 8510230778ab3a51c27dffb1b76ef2c24fab672a42742d3c0a45c2e9d1e5f20210b1fbca33486088da4a9a3958bde96b5aec0a63aac9894b4e9df65c88b2cbd6
+  checksum: b15a124cef28916fe07b400eb87cbc73ca082c142abf7ca8e8de6af43eca79ca7bd13eb4d4d48240b3bd3136eaac40d16e42d6edf87a8e5d1dd8070626860c78
   languageName: node
   linkType: hard
 
-"figgy-pudding@npm:^3.5.1":
-  version: 3.5.2
-  resolution: "figgy-pudding@npm:3.5.2"
-  checksum: 4090bd66193693dcda605e44d6b8715d8fb5c92a67acd57826e55cf816a342f550d57e5638f822b39366e1b2fdb244e99b3068a37213aa1d6c1bf602b8fde5ae
+"fdir@npm:^6.4.4":
+  version: 6.4.4
+  resolution: "fdir@npm:6.4.4"
+  peerDependencies:
+    picomatch: ^3 || ^4
+  peerDependenciesMeta:
+    picomatch:
+      optional: true
+  checksum: 79043610236579ffbd0647c508b43bd030a2d034a17c43cf96813a00e8e92e51acdb115c6ddecef3b5812cc2692b976155b4f6413e51e3761f1e772fa019a321
+  languageName: node
+  linkType: hard
+
+"fflate@npm:^0.4.8":
+  version: 0.4.8
+  resolution: "fflate@npm:0.4.8"
+  checksum: 29d8cbe44d5e7f53e7f5a160ac7f9cc025480c7b3bfd85c5f898cbe20dfa2dad4732daa534982664bf30b35896a90af44ea33ede5d94c5ffd1b8b0c0a0a56ca2
   languageName: node
   linkType: hard
 
@@ -17282,7 +10272,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"figures@npm:^3.0.0, figures@npm:^3.2.0":
+"figures@npm:^3.0.0":
   version: 3.2.0
   resolution: "figures@npm:3.2.0"
   dependencies:
@@ -17291,6 +10281,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"file-entry-cache@npm:^10.0.8":
+  version: 10.1.0
+  resolution: "file-entry-cache@npm:10.1.0"
+  dependencies:
+    flat-cache: ^6.1.9
+  checksum: 2d6a2e14f8dfbad33a4cf28efbf45c76e34183e8920ac676624ad8d48e785711340b26a6eed816a8aa3d80fcde99477c63c30e0b923b5bca0b9fdf7c5e69b6c8
+  languageName: node
+  linkType: hard
+
 "file-entry-cache@npm:^6.0.1":
   version: 6.0.1
   resolution: "file-entry-cache@npm:6.0.1"
@@ -17300,49 +10299,40 @@ __metadata:
   languageName: node
   linkType: hard
 
-"file-uri-to-path@npm:1.0.0":
-  version: 1.0.0
-  resolution: "file-uri-to-path@npm:1.0.0"
-  checksum: b648580bdd893a008c92c7ecc96c3ee57a5e7b6c4c18a9a09b44fb5d36d79146f8e442578bc0e173dc027adf3987e254ba1dfd6e3ec998b7c282873010502144
+"file-set@npm:^4.0.2":
+  version: 4.0.2
+  resolution: "file-set@npm:4.0.2"
+  dependencies:
+    array-back: ^5.0.0
+    glob: ^7.1.6
+  checksum: 6eacb9df4a0a95fbfb09e8ccdf8c3ef7f30de8c0b5043ff0530a79c0c0003550a0725eba517a5c7fe1c452df57c3b4d506e91859ccc248aebb2f038790eb66e6
   languageName: node
   linkType: hard
 
-"filesize@npm:^10.0.5":
-  version: 10.0.7
-  resolution: "filesize@npm:10.0.7"
-  checksum: acabe6ddcf0c06eb86a9b2ac0a93db48d2438037dce4f7ec5cf6ee32284a8d961b1efc251af1c05e7316ccf1e78c68cdc32655511745cc2580f9b8c309b523ce
+"filesize@npm:^10.0.8":
+  version: 10.1.6
+  resolution: "filesize@npm:10.1.6"
+  checksum: a797a9d41c8f27a9ae334d23f99fc5d903eac5d03c82190dc163901205435b56626fe1260c779ba3e87a2a34d426f19ff264c3f7d956e00f2d3ac69760b52e33
   languageName: node
   linkType: hard
 
-"filesize@npm:^4.1.2, filesize@npm:^4.2.1":
+"filesize@npm:~4.2.1":
   version: 4.2.1
   resolution: "filesize@npm:4.2.1"
   checksum: 3179f5852519cfe140bdd1e35852d552654e1e232f45b76d5a0df7cefa810b66b4808650cd1705ab00821c5709520bf01fbf7bf74872bd2652a420bfdcbb1a82
   languageName: node
   linkType: hard
 
-"fill-range@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "fill-range@npm:4.0.0"
-  dependencies:
-    extend-shallow: ^2.0.1
-    is-number: ^3.0.0
-    repeat-string: ^1.6.1
-    to-regex-range: ^2.1.0
-  checksum: dbb5102467786ab42bc7a3ec7380ae5d6bfd1b5177b2216de89e4a541193f8ba599a6db84651bd2c58c8921db41b8cc3d699ea83b477342d3ce404020f73c298
-  languageName: node
-  linkType: hard
-
-"fill-range@npm:^7.0.1":
-  version: 7.0.1
-  resolution: "fill-range@npm:7.0.1"
+"fill-range@npm:^7.1.1":
+  version: 7.1.1
+  resolution: "fill-range@npm:7.1.1"
   dependencies:
     to-regex-range: ^5.0.1
-  checksum: cc283f4e65b504259e64fd969bcf4def4eb08d85565e906b7d36516e87819db52029a76b6363d0f02d0d532f0033c9603b9e2d943d56ee3b0d4f7ad3328ff917
+  checksum: b4abfbca3839a3d55e4ae5ec62e131e2e356bf4859ce8480c64c4876100f4df292a63e5bb1618e1d7460282ca2b305653064f01654474aa35c68000980f17798
   languageName: node
   linkType: hard
 
-"finalhandler@npm:1.1.2, finalhandler@npm:~1.1.2":
+"finalhandler@npm:1.1.2":
   version: 1.1.2
   resolution: "finalhandler@npm:1.1.2"
   dependencies:
@@ -17357,49 +10347,37 @@ __metadata:
   languageName: node
   linkType: hard
 
-"finalhandler@npm:1.2.0":
-  version: 1.2.0
-  resolution: "finalhandler@npm:1.2.0"
+"finalhandler@npm:1.3.1":
+  version: 1.3.1
+  resolution: "finalhandler@npm:1.3.1"
   dependencies:
     debug: 2.6.9
-    encodeurl: ~1.0.2
+    encodeurl: ~2.0.0
     escape-html: ~1.0.3
     on-finished: 2.4.1
     parseurl: ~1.3.3
     statuses: 2.0.1
     unpipe: ~1.0.0
-  checksum: 92effbfd32e22a7dff2994acedbd9bcc3aa646a3e919ea6a53238090e87097f8ef07cced90aa2cc421abdf993aefbdd5b00104d55c7c5479a8d00ed105b45716
+  checksum: a8c58cd97c9cd47679a870f6833a7b417043f5a288cd6af6d0f49b476c874a506100303a128b6d3b654c3d74fa4ff2ffed68a48a27e8630cda5c918f2977dcf4
   languageName: node
   linkType: hard
 
-"find-babel-config@npm:^1.1.0, find-babel-config@npm:^1.2.0":
-  version: 1.2.0
-  resolution: "find-babel-config@npm:1.2.0"
+"find-babel-config@npm:^1.1.0":
+  version: 1.2.2
+  resolution: "find-babel-config@npm:1.2.2"
   dependencies:
-    json5: ^0.5.1
+    json5: ^1.0.2
     path-exists: ^3.0.0
-  checksum: 0a1785d3da9f38637885d9d65f183aaa072f51a834f733035e9694e4d0f6983ae8c8e75cd4e08b92af6f595b3b490ee813a1c5a9b14740685aa836fa1e878583
+  checksum: 9dd8ef0f47c5d83f6bf4106c1e21c6e62dd8b11d32ce0df3700b141ca119c63bd849cc3ade7e54c39c8a235b9c2a6ac598acda801f82582514b7b9c64027771d
   languageName: node
   linkType: hard
 
-"find-babel-config@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "find-babel-config@npm:2.0.0"
-  dependencies:
-    json5: ^2.1.1
-    path-exists: ^4.0.0
-  checksum: d110308b02fe6a6411a0cfb7fd50af6740fbf5093eada3d6ddacf99b07fc8eea4aa3475356484710a0032433029a21ce733bb3ef88fda1d6e35c29a3e4983014
-  languageName: node
-  linkType: hard
-
-"find-cache-dir@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "find-cache-dir@npm:2.1.0"
+"find-babel-config@npm:^2.1.1":
+  version: 2.1.2
+  resolution: "find-babel-config@npm:2.1.2"
   dependencies:
-    commondir: ^1.0.1
-    make-dir: ^2.0.0
-    pkg-dir: ^3.0.0
-  checksum: 60ad475a6da9f257df4e81900f78986ab367d4f65d33cf802c5b91e969c28a8762f098693d7a571b6e4dd4c15166c2da32ae2d18b6766a18e2071079448fdce4
+    json5: ^2.2.3
+  checksum: 268f29cb38ee086b0f953c89f762dcea30b5b0e14abee2b39516410c00b49baa6821f598bd50346c93584e5625c5740f5c8b7e34993f568787a068f84dacc8c2
   languageName: node
   linkType: hard
 
@@ -17421,6 +10399,27 @@ __metadata:
   languageName: node
   linkType: hard
 
+"find-replace@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "find-replace@npm:3.0.0"
+  dependencies:
+    array-back: ^3.0.1
+  checksum: 6b04bcfd79027f5b84aa1dfe100e3295da989bdac4b4de6b277f4d063e78f5c9e92ebc8a1fec6dd3b448c924ba404ee051cc759e14a3ee3e825fa1361025df08
+  languageName: node
+  linkType: hard
+
+"find-replace@npm:^5.0.1":
+  version: 5.0.2
+  resolution: "find-replace@npm:5.0.2"
+  peerDependencies:
+    "@75lb/nature": "*"
+  peerDependenciesMeta:
+    "@75lb/nature":
+      optional: true
+  checksum: 964fb76cf084638c4202628c65c03763fd8627b84b18c0948470b429371d18c5a0340167097961222d4decbcc4502880d776c57c1c3ef5f3d0081b8fde0e17ea
+  languageName: node
+  linkType: hard
+
 "find-up@npm:^2.1.0":
   version: 2.1.0
   resolution: "find-up@npm:2.1.0"
@@ -17459,23 +10458,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"find-up@npm:^6.3.0":
-  version: 6.3.0
-  resolution: "find-up@npm:6.3.0"
+"find-up@npm:^7.0.0":
+  version: 7.0.0
+  resolution: "find-up@npm:7.0.0"
   dependencies:
-    locate-path: ^7.1.0
+    locate-path: ^7.2.0
     path-exists: ^5.0.0
-  checksum: 9a21b7f9244a420e54c6df95b4f6fc3941efd3c3e5476f8274eb452f6a85706e7a6a90de71353ee4f091fcb4593271a6f92810a324ec542650398f928783c280
-  languageName: node
-  linkType: hard
-
-"find-yarn-workspace-root@npm:^1.1.0":
-  version: 1.2.1
-  resolution: "find-yarn-workspace-root@npm:1.2.1"
-  dependencies:
-    fs-extra: ^4.0.3
-    micromatch: ^3.1.4
-  checksum: a8f4565fb1ead6122acc0d324fa3257c20f7b0c91b7b266dab9eee7251fb5558fcff5b35dbfd301bfd1cbb91c1cdd1799b28ffa5b9a92efd8c7ded3663652bbe
+    unicorn-magic: ^0.1.0
+  checksum: e1c63860f9c04355ab2aa19f4be51c1a6e14a7d8cfbd8090e2be6da2a36a76995907cb45337a4b582b19b164388f71d6ab118869dc7bffb2093f2c089ecb95ee
   languageName: node
   linkType: hard
 
@@ -17512,16 +10502,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fireworm@npm:^0.7.0":
-  version: 0.7.1
-  resolution: "fireworm@npm:0.7.1"
+"fireworm@npm:^0.7.2":
+  version: 0.7.2
+  resolution: "fireworm@npm:0.7.2"
   dependencies:
     async: ~0.2.9
     is-type: 0.0.1
     lodash.debounce: ^3.1.1
     lodash.flatten: ^3.0.2
     minimatch: ^3.0.2
-  checksum: 118ac822c5594f832db082475ac40e3d5532a84ed1aa74c04aee6827e3940b62cde5551308643afdead594f07aa5fb24a140eec51d4fa63945729d4c0fa6c401
+  checksum: 0ad72e2ff34df45a5264da39e504b47964e350fbe575186306c8743799a0330c227870efd67e65d031532b14b5b01a9602c5c691c818b7902818bfd44a8b1aa8
   languageName: node
   linkType: hard
 
@@ -17584,38 +10574,40 @@ __metadata:
   linkType: hard
 
 "flat-cache@npm:^3.0.4":
-  version: 3.0.4
-  resolution: "flat-cache@npm:3.0.4"
+  version: 3.2.0
+  resolution: "flat-cache@npm:3.2.0"
   dependencies:
-    flatted: ^3.1.0
+    flatted: ^3.2.9
+    keyv: ^4.5.3
     rimraf: ^3.0.2
-  checksum: 4fdd10ecbcbf7d520f9040dd1340eb5dfe951e6f0ecf2252edeec03ee68d989ec8b9a20f4434270e71bcfd57800dc09b3344fca3966b2eb8f613072c7d9a2365
+  checksum: e7e0f59801e288b54bee5cb9681e9ee21ee28ef309f886b312c9d08415b79fc0f24ac842f84356ce80f47d6a53de62197ce0e6e148dc42d5db005992e2a756ec
   languageName: node
   linkType: hard
 
-"flat@npm:^6.0.1":
-  version: 6.0.1
-  resolution: "flat@npm:6.0.1"
-  bin:
-    flat: cli.js
-  checksum: c7a5f2e7e3ba0bec28b9c3aca27e68ff74df446df15cdb77ddef9e3d4fd0e9321ca52e49ca8b861c46157215006666b0dad25457f231083fc7bd2f7fcb67d7eb
+"flat-cache@npm:^6.1.9":
+  version: 6.1.9
+  resolution: "flat-cache@npm:6.1.9"
+  dependencies:
+    cacheable: ^1.9.0
+    flatted: ^3.3.3
+    hookified: ^1.8.2
+  checksum: f1423c494bbb8b59545b9a53a60ae3817c36795cb7723456437fba0c70f16e811f5b103945669c97ae672aa58250add3aeb2f1fc8be7b6af05cd20d80ab381b9
   languageName: node
   linkType: hard
 
-"flatted@npm:^3.1.0":
-  version: 3.1.1
-  resolution: "flatted@npm:3.1.1"
-  checksum: 508935e3366d95444131f0aaa801a4301f24ea5bcb900d12764e7335b46b910730cc1b5bcfcfb8eccb7c8db261ba0671c6a7ca30d10870ff7a7756dc7e731a7a
+"flat@npm:^5.0.2":
+  version: 5.0.2
+  resolution: "flat@npm:5.0.2"
+  bin:
+    flat: cli.js
+  checksum: 12a1536ac746db74881316a181499a78ef953632ddd28050b7a3a43c62ef5462e3357c8c29d76072bb635f147f7a9a1f0c02efef6b4be28f8db62ceb3d5c7f5d
   languageName: node
   linkType: hard
 
-"flush-write-stream@npm:^1.0.0":
-  version: 1.1.1
-  resolution: "flush-write-stream@npm:1.1.1"
-  dependencies:
-    inherits: ^2.0.3
-    readable-stream: ^2.3.6
-  checksum: 42e07747f83bcd4e799da802e621d6039787749ffd41f5517f8c4f786ee967e31ba32b09f8b28a9c6f67bd4f5346772e604202df350e8d99f4141771bae31279
+"flatted@npm:^3.2.9, flatted@npm:^3.3.3":
+  version: 3.3.3
+  resolution: "flatted@npm:3.3.3"
+  checksum: 8c96c02fbeadcf4e8ffd0fa24983241e27698b0781295622591fc13585e2f226609d95e422bcf2ef044146ffacb6b68b1f20871454eddf75ab3caa6ee5f4a1fe
   languageName: node
   linkType: hard
 
@@ -17629,56 +10621,31 @@ __metadata:
   linkType: hard
 
 "follow-redirects@npm:^1.0.0":
-  version: 1.14.0
-  resolution: "follow-redirects@npm:1.14.0"
+  version: 1.15.9
+  resolution: "follow-redirects@npm:1.15.9"
   peerDependenciesMeta:
     debug:
       optional: true
-  checksum: a6568930fb97f6f4c12eac52acc109e8677d4b26fcae463bab7de50c43e44886b94784be6608dd8f2ab4b015328377fb4be2e83abd2c8d6bc39ffe1cf11f7b5a
+  checksum: 859e2bacc7a54506f2bf9aacb10d165df78c8c1b0ceb8023f966621b233717dab56e8d08baadc3ad3b9db58af290413d585c999694b7c146aaf2616340c3d2a6
   languageName: node
   linkType: hard
 
-"for-each@npm:^0.3.3":
-  version: 0.3.3
-  resolution: "for-each@npm:0.3.3"
+"for-each@npm:^0.3.3, for-each@npm:^0.3.5":
+  version: 0.3.5
+  resolution: "for-each@npm:0.3.5"
   dependencies:
-    is-callable: ^1.1.3
-  checksum: 6c48ff2bc63362319c65e2edca4a8e1e3483a2fabc72fbe7feaf8c73db94fc7861bd53bc02c8a66a0c1dd709da6b04eec42e0abdd6b40ce47305ae92a25e5d28
-  languageName: node
-  linkType: hard
-
-"for-in@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "for-in@npm:1.0.2"
-  checksum: 09f4ae93ce785d253ac963d94c7f3432d89398bf25ac7a24ed034ca393bf74380bdeccc40e0f2d721a895e54211b07c8fad7132e8157827f6f7f059b70b4043d
+    is-callable: ^1.2.7
+  checksum: 3c986d7e11f4381237cc98baa0a2f87eabe74719eee65ed7bed275163082b940ede19268c61d04c6260e0215983b12f8d885e3c8f9aa8c2113bf07c37051745c
   languageName: node
   linkType: hard
 
 "foreground-child@npm:^3.1.0":
-  version: 3.1.1
-  resolution: "foreground-child@npm:3.1.1"
+  version: 3.3.1
+  resolution: "foreground-child@npm:3.3.1"
   dependencies:
-    cross-spawn: ^7.0.0
+    cross-spawn: ^7.0.6
     signal-exit: ^4.0.1
-  checksum: 139d270bc82dc9e6f8bc045fe2aae4001dc2472157044fdfad376d0a3457f77857fa883c1c8b21b491c6caade9a926a4bed3d3d2e8d3c9202b151a4cbbd0bcd5
-  languageName: node
-  linkType: hard
-
-"forever-agent@npm:~0.6.1":
-  version: 0.6.1
-  resolution: "forever-agent@npm:0.6.1"
-  checksum: 766ae6e220f5fe23676bb4c6a99387cec5b7b62ceb99e10923376e27bfea72f3c3aeec2ba5f45f3f7ba65d6616965aa7c20b15002b6860833bb6e394dea546a8
-  languageName: node
-  linkType: hard
-
-"form-data@npm:~2.3.2":
-  version: 2.3.3
-  resolution: "form-data@npm:2.3.3"
-  dependencies:
-    asynckit: ^0.4.0
-    combined-stream: ^1.0.6
-    mime-types: ^2.1.12
-  checksum: 10c1780fa13dbe1ff3100114c2ce1f9307f8be10b14bf16e103815356ff567b6be39d70fc4a40f8990b9660012dc24b0f5e1dde1b6426166eb23a445ba068ca3
+  checksum: b2c1a6fc0bf0233d645d9fefdfa999abf37db1b33e5dab172b3cbfb0662b88bfbd2c9e7ab853533d199050ec6b65c03fcf078fc212d26e4990220e98c6930eef
   languageName: node
   linkType: hard
 
@@ -17696,22 +10663,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"forwarded@npm:~0.1.2":
-  version: 0.1.2
-  resolution: "forwarded@npm:0.1.2"
-  checksum: 54695c574292f9bc6bfa52111844337bc2e61cfcc5ec82f16b816d721a67a0c76b4849a34b57e38e51d64ddbb81aef974f393579f610ed1b990470e75abad2e0
-  languageName: node
-  linkType: hard
-
-"fragment-cache@npm:^0.2.1":
-  version: 0.2.1
-  resolution: "fragment-cache@npm:0.2.1"
-  dependencies:
-    map-cache: ^0.2.2
-  checksum: 1cbbd0b0116b67d5790175de0038a11df23c1cd2e8dcdbade58ebba5594c2d641dade6b4f126d82a7b4a6ffc2ea12e3d387dbb64ea2ae97cf02847d436f60fdc
-  languageName: node
-  linkType: hard
-
 "fresh@npm:0.5.2":
   version: 0.5.2
   resolution: "fresh@npm:0.5.2"
@@ -17719,16 +10670,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"from2@npm:^2.1.0":
-  version: 2.3.0
-  resolution: "from2@npm:2.3.0"
-  dependencies:
-    inherits: ^2.0.1
-    readable-stream: ^2.0.0
-  checksum: 6080eba0793dce32f475141fb3d54cc15f84ee52e420ee22ac3ab0ad639dc95a1875bc6eb9c0e1140e94972a36a89dc5542491b85f1ab8df0c126241e0f1a61b
-  languageName: node
-  linkType: hard
-
 "fs-extra@npm:^0.24.0":
   version: 0.24.0
   resolution: "fs-extra@npm:0.24.0"
@@ -17765,25 +10706,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fs-extra@npm:^11.1.0":
-  version: 11.1.1
-  resolution: "fs-extra@npm:11.1.1"
-  dependencies:
-    graceful-fs: ^4.2.0
-    jsonfile: ^6.0.1
-    universalify: ^2.0.0
-  checksum: fb883c68245b2d777fbc1f2082c9efb084eaa2bbf9fddaa366130d196c03608eebef7fb490541276429ee1ca99f317e2d73e96f5ca0999eefedf5a624ae1edfd
-  languageName: node
-  linkType: hard
-
-"fs-extra@npm:^11.2.0":
-  version: 11.2.0
-  resolution: "fs-extra@npm:11.2.0"
+"fs-extra@npm:^11.1.1, fs-extra@npm:^11.2.0":
+  version: 11.3.0
+  resolution: "fs-extra@npm:11.3.0"
   dependencies:
     graceful-fs: ^4.2.0
     jsonfile: ^6.0.1
     universalify: ^2.0.0
-  checksum: b12e42fa40ba47104202f57b8480dd098aa931c2724565e5e70779ab87605665594e76ee5fb00545f772ab9ace167fe06d2ab009c416dc8c842c5ae6df7aa7e8
+  checksum: f983c706e0c22b0c0747a8e9c76aed6f391ba2d76734cf2757cd84da13417b402ed68fe25bace65228856c61d36d3b41da198f1ffbf33d0b34283a2f7a62c6e9
   languageName: node
   linkType: hard
 
@@ -17798,7 +10728,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fs-extra@npm:^4.0.2, fs-extra@npm:^4.0.3":
+"fs-extra@npm:^4.0.2":
   version: 4.0.3
   resolution: "fs-extra@npm:4.0.3"
   dependencies:
@@ -17820,17 +10750,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fs-extra@npm:^6.0.1":
-  version: 6.0.1
-  resolution: "fs-extra@npm:6.0.1"
-  dependencies:
-    graceful-fs: ^4.1.2
-    jsonfile: ^4.0.0
-    universalify: ^0.1.0
-  checksum: 133dbd765e05c1cdaaf723308e00ffbe746da5ad516ad890ae2da2a538982c1175371055c778fbe68d1fca1da9ed4003ba55c4a14e070372eabf6a7c48062759
-  languageName: node
-  linkType: hard
-
 "fs-extra@npm:^7.0.0, fs-extra@npm:^7.0.1":
   version: 7.0.1
   resolution: "fs-extra@npm:7.0.1"
@@ -17842,7 +10761,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fs-extra@npm:^8.0.0, fs-extra@npm:^8.0.1, fs-extra@npm:^8.1.0":
+"fs-extra@npm:^8.0.1, fs-extra@npm:^8.1.0":
   version: 8.1.0
   resolution: "fs-extra@npm:8.1.0"
   dependencies:
@@ -17865,7 +10784,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fs-merger@npm:^3.0.1, fs-merger@npm:^3.1.0, fs-merger@npm:^3.2.1":
+"fs-merger@npm:^3.2.1":
   version: 3.2.1
   resolution: "fs-merger@npm:3.2.1"
   dependencies:
@@ -17878,16 +10797,30 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fs-minipass@npm:^2.0.0, fs-minipass@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "fs-minipass@npm:2.1.0"
+"fs-minipass@npm:^3.0.0":
+  version: 3.0.3
+  resolution: "fs-minipass@npm:3.0.3"
   dependencies:
-    minipass: ^3.0.0
-  checksum: 1b8d128dae2ac6cc94230cc5ead341ba3e0efaef82dab46a33d171c044caaa6ca001364178d42069b2809c35a1c3c35079a32107c770e9ffab3901b59af8c8b1
+    minipass: ^7.0.3
+  checksum: 8722a41109130851d979222d3ec88aabaceeaaf8f57b2a8f744ef8bd2d1ce95453b04a61daa0078822bc5cd21e008814f06fe6586f56fef511e71b8d2394d802
+  languageName: node
+  linkType: hard
+
+"fs-readdir-recursive@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "fs-readdir-recursive@npm:1.1.0"
+  checksum: 29d50f3d2128391c7fc9fd051c8b7ea45bcc8aa84daf31ef52b17218e20bfd2bd34d02382742801954cc8d1905832b68227f6b680a666ce525d8b6b75068ad1e
+  languageName: node
+  linkType: hard
+
+"fs-then-native@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "fs-then-native@npm:2.0.0"
+  checksum: f4428e7206e3c39857c0bc6fa8c8329774d77e3c9597b1ce1a0dc13ec7a0247603682f3bd3eab0c645ccfed99a88ff14da5ce5327fe530395b8d8bac8775bfe1
   languageName: node
   linkType: hard
 
-"fs-tree-diff@npm:^0.5.2, fs-tree-diff@npm:^0.5.3, fs-tree-diff@npm:^0.5.4, fs-tree-diff@npm:^0.5.6, fs-tree-diff@npm:^0.5.9":
+"fs-tree-diff@npm:^0.5.2, fs-tree-diff@npm:^0.5.3, fs-tree-diff@npm:^0.5.6, fs-tree-diff@npm:^0.5.9":
   version: 0.5.9
   resolution: "fs-tree-diff@npm:0.5.9"
   dependencies:
@@ -17925,18 +10858,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fs-write-stream-atomic@npm:^1.0.8":
-  version: 1.0.10
-  resolution: "fs-write-stream-atomic@npm:1.0.10"
-  dependencies:
-    graceful-fs: ^4.1.2
-    iferr: ^0.1.5
-    imurmurhash: ^0.1.4
-    readable-stream: 1 || 2
-  checksum: 43c2d6817b72127793abc811ebf87a135b03ac7cbe41cdea9eeacf59b23e6e29b595739b083e9461303d525687499a1aaefcec3e5ff9bc82b170edd3dc467ccc
-  languageName: node
-  linkType: hard
-
 "fs.realpath@npm:^1.0.0":
   version: 1.0.0
   resolution: "fs.realpath@npm:1.0.0"
@@ -17944,76 +10865,57 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fsevents@npm:^1.2.7":
-  version: 1.2.13
-  resolution: "fsevents@npm:1.2.13"
-  dependencies:
-    bindings: ^1.5.0
-    nan: ^2.12.1
-  checksum: ae855aa737aaa2f9167e9f70417cf6e45a5cd11918e1fee9923709a0149be52416d765433b4aeff56c789b1152e718cd1b13ddec6043b78cdda68260d86383c1
-  conditions: os=darwin
-  languageName: node
-  linkType: hard
-
-"fsevents@npm:~2.3.1, fsevents@npm:~2.3.2":
-  version: 2.3.2
-  resolution: "fsevents@npm:2.3.2"
+"fsevents@npm:~2.3.2":
+  version: 2.3.3
+  resolution: "fsevents@npm:2.3.3"
   dependencies:
     node-gyp: latest
-  checksum: 97ade64e75091afee5265e6956cb72ba34db7819b4c3e94c431d4be2b19b8bb7a2d4116da417950c3425f17c8fe693d25e20212cac583ac1521ad066b77ae31f
-  conditions: os=darwin
-  languageName: node
-  linkType: hard
-
-"fsevents@patch:fsevents@^1.2.7#~builtin<compat/fsevents>":
-  version: 1.2.13
-  resolution: "fsevents@patch:fsevents@npm%3A1.2.13#~builtin<compat/fsevents>::version=1.2.13&hash=d11327"
-  dependencies:
-    bindings: ^1.5.0
-    nan: ^2.12.1
+  checksum: 11e6ea6fea15e42461fc55b4b0e4a0a3c654faa567f1877dbd353f39156f69def97a69936d1746619d656c4b93de2238bf731f6085a03a50cabf287c9d024317
   conditions: os=darwin
   languageName: node
   linkType: hard
 
-"fsevents@patch:fsevents@~2.3.1#~builtin<compat/fsevents>, fsevents@patch:fsevents@~2.3.2#~builtin<compat/fsevents>":
-  version: 2.3.2
-  resolution: "fsevents@patch:fsevents@npm%3A2.3.2#~builtin<compat/fsevents>::version=2.3.2&hash=df0bf1"
+"fsevents@patch:fsevents@~2.3.2#~builtin<compat/fsevents>":
+  version: 2.3.3
+  resolution: "fsevents@patch:fsevents@npm%3A2.3.3#~builtin<compat/fsevents>::version=2.3.3&hash=df0bf1"
   dependencies:
     node-gyp: latest
   conditions: os=darwin
   languageName: node
   linkType: hard
 
-"function-bind@npm:^1.1.1":
-  version: 1.1.1
-  resolution: "function-bind@npm:1.1.1"
-  checksum: b32fbaebb3f8ec4969f033073b43f5c8befbb58f1a79e12f1d7490358150359ebd92f49e72ff0144f65f2c48ea2a605bff2d07965f548f6474fd8efd95bf361a
+"function-bind@npm:^1.1.2":
+  version: 1.1.2
+  resolution: "function-bind@npm:1.1.2"
+  checksum: 2b0ff4ce708d99715ad14a6d1f894e2a83242e4a52ccfcefaee5e40050562e5f6dafc1adbb4ce2d4ab47279a45dc736ab91ea5042d843c3c092820dfe032efb1
   languageName: node
   linkType: hard
 
-"function.prototype.name@npm:^1.1.5":
-  version: 1.1.5
-  resolution: "function.prototype.name@npm:1.1.5"
+"function.prototype.name@npm:^1.1.6, function.prototype.name@npm:^1.1.8":
+  version: 1.1.8
+  resolution: "function.prototype.name@npm:1.1.8"
   dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.3
-    es-abstract: ^1.19.0
-    functions-have-names: ^1.2.2
-  checksum: acd21d733a9b649c2c442f067567743214af5fa248dbeee69d8278ce7df3329ea5abac572be9f7470b4ec1cd4d8f1040e3c5caccf98ebf2bf861a0deab735c27
+    call-bind: ^1.0.8
+    call-bound: ^1.0.3
+    define-properties: ^1.2.1
+    functions-have-names: ^1.2.3
+    hasown: ^2.0.2
+    is-callable: ^1.2.7
+  checksum: 3a366535dc08b25f40a322efefa83b2da3cd0f6da41db7775f2339679120ef63b6c7e967266182609e655b8f0a8f65596ed21c7fd72ad8bd5621c2340edd4010
   languageName: node
   linkType: hard
 
-"functions-have-names@npm:^1.2.2, functions-have-names@npm:^1.2.3":
+"functions-have-names@npm:^1.2.3":
   version: 1.2.3
   resolution: "functions-have-names@npm:1.2.3"
   checksum: c3f1f5ba20f4e962efb71344ce0a40722163e85bee2101ce25f88214e78182d2d2476aa85ef37950c579eb6cf6ee811c17b3101bb84004bb75655f3e33f3fdb5
   languageName: node
   linkType: hard
 
-"fuse.js@npm:^6.5.3":
-  version: 6.5.3
-  resolution: "fuse.js@npm:6.5.3"
-  checksum: f7c14f4422000e7f7e3515c66f7cefdfc38adec4cf380097f4146a201ea438af60b67dc5849b3c0de0115ce3f9bc5afad6fc6570c08dcfcef5bf6e95eb8e6d6f
+"fuse.js@npm:7.1.0, fuse.js@npm:^7.0.0":
+  version: 7.1.0
+  resolution: "fuse.js@npm:7.1.0"
+  checksum: e0c7d6833d336f9facd9359a888170b90c418b2f46c6cb389fd7dbc708712a2d1c5f30b5fea13b634a090a21f69d746eb0ceaff545b11ca088d3e5058c2a8e15
   languageName: node
   linkType: hard
 
@@ -18034,8 +10936,8 @@ __metadata:
   linkType: hard
 
 "gauge@npm:^5.0.0":
-  version: 5.0.1
-  resolution: "gauge@npm:5.0.1"
+  version: 5.0.2
+  resolution: "gauge@npm:5.0.2"
   dependencies:
     aproba: ^1.0.3 || ^2.0.0
     color-support: ^1.1.3
@@ -18045,7 +10947,7 @@ __metadata:
     string-width: ^4.2.3
     strip-ansi: ^6.0.1
     wide-align: ^1.1.5
-  checksum: 09b1eb8d8c850df7e4e2822feef27427afc845d4839fa13a08ddad74f882caf668dd1e77ac5e059d3e9a7b0cef59b706d28be40e1dc5fd326da32965e1f206a6
+  checksum: bc51e4f849bce385e51047d5f372fd15e04b8d41abf63b32cc29587678542570eab9694e4ebeb9afa9ff77440eeceb427296409a7c181ce502222a8856f225c6
   languageName: node
   linkType: hard
 
@@ -18063,33 +10965,38 @@ __metadata:
   languageName: node
   linkType: hard
 
-"get-intrinsic@npm:^1.0.2, get-intrinsic@npm:^1.1.0, get-intrinsic@npm:^1.1.1":
-  version: 1.1.1
-  resolution: "get-intrinsic@npm:1.1.1"
-  dependencies:
-    function-bind: ^1.1.1
-    has: ^1.0.3
-    has-symbols: ^1.0.1
-  checksum: a9fe2ca8fa3f07f9b0d30fb202bcd01f3d9b9b6b732452e79c48e79f7d6d8d003af3f9e38514250e3553fdc83c61650851cb6870832ac89deaaceb08e3721a17
+"get-east-asian-width@npm:^1.0.0":
+  version: 1.3.0
+  resolution: "get-east-asian-width@npm:1.3.0"
+  checksum: 757a34c7a46ff385e2775f96f9d3e553f6b6666a8898fb89040d36a1010fba692332772945606a7d4b0f0c6afb84cd394e75d5477c56e1f00f1eb79603b0aecc
   languageName: node
   linkType: hard
 
-"get-intrinsic@npm:^1.1.3, get-intrinsic@npm:^1.2.0":
-  version: 1.2.1
-  resolution: "get-intrinsic@npm:1.2.1"
+"get-intrinsic@npm:^1.2.4, get-intrinsic@npm:^1.2.5, get-intrinsic@npm:^1.2.6, get-intrinsic@npm:^1.2.7, get-intrinsic@npm:^1.3.0":
+  version: 1.3.0
+  resolution: "get-intrinsic@npm:1.3.0"
   dependencies:
-    function-bind: ^1.1.1
-    has: ^1.0.3
-    has-proto: ^1.0.1
-    has-symbols: ^1.0.3
-  checksum: 5b61d88552c24b0cf6fa2d1b3bc5459d7306f699de060d76442cce49a4721f52b8c560a33ab392cf5575b7810277d54ded9d4d39a1ea61855619ebc005aa7e5f
+    call-bind-apply-helpers: ^1.0.2
+    es-define-property: ^1.0.1
+    es-errors: ^1.3.0
+    es-object-atoms: ^1.1.1
+    function-bind: ^1.1.2
+    get-proto: ^1.0.1
+    gopd: ^1.2.0
+    has-symbols: ^1.1.0
+    hasown: ^2.0.2
+    math-intrinsics: ^1.1.0
+  checksum: 301008e4482bb9a9cb49e132b88fee093bff373b4e6def8ba219b1e96b60158a6084f273ef5cafe832e42cd93462f4accb46a618d35fe59a2b507f2388c5b79d
   languageName: node
   linkType: hard
 
-"get-own-enumerable-property-symbols@npm:^3.0.0":
-  version: 3.0.2
-  resolution: "get-own-enumerable-property-symbols@npm:3.0.2"
-  checksum: 8f0331f14159f939830884799f937343c8c0a2c330506094bc12cbee3665d88337fe97a4ea35c002cc2bdba0f5d9975ad7ec3abb925015cdf2a93e76d4759ede
+"get-proto@npm:^1.0.0, get-proto@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "get-proto@npm:1.0.1"
+  dependencies:
+    dunder-proto: ^1.0.1
+    es-object-atoms: ^1.0.0
+  checksum: 4fc96afdb58ced9a67558698b91433e6b037aaa6f1493af77498d7c85b141382cf223c0e5946f334fb328ee85dfe6edd06d218eaf09556f4bc4ec6005d7f5f7b
   languageName: node
   linkType: hard
 
@@ -18146,29 +11053,23 @@ __metadata:
   languageName: node
   linkType: hard
 
-"get-symbol-description@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "get-symbol-description@npm:1.0.0"
+"get-symbol-description@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "get-symbol-description@npm:1.1.0"
   dependencies:
-    call-bind: ^1.0.2
-    get-intrinsic: ^1.1.1
-  checksum: 9ceff8fe968f9270a37a1f73bf3f1f7bda69ca80f4f80850670e0e7b9444ff99323f7ac52f96567f8b5f5fbe7ac717a0d81d3407c7313e82810c6199446a5247
+    call-bound: ^1.0.3
+    es-errors: ^1.3.0
+    get-intrinsic: ^1.2.6
+  checksum: 655ed04db48ee65ef2ddbe096540d4405e79ba0a7f54225775fef43a7e2afcb93a77d141c5f05fdef0afce2eb93bcbfb3597142189d562ac167ff183582683cd
   languageName: node
   linkType: hard
 
-"get-value@npm:^2.0.3, get-value@npm:^2.0.6":
-  version: 2.0.6
-  resolution: "get-value@npm:2.0.6"
-  checksum: 5c3b99cb5398ea8016bf46ff17afc5d1d286874d2ad38ca5edb6e87d75c0965b0094cb9a9dddef2c59c23d250702323539a7fbdd870620db38c7e7d7ec87c1eb
-  languageName: node
-  linkType: hard
-
-"getpass@npm:^0.1.1":
-  version: 0.1.7
-  resolution: "getpass@npm:0.1.7"
+"get-tsconfig@npm:^4.7.0":
+  version: 4.10.1
+  resolution: "get-tsconfig@npm:4.10.1"
   dependencies:
-    assert-plus: ^1.0.0
-  checksum: ab18d55661db264e3eac6012c2d3daeafaab7a501c035ae0ccb193c3c23e9849c6e29b6ac762b9c2adae460266f925d55a3a2a3a3c8b94be2f222df94d70c046
+    resolve-pkg-maps: ^1.0.0
+  checksum: 22925debda6bd0992171a44ee79a22c32642063ba79534372c4d744e0c9154abe2c031659da0fb86bc9e73fc56a3b76b053ea5d24ca3ac3da43d2e6f7d1c3c33
   languageName: node
   linkType: hard
 
@@ -18186,17 +11087,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"glob-parent@npm:^3.1.0":
-  version: 3.1.0
-  resolution: "glob-parent@npm:3.1.0"
-  dependencies:
-    is-glob: ^3.1.0
-    path-dirname: ^1.0.0
-  checksum: 653d559237e89a11b9934bef3f392ec42335602034c928590544d383ff5ef449f7b12f3cfa539708e74bc0a6c28ab1fe51d663cc07463cdf899ba92afd85a855
+"github-slugger@npm:^1.0.0, github-slugger@npm:^1.2.1, github-slugger@npm:^1.4.0":
+  version: 1.5.0
+  resolution: "github-slugger@npm:1.5.0"
+  checksum: c70988224578b3bdaa25df65973ffc8c24594a77a28550c3636e495e49d17aef5cdb04c04fa3f1744babef98c61eecc6a43299a13ea7f3cc33d680bf9053ffbe
   languageName: node
   linkType: hard
 
-"glob-parent@npm:^5.1.0, glob-parent@npm:^5.1.2, glob-parent@npm:~5.1.0, glob-parent@npm:~5.1.2":
+"glob-parent@npm:^5.1.2, glob-parent@npm:~5.1.2":
   version: 5.1.2
   resolution: "glob-parent@npm:5.1.2"
   dependencies:
@@ -18221,18 +11119,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"glob@npm:^10.3.7":
-  version: 10.3.10
-  resolution: "glob@npm:10.3.10"
+"glob@npm:^10.2.2, glob@npm:^10.3.7":
+  version: 10.4.5
+  resolution: "glob@npm:10.4.5"
   dependencies:
     foreground-child: ^3.1.0
-    jackspeak: ^2.3.5
-    minimatch: ^9.0.1
-    minipass: ^5.0.0 || ^6.0.2 || ^7.0.0
-    path-scurry: ^1.10.1
+    jackspeak: ^3.1.2
+    minimatch: ^9.0.4
+    minipass: ^7.1.2
+    package-json-from-dist: ^1.0.0
+    path-scurry: ^1.11.1
   bin:
     glob: dist/esm/bin.mjs
-  checksum: 4f2fe2511e157b5a3f525a54092169a5f92405f24d2aed3142f4411df328baca13059f4182f1db1bf933e2c69c0bd89e57ae87edd8950cba8c7ccbe84f721cf3
+  checksum: 0bc725de5e4862f9f387fd0f2b274baf16850dcd2714502ccf471ee401803997983e2c05590cb65f9675a3c6f2a58e7a53f9e365704108c6ad3cbf1d60934c4a
   languageName: node
   linkType: hard
 
@@ -18245,39 +11144,11 @@ __metadata:
     minimatch: 2 || 3
     once: ^1.3.0
     path-is-absolute: ^1.0.0
-  checksum: f9742448303460672607e569457f1b57e486a79a985e269b69465834d2075b243378225f65dc54c09fcd4b75e4fb34442aec88f33f8c65fa4abccc8ee2dc2f5d
-  languageName: node
-  linkType: hard
-
-"glob@npm:^7.0.4, glob@npm:^7.1.4, glob@npm:^7.1.6":
-  version: 7.1.6
-  resolution: "glob@npm:7.1.6"
-  dependencies:
-    fs.realpath: ^1.0.0
-    inflight: ^1.0.4
-    inherits: 2
-    minimatch: ^3.0.4
-    once: ^1.3.0
-    path-is-absolute: ^1.0.0
-  checksum: 351d549dd90553b87c2d3f90ce11aed9e1093c74130440e7ae0592e11bbcd2ce7f0ebb8ba6bfe63aaf9b62166a7f4c80cb84490ae5d78408bb2572bf7d4ee0a6
-  languageName: node
-  linkType: hard
-
-"glob@npm:^7.1.2, glob@npm:^7.1.3":
-  version: 7.2.0
-  resolution: "glob@npm:7.2.0"
-  dependencies:
-    fs.realpath: ^1.0.0
-    inflight: ^1.0.4
-    inherits: 2
-    minimatch: ^3.0.4
-    once: ^1.3.0
-    path-is-absolute: ^1.0.0
-  checksum: 78a8ea942331f08ed2e055cb5b9e40fe6f46f579d7fd3d694f3412fe5db23223d29b7fee1575440202e9a7ff9a72ab106a39fee39934c7bedafe5e5f8ae20134
+  checksum: f9742448303460672607e569457f1b57e486a79a985e269b69465834d2075b243378225f65dc54c09fcd4b75e4fb34442aec88f33f8c65fa4abccc8ee2dc2f5d
   languageName: node
   linkType: hard
 
-"glob@npm:^7.2.3":
+"glob@npm:^7.0.4, glob@npm:^7.1.2, glob@npm:^7.1.3, glob@npm:^7.1.6, glob@npm:^7.1.7, glob@npm:^7.2.0, glob@npm:^7.2.3":
   version: 7.2.3
   resolution: "glob@npm:7.2.3"
   dependencies:
@@ -18291,7 +11162,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"glob@npm:^8.0.1, glob@npm:^8.0.3, glob@npm:^8.1.0":
+"glob@npm:^8.1.0":
   version: 8.1.0
   resolution: "glob@npm:8.1.0"
   dependencies:
@@ -18304,7 +11175,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"glob@npm:^9.3.4":
+"glob@npm:^9.3.3":
   version: 9.3.5
   resolution: "glob@npm:9.3.5"
   dependencies:
@@ -18367,37 +11238,22 @@ __metadata:
   languageName: node
   linkType: hard
 
-"globals@npm:^13.15.0":
-  version: 13.17.0
-  resolution: "globals@npm:13.17.0"
-  dependencies:
-    type-fest: ^0.20.2
-  checksum: fbaf4112e59b92c9f5575e85ce65e9e17c0b82711196ec5f58beb08599bbd92fd72703d6dfc9b080381fd35b644e1b11dcf25b38cc2341ec21df942594cbc8ce
-  languageName: node
-  linkType: hard
-
-"globals@npm:^13.19.0":
-  version: 13.20.0
-  resolution: "globals@npm:13.20.0"
+"globals@npm:^13.19.0, globals@npm:^13.24.0":
+  version: 13.24.0
+  resolution: "globals@npm:13.24.0"
   dependencies:
     type-fest: ^0.20.2
-  checksum: ad1ecf914bd051325faad281d02ea2c0b1df5d01bd94d368dcc5513340eac41d14b3c61af325768e3c7f8d44576e72780ec0b6f2d366121f8eec6e03c3a3b97a
-  languageName: node
-  linkType: hard
-
-"globals@npm:^9.18.0":
-  version: 9.18.0
-  resolution: "globals@npm:9.18.0"
-  checksum: e9c066aecfdc5ea6f727344a4246ecc243aaf66ede3bffee10ddc0c73351794c25e727dd046090dcecd821199a63b9de6af299a6e3ba292c8b22f0a80ea32073
+  checksum: 56066ef058f6867c04ff203b8a44c15b038346a62efbc3060052a1016be9f56f4cf0b2cd45b74b22b81e521a889fc7786c73691b0549c2f3a6e825b3d394f43c
   languageName: node
   linkType: hard
 
-"globalthis@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "globalthis@npm:1.0.3"
+"globalthis@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "globalthis@npm:1.0.4"
   dependencies:
-    define-properties: ^1.1.3
-  checksum: fbd7d760dc464c886d0196166d92e5ffb4c84d0730846d6621a39fbbc068aeeb9c8d1421ad330e94b7bca4bb4ea092f5f21f3d36077812af5d098b4dc006c998
+    define-properties: ^1.2.1
+    gopd: ^1.0.1
+  checksum: 39ad667ad9f01476474633a1834a70842041f70a55571e8dcef5fb957980a92da5022db5430fca8aecc5d47704ae30618c0bc877a579c70710c904e9ef06108a
   languageName: node
   linkType: hard
 
@@ -18424,21 +11280,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"globby@npm:^11.0.3":
-  version: 11.0.4
-  resolution: "globby@npm:11.0.4"
-  dependencies:
-    array-union: ^2.1.0
-    dir-glob: ^3.0.1
-    fast-glob: ^3.1.1
-    ignore: ^5.1.4
-    merge2: ^1.3.0
-    slash: ^3.0.0
-  checksum: d3e02d5e459e02ffa578b45f040381c33e3c0538ed99b958f0809230c423337999867d7b0dbf752ce93c46157d3bbf154d3fff988a93ccaeb627df8e1841775b
-  languageName: node
-  linkType: hard
-
-"globby@npm:^11.1.0":
+"globby@npm:^11.0.3, globby@npm:^11.1.0":
   version: 11.1.0
   resolution: "globby@npm:11.1.0"
   dependencies:
@@ -18452,16 +11294,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"globby@npm:^13.1.3":
-  version: 13.2.2
-  resolution: "globby@npm:13.2.2"
+"globby@npm:^14.0.1":
+  version: 14.1.0
+  resolution: "globby@npm:14.1.0"
   dependencies:
-    dir-glob: ^3.0.1
-    fast-glob: ^3.3.0
-    ignore: ^5.2.4
-    merge2: ^1.4.1
-    slash: ^4.0.0
-  checksum: f3d84ced58a901b4fcc29c846983108c426631fe47e94872868b65565495f7bee7b3defd68923bd480582771fd4bbe819217803a164a618ad76f1d22f666f41e
+    "@sindresorhus/merge-streams": ^2.1.0
+    fast-glob: ^3.3.3
+    ignore: ^7.0.3
+    path-type: ^6.0.0
+    slash: ^5.1.0
+    unicorn-magic: ^0.3.0
+  checksum: b1f27dccc999c010ee7e0ce7c6581fd2326ac86cf0508474d526d699a029b66b35d6fa4361c8b4ad8e80809582af71d5e2080e671cf03c26e98ca67aba8834bd
   languageName: node
   linkType: hard
 
@@ -18479,43 +11322,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"gopd@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "gopd@npm:1.0.1"
-  dependencies:
-    get-intrinsic: ^1.1.3
-  checksum: a5ccfb8806e0917a94e0b3de2af2ea4979c1da920bc381667c260e00e7cafdbe844e2cb9c5bcfef4e5412e8bf73bab837285bc35c7ba73aaaf0134d4583393a6
-  languageName: node
-  linkType: hard
-
-"graceful-fs@npm:^4.1.11, graceful-fs@npm:^4.1.15, graceful-fs@npm:^4.1.3":
-  version: 4.2.6
-  resolution: "graceful-fs@npm:4.2.6"
-  checksum: 792e64aafda05a151289f83eaa16aff34ef259658cefd65393883d959409f5a2389b0ec9ebf28f3d21f1b0ddc8f594a1162ae9b18e2b507a6799a70706ec573d
-  languageName: node
-  linkType: hard
-
-"graceful-fs@npm:^4.1.2, graceful-fs@npm:^4.1.6, graceful-fs@npm:^4.1.9, graceful-fs@npm:^4.2.0, graceful-fs@npm:^4.2.4":
-  version: 4.2.8
-  resolution: "graceful-fs@npm:4.2.8"
-  checksum: 5d224c8969ad0581d551dfabdb06882706b31af2561bd5e2034b4097e67cc27d05232849b8643866585fd0a41c7af152950f8776f4dd5579e9853733f31461c6
+"gopd@npm:^1.0.1, gopd@npm:^1.2.0":
+  version: 1.2.0
+  resolution: "gopd@npm:1.2.0"
+  checksum: cc6d8e655e360955bdccaca51a12a474268f95bb793fc3e1f2bdadb075f28bfd1fd988dab872daf77a61d78cbaf13744bc8727a17cfb1d150d76047d805375f3
   languageName: node
   linkType: hard
 
-"graceful-fs@npm:^4.2.6":
+"graceful-fs@npm:^4.1.2, graceful-fs@npm:^4.1.6, graceful-fs@npm:^4.1.9, graceful-fs@npm:^4.2.0, graceful-fs@npm:^4.2.11, graceful-fs@npm:^4.2.4, graceful-fs@npm:^4.2.6":
   version: 4.2.11
   resolution: "graceful-fs@npm:4.2.11"
   checksum: ac85f94da92d8eb6b7f5a8b20ce65e43d66761c55ce85ac96df6865308390da45a8d3f0296dd3a663de65d30ba497bd46c696cc1e248c72b13d6d567138a4fc7
   languageName: node
   linkType: hard
 
-"graceful-fs@npm:^4.2.9":
-  version: 4.2.10
-  resolution: "graceful-fs@npm:4.2.10"
-  checksum: 3f109d70ae123951905d85032ebeae3c2a5a7a997430df00ea30df0e3a6c60cf6689b109654d6fdacd28810a053348c4d14642da1d075049e6be1ba5216218da
-  languageName: node
-  linkType: hard
-
 "graceful-readlink@npm:>= 1.0.0":
   version: 1.0.1
   resolution: "graceful-readlink@npm:1.0.1"
@@ -18544,12 +11364,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"handlebars@npm:4.7.7, handlebars@npm:^4.0.11, handlebars@npm:^4.0.13, handlebars@npm:^4.0.4, handlebars@npm:^4.3.1, handlebars@npm:^4.4.2, handlebars@npm:^4.7.3":
-  version: 4.7.7
-  resolution: "handlebars@npm:4.7.7"
+"handlebars@npm:4.7.8, handlebars@npm:^4.0.11, handlebars@npm:^4.0.4, handlebars@npm:^4.3.1, handlebars@npm:^4.7.3, handlebars@npm:^4.7.8":
+  version: 4.7.8
+  resolution: "handlebars@npm:4.7.8"
   dependencies:
     minimist: ^1.2.5
-    neo-async: ^2.6.0
+    neo-async: ^2.6.2
     source-map: ^0.6.1
     uglify-js: ^3.1.4
     wordwrap: ^1.0.0
@@ -18558,31 +11378,7 @@ __metadata:
       optional: true
   bin:
     handlebars: bin/handlebars
-  checksum: 1e79a43f5e18d15742977cb987923eab3e2a8f44f2d9d340982bcb69e1735ed049226e534d7c1074eaddaf37e4fb4f471a8adb71cddd5bc8cf3f894241df5cee
-  languageName: node
-  linkType: hard
-
-"har-schema@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "har-schema@npm:2.0.0"
-  checksum: d8946348f333fb09e2bf24cc4c67eabb47c8e1d1aa1c14184c7ffec1140a49ec8aa78aa93677ae452d71d5fc0fdeec20f0c8c1237291fc2bcb3f502a5d204f9b
-  languageName: node
-  linkType: hard
-
-"har-validator@npm:~5.1.3":
-  version: 5.1.5
-  resolution: "har-validator@npm:5.1.5"
-  dependencies:
-    ajv: ^6.12.3
-    har-schema: ^2.0.0
-  checksum: b998a7269ca560d7f219eedc53e2c664cd87d487e428ae854a6af4573fc94f182fe9d2e3b92ab968249baec7ebaf9ead69cf975c931dc2ab282ec182ee988280
-  languageName: node
-  linkType: hard
-
-"hard-rejection@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "hard-rejection@npm:2.1.0"
-  checksum: 7baaf80a0c7fff4ca79687b4060113f1529589852152fa935e6787a2bc96211e784ad4588fb3048136ff8ffc9dfcf3ae385314a5b24db32de20bea0d1597f9dc
+  checksum: 00e68bb5c183fd7b8b63322e6234b5ac8fbb960d712cb3f25587d559c2951d9642df83c04a1172c918c41bcfc81bfbd7a7718bbce93b893e0135fc99edea93ff
   languageName: node
   linkType: hard
 
@@ -18604,17 +11400,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"has-bigints@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "has-bigints@npm:1.0.1"
-  checksum: 44ab55868174470065d2e0f8f6def1c990d12b82162a8803c679699fa8a39f966e336f2a33c185092fe8aea7e8bf2e85f1c26add5f29d98f2318bd270096b183
-  languageName: node
-  linkType: hard
-
 "has-bigints@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "has-bigints@npm:1.0.2"
-  checksum: 390e31e7be7e5c6fe68b81babb73dfc35d413604d7ee5f56da101417027a4b4ce6a27e46eff97ad040c835b5d228676eae99a9b5c3bc0e23c8e81a49241ff45b
+  version: 1.1.0
+  resolution: "has-bigints@npm:1.1.0"
+  checksum: 79730518ae02c77e4af6a1d1a0b6a2c3e1509785532771f9baf0241e83e36329542c3d7a0e723df8cbc85f74eff4f177828a2265a01ba576adbdc2d40d86538b
   languageName: node
   linkType: hard
 
@@ -18639,42 +11428,37 @@ __metadata:
   languageName: node
   linkType: hard
 
-"has-property-descriptors@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "has-property-descriptors@npm:1.0.0"
+"has-property-descriptors@npm:^1.0.0, has-property-descriptors@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "has-property-descriptors@npm:1.0.2"
   dependencies:
-    get-intrinsic: ^1.1.1
-  checksum: a6d3f0a266d0294d972e354782e872e2fe1b6495b321e6ef678c9b7a06a40408a6891817350c62e752adced73a94ac903c54734fee05bf65b1905ee1368194bb
-  languageName: node
-  linkType: hard
-
-"has-proto@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "has-proto@npm:1.0.1"
-  checksum: febc5b5b531de8022806ad7407935e2135f1cc9e64636c3916c6842bd7995994ca3b29871ecd7954bd35f9e2986c17b3b227880484d22259e2f8e6ce63fd383e
+    es-define-property: ^1.0.0
+  checksum: fcbb246ea2838058be39887935231c6d5788babed499d0e9d0cc5737494c48aba4fe17ba1449e0d0fbbb1e36175442faa37f9c427ae357d6ccb1d895fbcd3de3
   languageName: node
   linkType: hard
 
-"has-symbols@npm:^1.0.1, has-symbols@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "has-symbols@npm:1.0.2"
-  checksum: 2309c426071731be792b5be43b3da6fb4ed7cbe8a9a6bcfca1862587709f01b33d575ce8f5c264c1eaad09fca2f9a8208c0a2be156232629daa2dd0c0740976b
+"has-proto@npm:^1.2.0":
+  version: 1.2.0
+  resolution: "has-proto@npm:1.2.0"
+  dependencies:
+    dunder-proto: ^1.0.0
+  checksum: f55010cb94caa56308041d77967c72a02ffd71386b23f9afa8447e58bc92d49d15c19bf75173713468e92fe3fb1680b03b115da39c21c32c74886d1d50d3e7ff
   languageName: node
   linkType: hard
 
-"has-symbols@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "has-symbols@npm:1.0.3"
-  checksum: a054c40c631c0d5741a8285010a0777ea0c068f99ed43e5d6eb12972da223f8af553a455132fdb0801bdcfa0e0f443c0c03a68d8555aa529b3144b446c3f2410
+"has-symbols@npm:^1.0.3, has-symbols@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "has-symbols@npm:1.1.0"
+  checksum: b2316c7302a0e8ba3aaba215f834e96c22c86f192e7310bdf689dd0e6999510c89b00fbc5742571507cebf25764d68c988b3a0da217369a73596191ac0ce694b
   languageName: node
   linkType: hard
 
-"has-tostringtag@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "has-tostringtag@npm:1.0.0"
+"has-tostringtag@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "has-tostringtag@npm:1.0.2"
   dependencies:
-    has-symbols: ^1.0.2
-  checksum: cc12eb28cb6ae22369ebaad3a8ab0799ed61270991be88f208d508076a1e99abe4198c965935ce85ea90b60c94ddda73693b0920b58e7ead048b4a391b502c1c
+    has-symbols: ^1.0.3
+  checksum: 999d60bb753ad714356b2c6c87b7fb74f32463b8426e159397da4bde5bca7e598ab1073f4d8d4deafac297f2eb311484cd177af242776bf05f0d11565680468d
   languageName: node
   linkType: hard
 
@@ -18685,86 +11469,58 @@ __metadata:
   languageName: node
   linkType: hard
 
-"has-value@npm:^0.3.1":
-  version: 0.3.1
-  resolution: "has-value@npm:0.3.1"
-  dependencies:
-    get-value: ^2.0.3
-    has-values: ^0.1.4
-    isobject: ^2.0.0
-  checksum: 29e2a1e6571dad83451b769c7ce032fce6009f65bccace07c2962d3ad4d5530b6743d8f3229e4ecf3ea8e905d23a752c5f7089100c1f3162039fa6dc3976558f
-  languageName: node
-  linkType: hard
-
-"has-value@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "has-value@npm:1.0.0"
-  dependencies:
-    get-value: ^2.0.6
-    has-values: ^1.0.0
-    isobject: ^3.0.0
-  checksum: b9421d354e44f03d3272ac39fd49f804f19bc1e4fa3ceef7745df43d6b402053f828445c03226b21d7d934a21ac9cf4bc569396dc312f496ddff873197bbd847
-  languageName: node
-  linkType: hard
-
-"has-values@npm:^0.1.4":
-  version: 0.1.4
-  resolution: "has-values@npm:0.1.4"
-  checksum: ab1c4bcaf811ccd1856c11cfe90e62fca9e2b026ebe474233a3d282d8d67e3b59ed85b622c7673bac3db198cb98bd1da2b39300a2f98e453729b115350af49bc
-  languageName: node
-  linkType: hard
-
-"has-values@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "has-values@npm:1.0.0"
+"hash-for-dep@npm:^1.0.2, hash-for-dep@npm:^1.4.7, hash-for-dep@npm:^1.5.0, hash-for-dep@npm:^1.5.1":
+  version: 1.5.1
+  resolution: "hash-for-dep@npm:1.5.1"
   dependencies:
-    is-number: ^3.0.0
-    kind-of: ^4.0.0
-  checksum: 77e6693f732b5e4cf6c38dfe85fdcefad0fab011af74995c3e83863fabf5e3a836f406d83565816baa0bc0a523c9410db8b990fe977074d61aeb6d8f4fcffa11
+    broccoli-kitchen-sink-helpers: ^0.3.1
+    heimdalljs: ^0.2.3
+    heimdalljs-logger: ^0.1.7
+    path-root: ^0.1.1
+    resolve: ^1.10.0
+    resolve-package-path: ^1.0.11
+  checksum: ea9854cfeaedc5e3b7ba38f902a9173919f3f1abef13ee27ddc15b5ec8768be340762ed502e9d16b3ffbeb8e8af0f099cb0348215f9de39c31bb722af52895d9
   languageName: node
   linkType: hard
 
-"has@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "has@npm:1.0.3"
+"hasown@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "hasown@npm:2.0.2"
   dependencies:
-    function-bind: ^1.1.1
-  checksum: b9ad53d53be4af90ce5d1c38331e712522417d017d5ef1ebd0507e07c2fbad8686fffb8e12ddecd4c39ca9b9b47431afbb975b8abf7f3c3b82c98e9aad052792
+    function-bind: ^1.1.2
+  checksum: e8516f776a15149ca6c6ed2ae3110c417a00b62260e222590e54aa367cbcd6ed99122020b37b7fbdf05748df57b265e70095d7bf35a47660587619b15ffb93db
   languageName: node
   linkType: hard
 
-"hash-base@npm:^3.0.0":
-  version: 3.1.0
-  resolution: "hash-base@npm:3.1.0"
-  dependencies:
-    inherits: ^2.0.4
-    readable-stream: ^3.6.0
-    safe-buffer: ^5.2.0
-  checksum: 26b7e97ac3de13cb23fc3145e7e3450b0530274a9562144fc2bf5c1e2983afd0e09ed7cc3b20974ba66039fad316db463da80eb452e7373e780cbee9a0d2f2dc
+"hast-util-is-element@npm:^1.0.0":
+  version: 1.1.0
+  resolution: "hast-util-is-element@npm:1.1.0"
+  checksum: 30fad3f65e7ab2f0efd5db9e7344d0820b70971988dfe79f62d8447598b2a1ce8a59cd4bfc05ae0d9a1c451b9b53cbe1023743d7eac764d64720b6b73475f62f
   languageName: node
   linkType: hard
 
-"hash-for-dep@npm:^1.0.2, hash-for-dep@npm:^1.2.3, hash-for-dep@npm:^1.4.7, hash-for-dep@npm:^1.5.0, hash-for-dep@npm:^1.5.1":
-  version: 1.5.1
-  resolution: "hash-for-dep@npm:1.5.1"
+"hast-util-to-html@npm:^7.1.1":
+  version: 7.1.3
+  resolution: "hast-util-to-html@npm:7.1.3"
   dependencies:
-    broccoli-kitchen-sink-helpers: ^0.3.1
-    heimdalljs: ^0.2.3
-    heimdalljs-logger: ^0.1.7
-    path-root: ^0.1.1
-    resolve: ^1.10.0
-    resolve-package-path: ^1.0.11
-  checksum: ea9854cfeaedc5e3b7ba38f902a9173919f3f1abef13ee27ddc15b5ec8768be340762ed502e9d16b3ffbeb8e8af0f099cb0348215f9de39c31bb722af52895d9
+    ccount: ^1.0.0
+    comma-separated-tokens: ^1.0.0
+    hast-util-is-element: ^1.0.0
+    hast-util-whitespace: ^1.0.0
+    html-void-elements: ^1.0.0
+    property-information: ^5.0.0
+    space-separated-tokens: ^1.0.0
+    stringify-entities: ^3.0.1
+    unist-util-is: ^4.0.0
+    xtend: ^4.0.0
+  checksum: 5fb8d45adaed76e5d6a5c4c0d2684b5314ed92fc78ad85304631cb6acff46b73920b39c40c557641156cdb04ddf0efe8fb74b6fbafed84583409797ebd057a5b
   languageName: node
   linkType: hard
 
-"hash.js@npm:^1.0.0, hash.js@npm:^1.0.3":
-  version: 1.1.7
-  resolution: "hash.js@npm:1.1.7"
-  dependencies:
-    inherits: ^2.0.3
-    minimalistic-assert: ^1.0.1
-  checksum: e350096e659c62422b85fa508e4b3669017311aa4c49b74f19f8e1bc7f3a54a584fdfd45326d4964d6011f2b2d882e38bea775a96046f2a61b7779a979629d8f
+"hast-util-whitespace@npm:^1.0.0":
+  version: 1.0.4
+  resolution: "hast-util-whitespace@npm:1.0.4"
+  checksum: b7f4a1942bc78239a6fe4741aca34e3e7f84487e15e2cd2b6ca07bbba3055571763d877d7c077d7a2a029ede7500bc50a62af7b6dfe88e0644b16228b91dee0d
   languageName: node
   linkType: hard
 
@@ -18807,31 +11563,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"highlight.js@npm:^10.4.1":
-  version: 10.7.2
-  resolution: "highlight.js@npm:10.7.2"
-  checksum: af09b434070c81ed154b4c990bee61a8c1295887554abc7884eb2544c48bff208e237e7ce1b324ebe94abe0f942e15e2c11dff1b1ed22a79a3c4a0d8a900a921
-  languageName: node
-  linkType: hard
-
-"hmac-drbg@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "hmac-drbg@npm:1.0.1"
-  dependencies:
-    hash.js: ^1.0.3
-    minimalistic-assert: ^1.0.0
-    minimalistic-crypto-utils: ^1.0.1
-  checksum: bd30b6a68d7f22d63f10e1888aee497d7c2c5c0bb469e66bbdac99f143904d1dfe95f8131f95b3e86c86dd239963c9d972fcbe147e7cffa00e55d18585c43fe0
-  languageName: node
-  linkType: hard
-
-"home-or-tmp@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "home-or-tmp@npm:2.0.0"
-  dependencies:
-    os-homedir: ^1.0.0
-    os-tmpdir: ^1.0.1
-  checksum: b783c6ffd22f716d82f53e8c781cbe49bc9f4109a89ea86a27951e54c0bd335caf06bd828be2958cd9f4681986df1739558ae786abda6298cdd6d3edc2c362f1
+"highlight.js@npm:10.7.3":
+  version: 10.7.3
+  resolution: "highlight.js@npm:10.7.3"
+  checksum: defeafcd546b535d710d8efb8e650af9e3b369ef53e28c3dc7893eacfe263200bba4c5fcf43524ae66d5c0c296b1af0870523ceae3e3104d24b7abf6374a4fea
   languageName: node
   linkType: hard
 
@@ -18844,30 +11579,28 @@ __metadata:
   languageName: node
   linkType: hard
 
-"hosted-git-info@npm:^4.0.1":
-  version: 4.1.0
-  resolution: "hosted-git-info@npm:4.1.0"
-  dependencies:
-    lru-cache: ^6.0.0
-  checksum: c3f87b3c2f7eb8c2748c8f49c0c2517c9a95f35d26f4bf54b2a8cba05d2e668f3753548b6ea366b18ec8dadb4e12066e19fa382a01496b0ffa0497eb23cbe461
+"hookified@npm:^1.8.2":
+  version: 1.9.0
+  resolution: "hookified@npm:1.9.0"
+  checksum: 6dabae5a8d593412576fce56a91722aeef4f7c7cb25fea05afaf626a8a490534f09a2c4c1ec30b4b97fd5256a2dfb56be6a83b7a1a5f53a5e57dc6ae83873c29
   languageName: node
   linkType: hard
 
-"hosted-git-info@npm:^6.0.0":
-  version: 6.1.1
-  resolution: "hosted-git-info@npm:6.1.1"
+"hosted-git-info@npm:^3.0.8":
+  version: 3.0.8
+  resolution: "hosted-git-info@npm:3.0.8"
   dependencies:
-    lru-cache: ^7.5.1
-  checksum: fcd3ca2eaa05f3201425ccbb8aa47f88cdda4a3a6d79453f8e269f7171356278bd1db08f059d8439eb5eaa91c6a8a20800fc49cca6e9e4e899b202a332d5ba6b
+    lru-cache: ^6.0.0
+  checksum: 5af7a69581acb84206a7b8e009f4680c36396814e92c8a83973dfb3b87e44e44d1f7b8eaf3e4a953686482770ecb78406a4ce4666bfdfe447762434127871d8d
   languageName: node
   linkType: hard
 
-"html-encoding-sniffer@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "html-encoding-sniffer@npm:2.0.1"
+"hosted-git-info@npm:^6.0.0":
+  version: 6.1.3
+  resolution: "hosted-git-info@npm:6.1.3"
   dependencies:
-    whatwg-encoding: ^1.0.5
-  checksum: bf30cce461015ed7e365736fcd6a3063c7bc016a91f74398ef6158886970a96333938f7c02417ab3c12aa82e3e53b40822145facccb9ddfbcdc15a879ae4d7ba
+    lru-cache: ^7.5.1
+  checksum: 7a0fc89c98afd07a2a566139fd18136e6a23002a5af3fdf7e36ad2f5fda31e8c5f2e1814fd9daaf385ae5c1f20e34841b4b2b2b63ab10c98c92992c571c3b993
   languageName: node
   linkType: hard
 
@@ -18878,6 +11611,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"html-void-elements@npm:^1.0.0":
+  version: 1.0.5
+  resolution: "html-void-elements@npm:1.0.5"
+  checksum: 1a56f4f6cfbeb994c21701ff72b4b7f556fe784a70e5e554d1566ff775af83b91ea93f10664f039a67802d9f7b40d4a7f1ed20312bab47bd88d89bd792ea84ca
+  languageName: node
+  linkType: hard
+
 "htmlparser2@npm:^7.2.0":
   version: 7.2.0
   resolution: "htmlparser2@npm:7.2.0"
@@ -18890,35 +11630,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"htmlparser2@npm:^8.0.1":
-  version: 8.0.1
-  resolution: "htmlparser2@npm:8.0.1"
-  dependencies:
-    domelementtype: ^2.3.0
-    domhandler: ^5.0.2
-    domutils: ^3.0.1
-    entities: ^4.3.0
-  checksum: 06d5c71e8313597722bc429ae2a7a8333d77bd3ab07ccb916628384b37332027b047f8619448d8f4a3312b6609c6ea3302a4e77435d859e9e686999e6699ca39
-  languageName: node
-  linkType: hard
-
-"http-cache-semantics@npm:^4.1.0":
-  version: 4.1.1
-  resolution: "http-cache-semantics@npm:4.1.1"
-  checksum: 83ac0bc60b17a3a36f9953e7be55e5c8f41acc61b22583060e8dedc9dd5e3607c823a88d0926f9150e571f90946835c7fe150732801010845c72cd8bbff1a236
-  languageName: node
-  linkType: hard
-
-"http-errors@npm:1.7.2":
-  version: 1.7.2
-  resolution: "http-errors@npm:1.7.2"
-  dependencies:
-    depd: ~1.1.2
-    inherits: 2.0.3
-    setprototypeof: 1.1.1
-    statuses: ">= 1.5.0 < 2"
-    toidentifier: 1.0.0
-  checksum: 5534b0ae08e77f5a45a2380f500e781f6580c4ff75b816cb1f09f99a290b57e78a518be6d866db1b48cca6b052c09da2c75fc91fb16a2fe3da3c44d9acbb9972
+"http-cache-semantics@npm:^4.1.1":
+  version: 4.2.0
+  resolution: "http-cache-semantics@npm:4.2.0"
+  checksum: 7a7246ddfce629f96832791176fd643589d954e6f3b49548dadb4290451961237fab8fcea41cd2008fe819d95b41c1e8b97f47d088afc0a1c81705287b4ddbcc
   languageName: node
   linkType: hard
 
@@ -18947,34 +11662,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"http-errors@npm:~1.7.2":
-  version: 1.7.3
-  resolution: "http-errors@npm:1.7.3"
-  dependencies:
-    depd: ~1.1.2
-    inherits: 2.0.4
-    setprototypeof: 1.1.1
-    statuses: ">= 1.5.0 < 2"
-    toidentifier: 1.0.0
-  checksum: a59f359473f4b3ea78305beee90d186268d6075432622a46fb7483059068a2dd4c854a20ac8cd438883127e06afb78c1309168bde6cdfeed1e3700eb42487d99
-  languageName: node
-  linkType: hard
-
 "http-parser-js@npm:>=0.5.1":
-  version: 0.5.3
-  resolution: "http-parser-js@npm:0.5.3"
-  checksum: 6f3142c5f60ad995a6895a1dc4f70f8cef0910745366e97cbcb99caa604590dbcc11006b00989ad306837d6b820e9bfc6e801c4060ed19a0e4df83caa8577cb5
+  version: 0.5.10
+  resolution: "http-parser-js@npm:0.5.10"
+  checksum: 1038177c5f114860345ce7c19223d2cdd9a103265bd897bab13343c9eff4deef60f7956a674485f1234ffc9b19fb4b97f0c20a5848cfc9ccbf5d3c438d89ae89
   languageName: node
   linkType: hard
 
-"http-proxy-agent@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "http-proxy-agent@npm:5.0.0"
+"http-proxy-agent@npm:^7.0.0":
+  version: 7.0.2
+  resolution: "http-proxy-agent@npm:7.0.2"
   dependencies:
-    "@tootallnate/once": 2
-    agent-base: 6
-    debug: 4
-  checksum: e2ee1ff1656a131953839b2a19cd1f3a52d97c25ba87bd2559af6ae87114abf60971e498021f9b73f9fd78aea8876d1fb0d4656aac8a03c6caa9fc175f22b786
+    agent-base: ^7.1.0
+    debug: ^4.3.4
+  checksum: 670858c8f8f3146db5889e1fa117630910101db601fff7d5a8aa637da0abedf68c899f03d3451cac2f83bcc4c3d2dabf339b3aa00ff8080571cceb02c3ce02f3
   languageName: node
   linkType: hard
 
@@ -18989,25 +11690,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"http-signature@npm:~1.2.0":
-  version: 1.2.0
-  resolution: "http-signature@npm:1.2.0"
-  dependencies:
-    assert-plus: ^1.0.0
-    jsprim: ^1.2.2
-    sshpk: ^1.7.0
-  checksum: 3324598712266a9683585bb84a75dec4fd550567d5e0dd4a0fff6ff3f74348793404d3eeac4918fa0902c810eeee1a86419e4a2e92a164132dfe6b26743fb47c
-  languageName: node
-  linkType: hard
-
-"https-browserify@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "https-browserify@npm:1.0.0"
-  checksum: 09b35353e42069fde2435760d13f8a3fb7dd9105e358270e2e225b8a94f811b461edd17cb57594e5f36ec1218f121c160ddceeec6e8be2d55e01dcbbbed8cbae
-  languageName: node
-  linkType: hard
-
-"https-proxy-agent@npm:^2.2.3":
+"https-proxy-agent@npm:2.2.4":
   version: 2.2.4
   resolution: "https-proxy-agent@npm:2.2.4"
   dependencies:
@@ -19045,16 +11728,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"humanize-ms@npm:^1.2.1":
-  version: 1.2.1
-  resolution: "humanize-ms@npm:1.2.1"
-  dependencies:
-    ms: ^2.0.0
-  checksum: 9c7a74a2827f9294c009266c82031030eae811ca87b0da3dceb8d6071b9bde22c9f3daef0469c3c533cc67a97d8a167cd9fc0389350e5f415f61a79b171ded16
-  languageName: node
-  linkType: hard
-
-"iconv-lite@npm:0.4, iconv-lite@npm:0.4.24, iconv-lite@npm:^0.4.24":
+"iconv-lite@npm:0.4.24, iconv-lite@npm:^0.4.24":
   version: 0.4.24
   resolution: "iconv-lite@npm:0.4.24"
   dependencies:
@@ -19081,62 +11755,53 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ieee754@npm:^1.1.13, ieee754@npm:^1.1.4, ieee754@npm:^1.2.1":
+"ieee754@npm:^1.1.13, ieee754@npm:^1.2.1":
   version: 1.2.1
   resolution: "ieee754@npm:1.2.1"
   checksum: 5144c0c9815e54ada181d80a0b810221a253562422e7c6c3a60b1901154184f49326ec239d618c416c1c5945a2e197107aee8d986a3dd836b53dffefd99b5e7e
   languageName: node
   linkType: hard
 
-"iferr@npm:^0.1.5":
-  version: 0.1.5
-  resolution: "iferr@npm:0.1.5"
-  checksum: a18d19b6ad06a2d5412c0d37f6364869393ef6d1688d59d00082c1f35c92399094c031798340612458cd832f4f2e8b13bc9615934a7d8b0c53061307a3816aa1
-  languageName: node
-  linkType: hard
-
-"ignore@npm:^5.1.1, ignore@npm:^5.1.4":
-  version: 5.1.8
-  resolution: "ignore@npm:5.1.8"
-  checksum: 967abadb61e2cb0e5c5e8c4e1686ab926f91bc1a4680d994b91947d3c65d04c3ae126dcdf67f08e0feeb8ff8407d453e641aeeddcc47a3a3cca359f283cf6121
-  languageName: node
-  linkType: hard
-
-"ignore@npm:^5.2.0":
-  version: 5.2.0
-  resolution: "ignore@npm:5.2.0"
-  checksum: 6b1f926792d614f64c6c83da3a1f9c83f6196c2839aa41e1e32dd7b8d174cef2e329d75caabb62cb61ce9dc432f75e67d07d122a037312db7caa73166a1bdb77
+"ignore@npm:^5.1.1, ignore@npm:^5.2.0, ignore@npm:^5.2.4":
+  version: 5.3.2
+  resolution: "ignore@npm:5.3.2"
+  checksum: 2acfd32a573260ea522ea0bfeff880af426d68f6831f973129e2ba7363f422923cf53aab62f8369cbf4667c7b25b6f8a3761b34ecdb284ea18e87a5262a865be
   languageName: node
   linkType: hard
 
-"ignore@npm:^5.2.4":
-  version: 5.2.4
-  resolution: "ignore@npm:5.2.4"
-  checksum: 3d4c309c6006e2621659311783eaea7ebcd41fe4ca1d78c91c473157ad6666a57a2df790fe0d07a12300d9aac2888204d7be8d59f9aaf665b1c7fcdb432517ef
+"ignore@npm:^7.0.3":
+  version: 7.0.4
+  resolution: "ignore@npm:7.0.4"
+  checksum: 09b4d69192355ac066f7d99c0fdb26f52035d2eaae423bfb5f7389091d75a93bf9c105e1fbf51f557098f6d446726f29a63cef3a7d26722dc696dd345224719b
   languageName: node
   linkType: hard
 
-"immutable@npm:^4.0.0":
-  version: 4.2.4
-  resolution: "immutable@npm:4.2.4"
-  checksum: 3be84eded37b05e65cad57bfba630bc1bf170c498b7472144bc02d2650cc9baef79daf03574a9c2e41d195ebb55a1c12c9b312f41ee324b653927b24ad8bcaa7
+"immutable@npm:^5.0.2":
+  version: 5.1.2
+  resolution: "immutable@npm:5.1.2"
+  checksum: 85db3b2fddd637af68c85f7ac2710803fa61736ec56161e6035212a2226eae4d08bae913d48c15baaa94eb2f29e86a45bc40c02777b0220f6943ab66f4dfcf30
   languageName: node
   linkType: hard
 
-"import-fresh@npm:^3.0.0, import-fresh@npm:^3.2.1":
-  version: 3.3.0
-  resolution: "import-fresh@npm:3.3.0"
+"import-fresh@npm:^3.2.1, import-fresh@npm:^3.3.0":
+  version: 3.3.1
+  resolution: "import-fresh@npm:3.3.1"
   dependencies:
     parent-module: ^1.0.0
     resolve-from: ^4.0.0
-  checksum: 2cacfad06e652b1edc50be650f7ec3be08c5e5a6f6d12d035c440a42a8cc028e60a5b99ca08a77ab4d6b1346da7d971915828f33cdab730d3d42f08242d09baa
+  checksum: a06b19461b4879cc654d46f8a6244eb55eb053437afd4cbb6613cad6be203811849ed3e4ea038783092879487299fda24af932b86bdfff67c9055ba3612b8c87
   languageName: node
   linkType: hard
 
-"import-lazy@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "import-lazy@npm:4.0.0"
-  checksum: 22f5e51702134aef78890156738454f620e5fe7044b204ebc057c614888a1dd6fdf2ede0fdcca44d5c173fd64f65c985f19a51775b06967ef58cc3d26898df07
+"import-local@npm:^3.0.2":
+  version: 3.2.0
+  resolution: "import-local@npm:3.2.0"
+  dependencies:
+    pkg-dir: ^4.2.0
+    resolve-cwd: ^3.0.0
+  bin:
+    import-local-fixture: fixtures/cli.js
+  checksum: 0b0b0b412b2521739fbb85eeed834a3c34de9bc67e670b3d0b86248fc460d990a7b116ad056c084b87a693ef73d1f17268d6a5be626bb43c998a8b1c8a230004
   languageName: node
   linkType: hard
 
@@ -19161,20 +11826,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"indent-string@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "indent-string@npm:5.0.0"
-  checksum: e466c27b6373440e6d84fbc19e750219ce25865cb82d578e41a6053d727e5520dc5725217d6eb1cc76005a1bb1696a0f106d84ce7ebda3033b963a38583fb3b3
-  languageName: node
-  linkType: hard
-
-"infer-owner@npm:^1.0.3, infer-owner@npm:^1.0.4":
-  version: 1.0.4
-  resolution: "infer-owner@npm:1.0.4"
-  checksum: 181e732764e4a0611576466b4b87dac338972b839920b2a8cde43642e4ed6bd54dc1fb0b40874728f2a2df9a1b097b8ff83b56d5f8f8e3927f837fdcb47d8a89
-  languageName: node
-  linkType: hard
-
 "inflected@npm:^2.0.4":
   version: 2.1.0
   resolution: "inflected@npm:2.1.0"
@@ -19182,20 +11833,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"inflection@npm:^1.13.2":
-  version: 1.13.2
-  resolution: "inflection@npm:1.13.2"
-  checksum: e7ad0559384ed7c526813404bde843f8f17941d47625ad60fc3b09e46efde873dd9840818007c6bd4dbe388e6248fa033d5a8c405c5fc62738c51b118a0e940f
-  languageName: node
-  linkType: hard
-
-"inflection@npm:^2.0.1, inflection@npm:~2.0.1":
+"inflection@npm:^2.0.1":
   version: 2.0.1
   resolution: "inflection@npm:2.0.1"
   checksum: bb095b495e10a77afc043cc349ae0f7c8c53e4d1fbcd7781111c18d17bde87ce31ea08bd883774bcbb2ff50c301dd4835b5448c80eb50b5e4e080165b6030f3b
   languageName: node
   linkType: hard
 
+"inflection@npm:~3.0.2":
+  version: 3.0.2
+  resolution: "inflection@npm:3.0.2"
+  checksum: 4151df1bbde49701847df1c176d3b6970aba52f9119977529e1fbaf7840155903f9f422bc96ad903852d68e40cb477711efaf1e0032331b0b48d52ffe61a4bdc
+  languageName: node
+  linkType: hard
+
 "inflight@npm:^1.0.4":
   version: 1.0.6
   resolution: "inflight@npm:1.0.6"
@@ -19206,20 +11857,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.1, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.1, inherits@npm:~2.0.3":
+"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.1, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.1":
   version: 2.0.4
   resolution: "inherits@npm:2.0.4"
   checksum: 4a48a733847879d6cf6691860a6b1e3f0f4754176e4d71494c41f3475553768b10f84b5ce1d40fbd0e34e6bfbb864ee35858ad4dd2cf31e02fc4a154b724d7f1
   languageName: node
   linkType: hard
 
-"inherits@npm:2.0.1":
-  version: 2.0.1
-  resolution: "inherits@npm:2.0.1"
-  checksum: 6536b9377296d4ce8ee89c5c543cb75030934e61af42dba98a428e7d026938c5985ea4d1e3b87743a5b834f40ed1187f89c2d7479e9d59e41d2d1051aefba07b
-  languageName: node
-  linkType: hard
-
 "inherits@npm:2.0.3":
   version: 2.0.3
   resolution: "inherits@npm:2.0.3"
@@ -19227,7 +11871,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ini@npm:^1.3.6":
+"ini@npm:1.3.8":
   version: 1.3.8
   resolution: "ini@npm:1.3.8"
   checksum: dfd98b0ca3a4fc1e323e38a6c8eb8936e31a97a918d3b377649ea15bdb15d481207a0dda1021efbd86b464cae29a0d33c1d7dcaf6c5672bee17fa849bc50a1b3
@@ -19291,48 +11935,34 @@ __metadata:
   languageName: node
   linkType: hard
 
-"inquirer@npm:^8.2.1":
-  version: 8.2.5
-  resolution: "inquirer@npm:8.2.5"
+"inquirer@npm:^9.1.5":
+  version: 9.3.7
+  resolution: "inquirer@npm:9.3.7"
   dependencies:
-    ansi-escapes: ^4.2.1
-    chalk: ^4.1.1
-    cli-cursor: ^3.1.0
-    cli-width: ^3.0.0
-    external-editor: ^3.0.3
-    figures: ^3.0.0
-    lodash: ^4.17.21
-    mute-stream: 0.0.8
+    "@inquirer/figures": ^1.0.3
+    ansi-escapes: ^4.3.2
+    cli-width: ^4.1.0
+    external-editor: ^3.1.0
+    mute-stream: 1.0.0
     ora: ^5.4.1
-    run-async: ^2.4.0
-    rxjs: ^7.5.5
-    string-width: ^4.1.0
-    strip-ansi: ^6.0.0
-    through: ^2.3.6
-    wrap-ansi: ^7.0.0
-  checksum: f13ee4c444187786fb393609dedf6b30870115a57b603f2e6424f29a99abc13446fd45ee22461c33c9c40a92a60a8df62d0d6b25d74fc6676fa4cb211de55b55
-  languageName: node
-  linkType: hard
-
-"internal-slot@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "internal-slot@npm:1.0.3"
-  dependencies:
-    get-intrinsic: ^1.1.0
-    has: ^1.0.3
-    side-channel: ^1.0.4
-  checksum: 1944f92e981e47aebc98a88ff0db579fd90543d937806104d0b96557b10c1f170c51fb777b97740a8b6ddeec585fca8c39ae99fd08a8e058dfc8ab70937238bf
+    run-async: ^3.0.0
+    rxjs: ^7.8.1
+    string-width: ^4.2.3
+    strip-ansi: ^6.0.1
+    wrap-ansi: ^6.2.0
+    yoctocolors-cjs: ^2.1.2
+  checksum: 4d6e2f51b80051a6b9cc583ed5143e0a2c5e51938ffc0e91bbf8038216090566990f36ccb7856038390891fa69ea8d43ec389c70dcd097b67d351dc365dfc345
   languageName: node
   linkType: hard
 
-"internal-slot@npm:^1.0.4, internal-slot@npm:^1.0.5":
-  version: 1.0.5
-  resolution: "internal-slot@npm:1.0.5"
+"internal-slot@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "internal-slot@npm:1.1.0"
   dependencies:
-    get-intrinsic: ^1.2.0
-    has: ^1.0.3
-    side-channel: ^1.0.4
-  checksum: 97e84046bf9e7574d0956bd98d7162313ce7057883b6db6c5c7b5e5f05688864b0978ba07610c726d15d66544ffe4b1050107d93f8a39ebc59b15d8b429b497a
+    es-errors: ^1.3.0
+    hasown: ^2.0.2
+    side-channel: ^1.1.0
+  checksum: 8e0991c2d048cc08dab0a91f573c99f6a4215075887517ea4fa32203ce8aea60fa03f95b177977fa27eb502e5168366d0f3e02c762b799691411d49900611861
   languageName: node
   linkType: hard
 
@@ -19343,12 +11973,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"invariant@npm:^2.2.2":
-  version: 2.2.4
-  resolution: "invariant@npm:2.2.4"
-  dependencies:
-    loose-envify: ^1.0.0
-  checksum: cc3182d793aad82a8d1f0af697b462939cb46066ec48bbf1707c150ad5fad6406137e91a262022c269702e01621f35ef60269f6c0d7fd178487959809acdfb14
+"interpret@npm:^3.1.1":
+  version: 3.1.1
+  resolution: "interpret@npm:3.1.1"
+  checksum: 35cebcf48c7351130437596d9ab8c8fe131ce4038da4561e6d665f25640e0034702a031cf7e3a5cea60ac7ac548bf17465e0571ede126f3d3a6933152171ac82
   languageName: node
   linkType: hard
 
@@ -19359,10 +11987,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ip@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "ip@npm:2.0.0"
-  checksum: cfcfac6b873b701996d71ec82a7dd27ba92450afdb421e356f44044ed688df04567344c36cbacea7d01b1c39a4c732dc012570ebe9bebfb06f27314bca625349
+"ip-address@npm:^9.0.5":
+  version: 9.0.5
+  resolution: "ip-address@npm:9.0.5"
+  dependencies:
+    jsbn: 1.1.0
+    sprintf-js: ^1.1.3
+  checksum: aa15f12cfd0ef5e38349744e3654bae649a34c3b10c77a674a167e99925d1549486c5b14730eebce9fea26f6db9d5e42097b00aa4f9f612e68c79121c71652dc
   languageName: node
   linkType: hard
 
@@ -19373,24 +12004,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-accessor-descriptor@npm:^0.1.6":
-  version: 0.1.6
-  resolution: "is-accessor-descriptor@npm:0.1.6"
-  dependencies:
-    kind-of: ^3.0.2
-  checksum: 3d629a086a9585bc16a83a8e8a3416f400023301855cafb7ccc9a1d63145b7480f0ad28877dcc2cce09492c4ec1c39ef4c071996f24ee6ac626be4217b8ffc8a
-  languageName: node
-  linkType: hard
-
-"is-accessor-descriptor@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "is-accessor-descriptor@npm:1.0.0"
-  dependencies:
-    kind-of: ^6.0.0
-  checksum: 8e475968e9b22f9849343c25854fa24492dbe8ba0dea1a818978f9f1b887339190b022c9300d08c47fe36f1b913d70ce8cbaca00369c55a56705fdb7caed37fe
-  languageName: node
-  linkType: hard
-
 "is-alphabetical@npm:^1.0.0":
   version: 1.0.4
   resolution: "is-alphabetical@npm:1.0.4"
@@ -19408,24 +12021,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-arguments@npm:^1.1.1":
-  version: 1.1.1
-  resolution: "is-arguments@npm:1.1.1"
-  dependencies:
-    call-bind: ^1.0.2
-    has-tostringtag: ^1.0.0
-  checksum: 7f02700ec2171b691ef3e4d0e3e6c0ba408e8434368504bb593d0d7c891c0dbfda6d19d30808b904a6cb1929bca648c061ba438c39f296c2a8ca083229c49f27
-  languageName: node
-  linkType: hard
-
-"is-array-buffer@npm:^3.0.1, is-array-buffer@npm:^3.0.2":
-  version: 3.0.2
-  resolution: "is-array-buffer@npm:3.0.2"
+"is-array-buffer@npm:^3.0.4, is-array-buffer@npm:^3.0.5":
+  version: 3.0.5
+  resolution: "is-array-buffer@npm:3.0.5"
   dependencies:
-    call-bind: ^1.0.2
-    get-intrinsic: ^1.2.0
-    is-typed-array: ^1.1.10
-  checksum: dcac9dda66ff17df9cabdc58214172bf41082f956eab30bb0d86bc0fab1e44b690fc8e1f855cf2481245caf4e8a5a006a982a71ddccec84032ed41f9d8da8c14
+    call-bind: ^1.0.8
+    call-bound: ^1.0.3
+    get-intrinsic: ^1.2.6
+  checksum: f137a2a6e77af682cdbffef1e633c140cf596f72321baf8bba0f4ef22685eb4339dde23dfe9e9ca430b5f961dee4d46577dcf12b792b68518c8449b134fb9156
   languageName: node
   linkType: hard
 
@@ -19436,21 +12039,25 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-bigint@npm:^1.0.1":
-  version: 1.0.4
-  resolution: "is-bigint@npm:1.0.4"
+"is-async-function@npm:^2.0.0":
+  version: 2.1.1
+  resolution: "is-async-function@npm:2.1.1"
   dependencies:
-    has-bigints: ^1.0.1
-  checksum: c56edfe09b1154f8668e53ebe8252b6f185ee852a50f9b41e8d921cb2bed425652049fbe438723f6cb48a63ca1aa051e948e7e401e093477c99c84eba244f666
+    async-function: ^1.0.0
+    call-bound: ^1.0.3
+    get-proto: ^1.0.1
+    has-tostringtag: ^1.0.2
+    safe-regex-test: ^1.1.0
+  checksum: 9bece45133da26636488ca127d7686b85ad3ca18927e2850cff1937a650059e90be1c71a48623f8791646bb7a241b0cabf602a0b9252dcfa5ab273f2399000e6
   languageName: node
   linkType: hard
 
-"is-binary-path@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "is-binary-path@npm:1.0.1"
+"is-bigint@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "is-bigint@npm:1.1.0"
   dependencies:
-    binary-extensions: ^1.0.0
-  checksum: a803c99e9d898170c3b44a86fbdc0736d3d7fcbe737345433fb78e810b9fe30c982657782ad0e676644ba4693ddf05601a7423b5611423218663d6b533341ac9
+    has-bigints: ^1.0.2
+  checksum: ee1544f0e664f253306786ed1dce494b8cf242ef415d6375d8545b4d8816b0f054bd9f948a8988ae2c6325d1c28260dd02978236b2f7b8fb70dfc4838a6c9fa7
   languageName: node
   linkType: hard
 
@@ -19463,13 +12070,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-boolean-object@npm:^1.1.0":
-  version: 1.1.2
-  resolution: "is-boolean-object@npm:1.1.2"
+"is-boolean-object@npm:^1.2.1":
+  version: 1.2.2
+  resolution: "is-boolean-object@npm:1.2.2"
   dependencies:
-    call-bind: ^1.0.2
-    has-tostringtag: ^1.0.0
-  checksum: c03b23dbaacadc18940defb12c1c0e3aaece7553ef58b162a0f6bba0c2a7e1551b59f365b91e00d2dbac0522392d576ef322628cb1d036a0fe51eb466db67222
+    call-bound: ^1.0.3
+    has-tostringtag: ^1.0.2
+  checksum: 0415b181e8f1bfd5d3f8a20f8108e64d372a72131674eea9c2923f39d065b6ad08d654765553bdbffbd92c3746f1007986c34087db1bd89a31f71be8359ccdaa
   languageName: node
   linkType: hard
 
@@ -19480,71 +12087,49 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-callable@npm:^1.1.3, is-callable@npm:^1.2.7":
-  version: 1.2.7
-  resolution: "is-callable@npm:1.2.7"
-  checksum: 61fd57d03b0d984e2ed3720fb1c7a897827ea174bd44402878e059542ea8c4aeedee0ea0985998aa5cc2736b2fa6e271c08587addb5b3959ac52cf665173d1ac
-  languageName: node
-  linkType: hard
-
-"is-callable@npm:^1.1.4, is-callable@npm:^1.2.3, is-callable@npm:^1.2.4":
-  version: 1.2.4
-  resolution: "is-callable@npm:1.2.4"
-  checksum: 1a28d57dc435797dae04b173b65d6d1e77d4f16276e9eff973f994eadcfdc30a017e6a597f092752a083c1103cceb56c91e3dadc6692fedb9898dfaba701575f
-  languageName: node
-  linkType: hard
-
-"is-core-module@npm:^2.11.0, is-core-module@npm:^2.12.0, is-core-module@npm:^2.5.0":
-  version: 2.12.1
-  resolution: "is-core-module@npm:2.12.1"
-  dependencies:
-    has: ^1.0.3
-  checksum: f04ea30533b5e62764e7b2e049d3157dc0abd95ef44275b32489ea2081176ac9746ffb1cdb107445cf1ff0e0dfcad522726ca27c27ece64dadf3795428b8e468
-  languageName: node
-  linkType: hard
-
-"is-core-module@npm:^2.2.0":
-  version: 2.8.0
-  resolution: "is-core-module@npm:2.8.0"
+"is-builtin-module@npm:^3.2.1":
+  version: 3.2.1
+  resolution: "is-builtin-module@npm:3.2.1"
   dependencies:
-    has: ^1.0.3
-  checksum: f8b52714891e1a6c6577fcb8d5e057bab064a7a30954aab6beb5092e311473eb8da57afd334de4981dc32409ffca998412efc3a2edceb9e397cef6098d21dd91
+    builtin-modules: ^3.3.0
+  checksum: e8f0ffc19a98240bda9c7ada84d846486365af88d14616e737d280d378695c8c448a621dcafc8332dbf0fcd0a17b0763b845400709963fa9151ddffece90ae88
   languageName: node
   linkType: hard
 
-"is-core-module@npm:^2.8.1":
-  version: 2.8.1
-  resolution: "is-core-module@npm:2.8.1"
-  dependencies:
-    has: ^1.0.3
-  checksum: 418b7bc10768a73c41c7ef497e293719604007f88934a6ffc5f7c78702791b8528102fb4c9e56d006d69361549b3d9519440214a74aefc7e0b79e5e4411d377f
+"is-callable@npm:^1.2.7":
+  version: 1.2.7
+  resolution: "is-callable@npm:1.2.7"
+  checksum: 61fd57d03b0d984e2ed3720fb1c7a897827ea174bd44402878e059542ea8c4aeedee0ea0985998aa5cc2736b2fa6e271c08587addb5b3959ac52cf665173d1ac
   languageName: node
   linkType: hard
 
-"is-data-descriptor@npm:^0.1.4":
-  version: 0.1.4
-  resolution: "is-data-descriptor@npm:0.1.4"
+"is-core-module@npm:^2.12.1, is-core-module@npm:^2.16.0":
+  version: 2.16.1
+  resolution: "is-core-module@npm:2.16.1"
   dependencies:
-    kind-of: ^3.0.2
-  checksum: 5c622e078ba933a78338ae398a3d1fc5c23332b395312daf4f74bab4afb10d061cea74821add726cb4db8b946ba36217ee71a24fe71dd5bca4632edb7f6aad87
+    hasown: ^2.0.2
+  checksum: 6ec5b3c42d9cbf1ac23f164b16b8a140c3cec338bf8f884c076ca89950c7cc04c33e78f02b8cae7ff4751f3247e3174b2330f1fe4de194c7210deb8b1ea316a7
   languageName: node
   linkType: hard
 
-"is-data-descriptor@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "is-data-descriptor@npm:1.0.0"
+"is-data-view@npm:^1.0.1, is-data-view@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "is-data-view@npm:1.0.2"
   dependencies:
-    kind-of: ^6.0.0
-  checksum: e705e6816241c013b05a65dc452244ee378d1c3e3842bd140beabe6e12c0d700ef23c91803f971aa7b091fb0573c5da8963af34a2b573337d87bc3e1f53a4e6d
+    call-bound: ^1.0.2
+    get-intrinsic: ^1.2.6
+    is-typed-array: ^1.1.13
+  checksum: 31600dd19932eae7fd304567e465709ffbfa17fa236427c9c864148e1b54eb2146357fcf3aed9b686dee13c217e1bb5a649cb3b9c479e1004c0648e9febde1b2
   languageName: node
   linkType: hard
 
-"is-date-object@npm:^1.0.1, is-date-object@npm:^1.0.5":
-  version: 1.0.5
-  resolution: "is-date-object@npm:1.0.5"
+"is-date-object@npm:^1.0.5, is-date-object@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "is-date-object@npm:1.1.0"
   dependencies:
-    has-tostringtag: ^1.0.0
-  checksum: baa9077cdf15eb7b58c79398604ca57379b2fc4cf9aa7a9b9e295278648f628c9b201400c01c5e0f7afae56507d741185730307cbe7cad3b9f90a77e5ee342fc
+    call-bound: ^1.0.2
+    has-tostringtag: ^1.0.2
+  checksum: d6c36ab9d20971d65f3fc64cef940d57a4900a2ac85fb488a46d164c2072a33da1cb51eefcc039e3e5c208acbce343d3480b84ab5ff0983f617512da2742562a
   languageName: node
   linkType: hard
 
@@ -19555,28 +12140,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-descriptor@npm:^0.1.0":
-  version: 0.1.6
-  resolution: "is-descriptor@npm:0.1.6"
-  dependencies:
-    is-accessor-descriptor: ^0.1.6
-    is-data-descriptor: ^0.1.4
-    kind-of: ^5.0.0
-  checksum: 0f780c1b46b465f71d970fd7754096ffdb7b69fd8797ca1f5069c163eaedcd6a20ec4a50af669075c9ebcfb5266d2e53c8b227e485eefdb0d1fee09aa1dd8ab6
-  languageName: node
-  linkType: hard
-
-"is-descriptor@npm:^1.0.0, is-descriptor@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "is-descriptor@npm:1.0.2"
-  dependencies:
-    is-accessor-descriptor: ^1.0.0
-    is-data-descriptor: ^1.0.0
-    kind-of: ^6.0.2
-  checksum: 2ed623560bee035fb67b23e32ce885700bef8abe3fbf8c909907d86507b91a2c89a9d3a4d835a4d7334dd5db0237a0aeae9ca109c1e4ef1c0e7b577c0846ab5a
-  languageName: node
-  linkType: hard
-
 "is-docker@npm:^2.0.0":
   version: 2.2.1
   resolution: "is-docker@npm:2.2.1"
@@ -19586,22 +12149,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-extendable@npm:^0.1.0, is-extendable@npm:^0.1.1":
-  version: 0.1.1
-  resolution: "is-extendable@npm:0.1.1"
-  checksum: 3875571d20a7563772ecc7a5f36cb03167e9be31ad259041b4a8f73f33f885441f778cee1f1fe0085eb4bc71679b9d8c923690003a36a6a5fdf8023e6e3f0672
-  languageName: node
-  linkType: hard
-
-"is-extendable@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "is-extendable@npm:1.0.1"
-  dependencies:
-    is-plain-object: ^2.0.4
-  checksum: db07bc1e9de6170de70eff7001943691f05b9d1547730b11be01c0ebfe67362912ba743cf4be6fd20a5e03b4180c685dad80b7c509fe717037e3eee30ad8e84f
-  languageName: node
-  linkType: hard
-
 "is-extglob@npm:^2.1.0, is-extglob@npm:^2.1.1":
   version: 2.1.1
   resolution: "is-extglob@npm:2.1.1"
@@ -19609,10 +12156,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-finite@npm:^1.0.0":
-  version: 1.1.0
-  resolution: "is-finite@npm:1.1.0"
-  checksum: 532b97ed3d03e04c6bd203984d9e4ba3c0c390efee492bad5d1d1cd1802a68ab27adbd3ef6382f6312bed6c8bb1bd3e325ea79a8dc8fe080ed7a06f5f97b93e7
+"is-finalizationregistry@npm:^1.1.0":
+  version: 1.1.1
+  resolution: "is-finalizationregistry@npm:1.1.1"
+  dependencies:
+    call-bound: ^1.0.3
+  checksum: 38c646c506e64ead41a36c182d91639833311970b6b6c6268634f109eef0a1a9d2f1f2e499ef4cb43c744a13443c4cdd2f0812d5afdcee5e9b65b72b28c48557
   languageName: node
   linkType: hard
 
@@ -19630,6 +12179,34 @@ __metadata:
   languageName: node
   linkType: hard
 
+"is-fullwidth-code-point@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "is-fullwidth-code-point@npm:4.0.0"
+  checksum: 8ae89bf5057bdf4f57b346fb6c55e9c3dd2549983d54191d722d5c739397a903012cc41a04ee3403fd872e811243ef91a7c5196da7b5841dc6b6aae31a264a8d
+  languageName: node
+  linkType: hard
+
+"is-fullwidth-code-point@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "is-fullwidth-code-point@npm:5.0.0"
+  dependencies:
+    get-east-asian-width: ^1.0.0
+  checksum: 8dfb2d2831b9e87983c136f5c335cd9d14c1402973e357a8ff057904612ed84b8cba196319fabedf9aefe4639e14fe3afe9d9966d1d006ebeb40fe1fed4babe5
+  languageName: node
+  linkType: hard
+
+"is-generator-function@npm:^1.0.10":
+  version: 1.1.0
+  resolution: "is-generator-function@npm:1.1.0"
+  dependencies:
+    call-bound: ^1.0.3
+    get-proto: ^1.0.0
+    has-tostringtag: ^1.0.2
+    safe-regex-test: ^1.1.0
+  checksum: f7f7276131bdf7e28169b86ac55a5b080012a597f9d85a0cbef6fe202a7133fa450a3b453e394870e3cb3685c5a764c64a9f12f614684b46969b1e6f297bed6b
+  languageName: node
+  linkType: hard
+
 "is-git-url@npm:^1.0.0":
   version: 1.0.0
   resolution: "is-git-url@npm:1.0.0"
@@ -19646,16 +12223,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-glob@npm:^4.0.0, is-glob@npm:^4.0.1, is-glob@npm:~4.0.1":
-  version: 4.0.1
-  resolution: "is-glob@npm:4.0.1"
-  dependencies:
-    is-extglob: ^2.1.1
-  checksum: 84627cad11b4e745f5db5a163f32c47b711585a5ff6e14f8f8d026db87f4cdd3e2c95f6fa1f94ad22e469f36d819ae2814f03f9c668b164422ac3354a94672d3
-  languageName: node
-  linkType: hard
-
-"is-glob@npm:^4.0.3":
+"is-glob@npm:^4.0.0, is-glob@npm:^4.0.1, is-glob@npm:^4.0.3, is-glob@npm:~4.0.1":
   version: 4.0.3
   resolution: "is-glob@npm:4.0.3"
   dependencies:
@@ -19678,13 +12246,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-lambda@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "is-lambda@npm:1.0.1"
-  checksum: 93a32f01940220532e5948538699ad610d5924ac86093fcee83022252b363eb0cc99ba53ab084a04e4fb62bf7b5731f55496257a4c38adf87af9c4d352c71c35
-  languageName: node
-  linkType: hard
-
 "is-language-code@npm:^3.1.0":
   version: 3.1.0
   resolution: "is-language-code@npm:3.1.0"
@@ -19694,42 +12255,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-map@npm:^2.0.1, is-map@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "is-map@npm:2.0.2"
-  checksum: ace3d0ecd667bbdefdb1852de601268f67f2db725624b1958f279316e13fecb8fa7df91fd60f690d7417b4ec180712f5a7ee967008e27c65cfd475cc84337728
-  languageName: node
-  linkType: hard
-
-"is-negative-zero@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "is-negative-zero@npm:2.0.1"
-  checksum: a46f2e0cb5e16fdb8f2011ed488979386d7e68d381966682e3f4c98fc126efe47f26827912baca2d06a02a644aee458b9cba307fb389f6b161e759125db7a3b8
-  languageName: node
-  linkType: hard
-
-"is-negative-zero@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "is-negative-zero@npm:2.0.2"
-  checksum: f3232194c47a549da60c3d509c9a09be442507616b69454716692e37ae9f37c4dea264fb208ad0c9f3efd15a796a46b79df07c7e53c6227c32170608b809149a
-  languageName: node
-  linkType: hard
-
-"is-number-object@npm:^1.0.4":
-  version: 1.0.6
-  resolution: "is-number-object@npm:1.0.6"
-  dependencies:
-    has-tostringtag: ^1.0.0
-  checksum: c697704e8fc2027fc41cb81d29805de4e8b6dc9c3efee93741dbf126a8ecc8443fef85adbc581415ae7e55d325e51d0a942324ae35c829131748cce39cba55f3
+"is-map@npm:^2.0.3":
+  version: 2.0.3
+  resolution: "is-map@npm:2.0.3"
+  checksum: e6ce5f6380f32b141b3153e6ba9074892bbbbd655e92e7ba5ff195239777e767a976dcd4e22f864accaf30e53ebf961ab1995424aef91af68788f0591b7396cc
   languageName: node
   linkType: hard
 
-"is-number@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "is-number@npm:3.0.0"
+"is-number-object@npm:^1.1.1":
+  version: 1.1.1
+  resolution: "is-number-object@npm:1.1.1"
   dependencies:
-    kind-of: ^3.0.2
-  checksum: 0c62bf8e9d72c4dd203a74d8cfc751c746e75513380fef420cda8237e619a988ee43e678ddb23c87ac24d91ac0fe9f22e4ffb1301a50310c697e9d73ca3994e9
+    call-bound: ^1.0.3
+    has-tostringtag: ^1.0.2
+  checksum: 6517f0a0e8c4b197a21afb45cd3053dc711e79d45d8878aa3565de38d0102b130ca8732485122c7b336e98c27dacd5236854e3e6526e0eb30cae64956535662f
   languageName: node
   linkType: hard
 
@@ -19740,13 +12279,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-obj@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "is-obj@npm:1.0.1"
-  checksum: 3ccf0efdea12951e0b9c784e2b00e77e87b2f8bd30b42a498548a8afcc11b3287342a2030c308e473e93a7a19c9ea7854c99a8832a476591c727df2a9c79796c
-  languageName: node
-  linkType: hard
-
 "is-obj@npm:^2.0.0":
   version: 2.0.0
   resolution: "is-obj@npm:2.0.0"
@@ -19768,14 +12300,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-plain-obj@npm:^1.1.0":
-  version: 1.1.0
-  resolution: "is-plain-obj@npm:1.1.0"
-  checksum: 0ee04807797aad50859652a7467481816cbb57e5cc97d813a7dcd8915da8195dc68c436010bf39d195226cde6a2d352f4b815f16f26b7bf486a5754290629931
-  languageName: node
-  linkType: hard
-
-"is-plain-object@npm:^2.0.3, is-plain-object@npm:^2.0.4":
+"is-plain-object@npm:^2.0.4":
   version: 2.0.4
   resolution: "is-plain-object@npm:2.0.4"
   dependencies:
@@ -19791,59 +12316,31 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-potential-custom-element-name@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "is-potential-custom-element-name@npm:1.0.1"
-  checksum: ced7bbbb6433a5b684af581872afe0e1767e2d1146b2207ca0068a648fb5cab9d898495d1ac0583524faaf24ca98176a7d9876363097c2d14fee6dd324f3a1ab
-  languageName: node
-  linkType: hard
-
-"is-reference@npm:^1.1.0":
+"is-regex@npm:^1.2.1":
   version: 1.2.1
-  resolution: "is-reference@npm:1.2.1"
-  dependencies:
-    "@types/estree": "*"
-  checksum: e7b48149f8abda2c10849ea51965904d6a714193d68942ad74e30522231045acf06cbfae5a4be2702fede5d232e61bf50b3183acdc056e6e3afe07fcf4f4b2bc
-  languageName: node
-  linkType: hard
-
-"is-regex@npm:^1.1.2, is-regex@npm:^1.1.4":
-  version: 1.1.4
-  resolution: "is-regex@npm:1.1.4"
+  resolution: "is-regex@npm:1.2.1"
   dependencies:
-    call-bind: ^1.0.2
-    has-tostringtag: ^1.0.0
-  checksum: 362399b33535bc8f386d96c45c9feb04cf7f8b41c182f54174c1a45c9abbbe5e31290bbad09a458583ff6bf3b2048672cdb1881b13289569a7c548370856a652
-  languageName: node
-  linkType: hard
-
-"is-regexp@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "is-regexp@npm:1.0.0"
-  checksum: be692828e24cba479ec33644326fa98959ec68ba77965e0291088c1a741feaea4919d79f8031708f85fd25e39de002b4520622b55460660b9c369e6f7187faef
-  languageName: node
-  linkType: hard
-
-"is-set@npm:^2.0.1, is-set@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "is-set@npm:2.0.2"
-  checksum: b64343faf45e9387b97a6fd32be632ee7b269bd8183701f3b3f5b71a7cf00d04450ed8669d0bd08753e08b968beda96fca73a10fd0ff56a32603f64deba55a57
+    call-bound: ^1.0.2
+    gopd: ^1.2.0
+    has-tostringtag: ^1.0.2
+    hasown: ^2.0.2
+  checksum: 99ee0b6d30ef1bb61fa4b22fae7056c6c9b3c693803c0c284ff7a8570f83075a7d38cda53b06b7996d441215c27895ea5d1af62124562e13d91b3dbec41a5e13
   languageName: node
   linkType: hard
 
-"is-shared-array-buffer@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "is-shared-array-buffer@npm:1.0.1"
-  checksum: 2ffb92533e64e2876e6cfe6906871d28400b6f1a53130fe652ec8007bc0e5044d05e7af8e31bdc992fbba520bd92938cfbeedd0f286be92f250c7c76191c4d90
+"is-set@npm:^2.0.3":
+  version: 2.0.3
+  resolution: "is-set@npm:2.0.3"
+  checksum: 36e3f8c44bdbe9496c9689762cc4110f6a6a12b767c5d74c0398176aa2678d4467e3bf07595556f2dba897751bde1422480212b97d973c7b08a343100b0c0dfe
   languageName: node
   linkType: hard
 
-"is-shared-array-buffer@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "is-shared-array-buffer@npm:1.0.2"
+"is-shared-array-buffer@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "is-shared-array-buffer@npm:1.0.4"
   dependencies:
-    call-bind: ^1.0.2
-  checksum: 9508929cf14fdc1afc9d61d723c6e8d34f5e117f0bffda4d97e7a5d88c3a8681f633a74f8e3ad1fe92d5113f9b921dc5ca44356492079612f9a247efbce7032a
+    call-bound: ^1.0.3
+  checksum: 1611fedc175796eebb88f4dfc393dd969a4a8e6c69cadaff424ee9d4464f9f026399a5f84a90f7c62d6d7ee04e3626a912149726de102b0bd6c1ee6a9868fa5a
   languageName: node
   linkType: hard
 
@@ -19868,21 +12365,33 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-string@npm:^1.0.5, is-string@npm:^1.0.7":
-  version: 1.0.7
-  resolution: "is-string@npm:1.0.7"
+"is-string@npm:^1.1.1":
+  version: 1.1.1
+  resolution: "is-string@npm:1.1.1"
   dependencies:
-    has-tostringtag: ^1.0.0
-  checksum: 323b3d04622f78d45077cf89aab783b2f49d24dc641aa89b5ad1a72114cfeff2585efc8c12ef42466dff32bde93d839ad321b26884cf75e5a7892a938b089989
+    call-bound: ^1.0.3
+    has-tostringtag: ^1.0.2
+  checksum: 2eeaaff605250f5e836ea3500d33d1a5d3aa98d008641d9d42fb941e929ffd25972326c2ef912987e54c95b6f10416281aaf1b35cdf81992cfb7524c5de8e193
   languageName: node
   linkType: hard
 
-"is-symbol@npm:^1.0.2, is-symbol@npm:^1.0.3":
-  version: 1.0.4
-  resolution: "is-symbol@npm:1.0.4"
+"is-subdir@npm:^1.2.0":
+  version: 1.2.0
+  resolution: "is-subdir@npm:1.2.0"
+  dependencies:
+    better-path-resolve: 1.0.0
+  checksum: 31029a383972bff4cc4f1bd1463fd04dde017e0a04ae3a6f6e08124a90c6c4656312d593101b0f38805fa3f3c8f6bc4583524bbf72c50784fa5ca0d3e5a76279
+  languageName: node
+  linkType: hard
+
+"is-symbol@npm:^1.0.4, is-symbol@npm:^1.1.1":
+  version: 1.1.1
+  resolution: "is-symbol@npm:1.1.1"
   dependencies:
-    has-symbols: ^1.0.2
-  checksum: 92805812ef590738d9de49d677cd17dfd486794773fb6fa0032d16452af46e9b91bb43ffe82c983570f015b37136f4b53b28b8523bfb10b0ece7a66c31a54510
+    call-bound: ^1.0.2
+    has-symbols: ^1.1.0
+    safe-regex-test: ^1.1.0
+  checksum: bfafacf037af6f3c9d68820b74be4ae8a736a658a3344072df9642a090016e281797ba8edbeb1c83425879aae55d1cb1f30b38bf132d703692b2570367358032
   languageName: node
   linkType: hard
 
@@ -19895,20 +12404,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-typed-array@npm:^1.1.10, is-typed-array@npm:^1.1.9":
-  version: 1.1.10
-  resolution: "is-typed-array@npm:1.1.10"
+"is-typed-array@npm:^1.1.13, is-typed-array@npm:^1.1.14, is-typed-array@npm:^1.1.15":
+  version: 1.1.15
+  resolution: "is-typed-array@npm:1.1.15"
   dependencies:
-    available-typed-arrays: ^1.0.5
-    call-bind: ^1.0.2
-    for-each: ^0.3.3
-    gopd: ^1.0.1
-    has-tostringtag: ^1.0.0
-  checksum: aac6ecb59d4c56a1cdeb69b1f129154ef462bbffe434cb8a8235ca89b42f258b7ae94073c41b3cb7bce37f6a1733ad4499f07882d5d5093a7ba84dfc4ebb8017
+    which-typed-array: ^1.1.16
+  checksum: ea7cfc46c282f805d19a9ab2084fd4542fed99219ee9dbfbc26284728bd713a51eac66daa74eca00ae0a43b61322920ba334793607dc39907465913e921e0892
   languageName: node
   linkType: hard
 
-"is-typedarray@npm:^1.0.0, is-typedarray@npm:~1.0.0":
+"is-typedarray@npm:^1.0.0":
   version: 1.0.0
   resolution: "is-typedarray@npm:1.0.0"
   checksum: 3508c6cd0a9ee2e0df2fa2e9baabcdc89e911c7bd5cf64604586697212feec525aa21050e48affb5ffc3df20f0f5d2e2cf79b08caa64e1ccc9578e251763aef7
@@ -19922,55 +12427,39 @@ __metadata:
   languageName: node
   linkType: hard
 
-"is-weakmap@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "is-weakmap@npm:2.0.1"
-  checksum: 1222bb7e90c32bdb949226e66d26cb7bce12e1e28e3e1b40bfa6b390ba3e08192a8664a703dff2a00a84825f4e022f9cd58c4599ff9981ab72b1d69479f4f7f6
-  languageName: node
-  linkType: hard
-
-"is-weakref@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "is-weakref@npm:1.0.1"
-  dependencies:
-    call-bind: ^1.0.0
-  checksum: fdafb7b955671dd2f9658ff47c86e4025c0650fc68a3542a40e5a75898a763b1abd6b1e1f9f13207eed49541cdd76af67d73c44989ea358b201b70274cf8f6c1
+"is-weakmap@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "is-weakmap@npm:2.0.2"
+  checksum: f36aef758b46990e0d3c37269619c0a08c5b29428c0bb11ecba7f75203442d6c7801239c2f31314bc79199217ef08263787f3837d9e22610ad1da62970d6616d
   languageName: node
   linkType: hard
 
-"is-weakref@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "is-weakref@npm:1.0.2"
+"is-weakref@npm:^1.0.2, is-weakref@npm:^1.1.1":
+  version: 1.1.1
+  resolution: "is-weakref@npm:1.1.1"
   dependencies:
-    call-bind: ^1.0.2
-  checksum: 95bd9a57cdcb58c63b1c401c60a474b0f45b94719c30f548c891860f051bc2231575c290a6b420c6bc6e7ed99459d424c652bd5bf9a1d5259505dc35b4bf83de
+    call-bound: ^1.0.3
+  checksum: 1769b9aed5d435a3a989ffc18fc4ad1947d2acdaf530eb2bd6af844861b545047ea51102f75901f89043bed0267ed61d914ee21e6e8b9aa734ec201cdfc0726f
   languageName: node
   linkType: hard
 
-"is-weakset@npm:^2.0.1":
-  version: 2.0.2
-  resolution: "is-weakset@npm:2.0.2"
+"is-weakset@npm:^2.0.3":
+  version: 2.0.4
+  resolution: "is-weakset@npm:2.0.4"
   dependencies:
-    call-bind: ^1.0.2
-    get-intrinsic: ^1.1.1
-  checksum: 5d8698d1fa599a0635d7ca85be9c26d547b317ed8fd83fc75f03efbe75d50001b5eececb1e9971de85fcde84f69ae6f8346bc92d20d55d46201d328e4c74a367
+    call-bound: ^1.0.3
+    get-intrinsic: ^1.2.6
+  checksum: 5c6c8415a06065d78bdd5e3a771483aa1cd928df19138aa73c4c51333226f203f22117b4325df55cc8b3085a6716870a320c2d757efee92d7a7091a039082041
   languageName: node
   linkType: hard
 
-"is-windows@npm:^1.0.1, is-windows@npm:^1.0.2":
+"is-windows@npm:^1.0.0, is-windows@npm:^1.0.1":
   version: 1.0.2
   resolution: "is-windows@npm:1.0.2"
   checksum: 438b7e52656fe3b9b293b180defb4e448088e7023a523ec21a91a80b9ff8cdb3377ddb5b6e60f7c7de4fa8b63ab56e121b6705fe081b3cf1b828b0a380009ad7
   languageName: node
   linkType: hard
 
-"is-wsl@npm:^1.1.0":
-  version: 1.1.0
-  resolution: "is-wsl@npm:1.1.0"
-  checksum: ea157d232351e68c92bd62fc541771096942fe72f69dff452dd26dcc31466258c570a3b04b8cda2e01cd2968255b02951b8670d08ea4ed76d6b1a646061ac4fe
-  languageName: node
-  linkType: hard
-
 "is-wsl@npm:^2.2.0":
   version: 2.2.0
   resolution: "is-wsl@npm:2.2.0"
@@ -19987,7 +12476,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"isarray@npm:1.0.0, isarray@npm:^1.0.0, isarray@npm:~1.0.0":
+"isarray@npm:1.0.0, isarray@npm:^1.0.0":
   version: 1.0.0
   resolution: "isarray@npm:1.0.0"
   checksum: f032df8e02dce8ec565cf2eb605ea939bdccea528dbcf565cdf92bfa2da9110461159d86a537388ef1acef8815a330642d7885b29010e8f7eac967c9993b65ab
@@ -20002,9 +12491,9 @@ __metadata:
   linkType: hard
 
 "isbinaryfile@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "isbinaryfile@npm:5.0.0"
-  checksum: 25cc27388d51b8322c103f5894f9e72ec04e017734e57c4b70be2666501ec7e7f6cbb4a5fcfd15260a7cac979bd1ddb7f5231f5a3098c0695c4e7c049513dfaf
+  version: 5.0.4
+  resolution: "isbinaryfile@npm:5.0.4"
+  checksum: d88982a889369d83a5937b4b4d2288ed3b3dbbcee8fc74db40058f3c089a2c7beb9e5305b7177e82d87ff38fb62be8d60960f7a2d669ca08240ef31c1435b884
   languageName: node
   linkType: hard
 
@@ -20015,6 +12504,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"isexe@npm:^3.1.1":
+  version: 3.1.1
+  resolution: "isexe@npm:3.1.1"
+  checksum: 7fe1931ee4e88eb5aa524cd3ceb8c882537bc3a81b02e438b240e47012eef49c86904d0f0e593ea7c3a9996d18d0f1f3be8d3eaa92333977b0c3a9d353d5563e
+  languageName: node
+  linkType: hard
+
 "isobject@npm:^2.0.0":
   version: 2.1.0
   resolution: "isobject@npm:2.1.0"
@@ -20024,20 +12520,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"isobject@npm:^3.0.0, isobject@npm:^3.0.1":
+"isobject@npm:^3.0.1":
   version: 3.0.1
   resolution: "isobject@npm:3.0.1"
   checksum: db85c4c970ce30693676487cca0e61da2ca34e8d4967c2e1309143ff910c207133a969f9e4ddb2dc6aba670aabce4e0e307146c310350b298e74a31f7d464703
   languageName: node
   linkType: hard
 
-"isstream@npm:~0.1.2":
-  version: 0.1.2
-  resolution: "isstream@npm:0.1.2"
-  checksum: 1eb2fe63a729f7bdd8a559ab552c69055f4f48eb5c2f03724430587c6f450783c8f1cd936c1c952d0a927925180fcc892ebd5b174236cf1065d4bd5bdb37e963
-  languageName: node
-  linkType: hard
-
 "istextorbinary@npm:2.1.0":
   version: 2.1.0
   resolution: "istextorbinary@npm:2.1.0"
@@ -20060,16 +12549,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jackspeak@npm:^2.3.5":
-  version: 2.3.6
-  resolution: "jackspeak@npm:2.3.6"
+"jackspeak@npm:^3.1.2":
+  version: 3.4.3
+  resolution: "jackspeak@npm:3.4.3"
   dependencies:
     "@isaacs/cliui": ^8.0.2
     "@pkgjs/parseargs": ^0.11.0
   dependenciesMeta:
     "@pkgjs/parseargs":
       optional: true
-  checksum: 57d43ad11eadc98cdfe7496612f6bbb5255ea69fe51ea431162db302c2a11011642f50cfad57288bd0aea78384a0612b16e131944ad8ecd09d619041c8531b54
+  checksum: be31027fc72e7cc726206b9f560395604b82e0fddb46c4cbf9f97d049bcef607491a5afc0699612eaa4213ca5be8fd3e1e7cd187b3040988b65c9489838a7c00
   languageName: node
   linkType: hard
 
@@ -20084,17 +12573,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jquery@npm:^3.4.1":
-  version: 3.7.0
-  resolution: "jquery@npm:3.7.0"
-  checksum: 907785e133afc427650a131af5fccef66a404885037513b3d4d7d63aee6409bcc32a39836868c60e59b05aa0fb8ace8961c18b2ee3ffdf6ffdb571d6d7cd88ff
-  languageName: node
-  linkType: hard
-
-"js-sdsl@npm:^4.1.4":
-  version: 4.1.5
-  resolution: "js-sdsl@npm:4.1.5"
-  checksum: 695f657ddc5be462b97cac4e8e60f37de28d628ee0e23016baecff0bb584a18dddb5caeac537a775030f180b5afd62133ac4481e7024c8d03a62d73e4da0713e
+"jquery@npm:^3.5.1":
+  version: 3.7.1
+  resolution: "jquery@npm:3.7.1"
+  checksum: 4370b8139d6ae82867eb6f7f21d1edccf1d1bdf41c0840920ea80d366c2cd5dbe1ceebb110ee9772aa839b04400faa1572c5c560b507c688ed7b61cea26c0e27
   languageName: node
   linkType: hard
 
@@ -20105,21 +12587,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"js-tokens@npm:^3.0.0 || ^4.0.0, js-tokens@npm:^4.0.0":
+"js-tokens@npm:^4.0.0":
   version: 4.0.0
   resolution: "js-tokens@npm:4.0.0"
   checksum: 8a95213a5a77deb6cbe94d86340e8d9ace2b93bc367790b260101d2f36a2eaf4e4e22d9fa9cf459b38af3a32fb4190e638024cf82ec95ef708680e405ea7cc78
   languageName: node
   linkType: hard
 
-"js-tokens@npm:^3.0.2":
-  version: 3.0.2
-  resolution: "js-tokens@npm:3.0.2"
-  checksum: ff24cf90e6e4ac446eba56e604781c1aaf3bdaf9b13a00596a0ebd972fa3b25dc83c0f0f67289c33252abb4111e0d14e952a5d9ffb61f5c22532d555ebd8d8a9
-  languageName: node
-  linkType: hard
-
-"js-yaml@npm:^3.13.1, js-yaml@npm:^3.2.5, js-yaml@npm:^3.2.7":
+"js-yaml@npm:^3.2.5, js-yaml@npm:^3.2.7":
   version: 3.14.1
   resolution: "js-yaml@npm:3.14.1"
   dependencies:
@@ -20142,204 +12617,207 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jsbn@npm:~0.1.0":
-  version: 0.1.1
-  resolution: "jsbn@npm:0.1.1"
-  checksum: e5ff29c1b8d965017ef3f9c219dacd6e40ad355c664e277d31246c90545a02e6047018c16c60a00f36d561b3647215c41894f5d869ada6908a2e0ce4200c88f2
-  languageName: node
-  linkType: hard
-
-"jsdom@npm:^16.4.0":
-  version: 16.5.3
-  resolution: "jsdom@npm:16.5.3"
-  dependencies:
-    abab: ^2.0.5
-    acorn: ^8.1.0
-    acorn-globals: ^6.0.0
-    cssom: ^0.4.4
-    cssstyle: ^2.3.0
-    data-urls: ^2.0.0
-    decimal.js: ^10.2.1
-    domexception: ^2.0.1
-    escodegen: ^2.0.0
-    html-encoding-sniffer: ^2.0.1
-    is-potential-custom-element-name: ^1.0.0
-    nwsapi: ^2.2.0
-    parse5: 6.0.1
-    request: ^2.88.2
-    request-promise-native: ^1.0.9
-    saxes: ^5.0.1
-    symbol-tree: ^3.2.4
-    tough-cookie: ^4.0.0
-    w3c-hr-time: ^1.0.2
-    w3c-xmlserializer: ^2.0.0
-    webidl-conversions: ^6.1.0
-    whatwg-encoding: ^1.0.5
-    whatwg-mimetype: ^2.3.0
-    whatwg-url: ^8.5.0
-    ws: ^7.4.4
-    xml-name-validator: ^3.0.0
-  peerDependencies:
-    canvas: ^2.5.0
-  peerDependenciesMeta:
-    canvas:
-      optional: true
-  checksum: 19d107eeaa2b67cb9288b313d12af9df4c633526bbbaf222b0d97c1cfd4b9f23294f168dd80c39ee6bd344dde336b9a57ed24136639fea7dc5e24e88f4d5f79f
+"js2xmlparser@npm:^4.0.2":
+  version: 4.0.2
+  resolution: "js2xmlparser@npm:4.0.2"
+  dependencies:
+    xmlcreate: ^2.0.4
+  checksum: 55e3af71dc0104941dfc3e85452230db42ff3870a5777d1ea26bc0c68743f49113a517a7b305421a932b29f10058a012a7da8f5ba07860a05a1dce9fe5b62962
   languageName: node
   linkType: hard
 
-"jsesc@npm:^1.3.0":
-  version: 1.3.0
-  resolution: "jsesc@npm:1.3.0"
-  bin:
-    jsesc: bin/jsesc
-  checksum: 9384cc72bf8ef7f2eb75fea64176b8b0c1c5e77604854c72cb4670b7072e112e3baaa69ef134be98cb078834a7812b0bfe676ad441ccd749a59427f5ed2127f1
+"jsbn@npm:1.1.0":
+  version: 1.1.0
+  resolution: "jsbn@npm:1.1.0"
+  checksum: 944f924f2bd67ad533b3850eee47603eed0f6ae425fd1ee8c760f477e8c34a05f144c1bd4f5a5dd1963141dc79a2c55f89ccc5ab77d039e7077f3ad196b64965
   languageName: node
   linkType: hard
 
-"jsesc@npm:^2.5.1":
-  version: 2.5.2
-  resolution: "jsesc@npm:2.5.2"
-  bin:
-    jsesc: bin/jsesc
-  checksum: 4dc190771129e12023f729ce20e1e0bfceac84d73a85bc3119f7f938843fe25a4aeccb54b6494dce26fcf263d815f5f31acdefac7cc9329efb8422a4f4d9fa9d
+"jsdoc-api@npm:^8.1.1":
+  version: 8.1.1
+  resolution: "jsdoc-api@npm:8.1.1"
+  dependencies:
+    array-back: ^6.2.2
+    cache-point: ^2.0.0
+    collect-all: ^1.0.4
+    file-set: ^4.0.2
+    fs-then-native: ^2.0.0
+    jsdoc: ^4.0.3
+    object-to-spawn-args: ^2.0.1
+    temp-path: ^1.0.0
+    walk-back: ^5.1.0
+  checksum: 862aff98c438a2ead5693425eabb15262b5af5ddb0b162600491739746193b41e941b48a5dc7577652667fa977354e47471f20c466f5e86e729fcb0fb15d376d
   languageName: node
   linkType: hard
 
-"jsesc@npm:~0.3.x":
-  version: 0.3.0
-  resolution: "jsesc@npm:0.3.0"
-  bin:
-    jsesc: bin/jsesc
-  checksum: a5222fb2a599e874461ca384b59ecdc6449d52b6dd9d6ce0e878917e49ac6eb304e549cd69cb80bcf710d65aba130b31c795d1f1cd59f490d78e93d743bb6a4b
+"jsdoc-babel@npm:~0.5.0":
+  version: 0.5.0
+  resolution: "jsdoc-babel@npm:0.5.0"
+  dependencies:
+    jsdoc-regex: ^1.0.1
+    lodash: ^4.17.10
+  peerDependencies:
+    "@babel/core": ^7.0.0
+  checksum: 8a379ec19c76f02c27343b9adfed547ecbffc2d1d46b43f92071c4dfa11c8101bbfc5c69fcb7694648cef4ef4bc86eeb0f838c4bbf9ccd5c802a27dfd3bf5a4e
   languageName: node
   linkType: hard
 
-"jsesc@npm:~0.5.0":
-  version: 0.5.0
-  resolution: "jsesc@npm:0.5.0"
-  bin:
-    jsesc: bin/jsesc
-  checksum: b8b44cbfc92f198ad972fba706ee6a1dfa7485321ee8c0b25f5cedd538dcb20cde3197de16a7265430fce8277a12db066219369e3d51055038946039f6e20e17
+"jsdoc-parse@npm:^6.2.1":
+  version: 6.2.4
+  resolution: "jsdoc-parse@npm:6.2.4"
+  dependencies:
+    array-back: ^6.2.2
+    find-replace: ^5.0.1
+    lodash.omit: ^4.5.0
+    sort-array: ^5.0.0
+  checksum: ddc45c25468eff1ffe47a8295d8195f55007c254bc6a4a74de33aad21ec6e72bcd5a4c6f40f8f9d991005b6f55a82179d008694a70b4edceb31473cc5247b867
   languageName: node
   linkType: hard
 
-"json-parse-better-errors@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "json-parse-better-errors@npm:1.0.2"
-  checksum: ff2b5ba2a70e88fd97a3cb28c1840144c5ce8fae9cbeeddba15afa333a5c407cf0e42300cd0a2885dbb055227fe68d405070faad941beeffbfde9cf3b2c78c5d
+"jsdoc-regex@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "jsdoc-regex@npm:1.0.1"
+  checksum: ec85b19905857364a23369ab7ee1528878dfb41f285552fc8f70b628729cd3a8b56c57ac4b30c784df04543edba0ccbe2dcce37d70a501ffbdbff06b5a365710
   languageName: node
   linkType: hard
 
-"json-parse-even-better-errors@npm:^2.3.0, json-parse-even-better-errors@npm:^2.3.1":
-  version: 2.3.1
-  resolution: "json-parse-even-better-errors@npm:2.3.1"
-  checksum: 798ed4cf3354a2d9ccd78e86d2169515a0097a5c133337807cdf7f1fc32e1391d207ccfc276518cc1d7d8d4db93288b8a50ba4293d212ad1336e52a8ec0a941f
+"jsdoc-to-markdown@npm:~8.0.3":
+  version: 8.0.3
+  resolution: "jsdoc-to-markdown@npm:8.0.3"
+  dependencies:
+    array-back: ^6.2.2
+    command-line-tool: ^0.8.0
+    config-master: ^3.1.0
+    dmd: ^6.2.3
+    jsdoc-api: ^8.1.1
+    jsdoc-parse: ^6.2.1
+    walk-back: ^5.1.0
+  bin:
+    jsdoc2md: bin/cli.js
+  checksum: df3e130b69a53878f514df0a25f0a6f1871817d8024e2f3721aac0ff551b8fb5d08621d78dafcaf2e303a539758cced33222597fe32d688e5f0361ce903c640f
   languageName: node
   linkType: hard
 
-"json-schema-traverse@npm:^0.4.1":
-  version: 0.4.1
-  resolution: "json-schema-traverse@npm:0.4.1"
-  checksum: 7486074d3ba247769fda17d5181b345c9fb7d12e0da98b22d1d71a5db9698d8b4bd900a3ec1a4ffdd60846fc2556274a5c894d0c48795f14cb03aeae7b55260b
+"jsdoc@npm:^4.0.3":
+  version: 4.0.4
+  resolution: "jsdoc@npm:4.0.4"
+  dependencies:
+    "@babel/parser": ^7.20.15
+    "@jsdoc/salty": ^0.2.1
+    "@types/markdown-it": ^14.1.1
+    bluebird: ^3.7.2
+    catharsis: ^0.9.0
+    escape-string-regexp: ^2.0.0
+    js2xmlparser: ^4.0.2
+    klaw: ^3.0.0
+    markdown-it: ^14.1.0
+    markdown-it-anchor: ^8.6.7
+    marked: ^4.0.10
+    mkdirp: ^1.0.4
+    requizzle: ^0.2.3
+    strip-json-comments: ^3.1.0
+    underscore: ~1.13.2
+  bin:
+    jsdoc: ./jsdoc.js
+  checksum: f4372a15a262ffd5abfe71315bbf9ad0fd3dd633ca04298702c0b0d3bacd615a35e9f11877bd7aa4e1bb04adb731a55fb15c3e14e69a8e740e86c45548ad39b6
   languageName: node
   linkType: hard
 
-"json-schema-traverse@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "json-schema-traverse@npm:1.0.0"
-  checksum: 02f2f466cdb0362558b2f1fd5e15cce82ef55d60cd7f8fa828cf35ba74330f8d767fcae5c5c2adb7851fa811766c694b9405810879bc4e1ddd78a7c0e03658ad
+"jsesc@npm:^3.0.2":
+  version: 3.1.0
+  resolution: "jsesc@npm:3.1.0"
+  bin:
+    jsesc: bin/jsesc
+  checksum: 19c94095ea026725540c0d29da33ab03144f6bcf2d4159e4833d534976e99e0c09c38cefa9a575279a51fc36b31166f8d6d05c9fe2645d5f15851d690b41f17f
   languageName: node
   linkType: hard
 
-"json-schema@npm:0.2.3":
-  version: 0.2.3
-  resolution: "json-schema@npm:0.2.3"
-  checksum: bbc2070988fb5f2a2266a31b956f1b5660e03ea7eaa95b33402901274f625feb586ae0c485e1df854fde40a7f0dc679f3b3ca8e5b8d31f8ea07a0d834de785c7
+"jsesc@npm:~3.0.2":
+  version: 3.0.2
+  resolution: "jsesc@npm:3.0.2"
+  bin:
+    jsesc: bin/jsesc
+  checksum: a36d3ca40574a974d9c2063bf68c2b6141c20da8f2a36bd3279fc802563f35f0527a6c828801295bdfb2803952cf2cf387786c2c90ed564f88d5782475abfe3c
   languageName: node
   linkType: hard
 
-"json-stable-stringify-without-jsonify@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "json-stable-stringify-without-jsonify@npm:1.0.1"
-  checksum: cff44156ddce9c67c44386ad5cddf91925fe06b1d217f2da9c4910d01f358c6e3989c4d5a02683c7a5667f9727ff05831f7aa8ae66c8ff691c556f0884d49215
+"json-buffer@npm:3.0.1":
+  version: 3.0.1
+  resolution: "json-buffer@npm:3.0.1"
+  checksum: 9026b03edc2847eefa2e37646c579300a1f3a4586cfb62bf857832b60c852042d0d6ae55d1afb8926163fa54c2b01d83ae24705f34990348bdac6273a29d4581
   languageName: node
   linkType: hard
 
-"json-stable-stringify@npm:^1.0.0, json-stable-stringify@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "json-stable-stringify@npm:1.0.1"
-  dependencies:
-    jsonify: ~0.0.0
-  checksum: 65d6cbf0fca72a4136999f65f4401cf39a129f7aeff0fdd987ac3d3423a2113659294045fb8377e6e20d865cac32b1b8d70f3d87346c9786adcee60661d96ca5
+"json-parse-even-better-errors@npm:^2.3.0, json-parse-even-better-errors@npm:^2.3.1":
+  version: 2.3.1
+  resolution: "json-parse-even-better-errors@npm:2.3.1"
+  checksum: 798ed4cf3354a2d9ccd78e86d2169515a0097a5c133337807cdf7f1fc32e1391d207ccfc276518cc1d7d8d4db93288b8a50ba4293d212ad1336e52a8ec0a941f
   languageName: node
   linkType: hard
 
-"json-stringify-safe@npm:~5.0.1":
-  version: 5.0.1
-  resolution: "json-stringify-safe@npm:5.0.1"
-  checksum: 48ec0adad5280b8a96bb93f4563aa1667fd7a36334f79149abd42446d0989f2ddc58274b479f4819f1f00617957e6344c886c55d05a4e15ebb4ab931e4a6a8ee
+"json-schema-traverse@npm:^0.4.1":
+  version: 0.4.1
+  resolution: "json-schema-traverse@npm:0.4.1"
+  checksum: 7486074d3ba247769fda17d5181b345c9fb7d12e0da98b22d1d71a5db9698d8b4bd900a3ec1a4ffdd60846fc2556274a5c894d0c48795f14cb03aeae7b55260b
   languageName: node
   linkType: hard
 
-"json5@npm:^0.5.1":
-  version: 0.5.1
-  resolution: "json5@npm:0.5.1"
-  bin:
-    json5: lib/cli.js
-  checksum: 9b85bf06955b23eaa4b7328aa8892e3887e81ca731dd27af04a5f5f1458fbc5e1de57a24442e3272f8a888dd1abe1cb68eb693324035f6b3aeba4fcab7667d62
+"json-schema-traverse@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "json-schema-traverse@npm:1.0.0"
+  checksum: 02f2f466cdb0362558b2f1fd5e15cce82ef55d60cd7f8fa828cf35ba74330f8d767fcae5c5c2adb7851fa811766c694b9405810879bc4e1ddd78a7c0e03658ad
   languageName: node
   linkType: hard
 
-"json5@npm:^1.0.1":
+"json-stable-stringify-without-jsonify@npm:^1.0.1":
   version: 1.0.1
-  resolution: "json5@npm:1.0.1"
-  dependencies:
-    minimist: ^1.2.0
-  bin:
-    json5: lib/cli.js
-  checksum: e76ea23dbb8fc1348c143da628134a98adf4c5a4e8ea2adaa74a80c455fc2cdf0e2e13e6398ef819bfe92306b610ebb2002668ed9fc1af386d593691ef346fc3
+  resolution: "json-stable-stringify-without-jsonify@npm:1.0.1"
+  checksum: cff44156ddce9c67c44386ad5cddf91925fe06b1d217f2da9c4910d01f358c6e3989c4d5a02683c7a5667f9727ff05831f7aa8ae66c8ff691c556f0884d49215
   languageName: node
   linkType: hard
 
-"json5@npm:^2.1.1, json5@npm:^2.2.2, json5@npm:^2.2.3":
-  version: 2.2.3
-  resolution: "json5@npm:2.2.3"
-  bin:
-    json5: lib/cli.js
-  checksum: 2a7436a93393830bce797d4626275152e37e877b265e94ca69c99e3d20c2b9dab021279146a39cdb700e71b2dd32a4cebd1514cd57cee102b1af906ce5040349
+"json-stable-stringify@npm:^1.0.0, json-stable-stringify@npm:^1.0.1":
+  version: 1.3.0
+  resolution: "json-stable-stringify@npm:1.3.0"
+  dependencies:
+    call-bind: ^1.0.8
+    call-bound: ^1.0.4
+    isarray: ^2.0.5
+    jsonify: ^0.0.1
+    object-keys: ^1.1.1
+  checksum: aaa8b56b7dbee2234adc5e318cf71e38ecd7b8a3811a420a77add8c870d281f7f5050008e2964a7ced4857f501f4667f3ac88b44bf70197bd0682e068a4d93ea
   languageName: node
   linkType: hard
 
-"json5@npm:^2.1.2":
-  version: 2.2.0
-  resolution: "json5@npm:2.2.0"
+"json-to-ast@npm:2.1.0":
+  version: 2.1.0
+  resolution: "json-to-ast@npm:2.1.0"
   dependencies:
-    minimist: ^1.2.5
-  bin:
-    json5: lib/cli.js
-  checksum: e88fc5274bb58fc99547baa777886b069d2dd96d9cfc4490b305fd16d711dabd5979e35a4f90873cefbeb552e216b041a304fe56702bedba76e19bc7845f208d
+    code-error-fragment: 0.0.230
+    grapheme-splitter: ^1.0.4
+  checksum: 1e9b051505b218573b39f3fec9054d75772413aefc2fee3e763d9033276664faa7eec26b945a71f70b9ce29685b2f13259df7dd3243e15eacf4672c62d5ba7ce
   languageName: node
   linkType: hard
 
-"json5@npm:^2.2.1":
-  version: 2.2.1
-  resolution: "json5@npm:2.2.1"
+"json5@npm:1.0.2":
+  version: 1.0.2
+  resolution: "json5@npm:1.0.2"
+  dependencies:
+    minimist: ^1.2.0
   bin:
     json5: lib/cli.js
-  checksum: 74b8a23b102a6f2bf2d224797ae553a75488b5adbaee9c9b6e5ab8b510a2fc6e38f876d4c77dea672d4014a44b2399e15f2051ac2b37b87f74c0c7602003543b
+  checksum: 866458a8c58a95a49bef3adba929c625e82532bcff1fe93f01d29cb02cac7c3fe1f4b79951b7792c2da9de0b32871a8401a6e3c5b36778ad852bf5b8a61165d7
   languageName: node
   linkType: hard
 
-"jsondiffpatch@npm:^0.4.1":
-  version: 0.4.1
-  resolution: "jsondiffpatch@npm:0.4.1"
+"jsondiffpatch@npm:0.7.3":
+  version: 0.7.3
+  resolution: "jsondiffpatch@npm:0.7.3"
   dependencies:
-    chalk: ^2.3.0
-    diff-match-patch: ^1.0.0
+    "@dmsnell/diff-match-patch": ^1.1.0
   bin:
-    jsondiffpatch: ./bin/jsondiffpatch
-  checksum: 2062d188cc7f60f9d84e7bf497a7d89233d2f8ec21d085c26cdb24c2b7c5f4f7231ad9b978355e319c00820de0863499ba881c6c6b1bd92313db1a7d16d6ab1d
+    jsondiffpatch: bin/jsondiffpatch.js
+  checksum: ec00f40f957bf3827995d53804fb29f040e91565b46752d5212fd17462e17b8a08865df85ed5fc2f01b3b6e194d23a95d278b948078406152e77eb79157500a9
   languageName: node
   linkType: hard
 
@@ -20392,14 +12870,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jsonify@npm:~0.0.0":
-  version: 0.0.0
-  resolution: "jsonify@npm:0.0.0"
-  checksum: d8d4ed476c116e6987a460dcb82f22284686caae9f498ac87b0502c1765ac1522f4f450a4cad4cc368d202fd3b27a3860735140a82867fc6d558f5f199c38bce
+"jsonify@npm:^0.0.1":
+  version: 0.0.1
+  resolution: "jsonify@npm:0.0.1"
+  checksum: 027287e1c0294fce15f18c0ff990cfc2318e7f01fb76515f784d5cd0784abfec6fc5c2355c3a2f2cb0ad7f4aa2f5b74ebbfe4e80476c35b2d13cabdb572e1134
   languageName: node
   linkType: hard
 
-"jsonlint@npm:^1.6.3":
+"jsonlint@npm:~1.6.3":
   version: 1.6.3
   resolution: "jsonlint@npm:1.6.3"
   dependencies:
@@ -20411,26 +12889,25 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jsprim@npm:^1.2.2":
-  version: 1.4.1
-  resolution: "jsprim@npm:1.4.1"
+"keyv@npm:^4.5.3":
+  version: 4.5.4
+  resolution: "keyv@npm:4.5.4"
   dependencies:
-    assert-plus: 1.0.0
-    extsprintf: 1.3.0
-    json-schema: 0.2.3
-    verror: 1.10.0
-  checksum: 6bcb20ec265ae18bb48e540a6da2c65f9c844f7522712d6dfcb01039527a49414816f4869000493363f1e1ea96cbad00e46188d5ecc78257a19f152467587373
+    json-buffer: 3.0.1
+  checksum: 74a24395b1c34bd44ad5cb2b49140d087553e170625240b86755a6604cd65aa16efdbdeae5cdb17ba1284a0fbb25ad06263755dbc71b8d8b06f74232ce3cdd72
   languageName: node
   linkType: hard
 
-"just-extend@npm:^4.0.2":
-  version: 4.2.1
-  resolution: "just-extend@npm:4.2.1"
-  checksum: ff9fdede240fad313efeeeb68a660b942e5586d99c0058064c78884894a2690dc09bba44c994ad4e077e45d913fef01a9240c14a72c657b53687ac58de53b39c
+"keyv@npm:^5.3.3":
+  version: 5.3.3
+  resolution: "keyv@npm:5.3.3"
+  dependencies:
+    "@keyv/serialize": ^1.0.3
+  checksum: f73fbca241a071cf3dac52d32935c99a76ea2995442dded71d31ae9ac65907b5ff0d8ca63b201df25474d28433e402e5f2440159bd1f985f8a0055c259b6e536
   languageName: node
   linkType: hard
 
-"kind-of@npm:^6.0.3":
+"kind-of@npm:6.0.3":
   version: 6.0.3
   resolution: "kind-of@npm:6.0.3"
   checksum: 3ab01e7b1d440b22fe4c31f23d8d38b4d9b91d9f291df683476576493d5dfd2e03848a8b05813dd0c3f0e835bc63f433007ddeceb71f05cb25c45ae1b19c6d3b
@@ -20449,26 +12926,35 @@ __metadata:
   languageName: node
   linkType: hard
 
-"known-css-properties@npm:^0.27.0":
-  version: 0.27.0
-  resolution: "known-css-properties@npm:0.27.0"
-  checksum: 8584fcf0526f984fe5a358af20200dec3b944373dd005dc23a3ce988895e1acd03e7d69c49533dda07d6d9b6d53990ed1119bd9d3e927f17545f8764c434a5cd
+"klaw@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "klaw@npm:3.0.0"
+  dependencies:
+    graceful-fs: ^4.1.9
+  checksum: 1bf9de22392c80d28de8a2babd6f0de29fa52fcdc1654838fd35174b3641c168ec32b8b03022191e3c190efd535c31fce23f85e29cb260245571da7263ef418e
+  languageName: node
+  linkType: hard
+
+"known-css-properties@npm:^0.36.0":
+  version: 0.36.0
+  resolution: "known-css-properties@npm:0.36.0"
+  checksum: 2b231ae0ef90a9825f3798a585077c6948c119e091df8900ae07f52e5928122835ac1ad0b50629fe1e2357a608b17428181d5c63d02a623ffe84de5204f5f4fa
   languageName: node
   linkType: hard
 
 "language-subtag-registry@npm:^0.3.20":
-  version: 0.3.22
-  resolution: "language-subtag-registry@npm:0.3.22"
-  checksum: 8ab70a7e0e055fe977ac16ea4c261faec7205ac43db5e806f72e5b59606939a3b972c4bd1e10e323b35d6ffa97c3e1c4c99f6553069dad2dfdd22020fa3eb56a
+  version: 0.3.23
+  resolution: "language-subtag-registry@npm:0.3.23"
+  checksum: 0b64c1a6c5431c8df648a6d25594ff280613c886f4a1a542d9b864e5472fb93e5c7856b9c41595c38fac31370328fc79fcc521712e89ea6d6866cbb8e0995d81
   languageName: node
   linkType: hard
 
 "language-tags@npm:^1.0.8":
-  version: 1.0.8
-  resolution: "language-tags@npm:1.0.8"
+  version: 1.0.9
+  resolution: "language-tags@npm:1.0.9"
   dependencies:
     language-subtag-registry: ^0.3.20
-  checksum: 95d200a4c23ae58ec1c2224e264162ca95e71b3a1104a9cf9d2fd39ab807fa766b37827905a44c84763accc8223aedccebd4cd7807c16876cbe2af769e7a487b
+  checksum: 57c530796dc7179914dee71bc94f3747fd694612480241d0453a063777265dfe3a951037f7acb48f456bf167d6eb419d4c00263745326b3ba1cdcf4657070e78
   languageName: node
   linkType: hard
 
@@ -20481,17 +12967,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"leek@npm:0.0.24":
-  version: 0.0.24
-  resolution: "leek@npm:0.0.24"
-  dependencies:
-    debug: ^2.1.0
-    lodash.assign: ^3.2.0
-    rsvp: ^3.0.21
-  checksum: da2c554c7ea37c6e5ef680ce1940f7be2c2eef5661dc7f74e1bc86ac65136525fdb11e1d1f8f5c582ea8b9e4c8a31ba61d82e1192495a8f91bf1ca702b8d19f2
-  languageName: node
-  linkType: hard
-
 "levn@npm:^0.4.1":
   version: 0.4.1
   resolution: "levn@npm:0.4.1"
@@ -20502,13 +12977,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"levn@npm:~0.3.0":
-  version: 0.3.0
-  resolution: "levn@npm:0.3.0"
-  dependencies:
-    prelude-ls: ~1.1.2
-    type-check: ~0.3.2
-  checksum: 0d084a524231a8246bb10fec48cdbb35282099f6954838604f3c7fc66f2e16fa66fd9cc2f3f20a541a113c4dafdf181e822c887c8a319c9195444e6c64ac395e
+"lilconfig@npm:^3.1.3":
+  version: 3.1.3
+  resolution: "lilconfig@npm:3.1.3"
+  checksum: 644eb10830350f9cdc88610f71a921f510574ed02424b57b0b3abb66ea725d7a082559552524a842f4e0272c196b88dfe1ff7d35ffcc6f45736777185cd67c9a
   languageName: node
   linkType: hard
 
@@ -20523,9 +12995,9 @@ __metadata:
   linkType: hard
 
 "lines-and-columns@npm:^1.1.6":
-  version: 1.1.6
-  resolution: "lines-and-columns@npm:1.1.6"
-  checksum: 198a5436b1fa5cf703bae719c01c686b076f0ad7e1aafd95a58d626cabff302dc0414822126f2f80b58a8c3d66cda8a7b6da064f27130f87e1d3506d6dfd0d68
+  version: 1.2.4
+  resolution: "lines-and-columns@npm:1.2.4"
+  checksum: 0c37f9f7fa212b38912b7145e1cd16a5f3cd34d782441c3e6ca653485d326f58b3caccda66efce1c5812bde4961bbde3374fae4b0d11bf1226152337f3894aa5
   languageName: node
   linkType: hard
 
@@ -20538,61 +13010,53 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lint-staged@npm:^10.5.1":
-  version: 10.5.4
-  resolution: "lint-staged@npm:10.5.4"
+"linkify-it@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "linkify-it@npm:5.0.0"
   dependencies:
-    chalk: ^4.1.0
-    cli-truncate: ^2.1.0
-    commander: ^6.2.0
-    cosmiconfig: ^7.0.0
-    debug: ^4.2.0
-    dedent: ^0.7.0
-    enquirer: ^2.3.6
-    execa: ^4.1.0
-    listr2: ^3.2.2
-    log-symbols: ^4.0.0
-    micromatch: ^4.0.2
-    normalize-path: ^3.0.0
-    please-upgrade-node: ^3.2.0
-    string-argv: 0.3.1
-    stringify-object: ^3.3.0
-  bin:
-    lint-staged: bin/lint-staged.js
-  checksum: 4cc65f6c0a22dc091d0bbdfa6c15cd6e9b7d0d1e7603f5441bf9ac62f3a760fa36b0bda2db4c31b4084f28ba47cd4d0a176c3c3b314a97de8326e050d20b1635
+    uc.micro: ^2.0.0
+  checksum: b0b86cadaf816b64c947a83994ceaad1c15f9fe7e079776ab88699fb71afd7b8fc3fd3d0ae5ebec8c92c1d347be9ba257b8aef338c0ebf81b0d27dcf429a765a
   languageName: node
   linkType: hard
 
-"listr2@npm:^3.2.2":
-  version: 3.8.2
-  resolution: "listr2@npm:3.8.2"
+"lint-staged@npm:~16.0.0":
+  version: 16.0.0
+  resolution: "lint-staged@npm:16.0.0"
   dependencies:
-    chalk: ^4.1.1
-    cli-truncate: ^2.1.0
-    figures: ^3.2.0
-    indent-string: ^4.0.0
-    log-update: ^4.0.0
-    p-map: ^4.0.0
-    rxjs: ^6.6.7
-    through: ^2.3.8
-    wrap-ansi: ^7.0.0
-  peerDependencies:
-    enquirer: ">= 2.3.0 < 3"
-  checksum: f0930780daf525015fb6e0568c69b36e23a1b5c74c00b802ed911e2d9b2eacc6fb9f498e90669b1a0f51c987fab5dfe7d95f5bbddddf5f3d9d42d99d373ea700
+    chalk: ^5.4.1
+    commander: ^13.1.0
+    debug: ^4.4.0
+    lilconfig: ^3.1.3
+    listr2: ^8.3.3
+    micromatch: ^4.0.8
+    nano-spawn: ^1.0.0
+    pidtree: ^0.6.0
+    string-argv: ^0.3.2
+    yaml: ^2.7.1
+  bin:
+    lint-staged: bin/lint-staged.js
+  checksum: f57d710dac15179c013a6df457286cb60c4c6094a20f23aa0e3021acf8d9e612469131f415ea1a3f5a25cad5875a2e540eab068f788344d6b33c127a4457b02d
   languageName: node
   linkType: hard
 
-"livereload-js@npm:^3.3.1":
-  version: 3.3.2
-  resolution: "livereload-js@npm:3.3.2"
-  checksum: 72121395b54f338f0aaf33542a062b7ecfd886f472cb8acb174635011bf29ccc689e5861427431c115d445239498dbbcd070a37c0c8b9561606ebc90c579afbd
+"listr2@npm:^8.3.3":
+  version: 8.3.3
+  resolution: "listr2@npm:8.3.3"
+  dependencies:
+    cli-truncate: ^4.0.0
+    colorette: ^2.0.20
+    eventemitter3: ^5.0.1
+    log-update: ^6.1.0
+    rfdc: ^1.4.1
+    wrap-ansi: ^9.0.0
+  checksum: 77588101773677903205674e1fcfa880fda7aee64aec7797f03cbf638f3acdb6c91ca21496e938a2f29a71645aa838caee60b913d6c901d364af308d61f9bfff
   languageName: node
   linkType: hard
 
-"loader-runner@npm:^2.4.0":
-  version: 2.4.0
-  resolution: "loader-runner@npm:2.4.0"
-  checksum: e27eebbca5347a03f6b1d1bce5b2736a4984fb742f872c0a4d68e62de10f7637613e79a464d3bcd77c246d9c70fcac112bb4a3123010eb527e8b203a614647db
+"livereload-js@npm:^3.3.1":
+  version: 3.4.1
+  resolution: "livereload-js@npm:3.4.1"
+  checksum: 31a432b6ea7aafb445e2ec1f5d4c2db9ea20ff47816fdcb36e238b13798b11e9b2e731e5f10993a566b5bc6e5fb595f39000a6939d3d2d0baf1c16f4933cf8cf
   languageName: node
   linkType: hard
 
@@ -20603,42 +13067,24 @@ __metadata:
   languageName: node
   linkType: hard
 
-"loader-utils@npm:^1.2.3, loader-utils@npm:^1.4.0":
-  version: 1.4.0
-  resolution: "loader-utils@npm:1.4.0"
-  dependencies:
-    big.js: ^5.2.2
-    emojis-list: ^3.0.0
-    json5: ^1.0.1
-  checksum: d150b15e7a42ac47d935c8b484b79e44ff6ab4c75df7cc4cb9093350cf014ec0b17bdb60c5d6f91a37b8b218bd63b973e263c65944f58ca2573e402b9a27e717
-  languageName: node
-  linkType: hard
-
-"loader-utils@npm:^2.0.0":
-  version: 2.0.2
-  resolution: "loader-utils@npm:2.0.2"
+"loader-utils@npm:^2.0.0, loader-utils@npm:^2.0.4":
+  version: 2.0.4
+  resolution: "loader-utils@npm:2.0.4"
   dependencies:
     big.js: ^5.2.2
     emojis-list: ^3.0.0
     json5: ^2.1.2
-  checksum: 9078d1ed47cadc57f4c6ddbdb2add324ee7da544cea41de3b7f1128e8108fcd41cd3443a85b7ee8d7d8ac439148aa221922774efe4cf87506d4fb054d5889303
+  checksum: a5281f5fff1eaa310ad5e1164095689443630f3411e927f95031ab4fb83b4a98f388185bb1fe949e8ab8d4247004336a625e9255c22122b815bb9a4c5d8fc3b7
   languageName: node
   linkType: hard
 
-"loader.js@npm:^4.7.0":
+"loader.js@npm:~4.7.0":
   version: 4.7.0
   resolution: "loader.js@npm:4.7.0"
   checksum: 947412e7665e47ed1fefcd5c07b8fbcfd9991ccc4f39aa3ad631fc0be301c4410f57a2ed762e710450643210072fbbb54ea00128f9c449d76ee79fe5b8481ec6
   languageName: node
   linkType: hard
 
-"locate-character@npm:^2.0.5":
-  version: 2.0.5
-  resolution: "locate-character@npm:2.0.5"
-  checksum: dbc4c62bb98ba95626d5533c6d45d480b2536bb500d1453efdd19d0797e75ba92abf8d0432966990a1567a3b591b0fa6067f0ce93808cbf8b55beedd7bd28a78
-  languageName: node
-  linkType: hard
-
 "locate-path@npm:^2.0.0":
   version: 2.0.0
   resolution: "locate-path@npm:2.0.0"
@@ -20677,36 +13123,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"locate-path@npm:^7.1.0":
-  version: 7.1.0
-  resolution: "locate-path@npm:7.1.0"
+"locate-path@npm:^7.2.0":
+  version: 7.2.0
+  resolution: "locate-path@npm:7.2.0"
   dependencies:
     p-locate: ^6.0.0
-  checksum: 17d5eb6c04ff31856f8a6ae4ee3e3091d41485657428d1a91bd5f66aa1fcd7a90db3de6e8ffb905c2ff1a0014b77509b98dd6410424505efc08b1726d50bcbfc
-  languageName: node
-  linkType: hard
-
-"lodash-es@npm:^4.17.11":
-  version: 4.17.21
-  resolution: "lodash-es@npm:4.17.21"
-  checksum: 05cbffad6e2adbb331a4e16fbd826e7faee403a1a04873b82b42c0f22090f280839f85b95393f487c1303c8a3d2a010048bf06151a6cbe03eee4d388fb0a12d2
-  languageName: node
-  linkType: hard
-
-"lodash._baseassign@npm:^3.0.0":
-  version: 3.2.0
-  resolution: "lodash._baseassign@npm:3.2.0"
-  dependencies:
-    lodash._basecopy: ^3.0.0
-    lodash.keys: ^3.0.0
-  checksum: 27155048736d02dc384f97af303ba66bb5f768aedd5191dddf25acbd13a0733c530d4258df2136440fce7e28c8240561ecd94e769ce4cbb0115dbfd9ab5c4203
-  languageName: node
-  linkType: hard
-
-"lodash._basecopy@npm:^3.0.0":
-  version: 3.0.1
-  resolution: "lodash._basecopy@npm:3.0.1"
-  checksum: 4ccbeef09f53cb1a0cdf1cafeaea2d445ec2184337e1389eb3b81649a3e30f33c377d79027fbce06dae199a6f8ffb4fbd32f1ce07bddbdfae14f51f8340ae68c
+  checksum: c1b653bdf29beaecb3d307dfb7c44d98a2a98a02ebe353c9ad055d1ac45d6ed4e1142563d222df9b9efebc2bcb7d4c792b507fad9e7150a04c29530b7db570f8
   languageName: node
   linkType: hard
 
@@ -20720,24 +13142,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash._bindcallback@npm:^3.0.0":
-  version: 3.0.1
-  resolution: "lodash._bindcallback@npm:3.0.1"
-  checksum: 3916fd72bc02de3643a52d46cf5aaeab4c0b21cd7cb2fb801a8bf9dacdc8532e89b30a4ebafdf65da5fe09d8b0bf898a7416402704fd7262a976703e1c59e549
-  languageName: node
-  linkType: hard
-
-"lodash._createassigner@npm:^3.0.0":
-  version: 3.1.1
-  resolution: "lodash._createassigner@npm:3.1.1"
-  dependencies:
-    lodash._bindcallback: ^3.0.0
-    lodash._isiterateecall: ^3.0.0
-    lodash.restparam: ^3.0.0
-  checksum: ca9e08350914c279560b8930a3f7aa065b061a7e2b0bf13b33af1f782be8b5356f623ce01e89248212cc6099b1bc6c39e03ed9ffc9e0c2fd7169b1b7c447c01e
-  languageName: node
-  linkType: hard
-
 "lodash._getnative@npm:^3.0.0":
   version: 3.9.1
   resolution: "lodash._getnative@npm:3.9.1"
@@ -20752,38 +13156,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash._reinterpolate@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "lodash._reinterpolate@npm:3.0.0"
-  checksum: 06d2d5f33169604fa5e9f27b6067ed9fb85d51a84202a656901e5ffb63b426781a601508466f039c720af111b0c685d12f1a5c14ff8df5d5f27e491e562784b2
-  languageName: node
-  linkType: hard
-
-"lodash.assign@npm:^3.2.0":
-  version: 3.2.0
-  resolution: "lodash.assign@npm:3.2.0"
-  dependencies:
-    lodash._baseassign: ^3.0.0
-    lodash._createassigner: ^3.0.0
-    lodash.keys: ^3.0.0
-  checksum: 135351c0e376e2963ec785d4ad4efce55cd7f1d5e3d34387e940c1de6c5f92d6f91d3e415218bc37657f34aae823bc9ecf2fb38bd4734dc69f7d659582cc4178
-  languageName: node
-  linkType: hard
-
-"lodash.assign@npm:^4.2.0":
-  version: 4.2.0
-  resolution: "lodash.assign@npm:4.2.0"
-  checksum: 75bbc6733c9f577c448031b4051f990f068802708891f94be9d4c2faffd6a9ec67a2c49671dafc908a068d35687765464853282842b4560b662e6c903d11cc90
-  languageName: node
-  linkType: hard
-
-"lodash.assignin@npm:^4.1.0":
-  version: 4.2.0
-  resolution: "lodash.assignin@npm:4.2.0"
-  checksum: 4b55bc1d65ccd7648fdba8a4316d10546929bf0beb5950830d86c559948cf170f0e65b77c95e66b45b511b85a31161714de8b2008d2537627ef3c7759afe36a6
-  languageName: node
-  linkType: hard
-
 "lodash.camelcase@npm:^4.1.1, lodash.camelcase@npm:^4.3.0":
   version: 4.3.0
   resolution: "lodash.camelcase@npm:4.3.0"
@@ -20791,27 +13163,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash.castarray@npm:^4.4.0":
-  version: 4.4.0
-  resolution: "lodash.castarray@npm:4.4.0"
-  checksum: fca8c7047e0ae2738b0b2503fb00157ae0ff6d8a1b716f87ed715b22560e09de438c75b65e01a7e44ceb41c5b31dce2eb576e46db04beb9c699c498e03cbd00f
-  languageName: node
-  linkType: hard
-
-"lodash.clonedeep@npm:^4.4.1, lodash.clonedeep@npm:^4.5.0":
-  version: 4.5.0
-  resolution: "lodash.clonedeep@npm:4.5.0"
-  checksum: 92c46f094b064e876a23c97f57f81fbffd5d760bf2d8a1c61d85db6d1e488c66b0384c943abee4f6af7debf5ad4e4282e74ff83177c9e63d8ff081a4837c3489
-  languageName: node
-  linkType: hard
-
-"lodash.compact@npm:^3.0.1":
-  version: 3.0.1
-  resolution: "lodash.compact@npm:3.0.1"
-  checksum: 75039eddfa5ef2ea0da1fc3d36515e92227241f94258b3dcf771196e741c878698ce5b79c0cb7fe758841c9dfd0e6fa222888985aadc0384fd79bbc9680dd829
-  languageName: node
-  linkType: hard
-
 "lodash.debounce@npm:^3.1.1":
   version: 3.1.1
   resolution: "lodash.debounce@npm:3.1.1"
@@ -20835,13 +13186,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash.find@npm:^4.5.1, lodash.find@npm:^4.6.0":
-  version: 4.6.0
-  resolution: "lodash.find@npm:4.6.0"
-  checksum: b737f849a4fe36f5c3664ea636780dda2fde18335021faf80cdfdcb300ed75441da6f55cfd6de119092d8bb2ddbc4433f4a8de4b99c0b9c8640465b0901c717c
-  languageName: node
-  linkType: hard
-
 "lodash.flatten@npm:^3.0.2":
   version: 3.0.2
   resolution: "lodash.flatten@npm:3.0.2"
@@ -20852,27 +13196,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash.flatten@npm:^4.4.0":
-  version: 4.4.0
-  resolution: "lodash.flatten@npm:4.4.0"
-  checksum: 0ac34a393d4b795d4b7421153d27c13ae67e08786c9cbb60ff5b732210d46f833598eee3fb3844bb10070e8488efe390ea53bb567377e0cb47e9e630bf0811cb
-  languageName: node
-  linkType: hard
-
-"lodash.foreach@npm:^4.5.0":
-  version: 4.5.0
-  resolution: "lodash.foreach@npm:4.5.0"
-  checksum: a940386b158ca0d62994db41fc16529eb8ae67138f29ced38e91f912cb5435d1b0ed34b18e6f7b9ddfc32ab676afc6dfec60d1e22633d8e3e4b33413402ab4ad
-  languageName: node
-  linkType: hard
-
-"lodash.forin@npm:^4.4.0":
-  version: 4.4.0
-  resolution: "lodash.forin@npm:4.4.0"
-  checksum: c9c8e6c3204029fe0610efb8c74113b00a3d5a92b1d8defbf3f5cbc2d0f7663c680dff62e2950ed9406bb6d06e882fa39568c607bc44229d53fd93a9fd6c07b7
-  languageName: node
-  linkType: hard
-
 "lodash.get@npm:^4.4.2":
   version: 4.4.2
   resolution: "lodash.get@npm:4.4.2"
@@ -20880,20 +13203,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash.has@npm:^4.5.2":
-  version: 4.5.2
-  resolution: "lodash.has@npm:4.5.2"
-  checksum: b3ec829a86852331d48b3730ff06088a283d128a3965aa521ffd942bcf5c82e06bed3164ff7a7751d11e768d88f0d7bab316192091489caf20f452d42f7055d5
-  languageName: node
-  linkType: hard
-
-"lodash.invokemap@npm:^4.6.0":
-  version: 4.6.0
-  resolution: "lodash.invokemap@npm:4.6.0"
-  checksum: 646ceebbefbcb6da301f8c2868254680fd0bcdc6ada470495d9ae49c9c32938829c1b38a38c95d0258409a9655f85db404b16e648381c7450b7ed3d9c52d8808
-  languageName: node
-  linkType: hard
-
 "lodash.isarguments@npm:^3.0.0":
   version: 3.1.0
   resolution: "lodash.isarguments@npm:3.1.0"
@@ -20908,38 +13217,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash.isempty@npm:^4.4.0":
-  version: 4.4.0
-  resolution: "lodash.isempty@npm:4.4.0"
-  checksum: a8118f23f7ed72a1dbd176bf27f297d1e71aa1926288449cb8f7cef99ba1bc7527eab52fe7899ab080fa1dc150aba6e4a6367bf49fa4e0b78da1ecc095f8d8c5
-  languageName: node
-  linkType: hard
-
-"lodash.isequal@npm:^4.5.0":
-  version: 4.5.0
-  resolution: "lodash.isequal@npm:4.5.0"
-  checksum: da27515dc5230eb1140ba65ff8de3613649620e8656b19a6270afe4866b7bd461d9ba2ac8a48dcc57f7adac4ee80e1de9f965d89d4d81a0ad52bb3eec2609644
-  languageName: node
-  linkType: hard
-
-"lodash.isfunction@npm:^3.0.9":
-  version: 3.0.9
-  resolution: "lodash.isfunction@npm:3.0.9"
-  checksum: 99e54c34b1e8a9ba75c034deb39cedbd2aca7af685815e67a2a8ec4f73ec9748cda6ebee5a07d7de4b938e90d421fd280e9c385cc190f903ac217ac8aff30314
-  languageName: node
-  linkType: hard
-
-"lodash.isinteger@npm:^4.0.4":
-  version: 4.0.4
-  resolution: "lodash.isinteger@npm:4.0.4"
-  checksum: 6034821b3fc61a2ffc34e7d5644bb50c5fd8f1c0121c554c21ac271911ee0c0502274852845005f8651d51e199ee2e0cfebfe40aaa49c7fe617f603a8a0b1691
-  languageName: node
-  linkType: hard
-
-"lodash.isplainobject@npm:^4.0.6":
-  version: 4.0.6
-  resolution: "lodash.isplainobject@npm:4.0.6"
-  checksum: 29c6351f281e0d9a1d58f1a4c8f4400924b4c79f18dfc4613624d7d54784df07efaff97c1ff2659f3e085ecf4fff493300adc4837553104cef2634110b0d5337
+"lodash.iteratee@npm:^4.7.0":
+  version: 4.7.0
+  resolution: "lodash.iteratee@npm:4.7.0"
+  checksum: 900e8f9c2f37361aa50f880139e92a00a5c1a000a45c78f00f64f83591090ccd9644800d6869fc563ef47907d9914ec19e871433d7be8e272b7b0516b44910d7
   languageName: node
   linkType: hard
 
@@ -20950,39 +13231,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash.keys@npm:^3.0.0":
-  version: 3.1.2
-  resolution: "lodash.keys@npm:3.1.2"
-  dependencies:
-    lodash._getnative: ^3.0.0
-    lodash.isarguments: ^3.0.0
-    lodash.isarray: ^3.0.0
-  checksum: ac7c02c793334c48161a8e8a1f12576c73ee50d1371e75680afc6c2d3740d5e9bdc899517e6c0034014eaa2512c5f433a2e6985c9e16cf28b5c9013ec81bd35e
-  languageName: node
-  linkType: hard
-
-"lodash.lowerfirst@npm:^4.3.1":
-  version: 4.3.1
-  resolution: "lodash.lowerfirst@npm:4.3.1"
-  checksum: e1688e18873777d394db4994d150dfc14cf01bf450169cf8296af4d84ecd7c3c4ae4dab3746f77f8719a093e4fff58bee3ae73ae7e23ef508b7d970b189d9952
-  languageName: node
-  linkType: hard
-
-"lodash.map@npm:^4.6.0":
-  version: 4.6.0
-  resolution: "lodash.map@npm:4.6.0"
-  checksum: 7369a41d7d24d15ce3bbd02a7faa3a90f6266c38184e64932571b9b21b758bd10c04ffd117d1859be1a44156f29b94df5045eff172bf8a97fddf68bf1002d12f
-  languageName: node
-  linkType: hard
-
-"lodash.mapvalues@npm:^4.6.0":
-  version: 4.6.0
-  resolution: "lodash.mapvalues@npm:4.6.0"
-  checksum: 0ff1b252fda318fc36e47c296984925e98fbb0fc5a2ecc4ef458f3c739a9476d47e40c95ac653e8314d132aa59c746d4276527b99d6e271940555c6e12d2babd
-  languageName: node
-  linkType: hard
-
-"lodash.memoize@npm:4.1.2, lodash.memoize@npm:^4.1.2":
+"lodash.memoize@npm:^4.1.2":
   version: 4.1.2
   resolution: "lodash.memoize@npm:4.1.2"
   checksum: 9ff3942feeccffa4f1fafa88d32f0d24fdc62fd15ded5a74a5f950ff5f0c6f61916157246744c620173dddf38d37095a92327d5fd3861e2063e736a5c207d089
@@ -20996,50 +13245,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash.omit@npm:^4.1.0":
+"lodash.omit@npm:^4.1.0, lodash.omit@npm:^4.5.0":
   version: 4.5.0
   resolution: "lodash.omit@npm:4.5.0"
   checksum: 434645e49fe84ab315719bd5a9a3a585a0f624aa4160bc09157dd041a414bcc287c15840365c1379476a3f3eda41fbe838976c3f7bdecbbf4c5478e86c471a30
   languageName: node
   linkType: hard
 
-"lodash.pick@npm:^4.4.0":
-  version: 4.4.0
-  resolution: "lodash.pick@npm:4.4.0"
-  checksum: 2c36cab7da6b999a20bd3373b40e31a3ef81fa264f34a6979c852c5bc8ac039379686b27380f0cb8e3781610844fafec6949c6fbbebc059c98f8fa8570e3675f
-  languageName: node
-  linkType: hard
-
-"lodash.restparam@npm:^3.0.0":
-  version: 3.6.1
-  resolution: "lodash.restparam@npm:3.6.1"
-  checksum: 8bda0c7aaeac93da2b7e856bfeec8e6fdefb4d7eadfe6fd84775312a729fc1cb985636d922fe33b49f41aba135204962f4b853d7946105b7704102edb2bf6082
-  languageName: node
-  linkType: hard
-
-"lodash.snakecase@npm:^4.1.1":
-  version: 4.1.1
-  resolution: "lodash.snakecase@npm:4.1.1"
-  checksum: 1685ed3e83dda6eae5a4dcaee161a51cd210aabb3e1c09c57150e7dd8feda19e4ca0d27d0631eabe8d0f4eaa51e376da64e8c018ae5415417c5890d42feb72a8
-  languageName: node
-  linkType: hard
-
-"lodash.template@npm:^4.4.0, lodash.template@npm:^4.5.0":
-  version: 4.5.0
-  resolution: "lodash.template@npm:4.5.0"
-  dependencies:
-    lodash._reinterpolate: ^3.0.0
-    lodash.templatesettings: ^4.0.0
-  checksum: ca64e5f07b6646c9d3dbc0fe3aaa995cb227c4918abd1cef7a9024cd9c924f2fa389a0ec4296aa6634667e029bc81d4bbdb8efbfde11df76d66085e6c529b450
-  languageName: node
-  linkType: hard
-
-"lodash.templatesettings@npm:^4.0.0":
-  version: 4.2.0
-  resolution: "lodash.templatesettings@npm:4.2.0"
-  dependencies:
-    lodash._reinterpolate: ^3.0.0
-  checksum: 863e025478b092997e11a04e9d9e735875eeff1ffcd6c61742aa8272e3c2cddc89ce795eb9726c4e74cef5991f722897ff37df7738a125895f23fc7d12a7bb59
+"lodash.padend@npm:^4.6.1":
+  version: 4.6.1
+  resolution: "lodash.padend@npm:4.6.1"
+  checksum: c2e6e789debf83b98f5c085305cdcfff1067e7a31bda2a110fd765d3c11a99edfbeef570d9ef737ab3212006bdb8114e77622e518c18c1fce52b8fdfd9dab685
   languageName: node
   linkType: hard
 
@@ -21050,28 +13266,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash.uniq@npm:^4.2.0, lodash.uniq@npm:^4.5.0":
+"lodash.uniq@npm:^4.2.0":
   version: 4.5.0
   resolution: "lodash.uniq@npm:4.5.0"
   checksum: a4779b57a8d0f3c441af13d9afe7ecff22dd1b8ce1129849f71d9bbc8e8ee4e46dfb4b7c28f7ad3d67481edd6e51126e4e2a6ee276e25906d10f7140187c392d
   languageName: node
   linkType: hard
 
-"lodash.uniqby@npm:^4.7.0":
-  version: 4.7.0
-  resolution: "lodash.uniqby@npm:4.7.0"
-  checksum: 659264545a95726d1493123345aad8cbf56e17810fa9a0b029852c6d42bc80517696af09d99b23bef1845d10d95e01b8b4a1da578f22aeba7a30d3e0022a4938
-  languageName: node
-  linkType: hard
-
-"lodash.values@npm:^4.3.0":
-  version: 4.3.0
-  resolution: "lodash.values@npm:4.3.0"
-  checksum: 857e122ddf6edb50137887f0b834d471f96d66692ebb5de8b048ed277c8a3dd1bc8f85d82cf31b0f5c6dbc5b72c036a591205f76eec86bb11818a1a6f7e5a28c
-  languageName: node
-  linkType: hard
-
-"lodash@npm:^4.0.0, lodash@npm:^4.17.10, lodash@npm:^4.17.11, lodash@npm:^4.17.12, lodash@npm:^4.17.14, lodash@npm:^4.17.15, lodash@npm:^4.17.19, lodash@npm:^4.17.21, lodash@npm:^4.17.4, lodash@npm:^4.5.1, lodash@npm:^4.7.0":
+"lodash@npm:^4.0.0, lodash@npm:^4.17.10, lodash@npm:^4.17.11, lodash@npm:^4.17.12, lodash@npm:^4.17.14, lodash@npm:^4.17.15, lodash@npm:^4.17.19, lodash@npm:^4.17.21":
   version: 4.17.21
   resolution: "lodash@npm:4.17.21"
   checksum: eb835a2e51d381e561e508ce932ea50a8e5a68f4ebdd771ea240d3048244a8d13658acbd502cd4829768c56f2e16bdd4340b9ea141297d472517b83868e677f7
@@ -21087,7 +13289,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"log-symbols@npm:^4.0.0, log-symbols@npm:^4.1.0":
+"log-symbols@npm:^4.1.0":
   version: 4.1.0
   resolution: "log-symbols@npm:4.1.0"
   dependencies:
@@ -21097,15 +13299,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"log-update@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "log-update@npm:4.0.0"
+"log-update@npm:^6.1.0":
+  version: 6.1.0
+  resolution: "log-update@npm:6.1.0"
   dependencies:
-    ansi-escapes: ^4.3.0
-    cli-cursor: ^3.1.0
-    slice-ansi: ^4.0.0
-    wrap-ansi: ^6.2.0
-  checksum: ae2f85bbabc1906034154fb7d4c4477c79b3e703d22d78adee8b3862fa913942772e7fa11713e3d96fb46de4e3cabefbf5d0a544344f03b58d3c4bff52aa9eb2
+    ansi-escapes: ^7.0.0
+    cli-cursor: ^5.0.0
+    slice-ansi: ^7.1.0
+    strip-ansi: ^7.1.0
+    wrap-ansi: ^9.0.0
+  checksum: 817a9ba6c5cbc19e94d6359418df8cfe8b3244a2903f6d53354e175e243a85b782dc6a98db8b5e457ee2f09542ca8916c39641b9cd3b0e6ef45e9481d50c918a
   languageName: node
   linkType: hard
 
@@ -21120,25 +13323,9 @@ __metadata:
   linkType: hard
 
 "loglevel@npm:^1.4.1":
-  version: 1.7.1
-  resolution: "loglevel@npm:1.7.1"
-  checksum: 715a4ae69ad75d4d3bd04e4f6e9edbc4cae4db34d1e7f54f426d8cebe2dd9fef891ca3789e839d927cdbc5fad73d789e998db0af2f11f4c40219c272bc923823
-  languageName: node
-  linkType: hard
-
-"lolex@npm:^4.2.0":
-  version: 4.2.0
-  resolution: "lolex@npm:4.2.0"
-  checksum: 0a83bfe1748fc745515dff9b3f722422918f5f6975104d7e576fc32c06b5398ee0c58525684068d4de49cdd49874e00b5e2b2d72ce8c5d829dab86c8c08ca31f
-  languageName: node
-  linkType: hard
-
-"lolex@npm:^5.0.1":
-  version: 5.1.2
-  resolution: "lolex@npm:5.1.2"
-  dependencies:
-    "@sinonjs/commons": ^1.7.0
-  checksum: 7eb468d4ef4746c024d23cb2b75f679f79449a9d5cbe11abadf2f3b147c1d7ffe28816438bedfb8a75c58357a625c2f9ba197b050c226d2b3f0c4a956cf556fb
+  version: 1.9.2
+  resolution: "loglevel@npm:1.9.2"
+  checksum: 896c67b90a507bfcfc1e9a4daa7bf789a441dd70d95cd13b998d6dd46233a3bfadfb8fadb07250432bbfb53bf61e95f2520f9b11f9d3175cc460e5c251eca0af
   languageName: node
   linkType: hard
 
@@ -21149,17 +13336,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"loose-envify@npm:^1.0.0":
-  version: 1.4.0
-  resolution: "loose-envify@npm:1.4.0"
-  dependencies:
-    js-tokens: ^3.0.0 || ^4.0.0
-  bin:
-    loose-envify: cli.js
-  checksum: 6517e24e0cad87ec9888f500c5b5947032cdfe6ef65e1c1936a0c48a524b81e65542c9c3edc91c97d5bddc806ee2a985dbc79be89215d613b1de5db6d1cfe6f4
-  languageName: node
-  linkType: hard
-
 "lower-case@npm:^2.0.2":
   version: 2.0.2
   resolution: "lower-case@npm:2.0.2"
@@ -21169,6 +13345,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lru-cache@npm:^10.0.1, lru-cache@npm:^10.2.0":
+  version: 10.4.3
+  resolution: "lru-cache@npm:10.4.3"
+  checksum: 6476138d2125387a6d20f100608c2583d415a4f64a0fecf30c9e2dda976614f09cad4baa0842447bd37dd459a7bd27f57d9d8f8ce558805abd487c583f3d774a
+  languageName: node
+  linkType: hard
+
 "lru-cache@npm:^5.1.1":
   version: 5.1.1
   resolution: "lru-cache@npm:5.1.1"
@@ -21187,48 +13370,39 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lru-cache@npm:^7.5.1, lru-cache@npm:^7.7.1":
+"lru-cache@npm:^7.5.1":
   version: 7.18.3
   resolution: "lru-cache@npm:7.18.3"
   checksum: e550d772384709deea3f141af34b6d4fa392e2e418c1498c078de0ee63670f1f46f5eee746e8ef7e69e1c895af0d4224e62ee33e66a543a14763b0f2e74c1356
   languageName: node
   linkType: hard
 
-"lru-cache@npm:^9.1.1 || ^10.0.0":
-  version: 10.1.0
-  resolution: "lru-cache@npm:10.1.0"
-  checksum: 58056d33e2500fbedce92f8c542e7c11b50d7d086578f14b7074d8c241422004af0718e08a6eaae8705cee09c77e39a61c1c79e9370ba689b7010c152e6a76ab
-  languageName: node
-  linkType: hard
-
-"magic-string@npm:^0.24.0":
-  version: 0.24.1
-  resolution: "magic-string@npm:0.24.1"
-  dependencies:
-    sourcemap-codec: ^1.4.1
-  checksum: 335a4992a75b5869acf054216acf430bc587986500c495cb2f0d42d47364c7677c5a2db5a8465fac380ce5e87d33225e7f2e1cd8f586e7e5ceaf34d366650606
+"luxon@npm:^3.4.2":
+  version: 3.7.1
+  resolution: "luxon@npm:3.7.1"
+  checksum: 19e5b20304f2e558b1e5e1f4f04f227419642d373f7c10ccf8f0e7d63c05828187a6aa39d70caf87d18a4834800dcbf29cf5f5d81d03c7d2471cd0b61cee97f6
   languageName: node
   linkType: hard
 
 "magic-string@npm:^0.25.2, magic-string@npm:^0.25.7":
-  version: 0.25.7
-  resolution: "magic-string@npm:0.25.7"
+  version: 0.25.9
+  resolution: "magic-string@npm:0.25.9"
   dependencies:
-    sourcemap-codec: ^1.4.4
-  checksum: 727a1fb70f9610304fe384f1df0251eb7d1d9dd779c07ef1225690361b71b216f26f5d934bfb11c919b5b0e7ba50f6240c823a6f2e44cfd33d4a07d7747ca829
+    sourcemap-codec: ^1.4.8
+  checksum: 9a0e55a15c7303fc360f9572a71cffba1f61451bc92c5602b1206c9d17f492403bf96f946dfce7483e66822d6b74607262e24392e87b0ac27b786e69a40e9b1a
   languageName: node
   linkType: hard
 
 "magic-string@npm:^0.30.0":
-  version: 0.30.0
-  resolution: "magic-string@npm:0.30.0"
+  version: 0.30.17
+  resolution: "magic-string@npm:0.30.17"
   dependencies:
-    "@jridgewell/sourcemap-codec": ^1.4.13
-  checksum: 7bdf22e27334d8a393858a16f5f840af63a7c05848c000fd714da5aa5eefa09a1bc01d8469362f25cc5c4a14ec01b46557b7fff8751365522acddf21e57c488d
+    "@jridgewell/sourcemap-codec": ^1.5.0
+  checksum: f4b4ed17c5ada64f77fc98491847302ebad64894a905c417c943840c0384662118c9b37f9f68bb86add159fa4749ff6f118c4627d69a470121b46731f8debc6d
   languageName: node
   linkType: hard
 
-"make-dir@npm:^2.0.0":
+"make-dir@npm:^2.1.0":
   version: 2.1.0
   resolution: "make-dir@npm:2.1.0"
   dependencies:
@@ -21247,34 +13421,29 @@ __metadata:
   languageName: node
   linkType: hard
 
-"make-fetch-happen@npm:^10.0.3":
-  version: 10.2.1
-  resolution: "make-fetch-happen@npm:10.2.1"
+"make-fetch-happen@npm:^14.0.3":
+  version: 14.0.3
+  resolution: "make-fetch-happen@npm:14.0.3"
   dependencies:
-    agentkeepalive: ^4.2.1
-    cacache: ^16.1.0
-    http-cache-semantics: ^4.1.0
-    http-proxy-agent: ^5.0.0
-    https-proxy-agent: ^5.0.0
-    is-lambda: ^1.0.1
-    lru-cache: ^7.7.1
-    minipass: ^3.1.6
-    minipass-collect: ^1.0.2
-    minipass-fetch: ^2.0.3
+    "@npmcli/agent": ^3.0.0
+    cacache: ^19.0.1
+    http-cache-semantics: ^4.1.1
+    minipass: ^7.0.2
+    minipass-fetch: ^4.0.0
     minipass-flush: ^1.0.5
     minipass-pipeline: ^1.2.4
-    negotiator: ^0.6.3
+    negotiator: ^1.0.0
+    proc-log: ^5.0.0
     promise-retry: ^2.0.1
-    socks-proxy-agent: ^7.0.0
-    ssri: ^9.0.0
-  checksum: 2332eb9a8ec96f1ffeeea56ccefabcb4193693597b132cd110734d50f2928842e22b84cfa1508e921b8385cdfd06dda9ad68645fed62b50fff629a580f5fb72c
+    ssri: ^12.0.0
+  checksum: 6fb2fee6da3d98f1953b03d315826b5c5a4ea1f908481afc113782d8027e19f080c85ae998454de4e5f27a681d3ec58d57278f0868d4e0b736f51d396b661691
   languageName: node
   linkType: hard
 
 "make-plural@npm:^7.0.0":
-  version: 7.1.0
-  resolution: "make-plural@npm:7.1.0"
-  checksum: d0ef253e508c8cdbddcc37288d25e0944eb2bf800008bf178a1c37b101c3202d89609ddb577a10515bd2499c7665159594704682cc9c159cc20491da6b7ac09e
+  version: 7.4.0
+  resolution: "make-plural@npm:7.4.0"
+  checksum: f2e58b6efd3e099ebc076d6c6b60854740886006a7af9cfcb1d4478409efbdd41f6ae14921b8eef4f1cbc0702ff7a29f159199d7ac0831784d0bbfcfded39558
   languageName: node
   linkType: hard
 
@@ -21296,20 +13465,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"map-cache@npm:^0.2.2":
-  version: 0.2.2
-  resolution: "map-cache@npm:0.2.2"
-  checksum: 3067cea54285c43848bb4539f978a15dedc63c03022abeec6ef05c8cb6829f920f13b94bcaf04142fc6a088318e564c4785704072910d120d55dbc2e0c421969
-  languageName: node
-  linkType: hard
-
-"map-obj@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "map-obj@npm:1.0.1"
-  checksum: 9949e7baec2a336e63b8d4dc71018c117c3ce6e39d2451ccbfd3b8350c547c4f6af331a4cbe1c83193d7c6b786082b6256bde843db90cb7da2a21e8fcc28afed
-  languageName: node
-  linkType: hard
-
 "map-obj@npm:^4.1.0":
   version: 4.3.0
   resolution: "map-obj@npm:4.3.0"
@@ -21317,12 +13472,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"map-visit@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "map-visit@npm:1.0.0"
-  dependencies:
-    object-visit: ^1.0.0
-  checksum: c27045a5021c344fc19b9132eb30313e441863b2951029f8f8b66f79d3d8c1e7e5091578075a996f74e417479506fe9ede28c44ca7bc351a61c9d8073daec36a
+"markdown-it-anchor@npm:^8.6.7":
+  version: 8.6.7
+  resolution: "markdown-it-anchor@npm:8.6.7"
+  peerDependencies:
+    "@types/markdown-it": "*"
+    markdown-it: "*"
+  checksum: 828236768ac7f61ed5591393c1b1bfc5dbf2b6d0c58a3deec606c61dddaa12658a34450cbef37ab50a04453e618ce1efd47d86e4e52595024334898fd306225b
   languageName: node
   linkType: hard
 
@@ -21341,8 +13497,8 @@ __metadata:
   linkType: hard
 
 "markdown-it@npm:^13.0.1":
-  version: 13.0.1
-  resolution: "markdown-it@npm:13.0.1"
+  version: 13.0.2
+  resolution: "markdown-it@npm:13.0.2"
   dependencies:
     argparse: ^2.0.1
     entities: ~3.0.1
@@ -21351,7 +13507,23 @@ __metadata:
     uc.micro: ^1.0.5
   bin:
     markdown-it: bin/markdown-it.js
-  checksum: faf5891d389dc433bcf21d3fbff2009beb044b42b117c92f4848899780ca1a2282a209e3ff4672db4afed726a7248304ec473e6e242a7d6498af7113d31974e7
+  checksum: bb4bf2cb3e5d77a7f3dc9cf48e17d050fbcd26d37992204eaa5812220752858fe9debe439b2ae1de06e749a3bba537c0baf6ce7510307cf7163a70f04fafe672
+  languageName: node
+  linkType: hard
+
+"markdown-it@npm:^14.1.0":
+  version: 14.1.0
+  resolution: "markdown-it@npm:14.1.0"
+  dependencies:
+    argparse: ^2.0.1
+    entities: ^4.4.0
+    linkify-it: ^5.0.0
+    mdurl: ^2.0.0
+    punycode.js: ^2.3.1
+    uc.micro: ^2.1.0
+  bin:
+    markdown-it: bin/markdown-it.mjs
+  checksum: 07296b45ebd0b13a55611a24d1b1ad002c6729ec54f558f597846994b0b7b1de79d13cd99ff3e7b6e9e027f36b63125cdcf69174da294ecabdd4e6b9fff39e5d
   languageName: node
   linkType: hard
 
@@ -21364,6 +13536,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"marked@npm:^4.0.10, marked@npm:^4.3.0":
+  version: 4.3.0
+  resolution: "marked@npm:4.3.0"
+  bin:
+    marked: bin/marked.js
+  checksum: 0db6817893952c3ec710eb9ceafb8468bf5ae38cb0f92b7b083baa13d70b19774674be04db5b817681fa7c5c6a088f61300815e4dd75a59696f4716ad69f6260
+  languageName: node
+  linkType: hard
+
 "matcher-collection@npm:^1.0.0, matcher-collection@npm:^1.0.4, matcher-collection@npm:^1.1.1":
   version: 1.1.2
   resolution: "matcher-collection@npm:1.1.2"
@@ -21383,6 +13564,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"math-intrinsics@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "math-intrinsics@npm:1.1.0"
+  checksum: 0e513b29d120f478c85a70f49da0b8b19bc638975eca466f2eeae0071f3ad00454c621bf66e16dd435896c208e719fc91ad79bbfba4e400fe0b372e7c1c9c9a2
+  languageName: node
+  linkType: hard
+
 "mathml-tag-names@npm:^2.1.3":
   version: 2.1.3
   resolution: "mathml-tag-names@npm:2.1.3"
@@ -21390,14 +13578,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"md5.js@npm:^1.3.4":
-  version: 1.3.5
-  resolution: "md5.js@npm:1.3.5"
+"mdast-normalize-headings@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "mdast-normalize-headings@npm:2.0.0"
   dependencies:
-    hash-base: ^3.0.0
-    inherits: ^2.0.1
-    safe-buffer: ^5.1.2
-  checksum: 098494d885684bcc4f92294b18ba61b7bd353c23147fbc4688c75b45cb8590f5a95fd4584d742415dcc52487f7a1ef6ea611cfa1543b0dc4492fe026357f3f0c
+    unist-util-visit: ^2.0.0
+  checksum: 04875b3276a889ac8cb224a5890526f3d8a0b6dd3827a92931e9e3460473ef78976ab8553e898f45bb75de7177877ceb74d5eca276b3e97047e229caa0e77b1a
+  languageName: node
+  linkType: hard
+
+"mdast-util-definitions@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "mdast-util-definitions@npm:4.0.0"
+  dependencies:
+    unist-util-visit: ^2.0.0
+  checksum: 2325f20b82b3fb8cb5fda77038ee0bbdd44f82cfca7c48a854724b58bc1fe5919630a3ce7c45e210726df59d46c881d020b2da7a493bfd1ee36eb2bbfef5d78e
   languageName: node
   linkType: hard
 
@@ -21444,7 +13639,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mdast-util-gfm-autolink-literal@npm:^0.1.0":
+"mdast-util-gfm-autolink-literal@npm:^0.1.0, mdast-util-gfm-autolink-literal@npm:^0.1.3":
   version: 0.1.3
   resolution: "mdast-util-gfm-autolink-literal@npm:0.1.3"
   dependencies:
@@ -21496,6 +13691,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"mdast-util-to-hast@npm:^10.2.0":
+  version: 10.2.0
+  resolution: "mdast-util-to-hast@npm:10.2.0"
+  dependencies:
+    "@types/mdast": ^3.0.0
+    "@types/unist": ^2.0.0
+    mdast-util-definitions: ^4.0.0
+    mdurl: ^1.0.0
+    unist-builder: ^2.0.0
+    unist-util-generated: ^1.0.0
+    unist-util-position: ^3.0.0
+    unist-util-visit: ^2.0.0
+  checksum: 72df2dd9bfa2d07b4750a333444f82e0f3752dae75b6e300cf0a716407a185eb75095a54ecad90cbd6f6d133b20dea8844ff76c1ea78612550de170b43d4fa85
+  languageName: node
+  linkType: hard
+
 "mdast-util-to-markdown@npm:^0.6.0, mdast-util-to-markdown@npm:^0.6.1, mdast-util-to-markdown@npm:~0.6.0":
   version: 0.6.5
   resolution: "mdast-util-to-markdown@npm:0.6.5"
@@ -21510,6 +13721,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"mdast-util-to-string@npm:^1.0.0":
+  version: 1.1.0
+  resolution: "mdast-util-to-string@npm:1.1.0"
+  checksum: eec1eb283f3341376c8398b67ce512a11ab3e3191e3dbd5644d32a26784eac8d5f6d0b0fb81193af00d75a2c545cde765c8b03e966bd890076efb5d357fb4fe2
+  languageName: node
+  linkType: hard
+
 "mdast-util-to-string@npm:^2.0.0":
   version: 2.0.0
   resolution: "mdast-util-to-string@npm:2.0.0"
@@ -21517,10 +13735,18 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mdn-data@npm:2.0.27":
-  version: 2.0.27
-  resolution: "mdn-data@npm:2.0.27"
-  checksum: df94012b7b50d5ac7b862dd603c0cd2712c47e5a7b8a1d914054989d6d798320459319dd99d17ba6d0ff39a9fb50b117c9e8bf88a767635849719ff44912614e
+"mdast-util-toc@npm:^5.1.0":
+  version: 5.1.0
+  resolution: "mdast-util-toc@npm:5.1.0"
+  dependencies:
+    "@types/mdast": ^3.0.3
+    "@types/unist": ^2.0.3
+    extend: ^3.0.2
+    github-slugger: ^1.2.1
+    mdast-util-to-string: ^2.0.0
+    unist-util-is: ^4.0.0
+    unist-util-visit: ^2.0.0
+  checksum: dd1019f0f69deaa0985297f63ec97abcf7cc2f90c542bd513aa17055bc3784923bd8e8f5092e8d9e5ea736ffc55b315c25979939a718eca369224e4ade28ce57
   languageName: node
   linkType: hard
 
@@ -21531,27 +13757,27 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mdn-data@npm:2.0.4":
-  version: 2.0.4
-  resolution: "mdn-data@npm:2.0.4"
-  checksum: add3c95e6d03d301b8a8bcfee3de33f4d07e4c5eee5b79f18d6d737de717e22472deadf67c1a8563983c0b603e10d7df40aa8e5fddf18884dfe118ccec7ae329
-  languageName: node
-  linkType: hard
-
-"mdn-data@npm:~1.1.0":
-  version: 1.1.4
-  resolution: "mdn-data@npm:1.1.4"
-  checksum: 146dbea4c8bd68547f6ffec22868f099f82cead2a7a55eb70f80cf1a4958e3504c2d9bf17f3f0675f76f2b5a396b4ef2a5e9998af6c070625e9650771101c139
+"mdn-data@npm:2.12.2":
+  version: 2.12.2
+  resolution: "mdn-data@npm:2.12.2"
+  checksum: 77f38c180292cfbbd41c06641a27940cc293c08f47faa98f80bf64f98bb1b2a804df371e864e31a1ea97bdf181c0b0f85a2d96d1a6261f43c427b32222f33f1f
   languageName: node
   linkType: hard
 
-"mdurl@npm:^1.0.1":
+"mdurl@npm:^1.0.0, mdurl@npm:^1.0.1":
   version: 1.0.1
   resolution: "mdurl@npm:1.0.1"
   checksum: 71731ecba943926bfbf9f9b51e28b5945f9411c4eda80894221b47cc105afa43ba2da820732b436f0798fd3edbbffcd1fc1415843c41a87fea08a41cc1e3d02b
   languageName: node
   linkType: hard
 
+"mdurl@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "mdurl@npm:2.0.0"
+  checksum: 880bc289ef668df0bb34c5b2b5aaa7b6ea755052108cdaf4a5e5968ad01cf27e74927334acc9ebcc50a8628b65272ae6b1fd51fae1330c130e261c0466e1a3b2
+  languageName: node
+  linkType: hard
+
 "media-typer@npm:0.3.0":
   version: 0.3.0
   resolution: "media-typer@npm:0.3.0"
@@ -21570,26 +13796,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"memory-fs@npm:^0.4.1":
-  version: 0.4.1
-  resolution: "memory-fs@npm:0.4.1"
-  dependencies:
-    errno: ^0.1.3
-    readable-stream: ^2.0.1
-  checksum: 6db6c8682eff836664ca9b5b6052ae38d21713dda9d0ef4700fa5c0599a8bc16b2093bee75ac3dedbe59fb2222d368f25bafaa62ba143c41051359cbcb005044
-  languageName: node
-  linkType: hard
-
-"memory-fs@npm:^0.5.0":
-  version: 0.5.0
-  resolution: "memory-fs@npm:0.5.0"
-  dependencies:
-    errno: ^0.1.3
-    readable-stream: ^2.0.1
-  checksum: a9f25b0a8ecfb7324277393f19ef68e6ba53b9e6e4b526bbf2ba23055c5440fbf61acc7bf66bfd980e9eb4951a4790f6f777a9a3abd36603f22c87e8a64d3d6b
-  languageName: node
-  linkType: hard
-
 "memory-streams@npm:^0.1.3":
   version: 0.1.3
   resolution: "memory-streams@npm:0.1.3"
@@ -21599,30 +13805,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"meow@npm:^10.1.5":
-  version: 10.1.5
-  resolution: "meow@npm:10.1.5"
-  dependencies:
-    "@types/minimist": ^1.2.2
-    camelcase-keys: ^7.0.0
-    decamelize: ^5.0.0
-    decamelize-keys: ^1.1.0
-    hard-rejection: ^2.1.0
-    minimist-options: 4.1.0
-    normalize-package-data: ^3.0.2
-    read-pkg-up: ^8.0.0
-    redent: ^4.0.0
-    trim-newlines: ^4.0.2
-    type-fest: ^1.2.2
-    yargs-parser: ^20.2.9
-  checksum: dd5f0caa4af18517813547dc66741dcbf52c4c23def5062578d39b11189fd9457aee5c1f2263a5cd6592a465023df8357e8ac876b685b64dbcf545e3f66c23a7
+"meow@npm:^13.2.0":
+  version: 13.2.0
+  resolution: "meow@npm:13.2.0"
+  checksum: 79c61dc02ad448ff5c29bbaf1ef42181f1eae9947112c0e23db93e84cbc2708ecda53e54bfc6689f1e55255b2cea26840ec76e57a5773a16ca45f4fe2163ec1c
   languageName: node
   linkType: hard
 
-"merge-descriptors@npm:1.0.1":
-  version: 1.0.1
-  resolution: "merge-descriptors@npm:1.0.1"
-  checksum: 5abc259d2ae25bb06d19ce2b94a21632583c74e2a9109ee1ba7fd147aa7362b380d971e0251069f8b3eb7d48c21ac839e21fa177b335e82c76ec172e30c31a26
+"merge-descriptors@npm:1.0.3":
+  version: 1.0.3
+  resolution: "merge-descriptors@npm:1.0.3"
+  checksum: 52117adbe0313d5defa771c9993fe081e2d2df9b840597e966aadafde04ae8d0e3da46bac7ca4efc37d4d2b839436582659cd49c6a43eacb3fe3050896a105d1
   languageName: node
   linkType: hard
 
@@ -21633,20 +13826,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"merge-trees@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "merge-trees@npm:1.0.1"
-  dependencies:
-    can-symlink: ^1.0.0
-    fs-tree-diff: ^0.5.4
-    heimdalljs: ^0.2.1
-    heimdalljs-logger: ^0.1.7
-    rimraf: ^2.4.3
-    symlink-or-copy: ^1.0.0
-  checksum: d32b06a9b18ab6963718c99b38fbe010e91f54a16f6f5555b32d48be0938c7f33ea81b8f0411846c43e6a5cfdbbf9aa2817fccc0186c2aa071944fe76bdc0372
-  languageName: node
-  linkType: hard
-
 "merge-trees@npm:^2.0.0":
   version: 2.0.0
   resolution: "merge-trees@npm:2.0.0"
@@ -21756,70 +13935,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"micromatch@npm:^3.0.4, micromatch@npm:^3.1.10, micromatch@npm:^3.1.4":
-  version: 3.1.10
-  resolution: "micromatch@npm:3.1.10"
-  dependencies:
-    arr-diff: ^4.0.0
-    array-unique: ^0.3.2
-    braces: ^2.3.1
-    define-property: ^2.0.2
-    extend-shallow: ^3.0.2
-    extglob: ^2.0.4
-    fragment-cache: ^0.2.1
-    kind-of: ^6.0.2
-    nanomatch: ^1.2.9
-    object.pick: ^1.3.0
-    regex-not: ^1.0.0
-    snapdragon: ^0.8.1
-    to-regex: ^3.0.2
-  checksum: ad226cba4daa95b4eaf47b2ca331c8d2e038d7b41ae7ed0697cde27f3f1d6142881ab03d4da51b65d9d315eceb5e4cdddb3fbb55f5f72cfa19cf3ea469d054dc
-  languageName: node
-  linkType: hard
-
-"micromatch@npm:^4.0.2, micromatch@npm:^4.0.4":
-  version: 4.0.4
-  resolution: "micromatch@npm:4.0.4"
-  dependencies:
-    braces: ^3.0.1
-    picomatch: ^2.2.3
-  checksum: ef3d1c88e79e0a68b0e94a03137676f3324ac18a908c245a9e5936f838079fcc108ac7170a5fadc265a9c2596963462e402841406bda1a4bb7b68805601d631c
-  languageName: node
-  linkType: hard
-
-"micromatch@npm:^4.0.5":
-  version: 4.0.5
-  resolution: "micromatch@npm:4.0.5"
+"micromatch@npm:4.0.8":
+  version: 4.0.8
+  resolution: "micromatch@npm:4.0.8"
   dependencies:
-    braces: ^3.0.2
+    braces: ^3.0.3
     picomatch: ^2.3.1
-  checksum: 02a17b671c06e8fefeeb6ef996119c1e597c942e632a21ef589154f23898c9c6a9858526246abb14f8bca6e77734aa9dcf65476fca47cedfb80d9577d52843fc
-  languageName: node
-  linkType: hard
-
-"miller-rabin@npm:^4.0.0":
-  version: 4.0.1
-  resolution: "miller-rabin@npm:4.0.1"
-  dependencies:
-    bn.js: ^4.0.0
-    brorand: ^1.0.1
-  bin:
-    miller-rabin: bin/miller-rabin
-  checksum: 00cd1ab838ac49b03f236cc32a14d29d7d28637a53096bf5c6246a032a37749c9bd9ce7360cbf55b41b89b7d649824949ff12bc8eee29ac77c6b38eada619ece
-  languageName: node
-  linkType: hard
-
-"mime-db@npm:1.47.0, mime-db@npm:>= 1.43.0 < 2":
-  version: 1.47.0
-  resolution: "mime-db@npm:1.47.0"
-  checksum: 6808235243c39b3142e677af86972cf32de8ebbec81178491475a79aa07caf67646cd9b559972d22c3c372ddca4a093e58bb0ba10376d75a1efbd0e07be82de2
-  languageName: node
-  linkType: hard
-
-"mime-db@npm:1.51.0":
-  version: 1.51.0
-  resolution: "mime-db@npm:1.51.0"
-  checksum: 613b1ac9d6e725cc24444600b124a7f1ce6c60b1baa654f39a3e260d0995a6dffc5693190217e271af7e2a5612dae19f2a73f3e316707d797a7391165f7ef423
+  checksum: 79920eb634e6f400b464a954fcfa589c4e7c7143209488e44baf627f9affc8b1e306f41f4f0deedde97e69cb725920879462d3e750ab3bd3c1aed675bb3a8966
   languageName: node
   linkType: hard
 
@@ -21830,25 +13952,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mime-types@npm:^2.1.12, mime-types@npm:^2.1.18, mime-types@npm:^2.1.26, mime-types@npm:~2.1.19, mime-types@npm:~2.1.24":
-  version: 2.1.30
-  resolution: "mime-types@npm:2.1.30"
-  dependencies:
-    mime-db: 1.47.0
-  checksum: 53c36729b1c4f6029fd5957d5859e62eff4b86311a6e1dce87937583dc8971fec9f359ffcff4be93d26bb5ddd03f1b5ffc7626912031ce0a63510d7896521b2e
-  languageName: node
-  linkType: hard
-
-"mime-types@npm:^2.1.19":
-  version: 2.1.34
-  resolution: "mime-types@npm:2.1.34"
-  dependencies:
-    mime-db: 1.51.0
-  checksum: 67013de9e9d6799bde6d669d18785b7e18bcd212e710d3e04a4727f92f67a8ad4e74aee24be28b685adb794944814bde649119b58ee3282ffdbee58f9278d9f3
+"mime-db@npm:>= 1.43.0 < 2":
+  version: 1.54.0
+  resolution: "mime-db@npm:1.54.0"
+  checksum: e99aaf2f23f5bd607deb08c83faba5dd25cf2fec90a7cc5b92d8260867ee08dab65312e1a589e60093dc7796d41e5fae013268418482f1db4c7d52d0a0960ac9
   languageName: node
   linkType: hard
 
-"mime-types@npm:^2.1.27, mime-types@npm:~2.1.34":
+"mime-types@npm:^2.1.18, mime-types@npm:^2.1.19, mime-types@npm:^2.1.26, mime-types@npm:^2.1.27, mime-types@npm:~2.1.24, mime-types@npm:~2.1.34":
   version: 2.1.35
   resolution: "mime-types@npm:2.1.35"
   dependencies:
@@ -21887,93 +13998,98 @@ __metadata:
   languageName: node
   linkType: hard
 
-"min-indent@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "min-indent@npm:1.0.1"
-  checksum: bfc6dd03c5eaf623a4963ebd94d087f6f4bbbfd8c41329a7f09706b0cb66969c4ddd336abeb587bc44bc6f08e13bf90f0b374f9d71f9f01e04adc2cd6f083ef1
+"mimic-function@npm:^5.0.0":
+  version: 5.0.1
+  resolution: "mimic-function@npm:5.0.1"
+  checksum: eb5893c99e902ccebbc267c6c6b83092966af84682957f79313311edb95e8bb5f39fb048d77132b700474d1c86d90ccc211e99bae0935447a4834eb4c882982c
   languageName: node
   linkType: hard
 
 "mini-css-extract-plugin@npm:^2.5.2":
-  version: 2.6.0
-  resolution: "mini-css-extract-plugin@npm:2.6.0"
+  version: 2.9.2
+  resolution: "mini-css-extract-plugin@npm:2.9.2"
   dependencies:
     schema-utils: ^4.0.0
+    tapable: ^2.2.1
   peerDependencies:
     webpack: ^5.0.0
-  checksum: ea73bd66558de7a37db094fe68fa130e7a725ab15f880ff8467a75d9c4c2f1576d20720088ea22af9922a94b8600bbfef0c6acaf10d12a32a9bd20a90ba3c35f
+  checksum: 67a1f75359371a7776108999d472ae0942ccd904401e364e3a2c710d4b6fec61c4f53288594fcac35891f009e6df8825a00dfd3bfe4bcec0f862081d1f7cad50
   languageName: node
   linkType: hard
 
-"minimalistic-assert@npm:^1.0.0, minimalistic-assert@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "minimalistic-assert@npm:1.0.1"
-  checksum: cc7974a9268fbf130fb055aff76700d7e2d8be5f761fb5c60318d0ed010d839ab3661a533ad29a5d37653133385204c503bfac995aaa4236f4e847461ea32ba7
+"minimatch@npm:2 || 3, minimatch@npm:^3.0.0, minimatch@npm:^3.0.2, minimatch@npm:^3.0.4, minimatch@npm:^3.0.5, minimatch@npm:^3.1.1, minimatch@npm:^3.1.2":
+  version: 3.1.2
+  resolution: "minimatch@npm:3.1.2"
+  dependencies:
+    brace-expansion: ^1.1.7
+  checksum: c154e566406683e7bcb746e000b84d74465b3a832c45d59912b9b55cd50dee66e5c4b1e5566dba26154040e51672f9aa450a9aef0c97cfc7336b78b7afb9540a
   languageName: node
   linkType: hard
 
-"minimalistic-crypto-utils@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "minimalistic-crypto-utils@npm:1.0.1"
-  checksum: 6e8a0422b30039406efd4c440829ea8f988845db02a3299f372fceba56ffa94994a9c0f2fd70c17f9969eedfbd72f34b5070ead9656a34d3f71c0bd72583a0ed
+"minimatch@npm:^5.0.1":
+  version: 5.1.6
+  resolution: "minimatch@npm:5.1.6"
+  dependencies:
+    brace-expansion: ^2.0.1
+  checksum: 7564208ef81d7065a370f788d337cd80a689e981042cb9a1d0e6580b6c6a8c9279eba80010516e258835a988363f99f54a6f711a315089b8b42694f5da9d0d77
   languageName: node
   linkType: hard
 
-"minimatch@npm:^3.0.2":
-  version: 3.0.4
-  resolution: "minimatch@npm:3.0.4"
+"minimatch@npm:^7.4.3":
+  version: 7.4.6
+  resolution: "minimatch@npm:7.4.6"
   dependencies:
-    brace-expansion: ^1.1.7
-  checksum: 66ac295f8a7b59788000ea3749938b0970344c841750abd96694f80269b926ebcafad3deeb3f1da2522978b119e6ae3a5869b63b13a7859a456b3408bd18a078
+    brace-expansion: ^2.0.1
+  checksum: 1a6c8d22618df9d2a88aabeef1de5622eb7b558e9f8010be791cb6b0fa6e102d39b11c28d75b855a1e377b12edc7db8ff12a99c20353441caa6a05e78deb5da9
   languageName: node
   linkType: hard
 
-"minimist-options@npm:4.1.0":
-  version: 4.1.0
-  resolution: "minimist-options@npm:4.1.0"
+"minimatch@npm:^8.0.2":
+  version: 8.0.4
+  resolution: "minimatch@npm:8.0.4"
   dependencies:
-    arrify: ^1.0.1
-    is-plain-obj: ^1.1.0
-    kind-of: ^6.0.3
-  checksum: 8c040b3068811e79de1140ca2b708d3e203c8003eb9a414c1ab3cd467fc5f17c9ca02a5aef23bedc51a7f8bfbe77f87e9a7e31ec81fba304cda675b019496f4e
+    brace-expansion: ^2.0.1
+  checksum: 2e46cffb86bacbc524ad45a6426f338920c529dd13f3a732cc2cf7618988ee1aae88df4ca28983285aca9e0f45222019ac2d14ebd17c1edadd2ee12221ab801a
   languageName: node
   linkType: hard
 
-"minimist@npm:^0.2.1":
-  version: 0.2.4
-  resolution: "minimist@npm:0.2.4"
-  checksum: 52ab5922f5fd4f2d17410619c5e8c2df79327e7d94a59a9d1e7c567c5ef991c5385f7adb5c090d213fe5701e1fa1b6bb3d89a319e3b1b656b5a17308c87e2513
+"minimatch@npm:^9.0.4":
+  version: 9.0.5
+  resolution: "minimatch@npm:9.0.5"
+  dependencies:
+    brace-expansion: ^2.0.1
+  checksum: 2c035575eda1e50623c731ec6c14f65a85296268f749b9337005210bb2b34e2705f8ef1a358b188f69892286ab99dc42c8fb98a57bde55c8d81b3023c19cea28
   languageName: node
   linkType: hard
 
 "minimist@npm:^1.1.1, minimist@npm:^1.2.0, minimist@npm:^1.2.5, minimist@npm:^1.2.6":
-  version: 1.2.6
-  resolution: "minimist@npm:1.2.6"
-  checksum: d15428cd1e11eb14e1233bcfb88ae07ed7a147de251441d61158619dfb32c4d7e9061d09cab4825fdee18ecd6fce323228c8c47b5ba7cd20af378ca4048fb3fb
+  version: 1.2.8
+  resolution: "minimist@npm:1.2.8"
+  checksum: 75a6d645fb122dad29c06a7597bddea977258957ed88d7a6df59b5cd3fe4a527e253e9bbf2e783e4b73657f9098b96a5fe96ab8a113655d4109108577ecf85b0
   languageName: node
   linkType: hard
 
-"minipass-collect@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "minipass-collect@npm:1.0.2"
+"minipass-collect@npm:^2.0.1":
+  version: 2.0.1
+  resolution: "minipass-collect@npm:2.0.1"
   dependencies:
-    minipass: ^3.0.0
-  checksum: 14df761028f3e47293aee72888f2657695ec66bd7d09cae7ad558da30415fdc4752bbfee66287dcc6fd5e6a2fa3466d6c484dc1cbd986525d9393b9523d97f10
+    minipass: ^7.0.3
+  checksum: b251bceea62090f67a6cced7a446a36f4cd61ee2d5cea9aee7fff79ba8030e416327a1c5aa2908dc22629d06214b46d88fdab8c51ac76bacbf5703851b5ad342
   languageName: node
   linkType: hard
 
-"minipass-fetch@npm:^2.0.3":
-  version: 2.1.2
-  resolution: "minipass-fetch@npm:2.1.2"
+"minipass-fetch@npm:^4.0.0":
+  version: 4.0.1
+  resolution: "minipass-fetch@npm:4.0.1"
   dependencies:
     encoding: ^0.1.13
-    minipass: ^3.1.6
+    minipass: ^7.0.3
     minipass-sized: ^1.0.3
-    minizlib: ^2.1.2
+    minizlib: ^3.0.1
   dependenciesMeta:
     encoding:
       optional: true
-  checksum: 3f216be79164e915fc91210cea1850e488793c740534985da017a4cbc7a5ff50506956d0f73bb0cb60e4fe91be08b6b61ef35101706d3ef5da2c8709b5f08f91
+  checksum: 3dfca705ce887ca9ff14d73e8d8593996dea1a1ecd8101fdbb9c10549d1f9670bc8fb66ad0192769ead4c2dc01b4f9ca1cf567ded365adff17827a303b948140
   languageName: node
   linkType: hard
 
@@ -22014,7 +14130,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minipass@npm:^3.0.0, minipass@npm:^3.1.1, minipass@npm:^3.1.6":
+"minipass@npm:^3.0.0":
   version: 3.3.6
   resolution: "minipass@npm:3.3.6"
   dependencies:
@@ -22023,111 +14139,49 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minipass@npm:^4.0.0, minipass@npm:^4.2.4":
+"minipass@npm:^4.2.4":
   version: 4.2.8
   resolution: "minipass@npm:4.2.8"
   checksum: 7f4914d5295a9a30807cae5227a37a926e6d910c03f315930fde52332cf0575dfbc20295318f91f0baf0e6bb11a6f668e30cde8027dea7a11b9d159867a3c830
   languageName: node
   linkType: hard
 
-"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0":
-  version: 7.0.4
-  resolution: "minipass@npm:7.0.4"
-  checksum: 87585e258b9488caf2e7acea242fd7856bbe9a2c84a7807643513a338d66f368c7d518200ad7b70a508664d408aa000517647b2930c259a8b1f9f0984f344a21
+"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.0.4, minipass@npm:^7.1.2":
+  version: 7.1.2
+  resolution: "minipass@npm:7.1.2"
+  checksum: 2bfd325b95c555f2b4d2814d49325691c7bee937d753814861b0b49d5edcda55cbbf22b6b6a60bb91eddac8668771f03c5ff647dcd9d0f798e9548b9cdc46ee3
   languageName: node
   linkType: hard
 
-"minizlib@npm:^2.1.1, minizlib@npm:^2.1.2":
-  version: 2.1.2
-  resolution: "minizlib@npm:2.1.2"
+"minizlib@npm:^3.0.1":
+  version: 3.0.2
+  resolution: "minizlib@npm:3.0.2"
   dependencies:
-    minipass: ^3.0.0
-    yallist: ^4.0.0
-  checksum: f1fdeac0b07cf8f30fcf12f4b586795b97be856edea22b5e9072707be51fc95d41487faec3f265b42973a304fe3a64acd91a44a3826a963e37b37bafde0212c3
+    minipass: ^7.1.2
+  checksum: 493bed14dcb6118da7f8af356a8947cf1473289c09658e5aabd69a737800a8c3b1736fb7d7931b722268a9c9bc038a6d53c049b6a6af24b34a121823bb709996
   languageName: node
   linkType: hard
 
-"miragejs@npm:^0.1.43":
-  version: 0.1.43
-  resolution: "miragejs@npm:0.1.43"
+"miragejs@npm:~0.1.48":
+  version: 0.1.48
+  resolution: "miragejs@npm:0.1.48"
   dependencies:
     "@miragejs/pretender-node-polyfill": ^0.1.0
     inflected: ^2.0.4
-    lodash.assign: ^4.2.0
-    lodash.camelcase: ^4.3.0
-    lodash.clonedeep: ^4.5.0
-    lodash.compact: ^3.0.1
-    lodash.find: ^4.6.0
-    lodash.flatten: ^4.4.0
-    lodash.forin: ^4.4.0
-    lodash.get: ^4.4.2
-    lodash.has: ^4.5.2
-    lodash.invokemap: ^4.6.0
-    lodash.isempty: ^4.4.0
-    lodash.isequal: ^4.5.0
-    lodash.isfunction: ^3.0.9
-    lodash.isinteger: ^4.0.4
-    lodash.isplainobject: ^4.0.6
-    lodash.lowerfirst: ^4.3.1
-    lodash.map: ^4.6.0
-    lodash.mapvalues: ^4.6.0
-    lodash.pick: ^4.4.0
-    lodash.snakecase: ^4.1.1
-    lodash.uniq: ^4.5.0
-    lodash.uniqby: ^4.7.0
-    lodash.values: ^4.3.0
+    lodash: ^4.0.0
     pretender: ^3.4.7
-  checksum: 11da61a83fc816748f635b4a4792a56a82dc6a0b7f5049c5337864948697b76eec421f3ca459fbbd35d8bb8e373e59bff9a773d20ae700977088a1f29857360d
-  languageName: node
-  linkType: hard
-
-"mississippi@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "mississippi@npm:3.0.0"
-  dependencies:
-    concat-stream: ^1.5.0
-    duplexify: ^3.4.2
-    end-of-stream: ^1.1.0
-    flush-write-stream: ^1.0.0
-    from2: ^2.1.0
-    parallel-transform: ^1.1.0
-    pump: ^3.0.0
-    pumpify: ^1.3.3
-    stream-each: ^1.1.0
-    through2: ^2.0.0
-  checksum: 84b3d9889621d293f9a596bafe60df863b330c88fc19215ced8f603c605fc7e1bf06f8e036edf301bd630a03fd5d9d7d23d5d6b9a4802c30ca864d800f0bd9f8
-  languageName: node
-  linkType: hard
-
-"mixin-deep@npm:^1.2.0":
-  version: 1.3.2
-  resolution: "mixin-deep@npm:1.3.2"
-  dependencies:
-    for-in: ^1.0.2
-    is-extendable: ^1.0.1
-  checksum: 820d5a51fcb7479f2926b97f2c3bb223546bc915e6b3a3eb5d906dda871bba569863595424a76682f2b15718252954644f3891437cb7e3f220949bed54b1750d
-  languageName: node
-  linkType: hard
-
-"mkdirp@npm:^0.3.5":
-  version: 0.3.5
-  resolution: "mkdirp@npm:0.3.5"
-  checksum: 5b7db0f7db199b87f5b0e563b919ad214d1a2c55c3896db332ef1e66c2192b2077112a4733b2c6ff99c833a6f85ba5686f05a768c411fe461b667a17421d37a8
+  checksum: ff8767d077088b2e4ea6ba0aae0fdede34e1dd6e1ea91dbe4a4969a601bc7ce1bde6fa0b2f582cb9d1e8b33ca37e222ef2d711df2ade64d2c7252cae356bab0a
   languageName: node
   linkType: hard
 
-"mkdirp@npm:^0.5.0, mkdirp@npm:^0.5.1, mkdirp@npm:^0.5.3, mkdirp@npm:^0.5.5, mkdirp@npm:~0.5.1":
-  version: 0.5.5
-  resolution: "mkdirp@npm:0.5.5"
-  dependencies:
-    minimist: ^1.2.5
-  bin:
-    mkdirp: bin/cmd.js
-  checksum: 3bce20ea525f9477befe458ab85284b0b66c8dc3812f94155af07c827175948cdd8114852ac6c6d82009b13c1048c37f6d98743eb019651ee25c39acc8aabe7d
+"mkdirp2@npm:^1.0.4":
+  version: 1.0.5
+  resolution: "mkdirp2@npm:1.0.5"
+  checksum: 1fef4e978164e547f49c70d773fec1f2f9f5e52560ffe305e2443da6dad0464f14fe050a90896050700f484d2a0b5d73708305c5dfe4fd57e252f2f3f581053a
   languageName: node
   linkType: hard
 
-"mkdirp@npm:^0.5.6":
+"mkdirp@npm:^0.5.0, mkdirp@npm:^0.5.1, mkdirp@npm:^0.5.5":
   version: 0.5.6
   resolution: "mkdirp@npm:0.5.6"
   dependencies:
@@ -22138,7 +14192,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mkdirp@npm:^1.0.3, mkdirp@npm:^1.0.4":
+"mkdirp@npm:^1.0.4":
   version: 1.0.4
   resolution: "mkdirp@npm:1.0.4"
   bin:
@@ -22147,6 +14201,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"mkdirp@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "mkdirp@npm:3.0.1"
+  bin:
+    mkdirp: dist/cjs/src/bin.js
+  checksum: 972deb188e8fb55547f1e58d66bd6b4a3623bf0c7137802582602d73e6480c1c2268dcbafbfb1be466e00cc7e56ac514d7fd9334b7cf33e3e2ab547c16f83a8d
+  languageName: node
+  linkType: hard
+
 "mktemp@npm:~0.4.0":
   version: 0.4.0
   resolution: "mktemp@npm:0.4.0"
@@ -22174,27 +14237,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mout@npm:^1.0.0":
-  version: 1.2.2
-  resolution: "mout@npm:1.2.2"
-  checksum: e6c4249e9a5e603af8b4ae7172572e266f7cbd2edbf27824e2e06dd288adc66e67170f4a061ecc388429046aa93a7e3946e35139fd0767f76dd10d075fbca74f
-  languageName: node
-  linkType: hard
-
-"move-concurrently@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "move-concurrently@npm:1.0.1"
-  dependencies:
-    aproba: ^1.1.1
-    copy-concurrently: ^1.0.0
-    fs-write-stream-atomic: ^1.0.8
-    mkdirp: ^0.5.1
-    rimraf: ^2.5.4
-    run-queue: ^1.0.3
-  checksum: 4ea3296c150b09e798177847f673eb5783f8ca417ba806668d2c631739f653e1a735f19fb9b6e2f5e25ee2e4c0a6224732237a8e4f84c764e99d7462d258209e
-  languageName: node
-  linkType: hard
-
 "mr-dep-walk@npm:^1.4.0":
   version: 1.4.0
   resolution: "mr-dep-walk@npm:1.4.0"
@@ -22213,21 +14255,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ms@npm:2.1.1":
-  version: 2.1.1
-  resolution: "ms@npm:2.1.1"
-  checksum: 0078a23cd916a9a7435c413caa14c57d4b4f6e2470e0ab554b6964163c8a4436448ac7ae020e883685475da6b6796cc396b670f579cb275db288a21e3e57721e
-  languageName: node
-  linkType: hard
-
-"ms@npm:2.1.2":
-  version: 2.1.2
-  resolution: "ms@npm:2.1.2"
-  checksum: 673cdb2c3133eb050c745908d8ce632ed2c02d85640e2edb3ace856a2266a813b30c613569bf3354fdf4ea7d1a1494add3bfa95e2713baa27d0c2c71fc44f58f
-  languageName: node
-  linkType: hard
-
-"ms@npm:2.1.3, ms@npm:^2.0.0, ms@npm:^2.1.1":
+"ms@npm:2.1.3, ms@npm:^2.1.1, ms@npm:^2.1.3":
   version: 2.1.3
   resolution: "ms@npm:2.1.3"
   checksum: aa92de608021b242401676e35cfa5aa42dd70cbdc082b916da7fb925c542173e36bce97ea3e804923fe92c0ad991434e4a38327e15a1b5b5f945d66df615ae6d
@@ -22257,49 +14285,26 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nan@npm:^2.12.1":
-  version: 2.14.2
-  resolution: "nan@npm:2.14.2"
-  dependencies:
-    node-gyp: latest
-  checksum: 7a269139b66a7d37470effb7fb36a8de8cc3b5ffba6e40bb8e0545307911fe5ebf94797ec62f655ecde79c237d169899f8bd28256c66a32cbc8284faaf94c3f4
+"mute-stream@npm:1.0.0":
+  version: 1.0.0
+  resolution: "mute-stream@npm:1.0.0"
+  checksum: 36fc968b0e9c9c63029d4f9dc63911950a3bdf55c9a87f58d3a266289b67180201cade911e7699f8b2fa596b34c9db43dad37649e3f7fdd13c3bb9edb0017ee7
   languageName: node
   linkType: hard
 
-"nanoid@npm:^3.3.4":
-  version: 3.3.4
-  resolution: "nanoid@npm:3.3.4"
-  bin:
-    nanoid: bin/nanoid.cjs
-  checksum: 2fddd6dee994b7676f008d3ffa4ab16035a754f4bb586c61df5a22cf8c8c94017aadd360368f47d653829e0569a92b129979152ff97af23a558331e47e37cd9c
+"nano-spawn@npm:^1.0.0":
+  version: 1.0.2
+  resolution: "nano-spawn@npm:1.0.2"
+  checksum: 195eb751f5f32bebb622c57e3fdb2ebac8b9ffea301c94412a0fb0d3c0035854884e505a0518ff2dd50faf12d005843a0409b1316dd3746e3c5e696a77ccff16
   languageName: node
   linkType: hard
 
-"nanoid@npm:^3.3.6":
-  version: 3.3.6
-  resolution: "nanoid@npm:3.3.6"
+"nanoid@npm:^3.3.8":
+  version: 3.3.11
+  resolution: "nanoid@npm:3.3.11"
   bin:
     nanoid: bin/nanoid.cjs
-  checksum: 7d0eda657002738aa5206107bd0580aead6c95c460ef1bdd0b1a87a9c7ae6277ac2e9b945306aaa5b32c6dcb7feaf462d0f552e7f8b5718abfc6ead5c94a71b3
-  languageName: node
-  linkType: hard
-
-"nanomatch@npm:^1.2.9":
-  version: 1.2.13
-  resolution: "nanomatch@npm:1.2.13"
-  dependencies:
-    arr-diff: ^4.0.0
-    array-unique: ^0.3.2
-    define-property: ^2.0.2
-    extend-shallow: ^3.0.2
-    fragment-cache: ^0.2.1
-    is-windows: ^1.0.2
-    kind-of: ^6.0.2
-    object.pick: ^1.3.0
-    regex-not: ^1.0.0
-    snapdragon: ^0.8.1
-    to-regex: ^3.0.1
-  checksum: 54d4166d6ef08db41252eb4e96d4109ebcb8029f0374f9db873bd91a1f896c32ec780d2a2ea65c0b2d7caf1f28d5e1ea33746a470f32146ac8bba821d80d38d8
+  checksum: 3be20d8866a57a6b6d218e82549711c8352ed969f9ab3c45379da28f405363ad4c9aeb0b39e9abc101a529ca65a72ff9502b00bf74a912c4b64a9d62dfd26c29
   languageName: node
   linkType: hard
 
@@ -22317,21 +14322,28 @@ __metadata:
   languageName: node
   linkType: hard
 
-"negotiator@npm:0.6.2":
-  version: 0.6.2
-  resolution: "negotiator@npm:0.6.2"
-  checksum: dfddaff6c06792f1c4c3809e29a427b8daef8cd437c83b08dd51d7ee11bbd1c29d9512d66b801144d6c98e910ffd8723f2432e0cbf8b18d41d2a09599c975ab3
-  languageName: node
-  linkType: hard
-
-"negotiator@npm:0.6.3, negotiator@npm:^0.6.3":
+"negotiator@npm:0.6.3":
   version: 0.6.3
   resolution: "negotiator@npm:0.6.3"
   checksum: b8ffeb1e262eff7968fc90a2b6767b04cfd9842582a9d0ece0af7049537266e7b2506dfb1d107a32f06dd849ab2aea834d5830f7f4d0e5cb7d36e1ae55d021d9
   languageName: node
   linkType: hard
 
-"neo-async@npm:^2.5.0, neo-async@npm:^2.6.0, neo-async@npm:^2.6.1, neo-async@npm:^2.6.2":
+"negotiator@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "negotiator@npm:1.0.0"
+  checksum: 20ebfe79b2d2e7cf9cbc8239a72662b584f71164096e6e8896c8325055497c96f6b80cd22c258e8a2f2aa382a787795ec3ee8b37b422a302c7d4381b0d5ecfbb
+  languageName: node
+  linkType: hard
+
+"negotiator@npm:~0.6.4":
+  version: 0.6.4
+  resolution: "negotiator@npm:0.6.4"
+  checksum: 7ded10aa02a0707d1d12a9973fdb5954f98547ca7beb60e31cb3a403cc6e8f11138db7a3b0128425cf836fc85d145ec4ce983b2bdf83dca436af879c2d683510
+  languageName: node
+  linkType: hard
+
+"neo-async@npm:^2.6.2":
   version: 2.6.2
   resolution: "neo-async@npm:2.6.2"
   checksum: deac9f8d00eda7b2e5cd1b2549e26e10a0faa70adaa6fdadca701cc55f49ee9018e427f424bac0c790b7c7e2d3068db97f3093f1093975f2acb8f8818b936ed9
@@ -22345,19 +14357,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nise@npm:^1.5.2":
-  version: 1.5.3
-  resolution: "nise@npm:1.5.3"
-  dependencies:
-    "@sinonjs/formatio": ^3.2.1
-    "@sinonjs/text-encoding": ^0.7.1
-    just-extend: ^4.0.2
-    lolex: ^5.0.1
-    path-to-regexp: ^1.7.0
-  checksum: ec3af21345dcaf34650a6f5420a11e0fd21a836ac5960f5e8523c301ee98465abf88b958f7b3084ecc6e0a7133e5cf7963f4df176b90b423c4da4984f1ebd75e
-  languageName: node
-  linkType: hard
-
 "no-case@npm:^3.0.4":
   version: 3.0.4
   resolution: "no-case@npm:3.0.4"
@@ -22368,30 +14367,32 @@ __metadata:
   languageName: node
   linkType: hard
 
-"node-fetch@npm:^2.6.1":
-  version: 2.6.1
-  resolution: "node-fetch@npm:2.6.1"
-  checksum: 91075bedd57879117e310fbcc36983ad5d699e522edb1ebcdc4ee5294c982843982652925c3532729fdc86b2d64a8a827797a745f332040d91823c8752ee4d7c
+"node-addon-api@npm:^7.0.0":
+  version: 7.1.1
+  resolution: "node-addon-api@npm:7.1.1"
+  dependencies:
+    node-gyp: latest
+  checksum: 46051999e3289f205799dfaf6bcb017055d7569090f0004811110312e2db94cb4f8654602c7eb77a60a1a05142cc2b96e1b5c56ca4622c41a5c6370787faaf30
   languageName: node
   linkType: hard
 
 "node-gyp@npm:latest":
-  version: 9.3.1
-  resolution: "node-gyp@npm:9.3.1"
+  version: 11.2.0
+  resolution: "node-gyp@npm:11.2.0"
   dependencies:
     env-paths: ^2.2.0
-    glob: ^7.1.4
+    exponential-backoff: ^3.1.1
     graceful-fs: ^4.2.6
-    make-fetch-happen: ^10.0.3
-    nopt: ^6.0.0
-    npmlog: ^6.0.0
-    rimraf: ^3.0.2
+    make-fetch-happen: ^14.0.3
+    nopt: ^8.0.0
+    proc-log: ^5.0.0
     semver: ^7.3.5
-    tar: ^6.1.2
-    which: ^2.0.2
+    tar: ^7.4.3
+    tinyglobby: ^0.2.12
+    which: ^5.0.0
   bin:
     node-gyp: bin/node-gyp.js
-  checksum: b860e9976fa645ca0789c69e25387401b4396b93c8375489b5151a6c55cf2640a3b6183c212b38625ef7c508994930b72198338e3d09b9d7ade5acc4aaf51ea7
+  checksum: 2536282ba81f8a94b29482d3622b6ab298611440619e46de4512a6f32396a68b5530357c474b859787069d84a4c537d99e0c71078cce5b9f808bf84eeb78e8fb
   languageName: node
   linkType: hard
 
@@ -22402,37 +14403,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"node-libs-browser@npm:^2.2.1":
-  version: 2.2.1
-  resolution: "node-libs-browser@npm:2.2.1"
-  dependencies:
-    assert: ^1.1.1
-    browserify-zlib: ^0.2.0
-    buffer: ^4.3.0
-    console-browserify: ^1.1.0
-    constants-browserify: ^1.0.0
-    crypto-browserify: ^3.11.0
-    domain-browser: ^1.1.1
-    events: ^3.0.0
-    https-browserify: ^1.0.0
-    os-browserify: ^0.3.0
-    path-browserify: 0.0.1
-    process: ^0.11.10
-    punycode: ^1.2.4
-    querystring-es3: ^0.2.0
-    readable-stream: ^2.3.3
-    stream-browserify: ^2.0.1
-    stream-http: ^2.7.2
-    string_decoder: ^1.0.0
-    timers-browserify: ^2.0.4
-    tty-browserify: 0.0.0
-    url: ^0.11.0
-    util: ^0.11.0
-    vm-browserify: ^1.0.1
-  checksum: 41fa7927378edc0cb98a8cc784d3f4a47e43378d3b42ec57a23f81125baa7287c4b54d6d26d062072226160a3ce4d8b7a62e873d2fb637aceaddf71f5a26eca0
-  languageName: node
-  linkType: hard
-
 "node-modules-path@npm:^1.0.0, node-modules-path@npm:^1.0.1":
   version: 1.0.2
   resolution: "node-modules-path@npm:1.0.2"
@@ -22440,59 +14410,24 @@ __metadata:
   languageName: node
   linkType: hard
 
-"node-notifier@npm:^8.0.1":
-  version: 8.0.2
-  resolution: "node-notifier@npm:8.0.2"
+"node-notifier@npm:^10.0.0":
+  version: 10.0.1
+  resolution: "node-notifier@npm:10.0.1"
   dependencies:
     growly: ^1.3.0
     is-wsl: ^2.2.0
-    semver: ^7.3.2
+    semver: ^7.3.5
     shellwords: ^0.1.1
-    uuid: ^8.3.0
+    uuid: ^8.3.2
     which: ^2.0.2
-  checksum: 7db1683003f6aaa4324959dfa663cd56e301ccc0165977a9e7737989ffe3b4763297f9fc85f44d0662b63a4fd85516eda43411b492a4d2fae207afb23773f912
-  languageName: node
-  linkType: hard
-
-"node-releases@npm:^1.1.71, node-releases@npm:^1.1.77":
-  version: 1.1.77
-  resolution: "node-releases@npm:1.1.77"
-  checksum: eb2fcb45310e7d77f82bfdadeca546a698d258e011f15d88ad9a452a5e838a672ec532906581096ca19c66284a788330c3b09227ffc540e67228730f41b9c2e2
-  languageName: node
-  linkType: hard
-
-"node-releases@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "node-releases@npm:2.0.1"
-  checksum: b20dd8d4bced11f75060f0387e05e76b9dc4a0451f7bb3516eade6f50499ea7768ba95d8a60d520c193402df1e58cb3fe301510cc1c1ad68949c3d57b5149866
-  languageName: node
-  linkType: hard
-
-"node-releases@npm:^2.0.12":
-  version: 2.0.13
-  resolution: "node-releases@npm:2.0.13"
-  checksum: 17ec8f315dba62710cae71a8dad3cd0288ba943d2ece43504b3b1aa8625bf138637798ab470b1d9035b0545996f63000a8a926e0f6d35d0996424f8b6d36dda3
-  languageName: node
-  linkType: hard
-
-"node-releases@npm:^2.0.14":
-  version: 2.0.14
-  resolution: "node-releases@npm:2.0.14"
-  checksum: 59443a2f77acac854c42d321bf1b43dea0aef55cd544c6a686e9816a697300458d4e82239e2d794ea05f7bbbc8a94500332e2d3ac3f11f52e4b16cbe638b3c41
-  languageName: node
-  linkType: hard
-
-"node-releases@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "node-releases@npm:2.0.2"
-  checksum: da858bf86b4d512842379749f5a5e4196ddab05ba18ffcf29f05bf460beceaca927f070f4430bb5046efec18941ddbc85e4c5fdbb83afc28a38dd6069a2f255e
+  checksum: ac09456152e433462dd3ca277048de7a60c6d63fc657e00ac72805841baf9bb2573e8d3f64c4b64af73546d1ed39733af6b0036c38b57a83c883aa33fff35a2e
   languageName: node
   linkType: hard
 
-"node-releases@npm:^2.0.5":
-  version: 2.0.5
-  resolution: "node-releases@npm:2.0.5"
-  checksum: e85d949addd19f8827f32569d2be5751e7812ccf6cc47879d49f79b5234ff4982225e39a3929315f96370823b070640fb04d79fc0ddec8b515a969a03493a42f
+"node-releases@npm:^2.0.19":
+  version: 2.0.19
+  resolution: "node-releases@npm:2.0.19"
+  checksum: 917dbced519f48c6289a44830a0ca6dc944c3ee9243c468ebd8515a41c97c8b2c256edb7f3f750416bc37952cc9608684e6483c7b6c6f39f6bd8d86c52cfe658
   languageName: node
   linkType: hard
 
@@ -22524,26 +14459,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nopt@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "nopt@npm:6.0.0"
-  dependencies:
-    abbrev: ^1.0.0
-  bin:
-    nopt: bin/nopt.js
-  checksum: 82149371f8be0c4b9ec2f863cc6509a7fd0fa729929c009f3a58e4eb0c9e4cae9920e8f1f8eb46e7d032fec8fb01bede7f0f41a67eb3553b7b8e14fa53de1dac
-  languageName: node
-  linkType: hard
-
-"normalize-package-data@npm:^3.0.2":
-  version: 3.0.3
-  resolution: "normalize-package-data@npm:3.0.3"
+"nopt@npm:^8.0.0":
+  version: 8.1.0
+  resolution: "nopt@npm:8.1.0"
   dependencies:
-    hosted-git-info: ^4.0.1
-    is-core-module: ^2.5.0
-    semver: ^7.3.4
-    validate-npm-package-license: ^3.0.1
-  checksum: bbcee00339e7c26fdbc760f9b66d429258e2ceca41a5df41f5df06cc7652de8d82e8679ff188ca095cad8eff2b6118d7d866af2b68400f74602fbcbce39c160a
+    abbrev: ^3.0.0
+  bin:
+    nopt: bin/nopt.js
+  checksum: 49cfd3eb6f565e292bf61f2ff1373a457238804d5a5a63a8d786c923007498cba89f3648e3b952bc10203e3e7285752abf5b14eaf012edb821e84f24e881a92a
   languageName: node
   linkType: hard
 
@@ -22563,27 +14486,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"normalize-range@npm:^0.1.2":
-  version: 0.1.2
-  resolution: "normalize-range@npm:0.1.2"
-  checksum: 9b2f14f093593f367a7a0834267c24f3cb3e887a2d9809c77d8a7e5fd08738bcd15af46f0ab01cc3a3d660386f015816b5c922cea8bf2ee79777f40874063184
-  languageName: node
-  linkType: hard
-
-"normalize.css@npm:4.1.1":
-  version: 4.1.1
-  resolution: "normalize.css@npm:4.1.1"
-  checksum: 48500b12c63141286b637a0ed771d23e95872469eb9726171aea4fa90c9e9fe97870ee52c81dc42ef391733423bf0887dc0fdadae0e5f6020b6eb04e60ffcd68
-  languageName: node
-  linkType: hard
-
-"npm-git-info@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "npm-git-info@npm:1.0.3"
-  checksum: 1f2218004e109db649580f023ae2b6eb690efae0e47ec26216a01751325b45788430428b12478d91583e18bd8f4bc933d02a1f42984b8d4977f1c35ddef1bad2
-  languageName: node
-  linkType: hard
-
 "npm-package-arg@npm:^10.1.0":
   version: 10.1.0
   resolution: "npm-package-arg@npm:10.1.0"
@@ -22605,15 +14507,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"npm-run-path@npm:^3.0.0":
-  version: 3.1.0
-  resolution: "npm-run-path@npm:3.1.0"
-  dependencies:
-    path-key: ^3.0.0
-  checksum: 141e0b8f0e3b137347a2896572c9a84701754dda0670d3ceb8c56a87702ee03c26227e4517ab93f2904acfc836547315e740b8289bb24ca0cd8ba2b198043b0f
-  languageName: node
-  linkType: hard
-
 "npm-run-path@npm:^4.0.0, npm-run-path@npm:^4.0.1":
   version: 4.0.1
   resolution: "npm-run-path@npm:4.0.1"
@@ -22624,11 +14517,11 @@ __metadata:
   linkType: hard
 
 "npm-run-path@npm:^5.1.0":
-  version: 5.2.0
-  resolution: "npm-run-path@npm:5.2.0"
+  version: 5.3.0
+  resolution: "npm-run-path@npm:5.3.0"
   dependencies:
     path-key: ^4.0.0
-  checksum: c5325e016014e715689c4014f7e0be16cc4cbf529f32a1723e511bc4689b5f823b704d2bca61ac152ce2bda65e0205dc8b3ba0ec0f5e4c3e162d302f6f5b9efb
+  checksum: ae8e7a89da9594fb9c308f6555c73f618152340dcaae423e5fb3620026fefbec463618a8b761920382d666fa7a2d8d240b6fe320e8a6cdd54dc3687e2b659d25
   languageName: node
   linkType: hard
 
@@ -22656,67 +14549,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nth-check@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "nth-check@npm:1.0.2"
-  dependencies:
-    boolbase: ~1.0.0
-  checksum: 59e115fdd75b971d0030f42ada3aac23898d4c03aa13371fa8b3339d23461d1badf3fde5aad251fb956aaa75c0a3b9bfcd07c08a34a83b4f9dadfdce1d19337c
-  languageName: node
-  linkType: hard
-
-"nth-check@npm:^2.0.1":
-  version: 2.1.1
-  resolution: "nth-check@npm:2.1.1"
-  dependencies:
-    boolbase: ^1.0.0
-  checksum: 5afc3dafcd1573b08877ca8e6148c52abd565f1d06b1eb08caf982e3fa289a82f2cae697ffb55b5021e146d60443f1590a5d6b944844e944714a5b549675bcd3
-  languageName: node
-  linkType: hard
-
-"num2fraction@npm:^1.2.2":
-  version: 1.2.2
-  resolution: "num2fraction@npm:1.2.2"
-  checksum: 1da9c6797b505d3f5b17c7f694c4fa31565bdd5c0e5d669553253aed848a580804cd285280e8a73148bd9628839267daee4967f24b53d4e893e44b563e412635
-  languageName: node
-  linkType: hard
-
-"nwsapi@npm:^2.2.0":
-  version: 2.2.0
-  resolution: "nwsapi@npm:2.2.0"
-  checksum: 5ef4a9bc0c1a5b7f2e014aa6a4b359a257503b796618ed1ef0eb852098f77e772305bb0e92856e4bbfa3e6c75da48c0113505c76f144555ff38867229c2400a7
-  languageName: node
-  linkType: hard
-
-"oauth-sign@npm:~0.9.0":
-  version: 0.9.0
-  resolution: "oauth-sign@npm:0.9.0"
-  checksum: 8f5497a127967866a3c67094c21efd295e46013a94e6e828573c62220e9af568cc1d2d04b16865ba583e430510fa168baf821ea78f355146d8ed7e350fc44c64
-  languageName: node
-  linkType: hard
-
-"object-assign@npm:4.1.1, object-assign@npm:^4, object-assign@npm:^4.1.0, object-assign@npm:^4.1.1":
+"object-assign@npm:4.1.1, object-assign@npm:^4, object-assign@npm:^4.1.0":
   version: 4.1.1
   resolution: "object-assign@npm:4.1.1"
   checksum: fcc6e4ea8c7fe48abfbb552578b1c53e0d194086e2e6bbbf59e0a536381a292f39943c6e9628af05b5528aa5e3318bb30d6b2e53cadaf5b8fe9e12c4b69af23f
   languageName: node
   linkType: hard
 
-"object-assign@npm:^2.0.0":
+"object-get@npm:^2.1.1":
   version: 2.1.1
-  resolution: "object-assign@npm:2.1.1"
-  checksum: d37a7d7173408e07ee225116437592d92b584b2a5f38cafe608400b43efd9b78878dbd545b524aff5b4118d88e39466b9038b2d3de8885e212adad497d656c46
-  languageName: node
-  linkType: hard
-
-"object-copy@npm:^0.1.0":
-  version: 0.1.0
-  resolution: "object-copy@npm:0.1.0"
-  dependencies:
-    copy-descriptor: ^0.1.0
-    define-property: ^0.2.5
-    kind-of: ^3.0.3
-  checksum: a9e35f07e3a2c882a7e979090360d1a20ab51d1fa19dfdac3aa8873b328a7c4c7683946ee97c824ae40079d848d6740a3788fa14f2185155dab7ed970a72c783
+  resolution: "object-get@npm:2.1.1"
+  checksum: a015f70a6246024bb9ee49835609a2f516232d671c3de393ac62389853385807ebbecf0609784e8b5da1f30a5ca001b8dd5bfb32c8847dc1ed7f8e73e4b2080f
   languageName: node
   linkType: hard
 
@@ -22727,99 +14570,38 @@ __metadata:
   languageName: node
   linkType: hard
 
-"object-inspect@npm:^1.11.0, object-inspect@npm:^1.9.0":
-  version: 1.11.0
-  resolution: "object-inspect@npm:1.11.0"
-  checksum: 8c64f89ce3a7b96b6925879ad5f6af71d498abc217e136660efecd97452991216f375a7eb47cb1cb50643df939bf0c7cc391567b7abc6a924d04679705e58e27
-  languageName: node
-  linkType: hard
-
-"object-inspect@npm:^1.12.3":
-  version: 1.12.3
-  resolution: "object-inspect@npm:1.12.3"
-  checksum: dabfd824d97a5f407e6d5d24810d888859f6be394d8b733a77442b277e0808860555176719c5905e765e3743a7cada6b8b0a3b85e5331c530fd418cc8ae991db
-  languageName: node
-  linkType: hard
-
-"object-is@npm:^1.1.5":
-  version: 1.1.5
-  resolution: "object-is@npm:1.1.5"
-  dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.3
-  checksum: 989b18c4cba258a6b74dc1d74a41805c1a1425bce29f6cabb50dcb1a6a651ea9104a1b07046739a49a5bb1bc49727bcb00efd5c55f932f6ea04ec8927a7901fe
+"object-inspect@npm:^1.13.3, object-inspect@npm:^1.13.4":
+  version: 1.13.4
+  resolution: "object-inspect@npm:1.13.4"
+  checksum: 582810c6a8d2ef988ea0a39e69e115a138dad8f42dd445383b394877e5816eb4268489f316a6f74ee9c4e0a984b3eab1028e3e79d62b1ed67c726661d55c7a8b
   languageName: node
   linkType: hard
 
-"object-keys@npm:^1.0.12, object-keys@npm:^1.1.1":
+"object-keys@npm:^1.1.1":
   version: 1.1.1
   resolution: "object-keys@npm:1.1.1"
   checksum: b363c5e7644b1e1b04aa507e88dcb8e3a2f52b6ffd0ea801e4c7a62d5aa559affe21c55a07fd4b1fd55fc03a33c610d73426664b20032405d7b92a1414c34d6a
   languageName: node
   linkType: hard
 
-"object-visit@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "object-visit@npm:1.0.1"
-  dependencies:
-    isobject: ^3.0.0
-  checksum: b0ee07f5bf3bb881b881ff53b467ebbde2b37ebb38649d6944a6cd7681b32eedd99da9bd1e01c55facf81f54ed06b13af61aba6ad87f0052982995e09333f790
-  languageName: node
-  linkType: hard
-
-"object.assign@npm:^4.1.0, object.assign@npm:^4.1.2":
-  version: 4.1.2
-  resolution: "object.assign@npm:4.1.2"
-  dependencies:
-    call-bind: ^1.0.0
-    define-properties: ^1.1.3
-    has-symbols: ^1.0.1
-    object-keys: ^1.1.1
-  checksum: d621d832ed7b16ac74027adb87196804a500d80d9aca536fccb7ba48d33a7e9306a75f94c1d29cbfa324bc091bfc530bc24789568efdaee6a47fcfa298993814
+"object-to-spawn-args@npm:^2.0.1":
+  version: 2.0.1
+  resolution: "object-to-spawn-args@npm:2.0.1"
+  checksum: 845e75613d973fe92f04142589535175673fe2349d9a5c2f55fb3046e464626cf3fc58a601a0843d3b498128b7b674d1663dd1833feab40584f136762e183add
   languageName: node
   linkType: hard
 
-"object.assign@npm:^4.1.4":
-  version: 4.1.4
-  resolution: "object.assign@npm:4.1.4"
+"object.assign@npm:^4.1.7":
+  version: 4.1.7
+  resolution: "object.assign@npm:4.1.7"
   dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.4
-    has-symbols: ^1.0.3
+    call-bind: ^1.0.8
+    call-bound: ^1.0.3
+    define-properties: ^1.2.1
+    es-object-atoms: ^1.0.0
+    has-symbols: ^1.1.0
     object-keys: ^1.1.1
-  checksum: 76cab513a5999acbfe0ff355f15a6a125e71805fcf53de4e9d4e082e1989bdb81d1e329291e1e4e0ae7719f0e4ef80e88fb2d367ae60500d79d25a6224ac8864
-  languageName: node
-  linkType: hard
-
-"object.getownpropertydescriptors@npm:^2.1.0":
-  version: 2.1.2
-  resolution: "object.getownpropertydescriptors@npm:2.1.2"
-  dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.3
-    es-abstract: ^1.18.0-next.2
-  checksum: 6c1c0162a2bea912f092dbf48699998d6f4b788a9884ee99ba41ddf25c3f0924ec56c6a55738c4ae3bd91d1203813a9a8e18e6fff1f477e2626cdbcd1a5f3ca8
-  languageName: node
-  linkType: hard
-
-"object.pick@npm:^1.3.0":
-  version: 1.3.0
-  resolution: "object.pick@npm:1.3.0"
-  dependencies:
-    isobject: ^3.0.1
-  checksum: 77fb6eed57c67adf75e9901187e37af39f052ef601cb4480386436561357eb9e459e820762f01fd02c5c1b42ece839ad393717a6d1850d848ee11fbabb3e580a
-  languageName: node
-  linkType: hard
-
-"object.values@npm:^1.1.0":
-  version: 1.1.3
-  resolution: "object.values@npm:1.1.3"
-  dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.3
-    es-abstract: ^1.18.0-next.2
-    has: ^1.0.3
-  checksum: 8b29bd0936a32c2c5dfeb39389f65c7c3f32253a2ad3e4605726cac6bda8f642b4f8ab1ef58279851b86b7ae7322b3cf9a464c346498a7deb8f0c3a0554015f0
+  checksum: 60e07d2651cf4f5528c485f1aa4dbded9b384c47d80e8187cefd11320abb1aebebf78df5483451dfa549059f8281c21f7b4bf7d19e9e5e97d8d617df0df298de
   languageName: node
   linkType: hard
 
@@ -22884,45 +14666,26 @@ __metadata:
   languageName: node
   linkType: hard
 
-"optionator@npm:^0.8.1":
-  version: 0.8.3
-  resolution: "optionator@npm:0.8.3"
-  dependencies:
-    deep-is: ~0.1.3
-    fast-levenshtein: ~2.0.6
-    levn: ~0.3.0
-    prelude-ls: ~1.1.2
-    type-check: ~0.3.2
-    word-wrap: ~1.2.3
-  checksum: b8695ddf3d593203e25ab0900e265d860038486c943ff8b774f596a310f8ceebdb30c6832407a8198ba3ec9debe1abe1f51d4aad94843612db3b76d690c61d34
-  languageName: node
-  linkType: hard
-
-"optionator@npm:^0.9.1":
-  version: 0.9.1
-  resolution: "optionator@npm:0.9.1"
+"onetime@npm:^7.0.0":
+  version: 7.0.0
+  resolution: "onetime@npm:7.0.0"
   dependencies:
-    deep-is: ^0.1.3
-    fast-levenshtein: ^2.0.6
-    levn: ^0.4.1
-    prelude-ls: ^1.2.1
-    type-check: ^0.4.0
-    word-wrap: ^1.2.3
-  checksum: dbc6fa065604b24ea57d734261914e697bd73b69eff7f18e967e8912aa2a40a19a9f599a507fa805be6c13c24c4eae8c71306c239d517d42d4c041c942f508a0
+    mimic-function: ^5.0.0
+  checksum: eb08d2da9339819e2f9d52cab9caf2557d80e9af8c7d1ae86e1a0fef027d00a88e9f5bd67494d350df360f7c559fbb44e800b32f310fb989c860214eacbb561c
   languageName: node
   linkType: hard
 
 "optionator@npm:^0.9.3":
-  version: 0.9.3
-  resolution: "optionator@npm:0.9.3"
+  version: 0.9.4
+  resolution: "optionator@npm:0.9.4"
   dependencies:
-    "@aashutoshrathi/word-wrap": ^1.2.3
     deep-is: ^0.1.3
     fast-levenshtein: ^2.0.6
     levn: ^0.4.1
     prelude-ls: ^1.2.1
     type-check: ^0.4.0
-  checksum: 09281999441f2fe9c33a5eeab76700795365a061563d66b098923eb719251a42bdbe432790d35064d0816ead9296dbeb1ad51a733edf4167c96bd5d0882e428a
+    word-wrap: ^1.2.5
+  checksum: ecbd010e3dc73e05d239976422d9ef54a82a13f37c11ca5911dff41c98a6c7f0f163b27f922c37e7f8340af9d36febd3b6e9cef508f3339d4c393d7276d716bb
   languageName: node
   linkType: hard
 
@@ -22957,20 +14720,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"os-browserify@npm:^0.3.0":
-  version: 0.3.0
-  resolution: "os-browserify@npm:0.3.0"
-  checksum: 16e37ba3c0e6a4c63443c7b55799ce4066d59104143cb637ecb9fce586d5da319cdca786ba1c867abbe3890d2cbf37953f2d51eea85e20dd6c4570d6c54bfebf
-  languageName: node
-  linkType: hard
-
-"os-homedir@npm:^1.0.0":
-  version: 1.0.2
-  resolution: "os-homedir@npm:1.0.2"
-  checksum: af609f5a7ab72de2f6ca9be6d6b91a599777afc122ac5cad47e126c1f67c176fe9b52516b9eeca1ff6ca0ab8587fe66208bc85e40a3940125f03cdb91408e9d2
-  languageName: node
-  linkType: hard
-
 "os-locale@npm:^5.0.0":
   version: 5.0.0
   resolution: "os-locale@npm:5.0.0"
@@ -22982,20 +14731,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"os-tmpdir@npm:^1.0.0, os-tmpdir@npm:^1.0.1, os-tmpdir@npm:~1.0.1, os-tmpdir@npm:~1.0.2":
+"os-tmpdir@npm:~1.0.1, os-tmpdir@npm:~1.0.2":
   version: 1.0.2
   resolution: "os-tmpdir@npm:1.0.2"
   checksum: 5666560f7b9f10182548bf7013883265be33620b1c1b4a4d405c25be2636f970c5488ff3e6c48de75b55d02bde037249fe5dbfbb4c0fb7714953d56aed062e6d
   languageName: node
   linkType: hard
 
-"osenv@npm:^0.1.3":
-  version: 0.1.5
-  resolution: "osenv@npm:0.1.5"
+"own-keys@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "own-keys@npm:1.0.1"
   dependencies:
-    os-homedir: ^1.0.0
-    os-tmpdir: ^1.0.0
-  checksum: 779d261920f2a13e5e18cf02446484f12747d3f2ff82280912f52b213162d43d312647a40c332373cbccd5e3fb8126915d3bfea8dde4827f70f82da76e52d359
+    get-intrinsic: ^1.2.6
+    object-keys: ^1.1.1
+    safe-push-apply: ^1.0.0
+  checksum: cc9dd7d85c4ccfbe8109fce307d581ac7ede7b26de892b537873fbce2dc6a206d89aea0630dbb98e47ce0873517cefeaa7be15fcf94aaf4764a3b34b474a5b61
   languageName: node
   linkType: hard
 
@@ -23020,13 +14770,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"p-finally@npm:^2.0.0":
-  version: 2.0.1
-  resolution: "p-finally@npm:2.0.1"
-  checksum: 6306a2851c3b28f8b603624f395ae84dce76970498fed8aa6aae2d930595053746edf1e4ee0c4b78a97410d84aa4504d63179f5310d555511ecd226f53ed1e8e
-  languageName: node
-  linkType: hard
-
 "p-is-promise@npm:^2.1.0":
   version: 2.1.0
   resolution: "p-is-promise@npm:2.1.0"
@@ -23115,12 +14858,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"p-map@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "p-map@npm:4.0.0"
-  dependencies:
-    aggregate-error: ^3.0.0
-  checksum: cb0ab21ec0f32ddffd31dfc250e3afa61e103ef43d957cc45497afe37513634589316de4eb88abdfd969fe6410c22c0b93ab24328833b8eb1ccc087fc0442a1c
+"p-map@npm:^7.0.2":
+  version: 7.0.3
+  resolution: "p-map@npm:7.0.3"
+  checksum: 8c92d533acf82f0d12f7e196edccff773f384098bbb048acdd55a08778ce4fc8889d8f1bde72969487bd96f9c63212698d79744c20bedfce36c5b00b46d369f8
   languageName: node
   linkType: hard
 
@@ -23138,21 +14879,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"pako@npm:~1.0.5":
-  version: 1.0.11
-  resolution: "pako@npm:1.0.11"
-  checksum: 1be2bfa1f807608c7538afa15d6f25baa523c30ec870a3228a89579e474a4d992f4293859524e46d5d87fd30fa17c5edf34dbef0671251d9749820b488660b16
-  languageName: node
-  linkType: hard
-
-"parallel-transform@npm:^1.1.0":
-  version: 1.2.0
-  resolution: "parallel-transform@npm:1.2.0"
-  dependencies:
-    cyclist: ^1.0.1
-    inherits: ^2.0.3
-    readable-stream: ^2.1.5
-  checksum: ab6ddc1a662cefcfb3d8d546a111763d3b223f484f2e9194e33aefd8f6760c319d0821fd22a00a3adfbd45929b50d2c84cc121389732f013c2ae01c226269c27
+"package-json-from-dist@npm:^1.0.0":
+  version: 1.0.1
+  resolution: "package-json-from-dist@npm:1.0.1"
+  checksum: 58ee9538f2f762988433da00e26acc788036914d57c71c246bf0be1b60cdbd77dd60b6a3e1a30465f0b248aeb80079e0b34cb6050b1dfa18c06953bb1cbc7602
   languageName: node
   linkType: hard
 
@@ -23165,19 +14895,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"parse-asn1@npm:^5.0.0, parse-asn1@npm:^5.1.5":
-  version: 5.1.6
-  resolution: "parse-asn1@npm:5.1.6"
-  dependencies:
-    asn1.js: ^5.2.0
-    browserify-aes: ^1.0.0
-    evp_bytestokey: ^1.0.0
-    pbkdf2: ^3.0.3
-    safe-buffer: ^5.1.1
-  checksum: 9243311d1f88089bc9f2158972aa38d1abd5452f7b7cabf84954ed766048fe574d434d82c6f5a39b988683e96fb84cd933071dda38927e03469dc8c8d14463c7
-  languageName: node
-  linkType: hard
-
 "parse-entities@npm:^2.0.0":
   version: 2.0.0
   resolution: "parse-entities@npm:2.0.0"
@@ -23192,7 +14909,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"parse-json@npm:^5.0.0, parse-json@npm:^5.2.0":
+"parse-json@npm:^5.2.0":
   version: 5.2.0
   resolution: "parse-json@npm:5.2.0"
   dependencies:
@@ -23204,13 +14921,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"parse-ms@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "parse-ms@npm:1.0.1"
-  checksum: 93fa7921554fe16bc73272a94bf812d1db6a144964fb57692f6de4fccf14bd771a232e8dcdcd4bbaa4aa477796cd3f35374d65596cca12323f2664bc023b4b4c
-  languageName: node
-  linkType: hard
-
 "parse-passwd@npm:^1.0.0":
   version: 1.0.0
   resolution: "parse-passwd@npm:1.0.0"
@@ -23225,32 +14935,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"parse5-htmlparser2-tree-adapter@npm:^7.0.0":
-  version: 7.0.0
-  resolution: "parse5-htmlparser2-tree-adapter@npm:7.0.0"
-  dependencies:
-    domhandler: ^5.0.2
-    parse5: ^7.0.0
-  checksum: fc5d01e07733142a1baf81de5c2a9c41426c04b7ab29dd218acb80cd34a63177c90aff4a4aee66cf9f1d0aeecff1389adb7452ad6f8af0a5888e3e9ad6ef733d
-  languageName: node
-  linkType: hard
-
-"parse5@npm:6.0.1, parse5@npm:^6.0.1":
+"parse5@npm:^6.0.1":
   version: 6.0.1
   resolution: "parse5@npm:6.0.1"
   checksum: 7d569a176c5460897f7c8f3377eff640d54132b9be51ae8a8fa4979af940830b2b0c296ce75e5bd8f4041520aadde13170dbdec44889975f906098ea0002f4bd
   languageName: node
   linkType: hard
 
-"parse5@npm:^7.0.0":
-  version: 7.1.1
-  resolution: "parse5@npm:7.1.1"
-  dependencies:
-    entities: ^4.4.0
-  checksum: 8f72fbfa6df83a3f29f58e1818f7bd46b47ff3e26d79c74e10b8fc7ef7ee76163f205113f1b2f6a5b8dc4e31e726f490444f04890cead6e974dbcbe8172b1321
-  languageName: node
-  linkType: hard
-
 "parseurl@npm:~1.3.3":
   version: 1.3.3
   resolution: "parseurl@npm:1.3.3"
@@ -23258,27 +14949,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"pascalcase@npm:^0.1.1":
-  version: 0.1.1
-  resolution: "pascalcase@npm:0.1.1"
-  checksum: f83681c3c8ff75fa473a2bb2b113289952f802ff895d435edd717e7cb898b0408cbdb247117a938edcbc5d141020909846cc2b92c47213d764e2a94d2ad2b925
-  languageName: node
-  linkType: hard
-
-"path-browserify@npm:0.0.1":
-  version: 0.0.1
-  resolution: "path-browserify@npm:0.0.1"
-  checksum: ae8dcd45d0d3cfbaf595af4f206bf3ed82d77f72b4877ae7e77328079e1468c84f9386754bb417d994d5a19bf47882fd253565c18441cd5c5c90ae5187599e35
-  languageName: node
-  linkType: hard
-
-"path-dirname@npm:^1.0.0":
-  version: 1.0.2
-  resolution: "path-dirname@npm:1.0.2"
-  checksum: 0d2f6604ae05a252a0025318685f290e2764ecf9c5436f203cdacfc8c0b17c24cdedaa449d766beb94ab88cc7fc70a09ec21e7933f31abc2b719180883e5e33f
-  languageName: node
-  linkType: hard
-
 "path-exists@npm:^3.0.0":
   version: 3.0.0
   resolution: "path-exists@npm:3.0.0"
@@ -23300,7 +14970,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"path-is-absolute@npm:1.0.1, path-is-absolute@npm:^1.0.0, path-is-absolute@npm:^1.0.1":
+"path-is-absolute@npm:1.0.1, path-is-absolute@npm:^1.0.0":
   version: 1.0.1
   resolution: "path-is-absolute@npm:1.0.1"
   checksum: 060840f92cf8effa293bcc1bea81281bd7d363731d214cbe5c227df207c34cd727430f70c6037b5159c8a870b9157cba65e775446b0ab06fd5ecc7e54615a3b8
@@ -23328,7 +14998,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"path-parse@npm:^1.0.6, path-parse@npm:^1.0.7":
+"path-parse@npm:^1.0.7":
   version: 1.0.7
   resolution: "path-parse@npm:1.0.7"
   checksum: 49abf3d81115642938a8700ec580da6e830dde670be21893c62f4e10bd7dd4c3742ddc603fe24f898cba7eb0c6bc1777f8d9ac14185d34540c6d4d80cd9cae8a
@@ -23358,29 +15028,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"path-scurry@npm:^1.10.1, path-scurry@npm:^1.6.1":
-  version: 1.10.1
-  resolution: "path-scurry@npm:1.10.1"
+"path-scurry@npm:^1.11.1, path-scurry@npm:^1.6.1":
+  version: 1.11.1
+  resolution: "path-scurry@npm:1.11.1"
   dependencies:
-    lru-cache: ^9.1.1 || ^10.0.0
+    lru-cache: ^10.2.0
     minipass: ^5.0.0 || ^6.0.2 || ^7.0.0
-  checksum: e2557cff3a8fb8bc07afdd6ab163a92587884f9969b05bbbaf6fe7379348bfb09af9ed292af12ed32398b15fb443e81692047b786d1eeb6d898a51eb17ed7d90
-  languageName: node
-  linkType: hard
-
-"path-to-regexp@npm:0.1.7":
-  version: 0.1.7
-  resolution: "path-to-regexp@npm:0.1.7"
-  checksum: 69a14ea24db543e8b0f4353305c5eac6907917031340e5a8b37df688e52accd09e3cebfe1660b70d76b6bd89152f52183f28c74813dbf454ba1a01c82a38abce
+  checksum: 890d5abcd593a7912dcce7cf7c6bf7a0b5648e3dee6caf0712c126ca0a65c7f3d7b9d769072a4d1baf370f61ce493ab5b038d59988688e0c5f3f646ee3c69023
   languageName: node
   linkType: hard
 
-"path-to-regexp@npm:^1.7.0":
-  version: 1.8.0
-  resolution: "path-to-regexp@npm:1.8.0"
-  dependencies:
-    isarray: 0.0.1
-  checksum: 709f6f083c0552514ef4780cb2e7e4cf49b0cc89a97439f2b7cc69a608982b7690fb5d1720a7473a59806508fc2dae0be751ba49f495ecf89fd8fbc62abccbcd
+"path-to-regexp@npm:0.1.12":
+  version: 0.1.12
+  resolution: "path-to-regexp@npm:0.1.12"
+  checksum: ab237858bee7b25ecd885189f175ab5b5161e7b712b360d44f5c4516b8d271da3e4bf7bf0a7b9153ecb04c7d90ce8ff5158614e1208819cf62bac2b08452722e
   languageName: node
   linkType: hard
 
@@ -23391,51 +15052,40 @@ __metadata:
   languageName: node
   linkType: hard
 
-"pbkdf2@npm:^3.0.3":
-  version: 3.1.2
-  resolution: "pbkdf2@npm:3.1.2"
-  dependencies:
-    create-hash: ^1.1.2
-    create-hmac: ^1.1.4
-    ripemd160: ^2.0.1
-    safe-buffer: ^5.0.1
-    sha.js: ^2.4.8
-  checksum: 2c950a100b1da72123449208e231afc188d980177d021d7121e96a2de7f2abbc96ead2b87d03d8fe5c318face097f203270d7e27908af9f471c165a4e8e69c92
-  languageName: node
-  linkType: hard
-
-"performance-now@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "performance-now@npm:2.1.0"
-  checksum: 534e641aa8f7cba160f0afec0599b6cecefbb516a2e837b512be0adbe6c1da5550e89c78059c7fabc5c9ffdf6627edabe23eb7c518c4500067a898fa65c2b550
+"path-type@npm:^6.0.0":
+  version: 6.0.0
+  resolution: "path-type@npm:6.0.0"
+  checksum: b9f6eaf7795c48d5c9bc4c6bc3ac61315b8d36975a73497ab2e02b764c0836b71fb267ea541863153f633a069a1c2ed3c247cb781633842fc571c655ac57c00e
   languageName: node
   linkType: hard
 
-"picocolors@npm:^0.2.1":
-  version: 0.2.1
-  resolution: "picocolors@npm:0.2.1"
-  checksum: 3b0f441f0062def0c0f39e87b898ae7461c3a16ffc9f974f320b44c799418cabff17780ee647fda42b856a1dc45897e2c62047e1b546d94d6d5c6962f45427b2
+"picocolors@npm:^1.1.1":
+  version: 1.1.1
+  resolution: "picocolors@npm:1.1.1"
+  checksum: e1cf46bf84886c79055fdfa9dcb3e4711ad259949e3565154b004b260cd356c5d54b31a1437ce9782624bf766272fe6b0154f5f0c744fb7af5d454d2b60db045
   languageName: node
   linkType: hard
 
-"picocolors@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "picocolors@npm:1.0.0"
-  checksum: a2e8092dd86c8396bdba9f2b5481032848525b3dc295ce9b57896f931e63fc16f79805144321f72976383fc249584672a75cc18d6777c6b757603f372f745981
+"picomatch@npm:^2.0.4, picomatch@npm:^2.2.1, picomatch@npm:^2.3.1":
+  version: 2.3.1
+  resolution: "picomatch@npm:2.3.1"
+  checksum: 050c865ce81119c4822c45d3c84f1ced46f93a0126febae20737bd05ca20589c564d6e9226977df859ed5e03dc73f02584a2b0faad36e896936238238b0446cf
   languageName: node
   linkType: hard
 
-"picomatch@npm:^2.0.4, picomatch@npm:^2.2.1, picomatch@npm:^2.2.3":
-  version: 2.2.3
-  resolution: "picomatch@npm:2.2.3"
-  checksum: 45e2b882b5265d3a322c6b7b854c1fdc33d5083011b9730296e9ad26332824ac356529f1ce1b0c1111f08a84c02e8525ea121d17c4bbe2970ca6665e587921fa
+"picomatch@npm:^4.0.2":
+  version: 4.0.2
+  resolution: "picomatch@npm:4.0.2"
+  checksum: a7a5188c954f82c6585720e9143297ccd0e35ad8072231608086ca950bee672d51b0ef676254af0788205e59bd4e4deb4e7708769226bed725bf13370a7d1464
   languageName: node
   linkType: hard
 
-"picomatch@npm:^2.3.1":
-  version: 2.3.1
-  resolution: "picomatch@npm:2.3.1"
-  checksum: 050c865ce81119c4822c45d3c84f1ced46f93a0126febae20737bd05ca20589c564d6e9226977df859ed5e03dc73f02584a2b0faad36e896936238238b0446cf
+"pidtree@npm:^0.6.0":
+  version: 0.6.0
+  resolution: "pidtree@npm:0.6.0"
+  bin:
+    pidtree: bin/pidtree.js
+  checksum: 8fbc073ede9209dd15e80d616e65eb674986c93be49f42d9ddde8dbbd141bb53d628a7ca4e58ab5c370bb00383f67d75df59a9a226dede8fa801267a7030c27a
   languageName: node
   linkType: hard
 
@@ -23462,16 +15112,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"pkg-dir@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "pkg-dir@npm:3.0.0"
-  dependencies:
-    find-up: ^3.0.0
-  checksum: 70c9476ffefc77552cc6b1880176b71ad70bfac4f367604b2b04efd19337309a4eec985e94823271c7c0e83946fa5aeb18cd360d15d10a5d7533e19344bfa808
-  languageName: node
-  linkType: hard
-
-"pkg-dir@npm:^4.1.0":
+"pkg-dir@npm:^4.1.0, pkg-dir@npm:^4.2.0":
   version: 4.2.0
   resolution: "pkg-dir@npm:4.2.0"
   dependencies:
@@ -23480,6 +15121,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"pkg-entry-points@npm:^1.1.0":
+  version: 1.1.1
+  resolution: "pkg-entry-points@npm:1.1.1"
+  checksum: cf122530c2d05b8e14c202fcbd4c17f6f10ba3d16421bf9cf43fa7361f2205af4521278d70c3fef3a99cf04122a88daf21bec5f6eca3a067b762c2aa67dafdcd
+  languageName: node
+  linkType: hard
+
 "pkg-up@npm:^2.0.0":
   version: 2.0.0
   resolution: "pkg-up@npm:2.0.0"
@@ -23498,74 +15146,64 @@ __metadata:
   languageName: node
   linkType: hard
 
-"pkijs@npm:^2.2.2":
-  version: 2.2.2
-  resolution: "pkijs@npm:2.2.2"
+"pkijs@npm:~2.4.0":
+  version: 2.4.0
+  resolution: "pkijs@npm:2.4.0"
   dependencies:
-    asn1js: ^2.1.1
+    asn1js: ^3.0.3
     bytestreamjs: ^1.0.29
-    pvutils: ^1.0.17
-  checksum: 92664bc4b7378200f74d7faf32a80365058d79f22b27f9a83b10e1e7684892a17657ff65c106e7c48be6d79b76545149e949229ae42a6456d0e447b9872a26e5
-  languageName: node
-  linkType: hard
-
-"please-upgrade-node@npm:^3.2.0":
-  version: 3.2.0
-  resolution: "please-upgrade-node@npm:3.2.0"
-  dependencies:
-    semver-compare: ^1.0.0
-  checksum: d87c41581a2a022fbe25965a97006238cd9b8cbbf49b39f78d262548149a9d30bd2bdf35fec3d810e0001e630cd46ef13c7e19c389dea8de7e64db271a2381bb
+    pvutils: ^1.1.3
+  checksum: 0534d3ff4eb50ebe93818cc93a5190d78d4702ba55c0ffd270e10fddc58659b75f5d52b17ac0b100ad65757d595e5cc2985e646db4b295a09fb0c37eed58cae3
   languageName: node
   linkType: hard
 
 "portfinder@npm:^1.0.32":
-  version: 1.0.32
-  resolution: "portfinder@npm:1.0.32"
+  version: 1.0.37
+  resolution: "portfinder@npm:1.0.37"
   dependencies:
-    async: ^2.6.4
-    debug: ^3.2.7
-    mkdirp: ^0.5.6
-  checksum: 116b4aed1b9e16f6d5503823d966d9ffd41b1c2339e27f54c06cd2f3015a9d8ef53e2a53b57bc0a25af0885977b692007353aa28f9a0a98a44335cb50487240d
+    async: ^3.2.6
+    debug: ^4.3.6
+  checksum: 05fb2a8204ba342dfb3e152320455646fe944f0bafa1a0bec25495475133349bb803d238ae61d56845eeb40ba17428e64a1f04ee65084c4a468903246074872d
   languageName: node
   linkType: hard
 
-"posix-character-classes@npm:^0.1.0":
-  version: 0.1.1
-  resolution: "posix-character-classes@npm:0.1.1"
-  checksum: dedb99913c60625a16050cfed2fb5c017648fc075be41ac18474e1c6c3549ef4ada201c8bd9bd006d36827e289c571b6092e1ef6e756cdbab2fd7046b25c6442
+"possible-typed-array-names@npm:^1.0.0":
+  version: 1.1.0
+  resolution: "possible-typed-array-names@npm:1.1.0"
+  checksum: cfcd4f05264eee8fd184cd4897a17890561d1d473434b43ab66ad3673d9c9128981ec01e0cb1d65a52cd6b1eebfb2eae1e53e39b2e0eca86afc823ede7a4f41b
   languageName: node
   linkType: hard
 
 "postcss-modules-extract-imports@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "postcss-modules-extract-imports@npm:3.0.0"
+  version: 3.1.0
+  resolution: "postcss-modules-extract-imports@npm:3.1.0"
   peerDependencies:
     postcss: ^8.1.0
-  checksum: 4b65f2f1382d89c4bc3c0a1bdc5942f52f3cb19c110c57bd591ffab3a5fee03fcf831604168205b0c1b631a3dce2255c70b61aaae3ef39d69cd7eb450c2552d2
+  checksum: b9192e0f4fb3d19431558be6f8af7ca45fc92baaad9b2778d1732a5880cd25c3df2074ce5484ae491e224f0d21345ffc2d419bd51c25b019af76d7a7af88c17f
   languageName: node
   linkType: hard
 
 "postcss-modules-local-by-default@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "postcss-modules-local-by-default@npm:4.0.0"
+  version: 4.2.0
+  resolution: "postcss-modules-local-by-default@npm:4.2.0"
   dependencies:
     icss-utils: ^5.0.0
-    postcss-selector-parser: ^6.0.2
+    postcss-selector-parser: ^7.0.0
     postcss-value-parser: ^4.1.0
   peerDependencies:
     postcss: ^8.1.0
-  checksum: 6cf570badc7bc26c265e073f3ff9596b69bb954bc6ac9c5c1b8cba2995b80834226b60e0a3cbb87d5f399dbb52e6466bba8aa1d244f6218f99d834aec431a69d
+  checksum: 720d145453f82ad5f1c1d0ff7386d64722f0812808e4132e573c1a49909745e109fcce3792a0b0cb18770dbeb3d9741867e81c698dc8353a18bc664b7d6d9533
   languageName: node
   linkType: hard
 
 "postcss-modules-scope@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "postcss-modules-scope@npm:3.0.0"
+  version: 3.2.1
+  resolution: "postcss-modules-scope@npm:3.2.1"
   dependencies:
-    postcss-selector-parser: ^6.0.4
+    postcss-selector-parser: ^7.0.0
   peerDependencies:
     postcss: ^8.1.0
-  checksum: 330b9398dbd44c992c92b0dc612c0626135e2cc840fee41841eb61247a6cfed95af2bd6f67ead9dd9d0bb41f5b0367129d93c6e434fa3e9c58ade391d9a5a138
+  checksum: 085f65863bb7d8bf08209a979ceb22b2b07bb466574e0e698d34aaad832d614957bb05f2418348a14e4035f65e23b2be2951369d26ea429dd5762c6a020f0f7c
   languageName: node
   linkType: hard
 
@@ -23580,46 +15218,29 @@ __metadata:
   languageName: node
   linkType: hard
 
-"postcss-resolve-nested-selector@npm:^0.1.1":
-  version: 0.1.1
-  resolution: "postcss-resolve-nested-selector@npm:0.1.1"
-  checksum: b08fb76ab092a09ee01328bad620a01dcb445ac5eb02dd0ed9ed75217c2f779ecb3bf99a361c46e695689309c08c09f1a1ad7354c8d58c2c2c40d364657fcb08
+"postcss-resolve-nested-selector@npm:^0.1.6":
+  version: 0.1.6
+  resolution: "postcss-resolve-nested-selector@npm:0.1.6"
+  checksum: 85453901afe2a4db497b4e0d2c9cf2a097a08fa5d45bc646547025176217050334e423475519a1e6c74a1f31ade819d16bb37a39914e5321e250695ee3feea14
   languageName: node
   linkType: hard
 
-"postcss-safe-parser@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "postcss-safe-parser@npm:6.0.0"
+"postcss-safe-parser@npm:^7.0.1":
+  version: 7.0.1
+  resolution: "postcss-safe-parser@npm:7.0.1"
   peerDependencies:
-    postcss: ^8.3.3
-  checksum: 06c733eaad83a3954367e7ee02ddfe3796e7a44d4299ccf9239f40964a4daac153c7d77613f32964b5a86c0c6c2f6167738f31d578b73b17cb69d0c4446f0ebe
+    postcss: ^8.4.31
+  checksum: 285f30877f3ef5d43586432394ef4fcab904cd5bcfff5c26f586eb630fbee490abf2ac6d81e64fa212fb64d03630d12c2f3c5196f5637bec5ba3d043562ddf30
   languageName: node
   linkType: hard
 
-"postcss-selector-parser@npm:^6.0.13":
-  version: 6.0.13
-  resolution: "postcss-selector-parser@npm:6.0.13"
-  dependencies:
-    cssesc: ^3.0.0
-    util-deprecate: ^1.0.2
-  checksum: f89163338a1ce3b8ece8e9055cd5a3165e79a15e1c408e18de5ad8f87796b61ec2d48a2902d179ae0c4b5de10fccd3a325a4e660596549b040bc5ad1b465f096
-  languageName: node
-  linkType: hard
-
-"postcss-selector-parser@npm:^6.0.2, postcss-selector-parser@npm:^6.0.4":
-  version: 6.0.10
-  resolution: "postcss-selector-parser@npm:6.0.10"
+"postcss-selector-parser@npm:^7.0.0, postcss-selector-parser@npm:^7.1.0":
+  version: 7.1.0
+  resolution: "postcss-selector-parser@npm:7.1.0"
   dependencies:
     cssesc: ^3.0.0
     util-deprecate: ^1.0.2
-  checksum: 46afaa60e3d1998bd7adf6caa374baf857cc58d3ff944e29459c9a9e4680a7fe41597bd5b755fc81d7c388357e9bf67c0251d047c640a09f148e13606b8a8608
-  languageName: node
-  linkType: hard
-
-"postcss-value-parser@npm:^3.2.3":
-  version: 3.3.1
-  resolution: "postcss-value-parser@npm:3.3.1"
-  checksum: 62cd26e1cdbcf2dcc6bcedf3d9b409c9027bc57a367ae20d31dd99da4e206f730689471fd70a2abe866332af83f54dc1fa444c589e2381bf7f8054c46209ce16
+  checksum: 1300e7871dd60a5132ee5462cc6e94edd4f3df28462b2495ca9ff025bd83768a908e892a18fde62cae63ff63524641baa6d58c64120f04fe6884b916663ce737
   languageName: node
   linkType: hard
 
@@ -23630,36 +15251,41 @@ __metadata:
   languageName: node
   linkType: hard
 
-"postcss@npm:^6.0.1, postcss@npm:^6.0.17":
-  version: 6.0.23
-  resolution: "postcss@npm:6.0.23"
+"postcss@npm:^8.2.15, postcss@npm:^8.5.3":
+  version: 8.5.3
+  resolution: "postcss@npm:8.5.3"
   dependencies:
-    chalk: ^2.4.1
-    source-map: ^0.6.1
-    supports-color: ^5.4.0
-  checksum: cc6cb2c1dbcdefa6f57a71d67fe535c9e96543298bbe28f9a6a64c4f1e21b6127113890dd4cda8873d3f4e6613a0566b7b4bbb230204f3a9a309190bda065d81
+    nanoid: ^3.3.8
+    picocolors: ^1.1.1
+    source-map-js: ^1.2.1
+  checksum: da574620eb84ff60e65e1d8fc6bd5ad87a19101a23d0aba113c653434161543918229a0f673d89efb3b6d4906287eb04b957310dbcf4cbebacad9d1312711461
   languageName: node
   linkType: hard
 
-"postcss@npm:^8.2.15":
-  version: 8.4.14
-  resolution: "postcss@npm:8.4.14"
+"posthog-js@npm:^1.202.2":
+  version: 1.236.1
+  resolution: "posthog-js@npm:1.236.1"
   dependencies:
-    nanoid: ^3.3.4
-    picocolors: ^1.0.0
-    source-map-js: ^1.0.2
-  checksum: fe58766ff32e4becf65a7d57678995cfd239df6deed2fe0557f038b47c94e4132e7e5f68b5aa820c13adfec32e523b693efaeb65798efb995ce49ccd83953816
+    core-js: ^3.38.1
+    fflate: ^0.4.8
+    preact: ^10.19.3
+    web-vitals: ^4.2.4
+  peerDependencies:
+    "@rrweb/types": 2.0.0-alpha.17
+    rrweb-snapshot: 2.0.0-alpha.17
+  peerDependenciesMeta:
+    "@rrweb/types":
+      optional: true
+    rrweb-snapshot:
+      optional: true
+  checksum: 114f30c71024c425ce31625f1de7ca154feb6bb18a42be439b9595bccc8e8e4c71ba9c075f3215a68d6dadf3168f69a3cc38ffcc1260dd9ec56efc1881c50ca4
   languageName: node
   linkType: hard
 
-"postcss@npm:^8.4.24":
-  version: 8.4.26
-  resolution: "postcss@npm:8.4.26"
-  dependencies:
-    nanoid: ^3.3.6
-    picocolors: ^1.0.0
-    source-map-js: ^1.0.2
-  checksum: 1cf08ee10d58cbe98f94bf12ac49a5e5ed1588507d333d2642aacc24369ca987274e1f60ff4cbf0081f70d2ab18a5cd3a4a273f188d835b8e7f3ba381b184e57
+"preact@npm:^10.19.3":
+  version: 10.26.5
+  resolution: "preact@npm:10.26.5"
+  checksum: 3ef769e82bdb26314e51f02d09aea9ba566cad291504a5d79833055b1ff3ca7db647516315d2278498261881c61949917aac05cc56f172c32d013796378c304b
   languageName: node
   linkType: hard
 
@@ -23670,23 +15296,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"prelude-ls@npm:~1.1.2":
-  version: 1.1.2
-  resolution: "prelude-ls@npm:1.1.2"
-  checksum: c4867c87488e4a0c233e158e4d0d5565b609b105d75e4c05dc760840475f06b731332eb93cc8c9cecb840aa8ec323ca3c9a56ad7820ad2e63f0261dadcb154e4
-  languageName: node
-  linkType: hard
-
-"pretender@npm:^3.4.3":
-  version: 3.4.3
-  resolution: "pretender@npm:3.4.3"
-  dependencies:
-    fake-xml-http-request: ^2.1.1
-    route-recognizer: ^0.3.3
-  checksum: 2ac03977f489eb79882f1fd4bcfb949f6ca6226fd95f366ec35a73590bd76b52fc283e7d8e5a8e649982619097849a4240dce138afad9089b407b1feba5df4a3
-  languageName: node
-  linkType: hard
-
 "pretender@npm:^3.4.7":
   version: 3.4.7
   resolution: "pretender@npm:3.4.7"
@@ -23697,7 +15306,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"prettier-eslint-cli@npm:^7.1.0":
+"prettier-eslint-cli@npm:~7.1.0":
   version: 7.1.0
   resolution: "prettier-eslint-cli@npm:7.1.0"
   dependencies:
@@ -23739,21 +15348,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"prettier@npm:2.8.7":
-  version: 2.8.7
-  resolution: "prettier@npm:2.8.7"
+"prettier@npm:3.0.3":
+  version: 3.0.3
+  resolution: "prettier@npm:3.0.3"
   bin:
-    prettier: bin-prettier.js
-  checksum: fdc8f2616f099f5f0d685907f4449a70595a0fc1d081a88919604375989e0d5e9168d6121d8cc6861f21990b31665828e00472544d785d5940ea08a17660c3a6
+    prettier: bin/prettier.cjs
+  checksum: e10b9af02b281f6c617362ebd2571b1d7fc9fb8a3bd17e371754428cda992e5e8d8b7a046e8f7d3e2da1dcd21aa001e2e3c797402ebb6111b5cd19609dd228e0
   languageName: node
   linkType: hard
 
 "prettier@npm:^2.5.1":
-  version: 2.7.1
-  resolution: "prettier@npm:2.7.1"
+  version: 2.8.8
+  resolution: "prettier@npm:2.8.8"
   bin:
     prettier: bin-prettier.js
-  checksum: 55a4409182260866ab31284d929b3cb961e5fdb91fe0d2e099dac92eaecec890f36e524b4c19e6ceae839c99c6d7195817579cdffc8e2c80da0cb794463a748b
+  checksum: b49e409431bf129dd89238d64299ba80717b57ff5a6d1c1a8b1a28b590d998a34e083fa13573bc732bb8d2305becb4c9a4407f8486c81fa7d55100eb08263cf8
   languageName: node
   linkType: hard
 
@@ -23767,15 +15376,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"pretty-ms@npm:^3.1.0":
-  version: 3.2.0
-  resolution: "pretty-ms@npm:3.2.0"
-  dependencies:
-    parse-ms: ^1.0.0
-  checksum: 705030a262353abfeda1c765bd1f5269c06dc7777536bdd5f8cebc84f0d012aaca679ca6fc5ea4a84c915e967dce4ab4b6489693abb05dd58e7a9802747736a3
-  languageName: node
-  linkType: hard
-
 "printf@npm:^0.6.1":
   version: 0.6.1
   resolution: "printf@npm:0.6.1"
@@ -23783,14 +15383,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"prismjs@npm:^1.21.0":
-  version: 1.29.0
-  resolution: "prismjs@npm:1.29.0"
-  checksum: 007a8869d4456ff8049dc59404e32d5666a07d99c3b0e30a18bd3b7676dfa07d1daae9d0f407f20983865fd8da56de91d09cb08e6aa61f5bc420a27c0beeaf93
+"prismjs@npm:1.30.0":
+  version: 1.30.0
+  resolution: "prismjs@npm:1.30.0"
+  checksum: a68eddd4c5f1c506badb5434b0b28a7cc2479ed1df91bc4218e6833c7971ef40c50ec481ea49749ac964256acb78d8b66a6bd11554938e8998e46c18b5f9a580
   languageName: node
   linkType: hard
 
-"private@npm:^0.1.6, private@npm:^0.1.8":
+"private@npm:^0.1.8":
   version: 0.1.8
   resolution: "private@npm:0.1.8"
   checksum: a00abd713d25389f6de7294f0e7879b8a5d09a9ec5fd81cc2f21b29d4f9a80ec53bc4222927d3a281d4aadd4cd373d9a28726fca3935921950dc75fd71d1fdbb
@@ -23804,33 +15404,19 @@ __metadata:
   languageName: node
   linkType: hard
 
-"process-nextick-args@npm:~2.0.0":
-  version: 2.0.1
-  resolution: "process-nextick-args@npm:2.0.1"
-  checksum: 1d38588e520dab7cea67cbbe2efdd86a10cc7a074c09657635e34f035277b59fbb57d09d8638346bf7090f8e8ebc070c96fa5fd183b777fff4f5edff5e9466cf
+"proc-log@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "proc-log@npm:5.0.0"
+  checksum: c78b26ecef6d5cce4a7489a1e9923d7b4b1679028c8654aef0463b27f4a90b0946cd598f55799da602895c52feb085ec76381d007ab8dcceebd40b89c2f9dfe0
   languageName: node
   linkType: hard
 
 "process-relative-require@npm:^1.0.0":
   version: 1.0.0
   resolution: "process-relative-require@npm:1.0.0"
-  dependencies:
-    node-modules-path: ^1.0.0
-  checksum: 659265a7dad2329edd0483d36b7e25f61f8663901b74dd672ebd0bb5248494156b2892f0860ef0574049a235423183996656bee052ce2212fef2fbc61034df7e
-  languageName: node
-  linkType: hard
-
-"process@npm:^0.11.10":
-  version: 0.11.10
-  resolution: "process@npm:0.11.10"
-  checksum: bfcce49814f7d172a6e6a14d5fa3ac92cc3d0c3b9feb1279774708a719e19acd673995226351a082a9ae99978254e320ccda4240ddc474ba31a76c79491ca7c3
-  languageName: node
-  linkType: hard
-
-"promise-inflight@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "promise-inflight@npm:1.0.1"
-  checksum: 22749483091d2c594261517f4f80e05226d4d5ecc1fc917e1886929da56e22b5718b7f2a75f3807e7a7d471bc3be2907fe92e6e8f373ddf5c64bae35b5af3981
+  dependencies:
+    node-modules-path: ^1.0.0
+  checksum: 659265a7dad2329edd0483d36b7e25f61f8663901b74dd672ebd0bb5248494156b2892f0860ef0574049a235423183996656bee052ce2212fef2fbc61034df7e
   languageName: node
   linkType: hard
 
@@ -23868,13 +15454,15 @@ __metadata:
   linkType: hard
 
 "promise.prototype.finally@npm:^3.1.0":
-  version: 3.1.3
-  resolution: "promise.prototype.finally@npm:3.1.3"
+  version: 3.1.8
+  resolution: "promise.prototype.finally@npm:3.1.8"
   dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.3
-    es-abstract: ^1.19.1
-  checksum: aba8af6ae8d076e2c344d2674409b44c8f98b3aba98b78619739aeb4a74ebac80dbba5f9338da7cf0108a34384799d3996c46697d2e21c6e998c04d68041213c
+    call-bind: ^1.0.5
+    define-properties: ^1.2.1
+    es-abstract: ^1.22.3
+    es-errors: ^1.0.0
+    set-function-name: ^2.0.1
+  checksum: 43b2913292d501431cbc855a14b0318ec677d5e621a93b28e047e55618d0d01152d54a1d7dd3829d6a73b289d7779d74466db6a629e698c7f7475f139baadeda
   languageName: node
   linkType: hard
 
@@ -23889,13 +15477,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"proxy-addr@npm:~2.0.5":
-  version: 2.0.6
-  resolution: "proxy-addr@npm:2.0.6"
+"property-information@npm:^5.0.0":
+  version: 5.6.0
+  resolution: "property-information@npm:5.6.0"
   dependencies:
-    forwarded: ~0.1.2
-    ipaddr.js: 1.9.1
-  checksum: 2bad9b7a56b847faf606a19328aaaf5fca3e561ebb4e933969a580d94a20f77e74fb21196028a6e417851b3d9d95a0c704732a3362e3ef515d45d96859ac7eb9
+    xtend: ^4.0.0
+  checksum: fcf87c6542e59a8bbe31ca0b3255a4a63ac1059b01b04469680288998bcfa97f341ca989566adbb63975f4d85339030b82320c324a511532d390910d1c583893
   languageName: node
   linkType: hard
 
@@ -23909,120 +15496,61 @@ __metadata:
   languageName: node
   linkType: hard
 
-"prr@npm:~1.0.1":
-  version: 1.0.1
-  resolution: "prr@npm:1.0.1"
-  checksum: 3bca2db0479fd38f8c4c9439139b0c42dcaadcc2fbb7bb8e0e6afaa1383457f1d19aea9e5f961d5b080f1cfc05bfa1fe9e45c97a1d3fd6d421950a73d3108381
-  languageName: node
-  linkType: hard
-
-"psl@npm:^1.1.28, psl@npm:^1.1.33":
-  version: 1.8.0
-  resolution: "psl@npm:1.8.0"
-  checksum: 6150048ed2da3f919478bee8a82f3828303bc0fc730fb015a48f83c9977682c7b28c60ab01425a72d82a2891a1681627aa530a991d50c086b48a3be27744bde7
-  languageName: node
-  linkType: hard
-
-"public-encrypt@npm:^4.0.0":
-  version: 4.0.3
-  resolution: "public-encrypt@npm:4.0.3"
-  dependencies:
-    bn.js: ^4.1.0
-    browserify-rsa: ^4.0.0
-    create-hash: ^1.1.0
-    parse-asn1: ^5.0.0
-    randombytes: ^2.0.1
-    safe-buffer: ^5.1.2
-  checksum: 215d446e43cef021a20b67c1df455e5eea134af0b1f9b8a35f9e850abf32991b0c307327bc5b9bc07162c288d5cdb3d4a783ea6c6640979ed7b5017e3e0c9935
-  languageName: node
-  linkType: hard
-
-"pump@npm:^2.0.0":
-  version: 2.0.1
-  resolution: "pump@npm:2.0.1"
-  dependencies:
-    end-of-stream: ^1.1.0
-    once: ^1.3.1
-  checksum: e9f26a17be00810bff37ad0171edb35f58b242487b0444f92fb7d78bc7d61442fa9b9c5bd93a43fd8fd8ddd3cc75f1221f5e04c790f42907e5baab7cf5e2b931
-  languageName: node
-  linkType: hard
-
 "pump@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "pump@npm:3.0.0"
+  version: 3.0.2
+  resolution: "pump@npm:3.0.2"
   dependencies:
     end-of-stream: ^1.1.0
     once: ^1.3.1
-  checksum: e42e9229fba14732593a718b04cb5e1cfef8254544870997e0ecd9732b189a48e1256e4e5478148ecb47c8511dca2b09eae56b4d0aad8009e6fac8072923cfc9
-  languageName: node
-  linkType: hard
-
-"pumpify@npm:^1.3.3":
-  version: 1.5.1
-  resolution: "pumpify@npm:1.5.1"
-  dependencies:
-    duplexify: ^3.6.0
-    inherits: ^2.0.3
-    pump: ^2.0.0
-  checksum: 26ca412ec8d665bd0d5e185c1b8f627728eff603440d75d22a58e421e3c66eaf86ec6fc6a6efc54808ecef65979279fa8e99b109a23ec1fa8d79f37e6978c9bd
-  languageName: node
-  linkType: hard
-
-"punycode@npm:1.3.2":
-  version: 1.3.2
-  resolution: "punycode@npm:1.3.2"
-  checksum: b8807fd594b1db33335692d1f03e8beeddde6fda7fbb4a2e32925d88d20a3aa4cd8dcc0c109ccaccbd2ba761c208dfaaada83007087ea8bfb0129c9ef1b99ed6
+  checksum: e0c4216874b96bd25ddf31a0b61a5613e26cc7afa32379217cf39d3915b0509def3565f5f6968fafdad2894c8bbdbd67d340e84f3634b2a29b950cffb6442d9f
   languageName: node
   linkType: hard
 
-"punycode@npm:^1.2.4":
-  version: 1.4.1
-  resolution: "punycode@npm:1.4.1"
-  checksum: fa6e698cb53db45e4628559e557ddaf554103d2a96a1d62892c8f4032cd3bc8871796cae9eabc1bc700e2b6677611521ce5bb1d9a27700086039965d0cf34518
+"punycode.js@npm:^2.3.1":
+  version: 2.3.1
+  resolution: "punycode.js@npm:2.3.1"
+  checksum: 13466d7ed5e8dacdab8c4cc03837e7dd14218a59a40eb14a837f1f53ca396e18ef2c4ee6d7766b8ed2fc391d6a3ac489eebf2de83b3596f5a54e86df4a251b72
   languageName: node
   linkType: hard
 
-"punycode@npm:^2.1.0, punycode@npm:^2.1.1":
-  version: 2.1.1
-  resolution: "punycode@npm:2.1.1"
-  checksum: 823bf443c6dd14f669984dea25757b37993f67e8d94698996064035edd43bed8a5a17a9f12e439c2b35df1078c6bec05a6c86e336209eb1061e8025c481168e8
+"punycode@npm:^2.1.0":
+  version: 2.3.1
+  resolution: "punycode@npm:2.3.1"
+  checksum: bb0a0ceedca4c3c57a9b981b90601579058903c62be23c5e8e843d2c2d4148a3ecf029d5133486fb0e1822b098ba8bba09e89d6b21742d02fa26bda6441a6fb2
   languageName: node
   linkType: hard
 
-"pvutils@latest, pvutils@npm:^1.0.17":
-  version: 1.0.17
-  resolution: "pvutils@npm:1.0.17"
-  checksum: 370cc6c7ed2cddeb97e85339f4cac06cc07e3195774b0b8707a7994db0acd73451745cc57209a2bc6d4138b9b14d5ab0335e3614743a91010a74db597428dfe8
+"pvtsutils@npm:^1.3.6":
+  version: 1.3.6
+  resolution: "pvtsutils@npm:1.3.6"
+  dependencies:
+    tslib: ^2.8.1
+  checksum: 97b023b46d7b95bff004f8340efc465c1d995f35d7e97a2ef2e28d5e160f5ca47b48f42463b6be92b4341452a6b8c555feb2b1eb59ee90b97bd5d6fc86ffb186
   languageName: node
   linkType: hard
 
-"q@npm:^1.1.2":
-  version: 1.5.1
-  resolution: "q@npm:1.5.1"
-  checksum: 147baa93c805bc1200ed698bdf9c72e9e42c05f96d007e33a558b5fdfd63e5ea130e99313f28efc1783e90e6bdb4e48b67a36fcc026b7b09202437ae88a1fb12
+"pvutils@npm:^1.1.3, pvutils@npm:~1.1.3":
+  version: 1.1.3
+  resolution: "pvutils@npm:1.1.3"
+  checksum: 2ee26a9e5176c348977d6ec00d8ee80bff62f51743b1c5fe8abeeb4c5d29d9959cdfe0ce146707a9e6801bce88190fed3002d720b072dc87d031c692820b44c9
   languageName: node
   linkType: hard
 
-"qs@npm:^6.3.0":
-  version: 6.10.1
-  resolution: "qs@npm:6.10.1"
+"qs@npm:6.13.0":
+  version: 6.13.0
+  resolution: "qs@npm:6.13.0"
   dependencies:
-    side-channel: ^1.0.4
-  checksum: 00e390dbf98eff4d8ff121b61ab2fe32106852290de99ecd0e40fc76651c4101f43fc6cc8313cb69423563876fc532951b11dda55d2917def05f292258263480
+    side-channel: ^1.0.6
+  checksum: e9404dc0fc2849245107108ce9ec2766cde3be1b271de0bf1021d049dc5b98d1a2901e67b431ac5509f865420a7ed80b7acb3980099fe1c118a1c5d2e1432ad8
   languageName: node
   linkType: hard
 
-"querystring-es3@npm:^0.2.0":
-  version: 0.2.1
-  resolution: "querystring-es3@npm:0.2.1"
-  checksum: 691e8d6b8b157e7cd49ae8e83fcf86de39ab3ba948c25abaa94fba84c0986c641aa2f597770848c64abce290ed17a39c9df6df737dfa7e87c3b63acc7d225d61
-  languageName: node
-  linkType: hard
-
-"querystring@npm:0.2.0":
-  version: 0.2.0
-  resolution: "querystring@npm:0.2.0"
-  checksum: 8258d6734f19be27e93f601758858c299bdebe71147909e367101ba459b95446fbe5b975bf9beb76390156a592b6f4ac3a68b6087cea165c259705b8b4e56a69
+"qs@npm:^6.4.0":
+  version: 6.14.0
+  resolution: "qs@npm:6.14.0"
+  dependencies:
+    side-channel: ^1.1.0
+  checksum: 189b52ad4e9a0da1a16aff4c58b2a554a8dad9bd7e287c7da7446059b49ca2e33a49e570480e8be406b87fccebf134f51c373cbce36c8c83859efa0c9b71d635
   languageName: node
   linkType: hard
 
@@ -24051,32 +15579,36 @@ __metadata:
   languageName: node
   linkType: hard
 
-"qunit-dom@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "qunit-dom@npm:2.0.0"
+"qunit-dom@npm:~3.4.0":
+  version: 3.4.0
+  resolution: "qunit-dom@npm:3.4.0"
   dependencies:
-    broccoli-funnel: ^3.0.3
-    broccoli-merge-trees: ^4.2.0
-    ember-cli-babel: ^7.23.0
-    ember-cli-version-checker: ^5.1.1
-  checksum: f9f06ad19adaaa4f8f107f28fd3feacd65b26d4de647d08b11a844b750ebbed2adbeabab52edc9d8cda2b0b7a0e08812425a5d4698b34f1b2a9af7b6f53b8413
+    dom-element-descriptors: ^0.5.1
+  checksum: e657b085c493a25afea84a6ce4762a41249140b11e37b94faf3e728cdc5b95ebaa77b33aebeac3cd320f22b488c6eed78e657060c271fe6cb5a63e226fa92d87
+  languageName: node
+  linkType: hard
+
+"qunit-theme-ember@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "qunit-theme-ember@npm:1.0.0"
+  checksum: c3f263763f135ae8bbe0592093b12e71af0e1575fbb503889d77b01f9af751ed0ad1d6bfbd22fc76dde8cf30ff4bd34763e411a28eac97f85208af7f178e75e9
   languageName: node
   linkType: hard
 
-"qunit@npm:^2.19.4":
-  version: 2.19.4
-  resolution: "qunit@npm:2.19.4"
+"qunit@npm:~2.24.1":
+  version: 2.24.1
+  resolution: "qunit@npm:2.24.1"
   dependencies:
     commander: 7.2.0
     node-watch: 0.7.3
     tiny-glob: 0.2.9
   bin:
     qunit: bin/qunit.js
-  checksum: 626001f82881e91f3bff2688bc55948a570bd8bf7aea7c9e7836285f1ab0a7a3577296f3b37cce21e182dcd724d14ee439fa39961348a603fbe5a6d5ffc144ef
+  checksum: 0f12915dd21d1a10e7f8e3ac09f73333f3e09cbda11b2a8f23a01a5fd2ea069da10292aaf0112a05754eaa0801d25906a61ecc6a364c9248abcd0c05d499bc7e
   languageName: node
   linkType: hard
 
-"randombytes@npm:^2.0.0, randombytes@npm:^2.0.1, randombytes@npm:^2.0.5, randombytes@npm:^2.1.0":
+"randombytes@npm:^2.1.0":
   version: 2.1.0
   resolution: "randombytes@npm:2.1.0"
   dependencies:
@@ -24085,16 +15617,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"randomfill@npm:^1.0.3":
-  version: 1.0.4
-  resolution: "randomfill@npm:1.0.4"
-  dependencies:
-    randombytes: ^2.0.5
-    safe-buffer: ^5.1.0
-  checksum: 33734bb578a868d29ee1b8555e21a36711db084065d94e019a6d03caa67debef8d6a1bfd06a2b597e32901ddc761ab483a85393f0d9a75838f1912461d4dbfc7
-  languageName: node
-  linkType: hard
-
 "range-parser@npm:~1.2.1":
   version: 1.2.1
   resolution: "range-parser@npm:1.2.1"
@@ -24102,30 +15624,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"raw-body@npm:2.4.0":
-  version: 2.4.0
-  resolution: "raw-body@npm:2.4.0"
-  dependencies:
-    bytes: 3.1.0
-    http-errors: 1.7.2
-    iconv-lite: 0.4.24
-    unpipe: 1.0.0
-  checksum: 6343906939e018c6e633a34a938a5d6d1e93ffcfa48646e00207d53b418e941953b521473950c079347220944dc75ba10e7b3c08bf97e3ac72c7624882db09bb
-  languageName: node
-  linkType: hard
-
-"raw-body@npm:2.5.1":
-  version: 2.5.1
-  resolution: "raw-body@npm:2.5.1"
-  dependencies:
-    bytes: 3.1.2
-    http-errors: 2.0.0
-    iconv-lite: 0.4.24
-    unpipe: 1.0.0
-  checksum: 5362adff1575d691bb3f75998803a0ffed8c64eabeaa06e54b4ada25a0cd1b2ae7f4f5ec46565d1bec337e08b5ac90c76eaa0758de6f72a633f025d754dec29e
-  languageName: node
-  linkType: hard
-
 "raw-body@npm:2.5.2":
   version: 2.5.2
   resolution: "raw-body@npm:2.5.2"
@@ -24148,65 +15646,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"read-pkg-up@npm:^8.0.0":
-  version: 8.0.0
-  resolution: "read-pkg-up@npm:8.0.0"
-  dependencies:
-    find-up: ^5.0.0
-    read-pkg: ^6.0.0
-    type-fest: ^1.0.1
-  checksum: fe4c80401656b40b408884457fffb5a8015c03b1018cfd8e48f8d82a5e9023e24963603aeb2755608d964593e046c15b34d29b07d35af9c7aa478be81805209c
-  languageName: node
-  linkType: hard
-
-"read-pkg@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "read-pkg@npm:6.0.0"
-  dependencies:
-    "@types/normalize-package-data": ^2.4.0
-    normalize-package-data: ^3.0.2
-    parse-json: ^5.2.0
-    type-fest: ^1.0.1
-  checksum: 0cebdff381128e923815c643074a87011070e5fc352bee575d327d6485da3317fab6d802a7b03deeb0be7be8d3ad1640397b3d5d2f044452caf4e8d1736bf94f
-  languageName: node
-  linkType: hard
-
-"readable-stream@npm:1 || 2, readable-stream@npm:^2.0.0, readable-stream@npm:^2.0.1, readable-stream@npm:^2.0.2, readable-stream@npm:^2.1.5, readable-stream@npm:^2.2.2, readable-stream@npm:^2.3.3, readable-stream@npm:^2.3.6, readable-stream@npm:~2.3.6":
-  version: 2.3.7
-  resolution: "readable-stream@npm:2.3.7"
-  dependencies:
-    core-util-is: ~1.0.0
-    inherits: ~2.0.3
-    isarray: ~1.0.0
-    process-nextick-args: ~2.0.0
-    safe-buffer: ~5.1.1
-    string_decoder: ~1.1.1
-    util-deprecate: ~1.0.1
-  checksum: e4920cf7549a60f8aaf694d483a0e61b2a878b969d224f89b3bc788b8d920075132c4b55a7494ee944c7b6a9a0eada28a7f6220d80b0312ece70bbf08eeca755
-  languageName: node
-  linkType: hard
-
 "readable-stream@npm:2 || 3, readable-stream@npm:^3.4.0, readable-stream@npm:^3.6.0":
-  version: 3.6.0
-  resolution: "readable-stream@npm:3.6.0"
+  version: 3.6.2
+  resolution: "readable-stream@npm:3.6.2"
   dependencies:
     inherits: ^2.0.3
     string_decoder: ^1.1.1
     util-deprecate: ^1.0.1
-  checksum: d4ea81502d3799439bb955a3a5d1d808592cf3133350ed352aeaa499647858b27b1c4013984900238b0873ec8d0d8defce72469fb7a83e61d53f5ad61cb80dc8
-  languageName: node
-  linkType: hard
-
-"readable-stream@npm:^4.1.0":
-  version: 4.5.2
-  resolution: "readable-stream@npm:4.5.2"
-  dependencies:
-    abort-controller: ^3.0.0
-    buffer: ^6.0.3
-    events: ^3.3.0
-    process: ^0.11.10
-    string_decoder: ^1.3.0
-  checksum: c4030ccff010b83e4f33289c535f7830190773e274b3fcb6e2541475070bdfd69c98001c3b0cb78763fc00c8b62f514d96c2b10a8bd35d5ce45203a25fa1d33a
+  checksum: bdcbe6c22e846b6af075e32cf8f4751c2576238c5043169a1c221c92ee2878458a816a4ea33f4c67623c0b6827c8a400409bfb3cf0bf3381392d0b1dfb52ac8d
   languageName: node
   linkType: hard
 
@@ -24222,23 +15669,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"readdirp@npm:^2.2.1":
-  version: 2.2.1
-  resolution: "readdirp@npm:2.2.1"
-  dependencies:
-    graceful-fs: ^4.1.11
-    micromatch: ^3.1.10
-    readable-stream: ^2.0.2
-  checksum: 3879b20f1a871e0e004a14fbf1776e65ee0b746a62f5a416010808b37c272ac49b023c47042c7b1e281cba75a449696635bc64c397ed221ea81d853a8f2ed79a
-  languageName: node
-  linkType: hard
-
-"readdirp@npm:~3.5.0":
-  version: 3.5.0
-  resolution: "readdirp@npm:3.5.0"
-  dependencies:
-    picomatch: ^2.2.1
-  checksum: 6b1a9341e295e15d4fb40c010216cbcb6266587cd0b3ce7defabd66fa1b4e35f9fba3d64c2187fd38fadd01ccbfc5f1b33fdfb1da63b3cbf66224b7c6d75ce5a
+"readdirp@npm:^4.0.1":
+  version: 4.1.2
+  resolution: "readdirp@npm:4.1.2"
+  checksum: 3242ee125422cb7c0e12d51452e993f507e6ed3d8c490bc8bf3366c5cdd09167562224e429b13e9cb2b98d4b8b2b11dc100d3c73883aa92d657ade5a21ded004
   languageName: node
   linkType: hard
 
@@ -24263,13 +15697,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"redent@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "redent@npm:4.0.0"
+"rechoir@npm:^0.8.0":
+  version: 0.8.0
+  resolution: "rechoir@npm:0.8.0"
   dependencies:
-    indent-string: ^5.0.0
-    strip-indent: ^4.0.0
-  checksum: 6944e7b1d8f3fd28c2515f5c605b9f7f0ea0f4edddf41890bbbdd4d9ee35abb7540c3b278f03ff827bd278bb6ff4a5bd8692ca406b748c5c1c3ce7355e9fbf8f
+    resolve: ^1.20.0
+  checksum: ad3caed8afdefbc33fbc30e6d22b86c35b3d51c2005546f4e79bcc03c074df804b3640ad18945e6bef9ed12caedc035655ec1082f64a5e94c849ff939dc0a788
   languageName: node
   linkType: hard
 
@@ -24282,273 +15715,141 @@ __metadata:
   languageName: node
   linkType: hard
 
-"regenerate-unicode-properties@npm:^10.0.1":
-  version: 10.0.1
-  resolution: "regenerate-unicode-properties@npm:10.0.1"
-  dependencies:
-    regenerate: ^1.4.2
-  checksum: 1b638b7087d8143e5be3e20e2cda197ea0440fa0bc2cc49646b2f50c5a2b1acdc54b21e4215805a5a2dd487c686b2291accd5ad00619534098d2667e76247754
-  languageName: node
-  linkType: hard
-
-"regenerate-unicode-properties@npm:^10.1.0":
-  version: 10.1.1
-  resolution: "regenerate-unicode-properties@npm:10.1.1"
-  dependencies:
-    regenerate: ^1.4.2
-  checksum: b80958ef40f125275824c2c47d5081dfaefebd80bff26c76761e9236767c748a4a95a69c053fe29d2df881177f2ca85df4a71fe70a82360388b31159ef19adcf
-  languageName: node
-  linkType: hard
-
-"regenerate-unicode-properties@npm:^9.0.0":
-  version: 9.0.0
-  resolution: "regenerate-unicode-properties@npm:9.0.0"
-  dependencies:
-    regenerate: ^1.4.2
-  checksum: 62df21c274259a68c6fa1373e5ddb4d6f6374ad72c08dd488b7802880bc1c3b6de716303ec56c9f793a73d01815e9d81f03a8fbe3f32bc0f7fdf8d70d4841b64
-  languageName: node
-  linkType: hard
-
-"regenerate@npm:^1.2.1, regenerate@npm:^1.4.2":
-  version: 1.4.2
-  resolution: "regenerate@npm:1.4.2"
-  checksum: 3317a09b2f802da8db09aa276e469b57a6c0dd818347e05b8862959c6193408242f150db5de83c12c3fa99091ad95fb42a6db2c3329bfaa12a0ea4cbbeb30cb0
-  languageName: node
-  linkType: hard
-
-"regenerator-runtime@npm:^0.10.5":
-  version: 0.10.5
-  resolution: "regenerator-runtime@npm:0.10.5"
-  checksum: 35b33dbe5381d268b2be98f4ee4b028702acb38b012bff90723df067f915a337e5c979cce4dab4ed23febb223bbebb8820d46902f897742c55818c22c14e2a7c
-  languageName: node
-  linkType: hard
-
-"regenerator-runtime@npm:^0.11.0":
-  version: 0.11.1
-  resolution: "regenerator-runtime@npm:0.11.1"
-  checksum: 3c97bd2c7b2b3247e6f8e2147a002eb78c995323732dad5dc70fac8d8d0b758d0295e7015b90d3d444446ae77cbd24b9f9123ec3a77018e81d8999818301b4f4
-  languageName: node
-  linkType: hard
-
-"regenerator-runtime@npm:^0.13.11":
-  version: 0.13.11
-  resolution: "regenerator-runtime@npm:0.13.11"
-  checksum: 27481628d22a1c4e3ff551096a683b424242a216fee44685467307f14d58020af1e19660bf2e26064de946bad7eff28950eae9f8209d55723e2d9351e632bbb4
-  languageName: node
-  linkType: hard
-
-"regenerator-runtime@npm:^0.13.4":
-  version: 0.13.9
-  resolution: "regenerator-runtime@npm:0.13.9"
-  checksum: 65ed455fe5afd799e2897baf691ca21c2772e1a969d19bb0c4695757c2d96249eb74ee3553ea34a91062b2a676beedf630b4c1551cc6299afb937be1426ec55e
-  languageName: node
-  linkType: hard
-
-"regenerator-runtime@npm:^0.14.0":
-  version: 0.14.0
-  resolution: "regenerator-runtime@npm:0.14.0"
-  checksum: 1c977ad82a82a4412e4f639d65d22be376d3ebdd30da2c003eeafdaaacd03fc00c2320f18120007ee700900979284fc78a9f00da7fb593f6e6eeebc673fba9a3
-  languageName: node
-  linkType: hard
-
-"regenerator-transform@npm:^0.10.0":
-  version: 0.10.1
-  resolution: "regenerator-transform@npm:0.10.1"
-  dependencies:
-    babel-runtime: ^6.18.0
-    babel-types: ^6.19.0
-    private: ^0.1.6
-  checksum: bd366a3b0fa0d0975c48fb9eff250363a9ab28c25b472ecdc397bb19a836746640a30d8f641718a895f9178564bd8a01a0179a9c8e5813f76fc29e62a115d9d7
-  languageName: node
-  linkType: hard
-
-"regenerator-transform@npm:^0.14.2":
-  version: 0.14.5
-  resolution: "regenerator-transform@npm:0.14.5"
-  dependencies:
-    "@babel/runtime": ^7.8.4
-  checksum: a467a3b652b4ec26ff964e9c5f1817523a73fc44cb928b8d21ff11aebeac5d10a84d297fe02cea9f282bcec81a0b0d562237da69ef0f40a0160b30a4fa98bc94
+"reduce-flatten@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "reduce-flatten@npm:1.0.1"
+  checksum: 5e5a450500ece8dfff95ecd0b34f48941084c00fdc63e6a4413f758334d2d3f8b4d725670896c04853c477c062af03402aeb5e145b948e03abc914ee51bb3b89
   languageName: node
   linkType: hard
 
-"regenerator-transform@npm:^0.15.0":
-  version: 0.15.0
-  resolution: "regenerator-transform@npm:0.15.0"
-  dependencies:
-    "@babel/runtime": ^7.8.4
-  checksum: 86e54849ab1167618d28bb56d214c52a983daf29b0d115c976d79840511420049b6b42c9ebdf187defa8e7129bdd74b6dd266420d0d3868c9fa7f793b5d15d49
+"reduce-flatten@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "reduce-flatten@npm:3.0.1"
+  checksum: d46b9c93a12c2ad6275d6c50e2599778870d3e55362052ce02087f83eca890c5be975fa8e253f5890d5130379834e5b74d019e41e0c2c59c34bf57149c310207
   languageName: node
   linkType: hard
 
-"regenerator-transform@npm:^0.15.2":
-  version: 0.15.2
-  resolution: "regenerator-transform@npm:0.15.2"
-  dependencies:
-    "@babel/runtime": ^7.8.4
-  checksum: 20b6f9377d65954980fe044cfdd160de98df415b4bff38fbade67b3337efaf078308c4fed943067cd759827cc8cfeca9cb28ccda1f08333b85d6a2acbd022c27
+"reduce-unique@npm:^2.0.1":
+  version: 2.0.1
+  resolution: "reduce-unique@npm:2.0.1"
+  checksum: d24fad6b55b7633cfc453cf5f312f474dea2b7387c731d8691de70193004bf80e9208e39356361cb34670d2a30e64d5144f017e99feea56b826e2c2cc7279b68
   languageName: node
   linkType: hard
 
-"regex-not@npm:^1.0.0, regex-not@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "regex-not@npm:1.0.2"
+"reduce-without@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "reduce-without@npm:1.0.1"
   dependencies:
-    extend-shallow: ^3.0.2
-    safe-regex: ^1.1.0
-  checksum: 3081403de79559387a35ef9d033740e41818a559512668cef3d12da4e8a29ef34ee13c8ed1256b07e27ae392790172e8a15c8a06b72962fd4550476cde3d8f77
+    test-value: ^2.0.0
+  checksum: b43bbf4346852d089a4f7a75f5be6b232d3faec5e4df1a3c532deb3132d698a1e14cc93b5866419c16261a71220c6459ef56e341df12ed009a1e1bfc2af3e639
   languageName: node
   linkType: hard
 
-"regexp.prototype.flags@npm:^1.3.1":
-  version: 1.3.1
-  resolution: "regexp.prototype.flags@npm:1.3.1"
+"reflect.getprototypeof@npm:^1.0.6, reflect.getprototypeof@npm:^1.0.9":
+  version: 1.0.10
+  resolution: "reflect.getprototypeof@npm:1.0.10"
   dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.3
-  checksum: 343595db5a6bbbb3bfbda881f9c74832cfa9fc0039e64a43843f6bb9158b78b921055266510800ed69d4997638890b17a46d55fd9f32961f53ae56ac3ec4dd05
+    call-bind: ^1.0.8
+    define-properties: ^1.2.1
+    es-abstract: ^1.23.9
+    es-errors: ^1.3.0
+    es-object-atoms: ^1.0.0
+    get-intrinsic: ^1.2.7
+    get-proto: ^1.0.1
+    which-builtin-type: ^1.2.1
+  checksum: ccc5debeb66125e276ae73909cecb27e47c35d9bb79d9cc8d8d055f008c58010ab8cb401299786e505e4aab733a64cba9daf5f312a58e96a43df66adad221870
   languageName: node
   linkType: hard
 
-"regexp.prototype.flags@npm:^1.4.3, regexp.prototype.flags@npm:^1.5.0":
-  version: 1.5.0
-  resolution: "regexp.prototype.flags@npm:1.5.0"
+"regenerate-unicode-properties@npm:^10.2.0":
+  version: 10.2.0
+  resolution: "regenerate-unicode-properties@npm:10.2.0"
   dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.2.0
-    functions-have-names: ^1.2.3
-  checksum: c541687cdbdfff1b9a07f6e44879f82c66bbf07665f9a7544c5fd16acdb3ec8d1436caab01662d2fbcad403f3499d49ab0b77fbc7ef29ef961d98cc4bc9755b4
-  languageName: node
-  linkType: hard
-
-"regexpp@npm:^3.0.0":
-  version: 3.1.0
-  resolution: "regexpp@npm:3.1.0"
-  checksum: 63bcb2c98d63274774c79bef256e03f716d25f1fa8427267d0302d1436a83fa0d905f4e8a172fdfa99fb4d84833df2fb3bf7da2a1a868f156e913174c32b1139
+    regenerate: ^1.4.2
+  checksum: d5c5fc13f8b8d7e16e791637a4bfef741f8d70e267d51845ee7d5404a32fa14c75b181c4efba33e4bff8b0000a2f13e9773593713dfe5b66597df4259275ce63
   languageName: node
   linkType: hard
 
-"regexpp@npm:^3.2.0":
-  version: 3.2.0
-  resolution: "regexpp@npm:3.2.0"
-  checksum: a78dc5c7158ad9ddcfe01aa9144f46e192ddbfa7b263895a70a5c6c73edd9ce85faf7c0430e59ac38839e1734e275b9c3de5c57ee3ab6edc0e0b1bdebefccef8
+"regenerate@npm:^1.4.2":
+  version: 1.4.2
+  resolution: "regenerate@npm:1.4.2"
+  checksum: 3317a09b2f802da8db09aa276e469b57a6c0dd818347e05b8862959c6193408242f150db5de83c12c3fa99091ad95fb42a6db2c3329bfaa12a0ea4cbbeb30cb0
   languageName: node
   linkType: hard
 
-"regexpu-core@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "regexpu-core@npm:2.0.0"
-  dependencies:
-    regenerate: ^1.2.1
-    regjsgen: ^0.2.0
-    regjsparser: ^0.1.4
-  checksum: 14a78eb4608fa991ded6a1433ee6a570f95a4cfb7fe312145a44d6ecbb3dc8c707016a099494c741aa0ac75a1329b40814d30ff134c0d67679c80187029c7d2d
+"regenerator-runtime@npm:^0.13.4":
+  version: 0.13.11
+  resolution: "regenerator-runtime@npm:0.13.11"
+  checksum: 27481628d22a1c4e3ff551096a683b424242a216fee44685467307f14d58020af1e19660bf2e26064de946bad7eff28950eae9f8209d55723e2d9351e632bbb4
   languageName: node
   linkType: hard
 
-"regexpu-core@npm:^4.7.1":
-  version: 4.8.0
-  resolution: "regexpu-core@npm:4.8.0"
-  dependencies:
-    regenerate: ^1.4.2
-    regenerate-unicode-properties: ^9.0.0
-    regjsgen: ^0.5.2
-    regjsparser: ^0.7.0
-    unicode-match-property-ecmascript: ^2.0.0
-    unicode-match-property-value-ecmascript: ^2.0.0
-  checksum: df92e3e6482409f0a0de162ca1b4e17897e9b0b0687caead6804f04e9b89847e47abbfd0bfc62f52a0b833acf764ea5bdb7b707bb088034824a675ee95d31dec
+"regenerator-runtime@npm:^0.14.0":
+  version: 0.14.1
+  resolution: "regenerator-runtime@npm:0.14.1"
+  checksum: 9f57c93277b5585d3c83b0cf76be47b473ae8c6d9142a46ce8b0291a04bb2cf902059f0f8445dcabb3fb7378e5fe4bb4ea1e008876343d42e46d3b484534ce38
   languageName: node
   linkType: hard
 
-"regexpu-core@npm:^5.0.1":
-  version: 5.0.1
-  resolution: "regexpu-core@npm:5.0.1"
+"regexp.prototype.flags@npm:^1.5.3, regexp.prototype.flags@npm:^1.5.4":
+  version: 1.5.4
+  resolution: "regexp.prototype.flags@npm:1.5.4"
   dependencies:
-    regenerate: ^1.4.2
-    regenerate-unicode-properties: ^10.0.1
-    regjsgen: ^0.6.0
-    regjsparser: ^0.8.2
-    unicode-match-property-ecmascript: ^2.0.0
-    unicode-match-property-value-ecmascript: ^2.0.0
-  checksum: 6151a9700dad512fadb5564ad23246d54c880eb9417efa5e5c3658b910c1ff894d622dfd159af2ed527ffd44751bfe98682ae06c717155c254d8e2b4bab62785
+    call-bind: ^1.0.8
+    define-properties: ^1.2.1
+    es-errors: ^1.3.0
+    get-proto: ^1.0.1
+    gopd: ^1.2.0
+    set-function-name: ^2.0.2
+  checksum: 18cb667e56cb328d2dda569d7f04e3ea78f2683135b866d606538cf7b1d4271f7f749f09608c877527799e6cf350e531368f3c7a20ccd1bb41048a48926bdeeb
   languageName: node
   linkType: hard
 
-"regexpu-core@npm:^5.3.1":
-  version: 5.3.2
-  resolution: "regexpu-core@npm:5.3.2"
+"regexpu-core@npm:^6.2.0":
+  version: 6.2.0
+  resolution: "regexpu-core@npm:6.2.0"
   dependencies:
-    "@babel/regjsgen": ^0.8.0
     regenerate: ^1.4.2
-    regenerate-unicode-properties: ^10.1.0
-    regjsparser: ^0.9.1
+    regenerate-unicode-properties: ^10.2.0
+    regjsgen: ^0.8.0
+    regjsparser: ^0.12.0
     unicode-match-property-ecmascript: ^2.0.0
     unicode-match-property-value-ecmascript: ^2.1.0
-  checksum: 95bb97088419f5396e07769b7de96f995f58137ad75fac5811fb5fe53737766dfff35d66a0ee66babb1eb55386ef981feaef392f9df6d671f3c124812ba24da2
-  languageName: node
-  linkType: hard
-
-"regjsgen@npm:^0.2.0":
-  version: 0.2.0
-  resolution: "regjsgen@npm:0.2.0"
-  checksum: 1f3ae570151e2c29193cdc5a5890c0b83cd8c5029ed69315b0ea303bc2644f9ab5d536d2288fd9b70293fd351d7dd7fc1fc99ebe24554015c894dbce883bcf2b
-  languageName: node
-  linkType: hard
-
-"regjsgen@npm:^0.5.2":
-  version: 0.5.2
-  resolution: "regjsgen@npm:0.5.2"
-  checksum: 87c83d8488affae2493a823904de1a29a1867a07433c5e1142ad749b5606c5589b305fe35bfcc0972cf5a3b0d66b1f7999009e541be39a5d42c6041c59e2fb52
-  languageName: node
-  linkType: hard
-
-"regjsgen@npm:^0.6.0":
-  version: 0.6.0
-  resolution: "regjsgen@npm:0.6.0"
-  checksum: c5158ebd735e75074e41292ade1ff05d85566d205426cc61501e360c450a63baced8512ee3ae238e5c0a0e42969563c7875b08fa69d6f0402daf36bcb3e4d348
+  checksum: 67d3c4a3f6c99bc80b5d690074a27e6f675be1c1739f8a9acf028fbc36f1a468472574ea65e331e217995198ba4404d7878f3cb3739a73552dd3c70d3fb7f8e6
   languageName: node
   linkType: hard
 
-"regjsparser@npm:^0.1.4":
-  version: 0.1.5
-  resolution: "regjsparser@npm:0.1.5"
-  dependencies:
-    jsesc: ~0.5.0
-  bin:
-    regjsparser: bin/parser
-  checksum: 1feba2f3f2d4f1ef9f5f4e0f20c827cf866d4f65c51502eb64db4d4dd9c656f8c70f6c79537c892bf0fc9592c96f732519f7d8ad4a82f3b622756118ac737970
+"regjsgen@npm:^0.8.0":
+  version: 0.8.0
+  resolution: "regjsgen@npm:0.8.0"
+  checksum: a1d925ff14a4b2be774e45775ee6b33b256f89c42d480e6d85152d2133f18bd3d6af662161b226fa57466f7efec367eaf7ccd2a58c0ec2a1306667ba2ad07b0d
   languageName: node
   linkType: hard
 
-"regjsparser@npm:^0.7.0":
-  version: 0.7.0
-  resolution: "regjsparser@npm:0.7.0"
+"regjsparser@npm:^0.12.0":
+  version: 0.12.0
+  resolution: "regjsparser@npm:0.12.0"
   dependencies:
-    jsesc: ~0.5.0
+    jsesc: ~3.0.2
   bin:
     regjsparser: bin/parser
-  checksum: fefff9adcab47650817d2c492aac774f11a44b824a4a814e466ebc76313e03e79c50d2babde7e04888296f6ec0fd094e3eeeafa8122c60184de92cdb30636a57
+  checksum: 094b55b0ab3e1fd58f8ce5132a1d44dab08d91f7b0eea4132b0157b303ebb8ded20a9cbd893d25402d2aeddb23fac1f428ab4947b295d6fa51dd1c334a9e76f0
   languageName: node
   linkType: hard
 
-"regjsparser@npm:^0.8.2":
-  version: 0.8.4
-  resolution: "regjsparser@npm:0.8.4"
+"rehype-stringify@npm:^8.0.0":
+  version: 8.0.0
+  resolution: "rehype-stringify@npm:8.0.0"
   dependencies:
-    jsesc: ~0.5.0
-  bin:
-    regjsparser: bin/parser
-  checksum: d069b932491761cda127ce11f6bd2729c3b1b394a35200ec33f1199e937423db28ceb86cf33f0a97c76ecd7c0f8db996476579eaf0d80a1f74c1934f4ca8b27a
+    hast-util-to-html: ^7.1.1
+  checksum: 0d6749a63d0055e7e01a591f0f5405cc49e71ec31420ee8f15037370e1f7adbe430545160256572db4fc1c56a622455f41285f9a1933bef33c929f96574838d7
   languageName: node
   linkType: hard
 
-"regjsparser@npm:^0.9.1":
-  version: 0.9.1
-  resolution: "regjsparser@npm:0.9.1"
-  dependencies:
-    jsesc: ~0.5.0
-  bin:
-    regjsparser: bin/parser
-  checksum: 5e1b76afe8f1d03c3beaf9e0d935dd467589c3625f6d65fb8ffa14f224d783a0fed4bf49c2c1b8211043ef92b6117313419edf055a098ed8342e340586741afc
+"remark-extract-frontmatter@npm:^3.1.0":
+  version: 3.2.0
+  resolution: "remark-extract-frontmatter@npm:3.2.0"
+  checksum: b189efdd1d82bceebab2d9fc1f6c15ce0e35512c780613219f377781cbfc8371ff21138e8dd0506eaa7796c4a85a433ac6296887b358a8681ba337a4663ed923
   languageName: node
   linkType: hard
 
@@ -24582,12 +15883,51 @@ __metadata:
   languageName: node
   linkType: hard
 
-"remark-parse@npm:^9.0.0":
-  version: 9.0.0
-  resolution: "remark-parse@npm:9.0.0"
+"remark-hbs@npm:^0.4.1":
+  version: 0.4.1
+  resolution: "remark-hbs@npm:0.4.1"
+  dependencies:
+    unist-builder: ^2.0.3
+    unist-util-visit: ^2.0.3
+  checksum: c2c40577fdd6679ac641ca31318c4d6ba91a7f81ed0041522c5b9a1d73a4ffedad38a4ddf117d0ae9f78197ddae3ff9189bf65b56e570f74df70b0e29839550b
+  languageName: node
+  linkType: hard
+
+"remark-normalize-headings@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "remark-normalize-headings@npm:2.0.0"
+  dependencies:
+    mdast-normalize-headings: ^2.0.0
+  checksum: ce9fa71a0a576ece4ec4ad7701cf91d293aa078cdce2440d9d5e7ac36d5a11b91ad059dee8c85fce76cc1774207650f2b429b25cb5906741f0e1271c96a09c6e
+  languageName: node
+  linkType: hard
+
+"remark-parse@npm:^9.0.0":
+  version: 9.0.0
+  resolution: "remark-parse@npm:9.0.0"
+  dependencies:
+    mdast-util-from-markdown: ^0.8.0
+  checksum: 50104880549639b7dd7ae6f1e23c214915fe9c054f02f3328abdaee3f6de6d7282bf4357c3c5b106958fe75e644a3c248c2197755df34f9955e8e028fc74868f
+  languageName: node
+  linkType: hard
+
+"remark-rehype@npm:^8.0.0":
+  version: 8.1.0
+  resolution: "remark-rehype@npm:8.1.0"
+  dependencies:
+    mdast-util-to-hast: ^10.2.0
+  checksum: e1152464cfa83c14b570b1cb85eb9b3667795b5bed2f6b16d1c6e96c369816b07945a3c04eb0e1fd57a19cc1837969527d0056d5b6d179f1290688db2a7e2c5f
+  languageName: node
+  linkType: hard
+
+"remark-slug@npm:^6.0.0":
+  version: 6.1.0
+  resolution: "remark-slug@npm:6.1.0"
   dependencies:
-    mdast-util-from-markdown: ^0.8.0
-  checksum: 50104880549639b7dd7ae6f1e23c214915fe9c054f02f3328abdaee3f6de6d7282bf4357c3c5b106958fe75e644a3c248c2197755df34f9955e8e028fc74868f
+    github-slugger: ^1.0.0
+    mdast-util-to-string: ^1.0.0
+    unist-util-visit: ^2.0.0
+  checksum: 81fff0dcfaf6d6117ef1293bb1d26c3e25483d99c65c22434298eed93583a89ea5d7b94063d9a7f47c0647a708ce84f00ff62d274503f248feec03c344cabb20
   languageName: node
   linkType: hard
 
@@ -24610,81 +15950,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"repeat-element@npm:^1.1.2":
-  version: 1.1.4
-  resolution: "repeat-element@npm:1.1.4"
-  checksum: 1edd0301b7edad71808baad226f0890ba709443f03a698224c9ee4f2494c317892dc5211b2ba8cbea7194a9ddbcac01e283bd66de0467ab24ee1fc1a3711d8a9
-  languageName: node
-  linkType: hard
-
-"repeat-string@npm:^1.0.0, repeat-string@npm:^1.6.1":
+"repeat-string@npm:^1.0.0":
   version: 1.6.1
   resolution: "repeat-string@npm:1.6.1"
   checksum: 1b809fc6db97decdc68f5b12c4d1a671c8e3f65ec4a40c238bc5200e44e85bcc52a54f78268ab9c29fcf5fe4f1343e805420056d1f30fa9a9ee4c2d93e3cc6c0
   languageName: node
   linkType: hard
 
-"repeating@npm:^2.0.0":
-  version: 2.0.1
-  resolution: "repeating@npm:2.0.1"
-  dependencies:
-    is-finite: ^1.0.0
-  checksum: d2db0b69c5cb0c14dd750036e0abcd6b3c3f7b2da3ee179786b755cf737ca15fa0fff417ca72de33d6966056f4695440e680a352401fc02c95ade59899afbdd0
-  languageName: node
-  linkType: hard
-
-"request-promise-core@npm:1.1.4":
-  version: 1.1.4
-  resolution: "request-promise-core@npm:1.1.4"
-  dependencies:
-    lodash: ^4.17.19
-  peerDependencies:
-    request: ^2.34
-  checksum: c798bafd552961e36fbf5023b1d081e81c3995ab390f1bc8ef38a711ba3fe4312eb94dbd61887073d7356c3499b9380947d7f62faa805797c0dc50f039425699
-  languageName: node
-  linkType: hard
-
-"request-promise-native@npm:^1.0.9":
-  version: 1.0.9
-  resolution: "request-promise-native@npm:1.0.9"
-  dependencies:
-    request-promise-core: 1.1.4
-    stealthy-require: ^1.1.1
-    tough-cookie: ^2.3.3
-  peerDependencies:
-    request: ^2.34
-  checksum: 3e2c694eefac88cb20beef8911ad57a275ab3ccbae0c4ca6c679fffb09d5fd502458aab08791f0814ca914b157adab2d4e472597c97a73be702918e41725ed69
-  languageName: node
-  linkType: hard
-
-"request@npm:^2.88.2":
-  version: 2.88.2
-  resolution: "request@npm:2.88.2"
-  dependencies:
-    aws-sign2: ~0.7.0
-    aws4: ^1.8.0
-    caseless: ~0.12.0
-    combined-stream: ~1.0.6
-    extend: ~3.0.2
-    forever-agent: ~0.6.1
-    form-data: ~2.3.2
-    har-validator: ~5.1.3
-    http-signature: ~1.2.0
-    is-typedarray: ~1.0.0
-    isstream: ~0.1.2
-    json-stringify-safe: ~5.0.1
-    mime-types: ~2.1.19
-    oauth-sign: ~0.9.0
-    performance-now: ^2.1.0
-    qs: ~6.5.2
-    safe-buffer: ^5.1.2
-    tough-cookie: ~2.5.0
-    tunnel-agent: ^0.6.0
-    uuid: ^3.3.2
-  checksum: 4e112c087f6eabe7327869da2417e9d28fcd0910419edd2eb17b6acfc4bfa1dad61954525949c228705805882d8a98a86a0ea12d7f739c01ee92af7062996983
-  languageName: node
-  linkType: hard
-
 "require-directory@npm:^2.1.1":
   version: 2.1.1
   resolution: "require-directory@npm:2.1.1"
@@ -24727,6 +15999,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"requizzle@npm:^0.2.3":
+  version: 0.2.4
+  resolution: "requizzle@npm:0.2.4"
+  dependencies:
+    lodash: ^4.17.21
+  checksum: fceaa448b235f9ed111aa58360129225a3cec1a897a23293dc08d2a00f001756c042a62df0a9d4d1e2669ace52dec960aea73437f407b30c51bfba2e9da208b7
+  languageName: node
+  linkType: hard
+
 "reselect@npm:^3.0.1":
   version: 3.0.1
   resolution: "reselect@npm:3.0.1"
@@ -24734,13 +16015,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"reselect@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "reselect@npm:4.0.0"
-  checksum: ac7dfc9ef2cdb42b6fc87a856f3ce904c2e4363a2bc1e6fb7eea5f78902a6f506e4388e6509752984877c6dbfe501100c076671d334799eb5a1bfe9936cb2c12
-  languageName: node
-  linkType: hard
-
 "reselect@npm:^4.1.7":
   version: 4.1.8
   resolution: "reselect@npm:4.1.8"
@@ -24748,6 +16022,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"resolve-cwd@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "resolve-cwd@npm:3.0.0"
+  dependencies:
+    resolve-from: ^5.0.0
+  checksum: 546e0816012d65778e580ad62b29e975a642989108d9a3c5beabfb2304192fa3c9f9146fbdfe213563c6ff51975ae41bac1d3c6e047dd9572c94863a057b4d81
+  languageName: node
+  linkType: hard
+
 "resolve-dir@npm:^1.0.0, resolve-dir@npm:^1.0.1":
   version: 1.0.1
   resolution: "resolve-dir@npm:1.0.1"
@@ -24772,7 +16055,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"resolve-package-path@npm:^1.0.11, resolve-package-path@npm:^1.2.2, resolve-package-path@npm:^1.2.6":
+"resolve-package-path@npm:^1.0.11, resolve-package-path@npm:^1.2.6":
   version: 1.2.7
   resolution: "resolve-package-path@npm:1.2.7"
   dependencies:
@@ -24821,82 +16104,43 @@ __metadata:
   languageName: node
   linkType: hard
 
-"resolve-url@npm:^0.2.1":
-  version: 0.2.1
-  resolution: "resolve-url@npm:0.2.1"
-  checksum: 7b7035b9ed6e7bc7d289e90aef1eab5a43834539695dac6416ca6e91f1a94132ae4796bbd173cdacfdc2ade90b5f38a3fb6186bebc1b221cd157777a23b9ad14
-  languageName: node
-  linkType: hard
-
-"resolve@npm:^1.1.7, resolve@npm:^1.22.1":
-  version: 1.22.3
-  resolution: "resolve@npm:1.22.3"
-  dependencies:
-    is-core-module: ^2.12.0
-    path-parse: ^1.0.7
-    supports-preserve-symlinks-flag: ^1.0.0
-  bin:
-    resolve: bin/resolve
-  checksum: fb834b81348428cb545ff1b828a72ea28feb5a97c026a1cf40aa1008352c72811ff4d4e71f2035273dc536dcfcae20c13604ba6283c612d70fa0b6e44519c374
-  languageName: node
-  linkType: hard
-
-"resolve@npm:^1.10.0, resolve@npm:^1.11.1, resolve@npm:^1.13.1, resolve@npm:^1.14.2, resolve@npm:^1.17.0, resolve@npm:^1.20.0, resolve@npm:^1.3.3, resolve@npm:^1.4.0, resolve@npm:^1.5.0, resolve@npm:^1.8.1":
-  version: 1.20.0
-  resolution: "resolve@npm:1.20.0"
-  dependencies:
-    is-core-module: ^2.2.0
-    path-parse: ^1.0.6
-  checksum: 40cf70b2cde00ef57f99daf2dc63c6a56d6c14a1b7fc51735d06a6f0a3b97cb67b4fb7ef6c747b4e13a7baba83b0ef625d7c4ce92a483cd5af923c3b65fd16fe
+"resolve-pkg-maps@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "resolve-pkg-maps@npm:1.0.0"
+  checksum: 1012afc566b3fdb190a6309cc37ef3b2dcc35dff5fa6683a9d00cd25c3247edfbc4691b91078c97adc82a29b77a2660c30d791d65dab4fc78bfc473f60289977
   languageName: node
   linkType: hard
 
-"resolve@npm:^1.22.0":
-  version: 1.22.0
-  resolution: "resolve@npm:1.22.0"
-  dependencies:
-    is-core-module: ^2.8.1
-    path-parse: ^1.0.7
-    supports-preserve-symlinks-flag: ^1.0.0
-  bin:
-    resolve: bin/resolve
-  checksum: a2d14cc437b3a23996f8c7367eee5c7cf8149c586b07ca2ae00e96581ce59455555a1190be9aa92154785cf9f2042646c200d0e00e0bbd2b8a995a93a0ed3e4e
+"resolve.exports@npm:^2.0.2":
+  version: 2.0.3
+  resolution: "resolve.exports@npm:2.0.3"
+  checksum: abfb9f98278dcd0c19b8a49bb486abfafa23df4636d49128ea270dc982053c3ef230a530aecda1fae1322873fdfa6c97674fc539651ddfdb375ac58e0b8ef6df
   languageName: node
   linkType: hard
 
-"resolve@patch:resolve@^1.1.7#~builtin<compat/resolve>, resolve@patch:resolve@^1.22.1#~builtin<compat/resolve>":
-  version: 1.22.3
-  resolution: "resolve@patch:resolve@npm%3A1.22.3#~builtin<compat/resolve>::version=1.22.3&hash=c3c19d"
+"resolve@npm:^1.10.0, resolve@npm:^1.11.1, resolve@npm:^1.13.1, resolve@npm:^1.14.2, resolve@npm:^1.17.0, resolve@npm:^1.20.0, resolve@npm:^1.22.0, resolve@npm:^1.22.1, resolve@npm:^1.22.2, resolve@npm:^1.22.3, resolve@npm:^1.22.8, resolve@npm:^1.3.3, resolve@npm:^1.4.0, resolve@npm:^1.5.0":
+  version: 1.22.10
+  resolution: "resolve@npm:1.22.10"
   dependencies:
-    is-core-module: ^2.12.0
+    is-core-module: ^2.16.0
     path-parse: ^1.0.7
     supports-preserve-symlinks-flag: ^1.0.0
   bin:
     resolve: bin/resolve
-  checksum: ad59734723b596d0891321c951592ed9015a77ce84907f89c9d9307dd0c06e11a67906a3e628c4cae143d3e44898603478af0ddeb2bba3f229a9373efe342665
-  languageName: node
-  linkType: hard
-
-"resolve@patch:resolve@^1.10.0#~builtin<compat/resolve>, resolve@patch:resolve@^1.11.1#~builtin<compat/resolve>, resolve@patch:resolve@^1.13.1#~builtin<compat/resolve>, resolve@patch:resolve@^1.14.2#~builtin<compat/resolve>, resolve@patch:resolve@^1.17.0#~builtin<compat/resolve>, resolve@patch:resolve@^1.20.0#~builtin<compat/resolve>, resolve@patch:resolve@^1.3.3#~builtin<compat/resolve>, resolve@patch:resolve@^1.4.0#~builtin<compat/resolve>, resolve@patch:resolve@^1.5.0#~builtin<compat/resolve>, resolve@patch:resolve@^1.8.1#~builtin<compat/resolve>":
-  version: 1.20.0
-  resolution: "resolve@patch:resolve@npm%3A1.20.0#~builtin<compat/resolve>::version=1.20.0&hash=c3c19d"
-  dependencies:
-    is-core-module: ^2.2.0
-    path-parse: ^1.0.6
-  checksum: a0dd7d16a8e47af23afa9386df2dff10e3e0debb2c7299a42e581d9d9b04d7ad5d2c53f24f1e043f7b3c250cbdc71150063e53d0b6559683d37f790b7c8c3cd5
+  checksum: ab7a32ff4046fcd7c6fdd525b24a7527847d03c3650c733b909b01b757f92eb23510afa9cc3e9bf3f26a3e073b48c88c706dfd4c1d2fb4a16a96b73b6328ddcf
   languageName: node
   linkType: hard
 
-"resolve@patch:resolve@^1.22.0#~builtin<compat/resolve>":
-  version: 1.22.0
-  resolution: "resolve@patch:resolve@npm%3A1.22.0#~builtin<compat/resolve>::version=1.22.0&hash=c3c19d"
+"resolve@patch:resolve@^1.10.0#~builtin<compat/resolve>, resolve@patch:resolve@^1.11.1#~builtin<compat/resolve>, resolve@patch:resolve@^1.13.1#~builtin<compat/resolve>, resolve@patch:resolve@^1.14.2#~builtin<compat/resolve>, resolve@patch:resolve@^1.17.0#~builtin<compat/resolve>, resolve@patch:resolve@^1.20.0#~builtin<compat/resolve>, resolve@patch:resolve@^1.22.0#~builtin<compat/resolve>, resolve@patch:resolve@^1.22.1#~builtin<compat/resolve>, resolve@patch:resolve@^1.22.2#~builtin<compat/resolve>, resolve@patch:resolve@^1.22.3#~builtin<compat/resolve>, resolve@patch:resolve@^1.22.8#~builtin<compat/resolve>, resolve@patch:resolve@^1.3.3#~builtin<compat/resolve>, resolve@patch:resolve@^1.4.0#~builtin<compat/resolve>, resolve@patch:resolve@^1.5.0#~builtin<compat/resolve>":
+  version: 1.22.10
+  resolution: "resolve@patch:resolve@npm%3A1.22.10#~builtin<compat/resolve>::version=1.22.10&hash=c3c19d"
   dependencies:
-    is-core-module: ^2.8.1
+    is-core-module: ^2.16.0
     path-parse: ^1.0.7
     supports-preserve-symlinks-flag: ^1.0.0
   bin:
     resolve: bin/resolve
-  checksum: c79ecaea36c872ee4a79e3db0d3d4160b593f2ca16e031d8283735acd01715a203607e9ded3f91f68899c2937fa0d49390cddbe0fb2852629212f3cda283f4a7
+  checksum: 8aac1e4e4628bd00bf4b94b23de137dd3fe44097a8d528fd66db74484be929936e20c696e1a3edf4488f37e14180b73df6f600992baea3e089e8674291f16c9d
   languageName: node
   linkType: hard
 
@@ -24920,10 +16164,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ret@npm:~0.1.10":
-  version: 0.1.15
-  resolution: "ret@npm:0.1.15"
-  checksum: d76a9159eb8c946586567bd934358dfc08a36367b3257f7a3d7255fdd7b56597235af23c6afa0d7f0254159e8051f93c918809962ebd6df24ca2a83dbe4d4151
+"restore-cursor@npm:^5.0.0":
+  version: 5.1.0
+  resolution: "restore-cursor@npm:5.1.0"
+  dependencies:
+    onetime: ^7.0.0
+    signal-exit: ^4.1.0
+  checksum: 838dd54e458d89cfbc1a923b343c1b0f170a04100b4ce1733e97531842d7b440463967e521216e8ab6c6f8e89df877acc7b7f4c18ec76e99fb9bf5a60d358d2c
   languageName: node
   linkType: hard
 
@@ -24935,9 +16182,16 @@ __metadata:
   linkType: hard
 
 "reusify@npm:^1.0.4":
-  version: 1.0.4
-  resolution: "reusify@npm:1.0.4"
-  checksum: c3076ebcc22a6bc252cb0b9c77561795256c22b757f40c0d8110b1300723f15ec0fc8685e8d4ea6d7666f36c79ccc793b1939c748bf36f18f542744a4e379fcc
+  version: 1.1.0
+  resolution: "reusify@npm:1.1.0"
+  checksum: 64cb3142ac5e9ad689aca289585cb41d22521f4571f73e9488af39f6b1bd62f0cbb3d65e2ecc768ec6494052523f473f1eb4b55c3e9014b3590c17fc6a03e22a
+  languageName: node
+  linkType: hard
+
+"rfdc@npm:^1.4.1":
+  version: 1.4.1
+  resolution: "rfdc@npm:1.4.1"
+  checksum: 3b05bd55062c1d78aaabfcea43840cdf7e12099968f368e9a4c3936beb744adb41cbdb315eac6d4d8c6623005d6f87fdf16d8a10e1ff3722e84afea7281c8d13
   languageName: node
   linkType: hard
 
@@ -24964,13 +16218,13 @@ __metadata:
   linkType: hard
 
 "rimraf@npm:^5.0.0":
-  version: 5.0.5
-  resolution: "rimraf@npm:5.0.5"
+  version: 5.0.10
+  resolution: "rimraf@npm:5.0.10"
   dependencies:
     glob: ^10.3.7
   bin:
     rimraf: dist/esm/bin.mjs
-  checksum: d66eef829b2e23b16445f34e73d75c7b7cf4cbc8834b04720def1c8f298eb0753c3d76df77325fad79d0a2c60470525d95f89c2475283ad985fd7441c32732d1
+  checksum: 50e27388dd2b3fa6677385fc1e2966e9157c89c86853b96d02e6915663a96b7ff4d590e14f6f70e90f9b554093aa5dbc05ac3012876be558c06a65437337bc05
   languageName: node
   linkType: hard
 
@@ -24985,17 +16239,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ripemd160@npm:^2.0.0, ripemd160@npm:^2.0.1":
-  version: 2.0.2
-  resolution: "ripemd160@npm:2.0.2"
-  dependencies:
-    hash-base: ^3.0.0
-    inherits: ^2.0.1
-  checksum: 006accc40578ee2beae382757c4ce2908a826b27e2b079efdcd2959ee544ddf210b7b5d7d5e80467807604244e7388427330f5c6d4cd61e6edaddc5773ccc393
-  languageName: node
-  linkType: hard
-
-"rollup-pluginutils@npm:^2.0.1, rollup-pluginutils@npm:^2.6.0, rollup-pluginutils@npm:^2.8.1":
+"rollup-pluginutils@npm:^2.6.0":
   version: 2.8.2
   resolution: "rollup-pluginutils@npm:2.8.2"
   dependencies:
@@ -25004,43 +16248,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"rollup@npm:^0.57.1":
-  version: 0.57.1
-  resolution: "rollup@npm:0.57.1"
-  dependencies:
-    "@types/acorn": ^4.0.3
-    acorn: ^5.5.3
-    acorn-dynamic-import: ^3.0.0
-    date-time: ^2.1.0
-    is-reference: ^1.1.0
-    locate-character: ^2.0.5
-    pretty-ms: ^3.1.0
-    require-relative: ^0.8.7
-    rollup-pluginutils: ^2.0.1
-    signal-exit: ^3.0.2
-    sourcemap-codec: ^1.4.1
-  bin:
-    rollup: ./bin/rollup
-  checksum: 602691dfa734baec73a1988f34287e802a5498555a7fbe607135de4489cdb6ec49eea5902a850a25b96bf3a862e8cadbbffbd6ddf9986663d3f5ce4a0cb38519
-  languageName: node
-  linkType: hard
-
-"rollup@npm:^1.12.0":
-  version: 1.32.1
-  resolution: "rollup@npm:1.32.1"
-  dependencies:
-    "@types/estree": "*"
-    "@types/node": "*"
-    acorn: ^7.1.0
-  bin:
-    rollup: dist/bin/rollup
-  checksum: 3a02731c20c71321fae647c9c9cab0febee0580c6af029fdcd5dd6f424b8c85119d92c8554c6837327fd323c2458e92d955bbebc90ca6bed87cc626695e7c31f
-  languageName: node
-  linkType: hard
-
-"rollup@npm:^2.50.0":
-  version: 2.70.1
-  resolution: "rollup@npm:2.70.1"
+"rollup@npm:2.79.2":
+  version: 2.79.2
+  resolution: "rollup@npm:2.79.2"
   dependencies:
     fsevents: ~2.3.2
   dependenciesMeta:
@@ -25048,25 +16258,37 @@ __metadata:
       optional: true
   bin:
     rollup: dist/bin/rollup
-  checksum: 06c62933e6e81a1c8c684d7d576e507081aabdb63cc0c91bca86b7348b66df03b77827068e4990b8b6c738bd3ef66dcc8c7ed7e0ea40b736068e7618f693133e
+  checksum: df7aa4c8b95245dede157b06ab71e1921de6080757d30e9bf31f8fb142064d12dda865e2bafbab4349588f43425b2965a290c9a5da1c048246a70fc21734ebd7
   languageName: node
   linkType: hard
 
-"route-recognizer@npm:^0.3.3":
+"route-recognizer@npm:^0.3.3, route-recognizer@npm:^0.3.4":
   version: 0.3.4
   resolution: "route-recognizer@npm:0.3.4"
   checksum: 9586704491b26716eba1bdbb4a386893ecaab80c6dbf34e394957063b941ebf336ca09222f0892c9d118c609fa9b972d6e73e454abd4382acdc34dbb878e87f2
   languageName: node
   linkType: hard
 
-"rsvp@npm:^3.0.14, rsvp@npm:^3.0.17, rsvp@npm:^3.0.18, rsvp@npm:^3.0.21, rsvp@npm:^3.0.6, rsvp@npm:^3.1.0":
+"router_js@npm:^8.0.3":
+  version: 8.0.6
+  resolution: "router_js@npm:8.0.6"
+  dependencies:
+    "@glimmer/env": ^0.1.7
+  peerDependencies:
+    route-recognizer: ^0.3.4
+    rsvp: ^4.8.5
+  checksum: b2c32cf7a1606c27438b851c5597b2a87f0f64ff98a3217109e12c36136879fe7f7b137d293c128fb4f3fd02a46ef71fadef411eae883e1af477319904b6ac17
+  languageName: node
+  linkType: hard
+
+"rsvp@npm:^3.0.14, rsvp@npm:^3.0.17, rsvp@npm:^3.0.18, rsvp@npm:^3.0.6, rsvp@npm:^3.1.0":
   version: 3.6.2
   resolution: "rsvp@npm:3.6.2"
   checksum: 08504ea7ab3dba0349ff820011a460da69de08edf7149ee672f4511310ee4bd3767bfa83b6db019fa99b144125e1e93e6fba122d75a702a005360393f4352864
   languageName: node
   linkType: hard
 
-"rsvp@npm:^4.7.0, rsvp@npm:^4.8.1, rsvp@npm:^4.8.2, rsvp@npm:^4.8.4, rsvp@npm:^4.8.5":
+"rsvp@npm:^4.7.0, rsvp@npm:^4.8.1, rsvp@npm:^4.8.4, rsvp@npm:^4.8.5":
   version: 4.8.5
   resolution: "rsvp@npm:4.8.5"
   checksum: 2d8ef30d8febdf05bdf856ccca38001ae3647e41835ca196bc1225333f79b94ae44def733121ca549ccc36209c9b689f6586905e2a043873262609744da8efc1
@@ -25087,6 +16309,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"run-async@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "run-async@npm:3.0.0"
+  checksum: 280c03d5a88603f48103fc6fd69f07fb0c392a1e0d319c34ec96a2516030e07ba06f79231a563c78698b882649c2fc1fda601bc84705f57d50efcd1fa506cfc0
+  languageName: node
+  linkType: hard
+
 "run-parallel@npm:^1.1.9":
   version: 1.2.0
   resolution: "run-parallel@npm:1.2.0"
@@ -25096,23 +16325,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"run-queue@npm:^1.0.0, run-queue@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "run-queue@npm:1.0.3"
-  dependencies:
-    aproba: ^1.1.1
-  checksum: c4541e18b5e056af60f398f2f1b3d89aae5c093d1524bf817c5ee68bcfa4851ad9976f457a9aea135b1d0d72ee9a91c386e3d136bcd95b699c367cd09c70be53
-  languageName: node
-  linkType: hard
-
-"rw@npm:1":
-  version: 1.3.3
-  resolution: "rw@npm:1.3.3"
-  checksum: c20d82421f5a71c86a13f76121b751553a99cd4a70ea27db86f9b23f33db941f3f06019c30f60d50c356d0bd674c8e74764ac146ea55e217c091bde6fba82aa3
-  languageName: node
-  linkType: hard
-
-"rxjs@npm:^6.4.0, rxjs@npm:^6.6.0, rxjs@npm:^6.6.7":
+"rxjs@npm:^6.4.0, rxjs@npm:^6.6.0":
   version: 6.6.7
   resolution: "rxjs@npm:6.6.7"
   dependencies:
@@ -25121,32 +16334,36 @@ __metadata:
   languageName: node
   linkType: hard
 
-"rxjs@npm:^7.5.5, rxjs@npm:^7.8.1":
-  version: 7.8.1
-  resolution: "rxjs@npm:7.8.1"
+"rxjs@npm:^7.5.6, rxjs@npm:^7.8.1":
+  version: 7.8.2
+  resolution: "rxjs@npm:7.8.2"
   dependencies:
     tslib: ^2.1.0
-  checksum: de4b53db1063e618ec2eca0f7965d9137cabe98cf6be9272efe6c86b47c17b987383df8574861bcced18ebd590764125a901d5506082be84a8b8e364bf05f119
+  checksum: 2f233d7c832a6c255dabe0759014d7d9b1c9f1cb2f2f0d59690fd11c883c9826ea35a51740c06ab45b6ade0d9087bde9192f165cba20b6730d344b831ef80744
   languageName: node
   linkType: hard
 
-"rxjs@npm:^7.5.6":
-  version: 7.5.7
-  resolution: "rxjs@npm:7.5.7"
+"safe-array-concat@npm:^1.1.3":
+  version: 1.1.3
+  resolution: "safe-array-concat@npm:1.1.3"
   dependencies:
-    tslib: ^2.1.0
-  checksum: edabcdb73b0f7e0f5f6e05c2077aff8c52222ac939069729704357d6406438acca831c24210db320aba269e86dbe1a400f3769c89101791885121a342fb15d9c
+    call-bind: ^1.0.8
+    call-bound: ^1.0.2
+    get-intrinsic: ^1.2.6
+    has-symbols: ^1.1.0
+    isarray: ^2.0.5
+  checksum: 00f6a68140e67e813f3ad5e73e6dedcf3e42a9fa01f04d44b0d3f7b1f4b257af876832a9bfc82ac76f307e8a6cc652e3cf95876048a26cbec451847cf6ae3707
   languageName: node
   linkType: hard
 
-"safe-buffer@npm:5.1.2, safe-buffer@npm:~5.1.0, safe-buffer@npm:~5.1.1":
+"safe-buffer@npm:5.1.2":
   version: 5.1.2
   resolution: "safe-buffer@npm:5.1.2"
   checksum: f2f1f7943ca44a594893a852894055cf619c1fbcb611237fc39e461ae751187e7baf4dc391a72125e0ac4fb2d8c5c0b3c71529622e6a58f46b960211e704903c
   languageName: node
   linkType: hard
 
-"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.1, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:~5.2.0":
+"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.2, safe-buffer@npm:~5.2.0":
   version: 5.2.1
   resolution: "safe-buffer@npm:5.2.1"
   checksum: b99c4b41fdd67a6aaf280fcd05e9ffb0813654894223afb78a31f14a19ad220bba8aba1cb14eddce1fcfb037155fe6de4e861784eb434f7d11ed58d1e70dd491
@@ -25167,41 +16384,35 @@ __metadata:
   languageName: node
   linkType: hard
 
-"safe-regex-test@npm:^1.0.0":
+"safe-push-apply@npm:^1.0.0":
   version: 1.0.0
-  resolution: "safe-regex-test@npm:1.0.0"
+  resolution: "safe-push-apply@npm:1.0.0"
   dependencies:
-    call-bind: ^1.0.2
-    get-intrinsic: ^1.1.3
-    is-regex: ^1.1.4
-  checksum: bc566d8beb8b43c01b94e67de3f070fd2781685e835959bbbaaec91cc53381145ca91f69bd837ce6ec244817afa0a5e974fc4e40a2957f0aca68ac3add1ddd34
+    es-errors: ^1.3.0
+    isarray: ^2.0.5
+  checksum: 8c11cbee6dc8ff5cc0f3d95eef7052e43494591384015902e4292aef4ae9e539908288520ed97179cee17d6ffb450fe5f05a46ce7a1749685f7524fd568ab5db
   languageName: node
   linkType: hard
 
-"safe-regex@npm:^1.1.0":
+"safe-regex-test@npm:^1.1.0":
   version: 1.1.0
-  resolution: "safe-regex@npm:1.1.0"
+  resolution: "safe-regex-test@npm:1.1.0"
   dependencies:
-    ret: ~0.1.10
-  checksum: 9a8bba57c87a841f7997b3b951e8e403b1128c1a4fd1182f40cc1a20e2d490593d7c2a21030fadfea320c8e859219019e136f678c6689ed5960b391b822f01d5
-  languageName: node
-  linkType: hard
-
-"safe-stable-stringify@npm:^2.2.0":
-  version: 2.4.0
-  resolution: "safe-stable-stringify@npm:2.4.0"
-  checksum: 5c9e4b2b2423470becafe232244948e7ce9545baaa65d67965e8c36536c93d2f7b4c1ddeb4bba8a912d0325e02c7691f24dd4de6935a9c1221402c17582ae1c1
+    call-bound: ^1.0.2
+    es-errors: ^1.3.0
+    is-regex: ^1.2.1
+  checksum: 3c809abeb81977c9ed6c869c83aca6873ea0f3ab0f806b8edbba5582d51713f8a6e9757d24d2b4b088f563801475ea946c8e77e7713e8c65cdd02305b6caedab
   languageName: node
   linkType: hard
 
-"safe-stable-stringify@npm:^2.4.2":
-  version: 2.4.3
-  resolution: "safe-stable-stringify@npm:2.4.3"
-  checksum: 3aeb64449706ee1f5ad2459fc99648b131d48e7a1fbb608d7c628020177512dc9d94108a5cb61bbc953985d313d0afea6566d243237743e02870490afef04b43
+"safe-stable-stringify@npm:^2.4.3":
+  version: 2.5.0
+  resolution: "safe-stable-stringify@npm:2.5.0"
+  checksum: d3ce103ed43c6c2f523e39607208bfb1c73aa48179fc5be53c3aa97c118390bffd4d55e012f5393b982b65eb3e0ee954dd57b547930d3f242b0053dcdb923d17
   languageName: node
   linkType: hard
 
-"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0, safer-buffer@npm:^2.0.2, safer-buffer@npm:^2.1.0, safer-buffer@npm:~2.1.0":
+"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0":
   version: 2.1.2
   resolution: "safer-buffer@npm:2.1.2"
   checksum: cab8f25ae6f1434abee8d80023d7e72b598cf1327164ddab31003c51215526801e40b66c5e65d658a0af1e9d6478cadcb4c745f4bd6751f97d8644786c0978b0
@@ -25246,63 +16457,37 @@ __metadata:
   languageName: node
   linkType: hard
 
-"sass-svg-uri@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "sass-svg-uri@npm:1.0.0"
-  checksum: 75a2af6cc4ac44c262309f51c290a1a5120ab5cd45cabafd0faabd9ad3bb6898417d3993fdfdf65efbf0ff9878d105d2bb8e1502db29f13c41974fb4adaa3f1a
-  languageName: node
-  linkType: hard
-
-"sass@npm:^1.58.3":
-  version: 1.58.3
-  resolution: "sass@npm:1.58.3"
+"sass@npm:^1.83.0":
+  version: 1.89.0
+  resolution: "sass@npm:1.89.0"
   dependencies:
-    chokidar: ">=3.0.0 <4.0.0"
-    immutable: ^4.0.0
+    "@parcel/watcher": ^2.4.1
+    chokidar: ^4.0.0
+    immutable: ^5.0.2
     source-map-js: ">=0.6.2 <2.0.0"
+  dependenciesMeta:
+    "@parcel/watcher":
+      optional: true
   bin:
     sass: sass.js
-  checksum: 35a2b98c037ef80fdc93c9b0be846e6ccc7d75596351a37ee79c397e66666d0a754c52c4696e746c0aff32327471e185343ca349e998a58340411adc9d0489a5
+  checksum: 31d32b922a7327abe0ac2777ee071f87acf4e9ce7ed4693b52ad27fc8595c0a9381cc2efbba97a76fa03bbde03906fe69e9bc44a35a873189514b873f99e7ff6
   languageName: node
   linkType: hard
 
-"sass@npm:^1.69.5":
-  version: 1.69.5
-  resolution: "sass@npm:1.69.5"
+"sass@npm:~1.88.0":
+  version: 1.88.0
+  resolution: "sass@npm:1.88.0"
   dependencies:
-    chokidar: ">=3.0.0 <4.0.0"
-    immutable: ^4.0.0
+    "@parcel/watcher": ^2.4.1
+    chokidar: ^4.0.0
+    immutable: ^5.0.2
     source-map-js: ">=0.6.2 <2.0.0"
+  dependenciesMeta:
+    "@parcel/watcher":
+      optional: true
   bin:
     sass: sass.js
-  checksum: c66f4f02882e7aa7aa49703824dadbb5a174dcd05e3cd96f17f73687889aab6027d078b518e2c04b594dfd89b2f574824bf935c7aee46c770aa6be9aafcc49f2
-  languageName: node
-  linkType: hard
-
-"sax@npm:~1.2.4":
-  version: 1.2.4
-  resolution: "sax@npm:1.2.4"
-  checksum: d3df7d32b897a2c2f28e941f732c71ba90e27c24f62ee918bd4d9a8cfb3553f2f81e5493c7f0be94a11c1911b643a9108f231dd6f60df3fa9586b5d2e3e9e1fe
-  languageName: node
-  linkType: hard
-
-"saxes@npm:^5.0.1":
-  version: 5.0.1
-  resolution: "saxes@npm:5.0.1"
-  dependencies:
-    xmlchars: ^2.2.0
-  checksum: 5636b55cf15f7cf0baa73f2797bf992bdcf75d1b39d82c0aa4608555c774368f6ac321cb641fd5f3d3ceb87805122cd47540da6a7b5960fe0dbdb8f8c263f000
-  languageName: node
-  linkType: hard
-
-"schema-utils@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "schema-utils@npm:1.0.0"
-  dependencies:
-    ajv: ^6.1.0
-    ajv-errors: ^1.0.0
-    ajv-keywords: ^3.1.0
-  checksum: e8273b4f6eff9ddf4a4f4c11daf7b96b900237bf8859c86fa1e9b4fab416b72d7ea92468f8db89c18a3499a1070206e1c8a750c83b42d5325fc659cbb55eee88
+  checksum: 290a2797d2f6c0b9e9a4aeeb59abe3fdb68ffc9e1e154d5aafb363d5c897118ec50726812f63f4d8526a5b22a2d5b08001929acefb5120f05a0c16d8013d5ff8
   languageName: node
   linkType: hard
 
@@ -25317,75 +16502,39 @@ __metadata:
   languageName: node
   linkType: hard
 
-"schema-utils@npm:^3.0.0, schema-utils@npm:^3.1.0, schema-utils@npm:^3.1.1":
-  version: 3.1.1
-  resolution: "schema-utils@npm:3.1.1"
+"schema-utils@npm:^3.0.0, schema-utils@npm:^3.2.0":
+  version: 3.3.0
+  resolution: "schema-utils@npm:3.3.0"
   dependencies:
     "@types/json-schema": ^7.0.8
     ajv: ^6.12.5
     ajv-keywords: ^3.5.2
-  checksum: fb73f3d759d43ba033c877628fe9751620a26879f6301d3dbeeb48cf2a65baec5cdf99da65d1bf3b4ff5444b2e59cbe4f81c2456b5e0d2ba7d7fd4aed5da29ce
+  checksum: ea56971926fac2487f0757da939a871388891bc87c6a82220d125d587b388f1704788f3706e7f63a7b70e49fc2db974c41343528caea60444afd5ce0fe4b85c0
   languageName: node
   linkType: hard
 
-"schema-utils@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "schema-utils@npm:4.0.0"
+"schema-utils@npm:^4.0.0, schema-utils@npm:^4.3.0":
+  version: 4.3.2
+  resolution: "schema-utils@npm:4.3.2"
   dependencies:
     "@types/json-schema": ^7.0.9
-    ajv: ^8.8.0
+    ajv: ^8.9.0
     ajv-formats: ^2.1.1
-    ajv-keywords: ^5.0.0
-  checksum: c843e92fdd1a5c145dbb6ffdae33e501867f9703afac67bdf35a685e49f85b1dcc10ea250033175a64bd9d31f0555bc6785b8359da0c90bcea30cf6dfbb55a8f
-  languageName: node
-  linkType: hard
-
-"semver-compare@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "semver-compare@npm:1.0.0"
-  checksum: dd1d7e2909744cf2cf71864ac718efc990297f9de2913b68e41a214319e70174b1d1793ac16e31183b128c2b9812541300cb324db8168e6cf6b570703b171c68
-  languageName: node
-  linkType: hard
-
-"semver@npm:7.0.0":
-  version: 7.0.0
-  resolution: "semver@npm:7.0.0"
-  bin:
-    semver: bin/semver.js
-  checksum: 272c11bf8d083274ef79fe40a81c55c184dff84dd58e3c325299d0927ba48cece1f020793d138382b85f89bab5002a35a5ba59a3a68a7eebbb597eb733838778
-  languageName: node
-  linkType: hard
-
-"semver@npm:7.3.5, semver@npm:^7.3.2, semver@npm:^7.3.4, semver@npm:^7.3.5":
-  version: 7.3.5
-  resolution: "semver@npm:7.3.5"
-  dependencies:
-    lru-cache: ^6.0.0
-  bin:
-    semver: bin/semver.js
-  checksum: 5eafe6102bea2a7439897c1856362e31cc348ccf96efd455c8b5bc2c61e6f7e7b8250dc26b8828c1d76a56f818a7ee907a36ae9fb37a599d3d24609207001d60
-  languageName: node
-  linkType: hard
-
-"semver@npm:^5.3.0, semver@npm:^5.4.1, semver@npm:^5.5.0, semver@npm:^5.6.0":
-  version: 5.7.1
-  resolution: "semver@npm:5.7.1"
-  bin:
-    semver: ./bin/semver
-  checksum: 57fd0acfd0bac382ee87cd52cd0aaa5af086a7dc8d60379dfe65fea491fb2489b6016400813930ecd61fd0952dae75c115287a1b16c234b1550887117744dfaf
+    ajv-keywords: ^5.1.0
+  checksum: d798b341ffa1371f8471629e8861af3aa99e8e15b89da2c0db28c5a80a02ee8c6ffc7daefbe28a2b8c1bc8e3f3e02d028775145d7ab3d9d1a413a9651a835466
   languageName: node
   linkType: hard
 
-"semver@npm:^6.0.0, semver@npm:^6.1.1, semver@npm:^6.1.2, semver@npm:^6.3.0":
-  version: 6.3.0
-  resolution: "semver@npm:6.3.0"
+"semver@npm:^5.3.0, semver@npm:^5.4.1, semver@npm:^5.5.0, semver@npm:^5.6.0, semver@npm:^5.7.1":
+  version: 5.7.2
+  resolution: "semver@npm:5.7.2"
   bin:
-    semver: ./bin/semver.js
-  checksum: 1b26ecf6db9e8292dd90df4e781d91875c0dcc1b1909e70f5d12959a23c7eebb8f01ea581c00783bbee72ceeaad9505797c381756326073850dc36ed284b21b9
+    semver: bin/semver
+  checksum: fb4ab5e0dd1c22ce0c937ea390b4a822147a9c53dbd2a9a0132f12fe382902beef4fbf12cf51bb955248d8d15874ce8cd89532569756384f994309825f10b686
   languageName: node
   linkType: hard
 
-"semver@npm:^6.3.1":
+"semver@npm:^6.0.0, semver@npm:^6.3.0, semver@npm:^6.3.1":
   version: 6.3.1
   resolution: "semver@npm:6.3.1"
   bin:
@@ -25394,63 +16543,18 @@ __metadata:
   languageName: node
   linkType: hard
 
-"semver@npm:^7.0.0":
-  version: 7.5.1
-  resolution: "semver@npm:7.5.1"
-  dependencies:
-    lru-cache: ^6.0.0
-  bin:
-    semver: bin/semver.js
-  checksum: d16dbedad53c65b086f79524b9ef766bf38670b2395bdad5c957f824dcc566b624988013564f4812bcace3f9d405355c3635e2007396a39d1bffc71cfec4a2fc
-  languageName: node
-  linkType: hard
-
-"semver@npm:^7.3.7":
-  version: 7.3.7
-  resolution: "semver@npm:7.3.7"
-  dependencies:
-    lru-cache: ^6.0.0
-  bin:
-    semver: bin/semver.js
-  checksum: 2fa3e877568cd6ce769c75c211beaed1f9fce80b28338cadd9d0b6c40f2e2862bafd62c19a6cff42f3d54292b7c623277bcab8816a2b5521cf15210d43e75232
-  languageName: node
-  linkType: hard
-
-"semver@npm:^7.3.8":
-  version: 7.3.8
-  resolution: "semver@npm:7.3.8"
-  dependencies:
-    lru-cache: ^6.0.0
+"semver@npm:^7.0.0, semver@npm:^7.3.2, semver@npm:^7.3.4, semver@npm:^7.3.5, semver@npm:^7.3.7, semver@npm:^7.3.8, semver@npm:^7.5.2, semver@npm:^7.5.3, semver@npm:^7.5.4, semver@npm:^7.7.1":
+  version: 7.7.2
+  resolution: "semver@npm:7.7.2"
   bin:
     semver: bin/semver.js
-  checksum: ba9c7cbbf2b7884696523450a61fee1a09930d888b7a8d7579025ad93d459b2d1949ee5bbfeb188b2be5f4ac163544c5e98491ad6152df34154feebc2cc337c1
-  languageName: node
-  linkType: hard
-
-"send@npm:0.17.1":
-  version: 0.17.1
-  resolution: "send@npm:0.17.1"
-  dependencies:
-    debug: 2.6.9
-    depd: ~1.1.2
-    destroy: ~1.0.4
-    encodeurl: ~1.0.2
-    escape-html: ~1.0.3
-    etag: ~1.8.1
-    fresh: 0.5.2
-    http-errors: ~1.7.2
-    mime: 1.6.0
-    ms: 2.1.1
-    on-finished: ~2.3.0
-    range-parser: ~1.2.1
-    statuses: ~1.5.0
-  checksum: d214c2fa42e7fae3f8fc1aa3931eeb3e6b78c2cf141574e09dbe159915c1e3a337269fc6b7512e7dfddcd7d6ff5974cb62f7c3637ba86a55bde20a92c18bdca0
+  checksum: dd94ba8f1cbc903d8eeb4dd8bf19f46b3deb14262b6717d0de3c804b594058ae785ef2e4b46c5c3b58733c99c83339068203002f9e37cfe44f7e2cc5e3d2f621
   languageName: node
   linkType: hard
 
-"send@npm:0.18.0":
-  version: 0.18.0
-  resolution: "send@npm:0.18.0"
+"send@npm:0.19.0":
+  version: 0.19.0
+  resolution: "send@npm:0.19.0"
   dependencies:
     debug: 2.6.9
     depd: 2.0.0
@@ -25465,11 +16569,11 @@ __metadata:
     on-finished: 2.4.1
     range-parser: ~1.2.1
     statuses: 2.0.1
-  checksum: 74fc07ebb58566b87b078ec63e5a3e41ecd987e4272ba67b7467e86c6ad51bc6b0b0154133b6d8b08a2ddda360464f71382f7ef864700f34844a76c8027817a8
+  checksum: 5ae11bd900c1c2575525e2aa622e856804e2f96a09281ec1e39610d089f53aa69e13fd8db84b52f001d0318cf4bb0b3b904ad532fc4c0014eb90d32db0cff55f
   languageName: node
   linkType: hard
 
-"serialize-javascript@npm:^3.1.0":
+"serialize-javascript@npm:3.1.0":
   version: 3.1.0
   resolution: "serialize-javascript@npm:3.1.0"
   dependencies:
@@ -25478,27 +16582,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"serve-static@npm:1.14.1":
-  version: 1.14.1
-  resolution: "serve-static@npm:1.14.1"
-  dependencies:
-    encodeurl: ~1.0.2
-    escape-html: ~1.0.3
-    parseurl: ~1.3.3
-    send: 0.17.1
-  checksum: c6b268e8486d39ecd54b86c7f2d0ee4a38cd7514ddd9c92c8d5793bb005afde5e908b12395898ae206782306ccc848193d93daa15b86afb3cbe5a8414806abe8
-  languageName: node
-  linkType: hard
-
-"serve-static@npm:1.15.0":
-  version: 1.15.0
-  resolution: "serve-static@npm:1.15.0"
+"serve-static@npm:1.16.2":
+  version: 1.16.2
+  resolution: "serve-static@npm:1.16.2"
   dependencies:
-    encodeurl: ~1.0.2
+    encodeurl: ~2.0.0
     escape-html: ~1.0.3
     parseurl: ~1.3.3
-    send: 0.18.0
-  checksum: af57fc13be40d90a12562e98c0b7855cf6e8bd4c107fe9a45c212bf023058d54a1871b1c89511c3958f70626fff47faeb795f5d83f8cf88514dbaeb2b724464d
+    send: 0.19.0
+  checksum: dffc52feb4cc5c68e66d0c7f3c1824d4e989f71050aefc9bd5f822a42c54c9b814f595fc5f2b717f4c7cc05396145f3e90422af31186a93f76cf15f707019759
   languageName: node
   linkType: hard
 
@@ -25509,22 +16601,40 @@ __metadata:
   languageName: node
   linkType: hard
 
-"set-value@npm:^2.0.0, set-value@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "set-value@npm:2.0.1"
+"set-function-length@npm:^1.2.2":
+  version: 1.2.2
+  resolution: "set-function-length@npm:1.2.2"
   dependencies:
-    extend-shallow: ^2.0.1
-    is-extendable: ^0.1.1
-    is-plain-object: ^2.0.3
-    split-string: ^3.0.1
-  checksum: 09a4bc72c94641aeae950eb60dc2755943b863780fcc32e441eda964b64df5e3f50603d5ebdd33394ede722528bd55ed43aae26e9df469b4d32e2292b427b601
+    define-data-property: ^1.1.4
+    es-errors: ^1.3.0
+    function-bind: ^1.1.2
+    get-intrinsic: ^1.2.4
+    gopd: ^1.0.1
+    has-property-descriptors: ^1.0.2
+  checksum: a8248bdacdf84cb0fab4637774d9fb3c7a8e6089866d04c817583ff48e14149c87044ce683d7f50759a8c50fb87c7a7e173535b06169c87ef76f5fb276dfff72
   languageName: node
   linkType: hard
 
-"setimmediate@npm:^1.0.4":
-  version: 1.0.5
-  resolution: "setimmediate@npm:1.0.5"
-  checksum: c9a6f2c5b51a2dabdc0247db9c46460152ffc62ee139f3157440bd48e7c59425093f42719ac1d7931f054f153e2d26cf37dfeb8da17a794a58198a2705e527fd
+"set-function-name@npm:^2.0.1, set-function-name@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "set-function-name@npm:2.0.2"
+  dependencies:
+    define-data-property: ^1.1.4
+    es-errors: ^1.3.0
+    functions-have-names: ^1.2.3
+    has-property-descriptors: ^1.0.2
+  checksum: d6229a71527fd0404399fc6227e0ff0652800362510822a291925c9d7b48a1ca1a468b11b281471c34cd5a2da0db4f5d7ff315a61d26655e77f6e971e6d0c80f
+  languageName: node
+  linkType: hard
+
+"set-proto@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "set-proto@npm:1.0.0"
+  dependencies:
+    dunder-proto: ^1.0.1
+    es-errors: ^1.3.0
+    es-object-atoms: ^1.0.0
+  checksum: ec27cbbe334598547e99024403e96da32aca3e530583e4dba7f5db1c43cbc4affa9adfbd77c7b2c210b9b8b2e7b2e600bad2a6c44fd62e804d8233f96bbb62f4
   languageName: node
   linkType: hard
 
@@ -25535,13 +16645,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"setprototypeof@npm:1.1.1":
-  version: 1.1.1
-  resolution: "setprototypeof@npm:1.1.1"
-  checksum: a8bee29c1c64c245d460ce53f7460af8cbd0aceac68d66e5215153992cc8b3a7a123416353e0c642060e85cc5fd4241c92d1190eec97eda0dcb97436e8fcca3b
-  languageName: node
-  linkType: hard
-
 "setprototypeof@npm:1.2.0":
   version: 1.2.0
   resolution: "setprototypeof@npm:1.2.0"
@@ -25549,15 +16652,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"sha.js@npm:^2.4.0, sha.js@npm:^2.4.8":
-  version: 2.4.11
-  resolution: "sha.js@npm:2.4.11"
+"shallow-clone@npm:^3.0.0":
+  version: 3.0.1
+  resolution: "shallow-clone@npm:3.0.1"
   dependencies:
-    inherits: ^2.0.1
-    safe-buffer: ^5.0.1
-  bin:
-    sha.js: ./bin.js
-  checksum: ebd3f59d4b799000699097dadb831c8e3da3eb579144fd7eb7a19484cbcbb7aca3c68ba2bb362242eb09e33217de3b4ea56e4678184c334323eca24a58e3ad07
+    kind-of: ^6.0.2
+  checksum: 39b3dd9630a774aba288a680e7d2901f5c0eae7b8387fc5c8ea559918b29b3da144b7bdb990d7ccd9e11be05508ac9e459ce51d01fd65e583282f6ffafcba2e7
   languageName: node
   linkType: hard
 
@@ -25593,10 +16693,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"shell-quote@npm:^1.8.1":
-  version: 1.8.1
-  resolution: "shell-quote@npm:1.8.1"
-  checksum: 5f01201f4ef504d4c6a9d0d283fa17075f6770bfbe4c5850b074974c68062f37929ca61700d95ad2ac8822e14e8c4b990ca0e6e9272e64befd74ce5e19f0736b
+"shell-quote@npm:^1.8.1, shell-quote@npm:~1.8.2":
+  version: 1.8.2
+  resolution: "shell-quote@npm:1.8.2"
+  checksum: 1e97b62ced1c4c5135015978ebf273bed1f425a68cf84163e83fbb0f34b3ff9471e656720dab2b7cbb4ae0f58998e686d17d166c28dfb3662acd009e8bd7faed
   languageName: node
   linkType: hard
 
@@ -25607,39 +16707,62 @@ __metadata:
   languageName: node
   linkType: hard
 
-"side-channel@npm:^1.0.4":
-  version: 1.0.4
-  resolution: "side-channel@npm:1.0.4"
+"side-channel-list@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "side-channel-list@npm:1.0.0"
   dependencies:
-    call-bind: ^1.0.0
-    get-intrinsic: ^1.0.2
-    object-inspect: ^1.9.0
-  checksum: 351e41b947079c10bd0858364f32bb3a7379514c399edb64ab3dce683933483fc63fb5e4efe0a15a2e8a7e3c436b6a91736ddb8d8c6591b0460a24bb4a1ee245
+    es-errors: ^1.3.0
+    object-inspect: ^1.13.3
+  checksum: 603b928997abd21c5a5f02ae6b9cc36b72e3176ad6827fab0417ead74580cc4fb4d5c7d0a8a2ff4ead34d0f9e35701ed7a41853dac8a6d1a664fcce1a044f86f
   languageName: node
   linkType: hard
 
-"signal-exit@npm:^3.0.0, signal-exit@npm:^3.0.2":
-  version: 3.0.6
-  resolution: "signal-exit@npm:3.0.6"
-  checksum: b819ac81ba757af559dad0804233ae31bf6f054591cd8a671e9cbcf09f21c72ec3076fe87d1e04861f5b33b47d63f0694b568de99c99cd733ee2060515beb6d5
+"side-channel-map@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "side-channel-map@npm:1.0.1"
+  dependencies:
+    call-bound: ^1.0.2
+    es-errors: ^1.3.0
+    get-intrinsic: ^1.2.5
+    object-inspect: ^1.13.3
+  checksum: 42501371cdf71f4ccbbc9c9e2eb00aaaab80a4c1c429d5e8da713fd4d39ef3b8d4a4b37ed4f275798a65260a551a7131fd87fe67e922dba4ac18586d6aab8b06
+  languageName: node
+  linkType: hard
+
+"side-channel-weakmap@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "side-channel-weakmap@npm:1.0.2"
+  dependencies:
+    call-bound: ^1.0.2
+    es-errors: ^1.3.0
+    get-intrinsic: ^1.2.5
+    object-inspect: ^1.13.3
+    side-channel-map: ^1.0.1
+  checksum: a815c89bc78c5723c714ea1a77c938377ea710af20d4fb886d362b0d1f8ac73a17816a5f6640f354017d7e292a43da9c5e876c22145bac00b76cfb3468001736
+  languageName: node
+  linkType: hard
+
+"side-channel@npm:^1.0.6, side-channel@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "side-channel@npm:1.1.0"
+  dependencies:
+    es-errors: ^1.3.0
+    object-inspect: ^1.13.3
+    side-channel-list: ^1.0.0
+    side-channel-map: ^1.0.1
+    side-channel-weakmap: ^1.0.2
+  checksum: bf73d6d6682034603eb8e99c63b50155017ed78a522d27c2acec0388a792c3ede3238b878b953a08157093b85d05797217d270b7666ba1f111345fbe933380ff
   languageName: node
   linkType: hard
 
-"signal-exit@npm:^3.0.3, signal-exit@npm:^3.0.7":
+"signal-exit@npm:^3.0.0, signal-exit@npm:^3.0.2, signal-exit@npm:^3.0.3, signal-exit@npm:^3.0.7":
   version: 3.0.7
   resolution: "signal-exit@npm:3.0.7"
   checksum: a2f098f247adc367dffc27845853e9959b9e88b01cb301658cfe4194352d8d2bb32e18467c786a7fe15f1d44b233ea35633d076d5e737870b7139949d1ab6318
   languageName: node
   linkType: hard
 
-"signal-exit@npm:^4.0.1":
-  version: 4.0.2
-  resolution: "signal-exit@npm:4.0.2"
-  checksum: 41f5928431cc6e91087bf0343db786a6313dd7c6fd7e551dbc141c95bb5fb26663444fd9df8ea47c5d7fc202f60aa7468c3162a9365cbb0615fc5e1b1328fe31
-  languageName: node
-  linkType: hard
-
-"signal-exit@npm:^4.1.0":
+"signal-exit@npm:^4.0.1, signal-exit@npm:^4.1.0":
   version: 4.1.0
   resolution: "signal-exit@npm:4.1.0"
   checksum: 64c757b498cb8629ffa5f75485340594d2f8189e9b08700e69199069c8e3070fb3e255f7ab873c05dc0b3cec412aea7402e10a5990cb6a050bd33ba062a6c549
@@ -25655,32 +16778,30 @@ __metadata:
   languageName: node
   linkType: hard
 
-"simple-html-tokenizer@npm:^0.5.11, simple-html-tokenizer@npm:^0.5.8":
+"simple-html-tokenizer@npm:^0.5.11":
   version: 0.5.11
   resolution: "simple-html-tokenizer@npm:0.5.11"
   checksum: f834a5a0b169ffe10f74bd479a071a7161e0186669e28a1cd662efacdaedd27667469e2b965d5a8538d9d8e7373cb741ea8d748259221f40fa3e4bda2efbdbfc
   languageName: node
   linkType: hard
 
-"sinon@npm:^7.4.2":
-  version: 7.5.0
-  resolution: "sinon@npm:7.5.0"
+"sinon@npm:~20.0.0":
+  version: 20.0.0
+  resolution: "sinon@npm:20.0.0"
   dependencies:
-    "@sinonjs/commons": ^1.4.0
-    "@sinonjs/formatio": ^3.2.1
-    "@sinonjs/samsam": ^3.3.3
-    diff: ^3.5.0
-    lolex: ^4.2.0
-    nise: ^1.5.2
-    supports-color: ^5.5.0
-  checksum: e8cf6b3dd16e9c1ed1a2b9560c396a2d6205a4f32293b1762cb6ebb8f88cfa47db6aba45b0c1709ec396efb41d171d88c9b1ab8f32f35512eb9e5d0d0d15d307
+    "@sinonjs/commons": ^3.0.1
+    "@sinonjs/fake-timers": ^13.0.5
+    "@sinonjs/samsam": ^8.0.1
+    diff: ^7.0.0
+    supports-color: ^7.2.0
+  checksum: c6dcd3bc60aa360fede157fbed30c3984eb222990ff28f3014a5e31834cec74e5203c0575332a99c3f7976425167f70e0777507c0c58867473ad0a0c4c1a759c
   languageName: node
   linkType: hard
 
-"slash@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "slash@npm:1.0.0"
-  checksum: 4b6e21b1fba6184a7e2efb1dd173f692d8a845584c1bbf9dc818ff86f5a52fc91b413008223d17cc684604ee8bb9263a420b1182027ad9762e35388434918860
+"slash@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "slash@npm:2.0.0"
+  checksum: 512d4350735375bd11647233cb0e2f93beca6f53441015eea241fe784d8068281c3987fbaa93e7ef1c38df68d9c60013045c92837423c69115297d6169aa85e6
   languageName: node
   linkType: hard
 
@@ -25691,21 +16812,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"slash@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "slash@npm:4.0.0"
-  checksum: da8e4af73712253acd21b7853b7e0dbba776b786e82b010a5bfc8b5051a1db38ed8aba8e1e8f400dd2c9f373be91eb1c42b66e91abb407ff42b10feece5e1d2d
-  languageName: node
-  linkType: hard
-
-"slice-ansi@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "slice-ansi@npm:3.0.0"
-  dependencies:
-    ansi-styles: ^4.0.0
-    astral-regex: ^2.0.0
-    is-fullwidth-code-point: ^3.0.0
-  checksum: 5ec6d022d12e016347e9e3e98a7eb2a592213a43a65f1b61b74d2c78288da0aded781f665807a9f3876b9daa9ad94f64f77d7633a0458876c3a4fdc4eb223f24
+"slash@npm:^5.1.0":
+  version: 5.1.0
+  resolution: "slash@npm:5.1.0"
+  checksum: 70434b34c50eb21b741d37d455110258c42d2cf18c01e6518aeb7299f3c6e626330c889c0c552b5ca2ef54a8f5a74213ab48895f0640717cacefeef6830a1ba4
   languageName: node
   linkType: hard
 
@@ -25720,6 +16830,26 @@ __metadata:
   languageName: node
   linkType: hard
 
+"slice-ansi@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "slice-ansi@npm:5.0.0"
+  dependencies:
+    ansi-styles: ^6.0.0
+    is-fullwidth-code-point: ^4.0.0
+  checksum: 7e600a2a55e333a21ef5214b987c8358fe28bfb03c2867ff2cbf919d62143d1812ac27b4297a077fdaf27a03da3678e49551c93e35f9498a3d90221908a1180e
+  languageName: node
+  linkType: hard
+
+"slice-ansi@npm:^7.1.0":
+  version: 7.1.0
+  resolution: "slice-ansi@npm:7.1.0"
+  dependencies:
+    ansi-styles: ^6.2.1
+    is-fullwidth-code-point: ^5.0.0
+  checksum: 10313dd3cf7a2e4b265f527b1684c7c568210b09743fd1bd74f2194715ed13ffba653dc93a5fa79e3b1711518b8990a732cb7143aa01ddafe626e99dfa6474b2
+  languageName: node
+  linkType: hard
+
 "smart-buffer@npm:^4.2.0":
   version: 4.2.0
   resolution: "smart-buffer@npm:4.2.0"
@@ -25737,91 +16867,74 @@ __metadata:
   languageName: node
   linkType: hard
 
-"snapdragon-node@npm:^2.0.1":
-  version: 2.1.1
-  resolution: "snapdragon-node@npm:2.1.1"
-  dependencies:
-    define-property: ^1.0.0
-    isobject: ^3.0.0
-    snapdragon-util: ^3.0.1
-  checksum: 9bb57d759f9e2a27935dbab0e4a790137adebace832b393e350a8bf5db461ee9206bb642d4fe47568ee0b44080479c8b4a9ad0ebe3712422d77edf9992a672fd
-  languageName: node
-  linkType: hard
-
-"snapdragon-util@npm:^3.0.1":
-  version: 3.0.1
-  resolution: "snapdragon-util@npm:3.0.1"
-  dependencies:
-    kind-of: ^3.2.0
-  checksum: 684997dbe37ec995c03fd3f412fba2b711fc34cb4010452b7eb668be72e8811a86a12938b511e8b19baf853b325178c56d8b78d655305e5cfb0bb8b21677e7b7
-  languageName: node
-  linkType: hard
-
-"snapdragon@npm:^0.8.1":
-  version: 0.8.2
-  resolution: "snapdragon@npm:0.8.2"
+"socket.io-adapter@npm:~2.5.2":
+  version: 2.5.5
+  resolution: "socket.io-adapter@npm:2.5.5"
   dependencies:
-    base: ^0.11.1
-    debug: ^2.2.0
-    define-property: ^0.2.5
-    extend-shallow: ^2.0.1
-    map-cache: ^0.2.2
-    source-map: ^0.5.6
-    source-map-resolve: ^0.5.0
-    use: ^3.1.0
-  checksum: a197f242a8f48b11036563065b2487e9b7068f50a20dd81d9161eca6af422174fc158b8beeadbe59ce5ef172aa5718143312b3aebaae551c124b7824387c8312
-  languageName: node
-  linkType: hard
-
-"socket.io-adapter@npm:~2.4.0":
-  version: 2.4.0
-  resolution: "socket.io-adapter@npm:2.4.0"
-  checksum: a84639946dce13547b95f6e09fe167cdcd5d80941afc2e46790cc23384e0fd3c901e690ecc9bdd600939ce6292261ee15094a0b486f797ed621cfc8783d87a0c
+    debug: ~4.3.4
+    ws: ~8.17.1
+  checksum: fc52253c31d5fec24abc9bcd8d6557545fd1604387c64328def142e9a3d31c92ee8635839d668454fcdc0e7bb0442e8655623879e07b127df12756c28ef7632e
   languageName: node
   linkType: hard
 
-"socket.io-parser@npm:~4.2.0":
-  version: 4.2.1
-  resolution: "socket.io-parser@npm:4.2.1"
+"socket.io-parser@npm:~4.2.4":
+  version: 4.2.4
+  resolution: "socket.io-parser@npm:4.2.4"
   dependencies:
     "@socket.io/component-emitter": ~3.1.0
     debug: ~4.3.1
-  checksum: 2582202f22538d7e6b4436991378cb4cea3b2f8219cda24923ae35afd291ab5ad6120e7d093e41738256b6c6ad10c667dd25753c2d9a2340fead04e9286f152d
+  checksum: 61540ef99af33e6a562b9effe0fad769bcb7ec6a301aba5a64b3a8bccb611a0abdbe25f469933ab80072582006a78ca136bf0ad8adff9c77c9953581285e2263
   languageName: node
   linkType: hard
 
-"socket.io@npm:^4.1.2":
-  version: 4.5.2
-  resolution: "socket.io@npm:4.5.2"
+"socket.io@npm:4.8.1":
+  version: 4.8.1
+  resolution: "socket.io@npm:4.8.1"
   dependencies:
     accepts: ~1.3.4
     base64id: ~2.0.0
+    cors: ~2.8.5
     debug: ~4.3.2
-    engine.io: ~6.2.0
-    socket.io-adapter: ~2.4.0
-    socket.io-parser: ~4.2.0
-  checksum: 8527dd78fa3cf483a2cf0f09f64c4591186931b6765e5d8456dd3022b8786407952e3b931a83a86513c9f56852442e12f3497c761a113113e32b0c867c5ad5a7
+    engine.io: ~6.6.0
+    socket.io-adapter: ~2.5.2
+    socket.io-parser: ~4.2.4
+  checksum: d5e4d7eabba7a04c0d130a7b34c57050a1b4694e5b9eb9bd0a40dd07c1d635f3d5cacc15442f6135be8b2ecdad55dad08ee576b5c74864508890ff67329722fa
   languageName: node
   linkType: hard
 
-"socks-proxy-agent@npm:^7.0.0":
-  version: 7.0.0
-  resolution: "socks-proxy-agent@npm:7.0.0"
+"socks-proxy-agent@npm:^8.0.3":
+  version: 8.0.5
+  resolution: "socks-proxy-agent@npm:8.0.5"
   dependencies:
-    agent-base: ^6.0.2
-    debug: ^4.3.3
-    socks: ^2.6.2
-  checksum: 720554370154cbc979e2e9ce6a6ec6ced205d02757d8f5d93fe95adae454fc187a5cbfc6b022afab850a5ce9b4c7d73e0f98e381879cf45f66317a4895953846
+    agent-base: ^7.1.2
+    debug: ^4.3.4
+    socks: ^2.8.3
+  checksum: b4fbcdb7ad2d6eec445926e255a1fb95c975db0020543fbac8dfa6c47aecc6b3b619b7fb9c60a3f82c9b2969912a5e7e174a056ae4d98cb5322f3524d6036e1d
   languageName: node
   linkType: hard
 
-"socks@npm:^2.6.2":
-  version: 2.7.1
-  resolution: "socks@npm:2.7.1"
+"socks@npm:^2.8.3":
+  version: 2.8.4
+  resolution: "socks@npm:2.8.4"
   dependencies:
-    ip: ^2.0.0
+    ip-address: ^9.0.5
     smart-buffer: ^4.2.0
-  checksum: 259d9e3e8e1c9809a7f5c32238c3d4d2a36b39b83851d0f573bfde5f21c4b1288417ce1af06af1452569cd1eb0841169afd4998f0e04ba04656f6b7f0e46d748
+  checksum: cd1edc924475d5dfde534adf66038df7e62c7343e6b8c0113e52dc9bb6a0a10e25b2f136197f379d695f18e8f0f2b7f6e42977bf720ddbee912a851201c396ad
+  languageName: node
+  linkType: hard
+
+"sort-array@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "sort-array@npm:5.0.0"
+  dependencies:
+    array-back: ^6.2.2
+    typical: ^7.1.1
+  peerDependencies:
+    "@75lb/nature": ^0.1.1
+  peerDependenciesMeta:
+    "@75lb/nature":
+      optional: true
+  checksum: b14748cfa091143432e9a84e2bb1478235a63ba38fa3b5d8da31441b0d7183588f2d61454428a4349fb5f912c189c712d5eecebf3b7101da03ecd6383dc2c5c7
   languageName: node
   linkType: hard
 
@@ -25848,53 +16961,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"source-list-map@npm:^2.0.0":
-  version: 2.0.1
-  resolution: "source-list-map@npm:2.0.1"
-  checksum: 806efc6f75e7cd31e4815e7a3aaf75a45c704871ea4075cb2eb49882c6fca28998f44fc5ac91adb6de03b2882ee6fb02f951fdc85e6a22b338c32bfe19557938
-  languageName: node
-  linkType: hard
-
-"source-map-js@npm:>=0.6.2 <2.0.0, source-map-js@npm:^1.0.1, source-map-js@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "source-map-js@npm:1.0.2"
-  checksum: c049a7fc4deb9a7e9b481ae3d424cc793cb4845daa690bc5a05d428bf41bf231ced49b4cf0c9e77f9d42fdb3d20d6187619fc586605f5eabe995a316da8d377c
-  languageName: node
-  linkType: hard
-
-"source-map-resolve@npm:^0.5.0":
-  version: 0.5.3
-  resolution: "source-map-resolve@npm:0.5.3"
-  dependencies:
-    atob: ^2.1.2
-    decode-uri-component: ^0.2.0
-    resolve-url: ^0.2.1
-    source-map-url: ^0.4.0
-    urix: ^0.1.0
-  checksum: c73fa44ac00783f025f6ad9e038ab1a2e007cd6a6b86f47fe717c3d0765b4a08d264f6966f3bd7cd9dbcd69e4832783d5472e43247775b2a550d6f2155d24bae
-  languageName: node
-  linkType: hard
-
-"source-map-support@npm:^0.4.15":
-  version: 0.4.18
-  resolution: "source-map-support@npm:0.4.18"
-  dependencies:
-    source-map: ^0.5.6
-  checksum: 669aa7e992fec586fac0ba9a8dea8ce81b7328f92806335f018ffac5709afb2920e3870b4e56c68164282607229f04b8bbcf5d0e5c845eb1b5119b092e7585c0
-  languageName: node
-  linkType: hard
-
-"source-map-support@npm:~0.5.12, source-map-support@npm:~0.5.19":
-  version: 0.5.19
-  resolution: "source-map-support@npm:0.5.19"
-  dependencies:
-    buffer-from: ^1.0.0
-    source-map: ^0.6.0
-  checksum: c72802fdba9cb62b92baef18cc14cc4047608b77f0353e6c36dd993444149a466a2845332c5540d4a6630957254f0f68f4ef5a0120c33d2e83974c51a05afbac
+"source-map-js@npm:>=0.6.2 <2.0.0, source-map-js@npm:^1.0.1, source-map-js@npm:^1.2.1":
+  version: 1.2.1
+  resolution: "source-map-js@npm:1.2.1"
+  checksum: 4eb0cd997cdf228bc253bcaff9340afeb706176e64868ecd20efbe6efea931465f43955612346d6b7318789e5265bdc419bc7669c1cebe3db0eb255f57efa76b
   languageName: node
   linkType: hard
 
-"source-map-support@npm:~0.5.20":
+"source-map-support@npm:~0.5.12, source-map-support@npm:~0.5.20":
   version: 0.5.21
   resolution: "source-map-support@npm:0.5.21"
   dependencies:
@@ -25927,52 +17001,24 @@ __metadata:
   languageName: node
   linkType: hard
 
-"source-map@npm:^0.5.0, source-map@npm:^0.5.3, source-map@npm:^0.5.6, source-map@npm:^0.5.7":
-  version: 0.5.7
-  resolution: "source-map@npm:0.5.7"
-  checksum: 5dc2043b93d2f194142c7f38f74a24670cd7a0063acdaf4bf01d2964b402257ae843c2a8fa822ad5b71013b5fcafa55af7421383da919752f22ff488bc553f4d
-  languageName: node
-  linkType: hard
-
-"source-map@npm:^0.6.0, source-map@npm:^0.6.1, source-map@npm:~0.6.1":
+"source-map@npm:^0.6.0, source-map@npm:^0.6.1, source-map@npm:~0.6.0, source-map@npm:~0.6.1":
   version: 0.6.1
   resolution: "source-map@npm:0.6.1"
   checksum: 59ce8640cf3f3124f64ac289012c2b8bd377c238e316fb323ea22fbfe83da07d81e000071d7242cad7a23cd91c7de98e4df8830ec3f133cb6133a5f6e9f67bc2
   languageName: node
   linkType: hard
 
-"source-map@npm:~0.1.x":
-  version: 0.1.43
-  resolution: "source-map@npm:0.1.43"
-  dependencies:
-    amdefine: ">=0.0.4"
-  checksum: 0a230f8cae8a8ea70bd36701c33d01fb0c437b798508a561c896a99b42f5af81a206176a250fc654c7c57a736b8081c4b4a6c9887455f7d2724f847451f1d7d9
-  languageName: node
-  linkType: hard
-
-"source-map@npm:~0.7.2":
-  version: 0.7.3
-  resolution: "source-map@npm:0.7.3"
-  checksum: cd24efb3b8fa69b64bf28e3c1b1a500de77e84260c5b7f2b873f88284df17974157cc88d386ee9b6d081f08fdd8242f3fc05c953685a6ad81aad94c7393dedea
-  languageName: node
-  linkType: hard
-
-"sourcemap-codec@npm:^1.4.1, sourcemap-codec@npm:^1.4.4":
+"sourcemap-codec@npm:^1.4.8":
   version: 1.4.8
   resolution: "sourcemap-codec@npm:1.4.8"
   checksum: b57981c05611afef31605732b598ccf65124a9fcb03b833532659ac4d29ac0f7bfacbc0d6c5a28a03e84c7510e7e556d758d0bb57786e214660016fb94279316
   languageName: node
   linkType: hard
 
-"sourcemap-validator@npm:^1.1.0":
-  version: 1.1.1
-  resolution: "sourcemap-validator@npm:1.1.1"
-  dependencies:
-    jsesc: ~0.3.x
-    lodash.foreach: ^4.5.0
-    lodash.template: ^4.5.0
-    source-map: ~0.1.x
-  checksum: 51b704c08d6899dcb3abbf42cdcf39ccc2199a4c1be201935dd366f15ee8c2e43f684b1eef3c84e08f209280616943fd17feef2542873ca37471205288f13467
+"space-separated-tokens@npm:^1.0.0":
+  version: 1.1.5
+  resolution: "space-separated-tokens@npm:1.1.5"
+  checksum: 8ef68f1cfa8ccad316b7f8d0df0919d0f1f6d32101e8faeee34ea3a923ce8509c1ad562f57388585ee4951e92d27afa211ed0a077d3d5995b5ba9180331be708
   languageName: node
   linkType: hard
 
@@ -25983,60 +17029,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"spawn-command@npm:0.0.2":
-  version: 0.0.2
-  resolution: "spawn-command@npm:0.0.2"
-  checksum: e35c5d28177b4d461d33c88cc11f6f3a5079e2b132c11e1746453bbb7a0c0b8a634f07541a2a234fa4758239d88203b758def509161b651e81958894c0b4b64b
-  languageName: node
-  linkType: hard
-
-"spdx-correct@npm:^3.0.0":
-  version: 3.1.1
-  resolution: "spdx-correct@npm:3.1.1"
-  dependencies:
-    spdx-expression-parse: ^3.0.0
-    spdx-license-ids: ^3.0.0
-  checksum: 77ce438344a34f9930feffa61be0eddcda5b55fc592906ef75621d4b52c07400a97084d8701557b13f7d2aae0cb64f808431f469e566ef3fe0a3a131dcb775a6
-  languageName: node
-  linkType: hard
-
-"spdx-exceptions@npm:^2.1.0":
-  version: 2.3.0
-  resolution: "spdx-exceptions@npm:2.3.0"
-  checksum: cb69a26fa3b46305637123cd37c85f75610e8c477b6476fa7354eb67c08128d159f1d36715f19be6f9daf4b680337deb8c65acdcae7f2608ba51931540687ac0
-  languageName: node
-  linkType: hard
-
-"spdx-expression-parse@npm:^3.0.0":
-  version: 3.0.1
-  resolution: "spdx-expression-parse@npm:3.0.1"
-  dependencies:
-    spdx-exceptions: ^2.1.0
-    spdx-license-ids: ^3.0.0
-  checksum: a1c6e104a2cbada7a593eaa9f430bd5e148ef5290d4c0409899855ce8b1c39652bcc88a725259491a82601159d6dc790bedefc9016c7472f7de8de7361f8ccde
-  languageName: node
-  linkType: hard
-
-"spdx-license-ids@npm:^3.0.0":
-  version: 3.0.7
-  resolution: "spdx-license-ids@npm:3.0.7"
-  checksum: b52a88aebc19b4c69049349939e1948014c4d10f52a11870431fc1cc6551de411d19e4570f5f1df2d8b7089bec921df9017a3d5199ae2468b2b432171945278e
-  languageName: node
-  linkType: hard
-
-"split-string@npm:^3.0.1, split-string@npm:^3.0.2":
-  version: 3.1.0
-  resolution: "split-string@npm:3.1.0"
-  dependencies:
-    extend-shallow: ^3.0.0
-  checksum: ae5af5c91bdc3633628821bde92fdf9492fa0e8a63cf6a0376ed6afde93c701422a1610916f59be61972717070119e848d10dfbbd5024b7729d6a71972d2a84c
-  languageName: node
-  linkType: hard
-
-"sprintf-js@npm:^1.0.3":
-  version: 1.1.2
-  resolution: "sprintf-js@npm:1.1.2"
-  checksum: d4bb46464632b335e5faed381bd331157e0af64915a98ede833452663bc672823db49d7531c32d58798e85236581fb7342fd0270531ffc8f914e186187bf1c90
+"sprintf-js@npm:^1.1.1, sprintf-js@npm:^1.1.3":
+  version: 1.1.3
+  resolution: "sprintf-js@npm:1.1.3"
+  checksum: a3fdac7b49643875b70864a9d9b469d87a40dfeaf5d34d9d0c5b1cda5fd7d065531fcb43c76357d62254c57184a7b151954156563a4d6a747015cfb41021cad0
   languageName: node
   linkType: hard
 
@@ -26054,68 +17050,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"sshpk@npm:^1.7.0":
-  version: 1.16.1
-  resolution: "sshpk@npm:1.16.1"
-  dependencies:
-    asn1: ~0.2.3
-    assert-plus: ^1.0.0
-    bcrypt-pbkdf: ^1.0.0
-    dashdash: ^1.12.0
-    ecc-jsbn: ~0.1.1
-    getpass: ^0.1.1
-    jsbn: ~0.1.0
-    safer-buffer: ^2.0.2
-    tweetnacl: ~0.14.0
-  bin:
-    sshpk-conv: bin/sshpk-conv
-    sshpk-sign: bin/sshpk-sign
-    sshpk-verify: bin/sshpk-verify
-  checksum: 5e76afd1cedc780256f688b7c09327a8a650902d18e284dfeac97489a735299b03c3e72c6e8d22af03dbbe4d6f123fdfd5f3c4ed6bedbec72b9529a55051b857
-  languageName: node
-  linkType: hard
-
-"ssri@npm:^6.0.1":
-  version: 6.0.2
-  resolution: "ssri@npm:6.0.2"
-  dependencies:
-    figgy-pudding: ^3.5.1
-  checksum: 7c2e5d442f6252559c8987b7114bcf389fe5614bf65de09ba3e6f9a57b9b65b2967de348fcc3acccff9c069adb168140dd2c5fc2f6f4a779e604a27ef1f7d551
-  languageName: node
-  linkType: hard
-
-"ssri@npm:^9.0.0":
-  version: 9.0.1
-  resolution: "ssri@npm:9.0.1"
+"ssri@npm:^12.0.0":
+  version: 12.0.0
+  resolution: "ssri@npm:12.0.0"
   dependencies:
-    minipass: ^3.1.1
-  checksum: fb58f5e46b6923ae67b87ad5ef1c5ab6d427a17db0bead84570c2df3cd50b4ceb880ebdba2d60726588272890bae842a744e1ecce5bd2a2a582fccd5068309eb
-  languageName: node
-  linkType: hard
-
-"stable@npm:^0.1.8":
-  version: 0.1.8
-  resolution: "stable@npm:0.1.8"
-  checksum: 2ff482bb100285d16dd75cd8f7c60ab652570e8952c0bfa91828a2b5f646a0ff533f14596ea4eabd48bb7f4aeea408dce8f8515812b975d958a4cc4fa6b9dfeb
+    minipass: ^7.0.3
+  checksum: ef4b6b0ae47b4a69896f5f1c4375f953b9435388c053c36d27998bc3d73e046969ccde61ab659e679142971a0b08e50478a1228f62edb994105b280f17900c98
   languageName: node
   linkType: hard
 
 "stagehand@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "stagehand@npm:1.0.0"
+  version: 1.0.1
+  resolution: "stagehand@npm:1.0.1"
   dependencies:
     debug: ^4.1.0
-  checksum: 262ca2bfff9e505588a7595a24792814d9df27e54f8703aa5f2aa451df7f499b23a6860d42d9cd7462e37f45421365d430680705edca1ffe04d1cce481ed782a
-  languageName: node
-  linkType: hard
-
-"static-extend@npm:^0.1.1":
-  version: 0.1.2
-  resolution: "static-extend@npm:0.1.2"
-  dependencies:
-    define-property: ^0.2.5
-    object-copy: ^0.1.0
-  checksum: 8657485b831f79e388a437260baf22784540417a9b29e11572c87735df24c22b84eda42107403a64b30861b2faf13df9f7fc5525d51f9d1d2303aba5cbf4e12c
+  checksum: 4637e79fad2b2e78eb37306605e02bc48dd954fc591e55d7df104f7b74d7365a7e9c638af72bce3fd7ccbe083e683a0b8fa70be5d83c1ef6f8cd34838e212b51
   languageName: node
   linkType: hard
 
@@ -26126,73 +17075,33 @@ __metadata:
   languageName: node
   linkType: hard
 
-"statuses@npm:>= 1.4.0 < 2, statuses@npm:>= 1.5.0 < 2, statuses@npm:~1.5.0":
+"statuses@npm:>= 1.4.0 < 2, statuses@npm:~1.5.0":
   version: 1.5.0
   resolution: "statuses@npm:1.5.0"
   checksum: c469b9519de16a4bb19600205cffb39ee471a5f17b82589757ca7bd40a8d92ebb6ed9f98b5a540c5d302ccbc78f15dc03cc0280dd6e00df1335568a5d5758a5c
   languageName: node
   linkType: hard
 
-"stealthy-require@npm:^1.1.1":
-  version: 1.1.1
-  resolution: "stealthy-require@npm:1.1.1"
-  checksum: 6805b857a9f3a6a1079fc6652278038b81011f2a5b22cbd559f71a6c02087e6f1df941eb10163e3fdc5391ab5807aa46758d4258547c1f5ede31e6d9bfda8dd3
-  languageName: node
-  linkType: hard
-
-"stop-iteration-iterator@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "stop-iteration-iterator@npm:1.0.0"
-  dependencies:
-    internal-slot: ^1.0.4
-  checksum: d04173690b2efa40e24ab70e5e51a3ff31d56d699550cfad084104ab3381390daccb36652b25755e420245f3b0737de66c1879eaa2a8d4fc0a78f9bf892fcb42
-  languageName: node
-  linkType: hard
-
-"stream-browserify@npm:^2.0.1":
-  version: 2.0.2
-  resolution: "stream-browserify@npm:2.0.2"
-  dependencies:
-    inherits: ~2.0.1
-    readable-stream: ^2.0.2
-  checksum: 8de7bcab5582e9a931ae1a4768be7efe8fa4b0b95fd368d16d8cf3e494b897d6b0a7238626de5d71686e53bddf417fd59d106cfa3af0ec055f61a8d1f8fc77b3
-  languageName: node
-  linkType: hard
-
-"stream-each@npm:^1.1.0":
-  version: 1.2.3
-  resolution: "stream-each@npm:1.2.3"
-  dependencies:
-    end-of-stream: ^1.1.0
-    stream-shift: ^1.0.0
-  checksum: f243de78e9fcc60757994efc4e8ecae9f01a4b2c6a505d786b11fcaa68b1a75ca54afc1669eac9e08f19ff0230792fc40d0f3e3e2935d76971b4903af18b76ab
-  languageName: node
-  linkType: hard
-
-"stream-http@npm:^2.7.2":
-  version: 2.8.3
-  resolution: "stream-http@npm:2.8.3"
+"stream-connect@npm:^1.0.2":
+  version: 1.0.2
+  resolution: "stream-connect@npm:1.0.2"
   dependencies:
-    builtin-status-codes: ^3.0.0
-    inherits: ^2.0.1
-    readable-stream: ^2.3.6
-    to-arraybuffer: ^1.0.0
-    xtend: ^4.0.0
-  checksum: f57dfaa21a015f72e6ce6b199cf1762074cfe8acf0047bba8f005593754f1743ad0a91788f95308d9f3829ad55742399ad27b4624432f2752a08e62ef4346e05
+    array-back: ^1.0.2
+  checksum: 84dfbc7d1ca11e3d8eb224190d7dc7fc0a0ce2c77726f7c136c2d056c13bc3d9cd508cdb0a2fbd1218228cdd94675d1b85ca88331f6b3665da2ad4b86b955b95
   languageName: node
   linkType: hard
 
-"stream-shift@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "stream-shift@npm:1.0.1"
-  checksum: 59b82b44b29ec3699b5519a49b3cedcc6db58c72fb40c04e005525dfdcab1c75c4e0c180b923c380f204bed78211b9bad8faecc7b93dece4d004c3f6ec75737b
+"stream-via@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "stream-via@npm:1.0.4"
+  checksum: 22516abd3386ea3863cc98e5b52d2002444335f7477269336a9e26d2ab57f928319ce9b426c56d4ce20bb336c1f7612edccf13d3b6c97e759c306787474efe67
   languageName: node
   linkType: hard
 
-"string-argv@npm:0.3.1":
-  version: 0.3.1
-  resolution: "string-argv@npm:0.3.1"
-  checksum: efbd0289b599bee808ce80820dfe49c9635610715429c6b7cc50750f0437e3c2f697c81e5c390208c13b5d5d12d904a1546172a88579f6ee5cbaaaa4dc9ec5cf
+"string-argv@npm:^0.3.2":
+  version: 0.3.2
+  resolution: "string-argv@npm:0.3.2"
+  checksum: 8703ad3f3db0b2641ed2adbb15cf24d3945070d9a751f9e74a924966db9f325ac755169007233e8985a39a6a292f14d4fee20482989b89b96e473c4221508a0f
   languageName: node
   linkType: hard
 
@@ -26203,18 +17112,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"string-width-cjs@npm:string-width@^4.2.0, string-width@npm:^4.1.0, string-width@npm:^4.2.0":
-  version: 4.2.2
-  resolution: "string-width@npm:4.2.2"
-  dependencies:
-    emoji-regex: ^8.0.0
-    is-fullwidth-code-point: ^3.0.0
-    strip-ansi: ^6.0.0
-  checksum: 343e089b0e66e0f72aab4ad1d9b6f2c9cc5255844b0c83fd9b53f2a3b3fd0421bdd6cb05be96a73117eb012db0887a6c1d64ca95aaa50c518e48980483fea0ab
-  languageName: node
-  linkType: hard
-
-"string-width@npm:^1.0.2 || 2 || 3 || 4, string-width@npm:^4.2.3":
+"string-width-cjs@npm:string-width@^4.2.0, string-width@npm:^1.0.2 || 2 || 3 || 4, string-width@npm:^4.1.0, string-width@npm:^4.2.0, string-width@npm:^4.2.3":
   version: 4.2.3
   resolution: "string-width@npm:4.2.3"
   dependencies:
@@ -26257,102 +17155,73 @@ __metadata:
   languageName: node
   linkType: hard
 
-"string.prototype.endswith@npm:^0.2.0":
-  version: 0.2.0
-  resolution: "string.prototype.endswith@npm:0.2.0"
-  checksum: ee0d1619878a7525a6613da16b3a1d7f6d84a8d4414f78a8a1d24aef9789d4bd774d9e93eeb922a78e7f67d804e60f4cba314beb8f55327bff6e83ba39b91f24
-  languageName: node
-  linkType: hard
-
-"string.prototype.matchall@npm:^4.0.5":
-  version: 4.0.6
-  resolution: "string.prototype.matchall@npm:4.0.6"
-  dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.3
-    es-abstract: ^1.19.1
-    get-intrinsic: ^1.1.1
-    has-symbols: ^1.0.2
-    internal-slot: ^1.0.3
-    regexp.prototype.flags: ^1.3.1
-    side-channel: ^1.0.4
-  checksum: 07aca53ddd8a096a8bd0560eb8574386c6b3887a6a06b40a98abd42c94dadeed3296261fca22fec59a1ed970d199bdeb450fcb6a7390193588d9c6b5f48fe842
-  languageName: node
-  linkType: hard
-
-"string.prototype.matchall@npm:^4.0.6":
-  version: 4.0.8
-  resolution: "string.prototype.matchall@npm:4.0.8"
-  dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.4
-    es-abstract: ^1.20.4
-    get-intrinsic: ^1.1.3
-    has-symbols: ^1.0.3
-    internal-slot: ^1.0.3
-    regexp.prototype.flags: ^1.4.3
-    side-channel: ^1.0.4
-  checksum: 952da3a818de42ad1c10b576140a5e05b4de7b34b8d9dbf00c3ac8c1293e9c0f533613a39c5cda53e0a8221f2e710bc2150e730b1c2278d60004a8a35726efb6
-  languageName: node
-  linkType: hard
-
-"string.prototype.startswith@npm:^0.2.0":
-  version: 0.2.0
-  resolution: "string.prototype.startswith@npm:0.2.0"
-  checksum: b4224e2454c276baf0609c76f5db0ee6355a89a649041df9a2e49b4cdf4b424dbebbe2c070a3b5f6f00594f8f8fa98415799c7211e873e13f6ee007daae73516
-  languageName: node
-  linkType: hard
-
-"string.prototype.trim@npm:^1.2.7":
-  version: 1.2.7
-  resolution: "string.prototype.trim@npm:1.2.7"
+"string-width@npm:^7.0.0":
+  version: 7.2.0
+  resolution: "string-width@npm:7.2.0"
   dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.4
-    es-abstract: ^1.20.4
-  checksum: 05b7b2d6af63648e70e44c4a8d10d8cc457536df78b55b9d6230918bde75c5987f6b8604438c4c8652eb55e4fc9725d2912789eb4ec457d6995f3495af190c09
+    emoji-regex: ^10.3.0
+    get-east-asian-width: ^1.0.0
+    strip-ansi: ^7.1.0
+  checksum: 42f9e82f61314904a81393f6ef75b832c39f39761797250de68c041d8ba4df2ef80db49ab6cd3a292923a6f0f409b8c9980d120f7d32c820b4a8a84a2598a295
   languageName: node
   linkType: hard
 
-"string.prototype.trimend@npm:^1.0.4":
-  version: 1.0.4
-  resolution: "string.prototype.trimend@npm:1.0.4"
+"string.prototype.matchall@npm:^4.0.5, string.prototype.matchall@npm:^4.0.6":
+  version: 4.0.12
+  resolution: "string.prototype.matchall@npm:4.0.12"
   dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.3
-  checksum: 17e5aa45c3983f582693161f972c1c1fa4bbbdf22e70e582b00c91b6575f01680dc34e83005b98e31abe4d5d29e0b21fcc24690239c106c7b2315aade6a898ac
+    call-bind: ^1.0.8
+    call-bound: ^1.0.3
+    define-properties: ^1.2.1
+    es-abstract: ^1.23.6
+    es-errors: ^1.3.0
+    es-object-atoms: ^1.0.0
+    get-intrinsic: ^1.2.6
+    gopd: ^1.2.0
+    has-symbols: ^1.1.0
+    internal-slot: ^1.1.0
+    regexp.prototype.flags: ^1.5.3
+    set-function-name: ^2.0.2
+    side-channel: ^1.1.0
+  checksum: 98a09d6af91bfc6ee25556f3d7cd6646d02f5f08bda55d45528ed273d266d55a71af7291fe3fc76854deffb9168cc1a917d0b07a7d5a178c7e9537c99e6d2b57
   languageName: node
   linkType: hard
 
-"string.prototype.trimend@npm:^1.0.6":
-  version: 1.0.6
-  resolution: "string.prototype.trimend@npm:1.0.6"
+"string.prototype.trim@npm:^1.2.10":
+  version: 1.2.10
+  resolution: "string.prototype.trim@npm:1.2.10"
   dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.4
-    es-abstract: ^1.20.4
-  checksum: 0fdc34645a639bd35179b5a08227a353b88dc089adf438f46be8a7c197fc3f22f8514c1c9be4629b3cd29c281582730a8cbbad6466c60f76b5f99cf2addb132e
+    call-bind: ^1.0.8
+    call-bound: ^1.0.2
+    define-data-property: ^1.1.4
+    define-properties: ^1.2.1
+    es-abstract: ^1.23.5
+    es-object-atoms: ^1.0.0
+    has-property-descriptors: ^1.0.2
+  checksum: 87659cd8561237b6c69f5376328fda934693aedde17bb7a2c57008e9d9ff992d0c253a391c7d8d50114e0e49ff7daf86a362f7961cf92f7564cd01342ca2e385
   languageName: node
   linkType: hard
 
-"string.prototype.trimstart@npm:^1.0.4":
-  version: 1.0.4
-  resolution: "string.prototype.trimstart@npm:1.0.4"
+"string.prototype.trimend@npm:^1.0.9":
+  version: 1.0.9
+  resolution: "string.prototype.trimend@npm:1.0.9"
   dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.3
-  checksum: 3fb06818d3cccac5fa3f5f9873d984794ca0e9f6616fae6fcc745885d9efed4e17fe15f832515d9af5e16c279857fdbffdfc489ca4ed577811b017721b30302f
+    call-bind: ^1.0.8
+    call-bound: ^1.0.2
+    define-properties: ^1.2.1
+    es-object-atoms: ^1.0.0
+  checksum: cb86f639f41d791a43627784be2175daa9ca3259c7cb83e7a207a729909b74f2ea0ec5d85de5761e6835e5f443e9420c6ff3f63a845378e4a61dd793177bc287
   languageName: node
   linkType: hard
 
-"string.prototype.trimstart@npm:^1.0.6":
-  version: 1.0.6
-  resolution: "string.prototype.trimstart@npm:1.0.6"
+"string.prototype.trimstart@npm:^1.0.8":
+  version: 1.0.8
+  resolution: "string.prototype.trimstart@npm:1.0.8"
   dependencies:
-    call-bind: ^1.0.2
-    define-properties: ^1.1.4
-    es-abstract: ^1.20.4
-  checksum: 89080feef416621e6ef1279588994305477a7a91648d9436490d56010a1f7adc39167cddac7ce0b9884b8cdbef086987c4dcb2960209f2af8bac0d23ceff4f41
+    call-bind: ^1.0.7
+    define-properties: ^1.2.1
+    es-object-atoms: ^1.0.0
+  checksum: df1007a7f580a49d692375d996521dc14fd103acda7f3034b3c558a60b82beeed3a64fa91e494e164581793a8ab0ae2f59578a49896a7af6583c1f20472bce96
   languageName: node
   linkType: hard
 
@@ -26363,7 +17232,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"string_decoder@npm:^1.0.0, string_decoder@npm:^1.1.1, string_decoder@npm:^1.3.0":
+"string_decoder@npm:^1.1.1":
   version: 1.3.0
   resolution: "string_decoder@npm:1.3.0"
   dependencies:
@@ -26372,27 +17241,18 @@ __metadata:
   languageName: node
   linkType: hard
 
-"string_decoder@npm:~1.1.1":
-  version: 1.1.1
-  resolution: "string_decoder@npm:1.1.1"
-  dependencies:
-    safe-buffer: ~5.1.0
-  checksum: 9ab7e56f9d60a28f2be697419917c50cac19f3e8e6c28ef26ed5f4852289fe0de5d6997d29becf59028556f2c62983790c1d9ba1e2a3cc401768ca12d5183a5b
-  languageName: node
-  linkType: hard
-
-"stringify-object@npm:^3.3.0":
-  version: 3.3.0
-  resolution: "stringify-object@npm:3.3.0"
+"stringify-entities@npm:^3.0.1":
+  version: 3.1.0
+  resolution: "stringify-entities@npm:3.1.0"
   dependencies:
-    get-own-enumerable-property-symbols: ^3.0.0
-    is-obj: ^1.0.1
-    is-regexp: ^1.0.0
-  checksum: 6827a3f35975cfa8572e8cd3ed4f7b262def260af18655c6fde549334acdac49ddba69f3c861ea5a6e9c5a4990fe4ae870b9c0e6c31019430504c94a83b7a154
+    character-entities-html4: ^1.0.0
+    character-entities-legacy: ^1.0.0
+    xtend: ^4.0.0
+  checksum: 5b6212e2985101ddb8197d999a6c01abb610f2ba6efd6f8f7d7ec763b61cb08b55735b03febdf501c2091f484df16bc82412419ef35ee21135548f6a15881044
   languageName: node
   linkType: hard
 
-"strip-ansi-cjs@npm:strip-ansi@^6.0.1, strip-ansi@npm:^6.0.1":
+"strip-ansi-cjs@npm:strip-ansi@^6.0.1, strip-ansi@npm:^6.0.0, strip-ansi@npm:^6.0.1":
   version: 6.0.1
   resolution: "strip-ansi@npm:6.0.1"
   dependencies:
@@ -26428,16 +17288,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strip-ansi@npm:^6.0.0":
-  version: 6.0.0
-  resolution: "strip-ansi@npm:6.0.0"
-  dependencies:
-    ansi-regex: ^5.0.0
-  checksum: 04c3239ede44c4d195b0e66c0ad58b932f08bec7d05290416d361ff908ad282ecdaf5d9731e322c84f151d427436bde01f05b7422c3ec26dd927586736b0e5d0
-  languageName: node
-  linkType: hard
-
-"strip-ansi@npm:^7.0.1":
+"strip-ansi@npm:^7.0.1, strip-ansi@npm:^7.1.0":
   version: 7.1.0
   resolution: "strip-ansi@npm:7.1.0"
   dependencies:
@@ -26455,13 +17306,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strip-bom@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "strip-bom@npm:3.0.0"
-  checksum: 8d50ff27b7ebe5ecc78f1fe1e00fcdff7af014e73cf724b46fb81ef889eeb1015fc5184b64e81a2efe002180f3ba431bdd77e300da5c6685d702780fbf0c8d5b
-  languageName: node
-  linkType: hard
-
 "strip-bom@npm:^4.0.0":
   version: 4.0.0
   resolution: "strip-bom@npm:4.0.0"
@@ -26490,15 +17334,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strip-indent@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "strip-indent@npm:4.0.0"
-  dependencies:
-    min-indent: ^1.0.1
-  checksum: 06cbcd93da721c46bc13caeb1c00af93a9b18146a1c95927672d2decab6a25ad83662772417cea9317a2507fb143253ecc23c4415b64f5828cef9b638a744598
-  languageName: node
-  linkType: hard
-
 "strip-json-comments@npm:^3.1.0, strip-json-comments@npm:^3.1.1":
   version: 3.1.1
   resolution: "strip-json-comments@npm:3.1.1"
@@ -26506,6 +17341,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"strip-test-selectors@npm:0.1.0":
+  version: 0.1.0
+  resolution: "strip-test-selectors@npm:0.1.0"
+  checksum: 72e94040795d5305f7c112b619ba0e9b1f7155ad8804ad6761e98515dd39ebc490a7fba7b4628d3011e12c38a71d16a09d63630d9e77342fe86b08ad337a7144
+  languageName: node
+  linkType: hard
+
 "style-loader@npm:^2.0.0":
   version: 2.0.0
   resolution: "style-loader@npm:2.0.0"
@@ -26518,10 +17360,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"style-search@npm:^0.1.0":
-  version: 0.1.0
-  resolution: "style-search@npm:0.1.0"
-  checksum: 3cfefe335033aad6d47da0725cb48f5db91a73935954c77eab77d9e415e6668cdb406da4a4f7ef9f1aca77853cf5ba7952c45e869caa5bd6439691d88098d468
+"style-mod@npm:^4.0.0, style-mod@npm:^4.1.0":
+  version: 4.1.2
+  resolution: "style-mod@npm:4.1.2"
+  checksum: 7c5c3e82747f9bcf5f288d8d07f50848e4630fe5ff7bfe4d94cc87d6b6a2588227cbf21b4c792ac6406e5852293300a75e710714479a5c59a06af677f0825ef8
   languageName: node
   linkType: hard
 
@@ -26532,85 +17374,83 @@ __metadata:
   languageName: node
   linkType: hard
 
-"stylelint-config-recommended@npm:^11.0.0":
-  version: 11.0.0
-  resolution: "stylelint-config-recommended@npm:11.0.0"
+"stylelint-config-recommended@npm:^16.0.0":
+  version: 16.0.0
+  resolution: "stylelint-config-recommended@npm:16.0.0"
   peerDependencies:
-    stylelint: ^15.3.0
-  checksum: f6bed5995235d61a2b4bcae086fab925df3b824c77ef585f9f0f9b891b1409c0aa8ae49e8f53d6a2f851be8f7928a7d95e2b17ee876f248ce88f718a3892bf6f
+    stylelint: ^16.16.0
+  checksum: 711595ec35f387422154b14bc1d05217c48762b62dcee13ca73a0edbb7353d537e3a9f6646e9631b2988dfadc8a015a893611e6cca65971c9b99ab8bb096704f
   languageName: node
   linkType: hard
 
-"stylelint-config-standard@npm:^32.0.0":
-  version: 32.0.0
-  resolution: "stylelint-config-standard@npm:32.0.0"
+"stylelint-config-standard@npm:~38.0.0":
+  version: 38.0.0
+  resolution: "stylelint-config-standard@npm:38.0.0"
   dependencies:
-    stylelint-config-recommended: ^11.0.0
+    stylelint-config-recommended: ^16.0.0
   peerDependencies:
-    stylelint: ^15.4.0
-  checksum: 05f7481f93e0fd3d2e69ba6ef3b3b8347c2340fcc6732e3f4289cc1067ae74e87f6474b4385b8936a0ff062cc3dd08c5cc50e27d96994c6176a69d055a75537a
+    stylelint: ^16.18.0
+  checksum: 6704f80e93990a15e28043f25b926f08b6a585a6374d3610e1fa782c6e39279cdbd963c4614a58045372dc70254101f5d622f6578bbd7b2974fc3b4ce629db26
   languageName: node
   linkType: hard
 
-"stylelint-prettier@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "stylelint-prettier@npm:3.0.0"
+"stylelint-prettier@npm:~5.0.3":
+  version: 5.0.3
+  resolution: "stylelint-prettier@npm:5.0.3"
   dependencies:
     prettier-linter-helpers: ^1.0.0
   peerDependencies:
-    prettier: ">=2.0.0"
-    stylelint: ">=14.0.0"
-  checksum: 094f53ef5dbe3806524db7f580b9312ceca444651803fc08c8baa48cd9a270985c709fa4f083681a685310dc347b8e55aa93d462554ba7d4ae6258a3bdf6a278
+    prettier: ">=3.0.0"
+    stylelint: ">=16.0.0"
+  checksum: bb4461954c44338c75904388cc5079934740b351bd97fe1e739ce32281166025451c6c5eadda0920b99c24700dd657f1663d7868b452e1b57e8cc84b66b2631f
   languageName: node
   linkType: hard
 
-"stylelint@npm:^15.4.0":
-  version: 15.10.1
-  resolution: "stylelint@npm:15.10.1"
+"stylelint@npm:~16.19.1":
+  version: 16.19.1
+  resolution: "stylelint@npm:16.19.1"
   dependencies:
-    "@csstools/css-parser-algorithms": ^2.3.0
-    "@csstools/css-tokenizer": ^2.1.1
-    "@csstools/media-query-list-parser": ^2.1.2
-    "@csstools/selector-specificity": ^3.0.0
+    "@csstools/css-parser-algorithms": ^3.0.4
+    "@csstools/css-tokenizer": ^3.0.3
+    "@csstools/media-query-list-parser": ^4.0.2
+    "@csstools/selector-specificity": ^5.0.0
+    "@dual-bundle/import-meta-resolve": ^4.1.0
     balanced-match: ^2.0.0
     colord: ^2.9.3
-    cosmiconfig: ^8.2.0
-    css-functions-list: ^3.1.0
-    css-tree: ^2.3.1
-    debug: ^4.3.4
-    fast-glob: ^3.3.0
+    cosmiconfig: ^9.0.0
+    css-functions-list: ^3.2.3
+    css-tree: ^3.1.0
+    debug: ^4.3.7
+    fast-glob: ^3.3.3
     fastest-levenshtein: ^1.0.16
-    file-entry-cache: ^6.0.1
+    file-entry-cache: ^10.0.8
     global-modules: ^2.0.0
     globby: ^11.1.0
     globjoin: ^0.1.4
     html-tags: ^3.3.1
-    ignore: ^5.2.4
-    import-lazy: ^4.0.0
+    ignore: ^7.0.3
     imurmurhash: ^0.1.4
     is-plain-object: ^5.0.0
-    known-css-properties: ^0.27.0
+    known-css-properties: ^0.36.0
     mathml-tag-names: ^2.1.3
-    meow: ^10.1.5
-    micromatch: ^4.0.5
+    meow: ^13.2.0
+    micromatch: ^4.0.8
     normalize-path: ^3.0.0
-    picocolors: ^1.0.0
-    postcss: ^8.4.24
-    postcss-resolve-nested-selector: ^0.1.1
-    postcss-safe-parser: ^6.0.0
-    postcss-selector-parser: ^6.0.13
+    picocolors: ^1.1.1
+    postcss: ^8.5.3
+    postcss-resolve-nested-selector: ^0.1.6
+    postcss-safe-parser: ^7.0.1
+    postcss-selector-parser: ^7.1.0
     postcss-value-parser: ^4.2.0
     resolve-from: ^5.0.0
     string-width: ^4.2.3
-    strip-ansi: ^6.0.1
-    style-search: ^0.1.0
-    supports-hyperlinks: ^3.0.0
+    supports-hyperlinks: ^3.2.0
     svg-tags: ^1.0.0
-    table: ^6.8.1
+    table: ^6.9.0
     write-file-atomic: ^5.0.1
   bin:
     stylelint: bin/stylelint.mjs
-  checksum: 8eeae81fe4ed2dfc580d7c401806dbb058c14631abfafd0821db32f1e649aee62e3d39dda3462c6122826df91bd9799409be926e91b55b007622f51e44eb94c1
+  checksum: 5bb188187053592a481c19a4420d01cb50e78a6e68edac639a0316be1cf365df28826968345e10aaf1ec1c3ed672b91c749ca10b6e71d05ff5d181db188e50c6
   languageName: node
   linkType: hard
 
@@ -26630,7 +17470,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"supports-color@npm:^5.3.0, supports-color@npm:^5.4.0, supports-color@npm:^5.5.0":
+"supports-color@npm:^5.3.0":
   version: 5.5.0
   resolution: "supports-color@npm:5.5.0"
   dependencies:
@@ -26639,7 +17479,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"supports-color@npm:^7.0.0, supports-color@npm:^7.1.0":
+"supports-color@npm:^7.0.0, supports-color@npm:^7.1.0, supports-color@npm:^7.2.0":
   version: 7.2.0
   resolution: "supports-color@npm:7.2.0"
   dependencies:
@@ -26657,13 +17497,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"supports-hyperlinks@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "supports-hyperlinks@npm:3.0.0"
+"supports-hyperlinks@npm:^3.2.0":
+  version: 3.2.0
+  resolution: "supports-hyperlinks@npm:3.2.0"
   dependencies:
     has-flag: ^4.0.0
     supports-color: ^7.0.0
-  checksum: 41021305de5255b10d821bf93c7a781f783e1693d0faec293d7fc7ccf17011b90bde84b0295fa92ba75c6c390351fe84fdd18848cad4bf656e464a958243c3e7
+  checksum: 460594ec0024f041f61105d40f1e5fc55ffcc2d94b6048faf25a616ec8fbaea71e74d909a6851c721776f24eed67c59fd3b7c47af22a487ebab85640abdb5d3f
   languageName: node
   linkType: hard
 
@@ -26681,40 +17521,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"svgo@npm:1.3.0":
-  version: 1.3.0
-  resolution: "svgo@npm:1.3.0"
+"swagger-ui-dist@npm:~5.21.0":
+  version: 5.21.0
+  resolution: "swagger-ui-dist@npm:5.21.0"
   dependencies:
-    chalk: ^2.4.1
-    coa: ^2.0.2
-    css-select: ^2.0.0
-    css-select-base-adapter: ^0.1.1
-    css-tree: 1.0.0-alpha.33
-    csso: ^3.5.1
-    js-yaml: ^3.13.1
-    mkdirp: ~0.5.1
-    object.values: ^1.1.0
-    sax: ~1.2.4
-    stable: ^0.1.8
-    unquote: ~1.1.1
-    util.promisify: ~1.0.0
-  bin:
-    svgo: ./bin/svgo
-  checksum: 813880c96af74a90d5f52c477c71b5dda62b2a215807eab05757d6a0e0886d4e3fda564241d985d856dba225dad0b5d7409208e681fccfaa48ac90c53441238e
-  languageName: node
-  linkType: hard
-
-"swagger-ui-dist@npm:^5.9.0":
-  version: 5.9.0
-  resolution: "swagger-ui-dist@npm:5.9.0"
-  checksum: 722f5d81adf0c0a940559952f48f7cd20a3f2a53aee8771c896eee8e3bed6f78c2f231960a7c30a4dca390d1205c0b2909d84062978013bb60febc478b9fc3d9
-  languageName: node
-  linkType: hard
-
-"symbol-tree@npm:^3.2.4":
-  version: 3.2.4
-  resolution: "symbol-tree@npm:3.2.4"
-  checksum: 6e8fc7e1486b8b54bea91199d9535bb72f10842e40c79e882fc94fb7b14b89866adf2fd79efa5ebb5b658bc07fb459ccce5ac0e99ef3d72f474e74aaf284029d
+    "@scarf/scarf": =1.4.0
+  checksum: 7780be7b0f77a7be40d854d33117e7e4be77f63ac19859b0ef4243bc0dd6ba9af3b103beb8526911d6e09718f0ef5ea43854f5c7b61c5f1a7352730388a2fecf
   languageName: node
   linkType: hard
 
@@ -26751,6 +17563,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"synckit@npm:^0.11.0":
+  version: 0.11.6
+  resolution: "synckit@npm:0.11.6"
+  dependencies:
+    "@pkgr/core": ^0.2.4
+  checksum: ce910d27ee1b30ff961905e5d63d60e2cede4f33cd3dc7b46988989f83ac33b3020a193ec8121af9c999b68aa90c01ec42121ebf9fe4356cc6406b9ff037f180
+  languageName: node
+  linkType: hard
+
 "tabbable@npm:^5.3.3":
   version: 5.3.3
   resolution: "tabbable@npm:5.3.3"
@@ -26758,16 +17579,36 @@ __metadata:
   languageName: node
   linkType: hard
 
-"table@npm:^6.8.1":
-  version: 6.8.1
-  resolution: "table@npm:6.8.1"
+"tabbable@npm:^6.2.0":
+  version: 6.2.0
+  resolution: "tabbable@npm:6.2.0"
+  checksum: f8440277d223949272c74bb627a3371be21735ca9ad34c2570f7e1752bd646ccfc23a9d8b1ee65d6561243f4134f5fbbf1ad6b39ac3c4b586554accaff4a1300
+  languageName: node
+  linkType: hard
+
+"table-layout@npm:^0.4.2":
+  version: 0.4.5
+  resolution: "table-layout@npm:0.4.5"
+  dependencies:
+    array-back: ^2.0.0
+    deep-extend: ~0.6.0
+    lodash.padend: ^4.6.1
+    typical: ^2.6.1
+    wordwrapjs: ^3.0.0
+  checksum: 9642b67d1bb3d9ba85f2b95f0a65a12ec7e1186ce842c9be63f1fdf76e36e91be89955b58b7a16358e1b39a12ceb9860c41ed977d8305d792651c19f08e3f8f2
+  languageName: node
+  linkType: hard
+
+"table@npm:^6.9.0":
+  version: 6.9.0
+  resolution: "table@npm:6.9.0"
   dependencies:
     ajv: ^8.0.1
     lodash.truncate: ^4.4.2
     slice-ansi: ^4.0.0
     string-width: ^4.2.3
     strip-ansi: ^6.0.1
-  checksum: 08249c7046125d9d0a944a6e96cfe9ec66908d6b8a9db125531be6eb05fa0de047fd5542e9d43b4f987057f00a093b276b8d3e19af162a9c40db2681058fd306
+  checksum: f54a7d1c11cda8c676e1e9aff5e723646905ed4579cca14b3ce12d2b12eac3e18f5dbe2549fe0b79697164858e18961145db4dd0660bbeb0fb4032af0aaf32b4
   languageName: node
   linkType: hard
 
@@ -26784,31 +17625,31 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tapable@npm:^1.0.0, tapable@npm:^1.1.3":
-  version: 1.1.3
-  resolution: "tapable@npm:1.1.3"
-  checksum: 53ff4e7c3900051c38cc4faab428ebfd7e6ad0841af5a7ac6d5f3045c5b50e88497bfa8295b4b3fbcadd94993c9e358868b78b9fb249a76cb8b018ac8dccafd7
+"tapable@npm:^2.1.1, tapable@npm:^2.2.0, tapable@npm:^2.2.1":
+  version: 2.2.2
+  resolution: "tapable@npm:2.2.2"
+  checksum: 781b3666f4454eb506fd2bcd985c1994f2b93884ea88a7a2a5be956cad8337b31128a7591e771f7aab8e247993b2a0887d360a2d4f54382902ed89994c102740
   languageName: node
   linkType: hard
 
-"tapable@npm:^2.1.1, tapable@npm:^2.2.0":
-  version: 2.2.1
-  resolution: "tapable@npm:2.2.1"
-  checksum: 3b7a1b4d86fa940aad46d9e73d1e8739335efd4c48322cb37d073eb6f80f5281889bf0320c6d8ffcfa1a0dd5bfdbd0f9d037e252ef972aca595330538aac4d51
+"tar@npm:^7.4.3":
+  version: 7.4.3
+  resolution: "tar@npm:7.4.3"
+  dependencies:
+    "@isaacs/fs-minipass": ^4.0.0
+    chownr: ^3.0.0
+    minipass: ^7.1.2
+    minizlib: ^3.0.1
+    mkdirp: ^3.0.1
+    yallist: ^5.0.0
+  checksum: 8485350c0688331c94493031f417df069b778aadb25598abdad51862e007c39d1dd5310702c7be4a6784731a174799d8885d2fde0484269aea205b724d7b2ffa
   languageName: node
   linkType: hard
 
-"tar@npm:^6.1.11, tar@npm:^6.1.2":
-  version: 6.1.13
-  resolution: "tar@npm:6.1.13"
-  dependencies:
-    chownr: ^2.0.0
-    fs-minipass: ^2.0.0
-    minipass: ^4.0.0
-    minizlib: ^2.1.1
-    mkdirp: ^1.0.3
-    yallist: ^4.0.0
-  checksum: 8a278bed123aa9f53549b256a36b719e317c8b96fe86a63406f3c62887f78267cea9b22dc6f7007009738509800d4a4dccc444abd71d762287c90f35b002eb1c
+"temp-path@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "temp-path@npm:1.0.0"
+  checksum: 9ba6d376748532e8f10e0352392331102a3a62e442f372478cee425c260acf8262db2f6ab4efdf316b756732c63485b0c2bf92ae3c2f21554df6d779e6a1878d
   languageName: node
   linkType: hard
 
@@ -26822,34 +17663,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"terser-webpack-plugin@npm:^1.4.3":
-  version: 1.4.5
-  resolution: "terser-webpack-plugin@npm:1.4.5"
-  dependencies:
-    cacache: ^12.0.2
-    find-cache-dir: ^2.1.0
-    is-wsl: ^1.1.0
-    schema-utils: ^1.0.0
-    serialize-javascript: ^4.0.0
-    source-map: ^0.6.1
-    terser: ^4.1.2
-    webpack-sources: ^1.4.0
-    worker-farm: ^1.7.0
-  peerDependencies:
-    webpack: ^4.0.0
-  checksum: 02aada80927d3c8105d69cb00384d307b73aed67d180db5d20023a8d649149f3803ad50f9cd2ef9eb2622005de87e677198ecc5088f51422bfac5d4d57472d0e
-  languageName: node
-  linkType: hard
-
-"terser-webpack-plugin@npm:^5.1.3":
-  version: 5.3.3
-  resolution: "terser-webpack-plugin@npm:5.3.3"
+"terser-webpack-plugin@npm:^5.3.10":
+  version: 5.3.14
+  resolution: "terser-webpack-plugin@npm:5.3.14"
   dependencies:
-    "@jridgewell/trace-mapping": ^0.3.7
+    "@jridgewell/trace-mapping": ^0.3.25
     jest-worker: ^27.4.5
-    schema-utils: ^3.1.1
-    serialize-javascript: ^6.0.0
-    terser: ^5.7.2
+    schema-utils: ^4.3.0
+    serialize-javascript: ^6.0.2
+    terser: ^5.31.1
   peerDependencies:
     webpack: ^5.1.0
   peerDependenciesMeta:
@@ -26859,53 +17681,60 @@ __metadata:
       optional: true
     uglify-js:
       optional: true
-  checksum: 4b8d508d8a0f6e604addb286975f1fa670f8c3964a67abc03a7cfcfd4cdeca4b07dda6655e1c4425427fb62e4d2b0ca59d84f1b2cd83262ff73616d5d3ccdeb5
+  checksum: 13a1e67f1675a473b18d25cb0ce65c3f0a19b5e9a93213a99ea61dc4ca996ea93aa17a221965b526f5788d242836a8249ad00538fbb322e25cb69076eb55feab
   languageName: node
   linkType: hard
 
-"terser@npm:^4.1.2, terser@npm:^4.3.9":
-  version: 4.8.0
-  resolution: "terser@npm:4.8.0"
+"terser@npm:^4.3.9":
+  version: 4.8.1
+  resolution: "terser@npm:4.8.1"
   dependencies:
     commander: ^2.20.0
     source-map: ~0.6.1
     source-map-support: ~0.5.12
   bin:
     terser: bin/terser
-  checksum: f980789097d4f856c1ef4b9a7ada37beb0bb022fb8aa3057968862b5864ad7c244253b3e269c9eb0ab7d0caf97b9521273f2d1cf1e0e942ff0016e0583859c71
+  checksum: b342819bf7e82283059aaa3f22bb74deb1862d07573ba5a8947882190ad525fd9b44a15074986be083fd379c58b9a879457a330b66dcdb77b485c44267f9a55a
   languageName: node
   linkType: hard
 
-"terser@npm:^5.3.0":
-  version: 5.7.0
-  resolution: "terser@npm:5.7.0"
+"terser@npm:^5.31.1, terser@npm:^5.7.0":
+  version: 5.39.2
+  resolution: "terser@npm:5.39.2"
   dependencies:
+    "@jridgewell/source-map": ^0.3.3
+    acorn: ^8.14.0
     commander: ^2.20.0
-    source-map: ~0.7.2
-    source-map-support: ~0.5.19
+    source-map-support: ~0.5.20
   bin:
     terser: bin/terser
-  checksum: 3abeb551865079b27e2890dbec866054967d1963fc80a81e5e14e414c43db88ff53a5e88844c145df11bed01b28040aa96afd82113c6d1a6ad28409b6cae4fde
+  checksum: 986a47896503c5bc6475c751d9445d4326de2e6f8b0be2c943b7726426ad0fe2385aacb9dce1dbc3aee13171595a0234411479bc855e6c730a51f23175132c84
   languageName: node
   linkType: hard
 
-"terser@npm:^5.7.2":
-  version: 5.14.0
-  resolution: "terser@npm:5.14.0"
+"test-value@npm:^2.0.0":
+  version: 2.1.0
+  resolution: "test-value@npm:2.1.0"
   dependencies:
-    "@jridgewell/source-map": ^0.3.2
-    acorn: ^8.5.0
-    commander: ^2.20.0
-    source-map-support: ~0.5.20
-  bin:
-    terser: bin/terser
-  checksum: 9bce919c17cf028b1b41a3aca9f7e05354ff46701de39e733d6d7a43ebd9c6042d33cfa3e7ef84e5f4c17f1c429c7f40381a38c6e6d6ab1cdc46a1bf8f4e8985
+    array-back: ^1.0.3
+    typical: ^2.6.0
+  checksum: ce41ef4100c9ac84630e78d1ca06706714587faf255e44296ace1fc7bf5b888c160b8c0229d31467252a3b2b57197965194391f6ee0c54f33e0b8e3af3a33a0c
+  languageName: node
+  linkType: hard
+
+"test-value@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "test-value@npm:3.0.0"
+  dependencies:
+    array-back: ^2.0.0
+    typical: ^2.6.1
+  checksum: 5bac284cbe4b8e2024f987854952424925ba607c22e0af1b88020484e9d77d6b85e301c61f95f8f27f9eda58e4439d99056318f8b649bbc79f43e125f4f63f0b
   languageName: node
   linkType: hard
 
 "testem@npm:^3.10.1":
-  version: 3.10.1
-  resolution: "testem@npm:3.10.1"
+  version: 3.16.0
+  resolution: "testem@npm:3.16.0"
   dependencies:
     "@xmldom/xmldom": ^0.8.0
     backbone: ^1.1.2
@@ -26916,36 +17745,32 @@ __metadata:
     consolidate: ^0.16.0
     execa: ^1.0.0
     express: ^4.10.7
-    fireworm: ^0.7.0
+    fireworm: ^0.7.2
     glob: ^7.0.4
     http-proxy: ^1.13.1
     js-yaml: ^3.2.5
-    lodash.assignin: ^4.1.0
-    lodash.castarray: ^4.4.0
-    lodash.clonedeep: ^4.4.1
-    lodash.find: ^4.5.1
-    lodash.uniqby: ^4.7.0
-    mkdirp: ^1.0.4
+    lodash: ^4.17.21
+    mkdirp: ^3.0.1
     mustache: ^4.2.0
     node-notifier: ^10.0.0
     npmlog: ^6.0.0
     printf: ^0.6.1
     rimraf: ^3.0.2
-    socket.io: ^4.1.2
+    socket.io: ^4.5.4
     spawn-args: ^0.2.0
     styled_string: 0.0.1
     tap-parser: ^7.0.0
     tmp: 0.0.33
   bin:
     testem: testem.js
-  checksum: d6f05dc22186484efff4fe251af2c4af5b86f39e2430390ee5616b6d3bb3b0216d5ab3d5d31ac41e49545745e228af88c8131c54ea548c7d7f33e23234b9430d
+  checksum: feca4e9342caa42ad0fa8b0ce1ef8e78b7a547d25612582d3449b38da93d9fe3adf127f1972aea8fa651f1c5e835285076d6ccf6eccb485f07eaba8443e84c87
   languageName: node
   linkType: hard
 
-"tether@npm:^1.4.0":
-  version: 1.4.7
-  resolution: "tether@npm:1.4.7"
-  checksum: 766ac802654064b05e5785584a109101fc184266a0df99581a3ac45d33706c39d9fed314bd28daddf3532bfa0c41f81ebc133ce2c51995101ac922d3fb0477b8
+"tether@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "tether@npm:2.0.0"
+  checksum: 222f61dde68ba2a2903648fb13d58deb1f6eba020969973afb34495a27257a82c68f45c6960d70f4a6f2366fade4bdec36f184288f919b8e4417086ffac3be1b
   languageName: node
   linkType: hard
 
@@ -26970,16 +17795,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"through2@npm:^2.0.0":
-  version: 2.0.5
-  resolution: "through2@npm:2.0.5"
-  dependencies:
-    readable-stream: ~2.3.6
-    xtend: ~4.0.1
-  checksum: beb0f338aa2931e5660ec7bf3ad949e6d2e068c31f4737b9525e5201b824ac40cac6a337224856b56bd1ddd866334bbfb92a9f57cd6f66bc3f18d3d86fc0fe50
-  languageName: node
-  linkType: hard
-
 "through2@npm:^3.0.1":
   version: 3.0.2
   resolution: "through2@npm:3.0.2"
@@ -26990,29 +17805,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"through@npm:^2.3.6, through@npm:^2.3.8":
+"through@npm:^2.3.6":
   version: 2.3.8
   resolution: "through@npm:2.3.8"
   checksum: a38c3e059853c494af95d50c072b83f8b676a9ba2818dcc5b108ef252230735c54e0185437618596c790bbba8fcdaef5b290405981ffa09dce67b1f1bf190cbd
   languageName: node
   linkType: hard
 
-"time-zone@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "time-zone@npm:1.0.0"
-  checksum: e46f5a69b8c236dcd8e91e29d40d4e7a3495ed4f59888c3f84ce1d9678e20461421a6ba41233509d47dd94bc18f1a4377764838b21b584663f942b3426dcbce8
-  languageName: node
-  linkType: hard
-
-"timers-browserify@npm:^2.0.4":
-  version: 2.0.12
-  resolution: "timers-browserify@npm:2.0.12"
-  dependencies:
-    setimmediate: ^1.0.4
-  checksum: ec37ae299066bef6c464dcac29c7adafba1999e7227a9bdc4e105a459bee0f0b27234a46bfd7ab4041da79619e06a58433472867a913d01c26f8a203f87cee70
-  languageName: node
-  linkType: hard
-
 "tiny-glob@npm:0.2.9":
   version: 0.2.9
   resolution: "tiny-glob@npm:0.2.9"
@@ -27037,6 +17836,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tinyglobby@npm:^0.2.12":
+  version: 0.2.13
+  resolution: "tinyglobby@npm:0.2.13"
+  dependencies:
+    fdir: ^6.4.4
+    picomatch: ^4.0.2
+  checksum: 3a2e87a2518cb3616057b0aa58be4f17771ae78c6890556516ae1e631f8ce4cfee1ba1dcb62fcc54a64e2bdd6c3104f4f3d021e1a3e3f8fb0875bca380b913e5
+  languageName: node
+  linkType: hard
+
 "tippy.js@npm:^6.3.7":
   version: 6.3.7
   resolution: "tippy.js@npm:6.3.7"
@@ -27074,11 +17883,9 @@ __metadata:
   linkType: hard
 
 "tmp@npm:^0.2.1":
-  version: 0.2.1
-  resolution: "tmp@npm:0.2.1"
-  dependencies:
-    rimraf: ^3.0.0
-  checksum: 8b1214654182575124498c87ca986ac53dc76ff36e8f0e0b67139a8d221eaecfdec108c0e6ec54d76f49f1f72ab9325500b246f562b926f85bcdfca8bf35df9e
+  version: 0.2.3
+  resolution: "tmp@npm:0.2.3"
+  checksum: 73b5c96b6e52da7e104d9d44afb5d106bb1e16d9fa7d00dbeb9e6522e61b571fbdb165c756c62164be9a3bbe192b9b268c236d370a2a0955c7689cd2ae377b95
   languageName: node
   linkType: hard
 
@@ -27089,46 +17896,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"to-arraybuffer@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "to-arraybuffer@npm:1.0.1"
-  checksum: 31433c10b388722729f5da04c6b2a06f40dc84f797bb802a5a171ced1e599454099c6c5bc5118f4b9105e7d049d3ad9d0f71182b77650e4fdb04539695489941
-  languageName: node
-  linkType: hard
-
-"to-fast-properties@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "to-fast-properties@npm:1.0.3"
-  checksum: bd0abb58c4722851df63419de3f6d901d5118f0440d3f71293ed776dd363f2657edaaf2dc470e3f6b7b48eb84aa411193b60db8a4a552adac30de9516c5cc580
-  languageName: node
-  linkType: hard
-
-"to-fast-properties@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "to-fast-properties@npm:2.0.0"
-  checksum: be2de62fe58ead94e3e592680052683b1ec986c72d589e7b21e5697f8744cdbf48c266fa72f6c15932894c10187b5f54573a3bcf7da0bfd964d5caf23d436168
-  languageName: node
-  linkType: hard
-
-"to-object-path@npm:^0.3.0":
-  version: 0.3.0
-  resolution: "to-object-path@npm:0.3.0"
-  dependencies:
-    kind-of: ^3.0.2
-  checksum: 9425effee5b43e61d720940fa2b889623f77473d459c2ce3d4a580a4405df4403eec7be6b857455908070566352f9e2417304641ed158dda6f6a365fe3e66d70
-  languageName: node
-  linkType: hard
-
-"to-regex-range@npm:^2.1.0":
-  version: 2.1.1
-  resolution: "to-regex-range@npm:2.1.1"
-  dependencies:
-    is-number: ^3.0.0
-    repeat-string: ^1.6.1
-  checksum: 46093cc14be2da905cc931e442d280b2e544e2bfdb9a24b3cf821be8d342f804785e5736c108d5be026021a05d7b38144980a61917eee3c88de0a5e710e10320
-  languageName: node
-  linkType: hard
-
 "to-regex-range@npm:^5.0.1":
   version: 5.0.1
   resolution: "to-regex-range@npm:5.0.1"
@@ -27138,22 +17905,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"to-regex@npm:^3.0.1, to-regex@npm:^3.0.2":
-  version: 3.0.2
-  resolution: "to-regex@npm:3.0.2"
+"to-vfile@npm:^6.1.0":
+  version: 6.1.0
+  resolution: "to-vfile@npm:6.1.0"
   dependencies:
-    define-property: ^2.0.2
-    extend-shallow: ^3.0.2
-    regex-not: ^1.0.2
-    safe-regex: ^1.1.0
-  checksum: 4ed4a619059b64e204aad84e4e5f3ea82d97410988bcece7cf6cbfdbf193d11bff48cf53842d88b8bb00b1bfc0d048f61f20f0709e6f393fd8fe0122662d9db4
-  languageName: node
-  linkType: hard
-
-"toidentifier@npm:1.0.0":
-  version: 1.0.0
-  resolution: "toidentifier@npm:1.0.0"
-  checksum: 199e6bfca1531d49b3506cff02353d53ec987c9ee10ee272ca6484ed97f1fc10fb77c6c009079ca16d5c5be4a10378178c3cacdb41ce9ec954c3297c74c6053e
+    is-buffer: ^2.0.0
+    vfile: ^4.0.0
+  checksum: 7331aecca00d591bb904277e7ba65b9a12275a4ab035b1dd2cf21ec22f27cca4d0ee9802e73485e9c4bd8a4ca219c740a3ff724413327fb51c784466c8be18fc
   languageName: node
   linkType: hard
 
@@ -27164,43 +17922,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tough-cookie@npm:^2.3.3, tough-cookie@npm:~2.5.0":
-  version: 2.5.0
-  resolution: "tough-cookie@npm:2.5.0"
-  dependencies:
-    psl: ^1.1.28
-    punycode: ^2.1.1
-  checksum: 16a8cd090224dd176eee23837cbe7573ca0fa297d7e468ab5e1c02d49a4e9a97bb05fef11320605eac516f91d54c57838a25864e8680e27b069a5231d8264977
-  languageName: node
-  linkType: hard
-
-"tough-cookie@npm:^4.0.0":
-  version: 4.0.0
-  resolution: "tough-cookie@npm:4.0.0"
-  dependencies:
-    psl: ^1.1.33
-    punycode: ^2.1.1
-    universalify: ^0.1.2
-  checksum: 0891b37eb7d17faa3479d47f0dce2e3007f2583094ad272f2670d120fbcc3df3b0b0a631ba96ecad49f9e2297d93ff8995ce0d3292d08dd7eabe162f5b224d69
-  languageName: node
-  linkType: hard
-
-"tr46@npm:^2.0.2":
-  version: 2.0.2
-  resolution: "tr46@npm:2.0.2"
-  dependencies:
-    punycode: ^2.1.1
-  checksum: 2b2b3dfa6bc65d027b2fac729fba0fb5b9d98af7b69ad6876c0f088ebf127f2d53e5a4d4464e5de40380cf721f392262c9183d2a05cea4967a890e8801c842f6
-  languageName: node
-  linkType: hard
-
-"tracked-built-ins@npm:^3.1.1":
-  version: 3.2.0
-  resolution: "tracked-built-ins@npm:3.2.0"
+"tracked-built-ins@npm:~3.4.0":
+  version: 3.4.0
+  resolution: "tracked-built-ins@npm:3.4.0"
   dependencies:
-    "@embroider/addon-shim": ^1.8.3
+    "@embroider/addon-shim": ^1.8.7
+    decorator-transforms: ^2.0.0
     ember-tracked-storage-polyfill: ^1.0.0
-  checksum: 262c8df5cfa2911a9b2288e1d34aa9b07b6e5673d0138531445e86426253176f51f4c96083f60e564a380df1f489cdd0bc522b75a9b04fdadfe374f543bbed85
+  checksum: 4b65ebfa9f395d72733c1e29f88e09e125bb493c36151a2c56e4a5fc427690113dd0baf86ee0ac5094bfb58c2ea7983027e2def7e2014c120defbe80ccd2fed5
   languageName: node
   linkType: hard
 
@@ -27216,10 +17945,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"traverse@npm:^0.6.6":
-  version: 0.6.6
-  resolution: "traverse@npm:0.6.6"
-  checksum: e2afa72f11efa9ba31ed763d2d9d2aa244612f22015d16c0ea3ba5f6ca8bf071de87f8108b721885cce06ea4a36ef4605d9228c67e431d9015ea4685cb364420
+"traverse@npm:^0.6.7":
+  version: 0.6.11
+  resolution: "traverse@npm:0.6.11"
+  dependencies:
+    gopd: ^1.2.0
+    typedarray.prototype.slice: ^1.0.5
+    which-typed-array: ^1.1.18
+  checksum: 7cb89a604b0f09096a553497f9f0b80288ce41f869cafe2183c36a942b3b45133382e50d6d0f9f064fb2713b21813ace02a467e4b432e28623d5273236bfb2bf
   languageName: node
   linkType: hard
 
@@ -27258,21 +17991,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"trim-newlines@npm:^4.0.2":
-  version: 4.1.1
-  resolution: "trim-newlines@npm:4.1.1"
-  checksum: 5b09f8e329e8f33c1111ef26906332ba7ba7248cde3e26fc054bb3d69f2858bf5feedca9559c572ff91f33e52977c28e0d41c387df6a02a633cbb8c2d8238627
-  languageName: node
-  linkType: hard
-
-"trim-right@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "trim-right@npm:1.0.1"
-  checksum: 9120af534e006a7424a4f9358710e6e707887b6ccf7ea69e50d6ac6464db1fe22268400def01752f09769025d480395159778153fb98d4a2f6f40d4cf5d4f3b6
-  languageName: node
-  linkType: hard
-
-"trough@npm:^1.0.0":
+"trough@npm:^1.0.0, trough@npm:^1.0.5":
   version: 1.0.5
   resolution: "trough@npm:1.0.5"
   checksum: d6c8564903ed00e5258bab92134b020724dbbe83148dc72e4bf6306c03ed8843efa1bcc773fa62410dd89161ecb067432dd5916501793508a9506cacbc408e25
@@ -27286,24 +18005,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tslib@npm:^2.0.3":
-  version: 2.2.0
-  resolution: "tslib@npm:2.2.0"
-  checksum: a48c9639f7496fa701ea8ffe0561070fcb44c104a59632f7f845c0af00825c99b6373575ec59b2b5cdbfd7505875086dbe5dc83312304d8979f22ce571218ca3
-  languageName: node
-  linkType: hard
-
-"tslib@npm:^2.1.0":
-  version: 2.4.1
-  resolution: "tslib@npm:2.4.1"
-  checksum: 19480d6e0313292bd6505d4efe096a6b31c70e21cf08b5febf4da62e95c265c8f571f7b36fcc3d1a17e068032f59c269fab3459d6cd3ed6949eafecf64315fca
-  languageName: node
-  linkType: hard
-
-"tslib@npm:^2.3.1":
-  version: 2.3.1
-  resolution: "tslib@npm:2.3.1"
-  checksum: de17a98d4614481f7fcb5cd53ffc1aaf8654313be0291e1bfaee4b4bb31a20494b7d218ff2e15017883e8ea9626599b3b0e0229c18383ba9dce89da2adf15cb9
+"tslib@npm:^2.0.3, tslib@npm:^2.1.0, tslib@npm:^2.4.1, tslib@npm:^2.8.1":
+  version: 2.8.1
+  resolution: "tslib@npm:2.8.1"
+  checksum: e4aba30e632b8c8902b47587fd13345e2827fa639e7c3121074d5ee0880723282411a8838f830b55100cbe4517672f84a2472667d355b81e8af165a55dc6203a
   languageName: node
   linkType: hard
 
@@ -27318,29 +18023,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tty-browserify@npm:0.0.0":
-  version: 0.0.0
-  resolution: "tty-browserify@npm:0.0.0"
-  checksum: a06f746acc419cb2527ba19b6f3bd97b4a208c03823bfb37b2982629d2effe30ebd17eaed0d7e2fc741f3c4f2a0c43455bd5fb4194354b378e78cfb7ca687f59
-  languageName: node
-  linkType: hard
-
-"tunnel-agent@npm:^0.6.0":
-  version: 0.6.0
-  resolution: "tunnel-agent@npm:0.6.0"
-  dependencies:
-    safe-buffer: ^5.0.1
-  checksum: 05f6510358f8afc62a057b8b692f05d70c1782b70db86d6a1e0d5e28a32389e52fa6e7707b6c5ecccacc031462e4bc35af85ecfe4bbc341767917b7cf6965711
-  languageName: node
-  linkType: hard
-
-"tweetnacl@npm:^0.14.3, tweetnacl@npm:~0.14.0":
-  version: 0.14.5
-  resolution: "tweetnacl@npm:0.14.5"
-  checksum: 6061daba1724f59473d99a7bb82e13f211cdf6e31315510ae9656fefd4779851cb927adad90f3b488c8ed77c106adc0421ea8055f6f976ff21b27c5c4e918487
-  languageName: node
-  linkType: hard
-
 "type-check@npm:^0.4.0, type-check@npm:~0.4.0":
   version: 0.4.0
   resolution: "type-check@npm:0.4.0"
@@ -27350,15 +18032,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"type-check@npm:~0.3.2":
-  version: 0.3.2
-  resolution: "type-check@npm:0.3.2"
-  dependencies:
-    prelude-ls: ~1.1.2
-  checksum: dd3b1495642731bc0e1fc40abe5e977e0263005551ac83342ecb6f4f89551d106b368ec32ad3fb2da19b3bd7b2d1f64330da2ea9176d8ddbfe389fb286eb5124
-  languageName: node
-  linkType: hard
-
 "type-detect@npm:4.0.8":
   version: 4.0.8
   resolution: "type-detect@npm:4.0.8"
@@ -27366,6 +18039,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"type-detect@npm:^4.1.0":
+  version: 4.1.0
+  resolution: "type-detect@npm:4.1.0"
+  checksum: 3b32f873cd02bc7001b00a61502b7ddc4b49278aabe68d652f732e1b5d768c072de0bc734b427abf59d0520a5f19a2e07309ab921ef02018fa1cb4af155cdb37
+  languageName: node
+  linkType: hard
+
 "type-fest@npm:^0.11.0":
   version: 0.11.0
   resolution: "type-fest@npm:0.11.0"
@@ -27387,14 +18067,21 @@ __metadata:
   languageName: node
   linkType: hard
 
-"type-fest@npm:^1.0.1, type-fest@npm:^1.2.1, type-fest@npm:^1.2.2":
+"type-fest@npm:^1.2.1":
   version: 1.4.0
   resolution: "type-fest@npm:1.4.0"
   checksum: b011c3388665b097ae6a109a437a04d6f61d81b7357f74cbcb02246f2f5bd72b888ae33631b99871388122ba0a87f4ff1c94078e7119ff22c70e52c0ff828201
   languageName: node
   linkType: hard
 
-"type-is@npm:~1.6.17, type-is@npm:~1.6.18":
+"type-fest@npm:^4.35.0":
+  version: 4.41.0
+  resolution: "type-fest@npm:4.41.0"
+  checksum: 7055c0e3eb188425d07403f1d5dc175ca4c4f093556f26871fe22041bc93d137d54bef5851afa320638ca1379106c594f5aa153caa654ac1a7f22c71588a4e80
+  languageName: node
+  linkType: hard
+
+"type-is@npm:~1.6.18":
   version: 1.6.18
   resolution: "type-is@npm:1.6.18"
   dependencies:
@@ -27404,14 +18091,56 @@ __metadata:
   languageName: node
   linkType: hard
 
-"typed-array-length@npm:^1.0.4":
+"typed-array-buffer@npm:^1.0.3":
+  version: 1.0.3
+  resolution: "typed-array-buffer@npm:1.0.3"
+  dependencies:
+    call-bound: ^1.0.3
+    es-errors: ^1.3.0
+    is-typed-array: ^1.1.14
+  checksum: 3fb91f0735fb413b2bbaaca9fabe7b8fc14a3fa5a5a7546bab8a57e755be0e3788d893195ad9c2b842620592de0e68d4c077d4c2c41f04ec25b8b5bb82fa9a80
+  languageName: node
+  linkType: hard
+
+"typed-array-byte-length@npm:^1.0.3":
+  version: 1.0.3
+  resolution: "typed-array-byte-length@npm:1.0.3"
+  dependencies:
+    call-bind: ^1.0.8
+    for-each: ^0.3.3
+    gopd: ^1.2.0
+    has-proto: ^1.2.0
+    is-typed-array: ^1.1.14
+  checksum: cda9352178ebeab073ad6499b03e938ebc30c4efaea63a26839d89c4b1da9d2640b0d937fc2bd1f049eb0a38def6fbe8a061b601292ae62fe079a410ce56e3a6
+  languageName: node
+  linkType: hard
+
+"typed-array-byte-offset@npm:^1.0.4":
   version: 1.0.4
-  resolution: "typed-array-length@npm:1.0.4"
+  resolution: "typed-array-byte-offset@npm:1.0.4"
+  dependencies:
+    available-typed-arrays: ^1.0.7
+    call-bind: ^1.0.8
+    for-each: ^0.3.3
+    gopd: ^1.2.0
+    has-proto: ^1.2.0
+    is-typed-array: ^1.1.15
+    reflect.getprototypeof: ^1.0.9
+  checksum: 670b7e6bb1d3c2cf6160f27f9f529e60c3f6f9611c67e47ca70ca5cfa24ad95415694c49d1dbfeda016d3372cab7dfc9e38c7b3e1bb8d692cae13a63d3c144d7
+  languageName: node
+  linkType: hard
+
+"typed-array-length@npm:^1.0.7":
+  version: 1.0.7
+  resolution: "typed-array-length@npm:1.0.7"
   dependencies:
-    call-bind: ^1.0.2
+    call-bind: ^1.0.7
     for-each: ^0.3.3
-    is-typed-array: ^1.1.9
-  checksum: 2228febc93c7feff142b8c96a58d4a0d7623ecde6c7a24b2b98eb3170e99f7c7eff8c114f9b283085cd59dcd2bd43aadf20e25bba4b034a53c5bb292f71f8956
+    gopd: ^1.0.1
+    is-typed-array: ^1.1.13
+    possible-typed-array-names: ^1.0.0
+    reflect.getprototypeof: ^1.0.6
+  checksum: deb1a4ffdb27cd930b02c7030cb3e8e0993084c643208e52696e18ea6dd3953dfc37b939df06ff78170423d353dc8b10d5bae5796f3711c1b3abe52872b3774c
   languageName: node
   linkType: hard
 
@@ -27424,57 +18153,87 @@ __metadata:
   languageName: node
   linkType: hard
 
-"typedarray@npm:^0.0.6":
-  version: 0.0.6
-  resolution: "typedarray@npm:0.0.6"
-  checksum: 33b39f3d0e8463985eeaeeacc3cb2e28bc3dfaf2a5ed219628c0b629d5d7b810b0eb2165f9f607c34871d5daa92ba1dc69f49051cf7d578b4cbd26c340b9d1b1
+"typedarray.prototype.slice@npm:^1.0.5":
+  version: 1.0.5
+  resolution: "typedarray.prototype.slice@npm:1.0.5"
+  dependencies:
+    call-bind: ^1.0.8
+    define-properties: ^1.2.1
+    es-abstract: ^1.23.9
+    es-errors: ^1.3.0
+    get-proto: ^1.0.1
+    math-intrinsics: ^1.1.0
+    typed-array-buffer: ^1.0.3
+    typed-array-byte-offset: ^1.0.4
+  checksum: 51e5f1fd49e45cc6006fa3f6ad65cbb11a493529a53e4d82b993c34fe21f40c325cfca127a4cf6b6b36d49425e192cc90a1e306c6ed47649bd4b2870e040146d
   languageName: node
   linkType: hard
 
 "typescript-memoize@npm:^1.0.0-alpha.3, typescript-memoize@npm:^1.0.1":
-  version: 1.1.0
-  resolution: "typescript-memoize@npm:1.1.0"
-  checksum: a7d3357adbf421972619397c5db562664f3d440629a5afbb510c09e23e3a176424f600c3c853addc2234a9b7be3e61dae984771c057a76980fab67fb30c70d64
+  version: 1.1.1
+  resolution: "typescript-memoize@npm:1.1.1"
+  checksum: c4035ccda6c156437e0a302f4a0b4cbdfa70c59729d20434f66ecefd45ab5df057792eafe9e05e3e167efc6221b70f474b2789f93a2b0da2a949bc419f3b60ce
   languageName: node
   linkType: hard
 
 "typescript@npm:^4.5.4":
-  version: 4.8.4
-  resolution: "typescript@npm:4.8.4"
+  version: 4.9.5
+  resolution: "typescript@npm:4.9.5"
   bin:
     tsc: bin/tsc
     tsserver: bin/tsserver
-  checksum: 3e4f061658e0c8f36c820802fa809e0fd812b85687a9a2f5430bc3d0368e37d1c9605c3ce9b39df9a05af2ece67b1d844f9f6ea8ff42819f13bcb80f85629af0
+  checksum: ee000bc26848147ad423b581bd250075662a354d84f0e06eb76d3b892328d8d4440b7487b5a83e851b12b255f55d71835b008a66cbf8f255a11e4400159237db
   languageName: node
   linkType: hard
 
-"typescript@npm:^4.9.5":
-  version: 4.9.5
-  resolution: "typescript@npm:4.9.5"
+"typescript@npm:~5.8.3":
+  version: 5.8.3
+  resolution: "typescript@npm:5.8.3"
   bin:
     tsc: bin/tsc
     tsserver: bin/tsserver
-  checksum: ee000bc26848147ad423b581bd250075662a354d84f0e06eb76d3b892328d8d4440b7487b5a83e851b12b255f55d71835b008a66cbf8f255a11e4400159237db
+  checksum: cb1d081c889a288b962d3c8ae18d337ad6ee88a8e81ae0103fa1fecbe923737f3ba1dbdb3e6d8b776c72bc73bfa6d8d850c0306eed1a51377d2fccdfd75d92c4
   languageName: node
   linkType: hard
 
 "typescript@patch:typescript@^4.5.4#~builtin<compat/typescript>":
-  version: 4.8.4
-  resolution: "typescript@patch:typescript@npm%3A4.8.4#~builtin<compat/typescript>::version=4.8.4&hash=1a91c8"
+  version: 4.9.5
+  resolution: "typescript@patch:typescript@npm%3A4.9.5#~builtin<compat/typescript>::version=4.9.5&hash=23ec76"
   bin:
     tsc: bin/tsc
     tsserver: bin/tsserver
-  checksum: c981e82b77a5acdcc4e69af9c56cdecf5b934a87a08e7b52120596701e389a878b8e3f860e73ffb287bf649cc47a8c741262ce058148f71de4cdd88bb9c75153
+  checksum: ab417a2f398380c90a6cf5a5f74badd17866adf57f1165617d6a551f059c3ba0a3e4da0d147b3ac5681db9ac76a303c5876394b13b3de75fdd5b1eaa06181c9d
   languageName: node
   linkType: hard
 
-"typescript@patch:typescript@^4.9.5#~builtin<compat/typescript>":
-  version: 4.9.5
-  resolution: "typescript@patch:typescript@npm%3A4.9.5#~builtin<compat/typescript>::version=4.9.5&hash=23ec76"
+"typescript@patch:typescript@~5.8.3#~builtin<compat/typescript>":
+  version: 5.8.3
+  resolution: "typescript@patch:typescript@npm%3A5.8.3#~builtin<compat/typescript>::version=5.8.3&hash=85af82"
   bin:
     tsc: bin/tsc
     tsserver: bin/tsserver
-  checksum: ab417a2f398380c90a6cf5a5f74badd17866adf57f1165617d6a551f059c3ba0a3e4da0d147b3ac5681db9ac76a303c5876394b13b3de75fdd5b1eaa06181c9d
+  checksum: 1b503525a88ff0ff5952e95870971c4fb2118c17364d60302c21935dedcd6c37e6a0a692f350892bafcef6f4a16d09073fe461158547978d2f16fbe4cb18581c
+  languageName: node
+  linkType: hard
+
+"typical@npm:^2.6.0, typical@npm:^2.6.1":
+  version: 2.6.1
+  resolution: "typical@npm:2.6.1"
+  checksum: 6af04fefe50d90d3471f058b2cdc0f49b7436bdd605cd00acea7965926ff388a5a7d692ef144f45fccee6f8e896c065702ecc44b69057e2ce88c09e897c7d3a4
+  languageName: node
+  linkType: hard
+
+"typical@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "typical@npm:4.0.0"
+  checksum: a242081956825328f535e6195a924240b34daf6e7fdb573a1809a42b9f37fb8114fa99c7ab89a695e0cdb419d4149d067f6723e4b95855ffd39c6c4ca378efb3
+  languageName: node
+  linkType: hard
+
+"typical@npm:^7.1.1":
+  version: 7.3.0
+  resolution: "typical@npm:7.3.0"
+  checksum: edbb9beed7ffb355806d434d1dd0d41a2b78be0a41d9f1684fabbd4fb512ee220989b5ff91b04c79d19b850d6025d6c07417d63b8e7c9a3b2229a4a0676e17da
   languageName: node
   linkType: hard
 
@@ -27485,60 +18244,62 @@ __metadata:
   languageName: node
   linkType: hard
 
-"uglify-js@npm:^3.1.4":
-  version: 3.14.3
-  resolution: "uglify-js@npm:3.14.3"
-  bin:
-    uglifyjs: bin/uglifyjs
-  checksum: eef57b4fec031f687bef46182c33de5eff6bc40fec8d46152f3b92bb044602dd524a04e33ca5f7391f82db969b92ef6aded860f8a4ee5f4bf796d7420b030236
+"uc.micro@npm:^2.0.0, uc.micro@npm:^2.1.0":
+  version: 2.1.0
+  resolution: "uc.micro@npm:2.1.0"
+  checksum: 37197358242eb9afe367502d4638ac8c5838b78792ab218eafe48287b0ed28aaca268ec0392cc5729f6c90266744de32c06ae938549aee041fc93b0f9672d6b2
   languageName: node
   linkType: hard
 
-"unbox-primitive@npm:^1.0.0, unbox-primitive@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "unbox-primitive@npm:1.0.1"
-  dependencies:
-    function-bind: ^1.1.1
-    has-bigints: ^1.0.1
-    has-symbols: ^1.0.2
-    which-boxed-primitive: ^1.0.2
-  checksum: 89d950e18fb45672bc6b3c961f1e72c07beb9640c7ceed847b571ba6f7d2af570ae1a2584cfee268b9d9ea1e3293f7e33e0bc29eaeb9f8e8a0bab057ff9e6bba
+"uglify-js@npm:^3.1.4":
+  version: 3.19.3
+  resolution: "uglify-js@npm:3.19.3"
+  bin:
+    uglifyjs: bin/uglifyjs
+  checksum: 7ed6272fba562eb6a3149cfd13cda662f115847865c03099e3995a0e7a910eba37b82d4fccf9e88271bb2bcbe505bb374967450f433c17fa27aa36d94a8d0553
   languageName: node
   linkType: hard
 
-"unbox-primitive@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "unbox-primitive@npm:1.0.2"
+"unbox-primitive@npm:^1.1.0":
+  version: 1.1.0
+  resolution: "unbox-primitive@npm:1.1.0"
   dependencies:
-    call-bind: ^1.0.2
+    call-bound: ^1.0.3
     has-bigints: ^1.0.2
-    has-symbols: ^1.0.3
-    which-boxed-primitive: ^1.0.2
-  checksum: b7a1cf5862b5e4b5deb091672ffa579aa274f648410009c81cca63fed3b62b610c4f3b773f912ce545bb4e31edc3138975b5bc777fc6e4817dca51affb6380e9
+    has-symbols: ^1.1.0
+    which-boxed-primitive: ^1.1.1
+  checksum: 729f13b84a5bfa3fead1d8139cee5c38514e63a8d6a437819a473e241ba87eeb593646568621c7fc7f133db300ef18d65d1a5a60dc9c7beb9000364d93c581df
   languageName: node
   linkType: hard
 
 "underscore.string@npm:^3.2.2, underscore.string@npm:~3.3.4":
-  version: 3.3.5
-  resolution: "underscore.string@npm:3.3.5"
+  version: 3.3.6
+  resolution: "underscore.string@npm:3.3.6"
   dependencies:
-    sprintf-js: ^1.0.3
+    sprintf-js: ^1.1.1
     util-deprecate: ^1.0.2
-  checksum: 86c60f4e9c3176ae77a548ec2ac659cc3cf48b93c7cff7d548f7c91569fc15885c90816245bf4d6925241f64b54508fc60aac562246ea2de2e50d0411e82a702
+  checksum: b7719c30e5d1fdda4ee9379e8d80dca2b0668942420ba365ae3410120e08225fe36707a7981ce0f921812dee6a2290b713cdce1e75e770b98e67a45d8a378d35
   languageName: node
   linkType: hard
 
-"underscore@npm:^1.12.1":
-  version: 1.13.1
-  resolution: "underscore@npm:1.13.1"
-  checksum: 69bb4e6dd92c387ad322dd5b105f496fa64896d92ff1eea987610920d452667a12bca0938def4c4d60acd12da62410540fd268e7ca4f2480d89324498382fcac
+"underscore@npm:1.13.7":
+  version: 1.13.7
+  resolution: "underscore@npm:1.13.7"
+  checksum: 174b011af29e4fbe2c70eb2baa8bfab0d0336cf2f5654f364484967bc6264a86224d0134b9176e4235c8cceae00d11839f0fd4824268de04b11c78aca1241684
+  languageName: node
+  linkType: hard
+
+"undici-types@npm:~6.21.0":
+  version: 6.21.0
+  resolution: "undici-types@npm:6.21.0"
+  checksum: 46331c7d6016bf85b3e8f20c159d62f5ae471aba1eb3dc52fff35a0259d58dcc7d592d4cc4f00c5f9243fa738a11cfa48bd20203040d4a9e6bc25e807fab7ab3
   languageName: node
   linkType: hard
 
 "unicode-canonical-property-names-ecmascript@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "unicode-canonical-property-names-ecmascript@npm:2.0.0"
-  checksum: 39be078afd014c14dcd957a7a46a60061bc37c4508ba146517f85f60361acf4c7539552645ece25de840e17e293baa5556268d091ca6762747fdd0c705001a45
+  version: 2.0.1
+  resolution: "unicode-canonical-property-names-ecmascript@npm:2.0.1"
+  checksum: 3c3dabdb1d22aef4904399f9e810d0b71c0b12b3815169d96fac97e56d5642840c6071cf709adcace2252bc6bb80242396c2ec74b37224eb015c5f7aca40bad7
   languageName: node
   linkType: hard
 
@@ -27552,28 +18313,35 @@ __metadata:
   languageName: node
   linkType: hard
 
-"unicode-match-property-value-ecmascript@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "unicode-match-property-value-ecmascript@npm:2.0.0"
-  checksum: 8fe6a09d9085a625cabcead5d95bdbc1a2d5d481712856092ce0347231e81a60b93a68f1b69e82b3076a07e415a72c708044efa2aa40ae23e2e7b5c99ed4a9ea
+"unicode-match-property-value-ecmascript@npm:^2.1.0":
+  version: 2.2.0
+  resolution: "unicode-match-property-value-ecmascript@npm:2.2.0"
+  checksum: 9e3151e1d0bc6be35c4cef105e317c04090364173e8462005b5cde08a1e7c858b6586486cfebac39dc2c6c8c9ee24afb245de6d527604866edfa454fe2a35fae
   languageName: node
   linkType: hard
 
-"unicode-match-property-value-ecmascript@npm:^2.1.0":
+"unicode-property-aliases-ecmascript@npm:^2.0.0":
   version: 2.1.0
-  resolution: "unicode-match-property-value-ecmascript@npm:2.1.0"
-  checksum: 8d6f5f586b9ce1ed0e84a37df6b42fdba1317a05b5df0c249962bd5da89528771e2d149837cad11aa26bcb84c35355cb9f58a10c3d41fa3b899181ece6c85220
+  resolution: "unicode-property-aliases-ecmascript@npm:2.1.0"
+  checksum: 243524431893649b62cc674d877bd64ef292d6071dd2fd01ab4d5ad26efbc104ffcd064f93f8a06b7e4ec54c172bf03f6417921a0d8c3a9994161fe1f88f815b
   languageName: node
   linkType: hard
 
-"unicode-property-aliases-ecmascript@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "unicode-property-aliases-ecmascript@npm:2.0.0"
-  checksum: dda4d39128cbbede2ac60fbb85493d979ec65913b8a486bf7cb7a375a2346fa48cbf9dc6f1ae23376e7e8e684c2b411434891e151e865a661b40a85407db51d0
+"unicorn-magic@npm:^0.1.0":
+  version: 0.1.0
+  resolution: "unicorn-magic@npm:0.1.0"
+  checksum: 48c5882ca3378f380318c0b4eb1d73b7e3c5b728859b060276e0a490051d4180966beeb48962d850fd0c6816543bcdfc28629dcd030bb62a286a2ae2acb5acb6
+  languageName: node
+  linkType: hard
+
+"unicorn-magic@npm:^0.3.0":
+  version: 0.3.0
+  resolution: "unicorn-magic@npm:0.3.0"
+  checksum: bdd7d7c522f9456f32a0b77af23f8854f9a7db846088c3868ec213f9550683ab6a2bdf3803577eacbafddb4e06900974385841ccb75338d17346ccef45f9cb01
   languageName: node
   linkType: hard
 
-"unified@npm:^9.2.2":
+"unified@npm:^9.0.0, unified@npm:^9.2.2":
   version: 9.2.2
   resolution: "unified@npm:9.2.2"
   dependencies:
@@ -27587,60 +18355,54 @@ __metadata:
   languageName: node
   linkType: hard
 
-"union-value@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "union-value@npm:1.0.1"
-  dependencies:
-    arr-union: ^3.1.0
-    get-value: ^2.0.6
-    is-extendable: ^0.1.1
-    set-value: ^2.0.1
-  checksum: a3464097d3f27f6aa90cf103ed9387541bccfc006517559381a10e0dffa62f465a9d9a09c9b9c3d26d0f4cbe61d4d010e2fbd710fd4bf1267a768ba8a774b0ba
-  languageName: node
-  linkType: hard
-
-"unique-filename@npm:^1.1.1":
-  version: 1.1.1
-  resolution: "unique-filename@npm:1.1.1"
+"unique-filename@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "unique-filename@npm:4.0.0"
   dependencies:
-    unique-slug: ^2.0.0
-  checksum: cf4998c9228cc7647ba7814e255dec51be43673903897b1786eff2ac2d670f54d4d733357eb08dea969aa5e6875d0e1bd391d668fbdb5a179744e7c7551a6f80
+    unique-slug: ^5.0.0
+  checksum: 6a62094fcac286b9ec39edbd1f8f64ff92383baa430af303dfed1ffda5e47a08a6b316408554abfddd9730c78b6106bef4ca4d02c1231a735ddd56ced77573df
   languageName: node
   linkType: hard
 
-"unique-filename@npm:^2.0.0":
-  version: 2.0.1
-  resolution: "unique-filename@npm:2.0.1"
+"unique-slug@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "unique-slug@npm:5.0.0"
   dependencies:
-    unique-slug: ^3.0.0
-  checksum: 807acf3381aff319086b64dc7125a9a37c09c44af7620bd4f7f3247fcd5565660ac12d8b80534dcbfd067e6fe88a67e621386dd796a8af828d1337a8420a255f
+    imurmurhash: ^0.1.4
+  checksum: 222d0322bc7bbf6e45c08967863212398313ef73423f4125e075f893a02405a5ffdbaaf150f7dd1e99f8861348a486dd079186d27c5f2c60e465b7dcbb1d3e5b
   languageName: node
   linkType: hard
 
-"unique-slug@npm:^2.0.0":
-  version: 2.0.2
-  resolution: "unique-slug@npm:2.0.2"
+"unique-string@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "unique-string@npm:2.0.0"
   dependencies:
-    imurmurhash: ^0.1.4
-  checksum: 5b6876a645da08d505dedb970d1571f6cebdf87044cb6b740c8dbb24f0d6e1dc8bdbf46825fd09f994d7cf50760e6f6e063cfa197d51c5902c00a861702eb75a
+    crypto-random-string: ^2.0.0
+  checksum: ef68f639136bcfe040cf7e3cd7a8dff076a665288122855148a6f7134092e6ed33bf83a7f3a9185e46c98dddc445a0da6ac25612afa1a7c38b8b654d6c02498e
   languageName: node
   linkType: hard
 
-"unique-slug@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "unique-slug@npm:3.0.0"
-  dependencies:
-    imurmurhash: ^0.1.4
-  checksum: 49f8d915ba7f0101801b922062ee46b7953256c93ceca74303bd8e6413ae10aa7e8216556b54dc5382895e8221d04f1efaf75f945c2e4a515b4139f77aa6640c
+"unist-builder@npm:^2.0.0, unist-builder@npm:^2.0.3":
+  version: 2.0.3
+  resolution: "unist-builder@npm:2.0.3"
+  checksum: e946fdf77dbfc320feaece137ce4959ae2da6614abd1623bd39512dc741a9d5f313eb2ba79f8887d941365dccddec7fef4e953827475e392bf49b45336f597f6
   languageName: node
   linkType: hard
 
-"unique-string@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "unique-string@npm:2.0.0"
+"unist-util-find@npm:^1.0.2":
+  version: 1.0.4
+  resolution: "unist-util-find@npm:1.0.4"
   dependencies:
-    crypto-random-string: ^2.0.0
-  checksum: ef68f639136bcfe040cf7e3cd7a8dff076a665288122855148a6f7134092e6ed33bf83a7f3a9185e46c98dddc445a0da6ac25612afa1a7c38b8b654d6c02498e
+    lodash.iteratee: ^4.7.0
+    unist-util-visit: ^2.0.0
+  checksum: 98afb5e0db45faee4fc486bacfbc1b31bfdb5cf779e09dabeeba61ac8abbdb32e081a48aa2fe2f6f97bc4828ac3a2eb2a7467f606864a0afb24494c7dda1a269
+  languageName: node
+  linkType: hard
+
+"unist-util-generated@npm:^1.0.0":
+  version: 1.1.6
+  resolution: "unist-util-generated@npm:1.1.6"
+  checksum: 86239ff88a08800d52198f2f0e15911f05bab2dad17cef95550f7c2728f15ebb0344694fcc3101d05762d88adaf86cb85aa7a3300fedabd0b6d7d00b41cdcb7f
   languageName: node
   linkType: hard
 
@@ -27651,6 +18413,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"unist-util-position@npm:^3.0.0":
+  version: 3.1.0
+  resolution: "unist-util-position@npm:3.1.0"
+  checksum: 10b3952e32a1ffabbecad41c3946237f7059f5bb6436796da05531a285f50b97e4f37cfc2f7164676d041063f40fe1ad92fbb8ca38d3ae8747328ebe738d738f
+  languageName: node
+  linkType: hard
+
 "unist-util-stringify-position@npm:^2.0.0":
   version: 2.0.3
   resolution: "unist-util-stringify-position@npm:2.0.3"
@@ -27670,7 +18439,18 @@ __metadata:
   languageName: node
   linkType: hard
 
-"universalify@npm:^0.1.0, universalify@npm:^0.1.2":
+"unist-util-visit@npm:^2.0.0, unist-util-visit@npm:^2.0.2, unist-util-visit@npm:^2.0.3":
+  version: 2.0.3
+  resolution: "unist-util-visit@npm:2.0.3"
+  dependencies:
+    "@types/unist": ^2.0.0
+    unist-util-is: ^4.0.0
+    unist-util-visit-parents: ^3.0.0
+  checksum: 1fe19d500e212128f96d8c3cfa3312846e586b797748a1fd195fe6479f06bc90a6f6904deb08eefc00dd58e83a1c8a32fb8677252d2273ad7a5e624525b69b8f
+  languageName: node
+  linkType: hard
+
+"universalify@npm:^0.1.0":
   version: 0.1.2
   resolution: "universalify@npm:0.1.2"
   checksum: 40cdc60f6e61070fe658ca36016a8f4ec216b29bf04a55dce14e3710cc84c7448538ef4dad3728d0bfe29975ccd7bfb5f414c45e7b78883567fb31b246f02dff
@@ -27678,9 +18458,9 @@ __metadata:
   linkType: hard
 
 "universalify@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "universalify@npm:2.0.0"
-  checksum: 2406a4edf4a8830aa6813278bab1f953a8e40f2f63a37873ffa9a3bc8f9745d06cc8e88f3572cb899b7e509013f7f6fcc3e37e8a6d914167a5381d8440518c44
+  version: 2.0.1
+  resolution: "universalify@npm:2.0.1"
+  checksum: ecd8469fe0db28e7de9e5289d32bd1b6ba8f7183db34f3bfc4ca53c49891c2d6aa05f3fb3936a81285a905cc509fb641a0c3fc131ec786167eff41236ae32e60
   languageName: node
   linkType: hard
 
@@ -27691,39 +18471,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"unquote@npm:~1.1.1":
-  version: 1.1.1
-  resolution: "unquote@npm:1.1.1"
-  checksum: 71745867d09cba44ba2d26cb71d6dda7045a98b14f7405df4faaf2b0c90d24703ad027a9d90ba9a6e0d096de2c8d56f864fd03f1c0498c0b7a3990f73b4c8f5f
-  languageName: node
-  linkType: hard
-
-"unset-value@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "unset-value@npm:1.0.0"
-  dependencies:
-    has-value: ^0.3.1
-    isobject: ^3.0.0
-  checksum: 5990ecf660672be2781fc9fb322543c4aa592b68ed9a3312fa4df0e9ba709d42e823af090fc8f95775b4cd2c9a5169f7388f0cec39238b6d0d55a69fc2ab6b29
-  languageName: node
-  linkType: hard
-
-"untildify@npm:^2.1.0":
-  version: 2.1.0
-  resolution: "untildify@npm:2.1.0"
-  dependencies:
-    os-homedir: ^1.0.0
-  checksum: 071b394053fc94747d9df8c7f7ca50af41355c1207c8a0bf9f35f52b0d9ad5142a1920b018bc2b6ff04340a4f9c599ad50c9b8f4ff2c689ae52b1463ebbda94e
-  languageName: node
-  linkType: hard
-
-"upath@npm:^1.1.1":
-  version: 1.2.0
-  resolution: "upath@npm:1.2.0"
-  checksum: 4c05c094797cb733193a0784774dbea5b1889d502fc9f0572164177e185e4a59ba7099bf0b0adf945b232e2ac60363f9bf18aac9b2206fb99cbef971a8455445
-  languageName: node
-  linkType: hard
-
 "upath@npm:^2.0.1":
   version: 2.0.1
   resolution: "upath@npm:2.0.1"
@@ -27731,31 +18478,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"update-browserslist-db@npm:^1.0.11":
-  version: 1.0.11
-  resolution: "update-browserslist-db@npm:1.0.11"
-  dependencies:
-    escalade: ^3.1.1
-    picocolors: ^1.0.0
-  peerDependencies:
-    browserslist: ">= 4.21.0"
-  bin:
-    update-browserslist-db: cli.js
-  checksum: b98327518f9a345c7cad5437afae4d2ae7d865f9779554baf2a200fdf4bac4969076b679b1115434bd6557376bdd37ca7583d0f9b8f8e302d7d4cc1e91b5f231
-  languageName: node
-  linkType: hard
-
-"update-browserslist-db@npm:^1.0.13":
-  version: 1.0.13
-  resolution: "update-browserslist-db@npm:1.0.13"
+"update-browserslist-db@npm:^1.1.3":
+  version: 1.1.3
+  resolution: "update-browserslist-db@npm:1.1.3"
   dependencies:
-    escalade: ^3.1.1
-    picocolors: ^1.0.0
+    escalade: ^3.2.0
+    picocolors: ^1.1.1
   peerDependencies:
     browserslist: ">= 4.21.0"
   bin:
     update-browserslist-db: cli.js
-  checksum: 1e47d80182ab6e4ad35396ad8b61008ae2a1330221175d0abd37689658bdb61af9b705bfc41057fd16682474d79944fb2d86767c5ed5ae34b6276b9bed353322
+  checksum: 7b6d8d08c34af25ee435bccac542bedcb9e57c710f3c42421615631a80aa6dd28b0a81c9d2afbef53799d482fb41453f714b8a7a0a8003e3b4ec8fb1abb819af
   languageName: node
   linkType: hard
 
@@ -27775,30 +18508,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"urix@npm:^0.1.0":
-  version: 0.1.0
-  resolution: "urix@npm:0.1.0"
-  checksum: 4c076ecfbf3411e888547fe844e52378ab5ada2d2f27625139011eada79925e77f7fbf0e4016d45e6a9e9adb6b7e64981bd49b22700c7c401c5fc15f423303b3
-  languageName: node
-  linkType: hard
-
-"url@npm:^0.11.0":
-  version: 0.11.0
-  resolution: "url@npm:0.11.0"
-  dependencies:
-    punycode: 1.3.2
-    querystring: 0.2.0
-  checksum: 50d100d3dd2d98b9fe3ada48cadb0b08aa6be6d3ac64112b867b56b19be4bfcba03c2a9a0d7922bfd7ac17d4834e88537749fe182430dfd9b68e520175900d90
-  languageName: node
-  linkType: hard
-
-"use@npm:^3.1.0":
-  version: 3.1.1
-  resolution: "use@npm:3.1.1"
-  checksum: 08a130289f5238fcbf8f59a18951286a6e660d17acccc9d58d9b69dfa0ee19aa038e8f95721b00b432c36d1629a9e32a464bf2e7e0ae6a244c42ddb30bdd8b33
-  languageName: node
-  linkType: hard
-
 "username-sync@npm:^1.0.2":
   version: 1.0.3
   resolution: "username-sync@npm:1.0.3"
@@ -27806,43 +18515,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"util-deprecate@npm:^1.0.1, util-deprecate@npm:^1.0.2, util-deprecate@npm:~1.0.1":
+"util-deprecate@npm:^1.0.1, util-deprecate@npm:^1.0.2":
   version: 1.0.2
   resolution: "util-deprecate@npm:1.0.2"
   checksum: 474acf1146cb2701fe3b074892217553dfcf9a031280919ba1b8d651a068c9b15d863b7303cb15bd00a862b498e6cf4ad7b4a08fb134edd5a6f7641681cb54a2
   languageName: node
   linkType: hard
 
-"util.promisify@npm:~1.0.0":
-  version: 1.0.1
-  resolution: "util.promisify@npm:1.0.1"
-  dependencies:
-    define-properties: ^1.1.3
-    es-abstract: ^1.17.2
-    has-symbols: ^1.0.1
-    object.getownpropertydescriptors: ^2.1.0
-  checksum: d823c75b3fc66510018596f128a6592c98991df38bc0464a633bdf9134e2de0a1a33199c5c21cc261048a3982d7a19e032ecff8835b3c587f843deba96063e37
-  languageName: node
-  linkType: hard
-
-"util@npm:0.10.3":
-  version: 0.10.3
-  resolution: "util@npm:0.10.3"
-  dependencies:
-    inherits: 2.0.1
-  checksum: bd800f5d237a82caddb61723a6cbe45297d25dd258651a31335a4d5d981fd033cb4771f82db3d5d59b582b187cb69cfe727dc6f4d8d7826f686ee6c07ce611e0
-  languageName: node
-  linkType: hard
-
-"util@npm:^0.11.0":
-  version: 0.11.1
-  resolution: "util@npm:0.11.1"
-  dependencies:
-    inherits: 2.0.3
-  checksum: 80bee6a2edf5ab08dcb97bfe55ca62289b4e66f762ada201f2c5104cb5e46474c8b334f6504d055c0e6a8fda10999add9bcbd81ba765e7f37b17dc767331aa55
-  languageName: node
-  linkType: hard
-
 "utils-merge@npm:1.0.1":
   version: 1.0.1
   resolution: "utils-merge@npm:1.0.1"
@@ -27850,16 +18529,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"uuid@npm:^3.3.2":
-  version: 3.4.0
-  resolution: "uuid@npm:3.4.0"
+"uuid@npm:9.0.1":
+  version: 9.0.1
+  resolution: "uuid@npm:9.0.1"
   bin:
-    uuid: ./bin/uuid
-  checksum: 58de2feed61c59060b40f8203c0e4ed7fd6f99d42534a499f1741218a1dd0c129f4aa1de797bcf822c8ea5da7e4137aa3673431a96dae729047f7aca7b27866f
+    uuid: dist/bin/uuid
+  checksum: 39931f6da74e307f51c0fb463dc2462807531dc80760a9bff1e35af4316131b4fc3203d16da60ae33f07fdca5b56f3f1dd662da0c99fea9aaeab2004780cc5f4
   languageName: node
   linkType: hard
 
-"uuid@npm:^8.3.0":
+"uuid@npm:^8.3.2":
   version: 8.3.2
   resolution: "uuid@npm:8.3.2"
   bin:
@@ -27868,38 +18547,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"uuid@npm:^9.0.0":
-  version: 9.0.0
-  resolution: "uuid@npm:9.0.0"
-  bin:
-    uuid: dist/bin/uuid
-  checksum: 8dd2c83c43ddc7e1c71e36b60aea40030a6505139af6bee0f382ebcd1a56f6cd3028f7f06ffb07f8cf6ced320b76aea275284b224b002b289f89fe89c389b028
-  languageName: node
-  linkType: hard
-
 "v8-compile-cache@npm:^2.3.0":
-  version: 2.3.0
-  resolution: "v8-compile-cache@npm:2.3.0"
-  checksum: adb0a271eaa2297f2f4c536acbfee872d0dd26ec2d76f66921aa7fc437319132773483344207bdbeee169225f4739016d8d2dbf0553913a52bb34da6d0334f8e
-  languageName: node
-  linkType: hard
-
-"validate-npm-package-license@npm:^3.0.1":
-  version: 3.0.4
-  resolution: "validate-npm-package-license@npm:3.0.4"
-  dependencies:
-    spdx-correct: ^3.0.0
-    spdx-expression-parse: ^3.0.0
-  checksum: 35703ac889d419cf2aceef63daeadbe4e77227c39ab6287eeb6c1b36a746b364f50ba22e88591f5d017bc54685d8137bc2d328d0a896e4d3fd22093c0f32a9ad
+  version: 2.4.0
+  resolution: "v8-compile-cache@npm:2.4.0"
+  checksum: 8eb6ddb59d86f24566503f1e6ca98f3e6f43599f05359bd3ab737eaaf1585b338091478a4d3d5c2646632cf8030288d7888684ea62238cdce15a65ae2416718f
   languageName: node
   linkType: hard
 
 "validate-npm-package-name@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "validate-npm-package-name@npm:5.0.0"
-  dependencies:
-    builtins: ^5.0.0
-  checksum: 5342a994986199b3c28e53a8452a14b2bb5085727691ea7aa0d284a6606b127c371e0925ae99b3f1ef7cc7d2c9de75f52eb61a3d1cc45e39bca1e3a9444cbb4e
+  version: 5.0.1
+  resolution: "validate-npm-package-name@npm:5.0.1"
+  checksum: 0d583a1af23aeffea7748742cf22b6802458736fb8b60323ba5949763824d46f796474b0e1b9206beb716f9d75269e19dbd7795d6b038b29d561be95dd827381
   languageName: node
   linkType: hard
 
@@ -27913,7 +18571,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"validate-peer-dependencies@npm:^2.0.0, validate-peer-dependencies@npm:^2.2.0":
+"validate-peer-dependencies@npm:^2.0.0":
   version: 2.2.0
   resolution: "validate-peer-dependencies@npm:2.2.0"
   dependencies:
@@ -27934,180 +18592,137 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "vault@workspace:."
   dependencies:
-    "@babel/eslint-parser": ^7.21.3
-    "@babel/plugin-proposal-decorators": ^7.21.0
-    "@babel/plugin-proposal-object-rest-spread": ^7.12.1
-    "@babel/plugin-transform-block-scoping": ^7.12.1
-    "@ember-data/legacy-compat": ~4.12.4
-    "@ember/legacy-built-in-components": ^0.4.1
-    "@ember/optional-features": ^2.0.0
-    "@ember/render-modifiers": ^1.0.2
-    "@ember/string": ^3.0.1
-    "@ember/test-helpers": ^2.9.3
-    "@ember/test-waiters": ^3.1.0
-    "@glimmer/component": ^1.1.2
-    "@glimmer/tracking": ^1.1.2
-    "@hashicorp/design-system-components": ^3.4.0
-    "@hashicorp/ember-flight-icons": ^4.0.5
-    "@icholy/duration": ^5.1.0
-    "@lineal-viz/lineal": ^0.5.1
-    "@tsconfig/ember": ^2.0.0
-    "@types/ember": ^4.0.2
-    "@types/ember-data": ^4.4.6
-    "@types/ember-data__adapter": ^4.0.1
-    "@types/ember-data__model": ^4.0.0
-    "@types/ember-data__serializer": ^4.0.1
-    "@types/ember-data__store": ^4.0.2
-    "@types/ember-qunit": ^5.0.2
-    "@types/ember-resolver": ^5.0.13
-    "@types/ember__application": ^4.0.4
-    "@types/ember__array": ^4.0.3
-    "@types/ember__component": ^4.0.11
-    "@types/ember__controller": ^4.0.3
-    "@types/ember__debug": ^4.0.3
-    "@types/ember__destroyable": ^4.0.1
-    "@types/ember__engine": ^4.0.4
-    "@types/ember__error": ^4.0.1
-    "@types/ember__object": ^4.0.5
-    "@types/ember__polyfills": ^4.0.1
-    "@types/ember__routing": ^4.0.12
-    "@types/ember__runloop": ^4.0.2
-    "@types/ember__service": ^4.0.1
-    "@types/ember__string": ^3.0.10
-    "@types/ember__template": ^4.0.1
-    "@types/ember__test": ^4.0.1
-    "@types/ember__test-helpers": ^2.8.2
-    "@types/ember__utils": ^4.0.2
-    "@types/qunit": ^2.19.4
-    "@types/rsvp": ^4.0.4
-    "@types/shell-quote": ^1.7.1
-    "@typescript-eslint/eslint-plugin": ^5.19.0
-    "@typescript-eslint/parser": ^5.19.0
-    asn1js: ^2.2.0
-    autosize: ^4.0.0
-    babel-plugin-inline-json-import: ^0.3.2
-    base64-js: ^1.3.1
-    broccoli-asset-rev: ^3.0.0
+    "@babel/cli": ~7.27.0
+    "@babel/core": ~7.26.10
+    "@babel/eslint-parser": ~7.27.0
+    "@babel/plugin-proposal-class-properties": ~7.18.6
+    "@babel/plugin-proposal-decorators": ~7.25.9
+    "@babel/plugin-proposal-object-rest-spread": ~7.20.7
+    "@babel/plugin-transform-block-scoping": ~7.27.0
+    "@babel/preset-env": ~7.26.9
+    "@babel/preset-typescript": ~7.27.0
+    "@docfy/ember": ~0.8.5
+    "@ember/legacy-built-in-components": ~0.4.2
+    "@ember/optional-features": ~2.2.0
+    "@ember/render-modifiers": ~3.0.0
+    "@ember/string": ~4.0.1
+    "@ember/test-helpers": ~5.2.1
+    "@ember/test-waiters": ~4.1.0
+    "@glimmer/component": ~1.1.2
+    "@glimmer/tracking": ~1.1.2
+    "@hashicorp-internal/vault-reporting": "file:vault-reporting/0.8.0.tgz"
+    "@hashicorp/design-system-components": 4.20.1
+    "@hashicorp/vault-client-typescript": hashicorp/vault-client-typescript
+    "@icholy/duration": ~5.1.0
+    "@lineal-viz/lineal": ~0.5.1
+    "@tsconfig/ember": ~2.0.0
+    "@types/d3-array": ~3.2.1
+    "@types/ember-data": ~4.4.16
+    "@types/qunit": ~2.19.12
+    "@types/rsvp": ~4.0.9
+    "@types/shell-quote": ~1.7.5
+    "@typescript-eslint/eslint-plugin": ~5.62.0
+    "@typescript-eslint/parser": ~5.62.0
+    asn1js: ~3.0.6
+    autosize: ~6.0.1
+    babel-plugin-inline-json-import: ~0.3.2
+    base64-js: ~1.5.1
+    broccoli-asset-rev: ~3.0.0
     broccoli-sri-hash: "meirish/broccoli-sri-hash#rooturl"
-    codemirror: ^5.58.2
-    columnify: ^1.5.4
-    concurrently: ^8.2.2
-    d3-axis: ^1.0.8
-    d3-ease: ^1.0.5
-    d3-scale: ^1.0.7
-    d3-selection: ^1.3.0
-    d3-time-format: ^2.1.1
-    d3-tip: ^0.9.1
-    d3-transition: ^1.2.0
-    date-fns: ^2.30.0
-    date-fns-tz: ^1.2.2
-    deepmerge: ^4.0.0
-    doctoc: ^2.2.0
-    dompurify: ^3.0.2
-    ember-a11y-testing: ^5.2.1
-    ember-auto-import: 2.6.3
-    ember-basic-dropdown: 6.0.1
-    ember-cli: ~4.12.1
-    ember-cli-autoprefixer: ^0.8.1
-    ember-cli-babel: ^7.26.11
+    columnify: ~1.6.0
+    concurrently: ~9.1.2
+    d3-array: ~3.2.4
+    d3-axis: ~3.0.0
+    d3-format: ~3.1.0
+    d3-scale: ~4.0.2
+    d3-selection: ~3.0.0
+    d3-shape: ~3.2.0
+    date-fns: ~2.30.0
+    date-fns-tz: ~1.3.8
+    doctoc: ~2.2.1
+    dompurify: ~3.2.5
+    ember-a11y-testing: ~7.1.2
+    ember-auto-import: 2.10.0
+    ember-basic-dropdown: ~8.6.0
+    ember-cli: ~5.8.0
+    ember-cli-babel: ~8.2.0
+    ember-cli-clean-css: ~3.0.0
     ember-cli-content-security-policy: 2.0.3
-    ember-cli-dependency-checker: ^3.3.1
-    ember-cli-deprecation-workflow: ^2.1.0
+    ember-cli-dependency-checker: ~3.3.3
+    ember-cli-deprecation-workflow: ~3.3.0
     ember-cli-flash: 4.0.0
-    ember-cli-htmlbars: ^6.2.0
-    ember-cli-inject-live-reload: ^2.1.0
-    ember-cli-mirage: 2.4.0
-    ember-cli-page-object: 1.17.10
+    ember-cli-htmlbars: ~6.3.0
+    ember-cli-inject-live-reload: ~2.1.0
+    ember-cli-mirage: ~3.0.4
+    ember-cli-page-object: ~2.3.1
     ember-cli-sass: 11.0.1
     ember-cli-sri: "meirish/ember-cli-sri#rooturl"
     ember-cli-string-helpers: 6.1.0
-    ember-cli-terser: ^4.0.2
-    ember-cli-typescript: ^5.2.1
+    ember-cli-terser: ~4.0.2
     ember-composable-helpers: 5.0.0
-    ember-concurrency: 2.3.4
-    ember-copy: 2.0.1
-    ember-d3: ^0.5.1
-    ember-data: ~4.12.4
+    ember-concurrency: ~4.0.3
+    ember-data: ~5.3.13
     ember-engines: 0.8.23
-    ember-exam: ^9.0.0
-    ember-fetch: ^8.1.2
+    ember-exam: ~9.1.0
     ember-inflector: 4.0.2
-    ember-load-initializers: ^2.1.2
-    ember-maybe-in-element: ^2.0.3
-    ember-modal-dialog: ^4.0.1
-    ember-modifier: ^4.1.0
-    ember-page-title: ^7.0.0
-    ember-power-select: 6.0.1
-    ember-qrcode-shim: ^0.4.0
-    ember-qunit: ^6.2.0
-    ember-resolver: ^10.0.0
+    ember-load-initializers: ~3.0.1
+    ember-modal-dialog: ~4.1.5
+    ember-modifier: ~4.2.0
+    ember-power-select: ~8.7.0
+    ember-qrcode-shim: ~0.4.0
+    ember-qunit: ~8.1.1
+    ember-resolver: ~13.1.0
     ember-responsive: 5.0.0
-    ember-router-helpers: ^0.4.0
     ember-service-worker: "meirish/ember-service-worker#configurable-scope"
-    ember-sinon: ^4.0.0
-    ember-source: ~4.12.0
-    ember-style-modifier: ^4.1.0
-    ember-svg-jar: 2.4.0
-    ember-template-lint: 5.7.2
-    ember-template-lint-plugin-prettier: 4.0.0
-    ember-test-selectors: 6.0.0
-    ember-tether: ^2.0.1
-    ember-truth-helpers: 3.0.0
-    escape-string-regexp: ^2.0.0
-    eslint: ^8.37.0
-    eslint-config-prettier: ^8.8.0
-    eslint-plugin-compat: 4.0.2
-    eslint-plugin-ember: ^11.5.0
-    eslint-plugin-n: ^15.7.0
-    eslint-plugin-prettier: ^4.2.1
-    eslint-plugin-qunit: ^7.3.4
-    filesize: ^4.2.1
-    flat: ^6.0.1
-    handlebars: 4.7.7
-    highlight.js: ^10.4.1
-    jsondiffpatch: ^0.4.1
-    jsonlint: ^1.6.3
-    lint-staged: ^10.5.1
-    loader.js: ^4.7.0
-    node-notifier: ^8.0.1
-    normalize.css: 4.1.1
-    pkijs: ^2.2.2
-    pretender: ^3.4.3
-    prettier: 2.8.7
-    prettier-eslint-cli: ^7.1.0
-    pvutils: ^1.0.17
-    qunit: ^2.19.4
-    qunit-dom: ^2.0.0
-    sass: ^1.58.3
-    sass-svg-uri: ^1.0.0
-    shell-quote: ^1.8.1
-    string.prototype.endswith: ^0.2.0
-    string.prototype.startswith: ^0.2.0
-    stylelint: ^15.4.0
-    stylelint-config-standard: ^32.0.0
-    stylelint-prettier: ^3.0.0
-    swagger-ui-dist: ^5.9.0
+    ember-sinon-qunit: ~7.5.0
+    ember-source: ~5.8.0
+    ember-style-modifier: ~4.4.0
+    ember-template-lint: ~6.1.0
+    ember-template-lint-plugin-prettier: ~5.0.0
+    ember-test-selectors: 7.1.0
+    ember-tether: 3.0.0
+    ember-truth-helpers: 4.0.3
+    escape-string-regexp: ~2.0.0
+    eslint: ~8.57.1
+    eslint-config-prettier: ~9.1.0
+    eslint-plugin-compat: ~4.2.0
+    eslint-plugin-ember: ~11.12.0
+    eslint-plugin-n: ~16.6.2
+    eslint-plugin-prettier: ~5.2.6
+    eslint-plugin-qunit: ~8.1.2
+    filesize: ~4.2.1
+    handlebars: 4.7.8
+    highlight.js: 10.7.3
+    jsdoc-babel: ~0.5.0
+    jsdoc-to-markdown: ~8.0.3
+    jsondiffpatch: 0.7.3
+    jsonlint: ~1.6.3
+    lint-staged: ~16.0.0
+    loader.js: ~4.7.0
+    miragejs: ~0.1.48
+    pkijs: ~2.4.0
+    posthog-js: ^1.202.2
+    prettier: 3.0.3
+    prettier-eslint-cli: ~7.1.0
+    pvutils: ~1.1.3
+    qunit: ~2.24.1
+    qunit-dom: ~3.4.0
+    sass: ~1.88.0
+    shell-quote: ~1.8.2
+    sinon: ~20.0.0
+    stylelint: ~16.19.1
+    stylelint-config-standard: ~38.0.0
+    stylelint-prettier: ~5.0.3
+    swagger-ui-dist: ~5.21.0
     text-encoder-lite: 2.0.0
-    tracked-built-ins: ^3.1.1
-    typescript: ^4.9.5
-    uuid: ^9.0.0
-    walk-sync: ^2.0.2
-    webpack: 5.78.0
-    xstate: ^3.3.3
+    tracked-built-ins: ~3.4.0
+    typescript: ~5.8.3
+    uuid: 9.0.1
+    webpack: 5.94.0
+    webpack-cli: ^6.0.1
   languageName: unknown
   linkType: soft
 
-"verror@npm:1.10.0":
-  version: 1.10.0
-  resolution: "verror@npm:1.10.0"
-  dependencies:
-    assert-plus: ^1.0.0
-    core-util-is: 1.0.2
-    extsprintf: ^1.2.0
-  checksum: c431df0bedf2088b227a4e051e0ff4ca54df2c114096b0c01e1cbaadb021c30a04d7dd5b41ab277bcd51246ca135bf931d4c4c796ecae7a4fef6d744ecef36ea
-  languageName: node
-  linkType: hard
-
 "vfile-message@npm:^2.0.0":
   version: 2.0.4
   resolution: "vfile-message@npm:2.0.4"
@@ -28130,13 +18745,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"vm-browserify@npm:^1.0.1":
-  version: 1.1.2
-  resolution: "vm-browserify@npm:1.1.2"
-  checksum: 10a1c50aab54ff8b4c9042c15fc64aefccce8d2fb90c0640403242db0ee7fb269f9b102bdb69cfb435d7ef3180d61fd4fb004a043a12709abaf9056cfd7e039d
-  languageName: node
-  linkType: hard
-
 "vue-eslint-parser@npm:^8.0.1":
   version: 8.3.0
   resolution: "vue-eslint-parser@npm:8.3.0"
@@ -28154,21 +18762,24 @@ __metadata:
   languageName: node
   linkType: hard
 
-"w3c-hr-time@npm:^1.0.2":
-  version: 1.0.2
-  resolution: "w3c-hr-time@npm:1.0.2"
-  dependencies:
-    browser-process-hrtime: ^1.0.0
-  checksum: ec3c2dacbf8050d917bbf89537a101a08c2e333b4c19155f7d3bedde43529d4339db6b3d049d9610789cb915f9515f8be037e0c54c079e9d4735c50b37ed52b9
+"w3c-keyname@npm:^2.2.4":
+  version: 2.2.8
+  resolution: "w3c-keyname@npm:2.2.8"
+  checksum: 95bafa4c04fa2f685a86ca1000069c1ec43ace1f8776c10f226a73296caeddd83f893db885c2c220ebeb6c52d424e3b54d7c0c1e963bbf204038ff1a944fbb07
   languageName: node
   linkType: hard
 
-"w3c-xmlserializer@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "w3c-xmlserializer@npm:2.0.0"
-  dependencies:
-    xml-name-validator: ^3.0.0
-  checksum: ae25c51cf71f1fb2516df1ab33a481f83461a117565b95e3d0927432522323f93b1b2846cbb60196d337970c421adb604fc2d0d180c6a47a839da01db5b9973b
+"walk-back@npm:^2.0.1":
+  version: 2.0.1
+  resolution: "walk-back@npm:2.0.1"
+  checksum: c9c8b08683e49a93b30a734891ff0681e93c003fa3506c42bd88fe44449523faaf7ea2752301cf6362e2b3ebce16cce927ba5ab0f9f18a3dc755ece22fb2efcf
+  languageName: node
+  linkType: hard
+
+"walk-back@npm:^5.1.0":
+  version: 5.1.1
+  resolution: "walk-back@npm:5.1.1"
+  checksum: c976482ff419cd9b2ae256d6eec4a9d9c131656c6cbf316acbe3372feee79bd7c8c82122434af02f301071fe08865804e0d929a80eb44c42f9ad26edbe9a85a1
   languageName: node
   linkType: hard
 
@@ -28203,7 +18814,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"walk-sync@npm:^2.0.0, walk-sync@npm:^2.0.2, walk-sync@npm:^2.2.0":
+"walk-sync@npm:^2.0.2, walk-sync@npm:^2.2.0":
   version: 2.2.0
   resolution: "walk-sync@npm:2.2.0"
   dependencies:
@@ -28249,19 +18860,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"watch-detector@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "watch-detector@npm:1.0.0"
-  dependencies:
-    heimdalljs-logger: ^0.1.10
-    semver: ^6.3.0
-    silent-error: ^1.1.1
-    tmp: ^0.1.0
-  checksum: da3ab7804890663a07b36c53c27a15bad086021f195941141c0b7153f5b3e269e925a2fb3b65377bd0f5606891e67213a10d31fedd3feed21aef604a30053b26
-  languageName: node
-  linkType: hard
-
-"watch-detector@npm:^1.0.2":
+"watch-detector@npm:^1.0.0, watch-detector@npm:^1.0.2":
   version: 1.0.2
   resolution: "watch-detector@npm:1.0.2"
   dependencies:
@@ -28272,39 +18871,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"watchpack-chokidar2@npm:^2.0.1":
-  version: 2.0.1
-  resolution: "watchpack-chokidar2@npm:2.0.1"
-  dependencies:
-    chokidar: ^2.1.8
-  checksum: acf0f9ebca0c0b2fd1fe87ba557670477a6c0410bf1a653a726e68eb0620aa94fd9a43027a160a76bc793a21ea12e215e1e87dafe762682c13ef92ad4daf7b58
-  languageName: node
-  linkType: hard
-
-"watchpack@npm:^1.7.4":
-  version: 1.7.5
-  resolution: "watchpack@npm:1.7.5"
-  dependencies:
-    chokidar: ^3.4.1
-    graceful-fs: ^4.1.2
-    neo-async: ^2.5.0
-    watchpack-chokidar2: ^2.0.1
-  dependenciesMeta:
-    chokidar:
-      optional: true
-    watchpack-chokidar2:
-      optional: true
-  checksum: 8b7cb8c8df8f4dd0e8ac47693c0141c4f020a4b031411247d600eca31522fde6f1f9a3a6f6518b46e71f7971b0ed5734c08c60d7fdd2530e7262776286f69236
-  languageName: node
-  linkType: hard
-
-"watchpack@npm:^2.4.0":
-  version: 2.4.0
-  resolution: "watchpack@npm:2.4.0"
+"watchpack@npm:^2.4.1":
+  version: 2.4.4
+  resolution: "watchpack@npm:2.4.4"
   dependencies:
     glob-to-regexp: ^0.4.1
     graceful-fs: ^4.1.2
-  checksum: 23d4bc58634dbe13b86093e01c6a68d8096028b664ab7139d58f0c37d962d549a940e98f2f201cecdabd6f9c340338dc73ef8bf094a2249ef582f35183d1a131
+  checksum: 469514a04bcdd7ea77d4b3c62d1f087eafbce64cbc728c89355d5710ee01311533456122da7c585d3654d5bfcf09e6085db1a6eb274c4762a18e370526d17561
   languageName: node
   linkType: hard
 
@@ -28317,27 +18890,51 @@ __metadata:
   languageName: node
   linkType: hard
 
-"webidl-conversions@npm:^5.0.0":
-  version: 5.0.0
-  resolution: "webidl-conversions@npm:5.0.0"
-  checksum: ccf1ec2ca7c0b5671e5440ace4a66806ae09c49016ab821481bec0c05b1b82695082dc0a27d1fe9d804d475a408ba0c691e6803fd21be608e710955d4589cd69
+"web-vitals@npm:^4.2.4":
+  version: 4.2.4
+  resolution: "web-vitals@npm:4.2.4"
+  checksum: 5b3ffe1db33f23aebf8cc8560ac574401a95939baafde5841835c1bb1c01f9a2478442f319f77aa0d7914739fc2f6b020c5d5b128c16c5c77ca6be2f9dfbbde6
   languageName: node
   linkType: hard
 
-"webidl-conversions@npm:^6.1.0":
-  version: 6.1.0
-  resolution: "webidl-conversions@npm:6.1.0"
-  checksum: 1f526507aa491f972a0c1409d07f8444e1d28778dfa269a9971f2e157182f3d496dc33296e4ed45b157fdb3bf535bb90c90bf10c50dcf1dd6caacb2a34cc84fb
+"webpack-cli@npm:^6.0.1":
+  version: 6.0.1
+  resolution: "webpack-cli@npm:6.0.1"
+  dependencies:
+    "@discoveryjs/json-ext": ^0.6.1
+    "@webpack-cli/configtest": ^3.0.1
+    "@webpack-cli/info": ^3.0.1
+    "@webpack-cli/serve": ^3.0.1
+    colorette: ^2.0.14
+    commander: ^12.1.0
+    cross-spawn: ^7.0.3
+    envinfo: ^7.14.0
+    fastest-levenshtein: ^1.0.12
+    import-local: ^3.0.2
+    interpret: ^3.1.1
+    rechoir: ^0.8.0
+    webpack-merge: ^6.0.1
+  peerDependencies:
+    webpack: ^5.82.0
+  peerDependenciesMeta:
+    webpack-bundle-analyzer:
+      optional: true
+    webpack-dev-server:
+      optional: true
+  bin:
+    webpack-cli: ./bin/cli.js
+  checksum: 1418d0e48c58b4a223472d1a34aee74b497cd8b8fc7f0508da86983e6bbc0b2f20e85459d89fb7169309a6f0409e3a27c1b688e645fa705806195884855434fc
   languageName: node
   linkType: hard
 
-"webpack-sources@npm:^1.4.0, webpack-sources@npm:^1.4.1":
-  version: 1.4.3
-  resolution: "webpack-sources@npm:1.4.3"
+"webpack-merge@npm:^6.0.1":
+  version: 6.0.1
+  resolution: "webpack-merge@npm:6.0.1"
   dependencies:
-    source-list-map: ^2.0.0
-    source-map: ~0.6.1
-  checksum: 37463dad8d08114930f4bc4882a9602941f07c9f0efa9b6bc78738cd936275b990a596d801ef450d022bb005b109b9f451dd087db2f3c9baf53e8e22cf388f79
+    clone-deep: ^4.0.1
+    flat: ^5.0.2
+    wildcard: ^2.0.1
+  checksum: e8a604c686b944605a1c57cc7b75e886ab902dc5ffdd15259a092c5c2dd5f58868fe39f995ea4bad4f189e38843b061c4ae1eb22822d7169813f4adab571dc3d
   languageName: node
   linkType: hard
 
@@ -28348,78 +18945,39 @@ __metadata:
   languageName: node
   linkType: hard
 
-"webpack@npm:5.78.0":
-  version: 5.78.0
-  resolution: "webpack@npm:5.78.0"
+"webpack@npm:5.94.0":
+  version: 5.94.0
+  resolution: "webpack@npm:5.94.0"
   dependencies:
-    "@types/eslint-scope": ^3.7.3
-    "@types/estree": ^0.0.51
-    "@webassemblyjs/ast": 1.11.1
-    "@webassemblyjs/wasm-edit": 1.11.1
-    "@webassemblyjs/wasm-parser": 1.11.1
+    "@types/estree": ^1.0.5
+    "@webassemblyjs/ast": ^1.12.1
+    "@webassemblyjs/wasm-edit": ^1.12.1
+    "@webassemblyjs/wasm-parser": ^1.12.1
     acorn: ^8.7.1
-    acorn-import-assertions: ^1.7.6
-    browserslist: ^4.14.5
+    acorn-import-attributes: ^1.9.5
+    browserslist: ^4.21.10
     chrome-trace-event: ^1.0.2
-    enhanced-resolve: ^5.10.0
-    es-module-lexer: ^0.9.0
+    enhanced-resolve: ^5.17.1
+    es-module-lexer: ^1.2.1
     eslint-scope: 5.1.1
     events: ^3.2.0
     glob-to-regexp: ^0.4.1
-    graceful-fs: ^4.2.9
+    graceful-fs: ^4.2.11
     json-parse-even-better-errors: ^2.3.1
     loader-runner: ^4.2.0
     mime-types: ^2.1.27
     neo-async: ^2.6.2
-    schema-utils: ^3.1.0
+    schema-utils: ^3.2.0
     tapable: ^2.1.1
-    terser-webpack-plugin: ^5.1.3
-    watchpack: ^2.4.0
+    terser-webpack-plugin: ^5.3.10
+    watchpack: ^2.4.1
     webpack-sources: ^3.2.3
   peerDependenciesMeta:
     webpack-cli:
       optional: true
   bin:
     webpack: bin/webpack.js
-  checksum: 4213e5bcc23e54c2f2a589e8e96f1fb71a2c05d5033ffda6dd8bae32284abfa0eb6b6d0707806e8dcfa48a8fcda2448d3af6c4539061679251d94c0996bebf99
-  languageName: node
-  linkType: hard
-
-"webpack@npm:^4.43.0":
-  version: 4.46.0
-  resolution: "webpack@npm:4.46.0"
-  dependencies:
-    "@webassemblyjs/ast": 1.9.0
-    "@webassemblyjs/helper-module-context": 1.9.0
-    "@webassemblyjs/wasm-edit": 1.9.0
-    "@webassemblyjs/wasm-parser": 1.9.0
-    acorn: ^6.4.1
-    ajv: ^6.10.2
-    ajv-keywords: ^3.4.1
-    chrome-trace-event: ^1.0.2
-    enhanced-resolve: ^4.5.0
-    eslint-scope: ^4.0.3
-    json-parse-better-errors: ^1.0.2
-    loader-runner: ^2.4.0
-    loader-utils: ^1.2.3
-    memory-fs: ^0.4.1
-    micromatch: ^3.1.10
-    mkdirp: ^0.5.3
-    neo-async: ^2.6.1
-    node-libs-browser: ^2.2.1
-    schema-utils: ^1.0.0
-    tapable: ^1.1.3
-    terser-webpack-plugin: ^1.4.3
-    watchpack: ^1.7.4
-    webpack-sources: ^1.4.1
-  peerDependenciesMeta:
-    webpack-cli:
-      optional: true
-    webpack-command:
-      optional: true
-  bin:
-    webpack: bin/webpack.js
-  checksum: 013fa24c00d4261e16ebca60353fa6f848e417b5a44bdf28c16ebebd67fa61e960420bb314c8df05cfe2dad9b90efabcf38fd6875f2361922769a0384085ef1e
+  checksum: 6a3d667be304a69cd6dcb8d676bc29f47642c0d389af514cfcd646eaaa809961bc6989fc4b2621a717dfc461130f29c6e20006d62a32e012dafaa9517813a4e6
   languageName: node
   linkType: hard
 
@@ -28441,83 +18999,71 @@ __metadata:
   languageName: node
   linkType: hard
 
-"whatwg-encoding@npm:^1.0.5":
-  version: 1.0.5
-  resolution: "whatwg-encoding@npm:1.0.5"
+"which-boxed-primitive@npm:^1.1.0, which-boxed-primitive@npm:^1.1.1":
+  version: 1.1.1
+  resolution: "which-boxed-primitive@npm:1.1.1"
   dependencies:
-    iconv-lite: 0.4.24
-  checksum: 5be4efe111dce29ddee3448d3915477fcc3b28f991d9cf1300b4e50d6d189010d47bca2f51140a844cf9b726e8f066f4aee72a04d687bfe4f2ee2767b2f5b1e6
-  languageName: node
-  linkType: hard
-
-"whatwg-fetch@npm:^3.6.2":
-  version: 3.6.2
-  resolution: "whatwg-fetch@npm:3.6.2"
-  checksum: ee976b7249e7791edb0d0a62cd806b29006ad7ec3a3d89145921ad8c00a3a67e4be8f3fb3ec6bc7b58498724fd568d11aeeeea1f7827e7e1e5eae6c8a275afed
-  languageName: node
-  linkType: hard
-
-"whatwg-mimetype@npm:^2.3.0":
-  version: 2.3.0
-  resolution: "whatwg-mimetype@npm:2.3.0"
-  checksum: 23eb885940bcbcca4ff841c40a78e9cbb893ec42743993a42bf7aed16085b048b44b06f3402018931687153550f9a32d259dfa524e4f03577ab898b6965e5383
+    is-bigint: ^1.1.0
+    is-boolean-object: ^1.2.1
+    is-number-object: ^1.1.1
+    is-string: ^1.1.1
+    is-symbol: ^1.1.1
+  checksum: ee41d0260e4fd39551ad77700c7047d3d281ec03d356f5e5c8393fe160ba0db53ef446ff547d05f76ffabfd8ad9df7c9a827e12d4cccdbc8fccf9239ff8ac21e
   languageName: node
   linkType: hard
 
-"whatwg-url@npm:^8.0.0, whatwg-url@npm:^8.5.0":
-  version: 8.5.0
-  resolution: "whatwg-url@npm:8.5.0"
-  dependencies:
-    lodash: ^4.7.0
-    tr46: ^2.0.2
-    webidl-conversions: ^6.1.0
-  checksum: 3bda9bfd98be7a86761bc629d848526ae246b34bce6b1037254752bade6fb610fc696c1d4ba477d0fdd57c86b6fad0128f68203527d94cee13997cc91ecf2bb7
+"which-builtin-type@npm:^1.2.1":
+  version: 1.2.1
+  resolution: "which-builtin-type@npm:1.2.1"
+  dependencies:
+    call-bound: ^1.0.2
+    function.prototype.name: ^1.1.6
+    has-tostringtag: ^1.0.2
+    is-async-function: ^2.0.0
+    is-date-object: ^1.1.0
+    is-finalizationregistry: ^1.1.0
+    is-generator-function: ^1.0.10
+    is-regex: ^1.2.1
+    is-weakref: ^1.0.2
+    isarray: ^2.0.5
+    which-boxed-primitive: ^1.1.0
+    which-collection: ^1.0.2
+    which-typed-array: ^1.1.16
+  checksum: 7a3617ba0e7cafb795f74db418df889867d12bce39a477f3ee29c6092aa64d396955bf2a64eae3726d8578440e26777695544057b373c45a8bcf5fbe920bf633
   languageName: node
   linkType: hard
 
-"which-boxed-primitive@npm:^1.0.2":
+"which-collection@npm:^1.0.2":
   version: 1.0.2
-  resolution: "which-boxed-primitive@npm:1.0.2"
-  dependencies:
-    is-bigint: ^1.0.1
-    is-boolean-object: ^1.1.0
-    is-number-object: ^1.0.4
-    is-string: ^1.0.5
-    is-symbol: ^1.0.3
-  checksum: 53ce774c7379071729533922adcca47220228405e1895f26673bbd71bdf7fb09bee38c1d6399395927c6289476b5ae0629863427fd151491b71c4b6cb04f3a5e
-  languageName: node
-  linkType: hard
-
-"which-collection@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "which-collection@npm:1.0.1"
+  resolution: "which-collection@npm:1.0.2"
   dependencies:
-    is-map: ^2.0.1
-    is-set: ^2.0.1
-    is-weakmap: ^2.0.1
-    is-weakset: ^2.0.1
-  checksum: c815bbd163107ef9cb84f135e6f34453eaf4cca994e7ba85ddb0d27cea724c623fae2a473ceccfd5549c53cc65a5d82692de418166df3f858e1e5dc60818581c
+    is-map: ^2.0.3
+    is-set: ^2.0.3
+    is-weakmap: ^2.0.2
+    is-weakset: ^2.0.3
+  checksum: c51821a331624c8197916598a738fc5aeb9a857f1e00d89f5e4c03dc7c60b4032822b8ec5696d28268bb83326456a8b8216344fb84270d18ff1d7628051879d9
   languageName: node
   linkType: hard
 
 "which-module@npm:^2.0.0":
-  version: 2.0.0
-  resolution: "which-module@npm:2.0.0"
-  checksum: 809f7fd3dfcb2cdbe0180b60d68100c88785084f8f9492b0998c051d7a8efe56784492609d3f09ac161635b78ea29219eb1418a98c15ce87d085bce905705c9c
+  version: 2.0.1
+  resolution: "which-module@npm:2.0.1"
+  checksum: 1967b7ce17a2485544a4fdd9063599f0f773959cca24176dbe8f405e55472d748b7c549cd7920ff6abb8f1ab7db0b0f1b36de1a21c57a8ff741f4f1e792c52be
   languageName: node
   linkType: hard
 
-"which-typed-array@npm:^1.1.9":
-  version: 1.1.9
-  resolution: "which-typed-array@npm:1.1.9"
+"which-typed-array@npm:^1.1.16, which-typed-array@npm:^1.1.18, which-typed-array@npm:^1.1.19":
+  version: 1.1.19
+  resolution: "which-typed-array@npm:1.1.19"
   dependencies:
-    available-typed-arrays: ^1.0.5
-    call-bind: ^1.0.2
-    for-each: ^0.3.3
-    gopd: ^1.0.1
-    has-tostringtag: ^1.0.0
-    is-typed-array: ^1.1.10
-  checksum: fe0178ca44c57699ca2c0e657b64eaa8d2db2372a4e2851184f568f98c478ae3dc3fdb5f7e46c384487046b0cf9e23241423242b277e03e8ba3dabc7c84c98ef
+    available-typed-arrays: ^1.0.7
+    call-bind: ^1.0.8
+    call-bound: ^1.0.4
+    for-each: ^0.3.5
+    get-proto: ^1.0.1
+    gopd: ^1.2.0
+    has-tostringtag: ^1.0.2
+  checksum: 162d2a07f68ea323f88ed9419861487ce5d02cb876f2cf9dd1e428d04a63133f93a54f89308f337b27cabd312ee3d027cae4a79002b2f0a85b79b9ef4c190670
   languageName: node
   linkType: hard
 
@@ -28543,6 +19089,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"which@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "which@npm:5.0.0"
+  dependencies:
+    isexe: ^3.1.1
+  bin:
+    node-which: bin/which.js
+  checksum: 6ec99e89ba32c7e748b8a3144e64bfc74aa63e2b2eacbb61a0060ad0b961eb1a632b08fb1de067ed59b002cec3e21de18299216ebf2325ef0f78e0f121e14e90
+  languageName: node
+  linkType: hard
+
 "wide-align@npm:^1.1.5":
   version: 1.1.5
   resolution: "wide-align@npm:1.1.5"
@@ -28552,17 +19109,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"word-wrap@npm:^1.2.3, word-wrap@npm:~1.2.3":
-  version: 1.2.3
-  resolution: "word-wrap@npm:1.2.3"
-  checksum: 30b48f91fcf12106ed3186ae4fa86a6a1842416df425be7b60485de14bec665a54a68e4b5156647dec3a70f25e84d270ca8bc8cd23182ed095f5c7206a938c1f
+"wildcard@npm:^2.0.1":
+  version: 2.0.1
+  resolution: "wildcard@npm:2.0.1"
+  checksum: e0c60a12a219e4b12065d1199802d81c27b841ed6ad6d9d28240980c73ceec6f856771d575af367cbec2982d9ae7838759168b551776577f155044f5a5ba843c
   languageName: node
   linkType: hard
 
-"wordwrap@npm:^0.0.3":
-  version: 0.0.3
-  resolution: "wordwrap@npm:0.0.3"
-  checksum: dfc2d3512e857ae4b3bc2e8d4e5d2c285c28a4b87cd1d81c977ce9a1a99152d355807e046851a3d61148f39d877fbb889352e07b65a9cbdd2256aa928e159026
+"word-wrap@npm:^1.2.5":
+  version: 1.2.5
+  resolution: "word-wrap@npm:1.2.5"
+  checksum: f93ba3586fc181f94afdaff3a6fef27920b4b6d9eaefed0f428f8e07adea2a7f54a5f2830ce59406c8416f033f86902b91eb824072354645eea687dff3691ccb
   languageName: node
   linkType: hard
 
@@ -28573,21 +19130,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"worker-farm@npm:^1.7.0":
-  version: 1.7.0
-  resolution: "worker-farm@npm:1.7.0"
-  dependencies:
-    errno: ~0.1.7
-  checksum: eab917530e1feddf157ec749e9c91b73a886142daa7fdf3490bccbf7b548b2576c43ab8d0a98e72ac755cbc101ca8647a7b1ff2485fddb9e8f53c40c77f5a719
-  languageName: node
-  linkType: hard
-
-"workerpool@npm:^2.3.0":
-  version: 2.3.4
-  resolution: "workerpool@npm:2.3.4"
+"wordwrapjs@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "wordwrapjs@npm:3.0.0"
   dependencies:
-    object-assign: 4.1.1
-  checksum: 34793e88505ca6638372791d401a27d17674efdd34d5535b76ce6579b35a0cb1780156b113a3790405eefc447160d6e255e4887bfbf0c42edbae8fdf475ccc93
+    reduce-flatten: ^1.0.1
+    typical: ^2.6.1
+  checksum: 953322ec8dd8b634a1a07a611760b0473e258073fd3bcab473082c6f0f30cdc48e641310209973d8557b9893bc291e32587f6dce05ea675242e21f8b0b0877bc
   languageName: node
   linkType: hard
 
@@ -28609,27 +19158,13 @@ __metadata:
   languageName: node
   linkType: hard
 
-"workerpool@npm:^6.0.0":
-  version: 6.1.4
-  resolution: "workerpool@npm:6.1.4"
-  checksum: 0927dd4302fc39be132e829f6bdca1c675a50d285858d3f0b233b75724030d7c10a618a5e8f5623c991121073306c10af73e750ec9ea366e1d2d76d8b5d3422c
-  languageName: node
-  linkType: hard
-
-"workerpool@npm:^6.0.2":
+"workerpool@npm:^6.0.2, workerpool@npm:^6.1.5, workerpool@npm:^6.4.0":
   version: 6.5.1
   resolution: "workerpool@npm:6.5.1"
   checksum: f86d13f9139c3a57c5a5867e81905cd84134b499849405dec2ffe5b1acd30dabaa1809f6f6ee603a7c65e1e4325f21509db6b8398eaf202c8b8f5809e26a2e16
   languageName: node
   linkType: hard
 
-"workerpool@npm:^6.4.0":
-  version: 6.4.0
-  resolution: "workerpool@npm:6.4.0"
-  checksum: 5fc010dbec44c69e1758cb2ccf924dfd286a86062a934f9e69a81cbad66f9be541441b2399debc2b024ae3dfc33a34a4c9ad61058af2ed8d53dcdeffb22b7b40
-  languageName: node
-  linkType: hard
-
 "wrap-ansi-cjs@npm:wrap-ansi@^7.0.0, wrap-ansi@npm:^7.0.0":
   version: 7.0.0
   resolution: "wrap-ansi@npm:7.0.0"
@@ -28674,15 +19209,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"wrap-legacy-hbs-plugin-if-needed@npm:^1.0.1":
-  version: 1.0.1
-  resolution: "wrap-legacy-hbs-plugin-if-needed@npm:1.0.1"
+"wrap-ansi@npm:^9.0.0":
+  version: 9.0.0
+  resolution: "wrap-ansi@npm:9.0.0"
   dependencies:
-    "@glimmer/reference": ^0.42.1
-    "@glimmer/runtime": ^0.42.1
-    "@glimmer/syntax": ^0.42.1
-    "@simple-dom/interface": ^1.4.0
-  checksum: b273f53b92fa26041e6cf8f3b712a0267a3cc75c8def3370e556428e72ef38deea605897c8d42b2a3b90f04d810c432b1de470db983b0c131030b29dc46aa1bd
+    ansi-styles: ^6.2.1
+    string-width: ^7.0.0
+    strip-ansi: ^7.1.0
+  checksum: b2d43b76b3d8dcbdd64768165e548aad3e54e1cae4ecd31bac9966faaa7cf0b0345677ad6879db10ba58eb446ba8fa44fb82b4951872fd397f096712467a809f
   languageName: node
   linkType: hard
 
@@ -28715,33 +19249,18 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ws@npm:^7.4.4":
-  version: 7.4.5
-  resolution: "ws@npm:7.4.5"
-  peerDependencies:
-    bufferutil: ^4.0.1
-    utf-8-validate: ^5.0.2
-  peerDependenciesMeta:
-    bufferutil:
-      optional: true
-    utf-8-validate:
-      optional: true
-  checksum: 5c7d1527f93ef27f9306aaf52db76315e8ff84174d1df717196527c50334c80bc10307dcaf6674a9aca4bb73aac3f77c23d3d9b1800e8aa810a5ee7f52d67cfb
-  languageName: node
-  linkType: hard
-
-"ws@npm:~8.2.3":
-  version: 8.2.3
-  resolution: "ws@npm:8.2.3"
+"ws@npm:~8.17.1":
+  version: 8.17.1
+  resolution: "ws@npm:8.17.1"
   peerDependencies:
     bufferutil: ^4.0.1
-    utf-8-validate: ^5.0.2
+    utf-8-validate: ">=5.0.2"
   peerDependenciesMeta:
     bufferutil:
       optional: true
     utf-8-validate:
       optional: true
-  checksum: c869296ccb45f218ac6d32f8f614cd85b50a21fd434caf11646008eef92173be53490810c5c23aea31bc527902261fbfd7b062197eea341b26128d4be56a85e4
+  checksum: 442badcce1f1178ec87a0b5372ae2e9771e07c4929a3180321901f226127f252441e8689d765aa5cfba5f50ac60dd830954afc5aeae81609aefa11d3ddf5cecf
   languageName: node
   linkType: hard
 
@@ -28752,28 +19271,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"xml-name-validator@npm:^3.0.0":
-  version: 3.0.0
-  resolution: "xml-name-validator@npm:3.0.0"
-  checksum: b3ac459afed783c285bb98e4960bd1f3ba12754fd4f2320efa0f9181ca28928c53cc75ca660d15d205e81f92304419afe94c531c7cfb3e0649aa6d140d53ecb0
-  languageName: node
-  linkType: hard
-
-"xmlchars@npm:^2.2.0":
-  version: 2.2.0
-  resolution: "xmlchars@npm:2.2.0"
-  checksum: 8c70ac94070ccca03f47a81fcce3b271bd1f37a591bf5424e787ae313fcb9c212f5f6786e1fa82076a2c632c0141552babcd85698c437506dfa6ae2d58723062
-  languageName: node
-  linkType: hard
-
-"xstate@npm:^3.3.3":
-  version: 3.3.3
-  resolution: "xstate@npm:3.3.3"
-  checksum: b659cf8c7ac5f48ef68bd55d8b5a60fb3b34686222c8d4e8966b9e8d7fd59569cf02e135fba5969d1f7b96cd3f617b1131b38970b90930371e668af7f6b4d2f6
+"xmlcreate@npm:^2.0.4":
+  version: 2.0.4
+  resolution: "xmlcreate@npm:2.0.4"
+  checksum: b8dd52668b9aea77cd1408fa85538c14bb8dcc98b4e7bb51e76696c9c115d59eba7240298d0c4fd2caf8f1a8e283ab4e5c7b9a6bcfcf23a8b48f5068b677b748
   languageName: node
   linkType: hard
 
-"xtend@npm:^4.0.0, xtend@npm:~4.0.1":
+"xtend@npm:^4.0.0":
   version: 4.0.2
   resolution: "xtend@npm:4.0.2"
   checksum: ac5dfa738b21f6e7f0dd6e65e1b3155036d68104e67e5d5d1bde74892e327d7e5636a076f625599dc394330a731861e87343ff184b0047fef1360a7ec0a5a36a
@@ -28808,6 +19313,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"yallist@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "yallist@npm:5.0.0"
+  checksum: eba51182400b9f35b017daa7f419f434424410691bbc5de4f4240cc830fdef906b504424992700dc047f16b4d99100a6f8b8b11175c193f38008e9c96322b6a5
+  languageName: node
+  linkType: hard
+
 "yam@npm:^1.0.0":
   version: 1.0.0
   resolution: "yam@npm:1.0.0"
@@ -28818,10 +19330,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"yaml@npm:^1.10.0":
-  version: 1.10.2
-  resolution: "yaml@npm:1.10.2"
-  checksum: ce4ada136e8a78a0b08dc10b4b900936912d15de59905b2bf415b4d33c63df1d555d23acb2a41b23cf9fb5da41c256441afca3d6509de7247daa062fd2c5ea5f
+"yaml@npm:^2.2.2, yaml@npm:^2.7.1":
+  version: 2.8.0
+  resolution: "yaml@npm:2.8.0"
+  bin:
+    yaml: bin.mjs
+  checksum: 66f103ca5a2f02dac0526895cc7ae7626d91aa8c43aad6fdcff15edf68b1199be4012140b390063877913441aaa5288fdf57eca30e06268a8282dd741525e626
   languageName: node
   linkType: hard
 
@@ -28835,13 +19349,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"yargs-parser@npm:^20.2.9":
-  version: 20.2.9
-  resolution: "yargs-parser@npm:20.2.9"
-  checksum: 8bb69015f2b0ff9e17b2c8e6bfe224ab463dd00ca211eece72a4cd8a906224d2703fb8a326d36fdd0e68701e201b2a60ed7cf81ce0fd9b3799f9fe7745977ae3
-  languageName: node
-  linkType: hard
-
 "yargs-parser@npm:^21.1.1":
   version: 21.1.1
   resolution: "yargs-parser@npm:21.1.1"
@@ -28867,7 +19374,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"yargs@npm:^17.7.1, yargs@npm:^17.7.2":
+"yargs@npm:^17.7.2":
   version: 17.7.2
   resolution: "yargs@npm:17.7.2"
   dependencies:
@@ -28890,9 +19397,16 @@ __metadata:
   linkType: hard
 
 "yocto-queue@npm:^1.0.0":
-  version: 1.0.0
-  resolution: "yocto-queue@npm:1.0.0"
-  checksum: 2cac84540f65c64ccc1683c267edce396b26b1e931aa429660aefac8fbe0188167b7aee815a3c22fa59a28a58d898d1a2b1825048f834d8d629f4c2a5d443801
+  version: 1.2.1
+  resolution: "yocto-queue@npm:1.2.1"
+  checksum: 0843d6c2c0558e5c06e98edf9c17942f25c769e21b519303a5c2adefd5b738c9b2054204dc856ac0cd9d134b1bc27d928ce84fd23c9e2423b7e013d5a6f50577
+  languageName: node
+  linkType: hard
+
+"yoctocolors-cjs@npm:^2.1.2":
+  version: 2.1.2
+  resolution: "yoctocolors-cjs@npm:2.1.2"
+  checksum: 1c474d4b30a8c130e679279c5c2c33a0d48eba9684ffa0252cc64846c121fb56c3f25457fef902edbe1e2d7a7872130073a9fc8e795299d75e13fa3f5f548f1b
   languageName: node
   linkType: hard
 
diff --git a/vault/acl.go b/vault/acl.go
index 19c0ba8fb0c..84c6de6649b 100644
--- a/vault/acl.go
+++ b/vault/acl.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -6,6 +6,7 @@ package vault
 import (
 	"context"
 	"fmt"
+	"os"
 	"reflect"
 	"slices"
 	"sort"
@@ -13,10 +14,12 @@ import (
 
 	"github.com/armon/go-radix"
 	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/vault/observations"
 	"github.com/mitchellh/copystructure"
 )
 
@@ -39,8 +42,10 @@ type ACL struct {
 }
 
 type PolicyCheckOpts struct {
-	RootPrivsRequired bool
-	Unauth            bool
+	RootPrivsRequired          bool
+	Unauth                     bool
+	CheckSourcePath            bool
+	RecoverAlternateCapability *logical.Operation
 }
 
 type AuthResults struct {
@@ -333,6 +338,9 @@ func (a *ACL) CapabilitiesAndSubscribeEventTypes(ctx context.Context, path strin
 	if capabilities&SubscribeCapabilityInt > 0 {
 		pathCapabilities = append(pathCapabilities, SubscribeCapability)
 	}
+	if capabilities&RecoverCapabilityInt > 0 {
+		pathCapabilities = append(pathCapabilities, RecoverCapability)
+	}
 
 	// If "deny" is explicitly set or if the path has no capabilities at all,
 	// set the path capabilities to "deny"
@@ -467,6 +475,9 @@ CHECK:
 	case logical.PatchOperation:
 		operationAllowed = capabilities&PatchCapabilityInt > 0
 		grantingPolicies = permissions.GrantingPoliciesMap[PatchCapabilityInt]
+	case logical.RecoverOperation:
+		operationAllowed = capabilities&RecoverCapabilityInt > 0
+		grantingPolicies = permissions.GrantingPoliciesMap[RecoverCapabilityInt]
 
 	// These three re-use UpdateCapabilityInt since that's the most appropriate
 	// capability/operation mapping
@@ -504,7 +515,7 @@ CHECK:
 
 	// Only check parameter permissions for operations that can modify
 	// parameters.
-	if op == logical.ReadOperation || op == logical.UpdateOperation || op == logical.CreateOperation || op == logical.PatchOperation {
+	if op == logical.ReadOperation || op == logical.UpdateOperation || op == logical.CreateOperation || op == logical.PatchOperation || op == logical.RecoverOperation {
 		for _, parameter := range permissions.RequiredParameters {
 			if _, ok := req.Data[strings.ToLower(parameter)]; !ok {
 				return
@@ -517,26 +528,25 @@ CHECK:
 			return
 		}
 
-		if len(permissions.DeniedParameters) == 0 {
-			goto ALLOWED_PARAMETERS
-		}
+		useLegacyMatching := os.Getenv("VAULT_LEGACY_EXACT_MATCHING_ON_LIST") != ""
 
-		// Check if all parameters have been denied
-		if _, ok := permissions.DeniedParameters["*"]; ok {
-			return
-		}
+		if len(permissions.DeniedParameters) > 0 {
+			// Check if all parameters have been denied
+			if _, ok := permissions.DeniedParameters["*"]; ok {
+				return
+			}
 
-		for parameter, value := range req.Data {
-			// Check if parameter has been explicitly denied
-			if valueSlice, ok := permissions.DeniedParameters[strings.ToLower(parameter)]; ok {
-				// If the value exists in denied values slice, deny
-				if valueInParameterList(value, valueSlice) {
-					return
+			for parameter, value := range req.Data {
+				// Check if parameter has been explicitly denied
+				if valueSlice, ok := permissions.DeniedParameters[strings.ToLower(parameter)]; ok {
+					// If the value exists in denied values slice, deny
+					if valueInDeniedParameterList(value, valueSlice, useLegacyMatching) {
+						return
+					}
 				}
 			}
 		}
 
-	ALLOWED_PARAMETERS:
 		// If we don't have any allowed parameters set, allow
 		if len(permissions.AllowedParameters) == 0 {
 			ret.Allowed = true
@@ -556,9 +566,9 @@ CHECK:
 				return
 			}
 
-			// If the value doesn't exists in the allowed values slice,
+			// If the value doesn't exist in the allowed values slice,
 			// deny
-			if ok && !valueInParameterList(value, valueSlice) {
+			if ok && !valueInAllowedParameterList(value, valueSlice, useLegacyMatching) {
 				return
 			}
 		}
@@ -734,7 +744,43 @@ SWCPATH:
 	return wcPathDescrs[len(wcPathDescrs)-1].perms
 }
 
-func (c *Core) performPolicyChecks(ctx context.Context, acl *ACL, te *logical.TokenEntry, req *logical.Request, inEntity *identity.Entity, opts *PolicyCheckOpts) *AuthResults {
+func (c *Core) recordPolicyEvaluationObservation(ctx context.Context, te *logical.TokenEntry, req *logical.Request, results *AuthResults) {
+	observation := map[string]interface{}{
+		"request_id": req.ID,
+		"path":       req.Path,
+		"entity_id":  req.EntityID,
+		"client_id":  req.ClientID,
+	}
+	if te != nil {
+		observation["policies"] = te.Policies
+		observation["is_root"] = te.IsRoot()
+	}
+
+	if results != nil {
+		if results.ACLResults != nil {
+			observation["request_allowed"] = results.Allowed
+			observation["request_acl_allowed"] = results.ACLResults.Allowed
+
+			grantingPolicies := make([]logical.PolicyInfo, 0)
+			if len(results.ACLResults.GrantingPolicies) > 0 {
+				grantingPolicies = append(grantingPolicies, results.ACLResults.GrantingPolicies...)
+			}
+			if results.SentinelResults != nil && len(results.SentinelResults.GrantingPolicies) > 0 {
+				grantingPolicies = append(grantingPolicies, results.SentinelResults.GrantingPolicies...)
+			}
+			if len(grantingPolicies) > 0 {
+				observation["granting_policies"] = grantingPolicies
+			}
+
+			err := c.Observations().RecordObservationToLedger(ctx, observations.ObservationTypePolicyACLEvaluation, nil, observation)
+			if err != nil {
+				c.logger.Error("error recording observation for policy checks", "error", err)
+			}
+		}
+	}
+}
+
+func (c *Core) performPolicyChecksSinglePath(ctx context.Context, acl *ACL, te *logical.TokenEntry, req *logical.Request, inEntity *identity.Entity, opts *PolicyCheckOpts) *AuthResults {
 	ret := new(AuthResults)
 
 	// First, perform normal ACL checks if requested. The only time no ACL
@@ -745,35 +791,111 @@ func (c *Core) performPolicyChecks(ctx context.Context, acl *ACL, te *logical.To
 		ret.RootPrivs = ret.ACLResults.RootPrivs
 		// Root is always allowed; skip Sentinel/MFA checks
 		if ret.ACLResults.IsRoot {
-			// logger.Warn("token is root, skipping checks")
 			ret.Allowed = true
+			c.recordPolicyEvaluationObservation(ctx, te, req, ret)
 			return ret
 		}
 		if !ret.ACLResults.Allowed {
+			c.recordPolicyEvaluationObservation(ctx, te, req, ret)
 			return ret
 		}
 		// Since HelpOperation was fast-pathed inside AllowOperation, RootPrivs will not have been populated in this
 		// case, so we need to special-case that here as well, or we'll block HelpOperation on all sudo-protected paths.
 		if !ret.RootPrivs && opts.RootPrivsRequired && req.Operation != logical.HelpOperation {
+			c.recordPolicyEvaluationObservation(ctx, te, req, ret)
 			return ret
 		}
 	}
 
 	c.performEntPolicyChecks(ctx, acl, te, req, inEntity, opts, ret)
 
+	c.recordPolicyEvaluationObservation(ctx, te, req, ret)
 	return ret
 }
 
-func valueInParameterList(v interface{}, list []interface{}) bool {
+func valueInAllowedParameterList(v interface{}, list []interface{}, useLegacyMatching bool) bool {
 	// Empty list is equivalent to the item always existing in the list
 	if len(list) == 0 {
 		return true
 	}
 
-	return valueInSlice(v, list)
+	if valueInParameterList(v, list) {
+		return true
+	}
+
+	if useLegacyMatching {
+		// prevent execution of the new behaviour if we're in legacy mode
+		return false
+	}
+
+	if vSlice, ok := v.([]interface{}); ok {
+		// when not running in legacy mode, we run a relaxed check for slices that verifies if all
+		// elements in the slice exist in the allowed list, as opposed to checking if the allowed
+		// list contains a single element that matches the entire slice (but this whole-slice match
+		// is still supported)
+		for _, v := range vSlice {
+			if !valueInParameterList(v, list) {
+				return false
+			}
+		}
+
+		return true
+	} else if vString, ok := v.(string); ok {
+		// At this point we don't know if the field is of framework.TypeCommaStringSlice, but we assume it is
+		// because failing to match a value because of it being in a comma-separated string is way more likely
+		// and worse than accidentally matching a substring of a string value.
+		if vSlice, err := parseutil.ParseCommaStringSlice(vString); err == nil {
+			for _, v := range vSlice {
+				if !valueInParameterList(v, list) {
+					return false
+				}
+			}
+			return true
+		}
+	}
+
+	return false
 }
 
-func valueInSlice(v interface{}, list []interface{}) bool {
+func valueInDeniedParameterList(v interface{}, list []interface{}, useLegacyMatching bool) bool {
+	// Empty list is equivalent to the item always existing in the list
+	if len(list) == 0 {
+		return true
+	}
+
+	if valueInParameterList(v, list) {
+		return true
+	}
+
+	if useLegacyMatching {
+		// prevent execution of the new behaviour if we're in legacy mode
+		return false
+	}
+
+	// The new behaviour is that if any value in the slice is in the denied list, we deny.
+	if vSlice, ok := v.([]interface{}); ok {
+		for _, v := range vSlice {
+			if valueInParameterList(v, list) {
+				return true
+			}
+		}
+	} else if vString, ok := v.(string); ok {
+		// At this point we don't know if the field is of framework.TypeCommaStringSlice, but we assume it is
+		// because failing to match a value because of it being in a comma-separated string is way more likely
+		// and worse than accidentally matching a substring of a string value.
+		if vSlice, err := parseutil.ParseCommaStringSlice(vString); err == nil {
+			for _, v := range vSlice {
+				if valueInParameterList(v, list) {
+					return true
+				}
+			}
+		}
+	}
+
+	return false
+}
+
+func valueInParameterList(v interface{}, list []interface{}) bool {
 	for _, el := range list {
 		if el == nil || v == nil {
 			// It doesn't seem possible to set up a nil entry in the list, but it is possible
@@ -782,11 +904,8 @@ func valueInSlice(v interface{}, list []interface{}) bool {
 			if el == v {
 				return true
 			}
-		} else if reflect.TypeOf(el).String() == "string" && reflect.TypeOf(v).String() == "string" {
-			item := el.(string)
-			val := v.(string)
-
-			if strutil.GlobbedStringsMatch(item, val) {
+		} else if elStr, ok := el.(string); ok {
+			if vStr, ok := v.(string); ok && strutil.GlobbedStringsMatch(elStr, vStr) {
 				return true
 			}
 		} else if reflect.DeepEqual(el, v) {
diff --git a/vault/acl_test.go b/vault/acl_test.go
index 467a8c35cdd..159c679cf35 100644
--- a/vault/acl_test.go
+++ b/vault/acl_test.go
@@ -1,9 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"reflect"
@@ -12,7 +13,9 @@ import (
 	"time"
 
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
 )
 
 func TestACL_NewACL(t *testing.T) {
@@ -267,6 +270,7 @@ func testACLSingle(t *testing.T, ns *namespace.Namespace) {
 		{logical.UpdateOperation, "1/2/3", false, false},
 		{logical.UpdateOperation, "1/2/3/4", true, false},
 		{logical.CreateOperation, "1/2/3/4/5", true, false},
+		{logical.RecoverOperation, "1/2/3/4", true, false},
 	}
 
 	for _, tc := range tcases {
@@ -899,6 +903,7 @@ func TestACLGrantingPolicies(t *testing.T) {
 		{"kv/deny", logical.ReadOperation, []*Policy{policy, merged}, nil, false},
 		{"kv/path/longer", logical.UpdateOperation, []*Policy{policy, merged}, []logical.PolicyInfo{policyInfo}, true},
 		{"kv/path/foo", logical.ReadOperation, []*Policy{policy, merged}, []logical.PolicyInfo{policyInfo, mergedInfo}, true},
+		{"ns1/kv/foo", logical.RecoverOperation, []*Policy{policy, merged}, []logical.PolicyInfo{policyInfo}, true},
 	}
 
 	for _, tc := range tcases {
@@ -945,7 +950,7 @@ path "kv/deny" {
 }
 
 path "ns1/kv/foo" {
-	capabilities = ["update", "read"]
+	capabilities = ["update", "read", "recover"]
 }
 `
 
@@ -1038,7 +1043,7 @@ path "1/2/+" {
 	capabilities = ["read"]
 }
 path "1/2/+/+" {
-	capabilities = ["update"]
+	capabilities = ["update", "recover"]
 }
 `
 
@@ -1332,3 +1337,882 @@ path "test/star" {
 	}
 }
 `
+
+// TestAllowedAndDeniedParameters tests allowed_parameters and denied_parameters against both new and old behaviors
+func TestAllowedAndDeniedParameters(t *testing.T) {
+	type testReq struct {
+		path       string // defaults to "test/path"
+		parameters string // JSON string representation of parameters
+		allowed    bool
+
+		// for behaviors that differ between legacy exact matching and new slice matching one of the following must
+		// be set, otherwise the same test is executed for both modes and must pass in both
+		onlyLegacyExactMatching bool
+		onlyNewSliceMatching    bool
+	}
+
+	// Define test cases
+	testCases := map[string]struct {
+		policy   string
+		requests map[string]testReq
+	}{
+		"neither_allowed_nor_denied_parameters_sets_no_restrictions": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+				}
+			`,
+			requests: map[string]testReq{
+				"update_with_arbitrary_param_is_allowed": {
+					parameters: `{"arbitrary": "value"}`,
+					allowed:    true,
+				},
+			},
+		},
+		"simple_allowed_parameters": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"allowedParam" = ["allowedValue"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"explicitly_allowed": {
+					parameters: `{"allowedParam": "allowedValue"}`,
+					allowed:    true,
+				},
+				"implicitly_disallowed": {
+					parameters: `{"allowedParam": "disallowedValue"}`,
+					allowed:    false,
+				},
+				"some_other_param_disallowed": {
+					parameters: `{"someOtherParam": "someValue"}`,
+					allowed:    false,
+				},
+				"list_with_allowed_value_denied_on_legacy": {
+					parameters:              `{"allowedParam": ["allowedValue"]}`,
+					allowed:                 false,
+					onlyLegacyExactMatching: true,
+				},
+				"list_with_allowed_value_allowed_on_new": {
+					parameters:           `{"allowedParam": ["allowedValue"]}`,
+					allowed:              true,
+					onlyNewSliceMatching: true,
+				},
+				"lower_level_not_affected_by_allow": {
+					parameters: `{"allowedParam": {"allowedParam": "allowedValue"}}`,
+					allowed:    false,
+				},
+				"empty_parameters_allowed": {
+					parameters: `{}`,
+					allowed:    true,
+				},
+				"case_insensitive_param_matching": {
+					parameters: `{"ALLOWEDPARAM": "allowedValue"}`,
+					allowed:    true,
+				},
+				"case_sensitive_value_matching": {
+					parameters: `{"allowedParam": "ALLOWEDVALUE"}`,
+					allowed:    false,
+				},
+			},
+		},
+		"simple_denied_parameters": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					denied_parameters = {
+						"deniedParam" = ["deniedValue"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"explicitly_denied": {
+					parameters: `{"deniedParam": "deniedValue"}`,
+					allowed:    false,
+				},
+				"implicitly_allowed": {
+					parameters: `{"deniedParam": "notdeniedValue"}`,
+					allowed:    true,
+				},
+				"some_other_param_allowed": {
+					parameters: `{"someOtherParam": "someValue"}`,
+					allowed:    true,
+				},
+				"list_with_denied_value_allowed_on_legacy_exact_matching": {
+					parameters:              `{"deniedParam": ["deniedValue"]}`,
+					allowed:                 true,
+					onlyLegacyExactMatching: true,
+				},
+				"list_with_denied_value_denied_on_new_slice_matching": {
+					parameters:           `{"deniedParam": ["deniedValue"]}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+				"lower_level_not_affected_by_denial": {
+					parameters: `{"deniedParam": {"deniedParam": "deniedValue"}}`,
+					allowed:    true,
+				},
+				"empty_parameters_allowed": {
+					parameters: `{}`,
+					allowed:    true,
+				},
+				"case_insensitive_param_matching": {
+					parameters: `{"DENIEDPARAM": "deniedValue"}`,
+					allowed:    false,
+				},
+				"case_sensitive_value_matching": {
+					parameters: `{"deniedParam": "DENIEDVALUE"}`,
+					allowed:    true,
+				},
+			},
+		},
+		"allow_and_deny_any_value": {
+			policy: `
+				path "test/allow_all" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"any" = []
+					}
+				}
+				path "test/deny_all" {
+					capabilities = ["update"]
+					denied_parameters = {
+						"none" = []
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"any_param_is_allowed": {
+					path:       "test/allow_all",
+					parameters: `{"any": "thing"}`,
+					allowed:    true,
+				},
+				"all_values_denied": {
+					path:       "test/deny_all",
+					parameters: `{"none": "thing"}`,
+					allowed:    false,
+				},
+				"other_param_is_allowed": {
+					path:       "test/deny_all",
+					parameters: `{"other": "thing"}`,
+					allowed:    true,
+				},
+			},
+		},
+		"different_allowed_and_denied_simple_params": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"allowedParam" = ["allowed"]
+					}
+					denied_parameters = {
+						"deniedParam" = ["denied"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"param_in_allowed_parameters_is_allowed": {
+					parameters: `{"allowedParam": "allowed"}`,
+					allowed:    true,
+				},
+				"param_in_denied_parameters_is_denied": {
+					parameters: `{"deniedParam": "denied"}`,
+					allowed:    false,
+				},
+				"denied_param_is_denied_even_if_value_not_denied": {
+					parameters: `{"deniedParam": "notDenied"}`,
+					// this is the expected behavior because allowed_parameters is an allowlist, rendering the deny list moot
+					allowed: false,
+				},
+			},
+		},
+		"same_simple_param_allowed_and_denied": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"allowedAndDeniedParam" = ["allowed"]
+					}
+					denied_parameters = {
+						"allowedAndDeniedParam" = ["denied"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"allowed_value": {
+					parameters: `{"allowedAndDeniedParam": "allowed"}`,
+					allowed:    true,
+				},
+				"denied_value": {
+					parameters: `{"allowedAndDeniedParam": "denied"}`,
+					allowed:    false,
+				},
+				"other_value_denied": {
+					parameters: `{"allowedAndDeniedParam": "other"}`,
+					allowed:    false,
+				},
+				"other_param_denied": {
+					parameters: `{"otherParam": "value"}`,
+					allowed:    false,
+				},
+			},
+		},
+		"same_simple_param_allowed_and_denied_same_value": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"allowedAndDeniedParam" = ["allowedAndDenied"]
+					}
+					denied_parameters = {
+						"allowedAndDeniedParam" = ["allowedAndDenied"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"deny_takes_precedence": {
+					parameters: `{"allowedAndDeniedParam": "allowedAndDenied"}`,
+					allowed:    false,
+				},
+			},
+		},
+		"simple_allowed_and_denied_parameters_with_splat": {
+			// we call the "*" = [] thing "splat" in the docs, not sure why but let's be consistent
+			policy: `
+				path "test/all_allowed" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"*" = []
+					}
+				}
+				path "test/all_allowed_with_exceptions" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"*" = []
+						"except" = ["onlyThisValue"]
+					}
+				}
+				path "test/all_denied" {
+					capabilities = ["update"]
+					denied_parameters = {
+						"*" = []
+					}
+				}
+				path "test/all_denied_exception_doesnt_work'" {
+					capabilities = ["update"]
+					denied_parameters = {
+						"except" = ["onlyThisValue"]
+						"*" = []
+					}
+				}
+				path "test/all_allowed_with_denied" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"*" = []
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"any_param_is_allowed": {
+					path:       "test/all_allowed",
+					parameters: `{"1": "1", "2": [2], "3": {"4": "4"}}`,
+					allowed:    true,
+				},
+				"splat_allowed_params_allows_empty": {
+					path:       "test/all_allowed",
+					parameters: `{}`,
+					allowed:    true,
+				},
+				"most_params_allowed": {
+					path:       "test/all_allowed_with_exceptions",
+					parameters: `{"1": "1", "2": [2], "3": {"4": "4"}, "except": "onlyThisValue"}`,
+					allowed:    true,
+				},
+				"most_params_allowed_exception": {
+					path:       "test/all_allowed_with_exceptions",
+					parameters: `{"1": "1", "2": [2], "3": {"4": "4"}, "except": "wrongValue"}`,
+					allowed:    false,
+				},
+				"any_param_is_denied": {
+					path:       "test/all_denied",
+					parameters: `{"any": "thing"}`,
+					allowed:    false,
+				},
+				"any_param_is_denied_empty_allowed": {
+					path:       "test/all_denied",
+					parameters: `{}`,
+					allowed:    true,
+				},
+				"exception_doesnt_work_for_splat_denied_parameters": {
+					path:       "test/all_denied_exception_doesnt_work",
+					parameters: `{"except": "onlyThisValue"}`,
+					allowed:    false,
+				},
+			},
+		},
+		"splat_with_non_empty_list_same_as_empty_list": {
+			policy: `
+				path "test/splat_allowed_with_value" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"*" = ["allowedValue"]
+					}
+				}
+				path "test/splat_denied_with_value" {
+					capabilities = ["update"]
+					denied_parameters = {
+						"*" = ["deniedValue"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"any_allowed": {
+					path:       "test/splat_allowed_with_value",
+					parameters: `{"anyParam": "anyValue"}`,
+					allowed:    true,
+				},
+				"all_denied": {
+					path:       "test/splat_denied_with_value",
+					parameters: `{"param": "deniedValue"}`,
+					allowed:    false,
+				},
+			},
+		},
+		"glob_patterns": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"*" = []
+						"globParam" = ["allowed1*", "allowed2*"]
+					}
+					denied_parameters = {
+						"globParamDeny" = ["denied1*", "denied2*"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"match_allowed": {
+					parameters: `{"globParam": "allowed11111"}`,
+					allowed:    true,
+				},
+				"no_match_denied": {
+					parameters: `{"globParam": "otherValue"}`,
+					allowed:    false,
+				},
+				"match_denied": {
+					parameters: `{"globParamDeny": "denied1111"}`,
+					allowed:    false,
+				},
+				"no_match_allowed": {
+					parameters: `{"globParamDeny": "otherValue"}`,
+					allowed:    true,
+				},
+				"list_with_match_denied_on_new_slice_matching": {
+					parameters:           `{"globParamDeny": ["denied1111", "otherValue"]}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+				"list_with_match_denied_on_new_slice_matching_comma_string_slice_parsing": {
+					parameters:           `{"globParamDeny": "denied1111,otherValue"}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+				"list_with_match_allowed_on_legacy_exact_matching": {
+					parameters:              `{"globParamDeny": ["denied11111", "otherValue"]}`,
+					allowed:                 true,
+					onlyLegacyExactMatching: true,
+				},
+				"list_with_match_denied_on_legacy_exact_matching_comma_string_slice_parsing": {
+					parameters:              `{"globParamDeny": "denied11111,otherValue"}`,
+					allowed:                 false,
+					onlyLegacyExactMatching: true,
+				},
+			},
+		},
+		"splat_allow_and_specific_deny": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"*" = []
+					}
+					denied_parameters = {
+						"specificParam" = ["specificValue"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"splat_allows_any_param_except_specific": {
+					parameters: `{"anyParam": "anyValue"}`,
+					allowed:    true,
+				},
+				"specific_param_denied": {
+					parameters: `{"specificParam": "specificValue"}`,
+					allowed:    false,
+				},
+				"specific_param_with_other_value_allowed": {
+					parameters: `{"specificParam": "otherValue"}`,
+					allowed:    true,
+				},
+			},
+		},
+		"simple_merge": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"*" = []
+						"mergeParam" = ["value1"]
+					}
+					denied_parameters = {
+						"mergeParamDeny" = ["value3"]
+					}
+				}
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"mergeParam" = ["value2"]
+					}
+					denied_parameters = {
+						"mergeParamDeny" = ["value4"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"merged_allowed_values": {
+					parameters: `{"mergeParam": "value1"}`,
+					allowed:    true,
+				},
+				"merged_allowed_values_other": {
+					parameters: `{"mergeParam": "value2"}`,
+					allowed:    true,
+				},
+				"merged_disallowed_values": {
+					parameters: `{"mergeParam": "value3"}`,
+					allowed:    false,
+				},
+				"merged_both_vales_denied_on_legacy_exact_matching": {
+					parameters:              `{"mergeParam": ["value1", "value2"]}`,
+					allowed:                 false,
+					onlyLegacyExactMatching: true,
+				},
+				"merged_both_vales_denied_on_legacy_exact_matching_string_slice": {
+					parameters:              `{"mergeParam": "value1,value2"}`,
+					allowed:                 false,
+					onlyLegacyExactMatching: true,
+				},
+				"merged_both_values_allowed_on_new_slice_matching": {
+					parameters:           `{"mergeParam": ["value1", "value2"]}`,
+					allowed:              true,
+					onlyNewSliceMatching: true,
+				},
+				"merged_both_values_allowed_on_new_slice_matching_string_slice": {
+					parameters:           `{"mergeParam": "value1,value2"}`,
+					allowed:              true,
+					onlyNewSliceMatching: true,
+				},
+				"merged_denied_values": {
+					parameters: `{"mergeParamDeny": "value3"}`,
+					allowed:    false,
+				},
+				"merged_denied_values_other": {
+					parameters: `{"mergeParamDeny": "value4"}`,
+					allowed:    false,
+				},
+				"merged_allowed_values_not_denied": {
+					parameters: `{"mergeParamDeny": "value5"}`,
+					allowed:    true,
+				},
+				"merged_both_denied_values_denied_on_new_slice_matching": {
+					parameters:           `{"mergeParamDeny": ["value3", "value4"]}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+				"merged_both_denied_values_denied_on_new_slice_matching_string_slice": {
+					parameters:           `{"mergeParamDeny": "value3,value4"}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+				"merged_both_denied_values_allowed_on_legacy_exact_matching": {
+					parameters:              `{"mergeParamDeny": ["value3", "value4"]}`,
+					allowed:                 true,
+					onlyLegacyExactMatching: true,
+				},
+				"merged_both_denied_values_allowed_on_legacy_exact_matching_string_slice": {
+					parameters:              `{"mergeParamDeny": "value3,value4"}`,
+					allowed:                 true,
+					onlyLegacyExactMatching: true,
+				},
+			},
+		},
+		"multiple_allowed_values": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"allowed_param" = ["allowedValue1", "allowedValue2"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"single_value_allowed": {
+					parameters: `{"allowed_param": "allowedValue1"}`,
+					allowed:    true,
+				},
+				"other_single_value_allowed": {
+					parameters: `{"allowed_param": "allowedValue2"}`,
+					allowed:    true,
+				},
+				"multiple_values_denied_with_legacy_exact_matching": {
+					parameters:              `{"allowed_param": ["allowedValue1", "allowedValue2"]}`,
+					allowed:                 false,
+					onlyLegacyExactMatching: true,
+				},
+				"multiple_values_denied_with_legacy_exact_matching_string_slice": {
+					parameters:              `{"allowed_param": "allowedValue1,allowedValue2"}`,
+					allowed:                 false,
+					onlyLegacyExactMatching: true,
+				},
+				"multiple_values_allowed_with_new_slice_matching": {
+					parameters:           `{"allowed_param": ["allowedValue1", "allowedValue2"]}`,
+					allowed:              true,
+					onlyNewSliceMatching: true,
+				},
+				"multiple_values_allowed_with_new_slice_matching_string_slice": {
+					parameters:           `{"allowed_param": "allowedValue1,allowedValue2"}`,
+					allowed:              true,
+					onlyNewSliceMatching: true,
+				},
+			},
+		},
+		"multiple_denied_values": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					denied_parameters = {
+						"denied_param" = ["deniedValue1", "deniedValue2"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"single_value_denied": {
+					parameters: `{"denied_param": "deniedValue1"}`,
+					allowed:    false,
+				},
+				"other_single_value_denied": {
+					parameters: `{"denied_param": "deniedValue2"}`,
+					allowed:    false,
+				},
+				"multiple_values_allowed_under_legacy_matching": {
+					parameters:              `{"denied_param": ["deniedValue1", "deniedValue2"]}`,
+					allowed:                 true,
+					onlyLegacyExactMatching: true,
+				},
+				"multiple_values_allowed_under_legacy_matching_string_slice": {
+					parameters:              `{"denied_param": "deniedValue1,deniedValue2"}`,
+					allowed:                 true,
+					onlyLegacyExactMatching: true,
+				},
+				"multiple_values_denied_with_new_slice_matching": {
+					parameters:           `{"denied_param": ["deniedValue1", "deniedValue2"]}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+				"multiple_values_denied_with_new_slice_matching_string_slice": {
+					parameters:           `{"denied_param": "deniedValue1,deniedValue2"}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+			},
+		},
+		"multiple_allowed_values_list": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"allowed_param" = ["allowedValue1", ["allowedValue1", "allowedValue2"]]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"single_value_allowed": {
+					parameters: `{"allowed_param": "allowedValue1"}`,
+					allowed:    true,
+				},
+				"other_single_value_disallowed": {
+					parameters: `{"allowed_param": "allowedValue2"}`,
+					allowed:    false,
+				},
+				"multiple_values_allowed": {
+					parameters: `{"allowed_param": ["allowedValue1", "allowedValue2"]}`,
+					allowed:    true,
+				},
+				"multiple_values_denied_string_slice_new_matching": {
+					parameters:           `{"allowed_param": "allowedValue1,allowedValue2"}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+				"multiple_values_disallowed_string_slice_legacy_matching": {
+					parameters:              `{"allowed_param": "allowedValue1,allowedValue2"}`,
+					allowed:                 false,
+					onlyLegacyExactMatching: true,
+				},
+			},
+		},
+		"multiple_denied_values_list": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					denied_parameters = {
+						"denied_param" = ["deniedValue1", ["deniedValue1", "deniedValue2"]]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"single_value_denied": {
+					parameters: `{"denied_param": "deniedValue1"}`,
+					allowed:    false,
+				},
+				"other_single_value_allowed": {
+					parameters: `{"denied_param": "deniedValue2"}`,
+					allowed:    true,
+				},
+				"multiple_values_denied": {
+					parameters: `{"denied_param": ["deniedValue1", "deniedValue2"]}`,
+					allowed:    false,
+				},
+				"multiple_values_denied_string_slice_new_matching": {
+					parameters:           `{"denied_param": "deniedValue1,deniedValue2"}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+				"multiple_values_allowed_string_slice_legacy_matching": {
+					parameters:              `{"denied_param": "deniedValue1,deniedValue2"}`,
+					allowed:                 true,
+					onlyLegacyExactMatching: true,
+				},
+			},
+		},
+		"complex_value_types": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"map_param" = [{"key1" = "value1", "key2" = "value2"}]
+						"int_param" = [1, 2, 3]
+						"bool_param" = [true, false]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"map_param_allowed": {
+					parameters: `{"map_param": {"key1": "value1", "key2": "value2"}}`,
+					allowed:    true,
+				},
+				"map_additional_fields_disallowed": {
+					parameters: `{"map_param": {"key1": "value1", "key2": "value2", "key3": "value3"}}`,
+					allowed:    false,
+				},
+				"map_fewer_fields_disallowed": {
+					parameters: `{"map_param": {"key1": "value1"}}`,
+					allowed:    false,
+				},
+				"map_keys_case_sensitive": {
+					parameters: `{"map_param": {"KEY1": "value1", "key2": "value2"}}`,
+					allowed:    false,
+				},
+				"int_param_doesnt_work": {
+					parameters: `{"int_param": 2}`,
+					allowed:    false,
+				},
+				"bool_param_allowed": {
+					parameters: `{"bool_param": false}`,
+					allowed:    true,
+				},
+				"bool_param_disallowed": {
+					parameters: `{"bool_param": "false"}`,
+					allowed:    false,
+				},
+			},
+		},
+		"VAULT-35716_use_case": {
+			policy: `
+				path "identity/group" {
+					capabilities = ["create", "update", "list", "read"]
+					denied_parameters = {
+						"name" = ["admin_group_*", "ADMIN_GROUP_*", "admin_automation", "ADMIN_AUTOMATION"]
+						"policies" = ["*admin-automation-policy*", "*admin-policy*"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"assignment_of_both_policies_and_name_allowed_on_legacy_exact_matching": {
+					path: "identity/group",
+					parameters: `{
+						"name": "test_policy_list",
+						"policies": ["admin-policy", "admin-automation-policy"],
+						"type": "external"
+					}`,
+					allowed:                 true,
+					onlyLegacyExactMatching: true,
+				},
+				"assignment_of_both_policies_and_name_denied_on_new_slice_matching": {
+					path: "identity/group",
+					parameters: `{
+						"name": "test_policy_list",
+						"policies": ["admin-policy", "admin-automation-policy"],
+						"type": "external"
+					}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+			},
+		},
+		"string_slice_edge_cases": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"allowed_param" = ["allowedValue1", "allowedValue2"]
+						"*" = []
+					}
+					denied_parameters = {
+						"denied_param" = ["deniedValue1", "deniedValue2"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"denied_string_slice_counts_spaces_legacy_matching": {
+					parameters:              `{"denied_param": "someValue, deniedValue2"}`,
+					allowed:                 true,
+					onlyLegacyExactMatching: true,
+				},
+				"denied_string_slice_disregards_spaces_new_matching": {
+					parameters:           `{"denied_param": "someValue, deniedValue2"}`,
+					allowed:              false,
+					onlyNewSliceMatching: true,
+				},
+				"allowed_string_slice_counts_spaces_legacy_matching": {
+					parameters:              `{"allowed_param": "allowedValue1, allowedValue2"}`,
+					allowed:                 false,
+					onlyLegacyExactMatching: true,
+				},
+				"allowed_string_slice_disregards_spaces_new_matching": {
+					parameters:           `{"allowed_param": "allowedValue1, allowedValue2"}`,
+					allowed:              true,
+					onlyNewSliceMatching: true,
+				},
+				"denied_string_slice_inside_array_does_not_parse": {
+					parameters: `{"denied_param": ["deniedValue1,deniedValue2"]}`,
+					allowed:    true,
+				},
+				"allowed_string_slice_inside_array_does_not_parse": {
+					parameters: `{"allowed_param": ["allowedValue1,allowedValue2"]}`,
+					allowed:    false,
+				},
+				"denied_string_slice_does_not_merge": {
+					parameters: `{"denied_param": ["deniedValue1,deniedValue2", "someValue"]}`,
+					allowed:    true,
+				},
+				"allowed_string_slice_does_not_merge": {
+					parameters: `{"allowed_param": ["allowedValue1,allowedValue2", "allowedValue1"]}`,
+					allowed:    false,
+				},
+			},
+		},
+		"string_value": {
+			policy: `
+				path "test/path" {
+					capabilities = ["update"]
+					allowed_parameters = {
+						"allowed_param" = ["allowedValue,withComma"]
+						"*" = []
+					}
+					denied_parameters = {
+						"denied_param" = ["deniedValue,withComma"]
+					}
+				}
+			`,
+			requests: map[string]testReq{
+				"substring_does_not_match_allowed": {
+					parameters: `{"allowed_param": "allowedValue"}`,
+					allowed:    false,
+				},
+				"substring_does_not_match_denied": {
+					parameters: `{"denied_param": "deniedValue"}`,
+					allowed:    true,
+				},
+				"full_string_with_comma_matches_allowed": {
+					parameters: `{"allowed_param": "allowedValue,withComma"}`,
+					allowed:    true,
+				},
+				"full_string_with_comma_matches_denied": {
+					parameters: `{"denied_param": "deniedValue,withComma"}`,
+					allowed:    false,
+				},
+			},
+		},
+	}
+
+	ns := namespace.RootNamespace
+	ctx := namespace.ContextWithNamespace(context.Background(), ns)
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			r := require.New(t)
+			policy, err := ParseACLPolicy(ns, tc.policy)
+			r.NoError(err)
+
+			acl, err := NewACL(ctx, []*Policy{policy})
+			r.NoError(err)
+
+			for reqName, req := range tc.requests {
+				if req.onlyNewSliceMatching && req.onlyLegacyExactMatching {
+					t.Fatalf("test case %q cannot be both onlyNewSliceMatching and onlyLegacyExactMatching", reqName)
+				}
+				t.Run(reqName, func(t *testing.T) {
+					test := func(t *testing.T) {
+						r := require.New(t)
+						path := req.path
+						if path == "" {
+							path = "test/path"
+						}
+
+						// Decode JSON string into a map
+						var parameters map[string]any
+						reader := bytes.NewReader([]byte(req.parameters))
+						err := jsonutil.DecodeJSONFromReader(reader, &parameters)
+						r.NoError(err)
+
+						request := &logical.Request{
+							Path:      path,
+							Data:      parameters,
+							Operation: logical.UpdateOperation,
+						}
+
+						authResults := acl.AllowOperation(ctx, request, false)
+						require.Equal(t, req.allowed, authResults.Allowed)
+					}
+					if !req.onlyNewSliceMatching && !req.onlyLegacyExactMatching {
+						t.Setenv("VAULT_LEGACY_EXACT_MATCHING_ON_LIST", "true")
+						t.Run("legacy_exact_matching", test)
+						t.Setenv("VAULT_LEGACY_EXACT_MATCHING_ON_LIST", "")
+						t.Run("new_slice_matching", test)
+					} else {
+						if req.onlyLegacyExactMatching {
+							t.Setenv("VAULT_LEGACY_EXACT_MATCHING_ON_LIST", "true")
+						} else {
+							t.Setenv("VAULT_LEGACY_EXACT_MATCHING_ON_LIST", "")
+						}
+						test(t)
+					}
+				})
+			}
+		})
+	}
+}
diff --git a/vault/acl_util.go b/vault/acl_util.go
index 161ed18c458..1ae8cb8ecea 100644
--- a/vault/acl_util.go
+++ b/vault/acl_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -15,3 +15,7 @@ import (
 func (c *Core) performEntPolicyChecks(ctx context.Context, acl *ACL, te *logical.TokenEntry, req *logical.Request, inEntity *identity.Entity, opts *PolicyCheckOpts, ret *AuthResults) {
 	ret.Allowed = true
 }
+
+func (c *Core) performPolicyChecks(ctx context.Context, acl *ACL, te *logical.TokenEntry, req *logical.Request, inEntity *identity.Entity, opts *PolicyCheckOpts) *AuthResults {
+	return c.performPolicyChecksSinglePath(ctx, acl, te, req, inEntity, opts)
+}
diff --git a/vault/acme_billing_system_view.go b/vault/acme_billing_system_view.go
index eb805cc2e7f..21f10008ca6 100644
--- a/vault/acme_billing_system_view.go
+++ b/vault/acme_billing_system_view.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -69,10 +69,11 @@ type acmeBillingSystemViewImpl struct {
 }
 
 var (
-	_ logical.ACMEBillingSystemView = (*acmeBillingSystemViewImpl)(nil)
-	_ extendedSystemView            = (*acmeBillingSystemViewImpl)(nil)
-	_ logical.ManagedKeySystemView  = (*acmeBillingSystemViewImpl)(nil)
-	_ entropy.Sourcer               = (*acmeBillingSystemViewImpl)(nil)
+	_ logical.ACMEBillingSystemView         = (*acmeBillingSystemViewImpl)(nil)
+	_ extendedSystemView                    = (*acmeBillingSystemViewImpl)(nil)
+	_ logical.ManagedKeySystemView          = (*acmeBillingSystemViewImpl)(nil)
+	_ entropy.Sourcer                       = (*acmeBillingSystemViewImpl)(nil)
+	_ logical.PkiCertificateCountSystemView = (*acmeBillingSystemViewImpl)(nil)
 )
 
 // Scenario 2 above.
@@ -83,9 +84,10 @@ type acmeBillingSystemViewImplNoSourcer struct {
 }
 
 var (
-	_ logical.ACMEBillingSystemView = (*acmeBillingSystemViewImplNoSourcer)(nil)
-	_ extendedSystemView            = (*acmeBillingSystemViewImplNoSourcer)(nil)
-	_ logical.ManagedKeySystemView  = (*acmeBillingSystemViewImplNoSourcer)(nil)
+	_ logical.ACMEBillingSystemView         = (*acmeBillingSystemViewImplNoSourcer)(nil)
+	_ extendedSystemView                    = (*acmeBillingSystemViewImplNoSourcer)(nil)
+	_ logical.ManagedKeySystemView          = (*acmeBillingSystemViewImplNoSourcer)(nil)
+	_ logical.PkiCertificateCountSystemView = (*acmeBillingSystemViewImplNoSourcer)(nil)
 )
 
 // Scenario 3 above.
@@ -95,8 +97,9 @@ type acmeBillingSystemViewImplNoManagedKeys struct {
 }
 
 var (
-	_ logical.ACMEBillingSystemView = (*acmeBillingSystemViewImplNoManagedKeys)(nil)
-	_ extendedSystemView            = (*acmeBillingSystemViewImplNoManagedKeys)(nil)
+	_ logical.ACMEBillingSystemView         = (*acmeBillingSystemViewImplNoManagedKeys)(nil)
+	_ extendedSystemView                    = (*acmeBillingSystemViewImplNoManagedKeys)(nil)
+	_ logical.PkiCertificateCountSystemView = (*acmeBillingSystemViewImplNoManagedKeys)(nil)
 )
 
 // NewAcmeBillingSystemView creates the appropriate implementation based on
@@ -136,7 +139,11 @@ func (a *acmeBillingImpl) CreateActivityCountEventForIdentifiers(ctx context.Con
 		return nil
 	}
 	activityLog.logger.Debug(fmt.Sprintf("Handling ACME client count event for [%v] -> %v", identifiers, clientID))
-	activityLog.AddActivityToFragment(clientID, a.entry.NamespaceID, time.Now().Unix(), ACMEActivityType, a.entry.Accessor)
+	activityLog.AddActivityToFragment(clientID, a.entry.NamespaceID, time.Now().Unix(), ACMEActivityType, a.entry.Accessor, time.Now().Unix())
 
 	return nil
 }
+
+func (a *acmeBillingImpl) GetPkiCertificateCounter() logical.PkiCertificateCounter {
+	return a.core.GetPkiCertificateCounter()
+}
diff --git a/vault/activity/activity_log.pb.go b/vault/activity/activity_log.pb.go
index 5b666823c13..e6bf2af6a8c 100644
--- a/vault/activity/activity_log.pb.go
+++ b/vault/activity/activity_log.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: vault/activity/activity_log.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -27,12 +28,9 @@ const (
 // can store clients associated with entities or nonEntity clients, and really
 // is a ClientRecord, not specifically an EntityRecord.
 type EntityRecord struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	ClientID    string `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
-	NamespaceID string `protobuf:"bytes,2,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
+	state       protoimpl.MessageState `protogen:"open.v1"`
+	ClientID    string                 `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	NamespaceID string                 `protobuf:"bytes,2,opt,name=namespace_id,json=namespaceID,proto3" json:"namespace_id,omitempty"`
 	// using the Timestamp type would cost us an extra
 	// 4 bytes per record to store nanoseconds.
 	Timestamp int64 `protobuf:"varint,3,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
@@ -45,15 +43,20 @@ type EntityRecord struct {
 	// client_type identifies the source of the entity record (entity,
 	// non-entity, acme, etc.)
 	ClientType string `protobuf:"bytes,6,opt,name=client_type,json=clientType,proto3" json:"client_type,omitempty"`
+	// usage_time is the timestamp when the client performed the activity.
+	// using the Timestamp type would cost us an extra
+	// 4 bytes per record to store nanoseconds.
+	// adds extra 10 bytes to the record
+	UsageTime     int64 `protobuf:"varint,7,opt,name=usage_time,json=usageTime,proto3" json:"usage_time,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *EntityRecord) Reset() {
 	*x = EntityRecord{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_activity_activity_log_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_activity_activity_log_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EntityRecord) String() string {
@@ -64,7 +67,7 @@ func (*EntityRecord) ProtoMessage() {}
 
 func (x *EntityRecord) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_activity_activity_log_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -121,11 +124,15 @@ func (x *EntityRecord) GetClientType() string {
 	return ""
 }
 
-type LogFragment struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *EntityRecord) GetUsageTime() int64 {
+	if x != nil {
+		return x.UsageTime
+	}
+	return 0
+}
 
+type LogFragment struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// hostname (or node ID?) where the fragment originated,
 	// used for debugging.
 	OriginatingNode string `protobuf:"bytes,1,opt,name=originating_node,json=originatingNode,proto3" json:"originating_node,omitempty"`
@@ -133,16 +140,16 @@ type LogFragment struct {
 	Clients []*EntityRecord `protobuf:"bytes,2,rep,name=clients,proto3" json:"clients,omitempty"`
 	// token counts not yet in a log segment,
 	// indexed by namespace ID
-	NonEntityTokens map[string]uint64 `protobuf:"bytes,3,rep,name=non_entity_tokens,json=nonEntityTokens,proto3" json:"non_entity_tokens,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"varint,2,opt,name=value,proto3"`
+	NonEntityTokens map[string]uint64 `protobuf:"bytes,3,rep,name=non_entity_tokens,json=nonEntityTokens,proto3" json:"non_entity_tokens,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *LogFragment) Reset() {
 	*x = LogFragment{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_activity_activity_log_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_activity_activity_log_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *LogFragment) String() string {
@@ -153,7 +160,7 @@ func (*LogFragment) ProtoMessage() {}
 
 func (x *LogFragment) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_activity_activity_log_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -192,20 +199,17 @@ func (x *LogFragment) GetNonEntityTokens() map[string]uint64 {
 // This activity log stores records for both clients with entities
 // and clients without entities
 type EntityActivityLog struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Clients       []*EntityRecord        `protobuf:"bytes,1,rep,name=clients,proto3" json:"clients,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Clients []*EntityRecord `protobuf:"bytes,1,rep,name=clients,proto3" json:"clients,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *EntityActivityLog) Reset() {
 	*x = EntityActivityLog{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_activity_activity_log_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_activity_activity_log_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EntityActivityLog) String() string {
@@ -216,7 +220,7 @@ func (*EntityActivityLog) ProtoMessage() {}
 
 func (x *EntityActivityLog) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_activity_activity_log_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -239,20 +243,17 @@ func (x *EntityActivityLog) GetClients() []*EntityRecord {
 }
 
 type TokenCount struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	CountByNamespaceID map[string]uint64 `protobuf:"bytes,1,rep,name=count_by_namespace_id,json=countByNamespaceId,proto3" json:"count_by_namespace_id,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"varint,2,opt,name=value,proto3"`
+	state              protoimpl.MessageState `protogen:"open.v1"`
+	CountByNamespaceID map[string]uint64      `protobuf:"bytes,1,rep,name=count_by_namespace_id,json=countByNamespaceId,proto3" json:"count_by_namespace_id,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }
 
 func (x *TokenCount) Reset() {
 	*x = TokenCount{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_activity_activity_log_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_activity_activity_log_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *TokenCount) String() string {
@@ -263,7 +264,7 @@ func (*TokenCount) ProtoMessage() {}
 
 func (x *TokenCount) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_activity_activity_log_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -286,18 +287,16 @@ func (x *TokenCount) GetCountByNamespaceID() map[string]uint64 {
 }
 
 type LogFragmentResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *LogFragmentResponse) Reset() {
 	*x = LogFragmentResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_activity_activity_log_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_activity_activity_log_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *LogFragmentResponse) String() string {
@@ -308,7 +307,7 @@ func (*LogFragmentResponse) ProtoMessage() {}
 
 func (x *LogFragmentResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_activity_activity_log_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -325,10 +324,10 @@ func (*LogFragmentResponse) Descriptor() ([]byte, []int) {
 
 var File_vault_activity_activity_log_proto protoreflect.FileDescriptor
 
-var file_vault_activity_activity_log_proto_rawDesc = []byte{
+var file_vault_activity_activity_log_proto_rawDesc = string([]byte{
 	0x0a, 0x21, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79,
 	0x2f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x5f, 0x6c, 0x6f, 0x67, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x12, 0x08, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x22, 0xd3, 0x01,
+	0x6f, 0x74, 0x6f, 0x12, 0x08, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x22, 0xf2, 0x01,
 	0x0a, 0x0c, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x1b,
 	0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
 	0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x6e,
@@ -342,60 +341,62 @@ var file_vault_activity_activity_log_proto_rawDesc = []byte{
 	0x01, 0x28, 0x09, 0x52, 0x0d, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
 	0x6f, 0x72, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70,
 	0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x54,
-	0x79, 0x70, 0x65, 0x22, 0x86, 0x02, 0x0a, 0x0b, 0x4c, 0x6f, 0x67, 0x46, 0x72, 0x61, 0x67, 0x6d,
-	0x65, 0x6e, 0x74, 0x12, 0x29, 0x0a, 0x10, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69,
-	0x6e, 0x67, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f,
-	0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6e, 0x67, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x30,
-	0x0a, 0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x16, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74,
-	0x79, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73,
-	0x12, 0x56, 0x0a, 0x11, 0x6e, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x74,
-	0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x61, 0x63,
-	0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x2e, 0x4c, 0x6f, 0x67, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x4e, 0x6f, 0x6e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0f, 0x6e, 0x6f, 0x6e, 0x45, 0x6e, 0x74, 0x69,
-	0x74, 0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x1a, 0x42, 0x0a, 0x14, 0x4e, 0x6f, 0x6e, 0x45,
-	0x6e, 0x74, 0x69, 0x74, 0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
-	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x04, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x45, 0x0a, 0x11,
-	0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x41, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x4c, 0x6f,
-	0x67, 0x12, 0x30, 0x0a, 0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x16, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x2e, 0x45, 0x6e,
-	0x74, 0x69, 0x74, 0x79, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x63, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x73, 0x22, 0xb4, 0x01, 0x0a, 0x0a, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x43, 0x6f, 0x75,
-	0x6e, 0x74, 0x12, 0x5f, 0x0a, 0x15, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x62, 0x79, 0x5f, 0x6e,
-	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x2c, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x2e, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x2e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x79, 0x4e,
-	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
-	0x12, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
-	0x65, 0x49, 0x64, 0x1a, 0x45, 0x0a, 0x17, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x79, 0x4e, 0x61,
-	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
-	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
-	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x15, 0x0a, 0x13, 0x4c, 0x6f,
-	0x67, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x42, 0x2b, 0x5a, 0x29, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
-	0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f,
-	0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+	0x79, 0x70, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x74, 0x69, 0x6d,
+	0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x75, 0x73, 0x61, 0x67, 0x65, 0x54, 0x69,
+	0x6d, 0x65, 0x22, 0x86, 0x02, 0x0a, 0x0b, 0x4c, 0x6f, 0x67, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65,
+	0x6e, 0x74, 0x12, 0x29, 0x0a, 0x10, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6e,
+	0x67, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f, 0x72,
+	0x69, 0x67, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6e, 0x67, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x30, 0x0a,
+	0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16,
+	0x2e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x2e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x12,
+	0x56, 0x0a, 0x11, 0x6e, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x61, 0x63, 0x74,
+	0x69, 0x76, 0x69, 0x74, 0x79, 0x2e, 0x4c, 0x6f, 0x67, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x4e, 0x6f, 0x6e, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0f, 0x6e, 0x6f, 0x6e, 0x45, 0x6e, 0x74, 0x69, 0x74,
+	0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x1a, 0x42, 0x0a, 0x14, 0x4e, 0x6f, 0x6e, 0x45, 0x6e,
+	0x74, 0x69, 0x74, 0x79, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
+	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x45, 0x0a, 0x11, 0x45,
+	0x6e, 0x74, 0x69, 0x74, 0x79, 0x41, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x4c, 0x6f, 0x67,
+	0x12, 0x30, 0x0a, 0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x16, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x2e, 0x45, 0x6e, 0x74,
+	0x69, 0x74, 0x79, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x63, 0x6c, 0x69, 0x65, 0x6e,
+	0x74, 0x73, 0x22, 0xb4, 0x01, 0x0a, 0x0a, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x43, 0x6f, 0x75, 0x6e,
+	0x74, 0x12, 0x5f, 0x0a, 0x15, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x62, 0x79, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x2c, 0x2e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x2e, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x2e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x79, 0x4e, 0x61,
+	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x12,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x49, 0x64, 0x1a, 0x45, 0x0a, 0x17, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x79, 0x4e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x15, 0x0a, 0x13, 0x4c, 0x6f, 0x67,
+	0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x42, 0x2b, 0x5a, 0x29, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68,
+	0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x76,
+	0x61, 0x75, 0x6c, 0x74, 0x2f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
 
 var (
 	file_vault_activity_activity_log_proto_rawDescOnce sync.Once
-	file_vault_activity_activity_log_proto_rawDescData = file_vault_activity_activity_log_proto_rawDesc
+	file_vault_activity_activity_log_proto_rawDescData []byte
 )
 
 func file_vault_activity_activity_log_proto_rawDescGZIP() []byte {
 	file_vault_activity_activity_log_proto_rawDescOnce.Do(func() {
-		file_vault_activity_activity_log_proto_rawDescData = protoimpl.X.CompressGZIP(file_vault_activity_activity_log_proto_rawDescData)
+		file_vault_activity_activity_log_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_vault_activity_activity_log_proto_rawDesc), len(file_vault_activity_activity_log_proto_rawDesc)))
 	})
 	return file_vault_activity_activity_log_proto_rawDescData
 }
 
 var file_vault_activity_activity_log_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
-var file_vault_activity_activity_log_proto_goTypes = []interface{}{
+var file_vault_activity_activity_log_proto_goTypes = []any{
 	(*EntityRecord)(nil),        // 0: activity.EntityRecord
 	(*LogFragment)(nil),         // 1: activity.LogFragment
 	(*EntityActivityLog)(nil),   // 2: activity.EntityActivityLog
@@ -421,73 +422,11 @@ func file_vault_activity_activity_log_proto_init() {
 	if File_vault_activity_activity_log_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_vault_activity_activity_log_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EntityRecord); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_activity_activity_log_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LogFragment); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_activity_activity_log_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EntityActivityLog); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_activity_activity_log_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TokenCount); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_activity_activity_log_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LogFragmentResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_vault_activity_activity_log_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_vault_activity_activity_log_proto_rawDesc), len(file_vault_activity_activity_log_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   7,
 			NumExtensions: 0,
@@ -498,7 +437,6 @@ func file_vault_activity_activity_log_proto_init() {
 		MessageInfos:      file_vault_activity_activity_log_proto_msgTypes,
 	}.Build()
 	File_vault_activity_activity_log_proto = out.File
-	file_vault_activity_activity_log_proto_rawDesc = nil
 	file_vault_activity_activity_log_proto_goTypes = nil
 	file_vault_activity_activity_log_proto_depIDxs = nil
 }
diff --git a/vault/activity/activity_log.proto b/vault/activity/activity_log.proto
index cb0a6b94e8d..85796fcd68d 100644
--- a/vault/activity/activity_log.proto
+++ b/vault/activity/activity_log.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
@@ -25,6 +25,11 @@ message EntityRecord {
   // client_type identifies the source of the entity record (entity,
   // non-entity, acme, etc.)
   string client_type = 6;
+  // usage_time is the timestamp when the client performed the activity.
+  // using the Timestamp type would cost us an extra
+  // 4 bytes per record to store nanoseconds.
+  // adds extra 10 bytes to the record
+  int64 usage_time = 7;
 }
 
 message LogFragment {
diff --git a/vault/activity/query.go b/vault/activity/query.go
index 7e035c3dd7f..0330edd0985 100644
--- a/vault/activity/query.go
+++ b/vault/activity/query.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package activity
@@ -24,17 +24,19 @@ type NamespaceRecord struct {
 	NonEntityTokens uint64         `json:"non_entity_tokens"`
 	SecretSyncs     uint64         `json:"secret_syncs"`
 	Mounts          []*MountRecord `json:"mounts"`
+	ACMEClients     uint64         `json:"acme_clients"`
 }
 
 type CountsRecord struct {
 	EntityClients    int `json:"entity_clients"`
 	NonEntityClients int `json:"non_entity_clients"`
 	SecretSyncs      int `json:"secret_syncs"`
+	ACMEClients      int `json:"acme_clients"`
 }
 
 // HasCounts returns true when any of the record's fields have a non-zero value
 func (c *CountsRecord) HasCounts() bool {
-	return c.EntityClients+c.NonEntityClients+c.SecretSyncs != 0
+	return c.EntityClients+c.NonEntityClients+c.SecretSyncs+c.ACMEClients != 0
 }
 
 type NewClientRecord struct {
@@ -57,6 +59,7 @@ type MonthlyNamespaceRecord struct {
 
 type MountRecord struct {
 	MountPath string        `json:"mount_path"`
+	MountType string        `json:"mount_type"`
 	Counts    *CountsRecord `json:"counts"`
 }
 
@@ -317,3 +320,67 @@ func (s *PrecomputedQueryStore) DeleteQueriesBefore(ctx context.Context, retenti
 	}
 	return nil
 }
+
+func (m *MonthlyNamespaceRecord) ToNamespaceRecord() *NamespaceRecord {
+	return &NamespaceRecord{
+		NamespaceID:     m.NamespaceID,
+		Entities:        uint64(m.Counts.EntityClients),
+		NonEntityTokens: uint64(m.Counts.NonEntityClients),
+		SecretSyncs:     uint64(m.Counts.SecretSyncs),
+		Mounts:          m.Mounts,
+		ACMEClients:     uint64(m.Counts.ACMEClients),
+	}
+}
+
+func (n *NamespaceRecord) CombineWithMonthlyNamespaceRecord(nsRecord *MonthlyNamespaceRecord) {
+	existingMounts := make(map[string]*MountRecord)
+	for _, mountRecord := range n.Mounts {
+		existingMounts[mountRecord.MountPath] = mountRecord
+	}
+
+	for _, mountRecord := range nsRecord.Mounts {
+		if existingMountRecord, ok := existingMounts[mountRecord.MountPath]; ok {
+			existingMountRecord.Add(mountRecord)
+		} else {
+			n.Mounts = append(n.Mounts, mountRecord)
+		}
+	}
+
+	n.SecretSyncs += uint64(nsRecord.Counts.SecretSyncs)
+	n.Entities += uint64(nsRecord.Counts.EntityClients)
+	n.NonEntityTokens += uint64(nsRecord.Counts.NonEntityClients)
+	n.ACMEClients += uint64(nsRecord.Counts.ACMEClients)
+}
+
+func (m *MountRecord) Add(m2 *MountRecord) {
+	m.Counts.ACMEClients += m2.Counts.ACMEClients
+	m.Counts.NonEntityClients += m2.Counts.NonEntityClients
+	m.Counts.EntityClients += m2.Counts.EntityClients
+	m.Counts.SecretSyncs += m2.Counts.SecretSyncs
+}
+
+func (q *PrecomputedQuery) CombineWithCurrentMonth(currentMonth *MonthRecord) {
+	// Append the current months data to the precomputed query month's data
+	q.Months = append(q.Months, currentMonth)
+
+	existingNamespaceMounts := make(map[string]*NamespaceRecord)
+	// Store the existing namespaces and mounts in the precomputed query for easy access
+	for _, monthlyNamespaceRecord := range q.Namespaces {
+		existingNamespaceMounts[monthlyNamespaceRecord.NamespaceID] = monthlyNamespaceRecord
+	}
+
+	// Get the counts of new clients each mount per namespace in the current month, and increment
+	// its total count in the precomputed query. These total values will be visible in the
+	// by_namespace grouping in the final response data
+	for _, nsRecord := range currentMonth.NewClients.Namespaces {
+		namespaceId := nsRecord.NamespaceID
+
+		// If the namespace already exists in the previous months, iterate through the mounts and increment the counts
+		if existingNsRecord, ok := existingNamespaceMounts[namespaceId]; ok {
+			existingNsRecord.CombineWithMonthlyNamespaceRecord(nsRecord)
+		} else {
+			// Else just add the new namespace record to the slice in the precomputed query's namespace slice
+			q.Namespaces = append(q.Namespaces, nsRecord.ToNamespaceRecord())
+		}
+	}
+}
diff --git a/vault/activity/query_test.go b/vault/activity/query_test.go
index 1c5a8323195..8602e5ee659 100644
--- a/vault/activity/query_test.go
+++ b/vault/activity/query_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package activity
@@ -14,6 +14,7 @@ import (
 	"github.com/hashicorp/vault/helper/timeutil"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/assert"
 )
 
 func NewTestQueryStore(t *testing.T) *PrecomputedQueryStore {
@@ -292,3 +293,354 @@ func TestQueryStore_TimeRanges(t *testing.T) {
 		})
 	}
 }
+
+// TestCombineWithCurrentMonth is a unit test that verifies that an
+// internal join method to combine a precomputed query data structure
+// with the current month data.
+// This will create various repeating mounts, new mounts, and new namespaces and
+// verify that these two structures are properly combined.
+func TestCombineWithCurrentMonth(t *testing.T) {
+	// Create two months worth of records
+	months := []*MonthRecord{
+		{
+			Counts: &CountsRecord{
+				EntityClients:    1,
+				NonEntityClients: 1,
+				SecretSyncs:      1,
+				ACMEClients:      1,
+			},
+		},
+		{
+			Counts: &CountsRecord{
+				EntityClients:    1,
+				NonEntityClients: 1,
+				SecretSyncs:      1,
+				ACMEClients:      1,
+			},
+		},
+	}
+	pq := &PrecomputedQuery{
+		Months: months,
+		Namespaces: []*NamespaceRecord{
+			{
+				NamespaceID:     "ns1",
+				Entities:        2,
+				ACMEClients:     2,
+				NonEntityTokens: 2,
+				SecretSyncs:     2,
+				Mounts: []*MountRecord{
+					{
+						MountPath: "m1",
+						Counts: &CountsRecord{
+							EntityClients:    1,
+							NonEntityClients: 1,
+							SecretSyncs:      1,
+							ACMEClients:      1,
+						},
+					},
+					{
+						MountPath: "m2",
+						Counts: &CountsRecord{
+							EntityClients:    1,
+							NonEntityClients: 1,
+							SecretSyncs:      1,
+							ACMEClients:      1,
+						},
+					},
+				},
+			},
+			{
+				NamespaceID:     "ns2",
+				Entities:        2,
+				ACMEClients:     2,
+				NonEntityTokens: 2,
+				SecretSyncs:     2,
+				Mounts: []*MountRecord{
+					{
+						MountPath: "m1",
+						Counts: &CountsRecord{
+							EntityClients:    1,
+							NonEntityClients: 1,
+							SecretSyncs:      1,
+							ACMEClients:      1,
+						},
+					},
+					{
+						MountPath: "m2",
+						Counts: &CountsRecord{
+							EntityClients:    1,
+							NonEntityClients: 1,
+							SecretSyncs:      1,
+							ACMEClients:      1,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	// In the new month we will add clients to three namespaces
+	// Namespace 1: clients for m1 (already present in PQ), and clients for m2 (already present in PQ)
+	// Namespace 2: clients for m1 (already present in PQ), and clients for m3 (NOT in PQ)
+	// Namespace 2: all clients and mounts are new
+	newMonthlyRecord := &MonthRecord{
+		Namespaces: []*MonthlyNamespaceRecord{
+			{
+				NamespaceID: "ns1",
+				Counts: &CountsRecord{
+					EntityClients:    4,
+					NonEntityClients: 4,
+					SecretSyncs:      4,
+					ACMEClients:      4,
+				},
+				Mounts: []*MountRecord{
+					{
+						MountPath: "m1",
+						Counts: &CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+					},
+					{
+						MountPath: "m2",
+						Counts: &CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+					},
+				},
+			},
+			{
+				NamespaceID: "ns2",
+				Counts: &CountsRecord{
+					EntityClients:    4,
+					NonEntityClients: 4,
+					SecretSyncs:      4,
+					ACMEClients:      4,
+				},
+				Mounts: []*MountRecord{
+					{
+						MountPath: "m1",
+						Counts: &CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+					},
+					{
+						MountPath: "m3",
+						Counts: &CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+					},
+				},
+			},
+			{
+				NamespaceID: "ns3",
+				Counts: &CountsRecord{
+					EntityClients:    4,
+					NonEntityClients: 4,
+					SecretSyncs:      4,
+					ACMEClients:      4,
+				},
+				Mounts: []*MountRecord{
+					{
+						MountPath: "m1",
+						Counts: &CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+					},
+					{
+						MountPath: "m2",
+						Counts: &CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+					},
+				},
+			},
+		},
+		NewClients: &NewClientRecord{
+			Namespaces: []*MonthlyNamespaceRecord{
+				{
+					NamespaceID: "ns1",
+					Counts: &CountsRecord{
+						EntityClients:    2,
+						NonEntityClients: 2,
+						SecretSyncs:      2,
+						ACMEClients:      2,
+					},
+					Mounts: []*MountRecord{
+						{
+							MountPath: "m1",
+							Counts: &CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+								SecretSyncs:      1,
+								ACMEClients:      1,
+							},
+						},
+						{
+							MountPath: "m2",
+							Counts: &CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+								SecretSyncs:      1,
+								ACMEClients:      1,
+							},
+						},
+					},
+				},
+				{
+					NamespaceID: "ns2",
+					Counts: &CountsRecord{
+						EntityClients:    2,
+						NonEntityClients: 2,
+						SecretSyncs:      2,
+						ACMEClients:      2,
+					},
+					Mounts: []*MountRecord{
+						{
+							MountPath: "m1",
+							Counts: &CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+								SecretSyncs:      1,
+								ACMEClients:      1,
+							},
+						},
+						{
+							MountPath: "m3",
+							Counts: &CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+								SecretSyncs:      1,
+								ACMEClients:      1,
+							},
+						},
+					},
+				},
+				{
+					NamespaceID: "ns3",
+					Counts: &CountsRecord{
+						EntityClients:    2,
+						NonEntityClients: 2,
+						SecretSyncs:      2,
+						ACMEClients:      2,
+					},
+					Mounts: []*MountRecord{
+						{
+							MountPath: "m1",
+							Counts: &CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+								SecretSyncs:      1,
+								ACMEClients:      1,
+							},
+						},
+						{
+							MountPath: "m2",
+							Counts: &CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+								SecretSyncs:      1,
+								ACMEClients:      1,
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	pq.CombineWithCurrentMonth(newMonthlyRecord)
+
+	// There should be 3 namespaces (one new one from this month)
+	assert.Equal(t, 3, len(pq.Namespaces))
+	// There should be 3 months (one new month from this month)
+	assert.Equal(t, 3, len(pq.Months))
+
+	// Verify first namespace values
+	assert.Equal(t, 4, int(pq.Namespaces[0].SecretSyncs))
+	assert.Equal(t, 4, int(pq.Namespaces[0].ACMEClients))
+	assert.Equal(t, 4, int(pq.Namespaces[0].Entities))
+	assert.Equal(t, 4, int(pq.Namespaces[0].NonEntityTokens))
+	assert.Equal(t, 2, len(pq.Namespaces[0].Mounts))
+	for i := 0; i < 2; i++ {
+		compareCountsRecords(t, &CountsRecord{
+			EntityClients:    2,
+			ACMEClients:      2,
+			NonEntityClients: 2,
+			SecretSyncs:      2,
+		}, pq.Namespaces[0].Mounts[i].Counts)
+	}
+
+	// Verify second namespace values
+	assert.Equal(t, 4, int(pq.Namespaces[1].SecretSyncs))
+	assert.Equal(t, 4, int(pq.Namespaces[1].ACMEClients))
+	assert.Equal(t, 4, int(pq.Namespaces[1].Entities))
+	assert.Equal(t, 4, int(pq.Namespaces[1].NonEntityTokens))
+	assert.Equal(t, 3, len(pq.Namespaces[1].Mounts)) // We added a new mount to this namespace (m3)
+	// Check that the duplicate mount got incremented properly (m1)
+	compareCountsRecords(t, &CountsRecord{
+		EntityClients:    2,
+		ACMEClients:      2,
+		NonEntityClients: 2,
+		SecretSyncs:      2,
+	}, pq.Namespaces[1].Mounts[0].Counts)
+	// Check the old mount counts have not changed (m2)
+	compareCountsRecords(t, &CountsRecord{
+		EntityClients:    1,
+		ACMEClients:      1,
+		NonEntityClients: 1,
+		SecretSyncs:      1,
+	}, pq.Namespaces[1].Mounts[1].Counts)
+	// Check the new mounts have been added (m3)
+	compareCountsRecords(t, &CountsRecord{
+		EntityClients:    1,
+		ACMEClients:      1,
+		NonEntityClients: 1,
+		SecretSyncs:      1,
+	}, pq.Namespaces[1].Mounts[2].Counts)
+
+	// Verify third namespace counts
+	// This is a completely new namespace
+	assert.Equal(t, 2, int(pq.Namespaces[2].SecretSyncs))
+	assert.Equal(t, 2, int(pq.Namespaces[2].ACMEClients))
+	assert.Equal(t, 2, int(pq.Namespaces[2].Entities))
+	assert.Equal(t, 2, int(pq.Namespaces[2].NonEntityTokens))
+	assert.Equal(t, 2, len(pq.Namespaces[2].Mounts))
+	compareCountsRecords(t, &CountsRecord{
+		EntityClients:    1,
+		ACMEClients:      1,
+		NonEntityClients: 1,
+		SecretSyncs:      1,
+	}, pq.Namespaces[2].Mounts[0].Counts)
+	compareCountsRecords(t, &CountsRecord{
+		EntityClients:    1,
+		ACMEClients:      1,
+		NonEntityClients: 1,
+		SecretSyncs:      1,
+	}, pq.Namespaces[2].Mounts[1].Counts)
+}
+
+func compareCountsRecords(t *testing.T, record *CountsRecord, toCompare *CountsRecord) {
+	t.Helper()
+	assert.Equal(t, record.NonEntityClients, toCompare.NonEntityClients)
+	assert.Equal(t, record.ACMEClients, toCompare.ACMEClients)
+	assert.Equal(t, record.SecretSyncs, toCompare.SecretSyncs)
+	assert.Equal(t, record.EntityClients, toCompare.EntityClients)
+}
diff --git a/vault/activity/test_fixtures/aug.csv b/vault/activity/test_fixtures/aug.csv
deleted file mode 100644
index 575a8953e80..00000000000
--- a/vault/activity/test_fixtures/aug.csv
+++ /dev/null
@@ -1,21 +0,0 @@
-client_id,namespace_id,timestamp,non_entity,mount_accessor
-111122222-3333-4444-5555-000000000000,root,1,false,auth_1
-111122222-3333-4444-5555-000000000001,root,1,false,auth_1
-111122222-3333-4444-5555-000000000002,root,1,false,auth_1
-111122222-3333-4444-5555-000000000003,root,1,false,auth_1
-111122222-3333-4444-5555-000000000004,root,1,false,auth_1
-111122222-3333-4444-5555-000000000005,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000006,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000007,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000008,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000009,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000010,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000011,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000012,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000013,bbbbb,2,false,auth_3
-111122222-3333-4444-5555-000000000014,bbbbb,2,false,auth_3
-111122222-3333-4444-5555-000000000015,root,2,false,auth_4
-111122222-3333-4444-5555-000000000016,root,2,false,auth_4
-111122222-3333-4444-5555-000000000017,root,2,false,auth_4
-111122222-3333-4444-5555-000000000018,root,2,false,auth_4
-111122222-3333-4444-5555-000000000019,root,2,false,auth_4
diff --git a/vault/activity/test_fixtures/aug.json b/vault/activity/test_fixtures/aug.json
deleted file mode 100644
index 17f117ab2b6..00000000000
--- a/vault/activity/test_fixtures/aug.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{"client_id":"111122222-3333-4444-5555-000000000000","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000001","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000002","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000003","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000004","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000005","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000006","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000007","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000008","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000009","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000010","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000011","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000012","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000013","namespace_id":"bbbbb","timestamp":2,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000014","namespace_id":"bbbbb","timestamp":2,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000015","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000016","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000017","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000018","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000019","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
diff --git a/vault/activity/test_fixtures/aug_oct.csv b/vault/activity/test_fixtures/aug_oct.csv
deleted file mode 100644
index d7a3848b171..00000000000
--- a/vault/activity/test_fixtures/aug_oct.csv
+++ /dev/null
@@ -1,41 +0,0 @@
-client_id,namespace_id,timestamp,non_entity,mount_accessor
-111122222-3333-4444-5555-000000000000,root,1,false,auth_1
-111122222-3333-4444-5555-000000000001,root,1,false,auth_1
-111122222-3333-4444-5555-000000000002,root,1,false,auth_1
-111122222-3333-4444-5555-000000000003,root,1,false,auth_1
-111122222-3333-4444-5555-000000000004,root,1,false,auth_1
-111122222-3333-4444-5555-000000000005,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000006,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000007,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000008,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000009,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000010,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000011,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000012,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000013,bbbbb,2,false,auth_3
-111122222-3333-4444-5555-000000000014,bbbbb,2,false,auth_3
-111122222-3333-4444-5555-000000000015,root,2,false,auth_4
-111122222-3333-4444-5555-000000000016,root,2,false,auth_4
-111122222-3333-4444-5555-000000000017,root,2,false,auth_4
-111122222-3333-4444-5555-000000000018,root,2,false,auth_4
-111122222-3333-4444-5555-000000000019,root,2,false,auth_4
-111122222-3333-4444-5555-000000000020,root,3,false,auth_5
-111122222-3333-4444-5555-000000000021,root,3,false,auth_5
-111122222-3333-4444-5555-000000000022,root,3,false,auth_5
-111122222-3333-4444-5555-000000000023,root,3,false,auth_5
-111122222-3333-4444-5555-000000000024,root,3,false,auth_5
-111122222-3333-4444-5555-000000000025,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000026,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000027,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000028,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000029,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000030,root,4,false,auth_7
-111122222-3333-4444-5555-000000000031,root,4,false,auth_7
-111122222-3333-4444-5555-000000000032,root,4,false,auth_7
-111122222-3333-4444-5555-000000000033,root,4,false,auth_7
-111122222-3333-4444-5555-000000000034,root,4,false,auth_7
-111122222-3333-4444-5555-000000000035,bbbbb,4,false,auth_8
-111122222-3333-4444-5555-000000000036,bbbbb,4,false,auth_8
-111122222-3333-4444-5555-000000000037,bbbbb,4,false,auth_8
-111122222-3333-4444-5555-000000000038,bbbbb,4,false,auth_8
-111122222-3333-4444-5555-000000000039,bbbbb,4,false,auth_8
diff --git a/vault/activity/test_fixtures/aug_oct.json b/vault/activity/test_fixtures/aug_oct.json
deleted file mode 100644
index 011b9f6d858..00000000000
--- a/vault/activity/test_fixtures/aug_oct.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{"client_id":"111122222-3333-4444-5555-000000000000","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000001","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000002","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000003","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000004","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000005","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000006","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000007","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000008","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000009","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000010","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000011","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000012","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000013","namespace_id":"bbbbb","timestamp":2,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000014","namespace_id":"bbbbb","timestamp":2,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000015","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000016","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000017","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000018","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000019","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000020","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000021","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000022","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000023","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000024","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000025","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000026","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000027","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000028","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000029","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000030","namespace_id":"root","timestamp":4,"mount_accessor":"auth_7"}
-{"client_id":"111122222-3333-4444-5555-000000000031","namespace_id":"root","timestamp":4,"mount_accessor":"auth_7"}
-{"client_id":"111122222-3333-4444-5555-000000000032","namespace_id":"root","timestamp":4,"mount_accessor":"auth_7"}
-{"client_id":"111122222-3333-4444-5555-000000000033","namespace_id":"root","timestamp":4,"mount_accessor":"auth_7"}
-{"client_id":"111122222-3333-4444-5555-000000000034","namespace_id":"root","timestamp":4,"mount_accessor":"auth_7"}
-{"client_id":"111122222-3333-4444-5555-000000000035","namespace_id":"bbbbb","timestamp":4,"mount_accessor":"auth_8"}
-{"client_id":"111122222-3333-4444-5555-000000000036","namespace_id":"bbbbb","timestamp":4,"mount_accessor":"auth_8"}
-{"client_id":"111122222-3333-4444-5555-000000000037","namespace_id":"bbbbb","timestamp":4,"mount_accessor":"auth_8"}
-{"client_id":"111122222-3333-4444-5555-000000000038","namespace_id":"bbbbb","timestamp":4,"mount_accessor":"auth_8"}
-{"client_id":"111122222-3333-4444-5555-000000000039","namespace_id":"bbbbb","timestamp":4,"mount_accessor":"auth_8"}
diff --git a/vault/activity/test_fixtures/aug_sep.csv b/vault/activity/test_fixtures/aug_sep.csv
deleted file mode 100644
index 34549f8eda6..00000000000
--- a/vault/activity/test_fixtures/aug_sep.csv
+++ /dev/null
@@ -1,31 +0,0 @@
-client_id,namespace_id,timestamp,non_entity,mount_accessor
-111122222-3333-4444-5555-000000000000,root,1,false,auth_1
-111122222-3333-4444-5555-000000000001,root,1,false,auth_1
-111122222-3333-4444-5555-000000000002,root,1,false,auth_1
-111122222-3333-4444-5555-000000000003,root,1,false,auth_1
-111122222-3333-4444-5555-000000000004,root,1,false,auth_1
-111122222-3333-4444-5555-000000000005,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000006,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000007,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000008,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000009,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000010,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000011,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000012,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000013,bbbbb,2,false,auth_3
-111122222-3333-4444-5555-000000000014,bbbbb,2,false,auth_3
-111122222-3333-4444-5555-000000000015,root,2,false,auth_4
-111122222-3333-4444-5555-000000000016,root,2,false,auth_4
-111122222-3333-4444-5555-000000000017,root,2,false,auth_4
-111122222-3333-4444-5555-000000000018,root,2,false,auth_4
-111122222-3333-4444-5555-000000000019,root,2,false,auth_4
-111122222-3333-4444-5555-000000000020,root,3,false,auth_5
-111122222-3333-4444-5555-000000000021,root,3,false,auth_5
-111122222-3333-4444-5555-000000000022,root,3,false,auth_5
-111122222-3333-4444-5555-000000000023,root,3,false,auth_5
-111122222-3333-4444-5555-000000000024,root,3,false,auth_5
-111122222-3333-4444-5555-000000000025,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000026,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000027,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000028,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000029,ccccc,3,false,auth_6
diff --git a/vault/activity/test_fixtures/aug_sep.json b/vault/activity/test_fixtures/aug_sep.json
deleted file mode 100644
index fb3a5219313..00000000000
--- a/vault/activity/test_fixtures/aug_sep.json
+++ /dev/null
@@ -1,30 +0,0 @@
-{"client_id":"111122222-3333-4444-5555-000000000000","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000001","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000002","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000003","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000004","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000005","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000006","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000007","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000008","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000009","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000010","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000011","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000012","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000013","namespace_id":"bbbbb","timestamp":2,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000014","namespace_id":"bbbbb","timestamp":2,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000015","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000016","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000017","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000018","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000019","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000020","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000021","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000022","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000023","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000024","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000025","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000026","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000027","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000028","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000029","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
diff --git a/vault/activity/test_fixtures/full_history.csv b/vault/activity/test_fixtures/full_history.csv
deleted file mode 100644
index 7a37ed23665..00000000000
--- a/vault/activity/test_fixtures/full_history.csv
+++ /dev/null
@@ -1,46 +0,0 @@
-client_id,namespace_id,timestamp,non_entity,mount_accessor
-111122222-3333-4444-5555-000000000040,rrrrr,0,false,auth_9
-111122222-3333-4444-5555-000000000041,rrrrr,0,false,auth_9
-111122222-3333-4444-5555-000000000042,rrrrr,0,false,auth_9
-111122222-3333-4444-5555-000000000043,rrrrr,0,false,auth_9
-111122222-3333-4444-5555-000000000044,rrrrr,0,false,auth_9
-111122222-3333-4444-5555-000000000000,root,1,false,auth_1
-111122222-3333-4444-5555-000000000001,root,1,false,auth_1
-111122222-3333-4444-5555-000000000002,root,1,false,auth_1
-111122222-3333-4444-5555-000000000003,root,1,false,auth_1
-111122222-3333-4444-5555-000000000004,root,1,false,auth_1
-111122222-3333-4444-5555-000000000005,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000006,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000007,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000008,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000009,aaaaa,1,false,auth_2
-111122222-3333-4444-5555-000000000010,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000011,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000012,bbbbb,1,false,auth_3
-111122222-3333-4444-5555-000000000013,bbbbb,2,false,auth_3
-111122222-3333-4444-5555-000000000014,bbbbb,2,false,auth_3
-111122222-3333-4444-5555-000000000015,root,2,false,auth_4
-111122222-3333-4444-5555-000000000016,root,2,false,auth_4
-111122222-3333-4444-5555-000000000017,root,2,false,auth_4
-111122222-3333-4444-5555-000000000018,root,2,false,auth_4
-111122222-3333-4444-5555-000000000019,root,2,false,auth_4
-111122222-3333-4444-5555-000000000020,root,3,false,auth_5
-111122222-3333-4444-5555-000000000021,root,3,false,auth_5
-111122222-3333-4444-5555-000000000022,root,3,false,auth_5
-111122222-3333-4444-5555-000000000023,root,3,false,auth_5
-111122222-3333-4444-5555-000000000024,root,3,false,auth_5
-111122222-3333-4444-5555-000000000025,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000026,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000027,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000028,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000029,ccccc,3,false,auth_6
-111122222-3333-4444-5555-000000000030,root,4,false,auth_7
-111122222-3333-4444-5555-000000000031,root,4,false,auth_7
-111122222-3333-4444-5555-000000000032,root,4,false,auth_7
-111122222-3333-4444-5555-000000000033,root,4,false,auth_7
-111122222-3333-4444-5555-000000000034,root,4,false,auth_7
-111122222-3333-4444-5555-000000000035,bbbbb,4,false,auth_8
-111122222-3333-4444-5555-000000000036,bbbbb,4,false,auth_8
-111122222-3333-4444-5555-000000000037,bbbbb,4,false,auth_8
-111122222-3333-4444-5555-000000000038,bbbbb,4,false,auth_8
-111122222-3333-4444-5555-000000000039,bbbbb,4,false,auth_8
diff --git a/vault/activity/test_fixtures/full_history.json b/vault/activity/test_fixtures/full_history.json
deleted file mode 100644
index 7516adfad36..00000000000
--- a/vault/activity/test_fixtures/full_history.json
+++ /dev/null
@@ -1,45 +0,0 @@
-{"client_id":"111122222-3333-4444-5555-000000000040","namespace_id":"rrrrr","mount_accessor":"auth_9"}
-{"client_id":"111122222-3333-4444-5555-000000000041","namespace_id":"rrrrr","mount_accessor":"auth_9"}
-{"client_id":"111122222-3333-4444-5555-000000000042","namespace_id":"rrrrr","mount_accessor":"auth_9"}
-{"client_id":"111122222-3333-4444-5555-000000000043","namespace_id":"rrrrr","mount_accessor":"auth_9"}
-{"client_id":"111122222-3333-4444-5555-000000000044","namespace_id":"rrrrr","mount_accessor":"auth_9"}
-{"client_id":"111122222-3333-4444-5555-000000000000","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000001","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000002","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000003","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000004","namespace_id":"root","timestamp":1,"mount_accessor":"auth_1"}
-{"client_id":"111122222-3333-4444-5555-000000000005","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000006","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000007","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000008","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000009","namespace_id":"aaaaa","timestamp":1,"mount_accessor":"auth_2"}
-{"client_id":"111122222-3333-4444-5555-000000000010","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000011","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000012","namespace_id":"bbbbb","timestamp":1,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000013","namespace_id":"bbbbb","timestamp":2,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000014","namespace_id":"bbbbb","timestamp":2,"mount_accessor":"auth_3"}
-{"client_id":"111122222-3333-4444-5555-000000000015","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000016","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000017","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000018","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000019","namespace_id":"root","timestamp":2,"mount_accessor":"auth_4"}
-{"client_id":"111122222-3333-4444-5555-000000000020","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000021","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000022","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000023","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000024","namespace_id":"root","timestamp":3,"mount_accessor":"auth_5"}
-{"client_id":"111122222-3333-4444-5555-000000000025","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000026","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000027","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000028","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000029","namespace_id":"ccccc","timestamp":3,"mount_accessor":"auth_6"}
-{"client_id":"111122222-3333-4444-5555-000000000030","namespace_id":"root","timestamp":4,"mount_accessor":"auth_7"}
-{"client_id":"111122222-3333-4444-5555-000000000031","namespace_id":"root","timestamp":4,"mount_accessor":"auth_7"}
-{"client_id":"111122222-3333-4444-5555-000000000032","namespace_id":"root","timestamp":4,"mount_accessor":"auth_7"}
-{"client_id":"111122222-3333-4444-5555-000000000033","namespace_id":"root","timestamp":4,"mount_accessor":"auth_7"}
-{"client_id":"111122222-3333-4444-5555-000000000034","namespace_id":"root","timestamp":4,"mount_accessor":"auth_7"}
-{"client_id":"111122222-3333-4444-5555-000000000035","namespace_id":"bbbbb","timestamp":4,"mount_accessor":"auth_8"}
-{"client_id":"111122222-3333-4444-5555-000000000036","namespace_id":"bbbbb","timestamp":4,"mount_accessor":"auth_8"}
-{"client_id":"111122222-3333-4444-5555-000000000037","namespace_id":"bbbbb","timestamp":4,"mount_accessor":"auth_8"}
-{"client_id":"111122222-3333-4444-5555-000000000038","namespace_id":"bbbbb","timestamp":4,"mount_accessor":"auth_8"}
-{"client_id":"111122222-3333-4444-5555-000000000039","namespace_id":"bbbbb","timestamp":4,"mount_accessor":"auth_8"}
diff --git a/vault/activity_log.go b/vault/activity_log.go
index 55a38d73872..34b5090dc9f 100644
--- a/vault/activity_log.go
+++ b/vault/activity_log.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -10,8 +10,10 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"net/http"
 	"os"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -19,15 +21,15 @@ import (
 	"time"
 	"unicode/utf8"
 
-	"github.com/axiomhq/hyperloglog"
 	"github.com/golang/protobuf/proto"
 	log "github.com/hashicorp/go-hclog"
+	lru "github.com/hashicorp/golang-lru"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/timeutil"
-	"github.com/hashicorp/vault/sdk/helper/license"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault/activity"
+	"github.com/mitchellh/mapstructure"
 	"go.uber.org/atomic"
 )
 
@@ -41,6 +43,7 @@ const (
 	activityConfigKey      = "config"
 	activityIntentLogKey   = "endofmonth"
 
+	activityACMERegenerationKey = "acme-regeneration"
 	// sketch for each month that stores hash of client ids
 	distinctClientsBasePath = "log/distinctclients/"
 
@@ -61,18 +64,18 @@ const (
 	activitySegmentWriteTimeout = 1 * time.Minute
 
 	// Number of client records to store per segment. Each ClientRecord may
-	// consume upto 99 bytes; rounding it to 100bytes. This []byte undergo JSON marshalling
+	// consume upto 115 bytes; rounding it to 120 bytes. This []byte undergo JSON marshalling
 	// before adding them in storage increasing the size by approximately 4/3 times. Considering the storage
-	// limit of 512KB per storage entry, we can roughly store 512KB/(100bytes * 4/3) yielding approximately 3820 records.
-	ActivitySegmentClientCapacity = 3820
+	// limit of 512KB per storage entry, we can roughly store 512KB/(120 bytes * 4/3) yielding approximately 3200 records.
+	ActivitySegmentClientCapacity = 3200
 
 	// Maximum number of segments per month. This allows for 700K entities per
-	// month; 700K/3820 (ActivitySegmentClientCapacity). These limits are geared towards controlling the storage
+	// month; 700K/3200 (ActivitySegmentClientCapacity). These limits are geared towards controlling the storage
 	// implications of persisting activity logs. If we hit a scenario where the
 	// storage consequences are less important in comparison to the accuracy of
 	// the client activity, these limits can be further relaxed or even be
 	// removed.
-	activityLogMaxSegmentPerMonth = 184
+	activityLogMaxSegmentPerMonth = 220
 
 	// trackedTWESegmentPeriod is a time period of a little over a month, and represents
 	// the amount of time that needs to pass after a 1.9 or later upgrade to result in
@@ -87,8 +90,33 @@ const (
 	entityActivityType         = "entity"
 	secretSyncActivityType     = "secret-sync"
 
-	// FeatureSecretSyncBilling will always be false
-	FeatureSecretSyncBilling = license.FeatureNone
+	// ActivityLogMinimumRetentionMonths sets the default minimum retention_months
+	// to enforce when reporting is enabled. Note that this value is also statically
+	// defined in the UI. Any updates here should also be made to
+	// ui/app/models/clients/config.js.
+	ActivityLogMinimumRetentionMonths = 48
+
+	// activityLogMaximumRetentionMonths sets the default maximum retention_months
+	// to enforce when reporting is enabled.
+	activityLogMaximumRetentionMonths = 60
+
+	// ActivityExportInvalidFormatPrefix is used to check validation errors for the
+	// activity log export API handler
+	ActivityExportInvalidFormatPrefix = "invalid format"
+
+	// exportCSVFlatteningInitIndex is used within the activity export API when the "csv"
+	// format is requested. Map and slice values will be flattened and accumulated by the
+	// CSV encoder. Indexes will be generated to ensure that values are slotted into the
+	// correct column. This initial value is used prior to finalizing the CSV header.
+	exportCSVFlatteningInitIndex = -1
+)
+
+var (
+	ActivityClientTypes = []string{nonEntityTokenActivityType, entityActivityType, secretSyncActivityType, ACMEActivityType}
+
+	// ErrActivityExportInProgress is used to check validation errors for the
+	// activity log export API handler
+	ErrActivityExportInProgress = errors.New("existing export in progress")
 )
 
 type segmentInfo struct {
@@ -134,7 +162,8 @@ type ActivityLog struct {
 
 	// nodeID is the ID to use for all fragments that
 	// are generated.
-	// TODO: use secondary ID when available?
+	// This uses the primary ID as of right now, but
+	// could be adapted to use a secondary in the future.
 	nodeID string
 
 	// current log fragment (may be nil)
@@ -178,19 +207,28 @@ type ActivityLog struct {
 
 	inprocessExport *atomic.Bool
 
-	// CensusReportDone is a channel used to signal tests upon successful calls
-	// to (CensusReporter).Write() in CensusReport.
-	CensusReportDone chan bool
-
-	// CensusReportInterval is the testing configuration for time between
-	// Write() calls initiated in CensusReport.
-	CensusReportInterval time.Duration
-
 	// clock is used to support manipulating time in unit and integration tests
 	clock timeutil.Clock
 	// precomputedQueryWritten receives an element whenever a precomputed query
 	// is written. It's used for unit testing
 	precomputedQueryWritten chan struct{}
+
+	clientIDsUsage ClientUsageInfo
+}
+
+type ClientUsageInfo struct {
+	// clientIDsUsageInfoLock controls access to the ClientUsageInfo
+	clientIDsUsageInfoLock sync.RWMutex
+
+	// setupClientIDsUsageInfoCancelCtx is used to cancel and restart setupClientIDsUsageInfo goroutine during reloads
+	setupClientIDsUsageInfoCancelCtx context.CancelFunc
+
+	// The clientIDsUsageInfo map has clientIDs that have been used in the current billing period
+	clientIDsUsageInfo map[string]struct{}
+
+	// clientIDsUsageInfoLoaded is set to true when the clientIDsUsageInfo has up-to date information upon startup.
+	// This ensures that the counters api returns exact values for new clients in the current month upon startup.
+	clientIDsUsageInfoLoaded *atomic.Bool
 }
 
 // These non-persistent configuration options allow us to disable
@@ -205,9 +243,6 @@ type ActivityLogCoreConfig struct {
 	// Do not start timers to send or persist fragments.
 	DisableTimers bool
 
-	// CensusReportInterval is the testing configuration for time
-	CensusReportInterval time.Duration
-
 	// MinimumRetentionMonths defines the minimum value for retention
 	MinimumRetentionMonths int
 
@@ -218,6 +253,65 @@ type ActivityLogCoreConfig struct {
 	DisableInvalidation bool
 }
 
+// ActivityLogExportRecord is the output structure for activity export
+// API records. The fields below are all associated with the token used to
+// perform the logged activity. The omitempty JSON tag is not used to ensure
+// that the fields are consistent between CSV and JSON output.
+type ActivityLogExportRecord struct {
+	// EntityName is the name of the entity
+	EntityName string `json:"entity_name" mapstructure:"entity_name"`
+
+	// EntityAliasName is the entity alias name provided by the auth backend upon login
+	EntityAliasName string `json:"entity_alias_name" mapstructure:"entity_alias_name"`
+
+	// LocalEntityAlias indicates if the entity alias only belongs to the cluster where it was created.
+	LocalEntityAlias bool `json:"local_entity_alias" mapstructure:"local_entity_alias"`
+
+	// ClientID is the unique identifier assigned to the entity that performed the activity
+	ClientID string `json:"client_id" mapstructure:"client_id"`
+
+	// ClientType identifies the source of the entity record (entity, non-entity, acme, etc.)
+	ClientType string `json:"client_type" mapstructure:"client_type"`
+
+	// NamespaceID is the identifier of the namespace in which the associated auth backend resides
+	NamespaceID string `json:"namespace_id" mapstructure:"namespace_id"`
+
+	// NamespacePath is the path of the namespace in which the associated auth backend resides
+	NamespacePath string `json:"namespace_path" mapstructure:"namespace_path"`
+
+	// MountAccessor is the auth mount accessor associated with the token used
+	MountAccessor string `json:"mount_accessor" mapstructure:"mount_accessor"`
+
+	// MountType is the type of the auth mount associated with the token used
+	MountType string `json:"mount_type" mapstructure:"mount_type"`
+
+	// MountPath is the path of the auth mount associated with the token used
+	MountPath string `json:"mount_path" mapstructure:"mount_path"`
+
+	// TokenCreationTime denotes the token creation timestamp formatted using RFC3339
+	TokenCreationTime string `json:"token_creation_time" mapstructure:"token_creation_time"`
+
+	// ClientFirstUsedTime denotes the timestamp at which the activity first occurred in the query period formatted using RFC3339
+	ClientFirstUsedTime string `json:"client_first_used_time,omitempty" mapstructure:"client_first_used_time"`
+
+	// Policies are the list of policy names attached to the token used
+	Policies []string `json:"policies" mapstructure:"policies"`
+
+	// EntityMetadata represents explicit metadata set by clients. Multiple entities can have the
+	// same metadata which enables virtual groupings of entities.
+	EntityMetadata map[string]string `json:"entity_metadata" mapstructure:"entity_metadata"`
+
+	// EntityAliasMetadata represents the metadata associated with the identity alias. Multiple aliases can
+	// have the same custom metadata which enables virtual grouping of aliases.
+	EntityAliasMetadata map[string]string `json:"entity_alias_metadata" mapstructure:"entity_alias_metadata"`
+
+	// EntityAliasCustomMetadata represents the custom metadata associated with the identity alias
+	EntityAliasCustomMetadata map[string]string `json:"entity_alias_custom_metadata" mapstructure:"entity_alias_custom_metadata"`
+
+	// EntityGroupIDs provides a list of all of the identity group IDs in which an entity belongs
+	EntityGroupIDs []string `json:"entity_group_ids" mapstructure:"entity_group_ids"`
+}
+
 // NewActivityLog creates an activity log.
 func NewActivityLog(core *Core, logger log.Logger, view *BarrierView, metrics metricsutil.Metrics) (*ActivityLog, error) {
 	hostname, err := os.Hostname()
@@ -240,7 +334,6 @@ func NewActivityLog(core *Core, logger log.Logger, view *BarrierView, metrics me
 		sendCh:                    make(chan struct{}, 1), // buffered so it can be triggered by fragment size
 		doneCh:                    make(chan struct{}, 1),
 		partialMonthClientTracker: make(map[string]*activity.EntityRecord),
-		CensusReportInterval:      time.Hour * 1,
 		clock:                     clock,
 		currentSegment: segmentInfo{
 			startTimestamp: 0,
@@ -258,6 +351,10 @@ func NewActivityLog(core *Core, logger log.Logger, view *BarrierView, metrics me
 		standbyFragmentsReceived: make([]*activity.LogFragment, 0),
 		inprocessExport:          atomic.NewBool(false),
 		precomputedQueryWritten:  make(chan struct{}),
+		clientIDsUsage: ClientUsageInfo{
+			clientIDsUsageInfo:       make(map[string]struct{}),
+			clientIDsUsageInfoLoaded: new(atomic.Bool),
+		},
 	}
 
 	config, err := a.loadConfigOrDefault(core.activeContext)
@@ -265,6 +362,15 @@ func NewActivityLog(core *Core, logger log.Logger, view *BarrierView, metrics me
 		return nil, err
 	}
 
+	// check if the retention time is lesser than the default in storage when reporting is enabled to support upgrades
+	if (config.RetentionMonths < ActivityLogMinimumRetentionMonths) && core.ManualLicenseReportingEnabled() {
+		updatedConfig, err := a.setDefaultRetentionMonthsInConfig(core.activeContext, config)
+		if err != nil {
+			return nil, err
+		}
+		config = updatedConfig
+	}
+
 	a.SetConfigInit(config)
 
 	a.queryStore = activity.NewPrecomputedQueryStore(
@@ -502,7 +608,7 @@ func parseSegmentNumberFromPath(path string) (int, bool) {
 
 // availableLogs returns the start_time(s) (in UTC) associated with months for which logs exist,
 // sorted last to first
-func (a *ActivityLog) availableLogs(ctx context.Context) ([]time.Time, error) {
+func (a *ActivityLog) availableLogs(ctx context.Context, upTo time.Time) ([]time.Time, error) {
 	paths := make([]string, 0)
 	for _, basePath := range []string{activityEntityBasePath, activityTokenBasePath} {
 		p, err := a.view.List(ctx, basePath)
@@ -517,14 +623,17 @@ func (a *ActivityLog) availableLogs(ctx context.Context) ([]time.Time, error) {
 	out := make([]time.Time, 0)
 	for _, path := range paths {
 		// generate a set of unique start times
-		time, err := timeutil.ParseTimeFromPath(path)
+		segmentTime, err := timeutil.ParseTimeFromPath(path)
 		if err != nil {
 			return nil, err
 		}
+		if segmentTime.After(upTo) {
+			continue
+		}
 
-		if _, present := pathSet[time]; !present {
-			pathSet[time] = struct{}{}
-			out = append(out, time)
+		if _, present := pathSet[segmentTime]; !present {
+			pathSet[segmentTime] = struct{}{}
+			out = append(out, segmentTime)
 		}
 	}
 
@@ -533,15 +642,15 @@ func (a *ActivityLog) availableLogs(ctx context.Context) ([]time.Time, error) {
 		return out[i].After(out[j])
 	})
 
-	a.logger.Trace("scanned existing logs", "out", out)
+	a.logger.Trace("scanned existing logs", "out", out, "up to", upTo)
 
 	return out, nil
 }
 
 // getMostRecentActivityLogSegment gets the times (in UTC) associated with the most recent
 // contiguous set of activity logs, sorted in decreasing order (latest to earliest)
-func (a *ActivityLog) getMostRecentActivityLogSegment(ctx context.Context) ([]time.Time, error) {
-	logTimes, err := a.availableLogs(ctx)
+func (a *ActivityLog) getMostRecentActivityLogSegment(ctx context.Context, now time.Time) ([]time.Time, error) {
+	logTimes, err := a.availableLogs(ctx, now)
 	if err != nil {
 		return nil, err
 	}
@@ -574,7 +683,7 @@ func (a *ActivityLog) getLastEntitySegmentNumber(ctx context.Context, startTime
 }
 
 // WalkEntitySegments loads each of the entity segments for a particular start time
-func (a *ActivityLog) WalkEntitySegments(ctx context.Context, startTime time.Time, hll *hyperloglog.Sketch, walkFn func(*activity.EntityActivityLog, time.Time, *hyperloglog.Sketch) error) error {
+func (a *ActivityLog) WalkEntitySegments(ctx context.Context, startTime time.Time, walkFn func(*activity.EntityActivityLog, time.Time) error) error {
 	basePath := activityEntityBasePath + fmt.Sprint(startTime.Unix()) + "/"
 	pathList, err := a.view.List(ctx, basePath)
 	if err != nil {
@@ -596,7 +705,7 @@ func (a *ActivityLog) WalkEntitySegments(ctx context.Context, startTime time.Tim
 		if err != nil {
 			return fmt.Errorf("unable to parse segment %v%v: %w", basePath, path, err)
 		}
-		err = walkFn(out, startTime, hll)
+		err = walkFn(out, startTime)
 		if err != nil {
 			return fmt.Errorf("unable to walk entities: %w", err)
 		}
@@ -883,7 +992,7 @@ func (a *ActivityLog) refreshFromStoredLog(ctx context.Context, wg *sync.WaitGro
 	a.fragmentLock.Lock()
 	defer a.fragmentLock.Unlock()
 
-	decreasingLogTimes, err := a.getMostRecentActivityLogSegment(ctx)
+	decreasingLogTimes, err := a.getMostRecentActivityLogSegment(ctx, now)
 	if err != nil {
 		return err
 	}
@@ -977,7 +1086,7 @@ func (a *ActivityLog) refreshFromStoredLog(ctx context.Context, wg *sync.WaitGro
 	return nil
 }
 
-// This version is used during construction
+// SetConfigInit is used during construction
 func (a *ActivityLog) SetConfigInit(config activityConfig) {
 	switch config.Enabled {
 	case "enable":
@@ -995,16 +1104,13 @@ func (a *ActivityLog) SetConfigInit(config activityConfig) {
 	a.defaultReportMonths = config.DefaultReportMonths
 	a.retentionMonths = config.RetentionMonths
 
-	if a.retentionMonths < a.configOverrides.MinimumRetentionMonths {
+	// Let tests override the minimum if they want to.
+	if a.configOverrides.MinimumRetentionMonths > 0 {
 		a.retentionMonths = a.configOverrides.MinimumRetentionMonths
 	}
-
-	if a.configOverrides.CensusReportInterval > 0 {
-		a.CensusReportInterval = a.configOverrides.CensusReportInterval
-	}
 }
 
-// This version reacts to user changes
+// SetConfig reacts to user changes
 func (a *ActivityLog) SetConfig(ctx context.Context, config activityConfig) {
 	a.l.Lock()
 	defer a.l.Unlock()
@@ -1096,15 +1202,15 @@ func (a *ActivityLog) queriesAvailable(ctx context.Context) (bool, error) {
 }
 
 // setupActivityLog hooks up the singleton ActivityLog into Core.
-func (c *Core) setupActivityLog(ctx context.Context, wg *sync.WaitGroup) error {
+func (c *Core) setupActivityLog(ctx context.Context, wg *sync.WaitGroup, reload bool) error {
 	c.activityLogLock.Lock()
 	defer c.activityLogLock.Unlock()
-	return c.setupActivityLogLocked(ctx, wg)
+	return c.setupActivityLogLocked(ctx, wg, reload)
 }
 
 // setupActivityLogLocked hooks up the singleton ActivityLog into Core.
 // this function should be called with activityLogLock.
-func (c *Core) setupActivityLogLocked(ctx context.Context, wg *sync.WaitGroup) error {
+func (c *Core) setupActivityLogLocked(ctx context.Context, wg *sync.WaitGroup, reload bool) error {
 	logger := c.baseLogger.Named("activity")
 	c.AddLogger(logger)
 
@@ -1144,11 +1250,22 @@ func (c *Core) setupActivityLogLocked(ctx context.Context, wg *sync.WaitGroup) e
 			go manager.activeFragmentWorker(ctx)
 		}
 
-		// Check for any intent log, in the background
+		doRegeneration := !reload && !manager.hasRegeneratedACME(ctx)
 		manager.computationWorkerDone = make(chan struct{})
+		// handle leftover intent logs and regenerating precomputed queries
+		// for ACME
 		go func() {
-			manager.precomputedQueryWorker(ctx)
-			close(manager.computationWorkerDone)
+			defer close(manager.computationWorkerDone)
+			if doRegeneration {
+				err := manager.regeneratePrecomputedQueries(ctx)
+				if err != nil {
+					manager.logger.Error("unable to regenerate ACME data", "error", err)
+				}
+			} else {
+				// run the precomputed query worker normally
+				// errors are logged within the function
+				manager.precomputedQueryWorker(ctx, nil)
+			}
 		}()
 
 		// Catch up on garbage collection
@@ -1159,13 +1276,203 @@ func (c *Core) setupActivityLogLocked(ctx context.Context, wg *sync.WaitGroup) e
 			close(manager.retentionDone)
 		}(manager.retentionMonths)
 
-		manager.CensusReportDone = make(chan bool, 1)
-		go c.activityLog.CensusReport(ctx, c.CensusAgent(), c.BillingStart())
+		// set up clientIDs in memory, this happens as part of post unseal
+		c.postUnsealFuncs = append(c.postUnsealFuncs, func() {
+			// errors are logged within the function
+			c.setupClientIDsUsageInfo(ctx)
+		})
 	}
 
 	return nil
 }
 
+// loadClientIDsToMemory loads all the clientIDs seen into a.clientIDsUsageInfo for a given start and end time
+func (a *ActivityLog) loadClientIDsToMemory(ctx context.Context, startTime, endTime time.Time) error {
+	if startTime.IsZero() || endTime.IsZero() {
+		// nothing to load
+		return nil
+	}
+	times, err := a.availableLogs(ctx, endTime)
+	if err != nil {
+		return fmt.Errorf("error fetching available logs: %w", err)
+	}
+
+	// Filter over just the months we care about
+	filteredList := make([]time.Time, 0, len(times))
+	for _, t := range times {
+		if timeutil.InRange(t, startTime, endTime) {
+			filteredList = append(filteredList, t)
+		}
+	}
+
+	if len(filteredList) == 0 {
+		a.logger.Info("no clientIDs to load to memory", "start_time", startTime, "end_time", endTime)
+		return nil
+	}
+
+	a.logger.Info("starting to load clientIDS to memory", "start_time", startTime, "end_time", endTime, "months_included", filteredList)
+
+	// For each month in the filtered list walk all the log segments
+	inMemClientIDsMap := make(map[string]struct{})
+
+	for _, startTime := range filteredList {
+		inMemClientIDsMap, err = a.getClientIDsForStartTime(ctx, inMemClientIDsMap, startTime)
+		if err != nil {
+			return err
+		}
+	}
+	a.logger.Info("finished loading segments to store client IDs in memory")
+
+	// add the new clients to the existing map in memory
+	clientIDsUsageInfo := a.GetClientIDsUsageInfo()
+	maps.Copy(clientIDsUsageInfo, inMemClientIDsMap)
+
+	// update in-memory map in activity log
+	a.SetClientIDsUsageInfo(clientIDsUsageInfo)
+	return nil
+}
+
+// getClientIDsForStartTime loads each of the entity segments for a particular start time and adds the clientIDs to a map
+func (a *ActivityLog) getClientIDsForStartTime(ctx context.Context, inMemoryClientIDs map[string]struct{}, startTime time.Time) (map[string]struct{}, error) {
+	basePath := activityEntityBasePath + fmt.Sprint(startTime.Unix()) + "/"
+	pathList, err := a.view.List(ctx, basePath)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, path := range pathList {
+		raw, err := a.view.Get(ctx, basePath+path)
+		if err != nil {
+			return nil, err
+		}
+		if raw == nil {
+			a.logger.Warn("expected log segment not found", "startTime", startTime, "segment", path)
+			continue
+		}
+
+		out := &activity.EntityActivityLog{}
+		err = proto.Unmarshal(raw.Value, out)
+		if err != nil {
+			return nil, fmt.Errorf("unable to parse segment %v%v: %w", basePath, path, err)
+		}
+
+		for _, e := range out.Clients {
+			inMemoryClientIDs[e.ClientID] = struct{}{}
+		}
+	}
+	return inMemoryClientIDs, nil
+}
+
+// getStartTimeAndEndTimeUntilLastMonth returns the start time and end time
+// if entireBillingPeriod is set to true, it returns the start time as the start of the current billing cycle and the end of the last month
+// if not, it returns the start of the last month and end of the last month
+func (a *ActivityLog) getStartTimeAndEndTimeUntilLastMonth(entireBillingPeriod bool) (time.Time, time.Time) {
+	currBillingPeriodStartTime := a.core.BillingStart()
+	now := a.clock.Now().UTC()
+
+	// if we are in the first month of the billing cycle, return empty values
+	if timeutil.IsCurrentMonth(currBillingPeriodStartTime, now) {
+		return time.Time{}, time.Time{}
+	}
+
+	// Normalize to start of current month to prevent end of month weirdness
+	startOfCurrMonth := timeutil.StartOfMonth(now)
+
+	// get start time and end time of the last month
+	startOfLastMonth := startOfCurrMonth.AddDate(0, -1, 0)
+	endOfLastMonth := timeutil.EndOfMonth(startOfLastMonth)
+
+	if entireBillingPeriod {
+		// startTime is the start of month of billing start time and endTime is the end of last month
+		return timeutil.StartOfMonth(currBillingPeriodStartTime), endOfLastMonth
+	}
+	return startOfLastMonth, endOfLastMonth
+}
+
+func (a *ActivityLog) hasRegeneratedACME(ctx context.Context) bool {
+	regenerated, err := a.view.Get(ctx, activityACMERegenerationKey)
+	if err != nil {
+		a.logger.Error("unable to access ACME regeneration key")
+		return false
+	}
+	return regenerated != nil
+}
+
+func (a *ActivityLog) writeRegeneratedACME(ctx context.Context) error {
+	regeneratedEntry, err := logical.StorageEntryJSON(activityACMERegenerationKey, true)
+	if err != nil {
+		return err
+	}
+	return a.view.Put(ctx, regeneratedEntry)
+}
+
+func (a *ActivityLog) regeneratePrecomputedQueries(ctx context.Context) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	a.l.RLock()
+	doneCh := a.doneCh
+	a.l.RUnlock()
+	go func() {
+		select {
+		case <-doneCh:
+			cancel()
+		case <-ctx.Done():
+			break
+		}
+	}()
+
+	intentLogEntry, err := a.view.Get(ctx, activityIntentLogKey)
+	if err != nil {
+		a.logger.Error("could not load existing intent log", "error", err)
+	}
+	var intentLog *ActivityIntentLog
+	if intentLogEntry == nil {
+		regenerationIntentLog, err := a.createRegenerationIntentLog(ctx, a.clock.Now().UTC())
+		if errors.Is(err, previousMonthNotFoundErr) {
+			// if there are no segments earlier than the current month, consider
+			// this a success
+			return a.writeRegeneratedACME(ctx)
+		}
+		if err != nil {
+			return err
+		}
+		intentLog = regenerationIntentLog
+		a.logger.Debug("regenerating precomputed queries", "previous month", time.Unix(intentLog.PreviousMonth, 0).UTC(), "next month", time.Unix(intentLog.NextMonth, 0).UTC())
+	}
+	err = a.precomputedQueryWorker(ctx, intentLog)
+	if err != nil && !errors.Is(err, previousMonthNotFoundErr) {
+		return err
+	}
+	return a.writeRegeneratedACME(ctx)
+}
+
+func (a *ActivityLog) createRegenerationIntentLog(ctx context.Context, now time.Time) (*ActivityIntentLog, error) {
+	intentLog := &ActivityIntentLog{}
+	segments, err := a.availableLogs(ctx, now)
+	if err != nil {
+		return nil, fmt.Errorf("error fetching available logs: %w", err)
+	}
+
+	for i, segment := range segments {
+		if timeutil.IsCurrentMonth(segment, now) {
+			continue
+		}
+
+		intentLog.PreviousMonth = segment.Unix()
+		if i > 0 {
+			intentLog.NextMonth = segments[i-1].Unix()
+		}
+		break
+	}
+
+	if intentLog.PreviousMonth == 0 {
+		return nil, previousMonthNotFoundErr
+	}
+
+	return intentLog, nil
+}
+
 // stopActivityLogLocked removes the ActivityLog from Core
 // and frees any resources.
 // this function should be called with activityLogLock
@@ -1407,7 +1714,14 @@ func (a *ActivityLog) HandleEndOfMonth(ctx context.Context, currentTime time.Tim
 	a.fragmentLock.Unlock()
 
 	// Work on precomputed queries in background
-	go a.precomputedQueryWorker(ctx)
+	go a.precomputedQueryWorker(ctx, nil)
+
+	// update the clientIDs in memory for the last month.
+	// if new billing cycle is detected, reset clientIDs in memory
+	a.handleClientIDsInMemoryEndOfMonth(ctx, currentTime)
+
+	// clean up clients from clientIDsUsageInfo map if they are ephemeral
+	a.cleanupEphemeralClients()
 
 	return nil
 }
@@ -1459,22 +1773,23 @@ func (c *Core) ResetActivityLog() []*activity.LogFragment {
 	return allFragments
 }
 
-func (a *ActivityLog) AddEntityToFragment(entityID string, namespaceID string, timestamp int64) {
-	a.AddClientToFragment(entityID, namespaceID, timestamp, false, "")
+// AddEntityToFragment adds an entity for frgament for testing purposes
+func (a *ActivityLog) AddEntityToFragment(entityID string, namespaceID string, timestamp int64, usageTime int64) {
+	a.AddClientToFragment(entityID, namespaceID, timestamp, false, "", usageTime)
 }
 
 // AddClientToFragment checks a client ID for uniqueness and
 // if not already present, adds it to the current fragment.
 //
 // See note below about AddActivityToFragment.
-func (a *ActivityLog) AddClientToFragment(clientID string, namespaceID string, timestamp int64, isTWE bool, mountAccessor string) {
+func (a *ActivityLog) AddClientToFragment(clientID string, namespaceID string, timestamp int64, isTWE bool, mountAccessor string, usageTime int64) {
 	// TWE == token without entity
 	if isTWE {
-		a.AddActivityToFragment(clientID, namespaceID, timestamp, nonEntityTokenActivityType, mountAccessor)
+		a.AddActivityToFragment(clientID, namespaceID, timestamp, nonEntityTokenActivityType, mountAccessor, usageTime)
 		return
 	}
 
-	a.AddActivityToFragment(clientID, namespaceID, timestamp, entityActivityType, mountAccessor)
+	a.AddActivityToFragment(clientID, namespaceID, timestamp, entityActivityType, mountAccessor, usageTime)
 }
 
 // AddActivityToFragment adds a client count event of any type to
@@ -1482,10 +1797,7 @@ func (a *ActivityLog) AddClientToFragment(clientID string, namespaceID string, t
 // all types; if not already present, we will add it to the current
 // fragment. The timestamp is a Unix timestamp *without* nanoseconds,
 // as that is what token.CreationTime uses.
-func (a *ActivityLog) AddActivityToFragment(clientID string, namespaceID string, timestamp int64, activityType string, mountAccessor string) {
-	if activityType == secretSyncActivityType && !a.core.HasFeature(FeatureSecretSyncBilling) {
-		return
-	}
+func (a *ActivityLog) AddActivityToFragment(clientID string, namespaceID string, timestamp int64, activityType string, mountAccessor string, usageTime int64) {
 	// Check whether entity ID already recorded
 	var present bool
 
@@ -1523,6 +1835,7 @@ func (a *ActivityLog) AddActivityToFragment(clientID string, namespaceID string,
 		Timestamp:     timestamp,
 		MountAccessor: mountAccessor,
 		ClientType:    activityType,
+		UsageTime:     usageTime,
 	}
 
 	// Track whether the clientID corresponds to a token without an entity or not.
@@ -1574,12 +1887,11 @@ func (a *ActivityLog) receivedFragment(fragment *activity.LogFragment) {
 }
 
 type ResponseCounts struct {
-	DistinctEntities int `json:"distinct_entities" mapstructure:"distinct_entities"`
 	EntityClients    int `json:"entity_clients" mapstructure:"entity_clients"`
-	NonEntityTokens  int `json:"non_entity_tokens" mapstructure:"non_entity_tokens"`
 	NonEntityClients int `json:"non_entity_clients" mapstructure:"non_entity_clients"`
 	Clients          int `json:"clients"`
 	SecretSyncs      int `json:"secret_syncs" mapstructure:"secret_syncs"`
+	ACMEClients      int `json:"acme_clients" mapstructure:"acme_clients"`
 }
 
 // Add adds the new record's counts to the existing record
@@ -1589,9 +1901,8 @@ func (r *ResponseCounts) Add(newRecord *ResponseCounts) {
 	}
 	r.EntityClients += newRecord.EntityClients
 	r.Clients += newRecord.Clients
-	r.DistinctEntities += newRecord.DistinctEntities
 	r.NonEntityClients += newRecord.NonEntityClients
-	r.NonEntityTokens += newRecord.NonEntityTokens
+	r.ACMEClients += newRecord.ACMEClients
 	r.SecretSyncs += newRecord.SecretSyncs
 }
 
@@ -1602,30 +1913,6 @@ type ResponseNamespace struct {
 	Mounts        []*ResponseMount `json:"mounts"`
 }
 
-// Add adds the namespace counts to the existing record, then either adds the
-// mount counts to the existing mount (if it exists) or appends the mount to the
-// list of mounts
-func (r *ResponseNamespace) Add(newRecord *ResponseNamespace) {
-	// Create a map of the existing mounts, so we don't duplicate them
-	mountMap := make(map[string]*ResponseCounts)
-	for _, erm := range r.Mounts {
-		mountMap[erm.MountPath] = erm.Counts
-	}
-
-	r.Counts.Add(&newRecord.Counts)
-
-	// Check the current month mounts against the existing mounts and if there are matches, update counts
-	// accordingly. If there is no match, append the new mount to the existing mounts, so it will be counted
-	// later.
-	for _, newRecordMount := range newRecord.Mounts {
-		if existingRecordMountCounts, ok := mountMap[newRecordMount.MountPath]; ok {
-			existingRecordMountCounts.Add(newRecordMount.Counts)
-		} else {
-			r.Mounts = append(r.Mounts, newRecordMount)
-		}
-	}
-}
-
 type ResponseMonth struct {
 	Timestamp  string               `json:"timestamp"`
 	Counts     *ResponseCounts      `json:"counts"`
@@ -1640,6 +1927,7 @@ type ResponseNewClients struct {
 
 type ResponseMount struct {
 	MountPath string          `json:"mount_path" mapstructure:"mount_path"`
+	MountType string          `json:"mount_type" mapstructure:"mount_type"`
 	Counts    *ResponseCounts `json:"counts"`
 }
 
@@ -1656,8 +1944,9 @@ func (c *Core) ActivityLogInjectResponse(ctx context.Context, pq *activity.Preco
 
 func (a *ActivityLog) includeInResponse(query *namespace.Namespace, record *namespace.Namespace) bool {
 	if record == nil {
-		// Deleted namespace, only include in root queries
-		return query.ID == namespace.RootNamespaceID
+		// Deleted namespace, only include in root or admin namespace (if configured) queries
+		adminNsPath := namespace.Canonicalize(a.core.administrativeNamespacePath())
+		return query.ID == namespace.RootNamespaceID || (adminNsPath != "" && query.Path == adminNsPath)
 	}
 	return record.HasParent(query)
 }
@@ -1673,101 +1962,22 @@ func (a *ActivityLog) DefaultStartTime(endTime time.Time) time.Time {
 }
 
 func (a *ActivityLog) handleQuery(ctx context.Context, startTime, endTime time.Time, limitNamespaces int) (map[string]interface{}, error) {
-	var computePartial bool
-
-	// Change the start time to the beginning of the month, and the end time to be the end
-	// of the month.
+	// Normalize the start time to the beginning of the month, and the end time to be the end of the month.
 	startTime = timeutil.StartOfMonth(startTime)
 	endTime = timeutil.EndOfMonth(endTime)
 
-	// If the endTime of the query is the current month, request data from the queryStore
-	// with the endTime equal to the end of the last month, and add in the current month
-	// data.
-	precomputedQueryEndTime := endTime
-	if timeutil.IsCurrentMonth(endTime, a.clock.Now().UTC()) {
-		precomputedQueryEndTime = timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, timeutil.StartOfMonth(endTime)))
-		computePartial = true
-	}
-
-	pq := &activity.PrecomputedQuery{}
-	if startTime.After(precomputedQueryEndTime) && timeutil.IsCurrentMonth(startTime, a.clock.Now().UTC()) {
-		// We're only calculating the partial month client count. Skip the precomputation
-		// get call.
-		pq = &activity.PrecomputedQuery{
-			StartTime:  startTime,
-			EndTime:    endTime,
-			Namespaces: make([]*activity.NamespaceRecord, 0),
-			Months:     make([]*activity.MonthRecord, 0),
-		}
-	} else {
-		storedQuery, err := a.queryStore.Get(ctx, startTime, precomputedQueryEndTime)
-		if err != nil {
-			return nil, err
-		}
-		if storedQuery == nil {
-			// If the storedQuery is nil, that means there's no historical data to process. But, it's possible there's
-			// still current month data to process, so rather than returning a 204, let's proceed along like we're
-			// just querying the current month.
-			storedQuery = &activity.PrecomputedQuery{
-				StartTime:  startTime,
-				EndTime:    endTime,
-				Namespaces: make([]*activity.NamespaceRecord, 0),
-				Months:     make([]*activity.MonthRecord, 0),
-			}
-		}
-		pq = storedQuery
+	// Compute the total clients in the billing period, and get the breakdown by namespace.
+	pq, err := a.computeClientsInBillingPeriod(ctx, startTime, endTime)
+	if err != nil {
+		return nil, err
 	}
 
-	// Calculate the namespace response breakdowns and totals for entities and tokens from the initial
-	// namespace data.
+	// Convert the namespace data into a protobuf format that can be returned in the response
 	totalCounts, byNamespaceResponse, err := a.calculateByNamespaceResponseForQuery(ctx, pq.Namespaces)
 	if err != nil {
 		return nil, err
 	}
 
-	// If we need to add the current month's client counts into the total, compute the namespace
-	// breakdown for the current month as well.
-	var partialByMonth map[int64]*processMonth
-	var partialByNamespace map[string]*processByNamespace
-	var byNamespaceResponseCurrent []*ResponseNamespace
-	var totalCurrentCounts *ResponseCounts
-	if computePartial {
-		// Traverse through current month's activitylog data and group clients
-		// into months and namespaces
-		a.fragmentLock.RLock()
-		partialByMonth, partialByNamespace = a.populateNamespaceAndMonthlyBreakdowns()
-		a.fragmentLock.RUnlock()
-
-		// Convert the byNamespace breakdowns into structs that are
-		// consumable by the /activity endpoint, so as to reuse code between these two
-		// endpoints.
-		byNamespaceComputation := a.transformALNamespaceBreakdowns(partialByNamespace)
-
-		// Calculate the namespace response breakdowns and totals for entities
-		// and tokens from current month namespace data.
-		totalCurrentCounts, byNamespaceResponseCurrent, err = a.calculateByNamespaceResponseForQuery(ctx, byNamespaceComputation)
-		if err != nil {
-			return nil, err
-		}
-
-		// Create a mapping of namespace id to slice index, so that we can efficiently update our results without
-		// having to traverse the entire namespace response slice every time.
-		nsrMap := make(map[string]int)
-		for i, nr := range byNamespaceResponse {
-			nsrMap[nr.NamespaceID] = i
-		}
-
-		// Rather than blindly appending, which will create duplicates, check our existing counts against the current
-		// month counts, and append or update as necessary. We also want to account for mounts and their counts.
-		for _, nrc := range byNamespaceResponseCurrent {
-			if ndx, ok := nsrMap[nrc.NamespaceID]; ok {
-				byNamespaceResponse[ndx].Add(nrc)
-			} else {
-				byNamespaceResponse = append(byNamespaceResponse, nrc)
-			}
-		}
-	}
-
 	// Sort clients within each namespace
 	a.sortALResponseNamespaces(byNamespaceResponse)
 
@@ -1775,52 +1985,18 @@ func (a *ActivityLog) handleQuery(ctx context.Context, startTime, endTime time.T
 		totalCounts, byNamespaceResponse = a.limitNamespacesInALResponse(byNamespaceResponse, limitNamespaces)
 	}
 
-	distinctEntitiesResponse := totalCounts.EntityClients
-	if computePartial {
-		currentMonth, err := a.computeCurrentMonthForBillingPeriod(ctx, partialByMonth, startTime, endTime)
-		if err != nil {
-			return nil, err
-		}
-
-		// Add the namespace attribution for the current month to the newly computed current month value. Note
-		// that transformMonthBreakdowns calculates a superstruct of the required namespace struct due to its
-		// primary use-case being for precomputedQueryWorker, but we will reuse this code for brevity and extract
-		// the namespaces from it.
-		currentMonthNamespaceAttribution := a.transformMonthBreakdowns(partialByMonth)
-
-		// Ensure that there is only one element in this list -- if not, warn.
-		if len(currentMonthNamespaceAttribution) > 1 {
-			a.logger.Warn("more than one month worth of namespace and mount attribution calculated for "+
-				"current month values", "number of months", len(currentMonthNamespaceAttribution))
-		}
-		if len(currentMonthNamespaceAttribution) == 0 {
-			a.logger.Warn("no month data found, returning query with no namespace attribution for current month")
-		} else {
-			currentMonth.Namespaces = currentMonthNamespaceAttribution[0].Namespaces
-			currentMonth.NewClients.Namespaces = currentMonthNamespaceAttribution[0].NewClients.Namespaces
-		}
-		pq.Months = append(pq.Months, currentMonth)
-		distinctEntitiesResponse += pq.Months[len(pq.Months)-1].NewClients.Counts.EntityClients
-	}
-
 	// Now populate the response based on breakdowns.
 	responseData := make(map[string]interface{})
-	responseData["start_time"] = pq.StartTime.Format(time.RFC3339)
+	responseData["start_time"] = startTime.Format(time.RFC3339)
 
 	// If we computed partial counts, we should return the actual end time we computed counts for, not the pre-computed
 	// query end time. If we don't do this, the end_time in the response doesn't match the actual data in the response,
 	// which is confusing. Note that regardless of what end time is given, if it falls within the current month, it will
 	// be set to the end of the current month. This is definitely suboptimal, and possibly confusing, but still an
 	// improvement over using the pre-computed query end time.
-	if computePartial {
-		responseData["end_time"] = endTime.Format(time.RFC3339)
-	} else {
-		responseData["end_time"] = pq.EndTime.Format(time.RFC3339)
-	}
+	responseData["end_time"] = endTime.Format(time.RFC3339)
 
 	responseData["by_namespace"] = byNamespaceResponse
-	totalCounts.Add(totalCurrentCounts)
-	totalCounts.DistinctEntities = distinctEntitiesResponse
 	responseData["total"] = totalCounts
 
 	// Create and populate the month response structs based on the monthly breakdown.
@@ -1881,6 +2057,7 @@ func (a *ActivityLog) modifyResponseMonths(months []*ResponseMonth, start time.T
 type activityConfig struct {
 	// DefaultReportMonths are the default number of months that are returned on
 	// a report. The zero value uses the system default of 12.
+	// Deprecated: This field was removed in favor of using different default startTime and endTime values
 	DefaultReportMonths int `json:"default_report_months"`
 
 	// RetentionMonths defines the number of months we want to retain data. The
@@ -1889,14 +2066,12 @@ type activityConfig struct {
 
 	// Enabled is one of enable, disable, default.
 	Enabled string `json:"enabled"`
-
-	CensusReportInterval time.Duration `json:"census_report_interval"`
 }
 
 func defaultActivityConfig() activityConfig {
 	return activityConfig{
 		DefaultReportMonths: 12,
-		RetentionMonths:     24,
+		RetentionMonths:     ActivityLogMinimumRetentionMonths,
 		Enabled:             "default",
 	}
 }
@@ -1915,10 +2090,29 @@ func (a *ActivityLog) loadConfigOrDefault(ctx context.Context) (activityConfig,
 	if err := configRaw.DecodeJSON(&config); err != nil {
 		return config, err
 	}
-
 	return config, nil
 }
 
+// setDefaultRetentionMonthsInConfig sets the retention months in activity config with default value.
+// This supports upgrades from versions prior to set the new default ActivityLogMinimumRetentionMonths.
+func (a *ActivityLog) setDefaultRetentionMonthsInConfig(ctx context.Context, inputConfig activityConfig) (activityConfig, error) {
+	if a.core.perfStandby {
+		return inputConfig, nil
+	}
+
+	inputConfig.RetentionMonths = ActivityLogMinimumRetentionMonths
+
+	// Store the config
+	entry, err := logical.StorageEntryJSON(activityConfigKey, inputConfig)
+	if err != nil {
+		return inputConfig, err
+	}
+	if err := a.view.Put(ctx, entry); err != nil {
+		return inputConfig, err
+	}
+	return inputConfig, nil
+}
+
 // HandleTokenUsage adds the TokenEntry to the current fragment of the activity log
 // This currently occurs on token usage only.
 func (a *ActivityLog) HandleTokenUsage(ctx context.Context, entry *logical.TokenEntry, clientID string, isTWE bool) error {
@@ -1963,7 +2157,7 @@ func (a *ActivityLog) HandleTokenUsage(ctx context.Context, entry *logical.Token
 	}
 
 	// Parse an entry's client ID and add it to the activity log
-	a.AddClientToFragment(clientID, entry.NamespaceID, entry.CreationTime, isTWE, mountAccessor)
+	a.AddClientToFragment(clientID, entry.NamespaceID, entry.CreationTime, isTWE, mountAccessor, time.Now().Unix())
 	return nil
 }
 
@@ -2042,6 +2236,7 @@ func (p *processCounts) toCountsRecord() *activity.CountsRecord {
 	return &activity.CountsRecord{
 		EntityClients:    p.countByType(entityActivityType),
 		NonEntityClients: p.countByType(nonEntityTokenActivityType),
+		ACMEClients:      p.countByType(ACMEActivityType),
 		SecretSyncs:      p.countByType(secretSyncActivityType),
 	}
 }
@@ -2052,7 +2247,7 @@ func (p *processCounts) toCountsRecord() *activity.CountsRecord {
 func (p *processCounts) countByType(typ string) int {
 	switch typ {
 	case nonEntityTokenActivityType:
-		return len(p.ClientsByType[nonEntityTokenActivityType]) + int(p.Tokens) + len(p.ClientsByType[ACMEActivityType])
+		return len(p.ClientsByType[nonEntityTokenActivityType]) + int(p.Tokens)
 	}
 	return len(p.ClientsByType[typ])
 }
@@ -2060,17 +2255,6 @@ func (p *processCounts) countByType(typ string) int {
 // clientsByType returns the set of client IDs with the given type.
 // ACME clients are included in the non entity results
 func (p *processCounts) clientsByType(typ string) clientIDSet {
-	switch typ {
-	case nonEntityTokenActivityType:
-		clients := make(clientIDSet)
-		for c := range p.ClientsByType[nonEntityTokenActivityType] {
-			clients[c] = struct{}{}
-		}
-		for c := range p.ClientsByType[ACMEActivityType] {
-			clients[c] = struct{}{}
-		}
-		return clients
-	}
 	return p.ClientsByType[typ]
 }
 
@@ -2198,16 +2382,15 @@ func processClientRecord(e *activity.EntityRecord, byNamespace summaryByNamespac
 }
 
 // handleEntitySegment processes the record and adds it to the correct month/
-// namespace breakdown maps, as well as to the hyperloglog for the month. New
+// namespace breakdown maps for the month. New
 // clients are deduplicated in opts.byMonth so that clients will only appear in
 // the first month in which they are seen.
 // This method must be called in reverse chronological order of the months (with
 // the most recent month being called before previous months)
-func (a *ActivityLog) handleEntitySegment(l *activity.EntityActivityLog, segmentTime time.Time, hll *hyperloglog.Sketch, opts pqOptions) error {
+func (a *ActivityLog) handleEntitySegment(l *activity.EntityActivityLog, segmentTime time.Time, opts pqOptions) error {
 	for _, e := range l.Clients {
 
 		processClientRecord(e, opts.byNamespace, opts.byMonth, segmentTime)
-		hll.Insert([]byte(e.ClientID))
 
 		// step forward in time through the months to check if the client is
 		// present. If it is, delete it. This is because the client should only
@@ -2247,7 +2430,6 @@ func (a *ActivityLog) writePrecomputedQuery(ctx context.Context, segmentTime tim
 
 	// the byNamespace map also needs to be transformed into a protobuf
 	pq.Namespaces = a.transformALNamespaceBreakdowns(opts.byNamespace)
-
 	err := a.queryStore.Put(ctx, pq)
 	if err != nil {
 		a.logger.Warn("failed to store precomputed query", "error", err)
@@ -2273,14 +2455,7 @@ type pqOptions struct {
 
 // segmentToPrecomputedQuery processes a single segment
 func (a *ActivityLog) segmentToPrecomputedQuery(ctx context.Context, segmentTime time.Time, reader SegmentReader, opts pqOptions) error {
-	hyperloglog, err := a.CreateOrFetchHyperlogLog(ctx, segmentTime)
-	if err != nil {
-		// We were unable to create or fetch the hll, but we should still
-		// continue with our precomputation
-		a.logger.Warn("unable to create or fetch hyperloglog", "start time", segmentTime, "error", err)
-	}
-
-	// Iterate through entities, adding them to the hyperloglog and the summary maps in opts
+	// Iterate through entities, adding them to the summary maps in opts
 	for {
 		entity, err := reader.ReadEntity(ctx)
 		if errors.Is(err, io.EOF) {
@@ -2290,19 +2465,13 @@ func (a *ActivityLog) segmentToPrecomputedQuery(ctx context.Context, segmentTime
 			a.logger.Warn("failed to read segment", "error", err)
 			return err
 		}
-		err = a.handleEntitySegment(entity, segmentTime, hyperloglog, opts)
+		err = a.handleEntitySegment(entity, segmentTime, opts)
 		if err != nil {
 			a.logger.Warn("failed to handle entity segment", "error", err)
 			return err
 		}
 	}
 
-	// Store the hyperloglog
-	err = a.StoreHyperlogLog(ctx, segmentTime, hyperloglog)
-	if err != nil {
-		a.logger.Warn("failed to store hyperloglog for month", "start time", segmentTime, "error", err)
-	}
-
 	// Iterate through any tokens and add them to per namespace map
 	for {
 		token, err := reader.ReadToken(ctx)
@@ -2316,11 +2485,27 @@ func (a *ActivityLog) segmentToPrecomputedQuery(ctx context.Context, segmentTime
 		a.breakdownTokenSegment(token, opts.byNamespace)
 	}
 
-	// write metrics
+	// handle metrics reporting
+	a.reportPrecomputedQueryMetrics(ctx, segmentTime, opts)
+
+	// convert the maps to the proper format and write them as precomputed queries
+	return a.writePrecomputedQuery(ctx, segmentTime, opts)
+}
+
+func (a *ActivityLog) reportPrecomputedQueryMetrics(ctx context.Context, segmentTime time.Time, opts pqOptions) {
+	if segmentTime != opts.activePeriodEnd && segmentTime != opts.activePeriodStart {
+		return
+	}
+	// we don't want to introduce any new namespaced metrics. For secret sync
+	// (and all newer client types) we'll instead keep maps of the total
+	summedMetricsMonthly := make(map[string]int)
+	summedMetricsReporting := make(map[string]int)
+
 	for nsID, entry := range opts.byNamespace {
 		// If this is the most recent month, or the start of the reporting period, output
 		// a metric for each namespace.
-		if segmentTime == opts.activePeriodEnd {
+		switch segmentTime {
+		case opts.activePeriodEnd:
 			a.metrics.SetGaugeWithLabels(
 				[]string{"identity", "entity", "active", "monthly"},
 				float32(entry.Counts.countByType(entityActivityType)),
@@ -2335,7 +2520,9 @@ func (a *ActivityLog) segmentToPrecomputedQuery(ctx context.Context, segmentTime
 					{Name: "namespace", Value: a.namespaceToLabel(ctx, nsID)},
 				},
 			)
-		} else if segmentTime == opts.activePeriodStart {
+			summedMetricsMonthly[secretSyncActivityType] += entry.Counts.countByType(secretSyncActivityType)
+			summedMetricsMonthly[ACMEActivityType] += entry.Counts.countByType(ACMEActivityType)
+		case opts.activePeriodStart:
 			a.metrics.SetGaugeWithLabels(
 				[]string{"identity", "entity", "active", "reporting_period"},
 				float32(entry.Counts.countByType(entityActivityType)),
@@ -2350,17 +2537,27 @@ func (a *ActivityLog) segmentToPrecomputedQuery(ctx context.Context, segmentTime
 					{Name: "namespace", Value: a.namespaceToLabel(ctx, nsID)},
 				},
 			)
+			summedMetricsReporting[secretSyncActivityType] += entry.Counts.countByType(secretSyncActivityType)
+			summedMetricsReporting[ACMEActivityType] += entry.Counts.countByType(ACMEActivityType)
 		}
 	}
 
-	// convert the maps to the proper format and write them as precomputed queries
-	return a.writePrecomputedQuery(ctx, segmentTime, opts)
+	for ct, count := range summedMetricsMonthly {
+		a.metrics.SetGauge([]string{"identity", strings.ReplaceAll(ct, "-", "_"), "active", "monthly"}, float32(count))
+	}
+	for ct, count := range summedMetricsReporting {
+		a.metrics.SetGauge([]string{"identity", strings.ReplaceAll(ct, "-", "_"), "active", "reporting_period"}, float32(count))
+	}
 }
 
+var previousMonthNotFoundErr = errors.New("previous month not found")
+
 // goroutine to process the request in the intent log, creating precomputed queries.
 // We expect the return value won't be checked, so log errors as they occur
 // (but for unit testing having the error return should help.)
-func (a *ActivityLog) precomputedQueryWorker(ctx context.Context) error {
+// If the intent log that's passed into the function is non-nil, we use that
+// intent log. Otherwise, we read the intent log from storage
+func (a *ActivityLog) precomputedQueryWorker(ctx context.Context, intent *ActivityIntentLog) (err error) {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
@@ -2381,21 +2578,39 @@ func (a *ActivityLog) precomputedQueryWorker(ctx context.Context) error {
 	}(a.doneCh)
 	a.l.RUnlock()
 
-	// Load the intent log
-	rawIntentLog, err := a.view.Get(ctx, activityIntentLogKey)
-	if err != nil {
-		a.logger.Warn("could not load intent log", "error", err)
-		return err
-	}
-	if rawIntentLog == nil {
-		a.logger.Trace("no intent log found")
-		return err
+	strictEnforcement := intent == nil
+	shouldCleanupIntentLog := false
+	if intent == nil {
+
+		// Load the intent log
+		rawIntentLog, err := a.view.Get(ctx, activityIntentLogKey)
+		if err != nil {
+			a.logger.Warn("could not load intent log", "error", err)
+			return err
+		}
+		if rawIntentLog == nil {
+			a.logger.Trace("no intent log found")
+			return err
+		}
+		intent = new(ActivityIntentLog)
+		err = json.Unmarshal(rawIntentLog.Value, intent)
+		if err != nil {
+			a.logger.Warn("could not parse intent log", "error", err)
+			return err
+		}
+		shouldCleanupIntentLog = true
 	}
-	var intent ActivityIntentLog
-	err = json.Unmarshal(rawIntentLog.Value, &intent)
-	if err != nil {
-		a.logger.Warn("could not parse intent log", "error", err)
-		return err
+
+	cleanupIntentLog := func() {
+		if !shouldCleanupIntentLog {
+			return
+		}
+		// delete the intent log
+		// this should happen if the precomputed queries were generated
+		// successfully (i.e. err is nil) or if there's no data for the previous
+		// month.
+		// It should not happen in the general error case
+		a.view.Delete(ctx, activityIntentLogKey)
 	}
 
 	// currentMonth could change (from another month end) after we release the lock.
@@ -2408,29 +2623,30 @@ func (a *ActivityLog) precomputedQueryWorker(ctx context.Context) error {
 	// would work but this will be easier to control in tests.
 	retentionWindow := timeutil.MonthsPreviousTo(a.retentionMonths, time.Unix(intent.NextMonth, 0).UTC())
 	a.l.RUnlock()
-	if currentMonth != 0 && intent.NextMonth != currentMonth {
+	if strictEnforcement && currentMonth != 0 && intent.NextMonth != currentMonth {
 		a.logger.Warn("intent log does not match current segment",
 			"intent", intent.NextMonth, "current", currentMonth)
 		return errors.New("intent log is too far in the past")
 	}
 
 	lastMonth := intent.PreviousMonth
-	a.logger.Info("computing queries", "month", time.Unix(lastMonth, 0).UTC())
+	lastMonthTime := time.Unix(lastMonth, 0).UTC()
+	a.logger.Info("computing queries", "month", lastMonthTime)
 
-	times, err := a.availableLogs(ctx)
+	times, err := a.availableLogs(ctx, lastMonthTime)
 	if err != nil {
 		a.logger.Warn("could not list available logs", "error", err)
 		return err
 	}
 	if len(times) == 0 {
 		a.logger.Warn("no months in storage")
-		a.view.Delete(ctx, activityIntentLogKey)
-		return errors.New("previous month not found")
+		cleanupIntentLog()
+		return previousMonthNotFoundErr
 	}
 	if times[0].Unix() != lastMonth {
 		a.logger.Warn("last month not in storage", "latest", times[0].Unix())
-		a.view.Delete(ctx, activityIntentLogKey)
-		return errors.New("previous month not found")
+		cleanupIntentLog()
+		return previousMonthNotFoundErr
 	}
 
 	byNamespace := make(map[string]*processByNamespace)
@@ -2454,7 +2670,7 @@ func (a *ActivityLog) precomputedQueryWorker(ctx context.Context) error {
 	for _, startTime := range times {
 		// Do not work back further than the current retention window,
 		// which will just get deleted anyway.
-		if startTime.Before(retentionWindow) {
+		if startTime.Before(retentionWindow) && strictEnforcement {
 			break
 		}
 		reader, err := a.NewSegmentFileReader(ctx, startTime)
@@ -2466,9 +2682,7 @@ func (a *ActivityLog) precomputedQueryWorker(ctx context.Context) error {
 			return err
 		}
 	}
-
-	// delete the intent log
-	a.view.Delete(ctx, activityIntentLogKey)
+	cleanupIntentLog()
 
 	a.logger.Info("finished computing queries", "month", endTime)
 
@@ -2508,7 +2722,7 @@ func (a *ActivityLog) retentionWorker(ctx context.Context, currentTime time.Time
 	// everything >= the threshold is OK
 	retentionThreshold := timeutil.MonthsPreviousTo(retentionMonths, currentTime)
 
-	available, err := a.availableLogs(ctx)
+	available, err := a.availableLogs(ctx, retentionThreshold)
 	if err != nil {
 		a.logger.Warn("could not list segments", "error", err)
 		return err
@@ -2630,12 +2844,20 @@ func (a *ActivityLog) calculateByNamespaceResponseForQuery(ctx context.Context,
 		if err != nil {
 			return nil, nil, err
 		}
+		var displayPath string
+		if ns == nil {
+			displayPath = fmt.Sprintf(DeletedNamespaceFmt, nsRecord.NamespaceID)
+		} else {
+			displayPath = ns.Path
+		}
 		if a.includeInResponse(queryNS, ns) {
 			mountResponse := make([]*ResponseMount, 0, len(nsRecord.Mounts))
 			for _, mountRecord := range nsRecord.Mounts {
+				mountType := a.mountPathToMountType(ctx, strings.Join([]string{namespace.Canonicalize(displayPath), mountRecord.MountPath}, ""))
 				mountResponse = append(mountResponse, &ResponseMount{
 					MountPath: mountRecord.MountPath,
-					Counts:    a.countsRecordToCountsResponse(mountRecord.Counts, true),
+					MountType: mountType,
+					Counts:    a.countsRecordToCountsResponse(mountRecord.Counts),
 				})
 			}
 			// Sort the mounts in descending order of usage
@@ -2643,12 +2865,6 @@ func (a *ActivityLog) calculateByNamespaceResponseForQuery(ctx context.Context,
 				return mountResponse[i].Counts.Clients > mountResponse[j].Counts.Clients
 			})
 
-			var displayPath string
-			if ns == nil {
-				displayPath = fmt.Sprintf("deleted namespace %q", nsRecord.NamespaceID)
-			} else {
-				displayPath = ns.Path
-			}
 			nsCounts := a.namespaceRecordToCountsResponse(nsRecord)
 			byNamespaceResponse = append(byNamespaceResponse, &ResponseNamespace{
 				NamespaceID:   nsRecord.NamespaceID,
@@ -2667,11 +2883,11 @@ func (a *ActivityLog) prepareMonthsResponseForQuery(ctx context.Context, byMonth
 	for _, monthsRecord := range byMonth {
 		newClientsResponse := &ResponseNewClients{}
 		if monthsRecord.NewClients.Counts.HasCounts() {
-			newClientsNSResponse, err := a.prepareNamespaceResponse(ctx, monthsRecord.NewClients.Namespaces)
+			newClientsTotal, newClientsNSResponse, err := a.prepareNamespaceResponse(ctx, monthsRecord.NewClients.Namespaces)
 			if err != nil {
 				return nil, err
 			}
-			newClientsResponse.Counts = a.countsRecordToCountsResponse(monthsRecord.NewClients.Counts, false)
+			newClientsResponse.Counts = newClientsTotal
 			newClientsResponse.Namespaces = newClientsNSResponse
 		}
 
@@ -2679,11 +2895,11 @@ func (a *ActivityLog) prepareMonthsResponseForQuery(ctx context.Context, byMonth
 			Timestamp: time.Unix(monthsRecord.Timestamp, 0).UTC().Format(time.RFC3339),
 		}
 		if monthsRecord.Counts.HasCounts() {
-			nsResponse, err := a.prepareNamespaceResponse(ctx, monthsRecord.Namespaces)
+			monthTotal, nsResponse, err := a.prepareNamespaceResponse(ctx, monthsRecord.Namespaces)
 			if err != nil {
 				return nil, err
 			}
-			monthResponse.Counts = a.countsRecordToCountsResponse(monthsRecord.Counts, false)
+			monthResponse.Counts = monthTotal
 			monthResponse.Namespaces = nsResponse
 			monthResponse.NewClients = newClientsResponse
 			months = append(months, monthResponse)
@@ -2692,14 +2908,16 @@ func (a *ActivityLog) prepareMonthsResponseForQuery(ctx context.Context, byMonth
 	return months, nil
 }
 
-// prepareNamespaceResponse populates the namespace portion of the activity log response struct
-// from
-func (a *ActivityLog) prepareNamespaceResponse(ctx context.Context, nsRecords []*activity.MonthlyNamespaceRecord) ([]*ResponseNamespace, error) {
+// prepareNamespaceResponse takes monthly namespace records and converts them
+// into the response namespace format. The function also returns counts for the
+// total number of clients per type seen that month.
+func (a *ActivityLog) prepareNamespaceResponse(ctx context.Context, nsRecords []*activity.MonthlyNamespaceRecord) (*ResponseCounts, []*ResponseNamespace, error) {
 	queryNS, err := namespace.FromContext(ctx)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
-	nsResponse := make([]*ResponseNamespace, 0, len(nsRecords))
+	totalCounts := &ResponseCounts{}
+	nsResponses := make([]*ResponseNamespace, 0, len(nsRecords))
 	for _, nsRecord := range nsRecords {
 		if !nsRecord.Counts.HasCounts() {
 			continue
@@ -2707,36 +2925,42 @@ func (a *ActivityLog) prepareNamespaceResponse(ctx context.Context, nsRecords []
 
 		ns, err := NamespaceByID(ctx, nsRecord.NamespaceID, a.core)
 		if err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 		if a.includeInResponse(queryNS, ns) {
 			mountResponse := make([]*ResponseMount, 0, len(nsRecord.Mounts))
+			var displayPath string
+			if ns == nil {
+				displayPath = fmt.Sprintf(DeletedNamespaceFmt, nsRecord.NamespaceID)
+			} else {
+				displayPath = ns.Path
+			}
+
 			for _, mountRecord := range nsRecord.Mounts {
 				if !mountRecord.Counts.HasCounts() {
 					continue
 				}
 
+				mountType := a.mountPathToMountType(ctx, strings.Join([]string{namespace.Canonicalize(displayPath), mountRecord.MountPath}, ""))
 				mountResponse = append(mountResponse, &ResponseMount{
 					MountPath: mountRecord.MountPath,
-					Counts:    a.countsRecordToCountsResponse(mountRecord.Counts, false),
+					MountType: mountType,
+					Counts:    a.countsRecordToCountsResponse(mountRecord.Counts),
 				})
 			}
 
-			var displayPath string
-			if ns == nil {
-				displayPath = fmt.Sprintf("deleted namespace %q", nsRecord.NamespaceID)
-			} else {
-				displayPath = ns.Path
-			}
-			nsResponse = append(nsResponse, &ResponseNamespace{
+			nsResponse := &ResponseNamespace{
 				NamespaceID:   nsRecord.NamespaceID,
 				NamespacePath: displayPath,
-				Counts:        *a.countsRecordToCountsResponse(nsRecord.Counts, false),
+				Counts:        *a.countsRecordToCountsResponse(nsRecord.Counts),
 				Mounts:        mountResponse,
-			})
+			}
+			nsResponses = append(nsResponses, nsResponse)
+
+			totalCounts.Add(&nsResponse.Counts)
 		}
 	}
-	return nsResponse, nil
+	return totalCounts, nsResponses, nil
 }
 
 // partialMonthClientCount returns the number of clients used so far this month.
@@ -2772,12 +2996,11 @@ func (a *ActivityLog) partialMonthClientCount(ctx context.Context) (map[string]i
 	// Now populate the response based on breakdowns.
 	responseData := make(map[string]interface{})
 	responseData["by_namespace"] = byNamespaceResponse
-	responseData["distinct_entities"] = totalCounts.EntityClients
 	responseData["entity_clients"] = totalCounts.EntityClients
-	responseData["non_entity_tokens"] = totalCounts.NonEntityClients
 	responseData["non_entity_clients"] = totalCounts.NonEntityClients
 	responseData["clients"] = totalCounts.Clients
 	responseData["secret_syncs"] = totalCounts.SecretSyncs
+	responseData["acme_clients"] = totalCounts.ACMEClients
 
 	// The partialMonthClientCount should not have more than one month worth of data.
 	// If it does, something has gone wrong and we should warn that the activity log data
@@ -2810,17 +3033,21 @@ func (a *ActivityLog) partialMonthClientCount(ctx context.Context) (map[string]i
 }
 
 func (a *ActivityLog) writeExport(ctx context.Context, rw http.ResponseWriter, format string, startTime, endTime time.Time) error {
-	// For capacity reasons only allow a single in-process export at a time.
-	// TODO do we really need to do this?
+	// Only allow a single in-process export at a time as they can be resource-intensive
 	if !a.inprocessExport.CAS(false, true) {
-		return fmt.Errorf("existing export in progress")
+		return ErrActivityExportInProgress
 	}
 	defer a.inprocessExport.Store(false)
 
+	// Normalize the start time to the beginning of the month to keep consistency with the sys/counters API
+	// Without this, if the start time falls within the same month as the billing start date, the Export API
+	// could omit data that the sys/counters API includes, leading to discrepancies
+	startTime = timeutil.StartOfMonth(startTime)
+
 	// Find the months with activity log data that are between the start and end
 	// months. We want to walk this in cronological order so the oldest instance of a
 	// client usage is recorded, not the most recent.
-	times, err := a.availableLogs(ctx)
+	times, err := a.availableLogs(ctx, endTime)
 	if err != nil {
 		a.logger.Warn("failed to list available log segments", "error", err)
 		return fmt.Errorf("failed to list available log segments: %w", err)
@@ -2840,7 +3067,7 @@ func (a *ActivityLog) writeExport(ctx context.Context, rw http.ResponseWriter, f
 	}
 	if len(filteredList) == 0 {
 		a.logger.Info("no data to export", "start_time", startTime, "end_time", endTime)
-		return fmt.Errorf("no data to export in provided time range")
+		return nil
 	}
 
 	actualStartTime := filteredList[len(filteredList)-1]
@@ -2849,14 +3076,16 @@ func (a *ActivityLog) writeExport(ctx context.Context, rw http.ResponseWriter, f
 	// Add headers here because we start to immediately write in the csv encoder
 	// constructor.
 	rw.Header().Add("Content-Disposition", fmt.Sprintf("attachment; filename=\"activity_export_%d_to_%d.%s\"", actualStartTime.Unix(), endTime.Unix(), format))
-	rw.Header().Add("Content-Type", fmt.Sprintf("application/%s", format))
 
 	var encoder encoder
 	switch format {
 	case "json":
+		rw.Header().Add("Content-Type", fmt.Sprintf("application/json"))
 		encoder = newJSONEncoder(rw)
 	case "csv":
 		var err error
+		rw.Header().Add("Content-Type", fmt.Sprintf("text/csv"))
+
 		encoder, err = newCSVEncoder(rw)
 		if err != nil {
 			return fmt.Errorf("failed to create csv encoder: %w", err)
@@ -2867,31 +3096,273 @@ func (a *ActivityLog) writeExport(ctx context.Context, rw http.ResponseWriter, f
 
 	a.logger.Info("starting activity log export", "start_time", startTime, "end_time", endTime, "format", format)
 
-	dedupedIds := make(map[string]struct{})
+	dedupIDs := make(map[string]struct{})
+	reqNS, err := namespace.FromContext(ctx)
+	if err != nil {
+		return err
+	}
 
-	walkEntities := func(l *activity.EntityActivityLog, startTime time.Time, hll *hyperloglog.Sketch) error {
+	// an LRU cache is used to optimistically prevent frequent
+	// lookup of common identity backends
+	identityBackendCache, err := lru.New2Q(10)
+	if err != nil {
+		return err
+	}
+
+	walkEntities := func(l *activity.EntityActivityLog, startTime time.Time) error {
 		for _, e := range l.Clients {
-			if _, ok := dedupedIds[e.ClientID]; ok {
+			if _, ok := dedupIDs[e.ClientID]; ok {
 				continue
 			}
 
-			dedupedIds[e.ClientID] = struct{}{}
-			err := encoder.Encode(e)
+			dedupIDs[e.ClientID] = struct{}{}
+
+			ns, err := NamespaceByID(ctx, e.NamespaceID, a.core)
 			if err != nil {
 				return err
 			}
+			var nsDisplayPath string
+			if ns == nil {
+				nsDisplayPath = fmt.Sprintf(DeletedNamespaceFmt, e.NamespaceID)
+			} else {
+				nsDisplayPath = ns.Path
+			}
+
+			if !a.includeInResponse(reqNS, ns) {
+				continue
+			}
+
+			ts := time.Unix(e.Timestamp, 0)
+
+			record := &ActivityLogExportRecord{
+				ClientID:          e.ClientID,
+				ClientType:        e.ClientType,
+				NamespaceID:       e.NamespaceID,
+				NamespacePath:     nsDisplayPath,
+				TokenCreationTime: ts.UTC().Format(time.RFC3339),
+				MountAccessor:     e.MountAccessor,
+
+				// Default following to empty versus nil, will be overwritten if necessary
+				Policies:                  []string{},
+				EntityMetadata:            map[string]string{},
+				EntityAliasMetadata:       map[string]string{},
+				EntityAliasCustomMetadata: map[string]string{},
+				EntityGroupIDs:            []string{},
+			}
+
+			// if a client does not have usage time (clients used before upgrade to 1.21 and not seen yet after the upgrade),
+			// do not include first used time in response.
+			if e.UsageTime != 0 {
+				clientFirstUsedTimeStamp := time.Unix(e.UsageTime, 0)
+				record.ClientFirstUsedTime = clientFirstUsedTimeStamp.UTC().Format(time.RFC3339)
+			}
+
+			if e.MountAccessor != "" {
+				cacheKey := e.NamespaceID + mountPathIdentity
+
+				var identityBackend logical.Backend
+
+				val, ok := identityBackendCache.Get(cacheKey)
+				if !ok {
+					identityBackend = a.core.router.MatchingBackend(namespace.ContextWithNamespace(ctx, ns), mountPathIdentity)
+
+					if identityBackend != nil {
+						identityBackendCache.Add(cacheKey, identityBackend)
+					}
+				} else {
+					identityBackend = val.(logical.Backend)
+				}
+
+				if identityBackend != nil {
+					req := &logical.Request{
+						Path:      "lookup/entity",
+						Storage:   a.core.systemBarrierView,
+						Operation: logical.UpdateOperation,
+						Data: map[string]interface{}{
+							"id": e.ClientID,
+						},
+					}
+
+					entityResp, err := identityBackend.HandleRequest(namespace.ContextWithNamespace(ctx, ns), req)
+					if err != nil {
+						return fmt.Errorf("failed to lookup entity: %w", err)
+					}
+
+					if entityResp != nil {
+						record.EntityName, ok = entityResp.Data["name"].(string)
+						if !ok {
+							return fmt.Errorf("failed to process entity name")
+						}
+
+						policies, ok := entityResp.Data["policies"].([]string)
+						if !ok {
+							return fmt.Errorf("failed to process policies")
+						}
+
+						if policies != nil {
+							record.Policies = policies
+							slices.Sort(record.Policies)
+						}
+
+						entityMetadata, ok := entityResp.Data["metadata"].(map[string]string)
+						if !ok {
+							return fmt.Errorf("failed to process entity metadata")
+						}
+
+						if entityMetadata != nil {
+							record.EntityMetadata = entityMetadata
+						}
+
+						entityGroupIDs, ok := entityResp.Data["group_ids"].([]string)
+						if !ok {
+							return fmt.Errorf("failed to process entity group IDs")
+						}
+
+						if entityGroupIDs != nil {
+							record.EntityGroupIDs = entityGroupIDs
+							slices.Sort(record.EntityGroupIDs)
+						}
+
+						aliases, ok := entityResp.Data["aliases"].([]interface{})
+						if !ok {
+							return fmt.Errorf("failed to process aliases")
+						}
+
+						// filter for appropriate identity alias based on the
+						// mount accessor associated with the EntityRecord
+						for _, rawAlias := range aliases {
+							alias, ok := rawAlias.(map[string]interface{})
+
+							if !ok {
+								return fmt.Errorf("failed to process alias")
+							}
+
+							aliasMountAccessor, ok := alias["mount_accessor"].(string)
+
+							if !ok || aliasMountAccessor != e.MountAccessor {
+								continue
+							}
+
+							record.EntityAliasName, ok = alias["name"].(string)
+							if !ok {
+								return fmt.Errorf("failed to process entity alias name")
+							}
+
+							record.LocalEntityAlias, ok = alias["local"].(bool)
+							if !ok {
+								return fmt.Errorf("failed to process local entity alias")
+							}
+
+							entityAliasMetadata, ok := alias["metadata"].(map[string]string)
+							if !ok {
+								return fmt.Errorf("failed to process entity alias metadata")
+							}
+
+							if entityAliasMetadata != nil {
+								record.EntityAliasMetadata = entityAliasMetadata
+							}
+
+							entityAliasCustomMetadata, ok := alias["custom_metadata"].(map[string]string)
+							if !ok {
+								return fmt.Errorf("failed to process entity alias custom metadata")
+							}
+
+							if entityAliasCustomMetadata != nil {
+								record.EntityAliasCustomMetadata = entityAliasCustomMetadata
+							}
+
+							valResp := a.core.router.ValidateMountByAccessor(e.MountAccessor)
+							if valResp == nil {
+								record.MountType = ""
+								record.MountPath = fmt.Sprintf(DeletedMountFmt, e.MountAccessor)
+							} else {
+								record.MountType, ok = alias["mount_type"].(string)
+								if !ok {
+									return fmt.Errorf("failed to process mount type")
+								}
+								record.MountPath, ok = alias["mount_path"].(string)
+								if !ok {
+									return fmt.Errorf("failed to process mount path")
+								}
+
+							}
+
+						}
+					} else {
+						// fetch mount directly to ensure mount type and path are populated
+						// this will be necessary for non-entity client types (e.g. non-entity-token)
+						validateResp := a.core.router.ValidateMountByAccessor(e.MountAccessor)
+						if validateResp != nil {
+							record.MountPath = validateResp.MountPath
+							record.MountType = validateResp.MountType
+						}
+					}
+				}
+			}
+
+			// the format is validated above and thus we do not require a default
+			switch format {
+			case "json":
+				err := encoder.Encode(record)
+				if err != nil {
+					return err
+				}
+			case "csv":
+				csvEnc := encoder.(*csvEncoder)
+
+				if csvEnc.wroteHeader {
+					err := csvEnc.Encode(record)
+					if err != nil {
+						return err
+					}
+				} else {
+					err = csvEnc.accumulateHeaderFields(record)
+					if err != nil {
+						return err
+					}
+				}
+			}
 		}
 
 		return nil
 	}
 
-	// For each month in the filtered list walk all the log segments
+	// JSON will always walk once, CSV should only walk twice if we've processed
+	// records during the first pass
+	shouldWalk := true
 
-	for _, startTime := range filteredList {
-		err := a.WalkEntitySegments(ctx, startTime, nil, walkEntities)
-		if err != nil {
-			a.logger.Error("failed to load segments for export", "error", err)
-			return fmt.Errorf("failed to load segments for export: %w", err)
+	// CSV must perform two passes over the data to generate the column list
+	if format == "csv" {
+		for _, startTime := range filteredList {
+			err := a.WalkEntitySegments(ctx, startTime, walkEntities)
+			if err != nil {
+				a.logger.Error("failed to load segments for export", "error", err)
+				return fmt.Errorf("failed to load segments for export: %w", err)
+			}
+		}
+
+		if len(dedupIDs) > 0 {
+			// only write header if we've seen some records
+			err = encoder.(*csvEncoder).writeHeader()
+			if err != nil {
+				return err
+			}
+
+			// clear dedupIDs for second pass
+			dedupIDs = make(map[string]struct{})
+		} else {
+			shouldWalk = false
+		}
+	}
+
+	if shouldWalk {
+		// For each month in the filtered list walk all the log segments
+		for _, startTime := range filteredList {
+			err := a.WalkEntitySegments(ctx, startTime, walkEntities)
+			if err != nil {
+				a.logger.Error("failed to load segments for export", "error", err)
+				return fmt.Errorf("failed to load segments for export: %w", err)
+			}
 		}
 	}
 
@@ -2907,7 +3378,7 @@ func (a *ActivityLog) writeExport(ctx context.Context, rw http.ResponseWriter, f
 }
 
 type encoder interface {
-	Encode(*activity.EntityRecord) error
+	Encode(*ActivityLogExportRecord) error
 	Flush()
 	Error() error
 }
@@ -2924,7 +3395,7 @@ func newJSONEncoder(w io.Writer) *jsonEncoder {
 	}
 }
 
-func (j *jsonEncoder) Encode(er *activity.EntityRecord) error {
+func (j *jsonEncoder) Encode(er *ActivityLogExportRecord) error {
 	return j.e.Encode(er)
 }
 
@@ -2938,35 +3409,206 @@ var _ encoder = (*csvEncoder)(nil)
 
 type csvEncoder struct {
 	*csv.Writer
-}
+	// columnIndex stores all CSV columns and their respective column index.
+	columnIndex map[string]int
 
-func newCSVEncoder(w io.Writer) (*csvEncoder, error) {
-	writer := csv.NewWriter(w)
+	// wroteHeader indicates to the encoder whether or not a header row has been written
+	wroteHeader bool
+}
 
-	err := writer.Write([]string{
+// baseActivityExportCSVHeader returns the base CSV header for the activity
+// export API. The existing order should not be changed. New fields should
+// be appended to the end.
+func baseActivityExportCSVHeader() []string {
+	return []string{
+		"entity_name",
+		"entity_alias_name",
 		"client_id",
+		"client_type",
+		"local_entity_alias",
 		"namespace_id",
-		"timestamp",
-		"non_entity",
+		"namespace_path",
 		"mount_accessor",
-	})
-	if err != nil {
-		return nil, err
+		"mount_path",
+		"mount_type",
+		"token_creation_time",
+		"client_first_used_time",
+	}
+}
+
+// newCSVEncoder instantiates a csvEncoder with a new csv.Writer and base
+// columnIndex based on the base activity export CSV header.
+func newCSVEncoder(w io.Writer) (*csvEncoder, error) {
+	writer := csv.NewWriter(w)
+
+	baseColumnIndex := make(map[string]int)
+
+	for i, col := range baseActivityExportCSVHeader() {
+		baseColumnIndex[col] = i
 	}
 
 	return &csvEncoder{
-		Writer: writer,
+		Writer:      writer,
+		columnIndex: baseColumnIndex,
 	}, nil
 }
 
-// Encode converts an export bundle into a set of strings and writes them to the
-// csv writer.
-func (c *csvEncoder) Encode(e *activity.EntityRecord) error {
-	return c.Writer.Write([]string{
-		e.ClientID,
-		e.NamespaceID,
-		fmt.Sprintf("%d", e.Timestamp),
-		fmt.Sprintf("%t", e.NonEntity),
-		e.MountAccessor,
-	})
+// flattenMapField generates a flattened column name for a map field (e.g. foo.bar).
+func (c *csvEncoder) flattenMapField(fieldName string, subKey string) string {
+	return fmt.Sprintf("%s.%s", fieldName, subKey)
+}
+
+// flattenSliceField generates a flattened column name for a slice field (e.g. foo.0).
+func (c *csvEncoder) flattenSliceField(fieldName string, index int) string {
+	return fmt.Sprintf("%s.%d", fieldName, index)
+}
+
+// accumulateHeaderFields populates the columnIndex with newly discovered activity
+// export fields. Map keys and slice indices will be flattened into individual column
+// names. A map key "identity_metadata" that contains sub-keys "foo" and "bar"
+// will result in indexing the columns "identity_metadata.foo" and "identity_metadata.bar".
+// A slice "policies" with two values will result in indexing the columns "policies.0" and
+// "policies.1".
+func (c *csvEncoder) accumulateHeaderFields(record *ActivityLogExportRecord) error {
+	var recordMap map[string]interface{}
+
+	err := mapstructure.Decode(record, &recordMap)
+	if err != nil {
+		return err
+	}
+
+	for field, rawValue := range recordMap {
+		switch typedValue := rawValue.(type) {
+		case map[string]string:
+			for key := range typedValue {
+				columnName := c.flattenMapField(field, key)
+
+				if _, exists := c.columnIndex[columnName]; !exists {
+					// final index value will be chosen upon generating header
+					c.columnIndex[columnName] = exportCSVFlatteningInitIndex
+				}
+			}
+
+		case []string:
+			for idx := range typedValue {
+				columnName := c.flattenSliceField(field, idx)
+
+				if _, exists := c.columnIndex[columnName]; !exists {
+					// final index value will be chosen upon generating header
+					c.columnIndex[columnName] = exportCSVFlatteningInitIndex
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+// generateHeader initially finalizes column indices for flattened fields. The
+// flattened fields are appended to the base header in lexicographical order.
+func (c *csvEncoder) generateHeader() []string {
+	header := baseActivityExportCSVHeader()
+
+	flattenedColumnNames := make([]string, 0)
+
+	for k, idx := range c.columnIndex {
+		// base header fields already have non-zero index values
+		if idx == -1 {
+			flattenedColumnNames = append(flattenedColumnNames, k)
+		}
+	}
+
+	// sort to provide deterministic column ordering for flattened fields
+	slices.Sort(flattenedColumnNames)
+
+	for _, columnName := range flattenedColumnNames {
+		c.columnIndex[columnName] = len(header)
+		header = append(header, columnName)
+	}
+
+	return header
+}
+
+// writeHeader will write a CSV header if it has not already been written
+func (c *csvEncoder) writeHeader() error {
+	if !c.wroteHeader {
+
+		err := c.Writer.Write(c.generateHeader())
+		if err != nil {
+			return err
+		}
+
+		c.wroteHeader = true
+	}
+
+	return nil
+}
+
+// Encode converts an ActivityLogExportRecord into a row of CSV data. Map and
+// slice fields are flattened in the process. The resulting CSV row is
+// written to the underlying CSV writer.
+func (c *csvEncoder) Encode(record *ActivityLogExportRecord) error {
+	row := make([]string, len(c.columnIndex))
+
+	var recordMap map[string]interface{}
+	err := mapstructure.Decode(record, &recordMap)
+	if err != nil {
+		return err
+	}
+
+	for col, rawValue := range recordMap {
+		switch typedValue := rawValue.(type) {
+		case string:
+			if idx, ok := c.columnIndex[col]; ok {
+				row[idx] = typedValue
+			}
+
+		case bool:
+			if idx, ok := c.columnIndex[col]; ok {
+				row[idx] = strconv.FormatBool(typedValue)
+			}
+
+		case map[string]string:
+			for key, val := range typedValue {
+				columnName := c.flattenMapField(col, key)
+
+				if idx, ok := c.columnIndex[columnName]; ok {
+					row[idx] = val
+				}
+			}
+
+		case []string:
+			for idx, val := range typedValue {
+				columnName := c.flattenSliceField(col, idx)
+
+				if idx, ok := c.columnIndex[columnName]; ok {
+					row[idx] = val
+				}
+			}
+		}
+	}
+
+	return c.Writer.Write(row)
+}
+
+// cleanupEphemeralClients removes ephemeral clients whose associated entities no longer exist
+func (a *ActivityLog) cleanupEphemeralClients() error {
+	clientsIDsInMemory := a.GetClientIDsUsageInfo()
+
+	// loop through the clients and check if they are ephemeral
+	for clientId := range clientsIDsInMemory {
+		entity, err := a.core.identityStore.MemDBEntityByID(clientId, false)
+		if err != nil {
+			a.logger.Warn("could not lookup entity during ephemeral cleanup", "client_id", clientId, "error", err)
+			continue
+		}
+		if entity == nil {
+			delete(clientsIDsInMemory, clientId)
+		}
+	}
+
+	// now update the in-memory map
+	a.SetClientIDsUsageInfo(clientsIDsInMemory)
+
+	return nil
 }
diff --git a/vault/activity_log_test.go b/vault/activity_log_test.go
index dc02fed1c8e..b8068758363 100644
--- a/vault/activity_log_test.go
+++ b/vault/activity_log_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -10,8 +10,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"os"
-	"path/filepath"
 	"reflect"
 	"sort"
 	"strconv"
@@ -20,13 +18,16 @@ import (
 	"testing"
 	"time"
 
-	"github.com/axiomhq/hyperloglog"
+	"github.com/armon/go-metrics"
 	"github.com/go-test/deep"
 	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/command/server"
 	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/timeutil"
+	"github.com/hashicorp/vault/internalshared/configutil"
+	"github.com/hashicorp/vault/sdk/helper/testhelpers/schema"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault/activity"
 	"github.com/mitchellh/mapstructure"
@@ -54,7 +55,7 @@ func TestActivityLog_Creation(t *testing.T) {
 	const namespace_id = "ns123"
 	ts := time.Now()
 
-	a.AddEntityToFragment(entity_id, namespace_id, ts.Unix())
+	a.AddEntityToFragment(entity_id, namespace_id, ts.Unix(), ts.Unix())
 	if a.fragment == nil {
 		t.Fatal("no fragment created")
 	}
@@ -194,10 +195,10 @@ func TestActivityLog_UniqueEntities(t *testing.T) {
 	t2 := time.Now()
 	t3 := t2.Add(60 * time.Second)
 
-	a.AddEntityToFragment(id1, "root", t1.Unix())
-	a.AddEntityToFragment(id2, "root", t2.Unix())
-	a.AddEntityToFragment(id2, "root", t3.Unix())
-	a.AddEntityToFragment(id1, "root", t3.Unix())
+	a.AddEntityToFragment(id1, "root", t1.Unix(), t1.Unix())
+	a.AddEntityToFragment(id2, "root", t2.Unix(), t2.Unix())
+	a.AddEntityToFragment(id2, "root", t3.Unix(), t3.Unix())
+	a.AddEntityToFragment(id1, "root", t3.Unix(), t3.Unix())
 
 	if a.fragment == nil {
 		t.Fatal("no current fragment")
@@ -466,8 +467,8 @@ func TestActivityLog_SaveEntitiesToStorage(t *testing.T) {
 	}
 	path := fmt.Sprintf("%sentity/%d/0", ActivityLogPrefix, a.GetStartTimestamp())
 
-	a.AddEntityToFragment(ids[0], "root", times[0])
-	a.AddEntityToFragment(ids[1], "root2", times[1])
+	a.AddEntityToFragment(ids[0], "root", times[0], times[0])
+	a.AddEntityToFragment(ids[1], "root2", times[1], times[1])
 	err := a.saveCurrentSegmentToStorage(ctx, false)
 	if err != nil {
 		t.Fatalf("got error writing entities to storage: %v", err)
@@ -484,8 +485,8 @@ func TestActivityLog_SaveEntitiesToStorage(t *testing.T) {
 	}
 	expectedEntityIDs(t, out, ids[:2])
 
-	a.AddEntityToFragment(ids[0], "root", times[2])
-	a.AddEntityToFragment(ids[2], "root", times[2])
+	a.AddEntityToFragment(ids[0], "root", times[2], times[2])
+	a.AddEntityToFragment(ids[2], "root", times[2], times[2])
 	err = a.saveCurrentSegmentToStorage(ctx, false)
 	if err != nil {
 		t.Fatalf("got error writing segments to storage: %v", err)
@@ -500,35 +501,6 @@ func TestActivityLog_SaveEntitiesToStorage(t *testing.T) {
 	expectedEntityIDs(t, out, ids)
 }
 
-// TestActivityLog_StoreAndReadHyperloglog inserts into a hyperloglog, stores it and then reads it back. The test
-// verifies the estimate count is correct.
-func TestActivityLog_StoreAndReadHyperloglog(t *testing.T) {
-	core, _, _ := TestCoreUnsealed(t)
-	ctx := context.Background()
-
-	a := core.activityLog
-	a.SetStandbyEnable(ctx, true)
-	a.SetStartTimestamp(time.Now().Unix()) // set a nonzero segment
-	currentMonth := timeutil.StartOfMonth(time.Now())
-	currentMonthHll := hyperloglog.New()
-	currentMonthHll.Insert([]byte("a"))
-	currentMonthHll.Insert([]byte("a"))
-	currentMonthHll.Insert([]byte("b"))
-	currentMonthHll.Insert([]byte("c"))
-	currentMonthHll.Insert([]byte("d"))
-	currentMonthHll.Insert([]byte("d"))
-
-	err := a.StoreHyperlogLog(ctx, currentMonth, currentMonthHll)
-	if err != nil {
-		t.Fatalf("error storing hyperloglog in storage: %v", err)
-	}
-	fetchedHll, err := a.CreateOrFetchHyperlogLog(ctx, currentMonth)
-	// check the distinct count stored from hll
-	if fetchedHll.Estimate() != 4 {
-		t.Fatalf("wrong number of distinct elements: expected: 5 actual: %v", fetchedHll.Estimate())
-	}
-}
-
 // TestModifyResponseMonthsNilAppend calls modifyResponseMonths for a range of 5 months ago to now. It verifies that the
 // 5 months in the range are correct.
 func TestModifyResponseMonthsNilAppend(t *testing.T) {
@@ -623,7 +595,7 @@ func TestActivityLog_availableLogsEmptyDirectory(t *testing.T) {
 	// verify that directory is empty, and nothing goes wrong
 	core, _, _ := TestCoreUnsealed(t)
 	a := core.activityLog
-	times, err := a.availableLogs(context.Background())
+	times, err := a.availableLogs(context.Background(), time.Now())
 	if err != nil {
 		t.Fatalf("error getting start_time(s) for empty activity log")
 	}
@@ -646,7 +618,7 @@ func TestActivityLog_availableLogs(t *testing.T) {
 	}
 
 	// verify above files are there, and dates in correct order
-	times, err := a.availableLogs(context.Background())
+	times, err := a.availableLogs(context.Background(), time.Now())
 	if err != nil {
 		t.Fatalf("error getting start_time(s) for activity log")
 	}
@@ -661,6 +633,102 @@ func TestActivityLog_availableLogs(t *testing.T) {
 	}
 }
 
+// TestActivityLog_createRegenerationIntentLog tests that we can correctly create a regeneration intent log given the segments in storage
+func TestActivityLog_createRegenerationIntentLog(t *testing.T) {
+	testCases := []struct {
+		name          string
+		times         []time.Time
+		expectedLog   *ActivityIntentLog
+		expectedError bool
+	}{
+		{
+			"no segments",
+			[]time.Time{},
+			nil,
+			true,
+		},
+		{
+			"one segment",
+			[]time.Time{
+				time.Date(2024, 4, 4, 10, 54, 12, 0, time.UTC),
+			},
+			nil,
+			true,
+		},
+		{
+			"most recent segment is 3 months ago",
+			[]time.Time{
+				time.Date(2024, 1, 4, 10, 54, 12, 0, time.UTC),
+				time.Date(2024, 1, 3, 10, 54, 12, 0, time.UTC),
+			},
+			&ActivityIntentLog{NextMonth: 0, PreviousMonth: 1704365652},
+			false,
+		},
+		{
+			"lots of segments",
+			[]time.Time{
+				// two this month
+				time.Date(2024, 4, 4, 10, 54, 12, 0, time.UTC),
+				time.Date(2024, 4, 6, 10, 54, 12, 0, time.UTC),
+				// three last month
+				time.Date(2024, 3, 3, 10, 54, 12, 0, time.UTC),
+				time.Date(2024, 3, 6, 10, 54, 12, 0, time.UTC),
+				time.Date(2024, 3, 14, 10, 54, 12, 0, time.UTC),
+				// two the month before that
+				time.Date(2024, 2, 10, 10, 54, 12, 0, time.UTC),
+				time.Date(2024, 2, 17, 10, 54, 12, 0, time.UTC),
+			},
+			&ActivityIntentLog{NextMonth: 1712228052, PreviousMonth: 1710413652},
+			false,
+		},
+	}
+
+	core, _, _ := TestCoreUnsealed(t)
+	a := core.activityLog
+	now := time.Date(2024, 4, 10, 10, 54, 12, 0, time.UTC)
+	ctx := context.Background()
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			deletePaths := make([]string, 0)
+
+			// insert the times we're given
+			paths := make([]string, 0, len(tc.times))
+			for _, tm := range tc.times {
+				paths = append(paths, fmt.Sprintf("entity/%d/1", tm.Unix()))
+			}
+
+			for _, subPath := range paths {
+				fullPath := ActivityLogPrefix + subPath
+				WriteToStorage(t, core, fullPath, []byte("test"))
+				deletePaths = append(deletePaths, fullPath)
+			}
+
+			// regenerate the log
+			intentLog, err := a.createRegenerationIntentLog(context.Background(), now)
+			if tc.expectedError && err == nil {
+				t.Fatal("expected an error and got none")
+			}
+			if !tc.expectedError && err != nil {
+				t.Fatal(err)
+			}
+
+			// verify it's what we expect
+			if diff := deep.Equal(intentLog, tc.expectedLog); len(diff) != 0 {
+				t.Errorf("got=%v, expected=%v, diff=%v", intentLog, tc.expectedLog, diff)
+			}
+
+			// delete everything we wrote so the next test starts fresh
+			for _, p := range deletePaths {
+				err := core.barrier.Delete(ctx, p)
+				if err != nil {
+					t.Fatal(err)
+				}
+			}
+		})
+	}
+}
+
 // TestActivityLog_MultipleFragmentsAndSegments adds 4000 clients to a fragment
 // and saves it and reads it. The test then adds 4000 more clients and calls
 // receivedFragment with 200 more entities. The current segment is saved to
@@ -692,7 +760,7 @@ func TestActivityLog_MultipleFragmentsAndSegments(t *testing.T) {
 
 	// First ActivitySegmentClientCapacity should fit in one segment
 	for i := 0; i < 4000; i++ {
-		a.AddEntityToFragment(genID(i), "root", ts)
+		a.AddEntityToFragment(genID(i), "root", ts, ts)
 	}
 
 	// Consume new fragment notification.
@@ -721,7 +789,7 @@ func TestActivityLog_MultipleFragmentsAndSegments(t *testing.T) {
 
 	// 4000 more local entities
 	for i := 4000; i < 8000; i++ {
-		a.AddEntityToFragment(genID(i), "root", ts)
+		a.AddEntityToFragment(genID(i), "root", ts, ts)
 	}
 
 	// Simulated remote fragment with 100 duplicate entities
@@ -860,7 +928,7 @@ func TestActivityLog_API_ConfigCRUD_Census(t *testing.T) {
 		if err == nil {
 			t.Fatal("expected error")
 		}
-		if resp.Data["error"] != `retention_months must be at least 24 while Reporting is enabled` {
+		if resp.Data["error"] != `retention_months must be at least 48 while Reporting is enabled` {
 			t.Fatalf("bad: %v", resp)
 		}
 	} else {
@@ -871,7 +939,7 @@ func TestActivityLog_API_ConfigCRUD_Census(t *testing.T) {
 
 	req = logical.TestRequest(t, logical.UpdateOperation, "internal/counters/config")
 	req.Storage = view
-	req.Data["retention_months"] = 26
+	req.Data["retention_months"] = 56
 	resp, err = b.HandleRequest(namespace.RootContext(nil), req)
 	if err != nil {
 		t.Fatalf("err: %v", err)
@@ -917,9 +985,9 @@ func TestActivityLog_API_ConfigCRUD_Census(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
+
 	expected := map[string]interface{}{
-		"default_report_months":    12,
-		"retention_months":         26,
+		"retention_months":         56,
 		"enabled":                  "enable",
 		"queries_available":        false,
 		"reporting_enabled":        core.AutomatedLicenseReportingEnabled(),
@@ -1234,7 +1302,7 @@ func TestActivityLog_loadCurrentClientSegment(t *testing.T) {
 	for _, tc := range testCases {
 		data, err := proto.Marshal(tc.entities)
 		if err != nil {
-			t.Fatalf(err.Error())
+			t.Fatal(err.Error())
 		}
 		WriteToStorage(t, core, ActivityLogPrefix+tc.path, data)
 	}
@@ -1347,7 +1415,7 @@ func TestActivityLog_loadPriorEntitySegment(t *testing.T) {
 	for _, tc := range testCases {
 		data, err := proto.Marshal(tc.entities)
 		if err != nil {
-			t.Fatalf(err.Error())
+			t.Fatal(err.Error())
 		}
 		WriteToStorage(t, core, ActivityLogPrefix+tc.path, data)
 	}
@@ -1393,7 +1461,7 @@ func TestActivityLog_loadTokenCount(t *testing.T) {
 
 	data, err := proto.Marshal(tokenCount)
 	if err != nil {
-		t.Fatalf(err.Error())
+		t.Fatal(err.Error())
 	}
 
 	testCases := []struct {
@@ -1467,7 +1535,7 @@ func TestActivityLog_StopAndRestart(t *testing.T) {
 	// Simulate seal/unseal cycle
 	core.stopActivityLog()
 	var wg sync.WaitGroup
-	core.setupActivityLog(ctx, &wg)
+	core.setupActivityLog(ctx, &wg, false)
 	wg.Wait()
 
 	a = core.activityLog
@@ -1475,7 +1543,8 @@ func TestActivityLog_StopAndRestart(t *testing.T) {
 		t.Fatalf("nil token count map")
 	}
 
-	a.AddEntityToFragment("1111-1111", "root", time.Now().Unix())
+	ts := time.Now().Unix()
+	a.AddEntityToFragment("1111-1111", "root", ts, ts)
 	a.AddTokenToFragment("root")
 
 	err = a.saveCurrentSegmentToStorage(ctx, false)
@@ -1527,7 +1596,7 @@ func setupActivityRecordsInStorage(t *testing.T, base time.Time, includeEntities
 				Clients: []*activity.EntityRecord{entityRecord},
 			})
 			if err != nil {
-				t.Fatalf(err.Error())
+				t.Fatal(err.Error())
 			}
 			if i == 0 {
 				WriteToStorage(t, core, ActivityLogPrefix+"entity/"+fmt.Sprint(monthsAgo.Unix())+"/0", entityData)
@@ -1553,7 +1622,7 @@ func setupActivityRecordsInStorage(t *testing.T, base time.Time, includeEntities
 
 		tokenData, err := proto.Marshal(tokenCount)
 		if err != nil {
-			t.Fatalf(err.Error())
+			t.Fatal(err.Error())
 		}
 
 		WriteToStorage(t, core, ActivityLogPrefix+"directtokens/"+fmt.Sprint(base.Unix())+"/0", tokenData)
@@ -1806,182 +1875,6 @@ func TestActivityLog_refreshFromStoredLogPreviousMonth(t *testing.T) {
 	}
 }
 
-// TestActivityLog_Export writes overlapping client for 5 months with various mounts and namespaces. It performs an
-// export for various month ranges in the range, and verifies that the outputs are correct.
-func TestActivityLog_Export(t *testing.T) {
-	timeutil.SkipAtEndOfMonth(t)
-
-	january := time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC)
-	august := time.Date(2020, 8, 15, 12, 0, 0, 0, time.UTC)
-	september := timeutil.StartOfMonth(time.Date(2020, 9, 1, 0, 0, 0, 0, time.UTC))
-	october := timeutil.StartOfMonth(time.Date(2020, 10, 1, 0, 0, 0, 0, time.UTC))
-	november := timeutil.StartOfMonth(time.Date(2020, 11, 1, 0, 0, 0, 0, time.UTC))
-
-	core, _, _ := TestCoreUnsealedWithConfig(t, &CoreConfig{
-		ActivityLogConfig: ActivityLogCoreConfig{
-			DisableTimers: true,
-			ForceEnable:   true,
-		},
-	})
-	a := core.activityLog
-	ctx := namespace.RootContext(nil)
-
-	// Generate overlapping sets of entity IDs from this list.
-	//   january:      40-44                                          RRRRR
-	//   first month:   0-19  RRRRRAAAAABBBBBRRRRR
-	//   second month: 10-29            BBBBBRRRRRRRRRRCCCCC
-	//   third month:  15-39                 RRRRRRRRRRCCCCCRRRRRBBBBB
-
-	entityRecords := make([]*activity.EntityRecord, 45)
-	entityNamespaces := []string{"root", "aaaaa", "bbbbb", "root", "root", "ccccc", "root", "bbbbb", "rrrrr"}
-	authMethods := []string{"auth_1", "auth_2", "auth_3", "auth_4", "auth_5", "auth_6", "auth_7", "auth_8", "auth_9"}
-
-	for i := range entityRecords {
-		entityRecords[i] = &activity.EntityRecord{
-			ClientID:      fmt.Sprintf("111122222-3333-4444-5555-%012v", i),
-			NamespaceID:   entityNamespaces[i/5],
-			MountAccessor: authMethods[i/5],
-		}
-	}
-
-	toInsert := []struct {
-		StartTime int64
-		Segment   uint64
-		Clients   []*activity.EntityRecord
-	}{
-		// January, should not be included
-		{
-			january.Unix(),
-			0,
-			entityRecords[40:45],
-		},
-		// Artifically split August and October
-		{ // 1
-			august.Unix(),
-			0,
-			entityRecords[:13],
-		},
-		{ // 2
-			august.Unix(),
-			1,
-			entityRecords[13:20],
-		},
-		{ // 3
-			september.Unix(),
-			0,
-			entityRecords[10:30],
-		},
-		{ // 4
-			october.Unix(),
-			0,
-			entityRecords[15:40],
-		},
-		{
-			october.Unix(),
-			1,
-			entityRecords[15:40],
-		},
-		{
-			october.Unix(),
-			2,
-			entityRecords[17:23],
-		},
-	}
-
-	for i, segment := range toInsert {
-		eal := &activity.EntityActivityLog{
-			Clients: segment.Clients,
-		}
-
-		// Mimic a lower time stamp for earlier clients
-		for _, c := range eal.Clients {
-			c.Timestamp = int64(i)
-		}
-
-		data, err := proto.Marshal(eal)
-		if err != nil {
-			t.Fatal(err)
-		}
-		path := fmt.Sprintf("%ventity/%v/%v", ActivityLogPrefix, segment.StartTime, segment.Segment)
-		WriteToStorage(t, core, path, data)
-	}
-
-	tCases := []struct {
-		format    string
-		startTime time.Time
-		endTime   time.Time
-		expected  string
-	}{
-		{
-			format:    "json",
-			startTime: august,
-			endTime:   timeutil.EndOfMonth(september),
-			expected:  "aug_sep.json",
-		},
-		{
-			format:    "csv",
-			startTime: august,
-			endTime:   timeutil.EndOfMonth(september),
-			expected:  "aug_sep.csv",
-		},
-		{
-			format:    "json",
-			startTime: january,
-			endTime:   timeutil.EndOfMonth(november),
-			expected:  "full_history.json",
-		},
-		{
-			format:    "csv",
-			startTime: january,
-			endTime:   timeutil.EndOfMonth(november),
-			expected:  "full_history.csv",
-		},
-		{
-			format:    "json",
-			startTime: august,
-			endTime:   timeutil.EndOfMonth(october),
-			expected:  "aug_oct.json",
-		},
-		{
-			format:    "csv",
-			startTime: august,
-			endTime:   timeutil.EndOfMonth(october),
-			expected:  "aug_oct.csv",
-		},
-		{
-			format:    "json",
-			startTime: august,
-			endTime:   timeutil.EndOfMonth(august),
-			expected:  "aug.json",
-		},
-		{
-			format:    "csv",
-			startTime: august,
-			endTime:   timeutil.EndOfMonth(august),
-			expected:  "aug.csv",
-		},
-	}
-
-	for _, tCase := range tCases {
-		rw := &fakeResponseWriter{
-			buffer:  &bytes.Buffer{},
-			headers: http.Header{},
-		}
-		if err := a.writeExport(ctx, rw, tCase.format, tCase.startTime, tCase.endTime); err != nil {
-			t.Fatal(err)
-		}
-
-		expected, err := os.ReadFile(filepath.Join("activity", "test_fixtures", tCase.expected))
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		if !bytes.Equal(rw.buffer.Bytes(), expected) {
-			t.Fatal(rw.buffer.String())
-		}
-	}
-}
-
 type fakeResponseWriter struct {
 	buffer  *bytes.Buffer
 	headers http.Header
@@ -2003,8 +1896,19 @@ func (f *fakeResponseWriter) WriteHeader(statusCode int) {
 // their parents.
 func TestActivityLog_IncludeNamespace(t *testing.T) {
 	root := namespace.RootNamespace
-	a := &ActivityLog{}
+	coreConfig := &CoreConfig{
+		RawConfig: &server.Config{
+			SharedConfig: &configutil.SharedConfig{AdministrativeNamespacePath: "admin/"},
+		},
+		AdministrativeNamespacePath: "admin/",
+	}
+	core, _, _ := TestCoreUnsealedWithConfig(t, coreConfig)
+	a := core.activityLog
 
+	adminNs := &namespace.Namespace{
+		ID:   "adminID",
+		Path: "admin/",
+	}
 	nsA := &namespace.Namespace{
 		ID:   "aaaaa",
 		Path: "a/",
@@ -2017,13 +1921,15 @@ func TestActivityLog_IncludeNamespace(t *testing.T) {
 		ID:   "bbbbb",
 		Path: "a/b/",
 	}
-
 	testCases := []struct {
 		QueryNS  *namespace.Namespace
 		RecordNS *namespace.Namespace
 		Expected bool
 	}{
+		// deleted namespace records must be included in root and admin namespaces
 		{root, nil, true},
+		{adminNs, nil, true},
+
 		{root, root, true},
 		{root, nsA, true},
 		{root, nsAB, true},
@@ -2039,7 +1945,6 @@ func TestActivityLog_IncludeNamespace(t *testing.T) {
 		{nsC, nsA, false},
 		{nsC, nsAB, false},
 	}
-
 	for _, tc := range testCases {
 		if a.includeInResponse(tc.QueryNS, tc.RecordNS) != tc.Expected {
 			t.Errorf("bad response for query %v record %v, expected %v",
@@ -2160,8 +2065,8 @@ func TestActivityLog_EnableDisable(t *testing.T) {
 	id1 := "11111111-1111-1111-1111-111111111111"
 	id2 := "22222222-2222-2222-2222-222222222222"
 	id3 := "33333333-3333-3333-3333-333333333333"
-	a.AddEntityToFragment(id1, "root", time.Now().Unix())
-	a.AddEntityToFragment(id2, "root", time.Now().Unix())
+	a.AddEntityToFragment(id1, "root", time.Now().Unix(), time.Now().Unix())
+	a.AddEntityToFragment(id2, "root", time.Now().Unix(), time.Now().Unix())
 
 	a.SetStartTimestamp(a.GetStartTimestamp() - 10)
 	seg1 := a.GetStartTimestamp()
@@ -2175,7 +2080,7 @@ func TestActivityLog_EnableDisable(t *testing.T) {
 	readSegmentFromStorage(t, core, path)
 
 	// Add in-memory fragment
-	a.AddEntityToFragment(id3, "root", time.Now().Unix())
+	a.AddEntityToFragment(id3, "root", time.Now().Unix(), time.Now().Unix())
 
 	// disable and verify segment exists
 	disableRequest()
@@ -2227,7 +2132,7 @@ func TestActivityLog_EndOfMonth(t *testing.T) {
 	id1 := "11111111-1111-1111-1111-111111111111"
 	id2 := "22222222-2222-2222-2222-222222222222"
 	id3 := "33333333-3333-3333-3333-333333333333"
-	a.AddEntityToFragment(id1, "root", time.Now().Unix())
+	a.AddEntityToFragment(id1, "root", time.Now().Unix(), time.Now().Unix())
 
 	month0 := time.Now().UTC()
 	segment0 := a.GetStartTimestamp()
@@ -2275,12 +2180,12 @@ func TestActivityLog_EndOfMonth(t *testing.T) {
 		t.Errorf("expected previous month %v got %v", segment1, intent.NextMonth)
 	}
 
-	a.AddEntityToFragment(id2, "root", time.Now().Unix())
+	a.AddEntityToFragment(id2, "root", time.Now().Unix(), time.Now().Unix())
 
 	a.HandleEndOfMonth(ctx, month2)
 	segment2 := a.GetStartTimestamp()
 
-	a.AddEntityToFragment(id3, "root", time.Now().Unix())
+	a.AddEntityToFragment(id3, "root", time.Now().Unix(), time.Now().Unix())
 
 	err = a.saveCurrentSegmentToStorage(ctx, false)
 	if err != nil {
@@ -2627,7 +2532,7 @@ func TestActivityLog_CalculatePrecomputedQueriesWithMixedTWEs(t *testing.T) {
 		// Pretend we've successfully rolled over to the following month
 		a.SetStartTimestamp(tc.NextMonth)
 
-		err = a.precomputedQueryWorker(ctx)
+		err = a.precomputedQueryWorker(ctx, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -2726,7 +2631,7 @@ func TestActivityLog_SaveAfterDisable(t *testing.T) {
 		DefaultReportMonths: 12,
 	})
 
-	a.AddEntityToFragment("1111-1111-11111111", "root", time.Now().Unix())
+	a.AddEntityToFragment("1111-1111-11111111", "root", time.Now().Unix(), time.Now().Unix())
 	startTimestamp := a.GetStartTimestamp()
 
 	// This kicks off an asynchronous delete
@@ -3008,7 +2913,7 @@ func TestActivityLog_Precompute(t *testing.T) {
 		// Pretend we've successfully rolled over to the following month
 		a.SetStartTimestamp(tc.NextMonth)
 
-		err = a.precomputedQueryWorker(ctx)
+		err = a.precomputedQueryWorker(ctx, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -3270,7 +3175,7 @@ func TestActivityLog_Precompute_SkipMonth(t *testing.T) {
 		// Pretend we've successfully rolled over to the following month
 		a.SetStartTimestamp(tc.NextMonth)
 
-		err = a.precomputedQueryWorker(ctx)
+		err = a.precomputedQueryWorker(ctx, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -3536,7 +3441,7 @@ func TestActivityLog_PrecomputeNonEntityTokensWithID(t *testing.T) {
 		// Pretend we've successfully rolled over to the following month
 		a.SetStartTimestamp(tc.NextMonth)
 
-		err = a.precomputedQueryWorker(ctx)
+		err = a.precomputedQueryWorker(ctx, nil)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -3663,7 +3568,7 @@ func TestActivityLog_PrecomputeCancel(t *testing.T) {
 	// This will block if the shutdown didn't work.
 	go func() {
 		// We expect this to error because of BlockingInmemStorage
-		_ = a.precomputedQueryWorker(namespace.RootContext(nil))
+		_ = a.precomputedQueryWorker(namespace.RootContext(nil), nil)
 		close(done)
 	}()
 
@@ -3893,8 +3798,8 @@ func TestActivityLog_partialMonthClientCount(t *testing.T) {
 	}
 
 	for _, clientCount := range clientCountResponse {
-		if int(clientCounts[clientCount.NamespaceID]) != clientCount.Counts.DistinctEntities {
-			t.Errorf("bad entity count for namespace %s . expected %d, got %d", clientCount.NamespaceID, int(clientCounts[clientCount.NamespaceID]), clientCount.Counts.DistinctEntities)
+		if int(clientCounts[clientCount.NamespaceID]) != clientCount.Counts.EntityClients {
+			t.Errorf("bad entity count for namespace %s . expected %d, got %d", clientCount.NamespaceID, int(clientCounts[clientCount.NamespaceID]), clientCount.Counts.EntityClients)
 		}
 		totalCount := int(clientCounts[clientCount.NamespaceID])
 		if totalCount != clientCount.Counts.Clients {
@@ -3902,12 +3807,12 @@ func TestActivityLog_partialMonthClientCount(t *testing.T) {
 		}
 	}
 
-	distinctEntities, ok := results["distinct_entities"]
+	entityClients, ok := results["entity_clients"]
 	if !ok {
 		t.Fatalf("malformed results. got %v", results)
 	}
-	if distinctEntities != len(clients) {
-		t.Errorf("bad entity count. expected %d, got %d", len(clients), distinctEntities)
+	if entityClients != len(clients) {
+		t.Errorf("bad entity count. expected %d, got %d", len(clients), entityClients)
 	}
 
 	clientCount, ok := results["clients"]
@@ -3970,8 +3875,8 @@ func TestActivityLog_partialMonthClientCountUsingHandleQuery(t *testing.T) {
 	}
 
 	for _, clientCount := range clientCountResponse {
-		if int(clientCounts[clientCount.NamespaceID]) != clientCount.Counts.DistinctEntities {
-			t.Errorf("bad entity count for namespace %s . expected %d, got %d", clientCount.NamespaceID, int(clientCounts[clientCount.NamespaceID]), clientCount.Counts.DistinctEntities)
+		if int(clientCounts[clientCount.NamespaceID]) != clientCount.Counts.EntityClients {
+			t.Errorf("bad entity count for namespace %s . expected %d, got %d", clientCount.NamespaceID, int(clientCounts[clientCount.NamespaceID]), clientCount.Counts.EntityClients)
 		}
 		totalCount := int(clientCounts[clientCount.NamespaceID])
 		if totalCount != clientCount.Counts.Clients {
@@ -3985,9 +3890,9 @@ func TestActivityLog_partialMonthClientCountUsingHandleQuery(t *testing.T) {
 	}
 	totalCounts := ResponseCounts{}
 	err = mapstructure.Decode(totals, &totalCounts)
-	distinctEntities := totalCounts.DistinctEntities
-	if distinctEntities != len(clients) {
-		t.Errorf("bad entity count. expected %d, got %d", len(clients), distinctEntities)
+	entityClients := totalCounts.EntityClients
+	if entityClients != len(clients) {
+		t.Errorf("bad entity count. expected %d, got %d", len(clients), entityClients)
 	}
 
 	clientCount := totalCounts.Clients
@@ -4015,30 +3920,20 @@ func TestActivityLog_partialMonthClientCountUsingHandleQuery(t *testing.T) {
 	if monthsResponse[0].Counts.NonEntityClients != totalCounts.NonEntityClients {
 		t.Fatalf("wrong non-entity client count. got %v, expected %v", monthsResponse[0].Counts.NonEntityClients, totalCounts.NonEntityClients)
 	}
-	if monthsResponse[0].Counts.NonEntityTokens != totalCounts.NonEntityTokens {
-		t.Fatalf("wrong non-entity client count. got %v, expected %v", monthsResponse[0].Counts.NonEntityTokens, totalCounts.NonEntityTokens)
-	}
 	if monthsResponse[0].Counts.Clients != monthsResponse[0].NewClients.Counts.Clients {
 		t.Fatalf("wrong client count. got %v, expected %v", monthsResponse[0].Counts.Clients, monthsResponse[0].NewClients.Counts.Clients)
 	}
-	if monthsResponse[0].Counts.DistinctEntities != monthsResponse[0].NewClients.Counts.DistinctEntities {
-		t.Fatalf("wrong distinct entities count. got %v, expected %v", monthsResponse[0].Counts.DistinctEntities, monthsResponse[0].NewClients.Counts.DistinctEntities)
-	}
 	if monthsResponse[0].Counts.EntityClients != monthsResponse[0].NewClients.Counts.EntityClients {
 		t.Fatalf("wrong entity client count. got %v, expected %v", monthsResponse[0].Counts.EntityClients, monthsResponse[0].NewClients.Counts.EntityClients)
 	}
 	if monthsResponse[0].Counts.NonEntityClients != monthsResponse[0].NewClients.Counts.NonEntityClients {
 		t.Fatalf("wrong non-entity client count. got %v, expected %v", monthsResponse[0].Counts.NonEntityClients, monthsResponse[0].NewClients.Counts.NonEntityClients)
 	}
-	if monthsResponse[0].Counts.NonEntityTokens != monthsResponse[0].NewClients.Counts.NonEntityTokens {
-		t.Fatalf("wrong non-entity token count. got %v, expected %v", monthsResponse[0].Counts.NonEntityTokens, monthsResponse[0].NewClients.Counts.NonEntityTokens)
-	}
-
 	namespaceResponseMonth := monthsResponse[0].Namespaces
 
 	for _, clientCount := range namespaceResponseMonth {
 		if int(clientCounts[clientCount.NamespaceID]) != clientCount.Counts.EntityClients {
-			t.Errorf("bad entity count for namespace %s . expected %d, got %d", clientCount.NamespaceID, int(clientCounts[clientCount.NamespaceID]), clientCount.Counts.DistinctEntities)
+			t.Errorf("bad entity count for namespace %s . expected %d, got %d", clientCount.NamespaceID, int(clientCounts[clientCount.NamespaceID]), clientCount.Counts.EntityClients)
 		}
 		totalCount := int(clientCounts[clientCount.NamespaceID])
 		if totalCount != clientCount.Counts.Clients {
@@ -4155,7 +4050,7 @@ func TestActivityLog_partialMonthClientCountWithMultipleMountPaths(t *testing.T)
 			Clients: []*activity.EntityRecord{entityRecord},
 		})
 		if err != nil {
-			t.Fatalf(err.Error())
+			t.Fatal(err.Error())
 		}
 		storagePath := fmt.Sprintf("%sentity/%d/%d", ActivityLogPrefix, timeutil.StartOfMonth(now).Unix(), i)
 		WriteToStorage(t, core, storagePath, entityData)
@@ -4201,7 +4096,7 @@ func TestActivityLog_partialMonthClientCountWithMultipleMountPaths(t *testing.T)
 	// these are the paths that are expected and correspond with the entity records created above
 	expectedPaths := []string{
 		noMountAccessor,
-		fmt.Sprintf(deletedMountFmt, "deleted"),
+		fmt.Sprintf(DeletedMountFmt, "deleted"),
 		path,
 	}
 	for _, expectedPath := range expectedPaths {
@@ -4218,14 +4113,14 @@ func TestActivityLog_partialMonthClientCountWithMultipleMountPaths(t *testing.T)
 // TestActivityLog_processNewClients_delete ensures that the correct clients are deleted from a processNewClients struct
 func TestActivityLog_processNewClients_delete(t *testing.T) {
 	mount := "mount"
-	namespace := "namespace"
+	ns := "namespace"
 	clientID := "client-id"
 	run := func(t *testing.T, clientType string) {
 		t.Helper()
 		isNonEntity := clientType == nonEntityTokenActivityType || clientType == ACMEActivityType
 		record := &activity.EntityRecord{
 			MountAccessor: mount,
-			NamespaceID:   namespace,
+			NamespaceID:   ns,
 			ClientID:      clientID,
 			NonEntity:     isNonEntity,
 			ClientType:    clientType,
@@ -4234,8 +4129,8 @@ func TestActivityLog_processNewClients_delete(t *testing.T) {
 		newClients.add(record)
 
 		require.True(t, newClients.Counts.contains(record))
-		require.True(t, newClients.Namespaces[namespace].Counts.contains(record))
-		require.True(t, newClients.Namespaces[namespace].Mounts[mount].Counts.contains(record))
+		require.True(t, newClients.Namespaces[ns].Counts.contains(record))
+		require.True(t, newClients.Namespaces[ns].Mounts[mount].Counts.contains(record))
 
 		newClients.delete(record)
 
@@ -4243,8 +4138,8 @@ func TestActivityLog_processNewClients_delete(t *testing.T) {
 		counts := newClients.Counts
 		for _, typ := range []string{nonEntityTokenActivityType, secretSyncActivityType, entityActivityType, ACMEActivityType} {
 			require.NotContains(t, counts.clientsByType(typ), clientID)
-			require.NotContains(t, byNS[namespace].Mounts[mount].Counts.clientsByType(typ), clientID)
-			require.NotContains(t, byNS[namespace].Counts.clientsByType(typ), clientID)
+			require.NotContains(t, byNS[ns].Mounts[mount].Counts.clientsByType(typ), clientID)
+			require.NotContains(t, byNS[ns].Counts.clientsByType(typ), clientID)
 		}
 	}
 	t.Run("entity", func(t *testing.T) {
@@ -4266,14 +4161,15 @@ func TestActivityLog_processNewClients_delete(t *testing.T) {
 func TestActivityLog_processClientRecord(t *testing.T) {
 	startTime := time.Now()
 	mount := "mount"
-	namespace := "namespace"
+	ns := "namespace"
 	clientID := "client-id"
+
 	run := func(t *testing.T, clientType string) {
 		t.Helper()
 		isNonEntity := clientType == nonEntityTokenActivityType || clientType == ACMEActivityType
 		record := &activity.EntityRecord{
 			MountAccessor: mount,
-			NamespaceID:   namespace,
+			NamespaceID:   ns,
 			ClientID:      clientID,
 			NonEntity:     isNonEntity,
 			ClientType:    clientType,
@@ -4281,28 +4177,28 @@ func TestActivityLog_processClientRecord(t *testing.T) {
 		byNS := make(summaryByNamespace)
 		byMonth := make(summaryByMonth)
 		processClientRecord(record, byNS, byMonth, startTime)
-		require.Contains(t, byNS, namespace)
-		require.Contains(t, byNS[namespace].Mounts, mount)
+		require.Contains(t, byNS, ns)
+		require.Contains(t, byNS[ns].Mounts, mount)
 		monthIndex := timeutil.StartOfMonth(startTime).UTC().Unix()
 		require.Contains(t, byMonth, monthIndex)
 		require.Equal(t, byMonth[monthIndex].Namespaces, byNS)
 		require.Equal(t, byMonth[monthIndex].NewClients.Namespaces, byNS)
 
-		for _, typ := range []string{nonEntityTokenActivityType, secretSyncActivityType, entityActivityType} {
-			if clientType == typ || (clientType == ACMEActivityType && typ == nonEntityTokenActivityType) {
+		for _, typ := range ActivityClientTypes {
+			if clientType == typ {
 				require.Contains(t, byMonth[monthIndex].Counts.clientsByType(typ), clientID)
 				require.Contains(t, byMonth[monthIndex].NewClients.Counts.clientsByType(typ), clientID)
-				require.Contains(t, byNS[namespace].Mounts[mount].Counts.clientsByType(typ), clientID)
-				require.Contains(t, byNS[namespace].Counts.clientsByType(typ), clientID)
+				require.Contains(t, byNS[ns].Mounts[mount].Counts.clientsByType(typ), clientID)
+				require.Contains(t, byNS[ns].Counts.clientsByType(typ), clientID)
 			} else {
 				require.NotContains(t, byMonth[monthIndex].Counts.clientsByType(typ), clientID)
 				require.NotContains(t, byMonth[monthIndex].NewClients.Counts.clientsByType(typ), clientID)
-				require.NotContains(t, byNS[namespace].Mounts[mount].Counts.clientsByType(typ), clientID)
-				require.NotContains(t, byNS[namespace].Counts.clientsByType(typ), clientID)
-
+				require.NotContains(t, byNS[ns].Mounts[mount].Counts.clientsByType(typ), clientID)
+				require.NotContains(t, byNS[ns].Counts.clientsByType(typ), clientID)
 			}
 		}
 	}
+
 	t.Run("non entity", func(t *testing.T) {
 		run(t, nonEntityTokenActivityType)
 	})
@@ -4362,12 +4258,11 @@ func TestActivityLog_handleEntitySegment(t *testing.T) {
 	}
 	a := &ActivityLog{}
 	t.Run("older segment empty", func(t *testing.T) {
-		hll := hyperloglog.New()
 		byNS := make(summaryByNamespace)
 		byMonth := make(summaryByMonth)
 		segmentTime := addMonths(-3)
 		// our 3 clients were seen 3 months ago, with no other clients having been seen
-		err := a.handleEntitySegment(&activity.EntityActivityLog{Clients: currentSegmentClients}, segmentTime, hll, pqOptions{
+		err := a.handleEntitySegment(&activity.EntityActivityLog{Clients: currentSegmentClients}, segmentTime, pqOptions{
 			byNamespace:       byNS,
 			byMonth:           byMonth,
 			endTime:           timeutil.EndOfMonth(segmentTime),
@@ -4382,11 +4277,8 @@ func TestActivityLog_handleEntitySegment(t *testing.T) {
 		require.Equal(t, byMonth.firstSeen(t, currentSegmentClients[0]), segmentTime)
 		require.Equal(t, byMonth.firstSeen(t, currentSegmentClients[1]), segmentTime)
 		require.Equal(t, byMonth.firstSeen(t, currentSegmentClients[2]), segmentTime)
-		// and all 3 should be in the hyperloglog
-		require.Equal(t, hll.Estimate(), uint64(3))
 	})
 	t.Run("older segment clients seen earlier", func(t *testing.T) {
-		hll := hyperloglog.New()
 		byNS := make(summaryByNamespace)
 		byNS.add(currentSegmentClients[0])
 		byNS.add(currentSegmentClients[1])
@@ -4401,7 +4293,7 @@ func TestActivityLog_handleEntitySegment(t *testing.T) {
 		byMonth.add(currentSegmentClients[1], seenBefore1Month)
 
 		// handle clients 0, 1, and 2 as having been seen 3 months ago
-		err := a.handleEntitySegment(&activity.EntityActivityLog{Clients: currentSegmentClients}, segmentTime, hll, pqOptions{
+		err := a.handleEntitySegment(&activity.EntityActivityLog{Clients: currentSegmentClients}, segmentTime, pqOptions{
 			byNamespace:       byNS,
 			byMonth:           byMonth,
 			endTime:           timeutil.EndOfMonth(segmentTime),
@@ -4415,11 +4307,8 @@ func TestActivityLog_handleEntitySegment(t *testing.T) {
 		require.Equal(t, byMonth.firstSeen(t, currentSegmentClients[0]), segmentTime)
 		require.Equal(t, byMonth.firstSeen(t, currentSegmentClients[1]), segmentTime)
 		require.Equal(t, byMonth.firstSeen(t, currentSegmentClients[2]), segmentTime)
-
-		require.Equal(t, hll.Estimate(), uint64(3))
 	})
 	t.Run("disjoint set of clients", func(t *testing.T) {
-		hll := hyperloglog.New()
 		byNS := make(summaryByNamespace)
 		byNS.add(currentSegmentClients[0])
 		byNS.add(currentSegmentClients[1])
@@ -4434,7 +4323,7 @@ func TestActivityLog_handleEntitySegment(t *testing.T) {
 		byMonth.add(currentSegmentClients[1], seenBefore1Month)
 
 		// handle client 2 as having been seen 3 months ago
-		err := a.handleEntitySegment(&activity.EntityActivityLog{Clients: currentSegmentClients[2:]}, segmentTime, hll, pqOptions{
+		err := a.handleEntitySegment(&activity.EntityActivityLog{Clients: currentSegmentClients[2:]}, segmentTime, pqOptions{
 			byNamespace:       byNS,
 			byMonth:           byMonth,
 			endTime:           timeutil.EndOfMonth(segmentTime),
@@ -4448,11 +4337,8 @@ func TestActivityLog_handleEntitySegment(t *testing.T) {
 		require.Equal(t, byMonth.firstSeen(t, currentSegmentClients[0]), seenBefore2Months)
 		require.Equal(t, byMonth.firstSeen(t, currentSegmentClients[1]), seenBefore1Month)
 		require.Equal(t, byMonth.firstSeen(t, currentSegmentClients[2]), segmentTime)
-		// the hyperloglog will have 1 element, because there was only 1 client in the segment
-		require.Equal(t, hll.Estimate(), uint64(1))
 	})
 	t.Run("new clients same namespaces", func(t *testing.T) {
-		hll := hyperloglog.New()
 		byNS := make(summaryByNamespace)
 		byNS.add(currentSegmentClients[0])
 		byNS.add(currentSegmentClients[1])
@@ -4480,7 +4366,7 @@ func TestActivityLog_handleEntitySegment(t *testing.T) {
 			})
 		}
 		// 3 new clients have been seen 3 months ago
-		err := a.handleEntitySegment(&activity.EntityActivityLog{Clients: moreSegmentClients}, segmentTime, hll, pqOptions{
+		err := a.handleEntitySegment(&activity.EntityActivityLog{Clients: moreSegmentClients}, segmentTime, pqOptions{
 			byNamespace:       byNS,
 			byMonth:           byMonth,
 			endTime:           timeutil.EndOfMonth(segmentTime),
@@ -4500,8 +4386,6 @@ func TestActivityLog_handleEntitySegment(t *testing.T) {
 		require.Equal(t, byMonth.firstSeen(t, moreSegmentClients[0]), segmentTime)
 		require.Equal(t, byMonth.firstSeen(t, moreSegmentClients[1]), segmentTime)
 		require.Equal(t, byMonth.firstSeen(t, moreSegmentClients[2]), segmentTime)
-		// the hyperloglog will have 3 elements, because there were the 3 new elements in moreSegmentClients seen
-		require.Equal(t, hll.Estimate(), uint64(3))
 	})
 }
 
@@ -4599,6 +4483,12 @@ func TestActivityLog_writePrecomputedQuery(t *testing.T) {
 		MountAccessor: "mnt-3",
 		ClientType:    secretSyncActivityType,
 	}
+	acmeClient := &activity.EntityRecord{
+		ClientID:      "id-4",
+		NamespaceID:   "ns-4",
+		MountAccessor: "mnt-4",
+		ClientType:    ACMEActivityType,
+	}
 
 	now := time.Now()
 
@@ -4606,6 +4496,7 @@ func TestActivityLog_writePrecomputedQuery(t *testing.T) {
 	processClientRecord(clientEntity, byNS, byMonth, now)
 	processClientRecord(clientNonEntity, byNS, byMonth, now)
 	processClientRecord(secretSync, byNS, byMonth, now)
+	processClientRecord(acmeClient, byNS, byMonth, now)
 
 	endTime := timeutil.EndOfMonth(now)
 	opts := pqOptions{
@@ -4623,8 +4514,8 @@ func TestActivityLog_writePrecomputedQuery(t *testing.T) {
 	require.Equal(t, now.UTC().Unix(), val.StartTime.UTC().Unix())
 	require.Equal(t, endTime.UTC().Unix(), val.EndTime.UTC().Unix())
 
-	// ns-1, ns-2, and ns-3 should both be present in the results
-	require.Len(t, val.Namespaces, 3)
+	// ns-1, ns-2, ns-3, ns-4 should all be present in the results
+	require.Len(t, val.Namespaces, 4)
 	require.Len(t, val.Months, 1)
 	resultByNS := make(map[string]*activity.NamespaceRecord)
 	for _, ns := range val.Namespaces {
@@ -4633,41 +4524,62 @@ func TestActivityLog_writePrecomputedQuery(t *testing.T) {
 	ns1 := resultByNS["ns-1"]
 	ns2 := resultByNS["ns-2"]
 	ns3 := resultByNS["ns-3"]
+	ns4 := resultByNS["ns-4"]
 
 	require.Equal(t, ns1.Entities, uint64(1))
 	require.Equal(t, ns1.NonEntityTokens, uint64(0))
 	require.Equal(t, ns1.SecretSyncs, uint64(0))
+	require.Equal(t, ns1.ACMEClients, uint64(0))
 	require.Equal(t, ns2.Entities, uint64(0))
 	require.Equal(t, ns2.NonEntityTokens, uint64(1))
 	require.Equal(t, ns2.SecretSyncs, uint64(0))
+	require.Equal(t, ns2.ACMEClients, uint64(0))
 	require.Equal(t, ns3.Entities, uint64(0))
 	require.Equal(t, ns3.NonEntityTokens, uint64(0))
 	require.Equal(t, ns3.SecretSyncs, uint64(1))
+	require.Equal(t, ns3.ACMEClients, uint64(0))
+	require.Equal(t, ns4.Entities, uint64(0))
+	require.Equal(t, ns4.NonEntityTokens, uint64(0))
+	require.Equal(t, ns4.SecretSyncs, uint64(0))
+	require.Equal(t, ns4.ACMEClients, uint64(1))
 
 	require.Len(t, ns1.Mounts, 1)
 	require.Len(t, ns2.Mounts, 1)
 	require.Len(t, ns3.Mounts, 1)
+	require.Len(t, ns4.Mounts, 1)
+
 	// ns-1 needs to have mnt-1
 	require.Contains(t, ns1.Mounts[0].MountPath, "mnt-1")
 	// ns-2 needs to have mnt-2
 	require.Contains(t, ns2.Mounts[0].MountPath, "mnt-2")
 	// ns-3 needs to have mnt-3
 	require.Contains(t, ns3.Mounts[0].MountPath, "mnt-3")
+	// ns-4 needs to have mnt-4
+	require.Contains(t, ns4.Mounts[0].MountPath, "mnt-4")
 
 	// ns1 only has an entity client
 	require.Equal(t, 1, ns1.Mounts[0].Counts.EntityClients)
 	require.Equal(t, 0, ns1.Mounts[0].Counts.NonEntityClients)
 	require.Equal(t, 0, ns1.Mounts[0].Counts.SecretSyncs)
+	require.Equal(t, 0, ns1.Mounts[0].Counts.ACMEClients)
 
 	// ns2 only has a non entity client
 	require.Equal(t, 0, ns2.Mounts[0].Counts.EntityClients)
 	require.Equal(t, 1, ns2.Mounts[0].Counts.NonEntityClients)
 	require.Equal(t, 0, ns2.Mounts[0].Counts.SecretSyncs)
+	require.Equal(t, 0, ns2.Mounts[0].Counts.ACMEClients)
 
 	// ns3 only has a secret sync association
 	require.Equal(t, 0, ns3.Mounts[0].Counts.EntityClients)
 	require.Equal(t, 0, ns3.Mounts[0].Counts.NonEntityClients)
 	require.Equal(t, 1, ns3.Mounts[0].Counts.SecretSyncs)
+	require.Equal(t, 0, ns3.Mounts[0].Counts.ACMEClients)
+
+	// ns4 only has an ACME client
+	require.Equal(t, 0, ns4.Mounts[0].Counts.EntityClients)
+	require.Equal(t, 0, ns4.Mounts[0].Counts.NonEntityClients)
+	require.Equal(t, 0, ns4.Mounts[0].Counts.SecretSyncs)
+	require.Equal(t, 1, ns4.Mounts[0].Counts.ACMEClients)
 
 	monthRecord := val.Months[0]
 	// there should only be one month present, since the clients were added with the same timestamp
@@ -4675,11 +4587,13 @@ func TestActivityLog_writePrecomputedQuery(t *testing.T) {
 	require.Equal(t, 1, monthRecord.Counts.NonEntityClients)
 	require.Equal(t, 1, monthRecord.Counts.EntityClients)
 	require.Equal(t, 1, monthRecord.Counts.SecretSyncs)
-	require.Len(t, monthRecord.Namespaces, 3)
-	require.Len(t, monthRecord.NewClients.Namespaces, 3)
+	require.Equal(t, 1, monthRecord.Counts.ACMEClients)
+	require.Len(t, monthRecord.Namespaces, 4)
+	require.Len(t, monthRecord.NewClients.Namespaces, 4)
 	require.Equal(t, 1, monthRecord.NewClients.Counts.EntityClients)
 	require.Equal(t, 1, monthRecord.NewClients.Counts.NonEntityClients)
 	require.Equal(t, 1, monthRecord.NewClients.Counts.SecretSyncs)
+	require.Equal(t, 1, monthRecord.NewClients.Counts.ACMEClients)
 }
 
 type mockTimeNowClock struct {
@@ -4728,7 +4642,7 @@ func TestActivityLog_HandleEndOfMonth(t *testing.T) {
 	}()
 	core.activityLog.SetEnable(true)
 	core.activityLog.SetStartTimestamp(now.Unix())
-	core.activityLog.AddClientToFragment("id", "ns", now.Unix(), false, "mount")
+	core.activityLog.AddClientToFragment("id", "ns", now.Unix(), false, "mount", now.Unix())
 
 	// wait for the end of month to be triggered
 	select {
@@ -4758,9 +4672,9 @@ func TestAddActivityToFragment(t *testing.T) {
 	a.SetEnable(true)
 
 	mount := "mount"
-	namespace := "root"
+	ns := "root"
 	id := "id1"
-	a.AddActivityToFragment(id, namespace, 0, entityActivityType, mount)
+	a.AddActivityToFragment(id, ns, 0, entityActivityType, mount, 0)
 
 	testCases := []struct {
 		name         string
@@ -4809,16 +4723,14 @@ func TestAddActivityToFragment(t *testing.T) {
 			isNonEntity:  true,
 		},
 	}
+
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			if tc.activityType == secretSyncActivityType && !core.HasFeature(FeatureSecretSyncBilling) {
-				t.Skip()
-			}
 			a.fragmentLock.RLock()
 			numClientsBefore := len(a.fragment.Clients)
 			a.fragmentLock.RUnlock()
 
-			a.AddActivityToFragment(tc.id, namespace, 0, tc.activityType, mount)
+			a.AddActivityToFragment(tc.id, ns, 0, tc.activityType, mount, 0)
 			a.fragmentLock.RLock()
 			defer a.fragmentLock.RUnlock()
 			numClientsAfter := len(a.fragment.Clients)
@@ -4832,7 +4744,7 @@ func TestAddActivityToFragment(t *testing.T) {
 			require.Contains(t, a.partialMonthClientTracker, tc.expectedID)
 			require.True(t, proto.Equal(&activity.EntityRecord{
 				ClientID:      tc.expectedID,
-				NamespaceID:   namespace,
+				NamespaceID:   ns,
 				Timestamp:     0,
 				NonEntity:     tc.isNonEntity,
 				MountAccessor: mount,
@@ -4841,3 +4753,379 @@ func TestAddActivityToFragment(t *testing.T) {
 		})
 	}
 }
+
+// TestActivityLog_reportPrecomputedQueryMetrics creates 3 clients per type and
+// calls reportPrecomputedQueryMetrics. The test verifies that the metric sink
+// gets metrics reported correctly, based on the segment time matching the
+// active period start or end
+func TestActivityLog_reportPrecomputedQueryMetrics(t *testing.T) {
+	core, _, _, metricsSink := TestCoreUnsealedWithMetrics(t)
+	a := core.activityLog
+	byMonth := make(summaryByMonth)
+	byNS := make(summaryByNamespace)
+	segmentTime := time.Now()
+
+	// for each client type, make 3 clients in their own namespaces
+	for i := 0; i < 3; i++ {
+		for _, clientType := range ActivityClientTypes {
+			client := &activity.EntityRecord{
+				ClientID:      fmt.Sprintf("%s-%d", clientType, i),
+				NamespaceID:   fmt.Sprintf("ns-%d", i),
+				MountAccessor: fmt.Sprintf("mnt-%d", i),
+				ClientType:    clientType,
+				NonEntity:     clientType == nonEntityTokenActivityType || clientType == ACMEActivityType,
+			}
+			processClientRecord(client, byNS, byMonth, segmentTime)
+		}
+	}
+
+	endTime := timeutil.EndOfMonth(segmentTime)
+	opts := pqOptions{
+		byNamespace: byNS,
+		byMonth:     byMonth,
+		endTime:     endTime,
+	}
+
+	otherTime := segmentTime.Add(time.Hour)
+	hasNoMetric := func(t *testing.T, intervals []*metrics.IntervalMetrics, name string) {
+		t.Helper()
+		gauges := intervals[len(intervals)-1].Gauges
+		for _, metric := range gauges {
+			if metric.Name == name {
+				require.Fail(t, "metric found", name)
+			}
+		}
+	}
+
+	hasMetric := func(t *testing.T, intervals []*metrics.IntervalMetrics, name string, value float32, namespaceLabel *string) {
+		t.Helper()
+		fullMetric := fmt.Sprintf("%s;cluster=test-cluster", name)
+		if namespaceLabel != nil {
+			fullMetric = fmt.Sprintf("%s;namespace=%s;cluster=test-cluster", name, *namespaceLabel)
+		}
+		gauges := intervals[len(intervals)-1].Gauges
+		require.Contains(t, gauges, fullMetric)
+		metric := gauges[fullMetric]
+		require.Equal(t, value, metric.Value)
+	}
+
+	t.Run("no metrics", func(t *testing.T) {
+		// neither option is equal to the segment time, so no metrics should be
+		// reported
+		opts.activePeriodStart = otherTime
+		opts.activePeriodEnd = otherTime
+		a.reportPrecomputedQueryMetrics(context.Background(), segmentTime, opts)
+
+		data := metricsSink.Data()
+		hasNoMetric(t, data, "identity.entity.active.monthly")
+		hasNoMetric(t, data, "identity.nonentity.active.monthly")
+		hasNoMetric(t, data, "identity.secret_sync.active.monthly")
+		hasNoMetric(t, data, "identity.entity.active.reporting_period")
+		hasNoMetric(t, data, "identity.entity.active.reporting_period")
+		hasNoMetric(t, data, "identity.secret_sync.active.reporting_period")
+	})
+
+	t.Run("monthly metric", func(t *testing.T) {
+		// activePeriodEnd is equal to the segment time, indicating that monthly
+		// metrics should be reported
+		opts.activePeriodEnd = segmentTime
+		opts.activePeriodStart = otherTime
+		a.reportPrecomputedQueryMetrics(context.Background(), segmentTime, opts)
+
+		data := metricsSink.Data()
+		// expect the metrics ending with "monthly"
+		// the namespace was never registered in core, so it'll be
+		// reported with a "deleted-" prefix
+		for i := 0; i < 3; i++ {
+			ns := fmt.Sprintf("deleted-ns-%d", i)
+			hasMetric(t, data, "identity.entity.active.monthly", 1, &ns)
+			hasMetric(t, data, "identity.nonentity.active.monthly", 1, &ns)
+		}
+		// secret sync metrics should be the sum of clients across all
+		// namespaces
+		hasMetric(t, data, "identity.secret_sync.active.monthly", 3, nil)
+		hasMetric(t, data, "identity.pki_acme.active.monthly", 3, nil)
+	})
+
+	t.Run("reporting period metric", func(t *testing.T) {
+		// activePeriodEnd is not equal to the segment time but activePeriodStart
+		// is, which indicates that metrics for the reporting period should be
+		// reported
+		opts.activePeriodEnd = otherTime
+		opts.activePeriodStart = segmentTime
+		a.reportPrecomputedQueryMetrics(context.Background(), segmentTime, opts)
+
+		data := metricsSink.Data()
+		// expect the metrics ending with "reporting_period"
+		// the namespace was never registered in core, so it'll be
+		// reported with a "deleted-" prefix
+		for i := 0; i < 3; i++ {
+			ns := fmt.Sprintf("deleted-ns-%d", i)
+			hasMetric(t, data, "identity.entity.active.reporting_period", 1, &ns)
+			hasMetric(t, data, "identity.nonentity.active.reporting_period", 1, &ns)
+		}
+		// secret sync metrics should be the sum of clients across all
+		// namespaces
+		hasMetric(t, data, "identity.secret_sync.active.reporting_period", 3, nil)
+		hasMetric(t, data, "identity.pki_acme.active.reporting_period", 3, nil)
+	})
+}
+
+// TestActivityLog_Export_CSV_Header verifies that the export API properly
+// generates a CSV column index and header. Various ActivityLogExportRecords
+// are used to mimic an export discovering new map and slice fields that are
+// meant to be flattened as new columns.
+func TestActivityLog_Export_CSV_Header(t *testing.T) {
+	encoder, err := newCSVEncoder(nil)
+	require.NoError(t, err)
+
+	expectedColumnIndex := make(map[string]int)
+
+	// set expected index as base columnIndex upon encoder initialization
+	for k, v := range encoder.columnIndex {
+		expectedColumnIndex[k] = v
+	}
+
+	err = encoder.accumulateHeaderFields(&ActivityLogExportRecord{
+		Policies: []string{
+			"foo",
+		},
+		EntityMetadata: map[string]string{
+			"email_address": "jdoe@abc.com",
+		},
+	})
+	require.NoError(t, err)
+
+	expectedColumnIndex["policies.0"] = exportCSVFlatteningInitIndex
+	expectedColumnIndex["entity_metadata.email_address"] = exportCSVFlatteningInitIndex
+
+	require.Empty(t, deep.Equal(expectedColumnIndex, encoder.columnIndex))
+
+	err = encoder.accumulateHeaderFields(&ActivityLogExportRecord{
+		Policies: []string{
+			"foo",
+			"bar",
+			"baz",
+		},
+		EntityAliasCustomMetadata: map[string]string{
+			"region": "west",
+			"group":  "san_francisco",
+		},
+	})
+	require.NoError(t, err)
+
+	expectedColumnIndex["policies.1"] = exportCSVFlatteningInitIndex
+	expectedColumnIndex["policies.2"] = exportCSVFlatteningInitIndex
+	expectedColumnIndex["entity_alias_custom_metadata.group"] = exportCSVFlatteningInitIndex
+	expectedColumnIndex["entity_alias_custom_metadata.region"] = exportCSVFlatteningInitIndex
+
+	require.Empty(t, deep.Equal(expectedColumnIndex, encoder.columnIndex))
+
+	err = encoder.accumulateHeaderFields(&ActivityLogExportRecord{
+		Policies: []string{
+			"foo",
+		},
+		EntityGroupIDs: []string{
+			"97798e02-51e5-4ef3-906e-82c76d1a396e",
+		},
+		EntityMetadata: map[string]string{
+			"first_name": "John",
+			"last_name":  "Doe",
+		},
+		EntityAliasMetadata: map[string]string{
+			"contact_email": "foo@abc.com",
+		},
+	})
+	require.NoError(t, err)
+
+	expectedColumnIndex["entity_metadata.last_name"] = exportCSVFlatteningInitIndex
+	expectedColumnIndex["entity_metadata.first_name"] = exportCSVFlatteningInitIndex
+	expectedColumnIndex["entity_alias_metadata.contact_email"] = exportCSVFlatteningInitIndex
+	expectedColumnIndex["entity_group_ids.0"] = exportCSVFlatteningInitIndex
+
+	require.Empty(t, deep.Equal(expectedColumnIndex, encoder.columnIndex))
+
+	// no change because all the fields have seen before
+	err = encoder.accumulateHeaderFields(&ActivityLogExportRecord{
+		EntityAliasCustomMetadata: map[string]string{
+			"group":  "does-not-matter",
+			"region": "does-not-matter",
+		},
+		EntityAliasMetadata: map[string]string{
+			"contact_email": "does-not-matter",
+		},
+		EntityGroupIDs: []string{
+			"does-not-matter",
+		},
+		EntityMetadata: map[string]string{
+			"first_name": "does-not-matter",
+			"last_name":  "does-not-matter",
+		},
+		Policies: []string{
+			"does-not-matter",
+			"does-not-matter",
+			"does-not-matter",
+		},
+	})
+	require.NoError(t, err)
+	require.Empty(t, deep.Equal(expectedColumnIndex, encoder.columnIndex))
+
+	// no change because there are no slice or map fields
+	err = encoder.accumulateHeaderFields(&ActivityLogExportRecord{})
+	require.NoError(t, err)
+	require.Empty(t, deep.Equal(expectedColumnIndex, encoder.columnIndex))
+
+	expectedHeader := append(baseActivityExportCSVHeader(),
+		"entity_alias_custom_metadata.group",
+		"entity_alias_custom_metadata.region",
+		"entity_alias_metadata.contact_email",
+		"entity_group_ids.0",
+		"entity_metadata.email_address",
+		"entity_metadata.first_name",
+		"entity_metadata.last_name",
+		"policies.0",
+		"policies.1",
+		"policies.2")
+
+	header := encoder.generateHeader()
+	require.Empty(t, deep.Equal(expectedHeader, header))
+
+	expectedColumnIndex = make(map[string]int)
+
+	for idx, col := range expectedHeader {
+		expectedColumnIndex[col] = idx
+	}
+
+	require.Empty(t, deep.Equal(expectedColumnIndex, encoder.columnIndex))
+}
+
+// TestActivityLog_partialMonthClientCountUsingWriteExport verifies that the writeExport
+// method returns the same number of clients when queried with a start_time that is at
+// different times during the same month.
+func TestActivityLog_partialMonthClientCountUsingWriteExport(t *testing.T) {
+	ctx := namespace.RootContext(nil)
+	now := time.Now().UTC()
+	a, expectedClients, _ := setupActivityRecordsInStorage(t, timeutil.StartOfMonth(now), true, true)
+
+	// clients[0] belongs to previous month
+	// the rest belong to the current month
+	expectedCurrentMonthClients := expectedClients[1:]
+
+	type record struct {
+		ClientID          string `json:"client_id"`
+		NamespaceID       string `json:"namespace_id"`
+		TokenCreationTime string `json:"token_creation_time"`
+		NonEntity         bool   `json:"non_entity"`
+		MountAccessor     string `json:"mount_accessor"`
+		ClientType        string `json:"client_type"`
+	}
+
+	startOfMonth := timeutil.StartOfMonth(now)
+	endOfMonth := timeutil.EndOfMonth(now)
+	middleOfMonth := startOfMonth.Add(endOfMonth.Sub(startOfMonth) / 2)
+	testCases := []struct {
+		name               string
+		requestedStartTime time.Time
+	}{
+		{
+			name:               "start time is the start of the current month",
+			requestedStartTime: startOfMonth,
+		},
+		{
+			name:               "start time is the middle of the current month",
+			requestedStartTime: middleOfMonth,
+		},
+		{
+			name:               "start time is the end of the current month",
+			requestedStartTime: endOfMonth,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			rw := &fakeResponseWriter{
+				buffer:  &bytes.Buffer{},
+				headers: http.Header{},
+			}
+
+			// Test different start times but keep the end time at the end of the current month
+			// Start time of any timestamp within the current month should result in the same output from the export API
+			if err := a.writeExport(ctx, rw, "json", tc.requestedStartTime, endOfMonth); err != nil {
+				t.Fatal(err)
+			}
+
+			// Convert the json objects from the buffer and compare the results
+			var results []record
+			jsonObjects := strings.Split(strings.TrimSpace(rw.buffer.String()), "\n")
+			for _, jsonObject := range jsonObjects {
+				if jsonObject == "" {
+					continue
+				}
+
+				var result record
+				if err := json.Unmarshal([]byte(jsonObject), &result); err != nil {
+					t.Fatalf("Error unmarshaling JSON object: %v\nJSON: %s", err, jsonObject)
+				}
+				results = append(results, result)
+			}
+
+			// Compare expectedClients with actualClients
+			for i := range expectedCurrentMonthClients {
+				resultTimeStamp, err := time.Parse(time.RFC3339, results[i].TokenCreationTime)
+				require.NoError(t, err)
+				require.Equal(t, expectedCurrentMonthClients[i].ClientID, results[i].ClientID)
+				require.Equal(t, expectedCurrentMonthClients[i].NamespaceID, results[i].NamespaceID)
+				require.Equal(t, expectedCurrentMonthClients[i].Timestamp, resultTimeStamp.Unix())
+				require.Equal(t, expectedCurrentMonthClients[i].NonEntity, results[i].NonEntity)
+				require.Equal(t, expectedCurrentMonthClients[i].MountAccessor, results[i].MountAccessor)
+				require.Equal(t, expectedCurrentMonthClients[i].ClientType, results[i].ClientType)
+			}
+		})
+	}
+}
+
+// TestValidate_CountersResponses validates the responses schema of counters endpoints
+func TestValidate_CountersResponses(t *testing.T) {
+	core, b, _ := testCoreSystemBackend(t)
+	view := core.systemBarrierView
+
+	testCases := []struct {
+		operationType string
+		path          string
+	}{
+		{
+			operationType: logical.UpdateOperation,
+			path:          "internal/counters/config",
+		},
+		{
+			operationType: logical.ReadOperation,
+			path:          "internal/counters/config",
+		},
+		{
+			operationType: logical.ReadOperation,
+			path:          "internal/counters/activity",
+		},
+		{
+			operationType: logical.ReadOperation,
+			path:          "internal/counters/activity/export",
+		},
+		{
+			operationType: logical.ReadOperation,
+			path:          "internal/counters/activity/monthly",
+		},
+	}
+
+	for _, tc := range testCases {
+		// validate the schema definition of responses
+		req := logical.TestRequest(t, logical.Operation(tc.operationType), tc.path)
+		req.Storage = view
+		resp, err := b.HandleRequest(namespace.RootContext(context.TODO()), req)
+		schema.ValidateResponse(
+			t,
+			schema.GetResponseSchema(t, b.(*SystemBackend).Route(req.Path), req.Operation),
+			resp,
+			true,
+		)
+		require.NoError(t, err)
+	}
+}
diff --git a/vault/activity_log_testing_util.go b/vault/activity_log_testing_util.go
index 600da787c05..8a6bb861d7b 100644
--- a/vault/activity_log_testing_util.go
+++ b/vault/activity_log_testing_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -12,6 +12,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/hashicorp/vault/helper/constants"
+	"github.com/hashicorp/vault/helper/timeutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault/activity"
 	"google.golang.org/protobuf/testing/protocmp"
@@ -115,7 +116,7 @@ func (a *ActivityLog) SetStandbyEnable(ctx context.Context, enabled bool) {
 	// TODO only patch enabled?
 	a.SetConfigStandby(ctx, activityConfig{
 		DefaultReportMonths: 12,
-		RetentionMonths:     24,
+		RetentionMonths:     ActivityLogMinimumRetentionMonths,
 		Enabled:             enableStr,
 	})
 }
@@ -247,3 +248,10 @@ func (a *ActivityLog) GetEnabled() bool {
 func (c *Core) GetActivityLog() *ActivityLog {
 	return c.activityLog
 }
+
+// SetClock sets the clock on the activity log. This is used for testing with mock clocks
+func (a *ActivityLog) SetClock(clock timeutil.Clock) {
+	a.l.Lock()
+	defer a.l.Unlock()
+	a.clock = clock
+}
diff --git a/vault/activity_log_testonly_oss_test.go b/vault/activity_log_testonly_oss_test.go
new file mode 100644
index 00000000000..fc3fdef6fd6
--- /dev/null
+++ b/vault/activity_log_testonly_oss_test.go
@@ -0,0 +1,184 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build testonly && !enterprise
+
+package vault
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/armon/go-metrics"
+	"github.com/hashicorp/vault/helper/metricsutil"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
+	"github.com/hashicorp/vault/helper/timeutil"
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/stretchr/testify/require"
+)
+
+// TestActivityLog_setupClientIDsUsageInfo_CE verifies that upon startup, the client IDs are not loaded in CE
+func TestActivityLog_setupClientIDsUsageInfo_CE(t *testing.T) {
+	core, _, _ := TestCoreUnsealed(t)
+	a := core.activityLog
+	a.SetEnable(true)
+
+	core.setupClientIDsUsageInfo(context.Background())
+
+	// wait for clientIDs to be loaded into memory
+	verifyClientsLoadedInMemory := func() {
+		corehelpers.RetryUntil(t, 60*time.Second, func() error {
+			if a.GetClientIDsUsageInfoLoaded() {
+				return fmt.Errorf("loaded clientIDs to memory")
+			}
+			return nil
+		})
+	}
+	verifyClientsLoadedInMemory()
+
+	require.Len(t, a.GetClientIDsUsageInfo(), 0)
+}
+
+// TestGetStartEndTime_EndTimeAdjustedToPastMonth tests getStartEndTime for proper adjustment of given end time to past month
+func TestGetStartEndTime_EndTimeAdjustedToPastMonth(t *testing.T) {
+	now := time.Now().UTC()
+	currentMonthStart := timeutil.StartOfMonth(now)
+	previousMonthEnd := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now))
+
+	// billing start time is zero for CE
+	billingStartTime := time.Time{}
+	sixMonthsAgo := now.AddDate(0, -6, 0)
+
+	tests := []struct {
+		name           string
+		givenStartTime time.Time
+		givenEndTime   time.Time
+		expectedStart  time.Time
+		expectedEnd    time.Time
+		expectWarning  bool
+		expectErr      bool
+	}{
+		{
+			name:           "End time in the past is unchanged",
+			givenStartTime: sixMonthsAgo,
+			givenEndTime:   now.AddDate(0, -1, -1),
+			expectedStart:  sixMonthsAgo,
+			expectedEnd:    now.AddDate(0, -1, -1).UTC(),
+			expectWarning:  false,
+			expectErr:      false,
+		},
+		{
+			name:           "End time in the current month is clamped to previous month",
+			givenStartTime: sixMonthsAgo,
+			givenEndTime:   currentMonthStart.AddDate(0, 0, 5).Add(2 * time.Hour),
+			expectedStart:  sixMonthsAgo,
+			expectedEnd:    previousMonthEnd,
+			expectWarning:  true,
+			expectErr:      false,
+		},
+		{
+			name:           "End time in the future is clamped to previous month",
+			givenStartTime: sixMonthsAgo,
+			givenEndTime:   now.AddDate(0, 1, 0),
+			expectedStart:  sixMonthsAgo,
+			expectedEnd:    previousMonthEnd,
+			expectWarning:  true,
+			expectErr:      false,
+		},
+		{
+			name:           "End time is zero and gets clamped to previous month",
+			givenStartTime: sixMonthsAgo,
+			givenEndTime:   time.Time{},
+			expectedStart:  sixMonthsAgo,
+			expectedEnd:    previousMonthEnd,
+			expectWarning:  true,
+			expectErr:      false,
+		},
+		{
+			name:           "Start time after end time causes error",
+			givenStartTime: now.AddDate(0, 2, 0),
+			givenEndTime:   now.AddDate(0, 1, 0),
+			expectWarning:  false,
+			expectErr:      true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			d := &framework.FieldData{
+				Schema: map[string]*framework.FieldSchema{
+					"start_time": {
+						Type: framework.TypeTime,
+					},
+					"end_time": {
+						Type: framework.TypeTime,
+					},
+				},
+				Raw: map[string]any{
+					"start_time": tc.givenStartTime.Format(time.RFC3339Nano),
+					"end_time":   tc.givenEndTime.Format(time.RFC3339Nano),
+				},
+			}
+
+			start, end, warnings, err := getStartEndTime(d, time.Now(), billingStartTime)
+
+			if tc.expectErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			require.WithinDuration(t, tc.expectedStart, start, time.Second, "Expected start time did not match")
+			require.WithinDuration(t, tc.expectedEnd, end, time.Second, "Expected end time did not match")
+			require.Equal(t, tc.expectWarning, warnings.EndTimeAdjustedToPastMonth)
+		})
+	}
+}
+
+// TestActivityLog_GetBillingPeriodActivityTelemetryMetric_CE verifies that vault.client.billing_period.activity is not emitted in ce
+func TestActivityLog_GetBillingPeriodActivityTelemetryMetric_CE(t *testing.T) {
+	inMemSink := metrics.NewInmemSink(1*time.Second, 10000*time.Hour)
+	sink := metricsutil.NewClusterMetricSink("test", inMemSink)
+	testClusterName := "test-cluster"
+	config := &CoreConfig{
+		MetricSink: sink,
+		ActivityLogConfig: ActivityLogCoreConfig{
+			ForceEnable:   true,
+			DisableTimers: true,
+		},
+	}
+	core, _, _ := TestCoreUnsealedWithConfig(t, config)
+	a := core.activityLog
+	a.SetEnable(true)
+
+	core.setupClientIDsUsageInfo(context.Background())
+
+	// wait for clientIDs to be loaded into memory
+	verifyClientsLoadedInMemory := func() {
+		corehelpers.RetryUntil(t, 60*time.Second, func() error {
+			if a.GetClientIDsUsageInfoLoaded() {
+				return fmt.Errorf("loaded clientIDs to memory")
+			}
+			return nil
+		})
+	}
+	verifyClientsLoadedInMemory()
+
+	require.Len(t, a.GetClientIDsUsageInfo(), 0)
+
+	// verify telemetry metric value client.billing_period.activity
+	intervals := inMemSink.Data()
+
+	// Test crossed an interval boundary, don't try to deal with it.
+	// If we start close to the end of an interval, metrics will be split across two buckets
+	if len(intervals) > 1 {
+		t.Skip("Detected interval crossing.")
+	}
+
+	// vault.client.billing_period.activity should not be present in ce
+	fullMetricName := fmt.Sprintf("client.billing_period.activity;cluster=%s", testClusterName)
+	_, ok := intervals[0].Gauges[fullMetricName]
+	require.False(t, ok)
+}
diff --git a/vault/activity_log_testonly_test.go b/vault/activity_log_testonly_test.go
new file mode 100644
index 00000000000..32b9e5dc937
--- /dev/null
+++ b/vault/activity_log_testonly_test.go
@@ -0,0 +1,200 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build testonly
+
+package vault
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/timeutil"
+	"github.com/hashicorp/vault/sdk/helper/clientcountutil"
+	"github.com/hashicorp/vault/sdk/helper/clientcountutil/generation"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+)
+
+// TestActivityLog_doPrecomputedQueryCreation creates segments for the last 4
+// months and then calls doPrecomputedQueryCreation, in order of oldest to most
+// recent month. The test verifies that the count of clients in the generated
+// precomputed query is equal to the number of deduplicated clients.
+func TestActivityLog_doPrecomputedQueryCreation(t *testing.T) {
+	core, _, token := TestCoreUnsealed(t)
+	a := core.activityLog
+	a.SetEnable(true)
+
+	j, err := clientcountutil.NewActivityLogData(nil).
+		// 8 new clients
+		// across two segments
+		NewPreviousMonthData(4).
+		Segment().NewClientsSeen(5).
+		Segment().NewClientsSeen(3).
+
+		// 2 repeated clients
+		// 10 new clients
+		// across 3 segments
+		NewPreviousMonthData(3).
+		Segment().RepeatedClientsSeen(2).
+		NewClientsSeen(3).
+		Segment().NewClientsSeen(2).
+		Segment().NewClientsSeen(5).
+
+		// 7 new clients
+		// single segment
+		NewPreviousMonthData(2).
+		NewClientsSeen(7).
+
+		// 6 repeated clients
+		// 5 new clients
+		// across 2 segments
+		NewPreviousMonthData(1).
+		Segment().NewClientsSeen(5).
+		Segment().RepeatedClientsSeen(6).
+		ToJSON(generation.WriteOptions_WRITE_ENTITIES)
+	require.NoError(t, err)
+
+	r := logical.TestRequest(t, logical.UpdateOperation, "sys/internal/counters/activity/write")
+	r.Data["input"] = string(j)
+	r.ClientToken = token
+	_, err = core.HandleRequest(namespace.RootContext(context.Background()), r)
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+	times := map[int]time.Time{}
+	for i := 1; i < 5; i++ {
+		times[i] = timeutil.StartOfMonth(timeutil.MonthsPreviousTo(i, now))
+	}
+
+	testCases := []struct {
+		name              string
+		generateUpToMonth int
+		strictEnforcement bool
+		wantClients       int
+	}{
+		{
+			name:              "only 4 months ago",
+			generateUpToMonth: 4,
+			wantClients:       8, // 8 clients from month 4
+		},
+		{
+			name:              "3 months ago",
+			generateUpToMonth: 3,
+			// 8 clients (month 4) + 10 new clients (month 3)
+			wantClients: 18,
+		},
+		{
+			name:              "2 months ago",
+			generateUpToMonth: 2,
+			// 8 clients (month 4) + 10 new clients (month 3) + 7 new clients
+			// (month 2)
+			wantClients: 25,
+		},
+		{
+			name:              "1 month ago",
+			generateUpToMonth: 1,
+			// 8 clients (month 4) + 10 new clients (month 3) + 7 new clients
+			// (month 2) + 5 new clients (month 1)
+			wantClients: 30,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			generateUpTo := times[tc.generateUpToMonth]
+			nextMonth := timeutil.StartOfNextMonth(generateUpTo)
+			err = a.precomputedQueryWorker(context.Background(), &ActivityIntentLog{PreviousMonth: generateUpTo.Unix(), NextMonth: nextMonth.Unix()})
+			require.NoError(t, err)
+
+			// get precomputed queries spanning the whole time period
+			pq, err := a.queryStore.Get(context.Background(), times[4], now)
+			require.NoError(t, err)
+			require.Equal(t, tc.wantClients, int(pq.Namespaces[0].Entities))
+		})
+	}
+}
+
+// TestActivityLog_getClientIDsForStartTime verifies getClientIDsForStartTime function.
+// It adds data for 4 months previous to the current month and verifies if the correct number of clientIDs are returned based on the startTime.
+func TestActivityLog_getClientIDsForStartTime(t *testing.T) {
+	core, _, token := TestCoreUnsealed(t)
+	a := core.activityLog
+	a.SetEnable(true)
+
+	j, err := clientcountutil.NewActivityLogData(nil).
+		// 8 new clients
+		// across two segments
+		NewPreviousMonthData(4).
+		Segment().NewClientsSeen(5).
+		Segment().NewClientsSeen(3).
+
+		// 2 repeated clients
+		// 10 new clients
+		// across 3 segments
+		NewPreviousMonthData(3).
+		Segment().RepeatedClientsSeen(2).
+		NewClientsSeen(3).
+		Segment().NewClientsSeen(2).
+		Segment().NewClientsSeen(5).
+
+		// 7 new clients
+		// single segment
+		NewPreviousMonthData(2).
+		NewClientsSeen(7).
+
+		// 6 repeated clients
+		// 5 new clients
+		// across 2 segments
+		NewPreviousMonthData(1).
+		Segment().NewClientsSeen(5).
+		Segment().RepeatedClientsSeen(6).
+		ToJSON(generation.WriteOptions_WRITE_ENTITIES)
+	require.NoError(t, err)
+
+	r := logical.TestRequest(t, logical.UpdateOperation, "sys/internal/counters/activity/write")
+	r.Data["input"] = string(j)
+	r.ClientToken = token
+	_, err = core.HandleRequest(namespace.RootContext(context.Background()), r)
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+	times := map[int]time.Time{}
+	for i := 1; i < 5; i++ {
+		times[i] = timeutil.StartOfMonth(timeutil.MonthsPreviousTo(i, now))
+	}
+	testCases := []struct {
+		name            string
+		startTime       time.Time
+		expectedClients int
+	}{
+		{
+			name:            "startTime 4 months ago",
+			startTime:       times[4],
+			expectedClients: 8, // 8 clients from month 4
+		},
+		{
+			name:            "startTime 3 months ago",
+			startTime:       times[3],
+			expectedClients: 12, // 12 clients from month 3
+		},
+		{
+			name:            "startTime 2 months ago",
+			startTime:       times[2],
+			expectedClients: 7, // 7 clients from month 2
+		},
+		{
+			name:            "startTime 1 months ago",
+			startTime:       times[1],
+			expectedClients: 11, // 11 clients from last month
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			clientIDsMap, err := core.activityLog.getClientIDsForStartTime(context.Background(), make(map[string]struct{}), tc.startTime)
+			require.NoError(t, err)
+			require.Len(t, clientIDsMap, tc.expectedClients)
+		})
+	}
+}
diff --git a/vault/activity_log_util.go b/vault/activity_log_util.go
index a3a9d2b9c1b..eed3e7c6db0 100644
--- a/vault/activity_log_util.go
+++ b/vault/activity_log_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -8,6 +8,10 @@ package vault
 import (
 	"context"
 	"time"
+
+	"github.com/hashicorp/vault/helper/metricsutil"
+	"github.com/hashicorp/vault/helper/timeutil"
+	"github.com/hashicorp/vault/sdk/framework"
 )
 
 // sendCurrentFragment is a no-op on OSS
@@ -15,5 +19,33 @@ func (a *ActivityLog) sendCurrentFragment(ctx context.Context) error {
 	return nil
 }
 
-// CensusReport is a no-op on OSS
-func (a *ActivityLog) CensusReport(context.Context, CensusReporter, time.Time) {}
+// setupClientIDsUsageInfo is a no-op on OSS
+func (c *Core) setupClientIDsUsageInfo(ctx context.Context) {
+}
+
+// handleClientIDsInMemoryEndOfMonth is a no-op on OSS
+func (a *ActivityLog) handleClientIDsInMemoryEndOfMonth(ctx context.Context, currentTime time.Time) {
+}
+
+// getStartEndTime parses input for start and end times
+// If the end time is after the end of last month, it is adjusted to the last month
+func getStartEndTime(d *framework.FieldData, now time.Time, billingStartTime time.Time) (time.Time, time.Time, StartEndTimesWarnings, error) {
+	warnings := StartEndTimesWarnings{}
+	startTime, endTime, err := parseStartEndTimes(d, billingStartTime)
+	if err != nil {
+		return startTime, endTime, warnings, err
+	}
+	// ensure end time is adjusted to the past month if it falls within the current month
+	// or is in a future month
+	if !endTime.Before(timeutil.StartOfMonth(now.UTC())) {
+		endTime = timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, timeutil.StartOfMonth(now.UTC())))
+		warnings.EndTimeAdjustedToPastMonth = true
+	}
+
+	return startTime, endTime, warnings, nil
+}
+
+// clientsGaugeCollectorCurrentBillingPeriod is no-op on CE
+func (c *Core) clientsGaugeCollectorCurrentBillingPeriod(ctx context.Context) ([]metricsutil.GaugeLabelValues, error) {
+	return []metricsutil.GaugeLabelValues{}, nil
+}
diff --git a/vault/activity_log_util_common.go b/vault/activity_log_util_common.go
index 152da93a974..6e876025e42 100644
--- a/vault/activity_log_util_common.go
+++ b/vault/activity_log_util_common.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -8,73 +8,91 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"slices"
 	"sort"
 	"strings"
 	"time"
 
-	"github.com/axiomhq/hyperloglog"
 	"github.com/hashicorp/vault/helper/timeutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault/activity"
 	"google.golang.org/protobuf/proto"
 )
 
-type HLLGetter func(ctx context.Context, startTime time.Time) (*hyperloglog.Sketch, error)
-
-// computeCurrentMonthForBillingPeriod computes the current month's data with respect
-// to a billing period.
-func (a *ActivityLog) computeCurrentMonthForBillingPeriod(ctx context.Context, byMonth map[int64]*processMonth, startTime time.Time, endTime time.Time) (*activity.MonthRecord, error) {
-	return a.computeCurrentMonthForBillingPeriodInternal(ctx, byMonth, a.CreateOrFetchHyperlogLog, startTime, endTime)
-}
-
-// CreateOrFetchHyperlogLog creates a new hyperlogLog for each startTime (month) if it does not exist in storage.
-// hyperlogLog is used here to solve count-distinct problem i.e, to count the number of distinct clients
-// In activity log, hyperloglog is a sketch containing clientID's in a given month
-func (a *ActivityLog) CreateOrFetchHyperlogLog(ctx context.Context, startTime time.Time) (*hyperloglog.Sketch, error) {
-	monthlyHLLPath := fmt.Sprintf("%s%d", distinctClientsBasePath, startTime.Unix())
-	hll := hyperloglog.New()
-	data, err := a.view.Get(ctx, monthlyHLLPath)
-	if err != nil {
-		// If there is no hll, we should log the error, as having this fire multiple times
-		// is a sign that something is wrong with hll store/get. However, this is not a
-		// critical failure (in fact it is expected during the first month rotation after
-		// this code is deployed), so we will not throw an error.
-		a.logger.Warn("fetch of hyperloglog threw an error at path", monthlyHLLPath, "error", err)
+// computeClientsInBillingPeriod computes the clients in a billing period given a start and end time.
+// It retrieves the precomputed query data for the specified period, and if the current month is included,
+// it computes the current month's data by aggregating the activity log fragments. It returns the counts
+// separated by namespace as well as the total counts for the billing period.
+func (a *ActivityLog) computeClientsInBillingPeriod(ctx context.Context, startTime time.Time, endTime time.Time) (*activity.PrecomputedQuery, error) {
+	var computePartial bool
+
+	// If the endTime of the query is the current month, request data from the queryStore
+	// with the endTime equal to the end of the last month, and add in the current month
+	// data.
+	precomputedQueryEndTime := endTime
+	if timeutil.IsCurrentMonth(endTime, a.clock.Now().UTC()) {
+		precomputedQueryEndTime = timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, timeutil.StartOfMonth(endTime)))
+		computePartial = true
 	}
-	if data == nil {
-		a.logger.Trace("creating hyperloglog ", "path", monthlyHLLPath)
-		err = a.StoreHyperlogLog(ctx, startTime, hll)
-		if err != nil {
-			return hll, fmt.Errorf("error storing hyperloglog at path %s: error %w", monthlyHLLPath, err)
+
+	pq := &activity.PrecomputedQuery{}
+	if startTime.After(precomputedQueryEndTime) && timeutil.IsCurrentMonth(startTime, a.clock.Now().UTC()) {
+		// We're only calculating the partial month client count. Skip the precomputation
+		// get call.
+		pq = &activity.PrecomputedQuery{
+			StartTime:  startTime,
+			EndTime:    endTime,
+			Namespaces: make([]*activity.NamespaceRecord, 0),
+			Months:     make([]*activity.MonthRecord, 0),
 		}
 	} else {
-		err = hll.UnmarshalBinary(data.Value)
+		storedQuery, err := a.queryStore.Get(ctx, startTime, precomputedQueryEndTime)
 		if err != nil {
-			return hll, fmt.Errorf("error unmarshaling hyperloglog at path %s: error %w", monthlyHLLPath, err)
+			return nil, err
+		}
+		if storedQuery == nil {
+			// If the storedQuery is nil, that means there's no historical data to process. But, it's possible there's
+			// still current month data to process, so rather than returning a 204, let's proceed along like we're
+			// just querying the current month.
+			storedQuery = &activity.PrecomputedQuery{
+				StartTime:  startTime,
+				EndTime:    endTime,
+				Namespaces: make([]*activity.NamespaceRecord, 0),
+				Months:     make([]*activity.MonthRecord, 0),
+			}
 		}
+		pq = storedQuery
 	}
-	return hll, nil
-}
 
-// StoreHyperlogLog stores the hyperloglog (a sketch containing client IDs) for startTime (month) in storage
-func (a *ActivityLog) StoreHyperlogLog(ctx context.Context, startTime time.Time, newHll *hyperloglog.Sketch) error {
-	monthlyHLLPath := fmt.Sprintf("%s%d", distinctClientsBasePath, startTime.Unix())
-	a.logger.Trace("storing hyperloglog ", "path", monthlyHLLPath)
-	marshalledHll, err := newHll.MarshalBinary()
-	if err != nil {
-		return err
-	}
-	err = a.view.Put(ctx, &logical.StorageEntry{
-		Key:   monthlyHLLPath,
-		Value: marshalledHll,
-	})
-	if err != nil {
-		return err
+	var partialByMonth map[int64]*processMonth
+	if computePartial {
+		// Traverse through current month's activitylog data and group clients
+		// into months and namespaces
+		a.fragmentLock.RLock()
+		partialByMonth, _ = a.populateNamespaceAndMonthlyBreakdowns()
+		a.fragmentLock.RUnlock()
+
+		// Estimate the current month totals. These record contains is complete with all the
+		// current month data, grouped by namespace and mounts
+		currentMonth, err := a.computeCurrentMonthForBillingPeriod(partialByMonth, startTime, endTime)
+		if err != nil {
+			return nil, err
+		}
+
+		// Combine the existing months precomputed query with the current month data
+		pq.CombineWithCurrentMonth(currentMonth)
 	}
-	return nil
+
+	return pq, nil
+}
+
+// computeCurrentMonthForBillingPeriod computes the current month's data with respect
+// to a billing period.
+func (a *ActivityLog) computeCurrentMonthForBillingPeriod(byMonth map[int64]*processMonth, startTime time.Time, endTime time.Time) (*activity.MonthRecord, error) {
+	return a.computeCurrentMonthForBillingPeriodInternal(byMonth, startTime, endTime)
 }
 
-func (a *ActivityLog) computeCurrentMonthForBillingPeriodInternal(ctx context.Context, byMonth map[int64]*processMonth, hllGetFunc HLLGetter, startTime time.Time, endTime time.Time) (*activity.MonthRecord, error) {
+func (a *ActivityLog) computeCurrentMonthForBillingPeriodInternal(byMonth map[int64]*processMonth, startTime time.Time, endTime time.Time) (*activity.MonthRecord, error) {
 	if timeutil.IsCurrentMonth(startTime, a.clock.Now().UTC()) {
 		monthlyComputation := a.transformMonthBreakdowns(byMonth)
 		if len(monthlyComputation) > 1 {
@@ -84,88 +102,154 @@ func (a *ActivityLog) computeCurrentMonthForBillingPeriodInternal(ctx context.Co
 			return monthlyComputation[0], nil
 		}
 	}
-	// Fetch all hyperloglogs for months from startMonth to endMonth. If a month doesn't have an associated
-	// hll, warn and continue.
-
-	// hllMonthlyTimestamp is the start time of the month corresponding to which a hyperloglog of that month's
-	// client data is stored. The path at which the hyperloglog for a month is stored containes this timestamp.
-	hllMonthlyTimestamp := timeutil.StartOfMonth(startTime)
-	billingPeriodHLL := hyperloglog.New()
-	for hllMonthlyTimestamp.Before(timeutil.StartOfMonth(endTime)) {
-		monthSketch, err := hllGetFunc(ctx, hllMonthlyTimestamp)
-		// If there's an error with the hyperloglog fetch, we should still deduplicate on
-		// the hlls that we have so we will warn that we couldn't find a hll for the month
-		// and continue.
-		if err != nil {
-			a.logger.Warn("no hyperloglog associated with timestamp", "timestamp", hllMonthlyTimestamp)
-			hllMonthlyTimestamp = timeutil.StartOfNextMonth(hllMonthlyTimestamp)
-			continue
-		}
-		// Union the monthly hll into the billing period's hll
-		err = billingPeriodHLL.Merge(monthSketch)
-		if err != nil {
-			// In this case we can't afford to fail silently. Since this error indicates
-			// data corruption, we should not try to do any further deduplication
-			return nil, err
-		}
-		hllMonthlyTimestamp = timeutil.StartOfNextMonth(hllMonthlyTimestamp)
-	}
+
 	// There's at most one month of data here. We should validate this assumption explicitly
 	if len(byMonth) > 1 {
 		return nil, errors.New(fmt.Sprintf("multiple months of data found in partial month's client count breakdowns: %+v\n", byMonth))
 	}
 
-	activityTypes := []string{entityActivityType, nonEntityTokenActivityType, secretSyncActivityType}
+	// counts including new clients and old clients
+	totalCounts := &activity.CountsRecord{}
+	// new client counts
+	newCounts := &activity.CountsRecord{}
+	// namespaces of new clients
+	newNamespaces := make([]*activity.MonthlyNamespaceRecord, 0)
+	// namespaces including both namespaces with new and repeated clients
+	totalNamespaces := make([]*activity.MonthlyNamespaceRecord, 0)
+
+	monthRecord := &activity.MonthRecord{
+		Timestamp:  timeutil.StartOfMonth(endTime).UTC().Unix(),
+		Counts:     totalCounts,
+		Namespaces: totalNamespaces,
+		NewClients: &activity.NewClientRecord{
+			Counts:     newCounts,
+			Namespaces: newNamespaces,
+		},
+	}
+	if len(byMonth) == 0 {
+		return monthRecord, nil
+	}
 
-	// Now we will add the clients for the current month to a copy of the billing period's hll to
-	// see how the cardinality grows.
-	hllByType := make(map[string]*hyperloglog.Sketch, len(activityTypes))
-	totalByType := make(map[string]int, len(activityTypes))
-	for _, typ := range activityTypes {
-		hllByType[typ] = billingPeriodHLL.Clone()
+	// we've already checked that byMonth has length of 1, so this will get the
+	// value of the only entry in the map
+	var month *processMonth
+	for _, month = range byMonth {
 	}
 
-	for _, month := range byMonth {
-		if month.NewClients == nil || month.NewClients.Counts == nil || month.Counts == nil {
-			return nil, errors.New("malformed current month used to calculate current month's activity")
-		}
+	// This month should have clients
+	if month.NewClients == nil || month.NewClients.Counts == nil || month.Counts == nil {
+		return nil, errors.New("malformed current month used to calculate current month's activity")
+	}
 
-		for _, typ := range activityTypes {
-			// Note that the following calculations assume that all clients seen are currently in
-			// the NewClients section of byMonth. It is best to explicitly check this, just verify
-			// our assumptions about the passed in byMonth argument.
-			if month.Counts.countByType(typ) != month.NewClients.Counts.countByType(typ) {
-				return nil, errors.New("current month clients cache assumes billing period")
+	// clients in current billing period until last month
+	currentBillingPeriodClients := a.GetClientIDsUsageInfo()
+	for nsID, namespace := range month.Namespaces {
+		namespaceActivity := &activity.MonthlyNamespaceRecord{NamespaceID: nsID, Counts: &activity.CountsRecord{}}
+		newNamespaceActivity := &activity.MonthlyNamespaceRecord{NamespaceID: nsID, Counts: &activity.CountsRecord{}}
+		mountsActivity := make([]*activity.MountRecord, 0)
+		newMountsActivity := make([]*activity.MountRecord, 0)
+
+		for mountAccessor, mount := range namespace.Mounts {
+			mountPath := a.mountAccessorToMountPath(mountAccessor)
+
+			mountCounts := &activity.CountsRecord{}
+			newMountCounts := &activity.CountsRecord{}
+
+			for _, typ := range ActivityClientTypes {
+				for clientID := range mount.Counts.clientsByType(typ) {
+					if _, ok := currentBillingPeriodClients[clientID]; !ok {
+						// new client
+						a.incrementCount(newCounts, 1, typ)
+						a.incrementCount(newMountCounts, 1, typ)
+						a.incrementCount(newNamespaceActivity.Counts, 1, typ)
+					}
+
+					// increment the per mount, per namespace, and total counts
+					// for each client
+					a.incrementCount(totalCounts, 1, typ)
+					a.incrementCount(mountCounts, 1, typ)
+					a.incrementCount(namespaceActivity.Counts, 1, typ)
+				}
 			}
-			for clientID := range month.NewClients.Counts.clientsByType(typ) {
-				// All the clients for the current month are in the newClients section, initially.
-				// We need to deduplicate these clients across the billing period by adding them
-				// into the billing period hyperloglogs.
-				hllByType[typ].Insert([]byte(clientID))
-				totalByType[typ] += 1
+
+			// if there are any new clients on this mount, add it to the
+			// list of new mounts
+			if newMountCounts.HasCounts() {
+				newMountsActivity = append(newMountsActivity, &activity.MountRecord{MountPath: mountPath, Counts: newMountCounts})
 			}
+			mountsActivity = append(mountsActivity, &activity.MountRecord{MountPath: mountPath, Counts: mountCounts})
+		}
+
+		namespaceActivity.Mounts = mountsActivity
+		totalNamespaces = append(totalNamespaces, namespaceActivity)
+
+		// if there are any new clients on this namespace, add it to the
+		// list of new namespaces
+		if newNamespaceActivity.Counts.HasCounts() {
+			newNamespaceActivity.Mounts = newMountsActivity
+			newNamespaces = append(newNamespaces, newNamespaceActivity)
 		}
 	}
-	currentMonthNewByType := make(map[string]int, len(activityTypes))
-	for _, typ := range activityTypes {
-		// The number of new entities for the current month is approximately the size of the hll with
-		// the current month's entities minus the size of the initial billing period hll.
-		currentMonthNewByType[typ] = int(hllByType[typ].Estimate() - billingPeriodHLL.Estimate())
+
+	monthRecord.Namespaces = totalNamespaces
+	monthRecord.NewClients.Namespaces = newNamespaces
+	return monthRecord, nil
+}
+
+// incrementCount modifies the passed-in counts record by incrementing the
+// client type's field by num
+func (a *ActivityLog) incrementCount(c *activity.CountsRecord, num int, typ string) {
+	switch typ {
+	case entityActivityType:
+		c.EntityClients += num
+	case nonEntityTokenActivityType:
+		c.NonEntityClients += num
+	case secretSyncActivityType:
+		c.SecretSyncs += num
+	case ACMEActivityType:
+		c.ACMEClients += num
 	}
+}
 
-	return &activity.MonthRecord{
-		Timestamp: timeutil.StartOfMonth(endTime).UTC().Unix(),
-		NewClients: &activity.NewClientRecord{Counts: &activity.CountsRecord{
-			EntityClients:    currentMonthNewByType[entityActivityType],
-			NonEntityClients: currentMonthNewByType[nonEntityTokenActivityType],
-			SecretSyncs:      currentMonthNewByType[secretSyncActivityType],
-		}},
-		Counts: &activity.CountsRecord{
-			EntityClients:    totalByType[entityActivityType],
-			NonEntityClients: totalByType[nonEntityTokenActivityType],
-			SecretSyncs:      totalByType[secretSyncActivityType],
-		},
-	}, nil
+type processByNamespaceID struct {
+	id string
+	*processByNamespace
+}
+
+func (s summaryByNamespace) sort() []*processByNamespaceID {
+	namespaces := make([]*processByNamespaceID, 0, len(s))
+	for nsID, namespace := range s {
+		namespaces = append(namespaces, &processByNamespaceID{id: nsID, processByNamespace: namespace})
+	}
+	slices.SortStableFunc(namespaces, func(a, b *processByNamespaceID) int {
+		return strings.Compare(a.id, b.id)
+	})
+	return namespaces
+}
+
+type processMountAccessor struct {
+	accessor string
+	*processMount
+}
+
+func (s summaryByMount) sort() []*processMountAccessor {
+	mounts := make([]*processMountAccessor, 0, len(s))
+	for mountAccessor, mount := range s {
+		mounts = append(mounts, &processMountAccessor{accessor: mountAccessor, processMount: mount})
+	}
+	slices.SortStableFunc(mounts, func(a, b *processMountAccessor) int {
+		return strings.Compare(a.accessor, b.accessor)
+	})
+	return mounts
+}
+
+func (c clientIDSet) sort() []string {
+	clientIDs := make([]string, 0, len(c))
+	for clientID := range c {
+		clientIDs = append(clientIDs, clientID)
+	}
+	sort.Strings(clientIDs)
+	return clientIDs
 }
 
 // sortALResponseNamespaces sorts the namespaces for activity log responses.
@@ -188,6 +272,7 @@ func (a *ActivityLog) transformALNamespaceBreakdowns(nsData map[string]*processB
 			Entities:        uint64(ns.Counts.countByType(entityActivityType)),
 			NonEntityTokens: uint64(ns.Counts.countByType(nonEntityTokenActivityType)),
 			SecretSyncs:     uint64(ns.Counts.countByType(secretSyncActivityType)),
+			ACMEClients:     uint64(ns.Counts.countByType(ACMEActivityType)),
 			Mounts:          a.transformActivityLogMounts(ns.Mounts),
 		}
 		byNamespace = append(byNamespace, &nsRecord)
@@ -265,8 +350,11 @@ func (a *ActivityLog) sortActivityLogMonthsResponse(months []*ResponseMonth) {
 }
 
 const (
-	noMountAccessor = "no mount accessor (pre-1.10 upgrade?)"
-	deletedMountFmt = "deleted mount; accessor %q"
+	noMountAccessor     = "no mount accessor (pre-1.10 upgrade?)"
+	noMountPath         = "no mount path (pre-1.10 upgrade?)"
+	DeletedMountFmt     = "deleted mount; accessor %q"
+	DeletedMountPath    = "deleted mount"
+	DeletedNamespaceFmt = "deleted namespace %q"
 )
 
 // mountAccessorToMountPath transforms the mount accessor to the mount path
@@ -278,7 +366,7 @@ func (a *ActivityLog) mountAccessorToMountPath(mountAccessor string) string {
 	} else {
 		valResp := a.core.router.ValidateMountByAccessor(mountAccessor)
 		if valResp == nil {
-			displayPath = fmt.Sprintf(deletedMountFmt, mountAccessor)
+			displayPath = fmt.Sprintf(DeletedMountFmt, mountAccessor)
 		} else {
 			displayPath = valResp.MountPath
 			if !strings.HasSuffix(displayPath, "/") {
@@ -289,6 +377,26 @@ func (a *ActivityLog) mountAccessorToMountPath(mountAccessor string) string {
 	return displayPath
 }
 
+// mountPathToMountType transforms the mount path to the mount type
+// returns a placeholder string if the mount path is empty or deleted
+func (a *ActivityLog) mountPathToMountType(ctx context.Context, mountPath string) string {
+	var mountType string
+	if mountPath == "" {
+		mountType = noMountPath
+	} else {
+		path, valResp := a.core.router.MatchingMountAndEntry(ctx, mountPath)
+		if path == "" {
+			mountType = DeletedMountPath
+		} else {
+			mountType = valResp.Type
+			if !strings.HasSuffix(mountType, "/") {
+				mountType += "/"
+			}
+		}
+	}
+	return mountType
+}
+
 type singleTypeSegmentReader struct {
 	basePath         string
 	startTime        time.Time
@@ -384,18 +492,14 @@ func (e *segmentReader) ReadEntity(ctx context.Context) (*activity.EntityActivit
 
 // namespaceRecordToCountsResponse converts the record to the ResponseCounts
 // type. The function sums entity, non-entity, and secret sync counts to get the
-// total client count. If includeDeprecated is true, the deprecated fields
-// NonEntityTokens and DistinctEntities are populated
-func (a *ActivityLog) countsRecordToCountsResponse(record *activity.CountsRecord, includeDeprecated bool) *ResponseCounts {
+// total client count.
+func (a *ActivityLog) countsRecordToCountsResponse(record *activity.CountsRecord) *ResponseCounts {
 	response := &ResponseCounts{
 		EntityClients:    record.EntityClients,
 		NonEntityClients: record.NonEntityClients,
-		Clients:          record.EntityClients + record.NonEntityClients + record.SecretSyncs,
+		Clients:          record.EntityClients + record.NonEntityClients + record.SecretSyncs + record.ACMEClients,
 		SecretSyncs:      record.SecretSyncs,
-	}
-	if includeDeprecated {
-		response.NonEntityTokens = response.NonEntityClients
-		response.DistinctEntities = response.EntityClients
+		ACMEClients:      record.ACMEClients,
 	}
 	return response
 }
@@ -405,11 +509,38 @@ func (a *ActivityLog) countsRecordToCountsResponse(record *activity.CountsRecord
 // counts to get the total client count.
 func (a *ActivityLog) namespaceRecordToCountsResponse(record *activity.NamespaceRecord) *ResponseCounts {
 	return &ResponseCounts{
-		DistinctEntities: int(record.Entities),
 		EntityClients:    int(record.Entities),
-		NonEntityTokens:  int(record.NonEntityTokens),
 		NonEntityClients: int(record.NonEntityTokens),
-		Clients:          int(record.Entities + record.NonEntityTokens + record.SecretSyncs),
+		Clients:          int(record.Entities + record.NonEntityTokens + record.SecretSyncs + record.ACMEClients),
 		SecretSyncs:      int(record.SecretSyncs),
+		ACMEClients:      int(record.ACMEClients),
 	}
 }
+
+func (a *ActivityLog) GetClientIDsUsageInfo() map[string]struct{} {
+	a.clientIDsUsage.clientIDsUsageInfoLock.Lock()
+	defer a.clientIDsUsage.clientIDsUsageInfoLock.Unlock()
+	return a.clientIDsUsage.clientIDsUsageInfo
+}
+
+func (a *ActivityLog) SetClientIDsUsageInfo(inMemClientIDsMap map[string]struct{}) {
+	a.clientIDsUsage.clientIDsUsageInfoLock.Lock()
+	defer a.clientIDsUsage.clientIDsUsageInfoLock.Unlock()
+
+	a.clientIDsUsage.clientIDsUsageInfo = inMemClientIDsMap
+}
+
+// GetclientIDsUsageInfoLoaded gets a.clientIDsUsageInfoLoaded for external tests
+func (a *ActivityLog) GetClientIDsUsageInfoLoaded() bool {
+	return a.clientIDsUsage.clientIDsUsageInfoLoaded.Load()
+}
+
+// SetClientIDsUsageInfoLoaded sets a.clientIDsUsageInfoLoaded for external tests
+func (a *ActivityLog) SetClientIDsUsageInfoLoaded(loaded bool) {
+	a.clientIDsUsage.clientIDsUsageInfoLoaded.Store(loaded)
+}
+
+// SetupClientIDsUsageInfo calls core.setupClientIDsUsageInfo for external tests
+func (c *Core) SetupClientIDsUsageInfo(ctx context.Context) {
+	c.setupClientIDsUsageInfo(ctx)
+}
diff --git a/vault/activity_log_util_common_test.go b/vault/activity_log_util_common_test.go
index 91b064aa4c3..a6355439074 100644
--- a/vault/activity_log_util_common_test.go
+++ b/vault/activity_log_util_common_test.go
@@ -1,25 +1,62 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"sort"
+	"sync"
 	"testing"
 	"time"
 
-	"github.com/axiomhq/hyperloglog"
+	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/timeutil"
 	"github.com/hashicorp/vault/vault/activity"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 )
 
-// Test_ActivityLog_ComputeCurrentMonthForBillingPeriodInternal creates 3 months
-// of hyperloglogs and fills them with overlapping clients. The test calls
+// equalActivityMonthRecords is a helper to sort the namespaces and mounts
+// in activity.MonthRecord's, then compare their equality
+func equalActivityMonthRecords(t *testing.T, expected, got *activity.MonthRecord) {
+	t.Helper()
+	sortNamespaces := func(namespaces []*activity.MonthlyNamespaceRecord) {
+		sort.SliceStable(namespaces, func(i, j int) bool {
+			return namespaces[i].NamespaceID < namespaces[j].NamespaceID
+		})
+		for _, namespace := range namespaces {
+			sort.SliceStable(namespace.Mounts, func(i, j int) bool {
+				return namespace.Mounts[i].MountPath < namespace.Mounts[j].MountPath
+			})
+		}
+	}
+	sortNamespaces(expected.Namespaces)
+	sortNamespaces(expected.NewClients.Namespaces)
+	sortNamespaces(got.Namespaces)
+	sortNamespaces(got.NewClients.Namespaces)
+	require.Equal(t, expected, got)
+}
+
+// equalActivityNamespaceRecords is a helper to sort the namespaces in activity.NamespaceRecord's,
+// then compare their equality
+func equalActivityNamespaceRecords(t *testing.T, expected, got []*activity.NamespaceRecord) {
+	t.Helper()
+	sort.SliceStable(expected, func(i, j int) bool {
+		return expected[i].NamespaceID < expected[j].NamespaceID
+	})
+	sort.SliceStable(got, func(i, j int) bool {
+		return got[i].NamespaceID < got[j].NamespaceID
+	})
+	require.Equal(t, expected, got)
+}
+
+// Test_ActivityLog_ComputeCurrentMonthForBillingPeriodInternal test calls
 // computeCurrentMonthForBillingPeriodInternal with the current month map having
 // some overlap with the previous months. The test then verifies that the
 // results have the correct number of entity, non-entity, and secret sync
@@ -27,39 +64,11 @@ import (
 // computeCurrentMonthForBillingPeriodInternal with an empty current month map,
 // and verifies that the results are all 0.
 func Test_ActivityLog_ComputeCurrentMonthForBillingPeriodInternal(t *testing.T) {
-	// populate the first month with clients 1-20
-	monthOneHLL := hyperloglog.New()
-	// populate the second month with clients 10-30
-	monthTwoHLL := hyperloglog.New()
-	// populate the third month with clients 20-40
-	monthThreeHLL := hyperloglog.New()
-
-	for i := 0; i < 40; i++ {
-		clientID := []byte(fmt.Sprintf("client_%d", i))
-		if i < 20 {
-			monthOneHLL.Insert(clientID)
-		}
-		if 10 <= i && i < 20 {
-			monthTwoHLL.Insert(clientID)
-		}
-		if 20 <= i && i < 40 {
-			monthThreeHLL.Insert(clientID)
-		}
-	}
-	mockHLLGetFunc := func(ctx context.Context, startTime time.Time) (*hyperloglog.Sketch, error) {
-		currMonthStart := timeutil.StartOfMonth(time.Now())
-		if startTime.Equal(timeutil.MonthsPreviousTo(3, currMonthStart)) {
-			return monthThreeHLL, nil
-		}
-		if startTime.Equal(timeutil.MonthsPreviousTo(2, currMonthStart)) {
-			return monthTwoHLL, nil
-		}
-		if startTime.Equal(timeutil.MonthsPreviousTo(1, currMonthStart)) {
-			return monthOneHLL, nil
-		}
-		return nil, fmt.Errorf("bad start time")
-	}
+	core, _, _ := TestCoreUnsealed(t)
+	a := core.activityLog
 
+	month := newProcessMonth()
+	repeatedClientsIDsInMemory := make(map[string]struct{})
 	// Below we register the entity, non-entity, and secret sync clients that
 	// are seen in the current month
 
@@ -77,11 +86,24 @@ func Test_ActivityLog_ComputeCurrentMonthForBillingPeriodInternal(t *testing.T)
 		"client_21": {},
 		"client_30": {},
 		"client_31": {},
+	}
+	newEntitiesStruct := map[string]struct{}{
 		"client_40": {},
 		"client_41": {},
 		"client_42": {},
 	}
 
+	// repeated clients
+	for id := range entitiesStruct {
+		repeatedClientsIDsInMemory[id] = struct{}{}
+		month.add(&activity.EntityRecord{ClientID: id, ClientType: entityActivityType})
+	}
+
+	// new clients
+	for id := range newEntitiesStruct {
+		month.add(&activity.EntityRecord{ClientID: id, ClientType: entityActivityType})
+	}
+
 	// We will add 3 nonentity clients from month 1 (clients 2,3,4),
 	// 3 shared by months 1 and 2 (12,13,14),
 	// 3 shared by months 2 and 3 (22,23,24), and
@@ -100,12 +122,26 @@ func Test_ActivityLog_ComputeCurrentMonthForBillingPeriodInternal(t *testing.T)
 		"client_32": {},
 		"client_33": {},
 		"client_34": {},
+	}
+
+	newNonEntitiesStruct := map[string]struct{}{
 		"client_43": {},
 		"client_44": {},
 		"client_45": {},
 		"client_46": {},
 	}
 
+	// repeated non entity clients
+	for id := range nonEntitiesStruct {
+		repeatedClientsIDsInMemory[id] = struct{}{}
+		month.add(&activity.EntityRecord{ClientID: id, ClientType: nonEntityTokenActivityType})
+	}
+
+	// new non entity clients
+	for id := range newNonEntitiesStruct {
+		month.add(&activity.EntityRecord{ClientID: id, ClientType: nonEntityTokenActivityType})
+	}
+
 	// secret syncs have 1 client from month 1 (5)
 	// 1 shared by months 1 and 2 (15)
 	// 1 shared by months 2 and 3 (25)
@@ -117,35 +153,38 @@ func Test_ActivityLog_ComputeCurrentMonthForBillingPeriodInternal(t *testing.T)
 		"client_25": {},
 		"client_35": {},
 		"client_36": {},
+	}
+
+	newSecretSyncStruct := map[string]struct{}{
 		"client_47": {},
 		"client_48": {},
 	}
 
-	counts := &processCounts{
-		ClientsByType: map[string]clientIDSet{
-			entityActivityType:         entitiesStruct,
-			nonEntityTokenActivityType: nonEntitiesStruct,
-			secretSyncActivityType:     secretSyncStruct,
-		},
+	// repeated secret sync clients
+	for id := range secretSyncStruct {
+		repeatedClientsIDsInMemory[id] = struct{}{}
+		month.add(&activity.EntityRecord{ClientID: id, ClientType: secretSyncActivityType})
 	}
 
-	currentMonthClientsMap := make(map[int64]*processMonth, 1)
-	currentMonthClients := &processMonth{
-		Counts:     counts,
-		NewClients: &processNewClients{Counts: counts},
+	// new secret sync clients
+	for id := range newSecretSyncStruct {
+		month.add(&activity.EntityRecord{ClientID: id, ClientType: secretSyncActivityType})
 	}
+
+	// store all repeated clients in in-memory client usage map
+	a.SetClientIDsUsageInfo(repeatedClientsIDsInMemory)
+
+	currentMonthClientsMap := make(map[int64]*processMonth, 1)
+
 	// Technially I think currentMonthClientsMap should have the keys as
 	// unix timestamps, but for the purposes of the unit test it doesn't
 	// matter what the values actually are.
-	currentMonthClientsMap[0] = currentMonthClients
-
-	core, _, _ := TestCoreUnsealed(t)
-	a := core.activityLog
+	currentMonthClientsMap[0] = month
 
 	endTime := timeutil.StartOfMonth(time.Now())
 	startTime := timeutil.MonthsPreviousTo(3, endTime)
 
-	monthRecord, err := a.computeCurrentMonthForBillingPeriodInternal(context.Background(), currentMonthClientsMap, mockHLLGetFunc, startTime, endTime)
+	monthRecord, err := a.computeCurrentMonthForBillingPeriodInternal(currentMonthClientsMap, startTime, endTime)
 	require.NoError(t, err)
 
 	require.Equal(t, &activity.CountsRecord{
@@ -164,13 +203,1674 @@ func Test_ActivityLog_ComputeCurrentMonthForBillingPeriodInternal(t *testing.T)
 	endTime = time.Now().UTC()
 	startTime = timeutil.StartOfMonth(endTime)
 	emptyClientsMap := make(map[int64]*processMonth, 0)
-	monthRecord, err = a.computeCurrentMonthForBillingPeriodInternal(context.Background(), emptyClientsMap, mockHLLGetFunc, startTime, endTime)
+	monthRecord, err = a.computeCurrentMonthForBillingPeriodInternal(emptyClientsMap, startTime, endTime)
 	require.NoError(t, err)
 
 	require.Equal(t, &activity.CountsRecord{}, monthRecord.Counts)
 	require.Equal(t, &activity.CountsRecord{}, monthRecord.NewClients.Counts)
 }
 
+// Test_ActivityLog_ComputeCurrentMonth_NamespaceMounts checks that current
+// month counts are combined correctly with 3 previous months of data. The test
+// checks a variety of scenarios with different mount and namespace values
+func Test_ActivityLog_ComputeCurrentMonth_NamespaceMounts(t *testing.T) {
+	testCases := []struct {
+		name                          string
+		repeatedClientsUntilLastMonth []*activity.EntityRecord
+		currentMonthClients           []*activity.EntityRecord
+		wantErr                       bool
+		wantMonth                     *activity.MonthRecord
+	}{
+		{
+			name: "no clients",
+			wantMonth: &activity.MonthRecord{
+				Counts:     &activity.CountsRecord{},
+				Namespaces: []*activity.MonthlyNamespaceRecord{},
+				NewClients: &activity.NewClientRecord{
+					Counts:     &activity.CountsRecord{},
+					Namespaces: []*activity.MonthlyNamespaceRecord{},
+				},
+			},
+		},
+
+		{
+			// all the clients have been seen before
+			// they're all on ns1/mount1
+			name: "all repeated",
+			repeatedClientsUntilLastMonth: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+			},
+			currentMonthClients: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+			},
+			wantMonth: &activity.MonthRecord{
+				Counts: &activity.CountsRecord{
+					EntityClients:    1,
+					SecretSyncs:      1,
+					NonEntityClients: 1,
+					ACMEClients:      1,
+				},
+				Namespaces: []*activity.MonthlyNamespaceRecord{
+					{
+						NamespaceID: "ns1",
+						Counts: &activity.CountsRecord{
+							EntityClients:    1,
+							NonEntityClients: 1,
+							SecretSyncs:      1,
+							ACMEClients:      1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+									SecretSyncs:      1,
+									ACMEClients:      1,
+								},
+							},
+						},
+					},
+				},
+				NewClients: &activity.NewClientRecord{
+					Counts:     &activity.CountsRecord{},
+					Namespaces: []*activity.MonthlyNamespaceRecord{},
+				},
+			},
+		},
+		{
+			// all the clients have been seen before
+			// they're all on ns1, but mounts 1-4
+			name: "all repeated multiple mounts",
+			repeatedClientsUntilLastMonth: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount2"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount3"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount4"},
+			},
+			currentMonthClients: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount2"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount3"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount4"},
+			},
+			wantMonth: &activity.MonthRecord{
+				Counts: &activity.CountsRecord{
+					EntityClients:    1,
+					SecretSyncs:      1,
+					NonEntityClients: 1,
+					ACMEClients:      1,
+				},
+				Namespaces: []*activity.MonthlyNamespaceRecord{
+					{
+						NamespaceID: "ns1",
+						Counts: &activity.CountsRecord{
+							EntityClients:    1,
+							NonEntityClients: 1,
+							SecretSyncs:      1,
+							ACMEClients:      1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									EntityClients: 1,
+								},
+							},
+							{
+								MountPath: "mount2",
+								Counts: &activity.CountsRecord{
+									NonEntityClients: 1,
+								},
+							},
+							{
+								MountPath: "mount3",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 1,
+								},
+							},
+							{
+								MountPath: "mount4",
+								Counts: &activity.CountsRecord{
+									ACMEClients: 1,
+								},
+							},
+						},
+					},
+				},
+				NewClients: &activity.NewClientRecord{
+					Counts:     &activity.CountsRecord{},
+					Namespaces: []*activity.MonthlyNamespaceRecord{},
+				},
+			},
+		},
+		{
+			// all the clients have been seen before
+			// they're on namespaces ns1-4
+			name: "all repeated multiple namespaces",
+			repeatedClientsUntilLastMonth: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns2", MountAccessor: "mount1"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns3", MountAccessor: "mount1"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns4", MountAccessor: "mount1"},
+			},
+			currentMonthClients: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns2", MountAccessor: "mount1"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns3", MountAccessor: "mount1"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns4", MountAccessor: "mount1"},
+			},
+			wantMonth: &activity.MonthRecord{
+				Counts: &activity.CountsRecord{
+					EntityClients:    1,
+					SecretSyncs:      1,
+					NonEntityClients: 1,
+					ACMEClients:      1,
+				},
+				Namespaces: []*activity.MonthlyNamespaceRecord{
+					{
+						NamespaceID: "ns1",
+						Counts: &activity.CountsRecord{
+							EntityClients: 1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									EntityClients: 1,
+								},
+							},
+						},
+					},
+					{
+						NamespaceID: "ns2",
+						Counts: &activity.CountsRecord{
+							NonEntityClients: 1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									NonEntityClients: 1,
+								},
+							},
+						},
+					},
+					{
+						NamespaceID: "ns3",
+						Counts: &activity.CountsRecord{
+							SecretSyncs: 1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 1,
+								},
+							},
+						},
+					},
+					{
+						NamespaceID: "ns4",
+						Counts: &activity.CountsRecord{
+							ACMEClients: 1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									ACMEClients: 1,
+								},
+							},
+						},
+					},
+				},
+				NewClients: &activity.NewClientRecord{
+					Counts:     &activity.CountsRecord{},
+					Namespaces: []*activity.MonthlyNamespaceRecord{},
+				},
+			},
+		},
+		{
+			// 4 clients that have been seen before on namespaces 1-4
+			// 4 new clients on namespaces 1-4
+			name: "new clients multiple namespaces",
+			repeatedClientsUntilLastMonth: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns2", MountAccessor: "mount1"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns3", MountAccessor: "mount1"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns4", MountAccessor: "mount1"},
+			},
+			currentMonthClients: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns2", MountAccessor: "mount1"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns3", MountAccessor: "mount1"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns4", MountAccessor: "mount1"},
+				{ClientID: "new_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "new_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns2", MountAccessor: "mount1"},
+				{ClientID: "new_3", ClientType: secretSyncActivityType, NamespaceID: "ns3", MountAccessor: "mount1"},
+				{ClientID: "new_4", ClientType: ACMEActivityType, NamespaceID: "ns4", MountAccessor: "mount1"},
+			},
+			wantMonth: &activity.MonthRecord{
+				Counts: &activity.CountsRecord{
+					EntityClients:    2,
+					SecretSyncs:      2,
+					NonEntityClients: 2,
+					ACMEClients:      2,
+				},
+				Namespaces: []*activity.MonthlyNamespaceRecord{
+					{
+						NamespaceID: "ns1",
+						Counts: &activity.CountsRecord{
+							EntityClients: 2,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									EntityClients: 2,
+								},
+							},
+						},
+					},
+					{
+						NamespaceID: "ns2",
+						Counts: &activity.CountsRecord{
+							NonEntityClients: 2,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									NonEntityClients: 2,
+								},
+							},
+						},
+					},
+					{
+						NamespaceID: "ns3",
+						Counts: &activity.CountsRecord{
+							SecretSyncs: 2,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 2,
+								},
+							},
+						},
+					},
+					{
+						NamespaceID: "ns4",
+						Counts: &activity.CountsRecord{
+							ACMEClients: 2,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									ACMEClients: 2,
+								},
+							},
+						},
+					},
+				},
+				NewClients: &activity.NewClientRecord{
+					Counts: &activity.CountsRecord{
+						EntityClients:    1,
+						NonEntityClients: 1,
+						SecretSyncs:      1,
+						ACMEClients:      1,
+					},
+					Namespaces: []*activity.MonthlyNamespaceRecord{
+						{
+							NamespaceID: "ns1",
+							Counts: &activity.CountsRecord{
+								EntityClients: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: "mount1",
+									Counts: &activity.CountsRecord{
+										EntityClients: 1,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns2",
+							Counts: &activity.CountsRecord{
+								NonEntityClients: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: "mount1",
+									Counts: &activity.CountsRecord{
+										NonEntityClients: 1,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns3",
+							Counts: &activity.CountsRecord{
+								SecretSyncs: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: "mount1",
+									Counts: &activity.CountsRecord{
+										SecretSyncs: 1,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns4",
+							Counts: &activity.CountsRecord{
+								ACMEClients: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: "mount1",
+									Counts: &activity.CountsRecord{
+										ACMEClients: 1,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			// 4 clients that have been seen before on ns1/mount1-4
+			// 4 new clients on ns1/mount1-4
+			name: "new clients multiple mounts",
+			repeatedClientsUntilLastMonth: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount2"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount3"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount4"},
+			},
+			currentMonthClients: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount2"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount3"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount4"},
+				{ClientID: "new_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "new_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount2"},
+				{ClientID: "new_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount3"},
+				{ClientID: "new_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount4"},
+			},
+			wantMonth: &activity.MonthRecord{
+				Counts: &activity.CountsRecord{
+					EntityClients:    2,
+					SecretSyncs:      2,
+					NonEntityClients: 2,
+					ACMEClients:      2,
+				},
+				Namespaces: []*activity.MonthlyNamespaceRecord{
+					{
+						NamespaceID: "ns1",
+						Counts: &activity.CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									EntityClients: 2,
+								},
+							},
+							{
+								MountPath: "mount2",
+								Counts: &activity.CountsRecord{
+									NonEntityClients: 2,
+								},
+							},
+							{
+								MountPath: "mount3",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 2,
+								},
+							},
+							{
+								MountPath: "mount4",
+								Counts: &activity.CountsRecord{
+									ACMEClients: 2,
+								},
+							},
+						},
+					},
+				},
+				NewClients: &activity.NewClientRecord{
+					Counts: &activity.CountsRecord{
+						EntityClients:    1,
+						NonEntityClients: 1,
+						SecretSyncs:      1,
+						ACMEClients:      1,
+					},
+					Namespaces: []*activity.MonthlyNamespaceRecord{
+						{
+							NamespaceID: "ns1",
+							Counts: &activity.CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+								SecretSyncs:      1,
+								ACMEClients:      1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: "mount1",
+									Counts: &activity.CountsRecord{
+										EntityClients: 1,
+									},
+								},
+								{
+									MountPath: "mount2",
+									Counts: &activity.CountsRecord{
+										NonEntityClients: 1,
+									},
+								},
+								{
+									MountPath: "mount3",
+									Counts: &activity.CountsRecord{
+										SecretSyncs: 1,
+									},
+								},
+								{
+									MountPath: "mount4",
+									Counts: &activity.CountsRecord{
+										ACMEClients: 1,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			// 4 clients that have been seen before on ns1/mount1-4
+			// 4 new clients on ns1/mount5-6
+			name: "new clients new mounts",
+			repeatedClientsUntilLastMonth: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount2"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount3"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount4"},
+			},
+			currentMonthClients: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount2"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount3"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount4"},
+				{ClientID: "new_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount5"},
+				{ClientID: "new_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount6"},
+				{ClientID: "new_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount7"},
+				{ClientID: "new_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount8"},
+			},
+			wantMonth: &activity.MonthRecord{
+				Counts: &activity.CountsRecord{
+					EntityClients:    2,
+					SecretSyncs:      2,
+					NonEntityClients: 2,
+					ACMEClients:      2,
+				},
+				Namespaces: []*activity.MonthlyNamespaceRecord{
+					{
+						NamespaceID: "ns1",
+						Counts: &activity.CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									EntityClients: 1,
+								},
+							},
+							{
+								MountPath: "mount2",
+								Counts: &activity.CountsRecord{
+									NonEntityClients: 1,
+								},
+							},
+							{
+								MountPath: "mount3",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 1,
+								},
+							},
+							{
+								MountPath: "mount4",
+								Counts: &activity.CountsRecord{
+									ACMEClients: 1,
+								},
+							},
+							{
+								MountPath: "mount5",
+								Counts: &activity.CountsRecord{
+									EntityClients: 1,
+								},
+							},
+							{
+								MountPath: "mount6",
+								Counts: &activity.CountsRecord{
+									NonEntityClients: 1,
+								},
+							},
+							{
+								MountPath: "mount7",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 1,
+								},
+							},
+							{
+								MountPath: "mount8",
+								Counts: &activity.CountsRecord{
+									ACMEClients: 1,
+								},
+							},
+						},
+					},
+				},
+				NewClients: &activity.NewClientRecord{
+					Counts: &activity.CountsRecord{
+						EntityClients:    1,
+						NonEntityClients: 1,
+						SecretSyncs:      1,
+						ACMEClients:      1,
+					},
+					Namespaces: []*activity.MonthlyNamespaceRecord{
+						{
+							NamespaceID: "ns1",
+							Counts: &activity.CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+								SecretSyncs:      1,
+								ACMEClients:      1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: "mount5",
+									Counts: &activity.CountsRecord{
+										EntityClients: 1,
+									},
+								},
+								{
+									MountPath: "mount6",
+									Counts: &activity.CountsRecord{
+										NonEntityClients: 1,
+									},
+								},
+								{
+									MountPath: "mount7",
+									Counts: &activity.CountsRecord{
+										SecretSyncs: 1,
+									},
+								},
+								{
+									MountPath: "mount8",
+									Counts: &activity.CountsRecord{
+										ACMEClients: 1,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			// 4 clients that have been seen before on ns1
+			// 4 clients that are new on ns2-5
+			name: "new clients new namespaces",
+			repeatedClientsUntilLastMonth: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+			},
+			currentMonthClients: []*activity.EntityRecord{
+				{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+				{ClientID: "new_1", ClientType: entityActivityType, NamespaceID: "ns2", MountAccessor: "mount1"},
+				{ClientID: "new_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns3", MountAccessor: "mount1"},
+				{ClientID: "new_3", ClientType: secretSyncActivityType, NamespaceID: "ns4", MountAccessor: "mount1"},
+				{ClientID: "new_4", ClientType: ACMEActivityType, NamespaceID: "ns5", MountAccessor: "mount1"},
+			},
+			wantMonth: &activity.MonthRecord{
+				Counts: &activity.CountsRecord{
+					EntityClients:    2,
+					SecretSyncs:      2,
+					NonEntityClients: 2,
+					ACMEClients:      2,
+				},
+				Namespaces: []*activity.MonthlyNamespaceRecord{
+					{
+						NamespaceID: "ns1",
+						Counts: &activity.CountsRecord{
+							EntityClients:    1,
+							NonEntityClients: 1,
+							SecretSyncs:      1,
+							ACMEClients:      1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+									SecretSyncs:      1,
+									ACMEClients:      1,
+								},
+							},
+						},
+					},
+					{
+						NamespaceID: "ns2",
+						Counts: &activity.CountsRecord{
+							EntityClients: 1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									EntityClients: 1,
+								},
+							},
+						},
+					},
+					{
+						NamespaceID: "ns3",
+						Counts: &activity.CountsRecord{
+							NonEntityClients: 1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									NonEntityClients: 1,
+								},
+							},
+						},
+					},
+					{
+						NamespaceID: "ns4",
+						Counts: &activity.CountsRecord{
+							SecretSyncs: 1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 1,
+								},
+							},
+						},
+					},
+
+					{
+						NamespaceID: "ns5",
+						Counts: &activity.CountsRecord{
+							ACMEClients: 1,
+						},
+						Mounts: []*activity.MountRecord{
+							{
+								MountPath: "mount1",
+								Counts: &activity.CountsRecord{
+									ACMEClients: 1,
+								},
+							},
+						},
+					},
+				},
+				NewClients: &activity.NewClientRecord{
+					Counts: &activity.CountsRecord{
+						EntityClients:    1,
+						NonEntityClients: 1,
+						SecretSyncs:      1,
+						ACMEClients:      1,
+					},
+					Namespaces: []*activity.MonthlyNamespaceRecord{
+						{
+							NamespaceID: "ns2",
+							Counts: &activity.CountsRecord{
+								EntityClients: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: "mount1",
+									Counts: &activity.CountsRecord{
+										EntityClients: 1,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns3",
+							Counts: &activity.CountsRecord{
+								NonEntityClients: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: "mount1",
+									Counts: &activity.CountsRecord{
+										NonEntityClients: 1,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns4",
+							Counts: &activity.CountsRecord{
+								SecretSyncs: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: "mount1",
+									Counts: &activity.CountsRecord{
+										SecretSyncs: 1,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns5",
+							Counts: &activity.CountsRecord{
+								ACMEClients: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: "mount1",
+									Counts: &activity.CountsRecord{
+										ACMEClients: 1,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			core, _, _ := TestCoreUnsealed(t)
+			a := core.activityLog
+
+			// add repeated clients seen till last month to in-memory map
+			repeatedClients := make(map[string]struct{})
+			for _, c := range tc.repeatedClientsUntilLastMonth {
+				repeatedClients[c.ClientID] = struct{}{}
+			}
+			a.SetClientIDsUsageInfo(repeatedClients)
+
+			month := newProcessMonth()
+			for _, c := range tc.currentMonthClients {
+				month.add(c)
+			}
+			endTime := timeutil.StartOfMonth(time.Now())
+			startTime := timeutil.MonthsPreviousTo(3, endTime)
+			currentMonth := make(map[int64]*processMonth)
+			currentMonth[0] = month
+			monthRecord, err := a.computeCurrentMonthForBillingPeriodInternal(currentMonth, startTime, endTime)
+			if tc.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			correctMountPaths := func(namespaces []*activity.MonthlyNamespaceRecord) {
+				for _, ns := range namespaces {
+					for _, mount := range ns.Mounts {
+						mount.MountPath = fmt.Sprintf(DeletedMountFmt, mount.MountPath)
+					}
+				}
+			}
+			tc.wantMonth.Timestamp = timeutil.StartOfMonth(endTime).Unix()
+			correctMountPaths(tc.wantMonth.Namespaces)
+			correctMountPaths(tc.wantMonth.NewClients.Namespaces)
+			equalActivityMonthRecords(t, tc.wantMonth, monthRecord)
+		})
+	}
+}
+
+// Test_ActivityLog_ComputeClientsInBillingPeriod tests the computeClientsInBillingPeriod method
+// by creating a set of clients across multiple namespaces and mounts, some new and some repeated over 3 months.
+// It verifies that the response matches the expected results for billing periods that only include past months,
+// as well as for billing periods that include the current month. Also tests a period with no clients.
+func Test_ActivityLog_ComputeClientsInBillingPeriod(t *testing.T) {
+	// Create 20 clients of the 4 client types across 3 namespaces and 3 mounts.
+	clients := []*activity.EntityRecord{
+		{ClientID: "client_1", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_2", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_3", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_4", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_5", ClientType: entityActivityType, NamespaceID: "ns2", MountAccessor: "mount2"},
+		{ClientID: "client_6", ClientType: nonEntityTokenActivityType, NamespaceID: "ns2", MountAccessor: "mount2"},
+		{ClientID: "client_7", ClientType: secretSyncActivityType, NamespaceID: "ns3", MountAccessor: "mount3"},
+		{ClientID: "client_8", ClientType: ACMEActivityType, NamespaceID: "ns3", MountAccessor: "mount3"},
+
+		{ClientID: "client_9", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_10", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_11", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_12", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_13", ClientType: entityActivityType, NamespaceID: "ns2", MountAccessor: "mount2"},
+		{ClientID: "client_14", ClientType: nonEntityTokenActivityType, NamespaceID: "ns2", MountAccessor: "mount2"},
+		{ClientID: "client_15", ClientType: secretSyncActivityType, NamespaceID: "ns3", MountAccessor: "mount3"},
+		{ClientID: "client_16", ClientType: ACMEActivityType, NamespaceID: "ns3", MountAccessor: "mount3"},
+
+		{ClientID: "client_17", ClientType: entityActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_18", ClientType: nonEntityTokenActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_19", ClientType: secretSyncActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+		{ClientID: "client_20", ClientType: ACMEActivityType, NamespaceID: "ns1", MountAccessor: "mount1"},
+	}
+
+	// The clients are distributed as follows:
+	// First month (2 months ago): new clients 1-8
+	// Second month (1 month ago): new clients 9-16, repeated clients 1-8
+	// Current month: new clients 17-20, repeated clients 1-16
+	segments := []struct {
+		StartTime time.Time
+		Clients   []*activity.EntityRecord
+	}{
+		{
+			StartTime: timeutil.StartOfMonth(timeutil.MonthsPreviousTo(2, time.Now().UTC())),
+			Clients:   clients[:8],
+		},
+		{
+			StartTime: timeutil.StartOfMonth(timeutil.MonthsPreviousTo(1, time.Now().UTC())),
+			Clients:   clients[:16],
+		},
+		{
+			StartTime: timeutil.StartOfMonth(time.Now().UTC()),
+			Clients:   clients,
+		},
+	}
+
+	testCases := []struct {
+		name               string
+		startTime          time.Time
+		endTime            time.Time
+		expectedNamespaces []*activity.NamespaceRecord
+		expectedMonths     []*activity.MonthRecord
+	}{
+		{
+			name:      "past billing period two months",
+			startTime: segments[0].StartTime,
+			endTime:   timeutil.EndOfMonth(segments[1].StartTime),
+			expectedNamespaces: []*activity.NamespaceRecord{
+				{
+					NamespaceID:     "ns1",
+					Entities:        2,
+					NonEntityTokens: 2,
+					SecretSyncs:     2,
+					ACMEClients:     2,
+					Mounts: []*activity.MountRecord{
+						{
+							MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+							Counts:    &activity.CountsRecord{EntityClients: 2, NonEntityClients: 2, SecretSyncs: 2, ACMEClients: 2},
+						},
+					},
+				},
+				{
+					NamespaceID:     "ns2",
+					Entities:        2,
+					NonEntityTokens: 2,
+					Mounts: []*activity.MountRecord{
+						{
+							MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+							Counts:    &activity.CountsRecord{EntityClients: 2, NonEntityClients: 2},
+						},
+					},
+				},
+				{
+					NamespaceID: "ns3",
+					SecretSyncs: 2,
+					ACMEClients: 2,
+					Mounts: []*activity.MountRecord{
+						{
+							MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+							Counts:    &activity.CountsRecord{SecretSyncs: 2, ACMEClients: 2},
+						},
+					},
+				},
+			},
+			expectedMonths: []*activity.MonthRecord{
+				{
+					Timestamp: segments[0].StartTime.Unix(),
+					Counts: &activity.CountsRecord{
+						EntityClients:    2,
+						NonEntityClients: 2,
+						SecretSyncs:      2,
+						ACMEClients:      2,
+					},
+					Namespaces: []*activity.MonthlyNamespaceRecord{
+						{
+							NamespaceID: "ns1",
+							Counts: &activity.CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+								SecretSyncs:      1,
+								ACMEClients:      1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+									Counts: &activity.CountsRecord{
+										EntityClients:    1,
+										NonEntityClients: 1,
+										SecretSyncs:      1,
+										ACMEClients:      1,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns2",
+							Counts: &activity.CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+									Counts: &activity.CountsRecord{
+										EntityClients:    1,
+										NonEntityClients: 1,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns3",
+							Counts: &activity.CountsRecord{
+								SecretSyncs: 1,
+								ACMEClients: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+									Counts: &activity.CountsRecord{
+										SecretSyncs: 1,
+										ACMEClients: 1,
+									},
+								},
+							},
+						},
+					},
+					NewClients: &activity.NewClientRecord{
+						Counts: &activity.CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+						Namespaces: []*activity.MonthlyNamespaceRecord{
+							{
+								NamespaceID: "ns1",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+									SecretSyncs:      1,
+									ACMEClients:      1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+										Counts: &activity.CountsRecord{
+											EntityClients:    1,
+											NonEntityClients: 1,
+											SecretSyncs:      1,
+											ACMEClients:      1,
+										},
+									},
+								},
+							},
+							{
+								NamespaceID: "ns2",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+										Counts: &activity.CountsRecord{
+											EntityClients:    1,
+											NonEntityClients: 1,
+										},
+									},
+								},
+							},
+							{
+								NamespaceID: "ns3",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 1,
+									ACMEClients: 1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+										Counts: &activity.CountsRecord{
+											SecretSyncs: 1,
+											ACMEClients: 1,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				{
+					Timestamp: segments[1].StartTime.Unix(),
+					Counts: &activity.CountsRecord{
+						EntityClients:    4,
+						NonEntityClients: 4,
+						SecretSyncs:      4,
+						ACMEClients:      4,
+					},
+					Namespaces: []*activity.MonthlyNamespaceRecord{
+						{
+							NamespaceID: "ns1",
+							Counts: &activity.CountsRecord{
+								EntityClients:    2,
+								NonEntityClients: 2,
+								SecretSyncs:      2,
+								ACMEClients:      2,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+									Counts: &activity.CountsRecord{
+										EntityClients:    2,
+										NonEntityClients: 2,
+										SecretSyncs:      2,
+										ACMEClients:      2,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns2",
+							Counts: &activity.CountsRecord{
+								EntityClients:    2,
+								NonEntityClients: 2,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+									Counts: &activity.CountsRecord{
+										EntityClients:    2,
+										NonEntityClients: 2,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns3",
+							Counts: &activity.CountsRecord{
+								SecretSyncs: 2,
+								ACMEClients: 2,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+									Counts: &activity.CountsRecord{
+										SecretSyncs: 2,
+										ACMEClients: 2,
+									},
+								},
+							},
+						},
+					},
+					NewClients: &activity.NewClientRecord{
+						Counts: &activity.CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+						Namespaces: []*activity.MonthlyNamespaceRecord{
+							{
+								NamespaceID: "ns1",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+									SecretSyncs:      1,
+									ACMEClients:      1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+										Counts: &activity.CountsRecord{
+											EntityClients:    1,
+											NonEntityClients: 1,
+											SecretSyncs:      1,
+											ACMEClients:      1,
+										},
+									},
+								},
+							},
+							{
+								NamespaceID: "ns2",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+										Counts: &activity.CountsRecord{
+											EntityClients:    1,
+											NonEntityClients: 1,
+										},
+									},
+								},
+							},
+							{
+								NamespaceID: "ns3",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 1,
+									ACMEClients: 1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+										Counts: &activity.CountsRecord{
+											SecretSyncs: 1,
+											ACMEClients: 1,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name:      "current billing period three months",
+			startTime: segments[0].StartTime,
+			endTime:   timeutil.EndOfMonth(segments[2].StartTime),
+			expectedNamespaces: []*activity.NamespaceRecord{
+				{
+					NamespaceID:     "ns1",
+					Entities:        3,
+					NonEntityTokens: 3,
+					SecretSyncs:     3,
+					ACMEClients:     3,
+					Mounts: []*activity.MountRecord{
+						{
+							MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+							Counts:    &activity.CountsRecord{EntityClients: 3, NonEntityClients: 3, SecretSyncs: 3, ACMEClients: 3},
+						},
+					},
+				},
+				{
+					NamespaceID:     "ns2",
+					Entities:        2,
+					NonEntityTokens: 2,
+					Mounts: []*activity.MountRecord{
+						{
+							MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+							Counts:    &activity.CountsRecord{EntityClients: 2, NonEntityClients: 2},
+						},
+					},
+				},
+				{
+					NamespaceID: "ns3",
+					SecretSyncs: 2,
+					ACMEClients: 2,
+					Mounts: []*activity.MountRecord{
+						{
+							MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+							Counts:    &activity.CountsRecord{SecretSyncs: 2, ACMEClients: 2},
+						},
+					},
+				},
+			},
+			expectedMonths: []*activity.MonthRecord{
+				{
+					Timestamp: segments[0].StartTime.Unix(),
+					Counts: &activity.CountsRecord{
+						EntityClients:    2,
+						NonEntityClients: 2,
+						SecretSyncs:      2,
+						ACMEClients:      2,
+					},
+					Namespaces: []*activity.MonthlyNamespaceRecord{
+						{
+							NamespaceID: "ns1",
+							Counts: &activity.CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+								SecretSyncs:      1,
+								ACMEClients:      1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+									Counts: &activity.CountsRecord{
+										EntityClients:    1,
+										NonEntityClients: 1,
+										SecretSyncs:      1,
+										ACMEClients:      1,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns2",
+							Counts: &activity.CountsRecord{
+								EntityClients:    1,
+								NonEntityClients: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+									Counts: &activity.CountsRecord{
+										EntityClients:    1,
+										NonEntityClients: 1,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns3",
+							Counts: &activity.CountsRecord{
+								SecretSyncs: 1,
+								ACMEClients: 1,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+									Counts: &activity.CountsRecord{
+										SecretSyncs: 1,
+										ACMEClients: 1,
+									},
+								},
+							},
+						},
+					},
+					NewClients: &activity.NewClientRecord{
+						Counts: &activity.CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+						Namespaces: []*activity.MonthlyNamespaceRecord{
+							{
+								NamespaceID: "ns1",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+									SecretSyncs:      1,
+									ACMEClients:      1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+										Counts: &activity.CountsRecord{
+											EntityClients:    1,
+											NonEntityClients: 1,
+											SecretSyncs:      1,
+											ACMEClients:      1,
+										},
+									},
+								},
+							},
+							{
+								NamespaceID: "ns2",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+										Counts: &activity.CountsRecord{
+											EntityClients:    1,
+											NonEntityClients: 1,
+										},
+									},
+								},
+							},
+							{
+								NamespaceID: "ns3",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 1,
+									ACMEClients: 1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+										Counts: &activity.CountsRecord{
+											SecretSyncs: 1,
+											ACMEClients: 1,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				{
+					Timestamp: segments[1].StartTime.Unix(),
+					Counts: &activity.CountsRecord{
+						EntityClients:    4,
+						NonEntityClients: 4,
+						SecretSyncs:      4,
+						ACMEClients:      4,
+					},
+					Namespaces: []*activity.MonthlyNamespaceRecord{
+						{
+							NamespaceID: "ns1",
+							Counts: &activity.CountsRecord{
+								EntityClients:    2,
+								NonEntityClients: 2,
+								SecretSyncs:      2,
+								ACMEClients:      2,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+									Counts: &activity.CountsRecord{
+										EntityClients:    2,
+										NonEntityClients: 2,
+										SecretSyncs:      2,
+										ACMEClients:      2,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns2",
+							Counts: &activity.CountsRecord{
+								EntityClients:    2,
+								NonEntityClients: 2,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+									Counts: &activity.CountsRecord{
+										EntityClients:    2,
+										NonEntityClients: 2,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns3",
+							Counts: &activity.CountsRecord{
+								SecretSyncs: 2,
+								ACMEClients: 2,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+									Counts: &activity.CountsRecord{
+										SecretSyncs: 2,
+										ACMEClients: 2,
+									},
+								},
+							},
+						},
+					},
+					NewClients: &activity.NewClientRecord{
+						Counts: &activity.CountsRecord{
+							EntityClients:    2,
+							NonEntityClients: 2,
+							SecretSyncs:      2,
+							ACMEClients:      2,
+						},
+						Namespaces: []*activity.MonthlyNamespaceRecord{
+							{
+								NamespaceID: "ns1",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+									SecretSyncs:      1,
+									ACMEClients:      1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+										Counts: &activity.CountsRecord{
+											EntityClients:    1,
+											NonEntityClients: 1,
+											SecretSyncs:      1,
+											ACMEClients:      1,
+										},
+									},
+								},
+							},
+							{
+								NamespaceID: "ns2",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+										Counts: &activity.CountsRecord{
+											EntityClients:    1,
+											NonEntityClients: 1,
+										},
+									},
+								},
+							},
+							{
+								NamespaceID: "ns3",
+								Counts: &activity.CountsRecord{
+									SecretSyncs: 1,
+									ACMEClients: 1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+										Counts: &activity.CountsRecord{
+											SecretSyncs: 1,
+											ACMEClients: 1,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				{
+					Timestamp: segments[2].StartTime.Unix(),
+					Counts: &activity.CountsRecord{
+						EntityClients:    5,
+						NonEntityClients: 5,
+						SecretSyncs:      5,
+						ACMEClients:      5,
+					},
+					Namespaces: []*activity.MonthlyNamespaceRecord{
+						{
+							NamespaceID: "ns1",
+							Counts: &activity.CountsRecord{
+								EntityClients:    3,
+								NonEntityClients: 3,
+								SecretSyncs:      3,
+								ACMEClients:      3,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+									Counts: &activity.CountsRecord{
+										EntityClients:    3,
+										NonEntityClients: 3,
+										SecretSyncs:      3,
+										ACMEClients:      3,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns2",
+							Counts: &activity.CountsRecord{
+								EntityClients:    2,
+								NonEntityClients: 2,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount2"),
+									Counts: &activity.CountsRecord{
+										EntityClients:    2,
+										NonEntityClients: 2,
+									},
+								},
+							},
+						},
+						{
+							NamespaceID: "ns3",
+							Counts: &activity.CountsRecord{
+								SecretSyncs: 2,
+								ACMEClients: 2,
+							},
+							Mounts: []*activity.MountRecord{
+								{
+									MountPath: fmt.Sprintf(DeletedMountFmt, "mount3"),
+									Counts: &activity.CountsRecord{
+										SecretSyncs: 2,
+										ACMEClients: 2,
+									},
+								},
+							},
+						},
+					},
+					NewClients: &activity.NewClientRecord{
+						Counts: &activity.CountsRecord{
+							EntityClients:    1,
+							NonEntityClients: 1,
+							SecretSyncs:      1,
+							ACMEClients:      1,
+						},
+						Namespaces: []*activity.MonthlyNamespaceRecord{
+							{
+								NamespaceID: "ns1",
+								Counts: &activity.CountsRecord{
+									EntityClients:    1,
+									NonEntityClients: 1,
+									SecretSyncs:      1,
+									ACMEClients:      1,
+								},
+								Mounts: []*activity.MountRecord{
+									{
+										MountPath: fmt.Sprintf(DeletedMountFmt, "mount1"),
+										Counts: &activity.CountsRecord{
+											EntityClients:    1,
+											NonEntityClients: 1,
+											SecretSyncs:      1,
+											ACMEClients:      1,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name:               "past billing period no activity",
+			startTime:          timeutil.MonthsPreviousTo(5, time.Now().UTC()),
+			endTime:            timeutil.EndOfMonth(timeutil.StartOfPreviousMonth(segments[0].StartTime)),
+			expectedNamespaces: []*activity.NamespaceRecord{},
+			expectedMonths:     []*activity.MonthRecord{},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			core, _, _ := TestCoreUnsealed(t)
+			a := core.activityLog
+			a.SetEnable(true)
+			ctx := namespace.RootContext(nil)
+
+			// Write segments to storage
+			for i := 0; i < len(segments); i++ {
+				writeEntitySegment(t, core, segments[i].StartTime, 0, &activity.EntityActivityLog{Clients: segments[i].Clients})
+			}
+
+			// Write intent logs for previous months and create precomputed queries
+			writeIntentLog(t, core, segments[0].StartTime)
+			a.SetStartTimestamp(segments[1].StartTime.Unix())
+			err := a.precomputedQueryWorker(ctx, nil)
+			require.NoError(t, err)
+			expectMissingSegment(t, core, "sys/counters/activity/endofmonth")
+
+			writeIntentLog(t, core, segments[1].StartTime)
+			a.SetStartTimestamp(segments[2].StartTime.Unix())
+			err = a.precomputedQueryWorker(ctx, nil)
+			require.NoError(t, err)
+			expectMissingSegment(t, core, "sys/counters/activity/endofmonth")
+
+			// add repeated clients seen till last month to in-memory map
+			repeatedClients := make(map[string]struct{})
+			for _, c := range clients[:16] {
+				repeatedClients[c.ClientID] = struct{}{}
+			}
+			a.SetClientIDsUsageInfo(repeatedClients)
+
+			// Refresh partialMonthClientTracker with current segments
+			var wg sync.WaitGroup
+			err = a.refreshFromStoredLog(namespace.RootContext(nil), &wg, time.Now().UTC())
+			require.NoError(t, err, "error loading clients")
+			wg.Wait()
+
+			// Validate computeClientsInBillingPeriod for the specified billing period
+			pq, err := a.computeClientsInBillingPeriod(ctx, tc.startTime, tc.endTime)
+			require.NoError(t, err)
+			require.NotNil(t, pq)
+			require.Len(t, pq.Namespaces, len(tc.expectedNamespaces))
+			equalActivityNamespaceRecords(t, tc.expectedNamespaces, pq.Namespaces)
+			require.Len(t, pq.Months, len(tc.expectedMonths))
+			// Ensure months are in chronological order
+			sort.SliceStable(pq.Months, func(i, j int) bool {
+				return pq.Months[i].Timestamp < pq.Months[j].Timestamp
+			})
+			for i := range pq.Months {
+				require.Equal(t, tc.expectedMonths[i].Timestamp, pq.Months[i].Timestamp)
+				equalActivityMonthRecords(t, tc.expectedMonths[i], pq.Months[i])
+			}
+		})
+	}
+}
+
+// writeIntentLog writes an intent log for the end of a given month
+func writeIntentLog(t *testing.T, core *Core, ts time.Time) {
+	t.Helper()
+	intent := &ActivityIntentLog{
+		PreviousMonth: ts.Unix(),
+		NextMonth:     timeutil.StartOfNextMonth(ts).Unix(),
+	}
+	data, err := json.Marshal(intent)
+	require.NoError(t, err)
+	WriteToStorage(t, core, "sys/counters/activity/endofmonth", data)
+}
+
 // writeEntitySegment writes a single segment file with the given time and index for an entity
 func writeEntitySegment(t *testing.T, core *Core, ts time.Time, index int, item *activity.EntityActivityLog) {
 	t.Helper()
@@ -348,3 +2048,70 @@ func TestSegmentFileReader(t *testing.T) {
 		require.True(t, proto.Equal(gotTokens[i], tokens[i]))
 	}
 }
+
+// Test_ActivityLog_ComputeMaxSegmentsAndCapacity verifies the computed max values for
+// ActivitySegmentClientCapacity which determines the maximum number of client records per segment and
+// activityLogMaxSegmentPerMonth which determines the maximum number of segments per month
+func Test_ActivityLog_ComputeMaxSegmentsAndCapacity(t *testing.T) {
+	entityRecordInstance := &activity.EntityRecord{}
+
+	// Get the message's descriptor
+	descriptor := entityRecordInstance.ProtoReflect().Descriptor()
+
+	// Get the number of fields from the descriptor
+	expectedFieldCount := descriptor.Fields().Len()
+
+	// sample record with max values for each field in entity record
+	maxSampleRecord := &activity.EntityRecord{
+		ClientID:      "11111111-1111-1111-1111-111111111111",
+		NamespaceID:   "root",
+		Timestamp:     time.Now().Unix(),
+		NonEntity:     true,
+		MountAccessor: "auth_userpass_00000005",
+		ClientType:    "non-entity-token",
+		UsageTime:     time.Now().Unix(),
+	}
+	fieldCountMaxSampleRecord := getNumberofPopulatedFieldsInRecord(maxSampleRecord.ProtoReflect())
+
+	// verify if the maxSampleRecord has populated values for every field in entityRecord
+	// this will be used to compute the max client record size to store in storage
+	// if this fails, please update the maxSampleRecord with updated entity Record field values
+	require.Equal(t, expectedFieldCount, fieldCountMaxSampleRecord)
+
+	// sample record size in bytes
+	sampleRecordSize := proto.Size(maxSampleRecord)
+
+	// adding 20 extra bytes to the sample record to account for any extra unknown size increases
+	sampleRecordSize = sampleRecordSize + 20
+
+	// records undergo JSON marshalling which increases the size by approx 4/3 times
+	sampleRecordSizeStorage := int(float64(sampleRecordSize*4) / float64(3))
+
+	// storage limit per storage entry 512KB
+	storageLimitPerEntry := 512 * 1000
+
+	// number of client records that can be stored in a segment
+	clientRecordsPerSegment := storageLimitPerEntry / sampleRecordSizeStorage
+
+	require.Condition(t, func() bool {
+		return clientRecordsPerSegment <= ActivitySegmentClientCapacity
+	}, "client records in segment is greater than expected ActivitySegmentClientCapacity. Please recompute and update ActivitySegmentClientCapacity")
+
+	// max entity records per month
+	expectedClientRecordsPerMonth := 700 * 1000
+
+	maxSegmentsPerMonth := expectedClientRecordsPerMonth / clientRecordsPerSegment
+
+	require.Condition(t, func() bool {
+		return maxSegmentsPerMonth <= activityLogMaxSegmentPerMonth
+	}, "segments per month is greater than expected activityLogMaxSegmentPerMonth. Please recompute and update activityLogMaxSegmentPerMonth")
+}
+
+func getNumberofPopulatedFieldsInRecord(msg protoreflect.Message) int {
+	count := 0
+	msg.Range(func(fd protoreflect.FieldDescriptor, v protoreflect.Value) bool {
+		count++
+		return true
+	})
+	return count
+}
diff --git a/vault/audit.go b/vault/audit.go
index 0f0182be478..f26d9f99a2b 100644
--- a/vault/audit.go
+++ b/vault/audit.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -8,6 +8,8 @@ import (
 	"crypto/sha256"
 	"errors"
 	"fmt"
+	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -16,6 +18,7 @@ import (
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/audit"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/salt"
@@ -62,8 +65,27 @@ func (c *Core) generateAuditTestProbe() (*logical.LogInput, error) {
 	}, nil
 }
 
-// enableAudit is used to enable a new audit backend
+// auditBackendEntryAddrs maps a backend type to entry options that may need
+// to be normalized for conformance. All audit backends must have an entry.
+var auditBackendEntryAddrs = map[string][]string{
+	"file":   {},
+	"noop":   {},
+	"socket": {"address"},
+	"syslog": {},
+}
+
+// enableAudit is used to enable a new audit backend that didn't exist in storage beforehand.
 func (c *Core) enableAudit(ctx context.Context, entry *MountEntry, updateStorage bool) error {
+	// Check ahead of time if the type of audit device we're trying to enable is configured in Vault.
+	if _, ok := c.auditBackends[entry.Type]; !ok {
+		return fmt.Errorf("unknown backend type: %q: %w", entry.Type, audit.ErrExternalOptions)
+	}
+
+	// We can check early to ensure that non-Enterprise versions aren't trying to supply Enterprise only options.
+	if audit.HasInvalidOptions(entry.Options) {
+		return fmt.Errorf("enterprise-only options supplied: %w", audit.ErrExternalOptions)
+	}
+
 	// Ensure we end the path in a slash
 	if !strings.HasSuffix(entry.Path, "/") {
 		entry.Path += "/"
@@ -71,35 +93,87 @@ func (c *Core) enableAudit(ctx context.Context, entry *MountEntry, updateStorage
 
 	// Ensure there is a name
 	if entry.Path == "/" {
-		return fmt.Errorf("backend path must be specified")
+		return fmt.Errorf("backend path must be specified: %w", audit.ErrExternalOptions)
+	}
+
+	// Normalize any entries that might have addresses
+	keys, ok := auditBackendEntryAddrs[entry.Type]
+	if !ok {
+		return fmt.Errorf("backend type '%s' is missing normalization entry", entry.Type)
+	}
+	for k, v := range entry.Options {
+		if slices.Contains(keys, k) {
+			entry.Options[k] = configutil.NormalizeAddr(v)
+		}
 	}
 
-	if fallbackRaw, ok := entry.Options["fallback"]; ok {
-		fallback, err := parseutil.ParseBool(fallbackRaw)
+	if skipTestRaw, ok := entry.Options["skip_test"]; ok {
+		skipTest, err := parseutil.ParseBool(skipTestRaw)
 		if err != nil {
-			return fmt.Errorf("unable to enable audit device '%s', cannot parse supplied 'fallback' setting: %w", entry.Path, err)
+			return fmt.Errorf("cannot parse supplied 'skip_test' setting: %w", audit.ErrExternalOptions)
 		}
 
-		// Reassigning the fallback value means we can ensure that the formatting
+		// Reassigning the value means we can ensure that the formatting
 		// of it as a string is consistent for future comparisons.
-		entry.Options["fallback"] = strconv.FormatBool(fallback)
+		entry.Options["skip_test"] = strconv.FormatBool(skipTest)
+	}
+
+	ns, err := namespace.FromContext(ctx)
+	if err != nil {
+		return fmt.Errorf("%w: %w", audit.ErrInternal, err)
+	}
+	entry.NamespaceID = ns.ID
+	entry.namespace = ns
+
+	if entry.Type == "file" {
+		if prefix, ok := entry.Options[audit.OptionPrefix]; ok && prefix != "" && !c.allowAuditLogPrefixing {
+			return errors.New("audit prefixing is not enabled in configuration, audit prefixing may not be configured for file sinks")
+		}
+
+		if c.pluginDirectory != "" {
+			// Validate that the audit log file is not in the plugin directory
+			auditDir := filepath.Dir(entry.Options["file_path"])
+			auditDir, err = filepath.Abs(auditDir)
+			if err != nil {
+				return fmt.Errorf("error getting absolute path of audit dir for audit validation: %w", err)
+			}
+			pluginDir, err := filepath.Abs(c.pluginDirectory)
+			if err != nil {
+				return fmt.Errorf("error getting absolute path of plugin dir for audit validation: %w", err)
+			}
+			// Walk the audit path up checking that none of them are the plugin dir
+			for len(auditDir) > 1 || auditDir[0] != filepath.Separator {
+				rp, err := filepath.Rel(pluginDir, auditDir)
+				if err != nil {
+					return fmt.Errorf("error checking relative path for audit validation: %w", err)
+				}
+				if rp == "." {
+					return errors.New("audit file target may not be in the plugin directory")
+				}
+				auditDir = filepath.Dir(auditDir)
+			}
+		}
 	}
 
-	// Update the audit table
 	c.auditLock.Lock()
 	defer c.auditLock.Unlock()
 
 	// Look for matching name
 	for _, ent := range c.audit.Entries {
 		switch {
-		case entry.Options["fallback"] == "true" && ent.Options["fallback"] == "true":
-			return fmt.Errorf("unable to enable audit device '%s', a fallback device already exists '%s'", entry.Path, ent.Path)
 		// Existing is sql/mysql/ new is sql/ or
 		// existing is sql/ and new is sql/mysql/
 		case strings.HasPrefix(ent.Path, entry.Path):
 			fallthrough
 		case strings.HasPrefix(entry.Path, ent.Path):
-			return fmt.Errorf("path already in use")
+			return fmt.Errorf("path already in use: %w", audit.ErrExternalOptions)
+		}
+
+		// Ensure that the provided file_path argument isn't already used for another audit device's file_path.
+		if entry.Type == "file" {
+			if entry.Options["file_path"] == ent.Options["file_path"] {
+				return fmt.Errorf("file_path already in use: %w", audit.ErrExternalOptions)
+			}
 		}
 	}
 
@@ -107,75 +181,69 @@ func (c *Core) enableAudit(ctx context.Context, entry *MountEntry, updateStorage
 	if entry.UUID == "" {
 		entryUUID, err := uuid.GenerateUUID()
 		if err != nil {
-			return err
+			return fmt.Errorf("%w: %w", audit.ErrInternal, err)
 		}
 		entry.UUID = entryUUID
 	}
 	if entry.Accessor == "" {
 		accessor, err := c.generateMountAccessor("audit_" + entry.Type)
 		if err != nil {
-			return err
+			return fmt.Errorf("%w: %w", audit.ErrInternal, err)
 		}
 		entry.Accessor = accessor
 	}
 	viewPath := entry.ViewPath()
 	view := NewBarrierView(c.barrier, viewPath)
-	addAuditPathChecker(c, entry, view, viewPath)
-	origViewReadOnlyErr := view.getReadOnlyErr()
 
 	// Mark the view as read-only until the mounting is complete and
 	// ensure that it is reset after. This ensures that there will be no
 	// writes during the construction of the backend.
+	defer view.setReadOnlyErr(view.getReadOnlyErr())
 	view.setReadOnlyErr(logical.ErrSetupReadOnly)
-	defer view.setReadOnlyErr(origViewReadOnlyErr)
 
 	// Lookup the new backend
-	backend, err := c.newAuditBackend(ctx, entry, view, entry.Options)
+	backend, err := c.newAuditBackend(entry, view, entry.Options)
 	if err != nil {
 		return err
 	}
 	if backend == nil {
-		return fmt.Errorf("nil audit backend of type %q returned from factory", entry.Type)
+		return fmt.Errorf("nil audit backend of type %q: %w", entry.Type, audit.ErrInternal)
 	}
 
 	if entry.Options["skip_test"] != "true" {
 		// Test the new audit device and report failure if it doesn't work.
 		testProbe, err := c.generateAuditTestProbe()
 		if err != nil {
-			return err
+			return fmt.Errorf("error generating test probe: %w: %w", audit.ErrInternal, err)
 		}
 		err = backend.LogTestMessage(ctx, testProbe)
 		if err != nil {
 			c.logger.Error("new audit backend failed test", "path", entry.Path, "type", entry.Type, "error", err)
 			return fmt.Errorf("audit backend failed test message: %w", err)
-
 		}
 	}
 
-	newTable := c.audit.shallowClone()
-	newTable.Entries = append(newTable.Entries, entry)
-
-	ns, err := namespace.FromContext(ctx)
+	// Now that we're happy that the backend has been created correctly, we can
+	// try to register the backend with the audit broker.
+	// An error at this point doesn't cause issues anywhere outside the broker.
+	err = c.auditBroker.Register(backend, entry.Local)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to register %q audit backend %q: %w", entry.Type, entry.Path, err)
 	}
-	entry.NamespaceID = ns.ID
-	entry.namespace = ns
 
+	// Update a copy of the mount table, we will swap out the oneCore has access to
+	// for this one unless there is a problem persisting storage (if required).
+	newTable := c.audit.shallowClone()
+	newTable.Entries = append(newTable.Entries, entry)
 	if updateStorage {
 		if err := c.persistAudit(ctx, newTable, entry.Local); err != nil {
-			return errors.New("failed to update audit table")
+			return fmt.Errorf("failed to update audit table: %w: %w", audit.ErrInternal, err)
 		}
 	}
 
+	// Wrap things up, add the path checker, swap the table, log our success.
+	addAuditPathChecker(c, entry, view, viewPath)
 	c.audit = newTable
-
-	// Register the backend
-	err = c.auditBroker.Register(entry.Path, backend, entry.Local)
-	if err != nil {
-		return fmt.Errorf("failed to register %q audit backend %q: %w", entry.Type, entry.Path, err)
-	}
-
 	c.logger.Info("enabled audit backend", "path", entry.Path, "type", entry.Type)
 	return nil
 }
@@ -224,7 +292,7 @@ func (c *Core) disableAudit(ctx context.Context, path string, updateStorage bool
 	if updateStorage {
 		// Update the audit table
 		if err := c.persistAudit(ctx, newTable, entry.Local); err != nil {
-			return existed, errors.New("failed to update audit table")
+			return existed, fmt.Errorf("failed to update audit table: %w: %w", audit.ErrInternal, err)
 		}
 	}
 
@@ -410,10 +478,11 @@ func (c *Core) setupAudits(ctx context.Context) error {
 
 	brokerLogger := c.baseLogger.Named("audit")
 
-	broker, err := NewAuditBroker(brokerLogger)
+	broker, err := audit.NewBroker(brokerLogger)
 	if err != nil {
 		return err
 	}
+	c.auditBroker = broker
 
 	var successCount int
 
@@ -421,19 +490,17 @@ func (c *Core) setupAudits(ctx context.Context) error {
 		// Create a barrier view using the UUID
 		viewPath := entry.ViewPath()
 		view := NewBarrierView(c.barrier, viewPath)
-		addAuditPathChecker(c, entry, view, viewPath)
-		origViewReadOnlyErr := view.getReadOnlyErr()
 
 		// Mark the view as read-only until the mounting is complete and
 		// ensure that it is reset after. This ensures that there will be no
 		// writes during the construction of the backend.
 		view.setReadOnlyErr(logical.ErrSetupReadOnly)
 		c.postUnsealFuncs = append(c.postUnsealFuncs, func() {
-			view.setReadOnlyErr(origViewReadOnlyErr)
+			view.setReadOnlyErr(view.getReadOnlyErr())
 		})
 
 		// Initialize the backend
-		backend, err := c.newAuditBackend(ctx, entry, view, entry.Options)
+		backend, err := c.newAuditBackend(entry, view, entry.Options)
 		if err != nil {
 			c.logger.Error("failed to create audit entry", "path", entry.Path, "error", err)
 			continue
@@ -444,12 +511,13 @@ func (c *Core) setupAudits(ctx context.Context) error {
 		}
 
 		// Mount the backend
-		err = broker.Register(entry.Path, backend, entry.Local)
+		err = broker.Register(backend, entry.Local)
 		if err != nil {
 			c.logger.Error("failed to setup audit backed", "path", entry.Path, "type", entry.Type, "error", err)
 			continue
 		}
 
+		addAuditPathChecker(c, entry, view, viewPath)
 		successCount++
 	}
 
@@ -457,7 +525,6 @@ func (c *Core) setupAudits(ctx context.Context) error {
 		return errLoadAuditFailed
 	}
 
-	c.auditBroker = broker
 	c.AddLogger(brokerLogger)
 	return nil
 }
@@ -491,7 +558,7 @@ func (c *Core) teardownAudits() error {
 // audit lock needs to be held before calling this.
 func (c *Core) removeAuditReloadFunc(entry *MountEntry) {
 	switch entry.Type {
-	case "file":
+	case audit.TypeFile:
 		key := "audit_file|" + entry.Path
 		c.reloadFuncsLock.Lock()
 
@@ -506,10 +573,15 @@ func (c *Core) removeAuditReloadFunc(entry *MountEntry) {
 }
 
 // newAuditBackend is used to create and configure a new audit backend by name
-func (c *Core) newAuditBackend(ctx context.Context, entry *MountEntry, view logical.Storage, conf map[string]string) (audit.Backend, error) {
+func (c *Core) newAuditBackend(entry *MountEntry, view logical.Storage, conf map[string]string) (audit.Backend, error) {
+	// Ensure that non-Enterprise versions aren't trying to supply Enterprise only options.
+	if audit.HasInvalidOptions(entry.Options) {
+		return nil, fmt.Errorf("enterprise-only options supplied: %w", audit.ErrInvalidParameter)
+	}
+
 	f, ok := c.auditBackends[entry.Type]
 	if !ok {
-		return nil, fmt.Errorf("unknown backend type: %q", entry.Type)
+		return nil, fmt.Errorf("unknown backend type: %q: %w", entry.Type, audit.ErrInvalidParameter)
 	}
 	saltConfig := &salt.Config{
 		HMAC:     sha256.New,
@@ -518,24 +590,22 @@ func (c *Core) newAuditBackend(ctx context.Context, entry *MountEntry, view logi
 	}
 	auditLogger := c.baseLogger.Named("audit")
 
-	be, err := f(
-		ctx, &audit.BackendConfig{
-			SaltView:   view,
-			SaltConfig: saltConfig,
-			Config:     conf,
-			MountPath:  entry.Path,
-			Logger:     auditLogger,
-		},
-		c.auditedHeaders)
+	be, err := f(&audit.BackendConfig{
+		SaltView:   view,
+		SaltConfig: saltConfig,
+		Config:     conf,
+		MountPath:  entry.Path,
+		Logger:     auditLogger,
+	}, c.auditedHeaders)
 	if err != nil {
 		return nil, fmt.Errorf("unable to create new audit backend: %w", err)
 	}
 	if be == nil {
-		return nil, fmt.Errorf("nil backend returned from %q factory function", entry.Type)
+		return nil, fmt.Errorf("nil backend returned from %q factory function: %w", entry.Type, audit.ErrInternal)
 	}
 
 	switch entry.Type {
-	case "file":
+	case audit.TypeFile:
 		key := "audit_file|" + entry.Path
 
 		c.reloadFuncsLock.Lock()
@@ -549,15 +619,15 @@ func (c *Core) newAuditBackend(ctx context.Context, entry *MountEntry, view logi
 
 		c.reloadFuncs[key] = append(c.reloadFuncs[key], func() error {
 			auditLogger.Info("reloading file audit backend", "path", entry.Path)
-			return be.Reload(ctx)
+			return be.Reload()
 		})
 
 		c.reloadFuncsLock.Unlock()
-	case "socket":
+	case audit.TypeSocket:
 		if auditLogger.IsDebug() && entry.Options != nil {
 			auditLogger.Debug("socket backend options", "path", entry.Path, "address", entry.Options["address"], "socket type", entry.Options["socket_type"])
 		}
-	case "syslog":
+	case audit.TypeSyslog:
 		if auditLogger.IsDebug() && entry.Options != nil {
 			auditLogger.Debug("syslog backend options", "path", entry.Path, "facility", entry.Options["facility"], "tag", entry.Options["tag"])
 		}
@@ -585,17 +655,23 @@ type basicAuditor struct {
 }
 
 func (b *basicAuditor) AuditRequest(ctx context.Context, input *logical.LogInput) error {
-	if b.c.auditBroker == nil {
+	b.c.auditLock.RLock()
+	auditBroker := b.c.auditBroker
+	b.c.auditLock.RUnlock()
+	if auditBroker == nil {
 		return consts.ErrSealed
 	}
-	return b.c.auditBroker.LogRequest(ctx, input)
+	return auditBroker.LogRequest(ctx, input)
 }
 
 func (b *basicAuditor) AuditResponse(ctx context.Context, input *logical.LogInput) error {
-	if b.c.auditBroker == nil {
+	b.c.auditLock.RLock()
+	auditBroker := b.c.auditBroker
+	b.c.auditLock.RUnlock()
+	if auditBroker == nil {
 		return consts.ErrSealed
 	}
-	return b.c.auditBroker.LogResponse(ctx, input)
+	return auditBroker.LogResponse(ctx, input)
 }
 
 type genericAuditor struct {
@@ -608,12 +684,24 @@ func (g genericAuditor) AuditRequest(ctx context.Context, input *logical.LogInpu
 	ctx = namespace.ContextWithNamespace(ctx, g.namespace)
 	logInput := *input
 	logInput.Type = g.mountType + "-request"
-	return g.c.auditBroker.LogRequest(ctx, &logInput)
+	g.c.auditLock.RLock()
+	auditBroker := g.c.auditBroker
+	g.c.auditLock.RUnlock()
+	if auditBroker == nil {
+		return consts.ErrSealed
+	}
+	return auditBroker.LogRequest(ctx, &logInput)
 }
 
 func (g genericAuditor) AuditResponse(ctx context.Context, input *logical.LogInput) error {
 	ctx = namespace.ContextWithNamespace(ctx, g.namespace)
 	logInput := *input
 	logInput.Type = g.mountType + "-response"
-	return g.c.auditBroker.LogResponse(ctx, &logInput)
+	g.c.auditLock.RLock()
+	auditBroker := g.c.auditBroker
+	g.c.auditLock.RUnlock()
+	if auditBroker == nil {
+		return consts.ErrSealed
+	}
+	return auditBroker.LogResponse(ctx, &logInput)
 }
diff --git a/vault/audit_broker.go b/vault/audit_broker.go
deleted file mode 100644
index 4992a241050..00000000000
--- a/vault/audit_broker.go
+++ /dev/null
@@ -1,538 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package vault
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/armon/go-metrics"
-	"github.com/hashicorp/eventlogger"
-	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/go-multierror"
-	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/internal/observability/event"
-	"github.com/hashicorp/vault/sdk/logical"
-)
-
-type backendEntry struct {
-	backend audit.Backend
-	local   bool
-}
-
-// AuditBroker is used to provide a single ingest interface to auditable
-// events given that multiple backends may be configured.
-type AuditBroker struct {
-	sync.RWMutex
-	backends map[string]backendEntry
-
-	// broker is used to register pipelines for all devices except a fallback device.
-	broker *eventlogger.Broker
-
-	// fallbackBroker is used to register a pipeline to be used as a fallback
-	// in situations where we cannot use the eventlogger.Broker to guarantee that
-	// the required number of sinks were successfully written to. This situation
-	// occurs when all the audit devices registered with the broker use filtering.
-	// NOTE: there should only ever be a single device registered on the fallbackBroker.
-	fallbackBroker *eventlogger.Broker
-
-	// fallbackName stores the name (path) of the audit device which has been configured
-	// as the fallback pipeline (its eventlogger.PipelineID).
-	fallbackName string
-	logger       hclog.Logger
-}
-
-// NewAuditBroker creates a new audit broker
-func NewAuditBroker(log hclog.Logger) (*AuditBroker, error) {
-	const op = "vault.NewAuditBroker"
-
-	eventBroker, err := eventlogger.NewBroker()
-	if err != nil {
-		return nil, fmt.Errorf("%s: error creating event broker for audit events: %w", op, err)
-	}
-
-	// Set up the broker that will support a single fallback device.
-	fallbackEventBroker, err := eventlogger.NewBroker()
-	if err != nil {
-		return nil, fmt.Errorf("%s: error creating event fallback broker for audit event: %w", op, err)
-	}
-
-	broker := &AuditBroker{
-		backends:       make(map[string]backendEntry),
-		logger:         log,
-		broker:         eventBroker,
-		fallbackBroker: fallbackEventBroker,
-	}
-
-	return broker, nil
-}
-
-// Register is used to add new audit backend to the broker
-func (a *AuditBroker) Register(name string, backend audit.Backend, local bool) error {
-	const op = "vault.(AuditBroker).Register"
-
-	a.Lock()
-	defer a.Unlock()
-
-	name = strings.TrimSpace(name)
-	if name == "" {
-		return fmt.Errorf("%s: name is required: %w", op, event.ErrInvalidParameter)
-	}
-
-	// If the backend is already registered, we cannot re-register it.
-	if a.isRegistered(name) {
-		return fmt.Errorf("%s: backend already registered '%s'", op, name)
-	}
-
-	// Fallback devices are singleton instances, we cannot register more than one or overwrite the existing one.
-	if backend.IsFallback() && a.fallbackBroker.IsAnyPipelineRegistered(eventlogger.EventType(event.AuditType.String())) {
-		existing, err := a.existingFallbackName()
-		if err != nil {
-			return fmt.Errorf("%s: existing fallback device already registered: %w", op, err)
-		}
-
-		return fmt.Errorf("%s: existing fallback device already registered: %q", op, existing)
-	}
-
-	if name != backend.Name() {
-		return fmt.Errorf("%s: audit registration failed due to device name mismatch: %q, %q", op, name, backend.Name())
-	}
-
-	switch {
-	case backend.IsFallback():
-		err := a.registerFallback(name, backend)
-		if err != nil {
-			return fmt.Errorf("%s: unable to register fallback device for %q: %w", op, name, err)
-		}
-	default:
-		err := a.register(name, backend)
-		if err != nil {
-			return fmt.Errorf("%s: unable to register device for %q: %w", op, name, err)
-		}
-	}
-
-	a.backends[name] = backendEntry{
-		backend: backend,
-		local:   local,
-	}
-
-	return nil
-}
-
-// Deregister is used to remove an audit backend from the broker
-func (a *AuditBroker) Deregister(ctx context.Context, name string) error {
-	const op = "vault.(AuditBroker).Deregister"
-
-	a.Lock()
-	defer a.Unlock()
-
-	name = strings.TrimSpace(name)
-	if name == "" {
-		return fmt.Errorf("%s: name is required: %w", op, event.ErrInvalidParameter)
-	}
-
-	// If the backend isn't actually registered, then there's nothing to do.
-	// We don't return any error so that Deregister can be idempotent.
-	if !a.isRegistered(name) {
-		return nil
-	}
-
-	// Remove the Backend from the map first, so that if an error occurs while
-	// removing the pipeline and nodes, we can quickly exit this method with
-	// the error.
-	delete(a.backends, name)
-
-	switch {
-	case name == a.fallbackName:
-		err := a.deregisterFallback(ctx, name)
-		if err != nil {
-			return fmt.Errorf("%s: deregistration failed for fallback audit device %q: %w", op, name, err)
-		}
-	default:
-		err := a.deregister(ctx, name)
-		if err != nil {
-			return fmt.Errorf("%s: deregistration failed for audit device %q: %w", op, name, err)
-		}
-	}
-
-	return nil
-}
-
-// IsRegistered is used to check if a given audit backend is registered.
-func (a *AuditBroker) IsRegistered(name string) bool {
-	a.RLock()
-	defer a.RUnlock()
-
-	return a.isRegistered(name)
-}
-
-// isRegistered is used to check if a given audit backend is registered.
-// This method should be used within the AuditBroker to prevent locking issues.
-func (a *AuditBroker) isRegistered(name string) bool {
-	_, ok := a.backends[name]
-	return ok
-}
-
-// IsLocal is used to check if a given audit backend is registered
-func (a *AuditBroker) IsLocal(name string) (bool, error) {
-	a.RLock()
-	defer a.RUnlock()
-
-	be, ok := a.backends[name]
-	if ok {
-		return be.local, nil
-	}
-
-	return false, fmt.Errorf("unknown audit backend %q", name)
-}
-
-// GetHash returns a hash using the salt of the given backend
-func (a *AuditBroker) GetHash(ctx context.Context, name string, input string) (string, error) {
-	a.RLock()
-	defer a.RUnlock()
-
-	be, ok := a.backends[name]
-	if !ok {
-		return "", fmt.Errorf("unknown audit backend %q", name)
-	}
-
-	return audit.HashString(ctx, be.backend, input)
-}
-
-// LogRequest is used to ensure all the audit backends have an opportunity to
-// log the given request and that *at least one* succeeds.
-func (a *AuditBroker) LogRequest(ctx context.Context, in *logical.LogInput) (ret error) {
-	a.RLock()
-	defer a.RUnlock()
-
-	// If no backends are registered then we have no devices to log the request.
-	if len(a.backends) < 1 {
-		return nil
-	}
-
-	defer metrics.MeasureSince([]string{"audit", "log_request"}, time.Now())
-	defer func() {
-		metricVal := float32(0.0)
-		if ret != nil {
-			metricVal = 1.0
-		}
-		metrics.IncrCounter([]string{"audit", "log_request_failure"}, metricVal)
-	}()
-
-	var retErr *multierror.Error
-
-	e, err := audit.NewEvent(audit.RequestType)
-	if err != nil {
-		retErr = multierror.Append(retErr, err)
-		return retErr.ErrorOrNil()
-	}
-
-	e.Data = in
-
-	// There may be cases where only the fallback device was added but no other
-	// normal audit devices, so check if the broker had an audit based pipeline
-	// registered before trying to send to it.
-	var status eventlogger.Status
-	if a.broker.IsAnyPipelineRegistered(eventlogger.EventType(event.AuditType.String())) {
-		status, err = a.broker.Send(ctx, eventlogger.EventType(event.AuditType.String()), e)
-		if err != nil {
-			retErr = multierror.Append(retErr, multierror.Append(err, status.Warnings...))
-			return retErr.ErrorOrNil()
-		}
-	}
-
-	// Audit event ended up in at least 1 sink.
-	if len(status.CompleteSinks()) > 0 {
-		return retErr.ErrorOrNil()
-	}
-
-	// There were errors from inside the pipeline and we didn't write to a sink.
-	if len(status.Warnings) > 0 {
-		retErr = multierror.Append(retErr, multierror.Append(errors.New("error during audit pipeline processing"), status.Warnings...))
-		return retErr.ErrorOrNil()
-	}
-
-	// If a fallback device is registered we can rely on that to 'catch all'
-	// and also the broker level guarantee for completed sinks.
-	if a.fallbackBroker.IsAnyPipelineRegistered(eventlogger.EventType(event.AuditType.String())) {
-		status, err = a.fallbackBroker.Send(ctx, eventlogger.EventType(event.AuditType.String()), e)
-		if err != nil {
-			retErr = multierror.Append(retErr, multierror.Append(fmt.Errorf("auditing request to fallback device failed: %w", err), status.Warnings...))
-		}
-	} else {
-		// This audit event won't make it to any devices, we class this as a 'miss' for auditing.
-		metrics.IncrCounter(audit.MetricLabelsFallbackMiss(), 1)
-	}
-
-	return retErr.ErrorOrNil()
-}
-
-// LogResponse is used to ensure all the audit backends have an opportunity to
-// log the given response and that *at least one* succeeds.
-func (a *AuditBroker) LogResponse(ctx context.Context, in *logical.LogInput) (ret error) {
-	a.RLock()
-	defer a.RUnlock()
-
-	// If no backends are registered then we have no devices to send audit entries to.
-	if len(a.backends) < 1 {
-		return nil
-	}
-
-	defer metrics.MeasureSince([]string{"audit", "log_response"}, time.Now())
-	defer func() {
-		metricVal := float32(0.0)
-		if ret != nil {
-			metricVal = 1.0
-		}
-		metrics.IncrCounter([]string{"audit", "log_response_failure"}, metricVal)
-	}()
-
-	var retErr *multierror.Error
-
-	e, err := audit.NewEvent(audit.ResponseType)
-	if err != nil {
-		retErr = multierror.Append(retErr, err)
-		return retErr.ErrorOrNil()
-	}
-
-	e.Data = in
-
-	// In cases where we are trying to audit the response, we detach
-	// ourselves from the original context (keeping only the namespace).
-	// This is so that we get a fair run at writing audit entries if Vault
-	// has taken up a lot of time handling the request before audit (response)
-	// is triggered. Pipeline nodes and the eventlogger.Broker may check for a
-	// cancelled context and refuse to process the nodes further.
-	ns, err := namespace.FromContext(ctx)
-	if err != nil {
-		retErr = multierror.Append(retErr, fmt.Errorf("namespace missing from context: %w", err))
-		return retErr.ErrorOrNil()
-	}
-
-	auditContext, auditCancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer auditCancel()
-	auditContext = namespace.ContextWithNamespace(auditContext, ns)
-
-	// There may be cases where only the fallback device was added but no other
-	// normal audit devices, so check if the broker had an audit based pipeline
-	// registered before trying to send to it.
-	var status eventlogger.Status
-	if a.broker.IsAnyPipelineRegistered(eventlogger.EventType(event.AuditType.String())) {
-		status, err = a.broker.Send(auditContext, eventlogger.EventType(event.AuditType.String()), e)
-		if err != nil {
-			retErr = multierror.Append(retErr, multierror.Append(err, status.Warnings...))
-			return retErr.ErrorOrNil()
-		}
-	}
-
-	// Audit event ended up in at least 1 sink.
-	if len(status.CompleteSinks()) > 0 {
-		return retErr.ErrorOrNil()
-	}
-
-	// There were errors from inside the pipeline and we didn't write to a sink.
-	if len(status.Warnings) > 0 {
-		retErr = multierror.Append(retErr, multierror.Append(errors.New("error during audit pipeline processing"), status.Warnings...))
-		return retErr.ErrorOrNil()
-	}
-
-	// If a fallback device is registered we can rely on that to 'catch all'
-	// and also the broker level guarantee for completed sinks.
-	if a.fallbackBroker.IsAnyPipelineRegistered(eventlogger.EventType(event.AuditType.String())) {
-		status, err = a.fallbackBroker.Send(auditContext, eventlogger.EventType(event.AuditType.String()), e)
-		if err != nil {
-			retErr = multierror.Append(retErr, multierror.Append(fmt.Errorf("auditing response to fallback device failed: %w", err), status.Warnings...))
-		}
-	} else {
-		// This audit event won't make it to any devices, we class this as a 'miss' for auditing.
-		metrics.IncrCounter(audit.MetricLabelsFallbackMiss(), 1)
-	}
-
-	return retErr.ErrorOrNil()
-}
-
-func (a *AuditBroker) Invalidate(ctx context.Context, _ string) {
-	// For now, we ignore the key as this would only apply to salts.
-	// We just sort of brute force it on each one.
-	a.Lock()
-	defer a.Unlock()
-
-	for _, be := range a.backends {
-		be.backend.Invalidate(ctx)
-	}
-}
-
-// requiredSuccessThresholdSinks examines backends that have already been registered,
-// and returns the value that should be used for configuring success threshold sinks
-// on the eventlogger broker.
-// If all backends have nodes which provide filtering, then we cannot rely on the
-// guarantee provided by setting the threshold to 1, and must set it to 0.
-// If you are registering an audit device, you should first check if that backend
-// does not have filtering before querying the backends via requiredSuccessThresholdSinks.
-// backends may also contain a fallback device, which should be ignored as it is
-// handled by the fallbackBroker.
-func (a *AuditBroker) requiredSuccessThresholdSinks() int {
-	threshold := 0
-
-	// We might need to check over all the existing backends to discover if any
-	// don't use filtering.
-	for _, be := range a.backends {
-		switch {
-		case be.backend.IsFallback():
-			// Ignore fallback devices as they're handled by a separate broker.
-			continue
-		case !be.backend.HasFiltering():
-			threshold = 1
-			break
-		}
-	}
-
-	return threshold
-}
-
-// registerNodesAndPipeline registers eventlogger nodes and a pipeline with the
-// backend's name, on the specified eventlogger.Broker using the audit.Backend
-// to supply them.
-func registerNodesAndPipeline(broker *eventlogger.Broker, b audit.Backend) error {
-	const op = "vault.registerNodesAndPipeline"
-
-	for id, node := range b.Nodes() {
-		err := broker.RegisterNode(id, node)
-		if err != nil {
-			return fmt.Errorf("%s: unable to register nodes for %q: %w", op, b.Name(), err)
-		}
-	}
-
-	pipeline := eventlogger.Pipeline{
-		PipelineID: eventlogger.PipelineID(b.Name()),
-		EventType:  b.EventType(),
-		NodeIDs:    b.NodeIDs(),
-	}
-
-	err := broker.RegisterPipeline(pipeline)
-	if err != nil {
-		return fmt.Errorf("%s: unable to register pipeline for %q: %w", op, b.Name(), err)
-	}
-	return nil
-}
-
-// existingFallbackName returns the name of the fallback device which is registered
-// with the AuditBroker.
-func (a *AuditBroker) existingFallbackName() (string, error) {
-	const op = "vault.(AuditBroker).existingFallbackName"
-
-	for _, be := range a.backends {
-		if be.backend.IsFallback() {
-			return be.backend.Name(), nil
-		}
-	}
-
-	return "", fmt.Errorf("%s: existing fallback device name is missing", op)
-}
-
-// registerFallback can be used to register a fallback device, it will also
-// configure the success threshold required for sinks.
-func (a *AuditBroker) registerFallback(name string, backend audit.Backend) error {
-	const op = "vault.(AuditBroker).registerFallback"
-
-	err := registerNodesAndPipeline(a.fallbackBroker, backend)
-	if err != nil {
-		return fmt.Errorf("%s: fallback device pipeline registration error: %w", op, err)
-	}
-
-	// Store the name of the fallback audit device so that we can check when
-	// deregistering if the device is the single fallback one.
-	a.fallbackName = backend.Name()
-
-	// We need to turn on the threshold for the fallback broker, so we can
-	// guarantee it ends up somewhere
-	err = a.fallbackBroker.SetSuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()), 1)
-	if err != nil {
-		return fmt.Errorf("%s: unable to configure fallback sink success threshold (1) for %q: %w", op, name, err)
-	}
-
-	return nil
-}
-
-// deregisterFallback can be used to deregister a fallback audit device, it will
-// also configure the success threshold required for sinks.
-func (a *AuditBroker) deregisterFallback(ctx context.Context, name string) error {
-	const op = "vault.(AuditBroker).deregisterFallback"
-
-	err := a.fallbackBroker.SetSuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()), 0)
-	if err != nil {
-		return fmt.Errorf("%s: unable to configure fallback sink success threshold (0) for %q: %w", op, name, err)
-	}
-
-	_, err = a.fallbackBroker.RemovePipelineAndNodes(ctx, eventlogger.EventType(event.AuditType.String()), eventlogger.PipelineID(name))
-	if err != nil {
-		return fmt.Errorf("%s: unable to deregister fallback device %q: %w", op, name, err)
-	}
-
-	// Clear the fallback device name now we've deregistered.
-	a.fallbackName = ""
-
-	return nil
-}
-
-// register can be used to register a normal audit device, it will also calculate
-// and configure the success threshold required for sinks.
-func (a *AuditBroker) register(name string, backend audit.Backend) error {
-	const op = "vault.(AuditBroker).register"
-
-	err := registerNodesAndPipeline(a.broker, backend)
-	if err != nil {
-		return fmt.Errorf("%s: audit pipeline registration error: %w", op, err)
-	}
-
-	// Establish if we ONLY have pipelines that include filter nodes.
-	// Otherwise, we can rely on the eventlogger broker guarantee.
-	// Check the backend we're working with first, then query the backends
-	// that are already registered.
-	threshold := 0
-	if !backend.HasFiltering() {
-		threshold = 1
-	} else {
-		threshold = a.requiredSuccessThresholdSinks()
-	}
-
-	// Update the success threshold now that the pipeline is registered.
-	err = a.broker.SetSuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()), threshold)
-	if err != nil {
-		return fmt.Errorf("%s: unable to configure sink success threshold (%d) for %q: %w", op, threshold, name, err)
-	}
-
-	return nil
-}
-
-// deregister can be used to deregister a normal audit device, it will also
-// calculate and configure the success threshold required for sinks.
-func (a *AuditBroker) deregister(ctx context.Context, name string) error {
-	const op = "vault.(AuditBroker).deregister"
-
-	// Establish if we ONLY have pipelines that include filter nodes.
-	// Otherwise, we can rely on the eventlogger broker guarantee.
-	threshold := a.requiredSuccessThresholdSinks()
-
-	err := a.broker.SetSuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()), threshold)
-	if err != nil {
-		return fmt.Errorf("%s: unable to configure sink success threshold (%d) for %q: %w", op, threshold, name, err)
-	}
-
-	// The first return value, a bool, indicates whether
-	// RemovePipelineAndNodes encountered the error while evaluating
-	// pre-conditions (false) or once it started removing the pipeline and
-	// the nodes (true). This code doesn't care either way.
-	_, err = a.broker.RemovePipelineAndNodes(ctx, eventlogger.EventType(event.AuditType.String()), eventlogger.PipelineID(name))
-	if err != nil {
-		return fmt.Errorf("%s: unable to remove pipeline and nodes for %q: %w", op, name, err)
-	}
-
-	return nil
-}
diff --git a/vault/audit_broker_test.go b/vault/audit_broker_test.go
deleted file mode 100644
index 6493f5454b5..00000000000
--- a/vault/audit_broker_test.go
+++ /dev/null
@@ -1,334 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package vault
-
-import (
-	"context"
-	"crypto/sha256"
-	"testing"
-	"time"
-
-	"github.com/hashicorp/eventlogger"
-	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/builtin/audit/file"
-	"github.com/hashicorp/vault/builtin/audit/syslog"
-	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
-	"github.com/hashicorp/vault/internal/observability/event"
-	"github.com/hashicorp/vault/sdk/helper/salt"
-	"github.com/hashicorp/vault/sdk/logical"
-	"github.com/stretchr/testify/require"
-)
-
-// testAuditBackend will create an audit.Backend (which expects to use the eventlogger).
-func testAuditBackend(t *testing.T, path string, config map[string]string) audit.Backend {
-	t.Helper()
-
-	headersCfg := &AuditedHeadersConfig{
-		Headers: make(map[string]*auditedHeaderSettings),
-		view:    nil,
-	}
-
-	view := &logical.InmemStorage{}
-	se := &logical.StorageEntry{Key: "salt", Value: []byte("juan")}
-	err := view.Put(context.Background(), se)
-	require.NoError(t, err)
-
-	cfg := &audit.BackendConfig{
-		SaltView: view,
-		SaltConfig: &salt.Config{
-			HMAC:     sha256.New,
-			HMACType: "hmac-sha256",
-		},
-		Logger:    corehelpers.NewTestLogger(t),
-		Config:    config,
-		MountPath: path,
-	}
-
-	be, err := syslog.Factory(context.Background(), cfg, headersCfg)
-	require.NoError(t, err)
-	require.NotNil(t, be)
-
-	return be
-}
-
-// TestAuditBroker_Register_SuccessThresholdSinks tests that we are able to
-// correctly identify what the required success threshold sinks value on the
-// eventlogger broker should be set to.
-// We expect:
-// * 0 for only filtered backends
-// * 1 for any other combination
-func TestAuditBroker_Register_SuccessThresholdSinks(t *testing.T) {
-	t.Parallel()
-	l := corehelpers.NewTestLogger(t)
-	a, err := NewAuditBroker(l)
-	require.NoError(t, err)
-	require.NotNil(t, a)
-
-	filterBackend := testAuditBackend(t, "b1-filter", map[string]string{"filter": "operation == create"})
-	noFilterBackend := testAuditBackend(t, "b2-no-filter", map[string]string{})
-
-	// Should be set to 0 for required sinks (and not found, as we've never registered before).
-	res, ok := a.broker.SuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()))
-	require.False(t, ok)
-	require.Equal(t, 0, res)
-
-	// Register the filtered backend first, this shouldn't change the
-	// success threshold sinks to 1 as we can't guarantee any device yet.
-	err = a.Register("b1-filter", filterBackend, false)
-	require.NoError(t, err)
-
-	// Check the SuccessThresholdSinks (we expect 0 still, but found).
-	res, ok = a.broker.SuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()))
-	require.True(t, ok)
-	require.Equal(t, 0, res)
-
-	// Register the non-filtered backend second, this should mean we
-	// can rely on guarantees from the broker again.
-	err = a.Register("b2-no-filter", noFilterBackend, false)
-	require.NoError(t, err)
-
-	// Check the SuccessThresholdSinks (we expect 1 now).
-	res, ok = a.broker.SuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()))
-	require.True(t, ok)
-	require.Equal(t, 1, res)
-}
-
-// TestAuditBroker_Deregister_SuccessThresholdSinks tests that we are able to
-// correctly identify what the required success threshold sinks value on the
-// eventlogger broker should be set to when deregistering audit backends.
-// We expect:
-// * 0 for only filtered backends
-// * 1 for any other combination
-func TestAuditBroker_Deregister_SuccessThresholdSinks(t *testing.T) {
-	t.Parallel()
-	l := corehelpers.NewTestLogger(t)
-	a, err := NewAuditBroker(l)
-	require.NoError(t, err)
-	require.NotNil(t, a)
-
-	filterBackend := testAuditBackend(t, "b1-filter", map[string]string{"filter": "operation == create"})
-	noFilterBackend := testAuditBackend(t, "b2-no-filter", map[string]string{})
-
-	err = a.Register("b1-filter", filterBackend, false)
-	require.NoError(t, err)
-	err = a.Register("b2-no-filter", noFilterBackend, false)
-	require.NoError(t, err)
-
-	// We have a mix of filtered and non-filtered backends, so the
-	// successThresholdSinks should be 1.
-	res, ok := a.broker.SuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()))
-	require.True(t, ok)
-	require.Equal(t, 1, res)
-
-	// Deregister the non-filtered backend, there is one filtered backend left,
-	// so the successThresholdSinks should be 0.
-	err = a.Deregister(context.Background(), "b2-no-filter")
-	require.NoError(t, err)
-	res, ok = a.broker.SuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()))
-	require.True(t, ok)
-	require.Equal(t, 0, res)
-
-	// Deregister the last backend, disabling audit. The value of
-	// successThresholdSinks should still be 0.
-	err = a.Deregister(context.Background(), "b1-filter")
-	require.NoError(t, err)
-	res, ok = a.broker.SuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()))
-	require.True(t, ok)
-	require.Equal(t, 0, res)
-
-	// Re-register a backend that doesn't use filtering.
-	err = a.Register("b2-no-filter", noFilterBackend, false)
-	require.NoError(t, err)
-	res, ok = a.broker.SuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()))
-	require.True(t, ok)
-	require.Equal(t, 1, res)
-}
-
-// TestAuditBroker_Register_Fallback ensures we can register a fallback device.
-func TestAuditBroker_Register_Fallback(t *testing.T) {
-	t.Parallel()
-
-	l := corehelpers.NewTestLogger(t)
-	a, err := NewAuditBroker(l)
-	require.NoError(t, err)
-	require.NotNil(t, a)
-
-	path := "juan/"
-	fallbackBackend := testAuditBackend(t, path, map[string]string{"fallback": "true"})
-	err = a.Register(path, fallbackBackend, false)
-	require.NoError(t, err)
-	require.True(t, a.fallbackBroker.IsAnyPipelineRegistered(eventlogger.EventType(event.AuditType.String())))
-	require.Equal(t, path, a.fallbackName)
-	threshold, found := a.fallbackBroker.SuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()))
-	require.True(t, found)
-	require.Equal(t, 1, threshold)
-}
-
-// TestAuditBroker_Register_FallbackMultiple tests that trying to register more
-// than a single fallback device results in the correct error.
-func TestAuditBroker_Register_FallbackMultiple(t *testing.T) {
-	t.Parallel()
-
-	l := corehelpers.NewTestLogger(t)
-	a, err := NewAuditBroker(l)
-	require.NoError(t, err)
-	require.NotNil(t, a)
-
-	path1 := "juan1/"
-	fallbackBackend1 := testAuditBackend(t, path1, map[string]string{"fallback": "true"})
-	err = a.Register(path1, fallbackBackend1, false)
-	require.NoError(t, err)
-	require.True(t, a.fallbackBroker.IsAnyPipelineRegistered(eventlogger.EventType(event.AuditType.String())))
-	require.Equal(t, path1, a.fallbackName)
-
-	path2 := "juan2/"
-	fallbackBackend2 := testAuditBackend(t, path2, map[string]string{"fallback": "true"})
-	err = a.Register(path1, fallbackBackend2, false)
-	require.Error(t, err)
-	require.EqualError(t, err, "vault.(AuditBroker).Register: backend already registered 'juan1/'")
-	require.True(t, a.fallbackBroker.IsAnyPipelineRegistered(eventlogger.EventType(event.AuditType.String())))
-	require.Equal(t, path1, a.fallbackName)
-}
-
-// TestAuditBroker_Deregister_Fallback ensures that we can deregister a fallback
-// device successfully.
-func TestAuditBroker_Deregister_Fallback(t *testing.T) {
-	t.Parallel()
-
-	l := corehelpers.NewTestLogger(t)
-	a, err := NewAuditBroker(l)
-	require.NoError(t, err)
-	require.NotNil(t, a)
-
-	path := "juan/"
-	fallbackBackend := testAuditBackend(t, path, map[string]string{"fallback": "true"})
-	err = a.Register(path, fallbackBackend, false)
-	require.NoError(t, err)
-	require.True(t, a.fallbackBroker.IsAnyPipelineRegistered(eventlogger.EventType(event.AuditType.String())))
-	require.Equal(t, path, a.fallbackName)
-
-	threshold, found := a.fallbackBroker.SuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()))
-	require.True(t, found)
-	require.Equal(t, 1, threshold)
-
-	err = a.Deregister(context.Background(), path)
-	require.NoError(t, err)
-	require.False(t, a.fallbackBroker.IsAnyPipelineRegistered(eventlogger.EventType(event.AuditType.String())))
-	require.Equal(t, "", a.fallbackName)
-
-	threshold, found = a.fallbackBroker.SuccessThresholdSinks(eventlogger.EventType(event.AuditType.String()))
-	require.True(t, found)
-	require.Equal(t, 0, threshold)
-}
-
-// TestAuditBroker_Deregister_Multiple ensures that we can call deregister multiple
-// times without issue if is no matching backend registered.
-func TestAuditBroker_Deregister_Multiple(t *testing.T) {
-	t.Parallel()
-
-	l := corehelpers.NewTestLogger(t)
-	a, err := NewAuditBroker(l)
-	require.NoError(t, err)
-	require.NotNil(t, a)
-
-	err = a.Deregister(context.Background(), "foo")
-	require.NoError(t, err)
-
-	err = a.Deregister(context.Background(), "foo2")
-	require.NoError(t, err)
-}
-
-// TestAuditBroker_Register_MultipleFails checks for failure when we try to
-// re-register an audit backend.
-func TestAuditBroker_Register_MultipleFails(t *testing.T) {
-	t.Parallel()
-
-	l := corehelpers.NewTestLogger(t)
-	a, err := NewAuditBroker(l)
-	require.NoError(t, err)
-	require.NotNil(t, a)
-
-	path := "b2-no-filter"
-	noFilterBackend := testAuditBackend(t, path, map[string]string{})
-
-	err = a.Register(path, noFilterBackend, false)
-	require.NoError(t, err)
-
-	err = a.Register(path, noFilterBackend, false)
-	require.Error(t, err)
-	require.EqualError(t, err, "vault.(AuditBroker).Register: backend already registered 'b2-no-filter'")
-}
-
-// BenchmarkAuditBroker_File_Request_DevNull Attempts to register a single `file`
-// audit device on the broker, which points at /dev/null.
-// It will then attempt to benchmark how long it takes Vault to complete logging
-// a request, this really only shows us how Vault can handle lots of calls to the
-// broker to trigger the eventlogger pipelines that audit devices are configured as.
-// Since we aren't writing anything to file or doing any I/O.
-// This test used to live in the file package for the file backend, but once the
-// move to eventlogger was complete, there wasn't a way to create a file backend
-// and manually just write to the underlying file itself, the old code used to do
-// formatting and writing all together, but we've split this up with eventlogger
-// with different nodes in a pipeline (think 1 audit device:1 pipeline) each
-// handling a responsibility, for example:
-// filter nodes filter events, so you can select which ones make it to your audit log
-// formatter nodes format the events (to JSON/JSONX and perform HMACing etc)
-// sink nodes handle sending the formatted data to a file, syslog or socket.
-func BenchmarkAuditBroker_File_Request_DevNull(b *testing.B) {
-	backendConfig := &audit.BackendConfig{
-		Config: map[string]string{
-			"path": "/dev/null",
-		},
-		MountPath:  "test",
-		SaltConfig: &salt.Config{},
-		SaltView:   &logical.InmemStorage{},
-		Logger:     hclog.NewNullLogger(),
-	}
-
-	sink, err := file.Factory(context.Background(), backendConfig, nil)
-	require.NoError(b, err)
-
-	broker, err := NewAuditBroker(nil)
-	require.NoError(b, err)
-
-	err = broker.Register("test", sink, false)
-	require.NoError(b, err)
-
-	in := &logical.LogInput{
-		Auth: &logical.Auth{
-			ClientToken:     "foo",
-			Accessor:        "bar",
-			EntityID:        "foobarentity",
-			DisplayName:     "testtoken",
-			NoDefaultPolicy: true,
-			Policies:        []string{"root"},
-			TokenType:       logical.TokenTypeService,
-		},
-		Request: &logical.Request{
-			Operation: logical.UpdateOperation,
-			Path:      "/foo",
-			Connection: &logical.Connection{
-				RemoteAddr: "127.0.0.1",
-			},
-			WrapInfo: &logical.RequestWrapInfo{
-				TTL: 60 * time.Second,
-			},
-			Headers: map[string][]string{
-				"foo": {"bar"},
-			},
-		},
-	}
-
-	ctx := namespace.RootContext(context.Background())
-	b.ResetTimer()
-	b.RunParallel(func(pb *testing.PB) {
-		for pb.Next() {
-			if err := broker.LogRequest(ctx, in); err != nil {
-				panic(err)
-			}
-		}
-	})
-}
diff --git a/vault/audit_test.go b/vault/audit_test.go
index e58764cb247..76b34b2db82 100644
--- a/vault/audit_test.go
+++ b/vault/audit_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -12,12 +12,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/hashicorp/errwrap"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/audit"
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -27,16 +26,16 @@ import (
 
 func TestAudit_ReadOnlyViewDuringMount(t *testing.T) {
 	c, _, _ := TestCoreUnsealed(t)
-	c.auditBackends["noop"] = func(ctx context.Context, config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
-		err := config.SaltView.Put(ctx, &logical.StorageEntry{
+	c.auditBackends["noop"] = func(config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
+		err := config.SaltView.Put(context.Background(), &logical.StorageEntry{
 			Key:   "bar",
 			Value: []byte("baz"),
 		})
 		if err == nil || !strings.Contains(err.Error(), logical.ErrSetupReadOnly.Error()) {
 			t.Fatalf("expected a read-only error")
 		}
-		factory := corehelpers.NoopAuditFactory(nil)
-		return factory(ctx, config, nil)
+		factory := audit.NoopAuditFactory(nil)
+		return factory(config, nil)
 	}
 
 	me := &MountEntry{
@@ -52,12 +51,14 @@ func TestAudit_ReadOnlyViewDuringMount(t *testing.T) {
 
 func TestCore_EnableAudit(t *testing.T) {
 	c, keys, _ := TestCoreUnsealed(t)
-	c.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
 
 	me := &MountEntry{
 		Table: auditTableType,
 		Path:  "foo",
-		Type:  "noop",
+		Type:  audit.TypeFile,
+		Options: map[string]string{
+			"file_path": "discard",
+		},
 	}
 	err := c.enableAudit(namespace.RootContext(context.Background()), me, true)
 	if err != nil {
@@ -69,11 +70,15 @@ func TestCore_EnableAudit(t *testing.T) {
 	}
 
 	conf := &CoreConfig{
-		Physical:      c.physical,
-		AuditBackends: make(map[string]audit.Factory),
-		DisableMlock:  true,
+		AuditBackends: map[string]audit.Factory{
+			audit.TypeFile:   audit.NewFileBackend,
+			audit.TypeSocket: audit.NewSocketBackend,
+			audit.TypeSyslog: audit.NewSyslogBackend,
+		},
+		DisableMlock: true,
+		Physical:     c.physical,
 	}
-	conf.AuditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
+
 	c2, err := NewCore(conf)
 	if err != nil {
 		t.Fatalf("err: %v", err)
@@ -100,10 +105,54 @@ func TestCore_EnableAudit(t *testing.T) {
 	}
 }
 
+// TestCore_EnableExistingAudit ensures that we don't allow enabling a file audit device
+// with the same `file_path` as one of the existing ones.
+func TestCore_EnableExistingAudit(t *testing.T) {
+	c, _, _ := TestCoreUnsealed(t)
+
+	// First audit backend entry
+	me := &MountEntry{
+		Table: auditTableType,
+		Path:  "foo",
+		Type:  audit.TypeFile,
+		Options: map[string]string{
+			"file_path": "stdout",
+		},
+	}
+
+	// Second audit backend entry
+	me2 := &MountEntry{
+		Table: auditTableType,
+		Path:  "foo2",
+		Type:  audit.TypeFile,
+		Options: map[string]string{
+			"file_path": "stdout",
+		},
+	}
+
+	// Enable first audit backend
+	err := c.enableAudit(namespace.RootContext(context.Background()), me, true)
+	if err != nil {
+		t.Errorf("failed to enable audit for path 'foo': %v", err)
+	}
+
+	// Check if the first audit backend is registered
+	if !c.auditBroker.IsRegistered("foo/") {
+		t.Errorf("audit backend for path 'foo/' is not registered")
+	}
+
+	// Enable second audit backend
+	err = c.enableAudit(namespace.RootContext(context.Background()), me2, true)
+	if err == nil {
+		t.Errorf("Should not be able to enable audit for path 'foo2' due to duplication: %v", err)
+	}
+}
+
 func TestCore_EnableAudit_MixedFailures(t *testing.T) {
 	c, _, _ := TestCoreUnsealed(t)
-	c.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
-	c.auditBackends["fail"] = func(ctx context.Context, config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
+
+	// Additional audit backend type that will fail.
+	c.auditBackends["fail"] = func(config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
 		return nil, fmt.Errorf("failing enabling")
 	}
 
@@ -113,14 +162,20 @@ func TestCore_EnableAudit_MixedFailures(t *testing.T) {
 			{
 				Table: auditTableType,
 				Path:  "noop/",
-				Type:  "noop",
+				Type:  audit.TypeFile,
 				UUID:  "abcd",
+				Options: map[string]string{
+					"file_path": "discard",
+				},
 			},
 			{
 				Table: auditTableType,
 				Path:  "noop2/",
-				Type:  "noop",
+				Type:  audit.TypeFile,
 				UUID:  "bcde",
+				Options: map[string]string{
+					"file_path": "discard",
+				},
 			},
 		},
 	}
@@ -151,8 +206,9 @@ func TestCore_EnableAudit_MixedFailures(t *testing.T) {
 // correctly
 func TestCore_EnableAudit_Local(t *testing.T) {
 	c, _, _ := TestCoreUnsealed(t)
-	c.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
-	c.auditBackends["fail"] = func(ctx context.Context, config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
+
+	// Additional audit backend that will always fail.
+	c.auditBackends["fail"] = func(config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
 		return nil, fmt.Errorf("failing enabling")
 	}
 
@@ -162,20 +218,26 @@ func TestCore_EnableAudit_Local(t *testing.T) {
 			{
 				Table:       auditTableType,
 				Path:        "noop/",
-				Type:        "noop",
+				Type:        audit.TypeFile,
 				UUID:        "abcd",
 				Accessor:    "noop-abcd",
 				NamespaceID: namespace.RootNamespaceID,
 				namespace:   namespace.RootNamespace,
+				Options: map[string]string{
+					"file_path": "discard",
+				},
 			},
 			{
 				Table:       auditTableType,
 				Path:        "noop2/",
-				Type:        "noop",
+				Type:        audit.TypeFile,
 				UUID:        "bcde",
 				Accessor:    "noop-bcde",
 				NamespaceID: namespace.RootNamespaceID,
 				namespace:   namespace.RootNamespace,
+				Options: map[string]string{
+					"file_path": "discard",
+				},
 			},
 		},
 	}
@@ -235,72 +297,8 @@ func TestCore_EnableAudit_Local(t *testing.T) {
 	}
 }
 
-// TestAudit_enableAudit_fallback_invalid ensures that supplying a bad value for
-// 'fallback' in options gives us the correct error.
-func TestAudit_enableAudit_fallback_invalid(t *testing.T) {
-	entry := &MountEntry{
-		Path: "noop/",
-		Options: map[string]string{
-			"fallback": "juan",
-		},
-	}
-
-	cluster := NewTestCluster(t, nil, nil)
-	cluster.Start()
-	defer cluster.Cleanup()
-	core := cluster.Cores[0]
-	core.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
-	err := core.enableAudit(context.Background(), entry, false)
-	require.Error(t, err)
-	require.EqualError(t, err, "unable to enable audit device 'noop/', cannot parse supplied 'fallback' setting: cannot parse '' as bool: strconv.ParseBool: parsing \"juan\": invalid syntax")
-}
-
-// TestAudit_enableAudit_fallback_two ensures trying to enable a second fallback
-// device returns the correct error.
-func TestAudit_enableAudit_fallback_two(t *testing.T) {
-	entry1 := &MountEntry{
-		Table:       auditTableType,
-		Path:        "noop1/",
-		Type:        "noop",
-		UUID:        "abcd",
-		Accessor:    "noop1-abcd",
-		NamespaceID: namespace.RootNamespaceID,
-		Options: map[string]string{
-			"fallback": "TRUE",
-		},
-		namespace: namespace.RootNamespace,
-	}
-
-	entry2 := &MountEntry{
-		Table:       auditTableType,
-		Path:        "noop2/",
-		Type:        "noop",
-		UUID:        "abcd",
-		Accessor:    "noop2-abcd",
-		NamespaceID: namespace.RootNamespaceID,
-		Options: map[string]string{
-			"fallback": "1",
-		},
-		namespace: namespace.RootNamespace,
-	}
-
-	cluster := NewTestCluster(t, nil, nil)
-	cluster.Start()
-	defer cluster.Cleanup()
-	core := cluster.Cores[0]
-	core.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
-	ctx := namespace.ContextWithNamespace(context.Background(), namespace.RootNamespace)
-	err := core.enableAudit(ctx, entry1, false)
-	require.NoError(t, err)
-
-	err = core.enableAudit(ctx, entry2, false)
-	require.Error(t, err)
-	require.EqualError(t, err, "unable to enable audit device 'noop2/', a fallback device already exists 'noop1/'")
-}
-
 func TestCore_DisableAudit(t *testing.T) {
 	c, keys, _ := TestCoreUnsealed(t)
-	c.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
 
 	existed, err := c.disableAudit(namespace.RootContext(context.Background()), "foo", true)
 	if existed && err != nil {
@@ -310,7 +308,10 @@ func TestCore_DisableAudit(t *testing.T) {
 	me := &MountEntry{
 		Table: auditTableType,
 		Path:  "foo",
-		Type:  "noop",
+		Type:  audit.TypeFile,
+		Options: map[string]string{
+			"file_path": "discard",
+		},
 	}
 	err = c.enableAudit(namespace.RootContext(context.Background()), me, true)
 	if err != nil {
@@ -403,15 +404,16 @@ func verifyDefaultAuditTable(t *testing.T, table *MountTable) {
 
 func TestAuditBroker_LogRequest(t *testing.T) {
 	l := logging.NewVaultLogger(log.Trace)
-	b, err := NewAuditBroker(l)
+	b, err := audit.NewBroker(l)
 	if err != nil {
 		t.Fatal(err)
 	}
-	a1 := corehelpers.TestNoopAudit(t, "foo", nil)
-	a2 := corehelpers.TestNoopAudit(t, "bar", nil)
-	err = b.Register("foo", a1, false)
+
+	a1 := audit.TestNoopAudit(t, "foo", nil)
+	a2 := audit.TestNoopAudit(t, "bar", nil)
+	err = b.Register(a1, false)
 	require.NoError(t, err)
-	err = b.Register("bar", a2, false)
+	err = b.Register(a2, false)
 	require.NoError(t, err)
 
 	auth := &logical.Auth{
@@ -460,7 +462,7 @@ func TestAuditBroker_LogRequest(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	for _, a := range []*corehelpers.NoopAudit{a1, a2} {
+	for _, a := range []*audit.NoopAudit{a1, a2} {
 		if !reflect.DeepEqual(a.ReqAuth[0], auth) {
 			t.Fatalf("Bad: %#v", a.ReqAuth[0])
 		}
@@ -482,24 +484,25 @@ func TestAuditBroker_LogRequest(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	// Should FAIL work with both failing backends
+	// Should FAIL when both backends fail
 	a2.ReqErr = fmt.Errorf("failed")
-	if err := b.LogRequest(ctx, logInput); !errwrap.Contains(err, "event not processed by enough 'sink' nodes") {
+	if err = b.LogRequest(ctx, logInput); err != nil && !strings.HasPrefix(err.Error(), "event not processed by enough 'sink' nodes") {
 		t.Fatalf("err: %v", err)
 	}
 }
 
 func TestAuditBroker_LogResponse(t *testing.T) {
 	l := logging.NewVaultLogger(log.Trace)
-	b, err := NewAuditBroker(l)
+	b, err := audit.NewBroker(l)
 	if err != nil {
 		t.Fatal(err)
 	}
-	a1 := corehelpers.TestNoopAudit(t, "foo", nil)
-	a2 := corehelpers.TestNoopAudit(t, "bar", nil)
-	err = b.Register("foo", a1, false)
+
+	a1 := audit.TestNoopAudit(t, "foo", nil)
+	a2 := audit.TestNoopAudit(t, "bar", nil)
+	err = b.Register(a1, false)
 	require.NoError(t, err)
-	err = b.Register("bar", a2, false)
+	err = b.Register(a2, false)
 	require.NoError(t, err)
 
 	auth := &logical.Auth{
@@ -559,7 +562,7 @@ func TestAuditBroker_LogResponse(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	for _, a := range []*corehelpers.NoopAudit{a1, a2} {
+	for _, a := range []*audit.NoopAudit{a1, a2} {
 		if !reflect.DeepEqual(a.RespAuth[0], auth) {
 			t.Fatalf("Bad: %#v", a.ReqAuth[0])
 		}
@@ -595,27 +598,17 @@ func TestAuditBroker_LogResponse(t *testing.T) {
 func TestAuditBroker_AuditHeaders(t *testing.T) {
 	logger := logging.NewVaultLogger(log.Trace)
 
-	b, err := NewAuditBroker(logger)
+	b, err := audit.NewBroker(logger)
 	if err != nil {
 		t.Fatal(err)
 	}
-	_, barrier, _ := mockBarrier(t)
-	view := NewBarrierView(barrier, "headers/")
-
-	headersConf := &AuditedHeadersConfig{
-		view: view,
-	}
-	err = headersConf.add(context.Background(), "X-Test-Header", false)
-	require.NoError(t, err)
-	err = headersConf.add(context.Background(), "X-Vault-Header", false)
-	require.NoError(t, err)
 
-	a1 := corehelpers.TestNoopAudit(t, "foo", nil, audit.WithHeaderFormatter(headersConf))
-	a2 := corehelpers.TestNoopAudit(t, "bar", nil, audit.WithHeaderFormatter(headersConf))
+	a1 := audit.TestNoopAudit(t, "foo", nil)
+	a2 := audit.TestNoopAudit(t, "bar", nil)
 
-	err = b.Register("foo", a1, false)
+	err = b.Register(a1, false)
 	require.NoError(t, err)
-	err = b.Register("bar", a2, false)
+	err = b.Register(a2, false)
 	require.NoError(t, err)
 
 	auth := &logical.Auth{
@@ -632,7 +625,6 @@ func TestAuditBroker_AuditHeaders(t *testing.T) {
 		Headers: map[string][]string{
 			"X-Test-Header":  {"foo"},
 			"X-Vault-Header": {"bar"},
-			"Content-Type":   {"baz"},
 		},
 	}
 	respErr := fmt.Errorf("permission denied")
@@ -660,7 +652,7 @@ func TestAuditBroker_AuditHeaders(t *testing.T) {
 		"x-vault-header": {"bar"},
 	}
 
-	for _, a := range []*corehelpers.NoopAudit{a1, a2} {
+	for _, a := range []*audit.NoopAudit{a1, a2} {
 		if !reflect.DeepEqual(a.ReqHeaders[0], expected) {
 			t.Fatalf("Bad audited headers: %#v", a.ReqHeaders[0])
 		}
@@ -680,8 +672,60 @@ func TestAuditBroker_AuditHeaders(t *testing.T) {
 
 	// Should FAIL work with both failing backends
 	a2.ReqErr = fmt.Errorf("failed")
-	err = b.LogRequest(ctx, logInput)
-	if !errwrap.Contains(err, "event not processed by enough 'sink' nodes") {
+	if err = b.LogRequest(ctx, logInput); err != nil && !strings.HasPrefix(err.Error(), "event not processed by enough 'sink' nodes") {
 		t.Fatalf("err: %v", err)
 	}
 }
+
+// TestAudit_enableAudit ensures that we do not enable an audit device with Enterprise
+// only options on a non-Enterprise version of Vault.
+func TestAudit_enableAudit(t *testing.T) {
+	cluster := NewTestCluster(t, nil, &TestClusterOptions{NumCores: 1})
+	defer cluster.Cleanup()
+
+	c := cluster.Cores[0]
+
+	me := &MountEntry{
+		Table: auditTableType,
+		Path:  "foo",
+		Type:  audit.TypeFile,
+		Options: map[string]string{
+			"file_path": "discard",
+			"fallback":  "true",
+		},
+	}
+	err := c.enableAudit(namespace.RootContext(context.Background()), me, true)
+
+	if constants.IsEnterprise {
+		require.NoError(t, err)
+	} else {
+		require.Error(t, err)
+	}
+}
+
+// TestAudit_newAuditBackend ensures that we do not create a new audit device
+// with Enterprise only options on a non-Enterprise version of Vault.
+func TestAudit_newAuditBackend(t *testing.T) {
+	cluster := NewTestCluster(t, nil, &TestClusterOptions{NumCores: 1})
+	defer cluster.Cleanup()
+
+	c := cluster.Cores[0]
+
+	me := &MountEntry{
+		Table: auditTableType,
+		Path:  "foo",
+		Type:  audit.TypeFile,
+		Options: map[string]string{
+			"file_path": "discard",
+			"fallback":  "true",
+		},
+	}
+
+	_, err := c.newAuditBackend(me, &logical.InmemStorage{}, me.Options)
+
+	if constants.IsEnterprise {
+		require.NoError(t, err)
+	} else {
+		require.Error(t, err)
+	}
+}
diff --git a/vault/audited_headers.go b/vault/audited_headers.go
deleted file mode 100644
index a6ca376264f..00000000000
--- a/vault/audited_headers.go
+++ /dev/null
@@ -1,165 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package vault
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"sync"
-
-	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/sdk/logical"
-)
-
-// N.B.: While we could use textproto to get the canonical mime header, HTTP/2
-// requires all headers to be converted to lower case, so we just do that.
-
-const (
-	// Key used in the BarrierView to store and retrieve the header config
-	auditedHeadersEntry = "audited-headers"
-	// Path used to create a sub view off of BarrierView
-	auditedHeadersSubPath = "audited-headers-config/"
-)
-
-type auditedHeaderSettings struct {
-	HMAC bool `json:"hmac"`
-}
-
-// AuditedHeadersConfig is used by the Audit Broker to write only approved
-// headers to the audit logs. It uses a BarrierView to persist the settings.
-type AuditedHeadersConfig struct {
-	Headers map[string]*auditedHeaderSettings
-
-	view *BarrierView
-	sync.RWMutex
-}
-
-// add adds or overwrites a header in the config and updates the barrier view
-func (a *AuditedHeadersConfig) add(ctx context.Context, header string, hmac bool) error {
-	if header == "" {
-		return fmt.Errorf("header value cannot be empty")
-	}
-
-	// Grab a write lock
-	a.Lock()
-	defer a.Unlock()
-
-	if a.Headers == nil {
-		a.Headers = make(map[string]*auditedHeaderSettings, 1)
-	}
-
-	a.Headers[strings.ToLower(header)] = &auditedHeaderSettings{hmac}
-	entry, err := logical.StorageEntryJSON(auditedHeadersEntry, a.Headers)
-	if err != nil {
-		return fmt.Errorf("failed to persist audited headers config: %w", err)
-	}
-
-	if err := a.view.Put(ctx, entry); err != nil {
-		return fmt.Errorf("failed to persist audited headers config: %w", err)
-	}
-
-	return nil
-}
-
-// remove deletes a header out of the header config and updates the barrier view
-func (a *AuditedHeadersConfig) remove(ctx context.Context, header string) error {
-	if header == "" {
-		return fmt.Errorf("header value cannot be empty")
-	}
-
-	// Grab a write lock
-	a.Lock()
-	defer a.Unlock()
-
-	// Nothing to delete
-	if len(a.Headers) == 0 {
-		return nil
-	}
-
-	delete(a.Headers, strings.ToLower(header))
-	entry, err := logical.StorageEntryJSON(auditedHeadersEntry, a.Headers)
-	if err != nil {
-		return fmt.Errorf("failed to persist audited headers config: %w", err)
-	}
-
-	if err := a.view.Put(ctx, entry); err != nil {
-		return fmt.Errorf("failed to persist audited headers config: %w", err)
-	}
-
-	return nil
-}
-
-// ApplyConfig returns a map of approved headers and their values, either
-// hmac'ed or plaintext
-func (a *AuditedHeadersConfig) ApplyConfig(ctx context.Context, headers map[string][]string, salter audit.Salter) (result map[string][]string, retErr error) {
-	// Grab a read lock
-	a.RLock()
-	defer a.RUnlock()
-
-	// Make a copy of the incoming headers with everything lower so we can
-	// case-insensitively compare
-	lowerHeaders := make(map[string][]string, len(headers))
-	for k, v := range headers {
-		lowerHeaders[strings.ToLower(k)] = v
-	}
-
-	result = make(map[string][]string, len(a.Headers))
-	for key, settings := range a.Headers {
-		if val, ok := lowerHeaders[key]; ok {
-			// copy the header values so we don't overwrite them
-			hVals := make([]string, len(val))
-			copy(hVals, val)
-
-			// Optionally hmac the values
-			if settings.HMAC {
-				for i, el := range hVals {
-					hVal, err := audit.HashString(ctx, salter, el)
-					if err != nil {
-						return nil, err
-					}
-					hVals[i] = hVal
-				}
-			}
-
-			result[key] = hVals
-		}
-	}
-
-	return result, nil
-}
-
-// Initialize the headers config by loading from the barrier view
-func (c *Core) setupAuditedHeadersConfig(ctx context.Context) error {
-	// Create a sub-view
-	view := c.systemBarrierView.SubView(auditedHeadersSubPath)
-
-	// Create the config
-	out, err := view.Get(ctx, auditedHeadersEntry)
-	if err != nil {
-		return fmt.Errorf("failed to read config: %w", err)
-	}
-
-	headers := make(map[string]*auditedHeaderSettings)
-	if out != nil {
-		err = out.DecodeJSON(&headers)
-		if err != nil {
-			return err
-		}
-	}
-
-	// Ensure that we are able to case-sensitively access the headers;
-	// necessary for the upgrade case
-	lowerHeaders := make(map[string]*auditedHeaderSettings, len(headers))
-	for k, v := range headers {
-		lowerHeaders[strings.ToLower(k)] = v
-	}
-
-	c.auditedHeaders = &AuditedHeadersConfig{
-		Headers: lowerHeaders,
-		view:    view,
-	}
-
-	return nil
-}
diff --git a/vault/audited_headers_test.go b/vault/audited_headers_test.go
deleted file mode 100644
index 98375f9c2e1..00000000000
--- a/vault/audited_headers_test.go
+++ /dev/null
@@ -1,349 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package vault
-
-import (
-	"context"
-	"errors"
-	"reflect"
-	"strings"
-	"testing"
-
-	"github.com/hashicorp/vault/sdk/helper/salt"
-)
-
-func mockAuditedHeadersConfig(t *testing.T) *AuditedHeadersConfig {
-	_, barrier, _ := mockBarrier(t)
-	view := NewBarrierView(barrier, "foo/")
-	return &AuditedHeadersConfig{
-		Headers: make(map[string]*auditedHeaderSettings),
-		view:    view,
-	}
-}
-
-func TestAuditedHeadersConfig_CRUD(t *testing.T) {
-	conf := mockAuditedHeadersConfig(t)
-
-	testAuditedHeadersConfig_Add(t, conf)
-	testAuditedHeadersConfig_Remove(t, conf)
-}
-
-func testAuditedHeadersConfig_Add(t *testing.T, conf *AuditedHeadersConfig) {
-	err := conf.add(context.Background(), "X-Test-Header", false)
-	if err != nil {
-		t.Fatalf("Error when adding header to config: %s", err)
-	}
-
-	settings, ok := conf.Headers["x-test-header"]
-	if !ok {
-		t.Fatal("Expected header to be found in config")
-	}
-
-	if settings.HMAC {
-		t.Fatal("Expected HMAC to be set to false, got true")
-	}
-
-	out, err := conf.view.Get(context.Background(), auditedHeadersEntry)
-	if err != nil {
-		t.Fatalf("Could not retrieve headers entry from config: %s", err)
-	}
-	if out == nil {
-		t.Fatal("nil value")
-	}
-
-	headers := make(map[string]*auditedHeaderSettings)
-	err = out.DecodeJSON(&headers)
-	if err != nil {
-		t.Fatalf("Error decoding header view: %s", err)
-	}
-
-	expected := map[string]*auditedHeaderSettings{
-		"x-test-header": {
-			HMAC: false,
-		},
-	}
-
-	if !reflect.DeepEqual(headers, expected) {
-		t.Fatalf("Expected config didn't match actual. Expected: %#v, Got: %#v", expected, headers)
-	}
-
-	err = conf.add(context.Background(), "X-Vault-Header", true)
-	if err != nil {
-		t.Fatalf("Error when adding header to config: %s", err)
-	}
-
-	settings, ok = conf.Headers["x-vault-header"]
-	if !ok {
-		t.Fatal("Expected header to be found in config")
-	}
-
-	if !settings.HMAC {
-		t.Fatal("Expected HMAC to be set to true, got false")
-	}
-
-	out, err = conf.view.Get(context.Background(), auditedHeadersEntry)
-	if err != nil {
-		t.Fatalf("Could not retrieve headers entry from config: %s", err)
-	}
-	if out == nil {
-		t.Fatal("nil value")
-	}
-
-	headers = make(map[string]*auditedHeaderSettings)
-	err = out.DecodeJSON(&headers)
-	if err != nil {
-		t.Fatalf("Error decoding header view: %s", err)
-	}
-
-	expected["x-vault-header"] = &auditedHeaderSettings{
-		HMAC: true,
-	}
-
-	if !reflect.DeepEqual(headers, expected) {
-		t.Fatalf("Expected config didn't match actual. Expected: %#v, Got: %#v", expected, headers)
-	}
-}
-
-func testAuditedHeadersConfig_Remove(t *testing.T, conf *AuditedHeadersConfig) {
-	err := conf.remove(context.Background(), "X-Test-Header")
-	if err != nil {
-		t.Fatalf("Error when adding header to config: %s", err)
-	}
-
-	_, ok := conf.Headers["x-Test-HeAder"]
-	if ok {
-		t.Fatal("Expected header to not be found in config")
-	}
-
-	out, err := conf.view.Get(context.Background(), auditedHeadersEntry)
-	if err != nil {
-		t.Fatalf("Could not retrieve headers entry from config: %s", err)
-	}
-	if out == nil {
-		t.Fatal("nil value")
-	}
-
-	headers := make(map[string]*auditedHeaderSettings)
-	err = out.DecodeJSON(&headers)
-	if err != nil {
-		t.Fatalf("Error decoding header view: %s", err)
-	}
-
-	expected := map[string]*auditedHeaderSettings{
-		"x-vault-header": {
-			HMAC: true,
-		},
-	}
-
-	if !reflect.DeepEqual(headers, expected) {
-		t.Fatalf("Expected config didn't match actual. Expected: %#v, Got: %#v", expected, headers)
-	}
-
-	err = conf.remove(context.Background(), "x-VaulT-Header")
-	if err != nil {
-		t.Fatalf("Error when adding header to config: %s", err)
-	}
-
-	_, ok = conf.Headers["x-vault-header"]
-	if ok {
-		t.Fatal("Expected header to not be found in config")
-	}
-
-	out, err = conf.view.Get(context.Background(), auditedHeadersEntry)
-	if err != nil {
-		t.Fatalf("Could not retrieve headers entry from config: %s", err)
-	}
-	if out == nil {
-		t.Fatal("nil value")
-	}
-
-	headers = make(map[string]*auditedHeaderSettings)
-	err = out.DecodeJSON(&headers)
-	if err != nil {
-		t.Fatalf("Error decoding header view: %s", err)
-	}
-
-	expected = make(map[string]*auditedHeaderSettings)
-
-	if !reflect.DeepEqual(headers, expected) {
-		t.Fatalf("Expected config didn't match actual. Expected: %#v, Got: %#v", expected, headers)
-	}
-}
-
-type TestSalter struct{}
-
-func (*TestSalter) Salt(ctx context.Context) (*salt.Salt, error) {
-	return salt.NewSalt(ctx, nil, nil)
-}
-
-func TestAuditedHeadersConfig_ApplyConfig(t *testing.T) {
-	conf := mockAuditedHeadersConfig(t)
-
-	conf.add(context.Background(), "X-TesT-Header", false)
-	conf.add(context.Background(), "X-Vault-HeAdEr", true)
-
-	reqHeaders := map[string][]string{
-		"X-Test-Header":  {"foo"},
-		"X-Vault-Header": {"bar", "bar"},
-		"Content-Type":   {"json"},
-	}
-
-	salter := &TestSalter{}
-
-	result, err := conf.ApplyConfig(context.Background(), reqHeaders, salter)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	expected := map[string][]string{
-		"x-test-header":  {"foo"},
-		"x-vault-header": {"hmac-sha256:", "hmac-sha256:"},
-	}
-
-	if len(expected) != len(result) {
-		t.Fatalf("Expected headers count did not match actual count: Expected count %d\n Got %d\n", len(expected), len(result))
-	}
-
-	for resultKey, resultValues := range result {
-		expectedValues := expected[resultKey]
-
-		if len(expectedValues) != len(resultValues) {
-			t.Fatalf("Expected header values count did not match actual values count: Expected count: %d\n Got %d\n", len(expectedValues), len(resultValues))
-		}
-
-		for i, e := range expectedValues {
-			if e == "hmac-sha256:" {
-				if !strings.HasPrefix(resultValues[i], e) {
-					t.Fatalf("Expected headers did not match actual: Expected %#v...\n Got %#v\n", e, resultValues[i])
-				}
-			} else {
-				if e != resultValues[i] {
-					t.Fatalf("Expected headers did not match actual: Expected %#v\n Got %#v\n", e, resultValues[i])
-				}
-			}
-		}
-	}
-
-	// Make sure we didn't edit the reqHeaders map
-	reqHeadersCopy := map[string][]string{
-		"X-Test-Header":  {"foo"},
-		"X-Vault-Header": {"bar", "bar"},
-		"Content-Type":   {"json"},
-	}
-
-	if !reflect.DeepEqual(reqHeaders, reqHeadersCopy) {
-		t.Fatalf("Req headers were changed, expected %#v\n got %#v", reqHeadersCopy, reqHeaders)
-	}
-}
-
-// TestAuditedHeadersConfig_ApplyConfig_NoHeaders tests the case where there are
-// no headers in the request.
-func TestAuditedHeadersConfig_ApplyConfig_NoRequestHeaders(t *testing.T) {
-	conf := mockAuditedHeadersConfig(t)
-
-	conf.add(context.Background(), "X-TesT-Header", false)
-	conf.add(context.Background(), "X-Vault-HeAdEr", true)
-
-	reqHeaders := map[string][]string{}
-
-	salter := &TestSalter{}
-
-	result, err := conf.ApplyConfig(context.Background(), reqHeaders, salter)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if len(result) != 0 {
-		t.Fatalf("Expected no headers but actually got: %d\n", len(result))
-	}
-}
-
-func TestAuditedHeadersConfig_ApplyConfig_NoConfiguredHeaders(t *testing.T) {
-	conf := mockAuditedHeadersConfig(t)
-
-	reqHeaders := map[string][]string{
-		"X-Test-Header":  {"foo"},
-		"X-Vault-Header": {"bar", "bar"},
-		"Content-Type":   {"json"},
-	}
-
-	salter := &TestSalter{}
-
-	result, err := conf.ApplyConfig(context.Background(), reqHeaders, salter)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if len(result) != 0 {
-		t.Fatalf("Expected no headers but actually got: %d\n", len(result))
-	}
-
-	// Make sure we didn't edit the reqHeaders map
-	reqHeadersCopy := map[string][]string{
-		"X-Test-Header":  {"foo"},
-		"X-Vault-Header": {"bar", "bar"},
-		"Content-Type":   {"json"},
-	}
-
-	if !reflect.DeepEqual(reqHeaders, reqHeadersCopy) {
-		t.Fatalf("Req headers were changed, expected %#v\n got %#v", reqHeadersCopy, reqHeaders)
-	}
-}
-
-// FailingSalter is an implementation of the Salter interface where the Salt
-// method always returns an error.
-type FailingSalter struct{}
-
-// Salt always returns an error.
-func (s *FailingSalter) Salt(context.Context) (*salt.Salt, error) {
-	return nil, errors.New("testing error")
-}
-
-// TestAuditedHeadersConfig_ApplyConfig_HashStringError tests the case where
-// an error is returned from HashString instead of a map of headers.
-func TestAuditedHeadersConfig_ApplyConfig_HashStringError(t *testing.T) {
-	conf := mockAuditedHeadersConfig(t)
-
-	conf.add(context.Background(), "X-TesT-Header", false)
-	conf.add(context.Background(), "X-Vault-HeAdEr", true)
-
-	reqHeaders := map[string][]string{
-		"X-Test-Header":  {"foo"},
-		"X-Vault-Header": {"bar", "bar"},
-		"Content-Type":   {"json"},
-	}
-
-	salter := &FailingSalter{}
-
-	_, err := conf.ApplyConfig(context.Background(), reqHeaders, salter)
-	if err == nil {
-		t.Fatal("expected error from ApplyConfig")
-	}
-}
-
-func BenchmarkAuditedHeaderConfig_ApplyConfig(b *testing.B) {
-	conf := &AuditedHeadersConfig{
-		Headers: make(map[string]*auditedHeaderSettings),
-		view:    nil,
-	}
-
-	conf.Headers = map[string]*auditedHeaderSettings{
-		"X-Test-Header":  {false},
-		"X-Vault-Header": {true},
-	}
-
-	reqHeaders := map[string][]string{
-		"X-Test-Header":  {"foo"},
-		"X-Vault-Header": {"bar", "bar"},
-		"Content-Type":   {"json"},
-	}
-
-	salter := &TestSalter{}
-
-	// Reset the timer since we did a lot above
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		conf.ApplyConfig(context.Background(), reqHeaders, salter)
-	}
-}
diff --git a/vault/auth.go b/vault/auth.go
index ab74c563013..b33c54b7937 100644
--- a/vault/auth.go
+++ b/vault/auth.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -19,6 +19,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/vault/observations"
 	"github.com/hashicorp/vault/vault/plugincatalog"
 )
 
@@ -44,6 +45,11 @@ const (
 	credentialTableType = "auth"
 )
 
+func init() {
+	// Register the keys we use for auth "mount" tables
+	registerMountOrNamespaceTablePaths(coreAuthConfigPath, coreLocalAuthConfigPath)
+}
+
 var (
 	// errLoadAuthFailed if loadCredentials encounters an error
 	errLoadAuthFailed = errors.New("failed to setup auth table")
@@ -206,7 +212,7 @@ func (c *Core) enableCredentialInternal(ctx context.Context, entry *MountEntry,
 			if err == logical.ErrReadOnly && c.perfStandby {
 				return err
 			}
-			return errors.New("failed to update auth table")
+			return fmt.Errorf("failed to update auth table: %w", err)
 		}
 	}
 
@@ -243,6 +249,19 @@ func (c *Core) enableCredentialInternal(ctx context.Context, entry *MountEntry,
 	if c.logger.IsInfo() {
 		c.logger.Info("enabled credential backend", "path", entry.Path, "type", entry.Type, "version", entry.RunningVersion)
 	}
+
+	err = c.observations.RecordObservationToLedger(ctx, observations.ObservationTypeMountAuthEnable, ns, map[string]interface{}{
+		"path":                   entry.Path,
+		"local_mount":            entry.Local,
+		"type":                   entry.Type,
+		"accessor":               entry.Accessor,
+		"plugin_version":         entry.Version,
+		"running_plugin_version": entry.RunningVersion,
+	})
+	if err != nil {
+		c.logger.Error("failed to record observation after enabling credential backend", "path", entry.Path, "error", err)
+	}
+
 	return nil
 }
 
@@ -375,6 +394,18 @@ func (c *Core) disableCredentialInternal(ctx context.Context, path string, updat
 		c.logger.Info("disabled credential backend", "path", path)
 	}
 
+	err = c.observations.RecordObservationToLedger(ctx, observations.ObservationTypeMountAuthDisable, ns, map[string]interface{}{
+		"path":                   path,
+		"local_mount":            entry.Local,
+		"type":                   entry.Type,
+		"accessor":               entry.Accessor,
+		"plugin_version":         entry.Version,
+		"running_plugin_version": entry.RunningVersion,
+	})
+	if err != nil {
+		c.logger.Error("failed to record observation after disabling auth backend", "path", path, "error", err)
+	}
+
 	return nil
 }
 
@@ -401,7 +432,7 @@ func (c *Core) removeCredEntry(ctx context.Context, path string, updateStorage b
 				return err
 			}
 
-			return errors.New("failed to update auth table")
+			return fmt.Errorf("failed to update auth table: %w", err)
 		}
 	}
 
@@ -480,15 +511,17 @@ func (c *Core) remountCredential(ctx context.Context, src, dst namespace.MountPa
 	srcMatch.Path = strings.TrimPrefix(dst.MountPath, credentialRoutePrefix)
 
 	// Update the mount table
-	if err := c.persistAuth(ctx, c.auth, &srcMatch.Local); err != nil {
-		srcMatch.Path = srcPath
-		srcMatch.Tainted = true
-		c.authLock.Unlock()
-		if err == logical.ErrReadOnly && c.perfStandby {
-			return err
-		}
+	if updateStorage {
+		if err := c.persistAuth(ctx, c.auth, &srcMatch.Local); err != nil {
+			srcMatch.Path = srcPath
+			srcMatch.Tainted = true
+			c.authLock.Unlock()
+			if err == logical.ErrReadOnly && c.perfStandby {
+				return err
+			}
 
-		return fmt.Errorf("failed to update auth table with error %+v", err)
+			return fmt.Errorf("failed to update auth table with error %+v", err)
+		}
 	}
 
 	// Remount the backend, setting the existing route entry
@@ -558,7 +591,7 @@ func (c *Core) taintCredEntry(ctx context.Context, nsID, path string, updateStor
 			if err == logical.ErrReadOnly && c.perfStandby {
 				return err
 			}
-			return errors.New("failed to update auth table")
+			return fmt.Errorf("failed to update auth table: %w", err)
 		}
 	}
 
@@ -659,6 +692,12 @@ func (c *Core) loadCredentials(ctx context.Context) error {
 		}
 		entry.namespace = ns
 
+		// Subtle: in `loadMounts` there is a call to namespaceManager.Register in
+		// the equivalent place to here. It's non-obvious why that is needed (see
+		// the large comment there) but it's equally subtle why it better NOT to do
+		// the same here. For more rationale see
+		// https://github.com/hashicorp/vault-enterprise/pull/5437#issuecomment-1954434213.
+
 		// Sync values to the cache
 		entry.SyncCache()
 	}
@@ -949,6 +988,8 @@ func (c *Core) newCredentialBackend(ctx context.Context, entry *MountEntry, sysV
 	if err != nil {
 		return nil, err
 	}
+
+	conf := make(map[string]string)
 	var runningSha string
 	factory, ok := c.credentialBackends[t]
 	if !ok {
@@ -967,13 +1008,22 @@ func (c *Core) newCredentialBackend(ctx context.Context, entry *MountEntry, sysV
 			runningSha = hex.EncodeToString(plug.Sha256)
 		}
 
+		if plug.Download {
+			if err = sysView.DownloadExtractVerifyPlugin(ctx, plug); err != nil {
+				return nil, fmt.Errorf("failed to extract and verify plugin=%q version=%q before mounting: %w",
+					plug.Name, plug.Version, err)
+			}
+		}
+
 		factory = plugin.Factory
 		if !plug.Builtin {
 			factory = wrapFactoryCheckPerms(c, plugin.Factory)
 		}
+
+		setExternalPluginConfig(plug, conf)
 	}
+
 	// Set up conf to pass in plugin_name
-	conf := make(map[string]string)
 	for k, v := range entry.Options {
 		conf[k] = v
 	}
@@ -987,6 +1037,7 @@ func (c *Core) newCredentialBackend(ctx context.Context, entry *MountEntry, sysV
 
 	conf["plugin_type"] = consts.PluginTypeCredential.String()
 	conf["plugin_version"] = pluginVersion
+	pluginOptionsVersion := entry.Options["version"]
 
 	authLogger := c.baseLogger.Named(fmt.Sprintf("auth.%s.%s", t, entry.Accessor))
 	c.AddLogger(authLogger)
@@ -996,19 +1047,39 @@ func (c *Core) newCredentialBackend(ctx context.Context, entry *MountEntry, sysV
 		MountPath:     entry.Path,
 		Plugin:        entry.Type,
 		PluginVersion: pluginVersion,
-		Version:       entry.Options["version"],
+		Version:       pluginOptionsVersion,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	pluginRunningVersion := pluginVersion
+	if pluginRunningVersion == "" && runningSha == "" {
+		pluginRunningVersion = versions.GetBuiltinVersion(consts.PluginTypeCredential, entry.Type)
+	}
+
+	pluginObservationRecorder, err := c.observations.WithPlugin(entry.namespace, &logical.ObservationPluginInfo{
+		MountClass:           consts.PluginTypeCredential.String(),
+		MountAccessor:        entry.Accessor,
+		MountPath:            entry.Path,
+		Plugin:               entry.Type,
+		PluginVersion:        pluginVersion,
+		RunningPluginVersion: pluginRunningVersion,
+		Version:              pluginOptionsVersion,
+		Local:                entry.Local,
 	})
 	if err != nil {
 		return nil, err
 	}
 
 	config := &logical.BackendConfig{
-		StorageView:  view,
-		Logger:       authLogger,
-		Config:       conf,
-		System:       sysView,
-		BackendUUID:  entry.BackendAwareUUID,
-		EventsSender: pluginEventSender,
+		StorageView:         view,
+		Logger:              authLogger,
+		Config:              conf,
+		System:              sysView,
+		BackendUUID:         entry.BackendAwareUUID,
+		EventsSender:        pluginEventSender,
+		ObservationRecorder: pluginObservationRecorder,
 	}
 
 	backend, err := factory(ctx, config)
@@ -1016,11 +1087,8 @@ func (c *Core) newCredentialBackend(ctx context.Context, entry *MountEntry, sysV
 		return nil, err
 	}
 	if backend != nil {
-		entry.RunningVersion = pluginVersion
+		entry.RunningVersion = pluginRunningVersion
 		entry.RunningSha256 = runningSha
-		if entry.RunningVersion == "" && entry.RunningSha256 == "" {
-			entry.RunningVersion = versions.GetBuiltinVersion(consts.PluginTypeCredential, entry.Type)
-		}
 	}
 
 	return backend, nil
diff --git a/vault/auth_test.go b/vault/auth_test.go
index 97b8287f883..806411ffd20 100644
--- a/vault/auth_test.go
+++ b/vault/auth_test.go
@@ -1,16 +1,16 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
 	"context"
-	"reflect"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/armon/go-metrics"
+	"github.com/go-test/deep"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
@@ -142,8 +142,8 @@ func TestCore_DefaultAuthTable(t *testing.T) {
 	}
 
 	// Verify matching mount tables
-	if !reflect.DeepEqual(c.auth, c2.auth) {
-		t.Fatalf("mismatch: %v %v", c.auth, c2.auth)
+	if diffs := deep.Equal(c.auth, c2.auth); len(diffs) != 0 {
+		t.Fatalf("mismatch: %v %v:\nDiffs: %v", c.auth, c2.auth, diffs)
 	}
 }
 
@@ -230,8 +230,8 @@ func TestCore_EnableCredential(t *testing.T) {
 	}
 
 	// Verify matching auth tables
-	if !reflect.DeepEqual(c.auth, c2.auth) {
-		t.Fatalf("mismatch: %v %v", c.auth, c2.auth)
+	if diffs := deep.Equal(c.auth, c2.auth); len(diffs) != 0 {
+		t.Fatalf("mismatch: %v %v:\nDiffs: %v", c.auth, c2.auth, diffs)
 	}
 }
 
@@ -289,8 +289,8 @@ func TestCore_EnableCredential_aws_ec2(t *testing.T) {
 	}
 
 	// Verify matching auth tables
-	if !reflect.DeepEqual(c.auth, c2.auth) {
-		t.Fatalf("mismatch: %v %v", c.auth, c2.auth)
+	if diffs := deep.Equal(c.auth, c2.auth); len(diffs) != 0 {
+		t.Fatalf("mismatch: %v %v:\n%v", c.auth, c2.auth, diffs)
 	}
 }
 
@@ -377,8 +377,8 @@ func TestCore_EnableCredential_Local(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if !reflect.DeepEqual(oldCredential, c.auth) {
-		t.Fatalf("expected\n%#v\ngot\n%#v\n", oldCredential, c.auth)
+	if diffs := deep.Equal(oldCredential, c.auth); len(diffs) != 0 {
+		t.Fatalf("expected\n%#v\ngot\n%#v:\nDiffs: %v", oldCredential, c.auth, diffs)
 	}
 
 	if len(c.auth.Entries) != 2 {
@@ -486,8 +486,8 @@ func TestCore_DisableCredential(t *testing.T) {
 	}
 
 	// Verify matching mount tables
-	if !reflect.DeepEqual(c.auth, c2.auth) {
-		t.Fatalf("mismatch: %v %v", c.auth, c2.auth)
+	if diffs := deep.Equal(c.auth, c2.auth); len(diffs) != 0 {
+		t.Fatalf("mismatch: %v %v:\nDiffs: %v", c.auth, c2.auth, diffs)
 	}
 }
 
diff --git a/vault/barrier.go b/vault/barrier.go
index 9cba04eb7b3..dd4cfa05eaf 100644
--- a/vault/barrier.go
+++ b/vault/barrier.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -166,6 +166,8 @@ type SecurityBarrier interface {
 
 	// SecurityBarrier must provide the encryption APIs
 	BarrierEncryptor
+
+	DetectDeadlocks() bool
 }
 
 // BarrierStorage is the storage only interface required for a Barrier.
diff --git a/vault/barrier_access.go b/vault/barrier_access.go
index 8cfecfcac73..733fa0dc323 100644
--- a/vault/barrier_access.go
+++ b/vault/barrier_access.go
@@ -1,9 +1,15 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
-import "context"
+import (
+	"context"
+	"errors"
+
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/physical"
+)
 
 // BarrierEncryptorAccess is a wrapper around BarrierEncryptor that allows Core
 // to expose its barrier encrypt/decrypt operations through BarrierEncryptorAccess()
@@ -25,3 +31,56 @@ func (b *BarrierEncryptorAccess) Encrypt(ctx context.Context, key string, plaint
 func (b *BarrierEncryptorAccess) Decrypt(ctx context.Context, key string, ciphertext []byte) ([]byte, error) {
 	return b.barrierEncryptor.Decrypt(ctx, key, ciphertext)
 }
+
+// NewBarrierDecryptingStorage returns a view of storage that will decrypt the
+// storage values for Get operations. The returned storage is read-only, and
+// will error on attempts to Put or Delete.
+func NewBarrierDecryptingStorage(
+	barrier BarrierEncryptor, underlying physical.Backend,
+) logical.Storage {
+	return &barrierDecryptingStorage{
+		barrier:    barrier,
+		underlying: underlying,
+	}
+}
+
+type barrierDecryptingStorage struct {
+	barrier    BarrierEncryptor
+	underlying physical.Backend
+}
+
+func (b *barrierDecryptingStorage) List(ctx context.Context, prefix string) ([]string, error) {
+	return b.underlying.List(ctx, prefix)
+}
+
+// ignore-nil-nil-function-check
+func (b *barrierDecryptingStorage) Get(ctx context.Context, key string) (*logical.StorageEntry, error) {
+	entry, err := b.underlying.Get(ctx, key)
+	if err != nil {
+		return nil, err
+	}
+	if entry == nil {
+		return nil, nil
+	}
+	decrypted, err := b.barrier.Decrypt(ctx, entry.Key, entry.Value)
+	if err != nil {
+		return nil, err
+	}
+	return &logical.StorageEntry{
+		Key:      entry.Key,
+		Value:    decrypted,
+		SealWrap: entry.SealWrap,
+	}, nil
+}
+
+var errReadOnly = errors.New("read-only storage")
+
+func (b *barrierDecryptingStorage) Put(ctx context.Context, entry *logical.StorageEntry) error {
+	return errReadOnly
+}
+
+func (b *barrierDecryptingStorage) Delete(ctx context.Context, key string) error {
+	return errReadOnly
+}
+
+var _ logical.Storage = (*barrierDecryptingStorage)(nil)
diff --git a/vault/barrier_aes_gcm.go b/vault/barrier_aes_gcm.go
index bb4c455b480..40435579f5b 100644
--- a/vault/barrier_aes_gcm.go
+++ b/vault/barrier_aes_gcm.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -14,16 +14,20 @@ import (
 	"fmt"
 	"io"
 	"math"
+	"os"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/armon/go-metrics"
+	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
+	"github.com/hashicorp/vault/helper/locking"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/physical"
+	"github.com/hashicorp/vault/vault/seal"
 	"go.uber.org/atomic"
 )
 
@@ -38,7 +42,8 @@ const (
 	autoRotateCheckInterval = 5 * time.Minute
 	legacyRotateReason      = "legacy rotation"
 	// The keyring is persisted before the root key.
-	keyringTimeout = 1 * time.Second
+	defaultKeyringTimeout            = 1 * time.Second
+	bestEffortKeyringTimeoutOverride = "VAULT_ENCRYPTION_COUNT_PERSIST_TIMEOUT"
 )
 
 // Versions of the AESGCM storage methodology
@@ -68,7 +73,7 @@ var (
 type AESGCMBarrier struct {
 	backend physical.Backend
 
-	l      sync.RWMutex
+	l      locking.RWMutex
 	sealed bool
 
 	// keyring is used to maintain all of the encryption keys, including
@@ -91,6 +96,8 @@ type AESGCMBarrier struct {
 	// Used only for testing
 	RemoteEncryptions     *atomic.Int64
 	totalLocalEncryptions *atomic.Int64
+
+	bestEffortKeyringTimeout time.Duration
 }
 
 func (b *AESGCMBarrier) RotationConfig() (kc KeyRotationConfig, err error) {
@@ -114,19 +121,41 @@ func (b *AESGCMBarrier) SetRotationConfig(ctx context.Context, rotConfig KeyRota
 
 // NewAESGCMBarrier is used to construct a new barrier that uses
 // the provided physical backend for storage.
-func NewAESGCMBarrier(physical physical.Backend) (*AESGCMBarrier, error) {
+func NewAESGCMBarrier(physical physical.Backend, detectDeadlocks bool) (*AESGCMBarrier, error) {
+	keyringTimeout := defaultKeyringTimeout
+	keyringTimeoutStr := os.Getenv(bestEffortKeyringTimeoutOverride)
+	if keyringTimeoutStr != "" {
+		t, err := parseutil.ParseDurationSecond(keyringTimeoutStr)
+		if err != nil {
+			return nil, fmt.Errorf("failed parsing %s environment variable: %w", bestEffortKeyringTimeoutOverride, err)
+		}
+		keyringTimeout = t
+	}
+
 	b := &AESGCMBarrier{
 		backend:                  physical,
+		l:                        &locking.SyncRWMutex{},
 		sealed:                   true,
 		cache:                    make(map[uint32]cipher.AEAD),
 		currentAESGCMVersionByte: byte(AESGCMVersion2),
 		UnaccountedEncryptions:   atomic.NewInt64(0),
 		RemoteEncryptions:        atomic.NewInt64(0),
 		totalLocalEncryptions:    atomic.NewInt64(0),
+		bestEffortKeyringTimeout: keyringTimeout,
+	}
+	if detectDeadlocks {
+		b.l = &locking.DeadlockRWMutex{}
 	}
 	return b, nil
 }
 
+func (b *AESGCMBarrier) DetectDeadlocks() bool {
+	if _, ok := b.l.(*locking.DeadlockRWMutex); ok {
+		return true
+	}
+	return false
+}
+
 // Initialized checks if the barrier has been initialized
 // and has a root key set.
 func (b *AESGCMBarrier) Initialized(ctx context.Context) (bool, error) {
@@ -250,13 +279,14 @@ func (b *AESGCMBarrier) persistKeyringInternal(ctx context.Context, keyring *Key
 		Value: value,
 	}
 
+	ctx = seal.ContextWithFullRewrapRequired(ctx)
 	ctxKeyring := ctx
 
 	if bestEffort {
 		// We reduce the timeout on the initial 'put' but if this succeeds we will
 		// allow longer later on when we try to persist the root key .
 		var cancelKeyring func()
-		ctxKeyring, cancelKeyring = context.WithTimeout(ctx, keyringTimeout)
+		ctxKeyring, cancelKeyring = context.WithTimeout(ctx, b.bestEffortKeyringTimeout)
 		defer cancelKeyring()
 	}
 
@@ -593,6 +623,11 @@ func (b *AESGCMBarrier) Rotate(ctx context.Context, randomSource io.Reader) (uin
 	term := b.keyring.ActiveTerm()
 	newTerm := term + 1
 
+	if newTerm < term {
+		// We've rolled over the uint32, don't allow this
+		return 0, errors.New("failed to generate a new term value due to integer overflow")
+	}
+
 	// Add a new encryption key
 	newKeyring, err := b.keyring.AddKey(&Key{
 		Term:    newTerm,
@@ -1248,6 +1283,8 @@ func (b *AESGCMBarrier) persistEncryptions(ctx context.Context) error {
 			newKeyring := b.keyring.Clone()
 			err := b.persistKeyringBestEffort(ctx, newKeyring)
 			if err != nil {
+				// because Keys are pointer addressed, we need to undo the update to the Encryption count here
+				activeKey.Encryptions -= uint64(newEncs)
 				return err
 			}
 			b.UnaccountedEncryptions.Sub(newEncs)
diff --git a/vault/barrier_aes_gcm_test.go b/vault/barrier_aes_gcm_test.go
index 9ed7d6fcb13..60bcdd2ca0b 100644
--- a/vault/barrier_aes_gcm_test.go
+++ b/vault/barrier_aes_gcm_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -8,6 +8,8 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/json"
+	"math"
+	"strings"
 	"testing"
 	"time"
 
@@ -28,7 +30,7 @@ func mockBarrier(t testing.TB) (physical.Backend, SecurityBarrier, []byte) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -45,7 +47,7 @@ func TestAESGCMBarrier_Basic(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -57,7 +59,7 @@ func TestAESGCMBarrier_Rotate(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -69,7 +71,7 @@ func TestAESGCMBarrier_MissingRotateConfig(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -97,11 +99,11 @@ func TestAESGCMBarrier_Upgrade(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b1, err := NewAESGCMBarrier(inm)
+	b1, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b2, err := NewAESGCMBarrier(inm)
+	b2, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -113,11 +115,11 @@ func TestAESGCMBarrier_Upgrade_Rekey(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b1, err := NewAESGCMBarrier(inm)
+	b1, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b2, err := NewAESGCMBarrier(inm)
+	b2, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -129,7 +131,7 @@ func TestAESGCMBarrier_Rekey(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -143,7 +145,7 @@ func TestAESGCMBarrier_BackwardsCompatible(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -232,7 +234,7 @@ func TestAESGCMBarrier_Confidential(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -272,7 +274,7 @@ func TestAESGCMBarrier_Integrity(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -310,7 +312,7 @@ func TestAESGCMBarrier_MoveIntegrityV1(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -354,7 +356,7 @@ func TestAESGCMBarrier_MoveIntegrityV2(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -398,7 +400,7 @@ func TestAESGCMBarrier_UpgradeV1toV2(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -429,7 +431,7 @@ func TestAESGCMBarrier_UpgradeV1toV2(t *testing.T) {
 	}
 
 	// Open again as version 2
-	b, err = NewAESGCMBarrier(inm)
+	b, err = NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -453,7 +455,7 @@ func TestEncrypt_Unique(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -489,7 +491,7 @@ func TestInitialize_KeyLength(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -522,7 +524,7 @@ func TestEncrypt_BarrierEncryptor(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -558,7 +560,7 @@ func TestDecrypt_InvalidCipherLength(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -591,7 +593,7 @@ func TestAESGCMBarrier_ReloadKeyring(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b, err := NewAESGCMBarrier(inm)
+	b, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -614,7 +616,7 @@ func TestAESGCMBarrier_ReloadKeyring(t *testing.T) {
 
 	{
 		// Create a second barrier and rotate the keyring
-		b2, err := NewAESGCMBarrier(inm)
+		b2, err := NewAESGCMBarrier(inm, false)
 		if err != nil {
 			t.Fatalf("err: %v", err)
 		}
@@ -669,7 +671,7 @@ func TestBarrier_LegacyRotate(t *testing.T) {
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
-	b1, err := NewAESGCMBarrier(inm)
+	b1, err := NewAESGCMBarrier(inm, false)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	} // Initialize the barrier
@@ -697,6 +699,45 @@ func TestBarrier_LegacyRotate(t *testing.T) {
 	}
 }
 
+// TestBarrier_RotateFailsOnOverflow validates that if we ever actually hit the
+// barrier key rotation limit, we fail the rotation with an error.
+func TestBarrier_RotateFailsOnOverflow(t *testing.T) {
+	inm, err := inmem.NewInmem(nil, logger)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	b, err := NewAESGCMBarrier(inm, false)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	key, err := b.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	// Initialize the barrier
+	ctx := context.Background()
+	err = b.Initialize(ctx, key, nil, rand.Reader)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	err = b.Unseal(ctx, key)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	// Hack to avoid generating a lot of keys...
+	b.keyring.activeTerm = math.MaxUint32
+
+	_, err = b.Rotate(ctx, rand.Reader)
+	if err == nil {
+		t.Fatalf("Rotate should fail on overflow but did not")
+	}
+	if !strings.Contains(err.Error(), "integer overflow") {
+		t.Fatalf("Rotate failed but not for the expected reason of integer overflow: %v", err)
+	}
+}
+
 // TestBarrier_persistKeyring_Context checks that we get the right errors if
 // the context is cancelled or times-out before the first part of persistKeyring
 // is able to persist the keyring itself (i.e. we don't go on to try and persist
@@ -735,7 +776,7 @@ func TestBarrier_persistKeyring_Context(t *testing.T) {
 			// Set up barrier
 			backend, err := inmem.NewInmem(nil, corehelpers.NewTestLogger(t))
 			require.NoError(t, err)
-			barrier, err := NewAESGCMBarrier(backend)
+			barrier, err := NewAESGCMBarrier(backend, false)
 			require.NoError(t, err)
 			key, err := barrier.GenerateKey(rand.Reader)
 			require.NoError(t, err)
diff --git a/vault/barrier_test.go b/vault/barrier_test.go
index 97ec591e274..c694c8455e9 100644
--- a/vault/barrier_test.go
+++ b/vault/barrier_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/barrier_view.go b/vault/barrier_view.go
index ba62510d626..c18f9cf165f 100644
--- a/vault/barrier_view.go
+++ b/vault/barrier_view.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/barrier_view_test.go b/vault/barrier_view_test.go
index 705d3340c5e..2588d8ed54c 100644
--- a/vault/barrier_view_test.go
+++ b/vault/barrier_view_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/barrier_view_util.go b/vault/barrier_view_util.go
index 363fffe5e3d..1f7f1c88a9b 100644
--- a/vault/barrier_view_util.go
+++ b/vault/barrier_view_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/bench/smoke_bench_test.go b/vault/bench/smoke_bench_test.go
new file mode 100644
index 00000000000..4b6acc07b4f
--- /dev/null
+++ b/vault/bench/smoke_bench_test.go
@@ -0,0 +1,136 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package bench
+
+import (
+	"context"
+	"crypto/md5"
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/api"
+	vaulthttp "github.com/hashicorp/vault/http"
+	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	v2MountPath = "secret-v2"
+	secretPath  = "my-secret"
+)
+
+var secretData = map[string]interface{}{
+	"foo": "bar",
+}
+
+// BenchmarkSmoke_KVV2 runs basic benchmarks on writes and reads to KVV2 on an inmem test cluster.
+func BenchmarkSmoke_KVV2(b *testing.B) {
+	cluster := vault.NewTestCluster(b, &vault.CoreConfig{}, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+	})
+	client := cluster.Cores[0].Client
+
+	// mount the KVv2 backend
+	err := client.Sys().Mount(v2MountPath, &api.MountInput{
+		Type: "kv-v2",
+	})
+	require.NoError(b, err)
+
+	data, err := client.KVv2(v2MountPath).Put(context.Background(), secretPath, secretData)
+	require.NoError(b, err)
+
+	data, err = client.KVv2(v2MountPath).Get(context.Background(), secretPath)
+	require.NoError(b, err)
+
+	require.Equal(b, "kv", data.Raw.MountType)
+	require.Equal(b, secretData, data.Data)
+
+	bench := func(b *testing.B, dataSize int) {
+		data, err := uuid.GenerateRandomBytes(dataSize)
+		require.NoError(b, err)
+
+		testName := b.Name()
+
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			key := fmt.Sprintf("%s/%x", secretPath, md5.Sum([]byte(fmt.Sprintf("%s-%d", testName, i))))
+			_, err := client.KVv2(v2MountPath).Put(context.Background(), key, map[string]interface{}{
+				"foo": string(data),
+			})
+			require.NoError(b, err)
+			_, err = client.KVv2(v2MountPath).Get(context.Background(), secretPath)
+			require.NoError(b, err)
+		}
+	}
+
+	b.Run("kv-puts-and-gets", func(b *testing.B) { bench(b, 1024) })
+}
+
+// BenchmarkSmoke_ClusterCreation benchmarks the creation, start, and a cleanup of a vault.TestCluster.
+// Note that the cluster created here uses inmem Physical and HAPhysical backends.
+func BenchmarkSmoke_ClusterCreation(b *testing.B) {
+	bench := func(b *testing.B) {
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			cluster := vault.NewTestCluster(b, &vault.CoreConfig{}, &vault.TestClusterOptions{
+				HandlerFunc: vaulthttp.Handler,
+			})
+			cluster.Cleanup()
+		}
+	}
+
+	b.Run("cluster-creation", func(b *testing.B) { bench(b) })
+}
+
+// BenchmarkSmoke_MountUnmount runs some basic benchmarking on mounting and unmounting
+func BenchmarkSmoke_MountUnmount(b *testing.B) {
+	cluster := vault.NewTestCluster(b, &vault.CoreConfig{}, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+	})
+	client := cluster.Cores[0].Client
+
+	bench := func(b *testing.B) {
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			err := client.Sys().Mount(v2MountPath, &api.MountInput{
+				Type: "kv-v2",
+			})
+			require.NoError(b, err)
+			err = client.Sys().Unmount(v2MountPath)
+			require.NoError(b, err)
+		}
+	}
+
+	b.Run("mount-unmount", func(b *testing.B) { bench(b) })
+}
+
+// BenchmarkSmoke_TokenCreationRevocation runs some basic benchmarking on tokens
+func BenchmarkSmoke_TokenCreationRevocation(b *testing.B) {
+	cluster := vault.NewTestCluster(b, &vault.CoreConfig{}, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+	})
+	client := cluster.Cores[0].Client
+	rootToken := client.Token()
+
+	bench := func(b *testing.B) {
+		b.ResetTimer()
+		for i := 0; i < b.N; i++ {
+			client.SetToken(rootToken)
+			secret, err := client.Auth().Token().Create(&api.TokenCreateRequest{
+				Policies: []string{"default"},
+				TTL:      "30m",
+			})
+			require.NoError(b, err)
+			require.NotNil(b, secret)
+			require.NotNil(b, secret.Auth)
+			require.NotNil(b, secret.Auth.ClientToken)
+			client.SetToken(secret.Auth.ClientToken)
+			err = client.Auth().Token().RevokeSelf(secret.Auth.ClientToken)
+			require.NoError(b, err)
+		}
+	}
+
+	b.Run("token-creation-revocation", func(b *testing.B) { bench(b) })
+}
diff --git a/vault/capabilities.go b/vault/capabilities.go
index 8310aaf8e4b..df4b7ef2f22 100644
--- a/vault/capabilities.go
+++ b/vault/capabilities.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -72,10 +72,14 @@ func (c *Core) CapabilitiesAndSubscribeEventTypes(ctx context.Context, token, pa
 	// Add capabilities of the inline policy if it's set
 	policies := make([]*Policy, 0)
 	if te.InlinePolicy != "" {
-		inlinePolicy, err := ParseACLPolicy(tokenNS, te.InlinePolicy)
+		// TODO (HCL_DUP_KEYS_DEPRECATION): return to ParseACLPolicy once the deprecation is done
+		inlinePolicy, duplicate, err := ParseACLPolicyCheckDuplicates(tokenNS, te.InlinePolicy)
 		if err != nil {
 			return nil, nil, err
 		}
+		if duplicate {
+			c.logger.Warn("HCL inline policy contains duplicate attributes, which will no longer be supported in a future version", "namespace", tokenNS.Path)
+		}
 		policies = append(policies, inlinePolicy)
 		policyCount++
 	}
diff --git a/vault/capabilities_test.go b/vault/capabilities_test.go
index d0bd92c60a4..4eaa8fc169a 100644
--- a/vault/capabilities_test.go
+++ b/vault/capabilities_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/census.go b/vault/census.go
index e492ac2c88c..6aae8321818 100644
--- a/vault/census.go
+++ b/vault/census.go
@@ -1,22 +1,33 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
 
 package vault
 
-import "time"
+import (
+	"context"
+	"time"
+)
+
+const utilizationBasePath = "utilization"
 
 // CensusAgent is a stub for OSS
 type CensusReporter interface{}
 
-func (c *Core) setupCensusManager() error                        { return nil }
-func (c *Core) BillingStart() time.Time                          { return time.Time{} }
-func (c *Core) AutomatedLicenseReportingEnabled() bool           { return false }
-func (c *Core) CensusAgent() CensusReporter                      { return nil }
-func (c *Core) ReloadCensus() error                              { return nil }
-func (c *Core) teardownCensusManager() error                     { return nil }
-func (c *Core) StartManualCensusSnapshots()                      {}
-func (c *Core) ManualLicenseReportingEnabled() bool              { return false }
-func (c *Core) ManualCensusSnapshotInterval() time.Duration      { return time.Duration(0) }
-func (c *Core) ManualCensusSnapshotRetentionTime() time.Duration { return time.Duration(0) }
+func (c *Core) BillingStart() time.Time                                           { return time.Time{} }
+func (c *Core) AutomatedLicenseReportingEnabled() bool                            { return false }
+func (c *Core) CensusAgent() CensusReporter                                       { return nil }
+func (c *Core) teardownCensusManager() error                                      { return nil }
+func (c *Core) StartManualCensusSnapshots()                                       {}
+func (c *Core) ManualLicenseReportingEnabled() bool                               { return false }
+func (c *Core) ManualCensusSnapshotInterval() time.Duration                       { return time.Duration(0) }
+func (c *Core) ManualCensusSnapshotRetentionTime() time.Duration                  { return time.Duration(0) }
+func (c *Core) StartCensusReports(ctx context.Context)                            {}
+func (c *Core) SetRetentionMonths(months int) error                               { return nil }
+func (c *Core) ReloadCensusManager(ctx context.Context, licenseChange bool) error { return nil }
+func (c *Core) parseCensusManagerConfig(conf *CoreConfig) (CensusManagerConfig, error) {
+	return CensusManagerConfig{}, nil
+}
+func (c *Core) DevelopmentCluster() bool                      { return false }
+func (c *Core) SetDevelopmentCluster(developmentCluster bool) {}
diff --git a/vault/census_manager.go b/vault/census_manager.go
new file mode 100644
index 00000000000..0288ba427cc
--- /dev/null
+++ b/vault/census_manager.go
@@ -0,0 +1,60 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"context"
+	"time"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// CensusManager provides stub behavior for CE, simplifying the logic between CE
+// and ENT. This will always be marked active: false.
+type CensusManager struct {
+	active bool
+	logger hclog.Logger
+}
+
+// CensusManagerConfig is empty on CE.
+type CensusManagerConfig struct{}
+
+// NewCensusManager sets up the stub CensusManager on CE with active: false.
+func NewCensusManager(logger hclog.Logger, conf CensusManagerConfig, storage logical.Storage) (*CensusManager, error) {
+	return &CensusManager{
+		active: false,
+		logger: logger,
+	}, nil
+}
+
+// setupCensusManager is a stub on CE.
+func (c *Core) setupCensusManager(ctx context.Context) error {
+	return nil
+}
+
+// reloadDevelopmentClusterSetting is a stub on CE.
+func (c *Core) reloadDevelopmentClusterSetting() error {
+	return nil
+}
+
+// persistDevelopmentClusterSetting is a stub on CE.
+func (c *Core) persistDevelopmentClusterSetting(ctx context.Context) error {
+	return nil
+}
+
+// getDevelopmentClusterSetting is a stub on CE.
+func (c *Core) getDevelopmentClusterSetting(ctx context.Context) (bool, error) {
+	return false, nil
+}
+
+// BillingStart is a stub on CE.
+func (cm *CensusManager) BillingStart() time.Time {
+	return time.Time{}
+}
+
+// StartManualReportingSnapshots is a stub for CE.
+func (cm *CensusManager) StartManualReportingSnapshots() {}
diff --git a/vault/clienttype_enumer.go b/vault/clienttype_enumer.go
new file mode 100644
index 00000000000..33ffa9326a4
--- /dev/null
+++ b/vault/clienttype_enumer.go
@@ -0,0 +1,49 @@
+// Code generated by "enumer -type=clientType -trimprefix=clientType -transform=snake"; DO NOT EDIT.
+
+package vault
+
+import (
+	"fmt"
+)
+
+const _clientTypeName = "confidentialpublic"
+
+var _clientTypeIndex = [...]uint8{0, 12, 18}
+
+func (i clientType) String() string {
+	if i < 0 || i >= clientType(len(_clientTypeIndex)-1) {
+		return fmt.Sprintf("clientType(%d)", i)
+	}
+	return _clientTypeName[_clientTypeIndex[i]:_clientTypeIndex[i+1]]
+}
+
+var _clientTypeValues = []clientType{0, 1}
+
+var _clientTypeNameToValueMap = map[string]clientType{
+	_clientTypeName[0:12]:  0,
+	_clientTypeName[12:18]: 1,
+}
+
+// clientTypeString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func clientTypeString(s string) (clientType, error) {
+	if val, ok := _clientTypeNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to clientType values", s)
+}
+
+// clientTypeValues returns all values of the enum
+func clientTypeValues() []clientType {
+	return _clientTypeValues
+}
+
+// IsAclientType returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i clientType) IsAclientType() bool {
+	for _, v := range _clientTypeValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/vault/cluster.go b/vault/cluster.go
index 903b36c5cf1..9326d921a97 100644
--- a/vault/cluster.go
+++ b/vault/cluster.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -23,12 +23,14 @@ import (
 	uuid "github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/vault/cluster"
 )
 
 const (
 	// Storage path where the local cluster name and identifier are stored
 	coreLocalClusterInfoPath = "core/cluster/local/info"
+	coreLocalClusterNamePath = "core/cluster/local/name"
 
 	corePrivateKeyTypeP521    = "p521"
 	corePrivateKeyTypeED25519 = "ed25519"
@@ -61,18 +63,30 @@ type Cluster struct {
 // when Vault is sealed.
 func (c *Core) Cluster(ctx context.Context) (*Cluster, error) {
 	var cluster Cluster
+	var logicalEntry *logical.StorageEntry
+	var physicalEntry *physical.Entry
 
 	// Fetch the storage entry. This call fails when Vault is sealed.
-	entry, err := c.barrier.Get(ctx, coreLocalClusterInfoPath)
+	logicalEntry, err := c.barrier.Get(ctx, coreLocalClusterInfoPath)
 	if err != nil {
-		return nil, err
+		// Vault is sealed, pull cluster name from unencrypted storage
+		physicalEntry, err = c.physical.Get(ctx, coreLocalClusterNamePath)
+		if err != nil {
+			return nil, err
+		}
 	}
-	if entry == nil {
+	if logicalEntry == nil && physicalEntry == nil {
 		return &cluster, nil
 	}
 
 	// Decode the cluster information
-	if err = jsonutil.DecodeJSON(entry.Value, &cluster); err != nil {
+	var value []byte
+	if logicalEntry != nil {
+		value = logicalEntry.Value
+	} else {
+		value = physicalEntry.Value
+	}
+	if err = jsonutil.DecodeJSON(value, &cluster); err != nil {
 		return nil, fmt.Errorf("failed to decode cluster details: %w", err)
 	}
 
@@ -162,6 +176,7 @@ func (c *Core) setupCluster(ctx context.Context) error {
 	}
 
 	var modified bool
+	var generatedClusterName bool
 
 	if cluster == nil {
 		cluster = &Cluster{}
@@ -178,6 +193,7 @@ func (c *Core) setupCluster(ctx context.Context) error {
 			}
 
 			c.clusterName = fmt.Sprintf("vault-cluster-%08x", clusterNameBytes)
+			generatedClusterName = true
 		}
 
 		cluster.Name = c.clusterName
@@ -270,7 +286,7 @@ func (c *Core) setupCluster(ctx context.Context) error {
 			return err
 		}
 
-		// Store it
+		// Store cluster information in logical storage
 		err = c.barrier.Put(ctx, &logical.StorageEntry{
 			Key:   coreLocalClusterInfoPath,
 			Value: rawCluster,
@@ -279,6 +295,32 @@ func (c *Core) setupCluster(ctx context.Context) error {
 			c.logger.Error("failed to store cluster details", "error", err)
 			return err
 		}
+
+		// Store only cluster name in physical storage, but only if name isn't provided in config
+		if generatedClusterName {
+			rawCluster, err = json.Marshal(&Cluster{Name: cluster.Name})
+			if err != nil {
+				c.logger.Error("failed to marshal cluster name", "error", err)
+				return err
+			}
+
+			err = c.physical.Put(ctx, &physical.Entry{
+				Key:   coreLocalClusterNamePath,
+				Value: rawCluster,
+			})
+			if err != nil {
+				c.logger.Error("failed to store cluster name", "error", err)
+				return err
+			}
+		} else {
+			// check to ensure there is no entry at coreLocalClusterNamePath
+			err = c.physical.Delete(ctx, coreLocalClusterNamePath)
+			if err != nil {
+				c.logger.Error("failed to clear cluster name", "error", err)
+				return err
+			}
+
+		}
 	}
 
 	c.clusterID.Store(cluster.ID)
diff --git a/vault/cluster/cluster.go b/vault/cluster/cluster.go
index 8385d63a4c0..2e484d80d88 100644
--- a/vault/cluster/cluster.go
+++ b/vault/cluster/cluster.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cluster
diff --git a/vault/cluster/inmem_layer.go b/vault/cluster/inmem_layer.go
index aa28e153c2a..7534293b90c 100644
--- a/vault/cluster/inmem_layer.go
+++ b/vault/cluster/inmem_layer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cluster
@@ -116,6 +116,24 @@ func (l *InmemLayer) Listeners() []NetworkListener {
 	return []NetworkListener{l.listener}
 }
 
+// Partition forces the inmem layer to disconnect itself from peers and prevents
+// creating new connections. The returned function will add all peers back
+// and re-enable connections
+func (l *InmemLayer) Partition() (unpartition func()) {
+	l.l.Lock()
+	peersCopy := make([]*InmemLayer, 0, len(l.peers))
+	for _, peer := range l.peers {
+		peersCopy = append(peersCopy, peer)
+	}
+	l.l.Unlock()
+	l.DisconnectAll()
+	return func() {
+		for _, peer := range peersCopy {
+			l.Connect(peer)
+		}
+	}
+}
+
 // Dial implements NetworkLayer.
 func (l *InmemLayer) Dial(addr string, timeout time.Duration, tlsConfig *tls.Config) (*tls.Conn, error) {
 	l.l.Lock()
diff --git a/vault/cluster/inmem_layer_test.go b/vault/cluster/inmem_layer_test.go
index d465d1cd9fe..89c2f07f600 100644
--- a/vault/cluster/inmem_layer_test.go
+++ b/vault/cluster/inmem_layer_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cluster
diff --git a/vault/cluster/simulations.go b/vault/cluster/simulations.go
index 7a24b2f5bdb..0dc020e20b9 100644
--- a/vault/cluster/simulations.go
+++ b/vault/cluster/simulations.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cluster
diff --git a/vault/cluster/tcp_layer.go b/vault/cluster/tcp_layer.go
index d51d04af978..f578c25816c 100644
--- a/vault/cluster/tcp_layer.go
+++ b/vault/cluster/tcp_layer.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package cluster
diff --git a/vault/cluster_test.go b/vault/cluster_test.go
index 8d44940b3e7..4f0d9d9652d 100644
--- a/vault/cluster_test.go
+++ b/vault/cluster_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/core.go b/vault/core.go
index ff643122467..b4dcf26d50b 100644
--- a/vault/core.go
+++ b/vault/core.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -40,18 +40,19 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/go-secure-stdlib/tlsutil"
 	"github.com/hashicorp/go-uuid"
+	lru "github.com/hashicorp/golang-lru/v2"
 	kv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/audit"
 	"github.com/hashicorp/vault/command/server"
+	"github.com/hashicorp/vault/helper/activationflags"
 	"github.com/hashicorp/vault/helper/identity/mfa"
 	"github.com/hashicorp/vault/helper/locking"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/osutil"
-	"github.com/hashicorp/vault/limits"
+	"github.com/hashicorp/vault/helper/trace"
 	"github.com/hashicorp/vault/physical/raft"
-	"github.com/hashicorp/vault/plugins/event"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
@@ -63,6 +64,7 @@ import (
 	"github.com/hashicorp/vault/shamir"
 	"github.com/hashicorp/vault/vault/cluster"
 	"github.com/hashicorp/vault/vault/eventbus"
+	"github.com/hashicorp/vault/vault/observations"
 	"github.com/hashicorp/vault/vault/plugincatalog"
 	"github.com/hashicorp/vault/vault/quotas"
 	vaultseal "github.com/hashicorp/vault/vault/seal"
@@ -205,6 +207,20 @@ func (e *ErrInvalidKey) Error() string {
 	return fmt.Sprintf("invalid key: %v", e.Reason)
 }
 
+// possiblyWrapOverloadedError wraps ErrInternalError with the provided err
+// argument and a description if the err argument is ErrOverloaded. This is a
+// conservative approach to wrapping in some call paths which previously
+// discarded lower-level errors and returned ErrInternalError. The intent is to
+// prevent potential behavior changes by reducing the scope of errors which are
+// bubbled up.
+func possiblyWrapOverloadedError(desc string, err error) error {
+	if errors.Is(err, consts.ErrOverloaded) {
+		return fmt.Errorf("%s: %w: %w", desc, err, ErrInternalError)
+	}
+
+	return ErrInternalError
+}
+
 type RegisterAuthFunc func(context.Context, time.Duration, string, *logical.Auth, string) error
 
 type activeAdvertisement struct {
@@ -220,7 +236,8 @@ type unlockInformation struct {
 }
 
 type raftInformation struct {
-	challenge           *wrapping.BlobInfo
+	// challenge is in ciphertext
+	challenge           []byte
 	leaderClient        *api.Client
 	leaderBarrierConfig *SealConfig
 	nonVoter            bool
@@ -258,7 +275,7 @@ type Core struct {
 	// HABackend may be available depending on the physical backend
 	ha physical.HABackend
 
-	// storageType is the the storage type set in the storage configuration
+	// storageType is the storage type set in the storage configuration
 	storageType string
 
 	// redirectAddr is the address we advertise as leader if held
@@ -283,6 +300,9 @@ type Core struct {
 	// seal is our seal, for seal configuration information
 	seal Seal
 
+	// sealReloadFunc is a function that can be used to trigger seal configuration reloading
+	sealReloadFunc func(context.Context) error
+
 	// raftJoinDoneCh is used by the raft retry join routine to inform unseal process
 	// that the join is complete
 	raftJoinDoneCh chan struct{}
@@ -303,7 +323,7 @@ type Core struct {
 	// migrationInfo will be populated, which on enterprise may be necessary for
 	// seal rewrap.
 	migrationInfo     *migrationInformation
-	sealMigrationDone *uint32
+	sealMigrationDone atomic.Pointer[time.Time]
 
 	// barrier is the security barrier wrapping the physical backend
 	barrier SecurityBarrier
@@ -320,9 +340,6 @@ type Core struct {
 	// auditBackends is the mapping of backends to use for this core
 	auditBackends map[string]audit.Factory
 
-	// eventBackends is the mapping of event plugins to use for this core
-	eventBackends map[string]event.Factory
-
 	// stateLock protects mutable state
 	stateLock locking.RWMutex
 	sealed    *uint32
@@ -363,7 +380,7 @@ type Core struct {
 
 	// mountsLock is used to ensure that the mounts table does not
 	// change underneath a calling function
-	mountsLock locking.DeadlockRWMutex
+	mountsLock locking.RWMutex
 
 	// mountMigrationTracker tracks past and ongoing remount operations
 	// against their migration ids
@@ -375,7 +392,7 @@ type Core struct {
 
 	// authLock is used to ensure that the auth table does not
 	// change underneath a calling function
-	authLock locking.DeadlockRWMutex
+	authLock locking.RWMutex
 
 	// audit is loaded after unseal since it is a protected
 	// configuration
@@ -387,11 +404,11 @@ type Core struct {
 
 	// auditBroker is used to ingest the audit events and fan
 	// out into the configured audit backends
-	auditBroker *AuditBroker
+	auditBroker *audit.Broker
 
 	// auditedHeaders is used to configure which http headers
 	// can be output in the audit logs
-	auditedHeaders *AuditedHeadersConfig
+	auditedHeaders *audit.HeadersConfig
 
 	// systemBackend is the backend which is used to manage internal operations
 	systemBackend   *SystemBackend
@@ -407,6 +424,9 @@ type Core struct {
 	// renewal, expiration and revocation
 	expiration *ExpirationManager
 
+	// the rotation manager handles periodic rotation of credentials
+	rotationManager *RotationManager
+
 	// rollback manager is used to run rollbacks periodically
 	rollback *RollbackManager
 
@@ -445,6 +465,8 @@ type Core struct {
 	defaultLeaseTTL time.Duration
 	maxLeaseTTL     time.Duration
 
+	removeIrrevocableLeaseAfter time.Duration
+
 	// baseLogger is used to avoid ResetNamed as it strips useful prefixes in
 	// e.g. testing
 	baseLogger log.Logger
@@ -515,6 +537,8 @@ type Core struct {
 	rpcClientConn *grpc.ClientConn
 	// The grpc forwarding client
 	rpcForwardingClient *forwardingClient
+	// The time of the last successful request forwarding heartbeat
+	rpcLastSuccessfulHeartbeat *atomic.Value
 	// The UUID used to hold the leader lock. Only set on active node
 	leaderUUID string
 
@@ -537,11 +561,13 @@ type Core struct {
 	introspectionEnabled     bool
 	introspectionEnabledLock sync.Mutex
 
-	// pluginDirectory is the location vault will look for plugin binaries
+	// pluginDirectory is the location vault will look for old style plugins, it is
+	// the root for all plugin artifacts.
 	pluginDirectory string
-	// pluginTmpdir is the location vault will use for containerized plugin
+
+	// containerPluginTmpdir is the location vault will use for containerized plugin
 	// temporary files
-	pluginTmpdir string
+	containerPluginTmpdir string
 
 	// pluginFileUid is the uid of the plugin files and directory
 	pluginFileUid int
@@ -616,7 +642,9 @@ type Core struct {
 	// Stop channel for raft TLS rotations
 	raftTLSRotationStopCh chan struct{}
 	// Stores the pending peers we are waiting to give answers
-	pendingRaftPeers *sync.Map
+	pendingRaftPeers *lru.Cache[string, *raftBootstrapChallenge]
+	// holds the lock for modifying pendingRaftPeers
+	pendingRaftPeersLock sync.RWMutex
 
 	// rawConfig stores the config as-is from the provided server configuration.
 	rawConfig *atomic.Value
@@ -664,6 +692,9 @@ type Core struct {
 	// disableAutopilot is used to disable the autopilot subsystem in raft storage
 	disableAutopilot bool
 
+	// allowAuditLogPrefixing must be enabled for audit devices to use a prefix (more secure without)
+	allowAuditLogPrefixing bool
+
 	// enable/disable identifying response headers
 	enableResponseHeaderHostname   bool
 	enableResponseHeaderRaftNodeID bool
@@ -693,6 +724,8 @@ type Core struct {
 
 	events *eventbus.EventBus
 
+	observations *observations.ObservationSystem
+
 	// writeForwardedPaths are a set of storage paths which are GRPC forwarded
 	// to the active node of the primary cluster, when present. This PathManager
 	// contains absolute paths that we intend to forward (and template) when
@@ -716,8 +749,14 @@ type Core struct {
 
 	clusterAddrBridge *raft.ClusterAddrBridge
 
-	limiterRegistry     *limits.LimiterRegistry
-	limiterRegistryLock sync.Mutex
+	censusManager *CensusManager
+
+	// Activation flags for enterprise features that require a one-time activation
+	FeatureActivationFlags *activationflags.FeatureActivationFlags
+	licenseReloadCh        chan error
+
+	// reportingScanDirectory is where the files emitted by /sys/reporting/scan go.
+	reportingScanDirectory string
 }
 
 func (c *Core) ActiveNodeClockSkewMillis() int64 {
@@ -728,12 +767,6 @@ func (c *Core) EchoDuration() time.Duration {
 	return c.echoDuration.Load()
 }
 
-func (c *Core) GetRequestLimiter(key string) *limits.RequestLimiter {
-	c.limiterRegistryLock.Lock()
-	defer c.limiterRegistryLock.Unlock()
-	return c.limiterRegistry.GetLimiter(key)
-}
-
 // c.stateLock needs to be held in read mode before calling this function.
 func (c *Core) HAState() consts.HAState {
 	switch {
@@ -753,6 +786,10 @@ func (c *Core) HAStateWithLock() consts.HAState {
 	return c.HAState()
 }
 
+func (c *Core) HALock() sync.Locker {
+	return c.stateLock.RLocker()
+}
+
 // CoreConfig is used to parameterize a core
 type CoreConfig struct {
 	entCoreConfig
@@ -767,8 +804,6 @@ type CoreConfig struct {
 
 	AuditBackends map[string]audit.Factory
 
-	EventBackends map[string]event.Factory
-
 	Physical physical.Backend
 
 	StorageType string
@@ -820,6 +855,8 @@ type CoreConfig struct {
 
 	MaxLeaseTTL time.Duration
 
+	RemoveIrrevocableLeaseAfter time.Duration
+
 	ClusterName string
 
 	ClusterCipherSuites string
@@ -876,6 +913,9 @@ type CoreConfig struct {
 	// DisableAutopilot is used to disable autopilot subsystem in raft storage
 	DisableAutopilot bool
 
+	// AllowAuditLogPrefixing must be enabled for audit devices to use a prefix (more secure without)
+	AllowAuditLogPrefixing bool
+
 	// Whether to send headers in the HTTP response showing hostname or raft node ID
 	EnableResponseHeaderHostname   bool
 	EnableResponseHeaderRaftNodeID bool
@@ -897,14 +937,18 @@ type CoreConfig struct {
 	// only accessible in the root namespace, currently sys/audit-hash and sys/monitor.
 	AdministrativeNamespacePath string
 
+	// ObservationSystemConfig is the config for the Observation System
+	ObservationSystemConfig *observations.ObservationSystemConfig
+
 	NumRollbackWorkers int
 
 	PeriodicLeaderRefreshInterval time.Duration
 
 	ClusterAddrBridge *raft.ClusterAddrBridge
+	LicenseReload     chan error
 
-	DisableRequestLimiter bool
-	LimiterRegistry       *limits.LimiterRegistry
+	// ReportingScanDirectory is where files generated by /sys/reporting/scan will go.
+	ReportingScanDirectory string
 }
 
 // GetServiceRegistration returns the config's ServiceRegistration, or nil if it does
@@ -999,25 +1043,10 @@ func CreateCore(conf *CoreConfig) (*Core, error) {
 		effectiveSDKVersion = version.GetVersion().Version
 	}
 
-	var detectDeadlocks []string
-	if conf.DetectDeadlocks != "" {
-		detectDeadlocks = strings.Split(conf.DetectDeadlocks, ",")
-		for k, v := range detectDeadlocks {
-			detectDeadlocks[k] = strings.ToLower(strings.TrimSpace(v))
-		}
-	}
-
-	if conf.LimiterRegistry == nil {
-		conf.LimiterRegistry = limits.NewLimiterRegistry(conf.Logger.Named("limits"))
-	}
-
-	// Use imported logging deadlock if requested
-	var stateLock locking.RWMutex
-	stateLock = &locking.SyncRWMutex{}
-
-	if slices.Contains(detectDeadlocks, "statelock") {
-		stateLock = &locking.DeadlockRWMutex{}
-	}
+	detectDeadlocks := locking.ParseDetectDeadlockConfigParameter(conf.DetectDeadlocks)
+	stateLock := locking.CreateConfigurableRWMutex(detectDeadlocks, "statelock")
+	mountsLock := locking.CreateConfigurableRWMutex(detectDeadlocks, "mountsLock")
+	authLock := locking.CreateConfigurableRWMutex(detectDeadlocks, "authLock")
 
 	// Setup the core
 	c := &Core{
@@ -1033,9 +1062,11 @@ func CreateCore(conf *CoreConfig) (*Core, error) {
 		customListenerHeader: new(atomic.Value),
 		seal:                 conf.Seal,
 		stateLock:            stateLock,
+		mountsLock:           mountsLock,
+		authLock:             authLock,
 		router:               NewRouter(),
 		sealed:               new(uint32),
-		sealMigrationDone:    new(uint32),
+		sealMigrationDone:    atomic.Pointer[time.Time]{},
 		standby:              true,
 		standbyStopCh:        new(atomic.Value),
 		baseLogger:           conf.Logger,
@@ -1044,6 +1075,7 @@ func CreateCore(conf *CoreConfig) (*Core, error) {
 
 		defaultLeaseTTL:                conf.DefaultLeaseTTL,
 		maxLeaseTTL:                    conf.MaxLeaseTTL,
+		removeIrrevocableLeaseAfter:    conf.RemoveIrrevocableLeaseAfter,
 		sentinelTraceDisabled:          conf.DisableSentinelTrace,
 		cachingDisabled:                conf.DisableCache,
 		clusterName:                    conf.ClusterName,
@@ -1080,6 +1112,7 @@ func CreateCore(conf *CoreConfig) (*Core, error) {
 		numExpirationWorkers:           conf.NumExpirationWorkers,
 		raftFollowerStates:             raft.NewFollowerStates(),
 		disableAutopilot:               conf.DisableAutopilot,
+		allowAuditLogPrefixing:         conf.AllowAuditLogPrefixing,
 		enableResponseHeaderHostname:   conf.EnableResponseHeaderHostname,
 		enableResponseHeaderRaftNodeID: conf.EnableResponseHeaderRaftNodeID,
 		mountMigrationTracker:          &sync.Map{},
@@ -1097,6 +1130,8 @@ func CreateCore(conf *CoreConfig) (*Core, error) {
 		echoDuration:                   uberAtomic.NewDuration(0),
 		activeNodeClockSkewMillis:      uberAtomic.NewInt64(0),
 		periodicLeaderRefreshInterval:  conf.PeriodicLeaderRefreshInterval,
+		rpcLastSuccessfulHeartbeat:     new(atomic.Value),
+		reportingScanDirectory:         conf.ReportingScanDirectory,
 	}
 
 	c.standbyStopCh.Store(make(chan struct{}))
@@ -1210,7 +1245,11 @@ func NewCore(conf *CoreConfig) (*Core, error) {
 	}
 
 	// Construct a new AES-GCM barrier
-	c.barrier, err = NewAESGCMBarrier(c.physical)
+	detectDeadlocks := slices.Contains(c.detectDeadlocks, "barrier")
+	if detectDeadlocks {
+		c.Logger().Debug("enabling deadlock detection for the barrier")
+	}
+	c.barrier, err = NewAESGCMBarrier(c.physical, detectDeadlocks)
 	if err != nil {
 		return nil, fmt.Errorf("barrier setup failed: %w", err)
 	}
@@ -1238,7 +1277,7 @@ func NewCore(conf *CoreConfig) (*Core, error) {
 	if c.recoveryMode {
 		checkResult, err := c.checkForSealMigration(context.Background(), conf.UnwrapSeal)
 		if err != nil {
-			return nil, fmt.Errorf("error checking if a seal migration is needed")
+			return nil, fmt.Errorf("error checking if a seal migration is needed: %w", err)
 		}
 		if conf.UnwrapSeal != nil || checkResult == sealMigrationCheckAdjust {
 			return nil, errors.New("cannot run in recovery mode when a seal migration is needed")
@@ -1253,7 +1292,7 @@ func NewCore(conf *CoreConfig) (*Core, error) {
 		}
 	}
 	if conf.PluginTmpdir != "" {
-		c.pluginTmpdir, err = filepath.Abs(conf.PluginTmpdir)
+		c.containerPluginTmpdir, err = filepath.Abs(conf.PluginTmpdir)
 		if err != nil {
 			return nil, fmt.Errorf("core setup failed, could not verify plugin tmpdir: %w", err)
 		}
@@ -1288,9 +1327,6 @@ func NewCore(conf *CoreConfig) (*Core, error) {
 	// Audit backends
 	c.configureAuditBackends(conf.AuditBackends)
 
-	// Event plugins
-	c.configureEventBackends(conf.EventBackends)
-
 	// UI
 	uiStoragePrefix := systemBarrierPrefix + "ui"
 	c.uiConfig = NewUIConfig(conf.EnableUI, physical.NewView(c.physical, uiStoragePrefix), NewBarrierView(c.barrier, uiStoragePrefix))
@@ -1309,20 +1345,12 @@ func NewCore(conf *CoreConfig) (*Core, error) {
 	quotasLogger := conf.Logger.Named("quotas")
 	c.allLoggers = append(c.allLoggers, quotasLogger)
 
-	detectDeadlocks := slices.Contains(c.detectDeadlocks, "quotas")
-	c.quotaManager, err = quotas.NewManager(quotasLogger, c.quotaLeaseWalker, c.metricSink, detectDeadlocks)
+	detectDeadlocksQuotas := slices.Contains(c.detectDeadlocks, "quotas")
+	c.quotaManager, err = quotas.NewManager(quotasLogger, c.quotaLeaseWalker, c.metricSink, detectDeadlocksQuotas)
 	if err != nil {
 		return nil, err
 	}
 
-	c.limiterRegistry = conf.LimiterRegistry
-	c.limiterRegistryLock.Lock()
-	c.limiterRegistry.Disable()
-	if !conf.DisableRequestLimiter {
-		c.limiterRegistry.Enable()
-	}
-	c.limiterRegistryLock.Unlock()
-
 	err = c.adjustForSealMigration(conf.UnwrapSeal)
 	if err != nil {
 		return nil, err
@@ -1334,6 +1362,19 @@ func NewCore(conf *CoreConfig) (*Core, error) {
 		c.versionHistory = make(map[string]VaultVersion)
 	}
 
+	// Setup the Census Manager
+	cmConfig, err := c.parseCensusManagerConfig(conf)
+	if err != nil {
+		return nil, err
+	}
+
+	cmLogger := conf.Logger.Named("reporting")
+	c.allLoggers = append(c.allLoggers, cmLogger)
+	c.censusManager, err = NewCensusManager(cmLogger, cmConfig, NewBarrierView(c.barrier, utilizationBasePath))
+	if err != nil {
+		return nil, err
+	}
+
 	// Events
 	eventsLogger := conf.Logger.Named("events")
 	c.allLoggers = append(c.allLoggers, eventsLogger)
@@ -1342,18 +1383,62 @@ func NewCore(conf *CoreConfig) (*Core, error) {
 	if err != nil {
 		return nil, err
 	}
-	events, err := eventbus.NewEventBus(nodeID, eventsLogger)
+	events, err := eventbus.NewEventBus(nodeID, eventsLogger, c)
 	if err != nil {
 		return nil, err
 	}
 	c.events = events
 	c.events.Start()
 
-	c.clusterAddrBridge = conf.ClusterAddrBridge
+	// Create the snapshot manager if we're on enterprise and running raft
+	// storage backend.
+	c.createSnapshotManager()
+
+	observationsLogger := conf.Logger.Named("observations")
+	observationSystemConfig := conf.ObservationSystemConfig
+	if observationSystemConfig != nil {
+		if observationSystemConfig.LedgerPath != "" {
+			config := &observations.NewObservationSystemConfig{
+				ObservationSystemConfig: observationSystemConfig,
+				LocalNodeId:             nodeID,
+				Logger:                  observationsLogger,
+			}
+			err = c.AddObservationSystemToCore(config)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
 
+	c.clusterAddrBridge = conf.ClusterAddrBridge
+	c.licenseReloadCh = conf.LicenseReload
 	return c, nil
 }
 
+func (c *Core) AddObservationSystemToCore(config *observations.NewObservationSystemConfig) error {
+	observations, err := observations.NewObservationSystem(config)
+	if err != nil {
+		return err
+	}
+	c.observations = observations
+
+	c.reloadFuncsLock.Lock()
+
+	// While it's only possible to configure one observation system now, making the key
+	// include the path future-proofs us going forward.
+	key := "observations|" + config.LedgerPath
+	c.reloadFuncs[key] = append(c.reloadFuncs[key], func() error {
+		config.Logger.Info("reloading observation system", "path", config.LedgerPath)
+		return observations.Reload()
+	})
+
+	c.reloadFuncsLock.Unlock()
+
+	c.observations.Start()
+
+	return nil
+}
+
 // configureListeners configures the Core with the listeners from the CoreConfig.
 func (c *Core) configureListeners(conf *CoreConfig) error {
 	c.clusterListener.Store((*cluster.Listener)(nil))
@@ -1440,11 +1525,14 @@ func (c *Core) configureLogicalBackends(backends map[string]logical.Factory, log
 	// System
 	logicalBackends[mountTypeSystem] = func(ctx context.Context, config *logical.BackendConfig) (logical.Backend, error) {
 		sysBackendLogger := logger.Named("system")
+
 		c.AddLogger(sysBackendLogger)
 		b := NewSystemBackend(c, sysBackendLogger, config)
+
 		if err := b.Setup(ctx, config); err != nil {
 			return nil, err
 		}
+
 		return b, nil
 	}
 
@@ -1452,25 +1540,23 @@ func (c *Core) configureLogicalBackends(backends map[string]logical.Factory, log
 	logicalBackends[mountTypeIdentity] = func(ctx context.Context, config *logical.BackendConfig) (logical.Backend, error) {
 		identityLogger := logger.Named("identity")
 		c.AddLogger(identityLogger)
-		return NewIdentityStore(ctx, c, config, identityLogger)
-	}
 
-	c.logicalBackends = logicalBackends
+		idStore, err := NewIdentityStore(ctx, c, config, identityLogger)
+		if err != nil {
+			return nil, fmt.Errorf("error creating identity store: %w", err)
+		}
 
-	c.addExtraLogicalBackends(adminNamespacePath)
-}
+		// Wire up the idStoreBackend to support the activation flag
+		if c.systemBackend != nil {
+			c.systemBackend.idStoreBackend = idStore.Backend
+		}
 
-// configureEventBackends configures the Core with the ability to create
-// event backends for various types.
-func (c *Core) configureEventBackends(backends map[string]event.Factory) {
-	eventBackends := make(map[string]event.Factory, len(backends))
-	for k, f := range backends {
-		eventBackends[k] = f
+		return idStore, nil
 	}
 
-	c.eventBackends = eventBackends
+	c.logicalBackends = logicalBackends
 
-	c.addExtraEventBackends()
+	c.addExtraLogicalBackends(adminNamespacePath)
 }
 
 // handleVersionTimeStamps stores the current version at the current time to
@@ -1881,7 +1967,8 @@ func (c *Core) getUnsealKey(ctx context.Context, seal Seal) ([]byte, error) {
 // if the preceding conditions are true but we cannot decrypt the master key
 // in storage using the configured seal.
 func (c *Core) sealMigrated(ctx context.Context) (bool, error) {
-	if atomic.LoadUint32(c.sealMigrationDone) == 1 {
+	sealMigDone := c.sealMigrationDone.Load()
+	if sealMigDone != nil && !sealMigDone.IsZero() {
 		return true, nil
 	}
 
@@ -2023,7 +2110,7 @@ func (c *Core) migrateSeal(ctx context.Context) error {
 	}
 
 	// Flag migration performed for seal-rewrap later
-	atomic.StoreUint32(c.sealMigrationDone, 1)
+	c.SetSealMigrationDone()
 
 	c.logger.Info("seal migration complete")
 	return nil
@@ -2360,7 +2447,7 @@ func (c *Core) sealInternalWithOptions(grabStateLock, keepHALock, performCleanup
 
 		if err := c.preSeal(); err != nil {
 			c.logger.Error("pre-seal teardown failed", "error", err)
-			return fmt.Errorf("internal error")
+			return fmt.Errorf("internal error: %w", err)
 		}
 	} else {
 		// If we are keeping the lock we already have the state write lock
@@ -2469,33 +2556,51 @@ func (s standardUnsealStrategy) unseal(ctx context.Context, logger log.Logger, c
 	}
 
 	// Run setup-like functions
-	if err := runUnsealSetupFunctions(ctx, buildUnsealSetupFunctionSlice(c)); err != nil {
+	if err := runUnsealSetupFunctions(ctx, buildUnsealSetupFunctionSlice(c, true)); err != nil {
 		return err
 	}
 
-	if !c.IsDRSecondary() {
-		if !c.perfStandby {
-			if err := c.setupCensusManager(); err != nil {
-				logger.Error("failed to instantiate the license reporting agent", "error", err)
-			}
+	if c.isPrimary() {
+		// Reload the development cluster setting from config in case the cluster is newly promoted and the setting
+		// in Census Manager is a holdover from the old primary.
+		if err := c.reloadDevelopmentClusterSetting(); err != nil {
+			return err
+		}
+		// Store the primary's development cluster setting to propagate it to any secondaries
+		if err := c.persistDevelopmentClusterSetting(ctx); err != nil {
+			return err
 		}
+	} else {
+		// If we can find a stored development cluster setting, and it is different from what was set in our config,
+		// then we need to log an error warning that the value is changing and update the census manager with the new setting.
+		developmentCluster, err := c.getDevelopmentClusterSetting(ctx)
+		if err == nil && developmentCluster != c.DevelopmentCluster() {
+			c.logger.Error("development cluster setting in config does not match that of the primary, updating to follow the primary config setting")
+			c.SetDevelopmentCluster(developmentCluster)
+		} else if err != nil {
+			return err
+		}
+	}
 
+	if !c.IsDRSecondary() {
 		// not waiting on wg to avoid changing existing behavior
 		var wg sync.WaitGroup
-		if err := c.setupActivityLog(ctx, &wg); err != nil {
+		if err := c.setupActivityLog(ctx, &wg, false); err != nil {
 			return err
 		}
 
-		if !c.perfStandby {
-			c.StartManualCensusSnapshots()
+		if err := c.setupCensusManager(ctx); err != nil {
+			return err
 		}
-
 	} else {
-		broker, err := NewAuditBroker(logger)
+		brokerLogger := logger.Named("audit")
+		broker, err := audit.NewBroker(brokerLogger)
 		if err != nil {
 			return err
 		}
+		c.auditLock.Lock()
 		c.auditBroker = broker
+		c.auditLock.Unlock()
 	}
 
 	if c.isPrimary() {
@@ -2504,6 +2609,12 @@ func (s standardUnsealStrategy) unseal(ctx context.Context, logger log.Logger, c
 		}
 	}
 
+	if c.IsMultisealEnabled() {
+		if err := c.handleMultisealRewrapping(ctx, logger); err != nil {
+			return err
+		}
+	}
+
 	if c.getClusterListener() != nil && (c.ha != nil || shouldStartClusterListener(c)) {
 		if err := c.setupRaftActiveNode(ctx); err != nil {
 			return err
@@ -2512,7 +2623,6 @@ func (s standardUnsealStrategy) unseal(ctx context.Context, logger log.Logger, c
 		if err := c.startForwarding(ctx); err != nil {
 			return err
 		}
-
 	}
 
 	c.clusterParamsLock.Lock()
@@ -2555,7 +2665,7 @@ func (c *Core) setupPluginCatalog(ctx context.Context) error {
 		BuiltinRegistry:      c.builtinRegistry,
 		CatalogView:          NewBarrierView(c.barrier, pluginCatalogPath),
 		PluginDirectory:      c.pluginDirectory,
-		Tmpdir:               c.pluginTmpdir,
+		Tmpdir:               c.containerPluginTmpdir,
 		EnableMlock:          c.enableMlock,
 		PluginRuntimeCatalog: c.pluginRuntimeCatalog,
 	})
@@ -2571,7 +2681,7 @@ func (c *Core) setupPluginCatalog(ctx context.Context) error {
 // buildUnsealSetupFunctionSlice returns a slice of functions, tailored for this
 // Core's replication state, that can be passed to the runUnsealSetupFunctions
 // function.
-func buildUnsealSetupFunctionSlice(c *Core) []func(context.Context) error {
+func buildUnsealSetupFunctionSlice(c *Core, isActive bool) []func(context.Context) error {
 	// setupFunctions is a slice of functions that need to be called in order,
 	// that if any return an error, processing should immediately cease.
 	setupFunctions := []func(context.Context) error{
@@ -2599,6 +2709,9 @@ func buildUnsealSetupFunctionSlice(c *Core) []func(context.Context) error {
 		func(ctx context.Context) error {
 			return c.setupHeaderHMACKey(ctx, false)
 		},
+		func(ctx context.Context) error {
+			return c.EntSetupUIDefaultAuth(ctx)
+		},
 	}
 
 	// If this server is not part of a Disaster Recovery secondary cluster,
@@ -2621,10 +2734,18 @@ func buildUnsealSetupFunctionSlice(c *Core) []func(context.Context) error {
 		setupFunctions = append(setupFunctions, func(_ context.Context) error {
 			return c.setupExpiration(expireLeaseStrategyFairsharing)
 		})
+		setupFunctions = append(setupFunctions, func(_ context.Context) error {
+			return c.startRotation()
+		})
 		setupFunctions = append(setupFunctions, c.loadAudits)
 		setupFunctions = append(setupFunctions, c.setupAuditedHeadersConfig)
 		setupFunctions = append(setupFunctions, c.setupAudits)
-		setupFunctions = append(setupFunctions, c.loadIdentityStoreArtifacts)
+		setupFunctions = append(setupFunctions, func(ctx context.Context) error {
+			if c.identityStore == nil {
+				return nil
+			}
+			return c.identityStore.loadArtifacts(ctx, isActive)
+		})
 		setupFunctions = append(setupFunctions, func(ctx context.Context) error {
 			return loadPolicyMFAConfigs(ctx, c)
 		})
@@ -2633,6 +2754,10 @@ func buildUnsealSetupFunctionSlice(c *Core) []func(context.Context) error {
 			return nil
 		})
 		setupFunctions = append(setupFunctions, c.loadLoginMFAConfigs)
+
+		setupFunctions = append(setupFunctions, func(ctx context.Context) error {
+			return c.EntSetupUIDefaultAuth(ctx)
+		})
 	}
 
 	return setupFunctions
@@ -2655,10 +2780,10 @@ func runUnsealSetupFunctions(ctx context.Context, setupFunctions []func(context.
 // runUnsealSetupForPrimary runs some setup code specific to clusters that are
 // in the primary role (as defined by the (*Core).isPrimary method).
 func (c *Core) runUnsealSetupForPrimary(ctx context.Context, logger log.Logger) error {
-	if err := c.setupPluginReload(); err != nil {
-		return err
-	}
+	return c.setupPluginReload()
+}
 
+func (c *Core) handleMultisealRewrapping(ctx context.Context, logger log.Logger) error {
 	// Retrieve the seal generation information from storage
 	existingGenerationInfo, err := PhysicalSealGenInfo(ctx, c.physical)
 	if err != nil {
@@ -2667,38 +2792,53 @@ func (c *Core) runUnsealSetupForPrimary(ctx context.Context, logger log.Logger)
 	}
 
 	sealGenerationInfo := c.seal.GetAccess().GetSealGenerationInfo()
-
+	shouldRewrap := !sealGenerationInfo.IsRewrapped()
+	var reason string
 	switch {
 	case existingGenerationInfo == nil:
-		// This is the first time we store seal generation information
+		reason = "First time storing seal generation information"
 		fallthrough
 	case existingGenerationInfo.Generation < sealGenerationInfo.Generation:
-		// We have incremented the seal generation
+		if reason == "" {
+			reason = fmt.Sprintf("Seal generation incremented from %d to %d",
+				existingGenerationInfo.Generation, sealGenerationInfo.Generation)
+		}
+		fallthrough
+	case !existingGenerationInfo.Enabled:
+		if reason == "" {
+			reason = fmt.Sprintf("Seal just become enabled again after previously being disabled")
+		}
 		if err := c.SetPhysicalSealGenInfo(ctx, sealGenerationInfo); err != nil {
 			logger.Error("failed to store seal generation info", "error", err)
 			return err
 		}
-
+		shouldRewrap = true
 	case existingGenerationInfo.Generation == sealGenerationInfo.Generation:
 		// Same generation, update the rewrapped flag in case the previous active node
 		// changed its value. In other words, a rewrap may have happened, or a rewrap may have been
 		// started but not completed.
 		c.seal.GetAccess().GetSealGenerationInfo().SetRewrapped(existingGenerationInfo.IsRewrapped())
-
+		if !existingGenerationInfo.Enabled {
+			// Weren't enabled but are now, persist the flag
+			if err := c.SetPhysicalSealGenInfo(ctx, sealGenerationInfo); err != nil {
+				logger.Error("failed to store seal generation info", "error", err)
+				return err
+			}
+		}
+		reason = "A rewrap may have happened, or a rewrap may have been started but not completed"
+		shouldRewrap = !existingGenerationInfo.IsRewrapped()
 	case existingGenerationInfo.Generation > sealGenerationInfo.Generation:
 		// Our seal information is out of date. The previous active node used a newer generation.
 		logger.Error("A newer seal generation was found in storage. The seal configuration in this node should be updated to match that of the previous active node, and this node should be restarted.")
 		return errors.New("newer seal generation found in storage, in memory seal configuration is out of date")
 	}
-
-	if server.IsMultisealSupported() && !sealGenerationInfo.IsRewrapped() {
+	if shouldRewrap {
 		// Set the migration done flag so that a seal-rewrap gets triggered later.
 		// Note that in the case where multi seal is not supported, Core.migrateSeal() takes care of
 		// triggering the rewrap when necessary.
-		logger.Trace("seal generation information indicates that a seal-rewrap is needed", "generation", sealGenerationInfo.Generation)
-		atomic.StoreUint32(c.sealMigrationDone, 1)
+		logger.Info("seal generation information indicates that a seal-rewrap is needed", "generation", sealGenerationInfo.Generation, "reason", reason)
+		c.SetSealMigrationDone()
 	}
-
 	startPartialSealRewrapping(c)
 
 	return nil
@@ -2710,6 +2850,10 @@ func (c *Core) runUnsealSetupForPrimary(ctx context.Context, logger log.Logger)
 // requires the Vault to be unsealed such as mount tables, logical backends,
 // credential stores, etc.
 func (c *Core) postUnseal(ctx context.Context, ctxCancelFunc context.CancelFunc, unsealer UnsealStrategy) (retErr error) {
+	if stopTrace := c.tracePostUnsealIfEnabled(); stopTrace != nil {
+		defer stopTrace()
+	}
+
 	defer metrics.MeasureSince([]string{"core", "post_unseal"}, time.Now())
 
 	// Clear any out
@@ -2762,7 +2906,7 @@ func (c *Core) postUnseal(ctx context.Context, ctxCancelFunc context.CancelFunc,
 
 		// Start a periodic but infrequent heartbeat to detect auto-seal backend outages at runtime rather than being
 		// surprised by this at the next need to unseal.
-		seal.StartHealthCheck()
+		seal.StartHealthCheck(ctx)
 	}
 
 	// This is intentionally the last block in this function. We want to allow
@@ -2803,10 +2947,8 @@ func (c *Core) postUnseal(ctx context.Context, ctxCancelFunc context.CancelFunc,
 		close(jobs)
 	}
 
-	if atomic.LoadUint32(c.sealMigrationDone) == 1 {
-		if err := c.postSealMigration(ctx); err != nil {
-			c.logger.Warn("post-unseal post seal migration failed", "error", err)
-		}
+	if err := c.postSealMigration(ctx); err != nil {
+		c.logger.Warn("post-unseal post seal migration failed", "error", err)
 	}
 
 	if os.Getenv(EnvVaultDisableLocalAuthMountEntities) != "" {
@@ -2825,6 +2967,41 @@ func (c *Core) postUnseal(ctx context.Context, ctxCancelFunc context.CancelFunc,
 	return nil
 }
 
+// tracePostUnsealIfEnabled checks if post-unseal tracing is enabled in the server
+// config and starts a go trace if it is, returning a stop function to be called once
+// the post-unseal process is complete.
+func (c *Core) tracePostUnsealIfEnabled() (stop func()) {
+	// use rawConfig to allow config hot-reload of EnablePostUnsealTrace via SIGHUP
+	conf := c.rawConfig.Load()
+	if conf == nil {
+		c.logger.Warn("failed to get raw config to check enable_post_unseal_trace")
+		return nil
+	}
+
+	if !conf.(*server.Config).EnablePostUnsealTrace {
+		return nil
+	}
+
+	dir := conf.(*server.Config).PostUnsealTraceDir
+
+	traceFile, stopTrace, err := trace.StartDebugTrace(dir, "post-unseal")
+	if err != nil {
+		c.logger.Warn("failed to start post-unseal trace", "error", err)
+		return nil
+	}
+
+	c.logger.Info("post-unseal trace started", "file", traceFile)
+
+	return func() {
+		err := stopTrace()
+		if err != nil {
+			c.logger.Warn("failure when stopping post-unseal trace", "error", err)
+			return
+		}
+		c.logger.Info("post-unseal trace completed", "file", traceFile)
+	}
+}
+
 // preSeal is invoked before the barrier is sealed, allowing
 // for any state teardown required.
 func (c *Core) preSeal() error {
@@ -2845,6 +3022,7 @@ func (c *Core) preSeal() error {
 		close(c.metricsCh)
 		c.metricsCh = nil
 	}
+
 	var result error
 
 	c.stopForwarding()
@@ -2860,15 +3038,20 @@ func (c *Core) preSeal() error {
 	if err := c.teardownAudits(); err != nil {
 		result = multierror.Append(result, fmt.Errorf("error tearing down audits: %w", err))
 	}
-	if err := c.stopExpiration(); err != nil {
-		result = multierror.Append(result, fmt.Errorf("error stopping expiration: %w", err))
-	}
+	// Ensure that the ActivityLog and CensusManager are both completely torn
+	// down before stopping the ExpirationManager. This ordering is critical,
+	// due to a tight coupling between the ActivityLog, CensusManager, and
+	// ExpirationManager for product usage reporting.
 	c.stopActivityLog()
-	// Clean up census on seal
 	if err := c.teardownCensusManager(); err != nil {
 		result = multierror.Append(result, fmt.Errorf("error tearing down reporting agent: %w", err))
 	}
-
+	if err := c.stopExpiration(); err != nil {
+		result = multierror.Append(result, fmt.Errorf("error stopping expiration: %w", err))
+	}
+	if err := c.stopRotation(); err != nil {
+		result = multierror.Append(result, fmt.Errorf("error stopping rotation: %w", err))
+	}
 	if err := c.teardownCredentials(context.Background()); err != nil {
 		result = multierror.Append(result, fmt.Errorf("error tearing down credentials: %w", err))
 	}
@@ -2940,7 +3123,7 @@ func (c *Core) BarrierKeyLength() (min, max int) {
 	return
 }
 
-func (c *Core) AuditedHeadersConfig() *AuditedHeadersConfig {
+func (c *Core) AuditedHeadersConfig() *audit.HeadersConfig {
 	return c.auditedHeaders
 }
 
@@ -3031,6 +3214,8 @@ func setPhysicalSealConfig(ctx context.Context, c *Core, label, configPath strin
 	return nil
 }
 
+//go:generate enumer -type=sealMigrationCheckResult -trimprefix=sealMigrationCheck -transform=snake
+
 type sealMigrationCheckResult int
 
 const (
@@ -3075,7 +3260,7 @@ func (c *Core) checkForSealMigration(ctx context.Context, unwrapSeal Seal) (seal
 			// This is a migration away from Shamir.
 
 			return sealMigrationCheckAdjust, nil
-		case configuredType == SealConfigTypeMultiseal && server.IsMultisealSupported():
+		case configuredType == SealConfigTypeMultiseal && c.IsMultisealEnabled():
 			// We are going from a single non-shamir seal to multiseal, and multi seal is supported.
 			// This scenario is not considered a migration in the sense of requiring an unwrapSeal,
 			// but we will update the stored SealConfig later (see Core.migrateMultiSealConfig).
@@ -3413,6 +3598,20 @@ func (c *Core) IsSealMigrated(lock bool) bool {
 	return done
 }
 
+func (c *Core) SetSealReloadFunc(f func(context.Context) error) {
+	c.sealReloadFunc = f
+}
+
+// TriggerSealReload triggers reloading of the seal configuration and resetting of the seal.
+// The caller should hold the write statelock.
+func (c *Core) TriggerSealReload(ctx context.Context) error {
+	if c.sealReloadFunc == nil {
+		return nil
+	}
+
+	return c.sealReloadFunc(ctx)
+}
+
 func (c *Core) BarrierEncryptorAccess() *BarrierEncryptorAccess {
 	return NewBarrierEncryptorAccess(c.barrier)
 }
@@ -3556,6 +3755,15 @@ func (c *Core) LogFormat() string {
 	return conf.(*server.Config).LogFormat
 }
 
+// administrativeNamespacePath returns the configured administrative namespace path.
+func (c *Core) administrativeNamespacePath() string {
+	conf := c.rawConfig.Load()
+	if conf == nil {
+		return ""
+	}
+	return conf.(*server.Config).AdministrativeNamespacePath
+}
+
 // LogLevel returns the log level provided by level provided by config, CLI flag, or env
 func (c *Core) LogLevel() string {
 	return c.logLevel
@@ -3801,14 +4009,45 @@ func (c *Core) loadLoginMFAConfigs(ctx context.Context) error {
 	return nil
 }
 
+// MFACachedAuthResponse represents an authentication response that has been
+// temporarily cached during a two-phase MFA (Multi-Factor Authentication) login flow.
+//
+// This struct is used when an MFA enforcement is configured and a login request
+// lacks MFA credentials. Instead of completing the authentication immediately,
+// Vault caches the auth response and returns an MFARequirement to the client.
+// The client must then complete MFA validation using the mfa/validate endpoint
+// to retrieve the cached authentication and receive their token.
+//
+// The cached response includes the original authentication details along with
+// request metadata needed for MFA validation, such as the client's IP address
+// for methods like Duo that require connection information.
+//
+// This struct is also used to cache self-enrollment TOTP MFA secrets generated
+// during login when self-enrollment is enabled. This allows Vault to avoid
+// persisting the newly generated MFA secret until it has been successfully used
+// for validating an MFA-enforced login request.
 type MFACachedAuthResponse struct {
-	CachedAuth            *logical.Auth
-	RequestPath           string
-	RequestNSID           string
-	RequestNSPath         string
-	RequestConnRemoteAddr string
-	TimeOfStorage         time.Time
-	RequestID             string
+	CachedAuth              *logical.Auth
+	RequestPath             string
+	RequestNSID             string
+	RequestNSPath           string
+	RequestConnRemoteAddr   string
+	TimeOfStorage           time.Time
+	RequestID               string
+	SelfEnrollmentMFASecret *selfEnrollmentPendingMFASecret
+}
+
+// selfEnrollmentPendingMFASecret holds information about a TOTP Login MFA secret
+// that has been generated during a login request with self-enrollment enabled.
+// This secret is temporarily stored in memory until the user successfully
+// completes the MFA validation step. It is not persisted to avoid storing
+// unverified secrets.
+type selfEnrollmentPendingMFASecret struct {
+	// Fields here need to be exported because copystructure is used to copy this object.
+	MethodID string
+	Secret   *mfa.Secret
+	// Store the secret key string separately to avoid anyone accidentally persisting it on an Entity.
+	Key string
 }
 
 func (c *Core) setupCachedMFAResponseAuth() {
@@ -4033,13 +4272,18 @@ func (c *Core) StoreInFlightReqData(reqID string, data InFlightReqData) {
 	c.inFlightReqData.InFlightReqCount.Inc()
 }
 
-// FinalizeInFlightReqData is going log the completed request if the
-// corresponding server config option is enabled. It also removes the
-// request from the inFlightReqMap and decrement the number of in-flight
-// requests by one.
+// FinalizeInFlightReqData logs the completed request if the logRequestsLevel is configured
+// to a value other than `Off`. It then removes the request from the in-flight map
+// and decrements the counter.
 func (c *Core) FinalizeInFlightReqData(reqID string, statusCode int) {
-	if c.logRequestsLevel != nil && c.logRequestsLevel.Load() != 0 {
-		c.LogCompletedRequests(reqID, statusCode)
+	// Only log the request if a log level is set and it's not explicitly `Off`.
+	if c.logRequestsLevel != nil {
+		logLevel := c.logRequestsLevel.Load()
+
+		// Check for valid logging levels, excluding "Off"
+		if logLevel != int32(log.Off) && logLevel > int32(log.NoLevel) {
+			c.LogCompletedRequests(reqID, statusCode)
+		}
 	}
 
 	c.inFlightReqData.InFlightReqMap.Delete(reqID)
@@ -4094,6 +4338,10 @@ func (c *Core) LogCompletedRequests(reqID string, statusCode int) {
 		"request_method", reqData.Method)
 }
 
+// ReloadLogRequestsLevel reloads the request logging level. Note that unlike the
+// initial configuration, an empty or missing log level is explicitly treated as
+// `Off` during a reload. This is a defensive measure to ensure that request
+// logging is reliably disabled if the configuration is removed.
 func (c *Core) ReloadLogRequestsLevel() {
 	conf := c.rawConfig.Load()
 	if conf == nil {
@@ -4101,33 +4349,20 @@ func (c *Core) ReloadLogRequestsLevel() {
 	}
 
 	infoLevel := conf.(*server.Config).LogRequestsLevel
-	switch {
-	case log.LevelFromString(infoLevel) > log.NoLevel && log.LevelFromString(infoLevel) < log.Off:
-		c.logRequestsLevel.Store(int32(log.LevelFromString(infoLevel)))
-	case infoLevel != "":
-		c.logger.Warn("invalid log_requests_level", "level", infoLevel)
-	}
-}
+	configLogLevel := log.LevelFromString(infoLevel)
 
-func (c *Core) ReloadRequestLimiter() {
-	c.limiterRegistry.Logger.Info("reloading request limiter config")
-	conf := c.rawConfig.Load()
-	if conf == nil {
+	// Accept "off" or empty string as valid disables
+	if configLogLevel == log.Off || infoLevel == "" {
+		c.logRequestsLevel.Store(int32(log.Off))
 		return
 	}
-
-	disable := true
-	requestLimiterConfig := conf.(*server.Config).RequestLimiter
-	if requestLimiterConfig != nil {
-		disable = requestLimiterConfig.Disable
-	}
-
-	switch disable {
-	case true:
-		c.limiterRegistry.Disable()
-	default:
-		c.limiterRegistry.Enable()
+	// Accept valid levels only
+	if configLogLevel > log.NoLevel && configLogLevel < log.Off {
+		c.logRequestsLevel.Store(int32(configLogLevel))
+		return
 	}
+	// Warn on invalid values
+	c.logger.Warn("invalid log_requests_level", "level", infoLevel)
 }
 
 func (c *Core) ReloadIntrospectionEndpointEnabled() {
@@ -4141,15 +4376,16 @@ func (c *Core) ReloadIntrospectionEndpointEnabled() {
 }
 
 type PeerNode struct {
-	Hostname        string        `json:"hostname"`
-	APIAddress      string        `json:"api_address"`
-	ClusterAddress  string        `json:"cluster_address"`
-	Version         string        `json:"version"`
-	LastEcho        time.Time     `json:"last_echo"`
-	UpgradeVersion  string        `json:"upgrade_version,omitempty"`
-	RedundancyZone  string        `json:"redundancy_zone,omitempty"`
-	EchoDuration    time.Duration `json:"echo_duration"`
-	ClockSkewMillis int64         `json:"clock_skew_millis"`
+	Hostname                    string        `json:"hostname"`
+	APIAddress                  string        `json:"api_address"`
+	ClusterAddress              string        `json:"cluster_address"`
+	Version                     string        `json:"version"`
+	LastEcho                    time.Time     `json:"last_echo"`
+	UpgradeVersion              string        `json:"upgrade_version,omitempty"`
+	RedundancyZone              string        `json:"redundancy_zone,omitempty"`
+	EchoDuration                time.Duration `json:"echo_duration"`
+	ClockSkewMillis             int64         `json:"clock_skew_millis"`
+	ReplicationPrimaryCanaryAge int64         `json:"replication_primary_canary_age_ms"`
 }
 
 // GetHAPeerNodesCached returns the nodes that've sent us Echo requests recently.
@@ -4166,15 +4402,16 @@ func (c *Core) GetHAPeerNodesCached() []PeerNode {
 			apiAddr = info.nodeInfo.ApiAddr
 		}
 		nodes = append(nodes, PeerNode{
-			Hostname:        hostname,
-			APIAddress:      apiAddr,
-			ClusterAddress:  itemClusterAddr,
-			LastEcho:        info.lastHeartbeat,
-			Version:         info.version,
-			UpgradeVersion:  info.upgradeVersion,
-			RedundancyZone:  info.redundancyZone,
-			EchoDuration:    info.echoDuration,
-			ClockSkewMillis: info.clockSkewMillis,
+			Hostname:                    hostname,
+			APIAddress:                  apiAddr,
+			ClusterAddress:              itemClusterAddr,
+			LastEcho:                    info.lastHeartbeat,
+			Version:                     info.version,
+			UpgradeVersion:              info.upgradeVersion,
+			RedundancyZone:              info.redundancyZone,
+			EchoDuration:                info.echoDuration,
+			ClockSkewMillis:             info.clockSkewMillis,
+			ReplicationPrimaryCanaryAge: info.replicationLagMillis,
 		})
 	}
 	return nodes
@@ -4218,48 +4455,53 @@ func (c *Core) LoadNodeID() (string, error) {
 
 // DetermineRoleFromLoginRequest will determine the role that should be applied to a quota for a given
 // login request
-func (c *Core) DetermineRoleFromLoginRequest(ctx context.Context, mountPoint string, data map[string]interface{}) string {
+func (c *Core) DetermineRoleFromLoginRequest(ctx context.Context, mountPoint string, data map[string]interface{}, conn *logical.Connection, headers map[string][]string) string {
 	c.authLock.RLock()
 	defer c.authLock.RUnlock()
-	matchingBackend := c.router.MatchingBackend(ctx, mountPoint)
-	if matchingBackend == nil || matchingBackend.Type() != logical.TypeCredential {
-		// Role based quotas do not apply to this request
-		return ""
-	}
-	return c.doResolveRoleLocked(ctx, mountPoint, matchingBackend, data)
+	return c.doResolveRoleLocked(ctx, mountPoint, data, conn, headers)
 }
 
 // DetermineRoleFromLoginRequestFromReader will determine the role that should
 // be applied to a quota for a given login request. The reader will only be
 // consumed if the matching backend for the mount point exists and is a secret
 // backend
-func (c *Core) DetermineRoleFromLoginRequestFromReader(ctx context.Context, mountPoint string, reader io.Reader) string {
+func (c *Core) DetermineRoleFromLoginRequestFromReader(ctx context.Context, mountPoint string, reader io.Reader, conn *logical.Connection, header http.Header) string {
 	c.authLock.RLock()
 	defer c.authLock.RUnlock()
-	matchingBackend := c.router.MatchingBackend(ctx, mountPoint)
-	if matchingBackend == nil || matchingBackend.Type() != logical.TypeCredential {
-		// Role based quotas do not apply to this request
-		return ""
-	}
-
 	data := make(map[string]interface{})
 	err := jsonutil.DecodeJSONFromReader(reader, &data)
 	if err != nil {
 		return ""
 	}
-	return c.doResolveRoleLocked(ctx, mountPoint, matchingBackend, data)
+	return c.doResolveRoleLocked(ctx, mountPoint, data, conn, header)
 }
 
-// doResolveRoleLocked does a login and resolve role request on the matching
-// backend. Callers should have a read lock on c.authLock
-func (c *Core) doResolveRoleLocked(ctx context.Context, mountPoint string, matchingBackend logical.Backend, data map[string]interface{}) string {
-	resp, err := matchingBackend.HandleRequest(ctx, &logical.Request{
+// doResolveRoleLocked does a resolve role request on the matching backend.
+// Callers should have a read lock on c.authLock.
+func (c *Core) doResolveRoleLocked(ctx context.Context, mountPoint string, data map[string]interface{}, conn *logical.Connection, headers http.Header) string {
+	be, me := c.router.MatchingBackendAndMountEntry(ctx, mountPoint)
+	if be == nil || be.Type() != logical.TypeCredential {
+		// Role based quotas do not apply to this request
+		return ""
+	}
+
+	var passthroughRequestHeaders []string
+	if rawVal, ok := me.synthesizedConfigCache.Load("passthrough_request_headers"); ok {
+		passthroughRequestHeaders = rawVal.([]string)
+	}
+
+	req := &logical.Request{
 		MountPoint: mountPoint,
 		Path:       "login",
 		Operation:  logical.ResolveRoleOperation,
 		Data:       data,
 		Storage:    c.router.MatchingStorageByAPIPath(ctx, mountPoint+"login"),
-	})
+		Connection: conn,
+	}
+	if len(passthroughRequestHeaders) > 0 {
+		req.Headers = filteredHeaders(headers, passthroughRequestHeaders, deniedPassthroughRequestHeaders)
+	}
+	resp, err := be.HandleRequest(ctx, req)
 	if err != nil || resp.Data["role"] == nil {
 		return ""
 	}
@@ -4477,16 +4719,33 @@ func (c *Core) GetRaftAutopilotState(ctx context.Context) (*raft.AutopilotState,
 	return raftBackend.GetAutopilotServerState(ctx)
 }
 
-// Events returns a reference to the common event bus for sending and subscribint to events.
+// Events returns a reference to the common event bus for sending and subscribing to events.
 func (c *Core) Events() *eventbus.EventBus {
 	return c.events
 }
 
-func (c *Core) SetSeals(barrierSeal Seal, secureRandomReader io.Reader, shouldRewrap bool) error {
-	ctx, _ := c.GetContext()
+// Observations returns a reference to the observations system for recording observations.
+func (c *Core) Observations() *observations.ObservationSystem {
+	return c.observations
+}
 
-	c.stateLock.Lock()
-	defer c.stateLock.Unlock()
+func (c *Core) SetSeals(ctx context.Context, grabLock bool, barrierSeal Seal, secureRandomReader io.Reader, shouldRewrap bool) error {
+	return c.setSeals(ctx, grabLock, barrierSeal, secureRandomReader, shouldRewrap, true)
+}
+
+// SetSealsOnPerfStandby sets the seal state within the core object without attempting to persist it to disk,
+// normally SetSeals is what you should be calling.
+func (c *Core) SetSealsOnPerfStandby(ctx context.Context, grabLock bool, barrierSeal Seal, secureRandomReader io.Reader) error {
+	return c.setSeals(ctx, grabLock, barrierSeal, secureRandomReader, false, false)
+}
+
+func (c *Core) setSeals(ctx context.Context, grabLock bool, barrierSeal Seal, secureRandomReader io.Reader, shouldRewrap bool, performWrite bool) error {
+	if grabLock {
+		ctx, _ = c.GetContext()
+
+		c.stateLock.Lock()
+		defer c.stateLock.Unlock()
+	}
 
 	currentSealBarrierConfig, err := c.SealAccess().BarrierConfig(ctx)
 	if err != nil {
@@ -4508,21 +4767,21 @@ func (c *Core) SetSeals(barrierSeal Seal, secureRandomReader io.Reader, shouldRe
 	}
 
 	barrierConfigCopy.Type = barrierSeal.BarrierSealConfigType().String()
-	err = barrierSeal.SetBarrierConfig(ctx, barrierConfigCopy)
-	if err != nil {
-		return fmt.Errorf("error setting barrier config for new seal: %s", err)
-	}
+	if performWrite {
+		err = barrierSeal.SetBarrierConfig(ctx, barrierConfigCopy)
+		if err != nil {
+			return fmt.Errorf("error setting barrier config for new seal: %s", err)
+		}
 
-	err = barrierSeal.SetStoredKeys(ctx, rootKey)
-	if err != nil {
-		return fmt.Errorf("error setting root key in new seal: %s", err)
+		err = barrierSeal.SetStoredKeys(ctx, rootKey)
+		if err != nil {
+			return fmt.Errorf("error setting root key in new seal: %s", err)
+		}
 	}
 
 	c.seal = barrierSeal
 
-	c.reloadSealsEnt(secureRandomReader, barrierSeal, c.logger, shouldRewrap)
-
-	return nil
+	return c.reloadSealsEnt(secureRandomReader, barrierSeal, c.logger, shouldRewrap)
 }
 
 func (c *Core) GetWellKnownRedirect(ctx context.Context, path string) (string, error) {
@@ -4547,3 +4806,52 @@ func (c *Core) DetectStateLockDeadlocks() bool {
 	}
 	return false
 }
+
+// setupAuditedHeadersConfig will initialize new audited headers configuration on
+// the Core by loading data from the barrier view.
+func (c *Core) setupAuditedHeadersConfig(ctx context.Context) error {
+	// Create a sub-view, e.g. sys/audited-headers-config/
+	view := c.systemBarrierView.SubView(audit.AuditedHeadersSubPath)
+
+	headers, err := audit.NewHeadersConfig(view)
+	if err != nil {
+		return err
+	}
+
+	// Invalidate the headers now in order to load them for the first time.
+	err = headers.Invalidate(ctx)
+	if err != nil {
+		return err
+	}
+
+	// Update the Core.
+	c.auditedHeaders = headers
+
+	return nil
+}
+
+// IsRemovedFromCluster checks whether this node has been removed from the
+// cluster. This is only applicable to physical HA backends that satisfy the
+// RemovableNodeHABackend interface. The value of the `ok` result will be false
+// if the HA and underlyingPhysical backends are nil or do not support this operation.
+func (c *Core) IsRemovedFromCluster() (removed, ok bool) {
+	removableNodeHA := c.getRemovableHABackend()
+	if removableNodeHA == nil {
+		return false, false
+	}
+
+	return removableNodeHA.IsRemoved(), true
+}
+
+func (c *Core) shutdownRemovedNode() {
+	go func() {
+		c.ShutdownCoreError(errRemovedHANode)
+	}()
+}
+
+func (c *Core) SetSealMigrationDone() {
+	now := time.Now()
+	c.sealMigrationDone.Store(&now)
+}
+
+var errRemovedHANode = errors.New("node has been removed from the HA cluster")
diff --git a/vault/core_metrics.go b/vault/core_metrics.go
index c7be49c7364..2c8bbbfd365 100644
--- a/vault/core_metrics.go
+++ b/vault/core_metrics.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -6,6 +6,7 @@ package vault
 import (
 	"context"
 	"errors"
+	"fmt"
 	"os"
 	"strings"
 	"time"
@@ -13,12 +14,17 @@ import (
 	"github.com/armon/go-metrics"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/pluginconsts"
 	"github.com/hashicorp/vault/limits"
 	"github.com/hashicorp/vault/physical/raft"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
+const (
+	KVv2MetadataPath = "metadata"
+)
+
 func (c *Core) metricsLoop(stopCh chan struct{}) {
 	emitTimer := time.Tick(time.Second)
 
@@ -280,70 +286,88 @@ func (c *Core) emitMetricsActiveNode(stopCh chan struct{}) {
 	// because there's more than one TokenManager created during startup,
 	// but we only want one set of gauges.
 	metricsInit := []struct {
-		MetricName    []string
-		MetadataLabel []metrics.Label
-		CollectorFunc metricsutil.GaugeCollector
-		DisableEnvVar string
+		MetricName       []string
+		MetadataLabel    []metrics.Label
+		CollectorFunc    metricsutil.GaugeCollector
+		DisableEnvVar    string
+		IsEnterpriseOnly bool
 	}{
 		{
 			[]string{"token", "count"},
 			[]metrics.Label{{"gauge", "token_by_namespace"}},
 			c.tokenGaugeCollector,
 			"",
+			false,
 		},
 		{
 			[]string{"token", "count", "by_policy"},
 			[]metrics.Label{{"gauge", "token_by_policy"}},
 			c.tokenGaugePolicyCollector,
 			"",
+			false,
 		},
 		{
 			[]string{"expire", "leases", "by_expiration"},
 			[]metrics.Label{{"gauge", "leases_by_expiration"}},
 			c.leaseExpiryGaugeCollector,
 			"",
+			false,
 		},
 		{
 			[]string{"token", "count", "by_auth"},
 			[]metrics.Label{{"gauge", "token_by_auth"}},
 			c.tokenGaugeMethodCollector,
 			"",
+			false,
 		},
 		{
 			[]string{"token", "count", "by_ttl"},
 			[]metrics.Label{{"gauge", "token_by_ttl"}},
 			c.tokenGaugeTtlCollector,
 			"",
+			false,
 		},
 		{
 			[]string{"secret", "kv", "count"},
 			[]metrics.Label{{"gauge", "kv_secrets_by_mountpoint"}},
 			c.kvSecretGaugeCollector,
 			"VAULT_DISABLE_KV_GAUGE",
+			false,
 		},
 		{
 			[]string{"identity", "entity", "count"},
 			[]metrics.Label{{"gauge", "identity_by_namespace"}},
 			c.entityGaugeCollector,
 			"",
+			false,
 		},
 		{
 			[]string{"identity", "entity", "alias", "count"},
 			[]metrics.Label{{"gauge", "identity_by_mountpoint"}},
 			c.entityGaugeCollectorByMount,
 			"",
+			false,
 		},
 		{
 			[]string{"identity", "entity", "active", "partial_month"},
 			[]metrics.Label{{"gauge", "identity_active_month"}},
 			c.activeEntityGaugeCollector,
 			"",
+			false,
 		},
 		{
 			[]string{"policy", "configured", "count"},
 			[]metrics.Label{{"gauge", "number_policies_by_type"}},
 			c.configuredPoliciesGaugeCollector,
 			"",
+			false,
+		},
+		{
+			[]string{"client", "billing_period", "activity"},
+			[]metrics.Label{{"gauge", "clients_current_billing_period"}},
+			c.clientsGaugeCollectorCurrentBillingPeriod,
+			"",
+			true,
 		},
 	}
 
@@ -361,6 +385,11 @@ func (c *Core) emitMetricsActiveNode(stopCh chan struct{}) {
 				}
 			}
 
+			// Billing start date is always 0 on CE
+			if init.IsEnterpriseOnly && c.BillingStart().IsZero() {
+				continue
+			}
+
 			proc, err := c.MetricSink().NewGaugeCollectionProcess(
 				init.MetricName,
 				init.MetadataLabel,
@@ -381,10 +410,12 @@ func (c *Core) emitMetricsActiveNode(stopCh chan struct{}) {
 }
 
 type kvMount struct {
-	Namespace  *namespace.Namespace
-	MountPoint string
-	Version    string
-	NumSecrets int
+	Namespace     *namespace.Namespace
+	MountPoint    string
+	MountAccessor string
+	Version       string
+	Local         bool
+	NumSecrets    int
 }
 
 func (c *Core) findKvMounts() []*kvMount {
@@ -401,16 +432,18 @@ func (c *Core) findKvMounts() []*kvMount {
 	}
 
 	for _, entry := range c.mounts.Entries {
-		if entry.Type == "kv" || entry.Type == "generic" {
+		if entry.Type == pluginconsts.SecretEngineKV || entry.Type == pluginconsts.SecretEngineGeneric {
 			version, ok := entry.Options["version"]
-			if !ok {
+			if !ok || version == "" {
 				version = "1"
 			}
 			mounts = append(mounts, &kvMount{
-				Namespace:  entry.namespace,
-				MountPoint: entry.Path,
-				Version:    version,
-				NumSecrets: 0,
+				Namespace:     entry.namespace,
+				MountPoint:    entry.Path,
+				MountAccessor: entry.Accessor,
+				Version:       version,
+				NumSecrets:    0,
+				Local:         entry.Local,
 			})
 		}
 	}
@@ -425,19 +458,19 @@ func (c *Core) kvCollectionErrorCount() {
 	)
 }
 
-func (c *Core) walkKvMountSecrets(ctx context.Context, m *kvMount) {
-	var subdirectories []string
-	if m.Version == "1" {
-		subdirectories = []string{m.Namespace.Path + m.MountPoint}
-	} else {
-		subdirectories = []string{m.Namespace.Path + m.MountPoint + "metadata/"}
-	}
+func (c *Core) walkKvSecrets(
+	ctx context.Context,
+	rootDirs []string,
+	m *kvMount,
+	onSecret func(ctx context.Context, fullPath string) error,
+) error {
+	subdirectories := rootDirs
 
 	for len(subdirectories) > 0 {
-		// Check for cancellation
+		// Context cancellation check
 		select {
 		case <-ctx.Done():
-			return
+			return nil
 		default:
 			break
 		}
@@ -449,21 +482,27 @@ func (c *Core) walkKvMountSecrets(ctx context.Context, m *kvMount) {
 			Operation: logical.ListOperation,
 			Path:      currentDirectory,
 		}
+
 		resp, err := c.router.Route(ctx, listRequest)
 		if err != nil {
 			c.kvCollectionErrorCount()
-			// ErrUnsupportedPath probably means that the mount is not there any more,
+			// ErrUnsupportedPath probably means that the mount is not there anymore,
 			// don't log those cases.
-			if !strings.Contains(err.Error(), logical.ErrUnsupportedPath.Error()) {
+			if !strings.Contains(err.Error(), logical.ErrUnsupportedPath.Error()) &&
+				// ErrSetupReadOnly means the mount's currently being set up.
+				// Nothing is wrong and there's no cause for alarm, just that we can't get data from it
+				// yet. We also shouldn't log these cases
+				!strings.Contains(err.Error(), logical.ErrSetupReadOnly.Error()) {
 				c.logger.Error("failed to perform internal KV list", "mount_point", m.MountPoint, "error", err)
 				break
 			}
 			// Quit handling this mount point (but it'll still appear in the list)
-			return
+			return err
 		}
 		if resp == nil {
 			continue
 		}
+
 		rawKeys, ok := resp.Data["keys"]
 		if !ok {
 			continue
@@ -473,16 +512,92 @@ func (c *Core) walkKvMountSecrets(ctx context.Context, m *kvMount) {
 			c.kvCollectionErrorCount()
 			c.logger.Error("KV list keys are not a []string", "mount_point", m.MountPoint, "rawKeys", rawKeys)
 			// Quit handling this mount point (but it'll still appear in the list)
-			return
+			return fmt.Errorf("KV list keys are not a []string")
 		}
+
 		for _, path := range keys {
-			if len(path) > 0 && path[len(path)-1] == '/' {
-				subdirectories = append(subdirectories, currentDirectory+path)
+			fullPath := currentDirectory + path
+			if strings.HasSuffix(path, "/") {
+				subdirectories = append(subdirectories, fullPath)
 			} else {
-				m.NumSecrets += 1
+				if callBackErr := onSecret(ctx, fullPath); callBackErr != nil {
+					c.logger.Error("failed to get metadata for KVv2 secret", "path", fullPath, "error", err)
+					return callBackErr
+				}
 			}
 		}
 	}
+	return nil
+}
+
+// getMinNamespaceSecrets is expected to be called on the output
+// of GetKvUsageMetrics to get the min number of secrets in a single namespace.
+func getMinNamespaceSecrets(mapOfNamespacesToSecrets map[string]int) int {
+	currentMin := 0
+	for _, n := range mapOfNamespacesToSecrets {
+		if n < currentMin || currentMin == 0 {
+			currentMin = n
+		}
+	}
+	return currentMin
+}
+
+// getMaxNamespaceSecrets is expected to be called on the output
+// of GetKvUsageMetrics to get the max number of secrets in a single namespace.
+func getMaxNamespaceSecrets(mapOfNamespacesToSecrets map[string]int) int {
+	currentMax := 0
+	for _, n := range mapOfNamespacesToSecrets {
+		if n > currentMax {
+			currentMax = n
+		}
+	}
+	return currentMax
+}
+
+// getTotalSecretsAcrossAllNamespaces is expected to be called on the output
+// of GetKvUsageMetrics to get the total number of secrets across namespaces.
+func getTotalSecretsAcrossAllNamespaces(mapOfNamespacesToSecrets map[string]int) int {
+	total := 0
+	for _, n := range mapOfNamespacesToSecrets {
+		total += n
+	}
+	return total
+}
+
+// getMeanNamespaceSecrets is expected to be called on the output
+// of GetKvUsageMetrics to get the mean number of secrets across namespaces.
+func getMeanNamespaceSecrets(mapOfNamespacesToSecrets map[string]int) int {
+	length := len(mapOfNamespacesToSecrets)
+	// Avoid divide by zero:
+	if length == 0 {
+		return length
+	}
+	return getTotalSecretsAcrossAllNamespaces(mapOfNamespacesToSecrets) / length
+}
+
+func (c *Core) walkKvMountSecrets(ctx context.Context, m *kvMount) {
+	var startDirs []string
+	if m.Version == "1" {
+		startDirs = []string{m.Namespace.Path + m.MountPoint}
+	} else {
+		startDirs = []string{m.Namespace.Path + m.MountPoint + KVv2MetadataPath + "/"}
+	}
+
+	err := c.walkKvSecrets(ctx, startDirs, m, func(ctx context.Context, fullPath string) error {
+		m.NumSecrets++
+		return nil
+	})
+	if err != nil {
+		// ErrUnsupportedPath probably means that the mount is not there anymore,
+		// don't log those cases.
+		if !strings.Contains(err.Error(), logical.ErrUnsupportedPath.Error()) &&
+			// ErrSetupReadOnly means the mount's currently being set up.
+			// Nothing is wrong and there's no cause for alarm, just that we can't get data from it
+			// yet. We also shouldn't log these cases
+			!strings.Contains(err.Error(), logical.ErrSetupReadOnly.Error()) {
+			c.logger.Error("failed to walk KV mount", "mount_point", m.MountPoint, "error", err)
+		}
+	}
 }
 
 func (c *Core) kvSecretGaugeCollector(ctx context.Context) ([]metricsutil.GaugeLabelValues, error) {
diff --git a/vault/core_metrics_test.go b/vault/core_metrics_test.go
index 767b2ac3e34..8bf0e59253a 100644
--- a/vault/core_metrics_test.go
+++ b/vault/core_metrics_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -17,6 +17,7 @@ import (
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestCoreMetrics_KvSecretGauge(t *testing.T) {
@@ -246,6 +247,32 @@ func TestCoreMetrics_KvSecretGaugeError(t *testing.T) {
 	}
 }
 
+// TestCoreMetrics_KvUsageMetricsHelperFunctions tests the KV Product Usage
+// metrics helper functions designed to be used on the output of GetKvUsageMetrics.
+func TestCoreMetrics_KvUsageMetricsHelperFunctions(t *testing.T) {
+	// This is just "", but it makes it clearer
+	rootNsPath := namespace.RootNamespace.Path
+
+	testMap := map[string]int{
+		rootNsPath: 10,
+		"ns1":      20,
+		"ns3":      30,
+	}
+
+	require.Equal(t, 60, getTotalSecretsAcrossAllNamespaces(testMap))
+	require.Equal(t, 0, getTotalSecretsAcrossAllNamespaces(map[string]int{}))
+	require.Equal(t, 10, getTotalSecretsAcrossAllNamespaces(map[string]int{rootNsPath: 10}))
+	require.Equal(t, 20, getMeanNamespaceSecrets(testMap))
+	require.Equal(t, 0, getMeanNamespaceSecrets(map[string]int{}))
+	require.Equal(t, 10, getMeanNamespaceSecrets(map[string]int{rootNsPath: 10}))
+	require.Equal(t, 30, getMaxNamespaceSecrets(testMap))
+	require.Equal(t, 0, getMaxNamespaceSecrets(map[string]int{}))
+	require.Equal(t, 10, getMaxNamespaceSecrets(map[string]int{rootNsPath: 10}))
+	require.Equal(t, 10, getMinNamespaceSecrets(testMap))
+	require.Equal(t, 0, getMinNamespaceSecrets(map[string]int{}))
+	require.Equal(t, 10, getMinNamespaceSecrets(map[string]int{rootNsPath: 10}))
+}
+
 func metricLabelsMatch(t *testing.T, actual []metrics.Label, expected map[string]string) {
 	t.Helper()
 
diff --git a/vault/core_stubs_oss.go b/vault/core_stubs_oss.go
index 2fb05416b16..c7dd5fb6354 100644
--- a/vault/core_stubs_oss.go
+++ b/vault/core_stubs_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -7,6 +7,9 @@ package vault
 
 import (
 	"context"
+	"fmt"
+
+	"github.com/hashicorp/vault/sdk/logical"
 )
 
 //go:generate go run github.com/hashicorp/vault/tools/stubmaker
@@ -31,6 +34,10 @@ func (c *Core) EntGetLicenseState() (*LicenseState, error) {
 	return nil, nil
 }
 
+func (c *Core) EntGetLicense() (string, error) {
+	return "", nil
+}
+
 func (c *Core) EntReloadLicense() error {
 	return nil
 }
@@ -98,3 +105,50 @@ func (c *Core) entLastRemoteUpstreamWAL() uint64 {
 func (c *Core) EntWaitUntilWALShipped(ctx context.Context, index uint64) bool {
 	return true
 }
+
+func (c *Core) GetCurrentWALHeader() string {
+	return ""
+}
+
+func (c *Core) SecretsSyncLicensedActivated() bool { return false }
+
+func (c *Core) IsMultisealEnabled() bool { return false }
+
+func (c *Core) SetMultisealEnabled(_ bool) {}
+
+func (c *Core) ReloadReplicationCanaryWriteInterval() {}
+
+func (c *Core) GetReplicationLagMillisIgnoreErrs() int64 { return 0 }
+
+func (c *Core) ReloadOverloadController() {}
+
+func (c *Core) EntSetupUIDefaultAuth(ctx context.Context) error { return nil }
+
+// entGetPluginCacheDir returns empty string and an error indicating that this is an
+// enterprise-only feature. This is used to prevent the use of the plugin cache
+func (c *Core) entGetPluginCacheDir() (string, error) {
+	return "", fmt.Errorf("enterprise only feature")
+}
+
+// entGetPluginRuntimeDir returns empty string and an error indicating that this is an
+// enterprise-only feature
+func (c *Core) entGetPluginRuntimeDir() (string, error) {
+	return "", fmt.Errorf("enterprise only feature")
+}
+
+// entJoinPluginDir returns empty string and an error indicating that this is an
+// enterprise-only feature
+func (c *Core) entJoinPluginDir(_ string) (string, error) {
+	return "", fmt.Errorf("enterprise only feature")
+}
+
+// IsMountTypeAllowed returns true if a given secret engine mount type is permitted.
+// Forbidden mount types should be refused in mount requests, and any existing mounts
+// of that type should return an error on any routed external requests.
+func (c *Core) IsMountTypeAllowed(mountType string) bool {
+	return true
+}
+
+func (c *Core) GetPkiCertificateCounter() logical.PkiCertificateCounter {
+	return logical.NewNullPkiCertificateCounter()
+}
diff --git a/vault/core_test.go b/vault/core_test.go
index 789071b7872..36305eba770 100644
--- a/vault/core_test.go
+++ b/vault/core_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -21,9 +21,6 @@ import (
 	"github.com/hashicorp/go-uuid"
 	logicalKv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/audit"
-	"github.com/hashicorp/vault/builtin/audit/file"
-	"github.com/hashicorp/vault/builtin/audit/socket"
-	"github.com/hashicorp/vault/builtin/audit/syslog"
 	logicalDb "github.com/hashicorp/vault/builtin/logical/database"
 	"github.com/hashicorp/vault/builtin/plugin"
 	"github.com/hashicorp/vault/command/server"
@@ -41,6 +38,7 @@ import (
 	"github.com/sasha-s/go-deadlock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	uberatomic "go.uber.org/atomic"
 )
 
 // invalidKey is used to test Unseal
@@ -59,24 +57,24 @@ func TestNewCore_configureAuditBackends(t *testing.T) {
 		},
 		"file": {
 			backends: map[string]audit.Factory{
-				"file": file.Factory,
+				"file": audit.NewFileBackend,
 			},
 		},
 		"socket": {
 			backends: map[string]audit.Factory{
-				"socket": socket.Factory,
+				"socket": audit.NewSocketBackend,
 			},
 		},
 		"syslog": {
 			backends: map[string]audit.Factory{
-				"syslog": syslog.Factory,
+				"syslog": audit.NewSyslogBackend,
 			},
 		},
 		"all": {
 			backends: map[string]audit.Factory{
-				"file":   file.Factory,
-				"socket": socket.Factory,
-				"syslog": syslog.Factory,
+				"file":   audit.NewFileBackend,
+				"socket": audit.NewSocketBackend,
+				"syslog": audit.NewSyslogBackend,
 			},
 		},
 	}
@@ -263,6 +261,138 @@ func TestNewCore_configureLogRequestLevel(t *testing.T) {
 	}
 }
 
+// TestCore_FinalizeInFlightReqData validates that the core server
+// correctly finalizes a completed request. It verifies that the request is
+// removed from the in-flight map and the counter is decremented.
+func TestCore_FinalizeInFlightReqData(t *testing.T) {
+	core := &Core{
+		logger:           corehelpers.NewTestLogger(t),
+		logRequestsLevel: uberatomic.NewInt32(int32(log.Info)), // Set to a valid log level
+		inFlightReqData: &InFlightRequests{
+			InFlightReqMap:   &sync.Map{},
+			InFlightReqCount: uberatomic.NewUint64(1),
+		},
+	}
+
+	reqID := "test-req"
+	reqData := InFlightReqData{
+		StartTime:        time.Now(),
+		ClientRemoteAddr: "127.0.0.1",
+		ReqPath:          "/test",
+		Method:           "GET",
+		ClientID:         "client-1",
+	}
+	core.inFlightReqData.InFlightReqMap.Store(reqID, reqData)
+
+	core.FinalizeInFlightReqData(reqID, 200)
+
+	_, ok := core.inFlightReqData.InFlightReqMap.Load(reqID)
+	if ok {
+		t.Errorf("Expected request to be deleted from map")
+	}
+
+	if got := core.inFlightReqData.InFlightReqCount.Load(); got != 0 {
+		t.Errorf("Expected counter to be 0, got %d", got)
+	}
+}
+
+// TestCore_FinalizeInFlightReqData_LogLevelVariants checks that request
+// logging is conditional on the configured log level. It asserts that logging
+// only occurs when a valid log level is set and not for "off" or invalid levels.
+func TestCore_FinalizeInFlightReqData_LogLevelVariants(t *testing.T) {
+	tests := []struct {
+		name         string
+		logLevel     int32
+		expectLogged bool // For manual inspection only
+	}{
+		{"log level off", int32(log.Off), false},
+		{"log level no level (empty)", int32(log.NoLevel), false},
+		{"log level info", int32(log.Info), true},
+		{"log level invalid", int32(-99), false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			core := &Core{
+				logger:           corehelpers.NewTestLogger(t),
+				logRequestsLevel: uberatomic.NewInt32(tc.logLevel),
+				inFlightReqData: &InFlightRequests{
+					InFlightReqMap:   &sync.Map{},
+					InFlightReqCount: uberatomic.NewUint64(1),
+				},
+			}
+			reqID := "test-req"
+			reqData := InFlightReqData{
+				StartTime:        time.Now(),
+				ClientRemoteAddr: "127.0.0.1",
+				ReqPath:          "/test",
+				Method:           "GET",
+				ClientID:         "client-1",
+			}
+			core.inFlightReqData.InFlightReqMap.Store(reqID, reqData)
+
+			core.FinalizeInFlightReqData(reqID, 200)
+
+			_, ok := core.inFlightReqData.InFlightReqMap.Load(reqID)
+			if ok {
+				t.Errorf("Expected request to be deleted from map")
+			}
+
+			if got := core.inFlightReqData.InFlightReqCount.Load(); got != 0 {
+				t.Errorf("Expected counter to be 0, got %d", got)
+			}
+		})
+	}
+}
+
+// TestCore_ReloadLogRequestsLevel ensures the log level for completed
+// requests is correctly updated when the server config is reloaded via SIGHUP,
+// including handling empty or "off" values.
+func TestCore_ReloadLogRequestsLevel(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name          string
+		configLevel   string
+		expectedLevel log.Level
+	}{
+		{"none", "", log.Off},
+		{"off", "off", log.Off},
+		{"trace", "trace", log.Trace},
+		{"debug", "debug", log.Debug},
+		{"info", "info", log.Info},
+		{"warn", "warn", log.Warn},
+		{"error", "error", log.Error},
+		{"bad", "foo", log.NoLevel},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create an atomic.Value instance and initialize it
+			rawConfig := &atomic.Value{}
+			rawConfig.Store(&server.Config{
+				SharedConfig: &configutil.SharedConfig{},
+			})
+
+			core := &Core{
+				logger:           corehelpers.NewTestLogger(t),
+				logRequestsLevel: uberatomic.NewInt32(0),
+				rawConfig:        rawConfig,
+			}
+			// Simulate config reload
+			conf := &server.Config{
+				SharedConfig:     &configutil.SharedConfig{},
+				LogRequestsLevel: tc.configLevel,
+			}
+			core.rawConfig.Store(conf)
+
+			core.ReloadLogRequestsLevel()
+			got := log.Level(core.logRequestsLevel.Load())
+			require.Equal(t, tc.expectedLevel, got)
+		})
+	}
+}
+
 // TestNewCore_configureListeners tests that we are able to configure listeners
 // on a NewCore via config.
 func TestNewCore_configureListeners(t *testing.T) {
@@ -382,7 +512,7 @@ func TestCore_HasVaultVersion(t *testing.T) {
 	upgradeTime := versionEntry.TimestampInstalled
 
 	if upgradeTime.After(time.Now()) || upgradeTime.Before(time.Now().Add(-1*time.Hour)) {
-		t.Fatalf("upgrade time isn't within reasonable bounds of new core initialization. " +
+		t.Fatal("upgrade time isn't within reasonable bounds of new core initialization. " +
 			fmt.Sprintf("time is: %+v, upgrade time is %+v", time.Now(), upgradeTime))
 	}
 }
@@ -1175,7 +1305,7 @@ func TestCore_HandleRequest_InvalidToken(t *testing.T) {
 	if err == nil || !errwrap.Contains(err, logical.ErrPermissionDenied.Error()) {
 		t.Fatalf("err: %v", err)
 	}
-	if resp.Data["error"] != "permission denied" {
+	if !strings.Contains(resp.Data["error"].(string), "permission denied") {
 		t.Fatalf("bad: %#v", resp)
 	}
 }
@@ -1251,6 +1381,26 @@ func TestCore_HandleRequest_RootPath_WithSudo(t *testing.T) {
 	}
 }
 
+// TestCore_HandleRequest_TokenErrInvalidToken checks that a request made
+// with a non-existent token will return the "permission denied" and "invalid token" error
+func TestCore_HandleRequest_TokenErrInvalidToken(t *testing.T) {
+	c, _, _ := TestCoreUnsealed(t)
+
+	req := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "secret/test",
+		Data: map[string]interface{}{
+			"foo":   "bar",
+			"lease": "1h",
+		},
+		ClientToken: "bogus",
+	}
+	resp, err := c.HandleRequest(namespace.RootContext(nil), req)
+	if err == nil || !errwrap.Contains(err, logical.ErrInvalidToken.Error()) || !errwrap.Contains(err, logical.ErrPermissionDenied.Error()) {
+		t.Fatalf("err: %v, resp: %v", err, resp)
+	}
+}
+
 // Check that standard permissions work
 func TestCore_HandleRequest_PermissionDenied(t *testing.T) {
 	c, _, root := TestCoreUnsealed(t)
@@ -1271,6 +1421,69 @@ func TestCore_HandleRequest_PermissionDenied(t *testing.T) {
 	}
 }
 
+// TestCore_RevokedToken_InvalidTokenError checks that a request
+// returns an "invalid token" and a "permission denied" error when a token
+// that has been revoked is used in a request
+func TestCore_RevokedToken_InvalidTokenError(t *testing.T) {
+	c, _, root := TestCoreUnsealed(t)
+
+	// Set the 'test' policy object to permit access to sys/policy
+	req := &logical.Request{
+		Operation: logical.UpdateOperation,
+		Path:      "sys/policy/test", // root protected!
+		Data: map[string]interface{}{
+			"rules": `path "sys/policy" { policy = "sudo" }`,
+		},
+		ClientToken: root,
+	}
+	resp, err := c.HandleRequest(namespace.RootContext(nil), req)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if resp != nil && (resp.IsError() || len(resp.Data) > 0) {
+		t.Fatalf("bad: %#v", resp)
+	}
+
+	// Child token (non-root) but with 'test' policy should have access
+	testMakeServiceTokenViaCore(t, c, root, "child", "", []string{"test"})
+	req = &logical.Request{
+		Operation:   logical.ReadOperation,
+		Path:        "sys/policy", // root protected!
+		ClientToken: "child",
+	}
+	resp, err = c.HandleRequest(namespace.RootContext(nil), req)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if resp == nil {
+		t.Fatalf("bad: %#v", resp)
+	}
+
+	// Revoke the token
+	req = &logical.Request{
+		ClientToken: root,
+		Operation:   logical.UpdateOperation,
+		Path:        "auth/token/revoke",
+		Data: map[string]interface{}{
+			"token": "child",
+		},
+	}
+	resp, err = c.HandleRequest(namespace.RootContext(nil), req)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	req = &logical.Request{
+		Operation:   logical.ReadOperation,
+		Path:        "sys/policy", // root protected!
+		ClientToken: "child",
+	}
+	_, err = c.HandleRequest(namespace.RootContext(nil), req)
+	if err == nil || !errwrap.Contains(err, logical.ErrPermissionDenied.Error()) || !errwrap.Contains(err, logical.ErrInvalidToken.Error()) {
+		t.Fatalf("err: %v, resp: %v", err, resp)
+	}
+}
+
 // Check that standard permissions work
 func TestCore_HandleRequest_PermissionAllowed(t *testing.T) {
 	c, _, root := TestCoreUnsealed(t)
@@ -1460,11 +1673,11 @@ func TestCore_HandleLogin_Token(t *testing.T) {
 
 func TestCore_HandleRequest_AuditTrail(t *testing.T) {
 	// Create a noop audit backend
-	var noop *corehelpers.NoopAudit
+	var noop *audit.NoopAudit
 	c, _, root := TestCoreUnsealed(t)
-	c.auditBackends["noop"] = func(ctx context.Context, config *audit.BackendConfig, headerFormatter audit.HeaderFormatter) (audit.Backend, error) {
+	c.auditBackends["noop"] = func(config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
 		var err error
-		noop, err = corehelpers.NewNoopAudit(config, audit.WithHeaderFormatter(headerFormatter))
+		noop, err = audit.NewNoopAudit(config)
 		return noop, err
 	}
 
@@ -1523,11 +1736,11 @@ func TestCore_HandleRequest_AuditTrail(t *testing.T) {
 
 func TestCore_HandleRequest_AuditTrail_noHMACKeys(t *testing.T) {
 	// Create a noop audit backend
-	var noop *corehelpers.NoopAudit
+	var noop *audit.NoopAudit
 	c, _, root := TestCoreUnsealed(t)
-	c.auditBackends["noop"] = func(ctx context.Context, config *audit.BackendConfig, headerFormatter audit.HeaderFormatter) (audit.Backend, error) {
+	c.auditBackends["noop"] = func(config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
 		var err error
-		noop, err = corehelpers.NewNoopAudit(config, audit.WithHeaderFormatter(headerFormatter))
+		noop, err = audit.NewNoopAudit(config)
 		return noop, err
 	}
 
@@ -1626,7 +1839,7 @@ func TestCore_HandleRequest_AuditTrail_noHMACKeys(t *testing.T) {
 
 func TestCore_HandleLogin_AuditTrail(t *testing.T) {
 	// Create a badass credential backend that always logs in as armon
-	var noop *corehelpers.NoopAudit
+	var noop *audit.NoopAudit
 	noopBack := &NoopBackend{
 		Login: []string{"login"},
 		Response: &logical.Response{
@@ -1646,9 +1859,9 @@ func TestCore_HandleLogin_AuditTrail(t *testing.T) {
 	c.credentialBackends["noop"] = func(context.Context, *logical.BackendConfig) (logical.Backend, error) {
 		return noopBack, nil
 	}
-	c.auditBackends["noop"] = func(ctx context.Context, config *audit.BackendConfig, headerFormatter audit.HeaderFormatter) (audit.Backend, error) {
+	c.auditBackends["noop"] = func(config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
 		var err error
-		noop, err = corehelpers.NewNoopAudit(config, audit.WithHeaderFormatter(headerFormatter))
+		noop, err = audit.NewNoopAudit(config)
 		return noop, err
 	}
 
@@ -3206,11 +3419,12 @@ func TestCore_HandleRequest_TokenCreate_RegisterAuthFailure(t *testing.T) {
 
 // mockServiceRegistration helps test whether standalone ServiceRegistration works
 type mockServiceRegistration struct {
-	notifyActiveCount int
-	notifySealedCount int
-	notifyPerfCount   int
-	notifyInitCount   int
-	runDiscoveryCount int
+	notifyActiveCount         int
+	notifySealedCount         int
+	notifyPerfCount           int
+	notifyInitCount           int
+	notifyConfigurationReload int
+	runDiscoveryCount         int
 }
 
 func (m *mockServiceRegistration) Run(shutdownCh <-chan struct{}, wait *sync.WaitGroup, redirectAddr string) error {
@@ -3238,6 +3452,11 @@ func (m *mockServiceRegistration) NotifyInitializedStateChange(isInitialized boo
 	return nil
 }
 
+func (m *mockServiceRegistration) NotifyConfigurationReload(config *map[string]string) error {
+	m.notifyConfigurationReload++
+	return nil
+}
+
 // TestCore_ServiceRegistration tests whether standalone ServiceRegistration works
 func TestCore_ServiceRegistration(t *testing.T) {
 	// Make a mock service discovery
@@ -3294,10 +3513,11 @@ func TestCore_ServiceRegistration(t *testing.T) {
 
 	// Vault should be registered, unsealed, and active
 	if diff := deep.Equal(sr, &mockServiceRegistration{
-		runDiscoveryCount: 1,
-		notifyActiveCount: 1,
-		notifySealedCount: 1,
-		notifyInitCount:   1,
+		runDiscoveryCount:         1,
+		notifyActiveCount:         1,
+		notifySealedCount:         1,
+		notifyInitCount:           1,
+		notifyConfigurationReload: 1,
 	}); diff != nil {
 		t.Fatal(diff)
 	}
@@ -3313,15 +3533,11 @@ func TestDefaultDeadlock(t *testing.T) {
 	InduceDeadlock(t, testCore, 0)
 }
 
-func RestoreDeadlockOpts() func() {
-	opts := deadlock.Opts
-	return func() {
-		deadlock.Opts = opts
-	}
-}
-
 func InduceDeadlock(t *testing.T, vaultcore *Core, expected uint32) {
-	defer RestoreDeadlockOpts()()
+	priorDeadlockFunc := deadlock.Opts.OnPotentialDeadlock
+	defer func() {
+		deadlock.Opts.OnPotentialDeadlock = priorDeadlockFunc
+	}()
 	var deadlocks uint32
 	deadlock.Opts.OnPotentialDeadlock = func() {
 		atomic.AddUint32(&deadlocks, 1)
@@ -3351,6 +3567,79 @@ func InduceDeadlock(t *testing.T, vaultcore *Core, expected uint32) {
 	}
 }
 
+// TestDetectedDeadlockSetting verifies that a Core struct gets the appropriate
+// locking.RWMutex implementation assigned for the stateLock, authLock, and
+// mountsLock fields based on various values that could be obtained from the
+// detect_deadlocks configuration parameter.
+func TestDetectedDeadlockSetting(t *testing.T) {
+	var standardLock string = "*locking.SyncRWMutex"
+	var deadlockLock string = "*locking.DeadlockRWMutex"
+
+	for _, tc := range []struct {
+		name                        string
+		input                       string
+		expectedDetectDeadlockSlice []string
+		expectedStateLockImpl       string
+		expectedAuthLockImpl        string
+		expectedMountsLockImpl      string
+	}{
+		{
+			name:                        "none",
+			input:                       "",
+			expectedDetectDeadlockSlice: []string{},
+			expectedStateLockImpl:       standardLock,
+			expectedAuthLockImpl:        standardLock,
+			expectedMountsLockImpl:      standardLock,
+		},
+		{
+			name:                        "stateLock-only",
+			input:                       "STATELOCK",
+			expectedDetectDeadlockSlice: []string{"statelock"},
+			expectedStateLockImpl:       deadlockLock,
+			expectedAuthLockImpl:        standardLock,
+			expectedMountsLockImpl:      standardLock,
+		},
+		{
+			name:                        "authLock-only",
+			input:                       "AuthLock",
+			expectedDetectDeadlockSlice: []string{"authlock"},
+			expectedStateLockImpl:       standardLock,
+			expectedAuthLockImpl:        deadlockLock,
+			expectedMountsLockImpl:      standardLock,
+		},
+		{
+			name:                        "state-auth-mounts",
+			input:                       "mountsLock,AUTHlock,sTaTeLoCk",
+			expectedDetectDeadlockSlice: []string{"mountslock", "authlock", "statelock"},
+			expectedStateLockImpl:       deadlockLock,
+			expectedAuthLockImpl:        deadlockLock,
+			expectedMountsLockImpl:      deadlockLock,
+		},
+		{
+			name:                        "stateLock-with-unrecognized",
+			input:                       "stateLock,otherLock",
+			expectedDetectDeadlockSlice: []string{"statelock", "otherlock"},
+			expectedStateLockImpl:       deadlockLock,
+			expectedAuthLockImpl:        standardLock,
+			expectedMountsLockImpl:      standardLock,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			core, _, _ := TestCoreUnsealedWithConfig(t, &CoreConfig{DetectDeadlocks: tc.input})
+
+			assert.ElementsMatch(t, tc.expectedDetectDeadlockSlice, core.detectDeadlocks)
+
+			stateLockImpl := fmt.Sprintf("%T", core.stateLock)
+			authLockImpl := fmt.Sprintf("%T", core.authLock)
+			mountsLockImpl := fmt.Sprintf("%T", core.mountsLock)
+
+			assert.Equal(t, tc.expectedStateLockImpl, stateLockImpl)
+			assert.Equal(t, tc.expectedAuthLockImpl, authLockImpl)
+			assert.Equal(t, tc.expectedMountsLockImpl, mountsLockImpl)
+		})
+	}
+}
+
 func TestSetSeals(t *testing.T) {
 	oldSeal := NewTestSeal(t, &seal.TestSealOpts{
 		StoredKeys:   seal.StoredKeysSupportedGeneric,
@@ -3377,7 +3666,8 @@ func TestSetSeals(t *testing.T) {
 		Generation:   2,
 	})
 
-	err := testCore.SetSeals(newSeal, nil, false)
+	ctx := context.Background()
+	err := testCore.SetSeals(ctx, true, newSeal, nil, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -3507,17 +3797,105 @@ func TestBuildUnsealSetupFunctionSlice(t *testing.T) {
 			core: &Core{
 				replicationState: uint32Ptr(uint32(0)),
 			},
-			expectedLength: 25,
+			expectedLength: 28,
 		},
 		{
 			name: "dr secondary core",
 			core: &Core{
 				replicationState: uint32Ptr(uint32(consts.ReplicationDRSecondary)),
 			},
-			expectedLength: 14,
+			expectedLength: 15,
 		},
 	} {
-		funcs := buildUnsealSetupFunctionSlice(testcase.core)
+		funcs := buildUnsealSetupFunctionSlice(testcase.core, true)
 		assert.Equal(t, testcase.expectedLength, len(funcs), testcase.name)
 	}
 }
+
+// TestBarrier_DeadlockDetection verifies that the
+// DeadlockDetection is correctly enabled and disabled when the core is unsealed
+func TestBarrier_DeadlockDetection(t *testing.T) {
+	testCore := TestCore(t)
+	testCoreUnsealed(t, testCore)
+
+	if testCore.barrier.DetectDeadlocks() {
+		t.Fatal("barrierLock has deadlock detection enabled, it shouldn't")
+	}
+
+	testCore = TestCoreWithDeadlockDetection(t, nil, false)
+	testCoreUnsealed(t, testCore)
+
+	if !testCore.barrier.DetectDeadlocks() {
+		t.Fatal("barrierLock doesn't have deadlock detection enabled, it should")
+	}
+}
+
+// TestCore_IsRemovedFromCluster exercises all the execution paths in the
+// IsRemovedFromCluster convenience method of the Core struct.
+func TestCore_IsRemovedFromCluster(t *testing.T) {
+	core := &Core{}
+
+	// Test case where both HA and underlying physical backends ares nil
+	removed, ok := core.IsRemovedFromCluster()
+	if removed || ok {
+		t.Fatalf("expected removed and ok to be false, got removed: %v, ok: %v", removed, ok)
+	}
+
+	// Test case where HA backend is nil, but the underlying physical is there and does not support RemovableNodeHABackend
+	core.underlyingPhysical = &MockHABackend{}
+	removed, ok = core.IsRemovedFromCluster()
+	if removed || ok {
+		t.Fatalf("expected removed and ok to be false, got removed: %v, ok: %v", removed, ok)
+	}
+
+	// Test case where HA backend is nil, but the underlying physical is there, supports RemovableNodeHABackend, and is not removed
+	mockHA := &MockRemovableNodeHABackend{}
+	core.underlyingPhysical = mockHA
+	removed, ok = core.IsRemovedFromCluster()
+	if removed || !ok {
+		t.Fatalf("expected removed to be false and ok to be true, got removed: %v, ok: %v", removed, ok)
+	}
+
+	// Test case where HA backend is nil, but the underlying physical is there, supports RemovableNodeHABackend, and is removed
+	mockHA.Removed = true
+	removed, ok = core.IsRemovedFromCluster()
+	if !removed || !ok {
+		t.Fatalf("expected removed to be false and ok to be true, got removed: %v, ok: %v", removed, ok)
+	}
+
+	// Test case where HA backend does not support RemovableNodeHABackend
+	core.underlyingPhysical = &MockHABackend{}
+	core.ha = &MockHABackend{}
+	removed, ok = core.IsRemovedFromCluster()
+	if removed || ok {
+		t.Fatalf("expected removed and ok to be false, got removed: %v, ok: %v", removed, ok)
+	}
+
+	// Test case where HA backend supports RemovableNodeHABackend and is not removed
+	mockHA.Removed = false
+	core.ha = mockHA
+	removed, ok = core.IsRemovedFromCluster()
+	if removed || !ok {
+		t.Fatalf("expected removed and ok to be true, got removed: %v, ok: %v", removed, ok)
+	}
+
+	// Test case where HA backend supports RemovableNodeHABackend and is removed
+	mockHA.Removed = true
+	removed, ok = core.IsRemovedFromCluster()
+	if !removed || !ok {
+		t.Fatalf("expected removed to be false and ok to be true, got removed: %v, ok: %v", removed, ok)
+	}
+}
+
+// Test_administrativeNamespacePath verifies if administrativeNamespacePath function returns the configured administrative namespace path
+func Test_administrativeNamespacePath(t *testing.T) {
+	adminNamespacePath := "admin"
+	coreConfig := &CoreConfig{
+		RawConfig: &server.Config{
+			SharedConfig: &configutil.SharedConfig{AdministrativeNamespacePath: adminNamespacePath},
+		},
+		AdministrativeNamespacePath: adminNamespacePath,
+	}
+	core, _, _ := TestCoreUnsealedWithConfig(t, coreConfig)
+	require.Equal(t, core.administrativeNamespacePath(), adminNamespacePath)
+}
diff --git a/vault/core_util.go b/vault/core_util.go
index b2bac92c781..6f847c11555 100644
--- a/vault/core_util.go
+++ b/vault/core_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -10,7 +10,9 @@ import (
 	"fmt"
 
 	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/helper/activationflags"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/limits"
 	"github.com/hashicorp/vault/sdk/helper/license"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/physical"
@@ -58,6 +60,8 @@ func coreInit(c *Core, conf *CoreConfig) error {
 		c.physical = physical.NewStorageEncoding(c.physical)
 	}
 
+	c.FeatureActivationFlags = activationflags.NewFeatureActivationFlags()
+
 	return nil
 }
 
@@ -213,3 +217,14 @@ func DiagnoseCheckLicense(ctx context.Context, vaultCore *Core, coreConfig CoreC
 func createCustomMessageManager(storage logical.Storage, _ *Core) CustomMessagesManager {
 	return uicustommessages.NewManager(storage)
 }
+
+// GetRequestLimiter is a stub for CE. The caller will handle the nil case as a no-op.
+func (c *Core) GetRequestLimiter(key string) *limits.RequestLimiter {
+	return nil
+}
+
+// ReloadRequestLimiter is a no-op on CE.
+func (c *Core) ReloadRequestLimiter() {}
+
+// createSnapshotManager is a no-op on CE.
+func (c *Core) createSnapshotManager() {}
diff --git a/vault/core_util_common.go b/vault/core_util_common.go
index f6548f67f7b..75e2761994c 100644
--- a/vault/core_util_common.go
+++ b/vault/core_util_common.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/cors.go b/vault/cors.go
index db54c789bec..1f34a3c8559 100644
--- a/vault/cors.go
+++ b/vault/cors.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/counters.go b/vault/counters.go
index 283ec5f48d2..0926233b8bd 100644
--- a/vault/counters.go
+++ b/vault/counters.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -14,41 +14,6 @@ const (
 	countersSubPath = "counters/"
 )
 
-// ActiveTokens contains the number of active tokens.
-type ActiveTokens struct {
-	// ServiceTokens contains information about the number of active service
-	// tokens.
-	ServiceTokens TokenCounter `json:"service_tokens"`
-}
-
-// TokenCounter counts the number of tokens
-type TokenCounter struct {
-	// Total is the total number of tokens
-	Total int `json:"total"`
-}
-
-// countActiveTokens returns the number of active tokens
-func (c *Core) countActiveTokens(ctx context.Context) (*ActiveTokens, error) {
-	// Get all of the namespaces
-	ns := c.collectNamespaces()
-
-	// Count the tokens under each namespace
-	total := 0
-	for i := 0; i < len(ns); i++ {
-		ids, err := c.tokenStore.idView(ns[i]).List(ctx, "")
-		if err != nil {
-			return nil, err
-		}
-		total += len(ids)
-	}
-
-	return &ActiveTokens{
-		ServiceTokens: TokenCounter{
-			Total: total,
-		},
-	}, nil
-}
-
 // ActiveEntities contains the number of active entities.
 type ActiveEntities struct {
 	// Entities contains information about the number of active entities.
diff --git a/vault/counters_test.go b/vault/counters_test.go
index 06f17d689fb..44e7fef85a0 100644
--- a/vault/counters_test.go
+++ b/vault/counters_test.go
@@ -1,121 +1,16 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
 	"testing"
-	"time"
 
 	"github.com/go-test/deep"
 	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/sdk/helper/testhelpers/schema"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
-// noinspection SpellCheckingInspection
-func testParseTime(t *testing.T, format, timeval string) time.Time {
-	t.Helper()
-	tm, err := time.Parse(format, timeval)
-	if err != nil {
-		t.Fatalf("Error parsing time %q: %v", timeval, err)
-	}
-	return tm
-}
-
-func testCountActiveTokens(t *testing.T, c *Core, root string) int {
-	t.Helper()
-
-	rootCtx := namespace.RootContext(nil)
-	req := &logical.Request{
-		ClientToken: root,
-		Operation:   logical.ReadOperation,
-		Path:        "sys/internal/counters/tokens",
-	}
-	resp, err := c.HandleRequest(rootCtx, req)
-	if err != nil || (resp != nil && resp.IsError()) {
-		t.Fatalf("bad: resp: %#v\n err: %v", resp, err)
-	}
-	schema.ValidateResponse(
-		t,
-		// we remove the `sys/` prefix b/c Core removes it before routing to the 'sys' backend
-		schema.GetResponseSchema(t, c.systemBackend.Route("internal/counters/tokens"), req.Operation),
-		resp,
-		true,
-	)
-
-	activeTokens := resp.Data["counters"].(*ActiveTokens)
-	return activeTokens.ServiceTokens.Total
-}
-
-func TestTokenStore_CountActiveTokens(t *testing.T) {
-	c, _, root := TestCoreUnsealed(t)
-	rootCtx := namespace.RootContext(nil)
-
-	// Count the root token
-	count := testCountActiveTokens(t, c, root)
-	if count != 1 {
-		t.Fatalf("expected %d tokens, not %d", 1, count)
-	}
-
-	tokens := make([]string, 10)
-	for i := 0; i < 10; i++ {
-
-		// Create some service tokens
-		req := &logical.Request{
-			ClientToken: root,
-			Operation:   logical.UpdateOperation,
-			Path:        "auth/token/create",
-			Data: map[string]interface{}{
-				"ttl": "1h",
-			},
-		}
-
-		resp, err := c.HandleRequest(rootCtx, req)
-		if err != nil || (resp != nil && resp.IsError()) {
-			t.Fatalf("bad: resp: %#v\n err: %v", resp, err)
-		}
-
-		tokens[i] = resp.Auth.ClientToken
-
-		count = testCountActiveTokens(t, c, root)
-		if count != i+2 {
-			t.Fatalf("expected %d tokens, not %d", i+2, count)
-		}
-	}
-
-	// Revoke the service tokens
-	for i := 0; i < 10; i++ {
-
-		req := &logical.Request{
-			ClientToken: root,
-			Operation:   logical.UpdateOperation,
-			Path:        "auth/token/revoke",
-			Data: map[string]interface{}{
-				"token": tokens[i],
-			},
-		}
-
-		resp, err := c.HandleRequest(rootCtx, req)
-		if err != nil || (resp != nil && resp.IsError()) {
-			t.Fatalf("bad: resp: %#v\n err: %v", resp, err)
-		}
-	}
-
-	// We should now have only 1 token (the root token).  However, because
-	// token deletion works by setting the TTL of the token to 0 and waiting
-	// for it to get cleaned up by the expiration manager, occasionally we will
-	// have to wait briefly for all the tokens to actually get deleted.
-	for i := 0; i < 10; i++ {
-		count = testCountActiveTokens(t, c, root)
-		if count == 1 {
-			return
-		}
-		time.Sleep(time.Second)
-	}
-	t.Fatalf("expected %d tokens, not %d", 1, count)
-}
-
 func testCountActiveEntities(t *testing.T, c *Core, root string, expectedEntities int) {
 	t.Helper()
 
diff --git a/vault/custom_messages_manager.go b/vault/custom_messages_manager.go
index ca7c7cd3a80..7ecd0c8c5ab 100644
--- a/vault/custom_messages_manager.go
+++ b/vault/custom_messages_manager.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/custom_response_headers.go b/vault/custom_response_headers.go
index cdd4662a496..a5c3fca4600 100644
--- a/vault/custom_response_headers.go
+++ b/vault/custom_response_headers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/custom_response_headers_test.go b/vault/custom_response_headers_test.go
index 6ce32a68c00..ddcec33416b 100644
--- a/vault/custom_response_headers_test.go
+++ b/vault/custom_response_headers_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/diagnose/constants.go b/vault/diagnose/constants.go
index 7bfffe92eef..2597a39a4d3 100644
--- a/vault/diagnose/constants.go
+++ b/vault/diagnose/constants.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
diff --git a/vault/diagnose/file_checks.go b/vault/diagnose/file_checks.go
index 7a538c77bde..ace5ad206fe 100644
--- a/vault/diagnose/file_checks.go
+++ b/vault/diagnose/file_checks.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
diff --git a/vault/diagnose/file_checks_test.go b/vault/diagnose/file_checks_test.go
index 5bd01f6e919..f150cb44141 100644
--- a/vault/diagnose/file_checks_test.go
+++ b/vault/diagnose/file_checks_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
diff --git a/vault/diagnose/file_checks_unix.go b/vault/diagnose/file_checks_unix.go
index 318fba84289..d7f427fcfa8 100644
--- a/vault/diagnose/file_checks_unix.go
+++ b/vault/diagnose/file_checks_unix.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !windows
diff --git a/vault/diagnose/file_checks_windows.go b/vault/diagnose/file_checks_windows.go
index 9865cada507..0e2280c1f47 100644
--- a/vault/diagnose/file_checks_windows.go
+++ b/vault/diagnose/file_checks_windows.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build windows
diff --git a/vault/diagnose/helpers.go b/vault/diagnose/helpers.go
index 86886c1ecdc..1062b84c7c6 100644
--- a/vault/diagnose/helpers.go
+++ b/vault/diagnose/helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
diff --git a/vault/diagnose/helpers_test.go b/vault/diagnose/helpers_test.go
index a5055c29217..0df5ddf88f5 100644
--- a/vault/diagnose/helpers_test.go
+++ b/vault/diagnose/helpers_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
diff --git a/vault/diagnose/mock_storage_backend.go b/vault/diagnose/mock_storage_backend.go
index c12f7076c3d..acd0de9cb68 100644
--- a/vault/diagnose/mock_storage_backend.go
+++ b/vault/diagnose/mock_storage_backend.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
diff --git a/vault/diagnose/os_common.go b/vault/diagnose/os_common.go
index acff4e832d3..9b8b2145cc1 100644
--- a/vault/diagnose/os_common.go
+++ b/vault/diagnose/os_common.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !openbsd || !arm
diff --git a/vault/diagnose/os_openbsd_arm.go b/vault/diagnose/os_openbsd_arm.go
index 49ff4d68c89..a671f4bf2d5 100644
--- a/vault/diagnose/os_openbsd_arm.go
+++ b/vault/diagnose/os_openbsd_arm.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build openbsd && arm
diff --git a/vault/diagnose/os_unix.go b/vault/diagnose/os_unix.go
index ad39c486f8d..54c8542021b 100644
--- a/vault/diagnose/os_unix.go
+++ b/vault/diagnose/os_unix.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !windows
diff --git a/vault/diagnose/os_windows.go b/vault/diagnose/os_windows.go
index 05a99dec02d..c6032ef3d32 100644
--- a/vault/diagnose/os_windows.go
+++ b/vault/diagnose/os_windows.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build windows
diff --git a/vault/diagnose/output.go b/vault/diagnose/output.go
index 46d1e1ea5be..4e897f17929 100644
--- a/vault/diagnose/output.go
+++ b/vault/diagnose/output.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
@@ -13,7 +13,7 @@ import (
 	"sync"
 	"time"
 
-	wordwrap "github.com/mitchellh/go-wordwrap"
+	"github.com/mitchellh/go-wordwrap"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
@@ -118,7 +118,7 @@ func (t *TelemetryCollector) OnStart(_ context.Context, s sdktrace.ReadWriteSpan
 	defer t.mu.Unlock()
 	t.spans[s.SpanContext().SpanID()] = s
 	if isMainSection(s) {
-		fmt.Fprintf(t.ui, status_unknown+s.Name())
+		fmt.Fprint(t.ui, status_unknown+s.Name())
 	}
 }
 
diff --git a/vault/diagnose/raft_checks.go b/vault/diagnose/raft_checks.go
index e1c0e98f281..35b1811855d 100644
--- a/vault/diagnose/raft_checks.go
+++ b/vault/diagnose/raft_checks.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
diff --git a/vault/diagnose/storage_checks.go b/vault/diagnose/storage_checks.go
index 7e1a14efbf9..c39709fff53 100644
--- a/vault/diagnose/storage_checks.go
+++ b/vault/diagnose/storage_checks.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
diff --git a/vault/diagnose/storage_checks_test.go b/vault/diagnose/storage_checks_test.go
index 75f19e18e5e..786fc519632 100644
--- a/vault/diagnose/storage_checks_test.go
+++ b/vault/diagnose/storage_checks_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
diff --git a/vault/diagnose/test-fixtures/goodcertwithroot.pem b/vault/diagnose/test-fixtures/goodcertwithroot.pem
deleted file mode 100644
index 6e4baf613a3..00000000000
--- a/vault/diagnose/test-fixtures/goodcertwithroot.pem
+++ /dev/null
@@ -1,42 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDtTCCAp2gAwIBAgIUf+jhKTFBnqSs34II0WS1L4QsbbAwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wHhcNMTYwMjI5MDIyNzQxWhcNMjUw
-MTA1MTAyODExWjAbMRkwFwYDVQQDExBjZXJ0LmV4YW1wbGUuY29tMIIBIjANBgkq
-hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsZx0Svr82YJpFpIy4fJNW5fKA6B8mhxS
-TRAVnygAftetT8puHflY0ss7Y6X2OXjsU0PRn+1PswtivhKi+eLtgWkUF9cFYFGn
-SgMld6ZWRhNheZhA6ZfQmeM/BF2pa5HK2SDF36ljgjL9T+nWrru2Uv0BCoHzLAmi
-YYMiIWplidMmMO5NTRG3k+3AN0TkfakB6JVzjLGhTcXdOcVEMXkeQVqJMAuGouU5
-donyqtnaHuIJGuUdy54YDnX86txhOQhAv6r7dHXzZxS4pmLvw8UI1rsSf/GLcUVG
-B+5+AAGF5iuHC3N2DTl4xz3FcN4Cb4w9pbaQ7+mCzz+anqiJfyr2nwIDAQABo4H1
-MIHyMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUm++e
-HpyM3p708bgZJuRYEdX1o+UwHwYDVR0jBBgwFoAUncSzT/6HMexyuiU9/7EgHu+o
-k5swOwYIKwYBBQUHAQEELzAtMCsGCCsGAQUFBzAChh9odHRwOi8vMTI3LjAuMC4x
-OjgyMDAvdjEvcGtpL2NhMCEGA1UdEQQaMBiCEGNlcnQuZXhhbXBsZS5jb22HBH8A
-AAEwMQYDVR0fBCowKDAmoCSgIoYgaHR0cDovLzEyNy4wLjAuMTo4MjAwL3YxL3Br
-aS9jcmwwDQYJKoZIhvcNAQELBQADggEBABsuvmPSNjjKTVN6itWzdQy+SgMIrwfs
-X1Yb9Lefkkwmp9ovKFNQxa4DucuCuzXcQrbKwWTfHGgR8ct4rf30xCRoA7dbQWq4
-aYqNKFWrRaBRAaaYZ/O1ApRTOrXqRx9Eqr0H1BXLsoAq+mWassL8sf6siae+CpwA
-KqBko5G0dNXq5T4i2LQbmoQSVetIrCJEeMrU+idkuqfV2h1BQKgSEhFDABjFdTCN
-QDAHsEHsi2M4/jRW9fqEuhHSDfl2n7tkFUI8wTHUUCl7gXwweJ4qtaSXIwKXYzNj
-xqKHA8Purc1Yfybz4iE1JCROi9fInKlzr5xABq8nb9Qc/J9DIQM+Xmk=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDPDCCAiSgAwIBAgIUb5id+GcaMeMnYBv3MvdTGWigyJ0wDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wHhcNMTYwMjI5MDIyNzI5WhcNMjYw
-MjI2MDIyNzU5WjAWMRQwEgYDVQQDEwtleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAOxTMvhTuIRc2YhxZpmPwegP86cgnqfT1mXxi1A7
-Q7qax24Nqbf00I3oDMQtAJlj2RB3hvRSCb0/lkF7i1Bub+TGxuM7NtZqp2F8FgG0
-z2md+W6adwW26rlxbQKjmRvMn66G9YPTkoJmPmxt2Tccb9+apmwW7lslL5j8H48x
-AHJTMb+PMP9kbOHV5Abr3PT4jXUPUr/mWBvBiKiHG0Xd/HEmlyOEPeAThxK+I5tb
-6m+eB+7cL9BsvQpy135+2bRAxUphvFi5NhryJ2vlAvoJ8UqigsNK3E28ut60FAoH
-SWRfFUFFYtfPgTDS1yOKU/z/XMU2giQv2HrleWt0mp4jqBUCAwEAAaOBgTB/MA4G
-A1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSdxLNP/ocx
-7HK6JT3/sSAe76iTmzAfBgNVHSMEGDAWgBSdxLNP/ocx7HK6JT3/sSAe76iTmzAc
-BgNVHREEFTATggtleGFtcGxlLmNvbYcEfwAAATANBgkqhkiG9w0BAQsFAAOCAQEA
-wHThDRsXJunKbAapxmQ6bDxSvTvkLA6m97TXlsFgL+Q3Jrg9HoJCNowJ0pUTwhP2
-U946dCnSCkZck0fqkwVi4vJ5EQnkvyEbfN4W5qVsQKOFaFVzep6Qid4rZT6owWPa
-cNNzNcXAee3/j6hgr6OQ/i3J6fYR4YouYxYkjojYyg+CMdn6q8BoV0BTsHdnw1/N
-ScbnBHQIvIZMBDAmQueQZolgJcdOuBLYHe/kRy167z8nGg+PUFKIYOL8NaOU1+CJ
-t2YaEibVq5MRqCbRgnd9a2vG0jr5a3Mn4CUUYv+5qIjP3hUusYenW1/EWtn1s/gk
-zehNe5dFTjFpylg1o6b8Ow==
------END CERTIFICATE-----
diff --git a/vault/diagnose/tls_verification.go b/vault/diagnose/tls_verification.go
index 7632e69d522..24a8fc1b346 100644
--- a/vault/diagnose/tls_verification.go
+++ b/vault/diagnose/tls_verification.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
@@ -9,6 +9,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"strings"
@@ -91,7 +92,7 @@ func outputError(ctx context.Context, newWarnings, listenerWarnings []string, ne
 	}
 	if newErr != nil {
 		errMsg := listenerID + ": " + newErr.Error()
-		listenerErrors = append(listenerErrors, fmt.Errorf(errMsg))
+		listenerErrors = append(listenerErrors, errors.New(errMsg))
 		Fail(ctx, errMsg)
 	}
 	return listenerWarnings, listenerErrors
@@ -270,15 +271,17 @@ func TLSFileWarningChecks(leafCerts, interCerts, rootCerts []*x509.Certificate)
 	return warnings, nil
 }
 
-// NearExpiration returns a true if a certficate will expire in a month and false otherwise
+// NearExpiration returns a true if a certificate will expire in a month
+// and false otherwise, along with the duration until the certificate expires
+// which can be a negative duration if the certificate has already expired.
 func NearExpiration(c *x509.Certificate) (bool, time.Duration) {
-	oneMonthFromNow := time.Now().Add(30 * 24 * time.Hour)
-	var timeToExpiry time.Duration
-	if oneMonthFromNow.After(c.NotAfter) {
-		timeToExpiry := oneMonthFromNow.Sub(c.NotAfter)
-		return true, timeToExpiry
-	}
-	return false, timeToExpiry
+	now := time.Now()
+	timeToExpiry := c.NotAfter.Sub(now)
+
+	oneMonthFromNow := now.Add(30 * 24 * time.Hour)
+	isNearExpiration := oneMonthFromNow.After(c.NotAfter)
+
+	return isNearExpiration, timeToExpiry
 }
 
 // TLSMutualExclusionCertCheck returns error if both TLSDisableClientCerts and TLSRequireAndVerifyClientCert are set
@@ -348,7 +351,7 @@ func TLSCAFileCheck(CAFilePath string) ([]string, error) {
 
 	// Check for TLS Errors
 	if err = TLSErrorChecks(leafCerts, interCerts, rootCerts); err != nil {
-		return warningsSlc, fmt.Errorf(strings.ReplaceAll(err.Error(), "leaf", "root"))
+		return warningsSlc, errors.New(strings.ReplaceAll(err.Error(), "leaf", "root"))
 	}
 
 	return warningsSlc, err
diff --git a/vault/diagnose/tls_verification_test.go b/vault/diagnose/tls_verification_test.go
index 70f506c9377..3a8943209cf 100644
--- a/vault/diagnose/tls_verification_test.go
+++ b/vault/diagnose/tls_verification_test.go
@@ -1,27 +1,34 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package diagnose
 
 import (
 	"context"
+	"encoding/pem"
 	"fmt"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
+	pkihelper "github.com/hashicorp/vault/helper/testhelpers/pki"
 	"github.com/hashicorp/vault/internalshared/configutil"
+	"github.com/stretchr/testify/require"
 )
 
 // TestTLSValidCert is the positive test case to show that specifying a valid cert and key
 // passes all checks.
 func TestTLSValidCert(t *testing.T) {
+	tlsFiles := pkihelper.GenerateCertWithRoot(t)
+
 	listeners := []*configutil.Listener{
 		{
 			Type:                  "tcp",
 			Address:               "127.0.0.1:443",
 			ClusterAddress:        "127.0.0.1:8201",
-			TLSCertFile:           "./test-fixtures/goodcertwithroot.pem",
-			TLSKeyFile:            "./test-fixtures/goodkey.pem",
+			TLSCertFile:           tlsFiles.CombinedLeafCaFile,
+			TLSKeyFile:            tlsFiles.Leaf.KeyFile,
 			TLSMinVersion:         "tls10",
 			TLSDisableClientCerts: true,
 		},
@@ -29,10 +36,10 @@ func TestTLSValidCert(t *testing.T) {
 	warnings, errs := ListenerChecks(context.Background(), listeners)
 	if errs != nil {
 		// The test failed -- we can just return one of the errors
-		t.Fatalf(errs[0].Error())
+		t.Fatal(errs[0].Error())
 	}
 	if warnings != nil {
-		t.Fatalf("warnings returned from good listener")
+		t.Fatal("warnings returned from good listener")
 	}
 }
 
@@ -118,13 +125,14 @@ func TestTLSExpiredCert(t *testing.T) {
 // TestTLSMismatchedCryptographicInfo verifies that a cert and key of differing cryptographic
 // types, when specified together, is met with a unique error message.
 func TestTLSMismatchedCryptographicInfo(t *testing.T) {
+	testCaFiles := pkihelper.GenerateCertWithRoot(t)
 	listeners := []*configutil.Listener{
 		{
 			Type:                  "tcp",
 			Address:               "127.0.0.1:443",
 			ClusterAddress:        "127.0.0.1:8201",
-			TLSCertFile:           "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:            "./test-fixtures/ecdsa.key",
+			TLSCertFile:           testCaFiles.Leaf.CertFile,
+			TLSKeyFile:            "./test-fixtures/goodkey.pem", // pkihelper uses EC keys, this file is an RSA key
 			TLSMinVersion:         "tls10",
 			TLSDisableClientCerts: true,
 		},
@@ -142,7 +150,7 @@ func TestTLSMismatchedCryptographicInfo(t *testing.T) {
 			Type:                  "tcp",
 			Address:               "127.0.0.1:443",
 			ClusterAddress:        "127.0.0.1:8201",
-			TLSCertFile:           "./test-fixtures/ecdsa.crt",
+			TLSCertFile:           testCaFiles.Leaf.CertFile,
 			TLSKeyFile:            "./../../api/test-fixtures/keys/key.pem",
 			TLSClientCAFile:       "./../../api/test-fixtures/root/rootcacert.pem",
 			TLSMinVersion:         "tls10",
@@ -183,13 +191,15 @@ func TestTLSMultiKeys(t *testing.T) {
 
 // TestTLSCertAsKey verifies that a unique error message is thrown when a cert is specified twice.
 func TestTLSCertAsKey(t *testing.T) {
+	testCaFiles := pkihelper.GenerateCertWithRoot(t)
+
 	listeners := []*configutil.Listener{
 		{
 			Type:                  "tcp",
 			Address:               "127.0.0.1:443",
 			ClusterAddress:        "127.0.0.1:8201",
-			TLSCertFile:           "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:            "./../../api/test-fixtures/keys/cert.pem",
+			TLSCertFile:           testCaFiles.Leaf.CertFile,
+			TLSKeyFile:            testCaFiles.Leaf.CertFile,
 			TLSMinVersion:         "tls10",
 			TLSDisableClientCerts: true,
 		},
@@ -207,13 +217,21 @@ func TestTLSCertAsKey(t *testing.T) {
 // the root. The root certificate used in this test is the Baltimore Cyber Trust root
 // certificate, downloaded from: https://www.digicert.com/kb/digicert-root-certificates.htm
 func TestTLSInvalidRoot(t *testing.T) {
+	testCaFiles := pkihelper.GenerateCertWithRoot(t)
+	otherRoot := pkihelper.GenerateRootCa(t)
+
+	tempDir := t.TempDir()
+	mixedRoots := filepath.Join(tempDir, "leaf-with-bad-root.pem")
+	err := os.WriteFile(mixedRoots, append(pem.EncodeToMemory(testCaFiles.Leaf.CertPem), pem.EncodeToMemory(otherRoot.CertPem)...), 0o644)
+	require.NoError(t, err, "Failed to write file %s", mixedRoots)
+
 	listeners := []*configutil.Listener{
 		{
 			Type:                  "tcp",
 			Address:               "127.0.0.1:443",
 			ClusterAddress:        "127.0.0.1:8201",
-			TLSCertFile:           "./test-fixtures/goodcertbadroot.pem",
-			TLSKeyFile:            "./test-fixtures/goodkey.pem",
+			TLSCertFile:           mixedRoots,
+			TLSKeyFile:            testCaFiles.Leaf.KeyFile,
 			TLSMinVersion:         "tls10",
 			TLSDisableClientCerts: true,
 		},
@@ -231,13 +249,15 @@ func TestTLSInvalidRoot(t *testing.T) {
 // is still accepted by diagnose as valid. This is an acceptable, though less secure,
 // server configuration.
 func TestTLSNoRoot(t *testing.T) {
+	testCaFiles := pkihelper.GenerateCertWithRoot(t)
+
 	listeners := []*configutil.Listener{
 		{
 			Type:                  "tcp",
 			Address:               "127.0.0.1:443",
 			ClusterAddress:        "127.0.0.1:8201",
-			TLSCertFile:           "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:            "./test-fixtures/goodkey.pem",
+			TLSCertFile:           testCaFiles.Leaf.CertFile,
+			TLSKeyFile:            testCaFiles.Leaf.KeyFile,
 			TLSMinVersion:         "tls10",
 			TLSDisableClientCerts: true,
 		},
@@ -252,14 +272,16 @@ func TestTLSNoRoot(t *testing.T) {
 // TestTLSInvalidMinVersion checks that a listener with an invalid minimum configured
 // version errors appropriately.
 func TestTLSInvalidMinVersion(t *testing.T) {
+	testCaFiles := pkihelper.GenerateCertWithRoot(t)
+
 	listeners := []*configutil.Listener{
 		{
 			Type:                  "tcp",
 			Address:               "127.0.0.1:443",
 			ClusterAddress:        "127.0.0.1:8201",
-			TLSCertFile:           "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:            "./../../api/test-fixtures/keys/key.pem",
-			TLSClientCAFile:       "./../../api/test-fixtures/root/rootcacert.pem",
+			TLSCertFile:           testCaFiles.Leaf.CertFile,
+			TLSKeyFile:            testCaFiles.Leaf.KeyFile,
+			TLSClientCAFile:       testCaFiles.RootCa.CertFile,
 			TLSMinVersion:         "0",
 			TLSDisableClientCerts: true,
 		},
@@ -276,14 +298,16 @@ func TestTLSInvalidMinVersion(t *testing.T) {
 // TestTLSInvalidMaxVersion checks that a listener with an invalid maximum configured
 // version errors appropriately.
 func TestTLSInvalidMaxVersion(t *testing.T) {
+	testCaFiles := pkihelper.GenerateCertWithRoot(t)
+
 	listeners := []*configutil.Listener{
 		{
 			Type:                  "tcp",
 			Address:               "127.0.0.1:443",
 			ClusterAddress:        "127.0.0.1:8201",
-			TLSCertFile:           "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:            "./../../api/test-fixtures/keys/key.pem",
-			TLSClientCAFile:       "./../../api/test-fixtures/root/rootcacert.pem",
+			TLSCertFile:           testCaFiles.Leaf.CertFile,
+			TLSKeyFile:            testCaFiles.Leaf.KeyFile,
+			TLSClientCAFile:       testCaFiles.RootCa.CertFile,
 			TLSMaxVersion:         "0",
 			TLSDisableClientCerts: true,
 		},
@@ -390,14 +414,15 @@ func TestTLSClientCAVerfiyMutualExclusion(t *testing.T) {
 
 // TestTLSClientCAVerfiy checks that a listener which has TLS client certs checks enabled works as expected
 func TestTLSClientCAFileCheck(t *testing.T) {
+	testCaFiles := pkihelper.GenerateCertWithRoot(t)
 	listeners := []*configutil.Listener{
 		{
 			Type:                          "tcp",
 			Address:                       "127.0.0.1:443",
 			ClusterAddress:                "127.0.0.1:8201",
-			TLSCertFile:                   "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:                    "./../../api/test-fixtures/keys/key.pem",
-			TLSClientCAFile:               "./../../api/test-fixtures/root/rootcacert.pem",
+			TLSCertFile:                   testCaFiles.Leaf.CertFile,
+			TLSKeyFile:                    testCaFiles.Leaf.KeyFile,
+			TLSClientCAFile:               testCaFiles.RootCa.CertFile,
 			TLSMaxVersion:                 "tls10",
 			TLSRequireAndVerifyClientCert: true,
 			TLSDisableClientCerts:         false,
@@ -414,14 +439,25 @@ func TestTLSClientCAFileCheck(t *testing.T) {
 
 // TestTLSLeafCertInClientCAFile checks if a leafCert exist in TLSClientCAFile
 func TestTLSLeafCertInClientCAFile(t *testing.T) {
+	testCaFiles := pkihelper.GenerateCertWithRoot(t)
+
+	tempDir := t.TempDir()
+
+	otherRoot := pkihelper.GenerateRootCa(t)
+	mixedLeafWithRoot := filepath.Join(tempDir, "goodcertbadroot.pem")
+	err := os.WriteFile(mixedLeafWithRoot, append(pem.EncodeToMemory(testCaFiles.Leaf.CertPem), pem.EncodeToMemory(otherRoot.CertPem)...), 0o644)
+	if err != nil {
+		t.Fatalf("Failed to write file %s: %v", mixedLeafWithRoot, err)
+	}
+
 	listeners := []*configutil.Listener{
 		{
 			Type:                          "tcp",
 			Address:                       "127.0.0.1:443",
 			ClusterAddress:                "127.0.0.1:8201",
-			TLSCertFile:                   "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:                    "./../../api/test-fixtures/keys/key.pem",
-			TLSClientCAFile:               "./test-fixtures/goodcertbadroot.pem",
+			TLSCertFile:                   testCaFiles.CombinedLeafCaFile,
+			TLSKeyFile:                    testCaFiles.Leaf.KeyFile,
+			TLSClientCAFile:               mixedLeafWithRoot,
 			TLSMaxVersion:                 "tls10",
 			TLSRequireAndVerifyClientCert: true,
 			TLSDisableClientCerts:         false,
@@ -430,10 +466,10 @@ func TestTLSLeafCertInClientCAFile(t *testing.T) {
 	warnings, errs := ListenerChecks(context.Background(), listeners)
 	fmt.Println(warnings)
 	if errs == nil || len(errs) != 1 {
-		t.Fatalf("TLS Config check on bad ClientCAFile certificate should fail once")
+		t.Fatalf("TLS Config check on bad ClientCAFile certificate should fail once: got %v", errs)
 	}
 	if warnings == nil || len(warnings) != 1 {
-		t.Fatalf("TLS Config check on bad ClientCAFile certificate should warn once")
+		t.Fatalf("TLS Config check on bad ClientCAFile certificate should warn once: got %v", warnings)
 	}
 	if !strings.Contains(warnings[0], "Found at least one leaf certificate in the CA certificate file.") {
 		t.Fatalf("Bad error message: %s", warnings[0])
@@ -445,14 +481,15 @@ func TestTLSLeafCertInClientCAFile(t *testing.T) {
 
 // TestTLSNoRootInClientCAFile checks if no Root cert exist in TLSClientCAFile
 func TestTLSNoRootInClientCAFile(t *testing.T) {
+	testCa := pkihelper.GenerateCertWithIntermediaryRoot(t)
 	listeners := []*configutil.Listener{
 		{
 			Type:                          "tcp",
 			Address:                       "127.0.0.1:443",
 			ClusterAddress:                "127.0.0.1:8201",
-			TLSCertFile:                   "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:                    "./../../api/test-fixtures/keys/key.pem",
-			TLSClientCAFile:               "./test-fixtures/intermediateCert.pem",
+			TLSCertFile:                   testCa.Leaf.CertFile,
+			TLSKeyFile:                    testCa.Leaf.KeyFile,
+			TLSClientCAFile:               testCa.IntCa.CertFile,
 			TLSMaxVersion:                 "tls10",
 			TLSRequireAndVerifyClientCert: true,
 			TLSDisableClientCerts:         false,
@@ -469,14 +506,15 @@ func TestTLSNoRootInClientCAFile(t *testing.T) {
 
 // TestTLSIntermediateCertInClientCAFile checks if an intermediate cert is included in TLSClientCAFile
 func TestTLSIntermediateCertInClientCAFile(t *testing.T) {
+	testCa := pkihelper.GenerateCertWithIntermediaryRoot(t)
 	listeners := []*configutil.Listener{
 		{
 			Type:                          "tcp",
 			Address:                       "127.0.0.1:443",
 			ClusterAddress:                "127.0.0.1:8201",
-			TLSCertFile:                   "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:                    "./../../api/test-fixtures/keys/key.pem",
-			TLSClientCAFile:               "./test-fixtures/chain.crt.pem",
+			TLSCertFile:                   testCa.Leaf.CertFile,
+			TLSKeyFile:                    testCa.Leaf.KeyFile,
+			TLSClientCAFile:               testCa.CombinedCaFile,
 			TLSMaxVersion:                 "tls10",
 			TLSRequireAndVerifyClientCert: true,
 			TLSDisableClientCerts:         false,
@@ -491,16 +529,25 @@ func TestTLSIntermediateCertInClientCAFile(t *testing.T) {
 	}
 }
 
-// TestTLSMultipleRootInClietCACert checks if multiple roots included in TLSClientCAFile
-func TestTLSMultipleRootInClietCACert(t *testing.T) {
+// TestTLSMultipleRootInClientCACert checks if multiple roots included in TLSClientCAFile
+func TestTLSMultipleRootInClientCACert(t *testing.T) {
+	testCa := pkihelper.GenerateCertWithRoot(t)
+	otherRoot := pkihelper.GenerateRootCa(t)
+	tempDir := t.TempDir()
+	mixedRoots := filepath.Join(tempDir, "twoRootCA.pem")
+	err := os.WriteFile(mixedRoots, append(pem.EncodeToMemory(testCa.RootCa.CertPem), pem.EncodeToMemory(otherRoot.CertPem)...), 0o644)
+	if err != nil {
+		t.Fatalf("Failed to write file %s: %v", mixedRoots, err)
+	}
+
 	listeners := []*configutil.Listener{
 		{
 			Type:                          "tcp",
 			Address:                       "127.0.0.1:443",
 			ClusterAddress:                "127.0.0.1:8201",
-			TLSCertFile:                   "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:                    "./../../api/test-fixtures/keys/key.pem",
-			TLSClientCAFile:               "./test-fixtures/twoRootCA.pem",
+			TLSCertFile:                   testCa.Leaf.CertFile,
+			TLSKeyFile:                    testCa.Leaf.KeyFile,
+			TLSClientCAFile:               mixedRoots,
 			TLSMinVersion:                 "tls10",
 			TLSRequireAndVerifyClientCert: true,
 			TLSDisableClientCerts:         false,
@@ -508,7 +555,7 @@ func TestTLSMultipleRootInClietCACert(t *testing.T) {
 	}
 	warnings, errs := ListenerChecks(context.Background(), listeners)
 	if errs != nil {
-		t.Fatalf("TLS Config check on valid certificate should not fail")
+		t.Fatalf("TLS Config check on valid certificate should not fail got: %v", errs)
 	}
 	if warnings == nil {
 		t.Fatalf("TLS Config check on valid but bad certificate should warn")
@@ -520,13 +567,15 @@ func TestTLSMultipleRootInClietCACert(t *testing.T) {
 
 // TestTLSSelfSignedCerts tests invalid self-signed cert as TLSClientCAFile
 func TestTLSSelfSignedCert(t *testing.T) {
+	testCaFiles := pkihelper.GenerateCertWithRoot(t)
+
 	listeners := []*configutil.Listener{
 		{
 			Type:                          "tcp",
 			Address:                       "127.0.0.1:443",
 			ClusterAddress:                "127.0.0.1:8201",
-			TLSCertFile:                   "./../../api/test-fixtures/keys/cert.pem",
-			TLSKeyFile:                    "./../../api/test-fixtures/keys/key.pem",
+			TLSCertFile:                   testCaFiles.Leaf.CertFile,
+			TLSKeyFile:                    testCaFiles.Leaf.KeyFile,
 			TLSClientCAFile:               "test-fixtures/selfSignedCert.pem",
 			TLSMinVersion:                 "tls10",
 			TLSRequireAndVerifyClientCert: true,
diff --git a/vault/dynamic_system_view.go b/vault/dynamic_system_view.go
index ee460c0dd51..5ed0822ad1b 100644
--- a/vault/dynamic_system_view.go
+++ b/vault/dynamic_system_view.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -16,8 +16,10 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/helper/wrapping"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/rotation"
 	"github.com/hashicorp/vault/vault/plugincatalog"
 	"github.com/hashicorp/vault/version"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 type ctxKeyForwardedRequestMountAccessor struct{}
@@ -32,140 +34,6 @@ type dynamicSystemView struct {
 	perfStandby bool
 }
 
-type extendedSystemView interface {
-	logical.SystemView
-	logical.ExtendedSystemView
-	// SudoPrivilege won't work over the plugin system so we keep it here
-	// instead of in sdk/logical to avoid exposing to plugins
-	SudoPrivilege(context.Context, string, string) bool
-}
-
-var _ logical.ExtendedSystemView = (*extendedSystemViewImpl)(nil)
-
-type extendedSystemViewImpl struct {
-	dynamicSystemView
-}
-
-func (e extendedSystemViewImpl) Auditor() logical.Auditor {
-	return genericAuditor{
-		mountType: e.mountEntry.Type,
-		namespace: e.mountEntry.Namespace(),
-		c:         e.core,
-	}
-}
-
-func (e extendedSystemViewImpl) ForwardGenericRequest(ctx context.Context, req *logical.Request) (*logical.Response, error) {
-	// Forward the request if allowed
-	if couldForward(e.core) {
-		ctx = namespace.ContextWithNamespace(ctx, e.mountEntry.Namespace())
-		ctx = logical.IndexStateContext(ctx, &logical.WALState{})
-		ctx = context.WithValue(ctx, ctxKeyForwardedRequestMountAccessor{}, e.mountEntry.Accessor)
-		return forward(ctx, e.core, req)
-	}
-
-	return nil, logical.ErrReadOnly
-}
-
-// SudoPrivilege returns true if given path has sudo privileges
-// for the given client token
-func (e extendedSystemViewImpl) SudoPrivilege(ctx context.Context, path string, token string) bool {
-	// Resolve the token policy
-	te, err := e.core.tokenStore.Lookup(ctx, token)
-	if err != nil {
-		e.core.logger.Error("failed to lookup sudo token", "error", err)
-		return false
-	}
-
-	// Ensure the token is valid
-	if te == nil {
-		e.core.logger.Error("entry not found for given token")
-		return false
-	}
-
-	policyNames := make(map[string][]string)
-	// Add token policies
-	policyNames[te.NamespaceID] = append(policyNames[te.NamespaceID], te.Policies...)
-
-	tokenNS, err := NamespaceByID(ctx, te.NamespaceID, e.core)
-	if err != nil {
-		e.core.logger.Error("failed to lookup token namespace", "error", err)
-		return false
-	}
-	if tokenNS == nil {
-		e.core.logger.Error("failed to lookup token namespace", "error", namespace.ErrNoNamespace)
-		return false
-	}
-
-	// Add identity policies from all the namespaces
-	entity, identityPolicies, err := e.core.fetchEntityAndDerivedPolicies(ctx, tokenNS, te.EntityID, te.NoIdentityPolicies)
-	if err != nil {
-		e.core.logger.Error("failed to fetch identity policies", "error", err)
-		return false
-	}
-	for nsID, nsPolicies := range identityPolicies {
-		policyNames[nsID] = append(policyNames[nsID], nsPolicies...)
-	}
-
-	tokenCtx := namespace.ContextWithNamespace(ctx, tokenNS)
-
-	// Add the inline policy if it's set
-	policies := make([]*Policy, 0)
-	if te.InlinePolicy != "" {
-		inlinePolicy, err := ParseACLPolicy(tokenNS, te.InlinePolicy)
-		if err != nil {
-			e.core.logger.Error("failed to parse the token's inline policy", "error", err)
-			return false
-		}
-		policies = append(policies, inlinePolicy)
-	}
-
-	// Construct the corresponding ACL object. Derive and use a new context that
-	// uses the req.ClientToken's namespace
-	acl, err := e.core.policyStore.ACL(tokenCtx, entity, policyNames, policies...)
-	if err != nil {
-		e.core.logger.Error("failed to retrieve ACL for token's policies", "token_policies", te.Policies, "error", err)
-		return false
-	}
-
-	// The operation type isn't important here as this is run from a path the
-	// user has already been given access to; we only care about whether they
-	// have sudo. Note that we use root context because the path that comes in
-	// must be fully-qualified already so we don't want AllowOperation to
-	// prepend a namespace prefix onto it.
-	req := new(logical.Request)
-	req.Operation = logical.ReadOperation
-	req.Path = path
-	authResults := acl.AllowOperation(namespace.RootContext(ctx), req, true)
-	return authResults.RootPrivs
-}
-
-func (e extendedSystemViewImpl) APILockShouldBlockRequest() (bool, error) {
-	mountEntry := e.mountEntry
-	if mountEntry == nil {
-		return false, fmt.Errorf("no mount entry")
-	}
-	ns := mountEntry.Namespace()
-
-	if err := e.core.entBlockRequestIfError(ns.Path, mountEntry.Path); err != nil {
-		return true, nil
-	}
-
-	return false, nil
-}
-
-func (e extendedSystemViewImpl) RequestWellKnownRedirect(ctx context.Context, src, dest string) error {
-	return e.core.WellKnownRedirects.TryRegister(ctx, e.core, e.mountEntry.UUID, src, dest)
-}
-
-func (e extendedSystemViewImpl) DeregisterWellKnownRedirect(ctx context.Context, src string) bool {
-	return e.core.WellKnownRedirects.DeregisterSource(e.mountEntry.UUID, src)
-}
-
-// GetPinnedPluginVersion implements logical.ExtendedSystemView.
-func (e extendedSystemViewImpl) GetPinnedPluginVersion(ctx context.Context, pluginType consts.PluginType, pluginName string) (*pluginutil.PinnedVersion, error) {
-	return e.core.pluginCatalog.GetPinnedVersion(ctx, pluginType, pluginName)
-}
-
 func (d dynamicSystemView) DefaultLeaseTTL() time.Duration {
 	def, _ := d.fetchTTLs()
 	return def
@@ -407,10 +275,17 @@ func (d dynamicSystemView) GroupsForEntity(entityID string) ([]*logical.Group, e
 
 func (d dynamicSystemView) PluginEnv(_ context.Context) (*logical.PluginEnvironment, error) {
 	v := version.GetVersion()
+
+	buildDate, err := version.GetVaultBuildDate()
+	if err != nil {
+		return nil, err
+	}
+
 	return &logical.PluginEnvironment{
 		VaultVersion:           v.Version,
 		VaultVersionPrerelease: v.VersionPrerelease,
 		VaultVersionMetadata:   v.VersionMetadata,
+		VaultBuildDate:         timestamppb.New(buildDate),
 	}, nil
 }
 
@@ -459,12 +334,17 @@ func (d dynamicSystemView) ClusterID(ctx context.Context) (string, error) {
 }
 
 func (d dynamicSystemView) GenerateIdentityToken(ctx context.Context, req *pluginutil.IdentityTokenRequest) (*pluginutil.IdentityTokenResponse, error) {
-	storage := d.core.router.MatchingStorageByAPIPath(ctx, mountPathIdentity)
+	mountEntry := d.mountEntry
+	if mountEntry == nil {
+		return nil, fmt.Errorf("no mount entry")
+	}
+	nsCtx := namespace.ContextWithNamespace(ctx, mountEntry.Namespace())
+	storage := d.core.router.MatchingStorageByAPIPath(nsCtx, mountPathIdentity)
 	if storage == nil {
 		return nil, fmt.Errorf("failed to find storage entry for identity mount")
 	}
 
-	token, ttl, err := d.core.IdentityStore().generatePluginIdentityToken(ctx, storage, d.mountEntry, req.Audience, req.TTL)
+	token, ttl, err := d.core.IdentityStore().generatePluginIdentityToken(nsCtx, storage, d.mountEntry, req.Audience, req.TTL)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate plugin identity token: %w", err)
 	}
@@ -474,3 +354,45 @@ func (d dynamicSystemView) GenerateIdentityToken(ctx context.Context, req *plugi
 		TTL:   ttl,
 	}, nil
 }
+
+func (d dynamicSystemView) GetRotationInformation(ctx context.Context, req *rotation.RotationInfoRequest) (*rotation.RotationInfoResponse, error) {
+	// sanity check
+	mountEntry := d.mountEntry
+	if mountEntry == nil {
+		return nil, fmt.Errorf("no mount entry")
+	}
+	nsCtx := namespace.ContextWithNamespace(ctx, mountEntry.Namespace())
+
+	return d.core.GetRotationInformation(nsCtx, mountEntry.APIPath(), req)
+}
+
+func (d dynamicSystemView) RegisterRotationJob(ctx context.Context, req *rotation.RotationJobConfigureRequest) (string, error) {
+	mountEntry := d.mountEntry
+	if mountEntry == nil {
+		return "", fmt.Errorf("no mount entry")
+	}
+	nsCtx := namespace.ContextWithNamespace(ctx, mountEntry.Namespace())
+
+	job, err := rotation.ConfigureRotationJob(req)
+	if err != nil {
+		return "", fmt.Errorf("error configuring rotation job: %s", err)
+	}
+
+	id, err := d.core.RegisterRotationJob(nsCtx, job)
+	if err != nil {
+		return "", fmt.Errorf("error registering rotation job: %s", err)
+	}
+
+	job.RotationID = id
+	return id, nil
+}
+
+func (d dynamicSystemView) DeregisterRotationJob(ctx context.Context, req *rotation.RotationJobDeregisterRequest) (err error) {
+	mountEntry := d.mountEntry
+	if mountEntry == nil {
+		return fmt.Errorf("no mount entry")
+	}
+	nsCtx := namespace.ContextWithNamespace(ctx, mountEntry.Namespace())
+
+	return d.core.DeregisterRotationJob(nsCtx, req)
+}
diff --git a/vault/dynamic_system_view_stubs_oss.go b/vault/dynamic_system_view_stubs_oss.go
new file mode 100644
index 00000000000..bdff024e009
--- /dev/null
+++ b/vault/dynamic_system_view_stubs_oss.go
@@ -0,0 +1,18 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
+)
+
+// DownloadExtractVerifyPlugin returns an error as this is an enterprise only feature
+func (d dynamicSystemView) DownloadExtractVerifyPlugin(_ context.Context, _ *pluginutil.PluginRunner) error {
+	return fmt.Errorf("enterprise only feature")
+}
diff --git a/vault/dynamic_system_view_test.go b/vault/dynamic_system_view_test.go
index bf7d82e02d1..8c029a63f38 100644
--- a/vault/dynamic_system_view_test.go
+++ b/vault/dynamic_system_view_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -16,6 +16,8 @@ import (
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/version"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 var (
@@ -286,6 +288,50 @@ func TestDynamicSystemView_GeneratePasswordFromPolicy_failed(t *testing.T) {
 	}
 }
 
+// TestDynamicSystemView_PluginEnv_successful checks that the PluginEnv method returns the expected values in a successful case.
+func TestDynamicSystemView_PluginEnv_successful(t *testing.T) {
+	coreConfig := &CoreConfig{
+		CredentialBackends: map[string]logical.Factory{},
+	}
+
+	cluster := NewTestCluster(t, coreConfig, &TestClusterOptions{})
+
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	core := cluster.Cores[0].Core
+	TestWaitActive(t, core)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+	defer cancel()
+
+	ctx = namespace.RootContext(ctx)
+	dsv := TestDynamicSystemView(cluster.Cores[0].Core, nil)
+
+	pluginEnv, err := dsv.PluginEnv(ctx)
+	if err != nil {
+		t.Fatalf("no error expected, but got: %s", err)
+	}
+
+	expectedVersionInfo := version.GetVersion()
+
+	expectedBuildDate, err := version.GetVaultBuildDate()
+	if err != nil {
+		t.Fatalf("failed to set up expectedBuildDate: %v", err)
+	}
+
+	expectedPluginEnv := &logical.PluginEnvironment{
+		VaultVersion:           expectedVersionInfo.Version,
+		VaultVersionPrerelease: expectedVersionInfo.VersionPrerelease,
+		VaultVersionMetadata:   expectedVersionInfo.VersionMetadata,
+		VaultBuildDate:         timestamppb.New(expectedBuildDate),
+	}
+
+	if !reflect.DeepEqual(pluginEnv, expectedPluginEnv) {
+		t.Fatalf("got %q, expected %q", pluginEnv, expectedPluginEnv)
+	}
+}
+
 type runes []rune
 
 func (r runes) Len() int           { return len(r) }
diff --git a/vault/event_plugins_test.go b/vault/event_plugins_test.go
index e21fdec8910..7d5e7449bfa 100644
--- a/vault/event_plugins_test.go
+++ b/vault/event_plugins_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/eventbus/bus.go b/vault/eventbus/bus.go
index b45839f1ac0..15b4ac0a7b7 100644
--- a/vault/eventbus/bus.go
+++ b/vault/eventbus/bus.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package eventbus
@@ -19,6 +19,7 @@ import (
 	"github.com/hashicorp/eventlogger/formatter_filters/cloudevents"
 	"github.com/hashicorp/go-bexpr"
 	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -30,8 +31,9 @@ const (
 	// eventTypeAll is purely internal to the event bus. We use it to send all
 	// events down one big firehose, and pipelines define their own filtering
 	// based on what each subscriber is interested in.
-	eventTypeAll   = "*"
-	defaultTimeout = 60 * time.Second
+	eventTypeAll            = "*"
+	defaultTimeout          = 60 * time.Second
+	eventMetadataVaultIndex = "vault_index"
 )
 
 var (
@@ -40,7 +42,7 @@ var (
 
 	// these metadata fields will have the plugin mount path prepended to them
 	metadataPrependPathFields = []string{
-		"path",
+		logical.EventMetadataPath,
 		logical.EventMetadataDataPath,
 	}
 )
@@ -55,6 +57,13 @@ type EventBus struct {
 	timeout                    time.Duration
 	filters                    *Filters
 	cloudEventsFormatterFilter *cloudevents.FormatterFilter
+	walGetter                  StorageWALGetter
+}
+
+// StorageWALGetter is an interface used to fetch the current storage index
+// from core without importing core
+type StorageWALGetter interface {
+	GetCurrentWALHeader() string
 }
 
 type pluginEventBus struct {
@@ -111,6 +120,25 @@ func patchMountPath(data *logical.EventData, pluginInfo *logical.EventPluginInfo
 	return data
 }
 
+// getIndexForEvent returns the storage index (wal header) for events with
+// metadata.modified=true.
+func (bus *EventBus) getIndexForEvent(event *logical.EventReceived) (string, error) {
+	if event.Event == nil || event.Event.Metadata == nil || bus.walGetter == nil {
+		return "", nil
+	}
+	eventMetadataModified := event.Event.Metadata.GetFields()[logical.EventMetadataModified]
+	if eventMetadataModified != nil {
+		isModified, err := parseutil.ParseBool(eventMetadataModified.GetStringValue())
+		if err != nil {
+			return "", fmt.Errorf("failed to parse event metadata modified: %w", err)
+		}
+		if isModified {
+			return bus.walGetter.GetCurrentWALHeader(), nil
+		}
+	}
+	return "", nil
+}
+
 // SendEventInternal sends an event to the event bus and routes it to all relevant subscribers.
 // This function does *not* wait for all subscribers to acknowledge before returning.
 // This function is meant to be used by trusted internal code, so it can specify details like the namespace
@@ -118,7 +146,7 @@ func patchMountPath(data *logical.EventData, pluginInfo *logical.EventPluginInfo
 // the namespace and plugin info automatically.
 // The context passed in is currently ignored to ensure that the event is sent if the context is short-lived,
 // such as with an HTTP request context.
-func (bus *EventBus) SendEventInternal(_ context.Context, ns *namespace.Namespace, pluginInfo *logical.EventPluginInfo, eventType logical.EventType, data *logical.EventData) error {
+func (bus *EventBus) SendEventInternal(_ context.Context, ns *namespace.Namespace, pluginInfo *logical.EventPluginInfo, eventType logical.EventType, forwarded bool, data *logical.EventData) error {
 	if ns == nil {
 		return namespace.ErrNoNamespace
 	}
@@ -126,11 +154,24 @@ func (bus *EventBus) SendEventInternal(_ context.Context, ns *namespace.Namespac
 		return ErrNotStarted
 	}
 	eventReceived := &logical.EventReceived{
-		Event:      patchMountPath(data, pluginInfo),
 		Namespace:  ns.Path,
 		EventType:  string(eventType),
 		PluginInfo: pluginInfo,
 	}
+	// If the event has been forwarded downstream, no need to patch the mount
+	// path again
+	if forwarded {
+		eventReceived.Event = data
+	} else {
+		eventReceived.Event = patchMountPath(data, pluginInfo)
+		walStr, err := bus.getIndexForEvent(eventReceived)
+		if err != nil {
+			bus.logger.Warn("Failed to get index for event", "error", err)
+		}
+		if walStr != "" {
+			eventReceived.Event.Metadata.Fields[eventMetadataVaultIndex] = structpb.NewStringValue(walStr)
+		}
+	}
 
 	// We can't easily know when the SendEvent is complete, so we can't call the cancel function.
 	// But, it is called automatically after bus.timeout, so there won't be any leak as long as bus.timeout is not too long.
@@ -161,10 +202,10 @@ func (bus *EventBus) WithPlugin(ns *namespace.Namespace, eventPluginInfo *logica
 // This function does *not* wait for all subscribers to acknowledge before returning.
 // The context passed in is currently ignored.
 func (bus *pluginEventBus) SendEvent(ctx context.Context, eventType logical.EventType, data *logical.EventData) error {
-	return bus.bus.SendEventInternal(ctx, bus.namespace, bus.pluginInfo, eventType, data)
+	return bus.bus.SendEventInternal(ctx, bus.namespace, bus.pluginInfo, eventType, false, data)
 }
 
-func NewEventBus(localClusterID string, logger hclog.Logger) (*EventBus, error) {
+func NewEventBus(localNodeID string, logger hclog.Logger, c StorageWALGetter) (*EventBus, error) {
 	broker, err := eventlogger.NewBroker()
 	if err != nil {
 		return nil, err
@@ -180,7 +221,7 @@ func NewEventBus(localClusterID string, logger hclog.Logger) (*EventBus, error)
 		logger = hclog.Default().Named("events")
 	}
 
-	sourceUrl, err := url.Parse("vault://" + localClusterID)
+	sourceUrl, err := url.Parse("vault://" + localNodeID)
 	if err != nil {
 		return nil, err
 	}
@@ -198,7 +239,8 @@ func NewEventBus(localClusterID string, logger hclog.Logger) (*EventBus, error)
 		formatterNodeID:            formatterNodeID,
 		timeout:                    defaultTimeout,
 		cloudEventsFormatterFilter: cloudEventsFormatterFilter,
-		filters:                    NewFilters(localClusterID),
+		filters:                    NewFilters(localNodeID),
+		walGetter:                  c,
 	}, nil
 }
 
@@ -214,10 +256,10 @@ func (bus *EventBus) SubscribeMultipleNamespaces(ctx context.Context, namespaceP
 	return bus.subscribeInternal(ctx, namespacePathPatterns, pattern, bexprFilter, nil)
 }
 
-// subscribeInternal creates the pipeline and connects it to the event bus to receive events.
-// if the cluster is specified, then the namespacePathPatterns, pattern, and bexprFilter are ignored, and instead this
-// subscription will be tied to the given cluster's filter.
-func (bus *EventBus) subscribeInternal(ctx context.Context, namespacePathPatterns []string, pattern string, bexprFilter string, cluster *string) (<-chan *eventlogger.Event, context.CancelFunc, error) {
+// subscribeInternal creates the pipeline and connects it to the event bus to receive events. If the
+// clusterNode is specified, then the namespacePathPatterns, pattern, and bexprFilter are ignored,
+// and instead this subscription will be tied to the given cluster node's filter.
+func (bus *EventBus) subscribeInternal(ctx context.Context, namespacePathPatterns []string, pattern string, bexprFilter string, clusterNode *string) (<-chan *eventlogger.Event, context.CancelFunc, error) {
 	// subscriptions are still stored even if the bus has not been started
 	pipelineID, err := uuid.GenerateUUID()
 	if err != nil {
@@ -235,8 +277,11 @@ func (bus *EventBus) subscribeInternal(ctx context.Context, namespacePathPattern
 	}
 
 	var filterNode *eventlogger.Filter
-	if cluster != nil {
-		filterNode, err = newClusterFilterNode(bus.filters, clusterID(*cluster))
+	if clusterNode != nil {
+		filterNode, err = newClusterNodeFilterNode(bus.filters, clusterNodeID(*clusterNode))
+		if err != nil {
+			return nil, nil, err
+		}
 	} else {
 		filterNode, err = newFilterNode(namespacePathPatterns, pattern, bexprFilter)
 		if err != nil {
@@ -256,7 +301,7 @@ func (bus *EventBus) subscribeInternal(ctx context.Context, namespacePathPattern
 
 	ctx, cancel := context.WithCancel(ctx)
 	asyncNode := newAsyncNode(ctx, bus.logger, bus.broker, func() {
-		if cluster == nil {
+		if clusterNode == nil {
 			bus.filters.removePattern(bus.filters.self, namespacePathPatterns, pattern)
 		}
 	})
@@ -298,9 +343,9 @@ func (bus *EventBus) GlobalMatch(ns *namespace.Namespace, eventType logical.Even
 	return bus.filters.globalMatch(ns, eventType)
 }
 
-// ApplyClusterFilterChanges applies the given filter changes to the cluster's filters.
-func (bus *EventBus) ApplyClusterFilterChanges(c string, changes []FilterChange) {
-	bus.filters.applyChanges(clusterID(c), changes)
+// ApplyClusterNodeFilterChanges applies the given filter changes to the cluster node's filters.
+func (bus *EventBus) ApplyClusterNodeFilterChanges(c string, changes []FilterChange) {
+	bus.filters.applyChanges(clusterNodeID(c), changes)
 }
 
 // ApplyGlobalFilterChanges applies the given filter changes to the global filters.
@@ -313,9 +358,9 @@ func (bus *EventBus) ClearGlobalFilter() {
 	bus.filters.clearGlobalPatterns()
 }
 
-// ClearClusterFilter removes all entries from the given cluster's filter.
-func (bus *EventBus) ClearClusterFilter(id string) {
-	bus.filters.clearClusterPatterns(clusterID(id))
+// ClearClusterNodeFilter removes all entries from the given cluster node's filter.
+func (bus *EventBus) ClearClusterNodeFilter(id string) {
+	bus.filters.clearClusterNodePatterns(clusterNodeID(id))
 }
 
 // NotifyOnGlobalFilterChanges returns a channel that receives changes to the global filter.
@@ -323,14 +368,19 @@ func (bus *EventBus) NotifyOnGlobalFilterChanges(ctx context.Context) (<-chan []
 	return bus.filters.watch(ctx, globalCluster)
 }
 
-// NotifyOnLocalFilterChanges returns a channel that receives changes to the filter for the current cluster.
+// NotifyOnLocalFilterChanges returns a channel that receives changes to the filter for the current cluster node.
 func (bus *EventBus) NotifyOnLocalFilterChanges(ctx context.Context) (<-chan []FilterChange, context.CancelFunc, error) {
-	return bus.NotifyOnClusterFilterChanges(ctx, string(bus.filters.self))
+	return bus.NotifyOnClusterNodeFilterChanges(ctx, string(bus.filters.self))
+}
+
+// NotifyOnClusterNodeFilterChanges returns a channel that receives changes to the filter for the given cluster node.
+func (bus *EventBus) NotifyOnClusterNodeFilterChanges(ctx context.Context, clusterNode string) (<-chan []FilterChange, context.CancelFunc, error) {
+	return bus.filters.watch(ctx, clusterNodeID(clusterNode))
 }
 
-// NotifyOnClusterFilterChanges returns a channel that receives changes to the filter for the given cluster.
-func (bus *EventBus) NotifyOnClusterFilterChanges(ctx context.Context, cluster string) (<-chan []FilterChange, context.CancelFunc, error) {
-	return bus.filters.watch(ctx, clusterID(cluster))
+// NewAllEventsSubscription creates a new subscription to all events.
+func (bus *EventBus) NewAllEventsSubscription(ctx context.Context) (<-chan *eventlogger.Event, context.CancelFunc, error) {
+	return bus.subscribeInternal(ctx, nil, "*", "", nil)
 }
 
 // NewGlobalSubscription creates a new subscription to all events that match the global filter.
@@ -339,18 +389,18 @@ func (bus *EventBus) NewGlobalSubscription(ctx context.Context) (<-chan *eventlo
 	return bus.subscribeInternal(ctx, nil, "", "", &g)
 }
 
-// NewClusterSubscription creates a new subscription to all events that match the given cluster's filter.
-func (bus *EventBus) NewClusterSubscription(ctx context.Context, cluster string) (<-chan *eventlogger.Event, context.CancelFunc, error) {
-	return bus.subscribeInternal(ctx, nil, "", "", &cluster)
+// NewClusterNodeSubscription creates a new subscription to all events that match the given cluster node's filter.
+func (bus *EventBus) NewClusterNodeSubscription(ctx context.Context, clusterNode string) (<-chan *eventlogger.Event, context.CancelFunc, error) {
+	return bus.subscribeInternal(ctx, nil, "", "", &clusterNode)
 }
 
-// creates a new filter node that is tied to the filter for a given cluster
-func newClusterFilterNode(filters *Filters, c clusterID) (*eventlogger.Filter, error) {
+// creates a new filter node that is tied to the filter for a given cluster node
+func newClusterNodeFilterNode(filters *Filters, c clusterNodeID) (*eventlogger.Filter, error) {
 	return &eventlogger.Filter{
 		Predicate: func(e *eventlogger.Event) (bool, error) {
 			eventRecv := e.Payload.(*logical.EventReceived)
 			eventNs := strings.Trim(eventRecv.Namespace, "/")
-			if filters.clusterMatch(c, &namespace.Namespace{
+			if filters.clusterNodeMatch(c, &namespace.Namespace{
 				Path: eventNs,
 			}, logical.EventType(eventRecv.EventType)) {
 				return true, nil
diff --git a/vault/eventbus/bus_test.go b/vault/eventbus/bus_test.go
index cb4c12e950f..07cc0ec28d6 100644
--- a/vault/eventbus/bus_test.go
+++ b/vault/eventbus/bus_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package eventbus
@@ -18,12 +18,13 @@ import (
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/types/known/structpb"
 )
 
 // TestBusBasics tests that basic event sending and subscribing function.
 func TestBusBasics(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -36,14 +37,14 @@ func TestBusBasics(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, event)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, false, event)
 	if !errors.Is(err, ErrNotStarted) {
 		t.Errorf("Expected not started error but got: %v", err)
 	}
 
 	bus.Start()
 
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, event)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, false, event)
 	if err != nil {
 		t.Errorf("Expected no error sending: %v", err)
 	}
@@ -59,7 +60,7 @@ func TestBusBasics(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, event)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, false, event)
 	if err != nil {
 		t.Error(err)
 	}
@@ -78,7 +79,7 @@ func TestBusBasics(t *testing.T) {
 // TestBusIgnoresSendContext tests that the context is ignored when sending to an event,
 // so that we do not give up too quickly.
 func TestBusIgnoresSendContext(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -100,7 +101,7 @@ func TestBusIgnoresSendContext(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel() // cancel immediately
 
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, event)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, false, event)
 	if err != nil {
 		t.Errorf("Expected no error sending: %v", err)
 	}
@@ -119,7 +120,7 @@ func TestBusIgnoresSendContext(t *testing.T) {
 // TestSubscribeNonRootNamespace verifies that events for non-root namespaces
 // aren't filtered out by the bus.
 func TestSubscribeNonRootNamespace(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -144,7 +145,7 @@ func TestSubscribeNonRootNamespace(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = bus.SendEventInternal(ctx, ns, nil, eventType, event)
+	err = bus.SendEventInternal(ctx, ns, nil, eventType, false, event)
 	if err != nil {
 		t.Error(err)
 	}
@@ -162,7 +163,7 @@ func TestSubscribeNonRootNamespace(t *testing.T) {
 
 // TestNamespaceFiltering verifies that events for other namespaces are filtered out by the bus.
 func TestNamespaceFiltering(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -190,7 +191,7 @@ func TestNamespaceFiltering(t *testing.T) {
 	err = bus.SendEventInternal(ctx, &namespace.Namespace{
 		ID:   "abc",
 		Path: "/abc",
-	}, nil, eventType, event)
+	}, nil, eventType, false, event)
 	if err != nil {
 		t.Error(err)
 	}
@@ -203,7 +204,7 @@ func TestNamespaceFiltering(t *testing.T) {
 		// okay
 	}
 
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, event)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, false, event)
 	if err != nil {
 		t.Error(err)
 	}
@@ -222,7 +223,7 @@ func TestNamespaceFiltering(t *testing.T) {
 
 // TestBus2Subscriptions verifies that events of different types are successfully routed to the correct subscribers.
 func TestBus2Subscriptions(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -253,11 +254,11 @@ func TestBus2Subscriptions(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType2, event2)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType2, false, event2)
 	if err != nil {
 		t.Error(err)
 	}
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType1, event1)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType1, false, event1)
 	if err != nil {
 		t.Error(err)
 	}
@@ -293,7 +294,7 @@ func TestBusSubscriptionsCancel(t *testing.T) {
 	for _, tc := range testCases {
 		t.Run(fmt.Sprintf("cancel=%v", tc.cancel), func(t *testing.T) {
 			subscriptions.Store(0)
-			bus, err := NewEventBus("", nil)
+			bus, err := NewEventBus("", nil, nil)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -345,7 +346,7 @@ func TestBusSubscriptionsCancel(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, event)
+			err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, false, event)
 			if err != nil {
 				t.Error(err)
 			}
@@ -357,7 +358,7 @@ func TestBusSubscriptionsCancel(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, event)
+			err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, eventType, false, event)
 			if err != nil {
 				t.Error(err)
 			}
@@ -396,7 +397,7 @@ func waitFor(t *testing.T, maxWait time.Duration, f func() bool) {
 // TestBusWildcardSubscriptions tests that a single subscription can receive
 // multiple event types using * for glob patterns.
 func TestBusWildcardSubscriptions(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -427,11 +428,11 @@ func TestBusWildcardSubscriptions(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, barEventType, event2)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, barEventType, false, event2)
 	if err != nil {
 		t.Error(err)
 	}
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, fooEventType, event1)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, fooEventType, false, event1)
 	if err != nil {
 		t.Error(err)
 	}
@@ -471,7 +472,7 @@ func TestBusWildcardSubscriptions(t *testing.T) {
 // TestDataPathIsPrependedWithMount tests that "data_path", if present in the
 // metadata, is prepended with the plugin's mount.
 func TestDataPathIsPrependedWithMount(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -504,7 +505,7 @@ func TestDataPathIsPrependedWithMount(t *testing.T) {
 	}
 
 	// no plugin info means nothing should change
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, fooEventType, event)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, nil, fooEventType, false, event)
 	if err != nil {
 		t.Error(err)
 	}
@@ -530,7 +531,7 @@ func TestDataPathIsPrependedWithMount(t *testing.T) {
 		PluginVersion: "v1.13.1+builtin",
 		Version:       "2",
 	}
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, &pluginInfo, fooEventType, event)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, &pluginInfo, fooEventType, false, event)
 	if err != nil {
 		t.Error(err)
 	}
@@ -571,7 +572,7 @@ func TestDataPathIsPrependedWithMount(t *testing.T) {
 	if err := event.Metadata.UnmarshalJSON(metadataBytes); err != nil {
 		t.Fatal(err)
 	}
-	err = bus.SendEventInternal(ctx, namespace.RootNamespace, &pluginInfo, fooEventType, event)
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, &pluginInfo, fooEventType, false, event)
 	if err != nil {
 		t.Error(err)
 	}
@@ -587,11 +588,45 @@ func TestDataPathIsPrependedWithMount(t *testing.T) {
 	case <-timeout:
 		t.Error("Timeout waiting for event")
 	}
+
+	// Test that a forwarded event does not have anything prepended
+	event, err = logical.NewEvent()
+	if err != nil {
+		t.Fatal(err)
+	}
+	metadata = map[string]string{
+		logical.EventMetadataDataPath: "your/secret/path",
+		"not_touched":                 "xyz",
+	}
+	metadataBytes, err = json.Marshal(metadata)
+	if err != nil {
+		t.Fatal(err)
+	}
+	event.Metadata = &structpb.Struct{}
+	if err := event.Metadata.UnmarshalJSON(metadataBytes); err != nil {
+		t.Fatal(err)
+	}
+	err = bus.SendEventInternal(ctx, namespace.RootNamespace, &pluginInfo, fooEventType, true, event)
+	if err != nil {
+		t.Error(err)
+	}
+
+	timeout = time.After(1 * time.Second)
+	select {
+	case message := <-ch:
+		metadata := message.Payload.(*logical.EventReceived).Event.Metadata.AsMap()
+		assert.Contains(t, metadata, "not_touched")
+		assert.Equal(t, "xyz", metadata["not_touched"])
+		assert.Contains(t, metadata, "data_path")
+		assert.Equal(t, "your/secret/path", metadata["data_path"])
+	case <-timeout:
+		t.Error("Timeout waiting for event")
+	}
 }
 
 // TestBexpr tests go-bexpr filters are evaluated on an event.
 func TestBexpr(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -625,7 +660,7 @@ func TestBexpr(t *testing.T) {
 			PluginVersion: "v1.13.1+builtin",
 			Version:       "2",
 		}
-		return bus.SendEventInternal(ctx, namespace.RootNamespace, &pluginInfo, logical.EventType(eventType), event)
+		return bus.SendEventInternal(ctx, namespace.RootNamespace, &pluginInfo, logical.EventType(eventType), false, event)
 	}
 
 	testCases := []struct {
@@ -671,7 +706,7 @@ func TestBexpr(t *testing.T) {
 // TestPipelineCleanedUp ensures pipelines are properly cleaned up after
 // subscriptions are closed.
 func TestPipelineCleanedUp(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -706,7 +741,7 @@ func TestPipelineCleanedUp(t *testing.T) {
 
 // TestSubscribeGlobal tests that the global filter subscription mechanism works.
 func TestSubscribeGlobal(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -725,7 +760,7 @@ func TestSubscribeGlobal(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", ev)
+	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", false, ev)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -742,7 +777,7 @@ func TestSubscribeGlobal(t *testing.T) {
 
 // TestSubscribeGlobal_WithApply tests that the global filter subscription mechanism works when using ApplyGlobalFilterChanges.
 func TestSubscribeGlobal_WithApply(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -769,7 +804,7 @@ func TestSubscribeGlobal_WithApply(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", ev)
+	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", false, ev)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -784,9 +819,10 @@ func TestSubscribeGlobal_WithApply(t *testing.T) {
 	}
 }
 
-// TestSubscribeCluster tests that the cluster filter subscription mechanism works.
-func TestSubscribeCluster(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+// TestSubscribeClusterNode tests that the cluster node filter subscription
+// mechanism works.
+func TestSubscribeClusterNode(t *testing.T) {
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -796,7 +832,7 @@ func TestSubscribeCluster(t *testing.T) {
 	bus.filters.addPattern("somecluster", []string{""}, "abc*")
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	t.Cleanup(cancelFunc)
-	ch, cancel2, err := bus.NewClusterSubscription(ctx, "somecluster")
+	ch, cancel2, err := bus.NewClusterNodeSubscription(ctx, "somecluster")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -805,7 +841,7 @@ func TestSubscribeCluster(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", ev)
+	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", false, ev)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -820,9 +856,10 @@ func TestSubscribeCluster(t *testing.T) {
 	}
 }
 
-// TestSubscribeCluster_WithApply tests that the cluster filter subscription mechanism works when using ApplyClusterFilterChanges.
-func TestSubscribeCluster_WithApply(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+// TestSubscribeClusterNode_WithApply tests that the cluster node filter
+// subscription mechanism works when using ApplyClusterNodeFilterChanges.
+func TestSubscribeClusterNode_WithApply(t *testing.T) {
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -831,14 +868,14 @@ func TestSubscribeCluster_WithApply(t *testing.T) {
 
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	t.Cleanup(cancelFunc)
-	bus.ApplyClusterFilterChanges("somecluster", []FilterChange{
+	bus.ApplyClusterNodeFilterChanges("somecluster", []FilterChange{
 		{
 			Operation:         FilterChangeAdd,
 			NamespacePatterns: []string{""},
 			EventTypePattern:  "abc*",
 		},
 	})
-	ch, cancel2, err := bus.NewClusterSubscription(ctx, "somecluster")
+	ch, cancel2, err := bus.NewClusterNodeSubscription(ctx, "somecluster")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -847,7 +884,7 @@ func TestSubscribeCluster_WithApply(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", ev)
+	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", false, ev)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -864,7 +901,7 @@ func TestSubscribeCluster_WithApply(t *testing.T) {
 
 // TestClearGlobalFilter tests that clearing the global filter means no messages get through.
 func TestClearGlobalFilter(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -890,7 +927,7 @@ func TestClearGlobalFilter(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", ev)
+	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", false, ev)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -903,9 +940,10 @@ func TestClearGlobalFilter(t *testing.T) {
 	}
 }
 
-// TestClearClusterFilter tests that clearing a cluster filter means no messages get through.
-func TestClearClusterFilter(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+// TestClearClusterNodeFilter tests that clearing a cluster node filter means no
+// messages get through.
+func TestClearClusterNodeFilter(t *testing.T) {
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -914,15 +952,15 @@ func TestClearClusterFilter(t *testing.T) {
 
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	t.Cleanup(cancelFunc)
-	bus.ApplyClusterFilterChanges("somecluster", []FilterChange{
+	bus.ApplyClusterNodeFilterChanges("somecluster", []FilterChange{
 		{
 			Operation:         FilterChangeAdd,
 			NamespacePatterns: []string{""},
 			EventTypePattern:  "abc*",
 		},
 	})
-	bus.ClearClusterFilter("somecluster")
-	ch, cancel2, err := bus.NewClusterSubscription(ctx, "somecluster")
+	bus.ClearClusterNodeFilter("somecluster")
+	ch, cancel2, err := bus.NewClusterNodeSubscription(ctx, "somecluster")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -931,7 +969,7 @@ func TestClearClusterFilter(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", ev)
+	err = bus.SendEventInternal(nil, namespace.RootNamespace, nil, "abcd", false, ev)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -946,7 +984,7 @@ func TestClearClusterFilter(t *testing.T) {
 
 // TestNotifyOnGlobalFilterChanges tests that notifications on global filter changes are sent.
 func TestNotifyOnGlobalFilterChanges(t *testing.T) {
-	bus, err := NewEventBus("", nil)
+	bus, err := NewEventBus("", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -986,9 +1024,10 @@ func TestNotifyOnGlobalFilterChanges(t *testing.T) {
 	}
 }
 
-// TestNotifyOnLocalFilterChanges tests that notifications on local cluster filter changes are sent.
+// TestNotifyOnLocalFilterChanges tests that notifications on local cluster node
+// filter changes are sent.
 func TestNotifyOnLocalFilterChanges(t *testing.T) {
-	bus, err := NewEventBus("somecluster", nil)
+	bus, err := NewEventBus("somecluster", nil, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1003,7 +1042,7 @@ func TestNotifyOnLocalFilterChanges(t *testing.T) {
 		t.Fatal(err)
 	}
 	t.Cleanup(cancel2)
-	bus.ApplyClusterFilterChanges("somecluster", []FilterChange{
+	bus.ApplyClusterNodeFilterChanges("somecluster", []FilterChange{
 		{
 			Operation:         FilterChangeAdd,
 			NamespacePatterns: []string{""},
@@ -1027,3 +1066,121 @@ func TestNotifyOnLocalFilterChanges(t *testing.T) {
 		t.Fatal("We expected to get a global filter notification")
 	}
 }
+
+type fakeWALGetter struct {
+	Header string
+}
+
+func (f *fakeWALGetter) GetCurrentWALHeader() string {
+	return f.Header
+}
+
+var _ StorageWALGetter = (*fakeWALGetter)(nil)
+
+// Test_getIndexForEvent tests the retrieval of the Vault storage index for an
+// event based on its metadata.
+func Test_getIndexForEvent(t *testing.T) {
+	tests := map[string]struct {
+		event       *logical.EventReceived
+		walGetter   StorageWALGetter
+		expectErr   string
+		expectIndex string
+	}{
+		"event with modified true": {
+			event: &logical.EventReceived{
+				Event: &logical.EventData{
+					Metadata: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"modified": {Kind: &structpb.Value_StringValue{StringValue: "true"}},
+						},
+					},
+				},
+			},
+			walGetter:   &fakeWALGetter{"test-wal"},
+			expectErr:   "",
+			expectIndex: "test-wal",
+		},
+		"event with modified false": {
+			event: &logical.EventReceived{
+				Event: &logical.EventData{
+					Metadata: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"modified": {Kind: &structpb.Value_StringValue{StringValue: "false"}},
+						},
+					},
+				},
+			},
+			walGetter:   &fakeWALGetter{"test-wal"},
+			expectErr:   "",
+			expectIndex: "",
+		},
+		"event with modified not set": {
+			event: &logical.EventReceived{
+				Event: &logical.EventData{
+					Metadata: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"path": {Kind: &structpb.Value_StringValue{StringValue: "abc/"}},
+						},
+					},
+				},
+			},
+			walGetter:   &fakeWALGetter{"test-wal"},
+			expectErr:   "",
+			expectIndex: "",
+		},
+		"event with modified invalid": {
+			event: &logical.EventReceived{
+				Event: &logical.EventData{
+					Metadata: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"modified": {Kind: &structpb.Value_StringValue{StringValue: "invalid"}},
+						},
+					},
+				},
+			},
+			walGetter:   &fakeWALGetter{"test-wal"},
+			expectErr:   "failed to parse event metadata modified",
+			expectIndex: "",
+		},
+		"event without metadata": {
+			event: &logical.EventReceived{
+				Event: &logical.EventData{
+					Metadata: nil,
+				},
+			},
+			expectErr:   "",
+			expectIndex: "",
+		},
+		"nil walGetter": {
+			event: &logical.EventReceived{
+				Event: &logical.EventData{
+					Metadata: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"modified": {Kind: &structpb.Value_StringValue{StringValue: "true"}},
+						},
+					},
+				},
+			},
+			walGetter:   nil,
+			expectErr:   "",
+			expectIndex: "",
+		},
+	}
+
+	for name, tc := range tests {
+		t.Run(name, func(t *testing.T) {
+			bus, err := NewEventBus("", nil, tc.walGetter)
+			require.NoError(t, err)
+			bus.Start()
+
+			index, err := bus.getIndexForEvent(tc.event)
+			if tc.expectErr != "" {
+				assert.ErrorContains(t, err, tc.expectErr)
+				assert.Equal(t, tc.expectIndex, index)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tc.expectIndex, index)
+			}
+		})
+	}
+}
diff --git a/vault/eventbus/filter.go b/vault/eventbus/filter.go
index d4d496964f3..a9d839153a3 100644
--- a/vault/eventbus/filter.go
+++ b/vault/eventbus/filter.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package eventbus
@@ -19,18 +19,18 @@ import (
 
 const globalCluster = ""
 
-// Filters keeps track of all the event patterns that each cluster is interested in.
+// Filters keeps track of all the event patterns that each cluster node is interested in.
 type Filters struct {
 	lock    sync.RWMutex
-	self    clusterID
-	filters map[clusterID]*ClusterFilter
+	self    clusterNodeID
+	filters map[clusterNodeID]*ClusterNodeFilter
 
 	// notifyChanges is used to notify about changes to filters. The condition variables are tied to single lock above.
-	notifyChanges map[clusterID]*sync.Cond
+	notifyChanges map[clusterNodeID]*sync.Cond
 }
 
-// clusterID is used to syntactically indicate that the string is a cluster's identifier.
-type clusterID string
+// clusterNodeID is used to syntactically indicate that the string is a cluster nodes's identifier.
+type clusterNodeID string
 
 // pattern is used to represent one or more combinations of patterns
 type pattern struct {
@@ -46,14 +46,14 @@ func (p pattern) isEmpty() bool {
 	return p.namespacePatterns == "" && p.eventTypePattern == ""
 }
 
-// ClusterFilter keeps track of all patterns that a particular cluster is interested in.
-type ClusterFilter struct {
+// ClusterNodeFilter keeps track of all patterns that a particular cluster node is interested in.
+type ClusterNodeFilter struct {
 	patterns sets.Set[pattern]
 }
 
-// match checks if the given ns and eventType matches any pattern in the cluster's filter.
+// match checks if the given ns and eventType matches any pattern in the cluster node's filter.
 // Must be called while holding a (read) lock for the filter.
-func (nf *ClusterFilter) match(ns *namespace.Namespace, eventType logical.EventType) bool {
+func (nf *ClusterNodeFilter) match(ns *namespace.Namespace, eventType logical.EventType) bool {
 	if nf == nil {
 		return false
 	}
@@ -69,14 +69,14 @@ func (nf *ClusterFilter) match(ns *namespace.Namespace, eventType logical.EventT
 	return false
 }
 
-// NewFilters creates an empty set of filters to keep track of each cluster's pattern interests.
+// NewFilters creates an empty set of filters to keep track of each cluster node's pattern interests.
 func NewFilters(self string) *Filters {
 	f := &Filters{
-		self:          clusterID(self),
-		filters:       map[clusterID]*ClusterFilter{},
-		notifyChanges: map[clusterID]*sync.Cond{},
+		self:          clusterNodeID(self),
+		filters:       map[clusterNodeID]*ClusterNodeFilter{},
+		notifyChanges: map[clusterNodeID]*sync.Cond{},
 	}
-	f.notifyChanges[clusterID(self)] = sync.NewCond(&f.lock)
+	f.notifyChanges[clusterNodeID(self)] = sync.NewCond(&f.lock)
 	f.notifyChanges[globalCluster] = sync.NewCond(&f.lock)
 	return f
 }
@@ -89,7 +89,7 @@ func (f *Filters) String() string {
 	return x
 }
 
-func (nf *ClusterFilter) String() string {
+func (nf *ClusterNodeFilter) String() string {
 	var x []string
 	l := nf.patterns.UnsortedList()
 	for _, v := range l {
@@ -113,7 +113,7 @@ func (f *Filters) clearGlobalPatterns() {
 	delete(f.filters, globalCluster)
 }
 
-func (f *Filters) getOrCreateNotify(c clusterID) *sync.Cond {
+func (f *Filters) getOrCreateNotify(c clusterNodeID) *sync.Cond {
 	// fast check when we don't need to create the Cond
 	f.lock.RLock()
 	n, ok := f.notifyChanges[c]
@@ -133,7 +133,7 @@ func (f *Filters) getOrCreateNotify(c clusterID) *sync.Cond {
 	return n
 }
 
-func (f *Filters) notify(c clusterID) {
+func (f *Filters) notify(c clusterNodeID) {
 	f.lock.RLock()
 	defer f.lock.RUnlock()
 	if notifier, ok := f.notifyChanges[c]; ok {
@@ -141,16 +141,16 @@ func (f *Filters) notify(c clusterID) {
 	}
 }
 
-func (f *Filters) clearClusterPatterns(c clusterID) {
+func (f *Filters) clearClusterNodePatterns(c clusterNodeID) {
 	defer f.notify(c)
 	f.lock.Lock()
 	defer f.lock.Unlock()
 	delete(f.filters, c)
 }
 
-// copyPatternWithLock gets a copy of a cluster's filters
-func (f *Filters) copyPatternWithLock(c clusterID) *ClusterFilter {
-	filters := &ClusterFilter{}
+// copyPatternWithLock gets a copy of a cluster node's filters
+func (f *Filters) copyPatternWithLock(c clusterNodeID) *ClusterNodeFilter {
+	filters := &ClusterNodeFilter{}
 	if got, ok := f.filters[c]; ok {
 		filters.patterns = got.patterns.Clone()
 	} else {
@@ -160,7 +160,7 @@ func (f *Filters) copyPatternWithLock(c clusterID) *ClusterFilter {
 }
 
 // applyChanges applies the changes in the given list, atomically.
-func (f *Filters) applyChanges(c clusterID, changes []FilterChange) {
+func (f *Filters) applyChanges(c clusterNodeID, changes []FilterChange) {
 	defer f.notify(c)
 	f.lock.Lock()
 	defer f.lock.Unlock()
@@ -173,7 +173,7 @@ func (f *Filters) applyChanges(c clusterID, changes []FilterChange) {
 	for _, change := range changes {
 		applyChange(newPatterns, &change)
 	}
-	f.filters[c] = &ClusterFilter{patterns: newPatterns}
+	f.filters[c] = &ClusterNodeFilter{patterns: newPatterns}
 }
 
 // applyChange applies a single filter change to the given set.
@@ -204,13 +204,13 @@ func cleanJoinNamespaces(nsPatterns []string) string {
 	return strings.Join(trimmed, " ")
 }
 
-// addPattern adds a pattern to a node's list.
-func (f *Filters) addPattern(c clusterID, namespacePatterns []string, eventTypePattern string) {
+// addPattern adds a pattern to a cluster node's list.
+func (f *Filters) addPattern(c clusterNodeID, namespacePatterns []string, eventTypePattern string) {
 	defer f.notify(c)
 	f.lock.Lock()
 	defer f.lock.Unlock()
 	if _, ok := f.filters[c]; !ok {
-		f.filters[c] = &ClusterFilter{
+		f.filters[c] = &ClusterNodeFilter{
 			patterns: sets.New[pattern](),
 		}
 	}
@@ -220,8 +220,8 @@ func (f *Filters) addPattern(c clusterID, namespacePatterns []string, eventTypeP
 	f.filters[c].patterns.Insert(p)
 }
 
-// removePattern removes a pattern from a cluster's list.
-func (f *Filters) removePattern(c clusterID, namespacePatterns []string, eventTypePattern string) {
+// removePattern removes a pattern from a cluster node's list.
+func (f *Filters) removePattern(c clusterNodeID, namespacePatterns []string, eventTypePattern string) {
 	defer f.notify(c)
 	nsPatterns := slices.Clone(namespacePatterns)
 	sort.Strings(nsPatterns)
@@ -235,7 +235,7 @@ func (f *Filters) removePattern(c clusterID, namespacePatterns []string, eventTy
 	filters.patterns.Delete(check)
 }
 
-// anyMatch returns true if any cluster's pattern list matches the arguments.
+// anyMatch returns true if any cluster node's pattern list matches the arguments.
 func (f *Filters) anyMatch(ns *namespace.Namespace, eventType logical.EventType) bool {
 	f.lock.RLock()
 	defer f.lock.RUnlock()
@@ -249,24 +249,24 @@ func (f *Filters) anyMatch(ns *namespace.Namespace, eventType logical.EventType)
 
 // globalMatch returns true if the global cluster's pattern list matches the arguments.
 func (f *Filters) globalMatch(ns *namespace.Namespace, eventType logical.EventType) bool {
-	return f.clusterMatch(globalCluster, ns, eventType)
+	return f.clusterNodeMatch(globalCluster, ns, eventType)
 }
 
-// clusterMatch returns true if the given cluster's pattern list matches the arguments.
-func (f *Filters) clusterMatch(c clusterID, ns *namespace.Namespace, eventType logical.EventType) bool {
+// clusterNodeMatch returns true if the given cluster node's pattern list matches the arguments.
+func (f *Filters) clusterNodeMatch(c clusterNodeID, ns *namespace.Namespace, eventType logical.EventType) bool {
 	f.lock.RLock()
 	defer f.lock.RUnlock()
 	return f.filters[c].match(ns, eventType)
 }
 
-// localMatch returns true if the local cluster's pattern list matches the arguments.
+// localMatch returns true if the local cluster node's pattern list matches the arguments.
 func (f *Filters) localMatch(ns *namespace.Namespace, eventType logical.EventType) bool {
-	return f.clusterMatch(f.self, ns, eventType)
+	return f.clusterNodeMatch(f.self, ns, eventType)
 }
 
-// watch creates a notification channel that receives changes for the given cluster.
-func (f *Filters) watch(ctx context.Context, cluster clusterID) (<-chan []FilterChange, context.CancelFunc, error) {
-	notify := f.getOrCreateNotify(cluster)
+// watch creates a notification channel that receives changes for the given cluster node.
+func (f *Filters) watch(ctx context.Context, clusterNode clusterNodeID) (<-chan []FilterChange, context.CancelFunc, error) {
+	notify := f.getOrCreateNotify(clusterNode)
 	ctx, cancelFunc := context.WithCancel(ctx)
 	doneCh := ctx.Done()
 	ch := make(chan []FilterChange)
@@ -279,38 +279,61 @@ func (f *Filters) watch(ctx context.Context, cluster clusterID) (<-chan []Filter
 		}
 	}()
 
-	// actual watcher goroutine that waits for notifications and calculates changes
+	sendToNotify := make(chan *ClusterNodeFilter)
+
+	// goroutine for polling the condition variable.
+	// it's necessary to hold the lock the entire time to ensure there are no race conditions.
 	go func() {
-		var current *ClusterFilter
+		// use a WG to ensure we don't try to send to a closed channel
+		senders := sync.WaitGroup{}
+		defer func() {
+			senders.Wait()
+			close(sendToNotify)
+		}()
+		f.lock.Lock()
+		defer f.lock.Unlock()
 		for {
-			done := func() bool {
-				f.lock.Lock()
-				defer f.lock.Unlock()
-				next := f.copyPatternWithLock(cluster)
-				changes := calculateChanges(current, next)
-				current = next
-				// check if the context is finished before sending
-				select {
-				case <-doneCh:
-					close(ch)
-					return true
-				default:
-					go func() {
-						ch <- changes
-					}()
-				}
-				notify.Wait()
-				return false
+			select {
+			case <-doneCh:
+				return
+			default:
+			}
+			next := f.copyPatternWithLock(clusterNode)
+			senders.Add(1)
+			// don't block to send since we hold the lock
+			go func() {
+				sendToNotify <- next
+				senders.Done()
 			}()
-			if done {
+			notify.Wait()
+		}
+	}()
+
+	// calculate changes and forward to notification channel
+	go func() {
+		defer close(ch)
+		var current *ClusterNodeFilter
+		for {
+			next, ok := <-sendToNotify
+			if !ok {
 				return
 			}
+			changes := calculateChanges(current, next)
+			current = next
+			// check if the context is finished before sending
+			select {
+			case <-doneCh:
+				return
+			default:
+				ch <- changes
+			}
 		}
 	}()
+
 	return ch, cancelFunc, nil
 }
 
-// FilterChange represents a change to a cluster's filters.
+// FilterChange represents a change to a cluster node's filters.
 type FilterChange struct {
 	Operation         int
 	NamespacePatterns []string
@@ -324,7 +347,7 @@ const (
 )
 
 // calculateChanges calculates a set of changes necessary to transform from into to.
-func calculateChanges(from *ClusterFilter, to *ClusterFilter) []FilterChange {
+func calculateChanges(from *ClusterNodeFilter, to *ClusterNodeFilter) []FilterChange {
 	var changes []FilterChange
 	if to == nil {
 		changes = append(changes, FilterChange{
diff --git a/vault/eventbus/filter_test.go b/vault/eventbus/filter_test.go
index 4fb661f5576..442e27a22a1 100644
--- a/vault/eventbus/filter_test.go
+++ b/vault/eventbus/filter_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package eventbus
@@ -45,7 +45,8 @@ func TestFilters_AddRemoveMatchLocal(t *testing.T) {
 	assert.False(t, f.anyMatch(ns, "abc"))
 }
 
-// TestFilters_Watch checks that adding a watch for a cluster will send a notification when the patterns are modified.
+// TestFilters_Watch checks that adding a watch for a cluster node will send a
+// notification when the patterns are modified.
 func TestFilters_Watch(t *testing.T) {
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	t.Cleanup(cancelFunc)
@@ -135,7 +136,7 @@ func TestFilters_AddRemoveClear(t *testing.T) {
 	f.removePattern("somecluster", []string{"ns1"}, "abc")
 	assert.Equal(t, "", f.filters["somecluster"].String())
 	f.addPattern("somecluster", []string{"ns1"}, "abc")
-	f.clearClusterPatterns("somecluster")
+	f.clearClusterNodePatterns("somecluster")
 	assert.NotContains(t, f.filters, "somecluster")
 
 	f.addGlobalPattern([]string{"ns1"}, "abc")
diff --git a/vault/expiration.go b/vault/expiration.go
index 09cb9e9e439..d177c91b752 100644
--- a/vault/expiration.go
+++ b/vault/expiration.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -33,6 +33,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/locksutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/vault/observations"
 	"github.com/hashicorp/vault/vault/quotas"
 	uberAtomic "go.uber.org/atomic"
 )
@@ -127,6 +128,8 @@ type ExpirationManager struct {
 	// This value is protected by pendingLock
 	irrevocableLeaseCount int
 
+	irrevocableLeaseRemovalEnabled bool
+
 	// The uniquePolicies map holds policy sets, so they can
 	// be deduplicated. It is periodically emptied to prevent
 	// unbounded growth.
@@ -418,6 +421,10 @@ func (c *Core) setupExpiration(e ExpireLeaseStrategy) error {
 	}
 	go c.expiration.Restore(errorFunc)
 
+	if mgr.removeIrrevocableLeasesEnabled(c) {
+		mgr.irrevocableLeaseRemovalEnabled = true
+	}
+
 	quit := c.expiration.quitCh
 	go func() {
 		t := time.NewTimer(24 * time.Hour)
@@ -426,7 +433,7 @@ func (c *Core) setupExpiration(e ExpireLeaseStrategy) error {
 			case <-quit:
 				return
 			case <-t.C:
-				c.expiration.attemptIrrevocableLeasesRevoke()
+				c.expiration.attemptIrrevocableLeasesRevoke(c.removeIrrevocableLeaseAfter)
 				t.Reset(24 * time.Hour)
 			}
 		}
@@ -435,8 +442,11 @@ func (c *Core) setupExpiration(e ExpireLeaseStrategy) error {
 	return nil
 }
 
-// stopExpiration is used to stop the expiration manager before
-// sealing the Vault.
+// stopExpiration is used to stop the expiration manager before sealing Vault.
+// This *must* be called after shutting down the ActivityLog and
+// CensusManager to prevent Core's expirationManager reference from
+// changing while being accessed by product usage reporting. This is
+// an unfortunate side-effect of tight coupling between ActivityLog and Core.
 func (c *Core) stopExpiration() error {
 	if c.expiration != nil {
 		if err := c.expiration.Stop(); err != nil {
@@ -945,15 +955,26 @@ func (m *ExpirationManager) lazyRevokeInternal(ctx context.Context, leaseID stri
 	}
 	m.updatePending(le)
 
+	err = m.core.observations.RecordObservationToLedger(ctx, observations.ObservationTypeLeaseLazyRevoke, le.namespace, map[string]interface{}{
+		"lease_id":    leaseID,
+		"path":        le.Path,
+		"issue_time":  le.IssueTime,
+		"expire_time": le.ExpireTime,
+	})
+	if err != nil {
+		return err
+	}
+
 	return nil
 }
 
 // should be run on a schedule. something like once a day, maybe once a week
-func (m *ExpirationManager) attemptIrrevocableLeasesRevoke() {
+func (m *ExpirationManager) attemptIrrevocableLeasesRevoke(removeIrrevocableLeaseAfter time.Duration) {
 	m.irrevocable.Range(func(k, v interface{}) bool {
 		leaseID := k.(string)
 		le := v.(*leaseEntry)
 
+		// remove irrevocable leases after configured duration
 		if le.ExpireTime.Add(time.Hour).Before(time.Now()) {
 			// if we get an error (or no namespace) note it, but continue attempting
 			// to revoke other leases
@@ -969,12 +990,27 @@ func (m *ExpirationManager) attemptIrrevocableLeasesRevoke() {
 
 			ctxWithNS := namespace.ContextWithNamespace(m.core.activeContext, leaseNS)
 			ctxWithNSAndTimeout, _ := context.WithTimeout(ctxWithNS, time.Minute)
-			if err := m.revokeCommon(ctxWithNSAndTimeout, leaseID, false, false); err != nil {
-				// on failure, force some delay to mitigate resource spike while
-				// this is running. if revocations succeed, we are okay with
-				// the higher resource consumption.
-				time.Sleep(10 * time.Millisecond)
+
+			// remove irrevocable lease if 'remove irrevocable leases' feature is enabled
+			var forceRevoke bool
+			if m.irrevocableLeaseRemovalEnabled && le.ExpireTime.Add(removeIrrevocableLeaseAfter).Before(time.Now()) {
+				forceRevoke = true
+			}
+
+			err = m.revokeCommon(ctxWithNSAndTimeout, leaseID, forceRevoke, false)
+
+			// Log the appropriate message on errors or force revocation
+			if forceRevoke {
+				if err != nil {
+					m.logger.Debug("failed to delete irrevocable lease", "lease_id", le.LeaseID, "err", err)
+				} else {
+					m.logger.Debug("deleted irrevocable lease", "lease_id", le.LeaseID, "lease_expire_time", le.ExpireTime)
+				}
 			}
+
+			// Force some delay to mitigate resource spike while
+			// this is running.
+			time.Sleep(10 * time.Millisecond)
 		}
 
 		return true
@@ -983,9 +1019,8 @@ func (m *ExpirationManager) attemptIrrevocableLeasesRevoke() {
 
 // revokeCommon does the heavy lifting. If force is true, we ignore a problem
 // during revocation and still remove entries/index/lease timers
-func (m *ExpirationManager) revokeCommon(ctx context.Context, leaseID string, force, skipToken bool) error {
+func (m *ExpirationManager) revokeCommon(ctx context.Context, leaseID string, force, skipToken bool) (err error) {
 	defer metrics.MeasureSince([]string{"expire", "revoke-common"}, time.Now())
-
 	if !skipToken {
 		// Acquire lock for this lease
 		// If skipToken is true, then we're either being (1) called via RevokeByToken, so
@@ -1015,7 +1050,7 @@ func (m *ExpirationManager) revokeCommon(ctx context.Context, leaseID string, fo
 			}
 
 			if m.logger.IsWarn() {
-				m.logger.Warn("revocation from the backend failed, but in force mode so ignoring", "error", err)
+				m.logger.Warn("revocation from the backend failed, but in force mode so ignoring. external resources may be orphaned.", "lease_id", leaseID, "error", err)
 			}
 		}
 	}
@@ -1066,6 +1101,20 @@ func (m *ExpirationManager) revokeCommon(ctx context.Context, leaseID string, fo
 	}
 	m.pendingLock.Unlock()
 
+	if !skipToken {
+		err = m.core.observations.RecordObservationToLedger(ctx, observations.ObservationTypeLeaseRevocation, le.namespace, map[string]interface{}{
+			"lease_id":    leaseID,
+			"path":        le.Path,
+			"issue_time":  le.IssueTime,
+			"expire_time": le.ExpireTime,
+		})
+		if err != nil {
+			if !force {
+				return err
+			}
+		}
+	}
+
 	if m.logger.IsInfo() && !skipToken && m.logLeaseExpirations {
 		m.logger.Info("revoked lease", "lease_id", leaseID)
 	}
@@ -1315,6 +1364,16 @@ func (m *ExpirationManager) Renew(ctx context.Context, leaseID string, increment
 		return nil, err
 	}
 
+	err = m.core.observations.RecordObservationToLedger(ctx, observations.ObservationTypeLeaseRenewNonAuth, le.namespace, map[string]interface{}{
+		"lease_id":    leaseID,
+		"path":        le.Path,
+		"issue_time":  le.IssueTime,
+		"expire_time": le.ExpireTime,
+	})
+	if err != nil {
+		return nil, err
+	}
+
 	// Update the expiration time
 	m.updatePending(le)
 
@@ -1434,8 +1493,19 @@ func (m *ExpirationManager) RenewToken(ctx context.Context, req *logical.Request
 	if err := m.persistEntry(ctx, le); err != nil {
 		return nil, err
 	}
+
 	m.updatePending(le)
 
+	err = m.core.observations.RecordObservationToLedger(ctx, observations.ObservationTypeLeaseRenewAuth, le.namespace, map[string]interface{}{
+		"lease_id":    leaseID,
+		"path":        le.Path,
+		"issue_time":  le.IssueTime,
+		"expire_time": le.ExpireTime,
+	})
+	if err != nil {
+		return nil, err
+	}
+
 	retResp.Auth = resp.Auth
 	return retResp, nil
 }
@@ -1557,6 +1627,16 @@ func (m *ExpirationManager) Register(ctx context.Context, req *logical.Request,
 		return "", err
 	}
 
+	err = m.core.observations.RecordObservationToLedger(ctx, observations.ObservationTypeLeaseCreationNonAuth, le.namespace, map[string]interface{}{
+		"lease_id":    leaseID,
+		"path":        te.Path,
+		"issue_time":  le.IssueTime,
+		"expire_time": le.ExpireTime,
+	})
+	if err != nil {
+		return "", err
+	}
+
 	if indexToken != "" {
 		if err := m.createIndexByToken(ctx, le, indexToken); err != nil {
 			return "", err
@@ -1626,13 +1706,14 @@ func (m *ExpirationManager) RegisterAuth(ctx context.Context, te *logical.TokenE
 	}
 
 	// Create a lease entry
+	issueTime := time.Now()
 	le := leaseEntry{
 		LeaseID:     leaseID,
 		ClientToken: auth.ClientToken,
 		Auth:        auth,
 		Path:        te.Path,
 		LoginRole:   loginRole,
-		IssueTime:   time.Now(),
+		IssueTime:   issueTime,
 		ExpireTime:  authExpirationTime,
 		namespace:   tokenNS,
 		Version:     1,
@@ -1647,6 +1728,16 @@ func (m *ExpirationManager) RegisterAuth(ctx context.Context, te *logical.TokenE
 		return err
 	}
 
+	err = m.core.observations.RecordObservationToLedger(ctx, observations.ObservationTypeLeaseCreationAuth, tokenNS, map[string]interface{}{
+		"lease_id":    leaseID,
+		"path":        te.Path,
+		"issue_time":  issueTime,
+		"expire_time": authExpirationTime,
+	})
+	if err != nil {
+		return err
+	}
+
 	// Setup revocation timer
 	m.updatePending(&le)
 	if strings.HasPrefix(auth.ClientToken, consts.ServiceTokenPrefix) {
@@ -2013,7 +2104,9 @@ func (m *ExpirationManager) renewAuthEntry(ctx context.Context, req *logical.Req
 	return resp, nil
 }
 
-// loadEntry is used to read a lease entry
+// loadEntry is used to read a lease entry.
+// NOTE: loadEntry will return nil for both the pointer to a leaseEntry and the error when
+// the entry is not found, so callers should check the entry before attempting to access its fields.
 func (m *ExpirationManager) loadEntry(ctx context.Context, leaseID string) (*leaseEntry, error) {
 	// Take out the lease locks after we ensure we are in restore mode
 	restoreMode := m.inRestoreMode()
@@ -2311,6 +2404,16 @@ func (m *ExpirationManager) CreateOrFetchRevocationLeaseByToken(ctx context.Cont
 			m.deleteLockForLease(leaseID)
 			return "", err
 		}
+
+		err = m.core.observations.RecordObservationToLedger(ctx, observations.ObservationTypeLeaseCreationAuth, tokenNS, map[string]interface{}{
+			"lease_id":    leaseID,
+			"path":        te.Path,
+			"issue_time":  le.IssueTime,
+			"expire_time": le.ExpireTime,
+		})
+		if err != nil {
+			return "", err
+		}
 	}
 
 	return le.LeaseID, nil
diff --git a/vault/expiration_integ_test.go b/vault/expiration_integ_test.go
index fc51ab27ea0..e81c2426e9b 100644
--- a/vault/expiration_integ_test.go
+++ b/vault/expiration_integ_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault_test
diff --git a/vault/expiration_test.go b/vault/expiration_test.go
index a790f3f3483..8c28c3bd8e5 100644
--- a/vault/expiration_test.go
+++ b/vault/expiration_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -20,7 +20,6 @@ import (
 	"github.com/armon/go-metrics"
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-uuid"
-	"github.com/hashicorp/vault/helper/benchhelpers"
 	"github.com/hashicorp/vault/helper/fairshare"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
@@ -35,7 +34,7 @@ var testImagePull sync.Once
 
 // mockExpiration returns a mock expiration manager
 func mockExpiration(t testing.TB) *ExpirationManager {
-	c, _, _ := TestCoreUnsealed(benchhelpers.TBtoT(t))
+	c, _, _ := TestCoreUnsealed(t)
 
 	// Wait until the expiration manager is out of restore mode.
 	// This was added to prevent sporadic failures of TestExpiration_unrecoverableErrorMakesIrrevocable.
@@ -51,7 +50,7 @@ func mockExpiration(t testing.TB) *ExpirationManager {
 }
 
 func mockBackendExpiration(t testing.TB, backend physical.Backend) (*Core, *ExpirationManager) {
-	c, _, _ := TestCoreUnsealedBackend(benchhelpers.TBtoT(t), backend)
+	c, _, _ := TestCoreUnsealedBackend(t, backend)
 	return c, c.expiration
 }
 
@@ -699,7 +698,7 @@ func BenchmarkExpiration_Restore_InMem(b *testing.B) {
 }
 
 func benchmarkExpirationBackend(b *testing.B, physicalBackend physical.Backend, numLeases int) {
-	c, _, _ := TestCoreUnsealedBackend(benchhelpers.TBtoT(b), physicalBackend)
+	c, _, _ := TestCoreUnsealedBackend(b, physicalBackend)
 	exp := c.expiration
 	noop := &NoopBackend{}
 	view := NewBarrierView(c.barrier, "logical/")
@@ -768,7 +767,7 @@ func BenchmarkExpiration_Create_Leases(b *testing.B) {
 		b.Fatal(err)
 	}
 
-	c, _, _ := TestCoreUnsealedBackend(benchhelpers.TBtoT(b), inm)
+	c, _, _ := TestCoreUnsealedBackend(b, inm)
 	exp := c.expiration
 	noop := &NoopBackend{}
 	view := NewBarrierView(c.barrier, "logical/")
@@ -856,10 +855,7 @@ func TestExpiration_Restore(t *testing.T) {
 	}
 
 	// Stop everything
-	err = c.stopExpiration()
-	if err != nil {
-		t.Fatalf("err: %v", err)
-	}
+	stopExpiration(t, c)
 
 	if exp.leaseCount != 0 {
 		t.Fatalf("expected %v leases, got %v", 0, exp.leaseCount)
@@ -3009,6 +3005,23 @@ func registerOneLease(t *testing.T, ctx context.Context, exp *ExpirationManager)
 	return leaseID
 }
 
+// stopExpiration is a test helper which allows us to safely teardown the
+// expiration manager.  This preserves the shutdown order of Core for these few
+// outlier tests that (previously) directly called [Core].stopExpiration().
+func stopExpiration(t *testing.T, core *Core) {
+	t.Helper()
+	core.stopActivityLog()
+	err := core.teardownCensusManager()
+	if err != nil {
+		t.Fatalf("error stopping census manager: %v", err)
+	}
+
+	err = core.stopExpiration()
+	if err != nil {
+		t.Fatalf("error stopping expiration manager: %v", err)
+	}
+}
+
 func TestExpiration_MarkIrrevocable(t *testing.T) {
 	c, _, _ := TestCoreUnsealed(t)
 	exp := c.expiration
@@ -3061,10 +3074,7 @@ func TestExpiration_MarkIrrevocable(t *testing.T) {
 	}
 
 	// stop and restore to verify that irrevocable leases are properly loaded from storage
-	err = c.stopExpiration()
-	if err != nil {
-		t.Fatalf("error stopping expiration manager: %v", err)
-	}
+	stopExpiration(t, c)
 
 	err = exp.Restore(nil)
 	if err != nil {
@@ -3154,10 +3164,7 @@ func TestExpiration_StopClearsIrrevocableCache(t *testing.T) {
 	exp.markLeaseIrrevocable(ctx, le, fmt.Errorf("test irrevocable error"))
 	exp.pendingLock.Unlock()
 
-	err = c.stopExpiration()
-	if err != nil {
-		t.Fatalf("error stopping expiration manager: %v", err)
-	}
+	stopExpiration(t, c)
 
 	if _, ok := exp.irrevocable.Load(leaseID); ok {
 		t.Error("expiration manager irrevocable cache should be cleared on stop")
diff --git a/vault/expiration_testing_util_common.go b/vault/expiration_testing_util_common.go
index 57b1718e5b5..bc6e3aafba2 100644
--- a/vault/expiration_testing_util_common.go
+++ b/vault/expiration_testing_util_common.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/expiration_util.go b/vault/expiration_util.go
deleted file mode 100644
index f59f36af3af..00000000000
--- a/vault/expiration_util.go
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-//go:build !enterprise
-
-package vault
-
-import (
-	"fmt"
-
-	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/sdk/logical"
-)
-
-func (m *ExpirationManager) leaseView(*namespace.Namespace) *BarrierView {
-	return m.idView
-}
-
-func (m *ExpirationManager) tokenIndexView(*namespace.Namespace) *BarrierView {
-	return m.tokenView
-}
-
-func (m *ExpirationManager) collectLeases() (map[*namespace.Namespace][]string, int, error) {
-	leaseCount := 0
-	existing := make(map[*namespace.Namespace][]string)
-	keys, err := logical.CollectKeys(m.quitContext, m.leaseView(namespace.RootNamespace))
-	if err != nil {
-		return nil, 0, fmt.Errorf("failed to scan for leases: %w", err)
-	}
-	existing[namespace.RootNamespace] = keys
-	leaseCount += len(keys)
-	return existing, leaseCount, nil
-}
diff --git a/vault/expiration_util_ce.go b/vault/expiration_util_ce.go
new file mode 100644
index 00000000000..18d5b4f66c5
--- /dev/null
+++ b/vault/expiration_util_ce.go
@@ -0,0 +1,37 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"fmt"
+
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+func (m *ExpirationManager) leaseView(*namespace.Namespace) *BarrierView {
+	return m.idView
+}
+
+func (m *ExpirationManager) tokenIndexView(*namespace.Namespace) *BarrierView {
+	return m.tokenView
+}
+
+func (m *ExpirationManager) collectLeases() (map[*namespace.Namespace][]string, int, error) {
+	leaseCount := 0
+	existing := make(map[*namespace.Namespace][]string)
+	keys, err := logical.CollectKeys(m.quitContext, m.leaseView(namespace.RootNamespace))
+	if err != nil {
+		return nil, 0, fmt.Errorf("failed to scan for leases: %w", err)
+	}
+	existing[namespace.RootNamespace] = keys
+	leaseCount += len(keys)
+	return existing, leaseCount, nil
+}
+
+func (m *ExpirationManager) removeIrrevocableLeasesEnabled(c *Core) bool {
+	return false
+}
diff --git a/vault/expiration_util_ce_test.go b/vault/expiration_util_ce_test.go
new file mode 100644
index 00000000000..ed192f99011
--- /dev/null
+++ b/vault/expiration_util_ce_test.go
@@ -0,0 +1,18 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestExpiration_IrrevocableLeaseRemovalDisabled verifies that the irrevocable lease removal is disabled on Vault CE
+func TestExpiration_IrrevocableLeaseRemovalDisabled(t *testing.T) {
+	exp := mockExpiration(t)
+	require.Equal(t, false, exp.irrevocableLeaseRemovalEnabled)
+}
diff --git a/vault/extended_system_view.go b/vault/extended_system_view.go
new file mode 100644
index 00000000000..b80a9c682da
--- /dev/null
+++ b/vault/extended_system_view.go
@@ -0,0 +1,144 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package vault
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+var _ logical.ExtendedSystemView = (*extendedSystemViewImpl)(nil)
+
+type extendedSystemViewImpl struct {
+	dynamicSystemView
+}
+
+func (e extendedSystemViewImpl) Auditor() logical.Auditor {
+	return genericAuditor{
+		mountType: e.mountEntry.Type,
+		namespace: e.mountEntry.Namespace(),
+		c:         e.core,
+	}
+}
+
+func (e extendedSystemViewImpl) ForwardGenericRequest(ctx context.Context, req *logical.Request) (*logical.Response, error) {
+	// Forward the request if allowed
+	if couldForward(e.core) {
+		ctx = namespace.ContextWithNamespace(ctx, e.mountEntry.Namespace())
+		ctx = logical.IndexStateContext(ctx, &logical.WALState{})
+		ctx = context.WithValue(ctx, ctxKeyForwardedRequestMountAccessor{}, e.mountEntry.Accessor)
+		return forward(ctx, e.core, req)
+	}
+
+	return nil, logical.ErrReadOnly
+}
+
+// SudoPrivilege returns true if given path has sudo privileges
+// for the given client token
+func (e extendedSystemViewImpl) SudoPrivilege(ctx context.Context, path string, token string) bool {
+	// Resolve the token policy
+	te, err := e.core.tokenStore.Lookup(ctx, token)
+	if err != nil {
+		e.core.logger.Error("failed to lookup sudo token", "error", err)
+		return false
+	}
+
+	// Ensure the token is valid
+	if te == nil {
+		e.core.logger.Error("entry not found for given token")
+		return false
+	}
+
+	policyNames := make(map[string][]string)
+	// Add token policies
+	policyNames[te.NamespaceID] = append(policyNames[te.NamespaceID], te.Policies...)
+
+	tokenNS, err := NamespaceByID(ctx, te.NamespaceID, e.core)
+	if err != nil {
+		e.core.logger.Error("failed to lookup token namespace", "error", err)
+		return false
+	}
+	if tokenNS == nil {
+		e.core.logger.Error("failed to lookup token namespace", "error", namespace.ErrNoNamespace)
+		return false
+	}
+
+	// Add identity policies from all the namespaces
+	entity, identityPolicies, err := e.core.fetchEntityAndDerivedPolicies(ctx, tokenNS, te.EntityID, te.NoIdentityPolicies)
+	if err != nil {
+		e.core.logger.Error("failed to fetch identity policies", "error", err)
+		return false
+	}
+	for nsID, nsPolicies := range identityPolicies {
+		policyNames[nsID] = append(policyNames[nsID], nsPolicies...)
+	}
+
+	tokenCtx := namespace.ContextWithNamespace(ctx, tokenNS)
+
+	// Add the inline policy if it's set
+	policies := make([]*Policy, 0)
+	if te.InlinePolicy != "" {
+		// TODO (HCL_DUP_KEYS_DEPRECATION): return to ParseACLPolicy once the deprecation is done
+		inlinePolicy, duplicate, err := ParseACLPolicyCheckDuplicates(tokenNS, te.InlinePolicy)
+		if err != nil {
+			e.core.logger.Error("failed to parse the token's inline policy", "error", err)
+			return false
+		}
+		if duplicate {
+			e.core.logger.Warn("HCL inline policy contains duplicate attributes, which will no longer be supported in a future version", "namespace", tokenNS.Path)
+		}
+		policies = append(policies, inlinePolicy)
+	}
+
+	// Construct the corresponding ACL object. Derive and use a new context that
+	// uses the req.ClientToken's namespace
+	acl, err := e.core.policyStore.ACL(tokenCtx, entity, policyNames, policies...)
+	if err != nil {
+		e.core.logger.Error("failed to retrieve ACL for token's policies", "token_policies", te.Policies, "error", err)
+		return false
+	}
+
+	// The operation type isn't important here as this is run from a path the
+	// user has already been given access to; we only care about whether they
+	// have sudo. Note that we use root context because the path that comes in
+	// must be fully-qualified already so we don't want AllowOperation to
+	// prepend a namespace prefix onto it.
+	req := new(logical.Request)
+	req.Operation = logical.ReadOperation
+	req.Path = path
+	authResults := acl.AllowOperation(namespace.RootContext(ctx), req, true)
+	return authResults.RootPrivs
+}
+
+func (e extendedSystemViewImpl) APILockShouldBlockRequest() (bool, error) {
+	mountEntry := e.mountEntry
+	if mountEntry == nil {
+		return false, fmt.Errorf("no mount entry")
+	}
+	ns := mountEntry.Namespace()
+
+	if err := e.core.entBlockRequestIfError(ns.Path, mountEntry.Path); err != nil {
+		return true, nil
+	}
+
+	return false, nil
+}
+
+func (e extendedSystemViewImpl) RequestWellKnownRedirect(ctx context.Context, src, dest string) error {
+	return e.core.WellKnownRedirects.TryRegister(ctx, e.core, e.mountEntry.UUID, src, dest)
+}
+
+func (e extendedSystemViewImpl) DeregisterWellKnownRedirect(ctx context.Context, src string) bool {
+	return e.core.WellKnownRedirects.DeregisterSource(e.mountEntry.UUID, src)
+}
+
+// GetPinnedPluginVersion implements logical.ExtendedSystemView.
+func (e extendedSystemViewImpl) GetPinnedPluginVersion(ctx context.Context, pluginType consts.PluginType, pluginName string) (*pluginutil.PinnedVersion, error) {
+	return e.core.pluginCatalog.GetPinnedVersion(ctx, pluginType, pluginName)
+}
diff --git a/vault/extended_system_view_stubs_oss.go b/vault/extended_system_view_stubs_oss.go
new file mode 100644
index 00000000000..1095a2138bf
--- /dev/null
+++ b/vault/extended_system_view_stubs_oss.go
@@ -0,0 +1,22 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// extendedSystemView (Vault Community edition) is a logical.SystemView
+// that is extended with logical.ExtendedSystemView and SudoPrivilege
+type extendedSystemView interface {
+	logical.SystemView
+	logical.ExtendedSystemView
+	// SudoPrivilege won't work over the plugin system so we keep it here
+	// instead of in sdk/logical to avoid exposing to plugins
+	SudoPrivilege(context.Context, string, string) bool
+}
diff --git a/vault/external_plugin_container_test.go b/vault/external_plugin_container_test.go
index 5bca8b9eb98..3aa429c8ad9 100644
--- a/vault/external_plugin_container_test.go
+++ b/vault/external_plugin_container_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -84,6 +84,7 @@ func TestExternalPluginInContainer_MountAndUnmount(t *testing.T) {
 	})
 
 	t.Run("rootless runsc", func(t *testing.T) {
+		t.Skip("Temporarily skipping due to environment breakage")
 		if _, err := exec.LookPath("runsc"); err != nil {
 			t.Skip("Skipping test as runsc not found on path")
 		}
diff --git a/vault/external_plugin_test.go b/vault/external_plugin_test.go
index 03151d985e9..ca13d7464a0 100644
--- a/vault/external_plugin_test.go
+++ b/vault/external_plugin_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/external_tests/activity/activity_util.go b/vault/external_tests/activity/activity_util.go
new file mode 100644
index 00000000000..e21c5d8c41d
--- /dev/null
+++ b/vault/external_tests/activity/activity_util.go
@@ -0,0 +1,48 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package activity
+
+import (
+	"testing"
+	"time"
+
+	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/vault"
+	"github.com/mitchellh/mapstructure"
+)
+
+type QueryResponse struct {
+	StartTime   string                     `json:"start_time" mapstructure:"start_time"`
+	EndTime     string                     `json:"end_time" mapstructure:"end_time"`
+	ByNamespace []*vault.ResponseNamespace `json:"by_namespace"`
+	Total       *vault.ResponseCounts      `json:"total"`
+}
+
+func expectEndTime(t *testing.T, expected time.Time, resp *api.Secret) {
+	t.Helper()
+
+	qr := QueryResponse{}
+	mapstructure.Decode(resp.Data, &qr)
+	parsedTime, err := time.Parse(time.RFC3339, qr.EndTime)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !expected.Equal(parsedTime) {
+		t.Errorf("wrong end time, expected %v actual %v", expected, parsedTime)
+	}
+}
+
+func expectStartTime(t *testing.T, expected time.Time, resp *api.Secret) {
+	t.Helper()
+
+	var qr QueryResponse
+	mapstructure.Decode(resp.Data, &qr)
+	parsedTime, err := time.Parse(time.RFC3339, qr.StartTime)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !expected.Equal(parsedTime) {
+		t.Errorf("wrong start time, expected %v actual %v", expected, parsedTime)
+	}
+}
diff --git a/vault/external_tests/activity_testonly/acme_regeneration_oss_test.go b/vault/external_tests/activity_testonly/acme_regeneration_oss_test.go
new file mode 100644
index 00000000000..5e181c24fb3
--- /dev/null
+++ b/vault/external_tests/activity_testonly/acme_regeneration_oss_test.go
@@ -0,0 +1,95 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build testonly && !enterprise
+
+package activity_testonly
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/vault/helper/testhelpers/minimal"
+	"github.com/hashicorp/vault/helper/timeutil"
+	"github.com/hashicorp/vault/sdk/helper/clientcountutil"
+	"github.com/hashicorp/vault/sdk/helper/clientcountutil/generation"
+	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
+)
+
+// TestACMERegeneration_RegenerateWithCurrentMonth writes segments for previous
+// months and the current month. The test regenerates the precomputed queries,
+// and verifies that the counts are correct when querying both with and without
+// the current month
+func TestACMERegeneration_RegenerateWithCurrentMonth(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, &vault.CoreConfig{EnableRaw: true})
+	client := cluster.Cores[0].Client
+	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+		"enabled": "enable",
+	})
+	require.NoError(t, err)
+	now := time.Now().UTC()
+	_, err = clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(3).
+		// 3 months ago, 15 non-entity clients and 10 ACME clients
+		NewClientsSeen(15, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(10, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewPreviousMonthData(2).
+		// 2 months ago, 7 new non-entity clients and 5 new ACME clients
+		RepeatedClientsSeen(2, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(7, clientcountutil.WithClientType("non-entity-token")).
+		RepeatedClientsSeen(5, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewClientsSeen(5, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewPreviousMonthData(1).
+		// 1 months ago, 4 new non-entity clients and 2 new ACME clients
+		RepeatedClientsSeen(3, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(4, clientcountutil.WithClientType("non-entity-token")).
+		RepeatedClientsSeen(1, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewClientsSeen(2, clientcountutil.WithClientType(vault.ACMEActivityType)).
+
+		// current month, 10 new non-entity clients and 20 new ACME clients
+		NewCurrentMonthData().
+		NewClientsSeen(10, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(20, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES)
+
+	require.NoError(t, err)
+
+	forceRegeneration(t, cluster)
+
+	startFiveMonthsAgo := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(5, now))
+	endPastMonth := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now))
+	// current month isn't included in this query
+	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+		"start_time": {startFiveMonthsAgo.Format(time.RFC3339)},
+		"end_time":   {endPastMonth.Format(time.RFC3339)},
+	})
+	require.NoError(t, err)
+	require.Equal(t, vault.ResponseCounts{
+		NonEntityClients: 26,
+		Clients:          43,
+		ACMEClients:      17,
+	}, getTotals(t, resp))
+	// verify start and end times in the response
+	require.Equal(t, resp.Data["start_time"], startFiveMonthsAgo.UTC().Format(time.RFC3339))
+	require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+
+	// explicitly include the current month in the request
+	// the given end time is adjusted to the last month, excluding the current month at the API
+	respWithCurrent, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+		"start_time": {startFiveMonthsAgo.Format(time.RFC3339)},
+		"end_time":   {timeutil.EndOfMonth(now).Format(time.RFC3339)},
+	})
+	// verify start and end times in the response
+	// end time is expected to be adjusted to the past month, excluding the current month
+	require.Equal(t, resp.Data["start_time"], startFiveMonthsAgo.UTC().Format(time.RFC3339))
+	require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+	require.NoError(t, err)
+	require.Equal(t, vault.ResponseCounts{
+		NonEntityClients: 26,
+		Clients:          43,
+		ACMEClients:      17,
+	}, getTotals(t, respWithCurrent))
+}
diff --git a/vault/external_tests/activity_testonly/acme_regeneration_test.go b/vault/external_tests/activity_testonly/acme_regeneration_test.go
new file mode 100644
index 00000000000..21de5f381ab
--- /dev/null
+++ b/vault/external_tests/activity_testonly/acme_regeneration_test.go
@@ -0,0 +1,129 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build testonly
+
+package activity_testonly
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/vault/helper/testhelpers"
+	"github.com/hashicorp/vault/helper/testhelpers/minimal"
+	"github.com/hashicorp/vault/helper/timeutil"
+	"github.com/hashicorp/vault/sdk/helper/clientcountutil"
+	"github.com/hashicorp/vault/sdk/helper/clientcountutil/generation"
+	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
+)
+
+func forceRegeneration(t *testing.T, cluster *vault.TestCluster) {
+	t.Helper()
+	client := cluster.Cores[0].Client
+	_, err := client.Logical().Delete("sys/raw/sys/counters/activity/acme-regeneration")
+	require.NoError(t, err)
+	testhelpers.EnsureCoresSealed(t, cluster)
+	testhelpers.EnsureCoresUnsealed(t, cluster)
+	testhelpers.WaitForActiveNode(t, cluster)
+
+	testhelpers.RetryUntil(t, 10*time.Second, func() error {
+		r, err := client.Logical().Read("sys/raw/sys/counters/activity/acme-regeneration")
+		if err != nil {
+			return err
+		}
+		if r == nil {
+			return errors.New("no response")
+		}
+		return nil
+	})
+}
+
+// TestACMERegeneration_RegenerateMuchOlder creates segments 5 months ago, 4
+// months ago, and 3 months ago. The test regenerates the precomputed queries
+// and then verifies that this older data is included in the generated results.
+func TestACMERegeneration_RegenerateMuchOlder(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, &vault.CoreConfig{EnableRaw: true})
+	client := cluster.Cores[0].Client
+
+	now := time.Now().UTC()
+	_, err := clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(5).
+		// 5 months ago, 15 non-entity clients and 10 ACME clients
+		NewClientsSeen(15, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(10, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewPreviousMonthData(4).
+		// 4 months ago, 7 new non-entity clients and 5 new ACME clients
+		RepeatedClientsSeen(2, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(7, clientcountutil.WithClientType("non-entity-token")).
+		RepeatedClientsSeen(5, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewClientsSeen(5, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewPreviousMonthData(3).
+		// 3 months ago, 4 new non-entity clients and 2 new ACME clients
+		RepeatedClientsSeen(3, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(4, clientcountutil.WithClientType("non-entity-token")).
+		RepeatedClientsSeen(1, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewClientsSeen(2, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES)
+
+	require.NoError(t, err)
+
+	forceRegeneration(t, cluster)
+	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+		"start_time": {timeutil.StartOfMonth(timeutil.MonthsPreviousTo(5, now)).Format(time.RFC3339)},
+		"end_time":   {timeutil.EndOfMonth(now).Format(time.RFC3339)},
+	})
+	require.NoError(t, err)
+	require.Equal(t, vault.ResponseCounts{
+		NonEntityClients: 26,
+		Clients:          43,
+		ACMEClients:      17,
+	}, getTotals(t, resp))
+}
+
+// TestACMERegeneration_RegeneratePreviousMonths creates segments for the
+// previous 3 months, and no segments for the current month. The test verifies
+// that the older data gets regenerated
+func TestACMERegeneration_RegeneratePreviousMonths(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, &vault.CoreConfig{EnableRaw: true})
+	client := cluster.Cores[0].Client
+
+	now := time.Now().UTC()
+	_, err := clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(3).
+		// 3 months ago, 15 non-entity clients and 10 ACME clients
+		NewClientsSeen(15, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(10, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewPreviousMonthData(2).
+		// 2 months ago, 7 new non-entity clients and 5 new ACME clients
+		RepeatedClientsSeen(2, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(7, clientcountutil.WithClientType("non-entity-token")).
+		RepeatedClientsSeen(5, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewClientsSeen(5, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewPreviousMonthData(1).
+		// 1 months ago, 4 new non-entity clients and 2 new ACME clients
+		RepeatedClientsSeen(3, clientcountutil.WithClientType("non-entity-token")).
+		NewClientsSeen(4, clientcountutil.WithClientType("non-entity-token")).
+		RepeatedClientsSeen(1, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		NewClientsSeen(2, clientcountutil.WithClientType(vault.ACMEActivityType)).
+		Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES)
+
+	require.NoError(t, err)
+
+	forceRegeneration(t, cluster)
+
+	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+		"start_time": {timeutil.StartOfMonth(timeutil.MonthsPreviousTo(5, now)).Format(time.RFC3339)},
+		"end_time":   {timeutil.EndOfMonth(now).Format(time.RFC3339)},
+	})
+	require.NoError(t, err)
+	require.Equal(t, vault.ResponseCounts{
+		NonEntityClients: 26,
+		Clients:          43,
+		ACMEClients:      17,
+	}, getTotals(t, resp))
+}
diff --git a/vault/external_tests/activity_testonly/activity_testonly_oss_test.go b/vault/external_tests/activity_testonly/activity_testonly_oss_test.go
index dbb11c84533..70018c31221 100644
--- a/vault/external_tests/activity_testonly/activity_testonly_oss_test.go
+++ b/vault/external_tests/activity_testonly/activity_testonly_oss_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build testonly && !enterprise
@@ -7,13 +7,22 @@ package activity_testonly
 
 import (
 	"context"
+	"fmt"
+	"math"
 	"testing"
 	"time"
 
+	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/testhelpers"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/helper/testhelpers/minimal"
 	"github.com/hashicorp/vault/helper/timeutil"
+	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/helper/clientcountutil"
 	"github.com/hashicorp/vault/sdk/helper/clientcountutil/generation"
+	"github.com/hashicorp/vault/vault"
+	"github.com/mitchellh/mapstructure"
 	"github.com/stretchr/testify/require"
 )
 
@@ -59,3 +68,584 @@ func Test_ActivityLog_Disable(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, ts.UTC(), timeutil.StartOfPreviousMonth(now.UTC()))
 }
+
+// Test_ActivityLog_LoseLeadership writes data for the second last month, then causes the
+// active node to lose leadership. Once a new node becomes the leader, then the
+// test queries for the second last month data and verifies that the data from
+// before the leadership transfer is returned
+func Test_ActivityLog_LoseLeadership(t *testing.T) {
+	t.Parallel()
+	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+		NumCores:    2,
+	})
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	active := testhelpers.DeriveStableActiveCore(t, cluster)
+	client := active.Client
+	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+		"enabled": "enable",
+	})
+	require.NoError(t, err)
+
+	_, err = clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(1).
+		NewClientsSeen(10).
+		Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES, generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES)
+	require.NoError(t, err)
+	now := time.Now().UTC()
+
+	testhelpers.EnsureCoreSealed(t, active)
+	newActive := testhelpers.WaitForActiveNode(t, cluster)
+	standby := active
+	testhelpers.WaitForStandbyNode(t, standby)
+	testhelpers.EnsureCoreUnsealed(t, cluster, standby)
+
+	endPastMonth := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now))
+	startPastMonth := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(1, now))
+	resp, err := newActive.Client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+		"end_time":   {endPastMonth.Format(time.RFC3339)},
+		"start_time": {startPastMonth.Format(time.RFC3339)},
+	})
+	require.NoError(t, err)
+	// verify start and end times in the response
+	require.Equal(t, resp.Data["start_time"], startPastMonth.UTC().Format(time.RFC3339))
+	require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+	monthResponse := getMonthsData(t, resp)
+	require.Len(t, monthResponse, 1)
+	require.Equal(t, 10, monthResponse[0].NewClients.Counts.Clients)
+}
+
+// Test_ActivityLog_ClientsOverlapping writes data for the second last month and
+// the previous month. In the second last month, 7 new clients are seen. In the previous
+// month, there are 5 repeated and 2 new clients. The test queries over the
+// second last and previous months, and verifies that the repeated clients are not
+// considered new
+func Test_ActivityLog_ClientsOverlapping(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+		"enabled": "enable",
+	})
+	require.NoError(t, err)
+	_, err = clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(2).
+		NewClientsSeen(7).
+		NewPreviousMonthData(1).
+		RepeatedClientsSeen(5).
+		NewClientsSeen(2).
+		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+	endPastMonth := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now))
+	startTwoMonthsAgo := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(2, now))
+	// query from the beginning of the second last month to the end of the previous month
+	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+		"end_time":   {endPastMonth.Format(time.RFC3339)},
+		"start_time": {startTwoMonthsAgo.Format(time.RFC3339)},
+	})
+	require.NoError(t, err)
+	// verify start and end times in the response
+	require.Equal(t, resp.Data["start_time"], startTwoMonthsAgo.UTC().Format(time.RFC3339))
+	require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+	monthsResponse := getMonthsData(t, resp)
+	require.Len(t, monthsResponse, 2)
+	for _, month := range monthsResponse {
+		ts, err := time.Parse(time.RFC3339, month.Timestamp)
+		require.NoError(t, err)
+		// The previous month should have a total of 7 clients
+		// 2 of those will be considered new
+		if ts.UTC().Equal(timeutil.StartOfMonth(timeutil.MonthsPreviousTo(1, now))) {
+			require.Equal(t, month.Counts.Clients, 7)
+			require.Equal(t, month.NewClients.Counts.Clients, 2)
+		} else {
+			// All clients will be considered new for the second last month
+			require.Equal(t, month.Counts.Clients, 7)
+			require.Equal(t, month.NewClients.Counts.Clients, 7)
+
+		}
+	}
+}
+
+// Test_ActivityLog_ClientsNewCurrentMonth writes data for the second last month and
+// past month with 5 repeated clients and 2 new clients in the past month.
+// The test then queries the activity log for only the past month, and
+// verifies that all 7 clients seen the past month are considered new.
+func Test_ActivityLog_ClientsNewCurrentMonth(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+		"enabled": "enable",
+	})
+	require.NoError(t, err)
+	_, err = clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(2).
+		NewClientsSeen(5).
+		NewPreviousMonthData(1).
+		RepeatedClientsSeen(5).
+		NewClientsSeen(2).
+		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+	endPastMonth := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now))
+	startPastMonth := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(1, now))
+	// query from the beginning of the second last month to the end of the previous month
+	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+		"end_time":   {endPastMonth.Format(time.RFC3339)},
+		"start_time": {startPastMonth.Format(time.RFC3339)},
+	})
+	// verify start and end times in the response
+	require.Equal(t, resp.Data["start_time"], startPastMonth.UTC().Format(time.RFC3339))
+	require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+	require.NoError(t, err)
+	monthsResponse := getMonthsData(t, resp)
+	require.Len(t, monthsResponse, 1)
+	require.Equal(t, 7, monthsResponse[0].NewClients.Counts.Clients)
+}
+
+// Test_ActivityLog_EmptyDataMonths writes data for only the past month,
+// then queries a timeframe of several months in the past to now. The test
+// verifies that empty months of data are returned for the past, and the past
+// month data is correct.
+func Test_ActivityLog_EmptyDataMonths(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+		"enabled": "enable",
+	})
+	require.NoError(t, err)
+	_, err = clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(1).
+		NewClientsSeen(10).
+		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+	endPastMonth := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now))
+	startFourMonthsAgo := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(4, now))
+	// query from the beginning of 4 months ago to the end of past month
+	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+		"end_time":   {endPastMonth.Format(time.RFC3339)},
+		"start_time": {startFourMonthsAgo.Format(time.RFC3339)},
+	})
+	require.NoError(t, err)
+	// verify start and end times in the response
+	require.Equal(t, resp.Data["start_time"], startFourMonthsAgo.UTC().Format(time.RFC3339))
+	require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+	monthsResponse := getMonthsData(t, resp)
+
+	require.Len(t, monthsResponse, 4)
+	for _, month := range monthsResponse {
+		ts, err := time.Parse(time.RFC3339, month.Timestamp)
+		require.NoError(t, err)
+		// past month should have data
+		if ts.UTC().Equal(timeutil.StartOfMonth(timeutil.MonthsPreviousTo(1, now))) {
+			require.Equal(t, month.Counts.Clients, 10)
+		} else {
+			// other months should be empty
+			require.Nil(t, month.Counts)
+		}
+	}
+}
+
+// Test_ActivityLog_FutureEndDate queries a start time from the past
+// and an end date in the future. The test
+// verifies that the current month is returned in the response.
+func Test_ActivityLog_FutureEndDate(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+		"enabled": "enable",
+	})
+	require.NoError(t, err)
+	_, err = clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(1).
+		NewClientsSeen(10).
+		NewCurrentMonthData().
+		NewClientsSeen(10).
+		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+	startThreeMonthsAgo := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(3, now))
+	// query from the beginning of 3 months ago to beginning of next month
+	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+		"end_time":   {timeutil.StartOfNextMonth(now).Format(time.RFC3339)},
+		"start_time": {startThreeMonthsAgo.Format(time.RFC3339)},
+	})
+	require.NoError(t, err)
+	endPastMonth := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now))
+	// verify start and end times in the response
+	// end time must be adjusted to past month if within current month or in future date
+	require.Equal(t, resp.Data["start_time"], startThreeMonthsAgo.UTC().Format(time.RFC3339))
+	require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+	monthsResponse := getMonthsData(t, resp)
+
+	require.Len(t, monthsResponse, 3)
+
+	// Get the last month of data in the slice
+	expectedCurrentMonthData := monthsResponse[2]
+	expectedTime, err := time.Parse(time.RFC3339, expectedCurrentMonthData.Timestamp)
+	require.NoError(t, err)
+	if !timeutil.IsCurrentMonth(expectedTime, endPastMonth) {
+		t.Fatalf("final month data is not past month")
+	}
+}
+
+// Test_ActivityLog_ClientTypeResponse runs for each client type. In the
+// subtests, 10 clients of the type are created and the test verifies that the
+// activity log query response returns 10 clients of that type at every level of
+// the response hierarchy
+func Test_ActivityLog_ClientTypeResponse(t *testing.T) {
+	t.Parallel()
+	for _, tc := range allClientTypeTestCases {
+		tc := tc
+		t.Run(tc.clientType, func(t *testing.T) {
+			t.Parallel()
+			cluster := minimal.NewTestSoloCluster(t, nil)
+			client := cluster.Cores[0].Client
+			_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+				"enabled": "enable",
+			})
+			_, err = clientcountutil.NewActivityLogData(client).
+				NewPreviousMonthData(1).
+				NewClientsSeen(10, clientcountutil.WithClientType(tc.clientType)).
+				Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES, generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES)
+			require.NoError(t, err)
+
+			now := time.Now().UTC()
+			endPastMonth := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now))
+			startPastMonth := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(1, now))
+			resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+				"end_time":   {endPastMonth.Format(time.RFC3339)},
+				"start_time": {startPastMonth.Format(time.RFC3339)},
+			})
+			require.NoError(t, err)
+			// verify start and end times in the response
+			require.Equal(t, resp.Data["start_time"], startPastMonth.UTC().Format(time.RFC3339))
+			require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+
+			total := getTotals(t, resp)
+			require.Equal(t, 10, tc.responseCountsFn(total))
+			require.Equal(t, 10, total.Clients)
+
+			byNamespace := getNamespaceData(t, resp)
+			require.Equal(t, 10, tc.responseCountsFn(byNamespace[0].Counts))
+			require.Equal(t, 10, tc.responseCountsFn(*byNamespace[0].Mounts[0].Counts))
+			require.Equal(t, 10, byNamespace[0].Counts.Clients)
+			require.Equal(t, 10, byNamespace[0].Mounts[0].Counts.Clients)
+
+			byMonth := getMonthsData(t, resp)
+			require.Equal(t, 10, tc.responseCountsFn(*byMonth[0].NewClients.Counts))
+			require.Equal(t, 10, tc.responseCountsFn(*byMonth[0].Counts))
+			require.Equal(t, 10, tc.responseCountsFn(byMonth[0].Namespaces[0].Counts))
+			require.Equal(t, 10, tc.responseCountsFn(*byMonth[0].Namespaces[0].Mounts[0].Counts))
+			require.Equal(t, 10, byMonth[0].NewClients.Counts.Clients)
+			require.Equal(t, 10, byMonth[0].Counts.Clients)
+			require.Equal(t, 10, byMonth[0].Namespaces[0].Counts.Clients)
+			require.Equal(t, 10, byMonth[0].Namespaces[0].Mounts[0].Counts.Clients)
+		})
+
+	}
+}
+
+// Test_ActivityLog_MountDeduplication writes data for the second last
+// month across 4 mounts. The cubbyhole and sys mounts have clients in the
+// past month as well. The test verifies that the mount counts are correctly
+// summed in the results when the second last month and past month are queried.
+func Test_ActivityLog_MountDeduplication(t *testing.T) {
+	t.Parallel()
+
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+		"enabled": "enable",
+	})
+	require.NoError(t, err)
+	now := time.Now().UTC()
+
+	_, err = clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(2).
+		NewClientSeen(clientcountutil.WithClientMount("sys")).
+		NewClientSeen(clientcountutil.WithClientMount("secret")).
+		NewClientSeen(clientcountutil.WithClientMount("cubbyhole")).
+		NewClientSeen(clientcountutil.WithClientMount("identity")).
+		NewPreviousMonthData(1).
+		NewClientSeen(clientcountutil.WithClientMount("cubbyhole")).
+		NewClientSeen(clientcountutil.WithClientMount("sys")).
+		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
+	require.NoError(t, err)
+
+	endPastMonth := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now))
+	startTwoMonthsAgo := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(2, now))
+	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+		"end_time":   {endPastMonth.Format(time.RFC3339)},
+		"start_time": {startTwoMonthsAgo.Format(time.RFC3339)},
+	})
+	// verify start and end times in the response
+	require.Equal(t, resp.Data["start_time"], startTwoMonthsAgo.UTC().Format(time.RFC3339))
+	require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+
+	require.NoError(t, err)
+	byNamespace := getNamespaceData(t, resp)
+	require.Len(t, byNamespace, 1)
+	require.Len(t, byNamespace[0].Mounts, 4)
+	mountSet := make(map[string]int, 4)
+	for _, mount := range byNamespace[0].Mounts {
+		mountSet[mount.MountPath] = mount.Counts.Clients
+	}
+	require.Equal(t, map[string]int{
+		"identity/":  1,
+		"sys/":       2,
+		"cubbyhole/": 2,
+		"secret/":    1,
+	}, mountSet)
+}
+
+// TestHandleQuery_MultipleMounts creates a cluster with
+// two userpass mounts. It then tests verifies that
+// the total new counts are calculated within a reasonably level of accuracy for
+// various numbers of clients in each mount.
+func TestHandleQuery_MultipleMounts(t *testing.T) {
+	tests := map[string]struct {
+		twoMonthsAgo          [][]int
+		oneMonthAgo           [][]int
+		currentMonth          [][]int
+		expectedNewClients    int
+		expectedTotalAccuracy float64
+	}{
+		"low volume, all mounts": {
+			twoMonthsAgo: [][]int{
+				{20, 20},
+			},
+			oneMonthAgo: [][]int{
+				{30, 30},
+			},
+			currentMonth: [][]int{
+				{40, 40},
+			},
+			expectedNewClients:    80,
+			expectedTotalAccuracy: 1,
+		},
+		"medium volume, all mounts": {
+			twoMonthsAgo: [][]int{
+				{200, 200},
+			},
+			oneMonthAgo: [][]int{
+				{300, 300},
+			},
+			currentMonth: [][]int{
+				{400, 400},
+			},
+			expectedNewClients:    800,
+			expectedTotalAccuracy: 0.98,
+		},
+		"higher volume, all mounts": {
+			twoMonthsAgo: [][]int{
+				{200, 200},
+			},
+			oneMonthAgo: [][]int{
+				{300, 300},
+			},
+			currentMonth: [][]int{
+				{2000, 5000},
+			},
+			expectedNewClients:    7000,
+			expectedTotalAccuracy: 0.95,
+		},
+		"higher volume, no repeats": {
+			twoMonthsAgo: [][]int{
+				{200, 200},
+			},
+			oneMonthAgo: [][]int{
+				{300, 300},
+			},
+			currentMonth: [][]int{
+				{4000, 6000},
+			},
+			expectedNewClients:    10000,
+			expectedTotalAccuracy: 0.98,
+		},
+	}
+
+	for i, tt := range tests {
+		testname := fmt.Sprintf("%s", i)
+		t.Run(testname, func(t *testing.T) {
+			var err error
+			cluster := minimal.NewTestSoloCluster(t, nil)
+			client := cluster.Cores[0].Client
+			_, err = client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+				"enabled": "enable",
+			})
+			require.NoError(t, err)
+
+			// Create two namespaces
+			namespaces := []string{namespace.RootNamespaceID}
+			mounts := make(map[string][]string)
+
+			// Add two userpass mounts to each namespace
+			for _, ns := range namespaces {
+				err = client.WithNamespace(ns).Sys().EnableAuthWithOptions("userpass1", &api.EnableAuthOptions{
+					Type: "userpass",
+				})
+				require.NoError(t, err)
+				err = client.WithNamespace(ns).Sys().EnableAuthWithOptions("userpass2", &api.EnableAuthOptions{
+					Type: "userpass",
+				})
+				require.NoError(t, err)
+				mounts[ns] = []string{"auth/userpass1", "auth/userpass2"}
+			}
+
+			activityLogGenerator := clientcountutil.NewActivityLogData(client)
+
+			// Write three months ago data
+			activityLogGenerator = activityLogGenerator.NewPreviousMonthData(3)
+			for nsIndex, nsId := range namespaces {
+				for mountIndex, mount := range mounts[nsId] {
+					activityLogGenerator = activityLogGenerator.
+						NewClientsSeen(tt.twoMonthsAgo[nsIndex][mountIndex], clientcountutil.WithClientNamespace(nsId), clientcountutil.WithClientMount(mount))
+				}
+			}
+
+			// Write two months ago data
+			activityLogGenerator = activityLogGenerator.NewPreviousMonthData(2)
+			for nsIndex, nsId := range namespaces {
+				for mountIndex, mount := range mounts[nsId] {
+					activityLogGenerator = activityLogGenerator.
+						NewClientsSeen(tt.oneMonthAgo[nsIndex][mountIndex], clientcountutil.WithClientNamespace(nsId), clientcountutil.WithClientMount(mount))
+				}
+			}
+
+			// Write previous month data
+			activityLogGenerator = activityLogGenerator.NewPreviousMonthData(1)
+			for nsIndex, nsPath := range namespaces {
+				for mountIndex, mount := range mounts[nsPath] {
+					activityLogGenerator = activityLogGenerator.
+						RepeatedClientSeen(clientcountutil.WithClientNamespace(nsPath), clientcountutil.WithClientMount(mount)).
+						NewClientsSeen(tt.currentMonth[nsIndex][mountIndex], clientcountutil.WithClientNamespace(nsPath), clientcountutil.WithClientMount(mount))
+				}
+			}
+
+			// Write all the client count data
+			_, err = activityLogGenerator.Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
+			require.NoError(t, err)
+
+			endPastMonth := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, time.Now()).UTC())
+			startThreeMonthsAgo := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(3, time.Now().UTC()))
+
+			// query activity log
+			resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+				"end_time":   {endPastMonth.Format(time.RFC3339)},
+				"start_time": {startThreeMonthsAgo.Format(time.RFC3339)},
+			})
+			require.NoError(t, err)
+			// verify start and end times in the response
+			require.Equal(t, resp.Data["start_time"], startThreeMonthsAgo.UTC().Format(time.RFC3339))
+			require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+
+			// Ensure that the month response is the same as the totals, because all clients
+			// are new clients and there will be no approximation in the single month partial
+			// case
+			monthsRaw, ok := resp.Data["months"]
+			if !ok {
+				t.Fatalf("malformed results. got %v", resp.Data)
+			}
+			monthsResponse := make([]*vault.ResponseMonth, 0)
+			err = mapstructure.Decode(monthsRaw, &monthsResponse)
+
+			currentMonthClients := monthsResponse[len(monthsResponse)-1]
+
+			// Now verify that the new client totals for ALL namespaces are approximately accurate (there are no namespaces in CE)
+			newClientsError := math.Abs((float64)(currentMonthClients.NewClients.Counts.Clients - tt.expectedNewClients))
+			newClientsErrorMargin := newClientsError / (float64)(tt.expectedNewClients)
+			expectedAccuracyCalc := (1 - tt.expectedTotalAccuracy) * 100 / 100
+			if newClientsErrorMargin > expectedAccuracyCalc {
+				t.Fatalf("bad accuracy: expected %+v, found %+v", expectedAccuracyCalc, newClientsErrorMargin)
+			}
+
+			// Verify that the totals for the clients are visibly sensible (that is the total of all the individual new clients per namespace)
+			total := 0
+			for _, newClientCounts := range currentMonthClients.NewClients.Namespaces {
+				total += newClientCounts.Counts.Clients
+			}
+			if diff := math.Abs(float64(currentMonthClients.NewClients.Counts.Clients - total)); diff >= 1 {
+				t.Fatalf("total expected was %d but got %d", currentMonthClients.NewClients.Counts.Clients, total)
+			}
+		})
+	}
+}
+
+// TestActivityLog_CountersAPI_NoErrorOnLoadingClientIDsToMemoryFlag_CE verifies that default counters api is not blocked by clientIDsUsageInfoLoaded flag as it always remains false on CE
+func TestActivityLog_CountersAPI_NoErrorOnLoadingClientIDsToMemoryFlag_CE(t *testing.T) {
+	t.Parallel()
+
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+	core := cluster.Cores[0]
+	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+		"enabled": "enable",
+	})
+	require.NoError(t, err)
+	a := core.GetActivityLog()
+	a.SetEnable(true)
+	now := time.Now().UTC()
+
+	// wait for clientIDs to be loaded into memory
+	verifyClientsLoadedInMemory := func() {
+		corehelpers.RetryUntil(t, 60*time.Second, func() error {
+			if a.GetClientIDsUsageInfoLoaded() {
+				return fmt.Errorf("loaded clientIDs to memory")
+			}
+			return nil
+		})
+	}
+	verifyClientsLoadedInMemory()
+
+	// add some data to previous months
+	_, err = clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(2).
+		NewClientSeen(clientcountutil.WithClientMount("sys")).
+		NewClientSeen(clientcountutil.WithClientMount("secret")).
+		NewClientSeen(clientcountutil.WithClientMount("cubbyhole")).
+		NewClientSeen(clientcountutil.WithClientMount("identity")).
+		NewPreviousMonthData(1).
+		NewClientSeen(clientcountutil.WithClientMount("cubbyhole")).
+		NewClientSeen(clientcountutil.WithClientMount("sys")).
+		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
+	require.NoError(t, err)
+
+	// clientIDs in memory should be 0 as they are not updated in CE
+	require.Len(t, a.GetClientIDsUsageInfo(), 0)
+
+	// default counters api query
+	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{})
+	require.NoError(t, err)
+
+	// verify query response response
+	endPastMonth := timeutil.EndOfMonth(timeutil.MonthsPreviousTo(1, now))
+
+	// start time will be default time for time.Time{} as no start time is specified in input params
+	require.Equal(t, resp.Data["start_time"], time.Time{}.UTC().Format(time.RFC3339))
+	require.Equal(t, resp.Data["end_time"], endPastMonth.UTC().Format(time.RFC3339))
+
+	byNamespace := getNamespaceData(t, resp)
+	require.Len(t, byNamespace, 1)
+	require.Len(t, byNamespace[0].Mounts, 4)
+	mountSet := make(map[string]int, 4)
+	for _, mount := range byNamespace[0].Mounts {
+		mountSet[mount.MountPath] = mount.Counts.Clients
+	}
+	require.Equal(t, map[string]int{
+		"identity/":  1,
+		"sys/":       2,
+		"cubbyhole/": 2,
+		"secret/":    1,
+	}, mountSet)
+}
diff --git a/vault/external_tests/activity_testonly/activity_testonly_test.go b/vault/external_tests/activity_testonly/activity_testonly_test.go
index cde547b58b0..58049ec2e96 100644
--- a/vault/external_tests/activity_testonly/activity_testonly_test.go
+++ b/vault/external_tests/activity_testonly/activity_testonly_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build testonly
@@ -6,16 +6,19 @@
 package activity_testonly
 
 import (
+	"bytes"
 	"context"
+	"encoding/csv"
 	"encoding/json"
+	"io"
+	"strconv"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/hashicorp/vault/api"
-	"github.com/hashicorp/vault/helper/testhelpers"
 	"github.com/hashicorp/vault/helper/testhelpers/minimal"
 	"github.com/hashicorp/vault/helper/timeutil"
-	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/helper/clientcountutil"
 	"github.com/hashicorp/vault/sdk/helper/clientcountutil/generation"
 	"github.com/hashicorp/vault/vault"
@@ -23,170 +26,39 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// Test_ActivityLog_LoseLeadership writes data for this month, then causes the
-// active node to lose leadership. Once a new node becomes the leader, then the
-// test queries for the current month data and verifies that the data from
-// before the leadership transfer is returned
-func Test_ActivityLog_LoseLeadership(t *testing.T) {
-	t.Parallel()
-	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
-		HandlerFunc: vaulthttp.Handler,
-		NumCores:    2,
-	})
-	cluster.Start()
-	defer cluster.Cleanup()
-
-	active := testhelpers.DeriveStableActiveCore(t, cluster)
-	client := active.Client
-	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
-		"enabled": "enable",
-	})
-	require.NoError(t, err)
-
-	_, err = clientcountutil.NewActivityLogData(client).
-		NewCurrentMonthData().
-		NewClientsSeen(10).
-		Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES)
-	require.NoError(t, err)
-	now := time.Now().UTC()
-
-	testhelpers.EnsureCoreSealed(t, active)
-	newActive := testhelpers.WaitForActiveNode(t, cluster)
-	standby := active
-	testhelpers.WaitForStandbyNode(t, standby)
-	testhelpers.EnsureCoreUnsealed(t, cluster, standby)
-
-	resp, err := newActive.Client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
-		"end_time":   {timeutil.EndOfMonth(now).Format(time.RFC3339)},
-		"start_time": {timeutil.StartOfMonth(now).Format(time.RFC3339)},
-	})
-	monthResponse := getMonthsData(t, resp)
-	require.Len(t, monthResponse, 1)
-	require.Equal(t, 10, monthResponse[0].NewClients.Counts.Clients)
-}
-
-// Test_ActivityLog_ClientsOverlapping writes data for the previous month and
-// current month. In the previous month, 7 new clients are seen. In the current
-// month, there are 5 repeated and 2 new clients. The test queries over the
-// previous and current months, and verifies that the repeated clients are not
-// considered new
-func Test_ActivityLog_ClientsOverlapping(t *testing.T) {
-	t.Parallel()
-	cluster := minimal.NewTestSoloCluster(t, nil)
-	client := cluster.Cores[0].Client
-	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
-		"enabled": "enable",
-	})
-	require.NoError(t, err)
-	_, err = clientcountutil.NewActivityLogData(client).
-		NewPreviousMonthData(1).
-		NewClientsSeen(7).
-		NewCurrentMonthData().
-		RepeatedClientsSeen(5).
-		NewClientsSeen(2).
-		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
-	require.NoError(t, err)
-
-	now := time.Now().UTC()
-
-	// query from the beginning of the previous month to the end of this month
-	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
-		"end_time":   {timeutil.EndOfMonth(now).Format(time.RFC3339)},
-		"start_time": {timeutil.StartOfMonth(timeutil.MonthsPreviousTo(1, now)).Format(time.RFC3339)},
-	})
-	require.NoError(t, err)
-	monthsResponse := getMonthsData(t, resp)
-	require.Len(t, monthsResponse, 2)
-	for _, month := range monthsResponse {
-		ts, err := time.Parse(time.RFC3339, month.Timestamp)
-		require.NoError(t, err)
-		// This month should have a total of 7 clients
-		// 2 of those will be considered new
-		if ts.UTC().Equal(timeutil.StartOfMonth(now)) {
-			require.Equal(t, month.Counts.Clients, 7)
-			require.Equal(t, month.NewClients.Counts.Clients, 2)
-		} else {
-			// All clients will be considered new for the previous month
-			require.Equal(t, month.Counts.Clients, 7)
-			require.Equal(t, month.NewClients.Counts.Clients, 7)
-
-		}
-	}
-}
-
-// Test_ActivityLog_ClientsNewCurrentMonth writes data for the past month and
-// current month with 5 repeated clients and 2 new clients in the current month.
-// The test then queries the activity log for only the current month, and
-// verifies that all 7 clients seen this month are considered new.
-func Test_ActivityLog_ClientsNewCurrentMonth(t *testing.T) {
-	t.Parallel()
-	cluster := minimal.NewTestSoloCluster(t, nil)
-	client := cluster.Cores[0].Client
-	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
-		"enabled": "enable",
-	})
-	require.NoError(t, err)
-	_, err = clientcountutil.NewActivityLogData(client).
-		NewPreviousMonthData(1).
-		NewClientsSeen(5).
-		NewCurrentMonthData().
-		RepeatedClientsSeen(5).
-		NewClientsSeen(2).
-		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
-	require.NoError(t, err)
-
-	now := time.Now().UTC()
-
-	// query from the beginning of this month to the end of this month
-	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
-		"end_time":   {timeutil.EndOfMonth(now).Format(time.RFC3339)},
-		"start_time": {timeutil.StartOfMonth(now).Format(time.RFC3339)},
-	})
-	require.NoError(t, err)
-	monthsResponse := getMonthsData(t, resp)
-	require.Len(t, monthsResponse, 1)
-	require.Equal(t, 7, monthsResponse[0].NewClients.Counts.Clients)
-}
-
-// Test_ActivityLog_EmptyDataMonths writes data for only the current month,
-// then queries a timeframe of several months in the past to now. The test
-// verifies that empty months of data are returned for the past, and the current
-// month data is correct.
-func Test_ActivityLog_EmptyDataMonths(t *testing.T) {
-	t.Parallel()
-	cluster := minimal.NewTestSoloCluster(t, nil)
-	client := cluster.Cores[0].Client
-	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
-		"enabled": "enable",
-	})
-	require.NoError(t, err)
-	_, err = clientcountutil.NewActivityLogData(client).
-		NewCurrentMonthData().
-		NewClientsSeen(10).
-		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
-	require.NoError(t, err)
-
-	now := time.Now().UTC()
-	// query from the beginning of 3 months ago to the end of this month
-	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
-		"end_time":   {timeutil.EndOfMonth(now).Format(time.RFC3339)},
-		"start_time": {timeutil.StartOfMonth(timeutil.MonthsPreviousTo(3, now)).Format(time.RFC3339)},
-	})
-	require.NoError(t, err)
-	monthsResponse := getMonthsData(t, resp)
-
-	require.Len(t, monthsResponse, 4)
-	for _, month := range monthsResponse {
-		ts, err := time.Parse(time.RFC3339, month.Timestamp)
-		require.NoError(t, err)
-		// current month should have data
-		if ts.UTC().Equal(timeutil.StartOfMonth(now)) {
-			require.Equal(t, month.Counts.Clients, 10)
-		} else {
-			// other months should be empty
-			require.Nil(t, month.Counts)
-		}
-	}
+var allClientTypeTestCases = []struct {
+	clientType       string
+	topLevelJSONKey  string
+	responseCountsFn func(r vault.ResponseCounts) int
+}{
+	{
+		clientType:      vault.ACMEActivityType,
+		topLevelJSONKey: "acme_clients",
+		responseCountsFn: func(r vault.ResponseCounts) int {
+			return r.ACMEClients
+		},
+	},
+	{
+		clientType:      "secret-sync",
+		topLevelJSONKey: "secret_syncs",
+		responseCountsFn: func(r vault.ResponseCounts) int {
+			return r.SecretSyncs
+		},
+	},
+	{
+		clientType:      "entity",
+		topLevelJSONKey: "entity_clients",
+		responseCountsFn: func(r vault.ResponseCounts) int {
+			return r.EntityClients
+		},
+	},
+	{
+		clientType:      "non-entity-token",
+		topLevelJSONKey: "non_entity_clients",
+		responseCountsFn: func(r vault.ResponseCounts) int {
+			return r.NonEntityClients
+		},
+	},
 }
 
 func getMonthsData(t *testing.T, resp *api.Secret) []vault.ResponseMonth {
@@ -219,174 +91,389 @@ func getTotals(t *testing.T, resp *api.Secret) vault.ResponseCounts {
 	return total
 }
 
-// Test_ActivityLog_SecretSyncResponse creates 10 secret sync clients and
-// verifies that the activity log query response returns 10 secret sync clients
-// at every level of the response hierarchy
-func Test_ActivityLog_SecretSyncResponse(t *testing.T) {
+// Test_ActivityLogCurrentMonth_Response runs for each client type. The subtest
+// creates 10 clients of the type and verifies that the activity log partial
+// month response returns 10 clients of that type at every level of the response
+// hierarchy
+func Test_ActivityLogCurrentMonth_Response(t *testing.T) {
 	t.Parallel()
-	cluster := minimal.NewTestSoloCluster(t, nil)
-	client := cluster.Cores[0].Client
-	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
-		"enabled": "enable",
+
+	for _, tc := range allClientTypeTestCases {
+		tc := tc
+		t.Run(tc.clientType, func(t *testing.T) {
+			t.Parallel()
+			cluster := minimal.NewTestSoloCluster(t, nil)
+			client := cluster.Cores[0].Client
+			_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+				"enabled": "enable",
+			})
+			_, err = clientcountutil.NewActivityLogData(client).
+				NewCurrentMonthData().
+				NewClientsSeen(10, clientcountutil.WithClientType(tc.clientType)).
+				Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES)
+			require.NoError(t, err)
+
+			resp, err := client.Logical().Read("sys/internal/counters/activity/monthly")
+			require.NoError(t, err)
+
+			clientsOfType, ok := resp.Data[tc.topLevelJSONKey]
+			require.True(t, ok)
+			require.Equal(t, json.Number("10"), clientsOfType)
+			clients, ok := resp.Data["clients"]
+			require.True(t, ok)
+			require.Equal(t, json.Number("10"), clients)
+
+			byNamespace := getNamespaceData(t, resp)
+			require.Equal(t, 10, tc.responseCountsFn(byNamespace[0].Counts))
+			require.Equal(t, 10, tc.responseCountsFn(*byNamespace[0].Mounts[0].Counts))
+			require.Equal(t, 10, byNamespace[0].Counts.Clients)
+			require.Equal(t, 10, byNamespace[0].Mounts[0].Counts.Clients)
+
+			byMonth := getMonthsData(t, resp)
+			require.Equal(t, 10, tc.responseCountsFn(*byMonth[0].NewClients.Counts))
+			require.Equal(t, 10, tc.responseCountsFn(*byMonth[0].Counts))
+			require.Equal(t, 10, tc.responseCountsFn(byMonth[0].Namespaces[0].Counts))
+			require.Equal(t, 10, tc.responseCountsFn(*byMonth[0].Namespaces[0].Mounts[0].Counts))
+			require.Equal(t, 10, byMonth[0].NewClients.Counts.Clients)
+			require.Equal(t, 10, byMonth[0].Counts.Clients)
+			require.Equal(t, 10, byMonth[0].Namespaces[0].Counts.Clients)
+			require.Equal(t, 10, byMonth[0].Namespaces[0].Mounts[0].Counts.Clients)
+		})
+	}
+}
+
+// Test_ActivityLog_Deduplication runs for all client types. The subtest
+// verifies that the clients of that type are deduplicated across months. The
+// test creates 10 clients and repeats those clients in later months, then also
+// registers 3 and then 2 new clients. The test verifies that the total number
+// of clients is 15 (10 + 2 + 3), ensuring that the duplicates are not included
+func Test_ActivityLog_Deduplication(t *testing.T) {
+	t.Parallel()
+	for _, tc := range allClientTypeTestCases {
+		tc := tc
+		t.Run(tc.clientType, func(t *testing.T) {
+			t.Parallel()
+			cluster := minimal.NewTestSoloCluster(t, nil)
+			client := cluster.Cores[0].Client
+			_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+				"enabled": "enable",
+			})
+			_, err = clientcountutil.NewActivityLogData(client).
+				NewPreviousMonthData(3).
+				NewClientsSeen(10, clientcountutil.WithClientType(tc.clientType)).
+				NewPreviousMonthData(2).
+				RepeatedClientsSeen(4, clientcountutil.WithClientType(tc.clientType)).
+				NewClientsSeen(3, clientcountutil.WithClientType(tc.clientType)).
+				NewPreviousMonthData(1).
+				RepeatedClientsSeen(5, clientcountutil.WithClientType(tc.clientType)).
+				NewClientsSeen(2, clientcountutil.WithClientType(tc.clientType)).
+				Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES)
+			require.NoError(t, err)
+
+			now := time.Now().UTC()
+			resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+				"end_time":   {timeutil.StartOfMonth(now).Format(time.RFC3339)},
+				"start_time": {timeutil.StartOfMonth(timeutil.MonthsPreviousTo(4, now)).Format(time.RFC3339)},
+			},
+			)
+			require.NoError(t, err)
+
+			total := getTotals(t, resp)
+			require.Equal(t, 15, tc.responseCountsFn(total))
+			require.Equal(t, 15, total.Clients)
+		})
+	}
+}
+
+// getJSONExport is used to fetch activity export records using json format.
+// The records will be returned as a map keyed by client ID.
+func getJSONExport(t *testing.T, client *api.Client, startTime time.Time, now time.Time) (map[string]vault.ActivityLogExportRecord, error) {
+	t.Helper()
+
+	resp, err := client.Logical().ReadRawWithData("sys/internal/counters/activity/export", map[string][]string{
+		"start_time": {startTime.Format(time.RFC3339)},
+		"end_time":   {timeutil.EndOfMonth(now).Format(time.RFC3339)},
+		"format":     {"json"},
 	})
-	_, err = clientcountutil.NewActivityLogData(client).
-		NewCurrentMonthData().
-		NewClientsSeen(10, clientcountutil.WithClientType("secret-sync")).
-		Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES)
-	require.NoError(t, err)
+	if err != nil {
+		return nil, err
+	}
 
-	now := time.Now().UTC()
-	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
+	defer resp.Body.Close()
+
+	contents, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	buf := bytes.NewBuffer(contents)
+	decoder := json.NewDecoder(buf)
+	clients := make(map[string]vault.ActivityLogExportRecord)
+
+	for {
+		if !decoder.More() {
+			break
+		}
+
+		var record vault.ActivityLogExportRecord
+		err := decoder.Decode(&record)
+		if err != nil {
+			return nil, err
+		}
+
+		clients[record.ClientID] = record
+	}
+
+	return clients, nil
+}
+
+// getCSVExport fetches activity export records using csv format. All flattened
+// map and slice fields will be unflattened so that the a proper ActivityLogExportRecord
+// can be formed. The records will returned as a map keyed by client ID.
+func getCSVExport(t *testing.T, client *api.Client, startTime time.Time, now time.Time) (map[string]vault.ActivityLogExportRecord, error) {
+	t.Helper()
+
+	boolFields := map[string]struct{}{
+		"local_entity_alias": {},
+	}
+
+	mapFields := map[string]struct{}{
+		"entity_alias_custom_metadata": {},
+		"entity_alias_metadata":        {},
+		"entity_metadata":              {},
+	}
+
+	sliceFields := map[string]struct{}{
+		"entity_group_ids": {},
+		"policies":         {},
+	}
+
+	resp, err := client.Logical().ReadRawWithData("sys/internal/counters/activity/export", map[string][]string{
+		"start_time": {startTime.Format(time.RFC3339)},
 		"end_time":   {timeutil.EndOfMonth(now).Format(time.RFC3339)},
-		"start_time": {timeutil.StartOfMonth(now).Format(time.RFC3339)},
+		"format":     {"csv"},
 	})
-	require.NoError(t, err)
+	if err != nil {
+		return nil, err
+	}
+
+	defer resp.Body.Close()
+
+	csvRdr := csv.NewReader(resp.Body)
+	clients := make(map[string]vault.ActivityLogExportRecord)
+
+	csvRecords, err := csvRdr.ReadAll()
+	if err != nil {
+		return nil, err
+	}
+
+	if len(csvRecords) == 0 {
+		return clients, nil
+	}
+
+	csvHeader := csvRecords[0]
+
+	// skip initial row as it is header
+	for rowIdx := 1; rowIdx < len(csvRecords); rowIdx++ {
+		baseRecord := vault.ActivityLogExportRecord{
+			Policies:                  []string{},
+			EntityMetadata:            map[string]string{},
+			EntityAliasMetadata:       map[string]string{},
+			EntityAliasCustomMetadata: map[string]string{},
+			EntityGroupIDs:            []string{},
+		}
+
+		recordMap := make(map[string]interface{})
+
+		// create base map
+		err = mapstructure.Decode(baseRecord, &recordMap)
+		if err != nil {
+			return nil, err
+		}
+
+		for columnIdx, columnName := range csvHeader {
+			val := csvRecords[rowIdx][columnIdx]
+
+			// determine if column has been flattened
+			columnNameParts := strings.SplitN(columnName, ".", 2)
+
+			if len(columnNameParts) > 1 {
+				prefix := columnNameParts[0]
+
+				if _, ok := mapFields[prefix]; ok {
+					m := recordMap[prefix]
+
+					// ignore empty CSV column value
+					if val != "" {
+						m.(map[string]string)[columnNameParts[1]] = val
+						recordMap[prefix] = m
+					}
+				} else if _, ok := sliceFields[prefix]; ok {
+					s := recordMap[prefix]
+
+					// ignore empty CSV column value
+					if val != "" {
+						s = append(s.([]string), val)
+						recordMap[prefix] = s
+					}
+				} else {
+					t.Fatalf("unexpected CSV field: %q", columnName)
+				}
+			} else if _, ok := boolFields[columnName]; ok {
+				recordMap[columnName], err = strconv.ParseBool(val)
+				if err != nil {
+					return nil, err
+				}
+			} else {
+				recordMap[columnName] = val
+			}
+		}
+
+		var record vault.ActivityLogExportRecord
+		err = mapstructure.Decode(recordMap, &record)
+		if err != nil {
+			return nil, err
+		}
+
+		clients[record.ClientID] = record
+	}
 
-	total := getTotals(t, resp)
-	require.Equal(t, 10, total.SecretSyncs)
-	require.Equal(t, 10, total.Clients)
-
-	byNamespace := getNamespaceData(t, resp)
-	require.Equal(t, 10, byNamespace[0].Counts.SecretSyncs)
-	require.Equal(t, 10, byNamespace[0].Mounts[0].Counts.SecretSyncs)
-	require.Equal(t, 10, byNamespace[0].Counts.Clients)
-	require.Equal(t, 10, byNamespace[0].Mounts[0].Counts.Clients)
-
-	byMonth := getMonthsData(t, resp)
-	require.Equal(t, 10, byMonth[0].NewClients.Counts.SecretSyncs)
-	require.Equal(t, 10, byMonth[0].Counts.SecretSyncs)
-	require.Equal(t, 10, byMonth[0].Namespaces[0].Counts.SecretSyncs)
-	require.Equal(t, 10, byMonth[0].Namespaces[0].Mounts[0].Counts.SecretSyncs)
-	require.Equal(t, 10, byMonth[0].NewClients.Counts.Clients)
-	require.Equal(t, 10, byMonth[0].Counts.Clients)
-	require.Equal(t, 10, byMonth[0].Namespaces[0].Counts.Clients)
-	require.Equal(t, 10, byMonth[0].Namespaces[0].Mounts[0].Counts.Clients)
+	return clients, nil
 }
 
-// Test_ActivityLogCurrentMonth_SecretSyncResponse creates 10 secret sync
-// clients and verifies that the activity log partial month response returns
-// 10 secret sync clients at every level of the response hierarchy
-func Test_ActivityLogCurrentMonth_SecretSyncResponse(t *testing.T) {
+// Test_ActivityLog_Export_Sudo ensures that the export API is only accessible via
+// a root token or a token with a sudo policy.
+func Test_ActivityLog_Export_Sudo(t *testing.T) {
+	timeutil.SkipAtEndOfMonth(t)
 	t.Parallel()
+
+	now := time.Now().UTC()
+	var err error
+
 	cluster := minimal.NewTestSoloCluster(t, nil)
 	client := cluster.Cores[0].Client
-	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+	_, err = client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
 		"enabled": "enable",
 	})
+	require.NoError(t, err)
+
+	rootToken := client.Token()
+
 	_, err = clientcountutil.NewActivityLogData(client).
 		NewCurrentMonthData().
-		NewClientsSeen(10, clientcountutil.WithClientType("secret-sync")).
+		NewClientsSeen(10).
 		Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES)
+
 	require.NoError(t, err)
 
-	resp, err := client.Logical().Read("sys/internal/counters/activity/monthly")
+	// Ensure access via root token
+	startTime := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(1, now))
+	clients, err := getJSONExport(t, client, startTime, now)
 	require.NoError(t, err)
+	require.Len(t, clients, 10)
 
-	secretSyncs, ok := resp.Data["secret_syncs"]
-	require.True(t, ok)
-	require.Equal(t, json.Number("10"), secretSyncs)
-	clients, ok := resp.Data["clients"]
-	require.True(t, ok)
-	require.Equal(t, json.Number("10"), clients)
-
-	byNamespace := getNamespaceData(t, resp)
-	require.Equal(t, 10, byNamespace[0].Counts.SecretSyncs)
-	require.Equal(t, 10, byNamespace[0].Mounts[0].Counts.SecretSyncs)
-	require.Equal(t, 10, byNamespace[0].Counts.Clients)
-	require.Equal(t, 10, byNamespace[0].Mounts[0].Counts.Clients)
-
-	byMonth := getMonthsData(t, resp)
-	require.Equal(t, 10, byMonth[0].NewClients.Counts.SecretSyncs)
-	require.Equal(t, 10, byMonth[0].Counts.SecretSyncs)
-	require.Equal(t, 10, byMonth[0].Namespaces[0].Counts.SecretSyncs)
-	require.Equal(t, 10, byMonth[0].Namespaces[0].Mounts[0].Counts.SecretSyncs)
-	require.Equal(t, 10, byMonth[0].NewClients.Counts.Clients)
-	require.Equal(t, 10, byMonth[0].Counts.Clients)
-	require.Equal(t, 10, byMonth[0].Namespaces[0].Counts.Clients)
-	require.Equal(t, 10, byMonth[0].Namespaces[0].Mounts[0].Counts.Clients)
+	client.Sys().PutPolicy("non-sudo-export", `
+path "sys/internal/counters/activity/export" {
+	capabilities = ["read"]
 }
+	`)
 
-// Test_SecretSync_Deduplication verifies that secret sync clients are
-// deduplicated across months. The test creates 10 secret sync clients and
-// repeats those clients in later months, then also registers 3 and then 2 new
-// secret sync clients. The test verifies that the total number of secret sync
-// clients is 15 (10 + 2 + 3), ensuring that the duplicates are not included
-func Test_SecretSync_Deduplication(t *testing.T) {
-	t.Parallel()
-	cluster := minimal.NewTestSoloCluster(t, nil)
-	client := cluster.Cores[0].Client
-	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
-		"enabled": "enable",
+	secret, err := client.Auth().Token().Create(&api.TokenCreateRequest{
+		Policies: []string{"non-sudo-export"},
 	})
-	_, err = clientcountutil.NewActivityLogData(client).
-		NewPreviousMonthData(3).
-		NewClientsSeen(10, clientcountutil.WithClientType("secret-sync")).
-		NewPreviousMonthData(2).
-		RepeatedClientsSeen(4, clientcountutil.WithClientType("secret-sync")).
-		NewClientsSeen(3, clientcountutil.WithClientType("secret-sync")).
-		NewPreviousMonthData(1).
-		RepeatedClientsSeen(5, clientcountutil.WithClientType("secret-sync")).
-		NewClientsSeen(2, clientcountutil.WithClientType("secret-sync")).
-		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES)
 	require.NoError(t, err)
 
-	now := time.Now().UTC()
-	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
-		"end_time":   {timeutil.StartOfMonth(now).Format(time.RFC3339)},
-		"start_time": {timeutil.StartOfMonth(timeutil.MonthsPreviousTo(4, now)).Format(time.RFC3339)},
-	},
-	)
+	nonSudoToken := secret.Auth.ClientToken
+	client.SetToken(nonSudoToken)
+
+	// Ensure no access via token without sudo access
+	clients, err = getJSONExport(t, client, startTime, now)
+	require.ErrorContains(t, err, "permission denied")
+
+	client.SetToken(rootToken)
+	client.Sys().PutPolicy("sudo-export", `
+path "sys/internal/counters/activity/export" {
+	capabilities = ["read", "sudo"]
+}
+	`)
+
+	secret, err = client.Auth().Token().Create(&api.TokenCreateRequest{
+		Policies: []string{"sudo-export"},
+	})
 	require.NoError(t, err)
 
-	total := getTotals(t, resp)
-	require.Equal(t, 15, total.SecretSyncs)
-	require.Equal(t, 15, total.Clients)
+	sudoToken := secret.Auth.ClientToken
+	client.SetToken(sudoToken)
+
+	// Ensure access via token with sudo access
+	clients, err = getJSONExport(t, client, startTime, now)
+	require.NoError(t, err)
+	require.Len(t, clients, 10)
 }
 
-// Test_ActivityLog_MountDeduplication writes data for the previous
-// month across 4 mounts. The cubbyhole and sys mounts have clients in the
-// current month as well. The test verifies that the mount counts are correctly
-// summed in the results when the previous and current month are queried.
-func Test_ActivityLog_MountDeduplication(t *testing.T) {
+// Test_ActivityLog_Export_FirstUsedTime ensures that the export API returns the timestamp the
+// clients were first seen in the query period for ClientFirstUsedTime field.
+func Test_ActivityLog_Export_FirstUsedTime(t *testing.T) {
+	timeutil.SkipAtEndOfMonth(t)
 	t.Parallel()
 
+	now := time.Now().UTC()
+
+	var err error
+
 	cluster := minimal.NewTestSoloCluster(t, nil)
 	client := cluster.Cores[0].Client
-	_, err := client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
+	_, err = client.Logical().Write("sys/internal/counters/config", map[string]interface{}{
 		"enabled": "enable",
 	})
 	require.NoError(t, err)
-	now := time.Now().UTC()
 
+	// create new clients and repeated clients for every month.
+	// this is to verify that only the first used timestamp appears in the response
 	_, err = clientcountutil.NewActivityLogData(client).
+		NewPreviousMonthData(2).
+		NewClientsSeen(4).
 		NewPreviousMonthData(1).
-		NewClientSeen(clientcountutil.WithClientMount("sys")).
-		NewClientSeen(clientcountutil.WithClientMount("secret")).
-		NewClientSeen(clientcountutil.WithClientMount("cubbyhole")).
-		NewClientSeen(clientcountutil.WithClientMount("identity")).
+		NewClientsSeen(6).
+		RepeatedClientsSeen(4).
 		NewCurrentMonthData().
-		NewClientSeen(clientcountutil.WithClientMount("cubbyhole")).
-		NewClientSeen(clientcountutil.WithClientMount("sys")).
-		Write(context.Background(), generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES, generation.WriteOptions_WRITE_ENTITIES)
+		NewClientsSeen(10).
+		RepeatedClientsSeen(10).
+		Write(context.Background(), generation.WriteOptions_WRITE_ENTITIES)
+
 	require.NoError(t, err)
 
-	resp, err := client.Logical().ReadWithData("sys/internal/counters/activity", map[string][]string{
-		"end_time":   {timeutil.EndOfMonth(now).Format(time.RFC3339)},
-		"start_time": {timeutil.StartOfMonth(timeutil.MonthsPreviousTo(1, now)).Format(time.RFC3339)},
-	})
+	startTime := timeutil.StartOfMonth(timeutil.MonthsPreviousTo(3, now))
 
+	// Call export api
+	clients, err := getJSONExport(t, client, startTime, now)
 	require.NoError(t, err)
-	byNamespace := getNamespaceData(t, resp)
-	require.Len(t, byNamespace, 1)
-	require.Len(t, byNamespace[0].Mounts, 4)
-	mountSet := make(map[string]int, 4)
-	for _, mount := range byNamespace[0].Mounts {
-		mountSet[mount.MountPath] = mount.Counts.Clients
+
+	// total number of clients present in the query period
+	require.Len(t, clients, 20)
+
+	clientCountByFirstUsedMonth := make(map[time.Time]int)
+	currMonthStart := timeutil.StartOfMonth(now.UTC())
+	oneMonthAgoStart := timeutil.StartOfPreviousMonth(currMonthStart)
+	twoMonthsAgoStart := timeutil.StartOfPreviousMonth(oneMonthAgoStart)
+
+	// count number of clients by month the clients the first seen
+	// this actually corresponds to new clients added every month
+	// since clientcountutil assigns a random time for usage time we can check by month here as we do not know the exact expected usage time
+	for _, clientDetails := range clients {
+		require.NotEmpty(t, clientDetails.ClientFirstUsedTime)
+		parsedTime, err := time.Parse(time.RFC3339, clientDetails.ClientFirstUsedTime) // RFC3339 handles 'Z' for UTC
+		require.NoError(t, err)
+		startOfMonth := timeutil.StartOfMonth(parsedTime)
+		clientCountByFirstUsedMonth[startOfMonth]++
 	}
-	require.Equal(t, map[string]int{
-		"identity/":  1,
-		"sys/":       2,
-		"cubbyhole/": 2,
-		"secret/":    1,
-	}, mountSet)
+
+	// 4 clients were first seen two months ago
+	require.Equal(t, clientCountByFirstUsedMonth[twoMonthsAgoStart], 4)
+
+	// 6 new clients were first seen one month ago
+	require.Equal(t, clientCountByFirstUsedMonth[oneMonthAgoStart], 6)
+
+	// 10 clients were first seen in the current month
+	require.Equal(t, clientCountByFirstUsedMonth[currMonthStart], 10)
 }
diff --git a/vault/external_tests/api/api_integration_test.go b/vault/external_tests/api/api_integration_test.go
index 8f08951911c..c1f6c54681e 100644
--- a/vault/external_tests/api/api_integration_test.go
+++ b/vault/external_tests/api/api_integration_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api
@@ -9,12 +9,10 @@ import (
 
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/audit"
-	auditFile "github.com/hashicorp/vault/builtin/audit/file"
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/builtin/logical/database"
 	"github.com/hashicorp/vault/builtin/logical/pki"
 	"github.com/hashicorp/vault/builtin/logical/transit"
-	"github.com/hashicorp/vault/helper/benchhelpers"
 	"github.com/hashicorp/vault/helper/builtinplugins"
 	"github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -40,7 +38,7 @@ func testVaultServerUnseal(t testing.TB) (*api.Client, []string, func()) {
 			"userpass": credUserpass.Factory,
 		},
 		AuditBackends: map[string]audit.Factory{
-			"file": auditFile.Factory,
+			"file": audit.NewFileBackend,
 		},
 		LogicalBackends: map[string]logical.Factory{
 			"database":       database.Factory,
@@ -57,7 +55,7 @@ func testVaultServerUnseal(t testing.TB) (*api.Client, []string, func()) {
 func testVaultServerCoreConfig(t testing.TB, coreConfig *vault.CoreConfig) (*api.Client, []string, func()) {
 	t.Helper()
 
-	cluster := vault.NewTestCluster(benchhelpers.TBtoT(t), coreConfig, &vault.TestClusterOptions{
+	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: http.Handler,
 		NumCores:    1,
 	})
@@ -65,7 +63,7 @@ func testVaultServerCoreConfig(t testing.TB, coreConfig *vault.CoreConfig) (*api
 
 	// Make it easy to get access to the active
 	core := cluster.Cores[0].Core
-	vault.TestWaitActive(benchhelpers.TBtoT(t), core)
+	vault.TestWaitActive(t, core)
 
 	// Get the client already setup for us!
 	client := cluster.Cores[0].Client
diff --git a/vault/external_tests/api/feature_flag_ext_test.go b/vault/external_tests/api/feature_flag_ext_test.go
index 4f8cc8138e1..3c7f0216ba8 100644
--- a/vault/external_tests/api/feature_flag_ext_test.go
+++ b/vault/external_tests/api/feature_flag_ext_test.go
@@ -1,11 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api
 
 import (
 	"encoding/json"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"os"
 	"testing"
@@ -54,7 +54,7 @@ func TestFeatureFlags(t *testing.T) {
 		}
 		defer resp.Body.Close()
 
-		httpRespBody, err := ioutil.ReadAll(resp.Body)
+		httpRespBody, err := io.ReadAll(resp.Body)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/vault/external_tests/api/kv_helpers_test.go b/vault/external_tests/api/kv_helpers_test.go
index f3305f55223..f0f1714291c 100644
--- a/vault/external_tests/api/kv_helpers_test.go
+++ b/vault/external_tests/api/kv_helpers_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api
diff --git a/vault/external_tests/api/kv_test.go b/vault/external_tests/api/kv_test.go
index 71eecdeedfd..d1b8d8452a0 100644
--- a/vault/external_tests/api/kv_test.go
+++ b/vault/external_tests/api/kv_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api
diff --git a/vault/external_tests/api/renewer_integration_test.go b/vault/external_tests/api/renewer_integration_test.go
index 24abed1ca07..6d413aad29d 100644
--- a/vault/external_tests/api/renewer_integration_test.go
+++ b/vault/external_tests/api/renewer_integration_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api
diff --git a/vault/external_tests/api/secret_test.go b/vault/external_tests/api/secret_test.go
index d1cd4cdb1f2..ef866a07c62 100644
--- a/vault/external_tests/api/secret_test.go
+++ b/vault/external_tests/api/secret_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api
diff --git a/vault/external_tests/api/sudo_paths_test.go b/vault/external_tests/api/sudo_paths_test.go
index 50cccf8579a..989abb15d1b 100644
--- a/vault/external_tests/api/sudo_paths_test.go
+++ b/vault/external_tests/api/sudo_paths_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api
@@ -74,7 +74,8 @@ func TestSudoPaths(t *testing.T) {
 				t.Fatalf(
 					"A path in the static list of sudo paths in the api module "+
 						"is not marked as a sudo path in the OpenAPI spec (%s). Please reconcile the two "+
-						"accordingly.", path)
+						"accordingly. This involves adding to the Root string array in the PathsSpecial declaration "+
+						"for the backend in question. For example, for sys/, this would be in NewSystemBackend.", path)
 			}
 		}
 	}
diff --git a/vault/external_tests/api/sys_auth_test.go b/vault/external_tests/api/sys_auth_test.go
index 46e715de870..5c05adf8f46 100644
--- a/vault/external_tests/api/sys_auth_test.go
+++ b/vault/external_tests/api/sys_auth_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api
diff --git a/vault/external_tests/api/sys_mounts_test.go b/vault/external_tests/api/sys_mounts_test.go
index bdf8a0b16bb..fe07663173f 100644
--- a/vault/external_tests/api/sys_mounts_test.go
+++ b/vault/external_tests/api/sys_mounts_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api
diff --git a/vault/external_tests/api/sys_rekey_ext_test.go b/vault/external_tests/api/sys_rekey_ext_test.go
index fc8c0ddd834..0a584ed2470 100644
--- a/vault/external_tests/api/sys_rekey_ext_test.go
+++ b/vault/external_tests/api/sys_rekey_ext_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api
diff --git a/vault/external_tests/approle/wrapped_secretid_test.go b/vault/external_tests/approle/wrapped_secretid_test.go
index 2c1d9aed946..bc43ae1e6ec 100644
--- a/vault/external_tests/approle/wrapped_secretid_test.go
+++ b/vault/external_tests/approle/wrapped_secretid_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package approle
diff --git a/vault/external_tests/audit/audit_exclusion_test.go b/vault/external_tests/audit/audit_exclusion_test.go
new file mode 100644
index 00000000000..7df9e8e9e82
--- /dev/null
+++ b/vault/external_tests/audit/audit_exclusion_test.go
@@ -0,0 +1,50 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"testing"
+
+	"github.com/hashicorp/vault/helper/constants"
+	"github.com/hashicorp/vault/helper/testhelpers/minimal"
+	"github.com/stretchr/testify/require"
+)
+
+// TestAudit_Exclusion_ByVaultVersion ensures that the audit device 'exclude'
+// option is only supported in the enterprise edition of the product.
+func TestAudit_Exclusion_ByVaultVersion(t *testing.T) {
+	t.Parallel()
+
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	// Attempt to create an audit device with exclusion enabled.
+	mountPointFilterDevicePath := "mountpoint"
+	mountPointFilterDeviceData := map[string]any{
+		"type":        "file",
+		"description": "",
+		"local":       false,
+		"options": map[string]any{
+			"file_path": "discard",
+			"exclude":   "[ { \"fields\": [ \"/response/data\" ] } ]",
+		},
+	}
+
+	_, err := client.Logical().Write("sys/audit/"+mountPointFilterDevicePath, mountPointFilterDeviceData)
+	if constants.IsEnterprise {
+		require.NoError(t, err)
+	} else {
+		require.Error(t, err)
+		require.ErrorContains(t, err, "enterprise-only options supplied")
+	}
+
+	devices, err := client.Sys().ListAudit()
+	require.NoError(t, err)
+	if constants.IsEnterprise {
+		require.Len(t, devices, 1)
+	} else {
+		// Ensure the device has not been created.
+		require.Len(t, devices, 0)
+	}
+}
diff --git a/vault/external_tests/audit/audit_filtering_ce_test.go b/vault/external_tests/audit/audit_filtering_ce_test.go
new file mode 100644
index 00000000000..aae6c000df1
--- /dev/null
+++ b/vault/external_tests/audit/audit_filtering_ce_test.go
@@ -0,0 +1,68 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package audit
+
+import (
+	"testing"
+
+	"github.com/hashicorp/vault/helper/testhelpers/minimal"
+	"github.com/stretchr/testify/require"
+)
+
+// TestAuditFilteringInCE ensures that the audit device 'filter'
+// option is only supported in the enterprise edition of the product.
+func TestAuditFilteringInCE(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	// Attempt to create an audit device with filtering enabled.
+	mountPointFilterDevicePath := "mountpoint"
+	mountPointFilterDeviceData := map[string]any{
+		"type":        "file",
+		"description": "",
+		"local":       false,
+		"options": map[string]any{
+			"file_path": "/tmp/audit.log",
+			"filter":    "mount_point == secret/",
+		},
+	}
+	_, err := client.Logical().Write("sys/audit/"+mountPointFilterDevicePath, mountPointFilterDeviceData)
+	require.Error(t, err)
+	require.ErrorContains(t, err, "enterprise-only options supplied")
+
+	// Ensure the device has not been created.
+	devices, err := client.Sys().ListAudit()
+	require.NoError(t, err)
+	require.Len(t, devices, 0)
+}
+
+// TestAuditFilteringFallbackDeviceInCE validates that the audit device
+// 'fallback' option is only available in the enterprise edition of the product.
+func TestAuditFilteringFallbackDeviceInCE(t *testing.T) {
+	t.Parallel()
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	fallbackDevicePath := "fallback"
+	fallbackDeviceData := map[string]any{
+		"type":        "file",
+		"description": "",
+		"local":       false,
+		"options": map[string]any{
+			"file_path": "/tmp/audit.log",
+			"fallback":  "true",
+		},
+	}
+	_, err := client.Logical().Write("sys/audit/"+fallbackDevicePath, fallbackDeviceData)
+	require.Error(t, err)
+	require.ErrorContains(t, err, "enterprise-only options supplied")
+
+	// Ensure the device has not been created.
+	devices, err := client.Sys().ListAudit()
+	require.NoError(t, err)
+	require.Len(t, devices, 0)
+}
diff --git a/vault/external_tests/audit/audit_filtering_test.go b/vault/external_tests/audit/audit_filtering_test.go
deleted file mode 100644
index 36750166c0d..00000000000
--- a/vault/external_tests/audit/audit_filtering_test.go
+++ /dev/null
@@ -1,378 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package audit
-
-import (
-	"bufio"
-	"context"
-	"encoding/json"
-	"os"
-	"testing"
-
-	"github.com/hashicorp/vault/helper/testhelpers/minimal"
-	"github.com/stretchr/testify/require"
-)
-
-// TestAuditFilteringOnDifferentFields validates that the audit device 'filter'
-// option works as expected for the fields we allow filtering on. We create
-// three audit devices, each with a different filter, and make some auditable
-// requests, then we ensure that correct entries were written to the respective
-// log files. The mount_type and namespace filters are tested in other tests in
-// this package.
-func TestAuditFilteringOnDifferentFields(t *testing.T) {
-	t.Parallel()
-	cluster := minimal.NewTestSoloCluster(t, nil)
-	client := cluster.Cores[0].Client
-
-	// Create audit devices.
-	tempDir := t.TempDir()
-	mountPointFilterLogFile, err := os.CreateTemp(tempDir, "")
-	mountPointFilterDevicePath := "mountpoint"
-	mountPointFilterDeviceData := map[string]any{
-		"type":        "file",
-		"description": "",
-		"local":       false,
-		"options": map[string]any{
-			"file_path": mountPointFilterLogFile.Name(),
-			"filter":    "mount_point == secret/",
-		},
-	}
-	_, err = client.Logical().Write("sys/audit/"+mountPointFilterDevicePath, mountPointFilterDeviceData)
-	require.NoError(t, err)
-
-	operationFilterLogFile, err := os.CreateTemp(tempDir, "")
-	operationFilterPath := "operation"
-	operationFilterData := map[string]any{
-		"type":        "file",
-		"description": "",
-		"local":       false,
-		"options": map[string]any{
-			"file_path": operationFilterLogFile.Name(),
-			"filter":    "operation == create",
-		},
-	}
-	_, err = client.Logical().Write("sys/audit/"+operationFilterPath, operationFilterData)
-	require.NoError(t, err)
-
-	pathFilterLogFile, err := os.CreateTemp(tempDir, "")
-	pathFilterDevicePath := "path"
-	pathFilterDeviceData := map[string]any{
-		"type":        "file",
-		"description": "",
-		"local":       false,
-		"options": map[string]any{
-			"file_path": pathFilterLogFile.Name(),
-			"filter":    "path == secret/foo",
-		},
-	}
-	_, err = client.Logical().Write("sys/audit/"+pathFilterDevicePath, pathFilterDeviceData)
-	require.NoError(t, err)
-
-	// Ensure the devices have been created.
-	devices, err := client.Sys().ListAudit()
-	require.NoError(t, err)
-	_, ok := devices[mountPointFilterDevicePath+"/"]
-	require.True(t, ok)
-	_, ok = devices[operationFilterPath+"/"]
-	require.True(t, ok)
-	_, ok = devices[pathFilterDevicePath+"/"]
-	require.True(t, ok)
-
-	// A write to KV should produce an audit entry that is written to all the
-	// audit devices.
-	data := map[string]any{
-		"foo": "bar",
-	}
-	err = client.KVv1("secret/").Put(context.Background(), "foo", data)
-	require.NoError(t, err)
-
-	// Disable the audit devices.
-	err = client.Sys().DisableAudit(mountPointFilterDevicePath)
-	require.NoError(t, err)
-	err = client.Sys().DisableAudit(operationFilterPath)
-	require.NoError(t, err)
-	err = client.Sys().DisableAudit(pathFilterDevicePath)
-	require.NoError(t, err)
-	// Ensure the devices are no longer there.
-	devices, err = client.Sys().ListAudit()
-	require.NoError(t, err)
-	require.Len(t, devices, 0)
-
-	// Validate that only the entries matching the filters were written to each log file.
-	entries := checkAuditEntries(t, mountPointFilterLogFile, "mount_point", "secret/")
-	require.Equal(t, 2, entries)
-	entries = checkAuditEntries(t, operationFilterLogFile, "operation", "create")
-	require.Equal(t, 2, entries)
-	entries = checkAuditEntries(t, pathFilterLogFile, "path", "secret/foo")
-	require.Equal(t, 2, entries)
-}
-
-// TestAuditFilteringMultipleDevices validates that the audit device 'filter'
-// option works as expected and multiple audit devices with the same filter all
-// write the relevant entries to the logs. We create two audit devices that
-// filter out all events that are not for the KV mount type and one without
-// filters, make some auditable requests that both match and do not match the
-// filters, and ensure there are audit log entries for the former but not the
-// latter.
-func TestAuditFilteringMultipleDevices(t *testing.T) {
-	t.Parallel()
-	cluster := minimal.NewTestSoloCluster(t, nil)
-	client := cluster.Cores[0].Client
-
-	// Create audit devices.
-	tempDir := t.TempDir()
-	filteredLogFile, err := os.CreateTemp(tempDir, "")
-	filteredDevicePath := "filtered"
-	filteredDeviceData := map[string]any{
-		"type":        "file",
-		"description": "",
-		"local":       false,
-		"options": map[string]any{
-			"file_path": filteredLogFile.Name(),
-			"filter":    "mount_type == kv",
-		},
-	}
-	_, err = client.Logical().Write("sys/audit/"+filteredDevicePath, filteredDeviceData)
-	require.NoError(t, err)
-
-	filteredLogFile2, err := os.CreateTemp(tempDir, "")
-	filteredDevicePath2 := "filtered2"
-	filteredDeviceData2 := map[string]any{
-		"type":        "file",
-		"description": "",
-		"local":       false,
-		"options": map[string]any{
-			"file_path": filteredLogFile2.Name(),
-			"filter":    "mount_type == kv",
-		},
-	}
-	_, err = client.Logical().Write("sys/audit/"+filteredDevicePath2, filteredDeviceData2)
-	require.NoError(t, err)
-
-	nonFilteredLogFile, err := os.CreateTemp(tempDir, "")
-	nonFilteredDevicePath := "nonfiltered"
-	nonFilteredDeviceData := map[string]any{
-		"type":        "file",
-		"description": "",
-		"local":       false,
-		"options": map[string]any{
-			"file_path": nonFilteredLogFile.Name(),
-		},
-	}
-	_, err = client.Logical().Write("sys/audit/"+nonFilteredDevicePath, nonFilteredDeviceData)
-	require.NoError(t, err)
-
-	// Ensure the devices have been created.
-	devices, err := client.Sys().ListAudit()
-	require.NoError(t, err)
-	_, ok := devices[filteredDevicePath+"/"]
-	require.True(t, ok)
-	_, ok = devices[filteredDevicePath2+"/"]
-	require.True(t, ok)
-	_, ok = devices[nonFilteredDevicePath+"/"]
-	require.True(t, ok)
-
-	// Ensure the non-filtered log file is not empty.
-	nonFilteredLogSize := getFileSize(t, nonFilteredLogFile.Name())
-	require.Positive(t, nonFilteredLogSize)
-
-	// A write to KV should produce an audit entry that is written to the
-	// filtered devices and the non-filtered device.
-	data := map[string]any{
-		"foo": "bar",
-	}
-	err = client.KVv1("secret/").Put(context.Background(), "foo", data)
-	require.NoError(t, err)
-	// Ensure the non-filtered log file was written to.
-	oldNonFilteredLogSize := nonFilteredLogSize
-	nonFilteredLogSize = getFileSize(t, nonFilteredLogFile.Name())
-	require.Greater(t, nonFilteredLogSize, oldNonFilteredLogSize)
-
-	// Parse the filtered logs and verify that the filters only allowed entries
-	// with mount_type value being 'kv'. While we're at it, ensure that the
-	// numbers of entries are correct in both files.
-	filteredLogFiles := []*os.File{filteredLogFile, filteredLogFile2}
-	for _, f := range filteredLogFiles {
-		numberOfEntries := checkAuditEntries(t, f, "mount_type", "kv")
-		require.Equal(t, 2, numberOfEntries)
-	}
-
-	// Disable the audit devices.
-	err = client.Sys().DisableAudit(filteredDevicePath)
-	require.NoError(t, err)
-	err = client.Sys().DisableAudit(filteredDevicePath2)
-	require.NoError(t, err)
-	err = client.Sys().DisableAudit(nonFilteredDevicePath)
-	require.NoError(t, err)
-	// Ensure the devices are no longer there.
-	devices, err = client.Sys().ListAudit()
-	require.NoError(t, err)
-	require.Len(t, devices, 0)
-}
-
-// TestAuditFilteringFallbackDevice validates that the audit device 'fallback'
-// option works as expected. We create two audit devices, one with 'fallback'
-// enabled and one with a filter, and make some auditable requests, then we
-// ensure that correct entries were written to the respective log files.
-func TestAuditFilteringFallbackDevice(t *testing.T) {
-	t.Parallel()
-	cluster := minimal.NewTestSoloCluster(t, nil)
-	client := cluster.Cores[0].Client
-
-	tempDir := t.TempDir()
-	fallbackLogFile, err := os.CreateTemp(tempDir, "")
-	fallbackDevicePath := "fallback"
-	fallbackDeviceData := map[string]any{
-		"type":        "file",
-		"description": "",
-		"local":       false,
-		"options": map[string]any{
-			"file_path": fallbackLogFile.Name(),
-			"fallback":  "true",
-		},
-	}
-	_, err = client.Logical().Write("sys/audit/"+fallbackDevicePath, fallbackDeviceData)
-	require.NoError(t, err)
-
-	filteredLogFile, err := os.CreateTemp(tempDir, "")
-	filteredDevicePath := "filtered"
-	filteredDeviceData := map[string]any{
-		"type":        "file",
-		"description": "",
-		"local":       false,
-		"options": map[string]any{
-			"file_path": filteredLogFile.Name(),
-			"filter":    "mount_type == kv",
-		},
-	}
-	_, err = client.Logical().Write("sys/audit/"+filteredDevicePath, filteredDeviceData)
-	require.NoError(t, err)
-
-	// Ensure the devices have been created.
-	devices, err := client.Sys().ListAudit()
-	require.NoError(t, err)
-	_, ok := devices[fallbackDevicePath+"/"]
-	require.True(t, ok)
-	_, ok = devices[filteredDevicePath+"/"]
-	require.True(t, ok)
-
-	// A write to KV should produce an audit entry that is written to the
-	// filtered device.
-	data := map[string]any{
-		"foo": "bar",
-	}
-	err = client.KVv1("secret/").Put(context.Background(), "foo", data)
-	require.NoError(t, err)
-
-	// Disable the audit devices.
-	err = client.Sys().DisableAudit(fallbackDevicePath)
-	require.NoError(t, err)
-	err = client.Sys().DisableAudit(filteredDevicePath)
-	require.NoError(t, err)
-	// Ensure the devices are no longer there.
-	devices, err = client.Sys().ListAudit()
-	require.Len(t, devices, 0)
-
-	// Validate that only the entries matching the filter were written to the filtered log file.
-	numberOfEntries := checkAuditEntries(t, filteredLogFile, "mount_type", "kv")
-	require.Equal(t, 2, numberOfEntries)
-
-	// Validate that only the entries NOT matching the filter were written to the fallback log file.
-	numberOfEntries = 0
-	scanner := bufio.NewScanner(fallbackLogFile)
-	var auditRecord map[string]any
-	for scanner.Scan() {
-		auditRequest := map[string]any{}
-		err := json.Unmarshal(scanner.Bytes(), &auditRecord)
-		require.NoError(t, err)
-		req, ok := auditRecord["request"]
-		require.True(t, ok, "failed to parse request data from audit log entry")
-
-		auditRequest = req.(map[string]any)
-		require.NotEqual(t, "kv", auditRequest["mount_type"])
-		numberOfEntries += 1
-	}
-	// the fallback device will catch all non-kv related entries such as login, etc. there should be 7 in total.
-	require.Equal(t, 7, numberOfEntries)
-}
-
-// TestAuditFilteringFilterForUnsupportedField validates that the audit device
-// 'filter' option fails when the filter expression selector references an
-// unsupported field and that the error prevents an audit device from being
-// created.
-func TestAuditFilteringFilterForUnsupportedField(t *testing.T) {
-	t.Parallel()
-	cluster := minimal.NewTestSoloCluster(t, nil)
-	client := cluster.Cores[0].Client
-
-	tempDir := t.TempDir()
-	filteredLogFile, err := os.CreateTemp(tempDir, "")
-	filteredDevicePath := "filtered"
-	filteredDeviceData := map[string]any{
-		"type":        "file",
-		"description": "",
-		"local":       false,
-		"options": map[string]any{
-			"file_path": filteredLogFile.Name(),
-			"filter":    "auth == foo", // 'auth' is not one of the fields we allow filtering on
-		},
-	}
-	_, err = client.Logical().Write("sys/audit/"+filteredDevicePath, filteredDeviceData)
-	require.Error(t, err)
-	require.ErrorContains(t, err, "audit.NewEntryFilter: filter references an unsupported field: auth == foo")
-
-	// Ensure the device has not been created.
-	devices, err := client.Sys().ListAudit()
-	require.NoError(t, err)
-	require.Len(t, devices, 0)
-
-	// Now we do the same test but with the 'skip_test' option set to true.
-	filteredDeviceDataSkipTest := map[string]any{
-		"type":        "file",
-		"description": "",
-		"local":       false,
-		"options": map[string]any{
-			"file_path": filteredLogFile.Name(),
-			"filter":    "auth == foo", // 'auth' is not one of the fields we allow filtering on
-			"skip_test": true,
-		},
-	}
-	_, err = client.Logical().Write("sys/audit/"+filteredDevicePath, filteredDeviceDataSkipTest)
-	require.Error(t, err)
-	require.ErrorContains(t, err, "audit.NewEntryFilter: filter references an unsupported field: auth == foo")
-
-	// Ensure the device has not been created.
-	devices, err = client.Sys().ListAudit()
-	require.NoError(t, err)
-	require.Len(t, devices, 0)
-}
-
-// getFileSize returns the size of the given file in bytes.
-func getFileSize(t *testing.T, filePath string) int64 {
-	t.Helper()
-	fi, err := os.Stat(filePath)
-	require.NoError(t, err)
-	return fi.Size()
-}
-
-// checkAuditEntries parses the audit log file and asserts that the given key
-// has the expected value for each entry. It returns the number of entries that
-// were parsed.
-func checkAuditEntries(t *testing.T, logFile *os.File, key string, expectedValue any) int {
-	t.Helper()
-	counter := 0
-	scanner := bufio.NewScanner(logFile)
-	var auditRecord map[string]any
-	for scanner.Scan() {
-		auditRequest := map[string]any{}
-		err := json.Unmarshal(scanner.Bytes(), &auditRecord)
-		require.NoError(t, err)
-		req, ok := auditRecord["request"]
-		require.True(t, ok, "failed to parse request data from audit log entry")
-		auditRequest = req.(map[string]any)
-		require.Equal(t, expectedValue, auditRequest[key])
-		counter += 1
-	}
-	return counter
-}
diff --git a/vault/external_tests/audit/audit_test.go b/vault/external_tests/audit/audit_test.go
new file mode 100644
index 00000000000..f06aa6a4b44
--- /dev/null
+++ b/vault/external_tests/audit/audit_test.go
@@ -0,0 +1,371 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package audit
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/api/auth/userpass"
+	"github.com/hashicorp/vault/helper/testhelpers"
+	"github.com/hashicorp/vault/helper/testhelpers/minimal"
+	vaulthttp "github.com/hashicorp/vault/http"
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
+)
+
+// TestAudit_HMACFields verifies that all appropriate fields in audit
+// request and response entries are HMACed properly. The fields in question are:
+//   - request.headers.x-correlation-id
+//   - request.data: all sub-fields
+//   - respnse.auth.client_token
+//   - response.auth.accessor
+//   - response.data: all sub-fields
+//   - response.wrap_info.token
+//   - response.wrap_info.accessor
+func TestAudit_HMACFields(t *testing.T) {
+	const hmacPrefix = "hmac-sha256:"
+
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	tempDir := t.TempDir()
+	logFile, err := os.CreateTemp(tempDir, "")
+	require.NoError(t, err)
+	devicePath := "file"
+	deviceData := map[string]any{
+		"type":        "file",
+		"description": "",
+		"local":       false,
+		"options": map[string]any{
+			"file_path": logFile.Name(),
+		},
+	}
+
+	_, err = client.Logical().Write("sys/config/auditing/request-headers/x-correlation-id", map[string]interface{}{
+		"hmac": true,
+	})
+	require.NoError(t, err)
+
+	// Request 1
+	// Enable the audit device. A test probe request will audited along
+	// with the associated creation response
+	_, err = client.Logical().Write("sys/audit/"+devicePath, deviceData)
+	require.NoError(t, err)
+
+	// Request 2
+	// Ensure the device has been created.
+	devices, err := client.Sys().ListAudit()
+	require.NoError(t, err)
+	require.Len(t, devices, 1)
+
+	// Request 3
+	// Enable the userpass auth method (this will be an audited action)
+	err = client.Sys().EnableAuthWithOptions("userpass", &api.EnableAuthOptions{
+		Type: "userpass",
+	})
+	require.NoError(t, err)
+
+	username := "jdoe"
+	password := "abc123"
+
+	// Request 4
+	// Create a user with a password (another audited action)
+	_, err = client.Logical().Write(fmt.Sprintf("auth/userpass/users/%s", username), map[string]interface{}{
+		"password": password,
+	})
+	require.NoError(t, err)
+
+	authInput, err := userpass.NewUserpassAuth(username, &userpass.Password{FromString: password})
+	require.NoError(t, err)
+
+	newClient, err := client.Clone()
+	require.NoError(t, err)
+
+	correlationID := "correlation-id-foo"
+	newClient.AddHeader("x-correlation-id", correlationID)
+
+	// Request 5
+	authOutput, err := newClient.Auth().Login(context.Background(), authInput)
+	require.NoError(t, err)
+
+	// Request 6
+	hashedPassword, err := client.Sys().AuditHash(devicePath, password)
+	require.NoError(t, err)
+
+	// Request 7
+	hashedClientToken, err := client.Sys().AuditHash(devicePath, authOutput.Auth.ClientToken)
+	require.NoError(t, err)
+
+	// Request 8
+	hashedAccessor, err := client.Sys().AuditHash(devicePath, authOutput.Auth.Accessor)
+	require.NoError(t, err)
+
+	// Request 9
+	wrapResp, err := client.Logical().Write("sys/wrapping/wrap", map[string]interface{}{
+		"foo": "bar",
+	})
+	require.NoError(t, err)
+
+	// Request 10
+	hashedBar, err := client.Sys().AuditHash(devicePath, "bar")
+	require.NoError(t, err)
+
+	// Request 11
+	hashedWrapAccessor, err := client.Sys().AuditHash(devicePath, wrapResp.WrapInfo.Accessor)
+	require.NoError(t, err)
+
+	// Request 12
+	hashedWrapToken, err := client.Sys().AuditHash(devicePath, wrapResp.WrapInfo.Token)
+	require.NoError(t, err)
+
+	// Request 13
+	hashedCorrelationID, err := client.Sys().AuditHash(devicePath, correlationID)
+	require.NoError(t, err)
+
+	// Request 14
+	// Disable the audit device. The request will be audited but not the response.
+	_, err = client.Logical().Delete("sys/audit/" + devicePath)
+	require.NoError(t, err)
+
+	// Request 15
+	// Ensure the device has been deleted. This will not be audited.
+	devices, err = client.Sys().ListAudit()
+	require.NoError(t, err)
+	require.Len(t, devices, 0)
+
+	entries := make([]map[string]interface{}, 0)
+	scanner := bufio.NewScanner(logFile)
+
+	for scanner.Scan() {
+		entry := make(map[string]interface{})
+
+		err := json.Unmarshal(scanner.Bytes(), &entry)
+		require.NoError(t, err)
+
+		entries = append(entries, entry)
+	}
+
+	// This count includes the initial test probe upon creation of the audit device
+	require.Equal(t, 27, len(entries))
+
+	loginReqEntry := entries[8]
+	loginRespEntry := entries[9]
+
+	loginRequestFromReq := loginReqEntry["request"].(map[string]interface{})
+	loginRequestDataFromReq := loginRequestFromReq["data"].(map[string]interface{})
+	loginHeadersFromReq := loginRequestFromReq["headers"].(map[string]interface{})
+
+	loginRequestFromResp := loginRespEntry["request"].(map[string]interface{})
+	loginRequestDataFromResp := loginRequestFromResp["data"].(map[string]interface{})
+	loginHeadersFromResp := loginRequestFromResp["headers"].(map[string]interface{})
+
+	loginAuth := loginRespEntry["auth"].(map[string]interface{})
+
+	require.True(t, strings.HasPrefix(loginRequestDataFromReq["password"].(string), hmacPrefix))
+	require.Equal(t, loginRequestDataFromReq["password"].(string), hashedPassword)
+
+	require.True(t, strings.HasPrefix(loginRequestDataFromResp["password"].(string), hmacPrefix))
+	require.Equal(t, loginRequestDataFromResp["password"].(string), hashedPassword)
+
+	require.True(t, strings.HasPrefix(loginAuth["client_token"].(string), hmacPrefix))
+	require.Equal(t, loginAuth["client_token"].(string), hashedClientToken)
+
+	require.True(t, strings.HasPrefix(loginAuth["accessor"].(string), hmacPrefix))
+	require.Equal(t, loginAuth["accessor"].(string), hashedAccessor)
+
+	xCorrelationIDFromReq := loginHeadersFromReq["x-correlation-id"].([]interface{})
+	require.Equal(t, len(xCorrelationIDFromReq), 1)
+	require.True(t, strings.HasPrefix(xCorrelationIDFromReq[0].(string), hmacPrefix))
+	require.Equal(t, xCorrelationIDFromReq[0].(string), hashedCorrelationID)
+
+	xCorrelationIDFromResp := loginHeadersFromResp["x-correlation-id"].([]interface{})
+	require.Equal(t, len(xCorrelationIDFromResp), 1)
+	require.True(t, strings.HasPrefix(xCorrelationIDFromReq[0].(string), hmacPrefix))
+	require.Equal(t, xCorrelationIDFromResp[0].(string), hashedCorrelationID)
+
+	wrapReqEntry := entries[16]
+	wrapRespEntry := entries[17]
+
+	wrapRequestFromReq := wrapReqEntry["request"].(map[string]interface{})
+	wrapRequestDataFromReq := wrapRequestFromReq["data"].(map[string]interface{})
+
+	wrapRequestFromResp := wrapRespEntry["request"].(map[string]interface{})
+	wrapRequestDataFromResp := wrapRequestFromResp["data"].(map[string]interface{})
+
+	require.True(t, strings.HasPrefix(wrapRequestDataFromReq["foo"].(string), hmacPrefix))
+	require.Equal(t, wrapRequestDataFromReq["foo"].(string), hashedBar)
+
+	require.True(t, strings.HasPrefix(wrapRequestDataFromResp["foo"].(string), hmacPrefix))
+	require.Equal(t, wrapRequestDataFromResp["foo"].(string), hashedBar)
+
+	wrapResponseData := wrapRespEntry["response"].(map[string]interface{})
+	wrapInfo := wrapResponseData["wrap_info"].(map[string]interface{})
+
+	require.True(t, strings.HasPrefix(wrapInfo["accessor"].(string), hmacPrefix))
+	require.Equal(t, wrapInfo["accessor"].(string), hashedWrapAccessor)
+
+	require.True(t, strings.HasPrefix(wrapInfo["token"].(string), hmacPrefix))
+	require.Equal(t, wrapInfo["token"].(string), hashedWrapToken)
+}
+
+// TestAudit_Headers validates that headers are audited correctly. This includes
+// the default headers (x-correlation-id and user-agent) along with user-specified
+// headers.
+func TestAudit_Headers(t *testing.T) {
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	tempDir := t.TempDir()
+	logFile, err := os.CreateTemp(tempDir, "")
+	require.NoError(t, err)
+	devicePath := "file"
+	deviceData := map[string]any{
+		"type":        "file",
+		"description": "",
+		"local":       false,
+		"options": map[string]any{
+			"file_path": logFile.Name(),
+		},
+	}
+
+	_, err = client.Logical().Write("sys/config/auditing/request-headers/x-some-header", map[string]interface{}{
+		"hmac": false,
+	})
+	require.NoError(t, err)
+
+	// User-Agent header is audited by default
+	client.AddHeader("User-Agent", "foo-agent")
+
+	// X-Some-Header has been added to audited headers manually
+	client.AddHeader("X-Some-Header", "some-value")
+
+	// X-Some-Other-Header will not be audited
+	client.AddHeader("X-Some-Other-Header", "some-other-value")
+
+	// Request 1
+	// Enable the audit device. A test probe request will audited along
+	// with the associated creation response
+	_, err = client.Logical().Write("sys/audit/"+devicePath, deviceData)
+	require.NoError(t, err)
+
+	// Request 2
+	// Ensure the device has been created.
+	devices, err := client.Sys().ListAudit()
+	require.NoError(t, err)
+	require.Len(t, devices, 1)
+
+	// Request 3
+	resp, err := client.Sys().SealStatus()
+	require.NoError(t, err)
+	require.NotEmpty(t, resp)
+
+	expectedHeaders := map[string]interface{}{
+		"user-agent":    []interface{}{"foo-agent"},
+		"x-some-header": []interface{}{"some-value"},
+	}
+
+	entries := make([]map[string]interface{}, 0)
+	scanner := bufio.NewScanner(logFile)
+
+	for scanner.Scan() {
+		entry := make(map[string]interface{})
+
+		err := json.Unmarshal(scanner.Bytes(), &entry)
+		require.NoError(t, err)
+
+		request, ok := entry["request"].(map[string]interface{})
+		require.True(t, ok)
+
+		// test probe will not have headers set
+		requestPath, ok := request["path"].(string)
+		require.True(t, ok)
+
+		if requestPath != "sys/audit/test" {
+			headers, ok := request["headers"].(map[string]interface{})
+
+			require.True(t, ok)
+			require.Equal(t, expectedHeaders, headers)
+		}
+
+		entries = append(entries, entry)
+	}
+
+	// This count includes the initial test probe upon creation of the audit device
+	require.Equal(t, 4, len(entries))
+}
+
+type testAuditStartupPlugin struct {
+	*framework.Backend
+}
+
+func testAuditStartupBackend(t testing.TB, panic *atomic.Bool) logical.Factory {
+	return func(ctx context.Context, config *logical.BackendConfig) (logical.Backend, error) {
+		be := &testAuditStartupPlugin{Backend: &framework.Backend{BackendType: logical.TypeLogical}}
+		if err := be.Setup(ctx, config); err != nil {
+			return nil, err
+		}
+		extendedSys, ok := be.System().(logical.ExtendedSystemView)
+		if !ok {
+			return nil, fmt.Errorf("expected ExtendedSystemView, got %T", be.System())
+		}
+
+		wait := make(chan struct{})
+		// run in a goroutine to more closely mimic the behavior of a plugin where this causes a
+		// problem.
+		go func() {
+			defer close(wait)
+			defer func() {
+				if r := recover(); r != nil {
+					be.Logger().Error("panic during setup", "error", r)
+					panic.Store(true)
+				}
+			}()
+			// try to audit a request before the auditBroker has been created
+			if err := extendedSys.Auditor().AuditRequest(ctx, &logical.LogInput{}); err != nil && !errors.Is(err, consts.ErrSealed) {
+				be.Logger().Error("error auditing request", "error", err)
+			}
+		}()
+		<-wait
+		return be, nil
+	}
+}
+
+// TestAudit_BeforePostUnseal verifies that an audit request can be made before unseal without causing a panic. The test
+// mounts a backend that will attempt to audit a request in a goroutine during its setup. The seals and unseals the
+// cluster to force the backend to be re-created and perform an audit before the audit broker has been created.
+func TestAudit_BeforePostUnseal(t *testing.T) {
+	didPanic := new(atomic.Bool)
+	cluster := vault.NewTestCluster(t, &vault.CoreConfig{
+		LogicalBackends: map[string]logical.Factory{
+			"test": testAuditStartupBackend(t, didPanic),
+		},
+	}, &vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+		NumCores:    1,
+	})
+	defer cluster.Cleanup()
+
+	testhelpers.WaitForActiveNode(t, cluster)
+	err := cluster.Cores[0].Client.Sys().Mount("test", &api.MountInput{
+		Type: "test",
+	})
+	require.NoError(t, err)
+	// Seal and unseal to trigger a re-creation of all the mounts
+	cluster.Cores[0].Seal(t)
+	cluster.UnsealCores(t)
+	testhelpers.WaitForActiveNode(t, cluster)
+	require.False(t, didPanic.Load())
+}
diff --git a/vault/external_tests/consul_fencing_binary/consul_fencing_test.go b/vault/external_tests/consul_fencing_binary/consul_fencing_test.go
index 0efaf7407a5..3faf0039b5e 100644
--- a/vault/external_tests/consul_fencing_binary/consul_fencing_test.go
+++ b/vault/external_tests/consul_fencing_binary/consul_fencing_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package consul_fencing
@@ -15,6 +15,7 @@ import (
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/helper/testhelpers/consul"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/sdk/helper/testcluster"
 	"github.com/hashicorp/vault/sdk/helper/testcluster/docker"
 	"github.com/stretchr/testify/require"
@@ -33,11 +34,12 @@ func TestConsulFencing_PartitionedLeaderCantWrite(t *testing.T) {
 
 	consulStorage := consul.NewClusterStorage()
 
-	// Create  cluster logger that will dump cluster logs to stdout for debugging.
-	logger := hclog.NewInterceptLogger(hclog.DefaultOptions)
+	// Create  cluster logger that will write cluster logs to a file in CI.
+	logger := corehelpers.NewTestLogger(t)
 	logger.SetLevel(hclog.Trace)
 
 	clusterOpts := docker.DefaultOptions(t)
+	// We can use an enterprise image here because we are swapping out the binary anyway.
 	clusterOpts.ImageRepo = "hashicorp/vault-enterprise"
 	clusterOpts.ClusterOptions.Logger = logger
 
@@ -116,7 +118,7 @@ func TestConsulFencing_PartitionedLeaderCantWrite(t *testing.T) {
 	require.NoError(t, err)
 
 	const interval = 500 * time.Millisecond
-
+	const timeout = 3 * time.Second
 	runWriter := func(i int, targetServer testcluster.VaultClusterNode, ctr *uint64) {
 		wg.Add(1)
 		defer wg.Done()
@@ -125,10 +127,13 @@ func TestConsulFencing_PartitionedLeaderCantWrite(t *testing.T) {
 		for {
 			key := fmt.Sprintf("c%d-%08d", i, atomic.LoadUint64(ctr))
 
-			// Use a short timeout. If we don't then the one goroutine writing to the
-			// partitioned active node can get stuck here until the 60 second request
-			// timeout kicks in without issuing another request.
-			reqCtx, cancel := context.WithTimeout(ctx, interval)
+			// Use a short timeout. If we don't then the one goroutine writing
+			// to the partitioned active node can get stuck here until the 60
+			// second request timeout kicks in without issuing another request.
+			// However, this timeout being too short can cause issues too.
+			// Having it set to 500 milliseconds caused the test to
+			// intermittently fail in CI before.
+			reqCtx, cancel := context.WithTimeout(ctx, timeout)
 			logger.Debug("sending patch", "client", i, "key", key)
 			_, err = kv.Patch(reqCtx, "data", map[string]interface{}{
 				key: 1,
@@ -214,7 +219,7 @@ func TestConsulFencing_PartitionedLeaderCantWrite(t *testing.T) {
 			logger.Info("failed write", "write_count", writesAfterPartition, "err", err)
 		default:
 		}
-		require.NoError(t, ctx.Err())
+		require.NoError(t, ctx.Err(), "context error while waiting for writes to new leader")
 	}
 
 	// Heal partition
diff --git a/vault/external_tests/delegated_auth/delegated_auth_test.go b/vault/external_tests/delegated_auth/delegated_auth_test.go
index c50077ffe5f..c33914997fc 100644
--- a/vault/external_tests/delegated_auth/delegated_auth_test.go
+++ b/vault/external_tests/delegated_auth/delegated_auth_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package delegated_auth
@@ -327,7 +327,7 @@ func TestDelegatedAuth(t *testing.T) {
 			path:          "login",
 			username:      "allowed-est",
 			password:      "",
-			errorContains: "missing password",
+			errorContains: "invalid credentials",
 		},
 		{
 			name:          "bad-path-within-delegated-auth-error",
diff --git a/vault/external_tests/expiration/expiration_test.go b/vault/external_tests/expiration/expiration_test.go
index 14fb55b1724..b464fe84623 100644
--- a/vault/external_tests/expiration/expiration_test.go
+++ b/vault/external_tests/expiration/expiration_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package expiration
diff --git a/vault/external_tests/hcp_link/hcp_link_test.go b/vault/external_tests/hcp_link/hcp_link_test.go
index c2e264991db..66632eb61be 100644
--- a/vault/external_tests/hcp_link/hcp_link_test.go
+++ b/vault/external_tests/hcp_link/hcp_link_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package hcp_link
diff --git a/vault/external_tests/hcp_link/test_helpers.go b/vault/external_tests/hcp_link/test_helpers.go
index be06fb0c372..3befd86d4e0 100644
--- a/vault/external_tests/hcp_link/test_helpers.go
+++ b/vault/external_tests/hcp_link/test_helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package hcp_link
diff --git a/vault/external_tests/identity/aliases_test.go b/vault/external_tests/identity/aliases_test.go
index 217ef1687a4..0aae6f05a8c 100644
--- a/vault/external_tests/identity/aliases_test.go
+++ b/vault/external_tests/identity/aliases_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
diff --git a/vault/external_tests/identity/entities_test.go b/vault/external_tests/identity/entities_test.go
index afeff38f954..5d905d6d937 100644
--- a/vault/external_tests/identity/entities_test.go
+++ b/vault/external_tests/identity/entities_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
diff --git a/vault/external_tests/identity/group_aliases_test.go b/vault/external_tests/identity/group_aliases_test.go
index 6ae40e9a667..2ac3e46cb44 100644
--- a/vault/external_tests/identity/group_aliases_test.go
+++ b/vault/external_tests/identity/group_aliases_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
diff --git a/vault/external_tests/identity/groups_test.go b/vault/external_tests/identity/groups_test.go
index 49bc405435d..e86709435ed 100644
--- a/vault/external_tests/identity/groups_test.go
+++ b/vault/external_tests/identity/groups_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
@@ -153,7 +153,7 @@ func TestIdentityStore_ExternalGroupMembershipsAcrossMounts(t *testing.T) {
 	}
 	ldapMountAccessor1 := auths["ldap/"].Accessor
 
-	cleanup, cfg := ldaphelper.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldaphelper.PrepareTestContainer(t, ldaphelper.DefaultVersion)
 	defer cleanup()
 
 	// Configure LDAP auth
@@ -255,7 +255,7 @@ func TestIdentityStore_ExternalGroupMembershipsAcrossMounts(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	cleanup2, cfg2 := ldaphelper.PrepareTestContainer(t, "latest")
+	cleanup2, cfg2 := ldaphelper.PrepareTestContainer(t, ldaphelper.DefaultVersion)
 	defer cleanup2()
 
 	// Configure LDAP auth
diff --git a/vault/external_tests/identity/identity_test.go b/vault/external_tests/identity/identity_test.go
index 8634566f6e7..7f45a8325a4 100644
--- a/vault/external_tests/identity/identity_test.go
+++ b/vault/external_tests/identity/identity_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
@@ -11,10 +11,12 @@ import (
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/namespace"
 	ldaphelper "github.com/hashicorp/vault/helper/testhelpers/ldap"
 	"github.com/hashicorp/vault/helper/testhelpers/minimal"
 	"github.com/hashicorp/vault/sdk/helper/ldaputil"
+	"github.com/hashicorp/vault/vault"
 	"github.com/stretchr/testify/require"
 )
 
@@ -30,10 +32,10 @@ func TestIdentityStore_ExternalGroupMemberships_DifferentMounts(t *testing.T) {
 	require.NoError(t, err)
 	entityID := secret.Data["id"].(string)
 
-	cleanup, config1 := ldaphelper.PrepareTestContainer(t, "latest")
+	cleanup, config1 := ldaphelper.PrepareTestContainer(t, ldaphelper.DefaultVersion)
 	defer cleanup()
 
-	cleanup2, config2 := ldaphelper.PrepareTestContainer(t, "latest")
+	cleanup2, config2 := ldaphelper.PrepareTestContainer(t, ldaphelper.DefaultVersion)
 	defer cleanup2()
 
 	setupFunc := func(path string, cfg *ldaputil.ConfigEntry) string {
@@ -222,7 +224,7 @@ func TestIdentityStore_Integ_GroupAliases(t *testing.T) {
 		t.Fatalf("bad: group alias: %#v\n", aliasMap)
 	}
 
-	cleanup, cfg := ldaphelper.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldaphelper.PrepareTestContainer(t, ldaphelper.DefaultVersion)
 	defer cleanup()
 
 	// Configure LDAP auth
@@ -457,7 +459,7 @@ func TestIdentityStore_Integ_RemoveFromExternalGroup(t *testing.T) {
 		t.Fatalf("bad: group alias: %#v\n", aliasMap)
 	}
 
-	cleanup, cfg := ldaphelper.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldaphelper.PrepareTestContainer(t, ldaphelper.DefaultVersion)
 	defer cleanup()
 
 	// Configure LDAP auth
@@ -642,3 +644,24 @@ func addRemoveLdapGroupMember(t *testing.T, cfg *ldaputil.ConfigEntry, userCN st
 		t.Fatal(err)
 	}
 }
+
+func findEntityFromDuplicateSet(t *testing.T, c *vault.TestClusterCore, entityIDs []string) *identity.Entity {
+	t.Helper()
+
+	var entity *identity.Entity
+
+	// Try fetch each ID and ensure exactly one is present
+	found := 0
+	for _, entityID := range entityIDs {
+		e, err := c.IdentityStore().MemDBEntityByID(entityID, true)
+		require.NoError(t, err)
+		if e != nil {
+			found++
+			entity = e
+		}
+	}
+	// More than one means they didn't merge as expected!
+	require.Equal(t, found, 1,
+		"node %s does not have exactly one duplicate from the set", c.NodeID)
+	return entity
+}
diff --git a/vault/external_tests/identity/login_mfa_duo_test.go b/vault/external_tests/identity/login_mfa_duo_test.go
index 1817b633987..e08c1f17196 100644
--- a/vault/external_tests/identity/login_mfa_duo_test.go
+++ b/vault/external_tests/identity/login_mfa_duo_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
diff --git a/vault/external_tests/identity/login_mfa_okta_test.go b/vault/external_tests/identity/login_mfa_okta_test.go
index d1306d210cb..0a670f83913 100644
--- a/vault/external_tests/identity/login_mfa_okta_test.go
+++ b/vault/external_tests/identity/login_mfa_okta_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
diff --git a/vault/external_tests/identity/login_mfa_totp_test.go b/vault/external_tests/identity/login_mfa_totp_test.go
index b5794b2b850..2fe798fbc1e 100644
--- a/vault/external_tests/identity/login_mfa_totp_test.go
+++ b/vault/external_tests/identity/login_mfa_totp_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
@@ -7,6 +7,7 @@ import (
 	"context"
 	"encoding/base64"
 	"fmt"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -17,7 +18,6 @@ import (
 	"github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/builtin/logical/totp"
 	"github.com/hashicorp/vault/helper/testhelpers"
-	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
@@ -51,7 +51,7 @@ func doTwoPhaseLogin(t *testing.T, client *api.Client, totpCodePath, methodID, u
 }
 
 func TestLoginMfaGenerateTOTPTestAuditIncluded(t *testing.T) {
-	noop := corehelpers.TestNoopAudit(t, "noop/", nil)
+	noop := audit.TestNoopAudit(t, "noop/", nil)
 
 	cluster := vault.NewTestCluster(t, &vault.CoreConfig{
 		CredentialBackends: map[string]logical.Factory{
@@ -61,7 +61,7 @@ func TestLoginMfaGenerateTOTPTestAuditIncluded(t *testing.T) {
 			"totp": totp.Factory,
 		},
 		AuditBackends: map[string]audit.Factory{
-			"noop": func(ctx context.Context, config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
+			"noop": func(config *audit.BackendConfig, _ audit.HeaderFormatter) (audit.Backend, error) {
 				return noop, nil
 			},
 		},
@@ -93,7 +93,7 @@ func TestLoginMfaGenerateTOTPTestAuditIncluded(t *testing.T) {
 	// Creating two users in the userpass auth mount
 	userClient1, entityID1, _ := testhelpers.CreateEntityAndAlias(t, client, mountAccessor, entity1, testuser1)
 	userClient2, entityID2, _ := testhelpers.CreateEntityAndAlias(t, client, mountAccessor, entity2, testuser2)
-	waitPeriod := 5
+	waitPeriod := 3
 	totpConfig := map[string]interface{}{
 		"issuer":                  "yCorp",
 		"period":                  waitPeriod,
@@ -282,10 +282,24 @@ func TestLoginMfaGenerateTOTPTestAuditIncluded(t *testing.T) {
 	if err == nil {
 		t.Fatalf("MFA succeeded with an already used passcode")
 	}
-	if !strings.Contains(err.Error(), "code already used") {
-		t.Fatalf("got: %+v, expected: code already used", err.Error())
+	if !strings.Contains(err.Error(), "failed to validate TOTP passcode") {
+		t.Fatalf("got: %+v, expected: failed to validate TOTP passcode", err.Error())
 	}
 
+	for _, possibleCode := range []string{totpPasscode1 + " ", "  " + totpPasscode1} {
+		_, err = userClient1.Logical().WriteWithContext(context.Background(), "sys/mfa/validate", map[string]interface{}{
+			"mfa_request_id": secret.Auth.MFARequirement.MFARequestID,
+			"mfa_payload": map[string][]string{
+				methodID: {possibleCode},
+			},
+		})
+		if err == nil {
+			t.Fatalf("MFA succeeded with an already used passcode")
+		}
+		if !strings.Contains(err.Error(), "failed to validate TOTP passcode") {
+			t.Fatalf("got: %+v, expected: failed to validate TOTP passcode", err.Error())
+		}
+	}
 	// check for reaching max failed validation requests
 	secret, err = userClient1.Logical().WriteWithContext(context.Background(), userpassPath, map[string]interface{}{
 		"password": "testpassword",
@@ -301,7 +315,7 @@ func TestLoginMfaGenerateTOTPTestAuditIncluded(t *testing.T) {
 		_, maxErr = userClient1.Logical().WriteWithContext(context.Background(), "sys/mfa/validate", map[string]interface{}{
 			"mfa_request_id": secret.Auth.MFARequirement.MFARequestID,
 			"mfa_payload": map[string][]string{
-				methodID: {fmt.Sprintf("%d", i)},
+				methodID: {fmt.Sprintf("%s", strings.Repeat(strconv.Itoa(i), len(totpPasscode1)))},
 			},
 		})
 		if maxErr == nil {
@@ -315,8 +329,8 @@ func TestLoginMfaGenerateTOTPTestAuditIncluded(t *testing.T) {
 	// let's make sure the configID is not blocked for other users
 	doTwoPhaseLogin(t, userClient2, enginePath2, methodID, testuser2)
 
-	// let's see if user1 is able to login after 5 seconds
-	time.Sleep(5 * time.Second)
+	// let's see if user1 is able to login after 3 * (2+1) = 9 seconds
+	time.Sleep(9 * time.Second)
 	doTwoPhaseLogin(t, userClient1, enginePath1, methodID, testuser1)
 
 	// Destroy the secret so that the token can self generate
diff --git a/vault/external_tests/identity/oidc_provider_test.go b/vault/external_tests/identity/oidc_provider_test.go
index a360a5f096f..7880ea6ba88 100644
--- a/vault/external_tests/identity/oidc_provider_test.go
+++ b/vault/external_tests/identity/oidc_provider_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
diff --git a/vault/external_tests/identity/userlockouts_test.go b/vault/external_tests/identity/userlockouts_test.go
index 2a7b69913cf..091e03068d3 100644
--- a/vault/external_tests/identity/userlockouts_test.go
+++ b/vault/external_tests/identity/userlockouts_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
diff --git a/vault/external_tests/interned_regexp/interned_regexp_test.go b/vault/external_tests/interned_regexp/interned_regexp_test.go
new file mode 100644
index 00000000000..3e2e5037451
--- /dev/null
+++ b/vault/external_tests/interned_regexp/interned_regexp_test.go
@@ -0,0 +1,50 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package interned_regexp
+
+import (
+	"fmt"
+	"strconv"
+	"sync"
+	"testing"
+
+	"github.com/hashicorp/vault/api"
+	"github.com/hashicorp/vault/helper/testhelpers/minimal"
+	"github.com/stretchr/testify/require"
+)
+
+// TestInternedRegexpConcurrentAccess tests that multiple goroutines can
+// concurrently access and create multiple instances of the same type of mount
+// without causing any issues. This is important to ensure that the interned
+// regular expressions used in the mount paths do not cause have concurrency
+// faults.
+func TestInternedRegexpConcurrentAccess(t *testing.T) {
+	cluster := minimal.NewTestSoloCluster(t, nil)
+	client := cluster.Cores[0].Client
+
+	// Build mount input
+	mountInput := &api.MountInput{
+		Type: "pki",
+	}
+
+	// Mount 10 PKI secrets engine mounts.
+	wg := sync.WaitGroup{}
+	for i := 0; i < 10; i++ {
+		mountPath := "pki" + strconv.Itoa(i)
+		wg.Add(1)
+		go func() {
+			err := client.Sys().Mount(mountPath, mountInput)
+			require.NoError(t, err)
+
+			// Verify the mount was created
+			_, err = client.Sys().GetMount(mountPath)
+			require.NoError(t, err)
+
+			_, err = client.Logical().List(fmt.Sprintf("/%s/roles", mountPath))
+			require.NoError(t, err)
+			wg.Done()
+		}()
+	}
+	wg.Wait()
+}
diff --git a/vault/external_tests/kv/kv_patch_test.go b/vault/external_tests/kv/kv_patch_test.go
index 1b4802821ea..af66a9bbcbe 100644
--- a/vault/external_tests/kv/kv_patch_test.go
+++ b/vault/external_tests/kv/kv_patch_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kv
@@ -14,6 +14,7 @@ import (
 
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/helper/testhelpers/minimal"
+	"github.com/stretchr/testify/require"
 )
 
 func TestKV_Patch_BadContentTypeHeader(t *testing.T) {
@@ -158,7 +159,10 @@ func TestKV_Patch_Audit(t *testing.T) {
 	decoder := json.NewDecoder(auditLogFile)
 
 	var auditRecord map[string]interface{}
-	for decoder.Decode(&auditRecord) == nil {
+	for decoder.More() {
+		err := decoder.Decode(&auditRecord)
+		require.NoError(t, err)
+
 		auditRequest := map[string]interface{}{}
 
 		if req, ok := auditRecord["request"]; ok {
diff --git a/vault/external_tests/kv/kv_subkeys_test.go b/vault/external_tests/kv/kv_subkeys_test.go
index bcd2670c5ea..afa26efa7d9 100644
--- a/vault/external_tests/kv/kv_subkeys_test.go
+++ b/vault/external_tests/kv/kv_subkeys_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kv
diff --git a/vault/external_tests/kv/kvv2_upgrade_test.go b/vault/external_tests/kv/kvv2_upgrade_test.go
index 3e82a48faf9..04a4e7f7e50 100644
--- a/vault/external_tests/kv/kvv2_upgrade_test.go
+++ b/vault/external_tests/kv/kvv2_upgrade_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package kv
diff --git a/vault/external_tests/metrics/core_metrics_int_test.go b/vault/external_tests/metrics/core_metrics_int_test.go
index 7a9005ed9b0..ae3a7b1107f 100644
--- a/vault/external_tests/metrics/core_metrics_int_test.go
+++ b/vault/external_tests/metrics/core_metrics_int_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package metrics
@@ -7,7 +7,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"io/ioutil"
+	"io"
 	"testing"
 	"time"
 
@@ -49,7 +49,7 @@ func TestMountTableMetrics(t *testing.T) {
 
 	nonlocalLogicalMountsize, err := gaugeSearchHelper(data, 3)
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 	}
 
 	// Mount new kv
@@ -69,11 +69,11 @@ func TestMountTableMetrics(t *testing.T) {
 
 	nonlocalLogicalMountsizeAfterMount, err := gaugeSearchHelper(data, 4)
 	if err != nil {
-		t.Errorf(err.Error())
+		t.Error(err.Error())
 	}
 
 	if nonlocalLogicalMountsizeAfterMount <= nonlocalLogicalMountsize {
-		t.Errorf("Mount size does not change after new mount is mounted")
+		t.Error("Mount size does not change after new mount is mounted")
 	}
 }
 
@@ -139,7 +139,7 @@ func TestLeaderReElectionMetrics(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	bodyBytes, err := ioutil.ReadAll(respo.Response.Body)
+	bodyBytes, err := io.ReadAll(respo.Response.Body)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -183,7 +183,7 @@ func TestLeaderReElectionMetrics(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	bodyBytes, err = ioutil.ReadAll(respo.Response.Body)
+	bodyBytes, err = io.ReadAll(respo.Response.Body)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/vault/external_tests/mfa/login_mfa_test.go b/vault/external_tests/mfa/login_mfa_test.go
index 5e99fad8eeb..97e9c9c6316 100644
--- a/vault/external_tests/mfa/login_mfa_test.go
+++ b/vault/external_tests/mfa/login_mfa_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package mfa
diff --git a/vault/external_tests/misc/misc_binary/recovery_test.go b/vault/external_tests/misc/misc_binary/recovery_test.go
index 00e5570c308..bcef667ea41 100644
--- a/vault/external_tests/misc/misc_binary/recovery_test.go
+++ b/vault/external_tests/misc/misc_binary/recovery_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package misc
@@ -31,7 +31,8 @@ func TestRecovery_Docker(t *testing.T) {
 		t.Skip("only running docker test when $VAULT_BINARY present")
 	}
 	opts := &docker.DockerClusterOptions{
-		ImageRepo: "hashicorp/vault",
+		ImageRepo:    "hashicorp/vault",
+		DisableMlock: true,
 		// We're replacing the binary anyway, so we're not too particular about
 		// the docker image version tag.
 		ImageTag:    "latest",
diff --git a/vault/external_tests/misc/recover_from_panic_test.go b/vault/external_tests/misc/recover_from_panic_test.go
index 9452ad84096..c0f0277016d 100644
--- a/vault/external_tests/misc/recover_from_panic_test.go
+++ b/vault/external_tests/misc/recover_from_panic_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package misc
@@ -19,7 +19,8 @@ func TestRecoverFromPanic(t *testing.T) {
 		LogicalBackends: map[string]logical.Factory{
 			"noop": vault.NoopBackendFactory,
 		},
-		EnableRaw: true,
+		EnableRaw:    true,
+		DisableMlock: true,
 	}
 	cluster := vault.NewTestCluster(t, coreConfig, &vault.TestClusterOptions{
 		HandlerFunc: vaulthttp.Handler,
diff --git a/vault/external_tests/misc/recovery_test.go b/vault/external_tests/misc/recovery_test.go
index 5939f282de6..8904c90a150 100644
--- a/vault/external_tests/misc/recovery_test.go
+++ b/vault/external_tests/misc/recovery_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package misc
@@ -27,7 +27,8 @@ func TestRecovery(t *testing.T) {
 	var rootToken string
 	{
 		conf := vault.CoreConfig{
-			Physical: inm,
+			Physical:     inm,
+			DisableMlock: true,
 		}
 		opts := vault.TestClusterOptions{
 			HandlerFunc: http.Handler,
diff --git a/vault/external_tests/plugin/external_plugin_test.go b/vault/external_tests/plugin/external_plugin_test.go
index 837d32f8a88..f72a2c030b8 100644
--- a/vault/external_tests/plugin/external_plugin_test.go
+++ b/vault/external_tests/plugin/external_plugin_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugin_test
@@ -9,13 +9,13 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/api/auth/approle"
 	"github.com/hashicorp/vault/audit"
-	auditFile "github.com/hashicorp/vault/builtin/audit/file"
 	"github.com/hashicorp/vault/builtin/logical/database"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/testhelpers/consul"
@@ -28,6 +28,7 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
 	_ "github.com/jackc/pgx/v4/stdlib"
+	"github.com/stretchr/testify/require"
 )
 
 func getCluster(t *testing.T, numCores int, types ...consts.PluginType) *vault.TestCluster {
@@ -38,7 +39,7 @@ func getCluster(t *testing.T, numCores int, types ...consts.PluginType) *vault.T
 			"database": database.Factory,
 		},
 		AuditBackends: map[string]audit.Factory{
-			"file": auditFile.Factory,
+			"file": audit.NewFileBackend,
 		},
 	}
 
@@ -105,15 +106,19 @@ func TestExternalPlugin_RollbackAndReload(t *testing.T) {
 
 func testRegisterVersion(t *testing.T, client *api.Client, plugin pluginhelpers.TestPlugin, version string) {
 	t.Helper()
-	if err := client.Sys().RegisterPlugin(&api.RegisterPluginInput{
+	resp, err := client.Sys().RegisterPluginDetailed(&api.RegisterPluginInput{
 		Name:    plugin.Name,
 		Type:    api.PluginType(plugin.Typ),
 		Command: plugin.Name,
 		SHA256:  plugin.Sha256,
 		Version: version,
-	}); err != nil {
+	})
+	if err != nil {
 		t.Fatal(err)
 	}
+	if len(resp.Warnings) > 0 {
+		t.Errorf("expected no warnings, got: %v", resp.Warnings)
+	}
 }
 
 func testEnableVersion(t *testing.T, client *api.Client, plugin pluginhelpers.TestPlugin, version string) {
@@ -178,7 +183,7 @@ func TestExternalPlugin_ContinueOnError(t *testing.T) {
 
 func testExternalPlugin_ContinueOnError(t *testing.T, mismatch bool, pluginType consts.PluginType) {
 	cluster := getCluster(t, 1, pluginType)
-	defer cluster.Cleanup()
+	t.Cleanup(cluster.Cleanup)
 
 	core := cluster.Cores[0]
 	plugin := cluster.Plugins[0]
@@ -283,10 +288,12 @@ func testExternalPlugin_ContinueOnError(t *testing.T, mismatch bool, pluginType
 }
 
 // TestExternalPlugin_AuthMethod tests that we can build, register and use an
-// external auth method
+// external auth method (approle)
 func TestExternalPlugin_AuthMethod(t *testing.T) {
+	// getCluster calls pluginhelper.CompilePlugin which builds the approle
+	// auth method as a stand-in for the PluginTypeCredential
 	cluster := getCluster(t, 5, consts.PluginTypeCredential)
-	defer cluster.Cleanup()
+	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -295,18 +302,27 @@ func TestExternalPlugin_AuthMethod(t *testing.T) {
 	// Register
 	testRegisterVersion(t, client, plugin, plugin.Version)
 
-	// define a group of parallel tests so we wait for their execution before
-	// continuing on to cleanup
-	// see: https://go.dev/blog/subtests
-	t.Run("parallel execution group", func(t *testing.T) {
-		// loop to mount 5 auth methods that will each share a single
-		// plugin process
-		for i := 0; i < 5; i++ {
-			i := i
-			pluginPath := fmt.Sprintf("%s-%d", plugin.Name, i)
-			client := cluster.Cores[i].Client
+	var pluginTest sync.WaitGroup
+	// loop to mount 5 auth methods that will each share a single plugin process
+	for i := 0; i < 5; i++ {
+		i := i
+		pluginTest.Add(1)
+		// We will be making concurrent requests so we grab a unique client per
+		// mount. Otherwise our login requests will overwrite the vault token
+		// for all goroutines.
+		client := cluster.Cores[i].Client
+		pluginPath := fmt.Sprintf("%s-%d", plugin.Name, i)
+		t.Cleanup(func() {
+			if err := client.Sys().DisableAuth(pluginPath); err != nil {
+				t.Fatal(err)
+			}
+		})
+
+		// spin off 5 goroutines to make concurrent requests to the plugin
+		// to simulate a real-world environment
+		go func() {
+			defer pluginTest.Done()
 			t.Run(pluginPath, func(t *testing.T) {
-				t.Parallel()
 				client.SetToken(cluster.RootToken)
 				// Enable
 				if err := client.Sys().EnableAuthWithOptions(pluginPath, &api.EnableAuthOptions{
@@ -376,14 +392,13 @@ func TestExternalPlugin_AuthMethod(t *testing.T) {
 				if err == nil {
 					t.Fatalf("expected error, got nil")
 				}
-
-				// Reset root token
-				client.SetToken(cluster.RootToken)
 			})
-		}
-	})
+		}()
+	}
+
+	// wait for goroutine execution before continuing on to cleanup
+	pluginTest.Wait()
 
-	// Deregister
 	if err := client.Sys().DeregisterPlugin(&api.DeregisterPluginInput{
 		Name:    plugin.Name,
 		Type:    api.PluginType(plugin.Typ),
@@ -397,7 +412,7 @@ func TestExternalPlugin_AuthMethod(t *testing.T) {
 // method after reload
 func TestExternalPlugin_AuthMethodReload(t *testing.T) {
 	cluster := getCluster(t, 1, consts.PluginTypeCredential)
-	defer cluster.Cleanup()
+	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -458,6 +473,10 @@ func TestExternalPlugin_AuthMethodReload(t *testing.T) {
 	// Reset root token
 	client.SetToken(cluster.RootToken)
 
+	if err := client.Sys().DisableAuth(plugin.Name); err != nil {
+		t.Fatal(err)
+	}
+
 	// Deregister
 	if err := client.Sys().DeregisterPlugin(&api.DeregisterPluginInput{
 		Name:    plugin.Name,
@@ -469,10 +488,13 @@ func TestExternalPlugin_AuthMethodReload(t *testing.T) {
 }
 
 // TestExternalPlugin_SecretsEngine tests that we can build, register and use an
-// external secrets engine
+// external secrets engine (consul)
 func TestExternalPlugin_SecretsEngine(t *testing.T) {
+	t.Parallel()
+	// getCluster calls pluginhelper.CompilePlugin which builds the consul
+	// secrets engine as a stand-in for the PluginTypeSecrets
 	cluster := getCluster(t, 1, consts.PluginTypeSecrets)
-	defer cluster.Cleanup()
+	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -481,16 +503,24 @@ func TestExternalPlugin_SecretsEngine(t *testing.T) {
 	// Register
 	testRegisterVersion(t, client, plugin, plugin.Version)
 
-	// define a group of parallel tests so we wait for their execution before
-	// continuing on to cleanup
-	// see: https://go.dev/blog/subtests
-	t.Run("parallel execution group", func(t *testing.T) {
-		// loop to mount 5 secrets engines that will each share a single
-		// plugin process
-		for i := 0; i < 5; i++ {
-			pluginPath := fmt.Sprintf("%s-%d", plugin.Name, i)
+	var pluginTest sync.WaitGroup
+	// loop to mount 5 secrets engines that will each share a single plugin process
+	for i := 0; i < 5; i++ {
+		i := i
+		pluginTest.Add(1)
+		pluginPath := fmt.Sprintf("%s-%d", plugin.Name, i)
+		t.Cleanup(func() {
+			if err := client.Sys().Unmount(pluginPath); err != nil {
+				t.Fatal(err)
+			}
+		})
+
+		// spin off 5 goroutines to make concurrent requests to the plugin
+		// to simulate a real-world environment
+		go func() {
+			defer pluginTest.Done()
 			t.Run(pluginPath, func(t *testing.T) {
-				t.Parallel()
+				client.SetToken(cluster.RootToken)
 				// Enable
 				if err := client.Sys().Mount(pluginPath, &api.MountInput{
 					Type: plugin.Name,
@@ -500,7 +530,7 @@ func TestExternalPlugin_SecretsEngine(t *testing.T) {
 
 				// Configure
 				cleanupConsul, consulConfig := consul.PrepareTestContainer(t, "", false, true)
-				defer cleanupConsul()
+				t.Cleanup(cleanupConsul)
 
 				_, err := client.Logical().Write(pluginPath+"/config/access", map[string]interface{}{
 					"address": consulConfig.Address(),
@@ -526,11 +556,34 @@ func TestExternalPlugin_SecretsEngine(t *testing.T) {
 				if resp == nil {
 					t.Fatal("read creds response is nil")
 				}
+
+				revokeLease := resp.LeaseID
+				// Lookup - expect SUCCESS
+				resp, err = client.Sys().Lookup(revokeLease)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if resp == nil {
+					t.Fatalf("lease lookup response is nil")
+				}
+
+				// Revoke
+				if err = client.Sys().Revoke(revokeLease); err != nil {
+					t.Fatal(err)
+				}
+
+				// Lookup - expect FAILURE
+				_, err = client.Sys().Lookup(revokeLease)
+				if err == nil {
+					t.Fatalf("expected error, got nil")
+				}
 			})
-		}
-	})
+		}()
+	}
+
+	// wait for goroutine execution before continuing on to cleanup
+	pluginTest.Wait()
 
-	// Deregister
 	if err := client.Sys().DeregisterPlugin(&api.DeregisterPluginInput{
 		Name:    plugin.Name,
 		Type:    api.PluginType(plugin.Typ),
@@ -543,8 +596,9 @@ func TestExternalPlugin_SecretsEngine(t *testing.T) {
 // TestExternalPlugin_SecretsEngineReload tests that we can use an external
 // secrets engine after reload
 func TestExternalPlugin_SecretsEngineReload(t *testing.T) {
+	t.Parallel()
 	cluster := getCluster(t, 1, consts.PluginTypeSecrets)
-	defer cluster.Cleanup()
+	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -554,7 +608,7 @@ func TestExternalPlugin_SecretsEngineReload(t *testing.T) {
 
 	// Configure
 	cleanupConsul, consulConfig := consul.PrepareTestContainer(t, "", false, true)
-	defer cleanupConsul()
+	t.Cleanup(cleanupConsul)
 
 	_, err := client.Logical().Write(plugin.Name+"/config/access", map[string]interface{}{
 		"address": consulConfig.Address(),
@@ -596,6 +650,10 @@ func TestExternalPlugin_SecretsEngineReload(t *testing.T) {
 		t.Fatal("read creds response is nil")
 	}
 
+	if err := client.Sys().Unmount(plugin.Name); err != nil {
+		t.Fatal(err)
+	}
+
 	// Deregister
 	if err := client.Sys().DeregisterPlugin(&api.DeregisterPluginInput{
 		Name:    plugin.Name,
@@ -607,10 +665,13 @@ func TestExternalPlugin_SecretsEngineReload(t *testing.T) {
 }
 
 // TestExternalPlugin_Database tests that we can build, register and use an
-// external database secrets engine
+// external database secrets engine (postgres)
 func TestExternalPlugin_Database(t *testing.T) {
+	t.Parallel()
+	// getCluster calls pluginhelper.CompilePlugin which builds the postgres
+	// database engine as a stand-in for the PluginTypeSecrets
 	cluster := getCluster(t, 1, consts.PluginTypeDatabase)
-	defer cluster.Cleanup()
+	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -619,27 +680,29 @@ func TestExternalPlugin_Database(t *testing.T) {
 	// Register
 	testRegisterVersion(t, client, plugin, plugin.Version)
 
-	// Enable
+	// Enable the database engine
 	if err := client.Sys().Mount(consts.PluginTypeDatabase.String(), &api.MountInput{
 		Type: consts.PluginTypeDatabase.String(),
 	}); err != nil {
 		t.Fatal(err)
 	}
 
-	// define a group of parallel tests so we wait for their execution before
-	// continuing on to cleanup
-	// see: https://go.dev/blog/subtests
-	t.Run("parallel execution group", func(t *testing.T) {
-		// loop to mount 5 database connections that will each share a single
-		// plugin process
-		for i := 0; i < 5; i++ {
-			dbName := fmt.Sprintf("%s-%d", plugin.Name, i)
+	var pluginTest sync.WaitGroup
+	// loop to mount 5 secrets engines that will each share a single plugin process
+	for i := 0; i < 5; i++ {
+		i := i
+		pluginTest.Add(1)
+		dbName := fmt.Sprintf("%s-%d", plugin.Name, i)
+
+		// spin off 5 goroutines to make concurrent requests to the plugin
+		// to simulate a real-world environment
+		go func() {
+			defer pluginTest.Done()
 			t.Run(dbName, func(t *testing.T) {
-				t.Parallel()
 				roleName := "test-role-" + dbName
 
-				cleanupContainer, connURL := postgreshelper.PrepareTestContainerWithVaultUser(t, context.Background(), "13.4-buster")
-				defer cleanupContainer()
+				cleanupContainer, connURL := postgreshelper.PrepareTestContainerWithVaultUser(t, context.Background())
+				t.Cleanup(cleanupContainer)
 
 				_, err := client.Logical().Write("database/config/"+dbName, map[string]interface{}{
 					"connection_url": connURL,
@@ -689,14 +752,6 @@ func TestExternalPlugin_Database(t *testing.T) {
 					t.Fatal("read creds response is nil")
 				}
 
-				resp, err = client.Logical().Read("database/creds/" + roleName)
-				if err != nil {
-					t.Fatal(err)
-				}
-				if resp == nil {
-					t.Fatal("read creds response is nil")
-				}
-
 				revokeLease := resp.LeaseID
 				// Lookup - expect SUCCESS
 				resp, err = client.Sys().Lookup(revokeLease)
@@ -720,11 +775,22 @@ func TestExternalPlugin_Database(t *testing.T) {
 				if err == nil {
 					t.Fatalf("expected error, got nil")
 				}
+
+				// Revoke all leases so we don't get errors when we unmount the database engine
+				if err = client.Sys().RevokePrefix("database/creds/" + roleName); err != nil {
+					t.Fatal(err)
+				}
 			})
-		}
-	})
+		}()
+	}
+
+	// wait for goroutine execution before continuing on to cleanup
+	pluginTest.Wait()
+
+	if err := client.Sys().Unmount(consts.PluginTypeDatabase.String()); err != nil {
+		t.Fatal(err)
+	}
 
-	// Deregister
 	if err := client.Sys().DeregisterPlugin(&api.DeregisterPluginInput{
 		Name:    plugin.Name,
 		Type:    api.PluginType(plugin.Typ),
@@ -737,8 +803,9 @@ func TestExternalPlugin_Database(t *testing.T) {
 // TestExternalPlugin_DatabaseReload tests that we can use an external database
 // secrets engine after reload
 func TestExternalPlugin_DatabaseReload(t *testing.T) {
+	t.Parallel()
 	cluster := getCluster(t, 1, consts.PluginTypeDatabase)
-	defer cluster.Cleanup()
+	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -754,55 +821,84 @@ func TestExternalPlugin_DatabaseReload(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	dbName := fmt.Sprintf("%s-%d", plugin.Name, 0)
-	roleName := "test-role-" + dbName
-
-	cleanupContainer, connURL := postgreshelper.PrepareTestContainerWithVaultUser(t, context.Background(), "13.4-buster")
-	defer cleanupContainer()
-
-	_, err := client.Logical().Write("database/config/"+dbName, map[string]interface{}{
-		"connection_url": connURL,
-		"plugin_name":    plugin.Name,
-		"allowed_roles":  []string{roleName},
-		"username":       "vaultadmin",
-		"password":       "vaultpass",
+	roleName := "test-role"
+
+	// create 4 databases to create connections for
+	cleanupContainer0, connURL0 := postgreshelper.PrepareTestContainerWithVaultUser(t, context.Background())
+	t.Cleanup(cleanupContainer0)
+	cleanupContainer1, connURL1 := postgreshelper.PrepareTestContainerWithVaultUser(t, context.Background())
+	t.Cleanup(cleanupContainer1)
+	cleanupContainer2, connURL2 := postgreshelper.PrepareTestContainerWithVaultUser(t, context.Background())
+	t.Cleanup(cleanupContainer2)
+
+	var roles []string
+	// write the config and roles for the first 3 DBs
+	for i, url := range []string{connURL0, connURL1, connURL2} {
+		dbName := fmt.Sprintf("%s-%d", plugin.Name, i)
+		_, err := client.Logical().Write("database/config/"+dbName, map[string]interface{}{
+			"connection_url": url,
+			"plugin_name":    plugin.Name,
+			"allowed_roles":  []string{"*"},
+			"username":       "vaultadmin",
+			"password":       "vaultpass",
+		})
+		require.NoError(t, err)
+
+		r := fmt.Sprintf("%s-%d", roleName, i)
+		roles = append(roles, r)
+		_, err = client.Logical().Write("database/roles/"+r, map[string]interface{}{
+			"db_name":             dbName,
+			"creation_statements": testRole,
+			"max_ttl":             "10m",
+		})
+		require.NoError(t, err)
+	}
+
+	// the 4th db connection has a bad connURL on purpose, it should not fail
+	// the plugin reload
+	_, err := client.Logical().Write("database/config/"+plugin.Name+"-3", map[string]interface{}{
+		"connection_url":    "foobar",
+		"verify_connection": false, // this db connection should not fail the plugin reload
+		"plugin_name":       plugin.Name,
+		"allowed_roles":     []string{"*"},
+		"username":          "vaultadmin",
+		"password":          "vaultpass",
 	})
-	if err != nil {
-		t.Fatal(err)
+	require.NoError(t, err)
+
+	for _, role := range roles {
+		resp, err := client.Logical().Read("database/creds/" + role)
+		require.NoError(t, err)
+		if resp == nil {
+			t.Fatal("read creds response is nil")
+		}
 	}
 
-	_, err = client.Logical().Write("database/roles/"+roleName, map[string]interface{}{
-		"db_name":             dbName,
-		"creation_statements": testRole,
-		"max_ttl":             "10m",
+	// Reload plugin
+	_, err = client.Sys().ReloadPlugin(&api.ReloadPluginInput{
+		Plugin: plugin.Name,
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
 
-	resp, err := client.Logical().Read("database/creds/" + roleName)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if resp == nil {
-		t.Fatal("read creds response is nil")
+	// Generate credentials after reload
+	for _, role := range roles {
+		resp, err := client.Logical().Read("database/creds/" + role)
+		require.NoError(t, err)
+		if resp == nil {
+			t.Fatal("read creds response is nil")
+		}
 	}
 
-	// Reload plugin
-	if _, err := client.Sys().ReloadPlugin(&api.ReloadPluginInput{
+	// remove one postgres database so that the plugin reload will fail
+	cleanupContainer1()
+	_, err = client.Sys().ReloadPlugin(&api.ReloadPluginInput{
 		Plugin: plugin.Name,
-	}); err != nil {
-		t.Fatal(err)
-	}
+	})
+	require.NoError(t, err)
 
-	// Generate credentials after reload
-	resp, err = client.Logical().Read("database/creds/" + roleName)
-	if err != nil {
+	if err := client.Sys().Unmount(plugin.Name); err != nil {
 		t.Fatal(err)
 	}
-	if resp == nil {
-		t.Fatal("read creds response is nil")
-	}
 
 	// Deregister
 	if err := client.Sys().DeregisterPlugin(&api.DeregisterPluginInput{
@@ -844,7 +940,7 @@ func testExternalPluginMetadataAuditLog(t *testing.T, log map[string]interface{}
 // in audit log when it is enabled
 func TestExternalPlugin_AuditEnabled_ShouldLogPluginMetadata_Auth(t *testing.T) {
 	cluster := getCluster(t, 1, consts.PluginTypeCredential)
-	defer cluster.Cleanup()
+	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -880,25 +976,32 @@ func TestExternalPlugin_AuditEnabled_ShouldLogPluginMetadata_Auth(t *testing.T)
 
 	// Check the audit trail on request and response
 	decoder := json.NewDecoder(auditLogFile)
-	var auditRecord map[string]interface{}
-	for decoder.Decode(&auditRecord) == nil {
-		auditRequest := map[string]interface{}{}
+	for decoder.More() {
+		var auditRecord map[string]interface{}
+		err := decoder.Decode(&auditRecord)
+		require.NoError(t, err)
+
 		if req, ok := auditRecord["request"]; ok {
-			auditRequest = req.(map[string]interface{})
-			if auditRequest["path"] != "auth/"+plugin.Name+"/role/role1" {
+			auditRequest, ok := req.(map[string]interface{})
+			require.True(t, ok)
+
+			path, ok := auditRequest["path"]
+			require.True(t, ok)
+
+			if path != "auth/"+plugin.Name+"/role/role1" {
 				continue
 			}
+
+			testExternalPluginMetadataAuditLog(t, auditRequest, consts.PluginTypeCredential.String())
 		}
-		testExternalPluginMetadataAuditLog(t, auditRequest, consts.PluginTypeCredential.String())
 
-		auditResponse := map[string]interface{}{}
-		if req, ok := auditRecord["response"]; ok {
-			auditRequest = req.(map[string]interface{})
-			if auditResponse["path"] != "auth/"+plugin.Name+"/role/role1" {
-				continue
-			}
+		if resp, ok := auditRecord["response"]; ok {
+			auditResponse, ok := resp.(map[string]interface{})
+			require.True(t, ok)
+
+			testExternalPluginMetadataAuditLog(t, auditResponse, consts.PluginTypeCredential.String())
 		}
-		testExternalPluginMetadataAuditLog(t, auditResponse, consts.PluginTypeCredential.String())
+
 	}
 
 	// Deregister
@@ -915,7 +1018,7 @@ func TestExternalPlugin_AuditEnabled_ShouldLogPluginMetadata_Auth(t *testing.T)
 // in audit log when it is enabled
 func TestExternalPlugin_AuditEnabled_ShouldLogPluginMetadata_Secret(t *testing.T) {
 	cluster := getCluster(t, 1, consts.PluginTypeSecrets)
-	defer cluster.Cleanup()
+	t.Cleanup(cluster.Cleanup)
 
 	plugin := cluster.Plugins[0]
 	client := cluster.Cores[0].Client
@@ -943,36 +1046,44 @@ func TestExternalPlugin_AuditEnabled_ShouldLogPluginMetadata_Secret(t *testing.T
 
 	// Configure
 	cleanupConsul, consulConfig := consul.PrepareTestContainer(t, "", false, true)
-	defer cleanupConsul()
+	t.Cleanup(cleanupConsul)
 	_, err = client.Logical().Write(plugin.Name+"/config/access", map[string]interface{}{
 		"address": consulConfig.Address(),
 		"token":   consulConfig.Token,
 	})
-	if err != nil {
-		t.Fatal(err)
-	}
+	require.NoError(t, err)
+
+	// Disable audit now we're done performing operations
+	err = client.Sys().DisableAudit("file")
+	require.NoError(t, err)
 
 	// Check the audit trail on request and response
 	decoder := json.NewDecoder(auditLogFile)
-	var auditRecord map[string]interface{}
-	for decoder.Decode(&auditRecord) == nil {
-		auditRequest := map[string]interface{}{}
+	for decoder.More() {
+		var auditRecord map[string]interface{}
+		err := decoder.Decode(&auditRecord)
+		require.NoError(t, err)
+
 		if req, ok := auditRecord["request"]; ok {
-			auditRequest = req.(map[string]interface{})
-			if auditRequest["path"] != plugin.Name+"/config/access" {
+			auditRequest, ok := req.(map[string]interface{})
+			require.True(t, ok)
+
+			path, ok := auditRequest["path"].(string)
+			require.True(t, ok)
+
+			if path != plugin.Name+"/config/access" {
 				continue
 			}
+
+			testExternalPluginMetadataAuditLog(t, auditRequest, consts.PluginTypeSecrets.String())
 		}
-		testExternalPluginMetadataAuditLog(t, auditRequest, consts.PluginTypeSecrets.String())
 
-		auditResponse := map[string]interface{}{}
-		if req, ok := auditRecord["response"]; ok {
-			auditRequest = req.(map[string]interface{})
-			if auditResponse["path"] != plugin.Name+"/config/access" {
-				continue
-			}
+		if resp, ok := auditRecord["response"]; ok {
+			auditResponse, ok := resp.(map[string]interface{})
+			require.True(t, ok)
+
+			testExternalPluginMetadataAuditLog(t, auditResponse, consts.PluginTypeSecrets.String())
 		}
-		testExternalPluginMetadataAuditLog(t, auditResponse, consts.PluginTypeSecrets.String())
 	}
 
 	// Deregister
@@ -1138,7 +1249,7 @@ func TestCore_UpgradePluginUsingPinnedVersion_Database(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	cleanupPG, connURL := postgreshelper.PrepareTestContainerWithVaultUser(t, context.Background(), "13.4-buster")
+	cleanupPG, connURL := postgreshelper.PrepareTestContainerWithVaultUser(t, context.Background())
 	t.Cleanup(cleanupPG)
 
 	// Mount 1.0.0 then pin to 1.0.1
diff --git a/vault/external_tests/plugin/plugin_test.go b/vault/external_tests/plugin/plugin_test.go
index e38853fbcc8..5bee95b54d0 100644
--- a/vault/external_tests/plugin/plugin_test.go
+++ b/vault/external_tests/plugin/plugin_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugin_test
diff --git a/vault/external_tests/policy/acl_templating_test.go b/vault/external_tests/policy/acl_templating_test.go
index d88f4c49b24..6e8bedd805e 100644
--- a/vault/external_tests/policy/acl_templating_test.go
+++ b/vault/external_tests/policy/acl_templating_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package policy
diff --git a/vault/external_tests/policy/policy_test.go b/vault/external_tests/policy/policy_test.go
index ceee95f9db4..e87b32f0633 100644
--- a/vault/external_tests/policy/policy_test.go
+++ b/vault/external_tests/policy/policy_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package policy
@@ -48,7 +48,7 @@ func TestPolicy_NoDefaultPolicy(t *testing.T) {
 	}
 
 	// Configure LDAP auth backend
-	cleanup, cfg := ldaphelper.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldaphelper.PrepareTestContainer(t, ldaphelper.DefaultVersion)
 	defer cleanup()
 
 	_, err = client.Logical().Write("auth/ldap/config", map[string]interface{}{
@@ -106,7 +106,7 @@ func TestPolicy_NoConfiguredPolicy(t *testing.T) {
 	}
 
 	// Configure LDAP auth backend
-	cleanup, cfg := ldaphelper.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldaphelper.PrepareTestContainer(t, ldaphelper.DefaultVersion)
 	defer cleanup()
 
 	_, err = client.Logical().Write("auth/ldap/config", map[string]interface{}{
diff --git a/vault/external_tests/pprof/pprof.go b/vault/external_tests/pprof/pprof.go
index 91169e0ab15..365fa5e990a 100644
--- a/vault/external_tests/pprof/pprof.go
+++ b/vault/external_tests/pprof/pprof.go
@@ -1,24 +1,24 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pprof
 
 import (
-	"context"
 	"encoding/json"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"testing"
 
 	"github.com/hashicorp/go-cleanhttp"
-	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/sdk/helper/testcluster"
-	"github.com/stretchr/testify/require"
 	"golang.org/x/net/http2"
 )
 
 func SysPprof_Test(t *testing.T, cluster testcluster.VaultCluster) {
 	nodes := cluster.Nodes()
+	if len(nodes) == 0 {
+		t.Fatal("no nodes returned")
+	}
 	client := nodes[0].APIClient()
 
 	transport := cleanhttp.DefaultPooledTransport()
@@ -87,7 +87,7 @@ func SysPprof_Test(t *testing.T, cluster testcluster.VaultCluster) {
 		}
 		defer resp.Body.Close()
 
-		httpRespBody, err := ioutil.ReadAll(resp.Body)
+		httpRespBody, err := io.ReadAll(resp.Body)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -114,27 +114,3 @@ func SysPprof_Test(t *testing.T, cluster testcluster.VaultCluster) {
 		})
 	}
 }
-
-func SysPprof_Standby_Test(t *testing.T, cluster testcluster.VaultCluster) {
-	pprof := func(client *api.Client) (string, error) {
-		req := client.NewRequest("GET", "/v1/sys/pprof/cmdline")
-		resp, err := client.RawRequestWithContext(context.Background(), req)
-		if err != nil {
-			return "", err
-		}
-		defer resp.Body.Close()
-
-		data, err := ioutil.ReadAll(resp.Body)
-		return string(data), err
-	}
-
-	cmdline, err := pprof(cluster.Nodes()[0].APIClient())
-	require.Nil(t, err)
-	require.NotEmpty(t, cmdline)
-	t.Log(cmdline)
-
-	cmdline, err = pprof(cluster.Nodes()[1].APIClient())
-	require.Nil(t, err)
-	require.NotEmpty(t, cmdline)
-	t.Log(cmdline)
-}
diff --git a/vault/external_tests/pprof/pprof_binary/pprof_test.go b/vault/external_tests/pprof/pprof_binary/pprof_test.go
index 7e050eded4f..2dd48004e7f 100644
--- a/vault/external_tests/pprof/pprof_binary/pprof_test.go
+++ b/vault/external_tests/pprof/pprof_binary/pprof_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pprof_binary
@@ -21,7 +21,7 @@ func TestSysPprof_Exec(t *testing.T) {
 	if binary == "" {
 		t.Skip("only running exec test when $VAULT_BINARY present")
 	}
-	cluster := testcluster.NewTestExecDevCluster(t, &testcluster.ExecDevClusterOptions{
+	cluster := testcluster.NewTestExecDevServer(t, &testcluster.ExecDevClusterOptions{
 		ClusterOptions: testcluster.ClusterOptions{
 			NumCores: 1,
 		},
@@ -32,27 +32,3 @@ func TestSysPprof_Exec(t *testing.T) {
 
 	pprof.SysPprof_Test(t, cluster)
 }
-
-// TestSysPprof_Standby_Exec is the same as TestSysPprof_Standby, but using a Vault binary
-// running as -dev-three-node instead of a fake single node TestCluster.  There's
-// no particular reason why TestSysPprof was chosen to validate that mechanism,
-// other than that it was fast and simple.
-func TestSysPprof_Standby_Exec(t *testing.T) {
-	t.Parallel()
-	binary := os.Getenv("VAULT_BINARY")
-	if binary == "" {
-		t.Skip("only running exec test when $VAULT_BINARY present")
-	}
-	cluster := testcluster.NewTestExecDevCluster(t, &testcluster.ExecDevClusterOptions{
-		ClusterOptions: testcluster.ClusterOptions{
-			VaultNodeConfig: &testcluster.VaultNodeConfig{
-				DisablePerformanceStandby: true,
-			},
-		},
-		BinaryPath:        binary,
-		BaseListenAddress: "127.0.0.1:8210",
-	})
-	defer cluster.Cleanup()
-
-	pprof.SysPprof_Standby_Test(t, cluster)
-}
diff --git a/vault/external_tests/pprof/pprof_test.go b/vault/external_tests/pprof/pprof_test.go
index 3edbcb10776..afcad849f28 100644
--- a/vault/external_tests/pprof/pprof_test.go
+++ b/vault/external_tests/pprof/pprof_test.go
@@ -1,27 +1,39 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package pprof
 
 import (
 	"encoding/json"
-	"io/ioutil"
+	"io"
 	"net/http"
+	"os"
 	"strconv"
 	"strings"
 	"testing"
 
 	"github.com/hashicorp/go-cleanhttp"
+	"github.com/hashicorp/vault/command/server"
 	vaulthttp "github.com/hashicorp/vault/http"
-	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/sdk/helper/testhelpers/schema"
 	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
 	"golang.org/x/net/http2"
 )
 
 func TestSysPprof(t *testing.T) {
 	t.Parallel()
-	cluster := vault.NewTestCluster(t, nil, &vault.TestClusterOptions{
+
+	// trace test setup
+	dir, err := os.MkdirTemp("", "vault-trace-test")
+	require.NoError(t, err)
+
+	cluster := vault.NewTestCluster(t, &vault.CoreConfig{
+		RawConfig: &server.Config{
+			EnablePostUnsealTrace: true,
+			PostUnsealTraceDir:    dir,
+		},
+	}, &vault.TestClusterOptions{
 		HandlerFunc:             vaulthttp.Handler,
 		RequestResponseCallback: schema.ResponseValidatingCallback(t),
 	})
@@ -31,6 +43,14 @@ func TestSysPprof(t *testing.T) {
 	core := cluster.Cores[0].Core
 	vault.TestWaitActive(t, core)
 	SysPprof_Test(t, cluster)
+
+	// draft trace test onto pprof one to avoid increasing test runtime with additional clusters
+	files, err := os.ReadDir(dir)
+	require.NoError(t, err)
+	require.Greater(t, len(files), 0)
+	traceFile, err := files[0].Info()
+	require.NoError(t, err)
+	require.Greater(t, traceFile.Size(), int64(0))
 }
 
 func TestSysPprof_MaxRequestDuration(t *testing.T) {
@@ -65,7 +85,7 @@ func TestSysPprof_MaxRequestDuration(t *testing.T) {
 	}
 	defer resp.Body.Close()
 
-	httpRespBody, err := ioutil.ReadAll(resp.Body)
+	httpRespBody, err := io.ReadAll(resp.Body)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -86,22 +106,3 @@ func TestSysPprof_MaxRequestDuration(t *testing.T) {
 		t.Fatalf("unexpected error returned: %v", errs)
 	}
 }
-
-func TestSysPprof_Standby(t *testing.T) {
-	t.Parallel()
-	cluster := vault.NewTestCluster(t, &vault.CoreConfig{
-		DisablePerformanceStandby: true,
-	}, &vault.TestClusterOptions{
-		HandlerFunc: vaulthttp.Handler,
-		DefaultHandlerProperties: vault.HandlerProperties{
-			ListenerConfig: &configutil.Listener{
-				Profiling: configutil.ListenerProfiling{
-					UnauthenticatedPProfAccess: true,
-				},
-			},
-		},
-	})
-	defer cluster.Cleanup()
-
-	SysPprof_Standby_Test(t, cluster)
-}
diff --git a/vault/external_tests/quotas/quotas_test.go b/vault/external_tests/quotas/quotas_test.go
index 619e98f28b8..dd19e5adc2f 100644
--- a/vault/external_tests/quotas/quotas_test.go
+++ b/vault/external_tests/quotas/quotas_test.go
@@ -1,16 +1,20 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package quotas
 
 import (
+	"encoding/json"
 	"fmt"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/builtin/logical/pki"
+	"github.com/hashicorp/vault/helper/constants"
+	"github.com/hashicorp/vault/helper/testhelpers"
 	"github.com/hashicorp/vault/helper/testhelpers/teststorage"
 	"github.com/hashicorp/vault/sdk/helper/testhelpers/schema"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -541,3 +545,224 @@ func TestQuotas_RateLimitQuota(t *testing.T) {
 		t.Fatalf("unexpected number of failed requests: %d", numFail)
 	}
 }
+
+// TestQuotas_RateLimitQuota_GroupByConfig tests the validations imposed on the group_by and secondary_rate fields
+func TestQuotas_RateLimitQuota_GroupByConfig(t *testing.T) {
+	conf, opts := teststorage.ClusterSetup(coreConfig, nil, nil)
+	opts.NoDefaultQuotas = true
+	cluster := vault.NewTestCluster(t, conf, opts)
+	cluster.Start()
+	t.Cleanup(cluster.Cleanup)
+
+	core := cluster.Cores[0].Core
+	client := cluster.Cores[0].Client
+
+	vault.TestWaitActive(t, core)
+
+	testCases := map[string]struct {
+		reqData              map[string]interface{}
+		expectedErr          string
+		expectedReadContains map[string]interface{}
+		enterpriseOnly       bool
+		CeOnly               bool
+	}{
+		"group_by_defaults_to_ip": {
+			reqData: map[string]interface{}{
+				"rate": 100,
+			},
+			expectedReadContains: map[string]interface{}{
+				"group_by":       "ip",
+				"secondary_rate": json.Number("0"),
+			},
+		},
+		"explicitly_empty_group_by_defaults_to_ip": {
+			reqData: map[string]interface{}{
+				"rate":     100,
+				"group_by": "",
+			},
+			expectedReadContains: map[string]interface{}{
+				"group_by":       "ip",
+				"secondary_rate": json.Number("0"),
+			},
+		},
+		"explicit_group_by_ip_allowed_in_ce": {
+			reqData: map[string]interface{}{
+				"rate":     100,
+				"group_by": "ip",
+			},
+			expectedReadContains: map[string]interface{}{
+				"group_by":       "ip",
+				"secondary_rate": json.Number("0"),
+			},
+		},
+		"invalid_group_by": {
+			reqData: map[string]interface{}{
+				"rate":     100,
+				"group_by": "invalid",
+			},
+			expectedErr: `invalid grouping mode "invalid"`,
+		},
+		"group_by_none_not_allowed_in_ce": {
+			CeOnly: true,
+			reqData: map[string]interface{}{
+				"rate":     100,
+				"group_by": "none",
+			},
+			expectedErr: `grouping mode "none" is only available in Vault Enterprise`,
+		},
+		"group_by_entity_then_none_not_allowed_in_ce": {
+			CeOnly: true,
+			reqData: map[string]interface{}{
+				"rate":     100,
+				"group_by": "entity_then_none",
+			},
+			expectedErr: `grouping mode "entity_then_none" is only available in Vault Enterprise`,
+		},
+		"group_by_entity_then_ip_not_allowed_in_ce": {
+			CeOnly: true,
+			reqData: map[string]interface{}{
+				"rate":     100,
+				"group_by": "entity_then_ip",
+			},
+			expectedErr: `grouping mode "entity_then_ip" is only available in Vault Enterprise`,
+		},
+		"secondary_rate_invalid_with_group_by_none": {
+			enterpriseOnly: true,
+			reqData: map[string]interface{}{
+				"rate":           100,
+				"secondary_rate": 1,
+				"group_by":       "none",
+			},
+			expectedErr: "secondary rate is only valid when using entity-based grouping",
+		},
+		"secondary_rate_invalid_with_group_by_ip": {
+			enterpriseOnly: true,
+			reqData: map[string]interface{}{
+				"rate":           100,
+				"secondary_rate": 1,
+				"group_by":       "ip",
+			},
+			expectedErr: "secondary rate is only valid when using entity-based grouping",
+		},
+		"secondary_rate_defaults_to_rate_with_entity_then_ip": {
+			enterpriseOnly: true,
+			reqData: map[string]interface{}{
+				"rate":           100,
+				"group_by":       "entity_then_ip",
+				"secondary_rate": 0,
+			},
+			expectedReadContains: map[string]interface{}{
+				"group_by":       "entity_then_ip",
+				"secondary_rate": json.Number("100"),
+			},
+		},
+		"secondary_rate_defaults_to_rate_with_entity_then_none": {
+			enterpriseOnly: true,
+			reqData: map[string]interface{}{
+				"rate":     100,
+				"group_by": "entity_then_none",
+			},
+			expectedReadContains: map[string]interface{}{
+				"group_by":       "entity_then_none",
+				"secondary_rate": json.Number("100"),
+			},
+		},
+		"secondary_rate_defaults_to_zero_on_group_by_none": {
+			enterpriseOnly: true,
+			reqData: map[string]interface{}{
+				"rate":     100,
+				"group_by": "none",
+			},
+			expectedReadContains: map[string]interface{}{
+				"group_by":       "none",
+				"secondary_rate": json.Number("0"),
+			},
+		},
+		"secondary_rate_defaults_to_zero_on_group_by_ip": {
+			reqData: map[string]interface{}{
+				"rate":     100,
+				"group_by": "ip",
+			},
+			expectedReadContains: map[string]interface{}{
+				"group_by":       "ip",
+				"secondary_rate": json.Number("0"),
+			},
+		},
+		"secondary_rate_defaults_cannot_be_negative": {
+			enterpriseOnly: true,
+			reqData: map[string]interface{}{
+				"rate":           100,
+				"group_by":       "entity_then_ip",
+				"secondary_rate": -1,
+			},
+			expectedErr: "secondary rate must be greater than or equal to 0",
+		},
+	}
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			if tc.enterpriseOnly && !constants.IsEnterprise {
+				t.Skip("skipping test because it is only valid in enterprise")
+			} else if tc.CeOnly && constants.IsEnterprise {
+				t.Skip("skipping test because it is only valid in community edition")
+			}
+
+			_, err := client.Logical().Write("sys/quotas/rate-limit/"+name, tc.reqData)
+
+			if tc.expectedErr != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tc.expectedErr)
+			} else {
+				require.NoError(t, err)
+
+				resp, err := client.Logical().Read("sys/quotas/rate-limit/" + name)
+				require.NoError(t, err)
+				require.NotNil(t, resp)
+				require.NotEmpty(t, resp.Data)
+				for k, v := range tc.expectedReadContains {
+					require.Contains(t, resp.Data, k)
+					require.Equal(t, v, resp.Data[k])
+				}
+			}
+
+			_, err = client.Logical().Delete("sys/quotas/rate-limit/" + name)
+			require.NoError(t, err)
+		})
+	}
+}
+
+// TestQuotas_RateLimit_ZeroRetryRegression verifies that the rate limit response
+// headers do not return a Retry-After value of 0.
+func TestQuotas_RateLimit_ZeroRetryRegression(t *testing.T) {
+	conf, opts := teststorage.ClusterSetup(coreConfig, nil, nil)
+	cluster := vault.NewTestCluster(t, conf, opts)
+	cluster.Start()
+	defer cluster.Cleanup()
+
+	testhelpers.WaitForActiveNode(t, cluster)
+	client := cluster.Cores[0].Client
+	_, err := client.Logical().Write("sys/quotas/config", map[string]interface{}{
+		"enable_rate_limit_response_headers": true,
+	})
+	require.NoError(t, err)
+	_, err = client.Logical().Write("sys/quotas/rate-limit/root-rlq", map[string]interface{}{
+		"name": "root-rlq",
+		"rate": 1,
+	})
+	require.NoError(t, err)
+	failed := atomic.NewBool(false)
+	wg := sync.WaitGroup{}
+	client = client.WithResponseCallbacks(func(response *api.Response) {
+		if response.Header.Get("Retry-After") == "0" {
+			failed.Store(true)
+		}
+	})
+	for i := 0; i < 20; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			client.Logical().Read("sys/mounts")
+		}()
+	}
+	wg.Wait()
+	require.False(t, failed.Load())
+}
diff --git a/vault/external_tests/raft/raft.go b/vault/external_tests/raft/raft.go
index f3744c4ae60..94cc832c206 100644
--- a/vault/external_tests/raft/raft.go
+++ b/vault/external_tests/raft/raft.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rafttests
diff --git a/vault/external_tests/raft/raft_autopilot_test.go b/vault/external_tests/raft/raft_autopilot_test.go
index fa94fb3c510..01ae5111c2c 100644
--- a/vault/external_tests/raft/raft_autopilot_test.go
+++ b/vault/external_tests/raft/raft_autopilot_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rafttests
@@ -41,6 +41,41 @@ func TestRaft_Autopilot_Disable(t *testing.T) {
 	require.Nil(t, nil, state)
 }
 
+// TestRaft_Autopilot_BinaryVersionPlumbing is an apparently trivial test that
+// ensures that the default plumbing in Vault core to configure the binary
+// version of the raft library is working. Hopefully this will trivially pass
+// from now on, however it would have caught a regression in the past!
+func TestRaft_Autopilot_BinaryVersionPlumbing(t *testing.T) {
+	t.Parallel()
+
+	coreCfg, clusterOpts := raftClusterBuilder(t, &RaftClusterOpts{
+		EnableAutopilot: true,
+		// We need 2 nodes because the code path that regressed was different on a
+		// standby vs active node so we'd not detect the problem if we only test on
+		// an active node.
+		NumCores: 2,
+	})
+
+	// Default options should not set EffectiveSDKVersion(Map) which would defeat
+	// the point of this test by plumbing versions via config.
+	require.Nil(t, clusterOpts.EffectiveSDKVersionMap)
+	require.Empty(t, coreCfg.EffectiveSDKVersion)
+
+	c := vault.NewTestCluster(t, coreCfg, &clusterOpts)
+	defer c.Cleanup()
+
+	// Wait for follower to be perf standby (in Ent, in CE it will only wait for
+	// active). In either Enterprise or CE case, this should pass if we've plumbed
+	// the version correctly so it's valuable for both.
+	testhelpers.WaitForActiveNodeAndStandbys(t, c)
+	for _, core := range c.Cores {
+		be := core.UnderlyingRawStorage.(*raft.RaftBackend)
+		require.Equal(t, version.GetVersion().Version, be.UpgradeVersion(),
+			"expected raft upgrade version to default to Vault version for core %q",
+			core.NodeID)
+	}
+}
+
 // TestRaft_Autopilot_Stabilization_And_State verifies that nodes get promoted
 // to be voters after the stabilization time has elapsed.  Also checks that
 // the autopilot state is Healthy once all nodes are available.
diff --git a/vault/external_tests/raft/raft_binary/raft_test.go b/vault/external_tests/raft/raft_binary/raft_test.go
index 135ff4fb28b..f278df6a4cc 100644
--- a/vault/external_tests/raft/raft_binary/raft_test.go
+++ b/vault/external_tests/raft/raft_binary/raft_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raft_binary
@@ -32,7 +32,8 @@ func TestRaft_Configuration_Docker(t *testing.T) {
 		t.Skip("only running docker test when $VAULT_BINARY present")
 	}
 	opts := &docker.DockerClusterOptions{
-		ImageRepo: "hashicorp/vault",
+		ImageRepo:    "hashicorp/vault",
+		DisableMlock: true,
 		// We're replacing the binary anyway, so we're not too particular about
 		// the docker image version tag.
 		ImageTag:    "latest",
@@ -138,7 +139,8 @@ func TestDocker_LogStore_Boltdb_To_Raftwal_And_Back(t *testing.T) {
 		t.Skip("only running docker test when $VAULT_BINARY present")
 	}
 	opts := &docker.DockerClusterOptions{
-		ImageRepo: "hashicorp/vault",
+		ImageRepo:    "hashicorp/vault",
+		DisableMlock: true,
 		// We're replacing the binary anyway, so we're not too particular about
 		// the docker image version tag.
 		ImageTag:    "latest",
@@ -332,7 +334,8 @@ func TestRaft_LogStore_Migration_Snapshot(t *testing.T) {
 		t.Skip("only running docker test when $VAULT_BINARY present")
 	}
 	opts := &docker.DockerClusterOptions{
-		ImageRepo: "hashicorp/vault",
+		ImageRepo:    "hashicorp/vault",
+		DisableMlock: true,
 		// We're replacing the binary anyway, so we're not too particular about
 		// the docker image version tag.
 		ImageTag:    "latest",
diff --git a/vault/external_tests/raft/raft_test.go b/vault/external_tests/raft/raft_test.go
index 2f009492582..2764f3f9f0a 100644
--- a/vault/external_tests/raft/raft_test.go
+++ b/vault/external_tests/raft/raft_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package rafttests
@@ -7,21 +7,22 @@ import (
 	"bytes"
 	"context"
 	"crypto/md5"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"strings"
 	"sync"
 	"testing"
 	"time"
 
+	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-cleanhttp"
+	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/api"
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
-	"github.com/hashicorp/vault/helper/benchhelpers"
 	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/testhelpers"
@@ -30,8 +31,10 @@ import (
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/physical/raft"
+	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault"
+	"github.com/hashicorp/vault/vault/cluster"
 	vaultseal "github.com/hashicorp/vault/vault/seal"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/http2"
@@ -50,12 +53,14 @@ type RaftClusterOpts struct {
 	RedundancyZoneMap              map[int]string
 	EffectiveSDKVersionMap         map[int]string
 	PerNodePhysicalFactoryConfig   map[int]map[string]interface{}
+	DisableMlock                   bool
 }
 
 func raftClusterBuilder(t testing.TB, ropts *RaftClusterOpts) (*vault.CoreConfig, vault.TestClusterOptions) {
 	if ropts == nil {
 		ropts = &RaftClusterOpts{
 			InmemCluster: true,
+			DisableMlock: true,
 		}
 	}
 
@@ -66,6 +71,8 @@ func raftClusterBuilder(t testing.TB, ropts *RaftClusterOpts) (*vault.CoreConfig
 		DisableAutopilot:               !ropts.EnableAutopilot,
 		EnableResponseHeaderRaftNodeID: ropts.EnableResponseHeaderRaftNodeID,
 		Seal:                           ropts.Seal,
+		EnableRaw:                      true,
+		DisableMlock:                   ropts.DisableMlock,
 	}
 
 	opts := vault.TestClusterOptions{
@@ -105,8 +112,8 @@ func raftClusterBuilder(t testing.TB, ropts *RaftClusterOpts) (*vault.CoreConfig
 
 func raftCluster(t testing.TB, ropts *RaftClusterOpts) (*vault.TestCluster, *vault.TestClusterOptions) {
 	conf, opts := raftClusterBuilder(t, ropts)
-	cluster := vault.NewTestCluster(benchhelpers.TBtoT(t), conf, &opts)
-	vault.TestWaitActive(benchhelpers.TBtoT(t), cluster.Cores[0].Core)
+	cluster := vault.NewTestCluster(t, conf, &opts)
+	vault.TestWaitActive(t, cluster.Cores[0].Core)
 	return cluster, &opts
 }
 
@@ -249,6 +256,169 @@ func TestRaft_Retry_Join(t *testing.T) {
 	})
 }
 
+// TestRaftChallenge_sameAnswerSameID_concurrent verifies that 10 goroutines
+// all requesting a raft challenge with the same ID all return the same answer.
+// This is a regression test for a TOCTTOU race found during testing.
+func TestRaftChallenge_sameAnswerSameID_concurrent(t *testing.T) {
+	t.Parallel()
+
+	cluster, _ := raftCluster(t, &RaftClusterOpts{
+		DisableFollowerJoins: true,
+		NumCores:             1,
+	})
+	defer cluster.Cleanup()
+	client := cluster.Cores[0].Client
+
+	challenges := make(chan string, 15)
+	wg := sync.WaitGroup{}
+	for i := 0; i < 15; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			res, err := client.Logical().Write("sys/storage/raft/bootstrap/challenge", map[string]interface{}{
+				"server_id": "node1",
+			})
+			require.NoError(t, err)
+			challenges <- res.Data["challenge"].(string)
+		}()
+	}
+
+	wg.Wait()
+	challengeSet := make(map[string]struct{})
+	close(challenges)
+	for challenge := range challenges {
+		challengeSet[challenge] = struct{}{}
+	}
+
+	require.Len(t, challengeSet, 1)
+}
+
+// TestRaftChallenge_sameAnswerSameID verifies that repeated bootstrap requests
+// with the same node ID return the same challenge, but that a different node ID
+// returns a different challenge
+func TestRaftChallenge_sameAnswerSameID(t *testing.T) {
+	t.Parallel()
+
+	cluster, _ := raftCluster(t, &RaftClusterOpts{
+		DisableFollowerJoins: true,
+		NumCores:             1,
+	})
+	defer cluster.Cleanup()
+	client := cluster.Cores[0].Client
+	res, err := client.Logical().Write("sys/storage/raft/bootstrap/challenge", map[string]interface{}{
+		"server_id": "node1",
+	})
+	require.NoError(t, err)
+
+	// querying the same ID returns the same challenge
+	challenge := res.Data["challenge"]
+	resSameID, err := client.Logical().Write("sys/storage/raft/bootstrap/challenge", map[string]interface{}{
+		"server_id": "node1",
+	})
+	require.NoError(t, err)
+	require.Equal(t, challenge, resSameID.Data["challenge"])
+
+	// querying a different ID returns a new challenge
+	resDiffID, err := client.Logical().Write("sys/storage/raft/bootstrap/challenge", map[string]interface{}{
+		"server_id": "node2",
+	})
+	require.NoError(t, err)
+	require.NotEqual(t, challenge, resDiffID.Data["challenge"])
+}
+
+// TestRaftChallenge_evicted verifies that a valid answer errors if there have
+// been more than 20 challenge requests after it, because our cache of pending
+// bootstraps is limited to 20
+func TestRaftChallenge_evicted(t *testing.T) {
+	t.Parallel()
+	cluster, _ := raftCluster(t, &RaftClusterOpts{
+		DisableFollowerJoins: true,
+		NumCores:             1,
+	})
+	defer cluster.Cleanup()
+	firstResponse := map[string]interface{}{}
+	client := cluster.Cores[0].Client
+	for i := 0; i < vault.RaftInitialChallengeLimit+1; i++ {
+		if i == vault.RaftInitialChallengeLimit {
+			// wait before sending the last request, so we don't get rate
+			// limited
+			time.Sleep(2 * time.Second)
+		}
+		res, err := client.Logical().Write("sys/storage/raft/bootstrap/challenge", map[string]interface{}{
+			"server_id": fmt.Sprintf("node-%d", i),
+		})
+		require.NoError(t, err)
+
+		// save the response from the first challenge
+		if i == 0 {
+			firstResponse = res.Data
+		}
+	}
+
+	// get the answer to the challenge
+	challengeRaw, err := base64.StdEncoding.DecodeString(firstResponse["challenge"].(string))
+	require.NoError(t, err)
+	eBlob := &wrapping.BlobInfo{}
+	err = proto.Unmarshal(challengeRaw, eBlob)
+	require.NoError(t, err)
+	access := cluster.Cores[0].SealAccess().GetAccess()
+	multiWrapValue := &vaultseal.MultiWrapValue{
+		Generation: access.Generation(),
+		Slots:      []*wrapping.BlobInfo{eBlob},
+	}
+	plaintext, _, err := access.Decrypt(context.Background(), multiWrapValue)
+	require.NoError(t, err)
+
+	// send the answer
+	_, err = client.Logical().Write("sys/storage/raft/bootstrap/answer", map[string]interface{}{
+		"answer":          base64.StdEncoding.EncodeToString(plaintext),
+		"server_id":       "node-0",
+		"cluster_addr":    "127.0.0.1:8200",
+		"sdk_version":     "1.1.1",
+		"upgrade_version": "1.2.3",
+		"non_voter":       false,
+	})
+
+	require.ErrorContains(t, err, "no expected answer for the server id provided")
+}
+
+// TestRaft_ChallengeSpam creates 40 raft bootstrap challenges. The first 20
+// should succeed. After 20 challenges have been created, slow down the requests
+// so that there are 2.5 occurring per second. Some of these will fail, due to
+// rate limiting, but others will succeed.
+func TestRaft_ChallengeSpam(t *testing.T) {
+	t.Parallel()
+	cluster, _ := raftCluster(t, &RaftClusterOpts{
+		DisableFollowerJoins: true,
+	})
+	defer cluster.Cleanup()
+
+	// Execute 2 * MaxInFlightRequests, over a period that should allow some to proceed as the token bucket
+	// refills.
+	var someLaterFailed bool
+	var someLaterSucceeded bool
+	for n := 0; n < 2*vault.RaftInitialChallengeLimit; n++ {
+		_, err := cluster.Cores[0].Client.Logical().Write("sys/storage/raft/bootstrap/challenge", map[string]interface{}{
+			"server_id": fmt.Sprintf("core-%d", n),
+		})
+		// First MaxInFlightRequests should succeed for sure
+		if n < vault.RaftInitialChallengeLimit {
+			require.NoError(t, err)
+		} else {
+			// slow down to twice the configured rps
+			time.Sleep((1000 * time.Millisecond) / (2 * time.Duration(vault.RaftChallengesPerSecond)))
+			if err != nil {
+				require.Equal(t, 429, err.(*api.ResponseError).StatusCode)
+				someLaterFailed = true
+			} else {
+				someLaterSucceeded = true
+			}
+		}
+	}
+	require.True(t, someLaterFailed)
+	require.True(t, someLaterSucceeded)
+}
+
 func TestRaft_Join(t *testing.T) {
 	t.Parallel()
 	cluster, _ := raftCluster(t, &RaftClusterOpts{
@@ -518,7 +688,7 @@ func TestRaft_SnapshotAPI_MidstreamFailure(t *testing.T) {
 
 	var readErr error
 	go func() {
-		snap, readErr = ioutil.ReadAll(r)
+		snap, readErr = io.ReadAll(r)
 		wg.Done()
 	}()
 
@@ -635,7 +805,7 @@ func TestRaft_SnapshotAPI_RekeyRotate_Backward(t *testing.T) {
 			}
 			defer resp.Body.Close()
 
-			snap, err := ioutil.ReadAll(resp.Body)
+			snap, err := io.ReadAll(resp.Body)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -838,7 +1008,7 @@ func TestRaft_SnapshotAPI_RekeyRotate_Forward(t *testing.T) {
 				t.Fatal(err)
 			}
 
-			snap, err := ioutil.ReadAll(resp.Body)
+			snap, err := io.ReadAll(resp.Body)
 			resp.Body.Close()
 			if err != nil {
 				t.Fatal(err)
@@ -895,7 +1065,7 @@ func TestRaft_SnapshotAPI_RekeyRotate_Forward(t *testing.T) {
 				t.Fatal(err)
 			}
 
-			snap2, err := ioutil.ReadAll(resp.Body)
+			snap2, err := io.ReadAll(resp.Body)
 			resp.Body.Close()
 			if err != nil {
 				t.Fatal(err)
@@ -1025,7 +1195,7 @@ func TestRaft_SnapshotAPI_DifferentCluster(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	snap, err := ioutil.ReadAll(resp.Body)
+	snap, err := io.ReadAll(resp.Body)
 	resp.Body.Close()
 	if err != nil {
 		t.Fatal(err)
@@ -1195,3 +1365,297 @@ func TestRaft_Join_InitStatus(t *testing.T) {
 		verifyInitStatus(i, true)
 	}
 }
+
+// TestRaftCluster_Removed creates a 3 node raft cluster and then removes one of
+// the nodes. The test verifies that a write on the removed node errors, and that
+// the removed node is sealed.
+func TestRaftCluster_Removed(t *testing.T) {
+	t.Parallel()
+	cluster, _ := raftCluster(t, nil)
+	defer cluster.Cleanup()
+
+	follower := cluster.Cores[2]
+	followerClient := follower.Client
+	_, err := followerClient.Logical().Write("secret/foo", map[string]interface{}{
+		"test": "data",
+	})
+	require.NoError(t, err)
+
+	leaderClient := cluster.Cores[0].Client
+	_, err = leaderClient.Logical().Write("/sys/storage/raft/remove-peer", map[string]interface{}{
+		"server_id": follower.NodeID,
+	})
+	require.NoError(t, err)
+	followerClient.SetCheckRedirect(func(request *http.Request, requests []*http.Request) error {
+		require.Fail(t, "request caused a redirect", request.URL.Path)
+		return fmt.Errorf("no redirects allowed")
+	})
+	configChanged := func() bool {
+		config, err := leaderClient.Logical().Read("sys/storage/raft/configuration")
+		require.NoError(t, err)
+		cfg := config.Data["config"].(map[string]interface{})
+		servers := cfg["servers"].([]interface{})
+		return len(servers) == 2
+	}
+	// raft config changes happen async, so block until the config change is
+	// applied
+	require.Eventually(t, configChanged, 3*time.Second, 50*time.Millisecond)
+
+	_, err = followerClient.Logical().Write("secret/foo", map[string]interface{}{
+		"test": "other_data",
+	})
+	require.Error(t, err)
+	require.Eventually(t, follower.Sealed, 3*time.Second, 250*time.Millisecond)
+}
+
+// TestRaftCluster_Removed_RaftConfig creates a 3 node raft cluster with an extremely long
+// heartbeat interval, and then removes one of the nodes. The test verifies that
+// removed node discovers that it has been removed (via not being present in the
+// raft config) and seals.
+func TestRaftCluster_Removed_RaftConfig(t *testing.T) {
+	t.Parallel()
+	conf, opts := raftClusterBuilder(t, nil)
+	conf.ClusterHeartbeatInterval = 5 * time.Minute
+	cluster := vault.NewTestCluster(t, conf, &opts)
+	vault.TestWaitActive(t, cluster.Cores[0].Core)
+
+	follower := cluster.Cores[2]
+	followerClient := follower.Client
+	_, err := followerClient.Logical().Write("secret/foo", map[string]interface{}{
+		"test": "data",
+	})
+	require.NoError(t, err)
+
+	_, err = cluster.Cores[0].Client.Logical().Write("/sys/storage/raft/remove-peer", map[string]interface{}{
+		"server_id": follower.NodeID,
+	})
+	require.Eventually(t, follower.Sealed, 10*time.Second, 500*time.Millisecond)
+}
+
+// TestSysHealth_Raft creates a raft cluster and verifies that the health status
+// is OK for a healthy follower. The test partitions one of the nodes so that it
+// can't send request forwarding RPCs. The test verifies that the status
+// endpoint  shows that HA isn't healthy. Finally, the test removes the
+// partitioned follower and unpartitions it. The follower will learn that it has
+// been removed, and should return the removed status.
+func TestSysHealth_Raft(t *testing.T) {
+	parseHealthBody := func(t *testing.T, resp *api.Response) *vaulthttp.HealthResponse {
+		t.Helper()
+		health := vaulthttp.HealthResponse{}
+		defer resp.Body.Close()
+		require.NoError(t, jsonutil.DecodeJSONFromReader(resp.Body, &health))
+		return &health
+	}
+
+	opts := &vault.TestClusterOptions{
+		HandlerFunc:        vaulthttp.Handler,
+		NumCores:           3,
+		InmemClusterLayers: true,
+	}
+	heartbeat := 500 * time.Millisecond
+	teststorage.RaftBackendSetup(nil, opts)
+	conf := &vault.CoreConfig{
+		ClusterHeartbeatInterval: heartbeat,
+	}
+	vaultCluster := vault.NewTestCluster(t, conf, opts)
+	defer vaultCluster.Cleanup()
+	testhelpers.WaitForActiveNodeAndStandbys(t, vaultCluster)
+	followerClient := vaultCluster.Cores[1].Client
+
+	t.Run("healthy", func(t *testing.T) {
+		resp, err := followerClient.Logical().ReadRawWithData("sys/health", map[string][]string{
+			"perfstandbyok": {"true"},
+			"standbyok":     {"true"},
+		})
+		require.NoError(t, err)
+		require.Equal(t, resp.StatusCode, 200)
+		r := parseHealthBody(t, resp)
+		require.False(t, *r.RemovedFromCluster)
+		require.True(t, *r.HAConnectionHealthy)
+		require.Less(t, r.LastRequestForwardingHeartbeatMillis, 2*heartbeat.Milliseconds())
+	})
+	nl := vaultCluster.Cores[1].NetworkLayer()
+	inmem, ok := nl.(*cluster.InmemLayer)
+	require.True(t, ok)
+	unpartition := inmem.Partition()
+
+	t.Run("partition", func(t *testing.T) {
+		time.Sleep(2 * heartbeat)
+		var erroredResponse *api.Response
+		// the node isn't able to send/receive heartbeats, so it will have
+		// haunhealthy status.
+		testhelpers.RetryUntil(t, 3*time.Second, func() error {
+			resp, err := followerClient.Logical().ReadRawWithData("sys/health", map[string][]string{
+				"perfstandbyok": {"true"},
+				"standbyok":     {"true"},
+			})
+			if err == nil {
+				if resp != nil && resp.Body != nil {
+					resp.Body.Close()
+				}
+				return errors.New("expected error")
+			}
+			if resp.StatusCode != 474 {
+				resp.Body.Close()
+				return fmt.Errorf("status code %d", resp.StatusCode)
+			}
+			erroredResponse = resp
+			return nil
+		})
+		r := parseHealthBody(t, erroredResponse)
+		require.False(t, *r.RemovedFromCluster)
+		require.False(t, *r.HAConnectionHealthy)
+		require.Greater(t, r.LastRequestForwardingHeartbeatMillis, 2*heartbeat.Milliseconds())
+
+		// ensure haunhealthycode is respected
+		resp, err := followerClient.Logical().ReadRawWithData("sys/health", map[string][]string{
+			"perfstandbyok":   {"true"},
+			"standbyok":       {"true"},
+			"haunhealthycode": {"299"},
+		})
+		require.NoError(t, err)
+		require.Equal(t, 299, resp.StatusCode)
+		resp.Body.Close()
+	})
+
+	t.Run("remove and unpartition", func(t *testing.T) {
+		leaderClient := vaultCluster.Cores[0].Client
+		_, err := leaderClient.Logical().Write("sys/storage/raft/remove-peer", map[string]interface{}{
+			"server_id": vaultCluster.Cores[1].NodeID,
+		})
+		require.NoError(t, err)
+		unpartition()
+
+		var erroredResponse *api.Response
+
+		// now that the node can connect again, it will start getting the removed
+		// error when trying to connect. The code should be removed
+		testhelpers.RetryUntil(t, 10*time.Second, func() error {
+			resp, err := followerClient.Logical().ReadRawWithData("sys/health", map[string][]string{
+				"perfstandbyok": {"true"},
+				"standbyok":     {"true"},
+			})
+			if err == nil {
+				if resp != nil && resp.Body != nil {
+					resp.Body.Close()
+				}
+				return fmt.Errorf("expected error")
+			}
+			if resp.StatusCode != 530 {
+				resp.Body.Close()
+				return fmt.Errorf("status code %d", resp.StatusCode)
+			}
+			erroredResponse = resp
+			return nil
+		})
+		r := parseHealthBody(t, erroredResponse)
+		require.True(t, true, *r.RemovedFromCluster)
+		// The HA connection health should either be nil or false. It's possible
+		// for it to be false if we got the response in between the node marking
+		// itself removed and sealing
+		if r.HAConnectionHealthy != nil {
+			require.False(t, *r.HAConnectionHealthy)
+		}
+	})
+}
+
+// TestRaftCluster_Removed_ReAdd creates a three node raft cluster and then
+// removes one of the nodes. The removed follower tries to re-join, and the test
+// verifies that it errors and cannot join.
+func TestRaftCluster_Removed_ReAdd(t *testing.T) {
+	t.Parallel()
+	cluster, _ := raftCluster(t, nil)
+	defer cluster.Cleanup()
+
+	leader := cluster.Cores[0]
+	follower := cluster.Cores[2]
+
+	_, err := leader.Client.Logical().Write("/sys/storage/raft/remove-peer", map[string]interface{}{
+		"server_id": follower.NodeID,
+	})
+	require.NoError(t, err)
+	require.Eventually(t, follower.Sealed, 10*time.Second, 250*time.Millisecond)
+
+	joinReq := &api.RaftJoinRequest{LeaderAPIAddr: leader.Address.String()}
+	_, err = follower.Client.Sys().RaftJoin(joinReq)
+	require.Error(t, err)
+}
+
+// TestCore_RaftDataDirPath verifies that the RaftDataDirPath method returns a
+// data path when the storage backend is raft, and no data path when the storage
+// is not raft
+func TestCore_RaftDataDirPath(t *testing.T) {
+	t.Parallel()
+	t.Run("raft", func(t *testing.T) {
+		t.Parallel()
+		cluster, _ := raftCluster(t, nil)
+		defer cluster.Cleanup()
+		path, ok := cluster.Cores[0].RaftDataDirPath()
+		require.True(t, ok)
+		require.NotEmpty(t, path)
+	})
+	t.Run("inmem", func(t *testing.T) {
+		t.Parallel()
+		core, _, _ := vault.TestCoreUnsealed(t)
+		defer core.Shutdown()
+		path, ok := core.RaftDataDirPath()
+		require.False(t, ok)
+		require.Empty(t, path)
+	})
+	t.Run("raft ha", func(t *testing.T) {
+		t.Parallel()
+		var conf vault.CoreConfig
+		opts := vault.TestClusterOptions{HandlerFunc: vaulthttp.Handler}
+		teststorage.RaftHASetup(&conf, &opts, teststorage.MakeFileBackend)
+		cluster := vault.NewTestCluster(t, &conf, &opts)
+		defer cluster.Cleanup()
+		path, ok := cluster.Cores[0].RaftDataDirPath()
+		require.False(t, ok)
+		require.Empty(t, path)
+	})
+}
+
+// TestRaft_SnapshotLargerMaxRequestSize sets the max request size to 1KB and
+// creates a bunch of secrets. The test takes a snapshot and verifies that the
+// snapshot (larger than the max request size) can be restored successfully.
+func TestRaft_SnapshotLargerMaxRequestSize(t *testing.T) {
+	t.Parallel()
+	conf, opts := raftClusterBuilder(t, &RaftClusterOpts{
+		InmemCluster: true,
+		NumCores:     1,
+	})
+	opts.DefaultHandlerProperties = vault.HandlerProperties{
+		ListenerConfig: &configutil.Listener{
+			MaxRequestSize: 1024,
+		},
+	}
+
+	cluster := vault.NewTestCluster(t, conf, &opts)
+	vault.TestWaitActive(t, cluster.Cores[0].Core)
+	defer cluster.Cleanup()
+
+	client := cluster.Cores[0].Client
+	for i := 0; i < 4096; i++ {
+		path, err := uuid.GenerateUUID()
+		require.NoError(t, err)
+		content, err := uuid.GenerateUUID()
+		require.NoError(t, err)
+
+		_, err = client.KVv2("secret").Put(context.Background(), path, map[string]interface{}{
+			"data": content,
+		})
+	}
+	buf := new(bytes.Buffer)
+	err := client.Sys().RaftSnapshot(buf)
+	snap, err := io.ReadAll(buf)
+	require.NoError(t, err)
+	if len(snap) < 1024 {
+		// maybe possible if we get super unlucky with uuids and compression is
+		// amazing?
+		t.Fatalf("expected snapshot to be larger than max request size, got %d", len(snap))
+	}
+
+	err = client.Sys().RaftSnapshotRestore(bytes.NewReader(snap), false)
+	require.NoError(t, err)
+	testhelpers.WaitForActiveNode(t, cluster)
+}
diff --git a/vault/external_tests/raftha/raft_ha_test.go b/vault/external_tests/raftha/raft_ha_test.go
index 3f8c57d5353..d52b01b87ff 100644
--- a/vault/external_tests/raftha/raft_ha_test.go
+++ b/vault/external_tests/raftha/raft_ha_test.go
@@ -1,10 +1,13 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package raftha
 
 import (
+	"errors"
+	"fmt"
 	"testing"
+	"time"
 
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/api"
@@ -14,6 +17,7 @@ import (
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/vault"
+	"github.com/stretchr/testify/require"
 )
 
 func TestRaft_HA_NewCluster(t *testing.T) {
@@ -54,6 +58,20 @@ func TestRaft_HA_NewCluster(t *testing.T) {
 	})
 }
 
+// TestRaftHA_Recover_Cluster test that we can recover data and re-boostrap a cluster
+// that was created with raft HA enabled but is not using raft as the storage backend.
+func TestRaftHA_Recover_Cluster(t *testing.T) {
+	logger := logging.NewVaultLogger(hclog.Debug).Named(t.Name())
+	t.Run("file", func(t *testing.T) {
+		physBundle := teststorage.MakeFileBackend(t, logger)
+		testRaftHARecoverCluster(t, physBundle, logger)
+	})
+	t.Run("inmem", func(t *testing.T) {
+		physBundle := teststorage.MakeInmemBackend(t, logger)
+		testRaftHARecoverCluster(t, physBundle, logger)
+	})
+}
+
 func testRaftHANewCluster(t *testing.T, bundler teststorage.PhysicalBackendBundler, addClientCerts bool) {
 	var conf vault.CoreConfig
 	opts := vault.TestClusterOptions{HandlerFunc: vaulthttp.Handler}
@@ -117,6 +135,97 @@ func testRaftHANewCluster(t *testing.T, bundler teststorage.PhysicalBackendBundl
 	}
 }
 
+// testRaftHARecoverCluster : in this test, we're going to create a raft HA cluster and store a test secret in a KVv2
+// We're going to simulate an outage and destroy the cluster but we'll keep the storage backend.
+// We'll recreate a new cluster with the same storage backend and ensure that we can recover using
+// sys/storage/raft/bootstrap. We'll check that the new cluster
+// is functional and no data was lost: we can get the test secret from the KVv2.
+func testRaftHARecoverCluster(t *testing.T, physBundle *vault.PhysicalBackendBundle, logger hclog.Logger) {
+	opts := vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+		// We're not testing the HA, only that it can be recovered. No need for multiple cores.
+		NumCores: 1,
+	}
+
+	haStorage, haCleanup := teststorage.MakeReusableRaftHAStorage(t, logger, opts.NumCores, physBundle)
+	defer haCleanup()
+	haStorage.Setup(nil, &opts)
+	cluster := vault.NewTestCluster(t, nil, &opts)
+
+	var (
+		clusterBarrierKeys [][]byte
+		clusterRootToken   string
+	)
+	clusterBarrierKeys = cluster.BarrierKeys
+	clusterRootToken = cluster.RootToken
+	leaderCore := cluster.Cores[0]
+	testhelpers.EnsureCoreUnsealed(t, cluster, leaderCore)
+
+	leaderClient := cluster.Cores[0].Client
+	leaderClient.SetToken(clusterRootToken)
+
+	// Mount a KVv2 backend to store a test data
+	err := leaderClient.Sys().Mount("kv", &api.MountInput{
+		Type: "kv-v2",
+	})
+	require.NoError(t, err)
+
+	kvData := map[string]interface{}{
+		"data": map[string]interface{}{
+			"kittens": "awesome",
+		},
+	}
+
+	// Store the test data in the KVv2 backend
+	_, err = leaderClient.Logical().Write("kv/data/test_known_data", kvData)
+	require.NoError(t, err)
+
+	// We now have a raft HA cluster with a KVv2 backend enabled and a test data.
+	// We're now going to delete the cluster and create a new raft HA cluster with the same backend storage
+	// and ensure we can recover to a working vault cluster and don't lose the data from the backend storage.
+
+	opts = vault.TestClusterOptions{
+		HandlerFunc: vaulthttp.Handler,
+		// We're not testing the HA, only that it can be recovered. No need for multiple cores.
+		NumCores: 1,
+		// It's already initialized as we keep the same storage backend.
+		SkipInit: true,
+	}
+	haStorage, haCleanup = teststorage.MakeReusableRaftHAStorage(t, logger, opts.NumCores, physBundle)
+	defer haCleanup()
+	haStorage.Setup(nil, &opts)
+	clusterRestored := vault.NewTestCluster(t, nil, &opts)
+
+	clusterRestored.BarrierKeys = clusterBarrierKeys
+	clusterRestored.RootToken = clusterRootToken
+	leaderCoreRestored := clusterRestored.Cores[0]
+
+	testhelpers.EnsureCoresUnsealed(t, clusterRestored)
+
+	leaderClientRestored := clusterRestored.Cores[0].Client
+
+	// We now reset the TLS keyring and bootstrap the cluster again.
+	_, err = leaderClientRestored.Logical().Write("sys/storage/raft/bootstrap", nil)
+	require.NoError(t, err)
+
+	vault.TestWaitActive(t, leaderCoreRestored.Core)
+	// Core should be active and cluster in a working state. We should be able to
+	// read the data from the KVv2 backend.
+	leaderClientRestored.SetToken(clusterRootToken)
+	secretRaw, err := leaderClientRestored.Logical().Read("kv/data/test_known_data")
+	require.NoError(t, err)
+
+	data := secretRaw.Data["data"]
+	dataAsMap := data.(map[string]interface{})
+	require.NotNil(t, dataAsMap)
+	require.Equal(t, "awesome", dataAsMap["kittens"])
+
+	// Ensure no writes are happening before we try to clean it up, to prevent
+	// issues deleting the files.
+	clusterRestored.EnsureCoresSealed(t)
+	clusterRestored.Cleanup()
+}
+
 func TestRaft_HA_ExistingCluster(t *testing.T) {
 	t.Parallel()
 	conf := vault.CoreConfig{
@@ -221,3 +330,67 @@ func TestRaft_HA_ExistingCluster(t *testing.T) {
 
 	updateCluster(t)
 }
+
+// TestRaftHACluster_Removed_ReAdd creates a raft HA cluster with a file
+// backend. The test adds two standbys to the cluster and then removes one of
+// them. The removed follower tries to re-join, and the test verifies that it
+// errors and cannot join.
+func TestRaftHACluster_Removed_ReAdd(t *testing.T) {
+	t.Skip("This test is flaky and needs to be fixed before it can be re-enabled")
+	t.Parallel()
+	var conf vault.CoreConfig
+	opts := vault.TestClusterOptions{HandlerFunc: vaulthttp.Handler}
+	teststorage.RaftHASetup(&conf, &opts, teststorage.MakeFileBackend)
+	cluster := vault.NewTestCluster(t, &conf, &opts)
+	defer cluster.Cleanup()
+	vault.TestWaitActive(t, cluster.Cores[0].Core)
+
+	leader := cluster.Cores[0]
+	follower := cluster.Cores[2]
+	joinReq := &api.RaftJoinRequest{LeaderCACert: string(cluster.CACertPEM)}
+	_, err := follower.Client.Sys().RaftJoin(joinReq)
+	require.NoError(t, err)
+	_, err = cluster.Cores[1].Client.Sys().RaftJoin(joinReq)
+	require.NoError(t, err)
+
+	testhelpers.RetryUntil(t, 3*time.Second, func() error {
+		resp, err := leader.Client.Sys().RaftAutopilotState()
+		if err != nil {
+			return err
+		}
+		if len(resp.Servers) != 3 {
+			return errors.New("need 3 servers")
+		}
+		for serverID, server := range resp.Servers {
+			if !server.Healthy {
+				return fmt.Errorf("server %s is unhealthy", serverID)
+			}
+			if server.NodeType != "voter" {
+				return fmt.Errorf("server %s has type %s", serverID, server.NodeType)
+			}
+		}
+		return nil
+	})
+	_, err = leader.Client.Logical().Write("/sys/storage/raft/remove-peer", map[string]interface{}{
+		"server_id": follower.NodeID,
+	})
+	require.NoError(t, err)
+
+	follower.Logger().Info("waiting for shutdown to finish")
+
+	// Something about this test very flaky. Let's give the shutdown as long
+	// as it needs before anymore assertions. This shouldn't be too big of a
+	// deal, since the ShutdonwDone channel ensures we only take as much time as
+	// we need and this test is running in parallel anyway...
+	timeout := time.After(5 * time.Minute)
+	select {
+	case <-follower.ShutdownDone():
+	case <-timeout:
+		t.Fatalf("test timed out waiting for shutdown")
+	}
+
+	require.True(t, follower.Sealed(), "follower node still unsealed after shutdown")
+
+	_, err = follower.Client.Sys().RaftJoin(joinReq)
+	require.Error(t, err)
+}
diff --git a/vault/external_tests/replication_binary/replication_test.go b/vault/external_tests/replication_binary/replication_test.go
index ff2ef3e2d8f..fcae989a83c 100644
--- a/vault/external_tests/replication_binary/replication_test.go
+++ b/vault/external_tests/replication_binary/replication_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package replication_binary
diff --git a/vault/external_tests/response/allowed_response_headers_test.go b/vault/external_tests/response/allowed_response_headers_test.go
index d9dc2e4f236..4225ad1b2ad 100644
--- a/vault/external_tests/response/allowed_response_headers_test.go
+++ b/vault/external_tests/response/allowed_response_headers_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package identity
diff --git a/vault/external_tests/router/router_ext_test.go b/vault/external_tests/router/router_ext_test.go
index c2cb58c4c36..2f80048eaa5 100644
--- a/vault/external_tests/router/router_ext_test.go
+++ b/vault/external_tests/router/router_ext_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package router
@@ -12,7 +12,6 @@ import (
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/audit"
 	"github.com/hashicorp/vault/helper/testhelpers"
-	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/helper/testhelpers/minimal"
 	vaulthttp "github.com/hashicorp/vault/http"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -95,7 +94,7 @@ func TestWellKnownRedirect_HA(t *testing.T) {
 	var records *[][]byte
 	cluster := vault.NewTestCluster(t, &vault.CoreConfig{
 		AuditBackends: map[string]audit.Factory{
-			"noop": corehelpers.NoopAuditFactory(&records),
+			"noop": audit.NoopAuditFactory(&records),
 		},
 		DisablePerformanceStandby: true,
 		LogicalBackends: map[string]logical.Factory{
diff --git a/vault/external_tests/seal_binary/seal_docker_util.go b/vault/external_tests/seal_binary/seal_docker_util.go
index f65ba5b69d0..2b16cb76773 100644
--- a/vault/external_tests/seal_binary/seal_docker_util.go
+++ b/vault/external_tests/seal_binary/seal_docker_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package seal_binary
@@ -11,7 +11,7 @@ import (
 	"os"
 	"path"
 
-	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/api"
 	dockhelper "github.com/hashicorp/vault/sdk/helper/docker"
@@ -22,7 +22,7 @@ const (
 {
 	"storage": {
 		"file": {
-			"path": "/tmp",
+			"path": "/tmp"
 		}
 	},
 
@@ -311,7 +311,7 @@ func copyConfigToContainer(containerID string, bCtx dockhelper.BuildContext, run
 		return fmt.Errorf("error creating config tarball: %w", err)
 	}
 
-	err = runner.DockerAPI.CopyToContainer(context.Background(), containerID, "/vault/config", tar, types.CopyToContainerOptions{})
+	err = runner.DockerAPI.CopyToContainer(context.Background(), containerID, "/vault/config", tar, container.CopyToContainerOptions{})
 	if err != nil {
 		return fmt.Errorf("error copying config to container: %w", err)
 	}
@@ -330,7 +330,7 @@ func copyRecoveryModeTriggerToContainer(containerID string, runner *dockhelper.R
 		return fmt.Errorf("error creating config tarball: %w", err)
 	}
 
-	err = runner.DockerAPI.CopyToContainer(context.Background(), containerID, recoveryModeFileDir, tar, types.CopyToContainerOptions{})
+	err = runner.DockerAPI.CopyToContainer(context.Background(), containerID, recoveryModeFileDir, tar, container.CopyToContainerOptions{})
 	if err != nil {
 		return fmt.Errorf("error copying revovery mode trigger file to container: %w", err)
 	}
diff --git a/vault/external_tests/seal_binary/seal_sighup_test.go b/vault/external_tests/seal_binary/seal_sighup_test.go
index c6a7471b02c..4a875940dba 100644
--- a/vault/external_tests/seal_binary/seal_sighup_test.go
+++ b/vault/external_tests/seal_binary/seal_sighup_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/external_tests/sealmigration/seal_migration_pre14_test.go b/vault/external_tests/sealmigration/seal_migration_pre14_test.go
index 2b5d136e542..5235dd754da 100644
--- a/vault/external_tests/sealmigration/seal_migration_pre14_test.go
+++ b/vault/external_tests/sealmigration/seal_migration_pre14_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package sealmigration
diff --git a/vault/external_tests/sealmigration/seal_migration_test.go b/vault/external_tests/sealmigration/seal_migration_test.go
index 64594cdf3f5..e1f6a28c8b2 100644
--- a/vault/external_tests/sealmigration/seal_migration_test.go
+++ b/vault/external_tests/sealmigration/seal_migration_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package sealmigration
diff --git a/vault/external_tests/sealmigration/testshared.go b/vault/external_tests/sealmigration/testshared.go
index 7ddc36552e5..eb91379bec6 100644
--- a/vault/external_tests/sealmigration/testshared.go
+++ b/vault/external_tests/sealmigration/testshared.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package sealmigration
diff --git a/vault/external_tests/sealmigrationext/seal_migration_pre14_test.go b/vault/external_tests/sealmigrationext/seal_migration_pre14_test.go
index ae45f74f896..61090dcef13 100644
--- a/vault/external_tests/sealmigrationext/seal_migration_pre14_test.go
+++ b/vault/external_tests/sealmigrationext/seal_migration_pre14_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package sealmigrationext
diff --git a/vault/external_tests/standby/standby_test.go b/vault/external_tests/standby/standby_test.go
index 3ce3fb96bb3..6fb4f832caa 100644
--- a/vault/external_tests/standby/standby_test.go
+++ b/vault/external_tests/standby/standby_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package standby
diff --git a/vault/external_tests/token/batch_token_test.go b/vault/external_tests/token/batch_token_test.go
index 5024d7400cb..4b403283aa9 100644
--- a/vault/external_tests/token/batch_token_test.go
+++ b/vault/external_tests/token/batch_token_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package token
diff --git a/vault/external_tests/token/token_test.go b/vault/external_tests/token/token_test.go
index 4521ca6df84..c609ce17da9 100644
--- a/vault/external_tests/token/token_test.go
+++ b/vault/external_tests/token/token_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package token
@@ -102,7 +102,7 @@ func TestTokenStore_IdentityPolicies(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	cleanup, cfg := ldap.PrepareTestContainer(t, "latest")
+	cleanup, cfg := ldap.PrepareTestContainer(t, ldap.DefaultVersion)
 	defer cleanup()
 
 	// Configure LDAP auth
diff --git a/vault/forwarded_writer_oss.go b/vault/forwarded_writer_oss.go
index a985641d896..1e7a4d6e7c7 100644
--- a/vault/forwarded_writer_oss.go
+++ b/vault/forwarded_writer_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/generate_root.go b/vault/generate_root.go
index 83111db7538..fb4da4380df 100644
--- a/vault/generate_root.go
+++ b/vault/generate_root.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/generate_root_recovery.go b/vault/generate_root_recovery.go
index a015d62d27a..bc80358167d 100644
--- a/vault/generate_root_recovery.go
+++ b/vault/generate_root_recovery.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/generate_root_test.go b/vault/generate_root_test.go
index 8f5ddf512ba..da1c75a1bae 100644
--- a/vault/generate_root_test.go
+++ b/vault/generate_root_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/ha.go b/vault/ha.go
index 536142e5798..79d35f96fd2 100644
--- a/vault/ha.go
+++ b/vault/ha.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -24,6 +24,7 @@ import (
 	"github.com/hashicorp/vault/sdk/helper/certutil"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
+	"github.com/hashicorp/vault/sdk/helper/metricregistry"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/vault/seal"
@@ -45,8 +46,30 @@ const (
 	// leaderPrefixCleanDelay is how long to wait between deletions
 	// of orphaned leader keys, to prevent slamming the backend.
 	leaderPrefixCleanDelay = 200 * time.Millisecond
+
+	haAllowedMissedHeartbeats = 2
 )
 
+func init() {
+	// Register metrics that we should always consistently report whether or not
+	// they've been hit recently. The help texts are taken verbatim from our
+	// telemetry reference docs so if updated should probably stay in sync.
+	metricregistry.RegisterSummaries([]metricregistry.SummaryDefinition{
+		{
+			Name: []string{"vault", "core", "step_down"},
+			Help: "Time required to step down cluster leadership",
+		},
+		{
+			Name: []string{"vault", "core", "leadership_setup_failed"},
+			Help: "Time taken by the most recent leadership setup failure",
+		},
+		{
+			Name: []string{"vault", "core", "leadership_lost"},
+			Help: "Total time that a high-availability cluster node last maintained leadership",
+		},
+	})
+}
+
 var (
 	addEnterpriseHaActors func(*Core, *run.Group) chan func()            = addEnterpriseHaActorsNoop
 	interruptPerfStandby  func(chan func(), chan struct{}) chan struct{} = interruptPerfStandbyNoop
@@ -109,7 +132,7 @@ func (c *Core) getHAMembers() ([]HAStatusNode, error) {
 	}
 
 	if rb := c.getRaftBackend(); rb != nil {
-		leader.UpgradeVersion = rb.EffectiveVersion()
+		leader.UpgradeVersion = rb.UpgradeVersion()
 		leader.RedundancyZone = rb.RedundancyZone()
 	}
 
@@ -118,15 +141,16 @@ func (c *Core) getHAMembers() ([]HAStatusNode, error) {
 	for _, peerNode := range c.GetHAPeerNodesCached() {
 		lastEcho := peerNode.LastEcho
 		nodes = append(nodes, HAStatusNode{
-			Hostname:           peerNode.Hostname,
-			APIAddress:         peerNode.APIAddress,
-			ClusterAddress:     peerNode.ClusterAddress,
-			LastEcho:           &lastEcho,
-			Version:            peerNode.Version,
-			UpgradeVersion:     peerNode.UpgradeVersion,
-			RedundancyZone:     peerNode.RedundancyZone,
-			EchoDurationMillis: peerNode.EchoDuration.Milliseconds(),
-			ClockSkewMillis:    peerNode.ClockSkewMillis,
+			Hostname:                    peerNode.Hostname,
+			APIAddress:                  peerNode.APIAddress,
+			ClusterAddress:              peerNode.ClusterAddress,
+			LastEcho:                    &lastEcho,
+			Version:                     peerNode.Version,
+			UpgradeVersion:              peerNode.UpgradeVersion,
+			RedundancyZone:              peerNode.RedundancyZone,
+			EchoDurationMillis:          peerNode.EchoDuration.Milliseconds(),
+			ClockSkewMillis:             peerNode.ClockSkewMillis,
+			ReplicationPrimaryCanaryAge: peerNode.ReplicationPrimaryCanaryAge,
 		})
 	}
 
@@ -580,6 +604,20 @@ func (c *Core) waitForLeadership(newLeaderCh chan func(), manualStepDownCh, stop
 		c.activeContext = activeCtx
 		c.activeContextCancelFunc.Store(activeCtxCancel)
 
+		// Trigger a seal reload if necessary. A seal reload is necessary when a node
+		// becomes the leader since its seal generation information may be out of
+		// date (as is the case, for example, when a new node joins the cluster).
+		if err := c.TriggerSealReload(c.activeContext); err != nil {
+			c.logger.Error("seal configuration reload error", "error", err)
+			c.barrier.Seal()
+			c.logger.Warn("vault is sealed")
+			c.heldHALock = nil
+			lock.Unlock()
+			close(continueCh)
+			c.stateLock.Unlock()
+			return
+		}
+
 		// Perform seal migration
 		if err := c.migrateSeal(c.activeContext); err != nil {
 			c.logger.Error("seal migration error", "error", err)
@@ -1187,3 +1225,37 @@ func (c *Core) SetNeverBecomeActive(on bool) {
 		atomic.StoreUint32(c.neverBecomeActive, 0)
 	}
 }
+
+func (c *Core) getRemovableHABackend() physical.RemovableNodeHABackend {
+	var haBackend physical.RemovableNodeHABackend
+	if removableHA, ok := c.ha.(physical.RemovableNodeHABackend); ok {
+		haBackend = removableHA
+	}
+
+	if removableHA, ok := c.underlyingPhysical.(physical.RemovableNodeHABackend); ok {
+		haBackend = removableHA
+	}
+
+	return haBackend
+}
+
+// GetHAHeartbeatHealth returns whether a node's last successful heartbeat was
+// more than 2 intervals ago. If the node's request forwarding clients were
+// cleared (due to the node being sealed or finding a new leader), or the node
+// is uninitialized, healthy will be false.
+func (c *Core) GetHAHeartbeatHealth() (healthy bool, sinceLastHeartbeat *time.Duration) {
+	heartbeat := c.rpcLastSuccessfulHeartbeat.Load()
+	if heartbeat == nil {
+		return false, nil
+	}
+	lastHeartbeat := heartbeat.(time.Time)
+	if lastHeartbeat.IsZero() {
+		return false, nil
+	}
+	diff := time.Now().Sub(lastHeartbeat)
+	heartbeatInterval := c.clusterHeartbeatInterval
+	if heartbeatInterval <= 0 {
+		heartbeatInterval = 5 * time.Second
+	}
+	return diff < heartbeatInterval*haAllowedMissedHeartbeats, &diff
+}
diff --git a/vault/ha_test.go b/vault/ha_test.go
index cf3142d76fe..856a52eb75d 100644
--- a/vault/ha_test.go
+++ b/vault/ha_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -10,9 +10,11 @@ import (
 	"sync/atomic"
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/require"
 )
 
-// TestGrabLockOrStopped is a non-deterministic test to detect deadlocks in the
+// TestGrabLockOrStop is a non-deterministic test to detect deadlocks in the
 // grabLockOrStopped function. This test starts a bunch of workers which
 // continually lock/unlock and rlock/runlock the same RWMutex. Each worker also
 // starts a goroutine which closes the stop channel 1/2 the time, which races
@@ -85,3 +87,76 @@ func TestGrabLockOrStop(t *testing.T) {
 	}
 	workerWg.Wait()
 }
+
+// TestGetHAHeartbeatHealth checks that heartbeat health is correctly determined
+// for a variety of scenarios
+func TestGetHAHeartbeatHealth(t *testing.T) {
+	now := time.Now().UTC()
+	oldLastHeartbeat := now.Add(-1 * time.Hour)
+	futureHeartbeat := now.Add(10 * time.Second)
+	zeroHeartbeat := time.Time{}
+	testCases := []struct {
+		name              string
+		lastHeartbeat     *time.Time
+		heartbeatInterval time.Duration
+		wantHealthy       bool
+	}{
+		{
+			name:              "old heartbeat",
+			lastHeartbeat:     &oldLastHeartbeat,
+			heartbeatInterval: 5 * time.Second,
+			wantHealthy:       false,
+		},
+		{
+			name:              "no heartbeat",
+			lastHeartbeat:     nil,
+			heartbeatInterval: 5 * time.Second,
+			wantHealthy:       false,
+		},
+		{
+			name:              "recent heartbeat",
+			lastHeartbeat:     &now,
+			heartbeatInterval: 20 * time.Second,
+			wantHealthy:       true,
+		},
+		{
+			name:              "recent heartbeat, empty interval",
+			lastHeartbeat:     &futureHeartbeat,
+			heartbeatInterval: 0,
+			wantHealthy:       true,
+		},
+		{
+			name:              "old heartbeat, empty interval",
+			lastHeartbeat:     &oldLastHeartbeat,
+			heartbeatInterval: 0,
+			wantHealthy:       false,
+		},
+		{
+			name:              "zero value heartbeat",
+			lastHeartbeat:     &zeroHeartbeat,
+			heartbeatInterval: 5 * time.Second,
+			wantHealthy:       false,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			v := new(atomic.Value)
+			if tc.lastHeartbeat != nil {
+				v.Store(*tc.lastHeartbeat)
+			}
+			c := &Core{
+				rpcLastSuccessfulHeartbeat: v,
+				clusterHeartbeatInterval:   tc.heartbeatInterval,
+			}
+
+			now := time.Now()
+			gotHealthy, gotLastHeartbeat := c.GetHAHeartbeatHealth()
+			require.Equal(t, tc.wantHealthy, gotHealthy)
+			if tc.lastHeartbeat != nil && !tc.lastHeartbeat.IsZero() {
+				require.InDelta(t, now.Sub(*tc.lastHeartbeat).Milliseconds(), gotLastHeartbeat.Milliseconds(), float64(3*time.Second.Milliseconds()))
+			} else {
+				require.Nil(t, gotLastHeartbeat)
+			}
+		})
+	}
+}
diff --git a/vault/hcp_link/capabilities/api_capability/api_capability.go b/vault/hcp_link/capabilities/api_capability/api_capability.go
index b717b131581..f32d1d19cef 100644
--- a/vault/hcp_link/capabilities/api_capability/api_capability.go
+++ b/vault/hcp_link/capabilities/api_capability/api_capability.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api_capability
diff --git a/vault/hcp_link/capabilities/api_capability/api_passthrough.go b/vault/hcp_link/capabilities/api_capability/api_passthrough.go
index 5f0fa1da53a..e511a7624fa 100644
--- a/vault/hcp_link/capabilities/api_capability/api_passthrough.go
+++ b/vault/hcp_link/capabilities/api_capability/api_passthrough.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api_capability
diff --git a/vault/hcp_link/capabilities/api_capability/token_manager.go b/vault/hcp_link/capabilities/api_capability/token_manager.go
index 9b3ad31ab81..0a2b5cb39e9 100644
--- a/vault/hcp_link/capabilities/api_capability/token_manager.go
+++ b/vault/hcp_link/capabilities/api_capability/token_manager.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api_capability
diff --git a/vault/hcp_link/capabilities/api_capability/token_manager_test.go b/vault/hcp_link/capabilities/api_capability/token_manager_test.go
index c0f688609ac..a0c8e251e55 100644
--- a/vault/hcp_link/capabilities/api_capability/token_manager_test.go
+++ b/vault/hcp_link/capabilities/api_capability/token_manager_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package api_capability
diff --git a/vault/hcp_link/capabilities/capability.go b/vault/hcp_link/capabilities/capability.go
index 802c5b6a56f..a71853425b2 100644
--- a/vault/hcp_link/capabilities/capability.go
+++ b/vault/hcp_link/capabilities/capability.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package capabilities
diff --git a/vault/hcp_link/capabilities/link_control/link_control.go b/vault/hcp_link/capabilities/link_control/link_control.go
index 8af47a0eb71..3c9f4fcc66d 100644
--- a/vault/hcp_link/capabilities/link_control/link_control.go
+++ b/vault/hcp_link/capabilities/link_control/link_control.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package link_control
diff --git a/vault/hcp_link/capabilities/meta/meta.go b/vault/hcp_link/capabilities/meta/meta.go
index aa0c090f36e..9b03a094b75 100644
--- a/vault/hcp_link/capabilities/meta/meta.go
+++ b/vault/hcp_link/capabilities/meta/meta.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package meta
diff --git a/vault/hcp_link/capabilities/node_status/node_status.go b/vault/hcp_link/capabilities/node_status/node_status.go
index d2f52c07b23..1e336bb37c3 100644
--- a/vault/hcp_link/capabilities/node_status/node_status.go
+++ b/vault/hcp_link/capabilities/node_status/node_status.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package node_status
diff --git a/vault/hcp_link/internal/config.go b/vault/hcp_link/internal/config.go
index 0892865aa26..61f6e9011b4 100644
--- a/vault/hcp_link/internal/config.go
+++ b/vault/hcp_link/internal/config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package internal
diff --git a/vault/hcp_link/internal/wrapped_hcpLink.go b/vault/hcp_link/internal/wrapped_hcpLink.go
index 37606223028..c353814593a 100644
--- a/vault/hcp_link/internal/wrapped_hcpLink.go
+++ b/vault/hcp_link/internal/wrapped_hcpLink.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package internal
diff --git a/vault/hcp_link/link.go b/vault/hcp_link/link.go
index 3953a14e70d..1bf3a0283c0 100644
--- a/vault/hcp_link/link.go
+++ b/vault/hcp_link/link.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package hcp_link
diff --git a/vault/hcp_link/proto/go.mod b/vault/hcp_link/proto/go.mod
index bad600fdf57..252e72193cf 100644
--- a/vault/hcp_link/proto/go.mod
+++ b/vault/hcp_link/proto/go.mod
@@ -1,16 +1,17 @@
 module github.com/hashicorp/vault/vault/hcp_link/proto
 
-go 1.19
+go 1.23.0
+
+toolchain go1.23.7
 
 require (
-	google.golang.org/grpc v1.56.3
-	google.golang.org/protobuf v1.30.0
+	google.golang.org/grpc v1.63.2
+	google.golang.org/protobuf v1.34.1
 )
 
 require (
-	github.com/golang/protobuf v1.5.3 // indirect
-	golang.org/x/net v0.17.0 // indirect
-	golang.org/x/sys v0.13.0 // indirect
-	golang.org/x/text v0.13.0 // indirect
-	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
+	golang.org/x/net v0.37.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/text v0.23.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de // indirect
 )
diff --git a/vault/hcp_link/proto/go.sum b/vault/hcp_link/proto/go.sum
index ffa46a35054..1695d4747dc 100644
--- a/vault/hcp_link/proto/go.sum
+++ b/vault/hcp_link/proto/go.sum
@@ -1,20 +1,14 @@
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
-golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
-golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 h1:KpwkzHKEF7B9Zxg18WzOa7djJ+Ha5DzthMyZYQfEn2A=
-google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
-google.golang.org/grpc v1.56.3 h1:8I4C0Yq1EjstUzUJzpcRVbuYA2mODtEmpWiQoN/b2nc=
-google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
-google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
+golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de h1:cZGRis4/ot9uVm639a+rHCUaG0JJHEsdyzSQTMX+suY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de/go.mod h1:H4O17MA/PE9BsGx3w+a+W2VOLLD1Qf7oJneAoU6WktY=
+google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
+google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
+google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=
+google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
diff --git a/vault/hcp_link/proto/link_control/link_control.pb.go b/vault/hcp_link/proto/link_control/link_control.pb.go
index 1c14593f068..880f0bbe654 100644
--- a/vault/hcp_link/proto/link_control/link_control.pb.go
+++ b/vault/hcp_link/proto/link_control/link_control.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: vault/hcp_link/proto/link_control/link_control.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -24,18 +25,16 @@ const (
 )
 
 type PurgePolicyRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *PurgePolicyRequest) Reset() {
 	*x = PurgePolicyRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_link_control_link_control_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_link_control_link_control_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *PurgePolicyRequest) String() string {
@@ -46,7 +45,7 @@ func (*PurgePolicyRequest) ProtoMessage() {}
 
 func (x *PurgePolicyRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_link_control_link_control_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -62,18 +61,16 @@ func (*PurgePolicyRequest) Descriptor() ([]byte, []int) {
 }
 
 type PurgePolicyResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *PurgePolicyResponse) Reset() {
 	*x = PurgePolicyResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_link_control_link_control_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_link_control_link_control_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *PurgePolicyResponse) String() string {
@@ -84,7 +81,7 @@ func (*PurgePolicyResponse) ProtoMessage() {}
 
 func (x *PurgePolicyResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_link_control_link_control_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -101,7 +98,7 @@ func (*PurgePolicyResponse) Descriptor() ([]byte, []int) {
 
 var File_vault_hcp_link_proto_link_control_link_control_proto protoreflect.FileDescriptor
 
-var file_vault_hcp_link_proto_link_control_link_control_proto_rawDesc = []byte{
+var file_vault_hcp_link_proto_link_control_link_control_proto_rawDesc = string([]byte{
 	0x0a, 0x34, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x68, 0x63, 0x70, 0x5f, 0x6c, 0x69, 0x6e, 0x6b,
 	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x6c, 0x69, 0x6e, 0x6b, 0x5f, 0x63, 0x6f, 0x6e, 0x74,
 	0x72, 0x6f, 0x6c, 0x2f, 0x6c, 0x69, 0x6e, 0x6b, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c,
@@ -120,22 +117,22 @@ var file_vault_hcp_link_proto_link_control_link_control_proto_rawDesc = []byte{
 	0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x68, 0x63, 0x70, 0x5f,
 	0x6c, 0x69, 0x6e, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x6c, 0x69, 0x6e, 0x6b, 0x5f,
 	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_vault_hcp_link_proto_link_control_link_control_proto_rawDescOnce sync.Once
-	file_vault_hcp_link_proto_link_control_link_control_proto_rawDescData = file_vault_hcp_link_proto_link_control_link_control_proto_rawDesc
+	file_vault_hcp_link_proto_link_control_link_control_proto_rawDescData []byte
 )
 
 func file_vault_hcp_link_proto_link_control_link_control_proto_rawDescGZIP() []byte {
 	file_vault_hcp_link_proto_link_control_link_control_proto_rawDescOnce.Do(func() {
-		file_vault_hcp_link_proto_link_control_link_control_proto_rawDescData = protoimpl.X.CompressGZIP(file_vault_hcp_link_proto_link_control_link_control_proto_rawDescData)
+		file_vault_hcp_link_proto_link_control_link_control_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_vault_hcp_link_proto_link_control_link_control_proto_rawDesc), len(file_vault_hcp_link_proto_link_control_link_control_proto_rawDesc)))
 	})
 	return file_vault_hcp_link_proto_link_control_link_control_proto_rawDescData
 }
 
 var file_vault_hcp_link_proto_link_control_link_control_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_vault_hcp_link_proto_link_control_link_control_proto_goTypes = []interface{}{
+var file_vault_hcp_link_proto_link_control_link_control_proto_goTypes = []any{
 	(*PurgePolicyRequest)(nil),  // 0: link_control.PurgePolicyRequest
 	(*PurgePolicyResponse)(nil), // 1: link_control.PurgePolicyResponse
 }
@@ -154,37 +151,11 @@ func file_vault_hcp_link_proto_link_control_link_control_proto_init() {
 	if File_vault_hcp_link_proto_link_control_link_control_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_vault_hcp_link_proto_link_control_link_control_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PurgePolicyRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_link_control_link_control_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PurgePolicyResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_vault_hcp_link_proto_link_control_link_control_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_vault_hcp_link_proto_link_control_link_control_proto_rawDesc), len(file_vault_hcp_link_proto_link_control_link_control_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   2,
 			NumExtensions: 0,
@@ -195,7 +166,6 @@ func file_vault_hcp_link_proto_link_control_link_control_proto_init() {
 		MessageInfos:      file_vault_hcp_link_proto_link_control_link_control_proto_msgTypes,
 	}.Build()
 	File_vault_hcp_link_proto_link_control_link_control_proto = out.File
-	file_vault_hcp_link_proto_link_control_link_control_proto_rawDesc = nil
 	file_vault_hcp_link_proto_link_control_link_control_proto_goTypes = nil
 	file_vault_hcp_link_proto_link_control_link_control_proto_depIdxs = nil
 }
diff --git a/vault/hcp_link/proto/link_control/link_control.proto b/vault/hcp_link/proto/link_control/link_control.proto
index d80fe9ae351..d0833ada160 100644
--- a/vault/hcp_link/proto/link_control/link_control.proto
+++ b/vault/hcp_link/proto/link_control/link_control.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
diff --git a/vault/hcp_link/proto/link_control/link_control_grpc.pb.go b/vault/hcp_link/proto/link_control/link_control_grpc.pb.go
index 330e55259d2..f1fd6f461b2 100644
--- a/vault/hcp_link/proto/link_control/link_control_grpc.pb.go
+++ b/vault/hcp_link/proto/link_control/link_control_grpc.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: vault/hcp_link/proto/link_control/link_control.proto
 
@@ -18,8 +18,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	HCPLinkControl_PurgePolicy_FullMethodName = "/link_control.HCPLinkControl/PurgePolicy"
@@ -43,8 +43,9 @@ func NewHCPLinkControlClient(cc grpc.ClientConnInterface) HCPLinkControlClient {
 }
 
 func (c *hCPLinkControlClient) PurgePolicy(ctx context.Context, in *PurgePolicyRequest, opts ...grpc.CallOption) (*PurgePolicyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PurgePolicyResponse)
-	err := c.cc.Invoke(ctx, HCPLinkControl_PurgePolicy_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, HCPLinkControl_PurgePolicy_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -53,7 +54,7 @@ func (c *hCPLinkControlClient) PurgePolicy(ctx context.Context, in *PurgePolicyR
 
 // HCPLinkControlServer is the server API for HCPLinkControl service.
 // All implementations must embed UnimplementedHCPLinkControlServer
-// for forward compatibility
+// for forward compatibility.
 type HCPLinkControlServer interface {
 	// PurgePolicy Forgets the current Batch token, and its associated policy,
 	// such that the policy is forced to be refreshed.
@@ -61,14 +62,18 @@ type HCPLinkControlServer interface {
 	mustEmbedUnimplementedHCPLinkControlServer()
 }
 
-// UnimplementedHCPLinkControlServer must be embedded to have forward compatible implementations.
-type UnimplementedHCPLinkControlServer struct {
-}
+// UnimplementedHCPLinkControlServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedHCPLinkControlServer struct{}
 
 func (UnimplementedHCPLinkControlServer) PurgePolicy(context.Context, *PurgePolicyRequest) (*PurgePolicyResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method PurgePolicy not implemented")
 }
 func (UnimplementedHCPLinkControlServer) mustEmbedUnimplementedHCPLinkControlServer() {}
+func (UnimplementedHCPLinkControlServer) testEmbeddedByValue()                        {}
 
 // UnsafeHCPLinkControlServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to HCPLinkControlServer will
@@ -78,6 +83,13 @@ type UnsafeHCPLinkControlServer interface {
 }
 
 func RegisterHCPLinkControlServer(s grpc.ServiceRegistrar, srv HCPLinkControlServer) {
+	// If the following call pancis, it indicates UnimplementedHCPLinkControlServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&HCPLinkControl_ServiceDesc, srv)
 }
 
diff --git a/vault/hcp_link/proto/meta/meta.pb.go b/vault/hcp_link/proto/meta/meta.pb.go
index 01bffd0dbda..550b4af6715 100644
--- a/vault/hcp_link/proto/meta/meta.pb.go
+++ b/vault/hcp_link/proto/meta/meta.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: vault/hcp_link/proto/meta/meta.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -24,18 +25,16 @@ const (
 )
 
 type ListNamespacesRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListNamespacesRequest) Reset() {
 	*x = ListNamespacesRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListNamespacesRequest) String() string {
@@ -46,7 +45,7 @@ func (*ListNamespacesRequest) ProtoMessage() {}
 
 func (x *ListNamespacesRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -62,20 +61,17 @@ func (*ListNamespacesRequest) Descriptor() ([]byte, []int) {
 }
 
 type ListNamespacesResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Paths         []string               `protobuf:"bytes,1,rep,name=Paths,proto3" json:"Paths,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Paths []string `protobuf:"bytes,1,rep,name=Paths,proto3" json:"Paths,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListNamespacesResponse) Reset() {
 	*x = ListNamespacesResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListNamespacesResponse) String() string {
@@ -86,7 +82,7 @@ func (*ListNamespacesResponse) ProtoMessage() {}
 
 func (x *ListNamespacesResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -109,18 +105,16 @@ func (x *ListNamespacesResponse) GetPaths() []string {
 }
 
 type ListMountsRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListMountsRequest) Reset() {
 	*x = ListMountsRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListMountsRequest) String() string {
@@ -131,7 +125,7 @@ func (*ListMountsRequest) ProtoMessage() {}
 
 func (x *ListMountsRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -147,22 +141,19 @@ func (*ListMountsRequest) Descriptor() ([]byte, []int) {
 }
 
 type Mount struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Path          string                 `protobuf:"bytes,1,opt,name=Path,proto3" json:"Path,omitempty"`
+	Type          string                 `protobuf:"bytes,2,opt,name=Type,proto3" json:"Type,omitempty"`
+	Description   string                 `protobuf:"bytes,3,opt,name=Description,proto3" json:"Description,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Path        string `protobuf:"bytes,1,opt,name=Path,proto3" json:"Path,omitempty"`
-	Type        string `protobuf:"bytes,2,opt,name=Type,proto3" json:"Type,omitempty"`
-	Description string `protobuf:"bytes,3,opt,name=Description,proto3" json:"Description,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Mount) Reset() {
 	*x = Mount{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Mount) String() string {
@@ -173,7 +164,7 @@ func (*Mount) ProtoMessage() {}
 
 func (x *Mount) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -210,20 +201,17 @@ func (x *Mount) GetDescription() string {
 }
 
 type ListMountsResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Mounts        []*Mount               `protobuf:"bytes,1,rep,name=Mounts,proto3" json:"Mounts,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Mounts []*Mount `protobuf:"bytes,1,rep,name=Mounts,proto3" json:"Mounts,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListMountsResponse) Reset() {
 	*x = ListMountsResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListMountsResponse) String() string {
@@ -234,7 +222,7 @@ func (*ListMountsResponse) ProtoMessage() {}
 
 func (x *ListMountsResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -257,18 +245,16 @@ func (x *ListMountsResponse) GetMounts() []*Mount {
 }
 
 type ListAuthsRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListAuthsRequest) Reset() {
 	*x = ListAuthsRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListAuthsRequest) String() string {
@@ -279,7 +265,7 @@ func (*ListAuthsRequest) ProtoMessage() {}
 
 func (x *ListAuthsRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -295,22 +281,19 @@ func (*ListAuthsRequest) Descriptor() ([]byte, []int) {
 }
 
 type Auth struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Path          string                 `protobuf:"bytes,1,opt,name=Path,proto3" json:"Path,omitempty"`
+	Type          string                 `protobuf:"bytes,2,opt,name=Type,proto3" json:"Type,omitempty"`
+	Description   string                 `protobuf:"bytes,3,opt,name=Description,proto3" json:"Description,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Path        string `protobuf:"bytes,1,opt,name=Path,proto3" json:"Path,omitempty"`
-	Type        string `protobuf:"bytes,2,opt,name=Type,proto3" json:"Type,omitempty"`
-	Description string `protobuf:"bytes,3,opt,name=Description,proto3" json:"Description,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Auth) Reset() {
 	*x = Auth{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Auth) String() string {
@@ -321,7 +304,7 @@ func (*Auth) ProtoMessage() {}
 
 func (x *Auth) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -358,20 +341,17 @@ func (x *Auth) GetDescription() string {
 }
 
 type ListAuthResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Auths         []*Auth                `protobuf:"bytes,1,rep,name=Auths,proto3" json:"Auths,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Auths []*Auth `protobuf:"bytes,1,rep,name=Auths,proto3" json:"Auths,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ListAuthResponse) Reset() {
 	*x = ListAuthResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ListAuthResponse) String() string {
@@ -382,7 +362,7 @@ func (*ListAuthResponse) ProtoMessage() {}
 
 func (x *ListAuthResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -405,18 +385,16 @@ func (x *ListAuthResponse) GetAuths() []*Auth {
 }
 
 type GetClusterStatusRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GetClusterStatusRequest) Reset() {
 	*x = GetClusterStatusRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GetClusterStatusRequest) String() string {
@@ -427,7 +405,7 @@ func (*GetClusterStatusRequest) ProtoMessage() {}
 
 func (x *GetClusterStatusRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -443,20 +421,17 @@ func (*GetClusterStatusRequest) Descriptor() ([]byte, []int) {
 }
 
 type HANode struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Hostname      string                 `protobuf:"bytes,1,opt,name=Hostname,proto3" json:"Hostname,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Hostname string `protobuf:"bytes,1,opt,name=Hostname,proto3" json:"Hostname,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *HANode) Reset() {
 	*x = HANode{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *HANode) String() string {
@@ -467,7 +442,7 @@ func (*HANode) ProtoMessage() {}
 
 func (x *HANode) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -490,21 +465,18 @@ func (x *HANode) GetHostname() string {
 }
 
 type HAStatus struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Enabled       bool                   `protobuf:"varint,1,opt,name=Enabled,proto3" json:"Enabled,omitempty"`
+	Nodes         []*HANode              `protobuf:"bytes,2,rep,name=Nodes,proto3" json:"Nodes,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Enabled bool      `protobuf:"varint,1,opt,name=Enabled,proto3" json:"Enabled,omitempty"`
-	Nodes   []*HANode `protobuf:"bytes,2,rep,name=Nodes,proto3" json:"Nodes,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *HAStatus) Reset() {
 	*x = HAStatus{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[10]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *HAStatus) String() string {
@@ -515,7 +487,7 @@ func (*HAStatus) ProtoMessage() {}
 
 func (x *HAStatus) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[10]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -545,10 +517,7 @@ func (x *HAStatus) GetNodes() []*HANode {
 }
 
 type RaftServer struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// NodeID is the name of the server
 	NodeID string `protobuf:"bytes,1,opt,name=NodeID,proto3" json:"NodeID,omitempty"`
 	// Address is the IP:port of the server, used for Raft communications
@@ -559,16 +528,16 @@ type RaftServer struct {
 	ProtocolVersion string `protobuf:"bytes,4,opt,name=ProtocolVersion,proto3" json:"ProtocolVersion,omitempty"`
 	// Voter is true if this server has a vote in the cluster. This might
 	// be false if the server is staging and still coming online.
-	Voter bool `protobuf:"varint,5,opt,name=Voter,proto3" json:"Voter,omitempty"`
+	Voter         bool `protobuf:"varint,5,opt,name=Voter,proto3" json:"Voter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RaftServer) Reset() {
 	*x = RaftServer{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[11]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RaftServer) String() string {
@@ -579,7 +548,7 @@ func (*RaftServer) ProtoMessage() {}
 
 func (x *RaftServer) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[11]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -630,20 +599,17 @@ func (x *RaftServer) GetVoter() bool {
 }
 
 type RaftConfiguration struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Servers       []*RaftServer          `protobuf:"bytes,1,rep,name=Servers,proto3" json:"Servers,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Servers []*RaftServer `protobuf:"bytes,1,rep,name=Servers,proto3" json:"Servers,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RaftConfiguration) Reset() {
 	*x = RaftConfiguration{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[12]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RaftConfiguration) String() string {
@@ -654,7 +620,7 @@ func (*RaftConfiguration) ProtoMessage() {}
 
 func (x *RaftConfiguration) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[12]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -677,21 +643,18 @@ func (x *RaftConfiguration) GetServers() []*RaftServer {
 }
 
 type AutopilotServer struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ID            string                 `protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
+	Healthy       bool                   `protobuf:"varint,2,opt,name=Healthy,proto3" json:"Healthy,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	ID      string `protobuf:"bytes,1,opt,name=ID,proto3" json:"ID,omitempty"`
-	Healthy bool   `protobuf:"varint,2,opt,name=Healthy,proto3" json:"Healthy,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *AutopilotServer) Reset() {
 	*x = AutopilotServer{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[13]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *AutopilotServer) String() string {
@@ -702,7 +665,7 @@ func (*AutopilotServer) ProtoMessage() {}
 
 func (x *AutopilotServer) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[13]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -732,21 +695,18 @@ func (x *AutopilotServer) GetHealthy() bool {
 }
 
 type AutopilotStatus struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Healthy       bool                   `protobuf:"varint,1,opt,name=Healthy,proto3" json:"Healthy,omitempty"`
+	Servers       []*AutopilotServer     `protobuf:"bytes,2,rep,name=Servers,proto3" json:"Servers,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Healthy bool               `protobuf:"varint,1,opt,name=Healthy,proto3" json:"Healthy,omitempty"`
-	Servers []*AutopilotServer `protobuf:"bytes,2,rep,name=Servers,proto3" json:"Servers,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *AutopilotStatus) Reset() {
 	*x = AutopilotStatus{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[14]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *AutopilotStatus) String() string {
@@ -757,7 +717,7 @@ func (*AutopilotStatus) ProtoMessage() {}
 
 func (x *AutopilotStatus) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[14]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -787,22 +747,19 @@ func (x *AutopilotStatus) GetServers() []*AutopilotServer {
 }
 
 type RaftStatus struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	RaftConfiguration *RaftConfiguration `protobuf:"bytes,1,opt,name=RaftConfiguration,proto3" json:"RaftConfiguration,omitempty"`
-	AutopilotStatus   *AutopilotStatus   `protobuf:"bytes,2,opt,name=AutopilotStatus,proto3" json:"AutopilotStatus,omitempty"`
-	QuorumWarning     string             `protobuf:"bytes,3,opt,name=QuorumWarning,proto3" json:"QuorumWarning,omitempty"`
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	RaftConfiguration *RaftConfiguration     `protobuf:"bytes,1,opt,name=RaftConfiguration,proto3" json:"RaftConfiguration,omitempty"`
+	AutopilotStatus   *AutopilotStatus       `protobuf:"bytes,2,opt,name=AutopilotStatus,proto3" json:"AutopilotStatus,omitempty"`
+	QuorumWarning     string                 `protobuf:"bytes,3,opt,name=QuorumWarning,proto3" json:"QuorumWarning,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *RaftStatus) Reset() {
 	*x = RaftStatus{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[15]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RaftStatus) String() string {
@@ -813,7 +770,7 @@ func (*RaftStatus) ProtoMessage() {}
 
 func (x *RaftStatus) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[15]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -850,24 +807,21 @@ func (x *RaftStatus) GetQuorumWarning() string {
 }
 
 type GetClusterStatusResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ClusterID     string                 `protobuf:"bytes,1,opt,name=ClusterID,proto3" json:"ClusterID,omitempty"`
+	HAStatus      *HAStatus              `protobuf:"bytes,2,opt,name=HAStatus,proto3" json:"HAStatus,omitempty"`
+	RaftStatus    *RaftStatus            `protobuf:"bytes,3,opt,name=RaftStatus,proto3" json:"RaftStatus,omitempty"`
+	StorageType   string                 `protobuf:"bytes,4,opt,name=StorageType,proto3" json:"StorageType,omitempty"`
+	ClusterName   string                 `protobuf:"bytes,5,opt,name=ClusterName,proto3" json:"ClusterName,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	ClusterID   string      `protobuf:"bytes,1,opt,name=ClusterID,proto3" json:"ClusterID,omitempty"`
-	HAStatus    *HAStatus   `protobuf:"bytes,2,opt,name=HAStatus,proto3" json:"HAStatus,omitempty"`
-	RaftStatus  *RaftStatus `protobuf:"bytes,3,opt,name=RaftStatus,proto3" json:"RaftStatus,omitempty"`
-	StorageType string      `protobuf:"bytes,4,opt,name=StorageType,proto3" json:"StorageType,omitempty"`
-	ClusterName string      `protobuf:"bytes,5,opt,name=ClusterName,proto3" json:"ClusterName,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *GetClusterStatusResponse) Reset() {
 	*x = GetClusterStatusResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[16]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *GetClusterStatusResponse) String() string {
@@ -878,7 +832,7 @@ func (*GetClusterStatusResponse) ProtoMessage() {}
 
 func (x *GetClusterStatusResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_meta_meta_proto_msgTypes[16]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -930,7 +884,7 @@ func (x *GetClusterStatusResponse) GetClusterName() string {
 
 var File_vault_hcp_link_proto_meta_meta_proto protoreflect.FileDescriptor
 
-var file_vault_hcp_link_proto_meta_meta_proto_rawDesc = []byte{
+var file_vault_hcp_link_proto_meta_meta_proto_rawDesc = string([]byte{
 	0x0a, 0x24, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x68, 0x63, 0x70, 0x5f, 0x6c, 0x69, 0x6e, 0x6b,
 	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x2f, 0x6d, 0x65, 0x74, 0x61,
 	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x22, 0x17, 0x0a, 0x15,
@@ -1039,22 +993,22 @@ var file_vault_hcp_link_proto_meta_meta_proto_rawDesc = []byte{
 	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74,
 	0x2f, 0x68, 0x63, 0x70, 0x5f, 0x6c, 0x69, 0x6e, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
 	0x6d, 0x65, 0x74, 0x61, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_vault_hcp_link_proto_meta_meta_proto_rawDescOnce sync.Once
-	file_vault_hcp_link_proto_meta_meta_proto_rawDescData = file_vault_hcp_link_proto_meta_meta_proto_rawDesc
+	file_vault_hcp_link_proto_meta_meta_proto_rawDescData []byte
 )
 
 func file_vault_hcp_link_proto_meta_meta_proto_rawDescGZIP() []byte {
 	file_vault_hcp_link_proto_meta_meta_proto_rawDescOnce.Do(func() {
-		file_vault_hcp_link_proto_meta_meta_proto_rawDescData = protoimpl.X.CompressGZIP(file_vault_hcp_link_proto_meta_meta_proto_rawDescData)
+		file_vault_hcp_link_proto_meta_meta_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_vault_hcp_link_proto_meta_meta_proto_rawDesc), len(file_vault_hcp_link_proto_meta_meta_proto_rawDesc)))
 	})
 	return file_vault_hcp_link_proto_meta_meta_proto_rawDescData
 }
 
 var file_vault_hcp_link_proto_meta_meta_proto_msgTypes = make([]protoimpl.MessageInfo, 17)
-var file_vault_hcp_link_proto_meta_meta_proto_goTypes = []interface{}{
+var file_vault_hcp_link_proto_meta_meta_proto_goTypes = []any{
 	(*ListNamespacesRequest)(nil),    // 0: meta.ListNamespacesRequest
 	(*ListNamespacesResponse)(nil),   // 1: meta.ListNamespacesResponse
 	(*ListMountsRequest)(nil),        // 2: meta.ListMountsRequest
@@ -1103,217 +1057,11 @@ func file_vault_hcp_link_proto_meta_meta_proto_init() {
 	if File_vault_hcp_link_proto_meta_meta_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListNamespacesRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListNamespacesResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListMountsRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Mount); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListMountsResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListAuthsRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Auth); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListAuthResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetClusterStatusRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HANode); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HAStatus); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RaftServer); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RaftConfiguration); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AutopilotServer); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AutopilotStatus); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RaftStatus); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_meta_meta_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetClusterStatusResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_vault_hcp_link_proto_meta_meta_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_vault_hcp_link_proto_meta_meta_proto_rawDesc), len(file_vault_hcp_link_proto_meta_meta_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   17,
 			NumExtensions: 0,
@@ -1324,7 +1072,6 @@ func file_vault_hcp_link_proto_meta_meta_proto_init() {
 		MessageInfos:      file_vault_hcp_link_proto_meta_meta_proto_msgTypes,
 	}.Build()
 	File_vault_hcp_link_proto_meta_meta_proto = out.File
-	file_vault_hcp_link_proto_meta_meta_proto_rawDesc = nil
 	file_vault_hcp_link_proto_meta_meta_proto_goTypes = nil
 	file_vault_hcp_link_proto_meta_meta_proto_depIdxs = nil
 }
diff --git a/vault/hcp_link/proto/meta/meta.proto b/vault/hcp_link/proto/meta/meta.proto
index 88da5c653f8..023c6cfdacc 100644
--- a/vault/hcp_link/proto/meta/meta.proto
+++ b/vault/hcp_link/proto/meta/meta.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
diff --git a/vault/hcp_link/proto/meta/meta_grpc.pb.go b/vault/hcp_link/proto/meta/meta_grpc.pb.go
index f1a85bc7ad4..c53e6561022 100644
--- a/vault/hcp_link/proto/meta/meta_grpc.pb.go
+++ b/vault/hcp_link/proto/meta/meta_grpc.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: vault/hcp_link/proto/meta/meta.proto
 
@@ -18,8 +18,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	HCPLinkMeta_ListNamespaces_FullMethodName   = "/meta.HCPLinkMeta/ListNamespaces"
@@ -51,8 +51,9 @@ func NewHCPLinkMetaClient(cc grpc.ClientConnInterface) HCPLinkMetaClient {
 }
 
 func (c *hCPLinkMetaClient) ListNamespaces(ctx context.Context, in *ListNamespacesRequest, opts ...grpc.CallOption) (*ListNamespacesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListNamespacesResponse)
-	err := c.cc.Invoke(ctx, HCPLinkMeta_ListNamespaces_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, HCPLinkMeta_ListNamespaces_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -60,8 +61,9 @@ func (c *hCPLinkMetaClient) ListNamespaces(ctx context.Context, in *ListNamespac
 }
 
 func (c *hCPLinkMetaClient) ListMounts(ctx context.Context, in *ListMountsRequest, opts ...grpc.CallOption) (*ListMountsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListMountsResponse)
-	err := c.cc.Invoke(ctx, HCPLinkMeta_ListMounts_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, HCPLinkMeta_ListMounts_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -69,8 +71,9 @@ func (c *hCPLinkMetaClient) ListMounts(ctx context.Context, in *ListMountsReques
 }
 
 func (c *hCPLinkMetaClient) ListAuths(ctx context.Context, in *ListAuthsRequest, opts ...grpc.CallOption) (*ListAuthResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAuthResponse)
-	err := c.cc.Invoke(ctx, HCPLinkMeta_ListAuths_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, HCPLinkMeta_ListAuths_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -78,8 +81,9 @@ func (c *hCPLinkMetaClient) ListAuths(ctx context.Context, in *ListAuthsRequest,
 }
 
 func (c *hCPLinkMetaClient) GetClusterStatus(ctx context.Context, in *GetClusterStatusRequest, opts ...grpc.CallOption) (*GetClusterStatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetClusterStatusResponse)
-	err := c.cc.Invoke(ctx, HCPLinkMeta_GetClusterStatus_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, HCPLinkMeta_GetClusterStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -88,7 +92,7 @@ func (c *hCPLinkMetaClient) GetClusterStatus(ctx context.Context, in *GetCluster
 
 // HCPLinkMetaServer is the server API for HCPLinkMeta service.
 // All implementations must embed UnimplementedHCPLinkMetaServer
-// for forward compatibility
+// for forward compatibility.
 type HCPLinkMetaServer interface {
 	// ListNamespaces will be used to recursively list all namespaces
 	ListNamespaces(context.Context, *ListNamespacesRequest) (*ListNamespacesResponse, error)
@@ -101,9 +105,12 @@ type HCPLinkMetaServer interface {
 	mustEmbedUnimplementedHCPLinkMetaServer()
 }
 
-// UnimplementedHCPLinkMetaServer must be embedded to have forward compatible implementations.
-type UnimplementedHCPLinkMetaServer struct {
-}
+// UnimplementedHCPLinkMetaServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedHCPLinkMetaServer struct{}
 
 func (UnimplementedHCPLinkMetaServer) ListNamespaces(context.Context, *ListNamespacesRequest) (*ListNamespacesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListNamespaces not implemented")
@@ -118,6 +125,7 @@ func (UnimplementedHCPLinkMetaServer) GetClusterStatus(context.Context, *GetClus
 	return nil, status.Errorf(codes.Unimplemented, "method GetClusterStatus not implemented")
 }
 func (UnimplementedHCPLinkMetaServer) mustEmbedUnimplementedHCPLinkMetaServer() {}
+func (UnimplementedHCPLinkMetaServer) testEmbeddedByValue()                     {}
 
 // UnsafeHCPLinkMetaServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to HCPLinkMetaServer will
@@ -127,6 +135,13 @@ type UnsafeHCPLinkMetaServer interface {
 }
 
 func RegisterHCPLinkMetaServer(s grpc.ServiceRegistrar, srv HCPLinkMetaServer) {
+	// If the following call pancis, it indicates UnimplementedHCPLinkMetaServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&HCPLinkMeta_ServiceDesc, srv)
 }
 
diff --git a/vault/hcp_link/proto/node_status/status.pb.go b/vault/hcp_link/proto/node_status/status.pb.go
index b646ce6aff4..ee63aa173c1 100644
--- a/vault/hcp_link/proto/node_status/status.pb.go
+++ b/vault/hcp_link/proto/node_status/status.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: vault/hcp_link/proto/node_status/status.proto
 
@@ -16,6 +16,7 @@ import (
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -84,20 +85,17 @@ func (LogLevel) EnumDescriptor() ([]byte, []int) {
 }
 
 type RaftStatus struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	IsVoter       bool                   `protobuf:"varint,1,opt,name=IsVoter,proto3" json:"IsVoter,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	IsVoter bool `protobuf:"varint,1,opt,name=IsVoter,proto3" json:"IsVoter,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RaftStatus) Reset() {
 	*x = RaftStatus{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_node_status_status_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_node_status_status_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *RaftStatus) String() string {
@@ -108,7 +106,7 @@ func (*RaftStatus) ProtoMessage() {}
 
 func (x *RaftStatus) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_node_status_status_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -131,10 +129,7 @@ func (x *RaftStatus) GetIsVoter() bool {
 }
 
 type LinkedClusterNodeStatusResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state                  protoimpl.MessageState `protogen:"open.v1"`
 	Type                   string                 `protobuf:"bytes,1,opt,name=Type,proto3" json:"Type,omitempty"`
 	Initialized            bool                   `protobuf:"varint,2,opt,name=Initialized,proto3" json:"Initialized,omitempty"`
 	Sealed                 bool                   `protobuf:"varint,3,opt,name=Sealed,proto3" json:"Sealed,omitempty"`
@@ -157,15 +152,15 @@ type LinkedClusterNodeStatusResponse struct {
 	LogLevel               LogLevel               `protobuf:"varint,20,opt,name=LogLevel,proto3,enum=hashicorp.vault.hcp_link.node_status.LogLevel" json:"LogLevel,omitempty"`
 	ActiveTime             *timestamppb.Timestamp `protobuf:"bytes,21,opt,name=ActiveTime,proto3" json:"ActiveTime,omitempty"`
 	RaftStatus             *RaftStatus            `protobuf:"bytes,22,opt,name=RaftStatus,proto3" json:"RaftStatus,omitempty"`
+	unknownFields          protoimpl.UnknownFields
+	sizeCache              protoimpl.SizeCache
 }
 
 func (x *LinkedClusterNodeStatusResponse) Reset() {
 	*x = LinkedClusterNodeStatusResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_hcp_link_proto_node_status_status_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_hcp_link_proto_node_status_status_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *LinkedClusterNodeStatusResponse) String() string {
@@ -176,7 +171,7 @@ func (*LinkedClusterNodeStatusResponse) ProtoMessage() {}
 
 func (x *LinkedClusterNodeStatusResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_hcp_link_proto_node_status_status_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -347,7 +342,7 @@ func (x *LinkedClusterNodeStatusResponse) GetRaftStatus() *RaftStatus {
 
 var File_vault_hcp_link_proto_node_status_status_proto protoreflect.FileDescriptor
 
-var file_vault_hcp_link_proto_node_status_status_proto_rawDesc = []byte{
+var file_vault_hcp_link_proto_node_status_status_proto_rawDesc = string([]byte{
 	0x0a, 0x2d, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x68, 0x63, 0x70, 0x5f, 0x6c, 0x69, 0x6e, 0x6b,
 	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x73, 0x74, 0x61, 0x74,
 	0x75, 0x73, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
@@ -422,23 +417,23 @@ var file_vault_hcp_link_proto_node_status_status_proto_rawDesc = []byte{
 	0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x68, 0x63, 0x70,
 	0x5f, 0x6c, 0x69, 0x6e, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x6e, 0x6f, 0x64, 0x65,
 	0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_vault_hcp_link_proto_node_status_status_proto_rawDescOnce sync.Once
-	file_vault_hcp_link_proto_node_status_status_proto_rawDescData = file_vault_hcp_link_proto_node_status_status_proto_rawDesc
+	file_vault_hcp_link_proto_node_status_status_proto_rawDescData []byte
 )
 
 func file_vault_hcp_link_proto_node_status_status_proto_rawDescGZIP() []byte {
 	file_vault_hcp_link_proto_node_status_status_proto_rawDescOnce.Do(func() {
-		file_vault_hcp_link_proto_node_status_status_proto_rawDescData = protoimpl.X.CompressGZIP(file_vault_hcp_link_proto_node_status_status_proto_rawDescData)
+		file_vault_hcp_link_proto_node_status_status_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_vault_hcp_link_proto_node_status_status_proto_rawDesc), len(file_vault_hcp_link_proto_node_status_status_proto_rawDesc)))
 	})
 	return file_vault_hcp_link_proto_node_status_status_proto_rawDescData
 }
 
 var file_vault_hcp_link_proto_node_status_status_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
 var file_vault_hcp_link_proto_node_status_status_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_vault_hcp_link_proto_node_status_status_proto_goTypes = []interface{}{
+var file_vault_hcp_link_proto_node_status_status_proto_goTypes = []any{
 	(LogLevel)(0),                           // 0: hashicorp.vault.hcp_link.node_status.LogLevel
 	(*RaftStatus)(nil),                      // 1: hashicorp.vault.hcp_link.node_status.RaftStatus
 	(*LinkedClusterNodeStatusResponse)(nil), // 2: hashicorp.vault.hcp_link.node_status.LinkedClusterNodeStatusResponse
@@ -460,37 +455,11 @@ func file_vault_hcp_link_proto_node_status_status_proto_init() {
 	if File_vault_hcp_link_proto_node_status_status_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_vault_hcp_link_proto_node_status_status_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RaftStatus); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_hcp_link_proto_node_status_status_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LinkedClusterNodeStatusResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_vault_hcp_link_proto_node_status_status_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_vault_hcp_link_proto_node_status_status_proto_rawDesc), len(file_vault_hcp_link_proto_node_status_status_proto_rawDesc)),
 			NumEnums:      1,
 			NumMessages:   2,
 			NumExtensions: 0,
@@ -502,7 +471,6 @@ func file_vault_hcp_link_proto_node_status_status_proto_init() {
 		MessageInfos:      file_vault_hcp_link_proto_node_status_status_proto_msgTypes,
 	}.Build()
 	File_vault_hcp_link_proto_node_status_status_proto = out.File
-	file_vault_hcp_link_proto_node_status_status_proto_rawDesc = nil
 	file_vault_hcp_link_proto_node_status_status_proto_goTypes = nil
 	file_vault_hcp_link_proto_node_status_status_proto_depIdxs = nil
 }
diff --git a/vault/hcp_link/proto/node_status/status.proto b/vault/hcp_link/proto/node_status/status.proto
index 93da81c253c..ea614384412 100644
--- a/vault/hcp_link/proto/node_status/status.proto
+++ b/vault/hcp_link/proto/node_status/status.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
diff --git a/vault/identity_lookup.go b/vault/identity_lookup.go
index 14e4ffdf5bb..8f2cfc24234 100644
--- a/vault/identity_lookup.go
+++ b/vault/identity_lookup.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/identity_lookup_test.go b/vault/identity_lookup_test.go
index 368381acad1..24908c0a9f4 100644
--- a/vault/identity_lookup_test.go
+++ b/vault/identity_lookup_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/identity_store.go b/vault/identity_store.go
index d936e86c721..dff0e7f937a 100644
--- a/vault/identity_store.go
+++ b/vault/identity_store.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -6,6 +6,7 @@ package vault
 import (
 	"context"
 	"fmt"
+	"reflect"
 	"strings"
 	"time"
 
@@ -21,8 +22,12 @@ import (
 	"github.com/hashicorp/vault/helper/versions"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/helper/locksutil"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/patrickmn/go-cache"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 const (
@@ -40,7 +45,13 @@ func (c *Core) IdentityStore() *IdentityStore {
 	return c.identityStore
 }
 
-func (i *IdentityStore) resetDB(ctx context.Context) error {
+func (i *IdentityStore) GetDisableLowerCasedNames() bool {
+	i.lock.RLock()
+	defer i.lock.RUnlock()
+	return i.disableLowerCasedNames
+}
+
+func (i *IdentityStore) resetDB() error {
 	var err error
 
 	i.db, err = memdb.NewMemDB(identityStoreSchema(!i.disableLowerCasedNames))
@@ -53,24 +64,27 @@ func (i *IdentityStore) resetDB(ctx context.Context) error {
 
 func NewIdentityStore(ctx context.Context, core *Core, config *logical.BackendConfig, logger log.Logger) (*IdentityStore, error) {
 	iStore := &IdentityStore{
-		view:          config.StorageView,
-		logger:        logger,
-		router:        core.router,
-		redirectAddr:  core.redirectAddr,
-		localNode:     core,
-		namespacer:    core,
-		metrics:       core.MetricSink(),
-		totpPersister: core,
-		groupUpdater:  core,
-		tokenStorer:   core,
-		entityCreator: core,
-		mountLister:   core,
-		mfaBackend:    core.loginMFABackend,
+		view:                   config.StorageView,
+		logger:                 logger,
+		router:                 core.router,
+		redirectAddr:           core.redirectAddr,
+		localNode:              core,
+		namespacer:             core,
+		metrics:                core.MetricSink(),
+		totpPersister:          core,
+		groupUpdater:           core,
+		tokenStorer:            core,
+		entityCreator:          core,
+		mountLister:            core,
+		mfaBackend:             core.loginMFABackend,
+		aliasLocks:             locksutil.CreateLocks(),
+		renameDuplicates:       core.FeatureActivationFlags,
+		activationErrorHandler: core,
 	}
 
 	// Create a memdb instance, which by default, operates on lower cased
 	// identity names
-	err := iStore.resetDB(ctx)
+	err := iStore.resetDB()
 	if err != nil {
 		return nil, err
 	}
@@ -102,19 +116,20 @@ func NewIdentityStore(ctx context.Context, core *Core, config *logical.BackendCo
 		Paths:          iStore.paths(),
 		Invalidate:     iStore.Invalidate,
 		InitializeFunc: iStore.initialize,
+		ActivationFunc: iStore.activate,
 		PathsSpecial: &logical.Paths{
-			Unauthenticated: []string{
+			Unauthenticated: append([]string{
 				"oidc/.well-known/*",
 				"oidc/+/.well-known/*",
 				"oidc/provider/+/.well-known/*",
 				"oidc/provider/+/token",
-			},
+			}, identityStoreLoginMFAEntUnauthedPaths()...),
 			LocalStorage: []string{
 				localAliasesBucketsPrefix,
 			},
 		},
 		PeriodicFunc: func(ctx context.Context, req *logical.Request) error {
-			iStore.oidcPeriodicFunc(ctx)
+			iStore.oidcPeriodicFunc(ctx, req.Storage)
 
 			return nil
 		},
@@ -135,6 +150,7 @@ func NewIdentityStore(ctx context.Context, core *Core, config *logical.BackendCo
 func (i *IdentityStore) paths() []*framework.Path {
 	return framework.PathAppend(
 		entityPaths(i),
+		entityTestonlyPaths(i),
 		aliasPaths(i),
 		groupAliasPaths(i),
 		groupPaths(i),
@@ -149,6 +165,7 @@ func (i *IdentityStore) paths() []*framework.Path {
 		mfaDuoPaths(i),
 		mfaPingIDPaths(i),
 		mfaLoginEnforcementPaths(i),
+		mfaLoginEnterprisePaths(i),
 	)
 }
 
@@ -318,6 +335,11 @@ func mfaTOTPPaths(i *IdentityStore) []*framework.Path {
 				Default:     1,
 				Description: `The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.`,
 			},
+			"enable_self_enrollment": {
+				Type:        framework.TypeBool,
+				Default:     false,
+				Description: `If true, users are able to generate a TOTP Login MFA secret for themselves while logging in. Defaults to false.`,
+			},
 		},
 		i,
 	)
@@ -617,316 +639,471 @@ func (i *IdentityStore) Invalidate(ctx context.Context, key string) {
 	defer i.lock.Unlock()
 
 	switch {
-	// Check if the key is a storage entry key for an entity bucket
 	case strings.HasPrefix(key, storagepacker.StoragePackerBucketsPrefix):
-		// Create a MemDB transaction
-		txn := i.db.Txn(true)
-		defer txn.Abort()
-
-		// Each entity object in MemDB holds the MD5 hash of the storage
-		// entry key of the entity bucket. Fetch all the entities that
-		// belong to this bucket using the hash value. Remove these entities
-		// from MemDB along with all the aliases of each entity.
-		entitiesFetched, err := i.MemDBEntitiesByBucketKeyInTxn(txn, key)
-		if err != nil {
-			i.logger.Error("failed to fetch entities using the bucket key", "key", key)
-			return
-		}
+		// key is for a entity bucket in storage.
+		i.invalidateEntityBucket(ctx, key)
+	case strings.HasPrefix(key, groupBucketsPrefix):
+		// key is for a group bucket in storage.
+		i.invalidateGroupBucket(ctx, key)
+	case strings.HasPrefix(key, oidcTokensPrefix):
+		// key is for oidc tokens in storage.
+		i.invalidateOIDCToken(ctx)
+	case strings.HasPrefix(key, clientPath):
+		// key is for a client in storage.
+		i.invalidateClientPath(ctx, key)
+	case strings.HasPrefix(key, localAliasesBucketsPrefix):
+		// key is for a local alias bucket in storage.
+		i.invalidateLocalAliasesBucket(ctx, key)
+	}
+}
+
+func (i *IdentityStore) invalidateEntityBucket(ctx context.Context, key string) {
+	txn := i.db.Txn(true)
+	defer txn.Abort()
+
+	// The handling of entities has the added quirk of dealing with a temporary
+	// copy of the entity written in storage on the active node of performance
+	// secondary clusters. These temporary entity entries in storage must be
+	// removed once the actual entity appears in the storage bucket (as
+	// replicated from the primary cluster).
+	//
+	// This function retrieves all entities from MemDB that have a corresponding
+	// storage key that matches the provided key to invalidate. This is the set
+	// of entities that need to be updated, removed, or left alone in MemDB.
+	//
+	// The logic iterates over every entity stored in the invalidated storage
+	// bucket. For each entity read from the storage bucket, the set of entities
+	// read from MemDB is searched for the same entity. If it can't be found,
+	// it means that it needs to be inserted into MemDB. On the other hand, if
+	// the entity is found, it the storage bucket entity is compared to the
+	// MemDB entity. If they do not match, then the storage entity state needs
+	// to be used to update the MemDB entity; if they did match, then it means
+	// that the MemDB entity can be left alone. As each MemDB entity is
+	// processed in the loop, it is removed from the set of MemDB entities.
+	//
+	// Once all entities from the storage bucket have been compared to those
+	// retrieved from MemDB, the remaining entities from the set retrieved from
+	// MemDB are those that have been deleted from storage and must be removed
+	// from MemDB (because as MemDB entities that matches a storage bucket
+	// entity were processed, they were removed from the set).
+	memDBEntities, err := i.MemDBEntitiesByBucketKeyInTxn(txn, key)
+	if err != nil {
+		i.logger.Error("failed to fetch entities using the bucket key", "key", key)
+		return
+	}
+
+	bucket, err := i.entityPacker.GetBucket(ctx, key)
+	if err != nil {
+		i.logger.Error("failed to refresh entities", "key", key, "error", err)
+		return
+	}
 
-		for _, entity := range entitiesFetched {
-			// Delete all the aliases in the entity. This function will also remove
-			// the corresponding alias indexes too.
-			err = i.deleteAliasesInEntityInTxn(txn, entity, entity.Aliases)
+	if bucket != nil {
+		// The storage entry for the entity bucket exists, so we need to compare
+		// the entities in that bucket with those in MemDB and only update those
+		// that are different. The entities in the bucket storage entry are the
+		// source of truth.
+
+		// Iterate over each entity item from the bucket
+		for _, item := range bucket.Items {
+			bucketEntity, err := i.parseEntityFromBucketItem(ctx, item)
 			if err != nil {
-				i.logger.Error("failed to delete aliases in entity", "entity_id", entity.ID, "error", err)
+				i.logger.Error("failed to parse entity from bucket entry item", "error", err)
 				return
 			}
 
-			// Delete the entity using the same transaction
-			err = i.MemDBDeleteEntityByIDInTxn(txn, entity.ID)
+			localAliases, err := i.parseLocalAliases(bucketEntity.ID)
 			if err != nil {
-				i.logger.Error("failed to delete entity from MemDB", "entity_id", entity.ID, "error", err)
+				i.logger.Error("failed to load local aliases from storage", "error", err)
 				return
 			}
-		}
-
-		// Get the storage bucket entry
-		bucket, err := i.entityPacker.GetBucket(ctx, key)
-		if err != nil {
-			i.logger.Error("failed to refresh entities", "key", key, "error", err)
-			return
-		}
 
-		// If the underlying entry is nil, it means that this invalidation
-		// notification is for the deletion of the underlying storage entry. At
-		// this point, since all the entities belonging to this bucket are
-		// already removed, there is nothing else to be done. But, if the
-		// storage entry is non-nil, its an indication of an update. In this
-		// case, entities in the updated bucket needs to be reinserted into
-		// MemDB.
-		var entityIDs []string
-		if bucket != nil {
-			entityIDs = make([]string, 0, len(bucket.Items))
-			for _, item := range bucket.Items {
-				entity, err := i.parseEntityFromBucketItem(ctx, item)
-				if err != nil {
-					i.logger.Error("failed to parse entity from bucket entry item", "error", err)
-					return
-				}
-
-				localAliases, err := i.parseLocalAliases(entity.ID)
-				if err != nil {
-					i.logger.Error("failed to load local aliases from storage", "error", err)
-					return
-				}
-				if localAliases != nil {
-					for _, alias := range localAliases.Aliases {
-						entity.UpsertAlias(alias)
-					}
+			if localAliases != nil {
+				for _, alias := range localAliases.Aliases {
+					bucketEntity.UpsertAlias(alias)
 				}
+			}
 
-				// Only update MemDB and don't touch the storage
-				err = i.upsertEntityInTxn(ctx, txn, entity, nil, false)
-				if err != nil {
-					i.logger.Error("failed to update entity in MemDB", "error", err)
-					return
-				}
+			var memDBEntity *identity.Entity
+			for i, entity := range memDBEntities {
+				if entity.ID == bucketEntity.ID {
+					memDBEntity = entity
 
-				// If we are a secondary, the entity created by the secondary
-				// via the CreateEntity RPC would have been cached. Now that the
-				// invalidation of the same has hit, there is no need of the
-				// cache. Clearing the cache. Writing to storage can't be
-				// performed by perf standbys. So only doing this in the active
-				// node of the secondary.
-				if i.localNode.ReplicationState().HasState(consts.ReplicationPerformanceSecondary) && i.localNode.HAState() != consts.PerfStandby {
-					if err := i.localAliasPacker.DeleteItem(ctx, entity.ID+tmpSuffix); err != nil {
-						i.logger.Error("failed to clear local alias entity cache", "error", err, "entity_id", entity.ID)
-						return
-					}
+					// Remove this processed entity from the slice, so that
+					// all tht will be left are unprocessed entities.
+					copy(memDBEntities[i:], memDBEntities[i+1:])
+					memDBEntities = memDBEntities[:len(memDBEntities)-1]
+					break
 				}
-
-				entityIDs = append(entityIDs, entity.ID)
 			}
-		}
 
-		// entitiesFetched are the entities before invalidation. entityIDs
-		// represent entities that are valid after invalidation. Clear the
-		// storage entries of local aliases for those entities that are
-		// indicated deleted by this invalidation.
-		if i.localNode.ReplicationState().HasState(consts.ReplicationPerformanceSecondary) && i.localNode.HAState() != consts.PerfStandby {
-			for _, entity := range entitiesFetched {
-				if !strutil.StrListContains(entityIDs, entity.ID) {
-					if err := i.localAliasPacker.DeleteItem(ctx, entity.ID); err != nil {
-						i.logger.Error("failed to clear local alias for entity", "error", err, "entity_id", entity.ID)
-						return
-					}
-				}
+			// We've considered the use of github.com/google/go-cmp here,
+			// but opted for sticking with reflect.DeepEqual because go-cmp
+			// is intended for testing and is able to panic in some
+			// situations.
+			if memDBEntity != nil && reflect.DeepEqual(memDBEntity, bucketEntity) {
+				// No changes on this entity, move on to the next one.
+				continue
 			}
-		}
 
-		txn.Commit()
-		return
-
-	// Check if the key is a storage entry key for an group bucket
-	// For those entities that are deleted, clear up the local alias entries
-	case strings.HasPrefix(key, groupBucketsPrefix):
-		// Create a MemDB transaction
-		txn := i.db.Txn(true)
-		defer txn.Abort()
+			// If the entity exists in MemDB it must differ from the entity in
+			// the storage bucket because of above test. Blindly delete the
+			// current aliases associated with the MemDB entity. The correct set
+			// of aliases will be created in MemDB by the upsertEntityInTxn
+			// function. We need to do this because the upsertEntityInTxn
+			// function does not delete those aliases, it only creates missing
+			// ones.
+			if memDBEntity != nil {
+				if err := i.deleteAliasesInEntityInTxn(txn, memDBEntity, memDBEntity.Aliases); err != nil {
+					i.logger.Error("failed to remove entity aliases from changed entity", "entity_id", memDBEntity.ID, "error", err)
+					return
+				}
 
-		groupsFetched, err := i.MemDBGroupsByBucketKeyInTxn(txn, key)
-		if err != nil {
-			i.logger.Error("failed to fetch groups using the bucket key", "key", key)
-			return
-		}
+				if err := i.MemDBDeleteEntityByIDInTxn(txn, memDBEntity.ID); err != nil {
+					i.logger.Error("failed to delete changed entity", "entity_id", memDBEntity.ID, "error", err)
+					return
+				}
+			}
 
-		for _, group := range groupsFetched {
-			// Delete the group using the same transaction
-			err = i.MemDBDeleteGroupByIDInTxn(txn, group.ID)
+			_, err = i.upsertEntityInTxn(ctx, txn, bucketEntity, nil, false, false)
 			if err != nil {
-				i.logger.Error("failed to delete group from MemDB", "group_id", group.ID, "error", err)
+				i.logger.Error("failed to update entity in MemDB", "entity_id", bucketEntity.ID, "error", err)
 				return
 			}
 
-			if group.Alias != nil {
-				err := i.MemDBDeleteAliasByIDInTxn(txn, group.Alias.ID, true)
-				if err != nil {
-					i.logger.Error("failed to delete group alias from MemDB", "error", err)
+			// If this is a performance secondary, the entity created on
+			// this node would have been cached in a local cache based on
+			// the result of the CreateEntity RPC call to the primary
+			// cluster. Since this invalidation is signaling that the
+			// entity is now in the primary cluster's storage, the locally
+			// cached entry can be removed.
+			if i.localNode.ReplicationState().HasState(consts.ReplicationPerformanceSecondary) && i.localNode.HAState() == consts.Active {
+				if err := i.localAliasPacker.DeleteItem(ctx, bucketEntity.ID+tmpSuffix); err != nil {
+					i.logger.Error("failed to clear local alias entity cache", "error", err, "entity_id", bucketEntity.ID)
 					return
 				}
 			}
+
 		}
+	}
 
-		// Get the storage bucket entry
-		bucket, err := i.groupPacker.GetBucket(ctx, key)
+	// Any entities that are still in the memDBEntities slice are ones that do
+	// not exist in the bucket storage entry. These entities have to be removed
+	// from MemDB.
+	for _, memDBEntity := range memDBEntities {
+		err = i.deleteAliasesInEntityInTxn(txn, memDBEntity, memDBEntity.Aliases)
 		if err != nil {
-			i.logger.Error("failed to refresh group", "key", key, "error", err)
+			i.logger.Error("failed to delete aliases in entity", "entity_id", memDBEntity.ID, "error", err)
 			return
 		}
 
-		if bucket != nil {
-			for _, item := range bucket.Items {
-				group, err := i.parseGroupFromBucketItem(item)
-				if err != nil {
-					i.logger.Error("failed to parse group from bucket entry item", "error", err)
-					return
-				}
-
-				// Before updating the group, check if the group exists. If it
-				// does, then delete the group alias from memdb, for the
-				// invalidation would have sent an update.
-				groupFetched, err := i.MemDBGroupByIDInTxn(txn, group.ID, true)
-				if err != nil {
-					i.logger.Error("failed to fetch group from MemDB", "error", err)
-					return
-				}
-
-				// If the group has an alias remove it from memdb
-				if groupFetched != nil && groupFetched.Alias != nil {
-					err := i.MemDBDeleteAliasByIDInTxn(txn, groupFetched.Alias.ID, true)
-					if err != nil {
-						i.logger.Error("failed to delete old group alias from MemDB", "error", err)
-						return
-					}
-				}
+		err = i.MemDBDeleteEntityByIDInTxn(txn, memDBEntity.ID)
+		if err != nil {
+			i.logger.Error("failed to delete entity from MemDB", "entity_id", memDBEntity.ID, "error", err)
+			return
+		}
 
-				// Only update MemDB and don't touch the storage
-				err = i.UpsertGroupInTxn(ctx, txn, group, false)
-				if err != nil {
-					i.logger.Error("failed to update group in MemDB", "error", err)
-					return
-				}
+		// In addition, if this is an active node of a performance secondary
+		// cluster, remove the local alias storage entry for this deleted entity.
+		if i.localNode.ReplicationState().HasState(consts.ReplicationPerformanceSecondary) && i.localNode.HAState() == consts.Active {
+			if err := i.localAliasPacker.DeleteItem(ctx, memDBEntity.ID); err != nil {
+				i.logger.Error("failed to clear local alias for entity", "error", err, "entity_id", memDBEntity.ID)
+				return
 			}
 		}
+	}
+
+	txn.Commit()
+}
+
+func (i *IdentityStore) invalidateGroupBucket(ctx context.Context, key string) {
+	// Create a MemDB transaction
+	txn := i.db.Txn(true)
+	defer txn.Abort()
 
-		txn.Commit()
+	groupsFetched, err := i.MemDBGroupsByBucketKeyInTxn(txn, key)
+	if err != nil {
+		i.logger.Error("failed to fetch groups using the bucket key", "key", key)
 		return
+	}
 
-	case strings.HasPrefix(key, oidcTokensPrefix):
-		ns, err := namespace.FromContext(ctx)
+	for _, group := range groupsFetched {
+		// Delete the group using the same transaction
+		err = i.MemDBDeleteGroupByIDInTxn(txn, group.ID)
 		if err != nil {
-			i.logger.Error("error retrieving namespace", "error", err)
+			i.logger.Error("failed to delete group from MemDB", "group_id", group.ID, "error", err)
 			return
 		}
 
-		// Wipe the cache for the requested namespace. This will also clear
-		// the shared namespace as well.
-		if err := i.oidcCache.Flush(ns); err != nil {
-			i.logger.Error("error flushing oidc cache", "error", err)
+		if group.Alias != nil {
+			err := i.MemDBDeleteAliasByIDInTxn(txn, group.Alias.ID, true)
+			if err != nil {
+				i.logger.Error("failed to delete group alias from MemDB", "error", err)
+				return
+			}
 		}
-	case strings.HasPrefix(key, clientPath):
-		name := strings.TrimPrefix(key, clientPath)
+	}
 
-		// Invalidate the cached client in memdb
-		if err := i.memDBDeleteClientByName(ctx, name); err != nil {
-			i.logger.Error("error invalidating client", "error", err, "key", key)
-			return
-		}
-	case strings.HasPrefix(key, localAliasesBucketsPrefix):
-		//
-		// This invalidation only happens on perf standbys
-		//
-
-		txn := i.db.Txn(true)
-		defer txn.Abort()
-
-		// Find all the local aliases belonging to this bucket and remove it
-		// both from aliases table and entities table. We will add the local
-		// aliases back by parsing the storage key. This way the deletion
-		// invalidation gets handled.
-		aliases, err := i.MemDBLocalAliasesByBucketKeyInTxn(txn, key)
-		if err != nil {
-			i.logger.Error("failed to fetch entities using the bucket key", "key", key)
-			return
-		}
+	// Get the storage bucket entry
+	bucket, err := i.groupPacker.GetBucket(ctx, key)
+	if err != nil {
+		i.logger.Error("failed to refresh group", "key", key, "error", err)
+		return
+	}
 
-		for _, alias := range aliases {
-			entity, err := i.MemDBEntityByIDInTxn(txn, alias.CanonicalID, true)
+	if bucket != nil {
+		for _, item := range bucket.Items {
+			group, err := i.parseGroupFromBucketItem(item)
 			if err != nil {
-				i.logger.Error("failed to fetch entity during local alias invalidation", "entity_id", alias.CanonicalID, "error", err)
+				i.logger.Error("failed to parse group from bucket entry item", "error", err)
 				return
 			}
-			if entity == nil {
-				i.logger.Error("failed to fetch entity during local alias invalidation, missing entity", "entity_id", alias.CanonicalID, "error", err)
-				continue
-			}
 
-			// Delete local aliases from the entity.
-			err = i.deleteAliasesInEntityInTxn(txn, entity, []*identity.Alias{alias})
+			// Before updating the group, check if the group exists. If it
+			// does, then delete the group alias from memdb, for the
+			// invalidation would have sent an update.
+			groupFetched, err := i.MemDBGroupByIDInTxn(txn, group.ID, true)
 			if err != nil {
-				i.logger.Error("failed to delete aliases in entity", "entity_id", entity.ID, "error", err)
+				i.logger.Error("failed to fetch group from MemDB", "error", err)
 				return
 			}
 
-			// Update the entity with removed alias.
-			if err := i.MemDBUpsertEntityInTxn(txn, entity); err != nil {
-				i.logger.Error("failed to delete entity from MemDB", "entity_id", entity.ID, "error", err)
+			// If the group has an alias remove it from memdb
+			if groupFetched != nil && groupFetched.Alias != nil {
+				err := i.MemDBDeleteAliasByIDInTxn(txn, groupFetched.Alias.ID, true)
+				if err != nil {
+					i.logger.Error("failed to delete old group alias from MemDB", "error", err)
+					return
+				}
+			}
+
+			// Only update MemDB and don't touch the storage
+			err = i.UpsertGroupInTxn(ctx, txn, group, false)
+			if err != nil {
+				i.logger.Error("failed to update group in MemDB", "error", err)
 				return
 			}
 		}
+	}
 
-		// Now read the invalidated storage key
-		bucket, err := i.localAliasPacker.GetBucket(ctx, key)
-		if err != nil {
-			i.logger.Error("failed to refresh local aliases", "key", key, "error", err)
-			return
-		}
-		if bucket != nil {
-			for _, item := range bucket.Items {
-				if strings.HasSuffix(item.ID, tmpSuffix) {
-					continue
-				}
+	txn.Commit()
+}
 
-				var localAliases identity.LocalAliases
-				err = ptypes.UnmarshalAny(item.Message, &localAliases)
-				if err != nil {
-					i.logger.Error("failed to parse local aliases during invalidation", "error", err)
+// invalidateOIDCToken is called by the Invalidate function to handle the
+// invalidation of an OIDC token storage entry.
+func (i *IdentityStore) invalidateOIDCToken(ctx context.Context) {
+	ns, err := namespace.FromContext(ctx)
+	if err != nil {
+		i.logger.Error("error retrieving namespace", "error", err)
+		return
+	}
+
+	// Wipe the cache for the requested namespace
+	if err := i.oidcCache.Flush(ns); err != nil {
+		i.logger.Error("error flushing oidc cache", "error", err)
+		return
+	}
+}
+
+// invalidateClientPath is called by the Invalidate function to handle the
+// invalidation of a client path storage entry.
+func (i *IdentityStore) invalidateClientPath(ctx context.Context, key string) {
+	name := strings.TrimPrefix(key, clientPath)
+
+	// Invalidate the cached client in memdb
+	if err := i.memDBDeleteClientByName(ctx, name); err != nil {
+		i.logger.Error("error invalidating client", "error", err, "key", key)
+		return
+	}
+}
+
+// invalidateLocalAliasBucket is called by the Invalidate function to handle the
+// invalidation of a local alias bucket storage entry.
+func (i *IdentityStore) invalidateLocalAliasesBucket(ctx context.Context, key string) {
+	// This invalidation only happens on performance standby servers
+
+	// Create a MemDB transaction and abort it once this function returns
+	txn := i.db.Txn(true)
+	defer txn.Abort()
+
+	// Local aliases have the added complexity of being associated with
+	// entities. Whenever a local alias is updated or inserted into MemDB, its
+	// associated MemDB-stored entity must also be updated.
+	//
+	// This function retrieves all local aliases that have a corresponding
+	// storage key that matches the provided key to invalidate. This is the
+	// set of local aliases that need to be updated, removed, or left
+	// alone in MemDB. Each of these operations is done as its own MemDB
+	// operation, but the corresponding changes that need to be made to the
+	// associated entities can be batched together to cut down on the number of
+	// MemDB operations.
+	//
+	// The logic iterates over every local alias stored at the invalidated key.
+	// For each local alias read from the storage entry, the set of local
+	// aliases read from MemDB is searched for the same local alias. If it can't
+	// be found, it means that it needs to be inserted into MemDB. However, if
+	// it's found, it must be compared with the local alias from the storage. If
+	// they don't match, it means that the local alias in MemDB needs to be
+	// updated. If they did match, it means that this particular local alias did
+	// not change in storage, so nothing further needs to be done. Each local
+	// alias processed in this loop is removed from the set of retrieved local
+	// aliases. The local alias is also added to the map tracking local aliases
+	// that need to be upserted in their associated entities in MemDB.
+	//
+	// Once the code is done iterating over all of the local aliases from
+	// storage, any local aliases still in the set retrieved from MemDB
+	// corresponds to a local alias that is no longer in storage and must be
+	// removed from MemDB. These local aliases are added to the map tracking
+	// local aliases to remove from their entities in MemDB. The actual removal
+	// of the local aliases themselves is done as part of the tidying up of the
+	// associated entities, described below.
+	//
+	// In order to batch the changes to the associated entities, a map of entity
+	// to local aliases (slice of local alias) is built up in the loop that
+	// iterates over the local aliases from storage. Similarly, the code that
+	// detects which local aliases to remove from MemDB also builds a separate
+	// map of entity to local aliases (slice of local alias). Each element in
+	// the map of local aliases to update in their entity is processed as
+	// follows: the mapped slice of local aliases is iterated over and each
+	// local alias is upserted into the entity and then the entity itself is
+	// upserted. Then, each element in the map of local aliases to remove from
+	// their entity is processed as follows: the
+
+	// Get all cached local aliases to compare with invalidated bucket
+	memDBLocalAliases, err := i.MemDBLocalAliasesByBucketKeyInTxn(txn, key)
+	if err != nil {
+		i.logger.Error("failed to fetch local aliases using the bucket key", "key", key, "error", err)
+		return
+	}
+
+	// Get local aliases from the invalidated bucket
+	bucket, err := i.localAliasPacker.GetBucket(ctx, key)
+	if err != nil {
+		i.logger.Error("failed to refresh local aliases", "key", key, "error", err)
+		return
+	}
+
+	// This map tracks the set of local aliases that need to be updated in each
+	// affected entity in MemDB.
+	entityLocalAliasesToUpsert := map[*identity.Entity][]*identity.Alias{}
+
+	// This map tracks the set of local aliases that need to be removed from
+	// their affected entity in MemDB, as well as removing the local alias
+	// themselves.
+	entityLocalAliasesToRemove := map[*identity.Entity][]*identity.Alias{}
+
+	if bucket != nil {
+		// The storage entry for the local alias bucket exists, so we need to
+		// compare the local aliases in that bucket with those in MemDB and only
+		// update those that are different. The local aliases in the bucket are
+		// the source of truth.
+
+		// Iterate over each local alias item from the bucket
+		for _, item := range bucket.Items {
+			if strings.HasSuffix(item.ID, tmpSuffix) {
+				continue
+			}
+
+			var bucketLocalAliases identity.LocalAliases
+
+			err = anypb.UnmarshalTo(item.Message, &bucketLocalAliases, proto.UnmarshalOptions{})
+			if err != nil {
+				i.logger.Error("failed to parse local aliases during invalidation", "item_id", item.ID, "error", err)
+				return
+			}
+
+			for _, bucketLocalAlias := range bucketLocalAliases.Aliases {
+				// Find the entity related to bucketLocalAlias in MemDB in order
+				// to track any local aliases modifications that must be made in
+				// this entity.
+				memDBEntity := i.FetchEntityForLocalAliasInTxn(txn, bucketLocalAlias)
+				if memDBEntity == nil {
+					// FetchEntityForLocalAliasInTxn already logs any error
 					return
 				}
-				for _, alias := range localAliases.Aliases {
-					// Add to the aliases table
-					if err := i.MemDBUpsertAliasInTxn(txn, alias, false); err != nil {
-						i.logger.Error("failed to insert local alias to memdb during invalidation", "error", err)
-						return
+
+				// memDBLocalAlias starts off nil but gets set to the local
+				// alias from memDBLocalAliases whose ID matches the ID of
+				// bucketLocalAlias.
+				var memDBLocalAlias *identity.Alias
+				for i, localAlias := range memDBLocalAliases {
+					if localAlias.ID == bucketLocalAlias.ID {
+						memDBLocalAlias = localAlias
+
+						// Remove this processed local alias from the
+						// memDBLocalAliases slice, so that all that
+						// will be left are unprocessed local aliases.
+						copy(memDBLocalAliases[i:], memDBLocalAliases[i+1:])
+						memDBLocalAliases = memDBLocalAliases[:len(memDBLocalAliases)-1]
+
+						break
 					}
+				}
 
-					// Fetch the associated entity and add the alias to that too.
-					entity, err := i.MemDBEntityByIDInTxn(txn, alias.CanonicalID, false)
+				// We've considered the use of github.com/google/go-cmp here,
+				// but opted for sticking with reflect.DeepEqual because go-cmp
+				// is intended for testing and is able to panic in some
+				// situations.
+				if memDBLocalAlias == nil || !reflect.DeepEqual(memDBLocalAlias, bucketLocalAlias) {
+					// The bucketLocalAlias is not in MemDB or it has changed in
+					// storage.
+					err = i.MemDBUpsertAliasInTxn(txn, bucketLocalAlias, false)
 					if err != nil {
-						i.logger.Error("failed to fetch entity during local alias invalidation", "error", err)
-						return
-					}
-					if entity == nil {
-						cachedEntityItem, err := i.localAliasPacker.GetItem(alias.CanonicalID + tmpSuffix)
-						if err != nil {
-							i.logger.Error("failed to fetch cached entity", "key", key, "error", err)
-							return
-						}
-						if cachedEntityItem != nil {
-							entity, err = i.parseCachedEntity(cachedEntityItem)
-							if err != nil {
-								i.logger.Error("failed to parse cached entity", "key", key, "error", err)
-								return
-							}
-						}
-					}
-					if entity == nil {
-						i.logger.Error("received local alias invalidation for an invalid entity", "item.ID", item.ID)
+						i.logger.Error("failed to update local alias in MemDB", "alias_id", bucketLocalAlias.ID, "error", err)
 						return
 					}
-					entity.UpsertAlias(alias)
 
-					// Update the entities table
-					if err := i.MemDBUpsertEntityInTxn(txn, entity); err != nil {
-						i.logger.Error("failed to upsert entity during local alias invalidation", "error", err)
-						return
-					}
+					// Add this local alias to the set of local aliases that
+					// need to be updated for memDBEntity.
+					entityLocalAliasesToUpsert[memDBEntity] = append(entityLocalAliasesToUpsert[memDBEntity], bucketLocalAlias)
 				}
 			}
 		}
-		txn.Commit()
-		return
 	}
+
+	// Any local aliases still remaining in memDBLocalAliases do not exist in
+	// storage and should be removed from MemDB.
+	for _, memDBLocalAlias := range memDBLocalAliases {
+		memDBEntity := i.FetchEntityForLocalAliasInTxn(txn, memDBLocalAlias)
+		if memDBEntity == nil {
+			// FetchEntityForLocalAliasInTxn already logs any error
+			return
+		}
+
+		entityLocalAliasesToRemove[memDBEntity] = append(entityLocalAliasesToRemove[memDBEntity], memDBLocalAlias)
+	}
+
+	// Now process the entityLocalAliasesToUpsert map.
+	for entity, localAliases := range entityLocalAliasesToUpsert {
+		for _, localAlias := range localAliases {
+			entity.UpsertAlias(localAlias)
+		}
+
+		err = i.MemDBUpsertEntityInTxn(txn, entity)
+		if err != nil {
+			i.logger.Error("failed to update entity in MemDB", "entity_id", entity.ID, "error", err)
+			return
+		}
+	}
+
+	// Finally process the entityLocalAliasesToRemove map.
+	for entity, localAliases := range entityLocalAliasesToRemove {
+		// The deleteAliasesInEntityInTxn removes the provided aliases from
+		// the entity, but it also removes the aliases themselves from MemDB.
+		err := i.deleteAliasesInEntityInTxn(txn, entity, localAliases)
+		if err != nil {
+			i.logger.Error("failed to delete aliases in entity", "entity_id", entity.ID, "error", err)
+			return
+		}
+
+		err = i.MemDBUpsertEntityInTxn(txn, entity)
+		if err != nil {
+			i.logger.Error("failed to update entity in MemDB", "entity_id", entity.ID, "error", err)
+			return
+		}
+	}
+
+	txn.Commit()
 }
 
 func (i *IdentityStore) parseLocalAliases(entityID string) (*identity.LocalAliases, error) {
@@ -1008,7 +1185,7 @@ func (i *IdentityStore) parseEntityFromBucketItem(ctx context.Context, item *sto
 	}
 
 	if persistNeeded && !i.localNode.ReplicationState().HasState(consts.ReplicationPerformanceSecondary) {
-		entityAsAny, err := ptypes.MarshalAny(&entity)
+		entityAsAny, err := anypb.New(&entity)
 		if err != nil {
 			return nil, err
 		}
@@ -1197,7 +1374,7 @@ func (i *IdentityStore) CreateOrFetchEntity(ctx context.Context, alias *logical.
 		}
 		a := entity.Aliases[idx]
 		a.Metadata = alias.Metadata
-		a.LastUpdateTime = ptypes.TimestampNow()
+		a.LastUpdateTime = timestamppb.Now()
 
 		update = true
 	}
@@ -1211,13 +1388,14 @@ func (i *IdentityStore) CreateOrFetchEntity(ctx context.Context, alias *logical.
 
 		// Create a new alias
 		newAlias := &identity.Alias{
-			CanonicalID:   entity.ID,
-			Name:          alias.Name,
-			MountAccessor: alias.MountAccessor,
-			Metadata:      alias.Metadata,
-			MountPath:     mountValidationResp.MountPath,
-			MountType:     mountValidationResp.MountType,
-			Local:         alias.Local,
+			CanonicalID:    entity.ID,
+			Name:           alias.Name,
+			MountAccessor:  alias.MountAccessor,
+			Metadata:       alias.Metadata,
+			MountPath:      mountValidationResp.MountPath,
+			MountType:      mountValidationResp.MountType,
+			Local:          alias.Local,
+			CustomMetadata: alias.CustomMetadata,
 		}
 
 		err = i.sanitizeAlias(ctx, newAlias)
@@ -1252,7 +1430,7 @@ func (i *IdentityStore) CreateOrFetchEntity(ctx context.Context, alias *logical.
 	}
 
 	// Update MemDB and persist entity object
-	err = i.upsertEntityInTxn(ctx, txn, entity, nil, true)
+	_, err = i.upsertEntityInTxn(ctx, txn, entity, nil, true, false)
 	if err != nil {
 		return entity, entityCreated, err
 	}
diff --git a/vault/identity_store_aliases.go b/vault/identity_store_aliases.go
index 7b9d26e283e..c668885370c 100644
--- a/vault/identity_store_aliases.go
+++ b/vault/identity_store_aliases.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -16,6 +16,8 @@ import (
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/custommetadata"
 	"github.com/hashicorp/vault/sdk/logical"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 // aliasPaths returns the API endpoints to operate on aliases.
@@ -245,7 +247,7 @@ func (i *IdentityStore) handleAliasCreateUpdate() framework.OperationFunc {
 		if mountEntry.NamespaceID != ns.ID {
 			return logical.ErrorResponse("matching mount is in a different namespace than request"), logical.ErrPermissionDenied
 		}
-		alias, err := i.MemDBAliasByFactors(mountAccessor, name, false, false)
+		alias, err := i.MemDBAliasByFactors(mountAccessor, name, true, false)
 		if err != nil {
 			return nil, err
 		}
@@ -356,7 +358,7 @@ func (i *IdentityStore) handleAliasUpdate(ctx context.Context, canonicalID, name
 		return nil, nil
 	}
 
-	alias.LastUpdateTime = ptypes.TimestampNow()
+	alias.LastUpdateTime = timestamppb.Now()
 
 	// Get our current entity, which may be the same as the new one if the
 	// canonical ID hasn't changed
@@ -635,7 +637,7 @@ func (i *IdentityStore) pathAliasIDDelete() framework.OperationFunc {
 				}
 			}
 
-			marshaledAliases, err := ptypes.MarshalAny(localAliases)
+			marshaledAliases, err := anypb.New(localAliases)
 			if err != nil {
 				return nil, err
 			}
diff --git a/vault/identity_store_aliases_test.go b/vault/identity_store_aliases_test.go
index bf54c2db4a1..d659873ecdb 100644
--- a/vault/identity_store_aliases_test.go
+++ b/vault/identity_store_aliases_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/identity_store_conflicts.go b/vault/identity_store_conflicts.go
new file mode 100644
index 00000000000..830b7e5b04f
--- /dev/null
+++ b/vault/identity_store_conflicts.go
@@ -0,0 +1,444 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package vault
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/hashicorp/go-hclog"
+	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/helper/identity"
+)
+
+var errDuplicateIdentityName = errors.New("duplicate identity name")
+
+// ConflictResolver defines the interface for resolving conflicts between
+// entities, groups, and aliases. All methods should implement a check for
+// existing=nil. This is an intentional design choice to allow the caller to
+// search for extra information if necessary. Resolvers may not modify existing.
+// If they choose to modify duplicate the modified version will be inserted into
+// MemDB but they must return true in this case to all the calling code to take
+// appropriate actions like persisting the change.
+type ConflictResolver interface {
+	ResolveEntities(ctx context.Context, existing, duplicate *identity.Entity) (bool, error)
+	ResolveGroups(ctx context.Context, existing, duplicate *identity.Group) (bool, error)
+	ResolveAliases(ctx context.Context, parent *identity.Entity, existing, duplicate *identity.Alias) (bool, error)
+	Reload(ctx context.Context)
+}
+
+// errorResolver is a ConflictResolver that logs a warning message when a
+// pre-existing Identity artifact is found with the same factors as a new one.
+type errorResolver struct {
+	logger log.Logger
+}
+
+// ResolveEntities logs a warning message when a pre-existing Entity is found
+// and returns a duplicate name error, which should be handled by the caller by
+// putting the system in case-sensitive mode.
+func (r *errorResolver) ResolveEntities(ctx context.Context, existing, duplicate *identity.Entity) (bool, error) {
+	if existing == nil {
+		return false, nil
+	}
+
+	r.logger.Warn(errDuplicateIdentityName.Error(),
+		"entity_name", duplicate.Name,
+		"duplicate_of_name", existing.Name,
+		"duplicate_of_id", existing.ID,
+		"action", "merge the duplicate entities into one")
+
+	return false, errDuplicateIdentityName
+}
+
+// ResolveGroups logs a warning message when a pre-existing Group is found and
+// returns a duplicate name error, which should be handled by the caller by
+// putting the system in case-sensitive mode.
+func (r *errorResolver) ResolveGroups(ctx context.Context, existing, duplicate *identity.Group) (bool, error) {
+	if existing == nil {
+		return false, nil
+	}
+
+	r.logger.Warn(errDuplicateIdentityName.Error(),
+		"group_name", duplicate.Name,
+		"duplicate_of_name", existing.Name,
+		"duplicate_of_id", existing.ID,
+		"action", "merge the contents of duplicated groups into one and delete the other")
+
+	return false, errDuplicateIdentityName
+}
+
+// ResolveAliases logs a warning message when a pre-existing Alias is found and
+// returns a duplicate name error, which should be handled by the caller by
+// putting the system in case-sensitive mode.
+func (r *errorResolver) ResolveAliases(ctx context.Context, parent *identity.Entity, existing, duplicate *identity.Alias) (bool, error) {
+	if existing == nil {
+		return false, nil
+	}
+
+	r.logger.Warn(errDuplicateIdentityName.Error(),
+		"alias_name", duplicate.Name,
+		"mount_accessor", duplicate.MountAccessor,
+		"local", duplicate.Local,
+		"entity_name", parent.Name,
+		"alias_canonical_id", duplicate.CanonicalID,
+		"duplicate_of_name", existing.Name,
+		"duplicate_of_canonical_id", existing.CanonicalID,
+		"action", "merge the canonical entity IDs into one")
+
+	return false, errDuplicateIdentityName
+}
+
+// Reload is a no-op for the errorResolver implementation.
+func (r *errorResolver) Reload(ctx context.Context) {
+}
+
+// duplicateReportingErrorResolver collects duplicate information and optionally
+// logs a report on all the duplicates. We don't embed an errorResolver here
+// because we _don't_ want it's side effect of warning on just some duplicates
+// as we go as that's confusing when we have a more comprehensive report. The
+// only other behavior it has is to return a constant error which we can just do
+// ourselves.
+type duplicateReportingErrorResolver struct {
+	// seen* track the unique factors for each identity artifact, so
+	// that we can report on any duplication including different-case duplicates
+	// when in case-sensitive mode.
+	//
+	// Since this is only ever called from `load*` methods on IdentityStore during
+	// an unseal we can assume that it's all from a single goroutine and doesn't
+	// need locking.
+	seenEntities     map[string][]*identity.Entity
+	seenGroups       map[string][]*identity.Group
+	seenAliases      map[string][]*identity.Alias
+	seenLocalAliases map[string][]*identity.Alias
+	logger           hclog.Logger
+}
+
+func newDuplicateReportingErrorResolver(logger hclog.Logger) *duplicateReportingErrorResolver {
+	return &duplicateReportingErrorResolver{
+		seenEntities:     make(map[string][]*identity.Entity),
+		seenGroups:       make(map[string][]*identity.Group),
+		seenAliases:      make(map[string][]*identity.Alias),
+		seenLocalAliases: make(map[string][]*identity.Alias),
+		logger:           logger,
+	}
+}
+
+func (r *duplicateReportingErrorResolver) ResolveEntities(ctx context.Context, existing, duplicate *identity.Entity) (bool, error) {
+	entityKey := fmt.Sprintf("%s/%s", duplicate.NamespaceID, strings.ToLower(duplicate.Name))
+	r.seenEntities[entityKey] = append(r.seenEntities[entityKey], duplicate)
+	return false, errDuplicateIdentityName
+}
+
+func (r *duplicateReportingErrorResolver) ResolveGroups(ctx context.Context, existing, duplicate *identity.Group) (bool, error) {
+	groupKey := fmt.Sprintf("%s/%s", duplicate.NamespaceID, strings.ToLower(duplicate.Name))
+	r.seenGroups[groupKey] = append(r.seenGroups[groupKey], duplicate)
+	return false, errDuplicateIdentityName
+}
+
+func (r *duplicateReportingErrorResolver) ResolveAliases(ctx context.Context, parent *identity.Entity, existing, duplicate *identity.Alias) (bool, error) {
+	aliasKey := fmt.Sprintf("%s/%s", duplicate.MountAccessor, strings.ToLower(duplicate.Name))
+	if duplicate.Local {
+		r.seenLocalAliases[aliasKey] = append(r.seenLocalAliases[aliasKey], duplicate)
+	} else {
+		r.seenAliases[aliasKey] = append(r.seenAliases[aliasKey], duplicate)
+	}
+	return false, errDuplicateIdentityName
+}
+
+func (r *duplicateReportingErrorResolver) Reload(ctx context.Context) {
+	r.seenEntities = make(map[string][]*identity.Entity)
+}
+
+type identityDuplicateReportEntry struct {
+	artifactType   string
+	scope          string
+	name           string
+	id             string
+	canonicalID    string
+	resolutionHint string
+	index          int // we care about preserving load order in reporting
+	numOthers      int
+}
+
+type identityDuplicateReport struct {
+	entities                []identityDuplicateReportEntry
+	groups                  []identityDuplicateReportEntry
+	aliases                 []identityDuplicateReportEntry
+	localAliases            []identityDuplicateReportEntry
+	numEntityDuplicates     int
+	numGroupDuplicates      int
+	numAliasDuplicates      int
+	numLocalAliasDuplicates int
+}
+
+func (r *identityDuplicateReportEntry) Description() string {
+	scopeField := "namespace ID"
+	if r.artifactType == "entity-alias" || r.artifactType == "local entity-alias" {
+		scopeField = "mount accessor"
+	}
+	return fmt.Sprintf("%s %q with %s %q duplicates %d others",
+		r.artifactType, r.name, scopeField, r.scope, r.numOthers)
+}
+
+// Labels returns metadata pairs suitable for passing to a logger each slice
+// element corresponds alternately to a key and then a value.
+func (r *identityDuplicateReportEntry) Labels() []interface{} {
+	args := []interface{}{"id", r.id}
+	if r.canonicalID != "" {
+		args = append(args, "canonical_id")
+		args = append(args, r.canonicalID)
+	}
+	if r.resolutionHint != "" {
+		args = append(args, "force_deduplication")
+		args = append(args, r.resolutionHint)
+	}
+	return args
+}
+
+func (r *duplicateReportingErrorResolver) Report() identityDuplicateReport {
+	var report identityDuplicateReport
+
+	for _, entities := range r.seenEntities {
+		if len(entities) <= 1 {
+			// Fast path, skip non-duplicates
+			continue
+		}
+		report.numEntityDuplicates++
+		// We don't care if it's an exact match or not for entities since we'll
+		// rename in either case when we force a de-dupe.
+		for idx, entity := range entities {
+			r := identityDuplicateReportEntry{
+				artifactType: "entity",
+				scope:        entity.NamespaceID,
+				name:         entity.Name,
+				id:           entity.ID,
+				index:        idx,
+				numOthers:    len(entities) - 1,
+			}
+			if idx > 0 {
+				r.resolutionHint = fmt.Sprintf("would rename to %s-%s", entity.Name, entity.ID)
+			} else {
+				r.resolutionHint = "would not rename"
+			}
+			report.entities = append(report.entities, r)
+		}
+	}
+	sortReportEntries(report.entities)
+
+	for _, groups := range r.seenGroups {
+		if len(groups) <= 1 {
+			// Fast path, skip non-duplicates
+			continue
+		}
+		report.numGroupDuplicates++
+		// We don't care if it's an exact match or not for groups since we'll
+		// rename in either case when we force a de-dupe.
+		for idx, group := range groups {
+			r := identityDuplicateReportEntry{
+				artifactType: "group",
+				scope:        group.NamespaceID,
+				name:         group.Name,
+				id:           group.ID,
+				index:        idx,
+				numOthers:    len(groups) - 1,
+			}
+			if idx > 0 {
+				r.resolutionHint = fmt.Sprintf("would rename to %s-%s", group.Name, group.ID)
+			} else {
+				r.resolutionHint = "would not rename"
+			}
+			report.groups = append(report.groups, r)
+		}
+	}
+	sortReportEntries(report.groups)
+
+	reportAliases(&report, r.seenAliases, false)
+	reportAliases(&report, r.seenLocalAliases, true)
+
+	return report
+}
+
+func reportAliases(report *identityDuplicateReport, seen map[string][]*identity.Alias, local bool) {
+	artType := "entity-alias"
+	if local {
+		artType = "local entity-alias"
+	}
+	for _, aliases := range seen {
+		if len(aliases) <= 1 {
+			// Fast path, skip non-duplicates
+			continue
+		}
+		if local {
+			report.numLocalAliasDuplicates++
+		} else {
+			report.numAliasDuplicates++
+		}
+		// We can't have exact match duplicated for aliases at this point because
+		// the would have been merged during load. These are different-case
+		// duplicates that must be handled.
+		for idx, alias := range aliases {
+			r := identityDuplicateReportEntry{
+				artifactType: artType,
+				scope:        alias.MountAccessor,
+				name:         alias.Name,
+				id:           alias.ID,
+				canonicalID:  alias.CanonicalID,
+				index:        idx,
+				numOthers:    len(aliases) - 1,
+			}
+			if idx > 0 {
+				r.resolutionHint = fmt.Sprintf("would merge into entity %s", aliases[0].CanonicalID)
+			} else {
+				r.resolutionHint = "would merge others into this entity"
+			}
+			if local {
+				report.localAliases = append(report.localAliases, r)
+			} else {
+				report.aliases = append(report.aliases, r)
+			}
+		}
+	}
+	sortReportEntries(report.aliases)
+}
+
+func sortReportEntries(es []identityDuplicateReportEntry) {
+	sort.Slice(es, func(i, j int) bool {
+		a, b := es[i], es[j]
+		if a.scope != b.scope {
+			return a.scope < b.scope
+		}
+		aName, bName := strings.ToLower(a.name), strings.ToLower(b.name)
+		if aName != bName {
+			return aName < bName
+		}
+		return a.index < b.index
+	})
+}
+
+// Warner is a subset of hclog.Logger that only has the Warn method to make
+// testing simpler.
+type Warner interface {
+	Warn(msg string, args ...interface{})
+}
+
+const identityDuplicateReportUrl = "https://developer.hashicorp.com/vault/docs/upgrading/deduplication"
+
+func (r *duplicateReportingErrorResolver) LogReport(log Warner) {
+	report := r.Report()
+
+	if report.numEntityDuplicates == 0 && report.numGroupDuplicates == 0 && report.numAliasDuplicates == 0 {
+		return
+	}
+
+	log.Warn("DUPLICATES DETECTED, see following logs for details and refer to " +
+		identityDuplicateReportUrl + " for resolution.")
+
+	// Aliases first since they are most critical to resolve. Local first because
+	// all the rest can be ignored on a perf secondary.
+	if len(report.localAliases) > 0 {
+		log.Warn(fmt.Sprintf("%d different-case local entity alias duplicates found (potential security risk)", report.numLocalAliasDuplicates))
+		for _, e := range report.localAliases {
+			log.Warn(e.Description(), e.Labels()...)
+		}
+		log.Warn("end of different-case local entity-alias duplicates")
+	}
+	if len(report.aliases) > 0 {
+		log.Warn(fmt.Sprintf("%d different-case entity alias duplicates found (potential security risk)", report.numAliasDuplicates))
+		for _, e := range report.aliases {
+			log.Warn(e.Description(), e.Labels()...)
+		}
+		log.Warn("end of different-case entity-alias duplicates")
+	}
+
+	if len(report.entities) > 0 {
+		log.Warn(fmt.Sprintf("%d entity duplicates found", report.numEntityDuplicates))
+		for _, e := range report.entities {
+			log.Warn(e.Description(), e.Labels()...)
+		}
+		log.Warn("end of entity duplicates")
+	}
+
+	if len(report.groups) > 0 {
+		log.Warn(fmt.Sprintf("%d group duplicates found", report.numGroupDuplicates))
+		for _, e := range report.groups {
+			log.Warn(e.Description(), e.Labels()...)
+		}
+		log.Warn("end of group duplicates")
+	}
+	log.Warn("end of identity duplicate report, refer to " +
+		identityDuplicateReportUrl + " for resolution.")
+}
+
+// renameResolver is a ConflictResolver that appends the artifact's UUID to its
+// name to resolve potential conflicts. The renamed resource is associated with
+// the duplicated artifact by adding a `duplicate_of_canonical_id` metadata
+// field.
+type renameResolver struct {
+	logger log.Logger
+}
+
+// ResolveEntities renames an entity duplicate in a deterministic way so that
+// all entities end up addressable by a unique name still. We rename the
+// pre-existing entity such that only the last occurrence retains its unmodified
+// name. Note that this is potentially destructive but is the best option
+// available to resolve duplicates in storage caused by bugs in our validation.
+func (r *renameResolver) ResolveEntities(ctx context.Context, existing, duplicate *identity.Entity) (bool, error) {
+	if existing == nil {
+		return false, nil
+	}
+
+	duplicate.Name = duplicate.Name + "-" + duplicate.ID
+	if duplicate.Metadata == nil {
+		duplicate.Metadata = make(map[string]string)
+	}
+	duplicate.Metadata["duplicate_of_canonical_id"] = existing.ID
+
+	r.logger.Warn("renaming entity with duplicate name",
+		"namespace_id", duplicate.NamespaceID,
+		"entity_id", duplicate.ID,
+		"duplicate_of_canonical_id", existing.ID,
+		"renamed_from", existing.Name,
+		"renamed_to", duplicate.Name,
+	)
+
+	return true, nil
+}
+
+// ResolveGroups deals with group name duplicates by renaming those that
+// were "hidden" in memDB so they are queryable. It's important this is
+// deterministic so we don't end up with different group names on different
+// nodes. We use the ID to ensure the new name is unique bit also
+// deterministic. For now, don't persist this. The user can choose to
+// resolve it permanently by renaming or deleting explicitly.
+func (r *renameResolver) ResolveGroups(ctx context.Context, existing, duplicate *identity.Group) (bool, error) {
+	if existing == nil {
+		return false, nil
+	}
+
+	duplicate.Name = duplicate.Name + "-" + duplicate.ID
+	if duplicate.Metadata == nil {
+		duplicate.Metadata = make(map[string]string)
+	}
+	duplicate.Metadata["duplicate_of_canonical_id"] = existing.ID
+	r.logger.Warn("renaming group with duplicate name",
+		"namespace_id", duplicate.NamespaceID,
+		"group_id", duplicate.ID,
+		"duplicate_of_canonical_id", existing.ID,
+		"renamed_from", existing.Name,
+		"renamed_to", duplicate.Name,
+	)
+	return true, nil
+}
+
+// ResolveAliases is a no-op for the renameResolver implementation.
+func (r *renameResolver) ResolveAliases(ctx context.Context, parent *identity.Entity, existing, duplicate *identity.Alias) (bool, error) {
+	return false, nil
+}
+
+// Reload is a no-op for the renameResolver implementation.
+func (r *renameResolver) Reload(ctx context.Context) {
+}
diff --git a/vault/identity_store_conflicts_test.go b/vault/identity_store_conflicts_test.go
new file mode 100644
index 00000000000..de922b1eb2f
--- /dev/null
+++ b/vault/identity_store_conflicts_test.go
@@ -0,0 +1,259 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package vault
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+
+	log "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/helper/identity"
+	"github.com/stretchr/testify/require"
+)
+
+// TestDuplicateReportingErrorResolver tests that the reporting error resolver
+// correctly records, identifies, sorts and outputs information about duplicate
+// entities.
+func TestDuplicateReportingErrorResolver(t *testing.T) {
+	t.Parallel()
+
+	entities := [][]string{
+		// Some unduplicated entities in a different namespaces
+		{"root", "foo"},
+		{"root", "bar"},
+		{"admin", "foo"},
+		{"developers", "BAR"},
+
+		// Some exact-match duplicates in different namespaces
+		{"root", "exact-dupe-1"},
+		{"root", "exact-dupe-1"},
+		{"admin", "exact-dupe-1"},
+		{"admin", "exact-dupe-1"},
+
+		// Some different-case duplicates in different namespaces
+		{"root", "different-case-dupe-1"},
+		{"root", "DIFFERENT-CASE-DUPE-1"},
+		{"admin", "different-case-dupe-1"},
+		{"admin", "DIFFERENT-case-DUPE-1"},
+		{"admin", "different-case-DUPE-1"},
+	}
+
+	// Note that `local-` prefix here is used to define a mount as local as well
+	// as used in it's name.
+	aliases := [][]string{
+		// Unduplicated aliases on different mounts
+		{"mount1", "alias1"},
+		{"mount2", "alias1"},
+		{"mount2", "alias2"},
+		{"local-mount", "alias1"},
+
+		// We don't bother testing exact-match aliases since they will have been
+		// merged by the time they are reported)
+
+		// Different-case aliases on different mounts (some local)
+		{"mount1", "different-case-alias-1"},
+		{"mount1", "DIFFERENT-CASE-ALIAS-1"},
+		{"mount2", "different-case-alias-1"},
+		{"mount2", "DIFFERENT-CASE-ALIAS-1"},
+		{"mount2", "different-CASE-ALIAS-1"},
+		{"local-mount", "DIFFERENT-CASE-ALIAS-1"},
+		{"local-mount", "different-CASE-ALIAS-1"},
+	}
+
+	expectReport := `
+DUPLICATES DETECTED, see following logs for details and refer to https://developer.hashicorp.com/vault/docs/upgrading/deduplication for resolution.:
+1 different-case local entity alias duplicates found (potential security risk):
+local entity-alias "DIFFERENT-CASE-ALIAS-1" with mount accessor "local-mount" duplicates 1 others: id="00000000-0000-0000-0000-000000000009" canonical_id="11111111-0000-0000-0000-000000000009" force_deduplication="would merge others into this entity"
+local entity-alias "different-CASE-ALIAS-1" with mount accessor "local-mount" duplicates 1 others: id="00000000-0000-0000-0000-000000000010" canonical_id="11111111-0000-0000-0000-000000000010" force_deduplication="would merge into entity 11111111-0000-0000-0000-000000000009"
+end of different-case local entity-alias duplicates:
+2 different-case entity alias duplicates found (potential security risk):
+entity-alias "different-case-alias-1" with mount accessor "mount1" duplicates 1 others: id="00000000-0000-0000-0000-000000000004" canonical_id="11111111-0000-0000-0000-000000000004" force_deduplication="would merge others into this entity"
+entity-alias "DIFFERENT-CASE-ALIAS-1" with mount accessor "mount1" duplicates 1 others: id="00000000-0000-0000-0000-000000000005" canonical_id="11111111-0000-0000-0000-000000000005" force_deduplication="would merge into entity 11111111-0000-0000-0000-000000000004"
+entity-alias "different-case-alias-1" with mount accessor "mount2" duplicates 2 others: id="00000000-0000-0000-0000-000000000006" canonical_id="11111111-0000-0000-0000-000000000006" force_deduplication="would merge others into this entity"
+entity-alias "DIFFERENT-CASE-ALIAS-1" with mount accessor "mount2" duplicates 2 others: id="00000000-0000-0000-0000-000000000007" canonical_id="11111111-0000-0000-0000-000000000007" force_deduplication="would merge into entity 11111111-0000-0000-0000-000000000006"
+entity-alias "different-CASE-ALIAS-1" with mount accessor "mount2" duplicates 2 others: id="00000000-0000-0000-0000-000000000008" canonical_id="11111111-0000-0000-0000-000000000008" force_deduplication="would merge into entity 11111111-0000-0000-0000-000000000006"
+end of different-case entity-alias duplicates:
+4 entity duplicates found:
+entity "different-case-dupe-1" with namespace ID "admin" duplicates 2 others: id="00000000-0000-0000-0000-000000000010" force_deduplication="would not rename"
+entity "DIFFERENT-case-DUPE-1" with namespace ID "admin" duplicates 2 others: id="00000000-0000-0000-0000-000000000011" force_deduplication="would rename to DIFFERENT-case-DUPE-1-00000000-0000-0000-0000-000000000011"
+entity "different-case-DUPE-1" with namespace ID "admin" duplicates 2 others: id="00000000-0000-0000-0000-000000000012" force_deduplication="would rename to different-case-DUPE-1-00000000-0000-0000-0000-000000000012"
+entity "exact-dupe-1" with namespace ID "admin" duplicates 1 others: id="00000000-0000-0000-0000-000000000006" force_deduplication="would not rename"
+entity "exact-dupe-1" with namespace ID "admin" duplicates 1 others: id="00000000-0000-0000-0000-000000000007" force_deduplication="would rename to exact-dupe-1-00000000-0000-0000-0000-000000000007"
+entity "different-case-dupe-1" with namespace ID "root" duplicates 1 others: id="00000000-0000-0000-0000-000000000008" force_deduplication="would not rename"
+entity "DIFFERENT-CASE-DUPE-1" with namespace ID "root" duplicates 1 others: id="00000000-0000-0000-0000-000000000009" force_deduplication="would rename to DIFFERENT-CASE-DUPE-1-00000000-0000-0000-0000-000000000009"
+entity "exact-dupe-1" with namespace ID "root" duplicates 1 others: id="00000000-0000-0000-0000-000000000004" force_deduplication="would not rename"
+entity "exact-dupe-1" with namespace ID "root" duplicates 1 others: id="00000000-0000-0000-0000-000000000005" force_deduplication="would rename to exact-dupe-1-00000000-0000-0000-0000-000000000005"
+end of entity duplicates:
+4 group duplicates found:
+group "different-case-dupe-1" with namespace ID "admin" duplicates 2 others: id="00000000-0000-0000-0000-000000000010" force_deduplication="would not rename"
+group "DIFFERENT-case-DUPE-1" with namespace ID "admin" duplicates 2 others: id="00000000-0000-0000-0000-000000000011" force_deduplication="would rename to DIFFERENT-case-DUPE-1-00000000-0000-0000-0000-000000000011"
+group "different-case-DUPE-1" with namespace ID "admin" duplicates 2 others: id="00000000-0000-0000-0000-000000000012" force_deduplication="would rename to different-case-DUPE-1-00000000-0000-0000-0000-000000000012"
+group "exact-dupe-1" with namespace ID "admin" duplicates 1 others: id="00000000-0000-0000-0000-000000000006" force_deduplication="would not rename"
+group "exact-dupe-1" with namespace ID "admin" duplicates 1 others: id="00000000-0000-0000-0000-000000000007" force_deduplication="would rename to exact-dupe-1-00000000-0000-0000-0000-000000000007"
+group "different-case-dupe-1" with namespace ID "root" duplicates 1 others: id="00000000-0000-0000-0000-000000000008" force_deduplication="would not rename"
+group "DIFFERENT-CASE-DUPE-1" with namespace ID "root" duplicates 1 others: id="00000000-0000-0000-0000-000000000009" force_deduplication="would rename to DIFFERENT-CASE-DUPE-1-00000000-0000-0000-0000-000000000009"
+group "exact-dupe-1" with namespace ID "root" duplicates 1 others: id="00000000-0000-0000-0000-000000000004" force_deduplication="would not rename"
+group "exact-dupe-1" with namespace ID "root" duplicates 1 others: id="00000000-0000-0000-0000-000000000005" force_deduplication="would rename to exact-dupe-1-00000000-0000-0000-0000-000000000005"
+end of group duplicates:
+end of identity duplicate report, refer to https://developer.hashicorp.com/vault/docs/upgrading/deduplication for resolution.:
+`
+
+	// Create a new errorResolver
+	r := newDuplicateReportingErrorResolver(log.NewNullLogger())
+
+	for i, pair := range entities {
+		// Create a fake UUID based on the index this makes sure sort order is
+		// preserved when eyeballing the expected report.
+		id := fmt.Sprintf("00000000-0000-0000-0000-%012d", i)
+		// Create a new entity with the pair
+		entity := &identity.Entity{
+			ID:          id,
+			Name:        pair[1],
+			NamespaceID: pair[0],
+		}
+
+		// Call ResolveEntities, assume existing is nil for now. In real life we
+		// should be passed the existing entity for the exact match dupes but we
+		// don't depend on that so it's fine to omit.
+		_, _ = r.ResolveEntities(context.Background(), nil, entity)
+		// Don't care about the actual error here since it would be ignored in
+		// case-sensitive mode anyway.
+
+		// Also, since the data model is the same, pretend these are groups too
+		group := &identity.Group{
+			ID:          id,
+			Name:        pair[1],
+			NamespaceID: pair[0],
+		}
+		_, _ = r.ResolveGroups(context.Background(), nil, group)
+	}
+
+	// Load aliases second because that is realistic and yet we want to report on
+	// them first.
+	for i, pair := range aliases {
+		entity := &identity.Entity{
+			ID:          fmt.Sprintf("11111111-0000-0000-0000-%012d", i),
+			Name:        pair[1] + "-entity",
+			NamespaceID: "root",
+		}
+		alias := &identity.Alias{
+			ID:            fmt.Sprintf("00000000-0000-0000-0000-%012d", i),
+			CanonicalID:   entity.ID,
+			Name:          pair[1],
+			MountAccessor: pair[0],
+			// Parse our hacky DSL to define some alias mounts as local
+			Local: strings.HasPrefix(pair[0], "local-"),
+		}
+		_, _ = r.ResolveAliases(context.Background(), entity, nil, alias)
+	}
+
+	// "log" the report and check it matches expected report below.
+	var testLog identityTestWarnLogger
+	r.LogReport(&testLog)
+
+	// Dump the raw report to make it easier to copy paste/read
+	t.Log("\n\n" + testLog.buf.String())
+
+	require.Equal(t,
+		strings.TrimSpace(expectReport),
+		strings.TrimSpace(testLog.buf.String()),
+	)
+}
+
+type identityTestWarnLogger struct {
+	buf bytes.Buffer
+}
+
+func (l *identityTestWarnLogger) Warn(msg string, args ...interface{}) {
+	l.buf.WriteString(msg + ":")
+	if len(args)%2 != 0 {
+		panic("args must be key-value pairs")
+	}
+	for i := 0; i < len(args); i += 2 {
+		l.buf.WriteString(fmt.Sprintf(" %s=%q", args[i], args[i+1]))
+	}
+	l.buf.WriteString("\n")
+}
+
+// TestDuplicateRenameResolver tests that the rename resolver
+// correctly renames pre-existing entities and groups.
+func TestDuplicateRenameResolver(t *testing.T) {
+	t.Parallel()
+
+	entities := map[string][]string{
+		// 2 non-duplicates and 2 duplicates
+		"root": {
+			"foo",
+			"bar",
+			"exact-dupe-1", "exact-dupe-1",
+			"different-case-dupe-1", "DIFFERENT-CASE-DUPE-1",
+		},
+		// 1 non-duplicate and 3 duplicates
+		"admin": {
+			"foo",
+			"exact-dupe-1", "exact-dupe-1",
+			"different-case-dupe-1", "DIFFERENT-case-DUPE-1", "different-case-DUPE-1",
+		},
+		"developers": {"BAR"},
+	}
+
+	// Create a new errorResolver
+	r := &renameResolver{log.NewNullLogger()}
+
+	seenEntities := make(map[string]*identity.Entity)
+	seenGroups := make(map[string]*identity.Group)
+
+	for ns, entityList := range entities {
+		for i, name := range entityList {
+
+			id := fmt.Sprintf("00000000-0000-0000-0000-%012d", i)
+			// Create a new entity with the name/ns pair
+			entity := &identity.Entity{
+				ID:          id,
+				Name:        name,
+				NamespaceID: ns,
+			}
+
+			// Simulate a MemDB lookup
+			existingEntity := seenEntities[name]
+			renamed, err := r.ResolveEntities(context.Background(), existingEntity, entity)
+			require.NoError(t, err)
+
+			if existingEntity != nil {
+				require.True(t, renamed)
+				require.Equal(t, name+"-"+id, entity.Name)
+				require.Equal(t, existingEntity.ID, entity.Metadata["duplicate_of_canonical_id"])
+			} else {
+				require.False(t, renamed)
+				seenEntities[name] = entity
+			}
+
+			// Also, since the data model is the same, pretend these are groups too
+			group := &identity.Group{
+				ID:          id,
+				Name:        name,
+				NamespaceID: ns,
+			}
+
+			// More MemDB mocking
+			existingGroup := seenGroups[name]
+			renamed, err = r.ResolveGroups(context.Background(), existingGroup, group)
+			require.NoError(t, err)
+
+			if existingGroup != nil {
+				require.True(t, renamed)
+				require.Equal(t, name+"-"+id, group.Name)
+				require.Equal(t, existingGroup.ID, group.Metadata["duplicate_of_canonical_id"])
+			} else {
+				require.False(t, renamed)
+				seenGroups[name] = group
+			}
+		}
+	}
+
+	// No need to test entity alias merges here, since that's handled separately.
+}
diff --git a/vault/identity_store_entities.go b/vault/identity_store_entities.go
index 2f3825d2ddb..8dc6940c269 100644
--- a/vault/identity_store_entities.go
+++ b/vault/identity_store_entities.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -10,13 +10,12 @@ import (
 	"strings"
 
 	"github.com/golang/protobuf/ptypes"
-	memdb "github.com/hashicorp/go-memdb"
+	"github.com/hashicorp/go-memdb"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/identity/mfa"
 	"github.com/hashicorp/vault/helper/namespace"
-	"github.com/hashicorp/vault/helper/storagepacker"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -285,14 +284,7 @@ func (i *IdentityStore) pathEntityMergeID() framework.OperationFunc {
 				return logical.ErrorResponse(userErr.Error()), nil
 			}
 			// Alias clash error, so include additional details
-			resp := &logical.Response{
-				Data: map[string]interface{}{
-					"error": userErr.Error(),
-					"data":  aliases,
-				},
-			}
-
-			return resp, nil
+			return logical.ErrorResponseWithData(aliases, userErr.Error()), nil
 		}
 		if intErr != nil {
 			return nil, intErr
@@ -329,7 +321,7 @@ func (i *IdentityStore) handleEntityUpdateCommon() framework.OperationFunc {
 		// Get the name
 		entityName := d.Get("name").(string)
 		if entityName != "" {
-			entityByName, err := i.MemDBEntityByName(ctx, entityName, false)
+			entityByName, err := i.MemDBEntityByName(ctx, entityName, true)
 			if err != nil {
 				return nil, err
 			}
@@ -357,7 +349,7 @@ func (i *IdentityStore) handleEntityUpdateCommon() framework.OperationFunc {
 			entity.Policies = strutil.RemoveDuplicates(entityPoliciesRaw.([]string), false)
 		}
 
-		if strutil.StrListContains(entity.Policies, "root") {
+		if strutil.StrListContainsCaseInsensitive(entity.Policies, "root") {
 			return logical.ErrorResponse("policies cannot contain root"), nil
 		}
 
@@ -887,7 +879,7 @@ func (i *IdentityStore) mergeEntity(ctx context.Context, txn *memdb.Txn, toEntit
 			return errors.New("to_entity_id should not be present in from_entity_ids"), nil, nil
 		}
 
-		fromEntity, err := i.MemDBEntityByID(fromEntityID, false)
+		fromEntity, err := i.MemDBEntityByIDInTxn(txn, fromEntityID, false)
 		if err != nil {
 			return nil, err, nil
 		}
@@ -990,7 +982,6 @@ func (i *IdentityStore) mergeEntity(ctx context.Context, txn *memdb.Txn, toEntit
 	var fromEntityGroups []*identity.Group
 
 	toEntityAccessors := make(map[string][]string)
-
 	for _, alias := range toEntity.Aliases {
 		if accessors, ok := toEntityAccessors[alias.MountAccessor]; !ok {
 			// While it is not supported to have multiple aliases with the same mount accessor in one entity
@@ -1008,7 +999,7 @@ func (i *IdentityStore) mergeEntity(ctx context.Context, txn *memdb.Txn, toEntit
 			return errors.New("to_entity_id should not be present in from_entity_ids"), nil, nil
 		}
 
-		fromEntity, err := i.MemDBEntityByID(fromEntityID, true)
+		fromEntity, err := i.MemDBEntityByIDInTxn(txn, fromEntityID, true)
 		if err != nil {
 			return nil, err, nil
 		}
@@ -1031,25 +1022,36 @@ func (i *IdentityStore) mergeEntity(ctx context.Context, txn *memdb.Txn, toEntit
 		}
 
 		for _, fromAlias := range fromEntity.Aliases {
+			// We're going to modify this alias but it's still a pointer to the one in
+			// MemDB that could be being read by other goroutines even though we might
+			// be removing from MemDB really shortly...
+			fromAlias, err = fromAlias.Clone()
+			if err != nil {
+				return nil, err, nil
+			}
 			// If true, we need to handle conflicts (conflict = both aliases share the same mount accessor)
 			if toAliasIds, ok := toEntityAccessors[fromAlias.MountAccessor]; ok {
 				for _, toAliasId := range toAliasIds {
 					// When forceMergeAliases is true (as part of the merge-during-upsert case), we make the decision
-					// for the user, and keep the to_entity alias, merging the from_entity
+					// for the user, and keep the from_entity alias
 					// This case's code is the same as when the user selects to keep the from_entity alias
-					// but is kept separate for clarity
+					// but is kept separate for clarity.
 					if forceMergeAliases {
 						i.logger.Info("Deleting to_entity alias during entity merge", "to_entity", toEntity.ID, "deleted_alias", toAliasId)
 						err := i.MemDBDeleteAliasByIDInTxn(txn, toAliasId, false)
 						if err != nil {
 							return nil, fmt.Errorf("aborting entity merge - failed to delete orphaned alias %q during merge into entity %q: %w", toAliasId, toEntity.ID, err), nil
 						}
+						// Remove the alias from the entity's list in memory too!
+						toEntity.DeleteAliasByID(toAliasId)
 					} else if strutil.StrListContains(conflictingAliasIDsToKeep, toAliasId) {
 						i.logger.Info("Deleting from_entity alias during entity merge", "from_entity", fromEntityID, "deleted_alias", fromAlias.ID)
 						err := i.MemDBDeleteAliasByIDInTxn(txn, fromAlias.ID, false)
 						if err != nil {
 							return nil, fmt.Errorf("aborting entity merge - failed to delete orphaned alias %q during merge into entity %q: %w", fromAlias.ID, toEntity.ID, err), nil
 						}
+						// Don't need to alter toEntity aliases since we it never contained
+						// the alias we're deleting.
 
 						// Continue to next alias, as there's no alias to merge left in the from_entity
 						continue
@@ -1059,6 +1061,8 @@ func (i *IdentityStore) mergeEntity(ctx context.Context, txn *memdb.Txn, toEntit
 						if err != nil {
 							return nil, fmt.Errorf("aborting entity merge - failed to delete orphaned alias %q during merge into entity %q: %w", toAliasId, toEntity.ID, err), nil
 						}
+						// Remove the alias from the entity's list in memory too!
+						toEntity.DeleteAliasByID(toAliasId)
 					} else {
 						return fmt.Errorf("conflicting mount accessors in following alias IDs and neither were present in conflicting_alias_ids_to_keep: %s, %s", fromAlias.ID, toAliasId), nil, nil
 					}
@@ -1070,13 +1074,12 @@ func (i *IdentityStore) mergeEntity(ctx context.Context, txn *memdb.Txn, toEntit
 
 			fromAlias.MergedFromCanonicalIDs = append(fromAlias.MergedFromCanonicalIDs, fromEntity.ID)
 
-			err = i.MemDBUpsertAliasInTxn(txn, fromAlias, false)
-			if err != nil {
-				return nil, fmt.Errorf("failed to update alias during merge: %w", err), nil
-			}
+			// We don't insert into MemDB right now because we'll do that for all the
+			// aliases we want to end up with at the end to ensure they are inserted
+			// in the same order as when they load from storage next time.
 
 			// Add the alias to the desired entity
-			toEntity.Aliases = append(toEntity.Aliases, fromAlias)
+			toEntity.UpsertAlias(fromAlias)
 		}
 
 		// If told to, merge policies
@@ -1124,6 +1127,30 @@ func (i *IdentityStore) mergeEntity(ctx context.Context, txn *memdb.Txn, toEntit
 		}
 	}
 
+	// Normalize Alias order. We do this because we persist NonLocal and Local
+	// aliases separately and so after next reload local aliases will all come
+	// after non-local ones. While it's logically equivalent, it makes reasoning
+	// about merges and determinism very hard if the order of things in MemDB can
+	// change from one unseal to the next so we are especially careful to ensure
+	// it's exactly the same whether we just merged or on a subsequent load.
+	// persistEntities will already split these up and persist them separately, so
+	// we're kinda duplicating effort and code here but this should't happen often
+	// so I think it's fine.
+	nonLocalAliases, localAliases := splitLocalAliases(toEntity)
+	toEntity.Aliases = append(nonLocalAliases, localAliases...)
+
+	// Don't forget to insert aliases into alias table that were part of
+	// `toEntity` but were not merged above (because they didn't conflict). This
+	// might re-insert the same aliases we just inserted above again but that's a
+	// no-op. TODO: maybe we could remove the memdb updates in the loop above and
+	// have them all be inserted here.
+	for _, alias := range toEntity.Aliases {
+		err = i.MemDBUpsertAliasInTxn(txn, alias, false)
+		if err != nil {
+			return nil, err, nil
+		}
+	}
+
 	// Update MemDB with changes to the entity we are merging to
 	err = i.MemDBUpsertEntityInTxn(txn, toEntity)
 	if err != nil {
@@ -1140,16 +1167,7 @@ func (i *IdentityStore) mergeEntity(ctx context.Context, txn *memdb.Txn, toEntit
 
 	if persist && !isPerfSecondaryOrStandby {
 		// Persist the entity which we are merging to
-		toEntityAsAny, err := ptypes.MarshalAny(toEntity)
-		if err != nil {
-			return nil, err, nil
-		}
-		item := &storagepacker.Item{
-			ID:      toEntity.ID,
-			Message: toEntityAsAny,
-		}
-
-		err = i.entityPacker.PutItem(ctx, item)
+		err = i.persistEntity(ctx, toEntity)
 		if err != nil {
 			return nil, err, nil
 		}
diff --git a/vault/identity_store_entities_test.go b/vault/identity_store_entities_test.go
index 260b6a9ceac..4374ecc8e33 100644
--- a/vault/identity_store_entities_test.go
+++ b/vault/identity_store_entities_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/identity_store_group_aliases.go b/vault/identity_store_group_aliases.go
index f9103a6c935..a9a48dad4af 100644
--- a/vault/identity_store_group_aliases.go
+++ b/vault/identity_store_group_aliases.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -8,11 +8,11 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/golang/protobuf/ptypes"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 func groupAliasPaths(i *IdentityStore) []*framework.Path {
@@ -45,8 +45,12 @@ func groupAliasPaths(i *IdentityStore) []*framework.Path {
 				},
 			},
 
-			Callbacks: map[logical.Operation]framework.OperationFunc{
-				logical.UpdateOperation: i.pathGroupAliasRegister(),
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.UpdateOperation: &framework.PathOperation{
+					Callback:                    i.pathGroupAliasRegister(),
+					ForwardPerformanceStandby:   true,
+					ForwardPerformanceSecondary: true,
+				},
 			},
 
 			HelpSynopsis:    strings.TrimSpace(groupAliasHelp["group-alias"][0]),
@@ -85,6 +89,8 @@ func groupAliasPaths(i *IdentityStore) []*framework.Path {
 					DisplayAttrs: &framework.DisplayAttributes{
 						OperationVerb: "update",
 					},
+					ForwardPerformanceStandby:   true,
+					ForwardPerformanceSecondary: true,
 				},
 				logical.ReadOperation: &framework.PathOperation{
 					Callback: i.pathGroupAliasIDRead(),
@@ -97,6 +103,8 @@ func groupAliasPaths(i *IdentityStore) []*framework.Path {
 					DisplayAttrs: &framework.DisplayAttributes{
 						OperationVerb: "delete",
 					},
+					ForwardPerformanceStandby:   true,
+					ForwardPerformanceSecondary: true,
 				},
 			},
 
@@ -170,7 +178,7 @@ func (i *IdentityStore) handleGroupAliasUpdateCommon(ctx context.Context, req *l
 
 	if groupAlias == nil {
 		groupAlias = &identity.Alias{
-			CreationTime: ptypes.TimestampNow(),
+			CreationTime: timestamppb.Now(),
 			NamespaceID:  ns.ID,
 		}
 		groupAlias.LastUpdateTime = groupAlias.CreationTime
@@ -178,7 +186,7 @@ func (i *IdentityStore) handleGroupAliasUpdateCommon(ctx context.Context, req *l
 		if ns.ID != groupAlias.NamespaceID {
 			return logical.ErrorResponse("existing alias not in the same namespace as request"), logical.ErrPermissionDenied
 		}
-		groupAlias.LastUpdateTime = ptypes.TimestampNow()
+		groupAlias.LastUpdateTime = timestamppb.Now()
 		if groupAlias.CreationTime == nil {
 			groupAlias.CreationTime = groupAlias.LastUpdateTime
 		}
diff --git a/vault/identity_store_group_aliases_test.go b/vault/identity_store_group_aliases_test.go
index 300d6914136..8ea1900de83 100644
--- a/vault/identity_store_group_aliases_test.go
+++ b/vault/identity_store_group_aliases_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/identity_store_groups.go b/vault/identity_store_groups.go
index b1d3f8b5a05..4955d86e103 100644
--- a/vault/identity_store_groups.go
+++ b/vault/identity_store_groups.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -71,8 +71,9 @@ func groupPaths(i *IdentityStore) []*framework.Path {
 			Fields: groupPathFields(),
 			Operations: map[logical.Operation]framework.OperationHandler{
 				logical.UpdateOperation: &framework.PathOperation{
-					Callback:                  i.pathGroupRegister(),
-					ForwardPerformanceStandby: true,
+					Callback:                    i.pathGroupRegister(),
+					ForwardPerformanceStandby:   true,
+					ForwardPerformanceSecondary: true,
 				},
 			},
 
@@ -95,6 +96,8 @@ func groupPaths(i *IdentityStore) []*framework.Path {
 					DisplayAttrs: &framework.DisplayAttributes{
 						OperationVerb: "update",
 					},
+					ForwardPerformanceStandby:   true,
+					ForwardPerformanceSecondary: true,
 				},
 				logical.ReadOperation: &framework.PathOperation{
 					Callback: i.pathGroupIDRead(),
@@ -107,6 +110,8 @@ func groupPaths(i *IdentityStore) []*framework.Path {
 					DisplayAttrs: &framework.DisplayAttributes{
 						OperationVerb: "delete",
 					},
+					ForwardPerformanceStandby:   true,
+					ForwardPerformanceSecondary: true,
 				},
 			},
 
@@ -144,6 +149,8 @@ func groupPaths(i *IdentityStore) []*framework.Path {
 					DisplayAttrs: &framework.DisplayAttributes{
 						OperationVerb: "update",
 					},
+					ForwardPerformanceStandby:   true,
+					ForwardPerformanceSecondary: true,
 				},
 				logical.ReadOperation: &framework.PathOperation{
 					Callback: i.pathGroupNameRead(),
@@ -156,6 +163,8 @@ func groupPaths(i *IdentityStore) []*framework.Path {
 					DisplayAttrs: &framework.DisplayAttributes{
 						OperationVerb: "delete",
 					},
+					ForwardPerformanceStandby:   true,
+					ForwardPerformanceSecondary: true,
 				},
 			},
 
@@ -180,6 +189,7 @@ func groupPaths(i *IdentityStore) []*framework.Path {
 	}
 }
 
+// pathGroupRegister is always called by the active primary node of the cluster.
 func (i *IdentityStore) pathGroupRegister() framework.OperationFunc {
 	return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 		_, ok := d.GetOk("id")
@@ -199,6 +209,7 @@ func (i *IdentityStore) pathGroupRegister() framework.OperationFunc {
 	}
 }
 
+// pathGroupIDUpdate is always called by the active primary node of the cluster.
 func (i *IdentityStore) pathGroupIDUpdate() framework.OperationFunc {
 	return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 		groupID := d.Get("id").(string)
@@ -221,6 +232,7 @@ func (i *IdentityStore) pathGroupIDUpdate() framework.OperationFunc {
 	}
 }
 
+// pathGroupNameUpdate is always called by the active primary node of the cluster.
 func (i *IdentityStore) pathGroupNameUpdate() framework.OperationFunc {
 	return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 		groupName := d.Get("name").(string)
@@ -239,6 +251,7 @@ func (i *IdentityStore) pathGroupNameUpdate() framework.OperationFunc {
 	}
 }
 
+// handleGroupUpdateCommon is always handled by the active primary node of the cluster.
 func (i *IdentityStore) handleGroupUpdateCommon(ctx context.Context, req *logical.Request, d *framework.FieldData, group *identity.Group) (*logical.Response, error) {
 	var newGroup bool
 	if group == nil {
@@ -252,7 +265,7 @@ func (i *IdentityStore) handleGroupUpdateCommon(ctx context.Context, req *logica
 		group.Policies = strutil.RemoveDuplicatesStable(policiesRaw.([]string), true)
 	}
 
-	if strutil.StrListContains(group.Policies, "root") {
+	if strutil.StrListContainsCaseInsensitive(group.Policies, "root") {
 		return logical.ErrorResponse("policies cannot contain root"), nil
 	}
 
@@ -442,6 +455,7 @@ func (i *IdentityStore) handleGroupReadCommon(ctx context.Context, group *identi
 	}, nil
 }
 
+// pathGroupIDDelete is always called by the active primary node of the cluster.
 func (i *IdentityStore) pathGroupIDDelete() framework.OperationFunc {
 	return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 		groupID := d.Get("id").(string)
@@ -453,6 +467,7 @@ func (i *IdentityStore) pathGroupIDDelete() framework.OperationFunc {
 	}
 }
 
+// pathGroupNameDelete is always called by the active primary node of the cluster.
 func (i *IdentityStore) pathGroupNameDelete() framework.OperationFunc {
 	return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 		groupName := d.Get("name").(string)
@@ -464,6 +479,7 @@ func (i *IdentityStore) pathGroupNameDelete() framework.OperationFunc {
 	}
 }
 
+// handleGroupDeleteCommon is always handled by the active primary node of the cluster.
 func (i *IdentityStore) handleGroupDeleteCommon(ctx context.Context, key string, byID bool) (*logical.Response, error) {
 	// Acquire the lock to modify the group storage entry
 	i.groupLock.Lock()
diff --git a/vault/identity_store_groups_test.go b/vault/identity_store_groups_test.go
index 2aadbef55fc..c818c165f36 100644
--- a/vault/identity_store_groups_test.go
+++ b/vault/identity_store_groups_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/identity_store_injector.go b/vault/identity_store_injector.go
new file mode 100644
index 00000000000..7423b11c195
--- /dev/null
+++ b/vault/identity_store_injector.go
@@ -0,0 +1,13 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !testonly
+
+package vault
+
+import "github.com/hashicorp/vault/sdk/framework"
+
+// entityTestonlyPaths is a stub for non-testonly builds.
+func entityTestonlyPaths(i *IdentityStore) []*framework.Path {
+	return nil
+}
diff --git a/vault/identity_store_injector_testonly.go b/vault/identity_store_injector_testonly.go
new file mode 100644
index 00000000000..985dea196bb
--- /dev/null
+++ b/vault/identity_store_injector_testonly.go
@@ -0,0 +1,896 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build testonly
+
+package vault
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"strings"
+	"sync"
+	"unicode"
+
+	"github.com/golang/protobuf/ptypes"
+	uuid "github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/helper/identity"
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/storagepacker"
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+// entityTestonlyPaths returns a list of testonly API endpoints supported to
+// operate on entities in a way that is not supported by production Vault. These
+// all generate duplicate identity resources IN STORAGE. MemDB won't reflect
+// them until Vault has been sealed and unsealed again!
+//
+// Use of these endpoints is a bit nuanced as they are low level and do almost
+// no validation. By design, they are allowing you to write invalid state into
+// storage because that is what is needed to replicate some customer scenarios
+// caused by historical bugs. Bear the following non-obvious things in mind if
+// you use them.
+//
+//   - Very little validation is done. You can create state that in invalid in
+//     ways that Vault, even with it's bugs, has never been able to create.
+//   - These write the duplicates directly to storage without checking contents.
+//     So if you call the same endpoint with the same name multiple times you
+//     will end up with even more duplicates of the same name.
+//   - Because they write direct to storage, they DON'T update MemDB so regular
+//     API calls won't see the created resources until you seal and unseal.
+func entityTestonlyPaths(i *IdentityStore) []*framework.Path {
+	return []*framework.Path{
+		{
+			Pattern: "duplicate/entity-aliases",
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: "entity-aliases",
+				OperationVerb:   "create-duplicates",
+			},
+			Fields: map[string]*framework.FieldSchema{
+				"name": {
+					Type:        framework.TypeString,
+					Description: "Name of the entities to create",
+				},
+				"namespace_id": {
+					Type:        framework.TypeString,
+					Description: "NamespaceID of the entities to create",
+				},
+				"different_case": {
+					Type:        framework.TypeBool,
+					Description: "Create entities with different case variations",
+				},
+				"mount_accessor": {
+					Type:        framework.TypeString,
+					Description: "Mount accessor ID for the alias",
+				},
+				"metadata": {
+					Type:        framework.TypeKVPairs,
+					Description: "Metadata",
+				},
+				"count": {
+					Type:        framework.TypeInt,
+					Description: "Number of entity aliases to create",
+				},
+				"local": {
+					Type:        framework.TypeBool,
+					Description: "Local alias toggle",
+				},
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.UpdateOperation: &framework.PathOperation{
+					Callback:                  i.createDuplicateEntityAliases(),
+					ForwardPerformanceStandby: true,
+					// Duplicate entity alias injector now forwards
+					// CreateEntity calls when flags.Local is true.
+					ForwardPerformanceSecondary: false,
+				},
+			},
+		},
+		{
+			Pattern: "duplicate/local-entity-alias",
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: "entity-alias",
+				OperationVerb:   "create-duplicates",
+			},
+			Fields: map[string]*framework.FieldSchema{
+				"name": {
+					Type:        framework.TypeString,
+					Description: "Name of the entities to create",
+				},
+				"namespace_id": {
+					Type:        framework.TypeString,
+					Description: "NamespaceID of the entities to create",
+				},
+				"canonical_id": {
+					Type:        framework.TypeString,
+					Description: "The canonical entity ID to attach the local alias to",
+				},
+				"mount_accessor": {
+					Type:        framework.TypeString,
+					Description: "Mount accessor ID for the alias",
+				},
+				"metadata": {
+					Type:        framework.TypeKVPairs,
+					Description: "Metadata",
+				},
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.UpdateOperation: &framework.PathOperation{
+					Callback:                    i.createDuplicateLocalEntityAlias(),
+					ForwardPerformanceStandby:   true,
+					ForwardPerformanceSecondary: false, // Allow this on a perf secondary.
+				},
+			},
+		},
+		{
+			Pattern: "duplicate/entities",
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: "entities",
+				OperationVerb:   "create-duplicates",
+			},
+			Fields: map[string]*framework.FieldSchema{
+				"name": {
+					Type:        framework.TypeString,
+					Description: "Name of the entities to create",
+				},
+				"namespace_id": {
+					Type:        framework.TypeString,
+					Description: "NamespaceID of the entities to create",
+				},
+				"different_case": {
+					Type:        framework.TypeBool,
+					Description: "Create entities with different case variations",
+				},
+				"metadata": {
+					Type: framework.TypeKVPairs,
+					Description: `Metadata to be associated with the entity.
+In CLI, this parameter can be repeated multiple times, and it all gets merged together.
+For example:
+vault <command> <path> metadata=key1=value1 metadata=key2=value2
+					`,
+				},
+				"policies": {
+					Type:        framework.TypeCommaStringSlice,
+					Description: "Policies to be tied to the entity.",
+				},
+				"count": {
+					Type:        framework.TypeInt,
+					Description: "Number of entities to create",
+				},
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.UpdateOperation: &framework.PathOperation{
+					Callback:                  i.createDuplicateEntities(),
+					ForwardPerformanceStandby: true,
+					// Writing global (non-local) state should be replicated.
+					ForwardPerformanceSecondary: true,
+				},
+			},
+		},
+		{
+			Pattern: "duplicate/groups",
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: "groups",
+				OperationVerb:   "create-duplicates",
+			},
+			Fields: map[string]*framework.FieldSchema{
+				"id": {
+					Type:        framework.TypeString,
+					Description: "ID of the group. If set, updates the corresponding existing group.",
+				},
+				"type": {
+					Type:        framework.TypeString,
+					Description: "Type of the group, 'internal' or 'external'. Defaults to 'internal'",
+				},
+				"name": {
+					Type:        framework.TypeString,
+					Description: "Name of the group.",
+				},
+				"namespace_id": {
+					Type:        framework.TypeString,
+					Description: "NamespaceID of the entities to create",
+				},
+				"different_case": {
+					Type:        framework.TypeBool,
+					Description: "Create entities with different case variations",
+				},
+				"metadata": {
+					Type: framework.TypeKVPairs,
+					Description: `Metadata to be associated with the group.
+In CLI, this parameter can be repeated multiple times, and it all gets merged together.
+For example:
+vault <command> <path> metadata=key1=value1 metadata=key2=value2
+					`,
+				},
+				"policies": {
+					Type:        framework.TypeCommaStringSlice,
+					Description: "Policies to be tied to the group.",
+				},
+				"member_group_ids": {
+					Type:        framework.TypeCommaStringSlice,
+					Description: "Group IDs to be assigned as group members.",
+				},
+				"member_entity_ids": {
+					Type:        framework.TypeCommaStringSlice,
+					Description: "Entity IDs to be assigned as group members.",
+				},
+				"count": {
+					Type:        framework.TypeInt,
+					Description: "Number of groups to create",
+				},
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.UpdateOperation: &framework.PathOperation{
+					Callback:                  i.createDuplicateGroups(),
+					ForwardPerformanceStandby: true,
+					// Writing global (non-local) state should be replicated.
+					ForwardPerformanceSecondary: true,
+				},
+			},
+		},
+		{
+			Pattern: "entity/from-storage/?$",
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: "entity",
+				OperationVerb:   "list",
+				OperationSuffix: "from-storage",
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.ListOperation: &framework.PathOperation{
+					Callback:                  i.listEntitiesFromStorage(),
+					ForwardPerformanceStandby: true,
+					// Allow reading local cluster state
+					ForwardPerformanceSecondary: false,
+				},
+			},
+		},
+		{
+			Pattern: "group/from-storage/?$",
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: "group",
+				OperationVerb:   "list",
+				OperationSuffix: "from-storage",
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.ListOperation: &framework.PathOperation{
+					Callback:                  i.listGroupsFromStorage(),
+					ForwardPerformanceStandby: true,
+					// Allow reading local cluster state
+					ForwardPerformanceSecondary: false,
+				},
+			},
+		},
+	}
+}
+
+type CommonDuplicateFlags struct {
+	Name          string            `json:"name"`
+	NamespaceID   string            `json:"namespace_id"`
+	DifferentCase bool              `json:"different_case"`
+	Metadata      map[string]string `json:"metadata"`
+}
+
+type CommonAliasFlags struct {
+	MountAccessor string `json:"mount_accessor"`
+	CanonicalID   string `json:"canonical_id"`
+}
+
+type DuplicateEntityFlags struct {
+	CommonDuplicateFlags
+	Policies []string `json:"policies"`
+	Count    int      `json:"count"`
+}
+
+type DuplicateGroupFlags struct {
+	CommonDuplicateFlags
+	Type            string   `json:"type"`
+	Policies        []string `json:"policies"`
+	MemberGroupIDs  []string `json:"member_group_ids"`
+	MemberEntityIDs []string `json:"member_entity_ids"`
+	Count           int      `json:"count"`
+}
+
+type DuplicateEntityAliasFlags struct {
+	CommonDuplicateFlags
+	CommonAliasFlags
+	Count int  `json:"count"`
+	Local bool `json:"local"`
+}
+
+type DuplicateGroupAliasFlags struct {
+	CommonAliasFlags
+	Name  string `json:"name"`
+	Count int    `json:"count"`
+}
+
+func (i *IdentityStore) createDuplicateEntities() framework.OperationFunc {
+	return func(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+		metadata, ok := data.GetOk("metadata")
+		if !ok {
+			metadata = make(map[string]string)
+		}
+		flags := DuplicateEntityFlags{
+			CommonDuplicateFlags: CommonDuplicateFlags{
+				Name:          data.Get("name").(string),
+				NamespaceID:   data.Get("namespace_id").(string),
+				DifferentCase: data.Get("different_case").(bool),
+				Metadata:      metadata.(map[string]string),
+			},
+			Policies: data.Get("policies").([]string),
+			Count:    data.Get("count").(int),
+		}
+
+		if flags.Count < 1 {
+			flags.Count = 2
+		}
+
+		ids, err := i.CreateDuplicateEntitiesInStorage(ctx, flags)
+		if err != nil {
+			i.logger.Error("error creating duplicate entities", "error", err)
+			return logical.ErrorResponse("error creating duplicate entities"), err
+		}
+
+		return &logical.Response{
+			Data: map[string]interface{}{
+				"entity_ids": ids,
+			},
+		}, nil
+	}
+}
+
+func (i *IdentityStore) createDuplicateEntityAliases() framework.OperationFunc {
+	return func(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+		metadata, ok := data.GetOk("metadata")
+		if !ok {
+			metadata = make(map[string]string)
+		}
+
+		flags := DuplicateEntityAliasFlags{
+			CommonDuplicateFlags: CommonDuplicateFlags{
+				Name:          data.Get("name").(string),
+				NamespaceID:   data.Get("namespace_id").(string),
+				DifferentCase: data.Get("different_case").(bool),
+				Metadata:      metadata.(map[string]string),
+			},
+			CommonAliasFlags: CommonAliasFlags{
+				MountAccessor: data.Get("mount_accessor").(string),
+			},
+			Count: data.Get("count").(int),
+			Local: data.Get("local").(bool),
+		}
+
+		if flags.Count < 1 {
+			flags.Count = 2
+		}
+
+		ids, err := i.CreateDuplicateEntityAliasesInStorage(ctx, flags)
+		if err != nil {
+			i.logger.Error("error creating duplicate entity aliases", "error", err)
+			return logical.ErrorResponse("error creating duplicate entity aliases"), err
+		}
+
+		return &logical.Response{
+			Data: map[string]interface{}{
+				"entity_ids": ids,
+				"local":      flags.Local,
+			},
+		}, nil
+	}
+}
+
+func (i *IdentityStore) createDuplicateLocalEntityAlias() framework.OperationFunc {
+	return func(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+		metadata, ok := data.GetOk("metadata")
+		if !ok {
+			metadata = make(map[string]string)
+		}
+
+		flags := DuplicateEntityAliasFlags{
+			CommonDuplicateFlags: CommonDuplicateFlags{
+				Name:        data.Get("name").(string),
+				NamespaceID: data.Get("namespace_id").(string),
+				Metadata:    metadata.(map[string]string),
+			},
+			CommonAliasFlags: CommonAliasFlags{
+				MountAccessor: data.Get("mount_accessor").(string),
+				CanonicalID:   data.Get("canonical_id").(string),
+			},
+		}
+
+		if flags.Name == "" {
+			return logical.ErrorResponse("name is required"), nil
+		}
+		if flags.CanonicalID == "" {
+			return logical.ErrorResponse("canonical_id is required"), nil
+		}
+		if flags.MountAccessor == "" {
+			return logical.ErrorResponse("mount_accessor is required"), nil
+		}
+
+		ids, err := i.CreateDuplicateLocalEntityAliasInStorage(ctx, flags)
+		if err != nil {
+			i.logger.Error("error creating duplicate local alias", "error", err)
+			return logical.ErrorResponse("error creating duplicate local alias"), err
+		}
+
+		return &logical.Response{
+			Data: map[string]interface{}{
+				"alias_ids": ids,
+			},
+		}, nil
+	}
+}
+
+func (i *IdentityStore) createDuplicateGroups() framework.OperationFunc {
+	return func(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+		metadata, ok := data.GetOk("metadata")
+		if !ok {
+			metadata = make(map[string]string)
+		}
+
+		flags := DuplicateGroupFlags{
+			CommonDuplicateFlags: CommonDuplicateFlags{
+				Name:          data.Get("name").(string),
+				NamespaceID:   data.Get("namespace_id").(string),
+				DifferentCase: data.Get("different_case").(bool),
+				Metadata:      metadata.(map[string]string),
+			},
+			Type:            data.Get("type").(string),
+			Policies:        data.Get("policies").([]string),
+			MemberGroupIDs:  data.Get("member_group_ids").([]string),
+			MemberEntityIDs: data.Get("member_entity_ids").([]string),
+			Count:           data.Get("count").(int),
+		}
+
+		if flags.Count < 1 {
+			flags.Count = 2
+		}
+
+		ids, err := i.CreateDuplicateGroupsInStorage(ctx, flags)
+		if err != nil {
+			i.logger.Error("error creating duplicate entities", "error", err)
+			return logical.ErrorResponse("error creating duplicate entities"), err
+		}
+
+		return &logical.Response{
+			Data: map[string]interface{}{
+				"group_ids": ids,
+			},
+		}, nil
+	}
+}
+
+func (i *IdentityStore) CreateDuplicateGroupsInStorage(ctx context.Context, flags DuplicateGroupFlags) ([]string, error) {
+	var groupIDs []string
+	if flags.NamespaceID == "" {
+		flags.NamespaceID = namespace.RootNamespaceID
+	}
+	for d := 0; d < flags.Count; d++ {
+		groupID, err := uuid.GenerateUUID()
+		if err != nil {
+			return nil, err
+		}
+		groupIDs = append(groupIDs, groupID)
+
+		// Alias name is either exact match or different case
+		groupName := flags.Name
+		if flags.DifferentCase {
+			groupName = randomCase(flags.Name)
+		}
+
+		g := &identity.Group{
+			ID:              groupID,
+			Name:            groupName,
+			Policies:        flags.Policies,
+			MemberEntityIDs: flags.MemberEntityIDs,
+			ParentGroupIDs:  flags.MemberGroupIDs,
+			Type:            flags.Type,
+			NamespaceID:     flags.NamespaceID,
+			BucketKey:       i.groupPacker.BucketKey(groupID),
+		}
+
+		group, err := ptypes.MarshalAny(g)
+		if err != nil {
+			return nil, err
+		}
+		item := &storagepacker.Item{
+			ID:      g.ID,
+			Message: group,
+		}
+		if err = i.groupPacker.PutItem(ctx, item); err != nil {
+			return nil, err
+		}
+	}
+
+	return groupIDs, nil
+}
+
+// CreateDuplicateEntityAliasesInStorage creates n entities with a duplicate
+// alias in storage This should only be used in testing. This method can only
+// create non-local aliases. Local aliases are stored differently.
+//
+// Pass in mount type and accessor to create the entities
+func (i *IdentityStore) CreateDuplicateEntityAliasesInStorage(ctx context.Context, flags DuplicateEntityAliasFlags) ([]string, error) {
+	var entityIDs []string
+	if flags.NamespaceID == "" {
+		flags.NamespaceID = namespace.RootNamespaceID
+	}
+	for d := 0; d < flags.Count; d++ {
+		aliasID, err := uuid.GenerateUUID()
+		if err != nil {
+			return nil, err
+		}
+
+		// Alias name is either exact match or different case
+		dupAliasName := flags.Name
+		if flags.DifferentCase {
+			dupAliasName = randomCase(flags.Name)
+		}
+
+		// In real life alias dupes are due to races where they were auto-created
+		// along with the entities they point to. When we auto create entities like
+		// this they get random names so never collide with each other directly so
+		// don't create entities with duplicate names for this case as it doesn't
+		// match what customers who get in this state see. Instead use the same code
+		// path as CreateOfFetchEntity.
+		e := new(identity.Entity)
+		e.NamespaceID = flags.NamespaceID
+		err = i.sanitizeEntity(ctx, e)
+		if err != nil {
+			return nil, fmt.Errorf("error sanitizing entity: %w", err)
+		}
+		entityIDs = append(entityIDs, e.ID)
+
+		a := &identity.Alias{
+			ID:            aliasID,
+			NamespaceID:   flags.NamespaceID,
+			CanonicalID:   e.ID,
+			MountAccessor: flags.MountAccessor,
+			Name:          dupAliasName,
+			Local:         flags.Local,
+		}
+
+		persistEntity := func(ent *identity.Entity) error {
+			entity, err := ptypes.MarshalAny(ent)
+			if err != nil {
+				return fmt.Errorf("error marhsaling entity: %w", err)
+			}
+			item := &storagepacker.Item{
+				ID:      ent.ID,
+				Message: entity,
+			}
+			if err = i.entityPacker.PutItem(ctx, item); err != nil {
+				return err
+			}
+
+			return nil
+		}
+
+		if flags.Local {
+			// Check to see if the entity creation should be forwarded.
+			i.logger.Trace("forwarding entity creation for local alias cache")
+			e, err := i.entityCreator.CreateEntity(ctx)
+			if err != nil {
+				return nil, err
+			}
+
+			localAliases, err := i.parseLocalAliases(e.ID)
+			if err != nil {
+				return nil, fmt.Errorf("failed to parse local aliases from entity: %w", err)
+			}
+			if localAliases == nil {
+				localAliases = &identity.LocalAliases{}
+			}
+
+			// Don't check if this is a duplicate, since we're allowing the developer to
+			// create duplicates here.
+			localAliases.Aliases = append(localAliases.Aliases, a)
+
+			marshaledAliases, err := anypb.New(localAliases)
+			if err != nil {
+				return nil, fmt.Errorf("failed to marshal local aliases: %w", err)
+			}
+			item := &storagepacker.Item{
+				ID:      e.ID,
+				Message: marshaledAliases,
+			}
+			if err := i.localAliasPacker.PutItem(ctx, item); err != nil {
+				return nil, fmt.Errorf("failed to put item in local alias packer: %w", err)
+			}
+		} else {
+			e.UpsertAlias(a)
+			err := persistEntity(e)
+			if err != nil {
+				return nil, err
+			}
+
+		}
+	}
+
+	return entityIDs, nil
+}
+
+// CreateDuplicateLocalEntityAliasInStorage creates a single local entity alias
+// directly in storage. This should only be used in testing. This method can
+// only create local aliases and assumes that the entity is already created
+// separately and it's ID passed as CanonicalID. No validation of the mounts or
+// entity is done so if you need these to be realistic the caller must ensure
+// the entity and mount exist and that the mount is a local auth method of the
+// right type.
+//
+// Pass in mount type and accessor to create the entities
+func (i *IdentityStore) CreateDuplicateLocalEntityAliasInStorage(ctx context.Context, flags DuplicateEntityAliasFlags) ([]string, error) {
+	var aliasIDs []string
+	if flags.NamespaceID == "" {
+		flags.NamespaceID = namespace.RootNamespaceID
+	}
+
+	aliasID, err := uuid.GenerateUUID()
+	if err != nil {
+		return nil, err
+	}
+	aliasIDs = append(aliasIDs, aliasID)
+
+	a := &identity.Alias{
+		ID:            aliasID,
+		NamespaceID:   flags.NamespaceID,
+		CanonicalID:   flags.CanonicalID,
+		MountAccessor: flags.MountAccessor,
+		Name:          flags.Name,
+		Local:         true,
+	}
+
+	localAliases, err := i.parseLocalAliases(flags.CommonAliasFlags.CanonicalID)
+	if err != nil {
+		return nil, err
+	}
+	if localAliases == nil {
+		localAliases = &identity.LocalAliases{}
+	}
+
+	// Don't check if this is a duplicate, since we're allowing the developer to
+	// create duplicates here.
+	localAliases.Aliases = append(localAliases.Aliases, a)
+
+	marshaledAliases, err := anypb.New(localAliases)
+	if err != nil {
+		return nil, err
+	}
+	if err := i.localAliasPacker.PutItem(ctx, &storagepacker.Item{
+		ID:      flags.CommonAliasFlags.CanonicalID,
+		Message: marshaledAliases,
+	}); err != nil {
+		return nil, err
+	}
+
+	return aliasIDs, nil
+}
+
+func (i *IdentityStore) CreateDuplicateEntitiesInStorage(ctx context.Context, flags DuplicateEntityFlags) ([]string, error) {
+	var entityIDs []string
+	for d := 0; d < flags.Count; d++ {
+		entityID, err := uuid.GenerateUUID()
+		if err != nil {
+			return nil, err
+		}
+		entityIDs = append(entityIDs, entityID)
+
+		dupName := flags.Name
+		if flags.DifferentCase {
+			dupName = randomCase(flags.Name)
+		}
+
+		e := &identity.Entity{
+			ID:          entityID,
+			Name:        dupName,
+			NamespaceID: flags.NamespaceID,
+			BucketKey:   i.entityPacker.BucketKey(entityID),
+		}
+
+		entity, err := ptypes.MarshalAny(e)
+		if err != nil {
+			return nil, err
+		}
+		item := &storagepacker.Item{
+			ID:      e.ID,
+			Message: entity,
+		}
+		if err = i.entityPacker.PutItem(ctx, item); err != nil {
+			return nil, err
+		}
+	}
+
+	return entityIDs, nil
+}
+
+func randomCase(s string) string {
+	return strings.Map(func(r rune) rune {
+		if rand.Intn(2) == 0 {
+			return unicode.ToUpper(r)
+		}
+		return unicode.ToLower(r)
+	}, s)
+}
+
+func (i *IdentityStore) ListEntitiesFromStorage(ctx context.Context) ([]*identity.Entity, error) {
+	// Get Existing Buckets
+	existing, err := i.entityPacker.View().List(ctx, storagepacker.StoragePackerBucketsPrefix)
+	if err != nil {
+		return nil, fmt.Errorf("failed to scan for entity buckets: %w", err)
+	}
+
+	workerCount := 64
+	entities := make([]*identity.Entity, 0)
+
+	// Make channels for worker pool
+	broker := make(chan string)
+	quit := make(chan bool)
+
+	errs := make(chan error, (len(existing)))
+	result := make(chan *storagepacker.Bucket, len(existing))
+
+	wg := &sync.WaitGroup{}
+
+	// Stand up workers
+	for j := 0; j < workerCount; j++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+
+			for {
+				select {
+				case key, ok := <-broker:
+					if !ok {
+						return
+					}
+
+					bucket, err := i.entityPacker.GetBucket(ctx, storagepacker.StoragePackerBucketsPrefix+key)
+					if err != nil {
+						errs <- err
+						continue
+					}
+
+					result <- bucket
+
+				case <-quit:
+					return
+				}
+			}
+		}()
+	}
+
+	// Distribute the collected keys to the workers in a go routine
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for j, key := range existing {
+			if j%500 == 0 {
+				i.logger.Debug("entities loading", "progress", j)
+			}
+
+			select {
+			case <-quit:
+				return
+
+			default:
+				broker <- key
+			}
+		}
+
+		// Close the broker, causing worker routines to exit
+		close(broker)
+	}()
+
+	// Restore each key by pulling from the result chan
+LOOP:
+	for j := 0; j < len(existing); j++ {
+		select {
+		case err = <-errs:
+			// Close all go routines
+			close(quit)
+			break LOOP
+
+		case bucket := <-result:
+			// If there is no entry, nothing to restore
+			if bucket == nil {
+				continue
+			}
+
+			for _, item := range bucket.Items {
+				entity, err := i.parseEntityFromBucketItem(ctx, item)
+				if err != nil {
+					return nil, err
+				}
+				if entity == nil {
+					continue
+				}
+
+				// Load local aliases for entity
+				localAliases, err := i.parseLocalAliases(entity.ID)
+				if err != nil {
+					return nil, err
+				}
+				if localAliases != nil {
+					entity.Aliases = append(entity.Aliases, localAliases.Aliases...)
+				}
+
+				entities = append(entities, entity)
+			}
+		}
+	}
+
+	// Let all go routines finish
+	wg.Wait()
+	if err != nil {
+		return nil, err
+	}
+
+	return entities, nil
+}
+
+func (i *IdentityStore) listEntitiesFromStorage() framework.OperationFunc {
+	return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+		entities, err := i.ListEntitiesFromStorage(ctx)
+		if err != nil {
+			i.logger.Error("error listing entities", "error", err)
+			return logical.ErrorResponse("error listing entities"), err
+		}
+		resp := &logical.Response{
+			Data: map[string]interface{}{
+				"entities": entities,
+			},
+		}
+		return resp, nil
+	}
+}
+
+func (i *IdentityStore) ListGroupsFromStorage(ctx context.Context) ([]*identity.Group, error) {
+	existing, err := i.groupPacker.View().List(ctx, groupBucketsPrefix)
+	if err != nil {
+		return nil, fmt.Errorf("failed to scan for groups: %w", err)
+	}
+
+	groups := make([]*identity.Group, 0)
+
+	for _, key := range existing {
+		bucket, err := i.groupPacker.GetBucket(ctx, groupBucketsPrefix+key)
+		if err != nil {
+			return nil, err
+		}
+
+		if bucket == nil {
+			continue
+		}
+
+		for _, item := range bucket.Items {
+			group, err := i.parseGroupFromBucketItem(item)
+			if err != nil {
+				return nil, err
+			}
+			if group == nil {
+				continue
+			}
+			groups = append(groups, group)
+		}
+	}
+	return groups, nil
+}
+
+func (i *IdentityStore) listGroupsFromStorage() framework.OperationFunc {
+	return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+		groups, err := i.ListGroupsFromStorage(ctx)
+		if err != nil {
+			i.logger.Error("error listing groups", "error", err)
+			return logical.ErrorResponse("error listing groups"), err
+		}
+		resp := &logical.Response{
+			Data: map[string]interface{}{
+				"groups": groups,
+			},
+		}
+		return resp, nil
+	}
+}
diff --git a/vault/identity_store_oidc.go b/vault/identity_store_oidc.go
index f58c3a7b0dd..aeb9807d105 100644
--- a/vault/identity_store_oidc.go
+++ b/vault/identity_store_oidc.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -8,7 +8,6 @@ import (
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rand"
-	"crypto/rsa"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
@@ -30,6 +29,7 @@ import (
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/helper/cryptoutil"
 	"github.com/hashicorp/vault/sdk/helper/identitytpl"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/patrickmn/go-cache"
@@ -64,10 +64,6 @@ func (c *oidcConfig) fullIssuer(child string) (string, error) {
 	return issuer, nil
 }
 
-func validChildIssuer(child string) bool {
-	return child == baseIdentityTokenIssuer || child == pluginIdentityTokenIssuer
-}
-
 type expireableKey struct {
 	KeyID    string    `json:"key_id"`
 	ExpireAt time.Time `json:"expire_at"`
@@ -130,9 +126,6 @@ type oidcCache struct {
 var (
 	errNilNamespace = errors.New("nil namespace in oidc cache request")
 
-	// pseudo-namespace for cache items that don't belong to any real namespace.
-	noNamespace = &namespace.Namespace{ID: "__NO_NAMESPACE"}
-
 	reservedClaims = []string{
 		"iat", "aud", "exp", "iss",
 		"sub", "namespace", "nonce",
@@ -150,22 +143,15 @@ var (
 )
 
 const (
-	issuerPath           = "identity/oidc"
-	oidcTokensPrefix     = "oidc_tokens/"
-	namedKeyCachePrefix  = "namedKeys/"
-	oidcConfigStorageKey = oidcTokensPrefix + "config/"
-	namedKeyConfigPath   = oidcTokensPrefix + "named_keys/"
-	publicKeysConfigPath = oidcTokensPrefix + "public_keys/"
-	roleConfigPath       = oidcTokensPrefix + "roles/"
-
-	// Identity tokens have a base issuer and plugin issuer
-	baseIdentityTokenIssuer   = ""
-	pluginIdentityTokenIssuer = "plugins"
-
-	pluginTokenSubjectPrefix   = "plugin-identity"
-	pluginTokenPrivateClaimKey = "vaultproject.io"
-	secretTableValue           = "secret"
-	deleteKeyErrorFmt          = "unable to delete key %q because it is currently referenced by these %s: %s"
+	issuerPath              = "identity/oidc"
+	oidcTokensPrefix        = "oidc_tokens/"
+	namedKeyCachePrefix     = "namedKeys/"
+	oidcConfigStorageKey    = oidcTokensPrefix + "config/"
+	namedKeyConfigPath      = oidcTokensPrefix + "named_keys/"
+	publicKeysConfigPath    = oidcTokensPrefix + "public_keys/"
+	roleConfigPath          = oidcTokensPrefix + "roles/"
+	baseIdentityTokenIssuer = ""
+	deleteKeyErrorFmt       = "unable to delete key %q because it is currently referenced by these %s: %s"
 )
 
 // optionalChildIssuerRegex is a regex for optionally accepting a field in an
@@ -1096,99 +1082,6 @@ func (i *IdentityStore) pathOIDCGenerateToken(ctx context.Context, req *logical.
 	return retResp, nil
 }
 
-func (i *IdentityStore) generatePluginIdentityToken(ctx context.Context, storage logical.Storage, me *MountEntry, audience string, ttl time.Duration) (string, time.Duration, error) {
-	ns, err := namespace.FromContext(ctx)
-	if err != nil {
-		return "", 0, err
-	}
-
-	if me == nil {
-		i.Logger().Error("unexpected nil mount entry when generating plugin identity token")
-		return "", 0, errors.New("mount entry must not be nil")
-	}
-
-	key := defaultKeyName
-	if me.Config.IdentityTokenKey != "" {
-		key = me.Config.IdentityTokenKey
-	}
-	if ttl == 0 {
-		ttl = time.Hour
-	}
-	namedKey, err := i.getNamedKey(ctx, storage, key)
-	if err != nil {
-		return "", 0, err
-	}
-	if namedKey == nil {
-		return "", 0, fmt.Errorf("key %q not found", key)
-	}
-
-	// Validate that the role is allowed to sign with its key (the key could have been updated)
-	if !strutil.StrListContains(namedKey.AllowedClientIDs, "*") && !strutil.StrListContains(namedKey.AllowedClientIDs, audience) {
-		return "", 0, fmt.Errorf("the key %q does not list %q as an allowed audience", key, audience)
-	}
-
-	config, err := i.getOIDCConfig(ctx, storage)
-	if err != nil {
-		return "", 0, err
-	}
-
-	// Cap the TTL to the key's verification TTL. This is the maximum amount of
-	// time the key will remain in the JWKS after it's been rotated.
-	if ttl > namedKey.VerificationTTL {
-		ttl = namedKey.VerificationTTL
-	}
-
-	// Tokens for plugins have a distinct issuer from Vault's identity token issuer
-	issuer, err := config.fullIssuer(pluginIdentityTokenIssuer)
-	if err != nil {
-		return "", 0, err
-	}
-
-	// The subject uniquely identifies the plugin
-	subject := fmt.Sprintf("%s:%s:%s:%s", pluginTokenSubjectPrefix, ns.ID,
-		translateTableClaim(me.Table), me.Accessor)
-
-	now := time.Now()
-	claims := map[string]any{
-		"iss": issuer,
-		"sub": subject,
-		"aud": []string{audience},
-		"nbf": now.Unix(),
-		"iat": now.Unix(),
-		"exp": now.Add(ttl).Unix(),
-		pluginTokenPrivateClaimKey: map[string]any{
-			"namespace_id":   ns.ID,
-			"namespace_path": ns.Path,
-			"class":          translateTableClaim(me.Table),
-			"plugin":         me.Type,
-			"version":        me.RunningVersion,
-			"path":           me.Path,
-			"accessor":       me.Accessor,
-			"local":          me.Local,
-		},
-	}
-	payload, err := json.Marshal(claims)
-	if err != nil {
-		return "", 0, err
-	}
-
-	signedToken, err := namedKey.signPayload(payload)
-	if err != nil {
-		return "", 0, fmt.Errorf("error signing plugin identity token: %w", err)
-	}
-
-	return signedToken, ttl, nil
-}
-
-func translateTableClaim(table string) string {
-	switch table {
-	case mountTableType:
-		return secretTableValue
-	default:
-		return table
-	}
-}
-
 func (i *IdentityStore) getNamedKey(ctx context.Context, s logical.Storage, name string) (*namedKey, error) {
 	ns, err := namespace.FromContext(ctx)
 	if err != nil {
@@ -1607,10 +1500,10 @@ func (i *IdentityStore) pathOIDCDiscovery(ctx context.Context, req *logical.Requ
 
 // getKeysCacheControlHeader returns the cache control header for all public
 // keys at the .well-known/keys endpoint
-func (i *IdentityStore) getKeysCacheControlHeader() (string, error) {
+func (i *IdentityStore) getKeysCacheControlHeader(ns *namespace.Namespace) (string, error) {
 	// if jwksCacheControlMaxAge is set use that, otherwise fall back on the
 	// more conservative nextRun values
-	jwksCacheControlMaxAge, ok, err := i.oidcCache.Get(noNamespace, "jwksCacheControlMaxAge")
+	jwksCacheControlMaxAge, ok, err := i.oidcCache.Get(ns, "jwksCacheControlMaxAge")
 	if err != nil {
 		return "", err
 	}
@@ -1622,7 +1515,7 @@ func (i *IdentityStore) getKeysCacheControlHeader() (string, error) {
 		return fmt.Sprintf("max-age=%.0f", durationInSeconds), nil
 	}
 
-	nextRun, ok, err := i.oidcCache.Get(noNamespace, "nextRun")
+	nextRun, ok, err := i.oidcCache.Get(ns, "nextRun")
 	if err != nil {
 		return "", err
 	}
@@ -1694,7 +1587,7 @@ func (i *IdentityStore) pathOIDCReadPublicKeys(ctx context.Context, req *logical
 		return nil, err
 	}
 	if len(keys) > 0 {
-		header, err := i.getKeysCacheControlHeader()
+		header, err := i.getKeysCacheControlHeader(ns)
 		if err != nil {
 			return nil, err
 		}
@@ -1866,7 +1759,7 @@ func generateKeys(algorithm string) (*jose.JSONWebKey, error) {
 	switch algorithm {
 	case "RS256", "RS384", "RS512":
 		// 2048 bits is recommended by RSA Laboratories as a minimum post 2015
-		if key, err = rsa.GenerateKey(rand.Reader, 2048); err != nil {
+		if key, err = cryptoutil.GenerateRSAKey(rand.Reader, 2048); err != nil {
 			return nil, err
 		}
 	case "ES256", "ES384", "ES512":
@@ -1961,6 +1854,20 @@ func (i *IdentityStore) generatePublicJWKS(ctx context.Context, s logical.Storag
 		return jwksRaw.(*jose.JSONWebKeySet), nil
 	}
 
+	i.generateJWKSLock.Lock()
+	defer i.generateJWKSLock.Unlock()
+
+	// Check the cache again incase another requset acquired the lock
+	// before this request.
+	jwksRaw, ok, err = i.oidcCache.Get(ns, "jwks")
+	if err != nil {
+		return nil, err
+	}
+
+	if ok {
+		return jwksRaw.(*jose.JSONWebKeySet), nil
+	}
+
 	if _, err := i.expireOIDCPublicKeys(ctx, s); err != nil {
 		return nil, err
 	}
@@ -2208,17 +2115,23 @@ func (i *IdentityStore) oidcKeyRotation(ctx context.Context, s logical.Storage)
 
 // oidcPeriodFunc is invoked by the backend's periodFunc and runs regular key
 // rotations and expiration actions.
-func (i *IdentityStore) oidcPeriodicFunc(ctx context.Context) {
+func (i *IdentityStore) oidcPeriodicFunc(ctx context.Context, s logical.Storage) {
 	// Key rotations write to storage, so only run this on the primary cluster.
 	// The periodic func does not run on perf standbys or DR secondaries.
 	if i.System().ReplicationState().HasState(consts.ReplicationPerformanceSecondary) {
 		return
 	}
 
-	var nextRun time.Time
 	now := time.Now()
 
-	v, ok, err := i.oidcCache.Get(noNamespace, "nextRun")
+	ns, err := namespace.FromContext(ctx)
+	if err != nil {
+		i.Logger().Error("error getting namespace from context", "err", err)
+		return
+	}
+
+	var nextRun time.Time
+	v, ok, err := i.oidcCache.Get(ns, "nextRun")
 	if err != nil {
 		i.Logger().Error("error reading oidc cache", "err", err)
 		return
@@ -2232,68 +2145,52 @@ func (i *IdentityStore) oidcPeriodicFunc(ctx context.Context) {
 	// be run at any time safely, but there is no need to invoke them (which
 	// might be somewhat expensive if there are many roles/keys) if we're not
 	// past any rotation/expiration TTLs.
-	if now.After(nextRun) {
-		// Initialize to a fairly distant next run time. This will be brought in
-		// based on key rotation times.
-		nextRun = now.Add(24 * time.Hour)
-		minJwksClientCacheDuration := time.Duration(math.MaxInt64)
-
-		for _, ns := range i.namespacer.ListNamespaces(true) {
-			nsPath := ns.Path
-
-			s := i.router.MatchingStorageByAPIPath(ctx, nsPath+"identity/oidc")
-
-			if s == nil {
-				continue
-			}
-
-			nextRotation, jwksClientCacheDuration, err := i.oidcKeyRotation(ctx, s)
-			if err != nil {
-				i.Logger().Warn("error rotating OIDC keys", "err", err)
-			}
-
-			nextExpiration, err := i.expireOIDCPublicKeys(ctx, s)
-			if err != nil {
-				i.Logger().Warn("error expiring OIDC public keys", "err", err)
-			}
+	if now.Before(nextRun) {
+		return
+	}
 
-			if err := i.oidcCache.Flush(ns); err != nil {
-				i.Logger().Error("error flushing oidc cache", "err", err)
-			}
+	nextRotation, jwksClientCacheDuration, err := i.oidcKeyRotation(ctx, s)
+	if err != nil {
+		i.Logger().Warn("error rotating OIDC keys", "err", err)
+	}
 
-			// re-run at the soonest expiration or rotation time
-			if nextRotation.Before(nextRun) {
-				nextRun = nextRotation
-			}
+	nextExpiration, err := i.expireOIDCPublicKeys(ctx, s)
+	if err != nil {
+		i.Logger().Warn("error expiring OIDC public keys", "err", err)
+	}
 
-			if nextExpiration.Before(nextRun) {
-				nextRun = nextExpiration
-			}
+	if err := i.oidcCache.Flush(ns); err != nil {
+		i.Logger().Error("error flushing oidc cache", "err", err)
+	}
 
-			if jwksClientCacheDuration < minJwksClientCacheDuration {
-				minJwksClientCacheDuration = jwksClientCacheDuration
-			}
-		}
+	// use the soonest time between nextRotation and nextExpiration for the next run.
+	// Allow at most 24 hours though, keeping the legacy behavior from the original
+	// introduction of namespaces (unclear if necessary but safer to keep for now).
+	nextRun = now.Add(24 * time.Hour)
+	if nextRotation.Before(nextRun) {
+		nextRun = nextRotation
+	}
+	if nextExpiration.Before(nextRun) {
+		nextRun = nextExpiration
+	}
 
-		if err := i.oidcCache.SetDefault(noNamespace, "nextRun", nextRun); err != nil {
-			i.Logger().Error("error setting oidc cache", "err", err)
-		}
+	if err := i.oidcCache.SetDefault(ns, "nextRun", nextRun); err != nil {
+		i.Logger().Error("error setting oidc cache", "err", err)
+	}
 
-		if minJwksClientCacheDuration < math.MaxInt64 {
-			// the OIDC JWKS endpoint returns a Cache-Control HTTP header time between
-			// 0 and the minimum verificationTTL or minimum rotationPeriod out of all
-			// keys, whichever value is lower.
-			//
-			// This smooths calls from services validating JWTs to Vault, while
-			// ensuring that operators can assert that servers honoring the
-			// Cache-Control header will always have a superset of all valid keys, and
-			// not trust any keys longer than a jwksCacheControlMaxAge duration after a
-			// key is rotated out of signing use
-			if err := i.oidcCache.SetDefault(noNamespace, "jwksCacheControlMaxAge", minJwksClientCacheDuration); err != nil {
-				i.Logger().Error("error setting jwksCacheControlMaxAge in oidc cache", "err", err)
-			}
+	if jwksClientCacheDuration < math.MaxInt64 {
+		// the OIDC JWKS endpoint returns a Cache-Control HTTP header time between
+		// 0 and the minimum verificationTTL or minimum rotationPeriod out of all
+		// keys, whichever value is lower.
+		//
+		// This smooths calls from services validating JWTs to Vault, while
+		// ensuring that operators can assert that servers honoring the
+		// Cache-Control header will always have a superset of all valid keys, and
+		// not trust any keys longer than a jwksCacheControlMaxAge duration after a
+		// key is rotated out of signing use
+		if err := i.oidcCache.SetDefault(ns, "jwksCacheControlMaxAge", jwksClientCacheDuration); err != nil {
+			i.Logger().Error("error setting jwksCacheControlMaxAge in oidc cache", "err", err)
 		}
-
 	}
 }
 
@@ -2338,9 +2235,9 @@ func (c *oidcCache) Flush(ns *namespace.Namespace) error {
 		return errNilNamespace
 	}
 
-	// Remove all items from the provided namespace as well as the shared, "no namespace" section.
+	// Remove all items from the provided namespace
 	for itemKey := range c.c.Items() {
-		if isTargetNamespacedKey(itemKey, []string{noNamespace.ID, ns.ID}) {
+		if isTargetNamespacedKey(itemKey, []string{ns.ID}) {
 			c.c.Delete(itemKey)
 		}
 	}
diff --git a/vault/identity_store_oidc_provider.go b/vault/identity_store_oidc_provider.go
index 3882ab99cad..3d967443fe2 100644
--- a/vault/identity_store_oidc_provider.go
+++ b/vault/identity_store_oidc_provider.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -110,6 +110,7 @@ type client struct {
 	ClientSecret string `json:"client_secret"`
 }
 
+//go:generate enumer -type=clientType -trimprefix=clientType -transform=snake
 type clientType int
 
 const (
@@ -117,17 +118,6 @@ const (
 	public
 )
 
-func (k clientType) String() string {
-	switch k {
-	case confidential:
-		return "confidential"
-	case public:
-		return "public"
-	default:
-		return "unknown"
-	}
-}
-
 type provider struct {
 	Issuer           string   `json:"issuer"`
 	AllowedClientIDs []string `json:"allowed_client_ids"`
diff --git a/vault/identity_store_oidc_provider_test.go b/vault/identity_store_oidc_provider_test.go
index 2296c8aa7cc..7aa73c386db 100644
--- a/vault/identity_store_oidc_provider_test.go
+++ b/vault/identity_store_oidc_provider_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/identity_store_oidc_provider_util.go b/vault/identity_store_oidc_provider_util.go
index e2e21066019..8f76e83a266 100644
--- a/vault/identity_store_oidc_provider_util.go
+++ b/vault/identity_store_oidc_provider_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/identity_store_oidc_stubs_oss.go b/vault/identity_store_oidc_stubs_oss.go
new file mode 100644
index 00000000000..51b070599a4
--- /dev/null
+++ b/vault/identity_store_oidc_stubs_oss.go
@@ -0,0 +1,24 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"context"
+	"time"
+
+	"github.com/hashicorp/vault/sdk/helper/pluginidentityutil"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+//go:generate go run github.com/hashicorp/vault/tools/stubmaker
+
+func (i *IdentityStore) generatePluginIdentityToken(_ context.Context, _ logical.Storage, _ *MountEntry, _ string, _ time.Duration) (string, time.Duration, error) {
+	return "", 0, pluginidentityutil.ErrPluginWorkloadIdentityUnsupported
+}
+
+func validChildIssuer(child string) bool {
+	return child == baseIdentityTokenIssuer
+}
diff --git a/vault/identity_store_oidc_test.go b/vault/identity_store_oidc_test.go
index 9879c55a177..ff91179eec9 100644
--- a/vault/identity_store_oidc_test.go
+++ b/vault/identity_store_oidc_test.go
@@ -1,11 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
 	"context"
-	"crypto"
 	"encoding/json"
 	"fmt"
 	"regexp"
@@ -17,7 +16,6 @@ import (
 	"github.com/go-jose/go-jose/v3"
 	"github.com/go-jose/go-jose/v3/jwt"
 	"github.com/go-test/deep"
-	capjwt "github.com/hashicorp/cap/jwt"
 	"github.com/hashicorp/go-hclog"
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/helper/identity"
@@ -891,7 +889,7 @@ func TestOIDC_SignIDToken(t *testing.T) {
 
 	txn := c.identityStore.db.Txn(true)
 	defer txn.Abort()
-	err := c.identityStore.upsertEntityInTxn(ctx, txn, testEntity, nil, true)
+	_, err := c.identityStore.upsertEntityInTxn(ctx, txn, testEntity, nil, true, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1022,7 +1020,7 @@ func TestOIDC_SignIDToken_NilSigningKey(t *testing.T) {
 
 	txn := c.identityStore.db.Txn(true)
 	defer txn.Abort()
-	err := c.identityStore.upsertEntityInTxn(ctx, txn, testEntity, nil, true)
+	_, err := c.identityStore.upsertEntityInTxn(ctx, txn, testEntity, nil, true, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1194,14 +1192,14 @@ func TestOIDC_PeriodicFunc(t *testing.T) {
 			namedKeySamples := make([]*logical.StorageEntry, len(testSet.testCases))
 			publicKeysSamples := make([][]string, len(testSet.testCases))
 			for i := range testSet.testCases {
-				c.identityStore.oidcPeriodicFunc(ctx)
+				c.identityStore.oidcPeriodicFunc(ctx, storage)
 				namedKeyEntry, _ := storage.Get(ctx, namedKeyConfigPath+testSet.namedKey.name)
 				publicKeysEntry, _ := storage.List(ctx, publicKeysConfigPath)
 				namedKeySamples[i] = namedKeyEntry
 				publicKeysSamples[i] = publicKeysEntry
 
 				// sleep until we are in the next cycle - where a next run will happen
-				v, _, _ := c.identityStore.oidcCache.Get(noNamespace, "nextRun")
+				v, _, _ := c.identityStore.oidcCache.Get(namespace.RootNamespace, "nextRun")
 				nextRun := v.(time.Time)
 				now := time.Now()
 				diff := nextRun.Sub(now)
@@ -1499,7 +1497,7 @@ func TestOIDC_Path_Introspect(t *testing.T) {
 
 	txn := c.identityStore.db.Txn(true)
 	defer txn.Abort()
-	err = c.identityStore.upsertEntityInTxn(ctx, txn, testEntity, nil, true)
+	_, err = c.identityStore.upsertEntityInTxn(ctx, txn, testEntity, nil, true, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1604,61 +1602,37 @@ func TestOIDC_isTargetNamespacedKey(t *testing.T) {
 func TestOIDC_Flush(t *testing.T) {
 	c := newOIDCCache(gocache.NoExpiration, gocache.NoExpiration)
 	ns := []*namespace.Namespace{
-		noNamespace, // ns[0] is nilNamespace
+		{ID: "ns0"},
 		{ID: "ns1"},
-		{ID: "ns2"},
 	}
 
-	// populateNs populates cache by ns with some data
-	populateNs := func() {
-		for i := range ns {
-			for _, val := range []string{"keyA", "keyB", "keyC"} {
-				if err := c.SetDefault(ns[i], val, struct{}{}); err != nil {
-					t.Fatal(err)
-				}
-			}
-		}
-	}
-
-	// validate verifies that cache items exist or do not exist based on their namespaced key
-	verify := func(items map[string]gocache.Item, expect, doNotExpect []*namespace.Namespace) {
-		for _, expectNs := range expect {
-			found := false
-			for i := range items {
-				if isTargetNamespacedKey(i, []string{expectNs.ID}) {
-					found = true
-					break
-				}
-			}
-			if !found {
-				t.Fatalf("Expected cache to contain an entry with a namespaced key for namespace: %q but did not find one", expectNs.ID)
-			}
-		}
-
-		for _, doNotExpectNs := range doNotExpect {
-			for i := range items {
-				if isTargetNamespacedKey(i, []string{doNotExpectNs.ID}) {
-					t.Fatalf("Did not expect cache to contain an entry with a namespaced key for namespace: %q but found the key: %q", doNotExpectNs.ID, i)
-				}
-			}
-		}
+	// Add a key to the cache under each namespace
+	if err := c.SetDefault(ns[0], "keyA", struct{}{}); err != nil {
+		t.Fatal(err)
 	}
-
-	// flushing ns1 should flush ns1 and nilNamespace but not ns2
-	populateNs()
-	if err := c.Flush(ns[1]); err != nil {
+	if err := c.SetDefault(ns[1], "keyB", struct{}{}); err != nil {
 		t.Fatal(err)
 	}
-	items := c.c.Items()
-	verify(items, []*namespace.Namespace{ns[2]}, []*namespace.Namespace{ns[0], ns[1]})
 
-	// flushing nilNamespace should flush nilNamespace but not ns1 or ns2
-	populateNs()
+	// Flush ns0
 	if err := c.Flush(ns[0]); err != nil {
 		t.Fatal(err)
 	}
-	items = c.c.Items()
-	verify(items, []*namespace.Namespace{ns[1], ns[2]}, []*namespace.Namespace{ns[0]})
+
+	// Verify that ns0 was flushed but ns1 was not
+	items := c.c.Items()
+	ns1KeyFound := false
+	for i := range items {
+		if isTargetNamespacedKey(i, []string{ns[0].ID}) {
+			t.Fatalf("Expected cache to not contain an entry with a namespaced key for namespace: %q but found one", ns[0].ID)
+		}
+		if isTargetNamespacedKey(i, []string{ns[1].ID}) {
+			ns1KeyFound = true
+		}
+	}
+	if !ns1KeyFound {
+		t.Fatalf("Expected cache to contain an entry with a namespaced key for namespace: %q but did not find one", ns[1].ID)
+	}
 }
 
 func TestOIDC_CacheNamespaceNilCheck(t *testing.T) {
@@ -1681,7 +1655,7 @@ func TestOIDC_GetKeysCacheControlHeader(t *testing.T) {
 	c, _, _ := TestCoreUnsealed(t)
 
 	// get default value
-	header, err := c.identityStore.getKeysCacheControlHeader()
+	header, err := c.identityStore.getKeysCacheControlHeader(namespace.RootNamespace)
 	if err != nil {
 		t.Fatalf("expected success, got error:\n%v", err)
 	}
@@ -1693,11 +1667,11 @@ func TestOIDC_GetKeysCacheControlHeader(t *testing.T) {
 
 	// set nextRun
 	nextRun := time.Now().Add(24 * time.Hour)
-	if err = c.identityStore.oidcCache.SetDefault(noNamespace, "nextRun", nextRun); err != nil {
+	if err = c.identityStore.oidcCache.SetDefault(namespace.RootNamespace, "nextRun", nextRun); err != nil {
 		t.Fatal(err)
 	}
 
-	header, err = c.identityStore.getKeysCacheControlHeader()
+	header, err = c.identityStore.getKeysCacheControlHeader(namespace.RootNamespace)
 	if err != nil {
 		t.Fatalf("expected success, got error:\n%v", err)
 	}
@@ -1710,11 +1684,11 @@ func TestOIDC_GetKeysCacheControlHeader(t *testing.T) {
 	// set jwksCacheControlMaxAge
 	durationSeconds := 60
 	jwksCacheControlMaxAge := time.Duration(durationSeconds) * time.Second
-	if err = c.identityStore.oidcCache.SetDefault(noNamespace, "jwksCacheControlMaxAge", jwksCacheControlMaxAge); err != nil {
+	if err = c.identityStore.oidcCache.SetDefault(namespace.RootNamespace, "jwksCacheControlMaxAge", jwksCacheControlMaxAge); err != nil {
 		t.Fatal(err)
 	}
 
-	header, err = c.identityStore.getKeysCacheControlHeader()
+	header, err = c.identityStore.getKeysCacheControlHeader(namespace.RootNamespace)
 	if err != nil {
 		t.Fatalf("expected success, got error:\n%v", err)
 	}
@@ -1787,12 +1761,6 @@ func Test_oidcConfig_fullIssuer(t *testing.T) {
 			child:  baseIdentityTokenIssuer,
 			want:   fmt.Sprintf("https://vault.dev/v1/%s", issuerPath),
 		},
-		{
-			name:   "issuer with valid plugin child",
-			issuer: "http://127.0.0.1:8200",
-			child:  pluginIdentityTokenIssuer,
-			want:   fmt.Sprintf("http://127.0.0.1:8200/v1/%s/%s", issuerPath, pluginIdentityTokenIssuer),
-		},
 		{
 			name:    "issuer with invalid child",
 			issuer:  "http://127.0.0.1:8200",
@@ -1838,11 +1806,6 @@ func Test_validChildIssuer(t *testing.T) {
 			child: baseIdentityTokenIssuer,
 			want:  true,
 		},
-		{
-			name:  "valid child issuer",
-			child: pluginIdentityTokenIssuer,
-			want:  true,
-		},
 		{
 			name:  "invalid child issuer",
 			child: "test",
@@ -1869,8 +1832,8 @@ func Test_optionalChildIssuerRegex(t *testing.T) {
 		{
 			name:     "valid match with capture",
 			pattern:  "oidc" + optionalChildIssuerRegex("child") + "/.well-known/keys",
-			path:     "oidc/plugins/.well-known/keys",
-			captures: map[string]string{"child": "plugins"},
+			path:     "oidc/test/.well-known/keys",
+			captures: map[string]string{"child": "test"},
 		},
 		{
 			name:     "valid match with capture name, segment, and path change",
@@ -1887,7 +1850,7 @@ func Test_optionalChildIssuerRegex(t *testing.T) {
 		{
 			name:     "invalid match with multiple path segments",
 			pattern:  "oidc" + optionalChildIssuerRegex("child") + "/.well-known/keys",
-			path:     "oidc/plugins/invalid/.well-known/keys",
+			path:     "oidc/test/invalid/.well-known/keys",
 			captures: map[string]string{},
 		},
 	}
@@ -1906,132 +1869,6 @@ func Test_optionalChildIssuerRegex(t *testing.T) {
 	}
 }
 
-// TestIdentityStore_generatePluginIdentityToken tests generation of plugin identity
-// tokens by verifying signatures and validating claims.
-func TestIdentityStore_generatePluginIdentityToken(t *testing.T) {
-	core, _, _ := TestCoreUnsealed(t)
-	core.credentialBackends["userpass"] = credUserpass.Factory
-	identityStore := core.IdentityStore()
-	identityStore.redirectAddr = "http://localhost:8200"
-	ctx := namespace.RootContext(nil)
-	storage := core.router.MatchingStorageByAPIPath(ctx, mountPathIdentity)
-	require.NotNil(t, storage)
-
-	// Create a key
-	testKey := "test-key"
-	testAudience := "allowed-audience"
-	resp, err := core.identityStore.HandleRequest(ctx, testKeyReq(storage, testKey,
-		[]string{testAudience}, "RS256"))
-	expectSuccess(t, resp, err)
-
-	// Enable a secret mount using the test key
-	createMountEntryWithKey(t, ctx, core.systemBackend, "mounts/", "kv/", testKey)
-	expectSuccess(t, resp, err)
-	secretMountEntry := core.router.MatchingMountEntry(ctx, "kv/")
-	require.NotNil(t, secretMountEntry)
-
-	// Enable an auth mount using the default key
-	createMountEntryWithKey(t, ctx, core.systemBackend, "auth/", "userpass/", defaultKeyName)
-	expectSuccess(t, resp, err)
-	authMountEntry := core.router.MatchingMountEntry(ctx, "auth/userpass/")
-	require.NotNil(t, authMountEntry)
-
-	tests := []struct {
-		name       string
-		ctx        context.Context
-		mountEntry *MountEntry
-		audience   string
-		ttl        time.Duration
-		wantErr    bool
-	}{
-		{
-			name:    "expect error with nil context",
-			ctx:     nil,
-			wantErr: true,
-		},
-		{
-			name:       "expect error with nil mount entry",
-			ctx:        ctx,
-			mountEntry: nil,
-			wantErr:    true,
-		},
-		{
-			name: "expect error with key that doesn't exist",
-			ctx:  ctx,
-			mountEntry: &MountEntry{
-				Config: MountConfig{
-					IdentityTokenKey: "does-not-exist",
-				},
-			},
-			wantErr: true,
-		},
-		{
-			name:       "expect error with audience that's not allowed by the key",
-			ctx:        ctx,
-			mountEntry: secretMountEntry,
-			audience:   "not-allowed-audience",
-			wantErr:    true,
-		},
-		{
-			name:       "expect valid identity token with secret mount using test key",
-			ctx:        ctx,
-			mountEntry: secretMountEntry,
-			audience:   testAudience,
-		},
-		{
-			name:       "expect valid identity token with auth mount using default key",
-			ctx:        ctx,
-			mountEntry: authMountEntry,
-			audience:   testAudience,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			token, _, err := identityStore.generatePluginIdentityToken(tt.ctx, storage, tt.mountEntry,
-				tt.audience, tt.ttl)
-			if tt.wantErr {
-				require.Error(t, err)
-				require.Empty(t, token)
-				return
-			}
-
-			require.NoError(t, err)
-			require.NotEmpty(t, token)
-
-			// Verify the signature and claims of the token
-			key, err := identityStore.getNamedKey(ctx, storage, tt.mountEntry.Config.IdentityTokenKey)
-			require.NoError(t, err)
-			keySet, err := capjwt.NewStaticKeySet([]crypto.PublicKey{key.SigningKey.Public()})
-			require.NoError(t, err)
-
-			validator, err := capjwt.NewValidator(keySet)
-			require.NoError(t, err)
-			expected := capjwt.Expected{
-				Issuer: fmt.Sprintf("%s/v1/identity/oidc/plugins", identityStore.redirectAddr),
-				Subject: fmt.Sprintf("%s:%s:%s:%s", pluginTokenSubjectPrefix, namespace.RootNamespace.ID,
-					translateTableClaim(tt.mountEntry.Table), tt.mountEntry.Accessor),
-				Audiences:         []string{tt.audience},
-				SigningAlgorithms: []capjwt.Alg{capjwt.RS256},
-			}
-
-			claims, err := validator.Validate(ctx, token, expected)
-			require.NoError(t, err)
-			require.Contains(t, claims, pluginTokenPrivateClaimKey)
-			require.IsType(t, map[string]interface{}{}, claims[pluginTokenPrivateClaimKey])
-
-			vaultSubClaims := claims[pluginTokenPrivateClaimKey].(map[string]interface{})
-			require.Equal(t, namespace.RootNamespace.ID, vaultSubClaims["namespace_id"])
-			require.Equal(t, namespace.RootNamespace.Path, vaultSubClaims["namespace_path"])
-			require.Equal(t, translateTableClaim(tt.mountEntry.Table), vaultSubClaims["class"])
-			require.Equal(t, tt.mountEntry.Type, vaultSubClaims["plugin"])
-			require.Equal(t, tt.mountEntry.RunningVersion, vaultSubClaims["version"])
-			require.Equal(t, tt.mountEntry.Path, vaultSubClaims["path"])
-			require.Equal(t, tt.mountEntry.Accessor, vaultSubClaims["accessor"])
-			require.Equal(t, tt.mountEntry.Local, vaultSubClaims["local"])
-		})
-	}
-}
-
 func createMountEntryWithKey(t *testing.T, ctx context.Context, sys *SystemBackend, mountPrefix, mountType, key string) {
 	t.Helper()
 
@@ -2048,34 +1885,3 @@ func createMountEntryWithKey(t *testing.T, ctx context.Context, sys *SystemBacke
 	})
 	expectSuccess(t, resp, err)
 }
-
-// Test_translateTableClaim tests that we convert mount entry table
-// values to expected claim values.
-func Test_translateTableClaim(t *testing.T) {
-	tests := []struct {
-		name  string
-		table string
-		want  string
-	}{
-		{
-			name:  "given mounts table returns secret",
-			table: mountTableType,
-			want:  secretTableValue,
-		},
-		{
-			name:  "given auth table returns auth",
-			table: "auth",
-			want:  "auth",
-		},
-		{
-			name:  "given any value returns itself",
-			table: "other",
-			want:  "other",
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equalf(t, tt.want, translateTableClaim(tt.table), "translateTableClaim(%v)", tt.table)
-		})
-	}
-}
diff --git a/vault/identity_store_oidc_util.go b/vault/identity_store_oidc_util.go
index 89c82317a42..d641187c8a9 100644
--- a/vault/identity_store_oidc_util.go
+++ b/vault/identity_store_oidc_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/identity_store_oss.go b/vault/identity_store_oss.go
index 65266b3c168..350d8c3831c 100644
--- a/vault/identity_store_oss.go
+++ b/vault/identity_store_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -9,12 +9,21 @@ import (
 	"context"
 
 	"github.com/hashicorp/vault/helper/identity"
+	"github.com/hashicorp/vault/sdk/framework"
 )
 
-func (c *Core) SendGroupUpdate(context.Context, *identity.Group) (bool, error) {
-	return false, nil
+func (c *Core) SendGroupUpdate(context.Context, *identity.Group) error {
+	return nil
 }
 
 func (c *Core) CreateEntity(ctx context.Context) (*identity.Entity, error) {
 	return nil, nil
 }
+
+func identityStoreLoginMFAEntUnauthedPaths() []string {
+	return []string{}
+}
+
+func mfaLoginEnterprisePaths(i *IdentityStore) []*framework.Path {
+	return []*framework.Path{}
+}
diff --git a/vault/identity_store_schema.go b/vault/identity_store_schema.go
index f3244b18f33..c05c9622765 100644
--- a/vault/identity_store_schema.go
+++ b/vault/identity_store_schema.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/identity_store_structs.go b/vault/identity_store_structs.go
index d60427b9f6c..6636c15c8cc 100644
--- a/vault/identity_store_structs.go
+++ b/vault/identity_store_structs.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -10,12 +10,14 @@ import (
 
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-memdb"
+	"github.com/hashicorp/vault/helper/activationflags"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/storagepacker"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/helper/locksutil"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
@@ -56,11 +58,20 @@ type IdentityStore struct {
 	// to enable richer queries based on multiple indexes.
 	db *memdb.MemDB
 
-	// locks to make sure things are consistent
-	lock     sync.RWMutex
+	// lock is the high-level IdentityStore lock, which protects underlying
+	// state against concurrent modification/access. If needed, callers should
+	// be sure to take this lock **before** (and never after) taking out any of
+	// the lower-level locks to prevent deadlocks.
+	lock sync.RWMutex
+
+	// oidcLock is used to protect against concurrent changes to OIDC identity
+	// objects.
 	oidcLock sync.RWMutex
 
-	// groupLock is used to protect modifications to group entries
+	generateJWKSLock sync.Mutex
+
+	// groupLock is used to protect against concurrent changes to the group
+	// table and storagepacker.
 	groupLock sync.RWMutex
 
 	// oidcCache stores common response data as well as when the periodic func needs
@@ -104,6 +115,20 @@ type IdentityStore struct {
 	entityCreator EntityCreator
 	mountLister   MountLister
 	mfaBackend    *LoginMFABackend
+
+	// aliasLocks is used to protect modifications to alias entries based on the uniqueness factor
+	// which is name + accessor
+	aliasLocks []*locksutil.LockEntry
+
+	conflictResolver ConflictResolver
+
+	// renameDuplicates holds the Core reference to feature activation flags, so
+	// we can set and query enablement of the deduplication feature.
+	renameDuplicates       activationflags.ActivationManager
+	activationErrorHandler Sealer
+
+	// activateDeduplicationDone is a channel used for synchronization in testing
+	activateDeduplicationDone chan struct{}
 }
 
 type groupDiff struct {
@@ -137,7 +162,7 @@ type TOTPPersister interface {
 var _ TOTPPersister = &Core{}
 
 type GroupUpdater interface {
-	SendGroupUpdate(ctx context.Context, group *identity.Group) (bool, error)
+	SendGroupUpdate(ctx context.Context, group *identity.Group) error
 }
 
 var _ GroupUpdater = &Core{}
@@ -161,3 +186,9 @@ type MountLister interface {
 }
 
 var _ MountLister = &Core{}
+
+type Sealer interface {
+	Shutdown() error
+}
+
+var _ Sealer = &Core{}
diff --git a/vault/identity_store_test.go b/vault/identity_store_test.go
index d706f31a8ab..ffc1c799c5c 100644
--- a/vault/identity_store_test.go
+++ b/vault/identity_store_test.go
@@ -1,25 +1,39 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
 	"context"
+	"fmt"
+	"math/rand"
+	"os"
+	"regexp"
+	"slices"
+	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/armon/go-metrics"
 	"github.com/go-test/deep"
-	"github.com/golang/protobuf/ptypes"
+	"github.com/hashicorp/go-hclog"
 	uuid "github.com/hashicorp/go-uuid"
 	credGithub "github.com/hashicorp/vault/builtin/credential/github"
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
+	"github.com/hashicorp/vault/helper/activationflags"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/storagepacker"
+	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/physical"
+	"github.com/hashicorp/vault/sdk/physical/inmem"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
 )
 
 func TestIdentityStore_DeleteEntityAlias(t *testing.T) {
@@ -55,7 +69,7 @@ func TestIdentityStore_DeleteEntityAlias(t *testing.T) {
 		BucketKey:   c.identityStore.entityPacker.BucketKey("testEntityID"),
 	}
 
-	err := c.identityStore.upsertEntityInTxn(context.Background(), txn, entity, nil, false)
+	_, err := c.identityStore.upsertEntityInTxn(context.Background(), txn, entity, nil, false, false)
 	require.NoError(t, err)
 
 	err = c.identityStore.deleteAliasesInEntityInTxn(txn, entity, []*identity.Alias{alias, alias2})
@@ -142,7 +156,7 @@ func TestIdentityStore_UnsealingWhenConflictingAliasNames(t *testing.T) {
 
 	// Persist the second entity directly without the regular flow. This will skip
 	// merging of these enties.
-	entity2Any, err := ptypes.MarshalAny(entity2)
+	entity2Any, err := anypb.New(entity2)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -912,3 +926,994 @@ func TestIdentityStore_DeleteCaseSensitivityKey(t *testing.T) {
 		t.Fatalf("bad: expected no entry for casesensitivity key")
 	}
 }
+
+// TestIdentityStoreInvalidate_Entities verifies the proper handling of
+// entities in the Invalidate method.
+func TestIdentityStoreInvalidate_Entities(t *testing.T) {
+	c, _, _ := TestCoreUnsealed(t)
+
+	// Create an entity in storage then call the Invalidate function
+	//
+	id, err := uuid.GenerateUUID()
+	require.NoError(t, err)
+
+	entity := &identity.Entity{
+		Name:        "test",
+		NamespaceID: namespace.RootNamespaceID,
+		ID:          id,
+		Aliases:     []*identity.Alias{},
+		BucketKey:   c.identityStore.entityPacker.BucketKey(id),
+	}
+
+	p := c.identityStore.entityPacker
+
+	// Persist the entity which we are merging to
+	entityAsAny, err := anypb.New(entity)
+	require.NoError(t, err)
+
+	item := &storagepacker.Item{
+		ID:      id,
+		Message: entityAsAny,
+	}
+
+	err = p.PutItem(context.Background(), item)
+	require.NoError(t, err)
+
+	c.identityStore.Invalidate(context.Background(), p.BucketKey(id))
+
+	txn := c.identityStore.db.Txn(true)
+
+	memEntity, err := c.identityStore.MemDBEntityByIDInTxn(txn, id, true)
+	assert.NoError(t, err)
+	assert.NotNil(t, memEntity)
+
+	txn.Commit()
+
+	// Modify the entity in storage then call the Invalidate function
+	entity.Metadata = make(map[string]string)
+	entity.Metadata["foo"] = "bar"
+
+	entityAsAny, err = anypb.New(entity)
+	require.NoError(t, err)
+
+	item.Message = entityAsAny
+
+	p.PutItem(context.Background(), item)
+
+	c.identityStore.Invalidate(context.Background(), p.BucketKey(id))
+
+	txn = c.identityStore.db.Txn(true)
+
+	memEntity, err = c.identityStore.MemDBEntityByIDInTxn(txn, id, true)
+	assert.NoError(t, err)
+	assert.Contains(t, memEntity.Metadata, "foo")
+
+	txn.Commit()
+
+	// Delete the entity in storage then call the Invalidate function
+	err = p.DeleteItem(context.Background(), id)
+	require.NoError(t, err)
+
+	c.identityStore.Invalidate(context.Background(), p.BucketKey(id))
+
+	txn = c.identityStore.db.Txn(true)
+
+	memEntity, err = c.identityStore.MemDBEntityByIDInTxn(txn, id, true)
+	assert.NoError(t, err)
+	assert.Nil(t, memEntity)
+
+	txn.Commit()
+}
+
+// TestIdentityStoreInvalidate_EntityAliasDelete verifies that the
+// invalidateEntityBucket method properly cleans up aliases from
+// MemDB that are no longer associated with the entity in the
+// storage bucket.
+func TestIdentityStoreInvalidate_EntityAliasDelete(t *testing.T) {
+	ctx := namespace.ContextWithNamespace(context.Background(), namespace.RootNamespace)
+	c, _, root := TestCoreUnsealed(t)
+
+	// Enable a No-Op auth method
+	c.credentialBackends["noop"] = func(context.Context, *logical.BackendConfig) (logical.Backend, error) {
+		return &NoopBackend{
+			BackendType: logical.TypeCredential,
+		}, nil
+	}
+	mountAccessor1 := "noop-accessor1"
+	mountAccessor2 := "noop-accessor2"
+	mountAccessor3 := "noon-accessor3"
+
+	createMountEntry := func(path, uuid, mountAccessor string, local bool) *MountEntry {
+		return &MountEntry{
+			Table:            credentialTableType,
+			Path:             path,
+			Type:             "noop",
+			UUID:             uuid,
+			Accessor:         mountAccessor,
+			BackendAwareUUID: uuid + "backend",
+			NamespaceID:      namespace.RootNamespaceID,
+			namespace:        namespace.RootNamespace,
+			Local:            local,
+		}
+	}
+
+	c.auth = &MountTable{
+		Type: credentialTableType,
+		Entries: []*MountEntry{
+			createMountEntry("/noop1", "abcd", mountAccessor1, false),
+			createMountEntry("/noop2", "ghij", mountAccessor2, false),
+			createMountEntry("/noop3", "mnop", mountAccessor3, true),
+		},
+	}
+
+	require.NoError(t, c.setupCredentials(context.Background()))
+
+	// Create an entity
+	req := &logical.Request{
+		ClientToken: root,
+		Operation:   logical.UpdateOperation,
+		Path:        "entity",
+		Data: map[string]interface{}{
+			"name": "alice",
+		},
+	}
+
+	resp, err := c.identityStore.HandleRequest(ctx, req)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Contains(t, resp.Data, "id")
+
+	entityID := resp.Data["id"].(string)
+
+	createEntityAlias := func(name, mountAccessor string) string {
+		req = &logical.Request{
+			ClientToken: root,
+			Operation:   logical.UpdateOperation,
+			Path:        "entity-alias",
+			Data: map[string]interface{}{
+				"name":           name,
+				"canonical_id":   entityID,
+				"mount_accessor": mountAccessor,
+			},
+		}
+
+		resp, err = c.identityStore.HandleRequest(ctx, req)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Contains(t, resp.Data, "id")
+
+		return resp.Data["id"].(string)
+	}
+
+	alias1ID := createEntityAlias("alias1", mountAccessor1)
+	alias2ID := createEntityAlias("alias2", mountAccessor2)
+	alias3ID := createEntityAlias("alias3", mountAccessor3)
+
+	// Update the entity in storage only to remove alias2 then call invalidate
+	bucketKey := c.identityStore.entityPacker.BucketKey(entityID)
+	bucket, err := c.identityStore.entityPacker.GetBucket(context.Background(), bucketKey)
+	require.NoError(t, err)
+	require.NotNil(t, bucket)
+
+	bucketEntityItem := bucket.Items[0] // since there's only 1 entity
+	bucketEntity, err := c.identityStore.parseEntityFromBucketItem(context.Background(), bucketEntityItem)
+	require.NoError(t, err)
+	require.NotNil(t, bucketEntity)
+
+	replacementAliases := make([]*identity.Alias, 1)
+	for _, a := range bucketEntity.Aliases {
+		if a.ID != alias2ID {
+			replacementAliases[0] = a
+			break
+		}
+	}
+
+	bucketEntity.Aliases = replacementAliases
+
+	bucketEntityItem.Message, err = anypb.New(bucketEntity)
+	require.NoError(t, err)
+
+	require.NoError(t, c.identityStore.entityPacker.PutItem(context.Background(), bucketEntityItem))
+
+	c.identityStore.Invalidate(context.Background(), bucketKey)
+
+	alias1, err := c.identityStore.MemDBAliasByID(alias1ID, false, false)
+	assert.NoError(t, err)
+	assert.NotNil(t, alias1)
+
+	alias2, err := c.identityStore.MemDBAliasByID(alias2ID, false, false)
+	assert.NoError(t, err)
+	assert.Nil(t, alias2)
+
+	alias3, err := c.identityStore.MemDBAliasByID(alias3ID, false, false)
+	assert.NoError(t, err)
+	assert.NotNil(t, alias3)
+}
+
+// TestIdentityStoreInvalidate_EntityLocalAliasDelete verifies that the
+// invalidateLocalAliasesBucket method properly cleans up aliases from
+// MemDB that are no longer associated with the entity in the
+// storage bucket.
+func TestIdentityStoreInvalidate_EntityLocalAliasDelete(t *testing.T) {
+	ctx := namespace.ContextWithNamespace(context.Background(), namespace.RootNamespace)
+	c, _, root := TestCoreUnsealed(t)
+
+	// Enable a No-Op auth method
+	c.credentialBackends["noop"] = func(context.Context, *logical.BackendConfig) (logical.Backend, error) {
+		return &NoopBackend{
+			BackendType: logical.TypeCredential,
+		}, nil
+	}
+	mountAccessor1 := "noop-accessor1"
+	mountAccessor2 := "noop-accessor2"
+	mountAccessor3 := "noon-accessor3"
+
+	createMountEntry := func(path, uuid, mountAccessor string, local bool) *MountEntry {
+		return &MountEntry{
+			Table:            credentialTableType,
+			Path:             path,
+			Type:             "noop",
+			UUID:             uuid,
+			Accessor:         mountAccessor,
+			BackendAwareUUID: uuid + "backend",
+			NamespaceID:      namespace.RootNamespaceID,
+			namespace:        namespace.RootNamespace,
+			Local:            local,
+		}
+	}
+
+	c.auth = &MountTable{
+		Type: credentialTableType,
+		Entries: []*MountEntry{
+			createMountEntry("/noop1", "abcd", mountAccessor1, true),
+			createMountEntry("/noop2", "ghij", mountAccessor2, true),
+			createMountEntry("/noop3", "mnop", mountAccessor3, true),
+		},
+	}
+
+	require.NoError(t, c.setupCredentials(context.Background()))
+
+	// Create an entity
+	req := &logical.Request{
+		ClientToken: root,
+		Operation:   logical.UpdateOperation,
+		Path:        "entity",
+		Data: map[string]interface{}{
+			"name": "alice",
+		},
+	}
+
+	resp, err := c.identityStore.HandleRequest(ctx, req)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.Contains(t, resp.Data, "id")
+
+	entityID := resp.Data["id"].(string)
+
+	createEntityAlias := func(name, mountAccessor string) string {
+		req = &logical.Request{
+			ClientToken: root,
+			Operation:   logical.UpdateOperation,
+			Path:        "entity-alias",
+			Data: map[string]interface{}{
+				"name":           name,
+				"canonical_id":   entityID,
+				"mount_accessor": mountAccessor,
+			},
+		}
+
+		resp, err = c.identityStore.HandleRequest(ctx, req)
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.Contains(t, resp.Data, "id")
+
+		return resp.Data["id"].(string)
+	}
+
+	alias1ID := createEntityAlias("alias1", mountAccessor1)
+	alias2ID := createEntityAlias("alias2", mountAccessor2)
+	alias3ID := createEntityAlias("alias3", mountAccessor3)
+
+	for i, aliasID := range []string{alias1ID, alias2ID, alias3ID} {
+		alias, err := c.identityStore.MemDBAliasByID(aliasID, false, false)
+		require.NoError(t, err, i)
+		require.NotNil(t, alias, i)
+	}
+
+	// // Update the entity in storage only to remove alias2 then call invalidate
+	bucketKey := c.identityStore.entityPacker.BucketKey(entityID)
+	bucket, err := c.identityStore.entityPacker.GetBucket(context.Background(), bucketKey)
+	require.NoError(t, err)
+	require.NotNil(t, bucket)
+
+	bucketEntityItem := bucket.Items[0] // since there's only 1 entity
+	bucketEntity, err := c.identityStore.parseEntityFromBucketItem(context.Background(), bucketEntityItem)
+	require.NoError(t, err)
+	require.NotNil(t, bucketEntity)
+
+	bucketKey = c.identityStore.localAliasPacker.BucketKey(entityID)
+	bucketLocalAlias, err := c.identityStore.localAliasPacker.GetBucket(context.Background(), bucketKey)
+	require.NoError(t, err)
+	require.NotNil(t, bucketLocalAlias)
+
+	bucketLocalAliasItem := bucketLocalAlias.Items[0]
+	require.Equal(t, entityID, bucketLocalAliasItem.ID)
+
+	var localAliases identity.LocalAliases
+
+	err = anypb.UnmarshalTo(bucketLocalAliasItem.Message, &localAliases, proto.UnmarshalOptions{})
+	require.NoError(t, err)
+
+	memDBEntity, err := c.identityStore.MemDBEntityByID(entityID, false)
+	require.NoError(t, err)
+	require.NotNil(t, memDBEntity)
+
+	replacementAliases := make([]*identity.Alias, 0)
+	for _, a := range memDBEntity.Aliases {
+		if a.ID != alias2ID {
+			replacementAliases = append(replacementAliases, a)
+		}
+	}
+
+	localAliases.Aliases = replacementAliases
+
+	bucketLocalAliasItem.Message, err = anypb.New(&localAliases)
+	require.NoError(t, err)
+
+	require.NoError(t, c.identityStore.localAliasPacker.PutItem(context.Background(), bucketLocalAliasItem))
+
+	c.identityStore.Invalidate(context.Background(), bucketKey)
+
+	alias1, err := c.identityStore.MemDBAliasByID(alias1ID, false, false)
+	assert.NoError(t, err)
+	assert.NotNil(t, alias1)
+
+	alias2, err := c.identityStore.MemDBAliasByID(alias2ID, false, false)
+	assert.NoError(t, err)
+	assert.Nil(t, alias2)
+
+	alias3, err := c.identityStore.MemDBAliasByID(alias3ID, false, false)
+	assert.NoError(t, err)
+	assert.NotNil(t, alias3)
+}
+
+// TestIdentityStoreInvalidate_LocalAliasesWithEntity verifies the correct
+// handling of local aliases in the Invalidate method.
+func TestIdentityStoreInvalidate_LocalAliasesWithEntity(t *testing.T) {
+	c, _, _ := TestCoreUnsealed(t)
+
+	// Create an entity in storage then call the Invalidate function
+	//
+	entityID, err := uuid.GenerateUUID()
+	require.NoError(t, err)
+
+	entity := &identity.Entity{
+		Name:        "test",
+		NamespaceID: namespace.RootNamespaceID,
+		ID:          entityID,
+		Aliases:     []*identity.Alias{},
+		BucketKey:   c.identityStore.entityPacker.BucketKey(entityID),
+	}
+
+	aliasID, err := uuid.GenerateUUID()
+	require.NoError(t, err)
+
+	localAliases := &identity.LocalAliases{
+		Aliases: []*identity.Alias{
+			{
+				ID:            aliasID,
+				Name:          "test",
+				NamespaceID:   namespace.RootNamespaceID,
+				CanonicalID:   entityID,
+				MountAccessor: "userpass-000000",
+			},
+		},
+	}
+
+	ep := c.identityStore.entityPacker
+
+	// Persist the entity which we are merging to
+	entityAsAny, err := anypb.New(entity)
+	require.NoError(t, err)
+
+	entityItem := &storagepacker.Item{
+		ID:      entityID,
+		Message: entityAsAny,
+	}
+
+	err = ep.PutItem(context.Background(), entityItem)
+	require.NoError(t, err)
+
+	c.identityStore.Invalidate(context.Background(), ep.BucketKey(entityID))
+
+	lap := c.identityStore.localAliasPacker
+
+	localAliasesAsAny, err := anypb.New(localAliases)
+	require.NoError(t, err)
+
+	localAliasesItem := &storagepacker.Item{
+		ID:      entityID,
+		Message: localAliasesAsAny,
+	}
+
+	err = lap.PutItem(context.Background(), localAliasesItem)
+	require.NoError(t, err)
+
+	c.identityStore.Invalidate(context.Background(), lap.BucketKey(entityID))
+
+	txn := c.identityStore.db.Txn(true)
+
+	memDBEntity, err := c.identityStore.MemDBEntityByIDInTxn(txn, entityID, true)
+	assert.NoError(t, err)
+	assert.NotNil(t, memDBEntity)
+
+	memDBLocalAlias, err := c.identityStore.MemDBAliasByIDInTxn(txn, aliasID, true, false)
+	assert.NoError(t, err)
+	assert.NotNil(t, memDBLocalAlias)
+	assert.Equal(t, 1, len(memDBEntity.Aliases))
+	assert.NotNil(t, memDBEntity.Aliases[0])
+	assert.Equal(t, memDBEntity.Aliases[0].ID, memDBLocalAlias.ID)
+
+	txn.Commit()
+}
+
+// TestIdentityStoreInvalidate_TemporaryEntity verifies the proper handling of
+// temporary entities in the Invalidate method.
+func TestIdentityStoreInvalidate_TemporaryEntity(t *testing.T) {
+	c, _, _ := TestCoreUnsealed(t)
+
+	// Create an entity in storage then call the Invalidate function
+	//
+	entityID, err := uuid.GenerateUUID()
+	require.NoError(t, err)
+
+	tempEntity := &identity.Entity{
+		Name:        "test",
+		NamespaceID: namespace.RootNamespaceID,
+		ID:          entityID,
+		Aliases:     []*identity.Alias{},
+		BucketKey:   c.identityStore.entityPacker.BucketKey(entityID),
+	}
+
+	lap := c.identityStore.localAliasPacker
+	ep := c.identityStore.entityPacker
+
+	// Persist the entity which we are merging to
+	tempEntityAsAny, err := anypb.New(tempEntity)
+	require.NoError(t, err)
+
+	tempEntityItem := &storagepacker.Item{
+		ID:      entityID + tmpSuffix,
+		Message: tempEntityAsAny,
+	}
+
+	err = lap.PutItem(context.Background(), tempEntityItem)
+	require.NoError(t, err)
+
+	entityAsAny := tempEntityAsAny
+
+	entityItem := &storagepacker.Item{
+		ID:      entityID,
+		Message: entityAsAny,
+	}
+
+	err = ep.PutItem(context.Background(), entityItem)
+	require.NoError(t, err)
+
+	c.identityStore.Invalidate(context.Background(), ep.BucketKey(entityID))
+
+	txn := c.identityStore.db.Txn(true)
+
+	memDBEntity, err := c.identityStore.MemDBEntityByIDInTxn(txn, entityID, true)
+	assert.NoError(t, err)
+	assert.NotNil(t, memDBEntity)
+
+	item, err := lap.GetItem(lap.BucketKey(entityID) + tmpSuffix)
+	assert.NoError(t, err)
+	assert.Nil(t, item)
+}
+
+// TestIdentityStoreLoadingIsDeterministic tests the default error resolver and
+// the identity cleanup rename resolver to ensure that loading is deterministic
+// for both.
+func TestIdentityStoreLoadingIsDeterministic(t *testing.T) {
+	seedval := rand.Int63()
+	if os.Getenv("VAULT_TEST_IDENTITY_STORE_SEED") != "" {
+		var err error
+		seedval, err = strconv.ParseInt(os.Getenv("VAULT_TEST_IDENTITY_STORE_SEED"), 10, 64)
+		require.NoError(t, err)
+	}
+	defer t.Logf("Test generated with seed: %d", seedval)
+
+	tests := map[string]*determinismTestFlags{
+		"error-resolver-primary": {
+			identityDeduplication: false,
+			secondary:             false,
+		},
+		"identity-cleanup-primary": {
+			identityDeduplication: true,
+			secondary:             false,
+		},
+	}
+
+	// Hook to add cases that only differ in Enterprise
+	if entIdentityStoreDeterminismSupportsSecondary() {
+		tests["error-resolver-secondary"] = &determinismTestFlags{
+			identityDeduplication: false,
+			secondary:             true,
+		}
+		tests["identity-cleanup-secondary"] = &determinismTestFlags{
+			identityDeduplication: true,
+			secondary:             true,
+		}
+	}
+
+	repeats := 50
+
+	for name, flags := range tests {
+		t.Run(t.Name()+"-"+name, func(t *testing.T) {
+			// Create a random source specific to this test case so every test case
+			// starts out from the identical random state given the same seed. We do
+			// want each iteration to explore different path though so we do it here
+			// not inside the test func.
+			seed := rand.New(rand.NewSource(seedval)) // Seed for deterministic test
+			flags.seed = seed
+
+			for i := 0; i < repeats; i++ {
+				identityStoreLoadingIsDeterministic(t, flags)
+			}
+		})
+	}
+}
+
+type determinismTestFlags struct {
+	identityDeduplication bool
+	secondary             bool
+	seed                  *rand.Rand
+}
+
+// identityStoreLoadingIsDeterministic is a property-based test helper that
+// ensures the loading logic of the entity store is deterministic. This is
+// important because we perform certain merges and corrections of duplicates on
+// load and non-deterministic order can cause divergence between different nodes
+// or even after seal/unseal cycles on one node. Loading _should_ be
+// deterministic anyway if all data in storage was correct see comments inline
+// for examples of ways storage can be corrupt with respect to the expected
+// schema invariants.
+func identityStoreLoadingIsDeterministic(t *testing.T, flags *determinismTestFlags) {
+	// Create some state in store that could trigger non-deterministic behavior.
+	// The nature of the identity store schema is such that the order of loading
+	// entities etc shouldn't matter even if it was non-deterministic, however due
+	// to many and varied historical (and possibly current/future) bugs, we have
+	// seen many cases where storage ends up with duplicates persisted. This is
+	// not ideal of course and our code attempts to "fix" on the fly with merges
+	// on load. But it's hampered by the fact that the current implementation does
+	// not load entities in a deterministic order. which means that different
+	// nodes potentially resolve merges differently. This test proves that that
+	// happens and should hopefully provide some confidence that we don't
+	// introduce non-determinism in the future somehow. It's a bit odd we have to
+	// inject essentially invalid data into storage to trigger the issue but
+	// that's what we get in real life sometimes!
+	logger := corehelpers.NewTestLogger(t)
+	ims, err := inmem.NewTransactionalInmemHA(nil, logger)
+	require.NoError(t, err)
+
+	cfg := &CoreConfig{
+		Physical:        ims,
+		HAPhysical:      ims.(physical.HABackend),
+		Logger:          logger,
+		BuiltinRegistry: corehelpers.NewMockBuiltinRegistry(),
+		CredentialBackends: map[string]logical.Factory{
+			"userpass": credUserpass.Factory,
+		},
+	}
+
+	c, sealKeys, rootToken := TestCoreUnsealedWithConfig(t, cfg)
+
+	// Inject values into storage
+	upme, err := TestUserpassMount(c, false)
+	require.NoError(t, err)
+	localMe, err := TestUserpassMount(c, true)
+	require.NoError(t, err)
+
+	ctx := context.Background()
+
+	seed := flags.seed
+	identityDeduplication := flags.identityDeduplication
+	secondary := flags.secondary
+
+	// We create 100 entities each with 1 non-local alias and 1 local alias. We
+	// then randomly create duplicate alias or local alias entries with a
+	// probability that is unrealistic but ensures we have duplicates on every
+	// test run with high probability and more than 1 duplicate often.
+	for i := 0; i <= 100; i++ {
+		name := fmt.Sprintf("entity-%d", i)
+		alias := fmt.Sprintf("alias-%d", i)
+		localAlias := fmt.Sprintf("localalias-%d", i)
+		e := makeEntityForPacker(t, name, c.identityStore.entityPacker, seed)
+		attachAlias(t, e, alias, upme, seed)
+		attachAlias(t, e, localAlias, localMe, seed)
+
+		err = c.identityStore.persistEntity(ctx, e)
+		require.NoError(t, err)
+
+		// Subset of entities get a duplicate alias and/or duplicate local alias.
+		// We'll use a probability of 0.3 for each dup so that we expect at least a
+		// few double and maybe triple duplicates of each type every few test runs
+		// and may have duplicates of both types or neither etc.
+		pDup := 0.3
+		rnd := seed.Float64()
+		dupeNum := 0
+		for rnd < pDup && dupeNum < 10 {
+			e := makeEntityForPacker(t, fmt.Sprintf("entity-%d-dup-%d", i, dupeNum), c.identityStore.entityPacker, seed)
+			thisAlias := alias
+			if dupeNum%2 == 0 {
+				// Make some of the aliases be different-case dupes as that causes
+				// different loading code paths now (causes reload after de-duplication
+				// to persist the new merges).
+				thisAlias = strings.ToUpper(alias)
+			}
+			attachAlias(t, e, thisAlias, upme, seed)
+
+			err = c.identityStore.persistEntity(ctx, e)
+			require.NoError(t, err)
+			// Toss again to see if we continue
+			rnd = seed.Float64()
+			dupeNum++
+		}
+		// Toss the coin again to see if there are any local dupes
+		dupeNum = 0
+		rnd = seed.Float64()
+		for rnd < pDup && dupeNum < 10 {
+			e := makeEntityForPacker(t, fmt.Sprintf("entity-%d-localdup-%d", i, dupeNum), c.identityStore.entityPacker, seed)
+			attachAlias(t, e, localAlias, localMe, seed)
+			err = c.identityStore.persistEntity(ctx, e)
+			require.NoError(t, err)
+
+			rnd = seed.Float64()
+			dupeNum++
+		}
+		// See if we should add entity _name_ duplicates too (with no aliases)
+		dupeNum = 0
+		rnd = seed.Float64()
+		for rnd < pDup && dupeNum < 10 {
+			e := makeEntityForPacker(t, name, c.identityStore.entityPacker, seed)
+			err = c.identityStore.persistEntity(ctx, e)
+			require.NoError(t, err)
+			rnd = seed.Float64()
+			dupeNum++
+		}
+
+		// One more edge case is that it's currently possible as of the time of
+		// writing for a failure during entity invalidation to result in a permanent
+		// "cached" entity in the local alias packer even though we do have the
+		// replicated entity in the entity packer too. This is a bug and will
+		// hopefully be fixed at some point soon, but even after it is it's
+		// important that we still test for it since existing clusters may still
+		// have this persistent state. Pick a low probability but one we're very
+		// likely to hit in 100 iterations and write the entity to the local alias
+		// table too (this mimics the behavior of cacheTemporaryEntity).
+		pFailedLocalAliasInvalidation := 0.02
+		if rand.Float64() < pFailedLocalAliasInvalidation {
+			err = TestHelperWriteToStoragePacker(ctx, c.identityStore.localAliasPacker, e.ID+tmpSuffix, e)
+			require.NoError(t, err)
+		}
+	}
+
+	// Create some groups
+	for i := 0; i <= 100; i++ {
+		name := fmt.Sprintf("group-%d", i)
+		// Add an alias to every other group
+		alias := ""
+		if i%2 == 0 {
+			alias = fmt.Sprintf("groupalias-%d", i)
+		}
+		e := makeGroupWithNameAndAlias(t, name, alias, c.identityStore.groupPacker, upme, seed)
+		err = TestHelperWriteToStoragePacker(ctx, c.identityStore.groupPacker, e.ID, e)
+		require.NoError(t, err)
+	}
+	// Now add 10 groups with the same alias to ensure duplicates don't cause
+	// non-deterministic behavior.
+	for i := 0; i <= 10; i++ {
+		name := fmt.Sprintf("group-dup-%d", i)
+		e := makeGroupWithNameAndAlias(t, name, "groupalias-dup", c.identityStore.groupPacker, upme, seed)
+		err = TestHelperWriteToStoragePacker(ctx, c.identityStore.groupPacker, e.ID, e)
+		require.NoError(t, err)
+	}
+	// Add a second and third groups with duplicate names too.
+	for _, name := range []string{"group-0", "group-1", "group-1"} {
+		e := makeGroupWithNameAndAlias(t, name, "", c.identityStore.groupPacker, upme, seed)
+		err = TestHelperWriteToStoragePacker(ctx, c.identityStore.groupPacker, e.ID, e)
+		require.NoError(t, err)
+	}
+
+	if secondary {
+		entIdentityStoreDeterminismSecondaryTestSetup(t, ctx, c, upme, localMe, seed)
+	}
+
+	// Storage is now primed for the test.
+	require.NoError(t, c.Seal(rootToken))
+	require.True(t, c.Sealed())
+	for _, key := range sealKeys {
+		unsealed, err := c.Unseal(key)
+		require.NoError(t, err, "failed unseal on initial assertions")
+		if unsealed {
+			break
+		}
+	}
+	require.False(t, c.Sealed())
+
+	// Make sure all entity and group names have a valid format either with or
+	// without their UUID (after a deduplication renamed them). We never name
+	// things with more than 36 chars so force that so that this won't match an
+	// entity with multiple copies of the UUID appended. (UUIDs are 36 chars
+	// long so we add 37 chars with hyphen on a rename.)
+	nameRE := regexp.MustCompile(
+		`^[A-Za-z0-9-_]{1,36}` + // The original entity/group name.
+			`(-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})?$`, // optional hyphen, UUID
+	)
+	// Safety check for the regex - it must match a normally renamed entity but
+	// not one that's been accidentally renamed twice.
+	require.NotNil(t, nameRE.FindStringSubmatch("entity-234-ee337176-334a-49c6-7f16-0beffb91509a"))
+	require.Nil(t, nameRE.FindStringSubmatch("entity-234-ee337176-334a-49c6-7f16-0beffb91509a-ee337176-334a-49c6-7f16-0beffb91509a"))
+
+	if identityDeduplication {
+		// Perform an initial Seal/Unseal with duplicates injected to assert
+		// initial state.
+
+		// Test out the system backend ActivationFunc wiring
+		c.FeatureActivationFlags.ActivateInMem(activationflags.IdentityDeduplication, true)
+		require.NoError(t, err)
+
+		c.identityStore.MakeDeduplicationDoneChan()
+		err := c.systemBackend.activateIdentity(ctx, nil, activationflags.IdentityDeduplication)
+		require.NoError(t, err)
+		err = c.identityStore.WaitForActivateDeduplicationDone(ctx)
+		require.NoError(t, err)
+		require.IsType(t, &renameResolver{}, c.identityStore.conflictResolver)
+		require.False(t, c.identityStore.disableLowerCasedNames)
+	}
+
+	// To test that this is deterministic we need to load from storage a bunch of
+	// times and make sure we get the same result. For easier debugging we'll
+	// build a list of human readable ids that we can compare.
+	prevLoadedNames := []string{}
+	var prevErr error
+
+	for i := 0; i < 10; i++ {
+		err := c.identityStore.resetDB()
+		require.NoError(t, err)
+
+		logger.Info(" ==> BEGIN LOAD ARTIFACTS", "i", i)
+
+		err = c.identityStore.loadArtifacts(ctx, true)
+
+		if i > 0 {
+			require.Equal(t, prevErr, err)
+		}
+		prevErr = err
+
+		// Try to drain the channel if it's been created (if deduplication was
+		// enabled), but don't block in case it wasn't!
+		select {
+		case <-c.identityStore.activateDeduplicationDone:
+		default:
+		}
+		logger.Info(" ==> END LOAD ARTIFACTS ", "i", i)
+
+		// Identity store should be loaded now. Check its contents.
+		loadedNames := []string{}
+		numRenames := 0
+
+		tx := c.identityStore.db.Txn(false)
+
+		// Entities + their aliases
+		iter, err := tx.LowerBound(entitiesTable, "id", "")
+		require.NoError(t, err)
+		for item := iter.Next(); item != nil; item = iter.Next() {
+			e := item.(*identity.Entity)
+			loadedNames = append(loadedNames, e.NamespaceID+"/"+e.Name+"_"+e.ID)
+			for _, a := range e.Aliases {
+				loadedNames = append(loadedNames, a.MountAccessor+"/"+a.Name+"_"+a.ID)
+			}
+
+			// Name must match expected
+			matches := nameRE.FindStringSubmatch(e.Name)
+			require.NotNil(t, matches, "unexpected entity name: %s", e.Name)
+			if len(matches) > 1 {
+				// We have a UUID suffix so this was a rename
+				numRenames++
+			}
+		}
+
+		// Standalone alias query
+		iter, err = tx.LowerBound(entityAliasesTable, "id", "")
+		require.NoError(t, err)
+		for item := iter.Next(); item != nil; item = iter.Next() {
+			a := item.(*identity.Alias)
+			loadedNames = append(loadedNames, "fromAliasTable:"+a.MountAccessor+"/"+a.Name+"_"+a.ID)
+		}
+
+		// This is a non-triviality check to make sure we actually loaded stuff and
+		// are not just passing because of a bug in the test.
+		numLoaded := len(loadedNames)
+		require.Greater(t, numLoaded, 300, "not enough entities and aliases loaded on attempt %d", i)
+
+		// Groups
+		iter, err = tx.LowerBound(groupsTable, "id", "")
+		require.NoError(t, err)
+		for item := iter.Next(); item != nil; item = iter.Next() {
+			g := item.(*identity.Group)
+			loadedNames = append(loadedNames, g.Name)
+			if g.Alias != nil {
+				loadedNames = append(loadedNames, g.Alias.Name)
+			}
+
+			// Name must match expected
+			matches := nameRE.FindStringSubmatch(g.Name)
+			require.NotNil(t, matches, "unexpected group name: %s", g.Name)
+			if len(matches) > 1 {
+				// We have a UUID suffix so this was a rename
+				numRenames++
+			}
+		}
+
+		// This is a non-triviality check to make sure we actually loaded stuff and
+		// are not just passing because of a bug in the test.
+		groupsLoaded := len(loadedNames) - numLoaded
+		require.Greater(t, groupsLoaded, 140, "not enough groups and aliases loaded on attempt %d", i)
+
+		// note `lastIDs` argument is not needed anymore but we can't change the
+		// signature without breaking enterprise. It's simpler to keep it unused
+		// for now until both parts of this merge.
+		if secondary {
+			entIdentityStoreDeterminismSecondaryAssert(t, i, loadedNames, nil)
+		}
+
+		if i > 0 {
+			// Should be in the same order if we are deterministic since MemDB has strong ordering.
+			require.Equal(t, prevLoadedNames, loadedNames, "different result on attempt %d", i)
+		}
+
+		if identityDeduplication {
+			// Verify that at least _some_ renamed occurred and ended up with the right
+			// format. A previous version tried to work out an exact bound but that
+			// makes things more complex as Ent is different to CE and doesn't add
+			// much value over checking at least _some_ are present. The length check
+			// above finds the case where we double-renamed and add a second UUID
+			// suffix so we don't need to worry about "missing" that we also have
+			// extra invalid format renames here.
+			require.GreaterOrEqual(t, numRenames, 1, "not enough renamed entities and groups with expected format on attempt: %d", i)
+		}
+
+		prevLoadedNames = loadedNames
+	}
+}
+
+// TestIdentityStoreLoadingDuplicateReporting tests the reporting of different
+// types of duplicates during unseal when in case-sensitive mode.
+func TestIdentityStoreLoadingDuplicateReporting(t *testing.T) {
+	logger := corehelpers.NewTestLogger(t)
+	ims, err := inmem.NewTransactionalInmemHA(nil, logger)
+	require.NoError(t, err)
+
+	cfg := &CoreConfig{
+		Physical:        ims,
+		HAPhysical:      ims.(physical.HABackend),
+		Logger:          logger,
+		BuiltinRegistry: corehelpers.NewMockBuiltinRegistry(),
+		CredentialBackends: map[string]logical.Factory{
+			"userpass": credUserpass.Factory,
+		},
+	}
+
+	c, _, rootToken := TestCoreUnsealedWithConfig(t, cfg)
+
+	// Inject values into storage
+	upme, err := TestUserpassMount(c, false)
+	require.NoError(t, err)
+	localMe, err := TestUserpassMount(c, true)
+	require.NoError(t, err)
+
+	ctx := namespace.RootContext(nil)
+
+	seedval := rand.Int63()
+	if os.Getenv("VAULT_TEST_IDENTITY_STORE_SEED") != "" {
+		seedval, err = strconv.ParseInt(os.Getenv("VAULT_TEST_IDENTITY_STORE_SEED"), 10, 64)
+		require.NoError(t, err)
+	}
+	seed := rand.New(rand.NewSource(seedval)) // Seed for deterministic test
+	defer t.Logf("Test generated with seed %d", seedval)
+	identityCreateCaseDuplicates(t, ctx, c, upme, localMe, seed)
+
+	entIdentityStoreDuplicateReportTestSetup(t, ctx, c, rootToken, seed)
+
+	// Storage is now primed for the test.
+
+	// Setup a logger we can use to capture unseal logs
+	logBuf, stopCapture := startLogCapture(t, logger)
+
+	err = c.identityStore.loadArtifacts(ctx, true)
+	stopCapture()
+
+	require.NoError(t, err)
+
+	// Identity store should be loaded now. Check it's contents.
+
+	// We don't expect any actual behavior change just logs reporting duplicates.
+	// We could assert the current "expected" behavior but it's actually broken in
+	// many of these cases and seems strange to encode in a test that we want
+	// broken behavior!
+	numDupes := make(map[string]int)
+	duplicateCountRe := regexp.MustCompile(`(\d+) (different-case( local)? entity alias|entity|group) duplicates found`)
+	for _, log := range logBuf.Lines() {
+		if matches := duplicateCountRe.FindStringSubmatch(log); len(matches) >= 3 {
+			num, _ := strconv.Atoi(matches[1])
+			numDupes[matches[2]] = num
+		}
+	}
+	t.Logf("numDupes: %v", numDupes)
+	wantAliases, wantLocalAliases, wantEntities, wantGroups := identityStoreDuplicateReportTestWantDuplicateCounts()
+	require.Equal(t, wantLocalAliases, numDupes["different-case local entity alias"])
+	require.Equal(t, wantAliases, numDupes["different-case entity alias"])
+	require.Equal(t, wantEntities, numDupes["entity"])
+	require.Equal(t, wantGroups, numDupes["group"])
+}
+
+// logFn is a type we used to use here before concurrentLogBuffer was added.
+// It's used in other tests in Enterprise so we need to keep it around to avoid
+// breaking the build during merge
+type logFn struct {
+	fn func(msg string, args []interface{})
+}
+
+func (f *logFn) Accept(name string, level hclog.Level, msg string, args ...interface{}) {
+	f.fn(msg, args)
+}
+
+// concrrentLogBuffer is a simple hclog sink that captures log output in an
+// slice of lines in a goroutine-safe way. Use `startLogCapture` to use it.
+type concurrentLogBuffer struct {
+	m sync.Mutex
+	b []string
+}
+
+// Accept implements hclog.SinkAdapter
+func (c *concurrentLogBuffer) Accept(name string, level hclog.Level, msg string, args ...interface{}) {
+	pairs := make([]string, 0, len(args)/2)
+	for pair := range slices.Chunk(args, 2) {
+		// Yes this will panic if we didn't log an even number of args but thats
+		// OK because that's a bug!
+		pairs = append(pairs, fmt.Sprintf("%s=%s", pair[0], pair[1]))
+	}
+	line := fmt.Sprintf("%s: %s", msg, strings.Join(pairs, " "))
+
+	c.m.Lock()
+	defer c.m.Unlock()
+
+	c.b = append(c.b, line)
+}
+
+// Lines returns all the lines logged since starting the capture.
+func (c *concurrentLogBuffer) Lines() []string {
+	c.m.Lock()
+	defer c.m.Unlock()
+
+	return c.b
+}
+
+// startLogCaptue attaches a logFn to the logger and returns a channel that will
+// be sent each line of log output in a basec flat text format. It returns a
+// cancel/stop func that should be called when capture should stop or at the end
+// of processing.
+func startLogCapture(t *testing.T, logger *corehelpers.TestLogger) (*concurrentLogBuffer, func()) {
+	t.Helper()
+	b := &concurrentLogBuffer{
+		b: make([]string, 0, 1024),
+	}
+	logger.RegisterSink(b)
+	stop := func() {
+		logger.DeregisterSink(b)
+	}
+	return b, stop
+}
diff --git a/vault/identity_store_test_stubs_oss.go b/vault/identity_store_test_stubs_oss.go
new file mode 100644
index 00000000000..d9f6c8168e8
--- /dev/null
+++ b/vault/identity_store_test_stubs_oss.go
@@ -0,0 +1,47 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"context"
+	"math/rand"
+	"testing"
+)
+
+//go:generate go run github.com/hashicorp/vault/tools/stubmaker
+
+// entIdentityStoreDeterminismSupportsSecondary is a hack to drop duplicate
+// tests in CE where the secondary param will only cause the no-op methods below
+// to run which is functionally the same. It would be cleaner to define
+// different tests in CE and ENT but it's a table test with customer test-only
+// struct types which makes it a massive pain to have ent-ce specific code
+// interact with the test arguments.
+func entIdentityStoreDeterminismSupportsSecondary() bool {
+	return false
+}
+
+func entIdentityStoreDeterminismSecondaryTestSetup(t *testing.T, ctx context.Context, c *Core, me, localme *MountEntry, seed *rand.Rand) {
+	// no op
+}
+
+func entIdentityStoreDeterminismSecondaryAssert(t *testing.T, i int, loadedIDs, lastIDs []string) {
+	// no op
+}
+
+func entIdentityStoreDuplicateReportTestSetup(t *testing.T, ctx context.Context, c *Core, rootToken string, seed *rand.Rand) {
+	// no op
+}
+
+func identityStoreDuplicateReportTestWantDuplicateCounts() (int, int, int, int) {
+	// Note that the second count is for local aliases. CE Vault doesn't really
+	// distinguish between local and non-local aliases because it doesn't have any
+	// support for Performance Replication. But it's possible in code at least to
+	// set the local flag on a mount or alias during creation so we might as well
+	// test it behaves as expected in the CE code. It's maybe just about possible
+	// that this could happen in real life too because of a downgrade from
+	// Enterprise.
+	return 1, 1, 1, 1
+}
diff --git a/vault/identity_store_upgrade.go b/vault/identity_store_upgrade.go
index 33ed55ce184..20fe4c34176 100644
--- a/vault/identity_store_upgrade.go
+++ b/vault/identity_store_upgrade.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/identity_store_util.go b/vault/identity_store_util.go
index f39c1e26046..28baf3484a1 100644
--- a/vault/identity_store_util.go
+++ b/vault/identity_store_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -7,8 +7,10 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"math/rand"
 	"strings"
 	"sync"
+	"testing"
 	"time"
 
 	metrics "github.com/armon/go-metrics"
@@ -17,68 +19,205 @@ import (
 	memdb "github.com/hashicorp/go-memdb"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	uuid "github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/helper/activationflags"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/identity/mfa"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/storagepacker"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 var (
-	errDuplicateIdentityName = errors.New("duplicate identity name")
-	errCycleDetectedPrefix   = "cyclic relationship detected for member group ID"
-	tmpSuffix                = ".tmp"
+	errCycleDetectedPrefix = "cyclic relationship detected for member group ID"
+	tmpSuffix              = ".tmp"
+	entityLoadingTxMaxSize = 1024
 )
 
-func (c *Core) loadIdentityStoreArtifacts(ctx context.Context) error {
-	if c.identityStore == nil {
-		c.logger.Warn("identity store is not setup, skipping loading")
+// loadArtifacts is responsible for loading entities, groups, and aliases from
+// storage into MemDB.
+func (i *IdentityStore) loadArtifacts(ctx context.Context, isActive bool) error {
+	if i == nil {
+		return nil
+	}
+
+	loadFuncEntities := func(context.Context) error {
+		reload, err := i.loadEntities(ctx, isActive, false)
+		if err != nil {
+			return fmt.Errorf("failed to load entities: %w", err)
+		}
+		if reload {
+			// The persistMerges flag is used to fix a non-determinism issue in
+			// duplicate entities with global alias merges. This does not solve the
+			// case for local alias merges. Previously, alias merges could
+			// inconsistently flip between nodes due to bucket invalidation and
+			// reprocessing on standbys, leading to divergence from the primary. This
+			// flag ensures deterministic merges across all nodes by preventing
+			// unintended reinsertions of previously merged entities during bucket
+			// diffs.
+			persistMerges := false
+			if !i.localNode.ReplicationState().HasState(
+				consts.ReplicationDRSecondary|
+					consts.ReplicationPerformanceSecondary,
+			) && isActive {
+				persistMerges = true
+			}
+
+			// Since we're reloading entities, we need to inform the ConflictResolver
+			// about it so that it can clean up data related to the previous load.
+			i.conflictResolver.Reload(ctx)
+
+			// We also need to start again from empty state or wild things can happen!
+			if err := i.resetDB(); err != nil {
+				return err
+			}
+
+			_, err := i.loadEntities(ctx, isActive, persistMerges)
+			if err != nil {
+				return fmt.Errorf("failed to load entities: %w", err)
+			}
+		}
 		return nil
 	}
 
 	loadFunc := func(context.Context) error {
-		if err := c.identityStore.loadEntities(ctx); err != nil {
-			return err
+		i.logger.Debug("loading identity store artifacts with",
+			"case_sensitive", !i.disableLowerCasedNames,
+			"conflict_resolver", i.conflictResolver)
+
+		if err := loadFuncEntities(ctx); err != nil {
+			return fmt.Errorf("failed to load entities: %w", err)
 		}
-		if err := c.identityStore.loadGroups(ctx); err != nil {
-			return err
+
+		if err := i.loadGroups(ctx, isActive); err != nil {
+			return fmt.Errorf("failed to load groups: %w", err)
 		}
-		if err := c.identityStore.loadOIDCClients(ctx); err != nil {
-			return err
+		if err := i.loadOIDCClients(ctx); err != nil {
+			return fmt.Errorf("failed to load OIDC clients: %w", err)
 		}
-		if err := c.identityStore.loadCachedEntitiesOfLocalAliases(ctx); err != nil {
-			return err
+		if err := i.loadCachedEntitiesOfLocalAliases(ctx); err != nil {
+			return fmt.Errorf("failed to load cached local alias entities: %w", err)
 		}
 
 		return nil
 	}
 
-	// Load everything when memdb is set to operate on lower cased names
+	// Resolve all conflicts by logging a warning and returning
+	// errDuplicateIdentityName by default. The error will flip the
+	// identityStore into case-sensitive mode by switching the underlying
+	// schema to one with a relaxed lowerCase constraint and reload all
+	// artifacts into MemDB.
+	i.conflictResolver = &errorResolver{i.logger}
+
+	// If the identity deduplication cleanup flag is activated, instead
+	// deal with duplicate entities and groups by renaming with a -UUID
+	// suffix. N.B. *entity alias* duplicates will still be merged as before.
+	if i.renameDuplicates.IsActivationFlagEnabled(activationflags.IdentityDeduplication) {
+		i.conflictResolver = &renameResolver{i.logger}
+	}
+
+	// Load everything when MemDB is set to operate on lower cased names.
+	// errDuplicateIdentityName below should only happen if we're using the
+	// errorResolver (i.e. identity deduplication is not activated) and we
+	// encounter non-alias duplicates.
 	err := loadFunc(ctx)
 	switch {
 	case err == nil:
-		// If it succeeds, all is well
+		// No error implies we've loaded the artifacts successfully
+		// with no duplicates detected. This means there were no
+		// unmerged duplicates detected while loading with the
+		// errorResolver, or the renameResolver was activated and
+		// resolved all duplicates. In either case, we can return
+		// early, since there's nothing left to do.
 		return nil
 	case !errwrap.Contains(err, errDuplicateIdentityName.Error()):
+		// All other errors are unexpected and should be returned.
 		return err
 	}
 
-	c.identityStore.logger.Warn("enabling case sensitive identity names")
+	// If we're here, it means we've encountered duplicates while loading
+	// with the errorResolver.
+	i.logger.Warn("enabling case sensitive identity names")
 
 	// Set identity store to operate on case sensitive identity names
-	c.identityStore.disableLowerCasedNames = true
+	i.disableLowerCasedNames = true
 
-	// Swap the memdb instance by the one which operates on case sensitive
-	// names, hence obviating the need to unload anything that's already
-	// loaded.
-	if err := c.identityStore.resetDB(ctx); err != nil {
+	// Swap out the MemDB instance and reload artifacts with the
+	// new schema.
+	if err := i.resetDB(); err != nil {
 		return err
 	}
 
+	// Also reset the conflict resolver so that we report potential duplicates to
+	// be resolved before it's safe to return to case-insensitive mode.
+	reporterResolver := newDuplicateReportingErrorResolver(i.logger)
+	i.conflictResolver = reporterResolver
+
 	// Attempt to load identity artifacts once more after memdb is reset to
 	// accept case sensitive names
-	return loadFunc(ctx)
+	err = loadFunc(ctx)
+
+	// Log reported duplicates if any found whether or not we end up erroring.
+	reporterResolver.LogReport(i.logger)
+
+	return err
+}
+
+func (i *IdentityStore) activate(ctx context.Context, _ *logical.Request, featureName string) error {
+	switch featureName {
+	case activationflags.IdentityDeduplication:
+		return i.activateDeduplication(ctx, nil)
+	case activationflags.SCIMEnablement:
+		return nil
+	}
+
+	return nil
+}
+
+// activateDeduplication is called when the identity deduplication feature is
+// enabled via the Activation Flag API. This method holds two high-level locks
+// ([*IdentityStore].lock and [*IdentityStore].groupLock) to prevent concurrent
+// requests from updating MemDB state while we're modifying the underlying
+// schema and reloading from storage.
+func (i *IdentityStore) activateDeduplication(ctx context.Context, req *logical.Request) error {
+	go func() {
+		i.lock.Lock()
+		defer i.lock.Unlock()
+
+		i.groupLock.Lock()
+		defer i.groupLock.Unlock()
+
+		i.logger.Info("activating identity deduplication, reloading identity store")
+
+		i.disableLowerCasedNames = false
+		if err := i.resetDB(); err != nil {
+			i.logger.Error("failed to reset existing identity state: %w", err)
+			return
+		}
+
+		// If we fail to load from storage, we'll end up with a broken
+		// IdentityStore, so we're better of just sealing and letting another node
+		// take over!
+		if err := i.loadArtifacts(ctx, i.localNode.HAState() == consts.Active); err != nil {
+			i.logger.Error("failed to activate identity deduplication, shutting down")
+			i.activationErrorHandler.Shutdown()
+			return
+		}
+
+		// Write to the test-synchronization channel if it's been created.
+		// Otherwise don't block trying to write to a nil chan.
+		select {
+		case i.activateDeduplicationDone <- struct{}{}:
+		default:
+		}
+
+		i.logger.Info("identity deduplication activated, identity store reload complete")
+	}()
+
+	return nil
 }
 
 func (i *IdentityStore) sanitizeName(name string) string {
@@ -88,7 +227,7 @@ func (i *IdentityStore) sanitizeName(name string) string {
 	return strings.ToLower(name)
 }
 
-func (i *IdentityStore) loadGroups(ctx context.Context) error {
+func (i *IdentityStore) loadGroups(ctx context.Context, isActive bool) error {
 	i.logger.Debug("identity loading groups")
 	existing, err := i.groupPacker.View().List(ctx, groupBucketsPrefix)
 	if err != nil {
@@ -139,15 +278,34 @@ func (i *IdentityStore) loadGroups(ctx context.Context) error {
 			if err != nil {
 				return err
 			}
-			if groupByName != nil {
-				i.logger.Warn(errDuplicateIdentityName.Error(), "group_name", group.Name, "conflicting_group_name", groupByName.Name, "action", "merge the contents of duplicated groups into one and delete the other")
-				if !i.disableLowerCasedNames {
-					return errDuplicateIdentityName
+			modified, err := i.conflictResolver.ResolveGroups(ctx, groupByName, group)
+			if err != nil && !i.disableLowerCasedNames {
+				return err
+			}
+			persist := false
+			if modified {
+				// If we modified the group we need to persist the changes to avoid bugs
+				// where memDB and storage are out of sync in the future (e.g. after
+				// invalidations of other items in the same bucket later). We do this
+				// _even_ if `persist=false` because it is in general during unseal but
+				// this is exactly when we need to fix these. We must be _really_
+				// careful to only do this on primary active node though which is the
+				// only source of truth that should have write access to groups across a
+				// cluster since they are always non-local. Note that we check !Standby
+				// and !secondary because we still need to write back even if this is a
+				// single cluster with no replication setup and I'm not _sure_ that we
+				// report such a cluster as a primary.
+				if !i.localNode.ReplicationState().HasState(
+					consts.ReplicationDRSecondary|
+						consts.ReplicationPerformanceSecondary|
+						consts.ReplicationPerformanceStandby,
+				) && isActive {
+					persist = true
 				}
 			}
 
 			if i.logger.IsDebug() {
-				i.logger.Debug("loading group", "name", group.Name, "id", group.ID)
+				i.logger.Debug("loading group", "namespace", ns.ID, "name", group.Name, "id", group.ID)
 			}
 
 			txn := i.db.Txn(true)
@@ -156,7 +314,6 @@ func (i *IdentityStore) loadGroups(ctx context.Context) error {
 			// updated when respective entities were deleted. This is here to
 			// check that the entity IDs in the group are indeed valid, and if
 			// not remove them.
-			persist := false
 			for _, memberEntityID := range group.MemberEntityIDs {
 				entity, err := i.MemDBEntityByID(memberEntityID, false)
 				if err != nil {
@@ -169,7 +326,20 @@ func (i *IdentityStore) loadGroups(ctx context.Context) error {
 				}
 			}
 
-			err = i.UpsertGroupInTxn(ctx, txn, group, persist)
+			err = i.UpsertGroupInTxn(nsCtx, txn, group, persist)
+
+			if errors.Is(err, logical.ErrReadOnly) {
+				// This is an imperfect solution to unblock customers who are running into
+				// a readonly error during a DR failover (jira #28191). More specifically, if there
+				// are duplicate aliases in storage then they are merged during loadEntities. Vault
+				// attempts to remove the deleted duplicate entities from their groups to clean up.
+				// If the node is a PR secondary though it will fail because the RPC client
+				// is not yet initialized and the storage is read-only. This prevents the cluster from
+				// unsealing entirely and can potentially block a DR failover from succeeding.
+				i.logger.Warn("received a read only error while trying to upsert group to storage")
+				err = nil
+			}
+
 			if err != nil {
 				txn.Abort()
 				return fmt.Errorf("failed to update group in memdb: %w", err)
@@ -204,12 +374,20 @@ func (i *IdentityStore) loadCachedEntitiesOfLocalAliases(ctx context.Context) er
 	i.logger.Debug("cached entities of local alias entries", "num_buckets", len(existing))
 
 	// Make the channels used for the worker pool
-	broker := make(chan string)
+	broker := make(chan int)
 	quit := make(chan bool)
 
-	// Buffer these channels to prevent deadlocks
-	errs := make(chan error, len(existing))
-	result := make(chan *storagepacker.Bucket, len(existing))
+	// We want to process the buckets in deterministic order so that duplicate
+	// merging is deterministic. We still want to load in parallel though so
+	// create a slice of result channels, one for each bucket. We need each result
+	// and err chan to be 1 buffered so we can leave a result there even if the
+	// processing loop is blocking on an earlier bucket still.
+	results := make([]chan *storagepacker.Bucket, len(existing))
+	errs := make([]chan error, len(existing))
+	for j := range existing {
+		results[j] = make(chan *storagepacker.Bucket, 1)
+		errs[j] = make(chan error, 1)
+	}
 
 	// Use a wait group
 	wg := &sync.WaitGroup{}
@@ -222,20 +400,21 @@ func (i *IdentityStore) loadCachedEntitiesOfLocalAliases(ctx context.Context) er
 
 			for {
 				select {
-				case key, ok := <-broker:
+				case idx, ok := <-broker:
 					// broker has been closed, we are done
 					if !ok {
 						return
 					}
+					key := existing[idx]
 
 					bucket, err := i.localAliasPacker.GetBucket(ctx, localAliasesBucketsPrefix+key)
 					if err != nil {
-						errs <- err
+						errs[idx] <- err
 						continue
 					}
 
 					// Write results out to the result channel
-					result <- bucket
+					results[idx] <- bucket
 
 				// quit early
 				case <-quit:
@@ -249,7 +428,7 @@ func (i *IdentityStore) loadCachedEntitiesOfLocalAliases(ctx context.Context) er
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		for j, key := range existing {
+		for j := range existing {
 			if j%500 == 0 {
 				i.logger.Debug("cached entities of local aliases loading", "progress", j)
 			}
@@ -259,7 +438,7 @@ func (i *IdentityStore) loadCachedEntitiesOfLocalAliases(ctx context.Context) er
 				return
 
 			default:
-				broker <- key
+				broker <- j
 			}
 		}
 
@@ -274,16 +453,16 @@ func (i *IdentityStore) loadCachedEntitiesOfLocalAliases(ctx context.Context) er
 		i.logger.Info("cached entities of local aliases restored")
 	}()
 
-	// Restore each key by pulling from the result chan
-	for j := 0; j < len(existing); j++ {
+	// Restore each key by pulling from the slice of result chans
+	for j := range existing {
 		select {
-		case err := <-errs:
+		case err := <-errs[j]:
 			// Close all go routines
 			close(quit)
 
 			return err
 
-		case bucket := <-result:
+		case bucket := <-results[j]:
 			// If there is no entry, nothing to restore
 			if bucket == nil {
 				continue
@@ -302,7 +481,6 @@ func (i *IdentityStore) loadCachedEntitiesOfLocalAliases(ctx context.Context) er
 					return err
 				}
 				nsCtx := namespace.ContextWithNamespace(ctx, ns)
-
 				err = i.upsertEntity(nsCtx, entity, nil, false)
 				if err != nil {
 					return fmt.Errorf("failed to update entity in MemDB: %w", err)
@@ -314,23 +492,39 @@ func (i *IdentityStore) loadCachedEntitiesOfLocalAliases(ctx context.Context) er
 	return nil
 }
 
-func (i *IdentityStore) loadEntities(ctx context.Context) error {
+func (i *IdentityStore) loadEntities(ctx context.Context, isActive bool, persistMerges bool) (bool, error) {
 	// Accumulate existing entities
 	i.logger.Debug("loading entities")
 	existing, err := i.entityPacker.View().List(ctx, storagepacker.StoragePackerBucketsPrefix)
 	if err != nil {
-		return fmt.Errorf("failed to scan for entities: %w", err)
+		return false, fmt.Errorf("failed to scan for entities: %w", err)
 	}
 	i.logger.Debug("entities collected", "num_existing", len(existing))
 
+	// Track whether we performed entity merges during loading. Caller may need to
+	// know to work out if we need to persist them by re-running with
+	// persistMerges = true.
+	merged := false
+
 	duplicatedAccessors := make(map[string]struct{})
-	// Make the channels used for the worker pool
-	broker := make(chan string)
+	// Make the channels used for the worker pool. We send the index into existing
+	// so that we can keep results in the same order as inputs. Note that this is
+	// goroutine safe as long as we never mutate existing again in this method
+	// which we don't.
+	broker := make(chan int)
 	quit := make(chan bool)
 
-	// Buffer these channels to prevent deadlocks
-	errs := make(chan error, len(existing))
-	result := make(chan *storagepacker.Bucket, len(existing))
+	// We want to process the buckets in deterministic order so that duplicate
+	// merging is deterministic. We still want to load in parallel though so
+	// create a slice of result channels, one for each bucket. We need each result
+	// and err chan to be 1 buffered so we can leave a result there even if the
+	// processing loop is blocking on an earlier bucket still.
+	results := make([]chan []*identity.Entity, len(existing))
+	errs := make([]chan error, len(existing))
+	for j := range existing {
+		results[j] = make(chan []*identity.Entity, 1)
+		errs[j] = make(chan error, 1)
+	}
 
 	// Use a wait group
 	wg := &sync.WaitGroup{}
@@ -343,20 +537,31 @@ func (i *IdentityStore) loadEntities(ctx context.Context) error {
 
 			for {
 				select {
-				case key, ok := <-broker:
+				case idx, ok := <-broker:
 					// broker has been closed, we are done
 					if !ok {
 						return
 					}
+					key := existing[idx]
 
 					bucket, err := i.entityPacker.GetBucket(ctx, storagepacker.StoragePackerBucketsPrefix+key)
 					if err != nil {
-						errs <- err
+						errs[idx] <- err
 						continue
 					}
 
+					items := make([]*identity.Entity, len(bucket.Items))
+					for j, item := range bucket.Items {
+						entity, err := i.parseEntityFromBucketItem(ctx, item)
+						if err != nil {
+							errs[idx] <- err
+							continue
+						}
+						items[j] = entity
+					}
+
 					// Write results out to the result channel
-					result <- bucket
+					results[idx] <- items
 
 				// quit early
 				case <-quit:
@@ -370,17 +575,13 @@ func (i *IdentityStore) loadEntities(ctx context.Context) error {
 	wg.Add(1)
 	go func() {
 		defer wg.Done()
-		for j, key := range existing {
-			if j%500 == 0 {
-				i.logger.Debug("entities loading", "progress", j)
-			}
-
+		for j := range existing {
 			select {
 			case <-quit:
 				return
 
 			default:
-				broker <- key
+				broker <- j
 			}
 		}
 
@@ -388,84 +589,126 @@ func (i *IdentityStore) loadEntities(ctx context.Context) error {
 		close(broker)
 	}()
 
+	localAliasBuckets := make(map[string]*storagepacker.Bucket)
+
 	// Restore each key by pulling from the result chan
 LOOP:
-	for j := 0; j < len(existing); j++ {
+	for j := range existing {
 		select {
-		case err = <-errs:
+		case err = <-errs[j]:
 			// Close all go routines
 			close(quit)
 			break LOOP
 
-		case bucket := <-result:
+		case entities := <-results[j]:
 			// If there is no entry, nothing to restore
-			if bucket == nil {
+			if entities == nil {
 				continue
 			}
+			load := func(entities []*identity.Entity) error {
+				tx := i.db.Txn(true)
+				defer tx.Abort()
+				upsertedItems := 0
+				for _, entity := range entities {
+					if entity == nil {
+						continue
+					}
 
-			for _, item := range bucket.Items {
-				entity, err := i.parseEntityFromBucketItem(ctx, item)
-				if err != nil {
-					return err
-				}
-				if entity == nil {
-					continue
-				}
+					ns, err := i.namespacer.NamespaceByID(ctx, entity.NamespaceID)
+					if err != nil {
+						return err
+					}
+					if ns == nil {
+						// Remove dangling entities
+						if !(i.localNode.ReplicationState().HasState(consts.ReplicationPerformanceSecondary) || i.localNode.HAState() == consts.PerfStandby) {
+							// Entity's namespace doesn't exist anymore but the
+							// entity from the namespace still exists.
+							i.logger.Warn("deleting entity and its any existing aliases", "name", entity.Name, "namespace_id", entity.NamespaceID)
+							err = i.entityPacker.DeleteItem(ctx, entity.ID)
+							if err != nil {
+								return err
+							}
+						}
+						continue
+					}
+					nsCtx := namespace.ContextWithNamespace(ctx, ns)
 
-				ns, err := i.namespacer.NamespaceByID(ctx, entity.NamespaceID)
-				if err != nil {
-					return err
-				}
-				if ns == nil {
-					// Remove dangling entities
-					if !(i.localNode.ReplicationState().HasState(consts.ReplicationPerformanceSecondary) || i.localNode.HAState() == consts.PerfStandby) {
-						// Entity's namespace doesn't exist anymore but the
-						// entity from the namespace still exists.
-						i.logger.Warn("deleting entity and its any existing aliases", "name", entity.Name, "namespace_id", entity.NamespaceID)
-						err = i.entityPacker.DeleteItem(ctx, entity.ID)
-						if err != nil {
-							return err
+					// Ensure that there are no entities with duplicate names
+					entityByName, err := i.MemDBEntityByName(nsCtx, entity.Name, false)
+					if err != nil {
+						return nil
+					}
+					modified, err := i.conflictResolver.ResolveEntities(ctx, entityByName, entity)
+					if err != nil && !i.disableLowerCasedNames {
+						return err
+					}
+
+					persist := false
+					if modified {
+						// If we modified the entity, we need to persist the changes to avoid bugs
+						// where memDB and storage are out of sync in the future (e.g. after
+						// invalidations of other items in the same bucket later). We do this
+						// _even_ if `persist=false` because it is in general during unseal but
+						// this is exactly when we need to fix these. We must be _really_
+						// careful to only do this on primary active node though which is the
+						// only source of truth that should have write access to groups across a
+						// cluster since they are always non-local. Note that we check !Standby
+						// and !Secondary because we still need to write back even if this is a
+						// single cluster with no replication.
+						if !i.localNode.ReplicationState().HasState(
+							consts.ReplicationDRSecondary|
+								consts.ReplicationPerformanceSecondary,
+						) && isActive {
+							persist = true
 						}
 					}
-					continue
-				}
-				nsCtx := namespace.ContextWithNamespace(ctx, ns)
 
-				// Ensure that there are no entities with duplicate names
-				entityByName, err := i.MemDBEntityByName(nsCtx, entity.Name, false)
-				if err != nil {
-					return nil
-				}
-				if entityByName != nil {
-					i.logger.Warn(errDuplicateIdentityName.Error(), "entity_name", entity.Name, "conflicting_entity_name", entityByName.Name, "action", "merge the duplicate entities into one")
-					if !i.disableLowerCasedNames {
-						return errDuplicateIdentityName
+					mountAccessors := getAccessorsOnDuplicateAliases(entity.Aliases)
+
+					if len(mountAccessors) > 0 {
+						i.logger.Warn("Entity has multiple aliases on the same mount(s)", "entity_id", entity.ID, "mount_accessors", mountAccessors)
 					}
-				}
 
-				mountAccessors := getAccessorsOnDuplicateAliases(entity.Aliases)
+					for _, accessor := range mountAccessors {
+						if _, ok := duplicatedAccessors[accessor]; !ok {
+							duplicatedAccessors[accessor] = struct{}{}
+						}
+					}
 
-				for _, accessor := range mountAccessors {
-					if _, ok := duplicatedAccessors[accessor]; !ok {
-						duplicatedAccessors[accessor] = struct{}{}
+					err = i.loadLocalAliasesForEntity(ctx, entity, localAliasBuckets)
+					if err != nil {
+						return fmt.Errorf("failed to load local aliases from storage: %v", err)
 					}
-				}
 
-				localAliases, err := i.parseLocalAliases(entity.ID)
-				if err != nil {
-					return fmt.Errorf("failed to load local aliases from storage: %v", err)
-				}
-				if localAliases != nil {
-					for _, alias := range localAliases.Aliases {
-						entity.UpsertAlias(alias)
+					toBeUpserted := 1 + len(entity.Aliases)
+					if upsertedItems+toBeUpserted > entityLoadingTxMaxSize {
+						tx.Commit()
+						upsertedItems = 0
+						tx = i.db.Txn(true)
+						defer tx.Abort()
 					}
-				}
 
-				// Only update MemDB and don't hit the storage again
-				err = i.upsertEntity(nsCtx, entity, nil, false)
-				if err != nil {
-					return fmt.Errorf("failed to update entity in MemDB: %w", err)
+					// Only update MemDB and don't hit the storage again unless we are
+					// merging and on a primary active node.
+					thisOneMerged, err := i.upsertEntityInTxn(nsCtx, tx, entity, nil, persist, persistMerges)
+					if err != nil {
+						return fmt.Errorf("failed to update entity in MemDB: %w", err)
+					}
+					upsertedItems += toBeUpserted
+
+					if thisOneMerged {
+						merged = true
+					}
+				}
+				if upsertedItems > 0 {
+					tx.Commit()
 				}
+				return nil
+			}
+
+			err := load(entities)
+			if err != nil {
+				return false, err
 			}
 		}
 	}
@@ -473,7 +716,7 @@ LOOP:
 	// Let all go routines finish
 	wg.Wait()
 	if err != nil {
-		return err
+		return false, err
 	}
 
 	// Flatten the map into a list of keys, in order to log them
@@ -484,14 +727,44 @@ LOOP:
 		accessorCounter++
 	}
 
-	if len(duplicatedAccessorsList) > 0 {
-		i.logger.Warn("One or more entities have multiple aliases on the same mount(s), remove duplicates to avoid ACL templating issues", "mount_accessors", duplicatedAccessorsList)
-	}
-
 	if i.logger.IsInfo() {
 		i.logger.Info("entities restored")
 	}
 
+	return merged, nil
+}
+
+// loadLocalAliasesForEntity upserts local aliases into the entity by retrieving
+// the local aliases from the cache (if present) or storage
+func (i *IdentityStore) loadLocalAliasesForEntity(ctx context.Context, entity *identity.Entity, localAliasCache map[string]*storagepacker.Bucket) error {
+	bucketKey := i.localAliasPacker.BucketKey(entity.ID)
+	if len(bucketKey) == 0 {
+		return fmt.Errorf("no bucket key for ID %s", entity.ID)
+	}
+	bucket, ok := localAliasCache[bucketKey]
+	if !ok {
+		var err error
+		bucket, err = i.localAliasPacker.GetBucket(ctx, bucketKey)
+		if err != nil {
+			return fmt.Errorf("failed to load local alias bucket from storage: %v", err)
+		}
+		localAliasCache[bucketKey] = bucket
+	}
+	if bucket == nil {
+		return nil
+	}
+	for _, item := range bucket.Items {
+		if item.ID == entity.ID {
+			var localAliases identity.LocalAliases
+			err := ptypes.UnmarshalAny(item.Message, &localAliases)
+			if err != nil {
+				return fmt.Errorf("failed to unmarshal local alias: %v", err)
+			}
+			for _, alias := range localAliases.Aliases {
+				entity.UpsertAlias(alias)
+			}
+		}
+	}
 	return nil
 }
 
@@ -514,22 +787,54 @@ func getAccessorsOnDuplicateAliases(aliases []*identity.Alias) []string {
 	return mountAccessors
 }
 
+// fetchEntityInTxn retrieves an identity entity by its ID within the context of a MemDB transaction.
+// If the entity is not found by its direct ID, it attempts performs a lookup using the merged entity index.
+// The returned entity may be a clone or the original reference, depending on the value of the `clone` parameter.
+func (i *IdentityStore) fetchEntityInTxn(txn *memdb.Txn, entityID string, clone bool) (*identity.Entity, error) {
+	if entityID == "" {
+		return nil, fmt.Errorf("empty entity ID")
+	}
+	if txn == nil {
+		return nil, fmt.Errorf("nil txn")
+	}
+
+	entity, err := i.MemDBEntityByIDInTxn(txn, entityID, clone)
+	if err != nil {
+		i.logger.Error("failed to lookup entity using its ID", "error", err)
+		return nil, err
+	}
+
+	if entity == nil {
+		// If there was no corresponding entity object found, it is
+		// possible that the entity got merged into another entity. Try
+		// finding entity based on the merged entity index.
+		entity, err = i.MemDBEntityByMergedEntityIDInTxn(txn, entityID, clone)
+		if err != nil {
+			i.logger.Error("failed to lookup entity in merged entity ID index", "error", err)
+			return nil, err
+		}
+	}
+
+	return entity, nil
+}
+
 // upsertEntityInTxn either creates or updates an existing entity. The
 // operations will be updated in both MemDB and storage. If 'persist' is set to
 // false, then storage will not be updated. When an alias is transferred from
 // one entity to another, both the source and destination entities should get
 // updated, in which case, callers should send in both entity and
-// previousEntity.
-func (i *IdentityStore) upsertEntityInTxn(ctx context.Context, txn *memdb.Txn, entity *identity.Entity, previousEntity *identity.Entity, persist bool) error {
+// previousEntity. persistMerges is ignored if persist = true but if persist =
+// false it allows the caller to request that we persist the data only if it is
+// changes by a merge caused by a duplicate alias.
+func (i *IdentityStore) upsertEntityInTxn(ctx context.Context, txn *memdb.Txn, entity *identity.Entity, previousEntity *identity.Entity, persist, persistMerges bool) (merged bool, err error) {
 	defer metrics.MeasureSince([]string{"identity", "upsert_entity_txn"}, time.Now())
-	var err error
 
 	if txn == nil {
-		return errors.New("txn is nil")
+		return false, errors.New("txn is nil")
 	}
 
 	if entity == nil {
-		return errors.New("entity is nil")
+		return false, errors.New("entity is nil")
 	}
 
 	if entity.NamespaceID == "" {
@@ -537,16 +842,17 @@ func (i *IdentityStore) upsertEntityInTxn(ctx context.Context, txn *memdb.Txn, e
 	}
 
 	if previousEntity != nil && previousEntity.NamespaceID != entity.NamespaceID {
-		return errors.New("entity and previous entity are not in the same namespace")
+		return false, errors.New("entity and previous entity are not in the same namespace")
 	}
 
 	aliasFactors := make([]string, len(entity.Aliases))
 
+	var localAliasesToDrop []*identity.Alias
 	for index, alias := range entity.Aliases {
 		// Verify that alias is not associated to a different one already
-		aliasByFactors, err := i.MemDBAliasByFactors(alias.MountAccessor, alias.Name, false, false)
+		aliasByFactors, err := i.MemDBAliasByFactorsInTxn(txn, alias.MountAccessor, alias.Name, false, false)
 		if err != nil {
-			return err
+			return false, err
 		}
 
 		if alias.NamespaceID == "" {
@@ -557,16 +863,30 @@ func (i *IdentityStore) upsertEntityInTxn(ctx context.Context, txn *memdb.Txn, e
 		case aliasByFactors == nil:
 			// Not found, no merging needed, just check namespace
 			if alias.NamespaceID != entity.NamespaceID {
-				return errors.New("alias and entity are not in the same namespace")
+				return false, errors.New("alias and entity are not in the same namespace")
 			}
 
 		case aliasByFactors.CanonicalID == entity.ID:
 			// Lookup found the same entity, so it's already attached to the
 			// right place
 			if aliasByFactors.NamespaceID != entity.NamespaceID {
-				return errors.New("alias from factors and entity are not in the same namespace")
+				return false, errors.New("alias from factors and entity are not in the same namespace")
 			}
 
+		case i.localNode.ReplicationState().HasState(consts.ReplicationPerformanceSecondary) && alias.Local:
+			// If this alias is local and we're on the perf secondary, don't
+			// merge! We do this because we can't persist the entity merge to
+			// storage on a secondary and sending it upstream to the primary
+			// leads to all sorts of distributed state problems. Instead, just
+			// let the first alias win and remove any duplicates from the local
+			// alias packer.
+			//
+			// Rather than delete immediately, keep track of the list of local
+			// aliases to delete once we're done iterating.
+			i.logger.Trace("skipping entity merge and dropping local alias on secondary")
+			localAliasesToDrop = append(localAliasesToDrop, alias)
+			continue
+
 		case previousEntity != nil && aliasByFactors.CanonicalID == previousEntity.ID:
 			// previousEntity isn't upserted yet so may still contain the old
 			// alias reference in memdb if it was just changed; validate
@@ -590,32 +910,65 @@ func (i *IdentityStore) upsertEntityInTxn(ctx context.Context, txn *memdb.Txn, e
 			fallthrough
 
 		default:
-			i.logger.Warn("alias is already tied to a different entity; these entities are being merged", "alias_id", alias.ID, "other_entity_id", aliasByFactors.CanonicalID, "entity_aliases", entity.Aliases, "alias_by_factors", aliasByFactors)
-
-			respErr, intErr := i.mergeEntityAsPartOfUpsert(ctx, txn, entity, aliasByFactors.CanonicalID, persist)
+			// Though this is technically a conflict that should be resolved by the
+			// ConflictResolver implementation, the behavior here is a bit nuanced.
+			// Rather than introduce a behavior change, we handle this case directly
+			// as before by merging.
+			i.logger.Warn("alias is already tied to a different entity; these entities are being merged",
+				"alias_id", alias.ID,
+				"other_entity_id", aliasByFactors.CanonicalID,
+				"entity_aliases", entity.Aliases,
+				"alias_by_factors", aliasByFactors)
+
+			persistMerge := persist || persistMerges
+			respErr, intErr := i.mergeEntityAsPartOfUpsert(ctx, txn, entity, aliasByFactors.CanonicalID, persistMerge)
 			switch {
 			case respErr != nil:
-				return respErr
+				return false, respErr
 			case intErr != nil:
-				return intErr
+				return false, intErr
 			}
 
 			// The entity and aliases will be loaded into memdb and persisted
 			// as a result of the merge, so we are done here
-			return nil
+			return true, nil
 		}
 
-		if strutil.StrListContains(aliasFactors, i.sanitizeName(alias.Name)+alias.MountAccessor) {
-			i.logger.Warn(errDuplicateIdentityName.Error(), "alias_name", alias.Name, "mount_accessor", alias.MountAccessor, "local", alias.Local, "entity_name", entity.Name, "action", "delete one of the duplicate aliases")
-			if !i.disableLowerCasedNames {
-				return errDuplicateIdentityName
-			}
+		// This is subtle. We want to call `ResolveAliases` so that the resolver can
+		// get full insight into all the aliases loaded and generate useful reports
+		// about duplicates. However, we don't want to actually change the error
+		// handling behavior from before which would only return an error in a very
+		// specific case (when the alias being added is a duplicate of one for the
+		// same entity and we are not in case-sensitive mode). So we call the method
+		// here unconditionally, but then only handle the resultant error in the
+		// specific case we care about. Note that we choose not to call it `err` to
+		// avoid it being left non-nil in some cases and tripping up later error
+		// handling code, and to signal something different is happening here. Note
+		// that we explicitly _want_ this to be here an not before we merge
+		// duplicates above, because duplicates that have always merged are not a
+		// problem to the user and are already logged. We care about different-case
+		// duplicates that are not being considered duplicates right now because we
+		// are in case-sensitive mode so we can report these to the operator ahead
+		// of them disabling case-sensitive mode. Note that alias resolvers don't
+		// ever modify right now so ignore the bool.
+		_, conflictErr := i.conflictResolver.ResolveAliases(ctx, entity, aliasByFactors, alias)
+
+		// This appears to be accounting for any duplicate aliases for the same
+		// Entity. In that case we would have skipped over the merge above in the
+		// `aliasByFactors.CanonicalID == entity.ID` case and made it here. Now we
+		// are here, duplicates are reported and may cause an insert error but only
+		// if we are in default case-insensitive mode. Once we are in case-sensitive
+		// mode we'll happily ignore duplicates of any case! This doesn't seem
+		// especially desirable to me, but we'd rather not change behavior for now.
+		if strutil.StrListContains(aliasFactors, i.sanitizeName(alias.Name)+alias.MountAccessor) &&
+			conflictErr != nil && !i.disableLowerCasedNames {
+			return false, conflictErr
 		}
 
 		// Insert or update alias in MemDB using the transaction created above
 		err = i.MemDBUpsertAliasInTxn(txn, alias, false)
 		if err != nil {
-			return err
+			return false, err
 		}
 
 		aliasFactors[index] = i.sanitizeName(alias.Name) + alias.MountAccessor
@@ -625,30 +978,48 @@ func (i *IdentityStore) upsertEntityInTxn(ctx context.Context, txn *memdb.Txn, e
 	if previousEntity != nil {
 		err = i.MemDBUpsertEntityInTxn(txn, previousEntity)
 		if err != nil {
-			return err
+			return false, err
 		}
 
 		if persist {
 			// Persist the previous entity object
 			if err := i.persistEntity(ctx, previousEntity); err != nil {
-				return err
+				return false, err
 			}
 		}
 	}
 
+	// Now that we've gone through all aliases, we can update this entity and
+	// remove any local aliases before upserting in MemDB.
+	for _, alias := range localAliasesToDrop {
+		entity.DeleteAliasByID(alias.ID)
+	}
+
 	// Insert or update entity in MemDB using the transaction created above
 	err = i.MemDBUpsertEntityInTxn(txn, entity)
 	if err != nil {
-		return err
+		return false, err
 	}
 
 	if persist {
 		if err := i.persistEntity(ctx, entity); err != nil {
-			return err
+			return false, err
 		}
 	}
 
-	return nil
+	// Drop any local aliases detected above from the local alias packer on the
+	// Secondary active node. We'll only populate the localAliasesToDrop slice
+	// on Perf Secondaries, so check here to see if we're an active node so we
+	// can persist the change.
+	if i.localNode.HAState() == consts.Active {
+		for _, alias := range localAliasesToDrop {
+			if err := i.localAliasPacker.DeleteItem(ctx, alias.CanonicalID); err != nil {
+				i.logger.Warn("failed to delete entity from local alias packer", "entity_id", alias.CanonicalID)
+			}
+		}
+	}
+
+	return false, nil
 }
 
 func (i *IdentityStore) processLocalAlias(ctx context.Context, lAlias *logical.Alias, entity *identity.Entity, updateDb bool) (*identity.Alias, error) {
@@ -710,7 +1081,7 @@ func (i *IdentityStore) processLocalAlias(ctx context.Context, lAlias *logical.A
 		localAliases.Aliases = append(localAliases.Aliases, alias)
 	}
 
-	marshaledAliases, err := ptypes.MarshalAny(localAliases)
+	marshaledAliases, err := anypb.New(localAliases)
 	if err != nil {
 		return nil, err
 	}
@@ -727,7 +1098,7 @@ func (i *IdentityStore) processLocalAlias(ctx context.Context, lAlias *logical.A
 		if err := i.MemDBUpsertAliasInTxn(txn, alias, false); err != nil {
 			return nil, err
 		}
-		if err := i.upsertEntityInTxn(ctx, txn, entity, nil, false); err != nil {
+		if _, err := i.upsertEntityInTxn(ctx, txn, entity, nil, false, false); err != nil {
 			return nil, err
 		}
 		txn.Commit()
@@ -746,8 +1117,8 @@ func (i *IdentityStore) processLocalAlias(ctx context.Context, lAlias *logical.A
 // still be aware of the entities. This temporary cache will be cleared when the
 // invalidation hits the secondary nodes.
 func (i *IdentityStore) cacheTemporaryEntity(ctx context.Context, entity *identity.Entity) error {
-	if i.localNode.ReplicationState().HasState(consts.ReplicationPerformanceSecondary) && i.localNode.HAState() != consts.PerfStandby {
-		marshaledEntity, err := ptypes.MarshalAny(entity)
+	if i.localNode.ReplicationState().HasState(consts.ReplicationPerformanceSecondary) && i.localNode.HAState() == consts.Active {
+		marshaledEntity, err := anypb.New(entity)
 		if err != nil {
 			return err
 		}
@@ -761,6 +1132,21 @@ func (i *IdentityStore) cacheTemporaryEntity(ctx context.Context, entity *identi
 	return nil
 }
 
+func splitLocalAliases(entity *identity.Entity) ([]*identity.Alias, []*identity.Alias) {
+	var localAliases []*identity.Alias
+	var nonLocalAliases []*identity.Alias
+
+	for _, alias := range entity.Aliases {
+		if alias.Local {
+			localAliases = append(localAliases, alias)
+		} else {
+			nonLocalAliases = append(nonLocalAliases, alias)
+		}
+	}
+
+	return nonLocalAliases, localAliases
+}
+
 func (i *IdentityStore) persistEntity(ctx context.Context, entity *identity.Entity) error {
 	// If the entity that is passed into this function is resulting from a memdb
 	// query without cloning, then modifying it will result in a direct DB edit,
@@ -773,20 +1159,11 @@ func (i *IdentityStore) persistEntity(ctx context.Context, entity *identity.Enti
 	}
 
 	// Separate the local and non-local aliases.
-	var localAliases []*identity.Alias
-	var nonLocalAliases []*identity.Alias
-	for _, alias := range entity.Aliases {
-		switch alias.Local {
-		case true:
-			localAliases = append(localAliases, alias)
-		default:
-			nonLocalAliases = append(nonLocalAliases, alias)
-		}
-	}
+	nonLocalAliases, localAliases := splitLocalAliases(entity)
 
 	// Store the entity with non-local aliases.
 	entity.Aliases = nonLocalAliases
-	marshaledEntity, err := ptypes.MarshalAny(entity)
+	marshaledEntity, err := anypb.New(entity)
 	if err != nil {
 		return err
 	}
@@ -806,7 +1183,7 @@ func (i *IdentityStore) persistEntity(ctx context.Context, entity *identity.Enti
 		Aliases: localAliases,
 	}
 
-	marshaledAliases, err := ptypes.MarshalAny(aliases)
+	marshaledAliases, err := anypb.New(aliases)
 	if err != nil {
 		return err
 	}
@@ -833,7 +1210,7 @@ func (i *IdentityStore) upsertEntity(ctx context.Context, entity *identity.Entit
 	txn := i.db.Txn(true)
 	defer txn.Abort()
 
-	err := i.upsertEntityInTxn(ctx, txn, entity, previousEntity, persist)
+	_, err := i.upsertEntityInTxn(ctx, txn, entity, previousEntity, persist, false)
 	if err != nil {
 		return err
 	}
@@ -1198,6 +1575,19 @@ func (i *IdentityStore) MemDBEntityByMergedEntityID(mergedEntityID string, clone
 
 	txn := i.db.Txn(false)
 
+	return i.MemDBEntityByMergedEntityIDInTxn(txn, mergedEntityID, clone)
+}
+
+// MemDBEntityByMergedEntityIDInTxn fetches an identity.Entity from MemDB by looking up the provided
+// merged entity ID within the context of the provided transaction. If 'clone' is set to true,
+// a clone of the fetched entity is returned to prevent unintended modifications to the original
+// entity stored in MemDB. If no entity is found with the given merged entity ID, nil is returned.
+// An error is returned if there are issues during the lookup or if the type assertion fails.
+func (i *IdentityStore) MemDBEntityByMergedEntityIDInTxn(txn *memdb.Txn, mergedEntityID string, clone bool) (*identity.Entity, error) {
+	if mergedEntityID == "" {
+		return nil, fmt.Errorf("missing merged entity id")
+	}
+
 	entityRaw, err := txn.First(entitiesTable, "merged_entity_ids", mergedEntityID)
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch entity from memdb using merged entity id: %w", err)
@@ -1268,6 +1658,36 @@ func (i *IdentityStore) MemDBDeleteEntityByID(entityID string) error {
 	return nil
 }
 
+// FetchEntityForLocalAliasInTxn fetches the entity associated with the provided
+// local identity.Alias. MemDB will first be searched for the entity. If it is
+// not found there, the localAliasPacker storagepacker.StoragePacker will be
+// used. If an error occurs, an appropriate error message is logged and nil is
+// returned.
+func (i *IdentityStore) FetchEntityForLocalAliasInTxn(txn *memdb.Txn, alias *identity.Alias) *identity.Entity {
+	entity, err := i.MemDBEntityByIDInTxn(txn, alias.CanonicalID, false)
+	if err != nil {
+		i.logger.Error("failed to fetch entity from local alias", "entity_id", alias.CanonicalID, "error", err)
+		return nil
+	}
+
+	if entity == nil {
+		cachedEntityItem, err := i.localAliasPacker.GetItem(alias.CanonicalID + tmpSuffix)
+		if err != nil {
+			i.logger.Error("failed to fetch cached entity from local alias", "key", alias.CanonicalID+tmpSuffix, "error", err)
+			return nil
+		}
+		if cachedEntityItem != nil {
+			entity, err = i.parseCachedEntity(cachedEntityItem)
+			if err != nil {
+				i.logger.Error("failed to parse cached entity", "key", alias.CanonicalID+tmpSuffix, "error", err)
+				return nil
+			}
+		}
+	}
+
+	return entity
+}
+
 func (i *IdentityStore) MemDBDeleteEntityByIDInTxn(txn *memdb.Txn, entityID string) error {
 	if entityID == "" {
 		return nil
@@ -1345,10 +1765,10 @@ func (i *IdentityStore) sanitizeAlias(ctx context.Context, alias *identity.Alias
 
 	// Set the creation and last update times
 	if alias.CreationTime == nil {
-		alias.CreationTime = ptypes.TimestampNow()
+		alias.CreationTime = timestamppb.Now()
 		alias.LastUpdateTime = alias.CreationTime
 	} else {
-		alias.LastUpdateTime = ptypes.TimestampNow()
+		alias.LastUpdateTime = timestamppb.Now()
 	}
 
 	return nil
@@ -1399,10 +1819,10 @@ func (i *IdentityStore) sanitizeEntity(ctx context.Context, entity *identity.Ent
 
 	// Set the creation and last update times
 	if entity.CreationTime == nil {
-		entity.CreationTime = ptypes.TimestampNow()
+		entity.CreationTime = timestamppb.Now()
 		entity.LastUpdateTime = entity.CreationTime
 	} else {
-		entity.LastUpdateTime = ptypes.TimestampNow()
+		entity.LastUpdateTime = timestamppb.Now()
 	}
 
 	// Ensure that MFASecrets is non-nil at any time. This is useful when MFA
@@ -1463,10 +1883,10 @@ func (i *IdentityStore) sanitizeAndUpsertGroup(ctx context.Context, group *ident
 
 	// Set the creation and last update times
 	if group.CreationTime == nil {
-		group.CreationTime = ptypes.TimestampNow()
+		group.CreationTime = timestamppb.Now()
 		group.LastUpdateTime = group.CreationTime
 	} else {
-		group.LastUpdateTime = ptypes.TimestampNow()
+		group.LastUpdateTime = timestamppb.Now()
 	}
 
 	// Remove duplicate entity IDs and check if all IDs are valid
@@ -1754,7 +2174,7 @@ func (i *IdentityStore) UpsertGroup(ctx context.Context, group *identity.Group,
 	txn := i.db.Txn(true)
 	defer txn.Abort()
 
-	err := i.UpsertGroupInTxn(ctx, txn, group, true)
+	err := i.UpsertGroupInTxn(ctx, txn, group, persist)
 	if err != nil {
 		return err
 	}
@@ -1807,7 +2227,7 @@ func (i *IdentityStore) UpsertGroupInTxn(ctx context.Context, txn *memdb.Txn, gr
 	}
 
 	if persist {
-		groupAsAny, err := ptypes.MarshalAny(group)
+		groupAsAny, err := anypb.New(group)
 		if err != nil {
 			return err
 		}
@@ -1817,15 +2237,9 @@ func (i *IdentityStore) UpsertGroupInTxn(ctx context.Context, txn *memdb.Txn, gr
 			Message: groupAsAny,
 		}
 
-		sent, err := i.groupUpdater.SendGroupUpdate(ctx, group)
-		if err != nil {
+		if err := i.groupPacker.PutItem(ctx, item); err != nil {
 			return err
 		}
-		if !sent {
-			if err := i.groupPacker.PutItem(ctx, item); err != nil {
-				return err
-			}
-		}
 	}
 
 	return nil
@@ -2328,7 +2742,13 @@ func (i *IdentityStore) refreshExternalGroupMembershipsByEntityID(ctx context.Co
 			group.MemberEntityIDs = append(group.MemberEntityIDs, entityID)
 
 			err = i.UpsertGroupInTxn(ctx, txn, group, true)
-			if err != nil {
+			if errors.Is(err, logical.ErrReadOnly) {
+				i.logger.Info("forwarding update group request to active", "group_id", group.ID)
+				// Forward the group update to the active node
+				if err := i.groupUpdater.SendGroupUpdate(ctx, group); err != nil {
+					return false, nil, err
+				}
+			} else if err != nil {
 				return false, nil, err
 			}
 		}
@@ -2356,7 +2776,13 @@ func (i *IdentityStore) refreshExternalGroupMembershipsByEntityID(ctx context.Co
 			group.MemberEntityIDs = strutil.StrListDelete(group.MemberEntityIDs, entityID)
 
 			err = i.UpsertGroupInTxn(ctx, txn, group, true)
-			if err != nil {
+			if errors.Is(err, logical.ErrReadOnly) {
+				i.logger.Info("forwarding update group request to active", "group_id", group.ID)
+				// Forward the group update to the active node
+				if err := i.groupUpdater.SendGroupUpdate(ctx, group); err != nil {
+					return false, nil, err
+				}
+			} else if err != nil {
 				return false, nil, err
 			}
 		}
@@ -2466,6 +2892,7 @@ func (i *IdentityStore) handleAliasListCommon(ctx context.Context, groupAlias bo
 			"canonical_id":    alias.CanonicalID,
 			"mount_accessor":  alias.MountAccessor,
 			"custom_metadata": alias.CustomMetadata,
+			"metadata":        alias.Metadata,
 			"local":           alias.Local,
 		}
 
@@ -2566,3 +2993,141 @@ func (i *IdentityStore) countEntitiesByMountAccessor(ctx context.Context) (map[s
 
 	return byMountAccessor, nil
 }
+
+func makeEntityForPacker(t *testing.T, name string, p *storagepacker.StoragePacker, seed *rand.Rand) *identity.Entity {
+	t.Helper()
+	return makeEntityForPackerWithNamespace(t, namespace.RootNamespaceID, name, p, seed)
+}
+
+func makeEntityForPackerWithNamespace(t *testing.T, namespaceID, name string, p *storagepacker.StoragePacker, seed *rand.Rand) *identity.Entity {
+	t.Helper()
+	id, err := uuid.GenerateUUIDWithReader(seed)
+	require.NoError(t, err)
+	return &identity.Entity{
+		ID:          id,
+		Name:        name,
+		NamespaceID: namespaceID,
+		BucketKey:   p.BucketKey(id),
+	}
+}
+
+func attachAlias(t *testing.T, e *identity.Entity, name string, me *MountEntry, seed *rand.Rand) *identity.Alias {
+	t.Helper()
+
+	id, err := uuid.GenerateUUIDWithReader(seed)
+	require.NoError(t, err)
+	if e.NamespaceID != me.NamespaceID {
+		panic("mount and entity in different namespaces")
+	}
+	require.NoError(t, err)
+	a := &identity.Alias{
+		ID:            id,
+		Name:          name,
+		NamespaceID:   me.NamespaceID,
+		CanonicalID:   e.ID,
+		MountType:     me.Type,
+		MountAccessor: me.Accessor,
+		Local:         me.Local,
+	}
+	e.UpsertAlias(a)
+	return a
+}
+
+func identityCreateCaseDuplicates(t *testing.T, ctx context.Context, c *Core, upme, localme *MountEntry, seed *rand.Rand) {
+	t.Helper()
+
+	if upme.NamespaceID != localme.NamespaceID {
+		panic("both replicated and local auth mounts must be in the same namespace")
+	}
+
+	// Create entities with both case-sensitive and case-insensitive duplicate
+	// suffixes.
+	for i, suffix := range []string{"-case", "-case", "-cAsE"} {
+		// Entity duplicated by name
+		e := makeEntityForPackerWithNamespace(t, upme.NamespaceID, "entity"+suffix, c.identityStore.entityPacker, seed)
+		err := TestHelperWriteToStoragePacker(ctx, c.identityStore.entityPacker, e.ID, e)
+		require.NoError(t, err)
+
+		// Entity that isn't a dupe itself but has duplicated aliases
+		e2 := makeEntityForPackerWithNamespace(t, upme.NamespaceID, fmt.Sprintf("entity-%d", i), c.identityStore.entityPacker, seed)
+		// Add local and non-local aliases for this entity (which will also be
+		// duplicated)
+		attachAlias(t, e2, "alias"+suffix, upme, seed)
+		attachAlias(t, e2, "local-alias"+suffix, localme, seed)
+		err = TestHelperWriteToStoragePacker(ctx, c.identityStore.entityPacker, e2.ID, e2)
+		require.NoError(t, err)
+
+		// Group duplicated by name
+		g := makeGroupWithNameAndAlias(t, "group"+suffix, "", c.identityStore.groupPacker, upme, seed)
+		err = TestHelperWriteToStoragePacker(ctx, c.identityStore.groupPacker, g.ID, g)
+		require.NoError(t, err)
+	}
+}
+
+func makeGroupWithNameAndAlias(t *testing.T, name, alias string, p *storagepacker.StoragePacker, me *MountEntry, seed *rand.Rand) *identity.Group {
+	t.Helper()
+	id, err := uuid.GenerateUUIDWithReader(seed)
+	require.NoError(t, err)
+	id2, err := uuid.GenerateUUIDWithReader(seed)
+	require.NoError(t, err)
+	g := &identity.Group{
+		ID:          id,
+		Name:        name,
+		NamespaceID: me.NamespaceID,
+		BucketKey:   p.BucketKey(id),
+	}
+	if alias != "" {
+		g.Alias = &identity.Alias{
+			ID:            id2,
+			Name:          alias,
+			CanonicalID:   id,
+			MountType:     me.Type,
+			MountAccessor: me.Accessor,
+			NamespaceID:   me.NamespaceID,
+		}
+	}
+	return g
+}
+
+func makeLocalAliasWithName(t *testing.T, name, entityID string, bucketKey string, me *MountEntry, seed *rand.Rand) *identity.LocalAliases {
+	t.Helper()
+	id, err := uuid.GenerateUUIDWithReader(seed)
+	require.NoError(t, err)
+	return &identity.LocalAliases{
+		Aliases: []*identity.Alias{
+			{
+				ID:            id,
+				Name:          name,
+				CanonicalID:   entityID,
+				MountType:     me.Type,
+				MountAccessor: me.Accessor,
+				NamespaceID:   me.NamespaceID,
+			},
+		},
+	}
+}
+
+// MakeDeduplicationDoneChan creates a new done channel for synchronization
+// with tests outside of the vault package (e.g. in external_tests).
+func (i *IdentityStore) MakeDeduplicationDoneChan() {
+	i.lock.Lock()
+	defer i.lock.Unlock()
+
+	i.activateDeduplicationDone = make(chan struct{})
+}
+
+// WaitForActivateDeduplicationDone is a test helper to wait for the identity
+// deduplication activation to finish.
+func (i *IdentityStore) WaitForActivateDeduplicationDone(ctx context.Context) error {
+	i.logger.Trace("waiting for activation", "channel", i.activateDeduplicationDone)
+
+	timeoutCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+	select {
+	case <-i.activateDeduplicationDone:
+		i.logger.Trace("activation write received", "channel", i.activateDeduplicationDone)
+		return nil
+	case <-timeoutCtx.Done():
+		return fmt.Errorf("timed out waiting for deduplication")
+	}
+}
diff --git a/vault/init.go b/vault/init.go
index 28ff0574373..f1cde33e4f7 100644
--- a/vault/init.go
+++ b/vault/init.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -62,7 +62,7 @@ func (c *Core) InitializeRecovery(ctx context.Context) error {
 		return raftStorage.StartRecoveryCluster(context.Background(), raft.Peer{
 			ID:      raftStorage.NodeID(),
 			Address: parsedClusterAddr.Host,
-		})
+		}, c.shutdownRemovedNode)
 	})
 
 	return nil
@@ -319,6 +319,14 @@ func (c *Core) Initialize(ctx context.Context, initParams *InitParams) (*InitRes
 		SecretShares: [][]byte{},
 	}
 
+	// Write an entry to storage to indicate that initialization is in progress.
+	// It is used to prevent that nodes use stored keys to unseal while initialization
+	// is still in progress. This can happen when using the Consul backend (maybe others?).
+	if err := c.seal.SetInitializationFlag(ctx); err != nil {
+		c.logger.Error("failed to write initialization flag to storage", "error", err)
+		return nil, fmt.Errorf("failed to write initialization flag to storage: %w", err)
+	}
+
 	// If we are storing shares, pop them out of the returned results and push
 	// them through the seal
 	switch c.seal.StoredKeysSupported() {
@@ -413,6 +421,11 @@ func (c *Core) Initialize(ctx context.Context, initParams *InitParams) (*InitRes
 		}
 	}
 
+	if err := c.seal.ClearInitializationFlag(ctx); err != nil {
+		c.logger.Error("Error clearing initialization flag", "error", err)
+		return nil, fmt.Errorf("error clearing initialization flag: %w", err)
+	}
+
 	// Prepare to re-seal
 	if err := c.preSeal(); err != nil {
 		c.logger.Error("pre-seal teardown failed", "error", err)
@@ -463,6 +476,16 @@ func (c *Core) UnsealWithStoredKeys(ctx context.Context) error {
 		return NewNonFatalError(fmt.Errorf("fetching stored unseal keys failed: %w", err))
 	}
 
+	// Check whether Vault initialization is still in progress. If it is is, then
+	// bail out to give it a chance to complete.
+	isInitializing, err := c.seal.IsInitializationFlagSet(ctx)
+	if err != nil {
+		return NewNonFatalError(fmt.Errorf("fetching seal initialization flag failed: %w", err))
+	}
+	if isInitializing {
+		return NewNonFatalError(errors.New("stored unseal keys found, but flag indicates Vault initialization is still in progress"))
+	}
+
 	// This usually happens when auto-unseal is configured, but the servers have
 	// not been initialized yet.
 	if len(keys) == 0 {
diff --git a/vault/init_test.go b/vault/init_test.go
index 20a35259e79..0a51516f4b4 100644
--- a/vault/init_test.go
+++ b/vault/init_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/inspectable.go b/vault/inspectable.go
index cf4dce0c05c..0cd824e5862 100644
--- a/vault/inspectable.go
+++ b/vault/inspectable.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/inspectable_test.go b/vault/inspectable_test.go
index e6fe58f0250..a58249558f1 100644
--- a/vault/inspectable_test.go
+++ b/vault/inspectable_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/keyring.go b/vault/keyring.go
index 4f943c11b66..758daed08c2 100644
--- a/vault/keyring.go
+++ b/vault/keyring.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/keyring_test.go b/vault/keyring_test.go
index 57b06c6a77e..2ef1710fac9 100644
--- a/vault/keyring_test.go
+++ b/vault/keyring_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/logical_cubbyhole.go b/vault/logical_cubbyhole.go
index 161c226782a..3c7f33838b7 100644
--- a/vault/logical_cubbyhole.go
+++ b/vault/logical_cubbyhole.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -25,6 +25,9 @@ func CubbyholeBackendFactory(ctx context.Context, conf *logical.BackendConfig) (
 	}
 
 	b.Backend.Paths = append(b.Backend.Paths, b.paths()...)
+	b.Backend.PathsSpecial = &logical.Paths{
+		AllowSnapshotRead: []string{"*"},
+	}
 
 	if conf == nil {
 		return nil, fmt.Errorf("configuration passed into backend is nil")
@@ -76,7 +79,7 @@ func (b *CubbyholeBackend) paths() []*framework.Path {
 					DisplayAttrs: &framework.DisplayAttributes{
 						OperationVerb: "write",
 					},
-					Summary: "Store a secret at the specified location.",
+					Summary: "Store a secret at the specified location, or (enterprise-only) recover it from given snapshot Id.",
 				},
 				logical.CreateOperation: &framework.PathOperation{
 					Callback: b.handleWrite,
@@ -99,6 +102,11 @@ func (b *CubbyholeBackend) paths() []*framework.Path {
 					Summary:     "List secret entries at the specified location.",
 					Description: "Folders are suffixed with /. The input must be a folder; list on a file will not return a value. The values themselves are not accessible via this command.",
 				},
+				logical.RecoverOperation: &framework.PathOperation{
+					Callback: b.handleWrite,
+					// just like CreateOperation, recover is folded into update for OpenAPI documentation purposes, so
+					// no operation verb or summary is set
+				},
 			},
 
 			ExistenceCheck: b.handleExistenceCheck,
diff --git a/vault/logical_cubbyhole_test.go b/vault/logical_cubbyhole_test.go
index bc2d469e0cf..6b6861b20bb 100644
--- a/vault/logical_cubbyhole_test.go
+++ b/vault/logical_cubbyhole_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -11,7 +11,9 @@ import (
 	"time"
 
 	uuid "github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/sdk/helper/testhelpers/snapshots"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
 )
 
 func TestCubbyholeBackend_Write(t *testing.T) {
@@ -268,3 +270,66 @@ func testCubbyholeBackend() logical.Backend {
 	})
 	return b
 }
+
+// TestSnapshotOperations verifies that snapshot operations on the cubbyhole
+// backend succeed. It tests reading, listing, recovering, and recovering as a
+// copy from a snapshot.
+func TestSnapshotOperations(t *testing.T) {
+	backend := testCubbyholeBackend()
+	tc := snapshots.NewSnapshotTestCase(t, backend)
+	path := "secret"
+	_, err := backend.HandleRequest(context.Background(), &logical.Request{
+		Operation: logical.CreateOperation,
+		Storage:   tc.SnapshotStorage(),
+		Path:      path,
+		Data: map[string]interface{}{
+			"data": "old data",
+		},
+		ClientToken: "a",
+	})
+	require.NoError(t, err)
+
+	_, err = backend.HandleRequest(context.Background(), &logical.Request{
+		Operation: logical.CreateOperation,
+		Storage:   tc.RegularStorage(),
+		Path:      path,
+		Data: map[string]interface{}{
+			"data": "new data",
+		},
+		ClientToken: "a",
+	})
+
+	checkContent := func(t *testing.T, path string) {
+		readResp, err := backend.HandleRequest(context.Background(), &logical.Request{
+			Operation:   logical.ReadOperation,
+			Storage:     tc.RegularStorage(),
+			ClientToken: "a",
+			Path:        path,
+		})
+		require.NoError(t, err)
+		require.NotNil(t, readResp)
+		require.Equal(t, "old data", readResp.Data["data"])
+	}
+	require.NoError(t, err)
+	addToken := func(req *logical.Request) {
+		req.ClientToken = "a"
+	}
+	t.Run("read no side effects", func(t *testing.T) {
+		tc.RunRead(t, path, snapshots.WithModifyRequests(func(req *logical.Request) {
+			req.ClientToken = "token"
+		}))
+	})
+	t.Run("list no side effects", func(t *testing.T) {
+		tc.RunList(t, path, snapshots.WithModifyRequests(addToken))
+	})
+	t.Run("recover works", func(t *testing.T) {
+		_, err := tc.DoRecover(t, path, snapshots.WithModifyRequests(addToken))
+		require.NoError(t, err)
+		checkContent(t, path)
+	})
+	t.Run("recover new path works", func(t *testing.T) {
+		_, err := tc.DoRecover(t, "different-path", snapshots.WithModifyRequests(addToken), snapshots.WithRecoverSourcePath(path))
+		require.NoError(t, err)
+		checkContent(t, "different-path")
+	})
+}
diff --git a/vault/logical_passthrough.go b/vault/logical_passthrough.go
index 5df835b4043..87c1d5dd058 100644
--- a/vault/logical_passthrough.go
+++ b/vault/logical_passthrough.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/logical_passthrough_test.go b/vault/logical_passthrough_test.go
index a67b203c99f..f3588703219 100644
--- a/vault/logical_passthrough_test.go
+++ b/vault/logical_passthrough_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/logical_raw.go b/vault/logical_raw.go
index a58edeff4bb..183a8470911 100644
--- a/vault/logical_raw.go
+++ b/vault/logical_raw.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/logical_system.go b/vault/logical_system.go
index 5c8e3309d21..ba83f9e9be8 100644
--- a/vault/logical_system.go
+++ b/vault/logical_system.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -15,6 +15,7 @@ import (
 	"hash"
 	"math/rand"
 	"net/http"
+	"net/url"
 	"path"
 	"path/filepath"
 	"runtime"
@@ -31,6 +32,8 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-secure-stdlib/strutil"
 	semver "github.com/hashicorp/go-version"
+	"github.com/hashicorp/vault/audit"
+	"github.com/hashicorp/vault/helper/activationflags"
 	"github.com/hashicorp/vault/helper/experiments"
 	"github.com/hashicorp/vault/helper/hostutil"
 	"github.com/hashicorp/vault/helper/identity"
@@ -54,6 +57,7 @@ import (
 	"github.com/hashicorp/vault/version"
 	"github.com/mitchellh/mapstructure"
 	"golang.org/x/crypto/sha3"
+	"golang.org/x/time/rate"
 )
 
 const (
@@ -92,11 +96,12 @@ func NewSystemBackend(core *Core, logger log.Logger, config *logical.BackendConf
 	}
 
 	b := &SystemBackend{
-		Core:        core,
-		db:          db,
-		logger:      logger,
-		mfaBackend:  NewPolicyMFABackend(core, logger),
-		syncBackend: syncBackend,
+		Core:                 core,
+		db:                   db,
+		logger:               logger,
+		mfaBackend:           NewPolicyMFABackend(core, logger),
+		syncBackend:          syncBackend,
+		raftChallengeLimiter: rate.NewLimiter(rate.Limit(RaftChallengesPerSecond), RaftInitialChallengeLimit),
 	}
 
 	b.Backend = &framework.Backend{
@@ -130,7 +135,9 @@ func NewSystemBackend(core *Core, logger log.Logger, config *logical.BackendConf
 				"leases/lookup/*",
 				"storage/raft/snapshot-auto/config/*",
 				"leases",
+				"reporting/scan",
 				"internal/inspect/*",
+				"internal/counters/activity/export",
 				// sys/seal and sys/step-down actually have their sudo requirement enforced through hardcoding
 				// PolicyCheckOpts.RootPrivsRequired in dedicated calls to Core.performPolicyChecks, but we still need
 				// to declare them here so that the generated OpenAPI spec gets their sudo status correct.
@@ -189,15 +196,15 @@ func NewSystemBackend(core *Core, logger log.Logger, config *logical.BackendConf
 			},
 		},
 	}
+	b.Backend.PathsSpecial.Unauthenticated = append(b.Backend.PathsSpecial.Unauthenticated, entUnauthenticatedPaths()...)
 
 	b.Backend.Paths = append(b.Backend.Paths, entPaths(b)...)
 	b.Backend.Paths = append(b.Backend.Paths, b.configPaths()...)
-	b.Backend.Paths = append(b.Backend.Paths, b.uiCustomMessagePaths()...)
 	b.Backend.Paths = append(b.Backend.Paths, b.rekeyPaths()...)
 	b.Backend.Paths = append(b.Backend.Paths, b.sealPaths()...)
 	b.Backend.Paths = append(b.Backend.Paths, b.statusPaths()...)
 	b.Backend.Paths = append(b.Backend.Paths, b.pluginsCatalogListPaths()...)
-	b.Backend.Paths = append(b.Backend.Paths, b.pluginsCatalogCRUDPath())
+	b.Backend.Paths = append(b.Backend.Paths, entWrappedPluginsCRUDPath(b)...)
 	b.Backend.Paths = append(b.Backend.Paths, b.pluginsCatalogPinsListPath())
 	b.Backend.Paths = append(b.Backend.Paths, b.pluginsCatalogPinsCRUDPath())
 	b.Backend.Paths = append(b.Backend.Paths, b.pluginsReloadPath())
@@ -225,10 +232,8 @@ func NewSystemBackend(core *Core, logger log.Logger, config *logical.BackendConf
 	b.Backend.Paths = append(b.Backend.Paths, b.loginMFAPaths()...)
 	b.Backend.Paths = append(b.Backend.Paths, b.experimentPaths()...)
 	b.Backend.Paths = append(b.Backend.Paths, b.introspectionPaths()...)
-
-	if requestLimiterRead := b.requestLimiterReadPath(); requestLimiterRead != nil {
-		b.Backend.Paths = append(b.Backend.Paths, b.requestLimiterReadPath())
-	}
+	b.Backend.Paths = append(b.Backend.Paths, b.wellKnownPaths()...)
+	b.Backend.Paths = append(b.Backend.Paths, b.activationFlagsPaths()...)
 
 	if core.rawEnabled {
 		b.Backend.Paths = append(b.Backend.Paths, b.rawPaths()...)
@@ -249,6 +254,7 @@ func NewSystemBackend(core *Core, logger log.Logger, config *logical.BackendConf
 	b.Backend.Invalidate = sysInvalidate(b)
 	b.Backend.InitializeFunc = sysInitialize(b)
 	b.Backend.Clean = sysClean(b)
+	b.entInit()
 	return b
 }
 
@@ -268,11 +274,15 @@ func (b *SystemBackend) rawPaths() []*framework.Path {
 // prefix. Conceptually it is similar to procfs on Linux.
 type SystemBackend struct {
 	*framework.Backend
-	Core        *Core
-	db          *memdb.MemDB
-	logger      log.Logger
-	mfaBackend  *PolicyMFABackend
-	syncBackend *SecretsSyncBackend
+	entSystemBackend
+	Core                 *Core
+	db                   *memdb.MemDB
+	logger               log.Logger
+	mfaBackend           *PolicyMFABackend
+	syncBackend          *SecretsSyncBackend
+	idStoreBackend       *framework.Backend
+	raftChallengeLimiter *rate.Limiter
+	activationFlags      *activationflags.FeatureActivationFlags
 }
 
 // handleConfigStateSanitized returns the current configuration state. The configuration
@@ -529,17 +539,30 @@ func (b *SystemBackend) handlePluginCatalogUpdate(ctx context.Context, _ *logica
 		return logical.ErrorResponse("version %q is not allowed because 'builtin' is a reserved metadata identifier", pluginVersion), nil
 	}
 
+	if download := d.Get("download").(bool); download {
+		return logical.ErrorResponse("download is an enterprise only feature"), nil
+	}
+
 	sha256 := d.Get("sha256").(string)
 	if sha256 == "" {
 		sha256 = d.Get("sha_256").(string)
-		if sha256 == "" {
-			return logical.ErrorResponse("missing SHA-256 value"), nil
-		}
+	}
+
+	if sha256 == "" && pluginVersion == "" {
+		return logical.ErrorResponse("must provide at least one of sha256 or version: use sha256 for binary registration (version optional) or version only for artifact registration"), nil
+	}
+
+	if resp := validateSha256IsEmptyForEntPluginVersion(pluginVersion, sha256); resp.IsError() {
+		return resp, nil
 	}
 
 	command := d.Get("command").(string)
 	ociImage := d.Get("oci_image").(string)
-	if command == "" && ociImage == "" {
+	var resp logical.Response
+
+	if sha256 == "" && command != "" {
+		resp.AddWarning(fmt.Sprintf("When sha256 is unspecified, a plugin artifact is expected for registration and the command parameter %q will be ignored.", command))
+	} else if sha256 != "" && (command == "" && ociImage == "") {
 		return logical.ErrorResponse("must provide at least one of command or oci_image"), nil
 	}
 
@@ -605,7 +628,11 @@ func (b *SystemBackend) handlePluginCatalogUpdate(ctx context.Context, _ *logica
 		return nil, err
 	}
 
-	return nil, nil
+	if len(resp.Warnings) == 0 {
+		return nil, nil
+	}
+
+	return &resp, nil
 }
 
 func (b *SystemBackend) handlePluginCatalogRead(ctx context.Context, _ *logical.Request, d *framework.FieldData) (*logical.Response, error) {
@@ -1134,15 +1161,14 @@ func (b *SystemBackend) handlePluginRuntimeCatalogList(ctx context.Context, _ *l
 }
 
 // handleAuditedHeaderUpdate creates or overwrites a header entry
-func (b *SystemBackend) handleAuditedHeaderUpdate(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+func (b *SystemBackend) handleAuditedHeaderUpdate(ctx context.Context, _ *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 	header := d.Get("header").(string)
 	hmac := d.Get("hmac").(bool)
 	if header == "" {
 		return logical.ErrorResponse("missing header name"), nil
 	}
 
-	headerConfig := b.Core.AuditedHeadersConfig()
-	err := headerConfig.add(ctx, header, hmac)
+	err := b.Core.AuditedHeadersConfig().Add(ctx, header, hmac)
 	if err != nil {
 		return nil, err
 	}
@@ -1151,14 +1177,13 @@ func (b *SystemBackend) handleAuditedHeaderUpdate(ctx context.Context, req *logi
 }
 
 // handleAuditedHeaderDelete deletes the header with the given name
-func (b *SystemBackend) handleAuditedHeaderDelete(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+func (b *SystemBackend) handleAuditedHeaderDelete(ctx context.Context, _ *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 	header := d.Get("header").(string)
 	if header == "" {
 		return logical.ErrorResponse("missing header name"), nil
 	}
 
-	headerConfig := b.Core.AuditedHeadersConfig()
-	err := headerConfig.remove(ctx, header)
+	err := b.Core.AuditedHeadersConfig().Remove(ctx, header)
 	if err != nil {
 		return nil, err
 	}
@@ -1167,14 +1192,13 @@ func (b *SystemBackend) handleAuditedHeaderDelete(ctx context.Context, req *logi
 }
 
 // handleAuditedHeaderRead returns the header configuration for the given header name
-func (b *SystemBackend) handleAuditedHeaderRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+func (b *SystemBackend) handleAuditedHeaderRead(_ context.Context, _ *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 	header := d.Get("header").(string)
 	if header == "" {
 		return logical.ErrorResponse("missing header name"), nil
 	}
 
-	headerConfig := b.Core.AuditedHeadersConfig()
-	settings, ok := headerConfig.Headers[strings.ToLower(header)]
+	settings, ok := b.Core.AuditedHeadersConfig().Header(header)
 	if !ok {
 		return logical.ErrorResponse("Could not find header in config"), nil
 	}
@@ -1187,12 +1211,12 @@ func (b *SystemBackend) handleAuditedHeaderRead(ctx context.Context, req *logica
 }
 
 // handleAuditedHeadersRead returns the whole audited headers config
-func (b *SystemBackend) handleAuditedHeadersRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	headerConfig := b.Core.AuditedHeadersConfig()
+func (b *SystemBackend) handleAuditedHeadersRead(_ context.Context, _ *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
+	headerSettings := b.Core.AuditedHeadersConfig().Headers()
 
 	return &logical.Response{
 		Data: map[string]interface{}{
-			"headers": headerConfig.Headers,
+			"headers": headerSettings,
 		},
 	}, nil
 }
@@ -1359,7 +1383,7 @@ func (b *SystemBackend) handleGenerateRootDecodeTokenUpdate(ctx context.Context,
 	return resp, nil
 }
 
-func (b *SystemBackend) mountInfo(ctx context.Context, entry *MountEntry) map[string]interface{} {
+func (b *SystemBackend) mountInfo(ctx context.Context, entry *MountEntry, legacyTTLFormat bool) map[string]interface{} {
 	info := map[string]interface{}{
 		"type":                    entry.Type,
 		"description":             entry.Description,
@@ -1373,11 +1397,26 @@ func (b *SystemBackend) mountInfo(ctx context.Context, entry *MountEntry) map[st
 		"running_plugin_version":  entry.RunningVersion,
 		"running_sha256":          entry.RunningSha256,
 	}
+	coreDefTTL := int64(b.Core.defaultLeaseTTL.Seconds())
+	coreMaxTTL := int64(b.Core.maxLeaseTTL.Seconds())
+	entDefTTL := int64(entry.Config.DefaultLeaseTTL.Seconds())
+	entMaxTTL := int64(entry.Config.MaxLeaseTTL.Seconds())
 	entryConfig := map[string]interface{}{
-		"default_lease_ttl": int64(entry.Config.DefaultLeaseTTL.Seconds()),
-		"max_lease_ttl":     int64(entry.Config.MaxLeaseTTL.Seconds()),
+		"default_lease_ttl": entDefTTL,
+		"max_lease_ttl":     entMaxTTL,
 		"force_no_cache":    entry.Config.ForceNoCache,
 	}
+	if !legacyTTLFormat {
+		if entDefTTL == 0 {
+			entryConfig["default_lease_ttl"] = coreDefTTL
+		}
+		if entMaxTTL == 0 {
+			entryConfig["max_lease_ttl"] = coreMaxTTL
+		}
+	}
+	if entry.Config.TrimRequestTrailingSlashes {
+		entryConfig["trim_request_trailing_slashes"] = true
+	}
 	if rawVal, ok := entry.synthesizedConfigCache.Load("audit_non_hmac_request_keys"); ok {
 		entryConfig["audit_non_hmac_request_keys"] = rawVal.([]string)
 	}
@@ -1413,6 +1452,9 @@ func (b *SystemBackend) mountInfo(ctx context.Context, entry *MountEntry) map[st
 		}
 		entryConfig["user_lockout_config"] = userLockoutConfig
 	}
+	if rawVal, ok := entry.synthesizedConfigCache.Load("delegated_auth_accessors"); ok {
+		entryConfig["delegated_auth_accessors"] = rawVal.([]string)
+	}
 
 	// Add deprecation status only if it exists
 	builtinType := b.Core.builtinTypeFromMountEntry(ctx, entry)
@@ -1453,7 +1495,7 @@ func (b *SystemBackend) handleMountTable(ctx context.Context, req *logical.Reque
 		}
 
 		// Populate mount info
-		info := b.mountInfo(ctx, entry)
+		info := b.mountInfo(ctx, entry, true)
 
 		resp.Data[entry.Path] = info
 	}
@@ -1484,6 +1526,11 @@ func (b *SystemBackend) handleMount(ctx context.Context, req *logical.Request, d
 	externalEntropyAccess := data.Get("external_entropy_access").(bool)
 	options := data.Get("options").(map[string]string)
 
+	if !b.Core.IsMountTypeAllowed(logicalType) {
+		return logical.ErrorResponse("mounts of type %q are not supported by license", logicalType),
+			logical.ErrInvalidRequest
+	}
+
 	var config MountConfig
 	var apiConfig APIMountConfig
 
@@ -1598,6 +1645,10 @@ func (b *SystemBackend) handleMount(ctx context.Context, req *logical.Request, d
 		config.ForceNoCache = true
 	}
 
+	if apiConfig.TrimRequestTrailingSlashes {
+		config.TrimRequestTrailingSlashes = true
+	}
+
 	if err := checkListingVisibility(apiConfig.ListingVisibility); err != nil {
 		return logical.ErrorResponse(fmt.Sprintf("invalid listing_visibility %s", apiConfig.ListingVisibility)), nil
 	}
@@ -1737,7 +1788,7 @@ func (b *SystemBackend) handleReadMount(ctx context.Context, req *logical.Reques
 	}
 
 	resp := &logical.Response{
-		Data: b.mountInfo(ctx, entry),
+		Data: b.mountInfo(ctx, entry, true),
 	}
 	if entry.Version != "" && entry.Version != entry.RunningVersion {
 		warning := fmt.Sprintf("Plugin version is configured as %q, but running %q", entry.Version, entry.RunningVersion)
@@ -1953,8 +2004,8 @@ func (b *SystemBackend) handleRemount(ctx context.Context, req *logical.Request,
 		err := b.moveMount(ns, logger, migrationID, entry, fromPathDetails, toPathDetails)
 		if err != nil {
 			logger.Error("remount failed", "error", err)
-			if err := b.Core.setMigrationStatus(migrationID, MigrationFailureStatus); err != nil {
-				logger.Error("Setting migration status failed", "error", err, "target_status", MigrationFailureStatus)
+			if err := b.Core.setMigrationStatus(migrationID, MigrationStatusFailure); err != nil {
+				logger.Error("Setting migration status failed", "error", err, "target_status", MigrationStatusFailure)
 			}
 		}
 	}(migrationID)
@@ -2010,7 +2061,7 @@ func (b *SystemBackend) moveMount(ns *namespace.Namespace, logger log.Logger, mi
 		return err
 	}
 
-	if err := b.Core.setMigrationStatus(migrationID, MigrationSuccessStatus); err != nil {
+	if err := b.Core.setMigrationStatus(migrationID, MigrationStatusSuccess); err != nil {
 		return err
 	}
 	logger.Info("Completed mount move operations")
@@ -2134,6 +2185,10 @@ func (b *SystemBackend) handleTuneReadCommon(ctx context.Context, path string) (
 		resp.Data["identity_token_key"] = rawVal.(string)
 	}
 
+	if mountEntry.Config.TrimRequestTrailingSlashes {
+		resp.Data["trim_request_trailing_slashes"] = mountEntry.Config.TrimRequestTrailingSlashes
+	}
+
 	if mountEntry.Config.UserLockoutConfig != nil {
 		resp.Data["user_lockout_counter_reset_duration"] = int64(mountEntry.Config.UserLockoutConfig.LockoutCounterReset.Seconds())
 		resp.Data["user_lockout_threshold"] = mountEntry.Config.UserLockoutConfig.LockoutThreshold
@@ -2211,12 +2266,12 @@ func (b *SystemBackend) handleTuneWriteCommon(ctx context.Context, path string,
 		return nil, logical.ErrReadOnly
 	}
 
-	var lock *locking.DeadlockRWMutex
+	var lock locking.RWMutex
 	switch {
 	case strings.HasPrefix(path, credentialRoutePrefix):
-		lock = &b.Core.authLock
+		lock = b.Core.authLock
 	default:
-		lock = &b.Core.mountsLock
+		lock = b.Core.mountsLock
 	}
 
 	lock.Lock()
@@ -2407,6 +2462,17 @@ func (b *SystemBackend) handleTuneWriteCommon(ctx context.Context, path string,
 			pluginType = consts.PluginTypeCredential
 		}
 
+		// Update MountEntry.Type of external plugins registered in Vault pre-v1.0.0 to the plugin binary name
+		// stored in MountEntry.Config.PluginName
+		// Previously, when upgrading Vault from pre-v1.0.0 to post-v1.0.0, MountEntry.Type of external plugins
+		// remained "plugin" where it should follow the new scheme and be updated to the plugin binary name.
+		// https://hashicorp.atlassian.net/browse/VAULT-21999
+		if mountEntry.Config.PluginName != "" {
+			if mountEntry.Config.PluginName != mountEntry.Type && mountEntry.Type == "plugin" {
+				mountEntry.Type = mountEntry.Config.PluginName
+			}
+		}
+
 		pinnedVersion, err := b.Core.pluginCatalog.GetPinnedVersion(ctx, pluginType, mountEntry.Type)
 		if err != nil && !errors.Is(err, pluginutil.ErrPinnedVersionNotFound) {
 			return nil, err
@@ -2727,6 +2793,30 @@ func (b *SystemBackend) handleTuneWriteCommon(ctx context.Context, path string,
 		}
 	}
 
+	if rawVal, ok := data.GetOk("trim_request_trailing_slashes"); ok {
+		trimRequestTrailingSlashes := rawVal.(bool)
+
+		oldVal := mountEntry.Config.TrimRequestTrailingSlashes
+		mountEntry.Config.TrimRequestTrailingSlashes = trimRequestTrailingSlashes
+
+		// Update the mount table
+		var err error
+		switch {
+		case strings.HasPrefix(path, "auth/"):
+			err = b.Core.persistAuth(ctx, b.Core.auth, &mountEntry.Local)
+		default:
+			err = b.Core.persistMounts(ctx, b.Core.mounts, &mountEntry.Local)
+		}
+		if err != nil {
+			mountEntry.Config.TrimRequestTrailingSlashes = oldVal
+			return handleError(err)
+		}
+
+		if b.Core.logger.IsInfo() {
+			b.Core.logger.Info("mount tuning of trim_request_trailing_slashes successful", "path", path)
+		}
+	}
+
 	var err error
 	var resp *logical.Response
 	var options map[string]string
@@ -3047,7 +3137,7 @@ func (b *SystemBackend) handleAuthTable(ctx context.Context, req *logical.Reques
 			continue
 		}
 
-		info := b.mountInfo(ctx, entry)
+		info := b.mountInfo(ctx, entry, true)
 		resp.Data[entry.Path] = info
 	}
 
@@ -3081,7 +3171,7 @@ func (b *SystemBackend) handleReadAuth(ctx context.Context, req *logical.Request
 		}
 
 		return &logical.Response{
-			Data: b.mountInfo(ctx, entry),
+			Data: b.mountInfo(ctx, entry, true),
 		}, nil
 	}
 
@@ -3243,6 +3333,7 @@ func (b *SystemBackend) handleEnableAuth(ctx context.Context, req *logical.Reque
 		return logical.ErrorResponse(fmt.Sprintf("invalid listing_visibility %s", apiConfig.ListingVisibility)), nil
 	}
 	config.ListingVisibility = apiConfig.ListingVisibility
+	config.TrimRequestTrailingSlashes = apiConfig.TrimRequestTrailingSlashes
 
 	if len(apiConfig.AuditNonHMACRequestKeys) > 0 {
 		config.AuditNonHMACRequestKeys = apiConfig.AuditNonHMACRequestKeys
@@ -3579,9 +3670,12 @@ func (b *SystemBackend) handlePoliciesSet(policyType PolicyType) framework.Opera
 			policy.Raw = string(polBytes)
 		}
 
+		var duplicate bool
 		switch policyType {
 		case PolicyTypeACL:
-			p, err := ParseACLPolicy(ns, policy.Raw)
+			var p *Policy
+			// TODO (HCL_DUP_KEYS_DEPRECATION): go back to ParseACLPolicy once the deprecation is done
+			p, duplicate, err = ParseACLPolicyCheckDuplicates(ns, policy.Raw)
 			if err != nil {
 				return handleError(err)
 			}
@@ -3605,6 +3699,14 @@ func (b *SystemBackend) handlePoliciesSet(policyType PolicyType) framework.Opera
 			return handleError(err)
 		}
 
+		if duplicate {
+			if resp == nil {
+				resp = &logical.Response{}
+			}
+			// TODO (HCL_DUP_KEYS_DEPRECATION): remove log and API Warning once the deprecation is done
+			b.logger.Warn("newly created HCL policy contains duplicate attributes, which will no longer be supported in a future version", "policy", policy.Name, "namespace", ns.Path)
+			resp.AddWarning("policy contains duplicate attributes, which will no longer be supported in a future version")
+		}
 		return resp, nil
 	}
 }
@@ -3870,7 +3972,7 @@ func (b *SystemBackend) handleAuditHash(ctx context.Context, req *logical.Reques
 }
 
 // handleEnableAudit is used to enable a new audit backend
-func (b *SystemBackend) handleEnableAudit(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+func (b *SystemBackend) handleEnableAudit(ctx context.Context, _ *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 	repState := b.Core.ReplicationState()
 
 	local := data.Get("local").(bool)
@@ -3899,14 +4001,15 @@ func (b *SystemBackend) handleEnableAudit(ctx context.Context, req *logical.Requ
 
 	// Attempt enabling
 	if err := b.Core.enableAudit(ctx, me, true); err != nil {
-		b.Backend.Logger().Error("enable audit mount failed", "path", me.Path, "error", err)
-		return handleError(err)
+		b.Core.logger.Error("enable audit mount failed", "path", me.Path, "error", err)
+
+		return handleError(audit.ConvertToExternalError(err))
 	}
 	return nil, nil
 }
 
 // handleDisableAudit is used to disable an audit backend
-func (b *SystemBackend) handleDisableAudit(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+func (b *SystemBackend) handleDisableAudit(ctx context.Context, _ *logical.Request, data *framework.FieldData) (*logical.Response, error) {
 	path := data.Get("path").(string)
 
 	if !strings.HasSuffix(path, "/") {
@@ -3941,7 +4044,8 @@ func (b *SystemBackend) handleDisableAudit(ctx context.Context, req *logical.Req
 	// Attempt disable
 	if existed, err := b.Core.disableAudit(ctx, path, true); existed && err != nil {
 		b.Backend.Logger().Error("disable audit mount failed", "path", path, "error", err)
-		return handleError(err)
+
+		return handleError(audit.ConvertToExternalError(err))
 	}
 	return nil, nil
 }
@@ -4792,7 +4896,8 @@ func hasMountAccess(ctx context.Context, acl *ACL, path string) bool {
 			perms.CapabilitiesBitmap&SudoCapabilityInt > 0,
 			perms.CapabilitiesBitmap&UpdateCapabilityInt > 0,
 			perms.CapabilitiesBitmap&PatchCapabilityInt > 0,
-			perms.CapabilitiesBitmap&SubscribeCapabilityInt > 0:
+			perms.CapabilitiesBitmap&SubscribeCapabilityInt > 0,
+			perms.CapabilitiesBitmap&RecoverCapabilityInt > 0:
 
 			aclCapabilitiesGiven = true
 
@@ -4965,7 +5070,7 @@ func (b *SystemBackend) pathInternalUIMountsRead(ctx context.Context, req *logic
 		if ns.ID == entry.NamespaceID && hasAccess(ctx, entry) {
 			if isAuthed {
 				// If this is an authed request return all the mount info
-				secretMounts[entry.Path] = b.mountInfo(ctx, entry)
+				secretMounts[entry.Path] = b.mountInfo(ctx, entry, false)
 			} else {
 				secretMounts[entry.Path] = map[string]interface{}{
 					"type":        entry.Type,
@@ -4992,7 +5097,7 @@ func (b *SystemBackend) pathInternalUIMountsRead(ctx context.Context, req *logic
 		if ns.ID == entry.NamespaceID && hasAccess(ctx, entry) {
 			if isAuthed {
 				// If this is an authed request return all the mount info
-				authMounts[entry.Path] = b.mountInfo(ctx, entry)
+				authMounts[entry.Path] = b.mountInfo(ctx, entry, false)
 			} else {
 				authMounts[entry.Path] = map[string]interface{}{
 					"type":        entry.Type,
@@ -5047,6 +5152,14 @@ func (b *SystemBackend) pathInternalUIMountRead(ctx context.Context, req *logica
 		routerPrefix = credentialRoutePrefix
 	}
 
+	// the mount's namespace is (at least partially) in the request path and not
+	// in the request's context, so we need to add the namespace from the
+	// request path to the router prefix
+	if me.NamespaceID != ns.ID {
+		namespaceRouterPrefix := strings.TrimPrefix(me.Namespace().Path, ns.Path)
+		routerPrefix = namespaceRouterPrefix + routerPrefix
+	}
+
 	filtered, err := b.Core.checkReplicatedFiltering(ctx, me, routerPrefix)
 	if err != nil {
 		return nil, err
@@ -5055,7 +5168,7 @@ func (b *SystemBackend) pathInternalUIMountRead(ctx context.Context, req *logica
 		return errResp, logical.ErrPermissionDenied
 	}
 	resp := &logical.Response{
-		Data: b.mountInfo(ctx, me),
+		Data: b.mountInfo(ctx, me, false),
 	}
 	resp.Data["path"] = me.Path
 
@@ -5086,21 +5199,6 @@ func (b *SystemBackend) pathInternalCountersRequests(ctx context.Context, req *l
 	return resp, logical.ErrPathFunctionalityRemoved
 }
 
-func (b *SystemBackend) pathInternalCountersTokens(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	activeTokens, err := b.Core.countActiveTokens(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	resp := &logical.Response{
-		Data: map[string]interface{}{
-			"counters": activeTokens,
-		},
-	}
-
-	return resp, nil
-}
-
 func (b *SystemBackend) pathInternalCountersEntities(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 	activeEntities, err := b.Core.countActiveEntities(ctx)
 	if err != nil {
@@ -5203,6 +5301,9 @@ func (b *SystemBackend) pathInternalUIResultantACL(ctx context.Context, req *log
 		if perms.CapabilitiesBitmap&SubscribeCapabilityInt > 0 {
 			capabilities = append(capabilities, SubscribeCapability)
 		}
+		if perms.CapabilitiesBitmap&RecoverCapabilityInt > 0 {
+			capabilities = append(capabilities, RecoverCapability)
+		}
 
 		// If "deny" is explicitly set or if the path has no capabilities at all,
 		// set the path capabilities to "deny"
@@ -5237,29 +5338,19 @@ func (b *SystemBackend) pathInternalUIResultantACL(ctx context.Context, req *log
 		walkFn(exact, s, v)
 		return false
 	}
+	acl.exactRules.Walk(exactWalkFn)
+	resp.Data["exact_paths"] = exact
 
+	// Combine glob (prefix) and segment wildcard (+) paths into glob_paths
 	globWalkFn := func(s string, v interface{}) bool {
 		walkFn(glob, s, v)
 		return false
 	}
-
-	acl.exactRules.Walk(exactWalkFn)
 	acl.prefixRules.Walk(globWalkFn)
-
-	resp.Data["exact_paths"] = exact
-	resp.Data["glob_paths"] = glob
-
-	return resp, nil
-}
-
-// pathInternalUIVersion is the framework.PathOperation callback function for
-// the sys/internal/ui/version path. It simply returns the Vault version.
-func (b *SystemBackend) pathInternalUIVersion(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	resp := &logical.Response{
-		Data: map[string]any{
-			"version": version.GetVersion().VersionNumber(),
-		},
+	for s, v := range acl.segmentWildcardPaths {
+		walkFn(glob, s, v)
 	}
+	resp.Data["glob_paths"] = glob
 
 	return resp, nil
 }
@@ -5273,8 +5364,14 @@ func (b *SystemBackend) pathInternalOpenAPI(ctx context.Context, req *logical.Re
 
 	context := d.Get("context").(string)
 
+	vaultVersion := version.Version
+	redactVersion, _, _, _ := logical.CtxRedactionSettingsValue(ctx)
+	if redactVersion {
+		vaultVersion = ""
+	}
+
 	// Set up target document
-	doc := framework.NewOASDocument(version.Version)
+	doc := framework.NewOASDocument(vaultVersion)
 
 	// Generic mount paths will primarily be used for code generation purposes.
 	// This will result in parameterized mount paths being returned instead of
@@ -5363,7 +5460,7 @@ func (b *SystemBackend) pathInternalOpenAPI(ctx context.Context, req *logical.Re
 
 				// Add tags to all of the operations if necessary
 				if tag != "" {
-					for _, op := range []*framework.OASOperation{obj.Get, obj.Post, obj.Delete} {
+					for _, op := range []*framework.OASOperation{obj.Get, obj.Post, obj.Patch, obj.Delete} {
 						// TODO: a special override for identity is used used here because the backend
 						// is currently categorized as "secret", which will likely change. Also of interest
 						// is removing all tag handling here and providing the mount information to OpenAPI.
@@ -5435,24 +5532,25 @@ func (b *SystemBackend) pathInternalOpenAPI(ctx context.Context, req *logical.Re
 }
 
 type SealStatusResponse struct {
-	Type              string   `json:"type"`
-	Initialized       bool     `json:"initialized"`
-	Sealed            bool     `json:"sealed"`
-	T                 int      `json:"t"`
-	N                 int      `json:"n"`
-	Progress          int      `json:"progress"`
-	Nonce             string   `json:"nonce"`
-	Version           string   `json:"version"`
-	BuildDate         string   `json:"build_date"`
-	Migration         bool     `json:"migration"`
-	ClusterName       string   `json:"cluster_name,omitempty"`
-	ClusterID         string   `json:"cluster_id,omitempty"`
-	RecoverySeal      bool     `json:"recovery_seal"`
-	StorageType       string   `json:"storage_type,omitempty"`
-	HCPLinkStatus     string   `json:"hcp_link_status,omitempty"`
-	HCPLinkResourceID string   `json:"hcp_link_resource_ID,omitempty"`
-	Warnings          []string `json:"warnings,omitempty"`
-	RecoverySealType  string   `json:"recovery_seal_type,omitempty"`
+	Type               string   `json:"type"`
+	Initialized        bool     `json:"initialized"`
+	Sealed             bool     `json:"sealed"`
+	T                  int      `json:"t"`
+	N                  int      `json:"n"`
+	Progress           int      `json:"progress"`
+	Nonce              string   `json:"nonce"`
+	Version            string   `json:"version"`
+	BuildDate          string   `json:"build_date"`
+	Migration          bool     `json:"migration"`
+	ClusterName        string   `json:"cluster_name,omitempty"`
+	ClusterID          string   `json:"cluster_id,omitempty"`
+	RecoverySeal       bool     `json:"recovery_seal"`
+	StorageType        string   `json:"storage_type,omitempty"`
+	HCPLinkStatus      string   `json:"hcp_link_status,omitempty"`
+	HCPLinkResourceID  string   `json:"hcp_link_resource_ID,omitempty"`
+	Warnings           []string `json:"warnings,omitempty"`
+	RecoverySealType   string   `json:"recovery_seal_type,omitempty"`
+	RemovedFromCluster *bool    `json:"removed_from_cluster,omitempty"`
 }
 
 type SealBackendStatus struct {
@@ -5488,15 +5586,28 @@ func (core *Core) GetSealStatus(ctx context.Context, lock bool) (*SealStatusResp
 
 	hcpLinkStatus, resourceIDonHCP := core.GetHCPLinkStatus()
 
+	redactVersion, _, redactClusterName, _ := logical.CtxRedactionSettingsValue(ctx)
+	var removed *bool
+	isRemoved, shouldInclude := core.IsRemovedFromCluster()
+	if shouldInclude {
+		removed = &isRemoved
+	}
+
 	if sealConfig == nil {
 		s := &SealStatusResponse{
-			Type:         core.SealAccess().BarrierSealConfigType().String(),
-			Initialized:  initialized,
-			Sealed:       true,
-			RecoverySeal: core.SealAccess().RecoveryKeySupported(),
-			StorageType:  core.StorageType(),
-			Version:      version.GetVersion().VersionNumber(),
-			BuildDate:    version.BuildDate,
+			Type:               core.SealAccess().BarrierSealConfigType().String(),
+			Initialized:        initialized,
+			Sealed:             true,
+			RecoverySeal:       core.SealAccess().RecoveryKeySupported(),
+			StorageType:        core.StorageType(),
+			Version:            version.GetVersion().VersionNumber(),
+			BuildDate:          version.BuildDate,
+			RemovedFromCluster: removed,
+		}
+
+		if redactVersion {
+			s.Version = ""
+			s.BuildDate = ""
 		}
 
 		if resourceIDonHCP != "" {
@@ -5533,21 +5644,22 @@ func (core *Core) GetSealStatus(ctx context.Context, lock bool) (*SealStatusResp
 	progress, nonce := core.SecretProgress(lock)
 
 	s := &SealStatusResponse{
-		Type:             sealType,
-		Initialized:      initialized,
-		Sealed:           sealed,
-		T:                sealConfig.SecretThreshold,
-		N:                sealConfig.SecretShares,
-		Progress:         progress,
-		Nonce:            nonce,
-		Version:          version.GetVersion().VersionNumber(),
-		BuildDate:        version.BuildDate,
-		Migration:        core.IsInSealMigrationMode(lock) && !core.IsSealMigrated(lock),
-		ClusterName:      clusterName,
-		ClusterID:        clusterID,
-		RecoverySeal:     core.SealAccess().RecoveryKeySupported(),
-		RecoverySealType: recoverySealType,
-		StorageType:      core.StorageType(),
+		Type:               sealType,
+		Initialized:        initialized,
+		Sealed:             sealed,
+		T:                  sealConfig.SecretThreshold,
+		N:                  sealConfig.SecretShares,
+		Progress:           progress,
+		Nonce:              nonce,
+		Version:            version.GetVersion().VersionNumber(),
+		BuildDate:          version.BuildDate,
+		Migration:          core.IsInSealMigrationMode(lock) && !core.IsSealMigrated(lock),
+		RemovedFromCluster: removed,
+		ClusterName:        clusterName,
+		ClusterID:          clusterID,
+		RecoverySeal:       core.SealAccess().RecoveryKeySupported(),
+		RecoverySealType:   recoverySealType,
+		StorageType:        core.StorageType(),
 	}
 
 	if resourceIDonHCP != "" {
@@ -5555,6 +5667,15 @@ func (core *Core) GetSealStatus(ctx context.Context, lock bool) (*SealStatusResp
 		s.HCPLinkResourceID = resourceIDonHCP
 	}
 
+	if redactVersion {
+		s.Version = ""
+		s.BuildDate = ""
+	}
+
+	if redactClusterName {
+		s.ClusterName = ""
+	}
+
 	return s, nil
 }
 
@@ -5596,7 +5717,16 @@ func (c *Core) GetSealBackendStatus(ctx context.Context) (*SealBackendStatusResp
 	if err != nil {
 		return nil, fmt.Errorf("could not list partially seal wrapped values: %w", err)
 	}
-	genInfo := c.seal.GetAccess().GetSealGenerationInfo()
+	// When multi-seal is enabled, use the stored seal generation information. Note that the in-memory
+	// value may not be up-to-date on non-active nodes.
+	genInfo, err := PhysicalSealGenInfo(ctx, c.physical)
+	if err != nil {
+		return nil, fmt.Errorf("could not read seal generation information: %w", err)
+	}
+	if genInfo == nil {
+		// Multi-seal is not enabled, use the in-memory value.
+		genInfo = c.seal.GetAccess().GetSealGenerationInfo()
+	}
 	r.FullyWrapped = genInfo.IsRewrapped() && len(pps) == 0
 	return &r, nil
 }
@@ -5616,14 +5746,14 @@ type LeaderResponse struct {
 	RaftAppliedIndex   uint64 `json:"raft_applied_index,omitempty"`
 }
 
-func (core *Core) GetLeaderStatus() (*LeaderResponse, error) {
+func (core *Core) GetLeaderStatus(ctx context.Context) (*LeaderResponse, error) {
 	core.stateLock.RLock()
 	defer core.stateLock.RUnlock()
 
-	return core.GetLeaderStatusLocked()
+	return core.GetLeaderStatusLocked(ctx)
 }
 
-func (core *Core) GetLeaderStatusLocked() (*LeaderResponse, error) {
+func (core *Core) GetLeaderStatusLocked(ctx context.Context) (*LeaderResponse, error) {
 	haEnabled := true
 	isLeader, address, clusterAddr, err := core.LeaderLocked()
 	if errwrap.Contains(err, ErrHANotEnabled.Error()) {
@@ -5650,11 +5780,29 @@ func (core *Core) GetLeaderStatusLocked() (*LeaderResponse, error) {
 		resp.LastWAL = core.EntLastWAL()
 	}
 
+	_, redactAddresses, _, _ := logical.CtxRedactionSettingsValue(ctx)
+	if redactAddresses {
+		resp.LeaderAddress = ""
+		resp.LeaderClusterAddress = ""
+	}
+
 	resp.RaftCommittedIndex, resp.RaftAppliedIndex = core.GetRaftIndexesLocked()
+
 	return resp, nil
 }
 
 func (b *SystemBackend) handleSealStatus(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
+	var tokenPresent bool
+	token := req.ClientToken
+	if token != "" {
+		// We don't care about the error, we just want to know if the token exists
+		_, tokenEntry, _, _, err := b.Core.fetchACLTokenEntryAndEntity(ctx, req)
+		tokenPresent = err == nil && tokenEntry != nil
+	}
+	// If there is a valid token then we will not redact any values
+	if tokenPresent {
+		ctx = logical.CreateContextRedactionSettings(ctx, false, false, false)
+	}
 	status, err := b.Core.GetSealStatus(ctx, false)
 	if err != nil {
 		return nil, err
@@ -5674,7 +5822,19 @@ func (b *SystemBackend) handleSealStatus(ctx context.Context, req *logical.Reque
 }
 
 func (b *SystemBackend) handleLeaderStatus(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	status, err := b.Core.GetLeaderStatusLocked()
+	var tokenPresent bool
+	token := req.ClientToken
+
+	if token != "" {
+		// We don't care about the error, we just want to know if token exists
+		_, tokenEntry, _, _, err := b.Core.fetchACLTokenEntryAndEntity(ctx, req)
+		tokenPresent = err == nil && tokenEntry != nil
+	}
+
+	if tokenPresent {
+		ctx = logical.CreateContextRedactionSettings(ctx, false, false, false)
+	}
+	status, err := b.Core.GetLeaderStatusLocked(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -5751,16 +5911,17 @@ func (b *SystemBackend) handleHAStatus(ctx context.Context, req *logical.Request
 }
 
 type HAStatusNode struct {
-	Hostname           string     `json:"hostname"`
-	APIAddress         string     `json:"api_address"`
-	ClusterAddress     string     `json:"cluster_address"`
-	ActiveNode         bool       `json:"active_node"`
-	LastEcho           *time.Time `json:"last_echo"`
-	Version            string     `json:"version"`
-	UpgradeVersion     string     `json:"upgrade_version,omitempty"`
-	RedundancyZone     string     `json:"redundancy_zone,omitempty"`
-	EchoDurationMillis int64      `json:"echo_duration_ms"`
-	ClockSkewMillis    int64      `json:"clock_skew_ms"`
+	Hostname                    string     `json:"hostname"`
+	APIAddress                  string     `json:"api_address"`
+	ClusterAddress              string     `json:"cluster_address"`
+	ActiveNode                  bool       `json:"active_node"`
+	LastEcho                    *time.Time `json:"last_echo"`
+	Version                     string     `json:"version"`
+	UpgradeVersion              string     `json:"upgrade_version,omitempty"`
+	RedundancyZone              string     `json:"redundancy_zone,omitempty"`
+	EchoDurationMillis          int64      `json:"echo_duration_ms"`
+	ClockSkewMillis             int64      `json:"clock_skew_ms"`
+	ReplicationPrimaryCanaryAge int64      `json:"replication_primary_canary_age_ms"`
 }
 
 func (b *SystemBackend) handleVersionHistoryList(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
@@ -5983,13 +6144,75 @@ func (b *SystemBackend) handleReadExperiments(ctx context.Context, _ *logical.Re
 	}, nil
 }
 
+// handleWellKnownList handles /sys/well-known/ endpoint to provide the list of registered labels
+// within the /.well-known path on this server
+func (b *SystemBackend) handleWellKnownList() framework.OperationFunc {
+	return func(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+		labels := b.Core.WellKnownRedirects.List()
+
+		respKeys := []string{}
+		respKeyInfo := map[string]interface{}{}
+
+		for label, wk := range labels {
+			respKeys = append(respKeys, label)
+
+			mountPath := ""
+			m := b.Core.router.MatchingMountByUUID(wk.mountUUID)
+			if m != nil {
+				mountPath, _ = url.JoinPath(m.namespace.Path, m.Path)
+			}
+
+			respKeyInfo[label] = map[string]interface{}{
+				"mount_path": mountPath,
+				"mount_uuid": wk.mountUUID,
+				"prefix":     wk.prefix,
+			}
+		}
+
+		return logical.ListResponseWithInfo(respKeys, respKeyInfo), nil
+	}
+}
+
+// handleWellKnownRead handles the "/sys/well-known/<name>" endpoint to read a registered well-known label
+func (b *SystemBackend) handleWellKnownRead() framework.OperationFunc {
+	return func(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+		label := data.Get("label").(string)
+
+		wk, ok := b.Core.WellKnownRedirects.Get(label)
+		if !ok {
+			return nil, nil
+		}
+
+		mountPath := ""
+		m := b.Core.router.MatchingMountByUUID(wk.mountUUID)
+		if m != nil {
+			mountPath, _ = url.JoinPath(m.namespace.Path, m.Path)
+		}
+
+		return &logical.Response{
+			Data: map[string]interface{}{
+				"label":      label,
+				"mount_path": mountPath,
+				"mount_uuid": wk.mountUUID,
+				"prefix":     wk.prefix,
+			},
+		}, nil
+	}
+}
+
 func sanitizePath(path string) string {
 	if !strings.HasSuffix(path, "/") {
 		path += "/"
 	}
 
-	if strings.HasPrefix(path, "/") {
-		path = path[1:]
+	// Check for the specified prefixes and trim them if present
+	for strings.HasPrefix(path, "/") || strings.HasPrefix(path, "/\\") {
+		switch {
+		case strings.HasPrefix(path, "/\\"):
+			path = path[2:]
+		case strings.HasPrefix(path, "/"):
+			path = path[1:]
+		}
 	}
 
 	return path
@@ -6221,11 +6444,11 @@ in the plugin catalog.`,
 	},
 
 	"tune_audit_non_hmac_request_keys": {
-		`The list of keys in the request data object that will not be HMAC'ed by audit devices.`,
+		`The list of keys in the request data object that will not be HMAC'd by audit devices.`,
 	},
 
 	"tune_audit_non_hmac_response_keys": {
-		`The list of keys in the response data object that will not be HMAC'ed by audit devices.`,
+		`The list of keys in the response data object that will not be HMAC'd by audit devices.`,
 	},
 
 	"tune_mount_options": {
@@ -6290,7 +6513,7 @@ This path responds to the following HTTP methods.
 	},
 
 	"alias_identifier": {
-		`It is the name of the alias (user). For example, if the alias belongs to userpass backend, 
+		`It is the name of the alias (user). For example, if the alias belongs to userpass backend,
 	   the name should be a valid username within userpass auth method. If the alias belongs
 	    to an approle auth method, the name should be a valid RoleID`,
 		"",
@@ -6712,6 +6935,11 @@ Must already be present on the machine.`,
 		`The Vault plugin runtime to use when running the plugin.`,
 		"",
 	},
+	"plugin-catalog_download": {
+		`Automatically downloads official HashiCorp plugins
+from releases.hashicorp.com (beta)`,
+		"",
+	},
 	"plugin-catalog-pins": {
 		"Configures pinned plugin versions from the plugin catalog",
 		`
@@ -6911,10 +7139,6 @@ This path responds to the following HTTP methods.
 		"Currently unsupported. Previously, count of requests seen by this Vault cluster over time.",
 		"Currently unsupported. Previously, count of requests seen by this Vault cluster over time. Not included in count: health checks, UI asset requests, requests forwarded from another cluster.",
 	},
-	"internal-counters-tokens": {
-		"Count of active tokens in this Vault cluster.",
-		"Count of active tokens in this Vault cluster.",
-	},
 	"internal-counters-entities": {
 		"Count of active entities in this Vault cluster.",
 		"Count of active entities in this Vault cluster.",
@@ -6945,6 +7169,11 @@ This path responds to the following HTTP methods.
 		"Count of active clients so far this month.",
 		"Count of active clients so far this month.",
 	},
+	"activity-cumulative": {
+		"Cumulative count of clients under each namespace.",
+		`Cumulative count of clients under each namespace.
+		A cumulative count is the sum of the clients belonging to a namespace and all its child namespaces.`,
+	},
 	"activity-config": {
 		"Control the collection and reporting of client counts.",
 		"Control the collection and reporting of client counts.",
@@ -6987,4 +7216,39 @@ This path responds to the following HTTP methods.
 		returns the manual license reporting data.
 		`,
 	},
+
+	"well-known-list": {
+		`List the registered well-known labels to associated mounts.`,
+		`
+This path responds to the following HTTP methods.
+    LIST /
+        List the names of the registered labels within the .well-known folder on this server.
+
+    GET /
+        List the names of the registered labels within the .well-known folder on this server.
+
+    GET /<label>
+        Retrieve the information regarding a specific registered label on this server.
+	    `,
+	},
+
+	"well-known": {
+		`Read the associated mount info for a registered label within the well-known path prefix`,
+		`
+        Retrieve the information regarding a specific registered label on this server.
+		`,
+	},
+
+	"well-known-label": {
+		`The label representing a path-prefix within the /.well-known/ path`,
+		"",
+	},
+	"trim_request_trailing_slashes": {
+		`Whether to trim a trailing slash on incoming requests to this mount`,
+		"",
+	},
+	"pki-certificate-count": {
+		"Count of PKI certificates issued and stored by PKI backends on this cluster",
+		"Count of PKI certificates issued and stored by PKI backends on this cluster",
+	},
 }
diff --git a/vault/logical_system_activation_flags.go b/vault/logical_system_activation_flags.go
new file mode 100644
index 00000000000..13124eab703
--- /dev/null
+++ b/vault/logical_system_activation_flags.go
@@ -0,0 +1,189 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package vault
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/hashicorp/vault/helper/activationflags"
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+const (
+	paramFeatureName = "feature_name"
+	descFeatureName  = "The name of the feature to be activated."
+	summaryList      = "Returns the available and activated activation-flagged features."
+	summaryUpdate    = "Activate a flagged feature."
+
+	prefixActivationFlags         = "activation-flags"
+	verbActivationFlagsActivate   = "activate"
+	verbActivationFlagsDeactivate = "deactivate"
+
+	fieldActivated   = "activated"
+	fieldUnactivated = "unactivated"
+
+	helpSynopsis    = "Returns information about Vault's features that require a one-time activation step."
+	helpDescription = `
+This path responds to the following HTTP methods.
+	GET /
+		Returns the available and activated activation-flags.
+
+	PUT|POST /<feature-name>/activate
+		Activates the specified feature. Cannot be undone.`
+
+	activationFlagTest = "activation-test"
+)
+
+// These variables should only be mutated during initialization or server construction.
+// It is unsafe to modify them once the Vault core is running.
+var (
+	readActivationFlag = func(ctx context.Context, b *SystemBackend, req *logical.Request, fd *framework.FieldData) (*logical.Response, error) {
+		return b.readActivationFlag(ctx, req, fd)
+	}
+
+	writeActivationFlag = func(ctx context.Context, b *SystemBackend, req *logical.Request, fd *framework.FieldData, isActivate bool) (*logical.Response, error) {
+		return b.writeActivationFlagWrite(ctx, req, fd, isActivate)
+	}
+)
+
+func (b *SystemBackend) activationFlagsPaths() []*framework.Path {
+	return []*framework.Path{
+		{
+			Pattern: fmt.Sprintf("%s$", prefixActivationFlags),
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationVerb:   "read",
+				OperationSuffix: prefixActivationFlags,
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.ReadOperation: &framework.PathOperation{
+					Callback: b.handleActivationFlagRead,
+					Summary:  summaryList,
+				},
+			},
+			HelpSynopsis:    helpSynopsis,
+			HelpDescription: helpDescription,
+		},
+		{
+			Pattern: fmt.Sprintf("%s/%s/%s", prefixActivationFlags, activationFlagTest, verbActivationFlagsActivate),
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: prefixActivationFlags,
+				OperationVerb:   verbActivationFlagsActivate,
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.UpdateOperation: &framework.PathOperation{
+					Callback:                    b.handleActivationFlagsActivate,
+					ForwardPerformanceSecondary: true,
+					ForwardPerformanceStandby:   true,
+					Summary:                     summaryUpdate,
+				},
+			},
+			HelpSynopsis:    helpSynopsis,
+			HelpDescription: helpDescription,
+		},
+		{
+			Pattern: fmt.Sprintf("%s/%s/%s", prefixActivationFlags, activationflags.IdentityDeduplication, verbActivationFlagsActivate),
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: prefixActivationFlags,
+				OperationVerb:   verbActivationFlagsActivate,
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.UpdateOperation: &framework.PathOperation{
+					Callback:                    b.handleActivationFlagsActivate,
+					ForwardPerformanceSecondary: true,
+					ForwardPerformanceStandby:   true,
+					Summary:                     summaryUpdate,
+				},
+			},
+			HelpSynopsis:    helpSynopsis,
+			HelpDescription: helpDescription,
+		},
+		{
+			Pattern: fmt.Sprintf("%s/%s/%s", prefixActivationFlags, activationflags.SCIMEnablement, verbActivationFlagsActivate),
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: prefixActivationFlags,
+				OperationVerb:   verbActivationFlagsActivate,
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.UpdateOperation: &framework.PathOperation{
+					Callback:                    b.handleActivationFlagsActivate,
+					ForwardPerformanceSecondary: true,
+					ForwardPerformanceStandby:   true,
+					Summary:                     summaryUpdate,
+				},
+			},
+			HelpSynopsis:    helpSynopsis,
+			HelpDescription: helpDescription,
+		},
+	}
+}
+
+func (b *SystemBackend) handleActivationFlagRead(ctx context.Context, req *logical.Request, fd *framework.FieldData) (*logical.Response, error) {
+	return readActivationFlag(ctx, b, req, fd)
+}
+
+func (b *SystemBackend) handleActivationFlagsActivate(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	return writeActivationFlag(ctx, b, req, data, true)
+}
+
+func (b *SystemBackend) readActivationFlag(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
+	activationFlags, err := b.Core.FeatureActivationFlags.Get(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return b.activationFlagsToResponse(activationFlags), nil
+}
+
+func (b *SystemBackend) writeActivationFlagWrite(ctx context.Context, req *logical.Request, _ *framework.FieldData, isActivate bool) (*logical.Response, error) {
+	// We need to manually parse out the feature_name from the path because we can't use FieldSchema parameters
+	// in the path to make generic endpoints. We need each activation-flag path to be a separate endpoint.
+	// Path starts out as activation-flags/<feature_name>/verb
+	// Removes activation-flags/ from the path
+	trimPrefix := strings.TrimPrefix(req.Path, prefixActivationFlags+"/")
+	// Removes /verb from the path
+	featureName := trimPrefix[:strings.LastIndex(trimPrefix, "/")]
+
+	err := b.Core.FeatureActivationFlags.SetActivationFlagEnabled(ctx, featureName, isActivate)
+	if err != nil {
+		return nil, fmt.Errorf("failed to write new activation flags: %w", err)
+	}
+
+	// We read back the value after writing it to storage so that we can try forcing a cache update right away.
+	// If this fails, it's still okay to proceed as the write has been successful and the cache will get updated
+	// at the time of an endpoint getting called. However, we can only return the one feature name we just activated
+	// in the response since the read to retrieve any others did not succeed.
+	activationFlags, err := b.Core.FeatureActivationFlags.Get(ctx)
+	if err != nil {
+		resp := b.activationFlagsToResponse([]string{featureName})
+		return resp, fmt.Errorf("failed to read activation-flags back after write: %w", err)
+	}
+
+	return b.activationFlagsToResponse(activationFlags), nil
+}
+
+func (b *SystemBackend) activationFlagsToResponse(activationFlags []string) *logical.Response {
+	slices.Sort(activationFlags)
+	return &logical.Response{
+		Data: map[string]interface{}{
+			fieldActivated: activationFlags,
+		},
+	}
+}
+
+// activateIdentity activates a feature in the identity backend.
+func (b *SystemBackend) activateIdentity(ctx context.Context, _ *logical.Request, featureName string) error {
+	if b.idStoreBackend == nil || b.idStoreBackend.ActivationFunc == nil {
+		return nil
+	}
+
+	if err := b.idStoreBackend.ActivationFunc(ctx, nil, featureName); err != nil {
+		b.logger.Error("activation flag error", "error", err)
+	}
+
+	return nil
+}
diff --git a/vault/logical_system_activation_flags_test.go b/vault/logical_system_activation_flags_test.go
new file mode 100644
index 00000000000..a9b558bc54b
--- /dev/null
+++ b/vault/logical_system_activation_flags_test.go
@@ -0,0 +1,109 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/vault/helper/activationflags"
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+)
+
+// TestActivationFlags_Read tests the read operation for the activation flags.
+func TestActivationFlags_Read(t *testing.T) {
+	t.Run("given an initial state then read flags and expect all to be unactivated", func(t *testing.T) {
+		core, _, _ := TestCoreUnsealedWithConfig(t, &CoreConfig{})
+
+		resp, err := core.systemBackend.HandleRequest(
+			context.Background(),
+			&logical.Request{
+				Operation: logical.ReadOperation,
+				Path:      prefixActivationFlags,
+				Storage:   core.systemBarrierView,
+			},
+		)
+
+		require.NoError(t, err)
+		require.Equal(t, resp.Data, map[string]interface{}{
+			"activated": []string{},
+		})
+	})
+}
+
+// TestActivationFlags_BadFeatureName tests a nonexistent feature name or a missing feature name
+// in the activation-flags path API call.
+func TestActivationFlags_BadFeatureName(t *testing.T) {
+	core, _, _ := TestCoreUnsealedWithConfig(t, &CoreConfig{})
+
+	tests := map[string]struct {
+		featureName string
+	}{
+		"if no feature name is provided then expect unsupported path": {
+			featureName: "",
+		},
+		"if an invalid feature name is provided then expect unsupported path": {
+			featureName: "fake-feature",
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			resp, err := core.router.Route(
+				namespace.ContextWithNamespace(context.Background(), namespace.RootNamespace),
+				&logical.Request{
+					Operation: logical.UpdateOperation,
+					Path:      fmt.Sprintf("sys/%s/%s/%s", prefixActivationFlags, tt.featureName, verbActivationFlagsActivate),
+					Storage:   core.systemBarrierView,
+				},
+			)
+
+			require.Error(t, err)
+			require.Nil(t, resp)
+			require.Equal(t, err, logical.ErrUnsupportedPath)
+		})
+	}
+}
+
+// TestActivationFlags_Write tests the write operations for the activation flags
+func TestActivationFlags_Write(t *testing.T) {
+	t.Run("given an initial state then write an activation test flag and expect no errors", func(t *testing.T) {
+		core, _, _ := TestCoreUnsealedWithConfig(t, &CoreConfig{})
+
+		_, err := core.systemBackend.HandleRequest(
+			context.Background(),
+			&logical.Request{
+				Operation: logical.UpdateOperation,
+				Path:      fmt.Sprintf("%s/%s/%s", prefixActivationFlags, activationFlagTest, verbActivationFlagsActivate),
+				Storage:   core.systemBarrierView,
+			},
+		)
+
+		require.NoError(t, err)
+	})
+
+	t.Run("activate identity cleanup flag", func(t *testing.T) {
+		core, _, _ := TestCoreUnsealedWithConfig(t, &CoreConfig{})
+
+		resp, err := core.systemBackend.HandleRequest(
+			context.Background(),
+			&logical.Request{
+				Operation: logical.UpdateOperation,
+				Path:      fmt.Sprintf("%s/%s/%s", prefixActivationFlags, activationflags.IdentityDeduplication, verbActivationFlagsActivate),
+				Storage:   core.systemBarrierView,
+			},
+		)
+
+		require.NoError(t, err)
+		require.NotNil(t, resp)
+		require.NotEmpty(t, resp.Data)
+		require.NotNil(t, resp.Data["activated"])
+		require.Contains(t, resp.Data["activated"], activationflags.IdentityDeduplication)
+	})
+}
diff --git a/vault/logical_system_activity.go b/vault/logical_system_activity.go
index cf0d6a273f8..1227f173cfa 100644
--- a/vault/logical_system_activity.go
+++ b/vault/logical_system_activity.go
@@ -1,10 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"os"
@@ -13,11 +14,39 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
+	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/timeutil"
 	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/helper/errutil"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
+// defaultToRetentionMonthsMaxWarning is a warning message for setting the max retention_months value when retention_months value is more than activityLogMaximumRetentionMonths
+var defaultToRetentionMonthsMaxWarning = fmt.Sprintf("retention_months cannot be greater than %d; capped to %d.", activityLogMaximumRetentionMonths, activityLogMaximumRetentionMonths)
+
+const (
+	// WarningCurrentBillingPeriodDeprecated is a warning string that is used to indicate that the current_billing_period field, as the default start time will automatically be the billing period start date
+	WarningCurrentBillingPeriodDeprecated = "current_billing_period is deprecated; unless otherwise specified, all requests will default to the current billing period"
+
+	// WarningProvidedStartAndEndTimesIgnored is a warning string that is used to indicate that the provided start and end times by the user have been aligned to a billing period's start and end times
+	WarningProvidedStartAndEndTimesIgnored = "start_time and end_time parameters can only be used to specify the beginning or end of the same billing period. The values provided for these parameters are not supported and are ignored. Showing the data for the entire billing period corresponding to start_time. If start_time is not provided, the billing period is determined based on the end_time."
+
+	// WarningEndTimeAsCurrentMonthOrFutureIgnored is a warning string that is used to indicate the provided end time has been adjusted to the previous month if it was provided to be within the current month or in future date
+	WarningEndTimeAsCurrentMonthOrFutureIgnored = "end_time parameter can only be used to specify a date until the end of previous month. The value provided for this parameter was in the current month or in the future date and was therefore ignored. The response includes data until the end of the previous month."
+
+	// ErrWaitingForClientIDsToLoadToMemory is an error string that is used to indicate that the clientIDs are currently being loaded to memory which is needed to compute the actual values for new clients in the current month.
+	ErrWaitingForClientIDsToLoadToMemory = "We are gathering the most up-to-date client usage information. Please try again later."
+
+	// WarningCurrentMonthDataNotIncluded is a warning string that is used to indicate the the current month's data will be included in the next billing period, and not the current
+	WarningCurrentMonthDataNotIncluded = "The current month's data will not be included in the current billing period client count as this month is outside of the 12 month billing period. This data will be included in the next billing period"
+)
+
+type StartEndTimesWarnings struct {
+	TimesAlignedToBilling       bool
+	EndTimeAdjustedToPastMonth  bool
+	CurrentMonthDataNotIncluded bool
+}
+
 // activityQueryPath is available in every namespace
 func (b *SystemBackend) activityQueryPath() *framework.Path {
 	return &framework.Path{
@@ -31,21 +60,26 @@ func (b *SystemBackend) activityQueryPath() *framework.Path {
 
 		Fields: map[string]*framework.FieldSchema{
 			"current_billing_period": {
+				Deprecated:  true,
 				Type:        framework.TypeBool,
 				Description: "Query utilization for configured billing period",
+				Query:       true,
 			},
 			"start_time": {
 				Type:        framework.TypeTime,
 				Description: "Start of query interval",
+				Query:       true,
 			},
 			"end_time": {
 				Type:        framework.TypeTime,
 				Description: "End of query interval",
+				Query:       true,
 			},
 			"limit_namespaces": {
 				Type:        framework.TypeInt,
 				Default:     0,
 				Description: "Limit query output by namespaces",
+				Query:       true,
 			},
 		},
 		HelpSynopsis:    strings.TrimSpace(sysHelp["activity-query"][0]),
@@ -55,6 +89,42 @@ func (b *SystemBackend) activityQueryPath() *framework.Path {
 			logical.ReadOperation: &framework.PathOperation{
 				Callback: b.handleClientMetricQuery,
 				Summary:  "Report the client count metrics, for this namespace and all child namespaces.",
+				Responses: map[int][]framework.Response{
+					http.StatusOK: {{
+						Description: http.StatusText(http.StatusOK),
+						Fields: map[string]*framework.FieldSchema{
+							"start_time": {
+								Type:        framework.TypeTime,
+								Description: "The start time of the query interval.",
+							},
+							"end_time": {
+								Type:        framework.TypeTime,
+								Description: "The end time of the query interval.",
+							},
+							"by_namespace": {
+								Type:        framework.TypeSlice,
+								Description: "A list of usage counts broken down by namespace. Each element is an object containing namespace name, counts, and mounts.",
+							},
+							"total": {
+								Type:        framework.TypeMap,
+								Description: "Aggregated usage counts across all namespaces.",
+							},
+							"months": {
+								Type:        framework.TypeSlice,
+								Description: "A list of objects, each representing monthly client count data.",
+							},
+						},
+					}},
+					http.StatusNoContent: {{
+						Description: http.StatusText(http.StatusNoContent),
+					}},
+					http.StatusBadRequest: {{
+						Description: http.StatusText(http.StatusBadRequest),
+					}},
+					http.StatusInternalServerError: {{
+						Description: http.StatusText(http.StatusInternalServerError),
+					}},
+				},
 			},
 		},
 	}
@@ -77,6 +147,50 @@ func (b *SystemBackend) monthlyActivityCountPath() *framework.Path {
 			logical.ReadOperation: &framework.PathOperation{
 				Callback: b.handleMonthlyActivityCount,
 				Summary:  "Report the number of clients for this month, for this namespace and all child namespaces.",
+				Responses: map[int][]framework.Response{
+					http.StatusOK: {{
+						Description: http.StatusText(http.StatusOK),
+						Fields: map[string]*framework.FieldSchema{
+							"by_namespace": {
+								Type:        framework.TypeSlice,
+								Description: "A list of usage counts broken down by namespace. Each element is an object containing namespace name, counts, and mounts.",
+							},
+							"entity_clients": {
+								Type:        framework.TypeInt,
+								Description: "The number of unique entity clients for the month.",
+							},
+							"non_entity_clients": {
+								Type:        framework.TypeInt,
+								Description: "The number of unique non-entity clients for the month.",
+							},
+							"clients": {
+								Type:        framework.TypeInt,
+								Description: "The total number of unique clients for the month.",
+							},
+							"secret_syncs": {
+								Type:        framework.TypeInt,
+								Description: "The number of secret synchronizations for the month.",
+							},
+							"acme_clients": {
+								Type:        framework.TypeInt,
+								Description: "The number of ACME clients for the month.",
+							},
+							"months": {
+								Type:        framework.TypeSlice,
+								Description: "A list of objects, each representing monthly client count data.",
+							},
+						},
+					}},
+					http.StatusNoContent: {{
+						Description: http.StatusText(http.StatusNoContent),
+					}},
+					http.StatusBadRequest: {{
+						Description: http.StatusText(http.StatusBadRequest),
+					}},
+					http.StatusInternalServerError: {{
+						Description: http.StatusText(http.StatusInternalServerError),
+					}},
+				},
 			},
 		},
 	}
@@ -86,6 +200,57 @@ func (b *SystemBackend) activityPaths() []*framework.Path {
 	return []*framework.Path{
 		b.monthlyActivityCountPath(),
 		b.activityQueryPath(),
+		{
+			Pattern: "internal/counters/activity/export$",
+
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: "internal-client-activity",
+				OperationVerb:   "export",
+			},
+
+			Fields: map[string]*framework.FieldSchema{
+				"start_time": {
+					Type:        framework.TypeTime,
+					Description: "Start of query interval",
+					Query:       true,
+				},
+				"end_time": {
+					Type:        framework.TypeTime,
+					Description: "End of query interval",
+					Query:       true,
+				},
+				"format": {
+					Type:        framework.TypeString,
+					Description: "Format of the file. Either a CSV or a JSON file with an object per line.",
+					Default:     "json",
+					Query:       true,
+				},
+			},
+
+			HelpSynopsis:    strings.TrimSpace(sysHelp["activity-export"][0]),
+			HelpDescription: strings.TrimSpace(sysHelp["activity-export"][1]),
+
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.ReadOperation: &framework.PathOperation{
+					Callback: b.handleClientExport,
+					Summary:  "Returns a deduplicated export of all clients that had activity within the provided start and end times for this namespace and all child namespaces.",
+					Responses: map[int][]framework.Response{
+						http.StatusOK: {{
+							Description: http.StatusText(http.StatusOK),
+						}},
+						http.StatusNoContent: {{
+							Description: http.StatusText(http.StatusNoContent),
+						}},
+						http.StatusBadRequest: {{
+							Description: http.StatusText(http.StatusBadRequest),
+						}},
+						http.StatusInternalServerError: {{
+							Description: http.StatusText(http.StatusInternalServerError),
+						}},
+					},
+				},
+			},
+		},
 	}
 }
 
@@ -106,16 +271,20 @@ func (b *SystemBackend) rootActivityPaths() []*framework.Path {
 					Type:        framework.TypeInt,
 					Default:     12,
 					Description: "Number of months to report if no start date specified.",
+					Deprecated:  true,
+					Query:       true,
 				},
 				"retention_months": {
 					Type:        framework.TypeInt,
-					Default:     24,
+					Default:     ActivityLogMinimumRetentionMonths,
 					Description: "Number of months of client data to retain. Setting to 0 will clear all existing data.",
+					Query:       true,
 				},
 				"enabled": {
 					Type:        framework.TypeString,
 					Default:     "default",
 					Description: "Enable or disable collection of client count: enable, disable, or default.",
+					Query:       true,
 				},
 			},
 			HelpSynopsis:    strings.TrimSpace(sysHelp["activity-config"][0]),
@@ -128,6 +297,43 @@ func (b *SystemBackend) rootActivityPaths() []*framework.Path {
 						OperationSuffix: "configuration",
 					},
 					Summary: "Read the client count tracking configuration.",
+					Responses: map[int][]framework.Response{
+						http.StatusOK: {{
+							Description: http.StatusText(http.StatusOK),
+							Fields: map[string]*framework.FieldSchema{
+								"retention_months": {
+									Type:        framework.TypeInt,
+									Description: "The number of months of client data to retain.",
+								},
+								"enabled": {
+									Type:        framework.TypeString,
+									Description: "The current state of client count collection.",
+								},
+								"queries_available": {
+									Type:        framework.TypeBool,
+									Description: "Indicates if activity queries are available.",
+								},
+								"reporting_enabled": {
+									Type:        framework.TypeBool,
+									Description: "Indicates if automated license reporting is enabled.",
+								},
+								"billing_start_timestamp": {
+									Type:        framework.TypeTime,
+									Description: "The timestamp for the start of the billing period.",
+								},
+								"minimum_retention_months": {
+									Type:        framework.TypeInt,
+									Description: "The minimum retention period required.",
+								},
+							},
+						}},
+						http.StatusBadRequest: {{
+							Description: http.StatusText(http.StatusBadRequest),
+						}},
+						http.StatusInternalServerError: {{
+							Description: http.StatusText(http.StatusInternalServerError),
+						}},
+					},
 				},
 				logical.UpdateOperation: &framework.PathOperation{
 					Callback: b.handleActivityConfigUpdate,
@@ -135,6 +341,17 @@ func (b *SystemBackend) rootActivityPaths() []*framework.Path {
 						OperationVerb: "configure",
 					},
 					Summary: "Enable or disable collection of client count, set retention period, or set default reporting period.",
+					Responses: map[int][]framework.Response{
+						http.StatusOK: {{
+							Description: http.StatusText(http.StatusOK),
+						}},
+						http.StatusBadRequest: {{
+							Description: http.StatusText(http.StatusBadRequest),
+						}},
+						http.StatusInternalServerError: {{
+							Description: http.StatusText(http.StatusInternalServerError),
+						}},
+					},
 				},
 			},
 		},
@@ -150,15 +367,18 @@ func (b *SystemBackend) rootActivityPaths() []*framework.Path {
 				"start_time": {
 					Type:        framework.TypeTime,
 					Description: "Start of query interval",
+					Query:       true,
 				},
 				"end_time": {
 					Type:        framework.TypeTime,
 					Description: "End of query interval",
+					Query:       true,
 				},
 				"format": {
 					Type:        framework.TypeString,
 					Description: "Format of the file. Either a CSV or a JSON file with an object per line.",
 					Default:     "json",
+					Query:       true,
 				},
 			},
 
@@ -169,6 +389,20 @@ func (b *SystemBackend) rootActivityPaths() []*framework.Path {
 				logical.ReadOperation: &framework.PathOperation{
 					Callback: b.handleClientExport,
 					Summary:  "Report the client count metrics, for this namespace and all child namespaces.",
+					Responses: map[int][]framework.Response{
+						http.StatusOK: {{
+							Description: http.StatusText(http.StatusOK),
+						}},
+						http.StatusNoContent: {{
+							Description: http.StatusText(http.StatusNoContent),
+						}},
+						http.StatusBadRequest: {{
+							Description: http.StatusText(http.StatusBadRequest),
+						}},
+						http.StatusInternalServerError: {{
+							Description: http.StatusText(http.StatusInternalServerError),
+						}},
+					},
 				},
 			},
 		},
@@ -179,23 +413,25 @@ func (b *SystemBackend) rootActivityPaths() []*framework.Path {
 	return paths
 }
 
-func parseStartEndTimes(a *ActivityLog, d *framework.FieldData) (time.Time, time.Time, error) {
+func parseStartEndTimes(d *framework.FieldData, billingStartTime time.Time) (time.Time, time.Time, error) {
 	startTime := d.Get("start_time").(time.Time)
 	endTime := d.Get("end_time").(time.Time)
 
 	// If a specific endTime is used, then respect that
-	// otherwise we want to give the latest N months, so go back to the start
-	// of the previous month
+	// otherwise we want to query up until the end of the current month.
 	//
 	// Also convert any user inputs to UTC to avoid
 	// problems later.
 	if endTime.IsZero() {
-		endTime = timeutil.EndOfMonth(timeutil.StartOfPreviousMonth(time.Now().UTC()))
+		endTime = time.Now().UTC()
 	} else {
 		endTime = endTime.UTC()
 	}
+
+	// If startTime is not specified, we would like to query
+	// from the beginning of the billing period
 	if startTime.IsZero() {
-		startTime = a.DefaultStartTime(endTime)
+		startTime = billingStartTime
 	} else {
 		startTime = startTime.UTC()
 	}
@@ -215,7 +451,7 @@ func (b *SystemBackend) handleClientExport(ctx context.Context, req *logical.Req
 		return logical.ErrorResponse("no activity log present"), nil
 	}
 
-	startTime, endTime, err := parseStartEndTimes(a, d)
+	startTime, endTime, err := parseStartEndTimes(d, b.Core.BillingStart())
 	if err != nil {
 		return logical.ErrorResponse(err.Error()), nil
 	}
@@ -229,19 +465,30 @@ func (b *SystemBackend) handleClientExport(ctx context.Context, req *logical.Req
 		}
 	}
 
-	runCtx, cancelFunc := context.WithTimeout(b.Core.activeContext, timeout)
+	ns, err := namespace.FromContext(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	nsActiveContext := namespace.ContextWithNamespace(b.Core.activeContext, ns)
+	runCtx, cancelFunc := context.WithTimeout(nsActiveContext, timeout)
 	defer cancelFunc()
 
 	err = a.writeExport(runCtx, req.ResponseWriter, d.Get("format").(string), startTime, endTime)
 	if err != nil {
-		return nil, err
+		if errors.Is(err, ErrActivityExportInProgress) || strings.HasPrefix(err.Error(), ActivityExportInvalidFormatPrefix) {
+			return logical.ErrorResponse(err.Error()), nil
+		} else {
+			return nil, err
+		}
 	}
 
-	return nil, nil
+	// default status to 204, this will get rewritten to 200 later if the export writes data to req.ResponseWriter
+	respNoContent, err := logical.RespondWithStatusCode(&logical.Response{}, req, http.StatusNoContent)
+	return respNoContent, err
 }
 
 func (b *SystemBackend) handleClientMetricQuery(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	var startTime, endTime time.Time
 	b.Core.activityLogLock.RLock()
 	a := b.Core.activityLog
 	b.Core.activityLogLock.RUnlock()
@@ -249,15 +496,18 @@ func (b *SystemBackend) handleClientMetricQuery(ctx context.Context, req *logica
 		return logical.ErrorResponse("no activity log present"), nil
 	}
 
-	if d.Get("current_billing_period").(bool) {
-		startTime = b.Core.BillingStart()
-		endTime = time.Now().UTC()
-	} else {
-		var err error
-		startTime, endTime, err = parseStartEndTimes(a, d)
-		if err != nil {
-			return logical.ErrorResponse(err.Error()), nil
-		}
+	warnings := make([]string, 0)
+
+	if _, ok := d.GetOk("current_billing_period"); ok {
+		warnings = append(warnings, WarningCurrentBillingPeriodDeprecated)
+	}
+
+	var err error
+	var timeWarnings StartEndTimesWarnings
+	now := time.Now()
+	startTime, endTime, timeWarnings, err := getStartEndTime(d, now, b.Core.BillingStart())
+	if err != nil {
+		return logical.ErrorResponse(err.Error()), nil
 	}
 
 	var limitNamespaces int
@@ -265,17 +515,36 @@ func (b *SystemBackend) handleClientMetricQuery(ctx context.Context, req *logica
 		limitNamespaces = limitNamespacesRaw.(int)
 	}
 
+	// if end time is in the current month and the clientIDs are still being loaded to memory, return an error
+	// this will not block on CE as endtime cannot be in the current month
+	if !a.GetClientIDsUsageInfoLoaded() && timeutil.EndOfMonth(endTime).Equal(timeutil.EndOfMonth(now.UTC())) {
+		return nil, errutil.InternalError{Err: ErrWaitingForClientIDsToLoadToMemory}
+	}
+
 	results, err := a.handleQuery(ctx, startTime, endTime, limitNamespaces)
 	if err != nil {
 		return nil, err
 	}
 	if results == nil {
-		resp204, err := logical.RespondWithStatusCode(nil, req, http.StatusNoContent)
+		resp204, err := logical.RespondWithStatusCode(&logical.Response{
+			Warnings: warnings,
+		}, req, http.StatusNoContent)
 		return resp204, err
 	}
 
+	if timeWarnings.EndTimeAdjustedToPastMonth {
+		warnings = append(warnings, WarningEndTimeAsCurrentMonthOrFutureIgnored)
+	}
+	if timeWarnings.TimesAlignedToBilling {
+		warnings = append(warnings, WarningProvidedStartAndEndTimesIgnored)
+	}
+	if timeWarnings.CurrentMonthDataNotIncluded {
+		warnings = append(warnings, WarningCurrentMonthDataNotIncluded)
+	}
+
 	return &logical.Response{
-		Data: results,
+		Warnings: warnings,
+		Data:     results,
 	}, nil
 }
 
@@ -324,7 +593,6 @@ func (b *SystemBackend) handleActivityConfigRead(ctx context.Context, req *logic
 
 	return &logical.Response{
 		Data: map[string]interface{}{
-			"default_report_months":    config.DefaultReportMonths,
 			"retention_months":         config.RetentionMonths,
 			"enabled":                  config.Enabled,
 			"queries_available":        qa,
@@ -350,10 +618,12 @@ func (b *SystemBackend) handleActivityConfigUpdate(ctx context.Context, req *log
 		return nil, err
 	}
 
+	prevRetentionMonths := config.RetentionMonths
+
 	{
 		// Parse the default report months
-		if defaultReportMonthsRaw, ok := d.GetOk("default_report_months"); ok {
-			config.DefaultReportMonths = defaultReportMonthsRaw.(int)
+		if _, ok := d.GetOk("default_report_months"); ok {
+			warnings = append(warnings, fmt.Sprintf("default_report_months is deprecated: defaulting to billing start time"))
 		}
 
 		if config.DefaultReportMonths <= 0 {
@@ -363,6 +633,8 @@ func (b *SystemBackend) handleActivityConfigUpdate(ctx context.Context, req *log
 
 	{
 		// Parse the retention months
+		// For CE, this value can be between 0 and 60
+		// When reporting is enabled, this value can be between 48 and 60
 		if retentionMonthsRaw, ok := d.GetOk("retention_months"); ok {
 			config.RetentionMonths = retentionMonthsRaw.(int)
 		}
@@ -371,9 +643,9 @@ func (b *SystemBackend) handleActivityConfigUpdate(ctx context.Context, req *log
 			return logical.ErrorResponse("retention_months must be greater than or equal to 0"), logical.ErrInvalidRequest
 		}
 
-		if config.RetentionMonths > 36 {
-			config.RetentionMonths = 36
-			warnings = append(warnings, "retention_months cannot be greater than 36; capped to 36.")
+		if config.RetentionMonths > activityLogMaximumRetentionMonths {
+			config.RetentionMonths = activityLogMaximumRetentionMonths
+			warnings = append(warnings, defaultToRetentionMonthsMaxWarning)
 		}
 	}
 
@@ -404,9 +676,6 @@ func (b *SystemBackend) handleActivityConfigUpdate(ctx context.Context, req *log
 		}
 	}
 
-	a.core.activityLogLock.RLock()
-	minimumRetentionMonths := a.configOverrides.MinimumRetentionMonths
-	a.core.activityLogLock.RUnlock()
 	enabled := config.Enabled == "enable"
 	if !enabled && config.Enabled == "default" {
 		enabled = activityLogEnabledDefault
@@ -416,9 +685,9 @@ func (b *SystemBackend) handleActivityConfigUpdate(ctx context.Context, req *log
 		return logical.ErrorResponse("retention_months cannot be 0 while enabled"), logical.ErrInvalidRequest
 	}
 
-	// if manual license reporting is enabled, retention months must at least be 24 months
-	if a.core.ManualLicenseReportingEnabled() && config.RetentionMonths < minimumRetentionMonths {
-		return logical.ErrorResponse("retention_months must be at least %d while Reporting is enabled", minimumRetentionMonths), logical.ErrInvalidRequest
+	// if manual license reporting is enabled, retention months must at least be 48 months
+	if a.core.ManualLicenseReportingEnabled() && config.RetentionMonths < ActivityLogMinimumRetentionMonths {
+		return logical.ErrorResponse("retention_months must be at least %d while Reporting is enabled", ActivityLogMinimumRetentionMonths), logical.ErrInvalidRequest
 	}
 
 	// Store the config
@@ -433,6 +702,13 @@ func (b *SystemBackend) handleActivityConfigUpdate(ctx context.Context, req *log
 	// Set the new config on the activity log
 	a.SetConfig(ctx, config)
 
+	// Update Census agent's metadata if retention months change
+	if prevRetentionMonths != config.RetentionMonths {
+		if err := b.Core.SetRetentionMonths(config.RetentionMonths); err != nil {
+			return nil, err
+		}
+	}
+
 	if len(warnings) > 0 {
 		return &logical.Response{
 			Warnings: warnings,
diff --git a/vault/logical_system_activity_write.go b/vault/logical_system_activity_write.go
index fd4635458d3..fe03c4b7432 100644
--- a/vault/logical_system_activity_write.go
+++ b/vault/logical_system_activity_write.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !testonly
diff --git a/vault/logical_system_activity_write_testonly.go b/vault/logical_system_activity_write_testonly.go
index 62f7366887f..ab375719ff4 100644
--- a/vault/logical_system_activity_write_testonly.go
+++ b/vault/logical_system_activity_write_testonly.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build testonly
@@ -9,6 +9,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"maps"
 	"strings"
 	"sync"
 	"time"
@@ -47,6 +48,8 @@ func (b *SystemBackend) activityWritePath() *framework.Path {
 }
 
 func (b *SystemBackend) handleActivityWriteData(ctx context.Context, request *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+	now := time.Now().UTC()
+
 	json := data.Get("input")
 	input := &generation.ActivityLogMockInput{}
 	err := protojson.Unmarshal([]byte(json.(string)), input)
@@ -73,7 +76,7 @@ func (b *SystemBackend) handleActivityWriteData(ctx context.Context, request *lo
 	}
 	generated := newMultipleMonthsActivityClients(numMonths + 1)
 	for _, month := range input.Data {
-		err := generated.processMonth(ctx, b.Core, month)
+		err := generated.processMonth(ctx, b.Core, month, now)
 		if err != nil {
 			return logical.ErrorResponse("failed to process data for month %d", month.GetMonthsAgo()), err
 		}
@@ -83,8 +86,9 @@ func (b *SystemBackend) handleActivityWriteData(ctx context.Context, request *lo
 	for _, opt := range input.Write {
 		opts[opt] = struct{}{}
 	}
-	paths, err := generated.write(ctx, opts, b.Core.activityLog)
+	paths, err := generated.write(ctx, opts, b.Core.activityLog, now)
 	if err != nil {
+		b.logger.Debug("failed to write activity log data", "error", err.Error())
 		return logical.ErrorResponse("failed to write data"), err
 	}
 	return &logical.Response{
@@ -123,11 +127,13 @@ func (s *singleMonthActivityClients) addEntityRecord(record *activity.EntityReco
 // keys are the segment index, and the value are the clients that were seen in
 // that index. If the value is an empty slice, then it's an empty index. If the
 // value is nil, then it's a skipped index
-func (s *singleMonthActivityClients) populateSegments() (map[int][]*activity.EntityRecord, error) {
+// If loadClientIDsToMemory is true, it returns the list of clientIDs added.
+func (s *singleMonthActivityClients) populateSegments(loadClientIDsToMemory bool) (map[int][]*activity.EntityRecord, map[string]struct{}, error) {
 	segments := make(map[int][]*activity.EntityRecord)
 	ignoreIndexes := make(map[int]struct{})
 	skipIndexes := s.generationParameters.SkipSegmentIndexes
 	emptyIndexes := s.generationParameters.EmptySegmentIndexes
+	clientIDsAdded := make(map[string]struct{})
 
 	for _, i := range skipIndexes {
 		segments[int(i)] = nil
@@ -144,20 +150,32 @@ func (s *singleMonthActivityClients) populateSegments() (map[int][]*activity.Ent
 			clientsInSegment := make([]*activity.EntityRecord, 0, len(clientIndexes))
 			for _, idx := range clientIndexes {
 				clientsInSegment = append(clientsInSegment, s.clients[idx])
+				if loadClientIDsToMemory {
+					clientIDsAdded[s.clients[idx].ClientID] = struct{}{}
+				}
 			}
 			segments[segment] = clientsInSegment
 		}
-		return segments, nil
+		return segments, clientIDsAdded, nil
+	}
+
+	// determine how many segments are necessary to store the clients for this month
+	// using the default storage limits
+	numNecessarySegments := len(s.clients) / ActivitySegmentClientCapacity
+	if len(s.clients)%ActivitySegmentClientCapacity != 0 {
+		numNecessarySegments++
 	}
+	totalSegmentCount := numNecessarySegments
 
-	totalSegmentCount := 1
+	// override the segment count if set by client
 	if s.generationParameters.GetNumSegments() > 0 {
 		totalSegmentCount = int(s.generationParameters.GetNumSegments())
 	}
+
 	numNonUsable := len(skipIndexes) + len(emptyIndexes)
 	usableSegmentCount := totalSegmentCount - numNonUsable
 	if usableSegmentCount <= 0 {
-		return nil, fmt.Errorf("num segments %d is too low, it must be greater than %d (%d skipped indexes + %d empty indexes)", totalSegmentCount, numNonUsable, len(skipIndexes), len(emptyIndexes))
+		return nil, nil, fmt.Errorf("num segments %d is too low, it must be greater than %d (%d skipped indexes + %d empty indexes)", totalSegmentCount, numNonUsable, len(skipIndexes), len(emptyIndexes))
 	}
 
 	// determine how many clients should be in each segment
@@ -166,6 +184,10 @@ func (s *singleMonthActivityClients) populateSegments() (map[int][]*activity.Ent
 		segmentSizes++
 	}
 
+	if segmentSizes > ActivitySegmentClientCapacity {
+		return nil, nil, fmt.Errorf("the number of segments is too low, it must be greater than %d in order to meet storage limits", numNecessarySegments)
+	}
+
 	clientIndex := 0
 	for i := 0; i < totalSegmentCount; i++ {
 		if clientIndex >= len(s.clients) {
@@ -176,20 +198,25 @@ func (s *singleMonthActivityClients) populateSegments() (map[int][]*activity.Ent
 		}
 		for len(segments[i]) < segmentSizes && clientIndex < len(s.clients) {
 			segments[i] = append(segments[i], s.clients[clientIndex])
+			if loadClientIDsToMemory {
+				clientIDsAdded[s.clients[clientIndex].ClientID] = struct{}{}
+			}
 			clientIndex++
 		}
 	}
-	return segments, nil
+	return segments, clientIDsAdded, nil
 }
 
 // addNewClients generates clients according to the given parameters, and adds them to the month
 // the client will always have the mountAccessor as its mount accessor
-func (s *singleMonthActivityClients) addNewClients(c *generation.Client, mountAccessor string, segmentIndex *int) error {
+func (s *singleMonthActivityClients) addNewClients(c *generation.Client, mountAccessor string, segmentIndex *int, monthsAgo int32, now time.Time) error {
 	count := 1
 	if c.Count > 1 {
 		count = int(c.Count)
 	}
 	isNonEntity := c.ClientType != entityActivityType
+	ts := timeutil.MonthsPreviousTo(int(monthsAgo), now)
+
 	for i := 0; i < count; i++ {
 		record := &activity.EntityRecord{
 			ClientID:      c.Id,
@@ -197,6 +224,8 @@ func (s *singleMonthActivityClients) addNewClients(c *generation.Client, mountAc
 			MountAccessor: mountAccessor,
 			NonEntity:     isNonEntity,
 			ClientType:    c.ClientType,
+			Timestamp:     ts.Unix(),
+			UsageTime:     ts.Unix(),
 		}
 		if record.ClientID == "" {
 			var err error
@@ -211,7 +240,7 @@ func (s *singleMonthActivityClients) addNewClients(c *generation.Client, mountAc
 }
 
 // processMonth populates a month of client data
-func (m *multipleMonthsActivityClients) processMonth(ctx context.Context, core *Core, month *generation.Data) error {
+func (m *multipleMonthsActivityClients) processMonth(ctx context.Context, core *Core, month *generation.Data, now time.Time) error {
 	// default to using the root namespace and the first mount on the root namespace
 	mounts, err := core.ListMounts()
 	if err != nil {
@@ -274,7 +303,7 @@ func (m *multipleMonthsActivityClients) processMonth(ctx context.Context, core *
 				}
 			}
 
-			err = m.addClientToMonth(month.GetMonthsAgo(), clients, mountAccessor, segmentIndex)
+			err = m.addClientToMonth(month.GetMonthsAgo(), clients, mountAccessor, segmentIndex, now)
 			if err != nil {
 				return err
 			}
@@ -300,14 +329,14 @@ func (m *multipleMonthsActivityClients) processMonth(ctx context.Context, core *
 	return nil
 }
 
-func (m *multipleMonthsActivityClients) addClientToMonth(monthsAgo int32, c *generation.Client, mountAccessor string, segmentIndex *int) error {
+func (m *multipleMonthsActivityClients) addClientToMonth(monthsAgo int32, c *generation.Client, mountAccessor string, segmentIndex *int, now time.Time) error {
 	if c.Repeated || c.RepeatedFromMonth > 0 {
-		return m.addRepeatedClients(monthsAgo, c, mountAccessor, segmentIndex)
+		return m.addRepeatedClients(monthsAgo, c, mountAccessor, segmentIndex, now)
 	}
-	return m.months[monthsAgo].addNewClients(c, mountAccessor, segmentIndex)
+	return m.months[monthsAgo].addNewClients(c, mountAccessor, segmentIndex, monthsAgo, now)
 }
 
-func (m *multipleMonthsActivityClients) addRepeatedClients(monthsAgo int32, c *generation.Client, mountAccessor string, segmentIndex *int) error {
+func (m *multipleMonthsActivityClients) addRepeatedClients(monthsAgo int32, c *generation.Client, mountAccessor string, segmentIndex *int, now time.Time) error {
 	addingTo := m.months[monthsAgo]
 	repeatedFromMonth := monthsAgo + 1
 	if c.RepeatedFromMonth > 0 {
@@ -318,9 +347,19 @@ func (m *multipleMonthsActivityClients) addRepeatedClients(monthsAgo int32, c *g
 	if c.Count > 0 {
 		numClients = int(c.Count)
 	}
+
+	// usage time of the client in the month that the client is being added to
+	// this is a random time in the usage month
+	usageTime, err := timeutil.GetRandomTimeInMonth(timeutil.MonthsPreviousTo(int(monthsAgo), now))
+	if err != nil {
+		return err
+	}
+
 	for _, client := range repeatedFrom.clients {
 		if c.ClientType == client.ClientType && mountAccessor == client.MountAccessor && c.Namespace == client.NamespaceID {
-			addingTo.addEntityRecord(client, segmentIndex)
+			repeatedClient := *client
+			repeatedClient.UsageTime = usageTime.Unix()
+			addingTo.addEntityRecord(&repeatedClient, segmentIndex)
 			numClients--
 			if numClients == 0 {
 				break
@@ -333,75 +372,95 @@ func (m *multipleMonthsActivityClients) addRepeatedClients(monthsAgo int32, c *g
 	return nil
 }
 
-func (m *multipleMonthsActivityClients) write(ctx context.Context, opts map[generation.WriteOptions]struct{}, activityLog *ActivityLog) ([]string, error) {
-	now := time.Now().UTC()
+func (m *multipleMonthsActivityClients) addMissingCurrentMonth() {
+	missing := m.months[0].generationParameters == nil &&
+		len(m.months) > 1 &&
+		m.months[1].generationParameters != nil
+	if !missing {
+		return
+	}
+	m.months[0].generationParameters = &generation.Data{EmptySegmentIndexes: []int32{0}, NumSegments: 2}
+}
+
+func (m *multipleMonthsActivityClients) timestampForMonth(i int, now time.Time) time.Time {
+	if i > 0 {
+		return timeutil.StartOfMonth(timeutil.MonthsPreviousTo(i, now))
+	}
+	return now
+}
+
+func (m *multipleMonthsActivityClients) write(ctx context.Context, opts map[generation.WriteOptions]struct{}, activityLog *ActivityLog, now time.Time) ([]string, error) {
 	paths := []string{}
 
 	_, writePQ := opts[generation.WriteOptions_WRITE_PRECOMPUTED_QUERIES]
 	_, writeDistinctClients := opts[generation.WriteOptions_WRITE_DISTINCT_CLIENTS]
-	_, writeEntities := opts[generation.WriteOptions_WRITE_ENTITIES]
 	_, writeIntentLog := opts[generation.WriteOptions_WRITE_INTENT_LOGS]
+	_, writeClientIDsMemory := opts[generation.WriteOptions_WRITE_CLIENT_IDS_MEMORY]
 
-	pqOpts := pqOptions{}
-	if writePQ || writeDistinctClients {
-		pqOpts.byNamespace = make(map[string]*processByNamespace)
-		pqOpts.byMonth = make(map[int64]*processMonth)
-		pqOpts.activePeriodEnd = m.latestTimestamp(now, true)
-		pqOpts.endTime = timeutil.EndOfMonth(m.latestTimestamp(pqOpts.activePeriodEnd, false))
-		pqOpts.activePeriodStart = m.earliestTimestamp(now)
-	}
+	m.addMissingCurrentMonth()
 
-	var earliestTimestamp, latestTimestamp time.Time
+	clientIDsToAddToMemory := make(map[string]struct{})
 	for i, month := range m.months {
 		if month.generationParameters == nil {
 			continue
 		}
-		var timestamp time.Time
-		if i > 0 {
-			timestamp = timeutil.StartOfMonth(timeutil.MonthsPreviousTo(i, now))
-		} else {
-			timestamp = now
-		}
-		if earliestTimestamp.IsZero() || timestamp.Before(earliestTimestamp) {
-			earliestTimestamp = timestamp
-		}
-		if timestamp.After(latestTimestamp) {
-			latestTimestamp = timestamp
+		var loadClientIDsToMemory bool
+		timestamp := m.timestampForMonth(i, now)
+		startTime, endTime := activityLog.getStartTimeAndEndTimeUntilLastMonth(true)
+
+		// only load clients used until last month in the billing period to memory
+		if writeClientIDsMemory && (startTime != time.Time{} && !startTime.After(timestamp) && !endTime.Before(timestamp)) {
+			loadClientIDsToMemory = true
 		}
-		segments, err := month.populateSegments()
+
+		segments, clientIDsInSegments, err := month.populateSegments(loadClientIDsToMemory)
 		if err != nil {
 			return nil, err
 		}
-		for segmentIndex, segment := range segments {
-			if writeEntities || writeIntentLog {
-				if segment == nil {
-					// skip the index
-					continue
-				}
-				entityPath, err := activityLog.saveSegmentEntitiesInternal(ctx, segmentInfo{
-					startTimestamp:       timestamp.Unix(),
-					currentClients:       &activity.EntityActivityLog{Clients: segment},
-					clientSequenceNumber: uint64(segmentIndex),
-					tokenCount:           &activity.TokenCount{},
-				}, true)
-				if err != nil {
-					return nil, err
-				}
-				paths = append(paths, entityPath)
-			}
+
+		// add segment clients to clientIDs map if load to memory option has been selected
+		if loadClientIDsToMemory {
+			maps.Copy(clientIDsToAddToMemory, clientIDsInSegments)
 		}
 
-		if (writePQ || writeDistinctClients) && i > 0 {
-			reader := newProtoSegmentReader(segments)
-			err = activityLog.segmentToPrecomputedQuery(ctx, timestamp, reader, pqOpts)
+		for segmentIndex, segment := range segments {
+			if segment == nil {
+				// skip the index
+				continue
+			}
+			entityPath, err := activityLog.saveSegmentEntitiesInternal(ctx, segmentInfo{
+				startTimestamp:       timestamp.Unix(),
+				currentClients:       &activity.EntityActivityLog{Clients: segment},
+				clientSequenceNumber: uint64(segmentIndex),
+				tokenCount:           &activity.TokenCount{},
+			}, true)
 			if err != nil {
 				return nil, err
 			}
+			paths = append(paths, entityPath)
 		}
-
+	}
+	if writeClientIDsMemory {
+		activityLog.SetClientIDsUsageInfo(clientIDsToAddToMemory)
+	}
+	if writePQ || writeDistinctClients {
+		// start with the oldest month of data, and create precomputed queries
+		// up to that month
+		pqWg := sync.WaitGroup{}
+		for i := len(m.months) - 1; i > 0; i-- {
+			pqWg.Add(1)
+			go func(i int) {
+				defer pqWg.Done()
+				activityLog.precomputedQueryWorker(ctx, &ActivityIntentLog{
+					PreviousMonth: m.timestampForMonth(i, now).Unix(),
+					NextMonth:     now.Unix(),
+				})
+			}(i)
+		}
+		pqWg.Wait()
 	}
 	if writeIntentLog {
-		err := activityLog.writeIntentLog(ctx, earliestTimestamp.UTC().Unix(), latestTimestamp.UTC())
+		err := activityLog.writeIntentLog(ctx, m.latestTimestamp(now, false).Unix(), m.latestTimestamp(now, true).UTC())
 		if err != nil {
 			return nil, err
 		}
diff --git a/vault/logical_system_activity_write_testonly_test.go b/vault/logical_system_activity_write_testonly_test.go
index fd2ce2b38da..270191c1e5f 100644
--- a/vault/logical_system_activity_write_testonly_test.go
+++ b/vault/logical_system_activity_write_testonly_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build testonly
@@ -12,6 +12,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/timeutil"
 	"github.com/hashicorp/vault/sdk/helper/clientcountutil/generation"
@@ -19,7 +20,6 @@ import (
 	"github.com/hashicorp/vault/vault/activity"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/encoding/protojson"
-	"google.golang.org/protobuf/proto"
 )
 
 // TestSystemBackend_handleActivityWriteData calls the activity log write endpoint and confirms that the inputs are
@@ -76,6 +76,7 @@ func TestSystemBackend_handleActivityWriteData(t *testing.T) {
 			name:      "correctly formatted data succeeds",
 			operation: logical.UpdateOperation,
 			input:     map[string]interface{}{"input": `{"write":["WRITE_PRECOMPUTED_QUERIES"],"data":[{"current_month":true,"all":{"clients":[{"count":5}]}}]}`},
+			wantPaths: 1,
 		},
 		{
 			name:      "entities with multiple segments",
@@ -169,7 +170,7 @@ func Test_singleMonthActivityClients_addNewClients(t *testing.T) {
 			m := &singleMonthActivityClients{
 				predefinedSegments: make(map[int][]int),
 			}
-			err := m.addNewClients(tt.clients, tt.mount, tt.segmentIndex)
+			err := m.addNewClients(tt.clients, tt.mount, tt.segmentIndex, 0, time.Now().UTC())
 			require.NoError(t, err)
 			numNew := tt.clients.Count
 			if numNew == 0 {
@@ -274,7 +275,7 @@ func Test_multipleMonthsActivityClients_processMonth(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			m := newMultipleMonthsActivityClients(tt.numMonths)
-			err := m.processMonth(context.Background(), core, tt.clients)
+			err := m.processMonth(context.Background(), core, tt.clients, time.Now().UTC())
 			if tt.wantError {
 				require.Error(t, err)
 			} else {
@@ -319,7 +320,7 @@ func Test_multipleMonthsActivityClients_processMonth_segmented(t *testing.T) {
 	}
 	m := newMultipleMonthsActivityClients(1)
 	core, _, _ := TestCoreUnsealed(t)
-	require.NoError(t, m.processMonth(context.Background(), core, data))
+	require.NoError(t, m.processMonth(context.Background(), core, data, time.Now().UTC()))
 	require.Len(t, m.months[0].predefinedSegments, 3)
 	require.Len(t, m.months[0].clients, 3)
 
@@ -338,39 +339,57 @@ func Test_multipleMonthsActivityClients_processMonth_segmented(t *testing.T) {
 // from 1 month ago and 2 months ago, and verifies that the correct clients are
 // added based on namespace, mount, and non-entity attributes
 func Test_multipleMonthsActivityClients_addRepeatedClients(t *testing.T) {
+	now := time.Now().UTC()
+
 	m := newMultipleMonthsActivityClients(3)
 	defaultMount := "default"
 
-	require.NoError(t, m.addClientToMonth(2, &generation.Client{Count: 2}, "identity", nil))
-	require.NoError(t, m.addClientToMonth(2, &generation.Client{Count: 2, Namespace: "other_ns"}, defaultMount, nil))
-	require.NoError(t, m.addClientToMonth(1, &generation.Client{Count: 2}, defaultMount, nil))
-	require.NoError(t, m.addClientToMonth(1, &generation.Client{Count: 2, ClientType: "non-entity"}, defaultMount, nil))
+	require.NoError(t, m.addClientToMonth(2, &generation.Client{Count: 2}, "identity", nil, now))
+	require.NoError(t, m.addClientToMonth(2, &generation.Client{Count: 2, Namespace: "other_ns"}, defaultMount, nil, now))
+	require.NoError(t, m.addClientToMonth(1, &generation.Client{Count: 2}, defaultMount, nil, now))
+	require.NoError(t, m.addClientToMonth(1, &generation.Client{Count: 2, ClientType: "non-entity"}, defaultMount, nil, now))
 
 	month2Clients := m.months[2].clients
 	month1Clients := m.months[1].clients
 
+	// checks if all the clients in "containsClients" array exists in "allClients" array
+	hasClients := func(allClients []*activity.EntityRecord, containsClients []*activity.EntityRecord) bool {
+		allClientsList := make(map[string]struct{})
+
+		for _, client := range allClients {
+			allClientsList[client.ClientID] = struct{}{}
+		}
+
+		for _, client := range containsClients {
+			if _, exists := allClientsList[client.ClientID]; !exists {
+				return false
+			}
+		}
+		return true
+	}
+
 	thisMonth := m.months[0]
 	// this will match the first client in month 1
-	require.NoError(t, m.addRepeatedClients(0, &generation.Client{Count: 1, Repeated: true}, defaultMount, nil))
-	require.Contains(t, month1Clients, thisMonth.clients[0])
+	require.NoError(t, m.addRepeatedClients(0, &generation.Client{Count: 1, Repeated: true}, defaultMount, nil, time.Now().UTC()))
+	require.True(t, hasClients(month1Clients, []*activity.EntityRecord{thisMonth.clients[0]}))
 
 	// this will match the 3rd client in month 1
-	require.NoError(t, m.addRepeatedClients(0, &generation.Client{Count: 1, Repeated: true, ClientType: "non-entity"}, defaultMount, nil))
-	require.Equal(t, month1Clients[2], thisMonth.clients[1])
+	require.NoError(t, m.addRepeatedClients(0, &generation.Client{Count: 1, Repeated: true, ClientType: "non-entity"}, defaultMount, nil, time.Now().UTC()))
+	require.True(t, hasClients([]*activity.EntityRecord{month1Clients[2]}, []*activity.EntityRecord{thisMonth.clients[1]}))
 
 	// this will match the first two clients in month 1
-	require.NoError(t, m.addRepeatedClients(0, &generation.Client{Count: 2, Repeated: true}, defaultMount, nil))
-	require.Equal(t, month1Clients[0:2], thisMonth.clients[2:4])
+	require.NoError(t, m.addRepeatedClients(0, &generation.Client{Count: 2, Repeated: true}, defaultMount, nil, time.Now().UTC()))
+	require.True(t, hasClients(month1Clients[0:2], thisMonth.clients[2:4]))
 
 	// this will match the first client in month 2
-	require.NoError(t, m.addRepeatedClients(0, &generation.Client{Count: 1, RepeatedFromMonth: 2}, "identity", nil))
-	require.Equal(t, month2Clients[0], thisMonth.clients[4])
+	require.NoError(t, m.addRepeatedClients(0, &generation.Client{Count: 1, RepeatedFromMonth: 2}, "identity", nil, time.Now().UTC()))
+	require.True(t, hasClients([]*activity.EntityRecord{month2Clients[0]}, []*activity.EntityRecord{thisMonth.clients[4]}))
 
 	// this will match the 3rd client in month 2
-	require.NoError(t, m.addRepeatedClients(0, &generation.Client{Count: 1, RepeatedFromMonth: 2, Namespace: "other_ns"}, defaultMount, nil))
-	require.Equal(t, month2Clients[2], thisMonth.clients[5])
+	require.NoError(t, m.addRepeatedClients(0, &generation.Client{Count: 1, RepeatedFromMonth: 2, Namespace: "other_ns"}, defaultMount, nil, time.Now().UTC()))
+	require.True(t, hasClients([]*activity.EntityRecord{month2Clients[2]}, []*activity.EntityRecord{thisMonth.clients[5]}))
 
-	require.Error(t, m.addRepeatedClients(0, &generation.Client{Count: 1, RepeatedFromMonth: 2, Namespace: "other_ns"}, "other_mount", nil))
+	require.Error(t, m.addRepeatedClients(0, &generation.Client{Count: 1, RepeatedFromMonth: 2, Namespace: "other_ns"}, "other_mount", nil, time.Now().UTC()))
 }
 
 // Test_singleMonthActivityClients_populateSegments calls populateSegments for a
@@ -385,12 +404,14 @@ func Test_singleMonthActivityClients_populateSegments(t *testing.T) {
 		{ClientID: "e"},
 	}
 	cases := []struct {
-		name         string
-		segments     map[int][]int
-		numSegments  int
-		emptyIndexes []int32
-		skipIndexes  []int32
-		wantSegments map[int][]*activity.EntityRecord
+		name                  string
+		segments              map[int][]int
+		numSegments           int
+		emptyIndexes          []int32
+		skipIndexes           []int32
+		loadClientIDsToMemory bool
+		wantClientIDs         map[string]struct{}
+		wantSegments          map[int][]*activity.EntityRecord
 	}{
 		{
 			name: "segmented",
@@ -421,6 +442,27 @@ func Test_singleMonthActivityClients_populateSegments(t *testing.T) {
 				4: {},
 			},
 		},
+		{
+			name: "segmented with skip and empty with load clients to memory input flag",
+			segments: map[int][]int{
+				0: {0, 1},
+				2: {0, 1},
+			},
+			emptyIndexes:          []int32{1, 4},
+			skipIndexes:           []int32{3},
+			loadClientIDsToMemory: true,
+			wantClientIDs: map[string]struct{}{
+				"a": {},
+				"b": {},
+			},
+			wantSegments: map[int][]*activity.EntityRecord{
+				0: {{ClientID: "a"}, {ClientID: "b"}},
+				1: {},
+				2: {{ClientID: "a"}, {ClientID: "b"}},
+				3: nil,
+				4: {},
+			},
+		},
 		{
 			name:        "all clients",
 			numSegments: 0,
@@ -428,6 +470,21 @@ func Test_singleMonthActivityClients_populateSegments(t *testing.T) {
 				0: {{ClientID: "a"}, {ClientID: "b"}, {ClientID: "c"}, {ClientID: "d"}, {ClientID: "e"}},
 			},
 		},
+		{
+			name:                  "all clients with load clients to memory input flag",
+			numSegments:           0,
+			loadClientIDsToMemory: true,
+			wantClientIDs: map[string]struct{}{
+				"a": {},
+				"b": {},
+				"c": {},
+				"d": {},
+				"e": {},
+			},
+			wantSegments: map[int][]*activity.EntityRecord{
+				0: {{ClientID: "a"}, {ClientID: "b"}, {ClientID: "c"}, {ClientID: "d"}, {ClientID: "e"}},
+			},
+		},
 		{
 			name:        "all clients split",
 			numSegments: 2,
@@ -436,6 +493,22 @@ func Test_singleMonthActivityClients_populateSegments(t *testing.T) {
 				1: {{ClientID: "d"}, {ClientID: "e"}},
 			},
 		},
+		{
+			name:                  "all clients split with load clients to memory input flag",
+			numSegments:           2,
+			loadClientIDsToMemory: true,
+			wantClientIDs: map[string]struct{}{
+				"a": {},
+				"b": {},
+				"c": {},
+				"d": {},
+				"e": {},
+			},
+			wantSegments: map[int][]*activity.EntityRecord{
+				0: {{ClientID: "a"}, {ClientID: "b"}, {ClientID: "c"}},
+				1: {{ClientID: "d"}, {ClientID: "e"}},
+			},
+		},
 		{
 			name:         "all clients with skip and empty",
 			numSegments:  5,
@@ -449,12 +522,36 @@ func Test_singleMonthActivityClients_populateSegments(t *testing.T) {
 				4: {{ClientID: "d"}, {ClientID: "e"}},
 			},
 		},
+		{
+			name:                  "all clients with skip and empty with load clients to memory input flag",
+			numSegments:           5,
+			skipIndexes:           []int32{0, 3},
+			emptyIndexes:          []int32{2},
+			loadClientIDsToMemory: true,
+			wantClientIDs: map[string]struct{}{
+				"a": {},
+				"b": {},
+				"c": {},
+				"d": {},
+				"e": {},
+			},
+			wantSegments: map[int][]*activity.EntityRecord{
+				0: nil,
+				1: {{ClientID: "a"}, {ClientID: "b"}, {ClientID: "c"}},
+				2: {},
+				3: nil,
+				4: {{ClientID: "d"}, {ClientID: "e"}},
+			},
+		},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			s := singleMonthActivityClients{predefinedSegments: tc.segments, clients: clients, generationParameters: &generation.Data{EmptySegmentIndexes: tc.emptyIndexes, SkipSegmentIndexes: tc.skipIndexes, NumSegments: int32(tc.numSegments)}}
-			gotSegments, err := s.populateSegments()
+			gotSegments, clientsAdded, err := s.populateSegments(tc.loadClientIDsToMemory)
 			require.NoError(t, err)
+			if tc.loadClientIDsToMemory {
+				require.Equal(t, tc.wantClientIDs, clientsAdded)
+			}
 			require.Equal(t, tc.wantSegments, gotSegments)
 		})
 	}
@@ -465,7 +562,7 @@ func Test_singleMonthActivityClients_populateSegments(t *testing.T) {
 // precomputed queries are written. written and then storage is queried. The
 // test verifies that the correct timestamps are present in the activity log and
 // that the correct segment numbers for each month contain the correct number of
-// clients
+// clients and right number of clientIDs are loaded to memory
 func Test_handleActivityWriteData(t *testing.T) {
 	index5 := int32(5)
 	index4 := int32(4)
@@ -526,7 +623,7 @@ func Test_handleActivityWriteData(t *testing.T) {
 		paths := resp.Data["paths"].([]string)
 		require.Len(t, paths, 9)
 
-		times, err := core.activityLog.availableLogs(context.Background())
+		times, err := core.activityLog.availableLogs(context.Background(), time.Now())
 		require.NoError(t, err)
 		require.Len(t, times, 4)
 
@@ -643,10 +740,28 @@ func Test_handleActivityWriteData(t *testing.T) {
 		next := time.Unix(intent.NextMonth, 0)
 
 		require.Equal(t, timeutil.StartOfMonth(now), next.UTC())
-		require.Equal(t, timeutil.StartOfMonth(timeutil.MonthsPreviousTo(3, now)), prev.UTC())
+		require.Equal(t, timeutil.StartOfMonth(timeutil.MonthsPreviousTo(1, now)), prev.UTC())
 
-		times, err := core.activityLog.availableLogs(context.Background())
+		times, err := core.activityLog.availableLogs(context.Background(), time.Now())
 		require.NoError(t, err)
 		require.Len(t, times, 4)
 	})
+	t.Run("write clientIDs to memory", func(t *testing.T) {
+		core, _, _ := TestCoreUnsealed(t)
+		marshaled, err := protojson.Marshal(&generation.ActivityLogMockInput{
+			Data:  data,
+			Write: []generation.WriteOptions{generation.WriteOptions_WRITE_CLIENT_IDS_MEMORY},
+		})
+		require.NoError(t, err)
+		req := logical.TestRequest(t, logical.UpdateOperation, "internal/counters/activity/write")
+		req.Data = map[string]interface{}{"input": string(marshaled)}
+		_, err = core.systemBackend.HandleRequest(namespace.RootContext(nil), req)
+		require.NoError(t, err)
+		activityLog := core.GetActivityLog()
+
+		// clients until last month in the billing period must be loaded to memory
+		// Since, billing start is not available in ce, no clients are loaded
+		// This test will return 0 when run on ent as billing start is not set in this testcase
+		require.Equal(t, len(activityLog.GetClientIDsUsageInfo()), 0)
+	})
 }
diff --git a/vault/logical_system_custom_messages.go b/vault/logical_system_custom_messages.go
index cfa800d3ff2..8f0ca1867cd 100644
--- a/vault/logical_system_custom_messages.go
+++ b/vault/logical_system_custom_messages.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -19,6 +19,49 @@ import (
 // uiCustomMessagePaths returns a slice of *framework.Path elements that are
 // added to the receiver SystemBackend.
 func (b *SystemBackend) uiCustomMessagePaths() []*framework.Path {
+	responseFieldSchema := map[string]*framework.FieldSchema{
+		"id": {
+			Type:     framework.TypeString,
+			Required: true,
+		},
+		"title": {
+			Type:     framework.TypeString,
+			Required: true,
+		},
+		"authenticated": {
+			Type:     framework.TypeBool,
+			Required: true,
+		},
+		"type": {
+			Type:     framework.TypeBool,
+			Required: true,
+		},
+		"message": {
+			Type:     framework.TypeString,
+			Required: true,
+		},
+		"link": {
+			Type:     framework.TypeMap,
+			Required: false,
+		},
+		"start_time": {
+			Type:     framework.TypeTime,
+			Required: true,
+		},
+		"end_time": {
+			Type:     framework.TypeTime,
+			Required: true,
+		},
+		"active": {
+			Type:     framework.TypeBool,
+			Required: true,
+		},
+		"options": {
+			Type:     framework.TypeMap,
+			Required: false,
+		},
+	}
+
 	return []*framework.Path{
 		{
 			Pattern: "config/ui/custom-messages/$",
@@ -32,14 +75,17 @@ func (b *SystemBackend) uiCustomMessagePaths() []*framework.Path {
 				"authenticated": {
 					Type:     framework.TypeBool,
 					Required: false,
+					Query:    true,
 				},
 				"active": {
 					Type:     framework.TypeBool,
 					Required: false,
+					Query:    true,
 				},
 				"type": {
 					Type:     framework.TypeString,
 					Required: false,
+					Query:    true,
 				},
 			},
 			Operations: map[logical.Operation]framework.OperationHandler{
@@ -49,6 +95,16 @@ func (b *SystemBackend) uiCustomMessagePaths() []*framework.Path {
 					Responses: map[int][]framework.Response{
 						http.StatusOK: {{
 							Description: "OK",
+							Fields: map[string]*framework.FieldSchema{
+								"keys": {
+									Type:     framework.TypeStringSlice,
+									Required: true,
+								},
+								"key_info": {
+									Type:     framework.TypeMap,
+									Required: true,
+								},
+							},
 						}},
 					},
 				},
@@ -167,12 +223,7 @@ func (b *SystemBackend) uiCustomMessagePaths() []*framework.Path {
 					Responses: map[int][]framework.Response{
 						http.StatusOK: {{
 							Description: "OK",
-							Fields: map[string]*framework.FieldSchema{
-								"id": {
-									Type:     framework.TypeString,
-									Required: true,
-								},
-							},
+							Fields:      responseFieldSchema,
 						}},
 					},
 
@@ -187,12 +238,6 @@ func (b *SystemBackend) uiCustomMessagePaths() []*framework.Path {
 					Responses: map[int][]framework.Response{
 						http.StatusNoContent: {{
 							Description: "OK",
-							Fields: map[string]*framework.FieldSchema{
-								"id": {
-									Type:     framework.TypeString,
-									Required: true,
-								},
-							},
 						}},
 					},
 
@@ -207,44 +252,7 @@ func (b *SystemBackend) uiCustomMessagePaths() []*framework.Path {
 					Responses: map[int][]framework.Response{
 						http.StatusOK: {{
 							Description: "OK",
-							Fields: map[string]*framework.FieldSchema{
-								"id": {
-									Type:     framework.TypeString,
-									Required: true,
-								},
-								"title": {
-									Type:     framework.TypeString,
-									Required: true,
-								},
-								"authenticated": {
-									Type:     framework.TypeBool,
-									Required: true,
-								},
-								"type": {
-									Type:     framework.TypeBool,
-									Required: true,
-								},
-								"message": {
-									Type:     framework.TypeString,
-									Required: true,
-								},
-								"link": {
-									Type:     framework.TypeMap,
-									Required: false,
-								},
-								"start_time": {
-									Type:     framework.TypeTime,
-									Required: true,
-								},
-								"end_time": {
-									Type:     framework.TypeTime,
-									Required: true,
-								},
-								"options": {
-									Type:     framework.TypeMap,
-									Required: false,
-								},
-							},
+							Fields:      responseFieldSchema,
 						}},
 					},
 
diff --git a/vault/logical_system_custom_messages_test.go b/vault/logical_system_custom_messages_test.go
index b003955cf13..94b8068abc4 100644
--- a/vault/logical_system_custom_messages_test.go
+++ b/vault/logical_system_custom_messages_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/logical_system_events.go b/vault/logical_system_events.go
deleted file mode 100644
index 087be992df7..00000000000
--- a/vault/logical_system_events.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-package vault
-
-import (
-	"context"
-	"net/http"
-
-	"github.com/hashicorp/vault/sdk/framework"
-	"github.com/hashicorp/vault/sdk/logical"
-)
-
-// handleEventsSubscribe
-func (b *SystemBackend) handleEventsSubscribe(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	// TODO
-	return logical.RespondWithStatusCode(nil, req, http.StatusNoContent)
-}
-
-// handleEventsUnsubscribe
-func (b *SystemBackend) handleEventsUnsubscribe(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	// TODO
-	return logical.RespondWithStatusCode(nil, req, http.StatusNoContent)
-}
-
-// handleEventsListSubscriptions
-func (b *SystemBackend) handleEventsListSubscriptions(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	// TODO
-	return logical.RespondWithStatusCode(nil, req, http.StatusNoContent)
-}
diff --git a/vault/logical_system_helpers.go b/vault/logical_system_helpers.go
index ce29d230df0..c0905516dd1 100644
--- a/vault/logical_system_helpers.go
+++ b/vault/logical_system_helpers.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -31,9 +31,7 @@ var (
 		return nil
 	}
 
-	sysInitialize = func(b *SystemBackend) func(context.Context, *logical.InitializationRequest) error {
-		return nil
-	}
+	sysInitialize = ceSysInitialize
 
 	sysClean = func(b *SystemBackend) func(context.Context) {
 		return nil
@@ -135,6 +133,11 @@ var (
 			"config/group-policy-application$": {operations: []logical.Operation{logical.ReadOperation, logical.UpdateOperation}},
 		})...)
 
+		// reporting paths
+		paths = append(paths, buildEnterpriseOnlyPaths(map[string]enterprisePathStub{
+			"reporting/scan$": {operations: []logical.Operation{logical.UpdateOperation}},
+		})...)
+
 		// namespaces paths
 		paths = append(paths, buildEnterpriseOnlyPaths(map[string]enterprisePathStub{
 			"namespaces/?$": {operations: []logical.Operation{logical.ListOperation}},
@@ -280,6 +283,16 @@ var (
 	checkRaw = func(b *SystemBackend, path string) error { return nil }
 )
 
+func ceSysInitialize(b *SystemBackend) func(context.Context, *logical.InitializationRequest) error {
+	return func(ctx context.Context, req *logical.InitializationRequest) error {
+		err := b.Core.FeatureActivationFlags.Initialize(ctx, b.Core.systemBarrierView)
+		if err != nil {
+			return fmt.Errorf("failed to initialize activation flags: %w", err)
+		}
+		return nil
+	}
+}
+
 // Contains the config for a global plugin reload
 type pluginReloadRequest struct {
 	Type       string            `json:"type"` // Either 'plugins' or 'mounts'
@@ -327,7 +340,7 @@ func (b *SystemBackend) tuneMountTTLs(ctx context.Context, path string, me *Moun
 	if err != nil {
 		me.Config.MaxLeaseTTL = origMax
 		me.Config.DefaultLeaseTTL = origDefault
-		return fmt.Errorf("failed to update mount table, rolling back TTL changes")
+		return fmt.Errorf("failed to update mount table, rolling back TTL changes: %w", err)
 	}
 	if b.Core.logger.IsInfo() {
 		b.Core.logger.Info("mount tuning of leases successful", "path", path)
diff --git a/vault/logical_system_integ_test.go b/vault/logical_system_integ_test.go
index 644aaec0a68..42253cca28c 100644
--- a/vault/logical_system_integ_test.go
+++ b/vault/logical_system_integ_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault_test
@@ -87,11 +87,6 @@ func TestSystemBackend_InternalUIResultantACL(t *testing.T) {
 					"read",
 				},
 			},
-			"sys/internal/ui/version": map[string]interface{}{
-				"capabilities": []interface{}{
-					"read",
-				},
-			},
 			"sys/leases/lookup": map[string]interface{}{
 				"capabilities": []interface{}{
 					"update",
@@ -143,6 +138,9 @@ func TestSystemBackend_InternalUIResultantACL(t *testing.T) {
 					"update",
 				},
 			},
+			"identity/oidc/provider/+/authorize": map[string]interface{}{
+				"capabilities": []interface{}{"read", "update"},
+			},
 		},
 		"root":             false,
 		"chroot_namespace": "",
diff --git a/vault/logical_system_limits.go b/vault/logical_system_limits.go
index 76443a23bac..8980e68a112 100644
--- a/vault/logical_system_limits.go
+++ b/vault/logical_system_limits.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !testonly
diff --git a/vault/logical_system_limits_testonly.go b/vault/logical_system_limits_testonly.go
deleted file mode 100644
index a4e0755bfbc..00000000000
--- a/vault/logical_system_limits_testonly.go
+++ /dev/null
@@ -1,88 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: BUSL-1.1
-
-//go:build testonly
-
-package vault
-
-import (
-	"context"
-	"net/http"
-
-	"github.com/hashicorp/vault/limits"
-	"github.com/hashicorp/vault/sdk/framework"
-	"github.com/hashicorp/vault/sdk/logical"
-)
-
-// RequestLimiterResponse is a struct for marshalling Request Limiter status responses.
-type RequestLimiterResponse struct {
-	GlobalDisabled   bool                      `json:"global_disabled" mapstructure:"global_disabled"`
-	ListenerDisabled bool                      `json:"listener_disabled" mapstructure:"listener_disabled"`
-	Limiters         map[string]*LimiterStatus `json:"types" mapstructure:"types"`
-}
-
-// LimiterStatus holds the per-limiter status and flags for testing.
-type LimiterStatus struct {
-	Enabled bool                `json:"enabled" mapstructure:"enabled"`
-	Flags   limits.LimiterFlags `json:"flags,omitempty" mapstructure:"flags,omitempty"`
-}
-
-const readRequestLimiterHelpText = `
-Read the current status of the request limiter.
-`
-
-func (b *SystemBackend) requestLimiterReadPath() *framework.Path {
-	return &framework.Path{
-		Pattern:         "internal/request-limiter/status$",
-		HelpDescription: readRequestLimiterHelpText,
-		HelpSynopsis:    readRequestLimiterHelpText,
-		Operations: map[logical.Operation]framework.OperationHandler{
-			logical.ReadOperation: &framework.PathOperation{
-				Callback: b.handleReadRequestLimiter,
-				DisplayAttrs: &framework.DisplayAttributes{
-					OperationVerb:   "read",
-					OperationSuffix: "verbosity-level-for",
-				},
-				Responses: map[int][]framework.Response{
-					http.StatusOK: {{
-						Description: "OK",
-					}},
-				},
-				Summary: "Read the current status of the request limiter.",
-			},
-		},
-	}
-}
-
-// handleReadRequestLimiter returns the enabled Request Limiter status for this node.
-func (b *SystemBackend) handleReadRequestLimiter(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
-	resp := &RequestLimiterResponse{
-		Limiters: make(map[string]*LimiterStatus),
-	}
-
-	b.Core.limiterRegistryLock.Lock()
-	registry := b.Core.limiterRegistry
-	b.Core.limiterRegistryLock.Unlock()
-
-	resp.GlobalDisabled = !registry.Enabled
-	resp.ListenerDisabled = req.RequestLimiterDisabled
-	enabled := !(resp.GlobalDisabled || resp.ListenerDisabled)
-
-	for name := range limits.DefaultLimiterFlags {
-		var flags limits.LimiterFlags
-		if requestLimiter := b.Core.GetRequestLimiter(name); requestLimiter != nil && enabled {
-			flags = requestLimiter.Flags
-		}
-
-		resp.Limiters[name] = &LimiterStatus{
-			Enabled: enabled,
-			Flags:   flags,
-		}
-	}
-
-	return &logical.Response{
-		Data: map[string]interface{}{
-			"request_limiter": resp,
-		},
-	}, nil
-}
diff --git a/vault/logical_system_oss_test.go b/vault/logical_system_oss_test.go
new file mode 100644
index 00000000000..fad6b107ea6
--- /dev/null
+++ b/vault/logical_system_oss_test.go
@@ -0,0 +1,69 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// TestSystemBackend_PluginCatalog_Update_Download_Should_Fail tests the update failure
+// cases when download is true
+func TestSystemBackend_PluginCatalog_Update_Download_Should_Fail(t *testing.T) {
+	const expectedErrStr = "download is an enterprise only feature"
+	sym, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatalf("error: %v", err)
+	}
+	c, _, _ := TestCoreUnsealedWithConfig(t, &CoreConfig{
+		PluginDirectory: sym,
+	})
+	b := c.systemBackend
+
+	tests := []struct {
+		pluginType    consts.PluginType
+		pluginVersion string
+		pluginName    string
+	}{
+		{
+			pluginName:    "vault-plugin-database-redis",
+			pluginVersion: "v0.6.0",
+			pluginType:    consts.PluginTypeDatabase,
+		},
+		{
+			pluginName:    "vault-plugin-secrets-kv",
+			pluginVersion: "v0.24.0",
+			pluginType:    consts.PluginTypeSecrets,
+		},
+		{
+			pluginName:    "vault-plugin-auth-jwt",
+			pluginVersion: "v0.24.1",
+			pluginType:    consts.PluginTypeCredential,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(fmt.Sprintf("%s %s", tt.pluginName, tt.pluginVersion), func(t *testing.T) {
+			req := logical.TestRequest(t, logical.UpdateOperation,
+				"plugins/catalog/"+tt.pluginType.String()+"/"+tt.pluginName)
+			req.Data["version"] = tt.pluginVersion
+			req.Data["download"] = true
+			resp, err := b.HandleRequest(namespace.RootContext(nil), req)
+			if err != nil || resp.Error() == nil {
+				t.Fatalf("expected error when download is true, got resp: %v, err: %v", resp, err)
+			} else if !strings.Contains(resp.Error().Error(), expectedErrStr) {
+				t.Fatalf("expected error %q, got resp: %v", expectedErrStr, resp)
+			}
+		})
+	}
+}
diff --git a/vault/logical_system_paths.go b/vault/logical_system_paths.go
index 50e6bb43c89..5c26af9fa28 100644
--- a/vault/logical_system_paths.go
+++ b/vault/logical_system_paths.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -1180,6 +1180,10 @@ func (b *SystemBackend) rekeyPaths() []*framework.Path {
 					Type:        framework.TypeBool,
 					Description: "Specifies if previously-provided unseal keys are discarded and the unseal process is reset.",
 				},
+				"migrate": {
+					Type:        framework.TypeBool,
+					Description: "Used to migrate the seal from shamir to autoseal or autoseal to shamir. Must be provided on all unseal key calls.",
+				},
 			},
 
 			Operations: map[logical.Operation]framework.OperationHandler{
@@ -1828,6 +1832,7 @@ func (b *SystemBackend) sealPaths() []*framework.Path {
 							Description: "OK",
 						}},
 					},
+					ForwardPerformanceStandby: true,
 				},
 			},
 
@@ -1886,6 +1891,10 @@ func (b *SystemBackend) pluginsCatalogCRUDPath() *framework.Path {
 				Type:        framework.TypeString,
 				Description: strings.TrimSpace(sysHelp["plugin-catalog_version"][0]),
 			},
+			"download": {
+				Type:        framework.TypeBool,
+				Description: strings.TrimSpace(sysHelp["plugin-catalog_download"][0]),
+			},
 		},
 
 		Operations: map[logical.Operation]framework.OperationHandler{
@@ -2895,31 +2904,6 @@ func (b *SystemBackend) internalPaths() []*framework.Path {
 				},
 			},
 		},
-		{
-			Pattern: "internal/ui/version",
-			DisplayAttrs: &framework.DisplayAttributes{
-				OperationPrefix: "internal-ui",
-				OperationVerb:   "read",
-				OperationSuffix: "version",
-			},
-			Operations: map[logical.Operation]framework.OperationHandler{
-				logical.ReadOperation: &framework.PathOperation{
-					Callback: b.pathInternalUIVersion,
-					Summary:  "Backwards compatibility is not guaranteed for this API",
-					Responses: map[int][]framework.Response{
-						http.StatusOK: {{
-							Description: "OK",
-							Fields: map[string]*framework.FieldSchema{
-								"version": {
-									Type:     framework.TypeString,
-									Required: true,
-								},
-							},
-						}},
-					},
-				},
-			},
-		},
 		{
 			Pattern: "internal/counters/requests",
 			DisplayAttrs: &framework.DisplayAttributes{
@@ -2937,33 +2921,6 @@ func (b *SystemBackend) internalPaths() []*framework.Path {
 			HelpSynopsis:    strings.TrimSpace(sysHelp["internal-counters-requests"][0]),
 			HelpDescription: strings.TrimSpace(sysHelp["internal-counters-requests"][1]),
 		},
-		{
-			Pattern: "internal/counters/tokens",
-			DisplayAttrs: &framework.DisplayAttributes{
-				OperationPrefix: "internal",
-				OperationVerb:   "count",
-				OperationSuffix: "tokens",
-			},
-			Operations: map[logical.Operation]framework.OperationHandler{
-				logical.ReadOperation: &framework.PathOperation{
-					Callback: b.pathInternalCountersTokens,
-					Summary:  "Backwards compatibility is not guaranteed for this API",
-					Responses: map[int][]framework.Response{
-						http.StatusOK: {{
-							Description: "OK",
-							Fields: map[string]*framework.FieldSchema{
-								"counters": {
-									Type:     framework.TypeMap,
-									Required: true,
-								},
-							},
-						}},
-					},
-				},
-			},
-			HelpSynopsis:    strings.TrimSpace(sysHelp["internal-counters-tokens"][0]),
-			HelpDescription: strings.TrimSpace(sysHelp["internal-counters-tokens"][1]),
-		},
 		{
 			Pattern: "internal/counters/entities",
 			DisplayAttrs: &framework.DisplayAttributes{
@@ -3127,6 +3084,10 @@ func (b *SystemBackend) capabilitiesPaths() []*framework.Path {
 					Type:        framework.TypeCommaStringSlice,
 					Description: "Paths on which capabilities are being queried.",
 				},
+				"namespace": {
+					Type:        framework.TypeString,
+					Description: "Namespace for which capabilities are being queried.",
+				},
 			},
 
 			Operations: map[logical.Operation]framework.OperationHandler{
@@ -3846,6 +3807,10 @@ func (b *SystemBackend) authPaths() []*framework.Path {
 					Description: strings.TrimSpace(sysHelp["identity_token_key"][0]),
 					Required:    false,
 				},
+				"trim_request_trailing_slashes": {
+					Type:     framework.TypeBool,
+					Required: false,
+				},
 			},
 			Operations: map[logical.Operation]framework.OperationHandler{
 				logical.ReadOperation: &framework.PathOperation{
@@ -3936,6 +3901,10 @@ func (b *SystemBackend) authPaths() []*framework.Path {
 									Type:     framework.TypeString,
 									Required: false,
 								},
+								"trim_request_trailing_slashes": {
+									Type:     framework.TypeBool,
+									Required: false,
+								},
 							},
 						}},
 					},
@@ -4706,6 +4675,10 @@ func (b *SystemBackend) mountPaths() []*framework.Path {
 					Type:        framework.TypeString,
 					Description: strings.TrimSpace(sysHelp["identity_token_key"][0]),
 				},
+				"trim_request_trailing_slashes": {
+					Type:        framework.TypeBool,
+					Description: strings.TrimSpace(sysHelp["trim_request_trailing_slashes"][0]),
+				},
 			},
 
 			Operations: map[logical.Operation]framework.OperationHandler{
@@ -4808,6 +4781,10 @@ func (b *SystemBackend) mountPaths() []*framework.Path {
 									Type:     framework.TypeString,
 									Required: false,
 								},
+								"trim_request_trailing_slashes": {
+									Type:     framework.TypeBool,
+									Required: false,
+								},
 							},
 						}},
 					},
@@ -4830,6 +4807,192 @@ func (b *SystemBackend) mountPaths() []*framework.Path {
 			HelpDescription: strings.TrimSpace(sysHelp["mount_tune"][1]),
 		},
 
+		{
+			Pattern: "mounts/auth/(?P<path>.+?)/tune$",
+
+			DisplayAttrs: &framework.DisplayAttributes{
+				OperationPrefix: "mounts-auth",
+			},
+
+			Fields: map[string]*framework.FieldSchema{
+				"path": {
+					Type:        framework.TypeString,
+					Description: strings.TrimSpace(sysHelp["auth_tune"][0]),
+				},
+				"default_lease_ttl": {
+					Type:        framework.TypeString,
+					Description: strings.TrimSpace(sysHelp["tune_default_lease_ttl"][0]),
+				},
+				"max_lease_ttl": {
+					Type:        framework.TypeString,
+					Description: strings.TrimSpace(sysHelp["tune_max_lease_ttl"][0]),
+				},
+				"description": {
+					Type:        framework.TypeString,
+					Description: strings.TrimSpace(sysHelp["auth_desc"][0]),
+				},
+				"audit_non_hmac_request_keys": {
+					Type:        framework.TypeCommaStringSlice,
+					Description: strings.TrimSpace(sysHelp["tune_audit_non_hmac_request_keys"][0]),
+				},
+				"audit_non_hmac_response_keys": {
+					Type:        framework.TypeCommaStringSlice,
+					Description: strings.TrimSpace(sysHelp["tune_audit_non_hmac_response_keys"][0]),
+				},
+				"options": {
+					Type:        framework.TypeKVPairs,
+					Description: strings.TrimSpace(sysHelp["tune_mount_options"][0]),
+				},
+				"listing_visibility": {
+					Type:        framework.TypeString,
+					Description: strings.TrimSpace(sysHelp["listing_visibility"][0]),
+				},
+				"passthrough_request_headers": {
+					Type:        framework.TypeCommaStringSlice,
+					Description: strings.TrimSpace(sysHelp["passthrough_request_headers"][0]),
+				},
+				"allowed_response_headers": {
+					Type:        framework.TypeCommaStringSlice,
+					Description: strings.TrimSpace(sysHelp["allowed_response_headers"][0]),
+				},
+				"token_type": {
+					Type:        framework.TypeString,
+					Description: strings.TrimSpace(sysHelp["token_type"][0]),
+				},
+				"user_lockout_config": {
+					Type:        framework.TypeMap,
+					Description: strings.TrimSpace(sysHelp["tune_user_lockout_config"][0]),
+				},
+				"plugin_version": {
+					Type:        framework.TypeString,
+					Description: strings.TrimSpace(sysHelp["plugin-catalog_version"][0]),
+				},
+				"identity_token_key": {
+					Type:        framework.TypeString,
+					Description: strings.TrimSpace(sysHelp["identity_token_key"][0]),
+					Required:    false,
+				},
+				"trim_request_trailing_slashes": {
+					Type:     framework.TypeBool,
+					Required: false,
+				},
+			},
+			Operations: map[logical.Operation]framework.OperationHandler{
+				logical.ReadOperation: &framework.PathOperation{
+					Callback: b.handleAuthTuneRead,
+					DisplayAttrs: &framework.DisplayAttributes{
+						OperationVerb:   "read",
+						OperationSuffix: "tuning-information",
+					},
+					Summary:     "Reads the given auth path's configuration.",
+					Description: "This endpoint does NOT require sudo capability. For the sudo-required alternative, use the endpoint at `sys/auth/[auth-path]/tune`.",
+					Responses: map[int][]framework.Response{
+						http.StatusOK: {{
+							Description: "OK",
+							Fields: map[string]*framework.FieldSchema{
+								"description": {
+									Type:     framework.TypeString,
+									Required: true,
+								},
+								"default_lease_ttl": {
+									Type:     framework.TypeInt,
+									Required: true,
+								},
+								"max_lease_ttl": {
+									Type:     framework.TypeInt,
+									Required: true,
+								},
+								"force_no_cache": {
+									Type:     framework.TypeBool,
+									Required: true,
+								},
+								"external_entropy_access": {
+									Type:     framework.TypeBool,
+									Required: false,
+								},
+								"token_type": {
+									Type:     framework.TypeString,
+									Required: false,
+								},
+								"audit_non_hmac_request_keys": {
+									Type:     framework.TypeCommaStringSlice,
+									Required: false,
+								},
+								"audit_non_hmac_response_keys": {
+									Type:     framework.TypeCommaStringSlice,
+									Required: false,
+								},
+								"listing_visibility": {
+									Type:     framework.TypeString,
+									Required: false,
+								},
+								"passthrough_request_headers": {
+									Type:     framework.TypeCommaStringSlice,
+									Required: false,
+								},
+								"allowed_response_headers": {
+									Type:     framework.TypeCommaStringSlice,
+									Required: false,
+								},
+								"allowed_managed_keys": {
+									Type:     framework.TypeCommaStringSlice,
+									Required: false,
+								},
+								"user_lockout_counter_reset_duration": {
+									Type:     framework.TypeInt64,
+									Required: false,
+								},
+								"user_lockout_threshold": {
+									Type:     framework.TypeInt64, // uint64
+									Required: false,
+								},
+								"user_lockout_duration": {
+									Type:     framework.TypeInt64,
+									Required: false,
+								},
+								"user_lockout_disable": {
+									Type:     framework.TypeBool,
+									Required: false,
+								},
+								"options": {
+									Type:     framework.TypeMap,
+									Required: false,
+								},
+								"plugin_version": {
+									Type:     framework.TypeString,
+									Required: false,
+								},
+								"identity_token_key": {
+									Type:     framework.TypeString,
+									Required: false,
+								},
+								"trim_request_trailing_slashes": {
+									Type:     framework.TypeBool,
+									Required: false,
+								},
+							},
+						}},
+					},
+				},
+				logical.UpdateOperation: &framework.PathOperation{
+					Callback: b.handleAuthTuneWrite,
+					DisplayAttrs: &framework.DisplayAttributes{
+						OperationVerb:   "tune",
+						OperationSuffix: "configuration-parameters",
+					},
+					Summary:     "Tune configuration parameters for a given auth path.",
+					Description: "This endpoint does NOT require sudo capability. The same functionality can be achieved with sudo via the `sys/auth/[auth-path]/tune` endpoint.",
+					Responses: map[int][]framework.Response{
+						http.StatusNoContent: {{
+							Description: "OK",
+						}},
+					},
+				},
+			},
+			HelpSynopsis:    strings.TrimSpace(sysHelp["auth_tune"][0]),
+			HelpDescription: strings.TrimSpace(sysHelp["auth_tune"][1]),
+		},
+
 		{
 			Pattern: "mounts/(?P<path>.+?)",
 
@@ -5096,42 +5259,44 @@ func (b *SystemBackend) lockedUserPaths() []*framework.Path {
 	}
 }
 
-func (b *SystemBackend) eventPaths() []*framework.Path {
+func (b *SystemBackend) wellKnownPaths() []*framework.Path {
 	return []*framework.Path{
 		{
-			Pattern: "events/subscriptions$",
-
-			DisplayAttrs: &framework.DisplayAttributes{
-				OperationPrefix: "subscriptions",
-				OperationVerb:   "create",
-			},
-
-			Fields: map[string]*framework.FieldSchema{
-				"config": {
-					Type:     framework.TypeMap,
-					Required: true,
-					// Description: strings.TrimSpace(sysHelp["mount_accessor"][0]),
-				},
-				"plugin": {
-					Type:     framework.TypeString,
-					Required: true,
-				},
-				//"alias_identifier": {
-				//	Type: framework.TypeString,
-				//	// Description: strings.TrimSpace(sysHelp["alias_identifier"][0]),
-				//},
-			},
+			Pattern: "well-known/?$",
 
 			Operations: map[logical.Operation]framework.OperationHandler{
-				logical.UpdateOperation: &framework.PathOperation{
-					Callback: b.handleEventsSubscribe,
-					Summary:  "",
+				logical.ReadOperation: &framework.PathOperation{
+					Callback: b.handleWellKnownList(),
+					DisplayAttrs: &framework.DisplayAttributes{
+						OperationPrefix: "well-known",
+						OperationVerb:   "list",
+						OperationSuffix: "labels-2",
+					},
 					Responses: map[int][]framework.Response{
 						http.StatusOK: {{
 							Description: "OK",
 							Fields: map[string]*framework.FieldSchema{
-								"id": {
-									Type:     framework.TypeString,
+								"keys": {
+									Type:     framework.TypeStringSlice,
+									Required: true,
+								},
+							},
+						}},
+					},
+				},
+				logical.ListOperation: &framework.PathOperation{
+					Callback: b.handleWellKnownList(),
+					DisplayAttrs: &framework.DisplayAttributes{
+						OperationPrefix: "well-known",
+						OperationVerb:   "list",
+						OperationSuffix: "labels",
+					},
+					Responses: map[int][]framework.Response{
+						http.StatusOK: {{
+							Description: "OK",
+							Fields: map[string]*framework.FieldSchema{
+								"keys": {
+									Type:     framework.TypeStringSlice,
 									Required: true,
 								},
 							},
@@ -5139,64 +5304,57 @@ func (b *SystemBackend) eventPaths() []*framework.Path {
 					},
 				},
 			},
-			// HelpSynopsis:    strings.TrimSpace(sysHelp["unlock_user"][0]),
-			// HelpDescription: strings.TrimSpace(sysHelp["unlock_user"][1]),
+
+			HelpSynopsis:    strings.TrimSpace(sysHelp["well-known-list"][0]),
+			HelpDescription: strings.TrimSpace(sysHelp["well-known-list"][1]),
 		},
 		{
-			Pattern: "events/subscriptions/(?P<plugin>.+)/(?P<id>.+)",
+			Pattern: "well-known/(?P<label>.+)",
 
 			DisplayAttrs: &framework.DisplayAttributes{
-				OperationPrefix: "subscriptions",
-				OperationVerb:   "create",
+				OperationPrefix: "well-known",
+				OperationSuffix: "label",
 			},
 
 			Fields: map[string]*framework.FieldSchema{
-				"plugin": {
-					Type: framework.TypeString,
-				},
-				"id": {
-					Type: framework.TypeString,
-					// Description: strings.TrimSpace(sysHelp["mount_accessor"][0]),
-				},
-				"list": {
-					Type: framework.TypeBool,
+				"label": {
+					Type:        framework.TypeString,
+					Description: strings.TrimSpace(sysHelp["well-known-label"][0]),
 				},
-				//"alias_identifier": {
-				//	Type: framework.TypeString,
-				//	// Description: strings.TrimSpace(sysHelp["alias_identifier"][0]),
-				//},
 			},
+
 			Operations: map[logical.Operation]framework.OperationHandler{
-				logical.ListOperation: &framework.PathOperation{
-					Callback: b.handleEventsListSubscriptions,
-					Summary:  "",
-					Responses: map[int][]framework.Response{
-						http.StatusNoContent: {{
-							Description: "OK",
-						}},
-					},
-				},
 				logical.ReadOperation: &framework.PathOperation{
-					Callback: b.handleEventsListSubscriptions,
-					Summary:  "",
-					Responses: map[int][]framework.Response{
-						http.StatusNoContent: {{
-							Description: "OK",
-						}},
-					},
-				},
-				logical.DeleteOperation: &framework.PathOperation{
-					Callback: b.handleEventsUnsubscribe,
-					Summary:  "",
+					Callback: b.handleWellKnownRead(),
 					Responses: map[int][]framework.Response{
-						http.StatusNoContent: {{
+						http.StatusOK: {{
 							Description: "OK",
+							Fields: map[string]*framework.FieldSchema{
+								"label": {
+									Type:     framework.TypeString,
+									Required: true,
+								},
+								"mount_uuid": {
+									Type:     framework.TypeString,
+									Required: true,
+								},
+								"mount_path": {
+									Type:     framework.TypeString,
+									Required: true,
+								},
+								"prefix": {
+									Type:     framework.TypeString,
+									Required: true,
+								},
+							},
 						}},
 					},
+					Summary: "Retrieve the associated mount information for a registered well-known label.",
 				},
 			},
-			// HelpSynopsis:    strings.TrimSpace(sysHelp["unlock_user"][0]),
-			// HelpDescription: strings.TrimSpace(sysHelp["unlock_user"][1]),
+
+			HelpSynopsis:    strings.TrimSpace(sysHelp["well-known"][0]),
+			HelpDescription: strings.TrimSpace(sysHelp["well-known"][1]),
 		},
 	}
 }
diff --git a/vault/logical_system_plugins_stubs_oss.go b/vault/logical_system_plugins_stubs_oss.go
new file mode 100644
index 00000000000..813b0d21688
--- /dev/null
+++ b/vault/logical_system_plugins_stubs_oss.go
@@ -0,0 +1,14 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+func validateSha256IsEmptyForEntPluginVersion(pluginVersion string, sha256 string) *logical.Response {
+	return nil
+}
diff --git a/vault/logical_system_pprof.go b/vault/logical_system_pprof.go
index b67853adb44..89e6e546a51 100644
--- a/vault/logical_system_pprof.go
+++ b/vault/logical_system_pprof.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/logical_system_quotas.go b/vault/logical_system_quotas.go
index bea528e547b..24b3640a65d 100644
--- a/vault/logical_system_quotas.go
+++ b/vault/logical_system_quotas.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-secure-stdlib/strutil"
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -160,6 +161,22 @@ The 'rate' must be positive.`,
 					Description: `If set, when a client reaches a rate limit threshold, the client will be prohibited
 from any further requests until after the 'block_interval' has elapsed.`,
 				},
+				"group_by": {
+					Type: framework.TypeString,
+					Description: `Attribute by which to group requests by. Valid group_by modes are: 1) "ip" that groups
+requests by their source IP address (group_by defaults to ip if unset); 2) "none" that groups all requests that match
+the rate limit quota rule together; 3) "entity_then_ip" that groups requests by their entity ID for authenticated
+requests that carry one, or by their IP for unauthenticated requests (or requests whose authentication is not connected
+to an entity); and 4) "entity_then_none" which also groups requests by their entity ID when available, but the rest is
+all grouped together (i.e. unauthenticated or with authentication not connected to an entity).`,
+					Default: "ip",
+				},
+				"secondary_rate": {
+					Type: framework.TypeFloat,
+					Description: `Only available when using the "entity_then_ip" or "entity_then_none" group_by modes.
+This is the rate limit applied to the requests that fall under the "ip" or "none" groupings, while the authenticated
+requests that contain an entity ID are subject to the "rate" field instead. Defaults to the same value as "rate".`,
+				},
 			},
 			Operations: map[logical.Operation]framework.OperationHandler{
 				logical.UpdateOperation: &framework.PathOperation{
@@ -214,6 +231,14 @@ from any further requests until after the 'block_interval' has elapsed.`,
 									Type:     framework.TypeBool,
 									Required: true,
 								},
+								"group_by": {
+									Type:     framework.TypeString,
+									Required: true,
+								},
+								"secondary_rate": {
+									Type:     framework.TypeFloat,
+									Required: true,
+								},
 							},
 						}},
 					},
@@ -345,11 +370,42 @@ func (b *SystemBackend) handleRateLimitQuotasUpdate() framework.OperationFunc {
 		name := d.Get("name").(string)
 
 		qType := quotas.TypeRateLimit.String()
+
+		groupBy := d.Get("group_by").(string)
+		switch groupBy {
+		case "":
+			// in order to preserve backwards compatibility we default to the IP grouping, which was the behavior
+			// before the group_by field was added
+			groupBy = quotas.GroupByIp
+		case quotas.GroupByIp:
+			// valid group_by mode for both ent and CE
+		case quotas.GroupByNone, quotas.GroupByEntityThenIp, quotas.GroupByEntityThenNone:
+			// other group_by modes are only available in Enterprise. Use simple const on API to simplify things, but
+			// keep the evaluation properly contained in ent-only files
+			if !constants.IsEnterprise {
+				return logical.ErrorResponse("grouping mode %q is only available in Vault Enterprise", groupBy), nil
+			}
+		default:
+			return logical.ErrorResponse("invalid grouping mode %q", groupBy), nil
+		}
+
 		rate := d.Get("rate").(float64)
 		if rate <= 0 {
 			return logical.ErrorResponse("'rate' is invalid"), nil
 		}
 
+		secondaryRate := d.Get("secondary_rate").(float64)
+		if groupBy == quotas.GroupByEntityThenIp || groupBy == quotas.GroupByEntityThenNone {
+			if secondaryRate < 0 {
+				return logical.ErrorResponse("secondary rate must be greater than or equal to 0"), nil
+			}
+			if secondaryRate == 0 {
+				secondaryRate = rate
+			}
+		} else if secondaryRate != 0 {
+			return logical.ErrorResponse("secondary rate is only valid when using entity-based grouping"), nil
+		}
+
 		interval := time.Second * time.Duration(d.Get("interval").(int))
 		if interval == 0 {
 			interval = time.Second
@@ -461,16 +517,18 @@ func (b *SystemBackend) handleRateLimitQuotasUpdate() framework.OperationFunc {
 
 		switch {
 		case quota == nil:
-			quota = quotas.NewRateLimitQuota(name, ns.Path, mountPath, pathSuffix, role, inheritable, interval, blockInterval, rate)
+			quota = quotas.NewRateLimitQuota(name, ns.Path, mountPath, pathSuffix, role, quotas.GroupBy(groupBy), inheritable, interval, blockInterval, rate, secondaryRate)
 		default:
 			// Re-inserting the already indexed object in memdb might cause problems.
 			// So, clone the object. See https://github.com/hashicorp/go-memdb/issues/76.
 			clonedQuota := quota.Clone()
 			rlq := clonedQuota.(*quotas.RateLimitQuota)
+			rlq.GroupBy = quotas.GroupBy(groupBy)
 			rlq.NamespacePath = ns.Path
 			rlq.MountPath = mountPath
 			rlq.PathSuffix = pathSuffix
 			rlq.Rate = rate
+			rlq.SecondaryRate = secondaryRate
 			rlq.Inheritable = inheritable
 			rlq.Interval = interval
 			rlq.BlockInterval = blockInterval
@@ -507,9 +565,11 @@ func (b *SystemBackend) handleRateLimitQuotasRead() framework.OperationFunc {
 		data := map[string]interface{}{
 			"type":           qType,
 			"name":           rlq.Name,
+			"group_by":       rlq.GroupBy,
 			"path":           nsPath + rlq.MountPath + rlq.PathSuffix,
 			"role":           rlq.Role,
 			"rate":           rlq.Rate,
+			"secondary_rate": rlq.SecondaryRate,
 			"inheritable":    rlq.Inheritable,
 			"interval":       int(rlq.Interval.Seconds()),
 			"block_interval": int(rlq.BlockInterval.Seconds()),
@@ -558,8 +618,8 @@ var quotasHelp = map[string][2]string{
 mount.`,
 		`A rate limit quota will enforce API rate limiting in a specified interval. A
 rate limit quota can be created at the root level or defined on a namespace or
-mount by specifying a 'path'. The rate limiter is applied to each unique client
-IP address.`,
+mount by specifying a 'path'. The rate limiter is applied to each unique group of
+requests, as defined by the configured grouping method (client IP, entity ID, etc.).`,
 	},
 	"rate-limit-list": {
 		"Lists the names of all the rate limit quotas.",
diff --git a/vault/logical_system_raft.go b/vault/logical_system_raft.go
index 7b254076051..f60c3d2e236 100644
--- a/vault/logical_system_raft.go
+++ b/vault/logical_system_raft.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -9,6 +9,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"net/http"
 	"strings"
 	"time"
 
@@ -50,6 +51,12 @@ func (b *SystemBackend) raftStoragePaths() []*framework.Path {
 				"non_voter": {
 					Type: framework.TypeBool,
 				},
+				"upgrade_version": {
+					Type: framework.TypeString,
+				},
+				"sdk_version": {
+					Type: framework.TypeString,
+				},
 			},
 
 			Operations: map[logical.Operation]framework.OperationHandler{
@@ -261,11 +268,22 @@ func (b *SystemBackend) handleRaftRemovePeerUpdate() framework.OperationFunc {
 		}
 
 		b.Core.raftFollowerStates.Delete(serverID)
+		_, err := raftBackend.RemovedServerCleanup(ctx, serverID)
+		if err != nil {
+			// log the error but don't return it - we might get an error if we can't find the node in the cache, which
+			// is not an error condition in this instance.
+			b.logger.Info("attempted to remove node from perf standby cache but it failed, which might be fine", "server ID", serverID, "error", err)
+			return nil, nil
+		}
 
 		return nil, nil
 	}
 }
 
+const answerSize = 16
+
+var answerMaxEncodedSize = base64.StdEncoding.EncodedLen(answerSize)
+
 func (b *SystemBackend) handleRaftBootstrapChallengeWrite(makeSealer func() snapshot.Sealer) framework.OperationFunc {
 	return func(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
 		serverID := d.Get("server_id").(string)
@@ -274,25 +292,42 @@ func (b *SystemBackend) handleRaftBootstrapChallengeWrite(makeSealer func() snap
 		}
 
 		var answer []byte
-		answerRaw, ok := b.Core.pendingRaftPeers.Load(serverID)
+		b.Core.pendingRaftPeersLock.RLock()
+		challenge, ok := b.Core.pendingRaftPeers.Get(serverID)
+		b.Core.pendingRaftPeersLock.RUnlock()
 		if !ok {
-			var err error
-			answer, err = uuid.GenerateRandomBytes(16)
-			if err != nil {
-				return nil, err
+			if !b.raftChallengeLimiter.Allow() {
+				return logical.RespondWithStatusCode(logical.ErrorResponse("too many raft challenges in flight"), req, http.StatusTooManyRequests)
 			}
-			b.Core.pendingRaftPeers.Store(serverID, answer)
-		} else {
-			answer = answerRaw.([]byte)
-		}
 
-		sealer := makeSealer()
-		if sealer == nil {
-			return nil, errors.New("core has no seal Access to write raft bootstrap challenge")
-		}
-		protoBlob, err := sealer.Seal(ctx, answer)
-		if err != nil {
-			return nil, err
+			b.Core.pendingRaftPeersLock.Lock()
+			defer b.Core.pendingRaftPeersLock.Unlock()
+
+			challenge, ok = b.Core.pendingRaftPeers.Get(serverID)
+			if !ok {
+
+				var err error
+				answer, err = uuid.GenerateRandomBytes(answerSize)
+				if err != nil {
+					return nil, err
+				}
+
+				sealer := makeSealer()
+				if sealer == nil {
+					return nil, errors.New("core has no seal access to write raft bootstrap challenge")
+				}
+				protoBlob, err := sealer.Seal(ctx, answer)
+				if err != nil {
+					return nil, err
+				}
+
+				challenge = &raftBootstrapChallenge{
+					serverID:  serverID,
+					answer:    answer,
+					challenge: protoBlob,
+				}
+				b.Core.pendingRaftPeers.Add(serverID, challenge)
+			}
 		}
 
 		sealConfig, err := b.Core.seal.BarrierConfig(ctx)
@@ -302,7 +337,7 @@ func (b *SystemBackend) handleRaftBootstrapChallengeWrite(makeSealer func() snap
 
 		return &logical.Response{
 			Data: map[string]interface{}{
-				"challenge":   base64.StdEncoding.EncodeToString(protoBlob),
+				"challenge":   base64.StdEncoding.EncodeToString(challenge.challenge),
 				"seal_config": sealConfig,
 			},
 		}, nil
@@ -324,6 +359,9 @@ func (b *SystemBackend) handleRaftBootstrapAnswerWrite() framework.OperationFunc
 		if len(answerRaw) == 0 {
 			return logical.ErrorResponse("no answer provided"), logical.ErrInvalidRequest
 		}
+		if len(answerRaw) > answerMaxEncodedSize {
+			return logical.ErrorResponse("answer is too long"), logical.ErrInvalidRequest
+		}
 		clusterAddr := d.Get("cluster_addr").(string)
 		if len(clusterAddr) == 0 {
 			return logical.ErrorResponse("no cluster_addr provided"), logical.ErrInvalidRequest
@@ -336,14 +374,17 @@ func (b *SystemBackend) handleRaftBootstrapAnswerWrite() framework.OperationFunc
 			return logical.ErrorResponse("could not base64 decode answer"), logical.ErrInvalidRequest
 		}
 
-		expectedAnswerRaw, ok := b.Core.pendingRaftPeers.Load(serverID)
+		b.Core.pendingRaftPeersLock.Lock()
+		expectedChallenge, ok := b.Core.pendingRaftPeers.Get(serverID)
 		if !ok {
+			b.Core.pendingRaftPeersLock.Unlock()
 			return logical.ErrorResponse("no expected answer for the server id provided"), logical.ErrInvalidRequest
 		}
 
-		b.Core.pendingRaftPeers.Delete(serverID)
+		b.Core.pendingRaftPeers.Remove(serverID)
+		b.Core.pendingRaftPeersLock.Unlock()
 
-		if subtle.ConstantTimeCompare(answer, expectedAnswerRaw.([]byte)) == 0 {
+		if subtle.ConstantTimeCompare(answer, expectedChallenge.answer) == 0 {
 			return logical.ErrorResponse("invalid answer given"), logical.ErrInvalidRequest
 		}
 
@@ -370,6 +411,8 @@ func (b *SystemBackend) handleRaftBootstrapAnswerWrite() framework.OperationFunc
 		added := b.Core.raftFollowerStates.Update(&raft.EchoRequestUpdate{
 			NodeID:          serverID,
 			DesiredSuffrage: desiredSuffrage,
+			SDKVersion:      d.Get("sdk_version").(string),
+			UpgradeVersion:  d.Get("upgrade_version").(string),
 		})
 
 		switch nonVoter {
diff --git a/vault/logical_system_stubs_oss.go b/vault/logical_system_stubs_oss.go
new file mode 100644
index 00000000000..c130c8b7552
--- /dev/null
+++ b/vault/logical_system_stubs_oss.go
@@ -0,0 +1,37 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"context"
+	"errors"
+
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/vault/snapshots"
+)
+
+//go:generate go run github.com/hashicorp/vault/tools/stubmaker
+
+type entSystemBackend struct{}
+
+func entUnauthenticatedPaths() []string {
+	return []string{}
+}
+
+func (s *SystemBackend) entInit() {}
+
+func (s *SystemBackend) makeSnapshotSource(ctx context.Context, _ *framework.FieldData) (snapshots.Source, error) {
+	body, ok := logical.ContextOriginalBodyValue(ctx)
+	if !ok {
+		return nil, errors.New("no reader for request")
+	}
+	return snapshots.NewManualSnapshotSource(body), nil
+}
+
+func entWrappedPluginsCRUDPath(b *SystemBackend) []*framework.Path {
+	return []*framework.Path{b.pluginsCatalogCRUDPath()}
+}
diff --git a/vault/logical_system_sync_secrets_stub.go b/vault/logical_system_sync_secrets_stub.go
index f6f849691c4..225128d981e 100644
--- a/vault/logical_system_sync_secrets_stub.go
+++ b/vault/logical_system_sync_secrets_stub.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/logical_system_test.go b/vault/logical_system_test.go
index a6de9f2ac0b..49086e922a2 100644
--- a/vault/logical_system_test.go
+++ b/vault/logical_system_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -10,10 +10,12 @@ import (
 	"errors"
 	"fmt"
 	"io/ioutil"
+	"math/rand"
 	"net/http"
 	"os"
 	"path/filepath"
 	"reflect"
+	"regexp"
 	"runtime"
 	"strings"
 	"testing"
@@ -24,6 +26,8 @@ import (
 	"github.com/hashicorp/go-hclog"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	aeadwrapper "github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2"
+	"github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/audit"
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/helper/builtinplugins"
 	"github.com/hashicorp/vault/helper/experiments"
@@ -716,7 +720,7 @@ path "bar/baz" {
 	capabilities = ["read", "update"]
 }
 path "bar/baz" {
-	capabilities = ["delete"]
+	capabilities = ["delete", "recover"]
 }
 `
 
@@ -824,7 +828,7 @@ func TestSystemBackend_PathCapabilities(t *testing.T) {
 		expected1 := []string{"create", "sudo", "update"}
 		expected2 := expected1
 		expected3 := []string{"update"}
-		expected4 := []string{"delete", "read", "update"}
+		expected4 := []string{"delete", "read", "recover", "update"}
 
 		if !reflect.DeepEqual(resp.Data[path1], expected1) ||
 			!reflect.DeepEqual(resp.Data[path2], expected2) ||
@@ -1072,7 +1076,7 @@ func TestSystemBackend_remount_auth(t *testing.T) {
 		)
 
 		migrationInfo := resp.Data["migration_info"].(*MountMigrationInfo)
-		if migrationInfo.MigrationStatus != MigrationSuccessStatus.String() {
+		if migrationInfo.MigrationStatus != MigrationStatusSuccess.String() {
 			return fmt.Errorf("Expected migration status to be successful, got %q", migrationInfo.MigrationStatus)
 		}
 		return nil
@@ -1224,7 +1228,7 @@ func TestSystemBackend_remount(t *testing.T) {
 			t.Fatalf("err: %v", err)
 		}
 		migrationInfo := resp.Data["migration_info"].(*MountMigrationInfo)
-		if migrationInfo.MigrationStatus != MigrationSuccessStatus.String() {
+		if migrationInfo.MigrationStatus != MigrationStatusSuccess.String() {
 			return fmt.Errorf("Expected migration status to be successful, got %q", migrationInfo.MigrationStatus)
 		}
 		return nil
@@ -2484,7 +2488,7 @@ func TestSystemBackend_tuneAuth(t *testing.T) {
 			Command: "foo",
 			Args:    []string{},
 			Env:     []string{},
-			Sha256:  []byte{},
+			Sha256:  []byte("sha256"),
 		})
 		if err != nil {
 			t.Fatal(err)
@@ -2519,6 +2523,146 @@ func TestSystemBackend_tuneAuth(t *testing.T) {
 	}
 }
 
+// TestSystemBackend_tune_updatePreV1MountEntryType tests once Vault is migrated post-v1.0.0,
+// the secret/auth mount was enabled in Vault pre-v1.0.0 has its MountEntry.Type updated
+// to the plugin name when tuned with plugin_version
+func TestSystemBackend_tune_updatePreV1MountEntryType(t *testing.T) {
+	tempDir, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatalf("error: %v", err)
+	}
+
+	c, _, _ := TestCoreUnsealedWithConfig(t, &CoreConfig{
+		PluginDirectory: tempDir,
+	})
+
+	ctx := namespace.RootContext(nil)
+	testCases := []struct {
+		pluginName string
+		pluginType consts.PluginType
+		mountTable string
+	}{
+		{"consul", consts.PluginTypeSecrets, "mounts"},
+		{"approle", consts.PluginTypeCredential, "auth"},
+	}
+
+	readMountConfig := func(pluginName, mountTable string) map[string]interface{} {
+		t.Helper()
+		req := logical.TestRequest(t, logical.ReadOperation, mountTable+"/"+pluginName)
+		resp, err := c.systemBackend.HandleRequest(ctx, req)
+		if err != nil {
+			t.Fatalf("err: %v", err)
+		}
+
+		return resp.Data
+	}
+
+	for _, tc := range testCases {
+		// Enable the mount
+		{
+			req := logical.TestRequest(t, logical.UpdateOperation, tc.mountTable+"/"+tc.pluginName)
+			req.Data["type"] = tc.pluginName
+
+			resp, err := c.systemBackend.HandleRequest(ctx, req)
+			if err != nil {
+				t.Fatalf("err: %v, resp: %#v", err, resp)
+			}
+			if resp != nil {
+				t.Fatalf("bad: %v", resp)
+			}
+
+			config := readMountConfig(tc.pluginName, tc.mountTable)
+			pluginVersion, ok := config["plugin_version"]
+			if !ok || pluginVersion != "" {
+				t.Fatalf("expected empty plugin version in config: %#v", config)
+			}
+		}
+
+		// Directly set MountEntry's Type to "plugin" and Config.PluginName like Vault pre-v1.0.0 does
+		const mountEntryTypeExternalPlugin = "plugin"
+		{
+			var mountEntry *MountEntry
+			if tc.mountTable == "mounts" {
+				mountEntry, err = c.mounts.find(ctx, tc.pluginName+"/")
+			} else {
+				mountEntry, err = c.auth.find(ctx, tc.pluginName+"/")
+			}
+			if err != nil {
+				t.Fatal(err)
+			}
+			if mountEntry == nil {
+				t.Fatal()
+			}
+			mountEntry.Type = mountEntryTypeExternalPlugin
+			mountEntry.Config.PluginName = tc.pluginName
+			err := c.persistMounts(ctx, c.mounts, &mountEntry.Local)
+			if err != nil {
+				t.Fatal(err)
+			}
+		}
+
+		// Verify MountEntry.Type is still "plugin" (Vault pre-v1.0.0)
+		config := readMountConfig(tc.pluginName, tc.mountTable)
+		mountEntryType, ok := config["type"]
+		if !ok || mountEntryType != mountEntryTypeExternalPlugin {
+			t.Fatalf("expected mount type %s but was %s, config: %#v", mountEntryTypeExternalPlugin, mountEntryType, config)
+		}
+
+		// Register the plugin in the catalog, and then try the same request again.
+		const externalPluginVersion string = "v0.0.7"
+		{
+			file, err := os.Create(filepath.Join(tempDir, tc.pluginName))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := file.Close(); err != nil {
+				t.Fatal(err)
+			}
+			err = c.pluginCatalog.Set(context.Background(), pluginutil.SetPluginInput{
+				Name:    tc.pluginName,
+				Type:    tc.pluginType,
+				Version: externalPluginVersion,
+				Command: tc.pluginName,
+				Args:    []string{},
+				Env:     []string{},
+				Sha256:  []byte("sha256"),
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+		}
+
+		// Tune mount with plugin_version
+		{
+			req := logical.TestRequest(t, logical.UpdateOperation, tc.mountTable+"/"+tc.pluginName+"/tune")
+			req.Data["plugin_version"] = externalPluginVersion
+
+			resp, err := c.systemBackend.HandleRequest(ctx, req)
+			if err != nil {
+				t.Fatalf("err: %v, resp: %#v", err, resp)
+			}
+			if resp != nil {
+				t.Fatalf("bad: %v", resp)
+			}
+		}
+
+		// Verify that plugin_version and MountEntry.Type were updated properly
+		config = readMountConfig(tc.pluginName, tc.mountTable)
+		pluginVersion, ok := config["plugin_version"]
+		if !ok || pluginVersion == "" {
+			t.Fatalf("expected non-empty plugin version in config: %#v", config)
+		}
+		if pluginVersion != externalPluginVersion {
+			t.Fatalf("expected plugin version %#v, got %v", externalPluginVersion, pluginVersion)
+		}
+
+		mountEntryType, ok = config["type"]
+		if !ok || mountEntryType != tc.pluginName {
+			t.Fatalf("expected mount type %s, got %s, config: %#v", tc.pluginName, mountEntryType, config)
+		}
+	}
+}
+
 func TestSystemBackend_policyList(t *testing.T) {
 	b := testSystemBackend(t)
 	req := logical.TestRequest(t, logical.ReadOperation, "policy")
@@ -2558,6 +2702,8 @@ func TestSystemBackend_policyCRUD(t *testing.T) {
 	if resp != nil && (resp.IsError() || len(resp.Data) > 0) {
 		t.Fatalf("bad: %#v", resp)
 	}
+	// TODO (HCL_DUP_KEYS_DEPRECATION): remove this expectation once deprecation is done
+	require.NotContains(t, resp.Warnings, "policy contains duplicate attributes, which will no longer be supported in a future version")
 
 	// validate the response structure for policy named Update
 	schema.ValidateResponse(
@@ -2664,12 +2810,47 @@ func TestSystemBackend_policyCRUD(t *testing.T) {
 	}
 }
 
+// TestSystemBackend_writeHCLDuplicateAttributes checks that trying to create a policy with duplicate HCL attributes
+// results in a warning being returned by the API
+func TestSystemBackend_writeHCLDuplicateAttributes(t *testing.T) {
+	// policy with duplicate attribute
+	rules := `path "foo/" { policy = "read" policy = "read" }`
+	req := logical.TestRequest(t, logical.UpdateOperation, "policy/foo")
+	req.Data["policy"] = rules
+
+	t.Run("fails with env unset", func(t *testing.T) {
+		b := testSystemBackend(t)
+		resp, err := b.HandleRequest(namespace.RootContext(nil), req)
+		require.Error(t, err)
+		require.Error(t, resp.Error())
+		require.EqualError(t, resp.Error(), "failed to parse policy: The argument \"policy\" at 1:31 was already set. Each argument can only be defined once")
+	})
+
+	// TODO (HCL_DUP_KEYS_DEPRECATION): leave only test above once deprecation is done
+	t.Run("warning with env set", func(t *testing.T) {
+		t.Setenv(random.AllowHclDuplicatesEnvVar, "true")
+		b := testSystemBackend(t)
+		resp, err := b.HandleRequest(namespace.RootContext(nil), req)
+		if err != nil {
+			t.Fatalf("err: %v %#v", err, resp)
+		}
+		if resp != nil && (resp.IsError() || len(resp.Data) > 0) {
+			t.Fatalf("bad: %#v", resp)
+		}
+		require.Contains(t, resp.Warnings, "policy contains duplicate attributes, which will no longer be supported in a future version")
+	})
+}
+
 func TestSystemBackend_enableAudit(t *testing.T) {
-	c, b, _ := testCoreSystemBackend(t)
-	c.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
+	_, b, _ := testCoreSystemBackend(t)
 
 	req := logical.TestRequest(t, logical.UpdateOperation, "audit/foo")
-	req.Data["type"] = "noop"
+	req.Data = map[string]any{
+		"type": audit.TypeFile,
+		"options": map[string]string{
+			"file_path": "discard",
+		},
+	}
 
 	resp, err := b.HandleRequest(namespace.RootContext(nil), req)
 	if err != nil {
@@ -2735,11 +2916,15 @@ func TestSystemBackend_decodeToken(t *testing.T) {
 }
 
 func TestSystemBackend_auditHash(t *testing.T) {
-	c, b, _ := testCoreSystemBackend(t)
-	c.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
+	_, b, _ := testCoreSystemBackend(t)
 
 	req := logical.TestRequest(t, logical.UpdateOperation, "audit/foo")
-	req.Data["type"] = "noop"
+	req.Data = map[string]any{
+		"type": audit.TypeFile,
+		"options": map[string]string{
+			"file_path": "discard",
+		},
+	}
 
 	resp, err := b.HandleRequest(namespace.RootContext(nil), req)
 	if err != nil {
@@ -2774,12 +2959,16 @@ func TestSystemBackend_auditHash(t *testing.T) {
 		true,
 	)
 
-	hash, ok := resp.Data["hash"]
+	hashRaw, ok := resp.Data["hash"]
 	if !ok {
 		t.Fatalf("did not get hash back in response, response was %#v", resp.Data)
 	}
-	if hash.(string) != "hmac-sha256:f9320baf0249169e73850cd6156ded0106e2bb6ad8cab01b7bbbebe6d1065317" {
-		t.Fatalf("bad hash back: %s", hash.(string))
+	hash := hashRaw.(string)
+	if !strings.HasPrefix(hash, "hmac-sha256:") {
+		t.Fatalf("bad hash format: %s", hash)
+	}
+	if len(hash) != 76 { // "hmac-sha256:" + 64
+		t.Fatalf("bad hash length: %s", hash)
 	}
 }
 
@@ -2791,23 +2980,26 @@ func TestSystemBackend_enableAudit_invalid(t *testing.T) {
 	if err != logical.ErrInvalidRequest {
 		t.Fatalf("err: %v", err)
 	}
-	if resp.Data["error"] != `unknown backend type: "nope"` {
+	if resp.Data["error"] != "unknown backend type: \"nope\": invalid configuration" {
 		t.Fatalf("bad: %v", resp)
 	}
 }
 
 func TestSystemBackend_auditTable(t *testing.T) {
-	c, b, _ := testCoreSystemBackend(t)
-	c.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
+	_, b, _ := testCoreSystemBackend(t)
 
 	req := logical.TestRequest(t, logical.UpdateOperation, "audit/foo")
-	req.Data["type"] = "noop"
-	req.Data["description"] = "testing"
-	req.Data["options"] = map[string]interface{}{
-		"foo": "bar",
+	req.Data = map[string]any{
+		"type":        audit.TypeFile,
+		"description": "testing",
+		"local":       true,
+		"options": map[string]string{
+			"file_path": "discard",
+			"foo":       "bar",
+		},
 	}
-	req.Data["local"] = true
-	b.HandleRequest(namespace.RootContext(nil), req)
+	_, err := b.HandleRequest(namespace.RootContext(nil), req)
+	require.NoError(t, err)
 
 	req = logical.TestRequest(t, logical.ReadOperation, "audit")
 	resp, err := b.HandleRequest(namespace.RootContext(nil), req)
@@ -2818,10 +3010,11 @@ func TestSystemBackend_auditTable(t *testing.T) {
 	exp := map[string]interface{}{
 		"foo/": map[string]interface{}{
 			"path":        "foo/",
-			"type":        "noop",
+			"type":        audit.TypeFile,
 			"description": "testing",
 			"options": map[string]string{
-				"foo": "bar",
+				"file_path": "discard",
+				"foo":       "bar",
 			},
 			"local": true,
 		},
@@ -2832,16 +3025,20 @@ func TestSystemBackend_auditTable(t *testing.T) {
 }
 
 func TestSystemBackend_disableAudit(t *testing.T) {
-	c, b, _ := testCoreSystemBackend(t)
-	c.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
+	_, b, _ := testCoreSystemBackend(t)
 
 	req := logical.TestRequest(t, logical.UpdateOperation, "audit/foo")
-	req.Data["type"] = "noop"
-	req.Data["description"] = "testing"
-	req.Data["options"] = map[string]interface{}{
-		"foo": "bar",
+	req.Data = map[string]any{
+		"type":        audit.TypeFile,
+		"description": "testing",
+		"local":       true,
+		"options": map[string]string{
+			"file_path": "discard",
+			"foo":       "bar",
+		},
 	}
-	b.HandleRequest(namespace.RootContext(nil), req)
+	_, err := b.HandleRequest(namespace.RootContext(nil), req)
+	require.NoError(t, err)
 
 	// Deregister it
 	req = logical.TestRequest(t, logical.DeleteOperation, "audit/foo")
@@ -4371,8 +4568,8 @@ func TestSystemBackend_InternalUIMounts(t *testing.T) {
 			"token/": map[string]interface{}{
 				"options": map[string]string(nil),
 				"config": map[string]interface{}{
-					"default_lease_ttl": int64(0),
-					"max_lease_ttl":     int64(0),
+					"default_lease_ttl": int64(2764800),
+					"max_lease_ttl":     int64(2764800),
 					"force_no_cache":    false,
 					"token_type":        "default-service",
 				},
@@ -4541,6 +4738,91 @@ func TestSystemBackend_InternalUIMount(t *testing.T) {
 	}
 }
 
+// TestSystemBackend_InternalUIResultantACL verifies that segment wildcard and prefix glob ACLs are emitted correctly in the internal UI resultant-acl endpoint.
+func TestSystemBackend_InternalUIResultantACL(t *testing.T) {
+	ctx := namespace.RootContext(nil)
+	core, b, rootToken := testCoreSystemBackend(t)
+
+	// Define a policy that includes a segment wildcard and a prefix glob.
+	rules := `
+name = "ui-res-acl-test"
+path "+/auth/*" {
+  capabilities = ["read"]
+}
+path "sys/*" {
+  capabilities = ["update"]
+}`
+
+	pol, err := ParseACLPolicy(namespace.RootNamespace, rules)
+	require.NoError(t, err)
+	require.NoError(t, core.policyStore.SetPolicy(ctx, pol))
+
+	// Create a non-root token that has this policy attached
+	testMakeServiceTokenViaBackend(t, core.tokenStore, rootToken, "tokenid", "", []string{"ui-res-acl-test"})
+
+	// Call the endpoint as the non-root token; this endpoint evaluates the caller.
+	req := logical.TestRequest(t, logical.ReadOperation, "internal/ui/resultant-acl")
+	req.ClientToken = "tokenid"
+
+	resp, err := b.HandleRequest(ctx, req)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	require.NotNil(t, resp.Data)
+
+	// Validate response shape.
+	schema.ValidateResponse(
+		t,
+		schema.GetResponseSchema(t, b.(*SystemBackend).Route(req.Path), req.Operation),
+		resp,
+		true,
+	)
+
+	// Basic flags we expect back for a non-root token we’re inspecting.
+	if v, ok := resp.Data["root"].(bool); ok {
+		require.False(t, v, "expected non-root token")
+	}
+
+	// Extract glob paths and ensure both entries are present with expected caps.
+	globPaths, ok := resp.Data["glob_paths"].(map[string]interface{})
+	require.True(t, ok, "glob_paths missing or wrong type")
+
+	getCaps := func(m map[string]interface{}) []string {
+		raw := m["capabilities"]
+		switch a := raw.(type) {
+		case []string:
+			return a
+		case []interface{}:
+			out := make([]string, 0, len(a))
+			for _, x := range a {
+				if s, ok := x.(string); ok {
+					out = append(out, s)
+				}
+			}
+			return out
+		default:
+			return nil
+		}
+	}
+
+	// 1) segment wildcard preserved
+	segRaw, ok := globPaths["+/auth/*"]
+	require.True(t, ok, "segment wildcard path not found")
+	seg, ok := segRaw.(map[string]interface{})
+	require.True(t, ok, "segment wildcard value wrong type")
+	require.Equal(t, []string{"read"}, getCaps(seg))
+
+	// 2) prefix glob preserved (the backend may normalize to "sys/*" or "sys/")
+	prefixKey := "sys/*"
+	if _, ok := globPaths["sys/"]; ok {
+		prefixKey = "sys/"
+	}
+	prefRaw, ok := globPaths[prefixKey]
+	require.True(t, ok, "prefix glob path not found")
+	pref, ok := prefRaw.(map[string]interface{})
+	require.True(t, ok, "prefix glob value wrong type")
+	require.Contains(t, getCaps(pref), "update")
+}
+
 func TestSystemBackend_OpenAPI(t *testing.T) {
 	coreConfig := &CoreConfig{
 		LogicalBackends: map[string]logical.Factory{
@@ -6287,7 +6569,7 @@ func TestValidateVersion_HelpfulErrorWhenBuiltinOverridden(t *testing.T) {
 		Command: command,
 		Args:    nil,
 		Env:     nil,
-		Sha256:  nil,
+		Sha256:  []byte("sha256"),
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -6950,3 +7232,283 @@ func TestPathInternalUICustomMessagesCommon(t *testing.T) {
 	assert.Contains(t, resp.Data, "key_info")
 	assert.Equal(t, 3, len(resp.Data["key_info"].(map[string]any)))
 }
+
+// TestGetLeaderStatus_RedactionSettings verifies that the GetLeaderStatus response
+// is properly redacted based on the provided context.Context.
+func TestGetLeaderStatus_RedactionSettings(t *testing.T) {
+	testCluster := NewTestCluster(t, nil, nil)
+
+	testCluster.Start()
+	defer testCluster.Cleanup()
+
+	testCore := testCluster.Cores[0]
+
+	// Check with no redaction settings
+	resp, err := testCore.GetLeaderStatus(context.Background())
+	assert.NoError(t, err)
+	assert.NotEmpty(t, resp.LeaderAddress)
+	assert.NotEmpty(t, resp.LeaderClusterAddress)
+
+	// Check with redaction setting explicitly disabled
+	ctx := logical.CreateContextRedactionSettings(context.Background(), false, false, false)
+	resp, err = testCore.GetLeaderStatus(ctx)
+	assert.NoError(t, err)
+	assert.NotEmpty(t, resp.LeaderAddress)
+	assert.NotEmpty(t, resp.LeaderClusterAddress)
+
+	// Check with redaction setting enabled
+	ctx = logical.CreateContextRedactionSettings(context.Background(), false, true, false)
+	resp, err = testCore.GetLeaderStatus(ctx)
+	assert.NoError(t, err)
+	assert.Empty(t, resp.LeaderAddress)
+	assert.Empty(t, resp.LeaderClusterAddress)
+}
+
+// TestGetSealStatus_RedactionSettings verifies that the GetSealStatus response
+// is properly redacted based on the provided context.Context.
+func TestGetSealStatus_RedactionSettings(t *testing.T) {
+	// This test function cannot be parallelized, because it messes with the
+	// global version.BuildDate variable.
+	oldBuildDate := version.BuildDate
+	version.BuildDate = time.Now().Format(time.RFC3339)
+	defer func() { version.BuildDate = oldBuildDate }()
+
+	testCluster := NewTestCluster(t, &CoreConfig{
+		ClusterName: "secret-cluster-name",
+	}, nil)
+
+	testCluster.Start()
+	defer testCluster.Cleanup()
+
+	testCore := testCluster.Cores[0]
+
+	// Check with no redaction settings
+	resp, err := testCore.GetSealStatus(context.Background(), false)
+	assert.NoError(t, err)
+	assert.NotEmpty(t, resp.Version)
+	assert.NotEmpty(t, resp.BuildDate)
+	assert.NotEmpty(t, resp.ClusterName)
+
+	// Check with redaction setting explicitly disabled
+	ctx := logical.CreateContextRedactionSettings(context.Background(), false, false, false)
+	resp, err = testCore.GetSealStatus(ctx, false)
+	assert.NoError(t, err)
+	assert.NotEmpty(t, resp.Version)
+	assert.NotEmpty(t, resp.BuildDate)
+	assert.NotEmpty(t, resp.ClusterName)
+
+	// Check with redaction setting enabled
+	ctx = logical.CreateContextRedactionSettings(context.Background(), true, false, true)
+	resp, err = testCore.GetSealStatus(ctx, false)
+	assert.NoError(t, err)
+	assert.Empty(t, resp.Version)
+	assert.Empty(t, resp.BuildDate)
+	assert.Empty(t, resp.ClusterName)
+}
+
+// TestWellKnownSysApi verifies the GET/LIST endpoints of /sys/well-known and /sys/well-known/<label>
+func TestWellKnownSysApi(t *testing.T) {
+	c, _, _ := TestCoreUnsealed(t)
+	b := c.systemBackend
+
+	myUuid, err := uuid.GenerateUUID()
+	require.NoError(t, err, "failed generating uuid")
+
+	err = c.WellKnownRedirects.TryRegister(context.Background(), c, myUuid, "mylabel1", "test-path/foo1")
+	require.NoError(t, err, "failed registering well-known redirect 1")
+
+	err = c.WellKnownRedirects.TryRegister(context.Background(), c, myUuid, "mylabel2", "test-path/foo2")
+	require.NoError(t, err, "failed registering well-known redirect 2")
+
+	// Test LIST operation
+	req := logical.TestRequest(t, logical.ListOperation, "well-known")
+	resp, err := b.HandleRequest(namespace.RootContext(nil), req)
+	require.NoError(t, err, "failed list well-known request")
+	require.NotNil(t, resp, "response from list well-known request was nil")
+
+	require.Contains(t, resp.Data["keys"], "mylabel1")
+	require.Contains(t, resp.Data["keys"], "mylabel2")
+	require.Len(t, resp.Data["keys"], 2)
+
+	keyInfo := resp.Data["key_info"].(map[string]interface{})
+	keyInfoLabel1 := keyInfo["mylabel1"].(map[string]interface{})
+	require.Equal(t, myUuid, keyInfoLabel1["mount_uuid"])
+	require.Equal(t, "test-path/foo1", keyInfoLabel1["prefix"])
+
+	keyInfoLabel2 := keyInfo["mylabel2"].(map[string]interface{})
+	require.Equal(t, myUuid, keyInfoLabel2["mount_uuid"])
+	require.Equal(t, "test-path/foo2", keyInfoLabel2["prefix"])
+
+	// Test GET operation
+	req = logical.TestRequest(t, logical.ReadOperation, "well-known/mylabel1")
+	resp, err = b.HandleRequest(namespace.RootContext(nil), req)
+	require.NoError(t, err, "failed get well-known request")
+	require.NotNil(t, resp, "response from get well-known request was nil")
+
+	require.Equal(t, myUuid, resp.Data["mount_uuid"])
+	require.Equal(t, "test-path/foo1", resp.Data["prefix"])
+
+	// Test GET operation on unknown label
+	req = logical.TestRequest(t, logical.ReadOperation, "well-known/mylabel1-unknown")
+	resp, err = b.HandleRequest(namespace.RootContext(nil), req)
+	require.NoError(t, err, "failed get well-known request")
+	require.Nil(t, resp, "response from unknown should have been nil was %v", resp)
+}
+
+// Test_sanitizePath verifies that sanitizePath can correctly remove leading
+// slashes and add trailing slashes
+func Test_sanitizePath(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		path string
+		want string
+	}{
+		{
+			path: "/mount/path",
+			want: "mount/path/",
+		},
+		{
+			path: "///mount/path",
+			want: "mount/path/",
+		},
+		{
+			path: "/mount/path/",
+			want: "mount/path/",
+		},
+		{
+			path: "//mount/path/",
+			want: "mount/path/",
+		},
+		{
+			path: "/\\mount/path/",
+			want: "mount/path/",
+		},
+		{
+			path: "\\mount/path/",
+			want: "\\mount/path/",
+		},
+		{
+			path: "\\//mount/path/",
+			want: "\\//mount/path/",
+		},
+		{
+			path: "",
+			want: "",
+		},
+		{
+			path: "/",
+			want: "",
+		},
+		{
+			path: "///",
+			want: "",
+		},
+		{
+			path: "\\",
+			want: "\\/",
+		},
+		{
+			path: "\\/",
+			want: "\\/",
+		},
+		{
+			path: "/\\",
+			want: "",
+		},
+	}
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.path, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, tc.want, sanitizePath(tc.path))
+		})
+	}
+}
+
+// TestFuzz_sanitizePath verifies that randomly generated paths must abide by
+// the invariants:
+//   - if the original path was empty or was only made up of slashes, the
+//     sanitized path must be empty
+//   - otherwise,
+//     -- the sanitized path must not have a slash as a prefix
+//     -- the sanitized path must have a slash as a suffix
+//
+// The randomly generated paths will always have at least 1 slash
+func TestFuzz_sanitizePath(t *testing.T) {
+	slashesOrEmpty := regexp.MustCompile(`/*`)
+	valid := func(path, newPath string) bool {
+		if newPath == "" && slashesOrEmpty.MatchString(path) {
+			return true
+		}
+		if strings.HasPrefix(newPath, "/") {
+			return false
+		}
+		return strings.HasSuffix(newPath, "/")
+	}
+
+	r := rand.New(rand.NewSource(time.Now().Unix()))
+	gen := &random.StringGenerator{
+		Length: 10,
+		Rules: []random.Rule{
+			random.CharsetRule{
+				Charset:  random.LowercaseRuneset,
+				MinChars: 1,
+			},
+			random.CharsetRule{
+				Charset:  []rune{'/'},
+				MinChars: 1,
+			},
+		},
+	}
+	for i := 0; i < 100; i++ {
+		path, err := gen.Generate(context.Background(), r)
+		require.NoError(t, err)
+		newPath := sanitizePath(path)
+		require.True(t, valid(path, newPath), `"%s" not sanitized correctly, got "%s"`, path, newPath)
+	}
+}
+
+// TestSealStatus_Removed checks if the seal-status endpoint returns the
+// correct value for RemovedFromCluster when provided with different backends
+func TestSealStatus_Removed(t *testing.T) {
+	removedCore, err := TestCoreWithMockRemovableNodeHABackend(t, true)
+	require.NoError(t, err)
+	notRemovedCore, err := TestCoreWithMockRemovableNodeHABackend(t, false)
+	require.NoError(t, err)
+	testCases := []struct {
+		name      string
+		core      *Core
+		wantField bool
+		wantTrue  bool
+	}{
+		{
+			name:      "removed",
+			core:      removedCore,
+			wantField: true,
+			wantTrue:  true,
+		},
+		{
+			name:      "not removed",
+			core:      notRemovedCore,
+			wantField: true,
+			wantTrue:  false,
+		},
+		{
+			name:      "different backend",
+			core:      TestCore(t),
+			wantField: false,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			status, err := tc.core.GetSealStatus(context.Background(), true)
+			require.NoError(t, err)
+			if tc.wantField {
+				require.NotNil(t, status.RemovedFromCluster)
+				require.Equal(t, tc.wantTrue, *status.RemovedFromCluster)
+			} else {
+				require.Nil(t, status.RemovedFromCluster)
+			}
+		})
+	}
+}
diff --git a/vault/logical_system_user_lockout.go b/vault/logical_system_user_lockout.go
index 8390b708882..759ab8d57f0 100644
--- a/vault/logical_system_user_lockout.go
+++ b/vault/logical_system_user_lockout.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/logical_system_util.go b/vault/logical_system_util.go
index 7936c091757..d07bb08f147 100644
--- a/vault/logical_system_util.go
+++ b/vault/logical_system_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/login_mfa.go b/vault/login_mfa.go
index a81dd512371..b17ff938c0f 100644
--- a/vault/login_mfa.go
+++ b/vault/login_mfa.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -10,9 +10,10 @@ import (
 	"errors"
 	"fmt"
 	"image/png"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/url"
+	"regexp"
 	"strings"
 	"sync"
 	"time"
@@ -27,6 +28,7 @@ import (
 	"github.com/hashicorp/go-memdb"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/go-uuid"
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/identity/mfa"
 	"github.com/hashicorp/vault/helper/namespace"
@@ -38,8 +40,7 @@ import (
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/hashicorp/vault/vault/quotas"
 	"github.com/mitchellh/mapstructure"
-	"github.com/okta/okta-sdk-golang/v2/okta"
-	"github.com/okta/okta-sdk-golang/v2/okta/query"
+	"github.com/okta/okta-sdk-golang/v5/okta"
 	"github.com/patrickmn/go-cache"
 	otplib "github.com/pquerna/otp"
 	totplib "github.com/pquerna/otp/totp"
@@ -336,7 +337,7 @@ func (i *IdentityStore) handleMFAMethodWriteCommon(ctx context.Context, req *log
 
 	switch methodType {
 	case mfaMethodTypeTOTP:
-		err = parseTOTPConfig(mConfig, d)
+		err = parseTOTPConfig(mConfig, d, constants.IsEnterprise, true)
 		if err != nil {
 			return logical.ErrorResponse(err.Error()), nil
 		}
@@ -728,7 +729,7 @@ func (b *LoginMFABackend) handleMFALoginValidate(ctx context.Context, req *logic
 		return nil, fmt.Errorf("original request was issued in a different namesapce %v, current namespace is %v", cachedResponseAuth.RequestNSPath, ns.Path)
 	}
 
-	entity, _, err := b.Core.fetchEntityAndDerivedPolicies(ctx, ns, cachedResponseAuth.CachedAuth.EntityID, true)
+	entity, err := b.Core.fetchEntity(cachedResponseAuth.CachedAuth.EntityID, true)
 	if err != nil || entity == nil {
 		return nil, fmt.Errorf("MFA validation failed. entity not found: %v", err)
 	}
@@ -743,11 +744,19 @@ func (b *LoginMFABackend) handleMFALoginValidate(ctx context.Context, req *logic
 		return nil, fmt.Errorf("found nil or empty MFAEnforcement configuration")
 	}
 
+	potentialMFASecret := cachedResponseAuth.SelfEnrollmentMFASecret
+
 	for _, eConfig := range matchedMfaEnforcementList {
-		err = b.Core.validateLoginMFA(ctx, eConfig, entity, req.Connection.RemoteAddr, mfaCreds)
+		err = b.Core.validateLoginMFA(ctx, eConfig, entity, req.Connection.RemoteAddr, mfaCreds, potentialMFASecret)
 		if err != nil {
 			return logical.ErrorResponse(fmt.Sprintf("failed to satisfy enforcement %s. error: %s", eConfig.Name, err.Error())), logical.ErrPermissionDenied
 		}
+		if cachedResponseAuth.SelfEnrollmentMFASecret != nil && entity.MFASecrets[potentialMFASecret.MethodID] == nil {
+			err := possiblyForwardPendingLoginMFASecretWrite(ctx, b.Core, entity.ID, potentialMFASecret)
+			if err != nil {
+				return nil, err
+			}
+		}
 	}
 
 	// MFA validation has passed. Let's generate the token
@@ -759,6 +768,46 @@ func (b *LoginMFABackend) handleMFALoginValidate(ctx context.Context, req *logic
 	return resp, nil
 }
 
+// writeTOTPMFASecretAndKey persists the pending TOTP MFA secret on the entity
+// and the key in storage. This method should only be called on the active node
+// of the primary cluster, since it attempts to write to storage. Note that this
+// The identity store lock is not used consistently, so this method also opens a
+// transaction to ensure no modifications happen between fetching it and
+// upserting the entity, to avoid unwittingly clobbering changes to it.
+func (c *Core) writeTOTPMFASecretAndKey(ctx context.Context, entityID string, pendingSecret *selfEnrollmentPendingMFASecret) error {
+	if c.identityStore == nil {
+		return fmt.Errorf("identity store is not configured")
+	}
+	c.identityStore.lock.Lock()
+	defer c.identityStore.lock.Unlock()
+	txn := c.identityStore.db.Txn(true)
+	defer txn.Abort()
+
+	entity, err := c.identityStore.fetchEntityInTxn(txn, entityID, false)
+	if err != nil {
+		return fmt.Errorf("failed to find entity with ID %q: error: %w", entityID, err)
+	}
+	if entity.MFASecrets == nil {
+		entity.MFASecrets = map[string]*mfa.Secret{}
+	}
+
+	entity.MFASecrets[pendingSecret.MethodID] = pendingSecret.Secret
+	_, err = c.identityStore.upsertEntityInTxn(ctx, txn, entity, nil, true, true)
+	if err != nil {
+		c.loginMFABackend.mfaLogger.Error("failed to persist self-enrollment MFA secret in entity", "entity_id", entity.ID)
+		return fmt.Errorf("failed to persist self-enrollment MFA secret in entity: %w", err)
+	}
+	err = c.PersistTOTPKey(ctx, pendingSecret.MethodID, entity.ID, pendingSecret.Key)
+	if err != nil {
+		c.loginMFABackend.mfaLogger.Error("failed to persist self-enrollment MFA secret key in storage", "entity_id", entity.ID)
+		return fmt.Errorf("failed to persist self-enrollment MFA secret key: %w", err)
+	}
+
+	// Commit the transaction to persist the entity changes.
+	txn.Commit()
+	return nil
+}
+
 func (c *Core) teardownLoginMFA() error {
 	if !c.IsDRSecondary() {
 		// Clear any cached auth response
@@ -1272,7 +1321,7 @@ func (b *LoginMFABackend) mfaConfigReadByMethodID(id string) (map[string]interfa
 		return nil, nil
 	}
 
-	return b.mfaConfigToMap(mConfig)
+	return b.mfaConfigToMap(mConfig, constants.IsEnterprise, true)
 }
 
 func (b *LoginMFABackend) mfaMethodList(ctx context.Context, methodType string) ([]string, map[string]interface{}, error) {
@@ -1332,7 +1381,7 @@ func (b *LoginMFABackend) mfaMethodList(ctx context.Context, methodType string)
 		}
 
 		keys = append(keys, config.ID)
-		configInfoEntry, err := b.mfaConfigToMap(config)
+		configInfoEntry, err := b.mfaConfigToMap(config, constants.IsEnterprise, true)
 		if err != nil {
 			return nil, nil, fmt.Errorf("failed to convert config to map: %w", err)
 		}
@@ -1418,7 +1467,11 @@ func (b *LoginMFABackend) mfaLoginEnforcementConfigToMap(eConfig *mfa.MFAEnforce
 	return resp, nil
 }
 
-func (b *MFABackend) mfaConfigToMap(mConfig *mfa.Config) (map[string]interface{}, error) {
+// mfaConfigToMap converts a mfa.Config to a map used for responses to MFA
+// method endpoints. The `isLoginMFA` parameter indicates whether the
+// configuration is for login MFA, which includes additional fields on the
+// shared mfa.Config object for the TOTP type MFA method.
+func (b *MFABackend) mfaConfigToMap(mConfig *mfa.Config, isEnterprise, isLoginMFA bool) (map[string]interface{}, error) {
 	respData := make(map[string]interface{})
 
 	switch mConfig.Config.(type) {
@@ -1432,6 +1485,11 @@ func (b *MFABackend) mfaConfigToMap(mConfig *mfa.Config) (map[string]interface{}
 		respData["qr_size"] = totpConfig.QRSize
 		respData["algorithm"] = otplib.Algorithm(totpConfig.Algorithm).String()
 		respData["max_validation_attempts"] = totpConfig.MaxValidationAttempts
+		if isEnterprise && isLoginMFA {
+			// Login MFA and policy (i.e. enterprise step-up) MFA share the same protobuf message for TOTPConfig,
+			// but the login MFA has an additional field for self-enrollment, which is an enterprise feature.
+			respData["enable_self_enrollment"] = totpConfig.GetEnableSelfEnrollment()
+		}
 	case *mfa.Config_OktaConfig:
 		oktaConfig := mConfig.GetOktaConfig()
 		respData["org_name"] = oktaConfig.OrgName
@@ -1475,7 +1533,12 @@ func (b *MFABackend) mfaConfigToMap(mConfig *mfa.Config) (map[string]interface{}
 	return respData, nil
 }
 
-func parseTOTPConfig(mConfig *mfa.Config, d *framework.FieldData) error {
+// parseTOTPConfig parses the TOTP configuration from the field data and updates the mConfig.
+// The `isEnterprise` parameter indicates whether the configuration is for an enterprise setup,
+// which affects the validation of certain fields like `enable_self_enrollment`.
+// The `isLoginMfa` parameter indicates whether the configuration is for login MFA,
+// which allows for self-enrollment and includes an additional field in the TOTPConfig.
+func parseTOTPConfig(mConfig *mfa.Config, d *framework.FieldData, isEnterprise, isLoginMfa bool) error {
 	if mConfig == nil {
 		return fmt.Errorf("config is nil")
 	}
@@ -1539,6 +1602,17 @@ func parseTOTPConfig(mConfig *mfa.Config, d *framework.FieldData) error {
 		maxValidationAttempt = defaultMaxTOTPValidateAttempts
 	}
 
+	enableSelfEnrollment := false
+	if isLoginMfa {
+		enableSelfEnrollmentRaw, ok := d.GetOk("enable_self_enrollment")
+		if ok {
+			enableSelfEnrollment = enableSelfEnrollmentRaw.(bool)
+		}
+		if !isEnterprise && enableSelfEnrollment {
+			return fmt.Errorf("enable_self_enrollment is an enterprise only feature")
+		}
+
+	}
 	config := &mfa.TOTPConfig{
 		Issuer:                issuer,
 		Period:                uint32(period),
@@ -1548,6 +1622,7 @@ func parseTOTPConfig(mConfig *mfa.Config, d *framework.FieldData) error {
 		KeySize:               uint32(keySize),
 		QRSize:                int32(d.Get("qr_size").(int)),
 		MaxValidationAttempts: uint32(maxValidationAttempt),
+		EnableSelfEnrollment:  enableSelfEnrollment,
 	}
 	mConfig.Config = &mfa.Config_TOTPConfig{
 		TOTPConfig: config,
@@ -1613,7 +1688,7 @@ func parseOktaConfig(mConfig *mfa.Config, d *framework.FieldData) error {
 	return nil
 }
 
-func (c *Core) validateLoginMFA(ctx context.Context, eConfig *mfa.MFAEnforcementConfig, entity *identity.Entity, requestConnRemoteAddr string, mfaCredsMap logical.MFACreds) error {
+func (c *Core) validateLoginMFA(ctx context.Context, eConfig *mfa.MFAEnforcementConfig, entity *identity.Entity, requestConnRemoteAddr string, mfaCredsMap logical.MFACreds, potentialTOTPSecret *selfEnrollmentPendingMFASecret) error {
 	sanitizedMfaCreds, err := c.loginMFABackend.sanitizeMFACredsWithLoginEnforcementMethodIDs(ctx, mfaCredsMap, eConfig.MFAMethodIDs)
 	if err != nil {
 		return fmt.Errorf("failed to sanitize MFA creds, %w", err)
@@ -1631,7 +1706,7 @@ func (c *Core) validateLoginMFA(ctx context.Context, eConfig *mfa.MFAEnforcement
 			continue
 		}
 
-		err := c.validateLoginMFAInternal(ctx, methodID, entity, requestConnRemoteAddr, mfaCreds)
+		err := c.validateLoginMFAInternal(ctx, methodID, entity, requestConnRemoteAddr, mfaCreds, potentialTOTPSecret)
 		if err != nil {
 			retErr = multierror.Append(retErr, err)
 			continue
@@ -1642,7 +1717,7 @@ func (c *Core) validateLoginMFA(ctx context.Context, eConfig *mfa.MFAEnforcement
 	return multierror.Append(retErr, fmt.Errorf("login MFA validation failed for methodID: %v", eConfig.MFAMethodIDs))
 }
 
-func (c *Core) validateLoginMFAInternal(ctx context.Context, methodID string, entity *identity.Entity, reqConnectionRemoteAddress string, mfaCreds []string) (retErr error) {
+func (c *Core) validateLoginMFAInternal(ctx context.Context, methodID string, entity *identity.Entity, reqConnectionRemoteAddress string, mfaCreds []string, potentialTOTPSecret *selfEnrollmentPendingMFASecret) (retErr error) {
 	if entity == nil {
 		return fmt.Errorf("entity is nil")
 	}
@@ -1690,15 +1765,21 @@ func (c *Core) validateLoginMFAInternal(ctx context.Context, methodID string, en
 	switch mConfig.Type {
 	case mfaMethodTypeTOTP:
 		// Get the MFA secret data required to validate the supplied credentials
-		if entity.MFASecrets == nil {
-			return fmt.Errorf("MFA secret for method ID %q not present in entity %q", mConfig.ID, entity.ID)
-		}
-		entityMFASecret := entity.MFASecrets[mConfig.ID]
-		if entityMFASecret == nil {
-			return fmt.Errorf("MFA secret for method name %q not present in entity %q", mConfig.Name, entity.ID)
+		var entityMFASecret *mfa.Secret
+		var mfaSecretKey string
+		switch {
+		case entity.MFASecrets != nil && entity.MFASecrets[mConfig.ID] != nil:
+			// Use the existing secret stored on the entity
+			entityMFASecret = entity.MFASecrets[mConfig.ID]
+		case (entity.MFASecrets == nil || entity.MFASecrets[mConfig.ID] == nil) && potentialTOTPSecret != nil &&
+			potentialTOTPSecret.MethodID == methodID && potentialTOTPSecret.Secret != nil && potentialTOTPSecret.Key != "":
+			// Use the self-enrollment secret generated during this login request
+			entityMFASecret = potentialTOTPSecret.Secret
+			mfaSecretKey = potentialTOTPSecret.Key
+		default:
+			return fmt.Errorf("MFA secret for method ID %q not present in entity %q or cached MFA auth response", mConfig.ID, entity.ID)
 		}
-
-		return c.validateTOTP(ctx, mfaFactors, entityMFASecret, mConfig.ID, entity.ID, c.loginMFABackend.usedCodes, mConfig.GetTOTPConfig().MaxValidationAttempts)
+		return c.validateTOTP(ctx, mfaFactors, entityMFASecret, mConfig.ID, entity.ID, c.loginMFABackend.usedCodes, mConfig.GetTOTPConfig().MaxValidationAttempts, mfaSecretKey)
 
 	case mfaMethodTypeOkta:
 		return c.validateOkta(ctx, mConfig, finalUsername)
@@ -1740,7 +1821,7 @@ ECONFIG_LOOP:
 		// i.e. is it the req's ns or an ancestor of req's ns?
 		eConfigNS, err := c.NamespaceByID(ctx, eConfig.NamespaceID)
 		if err != nil {
-			return nil, fmt.Errorf("failed to find the MFAEnforcementConfig namespace")
+			return nil, fmt.Errorf("failed to find the MFAEnforcementConfig namespace: %w", err)
 		}
 
 		if eConfig == nil || eConfigNS == nil || (eConfigNS.ID != ns.ID && !ns.HasParent(eConfigNS)) {
@@ -1908,9 +1989,9 @@ func (c *Core) validateDuo(ctx context.Context, mfaFactors *MFAFactor, mConfig *
 	case "allow":
 		return nil
 	case "deny":
-		return fmt.Errorf(preauth.Response.Status_Msg)
+		return errors.New(preauth.Response.Status_Msg)
 	case "enroll":
-		return fmt.Errorf(fmt.Sprintf("%q - %q", preauth.Response.Status_Msg, preauth.Response.Enroll_Portal_Url))
+		return fmt.Errorf("%q - %q", preauth.Response.Status_Msg, preauth.Response.Enroll_Portal_Url)
 	case "auth":
 		break
 	default:
@@ -1990,7 +2071,7 @@ func (c *Core) validateOkta(ctx context.Context, mConfig *mfa.Config, username s
 		return err
 	}
 
-	ctx, client, err := okta.NewClient(ctx,
+	cfg, err := okta.NewConfiguration(
 		okta.WithToken(oktaConfig.APIToken),
 		okta.WithOrgUrl(orgURL.String()),
 		// Do not use cache or polling MFA will not refresh
@@ -1999,15 +2080,15 @@ func (c *Core) validateOkta(ctx context.Context, mConfig *mfa.Config, username s
 	if err != nil {
 		return fmt.Errorf("error creating client: %s", err)
 	}
+	client := okta.NewAPIClient(cfg)
 
 	filterField := "profile.login"
 	if oktaConfig.PrimaryEmail {
 		filterField = "profile.email"
 	}
 	filterQuery := fmt.Sprintf("%s eq %q", filterField, username)
-	filter := query.NewQueryParams(query.WithFilter(filterQuery))
 
-	users, _, err := client.User.ListUsers(ctx, filter)
+	users, _, err := client.UserAPI.ListUsers(client.GetConfig().Context).Filter(filterQuery).Execute()
 	if err != nil {
 		return err
 	}
@@ -2020,7 +2101,7 @@ func (c *Core) validateOkta(ctx context.Context, mConfig *mfa.Config, username s
 
 	user := users[0]
 
-	factors, _, err := client.UserFactor.ListFactors(ctx, user.Id)
+	factors, _, err := client.UserFactorAPI.ListFactors(ctx, user.GetId()).Execute()
 	if err != nil {
 		return err
 	}
@@ -2030,14 +2111,12 @@ func (c *Core) validateOkta(ctx context.Context, mConfig *mfa.Config, username s
 	}
 
 	var factorFound bool
-	var userFactor *okta.UserFactor
+	var userFactor *okta.UserFactorPush
 	for _, factor := range factors {
-		if factor.IsUserFactorInstance() {
-			userFactor = factor.(*okta.UserFactor)
-			if userFactor.FactorType == "push" {
-				factorFound = true
-				break
-			}
+		if factor.UserFactorPush != nil {
+			userFactor = factor.UserFactorPush
+			factorFound = true
+			break
 		}
 	}
 
@@ -2045,13 +2124,13 @@ func (c *Core) validateOkta(ctx context.Context, mConfig *mfa.Config, username s
 		return fmt.Errorf("no push-type MFA factor found for user")
 	}
 
-	result, _, err := client.UserFactor.VerifyFactor(ctx, user.Id, userFactor.Id, okta.VerifyFactorRequest{}, userFactor, nil)
+	result, _, err := client.UserFactorAPI.VerifyFactor(ctx, user.GetId(), userFactor.GetId()).Execute()
 	if err != nil {
 		return err
 	}
 
-	if result.FactorResult != "WAITING" {
-		return fmt.Errorf("expected WAITING status for push status, got %q", result.FactorResult)
+	if result.GetFactorResult() != "WAITING" {
+		return fmt.Errorf("expected WAITING status for push status, got %q", result.GetFactorResult())
 	}
 
 	// Parse links to get polling link
@@ -2070,27 +2149,33 @@ func (c *Core) validateOkta(ctx context.Context, mConfig *mfa.Config, username s
 		return err
 	}
 
+	// Okta doesn't return the transactionID as a parameter in the response, but it's encoded in the URL
+	// this approach comes from: https://github.com/okta/okta-sdk-golang/issues/300, but it's not ideal.
+	// It is, however, what the dotnet library by Okta themselves does.
+	txRx := regexp.MustCompile("^.*/transactions/(.*)$")
+	matches := txRx.FindStringSubmatch(url.Path)
+	if len(matches) != 2 {
+		return fmt.Errorf("couldn't determine transaction id from url")
+	}
+	transactionID := matches[1]
+
+	// poll verifyfactor until termination (e.g., the user responds to the push factor)
 	for {
-		// Okta provides an SDK method `GetFactorTransactionStatus` but does not provide the transaction id in
-		// the VerifyFactor respone. This code effectively reimplements that method.
-		rq := client.CloneRequestExecutor()
-		req, err := rq.WithAccept("application/json").WithContentType("application/json").NewRequest("GET", url.String(), nil)
-		if err != nil {
-			return err
-		}
-		var result *okta.VerifyUserFactorResponse
-		_, err = rq.Do(ctx, req, &result)
+		result, _, err := client.UserFactorAPI.GetFactorTransactionStatus(client.GetConfig().Context, user.GetId(), userFactor.GetId(), transactionID).Execute()
 		if err != nil {
 			return err
 		}
 
-		switch result.FactorResult {
-		case "WAITING":
-		case "SUCCESS":
+		// the transaction status returns an inner object set based on what the factor status is.
+		// the other ones are nil. This is (probably) because the structure of the returned JSON
+		// varies based on what the factor status is.
+		switch {
+		case result.UserFactorPushTransactionWaiting != nil:
+		case result.UserFactorPushTransaction != nil:
 			return nil
-		case "REJECTED":
+		case result.UserFactorPushTransactionRejected != nil:
 			return fmt.Errorf("push verification explicitly rejected")
-		case "TIMEOUT":
+		case result.UserFactorPushTransactionTimeout != nil:
 			return fmt.Errorf("push verification timed out")
 		default:
 			return fmt.Errorf("unknown status code")
@@ -2159,7 +2244,7 @@ func (c *Core) validatePingID(ctx context.Context, mConfig *mfa.Config, username
 		req = req.WithContext(ctx)
 		req.Method = "POST"
 		req.URL = reqURL
-		req.Body = ioutil.NopCloser(bytes.NewBufferString(signedToken))
+		req.Body = io.NopCloser(bytes.NewBufferString(signedToken))
 		if req.Header == nil {
 			req.Header = make(http.Header)
 		}
@@ -2317,7 +2402,7 @@ func (c *Core) validatePingID(ctx context.Context, mConfig *mfa.Config, username
 	return nil
 }
 
-func (c *Core) validateTOTP(ctx context.Context, mfaFactors *MFAFactor, entityMethodSecret *mfa.Secret, configID, entityID string, usedCodes *cache.Cache, maximumValidationAttempts uint32) error {
+func (c *Core) validateTOTP(ctx context.Context, mfaFactors *MFAFactor, entityMethodSecret *mfa.Secret, configID, entityID string, usedCodes *cache.Cache, maximumValidationAttempts uint32, key string) error {
 	if mfaFactors == nil || mfaFactors.passcode == "" {
 		return fmt.Errorf("MFA credentials not supplied")
 	}
@@ -2328,15 +2413,19 @@ func (c *Core) validateTOTP(ctx context.Context, mfaFactors *MFAFactor, entityMe
 		return fmt.Errorf("entity does not contain the TOTP secret")
 	}
 
+	if len(passcode) != int(totpSecret.GetDigits()) {
+		return fmt.Errorf("failed to validate TOTP passcode")
+	}
+
 	usedName := fmt.Sprintf("%s_%s", configID, passcode)
 
 	_, ok := usedCodes.Get(usedName)
 	if ok {
-		return fmt.Errorf("code already used; new code is available in %v seconds", totpSecret.Period)
+		return fmt.Errorf("failed to validate TOTP passcode")
 	}
 
-	// The duration in which a passcode is stored in cache to enforce
-	// rate limit on failed totp passcode validation
+	// The duration in which a rateLimitID (configID_entityID) is used to limit the number of TOTP validation attempts.
+	// The passcode will be added to the usedCodes cache later, with a different TTL, with the skew and period.
 	passcodeTTL := time.Duration(int64(time.Second) * int64(totpSecret.Period))
 
 	// Enforcing rate limit per MethodID per EntityID
@@ -2359,13 +2448,15 @@ func (c *Core) validateTOTP(ctx context.Context, mfaFactors *MFAFactor, entityMe
 		}
 	}
 
-	key, err := c.fetchTOTPKey(ctx, configID, entityID)
-	if err != nil {
-		return errwrap.Wrapf("error fetching TOTP key: {{err}}", err)
-	}
-
 	if key == "" {
-		return fmt.Errorf("empty key for entity's TOTP secret")
+		var err error
+		key, err = c.fetchTOTPKey(ctx, configID, entityID)
+		if err != nil {
+			return fmt.Errorf("error fetching TOTP key: %w", err)
+		}
+		if key == "" {
+			return fmt.Errorf("empty key for entity's TOTP secret")
+		}
 	}
 
 	validateOpts := totplib.ValidateOpts{
@@ -2653,6 +2744,31 @@ func (b *LoginMFABackend) MemDBMFALoginEnforcementConfigByNameAndNamespace(name,
 	return eConfig.Clone()
 }
 
+func (b *LoginMFABackend) MemDBMFALoginEnforcementConfigByID(id string) (*mfa.MFAEnforcementConfig, error) {
+	if id == "" {
+		return nil, fmt.Errorf("missing config id")
+	}
+
+	txn := b.db.Txn(false)
+	defer txn.Abort()
+
+	eConfigRaw, err := txn.First(memDBMFALoginEnforcementsTable, "id", id)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch MFA login enforcement config from memdb using id: %w", err)
+	}
+
+	if eConfigRaw == nil {
+		return nil, nil
+	}
+
+	eConfig, ok := eConfigRaw.(*mfa.MFAEnforcementConfig)
+	if !ok {
+		return nil, fmt.Errorf("invalid type for MFA login enforcement config in memdb")
+	}
+
+	return eConfig.Clone()
+}
+
 func (b *LoginMFABackend) MemDBMFALoginEnforcementConfigIterator() (memdb.ResultIterator, error) {
 	txn := b.db.Txn(false)
 	defer txn.Abort()
@@ -2710,6 +2826,32 @@ func (b *LoginMFABackend) deleteMFALoginEnforcementConfigByNameAndNamespace(ctx
 	return nil
 }
 
+func (b *LoginMFABackend) MemDBDeleteMFALoginEnforcementConfigByID(id string) error {
+	if id == "" {
+		return nil
+	}
+
+	txn := b.db.Txn(true)
+	defer txn.Abort()
+
+	eConfig, err := b.MemDBMFALoginEnforcementConfigByID(id)
+	if err != nil {
+		return err
+	}
+
+	if eConfig == nil {
+		return nil
+	}
+
+	err = txn.Delete(memDBMFALoginEnforcementsTable, eConfig)
+	if err != nil {
+		return err
+	}
+
+	txn.Commit()
+	return nil
+}
+
 func (b *LoginMFABackend) MemDBDeleteMFALoginEnforcementConfigByNameAndNamespace(name, namespaceId, tableName string) error {
 	if name == "" || namespaceId == "" {
 		return nil
diff --git a/vault/login_mfa_ce.go b/vault/login_mfa_ce.go
new file mode 100644
index 00000000000..209e3eb4d89
--- /dev/null
+++ b/vault/login_mfa_ce.go
@@ -0,0 +1,15 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"context"
+)
+
+// possiblyForwardPendingLoginMFASecretWrite attempts to persist the pending MFA secret and key to storage.
+func possiblyForwardPendingLoginMFASecretWrite(ctx context.Context, c *Core, entityID string, pendingSecret *selfEnrollmentPendingMFASecret) error {
+	return c.writeTOTPMFASecretAndKey(ctx, entityID, pendingSecret)
+}
diff --git a/vault/login_mfa_test.go b/vault/login_mfa_test.go
index 1b4244003c0..5b200daedb5 100644
--- a/vault/login_mfa_test.go
+++ b/vault/login_mfa_test.go
@@ -1,11 +1,19 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
+	"context"
 	"strings"
 	"testing"
+
+	"github.com/hashicorp/vault/helper/identity/mfa"
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/sdk/framework"
+	otplib "github.com/pquerna/otp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestParseFactors(t *testing.T) {
@@ -62,3 +70,544 @@ func TestParseFactors(t *testing.T) {
 		})
 	}
 }
+
+// TestMFAConfigToMap verifies that different MFA method configurations (TOTP,
+// Okta, Duo, PingID) are correctly converted to a map format for API
+// responses. The test covers both login MFA and policy MFA scenarios, since
+// these share objects/protobufs, but can have slightly different responses.
+func TestMFAConfigToMap(t *testing.T) {
+	testCases := map[string]struct {
+		config         *mfa.Config
+		expectedResult map[string]any
+		isEnterprise   bool
+		isLoginMFA     bool
+	}{
+		"totp-with-login-mfa": {
+			config: &mfa.Config{
+				Type: mfaMethodTypeTOTP,
+				Config: &mfa.Config_TOTPConfig{
+					TOTPConfig: &mfa.TOTPConfig{
+						Issuer:                "TestIssuer",
+						Period:                30,
+						Digits:                6,
+						Skew:                  1,
+						KeySize:               20,
+						QRSize:                200,
+						Algorithm:             int32(otplib.AlgorithmSHA1),
+						MaxValidationAttempts: 5,
+						EnableSelfEnrollment:  true,
+					},
+				},
+			},
+			expectedResult: map[string]interface{}{
+				"algorithm":               "SHA1",
+				"digits":                  int32(6),
+				"enable_self_enrollment":  true,
+				"id":                      "",
+				"issuer":                  "TestIssuer",
+				"key_size":                uint32(20),
+				"max_validation_attempts": uint32(5),
+				"name":                    "",
+				"namespace_id":            "",
+				"namespace_path":          "/",
+				"period":                  uint32(30),
+				"qr_size":                 int32(200),
+				"skew":                    uint32(1),
+				"type":                    "totp",
+			},
+			isEnterprise: true,
+			isLoginMFA:   true,
+		},
+		"totp-with-login-mfa-non-ent": {
+			config: &mfa.Config{
+				Type: mfaMethodTypeTOTP,
+				Config: &mfa.Config_TOTPConfig{
+					TOTPConfig: &mfa.TOTPConfig{
+						Issuer:                "TestIssuer",
+						Period:                30,
+						Digits:                6,
+						Skew:                  1,
+						KeySize:               20,
+						QRSize:                200,
+						Algorithm:             int32(otplib.AlgorithmSHA1),
+						MaxValidationAttempts: 5,
+						EnableSelfEnrollment:  true,
+					},
+				},
+			},
+			expectedResult: map[string]interface{}{
+				"algorithm":               "SHA1",
+				"digits":                  int32(6),
+				"id":                      "",
+				"issuer":                  "TestIssuer",
+				"key_size":                uint32(20),
+				"max_validation_attempts": uint32(5),
+				"name":                    "",
+				"namespace_id":            "",
+				"namespace_path":          "/",
+				"period":                  uint32(30),
+				"qr_size":                 int32(200),
+				"skew":                    uint32(1),
+				"type":                    "totp",
+			},
+			isEnterprise: false,
+			isLoginMFA:   true,
+		},
+		"totp-ent-step-up-mfa-self-enrollment-false": {
+			config: &mfa.Config{
+				Type: mfaMethodTypeTOTP,
+				Config: &mfa.Config_TOTPConfig{
+					TOTPConfig: &mfa.TOTPConfig{
+						Issuer:                "TestIssuer",
+						Period:                30,
+						Digits:                6,
+						Skew:                  1,
+						KeySize:               20,
+						QRSize:                200,
+						Algorithm:             int32(otplib.AlgorithmSHA1),
+						MaxValidationAttempts: 5,
+						EnableSelfEnrollment:  false,
+					},
+				},
+			},
+			expectedResult: map[string]interface{}{
+				"algorithm":               "SHA1",
+				"digits":                  int32(6),
+				"id":                      "",
+				"issuer":                  "TestIssuer",
+				"key_size":                uint32(20),
+				"max_validation_attempts": uint32(5),
+				"name":                    "",
+				"namespace_id":            "",
+				"namespace_path":          "/",
+				"period":                  uint32(30),
+				"qr_size":                 int32(200),
+				"skew":                    uint32(1),
+				"type":                    "totp",
+			},
+			isEnterprise: true,
+			isLoginMFA:   false,
+		},
+		"totp-ent-step-up-mfa-self-enrollment-true": {
+			config: &mfa.Config{
+				Type: mfaMethodTypeTOTP,
+				Config: &mfa.Config_TOTPConfig{
+					TOTPConfig: &mfa.TOTPConfig{
+						Issuer:                "TestIssuer",
+						Period:                30,
+						Digits:                6,
+						Skew:                  1,
+						KeySize:               20,
+						QRSize:                200,
+						Algorithm:             int32(otplib.AlgorithmSHA1),
+						MaxValidationAttempts: 5,
+						EnableSelfEnrollment:  true,
+					},
+				},
+			},
+			expectedResult: map[string]interface{}{
+				"algorithm":               "SHA1",
+				"digits":                  int32(6),
+				"id":                      "",
+				"issuer":                  "TestIssuer",
+				"key_size":                uint32(20),
+				"max_validation_attempts": uint32(5),
+				"name":                    "",
+				"namespace_id":            "",
+				"namespace_path":          "/",
+				"period":                  uint32(30),
+				"qr_size":                 int32(200),
+				"skew":                    uint32(1),
+				"type":                    "totp",
+			},
+			isEnterprise: true,
+			isLoginMFA:   false,
+		},
+		"okta-prod": {
+			config: &mfa.Config{
+				Type: mfaMethodTypeOkta,
+				Config: &mfa.Config_OktaConfig{
+					OktaConfig: &mfa.OktaConfig{
+						OrgName:      "TestOrg",
+						APIToken:     "test-token",
+						PrimaryEmail: true,
+						Production:   true,
+					},
+				},
+			},
+			expectedResult: map[string]interface{}{
+				"production":      true,
+				"id":              "",
+				"mount_accessor":  "",
+				"name":            "",
+				"namespace_id":    "",
+				"namespace_path":  "/",
+				"org_name":        "TestOrg",
+				"type":            "okta",
+				"username_format": "",
+			},
+		},
+		"okta-non-prod": {
+			config: &mfa.Config{
+				Type: mfaMethodTypeOkta,
+				Config: &mfa.Config_OktaConfig{
+					OktaConfig: &mfa.OktaConfig{
+						OrgName:      "TestOrg",
+						APIToken:     "test-token",
+						BaseURL:      "https://test.okta.com",
+						PrimaryEmail: true,
+					},
+				},
+			},
+			expectedResult: map[string]interface{}{
+				"base_url":        "https://test.okta.com",
+				"id":              "",
+				"mount_accessor":  "",
+				"name":            "",
+				"namespace_id":    "",
+				"namespace_path":  "/",
+				"org_name":        "TestOrg",
+				"type":            "okta",
+				"username_format": "",
+			},
+		},
+		"duo": {
+			config: &mfa.Config{
+				Type: mfaMethodTypeDuo,
+				Config: &mfa.Config_DuoConfig{
+					DuoConfig: &mfa.DuoConfig{
+						APIHostname:    "api.duo.com",
+						IntegrationKey: "integration-key",
+						SecretKey:      "secret-key",
+						PushInfo:       "push-info",
+						UsePasscode:    true,
+					},
+				},
+			},
+			expectedResult: map[string]interface{}{
+				"api_hostname":    "api.duo.com",
+				"pushinfo":        "push-info",
+				"mount_accessor":  "",
+				"username_format": "",
+				"use_passcode":    true,
+				"type":            "duo",
+				"id":              "",
+				"name":            "",
+				"namespace_id":    "",
+				"namespace_path":  "/",
+			},
+		},
+		"ping-id": {
+			config: &mfa.Config{
+				Type: mfaMethodTypePingID,
+				Config: &mfa.Config_PingIDConfig{
+					PingIDConfig: &mfa.PingIDConfig{
+						UseSignature:     true,
+						IDPURL:           "https://idp.pingid.com",
+						OrgAlias:         "org-alias",
+						AdminURL:         "https://admin.pingid.com",
+						AuthenticatorURL: "https://authenticator.pingid.com",
+					},
+				},
+			},
+			expectedResult: map[string]interface{}{
+				"use_signature":     true,
+				"idp_url":           "https://idp.pingid.com",
+				"org_alias":         "org-alias",
+				"admin_url":         "https://admin.pingid.com",
+				"authenticator_url": "https://authenticator.pingid.com",
+				"type":              "pingid",
+				"id":                "",
+				"name":              "",
+				"namespace_id":      "",
+				"namespace_path":    "/",
+			},
+		},
+	}
+	backend := &MFABackend{}
+	backend.namespacer = &MockNamespacer{}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			actualResult, err := backend.mfaConfigToMap(tc.config, tc.isEnterprise, tc.isLoginMFA)
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedResult, actualResult)
+		})
+	}
+}
+
+// TestMfaConfigToMap_InvalidType validates that mfaConfigToMap returns an error
+// when the method type is not recognized.
+func TestMfaConfigToMap_InvalidType(t *testing.T) {
+	backend := &MFABackend{}
+	mConfig := &mfa.Config{
+		Type:   "invalid-type",
+		Config: nil,
+	}
+
+	_, err := backend.mfaConfigToMap(mConfig, true, true)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "invalid method type")
+}
+
+// TestParseTOTPConfig validates that the parseTOTPConfig function returns the
+// expected self-enrollment value given various combinations of isEnterprise and
+// isLoginMFA inputs.
+func TestParseTOTPConfig(t *testing.T) {
+	testCases := map[string]struct {
+		isEnterprise   bool
+		isLoginMFA     bool
+		expectedResult *mfa.TOTPConfig
+		wantErr        bool
+	}{
+		"login-mfa-ent": {
+			isEnterprise: true,
+			isLoginMFA:   true,
+			expectedResult: &mfa.TOTPConfig{
+				Issuer:                "TestIssuer",
+				Period:                30,
+				Digits:                6,
+				Skew:                  1,
+				KeySize:               20,
+				QRSize:                200,
+				Algorithm:             int32(otplib.AlgorithmSHA1),
+				MaxValidationAttempts: 5,
+				EnableSelfEnrollment:  true,
+			},
+		},
+		"login-mfa-ce": {
+			isEnterprise:   false,
+			isLoginMFA:     true,
+			expectedResult: &mfa.TOTPConfig{},
+			wantErr:        true,
+		},
+		"step-up-mfa-ent": {
+			isEnterprise: true,
+			isLoginMFA:   false,
+			expectedResult: &mfa.TOTPConfig{
+				Issuer:                "TestIssuer",
+				Period:                30,
+				Digits:                6,
+				Skew:                  1,
+				KeySize:               20,
+				QRSize:                200,
+				Algorithm:             int32(otplib.AlgorithmSHA1),
+				MaxValidationAttempts: 5,
+				EnableSelfEnrollment:  false,
+			},
+		},
+		"step-up-mfa-ce": {
+			isEnterprise: false,
+			isLoginMFA:   false,
+			expectedResult: &mfa.TOTPConfig{
+				Issuer:                "TestIssuer",
+				Period:                30,
+				Digits:                6,
+				Skew:                  1,
+				KeySize:               20,
+				QRSize:                200,
+				Algorithm:             int32(otplib.AlgorithmSHA1),
+				MaxValidationAttempts: 5,
+				EnableSelfEnrollment:  false,
+			},
+			wantErr: false,
+		},
+	}
+
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			rawData := map[string]interface{}{
+				"algorithm":               "SHA1",
+				"digits":                  6,
+				"period":                  30,
+				"skew":                    1,
+				"key_size":                20,
+				"issuer":                  "TestIssuer",
+				"max_validation_attempts": 5,
+				"enable_self_enrollment":  true,
+				"qr_size":                 200,
+			}
+			config := &mfa.Config{}
+			schema := mfaTOTPPaths(&IdentityStore{})[0].Fields
+			data := &framework.FieldData{
+				Raw:    rawData,
+				Schema: schema,
+			}
+			err := parseTOTPConfig(config, data, tc.isEnterprise, tc.isLoginMFA)
+			if tc.wantErr {
+				require.Error(t, err)
+				require.Nil(t, config.Config)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tc.expectedResult, config.Config.(*mfa.Config_TOTPConfig).TOTPConfig)
+			}
+		})
+	}
+}
+
+// TestParseTOTPConfig_UnhappyPaths tests various error scenarios for the
+// parseTOTPConfig function.
+func TestParseTOTPConfig_UnhappyPaths(t *testing.T) {
+	testCases := map[string]struct {
+		config         *mfa.Config
+		data           *framework.FieldData
+		expectedErrMsg string
+	}{
+		"nil-config": {
+			config:         nil,
+			data:           nil,
+			expectedErrMsg: "config is nil",
+		},
+		"nil-field-data": {
+			config:         &mfa.Config{},
+			data:           nil,
+			expectedErrMsg: "field data is nil",
+		},
+		"invalid-algorithm": {
+			config: &mfa.Config{},
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"algorithm":               "SHA007",
+					"digits":                  6,
+					"period":                  30,
+					"skew":                    1,
+					"key_size":                20,
+					"issuer":                  "TestIssuer",
+					"max_validation_attempts": 5,
+					"enable_self_enrollment":  true,
+					"qr_size":                 200,
+				},
+				Schema: mfaTOTPPaths(&IdentityStore{})[0].Fields,
+			},
+			expectedErrMsg: "unrecognized algorithm",
+		},
+		"invalid-digits": {
+			config: &mfa.Config{},
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"algorithm":               "SHA1",
+					"digits":                  7, // Invalid value, should be 6 or 8
+					"period":                  30,
+					"skew":                    1,
+					"key_size":                20,
+					"issuer":                  "TestIssuer",
+					"max_validation_attempts": 5,
+					"enable_self_enrollment":  true,
+					"qr_size":                 200,
+				},
+				Schema: mfaTOTPPaths(&IdentityStore{})[0].Fields,
+			},
+			expectedErrMsg: "digits can only be 6 or 8",
+		},
+		"invalid-period": {
+			config: &mfa.Config{},
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"algorithm":               "SHA1",
+					"digits":                  6,
+					"period":                  0, // Invalid value, should be positive
+					"skew":                    1,
+					"key_size":                20,
+					"issuer":                  "TestIssuer",
+					"max_validation_attempts": 5,
+					"enable_self_enrollment":  true,
+					"qr_size":                 200,
+				},
+				Schema: mfaTOTPPaths(&IdentityStore{})[0].Fields,
+			},
+			expectedErrMsg: "period must be greater than zero",
+		},
+		"invalid-skew": {
+			config: &mfa.Config{},
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"algorithm":               "SHA1",
+					"digits":                  6,
+					"period":                  30,
+					"skew":                    2, // Invalid value, should be 0 or 1
+					"key_size":                20,
+					"issuer":                  "TestIssuer",
+					"max_validation_attempts": 5,
+					"enable_self_enrollment":  true,
+					"qr_size":                 200,
+				},
+				Schema: mfaTOTPPaths(&IdentityStore{})[0].Fields,
+			},
+			expectedErrMsg: "skew must be 0 or 1",
+		},
+		"invalid-key-size": {
+			config: &mfa.Config{},
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"algorithm":               "SHA1",
+					"digits":                  6,
+					"period":                  30,
+					"skew":                    1,
+					"key_size":                0, // Invalid value, should be positive
+					"issuer":                  "TestIssuer",
+					"max_validation_attempts": 5,
+					"enable_self_enrollment":  true,
+					"qr_size":                 200,
+				},
+				Schema: mfaTOTPPaths(&IdentityStore{})[0].Fields,
+			},
+			expectedErrMsg: "key_size must be greater than zero",
+		},
+		"invalid-issuer": {
+			config: &mfa.Config{},
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"algorithm":               "SHA1",
+					"digits":                  6,
+					"period":                  30,
+					"skew":                    1,
+					"key_size":                20,
+					"issuer":                  "", // Invalid value, should not be empty
+					"max_validation_attempts": 5,
+					"enable_self_enrollment":  true,
+					"qr_size":                 200,
+				},
+				Schema: mfaTOTPPaths(&IdentityStore{})[0].Fields,
+			},
+			expectedErrMsg: "issuer must be set",
+		},
+		"invalid-max-validation-attempts": {
+			config: &mfa.Config{},
+			data: &framework.FieldData{
+				Raw: map[string]interface{}{
+					"algorithm":               "SHA1",
+					"digits":                  6,
+					"period":                  30,
+					"skew":                    1,
+					"key_size":                20,
+					"issuer":                  "TestIssuer",
+					"max_validation_attempts": -1, // Invalid value, should be greater than zero
+					"enable_self_enrollment":  true,
+					"qr_size":                 200,
+				},
+				Schema: mfaTOTPPaths(&IdentityStore{})[0].Fields,
+			},
+			expectedErrMsg: "max_validation_attempts must be greater than zero",
+		},
+	}
+	for name, tc := range testCases {
+		t.Run(name, func(t *testing.T) {
+			err := parseTOTPConfig(tc.config, tc.data, true, true)
+			require.Error(t, err)
+			require.ErrorContains(t, err, tc.expectedErrMsg)
+		})
+	}
+}
+
+// MockNamespacer is a mock implementation of the Namespacer interface for testing purposes.
+type MockNamespacer struct {
+	Namespacer
+}
+
+// NamespaceByID returns a namespace with the same ID as the passed argument and with a path of `/`.
+func (m *MockNamespacer) NamespaceByID(ctx context.Context, id string) (*namespace.Namespace, error) {
+	return &namespace.Namespace{
+		ID:   id,
+		Path: "/",
+	}, nil
+}
diff --git a/vault/managed_key_registry.go b/vault/managed_key_registry.go
index 5beb2edabc6..ce8228f2293 100644
--- a/vault/managed_key_registry.go
+++ b/vault/managed_key_registry.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/mfa_auth_resp_priority_queue.go b/vault/mfa_auth_resp_priority_queue.go
index a2119dffcaf..21f760775e8 100644
--- a/vault/mfa_auth_resp_priority_queue.go
+++ b/vault/mfa_auth_resp_priority_queue.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/mfa_auth_resp_priority_queue_test.go b/vault/mfa_auth_resp_priority_queue_test.go
index 61274aeccd3..376e9ac188b 100644
--- a/vault/mfa_auth_resp_priority_queue_test.go
+++ b/vault/mfa_auth_resp_priority_queue_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/mount.go b/vault/mount.go
index bc619369296..b7ac1fd8af6 100644
--- a/vault/mount.go
+++ b/vault/mount.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -20,11 +20,13 @@ import (
 	"github.com/hashicorp/vault/builtin/plugin"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/pluginconsts"
 	"github.com/hashicorp/vault/helper/versions"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/vault/observations"
 	"github.com/hashicorp/vault/vault/plugincatalog"
 	"github.com/mitchellh/copystructure"
 )
@@ -52,6 +54,11 @@ const (
 	mountTableType = "mounts"
 )
 
+func init() {
+	// Register the keys we use for mount tables
+	registerMountOrNamespaceTablePaths(coreMountConfigPath, coreLocalMountConfigPath)
+}
+
 // ListingVisibilityType represents the types for listing visibility
 type ListingVisibilityType string
 
@@ -70,12 +77,14 @@ const (
 	mountTypeSystem      = "system"
 	mountTypeNSSystem    = "ns_system"
 	mountTypeIdentity    = "identity"
+	mountTypeNSIdentity  = "ns_identity"
 	mountTypeCubbyhole   = "cubbyhole"
 	mountTypePlugin      = "plugin"
 	mountTypeKV          = "kv"
 	mountTypeNSCubbyhole = "ns_cubbyhole"
 	mountTypeToken       = "token"
 	mountTypeNSToken     = "ns_token"
+	mountTypeDatabase    = "database"
 
 	MountTableUpdateStorage   = true
 	MountTableNoUpdateStorage = false
@@ -105,7 +114,6 @@ var (
 		mountPathCubbyhole,
 		mountPathSystem,
 		"audit/",
-		mountPathIdentity,
 	}
 
 	// singletonMounts can only exist in one location and are
@@ -144,26 +152,16 @@ type MountTable struct {
 	Entries []*MountEntry `json:"entries"`
 }
 
+//go:generate enumer -type=MountMigrationStatus -trimprefix=MigrationStatus -transform=kebab
+
 type MountMigrationStatus int
 
 const (
-	MigrationInProgressStatus MountMigrationStatus = iota
-	MigrationSuccessStatus
-	MigrationFailureStatus
+	MigrationStatusInProgress MountMigrationStatus = iota
+	MigrationStatusSuccess
+	MigrationStatusFailure
 )
 
-func (m MountMigrationStatus) String() string {
-	switch m {
-	case MigrationInProgressStatus:
-		return "in-progress"
-	case MigrationSuccessStatus:
-		return "success"
-	case MigrationFailureStatus:
-		return "failure"
-	}
-	return "unknown"
-}
-
 type MountMigrationInfo struct {
 	SourceMount     string `json:"source_mount"`
 	TargetMount     string `json:"target_mount"`
@@ -355,19 +353,20 @@ type MountEntry struct {
 
 // MountConfig is used to hold settable options
 type MountConfig struct {
-	DefaultLeaseTTL           time.Duration         `json:"default_lease_ttl,omitempty" structs:"default_lease_ttl" mapstructure:"default_lease_ttl"` // Override for global default
-	MaxLeaseTTL               time.Duration         `json:"max_lease_ttl,omitempty" structs:"max_lease_ttl" mapstructure:"max_lease_ttl"`             // Override for global default
-	ForceNoCache              bool                  `json:"force_no_cache,omitempty" structs:"force_no_cache" mapstructure:"force_no_cache"`          // Override for global default
-	AuditNonHMACRequestKeys   []string              `json:"audit_non_hmac_request_keys,omitempty" structs:"audit_non_hmac_request_keys" mapstructure:"audit_non_hmac_request_keys"`
-	AuditNonHMACResponseKeys  []string              `json:"audit_non_hmac_response_keys,omitempty" structs:"audit_non_hmac_response_keys" mapstructure:"audit_non_hmac_response_keys"`
-	ListingVisibility         ListingVisibilityType `json:"listing_visibility,omitempty" structs:"listing_visibility" mapstructure:"listing_visibility"`
-	PassthroughRequestHeaders []string              `json:"passthrough_request_headers,omitempty" structs:"passthrough_request_headers" mapstructure:"passthrough_request_headers"`
-	AllowedResponseHeaders    []string              `json:"allowed_response_headers,omitempty" structs:"allowed_response_headers" mapstructure:"allowed_response_headers"`
-	TokenType                 logical.TokenType     `json:"token_type,omitempty" structs:"token_type" mapstructure:"token_type"`
-	AllowedManagedKeys        []string              `json:"allowed_managed_keys,omitempty" mapstructure:"allowed_managed_keys"`
-	UserLockoutConfig         *UserLockoutConfig    `json:"user_lockout_config,omitempty" mapstructure:"user_lockout_config"`
-	DelegatedAuthAccessors    []string              `json:"delegated_auth_accessors,omitempty" mapstructure:"delegated_auth_accessors"`
-	IdentityTokenKey          string                `json:"identity_token_key,omitempty" mapstructure:"identity_token_key"`
+	DefaultLeaseTTL            time.Duration         `json:"default_lease_ttl,omitempty" structs:"default_lease_ttl" mapstructure:"default_lease_ttl"` // Override for global default
+	MaxLeaseTTL                time.Duration         `json:"max_lease_ttl,omitempty" structs:"max_lease_ttl" mapstructure:"max_lease_ttl"`             // Override for global default
+	ForceNoCache               bool                  `json:"force_no_cache,omitempty" structs:"force_no_cache" mapstructure:"force_no_cache"`          // Override for global default
+	AuditNonHMACRequestKeys    []string              `json:"audit_non_hmac_request_keys,omitempty" structs:"audit_non_hmac_request_keys" mapstructure:"audit_non_hmac_request_keys"`
+	AuditNonHMACResponseKeys   []string              `json:"audit_non_hmac_response_keys,omitempty" structs:"audit_non_hmac_response_keys" mapstructure:"audit_non_hmac_response_keys"`
+	ListingVisibility          ListingVisibilityType `json:"listing_visibility,omitempty" structs:"listing_visibility" mapstructure:"listing_visibility"`
+	PassthroughRequestHeaders  []string              `json:"passthrough_request_headers,omitempty" structs:"passthrough_request_headers" mapstructure:"passthrough_request_headers"`
+	AllowedResponseHeaders     []string              `json:"allowed_response_headers,omitempty" structs:"allowed_response_headers" mapstructure:"allowed_response_headers"`
+	TokenType                  logical.TokenType     `json:"token_type,omitempty" structs:"token_type" mapstructure:"token_type"`
+	AllowedManagedKeys         []string              `json:"allowed_managed_keys,omitempty" mapstructure:"allowed_managed_keys"`
+	UserLockoutConfig          *UserLockoutConfig    `json:"user_lockout_config,omitempty" mapstructure:"user_lockout_config"`
+	DelegatedAuthAccessors     []string              `json:"delegated_auth_accessors,omitempty" mapstructure:"delegated_auth_accessors"`
+	IdentityTokenKey           string                `json:"identity_token_key,omitempty" mapstructure:"identity_token_key"`
+	TrimRequestTrailingSlashes bool                  `json:"trim_request_trailing_slashes,omitempty" mapstructure:"trim_request_trailing_slashes"` // If requests to this mount should have trailing slashes trimmed
 
 	// PluginName is the name of the plugin registered in the catalog.
 	//
@@ -395,20 +394,21 @@ type APIUserLockoutConfig struct {
 
 // APIMountConfig is an embedded struct of api.MountConfigInput
 type APIMountConfig struct {
-	DefaultLeaseTTL           string                `json:"default_lease_ttl" structs:"default_lease_ttl" mapstructure:"default_lease_ttl"`
-	MaxLeaseTTL               string                `json:"max_lease_ttl" structs:"max_lease_ttl" mapstructure:"max_lease_ttl"`
-	ForceNoCache              bool                  `json:"force_no_cache" structs:"force_no_cache" mapstructure:"force_no_cache"`
-	AuditNonHMACRequestKeys   []string              `json:"audit_non_hmac_request_keys,omitempty" structs:"audit_non_hmac_request_keys" mapstructure:"audit_non_hmac_request_keys"`
-	AuditNonHMACResponseKeys  []string              `json:"audit_non_hmac_response_keys,omitempty" structs:"audit_non_hmac_response_keys" mapstructure:"audit_non_hmac_response_keys"`
-	ListingVisibility         ListingVisibilityType `json:"listing_visibility,omitempty" structs:"listing_visibility" mapstructure:"listing_visibility"`
-	PassthroughRequestHeaders []string              `json:"passthrough_request_headers,omitempty" structs:"passthrough_request_headers" mapstructure:"passthrough_request_headers"`
-	AllowedResponseHeaders    []string              `json:"allowed_response_headers,omitempty" structs:"allowed_response_headers" mapstructure:"allowed_response_headers"`
-	TokenType                 string                `json:"token_type" structs:"token_type" mapstructure:"token_type"`
-	AllowedManagedKeys        []string              `json:"allowed_managed_keys,omitempty" mapstructure:"allowed_managed_keys"`
-	UserLockoutConfig         *UserLockoutConfig    `json:"user_lockout_config,omitempty" mapstructure:"user_lockout_config"`
-	PluginVersion             string                `json:"plugin_version,omitempty" mapstructure:"plugin_version"`
-	DelegatedAuthAccessors    []string              `json:"delegated_auth_accessors,omitempty" mapstructure:"delegated_auth_accessors"`
-	IdentityTokenKey          string                `json:"identity_token_key,omitempty" mapstructure:"identity_token_key"`
+	DefaultLeaseTTL            string                `json:"default_lease_ttl" structs:"default_lease_ttl" mapstructure:"default_lease_ttl"`
+	MaxLeaseTTL                string                `json:"max_lease_ttl" structs:"max_lease_ttl" mapstructure:"max_lease_ttl"`
+	ForceNoCache               bool                  `json:"force_no_cache" structs:"force_no_cache" mapstructure:"force_no_cache"`
+	AuditNonHMACRequestKeys    []string              `json:"audit_non_hmac_request_keys,omitempty" structs:"audit_non_hmac_request_keys" mapstructure:"audit_non_hmac_request_keys"`
+	AuditNonHMACResponseKeys   []string              `json:"audit_non_hmac_response_keys,omitempty" structs:"audit_non_hmac_response_keys" mapstructure:"audit_non_hmac_response_keys"`
+	ListingVisibility          ListingVisibilityType `json:"listing_visibility,omitempty" structs:"listing_visibility" mapstructure:"listing_visibility"`
+	PassthroughRequestHeaders  []string              `json:"passthrough_request_headers,omitempty" structs:"passthrough_request_headers" mapstructure:"passthrough_request_headers"`
+	AllowedResponseHeaders     []string              `json:"allowed_response_headers,omitempty" structs:"allowed_response_headers" mapstructure:"allowed_response_headers"`
+	TokenType                  string                `json:"token_type" structs:"token_type" mapstructure:"token_type"`
+	AllowedManagedKeys         []string              `json:"allowed_managed_keys,omitempty" mapstructure:"allowed_managed_keys"`
+	UserLockoutConfig          *UserLockoutConfig    `json:"user_lockout_config,omitempty" mapstructure:"user_lockout_config"`
+	PluginVersion              string                `json:"plugin_version,omitempty" mapstructure:"plugin_version"`
+	DelegatedAuthAccessors     []string              `json:"delegated_auth_accessors,omitempty" mapstructure:"delegated_auth_accessors"`
+	IdentityTokenKey           string                `json:"identity_token_key,omitempty" mapstructure:"identity_token_key"`
+	TrimRequestTrailingSlashes bool                  `json:"trim_request_trailing_slashes,omitempty" mapstructure:"trim_request_trailing_slashes"` // If requests to this mount should have trailing slashes trimmed
 
 	// PluginName is the name of the plugin registered in the catalog.
 	//
@@ -680,8 +680,12 @@ func (c *Core) mountInternal(ctx context.Context, entry *MountEntry, updateStora
 		return fmt.Errorf("error creating forwarded writer: %v", err)
 	}
 
+	// add the snapshot storage router, which will use the context to determine
+	// whether a read will be from a snapshot or from the normal barrier storage
+	router := newSnapshotStorageRouter(c, forwarded)
+
 	viewPath := entry.ViewPath()
-	view := NewBarrierView(forwarded, viewPath)
+	view := NewBarrierView(router, viewPath)
 
 	// Singleton mounts cannot be filtered manually on a per-secondary basis
 	// from replication.
@@ -783,6 +787,19 @@ func (c *Core) mountInternal(ctx context.Context, entry *MountEntry, updateStora
 	if c.logger.IsInfo() {
 		c.logger.Info("successful mount", "namespace", entry.Namespace().Path, "path", entry.Path, "type", entry.Type, "version", entry.RunningVersion)
 	}
+
+	err = c.observations.RecordObservationToLedger(ctx, observations.ObservationTypeMountSecretsEnable, ns, map[string]interface{}{
+		"path":                   entry.Path,
+		"local_mount":            entry.Local,
+		"type":                   entry.Type,
+		"accessor":               entry.Accessor,
+		"plugin_version":         entry.Version,
+		"running_plugin_version": entry.RunningVersion,
+	})
+	if err != nil {
+		c.logger.Error("failed to record observation after enabling mount backend", "path", entry.Path, "error", err)
+	}
+
 	return nil
 }
 
@@ -953,7 +970,7 @@ func (c *Core) unmountInternal(ctx context.Context, path string, updateStorage b
 
 	removePathCheckers(c, entry, viewPath)
 
-	if c.quotaManager != nil {
+	if c.quotaManager != nil && !c.IsPerfSecondary() {
 		if err := c.quotaManager.HandleBackendDisabling(ctx, ns.Path, path); err != nil {
 			c.logger.Error("failed to update quotas after disabling mount", "path", path, "error", err)
 			return err
@@ -966,6 +983,18 @@ func (c *Core) unmountInternal(ctx context.Context, path string, updateStorage b
 		c.logger.Info("successfully unmounted", "path", path, "namespace", ns.Path)
 	}
 
+	err = c.observations.RecordObservationToLedger(ctx, observations.ObservationTypeMountSecretsDisable, ns, map[string]interface{}{
+		"path":                   entry.Path,
+		"local_mount":            entry.Local,
+		"type":                   entry.Type,
+		"accessor":               entry.Accessor,
+		"plugin_version":         entry.Version,
+		"running_plugin_version": entry.RunningVersion,
+	})
+	if err != nil {
+		c.logger.Error("failed to record observation after enabling mount backend", "path", entry.Path, "error", err)
+	}
+
 	return nil
 }
 
@@ -1195,15 +1224,17 @@ func (c *Core) remountSecretsEngine(ctx context.Context, src, dst namespace.Moun
 	srcMatch.Path = dst.MountPath
 
 	// Update the mount table
-	if err := c.persistMounts(ctx, c.mounts, &srcMatch.Local); err != nil {
-		srcMatch.Path = srcPath
-		srcMatch.Tainted = true
-		c.mountsLock.Unlock()
-		if err == logical.ErrReadOnly && c.perfStandby {
-			return err
-		}
+	if updateStorage {
+		if err := c.persistMounts(ctx, c.mounts, &srcMatch.Local); err != nil {
+			srcMatch.Path = srcPath
+			srcMatch.Tainted = true
+			c.mountsLock.Unlock()
+			if err == logical.ErrReadOnly && c.perfStandby {
+				return err
+			}
 
-		return fmt.Errorf("failed to update mount table with error %+v", err)
+			return fmt.Errorf("failed to update mount table with error %+v", err)
+		}
 	}
 
 	// Remount the backend
@@ -1309,6 +1340,24 @@ func (c *Core) loadMounts(ctx context.Context) error {
 		}
 		entry.namespace = ns
 
+		// Subtle/hacky: re-register ns with namespaceManager to ensure that in the
+		// case where duplicate namespaces existed due to historical race bugs, we
+		// still ensure the correct namespaces are the ones that "win" the path
+		// registrations. This became an issue when we added Core.warmNamespaceCache
+		// and subsequently discovered customers had latent corruption where there
+		// were multiple namespace IDs with the same path in the namespaces config
+		// entry and loading them into cache made it non-deterministic which one won
+		// the slot in the path index due to map iteration randomness. By explicitly
+		// re-registering them here we enforce the same consistent order of
+		// registration into the path index that we had before warming and so
+		// prevent any apparent regressions. Note that mount entries are a slice not
+		// a map so consistent even if we ever did allow duplicates to be stored. We
+		// want to fix all the root causes of those duplicates but also want to
+		// restore the previous behavior that masked them as a problem. They will
+		// likely be there for a long time to come as they are persistent now even
+		// if we find all the bugs that allowed it to get in that state.
+		NamespaceRegister(ctx, ns, c)
+
 		// Sync values to the cache
 		entry.SyncCache()
 	}
@@ -1508,8 +1557,10 @@ func (c *Core) setupMounts(ctx context.Context) error {
 			return fmt.Errorf("error creating forwarded writer: %v", err)
 		}
 
+		storageRouter := newSnapshotStorageRouter(c, forwarded)
+
 		// Create a barrier storage view using the UUID
-		view := NewBarrierView(forwarded, barrierPath)
+		view := NewBarrierView(storageRouter, barrierPath)
 
 		// Singleton mounts cannot be filtered manually on a per-secondary basis
 		// from replication
@@ -1675,6 +1726,8 @@ func (c *Core) newLogicalBackend(ctx context.Context, entry *MountEntry, sysView
 	if err != nil {
 		return nil, err
 	}
+
+	conf := make(map[string]string)
 	var runningSha string
 	factory, ok := c.logicalBackends[t]
 	if !ok {
@@ -1693,13 +1746,22 @@ func (c *Core) newLogicalBackend(ctx context.Context, entry *MountEntry, sysView
 			runningSha = hex.EncodeToString(plug.Sha256)
 		}
 
+		if plug.Download {
+			if err = sysView.DownloadExtractVerifyPlugin(ctx, plug); err != nil {
+				return nil, fmt.Errorf("failed to extract and verify plugin=%q version=%q before mounting: %w",
+					plug.Name, plug.Version, err)
+			}
+		}
+
 		factory = plugin.Factory
 		if !plug.Builtin {
 			factory = wrapFactoryCheckPerms(c, factory)
 		}
+
+		setExternalPluginConfig(plug, conf)
 	}
+
 	// Set up conf to pass in plugin_name
-	conf := make(map[string]string)
 	for k, v := range entry.Options {
 		conf[k] = v
 	}
@@ -1714,6 +1776,12 @@ func (c *Core) newLogicalBackend(ctx context.Context, entry *MountEntry, sysView
 	conf["plugin_type"] = consts.PluginTypeSecrets.String()
 	conf["plugin_version"] = pluginVersion
 
+	pluginOptionsVersion := entry.Options["version"]
+	// If Version isn't specified for a KV mount, it must be version 1.
+	if pluginOptionsVersion == "" && entry.Type == pluginconsts.SecretEngineKV {
+		pluginOptionsVersion = "1"
+	}
+
 	backendLogger := c.baseLogger.Named(fmt.Sprintf("secrets.%s.%s", t, entry.Accessor))
 	c.AddLogger(backendLogger)
 	pluginEventSender, err := c.events.WithPlugin(entry.namespace, &logical.EventPluginInfo{
@@ -1722,18 +1790,39 @@ func (c *Core) newLogicalBackend(ctx context.Context, entry *MountEntry, sysView
 		MountPath:     entry.Path,
 		Plugin:        entry.Type,
 		PluginVersion: pluginVersion,
-		Version:       entry.Options["version"],
+		Version:       pluginOptionsVersion,
 	})
 	if err != nil {
 		return nil, err
 	}
+
+	pluginRunningVersion := pluginVersion
+	if pluginRunningVersion == "" && runningSha == "" {
+		pluginRunningVersion = versions.GetBuiltinVersion(consts.PluginTypeSecrets, entry.Type)
+	}
+
+	pluginObservationRecorder, err := c.observations.WithPlugin(entry.namespace, &logical.ObservationPluginInfo{
+		MountClass:           consts.PluginTypeSecrets.String(),
+		MountAccessor:        entry.Accessor,
+		MountPath:            entry.Path,
+		Plugin:               entry.Type,
+		PluginVersion:        pluginVersion,
+		RunningPluginVersion: pluginRunningVersion,
+		Version:              pluginOptionsVersion,
+		Local:                entry.Local,
+	})
+	if err != nil {
+		return nil, err
+	}
+
 	config := &logical.BackendConfig{
-		StorageView:  view,
-		Logger:       backendLogger,
-		Config:       conf,
-		System:       sysView,
-		BackendUUID:  entry.BackendAwareUUID,
-		EventsSender: pluginEventSender,
+		StorageView:         view,
+		Logger:              backendLogger,
+		Config:              conf,
+		System:              sysView,
+		BackendUUID:         entry.BackendAwareUUID,
+		EventsSender:        pluginEventSender,
+		ObservationRecorder: pluginObservationRecorder,
 	}
 
 	ctx = namespace.ContextWithNamespace(ctx, entry.namespace)
@@ -1746,11 +1835,8 @@ func (c *Core) newLogicalBackend(ctx context.Context, entry *MountEntry, sysView
 		return nil, fmt.Errorf("nil backend of type %q returned from factory", t)
 	}
 
-	entry.RunningVersion = pluginVersion
+	entry.RunningVersion = pluginRunningVersion
 	entry.RunningSha256 = runningSha
-	if entry.RunningVersion == "" && entry.RunningSha256 == "" {
-		entry.RunningVersion = versions.GetBuiltinVersion(consts.PluginTypeSecrets, entry.Type)
-	}
 	addLicenseCallback(c, backend)
 
 	return backend, nil
@@ -1955,7 +2041,7 @@ func (c *Core) createMigrationStatus(from, to namespace.MountPathDetails) (strin
 	migrationInfo := MountMigrationInfo{
 		SourceMount:     from.Namespace.Path + from.MountPath,
 		TargetMount:     to.Namespace.Path + to.MountPath,
-		MigrationStatus: MigrationInProgressStatus.String(),
+		MigrationStatus: MigrationStatusInProgress.String(),
 	}
 	c.mountMigrationTracker.Store(migrationID, migrationInfo)
 	return migrationID, nil
diff --git a/vault/mount_stubs_oss.go b/vault/mount_stubs_oss.go
new file mode 100644
index 00000000000..7b1ca0b1474
--- /dev/null
+++ b/vault/mount_stubs_oss.go
@@ -0,0 +1,17 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+// go:build !enterprise
+
+package vault
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
+)
+
+func entExtractVerifyPlugin(context.Context, *pluginutil.PluginRunner) error {
+	// Do nothing in OSS
+	return nil
+}
diff --git a/vault/mount_test.go b/vault/mount_test.go
index a412252e447..16637e1a08f 100644
--- a/vault/mount_test.go
+++ b/vault/mount_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -13,6 +13,8 @@ import (
 
 	"github.com/armon/go-metrics"
 	"github.com/go-test/deep"
+	"github.com/hashicorp/vault/audit"
+	"github.com/hashicorp/vault/helper/locking"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
@@ -114,7 +116,7 @@ func TestLogicalMountMetrics(t *testing.T) {
 
 func TestCore_DefaultMountTable(t *testing.T) {
 	c, keys, _ := TestCoreUnsealed(t)
-	verifyDefaultTable(t, c.mounts, 4)
+	verifyDefaultTable(t, c.mounts, 4, c.mountsLock)
 
 	// Start a second core with same physical
 	inmemSink := metrics.NewInmemSink(1000000*time.Hour, 2000000*time.Hour)
@@ -140,6 +142,10 @@ func TestCore_DefaultMountTable(t *testing.T) {
 		}
 	}
 
+	c.mountsLock.Lock()
+	defer c.mountsLock.Unlock()
+	c2.mountsLock.Lock()
+	defer c2.mountsLock.Unlock()
 	if diff := deep.Equal(c.mounts.sortEntriesByPath(), c2.mounts.sortEntriesByPath()); len(diff) > 0 {
 		t.Fatalf("mismatch: %v", diff)
 	}
@@ -186,6 +192,10 @@ func TestCore_Mount(t *testing.T) {
 	}
 
 	// Verify matching mount tables
+	c.mountsLock.Lock()
+	defer c.mountsLock.Unlock()
+	c2.mountsLock.Lock()
+	defer c2.mountsLock.Unlock()
 	if diff := deep.Equal(c.mounts.sortEntriesByPath(), c2.mounts.sortEntriesByPath()); len(diff) > 0 {
 		t.Fatalf("mismatch: %v", diff)
 	}
@@ -258,6 +268,10 @@ func TestCore_Mount_kv_generic(t *testing.T) {
 	}
 
 	// Verify matching mount tables
+	c.mountsLock.Lock()
+	defer c.mountsLock.Unlock()
+	c2.mountsLock.Lock()
+	defer c2.mountsLock.Unlock()
 	if diff := deep.Equal(c.mounts.sortEntriesByPath(), c2.mounts.sortEntriesByPath()); len(diff) > 0 {
 		t.Fatalf("mismatch: %v", diff)
 	}
@@ -356,8 +370,8 @@ func TestCore_Mount_Local(t *testing.T) {
 	}
 	c.mounts.Entries = compEntries
 
-	if !reflect.DeepEqual(oldMounts, c.mounts) {
-		t.Fatalf("expected\n%#v\ngot\n%#v\n", oldMounts, c.mounts)
+	if diffs := deep.Equal(oldMounts, c.mounts); len(diffs) != 0 {
+		t.Fatalf("expected\n%#v\ngot\n%#v:\nDiffs: %v", oldMounts, c.mounts, diffs)
 	}
 
 	if len(c.mounts.Entries) != 2 {
@@ -716,17 +730,19 @@ func TestCore_Remount_Protected(t *testing.T) {
 func TestDefaultMountTable(t *testing.T) {
 	c, _, _ := TestCoreUnsealed(t)
 	table := c.defaultMountTable()
-	verifyDefaultTable(t, table, 3)
+	verifyDefaultTable(t, table, 3, c.mountsLock)
 }
 
 func TestCore_MountTable_UpgradeToTyped(t *testing.T) {
 	c, _, _ := TestCoreUnsealed(t)
-	c.auditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
 
 	me := &MountEntry{
 		Table: auditTableType,
 		Path:  "foo",
-		Type:  "noop",
+		Type:  audit.TypeFile,
+		Options: map[string]string{
+			"file_path": "discard",
+		},
 	}
 	err := c.enableAudit(namespace.RootContext(nil), me, true)
 	if err != nil {
@@ -883,7 +899,9 @@ func testCore_MountTable_UpgradeToTyped_Common(
 	}
 }
 
-func verifyDefaultTable(t *testing.T, table *MountTable, expected int) {
+func verifyDefaultTable(t *testing.T, table *MountTable, expected int, mountsLock locking.RWMutex) {
+	mountsLock.Lock()
+	defer mountsLock.Unlock()
 	if len(table.Entries) != expected {
 		t.Fatalf("bad: %v", table.Entries)
 	}
diff --git a/vault/mount_util.go b/vault/mount_util.go
index 6917afa8202..f4e6fa12552 100644
--- a/vault/mount_util.go
+++ b/vault/mount_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -76,3 +76,7 @@ func (c *Core) mountEntrySysView(entry *MountEntry) extendedSystemView {
 func (c *Core) entBuiltinPluginMetrics(ctx context.Context, entry *MountEntry, val float32) error {
 	return nil
 }
+
+func newSnapshotStorageRouter(c *Core, storage logical.Storage) logical.Storage {
+	return storage
+}
diff --git a/vault/mount_util_shared.go b/vault/mount_util_shared.go
index 57a1c880230..4a1bb95d93e 100644
--- a/vault/mount_util_shared.go
+++ b/vault/mount_util_shared.go
@@ -1,9 +1,10 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
 	"github.com/hashicorp/vault/sdk/logical"
 )
 
@@ -29,3 +30,8 @@ func collectBackendSpecialPaths(backend logical.Backend, viewPath string, access
 
 	return ret
 }
+
+// setExternalPluginConfig sets key value pairs to config based on pluginutil.PluginRunner
+func setExternalPluginConfig(runner *pluginutil.PluginRunner, config map[string]string) {
+	config[pluginutil.ConfigPluginTier] = runner.Tier.String()
+}
diff --git a/vault/mountmigrationstatus_enumer.go b/vault/mountmigrationstatus_enumer.go
new file mode 100644
index 00000000000..62edfa18b91
--- /dev/null
+++ b/vault/mountmigrationstatus_enumer.go
@@ -0,0 +1,50 @@
+// Code generated by "enumer -type=MountMigrationStatus -trimprefix=MigrationStatus -transform=kebab"; DO NOT EDIT.
+
+package vault
+
+import (
+	"fmt"
+)
+
+const _MountMigrationStatusName = "in-progresssuccessfailure"
+
+var _MountMigrationStatusIndex = [...]uint8{0, 11, 18, 25}
+
+func (i MountMigrationStatus) String() string {
+	if i < 0 || i >= MountMigrationStatus(len(_MountMigrationStatusIndex)-1) {
+		return fmt.Sprintf("MountMigrationStatus(%d)", i)
+	}
+	return _MountMigrationStatusName[_MountMigrationStatusIndex[i]:_MountMigrationStatusIndex[i+1]]
+}
+
+var _MountMigrationStatusValues = []MountMigrationStatus{0, 1, 2}
+
+var _MountMigrationStatusNameToValueMap = map[string]MountMigrationStatus{
+	_MountMigrationStatusName[0:11]:  0,
+	_MountMigrationStatusName[11:18]: 1,
+	_MountMigrationStatusName[18:25]: 2,
+}
+
+// MountMigrationStatusString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func MountMigrationStatusString(s string) (MountMigrationStatus, error) {
+	if val, ok := _MountMigrationStatusNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to MountMigrationStatus values", s)
+}
+
+// MountMigrationStatusValues returns all values of the enum
+func MountMigrationStatusValues() []MountMigrationStatus {
+	return _MountMigrationStatusValues
+}
+
+// IsAMountMigrationStatus returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i MountMigrationStatus) IsAMountMigrationStatus() bool {
+	for _, v := range _MountMigrationStatusValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/vault/namespaces.go b/vault/namespaces.go
index af4f5c5dc36..4b82a5e9fe4 100644
--- a/vault/namespaces.go
+++ b/vault/namespaces.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -17,3 +17,9 @@ func namespaceByID(ctx context.Context, nsID string, c *Core) (*namespace.Namesp
 	}
 	return nil, namespace.ErrNoNamespace
 }
+
+var NamespaceRegister func(context.Context, *namespace.Namespace, *Core) error = namespaceRegister
+
+func namespaceRegister(ctx context.Context, ns *namespace.Namespace, c *Core) error {
+	return nil
+}
diff --git a/vault/namespaces_oss.go b/vault/namespaces_oss.go
index 902bea712e3..1ea5bd1a967 100644
--- a/vault/namespaces_oss.go
+++ b/vault/namespaces_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -18,3 +18,5 @@ func (c *Core) NamespaceByID(ctx context.Context, nsID string) (*namespace.Names
 func (c *Core) ListNamespaces(includePath bool) []*namespace.Namespace {
 	return []*namespace.Namespace{namespace.RootNamespace}
 }
+
+func (c *Core) resetNamespaceCache() {}
diff --git a/vault/observations/observations.go b/vault/observations/observations.go
new file mode 100644
index 00000000000..0f5c928bb04
--- /dev/null
+++ b/vault/observations/observations.go
@@ -0,0 +1,33 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package observations
+
+import "github.com/hashicorp/go-hclog"
+
+// ObservationSystemConfig serves as a definition of what an observation
+// system needs from the Vault config file to start.
+type ObservationSystemConfig struct {
+	// LedgerPath is the path to the observation system's ledger.
+	LedgerPath string `json:"ledger_path" hcl:"ledger_path"`
+
+	// TypePrefixDenylist will deny any observations with types with matching prefixes
+	// to be emitted to the ledger.
+	TypePrefixDenylist []string `json:"type_prefix_denylist" hcl:"type_prefix_denylist"`
+
+	// TypePrefixAllowlist will only allow observations with types with matching prefixes
+	// to be emitted to the ledger.
+	TypePrefixAllowlist []string `json:"type_prefix_allowlist" hcl:"type_prefix_allowlist"`
+
+	// FileMode will attempt to open the ledger at the ledger path with the following
+	// file mode. Specified as a string, but parsed as an octal, e.g. "0755".
+	FileMode string `json:"file_mode" hcl:"file_mode"`
+}
+
+// NewObservationSystemConfig is the config for a new Observation System, provided
+// to NewObservationSystem
+type NewObservationSystemConfig struct {
+	*ObservationSystemConfig
+	LocalNodeId string
+	Logger      hclog.Logger
+}
diff --git a/vault/observations/observations_ce.go b/vault/observations/observations_ce.go
new file mode 100644
index 00000000000..76b3a6ad688
--- /dev/null
+++ b/vault/observations/observations_ce.go
@@ -0,0 +1,40 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package observations
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// ObservationSystem contains the main logic of running the observation system.
+type ObservationSystem struct{}
+
+type pluginObservationSystem struct{}
+
+func (observations *ObservationSystem) Start() {}
+
+func (observations *ObservationSystem) WithPlugin(_ *namespace.Namespace, _ *logical.ObservationPluginInfo) (*pluginObservationSystem, error) {
+	return &pluginObservationSystem{}, nil
+}
+
+func (observations *pluginObservationSystem) RecordObservationFromPlugin(_ context.Context, _ string, _ map[string]interface{}) error {
+	return nil
+}
+
+func (observations *ObservationSystem) RecordObservationToLedger(_ context.Context, _ string, _ *namespace.Namespace, _ map[string]interface{}) error {
+	return nil
+}
+
+func NewObservationSystem(_ *NewObservationSystemConfig) (*ObservationSystem, error) {
+	return &ObservationSystem{}, nil
+}
+
+func (observations *ObservationSystem) Reload() error {
+	return nil
+}
diff --git a/vault/observations/observations_consts.go b/vault/observations/observations_consts.go
new file mode 100644
index 00000000000..608464a893d
--- /dev/null
+++ b/vault/observations/observations_consts.go
@@ -0,0 +1,38 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package observations
+
+const (
+	// ObservationTypeLeaseCreationAuth is emitted when a lease connected to auth is created
+	ObservationTypeLeaseCreationAuth = "lease/create/auth"
+	// ObservationTypeLeaseCreationNonAuth is emitted when a lease NOT connected to auth is created
+	ObservationTypeLeaseCreationNonAuth = "lease/create/non-auth"
+	// ObservationTypeLeaseRenewAuth is emitted when a lease connected to auth is renewed
+	ObservationTypeLeaseRenewAuth = "lease/renew/auth"
+	// ObservationTypeLeaseRenewNonAuth is emitted when a lease NOT connected to auth is renewed
+	ObservationTypeLeaseRenewNonAuth = "lease/renew/non-auth"
+	// ObservationTypeLeaseLazyRevoke is emitted when a lease is lazy-revoked
+	ObservationTypeLeaseLazyRevoke = "lease/lazy-revoke"
+	// ObservationTypeLeaseRevocation is emitted when a lease is revoked
+	ObservationTypeLeaseRevocation = "lease/revoke"
+
+	// ObservationTypePolicyACLEvaluation is emitted when an ACL policy is evaluated
+	ObservationTypePolicyACLEvaluation = "policy/acl/evaluation"
+
+	// ObservationTypeMountAuthEnable is emitted when an auth mount is enabled
+	ObservationTypeMountAuthEnable = "mount/auth/enable"
+	// ObservationTypeMountAuthDisable is emitted when an auth mount is disabled
+	ObservationTypeMountAuthDisable = "mount/auth/disable"
+	// ObservationTypeMountSecretsEnable is emitted when a secret mount is enabled
+	ObservationTypeMountSecretsEnable = "mount/secrets/enable"
+	// ObservationTypeMountSecretsDisable is emitted when a secret mount is disabled
+	ObservationTypeMountSecretsDisable = "mount/secrets/disable"
+
+	// ObservationTypeNamespaceCreate is emitted when a namespace is created
+	ObservationTypeNamespaceCreate = "namespace/create"
+	// ObservationTypeNamespacePatch is emitted when a namespace is patched
+	ObservationTypeNamespacePatch = "namespace/patch"
+	// ObservationTypeNamespaceDelete is emitted when a namespace is deleted
+	ObservationTypeNamespaceDelete = "namespace/delete"
+)
diff --git a/vault/password_policy_util.go b/vault/password_policy_util.go
index 7a10376ee30..fe5d663d290 100644
--- a/vault/password_policy_util.go
+++ b/vault/password_policy_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/path_registry.go b/vault/path_registry.go
new file mode 100644
index 00000000000..c7009c908e7
--- /dev/null
+++ b/vault/path_registry.go
@@ -0,0 +1,34 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package vault
+
+import "github.com/hashicorp/vault/sdk/physical"
+
+// This is a separate file in vault package for now to keep it simple. In the
+// future if we choose to break up vault package such that namespaces or mount
+// table are moved, this could become a separate helper package but since it's
+// so trivial and not clear if it should be used for other types of paths it
+// seems like overkill to design a whole package API when we don't know the
+// future requirements yet.
+
+var registeredMountOrNamespaceTableKeys []string
+
+// registerMountOrNamespaceTablePaths is meant to be called in init() to allow
+// code within vault core to register "special" backend storage keys that
+// should be considered part of the mount table and/or namespace metadata in a
+// natural place alongside the rest of the code that matters for that subsystem.
+// We need to know them centrally within NewCore so that we can register them
+// with Backends that want to apply different limits to mount table entries and
+// namespace config.
+func registerMountOrNamespaceTablePaths(paths ...string) {
+	registeredMountOrNamespaceTableKeys = append(registeredMountOrNamespaceTableKeys, paths...)
+}
+
+func applyMountAndNamespaceTableKeys(b physical.Backend) {
+	if b, ok := b.(physical.MountTableLimitingBackend); ok {
+		for _, path := range registeredMountOrNamespaceTableKeys {
+			b.RegisterMountTablePath(path)
+		}
+	}
+}
diff --git a/vault/path_registry_test.go b/vault/path_registry_test.go
new file mode 100644
index 00000000000..30c6f2e8d7a
--- /dev/null
+++ b/vault/path_registry_test.go
@@ -0,0 +1,43 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package vault
+
+import (
+	"testing"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/sdk/physical/inmem"
+	"github.com/stretchr/testify/require"
+)
+
+// TestMountTableAndNamespacePathRegistry tests that the mount and namespace
+// path registry works.
+func TestMountTableAndNamespacePathRegistry(t *testing.T) {
+	// Make a copy of the registered paths so we can cleanup later otherwise we
+	// leave the global state poluted in the process and may break other tests.
+	originalPaths := registeredMountOrNamespaceTableKeys
+	defer func() {
+		registeredMountOrNamespaceTableKeys = originalPaths
+	}()
+
+	// Register some dummy paths to test here
+	registerMountOrNamespaceTablePaths("mounty1", "mounty2")
+
+	backend, err := inmem.NewInmem(nil, hclog.NewNullLogger())
+	require.NoError(t, err)
+
+	imb := backend.(*inmem.InmemBackend)
+
+	applyMountAndNamespaceTableKeys(backend)
+
+	// I wanted to avoid hard coding the actual paths that are registered in init
+	// here in an assertion against all paths registered since the whole point of
+	// the registry is to avoid hard coding those elsewhere in code! So instead we
+	// test that our own dummy registrations exist and ignore anything else.
+
+	registeredPaths := imb.GetMountTablePaths()
+
+	require.Contains(t, registeredPaths, "mounty1")
+	require.Contains(t, registeredPaths, "mounty2")
+}
diff --git a/vault/plugin_reload.go b/vault/plugin_reload.go
index 88d7d296101..8ea7ccd925b 100644
--- a/vault/plugin_reload.go
+++ b/vault/plugin_reload.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -281,6 +281,11 @@ func (c *Core) reloadBackendCommon(ctx context.Context, entry *MountEntry, isAut
 				return err
 			}
 			re.binaryPaths.Store(binaryPathsEntry)
+			allowSnapshotReadPathsEntry, err := parseUnauthenticatedPaths(paths.AllowSnapshotRead)
+			if err != nil {
+				return err
+			}
+			re.allowSnapshotReadPaths.Store(allowSnapshotReadPathsEntry)
 		}
 	}
 
diff --git a/vault/plugincatalog/builtin_registry.go b/vault/plugincatalog/builtin_registry.go
index 38bbb340137..ae37ed1202b 100644
--- a/vault/plugincatalog/builtin_registry.go
+++ b/vault/plugincatalog/builtin_registry.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugincatalog
diff --git a/vault/plugincatalog/pin.go b/vault/plugincatalog/pin.go
index 473584374ca..b459adf89d0 100644
--- a/vault/plugincatalog/pin.go
+++ b/vault/plugincatalog/pin.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugincatalog
diff --git a/vault/plugincatalog/pin_test.go b/vault/plugincatalog/pin_test.go
index ff93806a448..1c348160718 100644
--- a/vault/plugincatalog/pin_test.go
+++ b/vault/plugincatalog/pin_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugincatalog
@@ -33,6 +33,7 @@ func TestPluginCatalog_PinnedVersionCRUD(t *testing.T) {
 			Type:    consts.PluginTypeSecrets,
 			Version: version,
 			Command: filepath.Base(file.Name()),
+			Sha256:  []byte("sha256"),
 		})
 		require.NoError(t, err)
 	}
diff --git a/vault/plugincatalog/plugin_artifact.go b/vault/plugincatalog/plugin_artifact.go
new file mode 100644
index 00000000000..57d3d6545f4
--- /dev/null
+++ b/vault/plugincatalog/plugin_artifact.go
@@ -0,0 +1,267 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package plugincatalog
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"runtime"
+	"strings"
+	"sync"
+
+	"github.com/ProtonMail/gopenpgp/v3/crypto"
+)
+
+const (
+	extractedArtifactDirFmt = "%s_%s_%s_%s" // vault-plugin-database-oracle_1.2.3+ent_linux_amd64
+	metadataFile            = "metadata.json"
+	metadataSig             = "metadata.json.sig"
+)
+
+var (
+	once     sync.Once
+	verifier crypto.PGPVerify
+
+	errExtractedArtifactDirNotFound = errors.New("extracted artifact directory not found")
+	errReadMetadata                 = errors.New("failed to read metadata")
+	errReadMetadataSig              = errors.New("failed to read metadata signature")
+	errReadPlugin                   = errors.New("failed to read plugin binary")
+	errReadPluginMetadata           = errors.New("failed to read plugin metadata")
+	errReadPluginPGPSig             = errors.New("failed to read plugin binary PGP signature")
+	errVerifyMetadataSig            = errors.New("failed to verify metadata detached signature")
+	errVerifyPluginSig              = errors.New("failed to verify plugin binary PGP signature")
+)
+
+func load() error {
+	var errs error
+	once.Do(func() {
+		// hashiCorpPGPPubKey is HashiCorp's PGP public key
+		// at https://www.hashicorp.com/.well-known/pgp-key.txt.
+		// This key is used to verify the authenticity of HashiCorp plugins.
+		const hashiCorpPGPPubKey = `
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGB9+xkBEACabYZOWKmgZsHTdRDiyPJxhbuUiKX65GUWkyRMJKi/1dviVxOX
+PG6hBPtF48IFnVgxKpIb7G6NjBousAV+CuLlv5yqFKpOZEGC6sBV+Gx8Vu1CICpl
+Zm+HpQPcIzwBpN+Ar4l/exCG/f/MZq/oxGgH+TyRF3XcYDjG8dbJCpHO5nQ5Cy9h
+QIp3/Bh09kET6lk+4QlofNgHKVT2epV8iK1cXlbQe2tZtfCUtxk+pxvU0UHXp+AB
+0xc3/gIhjZp/dePmCOyQyGPJbp5bpO4UeAJ6frqhexmNlaw9Z897ltZmRLGq1p4a
+RnWL8FPkBz9SCSKXS8uNyV5oMNVn4G1obCkc106iWuKBTibffYQzq5TG8FYVJKrh
+RwWB6piacEB8hl20IIWSxIM3J9tT7CPSnk5RYYCTRHgA5OOrqZhC7JefudrP8n+M
+pxkDgNORDu7GCfAuisrf7dXYjLsxG4tu22DBJJC0c/IpRpXDnOuJN1Q5e/3VUKKW
+mypNumuQpP5lc1ZFG64TRzb1HR6oIdHfbrVQfdiQXpvdcFx+Fl57WuUraXRV6qfb
+4ZmKHX1JEwM/7tu21QE4F1dz0jroLSricZxfaCTHHWNfvGJoZ30/MZUrpSC0IfB3
+iQutxbZrwIlTBt+fGLtm3vDtwMFNWM+Rb1lrOxEQd2eijdxhvBOHtlIcswARAQAB
+tERIYXNoaUNvcnAgU2VjdXJpdHkgKGhhc2hpY29ycC5jb20vc2VjdXJpdHkpIDxz
+ZWN1cml0eUBoYXNoaWNvcnAuY29tPokCVAQTAQoAPhYhBMh0AR8KtAURDQIQVTQ2
+XZRy10aPBQJgffsZAhsDBQkJZgGABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJ
+EDQ2XZRy10aPtpcP/0PhJKiHtC1zREpRTrjGizoyk4Sl2SXpBZYhkdrG++abo6zs
+buaAG7kgWWChVXBo5E20L7dbstFK7OjVs7vAg/OLgO9dPD8n2M19rpqSbbvKYWvp
+0NSgvFTT7lbyDhtPj0/bzpkZEhmvQaDWGBsbDdb2dBHGitCXhGMpdP0BuuPWEix+
+QnUMaPwU51q9GM2guL45Tgks9EKNnpDR6ZdCeWcqo1IDmklloidxT8aKL21UOb8t
+cD+Bg8iPaAr73bW7Jh8TdcV6s6DBFub+xPJEB/0bVPmq3ZHs5B4NItroZ3r+h3ke
+VDoSOSIZLl6JtVooOJ2la9ZuMqxchO3mrXLlXxVCo6cGcSuOmOdQSz4OhQE5zBxx
+LuzA5ASIjASSeNZaRnffLIHmht17BPslgNPtm6ufyOk02P5XXwa69UCjA3RYrA2P
+QNNC+OWZ8qQLnzGldqE4MnRNAxRxV6cFNzv14ooKf7+k686LdZrP/3fQu2p3k5rY
+0xQUXKh1uwMUMtGR867ZBYaxYvwqDrg9XB7xi3N6aNyNQ+r7zI2lt65lzwG1v9hg
+FG2AHrDlBkQi/t3wiTS3JOo/GCT8BjN0nJh0lGaRFtQv2cXOQGVRW8+V/9IpqEJ1
+qQreftdBFWxvH7VJq2mSOXUJyRsoUrjkUuIivaA9Ocdipk2CkP8bpuGz7ZF4uQIN
+BGB9+xkBEACoklYsfvWRCjOwS8TOKBTfl8myuP9V9uBNbyHufzNETbhYeT33Cj0M
+GCNd9GdoaknzBQLbQVSQogA+spqVvQPz1MND18GIdtmr0BXENiZE7SRvu76jNqLp
+KxYALoK2Pc3yK0JGD30HcIIgx+lOofrVPA2dfVPTj1wXvm0rbSGA4Wd4Ng3d2AoR
+G/wZDAQ7sdZi1A9hhfugTFZwfqR3XAYCk+PUeoFrkJ0O7wngaon+6x2GJVedVPOs
+2x/XOR4l9ytFP3o+5ILhVnsK+ESVD9AQz2fhDEU6RhvzaqtHe+sQccR3oVLoGcat
+ma5rbfzH0Fhj0JtkbP7WreQf9udYgXxVJKXLQFQgel34egEGG+NlbGSPG+qHOZtY
+4uWdlDSvmo+1P95P4VG/EBteqyBbDDGDGiMs6lAMg2cULrwOsbxWjsWka8y2IN3z
+1stlIJFvW2kggU+bKnQ+sNQnclq3wzCJjeDBfucR3a5WRojDtGoJP6Fc3luUtS7V
+5TAdOx4dhaMFU9+01OoH8ZdTRiHZ1K7RFeAIslSyd4iA/xkhOhHq89F4ECQf3Bt4
+ZhGsXDTaA/VgHmf3AULbrC94O7HNqOvTWzwGiWHLfcxXQsr+ijIEQvh6rHKmJK8R
+9NMHqc3L18eMO6bqrzEHW0Xoiu9W8Yj+WuB3IKdhclT3w0pO4Pj8gQARAQABiQI8
+BBgBCgAmFiEEyHQBHwq0BRENAhBVNDZdlHLXRo8FAmB9+xkCGwwFCQlmAYAACgkQ
+NDZdlHLXRo9ZnA/7BmdpQLeTjEiXEJyW46efxlV1f6THn9U50GWcE9tebxCXgmQf
+u+Uju4hreltx6GDi/zbVVV3HCa0yaJ4JVvA4LBULJVe3ym6tXXSYaOfMdkiK6P1v
+JgfpBQ/b/mWB0yuWTUtWx18BQQwlNEQWcGe8n1lBbYsH9g7QkacRNb8tKUrUbWlQ
+QsU8wuFgly22m+Va1nO2N5C/eE/ZEHyN15jEQ+QwgQgPrK2wThcOMyNMQX/VNEr1
+Y3bI2wHfZFjotmek3d7ZfP2VjyDudnmCPQ5xjezWpKbN1kvjO3as2yhcVKfnvQI5
+P5Frj19NgMIGAp7X6pF5Csr4FX/Vw316+AFJd9Ibhfud79HAylvFydpcYbvZpScl
+7zgtgaXMCVtthe3GsG4gO7IdxxEBZ/Fm4NLnmbzCIWOsPMx/FxH06a539xFq/1E2
+1nYFjiKg8a5JFmYU/4mV9MQs4bP/3ip9byi10V+fEIfp5cEEmfNeVeW5E7J8PqG9
+t4rLJ8FR4yJgQUa2gs2SNYsjWQuwS/MJvAv4fDKlkQjQmYRAOp1SszAnyaplvri4
+ncmfDsf0r65/sd6S40g5lHH8LIbGxcOIN6kwthSTPWX89r42CbY8GzjTkaeejNKx
+v1aCrO58wAtursO1DiXCvBY7+NdafMRnoHwBk50iPqrVkNA8fv+auRyB2/G5Ag0E
+YH3+JQEQALivllTjMolxUW2OxrXb+a2Pt6vjCBsiJzrUj0Pa63U+lT9jldbCCfgP
+wDpcDuO1O05Q8k1MoYZ6HddjWnqKG7S3eqkV5c3ct3amAXp513QDKZUfIDylOmhU
+qvxjEgvGjdRjz6kECFGYr6Vnj/p6AwWv4/FBRFlrq7cnQgPynbIH4hrWvewp3Tqw
+GVgqm5RRofuAugi8iZQVlAiQZJo88yaztAQ/7VsXBiHTn61ugQ8bKdAsr8w/ZZU5
+HScHLqRolcYg0cKN91c0EbJq9k1LUC//CakPB9mhi5+aUVUGusIM8ECShUEgSTCi
+KQiJUPZ2CFbbPE9L5o9xoPCxjXoX+r7L/WyoCPTeoS3YRUMEnWKvc42Yxz3meRb+
+BmaqgbheNmzOah5nMwPupJYmHrjWPkX7oyyHxLSFw4dtoP2j6Z7GdRXKa2dUYdk2
+x3JYKocrDoPHh3Q0TAZujtpdjFi1BS8pbxYFb3hHmGSdvz7T7KcqP7ChC7k2RAKO
+GiG7QQe4NX3sSMgweYpl4OwvQOn73t5CVWYp/gIBNZGsU3Pto8g27vHeWyH9mKr4
+cSepDhw+/X8FGRNdxNfpLKm7Vc0Sm9Sof8TRFrBTqX+vIQupYHRi5QQCuYaV6OVr
+ITeegNK3So4m39d6ajCR9QxRbmjnx9UcnSYYDmIB6fpBuwT0ogNtABEBAAGJBHIE
+GAEKACYCGwIWIQTIdAEfCrQFEQ0CEFU0Nl2UctdGjwUCYH4bgAUJAeFQ2wJAwXQg
+BBkBCgAdFiEEs2y6kaLAcwxDX8KAsLRBCXaFtnYFAmB9/iUACgkQsLRBCXaFtnYX
+BhAAlxejyFXoQwyGo9U+2g9N6LUb/tNtH29RHYxy4A3/ZUY7d/FMkArmh4+dfjf0
+p9MJz98Zkps20kaYP+2YzYmaizO6OA6RIddcEXQDRCPHmLts3097mJ/skx9qLAf6
+rh9J7jWeSqWO6VW6Mlx8j9m7sm3Ae1OsjOx/m7lGZOhY4UYfY627+Jf7WQ5103Qs
+lgQ09es/vhTCx0g34SYEmMW15Tc3eCjQ21b1MeJD/V26npeakV8iCZ1kHZHawPq/
+aCCuYEcCeQOOteTWvl7HXaHMhHIx7jjOd8XX9V+UxsGz2WCIxX/j7EEEc7CAxwAN
+nWp9jXeLfxYfjrUB7XQZsGCd4EHHzUyCf7iRJL7OJ3tz5Z+rOlNjSgci+ycHEccL
+YeFAEV+Fz+sj7q4cFAferkr7imY1XEI0Ji5P8p/uRYw/n8uUf7LrLw5TzHmZsTSC
+UaiL4llRzkDC6cVhYfqQWUXDd/r385OkE4oalNNE+n+txNRx92rpvXWZ5qFYfv7E
+95fltvpXc0iOugPMzyof3lwo3Xi4WZKc1CC/jEviKTQhfn3WZukuF5lbz3V1PQfI
+xFsYe9WYQmp25XGgezjXzp89C/OIcYsVB1KJAKihgbYdHyUN4fRCmOszmOUwEAKR
+3k5j4X8V5bk08sA69NVXPn2ofxyk3YYOMYWW8ouObnXoS8QJEDQ2XZRy10aPMpsQ
+AIbwX21erVqUDMPn1uONP6o4NBEq4MwG7d+fT85rc1U0RfeKBwjucAE/iStZDQoM
+ZKWvGhFR+uoyg1LrXNKuSPB82unh2bpvj4zEnJsJadiwtShTKDsikhrfFEK3aCK8
+Zuhpiu3jxMFDhpFzlxsSwaCcGJqcdwGhWUx0ZAVD2X71UCFoOXPjF9fNnpy80YNp
+flPjj2RnOZbJyBIM0sWIVMd8F44qkTASf8K5Qb47WFN5tSpePq7OCm7s8u+lYZGK
+wR18K7VliundR+5a8XAOyUXOL5UsDaQCK4Lj4lRaeFXunXl3DJ4E+7BKzZhReJL6
+EugV5eaGonA52TWtFdB8p+79wPUeI3KcdPmQ9Ll5Zi/jBemY4bzasmgKzNeMtwWP
+fk6WgrvBwptqohw71HDymGxFUnUP7XYYjic2sVKhv9AevMGycVgwWBiWroDCQ9Ja
+btKfxHhI2p+g+rcywmBobWJbZsujTNjhtme+kNn1mhJsD3bKPjKQfAxaTskBLb0V
+wgV21891TS1Dq9kdPLwoS4XNpYg2LLB4p9hmeG3fu9+OmqwY5oKXsHiWc43dei9Y
+yxZ1AAUOIaIdPkq+YG/PhlGE4YcQZ4RPpltAr0HfGgZhmXWigbGS+66pUj+Ojysc
+j0K5tCVxVu0fhhFpOlHv0LWaxCbnkgkQH9jfMEJkAWMOuQINBGCAXCYBEADW6RNr
+ZVGNXvHVBqSiOWaxl1XOiEoiHPt50Aijt25yXbG+0kHIFSoR+1g6Lh20JTCChgfQ
+kGGjzQvEuG1HTw07YhsvLc0pkjNMfu6gJqFox/ogc53mz69OxXauzUQ/TZ27GDVp
+UBu+EhDKt1s3OtA6Bjz/csop/Um7gT0+ivHyvJ/jGdnPEZv8tNuSE/Uo+hn/Q9hg
+8SbveZzo3C+U4KcabCESEFl8Gq6aRi9vAfa65oxD5jKaIz7cy+pwb0lizqlW7H9t
+Qlr3dBfdIcdzgR55hTFC5/XrcwJ6/nHVH/xGskEasnfCQX8RYKMuy0UADJy72TkZ
+bYaCx+XXIcVB8GTOmJVoAhrTSSVLAZspfCnjwnSxisDn3ZzsYrq3cV6sU8b+QlIX
+7VAjurE+5cZiVlaxgCjyhKqlGgmonnReWOBacCgL/UvuwMmMp5TTLmiLXLT7uxeG
+ojEyoCk4sMrqrU1jevHyGlDJH9Taux15GILDwnYFfAvPF9WCid4UZ4Ouwjcaxfys
+3LxNiZIlUsXNKwS3mhiMRL4TRsbs4k4QE+LIMOsauIvcvm8/frydvQ/kUwIhVTH8
+0XGOH909bYtJvY3fudK7ShIwm7ZFTduBJUG473E/Fn3VkhTmBX6+PjOC50HR/Hyb
+waRCzfDruMe3TAcE/tSP5CUOb9C7+P+hPzQcDwARAQABiQRyBBgBCgAmFiEEyHQB
+Hwq0BRENAhBVNDZdlHLXRo8FAmCAXCYCGwIFCQlmAYACQAkQNDZdlHLXRo/BdCAE
+GQEKAB0WIQQ3TsdbSFkTYEqDHMfIIMbVzSerhwUCYIBcJgAKCRDIIMbVzSerh0Xw
+D/9ghnUsoNCu1OulcoJdHboMazJvDt/znttdQSnULBVElgM5zk0Uyv87zFBzuCyQ
+JWL3bWesQ2uFx5fRWEPDEfWVdDrjpQGb1OCCQyz1QlNPV/1M1/xhKGS9EeXrL8Dw
+F6KTGkRwn1yXiP4BGgfeFIQHmJcKXEZ9HkrpNb8mcexkROv4aIPAwn+IaE+NHVtt
+IBnufMXLyfpkWJQtJa9elh9PMLlHHnuvnYLvuAoOkhuvs7fXDMpfFZ01C+QSv1dz
+Hm52GSStERQzZ51w4c0rYDneYDniC/sQT1x3dP5Xf6wzO+EhRMabkvoTbMqPsTEP
+xyWr2pNtTBYp7pfQjsHxhJpQF0xjGN9C39z7f3gJG8IJhnPeulUqEZjhRFyVZQ6/
+siUeq7vu4+dM/JQL+i7KKe7Lp9UMrG6NLMH+ltaoD3+lVm8fdTUxS5MNPoA/I8cK
+1OWTJHkrp7V/XaY7mUtvQn5V1yET5b4bogz4nME6WLiFMd+7x73gB+YJ6MGYNuO8
+e/NFK67MfHbk1/AiPTAJ6s5uHRQIkZcBPG7y5PpfcHpIlwPYCDGYlTajZXblyKrw
+BttVnYKvKsnlysv11glSg0DphGxQJbXzWpvBNyhMNH5dffcfvd3eXJAxnD81GD2z
+ZAriMJ4Av2TfeqQ2nxd2ddn0jX4WVHtAvLXfCgLM2Gveho4jD/9sZ6PZz/rEeTvt
+h88t50qPcBa4bb25X0B5FO3TeK2LL3VKLuEp5lgdcHVonrcdqZFobN1CgGJua8TW
+SprIkh+8ATZ/FXQTi01NzLhHXT1IQzSpFaZw0gb2f5ruXwvTPpfXzQrs2omY+7s7
+fkCwGPesvpSXPKn9v8uhUwD7NGW/Dm+jUM+QtC/FqzX7+/Q+OuEPjClUh1cqopCZ
+EvAI3HjnavGrYuU6DgQdjyGT/UDbuwbCXqHxHojVVkISGzCTGpmBcQYQqhcFRedJ
+yJlu6PSXlA7+8Ajh52oiMJ3ez4xSssFgUQAyOB16432tm4erpGmCyakkoRmMUn3p
+wx+QIppxRlsHznhcCQKR3tcblUqH3vq5i4/ZAihusMCa0YrShtxfdSb13oKX+pFr
+aZXvxyZlCa5qoQQBV1sowmPL1N2j3dR9TVpdTyCFQSv4KeiExmowtLIjeCppRBEK
+eeYHJnlfkyKXPhxTVVO6H+dU4nVu0ASQZ07KiQjbI+zTpPKFLPp3/0sPRJM57r1+
+aTS71iR7nZNZ1f8LZV2OvGE6fJVtgJ1J4Nu02K54uuIhU3tg1+7Xt+IqwRc9rbVr
+pHH/hFCYBPW2D2dxB+k2pQlg5NI+TpsXj5Zun8kRw5RtVb+dLuiH/xmxArIee8Jq
+ZF5q4h4I33PSGDdSvGXn9UMY5Isjpg==
+=7pIB
+-----END PGP PUBLIC KEY BLOCK-----
+`
+
+		pgp := crypto.PGP()
+		key, err := crypto.NewKeyFromArmored(hashiCorpPGPPubKey)
+		if err != nil {
+			errs = errors.Join(errs, err)
+		}
+
+		verifier, err = pgp.Verify().VerificationKey(key).New()
+		if err != nil {
+			errs = errors.Join(errs, err)
+		}
+	})
+
+	if verifier == nil {
+		errs = errors.Join(errs, errors.New("verifier is nil after initialization"))
+	}
+
+	return errs
+}
+
+func GetExtractedArtifactDir(pluginName, pluginVersion string) string {
+	if strings.HasPrefix(pluginVersion, "v") {
+		pluginVersion = pluginVersion[1:]
+	}
+
+	return fmt.Sprintf(extractedArtifactDirFmt, pluginName, pluginVersion, runtime.GOOS, runtime.GOARCH)
+}
+
+type verifyFunc func(data, sig []byte) error
+
+func verifyPGPSignatureDetached(data, sig []byte) error {
+	if err := load(); err != nil {
+		return fmt.Errorf("failed to load verifier: %w", err)
+	}
+
+	verifyResult, err := verifier.VerifyDetached(data, sig, crypto.Armor)
+	if err != nil {
+		return fmt.Errorf("failed to verify data: %w", err)
+	}
+	if sigErr := verifyResult.SignatureError(); sigErr != nil {
+		return fmt.Errorf("unexpected signature error: %w", sigErr)
+	}
+
+	return nil
+}
+
+func VerifyPlugin(pluginDir string, pluginName string, verifyFunc verifyFunc) (*PluginMetadata, error) {
+	if st, err := os.Stat(pluginDir); err != nil {
+		if os.IsNotExist(err) {
+			return nil, fmt.Errorf("%w: %s", errExtractedArtifactDirNotFound, pluginDir)
+		}
+		return nil, fmt.Errorf("unexpected err %w", err)
+	} else if !st.IsDir() {
+		return nil, fmt.Errorf("%w: %s is not a directory", errExtractedArtifactDirNotFound, pluginDir)
+	}
+
+	// verify metadata.json is untampered
+	metadataPath := path.Join(pluginDir, "metadata.json")
+	metadataBytes, err := os.ReadFile(metadataPath)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", errReadMetadata, err)
+	}
+
+	metadataSigBytes, err := os.ReadFile(path.Join(pluginDir, "metadata.json.sig"))
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", errReadMetadataSig, err)
+	}
+
+	if err := verifyFunc(metadataBytes, metadataSigBytes); err != nil {
+		return nil, fmt.Errorf("%w: %w", errVerifyMetadataSig, err)
+	}
+
+	// verify plugin binary is untampered
+	// TODO: We should update this to not read in the whole file into memory to be more efficient. Reference the secure-plugin-api's HashFile function.
+	pluginBytes, err := os.ReadFile(path.Join(pluginDir, pluginName))
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", errReadPlugin, err)
+	}
+
+	metadata, err := readPluginMetadata(metadataPath)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %w", errReadPluginMetadata, err)
+	}
+
+	if err := verifyFunc(pluginBytes, []byte(metadata.Plugin.PGPSig)); err != nil {
+		return nil, fmt.Errorf("%w: %w", errVerifyPluginSig, err)
+	}
+
+	// TODO: Once we set sha256 on the metadata file from releases.hashicorp.com,
+	// we should compare the file hash with the metadata file's sha256.
+	hasher := sha256.New()
+	if _, err := hasher.Write(pluginBytes); err != nil {
+		return nil, fmt.Errorf("failed to hash plugin binary: %w", err)
+	}
+	metadata.Plugin.Sha256 = hex.EncodeToString(hasher.Sum(nil))
+
+	return metadata, nil
+}
diff --git a/vault/plugincatalog/plugin_artifact_test.go b/vault/plugincatalog/plugin_artifact_test.go
new file mode 100644
index 00000000000..45b5f182f02
--- /dev/null
+++ b/vault/plugincatalog/plugin_artifact_test.go
@@ -0,0 +1,49 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package plugincatalog
+
+import (
+	"fmt"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// Test_getExtractedArtifactDir tests the getExtractedArtifactDir function.
+func Test_getExtractedArtifactDir(t *testing.T) {
+	t.Parallel()
+
+	type args struct {
+		command string
+		version string
+	}
+	tests := []struct {
+		name string
+		args args
+		want string
+	}{
+		{
+			name: "v-prefixed version",
+			args: args{"vault-plugin-auth-aws", "v0.18.0+ent"},
+			want: fmt.Sprintf("vault-plugin-auth-aws_0.18.0+ent_%s_%s", runtime.GOOS, runtime.GOARCH),
+		},
+		{
+			name: "un-prefixed version",
+			args: args{"vault-plugin-auth-aws", "0.18.0+ent"},
+			want: fmt.Sprintf("vault-plugin-auth-aws_0.18.0+ent_%s_%s", runtime.GOOS, runtime.GOARCH),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, GetExtractedArtifactDir(tt.args.command, tt.args.version))
+		})
+	}
+}
+
+// TestPluginCatalog_load tests that we can successfully load the HashiCorp PGP public key into our global verifier.
+func TestPluginCatalog_load(t *testing.T) {
+	err := load()
+	assert.NoError(t, err, "expected successful load of PGP public key")
+}
diff --git a/vault/plugincatalog/plugin_catalog.go b/vault/plugincatalog/plugin_catalog.go
index b2b61f54bb7..fb039c03be9 100644
--- a/vault/plugincatalog/plugin_catalog.go
+++ b/vault/plugincatalog/plugin_catalog.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugincatalog
@@ -173,6 +173,13 @@ func SetupPluginCatalog(ctx context.Context, in *PluginCatalogInput) (*PluginCat
 		return nil, err
 	}
 
+	// Sanitize the plugin catalog
+	err = catalog.verifyOfficialPlugins(ctx)
+	if err != nil {
+		logger.Error("error while sanitizing plugin storage", "error", err)
+		return nil, err
+	}
+
 	if legacy, _ := strconv.ParseBool(os.Getenv(pluginutil.PluginUseLegacyEnvLayering)); legacy {
 		conflicts := false
 		osKeys := envKeys(os.Environ())
@@ -827,7 +834,7 @@ func (c *PluginCatalog) upgradePlugins(ctx context.Context, logger log.Logger) e
 		}
 
 		// Upgrade the storage. At this point we don't know what type of plugin this is so pass in the unknown type.
-		runner, err := c.setInternal(ctx, pluginutil.SetPluginInput{
+		runner, err := c.set(ctx, pluginutil.SetPluginInput{
 			Name:    pluginName,
 			Type:    consts.PluginTypeUnknown,
 			Version: plugin.Version,
@@ -857,6 +864,45 @@ func (c *PluginCatalog) upgradePlugins(ctx context.Context, logger log.Logger) e
 	return retErr
 }
 
+// verifyOfficialPlugins verifies all official HashiCorp plugins
+func (c *PluginCatalog) verifyOfficialPlugins(ctx context.Context) error {
+	plugins, err := c.collectAllPlugins(ctx)
+	if err != nil {
+		return err
+	}
+
+	// // TODO: In the future, add retries.
+	for _, plugin := range plugins {
+		if plugin.Download {
+			// TODO: In the future, we may want to have some sort of deadline here so we don't block Vault from starting or impose any extended delays.
+			if err := c.entDownloadExtractVerifyPlugin(ctx, plugin); err != nil {
+				c.logger.Warn("failed to download, extract, and verify plugin",
+					"plugin", plugin.Name, "version", plugin.Version, "error", err)
+			}
+		}
+	}
+
+	// The below verification block only applies to official plugins that were manually downloaded and extracted to the plugin directory.
+	var hasOfficialPlugins bool
+	for _, plugin := range plugins {
+		if plugin.Tier != consts.PluginTierOfficial || plugin.Download {
+			continue
+		}
+
+		hasOfficialPlugins = true
+		pluginDir := path.Join(c.directory, path.Dir(plugin.Command))
+		if _, err = VerifyPlugin(pluginDir, plugin.Name, verifyPGPSignatureDetached); err != nil {
+			return fmt.Errorf("failed to verify plugin %q version %q: %w", plugin.Name, plugin.Version, err)
+		}
+	}
+
+	if hasOfficialPlugins {
+		c.logger.Info("all official plugins verified")
+	}
+
+	return nil
+}
+
 // Get retrieves a plugin with the specified name from the catalog. It first
 // looks for external plugins with this name and then looks for builtin plugins.
 // It returns a PluginRunner or an error if no plugin was found.
@@ -955,27 +1001,87 @@ func (c *PluginCatalog) Set(ctx context.Context, plugin pluginutil.SetPluginInpu
 	c.lock.Lock()
 	defer c.lock.Unlock()
 
-	_, err := c.setInternal(ctx, plugin)
+	_, err := c.set(ctx, plugin)
 	return err
 }
 
-func (c *PluginCatalog) setInternal(ctx context.Context, plugin pluginutil.SetPluginInput) (*pluginutil.PluginRunner, error) {
-	command := plugin.Command
+// set sets a plugin entry in the catalog.
+// For manually extracted plugin artifacts when sha256 is unset, it additionally attempts to verify the plugin.
+func (c *PluginCatalog) set(ctx context.Context, plugin pluginutil.SetPluginInput) (*pluginutil.PluginRunner, error) {
+	absCommand := plugin.Command
+	var pluginTier consts.PluginTier
+
 	if plugin.OCIImage == "" {
-		// Best effort check to make sure the command isn't breaking out of the
-		// configured plugin directory.
-		command = filepath.Join(c.directory, plugin.Command)
-		sym, err := filepath.EvalSymlinks(command)
+		// When OCIImage is empty, then we want to register with the binary either directly (if Sha256 is set) or via the extracted artifact directory (if Sha256 is unset).
+
+		// Validate name and command are set as we rely on these to be specified to populate the plugin runner.
+		if plugin.Name == "" {
+			return nil, fmt.Errorf("must specify name to register plugin")
+		}
+		if plugin.Download || len(plugin.Sha256) > 0 {
+			// For downloaded plugins and plugin binaries, we require command to be set from the caller to populate the plugin runner.
+			// Extracted artifacts don't require command to be set as we derive it from the plugin name.
+			if plugin.Command == "" {
+				return nil, fmt.Errorf("must specify command to register plugin")
+			}
+		}
+
+		var expectedPluginDir string
+		var err error
+		if plugin.Download {
+			expectedPluginDir, plugin.Command, pluginTier, err = c.entPrepareDownloadedPlugin(ctx, plugin)
+		} else if len(plugin.Sha256) > 0 {
+			// When Download is false and Sha256 is set, we can assume the binary is already available.
+			expectedPluginDir = c.directory
+		} else {
+			// When Download is false and Sha256 is unset, ensure Version is set then attempt to verify
+			// the plugin in its extracted artifact directory.
+			//
+			// TODO: We should move this verification of manually extracted artifacts into handlePluginCatalogUpdate
+			// and pass tier and sha256 from the pluginutil.SetPluginInput instead of setting them here.
+
+			if len(plugin.Version) == 0 {
+				return nil, fmt.Errorf("must specify sha256 to register plugin with binary or version to register plugin with extracted artifact directory")
+			}
+
+			var err error
+			extractedArtifactDir := GetExtractedArtifactDir(plugin.Name, plugin.Version)
+			expectedPluginDir = path.Join(c.directory, extractedArtifactDir)
+
+			// plugin.Command is the command relative to the plugin directory,
+			// e.g., plugins/vault-plugin-secrets-kv_0.24.0_linux_amd64/vault-plugin-secrets-kv
+			plugin.Command = path.Join(extractedArtifactDir, plugin.Name)
+
+			metadata, err := VerifyPlugin(expectedPluginDir, plugin.Name, verifyPGPSignatureDetached)
+			if err != nil {
+				return nil, fmt.Errorf("failed to verify plugin plugin %q version %q: %w",
+					plugin.Name, plugin.Version, err)
+			}
+			pluginTier = metadata.Plugin.Tier
+
+			plugin.Sha256, err = hex.DecodeString(metadata.Plugin.Sha256)
+			if err != nil {
+				return nil, fmt.Errorf("failed to decode plugin metadata sha256: %w", err)
+			}
+		}
+
+		absCommand = filepath.Join(c.directory, plugin.Command)
+
+		sym, err := filepath.EvalSymlinks(absCommand)
 		if err != nil {
 			return nil, fmt.Errorf("error while validating the command path: %w", err)
 		}
+
+		// Best effort check to make sure the command isn't breaking out of the
+		// configured plugin directory.
+
 		symAbs, err := filepath.Abs(filepath.Dir(sym))
 		if err != nil {
 			return nil, fmt.Errorf("error while validating the command path: %w", err)
 		}
 
-		if symAbs != c.directory {
-			return nil, errors.New("cannot execute files outside of configured plugin directory")
+		if symAbs != expectedPluginDir {
+			return nil, fmt.Errorf("cannot execute files outside of configured plugin directory %s: expected %s, got %s", c.directory, expectedPluginDir, symAbs)
 		}
 	}
 
@@ -984,14 +1090,18 @@ func (c *PluginCatalog) setInternal(ctx context.Context, plugin pluginutil.SetPl
 	// the plugin directory to the command, but we can't use get() here.
 	entryTmp := &pluginutil.PluginRunner{
 		Name:     plugin.Name,
-		Command:  command,
+		Command:  absCommand,
 		OCIImage: plugin.OCIImage,
 		Runtime:  plugin.Runtime,
 		Args:     plugin.Args,
 		Env:      plugin.Env,
 		Sha256:   plugin.Sha256,
 		Builtin:  false,
+		Tmpdir:   c.tmpdir,
+		Tier:     pluginTier,
+		Download: plugin.Download,
 	}
+
 	if entryTmp.OCIImage != "" && entryTmp.Runtime != "" {
 		var err error
 		entryTmp.RuntimeConfig, err = c.runtimeCatalog.Get(ctx, entryTmp.Runtime, consts.PluginRuntimeTypeContainer)
@@ -1051,6 +1161,9 @@ func (c *PluginCatalog) setInternal(ctx context.Context, plugin pluginutil.SetPl
 		Env:      plugin.Env,
 		Sha256:   plugin.Sha256,
 		Builtin:  false,
+		Tmpdir:   c.tmpdir,
+		Tier:     pluginTier,
+		Download: plugin.Download,
 	}
 
 	buf, err := json.Marshal(entry)
diff --git a/vault/plugincatalog/plugin_catalog_stubs_oss.go b/vault/plugincatalog/plugin_catalog_stubs_oss.go
new file mode 100644
index 00000000000..5517f23afa2
--- /dev/null
+++ b/vault/plugincatalog/plugin_catalog_stubs_oss.go
@@ -0,0 +1,21 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package plugincatalog
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/hashicorp/vault/sdk/helper/pluginutil"
+)
+
+func (c *PluginCatalog) entPrepareDownloadedPlugin(ctx context.Context, plugin pluginutil.SetPluginInput) (string, string, consts.PluginTier, error) {
+	return "", "", consts.PluginTierUnknown, nil
+}
+
+func (c *PluginCatalog) entDownloadExtractVerifyPlugin(ctx context.Context, pr *pluginutil.PluginRunner) error {
+	return nil
+}
diff --git a/vault/plugincatalog/plugin_catalog_test.go b/vault/plugincatalog/plugin_catalog_test.go
index 94d3f321f08..dd974eafb69 100644
--- a/vault/plugincatalog/plugin_catalog_test.go
+++ b/vault/plugincatalog/plugin_catalog_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugincatalog
@@ -199,6 +199,7 @@ func TestPluginCatalog_CRUD(t *testing.T) {
 		Type:    consts.PluginTypeDatabase,
 		Version: "1.0.0",
 		Command: filepath.Base(file.Name()),
+		Sha256:  []byte{'1'},
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -646,7 +647,7 @@ func TestPluginCatalog_ListHandlesPluginNamesWithSlashes(t *testing.T) {
 			Command: command,
 			Args:    nil,
 			Env:     nil,
-			Sha256:  nil,
+			Sha256:  []byte{'1'},
 		})
 		if err != nil {
 			t.Fatal(err)
@@ -828,6 +829,7 @@ func TestPluginCatalog_ErrDirectoryNotConfigured(t *testing.T) {
 				Name:    "binary",
 				Type:    consts.PluginTypeDatabase,
 				Command: command,
+				Sha256:  []byte{'1'},
 			})
 			dirSet := catalog.directory != ""
 			if dirSet {
@@ -1267,6 +1269,7 @@ func TestPluginCatalog_CannotDeletePinnedVersion(t *testing.T) {
 		Type:    consts.PluginTypeSecrets,
 		Version: "1.0.0",
 		Command: filepath.Base(file.Name()),
+		Sha256:  []byte{'1'},
 	})
 	if err != nil {
 		t.Fatal(err)
diff --git a/vault/plugincatalog/plugin_metadata.go b/vault/plugincatalog/plugin_metadata.go
new file mode 100644
index 00000000000..b9886ac5993
--- /dev/null
+++ b/vault/plugincatalog/plugin_metadata.go
@@ -0,0 +1,49 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package plugincatalog
+
+import (
+	"encoding/json"
+	"os"
+
+	"github.com/hashicorp/vault/sdk/helper/consts"
+)
+
+// PluginMetadata represents metadata.json in the plugin artifact
+type PluginMetadata struct {
+	Version string `json:"version"`
+	Plugin  Plugin `json:"plugin"`
+}
+
+// Plugin represents the metadata of a plugin as defined
+// under "plugin" object in the metadata.json
+type Plugin struct {
+	Name string            `json:"name"`
+	Type consts.PluginType `json:"type"`
+	Tier consts.PluginTier `json:"tier,omitempty"`
+	// By is the plugin author's GitHub account, following Terraform Registry's convention
+	By       string `json:"by"`
+	Version  string `json:"version"`
+	Platform string `json:"platform"`
+	Arch     string `json:"arch"`
+	// PGPSig is PGP ASCII armored detached signature
+	PGPSig string `json:"pgp_sig"`
+	// Sha256 is the SHA256 checksum of the plugin binary.
+	// TODO: Not currently present in today's plugin release metadata, but will be added in the future.
+	Sha256 string `json:"sha256"`
+}
+
+func readPluginMetadata(metadataPath string) (*PluginMetadata, error) {
+	metadataBytes, err := os.ReadFile(metadataPath)
+	if err != nil {
+		return nil, err
+	}
+
+	metadata := PluginMetadata{}
+	if err = json.Unmarshal(metadataBytes, &metadata); err != nil {
+		return nil, err
+	}
+
+	return &metadata, nil
+}
diff --git a/vault/plugincatalog/plugin_runtime_catalog.go b/vault/plugincatalog/plugin_runtime_catalog.go
index 73e7e01fe2a..0db23deccbd 100644
--- a/vault/plugincatalog/plugin_runtime_catalog.go
+++ b/vault/plugincatalog/plugin_runtime_catalog.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugincatalog
diff --git a/vault/plugincatalog/plugin_runtime_catalog_test.go b/vault/plugincatalog/plugin_runtime_catalog_test.go
index 43dcfffde3f..52ecc02009c 100644
--- a/vault/plugincatalog/plugin_runtime_catalog_test.go
+++ b/vault/plugincatalog/plugin_runtime_catalog_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugincatalog
diff --git a/vault/plugincatalog/testing.go b/vault/plugincatalog/testing.go
index cb5a52e7f8d..e69d2f65a29 100644
--- a/vault/plugincatalog/testing.go
+++ b/vault/plugincatalog/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package plugincatalog
@@ -10,10 +10,10 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"testing"
 
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/pluginutil"
-	"github.com/mitchellh/go-testing-interface"
 )
 
 // TestAddTestPlugin registers the testFunc as part of the plugin command to the
@@ -23,7 +23,7 @@ import (
 // will be something like:
 // stderr (ignored by go-plugin): "testing: warning: no tests to run"
 // stdout: "PASS"
-func TestAddTestPlugin(t testing.T, pluginCatalog *PluginCatalog, name string, pluginType consts.PluginType, version string, testFunc string, env []string) {
+func TestAddTestPlugin(t testing.TB, pluginCatalog *PluginCatalog, name string, pluginType consts.PluginType, version string, testFunc string, env []string) {
 	t.Helper()
 	if pluginCatalog.directory == "" {
 		t.Fatal("plugin catalog must have a plugin directory set to add plugins")
diff --git a/vault/plugincatalog/testing_util.go b/vault/plugincatalog/testing_util.go
new file mode 100644
index 00000000000..8934ff5dfcc
--- /dev/null
+++ b/vault/plugincatalog/testing_util.go
@@ -0,0 +1,87 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package plugincatalog
+
+import (
+	"encoding/json"
+	"fmt"
+	"runtime"
+	"testing"
+
+	"github.com/ProtonMail/gopenpgp/v3/crypto"
+	"github.com/google/uuid"
+	"github.com/hashicorp/vault/sdk/helper/consts"
+	"github.com/stretchr/testify/assert"
+)
+
+// gereratePGPKeyPair generates a PGP key pair for testing purposes
+func generatePGPKeyPair(t *testing.T) (*crypto.Key, string) {
+	pgp := crypto.PGP()
+	user := "test" + uuid.NewString()[:5]
+	privKey, err := pgp.KeyGeneration().AddUserId(user, fmt.Sprintf("%s@hashicorp.com", user)).New().GenerateKey()
+	assert.NoError(t, err)
+
+	pubkey, err := privKey.ToPublic()
+	assert.NoError(t, err)
+
+	armored, err := pubkey.Armor()
+	assert.NoError(t, err)
+
+	return privKey, armored
+}
+
+// generatePluginArtifactContents generates file contents for a plugin artifact for testing purposes
+// If key is nil, signatures will carry a placeholder value
+func generatePluginArtifactContents(t *testing.T, pluginName, pluginVersion string, pluginType consts.PluginType,
+	includeBinarySig bool, privKey *crypto.Key,
+) map[string][]byte {
+	t.Helper()
+
+	metadata := PluginMetadata{
+		Version: "v0",
+		Plugin: Plugin{
+			Name:     pluginName,
+			Type:     pluginType,
+			Tier:     consts.PluginTierOfficial,
+			By:       "hashicorp",
+			Version:  pluginVersion,
+			Platform: runtime.GOOS,
+			Arch:     runtime.GOARCH,
+			PGPSig:   "signature-placeholder",
+		},
+	}
+	metadataBytes, err := json.Marshal(metadata)
+	assert.NoError(t, err)
+
+	pluginBytes := []byte("plugin-binary-placeholder")
+	metadataSigBytes := []byte("signature-placeholder")
+	pgp := crypto.PGP()
+	if privKey != nil {
+		signer, err := pgp.Sign().SigningKey(privKey).Detached().New()
+		defer signer.ClearPrivateParams()
+		assert.NoError(t, err)
+
+		// exclude binary signature for bad plugin signature read test
+		metadata.Plugin.PGPSig = ""
+		if includeBinarySig {
+			signature, err := signer.Sign(pluginBytes, crypto.Armor)
+			assert.NoError(t, err)
+
+			metadata.Plugin.PGPSig = string(signature)
+		}
+
+		metadataBytes, err = json.Marshal(metadata)
+		assert.NoError(t, err)
+
+		metadataSigBytes, err = signer.Sign(metadataBytes, crypto.Armor)
+		assert.NoError(t, err)
+	}
+
+	return map[string][]byte{
+		metadataFile: metadataBytes,
+		metadataSig:  metadataSigBytes,
+		pluginName:   pluginBytes,
+		"LICENSE":    []byte("license-placeholder"),
+	}
+}
diff --git a/vault/policy.go b/vault/policy.go
index 3f34d453114..22f362fd188 100644
--- a/vault/policy.go
+++ b/vault/policy.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -15,6 +15,7 @@ import (
 	"github.com/hashicorp/hcl/hcl/ast"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/sdk/helper/hclutil"
 	"github.com/hashicorp/vault/sdk/helper/identitytpl"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -32,6 +33,7 @@ const (
 	RootCapability      = "root"
 	PatchCapability     = "patch"
 	SubscribeCapability = "subscribe"
+	RecoverCapability   = "recover"
 
 	// Backwards compatibility
 	OldDenyPathPolicy  = "deny"
@@ -50,6 +52,7 @@ const (
 	SudoCapabilityInt
 	PatchCapabilityInt
 	SubscribeCapabilityInt
+	RecoverCapabilityInt
 )
 
 // Error constants for testing
@@ -93,6 +96,7 @@ var cap2Int = map[string]uint32{
 	SudoCapability:      SudoCapabilityInt,
 	PatchCapability:     PatchCapabilityInt,
 	SubscribeCapability: SubscribeCapabilityInt,
+	RecoverCapability:   RecoverCapabilityInt,
 }
 
 type egpPath struct {
@@ -289,6 +293,13 @@ func addGrantingPoliciesToMap(m map[uint32][]logical.PolicyInfo, policy *Policy,
 // intermediary set of policies, before being compiled into
 // the ACL
 func ParseACLPolicy(ns *namespace.Namespace, rules string) (*Policy, error) {
+	p, _, err := parseACLPolicyWithTemplating(ns, rules, false, nil, nil)
+	return p, err
+}
+
+// ParseACLPolicyCheckDuplicates is the same as the above but checks for duplicate attributes in the HCL policy
+// TODO (HCL_DUP_KEYS_DEPRECATION): remove this function once deprecation is done
+func ParseACLPolicyCheckDuplicates(ns *namespace.Namespace, rules string) (p *Policy, duplicate bool, err error) {
 	return parseACLPolicyWithTemplating(ns, rules, false, nil, nil)
 }
 
@@ -296,17 +307,18 @@ func ParseACLPolicy(ns *namespace.Namespace, rules string) (*Policy, error) {
 // should perform substitutions. If performTemplating is true we know that it
 // is templated so we don't check again, otherwise we check to see if it's a
 // templated policy.
-func parseACLPolicyWithTemplating(ns *namespace.Namespace, rules string, performTemplating bool, entity *identity.Entity, groups []*identity.Group) (*Policy, error) {
+func parseACLPolicyWithTemplating(ns *namespace.Namespace, rules string, performTemplating bool, entity *identity.Entity, groups []*identity.Group) (p *Policy, duplicate bool, err error) {
 	// Parse the rules
-	root, err := hcl.Parse(rules)
+	// TODO (HCL_DUP_KEYS_DEPRECATION): go back to a simple hcl.Parse and remove duplicate return value once deprecation is done
+	root, duplicate, err := random.ParseAndCheckForDuplicateHclAttributes(rules)
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse policy: %w", err)
+		return nil, duplicate, fmt.Errorf("failed to parse policy: %w", err)
 	}
 
 	// Top-level item should be the object list
 	list, ok := root.Node.(*ast.ObjectList)
 	if !ok {
-		return nil, fmt.Errorf("failed to parse policy: does not contain a root object")
+		return nil, duplicate, fmt.Errorf("failed to parse policy: does not contain a root object")
 	}
 
 	// Check for invalid top-level keys
@@ -315,26 +327,26 @@ func parseACLPolicyWithTemplating(ns *namespace.Namespace, rules string, perform
 		"path",
 	}
 	if err := hclutil.CheckHCLKeys(list, valid); err != nil {
-		return nil, fmt.Errorf("failed to parse policy: %w", err)
+		return nil, duplicate, fmt.Errorf("failed to parse policy: %w", err)
 	}
 
 	// Create the initial policy and store the raw text of the rules
-	p := Policy{
+	p = &Policy{
 		Raw:       rules,
 		Type:      PolicyTypeACL,
 		namespace: ns,
 	}
 	if err := hcl.DecodeObject(&p, list); err != nil {
-		return nil, fmt.Errorf("failed to parse policy: %w", err)
+		return nil, duplicate, fmt.Errorf("failed to parse policy: %w", err)
 	}
 
 	if o := list.Filter("path"); len(o.Items) > 0 {
-		if err := parsePaths(&p, o, performTemplating, entity, groups); err != nil {
-			return nil, fmt.Errorf("failed to parse policy: %w", err)
+		if err := parsePaths(p, o, performTemplating, entity, groups); err != nil {
+			return nil, duplicate, fmt.Errorf("failed to parse policy: %w", err)
 		}
 	}
 
-	return &p, nil
+	return p, duplicate, nil
 }
 
 func parsePaths(result *Policy, list *ast.ObjectList, performTemplating bool, entity *identity.Entity, groups []*identity.Group) error {
@@ -451,7 +463,7 @@ func parsePaths(result *Policy, list *ast.ObjectList, performTemplating bool, en
 				pc.Capabilities = []string{DenyCapability}
 				pc.Permissions.CapabilitiesBitmap = DenyCapabilityInt
 				goto PathFinished
-			case CreateCapability, ReadCapability, UpdateCapability, DeleteCapability, ListCapability, SudoCapability, PatchCapability, SubscribeCapability:
+			case CreateCapability, ReadCapability, UpdateCapability, DeleteCapability, ListCapability, SudoCapability, PatchCapability, SubscribeCapability, RecoverCapability:
 				pc.Permissions.CapabilitiesBitmap |= cap2Int[cap]
 			default:
 				return fmt.Errorf("path %q: invalid capability %q", key, cap)
diff --git a/vault/policy_store.go b/vault/policy_store.go
index a238be3c2d3..375499fae83 100644
--- a/vault/policy_store.go
+++ b/vault/policy_store.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -102,12 +102,6 @@ path "sys/internal/ui/resultant-acl" {
     capabilities = ["read"]
 }
 
-# Allow a token to look up the Vault version. This path is not subject to
-# redaction like the unauthenticated endpoints that provide the Vault version.
-path "sys/internal/ui/version" {
-	capabilities = ["read"]
-}
-
 # Allow a token to renew a lease via lease_id in the request body; old path for
 # old clients, new path for newer
 path "sys/renew" {
@@ -594,10 +588,13 @@ func (ps *PolicyStore) switchedGetPolicy(ctx context.Context, name string, polic
 	switch policyEntry.Type {
 	case PolicyTypeACL:
 		// Parse normally
-		p, err := ParseACLPolicy(ns, policyEntry.Raw)
+		p, duplicate, err := ParseACLPolicyCheckDuplicates(ns, policyEntry.Raw)
 		if err != nil {
 			return nil, fmt.Errorf("failed to parse policy: %w", err)
 		}
+		if duplicate {
+			ps.logger.Warn("HCL policy contains duplicate attributes, which will no longer be supported in a future version", "policy", policy.Name, "namespace", policy.namespace.Path)
+		}
 		policy.Paths = p.Paths
 
 		// Reset this in case they set the name in the policy itself
@@ -877,10 +874,13 @@ func (ps *PolicyStore) ACL(ctx context.Context, entity *identity.Entity, policyN
 					groups = append(directGroups, inheritedGroups...)
 				}
 			}
-			p, err := parseACLPolicyWithTemplating(policy.namespace, policy.Raw, true, entity, groups)
+			p, duplicate, err := parseACLPolicyWithTemplating(policy.namespace, policy.Raw, true, entity, groups)
 			if err != nil {
 				return nil, fmt.Errorf("error parsing templated policy %q: %w", policy.Name, err)
 			}
+			if duplicate {
+				ps.logger.Warn("HCL policy contains duplicate attributes, which will no longer be supported in a future version", "policy", policy.Name, "namespace", policy.namespace.Path)
+			}
 			p.Name = policy.Name
 			allPolicies[i] = p
 		}
diff --git a/vault/policy_store_test.go b/vault/policy_store_test.go
index e9b40f23fbe..8d1b4596f0a 100644
--- a/vault/policy_store_test.go
+++ b/vault/policy_store_test.go
@@ -1,14 +1,18 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
+	"bytes"
 	"context"
 	"reflect"
+	"sync"
 	"testing"
 
+	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/random"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/stretchr/testify/require"
 )
@@ -437,3 +441,57 @@ func TestPolicyStore_GetNonEGPPolicyType(t *testing.T) {
 		})
 	}
 }
+
+// TestPolicyStore_DuplicateAttributes checks the behaviour of the policyStore.ACL method when it finds a templated
+// policy with duplicate attributes
+// TODO (HCL_DUP_KEYS_DEPRECATION): change this test to expect an error. Will need to manually create the policy since
+// ParseACLPolicy will fail on duplicate attributes.
+func TestPolicyStore_DuplicateAttributes(t *testing.T) {
+	logOut := new(bytes.Buffer)
+	conf := &CoreConfig{
+		Logger: log.New(&log.LoggerOptions{
+			Mutex:  &sync.Mutex{},
+			Level:  log.Warn,
+			Output: logOut,
+		}),
+	}
+	core, _, _ := TestCoreUnsealedWithConfig(t, conf)
+	ps := core.policyStore
+	dupAttrPolicy := aclPolicy + `
+path "foo" {
+	capabilities = ["list"]
+	capabilities = ["read"]
+}
+`
+	t.Setenv(random.AllowHclDuplicatesEnvVar, "true")
+	policy, err := ParseACLPolicy(namespace.RootNamespace, dupAttrPolicy)
+	require.NoError(t, err)
+	// check that "list" and "read" get concatenated
+	require.Len(t, policy.Paths[len(policy.Paths)-1].Capabilities, 2)
+	policy.Templated = true
+	require.NoError(t, err)
+	ctx := namespace.RootContext(context.Background())
+	err = ps.SetPolicy(ctx, policy)
+	require.NoError(t, err)
+
+	logOut.Reset()
+	_, err = ps.ACL(ctx, nil, map[string][]string{namespace.RootNamespace.ID: {"dev", "ops"}})
+	require.NoError(t, err)
+	require.Contains(t, logOut.String(), "HCL policy contains duplicate attributes, which will no longer be supported in a future version")
+
+	ps.tokenPoliciesLRU.Purge()
+	logOut.Reset()
+	p, err := ps.GetPolicy(ctx, "dev", PolicyTypeACL)
+	require.NotNil(t, p)
+	require.NoError(t, err)
+	require.Contains(t, logOut.String(), "HCL policy contains duplicate attributes, which will no longer be supported in a future version")
+
+	t.Setenv(random.AllowHclDuplicatesEnvVar, "false")
+	_, err = ps.ACL(ctx, nil, map[string][]string{namespace.RootNamespace.ID: {"dev", "ops"}})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "error parsing templated policy \"dev\": failed to parse policy: The argument \"capabilities\" at 61:2 was already set. Each argument can only be defined once")
+	ps.tokenPoliciesLRU.Purge()
+	_, err = ps.GetPolicy(ctx, "dev", PolicyTypeACL)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "failed to parse policy: failed to parse policy: The argument \"capabilities\" at 61:2 was already set. Each argument can only be defined once")
+}
diff --git a/vault/policy_store_util.go b/vault/policy_store_util.go
index 45abf9b5c63..6ee3bb6e84e 100644
--- a/vault/policy_store_util.go
+++ b/vault/policy_store_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/policy_test.go b/vault/policy_test.go
index 862b767c825..e1448fef7fa 100644
--- a/vault/policy_test.go
+++ b/vault/policy_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -526,3 +526,19 @@ func TestPolicy_Subscribe_EventTypes(t *testing.T) {
 		t.Fatalf("ACLPermission should reflect subscribe event types, but got %v", policy.Paths[0].Permissions.SubscribeEventTypes)
 	}
 }
+
+// TestPolicy_Recover verifies that the recover capability can be used in a
+// policy, and that the capability is set in the capabilities bitmap.
+func TestPolicy_Recover(t *testing.T) {
+	policy, err := ParseACLPolicy(namespace.RootNamespace, strings.TrimSpace(`
+	path "secret/*" {
+		capabilities = ["recover"]
+	}
+	`))
+	if err != nil {
+		t.Fatalf("Policies should be able to use 'recover' capability")
+	}
+	if policy.Paths[0].Permissions.CapabilitiesBitmap&RecoverCapabilityInt == 0 {
+		t.Fatalf("Recover capability should be present in capabilities bitmap")
+	}
+}
diff --git a/vault/policy_util.go b/vault/policy_util.go
index 04c57daa9bd..8ed7cba3a58 100644
--- a/vault/policy_util.go
+++ b/vault/policy_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/quotas/leaseaction_enumer.go b/vault/quotas/leaseaction_enumer.go
new file mode 100644
index 00000000000..114ece18cf0
--- /dev/null
+++ b/vault/quotas/leaseaction_enumer.go
@@ -0,0 +1,52 @@
+// Code generated by "enumer -type=LeaseAction -trimprefix=LeaseAction -transform=snake"; DO NOT EDIT.
+
+package quotas
+
+import (
+	"fmt"
+)
+
+const _LeaseActionName = "unknownloadedcreateddeletedallow"
+
+var _LeaseActionIndex = [...]uint8{0, 7, 13, 20, 27, 32}
+
+func (i LeaseAction) String() string {
+	if i >= LeaseAction(len(_LeaseActionIndex)-1) {
+		return fmt.Sprintf("LeaseAction(%d)", i)
+	}
+	return _LeaseActionName[_LeaseActionIndex[i]:_LeaseActionIndex[i+1]]
+}
+
+var _LeaseActionValues = []LeaseAction{0, 1, 2, 3, 4}
+
+var _LeaseActionNameToValueMap = map[string]LeaseAction{
+	_LeaseActionName[0:7]:   0,
+	_LeaseActionName[7:13]:  1,
+	_LeaseActionName[13:20]: 2,
+	_LeaseActionName[20:27]: 3,
+	_LeaseActionName[27:32]: 4,
+}
+
+// LeaseActionString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func LeaseActionString(s string) (LeaseAction, error) {
+	if val, ok := _LeaseActionNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to LeaseAction values", s)
+}
+
+// LeaseActionValues returns all values of the enum
+func LeaseActionValues() []LeaseAction {
+	return _LeaseActionValues
+}
+
+// IsALeaseAction returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i LeaseAction) IsALeaseAction() bool {
+	for _, v := range _LeaseActionValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/vault/quotas/quotas.go b/vault/quotas/quotas.go
index bbd456b2566..0abfee69568 100644
--- a/vault/quotas/quotas.go
+++ b/vault/quotas/quotas.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package quotas
@@ -30,28 +30,15 @@ const (
 	TypeLeaseCount Type = "lease-count"
 )
 
+//go:generate enumer -type=LeaseAction -trimprefix=LeaseAction -transform=snake
+
 // LeaseAction is the action taken by the expiration manager on the lease. The
 // quota manager will use this information to update the lease path cache and
 // updating counters for relevant quota rules.
 type LeaseAction uint32
 
-// String converts each lease action into its string equivalent value
-func (la LeaseAction) String() string {
-	switch la {
-	case LeaseActionLoaded:
-		return "loaded"
-	case LeaseActionCreated:
-		return "created"
-	case LeaseActionDeleted:
-		return "deleted"
-	case LeaseActionAllow:
-		return "allow"
-	}
-	return "unknown"
-}
-
 const (
-	_ LeaseAction = iota
+	LeaseActionUnknown LeaseAction = iota
 
 	// LeaseActionLoaded indicates loading of lease in the expiration manager after
 	// unseal.
@@ -83,6 +70,22 @@ func (q Type) String() string {
 	return "unknown"
 }
 
+// GroupBy identifies the attribute by which a rate limit quota rule will group the requests
+type GroupBy string
+
+const (
+	// GroupByIp groups requests to which the RLQ applies by the client IP address
+	GroupByIp = "ip"
+	// GroupByNone groups all requests to which the RLQ applies together (i.e. collective rate limit)
+	GroupByNone = "none"
+	// GroupByEntityThenIp groups requests to which the RLQ applies by entity Id if available, otherwise
+	// by the client IP address (e.g. login or root token requests)
+	GroupByEntityThenIp = "entity_then_ip"
+	// GroupByEntityThenNone groups requests to which the RLQ applies by entity Id if available, and all
+	// entity-less requests together (e.g. login or root token requests)
+	GroupByEntityThenNone = "entity_then_none"
+)
+
 const (
 	indexID                 = "id"
 	indexName               = "name"
@@ -282,6 +285,8 @@ type Request struct {
 	// ClientAddress is client unique addressable string (e.g. IP address). It can
 	// be empty if the quota type does not need it.
 	ClientAddress string
+
+	entRateLimitRequest
 }
 
 // NewManager creates and initializes a new quota manager to hold all the quota
diff --git a/vault/quotas/quotas_rate_limit.go b/vault/quotas/quotas_rate_limit.go
index a648f92d1a4..3392e1d3025 100644
--- a/vault/quotas/quotas_rate_limit.go
+++ b/vault/quotas/quotas_rate_limit.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package quotas
@@ -6,6 +6,7 @@ package quotas
 import (
 	"context"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"math"
 	"strconv"
@@ -35,6 +36,8 @@ const (
 	EnvVaultEnableRateLimitAuditLogging = "VAULT_ENABLE_RATE_LIMIT_AUDIT_LOGGING"
 )
 
+var ErrGroupByNotSupported = errors.New("group_by mode is not supported in community edition")
+
 // Ensure that RateLimitQuota implements the Quota interface
 var _ Quota = (*RateLimitQuota)(nil)
 
@@ -50,6 +53,9 @@ type RateLimitQuota struct {
 	// Name of the quota rule
 	Name string `json:"name"`
 
+	// GroupBy is the grouping mode for the rate limit quota, defaulting to IP grouping if unset.
+	GroupBy GroupBy `json:"group_by"`
+
 	// NamespacePath is the path of the namespace to which this quota is
 	// applicable.
 	NamespacePath string `json:"namespace_path"`
@@ -70,6 +76,10 @@ type RateLimitQuota struct {
 	// Rate defines the number of requests allowed per Interval.
 	Rate float64 `json:"rate"`
 
+	// SecondaryRate is only available when GroupBy is set to GroupByEntityThenIp or GroupByEntityThenNone, defining the
+	// number of requests allowed per Interval for the secondary groups.
+	SecondaryRate float64 `json:"secondary_rate"`
+
 	// Interval defines the duration to which rate limiting is applied.
 	Interval time.Duration `json:"interval"`
 
@@ -87,6 +97,7 @@ type RateLimitQuota struct {
 	blockedClients      sync.Map
 	purgeBlocked        bool
 	closePurgeBlockedCh chan struct{}
+	entRateLimitQuota
 }
 
 func (q *RateLimitQuota) GetNamespacePath() string {
@@ -98,7 +109,7 @@ func (q *RateLimitQuota) GetNamespacePath() string {
 // provided, which will default to 1s when initialized. An optional block
 // duration may be provided, where if set, when a client reaches the rate limit,
 // subsequent requests will fail until the block duration has passed.
-func NewRateLimitQuota(name, nsPath, mountPath, pathSuffix, role string, inheritable bool, interval, block time.Duration, rate float64) *RateLimitQuota {
+func NewRateLimitQuota(name, nsPath, mountPath, pathSuffix, role string, groupBy GroupBy, inheritable bool, interval, block time.Duration, rate, secondaryRate float64) *RateLimitQuota {
 	id, err := uuid.GenerateUUID()
 	if err != nil {
 		// Fall back to generating with a hash of the name, later in initialize
@@ -108,12 +119,14 @@ func NewRateLimitQuota(name, nsPath, mountPath, pathSuffix, role string, inherit
 		Name:          name,
 		ID:            id,
 		Type:          TypeRateLimit,
+		GroupBy:       groupBy,
 		NamespacePath: nsPath,
 		MountPath:     mountPath,
 		Role:          role,
 		PathSuffix:    pathSuffix,
 		Inheritable:   inheritable,
 		Rate:          rate,
+		SecondaryRate: secondaryRate,
 		Interval:      interval,
 		BlockInterval: block,
 		purgeInterval: DefaultRateLimitPurgeInterval,
@@ -219,7 +232,7 @@ func (rlq *RateLimitQuota) initialize(logger log.Logger, ms *metricsutil.Cluster
 		go rlq.purgeBlockedClients()
 	}
 
-	return nil
+	return rlq.initializeEnt()
 }
 
 // purgeBlockedClients performs a blocking process where every purgeInterval
@@ -301,6 +314,8 @@ func (rlq *RateLimitQuota) allow(ctx context.Context, req *Request) (Response, e
 	}
 
 	if req.ClientAddress == "" {
+		// we might not need the IP address depending on the group_by mode, but it's always available so it's better
+		// to make it an invariant
 		return resp, fmt.Errorf("missing request client address in quota request")
 	}
 
@@ -313,25 +328,34 @@ func (rlq *RateLimitQuota) allow(ctx context.Context, req *Request) (Response, e
 		}
 	}()
 
+	key, isSecondaryGroup, err := rlq.getGroupKey(req)
+	if err != nil {
+		if errors.Is(err, ErrGroupByNotSupported) {
+			rlq.logger.Warn("found unsupported group_by mode in rate limited quota, ignoring it", "group_by", rlq.GroupBy, "Name", rlq.Name)
+			return resp, nil
+		}
+		return resp, err
+	}
+
 	// Check if the client is currently blocked and if so, deny the request. Note,
 	// we cannot simply rely on the presence of the client in the map as the timing
 	// of purging blocked clients may not yield a false negative. In other words,
 	// a client may no longer be considered blocked whereas the purging interval
 	// has yet to run.
-	if v, ok := rlq.blockedClients.Load(req.ClientAddress); ok {
+	if v, ok := rlq.blockedClients.Load(key); ok {
 		blockedAt := v.(time.Time)
 		if time.Since(blockedAt) >= rlq.BlockInterval {
 			// allow the request and remove the blocked client
-			rlq.blockedClients.Delete(req.ClientAddress)
+			rlq.blockedClients.Delete(key)
 		} else {
 			// deny the request and return early
 			resp.Allowed = false
-			retryAfter = strconv.Itoa(int(time.Until(blockedAt.Add(rlq.BlockInterval)).Seconds()))
+			retryAfter = rlq.retryAfterSeconds(time.Now(), blockedAt.Add(rlq.BlockInterval))
 			return resp, nil
 		}
 	}
 
-	limit, remaining, reset, allow, err := rlq.store.Take(ctx, req.ClientAddress)
+	limit, remaining, reset, allow, err := rlq.take(ctx, key, isSecondaryGroup)
 	if err != nil {
 		return resp, err
 	}
@@ -339,20 +363,24 @@ func (rlq *RateLimitQuota) allow(ctx context.Context, req *Request) (Response, e
 	resp.Allowed = allow
 	resp.Headers[httplimit.HeaderRateLimitLimit] = strconv.FormatUint(limit, 10)
 	resp.Headers[httplimit.HeaderRateLimitRemaining] = strconv.FormatUint(remaining, 10)
-	resp.Headers[httplimit.HeaderRateLimitReset] = strconv.Itoa(int(time.Until(time.Unix(0, int64(reset))).Seconds()))
+	resp.Headers[httplimit.HeaderRateLimitReset] = rlq.retryAfterSeconds(time.Now(), time.Unix(0, int64(reset)))
 	retryAfter = resp.Headers[httplimit.HeaderRateLimitReset]
 
 	// If the request is not allowed (i.e. rate limit threshold reached) and blocking
 	// is enabled, we add the client to the set of blocked clients.
 	if !resp.Allowed && rlq.purgeBlocked {
 		blockedAt := time.Now()
-		retryAfter = strconv.Itoa(int(time.Until(blockedAt.Add(rlq.BlockInterval)).Seconds()))
-		rlq.blockedClients.Store(req.ClientAddress, blockedAt)
+		retryAfter = rlq.retryAfterSeconds(time.Now(), blockedAt.Add(rlq.BlockInterval))
+		rlq.blockedClients.Store(key, blockedAt)
 	}
 
 	return resp, nil
 }
 
+func (rlq *RateLimitQuota) retryAfterSeconds(now, waitUntil time.Time) string {
+	return strconv.Itoa(int(math.Ceil(waitUntil.Sub(now).Seconds())))
+}
+
 // close stops the current running client purge loop.
 // It should be called with the write lock held.
 func (rlq *RateLimitQuota) close(ctx context.Context) error {
@@ -361,10 +389,12 @@ func (rlq *RateLimitQuota) close(ctx context.Context) error {
 	}
 
 	if rlq.store != nil {
-		return rlq.store.Close(ctx)
+		if err := rlq.store.Close(ctx); err != nil {
+			return err
+		}
 	}
 
-	return nil
+	return rlq.closeEnt(ctx)
 }
 
 func (rlq *RateLimitQuota) handleRemount(mountpath, nspath string) {
diff --git a/vault/quotas/quotas_rate_limit_oss.go b/vault/quotas/quotas_rate_limit_oss.go
new file mode 100644
index 00000000000..fe413de0f69
--- /dev/null
+++ b/vault/quotas/quotas_rate_limit_oss.go
@@ -0,0 +1,32 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package quotas
+
+import "context"
+
+type entRateLimitRequest struct{}
+
+type entRateLimitQuota struct{}
+
+// getGroupKey returns the identifier to the request for rate limiting purposes. On CE we only support IP-based grouping.
+func (rlq *RateLimitQuota) getGroupKey(req *Request) (key string, isSecondaryGroup bool, err error) {
+	if rlq.GroupBy != "" && rlq.GroupBy != GroupByIp {
+		return "", false, ErrGroupByNotSupported
+	}
+	return req.ClientAddress, false, nil
+}
+
+func (rlq *RateLimitQuota) take(ctx context.Context, key string, isSecondaryGroup bool) (tokens, remaining, reset uint64, allow bool, err error) {
+	return rlq.store.Take(ctx, key)
+}
+
+func (rlq *RateLimitQuota) initializeEnt() error {
+	return nil
+}
+
+func (rlq *RateLimitQuota) closeEnt(ctx context.Context) error {
+	return nil
+}
diff --git a/vault/quotas/quotas_rate_limit_test.go b/vault/quotas/quotas_rate_limit_test.go
index 8c474c2f314..14ed50b587a 100644
--- a/vault/quotas/quotas_rate_limit_test.go
+++ b/vault/quotas/quotas_rate_limit_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package quotas
@@ -14,10 +14,8 @@ import (
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/sdk/helper/logging"
-	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/atomic"
-	"go.uber.org/goleak"
 )
 
 type clientResult struct {
@@ -31,7 +29,7 @@ func TestNewRateLimitQuota(t *testing.T) {
 		rlq       *RateLimitQuota
 		expectErr bool
 	}{
-		{"valid rate", NewRateLimitQuota("test-rate-limiter", "qa", "/foo/bar", "", "", false, time.Second, 0, 16.7), false},
+		{"valid rate", NewRateLimitQuota("test-rate-limiter", "qa", "/foo/bar", "", "", GroupByIp, false, time.Second, 0, 16.7, 0), false},
 	}
 
 	for _, tc := range testCases {
@@ -48,7 +46,7 @@ func TestNewRateLimitQuota(t *testing.T) {
 }
 
 func TestRateLimitQuota_Close(t *testing.T) {
-	rlq := NewRateLimitQuota("test-rate-limiter", "qa", "/foo/bar", "", "", false, time.Second, time.Minute, 16.7)
+	rlq := NewRateLimitQuota("test-rate-limiter", "qa", "/foo/bar", "", "", GroupByIp, false, time.Second, 0, 16.7, 0)
 	require.NoError(t, rlq.initialize(logging.NewVaultLogger(log.Trace), metricsutil.BlackholeSink()))
 	require.NoError(t, rlq.close(context.Background()))
 
@@ -217,17 +215,20 @@ func TestRateLimitQuota_Allow_WithBlock(t *testing.T) {
 	}()
 }
 
-func TestRateLimitQuota_Update(t *testing.T) {
-	defer goleak.VerifyNone(t)
-	qm, err := NewManager(logging.NewVaultLogger(log.Trace), nil, metricsutil.BlackholeSink(), true)
-	require.NoError(t, err)
-
-	view := &logical.InmemStorage{}
-	require.NoError(t, qm.Setup(context.Background(), view, nil))
-
-	quota := NewRateLimitQuota("quota1", "", "", "", "", false, time.Second, 0, 10)
-	require.NoError(t, qm.SetQuota(context.Background(), TypeRateLimit.String(), quota, true))
-	require.NoError(t, qm.SetQuota(context.Background(), TypeRateLimit.String(), quota, true))
-
-	require.Nil(t, quota.close(context.Background()))
+// TestRateLimitQuota_retryAfterSeconds tests the that retryAfterSeconds rounds
+// up the number of seconds until the block ends
+func TestRateLimitQuota_retryAfterSeconds(t *testing.T) {
+	quota := NewRateLimitQuota("quota1", "", "", "", "", GroupByIp, false, time.Second, 0, 10, 0)
+	now := time.Now()
+	t.Run("less than 1", func(t *testing.T) {
+		blockedUntil := time.Now().Add(200 * time.Millisecond)
+		retryAfter := quota.retryAfterSeconds(now, blockedUntil)
+		require.Equal(t, "1", retryAfter)
+	})
+
+	t.Run("more than 1", func(t *testing.T) {
+		blockedUntil := time.Now().Add(1300 * time.Millisecond)
+		retryAfter := quota.retryAfterSeconds(now, blockedUntil)
+		require.Equal(t, "2", retryAfter)
+	})
 }
diff --git a/vault/quotas/quotas_test.go b/vault/quotas/quotas_test.go
index 3f7929ce630..f3993e1c899 100644
--- a/vault/quotas/quotas_test.go
+++ b/vault/quotas/quotas_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package quotas
@@ -23,7 +23,7 @@ func TestQuotas_MountPathOverwrite(t *testing.T) {
 	view := &logical.InmemStorage{}
 	require.NoError(t, qm.Setup(context.Background(), view, nil))
 
-	quota := NewRateLimitQuota("tq", "", "kv1/", "", "", false, time.Second, 0, 10)
+	quota := NewRateLimitQuota("tq", "", "kv1/", "", "", GroupByIp, false, time.Second, 0, 10, 0)
 	require.NoError(t, qm.SetQuota(context.Background(), TypeRateLimit.String(), quota, false))
 	quota = quota.Clone().(*RateLimitQuota)
 	quota.MountPath = "kv2/"
@@ -52,7 +52,7 @@ func TestQuotas_Precedence(t *testing.T) {
 
 	setQuotaFunc := func(t *testing.T, name, nsPath, mountPath, pathSuffix, role string, inheritable bool) Quota {
 		t.Helper()
-		quota := NewRateLimitQuota(name, nsPath, mountPath, pathSuffix, role, inheritable, time.Second, 0, 10)
+		quota := NewRateLimitQuota(name, nsPath, mountPath, pathSuffix, role, GroupByIp, inheritable, time.Second, 0, 10, 0)
 		require.NoError(t, qm.SetQuota(context.Background(), TypeRateLimit.String(), quota, true))
 		return quota
 	}
@@ -167,7 +167,7 @@ func TestQuotas_QueryResolveRole_RateLimitQuotas(t *testing.T) {
 	require.False(t, required)
 
 	// Create a non-role-based RLQ on mount1/ and make sure it doesn't require role resolution
-	rlq := NewRateLimitQuota("tq", rlqReq.NamespacePath, rlqReq.MountPath, rlqReq.Path, rlqReq.Role, false, 1*time.Minute, 10*time.Second, 10)
+	rlq := NewRateLimitQuota("tq", rlqReq.NamespacePath, rlqReq.MountPath, rlqReq.Path, rlqReq.Role, GroupByIp, false, 1*time.Minute, 0, 10, 0)
 	require.NoError(t, qm.SetQuota(context.Background(), TypeRateLimit.String(), rlq, false))
 
 	required, err = qm.QueryResolveRoleQuotas(rlqReq)
@@ -176,7 +176,7 @@ func TestQuotas_QueryResolveRole_RateLimitQuotas(t *testing.T) {
 
 	// Create a role-based RLQ on mount1/ and make sure it requires role resolution
 	rlqReq.Role = "test"
-	rlq = NewRateLimitQuota("tq", rlqReq.NamespacePath, rlqReq.MountPath, rlqReq.Path, rlqReq.Role, false, 1*time.Minute, 10*time.Second, 10)
+	rlq = NewRateLimitQuota("tq", rlqReq.NamespacePath, rlqReq.MountPath, rlqReq.Path, rlqReq.Role, GroupByIp, false, 1*time.Minute, 0, 10, 0)
 	require.NoError(t, qm.SetQuota(context.Background(), TypeRateLimit.String(), rlq, false))
 
 	required, err = qm.QueryResolveRoleQuotas(rlqReq)
diff --git a/vault/quotas/quotas_util.go b/vault/quotas/quotas_util.go
index 728a82e8b24..ad38336757b 100644
--- a/vault/quotas/quotas_util.go
+++ b/vault/quotas/quotas_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/raft.go b/vault/raft.go
index abc7a4acaf3..74bf14eae2e 100644
--- a/vault/raft.go
+++ b/vault/raft.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -8,6 +8,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"net/url"
 	"strings"
@@ -15,16 +16,18 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-cleanhttp"
 	"github.com/hashicorp/go-discover"
 	discoverk8s "github.com/hashicorp/go-discover/provider/k8s"
 	"github.com/hashicorp/go-hclog"
-	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	"github.com/hashicorp/go-secure-stdlib/tlsutil"
 	"github.com/hashicorp/go-uuid"
 	goversion "github.com/hashicorp/go-version"
+	lru "github.com/hashicorp/golang-lru/v2"
+	raftlib "github.com/hashicorp/raft"
 	"github.com/hashicorp/vault/api"
+	httpPriority "github.com/hashicorp/vault/http/priority"
+	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/physical/raft"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -34,6 +37,9 @@ import (
 )
 
 const (
+	RaftInitialChallengeLimit = 20 // allow an initial burst to 20
+	RaftChallengesPerSecond   = 5  // equating to an average 200ms min time
+
 	// undoLogMonitorInterval is how often the leader checks to see
 	// if all the cluster members it knows about are new enough to support
 	// undo logs.
@@ -48,11 +54,18 @@ var (
 	raftTLSStoragePath    = "core/raft/tls"
 	raftTLSRotationPeriod = 24 * time.Hour
 
-	raftAutopilotConfigurationStoragePath = "core/raft/autopilot/configuration"
+	raftAutopilotConfigurationStoragePath  = "core/raft/autopilot/configuration"
+	raftAutopilotPersistedStateStoragePath = "core/raft/autopilot/state"
 
 	ErrJoinWithoutAutoloading = errors.New("attempt to join a cluster using autoloaded licenses while not using autoloading ourself")
 )
 
+type raftBootstrapChallenge struct {
+	serverID  string
+	answer    []byte // the random answer
+	challenge []byte // the Sealed answer
+}
+
 // GetRaftNodeID returns the raft node ID if there is one, or an empty string if there's not
 func (c *Core) GetRaftNodeID() string {
 	rb := c.getRaftBackend()
@@ -149,9 +162,11 @@ func (c *Core) startRaftBackend(ctx context.Context) (retErr error) {
 		raftBackend.SetRestoreCallback(c.raftSnapshotRestoreCallback(true, true))
 
 		if err := raftBackend.SetupCluster(ctx, raft.SetupOpts{
-			TLSKeyring:      raftTLS,
-			ClusterListener: c.getClusterListener(),
-			StartAsLeader:   creating,
+			TLSKeyring:          raftTLS,
+			ClusterListener:     c.getClusterListener(),
+			StartAsLeader:       creating,
+			EffectiveSDKVersion: c.effectiveSDKVersion,
+			RemovedCallback:     c.shutdownRemovedNode,
 		}); err != nil {
 			return err
 		}
@@ -309,9 +324,12 @@ func (c *Core) setupRaftActiveNode(ctx context.Context) error {
 	}
 
 	c.logger.Info("starting raft active node")
-	raftBackend.SetEffectiveSDKVersion(c.effectiveSDKVersion)
 
-	c.pendingRaftPeers = &sync.Map{}
+	var err error
+	c.pendingRaftPeers, err = lru.New[string, *raftBootstrapChallenge](RaftInitialChallengeLimit)
+	if err != nil {
+		return err
+	}
 
 	// Reload the raft TLS keys to ensure we are using the latest version.
 	if err := c.checkRaftTLSKeyUpgrades(ctx); err != nil {
@@ -327,6 +345,8 @@ func (c *Core) setupRaftActiveNode(ctx context.Context) error {
 	// Run the verifier if we're configured to do so
 	raftBackend.StartRaftWalVerifier(ctx)
 
+	// Starting this here will prepopulate the raft follower states with our current raft configuration, but that
+	// doesn't include information like upgrade versions or redundancy zones.
 	if err := c.startPeriodicRaftTLSRotate(ctx); err != nil {
 		return err
 	}
@@ -336,10 +356,42 @@ func (c *Core) setupRaftActiveNode(ctx context.Context) error {
 		c.logger.Error("failed to load autopilot config from storage when setting up cluster; continuing since autopilot falls back to default config", "error", err)
 	}
 	disableAutopilot := c.disableAutopilot
-	raftBackend.SetupAutopilot(c.activeContext, autopilotConfig, c.raftFollowerStates, disableAutopilot)
+	persistedState, err := c.autopilotPersistedState()
+	if err != nil {
+		c.logger.Error("failed to load autopilot persisted state from storage", "error", err)
+	}
+	raftBackend.SetupAutopilot(c.activeContext, &raft.AutopilotSetupOptions{
+		StorageConfig:       autopilotConfig,
+		FollowerStates:      c.raftFollowerStates,
+		Disable:             disableAutopilot,
+		PersistedStates:     persistedState,
+		SavePersistedStates: c.saveAutopilotPersistedState,
+	})
 	return nil
 }
 
+func (c *Core) autopilotPersistedState() (map[string]raft.PersistedFollowerState, error) {
+	entry, err := c.barrier.Get(c.activeContext, raftAutopilotPersistedStateStoragePath)
+	if err != nil {
+		return nil, err
+	}
+	var m map[string]raft.PersistedFollowerState
+	if entry == nil {
+		return m, nil
+	}
+
+	err = entry.DecodeJSON(&m)
+	return m, err
+}
+
+func (c *Core) saveAutopilotPersistedState(states map[string]raft.PersistedFollowerState) error {
+	entry, err := logical.StorageEntryJSON(raftAutopilotPersistedStateStoragePath, states)
+	if err != nil {
+		return err
+	}
+	return c.barrier.Put(httpPriority.ContextWithRequestPriority(c.activeContext, httpPriority.NeverDrop), entry)
+}
+
 func (c *Core) stopRaftActiveNode() {
 	raftBackend := c.getRaftBackend()
 	if raftBackend == nil {
@@ -494,6 +546,7 @@ func (c *Core) raftTLSRotatePhased(ctx context.Context, logger hclog.Logger, raf
 	if err != nil {
 		return err
 	}
+
 	for _, server := range raftConfig.Servers {
 		if server.NodeID != raftBackend.NodeID() {
 			followerStates.Update(&raft.EchoRequestUpdate{
@@ -713,7 +766,12 @@ func (c *Core) raftCreateTLSKeyring(ctx context.Context) (*raft.TLSKeyring, erro
 	}
 
 	if raftTLSEntry != nil {
-		return nil, fmt.Errorf("TLS keyring already present")
+		// For Raft storage, the keyring should already be there, but
+		// for situations with non-Raft storage and Raft HA, we can ignore this,
+		// as it will need to be remade.
+		if _, usingRaftStorage := c.underlyingPhysical.(*raft.RaftBackend); usingRaftStorage {
+			return nil, fmt.Errorf("TLS keyring already present")
+		}
 	}
 
 	raftTLS, err := raft.GenerateTLSKey(c.secureRandomReader)
@@ -846,6 +904,10 @@ func (c *Core) raftSnapshotRestoreCallback(grabLock bool, sealNode bool) func(co
 			return err
 		}
 
+		// Reset the namespace cache so that any namespaces cached
+		// before the snapshot restore will no longer be present.
+		c.resetNamespaceCache()
+
 		return nil
 	}
 }
@@ -873,6 +935,12 @@ func (c *Core) InitiateRetryJoin(ctx context.Context) error {
 	c.logger.Info("raft retry join initiated")
 
 	if _, err = c.JoinRaftCluster(ctx, leaderInfos, raftBackend.NonVoter()); err != nil {
+		// If the node has been removed, we should continue to startup but in
+		// the removed state
+		if errors.Is(err, errRemovedHANode) {
+			c.logger.Error("failed to join raft cluster", "error", err)
+			return nil
+		}
 		return err
 	}
 
@@ -954,8 +1022,8 @@ func (c *Core) getRaftChallenge(leaderInfo *raft.LeaderJoinInfo) (*raftInformati
 		return nil, err
 	}
 
-	if sealConfig.Type != c.seal.BarrierSealConfigType().String() {
-		return nil, fmt.Errorf("mismatching seal types between raft leader (%s) and follower (%s)", sealConfig.Type, c.seal.BarrierSealConfigType())
+	if !CompatibleSealTypes(sealConfig.Type, c.seal.BarrierSealConfigType().String()) {
+		return nil, fmt.Errorf("incompatible seal types between raft leader (%s) and follower (%s)", sealConfig.Type, c.seal.BarrierSealConfigType())
 	}
 
 	challengeB64, ok := secret.Data["challenge"]
@@ -967,13 +1035,8 @@ func (c *Core) getRaftChallenge(leaderInfo *raft.LeaderJoinInfo) (*raftInformati
 		return nil, fmt.Errorf("error decoding raft bootstrap challenge: %w", err)
 	}
 
-	eBlob := &wrapping.BlobInfo{}
-	if err := proto.Unmarshal(challengeRaw, eBlob); err != nil {
-		return nil, fmt.Errorf("error decoding raft bootstrap challenge: %w", err)
-	}
-
 	return &raftInformation{
-		challenge:           eBlob,
+		challenge:           challengeRaw,
 		leaderClient:        apiClient,
 		leaderBarrierConfig: &sealConfig,
 	}, nil
@@ -991,6 +1054,13 @@ func (c *Core) JoinRaftCluster(ctx context.Context, leaderInfos []*raft.LeaderJo
 	}
 
 	isRaftHAOnly := c.isRaftHAOnly()
+	if raftBackend.IsRemoved() {
+		if isRaftHAOnly {
+			return false, fmt.Errorf("%w. Raft data for this node must be cleaned up before it can be added back", errRemovedHANode)
+		} else {
+			return false, fmt.Errorf("%w. All vault data for this node must be cleaned up before it can be added back", errRemovedHANode)
+		}
+	}
 	// Prevent join from happening if we're using raft for storage and
 	// it has already been initialized.
 	if init && !isRaftHAOnly {
@@ -1224,17 +1294,15 @@ func (c *Core) raftLeaderInfo(leaderInfo *raft.LeaderJoinInfo, disco *discover.D
 			// default to 8200 when no port is provided
 			port = 8200
 		}
-		// Addrs returns either IPv4 or IPv6 address, without scheme or port
+		// Addrs returns either IPv4 or IPv6 address, without scheme and most of them without port
+		// IPv6 can be explicit such as "[::1]" or implicit "::1"
 		clusterIPs, err := disco.Addrs(leaderInfo.AutoJoin, c.logger.StandardLogger(nil))
 		if err != nil {
 			return nil, fmt.Errorf("failed to parse addresses from auto-join metadata: %w", err)
 		}
 		for _, ip := range clusterIPs {
-			if strings.Count(ip, ":") >= 2 && !strings.HasPrefix(ip, "[") {
-				// An IPv6 address in implicit form, however we need it in explicit form to use in a URL.
-				ip = fmt.Sprintf("[%s]", ip)
-			}
-			u := fmt.Sprintf("%s://%s:%d", scheme, ip, port)
+			addr := formatDiscoveredAddr(ip, port)
+			u := configutil.NormalizeAddr(fmt.Sprintf("%s://%s", scheme, addr))
 			info := *leaderInfo
 			info.LeaderAPIAddr = u
 			ret = append(ret, &info)
@@ -1248,7 +1316,30 @@ func (c *Core) raftLeaderInfo(leaderInfo *raft.LeaderJoinInfo, disco *discover.D
 
 // NewDelegateForCore creates a raft.Delegate for the specified core using its backend.
 func NewDelegateForCore(c *Core) *raft.Delegate {
-	return raft.NewDelegate(c.getRaftBackend())
+	persistedState, err := c.autopilotPersistedState()
+	if err != nil {
+		c.logger.Error("failed to load autopilot persisted state from storage", "error", err)
+	}
+	return raft.NewDelegate(c.getRaftBackend(), persistedState, c.saveAutopilotPersistedState)
+}
+
+func (c *Core) ReloadRaftConfig(config map[string]string) error {
+	rb := c.getRaftBackend()
+	if rb == nil {
+		return nil
+	}
+	raftConfig := raftlib.DefaultConfig()
+	if err := raft.ApplyConfigSettings(c.logger, config, raftConfig); err != nil {
+		return err
+	}
+	rlconfig := raftlib.ReloadableConfig{
+		TrailingLogs:      raftConfig.TrailingLogs,
+		SnapshotInterval:  raftConfig.SnapshotInterval,
+		SnapshotThreshold: raftConfig.SnapshotThreshold,
+		HeartbeatTimeout:  raftConfig.HeartbeatTimeout,
+		ElectionTimeout:   raftConfig.ElectionTimeout,
+	}
+	return rb.ReloadConfig(rlconfig)
 }
 
 // getRaftBackend returns the RaftBackend from the HA or physical backend,
@@ -1289,15 +1380,6 @@ func (c *Core) joinRaftSendAnswer(ctx context.Context, sealAccess seal.Access, r
 		return errors.New("raft is already initialized")
 	}
 
-	multiWrapValue := &seal.MultiWrapValue{
-		Generation: sealAccess.Generation(),
-		Slots:      []*wrapping.BlobInfo{raftInfo.challenge},
-	}
-	plaintext, _, err := sealAccess.Decrypt(ctx, multiWrapValue, nil)
-	if err != nil {
-		return fmt.Errorf("error decrypting challenge: %w", err)
-	}
-
 	parsedClusterAddr, err := url.Parse(c.ClusterAddr())
 	if err != nil {
 		return fmt.Errorf("error parsing cluster address: %w", err)
@@ -1313,12 +1395,20 @@ func (c *Core) joinRaftSendAnswer(ctx context.Context, sealAccess seal.Access, r
 		}
 	}
 
+	sealer := NewSealAccessSealer(sealAccess, c.logger, "bootstrap_challenge_read")
+	plaintext, err := sealer.Open(context.Background(), raftInfo.challenge)
+	if err != nil {
+		return fmt.Errorf("error decrypting challenge: %w", err)
+	}
+
 	answerReq := raftInfo.leaderClient.NewRequest("PUT", "/v1/sys/storage/raft/bootstrap/answer")
 	if err := answerReq.SetJSONBody(map[string]interface{}{
-		"answer":       base64.StdEncoding.EncodeToString(plaintext),
-		"cluster_addr": clusterAddr,
-		"server_id":    raftBackend.NodeID(),
-		"non_voter":    raftInfo.nonVoter,
+		"answer":          base64.StdEncoding.EncodeToString(plaintext),
+		"cluster_addr":    clusterAddr,
+		"server_id":       raftBackend.NodeID(),
+		"non_voter":       raftInfo.nonVoter,
+		"sdk_version":     raftBackend.SDKVersion(),
+		"upgrade_version": raftBackend.UpgradeVersion(),
 	}); err != nil {
 		return err
 	}
@@ -1352,6 +1442,7 @@ func (c *Core) joinRaftSendAnswer(ctx context.Context, sealAccess seal.Access, r
 	opts := raft.SetupOpts{
 		TLSKeyring:      answerResp.Data.TLSKeyring,
 		ClusterListener: c.getClusterListener(),
+		RemovedCallback: c.shutdownRemovedNode,
 	}
 	err = raftBackend.SetupCluster(ctx, opts)
 	if err != nil {
@@ -1407,7 +1498,8 @@ func (c *Core) RaftBootstrap(ctx context.Context, onInit bool) error {
 	}
 
 	raftOpts := raft.SetupOpts{
-		StartAsLeader: true,
+		StartAsLeader:   true,
+		RemovedCallback: c.shutdownRemovedNode,
 	}
 
 	if !onInit {
@@ -1434,6 +1526,22 @@ func (c *Core) isRaftUnseal() bool {
 	return c.raftInfo.Load().(*raftInformation) != nil
 }
 
+// RaftDataDirPath returns the string path to the raft data directory and true,
+// or an empty string and false if it fails to find it or if the value is an empty string.
+func (c *Core) RaftDataDirPath() (string, bool) {
+	raftStorage, ok := c.underlyingPhysical.(*raft.RaftBackend)
+	if !ok {
+		return "", false
+	}
+	config := raftStorage.GetStorageConfig()
+
+	path, ok := config["path"]
+	if !ok || path == "" {
+		return "", false
+	}
+	return path, true
+}
+
 type answerRespData struct {
 	Data answerResp `json:"data"`
 }
@@ -1456,3 +1564,19 @@ func newDiscover() (*discover.Discover, error) {
 		discover.WithProviders(providers),
 	)
 }
+
+// formatDiscoveredAddr joins ip and port if addr does not already contain a port
+func formatDiscoveredAddr(addr string, defaultPort uint) string {
+	// addr is an implicit IPv6 address
+	if !strings.HasPrefix(addr, "[") && strings.Count(addr, ":") > 1 {
+		return fmt.Sprintf("[%s]:%d", addr, defaultPort)
+	}
+	ip, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return fmt.Sprintf("%s:%d", addr, defaultPort)
+	}
+	if strings.ContainsRune(ip, ':') {
+		ip = fmt.Sprintf("[%s]", ip)
+	}
+	return fmt.Sprintf("%s:%s", ip, port)
+}
diff --git a/vault/raft_test.go b/vault/raft_test.go
new file mode 100644
index 00000000000..d82009533e2
--- /dev/null
+++ b/vault/raft_test.go
@@ -0,0 +1,33 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package vault
+
+import (
+	"testing"
+)
+
+// TestFormatDiscoveredAddr validates that the string returned by formatDiscoveredAddr always respect the format `host:port`.
+func TestFormatDiscoveredAddr(t *testing.T) {
+	type TestCase struct {
+		addr string
+		port uint
+		res  string
+	}
+	cases := []TestCase{
+		{addr: "127.0.0.1", port: uint(8200), res: "127.0.0.1:8200"},
+		{addr: "192.168.137.1:8201", port: uint(8200), res: "192.168.137.1:8201"},
+		{addr: "fe80::aa5e:45ff:fe54:c6ce", port: uint(8200), res: "[fe80::aa5e:45ff:fe54:c6ce]:8200"},
+		{addr: "::1", port: uint(8200), res: "[::1]:8200"},
+		{addr: "[::1]", port: uint(8200), res: "[::1]:8200"},
+		{addr: "[::1]:8201", port: uint(8200), res: "[::1]:8201"},
+		{addr: "[fe80::aa5e:45ff:fe54:c6ce]", port: uint(8200), res: "[fe80::aa5e:45ff:fe54:c6ce]:8200"},
+		{addr: "[fe80::aa5e:45ff:fe54:c6ce]:8201", port: uint(8200), res: "[fe80::aa5e:45ff:fe54:c6ce]:8201"},
+	}
+	for i, c := range cases {
+		res := formatDiscoveredAddr(c.addr, c.port)
+		if res != c.res {
+			t.Errorf("case %d result shoud be \"%s\" but is \"%s\"", i, c.res, res)
+		}
+	}
+}
diff --git a/vault/rekey.go b/vault/rekey.go
index 1f254eb0d7f..e808e6c8918 100644
--- a/vault/rekey.go
+++ b/vault/rekey.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -11,6 +11,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"time"
 
 	aeadwrapper "github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2"
 	"github.com/hashicorp/go-uuid"
@@ -236,6 +237,7 @@ func (c *Core) BarrierRekeyInit(config *SealConfig) logical.HTTPCodedError {
 		return logical.CodedError(http.StatusInternalServerError, fmt.Errorf("error generating nonce for procedure: %w", err).Error())
 	}
 	c.barrierRekeyConfig.Nonce = nonce
+	c.barrierRekeyConfig.Created = time.Now().UTC()
 
 	if c.logger.IsInfo() {
 		c.logger.Info("rekey initialized", "nonce", c.barrierRekeyConfig.Nonce, "shares", c.barrierRekeyConfig.SecretShares, "threshold", c.barrierRekeyConfig.SecretThreshold, "validation_required", c.barrierRekeyConfig.VerificationRequired)
@@ -286,6 +288,7 @@ func (c *Core) RecoveryRekeyInit(config *SealConfig) logical.HTTPCodedError {
 		return logical.CodedError(http.StatusInternalServerError, fmt.Errorf("error generating nonce for procedure: %w", err).Error())
 	}
 	c.recoveryRekeyConfig.Nonce = nonce
+	c.recoveryRekeyConfig.Created = time.Now().UTC()
 
 	if c.logger.IsInfo() {
 		c.logger.Info("rekey initialized", "nonce", c.recoveryRekeyConfig.Nonce, "shares", c.recoveryRekeyConfig.SecretShares, "threshold", c.recoveryRekeyConfig.SecretThreshold, "validation_required", c.recoveryRekeyConfig.VerificationRequired)
@@ -910,7 +913,7 @@ func (c *Core) RekeyVerify(ctx context.Context, key []byte, nonce string, recove
 }
 
 // RekeyCancel is used to cancel an in-progress rekey
-func (c *Core) RekeyCancel(recovery bool) logical.HTTPCodedError {
+func (c *Core) RekeyCancel(recovery bool, nonce string, requiresNonceDeadline time.Duration) logical.HTTPCodedError {
 	c.stateLock.RLock()
 	defer c.stateLock.RUnlock()
 	if c.Sealed() {
@@ -923,10 +926,26 @@ func (c *Core) RekeyCancel(recovery bool) logical.HTTPCodedError {
 	c.rekeyLock.Lock()
 	defer c.rekeyLock.Unlock()
 
+	validBarrierReq := func() bool {
+		return c.barrierRekeyConfig.Nonce == nonce ||
+			rekeyCancelDeadlineIsMet(c.barrierRekeyConfig.Created, requiresNonceDeadline)
+	}
+
+	validRecoveryReq := func() bool {
+		return c.recoveryRekeyConfig.Nonce == nonce ||
+			rekeyCancelDeadlineIsMet(c.recoveryRekeyConfig.Created, requiresNonceDeadline)
+	}
+
 	// Clear any progress or config
 	if recovery {
+		if c.recoveryRekeyConfig != nil && !validRecoveryReq() {
+			return logical.CodedError(http.StatusBadRequest, "invalid request")
+		}
 		c.recoveryRekeyConfig = nil
 	} else {
+		if c.barrierRekeyConfig != nil && !validBarrierReq() {
+			return logical.CodedError(http.StatusBadRequest, "invalid request")
+		}
 		c.barrierRekeyConfig = nil
 	}
 	return nil
@@ -1031,3 +1050,11 @@ func (c *Core) RekeyDeleteBackup(ctx context.Context, recovery bool) logical.HTT
 	}
 	return nil
 }
+
+func rekeyCancelDeadlineIsMet(created time.Time, deadline time.Duration) bool {
+	if created.IsZero() {
+		return false
+	}
+	passed := time.Now().UTC().Sub(created) >= deadline
+	return passed
+}
diff --git a/vault/rekey_test.go b/vault/rekey_test.go
index 246042ea89a..c99b25374af 100644
--- a/vault/rekey_test.go
+++ b/vault/rekey_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -8,13 +8,16 @@ import (
 	"fmt"
 	"reflect"
 	"strings"
+	"sync"
 	"testing"
+	"time"
 
 	log "github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/vault/sdk/helper/logging"
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/sdk/physical/inmem"
 	"github.com/hashicorp/vault/vault/seal"
+	"github.com/stretchr/testify/require"
 )
 
 func TestCore_Rekey_Lifecycle(t *testing.T) {
@@ -57,7 +60,7 @@ func testCore_Rekey_Lifecycle_Common(t *testing.T, c *Core, recovery bool) {
 	}
 
 	// Cancel should be idempotent
-	err = c.RekeyCancel(false)
+	err = c.RekeyCancel(false, "", 10*time.Minute)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -83,7 +86,7 @@ func testCore_Rekey_Lifecycle_Common(t *testing.T, c *Core, recovery bool) {
 	}
 
 	// Cancel should be clear
-	err = c.RekeyCancel(recovery)
+	err = c.RekeyCancel(recovery, conf.Nonce, 10*time.Minute)
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -548,3 +551,195 @@ func TestSysRekey_Verification_Invalid(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 }
+
+// TestCancelRekey_Nonce verifies that cancelling a rekey operation requires a
+// nonce
+func TestCancelRekey_Nonce(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		recovery bool
+		config   *SealConfig
+		core     func(t *testing.T) *Core
+	}{
+		{
+			recovery: true,
+			config: &SealConfig{
+				SecretShares:    1,
+				SecretThreshold: 1,
+				Type:            string(SealConfigTypeMultiseal),
+			},
+			core: func(t *testing.T) *Core {
+				c, _, _, _ := TestCoreUnsealedWithConfigSealOpts(t,
+					&SealConfig{StoredShares: 1, SecretShares: 1, SecretThreshold: 1},
+					&SealConfig{StoredShares: 1, SecretShares: 1, SecretThreshold: 1},
+					&seal.TestSealOpts{StoredKeys: seal.StoredKeysSupportedGeneric})
+				return c
+			},
+		},
+		{
+			recovery: false,
+			config: &SealConfig{
+				SecretShares:    1,
+				SecretThreshold: 1,
+				StoredShares:    1,
+				Type:            string(SealConfigTypeShamir),
+			},
+			core: func(t *testing.T) *Core {
+				c, _, _ := TestCoreUnsealed(t)
+				return c
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.config.Type, func(t *testing.T) {
+			c := tc.core(t)
+			// bail if recovery rekey is not supported
+			if tc.recovery && !c.seal.RecoveryKeySupported() {
+				t.Skip(t, "recovery rekey not supported")
+			}
+
+			err := c.RekeyInit(tc.config, tc.recovery)
+			require.NoError(t, err, "rekey init failed")
+
+			// try to cancel without the nonce
+			err = c.RekeyCancel(tc.recovery, "", 10*time.Minute)
+			require.Error(t, err, "cancel should have errored")
+
+			// retrieve the nonce
+			var nonce string
+			c.stateLock.RLock()
+			c.rekeyLock.RLock()
+			if tc.recovery {
+				nonce = c.recoveryRekeyConfig.Nonce
+			} else {
+				nonce = c.barrierRekeyConfig.Nonce
+			}
+			c.rekeyLock.RUnlock()
+			c.stateLock.RUnlock()
+
+			require.NotEmpty(t, nonce, "nonce missing")
+
+			// cancel successfully
+			err = c.RekeyCancel(tc.recovery, nonce, 10*time.Minute)
+			require.NoError(t, err, "error on rekey cancel")
+		})
+	}
+}
+
+// TestCancelRekey_Regression creates 50 cancel requests in parallel and then
+// starts a rekey operation. The test verifies that the spammed cancel requests
+// are not able to cancel the rekey, because they do not provide a nonce.
+func TestCancelRekey_Regression(t *testing.T) {
+	t.Parallel()
+	testCases := []struct {
+		recovery bool
+		config   *SealConfig
+		core     func(t *testing.T) *Core
+	}{
+		{
+			recovery: true,
+			config: &SealConfig{
+				SecretShares:    1,
+				SecretThreshold: 1,
+				Type:            string(SealConfigTypeMultiseal),
+			},
+			core: func(t *testing.T) *Core {
+				c, _, _, _ := TestCoreUnsealedWithConfigSealOpts(t,
+					&SealConfig{StoredShares: 1, SecretShares: 1, SecretThreshold: 1},
+					&SealConfig{StoredShares: 1, SecretShares: 1, SecretThreshold: 1},
+					&seal.TestSealOpts{StoredKeys: seal.StoredKeysSupportedGeneric})
+				return c
+			},
+		},
+		{
+			recovery: false,
+			config: &SealConfig{
+				SecretShares:    1,
+				SecretThreshold: 1,
+				StoredShares:    1,
+				Type:            string(SealConfigTypeShamir),
+			},
+			core: func(t *testing.T) *Core {
+				c, _, _ := TestCoreUnsealed(t)
+				return c
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.config.Type, func(t *testing.T) {
+			c := tc.core(t)
+			wg := sync.WaitGroup{}
+			for i := 0; i < 50; i++ {
+				wg.Add(1)
+				go func() {
+					defer wg.Done()
+					c.RekeyCancel(tc.recovery, "", 10*time.Minute)
+				}()
+			}
+			err := c.RekeyInit(tc.config, tc.recovery)
+			require.NoError(t, err)
+
+			wg.Wait()
+			happening, keys, err := c.RekeyProgress(tc.recovery, false)
+			require.NoError(t, err)
+			require.True(t, happening)
+			require.Equal(t, 0, keys)
+		})
+	}
+}
+
+// TestCancelRekey_AfterDeadline verifies that cancelling a rekey after the deadline
+// does not require a nonce.
+func TestCancelRekey_AfterDeadline(t *testing.T) {
+	testCases := []struct {
+		recovery bool
+		config   *SealConfig
+		core     func(t *testing.T) *Core
+	}{
+		{
+			recovery: true,
+			config: &SealConfig{
+				SecretShares:    1,
+				SecretThreshold: 1,
+				Type:            string(SealConfigTypeMultiseal),
+			},
+			core: func(t *testing.T) *Core {
+				c, _, _, _ := TestCoreUnsealedWithConfigSealOpts(t,
+					&SealConfig{StoredShares: 1, SecretShares: 1, SecretThreshold: 1},
+					&SealConfig{StoredShares: 1, SecretShares: 1, SecretThreshold: 1},
+					&seal.TestSealOpts{StoredKeys: seal.StoredKeysSupportedGeneric})
+				return c
+			},
+		},
+		{
+			recovery: false,
+			config: &SealConfig{
+				SecretShares:    1,
+				SecretThreshold: 1,
+				StoredShares:    1,
+				Type:            string(SealConfigTypeShamir),
+			},
+			core: func(t *testing.T) *Core {
+				c, _, _ := TestCoreUnsealed(t)
+				return c
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.config.Type, func(t *testing.T) {
+			c := tc.core(t)
+			err := c.RekeyInit(tc.config, tc.recovery)
+			require.NoError(t, err)
+
+			// ensure that that 10 ms have passed before we cancel
+			time.Sleep(10 * time.Millisecond)
+			// set the deadline to a microsecond, which means we won't need a
+			// nonce to cancel the rekey
+			err = c.RekeyCancel(tc.recovery, "", time.Microsecond)
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/vault/reload_seal_stubs_oss.go b/vault/reload_seal_stubs_oss.go
index 6bf03ae1961..3b9aaced601 100644
--- a/vault/reload_seal_stubs_oss.go
+++ b/vault/reload_seal_stubs_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -13,5 +13,6 @@ import (
 
 //go:generate go run github.com/hashicorp/vault/tools/stubmaker
 
-func (c *Core) reloadSealsEnt(secureRandomReader io.Reader, sealAccess Seal, logger hclog.Logger, shouldRewrap bool) {
+func (c *Core) reloadSealsEnt(secureRandomReader io.Reader, sealAccess Seal, logger hclog.Logger, shouldRewrap bool) error {
+	return nil
 }
diff --git a/vault/replication/cluster.go b/vault/replication/cluster.go
index 72d80f2e4e6..3a4c0533097 100644
--- a/vault/replication/cluster.go
+++ b/vault/replication/cluster.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/request_forwarding.go b/vault/request_forwarding.go
index 619222c344a..52afe662d1a 100644
--- a/vault/request_forwarding.go
+++ b/vault/request_forwarding.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -22,13 +22,116 @@ import (
 	"github.com/hashicorp/vault/helper/forwarding"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/vault/cluster"
 	"github.com/hashicorp/vault/vault/replication"
 	"golang.org/x/net/http2"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/keepalive"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
 )
 
+var (
+	NotHAMember       = "node is not in HA cluster membership"
+	StatusNotHAMember = status.Error(codes.FailedPrecondition, NotHAMember)
+)
+
+const haNodeIDKey = "ha_node_id"
+
+func haIDFromContext(ctx context.Context) (string, bool) {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return "", false
+	}
+	res := md.Get(haNodeIDKey)
+	if len(res) == 0 {
+		return "", false
+	}
+	return res[0], true
+}
+
+// haMembershipServerCheck extracts the client's HA node ID from the context
+// and checks if this client has been removed. The function returns
+// StatusNotHAMember if the client has been removed
+func haMembershipServerCheck(ctx context.Context, c *Core, haBackend physical.RemovableNodeHABackend) error {
+	if haBackend == nil {
+		return nil
+	}
+	nodeID, ok := haIDFromContext(ctx)
+	if !ok {
+		return nil
+	}
+	removed, err := haBackend.IsNodeRemoved(ctx, nodeID)
+	if err != nil {
+		c.logger.Error("failed to check if node is removed", "error", err)
+		return err
+	}
+	if removed {
+		return StatusNotHAMember
+	}
+	return nil
+}
+
+func haMembershipUnaryServerInterceptor(c *Core, haBackend physical.RemovableNodeHABackend) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp any, err error) {
+		err = haMembershipServerCheck(ctx, c, haBackend)
+		if err != nil {
+			return nil, err
+		}
+		return handler(ctx, req)
+	}
+}
+
+func haMembershipStreamServerInterceptor(c *Core, haBackend physical.RemovableNodeHABackend) grpc.StreamServerInterceptor {
+	return func(srv any, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		err := haMembershipServerCheck(ss.Context(), c, haBackend)
+		if err != nil {
+			return err
+		}
+		return handler(srv, ss)
+	}
+}
+
+// haMembershipClientCheck checks if the given error from the server
+// is StatusNotHAMember. If so, the client will mark itself as removed
+// and shutdown
+func haMembershipClientCheck(err error, c *Core, haBackend physical.RemovableNodeHABackend) {
+	if !errors.Is(err, StatusNotHAMember) {
+		return
+	}
+	removeErr := haBackend.RemoveSelf()
+	if removeErr != nil {
+		c.logger.Debug("failed to remove self", "error", removeErr)
+	}
+	c.shutdownRemovedNode()
+}
+
+func haMembershipUnaryClientInterceptor(c *Core, haBackend physical.RemovableNodeHABackend) grpc.UnaryClientInterceptor {
+	return func(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
+		if haBackend == nil {
+			return invoker(ctx, method, req, reply, cc, opts...)
+		}
+		ctx = metadata.AppendToOutgoingContext(ctx, haNodeIDKey, haBackend.NodeID())
+		err := invoker(ctx, method, req, reply, cc, opts...)
+		haMembershipClientCheck(err, c, haBackend)
+		return err
+	}
+}
+
+func haMembershipStreamClientInterceptor(c *Core, haBackend physical.RemovableNodeHABackend) grpc.StreamClientInterceptor {
+	return func(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
+		if haBackend == nil {
+			return streamer(ctx, desc, cc, method, opts...)
+		}
+		ctx = metadata.AppendToOutgoingContext(ctx, haNodeIDKey, haBackend.NodeID())
+		stream, err := streamer(ctx, desc, cc, method, opts...)
+		haMembershipClientCheck(err, c, haBackend)
+		return stream, err
+	}
+}
+
 type requestForwardingHandler struct {
 	fws         *http2.Server
 	fwRPCServer *grpc.Server
@@ -47,6 +150,7 @@ type requestForwardingClusterClient struct {
 func NewRequestForwardingHandler(c *Core, fws *http2.Server, perfStandbySlots chan struct{}, perfStandbyRepCluster *replication.Cluster) (*requestForwardingHandler, error) {
 	// Resolve locally to avoid races
 	ha := c.ha != nil
+	removableHABackend := c.getRemovableHABackend()
 
 	fwRPCServer := grpc.NewServer(
 		grpc.KeepaliveParams(keepalive.ServerParameters{
@@ -54,6 +158,8 @@ func NewRequestForwardingHandler(c *Core, fws *http2.Server, perfStandbySlots ch
 		}),
 		grpc.MaxRecvMsgSize(math.MaxInt32),
 		grpc.MaxSendMsgSize(math.MaxInt32),
+		grpc.StreamInterceptor(haMembershipStreamServerInterceptor(c, removableHABackend)),
+		grpc.UnaryInterceptor(haMembershipUnaryServerInterceptor(c, removableHABackend)),
 	)
 
 	if ha && c.clusterHandler != nil {
@@ -274,6 +380,8 @@ func (c *Core) refreshRequestForwardingConnection(ctx context.Context, clusterAd
 		core: c,
 	})
 
+	removableHABackend := c.getRemovableHABackend()
+
 	// Set up grpc forwarding handling
 	// It's not really insecure, but we have to dial manually to get the
 	// ALPN header right. It's just "insecure" because GRPC isn't managing
@@ -285,6 +393,8 @@ func (c *Core) refreshRequestForwardingConnection(ctx context.Context, clusterAd
 		grpc.WithKeepaliveParams(keepalive.ClientParameters{
 			Time: 2 * c.clusterHeartbeatInterval,
 		}),
+		grpc.WithStreamInterceptor(haMembershipStreamClientInterceptor(c, removableHABackend)),
+		grpc.WithUnaryInterceptor(haMembershipUnaryClientInterceptor(c, removableHABackend)),
 		grpc.WithDefaultCallOptions(
 			grpc.MaxCallRecvMsgSize(math.MaxInt32),
 			grpc.MaxCallSendMsgSize(math.MaxInt32),
@@ -332,6 +442,7 @@ func (c *Core) clearForwardingClients() {
 		clusterListener.RemoveClient(consts.RequestForwardingALPN)
 	}
 	c.clusterLeaderParams.Store((*ClusterLeaderParams)(nil))
+	c.rpcLastSuccessfulHeartbeat.Store(time.Time{})
 }
 
 // ForwardRequest forwards a given request to the active node and returns the
@@ -374,6 +485,10 @@ func (c *Core) ForwardRequest(req *http.Request) (int, http.Header, []byte, erro
 	if err != nil {
 		metrics.IncrCounter([]string{"ha", "rpc", "client", "forward", "errors"}, 1)
 		c.logger.Error("error during forwarded RPC request", "error", err)
+
+		if errors.Is(err, StatusNotHAMember) {
+			return 0, nil, nil, fmt.Errorf("error during forwarding RPC request: %w", err)
+		}
 		return 0, nil, nil, fmt.Errorf("error during forwarding RPC request")
 	}
 
diff --git a/vault/request_forwarding_rpc.go b/vault/request_forwarding_rpc.go
index 8b82b767d02..6b4abc18245 100644
--- a/vault/request_forwarding_rpc.go
+++ b/vault/request_forwarding_rpc.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -74,32 +74,43 @@ func (s *forwardedRequestRPCServer) ForwardRequest(ctx context.Context, freq *fo
 }
 
 type nodeHAConnectionInfo struct {
-	nodeInfo        *NodeInformation
-	lastHeartbeat   time.Time
-	version         string
-	upgradeVersion  string
-	redundancyZone  string
-	localTime       time.Time
-	echoDuration    time.Duration
-	clockSkewMillis int64
+	nodeInfo             *NodeInformation
+	lastHeartbeat        time.Time
+	version              string
+	upgradeVersion       string
+	redundancyZone       string
+	localTime            time.Time
+	echoDuration         time.Duration
+	clockSkewMillis      int64
+	replicationLagMillis int64
 }
 
 func (s *forwardedRequestRPCServer) Echo(ctx context.Context, in *EchoRequest) (*EchoReply, error) {
 	incomingNodeConnectionInfo := nodeHAConnectionInfo{
-		nodeInfo:        in.NodeInfo,
-		lastHeartbeat:   time.Now(),
-		version:         in.SdkVersion,
-		upgradeVersion:  in.RaftUpgradeVersion,
-		redundancyZone:  in.RaftRedundancyZone,
-		localTime:       in.Now.AsTime(),
-		echoDuration:    in.LastRoundtripTime.AsDuration(),
-		clockSkewMillis: in.ClockSkewMillis,
+		nodeInfo:             in.NodeInfo,
+		lastHeartbeat:        time.Now(),
+		version:              in.SdkVersion,
+		upgradeVersion:       in.RaftUpgradeVersion,
+		redundancyZone:       in.RaftRedundancyZone,
+		localTime:            in.Now.AsTime(),
+		echoDuration:         in.LastRoundtripTime.AsDuration(),
+		clockSkewMillis:      in.ClockSkewMillis,
+		replicationLagMillis: in.ReplicationPrimaryCanaryAgeMillis,
 	}
 	if in.ClusterAddr != "" {
 		s.core.clusterPeerClusterAddrsCache.Set(in.ClusterAddr, incomingNodeConnectionInfo, 0)
 	}
 
 	if in.RaftAppliedIndex > 0 && len(in.RaftNodeID) > 0 && s.raftFollowerStates != nil {
+		s.core.logger.Trace("forwarding RPC: echo received",
+			"node_id", in.RaftNodeID,
+			"applied_index", in.RaftAppliedIndex,
+			"term", in.RaftTerm,
+			"desired_suffrage", in.RaftDesiredSuffrage,
+			"sdk_version", in.SdkVersion,
+			"upgrade_version", in.RaftUpgradeVersion,
+			"redundancy_zone", in.RaftRedundancyZone)
+
 		s.raftFollowerStates.Update(&raft.EchoRequestUpdate{
 			NodeID:          in.RaftNodeID,
 			AppliedIndex:    in.RaftAppliedIndex,
@@ -150,12 +161,13 @@ func (c *forwardingClient) startHeartbeat() {
 			defer metrics.MeasureSinceWithLabels([]string{"ha", "rpc", "client", "echo"}, time.Now(), labels)
 
 			req := &EchoRequest{
-				Message:           "ping",
-				ClusterAddr:       clusterAddr,
-				NodeInfo:          &ni,
-				SdkVersion:        c.core.effectiveSDKVersion,
-				LastRoundtripTime: durationpb.New(echoDuration),
-				ClockSkewMillis:   serverTimeDelta,
+				Message:                           "ping",
+				ClusterAddr:                       clusterAddr,
+				NodeInfo:                          &ni,
+				SdkVersion:                        c.core.effectiveSDKVersion,
+				LastRoundtripTime:                 durationpb.New(echoDuration),
+				ClockSkewMillis:                   serverTimeDelta,
+				ReplicationPrimaryCanaryAgeMillis: c.core.GetReplicationLagMillisIgnoreErrs(),
 			}
 
 			if raftBackend := c.core.getRaftBackend(); raftBackend != nil {
@@ -164,7 +176,7 @@ func (c *forwardingClient) startHeartbeat() {
 				req.RaftTerm = raftBackend.Term()
 				req.RaftDesiredSuffrage = raftBackend.DesiredSuffrage()
 				req.RaftRedundancyZone = raftBackend.RedundancyZone()
-				req.RaftUpgradeVersion = raftBackend.EffectiveVersion()
+				req.RaftUpgradeVersion = raftBackend.UpgradeVersion()
 				labels = append(labels, metrics.Label{Name: "peer_id", Value: raftBackend.NodeID()})
 			}
 
@@ -189,6 +201,7 @@ func (c *forwardingClient) startHeartbeat() {
 				c.core.logger.Debug("forwarding: error sending echo request to active node", "error", err)
 				return
 			}
+			c.core.rpcLastSuccessfulHeartbeat.Store(now)
 			if resp == nil {
 				c.core.logger.Debug("forwarding: empty echo response from active node")
 				return
@@ -202,6 +215,9 @@ func (c *forwardingClient) startHeartbeat() {
 			atomic.StoreUint32(c.core.activeNodeReplicationState, resp.ReplicationState)
 		}
 
+		// store a value before the first tick to indicate that we've started
+		// sending heartbeats
+		c.core.rpcLastSuccessfulHeartbeat.Store(time.Now())
 		tick()
 
 		for {
diff --git a/vault/request_forwarding_rpc_util.go b/vault/request_forwarding_rpc_util.go
index 8923a652f7c..6883a790d92 100644
--- a/vault/request_forwarding_rpc_util.go
+++ b/vault/request_forwarding_rpc_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/request_forwarding_service.pb.go b/vault/request_forwarding_service.pb.go
index 9402692e090..17379a89137 100644
--- a/vault/request_forwarding_service.pb.go
+++ b/vault/request_forwarding_service.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: vault/request_forwarding_service.proto
 
@@ -17,6 +17,7 @@ import (
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -27,11 +28,8 @@ const (
 )
 
 type EchoRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Message string `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
+	state   protoimpl.MessageState `protogen:"open.v1"`
+	Message string                 `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
 	// ClusterAddr is used to send up a standby node's address to the active
 	// node upon heartbeat
 	ClusterAddr string `protobuf:"bytes,2,opt,name=cluster_addr,json=clusterAddr,proto3" json:"cluster_addr,omitempty"`
@@ -50,16 +48,17 @@ type EchoRequest struct {
 	// last_roundtrip_time is the time taken for the last echo request
 	LastRoundtripTime *durationpb.Duration `protobuf:"bytes,13,opt,name=last_roundtrip_time,json=lastRoundtripTime,proto3" json:"last_roundtrip_time,omitempty"`
 	// clock_skew_millis is the server time minus the local time
-	ClockSkewMillis int64 `protobuf:"varint,14,opt,name=clock_skew_millis,json=clockSkewMillis,proto3" json:"clock_skew_millis,omitempty"`
+	ClockSkewMillis                   int64 `protobuf:"varint,14,opt,name=clock_skew_millis,json=clockSkewMillis,proto3" json:"clock_skew_millis,omitempty"`
+	ReplicationPrimaryCanaryAgeMillis int64 `protobuf:"varint,15,opt,name=replication_primary_canary_age_millis,json=replicationPrimaryCanaryAgeMillis,proto3" json:"replication_primary_canary_age_millis,omitempty"`
+	unknownFields                     protoimpl.UnknownFields
+	sizeCache                         protoimpl.SizeCache
 }
 
 func (x *EchoRequest) Reset() {
 	*x = EchoRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_request_forwarding_service_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_request_forwarding_service_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EchoRequest) String() string {
@@ -70,7 +69,7 @@ func (*EchoRequest) ProtoMessage() {}
 
 func (x *EchoRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_request_forwarding_service_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -183,28 +182,32 @@ func (x *EchoRequest) GetClockSkewMillis() int64 {
 	return 0
 }
 
-type EchoReply struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *EchoRequest) GetReplicationPrimaryCanaryAgeMillis() int64 {
+	if x != nil {
+		return x.ReplicationPrimaryCanaryAgeMillis
+	}
+	return 0
+}
 
-	Message          string           `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
-	ClusterAddrs     []string         `protobuf:"bytes,2,rep,name=cluster_addrs,json=clusterAddrs,proto3" json:"cluster_addrs,omitempty"`
-	ReplicationState uint32           `protobuf:"varint,3,opt,name=replication_state,json=replicationState,proto3" json:"replication_state,omitempty"`
-	RaftAppliedIndex uint64           `protobuf:"varint,4,opt,name=raft_applied_index,json=raftAppliedIndex,proto3" json:"raft_applied_index,omitempty"`
-	RaftNodeID       string           `protobuf:"bytes,5,opt,name=raft_node_id,json=raftNodeId,proto3" json:"raft_node_id,omitempty"`
-	NodeInfo         *NodeInformation `protobuf:"bytes,6,opt,name=node_info,json=nodeInfo,proto3" json:"node_info,omitempty"`
+type EchoReply struct {
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	Message          string                 `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
+	ClusterAddrs     []string               `protobuf:"bytes,2,rep,name=cluster_addrs,json=clusterAddrs,proto3" json:"cluster_addrs,omitempty"`
+	ReplicationState uint32                 `protobuf:"varint,3,opt,name=replication_state,json=replicationState,proto3" json:"replication_state,omitempty"`
+	RaftAppliedIndex uint64                 `protobuf:"varint,4,opt,name=raft_applied_index,json=raftAppliedIndex,proto3" json:"raft_applied_index,omitempty"`
+	RaftNodeID       string                 `protobuf:"bytes,5,opt,name=raft_node_id,json=raftNodeId,proto3" json:"raft_node_id,omitempty"`
+	NodeInfo         *NodeInformation       `protobuf:"bytes,6,opt,name=node_info,json=nodeInfo,proto3" json:"node_info,omitempty"`
 	// now is the time on the server
-	Now *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=now,proto3" json:"now,omitempty"`
+	Now           *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=now,proto3" json:"now,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *EchoReply) Reset() {
 	*x = EchoReply{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_request_forwarding_service_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_request_forwarding_service_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EchoReply) String() string {
@@ -215,7 +218,7 @@ func (*EchoReply) ProtoMessage() {}
 
 func (x *EchoReply) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_request_forwarding_service_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -280,25 +283,22 @@ func (x *EchoReply) GetNow() *timestamppb.Timestamp {
 }
 
 type NodeInformation struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	ClusterAddr      string `protobuf:"bytes,1,opt,name=cluster_addr,json=clusterAddr,proto3" json:"cluster_addr,omitempty"`
-	ApiAddr          string `protobuf:"bytes,2,opt,name=api_addr,json=apiAddr,proto3" json:"api_addr,omitempty"`
-	Mode             string `protobuf:"bytes,3,opt,name=mode,proto3" json:"mode,omitempty"`
-	NodeID           string `protobuf:"bytes,4,opt,name=node_id,json=nodeId,proto3" json:"node_id,omitempty"`
-	ReplicationState uint32 `protobuf:"varint,5,opt,name=replication_state,json=replicationState,proto3" json:"replication_state,omitempty"`
-	Hostname         string `protobuf:"bytes,6,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	ClusterAddr      string                 `protobuf:"bytes,1,opt,name=cluster_addr,json=clusterAddr,proto3" json:"cluster_addr,omitempty"`
+	ApiAddr          string                 `protobuf:"bytes,2,opt,name=api_addr,json=apiAddr,proto3" json:"api_addr,omitempty"`
+	Mode             string                 `protobuf:"bytes,3,opt,name=mode,proto3" json:"mode,omitempty"`
+	NodeID           string                 `protobuf:"bytes,4,opt,name=node_id,json=nodeId,proto3" json:"node_id,omitempty"`
+	ReplicationState uint32                 `protobuf:"varint,5,opt,name=replication_state,json=replicationState,proto3" json:"replication_state,omitempty"`
+	Hostname         string                 `protobuf:"bytes,6,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *NodeInformation) Reset() {
 	*x = NodeInformation{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_request_forwarding_service_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_request_forwarding_service_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *NodeInformation) String() string {
@@ -309,7 +309,7 @@ func (*NodeInformation) ProtoMessage() {}
 
 func (x *NodeInformation) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_request_forwarding_service_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -367,23 +367,20 @@ func (x *NodeInformation) GetHostname() string {
 }
 
 type ClientKey struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Type          string                 `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	X             []byte                 `protobuf:"bytes,2,opt,name=x,proto3" json:"x,omitempty"`
+	Y             []byte                 `protobuf:"bytes,3,opt,name=y,proto3" json:"y,omitempty"`
+	D             []byte                 `protobuf:"bytes,4,opt,name=d,proto3" json:"d,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
-	X    []byte `protobuf:"bytes,2,opt,name=x,proto3" json:"x,omitempty"`
-	Y    []byte `protobuf:"bytes,3,opt,name=y,proto3" json:"y,omitempty"`
-	D    []byte `protobuf:"bytes,4,opt,name=d,proto3" json:"d,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *ClientKey) Reset() {
 	*x = ClientKey{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_request_forwarding_service_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_request_forwarding_service_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *ClientKey) String() string {
@@ -394,7 +391,7 @@ func (*ClientKey) ProtoMessage() {}
 
 func (x *ClientKey) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_request_forwarding_service_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -438,18 +435,16 @@ func (x *ClientKey) GetD() []byte {
 }
 
 type PerfStandbyElectionInput struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *PerfStandbyElectionInput) Reset() {
 	*x = PerfStandbyElectionInput{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_request_forwarding_service_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_request_forwarding_service_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *PerfStandbyElectionInput) String() string {
@@ -460,7 +455,7 @@ func (*PerfStandbyElectionInput) ProtoMessage() {}
 
 func (x *PerfStandbyElectionInput) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_request_forwarding_service_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -476,25 +471,22 @@ func (*PerfStandbyElectionInput) Descriptor() ([]byte, []int) {
 }
 
 type PerfStandbyElectionResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	ID                 string     `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	ClusterID          string     `protobuf:"bytes,2,opt,name=cluster_id,json=clusterId,proto3" json:"cluster_id,omitempty"`
-	PrimaryClusterAddr string     `protobuf:"bytes,3,opt,name=primary_cluster_addr,json=primaryClusterAddr,proto3" json:"primary_cluster_addr,omitempty"`
-	CaCert             []byte     `protobuf:"bytes,4,opt,name=ca_cert,json=caCert,proto3" json:"ca_cert,omitempty"`
-	ClientCert         []byte     `protobuf:"bytes,5,opt,name=client_cert,json=clientCert,proto3" json:"client_cert,omitempty"`
-	ClientKey          *ClientKey `protobuf:"bytes,6,opt,name=client_key,json=clientKey,proto3" json:"client_key,omitempty"`
+	state              protoimpl.MessageState `protogen:"open.v1"`
+	ID                 string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ClusterID          string                 `protobuf:"bytes,2,opt,name=cluster_id,json=clusterId,proto3" json:"cluster_id,omitempty"`
+	PrimaryClusterAddr string                 `protobuf:"bytes,3,opt,name=primary_cluster_addr,json=primaryClusterAddr,proto3" json:"primary_cluster_addr,omitempty"`
+	CaCert             []byte                 `protobuf:"bytes,4,opt,name=ca_cert,json=caCert,proto3" json:"ca_cert,omitempty"`
+	ClientCert         []byte                 `protobuf:"bytes,5,opt,name=client_cert,json=clientCert,proto3" json:"client_cert,omitempty"`
+	ClientKey          *ClientKey             `protobuf:"bytes,6,opt,name=client_key,json=clientKey,proto3" json:"client_key,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }
 
 func (x *PerfStandbyElectionResponse) Reset() {
 	*x = PerfStandbyElectionResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_request_forwarding_service_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_request_forwarding_service_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *PerfStandbyElectionResponse) String() string {
@@ -505,7 +497,7 @@ func (*PerfStandbyElectionResponse) ProtoMessage() {}
 
 func (x *PerfStandbyElectionResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_request_forwarding_service_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -564,7 +556,7 @@ func (x *PerfStandbyElectionResponse) GetClientKey() *ClientKey {
 
 var File_vault_request_forwarding_service_proto protoreflect.FileDescriptor
 
-var file_vault_request_forwarding_service_proto_rawDesc = []byte{
+var file_vault_request_forwarding_service_proto_rawDesc = string([]byte{
 	0x0a, 0x26, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f,
 	0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69,
 	0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x1a,
@@ -574,7 +566,7 @@ var file_vault_request_forwarding_service_proto_rawDesc = []byte{
 	0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 	0x1a, 0x1d, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x2f, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
 	0x69, 0x6e, 0x67, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0xef, 0x04, 0x0a, 0x0b, 0x45, 0x63, 0x68, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0xc1, 0x05, 0x0a, 0x0b, 0x45, 0x63, 0x68, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
 	0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
 	0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6c, 0x75,
 	0x73, 0x74, 0x65, 0x72, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
@@ -613,93 +605,98 @@ var file_vault_request_forwarding_service_proto_rawDesc = []byte{
 	0x70, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x2a, 0x0a, 0x11, 0x63, 0x6c, 0x6f, 0x63, 0x6b, 0x5f, 0x73,
 	0x6b, 0x65, 0x77, 0x5f, 0x6d, 0x69, 0x6c, 0x6c, 0x69, 0x73, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x03,
 	0x52, 0x0f, 0x63, 0x6c, 0x6f, 0x63, 0x6b, 0x53, 0x6b, 0x65, 0x77, 0x4d, 0x69, 0x6c, 0x6c, 0x69,
-	0x73, 0x22, 0xaa, 0x02, 0x0a, 0x09, 0x45, 0x63, 0x68, 0x6f, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x12,
-	0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6c, 0x75,
-	0x73, 0x74, 0x65, 0x72, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x0c, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x73, 0x12, 0x2b,
-	0x0a, 0x11, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x74,
-	0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x10, 0x72, 0x65, 0x70, 0x6c, 0x69,
-	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x2c, 0x0a, 0x12, 0x72,
-	0x61, 0x66, 0x74, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x65, 0x64, 0x5f, 0x69, 0x6e, 0x64, 0x65,
-	0x78, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x10, 0x72, 0x61, 0x66, 0x74, 0x41, 0x70, 0x70,
-	0x6c, 0x69, 0x65, 0x64, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x20, 0x0a, 0x0c, 0x72, 0x61, 0x66,
-	0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0a, 0x72, 0x61, 0x66, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x49, 0x64, 0x12, 0x33, 0x0a, 0x09, 0x6e,
-	0x6f, 0x64, 0x65, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16,
-	0x2e, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x72,
-	0x6d, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x08, 0x6e, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f,
-	0x12, 0x2c, 0x0a, 0x03, 0x6e, 0x6f, 0x77, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x03, 0x6e, 0x6f, 0x77, 0x22, 0xc5,
-	0x01, 0x0a, 0x0f, 0x4e, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x61, 0x64,
-	0x64, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65,
-	0x72, 0x41, 0x64, 0x64, 0x72, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x69, 0x5f, 0x61, 0x64, 0x64,
-	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x69, 0x41, 0x64, 0x64, 0x72,
-	0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x6d, 0x6f, 0x64, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x64, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6e, 0x6f, 0x64, 0x65, 0x49, 0x64, 0x12, 0x2b, 0x0a,
-	0x11, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x61,
-	0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x10, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x68, 0x6f,
-	0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f,
-	0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x49, 0x0a, 0x09, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x4b, 0x65, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0c, 0x0a, 0x01, 0x78, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x01, 0x78, 0x12, 0x0c, 0x0a, 0x01, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x01, 0x79, 0x12, 0x0c, 0x0a, 0x01, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x01,
-	0x64, 0x22, 0x1a, 0x0a, 0x18, 0x50, 0x65, 0x72, 0x66, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x62, 0x79,
-	0x45, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x22, 0xe9, 0x01,
-	0x0a, 0x1b, 0x50, 0x65, 0x72, 0x66, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x62, 0x79, 0x45, 0x6c, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x0e, 0x0a,
-	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a,
-	0x0a, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x09, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x14,
-	0x70, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f,
-	0x61, 0x64, 0x64, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x70, 0x72, 0x69, 0x6d,
-	0x61, 0x72, 0x79, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x12, 0x17,
-	0x0a, 0x07, 0x63, 0x61, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52,
-	0x06, 0x63, 0x61, 0x43, 0x65, 0x72, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x63, 0x6c,
-	0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x12, 0x2f, 0x0a, 0x0a, 0x63, 0x6c, 0x69, 0x65,
-	0x6e, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x76,
-	0x61, 0x75, 0x6c, 0x74, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x4b, 0x65, 0x79, 0x52, 0x09,
-	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x4b, 0x65, 0x79, 0x32, 0xf0, 0x01, 0x0a, 0x11, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x12,
-	0x3d, 0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x13, 0x2e, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x2e, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
-	0x69, 0x6e, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x2e,
-	0x0a, 0x04, 0x45, 0x63, 0x68, 0x6f, 0x12, 0x12, 0x2e, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2e, 0x45,
-	0x63, 0x68, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x10, 0x2e, 0x76, 0x61, 0x75,
-	0x6c, 0x74, 0x2e, 0x45, 0x63, 0x68, 0x6f, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x22, 0x00, 0x12, 0x6c,
-	0x0a, 0x21, 0x50, 0x65, 0x72, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x6e, 0x63, 0x65, 0x53, 0x74, 0x61,
-	0x6e, 0x64, 0x62, 0x79, 0x45, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x1f, 0x2e, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2e, 0x50, 0x65, 0x72, 0x66,
-	0x53, 0x74, 0x61, 0x6e, 0x64, 0x62, 0x79, 0x45, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49,
-	0x6e, 0x70, 0x75, 0x74, 0x1a, 0x22, 0x2e, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2e, 0x50, 0x65, 0x72,
-	0x66, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x62, 0x79, 0x45, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x30, 0x01, 0x42, 0x22, 0x5a, 0x20,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69,
-	0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+	0x73, 0x12, 0x50, 0x0a, 0x25, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x5f, 0x63, 0x61, 0x6e, 0x61, 0x72, 0x79, 0x5f,
+	0x61, 0x67, 0x65, 0x5f, 0x6d, 0x69, 0x6c, 0x6c, 0x69, 0x73, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x21, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x72, 0x69,
+	0x6d, 0x61, 0x72, 0x79, 0x43, 0x61, 0x6e, 0x61, 0x72, 0x79, 0x41, 0x67, 0x65, 0x4d, 0x69, 0x6c,
+	0x6c, 0x69, 0x73, 0x22, 0xaa, 0x02, 0x0a, 0x09, 0x45, 0x63, 0x68, 0x6f, 0x52, 0x65, 0x70, 0x6c,
+	0x79, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x63,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x0c, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x73,
+	0x12, 0x2b, 0x0a, 0x11, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
+	0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x10, 0x72, 0x65, 0x70,
+	0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x2c, 0x0a,
+	0x12, 0x72, 0x61, 0x66, 0x74, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x65, 0x64, 0x5f, 0x69, 0x6e,
+	0x64, 0x65, 0x78, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x10, 0x72, 0x61, 0x66, 0x74, 0x41,
+	0x70, 0x70, 0x6c, 0x69, 0x65, 0x64, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x20, 0x0a, 0x0c, 0x72,
+	0x61, 0x66, 0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0a, 0x72, 0x61, 0x66, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x49, 0x64, 0x12, 0x33, 0x0a,
+	0x09, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66,
+	0x6f, 0x72, 0x6d, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x08, 0x6e, 0x6f, 0x64, 0x65, 0x49, 0x6e,
+	0x66, 0x6f, 0x12, 0x2c, 0x0a, 0x03, 0x6e, 0x6f, 0x77, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x03, 0x6e, 0x6f, 0x77,
+	0x22, 0xc5, 0x01, 0x0a, 0x0f, 0x4e, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x72, 0x6d, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f,
+	0x61, 0x64, 0x64, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x69, 0x5f, 0x61,
+	0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x69, 0x41, 0x64,
+	0x64, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x69,
+	0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6e, 0x6f, 0x64, 0x65, 0x49, 0x64, 0x12,
+	0x2b, 0x0a, 0x11, 0x72, 0x65, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73,
+	0x74, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x10, 0x72, 0x65, 0x70, 0x6c,
+	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x1a, 0x0a, 0x08,
+	0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x49, 0x0a, 0x09, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x4b, 0x65, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0c, 0x0a, 0x01, 0x78, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x01, 0x78, 0x12, 0x0c, 0x0a, 0x01, 0x79, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x01, 0x79, 0x12, 0x0c, 0x0a, 0x01, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x01, 0x64, 0x22, 0x1a, 0x0a, 0x18, 0x50, 0x65, 0x72, 0x66, 0x53, 0x74, 0x61, 0x6e, 0x64,
+	0x62, 0x79, 0x45, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x22,
+	0xe9, 0x01, 0x0a, 0x1b, 0x50, 0x65, 0x72, 0x66, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x62, 0x79, 0x45,
+	0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x1d, 0x0a, 0x0a, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x49, 0x64, 0x12, 0x30,
+	0x0a, 0x14, 0x70, 0x72, 0x69, 0x6d, 0x61, 0x72, 0x79, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x70, 0x72,
+	0x69, 0x6d, 0x61, 0x72, 0x79, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72,
+	0x12, 0x17, 0x0a, 0x07, 0x63, 0x61, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x06, 0x63, 0x61, 0x43, 0x65, 0x72, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x6c, 0x69,
+	0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a,
+	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x12, 0x2f, 0x0a, 0x0a, 0x63, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10,
+	0x2e, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x4b, 0x65, 0x79,
+	0x52, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x4b, 0x65, 0x79, 0x32, 0xf0, 0x01, 0x0a, 0x11,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e,
+	0x67, 0x12, 0x3d, 0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x13, 0x2e, 0x66, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67,
+	0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x66, 0x6f, 0x72, 0x77, 0x61,
+	0x72, 0x64, 0x69, 0x6e, 0x67, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
+	0x12, 0x2e, 0x0a, 0x04, 0x45, 0x63, 0x68, 0x6f, 0x12, 0x12, 0x2e, 0x76, 0x61, 0x75, 0x6c, 0x74,
+	0x2e, 0x45, 0x63, 0x68, 0x6f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x10, 0x2e, 0x76,
+	0x61, 0x75, 0x6c, 0x74, 0x2e, 0x45, 0x63, 0x68, 0x6f, 0x52, 0x65, 0x70, 0x6c, 0x79, 0x22, 0x00,
+	0x12, 0x6c, 0x0a, 0x21, 0x50, 0x65, 0x72, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x6e, 0x63, 0x65, 0x53,
+	0x74, 0x61, 0x6e, 0x64, 0x62, 0x79, 0x45, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1f, 0x2e, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2e, 0x50, 0x65,
+	0x72, 0x66, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x62, 0x79, 0x45, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x1a, 0x22, 0x2e, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2e, 0x50,
+	0x65, 0x72, 0x66, 0x53, 0x74, 0x61, 0x6e, 0x64, 0x62, 0x79, 0x45, 0x6c, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x30, 0x01, 0x42, 0x22,
+	0x5a, 0x20, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73,
+	0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x76, 0x61, 0x75,
+	0x6c, 0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+})
 
 var (
 	file_vault_request_forwarding_service_proto_rawDescOnce sync.Once
-	file_vault_request_forwarding_service_proto_rawDescData = file_vault_request_forwarding_service_proto_rawDesc
+	file_vault_request_forwarding_service_proto_rawDescData []byte
 )
 
 func file_vault_request_forwarding_service_proto_rawDescGZIP() []byte {
 	file_vault_request_forwarding_service_proto_rawDescOnce.Do(func() {
-		file_vault_request_forwarding_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_vault_request_forwarding_service_proto_rawDescData)
+		file_vault_request_forwarding_service_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_vault_request_forwarding_service_proto_rawDesc), len(file_vault_request_forwarding_service_proto_rawDesc)))
 	})
 	return file_vault_request_forwarding_service_proto_rawDescData
 }
 
 var file_vault_request_forwarding_service_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
-var file_vault_request_forwarding_service_proto_goTypes = []interface{}{
+var file_vault_request_forwarding_service_proto_goTypes = []any{
 	(*EchoRequest)(nil),                 // 0: vault.EchoRequest
 	(*EchoReply)(nil),                   // 1: vault.EchoReply
 	(*NodeInformation)(nil),             // 2: vault.NodeInformation
@@ -736,85 +733,11 @@ func file_vault_request_forwarding_service_proto_init() {
 	if File_vault_request_forwarding_service_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_vault_request_forwarding_service_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EchoRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_request_forwarding_service_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EchoReply); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_request_forwarding_service_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NodeInformation); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_request_forwarding_service_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ClientKey); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_request_forwarding_service_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PerfStandbyElectionInput); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_request_forwarding_service_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PerfStandbyElectionResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_vault_request_forwarding_service_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_vault_request_forwarding_service_proto_rawDesc), len(file_vault_request_forwarding_service_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   6,
 			NumExtensions: 0,
@@ -825,7 +748,6 @@ func file_vault_request_forwarding_service_proto_init() {
 		MessageInfos:      file_vault_request_forwarding_service_proto_msgTypes,
 	}.Build()
 	File_vault_request_forwarding_service_proto = out.File
-	file_vault_request_forwarding_service_proto_rawDesc = nil
 	file_vault_request_forwarding_service_proto_goTypes = nil
 	file_vault_request_forwarding_service_proto_depIDxs = nil
 }
diff --git a/vault/request_forwarding_service.proto b/vault/request_forwarding_service.proto
index f564e807dcd..02ab94d2147 100644
--- a/vault/request_forwarding_service.proto
+++ b/vault/request_forwarding_service.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
@@ -33,6 +33,7 @@ message EchoRequest {
   google.protobuf.Duration last_roundtrip_time = 13;
   // clock_skew_millis is the server time minus the local time
   int64 clock_skew_millis = 14;
+  int64 replication_primary_canary_age_millis = 15;
 }
 
 message EchoReply {
diff --git a/vault/request_forwarding_service_grpc.pb.go b/vault/request_forwarding_service_grpc.pb.go
index d0b63b3693c..cbc47dda6a1 100644
--- a/vault/request_forwarding_service_grpc.pb.go
+++ b/vault/request_forwarding_service_grpc.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: vault/request_forwarding_service.proto
 
@@ -19,8 +19,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	RequestForwarding_ForwardRequest_FullMethodName                    = "/vault.RequestForwarding/ForwardRequest"
@@ -34,7 +34,7 @@ const (
 type RequestForwardingClient interface {
 	ForwardRequest(ctx context.Context, in *forwarding.Request, opts ...grpc.CallOption) (*forwarding.Response, error)
 	Echo(ctx context.Context, in *EchoRequest, opts ...grpc.CallOption) (*EchoReply, error)
-	PerformanceStandbyElectionRequest(ctx context.Context, in *PerfStandbyElectionInput, opts ...grpc.CallOption) (RequestForwarding_PerformanceStandbyElectionRequestClient, error)
+	PerformanceStandbyElectionRequest(ctx context.Context, in *PerfStandbyElectionInput, opts ...grpc.CallOption) (grpc.ServerStreamingClient[PerfStandbyElectionResponse], error)
 }
 
 type requestForwardingClient struct {
@@ -46,8 +46,9 @@ func NewRequestForwardingClient(cc grpc.ClientConnInterface) RequestForwardingCl
 }
 
 func (c *requestForwardingClient) ForwardRequest(ctx context.Context, in *forwarding.Request, opts ...grpc.CallOption) (*forwarding.Response, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(forwarding.Response)
-	err := c.cc.Invoke(ctx, RequestForwarding_ForwardRequest_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, RequestForwarding_ForwardRequest_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -55,20 +56,22 @@ func (c *requestForwardingClient) ForwardRequest(ctx context.Context, in *forwar
 }
 
 func (c *requestForwardingClient) Echo(ctx context.Context, in *EchoRequest, opts ...grpc.CallOption) (*EchoReply, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EchoReply)
-	err := c.cc.Invoke(ctx, RequestForwarding_Echo_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, RequestForwarding_Echo_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *requestForwardingClient) PerformanceStandbyElectionRequest(ctx context.Context, in *PerfStandbyElectionInput, opts ...grpc.CallOption) (RequestForwarding_PerformanceStandbyElectionRequestClient, error) {
-	stream, err := c.cc.NewStream(ctx, &RequestForwarding_ServiceDesc.Streams[0], RequestForwarding_PerformanceStandbyElectionRequest_FullMethodName, opts...)
+func (c *requestForwardingClient) PerformanceStandbyElectionRequest(ctx context.Context, in *PerfStandbyElectionInput, opts ...grpc.CallOption) (grpc.ServerStreamingClient[PerfStandbyElectionResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &RequestForwarding_ServiceDesc.Streams[0], RequestForwarding_PerformanceStandbyElectionRequest_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &requestForwardingPerformanceStandbyElectionRequestClient{stream}
+	x := &grpc.GenericClientStream[PerfStandbyElectionInput, PerfStandbyElectionResponse]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -78,36 +81,25 @@ func (c *requestForwardingClient) PerformanceStandbyElectionRequest(ctx context.
 	return x, nil
 }
 
-type RequestForwarding_PerformanceStandbyElectionRequestClient interface {
-	Recv() (*PerfStandbyElectionResponse, error)
-	grpc.ClientStream
-}
-
-type requestForwardingPerformanceStandbyElectionRequestClient struct {
-	grpc.ClientStream
-}
-
-func (x *requestForwardingPerformanceStandbyElectionRequestClient) Recv() (*PerfStandbyElectionResponse, error) {
-	m := new(PerfStandbyElectionResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RequestForwarding_PerformanceStandbyElectionRequestClient = grpc.ServerStreamingClient[PerfStandbyElectionResponse]
 
 // RequestForwardingServer is the server API for RequestForwarding service.
 // All implementations must embed UnimplementedRequestForwardingServer
-// for forward compatibility
+// for forward compatibility.
 type RequestForwardingServer interface {
 	ForwardRequest(context.Context, *forwarding.Request) (*forwarding.Response, error)
 	Echo(context.Context, *EchoRequest) (*EchoReply, error)
-	PerformanceStandbyElectionRequest(*PerfStandbyElectionInput, RequestForwarding_PerformanceStandbyElectionRequestServer) error
+	PerformanceStandbyElectionRequest(*PerfStandbyElectionInput, grpc.ServerStreamingServer[PerfStandbyElectionResponse]) error
 	mustEmbedUnimplementedRequestForwardingServer()
 }
 
-// UnimplementedRequestForwardingServer must be embedded to have forward compatible implementations.
-type UnimplementedRequestForwardingServer struct {
-}
+// UnimplementedRequestForwardingServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedRequestForwardingServer struct{}
 
 func (UnimplementedRequestForwardingServer) ForwardRequest(context.Context, *forwarding.Request) (*forwarding.Response, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ForwardRequest not implemented")
@@ -115,10 +107,11 @@ func (UnimplementedRequestForwardingServer) ForwardRequest(context.Context, *for
 func (UnimplementedRequestForwardingServer) Echo(context.Context, *EchoRequest) (*EchoReply, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Echo not implemented")
 }
-func (UnimplementedRequestForwardingServer) PerformanceStandbyElectionRequest(*PerfStandbyElectionInput, RequestForwarding_PerformanceStandbyElectionRequestServer) error {
+func (UnimplementedRequestForwardingServer) PerformanceStandbyElectionRequest(*PerfStandbyElectionInput, grpc.ServerStreamingServer[PerfStandbyElectionResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method PerformanceStandbyElectionRequest not implemented")
 }
 func (UnimplementedRequestForwardingServer) mustEmbedUnimplementedRequestForwardingServer() {}
+func (UnimplementedRequestForwardingServer) testEmbeddedByValue()                           {}
 
 // UnsafeRequestForwardingServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to RequestForwardingServer will
@@ -128,6 +121,13 @@ type UnsafeRequestForwardingServer interface {
 }
 
 func RegisterRequestForwardingServer(s grpc.ServiceRegistrar, srv RequestForwardingServer) {
+	// If the following call pancis, it indicates UnimplementedRequestForwardingServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&RequestForwarding_ServiceDesc, srv)
 }
 
@@ -172,21 +172,11 @@ func _RequestForwarding_PerformanceStandbyElectionRequest_Handler(srv interface{
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(RequestForwardingServer).PerformanceStandbyElectionRequest(m, &requestForwardingPerformanceStandbyElectionRequestServer{stream})
-}
-
-type RequestForwarding_PerformanceStandbyElectionRequestServer interface {
-	Send(*PerfStandbyElectionResponse) error
-	grpc.ServerStream
+	return srv.(RequestForwardingServer).PerformanceStandbyElectionRequest(m, &grpc.GenericServerStream[PerfStandbyElectionInput, PerfStandbyElectionResponse]{ServerStream: stream})
 }
 
-type requestForwardingPerformanceStandbyElectionRequestServer struct {
-	grpc.ServerStream
-}
-
-func (x *requestForwardingPerformanceStandbyElectionRequestServer) Send(m *PerfStandbyElectionResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RequestForwarding_PerformanceStandbyElectionRequestServer = grpc.ServerStreamingServer[PerfStandbyElectionResponse]
 
 // RequestForwarding_ServiceDesc is the grpc.ServiceDesc for RequestForwarding service.
 // It's only intended for direct use with grpc.RegisterService,
diff --git a/vault/request_forwarding_test.go b/vault/request_forwarding_test.go
new file mode 100644
index 00000000000..ffdce0f51c2
--- /dev/null
+++ b/vault/request_forwarding_test.go
@@ -0,0 +1,131 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+package vault
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/vault/sdk/physical"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/metadata"
+)
+
+// Test_haIDFromContext verifies that the HA node ID gets correctly extracted
+// from a gRPC context
+func Test_haIDFromContext(t *testing.T) {
+	testCases := []struct {
+		name   string
+		md     metadata.MD
+		wantID string
+		wantOk bool
+	}{
+		{
+			name:   "no ID",
+			md:     metadata.MD{},
+			wantID: "",
+			wantOk: false,
+		},
+		{
+			name:   "with ID",
+			md:     metadata.MD{haNodeIDKey: {"node_id"}},
+			wantID: "node_id",
+			wantOk: true,
+		},
+		{
+			name:   "with empty string ID",
+			md:     metadata.MD{haNodeIDKey: {""}},
+			wantID: "",
+			wantOk: true,
+		},
+		{
+			name:   "with empty ID",
+			md:     metadata.MD{haNodeIDKey: {}},
+			wantID: "",
+			wantOk: false,
+		},
+
+		{
+			name:   "with multiple IDs",
+			md:     metadata.MD{haNodeIDKey: {"1", "2"}},
+			wantID: "1",
+			wantOk: true,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := metadata.NewIncomingContext(context.Background(), tc.md)
+			id, ok := haIDFromContext(ctx)
+			require.Equal(t, tc.wantID, id)
+			require.Equal(t, tc.wantOk, ok)
+		})
+	}
+}
+
+type mockHARemovableNodeBackend struct {
+	physical.RemovableNodeHABackend
+	isRemoved func(context.Context, string) (bool, error)
+}
+
+func (m *mockHARemovableNodeBackend) IsNodeRemoved(ctx context.Context, nodeID string) (bool, error) {
+	return m.isRemoved(ctx, nodeID)
+}
+
+func newMockHARemovableNodeBackend(isRemoved func(context.Context, string) (bool, error)) physical.RemovableNodeHABackend {
+	return &mockHARemovableNodeBackend{isRemoved: isRemoved}
+}
+
+// Test_haMembershipServerCheck verifies that the correct error is returned
+// when the context contains a removed node ID
+func Test_haMembershipServerCheck(t *testing.T) {
+	nodeIDCtx := metadata.NewIncomingContext(context.Background(), metadata.MD{haNodeIDKey: {"node_id"}})
+	otherErr := errors.New("error checking")
+	testCases := []struct {
+		name      string
+		nodeIDCtx context.Context
+		haBackend physical.RemovableNodeHABackend
+		wantError error
+	}{
+		{
+			name:      "nil backend",
+			haBackend: nil,
+			nodeIDCtx: nodeIDCtx,
+		}, {
+			name: "no node ID context",
+			haBackend: newMockHARemovableNodeBackend(func(ctx context.Context, s string) (bool, error) {
+				return false, nil
+			}),
+			nodeIDCtx: context.Background(),
+		}, {
+			name: "node removed",
+			haBackend: newMockHARemovableNodeBackend(func(ctx context.Context, s string) (bool, error) {
+				return true, nil
+			}),
+			nodeIDCtx: nodeIDCtx,
+			wantError: StatusNotHAMember,
+		}, {
+			name: "node removed err",
+			haBackend: newMockHARemovableNodeBackend(func(ctx context.Context, s string) (bool, error) {
+				return false, otherErr
+			}),
+			nodeIDCtx: nodeIDCtx,
+			wantError: otherErr,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			c := &Core{
+				logger: hclog.NewNullLogger(),
+			}
+			err := haMembershipServerCheck(tc.nodeIDCtx, c, tc.haBackend)
+			if tc.wantError != nil {
+				require.EqualError(t, err, tc.wantError.Error())
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/vault/request_handling.go b/vault/request_handling.go
index a58210e4f81..0ec4cc8a33d 100644
--- a/vault/request_handling.go
+++ b/vault/request_handling.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -26,10 +26,12 @@ import (
 	"github.com/hashicorp/go-sockaddr"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/command/server"
+	"github.com/hashicorp/vault/helper/constants"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/identity/mfa"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/http/priority"
 	"github.com/hashicorp/vault/internalshared/configutil"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/consts"
@@ -41,6 +43,8 @@ import (
 	"github.com/hashicorp/vault/vault/quotas"
 	"github.com/hashicorp/vault/vault/tokens"
 	uberAtomic "go.uber.org/atomic"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 const (
@@ -69,6 +73,11 @@ type HandlerProperties struct {
 	DisablePrintableCheck bool
 	RecoveryMode          bool
 	RecoveryToken         *uberAtomic.String
+
+	// RequestIDGenerator is primary used for testing purposes to allow tests to
+	// control the request IDs deterministically. In production code (i.e. if this
+	// is nil) the handler will generate UUIDs.
+	RequestIDGenerator func() (string, error)
 }
 
 // fetchEntityAndDerivedPolicies returns the entity object for the given entity
@@ -82,28 +91,16 @@ func (c *Core) fetchEntityAndDerivedPolicies(ctx context.Context, tokenNS *names
 		return nil, nil, nil
 	}
 
-	// c.logger.Debug("entity set on the token", "entity_id", te.EntityID)
-
-	// Fetch the entity
-	entity, err := c.identityStore.MemDBEntityByID(entityID, false)
+	entity, err := c.fetchEntity(entityID, false)
+	if entity == nil && err == nil {
+		return nil, nil, nil
+	}
 	if err != nil {
-		c.logger.Error("failed to lookup entity using its ID", "error", err)
 		return nil, nil, err
 	}
 
-	if entity == nil {
-		// If there was no corresponding entity object found, it is
-		// possible that the entity got merged into another entity. Try
-		// finding entity based on the merged entity index.
-		entity, err = c.identityStore.MemDBEntityByMergedEntityID(entityID, false)
-		if err != nil {
-			c.logger.Error("failed to lookup entity in merged entity ID index", "error", err)
-			return nil, nil, err
-		}
-	}
-
 	policies := make(map[string][]string)
-	if entity != nil && !skipDeriveEntityPolicies {
+	if !skipDeriveEntityPolicies {
 		// c.logger.Debug("entity successfully fetched; adding entity policies to token's policies to create ACL")
 
 		// Attach the policies on the entity
@@ -129,6 +126,18 @@ func (c *Core) fetchEntityAndDerivedPolicies(ctx context.Context, tokenNS *names
 	return entity, policies, err
 }
 
+// fetchEntity returns the entity object for the given entity
+// ID. If the entity is merged into a different entity object, the entity into
+// which the given entity ID is merged into will be returned.
+func (c *Core) fetchEntity(entityID string, clone bool) (*identity.Entity, error) {
+	if entityID == "" || c.identityStore == nil {
+		return nil, nil
+	}
+	txn := c.identityStore.db.Txn(false)
+
+	return c.identityStore.fetchEntityInTxn(txn, entityID, clone)
+}
+
 // filterGroupPoliciesByNS takes a context, token namespace, and a map of
 // namespace IDs to slices of group policy names and returns a similar map,
 // but filtered down to the policies that should apply to the token based on the
@@ -248,7 +257,7 @@ func (c *Core) fetchACLTokenEntryAndEntity(ctx context.Context, req *logical.Req
 
 	// Ensure the token is valid
 	if te == nil {
-		return nil, nil, nil, nil, logical.ErrPermissionDenied
+		return nil, nil, nil, nil, multierror.Append(logical.ErrPermissionDenied, logical.ErrInvalidToken)
 	}
 
 	// CIDR checks bind all tokens except non-expiring root tokens
@@ -316,10 +325,14 @@ func (c *Core) fetchACLTokenEntryAndEntity(ctx context.Context, req *logical.Req
 	// Add the inline policy if it's set
 	policies := make([]*Policy, 0)
 	if te.InlinePolicy != "" {
-		inlinePolicy, err := ParseACLPolicy(tokenNS, te.InlinePolicy)
+		// TODO (HCL_DUP_KEYS_DEPRECATION): return to ParseACLPolicy once the deprecation is done
+		inlinePolicy, duplicate, err := ParseACLPolicyCheckDuplicates(tokenNS, te.InlinePolicy)
 		if err != nil {
 			return nil, nil, nil, nil, ErrInternalError
 		}
+		if duplicate {
+			c.logger.Warn("HCL inline policy contains duplicate attributes, which will no longer be supported in a future version", "namespace", tokenNS.Path)
+		}
 		policies = append(policies, inlinePolicy)
 	}
 
@@ -334,9 +347,9 @@ func (c *Core) fetchACLTokenEntryAndEntity(ctx context.Context, req *logical.Req
 	return acl, te, entity, identityPolicies, nil
 }
 
-// CheckTokenWithLock calls CheckToken after grabbing the internal stateLock, and also checking that we aren't in the
-// process of shutting down.
-func (c *Core) CheckTokenWithLock(ctx context.Context, req *logical.Request, unauth bool) (*logical.Auth, *logical.TokenEntry, error) {
+// CheckTokenWithLock calls CheckToken after grabbing the internal stateLock,
+// and also checking that we aren't in the process of shutting down.
+func (c *Core) CheckTokenWithLock(ctx context.Context, req *logical.Request) (*logical.Auth, *logical.TokenEntry, error) {
 	c.stateLock.RLock()
 	defer c.stateLock.RUnlock()
 	// first check that we aren't shutting down
@@ -345,9 +358,63 @@ func (c *Core) CheckTokenWithLock(ctx context.Context, req *logical.Request, una
 	} else if c.activeContext != nil && c.activeContext.Err() != nil {
 		return nil, nil, c.activeContext.Err()
 	}
-	return c.CheckToken(ctx, req, unauth)
+	return c.CheckToken(ctx, req, false)
+}
+
+func (c *Core) existenceCheck(ctx context.Context, req *logical.Request) (*logical.Operation, error) {
+	existsResp, checkExists, resourceExists, err := c.router.RouteExistenceCheck(ctx, req)
+	switch err {
+	case logical.ErrUnsupportedPath:
+		// fail later via bad path to avoid confusing items in the log
+		checkExists = false
+	case logical.ErrRelativePath:
+		return nil, errutil.UserError{Err: err.Error()}
+	case nil:
+		if existsResp != nil && existsResp.IsError() {
+			return nil, existsResp.Error()
+		}
+		// Otherwise, continue on
+	default:
+		c.logger.Error("failed to run existence check", "error", err)
+		if _, ok := err.(errutil.UserError); ok {
+			return nil, err
+		} else {
+			return nil, ErrInternalError
+		}
+	}
+	var existenceCheckOp logical.Operation
+	switch {
+	case !checkExists:
+		// No existence check, so always treat it as an update operation, which is how it is pre 0.5
+		existenceCheckOp = logical.UpdateOperation
+	case resourceExists:
+		// It exists, so force an update operation
+		existenceCheckOp = logical.UpdateOperation
+	case !resourceExists:
+		// It doesn't exist, force a create operation
+		existenceCheckOp = logical.CreateOperation
+	default:
+		panic("unreachable code")
+	}
+	return &existenceCheckOp, nil
 }
 
+// CheckToken returns information about the state of authentication for a request.
+// The unauth flag should be set true for "login" requests; these are requests to
+// logical.Paths.Unauthenticated endpoints that are not deleted auth requests,
+// though note that despite being called login requests, not all of them are actually
+// login requests, as in attempts to authenticate and get back a token.
+//
+// Generally speaking, if CheckToken return an error, the request should fail,
+// but there are exceptions, e.g. ErrPerfStandbyPleaseForward may just result in
+// the request being forwarded to the active node.  A returned error does not
+// necessarily mean that the other return values will be nil; often they are
+// useful e.g. for auditing failing requests.
+//
+// When unauth is true, fail root path requests, don't worry about regular
+// ACL policy checks (though sentinel checks may still apply), and don't do
+// client counting.  When unauth is false, an invalid token or a lack of ACL
+// perms will result in an error, and client counting applies.
 func (c *Core) CheckToken(ctx context.Context, req *logical.Request, unauth bool) (*logical.Auth, *logical.TokenEntry, error) {
 	defer metrics.MeasureSince([]string{"core", "check_token"}, time.Now())
 
@@ -390,11 +457,17 @@ func (c *Core) CheckToken(ctx context.Context, req *logical.Request, unauth bool
 	}
 
 	// At this point we won't be forwarding a raw request; we should delete
-	// authorization headers as appropriate
-	switch req.ClientTokenSource {
-	case logical.ClientTokenFromVaultHeader:
+	// authorization headers as appropriate.  Don't delete Authorization headers
+	// if this is an unauth (login) request, as that precludes things like spiffe
+	// auth handling login requests with the payload in the Authorization header.
+	// However, if we did find a valid vault token in the header, we'll still
+	// suppress the header even if unauth is true, on the principle that we
+	// don't want to expose vault tokens to plugins which might do something
+	// nefarious with them.
+	switch {
+	case req.ClientTokenSource == logical.ClientTokenFromVaultHeader:
 		delete(req.Headers, consts.AuthHeaderName)
-	case logical.ClientTokenFromAuthzHeader:
+	case req.ClientTokenSource == logical.ClientTokenFromAuthzHeader && !unauth && te == nil:
 		if headers, ok := req.Headers["Authorization"]; ok {
 			retHeaders := make([]string, 0, len(headers))
 			for _, v := range headers {
@@ -413,41 +486,13 @@ func (c *Core) CheckToken(ctx context.Context, req *logical.Request, unauth bool
 	// whether a particular resource exists. Then we can mark it as an update
 	// or creation as appropriate.
 	if req.Operation == logical.CreateOperation || req.Operation == logical.UpdateOperation {
-		existsResp, checkExists, resourceExists, err := c.router.RouteExistenceCheck(ctx, req)
-		switch err {
-		case logical.ErrUnsupportedPath:
-			// fail later via bad path to avoid confusing items in the log
-			checkExists = false
-		case logical.ErrRelativePath:
-			return nil, te, errutil.UserError{Err: err.Error()}
-		case nil:
-			if existsResp != nil && existsResp.IsError() {
-				return nil, te, existsResp.Error()
-			}
-			// Otherwise, continue on
-		default:
-			c.logger.Error("failed to run existence check", "error", err)
-			if _, ok := err.(errutil.UserError); ok {
-				return nil, te, err
-			} else {
-				return nil, te, ErrInternalError
-			}
-		}
-
-		switch {
-		case !checkExists:
-			// No existence check, so always treat it as an update operation, which is how it is pre 0.5
-			req.Operation = logical.UpdateOperation
-		case resourceExists:
-			// It exists, so force an update operation
-			req.Operation = logical.UpdateOperation
-		case !resourceExists:
-			// It doesn't exist, force a create operation
-			req.Operation = logical.CreateOperation
-		default:
-			panic("unreachable code")
+		op, err := c.existenceCheck(ctx, req)
+		if err != nil {
+			return nil, te, err
 		}
+		req.Operation = *op
 	}
+
 	// Create the auth response
 	auth := &logical.Auth{
 		ClientToken: req.ClientToken,
@@ -476,13 +521,36 @@ func (c *Core) CheckToken(ctx context.Context, req *logical.Request, unauth bool
 		req.ClientID = clientID
 	}
 
+	twoStepRecover := req.Operation == logical.RecoverOperation && req.RecoverSourcePath != "" && req.RecoverSourcePath != req.Path
+	var alternateRecoverCapability *logical.Operation
+	if twoStepRecover {
+		// An existence check call requires the operation to be set to either
+		// create or update. We set it to create here, then switch it back once
+		// the existence check is done.
+		req.Operation = logical.CreateOperation
+		op, err := c.existenceCheck(ctx, req)
+		req.Operation = logical.RecoverOperation
+		if err != nil {
+			return nil, te, err
+		}
+		alternateRecoverCapability = op
+	}
+
 	// Check the standard non-root ACLs. Return the token entry if it's not
 	// allowed so we can decrement the use count.
 	authResults := c.performPolicyChecks(ctx, acl, te, req, entity, &PolicyCheckOpts{
-		Unauth:            unauth,
-		RootPrivsRequired: rootPath,
+		Unauth:                     unauth,
+		RootPrivsRequired:          rootPath,
+		CheckSourcePath:            twoStepRecover,
+		RecoverAlternateCapability: alternateRecoverCapability,
 	})
 
+	// Assign the sudo path priority if the request is issued against a sudo path.
+	if rootPath {
+		pri := uint8(priority.NeverDrop)
+		auth.HTTPRequestPriority = &pri
+	}
+
 	auth.PolicyResults = &logical.PolicyResults{
 		Allowed: authResults.Allowed,
 	}
@@ -584,6 +652,15 @@ func (c *Core) switchedLockHandleRequest(httpCtx context.Context, req *logical.R
 	if ok {
 		ctx = logical.CreateContextOriginalBody(ctx, body)
 	}
+	redactVersion, redactAddresses, redactClusterName, ok := logical.CtxRedactionSettingsValue(httpCtx)
+	if ok {
+		ctx = logical.CreateContextRedactionSettings(ctx, redactVersion, redactAddresses, redactClusterName)
+	}
+	inFlightRequestPriority, ok := httpCtx.Value(logical.CtxKeyInFlightRequestPriority{}).(priority.AOPWritePriority)
+	if ok {
+		ctx = context.WithValue(ctx, logical.CtxKeyInFlightRequestPriority{}, inFlightRequestPriority)
+	}
+
 	resp, err = c.handleCancelableRequest(ctx, req)
 	req.SetTokenEntry(nil)
 	cancel()
@@ -591,27 +668,11 @@ func (c *Core) switchedLockHandleRequest(httpCtx context.Context, req *logical.R
 }
 
 func (c *Core) handleCancelableRequest(ctx context.Context, req *logical.Request) (resp *logical.Response, err error) {
-	// Allowing writing to a path ending in / makes it extremely difficult to
-	// understand user intent for the filesystem-like backends (kv,
-	// cubbyhole) -- did they want a key named foo/ or did they want to write
-	// to a directory foo/ with no (or forgotten) key, or...? It also affects
-	// lookup, because paths ending in / are considered prefixes by some
-	// backends. Basically, it's all just terrible, so don't allow it.
-	if strings.HasSuffix(req.Path, "/") &&
-		(req.Operation == logical.UpdateOperation ||
-			req.Operation == logical.CreateOperation ||
-			req.Operation == logical.PatchOperation) {
-		return logical.ErrorResponse("cannot write to a path ending in '/'"), nil
-	}
 	waitGroup, err := waitForReplicationState(ctx, c, req)
 	if err != nil {
 		return nil, err
 	}
 
-	// MountPoint will not always be set at this point, so we ensure the req contains it
-	// as it is depended on by some functionality (e.g. quotas)
-	req.MountPoint = c.router.MatchingMount(ctx, req.Path)
-
 	// Decrement the wait group when our request is done
 	if waitGroup != nil {
 		defer waitGroup.Done()
@@ -621,8 +682,51 @@ func (c *Core) handleCancelableRequest(ctx context.Context, req *logical.Request
 		return nil, logical.ErrMissingRequiredState
 	}
 
+	// Ensure the req contains a MountPoint as it is depended on by some
+	// functionality (e.g. quotas)
+	var entry *MountEntry
+	req.MountPoint, entry = c.router.MatchingMountAndEntry(ctx, req.Path)
+
+	if entry != nil && entry.Table == mountTableType && !c.IsMountTypeAllowed(entry.Type) {
+		return logical.ErrorResponse("mounts of type %q aren't supported by license", entry.Type), logical.ErrInvalidRequest
+	}
+
+	// If the request requires a snapshot ID, we need to perform checks to
+	// ensure the request is valid and lock the snapshot, so it doesn't get
+	// unloaded while the request is being processed.
+	if req.RequiresSnapshotID != "" {
+		if c.perfStandby {
+			return nil, logical.ErrPerfStandbyPleaseForward
+		}
+		unlockSnapshot, err := c.lockSnapshotForRequest(ctx, req, entry)
+		if err != nil {
+			return logical.ErrorResponse("unable to lock snapshot: " + err.Error()), err
+		}
+		defer unlockSnapshot()
+	}
+	// Allowing writing to a path ending in / makes it extremely difficult to
+	// understand user intent for the filesystem-like backends (kv,
+	// cubbyhole) -- did they want a key named foo/ or did they want to write
+	// to a directory foo/ with no (or forgotten) key, or...? It also affects
+	// lookup, because paths ending in / are considered prefixes by some
+	// backends. Basically, it's all just terrible, so don't allow it.
+	if strings.HasSuffix(req.Path, "/") &&
+		(req.Operation == logical.UpdateOperation ||
+			req.Operation == logical.CreateOperation ||
+			req.Operation == logical.PatchOperation ||
+			req.Operation == logical.RecoverOperation) {
+		if entry == nil || !entry.Config.TrimRequestTrailingSlashes {
+			return logical.ErrorResponse("cannot write to a path ending in '/'"), nil
+		} else {
+			req.Path = strings.TrimSuffix(req.Path, "/")
+		}
+	}
+
 	err = c.PopulateTokenEntry(ctx, req)
 	if err != nil {
+		if errwrap.Contains(err, logical.ErrPermissionDenied.Error()) {
+			return nil, multierror.Append(err, logical.ErrInvalidToken)
+		}
 		return nil, err
 	}
 
@@ -736,7 +840,8 @@ func (c *Core) handleCancelableRequest(ctx context.Context, req *logical.Request
 		case "sys/leases/lookup", "sys/leases/renew", "sys/leases/revoke", "sys/leases/revoke-force":
 			leaseID, ok := req.Data["lease_id"]
 			// If lease ID is not present, break out and let the backend handle the error
-			if !ok || leaseID == nil {
+			_, isString := leaseID.(string)
+			if !ok || !isString {
 				break
 			}
 			_, nsID := namespace.SplitIDFromString(leaseID.(string))
@@ -868,7 +973,6 @@ func (c *Core) handleCancelableRequest(ctx context.Context, req *logical.Request
 
 	var nonHMACReqDataKeys []string
 	var nonHMACRespDataKeys []string
-	entry := c.router.MatchingMountEntry(ctx, req.Path)
 	if entry != nil {
 		// Get and set ignored HMAC'd value. Reset those back to empty afterwards.
 		if rawVals, ok := entry.synthesizedConfigCache.Load("audit_non_hmac_request_keys"); ok {
@@ -1001,6 +1105,13 @@ func (c *Core) handleRequest(ctx context.Context, req *logical.Request) (retResp
 		return nil, nil, ctErr
 	}
 
+	// See if the call to CheckToken set any request priority. We push the
+	// processing down into CheckToken so we only have to do a router lookup
+	// once.
+	if auth != nil && auth.HTTPRequestPriority != nil {
+		ctx = context.WithValue(ctx, logical.CtxKeyInFlightRequestPriority{}, *auth.HTTPRequestPriority)
+	}
+
 	// Updating in-flight request data with client/entity ID
 	inFlightReqID, ok := ctx.Value(logical.CtxKeyInFlightRequestID{}).(string)
 	if ok && req.ClientID != "" {
@@ -1021,7 +1132,7 @@ func (c *Core) handleRequest(ctx context.Context, req *logical.Request) (retResp
 		}
 		if te == nil {
 			// Token has been revoked by this point
-			retErr = multierror.Append(retErr, logical.ErrPermissionDenied)
+			retErr = multierror.Append(retErr, logical.ErrPermissionDenied, logical.ErrInvalidToken)
 			return nil, nil, retErr
 		}
 		if te.NumUses == tokenRevocationPending {
@@ -1148,6 +1259,39 @@ func (c *Core) handleRequest(ctx context.Context, req *logical.Request) (retResp
 		}
 	}()
 
+	// This context value will be empty if it's a request that doesn't require a
+	// snapshot. This is done on purpose and handled in the
+	// SnapshotStorageRouter
+	ctx = logical.CreateContextWithSnapshotID(ctx, req.RequiresSnapshotID)
+
+	// recover operations require 2 steps
+	if req.Operation == logical.RecoverOperation {
+		// first do a read operation
+		// this will use the snapshot's storage
+		originalPath := req.Path
+		req.Operation = logical.ReadOperation
+		if req.RecoverSourcePath != "" {
+			req.Path = req.RecoverSourcePath
+		}
+		resp, err := c.doRouting(ctx, req)
+		if err != nil {
+			return nil, auth, err
+		}
+		if resp == nil {
+			return logical.ErrorResponse("no data in the snapshot"), auth, err
+		}
+		if resp.IsError() {
+			return resp, auth, err
+		}
+		// use the response as the data in a recover operation
+		// set the snapshot ID context value to the empty string to ensure that
+		// the write goes to the real storage
+		req.Operation = logical.RecoverOperation
+		req.Path = originalPath
+		req.Data = resp.Data
+		ctx = logical.CreateContextWithSnapshotID(ctx, "")
+	}
+
 	// Route the request
 	resp, routeErr := c.doRouting(ctx, req)
 	if resp != nil {
@@ -1232,18 +1376,24 @@ func (c *Core) handleRequest(ctx context.Context, req *logical.Request) (retResp
 			} else if matchingMountEntry.Options == nil || matchingMountEntry.Options["leased_passthrough"] != "true" {
 				registerLease = false
 				resp.Secret.Renewable = false
+			} else if req.IsSnapshotReadOrList() {
+				registerLease = false
+				resp.Secret.Renewable = false
 			}
 
 		case "plugin":
 			// If we are a plugin type and the plugin name is "kv" check the
 			// mount entry options.
-			if matchingMountEntry.Config.PluginName == "kv" && (matchingMountEntry.Options == nil || matchingMountEntry.Options["leased_passthrough"] != "true") {
+			if matchingMountEntry.Config.PluginName == "kv" && (matchingMountEntry.Options == nil || matchingMountEntry.Options["leased_passthrough"] != "true" || req.IsSnapshotReadOrList()) {
 				registerLease = false
 				resp.Secret.Renewable = false
 			}
 		}
 
 		if registerLease {
+			if req.IsSnapshotReadOrList() {
+				return logical.ErrorResponse("cannot register lease for snapshot read or list"), nil, ErrInternalError
+			}
 			sysView := c.router.MatchingSystemView(ctx, req.Path)
 			if sysView == nil {
 				c.logger.Error("unable to look up sys view for login path", "request_path", req.Path)
@@ -1499,6 +1649,7 @@ func (c *Core) handleLoginRequest(ctx context.Context, req *logical.Request) (re
 			return nil, nil, err
 		}
 		if isloginUserLocked {
+			c.logger.Error("login attempts exceeded, user is locked out", "request_path", req.Path)
 			return nil, nil, logical.ErrPermissionDenied
 		}
 	}
@@ -1655,6 +1806,7 @@ func (c *Core) handleLoginRequest(ctx context.Context, req *logical.Request) (re
 			var err error
 			// Fetch the entity for the alias, or create an entity if one
 			// doesn't exist.
+
 			entity, entityCreated, err := c.identityStore.CreateOrFetchEntity(ctx, auth.Alias)
 			if err != nil {
 				switch auth.Alias.Local {
@@ -1662,7 +1814,7 @@ func (c *Core) handleLoginRequest(ctx context.Context, req *logical.Request) (re
 					// Only create a new entity if the error was a readonly error and the creation flag is true
 					// i.e the entity was in the middle of being created
 					if entityCreated && errors.Is(err, logical.ErrReadOnly) {
-						entity, err = possiblyForwardEntityCreation(ctx, c, err, auth, nil)
+						entity, err = registerLocalAlias(ctx, c, auth.Alias)
 						if err != nil {
 							if strings.Contains(err.Error(), errCreateEntityUnimplemented) {
 								resp.AddWarning("primary cluster doesn't yet issue entities for local auth mounts; falling back to not issuing entities for local auth mounts")
@@ -1672,14 +1824,14 @@ func (c *Core) handleLoginRequest(ctx context.Context, req *logical.Request) (re
 							}
 						}
 					}
-					err = updateLocalAlias(ctx, c, auth, entity)
 				default:
 					entity, entityCreated, err = possiblyForwardAliasCreation(ctx, c, err, auth, entity)
+					if err != nil {
+						return nil, nil, err
+					}
 				}
 			}
-			if err != nil {
-				return nil, nil, err
-			}
+
 			if entity == nil {
 				return nil, nil, fmt.Errorf("failed to create an entity for the authenticated alias")
 			}
@@ -1739,7 +1891,7 @@ func (c *Core) handleLoginRequest(ctx context.Context, req *logical.Request) (re
 			// run single-phase login MFA check, else run two-phase login MFA check
 			if len(matchedMfaEnforcementList) > 0 && len(req.MFACreds) > 0 {
 				for _, eConfig := range matchedMfaEnforcementList {
-					err = c.validateLoginMFA(ctx, eConfig, entity, req.Connection.RemoteAddr, req.MFACreds)
+					err = c.validateLoginMFA(ctx, eConfig, entity, req.Connection.RemoteAddr, req.MFACreds, nil)
 					if err != nil {
 						return nil, nil, logical.ErrPermissionDenied
 					}
@@ -1755,7 +1907,8 @@ func (c *Core) handleLoginRequest(ctx context.Context, req *logical.Request) (re
 					MFAConstraints: make(map[string]*logical.MFAConstraintAny),
 				}
 				for _, eConfig := range matchedMfaEnforcementList {
-					mfaAny, err := c.buildMfaEnforcementResponse(eConfig)
+					onlyMFAEnforcement := len(matchedMfaEnforcementList) == 1
+					mfaAny, err := c.buildMfaEnforcementResponse(eConfig, entity, onlyMFAEnforcement)
 					if err != nil {
 						return nil, nil, err
 					}
@@ -1803,7 +1956,7 @@ func (c *Core) handleLoginRequest(ctx context.Context, req *logical.Request) (re
 		// for new role-based quotas upon creation, rather than counting old leases toward
 		// the total.
 		if reqRole == nil && requiresLease && !c.impreciseLeaseRoleTracking {
-			role = c.DetermineRoleFromLoginRequest(ctx, req.MountPoint, req.Data)
+			role = c.DetermineRoleFromLoginRequest(ctx, req.MountPoint, req.Data, req.Connection, req.Headers)
 		}
 
 		leaseGen, respTokenCreate, errCreateToken := c.LoginCreateToken(ctx, ns, req.Path, source, role, resp)
@@ -2041,7 +2194,7 @@ func (c *Core) LoginCreateToken(ctx context.Context, ns *namespace.Namespace, re
 		if auth.TokenType != logical.TokenTypeBatch {
 			leaseGenerated = true
 		}
-	case err == ErrInternalError:
+	case errors.Is(err, ErrInternalError), isRetryableRPCError(ctx, err):
 		return false, nil, err
 	default:
 		return false, logical.ErrorResponse(err.Error()), logical.ErrInvalidRequest
@@ -2071,6 +2224,34 @@ func (c *Core) LoginCreateToken(ctx context.Context, ns *namespace.Namespace, re
 	return leaseGenerated, resp, nil
 }
 
+func isRetryableRPCError(ctx context.Context, err error) bool {
+	stat, ok := status.FromError(err)
+	if !ok {
+		return false
+	}
+
+	switch stat.Code() {
+	case codes.Unavailable:
+		return true
+	case codes.Canceled:
+		// if the request context is canceled through a deadline exceeded, we
+		// want to return false. But otherwise, there could have been an EOF or
+		// the RPC client context has been canceled which should be retried
+		ctxErr := ctx.Err()
+		if ctxErr == nil {
+			return true
+		}
+		return !errors.Is(ctxErr, context.DeadlineExceeded)
+	case codes.Unknown:
+		// sometimes a missing HTTP content-type error can happen when multiple
+		// HTTP statuses have been written. This can happen when the error
+		// occurs in the middle of a response. This should be retried.
+		return strings.Contains(err.Error(), "malformed header: missing HTTP content-type")
+	default:
+		return false
+	}
+}
+
 // failedUserLoginProcess updates the userFailedLoginMap with login count and  last failed
 // login time for users with failed login attempt
 // If the user gets locked for current login attempt, it updates the storage entry too
@@ -2309,7 +2490,13 @@ func (c *Core) getUserLockoutFromConfig(mountType string) UserLockoutConfig {
 	return defaultUserLockoutConfig
 }
 
-func (c *Core) buildMfaEnforcementResponse(eConfig *mfa.MFAEnforcementConfig) (*logical.MFAConstraintAny, error) {
+func (c *Core) buildMfaEnforcementResponse(eConfig *mfa.MFAEnforcementConfig, entity *identity.Entity, onlyMFAEnforcement bool) (*logical.MFAConstraintAny, error) {
+	if eConfig == nil {
+		return nil, fmt.Errorf("MFA enforcement config is nil")
+	}
+	if entity == nil {
+		return nil, fmt.Errorf("entity is nil")
+	}
 	mfaAny := &logical.MFAConstraintAny{
 		Any: []*logical.MFAMethodID{},
 	}
@@ -2322,15 +2509,36 @@ func (c *Core) buildMfaEnforcementResponse(eConfig *mfa.MFAEnforcementConfig) (*
 		if mConfig.Type == mfaMethodTypeDuo {
 			duoConf, ok := mConfig.Config.(*mfa.Config_DuoConfig)
 			if !ok {
-				return nil, fmt.Errorf("invalid MFA configuration type")
+				return nil, fmt.Errorf("invalid MFA configuration type, expected DuoConfig")
 			}
 			duoUsePasscode = duoConf.DuoConfig.UsePasscode
 		}
+
+		allowSelfEnrollment := false
+		if mConfig.Type == mfaMethodTypeTOTP && constants.IsEnterprise {
+			totpConf, ok := mConfig.Config.(*mfa.Config_TOTPConfig)
+			if !ok {
+				return nil, fmt.Errorf("invalid MFA configuration type, expected TOTPConfig")
+			}
+			enrollmentEnabled := totpConf.TOTPConfig.GetEnableSelfEnrollment()
+			_, entityHasMFASecretForMethodID := entity.MFASecrets[methodID]
+			if enrollmentEnabled && !entityHasMFASecretForMethodID && onlyMFAEnforcement {
+				// If enable_self_enrollment setting on the TOTP MFA method config is set to
+				// true and the entity does not have an MFA secret yet, we will allow
+				// self-service enrollment as long as only a single MFA enforcement applies to
+				// this login request.
+				allowSelfEnrollment = true
+			}
+		}
+
 		mfaMethod := &logical.MFAMethodID{
 			Type:         mConfig.Type,
 			ID:           methodID,
 			UsesPasscode: mConfig.Type == mfaMethodTypeTOTP || duoUsePasscode,
 			Name:         mConfig.Name,
+			// This will be used by the client to determine whether it should offer the user
+			// a way to generate an MFA secret for this method.
+			SelfEnrollmentEnabled: allowSelfEnrollment,
 		}
 		mfaAny.Any = append(mfaAny.Any, mfaMethod)
 	}
@@ -2376,7 +2584,7 @@ func (c *Core) RegisterAuth(ctx context.Context, tokenTTL time.Duration, path st
 
 	if err := c.tokenStore.create(ctx, &te); err != nil {
 		c.logger.Error("failed to create token", "error", err)
-		return ErrInternalError
+		return possiblyWrapOverloadedError("failed to create token", err)
 	}
 
 	// Populate the client token, accessor, and TTL
@@ -2396,7 +2604,7 @@ func (c *Core) RegisterAuth(ctx context.Context, tokenTTL time.Duration, path st
 				c.logger.Warn("failed to clean up token lease during login request", "request_path", path, "error", err)
 			}
 			c.logger.Error("failed to register token lease during login request", "request_path", path, "error", err)
-			return ErrInternalError
+			return possiblyWrapOverloadedError("failed to register token lease during login request", err)
 		}
 		if te.ExternalID != "" {
 			auth.ClientToken = te.ExternalID
@@ -2436,6 +2644,8 @@ func (c *Core) LocalGetUserFailedLoginInfo(ctx context.Context, userKey FailedLo
 // LocalUpdateUserFailedLoginInfo updates the failed login information for a user based on alias name and mountAccessor
 func (c *Core) LocalUpdateUserFailedLoginInfo(ctx context.Context, userKey FailedLoginUser, failedLoginInfo *FailedLoginInfo, deleteEntry bool) error {
 	c.userFailedLoginInfoLock.Lock()
+	defer c.userFailedLoginInfoLock.Unlock()
+
 	switch deleteEntry {
 	case false:
 		// update entry in the map
@@ -2478,7 +2688,6 @@ func (c *Core) LocalUpdateUserFailedLoginInfo(ctx context.Context, userKey Faile
 		// delete the entry from the map, if no key exists it is no-op
 		delete(c.userFailedLoginInfo, userKey)
 	}
-	c.userFailedLoginInfoLock.Unlock()
 	return nil
 }
 
@@ -2636,7 +2845,6 @@ func (c *Core) checkSSCTokenInternal(ctx context.Context, token string, isPerfSt
 	if !strings.HasPrefix(token, consts.ServiceTokenPrefix) {
 		return token, nil
 	}
-
 	// Check token length to guess if this is an server side consistent token or not.
 	// Note that even when the DisableSSCTokens flag is set, index
 	// bearing tokens that have already been given out may still be used.
@@ -2655,12 +2863,19 @@ func (c *Core) checkSSCTokenInternal(ctx context.Context, token string, isPerfSt
 
 	err = proto.Unmarshal(tokenBytes, signedToken)
 	if err != nil {
-		return "", fmt.Errorf("error occurred when unmarshalling ssc token: %w", err)
+		// Log a warning here, but don't return an error. This is because we want don't
+		// want to forward the request to the active node if the token is invalid.
+		c.logger.Debug("error occurred when unmarshalling ssc token: %w", err)
+		return token, nil
 	}
 	hm, err := c.tokenStore.CalculateSignedTokenHMAC(signedToken.Token)
 	if !hmac.Equal(hm, signedToken.Hmac) {
-		return "", fmt.Errorf("token mac for %+v is incorrect: err %w", signedToken, err)
+		// As above, don't return an error so that the request is handled like normal,
+		// and handled by the node that received it.
+		c.logger.Debug("token mac is incorrect", "token", signedToken.Token)
+		return token, nil
 	}
+
 	plainToken := &tokens.Token{}
 	err = proto.Unmarshal([]byte(signedToken.Token), plainToken)
 	if err != nil {
@@ -2681,11 +2896,13 @@ func (c *Core) checkSSCTokenInternal(ctx context.Context, token string, isPerfSt
 	if c.HasWALState(requiredWalState, isPerfStandby) {
 		return plainToken.Random, nil
 	}
+
 	// Make sure to forward the request instead of checking the token if the flag
 	// is set and we're on a perf standby
 	if c.ForwardToActive() == ForwardSSCTokenToActive && isPerfStandby {
 		return "", logical.ErrPerfStandbyPleaseForward
 	}
+
 	// In this case, the server side consistent token cannot be used on this node. We return the appropriate
 	// status code.
 	return "", logical.ErrMissingRequiredState
diff --git a/vault/request_handling_test.go b/vault/request_handling_test.go
index 6bbde873a73..1bff0296330 100644
--- a/vault/request_handling_test.go
+++ b/vault/request_handling_test.go
@@ -1,9 +1,11 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
+	"context"
+	"errors"
 	"strings"
 	"testing"
 	"time"
@@ -15,6 +17,9 @@ import (
 	credUserpass "github.com/hashicorp/vault/builtin/credential/userpass"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/logical"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 func TestRequestHandling_Wrapping(t *testing.T) {
@@ -478,3 +483,148 @@ func TestRequestHandling_SecretLeaseMetric(t *testing.T) {
 		},
 	)
 }
+
+// TestRequestHandling_isRetryableRPCError tests that a retryable RPC error
+// can be distinguished from a normal error
+func TestRequestHandling_isRetryableRPCError(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	deadlineCtx, deadlineCancel := context.WithDeadline(context.Background(), time.Now().Add(-1*time.Second))
+	defer deadlineCancel()
+	testCases := []struct {
+		name string
+		ctx  context.Context
+		err  error
+		want bool
+	}{
+		{
+			name: "req context canceled, not deadline",
+			ctx:  ctx,
+			err:  status.Error(codes.Canceled, "context canceled"),
+			want: true,
+		},
+		{
+			name: "req context deadline exceeded",
+			ctx:  deadlineCtx,
+			err:  status.Error(codes.Canceled, "context canceled"),
+			want: false,
+		},
+		{
+			name: "server context canceled",
+			err:  status.Error(codes.Canceled, "context canceled"),
+			want: true,
+		},
+		{
+			name: "unavailable",
+			err:  status.Error(codes.Unavailable, "unavailable"),
+			want: true,
+		},
+		{
+			name: "other status",
+			err:  status.Error(codes.FailedPrecondition, "failed"),
+			want: false,
+		},
+		{
+			name: "other unknown",
+			err:  status.Error(codes.Unknown, "unknown"),
+			want: false,
+		},
+		{
+			name: "malformed header unknown",
+			err:  status.Error(codes.Unknown, "malformed header: missing HTTP content-type"),
+			want: true,
+		},
+		{
+			name: "other error",
+			err:  errors.New("other type of error"),
+			want: false,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			useCtx := tc.ctx
+			if tc.ctx == nil {
+				useCtx = context.Background()
+			}
+			require.Equal(t, tc.want, isRetryableRPCError(useCtx, tc.err))
+		})
+	}
+}
+
+// TestRequestHandling_TokenRenewal tests that a renewable token can be renewed
+// and that an error is returned when lease_id is not a string
+func TestRequestHandling_TokenRenewal(t *testing.T) {
+	core, _, root := TestCoreUnsealed(t)
+
+	// First, create a renewable token with a short TTL
+	req := &logical.Request{
+		Path:        "auth/token/create",
+		ClientToken: root,
+		Operation:   logical.UpdateOperation,
+		Data: map[string]interface{}{
+			"ttl":       "1h",
+			"renewable": true,
+			"policies":  []string{"default"},
+		},
+	}
+
+	resp, err := core.HandleRequest(namespace.RootContext(context.TODO()), req)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if resp == nil || resp.Auth == nil {
+		t.Fatalf("bad: %v", resp)
+	}
+
+	newToken := resp.Auth.ClientToken
+	if newToken == "" {
+		t.Fatal("expected non-empty token")
+	}
+	if !resp.Auth.Renewable {
+		t.Fatal("expected renewable token")
+	}
+
+	// Test token renewal
+	req = &logical.Request{
+		Path:        "auth/token/renew-self",
+		ClientToken: newToken,
+		Operation:   logical.UpdateOperation,
+		Data: map[string]interface{}{
+			"increment": "2h", // Extend by 2 hours
+		},
+	}
+
+	resp, err = core.HandleRequest(namespace.RootContext(context.TODO()), req)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if resp == nil || resp.Auth == nil {
+		t.Fatalf("bad: %v", resp)
+	}
+
+	// Verify the token was renewed
+	if resp.Auth.ClientToken != newToken {
+		t.Fatalf("expected same token, got %s", resp.Auth.ClientToken)
+	}
+	if !resp.Auth.Renewable {
+		t.Fatal("expected renewable token after renewal")
+	}
+
+	req = &logical.Request{
+		Path:        "sys/leases/renew",
+		ClientToken: root,
+		Operation:   logical.UpdateOperation,
+		Data: map[string]interface{}{
+			"lease_id": 12345, // Non-string value
+		},
+	}
+
+	resp, err = core.HandleRequest(namespace.RootContext(context.TODO()), req)
+	if err == nil {
+		t.Fatal("expected error when lease_id is not a string")
+	}
+	if !strings.Contains(err.Error(), "invalid request") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
diff --git a/vault/request_handling_util.go b/vault/request_handling_util.go
index bda5af22447..441e461eaf9 100644
--- a/vault/request_handling_util.go
+++ b/vault/request_handling_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -7,6 +7,7 @@ package vault
 
 import (
 	"context"
+	"errors"
 	"sync"
 	"time"
 
@@ -68,12 +69,8 @@ func possiblyForwardAliasCreation(ctx context.Context, c *Core, inErr error, aut
 
 var errCreateEntityUnimplemented = "create entity unimplemented in the server"
 
-func possiblyForwardEntityCreation(ctx context.Context, c *Core, inErr error, auth *logical.Auth, entity *identity.Entity) (*identity.Entity, error) {
-	return entity, inErr
-}
-
-func updateLocalAlias(ctx context.Context, c *Core, auth *logical.Auth, entity *identity.Entity) error {
-	return nil
+func registerLocalAlias(_ context.Context, _ *Core, _ *logical.Alias) (*identity.Entity, error) {
+	return nil, logical.ErrReadOnly
 }
 
 func possiblyForwardSaveCachedAuthResponse(ctx context.Context, c *Core, respAuth *MFACachedAuthResponse) error {
@@ -88,3 +85,7 @@ func possiblyForwardSaveCachedAuthResponse(ctx context.Context, c *Core, respAut
 func forwardCreateTokenRegisterAuth(ctx context.Context, c *Core, te *logical.TokenEntry, roleName string, renewable bool, periodToUse, explicitMaxTTLToUse time.Duration) (*logical.TokenEntry, error) {
 	return nil, nil
 }
+
+func (c *Core) lockSnapshotForRequest(ctx context.Context, req *logical.Request, entry *MountEntry) (func(), error) {
+	return nil, errors.New("loaded snapshots not supported")
+}
diff --git a/vault/rollback.go b/vault/rollback.go
index 98f58987f55..fe8a8dc84fa 100644
--- a/vault/rollback.go
+++ b/vault/rollback.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/rollback_test.go b/vault/rollback_test.go
index eeca3dad9fb..bbe451b0149 100644
--- a/vault/rollback_test.go
+++ b/vault/rollback_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/rotation_stubs_oss.go b/vault/rotation_stubs_oss.go
new file mode 100644
index 00000000000..a38705b1240
--- /dev/null
+++ b/vault/rotation_stubs_oss.go
@@ -0,0 +1,40 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1package vault
+
+//go:build !enterprise
+
+package vault
+
+//go:generate go run github.com/hashicorp/vault/tools/stubmaker
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/sdk/helper/automatedrotationutil"
+	"github.com/hashicorp/vault/sdk/rotation"
+)
+
+type RotationManager struct{}
+
+func (c *Core) startRotation() error {
+	return nil
+}
+
+func (c *Core) stopRotation() error {
+	return nil
+}
+
+func (c *Core) GetRotationInformation(_ context.Context, _ string, _ *rotation.RotationInfoRequest) (*rotation.RotationInfoResponse, error) {
+	return nil, automatedrotationutil.ErrRotationManagerUnsupported
+}
+
+func (c *Core) RegisterRotationJob(_ context.Context, _ *rotation.RotationJob) (string, error) {
+	return "", automatedrotationutil.ErrRotationManagerUnsupported
+}
+
+// The DeregisterRotationJob stub returns nil instead of an error because it is intended to be valid to send a deregister
+// request for a non-existent job. As a result, the plugin sends a deregister request whenever the relevant rotation
+// values are unset. This means that for a plugin running in CE Vault, it will _always_ try to send a deregister request.
+func (c *Core) DeregisterRotationJob(_ context.Context, _ *rotation.RotationJobDeregisterRequest) error {
+	return nil
+}
diff --git a/vault/router.go b/vault/router.go
index 2618101502e..d017cdbd8a0 100644
--- a/vault/router.go
+++ b/vault/router.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -63,14 +63,15 @@ type routeEntry struct {
 	tainted atomic.Bool
 	// backend is the actual backend instance for this route entry; lock l must
 	// be held to access this field.
-	backend       logical.Backend
-	mountEntry    *MountEntry
-	storageView   logical.Storage
-	storagePrefix string
-	rootPaths     atomic.Value
-	loginPaths    atomic.Value
-	binaryPaths   atomic.Value
-	limitedPaths  atomic.Value
+	backend                logical.Backend
+	mountEntry             *MountEntry
+	storageView            logical.Storage
+	storagePrefix          string
+	rootPaths              atomic.Value
+	loginPaths             atomic.Value
+	binaryPaths            atomic.Value
+	limitedPaths           atomic.Value
+	allowSnapshotReadPaths atomic.Value
 	// l is the lock used to protect access to backend during reloads
 	l sync.RWMutex
 }
@@ -89,7 +90,8 @@ type specialPathsEntry struct {
 }
 
 // specialPathsLookupFunc is used by (*Router).specialPath to look up a
-// specialPathsEntry corresponding to loginPath, binaryPath, or limitedPath.
+// specialPathsEntry corresponding to loginPath, binaryPath, limitedPath, or
+// allowSnapshotReadPath.
 type specialPathsLookupFunc func(re *routeEntry) *specialPathsEntry
 
 type ValidateMountResponse struct {
@@ -225,6 +227,12 @@ func (r *Router) Mount(backend logical.Backend, prefix string, mountEntry *Mount
 	}
 	re.limitedPaths.Store(limitedPathsEntry)
 
+	allowSnapshotReadPathsEntry, err := parseUnauthenticatedPaths(paths.AllowSnapshotRead)
+	if err != nil {
+		return err
+	}
+	re.allowSnapshotReadPaths.Store(allowSnapshotReadPathsEntry)
+
 	switch {
 	case prefix == "":
 		return fmt.Errorf("missing prefix to be used for router entry; mount_path: %q, mount_type: %q", re.mountEntry.Path, re.mountEntry.Type)
@@ -373,23 +381,30 @@ func (r *Router) MatchingMountByAccessor(mountAccessor string) *MountEntry {
 // MatchingMount returns the mount prefix that would be used for a path
 func (r *Router) MatchingMount(ctx context.Context, path string) string {
 	r.l.RLock()
-	mount := r.matchingMountInternal(ctx, path)
+	mount, _ := r.matchingMountInternal(ctx, path)
 	r.l.RUnlock()
 	return mount
 }
 
-func (r *Router) matchingMountInternal(ctx context.Context, path string) string {
+// MatchingMountAndEntry returns the mount prefix and MountEntry used for a path
+func (r *Router) MatchingMountAndEntry(ctx context.Context, path string) (string, *MountEntry) {
+	r.l.RLock()
+	defer r.l.RUnlock()
+	return r.matchingMountInternal(ctx, path)
+}
+
+func (r *Router) matchingMountInternal(ctx context.Context, path string) (string, *MountEntry) {
 	ns, err := namespace.FromContext(ctx)
 	if err != nil {
-		return ""
+		return "", nil
 	}
 	path = ns.Path + path
 
-	mount, _, ok := r.root.LongestPrefix(path)
+	mount, raw, ok := r.root.LongestPrefix(path)
 	if !ok {
-		return ""
+		return "", nil
 	}
-	return mount
+	return mount, raw.(*routeEntry).mountEntry
 }
 
 // matchingPrefixInternal returns a mount prefix that a path may be a part of
@@ -416,7 +431,7 @@ func (r *Router) matchingPrefixInternal(ctx context.Context, path string) string
 func (r *Router) MountConflict(ctx context.Context, path string) string {
 	r.l.RLock()
 	defer r.l.RUnlock()
-	if exactMatch := r.matchingMountInternal(ctx, path); exactMatch != "" {
+	if exactMatch, _ := r.matchingMountInternal(ctx, path); exactMatch != "" {
 		return exactMatch
 	}
 	if prefixMatch := r.matchingPrefixInternal(ctx, path); prefixMatch != "" {
@@ -459,26 +474,20 @@ func (r *Router) matchingStorage(ctx context.Context, path string, apiPath bool)
 
 // MatchingMountEntry returns the MountEntry used for a path
 func (r *Router) MatchingMountEntry(ctx context.Context, path string) *MountEntry {
-	ns, err := namespace.FromContext(ctx)
-	if err != nil {
-		return nil
-	}
-	path = ns.Path + path
-
-	r.l.RLock()
-	_, raw, ok := r.root.LongestPrefix(path)
-	r.l.RUnlock()
-	if !ok {
-		return nil
-	}
-	return raw.(*routeEntry).mountEntry
+	_, mountEntry := r.MatchingBackendAndMountEntry(ctx, path)
+	return mountEntry
 }
 
 // MatchingBackend returns the backend used for a path
 func (r *Router) MatchingBackend(ctx context.Context, path string) logical.Backend {
+	be, _ := r.MatchingBackendAndMountEntry(ctx, path)
+	return be
+}
+
+func (r *Router) MatchingBackendAndMountEntry(ctx context.Context, path string) (logical.Backend, *MountEntry) {
 	ns, err := namespace.FromContext(ctx)
 	if err != nil {
-		return nil
+		return nil, nil
 	}
 	path = ns.Path + path
 
@@ -486,14 +495,15 @@ func (r *Router) MatchingBackend(ctx context.Context, path string) logical.Backe
 	_, raw, ok := r.root.LongestPrefix(path)
 	r.l.RUnlock()
 	if !ok {
-		return nil
+		return nil, nil
 	}
 
 	re := raw.(*routeEntry)
+
 	re.l.RLock()
 	defer re.l.RUnlock()
 
-	return re.backend
+	return re.backend, re.mountEntry
 }
 
 // MatchingSystemView returns the SystemView used for a path
@@ -589,6 +599,9 @@ func (r *Router) routeCommon(ctx context.Context, req *logical.Request, existenc
 	req.Path = adjustedPath
 	if !existenceCheck {
 		metricName := []string{"route", string(req.Operation)}
+		if req.IsSnapshotReadOrList() {
+			metricName[1] = metricName[1] + "-snapshot"
+		}
 		if req.Operation != logical.RollbackOperation || r.rollbackMetricsMountName {
 			metricName = append(metricName, strings.ReplaceAll(mount, "/", "-"))
 		}
@@ -624,6 +637,10 @@ func (r *Router) routeCommon(ctx context.Context, req *logical.Request, existenc
 	// Adjust the path to exclude the routing prefix
 	originalPath := req.Path
 	req.Path = strings.TrimPrefix(ns.Path+req.Path, mount)
+	originalRecoverSourcePath := req.RecoverSourcePath
+	if req.RecoverSourcePath != "" {
+		req.RecoverSourcePath = strings.TrimPrefix(ns.Path+req.RecoverSourcePath, mount)
+	}
 	req.MountPoint = mount
 	req.MountType = re.mountEntry.Type
 	req.SetMountRunningSha256(re.mountEntry.RunningSha256)
@@ -744,6 +761,7 @@ func (r *Router) routeCommon(ctx context.Context, req *logical.Request, existenc
 	// Reset the request before returning
 	defer func() {
 		req.Path = originalPath
+		req.RecoverSourcePath = originalRecoverSourcePath
 		req.MountPoint = mount
 		req.MountType = re.mountEntry.Type
 		req.SetMountRunningSha256(re.mountEntry.RunningSha256)
@@ -908,9 +926,18 @@ func (r *Router) LimitedPath(ctx context.Context, path string) bool {
 		})
 }
 
+// AllowSnapshotReadPath checks if the given path is allowed to be used for a
+// snapshot read
+func (r *Router) AllowSnapshotReadPath(ctx context.Context, path string) bool {
+	return r.specialPath(ctx, path,
+		func(re *routeEntry) *specialPathsEntry {
+			return re.allowSnapshotReadPaths.Load().(*specialPathsEntry)
+		})
+}
+
 // specialPath is a common method for checking if the given path has a matching
-// PathsSpecial entry. This is used for Login, Binary, and Limited PathsSpecial
-// fields.
+// PathsSpecial entry. This is used for Login, Binary, Limited, and
+// AllowSnapshotRead PathsSpecial fields.
 // Matching Priority
 //  1. prefix
 //  2. exact
diff --git a/vault/router_access.go b/vault/router_access.go
index 8fc150fd146..f7d3797ed5e 100644
--- a/vault/router_access.go
+++ b/vault/router_access.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/router_test.go b/vault/router_test.go
index 8f44afeaa93..1eba959b701 100644
--- a/vault/router_test.go
+++ b/vault/router_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -11,8 +11,10 @@ import (
 
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/logical"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestRouter_Mount(t *testing.T) {
@@ -683,3 +685,136 @@ func TestWellKnownRedirectMatching(t *testing.T) {
 		t.Fail()
 	}
 }
+
+// TestRouter_AllowSnapshotReadPaths mounts a backend with a set of paths that
+// are allowed to be read from a snapshot. The test verifies that paths that
+// match the allowed paths return true, while paths that do not match return
+// false from the router.
+func TestRouter_AllowSnapshotReadPaths(t *testing.T) {
+	r := NewRouter()
+	_, barrier, _ := mockBarrier(t)
+	view := NewBarrierView(barrier, "logical/")
+
+	meUUID, err := uuid.GenerateUUID()
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx := namespace.RootContext(context.Background())
+	n := &NoopBackend{
+		AllowSnapshotRead: []string{
+			"config/root",
+			"roles/+",
+			"roles/+/status",
+			"static-creds/+",
+			"static-creds/+/sub",
+		},
+		BackendType: logical.TypeCredential,
+	}
+	err = r.Mount(n, "foo/", &MountEntry{UUID: meUUID, Accessor: "fooaccessor", NamespaceID: namespace.RootNamespaceID, namespace: namespace.RootNamespace}, view)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	testCases := []struct {
+		queryPath string
+		expect    bool
+	}{
+		{
+			queryPath: "config",
+			expect:    false,
+		},
+		{
+			queryPath: "config/root",
+			expect:    true,
+		},
+		{
+			queryPath: "config/root/key",
+			expect:    false,
+		},
+		{
+			queryPath: "roles/name",
+			expect:    true,
+		},
+		{
+			queryPath: "roles/name/status",
+			expect:    true,
+		},
+		{
+			queryPath: "roles/name/status/sub",
+			expect:    false,
+		},
+		{
+			queryPath: "static-creds/name",
+			expect:    true,
+		},
+		{
+			queryPath: "static-creds/name/sub",
+			expect:    true,
+		},
+		{
+			queryPath: "static-creds/name/more/sub",
+			expect:    false,
+		},
+		{
+			queryPath: "creds/name",
+			expect:    false,
+		},
+	}
+	for _, tc := range testCases {
+		t.Run(strings.ReplaceAll(tc.queryPath, "/", "_"), func(t *testing.T) {
+			require.Equal(t, tc.expect, r.AllowSnapshotReadPath(ctx, "foo/"+tc.queryPath))
+		})
+	}
+}
+
+// TestRouter_StripPrefix_RecoverSourcePath tests that when a request is made
+// with a RecoverSourcePath set, the router will strip the namespace and mount
+// prefix from that path before sending the request to the RecoverOperation
+// callback
+func TestRouter_StripPrefix_RecoverSourcePath(t *testing.T) {
+	b := &framework.Backend{
+		PathsSpecial: &logical.Paths{
+			AllowSnapshotRead: []string{"foo/*"},
+		},
+	}
+	b.Paths = []*framework.Path{
+		{
+			Pattern: "foo/" + framework.GenericNameWithAtRegex("name"),
+			Fields: map[string]*framework.FieldSchema{
+				"name": {
+					Type: framework.TypeString,
+				},
+			},
+			Callbacks: map[logical.Operation]framework.OperationFunc{
+				logical.RecoverOperation: func(ctx context.Context, req *logical.Request, data *framework.FieldData) (*logical.Response, error) {
+					// return the name from the path, unless RecoverSourcePath is set, in which
+					// case return the name from the recover source path.
+					name := data.Get("name").(string)
+					if req.RecoverSourcePath != "" {
+						d, err := b.RecoverSourcePathFieldData(req)
+						if err != nil {
+							return nil, err
+						}
+						name = d.Get("name").(string)
+					}
+					return &logical.Response{Data: map[string]interface{}{"name": name}}, nil
+				},
+			},
+		},
+	}
+
+	r := NewRouter()
+	_, barrier, _ := mockBarrier(t)
+	view := NewBarrierView(barrier, "logical/")
+
+	meUUID, err := uuid.GenerateUUID()
+	require.NoError(t, err)
+	err = r.Mount(b, "test/", &MountEntry{UUID: meUUID, Accessor: "testaccessor", NamespaceID: namespace.RootNamespaceID, namespace: namespace.RootNamespace}, view)
+	resp, err := r.Route(namespace.RootContext(context.Background()), &logical.Request{
+		Path:              "test/foo/new-path",
+		Operation:         logical.RecoverOperation,
+		RecoverSourcePath: "test/foo/old-path",
+	})
+	require.NoError(t, err)
+	require.Equal(t, "old-path", resp.Data["name"])
+}
diff --git a/vault/router_testing.go b/vault/router_testing.go
index d8a41e00ae0..93ab0c1d5b3 100644
--- a/vault/router_testing.go
+++ b/vault/router_testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -19,16 +19,17 @@ type RouterTestHandlerFunc func(context.Context, *logical.Request) (*logical.Res
 type NoopBackend struct {
 	sync.Mutex
 
-	Root            []string
-	Login           []string
-	Paths           []string
-	Requests        []*logical.Request
-	Response        *logical.Response
-	RequestHandler  RouterTestHandlerFunc
-	Invalidations   []string
-	DefaultLeaseTTL time.Duration
-	MaxLeaseTTL     time.Duration
-	BackendType     logical.BackendType
+	Root              []string
+	Login             []string
+	Paths             []string
+	AllowSnapshotRead []string
+	Requests          []*logical.Request
+	Response          *logical.Response
+	RequestHandler    RouterTestHandlerFunc
+	Invalidations     []string
+	DefaultLeaseTTL   time.Duration
+	MaxLeaseTTL       time.Duration
+	BackendType       logical.BackendType
 
 	RollbackErrs bool
 }
@@ -79,8 +80,9 @@ func (n *NoopBackend) HandleExistenceCheck(ctx context.Context, req *logical.Req
 
 func (n *NoopBackend) SpecialPaths() *logical.Paths {
 	return &logical.Paths{
-		Root:            n.Root,
-		Unauthenticated: n.Login,
+		Root:              n.Root,
+		Unauthenticated:   n.Login,
+		AllowSnapshotRead: n.AllowSnapshotRead,
 	}
 }
 
diff --git a/vault/seal.go b/vault/seal.go
index 0bc9cebf535..c3e62e50d66 100644
--- a/vault/seal.go
+++ b/vault/seal.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -10,7 +10,6 @@ import (
 	"fmt"
 	"sync/atomic"
 
-	"github.com/hashicorp/vault/command/server"
 	"github.com/hashicorp/vault/sdk/helper/jsonutil"
 	"github.com/hashicorp/vault/sdk/physical"
 	"github.com/hashicorp/vault/vault/seal"
@@ -47,6 +46,11 @@ const (
 	// a new generation which keeps track if a rewrap of all CSPs and seal wrapped
 	// values has completed .
 	SealGenInfoPath = "core/seal-gen-info"
+
+	// SealInitializationFlagPath is the path used to store an entry that signals
+	// that Vault initialization is still in progress. It is used to prevent nodes
+	// from becoming active when that is the case.
+	SealInitializationFlagPath = "core/seal-initialization-flag"
 )
 
 type Seal interface {
@@ -76,6 +80,9 @@ type Seal interface {
 	VerifyRecoveryKey(context.Context, []byte) error
 	GetAccess() seal.Access
 	Healthy() bool
+	SetInitializationFlag(context.Context) error
+	ClearInitializationFlag(context.Context) error
+	IsInitializationFlagSet(context.Context) (bool, error)
 }
 
 type defaultSeal struct {
@@ -149,6 +156,39 @@ func (d *defaultSeal) SetStoredKeys(ctx context.Context, keys [][]byte) error {
 	return writeStoredKeys(ctx, d.core.physical, d.access, keys)
 }
 
+func (d *defaultSeal) SetInitializationFlag(ctx context.Context) error {
+	return writeInitializationFlag(ctx, d.core.physical, true)
+}
+
+func (d *defaultSeal) ClearInitializationFlag(ctx context.Context) error {
+	return writeInitializationFlag(ctx, d.core.physical, false)
+}
+
+func writeInitializationFlag(ctx context.Context, storage physical.Backend, set bool) error {
+	if set {
+		pe := &physical.Entry{
+			Key:   SealInitializationFlagPath,
+			Value: []byte("initialization in progress"),
+		}
+		return storage.Put(ctx, pe)
+	}
+
+	return storage.Delete(ctx, SealInitializationFlagPath)
+}
+
+func (d *defaultSeal) IsInitializationFlagSet(ctx context.Context) (bool, error) {
+	return isInitializationFlagSet(ctx, d.core.physical)
+}
+
+func isInitializationFlagSet(ctx context.Context, storage physical.Backend) (bool, error) {
+	pe, err := storage.Get(ctx, SealInitializationFlagPath)
+	if err != nil {
+		return false, err
+	}
+
+	return pe != nil, nil
+}
+
 func (d *defaultSeal) LegacySeal() bool {
 	cfg := d.config.Load().(*SealConfig)
 	if cfg == nil {
@@ -340,10 +380,6 @@ func readStoredKeys(ctx context.Context, storage physical.Backend, encryptor sea
 }
 
 func (c *Core) SetPhysicalSealGenInfo(ctx context.Context, sealGenInfo *seal.SealGenerationInfo) error {
-	if !server.IsMultisealSupported() {
-		return nil
-	}
-
 	if sealGenInfo == nil {
 		return errors.New("invalid seal generation information: generation is unknown")
 	}
@@ -368,10 +404,6 @@ func (c *Core) SetPhysicalSealGenInfo(ctx context.Context, sealGenInfo *seal.Sea
 }
 
 func PhysicalSealGenInfo(ctx context.Context, storage physical.Backend) (*seal.SealGenerationInfo, error) {
-	if !server.IsMultisealSupported() {
-		return nil, nil
-	}
-
 	pe, err := storage.Get(ctx, SealGenInfoPath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch seal generation info: %w", err)
diff --git a/vault/seal/envelope.go b/vault/seal/envelope.go
index 8efb70ebbc9..b296277fa12 100644
--- a/vault/seal/envelope.go
+++ b/vault/seal/envelope.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package seal
diff --git a/vault/seal/envelope_test.go b/vault/seal/envelope_test.go
index 98368ba62fa..d010b0568d2 100644
--- a/vault/seal/envelope_test.go
+++ b/vault/seal/envelope_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package seal
diff --git a/vault/seal/multi_wrap_value.pb.go b/vault/seal/multi_wrap_value.pb.go
index 7f2696da273..e3d79a6351b 100644
--- a/vault/seal/multi_wrap_value.pb.go
+++ b/vault/seal/multi_wrap_value.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: vault/seal/multi_wrap_value.proto
 
@@ -15,6 +15,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -26,23 +27,20 @@ const (
 
 // MultiWrapValue can be used to keep track of different encryptions of a value.
 type MultiWrapValue struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
+	state protoimpl.MessageState `protogen:"open.v1"`
 	// Generation is used to keep track of when the MultiWrapValue was generated.
 	Generation uint64 `protobuf:"varint,1,opt,name=generation,proto3" json:"generation,omitempty"`
 	// Slots has a BlobInfo for each key used to encrypt the value.
-	Slots []*v2.BlobInfo `protobuf:"bytes,2,rep,name=slots,proto3" json:"slots,omitempty"`
+	Slots         []*v2.BlobInfo `protobuf:"bytes,2,rep,name=slots,proto3" json:"slots,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *MultiWrapValue) Reset() {
 	*x = MultiWrapValue{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_seal_multi_wrap_value_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_seal_multi_wrap_value_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *MultiWrapValue) String() string {
@@ -53,7 +51,7 @@ func (*MultiWrapValue) ProtoMessage() {}
 
 func (x *MultiWrapValue) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_seal_multi_wrap_value_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -84,7 +82,7 @@ func (x *MultiWrapValue) GetSlots() []*v2.BlobInfo {
 
 var File_vault_seal_multi_wrap_value_proto protoreflect.FileDescriptor
 
-var file_vault_seal_multi_wrap_value_proto_rawDesc = []byte{
+var file_vault_seal_multi_wrap_value_proto_rawDesc = string([]byte{
 	0x0a, 0x21, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x73, 0x65, 0x61, 0x6c, 0x2f, 0x6d, 0x75, 0x6c,
 	0x74, 0x69, 0x5f, 0x77, 0x72, 0x61, 0x70, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x2e, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x12, 0x04, 0x73, 0x65, 0x61, 0x6c, 0x1a, 0x33, 0x67, 0x69, 0x74, 0x68, 0x75,
@@ -102,22 +100,22 @@ var file_vault_seal_multi_wrap_value_proto_rawDesc = []byte{
 	0x27, 0x5a, 0x25, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61,
 	0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x76, 0x61,
 	0x75, 0x6c, 0x74, 0x2f, 0x73, 0x65, 0x61, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_vault_seal_multi_wrap_value_proto_rawDescOnce sync.Once
-	file_vault_seal_multi_wrap_value_proto_rawDescData = file_vault_seal_multi_wrap_value_proto_rawDesc
+	file_vault_seal_multi_wrap_value_proto_rawDescData []byte
 )
 
 func file_vault_seal_multi_wrap_value_proto_rawDescGZIP() []byte {
 	file_vault_seal_multi_wrap_value_proto_rawDescOnce.Do(func() {
-		file_vault_seal_multi_wrap_value_proto_rawDescData = protoimpl.X.CompressGZIP(file_vault_seal_multi_wrap_value_proto_rawDescData)
+		file_vault_seal_multi_wrap_value_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_vault_seal_multi_wrap_value_proto_rawDesc), len(file_vault_seal_multi_wrap_value_proto_rawDesc)))
 	})
 	return file_vault_seal_multi_wrap_value_proto_rawDescData
 }
 
 var file_vault_seal_multi_wrap_value_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
-var file_vault_seal_multi_wrap_value_proto_goTypes = []interface{}{
+var file_vault_seal_multi_wrap_value_proto_goTypes = []any{
 	(*MultiWrapValue)(nil), // 0: seal.MultiWrapValue
 	(*v2.BlobInfo)(nil),    // 1: github.com.hashicorp.go.kms.wrapping.v2.types.BlobInfo
 }
@@ -135,25 +133,11 @@ func file_vault_seal_multi_wrap_value_proto_init() {
 	if File_vault_seal_multi_wrap_value_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_vault_seal_multi_wrap_value_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MultiWrapValue); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_vault_seal_multi_wrap_value_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_vault_seal_multi_wrap_value_proto_rawDesc), len(file_vault_seal_multi_wrap_value_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   1,
 			NumExtensions: 0,
@@ -164,7 +148,6 @@ func file_vault_seal_multi_wrap_value_proto_init() {
 		MessageInfos:      file_vault_seal_multi_wrap_value_proto_msgTypes,
 	}.Build()
 	File_vault_seal_multi_wrap_value_proto = out.File
-	file_vault_seal_multi_wrap_value_proto_rawDesc = nil
 	file_vault_seal_multi_wrap_value_proto_goTypes = nil
 	file_vault_seal_multi_wrap_value_proto_depIdxs = nil
 }
diff --git a/vault/seal/multi_wrap_value.proto b/vault/seal/multi_wrap_value.proto
index 8e1ecf7321e..de9379a191e 100644
--- a/vault/seal/multi_wrap_value.proto
+++ b/vault/seal/multi_wrap_value.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
diff --git a/vault/seal/seal.go b/vault/seal/seal.go
index 812d5deba72..755a88efb6a 100644
--- a/vault/seal/seal.go
+++ b/vault/seal/seal.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package seal
@@ -59,6 +59,7 @@ type SealGenerationInfo struct {
 	Generation uint64
 	Seals      []*configutil.KMS
 	rewrapped  atomic.Bool
+	Enabled    bool
 }
 
 // Validate is used to sanity check the seal generation info being created
@@ -81,6 +82,15 @@ func (sgi *SealGenerationInfo) Validate(existingSgi *SealGenerationInfo, hasPart
 		return nil
 	}
 
+	// Validate that we're in a safe spot with respect to disabling multiseal
+	if existingSgi.Enabled && !sgi.Enabled {
+		if len(existingSgi.Seals) > 1 {
+			return fmt.Errorf("multi-seal is disabled but previous configuration had multiple seals.  re-enable and migrate to a single seal before disabling multi-seal")
+		} else if !existingSgi.IsRewrapped() {
+			return fmt.Errorf("multi-seal is disabled but previous storage was not fully re-wrapped, re-enable multi-seal and allow rewrapping to complete before disabling multi-seal")
+		}
+	}
+
 	existingSealNameAndType := sealNameAndTypeAsStr(existingSgi.Seals)
 	previousShamirConfigured := false
 
@@ -234,6 +244,7 @@ type sealGenerationInfoJson struct {
 	Generation uint64
 	Seals      []*configutil.KMS
 	Rewrapped  bool
+	Enabled    bool
 }
 
 func (sgi *SealGenerationInfo) MarshalJSON() ([]byte, error) {
@@ -241,6 +252,7 @@ func (sgi *SealGenerationInfo) MarshalJSON() ([]byte, error) {
 		Generation: sgi.Generation,
 		Seals:      sgi.Seals,
 		Rewrapped:  sgi.IsRewrapped(),
+		Enabled:    sgi.Enabled,
 	})
 }
 
@@ -253,6 +265,7 @@ func (sgi *SealGenerationInfo) UnmarshalJSON(b []byte) error {
 	sgi.Generation = value.Generation
 	sgi.Seals = value.Seals
 	sgi.SetRewrapped(value.Rewrapped)
+	sgi.Enabled = value.Enabled
 
 	return nil
 }
@@ -412,6 +425,10 @@ func healthyWrappers(wrapper *SealWrapper) bool {
 	return wrapper.IsHealthy()
 }
 
+func unhealthyWrappers(wrapper *SealWrapper) bool {
+	return !wrapper.IsHealthy()
+}
+
 func enabledWrappers(wrapper *SealWrapper) bool {
 	return !wrapper.Disabled
 }
@@ -490,11 +507,17 @@ func (a *access) IsUpToDate(ctx context.Context, value *MultiWrapValue, forceKey
 			return false, JoinSealWrapErrors("cannot determine key IDs of Access wrappers", errs)
 		}
 		if len(errs) > 0 {
-			msg := "could not determine key IDs of some Access wrappers"
-			a.logger.Error("partial failure refreshing seal key IDs", "err", JoinSealWrapErrors(msg, errs))
-			return false, JoinSealWrapErrors(msg, errs)
+			a.logger.Warn("cannot determine if seal wrapped entry needs update: there were errors determining the key IDs for one or more seals")
+			a.logger.Debug("cannot determine if seal wrapped entry needs update", "err", JoinSealWrapErrors("error refreshing key IDs of Access wrappers", errs))
+
+			// Return true, since the encrypted values cannot be re-encrypted without
+			// losing the ciphertext of unhealthy wrappers.
+			return true, nil
 		}
-		a.keyIdSet.set(test)
+	} else if !a.keyIdSet.initialized() {
+		// Since the key ID set is not initialized, we cannot determine if the value is up-to-date, so assume it is.
+		// Note that we cannot just force an update, since that breaks migrations to a Shamir defaultSeal.
+		return true, nil
 	}
 
 	return a.keyIdSet.equal(value), nil
@@ -513,10 +536,30 @@ const (
 
 // Encrypt uses the underlying seal to encrypt the plaintext and returns it.
 func (a *access) Encrypt(ctx context.Context, plaintext []byte, options ...wrapping.Option) (*MultiWrapValue, map[string]error) {
+	errs := make(map[string]error)
+
 	// Note that we do not encrypt with disabled wrappers. Disabled wrappers are only used to decrypt.
 	candidateWrappers := a.filterSealWrappers(enabledWrappers, healthyWrappers)
-	if len(candidateWrappers) == 0 {
-		// If all seals are unhealthy, try any way since a seal may have recovered
+	if len(candidateWrappers) > 0 {
+		// As there are healthy wrappers, add errors for any unhealthy ones, so that it
+		// it is clear that the resulting MultiWrapValue is missing ciphertext for some seals.
+		for i, unhealthyWrapper := range a.filterSealWrappers(enabledWrappers, unhealthyWrappers) {
+			var keyId string
+			if unhealthyWrapper.Wrapper != nil {
+				// Annoying, apparently Wrapper may be null, see setSeal() in server.go,
+				// in the config seal loop.
+				keyId, _ = unhealthyWrapper.Wrapper.KeyId(ctx)
+			}
+			if keyId == "" {
+				keyId = unhealthyWrapper.Name
+				if _, duplicated := errs[keyId]; duplicated {
+					keyId = fmt.Sprintf("%s-%d", keyId, i)
+				}
+			}
+			errs[keyId] = errors.New("seal is unhealthy")
+		}
+	} else {
+		// If all seals are unhealthy, try with all of them since a seal may have recovered.
 		candidateWrappers = a.filterSealWrappers(enabledWrappers)
 	}
 	enabledWrappersByPriority := filterSealWrappers(candidateWrappers, configuredWrappers)
@@ -590,7 +633,6 @@ GATHER_RESULTS:
 
 	// Sort out the successful results from the errors
 	var slots []*wrapping.BlobInfo
-	errs := make(map[string]error)
 	for _, sealWrapper := range enabledWrappersByPriority {
 		if result, ok := results[sealWrapper.Name]; ok {
 			if result.err != nil {
@@ -675,6 +717,7 @@ func (a *access) tryEncrypt(ctx context.Context, sealWrapper *SealWrapper, plain
 func (a *access) Decrypt(ctx context.Context, ciphertext *MultiWrapValue, options ...wrapping.Option) ([]byte, bool, error) {
 	isUpToDate, err := a.IsUpToDate(ctx, ciphertext, false)
 	if err != nil {
+		a.logger.Trace("UNWRAP error in isUpToDate check", "error", err)
 		return nil, false, err
 	}
 
@@ -682,8 +725,10 @@ func (a *access) Decrypt(ctx context.Context, ciphertext *MultiWrapValue, option
 	if len(wrappersByPriority) == 0 {
 		// If all seals are unhealthy, try any way since a seal may have recovered
 		wrappersByPriority = a.filterSealWrappers(configuredWrappers)
+		a.logger.Trace("UNWRAP all seals are unhealthy, trying all configured seals")
 	}
 	if len(wrappersByPriority) == 0 {
+		a.logger.Trace("UNWRAP no healty seals", "error", ErrNoHealthySeals)
 		return nil, false, ErrNoHealthySeals
 	}
 
@@ -724,6 +769,7 @@ func (a *access) Decrypt(ctx context.Context, ciphertext *MultiWrapValue, option
 	// Start goroutines to decrypt the value
 	first := wrappersByPriority[0]
 	found := false
+	var sealKeyIds []string
 outer:
 	// This loop finds the highest priority seal with a keyId in common with the blobInfoMap,
 	// and ensures we'll use it first.  This should equal the highest priority wrapper in the nominal
@@ -732,10 +778,12 @@ outer:
 	for _, sealWrapper := range wrappersByPriority {
 		keyId, err := sealWrapper.Wrapper.KeyId(ctx)
 		if err != nil {
+			a.logger.Trace("UNWRAP error calling sealWrapper.Wrapper.KeyId()", "sealWrapper.Name", sealWrapper.Name, "error", err)
 			resultWg.Add(1)
 			go reportResult(sealWrapper.Name, nil, false, err)
 			continue
 		}
+		sealKeyIds = append(sealKeyIds, keyId)
 		if bi := ciphertext.BlobInfoForKeyId(keyId); bi != nil {
 			found = true
 			first = sealWrapper
@@ -745,6 +793,26 @@ outer:
 
 	if !found {
 		a.logger.Warn("while unwrapping, value has no key-id in common with currently healthy seals.  Trying all healthy seals")
+
+		if a.logger.IsTrace() {
+			var blobInfoKeyIds []string
+			for _, bi := range ciphertext.Slots {
+				if bi.KeyInfo == nil {
+					blobInfoKeyIds = append(blobInfoKeyIds, "<nil KeyInfo>")
+				} else if bi.KeyInfo.KeyId == "" {
+					blobInfoKeyIds = append(blobInfoKeyIds, "<nil KeyId>")
+				} else {
+					blobInfoKeyIds = append(blobInfoKeyIds, bi.KeyInfo.KeyId)
+				}
+			}
+			var configKeyIds []string
+			for _, cfg := range a.sealGenerationInfo.Seals {
+				configKeyIds = append(configKeyIds, cfg.Config["kms_key_id"])
+			}
+			a.logger.Trace("UNWRAP no common key IDs SEAL CONFIG", "sealGenerationInfo.Generation", a.sealGenerationInfo.Generation, "sealWrapper.Wrapper.KeyId", configKeyIds)
+			a.logger.Trace("UNWRAP no common key IDs SEAL ACTUAL", "sealGenerationInfo.Generation", a.sealGenerationInfo.Generation, "sealWrapper.Wrapper.KeyId", sealKeyIds)
+			a.logger.Trace("UNWRAP no common key IDs BLOB INFO  ", "ciphertext.Generation", ciphertext.Generation, "blobInfo.KeyInfo.KeyIds", blobInfoKeyIds)
+		}
 	}
 
 	resultWg.Add(1)
@@ -818,21 +886,40 @@ func (a *access) tryDecrypt(ctx context.Context, sealWrapper *SealWrapper, value
 	var keyId string
 	if id, err := sealWrapper.Wrapper.KeyId(ctx); err == nil {
 		keyId = id
-		if ciphertext := value.BlobInfoForKeyId(keyId); ciphertext != nil {
+		ciphertext := value.BlobInfoForKeyId(keyId)
+		if ciphertext != nil {
 			pt, decryptErr = sealWrapper.Wrapper.Decrypt(ctx, ciphertext, options...)
 
-			sealWrapper.SetHealthy(decryptErr == nil || IsOldKeyError(decryptErr), now)
+			healthy := decryptErr == nil || IsOldKeyError(decryptErr)
+			sealWrapper.SetHealthy(healthy, now)
+			if healthy {
+				a.logger.Trace("UNWRAP exact key ID match decrypt success", "sealWrapper.Name", sealWrapper.Name, "sealWrapper.Wrapper.KeyId", keyId)
+			} else {
+				a.logger.Trace("UNWRAP exact key ID match decrypt failure", "sealWrapper.Name", sealWrapper.Name, "sealWrapper.Wrapper.KeyId", keyId, "error", decryptErr)
+			}
 		}
 	}
 	// If we don't get a result, try all the slots
 	if pt == nil && decryptErr == nil {
+		a.logger.Trace("UNWRAP no exact key ID match, trying all blob infos", "sealWrapper.Name", sealWrapper.Name)
 		for _, ciphertext := range value.Slots {
 			pt, decryptErr = sealWrapper.Wrapper.Decrypt(ctx, ciphertext, options...)
+			var keyId string
+			if a.logger.IsTrace() {
+				if id, keyIdErr := sealWrapper.Wrapper.KeyId(ctx); keyIdErr != nil {
+					keyId = fmt.Sprintf("error getting key ID: %v", keyIdErr)
+				} else {
+					keyId = id
+				}
+			}
 			if decryptErr == nil {
 				// Note that we only update wrapper health for failures on exact key ID match,
 				// otherwise we would have false negatives.
 				sealWrapper.SetHealthy(true, now)
+				a.logger.Trace("UNWRAP inexact key ID match decrypt success", "sealWrapper.Name", sealWrapper.Name, "sealWrapper.Wrapper.KeyId", keyId)
 				break
+			} else {
+				a.logger.Trace("UNWRAP inexact key ID match decrypt failure", "seal_name", sealWrapper.Name, "sealWrapper.Wrapper.KeyId", keyId, "error", decryptErr)
 			}
 		}
 	}
@@ -924,6 +1011,10 @@ type keyIdSet struct {
 	keyIds atomic.Pointer[[]string]
 }
 
+func (s *keyIdSet) initialized() bool {
+	return len(s.get()) > 0
+}
+
 func (s *keyIdSet) set(value *MultiWrapValue) {
 	keyIds := s.collect(value)
 	s.setIds(keyIds)
diff --git a/vault/seal/seal_test.go b/vault/seal/seal_test.go
index 76a02d9a278..1bb2e9389ef 100644
--- a/vault/seal/seal_test.go
+++ b/vault/seal/seal_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package seal
diff --git a/vault/seal/seal_testing.go b/vault/seal/seal_testing.go
index 1a2d586b435..65cbce1b59c 100644
--- a/vault/seal/seal_testing.go
+++ b/vault/seal/seal_testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package seal
diff --git a/vault/seal/seal_wrapper.go b/vault/seal/seal_wrapper.go
index 421024c7e8a..5f7127fca1a 100644
--- a/vault/seal/seal_wrapper.go
+++ b/vault/seal/seal_wrapper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package seal
@@ -15,6 +15,12 @@ import (
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 )
 
+var RequireFullWrap = struct{}{}
+
+func ContextWithFullRewrapRequired(ctx context.Context) context.Context {
+	return context.WithValue(ctx, RequireFullWrap, true)
+}
+
 type PartialSealWrapError struct {
 	Err error
 }
@@ -51,29 +57,32 @@ type SealWrapper struct {
 
 func NewSealWrapper(wrapper wrapping.Wrapper, priority int, name string, sealConfigType string, disabled bool, configured bool) *SealWrapper {
 	ret := &SealWrapper{
-		Wrapper:        wrapper,
-		Priority:       priority,
-		Name:           name,
-		SealConfigType: sealConfigType,
-		Disabled:       disabled,
-		Configured:     configured,
+		Wrapper:         wrapper,
+		Priority:        priority,
+		Name:            name,
+		SealConfigType:  sealConfigType,
+		Disabled:        disabled,
+		Configured:      configured,
+		lastSeenHealthy: time.Now(),
+		healthy:         false,
 	}
 
 	if configured {
-		setHealth(ret, true, time.Now(), ret.lastHealthCheck)
-	} else {
-		setHealth(ret, false, time.Now(), ret.lastHealthCheck)
+		ret.healthy = true
 	}
 
 	return ret
 }
 
 func (sw *SealWrapper) SetHealthy(healthy bool, checkTime time.Time) {
+	sw.hcLock.Lock()
+	defer sw.hcLock.Unlock()
+
+	sw.healthy = healthy
+	sw.lastHealthCheck = checkTime
+
 	if healthy {
-		setHealth(sw, true, checkTime, checkTime)
-	} else {
-		// do not update lastSeenHealthy
-		setHealth(sw, false, sw.lastHealthCheck, checkTime)
+		sw.lastSeenHealthy = checkTime
 	}
 }
 
@@ -134,13 +143,3 @@ func getHealth(sw *SealWrapper) (healthy bool, lastSeenHealthy time.Time, lastHe
 
 	return sw.healthy, sw.lastSeenHealthy, sw.lastHealthCheck
 }
-
-// setHealth is the only function allowed to mutate the health fields
-func setHealth(sw *SealWrapper, healthy bool, lastSeenHealthy, lastHealthCheck time.Time) {
-	sw.hcLock.Lock()
-	defer sw.hcLock.Unlock()
-
-	sw.healthy = healthy
-	sw.lastSeenHealthy = lastSeenHealthy
-	sw.lastHealthCheck = lastHealthCheck
-}
diff --git a/vault/seal_access.go b/vault/seal_access.go
index c124310ba26..2cd1fb96c85 100644
--- a/vault/seal_access.go
+++ b/vault/seal_access.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/seal_autoseal.go b/vault/seal_autoseal.go
index c3edf9d8a02..4efd27f5c49 100644
--- a/vault/seal_autoseal.go
+++ b/vault/seal_autoseal.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -118,6 +118,18 @@ func (d *autoSeal) SetStoredKeys(ctx context.Context, keys [][]byte) error {
 	return writeStoredKeys(ctx, d.core.physical, d.Access, keys)
 }
 
+func (d *autoSeal) SetInitializationFlag(ctx context.Context) error {
+	return writeInitializationFlag(ctx, d.core.physical, true)
+}
+
+func (d *autoSeal) ClearInitializationFlag(ctx context.Context) error {
+	return writeInitializationFlag(ctx, d.core.physical, false)
+}
+
+func (d *autoSeal) IsInitializationFlagSet(ctx context.Context) (bool, error) {
+	return isInitializationFlagSet(ctx, d.core.physical)
+}
+
 // GetStoredKeys retrieves the key shares by unwrapping the encrypted key using the
 // autoseal.
 func (d *autoSeal) GetStoredKeys(ctx context.Context) ([][]byte, error) {
@@ -194,7 +206,7 @@ func (d *autoSeal) BarrierConfig(ctx context.Context) (*SealConfig, error) {
 
 	barrierTypeUpgradeCheck(d.BarrierSealConfigType(), conf)
 
-	if conf.Type != d.BarrierSealConfigType().String() && conf.Type != SealConfigTypeMultiseal.String() && d.BarrierSealConfigType() != SealConfigTypeMultiseal {
+	if !CompatibleSealTypes(conf.Type, d.BarrierSealConfigType().String()) {
 		d.logger.Error("barrier seal type does not match loaded type", "seal_type", conf.Type, "loaded_type", d.BarrierSealConfigType())
 		return nil, fmt.Errorf("barrier seal type of %q does not match loaded type of %q", conf.Type, d.BarrierSealConfigType())
 	}
@@ -203,6 +215,10 @@ func (d *autoSeal) BarrierConfig(ctx context.Context) (*SealConfig, error) {
 	return conf.Clone(), nil
 }
 
+func CompatibleSealTypes(a, b string) bool {
+	return a == b || a == SealConfigTypeMultiseal.String() || b == SealConfigTypeMultiseal.String()
+}
+
 func (d *autoSeal) ClearBarrierConfig(ctx context.Context) error {
 	return d.SetBarrierConfig(ctx, nil)
 }
@@ -453,7 +469,7 @@ func (d *autoSeal) migrateRecoveryConfig(ctx context.Context) error {
 
 // StartHealthCheck starts a goroutine that tests the health of the auto-unseal backend once every 10 minutes.
 // If unhealthy, logs a warning on the condition and begins testing every one minute until healthy again.
-func (d *autoSeal) StartHealthCheck() {
+func (d *autoSeal) StartHealthCheck(ctx context.Context) {
 	d.StopHealthCheck()
 	d.hcLock.Lock()
 	defer d.hcLock.Unlock()
@@ -461,14 +477,18 @@ func (d *autoSeal) StartHealthCheck() {
 	healthCheck := time.NewTicker(seal.HealthTestIntervalNominal)
 	d.healthCheckStop = make(chan struct{})
 	healthCheckStop := d.healthCheckStop
-	ctx := d.core.activeContext
 
 	go func() {
 		lastTestOk := true
 		lastSeenOk := time.Now()
 
 		check := func(now time.Time) {
-			ctx, cancel := context.WithTimeout(ctx, seal.HealthTestTimeout)
+			if d.core.activeContext == nil {
+				// This probably only happens during the execution of some unit tests.
+				d.logger.Warn("no active context, skipping this health check")
+				return
+			}
+			ctx, cancel := context.WithTimeout(d.core.activeContext, seal.HealthTestTimeout)
 			defer cancel()
 
 			d.logger.Trace("performing a seal health check")
@@ -513,7 +533,7 @@ error and restart Vault.`)
 				d.core.MetricSink().SetGauge(autoSealUnavailableDuration, 0)
 			} else {
 				if lastTestOk && allUnhealthy {
-					d.logger.Info("seal backend is completely unhealthy (all seal wrappers all unhealthy)", "downtime", now.Sub(lastSeenOk).String())
+					d.logger.Error("seal backend is completely unhealthy (all seal wrappers all unhealthy)", "downtime", now.Sub(lastSeenOk).String())
 				}
 				lastTestOk = false
 				healthCheck.Reset(seal.HealthTestIntervalUnhealthy)
@@ -525,8 +545,15 @@ error and restart Vault.`)
 			d.allSealsHealthy = allHealthy
 		}
 
+		check(time.Now())
 		for {
 			select {
+			case <-ctx.Done():
+				if healthCheck != nil {
+					healthCheck.Stop()
+				}
+				healthCheckStop = nil
+				return
 			case <-healthCheckStop:
 				if healthCheck != nil {
 					healthCheck.Stop()
diff --git a/vault/seal_autoseal_test.go b/vault/seal_autoseal_test.go
index 223194d5437..fe3b4fe1876 100644
--- a/vault/seal_autoseal_test.go
+++ b/vault/seal_autoseal_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -190,7 +190,7 @@ func TestAutoSeal_HealthCheck(t *testing.T) {
 	autoSeal := NewAutoSeal(testSealAccess)
 	autoSeal.SetCore(core)
 	core.seal = autoSeal
-	autoSeal.StartHealthCheck()
+	autoSeal.StartHealthCheck(t.Context())
 	defer autoSeal.StopHealthCheck()
 	wrappers[0].SetError(errors.New("disconnected"))
 
diff --git a/vault/seal_config.go b/vault/seal_config.go
index cc81a983c7b..6a4153e4baa 100644
--- a/vault/seal_config.go
+++ b/vault/seal_config.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"encoding/base64"
 	"fmt"
+	"time"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
@@ -65,6 +66,9 @@ type SealConfig struct {
 
 	// Name is the name provided in the seal configuration to identify the seal
 	Name string `json:"name" mapstructure:"name"`
+
+	// Created is the time of creation in UTC
+	Created time.Time `json:"-"`
 }
 
 // Validate is used to sanity check the seal configuration
diff --git a/vault/seal_rewrap_stubs_oss.go b/vault/seal_rewrap_stubs_oss.go
index 0f5d569f23e..d614afcfea9 100644
--- a/vault/seal_rewrap_stubs_oss.go
+++ b/vault/seal_rewrap_stubs_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/seal_stubs_oss.go b/vault/seal_stubs_oss.go
index 7e68a9fa369..a76b26744f1 100644
--- a/vault/seal_stubs_oss.go
+++ b/vault/seal_stubs_oss.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/seal_test.go b/vault/seal_test.go
index 48aba5ec31f..cedc7dd7315 100644
--- a/vault/seal_test.go
+++ b/vault/seal_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/seal_testing.go b/vault/seal_testing.go
index 87ba9706148..8eb53fc52bd 100644
--- a/vault/seal_testing.go
+++ b/vault/seal_testing.go
@@ -1,17 +1,17 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
 	"context"
+	testing "testing"
 
 	"github.com/hashicorp/vault/vault/seal"
 	vaultseal "github.com/hashicorp/vault/vault/seal"
-	testing "github.com/mitchellh/go-testing-interface"
 )
 
-func TestCoreUnsealedWithConfigs(t testing.T, barrierConf, recoveryConf *SealConfig) (*Core, [][]byte, [][]byte, string) {
+func TestCoreUnsealedWithConfigs(t testing.TB, barrierConf, recoveryConf *SealConfig) (*Core, [][]byte, [][]byte, string) {
 	t.Helper()
 	opts := &seal.TestSealOpts{}
 	if recoveryConf == nil {
@@ -20,7 +20,7 @@ func TestCoreUnsealedWithConfigs(t testing.T, barrierConf, recoveryConf *SealCon
 	return TestCoreUnsealedWithConfigSealOpts(t, barrierConf, recoveryConf, opts)
 }
 
-func TestCoreUnsealedWithConfigSealOpts(t testing.T, barrierConf, recoveryConf *SealConfig, sealOpts *seal.TestSealOpts) (*Core, [][]byte, [][]byte, string) {
+func TestCoreUnsealedWithConfigSealOpts(t testing.TB, barrierConf, recoveryConf *SealConfig, sealOpts *seal.TestSealOpts) (*Core, [][]byte, [][]byte, string) {
 	t.Helper()
 	seal := NewTestSeal(t, sealOpts)
 	core := TestCoreWithSeal(t, seal, false)
diff --git a/vault/seal_testing_util.go b/vault/seal_testing_util.go
index ea735b08750..d8c374a5097 100644
--- a/vault/seal_testing_util.go
+++ b/vault/seal_testing_util.go
@@ -1,18 +1,19 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
 
 import (
+	testing "testing"
+
 	"github.com/hashicorp/go-kms-wrapping/wrappers/aead/v2"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/vault/seal"
-	testing "github.com/mitchellh/go-testing-interface"
 )
 
 // NewTestSeal creates a new seal for testing. If you want to use the same seal multiple times, such as for
 // a cluster, use NewTestSealFunc instead.
-func NewTestSeal(t testing.T, opts *seal.TestSealOpts) Seal {
+func NewTestSeal(t testing.TB, opts *seal.TestSealOpts) Seal {
 	t.Helper()
 	opts = seal.NewTestSealOpts(opts)
 	logger := corehelpers.NewTestLogger(t).Named("sealAccess")
@@ -55,7 +56,7 @@ func NewTestSeal(t testing.T, opts *seal.TestSealOpts) Seal {
 
 // NewTestSealFunc returns a function that creates seals. All such seals will have TestWrappers that
 // share the same secret, thus making them equivalent.
-func NewTestSealFunc(t testing.T, opts *seal.TestSealOpts) func() Seal {
+func NewTestSealFunc(t testing.TB, opts *seal.TestSealOpts) func() Seal {
 	testSeal := NewTestSeal(t, opts)
 
 	return func() Seal {
@@ -64,12 +65,12 @@ func NewTestSealFunc(t testing.T, opts *seal.TestSealOpts) func() Seal {
 }
 
 // CloneTestSeal creates a new test seal that shares the same seal wrappers as `testSeal`.
-func cloneTestSeal(t testing.T, testSeal Seal) Seal {
+func cloneTestSeal(t testing.TB, testSeal Seal) Seal {
 	logger := corehelpers.NewTestLogger(t).Named("sealAccess")
 
 	access, err := seal.NewAccessFromSealWrappers(logger, testSeal.GetAccess().Generation(), testSeal.GetAccess().GetSealGenerationInfo().IsRewrapped(), testSeal.GetAccess().GetAllSealWrappersByPriority())
 	if err != nil {
-		t.Fatal("error cloning seal %v", err)
+		t.Fatalf("error cloning seal %v", err)
 	}
 	if testSeal.StoredKeysSupported() == seal.StoredKeysNotSupported {
 		return NewDefaultSeal(access)
diff --git a/vault/seal_util.go b/vault/seal_util.go
index 4ba94f6a98c..bd07be2eefa 100644
--- a/vault/seal_util.go
+++ b/vault/seal_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/seal_util_test.go b/vault/seal_util_test.go
index efbaeb428cc..5ed0b5b48d7 100644
--- a/vault/seal_util_test.go
+++ b/vault/seal_util_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/seal_wrapped_value.go b/vault/seal_wrapped_value.go
index 44399fa9f99..1c1a8c982a7 100644
--- a/vault/seal_wrapped_value.go
+++ b/vault/seal_wrapped_value.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/seal_wrapped_value_test.go b/vault/seal_wrapped_value_test.go
index 4572557bfe7..ae65706c392 100644
--- a/vault/seal_wrapped_value_test.go
+++ b/vault/seal_wrapped_value_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/sealmigrationcheckresult_enumer.go b/vault/sealmigrationcheckresult_enumer.go
new file mode 100644
index 00000000000..055756426a7
--- /dev/null
+++ b/vault/sealmigrationcheckresult_enumer.go
@@ -0,0 +1,51 @@
+// Code generated by "enumer -type=sealMigrationCheckResult -trimprefix=sealMigrationCheck -transform=snake"; DO NOT EDIT.
+
+package vault
+
+import (
+	"fmt"
+)
+
+const _sealMigrationCheckResultName = "errorskipadjustdo_not_ajust"
+
+var _sealMigrationCheckResultIndex = [...]uint8{0, 5, 9, 15, 27}
+
+func (i sealMigrationCheckResult) String() string {
+	if i < 0 || i >= sealMigrationCheckResult(len(_sealMigrationCheckResultIndex)-1) {
+		return fmt.Sprintf("sealMigrationCheckResult(%d)", i)
+	}
+	return _sealMigrationCheckResultName[_sealMigrationCheckResultIndex[i]:_sealMigrationCheckResultIndex[i+1]]
+}
+
+var _sealMigrationCheckResultValues = []sealMigrationCheckResult{0, 1, 2, 3}
+
+var _sealMigrationCheckResultNameToValueMap = map[string]sealMigrationCheckResult{
+	_sealMigrationCheckResultName[0:5]:   0,
+	_sealMigrationCheckResultName[5:9]:   1,
+	_sealMigrationCheckResultName[9:15]:  2,
+	_sealMigrationCheckResultName[15:27]: 3,
+}
+
+// sealMigrationCheckResultString retrieves an enum value from the enum constants string name.
+// Throws an error if the param is not part of the enum.
+func sealMigrationCheckResultString(s string) (sealMigrationCheckResult, error) {
+	if val, ok := _sealMigrationCheckResultNameToValueMap[s]; ok {
+		return val, nil
+	}
+	return 0, fmt.Errorf("%s does not belong to sealMigrationCheckResult values", s)
+}
+
+// sealMigrationCheckResultValues returns all values of the enum
+func sealMigrationCheckResultValues() []sealMigrationCheckResult {
+	return _sealMigrationCheckResultValues
+}
+
+// IsAsealMigrationCheckResult returns "true" if the value is listed in the enum definition. "false" otherwise
+func (i sealMigrationCheckResult) IsAsealMigrationCheckResult() bool {
+	for _, v := range _sealMigrationCheckResultValues {
+		if i == v {
+			return true
+		}
+	}
+	return false
+}
diff --git a/vault/sealunwrapper.go b/vault/sealunwrapper.go
index 27f4cd48270..0861d5b32d8 100644
--- a/vault/sealunwrapper.go
+++ b/vault/sealunwrapper.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -18,10 +18,9 @@ import (
 // NewSealUnwrapper creates a new seal unwrapper
 func NewSealUnwrapper(underlying physical.Backend, logger log.Logger) physical.Backend {
 	ret := &sealUnwrapper{
-		underlying:   underlying,
-		logger:       logger,
-		locks:        locksutil.CreateLocks(),
-		allowUnwraps: new(uint32),
+		underlying: underlying,
+		logger:     logger,
+		locks:      locksutil.CreateLocks(),
 	}
 
 	if underTxn, ok := underlying.(physical.Transactional); ok {
@@ -43,7 +42,7 @@ type sealUnwrapper struct {
 	underlying   physical.Backend
 	logger       log.Logger
 	locks        []*locksutil.LockEntry
-	allowUnwraps *uint32
+	allowUnwraps atomic.Bool
 }
 
 // transactionalSealUnwrapper is a seal unwrapper that wraps a physical that is transactional
@@ -63,63 +62,70 @@ func (d *sealUnwrapper) Put(ctx context.Context, entry *physical.Entry) error {
 	return d.underlying.Put(ctx, entry)
 }
 
-// unwrap gets an entry from underlying storage and tries to unwrap it. If the entry was not wrapped, return
-// value unwrappedEntry will be nil. If the entry is wrapped and encrypted, an error is returned.
-func (d *sealUnwrapper) unwrap(ctx context.Context, key string) (entry, unwrappedEntry *physical.Entry, err error) {
-	entry, err = d.underlying.Get(ctx, key)
+// unwrap gets an entry from underlying storage and tries to unwrap it.
+// - If the entry is not wrapped: the entry will be returned unchanged and wasWrapped will be false
+// - If the entry is wrapped and encrypted: an error is returned.
+// - If the entry is wrapped but not encrypted: the entry will be unwrapped and returned. wasWrapped will be true.
+func (d *sealUnwrapper) unwrap(ctx context.Context, key string) (unwrappedEntry *physical.Entry, wasWrapped bool, err error) {
+	entry, err := d.underlying.Get(ctx, key)
 	if err != nil {
-		return nil, nil, err
+		return nil, false, err
 	}
 	if entry == nil {
-		return nil, nil, err
+		return nil, false, nil
 	}
 
 	wrappedEntryValue, unmarshaled := UnmarshalSealWrappedValueWithCanary(entry.Value)
 	switch {
 	case !unmarshaled:
-		unwrappedEntry = entry
+		// Entry is not wrapped
+		return entry, false, nil
 	case wrappedEntryValue.isEncrypted():
-		return nil, nil, fmt.Errorf("cannot decode sealwrapped storage entry %q", entry.Key)
+		// Entry is wrapped and encrypted
+		return nil, true, fmt.Errorf("cannot decode sealwrapped storage entry %q", entry.Key)
 	default:
+		// Entry is wrapped and not encrypted
 		pt, err := wrappedEntryValue.getPlaintextValue()
 		if err != nil {
-			return nil, nil, err
+			return nil, true, err
 		}
-		unwrappedEntry = &physical.Entry{
+		return &physical.Entry{
 			Key:   entry.Key,
 			Value: pt,
-		}
+		}, true, nil
 	}
-
-	return entry, unwrappedEntry, nil
 }
 
 func (d *sealUnwrapper) Get(ctx context.Context, key string) (*physical.Entry, error) {
-	entry, unwrappedEntry, err := d.unwrap(ctx, key)
+	entry, wasWrapped, err := d.unwrap(ctx, key)
 	switch {
-	case err != nil:
+	case err != nil: // Failed to get entry
 		return nil, err
-	case entry == nil:
+	case entry == nil: // Entry doesn't exist
 		return nil, nil
-	case atomic.LoadUint32(d.allowUnwraps) != 1:
-		return unwrappedEntry, nil
+	case !wasWrapped || !d.allowUnwraps.Load(): // Entry was not wrapped or unwrapping not allowed
+		return entry, nil
 	}
 
+	// Entry was wrapped, we need to replace it with the unwrapped value
+
+	// Grab locks because we are performing a write
 	locksutil.LockForKey(d.locks, key).Lock()
 	defer locksutil.LockForKey(d.locks, key).Unlock()
 
-	// At this point we need to re-read and re-check
-	entry, unwrappedEntry, err = d.unwrap(ctx, key)
+	// Read entry again in case it was changed while we were waiting for the lock
+	entry, wasWrapped, err = d.unwrap(ctx, key)
 	switch {
-	case err != nil:
+	case err != nil: // Failed to get entry
 		return nil, err
-	case entry == nil:
+	case entry == nil: // Entry doesn't exist
 		return nil, nil
-	case atomic.LoadUint32(d.allowUnwraps) != 1:
-		return unwrappedEntry, nil
+	case !wasWrapped || !d.allowUnwraps.Load(): // Entry was not wrapped or unwrapping not allowed
+		return entry, nil
 	}
 
-	return unwrappedEntry, d.underlying.Put(ctx, unwrappedEntry)
+	// Write out the unwrapped value
+	return entry, d.underlying.Put(ctx, entry)
 }
 
 func (d *sealUnwrapper) Delete(ctx context.Context, key string) error {
@@ -155,12 +161,12 @@ func (d *transactionalSealUnwrapper) Transaction(ctx context.Context, txns []*ph
 // This should only run during preSeal which ensures that it can't be run
 // concurrently and that it will be run only by the active node
 func (d *sealUnwrapper) stopUnwraps() {
-	atomic.StoreUint32(d.allowUnwraps, 0)
+	d.allowUnwraps.Store(false)
 }
 
 func (d *sealUnwrapper) runUnwraps() {
 	// Allow key unwraps on key gets. This gets set only when running on the
 	// active node to prevent standbys from changing data underneath the
 	// primary
-	atomic.StoreUint32(d.allowUnwraps, 1)
+	d.allowUnwraps.Store(true)
 }
diff --git a/vault/sealunwrapper_test.go b/vault/sealunwrapper_test.go
index 023ae49ded6..c505ee2589e 100644
--- a/vault/sealunwrapper_test.go
+++ b/vault/sealunwrapper_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
@@ -21,25 +21,29 @@ import (
 func TestSealUnwrapper(t *testing.T) {
 	logger := corehelpers.NewTestLogger(t)
 
-	// Test without transactions
-	phys, err := inmem.NewInmemHA(nil, logger)
-	if err != nil {
-		t.Fatal(err)
-	}
-	performTestSealUnwrapper(t, phys, logger)
+	// Test with both cache enabled and disabled
+	for _, disableCache := range []bool{true, false} {
+		// Test without transactions
+		phys, err := inmem.NewInmemHA(nil, logger)
+		if err != nil {
+			t.Fatal(err)
+		}
+		performTestSealUnwrapper(t, phys, logger, disableCache)
 
-	// Test with transactions
-	tPhys, err := inmem.NewTransactionalInmemHA(nil, logger)
-	if err != nil {
-		t.Fatal(err)
+		// Test with transactions
+		tPhys, err := inmem.NewTransactionalInmemHA(nil, logger)
+		if err != nil {
+			t.Fatal(err)
+		}
+		performTestSealUnwrapper(t, tPhys, logger, disableCache)
 	}
-	performTestSealUnwrapper(t, tPhys, logger)
 }
 
-func performTestSealUnwrapper(t *testing.T, phys physical.Backend, logger log.Logger) {
+func performTestSealUnwrapper(t *testing.T, phys physical.Backend, logger log.Logger, disableCache bool) {
 	ctx := context.Background()
 	base := &CoreConfig{
-		Physical: phys,
+		Physical:     phys,
+		DisableCache: disableCache,
 	}
 	cluster := NewTestCluster(t, base, &TestClusterOptions{
 		Logger: logger,
@@ -47,6 +51,8 @@ func performTestSealUnwrapper(t *testing.T, phys physical.Backend, logger log.Lo
 	cluster.Start()
 	defer cluster.Cleanup()
 
+	physImem := phys.(interface{ Underlying() *inmem.InmemBackend }).Underlying()
+
 	// Read a value and then save it back in a proto message
 	entry, err := phys.Get(ctx, "core/master")
 	if err != nil {
@@ -78,7 +84,15 @@ func performTestSealUnwrapper(t *testing.T, phys physical.Backend, logger log.Lo
 	// successfully decode it, but be able to unmarshal it when read back from
 	// the underlying physical store. When we read from active, it should both
 	// successfully decode it and persist it back.
-	checkValue := func(core *Core, wrapped bool) {
+	checkValue := func(core *Core, wrapped bool, ro bool) {
+		if ro {
+			physImem.FailPut(true)
+			physImem.FailDelete(true)
+			defer func() {
+				physImem.FailPut(false)
+				physImem.FailDelete(false)
+			}()
+		}
 		entry, err := core.physical.Get(ctx, "core/master")
 		if err != nil {
 			t.Fatal(err)
@@ -106,7 +120,12 @@ func performTestSealUnwrapper(t *testing.T, phys physical.Backend, logger log.Lo
 	}
 
 	TestWaitActive(t, cluster.Cores[0].Core)
-	checkValue(cluster.Cores[2].Core, true)
-	checkValue(cluster.Cores[1].Core, true)
-	checkValue(cluster.Cores[0].Core, false)
+	checkValue(cluster.Cores[2].Core, true, true)
+	checkValue(cluster.Cores[1].Core, true, true)
+	checkValue(cluster.Cores[0].Core, false, false)
+
+	// The storage entry should now be unwrapped, so there should be no more writes to storage when we read it
+	checkValue(cluster.Cores[2].Core, false, true)
+	checkValue(cluster.Cores[1].Core, false, true)
+	checkValue(cluster.Cores[0].Core, false, true)
 }
diff --git a/vault/snapshots/source.go b/vault/snapshots/source.go
new file mode 100644
index 00000000000..702c5cbd59c
--- /dev/null
+++ b/vault/snapshots/source.go
@@ -0,0 +1,47 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package snapshots
+
+import (
+	"context"
+	"io"
+)
+
+// Source is used to read raw snapshot data
+type Source interface {
+	ReadCloser(ctx context.Context) (io.ReadCloser, error)
+	Type(ctx context.Context) string
+}
+
+var _ Source = (*manualUploadSource)(nil)
+
+type manualUploadSource struct {
+	r io.ReadCloser
+}
+
+// NewManualSnapshotSource creates a new Source that returns the wrapped reader
+// as the snapshot data
+func NewManualSnapshotSource(r io.ReadCloser) Source {
+	return &manualUploadSource{r: r}
+}
+
+func (m *manualUploadSource) Type(_ context.Context) string {
+	return "manual"
+}
+
+func (m *manualUploadSource) ReadCloser(ctx context.Context) (io.ReadCloser, error) {
+	return &ctxAwareReadCloser{ctx, m.r}, nil
+}
+
+type ctxAwareReadCloser struct {
+	ctx context.Context
+	io.ReadCloser
+}
+
+func (c *ctxAwareReadCloser) Read(p []byte) (n int, err error) {
+	if c.ctx.Err() != nil {
+		return 0, c.ctx.Err()
+	}
+	return c.ReadCloser.Read(p)
+}
diff --git a/vault/test_cluster_detect_deadlock.go b/vault/test_cluster_detect_deadlock.go
index a6a9eef969c..8f3972623a9 100644
--- a/vault/test_cluster_detect_deadlock.go
+++ b/vault/test_cluster_detect_deadlock.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build deadlock
diff --git a/vault/test_cluster_do_not_detect_deadlock.go b/vault/test_cluster_do_not_detect_deadlock.go
index 27db3ae05a3..804180cc898 100644
--- a/vault/test_cluster_do_not_detect_deadlock.go
+++ b/vault/test_cluster_do_not_detect_deadlock.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !deadlock
diff --git a/vault/testdata/Dockerfile b/vault/testdata/Dockerfile
index 2fd0aa80e20..5eea3879491 100644
--- a/vault/testdata/Dockerfile
+++ b/vault/testdata/Dockerfile
@@ -1,4 +1,4 @@
-# Copyright (c) HashiCorp, Inc.
+# Copyright IBM Corp. 2016, 2025
 # SPDX-License-Identifier: BUSL-1.1
 
 FROM docker.mirror.hashicorp.services/ubuntu:22.04
diff --git a/vault/testing.go b/vault/testing.go
index e82edb2288b..680284f97b9 100644
--- a/vault/testing.go
+++ b/vault/testing.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -27,6 +27,7 @@ import (
 	"runtime"
 	"sync"
 	"sync/atomic"
+	"testing"
 	"time"
 
 	"github.com/armon/go-metrics"
@@ -36,15 +37,15 @@ import (
 	kv "github.com/hashicorp/vault-plugin-secrets-kv"
 	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/audit"
-	auditFile "github.com/hashicorp/vault/builtin/audit/file"
 	"github.com/hashicorp/vault/command/server"
 	"github.com/hashicorp/vault/helper/constants"
+	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
+	"github.com/hashicorp/vault/helper/storagepacker"
 	"github.com/hashicorp/vault/helper/testhelpers/corehelpers"
 	"github.com/hashicorp/vault/helper/testhelpers/pluginhelpers"
 	"github.com/hashicorp/vault/internalshared/configutil"
-	"github.com/hashicorp/vault/limits"
 	"github.com/hashicorp/vault/sdk/framework"
 	"github.com/hashicorp/vault/sdk/helper/consts"
 	"github.com/hashicorp/vault/sdk/helper/logging"
@@ -56,9 +57,10 @@ import (
 	"github.com/hashicorp/vault/vault/plugincatalog"
 	"github.com/hashicorp/vault/vault/seal"
 	"github.com/mitchellh/copystructure"
-	"github.com/mitchellh/go-testing-interface"
 	"golang.org/x/crypto/ed25519"
 	"golang.org/x/net/http2"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"google.golang.org/protobuf/types/known/anypb"
 )
 
 // This file contains a number of methods that are useful for unit
@@ -100,59 +102,61 @@ oOyBJU/HMVvBfv4g+OVFLVgSwwm6owwsouZ0+D/LasbuHqYyqYqdyPJQYzWA2Y+F
 )
 
 // TestCore returns a pure in-memory, uninitialized core for testing.
-func TestCore(t testing.T) *Core {
+func TestCore(t testing.TB) *Core {
 	return TestCoreWithSeal(t, nil, false)
 }
 
 // TestCoreRaw returns a pure in-memory, uninitialized core for testing. The raw
 // storage endpoints are enabled with this core.
-func TestCoreRaw(t testing.T) *Core {
+func TestCoreRaw(t testing.TB) *Core {
 	return TestCoreWithSeal(t, nil, true)
 }
 
 // TestCoreNewSeal returns a pure in-memory, uninitialized core with
 // the new seal configuration.
-func TestCoreNewSeal(t testing.T) *Core {
+func TestCoreNewSeal(t testing.TB) *Core {
 	seal := NewTestSeal(t, nil)
 	return TestCoreWithSeal(t, seal, false)
 }
 
 // TestCoreWithConfig returns a pure in-memory, uninitialized core with the
 // specified core configurations overridden for testing.
-func TestCoreWithConfig(t testing.T, conf *CoreConfig) *Core {
+func TestCoreWithConfig(t testing.TB, conf *CoreConfig) *Core {
 	return TestCoreWithSealAndUI(t, conf)
 }
 
 // TestCoreWithSeal returns a pure in-memory, uninitialized core with the
 // specified seal for testing.
-func TestCoreWithSeal(t testing.T, testSeal Seal, enableRaw bool) *Core {
+func TestCoreWithSeal(t testing.TB, testSeal Seal, enableRaw bool) *Core {
 	conf := &CoreConfig{
 		Seal:            testSeal,
 		EnableUI:        false,
 		EnableRaw:       enableRaw,
 		BuiltinRegistry: corehelpers.NewMockBuiltinRegistry(),
 		AuditBackends: map[string]audit.Factory{
-			"file": auditFile.Factory,
+			audit.TypeFile:   audit.NewFileBackend,
+			audit.TypeSocket: audit.NewSocketBackend,
+			audit.TypeSyslog: audit.NewSyslogBackend,
 		},
 	}
 	return TestCoreWithSealAndUI(t, conf)
 }
 
-func TestCoreWithDeadlockDetection(t testing.T, testSeal Seal, enableRaw bool) *Core {
+func TestCoreWithDeadlockDetection(t testing.TB, testSeal Seal, enableRaw bool) *Core {
 	conf := &CoreConfig{
 		Seal:            testSeal,
 		EnableUI:        false,
 		EnableRaw:       enableRaw,
 		BuiltinRegistry: corehelpers.NewMockBuiltinRegistry(),
 		AuditBackends: map[string]audit.Factory{
-			"file": auditFile.Factory,
+			"file": audit.NewFileBackend,
 		},
-		DetectDeadlocks: "expiration,quotas,statelock",
+		DetectDeadlocks: "expiration,quotas,statelock,barrier",
 	}
 	return TestCoreWithSealAndUI(t, conf)
 }
 
-func TestCoreWithCustomResponseHeaderAndUI(t testing.T, CustomResponseHeaders map[string]map[string]string, enableUI bool) (*Core, [][]byte, string) {
+func TestCoreWithCustomResponseHeaderAndUI(t testing.TB, CustomResponseHeaders map[string]map[string]string, enableUI bool) (*Core, [][]byte, string) {
 	confRaw := &server.Config{
 		SharedConfig: &configutil.SharedConfig{
 			Listeners: []*configutil.Listener{
@@ -175,7 +179,7 @@ func TestCoreWithCustomResponseHeaderAndUI(t testing.T, CustomResponseHeaders ma
 	return testCoreUnsealed(t, core)
 }
 
-func TestCoreUI(t testing.T, enableUI bool) *Core {
+func TestCoreUI(t testing.TB, enableUI bool) *Core {
 	conf := &CoreConfig{
 		EnableUI:        enableUI,
 		EnableRaw:       true,
@@ -184,7 +188,7 @@ func TestCoreUI(t testing.T, enableUI bool) *Core {
 	return TestCoreWithSealAndUI(t, conf)
 }
 
-func TestCoreWithSealAndUI(t testing.T, opts *CoreConfig) *Core {
+func TestCoreWithSealAndUI(t testing.TB, opts *CoreConfig) *Core {
 	c := TestCoreWithSealAndUINoCleanup(t, opts)
 
 	t.Cleanup(func() {
@@ -204,7 +208,7 @@ func TestCoreWithSealAndUI(t testing.T, opts *CoreConfig) *Core {
 	return c
 }
 
-func TestCoreWithSealAndUINoCleanup(t testing.T, opts *CoreConfig) *Core {
+func TestCoreWithSealAndUINoCleanup(t testing.TB, opts *CoreConfig) *Core {
 	logger := corehelpers.NewTestLogger(t)
 	physicalBackend, err := physInmem.NewInmem(nil, logger)
 	if err != nil {
@@ -259,6 +263,11 @@ func TestCoreWithSealAndUINoCleanup(t testing.T, opts *CoreConfig) *Core {
 	if opts.NumRollbackWorkers != 0 {
 		conf.NumRollbackWorkers = opts.NumRollbackWorkers
 	}
+	if conf.RawConfig != nil {
+		if conf.RawConfig.Storage != nil {
+			conf.StorageType = conf.RawConfig.Storage.Type
+		}
+	}
 
 	conf.ActivityLogConfig = opts.ActivityLogConfig
 	testApplyEntBaseConfig(conf, opts)
@@ -271,10 +280,10 @@ func TestCoreWithSealAndUINoCleanup(t testing.T, opts *CoreConfig) *Core {
 	return c
 }
 
-func testCoreConfig(t testing.T, physicalBackend physical.Backend, logger log.Logger) *CoreConfig {
+func testCoreConfig(t testing.TB, physicalBackend physical.Backend, logger log.Logger) *CoreConfig {
 	t.Helper()
 	noopAudits := map[string]audit.Factory{
-		"noop": corehelpers.NoopAuditFactory(nil),
+		"noop": audit.NoopAuditFactory(nil),
 	}
 
 	noopBackends := make(map[string]logical.Factory)
@@ -322,13 +331,13 @@ func testCoreConfig(t testing.T, physicalBackend physical.Backend, logger log.Lo
 
 // TestCoreInit initializes the core with a single key, and returns
 // the key that must be used to unseal the core and a root token.
-func TestCoreInit(t testing.T, core *Core) ([][]byte, string) {
+func TestCoreInit(t testing.TB, core *Core) ([][]byte, string) {
 	t.Helper()
 	secretShares, _, root := TestCoreInitClusterWrapperSetup(t, core, nil)
 	return secretShares, root
 }
 
-func TestCoreInitClusterWrapperSetup(t testing.T, core *Core, handler http.Handler) ([][]byte, [][]byte, string) {
+func TestCoreInitClusterWrapperSetup(t testing.TB, core *Core, handler http.Handler) ([][]byte, [][]byte, string) {
 	t.Helper()
 	core.SetClusterHandler(handler)
 
@@ -377,7 +386,7 @@ func TestCoreSeal(core *Core) error {
 
 // TestCoreUnsealed returns a pure in-memory core that is already
 // initialized and unsealed.
-func TestCoreUnsealed(t testing.T) (*Core, [][]byte, string) {
+func TestCoreUnsealed(t testing.TB) (*Core, [][]byte, string) {
 	t.Helper()
 	core := TestCore(t)
 	return testCoreUnsealed(t, core)
@@ -390,7 +399,7 @@ func SetupMetrics(conf *CoreConfig) *metrics.InmemSink {
 	return inmemSink
 }
 
-func TestCoreUnsealedWithMetrics(t testing.T) (*Core, [][]byte, string, *metrics.InmemSink) {
+func TestCoreUnsealedWithMetrics(t testing.TB) (*Core, [][]byte, string, *metrics.InmemSink) {
 	t.Helper()
 	conf := &CoreConfig{
 		BuiltinRegistry: corehelpers.NewMockBuiltinRegistry(),
@@ -400,7 +409,7 @@ func TestCoreUnsealedWithMetrics(t testing.T) (*Core, [][]byte, string, *metrics
 	return core, keys, root, sink
 }
 
-func TestCoreUnsealedWithMetricsAndConfig(t testing.T, conf *CoreConfig) (*Core, [][]byte, string, *metrics.InmemSink) {
+func TestCoreUnsealedWithMetricsAndConfig(t testing.TB, conf *CoreConfig) (*Core, [][]byte, string, *metrics.InmemSink) {
 	t.Helper()
 	conf.BuiltinRegistry = corehelpers.NewMockBuiltinRegistry()
 	sink := SetupMetrics(conf)
@@ -410,7 +419,7 @@ func TestCoreUnsealedWithMetricsAndConfig(t testing.T, conf *CoreConfig) (*Core,
 
 // TestCoreUnsealedRaw returns a pure in-memory core that is already
 // initialized, unsealed, and with raw endpoints enabled.
-func TestCoreUnsealedRaw(t testing.T) (*Core, [][]byte, string) {
+func TestCoreUnsealedRaw(t testing.TB) (*Core, [][]byte, string) {
 	t.Helper()
 	core := TestCoreRaw(t)
 	return testCoreUnsealed(t, core)
@@ -418,13 +427,13 @@ func TestCoreUnsealedRaw(t testing.T) (*Core, [][]byte, string) {
 
 // TestCoreUnsealedWithConfig returns a pure in-memory core that is already
 // initialized, unsealed, with the any provided core config values overridden.
-func TestCoreUnsealedWithConfig(t testing.T, conf *CoreConfig) (*Core, [][]byte, string) {
+func TestCoreUnsealedWithConfig(t testing.TB, conf *CoreConfig) (*Core, [][]byte, string) {
 	t.Helper()
 	core := TestCoreWithConfig(t, conf)
 	return testCoreUnsealed(t, core)
 }
 
-func testCoreUnsealed(t testing.T, core *Core) (*Core, [][]byte, string) {
+func testCoreUnsealed(t testing.TB, core *Core) (*Core, [][]byte, string) {
 	t.Helper()
 	token, keys := TestInitUnsealCore(t, core)
 
@@ -432,7 +441,7 @@ func testCoreUnsealed(t testing.T, core *Core) (*Core, [][]byte, string) {
 	return core, keys, token
 }
 
-func TestInitUnsealCore(t testing.T, core *Core) (string, [][]byte) {
+func TestInitUnsealCore(t testing.TB, core *Core) (string, [][]byte) {
 	keys, token := TestCoreInit(t, core)
 	for _, key := range keys {
 		if _, err := TestCoreUnseal(core, TestKeyCopy(key)); err != nil {
@@ -446,7 +455,7 @@ func TestInitUnsealCore(t testing.T, core *Core) (string, [][]byte) {
 	return token, keys
 }
 
-func testCoreAddSecretMount(t testing.T, core *Core, token, kvVersion string) {
+func testCoreAddSecretMount(t testing.TB, core *Core, token, kvVersion string) {
 	kvReq := &logical.Request{
 		Operation:   logical.UpdateOperation,
 		ClientToken: token,
@@ -469,7 +478,7 @@ func testCoreAddSecretMount(t testing.T, core *Core, token, kvVersion string) {
 	}
 }
 
-func TestCoreUnsealedBackend(t testing.T, backend physical.Backend) (*Core, [][]byte, string) {
+func TestCoreUnsealedBackend(t testing.TB, backend physical.Backend) (*Core, [][]byte, string) {
 	t.Helper()
 	logger := corehelpers.NewTestLogger(t)
 	conf := testCoreConfig(t, backend, logger)
@@ -539,7 +548,7 @@ func TestDynamicSystemView(c *Core, ns *namespace.Namespace) logical.SystemView
 	}
 }
 
-func TestAddTestPlugin(t testing.T, core *Core, name string, pluginType consts.PluginType, version string, testFunc string, env []string) {
+func TestAddTestPlugin(t testing.TB, core *Core, name string, pluginType consts.PluginType, version string, testFunc string, env []string) {
 	t.Helper()
 	plugincatalog.TestAddTestPlugin(t, core.pluginCatalog, name, pluginType, version, testFunc, env)
 }
@@ -648,14 +657,31 @@ func GenerateRandBytes(length int) ([]byte, error) {
 	return buf, nil
 }
 
-func TestWaitActive(t testing.T, core *Core) {
+func TestWaitPerfStandby(t testing.TB, core *Core) {
+	t.Helper()
+	start := time.Now()
+	var perfStandby bool
+	for time.Now().Sub(start) < 30*time.Second {
+		perfStandby = core.PerfStandby()
+
+		if perfStandby {
+			break
+		}
+	}
+	if !perfStandby {
+		err := errors.New("core not in perf standby mode")
+		t.Fatal(err)
+	}
+}
+
+func TestWaitActive(t testing.TB, core *Core) {
 	t.Helper()
 	if err := TestWaitActiveWithError(core); err != nil {
 		t.Fatal(err)
 	}
 }
 
-func TestWaitActiveForwardingReady(t testing.T, core *Core) {
+func TestWaitActiveForwardingReady(t testing.TB, core *Core) {
 	t.Helper()
 	TestWaitActive(t, core)
 
@@ -724,7 +750,7 @@ func (c *TestCluster) SetRootToken(token string) {
 func (c *TestCluster) Start() {
 }
 
-func (c *TestCluster) start(t testing.T) {
+func (c *TestCluster) start(t testing.TB) {
 	t.Helper()
 	for i, core := range c.Cores {
 		if core.Server != nil {
@@ -788,14 +814,14 @@ WAITACTIVE:
 }
 
 // UnsealCores uses the cluster barrier keys to unseal the test cluster cores
-func (c *TestCluster) UnsealCores(t testing.T) {
+func (c *TestCluster) UnsealCores(t testing.TB) {
 	t.Helper()
 	if err := c.UnsealCoresWithError(t, false); err != nil {
 		t.Fatal(err)
 	}
 }
 
-func (c *TestCluster) UnsealCoresWithError(t testing.T, useStoredKeys bool) error {
+func (c *TestCluster) UnsealCoresWithError(t testing.TB, useStoredKeys bool) error {
 	unseal := func(core *Core) error {
 		for _, key := range c.BarrierKeys {
 			if _, err := core.Unseal(TestKeyCopy(key)); err != nil {
@@ -851,7 +877,7 @@ func (c *TestCluster) UnsealCoresWithError(t testing.T, useStoredKeys bool) erro
 	return nil
 }
 
-func (c *TestCluster) UnsealCore(t testing.T, core *TestClusterCore) {
+func (c *TestCluster) UnsealCore(t testing.TB, core *TestClusterCore) {
 	err := c.AttemptUnsealCore(core)
 	if err != nil {
 		t.Fatal(err)
@@ -873,21 +899,21 @@ func (c *TestCluster) AttemptUnsealCore(core *TestClusterCore) error {
 	return nil
 }
 
-func (c *TestCluster) UnsealCoreWithStoredKeys(t testing.T, core *TestClusterCore) {
+func (c *TestCluster) UnsealCoreWithStoredKeys(t testing.TB, core *TestClusterCore) {
 	t.Helper()
 	if err := core.UnsealWithStoredKeys(context.Background()); err != nil {
 		t.Fatal(err)
 	}
 }
 
-func (c *TestCluster) EnsureCoresSealed(t testing.T) {
+func (c *TestCluster) EnsureCoresSealed(t testing.TB) {
 	t.Helper()
 	if err := c.ensureCoresSealed(); err != nil {
 		t.Fatal(err)
 	}
 }
 
-func (c *TestClusterCore) Seal(t testing.T) {
+func (c *TestClusterCore) Seal(t testing.TB) {
 	t.Helper()
 	if err := c.Core.sealInternal(); err != nil {
 		t.Fatal(err)
@@ -956,6 +982,14 @@ func (c *TestClusterCore) ClusterListener() *cluster.Listener {
 	return c.getClusterListener()
 }
 
+// NetworkLayer returns the network layer for the cluster core. This can be used
+// in conjunction with the cluster.InmemLayer to disconnect specific nodes from
+// the cluster when we need to simulate abrupt node failure or a network
+// partition in NewTestCluster tests.
+func (c *TestClusterCore) NetworkLayer() cluster.NetworkLayer {
+	return c.Core.clusterNetworkLayer
+}
+
 func (c *TestCluster) Cleanup() {
 	c.Logger.Info("cleaning up vault cluster")
 	if tl, ok := c.Logger.(*corehelpers.TestLogger); ok {
@@ -1019,25 +1053,26 @@ type TestListener struct {
 
 type TestClusterCore struct {
 	*Core
-	CoreConfig           *CoreConfig
-	Client               *api.Client
-	Handler              http.Handler
-	Address              *net.TCPAddr
-	Listeners            []*TestListener
-	ReloadFuncs          *map[string][]reloadutil.ReloadFunc
-	ReloadFuncsLock      *sync.RWMutex
-	Server               *http.Server
-	ServerCert           *x509.Certificate
-	ServerCertBytes      []byte
-	ServerCertPEM        []byte
-	ServerKey            *ecdsa.PrivateKey
-	ServerKeyPEM         []byte
-	tlsConfig            *tls.Config
-	UnderlyingStorage    physical.Backend
-	UnderlyingRawStorage physical.Backend
-	UnderlyingHAStorage  physical.HABackend
-	Barrier              SecurityBarrier
-	NodeID               string
+	CoreConfig              *CoreConfig
+	Client                  *api.Client
+	Handler                 http.Handler
+	Address                 *net.TCPAddr
+	Listeners               []*TestListener
+	ReloadFuncs             *map[string][]reloadutil.ReloadFunc
+	ReloadFuncsLock         *sync.RWMutex
+	Server                  *http.Server
+	ServerCert              *x509.Certificate
+	ServerCertBytes         []byte
+	ServerCertPEM           []byte
+	ServerKey               *ecdsa.PrivateKey
+	ServerKeyPEM            []byte
+	tlsConfig               *tls.Config
+	UnderlyingStorage       physical.Backend
+	UnderlyingRawStorage    physical.Backend
+	UnderlyingHAStorage     physical.HABackend
+	Barrier                 SecurityBarrier
+	NodeID                  string
+	pkiCertificateCountData struct{ ignoredIssuedCount, ignoredStoredCount uint64 }
 }
 
 type PhysicalBackendBundle struct {
@@ -1098,13 +1133,13 @@ type TestClusterOptions struct {
 	// core in cluster will have 0, second 1, etc.
 	// If the backend is shared across the cluster (i.e. is not Raft) then it
 	// should return nil when coreIdx != 0.
-	PhysicalFactory func(t testing.T, coreIdx int, logger log.Logger, conf map[string]interface{}) *PhysicalBackendBundle
+	PhysicalFactory func(t testing.TB, coreIdx int, logger log.Logger, conf map[string]interface{}) *PhysicalBackendBundle
 	// FirstCoreNumber is used to assign a unique number to each core within
 	// a multi-cluster setup.
 	FirstCoreNumber   int
 	RequireClientAuth bool
 	// SetupFunc is called after the cluster is started.
-	SetupFunc      func(t testing.T, c *TestCluster)
+	SetupFunc      func(t testing.TB, c *TestCluster)
 	PR1103Disabled bool
 
 	// ClusterLayers are used to override the default cluster connection layer
@@ -1133,8 +1168,6 @@ type TestClusterOptions struct {
 
 	// ABCDLoggerNames names the loggers according to our ABCD convention when generating 4 clusters
 	ABCDLoggerNames bool
-
-	LimiterRegistry *limits.LimiterRegistry
 }
 
 type TestPluginConfig struct {
@@ -1166,7 +1199,7 @@ type certInfo struct {
 // logger and will be the basis for each core's logger.  If no opts.Logger is
 // given, one will be generated based on t.Name() for the cluster logger, and if
 // no base.Logger is given will also be used as the basis for each core's logger.
-func NewTestCluster(t testing.T, base *CoreConfig, opts *TestClusterOptions) *TestCluster {
+func NewTestCluster(t testing.TB, base *CoreConfig, opts *TestClusterOptions) *TestCluster {
 	var err error
 
 	if opts == nil {
@@ -1418,17 +1451,21 @@ func NewTestCluster(t testing.T, base *CoreConfig, opts *TestClusterOptions) *Te
 	coreConfig := &CoreConfig{
 		LogicalBackends:    make(map[string]logical.Factory),
 		CredentialBackends: make(map[string]logical.Factory),
-		AuditBackends:      make(map[string]audit.Factory),
-		RedirectAddr:       fmt.Sprintf("https://127.0.0.1:%d", listeners[0][0].Address.Port),
-		ClusterAddr:        "https://127.0.0.1:0",
-		DisableMlock:       true,
-		EnableUI:           true,
-		EnableRaw:          true,
-		BuiltinRegistry:    corehelpers.NewMockBuiltinRegistry(),
-		LimiterRegistry:    limits.NewLimiterRegistry(testCluster.Logger),
+		AuditBackends: map[string]audit.Factory{
+			audit.TypeFile:   audit.NewFileBackend,
+			audit.TypeSocket: audit.NewSocketBackend,
+			audit.TypeSyslog: audit.NewSyslogBackend,
+		},
+		RedirectAddr:    fmt.Sprintf("https://127.0.0.1:%d", listeners[0][0].Address.Port),
+		ClusterAddr:     "https://127.0.0.1:0",
+		DisableMlock:    true,
+		EnableUI:        true,
+		EnableRaw:       true,
+		BuiltinRegistry: corehelpers.NewMockBuiltinRegistry(),
 	}
 
 	if base != nil {
+		coreConfig.ClusterHeartbeatInterval = base.ClusterHeartbeatInterval
 		coreConfig.DetectDeadlocks = TestDeadlockDetection
 		coreConfig.RawConfig = base.RawConfig
 		coreConfig.DisableCache = base.DisableCache
@@ -1457,6 +1494,7 @@ func NewTestCluster(t testing.T, base *CoreConfig, opts *TestClusterOptions) *Te
 		coreConfig.AdministrativeNamespacePath = base.AdministrativeNamespacePath
 		coreConfig.ServiceRegistration = base.ServiceRegistration
 		coreConfig.ImpreciseLeaseRoleTracking = base.ImpreciseLeaseRoleTracking
+		coreConfig.ReportingScanDirectory = base.ReportingScanDirectory
 
 		if base.BuiltinRegistry != nil {
 			coreConfig.BuiltinRegistry = base.BuiltinRegistry
@@ -1514,10 +1552,7 @@ func NewTestCluster(t testing.T, base *CoreConfig, opts *TestClusterOptions) *Te
 		coreConfig.ExpirationRevokeRetryBase = base.ExpirationRevokeRetryBase
 		coreConfig.PeriodicLeaderRefreshInterval = base.PeriodicLeaderRefreshInterval
 		coreConfig.ClusterAddrBridge = base.ClusterAddrBridge
-
-		if base.LimiterRegistry != nil {
-			coreConfig.LimiterRegistry = base.LimiterRegistry
-		}
+		coreConfig.ObservationSystemConfig = base.ObservationSystemConfig
 
 		testApplyEntBaseConfig(coreConfig, base)
 	}
@@ -1545,11 +1580,6 @@ func NewTestCluster(t testing.T, base *CoreConfig, opts *TestClusterOptions) *Te
 		coreConfig.RawConfig = c
 	}
 
-	addAuditBackend := len(coreConfig.AuditBackends) == 0
-	if addAuditBackend {
-		coreConfig.AuditBackends["noop"] = corehelpers.NoopAuditFactory(nil)
-	}
-
 	if coreConfig.Physical == nil && (opts == nil || opts.PhysicalFactory == nil) {
 		coreConfig.Physical, err = physInmem.NewInmem(nil, testCluster.Logger)
 		if err != nil {
@@ -1665,7 +1695,7 @@ func NewTestCluster(t testing.T, base *CoreConfig, opts *TestClusterOptions) *Te
 
 	// Initialize cores
 	if opts == nil || !opts.SkipInit {
-		testCluster.initCores(t, opts, addAuditBackend)
+		testCluster.initCores(t, opts)
 	}
 
 	// Assign clients
@@ -1706,7 +1736,7 @@ func NewTestCluster(t testing.T, base *CoreConfig, opts *TestClusterOptions) *Te
 }
 
 // StopCore performs an orderly shutdown of a core.
-func (cluster *TestCluster) StopCore(t testing.T, idx int) {
+func (cluster *TestCluster) StopCore(t testing.TB, idx int) {
 	t.Helper()
 
 	if idx < 0 || idx > len(cluster.Cores) {
@@ -1724,7 +1754,7 @@ func (cluster *TestCluster) StopCore(t testing.T, idx int) {
 	cluster.cleanupFuncs[idx]()
 }
 
-func GenerateListenerAddr(t testing.T, opts *TestClusterOptions, certIPs []net.IP) (*net.TCPAddr, []net.IP) {
+func GenerateListenerAddr(t testing.TB, opts *TestClusterOptions, certIPs []net.IP) (*net.TCPAddr, []net.IP) {
 	var baseAddr *net.TCPAddr
 	var err error
 
@@ -1746,7 +1776,7 @@ func GenerateListenerAddr(t testing.T, opts *TestClusterOptions, certIPs []net.I
 
 // StartCore restarts a TestClusterCore that was stopped, by replacing the
 // underlying Core.
-func (cluster *TestCluster) StartCore(t testing.T, idx int, opts *TestClusterOptions) {
+func (cluster *TestCluster) StartCore(t testing.TB, idx int, opts *TestClusterOptions) {
 	t.Helper()
 
 	if idx < 0 || idx > len(cluster.Cores) {
@@ -1803,7 +1833,7 @@ func (cluster *TestCluster) StartCore(t testing.T, idx int, opts *TestClusterOpt
 	tcc.Logger().Info("restarted test core", "core", idx)
 }
 
-func (testCluster *TestCluster) newCore(t testing.T, idx int, coreConfig *CoreConfig, opts *TestClusterOptions, listeners []*TestListener, pubKey ed25519.PublicKey) (func(), *Core, CoreConfig, http.Handler) {
+func (testCluster *TestCluster) newCore(t testing.TB, idx int, coreConfig *CoreConfig, opts *TestClusterOptions, listeners []*TestListener, pubKey ed25519.PublicKey) (func(), *Core, CoreConfig, http.Handler) {
 	localConfig := *coreConfig
 	cleanupFunc := func() {}
 	var handler http.Handler
@@ -1912,10 +1942,6 @@ func (testCluster *TestCluster) newCore(t testing.T, idx int, coreConfig *CoreCo
 
 	localConfig.NumExpirationWorkers = numExpirationWorkersTest
 
-	if opts != nil && opts.LimiterRegistry != nil {
-		localConfig.LimiterRegistry = opts.LimiterRegistry
-	}
-
 	c, err := NewCore(&localConfig)
 	if err != nil {
 		t.Fatalf("err: %v", err)
@@ -1945,7 +1971,7 @@ func (testCluster *TestCluster) newCore(t testing.T, idx int, coreConfig *CoreCo
 }
 
 func (testCluster *TestCluster) setupClusterListener(
-	t testing.T, idx int, core *Core, coreConfig *CoreConfig,
+	t testing.TB, idx int, core *Core, coreConfig *CoreConfig,
 	opts *TestClusterOptions, listeners []*TestListener, handler http.Handler,
 ) {
 	if coreConfig.ClusterAddr == "" {
@@ -1980,11 +2006,9 @@ func (testCluster *TestCluster) setupClusterListener(
 	core.SetClusterHandler(handler)
 }
 
-func (tc *TestCluster) InitCores(t testing.T, opts *TestClusterOptions, addAuditBackend bool) {
-	tc.initCores(t, opts, addAuditBackend)
-}
-
-func (tc *TestCluster) initCores(t testing.T, opts *TestClusterOptions, addAuditBackend bool) {
+// initCores attempts to initialize a core for a test cluster using the supplied
+// options.
+func (tc *TestCluster) initCores(t testing.TB, opts *TestClusterOptions) {
 	leader := tc.Cores[0]
 
 	bKeys, rKeys, root := TestCoreInitClusterWrapperSetup(t, leader.Core, leader.Handler)
@@ -2091,24 +2115,6 @@ func (tc *TestCluster) initCores(t testing.T, opts *TestClusterOptions, addAudit
 	}
 	tc.ID = cluster.ID
 
-	// Enable auditing if required
-	if addAuditBackend {
-		auditReq := &logical.Request{
-			Operation:   logical.UpdateOperation,
-			ClientToken: tc.RootToken,
-			Path:        "sys/audit/noop",
-			Data:        map[string]interface{}{"type": "noop"},
-		}
-		resp, err := leader.Core.HandleRequest(namespace.RootContext(ctx), auditReq)
-		if err != nil {
-			t.Fatal(err)
-		}
-
-		if resp.IsError() {
-			t.Fatal(err)
-		}
-	}
-
 	// Configure a secret engine (kv)
 	kvVersion := "1"
 	if opts != nil {
@@ -2119,7 +2125,7 @@ func (tc *TestCluster) initCores(t testing.T, opts *TestClusterOptions, addAudit
 }
 
 func (testCluster *TestCluster) getAPIClient(
-	t testing.T, opts *TestClusterOptions,
+	t testing.TB, opts *TestClusterOptions,
 	port int, tlsConfig *tls.Config,
 ) *api.Client {
 	transport := cleanhttp.DefaultPooledTransport()
@@ -2225,3 +2231,151 @@ var (
 	_ testcluster.VaultCluster     = &TestCluster{}
 	_ testcluster.VaultClusterNode = &TestClusterCore{}
 )
+
+func TestUserpassMount(c *Core, local bool) (*MountEntry, error) {
+	return TestUserpassMountContext(namespace.RootContext(nil), c, local)
+}
+
+func TestUserpassMountContext(ctx context.Context, c *Core, local bool) (*MountEntry, error) {
+	name := "userpass"
+	if local {
+		name += "-local"
+	}
+	userpassMe := &MountEntry{
+		Table:       credentialTableType,
+		Path:        name + "/",
+		Type:        "userpass",
+		Description: name,
+		// Don't specify an accessor so we use a random one otherwise we will cause
+		// horrible issues when we try to create a new mount on a different
+		// namespace but they have the same accessor!
+		Local: local,
+	}
+	if err := c.enableCredential(ctx, userpassMe); err != nil {
+		return nil, err
+	}
+	return userpassMe, nil
+}
+
+// TestCreateDuplicateEntityAliasesInStorage creates n entities with a duplicate alias in storage
+// This should only be used in testing
+func TestCreateDuplicateEntityAliasesInStorage(ctx context.Context, c *Core, n int) ([]string, error) {
+	userpassMe, err := TestUserpassMount(c, false)
+	if err != nil {
+		return nil, err
+	}
+
+	var entityIDs []string
+	for i := 0; i < n; i++ {
+		entityID := fmt.Sprintf("e%d", i)
+		entityIDs = append(entityIDs, entityID)
+		a := &identity.Alias{
+			ID:            entityID,
+			CanonicalID:   entityID,
+			MountType:     "userpass",
+			MountAccessor: userpassMe.Accessor,
+			Name:          "alias-dup",
+		}
+		e := &identity.Entity{
+			ID:   entityID,
+			Name: "entity-dup",
+			Aliases: []*identity.Alias{
+				a,
+			},
+			NamespaceID: namespace.RootNamespaceID,
+			BucketKey:   c.identityStore.entityPacker.BucketKey(entityID),
+		}
+		if err := TestHelperWriteToStoragePacker(ctx, c.identityStore.entityPacker, e.ID, e); err != nil {
+			return nil, err
+		}
+	}
+
+	return entityIDs, nil
+}
+
+// TestHelperWriteToStoragePacker takes care of boiler place to insert into a
+// storage packer. Just provide the raw protobuf object e.g. &identity.Entity{}
+// and it is wrapped and inserted for you. You still need to populate BucketKey
+// in the object if applicable before passing it.
+func TestHelperWriteToStoragePacker(ctx context.Context, p *storagepacker.StoragePacker, id string, m protoreflect.ProtoMessage) error {
+	a, err := anypb.New(m)
+	if err != nil {
+		return err
+	}
+	i := &storagepacker.Item{
+		ID:      id,
+		Message: a,
+	}
+	return p.PutItem(context.Background(), i)
+}
+
+// TestCreateStorageGroup creates a group in storage only to bypass checks that the entities exist in memdb
+// Should only be used in testing
+func TestCreateStorageGroup(ctx context.Context, c *Core, entityIDs []string) error {
+	// generate random int
+	i := mathrand.Intn(100)
+
+	key := fmt.Sprintf("testgroupid-%d", i)
+
+	group := &identity.Group{
+		ID:              key,
+		Name:            "testgroupname",
+		Policies:        []string{"testgrouppolicy"},
+		MemberEntityIDs: entityIDs,
+		BucketKey:       c.identityStore.groupPacker.BucketKey(key),
+	}
+	groupAsAny, err := anypb.New(group)
+	if err != nil {
+		return err
+	}
+	item := &storagepacker.Item{
+		ID:      group.ID,
+		Message: groupAsAny,
+	}
+	err = c.identityStore.groupPacker.PutItem(ctx, item)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// Mock HABackend is a non-functional HABackend for testing purposes
+type MockHABackend struct {
+	physical.HABackend
+	physical.Backend
+}
+
+func (m *MockHABackend) HAEnabled() bool {
+	return true
+}
+
+// MockRemovableNodeHABackend is a barely functional RemovableNodeHABackend for testing purposes.
+// It has a functional IsRemoved method and an exported Removed field so that the desired state can be easily set.
+type MockRemovableNodeHABackend struct {
+	physical.RemovableNodeHABackend
+	physical.Backend
+	Removed bool
+}
+
+func (m *MockRemovableNodeHABackend) HAEnabled() bool {
+	return true
+}
+
+func (m *MockRemovableNodeHABackend) IsRemoved() bool {
+	return m.Removed
+}
+
+func TestCoreWithMockRemovableNodeHABackend(t *testing.T, removed bool) (*Core, error) {
+	t.Helper()
+	logger := corehelpers.NewTestLogger(t)
+	inmha, err := physInmem.NewInmemHA(nil, logger)
+	if err != nil {
+		t.Fatal(err)
+	}
+	conf := testCoreConfig(t, inmha, logger)
+	mockHABackend := &MockRemovableNodeHABackend{Removed: removed}
+	conf.HAPhysical = mockHABackend
+	conf.RedirectAddr = "http://127.0.0.1:8200"
+
+	return NewCore(conf)
+}
diff --git a/vault/testing_util.go b/vault/testing_util.go
index 0cbd1a4fb31..c2c727d5d57 100644
--- a/vault/testing_util.go
+++ b/vault/testing_util.go
@@ -1,20 +1,20 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
-//go:build !enterprise
-
 package vault
 
 import (
-	"crypto/ed25519"
+	"time"
 
-	testing "github.com/mitchellh/go-testing-interface"
+	"github.com/hashicorp/vault/version"
 )
 
-func GenerateTestLicenseKeys() (ed25519.PublicKey, ed25519.PrivateKey, error) { return nil, nil, nil }
-func testGetLicensingConfig(key ed25519.PublicKey) *LicensingConfig           { return &LicensingConfig{} }
-func testExtraTestCoreSetup(testing.T, ed25519.PrivateKey, *TestClusterCore)  {}
-func testAdjustUnderlyingStorage(tcc *TestClusterCore) {
-	tcc.UnderlyingStorage = tcc.physical
+func init() {
+	// The BuildDate is set as part of the build process in CI so we need to
+	// initialize it for testing. By setting it to now minus one year we
+	// provide some headroom to ensure that test license expiration (for enterprise)
+	// does not exceed the BuildDate as that is invalid.
+	if version.BuildDate == "" {
+		version.BuildDate = time.Now().UTC().AddDate(-1, 0, 0).Format(time.RFC3339)
+	}
 }
-func testApplyEntBaseConfig(coreConfig, base *CoreConfig) {}
diff --git a/vault/testing_util_stubs_oss.go b/vault/testing_util_stubs_oss.go
new file mode 100644
index 00000000000..191f978ac92
--- /dev/null
+++ b/vault/testing_util_stubs_oss.go
@@ -0,0 +1,28 @@
+// Copyright IBM Corp. 2016, 2025
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !enterprise
+
+package vault
+
+import (
+	"crypto/ed25519"
+	"testing"
+)
+
+//go:generate go run github.com/hashicorp/vault/tools/stubmaker
+
+func GenerateTestLicenseKeys() (ed25519.PublicKey, ed25519.PrivateKey, error) { return nil, nil, nil }
+func testGetLicensingConfig(key ed25519.PublicKey) *LicensingConfig           { return &LicensingConfig{} }
+func testExtraTestCoreSetup(testing.TB, ed25519.PrivateKey, *TestClusterCore) {}
+func testAdjustUnderlyingStorage(tcc *TestClusterCore) {
+	tcc.UnderlyingStorage = tcc.physical
+}
+func testApplyEntBaseConfig(coreConfig, base *CoreConfig) {}
+
+// The following are stubs for PKI certificate counting, which is an enterprise feature.
+
+func (c *TestClusterCore) StopPkiCertificateCountConsumerJob() {}
+func (c *TestClusterCore) ResetPkiCertificateCounts()          {}
+func (c *TestClusterCore) RequirePkiCertificateCounts(t testing.TB, expectedIssuedCount, expectedStoredCount int) {
+}
diff --git a/vault/token_store.go b/vault/token_store.go
index 0731d9821ef..e50cda9573c 100644
--- a/vault/token_store.go
+++ b/vault/token_store.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -1060,9 +1060,14 @@ func (ts *TokenStore) create(ctx context.Context, entry *logical.TokenEntry) err
 
 	// Validate the inline policy if it's set
 	if entry.InlinePolicy != "" {
-		if _, err := ParseACLPolicy(tokenNS, entry.InlinePolicy); err != nil {
+		// TODO (HCL_DUP_KEYS_DEPRECATION): return to ParseACLPolicy once the deprecation is done
+		_, duplicate, err := ParseACLPolicyCheckDuplicates(tokenNS, entry.InlinePolicy)
+		if err != nil {
 			return fmt.Errorf("failed to parse inline policy for token entry: %v", err)
 		}
+		if duplicate {
+			ts.logger.Warn("HCL inline policy contains duplicate attributes, which will no longer be supported in a future version", "namespace", tokenNS.Path)
+		}
 	}
 
 	switch entry.Type {
@@ -1953,7 +1958,7 @@ func (ts *TokenStore) revokeInternal(ctx context.Context, saltedID string, skipO
 			}
 			lock.Unlock()
 
-			// Delete the the child storage entry after we update the token entry Since
+			// Delete the child storage entry after we update the token entry Since
 			// paths are not deeply nested (i.e. they are simply
 			// parenPrefix/<parentID>/<childID>), we can simply call view.Delete instead
 			// of logical.ClearView
@@ -2988,10 +2993,10 @@ func (ts *TokenStore) handleCreateCommon(ctx context.Context, req *logical.Reque
 		}
 	}
 
-	if strutil.StrListContains(te.Policies, "root") {
+	if strutil.StrListContainsCaseInsensitive(te.Policies, "root") {
 		// Prevent attempts to create a root token without an actual root token as parent.
 		// This is to thwart privilege escalation by tokens having 'sudo' privileges.
-		if !strutil.StrListContains(parent.Policies, "root") {
+		if !strutil.StrListContainsCaseInsensitive(parent.Policies, "root") {
 			return logical.ErrorResponse("root tokens may not be created without parent token being root"), logical.ErrInvalidRequest
 		}
 
@@ -3136,11 +3141,21 @@ func (ts *TokenStore) handleCreateCommon(ctx context.Context, req *logical.Reque
 		}
 	}
 
-	sysView := ts.System().(extendedSystemView)
+	sysView := ts.core.router.MatchingSystemView(ctx, fmt.Sprintf("auth/token/%s", req.Path))
+	if sysView == nil {
+		return logical.ErrorResponse("got nil system view"), ErrInternalError
+	}
+
+	var backendMaxTTL time.Duration
+
+	mountEntry := ts.core.router.MatchingMountByAccessor(req.MountAccessor)
+	if mountEntry != nil {
+		backendMaxTTL = mountEntry.Config.MaxLeaseTTL
+	}
 
 	// Only calculate a TTL if you are A) periodic, B) have a TTL, C) do not have a TTL and are not a root token
-	if periodToUse > 0 || te.TTL > 0 || (te.TTL == 0 && !strutil.StrListContains(te.Policies, "root")) {
-		ttl, warnings, err := framework.CalculateTTL(sysView, 0, te.TTL, periodToUse, 0, explicitMaxTTLToUse, time.Unix(te.CreationTime, 0))
+	if periodToUse > 0 || te.TTL > 0 || (te.TTL == 0 && !strutil.StrListContainsCaseInsensitive(te.Policies, "root")) {
+		ttl, warnings, err := framework.CalculateTTL(sysView, 0, te.TTL, periodToUse, backendMaxTTL, explicitMaxTTLToUse, time.Unix(te.CreationTime, 0))
 		if err != nil {
 			return nil, err
 		}
@@ -3435,8 +3450,10 @@ func (ts *TokenStore) handleLookup(ctx context.Context, req *logical.Request, da
 			return nil, err
 		}
 		if len(identityPolicies) != 0 {
-			resp.Data["identity_policies"] = identityPolicies[out.NamespaceID]
-			delete(identityPolicies, out.NamespaceID)
+			if _, ok := identityPolicies[out.NamespaceID]; ok {
+				resp.Data["identity_policies"] = identityPolicies[out.NamespaceID]
+				delete(identityPolicies, out.NamespaceID)
+			}
 			resp.Data["external_namespace_policies"] = identityPolicies
 		}
 	}
@@ -4116,7 +4133,7 @@ func (ts *TokenStore) gaugeCollectorByMethod(ctx context.Context) ([]metricsutil
 
 		// mountEntry.Path lacks the "auth/" prefix; perhaps we should
 		// refactor router to provide a method that returns both the matching
-		// path *and* the the mount entry?
+		// path *and* the mount entry?
 		// Or we could just always add "auth/"?
 		matchingMount := ts.core.router.MatchingMount(ctx, path)
 		if matchingMount == "" {
diff --git a/vault/token_store_test.go b/vault/token_store_test.go
index 43a1276da83..18ab682cb5f 100644
--- a/vault/token_store_test.go
+++ b/vault/token_store_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -25,7 +25,6 @@ import (
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-sockaddr"
 	"github.com/hashicorp/go-uuid"
-	"github.com/hashicorp/vault/helper/benchhelpers"
 	"github.com/hashicorp/vault/helper/identity"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
@@ -544,7 +543,7 @@ func testMakeServiceTokenViaBackend(t testing.TB, ts *TokenStore, root, client,
 
 func testMakeTokenViaBackend(t testing.TB, ts *TokenStore, root, client, ttl string, policy []string, batch bool) {
 	t.Helper()
-	req := logical.TestRequest(benchhelpers.TBtoT(t), logical.UpdateOperation, "create")
+	req := logical.TestRequest(t, logical.UpdateOperation, "create")
 	req.ClientToken = root
 	if batch {
 		req.Data["type"] = "batch"
@@ -654,7 +653,7 @@ func testMakeServiceTokenViaCore(t testing.TB, c *Core, root, client, ttl string
 }
 
 func testMakeTokenViaCore(t testing.TB, c *Core, root, client, ttl, period string, policy []string, batch bool, outAuth *logical.Auth) {
-	req := logical.TestRequest(benchhelpers.TBtoT(t), logical.UpdateOperation, "auth/token/create")
+	req := logical.TestRequest(t, logical.UpdateOperation, "auth/token/create")
 	req.ClientToken = root
 	if batch {
 		req.Data["type"] = "batch"
@@ -1171,10 +1170,7 @@ func TestTokenStore_CreateLookup_ExpirationInRestoreMode(t *testing.T) {
 		t.Fatalf("err: %v", err)
 	}
 
-	err = c.stopExpiration()
-	if err != nil {
-		t.Fatal(err)
-	}
+	stopExpiration(t, c)
 
 	// Reset expiration manager to restore mode
 	ts.expiration.restoreModeLock.Lock()
@@ -1413,7 +1409,7 @@ func TestTokenStore_RevokeTree(t *testing.T) {
 // Revokes a given Token Store tree non recursively.
 // The second parameter refers to the depth of the tree.
 func testTokenStore_RevokeTree_NonRecursive(t testing.TB, depth uint64, injectCycles bool) {
-	c, _, _ := TestCoreUnsealed(benchhelpers.TBtoT(t))
+	c, _, _ := TestCoreUnsealed(t)
 	ts := c.tokenStore
 	root, children := buildTokenTree(t, ts, depth)
 
@@ -4130,7 +4126,7 @@ func TestTokenStore_RolePeriod(t *testing.T) {
 			t.Fatal("response was nil")
 		}
 		if resp.Auth == nil {
-			t.Fatalf(fmt.Sprintf("response auth was nil, resp is %#v", *resp))
+			t.Fatalf("response auth was nil, resp is %#v", *resp)
 		}
 		if resp.Auth.ClientToken == "" {
 			t.Fatalf("bad: %#v", resp)
@@ -4287,7 +4283,7 @@ func TestTokenStore_RoleExplicitMaxTTL(t *testing.T) {
 			t.Fatal("response was nil")
 		}
 		if resp.Auth == nil {
-			t.Fatalf(fmt.Sprintf("response auth was nil, resp is %#v", *resp))
+			t.Fatalf("response auth was nil, resp is %#v", *resp)
 		}
 		if resp.Auth.ClientToken == "" {
 			t.Fatalf("bad: %#v", resp)
@@ -4679,7 +4675,7 @@ func TestTokenStore_Periodic(t *testing.T) {
 			t.Fatal("response was nil")
 		}
 		if resp.Auth == nil {
-			t.Fatalf(fmt.Sprintf("response auth was nil, resp is %#v", *resp))
+			t.Fatalf("response auth was nil, resp is %#v", *resp)
 		}
 		if resp.Auth.ClientToken == "" {
 			t.Fatalf("bad: %#v", resp)
@@ -4740,7 +4736,7 @@ func TestTokenStore_Periodic(t *testing.T) {
 			t.Fatal("response was nil")
 		}
 		if resp.Auth == nil {
-			t.Fatalf(fmt.Sprintf("response auth was nil, resp is %#v", *resp))
+			t.Fatalf("response auth was nil, resp is %#v", *resp)
 		}
 		if resp.Auth.ClientToken == "" {
 			t.Fatalf("bad: %#v", resp)
@@ -4792,7 +4788,7 @@ func testTokenStore_NumUses_ErrorCheckHelper(t *testing.T, resp *logical.Respons
 		t.Fatal("response was nil")
 	}
 	if resp.Auth == nil {
-		t.Fatalf(fmt.Sprintf("response auth was nil, resp is %#v", *resp))
+		t.Fatalf("response auth was nil, resp is %#v", *resp)
 	}
 	if resp.Auth.ClientToken == "" {
 		t.Fatalf("bad: %#v", resp)
@@ -4939,7 +4935,7 @@ func TestTokenStore_Periodic_ExplicitMax(t *testing.T) {
 			t.Fatal("response was nil")
 		}
 		if resp.Auth == nil {
-			t.Fatalf(fmt.Sprintf("response auth was nil, resp is %#v", *resp))
+			t.Fatalf("response auth was nil, resp is %#v", *resp)
 		}
 		if resp.Auth.ClientToken == "" {
 			t.Fatalf("bad: %#v", resp)
@@ -5013,7 +5009,7 @@ func TestTokenStore_Periodic_ExplicitMax(t *testing.T) {
 			t.Fatal("response was nil")
 		}
 		if resp.Auth == nil {
-			t.Fatalf(fmt.Sprintf("response auth was nil, resp is %#v", *resp))
+			t.Fatalf("response auth was nil, resp is %#v", *resp)
 		}
 		if resp.Auth.ClientToken == "" {
 			t.Fatalf("bad: %#v", resp)
diff --git a/vault/token_store_util.go b/vault/token_store_util.go
index 02c9ccd27f7..77c8f5f090c 100644
--- a/vault/token_store_util.go
+++ b/vault/token_store_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/vault/token_store_util_common.go b/vault/token_store_util_common.go
index c4c3852eaeb..bf21b66be86 100644
--- a/vault/token_store_util_common.go
+++ b/vault/token_store_util_common.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/tokens/token.pb.go b/vault/tokens/token.pb.go
index a7f770e534e..7453501d013 100644
--- a/vault/tokens/token.pb.go
+++ b/vault/tokens/token.pb.go
@@ -1,9 +1,9 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.36.5
 // 	protoc        (unknown)
 // source: vault/tokens/token.proto
 
@@ -14,6 +14,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -25,22 +26,19 @@ const (
 
 // SignedToken
 type SignedToken struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	TokenVersion  uint64                 `protobuf:"varint,1,opt,name=token_version,json=tokenVersion,proto3" json:"token_version,omitempty"` // always 1 for now
+	Hmac          []byte                 `protobuf:"bytes,2,opt,name=hmac,proto3" json:"hmac,omitempty"`                                      // HMAC of token
+	Token         []byte                 `protobuf:"bytes,3,opt,name=token,proto3" json:"token,omitempty"`                                    // protobuf-marshalled Token message
 	unknownFields protoimpl.UnknownFields
-
-	TokenVersion uint64 `protobuf:"varint,1,opt,name=token_version,json=tokenVersion,proto3" json:"token_version,omitempty"` // always 1 for now
-	Hmac         []byte `protobuf:"bytes,2,opt,name=hmac,proto3" json:"hmac,omitempty"`                                      // HMAC of token
-	Token        []byte `protobuf:"bytes,3,opt,name=token,proto3" json:"token,omitempty"`                                    // protobuf-marshalled Token message
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *SignedToken) Reset() {
 	*x = SignedToken{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_tokens_token_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_tokens_token_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *SignedToken) String() string {
@@ -51,7 +49,7 @@ func (*SignedToken) ProtoMessage() {}
 
 func (x *SignedToken) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_tokens_token_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -88,22 +86,19 @@ func (x *SignedToken) GetToken() []byte {
 }
 
 type Token struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Random        string                 `protobuf:"bytes,1,opt,name=random,proto3" json:"random,omitempty"`                            // unencoded equiv of former $randbase62
+	LocalIndex    uint64                 `protobuf:"varint,2,opt,name=local_index,json=localIndex,proto3" json:"local_index,omitempty"` // required storage state to have this token
+	IndexEpoch    uint32                 `protobuf:"varint,3,opt,name=index_epoch,json=indexEpoch,proto3" json:"index_epoch,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Random     string `protobuf:"bytes,1,opt,name=random,proto3" json:"random,omitempty"`                            // unencoded equiv of former $randbase62
-	LocalIndex uint64 `protobuf:"varint,2,opt,name=local_index,json=localIndex,proto3" json:"local_index,omitempty"` // required storage state to have this token
-	IndexEpoch uint32 `protobuf:"varint,3,opt,name=index_epoch,json=indexEpoch,proto3" json:"index_epoch,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Token) Reset() {
 	*x = Token{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_vault_tokens_token_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_vault_tokens_token_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Token) String() string {
@@ -114,7 +109,7 @@ func (*Token) ProtoMessage() {}
 
 func (x *Token) ProtoReflect() protoreflect.Message {
 	mi := &file_vault_tokens_token_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -152,7 +147,7 @@ func (x *Token) GetIndexEpoch() uint32 {
 
 var File_vault_tokens_token_proto protoreflect.FileDescriptor
 
-var file_vault_tokens_token_proto_rawDesc = []byte{
+var file_vault_tokens_token_proto_rawDesc = string([]byte{
 	0x0a, 0x18, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x2f, 0x74,
 	0x6f, 0x6b, 0x65, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x06, 0x74, 0x6f, 0x6b, 0x65,
 	0x6e, 0x73, 0x22, 0x5c, 0x0a, 0x0b, 0x53, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x54, 0x6f, 0x6b, 0x65,
@@ -171,22 +166,22 @@ var file_vault_tokens_token_proto_rawDesc = []byte{
 	0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x76, 0x61, 0x75, 0x6c,
 	0x74, 0x2f, 0x76, 0x61, 0x75, 0x6c, 0x74, 0x2f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x62, 0x06,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+})
 
 var (
 	file_vault_tokens_token_proto_rawDescOnce sync.Once
-	file_vault_tokens_token_proto_rawDescData = file_vault_tokens_token_proto_rawDesc
+	file_vault_tokens_token_proto_rawDescData []byte
 )
 
 func file_vault_tokens_token_proto_rawDescGZIP() []byte {
 	file_vault_tokens_token_proto_rawDescOnce.Do(func() {
-		file_vault_tokens_token_proto_rawDescData = protoimpl.X.CompressGZIP(file_vault_tokens_token_proto_rawDescData)
+		file_vault_tokens_token_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_vault_tokens_token_proto_rawDesc), len(file_vault_tokens_token_proto_rawDesc)))
 	})
 	return file_vault_tokens_token_proto_rawDescData
 }
 
 var file_vault_tokens_token_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_vault_tokens_token_proto_goTypes = []interface{}{
+var file_vault_tokens_token_proto_goTypes = []any{
 	(*SignedToken)(nil), // 0: tokens.SignedToken
 	(*Token)(nil),       // 1: tokens.Token
 }
@@ -203,37 +198,11 @@ func file_vault_tokens_token_proto_init() {
 	if File_vault_tokens_token_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_vault_tokens_token_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SignedToken); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_vault_tokens_token_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Token); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_vault_tokens_token_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_vault_tokens_token_proto_rawDesc), len(file_vault_tokens_token_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   2,
 			NumExtensions: 0,
@@ -244,7 +213,6 @@ func file_vault_tokens_token_proto_init() {
 		MessageInfos:      file_vault_tokens_token_proto_msgTypes,
 	}.Build()
 	File_vault_tokens_token_proto = out.File
-	file_vault_tokens_token_proto_rawDesc = nil
 	file_vault_tokens_token_proto_goTypes = nil
 	file_vault_tokens_token_proto_depIdxs = nil
 }
diff --git a/vault/tokens/token.proto b/vault/tokens/token.proto
index 60dc56b7ef6..a282a5e1eea 100644
--- a/vault/tokens/token.proto
+++ b/vault/tokens/token.proto
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 syntax = "proto3";
diff --git a/vault/ui.go b/vault/ui.go
index 8422ea11c71..3c81c850d58 100644
--- a/vault/ui.go
+++ b/vault/ui.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/ui_custom_messages/entry.go b/vault/ui_custom_messages/entry.go
index de50335d8d2..49b5a95699b 100644
--- a/vault/ui_custom_messages/entry.go
+++ b/vault/ui_custom_messages/entry.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package uicustommessages
diff --git a/vault/ui_custom_messages/entry_test.go b/vault/ui_custom_messages/entry_test.go
index 4cef2dc5dbd..c772ae02a34 100644
--- a/vault/ui_custom_messages/entry_test.go
+++ b/vault/ui_custom_messages/entry_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package uicustommessages
diff --git a/vault/ui_custom_messages/filter.go b/vault/ui_custom_messages/filter.go
index de91281865d..cfd20b2ea28 100644
--- a/vault/ui_custom_messages/filter.go
+++ b/vault/ui_custom_messages/filter.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package uicustommessages
diff --git a/vault/ui_custom_messages/filter_test.go b/vault/ui_custom_messages/filter_test.go
index c170253f402..022b42ec53e 100644
--- a/vault/ui_custom_messages/filter_test.go
+++ b/vault/ui_custom_messages/filter_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package uicustommessages
diff --git a/vault/ui_custom_messages/manager.go b/vault/ui_custom_messages/manager.go
index db2ea24c749..a01f7ed4527 100644
--- a/vault/ui_custom_messages/manager.go
+++ b/vault/ui_custom_messages/manager.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package uicustommessages
diff --git a/vault/ui_custom_messages/manager_test.go b/vault/ui_custom_messages/manager_test.go
index 2029407248a..37e14a689dc 100644
--- a/vault/ui_custom_messages/manager_test.go
+++ b/vault/ui_custom_messages/manager_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package uicustommessages
diff --git a/vault/ui_custom_messages/message.go b/vault/ui_custom_messages/message.go
index 0435bf5e482..d33784ca72f 100644
--- a/vault/ui_custom_messages/message.go
+++ b/vault/ui_custom_messages/message.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package uicustommessages
diff --git a/vault/ui_custom_messages/message_test.go b/vault/ui_custom_messages/message_test.go
index a57cd01686b..a3416ed7848 100644
--- a/vault/ui_custom_messages/message_test.go
+++ b/vault/ui_custom_messages/message_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package uicustommessages
diff --git a/vault/ui_custom_messages/namespace.go b/vault/ui_custom_messages/namespace.go
index 57af486dab4..1f11d90aa40 100644
--- a/vault/ui_custom_messages/namespace.go
+++ b/vault/ui_custom_messages/namespace.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package uicustommessages
diff --git a/vault/ui_custom_messages/namespace_test.go b/vault/ui_custom_messages/namespace_test.go
index aa0fa680b68..eea70201f2e 100644
--- a/vault/ui_custom_messages/namespace_test.go
+++ b/vault/ui_custom_messages/namespace_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package uicustommessages
diff --git a/vault/ui_test.go b/vault/ui_test.go
index 8e6bce10cea..19e0febc1d9 100644
--- a/vault/ui_test.go
+++ b/vault/ui_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/util.go b/vault/util.go
index 60b71713c8e..fe303d08526 100644
--- a/vault/util.go
+++ b/vault/util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/util_test.go b/vault/util_test.go
index 04d345f0fe5..acd0a67caaa 100644
--- a/vault/util_test.go
+++ b/vault/util_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/vault_version_time.go b/vault/vault_version_time.go
index e4a8e1964a3..c041b0831f0 100644
--- a/vault/vault_version_time.go
+++ b/vault/vault_version_time.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/version_store.go b/vault/version_store.go
index 8c50f50647f..46fbac98ad6 100644
--- a/vault/version_store.go
+++ b/vault/version_store.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/version_store_test.go b/vault/version_store_test.go
index 1ce0f029b0e..d2cc5378c5e 100644
--- a/vault/version_store_test.go
+++ b/vault/version_store_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
diff --git a/vault/well_known_redirect.go b/vault/well_known_redirect.go
index 027a4c28c33..c0c2a0cab7b 100644
--- a/vault/well_known_redirect.go
+++ b/vault/well_known_redirect.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -15,14 +15,13 @@ import (
 )
 
 type wellKnownRedirect struct {
-	c             *Core
-	mountUUID     string
-	prefix        string
-	isPrefixMatch bool
+	c         *Core
+	mountUUID string
+	prefix    string
 }
 
 type wellKnownRedirectRegistry struct {
-	lock  sync.Mutex
+	lock  sync.RWMutex
 	paths *radix.Tree
 }
 
@@ -54,6 +53,9 @@ func (reg *wellKnownRedirectRegistry) TryRegister(ctx context.Context, core *Cor
 
 // Find any relevant redirects for a given source path
 func (reg *wellKnownRedirectRegistry) Find(path string) (*wellKnownRedirect, string) {
+	reg.lock.RLock()
+	defer reg.lock.RUnlock()
+
 	s, a, found := reg.paths.LongestPrefix(path)
 	if found {
 		remaining := strings.TrimPrefix(path, s)
@@ -107,6 +109,32 @@ func (reg *wellKnownRedirectRegistry) DeregisterSource(mountUuid, src string) bo
 	return found
 }
 
+// List returns a map keyed by the registered label and associated well known redirect
+func (reg *wellKnownRedirectRegistry) List() map[string]*wellKnownRedirect {
+	reg.lock.RLock()
+	defer reg.lock.RUnlock()
+
+	labels := map[string]*wellKnownRedirect{}
+	reg.paths.Walk(func(s string, v interface{}) bool {
+		labels[s] = v.(*wellKnownRedirect)
+		return false
+	})
+
+	return labels
+}
+
+// Get returns a well known redirect for a specific registered label
+func (reg *wellKnownRedirectRegistry) Get(label string) (*wellKnownRedirect, bool) {
+	reg.lock.RLock()
+	defer reg.lock.RUnlock()
+
+	if v, ok := reg.paths.Get(label); ok {
+		return v.(*wellKnownRedirect), true
+	}
+
+	return nil, false
+}
+
 // Construct the full destination of the redirect, including any remaining path past the src
 func (a *wellKnownRedirect) Destination(remaining string) (string, error) {
 	var destPath string
diff --git a/vault/wrapping.go b/vault/wrapping.go
index accca9a65ee..cedba608f14 100644
--- a/vault/wrapping.go
+++ b/vault/wrapping.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package vault
@@ -15,6 +15,7 @@ import (
 	"github.com/armon/go-metrics"
 	"github.com/go-jose/go-jose/v3"
 	"github.com/go-jose/go-jose/v3/jwt"
+	"github.com/hashicorp/vault/api"
 	"github.com/hashicorp/vault/helper/metricsutil"
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/helper/certutil"
@@ -129,6 +130,13 @@ DONELISTHANDLING:
 		}
 	}
 
+	// If the response is from a snapshot read or list, we need to make sure
+	// that hte wrapped value is written to real storage, not to the snapshot
+	// storage
+	if req.IsSnapshotReadOrList() {
+		ctx = logical.CreateContextWithSnapshotID(ctx, "")
+	}
+
 	// If we are wrapping, the first part (performed in this functions) happens
 	// before auditing so that resp.WrapInfo.Token can contain the HMAC'd
 	// wrapping token ID in the audit logs, so that it can be determined from
@@ -218,7 +226,7 @@ DONELISTHANDLING:
 			priClaims.Accessor = resp.Auth.Accessor
 		}
 		sig, err := jose.NewSigner(
-			jose.SigningKey{Algorithm: jose.ES512, Key: c.wrappingJWTKey},
+			jose.SigningKey{Algorithm: jose.SignatureAlgorithm(api.CubbyHoleJWTSignatureAlgorithm), Key: c.wrappingJWTKey},
 			(&jose.SignerOptions{}).WithType("JWT"))
 		if err != nil {
 			c.tokenStore.revokeOrphan(ctx, te.ID)
diff --git a/vault/wrapping_util.go b/vault/wrapping_util.go
index bf610705c2f..995775b661e 100644
--- a/vault/wrapping_util.go
+++ b/vault/wrapping_util.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build !enterprise
diff --git a/version/VERSION b/version/VERSION
index cedb0c42541..7274dd2ba6b 100644
--- a/version/VERSION
+++ b/version/VERSION
@@ -1 +1 @@
-1.17.0-beta1
+1.21.0-beta1
diff --git a/version/cgo.go b/version/cgo.go
index 63f804757ca..2ba51aeb1e5 100644
--- a/version/cgo.go
+++ b/version/cgo.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 //go:build cgo
diff --git a/version/version.go b/version/version.go
index eb63e741802..0417077e414 100644
--- a/version/version.go
+++ b/version/version.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package version
@@ -6,6 +6,7 @@ package version
 import (
 	"bytes"
 	"fmt"
+	"time"
 )
 
 type VersionInfo struct {
@@ -33,6 +34,14 @@ func GetVersion() *VersionInfo {
 	}
 }
 
+func GetVaultBuildDate() (time.Time, error) {
+	buildDate, err := time.Parse(time.RFC3339, BuildDate)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("failed to parse build date based on RFC3339: %w", err)
+	}
+	return buildDate, nil
+}
+
 func (c *VersionInfo) VersionNumber() string {
 	if Version == "unknown" && VersionPrerelease == "unknown" {
 		return "(version unknown)"
diff --git a/version/version_base.go b/version/version_base.go
index 1c1fe80cd07..b9959e90df7 100644
--- a/version/version_base.go
+++ b/version/version_base.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package version
diff --git a/version/version_test.go b/version/version_test.go
index ae2da448c31..74180a60328 100644
--- a/version/version_test.go
+++ b/version/version_test.go
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2016, 2025
 // SPDX-License-Identifier: BUSL-1.1
 
 package version
diff --git a/website/.editorconfig b/website/.editorconfig
deleted file mode 100644
index 36bf83fdb5a..00000000000
--- a/website/.editorconfig
+++ /dev/null
@@ -1,18 +0,0 @@
-# This file is for unifying the coding style for different editors and IDEs
-# editorconfig.org
-
-root = true
-
-[*]
-end_of_line = lf
-charset = utf-8
-insert_final_newline = true
-trim_trailing_whitespace = true
-indent_style = space
-indent_size = 2
-
-[Makefile]
-indent_style = tab
-
-[{*.md,*.json}]
-max_line_length = null
diff --git a/website/.env b/website/.env
deleted file mode 100644
index 6ba0ec11612..00000000000
--- a/website/.env
+++ /dev/null
@@ -1,3 +0,0 @@
-NEXT_PUBLIC_ALGOLIA_APP_ID=YY0FFNI7MF
-NEXT_PUBLIC_ALGOLIA_INDEX=product_VAULT
-NEXT_PUBLIC_ALGOLIA_SEARCH_ONLY_API_KEY=9c555e8fa951c1c53e726c0ce2eb3b73
diff --git a/website/.env.production b/website/.env.production
deleted file mode 100644
index 83825a896ca..00000000000
--- a/website/.env.production
+++ /dev/null
@@ -1 +0,0 @@
-HASHI_ENV=production
diff --git a/website/.eslintrc.js b/website/.eslintrc.js
deleted file mode 100644
index 4b17f084b36..00000000000
--- a/website/.eslintrc.js
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-module.exports = {
-  ...require('@hashicorp/platform-cli/config/.eslintrc'),
-  /* Specify overrides here */
-  ignorePatterns: ['public/']
-}
diff --git a/website/.gitignore b/website/.gitignore
deleted file mode 100644
index adaccf90dba..00000000000
--- a/website/.gitignore
+++ /dev/null
@@ -1,11 +0,0 @@
-node_modules
-.DS_Store
-.next
-out
-.mdx-data
-
-# As per Next.js conventions (https://nextjs.org/docs/basic-features/environment-variables#default-environment-variables)
-.env*.local
-!.env*
-
-website-preview
diff --git a/website/.nvmrc b/website/.nvmrc
deleted file mode 100644
index 3f430af82b3..00000000000
--- a/website/.nvmrc
+++ /dev/null
@@ -1 +0,0 @@
-v18
diff --git a/website/.stylelintrc.js b/website/.stylelintrc.js
deleted file mode 100644
index b651a846093..00000000000
--- a/website/.stylelintrc.js
+++ /dev/null
@@ -1,9 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-module.exports = {
-  ...require('@hashicorp/platform-cli/config/stylelint.config'),
-  /* Specify overrides here */
-}
diff --git a/website/Dockerfile b/website/Dockerfile
deleted file mode 100644
index d97a50cd73c..00000000000
--- a/website/Dockerfile
+++ /dev/null
@@ -1,11 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-FROM docker.mirror.hashicorp.services/node:18.18.2-alpine
-RUN apk add --update --no-cache git make g++ automake autoconf libtool nasm libpng-dev
-
-COPY ./package.json /website/package.json
-COPY ./package-lock.json /website/package-lock.json
-WORKDIR /website
-RUN npm install -g npm@latest
-RUN npm install
diff --git a/website/Makefile b/website/Makefile
deleted file mode 100644
index eeaa9157f52..00000000000
--- a/website/Makefile
+++ /dev/null
@@ -1,58 +0,0 @@
-######################################################
-# NOTE: This file is managed by the Digital Team's   #
-# Terraform configuration @ hashicorp/mktg-terraform #
-######################################################
-
-.DEFAULT_GOAL := website
-
-# Set the preview mode for the website shell to "developer" or "io"
-PREVIEW_MODE ?= developer
-REPO ?= vault
-
-# Enable setting alternate docker tool, e.g. 'make DOCKER_CMD=podman'
-DOCKER_CMD ?= docker
-
-CURRENT_GIT_BRANCH=$$(git rev-parse --abbrev-ref HEAD)
-LOCAL_CONTENT_DIR=
-PWD=$$(pwd)
-
-DOCKER_IMAGE="hashicorp/dev-portal"
-DOCKER_IMAGE_LOCAL="dev-portal-local"
-DOCKER_RUN_FLAGS=-it \
-		--publish "3000:3000" \
-		--rm \
-		--tty \
-		--volume "$(PWD)/content:/app/content" \
-		--volume "$(PWD)/public:/app/public" \
-		--volume "$(PWD)/data:/app/data" \
-		--volume "$(PWD)/redirects.js:/app/redirects.js" \
-		--volume "next-dir:/app/website-preview/.next" \
-		--volume "$(PWD)/.env:/app/.env" \
-		-e "REPO=$(REPO)" \
-		-e "PREVIEW_FROM_REPO=$(REPO)" \
-		-e "IS_CONTENT_PREVIEW=true" \
-		-e "LOCAL_CONTENT_DIR=$(LOCAL_CONTENT_DIR)" \
-		-e "CURRENT_GIT_BRANCH=$(CURRENT_GIT_BRANCH)" \
-		-e "PREVIEW_MODE=$(PREVIEW_MODE)"
-
-# Default: run this if working on the website locally to run in watch mode.
-.PHONY: website
-website:
-	@echo "==> Downloading latest Docker image..."
-	@$(DOCKER_CMD) pull $(DOCKER_IMAGE)
-	@echo "==> Starting website..."
-	@$(DOCKER_CMD) run $(DOCKER_RUN_FLAGS) $(DOCKER_IMAGE)
-
-# Use this if you have run `website/build-local` to use the locally built image.
-.PHONY: website/local
-website/local:
-	@echo "==> Starting website from local image..."
-	@$(DOCKER_CMD) run $(DOCKER_RUN_FLAGS) $(DOCKER_IMAGE_LOCAL)
-
-# Run this to generate a new local Docker image.
-.PHONY: website/build-local
-website/build-local:
-	@echo "==> Building local Docker image"
-	@$(DOCKER_CMD) build https://github.com/hashicorp/dev-portal.git\#main \
-		-t $(DOCKER_IMAGE_LOCAL)
-
diff --git a/website/README.md b/website/README.md
index e18ee8cc38f..4b067adebc5 100644
--- a/website/README.md
+++ b/website/README.md
@@ -1,535 +1,23 @@
-# Vault Website
+# Vault product documentation website
 
-This subdirectory contains the content for the [Vault Website](https://vaultproject.io/).
+> [!IMPORTANT]  
+>
+> **Vault documentation change**
+> 
+> Vault product documentation no longer publishes from the `/website` directory.
 
-<!--
-  This readme file contains several blocks of generated text, to make it easier to share common information
-  across documentation website readmes. To generate these blocks from their source, run `npm run generate:readme`
+The Vault docs now live in the
+[`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs)
+repo under `/content/vault/`.
 
-  Any edits to the readme are welcome outside the clearly noted boundaries of the blocks. Alternately, a
-  block itself can be safely "forked" from the central implementation simply by removing the "BEGIN" and
-  "END" comments from around it.
--->
+You can still contribute to Vault docs by created a PR under
+`hashicorp/web-unified-docs`:
 
-## Table of Contents
+- For content changes related to the monthly Vault update, submit PRs against
+  the monthly update branch (e.g., `vault/202509`).
 
-- [Contributions](#contributions-welcome)
-- [Running the Site Locally](#running-the-site-locally)
-- [Editing Markdown Content](#editing-markdown-content)
-- [Editing Navigation Sidebars](#editing-navigation-sidebars)
-- [Changing the Release Version](#changing-the-release-version)
-- [Redirects](#redirects)
-- [Browser Support](#browser-support)
-- [Deployment](#deployment)
+- For content changes related to an upcoming Vault release, submit PRs against
+  the RC release branch (e.g., `vault/1.21.x`).
 
-<!-- BEGIN: contributions -->
-<!-- Generated text, do not edit directly -->
-
-## Contributions Welcome!
-
-If you find a typo or you feel like you can improve the HTML, CSS, or JavaScript, we welcome contributions. Feel free to open issues or pull requests like any normal GitHub project, and we'll merge it in 🚀
-
-<!-- END: contributions -->
-
-<!-- BEGIN: local-development -->
-<!-- Generated text, do not edit directly -->
-
-## Running the Site Locally
-
-The website can be run locally through node.js or [Docker](https://www.docker.com/get-started). If you choose to run through Docker, everything will be a little bit slower due to the additional overhead, so for frequent contributors it may be worth it to use node.
-
-> **Note:** If you are using a text editor that uses a "safe write" save style such as **vim** or **goland**, this can cause issues with the live reload in development. If you turn off safe write, this should solve the problem. In vim, this can be done by running `:set backupcopy=yes`. In goland, search the settings for "safe write" and turn that setting off.
-
-### With Docker
-
-Running the site locally is simple. Provided you have Docker installed, clone this repo, run `make`, and then visit `http://localhost:3000`.
-
-The docker image is pre-built with all the website dependencies installed, which is what makes it so quick and simple, but also means if you need to change dependencies and test the changes within Docker, you'll need a new image. If this is something you need to do, you can run `make build-image` to generate a local Docker image with updated dependencies, then `make website-local` to use that image and preview.
-
-### With Node
-
-If your local development environment has a supported version (v10.0.0+) of [node installed](https://nodejs.org/en/) you can run:
-
-- `npm install`
-- `npm start`
-
-...and then visit `http://localhost:3000`.
-
-If you pull down new code from github, you should run `npm install` again. Otherwise, there's no need to re-run `npm install` each time the site is run, you can just run `npm start` to get it going.
-
-<!-- END: local-development -->
-
-<!-- BEGIN: editing-markdown -->
-<!-- Generated text, do not edit directly -->
-
-## Editing Markdown Content
-
-Documentation content is written in [Markdown](https://www.markdownguide.org/cheat-sheet/) and you'll find all files listed under the `/content` directory.
-
-To create a new page with Markdown, create a file ending in `.mdx` in a `content/<subdirectory>`. The path in the content directory will be the URL route. For example, `content/docs/hello.mdx` will be served from the `/docs/hello` URL.
-
-> **Important**: Files and directories will only be rendered and published to the website if they are [included in sidebar data](#editing-navigation-sidebars). Any file not included in sidebar data will not be rendered or published.
-
-This file can be standard Markdown and also supports [YAML frontmatter](https://middlemanapp.com/basics/frontmatter/). YAML frontmatter is optional, there are defaults for all keys.
-
-```yaml
----
-title: 'My Title'
-description: "A thorough, yet succinct description of the page's contents"
----
-```
-
-The significant keys in the YAML frontmatter are:
-
-- `title` `(string)` - This is the title of the page that will be set in the HTML title.
-- `description` `(string)` - This is a description of the page that will be set in the HTML description.
-
-> ⚠️ If there is a need for a `/api/*` url on this website, the url will be changed to `/api-docs/*`, as the `api` folder is reserved by next.js.
-
-### Validating Content
-
-Content changes are automatically validated against a set of rules as part of the pull request process. If you want to run these checks locally to validate your content before comitting your changes, you can run the following command:
-
-```
-npm run content-check
-```
-
-If the validation fails, actionable error messages will be displayed to help you address detected issues.
-
-### Creating New Pages
-
-There is currently a small bug with new page creation - if you create a new page and link it up via subnav data while the server is running, it will report an error saying the page was not found. This can be resolved by restarting the server.
-
-### Markdown Enhancements
-
-There are several custom markdown plugins that are available by default that enhance [standard markdown](https://commonmark.org/) to fit our use cases. This set of plugins introduces a couple instances of custom syntax, and a couple specific pitfalls that are not present by default with markdown, detailed below:
-
-- > **Warning**: We are deprecating the current [paragraph alerts](https://github.com/hashicorp/remark-plugins/tree/master/plugins/paragraph-custom-alerts#paragraph-custom-alerts), in favor of the newer [MDX Inline Alert](#inline-alerts) components. The legacy paragraph alerts are represented by the symbols `~>`, `->`, `=>`, or `!>`.
-- If you see `@include '/some/path.mdx'`, this is a [markdown include](https://github.com/hashicorp/remark-plugins/tree/master/plugins/include-markdown#include-markdown-plugin). It's worth noting as well that all includes resolve from `website/content/partials` by default, and that changes to partials will not live-reload the website.
-- If you see `# Headline ((#slug))`, this is an example of an [anchor link alias](https://github.com/hashicorp/remark-plugins/tree/je.anchor-link-adjustments/plugins/anchor-links#anchor-link-aliases). It adds an extra permalink to a headline for compatibility and is removed from the output.
-- Due to [automatically generated permalinks](https://github.com/hashicorp/remark-plugins/tree/je.anchor-link-adjustments/plugins/anchor-links#anchor-links), any text changes to _headlines_ or _list items that begin with inline code_ can and will break existing permalinks. Be very cautious when changing either of these two text items.
-
-  Headlines are fairly self-explanatory, but here's an example of how to list items that begin with inline code look.
-
-  ```markdown
-  - this is a normal list item
-  - `this` is a list item that begins with inline code
-  ```
-
-  Its worth noting that _only the inline code at the beginning of the list item_ will cause problems if changed. So if you changed the above markup to...
-
-  ```markdown
-  - lsdhfhksdjf
-  - `this` jsdhfkdsjhkdsfjh
-  ```
-
-  ...while it perhaps would not be an improved user experience, no links would break because of it. The best approach is to **avoid changing headlines and inline code at the start of a list item**. If you must change one of these items, make sure to tag someone from the digital marketing development team on your pull request, they will help to ensure as much compatibility as possible.
-
-### Custom Components
-
-A number of custom [mdx components](https://mdxjs.com/) are available for use within any `.mdx` file. Each one is documented below:
-
-#### Inline Alerts
-
-There are custom MDX components available to author alert data. [See the full documentation here](https://developer.hashicorp.com/swingset/components/mdxinlinealert). They render as colored boxes to draw the user's attention to some type of aside.
-
-```mdx
-## Alert types
-
-### Tip
-
-<Tip>
-  To provide general information to the user regarding the current context or
-  relevant actions.
-</Tip>
-
-### Highlight
-
-<Highlight>
-  To provide general or promotional information to the user prominently.
-</Highlight>
-
-### Note
-
-<Note>
-  To help users avoid an issue. Provide guidance and actions if possible.
-</Note>
-
-### Warning
-
-<Warning>
-  To indicate critical issues that need immediate action or help users
-  understand something critical.
-</Warning>
-
-## Title override prop
-
-<Note title="Hashiconf 2027">To provide general information.</Note>
-```
-
-#### Tabs
-
-The `Tabs` component creates tabbed content of any type, but is often used for code examples given in different languages. Here's an example of how it looks from the Vagrant documentation website:
-
-![Tabs Component](https://p176.p0.n0.cdn.getcloudapp.com/items/WnubALZ4/Screen%20Recording%202020-06-11%20at%2006.03%20PM.gif?v=1de81ea720a8cc8ade83ca64fb0b9edd)
-
-> Please refer to the [Swingset](https://react-components.vercel.app/?component=Tabs) documentation for the latest examples and API reference.
-
-It can be used as such within a markdown file:
-
-````mdx
-Normal **markdown** content.
-
-<Tabs>
-<Tab heading="CLI command">
-            <!-- Intentionally skipped line.. -->
-```shell-session
-$ command ...
-```
-            <!-- Intentionally skipped line.. -->
-</Tab>
-<Tab heading="API call using cURL">
-
-```shell-session
-$ curl ...
-```
-
-</Tab>
-</Tabs>
-
-Continued normal markdown content
-````
-
-The intentionally skipped line is a limitation of the mdx parser which is being actively worked on. All tabs must have a heading, and there is no limit to the number of tabs, though it is recommended to go for a maximum of three or four.
-
-#### Enterprise Alert
-
-This component provides a standard way to call out functionality as being present only in the enterprise version of the software. It can be presented in two contexts, inline or standalone. Here's an example of standalone usage from the Consul docs website:
-
-![Enterprise Alert Component - Standalone](https://p176.p0.n0.cdn.getcloudapp.com/items/WnubALp8/Screen%20Shot%202020-06-11%20at%206.06.03%20PM.png?v=d1505b90bdcbde6ed664831a885ea5fb)
-
-The standalone component can be used as such in markdown files:
-
-```mdx
-# Page Headline
-
-<EnterpriseAlert />
-
-Continued markdown content...
-```
-
-It can also receive custom text contents if you need to change the messaging but wish to retain the style. This will replace the text `This feature is available in all versions of Consul Enterprise.` with whatever you add. For example:
-
-```mdx
-# Page Headline
-
-<EnterpriseAlert>
-  My custom text here, and <a href="#">a link</a>!
-</EnterpriseAlert>
-
-Continued markdown content...
-```
-
-It's important to note that once you are adding custom content, it must be html and can not be markdown, as demonstrated above with the link.
-
-Now let's look at inline usage, here's an example:
-
-![Enterprise Alert Component - Inline](https://p176.p0.n0.cdn.getcloudapp.com/items/L1upYLEJ/Screen%20Shot%202020-06-11%20at%206.07.50%20PM.png?v=013ba439263de8292befbc851d31dd78)
-
-And here's how it could be used in your markdown document:
-
-```mdx
-### Some Enterprise Feature <EnterpriseAlert inline />
-
-Continued markdown content...
-```
-
-It's also worth noting that this component will automatically adjust to the correct product colors depending on the context.
-
-#### Other Components
-
-Other custom components can be made available on a per-site basis, the above are the standards. If you have questions about custom components that are not documented here, or have a request for a new custom component, please reach out to @hashicorp/digital-marketing.
-
-### Syntax Highlighting
-
-When using fenced code blocks, the recommendation is to tag the code block with a language so that it can be syntax highlighted. For example:
-
-````
-```
-// BAD: Code block with no language tag
-```
-
-```javascript
-// GOOD: Code block with a language tag
-```
-````
-
-Check out the [supported languages list](https://prismjs.com/#supported-languages) for the syntax highlighter we use if you want to double check the language name.
-
-It is also worth noting specifically that if you are using a code block that is an example of a terminal command, the correct language tag is `shell-session`. For example:
-
-🚫**BAD**: Using `shell`, `sh`, `bash`, or `plaintext` to represent a terminal command
-
-````
-```shell
-$ terraform apply
-```
-````
-
-✅**GOOD**: Using `shell-session` to represent a terminal command
-
-````
-```shell-session
-$ terraform apply
-```
-````
-
-<!-- END: editing-markdown -->
-
-<!-- BEGIN: editing-docs-sidebars -->
-<!-- Generated text, do not edit directly -->
-
-## Editing Navigation Sidebars
-
-The structure of the sidebars are controlled by files in the [`/data` directory](data). For example, [data/docs-nav-data.json](data/docs-nav-data.json) controls the **docs** sidebar. Within the `data` folder, any file with `-nav-data` after it controls the navigation for the given section.
-
-The sidebar uses a simple recursive data structure to represent _files_ and _directories_. The sidebar is meant to reflect the structure of the docs within the filesystem while also allowing custom ordering. Let's look at an example. First, here's our example folder structure:
-
-```text
-.
-├── docs
-│   └── directory
-│       ├── index.mdx
-│       ├── file.mdx
-│       ├── another-file.mdx
-│       └── nested-directory
-│           ├── index.mdx
-│           └── nested-file.mdx
-```
-
-Here's how this folder structure could be represented as a sidebar navigation, in this example it would be the file `website/data/docs-nav-data.json`:
-
-```json
-[
-  {
-    "title": "Directory",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "directory"
-      },
-      {
-        "title": "File",
-        "path": "directory/file"
-      },
-      {
-        "title": "Another File",
-        "path": "directory/another-file"
-      },
-      {
-        "title": "Nested Directory",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "directory/nested-directory"
-          },
-          {
-            "title": "Nested File",
-            "path": "directory/nested-directory/nested-file"
-          }
-        ]
-      }
-    ]
-  }
-]
-```
-
-A couple more important notes:
-
-- Within this data structure, ordering is flexible, but hierarchy is not. The structure of the sidebar must correspond to the structure of the content directory. So while you could put `file` and `another-file` in any order in the sidebar, or even leave one or both of them out, you could not decide to un-nest the `nested-directory` object without also un-nesting it in the filesystem.
-- The `title` property on each node in the `nav-data` tree is the human-readable name in the navigation.
-- The `path` property on each leaf node in the `nav-data` tree is the URL path where the `.mdx` document will be rendered, and the
-- Note that "index" files must be explicitly added. These will be automatically resolved, so the `path` value should be, as above, `directory` rather than `directory/index`. A common convention is to set the `title` of an "index" node to be `"Overview"`.
-
-Below we will discuss a couple of more unusual but still helpful patterns.
-
-### Index-less Categories
-
-Sometimes you may want to include a category but not have a need for an index page for the category. This can be accomplished, but as with other branch and leaf nodes, a human-readable `title` needs to be set manually. Here's an example of how an index-less category might look:
-
-```text
-.
-├── docs
-│   └── indexless-category
-│       └── file.mdx
-```
-
-```json
-// website/data/docs-nav-data.json
-[
-  {
-    "title": "Indexless Category",
-    "routes": [
-      {
-        "title": "File",
-        "path": "indexless-category/file"
-      }
-    ]
-  }
-]
-```
-
-### Custom or External Links
-
-Sometimes you may have a need to include a link that is not directly to a file within the docs hierarchy. This can also be supported using a different pattern. For example:
-
-```json
-[
-  {
-    "name": "Directory",
-    "routes": [
-      {
-        "title": "File",
-        "path": "directory/file"
-      },
-      {
-        "title": "Another File",
-        "path": "directory/another-file"
-      },
-      {
-        "title": "Tao of HashiCorp",
-        "href": "https://www.hashicorp.com/tao-of-hashicorp"
-      }
-    ]
-  }
-]
-```
-
-If the link provided in the `href` property is external, it will display a small icon indicating this. If it's internal, it will appear the same way as any other direct file link.
-
-<!-- END: editing-docs-sidebars -->
-
-<!-- BEGIN: releases -->
-<!-- Generated text, do not edit directly -->
-
-## Changing the Release Version
-
-To change the version displayed for download on the website, head over to `data/version.js` and change the number there. It's important to note that the version number must match a version that has been released and is live on `releases.hashicorp.com` -- if it does not, the website will be unable to fetch links to the binaries and will not compile. So this version number should be changed _only after a release_.
-
-### Displaying a Prerelease
-
-If there is a prerelease of any type that should be displayed on the downloads page, this can be done by editing `pages/downloads/index.jsx`. By default, the download component might look something like this:
-
-```jsx
-<ProductDownloader
-  product="<Product>"
-  version={VERSION}
-  downloads={downloadData}
-  community="/resources"
-/>
-```
-
-To add a prerelease, an extra `prerelease` property can be added to the component as such:
-
-```jsx
-<ProductDownloader
-  product="<Product>"
-  version={VERSION}
-  downloads={downloadData}
-  community="/resources"
-  prerelease={{
-    type: 'release candidate', // the type of prerelease: beta, release candidate, etc.
-    name: 'v1.0.0', // the name displayed in text on the website
-    version: '1.0.0-rc1', // the actual version tag that was pushed to releases.hashicorp.com
-  }}
-/>
-```
-
-This configuration would display something like the following text on the website, emphasis added to the configurable parameters:
-
-```
-A {{ release candidate }} for <Product> {{ v1.0.0 }} is available! The release can be <a href='https://releases.hashicorp.com/<product>/{{ 1.0.0-rc1 }}'>downloaded here</a>.
-```
-
-You may customize the parameters in any way you'd like. To remove a prerelease from the website, simply delete the `prerelease` parameter from the above component.
-
-<!-- END: releases -->
-
-<!-- BEGIN: redirects -->
-<!-- Generated text, do not edit directly -->
-
-## Redirects
-
-This website structures URLs based on the filesystem layout. This means that if a file is moved, removed, or a folder is re-organized, links will break. If a path change is necessary, it can be mitigated using redirects. It's important to note that redirects should only be used to cover for external links -- if you are moving a path which internal links point to, the internal links should also be adjusted to point to the correct page, rather than relying on a redirect.
-
-To add a redirect, head over to the `redirects.js` file - the format is fairly simple - there's a `source` and a `destination` - fill them both in, indicate that it's a permanent redirect or not using the `permanent` key, and that's it. Let's look at an example:
-
-```
-{
-  source: '/foo',
-  destination: '/bar',
-  permanent: true
-}
-```
-
-This redirect rule will send all incoming links to `/foo` to `/bar`. For more details on the redirects file format, [check out the docs on vercel](https://vercel.com/docs/configuration#project/redirects). All redirects will work both locally and in production exactly the same way, so feel free to test and verify your redirects locally. In the past testing redirects has required a preview deployment -- this is no longer the case. Please note however that if you add a redirect while the local server is running, you will need to restart it in order to see the effects of the redirect.
-
-There is still one caveat though: redirects do not apply to client-side navigation. By default, all links in the navigation and docs sidebar will navigate purely on the client side, which makes navigation through the docs significantly faster, especially for those with low-end devices and/or weak internet connections. In the future, we plan to convert all internal links within docs pages to behave this way as well. This means that if there is a link on this website to a given piece of content that has changed locations in some way, we need to also _directly change existing links to the content_. This way, if a user clicks a link that navigates on the client side, or if they hit the url directly and the page renders from the server side, either one will work perfectly.
-
-Let's look at an example. Say you have a page called `/docs/foo` which needs to be moved to `/docs/nested/foo`. Additionally, this is a page that has been around for a while and we know there are links into `/docs/foo.html` left over from our previous website structure. First, we move the page, then adjust the docs sidenav, in `data/docs-navigation.js`. Find the category the page is in, and move it into the appropriate subcategory. Next, we add to `_redirects` as such. The `.html` version is covered automatically.
-
-```js
-{ source: '/foo', destination: '/nested/foo', permanent: true }
-```
-
-Next, we run a global search for internal links to `/foo`, and make sure to adjust them to be `/nested/foo` - this is to ensure that client-side navigation still works correctly. _Adding a redirect alone is not enough_.
-
-One more example - let's say that content is being moved to an external website. A common example is guides moving to `learn.hashicorp.com`. In this case, we take all the same steps, except that we need to make a different type of change to the `docs-navigation` file. If previously the structure looked like:
-
-```js
-{
-  category: 'docs',
-  content: [
-    'foo'
-  ]
-}
-```
-
-If we no longer want the link to be in the side nav, we can simply remove it. If we do still want the link in the side nav, but pointing to an external destination, we need to slightly change the structure as such:
-
-```js
-{
-  category: 'docs',
-  content: [
-    { title: 'Foo Title', href: 'https://learn.hashicorp.com/<product>/foo' }
-  ]
-}
-```
-
-As the majority of items in the side nav are internal links, the structure makes it as easy as possible to represent these links. This alternate syntax is the most concise manner than an external link can be represented. External links can be used anywhere within the docs sidenav.
-
-It's also worth noting that it is possible to do glob-based redirects, for example matching `/docs/*`, and you may see this pattern in the redirects file. This type of redirect is much higher risk and the behavior is a bit more nuanced, so if you need to add a glob redirect, please reach out to the website maintainers and ask about it first.
-
-<!-- END: redirects -->
-
-<!-- BEGIN: browser-support -->
-<!-- Generated text, do not edit directly -->
-
-## Browser Support
-
-We support the following browsers targeting roughly the versions specified.
-
-| ![Chrome](https://raw.githubusercontent.com/alrra/browser-logos/main/src/chrome/chrome.svg) | ![Edge](https://raw.githubusercontent.com/alrra/browser-logos/main/src/edge/edge.svg) | ![Opera](https://raw.githubusercontent.com/alrra/browser-logos/main/src/opera/opera.svg) | ![Firefox](https://raw.githubusercontent.com/alrra/browser-logos/main/src/firefox/firefox.svg) | ![Safari](https://raw.githubusercontent.com/alrra/browser-logos/main/src/safari/safari.svg) |
-| ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
-| **Latest**                                                                                  | **Latest**                                                                            | **Latest**                                                                               | **Latest**                                                                                     | **Latest**                                                                                  |
-
-<!-- END: browser-support -->
-
-<!-- BEGIN: deployment -->
-<!-- Generated text, do not edit directly -->
-
-## Deployment
-
-This website is hosted on Vercel and configured to automatically deploy anytime you push code to the `stable-website` branch. Any time a pull request is submitted that changes files within the `website` folder, a deployment preview will appear in the github checks which can be used to validate the way docs changes will look live. Deployments from `stable-website` will look and behave the same way as deployment previews.
-
-<!-- END: deployment -->
+- For version-agnostic updates like typos, corrections, and broken links, submit
+  PRs against the `main` branch.
diff --git a/website/content/api-docs/auth/alicloud.mdx b/website/content/api-docs/auth/alicloud.mdx
deleted file mode 100644
index 9dd68096767..00000000000
--- a/website/content/api-docs/auth/alicloud.mdx
+++ /dev/null
@@ -1,200 +0,0 @@
----
-layout: api
-page_title: AliCloud - Auth Methods - HTTP API
-description: This is the API documentation for the Vault AliCloud auth method.
----
-
-# AliCloud auth method (API)
-
-This is the API documentation for the Vault AliCloud auth method. For
-general information about the usage and operation of the AliCloud method, please
-see the [Vault AliCloud auth method documentation](/vault/docs/auth/alicloud).
-
-This documentation assumes the AliCloud auth method is mounted at the `/auth/alicloud`
-path in Vault. Since it is possible to enable auth methods at any location,
-please update your API calls accordingly.
-
-## Create/Update role
-
-Registers a role. Only entities using the role registered using this endpoint
-will be able to perform the login operation.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `/auth/alicloud/role/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role. Must correspond with the name of the role reflected in the arn.
-- `arn` `(string: <required>)` - The role's arn.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "arn": "acs:ram::5138828231865461:role/dev-role",
-  "policies": ["dev", "prod"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/alicloud/role/dev-role
-```
-
-## Read role
-
-Returns the previously registered role configuration.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `GET`  | `/auth/alicloud/role/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/alicloud/role/dev-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "arn": "acs:ram::5138828231865461:role/dev-role",
-    "policies": ["default", "dev", "prod"],
-    "ttl": 1800000,
-    "max_ttl": 1800000,
-    "period": 0
-  }
-}
-```
-
-## List roles
-
-Lists all the roles that are registered with the method.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `LIST` | `/auth/alicloud/roles` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/alicloud/roles
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["dev-role", "prod-role"]
-  }
-}
-```
-
-## Delete role
-
-Deletes the previously registered role.
-
-| Method   | Path                        |
-| :------- | :-------------------------- |
-| `DELETE` | `/auth/alicloud/role/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/alicloud/role/dev-role
-```
-
-## Login
-
-Fetch a token. This endpoint verifies the signature of the signed
-GetCallerIdentity request.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/auth/alicloud/login` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role.
-- `identity_request_url` `(string: <required>)` - Base64-encoded HTTP URL used in
-  the signed request.
-- `identity_request_headers` `(string: <required>)` - Base64-encoded,
-  JSON-serialized representation of the sts:GetCallerIdentity HTTP request
-  headers. The JSON serialization assumes that each header key maps to either a
-  string value or an array of string values (though the length of that array
-  will probably only be one).
-
-### Sample payload
-
-```json
-{
-  "role": "dev-role",
-  "identity_request_url": "aWRlbnRpdHlabrVxdWVzdF91cmw=",
-  "identity_request_headers": "aWRlimRpdHlfcmVxdWVzdF9oZWFkZXJz"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/alicloud/login
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "renewable": true,
-    "lease_duration": 1800000,
-    "metadata": {
-      "role_tag_max_ttl": "0",
-      "instance_id": "i-de0f1344",
-      "ami_id": "ami-fce36983",
-      "role": "dev-role",
-      "auth_type": "ec2",
-      "account_id": "5138828231865461",
-      "user_id": "216959339000654321",
-      "role_id": "4657-abcd",
-      "arn": "acs:ram::5138828231865461:assumed-role/dev-role/vm-ram-i-rj978rorvlg76urhqh7q",
-      "identity_type": "assumed-role",
-      "principal_id": "vm-ram-i-rj978rorvlg76urhqh7q",
-      "request_id": "D6E46F10-F26C-4AA0-BB69-FE2743D9AE62",
-      "role_name": "dev-role"
-    },
-    "policies": ["default", "dev"],
-    "accessor": "20b89871-e6f2-1160-fb29-31c2f6d4645e",
-    "client_token": "d9368254-3f21-aded-8a6f-7c818e81b17a"
-  }
-}
-```
diff --git a/website/content/api-docs/auth/approle.mdx b/website/content/api-docs/auth/approle.mdx
deleted file mode 100644
index cc731a55029..00000000000
--- a/website/content/api-docs/auth/approle.mdx
+++ /dev/null
@@ -1,731 +0,0 @@
----
-layout: api
-page_title: AppRole - Auth Methods - HTTP API
-description: This is the API documentation for the Vault AppRole auth method.
----
-
-# AppRole auth method (API)
-
-This is the API documentation for the Vault AppRole auth method. For
-general information about the usage and operation of the AppRole method, please
-see the [Vault AppRole method documentation](/vault/docs/auth/approle).
-
-This documentation assumes the AppRole method is mounted at the `/auth/approle`
-path in Vault. Since it is possible to enable auth methods at any location,
-please update your API calls accordingly.
-
-## List roles
-
-This endpoint returns a list the existing AppRoles in the method.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `LIST` | `/auth/approle/role` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/approle/role
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": ["dev", "prod", "test"]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Create/Update AppRole
-
-Creates a new AppRole or updates an existing AppRole. This endpoint
-supports both `create` and `update` capabilities. There can be one or more
-constraints enabled on the role. It is required to have at least one of them
-enabled while creating or updating a role.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `POST` | `/auth/approle/role/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes, accepted characters 
-include a-Z, 0-9, space, hyphen, underscore and periods.
-- `bind_secret_id` `(bool: true)` - Require `secret_id` to be presented when
-  logging in using this AppRole.
-- `secret_id_bound_cidrs` `(array: [])` - Comma-separated string or list of CIDR
-  blocks; if set, specifies blocks of IP addresses which can perform the login
-  operation.
-- `secret_id_num_uses` `(integer: 0)` - Number of times any particular SecretID
-  can be used to fetch a token from this AppRole, after which the SecretID by default
-  will expire. A value of zero will allow unlimited uses.
-  However, this option may be overridden by the request's 'num_uses' field when generating a SecretID.
-- `secret_id_ttl` `(string: "")` - Duration in either an integer number of
-  seconds (`3600`) or an integer time unit (`60m`) after which by default any SecretID
-  expires. A value of zero will allow the SecretID to not expire.
-  However, this option may be overridden by the request's 'ttl' field when generating a SecretID.
-- `local_secret_ids` `(bool: false)` - If set, the secret IDs generated
-  using this role will be cluster local. This can only be set during role
-  creation and once set, it can't be reset later.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "token_ttl": "10m",
-  "token_max_ttl": "15m",
-  "token_policies": ["default"],
-  "period": 0,
-  "bind_secret_id": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1
-```
-
-## Read AppRole
-
-Reads the properties of an existing AppRole.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `GET`  | `/auth/approle/role/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "token_ttl": 1200,
-    "token_max_ttl": 1800,
-    "secret_id_ttl": 600,
-    "secret_id_num_uses": 40,
-    "token_policies": ["default"],
-    "period": 0,
-    "bind_secret_id": true,
-    "secret_id_bound_cidrs": []
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Delete AppRole
-
-Deletes an existing AppRole from the method.
-
-| Method   | Path                            |
-| :------- | :------------------------------ |
-| `DELETE` | `/auth/approle/role/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1
-```
-
-## Read AppRole role ID
-
-Reads the RoleID of an existing AppRole.
-
-| Method | Path                                    |
-| :----- | :-------------------------------------- |
-| `GET`  | `/auth/approle/role/:role_name/role-id` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1/role-id
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "role_id": "e5a7b66e-5d08-da9c-7075-71984634b882"
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Update AppRole role ID
-
-Updates the RoleID of an existing AppRole to a custom value.
-
-| Method | Path                                    |
-| :----- | :-------------------------------------- |
-| `POST` | `/auth/approle/role/:role_name/role-id` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-- `role_id` `(string: <required>)` - Value to be set as RoleID.
-
-### Sample payload
-
-```json
-{
-  "role_id": "custom-role-id"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1/role-id
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "role_id": "e5a7b66e-5d08-da9c-7075-71984634b882"
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Generate new secret ID
-
-Generates and issues a new SecretID on an existing AppRole. Similar to
-tokens, the response will also contain a `secret_id_accessor` value which can
-be used to read the properties of the SecretID without divulging the SecretID
-itself, and also to delete the SecretID from the AppRole.
-
-| Method | Path                                      |
-| :----- | :---------------------------------------- |
-| `POST` | `/auth/approle/role/:role_name/secret-id` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-- `metadata` `(string: "")` - Metadata to be tied to the SecretID. This should be
-  a JSON-formatted string containing the metadata in key-value pairs. This
-  metadata will be set on tokens issued with this SecretID, and is logged in
-  audit logs _in plaintext_.
-- `cidr_list` `(array: [])` - Comma separated string or list of CIDR blocks
-  enforcing secret IDs to be used from specific set of IP addresses. If
-  `secret_id_bound_cidrs` is set on the role, then the list of CIDR blocks listed
-  here should be a subset of the CIDR blocks listed on the role.
-- `token_bound_cidrs` `(array: [])` - Comma-separated string or list of CIDR
-  blocks; if set, specifies blocks of IP addresses which can use the auth tokens
-  generated by this SecretID. Overrides any role-set value but must be a subset.
-- `num_uses` `(integer: 0)` - Number of times this SecretID can be used, after which
-  the SecretID expires. A value of zero will allow unlimited uses.
-  Overrides secret_id_num_uses role option when supplied.
-  May not be higher than role's secret_id_num_uses.
-- `ttl` `(string: "")` - Duration in seconds (`3600`) or an integer time unit (`60m`)
-  after which this SecretID expires. A value of zero will allow the SecretID to not expire.
-  Overrides secret_id_ttl role option when supplied.
-  May not be longer than role's secret_id_ttl.
-
-### Sample payload
-
-```json
-{
-  "metadata": "{ \"tag1\": \"production\" }",
-  "ttl": 600,
-  "num_uses": 50
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1/secret-id
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "secret_id_accessor": "84896a0c-1347-aa90-a4f6-aca8b7558780",
-    "secret_id": "841771dc-11c9-bbc7-bcac-6a3945a69cd9",
-    "secret_id_ttl": 600,
-    "secret_id_num_uses": 50
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## List secret ID accessors
-
-Lists the accessors of all the SecretIDs issued against the AppRole.
-This includes the accessors for "custom" SecretIDs as well.
-
-| Method | Path                                      |
-| :----- | :---------------------------------------- |
-| `LIST` | `/auth/approle/role/:role_name/secret-id` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1/secret-id
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": [
-      "ce102d2a-8253-c437-bf9a-aceed4241491",
-      "a1c8dee4-b869-e68d-3520-2040c1a0849a",
-      "be83b7e2-044c-7244-07e1-47560ca1c787",
-      "84896a0c-1347-aa90-a4f6-aca8b7558780",
-      "239b1328-6523-15e7-403a-a48038cdc45a"
-    ]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Read AppRole secret ID
-
-Reads out the properties of a SecretID.
-
-| Method | Path                                             |
-| :----- | :----------------------------------------------- |
-| `POST` | `/auth/approle/role/:role_name/secret-id/lookup` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-- `secret_id` `(string: <required>)` - Secret ID attached to the role.
-
-### Sample payload
-
-```json
-{
-  "secret_id": "84896a0c-1347-aa90-a4f6-aca8b7558780"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1/secret-id/lookup
-```
-
-### Sample Response
-
-```json
-{
-  "request_id": "74752925-f309-6859-3d2d-0fcded95150e",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "cidr_list": [],
-    "creation_time": "2023-02-10T18:17:27.089757383Z",
-    "expiration_time": "0001-01-01T00:00:00Z",
-    "last_updated_time": "2023-02-10T18:17:27.089757383Z",
-    "metadata": {
-      "tag1": "production"
-    },
-    "secret_id_accessor": "2be760a4-86bb-2fa9-1637-1b7fa9ba2896",
-    "secret_id_num_uses": 0,
-    "secret_id_ttl": 0,
-    "token_bound_cidrs": []
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Destroy AppRole Secret ID
-
-Destroy an AppRole secret ID.
-
-| Method | Path                                              |
-| :----- | :------------------------------------------------ |
-| `POST` | `/auth/approle/role/:role_name/secret-id/destroy` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-- `secret_id` `(string: <required>)` - Secret ID attached to the role.
-
-### Sample payload
-
-```json
-{
-  "secret_id": "84896a0c-1347-aa90-a4f6-aca8b7558780"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1/secret-id/destroy
-```
-
-## Read AppRole secret ID accessor
-
-Reads out the properties of a SecretID.
-
-| Method | Path                                                      |
-| :----- | :-------------------------------------------------------- |
-| `POST` | `/auth/approle/role/:role_name/secret-id-accessor/lookup` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-- `secret_id_accessor` `(string: <required>)` - Secret ID accessor attached to the role.
-
-### Sample payload
-
-```json
-{
-  "secret_id_accessor": "84896a0c-1347-aa90-a4f6-aca8b7558780"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1/secret-id-accessor/lookup
-```
-
-### Sample Response
-
-```json
-{
-  "request_id": "72836cd1-139c-fe66-1402-8bb5ca4044b8",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "cidr_list": [],
-    "creation_time": "2023-02-10T18:17:27.089757383Z",
-    "expiration_time": "0001-01-01T00:00:00Z",
-    "last_updated_time": "2023-02-10T18:17:27.089757383Z",
-    "metadata": {
-      "tag1": "production"
-    },
-    "secret_id_accessor": "2be760a4-86bb-2fa9-1637-1b7fa9ba2896",
-    "secret_id_num_uses": 0,
-    "secret_id_ttl": 0,
-    "token_bound_cidrs": []
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Destroy AppRole Secret ID Accessor
-
-Destroy an AppRole secret ID by its accessor.
-
-| Method | Path                                                       |
-| :----- | :--------------------------------------------------------- |
-| `POST` | `/auth/approle/role/:role_name/secret-id-accessor/destroy` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-- `secret_id_accessor` `(string: <required>)` - Secret ID accessor attached to the role.
-
-### Sample payload
-
-```json
-{
-  "secret_id_accessor": "84896a0c-1347-aa90-a4f6-aca8b7558780"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1/secret-id-accessor/destroy
-```
-
-## Create custom AppRole secret ID
-
-Assigns a "custom" SecretID against an existing AppRole. This is used in the
-"Push" model of operation.
-
-| Method | Path                                             |
-| :----- | :----------------------------------------------- |
-| `POST` | `/auth/approle/role/:role_name/custom-secret-id` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - Name of the AppRole. Must be less than 4096 bytes.
-- `secret_id` `(string: <required>)` - SecretID to be attached to the Role.
-- `metadata` `(string: "")` - Metadata to be tied to the SecretID. This should be
-  a JSON-formatted string containing the metadata in key-value pairs. This
-  metadata will be set on tokens issued with this SecretID, and is logged in
-  audit logs _in plaintext_.
-- `cidr_list` `(array: [])` - Comma separated string or list of CIDR blocks
-  enforcing secret IDs to be used from specific set of IP addresses. If
-  `secret_id_bound_cidrs` is set on the role, then the list of CIDR blocks listed
-  here should be a subset of the CIDR blocks listed on the role.
-- `token_bound_cidrs` `(array: [])` - Comma-separated string or list of CIDR
-  blocks; if set, specifies blocks of IP addresses which can use the auth tokens
-  generated by this SecretID. Overrides any role-set value but must be a subset.
-- `num_uses` `(integer: 0)` - Number of times this SecretID can be used, after which
-  the SecretID expires. A value of zero will allow unlimited uses.
-  Overrides secret_id_num_uses role option when supplied.
-  May not be higher than role's secret_id_num_uses.
-- `ttl` `(string: "")` - Duration in seconds (`3600`) or an integer time unit (`60m`)
-  after which this SecretID expires. A value of zero will allow the SecretID to not expire.
-  Overrides secret_id_ttl role option when supplied.
-  May not be longer than role's secret_id_ttl.
-
-### Sample payload
-
-```json
-{
-  "secret_id": "testsecretid",
-  "ttl": 600,
-  "num_uses": 50
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/approle/role/application1/custom-secret-id
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "secret_id": "testsecretid",
-    "secret_id_accessor": "84896a0c-1347-aa90-a4f6-aca8b7558780",
-    "secret_id_ttl": 600,
-    "secret_id_num_uses": 50
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Login with AppRole
-
-Issues a Vault token based on the presented credentials. `role_id` is always
-required; if `bind_secret_id` is enabled (the default) on the AppRole,
-`secret_id` is required too. Any other bound authentication values on the
-AppRole (such as client IP CIDR) are also evaluated.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `POST` | `/auth/approle/login` |
-
-### Parameters
-
-- `role_id` `(string: <required>)` - RoleID of the AppRole.
-- `secret_id` `(string: <required>)` - SecretID belonging to AppRole.
-
-### Sample payload
-
-```json
-{
-  "role_id": "59d6d1ca-47bb-4e7e-a40b-8be3bc5a0ba8",
-  "secret_id": "84896a0c-1347-aa90-a4f6-aca8b7558780"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/approle/login
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "renewable": true,
-    "lease_duration": 1200,
-    "metadata": null,
-    "token_policies": ["default"],
-    "accessor": "fd6c9a00-d2dc-3b11-0be5-af7ae0e1d374",
-    "client_token": "5b1a0318-679c-9c45-e5c6-d1b9a9035d49"
-  },
-  "warnings": null,
-  "wrap_info": null,
-  "data": null,
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Read, update, or delete AppRole properties
-
-Updates the respective property in the existing AppRole. All of these
-parameters of the AppRole can be updated using the `/auth/approle/role/:role_name`
-endpoint directly. The endpoints for each field is provided separately
-to be able to delegate specific endpoints using Vault's ACL system.
-
-| Method            | Path                                                  |
-| :---------------- | :---------------------------------------------------- | --------- |
-| `GET/POST/DELETE` | `/auth/approle/role/:role_name/policies`              | `200/204` |
-| `GET/POST/DELETE` | `/auth/approle/role/:role_name/secret-id-num-uses`    | `200/204` |
-| `GET/POST/DELETE` | `/auth/approle/role/:role_name/secret-id-ttl`         | `200/204` |
-| `GET/POST/DELETE` | `/auth/approle/role/:role_name/token-ttl`             | `200/204` |
-| `GET/POST/DELETE` | `/auth/approle/role/:role_name/token-max-ttl`         | `200/204` |
-| `GET/POST/DELETE` | `/auth/approle/role/:role_name/bind-secret-id`        | `200/204` |
-| `GET/POST/DELETE` | `/auth/approle/role/:role_name/secret-id-bound-cidrs` | `200/204` |
-| `GET/POST/DELETE` | `/auth/approle/role/:role_name/token-bound-cidrs`     | `200/204` |
-| `GET/POST/DELETE` | `/auth/approle/role/:role_name/period`                | `200/204` |
-
-Refer to `/auth/approle/role/:role_name` endpoint.
-
-## Tidy tokens
-
-Performs some maintenance tasks to clean up invalid entries that may remain
-in the token store. Generally, running this is not needed unless upgrade
-notes or support personnel suggest it. This may perform a lot of I/O to the
-storage method so should be used sparingly.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/auth/approle/tidy/secret-id` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/auth/approle/tidy/secret-id
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "b20b56e3-4699-5b19-cc6b-e74f7b787bbf",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": null,
-  "wrap_info": null,
-  "warnings": [
-    "Tidy operation successfully started. Any information from the operation will be printed to Vault's server logs."
-  ],
-  "auth": null
-}
-```
diff --git a/website/content/api-docs/auth/aws.mdx b/website/content/api-docs/auth/aws.mdx
deleted file mode 100644
index 4b35e554b70..00000000000
--- a/website/content/api-docs/auth/aws.mdx
+++ /dev/null
@@ -1,1404 +0,0 @@
----
-layout: api
-page_title: AWS - Auth Methods - HTTP API
-description: This is the API documentation for the Vault AWS auth method.
----
-
-# AWS auth method (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-@include 'aws-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault AWS auth method. For
-general information about the usage and operation of the AWS method, please
-see the [Vault AWS method documentation](/vault/docs/auth/aws).
-
-This documentation assumes the AWS method is mounted at the `/auth/aws`
-path in Vault. Since it is possible to enable auth methods at any location,
-please update your API calls accordingly.
-
-~> **Vault 1.7** deprecated several AWS Auth URLs. The full
-[list of affected endpoints](#deprecations-effective-in-vault-1-7) and their
-replacements is provided at the end of this document.
-
-## Configure client
-
-Configures the credentials required to perform API calls to AWS as well as
-custom endpoints to talk to AWS APIs. The instance identity document
-fetched from the PKCS#7 signature will provide the EC2 instance ID. The
-credentials configured using this endpoint will be used to query the status
-of the instances via DescribeInstances API. If static credentials are not
-provided using this endpoint, then the credentials will be retrieved from
-the environment variables `AWS_ACCESS_KEY`, `AWS_SECRET_KEY` and
-`AWS_REGION` respectively. If the credentials are still not found and if the
-method is configured on an EC2 instance with metadata querying
-capabilities, the credentials are fetched automatically.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/auth/aws/config/client` |
-
-### Parameters
-
-- `max_retries` `(int: -1)` - Number of max retries the client should use for
-  recoverable errors. The default (`-1`) falls back to the AWS SDK's default
-  behavior.
-- `access_key` `(string: "")` - AWS Access key with permissions to query AWS
-  APIs. The permissions required depend on the specific configurations. If using
-  the `iam` auth method without inferencing, then no credentials are necessary.
-  If using the `ec2` auth method or using the `iam` auth method with
-  inferencing, then these credentials need access to `ec2:DescribeInstances`. If
-  additionally a `bound_iam_role` is specified, then these credentials also need
-  access to `iam:GetInstanceProfile`. If, however, an alternate sts
-  configuration is set for the target account, then the credentials must be
-  permissioned to call `sts:AssumeRole` on the configured role, and that role
-  must have the permissions described here.
-- `secret_key` `(string: "")` - AWS Secret key with permissions to query AWS
-  APIs.
-- `endpoint` `(string: "")` - URL to override the default generated endpoint for
-  making AWS EC2 API calls.
-- `iam_endpoint` `(string: "")` - URL to override the default generated endpoint
-  for making AWS IAM API calls.
-- `sts_endpoint` `(string: "")` - URL to override the default generated endpoint
-  for making AWS STS API calls. If set, `sts_region` should also be set.
-- `sts_region` `(string: "")` - Region to override the default region for making
-  AWS STS API calls. Should only be set if `sts_endpoint` is set. If so, should
-  be set to the region in which the custom `sts_endpoint` resides.
-- `use_sts_region_from_client` `(boolean: false)` - If set, overrides both `sts_endpoint`
-  and `sts_region` to instead use the region specified in the client request headers for
-  IAM-based authentication . This can be useful when you have client requests coming from
-  different regions and want flexibility in which regional STS API is used.
-- `iam_server_id_header_value` `(string: "")` - The value to require in the
-  `X-Vault-AWS-IAM-Server-ID` header as part of GetCallerIdentity requests that
-  are used in the iam auth method. If not set, then no value is required or
-  validated. If set, clients must include an X-Vault-AWS-IAM-Server-ID header in
-  the headers of login requests, and further this header must be among the
-  signed headers validated by AWS. This is to protect against different types of
-  replay attacks, for example a signed request sent to a dev server being resent
-  to a production server. Consider setting this to the Vault server's DNS name.
-- `allowed_sts_header_values` `(string: "")` A comma separated list of
-  additional request headers permitted when providing the iam_request_headers for
-  an IAM based login call. In any case, a default list of headers AWS STS
-  expects for a GetCallerIdentity are allowed.
-
-### Sample payload
-
-```json
-{
-  "access_key": "VKIAJBRHKH6EVTTNXDHA",
-  "secret_key": "vCtSM8ZUEQ3mOFVlYPBQkf2sO6F/W7a5TVzrl3Oj"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/aws/config/client
-```
-
-## Read config
-
-Returns the previously configured AWS access credentials.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/auth/aws/config/client` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/aws/config/client
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "access_key": "VKIAJBRHKH6EVTTNXDHA",
-    "endpoint": "",
-    "iam_endpoint": "",
-    "sts_endpoint": "",
-    "sts_region": "",
-    "use_sts_region_from_client": false,
-    "iam_server_id_header_value": ""
-  }
-}
-```
-
-## Delete config
-
-Deletes the previously configured AWS access credentials.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/auth/aws/config/client` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/aws/config/client
-```
-
-## Rotate root credentials
-
-When you have configured Vault with static credentials, you can use this
-endpoint to have Vault rotate the access key it used. Note that, due to AWS
-eventual consistency, after calling this endpoint, subsequent calls from Vault
-to AWS may fail for a few seconds until AWS becomes consistent again.
-
-In order to call this endpoint, Vault's AWS access key MUST be the only access
-key on the IAM user; otherwise, generation of a new access key will fail. Once
-this method is called, Vault will now be the only entity that knows the AWS
-secret key is used to access AWS.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/auth/aws/config/rotate-root` |
-
-### Parameters
-
-There are no parameters to this operation.
-
-### Sample request
-
-```$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/auth/aws/config/rotate-root
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "access_key": "AKIA..."
-  }
-}
-```
-
-The new access key Vault uses is returned by this operation.
-
-## Configure identity integration
-
-This configures the way that Vault interacts with the
-[Identity](/vault/docs/secrets/identity) store. The default (as of Vault
-1.0.3) is `role_id` for both values.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `/auth/aws/config/identity` |
-
-### Parameters
-
-- `iam_alias` `(string: "role_id")` - How to generate the identity alias when
-  using the `iam` auth method. Valid choices are `role_id`, `unique_id`, and
-  `full_arn` When `role_id` is selected, the randomly generated ID of the role
-  is used. When `unique_id` is selected, the [IAM Unique
-  ID](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers#identifiers-unique-ids)
-  of the IAM principal (either the user or role) is used as the identity alias
-  name. When `full_arn` is selected, the ARN returned by the
-  `sts:GetCallerIdentity` call is used as the alias name. This is either
-  `arn:aws:iam::<account_id>:user/<optional_path/><user_name>` or
-  `arn:aws:sts::<account_id>:assumed-role/<role_name_without_path>/<role_session_name>`.
-  **Note**: if you select `full_arn` and then delete and recreate the IAM role,
-  Vault won't be aware and any identity aliases set up for the role name will
-  still be valid.
-
-- `iam_metadata` `(string: "default")` - The metadata to include on the token
-  returned by the `login` endpoint. This metadata will be added to both audit logs,
-  and on the `iam_alias`. By default, it includes `account_id` and `auth_type`.
-  Additionally, `canonical_arn`, `client_arn`, `client_user_id`, `inferred_aws_region`,
-  `inferred_entity_id`, and `inferred_entity_type` are available. To include no metadata,
-  set to `""` via the CLI or `[]` via the API. To use only particular fields, select
-  the explicit fields. To restore to defaults, send only a field of `default`.
-  **Only select fields that will have a low rate of change** for your `iam_alias` because
-  each change triggers a storage write and can have a performance impact at scale.
-
-- `ec2_alias` `(string: "role_id")` - Configures how to generate the identity
-  alias when using the `ec2` auth method. Valid choices are `role_id`,
-  `instance_id`, and `image_id`. When `role_id` is selected, the randomly
-  generated ID of the role is used. When `instance_id` is selected, the
-  instance identifier is used as the identity alias name. When `image_id` is
-  selected, AMI ID of the instance is used as the identity alias name.
-
-- `ec2_metadata` `(string: "default")` - The metadata to include on the token
-  returned by the `login` endpoint. This metadata will be added to both audit logs,
-  and on the `ec2_alias`. By default, it includes `account_id` and `auth_type`.
-  Additionally, `ami_id`, `instance_id`, and `region`, are available. To include no metadata,
-  set to `""` via the CLI or `[]` via the API. To use only particular fields, select
-  the explicit fields. To restore to defaults, send only a field of `default`.
-  **Only select fields that will have a low rate of change** for your `ec2_alias` because
-  each change triggers a storage write and can have a performance impact at scale.
-
-### Sample payload
-
-```json
-{
-  "iam_alias": "unique_id"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    -- header "X-Vault-Token:..." \
-    --request POST
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/aws/config/identity
-```
-
-## Read identity integration configuration
-
-Returns the previously configured Identity integration configuration
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `GET`  | `/auth/aws/config/identity` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token:..." \
-    http://127.0.0.1:8200/v1/auth/aws/config/identity
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "iam_alias": "full_arn"
-  }
-}
-```
-
-## Create certificate configuration
-
-Registers an AWS public key to be used to verify the instance identity
-documents. Indicate the type of the public key using the `type` parameter.
-Vault has the default
-[documented](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html)
-set of AWS certificates built-in.
-
-The `pkcs7` type is used to verify PKCS#7 signatures from the AWS
-`http://169.254.169.254/latest/dynamic/instance-identity/pkcs7` and
-`http://169.254.169.254/latest/dynamic/instance-identity/rsa2048` endpoints.
-
-The `identity` type is used to verify signatures from the
-`http://169.254.169.254/latest/dynamic/instance-identity/document` and
-`http://169.254.169.254/latest/dynamic/instance-identity/signature` endpoints.
-
-See the [AWS docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html)
-for more information on the signature types and the corresponding certificates.
-
-| Method | Path                                      |
-| :----- | :---------------------------------------- |
-| `POST` | `/auth/aws/config/certificate/:cert_name` |
-
-### Parameters
-
-- `cert_name` `(string: <required>)` - Name of the certificate.
-- `aws_public_cert` `(string: <required>)` - Base64-encoded AWS Public key required to verify
-  PKCS#7 signature of the EC2 instance metadata.
-- `type` `(string: "pkcs7")` - Takes the value of either "pkcs7" or "identity",
-  indicating the type of document which can be verified using the given
-  certificate. The PKCS#7 document can be a DSA digest from the
-  [/pkcs7](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-pkcs7.html)
-  endpoint or an RSA-2048 signature from the
-  [/rsa2048](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-rsa2048.html)
-  endpoint.
-  The identity signature is used to validate RSA signatures from the
-  [/signature](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-signature.html)
-  endpoint. Defaults to "pkcs7".
-
-### Sample payload
-
-```json
-{
-  "aws_public_cert": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM3VENDQXEwQ0NRQ1d1a2paNVY0YVp6QUpCZ2NxaGtqT09BUURNRnd4Q3pBSkJnTlZCQVlUQWxWVE1Sa3cKRndZRFZRUUlFeEJYWVhOb2FXNW5kRzl1SUZOMFlYUmxNUkF3RGdZRFZRUUhFd2RUWldGMGRHeGxNU0F3SGdZRApWUVFLRXhkQmJXRjZiMjRnVjJWaUlGTmxjblpwWTJWeklFeE1RekFlRncweE1qQXhNRFV4TWpVMk1USmFGdzB6Ck9EQXhNRFV4TWpVMk1USmFNRnd4Q3pBSkJnTlZCQVlUQWxWVE1Sa3dGd1lEVlFRSUV4QlhZWE5vYVc1bmRHOXUKSUZOMFlYUmxNUkF3RGdZRFZRUUhFd2RUWldGMGRHeGxNU0F3SGdZRFZRUUtFeGRCYldGNmIyNGdWMlZpSUZObApjblpwWTJWeklFeE1RekNDQWJjd2dnRXNCZ2NxaGtqT09BUUJNSUlCSHdLQmdRQ2prdmNTMmJiMVZRNHl0LzVlCmloNU9PNmtLL24xTHpsbHI3RDhad3RRUDhmT0VwcDVFMm5nK0Q2VWQxWjFnWWlwcjU4S2ozbnNzU05wSTZiWDMKVnlJUXpLN3dMY2xuZC9Zb3pxTk5tZ0l5WmVjTjdFZ2xLOUlUSEpMUCt4OEZ0VXB0M1FieVlYSmRtVk1lZ042UApodmlZdDVKSC9uWWw0aGgzUGExSEpkc2tnUUlWQUxWSjNFUjExK0tvNHRQNm53dkh3aDYrRVJZUkFvR0JBSTFqCmsrdGtxTVZIdUFGY3ZBR0tvY1Rnc2pKZW02LzVxb216SnVLRG1iSk51OVF4dzNyQW90WGF1OFFlK01CY0psL1UKaGh5MUtIVnBDR2w5ZnVlUTJzNklMMENhTy9idXljVTFDaVlRazQwS05IQ2NIZk5pWmJkbHgxRTlycFVwN2JuRgpsUmEydjFudE1YM2NhUlZEZGJ0UEVXbWR4U0NZc1lGRGs0bVpyT0xCQTRHRUFBS0JnRWJtZXZlNWY4TElFL0dmCk1ObVA5Q001ZW92UU9HeDVobzhXcUQrYVRlYnMrazJ0bjkyQkJQcWVacXBXUmE1UC8ranJkS21sMXF4NGxsSFcKTVhyczNJZ0liNitoVUlCK1M4ZHo4L21tTzBicHI3NlJvWlZDWFlhYjJDWmVkRnV0N3FjM1dVSDkrRVVBSDVtdwp2U2VEQ09VTVlRUjdSOUxJTll3b3VISXppcVFZTUFrR0J5cUdTTTQ0QkFNREx3QXdMQUlVV1hCbGs0MHhUd1N3CjdIWDMyTXhYWXJ1c2U5QUNGQk5HbWRYMlpCclZOR3JOOU4yZjZST2swazlLCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/aws/config/certificate/test-cert
-```
-
-## Read certificate configuration
-
-Returns the previously configured AWS public key.
-
-| Method | Path                                      |
-| :----- | :---------------------------------------- |
-| `GET`  | `/auth/aws/config/certificate/:cert_name` |
-
-### Parameters
-
-- `cert_name` `(string: <required>)` - Name of the certificate.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/aws/config/certificate/test-cert
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "aws_public_cert": "-----BEGIN CERTIFICATE-----\nMIIC7TCCAq0CCQCWukjZ5V4aZzAJBgcqhkjOOAQDMFwxCzAJBgNVBAYTAlVTMRkw\nFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYD\nVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAeFw0xMjAxMDUxMjU2MTJaFw0z\nODAxMDUxMjU2MTJaMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9u\nIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNl\ncnZpY2VzIExMQzCCAbcwggEsBgcqhkjOOAQBMIIBHwKBgQCjkvcS2bb1VQ4yt/5e\nih5OO6kK/n1Lzllr7D8ZwtQP8fOEpp5E2ng+D6Ud1Z1gYipr58Kj3nssSNpI6bX3\nVyIQzK7wLclnd/YozqNNmgIyZecN7EglK9ITHJLP+x8FtUpt3QbyYXJdmVMegN6P\nhviYt5JH/nYl4hh3Pa1HJdskgQIVALVJ3ER11+Ko4tP6nwvHwh6+ERYRAoGBAI1j\nk+tkqMVHuAFcvAGKocTgsjJem6/5qomzJuKDmbJNu9Qxw3rAotXau8Qe+MBcJl/U\nhhy1KHVpCGl9fueQ2s6IL0CaO/buycU1CiYQk40KNHCcHfNiZbdlx1E9rpUp7bnF\nlRa2v1ntMX3caRVDdbtPEWmdxSCYsYFDk4mZrOLBA4GEAAKBgEbmeve5f8LIE/Gf\nMNmP9CM5eovQOGx5ho8WqD+aTebs+k2tn92BBPqeZqpWRa5P/+jrdKml1qx4llHW\nMXrs3IgIb6+hUIB+S8dz8/mmO0bpr76RoZVCXYab2CZedFut7qc3WUH9+EUAH5mw\nvSeDCOUMYQR7R9LINYwouHIziqQYMAkGByqGSM44BAMDLwAwLAIUWXBlk40xTwSw\n7HX32MxXYruse9ACFBNGmdX2ZBrVNGrN9N2f6ROk0k9K\n-----END CERTIFICATE-----\n",
-    "type": "pkcs7"
-  }
-}
-```
-
-## Delete certificate configuration
-
-Removes the previously configured AWS public key.
-
-| Method   | Path                                      |
-| :------- | :---------------------------------------- |
-| `DELETE` | `/auth/aws/config/certificate/:cert_name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/aws/config/certificate/test-cert
-```
-
-## List certificate configurations
-
-Lists all the AWS public certificates that are registered with the method.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `LIST` | `/auth/aws/config/certificates` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/aws/config/certificates
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["cert1"]
-  }
-}
-```
-
-## Create STS role
-
-Allows the explicit association of STS roles to satellite AWS accounts
-(i.e. those which are not the account in which the Vault server is
-running.) Vault will use credentials obtained by assuming these STS roles
-when validating IAM principals or EC2 instances in the particular AWS account.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `POST` | `/auth/aws/config/sts/:account_id` |
-
-### Parameters
-
-- `account_id` `(string: <required>)` - AWS account ID to be associated with
-  STS role. If set, Vault will use assumed credentials to verify any login
-  attempts from EC2 instances in this account.
-- `sts_role` `(string: <required>)` - AWS ARN for STS role to be assumed when
-  interacting with the account specified. The Vault server must have
-  permissions to assume this role.
-
-### Sample payload
-
-```json
-{
-  "sts_role": "arn:aws:iam:111122223333:role/myRole"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/aws/config/sts/111122223333
-```
-
-## Read STS role
-
-Returns the previously configured STS role.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `GET`  | `/auth/aws/config/sts/:account_id` |
-
-### Parameters
-
-- `account_id` `(string: <required>)` - AWS account ID that has been
-  previously associated with STS role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/aws/config/sts/111122223333
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "sts_role ": "arn:aws:iam:111122223333:role/myRole"
-  }
-}
-```
-
-## List STS roles
-
-Lists all the AWS Account IDs for which an STS role is registered.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `LIST` | `/auth/aws/config/sts` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/aws/config/sts
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["111122223333", "999988887777"]
-  }
-}
-```
-
-## Delete STS role
-
-Deletes a previously configured AWS account/STS role association.
-
-| Method   | Path                               |
-| :------- | :--------------------------------- |
-| `DELETE` | `/auth/aws/config/sts/:account_id` |
-
-### Parameters
-
-- `account_id` `(string: <required>)` - AWS account ID that has been
-  previously associated with STS role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/aws/config/sts/111122223333
-```
-
-## Configure identity access list tidy operation
-
-Configures the periodic tidying operation of the access listed identity entries.
-
-| Method | Path                                        |
-| :----- | :------------------------------------------ |
-| `POST` | `/auth/aws/config/tidy/identity-accesslist` |
-
-### Parameters
-
-- `safety_buffer` `(string: "72h")` - The amount of extra time that must have
-  passed beyond the `roletag` expiration, before it is removed from the method
-  storage. Defaults to 72h.
-- `disable_periodic_tidy` `(bool: false)` - If set to 'true', disables the
-  periodic tidying of the `identity-accesslist/<instance_id>` entries.
-
-### Sample payload
-
-```json
-{
-  "safety_buffer": "48h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/aws/config/tidy/identity-accesslist
-```
-
-## Read identity access list tidy settings
-
-Returns the previously configured periodic access list tidying settings.
-
-| Method | Path                                        |
-| :----- | :------------------------------------------ |
-| `GET`  | `/auth/aws/config/tidy/identity-accesslist` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/aws/config/tidy/identity-accesslist
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "safety_buffer": 600,
-    "disable_periodic_tidy": false
-  }
-}
-```
-
-## Delete identity access list tidy settings
-
-Deletes the previously configured periodic access list tidying settings.
-
-| Method   | Path                                        |
-| :------- | :------------------------------------------ |
-| `DELETE` | `/auth/aws/config/tidy/identity-accesslist` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/aws/config/tidy/identity-accesslist
-```
-
-## Configure role tag deny list tidy operation
-
-Configures the periodic tidying operation of the deny listed role tag entries.
-
-| Method | Path                                     |
-| :----- | :--------------------------------------- |
-| `POST` | `/auth/aws/config/tidy/roletag-denylist` |
-
-### Parameters
-
-- `safety_buffer` `(string: "72h")` - The amount of extra time that must have
-  passed beyond the `roletag` expiration, before it is removed from the method
-  storage. Defaults to 72h.
-- `disable_periodic_tidy` `(bool: false)` - If set to 'true', disables the
-  periodic tidying of the `roletag-denylist/<instance_id>` entries.
-
-### Sample payload
-
-```json
-{
-  "safety_buffer": "48h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/aws/config/tidy/roletag-denylist
-```
-
-## Read role tag deny list tidy settings
-
-Returns the previously configured periodic deny list tidying settings.
-
-| Method | Path                                     |
-| :----- | :--------------------------------------- |
-| `GET`  | `/auth/aws/config/tidy/roletag-denylist` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/aws/config/tidy/roletag-denylist
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "safety_buffer": 600,
-    "disable_periodic_tidy": false
-  }
-}
-```
-
-## Delete role tag deny list tidy settings
-
-Deletes the previously configured periodic deny list tidying settings.
-
-| Method   | Path                                     |
-| :------- | :--------------------------------------- |
-| `DELETE` | `/auth/aws/config/tidy/roletag-denylist` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/aws/config/tidy/roletag-denylist
-```
-
-## Create/Update role
-
-Registers a role in the method. Only those instances or principals which
-are using the role registered using this endpoint, will be able to perform
-the login operation. Constraints can be specified on the role, that are
-applied on the instances or principals attempting to login. At least one
-constraint must be specified on the role. The available constraints you
-can choose are dependent on the `auth_type` of the role and, if the
-`auth_type` is `iam`, then whether inferencing is enabled. A role will not
-let you configure a constraint if it is not checked by the `auth_type` and
-inferencing configuration of that role. For the constraints which accept a list
-of values, the authenticating instance/principal must match any one value in the
-list in order to satisfy that constraint.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/auth/aws/role/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role. Vault normalizes all role
-  names to lower case. If you create two roles, "Web-Workers" and "WEB-WORKERS",
-  they will both be normalized to "web-workers" and will be regarded as the same role.
-  This is to prevent unexpected behavior due to casing differences. At all points,
-  Vault can be provided the role in any casing, and it will internally handle
-  sending it to lower case and seeking it inside its storage engine.
-- `auth_type` `(string: "iam")` - The auth type permitted for this role. Valid
-  choices are "ec2" or "iam". If no value is specified, then it will default to
-  "iam" (except for legacy `aws-ec2` auth types, for which it will default to
-  "ec2"). Only those bindings applicable to the auth type chosen will be allowed
-  to be configured on the role.
-- `bound_ami_id` `(list: [])` - If set, defines a constraint on the EC2
-  instances that they should be using one of the AMI ID specified by this parameter.
-  This constraint is checked during ec2 auth as well as the iam auth method only
-  when inferring an EC2 instance. This is a comma-separated string or JSON
-  array.
-- `bound_account_id` `(list: [])` - If set, defines a constraint on the EC2
-  instances that the account ID in its identity document to match one of the ones
-  specified by this parameter. This constraint is checked during ec2 auth as
-  well as the iam auth method only when inferring an EC2 instance. This is a
-  comma-separated string or JSON array.
-- `bound_region` `(list: [])` - If set, defines a constraint on the EC2
-  instances that the region in its identity document must match one of the
-  regions specified by this parameter. This constraint is only checked by the ec2 auth
-  method as well as the iam auth method only when inferring an ec2 instance.
-  This is a comma-separated string or JSON array.
-- `bound_vpc_id` `(list: [])` - If set, defines a constraint on the EC2
-  instance to be associated with a VPC ID that matches one of the values specified by
-  this parameter. This constraint is only checked by the ec2 auth method as well
-  as the iam auth method only when inferring an ec2 instance. This is a
-  comma-separated string or JSON array.
-- `bound_subnet_id` `(list: [])` - If set, defines a constraint on the EC2
-  instance to be associated with a subnet ID that matches one of the values specified
-  by this parameter. This constraint is only checked by the ec2 auth method as
-  well as the iam auth method only when inferring an ec2 instance. This is a
-  comma-separated string or a JSON array.
-- `bound_iam_role_arn` `(list: [])` - If set, defines a constraint on the
-  authenticating EC2 instance that it must match one of the IAM role ARNs specified by
-  this parameter. Wildcards are supported at the end of the ARN to allow for
-  prefix matching. The configured IAM user or EC2 instance role must be allowed to
-  execute the `iam:GetInstanceProfile` action if this is specified. This
-  constraint is checked by the ec2 auth method as well as the iam auth method
-  only when inferring an EC2 instance. This is a comma-separated string or a
-  JSON array.
-- `bound_iam_instance_profile_arn` `(list: [])` - If set, defines a constraint
-  on the EC2 instances to be associated with an IAM instance profile ARN.
-  Wildcards are supported at the end of the ARN to allow for prefix matching.
-  This constraint is
-  checked by the ec2 auth method as well as the iam auth method only when
-  inferring an ec2 instance. This is a comma-separated string or a JSON array.
-- `bound_ec2_instance_id` `(list: [])` - If set, defines a constraint on the
-  EC2 instances to have one of these instance IDs. This constraint is checked by
-  the ec2 auth method as well as the iam auth method only when inferring an ec2
-  instance. This is a comma-separated string or a JSON array.
-- `role_tag` `(string: "")` - If set, enables the role tags for this role. The
-  value set for this field should be the 'key' of the tag on the EC2 instance.
-  The 'value' of the tag should be generated using `role/<role>/tag` endpoint.
-  Defaults to an empty string, meaning that role tags are disabled. This
-  constraint is valid only with the ec2 auth method and is not allowed when
-  `auth_type` is iam.
-- `bound_iam_principal_arn` `(list: [])` - Defines the list of IAM principals
-  that are permitted to login to the role using the iam auth method. Individual
-  values should look like "arn:aws:iam::123456789012:user/MyUserName" or
-  "arn:aws:iam::123456789012:role/MyRoleName". Wildcards are supported at the
-  end of the ARN, e.g., "arn:aws:iam::123456789012:\*" will match any IAM
-  principal in the AWS account 123456789012. When `resolve_aws_unique_ids` is
-  `false` and you are binding to IAM roles (as opposed to users) and you are not
-  using a wildcard at the end, then you must specify the ARN by omitting any
-  path component; see the documentation for `resolve_aws_unique_ids` below.
-  This constraint is only checked by
-  the iam auth method. Wildcards are supported at the end of the ARN, e.g.,
-  "arn:aws:iam::123456789012:role/\*" will match all roles in the AWS account.
-  This is a comma-separated string or JSON array.
-- `inferred_entity_type` `(string: "")` - When set, instructs Vault to turn on
-  inferencing. The only current valid value is "ec2_instance" instructing Vault
-  to infer that the role comes from an EC2 instance in an IAM instance profile.
-  This only applies to the iam auth method. If you set this on an existing role
-  where it had not previously been set, tokens that had been created prior will
-  not be renewable; clients will need to get a new token.
-- `inferred_aws_region` `(string: "")` - When role inferencing is activated, the
-  region to search for the inferred entities (e.g., EC2 instances). Required if
-  role inferencing is activated. This only applies to the iam auth method.
-- `resolve_aws_unique_ids` `(bool: true)` - When set, resolves the
-  `bound_iam_principal_arn` to the
-  [AWS Unique ID](http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers#identifiers-unique-ids)
-  for the bound principal ARN. This field is ignored when
-  `bound_iam_principal_arn` ends with a wildcard character.
-  This requires Vault to be able to call `iam:GetUser` or `iam:GetRole` on the
-  `bound_iam_principal_arn` that is being bound. Resolving to internal AWS IDs
-  more closely mimics the behavior of AWS services in that if an IAM user or
-  role is deleted and a new one is recreated with the same name, those new users
-  or roles won't get access to roles in Vault that were permissioned to the
-  prior principals of the same name. The default value for new roles is true,
-  while the default value for roles that existed prior to this option existing
-  is false (you can check the value for a given role using the GET method on the
-  role). Any authentication tokens created prior to this being supported won't
-  verify the unique ID upon token renewal. When this is changed from false to
-  true on an existing role, Vault will attempt to resolve the role's bound IAM
-  ARN to the unique ID and, if unable to do so, will fail to enable this option.
-  Changing this from `true` to `false` is not supported; if absolutely
-  necessary, you would need to delete the role and recreate it explicitly
-  setting it to `false`. However; the instances in which you would want to do
-  this should be rare. If the role creation (or upgrading to use this) succeed,
-  then Vault has already been able to resolve internal IDs, and it doesn't need
-  any further IAM permissions to authenticate users. If a role has been deleted
-  and recreated, and Vault has cached the old unique ID, you should just call
-  this endpoint specifying the same `bound_iam_principal_arn` and, as long as
-  Vault still has the necessary IAM permissions to resolve the unique ID, Vault
-  will update the unique ID. (If it does not have the necessary permissions to
-  resolve the unique ID, then it will fail to update.) If this option is set to
-  false, then you MUST leave out the path component in `bound_iam_principal_arn`
-  for **roles** that do not specify a wildcard at the end, but not IAM users or
-  role bindings that have a wildcard. That is, if your IAM role ARN is of the
-  form `arn:aws:iam::123456789012:role/some/path/to/MyRoleName`, and
-  `resolve_aws_unique_ids` is `false`, you **must** specify a
-  `bound_iam_principal_arn` of `arn:aws:iam::123456789012:role/MyRoleName` for
-  authentication to work.
-- `allow_instance_migration` `(bool: false)` - If set, allows migration of the
-  underlying instance where the client resides. This keys off of pendingTime in
-  the metadata document, so essentially, this disables the client nonce check
-  whenever the instance is migrated to a new host and pendingTime is newer than
-  the previously-remembered time. Use with caution. This only applies to
-  authentications via the ec2 auth method. This is mutually exclusive with
-  `disallow_reauthentication`.
-- `disallow_reauthentication` `(bool: false)` - If set, only allows a single
-  token to be granted per instance ID. In order to perform a fresh login, the
-  entry in the access list for the instance ID needs to be cleared using
-  `auth/aws/identity-accesslist/<instance_id>` endpoint. Defaults to 'false'.
-  This only applies to authentications via the ec2 auth method. This is mutually
-  exclusive with `allow_instance_migration`.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "bound_ami_id": ["ami-fce36987"],
-  "bound_ec2_instance_id": ["i-12345678901234567"],
-  "role_tag": "",
-  "policies": ["default", "dev", "prod"],
-  "max_ttl": 1800000,
-  "disallow_reauthentication": false,
-  "allow_instance_migration": false
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/aws/role/dev-role
-```
-
-## Read role
-
-Returns the previously registered role configuration.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/auth/aws/role/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/aws/role/dev-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "bound_ami_id": ["ami-fce36987"],
-    "role_tag": "",
-    "policies": ["default", "dev", "prod"],
-    "max_ttl": 1800000,
-    "disallow_reauthentication": false,
-    "allow_instance_migration": false
-  }
-}
-```
-
-## List roles
-
-Lists all the roles that are registered with the method.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `LIST` | `/auth/aws/roles` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/aws/roles
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["dev-role", "prod-role"]
-  }
-}
-```
-
-## Delete role
-
-Deletes the previously registered role.
-
-| Method   | Path                   |
-| :------- | :--------------------- |
-| `DELETE` | `/auth/aws/role/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/aws/role/dev-role
-```
-
-## Create role tags
-
-Creates a role tag on the role, which help in restricting the capabilities
-that are set on the role. Role tags are not tied to any specific ec2
-instance unless specified explicitly using the `instance_id` parameter. By
-default, role tags are designed to be used across all instances that
-satisfies the constraints on the role. Regardless of which instances have
-role tags on them, capabilities defined in a role tag must be a strict
-subset of the given role's capabilities. Note that, since adding and
-removing a tag is often a widely distributed privilege, care needs to be
-taken to ensure that the instances are attached with correct tags to not
-let them gain more privileges than what were intended. If a role tag is
-changed, the capabilities inherited by the instance will be those defined
-on the new role tag. Since those must be a subset of the role
-capabilities, the role should never provide more capabilities than any
-given instance can be allowed to gain in a worst-case scenario.
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `POST` | `/auth/aws/role/:role/tag` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role.
-- `policies` `(array: [])` - Policies to be associated with the tag. If set,
-  must be a subset of the role's policies. If set, but set to an empty value,
-  only the 'default' policy will be given to issued tokens.
-- `max_ttl` `(string: "")` - The maximum allowed lifetime of tokens issued using
-  this role.
-- `instance_id` `(string: "")` - Instance ID for which this tag is intended for.
-  If set, the created tag can only be used by the instance with the given ID.
-- `allow_instance_migration` `(bool: false)` - If set, allows migration of the
-  underlying instance where the client resides. This keys off of pendingTime in
-  the metadata document, so essentially, this disables the client nonce check
-  whenever the instance is migrated to a new host and pendingTime is newer than
-  the previously-remembered time. Use with caution. Defaults to 'false'.
-  Mutually exclusive with `disallow_reauthentication`.
-- `disallow_reauthentication` `(bool: false)` - If set, only allows a single
-  token to be granted per instance ID. This can be cleared with the
-  auth/aws/identity-accesslist endpoint. Defaults to 'false'. Mutually exclusive
-  with `allow_instance_migration`.
-
-### Sample payload
-
-```json
-{
-  "policies": ["default", "dev-api"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/aws/role/dev-api-and-web-role/tag
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "tag_value": "v1:09Vp0qGuyB8=:r=dev-role:p=default,dev-api:d=false:t=300h0m0s:uPLKCQxqsefRhrp1qmVa1wsQVUXXJG8UZP/pJIdVyOI=",
-    "tag_key": "VaultRole"
-  }
-}
-```
-
-## Login
-
-Fetch a token. This endpoint verifies the PKCS#7 signature of the instance
-identity document or the signature of the signed GetCallerIdentity request.
-With the ec2 auth method, or when inferring an EC2 instance, verifies that
-the instance is actually in a running state. Cross checks the constraints
-defined on the role with which the login is being performed. With the ec2
-auth method, as an alternative to PKCS#7 signature, the identity document
-along with its RSA signature can be supplied to this endpoint.
-
-See the [AWS docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html)
-for more information on the signature types.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `POST` | `/auth/aws/login` |
-
-### Parameters
-
-- `role` `(string: "")` - Name of the role against which the login is being
-  attempted. If `role` is not specified, then the login endpoint looks for a
-  role bearing the name of the AMI ID of the EC2 instance that is trying to
-  login if using the ec2 auth method, or the "friendly name" (i.e., role name or
-  username) of the IAM principal authenticated. If a matching role is not found,
-  login fails.
-- `identity` `(string: <required-ec2>)` - Base64 encoded EC2 instance identity
-  document, which can usually be obtained from the
-  `http://169.254.169.254/latest/dynamic/instance-identity/document` endpoint.
-  When using `curl` for fetching the identity document, consider using the option
-  `-w 0` while piping the output to `base64` binary.
-  Either both of this and `signature` must be set _OR_ `pkcs7` must be set
-  when using the ec2 auth method.
-- `signature` `(string: <required-ec2>)` - Base64-encoded SHA256 RSA signature of
-  the instance identity document, which can usually be obtained from the
-  `http://169.254.169.254/latest/dynamic/instance-identity/signature` endpoint.
-  Either both this _AND_ `identity` must be set _OR_ `pkcs7` must be set
-  when using the ec2 auth method.
-- `pkcs7` `(string: <required-ec2>)` - PKCS#7 signature of the identity document
-  with all `\n` characters removed. This supports signatures from the AWS
-  `http://169.254.169.254/latest/dynamic/instance-identity/rsa2048`
-  or `http://169.254.169.254/latest/dynamic/instance-identity/pkcs7` endpoints.
-  Either this needs to be set _OR_ both `identity` and
-  `signature` need to be set when using the ec2 auth method.
-- `nonce` `(string: "")` - The nonce to be used for subsequent login requests.
-  If this parameter is not specified at all and if reauthentication is allowed,
-  then the method will generate a random nonce, attaches it to the instance's
-  identity-accesslist entry and returns the nonce back as part of auth metadata.
-  This value should be used with further login requests, to establish client
-  authenticity. Clients can choose to set a custom nonce if preferred, in which
-  case, it is recommended that clients provide a strong nonce. If a nonce is
-  provided but with an empty value, it indicates intent to disable
-  reauthentication. Note that, when `disallow_reauthentication` option is
-  enabled on either the role or the role tag, the `nonce` holds no significance.
-  This is ignored unless using the ec2 auth method.
-- `iam_http_request_method` `(string: <required-iam>)` - HTTP method used in the
-  signed request. This is required when using the iam auth method.
-- `iam_request_url` `(string: <required-iam>)` - Base64-encoded HTTP URL used in
-  the signed request. Most likely just `aHR0cHM6Ly9zdHMuYW1hem9uYXdzLmNvbS8=`
-  (base64-encoding of `https://sts.amazonaws.com/`) as most requests will
-  probably use POST with an empty URI. If using GET method this will contain
-  the authentication headers that have been hoisted out of the message body.
-  This is required when using the iam auth method.
-- `iam_request_body` `(string: <required-iam>)` - Base64-encoded body of the
-  signed request. Most likely
-  `QWN0aW9uPUdldENhbGxlcklkZW50aXR5JlZlcnNpb249MjAxMS0wNi0xNQ==`, which is the
-  base64 encoding of `Action=GetCallerIdentity&Version=2011-06-15`. This is
-  required when using the iam auth method with POST signed requests.
-- `iam_request_headers` `(string: <required-iam>)` - Key/value pairs of headers
-  for use in the `sts:GetCallerIdentity` HTTP requests headers. Can be either a
-  Base64-encoded, JSON-serialized string, or a JSON object of key/value pairs. The
-  JSON serialization assumes that each header key maps to either a string value or
-  an array of string values (though the length of that array will probably only be
-  one). If the `iam_server_id_header_value` is configured in Vault for the aws
-  auth mount, then the headers must include the X-Vault-AWS-IAM-Server-ID header,
-  its value must match the value configured, and the header must be included in
-  the signed headers. This is required when using the iam auth method.
-
-### Sample payload
-
-```json
-{
-  "iam_http_request_method": "POST",
-  "iam_request_body": "QWN0aW9uPUdldENhbG...",
-  "iam_request_headers": "eyJBdXRob3JpemF0aW9uIj...",
-  "iam_request_url": "aHR0cHM6L...",
-  "role": "dev-role"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/aws/login
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "renewable": true,
-    "lease_duration": 1800000,
-    "metadata": {
-      "role_tag_max_ttl": "0",
-      "instance_id": "i-de0f1344",
-      "ami_id": "ami-fce36983",
-      "role": "dev-role",
-      "auth_type": "ec2"
-    },
-    "policies": ["default", "dev"],
-    "accessor": "20b89871-e6f2-1160-fb29-31c2f6d4645e",
-    "client_token": "c9368254-3f21-aded-8a6f-7c818e81b17a"
-  }
-}
-```
-
-## Place role tags in deny list
-
-Places a valid role tag in a deny list. This ensures that the role tag
-cannot be used by any instance to perform a login operation again. Note
-that if the role tag was previously used to perform a successful login,
-placing the tag in the deny list does not invalidate the already issued
-token.
-
-| Method | Path                                   |
-| :----- | :------------------------------------- |
-| `POST` | `/auth/aws/roletag-denylist/:role_tag` |
-
-### Parameters
-
-- `role_tag` `(string: <required>)` - Role tag to be deny listed. This is the `tag_value` returned when the role tag is
-  created. The tag can be supplied as-is. In order to avoid any encoding problems, it can be base64
-  encoded.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/auth/aws/roletag-denylist/djE6MDlWcDBxR3V5Qjg9OmE9YW1pLWZjZTNjNjk2OnA9ZGVmYXVsdCxwcm9kOmQ9ZmFsc2U6dD0zMDBoMG0wczp1UExLQ1F4cXNlZlJocnAxcW1WYTF3c1FWVVhYSkc4VVpQLwo=
-```
-
-### Read role tag deny list information
-
-Returns the deny list entry of a previously deny listed role tag.
-
-| Method | Path                                   |
-| :----- | :------------------------------------- |
-| `GET`  | `/auth/aws/roletag-denylist/:role_tag` |
-
-### Parameters
-
-- `role_tag` `(string: <required>)` - Role tag to be deny listed. The tag can be
-  supplied as-is. In order to avoid any encoding problems, it can be base64
-  encoded.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/aws/roletag-denylist/djE6MDlWcDBxR3V5Qjg9OmE9YW1pLWZjZTNjNjk2OnA9ZGVmYXVsdCxwcm9kOmQ9ZmFsc2U6dD0zMDBoMG0wczp1UExLQ1F4cXNlZlJocnAxcW1WYTF3c1FWVVhYSkc4VVpQLwo=
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "expiration_time": "2016-04-25T10:35:20.127058773-04:00",
-    "creation_time": "2016-04-12T22:35:01.178348124-04:00"
-  }
-}
-```
-
-## List deny list tags
-
-Lists all the role tags that are deny listed.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `LIST` | `/auth/aws/roletag-denylist` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/aws/roletag-denylist
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "v1:09Vp0qGuyB8=:a=ami-fce3c696:p=default,prod:d=false:t=300h0m0s:uPLKCQxqsefRhrp1qmVa1wsQVUXXJG8UZP/"
-    ]
-  }
-}
-```
-
-## Delete deny list tags
-
-Deletes a deny listed role tag.
-
-| Method   | Path                                   |
-| :------- | :------------------------------------- |
-| `DELETE` | `/auth/aws/roletag-denylist/:role_tag` |
-
-### Parameters
-
-- `role_tag` `(string: <required>)` - Role tag to be deny listed. The tag can be
-  supplied as-is. In order to avoid any encoding problems, it can be base64
-  encoded.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/aws/roletag-denylist/djE6MDlWcDBxR3V5Qjg9OmE9YW1pLWZjZTNjNjk2OnA9ZGVmYXVsdCxwcm9kOmQ9ZmFsc2U6dD0zMDBoMG0wczp1UExLQ1F4cXNlZlJocnAxcW1WYTF3c1FWVVhYSkc4VVpQLwo=
-```
-
-## Tidy deny list tags
-
-Cleans up the entries in the deny listed based on expiration time on the entry and
-`safety_buffer`.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `POST` | `/auth/aws/tidy/roletag-denylist` |
-
-### Parameters
-
-- `safety_buffer` `(string: "72h")` - The amount of extra time that must have
-  passed beyond the `roletag` expiration, before it is removed from the method
-  storage. Defaults to 72h.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/auth/aws/tidy/roletag-denylist
-```
-
-### Read identity access list information
-
-Returns an entry in the identity access list. An entry will be created/updated by every
-successful login.
-
-| Method | Path                                         |
-| :----- | :------------------------------------------- |
-| `GET`  | `/auth/aws/identity-accesslist/:instance_id` |
-
-### Parameters
-
-- `instance_id` `(string: <required>)` - EC2 instance ID. A successful login
-  operation from an EC2 instance gets cached in th access list, keyed off of
-  instance ID.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/aws/identity-accesslist/i-aab47d37
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "pending_time": "2016-04-14T01:01:41Z",
-    "expiration_time": "2016-05-05 10:09:16.67077232 +0000 UTC",
-    "creation_time": "2016-04-14 14:09:16.67077232 +0000 UTC",
-    "client_nonce": "5defbf9e-a8f9-3063-bdfc-54b7a42a1f95",
-    "role": "dev-role"
-  }
-}
-```
-
-## List identity access list entries
-
-Lists all the instance IDs that are in the access list of successful logins.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `LIST` | `/auth/aws/identity-accesslist` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/aws/identity-accesslist
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["i-aab47d37"]
-  }
-}
-```
-
-## Delete identity access list entries
-
-Deletes a cache of the successful login from an instance.
-
-| Method   | Path                                         |
-| :------- | :------------------------------------------- |
-| `DELETE` | `/auth/aws/identity-accesslist/:instance_id` |
-
-### Parameters
-
-- `instance_id` `(string: <required>)` - EC2 instance ID. A successful login
-  operation from an EC2 instance gets cached in this access list, keyed off of
-  instance ID.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/aws/identity-accesslist/i-aab47d37
-```
-
-## Tidy identity access list entries
-
-Cleans up the entries in the access list based on expiration time and
-`safety_buffer`.
-
-| Method | Path                                 |
-| :----- | :----------------------------------- |
-| `POST` | `/auth/aws/tidy/identity-accesslist` |
-
-### Parameters
-
-- `safety_buffer` `(string: "72h")` - The amount of extra time that must have
-  passed beyond the `roletag` expiration, before it is removed from the method
-  storage. Defaults to 72h.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/auth/aws/tidy/identity-accesslist
-```
-
-## Deprecations effective in Vault 1.7
-
-Vault 1.7 introduced new URLs for a number of AWS Auth APIs. The previous
-URLs are deprecated. The affected APIs include:
-
-| Current                                     | Deprecated in 1.7                          |
-| :------------------------------------------ | :----------------------------------------- |
-| `/auth/aws/roletag-denylist`                | `/auth/aws/roletag-blacklist`              |
-| `/auth/aws/identity-accesslist`             | `/auth/aws/identity-whitelist`             |
-| `/auth/aws/tidy/identity-accesslist`        | `/auth/aws/tidy/identity-whitelist`        |
-| `/auth/aws/tidy/roletag-denylist`           | `/auth/aws/tidy/roletag-blacklist`         |
-| `/auth/aws/config/tidy/identity-accesslist` | `/auth/aws/config/tidy/identity-whitelist` |
-| `/auth/aws/config/tidy/roletag-denylist`    | `/auth/aws/config/tidy/roletag-blacklist`  |
diff --git a/website/content/api-docs/auth/azure.mdx b/website/content/api-docs/auth/azure.mdx
deleted file mode 100644
index 3f8eef4e2a5..00000000000
--- a/website/content/api-docs/auth/azure.mdx
+++ /dev/null
@@ -1,353 +0,0 @@
----
-layout: api
-page_title: Azure - Auth Methods - HTTP API
-description: |-
-  This is the API documentation for the Vault Azure authentication
-  method plugin.
----
-
-# Azure auth method (API)
-
-This is the API documentation for the Vault Azure auth method
-plugin. To learn more about the usage and operation, see the
-[Vault Azure method documentation](/vault/docs/auth/azure).
-
-This documentation assumes the plugin method is mounted at the
-`/auth/azure` path in Vault. Since it is possible to enable auth methods
-at any location, please update your API calls accordingly.
-
-## Configure
-
-Configures the credentials required for the plugin to perform API calls
-to Azure. These credentials will be used to query the metadata about the
-virtual machine.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/auth/azure/config` |
-
-### Parameters
-
-- `tenant_id` `(string: <required>)` - The tenant id for the Azure Active Directory organization.
-  This value can also be provided with the `AZURE_TENANT_ID` environment variable.
-- `resource` `(string: <required>)` - The resource URL for the application registered in Azure Active Directory.
-  The value is expected to match the audience (`aud` claim) of the [JWT](/vault/api-docs/auth/azure#jwt)
-  provided to the login API. See the [resource](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http)
-  parameter for how the audience is set when requesting a JWT access token from the Azure Instance Metadata Service (IMDS) endpoint.
-  This value can also be provided with the `AZURE_AD_RESOURCE` environment variable.
-- `environment` `(string: 'AzurePublicCloud')` - The Azure cloud environment. Valid values: AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud, AzureGermanCloud.
-  This value can also be provided with the `AZURE_ENVIRONMENT` environment variable.
-- `client_id` `(string: '')` - The client id for credentials to query the Azure APIs. Currently read permissions to query compute resources are required.
-  This value can also be provided with the `AZURE_CLIENT_ID` environment variable.
-- `client_secret` `(string: '')` - The client secret for credentials to query the Azure APIs.
-  This value can also be provided with the `AZURE_CLIENT_SECRET` environment variable.
-- `max_retries` `(int: 3)` - The maximum number of attempts a failed operation will be 
-  retried before producing an error.
-- `max_retry_delay` `(string: '60s')` - The maximum delay, in seconds, allowed before retrying an operation.
-- `retry_delay` `(string: '4s')` - The initial amount of delay, in seconds, to use before retrying an operation. Increases exponentially.
-
-### Sample payload
-
-```json
-{
-  "tenant_id": "kd83...",
-  "resource": "https://management.azure.com/",
-  "client_id": "12ud...",
-  "client_secret": "DUJDS3..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/auth/azure/config
-```
-
-# Read config
-
-Returns the previously configured config, including credentials.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/auth/azure/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/auth/azure/config
-```
-
-### Sample response
-
-```json
-{
-  "data":{
-    "tenant_id": "kd83...",
-    "resource": "https://management.azure.com/",
-    "client_id": "12ud...",
-    "client_secret": "DUJDS3..."
-  },
-  ...
-}
-
-```
-
-## Delete config
-
-Deletes the previously configured Azure config and credentials.
-
-| Method   | Path                 |
-| :------- | :------------------- |
-| `DELETE` | `/auth/azure/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/auth/azure/config
-```
-
-## Rotate root
-
-This endpoint generates a new client secret for the root account defined in the config. The
-value generated will only be known by Vault.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/azure/rotate-root` |
-
-### Parameters
-
-There are no parameters to this operation.
-
-### Sample request
-
-```shell-session
-$ curl \
-  --header "X-Vault-Token: ..." \
-  --request POST \
-  https://127.0.0.1:8200/v1/auth/azure/rotate-root
-```
-
-## Create/Update role
-
-Registers a role in the method. Role types have specific entities
-that can perform login operations against this endpoint. Constraints specific
-to the role type must be set on the role. These are applied to the authenticated
-entities attempting to login.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/auth/azure/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-- `bound_service_principal_ids` `(array: [])` - The list of Service Principal IDs
-  that login is restricted to.
-- `bound_group_ids` `(array: [])` - The list of group ids that login is restricted
-  to.
-- `bound_locations` `(array: [])` - The list of locations that login is restricted to.
-- `bound_subscription_ids` `(array: [])` - The list of subscription IDs that login
-  is restricted to.
-- `bound_resource_groups` `(array: [])` - The list of resource groups that
-  login is restricted to.
-- `bound_scale_sets` `(array: [])` - The list of scale set names that the
-  login is restricted to.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "token_policies": ["default", "dev", "prod"],
-  "max_ttl": 1800000,
-  "max_jwt_exp": 10000,
-  "bound_resource_groups": ["vault-dev", "vault-staging", "vault-prod"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/auth/azure/role/dev-role
-```
-
-## Read role
-
-Returns the previously registered role configuration.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `GET`  | `/auth/azure/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/auth/azure/role/dev-role
-```
-
-### Sample response
-
-```json
-{
-  "data":{
-    "token_policies": [
-        "default",
-        "dev",
-        "prod"
-    ],
-    "max_ttl": 1800000,
-    "max_jwt_exp": 10000,
-    "bound_resource_groups": [
-        "vault-dev",
-        "vault-staging",
-        "vault-prod"
-    ]
-  },
-  ...
-}
-
-```
-
-## List roles
-
-Lists all the roles that are registered with the plugin.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `LIST` | `/auth/azure/role` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/auth/azure/role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "dev-role",
-      "prod-role"
-    ]
-  },
-  ...
-}
-```
-
-## Delete role
-
-Deletes the previously registered role.
-
-| Method   | Path                     |
-| :------- | :----------------------- |
-| `DELETE` | `/auth/azure/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/auth/azure/role/dev-role
-```
-
-## Login
-
-Fetch a token. This endpoint takes a signed JSON Web Token (JWT) and
-a role name for some entity. It verifies the JWT signature to authenticate that
-entity and then authorizes the entity for the given role.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/auth/azure/login` |
-
-### Sample payload
-
-- `role` `(string: <required>)` - Name of the role against which the login is being
-  attempted.
-- `jwt` `(string: <required>)` - Signed [JSON Web Token](https://tools.ietf.org/html/rfc7519) (JWT)
-  from Azure MSI. See [Azure documentation](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token)
-  for details on how to acquire a JWT access token through instance metadata.
-- `subscription_id` `(string: <required>)` - The subscription ID for the machine that
-  generated the MSI token. This information can be obtained through instance
-  metadata.
-- `resource_group_name` `(string: <required>)` - The resource group for the machine that
-  generated the MSI token. This information can be obtained through instance
-  metadata.
-- `vm_name` `(string: "")` - The virtual machine name for the machine that
-  generated the MSI token. This information can be obtained through instance
-  metadata. If `vmss_name` is provided, this value is ignored.
-- `vmss_name` `(string: "")` - The virtual machine scale set name for the machine
-  that generated the MSI token. This information can be obtained through instance
-  metadata.
-- `resource_id` `(string: "")` - The fully qualified ID of the Azure resource that
-  generated the MSI token, including the resource name and resource type. Use
-  the format /subscriptions/{guid}/resourceGroups/{resource-group-name}/{resource-provider-namespace}/{resource-type}/{resource-name}.
-  If `vm_name` or `vmss_name` is provided, this value is ignored.
-
-### Sample payload
-
-```json
-{
-  "role": "dev-role",
-  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/auth/azure/login
-```
-
-### Sample response
-
-```json
-{
-    "auth":{
-        "client_token":"f33f8c72-924e-11f8-cb43-ac59d697597c",
-        "accessor":"0e9e354a-520f-df04-6867-ee81cae3d42d",
-        "token_policies":[
-            "default",
-            "dev",
-            "prod"
-        ],
-        "lease_duration":2764800,
-        "renewable":true
-    },
-    ...
-}
-```
diff --git a/website/content/api-docs/auth/cert.mdx b/website/content/api-docs/auth/cert.mdx
deleted file mode 100644
index c9fdeef5cd7..00000000000
--- a/website/content/api-docs/auth/cert.mdx
+++ /dev/null
@@ -1,440 +0,0 @@
----
-layout: api
-page_title: TLS Certificate - Auth Methods - HTTP API
-description: |-
-  This is the API documentation for the Vault TLS Certificate authentication
-  method.
----
-
-# TLS certificate auth method (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault TLS Certificate authentication
-method. For general information about the usage and operation of the TLS
-Certificate method, please see the [Vault TLS Certificate method documentation](/vault/docs/auth/cert).
-
-This documentation assumes the TLS Certificate method is mounted at the
-`/auth/cert` path in Vault. Since it is possible to enable auth methods at any
-location, please update your API calls accordingly.
-
-## Create CA certificate role
-
-Sets a CA cert and associated parameters in a role name.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/auth/cert/certs/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the certificate role.
-- `certificate` `(string: <required>)` - The PEM-format CA certificate.
-- `allowed_names` `(string: "")` - DEPRECATED: Please use the individual
-  `allowed_X_sans` parameters instead. Constrain the Common and Alternative
-  Names in the client certificate with a [globbed pattern](https://github.com/ryanuber/go-glob/blob/master/README.md#example). Value is
-  a comma-separated list of patterns. Authentication requires at least one Name
-  matching at least one pattern. If not set, defaults to allowing all names.
-- `allowed_common_names` `(string: "" or array: [])` - Constrain the Common
-  Names in the client certificate with a [globbed pattern](https://github.com/ryanuber/go-glob/blob/master/README.md#example). Value is
-  a comma-separated list of patterns. Authentication requires at least one Name
-  matching at least one pattern. If not set, defaults to allowing all names.
-- `allowed_dns_sans` `(string: "" or array: [])` - Constrain the Alternative
-  Names in the client certificate with a [globbed pattern](https://github.com/ryanuber/go-glob/blob/master/README.md#example). Value is
-  a comma-separated list of patterns. Authentication requires at least one DNS
-  matching at least one pattern. If not set, defaults to allowing all dns.
-- `allowed_email_sans` `(string: "" or array: [])` - Constrain the Alternative
-  Names in the client certificate with a [globbed pattern](https://github.com/ryanuber/go-glob/blob/master/README.md#example). Value is
-  a comma-separated list of patterns. Authentication requires at least one
-  Email matching at least one pattern. If not set, defaults to allowing all
-  emails.
-- `allowed_uri_sans` `(string: "" or array: [])` - Constrain the Alternative
-  Names in the client certificate with a [globbed pattern](https://github.com/ryanuber/go-glob/blob/master/README.md#example). Value is
-  a comma-separated list of URI patterns. Authentication requires at least one
-  URI matching at least one pattern. If not set, defaults to allowing all URIs.
-- `allowed_organizational_units` `(string: "" or array: [])` - Constrain the
-  Organizational Units (OU) in the client certificate with a [globbed pattern](https://github.com/ryanuber/go-glob/blob/master/README.md#example). Value is
-  a comma-separated list of OU patterns. Authentication requires at least one
-  OU matching at least one pattern. If not set, defaults to allowing all OUs.
-- `required_extensions` `(string: "" or array: [])` - Require specific Custom
-  Extension OIDs to exist and match the pattern. Value is a comma separated
-  string or array of `oid:value`. Expects the extension value to be some type
-  of ASN1 encoded string. All conditions _must_ be met. To match on the hex-encoded
-  value of the extension, including non-string extensions, use the format
-  `hex:<oid>:<value>`.Supports globbing on `value`.
-- `allowed_metadata_extensions` `(array:[])` - A comma separated string or
-  array of oid extensions. Upon successful authentication, these extensions
-  will be added as metadata if they are present in the certificate. The
-  metadata key will be the string consisting of the oid numbers separated
-  by a dash (-) instead of a dot (.) to allow usage in ACL templates.
-- `ocsp_enabled` `(bool: false)` - If enabled, validate certificates' revocation
-  status using OCSP.
-- `ocsp_ca_certificates` `(string: "")` Any additional CA certificates needed to
-  verify OCSP responses.  Provided as base64 encoded PEM data.
-- `ocsp_servers_override` `(array: [])`: A comma-separated list of OCSP server
-  addresses.  If unset, the OCSP server is determined from the AuthorityInformationAccess
-  extension on the certificate being inspected.
-- `ocsp_fail_open` `(bool: false)` - If true and an OCSP response cannot be fetched
-  or is of an unknown status, the login will proceed as if the certificate has not
-  been revoked.
-- `ocsp_query_all_servers` `(bool: false)` - If set to true, rather than accepting
-  the first successful OCSP response, query all servers and consider the certificate
-  valid only if all servers agree.
-
-  ~> **Note**: When using Vault's PKI engine with Performance Replication clusters
-     as the OCSP provider, and without `unified_crls=true` set on the source mount
-     or when using cluster-local OCSP resolvers, we recommend enabling this option.
-
-- `display_name` `(string: "")` - The `display_name` to set on tokens issued
-  when authenticating against this CA certificate. If not set, defaults to the
-  name of the role.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "certificate": "-----BEGIN CERTIFICATE-----\nMIIEtzCCA5+.......ZRtAfQ6r\nwlW975rYa1ZqEdA=\n-----END CERTIFICATE-----",
-  "display_name": "test",
-  "bound_cidrs": ["127.0.0.1/32", "128.252.0.0/16"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --cacert vault-ca.pem \
-    --data @payload.json
-    https://127.0.0.1:8200/v1/auth/cert/certs/test-ca
-```
-
-## Read CA certificate role
-
-Gets information associated with the named role.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `GET`  | `/auth/cert/certs/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the certificate role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --cacert vault-ca.pem \
-    https://127.0.0.1:8200/v1/auth/cert/certs/test-ca
-```
-
-### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIEtzCCA5+.......ZRtAfQ6r\nwlW975rYa1ZqEdA=\n-----END CERTIFICATE-----",
-    "display_name": "test",
-    "policies": "",
-    "allowed_names": "",
-    "required_extensions": "",
-    "ttl": 2764800,
-    "max_ttl": 2764800,
-    "period": 0
-  },
-  "warnings": null,
-  "auth": null
-}
-```
-
-## List certificate roles
-
-Lists configured certificate names.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `LIST` | `/auth/cert/certs` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    --cacert vault-ca.pem \
-    https://127.0.0.1:8200/v1/auth/cert/certs
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": ["cert1", "cert2"]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Delete certificate role
-
-Deletes the named role and CA cert from the method mount.
-
-| Method   | Path                     |
-| :------- | :----------------------- |
-| `DELETE` | `/auth/cert/certs/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the certificate role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    --cacert vault-ca.pem \
-    https://127.0.0.1:8200/v1/auth/cert/certs/cert1
-```
-
-## List CRLs
-
-Lists configured certificate revocation lists.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `LIST` | `/auth/cert/crls` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    --cacert vault-ca.pem \
-    https://127.0.0.1:8200/v1/auth/cert/crls
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": ["crl1", "crl2"]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Create CRL
-
-Sets a named CRL.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/auth/cert/crls/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the CRL.
-- `crl` `(string: "")` - The PEM format CRL.
-- `url` `(string: "")` - The URL of a CRL distribution point.
-
-**Note**: Either 'crl' or 'url' parameters must be provided, if both are provided, 'crl' is used.
-
-### Sample payload
-
-```json
-{
-  "crl": "-----BEGIN X509 CRL-----\n...\n-----END X509 CRL-----"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --cacert vault-ca.pem \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/auth/cert/crls/custom-crl
-```
-
-## Read CRL
-
-Gets information associated with the named CRL (currently, the serial
-numbers contained within). As the serials can be integers up to an
-arbitrary size, these are returned as strings.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/auth/cert/crls/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the CRL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --cacert vault-ca.pem \
-    https://127.0.0.1:8200/v1/auth/cert/crls/custom-crl
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "data": {
-    "serials": {
-      "13": {}
-    }
-  },
-  "lease_duration": 0,
-  "lease_id": "",
-  "renewable": false,
-  "warnings": null
-}
-```
-
-## Delete CRL
-
-Deletes the named CRL from the auth method mount.
-
-| Method   | Path                    |
-| :------- | :---------------------- |
-| `DELETE` | `/auth/cert/crls/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the CRL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    --cacert vault-ca.pem \
-    https://127.0.0.1:8200/v1/auth/cert/crls/cert1
-```
-
-## Configure TLS certificate method
-
-Configuration options for the method.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/auth/cert/config` |
-
-### Parameters
-
-- `disable_binding` `(boolean: false)` - If set, during renewal, skips the
-  matching of presented client identity with the client identity used during
-  login.
-- `enable_identity_alias_metadata` `(boolean: false)` - If set, metadata of
-  the certificate including the metadata corresponding to
-  `allowed_metadata_extensions` will be stored in the alias
-- `ocsp_cache_size` `(int: 100)` - The size of the OCSP response LRU cache.  Note
-  that this cache is used for all configured certificates.
-- `role_cache_size` `(int: 200)` - The size of the role cache.  Use `-1` to disable 
-  role caching.
-
-### Sample payload
-
-```json
-{
-  "disable_binding": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --cacert vault-ca.pem \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/auth/cert/certs/cert1
-```
-
-## Login with TLS certificate method
-
-Log in and fetch a token. If there is a valid chain to a CA configured in the
-method and all role constraints are matched, a token will be issued. If the
-certificate has DNS SANs in it, each of those will be verified. If Common Name
-is required to be verified, then it should be a fully qualified DNS domain name
-and must be duplicated as a DNS SAN (see
-https://tools.ietf.org/html/rfc6125#section-2.3)
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/auth/cert/login` |
-
-### Parameters
-
-- `name` `(string: "")` - Authenticate against only the named certificate role,
-  returning its policy list if successful. If not set, defaults to trying all
-  certificate roles and returning any one that matches.
-
-### Sample payload
-
-```json
-{
-  "name": "cert1"
-}
-```
-
-### Sample request
-
-~> **NOTE** The `--cacert` value used here is for the Vault TLS Listener CA
-certificate, not the CA that issued the client authentication certificate. This
-can be omitted if the CA used to issue the Vault server certificate is trusted
-by the local system executing this command.
-
-```shell-session
-$ curl \
-    --request POST \
-    --cacert vault-ca.pem \
-    --cert cert.pem \
-    --key key.pem \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/auth/cert/login
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "client_token": "cf95f87d-f95b-47ff-b1f5-ba7bff850425",
-    "policies": ["web", "stage"],
-    "lease_duration": 3600,
-    "renewable": true
-  }
-}
-```
diff --git a/website/content/api-docs/auth/cf.mdx b/website/content/api-docs/auth/cf.mdx
deleted file mode 100644
index c5b9d95cc29..00000000000
--- a/website/content/api-docs/auth/cf.mdx
+++ /dev/null
@@ -1,338 +0,0 @@
----
-layout: api
-page_title: Cloud Foundry - Auth Methods - HTTP API
-description: This is the API documentation for the Vault Cloud Foundry auth method.
----
-
-# Pivotal Cloud Foundry (CF) auth method (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault CF auth method. For
-general information about the usage and operation of the CF method, please
-see the [Vault CF method documentation](/vault/docs/auth/cf).
-
-This documentation assumes the CF method is mounted at the `/auth/cf`
-path in Vault. Since it is possible to enable auth methods at any location,
-please update your API calls accordingly.
-
-## Create configuration
-
-Configure the root CA certificate to be used for verifying instance identity
-certificates, and configure access to the CF API. For detailed instructions
-on how to obtain these values, please see the [Vault CF method
-documentation](/vault/docs/auth/cf).
-
-| Method | Path              |
-| :----- | ----------------- |
-| `POST` | `/auth/cf/config` |
-
-### Parameters
-
-- `identity_ca_certificates` `(array: [], required)` - The root CA certificate(s)
-  to be used for verifying that the `CF_INSTANCE_CERT` presented for logging in was
-  issued by the proper authority.
-- `cf_api_addr` `(string: required)`: CF's full API address, to be used for verifying
-  that a given `CF_INSTANCE_CERT` shows an application ID, space ID, and organization ID
-  that presently exist.
-- `cf_username` `(string: required)`: The username for authenticating to the CF API.
-- `cf_password` `(string: required)`: The password for authenticating to the CF API.
-- `cf_api_trusted_certificates` `(array: [])`: The certificate that's presented by the
-  CF API. This configures Vault to trust this certificate when making API calls, resolving
-  `x509: certificate signed by unknown authority` errors.
-- `login_max_seconds_not_before` `(int: 300)`: The maximum number of seconds in the past when a
-  signature could have been created. The lower the value, the lower the risk of replay
-  attacks.
-- `login_max_seconds_not_after` `(int: 60)`: In case of clock drift, the maximum number of
-  seconds in the future when a signature could have been created. The lower the value,
-  the lower the risk of replay attacks.
-
-### Sample payload
-
-```json
-{
-  "identity_ca_certificates": [
-    "-----BEGIN CERTIFICATE-----\nMIIEtzCCA5+.......ZRtAfQ6r\nwlW975rYa1ZqEdA=\n-----END CERTIFICATE-----"
-  ],
-  "cf_api_addr": "https://api.sys.somewhere.cf-app.com",
-  "cf_username": "vault",
-  "cf_password": "pa55w0rd",
-  "cf_api_trusted_certificates": [
-    "-----BEGIN CERTIFICATE-----\nMIIEtzCCA5+.......ZRtAfQ6r\nwlW975rYa1ZqEdA=\n-----END CERTIFICATE-----"
-  ],
-  "login_max_seconds_not_before": 5,
-  "login_max_seconds_not_after": 1
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/cf/config
-```
-
-## Read config
-
-Returns the present CF configuration.
-
-| Method | Path              |
-| :----- | ----------------- |
-| `GET`  | `/auth/cf/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/cf/config
-```
-
-### Sample response
-
-```json
-{
-  "identity_ca_certificates": [
-    "-----BEGIN CERTIFICATE-----\nMIIEtzCCA5+.......ZRtAfQ6r\nwlW975rYa1ZqEdA=\n-----END CERTIFICATE-----"
-  ],
-  "cf_api_addr": "https://api.sys.somewhere.cf-app.com",
-  "cf_username": "vault",
-  "cf_api_trusted_certificates": [
-    "-----BEGIN CERTIFICATE-----\nMIIEtzCCA5+.......ZRtAfQ6r\nwlW975rYa1ZqEdA=\n-----END CERTIFICATE-----"
-  ],
-  "login_max_seconds_not_before": 5,
-  "login_max_seconds_not_after": 1
-}
-```
-
-## Delete config
-
-Deletes the present CF configuration.
-
-| Method   | Path              |
-| :------- | ----------------- |
-| `DELETE` | `/auth/cf/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/cf/config
-```
-
-## Create/Update role
-
-Create a role in Vault granting a particular level of access to a particular group
-of CF instances. We recommend using the CF API or the CF CLI to gain the IDs you
-wish to target.
-
-If you list no `bound` parameters, then any entity with a valid
-`CF_INSTANCE_CERT` that's been issued by any configured `identity_ca_certificates`
-will be able to authenticate against this role.
-
-| Method | Path                   |
-| :----- | ---------------------- |
-| `POST` | `/auth/cf/roles/:role` |
-
-### Parameters
-
-- `role` `(string: required)` - The name of the role.
-- `bound_application_ids` `(array: [])` - An optional list of application IDs
-  an instance must be a member of to qualify as a member of this role.
-- `bound_space_ids` `(array: [])` - An optional list of space IDs
-  an instance must be a member of to qualify as a member of this role.
-- `bound_organization_ids` `(array: [])` - An optional list of organization IDs
-  an instance must be a member of to qualify as a member of this role.
-- `bound_instance_ids` `(array: [])` - An optional list of instance IDs
-  an instance must be a member of to qualify as a member of this role. Please note that
-  every time you use `cf push` on an app, its instance ID changes. Also, instance IDs
-  are not verifiable as being presently alive using the CF API. Thus, we recommend against
-  using this setting for most use cases.
-- `disable_ip_matching` `(bool: false)` - If set to true, disables the default behavior
-  that logging in must be performed from an acceptable IP address described by the
-  certificate presented. Should only be set to true if required, generally when a proxy
-  is used to perform logins.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "bound_application_ids": ["09d7eb6a-afc2-49a0-bb32-858c22f2b346"],
-  "bound_space_ids": ["21005ebb-8943-433e-84e6-d9d9d7338853"],
-  "bound_organization_ids": ["9785a884-5e93-49bd-97ee-57bf7c2b20e0"],
-  "bound_instance_ids": ["f3e0f176-3f83-4efb-5842-2ff4"],
-  "bound_cidrs": ["127.0.0.1/32", "128.252.0.0/16"],
-  "policies": ["default"],
-  "ttl": "1h",
-  "max_ttl": "1h",
-  "period": "1h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/cf/roles/:role
-```
-
-## Read role
-
-Returns a CF role.
-
-| Method | Path                   |
-| :----- | ---------------------- |
-| `GET`  | `/auth/cf/roles/:role` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/cf/roles/:role
-```
-
-### Sample response
-
-```json
-{
-  "bound_application_ids": ["09d7eb6a-afc2-49a0-bb32-858c22f2b346"],
-  "bound_space_ids": ["21005ebb-8943-433e-84e6-d9d9d7338853"],
-  "bound_organization_ids": ["9785a884-5e93-49bd-97ee-57bf7c2b20e0"],
-  "bound_instance_ids": ["f3e0f176-3f83-4efb-5842-2ff4"],
-  "bound_cidrs": ["127.0.0.1/32", "128.252.0.0/16"],
-  "policies": ["default"],
-  "ttl": 2764790,
-  "max_ttl": 2764790,
-  "period": 2764790
-}
-```
-
-## Delete role
-
-Deletes a CF role.
-
-| Method   | Path                   |
-| :------- | ---------------------- |
-| `DELETE` | `/auth/cf/roles/:role` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/cf/roles/:role
-```
-
-## List roles
-
-Returns a CF role.
-
-| Method | Path             |
-| :----- | ---------------- |
-| `LIST` | `/auth/cf/roles` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST
-    http://127.0.0.1:8200/v1/auth/cf/roles
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["role1", "role2"]
-  }
-}
-```
-
-## Login
-
-Log in to CF.
-
-Vault provides both an agent and a CLI tool for logging in that
-eliminates the need to build a signature yourself. However, if you do wish to
-build the signature, its signing algorithm is viewable [here](https://github.com/hashicorp/vault-plugin-auth-cf/tree/master/signatures).
-The [plugin repo](https://github.com/hashicorp/vault-plugin-auth-cf) also contains
-a command-line tool (`generate-signature`) that can be compiled as a binary for generating a signature,
-and a test that outputs steps in generating the signature so they can be duplicated.
-
-However, at a high level, these are the steps for generating a signature:
-
-- Get and format the current time, ex. `2006-01-02T15:04:05Z`.
-- Get the full body of the file located at `CF_INSTANCE_CERT`.
-- Get the name of the role.
-- Concatenate them together in the above order, with no extra string used for joining them.
-- Create a SHA256 checksum of the resulting string (`checksum` below).
-- Sign the string using the key located at `CF_INSTANCE_KEY`. In Go, this is performed using
-  the following line of code which you can more deeply inspect:
-
-```
-rsa.SignPSS(rand.Reader, rsaPrivateKey, crypto.SHA256, checksum, nil)
-```
-
-- Convert the signature to a string.
-
-| Method | Path             |
-| :----- | ---------------- |
-| `POST` | `/auth/cf/login` |
-
-### Parameters
-
-- `role` `(string: required)` - The name of the role.
-- `cf_instance_cert` `(string: required)` - The full body of the file available at
-  the path denoted by `CF_INSTANCE_CERT`.
-- `signing_time` `(string: required)` - The date and time used to construct the signature.
-- `signature` `(string: required)` - The signature generated by the algorithm described
-  above using the `CF_INSTANCE_KEY`.
-
-### Sample payload
-
-```json
-{
-  "role": "test-role",
-  "cf_instance_cert": "-----BEGIN CERTIFICATE-----\nMIIEtzCCA5+.......ZRtAfQ6r\nwlW975rYa1ZqEdA=\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIEtzCCA5+.......ZRtAfQ6r\nwlW975rYa1ZqEdA=\n-----END CERTIFICATE-----",
-  "signing_time": "2006-01-02T15:04:05Z",
-  "signature": "MmyUjQ1OqxQmF0W6raVQDL-hlqqe1oG-7abA6Oi3NHwT-9lMfrYxsCwMnd2HKGMly2tCgetcoA2orfquoe6MkMuksx_KGH_KLObcAykt53z4rHceHKGvm7eGj60cjWFYtiNPic-lzUGERLbUeKLMi6NlThm9ueb7hhpyTUpEYtphV3gorbVxvlkrnuYSbgy2NGpOUY1N8dRzcxmHkYjh12XoWEw4Is5aFr6eFKbZ0vmLWBzhJ7_w20CFyTpRYB-6heGz1iR9qEG8mZk3_x4rZpT5mejJ5zmH2xlUjBJMndfcz47btEi2BO9pFVxK2wK-tKeUUFgx6RcomAopTskkmg=="
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/cf/login
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "renewable": true,
-    "lease_duration": 1800000,
-    "policies": ["default", "dev"],
-    "accessor": "20b89871-e6f2-1160-fb29-31c2f6d4645e",
-    "client_token": "c9368254-3f21-aded-8a6f-7c818e81b17a"
-  }
-}
-```
diff --git a/website/content/api-docs/auth/gcp.mdx b/website/content/api-docs/auth/gcp.mdx
deleted file mode 100644
index dddeb9594e0..00000000000
--- a/website/content/api-docs/auth/gcp.mdx
+++ /dev/null
@@ -1,479 +0,0 @@
----
-layout: api
-page_title: Google Cloud - Auth Methods - HTTP API
-description: |-
-  This is the API documentation for the Vault Google Cloud authentication
-  method.
----
-
-# Google Cloud auth method (API)
-
-This is the API documentation for the Vault Google Cloud auth method. To learn
-more about the usage and operation, see the
-[Vault Google Cloud method documentation](/vault/docs/auth/gcp).
-
-This documentation assumes the plugin method is mounted at the
-`/auth/gcp` path in Vault. Since it is possible to enable auth methods
-at any location, please update your API calls accordingly.
-
-## Configure
-
-Configures the credentials required for the plugin to perform API calls
-to Google Cloud. These credentials will be used to query the status of IAM
-entities and get service account or other Google public certificates
-to confirm signed JWTs passed in during login.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/auth/gcp/config` |
-
-### Parameters
-
-- `credentials` `(string: "")` - A JSON string containing the contents of a GCP
-  service account credentials file. The service account associated with the credentials
-  file must have the following [permissions](/vault/docs/auth/gcp#required-gcp-permissions).
-  If this value is empty, Vault will try to use [Application Default Credentials][gcp-adc]
-  from the machine on which the Vault server is running.
-
-- `iam_alias` `(string: "role_id")` - Must be either `unique_id` or `role_id`.
-  If `unique_id` is specified, the service account's unique ID will be used for
-  alias names during login. If `role_id` is specified, the ID of the Vault role
-  will be used. Only used if role `type` is `iam`.
-
-- `iam_metadata` `(string: "default")` - The metadata to include on the token
-  returned by the `login` endpoint. This metadata will be added to both audit logs,
-  and on the `iam_alias`. By default, it includes `project_id`, `role`,
-  `service_account_id`, and `service_account_email`. To include no metadata,
-  set to `""` via the CLI or `[]` via the API. To use only particular fields, select
-  the explicit fields. To restore to defaults, send only a field of `default`.
-  **Only select fields that will have a low rate of change** for your `iam_alias` because
-  each change triggers a storage write and can have a performance impact at scale.
-  Only used if role `type` is `iam`.
-
-- `gce_alias` `(string: "role_id")` - Must be either `instance_id` or `role_id`.
-  If `instance_id` is specified, the GCE instance ID will be used for alias names
-  during login. If `role_id` is specified, the ID of the Vault role will be used.
-  Only used if role `type` is `gce`.
-
-- `gce_metadata` `(string: "default")` - The metadata to include on the token
-  returned by the `login` endpoint. This metadata will be added to both audit logs,
-  and on the `gce_alias`. By default, it includes `instance_creation_timestamp`,
-  `instance_id`, `instance_name`, `project_id`, `project_number`, `role`,
-  `service_account_id`, `service_account_email`, and `zone`. To include no metadata,
-  set to `""` via the CLI or `[]` via the API. To use only particular fields, select
-  the explicit fields. To restore to defaults, send only a field of `default`.
-  **Only select fields that will have a low rate of change** for your `gce_alias` because
-  each change triggers a storage write and can have a performance impact at scale.
-  Only used if role `type` is `gce`.
-
-- `custom_endpoint` `(map<string|string>: <optional>)` - Specifies overrides to
-  [service endpoints](https://cloud.google.com/apis/design/glossary#api_service_endpoint)
-  used when making API requests. This allows specific requests made during authentication
-  to target alternative service endpoints for use in [Private Google Access](https://cloud.google.com/vpc/docs/configure-private-google-access)
-  environments.
-
-  Overrides are set at the subdomain level using the following keys:
-  - `api` - Replaces the service endpoint used in API requests to `https://www.googleapis.com`.
-  - `iam` - Replaces the service endpoint used in API requests to `https://iam.googleapis.com`.
-  - `crm` - Replaces the service endpoint used in API requests to `https://cloudresourcemanager.googleapis.com`.
-  - `compute` - Replaces the service endpoint used in API requests to `https://compute.googleapis.com`.
-
-  The endpoint value provided for a given key has the form of `scheme://host:port`.
-  The `scheme://` and `:port` portions of the endpoint value are optional.
-
-### Sample payload
-
-```json
-{
-  "credentials": "{ \"type\": \"service_account\", \"project_id\": \"project-123456\", ...}"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/gcp/config
-```
-
-## Read config
-
-Returns the configuration, if any, including credentials.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/auth/gcp/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/gcp/config
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "client_email": "service-account@project-123456.iam.gserviceaccount.com",
-    "client_id": "123456789101112131415",
-    "private_key_id": "97fd7ba59a96e1f3830296aedb4f50879e4d5382",
-    "project_id": "project-123456"
-  }
-}
-```
-
-## Create/Update role
-
-Registers a role in the method. Role types have specific entities
-that can perform login operations against this endpoint. Constraints specific
-to the role type must be set on the role. These are applied to the authenticated
-entities attempting to login.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/auth/gcp/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the role.
-
-- `type` `(string: <required>)` - The type of this role. Certain fields
-  correspond to specific roles and will be rejected otherwise. Please see below
-  for more information.
-
-- `bound_service_accounts` `(array: <required for iam>)` - An array of
-  service account emails or IDs that login is restricted to,
-  either directly or through an associated instance. If set to
-  `*`, all service accounts are allowed (you can bind this further using
-  `bound_projects`.)
-
-- `bound_projects` `(array: [])` - An array of GCP project IDs. Only entities
-  belonging to this project can authenticate under the role.
-
-- `add_group_aliases` `(bool: false)` - If true, any auth token
-  generated under this token will have associated group aliases, namely
-  `project-$PROJECT_ID`, `folder-$PROJECT_ID`, and `organization-$ORG_ID`
-  for the entities project and all its folder or organization ancestors. This
-  requires Vault to have IAM permission `resourcemanager.projects.get`.
-
-@include 'tokenfields.mdx'
-
-#### `iam`-only parameters
-
-The following parameters are only valid when the role is of type `"iam"`:
-
-- `max_jwt_exp` `(string: "15m")` - The number of seconds past the time of
-  authentication that the login param JWT must expire within. For example, if a
-  user attempts to login with a token that expires within an hour and this is
-  set to 15 minutes, Vault will return an error prompting the user to create a
-  new signed JWT with a shorter `exp`. The GCE metadata tokens currently do not
-  allow the `exp` claim to be customized.
-
-- `allow_gce_inference` `(bool: true)` - A flag to determine if this role should
-  allow GCE instances to authenticate by inferring service accounts from the
-  GCE identity metadata token.
-
-#### `gce`-only parameters
-
-The following parameters are only valid when the role is of type `"gce"`:
-
-- `bound_zones` `(array: [])`: The list of zones that a GCE instance must belong
-  to in order to be authenticated. If `bound_instance_groups` is provided, it is
-  assumed to be a zonal group and the group must belong to this zone.
-
-- `bound_regions` `(array: [])`: The list of regions that a GCE instance must
-  belong to in order to be authenticated. If `bound_instance_groups` is
-  provided, it is assumed to be a regional group and the group must belong to
-  this region. If `bound_zones` are provided, this attribute is ignored.
-
-- `bound_instance_groups` `(array: [])`: The instance groups that an authorized
-  instance must belong to in order to be authenticated. If specified, either
-  `bound_zones` or `bound_regions` must be set too.
-
-- `bound_labels` `(array: [])`: A comma-separated list of GCP labels formatted
-  as "key:value" strings that must be set on authorized GCE instances. Because
-  GCP labels are not currently ACL'd, we recommend that this be used in
-  conjunction with other restrictions.
-
-### Sample payload
-
-Example `iam` role:
-
-```json
-{
-  "type": "iam",
-  "project_id": "project-123456",
-  "policies": ["prod"],
-  "ttl": "30m",
-  "max_ttl": "24h",
-  "max_jwt_exp": "5m",
-  "bound_service_accounts": ["dev-1@project-123456.iam.gserviceaccount.com"]
-}
-```
-
-Example `gce` role:
-
-```json
-{
-  "type": "gce",
-  "project_id": "project-123456",
-  "policies": ["prod"],
-  "bound_zones": ["us-east1-b", "eu-west2-a"],
-  "ttl": "30m",
-  "max_ttl": "24h",
-  "bound_service_accounts": ["dev-1@project-123456.iam.gserviceaccount.com"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/gcp/role/my-role
-```
-
-## Edit service accounts on IAM role
-
-Edit service accounts for an existing IAM role in the method.
-This allows you to add or remove service accounts from the list of
-service accounts on the role.
-
-| Method | Path                                    |
-| :----- | :-------------------------------------- |
-| `POST` | `/auth/gcp/role/:name/service-accounts` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of an existing `iam` type role. This
-  will return an error if role is not an `iam` type role.
-
-- `add` `(array: [])` - The list of service accounts to add to the role's
-  service accounts.
-
-- `remove` `(array: [])` - The list of service accounts to remove from the
-  role's service accounts.
-
-### Sample payload
-
-```json
-{
-  "add": ["dev-1@project-123456.iam.gserviceaccount.com", "123456789"],
-  "remove": ["dev-2@project-123456.iam.gserviceaccount.com"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/gcp/role/my-role
-```
-
-## Edit labels on GCE role
-
-Edit labels for an existing GCE role in the backend. This allows you to add or
-remove labels (keys, values, or both) from the list of keys on the role.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/auth/gcp/role/:name/labels` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of an existing `gce` role. This will
-  return an error if role is not a `gce` type role.
-
-- `add` `(array: [])` - The list of `key:value` labels to add to the GCE role's
-  bound labels.
-
-- `remove` `(array: [])` - The list of label _keys_ to remove from the role's
-  bound labels. If any of the specified keys do not exist, no error is returned
-  (idempotent).
-
-### Sample payload
-
-```json
-{
-  "add": ["foo:bar", "env:dev", "key:value"],
-  "remove": ["key1", "key2"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/gcp/role/my-role
-```
-
-## Read role
-
-Returns the previously registered role configuration.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/auth/gcp/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the role to read.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/gcp/role/my-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "bound_labels": {
-      "env": "dev",
-      "foo": "bar",
-      "key": "value"
-    },
-    "bound_service_accounts": ["dev-1@project-123456.iam.gserviceaccount.com"],
-    "bound_zones": ["eu-west2-a", "us-east1-b"],
-    "gce_alias": "instance_id",
-    "max_ttl": 86400,
-    "policies": ["prod"],
-    "project_id": "project-123456",
-    "role_id": "6bbfab2b-ca32-6044-4829-4515728d87b1",
-    "type": "gce",
-    "ttl": 1800
-  }
-}
-```
-
-## List roles
-
-Lists all the roles that are registered with the plugin.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `LIST` | `/auth/gcp/roles` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/gcp/roles
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["my-role", "my-other-role"]
-  }
-}
-```
-
-## Delete role
-
-Deletes the previously registered role.
-
-| Method   | Path                   |
-| :------- | :--------------------- |
-| `DELETE` | `/auth/gcp/role/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - The name of the role to delete.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/gcp/role/my-role
-```
-
-## Login
-
-Login to retrieve a Vault token. This endpoint takes a signed JSON Web Token
-(JWT) and a role name for some entity. It verifies the JWT signature with Google
-Cloud to authenticate that entity and then authorizes the entity for the given
-role.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `POST` | `/auth/gcp/login` |
-
-### Sample payload
-
-- `role` `(string: <required>)` - The name of the role against which the login
-  is being attempted.
-
-- `jwt` `(string: <required>)` - A Signed [JSON Web Token][jwt].
-
-  - For `iam` type roles, this is a JWT signed with the
-    [`signJwt` method][signjwt-method] or a self-signed JWT.
-
-  - For `gce` type roles, this is an [identity metadata token][instance-token].
-
-### Sample payload
-
-```json
-{
-  "role": "my-role",
-  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/gcp/login
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "client_token": "f33f8c72-924e-11f8-cb43-ac59d697597c",
-    "accessor": "0e9e354a-520f-df04-6867-ee81cae3d42d",
-    "policies": ["default", "dev", "prod"],
-    "metadata": {
-      "project_id": "my-project",
-      "role": "my-role",
-      "service_account_email": "dev1@project-123456.iam.gserviceaccount.com",
-      "service_account_id": "111111111111111111111"
-    },
-    "lease_duration": 2764800,
-    "renewable": true
-  }
-}
-```
-
-[gcp-adc]: https://developers.google.com/identity/protocols/application-default-credentials
-[jwt]: https://tools.ietf.org/html/rfc7519
-[signjwt-method]: https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signJwt
-[instance-token]: https://cloud.google.com/compute/docs/instances/verifying-instance-identity#request_signature
diff --git a/website/content/api-docs/auth/github.mdx b/website/content/api-docs/auth/github.mdx
deleted file mode 100644
index d8e12c8c556..00000000000
--- a/website/content/api-docs/auth/github.mdx
+++ /dev/null
@@ -1,278 +0,0 @@
----
-layout: api
-page_title: GitHub - Auth Methods - HTTP API
-description: This is the API documentation for the Vault GitHub auth method.
----
-
-# GitHub auth method (API)
-
-This is the API documentation for the Vault GitHub auth method. For
-general information about the usage and operation of the GitHub method, please
-see the [Vault GitHub method documentation](/vault/docs/auth/github).
-
-This documentation assumes the GitHub method is enabled at the `/auth/github`
-path in Vault. Since it is possible to enable auth methods at any location,
-please update your API calls accordingly.
-
-## Configure method
-
-Configures the connection parameters for GitHub. This path honors the
-distinction between the `create` and `update` capabilities inside ACL policies.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `POST` | `/auth/github/config` |
-
-### Parameters
-
-- `organization` `(string: <required>)` - The organization users must be part
-  of.
-- `organization_id` `(int: 0)` - The ID of the organization users must be part
-  of. Vault will attempt to fetch and set this value if it is not provided.
-- `base_url` `(string: "")` - The API endpoint to use. Useful if you are running
-  GitHub Enterprise or an API-compatible authentication server.
-
-### Environment variables
-- `VAULT_AUTH_CONFIG_GITHUB_TOKEN` `(string: "")` - An optional GitHub token used to make
-  authenticated GitHub API requests. This can be useful for bypassing GitHub's
-  rate-limiting during automation flows when the `organization_id` is not provided.
-  We encourage you to provide the `organization_id` instead of relying on this environment variable.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "organization": "acme-org"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/github/config
-```
-
-## Read configuration
-
-Reads the GitHub configuration.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `GET`  | `/auth/github/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/github/config
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "812229d7-a82e-0b20-c35b-81ce8c1b9fa6",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "organization": "acme-org",
-    "base_url": "",
-    "ttl": "",
-    "max_ttl": ""
-  },
-  "warnings": null
-}
-```
-
-## Map GitHub teams
-
-Map a list of policies to a team that exists in the configured GitHub organization.
-
-| Method | Path                                |
-| :----- | :---------------------------------- |
-| `POST` | `/auth/github/map/teams/:team_name` |
-
-### Parameters
-
-- `team_name` `(string)` - GitHub team name in "slugified" format
-- `value` `(string)` - Comma separated list of policies to assign
-
-### Sample payload
-
-```json
-{
-  "value": "dev-policy"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/github/map/teams/dev
-```
-
-## Read team mapping
-
-Reads the GitHub team policy mapping.
-
-| Method | Path                                |
-| :----- | :---------------------------------- |
-| `GET`  | `/auth/github/map/teams/:team_name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/github/map/teams/dev
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "812229d7-a82e-0b20-c35b-81ce8c1b9fa6",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "key": "dev",
-    "value": "dev-policy"
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Map GitHub users
-
-Map a list of policies to a specific GitHub user exists in the configured
-organization.
-
-| Method | Path                                |
-| :----- | :---------------------------------- |
-| `POST` | `/auth/github/map/users/:user_name` |
-
-### Parameters
-
-- `user_name` `(string)` - GitHub user name
-- `value` `(string)` - Comma separated list of policies to assign
-
-### Sample payload
-
-```json
-{
-  "value": "sethvargo-policy"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/github/map/users/sethvargo
-```
-
-The user with username `sethvargo` will be assigned the `sethvargo-policy`
-policy **in addition to** any team policies.
-
-## Read user mapping
-
-Reads the GitHub user policy mapping.
-
-| Method | Path                                |
-| :----- | :---------------------------------- |
-| `GET`  | `/auth/github/map/users/:user_name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/github/map/users/sethvargo
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "764b6f88-efba-51bd-ed62-cf1c9e80e37a",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "key": "sethvargo",
-    "value": "sethvargo-policy"
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Login
-
-Login using GitHub access token.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/auth/github/login` |
-
-### Parameters
-
-- `token` `(string: <required>)` - GitHub personal API token.
-
-### Sample payload
-
-```json
-{
-  "token": "ABC123..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    http://127.0.0.1:8200/v1/auth/github/login
-```
-
-### Sample response
-
-```javascript
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": null,
-  "warnings": null,
-  "auth": {
-    "client_token": "64d2a8f2-2a2f-5688-102b-e6088b76e344",
-    "accessor": "18bb8f89-826a-56ee-c65b-1736dc5ea27d",
-    "policies": ["default"],
-    "metadata": {
-      "username": "fred",
-      "org": "acme-org"
-    },
-  },
-  "lease_duration": 7200,
-  "renewable": true
-}
-```
diff --git a/website/content/api-docs/auth/index.mdx b/website/content/api-docs/auth/index.mdx
deleted file mode 100644
index 2cc48c1d921..00000000000
--- a/website/content/api-docs/auth/index.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
----
-layout: api
-page_title: Auth Methods - HTTP API
-description: |-
-  Each auth method publishes its own set of API paths and methods.
-  These endpoints are documented in this section.
----
-
-# Auth methods
-
-Each auth method publishes its own set of API paths and methods. These endpoints
-are documented in this section. Auth methods are enabled at a path, but the
-documentation will assume the default paths for simplicity. If you are enabling
-at a different path, you should adjust your API calls accordingly.
-
-For the API documentation for a specific auth method, please choose a auth
-method from the navigation.
diff --git a/website/content/api-docs/auth/jwt.mdx b/website/content/api-docs/auth/jwt.mdx
deleted file mode 100644
index 4b99126ef80..00000000000
--- a/website/content/api-docs/auth/jwt.mdx
+++ /dev/null
@@ -1,443 +0,0 @@
----
-layout: api
-page_title: JWT/OIDC - Auth Methods - HTTP API
-description: |-
-  This is the API documentation for the Vault JWT/OIDC authentication
-  method plugin.
----
-
-# JWT/OIDC auth method (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault JWT/OIDC auth method
-plugin. To learn more about the usage and operation, see the
-[Vault JWT/OIDC method documentation](/vault/docs/auth/jwt).
-
-This documentation assumes the plugin method is mounted at the
-`/auth/jwt` path in Vault. Since it is possible to enable auth methods
-at any location, please update your API calls accordingly.
-
-## Configure
-
-Configures the validation information to be used globally across all roles. One
-(and only one) of `oidc_discovery_url`, `jwks_url`, and `jwt_validation_pubkeys` must be
-set.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/auth/jwt/config` |
-
-### Parameters
-
-- `oidc_discovery_url` `(string: <optional>)` - The OIDC Discovery URL, without any .well-known component (base path). Cannot be used with "jwks_url" or "jwt_validation_pubkeys".
-- `oidc_discovery_ca_pem` `(string: <optional>)` - The contents of a CA certificate or chain of certificates, in PEM format, to use to validate connections to the OIDC Discovery URL. If not set, system certificates are used.
-- `oidc_client_id` `(string: <optional>)` - The OAuth Client ID from the provider for OIDC roles.
-- `oidc_client_secret` `(string: <optional>)` - The OAuth Client Secret from the provider for OIDC roles.
-- `oidc_response_mode` `(string: <optional>)` - The response mode to be used in the OAuth2 request. Allowed values are "query" and "form_post". Defaults to "query". If using Vault namespaces, and oidc_response_mode is "form_post", then "namespace_in_state" should be set to false.
-- `oidc_response_types` `(comma-separated string, or array of strings: <optional>)` - The response types to request. Allowed values are "code" and "id_token". Defaults to "code".
-  Note: "id_token" may only be used if "oidc_response_mode" is set to "form_post".
-- `jwks_url` `(string: <optional>)` - JWKS URL to use to authenticate signatures. Cannot be used with "oidc_discovery_url" or "jwt_validation_pubkeys".
-- `jwks_ca_pem` `(string: <optional>)` - The contents of a CA certificate or chain of certificates, in PEM format, to use to validate connections to the JWKS URL. If not set, system certificates are used.
-- `jwks_pairs` `(list of JSON object: <optional>)` - List of JWKS URL and optional CA certificate pairs. CA certificates must be in PEM format. Must be a list of JSON objects with format `[{"jwks_url": "", "jwks_ca_pem": ""}]`. Cannot be used with "jwks_url" or "jwks_ca_pem".
-- `jwt_validation_pubkeys` `(comma-separated string, or array of strings: <optional>)` - A list of PEM-encoded public keys to use to authenticate signatures locally. Cannot be used with "jwks_url" or "oidc_discovery_url".
-- `bound_issuer` `(string: <optional>)` - The value against which to match the `iss` claim in a JWT. Cannot be configured when `jwks_pairs` is set.
-- `jwt_supported_algs` `(comma-separated string, or array of strings: <optional>)` - A list of supported signing algorithms. Defaults to [RS256] for OIDC roles. Defaults to all [available algorithms](https://github.com/hashicorp/cap/blob/main/jwt/algs.go) for JWT roles.
-- `default_role` `(string: <optional>)` - The default role to use if none is provided during login.
-- `provider_config` `(map: <optional>)` - Configuration options for provider-specific handling. Providers with specific handling include: Azure, Google, SecureAuth, IBM ISAM. The options are described in each provider's section in [OIDC Provider Setup](/vault/docs/auth/jwt/oidc-providers).
-- `namespace_in_state` `(bool: true)` - Pass namespace in the OIDC state parameter instead of as a separate query parameter. With this setting, the allowed redirect URL(s) in Vault and on the provider side should not contain a namespace query parameter. This means only one redirect URL entry needs to be maintained on the provider side for all vault namespaces that will be authenticating against it. Defaults to true for new configs.
-
-### Sample payload
-
-```json
-{
-  "oidc_discovery_url": "https://myco.auth0.com/",
-  "bound_issuer": "https://myco.auth0.com/"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/auth/jwt/config
-```
-
-## Read config
-
-Returns the previously configured config.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/auth/jwt/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/auth/jwt/config
-```
-
-### Sample response
-
-```json
-{
-  "data":{
-    "oidc_discovery_url": "https://myco.auth0.com/",
-    "oidc_discovery_ca_pem": [],
-    "bound_issuer": "https://myco.auth0.com/",
-    "jwt_validation_pubkeys": []
-  },
-  ...
-}
-```
-
-## Create/Update role
-
-Registers a role in the method. Role types have specific entities
-that can perform login operations against this endpoint. Constraints specific
-to the role type must be set on the role. These are applied to the authenticated
-entities attempting to login. At least one of the bound values must be set.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/auth/jwt/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-- `role_type` `(string: <optional>)` - Type of role, either "oidc" (default) or "jwt".
-- `bound_audiences` `(array: <optional>)` - List of `aud` claims to match against.
-  Any match is sufficient. For "jwt" roles, at least one of `bound_audiences`, `bound_subject`,
-  `bound_claims` or `token_bound_cidrs` is required. Optional for "oidc" roles.
-- `user_claim` `(string: <required>)` - The claim to use to uniquely identify
-  the user; this will be used as the name for the Identity entity alias created
-  due to a successful login. The claim value must be a string.
-- `user_claim_json_pointer` `(bool: false)` - Specifies if the `user_claim` value uses
-  [JSON pointer](/vault/docs/auth/jwt#claim-specifications-and-json-pointer) syntax for
-  referencing claims. By default, the `user_claim` value will not use JSON pointer.
-- `clock_skew_leeway` `(int or string: <optional>)` - The amount of leeway to add to all claims to
-  account for clock skew, in seconds. Defaults to `60` seconds if set to `0` and can be disabled
-  if set to `-1`. Accepts an integer number of seconds, or a Go duration format string. Only applicable
-  with "jwt" roles.
-- `expiration_leeway` `(int or string: <optional>)` - The amount of leeway to add to expiration (`exp`) claims to
-  account for clock skew, in seconds. Defaults to `150` seconds if set to `0` and can be disabled
-  if set to `-1`. Accepts an integer number of seconds, or a Go duration format string. Only applicable
-  with "jwt" roles.
-- `not_before_leeway` `(int or string: <optional>)` - The amount of leeway to add to not before (`nbf`) claims to
-  account for clock skew, in seconds. Defaults to `150` seconds if set to `0` and can be disabled
-  if set to `-1`. Accepts an integer number of seconds, or a Go duration format string. Only applicable
-  with "jwt" roles.
-- `bound_subject` `(string: <optional>)` - If set, requires that the `sub`
-  claim matches this value.
-- `bound_claims` `(map: <optional>)` - If set, a map of claims (keys) to match against respective claim values (values).
-  Each expected value may be a string, integer, boolean or a list of strings. The interpretation of the bound
-  claim values is configured with `bound_claims_type`. Keys support [JSON pointer](/vault/docs/auth/jwt#claim-specifications-and-json-pointer)
-  syntax for referencing claims.
-- `bound_claims_type` `(string: "string")` - Configures the interpretation of the bound_claims values.
-  If `"string"` (the default), the values will be treated as literals and must match exactly.
-  If set to `"glob"`, the values will be interpreted as globs, with `*` matching any number of
-  characters.
-- `groups_claim` `(string: <optional>)` - The claim to use to uniquely identify
-  the set of groups to which the user belongs; this will be used as the names
-  for the Identity group aliases created due to a successful login. The claim
-  value must be a list of strings. Supports [JSON pointer](/vault/docs/auth/jwt#claim-specifications-and-json-pointer)
-  syntax for referencing claims.
-- `claim_mappings` `(map: <optional>)` - If set, a map of claims (keys) to be copied to
-  specified metadata fields (values). Keys support [JSON pointer](/vault/docs/auth/jwt#claim-specifications-and-json-pointer)
-  syntax for referencing claims.
-- `oidc_scopes` `(list: <optional>)` - If set, a list of OIDC scopes to be used with an OIDC role.
-  The standard scope "openid" is automatically included and need not be specified.
-- `allowed_redirect_uris` `(list: <required>)` - The list of allowed values for redirect_uri
-  during OIDC logins.
-- `verbose_oidc_logging` `(bool: false)` - Log received OIDC tokens and claims when debug-level
-  logging is active. Not recommended in production since sensitive information may be present
-  in OIDC responses.
-- `max_age` `(int or string: <optional>)` - Specifies the allowable elapsed time in seconds since the last
-  time the user was actively authenticated with the OIDC provider. If set, the `max_age` request parameter
-  will be included in the authentication request. See [AuthRequest](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest)
-  for additional details. Accepts an integer number of seconds, or a Go duration format string.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "policies": ["dev", "prod"],
-  "bound_subject": "sl29dlldsfj3uECzsU3Sbmh0F29Fios1@clients",
-  "bound_audiences": "https://myco.test",
-  "user_claim": "https://vault/user",
-  "groups_claim": "https://vault/groups",
-  "bound_claims": {
-    "department": "engineering",
-    "sector": "7g"
-  },
-  "claim_mappings": {
-    "preferred_language": "language",
-    "group": "group"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/auth/jwt/role/dev-role
-```
-
-## Read role
-
-Returns the previously registered role configuration.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/auth/jwt/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/auth/jwt/role/dev-role
-```
-
-### Sample response
-
-```json
-{
-  "data":{
-    "bound_subject": "sl29dlldsfj3uECzsU3Sbmh0F29Fios1@clients",
-    "bound_audiences": [
-      "https://myco.test"
-    ],
-    "bound_cidrs": [],
-    "user_claim": "https://vault/user",
-    "groups_claim": "https://vault/groups",
-    "policies": [
-      "dev",
-      "prod"
-    ],
-    "period": 0,
-    "ttl": 0,
-    "num_uses": 0,
-    "max_ttl": 0
-  },
-  ...
-}
-
-```
-
-## List roles
-
-Lists all the roles that are registered with the plugin.
-
-| Method | Path             |
-| :----- | :--------------- |
-| `LIST` | `/auth/jwt/role` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/auth/jwt/role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "dev-role",
-      "prod-role"
-    ]
-  },
-  ...
-}
-```
-
-## Delete role
-
-Deletes the previously registered role.
-
-| Method   | Path                   |
-| :------- | :--------------------- |
-| `DELETE` | `/auth/jwt/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/auth/jwt/role/dev-role
-```
-
-## OIDC authorization URL request
-
-Obtain an authorization URL from Vault to start an OIDC login flow.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/auth/jwt/oidc/auth_url` |
-
-### Parameters
-
-- `role` `(string: <optional>)` - Name of the role against which the login is being
-  attempted. Defaults to configured `default_role` if not provided.
-- `redirect_uri` `(string: <required>)` - Path to the callback to complete the login. This will be
-  of the form, "https&#x3A;//.../oidc/callback" where the leading portion is dependent on your Vault
-  server location, port, and the mount of the JWT plugin. This must be configured with Vault and the
-  provider. See [Redirect URIs](/vault/docs/auth/jwt#redirect-uris) for more information.
-- `client_nonce` `(string: <optional>)` - Optional client-provided nonce that
-  must match the `client_nonce` value provided during a subsequent request to the
-  [callback](/vault/api-docs/auth/jwt#oidc-callback) API.
-
-### Sample payload
-
-```json
-{
-  "role": "dev-role",
-  "redirect_uri": "https://vault.myco.com:8200/ui/vault/auth/jwt/oidc/callback"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/auth/jwt/oidc/auth_url
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "c701169c-64f8-26cc-0315-078e8c3ce897",
-  "data": {
-    "auth_url": "https://myco.auth0.com/authorize?client_id=r3qXcK2bezU3Sbmh0K16fatW6&nonce=851b69a9bfa5a6a5668111314414e3687891a599&redirect_uri=https%3A%2F%2Fvault.myco.com3A8200%2Fui%2Fvault%2Fauth%2Fjwt%2Foidc%2Fcallback&response_type=code&scope=openid+email+profile&state=1011e726d24960e09cfca2e04b36b38593cb6a22"
-  },
-  ...
-}
-```
-
-## OIDC callback
-
-Exchange an authorization code for an OIDC ID Token. The ID token will be further validated
-against any bound claims, and if valid a Vault token will be returned.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/auth/jwt/oidc/callback` |
-
-### Parameters
-
-- `state` `(string: <required>)` - Opaque state ID that is part of the Authorization URL and will
-  be included in the the redirect following successful authentication on the provider.
-- `nonce` `(string: <required>)` - Opaque nonce that is part of the Authorization URL and will
-  be included in the the redirect following successful authentication on the provider.
-- `code` `(string: <required>)` - Provider-generated authorization code that Vault will exchange for
-  an ID token.
-- `client_nonce` `(string: <optional>)` - Optional client-provided nonce that must
-  match the `client_nonce` value provided during the prior request to the
-  [auth_url](/vault/api-docs/auth/jwt#oidc-authorization-url-request) API.
-
-### Sample request
-
-```shell-session
-$ curl \
-    https://127.0.0.1:8200/v1/auth/jwt/oidc/callback?state=n2kfh3nsl&code=mn2ldl2nv98h2jl&nonce=ni42i2idj2jj
-```
-
-### Sample response
-
-```json
-{
-    "auth":{
-        "client_token":"f33f8c72-924e-11f8-cb43-ac59d697597c",
-        "accessor":"0e9e354a-520f-df04-6867-ee81cae3d42d",
-        "policies":[
-            "default",
-            "dev",
-            "prod"
-        ],
-        "lease_duration":2764800,
-        "renewable":true
-    },
-    ...
-}
-```
-
-## JWT login
-
-Fetch a token. This endpoint takes a signed JSON Web Token (JWT) and
-a role name for some entity. It verifies the JWT signature to authenticate that
-entity and then authorizes the entity for the given role.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `POST` | `/auth/jwt/login` |
-
-### Parameters
-
-- `role` `(string: <optional>)` - Name of the role against which the login is being
-  attempted. Defaults to configured `default_role` if not provided.
-- `jwt` `(string: <required>)` - Signed [JSON Web Token](https://tools.ietf.org/html/rfc7519) (JWT).
-
-### Sample payload
-
-```json
-{
-  "role": "dev-role",
-  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/auth/jwt/login
-```
-
-### Sample response
-
-```json
-{
-    "auth":{
-        "client_token":"f33f8c72-924e-11f8-cb43-ac59d697597c",
-        "accessor":"0e9e354a-520f-df04-6867-ee81cae3d42d",
-        "policies":[
-            "default",
-            "dev",
-            "prod"
-        ],
-        "lease_duration":2764800,
-        "renewable":true
-    },
-    ...
-}
-```
diff --git a/website/content/api-docs/auth/kerberos.mdx b/website/content/api-docs/auth/kerberos.mdx
deleted file mode 100644
index d4eba3baf2d..00000000000
--- a/website/content/api-docs/auth/kerberos.mdx
+++ /dev/null
@@ -1,410 +0,0 @@
----
-layout: api
-page_title: Kerberos - Auth Methods - HTTP API
-description: This is the API documentation for the Vault Kerberos auth method plugin.
----
-
-# Kerberos auth method (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault Kerberos auth method plugin. To
-learn more about the usage and operation, see the
-[Vault Kerberos auth method](/vault/docs/auth/kerberos).
-
-This documentation assumes the Kerberos auth method is mounted at the
-`auth/kerberos` path in Vault. Since it is possible to enable auth methods at
-any location, please update your API calls accordingly.
-
-The Kerberos auth method validates both Kerberos and LDAP authorization,
-so both configurations are required.
-
-## Configure Vault Kerberos
-
-This endpoint configures the keytab and service account to be used by Vault
-for verifying inbound SPNEGO tokens.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/auth/kerberos/config` |
-
-- `keytab` `(string: <required>)` – A base 64 representation of the contents
-  of the Kerberos keytab that will be used for verifying inbound SPNEGO tokens.
-  It should contain an entry matching the service account given. This can be
-  created through the following command: `$ base64 vault.keytab > vault.keytab.base64`.
-- `service_account` `(string: <required>)` – The service account associated
-  with both the keytab entry and an LDAP service account created for Vault. Ex.:
-  `"vault_svc"`.
-- `remove_instance_name` - Removes any instance names from a Kerberos service
-  principal name when parsing the keytab file. For example when this is set to true,
-  if a keytab has the service principal name `foo/localhost@example.com`, Vault
-  will strip the service principal name to just be `foo@example.com`. 
-- `add_group_aliases` - When set to true, Vault will add any LDAP groups found for 
-  the user as group aliases.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/kerberos/config
-```
-
-### Sample payload
-
-```json
-{
-  "add_group_aliases": false,
-  "keytab": "BQIAAAA6AAEACk1BVFJJWC5MQU4ACXZhdWx0X3N2YwAAAAFdzZSjAgAXABDwhEyRR9nRqkpP8KTn2A83AAAAAg==",
-  "remove_instance_name": false,
-  "service_account": "vault_svc"
-}
-```
-
-## Read Vault Kerberos
-
-This endpoint retrieves the service account for the Kerberos auth method.
-The keytab is not returned because it is sensitive information.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/auth/kerberos/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/kerberos/config
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "add_group_aliases": false,
-    "remove_instance_name": false,
-    "service_account": "vault_svc"
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Configure Kerberos LDAP
-
-This endpoint configures LDAP in the Kerberos auth method.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/auth/kerberos/config/ldap` |
-
-### Parameters
-
-- `url` `(string: <required>)` – The LDAP server to connect to. Examples:
-  `ldap://ldap.myorg.com`, `ldaps://ldap.myorg.com:636`. Multiple URLs can be
-  specified with commas, e.g. `ldap://ldap.myorg.com,ldap://ldap2.myorg.com`;
-  these will be tried in-order.
-- `case_sensitive_names` `(bool: false)` – If set, user and group names
-  assigned to policies within the backend will be case sensitive. Otherwise,
-  names will be normalized to lower case. Case will still be preserved when
-  sending the username to the LDAP server at login time; this is only for
-  matching local user/group definitions.
-- `starttls` `(bool: false)` – If true, issues a `StartTLS` command after
-  establishing an unencrypted connection.
-- `tls_min_version` `(string: tls12)` – Minimum TLS version to use. Accepted
-  values are `tls10`, `tls11`, `tls12` or `tls13`.
-- `tls_max_version` `(string: tls12)` – Maximum TLS version to use. Accepted
-  values are `tls10`, `tls11`, `tls12` or `tls13`.
-- `insecure_tls` `(bool: false)` – If true, skips LDAP server SSL certificate
-  verification - insecure, use with caution!
-- `certificate` `(string: "")` – CA certificate to use when verifying LDAP server
-  certificate, must be x509 PEM encoded.
-- `binddn` `(string: "")` – Distinguished name of object to bind when performing
-  user search. Example: `cn=vault,ou=Users,dc=example,dc=com`
-- `bindpass` `(string: "")` – Password to use along with `binddn` when performing
-  user search.
-- `userdn` `(string: "")` – Base DN under which to perform user search. Example:
-  `ou=Users,dc=example,dc=com`
-- `userattr` `(string: "")` – Attribute on user attribute object matching the
-  username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
-- `discoverdn` `(bool: false)` – Use anonymous bind to discover the bind DN of a
-  user.
-- `deny_null_bind` `(bool: true)` – This option prevents users from bypassing
-  authentication when providing an empty password.
-- `upndomain` `(string: "")` – The _userPrincipalDomain_ used to construct the UPN
-  string for the authenticating user. The constructed UPN will appear as
-  `[username]@UPNDomain`. Example: `example.com`, which will cause vault to bind
-  as `username@example.com`.
-- `groupfilter` `(string: "")` – Go template used when constructing the group
-  membership query. The template can access the following context variables:
-  \[`UserDN`, `Username`\]. The default is
-  `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))`,
-  which is compatible with several common directory schemas. To support
-  nested group resolution for Active Directory, instead use the following
-  query: `(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))`.
-- `groupdn` `(string: "")` – LDAP search base to use for group membership
-  search. This can be the root containing either groups or users. Example:
-  `ou=Groups,dc=example,dc=com`
-- `groupattr` `(string: "")` – LDAP attribute to follow on objects returned by
-  `groupfilter` in order to enumerate user group membership. Examples: for
-  groupfilter queries returning _group_ objects, use: `cn`. For queries
-  returning _user_ objects, use: `memberOf`. The default is `cn`.
-
-@include 'tokenfields.mdx'
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/kerberos/config/ldap
-```
-
-### Sample payload
-
-```json
-{
-  "binddn": "cn=vault,ou=Users,dc=example,dc=com",
-  "deny_null_bind": true,
-  "discoverdn": false,
-  "groupattr": "cn",
-  "groupdn": "ou=Groups,dc=example,dc=com",
-  "groupfilter": "(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))",
-  "insecure_tls": false,
-  "starttls": false,
-  "tls_max_version": "tls12",
-  "tls_min_version": "tls12",
-  "url": "ldaps://ldap.myorg.com:636",
-  "userattr": "samaccountname",
-  "userdn": "ou=Users,dc=example,dc=com"
-}
-```
-
-## Read Kerberos LDAP configuration
-
-This endpoint retrieves the LDAP configuration for the Kerberos auth method.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `GET`  | `/auth/kerberos/config/ldap` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/kerberos/config/ldap
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "binddn": "cn=vault,ou=Users,dc=example,dc=com",
-    "bindpass": "",
-    "certificate": "",
-    "deny_null_bind": true,
-    "discoverdn": false,
-    "groupattr": "cn",
-    "groupdn": "ou=Groups,dc=example,dc=com",
-    "groupfilter": "(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))",
-    "insecure_tls": false,
-    "starttls": false,
-    "tls_max_version": "tls12",
-    "tls_min_version": "tls12",
-    "upndomain": "",
-    "url": "ldaps://ldap.myorg.com:636",
-    "userattr": "samaccountname",
-    "userdn": "ou=Users,dc=example,dc=com"
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## List Kerberos LDAP groups
-
-This endpoint returns a list of existing LDAP groups in the Kerberos auth method.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `LIST` | `/auth/kerberos/groups` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/kerberos/groups
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": ["scientists", "engineers"]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Read Kerberos LDAP group
-
-This endpoint returns the policies associated with a Kerberos LDAP group.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `GET`  | `/auth/kerberos/groups/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the LDAP group.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/kerberos/groups/admins
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "policies": ["admin", "default"]
-  },
-  "renewable": false,
-  "lease_id": "",
-  "lease_duration": 0,
-  "warnings": null
-}
-```
-
-## Create/Update Kerberos LDAP group
-
-This endpoint creates or updates LDAP group policies.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/auth/kerberos/groups/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the LDAP group.
-- `policies` `(string: "")` – Comma-separated list of policies associated to the
-  group.
-
-### Sample payload
-
-```json
-{
-  "policies": "admin,default"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/kerberos/groups/admins
-```
-
-## Delete Kerberos LDAP group
-
-This endpoint deletes the LDAP group and policy association.
-
-| Method   | Path                          |
-| :------- | :---------------------------- |
-| `DELETE` | `/auth/kerberos/groups/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the LDAP group.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/kerberos/groups/admins
-```
-
-## Login with Kerberos
-
-This endpoint allows you to log in with a valid Kerberos SPNEGO
-token. This token is obtained by the client, marshalled, and
-converted to base 64 using standard encoding.
-
-Example SPNEGO token (newlines added for readability):
-
-```
-YIIFSwYGKwYBBQUCoIIFPzCCBTugDTALBgkqhkiG9xIBAgKiggUoBIIFJGCCBSAGCSq
-GSIb3EgECAgEAboIFDzCCBQugAwIBBaEDAgEOogcDBQAgAAAAo4IEB2GCBAMwggP/oA
-MCAQWhDBsKTUFUUklYLkxBTqIvMC2gAwIBA6EmMCQbBEhUVFAbHDdlZmNjZTg4MGVkM
-y5tYXRyaXgubGFuOjgyMDCjggO3MIIDs6ADAgEXoQMCAQKiggOlBIIDoXky+VDSMXqT
-Z8XqUiIfzX3+t1ROgO49WYQPoqW1EJLA6vOVtsLITTuDUw8WaLIexki07up3wiO7bKn
-unPFN3Y6VaKZfGoubVBFnLwrxqiEqytk19fiuc0bUJD5fNX+BUeHjePPmE73kRcuchC
-L5+WkbY0X37cH5uKwCWI6TxpuEc74+mvmGOdAOdisC31MO6EBnOpTlxvKOXzShVk5Xa
-rkkHjTJyjoUslgm8JVdj/uB/+x16k0bFVOuWybfeCkn4FY7OeIxypxDJgk6uHU+5jpy
-XsdXK4w5GG+TK5BI6LXW8ZH6NOhcTZnRyt1/S4Wihd6HKhL8lH6H+wPWAnN4Ym8jiSg
-7O0nIkp9su1l/umJWnLnyUdsC9ekKmCYS9MLrmaUREnKMFfrYOF283gWVmfuSWd832Q
-9PIE93vUVTfetw1OwbJXEbG7ex3BotXPJ8yaDUAz4Zv0a6zQlj6JutE7LF3JvuuQeot
-QnwPhrZTrmv7ZbmGO3GmkzbMzIwcTXCCKX8ocOo8GLmtEigAPK23FOW2Y0p1meYjF0U
-xPzU6MPxfQWiXTWflqabXug7uZh8u76rzSEEceosPxoBqMm6hSmGc85+0bzy/E7AGJM
-5ELa2Ny2KpyniPiYCap44GsFZbGM1FwJeh1bG3dJungIn7po4X2wlg00wZVlbHsBzhP
-Hys0oxVzOQfrvx88G0fH80+vyzQiQAq4ZqmZqkO0zFSsdqG8ReJvpY0eGzN6/lGwcRl
-eav7Vum/s5MalXhYUdOjB4K3A5yQArHbbLfeZlhb7d4vttzPNkmaZ9ZNTyW1GSuqDtd
-+YJ0g70aN82KQMWiK3cbJcx/1jcmaN5gjSDm0xk19G2eb8VlRpwLFAazOlpPGozPl0Y
-PD45h3Yv3AA5aMVXvEi+NvSYR3z9VXxk6A8wFJxV5NZxV2hYwmxt0S+TYXFeudXzT+W
-ySoykcsxIU6rUevmJlEqZDyD3VcdnUOE9pxrIY/cqpdBBwatorF+jIK/ytcTBjvoM6c
-LL4g4n/isWMu8Xs6lSMxZzrC3Ewv9VYMzOEFxaHUXlyIC8GCN6t9DHZNzT91TC0u5Rj
-XuLqXENczg33dACvr+yhvin/0QNBQG+EXz/E4NiBBWqtTFa0BiTVTwyrKL5OyiLcIVe
-v4l8l9vyj/ABwDacr9ZGjhFbOShCTuFFWBPNnBwPqiRBV4y1gPP4abYBmeboLrUiqwZ
-81UrP2L8rCTEtYu9q3GmW/pIHqMIHnoAMCAReigd8EgdxwBViqyCyL0+J/k2bw0upNL
-h+4wzJcFBFC/wxX2aMvvIYdQv5nWwdNLMII3l/zQ0+eRdzpKfg1ZRT6x0D5278eQLto
-9r1CqKNW515u4kD5+pE8VOwZJMVe3FmduaH2gnTLAcoYXkBUE24hcr0ExSY6kTTBWPj
-U5dsmUsj3+qrN9JruEADqw99t/EWnN3iTsHh1rOQOd9jIJ1wCIkgvnLB8Rad+q5jguG
-8qQh1WDObTlNOnezDtiuLtRb03QDo8Q4Sm72IIcLDlffVvl7WAog5TpC8qM97+Wmv0C
-sWw
-```
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/auth/kerberos/login` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "Authorization: Negotiate YIIFSw...sWw" \
-    --request POST \
-    http://127.0.0.1:8200/v1/auth/kerberos/login
-```
diff --git a/website/content/api-docs/auth/kubernetes.mdx b/website/content/api-docs/auth/kubernetes.mdx
deleted file mode 100644
index 6fb84794d5a..00000000000
--- a/website/content/api-docs/auth/kubernetes.mdx
+++ /dev/null
@@ -1,328 +0,0 @@
----
-layout: api
-page_title: Kubernetes - Auth Methods - HTTP API
-description: This is the API documentation for the Vault Kubernetes auth method plugin.
----
-
-# Kubernetes auth method (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault Kubernetes auth method plugin. To
-learn more about the usage and operation, see the
-[Vault Kubernetes auth method](/vault/docs/auth/kubernetes).
-
-This documentation assumes the Kubernetes method is mounted at the
-`/auth/kubernetes` path in Vault. Since it is possible to enable auth methods at
-any location, please update your API calls accordingly.
-
-## Configure method
-
-The Kubernetes auth method validates service account JWTs and verifies their
-existence with the Kubernetes TokenReview API. This endpoint configures the
-public key used to validate the JWT signature and the necessary information to
-access the Kubernetes API.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/auth/kubernetes/config` |
-
-### Parameters
-
-- `kubernetes_host` `(string: <required>)` - Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.
-- `kubernetes_ca_cert` `(string: "")` - PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API. NOTE: Every line must end with a newline: `\n`
-  If not set, the local CA cert will be used if running in a Kubernetes pod.
-- `token_reviewer_jwt` `(string: "")` - A service account JWT (or other token) used as a bearer
-  token to access the TokenReview API to validate other JWTs during login. If not set,
-  the local service account token is used if running in a Kubernetes pod, otherwise
-  the JWT submitted in the login payload will be used to access the Kubernetes TokenReview API.
-- `pem_keys` `(array: [])` - Optional list of PEM-formatted public keys or certificates
-  used to verify the signatures of Kubernetes service account
-  JWTs. If a certificate is given, its public key will be
-  extracted. Not every installation of Kubernetes exposes these
-  keys.
-- `disable_local_ca_jwt` `(bool: false)` - Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod.
-- `use_annotations_as_alias_metadata` `(bool: false)` - Use annotations from the client token's associated service account
-  as alias metadata for the Vault entity. Only annotations with the prefix `vault.hashicorp.com/alias-metadata-` will be used.
-  For example, if an annotation "vault.hashicorp.com/alias-metadata-foo" is configured, "foo" with its value will be added
-  to the alias metadata. NOTE: Vault will need permission to read service accounts from the Kubernetes API.
-
-### Deprecated parameters
-
--> The following fields have been deprecated and will be removed in a future release:
-
-- `disable_iss_validation` `(bool: true)` **Deprecated** Disable JWT issuer validation. Allows to skip ISS validation.
-
-- `issuer` `(string: "")` **Deprecated** Optional JWT issuer. If no issuer is specified, then this plugin will use `kubernetes/serviceaccount` as the default issuer.
-See [these instructions](/vault/docs/auth/kubernetes#discovering-the-service-account-issuer) for looking up the issuer for a given Kubernetes cluster.
-
-### Caveats
-
-If Vault is running in a Kubernetes Pod, the `kubernetes_ca_cert` and
-`token_reviewer_jwt` parameters will automatically default to the local CA cert
-(`/var/run/secrets/kubernetes.io/serviceaccount/ca.crt`) and local service
-account JWT (`/var/run/secrets/kubernetes.io/serviceaccount/token`). This
-behavior may be disabled by setting `disable_local_ca_jwt` to `true`.
-
-When Vault is running in a non-Kubernetes environment, either
-`kubernetes_ca_cert` or `pem_keys` must be set by the user.
-
-### Sample payload
-
-```json
-{
-  "kubernetes_host": "https://192.168.99.100:8443",
-  "kubernetes_ca_cert": "-----BEGIN CERTIFICATE-----\n.....\n-----END CERTIFICATE-----",
-  "pem_keys": "-----BEGIN CERTIFICATE-----\n.....\n-----END CERTIFICATE-----"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/kubernetes/config
-```
-
-## Read config
-
-Returns the previously configured config, excluding credentials.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/auth/kubernetes/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/kubernetes/config
-```
-
-### Sample response
-
-```json
-{
-  "data":{
-    "kubernetes_host": "https://192.168.99.100:8443",
-    "kubernetes_ca_cert": "-----BEGIN CERTIFICATE-----.....-----END CERTIFICATE-----",
-    "pem_keys": ["-----BEGIN CERTIFICATE-----.....", .....],
-    "disable_local_ca_jwt": false,
-    "token_reviewer_jwt_set": false
-  }
-}
-```
-
-## Create/Update role
-
-Registers a role in the auth method. Role types have specific entities
-that can perform login operations against this endpoint. Constraints specific
-to the role type must be set on the role. These are applied to the authenticated
-entities attempting to login.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/auth/kubernetes/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-- `bound_service_account_names` `(array: <required>)` - List of service account
-  names able to access this role. If set to "\*" all names are allowed.
-- `bound_service_account_namespaces` `(array: [])` - List of namespaces
-  allowed to access this role. If set to "\*" all namespaces are allowed.
-- `bound_service_account_namespace_selector` `(string: "")` - A label selector for Kubernetes
-  namespaces allowed to acces this role. Accepts either a JSON or YAML object. The value
-  should be of type
-  [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta). Currently, label selectors with `matchExpressions` are not supported.
-  If this parameter is used, the Vault requires permissions to read namespaces on the Kubernetes
-  cluster. If set with `bound_service_account_namespaces`, the conditions are `OR`ed.
-- `audience` `(string: "")` - Optional Audience claim to verify in the JWT.
-- `alias_name_source` `(string: "serviceaccount_uid")` - Configures how identity aliases are generated.
-  Valid choices are: `serviceaccount_uid`, `serviceaccount_name`
-  When `serviceaccount_uid` is specified, the machine generated UID from the service account will be used as the identity alias name.
-  When `serviceaccount_name` is specified, the service account's namespace and name will be used as the identity alias name e.g `vault/vault-auth`.
-  While it is strongly advised that you use `serviceaccount_uid`, you may also use `serviceaccount_name` in cases where
-  you want to set the alias ahead of time, and the risks are mitigated or otherwise acceptable given your use case.
-  It is very important to limit who is able to delete/create service accounts within a given cluster.
-  See the [Create an Entity Alias](/vault/api-docs/secret/identity/entity-alias#create-an-entity-alias) document
-  which further expands on the potential security implications mentioned above.
-
-@include 'tokenfields.mdx'
-
-### Sample Payload 1
-
-```json
-{
-  "bound_service_account_names": "vault-auth",
-  "bound_service_account_namespaces": "default",
-  "policies": ["dev", "prod"],
-  "max_ttl": 1800000
-}
-```
-
-### Sample Payload 2
-
-```json
-{
-  "bound_service_account_names": "vault-auth",
-  "bound_service_account_namespace_selector": "\"{\"matchLabels\":{\"stage\":\"dev\",\"vault-role\":\"dev-role\"}}",
-  "policies": ["dev", "prod"],
-  "max_ttl": 1800000
-}
-```
-
-### Sample Request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/kubernetes/role/dev-role
-```
-
-## Read role
-
-Returns the previously registered role configuration.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `GET`  | `/auth/kubernetes/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/kubernetes/role/dev-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "bound_service_account_names": "vault-auth",
-    "bound_service_account_namespaces": "default",
-    "max_ttl": 1800000,
-    "ttl": 0,
-    "period": 0,
-    "policies": ["dev", "prod"]
-  }
-}
-```
-
-## List roles
-
-Lists all the roles that are registered with the auth method.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `LIST` | `/auth/kubernetes/role`           |
-| `GET`  | `/auth/kubernetes/role?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/kubernetes/role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["dev-role", "prod-role"]
-  }
-}
-```
-
-## Delete role
-
-Deletes the previously registered role.
-
-| Method   | Path                          |
-| :------- | :---------------------------- |
-| `DELETE` | `/auth/kubernetes/role/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/kubernetes/role/dev-role
-```
-
-## Login
-
-Fetch a token. This endpoint takes a signed JSON Web Token (JWT) and
-a role name for some entity. It verifies the JWT signature to authenticate that
-entity and then authorizes the entity for the given role.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/auth/kubernetes/login` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role against which the login is being
-  attempted.
-- `jwt` `(string: <required>)` - Signed [JSON Web
-  Token](https://tools.ietf.org/html/rfc7519) (JWT) for authenticating a service
-  account.
-
-### Sample payload
-
-```json
-{
-  "role": "dev-role",
-  "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/kubernetes/login
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "client_token": "62b858f9-529c-6b26-e0b8-0457b6aacdb4",
-    "accessor": "afa306d0-be3d-c8d2-b0d7-2676e1c0d9b4",
-    "policies": ["default"],
-    "metadata": {
-      "role": "test",
-      "service_account_name": "vault-auth",
-      "service_account_namespace": "default",
-      "service_account_secret_name": "vault-auth-token-pd21c",
-      "service_account_uid": "aa9aa8ff-98d0-11e7-9bb7-0800276d99bf"
-    },
-    "lease_duration": 2764800,
-    "renewable": true
-  }
-}
-```
diff --git a/website/content/api-docs/auth/ldap.mdx b/website/content/api-docs/auth/ldap.mdx
deleted file mode 100644
index eec8772318e..00000000000
--- a/website/content/api-docs/auth/ldap.mdx
+++ /dev/null
@@ -1,492 +0,0 @@
----
-layout: api
-page_title: LDAP - Auth Methods - HTTP API
-description: This is the API documentation for the Vault LDAP auth method.
----
-
-# LDAP auth method (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault LDAP auth method. For
-general information about the usage and operation of the LDAP method, please
-see the [Vault LDAP method documentation](/vault/docs/auth/ldap).
-
-This documentation assumes the LDAP method is mounted at the `/auth/ldap`
-path in Vault. Since it is possible to enable auth methods at any location,
-please update your API calls accordingly.
-
-## Configure LDAP
-
-This endpoint configures the LDAP auth method.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/auth/ldap/config` |
-
-### Parameters
-
-- `url` `(string: ldap://127.0.0.1)` – The LDAP server to connect to. Examples:
-  `ldap://ldap.myorg.com`, `ldaps://ldap.myorg.com:636`. Multiple URLs can be
-  specified with commas, e.g. `ldap://ldap.myorg.com,ldap://ldap2.myorg.com`;
-  these will be tried in-order.
-- `case_sensitive_names` `(bool: false)` – If set, user and group names
-  assigned to policies within the backend will be case sensitive. Otherwise,
-  names will be normalized to lower case. Case will still be preserved when
-  sending the username to the LDAP server at login time; this is only for
-  matching local user/group definitions.
-- `connection_timeout` `(integer: 30 or string: "30s")` - Timeout, in seconds,
-  when attempting to connect to the LDAP server before trying the next URL in
-  the configuration.
-- `request_timeout` `(integer: 90 or string: "90s")` - Timeout, in seconds, for
-  the connection when making requests against the server before returning back
-  an error.
-- `starttls` `(bool: false)` – If true, issues a `StartTLS` command after
-  establishing an unencrypted connection.
-- `tls_min_version` `(string: tls12)` – Minimum TLS version to use. Accepted
-  values are `tls10`, `tls11`, `tls12` or `tls13`.
-- `tls_max_version` `(string: tls12)` – Maximum TLS version to use. Accepted
-  values are `tls10`, `tls11`, `tls12` or `tls13`.
-- `insecure_tls` `(bool: false)` – If true, skips LDAP server SSL certificate
-  verification - insecure, use with caution!
-- `certificate` `(string: "")` – CA certificate to use when verifying LDAP server
-  certificate, must be x509 PEM encoded.
-- `client_tls_cert` `(string "")` - Client certificate to provide to the LDAP
-  server, must be x509 PEM encoded (optional).
-- `client_tls_key` `(string "")` - Client certificate key to provide to the LDAP
-  server, must be x509 PEM encoded (optional).
-- `binddn` `(string: "")` – Distinguished name of object to bind when performing
-  user search. Example: `cn=vault,ou=Users,dc=example,dc=com`
-- `bindpass` `(string: "")` – Password to use along with `binddn` when performing
-  user search.
-- `userdn` `(string: "")` – Base DN under which to perform user search. Example:
-  `ou=Users,dc=example,dc=com`
-- `userattr` `(string: "cn")` – Attribute on user attribute object matching the
-  username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
-- `discoverdn` `(bool: false)` – Use anonymous bind to discover the bind DN of a
-  user.
-- `deny_null_bind` `(bool: true)` – This option prevents users from bypassing
-  authentication when providing an empty password.
-- `upndomain` `(string: "")` – The userPrincipalDomain used to construct the UPN
-  string for the authenticating user. The constructed UPN will appear as
-  `[username]@UPNDomain`. Example: `example.com`, which will cause vault to bind
-  as `username@example.com`.
-- `userfilter` `(string: "")` – An optional LDAP user search filter.
-  The template can access the following context variables: UserAttr, Username.
-  The default is `({{.UserAttr}}={{.Username}})`, or `({{.UserAttr}}={{.Username@.upndomain}})`
-  if `upndomain` is set. In order for the `userfilter` to be applied,
-  both `binddn` and `bindpass` must be set, or `discoverdn` must be set to `true`.
-- `anonymous_group_search` `(bool: false)` - Use anonymous binds when performing
-  LDAP group searches (note: even when `true`, the initial credentials will still
-  be used for the initial connection test).
-- `groupfilter` `(string: "")` – Go template used when constructing the group
-  membership query. The template can access the following context variables:
-  \[`UserDN`, `Username`\]. The default is
-  `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))`,
-  which is compatible with several common directory schemas. To support
-  nested group resolution for Active Directory, instead use the following
-  query: `(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))`.
-- `groupdn` `(string: "")` – LDAP search base to use for group membership
-  search. This can be the root containing either groups or users. Example:
-  `ou=Groups,dc=example,dc=com`
-- `groupattr` `(string: "")` – LDAP attribute to follow on objects returned by
-  `groupfilter` in order to enumerate user group membership. Examples: for
-  groupfilter queries returning _group_ objects, use: `cn`. For queries
-  returning _user_ objects, use: `memberOf`. The default is `cn`.
-- `username_as_alias` `(bool: false)` - If set to true, forces the auth method
-  to use the username passed by the user as the alias name.
-- `dereference_aliases` `(string: never)` - When aliases should be dereferenced
-  on search operations. Accepted values are 'never', 'finding', 'searching',
-  'always'. Defaults to 'never'.
-- `max_page_size` `(int: 0)` - If set to a value greater than 0, the LDAP
-  backend will use the LDAP server's paged search control to request pages of
-  up to the given size. This can be used to avoid hitting the LDAP server's
-  maximum result size limit. Otherwise, the LDAP backend will not use the
-  paged search control.
-- `use_token_groups` `(bool: true)` - (Optional) Use the Active Directory tokenGroups
-  constructed attribute of the user to find the group memberships.
-
-@include 'tokenfields.mdx'
-
-@include 'ldap-auth-userfilter-warning.mdx'
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/ldap/config
-```
-
-### Sample payload
-
-```json
-{
-  "binddn": "cn=vault,ou=Users,dc=example,dc=com",
-  "deny_null_bind": true,
-  "discoverdn": false,
-  "groupattr": "cn",
-  "groupdn": "ou=Groups,dc=example,dc=com",
-  "groupfilter": "(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))",
-  "insecure_tls": false,
-  "starttls": false,
-  "tls_max_version": "tls12",
-  "tls_min_version": "tls12",
-  "url": "ldaps://ldap.myorg.com:636",
-  "username_as_alias": false,
-  "userattr": "samaccountname",
-  "userdn": "ou=Users,dc=example,dc=com",
-  "max_page_size": 1000
-}
-```
-
-## Read LDAP configuration
-
-This endpoint retrieves the LDAP configuration for the auth method.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/auth/ldap/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/ldap/config
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "binddn": "cn=vault,ou=Users,dc=example,dc=com",
-    "bindpass": "",
-    "certificate": "",
-    "deny_null_bind": true,
-    "discoverdn": false,
-    "groupattr": "cn",
-    "groupdn": "ou=Groups,dc=example,dc=com",
-    "groupfilter": "(\u0026(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))",
-    "insecure_tls": false,
-    "starttls": false,
-    "tls_max_version": "tls12",
-    "tls_min_version": "tls12",
-    "upndomain": "",
-    "url": "ldaps://ldap.myorg.com:636",
-    "username_as_alias": false,
-    "userattr": "samaccountname",
-    "userdn": "ou=Users,dc=example,dc=com"
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## List LDAP groups
-
-This endpoint returns a list of existing groups in the method.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `LIST` | `/auth/ldap/groups` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/ldap/groups
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": ["scientists", "engineers"]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Read LDAP group
-
-This endpoint returns the policies associated with a LDAP group.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/auth/ldap/groups/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the LDAP group
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/ldap/groups/admins
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "policies": [
-      "admin",
-      "default"
-    ]
-  },
-  "renewable": false,
-  "lease_id": ""
-  "lease_duration": 0,
-  "warnings": null
-}
-```
-
-## Create/Update LDAP group
-
-This endpoint creates or updates LDAP group policies.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/auth/ldap/groups/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the LDAP group
-- `policies` `(string: "")` – Comma-separated list of policies associated to the
-  group.
-
-### Sample payload
-
-```json
-{
-  "policies": "admin,default"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/ldap/groups/admins
-```
-
-## Delete LDAP group
-
-This endpoint deletes the LDAP group and policy association.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/auth/ldap/groups/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the LDAP group
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/ldap/groups/admins
-```
-
-## List LDAP users
-
-This endpoint returns a list of existing users in the method.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `LIST` | `/auth/ldap/users` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/ldap/users
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": ["mitchellh", "armon"]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Read LDAP user
-
-This endpoint returns the policies associated with a LDAP user.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `GET`  | `/auth/ldap/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` – The username of the LDAP user
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/ldap/users/mitchellh
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "policies": [
-      "admin",
-      "default"
-    ],
-    "groups": ""
-  },
-  "renewable": false,
-  "lease_id": ""
-  "lease_duration": 0,
-  "warnings": null
-}
-```
-
-## Create/Update LDAP user
-
-This endpoint creates or updates LDAP users policies and group associations.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/auth/ldap/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` – The username of the LDAP user
-- `policies` `(string: "")` – Comma-separated list of policies associated to the
-  user.
-- `groups` `(string: "")` – Comma-separated list of groups associated to the
-  user.
-
-### Sample payload
-
-```json
-{
-  "policies": "admin,default"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/ldap/users/mitchellh
-```
-
-## Delete LDAP user
-
-This endpoint deletes the LDAP user and policy association.
-
-| Method   | Path                         |
-| :------- | :--------------------------- |
-| `DELETE` | `/auth/ldap/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` – The username of the LDAP user
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/ldap/users/mitchellh
-```
-
-## Login with LDAP user
-
-This endpoint allows you to log in with LDAP credentials
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/auth/ldap/login/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` – The username of the LDAP user
-- `password` `(string: <required>)` – The password for the LDAP user.
-When authenticating with the Vault CLI, i.e. `vault login -method=ldap username=mitchellh`
-the password can alternatively be supplied via the `VAULT_LDAP_PASSWORD` environment variable.
-
-### Sample payload
-
-```json
-{
-  "password": "MyPassword1"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/ldap/login/mitchellh
-```
-
-### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": null,
-  "auth": {
-    "client_token": "c4f280f6-fdb2-18eb-89d3-589e2e834cdb",
-    "policies": ["admins", "default"],
-    "metadata": {
-      "username": "mitchellh"
-    },
-    "lease_duration": 0,
-    "renewable": false
-  }
-}
-```
diff --git a/website/content/api-docs/auth/oci.mdx b/website/content/api-docs/auth/oci.mdx
deleted file mode 100644
index ed3886ebd2c..00000000000
--- a/website/content/api-docs/auth/oci.mdx
+++ /dev/null
@@ -1,243 +0,0 @@
----
-layout: api
-page_title: OCI - Auth Methods - HTTP API
-description: This is the API documentation for the Vault OCI auth method plugin.
----
-
-# OCI auth method (API)
-
-This is the API documentation for the Vault OCI auth method plugin. To
-learn more about the usage and operation, see the
-[Vault OCI auth method](/vault/docs/auth/oci).
-
-This documentation assumes the OCI method is mounted at the
-`/auth/oci` path in Vault. Since it is possible to enable auth methods at
-any location, please update your API calls accordingly.
-
-## Configure home tenancy method
-
-Configure your home tenancy in the Vault, so that only users or instances from your tenancy will be allowed to log into Vault, through the OCI Auth method.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/auth/oci/config` |
-
-### Parameters
-
-- `home_tenancy_id` `(string: <required>)` - The Tenancy OCID of your OCI account.
-
-### Sample payload
-
-```json
-{
-  "home_tenancy_id": "ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/oci/config
-```
-
-## Read config
-
-Returns the previously configured config.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/auth/oci/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/oci/config
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "home_tenancy_id": "ocid1.tenancy.oc1..aaaaaaaah7zkvaffv26pzyauoe2zbnionqvhvsexamplee557wakiofi4ysgqq"
-  }
-}
-```
-
-## Create/Update role
-
-Create a Vault administrator role in the OCI Auth method.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/auth/oci/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-- `ocid_list` `(string: <required>)` - A comma separated list of Group or Dynamic Group OCIDs that can take this role.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "ocid_list": "ocid1.group.oc1..aaaaaaaaiqnblimpvmegkqh3bxilrdvjobr7qd223g275idcqhexamplefq,ocid1.dynamicgroup.oc1..aaaaaaaa5hmfyrdaxvmt52ekju5n7ffamn2pdvxaq6esb2vzzoduexamplea",
-  "token_policies": ["dev", "prod"],
-  "token_ttl": 1800
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/oci/role/devrole
-```
-
-## Read role
-
-Returns the previously registered role configuration.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/auth/oci/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/oci/role/devrole
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "ocid_list": [
-      "ocid1.group.oc1..aaaaaaaaiqnblimpvmegkqh3bxilrdvjobr7qd223g275idcqhexamplefq",
-      "ocid1.dynamicgroup.oc1..aaaaaaaa5hmfyrdaxvmt52ekju5n7ffamn2pdvxaq6esb2vzzoduexamplea"
-    ],
-    "token_ttl": 1800,
-    "token_policies": ["dev", "prod"]
-  }
-}
-```
-
-## List roles
-
-Lists all the roles that are registered with the auth method.
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `LIST` | `/auth/oci/role`           |
-| `GET`  | `/auth/oci/role?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/oci/role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["devrole", "prodrole"]
-  }
-}
-```
-
-## Delete role
-
-Deletes the previously registered role.
-
-| Method   | Path                   |
-| :------- | :--------------------- |
-| `DELETE` | `/auth/oci/role/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/oci/role/devrole
-```
-
-## Login
-
-Fetch a token. This endpoint takes signed request headers and
-a role name for some entity. It verifies the signed request headers to authenticate that
-entity and then authorizes the entity for the given role.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/auth/oci/login/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role against which the login is being attempted.
-- `request_headers` `(list: [])` - Signed request headers for authenticating. For details on signing, see [signing the request](https://docs.cloud.oracle.com/iaas/Content/API/Concepts/signingrequests.htm)
-
-### Sample payload
-
-```json
-{
-  "request_headers": {
-    "date": ["Fri, 22 Aug 2019 21:02:19 GMT"],
-    "(request-target)": ["get /v1/auth/oci/login/devrole"],
-    "host": ["127.0.0.1"],
-    "content-type": ["application/json"],
-    "authorization": [
-      "Signature algorithm=\"rsa-sha256\",headers=\"date (request-target) host\",keyId=\"ocid1.tenancy.oc1..aaaaaaaaba3pv6wkcr4jqae5f15p2b2m2yt2j6rx32uzr4h25vqstifsfdsq/ocid1.user.oc1..aaaaaaaat5nvwcna5j6aqzjcaty5eqbb6qt2jvpkanghtgdaqedqw3rynjq/73:61:a2:21:67:e0:df:be:7e:4b:93:1e:15:98:a5:b7\",signature=\"GBas7grhyrhSKHP6AVIj/h5/Vp8bd/peM79H9Wv8kjoaCivujVXlpbKLjMPeDUhxkFIWtTtLBj3sUzaFj34XE6YZAHc9r2DmE4pMwOAy/kiITcZxa1oHPOeRheC0jP2dqbTll8fmTZVwKZOKHYPtrLJIJQHJjNvxFWeHQjMaR7M=\",version=\"1\""
-    ]
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/oci/login/devrole
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "token": "62b8ssf9-529c-6b26-e0b8-045fcdb4",
-    "token_accessor": "afaff6d0-be3d-c8d2-b0d7-2676sss0d9b4",
-    "token_policies": ["dev"],
-    "token_duration": 1800
-  }
-}
-```
diff --git a/website/content/api-docs/auth/okta.mdx b/website/content/api-docs/auth/okta.mdx
deleted file mode 100644
index 5a6ad1eed72..00000000000
--- a/website/content/api-docs/auth/okta.mdx
+++ /dev/null
@@ -1,434 +0,0 @@
----
-layout: api
-page_title: Okta - Auth Methods - HTTP API
-description: This is the API documentation for the Vault Okta auth method.
----
-
-# Okta auth method (API)
-
-This is the API documentation for the Vault Okta auth method. For
-general information about the usage and operation of the Okta method, please
-see the [Vault Okta method documentation](/vault/docs/auth/okta).
-
-This documentation assumes the Okta method is mounted at the `/auth/okta`
-path in Vault. Since it is possible to enable auth methods at any location,
-please update your API calls accordingly.
-
-## Create configuration
-
-Configures the connection parameters for Okta. This path honors the
-distinction between the `create` and `update` capabilities inside ACL policies.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/auth/okta/config` |
-
-### Parameters
-
-- `org_name` `(string: <required>)` - Name of the organization to be used in the
-  Okta API.
-- `api_token` `(string: "")` - Okta API token. This is required to query Okta
-  for user group membership. If this is not supplied only locally configured
-  groups will be enabled.
-  **Support for okta auth without api_token is deprecated in Vault 1.4**
-- `base_url` `(string: "")` - If set, will be used as the base domain
-  for API requests. If unset, "okta.com" will be used. Other valid examples
-  are oktapreview.com, and okta-emea.com.
-- `bypass_okta_mfa` `(bool: false)` - Whether to bypass an Okta MFA request.
-  Useful if using one of Vault's built-in MFA mechanisms, but this will also
-  cause certain other statuses to be ignored, such as `PASSWORD_EXPIRED`.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "org_name": "example",
-  "api_token": "abc123"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/okta/config
-```
-
-## Read configuration
-
-Reads the Okta configuration.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/auth/okta/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/okta/config
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "812229d7-a82e-0b20-c35b-81ce8c1b9fa6",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "base_url": "okta.com",
-    "bypass_okta_mfa": false,
-    "org_name": "example",
-    "token_bound_cidrs": [],
-    "token_explicit_max_ttl": 0,
-    "token_max_ttl": 0,
-    "token_no_default_policy": false,
-    "token_num_uses": 0,
-    "token_period": 0,
-    "token_policies": [],
-    "token_ttl": 0,
-    "token_type": "default"
-  },
-  "warnings": null
-}
-```
-
-## List users
-
-List the users configured in the Okta method.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `LIST` | `/auth/okta/users` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/okta/users
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": ["fred", "jane"]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Register user
-
-Registers a new user and maps a set of policies to it.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/auth/okta/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` - Name of the user.
-- `groups` `(array: [])` - List or comma-separated string of groups associated with the user.
-- `policies` `(array: [])` - List or comma-separated string of policies associated with the user.
-
-```json
-{
-  "policies": ["dev", "prod"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/okta/users/fred
-```
-
-## Read user
-
-Reads the properties of an existing username.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `GET`  | `/auth/okta/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` - Username for this user.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/okta/users/test-user
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "812229d7-a82e-0b20-c35b-81ce8c1b9fa6",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "policies": ["default", "dev"],
-    "groups": []
-  },
-  "warnings": null
-}
-```
-
-## Delete user
-
-Deletes an existing username from the method.
-
-| Method   | Path                         |
-| :------- | :--------------------------- |
-| `DELETE` | `/auth/okta/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` - Username for this user.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/okta/users/test-user
-```
-
-## List groups
-
-List the groups configured in the Okta method.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `LIST` | `/auth/okta/groups` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/okta/groups
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": ["admins", "dev-users"]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Register group
-
-Registers a new group and maps a set of policies to it.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/auth/okta/groups/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the group.
-- `policies` `(array: [])` - The list or comma-separated string of policies associated with the group.
-
-```json
-{
-  "policies": ["dev", "prod"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/okta/groups/admins
-```
-
-## Read group
-
-Reads the properties of an existing group.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/auth/okta/groups/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name for the group.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/okta/groups/admins
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "812229d7-a82e-0b20-c35b-81ce8c1b9fa6",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "policies": ["default", "admin"]
-  },
-  "warnings": null
-}
-```
-
-## Delete group
-
-Deletes an existing group from the method.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/auth/okta/groups/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name for the group.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/okta/users/test-user
-```
-
-## Login
-
-Login with the username and password.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/auth/okta/login/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` - Username for this user.
-- `password` `(string: <required>)` - Password for the authenticating user.
-- `totp` `(string: <optional>)` - Okta Verify TOTP passcode.
-- `provider` `(string: <optional>)` - MFA TOTP factor provider. `GOOGLE` and `OKTA` are currently supported.
-- `nonce` `(string: <optional>)` - Nonce provided during a login request to
-  retrieve the number verification challenge for the matching request.
-
-### Sample payload
-
-```json
-{
-  "password": "Password!"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/okta/login/fred
-```
-
-### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": null,
-  "warnings": null,
-  "auth": {
-    "client_token": "64d2a8f2-2a2f-5688-102b-e6088b76e344",
-    "accessor": "18bb8f89-826a-56ee-c65b-1736dc5ea27d",
-    "policies": ["default"],
-    "metadata": {
-      "username": "fred",
-      "policies": "default"
-    },
-    "lease_duration": 7200,
-    "renewable": true
-  }
-}
-```
-
-## Verify
-
-Verify a number challenge that may result from an Okta Verify Push challenge.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `GET`  | `/auth/okta/verify/:nonce`   |
-
-### Parameters
-
-- `nonce` `(string: <required>)` - Nonce provided if performing login that
-requires number verification challenge. Logins through the vault login CLI
-command will automatically generate a nonce.
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/auth/okta/verify/nonce/BCR66Ru6oJKPtC00PxJJ
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "de6a8029-79e5-1dd1-dbe9-6405166b3f94",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "correct_answer": 94
-  },
-  "warnings": null
-}
-```
-
diff --git a/website/content/api-docs/auth/radius.mdx b/website/content/api-docs/auth/radius.mdx
deleted file mode 100644
index ba71ec2ceb5..00000000000
--- a/website/content/api-docs/auth/radius.mdx
+++ /dev/null
@@ -1,233 +0,0 @@
----
-layout: api
-page_title: RADIUS - Auth Methods - HTTP API
-description: This is the API documentation for the Vault RADIUS auth method.
----
-
-# RADIUS auth method (API)
-
-This is the API documentation for the Vault RADIUS auth method. For
-general information about the usage and operation of the RADIUS method, please
-see the [Vault RADIUS method documentation](/vault/docs/auth/radius).
-
-This documentation assumes the RADIUS method is mounted at the `/auth/radius`
-path in Vault. Since it is possible to enable auth methods at any location,
-please update your API calls accordingly.
-
-## Configure RADIUS
-
-Configures the connection parameters and shared secret used to communicate with
-RADIUS.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `POST` | `/auth/radius/config` |
-
-### Parameters
-
-- `host` `(string: <required>)` - The RADIUS server to connect to. Examples:
-  `radius.myorg.com`, `127.0.0.1`
-- `port` `(integer: 1812)` - The UDP port where the RADIUS server is listening
-  on. Defaults is 1812.
-- `secret` `(string: <required>)` - The RADIUS shared secret.
-- `unregistered_user_policies` `(string: "")` - A comma-separated list of
-  policies to be granted to unregistered users.
-- `dial_timeout` `(integer: 10)` - Number of second to wait for a backend
-  connection before timing out. Default is 10.
-- `nas_port` `(integer: 10)` - The NAS-Port attribute of the RADIUS request.
-  Defaults is 10.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "host": "radius.myorg.com",
-  "port": 1812,
-  "secret": "mySecret"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/radius/config
-```
-
-## Register user
-
-Registers a new user and maps a set of policies to it. This path honors the
-distinction between the `create` and `update` capabilities inside ACL policies.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/auth/radius/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` - Username for this user.
-- `policies` `(string: "")` - Comma-separated list of policies. If set to
-  empty string, only the `default` policy will be applicable to the user.
-
-```json
-{
-  "policies": "dev,prod"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/radius/users/test-user
-```
-
-## Read user
-
-Reads the properties of an existing username.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/auth/radius/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` - Username for this user.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/radius/users/test-user
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "812229d7-a82e-0b20-c35b-81ce8c1b9fa6",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "policies": "default,dev"
-  },
-  "warnings": null
-}
-```
-
-## Delete user
-
-Deletes an existing username from the method.
-
-| Method   | Path                           |
-| :------- | :----------------------------- |
-| `DELETE` | `/auth/radius/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` - Username for this user.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/radius/users/test-user
-```
-
-## List users
-
-List the users registered with the method.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `LIST` | `/auth/radius/users` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/radius/users
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": ["devuser", "produser"]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Login
-
-Login with the username and password.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/auth/radius/login`           |
-| `POST` | `/auth/radius/login/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` - Username for this user.
-- `password` `(string: <required>)` - Password for the authenticating user.
-
-### Sample payload
-
-```json
-{
-  "password": "Password!"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/radius/login/test-user
-```
-
-### Sample response
-
-```javascript
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": null,
-  "warnings": null,
-  "auth": {
-    "client_token": "64d2a8f2-2a2f-5688-102b-e6088b76e344",
-    "accessor": "18bb8f89-826a-56ee-c65b-1736dc5ea27d",
-    "policies": ["default"],
-    "metadata": {
-      "username": "vishal"
-    },
-  },
-  "lease_duration": 7200,
-  "renewable": true
-}
-```
diff --git a/website/content/api-docs/auth/saml.mdx b/website/content/api-docs/auth/saml.mdx
deleted file mode 100644
index e1fe74d3713..00000000000
--- a/website/content/api-docs/auth/saml.mdx
+++ /dev/null
@@ -1,445 +0,0 @@
----
-layout: api
-page_title: SAML - Auth Methods - HTTP API
-description: |-
-  This is the API documentation for the Vault SAML auth method.
----
-
-# SAML auth method (API)
-
-<EnterpriseAlert />
-
-This is the API documentation for the Vault SAML auth method. To learn more about the
-usage and operation, see the [Vault SAML auth method documentation](/vault/docs/auth/saml).
-
-This documentation assumes the SAML auth method is mounted at the `/auth/saml` path in
-Vault. Since it is possible to enable auth methods at any location, please update your
-API calls accordingly.
-
-## Create or update configuration
-
-Configures the auth method with a SAML identity provider.
-
-| Method     | Path                |
-|:-----------| :------------------ |
-| `POST/PUT` | `/auth/saml/config` |
-
-### Parameters
-
-- `idp_metadata_url` `(string, <required>)` - The metadata URL of the identity provider.
-  Mutually exclusive with `idp_sso_url`, `idp_issuer` and `idp_cert`. Must be a
-  well-formatted URL.
-- `idp_sso_url` `(string, <required if idp_metadata_url is not set>)` - The SSO URL of the
-  identity provider. Mutually exclusive with `idp_metadata_url`. Must be a
-  well-formatted URL.
-- `idp_entity_id` `(string, <required if idp_metadata_url is not set>)` - The entity ID of
-  the identity provider. Mutually exclusive with `idp_metadata_url`.
-- `idp_cert` `(string, <required if idp_metadata_url is not set>)` - The PEM-encoded
-  certificate of the identity provider used to verify response and assertion signatures.
-  Mutually exclusive with `idp_metadata_url`.
-- `entity_id` `(string, <required>)` - The entity ID of the SAML authentication
-  service provider. Must match entity ID configured for the application in the
-  SAML identity provider.
-- `acs_urls` `(list, <required>)` - The well-formated URLs of your Assertion
-  Consumer Service (ACS) that should receive a response from the identity
-  provider. Vault returns a security warning if any of the given URLs lack TLS
-  protection.
-- `default_role` `(string, <optional>)` - The role to use if no role is provided during login.
-  If not set, a role is required during login.
-- `verbose_logging` `(bool, false)` - **Not recommended for production**. Log
-  additional, **potentially sensitive** information during the SAML exchange
-  according to the current logging level. When `verbose_logging` is `true`,
-  debug-level logs provide user attributes and trace-level logs provide the full
-  SAML response.
-
-### Sample payload
-
-```json
-{
-  "acs_urls": "https://my.vault/v1/auth/saml/callback",
-  "default_role": "admin",
-  "entity_id": "https://my.vault/v1/auth/saml",
-  "idp_metadata_url": "https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request PUT \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/saml/config
-```
-
-## Read configuration
-
-Reads the auth method configuration.
-
-| Method  | Path                |
-| :------ | :------------------ |
-| `GET`   | `/auth/saml/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/saml/config
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "09c907d2-2dbe-8a5c-ca97-fad83195738b",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "acs_urls": [
-      "https://my.vault/v1/auth/saml/callback"
-    ],
-    "default_role": "admin",
-    "entity_id": "https://my.vault/v1/auth/saml",
-    "idp_metadata_url": "https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata"
-  },
-  "warnings": null
-}
-```
-
-## Create or update role
-
-Configures a role in the auth method. Roles define specific constraints required for
-authentication and properties of resulting Vault tokens.
-
-| Method     | Path                     |
-|:-----------|:-------------------------|
-| `POST/PUT` | `/auth/saml/role/:name`  |
-
-### Parameters
-
-- `name` `(string: <required>)` - URL parameter that provides the name of the role to create.
-- `bound_subjects` `(string: <optional>)` - The subject being asserted for SAML
-  authentication. One of the provided values must match the subject returned in
-  the SAML assertion from the identity provider.
-- `bound_subjects_type` `(string: <optional>)` - The type of matching assertion to perform
-  on `bound_subjects`. If `string`, requires a direct string match. If `glob`, allows for
-  wildcard matching using the `*` character.
-- `bound_attributes` `(map: <optional>)` - Mapping of attribute names to values that are
-  expected to exist in the SAML assertion. The expected value may be a single string or a
-  comma-separated list of strings. The user will be authenticated if the SAML attributes
-  match at least one of the expected values.
-- `bound_attributes_type` `(string: "string")` - The type of matching assertion to perform
-  on the key-value pairs provided by `bound_attributes`. If set to `string`, a direct string
-  match is required. If set to `glob`, allows for wildcard matching using the `*` character.
-- `groups_attribute` `(string: <optional>)` - The attribute to use to identify the set of
-  groups to which the user belongs. This will be used as the names for the Identity group
-  aliases created due to a successful login.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "bound_attributes": "group=admin",
-  "bound_subjects": "*@hashicorp.com",
-  "bound_subjects_type": "glob",
-  "token_policies": "writer",
-  "ttl": "1h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request PUT \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/saml/role/admin
-```
-
-## Read role
-
-Reads a configured role.
-
-| Method | Path                    |
-| :----- |:------------------------|
-| `GET`  | `/auth/saml/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - URL parameter that provides the name of the
-  role to read.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/auth/saml/role/admin
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "3148ca9a-286e-a0a4-5a4b-31b6abb63d37",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "bound_attributes": {
-      "group": [
-        "admin"
-      ]
-    },
-    "bound_attributes_type": "string",
-    "bound_subjects": [
-      "*@hashicorp.com"
-    ],
-    "bound_subjects_type": "glob",
-    "groups_attribute": "",
-    "token_bound_cidrs": [],
-    "token_explicit_max_ttl": 0,
-    "token_max_ttl": 0,
-    "token_no_default_policy": false,
-    "token_num_uses": 0,
-    "token_period": 0,
-    "token_policies": [
-      "writer"
-    ],
-    "token_ttl": 0,
-    "token_type": "default"
-  },
-  "warnings": null
-}
-```
-
-## List roles
-
-Lists all the configured roles.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `LIST` | `/auth/saml/role` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/auth/saml/role?list=true
-```
-
-### Sample response
-
-```json
-[
-  "admin",
-  "operations"
-]
-```
-
-## Delete Role
-
-Deletes a configured role.
-
-| Method   | Path                    |
-| :------- | :---------------------- |
-| `DELETE` | `/auth/saml/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - URL parameter that provides the name of the
-  role to delete.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/saml/role/admin
-```
-
-## Obtain SSO service URL
-
-Starts a login flow by providing a SAML Single Sign-On (SSO) Service URL for the
-configured identity provider. The returned `token_poll_id` can be used to obtain
-the Vault token after the user is authenticated with the identity provider and the
-SAML response has passed validation.
-
-<Note title="Unauthenticated">
-A Vault token is not required to interact with this API.
-</Note>
-
-| Method  | Path                         |
-|:--------|:-----------------------------|
-| `POST`  | `/auth/saml/sso_service_url` |
-
-### Parameters
-
-- `role` `(string, <optional>)` - The role name to use for the login flow.
-  Defaults to the role configured with `default_role`.
-- `client_challenge` `(string, <required>)` - The client challenge value. Must be the
-  output of a base64-encoded, sha256 digest of the `client_verifier` eventually provided
-  to the [Token API](/vault/api-docs/auth/saml#obtain-vault-token). Must be at least 44
-  bytes in length.
-- `client_type` `(string, <required>)` - The type of the requesting client. The response
-  from the Assertion Consumer Service [Callback API](/vault/api-docs/auth/saml#assertion-consumer-service-callback)
-  will differ based on the provided type. If `cli`, an HTML success page will be returned
-  in the response. If `browser`, a blank HTML page will be returned in the response.
-- `acs_url` `(string, <required>)` - The URL where the identity provider will send its
-  SAML response. Must be in the set of configured [`acs_urls`](/vault/api-docs/auth/saml#acs_urls).
-
-### Sample payload
-
-```json
-{
-  "acs_url": "https://my.vault/v1/auth/saml/callback",
-  "client_challenge": "Z6+7owP80d1aHTha1kdixtT99JkvmG4TPSgbvDwZ70A=",
-  "client_type": "cli",
-  "role": "admin"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/saml/sso_service_url
-```
-
-### Sample response
-
-```json
-{
-  "sso_service_url": "https://example.okta.com/app/abc123eb9xnIfzlaf697/id/sso/saml?RelayState=...&SAMLRequest=...",
-  "token_poll_id": "ee442348-159b-df10-4c59-63050069df4d"
-}
-```
-
-## Assertion consumer service callback
-
-The assertion consumer service URL of the auth method. Completes the round trip from
-the identity provider and performs validations on the SAML response.
-
-<Note title="Unauthenticated">
-A Vault token is not required to interact with this API.
-</Note>
-
-| Method  | Path                  |
-|:--------|:----------------------|
-| `POST`  | `/auth/saml/callback` |
-
-### Parameters
-
-- `RelayState` `(string, <required>)` - The relay state from the original SAML
-  authentication request that was returned by the identity provider.
-- `SAMLResponse` `(string, <required>)` - The signed SAML response from the identity
-  provider.
-
-### Sample payload
-
-```json
-{
-  "RelayState": "0afe62a9-7b83-a182-0650-c749badfb900",
-  "SAMLResponse": "..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/saml/callback
-```
-
-## Obtain vault token
-
-The token endpoint completes the login flow by returning a Vault token.
-
-<Note title="Unauthenticated">
-A Vault token is not required to interact with this API.
-</Note>
-
-| Method  | Path               |
-|:--------|:-------------------|
-| `POST`  | `/auth/saml/token` |
-
-### Parameters
-
-- `client_verifier` `(string, <required>)` - The value which produced the `client_challenge`
-  provided to the [SSO Service URL API](/vault/api-docs/auth/saml#obtain-sso-service-url)
-  at the start of the authentication flow. Its base64-encoded, sha256 digest must match the
-  `client_challenge` value.
-- `token_poll_id` `(string, <required>)` - The `token_poll_id` value returned from the
-  [SSO Service URL API](/vault/api-docs/auth/saml#obtain-sso-service-url) at the start of
-  the authentication flow.
-
-### Sample payload
-
-```json
-{
-  "client_verifier": "59634224-5869-6002-e0b1-35370b8f6b82",
-  "token_poll_id": "ee442348-159b-df10-4c59-63050069df4d"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/saml/token
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "b16f7cf9-0970-2e64-69d6-f00d055e93c4",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": null,
-  "warnings": null,
-  "auth": {
-    "client_token": "hvs.CAES...",
-    "accessor": "Rl4gU4amxzBFpFBJixv8xJBK",
-    "policies": [
-      "default",
-      "writer"
-    ],
-    "token_policies": [
-      "default",
-      "writer"
-    ],
-    "identity_policies": null,
-    "metadata": {
-      "role": "admin"
-    },
-    "orphan": true,
-    "entity_id": "afd74442-6c48-3d2f-9449-689ce050ba88",
-    "lease_duration": 3600,
-    "renewable": true,
-    "mfa_requirement": null
-  }
-}
-```
diff --git a/website/content/api-docs/auth/token.mdx b/website/content/api-docs/auth/token.mdx
deleted file mode 100644
index 5301b17702a..00000000000
--- a/website/content/api-docs/auth/token.mdx
+++ /dev/null
@@ -1,851 +0,0 @@
----
-layout: api
-page_title: Token - Auth Methods - HTTP API
-description: This is the API documentation for the Vault token auth method.
----
-
-# Token auth method (API)
-
-This is the API documentation for the Vault token auth method. For
-general information about the usage and operation of the token method, please
-see the [Vault Token method documentation](/vault/docs/auth/token).
-
-## List accessors
-
-This endpoint lists token accessor. This requires `sudo` capability, and access
-to it should be tightly controlled as the accessors can be used to revoke very
-large numbers of tokens and their associated leases at once.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `LIST` | `/auth/token/accessors` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/token/accessors
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "warnings": null,
-  "wrap_info": null,
-  "data": {
-    "keys": [
-      "476ea048-ded5-4d07-eeea-938c6b4e43ec",
-      "bb00c093-b7d3-b0e9-69cc-c4d85081165b"
-    ]
-  },
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": ""
-}
-```
-
-## Create token
-
-Creates a new token. Certain options are only available when called by a
-root token. If used via the `/auth/token/create-orphan` endpoint, a root
-token is not required to create an orphan token (otherwise set with the
-`no_parent` option). If used with a role name in the path, the token will
-be created against the specified role name; this may override options set
-during this call.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `POST` | `/auth/token/create`            |
-| `POST` | `/auth/token/create-orphan`     |
-| `POST` | `/auth/token/create/:role_name` |
-
-### Parameters
-
-- `id` `(string: "")` – The ID of the client token. Can only be specified by a
-  root token. The ID provided may not contain a `.` character. Otherwise, the
-  token ID is a randomly generated value.
-
-  _Note:_ The ID should not start with the `s.` prefix.
-
-- `role_name` `(string: "")` – The name of the token role.
-- `policies` `(array: "")` – A list of policies for the token. This must be a
-  subset of the policies belonging to the token making the request, unless
-  the calling token is root or contains `sudo` capabilities to `auth/token/create`.
-  If not specified, defaults to all the policies of the calling token.
-- `meta` `(map: {})` – A map of string to string valued metadata. This is
-  passed through to the audit devices.
-- `no_parent` `(bool: false)` - This argument only has effect if used by a root
-  or sudo caller. When set to true, the token created will not have a parent.
-- `no_default_policy` `(bool: false)` - If true the `default` policy will not be
-  contained in this token's policy set.
-- `renewable` `(bool: true)` - Set to `false` to disable the ability of the token
-  to be renewed past its initial TTL. Setting the value to `true` will allow
-  the token to be renewable up to the system/mount maximum TTL.
-- `lease` `(string: "")` - DEPRECATED; use `ttl` instead
-- `ttl` `(string: "")` - The TTL period of the token, provided as "1h", where
-  hour is the largest suffix. If not provided, the token is valid for the
-  [default lease TTL](/vault/docs/configuration), or indefinitely if the
-  root policy is used.
-- `type` `(string: "")` - The token type. Can be "batch" or "service". Defaults
-  to the type specified by the role configuration named by `role_name`.
-- `explicit_max_ttl` `(string: "")` - If set, the token will have an explicit
-  max TTL set upon it. This maximum token TTL _cannot_ be changed later, and
-  unlike with normal tokens, updates to the system/mount max TTL value will
-  have no effect at renewal time -- the token will never be able to be renewed
-  or used past the value set at issue time.
-- `display_name` `(string: "token")` - The display name of the token.
-- `num_uses` `(integer: 0)` - The maximum uses for the given token. This can be
-  used to create a one-time-token or limited use token. The value of 0 has no
-  limit to the number of uses.
-- `period` `(string: "")` - If specified, the token will be periodic; it will have
-  no maximum TTL (unless an "explicit-max-ttl" is also set) but every renewal
-  will use the given period. Requires a root token or one with the sudo capability.
-- `entity_alias` `(string: "")` - Name of the entity alias to associate with
-  during token creation. Only works in combination with `role_name` argument
-  and used entity alias must be listed in `allowed_entity_aliases`. If this has
-  been specified, the entity will not be inherited from the parent.
-
-### Sample payload
-
-```json
-{
-  "policies": ["web", "stage"],
-  "meta": {
-    "user": "armon"
-  },
-  "ttl": "1h",
-  "renewable": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/token/create
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "f00341c1-fad5-f6e6-13fd-235617f858a1",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": null,
-  "wrap_info": null,
-  "warnings": [
-    "Policy \"stage\" does not exist",
-    "Policy \"web\" does not exist"
-  ],
-  "auth": {
-    "client_token": "s.wOrq9dO9kzOcuvB06CMviJhZ",
-    "accessor": "B6oixijqmeR4bsLOJH88Ska9",
-    "policies": ["default", "stage", "web"],
-    "token_policies": ["default", "stage", "web"],
-    "metadata": {
-      "user": "armon"
-    },
-    "lease_duration": 3600,
-    "renewable": true,
-    "entity_id": "",
-    "token_type": "service",
-    "orphan": false,
-    "num_uses": 0
-  }
-}
-```
-
-## Lookup a token
-
-Returns information about the client token.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/auth/token/lookup` |
-
-### Parameters
-
-- `token` `(string: <required>)` - Token to lookup.
-
-### Sample payload
-
-```json
-{
-  "token": "ClientToken"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/token/lookup
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "accessor": "8609694a-cdbc-db9b-d345-e782dbb562ed",
-    "creation_time": 1523979354,
-    "creation_ttl": 2764800,
-    "display_name": "ldap2-tesla",
-    "entity_id": "7d2e3179-f69b-450c-7179-ac8ee8bd8ca9",
-    "expire_time": "2018-05-19T11:35:54.466476215-04:00",
-    "explicit_max_ttl": 0,
-    "id": "cf64a70f-3a12-3f6c-791d-6cef6d390eed",
-    "identity_policies": ["dev-group-policy"],
-    "issue_time": "2018-04-17T11:35:54.466476078-04:00",
-    "meta": {
-      "username": "tesla"
-    },
-    "num_uses": 0,
-    "orphan": true,
-    "path": "auth/ldap2/login/tesla",
-    "policies": ["default", "testgroup2-policy"],
-    "renewable": true,
-    "ttl": 2764790
-  }
-}
-```
-
-## Lookup a token (Self)
-
-Returns information about the current client token.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/auth/token/lookup-self` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/token/lookup-self
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "accessor": "8609694a-cdbc-db9b-d345-e782dbb562ed",
-    "creation_time": 1523979354,
-    "creation_ttl": 2764800,
-    "display_name": "ldap2-tesla",
-    "entity_id": "7d2e3179-f69b-450c-7179-ac8ee8bd8ca9",
-    "expire_time": "2018-05-19T11:35:54.466476215-04:00",
-    "explicit_max_ttl": 0,
-    "id": "cf64a70f-3a12-3f6c-791d-6cef6d390eed",
-    "identity_policies": ["dev-group-policy"],
-    "issue_time": "2018-04-17T11:35:54.466476078-04:00",
-    "meta": {
-      "username": "tesla"
-    },
-    "num_uses": 0,
-    "orphan": true,
-    "path": "auth/ldap2/login/tesla",
-    "policies": ["default", "testgroup2-policy"],
-    "renewable": true,
-    "ttl": 2764790
-  }
-}
-```
-
-## Lookup a token (Accessor)
-
-Returns information about the client token from the accessor.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/auth/token/lookup-accessor` |
-
-### Parameters
-
-- `accessor` `(string: <required>)` - Token accessor to lookup.
-
-### Sample payload
-
-```json
-{
-  "accessor": "8609694a-cdbc-db9b-d345-e782dbb562ed"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/token/lookup-accessor
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "accessor": "8609694a-cdbc-db9b-d345-e782dbb562ed",
-    "creation_time": 1523979354,
-    "creation_ttl": 2764800,
-    "display_name": "ldap2-tesla",
-    "entity_id": "7d2e3179-f69b-450c-7179-ac8ee8bd8ca9",
-    "expire_time": "2018-05-19T11:35:54.466476215-04:00",
-    "explicit_max_ttl": 0,
-    "id": "",
-    "identity_policies": ["dev-group-policy"],
-    "issue_time": "2018-04-17T11:35:54.466476078-04:00",
-    "meta": {
-      "username": "tesla"
-    },
-    "num_uses": 0,
-    "orphan": true,
-    "path": "auth/ldap2/login/tesla",
-    "policies": ["default", "testgroup2-policy"],
-    "renewable": true,
-    "ttl": 2763902
-  }
-}
-```
-
-## Renew a token
-
-Renews a lease associated with a token. This is used to prevent the expiration
-of a token, and the automatic revocation of it. Token renewal is possible only
-if there is a lease associated with it.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/auth/token/renew` |
-
-### Parameters
-
-- `token` `(string: <required>)` - Token to renew. This can be part of the URL
-  or the body.
-- `increment` `(string: "")` - An optional requested increment duration can be
-  provided. This increment may not be honored, for instance in the case of periodic tokens.
-  If not supplied, Vault will use the default TTL. This is specified as a numeric string
-  with suffix like "30s" or "5m".
-
-### Sample payload
-
-```json
-{
-  "token": "ClientToken"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/token/renew
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "client_token": "ABCD",
-    "policies": ["web", "stage"],
-    "metadata": {
-      "user": "armon"
-    },
-    "lease_duration": 3600,
-    "renewable": true
-  }
-}
-```
-
-## Renew a token (Self)
-
-Renews a lease associated with the calling token. This is used to prevent the
-expiration of a token, and the automatic revocation of it. Token renewal is
-possible only if there is a lease associated with it.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/auth/token/renew-self` |
-
-### Parameters
-
-- `increment` `(string: "")` - An optional requested increment duration can be
-  provided. This increment may not be honored, for instance in the case of periodic tokens.
-  If not supplied, Vault will use the default TTL. This is specified as a numeric string
-  with suffix like "30s" or "5m".
-
-### Sample payload
-
-```json
-{
-  "increment": "1h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/token/renew-self
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "client_token": "ABCD",
-    "policies": ["web", "stage"],
-    "metadata": {
-      "user": "armon"
-    },
-    "lease_duration": 3600,
-    "renewable": true
-  }
-}
-```
-
-## Renew a token (Accessor)
-
-Renews a lease associated with a token using its accessor. This is used to
-prevent the expiration of a token, and the automatic revocation of it. Token
-renewal is possible only if there is a lease associated with it.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/auth/token/renew-accessor` |
-
-### Parameters
-
-- `accessor` `(string: <required>)` - Accessor associated with the token to
-  renew.
-- `increment` `(string: "")` - An optional requested lease increment can be
-  provided. This increment may be ignored.
-
-### Sample payload
-
-```json
-{
-  "accessor": "7JFKXuXKXa2D44YfDiovZ9aq"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/token/renew-accessor
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "client_token": "",
-    "policies": ["web", "stage"],
-    "metadata": {
-      "user": "armon"
-    },
-    "lease_duration": 3600,
-    "renewable": true
-  }
-}
-```
-
-## Revoke a token
-
-Revokes a token and all child tokens. When the token is revoked, all dynamic secrets
-generated with it are also revoked.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/auth/token/revoke` |
-
-### Parameters
-
-- `token` `(string: <required>)` - Token to revoke.
-
-### Sample payload
-
-```json
-{
-  "token": "ClientToken"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/token/revoke
-```
-
-## Revoke a token (Self)
-
-Revokes the token used to call it and all child tokens. When the token is
-revoked, all dynamic secrets generated with it are also revoked.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/auth/token/revoke-self` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/auth/token/revoke-self
-```
-
-## Revoke a token accessor
-
-Revoke the token associated with the accessor and all the child tokens. This is
-meant for purposes where there is no access to token ID but there is need to
-revoke a token and its children.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/auth/token/revoke-accessor` |
-
-### Parameters
-
-- `accessor` `(string: <required>)` - Accessor of the token.
-
-### Sample payload
-
-```json
-{
-  "accessor": "2c84f488-2133-4ced-87b0-570f93a76830"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/token/revoke-accessor
-```
-
-## Revoke token and orphan children
-
-Revokes a token but not its child tokens. When the token is revoked, all secrets
-generated with it are also revoked. All child tokens are orphaned, but can be
-revoked sub-sequently using `/auth/token/revoke/`. This is a root-protected
-endpoint.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `/auth/token/revoke-orphan` |
-
-### Parameters
-
-- `token` `(string: <required>)` - Token to revoke. This can be part of the URL
-  or the body.
-
-### Sample payload
-
-```json
-{
-  "token": "ClientToken"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/token/revoke-orphan
-```
-
-## Read token role
-
-Fetches the named role configuration.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/auth/token/roles/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - The name of the token role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/token/roles/nomad
-```
-
-### Sample response
-
-```javascript
-{
-  "request_id": "075a19cd-4e56-a3ca-d956-7609819831ec",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "allowed_entity_aliases": [
-      "my-entity-alias"
-    ],
-    "allowed_policies": [],
-    "disallowed_policies": [],
-    "allowed_policies_glob": [],
-    "disallowed_policies_glob": [],
-    "explicit_max_ttl": 0,
-    "name": "nomad",
-    "orphan": false,
-    "path_suffix": "",
-    "period": 0,
-    "renewable": true,
-    "token_explicit_max_ttl": 0,
-    "token_no_default_policy": false,
-    "token_period": 0,
-    "token_type": "default-service"
-  },
-  "warnings": null
-}
-```
-
-## List token roles
-
-List available token roles.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `LIST` | `/auth/token/roles` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST
-    http://127.0.0.1:8200/v1/auth/token/roles
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["role1", "role2"]
-  }
-}
-```
-
-## Create/Update token role
-
-Creates (or replaces) the named role. Roles enforce specific behavior when
-creating tokens that allow token functionality that is otherwise not
-available or would require `sudo`/root privileges to access. Role
-parameters, when set, override any provided options to the `create`
-endpoints. The role name is also included in the token path, allowing all
-tokens created against a role to be revoked using the
-`/sys/leases/revoke-prefix` endpoint.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/auth/token/roles/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` – The name of the token role.
-- `allowed_policies` `(list: [])` – If set, tokens can be created with any
-  subset of the policies in this list, rather than the normal semantics of
-  tokens being a subset of the calling token's policies. The parameter is a
-  comma-delimited string of policy names. If at creation time
-  `no_default_policy` is not set and `"default"` is not contained in
-  `disallowed_policies` or glob matched in `disallowed_policies_glob`,
-  the `"default"` policy will be added to the created token automatically.
-- `disallowed_policies` `(list: [])` – If set, successful token creation via
-  this role will require that no policies in the given list are requested. The
-  parameter is a comma-delimited string of policy names. Adding `"default"` to
-  this list will prevent `"default"` from being added automatically to created
-  tokens.
-- `allowed_policies_glob` `(list: [])` – If set, tokens can be created with any
-  subset of glob matched policies in this list, rather than the normal semantics
-  of tokens being a subset of the calling token's policies. The parameter is a
-  comma-delimited string of policy name globs. If at creation time
-  `no_default_policy` is not set and `"default"` is not contained in
-  `disallowed_policies` or glob matched in `disallowed_policies_glob`,
-  the `"default"` policy will be added to the created token automatically.
-  If combined with `allowed_policies` policies need to only match one of the two
-  lists to be permitted. Note that unlike `allowed_policies` the policies listed
-  in `allowed_policies_glob` will not be added to the token when no policies are
-  specified in the call to `/auth/token/create/:role_name`.
-- `disallowed_policies_glob` `(list: [])` – If set, successful token creation via
-  this role will require that no requested policies glob match any of policies in
-  this list. The parameter is a comma-delimited string of policy name globs.
-  Adding any glob that matches `"default"` to this list will prevent `"default"`
-  from being added automatically to created tokens.
-  If combined with `disallowed_policies` policies need to only match one of the
-  two lists to be blocked.
-- `orphan` `(bool: false)` - If `true`, tokens created against this policy will
-  be orphan tokens (they will have no parent). As such, they will not be
-  automatically revoked by the revocation of any other token.
-- `renewable` `(bool: true)` - Set to `false` to disable the ability of the token
-  to be renewed past its initial TTL. Setting the value to `true` will allow
-  the token to be renewable up to the system/mount maximum TTL.
-- `path_suffix` `(string: "")` - If set, tokens created against this role will
-  have the given suffix as part of their path in addition to the role name. This
-  can be useful in certain scenarios, such as keeping the same role name in the
-  future but revoking all tokens created against it before some point in time.
-  The suffix can be changed, allowing new callers to have the new suffix as part
-  of their path, and then tokens with the old suffix can be revoked via
-  `/sys/leases/revoke-prefix`.
-- `allowed_entity_aliases` `(string: "", or list: [])` - String or JSON list
-  of allowed entity aliases. If set, specifies the entity aliases which are
-  allowed to be used during token generation. This field supports globbing.
-  Note that `allowed_entity_aliases` is not case sensitive.
-
-@include 'tokenstorefields.mdx'
-
-### Sample payload
-
-```json
-  "allowed_policies": [
-    "dev"
-  ],
-  "name": "nomad",
-  "orphan": false,
-  "bound_cidrs": ["127.0.0.1/32", "128.252.0.0/16"],
-  "renewable": true,
-  "allowed_entity_aliases": ["web-entity-alias", "app-entity-*"]
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST
-    --data @payload.json
-    http://127.0.0.1:8200/v1/auth/token/roles/nomad
-```
-
-## Delete token role
-
-This endpoint deletes the named token role.
-
-| Method   | Path                           |
-| :------- | :----------------------------- |
-| `DELETE` | `/auth/token/roles/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` - The name of the token role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/token/roles/admins
-```
-
-## Tidy tokens
-
-Performs some maintenance tasks to clean up invalid entries that may remain
-in the token store. On Enterprise, Tidy will only impact the tokens in the
-specified namespace, or the root namespace if unspecified.
-
-Generally, running this is not needed unless upgrade notes or support personnel
-suggest it. There are two potential dangers to running tidy: first, this will
-perform a lot of read I/O to the storage method, as it will essentially reload the
-entirety of the token store into memory. Depending on how much cleanup is
-required (usually very little) there may also be a large number of writes.
-Second, this will cause Vault's memory usage to balloon up, because the default
-Vault internal cache is unlimited in size and every value read from storage will
-be cached. Listing the `/auth/token/accessors` endpoint is a good way to get
-some sense of the potential impact: tidy does this and more, so if this call creates problems
-for your cluster, it would be wise to give Vault more resources before attempting
-tidy. Note that the request may time out depending on
-[max duration](/vault/docs/configuration#default_max_request_duration)
-and your client's timeout configuration, make sure to allow it run to completion
-to properly judge the impact.
-
-Tidy will load every token accessor and cubbyhole in the namespace, as well
-as all the secondary index entries that are used to group tokens into trees so
-that parent token revocation also revokes child tokens.
-
-For each parent token listed in the secondary index, tidy will check if the token
-still exists in storage, and if not its child tokens that still exist will be
-made orphans, then the parent token will be removed from the secondary index.
-
-For each accessor found, tidy will check if the corresponding token still exists
-in storage, and if not will delete the accessor. If the token still exists in
-storage but shouldn't, tidy will try to revoke it and any child leases it might
-have, then delete the accessor.
-
-Finally, any cubbyhole entries that are associated with tokens which weren't deemed
-valid in the above steps will be deleted.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/auth/token/tidy` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/auth/token/tidy
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "84437c7f-36a1-6c1d-381d-14ec99217e94",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": null,
-  "wrap_info": null,
-  "warnings": [
-    "Tidy operation successfully started. Any information from the operation will be printed to Vault's server logs."
-  ],
-  "auth": null
-}
-```
diff --git a/website/content/api-docs/auth/userpass.mdx b/website/content/api-docs/auth/userpass.mdx
deleted file mode 100644
index 940176b1cc2..00000000000
--- a/website/content/api-docs/auth/userpass.mdx
+++ /dev/null
@@ -1,280 +0,0 @@
----
-layout: api
-page_title: Userpass - Auth Methods - HTTP API
-description: |-
-  This is the API documentation for the Vault username and password
-  auth method.
----
-
-# Userpass auth method (HTTP API)
-
-This is the API documentation for the Vault Username & Password auth method. For
-general information about the usage and operation of the Username and Password method, please
-see the [Vault Userpass method documentation](/vault/docs/auth/userpass).
-
-This documentation assumes the Username & Password method is mounted at the `/auth/userpass`
-path in Vault. Since it is possible to enable auth methods at any location,
-please update your API calls accordingly.
-
-## Create/Update user
-
-Create a new user or update an existing user. This path honors the distinction between the `create` and `update` capabilities inside ACL policies.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `POST` | `/auth/userpass/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` – The username for the user. Accepted characters: alphanumeric plus "_", "-", "." (underscore, hyphen and period); username cannot begin with a hyphen, nor can it begin or end with a period.
-- `password` `(string: <required>)` - The password for the user. Only required
-  when creating the user.
-
-@include 'tokenfields.mdx'
-
-### Sample payload
-
-```json
-{
-  "password": "superSecretPassword",
-  "token_policies": ["admin", "default"],
-  "token_bound_cidrs": ["127.0.0.1/32", "128.252.0.0/16"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/userpass/users/mitchellh
-```
-
-## Read user
-
-Reads the properties of an existing username.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `GET`  | `/auth/userpass/users/:username` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/auth/userpass/users/mitchellh
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "0ad1be52-9398-4b3c-f58b-98e427406471",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "token_bound_cidrs": [
-      "127.0.0.1",
-      "128.252.0.0/16"
-    ],
-    "token_explicit_max_ttl": 0,
-    "token_max_ttl": 0,
-    "token_no_default_policy": false,
-    "token_num_uses": 0,
-    "token_period": 0,
-    "token_policies": [
-      "admin",
-      "default"
-    ],
-    "token_ttl": 0,
-    "token_type": "default"
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Delete user
-
-This endpoint deletes the user from the method.
-
-| Method   | Path                             |
-| :------- | :------------------------------- |
-| `DELETE` | `/auth/userpass/users/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` - The username for the user.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/auth/userpass/users/mitchellh
-```
-
-## Update password on user
-
-Update password for an existing user.
-
-| Method | Path                                      |
-| :----- | :---------------------------------------- |
-| `POST` | `/auth/userpass/users/:username/password` |
-
-### Parameters
-
-- `username` `(string: <required>)` – The username for the user.
-- `password` `(string: <required>)` - The password for the user.
-
-### Sample payload
-
-```json
-{
-  "password": "superSecretPassword2"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/userpass/users/mitchellh/password
-```
-
-## Update policies on user
-
-Update policies for an existing user.
-
-| Method | Path                                      |
-| :----- | :---------------------------------------- |
-| `POST` | `/auth/userpass/users/:username/policies` |
-
-### Parameters
-
-- `username` `(string: <required>)` – The username for the user.
-- `token_policies` `(array: [] or comma-delimited string: "")` - List of
-  policies to encode onto generated tokens. Depending on the auth method, this
-  list may be supplemented by user/group/other values.
-
-### Sample payload
-
-```json
-{
-  "token_policies": ["policy1", "policy2"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/userpass/users/mitchellh/policies
-```
-
-## List users
-
-List available userpass users.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `LIST` | `/auth/userpass/users` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/auth/userpass/users
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["mitchellh", "armon"]
-  }
-}
-```
-
-## Login
-
-Login with the username and password.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `POST` | `/auth/userpass/login/:username` |
-
-### Parameters
-
-- `username` `(string: <required>)` – The username for the user.
-- `password` `(string: <required>)` - The password for the user.
-
-### Sample payload
-
-```json
-{
-  "password": "superSecretPassword2"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/auth/userpass/login/mitchellh
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "ae1882ba-f60a-7629-ce1a-6618c482de3e",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": null,
-  "wrap_info": null,
-  "warnings": null,
-  "auth": {
-    "client_token": "hvs.CAESIJyeFmhLYRWVXPJStT3fDP1ZdFkon_otuk1sJUpkfk_WGh4KHGh2cy5xdW9XVHBnVUwwbzB1ZEhzZkpkRmVoU08",
-    "accessor": "iP2Lw1JXpjlALbgJSeIx51n7",
-    "policies": [
-      "default",
-      "policy1",
-      "policy2"
-    ],
-    "token_policies": [
-      "default",
-      "policy1",
-      "policy2"
-    ],
-    "metadata": {
-      "username": "mitchellh"
-    },
-    "lease_duration": 2764800,
-    "renewable": true,
-    "entity_id": "0660dce5-4f2c-926a-8b15-158901557d9d",
-    "token_type": "service",
-    "orphan": true,
-    "mfa_requirement": null,
-    "num_uses": 0
-  }
-}
-```
diff --git a/website/content/api-docs/index.mdx b/website/content/api-docs/index.mdx
deleted file mode 100644
index a985604464c..00000000000
--- a/website/content/api-docs/index.mdx
+++ /dev/null
@@ -1,319 +0,0 @@
----
-layout: api
-page_title: HTTP API
-description: Vault has an HTTP API that can be used to control every aspect of Vault.
----
-
-# HTTP API
-
-The Vault HTTP API gives you full access to Vault using [REST like HTTP verbs](https://en.wikipedia.org/wiki/Representational_state_transfer).
-Every aspect of Vault can be controlled using the APIs. The Vault CLI uses the
-HTTP API to access Vault similar to all other consumers.
-
-All API routes are prefixed with `/v1/`.
-
-This documentation is only for the v1 API, which is currently the only version.
-
-~> **Backwards compatibility:** At the current version, Vault does not yet
-promise backwards compatibility even with the v1 prefix. We'll remove this
-warning when this policy changes. At this point in time the core API (that
-is, `sys/` routes) change very infrequently, but various secrets engines/auth
-methods/etc. sometimes have minor changes to accommodate new features as
-they're developed.
-
-## Transport
-
-The API is expected to be accessed over a TLS connection at all times, with a
-valid certificate that is verified by a well-behaved client. It is possible to
-disable TLS verification for listeners, however, so API clients should expect
-to have to do both depending on user settings.
-
-## Authentication
-
-Once Vault is unsealed, almost every other operation requires a _client token_.
-A user may have a client token sent to them. The client token must be sent as
-either the `X-Vault-Token` HTTP Header or as `Authorization` HTTP Header using
-the `Bearer <token>` scheme.
-
-Otherwise, a client token can be retrieved using an [authentication
-engine](/vault/docs/auth).
-
-Each auth method has one or more unauthenticated login endpoints. These
-endpoints can be reached without any authentication, and are used for
-authentication to Vault itself. These endpoints are specific to each auth
-method.
-
-Responses from auth login methods that generate an authentication token are
-sent back to the client in JSON. The resulting token should be saved on the
-client or passed via the `X-Vault-Token` or `Authorization` header for future requests.
-
-## Parameter restrictions
-
-Several Vault APIs require specifying path parameters. The path parameter cannot end
-in periods. Otherwise, Vault will return a 404 unsupported path error.
-
-## Namespaces
-
-When using [Namespaces](/vault/docs/enterprise/namespaces) the final path of the API
-request is relative to the `X-Vault-Namespace` header. For instance, if a
-request URI is `secret/foo` with the `X-Vault-Namespace` header set as `ns1/ns2/`,
-then the resulting request path to Vault will be `ns1/ns2/secret/foo`.
-
-Note that it is semantically equivalent to use the full path rather than the
-`X-Vault-Namespace` header, Vault will match the corresponding namespace
-based on correlating user input. Similar path results may be achieved if
-`X-Vault-Namespace` is set to `ns1/` with the request path of `ns2/secret/foo`
-as well, or otherwise if `X-Vault-Namespace` is omitted entirely and instead a
-complete path is provided such as: `ns1/ns2/secret/foo`.
-
-For example, the following two commands result in equivalent requests:
-
-```shell-session
-$ curl \
-    -H "X-Vault-Token: f3b09679-3001-009d-2b80-9c306ab81aa6" \
-    -H "X-Vault-Namespace: ns1/ns2/" \
-    -X GET \
-    http://127.0.0.1:8200/v1/secret/foo
-```
-
-```shell-session
-$ curl \
-    -H "X-Vault-Token: f3b09679-3001-009d-2b80-9c306ab81aa6" \
-    -X GET \
-    http://127.0.0.1:8200/v1/ns1/ns2/secret/foo
-```
-
-## API operations
-
-Typically the request data, body and response data to and from Vault is in JSON.
-Vault sets the `Content-Type` header appropriately with its response and does
-not require it from the clients request.
-
-The demonstration below uses the [`KVv1` secrets engine](/vault/api-docs/secret/kv/kv-v1), which is a
-simple Key Value store. Please read [the API documentation of KV secret engines](/vault/api-docs/secret/kv)
-for details of `KVv1` compared to `KVv2` and how they differ in their URI paths
-as well as the features available in version 2 of the KV secrets engine.
-
-For `KVv1`, reading a secret using the HTTP API is done by issuing a GET:
-
-```text
-/v1/secret/foo
-```
-
-This maps to `secret/foo` where `foo` is the key in the `secret/` mount, which
-is mounted by default on a fresh Vault install and is of type `kv`.
-
-Here is an example of reading a secret using cURL:
-
-```shell-session
-$ curl \
-    -H "X-Vault-Token: f3b09679-3001-009d-2b80-9c306ab81aa6" \
-    -X GET \
-    http://127.0.0.1:8200/v1/secret/foo
-```
-
-A few endpoints consume calls with `GET` query string parameters, but only if
-those parameters are not sensitive, especially since  some load balancers will
-be able log these. Most endpoints that accept `POST` query string parameters
-expect those parameters in the request body.
-
-You can list secrets as well. To do this, either issue a `GET` with the query
-string parameter `list=true`, or you use the `LIST` HTTP verb. For the `kv` secrets
-engine, listing is allowed on directories only, which returns the keys at the
-requested path:
-
-```shell-session
-$ curl \
-    -H "X-Vault-Token: f3b09679-3001-009d-2b80-9c306ab81aa6" \
-    -X LIST \
-    http://127.0.0.1:8200/v1/secret/
-```
-
-The API documentation uses `LIST` as the HTTP verb, but you can still use `GET`
-with the `?list=true` query string.
-
-To make an API with specific data in request body, issue a `POST`:
-
-```text
-/v1/secret/foo
-```
-
-with a JSON body like:
-
-```javascript
-{
-  "value": "bar"
-}
-```
-
-Here is an example of writing a secret using cURL:
-
-```shell-session
-$ curl \
-    -H "X-Vault-Token: f3b09679-3001-009d-2b80-9c306ab81aa6" \
-    -H "Content-Type: application/json" \
-    -X POST \
-    -d '{"data":{"value":"bar"}}' \
-    http://127.0.0.1:8200/v1/secret/baz
-```
-
-Vault currently considers `PUT` and `POST` to be synonyms. Rather than trust a
-client's stated intentions, Vault engines can implement an existence check to
-discover whether an operation is actually a create or update operation based on
-the data already stored within Vault. This makes permission management via ACLs
-more flexible.
-
-A [KVv2 example](/vault/api-docs/secret/kv/kv-v2#sample-request-3) for the engine path of `secret` requires that URI is
-appended with ***`data/`***  prior to the secret name (`baz`) such as:
-
-```shell-session
-$ curl \
-    -H "X-Vault-Token: f3b09679-3001-009d-2b80-9c306ab81aa6" \
-    -H "Content-Type: application/json" \
-    -X POST \
-    -d '{"data":{"value":"bar"}}' \
-    http://127.0.0.1:8200/v1/secret/data/baz
-```
-
-For more examples, please look at the Vault API client.
-
-## The `X-Vault-Request` header
-
-Requests that are sent to a [Vault Proxy][proxy] that is configured to use the
-`require_request_header` option must include the `X-Vault-Request` header
-entry, e.g.:
-
-```shell-session
-$ curl \
-    -H "X-Vault-Token: f3b09679-3001-009d-2b80-9c306ab81aa6" \
-    -H "X-Vault-Request: true" \
-    -H "Content-Type: application/json" \
-    -X POST \
-    -d '{"value":"bar"}' \
-    http://127.0.0.1:8200/v1/secret/baz
-```
-
-The Vault CLI always adds this header to every request, regardless of whether
-the request is being sent to a Vault Agent or directly to a Vault Server. In
-addition, the Vault SDK always adds this header to every request.
-
-## Help
-
-To retrieve the help for any API within Vault, including mounted engines, auth
-methods, etc. then append `?help=1` to any URL. If you have valid permission to
-access the path, then the help text will be returned as a markdown-formatted block
-in the `help` attribute of the response.
-
-Additionally, with the [OpenAPI generation](/vault/api-docs/system/internal-specs-openapi) in Vault, you will get back a small
-OpenAPI document in the `openapi` attribute. This document is relevant for the
-path you're looking up and any paths under it - also note paths in the OpenAPI
-document are relative to the initial path queried.
-
-
-Example request:
-
-```shell-session
-$ curl \
-    -H "X-Vault-Token: f3b09679-3001-009d-2b80-9c306ab81aa6" \
-    http://127.0.0.1:8200/v1/secret?help=1
-```
-
-Example response:
-
-```javascript
-{
-  "help": "## DESCRIPTION\n\nThis backend provides a versioned key-value store. The kv backend reads and\nwrites arbitrary secrets to the storage backend. The secrets are\nencrypted/decrypted by Vault: they are never stored unencrypted in the backend\nand the backend never has an opportunity to see the unencrypted value. Each key\ncan have a configured number of versions, and versions can be retrieved based on\ntheir version numbers.\n\n## PATHS\n\nThe following paths are supported by this backend. To view help for\nany of the paths below, use the help command with any route matching\nthe path pattern. Note that depending on the policy of your auth token,\nyou may or may not be able to access certain paths.\n\n    ^.*$\n\n\n    ^config$\n        Configures settings for the KV store\n\n    ^data/(?P<path>.*)$\n        Write, Read, and Delete data in the Key-Value Store.\n\n    ^delete/(?P<path>.*)$\n        Marks one or more versions as deleted in the KV store.\n\n    ^destroy/(?P<path>.*)$\n        Permanently removes one or more versions in the KV store\n\n    ^metadata/(?P<path>.*)$\n        Configures settings for the KV store\n\n    ^undelete/(?P<path>.*)$\n        Undeletes one or more versions from the KV store.",
-  "openapi": {
-    "openapi": "3.0.2",
-    "info": {
-      "title": "HashiCorp Vault API",
-      "description": "HTTP API that gives you full access to Vault. All API routes are prefixed with `/v1/`.",
-      "version": "1.0.0",
-      "license": {
-        "name": "Mozilla Public License 2.0",
-        "url": "https://www.mozilla.org/en-US/MPL/2.0"
-      }
-    },
-    "paths": {
-      "/.*": {},
-      "/config": {
-        "description": "Configures settings for the KV store",
-        "x-vault-create-supported": true,
-        "get": {
-          "summary": "Read the backend level settings.",
-          "tags": [
-            "secrets"
-          ],
-          "responses": {
-            "200": {
-              "description": "OK"
-            }
-          }
-        },
-     ...[output truncated]...
-     }
-  }
-}
-```
-
-## Error response
-
-A common JSON structure is always returned to return errors:
-
-```javascript
-{
-  "errors": [
-    "message",
-    "another message"
-  ]
-}
-```
-
-This structure will be returned for any HTTP status greater than or equal to 400.
-
-## HTTP status codes
-
-The following HTTP status codes are used throughout the API. Vault tries to
-adhere to these whenever possible, but in case it doesn't -- then feel free to
-[raise a bug](https://github.com/hashicorp/vault/issues) for our attention!
-
-~> _Note_: Applications should be prepared to accept both `200` and `204` as
-success. `204` is simply an indication that there is no response body to parse,
-but API endpoints that indicate that they return a `204` may return a `200` if
-warnings are generated during the operation.
-
-- `200` - Success with data.
-- `204` - Success, no data returned.
-- `400` - Invalid request, missing or invalid data.
-- `403` - Forbidden, your authentication details are either incorrect, you
-  don't have access to this feature, or - if CORS is enabled - you made a
-  cross-origin request from an origin that is not allowed to make such
-  requests.
-- `404` - Invalid path. This can both mean that the path truly doesn't exist or
-  that you don't have permission to view a specific path. We use 404 in some
-  cases to avoid state leakage.
-- `405` - Unsupported operation.  You tried to use a method inappropriate to
-  the request path, e.g. a POST on an endpoint that only accepts GETs.
-- `412` - Precondition failed.  Returned on Enterprise when a request can't be
-  processed yet due to some missing eventually consistent data.  Should be retried,
-  perhaps with a little backoff.
-  See [Vault Eventual Consistency](/vault/docs/enterprise/consistency).
-- `429` - Default return code for health status of standby nodes. This will
-  likely change in the future.
-- `472` - Default return code for disaster recovery mode replication secondary and active.
-- `473` - Default return code for health status of performance standby nodes.
-- `500` - Internal server error. An internal error has occurred, try again
-  later. If the error persists, report a bug.
-- `501` - Vault is not initialized.
-- `502` - A request to Vault required Vault making a request to a third party;
-  the third party responded with an error of some kind.
-- `503` - Vault is down for maintenance or is currently sealed. Try again
-  later.
-
-## Limits
-
-A maximum request size of 32MB is imposed to prevent a denial of service attack
-with arbitrarily large requests; this can be tuned per `listener` block in
-Vault's server configuration file.
-
-[proxy]: /vault/docs/agent-and-proxy/proxy#listener-stanza
diff --git a/website/content/api-docs/libraries.mdx b/website/content/api-docs/libraries.mdx
deleted file mode 100644
index 5e15bb4569b..00000000000
--- a/website/content/api-docs/libraries.mdx
+++ /dev/null
@@ -1,206 +0,0 @@
----
-layout: api
-page_title: 'HTTP API: Libraries'
-description: >-
-  List of official and community contributed libraries for interacting with the
-  Vault HTTP API.
----
-
-# Libraries
-
-The programming libraries listed on this page can be used to consume the API more conveniently.
-Some are officially maintained while others are provided by the community.
-
-For a step-by-step walkthrough on using these client libraries, see the [developer quickstart](/vault/docs/get-started/developer-qs).
-For copy-pastable code examples, see the [vault-examples](https://github.com/hashicorp/vault-examples) repo.
-
-## Official
-
-These libraries are officially maintained by HashiCorp.
-
-### Go
-
-- [Vault Go Client](https://github.com/hashicorp/vault/tree/main/api)
-
-```shell-session
-$ go get github.com/hashicorp/vault/api
-```
-
-[Example application](https://github.com/hashicorp/hello-vault-go)
-
-### Ruby
-
-- [Vault Ruby Client](https://github.com/hashicorp/vault-ruby)
-
-```shell-session
-$ gem install vault
-```
-
-## C#
-
-- [Vault DotNet Client](https://github.com/hashicorp/vault-client-dotnet) - Note that this is currently in early development, and is not yet production-ready. 
-
-```shell-session
-# Install-Package HashiCorp.Vault
-```
-
-[Example application](https://github.com/hashicorp/vault-client-dotnet#getting-started)
-
-## Community
-
-These libraries are provided by the community.
-
-### Ansible
-
-- [ansible-vault](https://github.com/jhaals/ansible-vault) - Lookup plugin without third-party dependencies.
-- [Ansible Modules Hashivault](https://pypi.python.org/pypi/ansible-modules-hashivault)
-
-```shell-session
-$ pip install ansible-modules-hashivault
-```
-
-### C&#35;
-
-- [VaultSharp](https://github.com/rajanadar/VaultSharp)
-  - Supports .NET 4.6.x, 4.7.x, 4.8.x, .NET Standard 2.x, .NET 6.0 and 7.0.
-
-```shell-session
-$ Install-Package VaultSharp
-```
-
-- [Vault.NET](https://github.com/Chatham/Vault.NET)
-
-```shell-session
-$ Install-Package Vault
-```
-
-[Example application](https://github.com/hashicorp/hello-vault-dotnet)
-
-### C++
-
-- [libvault](https://github.com/abedra/libvault)
-
-### Clojure
-
-- [vault-clj](https://github.com/amperity/vault-clj)
-
-### Elixir
-
-- [libvault](https://hex.pm/packages/libvault)
-- [vaultex](https://hex.pm/packages/vaultex)
-
-### Erlang
-
-- [canal](https://github.com/rkallos/canal)
-
-### Go
-
-- [vaultgo](https://github.com/mittwald/vaultgo)
-
-```shell-session
-$ go get github.com/mittwald/vaultgo
-```
-
-### Haskell
-
-- [vault-tool](https://hackage.haskell.org/package/vault-tool)
-
-```shell-session
-$ cabal install vault-tool
-```
-
-- [gothic](http://hackage.haskell.org/package/gothic)
-
-```shell-session
-$ stack install gothic
-```
-
-### Java
-
-- [Spring Vault](https://github.com/spring-projects/spring-vault)
-- [vault-java-driver](https://github.com/jopenlibs/vault-java-driver)
-
-### Kotlin
-
-- [vault-kotlin](https://github.com/kunickiaj/vault-kotlin)
-
-### Node.js
-
-- [node-vault](https://github.com/kr1sp1n/node-vault)
-
-```shell-session
-$ npm install node-vault
-```
-
-- [vaulTS](https://github.com/mittwald/vaulTS) (Github NPM Registry)
-
-```shell-session
-$ npm install @mittwald/vaults
-```
-
-- [vault-api](https://github.com/SaiHemanthBR/vault-api) (Typescript. Axios-like API)
-
-```shell-session
-$ npm install vault-api
-```
-
-- [loopback4-vault](https://github.com/sourcefuse/loopback4-vault) (LoopBack 4 Extension)
-
-```shell-session
-$ npm i @sourceloop/vault
-```
-
-### PHP
-
-- [vault-php-sdk](https://github.com/jippi/vault-php-sdk)
-
-```shell-session
-$ composer require jippi/vault-php-sdk
-```
-
-- [vault-php-sdk](https://github.com/violuke/vault-php-sdk) extended from jipppi
-
-```shell-session
-$ composer require violuke/vault-php-sdk
-```
-
-- [vault-php](https://github.com/CSharpRU/vault-php)
-
-```shell-session
-$ composer require csharpru/vault-php
-```
-
-- [vault-php](https://github.com/mittwald/vaultPHP)
-
-```shell-session
-$ composer require mittwald/vault-php
-```
-
-### PowerShell
-
-- [Zyborg.Vault](https://github.com/zyborg/Zyborg.Vault)
-
-```PowerShell
-Install-Module Zyborg.Vault
-```
-
-### Python
-
-- [HVAC](https://github.com/ianunruh/hvac)
-
-```shell-session
-$ pip install hvac
-```
-
-### R
-
-- [vaultr](https://github.com/vimc/vaultr)
-
-### Rust
-
-- [HashicorpVault](https://crates.io/crates/hashicorp_vault)
-- [vaultrs](https://crates.io/crates/vaultrs)
-
-### Scala
-
-- [scala-vault](https://github.com/janstenpickle/scala-vault)
diff --git a/website/content/api-docs/relatedtools.mdx b/website/content/api-docs/relatedtools.mdx
deleted file mode 100644
index 12b0732b116..00000000000
--- a/website/content/api-docs/relatedtools.mdx
+++ /dev/null
@@ -1,40 +0,0 @@
----
-layout: api
-page_title: Related Tools
-description: Short list of third-party tools that work with or are related to Vault.
----
-
-# Related tools
-
-## HashiCorp tools
-
-- [Vault Agent](/vault/docs/agent-and-proxy/agent) can render Vault secrets either to files or directly into a child process as environment variables using `consul-template` templating syntax
-- [Vault Proxy](/vault/docs/agent-and-proxy/proxy) acts as an API Proxy for Vault, and can optionally allow or force interacting clients to use its automatically authenticated token
-- [Terraform Vault Provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) can read from, write to, and configure Vault from [HashiCorp Terraform](https://www.terraform.io/)
-- [consul-template](https://github.com/hashicorp/consul-template) is a template renderer, notifier, and supervisor for HashiCorp Consul and Vault data
-- [vault-ssh-helper](https://github.com/hashicorp/vault-ssh-helper) can be used to enable one-time passwords for SSH authentication via Vault
-
-## Third-Party tools
-
-The following list of tools is maintained by the community of Vault users; HashiCorp has not tested or approved them and makes no claims as to their suitability or security.
-
-- [HashiCorp Vault Jenkins plugin](https://plugins.jenkins.io/hashicorp-vault-plugin) - a Jenkins plugin for injecting Vault secrets into the build environment
-- [Spring Vault](http://projects.spring.io/spring-vault/) - a Java Spring project for working with Vault secrets
-- [vault-exec](https://github.com/kmanning/vault_exec) - a shell wrapper to execute arbitrary scripts using temporary AWS credentials managed by Vault
-- [pouch](https://github.com/tuenti/pouch) - A set of tools to manage provisioning of secrets on hosts based on the AppRole authentication method of Vault
-- [vault-aws-creds](https://github.com/jantman/vault-aws-creds) - Python helper to export Vault-provided temporary AWS creds into the environment
-- [goldfish](https://github.com/Caiyeon/goldfish) - A Vault UI panel written with VueJS and Vault native Go API.
-- [vault-migrator](https://github.com/nebtex/vault-migrator) - A tool to migrate data between different Vault storage mechanisms
-- [Cryptr](https://github.com/adobe/cryptr) - a desktop Vault UI for Mac, Windows and Linux
-- [sequelize-vault](https://github.com/linyows/sequelize-vault) - A Sequelize plugin for easily integrating Vault secrets.
-- [ansible-modules-hashivault](https://github.com/TerryHowe/ansible-modules-hashivault) - An Ansible module for configuring most things in Vault including secrets, backends and policies.
-- [Docker credential helper](https://github.com/morningconsult/docker-credential-vault-login) - A program that automatically reads Docker credentials from your Vault server and passes them to the Docker daemon to authenticate to your Docker registry when pulling an image
-- [Cruise Daytona](https://github.com/cruise-automation/daytona) - An alternative implementation of the Vault client CLI for services and containers. Its core features are the ability to automate authentication, fetching of secrets, and automated token renewal. Support for AWS, GCP, & Kubernetes Vault Auth Backends.
-- [Vault-CRD](https://vault.koudingspawn.de/) - Synchronize secrets stored in HashiCorp Vault to Kubernetes Secrets for better GitOps without secrets stored in git manifest files.
-- [vsh](https://github.com/fishi0x01/vsh) - Interactive shell with tab-completion. Allows recursive operations on paths. Allows migration of secrets between both KV versions.
-- [vault-cli](https://github.com/IBM/vault-cli) - A yaml based automation tool that bootstraps Vault cluster(s) with the desired configuration (namespaces, endpoints, policies, roles, endpoint)
-- [vault-go](https://github.com/IBM/vault-go) - Helper Golang Vault types as Kubernetes Custom Resource Definitions (CRD)
-- [HashiBox](https://github.com/nunchistudio/hashibox) - Vagrant environment to simulate highly-available cloud with Consul, Nomad, Vault, and optional support for Waypoint. Community & Enterprise supported.
-- [vkv](https://github.com/FalcoSuessgott/vkv) - Recursively list key-values entries from Vaults KV2 engine in various formats.
-
-Want to add your own project, or one that you use? Additions are welcome via [pull requests](https://github.com/hashicorp/vault/blob/main/website/content/api-docs/relatedtools.mdx).
diff --git a/website/content/api-docs/secret/ad.mdx b/website/content/api-docs/secret/ad.mdx
deleted file mode 100644
index ca9494ba08d..00000000000
--- a/website/content/api-docs/secret/ad.mdx
+++ /dev/null
@@ -1,529 +0,0 @@
----
-layout: api
-page_title: Active Directory - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault Active Directory secrets engine.
----
-
-# Active directory secrets engine (API)
-
-@include 'ad-secrets-deprecation.mdx'
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault AD secrets engine. For general
-information about the usage and operation of the AD secrets engine, please see
-the [Vault Active Directory documentation](/vault/docs/secrets/ad).
-
-This documentation assumes the AD secrets engine is enabled at the `/ad` path
-in Vault. Since it is possible to enable secrets engines at any location, please
-update your API calls accordingly.
-
-## Configuration
-
-The `config` endpoint configures the LDAP connection and binding parameters, as well as the password rotation configuration.
-
-### Password parameters
-
-- `ttl` `(int: "")` - The default password time-to-live in seconds. Once the ttl has passed, a password will
-  be rotated the next time it's requested.
-- `max_ttl` `(int: "")` - The maximum password time-to-live in seconds. No role will be allowed to set a
-  custom ttl greater than the `max_ttl`.
-- `password_policy` `(string: "")` - Name of the [password policy](/vault/docs/concepts/password-policies) to use to
-  generate passwords from. Mutually exclusive with `length` and `formatter`.
-
-**Deprecated parameters**:
-
-- `length` (string, optional) - The desired password length. Defaults to 64. Minimum is 14. Mutually exclusive
-  with `password_policy`.
-- `formatter` (string, optional) - Text into which the base64 password should be inserted, formatted like so:
-  `mycustom{{PASSWORD}}`. Mutually exclusive with `password_policy`.
-
-The following statement is applicable when using `length` and/or `formatter`, but not `password_policy`:
-
-To meet Microsoft's password complexity requirements, all passwords begin with "?@09AZ" unless a `formatter` is provided.
-The `formatter` is for organizations with different, custom password requirements. It allows an organization to supply
-text that fulfills those requirements. `{{PASSWORD}}` must appear exactly once and can be anywhere in the text.
-
-### Connection parameters
-
-- `url` (string, optional) - The LDAP server to connect to. Examples: `ldaps://ldap.myorg.com`, `ldaps://ldap.myorg.com:636`. This can also be a comma-delineated list of URLs, e.g. `ldaps://ldap.myorg.com,ldaps://ldap.myorg.com:636`, in which case the servers will be tried in-order if there are errors during the connection process. Default is `ldap://127.0.0.1`.
-- `connection_timeout` `(integer: 30 or string: "30s")` - Timeout, in seconds, when attempting to connect to the LDAP server before trying the next URL in the configuration.
-- `request_timeout` `(integer: 90 or string: "90s")` - Timeout, in seconds, for the connection when making requests against the server before returning back an error.
-- `starttls` (bool, optional) - If true, issues a `StartTLS` command after establishing an unencrypted connection.
-- `insecure_tls` - (bool, optional) - If true, skips LDAP server SSL certificate verification - insecure, use with caution!
-- `certificate` - (string, optional) - CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
-
-### Binding parameters
-
-- `binddn` (string, required) - Distinguished name of object to bind when performing user and group search. Example: `cn=vault,ou=Users,dc=example,dc=com`
-- `bindpass` (string, required) - Password to use along with `binddn` when performing user search.
-- `userdn` (string, optional) - Base DN under which to perform user search. Example: `ou=Users,dc=example,dc=com`
-- `upndomain` (string, optional) - The domain (userPrincipalDomain) used to construct a UPN string for authentication. The constructed UPN will appear as `[binddn]@UPNDomain`. Example: if `upndomain=example.com` and `binddn=admin`, the UPN string `admin@example.com` will be used to login to Active Directory.
-
-### Other parameters
-
-- `last_rotation_tolerance` (string, optional) - Tolerance duration to use when checking the last rotation time.
-  Active Directory often shows a "pwdLastSet" time after Vault's because it takes
-  a while for password updates to be propagated across a large cluster. By default, if Active Directory's last rotation time is
-  within 5 seconds of Vault's, Vault considers itself to have been the last entity that rotated the password. However, if it's been
-  more than 5 seconds, Vault thinks that something rotated the password out-of-band, and re-rotates it so it will "know" it and be
-  able to continue returning it. This may be too low for larger Active Directory clusters, and too high for smaller ones.
-
-## Config management
-
-At present, this endpoint does not confirm that the provided AD credentials are
-valid AD credentials with proper permissions.
-
-| Method   | Path         |
-| :------- | :----------- |
-| `POST`   | `/ad/config` |
-| `GET`    | `/ad/config` |
-| `DELETE` | `/ad/config` |
-
-### Sample post request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ad/config
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault write ad/config \
-    binddn="domain-admin" \
-    bindpass="pa$$w0rd" \
-    url="ldaps://127.0.0.1" \
-    userdn="dc=example,dc=com"
-```
-
-</Tab>
-</Tabs>
-
-### Sample post payload
-
-```json
-{
-  "binddn": "domain-admin",
-  "bindpass": "pa$$w0rd",
-  "url": "ldaps://127.0.0.11",
-  "userdn": "dc=example,dc=com"
-}
-```
-
-### Sample get response data
-
-```json
-{
-  "binddn": "domain-admin",
-  "certificate": "",
-  "insecure_tls": false,
-  "length": 64,
-  "max_ttl": 2764800,
-  "starttls": false,
-  "tls_max_version": "tls12",
-  "tls_min_version": "tls12",
-  "ttl": 2764800,
-  "upndomain": "",
-  "url": "ldaps://127.0.0.11",
-  "userdn": "dc=example,dc=com"
-}
-```
-
-## Role management
-
-The `roles` endpoint configures how Vault will manage the passwords for individual service accounts.
-
-### Parameters
-
-- `service_account_name` (string, required) - The name of a pre-existing service account in Active Directory that maps to this role.
-- `ttl` (string, optional) - The password time-to-live in seconds. Defaults to the configuration `ttl` if not provided.
-
-When adding a role, Vault verifies its associated service account exists.
-
-| Method   | Path                   |
-| :------- | :--------------------- |
-| `GET`    | `/ad/roles`            |
-| `POST`   | `/ad/roles/:role_name` |
-| `GET`    | `/ad/roles/:role_name` |
-| `DELETE` | `/ad/roles/:role_name` |
-
-### Sample post request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ad/roles/my-application
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault write ad/roles/my-application \
-    service_account_name="my-application@example.com" \
-    ttl=100
-```
-
-</Tab>
-</Tabs>
-
-### Sample post payload
-
-```json
-{
-  "service_account_name": "my-application@example.com",
-  "ttl": 100
-}
-```
-
-### Sample get role response
-
-```json
-{
-  "last_vault_rotation": "2018-05-24T17:14:38.677370855Z",
-  "password_last_set": "2018-05-24T17:14:38.6038495Z",
-  "service_account_name": "my-application@example.com",
-  "ttl": 100
-}
-```
-
-### Sample list roles response
-
-Performing a `LIST` on the `/ad/roles` endpoint will list the names of all the roles Vault contains.
-
-```json
-["my-application"]
-```
-
-## Retrieving passwords
-
-The `creds` endpoint offers the credential information for a given role.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/ad/creds/:role_name` |
-
-### Sample get request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/ad/creds/my-application
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault read ad/creds/my-application
-```
-
-</Tab>
-</Tabs>
-
-### Sample get response
-
-```json
-{
-  "current_password": "?@09AZnh4Q5N4O5zdLk/4F8aIMgsnpDM6tSQEZCge3Mz1wXcZEgZhOa6OR748F96",
-  "last_password": "?@09AZSen9TzUwK7ZhafS7B0GuWGraQjfWEna5SwnmF/tVaKFqjXhhGV/Z0v/pBJ",
-  "username": "my-application"
-}
-```
-
-## Library management
-
-The `library` endpoint configures the sets of service accounts that Vault will offer for check-out.
-
-### Parameters
-
-- `name` (string: "", required): The name of the set of service accounts.
-- `service_account_names` (string: "", or list: [] required): The names of all the service accounts that can be
-  checked out from this set. These service accounts must only be used by Vault, and may only be in one set. These
-  service accounts must already exist in Active Directory.
-- `ttl` (duration: "24h", optional): The maximum amount of time a single check-out lasts before Vault
-  automatically checks it back in. Defaults to 24 hours. Setting it to zero reflects an unlimited lending period.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-- `max_ttl` (duration: "24h", optional): The maximum amount of time a check-out last with renewal before Vault
-  automatically checks it back in. Defaults to 24 hours. Setting it to zero reflects an unlimited lending period.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-- `disable_check_in_enforcement` (bool: false, optional): Disable enforcing that service accounts must be
-  checked in by the entity or client token that checked them out. Defaults to false.
-
-When adding a service account to the library, Vault verifies it already exists in Active Directory.
-
-| Method   | Path                    |
-| :------- | :---------------------- |
-| `LIST`   | `/ad/library`           |
-| `POST`   | `/ad/library/:set_name` |
-| `GET`    | `/ad/library/:set_name` |
-| `DELETE` | `/ad/library/:set_name` |
-
-### Sample post request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ad/library/accounting-team
-```
-
-### Sample post payload
-
-```json
-{
-  "service_account_names": ["fizz@example.com", "buzz@example.com"],
-  "ttl": "10h",
-  "max_ttl": "20h",
-  "disable_check_in_enforcement": false
-}
-```
-
-### Sample get response
-
-```json
-{
-  "service_account_names": ["fizz@example.com", "buzz@example.com"],
-  "ttl": "10h",
-  "max_ttl": "20h",
-  "disable_check_in_enforcement": false
-}
-```
-
-### Sample list response
-
-Performing a `LIST` on the `/ad/library` endpoint will list the names of all the sets of service accounts Vault contains.
-
-```json
-["accounting-team"]
-```
-
-## Check-out management
-
-These endpoints help manage check-outs.
-
-### Check a credential out
-
-Returns a `200` if a credential is available, and a `400` if no credential is available.
-
-- `name` (string: "", required): The name of the set of service accounts.
-- `ttl` (duration: "", optional): The maximum amount of time a check-out lasts before Vault
-  automatically checks it back in. Setting it to zero reflects an unlimited lending period.
-  Defaults to the set's `ttl`. If the requested `ttl` is higher than the set's, the set's will be used.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `POST` | `/ad/library/:set_name/check-out` |
-
-### Sample post request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ad/library/accounting-team/check-out
-```
-
-### Sample post payload
-
-```json
-{
-  "ttl": "1h"
-}
-```
-
-### Sample post response
-
-```json
-{
-  "request_id": "364a17d4-e5ab-998b-ceee-b49929229e0c",
-  "lease_id": "ad/library/accounting-team/check-out/aoBsaBEI4PK96VnukubvYDlZ",
-  "renewable": true,
-  "lease_duration": 36000,
-  "data": {
-    "password": "?@09QW0KZ8DSBu3deIu7XLY1NZqzwhozmMAZ6v0IcZJGOjs5GvpVMvOeW7/duls2",
-    "service_account_name": "fizz@example.com"
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-### Check a credential in
-
-By default, check-in must be called by the same entity or client token used for check-out.
-To disable this behavior, use the `disable_check_in_enforcement` toggle on the library set. Or, use
-the `ad/library/manage/:set_name/check-in` behavior to force check-in of the account. Access to the
-"manage" endpoint should only be granted to highly privileged Vault users, like Vault operators.
-
-If a caller attempts to check in a service account they're not authorized to check in, they will
-receive an error response. If they attempt to check in a service account they _are_ authorized to
-check in, but it's _already_ checked in, they will receive a successful response but the account
-will not be included in the `check_ins` listed. `check_ins` shows which service accounts were checked
-in _by this particular call_.
-
-- `name` (string: "", required): The name of the set of service accounts.
-- `service_account_names` (string: "", or list: [] optional): The names of all the service accounts to be
-  checked in. May be omitted if only one is checked out.
-
-| Method | Path                                    |
-| :----- | :-------------------------------------- |
-| `POST` | `/ad/library/:set_name/check-in`        |
-| `POST` | `/ad/library/manage/:set_name/check-in` |
-
-### Sample post request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ad/library/accounting-team/check-in
-```
-
-### Sample post payload
-
-```json
-{
-  "service_account_names": ["fizz@example.com"]
-}
-```
-
-### Sample post response
-
-```json
-{
-  "request_id": "db45c714-3f68-b748-95bc-8f7467637a52",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "check_ins": ["fizz@example.com"]
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-### Check the status of service accounts
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/ad/library/:set_name/status` |
-
-### Sample get request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/ad/library/accounting-team/status
-```
-
-### Sample get response
-
-```json
-{
-  "request_id": "9e44c8b5-d142-5867-2a11-49f3ba71215a",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "buzz@example.com": {
-      "available": true
-    },
-    "fizz@example.com": {
-      "available": false,
-      "borrower_client_token": "4c653e473bf7e27c6759fccc3def20c44d776279",
-      "borrower_entity_id": "631256b1-8523-9838-5501-d0a1e2cdad9c"
-    }
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Rotate root credentials
-
-Rotate the `bindpass` to a new one known only to Vault.
-
-### Risks
-
-1. When the `bindpass` is rotated, it successfully gets rotated in Active Directory but Vault can't store it so it becomes unknown.
-2. If the `binddn` in use applies to more than one entity in Active Directory, root credential rotation will fail because it's unclear which entity to perform the operation for.
-
-### Mitigating risks
-
-1. Always have another account that can provision a new `binddn` and `bindpass` to replace one whose password becomes unknown.
-2. Ensure the `binddn` in use only applies to one entity by including all distinguished name parameters possible. For example, use `"CN=vault-ad-test,CN=Users,DC=example,DC=com"` instead of `"CN=vault-ad-test"`.
-
-### Endpoints
-
-| Method | Path              |
-| :----- | :---------------- | -------------------------------------- |
-| `GET`  | `/ad/rotate-root` | `204 (empty body) or 200 with warning` |
-| `POST` | `/ad/rotate-root` | `204 (empty body) or 200 with warning` |
-
-Generally, `rotate-root` returns a 204. However, if `rotate-root` is already in progress, it may return a 200 with a warning that root credential rotation is already in progress.
-
-### Sample get request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/ad/rotate-root
-```
-
-### Sample post request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/ad/rotate-root
-```
-
-## Rotate role credentials
-
-Manually rotate the password of a managed Active Directory service account.
-
-### Endpoints
-
-| Method | Path                         |                                        |
-| :----- | :--------------------------- | -------------------------------------- |
-| `POST` | `/ad/rotate-role/:role_name` | `204 (empty body) or 200 with warning` |
-
-Generally, `rotate-role` returns a 204. However, if `rotate-role` is already in progress, it may return a 200 with a warning that credential rotation is already in progress.
-
-### Sample post request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/ad/rotate-role/my-application
-```
diff --git a/website/content/api-docs/secret/alicloud.mdx b/website/content/api-docs/secret/alicloud.mdx
deleted file mode 100644
index 48bb366f969..00000000000
--- a/website/content/api-docs/secret/alicloud.mdx
+++ /dev/null
@@ -1,215 +0,0 @@
----
-layout: api
-page_title: AliCloud - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault AliCloud secrets engine.
----
-
-# AliCloud secrets engine (API)
-
-This is the API documentation for the Vault AliCloud secrets engine. For general
-information about the usage and operation of the AliCloud secrets engine, please see
-the [Vault AliCloud documentation](/vault/docs/secrets/alicloud).
-
-This documentation assumes the AliCloud secrets engine is enabled at the `/alicloud` path
-in Vault. Since it is possible to enable secrets engines at any location, please
-update your API calls accordingly.
-
-## Config management
-
-This endpoint configures the root RAM credentials to communicate with AliCloud. AliCloud
-will use credentials in the following order:
-
-1. [Environment variables](https://github.com/aliyun/alibaba-cloud-sdk-go/blob/master/sdk/auth/credentials/providers/env.go)
-2. A static credential configuration set at this endpoint
-3. Instance metadata (recommended)
-
-To use instance metadata, leave the static credential configuration unset.
-
-At present, this endpoint does not confirm that the provided AliCloud credentials are
-valid AliCloud credentials with proper permissions.
-
-Please see the [Vault AliCloud documentation](/vault/docs/secrets/alicloud) for
-the policies that should be attached to the access key you provide.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/alicloud/config` |
-| `GET`  | `/alicloud/config` |
-
-### Parameters
-
-- `access_key` (string, required) - The ID of an access key with appropriate policies.
-- `secret_key` (string, required) - The secret for that key.
-
-### Sample post request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/alicloud/config
-```
-
-### Sample post payload
-
-```json
-{
-  "access_key": "0wNEpMMlzy7szvai",
-  "secret_key": "PupkTg8jdmau1cXxYacgE736PJj4cA"
-}
-```
-
-### Sample get response data
-
-```json
-{
-  "access_key": "0wNEpMMlzy7szvai"
-}
-```
-
-## Role management
-
-The `role` endpoint configures how Vault will generate credentials for users of each role.
-
-### Parameters
-
-- `name` (string, required) – Specifies the name of the role to generate credentials against. This is part of the request URL.
-- `remote_policies` (string, optional) - The names and types of a pre-existing policies to be applied to the generate access token. Example: "name:AliyunOSSReadOnlyAccess,type:System".
-- `inline_policies` (string, optional) - The policy document JSON to be generated and attached to the access token.
-- `role_arn` (string, optional) - The ARN of a role that will be assumed to obtain STS credentials. See [Vault AliCloud documentation](/vault/docs/secrets/alicloud) regarding trusted actors.
-- `ttl` (int, optional) - The duration in seconds after which the issued token should expire. Defaults to 0, in which case the value will fallback to the system/mount defaults.
-- `max_ttl` (int, optional) - The maximum allowed lifetime of tokens issued using this role.
-
-| Method   | Path                        |
-| :------- | :-------------------------- |
-| `GET`    | `/alicloud/role`            |
-| `POST`   | `/alicloud/role/:role_name` |
-| `GET`    | `/alicloud/role/:role_name` |
-| `DELETE` | `/alicloud/role/:role_name` |
-
-### Sample post request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/alicloud/role/my-application
-```
-
-### Sample post payload using policies
-
-```json
-{
-  "remote_policies": [
-    "name:AliyunOSSReadOnlyAccess,type:System",
-    "name:AliyunRDSReadOnlyAccess,type:System"
-  ],
-  "inline_policies": "[{\"Statement\": [{\"Action\": [\"ram:Get*\",\"ram:List*\"],\"Effect\": \"Allow\",\"Resource\": \"*\"}],\"Version\": \"1\"}]"
-}
-```
-
-### Sample get role response using policies
-
-```json
-{
-  "inline_policies": [
-    {
-      "hash": "49796debb24d39b7a61485f9b0c97e04",
-      "policy_document": {
-        "Statement": [
-          {
-            "Action": ["ram:Get*", "ram:List*"],
-            "Effect": "Allow",
-            "Resource": "*"
-          }
-        ],
-        "Version": "1"
-      }
-    }
-  ],
-  "max_ttl": 0,
-  "remote_policies": [
-    {
-      "name": "AliyunOSSReadOnlyAccess",
-      "type": "System"
-    },
-    {
-      "name": "AliyunRDSReadOnlyAccess",
-      "type": "System"
-    }
-  ],
-  "role_arn": "",
-  "ttl": 0
-}
-```
-
-### Sample post payload using Assume-Role
-
-```json
-{
-  "role_arn": "acs:ram::5138828231865461:role/hastrustedactors"
-}
-```
-
-### Sample get role response using Assume-Role
-
-```json
-{
-  "inline_policies": null,
-  "max_ttl": 0,
-  "remote_policies": null,
-  "role_arn": "acs:ram::5138828231865461:role/hastrustedactors",
-  "ttl": 0
-}
-```
-
-### Sample list roles response
-
-Performing a `LIST` on the `/alicloud/roles` endpoint will list the names of all the roles Vault contains.
-
-```json
-["policy-based", "role-based"]
-```
-
-## Generate RAM credentials
-
-This endpoint generates dynamic RAM credentials based on the named role. This
-role must be created before queried.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/alicloud/creds/:name` |
-
-### Parameters
-
-- `name` (string, required) – Specifies the name of the role to generate credentials against. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/alicloud/creds/example-role
-```
-
-### Sample response for roles using policies
-
-```json
-{
-  "access_key": "0wNEpMMlzy7szvai",
-  "secret_key": "PupkTg8jdmau1cXxYacgE736PJj4cA"
-}
-```
-
-### Sample response for roles using Assume-Role
-
-```json
-{
-  "access_key": "STS.L4aBSCSJVMuKg5U1vFDw",
-  "expiration": "2018-08-15T22:04:07Z",
-  "secret_key": "wyLTSmsyPGP1ohvvw8xYgB29dlGI8KMiH2pKCNZ9",
-  "security_token": "CAESrAIIARKAAShQquMnLIlbvEcIxO6wCoqJufs8sWwieUxu45hS9AvKNEte8KRUWiJWJ6Y+YHAPgNwi7yfRecMFydL2uPOgBI7LDio0RkbYLmJfIxHM2nGBPdml7kYEOXmJp2aDhbvvwVYIyt/8iES/R6N208wQh0Pk2bu+/9dvalp6wOHF4gkFGhhTVFMuTDRhQlNDU0pWTXVLZzVVMXZGRHciBTQzMjc0KgVhbGljZTCpnJjwySk6BlJzYU1ENUJuCgExGmkKBUFsbG93Eh8KDEFjdGlvbkVxdWFscxIGQWN0aW9uGgcKBW9zczoqEj8KDlJlc291cmNlRXF1YWxzEghSZXNvdXJjZRojCiFhY3M6b3NzOio6NDMyNzQ6c2FtcGxlYm94L2FsaWNlLyo="
-}
-```
diff --git a/website/content/api-docs/secret/aws.mdx b/website/content/api-docs/secret/aws.mdx
deleted file mode 100644
index 9a28b804099..00000000000
--- a/website/content/api-docs/secret/aws.mdx
+++ /dev/null
@@ -1,788 +0,0 @@
----
-layout: api
-page_title: AWS - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault AWS secrets engine.
----
-
-# AWS secrets engine (API)
-
-This is the API documentation for the Vault AWS secrets engine. For general
-information about the usage and operation of the AWS secrets engine, please see
-the [Vault AWS documentation](/vault/docs/secrets/aws).
-
-This documentation assumes the AWS secrets engine is enabled at the `/aws` path
-in Vault. Since it is possible to enable secrets engines at any location, please
-update your API calls accordingly.
-
-## Configure root credentials
-
-This endpoint configures the root credentials to communicate with AWS. Credentials
-can be configured either with IAM access keys for a privileged AWS account, or using
-Plugin Workload Identity Federation (WIF).
-
-### IAM
-
-There are multiple ways to pass root IAM credentials to the Vault server, specified
-below with the highest precedence first. If credentials already exist, this will
-overwrite them.
-
-The official AWS SDK is used for sourcing credentials from env vars, shared
-files, or IAM/ECS instances.
-
-- Static credentials provided to the API as a payload
-
-- Credentials in the `AWS_ACCESS_KEY`, `AWS_SECRET_KEY`, and `AWS_REGION`
-  environment variables **on the server**
-
-- Shared credentials files
-
-- Assigned IAM role or ECS task role credentials
-
-At present, this endpoint does not confirm that the provided AWS credentials are
-valid AWS credentials with proper permissions.
-
-### Plugin WIF
-
-A trust relationship with an external AWS system can be established by using the AWS Secret
-Engine's plugin identity token. The audience claim value and the TTL for this plugin identity
-token can be provided to the API as part of the payload.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/aws/config/root` |
-
-### Parameters
-
-- `max_retries` `(int: -1)` - Number of max retries the client should use for
-  recoverable errors. The default (`-1`) falls back to the AWS SDK's default
-  behavior.
-
-- `access_key` `(string: "")` – Specifies the AWS access key ID. Mutually exclusive with
-  `identity_token_audience`.
-
-- `secret_key` `(string: "")` – Specifies the AWS secret access key. Must be provided with
-  `access_key`.
-
-- `role_arn` `(string: "")` – Role ARN to assume for plugin workload identity token federation.
-  Required with `identity_token_audience`.
-
-- `identity_token_audience` `(string: "")` - The audience claim value for plugin identity tokens.
-  Must match an allowed audience configured for the target [IAM OIDC identity provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html#manage-oidc-provider-console).
-  Mutually exclusive with `access_key`.
-
-- `identity_token_ttl` `(string/int: 3600)` - The TTL of generated tokens. Defaults to 1 hour.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `region` `(string: <optional>)` – Specifies the AWS region. If not set it
-  will use the `AWS_REGION` env var, `AWS_DEFAULT_REGION` env var, or
-  `us-east-1` in that order.
-
-- `iam_endpoint` `(string: <optional>)` – Specifies a custom HTTP IAM endpoint to use.
-
-- `sts_endpoint` `(string: <optional>)` – Specifies a custom HTTP STS endpoint to use.
-
-- `username_template` `(string: <optional>)` - [Template](/vault/docs/concepts/username-templating) describing how
-  dynamic usernames are generated. The username template is used to generate both IAM usernames (capped at 64 characters)
-  and STS usernames (capped at 32 characters). Longer usernames result in a 500 error.
-
-  To ensure generated usernames are within length limits for both STS/IAM, the template must adequately handle
-  both conditional cases (see [Conditional Templates](https://pkg.go.dev/text/template)). As an example, if no template
-  is provided the field defaults to the template below. It is to be noted that, DisplayName is the name of the vault
-  authenticated user running the AWS credential generation and PolicyName is the name of the Role for which the
-  credential is being generated for:
-
-  ```
-  {{ if (eq .Type "STS") }}
-      {{ printf "vault-%s-%s" (unix_time) (random 20) | truncate 32 }}
-  {{ else }}
-      {{ printf "vault-%s-%s-%s" (printf "%s-%s" (.DisplayName) (.PolicyName) | truncate 42) (unix_time) (random 20) | truncate 64 }}
-  {{ end }}
-  ```
-
-### Sample payload
-
-```json
-{
-  "access_key": "AKIA...",
-  "secret_key": "2J+...",
-  "region": "us-east-1"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/aws/config/root
-```
-
-## Read root configuration
-
-This endpoint allows you to read non-secure values that have been configured in the
-`config/root` endpoint. In particular, the `secret_key` parameter is never returned.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/aws/config/root` |
-
-### Sample request
-
-```shell-session
-$ curl
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/aws/config/root
-
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "access_key": "AKIAEXAMPLE",
-    "region": "us-west-2",
-    "iam_endpoint": "https://iam.amazonaws.com",
-    "sts_endpoint": "https://sts.us-west-2.amazonaws.com",
-    "max_retries": -1
-  }
-}
-```
-
-## Rotate root IAM credentials
-
-When you have configured Vault with static credentials, you can use this
-endpoint to have Vault rotate the access key it used. Note that, due to AWS
-eventual consistency, after calling this endpoint, subsequent calls from Vault
-to AWS may fail for a few seconds until AWS becomes consistent again.
-
-In order to call this endpoint, Vault's AWS access key MUST be the only access
-key on the IAM user; otherwise, generation of a new access key will fail. Once
-this method is called, Vault will now be the only entity that knows the AWS
-secret key is used to access AWS.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/aws/config/rotate-root` |
-
-### Parameters
-
-There are no parameters to this operation.
-
-### Sample request
-
-```shell-session
-$ curl \
-  --header "X-Vault-Token: ..." \
-  --request POST \
-  http://127.0.0.1:8200/v1/aws/config/rotate-root
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "access_key": "AKIA..."
-  }
-}
-```
-
-The new access key Vault uses is returned by this operation.
-
-## Configure lease
-
-This endpoint configures lease settings for the AWS secrets engine. It is
-optional, as there are default values for `lease` and `lease_max`.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/aws/config/lease` |
-
-### Parameters
-
-- `lease` `(string: <required>)` – Specifies the lease value provided as a
-  string duration with time suffix. "h" (hour) is the largest suffix.
-
-- `lease_max` `(string: <required>)` – Specifies the maximum lease value
-  provided as a string duration with time suffix. "h" (hour) is the largest
-  suffix.
-
-### Sample payload
-
-```json
-{
-  "lease": "30m",
-  "lease_max": "12h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/aws/config/lease
-```
-
-## Read lease
-
-This endpoint returns the current lease settings for the AWS secrets engine.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/aws/config/lease` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/aws/config/lease
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "lease": "30m0s",
-    "lease_max": "12h0m0s"
-  }
-}
-```
-
-## Create/Update role
-
-This endpoint creates or updates the role with the given `name`. If a role with
-the name does not exist, it will be created. If the role exists, it will be
-updated with the new attributes.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/aws/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create. This
-  is part of the request URL.
-
-- `credential_type` `(string: <required>)` – Specifies the type of credential to be used when
-  retrieving credentials from the role. Must be one of `iam_user`,
-  `assumed_role`, `federation_token`, or `session_token`.
-
-- `role_arns` `(list: [])` – Specifies the ARNs of the AWS roles this Vault role
-  is allowed to assume. Required when `credential_type` is `assumed_role` and
-  prohibited otherwise. This is a comma-separated string or JSON array.
-
-- `policy_arns` `(list: [])` – Specifies a list of AWS managed policy ARN. The
-  behavior depends on the credential type. With `iam_user`, the policies will
-  be attached to IAM users when they are requested. With `assumed_role` and
-  `federation_token`, the policy ARNs will act as a filter on what the
-  credentials can do, similar to `policy_document`.
-  When `credential_type` is `iam_user` or `federation_token`, at
-  least one of `policy_arns` or `policy_document` must be specified. This is a
-  comma-separated string or JSON array. When using `session_token`, this field
-  is disallowed.
-
-- `policy_document` `(string)` – The IAM policy document for the role. The
-  behavior depends on the credential type. With `iam_user`, the policy document
-  will be attached to the IAM user generated and augment the permissions the IAM
-  user has. With `assumed_role` and `federation_token`, the policy document will
-  act as a filter on what the credentials can do, similar to `policy_arns`. With
-  `session_token`, this field is disallowed.
-
-- `iam_groups` `(list: [])` - A list of IAM group names. IAM users generated
-  against this vault role will be added to these IAM Groups. For a credential
-  type of `assumed_role` or `federation_token`, the policies sent to the
-  corresponding AWS call (sts:AssumeRole or sts:GetFederation) will be the
-  policies from each group in `iam_groups` combined with the `policy_document`
-  and `policy_arns` parameters.
-
-- `iam_tags` `(list: [])` - A list of strings representing a key/value pair to be used as a
-  tag for any `iam_user` user that is created by this role. Format is a key and value
-  separated by an `=` (e.g. `test_key=value`). Note: when using the CLI multiple tags
-  can be specified in the role configuration by adding another `iam_tags` assignment
-  in the same command.
-
-- `default_sts_ttl` `(string)` - The default TTL for STS credentials. When a TTL is not
-  specified when STS credentials are requested, and a default TTL is specified
-  on the role, then this default TTL will be used. Valid only when
-  `credential_type` is one of `assumed_role` or `federation_token`.
-
-- `max_sts_ttl` `(string)` - The max allowed TTL for STS credentials (credentials
-  TTL are capped to `max_sts_ttl`). Valid only when `credential_type` is one of
-  `assumed_role` or `federation_token`.
-
-- `user_path` `(string)` - The path for the user name. Valid only when
-  `credential_type` is `iam_user`. Default is `/`
-
-- `permissions_boundary_arn` `(string)` - The ARN of the [AWS Permissions
-  Boundary](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
-  to attach to IAM users created in the role. Valid only when `credential_type`
-  is `iam_user`. If not specified, then no permissions boundary policy will be
-  attached.
-
-- `mfa_serial_number` `(string)` - The ARN or hardware device number of the device configured
-  to the IAM user for multi-factor authentication. Only required if the IAM user has an MFA device
-  set up in AWS.
-
-Legacy parameters:
-
-These parameters are supported for backwards compatibility only. They cannot be
-mixed with the parameters listed above.
-
-- `policy` `(string: <required unless arn provided>)` – Specifies the IAM policy
-  in JSON format.
-
-- `arn` `(string: <required unless policy provided>)` – Specifies the full ARN
-  reference to the desired existing policy.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/aws/roles/example-role
-```
-
-### Sample payloads
-
-Using an inline IAM policy:
-
-```json
-{
-  "credential_type": "federation_token",
-  "policy_document": "{\"Version\": \"...\"}"
-}
-```
-
-Using a Session Token:
-
-```json
-{
-  "credential_type": "session_token"
-}
-```
-
-Using an ARN:
-
-```json
-{
-  "credential_type": "assumed_role",
-  "role_arns": "arn:aws:iam::123456789012:role/DeveloperRole"
-}
-```
-
-Using groups:
-
-```json
-{
-  "credential_type": "assumed_role",
-  "iam_groups": ["group1", "group2"]
-}
-```
-
-Using tags:
-
-<Tabs>
-  <Tab heading="cURL">
-
-  ```json
-  {
-    "credential_type": "iam_user",
-    "iam_tags": [
-      "first_key=first_value",
-      "second_key=second_value"
-    ]
-  }
-  ```
-
-  or
-
-  ```json
-  {
-    "credential_type": "iam_user",
-    "iam_tags": {
-      "first_key": "first_value",
-      "second_key": "second_value"
-    }
-  }
-  ```
-
-  </Tab>
-  <Tab heading="CLI">
-
-  ```bash
-    vault write aws/roles/example-role \
-    credential_type=iam_user \
-    iam_tags="first_key=first_value" \
-    iam_tags="second_key=second_value" \
-  ```
-
-  or
-
-  ```bash
-    vault write aws/roles/example-role \
-    credential_type=iam_user \
-    iam_tags=@test.json
-  ```
-
-  where `test.json` is:
-
-  ```json
-  ["tag1=42", "tag2=something"]
-  ```
-
-  </Tab>
-</Tabs>
-
-## Read role
-
-This endpoint queries an existing role by the given name. If the role does not
-exist, a 404 is returned.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/aws/roles/:name` |
-
-If invalid role data was supplied to the role from an earlier version of Vault,
-then it will show up in the response as `invalid_data`.
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to read. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/aws/roles/example-role
-```
-
-### Sample responses
-
-For an inline IAM policy:
-
-```json
-{
-  "data": {
-    "policy_document": "{\"Version\": \"...\"}",
-    "policy_arns": [],
-    "credential_types": ["assumed_role"],
-    "role_arns": [],
-    "iam_groups": []
-  }
-}
-```
-
-For a role ARN:
-
-```json
-{
-  "data": {
-    "policy_document": "",
-    "policy_arns": [],
-    "credential_types": ["assumed_role"],
-    "role_arns": ["arn:aws:iam::123456789012:role/example-role"],
-    "iam_groups": []
-  }
-}
-```
-
-For IAM groups:
-
-```json
-{
-  "data": {
-    "policy_document": "",
-    "policy_arns": [],
-    "credential_types": ["assumed_role"],
-    "role_arns": [],
-    "iam_groups": ["group1", "group2"]
-  }
-}
-```
-
-## List roles
-
-This endpoint lists all existing roles in the secrets engine.
-
-| Method | Path         |
-| :----- | :----------- |
-| `LIST` | `/aws/roles` |
-
-### Sample request
-
-```shell-session
-$ curl
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/aws/roles
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-role"]
-  }
-}
-```
-
-## Delete role
-
-This endpoint deletes an existing role by the given name. If the role does not
-exist, a 404 is returned.
-
-| Method   | Path               |
-| :------- | :----------------- |
-| `DELETE` | `/aws/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to delete. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/aws/roles/example-role
-```
-
-## Generate credentials
-
-This endpoint generates credentials based on the named role. This role must be
-created before queried.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/aws/creds/:name` |
-| `POST` | `/aws/sts/:name`   |
-
-The `/aws/creds` and `/aws/sts` endpoints are almost identical. The exception is
-when retrieving credentials for a role that was specified with the legacy `arn`
-or `policy` parameter. In this case, credentials retrieved through `/aws/sts`
-must be of either the `assumed_role` or `federation_token` types, and
-credentials retrieved through `/aws/creds` must be of the `iam_user` type.
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to generate
-  credentials against. This is part of the request URL.
-
-- `role_arn` `(string)` – The ARN of the role to assume if `credential_type` on
-  the Vault role is `assumed_role`. Must match one of the allowed role ARNs in
-  the Vault role. Optional if the Vault role only allows a single AWS role ARN;
-  required otherwise.
-
-- `role_session_name` `(string)` - The role session name to attach to the assumed role ARN.
-  `role_session_name` is limited to 64 characters; if exceeded, the `role_session_name` in the
-  assumed role ARN will be truncated to 64 characters. If `role_session_name` is not provided,
-  then it will be generated dynamically by default.
-
-- `ttl` `(string: "3600s")` – Specifies the TTL for the use of the STS token.
-  This is specified as a string with a duration suffix. Valid only when
-  `credential_type` is `assumed_role` `federation_token`, or `session_token`. When not specified,
-  the `default_sts_ttl` set for the role will be used. If that is also not set, then
-  the default value of `3600s` will be used. AWS places limits
-  on the maximum TTL allowed. See the AWS documentation on the `DurationSeconds`
-  parameter for
-  [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html)
-  (for `assumed_role` credential types),
-  [GetFederationToken](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html)
-  (for `federation_token` credential types), or
-  [GetSessionToken](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html)
-  (for `session_token` credential types) for more details.
-
-- `mfa_code` `(string)` - The TOTP generated by the MFA device configured on the IAM user and set
-  on the Vault role. This is optional based on whether the Vault role has the `mfa_serial_number`
-  field set or not. Only required if the Vault role has the `mfa_serial_number` set on it.
-
-### Sample AssumeRole request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/aws/creds/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "access_key": "AKIA...",
-    "secret_key": "xlCs...",
-    "session_token": null,
-    "arn": "arn:aws:sts::123456789012:assumed-role/DeveloperRole/some-user-supplied-role-session-name"
-  }
-}
-```
-
-### Sample Session Token request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/aws/creds/example-role?mfa_code=123456
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "access_key": "AKIA...",
-    "secret_key": "xlCs...",
-    "session_token": "FwoG...",
-  }
-}
-```
-
-## Create/Update static role
-This endpoint creates or updates static role definitions. A static role is a 1-to-1 mapping
-with an AWS IAM User, which will be adopted and managed by Vault, including rotating it according
-to the configured `rotation_period`.
-
-<Note>
-
-  Vault will create a new credential upon configuration, and if the maximum number of access keys already exist,
-  Vault will rotate the oldest one. Vault must do this to know the credential.
-
-  At each rotation, Vault will rotate the oldest existing credential.
-
-</Note>
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/aws/static-roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create. This
-is specified as part of the URL.
-
-- `username` `(string: <required>)` – Specifies the username of the IAM user.
-
-- `rotation_period` `(string/int: <required>)` – Specifies the amount of time
-Vault should wait before rotating the password. The minimum is 1 minute. Can be
-specified in either `24h` or `86400` format (see [duration format strings](/vault/docs/concepts/duration-format)).
-Updating the rotation period will 'reset' the next rotation to occur at `now` + `rotation_period`.
-
-### Sample payload
-
-```json
-{
-  "username": "example-user",
-  "rotation_period": "11h30m"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/aws/static-roles/my-static-role
-```
-
-### Sample response
-
-## Read static role
-
-This endpoint queries the static role definition.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/aws/static-roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the static role to read.
-This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/aws/static-roles/my-static-role
-```
-### Sample response
-
-```json
-{
-  "name": "my-static-role",
-  "username": "example-user",
-  "rotation_period": "11h30m"
-}
-```
-
-## Delete static role
-
-This endpoint deletes the static role definition. The user, having been defined externally,
-must be cleaned up manually.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/aws/static-roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the static role to
-delete. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/aws/static-roles/my-static-role
-```
-
-## Get static credentials
-
-This endpoint returns the current credentials based on the named static role.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/aws/static-creds/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the static role to get
-credentials for. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/aws/static-creds/my-static-role
-```
-
-### Sample response
-
-```json
-{
-  "access_key": "AKIA...",
-  "secret_key": "..."
-}
-```
diff --git a/website/content/api-docs/secret/azure.mdx b/website/content/api-docs/secret/azure.mdx
deleted file mode 100644
index 2124e64b495..00000000000
--- a/website/content/api-docs/secret/azure.mdx
+++ /dev/null
@@ -1,341 +0,0 @@
----
-layout: api
-page_title: Azure - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault Azure secrets engine.
----
-
-# Azure secrets engine (API)
-
-This is the API documentation for the Vault Azure
-secrets engine. For general information about the usage and operation of
-the Azure secrets engine, please see the main [Azure secrets documentation][docs].
-
-This documentation assumes the Azure secrets engine is enabled at the `/azure` path
-in Vault. Since it is possible to mount secrets engines at any path, please
-update your API calls accordingly.
-
-## Configure access
-
-Configures the credentials required for the plugin to perform API calls
-to Azure. These credentials will be used to query roles and create/delete
-service principals. Environment variables will override any parameters set in the config.
-
-| Method | Path            |
-| :----- | :-------------- |
-| `POST` | `/azure/config` |
-
-- `subscription_id` (`string: <required>`) - The subscription id for the Azure Active Directory.
-  This value can also be provided with the AZURE_SUBSCRIPTION_ID environment variable.
-- `tenant_id` (`string: <required>`) - The tenant id for the Azure Active Directory.
-  This value can also be provided with the AZURE_TENANT_ID environment variable.
-- `client_id` (`string:""`) - The OAuth2 client id to connect to Azure. This value can also be provided
-  with the AZURE_CLIENT_ID environment variable. See [authentication](/vault/docs/secrets/azure#authentication) for more details.
-- `client_secret` (`string:""`) - The OAuth2 client secret to connect to Azure. This value can also be
-  provided with the AZURE_CLIENT_SECRET environment variable. See [authentication](/vault/docs/secrets/azure#authentication) for more details.
-- `environment` (`string:""`) - The Azure environment. This value can also be provided with the AZURE_ENVIRONMENT
-  environment variable. If not specified, Vault will use Azure Public Cloud.
-- `password_policy` `(string: "")` - Specifies a [password policy](/vault/docs/concepts/password-policies) to
-  use when creating dynamic credentials. Defaults to generating an alphanumeric password if not set.
-- `root_password_ttl` `(string: 182d)` - Specifies how long the root password is valid for in Azure when
-  rotate-root generates a new client secret. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-```json
-{
-  "subscription_id": "94ca80...",
-  "tenant_id": "d0ac7e...",
-  "client_id": "e607c4...",
-  "client_secret": "9a6346...",
-  "environment": "AzureGermanCloud",
-  "password_policy": "azure_policy",
-  "root_password_ttl": "48d"
-}
-```
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/azure/config
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault write azure/config \
-    subscription_id="94ca80..." \
-    tenant_id="d0ac7e...",
-    client_id="e607c4...",
-    client_secret="9a6346...",
-    environment="AzureGermanCloud",
-    password_policy="azure_policy"
-```
-
-</Tab>
-</Tabs>
-
-## Read config
-
-Return the stored configuration, omitting `client_secret`.
-
-| Method | Path            |
-| :----- | :-------------- |
-| `GET`  | `/azure/config` |
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/azure/config
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault read azure/config
-```
-
-</Tab>
-</Tabs>
-
-### Sample response
-
-```json
-{
-  "data": {
-    "subscription_id": "94ca80...",
-    "tenant_id": "d0ac7e...",
-    "client_id": "e607c4...",
-    "environment": "AzureGermanCloud"
-  },
-  ...
-}
-```
-
-## Delete config
-
-Deletes the stored Azure configuration and credentials.
-
-| Method   | Path            |
-| :------- | :-------------- |
-| `DELETE` | `/azure/config` |
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/azure/config
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault delete azure/config
-```
-
-</Tab>
-</Tabs>
-
-## Rotate root
-
-This endpoint generates a new client secret for the root account defined in the config. The
-value generated will only be known by Vault.
-
-~> Due to the eventual consistency of Microsoft Azure client secret APIs, the plugin
-may briefly stop authenticating to Azure as the password propagates through their
-datacenters.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/azure/rotate-root` |
-
-### Parameters
-
-There are no parameters to this operation.
-
-### Sample request
-
-```shell-session
-$ curl \
-  --header "X-Vault-Token: ..." \
-  --request POST \
-  http://127.0.0.1:8200/v1/azure/rotate-root
-```
-
-## Create/Update role
-
-Create or update a Vault role. Either `application_object_id` or
-`azure_roles` must be provided, and these resources must exist for this
-call to succeed. See the Azure secrets [roles docs][roles] for more
-information about roles.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/azure/roles/:name` |
-
-### Parameters
-
-- `azure_roles` (`string: ""`) - List of Azure roles to be assigned to the generated service
-  principal. The array must be in JSON format, properly escaped as a string. See [roles docs][roles]
-  for details on role definition.
-- `azure_groups` (`string: ""`) - List of Azure groups that the generated service principal will be
-  assigned to. The array must be in JSON format, properly escaped as a string. See [groups docs][groups]
-  for more details.
-- `application_object_id` (`string: ""`) - Application Object ID for an existing service principal that will
-  be used instead of creating dynamic service principals. If present, `azure_roles` will be ignored. See
-  [roles docs][roles] for details on role definition.
-- `persist_app` (`bool: "false"`) – If set to true, persists the created service principal and application for the lifetime of the role.
- Useful for when the Service Principal needs to maintain ownership of objects it creates
-- `ttl` (`string: ""`) – Specifies the default TTL for service principals generated using this role.
-  Accepts time suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine default TTL time.
-- `max_ttl` (`string: ""`) – Specifies the maximum TTL for service principals generated using this role. Accepts time
-  suffixed strings ("1h") or an integer number of seconds. Defaults to the system/engine max TTL time.
-- `permanently_delete` (`bool: false`) - Specifies whether to permanently delete Applications and Service Principals that are dynamically
-  created by Vault. If `application_object_id` is present, `permanently_delete` must be `false`.
-- `sign_in_audience` (`string: ""`) - Specifies the security principal types that are allowed to sign in to the application.
-  Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount.
-- `tags` (`string: ""`) - A comma-separated string of Azure tags to attach to an application.
-
-### Sample payload
-
-```json
-{
-  "azure_roles": "[
-    {
-      \"role_name\": \"Contributor\",
-      \"scope\":  \"/subscriptions/<uuid>/resourceGroups/Website\"
-    },
-    {
-      \"role_id\": \"/subscriptions/<uuid>/providers/Microsoft.Authorization/roleDefinitions/<uuid>\",
-      \"scope\":  \"/subscriptions/<uuid>\"
-    }
-  ]",
-  "ttl": 3600,
-  "max_ttl": "24h"
-  "sign_in_audience": "AzureADMyOrg"
-  "tags": "team:engineering","environment:development"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/azure/roles/my-role
-```
-
-## List roles
-
-Lists all of the roles that are registered with the plugin.
-
-| Method | Path           |
-| :----- | :------------- |
-| `LIST` | `/azure/roles` |
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/azure/roles
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault list azure/roles
-```
-
-</Tab>
-</Tabs>
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["my-role-one", "my-role-two"]
-  }
-}
-```
-
-## Generate credentials
-
-This endpoint generates a new service principal based on the named role.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/azure/creds/:name` |
-
-### Parameters
-
-- `name` (`string: <required>`) - Specifies the name of the role to create credentials against.
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/azure/creds/my-role
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault read azure/creds/my-role
-```
-
-</Tab>
-</Tabs>
-
-### Sample response
-
-```json
-{
-  "data": {
-    "client_id": "408bf248-dd4e-4be5-919a-7f6207a307ab",
-    "client_secret": "9PfdaDP9qcf98ggw8WSttfVreFcN4q9c4m4x",
-    ...
-  }
-}
-```
-
-## Revoking/Renewing secrets
-
-See docs on how to [renew](/vault/api-docs/system/leases#renew-lease) and [revoke](/vault/api-docs/system/leases#revoke-lease) leases.
-
-[docs]: /vault/docs/secrets/azure
-[roles]: /vault/docs/secrets/azure#roles
-[groups]: /vault/docs/secrets/azure#azure-groups
diff --git a/website/content/api-docs/secret/cassandra.mdx b/website/content/api-docs/secret/cassandra.mdx
deleted file mode 100644
index 24762fb1dff..00000000000
--- a/website/content/api-docs/secret/cassandra.mdx
+++ /dev/null
@@ -1,249 +0,0 @@
----
-layout: api
-page_title: Cassandra - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault Cassandra secrets engine.
----
-
-# Cassandra secrets engine (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-~> **Deprecation Note:** This backend is deprecated in favor of the
-combined databases backend added in v0.7.1. See the API documentation for
-the new implementation of this backend at
-[Cassandra database plugin HTTP API](/vault/api-docs/secret/databases/cassandra).
-
-This is the API documentation for the Vault Cassandra secrets engine. For
-general information about the usage and operation of the Cassandra backend,
-please see the
-[Vault Cassandra backend documentation](/vault/docs/secrets/databases/cassandra).
-
-This documentation assumes the Cassandra backend is mounted at the `/cassandra`
-path in Vault. Since it is possible to enable secrets engines at any location,
-please update your API calls accordingly.
-
-## Configure connection
-
-This endpoint configures the connection information used to communicate with
-Cassandra.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/cassandra/config/connection` |
-
-### Parameters
-
-- `hosts` `(string: <required>)` – Specifies a set of comma-delineated Cassandra
-  hosts to connect to.
-
-- `username` `(string: <required>)` – Specifies the username to use for
-  superuser access.
-
-- `password` `(string: <required>)` – Specifies the password corresponding to
-  the given username.
-
-- `tls` `(bool: true)` – Specifies whether to use TLS when connecting to
-  Cassandra.
-
-- `insecure_tls` `(bool: false)` – Specifies whether to skip verification of the
-  server certificate when using TLS.
-
-- `pem_bundle` `(string: "")` – Specifies concatenated PEM blocks containing a
-  certificate and private key; a certificate, private key, and issuing CA
-  certificate; or just a CA certificate.
-
-- `pem_json` `(string: "")` – Specifies JSON containing a certificate and
-  private key; a certificate, private key, and issuing CA certificate; or just a
-  CA certificate. For convenience format is the same as the output of the
-  `issue` command from the `pki` backend; see
-  [the pki documentation](/vault/docs/secrets/pki).
-
-- `protocol_version` `(int: 2)` – Specifies the CQL protocol version to use.
-
-- `connect_timeout` `(string: "5s")` – Specifies the connection timeout to use.
-
-- `consistency` `(string: "")` – Specifies the consistency option to use. See
-  the [gocql
-  definition](https://github.com/gocql/gocql/blob/master/frame.go#L188) for
-  valid options.
-
-TLS works as follows:
-
-- If `tls` is set to true, the connection will use TLS; this happens
-  automatically if `pem_bundle`, `pem_json`, or `insecure_tls` is set
-
-- If `insecure_tls` is set to true, the connection will not perform verification
-  of the server certificate; this also sets `tls` to true
-
-- If only `issuing_ca` is set in `pem_json`, or the only certificate in
-  `pem_bundle` is a CA certificate, the given CA certificate will be used for
-  server certificate verification; otherwise the system CA certificates will be
-  used
-
-- If `certificate` and `private_key` are set in `pem_bundle` or `pem_json`,
-  client auth will be turned on for the connection
-
-`pem_bundle` should be a PEM-concatenated bundle of a private key + client
-certificate, an issuing CA certificate, or both. `pem_json` should contain the
-same information; for convenience, the JSON format is the same as that output by
-the issue command from the PKI backend.
-
-### Sample payload
-
-```json
-{
-  "hosts": "cassandra1.local",
-  "username": "user",
-  "password": "pass"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/cassandra/config/connection
-```
-
-## Create role
-
-This endpoint creates or updates the role definition.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/cassandra/roles/:name` |
-
-### Parameters
-
-- `creation_cql` `(string: "")` – Specifies the CQL statements executed to
-  create and configure the new user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The '{{username}}' and
-  '{{password}}' values will be substituted; it is required that these
-  parameters are in single quotes. The default creates a non-superuser user with
-  no authorization grants.
-
-- `rollback_cql` `(string: "")` – Specifies the CQL statements executed to
-  attempt a rollback if an error is encountered during user creation. The
-  default is to delete the user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The '{{username}}' and
-  '{{password}}' values will be substituted; it is required that these
-  parameters are in single quotes.
-
-- `lease` `(string: "")` – Specifies the lease value provided as a string
-  duration with time suffix. "h" hour is the largest suffix.
-
-- `consistency` `(string: "Quorum")` – Specifies the consistency level value
-  provided as a string. Determines the consistency level used for operations
-  performed on the Cassandra database.
-
-### Sample payload
-
-```json
-{
-  "creation_cql": "CREATE USER ..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/cassandra/roles/my-role
-```
-
-## Read role
-
-This endpoint queries the role definition.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `GET`  | `/cassandra/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to read. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/cassandra/roles/my-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "creation_cql": "CREATE USER...",
-    "rollback_cql": "DROP USER...",
-    "lease": "12h",
-    "consistency": "Quorum"
-  }
-}
-```
-
-## Delete role
-
-This endpoint deletes the role definition.
-
-| Method   | Path                     |                 |
-| :------- | :----------------------- | --------------- |
-| `DELETE` | `/cassandra/roles/:name` | `204 (no body)` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to delete. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/cassandra/roles/my-role
-```
-
-## Generate credentials
-
-This endpoint generates a new set of dynamic credentials based on the named
-role.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `GET`  | `/cassandra/creds/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create
-  credentials against. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/cassandra/creds/my-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "username": "vault-root-1430158508-126",
-    "password": "132ae3ef-5a64-7499-351e-bfe59f3a2a21"
-  }
-}
-```
diff --git a/website/content/api-docs/secret/consul.mdx b/website/content/api-docs/secret/consul.mdx
deleted file mode 100644
index ad0875ada0e..00000000000
--- a/website/content/api-docs/secret/consul.mdx
+++ /dev/null
@@ -1,350 +0,0 @@
----
-layout: api
-page_title: Consul - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault Consul secrets engine.
----
-
-# Consul secrets engine (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-@include 'consul-dataplane-compat.mdx'
-
-This is the API documentation for the Vault Consul secrets engine. For general
-information about the usage and operation of the Consul secrets engine, please
-see the [Vault Consul documentation](/vault/docs/secrets/consul).
-
-This documentation assumes the Consul secrets engine is enabled at the `/consul`
-path in Vault. Since it is possible to enable secrets engines at any location,
-please update your API calls accordingly.
-
-## Configure access
-
-This endpoint configures the access information for Consul. This access
-information is used so that Vault can communicate with Consul and generate
-Consul tokens.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/consul/config/access` |
-
-### Parameters
-
-- `address` `(string: <required>)` – Specifies the address of the Consul
-  instance, provided as `"host:port"` like `"127.0.0.1:8500"`.
-
-- `scheme` `(string: "http")` – Specifies the URL scheme to use.
-
-- `token` `(string: "")` – Specifies the Consul ACL token to use. This
-  must be a management type token. If this is not provided, Vault will try to
-  bootstrap the ACL system of the Consul cluster automatically.
-
-- `ca_cert` `(string: "")` - CA certificate to use when verifying Consul server certificate,
-  must be x509 PEM encoded.
-
-- `client_cert` `(string: "")` - Client certificate used for Consul's TLS communication,
-  must be x509 PEM encoded and if this is set you need to also set client_key.
-
-- `client_key` `(string: "")` - Client key used for Consul's TLS communication,
-  must be x509 PEM encoded and if this is set you need to also set client_cert.
-
-### Sample payload
-
-```json
-{
-  "address": "127.0.0.1:8500",
-  "scheme": "https",
-  "token": "adha..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/consul/config/access
-```
-
-## Create/Update role
-
-This endpoint creates or updates the Consul role definition. If the role does
-not exist, it will be created. If the role already exists, it will receive
-updated attributes. At least one of `consul_policies`, `consul_roles`,
-`service_identities`, or `node_identities` is required depending on the
-Consul version.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `POST` | `/consul/roles/:name` |
-
-### Parameters for consul versions 1.11 and above
-
-- `partition` `(string: "")` - Specifies the Consul admin partition in which the token is generated.
-  The partition must exist, and the Consul policies or roles assigned to the
-  Vault role must also exist inside the given partition. If not provided, the partition `default`
-  is used.
-
-To create a client token within a particular Consul admin partition:
-
-```json
-{
-  "partition": "admin1"
-}
-```
-
-### Parameters for consul versions 1.8 and above
-
-- `node_identities` `(list: <node identity or identities>)` - The list of node identities to assign to the generated
-  token. This may be a comma-separated list to attach multiple node identities to a token.
-
-To create a client token with node identities attached:
-
-```json
-{
-  "node_identities": [
-      "client-1:dc1",
-      "client-2:dc1"
-    ]
-}
-```
-
-### Parameters for consul versions 1.7 and above
-
-- `consul_namespace` `(string: "")` - Specifies the Consul namespace in which the token is generated.
-  The namespace must exist, and the Consul policies or roles assigned to the Vault role must also exist
-  inside the given Consul namespace. If not provided, the namespace `default` is used.
-
-To create a client token within a particular Consul namespace:
-
-```json
-{
-  "consul_namespace": "ns1"
-}
-```
-
-### Parameters for consul version 1.5 and above
-
-- `service_identities` `(list: <service identity or identities>)` - The list of service identities to assign to the generated
-  token. This may be a comma-separated list to attach multiple service identities to a token.
-
-- `consul_roles` `(list: <role or roles>)` – The list of Consul roles to attach to the
-  token generated by Vault.
-
-  To create a client token with roles defined in Consul:
-
-### Sample payload
-
-```json
-{
-  "consul_roles": "role-a,role-b"
-}
-```
-
-To create a client token with service identities attached:
-
-```json
-{
-  "service_identities": [
-      "myservice-1:dc1,dc2",
-      "myservice-2:dc1"
-    ]
-}
-```
-
-### Parameters for consul versions 1.4 and above
-
-- `name` `(string: <required>)` – Specifies the name of an existing role against
-  which to create this Consul credential. This is part of the request URL.
-
-- `token_type` <sup>DEPRECATED (1.11)</sup> `(string: "client")` - Specifies the type of token to create
-  when using this role. Valid values are `"client"` or `"management"`. If a `"management"`
-  token, the `policy` parameter is not required. Defaults to `"client`". [Deprecated from Consul as of 1.4 and
-  removed as of Consul 1.11.](/consul/api-docs/acl/legacy)
-
-- `policy` <sup>DEPRECATED (1.11)</sup> `(string: "")` – Specifies the base64-encoded ACL policy.
-  This is required unless the `token_type` is `"management"`. [Deprecated from Consul as of 1.4 and
-  removed as of Consul 1.11.](/consul/api-docs/acl/legacy)
-
-- `policies` <sup>DEPRECATED (1.11)</sup> `(list: <policy or policies>)` - Same as `consul_policies`.
-  Deprecated in favor of using `consul_policies`.
-
-- `consul_policies` `(list: <policy or policies>)` – The list of Consul policies to assign
-  to the generated token. This field is required if using using Consul 1.4.
-
-- `local` `(bool: false)` - Indicates that the token should not be replicated
-  globally and instead be local to the current datacenter. Only available in Consul
-  1.4 and greater.
-
-- `ttl` `(duration: "")` – Specifies the TTL for this role. If not
-  provided, the default Vault TTL is used. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `max_ttl` `(duration: "")` – Specifies the max TTL for this role. If not
-  provided, the default Vault Max TTL is used. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-To create a client token with policies defined in Consul:
-
-```json
-{
-  "consul_policies": "policy-1,policy-2"
-}
-```
-
-### Parameters for consul version below 1.4
-
-- `lease` <sup>DEPRECATED (1.11)</sup> `(string: "")` – Specifies the lease for this role.
-  Uses [duration format strings](/vault/docs/concepts/duration-format). If not
-  provided, the default Vault lease is used.
-
-- `policy` <sup>DEPRECATED (1.11)</sup> `(string: <policy>)` – Specifies the base64-encoded ACL policy. The
-  ACL format can be found in the [Consul ACL
-  documentation](/consul/docs/security/acl/acl-legacy). This is
-  required unless the `token_type` is `"management"`.
-
-### Sample payload
-
-To create a client token with a base64-encoded policy:
-
-```json
-{
-  "policy": "a2V5ICIi...=="
-}
-```
-
-To create management tokens:
-
-```json
-{
-  "token_type": "management"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/consul/roles/example-role
-```
-
-## Read role
-
-This endpoint queries for information about a Consul role with the given name.
-If no role exists with that name, a 404 is returned.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `GET`  | `/consul/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to query. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/consul/roles/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "policy": "abd2...==",
-    "lease": "1h0m0s",
-    "token_type": "client"
-  }
-}
-```
-
-## List roles
-
-This endpoint lists all existing roles in the secrets engine.
-
-| Method | Path            |
-| :----- | :-------------- |
-| `LIST` | `/consul/roles` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/consul/roles
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-role"]
-  }
-}
-```
-
-## Delete role
-
-This endpoint deletes a Consul role with the given name. Even if the role does
-not exist, this endpoint will still return a successful response.
-
-| Method   | Path                  |
-| :------- | :-------------------- |
-| `DELETE` | `/consul/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to delete. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request DELETE \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/consul/roles/example-role
-```
-
-## Generate credential
-
-This endpoint generates a dynamic Consul token based on the given role
-definition.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `GET`  | `/consul/creds/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of an existing role against
-  which to create this Consul credential. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/consul/creds/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "token": "973a31ea-1ec4-c2de-0f63-623f477c2510"
-  }
-}
-```
diff --git a/website/content/api-docs/secret/cubbyhole.mdx b/website/content/api-docs/secret/cubbyhole.mdx
deleted file mode 100644
index e819969950f..00000000000
--- a/website/content/api-docs/secret/cubbyhole.mdx
+++ /dev/null
@@ -1,151 +0,0 @@
----
-layout: api
-page_title: Cubbyhole - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault Cubbyhole secrets engine.
----
-
-# Cubbyhole secrets engine (API)
-
-This is the API documentation for the Vault Cubbyhole secrets engine. For
-general information about the usage and operation of the Cubbyhole secrets
-engine, please see the
-[Vault Cubbyhole documentation](/vault/docs/secrets/cubbyhole).
-
-This documentation assumes the Cubbyhole secrets engine is enabled at the
-`/cubbyhole` path in Vault. Since it is possible to enable secrets engines at
-any location, please update your API calls accordingly.
-
-## Read secret
-
-This endpoint retrieves the secret at the specified location.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/cubbyhole/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the secret to read.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/cubbyhole/my-secret
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "data": {
-    "foo": "bar"
-  },
-  "lease_duration": 0,
-  "lease_id": "",
-  "renewable": false
-}
-```
-
-## List secrets
-
-This endpoint returns a list of secret entries at the specified location.
-Folders are suffixed with `/`. The input must be a folder; list on a file will
-not return a value. The values themselves are not accessible via this command.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `LIST` | `/cubbyhole/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the secrets to list.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/cubbyhole/my-secret
-```
-
-### Sample response
-
-The example below shows output for a query path of `cubbyhole/` when there are
-secrets at `cubbyhole/foo` and `cubbyhole/foo/bar`; note the difference in the
-two entries.
-
-```json
-{
-  "auth": null,
-  "data": {
-    "keys": ["foo", "foo/"]
-  },
-  "lease_duration": 2764800,
-  "lease_id": "",
-  "renewable": false
-}
-```
-
-## Create/Update secret
-
-This endpoint stores a secret at the specified location.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/cubbyhole/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the secrets to
-  create/update. This is specified as part of the URL.
-
-- `:key` `(string: "")` – Specifies a key in the payload, paired with an associated value, to
-  be held at the given location. Multiple key/value pairs can be specified, and
-  all will be returned on a read operation.
-
-### Sample payload
-
-```json
-{
-  "foo": "bar",
-  "zip": "zap"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/cubbyhole/my-secret
-```
-
-## Delete secret
-
-This endpoint deletes the secret at the specified location.
-
-| Method   | Path               |
-| :------- | :----------------- |
-| `DELETE` | `/cubbyhole/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the secret to delete.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/cubbyhole/my-secret
-```
diff --git a/website/content/api-docs/secret/databases/cassandra.mdx b/website/content/api-docs/secret/databases/cassandra.mdx
deleted file mode 100644
index 5e265979f05..00000000000
--- a/website/content/api-docs/secret/databases/cassandra.mdx
+++ /dev/null
@@ -1,218 +0,0 @@
----
-layout: api
-page_title: Cassandra - Database - Secrets Engines - HTTP API
-description: >-
-  The Cassandra plugin for Vault's database secrets engine generates database
-  credentials to access Cassandra servers.
----
-
-# Cassandra database plugin HTTP API
-
-@include 'x509-sha1-deprecation.mdx'
-
-The Cassandra database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the Cassandra database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Secrets Engine](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `hosts` `(string: <required>)` – Specifies a set of comma-delineated Cassandra
-  hosts to connect to.
-
-- `port` `(int: 9042)` – Specifies the default port to use if none is provided
-  as part of the host URI. Defaults to Cassandra's default transport port, 9042.
-
-- `username` `(string: <required>)` – Specifies the username to use for
-  superuser access.
-
-- `password` `(string: <required>)` – Specifies the password corresponding to
-  the given username.
-
-- `tls` `(bool: true)` – Specifies whether to use TLS when connecting to
-  Cassandra.
-
-- `insecure_tls` `(bool: false)` – Specifies whether to skip verification of the
-  server certificate when using TLS.
-
-- `tls_server_name` `(string: "")` – Specifies the name to use as the SNI host when
-  connecting to the Cassandra server via TLS.
-
-- `pem_bundle` `(string: "")` – Specifies concatenated PEM blocks containing a
-  certificate and private key; a certificate, private key, and issuing CA
-  certificate; or just a CA certificate. Only one of `pem_bundle` or `pem_json` can be specified.
-
-- `pem_json` `(string: "")` – Specifies JSON containing a certificate and
-  private key; a certificate, private key, and issuing CA certificate; or just a
-  CA certificate. The value in this field must be an encoded JSON object. For convenience format is the
-  same as the output of the `issue` command from the `pki` secrets engine; see
-  [the pki documentation](/vault/docs/secrets/pki). Only one of `pem_bundle` or `pem_json` can be specified.
-
-<details>
-<summary><b><tt>pem_json</tt> example</b></summary>
-
-```json
-{
-  "certificate": "<client certificate as a PEM>",
-  "private_key": "<private key as a PEM>",
-  "ca_chain": ["<CA as a PEM>", "<Additional PEM for the CA chain if needed"]
-}
-```
-
-If using the Vault CLI, it's probably easiest to write the JSON to a file and then reference the file:
-
-```shell
-vault write database/config/cassandra-example <...other fields> pem_json=@/path/to/file.json
-```
-
-</details>
-
-- `skip_verification` `(bool: false)` - Skip permissions checks when a connection to Cassandra
-  is first created. These checks ensure that Vault is able to create roles, but can be resource
-  intensive in clusters with many roles.
-
-- `protocol_version` `(int: 2)` – Specifies the CQL protocol version to use.
-
-- `connect_timeout` `(string: "5s")` – Specifies the timeout to use, both for
-  connections and in general.
-
-- `local_datacenter` `(string: "")` – If set, enables host selection policy
-  which will prioritize and use hosts which are in the local datacenter before
-  hosts in all other datacenters (for example `dc-01`).
-
-- `socket_keep_alive` `(string: "0s")` – the keep-alive period for an active
-  network connection. If zero, keep-alives are not enabled.
-
-- `consistency` `(string: "")` – Specifies the consistency option to use. See
-  the [gocql
-  definition](https://github.com/gocql/gocql/blob/master/frame.go#L188) for
-  valid options.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how
-  dynamic usernames are generated.
-
-<details>
-<summary><b>Default Username Template</b></summary>
-
-```
-{{ printf "v_%s_%s_%s_%s" (.DisplayName | truncate 15) (.RoleName | truncate 15) (random 20) (unix_time) | truncate 100 | replace "-" "_" | lowercase }}
-```
-
-<details>
-<summary><b>Example Usernames:</b></summary>
-
-| Example       |                                                      |
-| ------------- | ---------------------------------------------------- |
-| `DisplayName` | `token`                                              |
-| `RoleName`    | `myrolename`                                         |
-| Username      | `v_token_myrolename_uszt1n4cyhal4m0xtgx3_1614294836` |
-
-| Example       |                                                                     |
-| ------------- | ------------------------------------------------------------------- |
-| `DisplayName` | `amuchlonger_dispname`                                              |
-| `RoleName`    | `role-name-with-dashes`                                             |
-| Username      | `v_amuchlonger_dis_role_name_with__s0t9xb0jsab9nqz7yj40_1614294836` |
-
-</details>
-</details>
-
-TLS works as follows:
-
-- If `tls` is set to true, the connection will use TLS; this happens
-  automatically if `pem_bundle`, `pem_json`, or `insecure_tls` is set
-
-- If `insecure_tls` is set to true, the connection will not perform verification
-  of the server certificate; this also sets `tls` to true
-
-- If only `issuing_ca` is set in `pem_json`, or the only certificate in
-  `pem_bundle` is a CA certificate, the given CA certificate will be used for
-  server certificate verification; otherwise the system CA certificates will be
-  used
-
-- If `certificate` and `private_key` are set in `pem_bundle` or `pem_json`,
-  client auth will be turned on for the connection
-
-`pem_bundle` should be a PEM-concatenated bundle of a private key + client
-certificate, an issuing CA certificate, or both. `pem_json` should contain the
-same information; for convenience, the JSON format is the same as that output by
-the issue command from the PKI secrets engine.
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "cassandra-database-plugin",
-  "allowed_roles": "readonly",
-  "hosts": "cassandra1.local",
-  "username": "user",
-  "password": "pass"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/cassandra/config/connection
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(list: [])` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{username}}` and `{{password}}` values will be substituted. If not
-  provided, defaults to a generic create user statements that creates a
-  non-superuser.
-
-- `revocation_statements` `(list: [])` – Specifies the database statements to
-  be executed to revoke a user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The `{{username}}` value will be
-  substituted. If not provided defaults to a generic drop user statement.
-
-- `rollback_statements` `(list: [])` – Specifies the database statements to be
-  executed to rollback a create operation in the event of an error. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{username}}` value will be substituted. If not provided, defaults to
-  a generic drop user statement
-
-- `root_rotation_statements` `(list: [])` - Specifies the database statements
-  to be executed when rotating the root user's password. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{username}}` value will be substituted. If not provided, defaults to
-  a reasonable default alter user statement.
-
-~> Prior to Vault 1.7.1 and 1.6.4 the default `root_rotation_statements` does not
-  allow for usernames with special characters in them due to missing quotes
-  around the username. To fix this issue in versions prior to Vault 1.7.1/1.6.4,
-  specify the following `root_rotation_statements`:
-
-  ```sql
-  ALTER USER '{{username}}' WITH PASSWORD '{{password}}';
-  ```
diff --git a/website/content/api-docs/secret/databases/couchbase.mdx b/website/content/api-docs/secret/databases/couchbase.mdx
deleted file mode 100644
index addd5bdcd24..00000000000
--- a/website/content/api-docs/secret/databases/couchbase.mdx
+++ /dev/null
@@ -1,115 +0,0 @@
----
-layout: api
-page_title: Couchbase - Database - Secrets Engines - HTTP API
-description: >-
-  The Couchbase plugin for Vault's database secrets engine generates database
-  credentials to access Couchbase servers.
----
-
-# Couchbase database plugin HTTP API
-
-@include 'x509-sha1-deprecation.mdx'
-
-The Couchbase database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the Couchbase database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Secrets Engine](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `hosts` `(string: <required>)` – Specifies a set of comma-delimited Couchbase
-  hosts to connect to. Must use `couchbase://` scheme if `tls` is `true`.
-
-- `username` `(string: <required>)` – Specifies the username for Vault to use.
-
-- `password` `(string: <required>)` – Specifies the password corresponding to
-  the given username.
-
-- `tls` `(bool: false)` – Specifies whether to use TLS when connecting to
-  Couchbase.
-
-- `insecure_tls` `(bool: false)` – Specifies whether to skip verification of the
-  server certificate when using TLS.
-
-- `base64pem` `(string: "")` – Required if `tls` is `true`. Specifies the
-  certificate authority of the Couchbase server, as a PEM certificate that has
-  been base64 encoded.
-
-- `bucket_name` `(string: "")` - Required for Couchbase versions prior to 6.5.0. This
-  is only used to verify vault's connection to the server.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how
-  dynamic usernames are generated.
-
-<details>
-<summary><b>Default Username Template</b></summary>
-
-```
-V_{{.DisplayName | uppercase | truncate 64}}_{{.RoleName | uppercase | truncate 64}}_{{random 20 | uppercase}}_{{unix_time}}
-```
-
-<details>
-  <summary><b>Example Usernames:</b></summary>
-
-| Example       |                                                      |
-| ------------- | ---------------------------------------------------- |
-| `DisplayName` | `token`                                              |
-| `RoleName`    | `myrolename`                                         |
-| Username      | `V_TOKEN_MYROLENAME_USZT1N4CYHAL4M0XTGX3_1614294836` |
-
-| Example       |                                                                                |
-| ------------- | ------------------------------------------------------------------------------ |
-| `DisplayName` | `amuchlonger_dispname`                                                         |
-| `RoleName`    | `role-name-with-dashes`                                                        |
-| Username      | `V_AMUCHLONGER_DISPNAME_ROLE-NAME-WITH-DASHES_S0T9XB0JSAB9NQZ7YJ40_1614294836` |
-
-</details>
-</details>
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "couchbase-database-plugin",
-  "hosts": "couchbase://127.0.0.1",
-  "username": "user",
-  "password": "pass",
-  "allowed-roles": "my-*-role"
-}
-```
-
-### Sample request
-
-```bash
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/couchbase
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(list: [])` – Specifies a JSON string containing
-  Couchbase RBAC roles to assign to created users. Any groups specified must
-  already exist. Must be a single JSON string. If not provided, defaults to
-  read-only admin.
diff --git a/website/content/api-docs/secret/databases/elasticdb.mdx b/website/content/api-docs/secret/databases/elasticdb.mdx
deleted file mode 100644
index 5b849e8ff26..00000000000
--- a/website/content/api-docs/secret/databases/elasticdb.mdx
+++ /dev/null
@@ -1,109 +0,0 @@
----
-layout: api
-page_title: Elasticsearch - Database - Secrets Engines - HTTP API
-description: >-
-  The Elasticsearch plugin for Vault's database secrets engine generates
-  database credentials to access Elasticsearch.
----
-
-# Elasticsearch database plugin HTTP API
-
-@include 'x509-sha1-deprecation.mdx'
-
-The Elasticsearch database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates credentials dynamically based on
-configured roles for Elasticsearch.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Backend](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `url` `(string: <required>)` - The URL for Elasticsearch's API (`http://localhost:9200`).
-- `username` `(string: <required>)` - The username to be used in the connection URL (`vault`).
-- `password` `(string: <required>)` - The password to be used in the connection URL (`pa55w0rd`).
-- `ca_cert` `(string: "")` - The path to a PEM-encoded CA cert file to use to verify the Elasticsearch server's identity.
-- `ca_path` `(string: "")` - The path to a directory of PEM-encoded CA cert files to use to verify the Elasticsearch server's identity.
-- `client_cert` `(string: "")` - The path to the certificate for the Elasticsearch client to present for communication.
-- `client_key` `(string: "")` - The path to the key for the Elasticsearch client to use for communication.
-- `tls_server_name` `(string: "")` - This, if set, is used to set the SNI host when connecting via TLS.
-- `insecure` `(bool: false)` - Not recommended. Default to `false`. Can be set to `true` to disable certificate verification.
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how dynamic usernames are generated.
-- `use_old_xpack` `(bool: false)` - Can be set to `true` to use the `/_xpack/security` base API path when managing Elasticsearch. May be required for Elasticsearch server versions prior to 6.
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "elasticsearch-database-plugin",
-  "allowed_roles": "internally-defined-role,externally-defined-role",
-  "url": "http://localhost:9200",
-  "username": "vault",
-  "password": "myPa55word",
-  "ca_cert": "/usr/share/ca-certificates/extra/elastic-stack-ca.crt.pem",
-  "client_cert": "$ES_HOME/config/certs/elastic-certificates.crt.pem",
-  "client_key": "$ES_HOME/config/certs/elastic-certificates.key.pem"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/my-elasticsearch-database
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(string: <required>)` – Using JSON, either defines an
-  `elasticsearch_role_definition` or a group of pre-existing `elasticsearch_roles`.
-
-  The object specified by the `elasticsearch_role_definition` is the JSON directly
-  passed through to the Elasticsearch API, so you can pass through anything shown
-  [here](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/security-api-put-role.html).
-
-  For `elasticsearch_roles`, add the names of the roles only. They must pre-exist
-  in Elasticsearch.  Defining roles in Vault is more secure than using pre-existing
-  roles because a privilege escalation could be performed by editing the roles used
-  out-of-band in Elasticsearch.
-
-### Sample creation statements
-
-```json
-{
-  "elasticsearch_role_definition": {
-    "indices": [
-      {
-        "names": ["*"],
-        "privileges": ["read"]
-      }
-    ]
-  }
-}
-```
-
-```json
-{
-  "elasticsearch_roles": ["pre-existing-role-in-elasticsearch"]
-}
-```
diff --git a/website/content/api-docs/secret/databases/hanadb.mdx b/website/content/api-docs/secret/databases/hanadb.mdx
deleted file mode 100644
index 6c4368068ff..00000000000
--- a/website/content/api-docs/secret/databases/hanadb.mdx
+++ /dev/null
@@ -1,104 +0,0 @@
----
-layout: api
-page_title: HANA - Database - Secrets Engines - HTTP API
-description: >-
-  The HANA plugin for Vault's database secrets engine generates database
-  credentials to access HANA servers.
----
-
-# HANA database plugin HTTP API
-
-The HANA database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the HANA database.
-
-## Configure connection
-
-In addition to the parameters defined by the [database
-secrets engine](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     | Produces |
-| :----- | :----------------------- | -------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `connection_url` `(string: <required>)` - Specifies the HANA DSN. This field
-  can be templated and supports passing the username and password
-  parameters in the following format `{{field_name}}`. A templated connection URL is
-  required when using root credential rotation.
-
-- `max_open_connections` `(int: 4)` - Specifies the maximum number of open
-  connections to the database.
-
-- `max_idle_connections` `(int: 0)` - Specifies the maximum number of idle
-  connections to the database. A zero uses the value of `max_open_connections`
-  and a negative value disables idle connections. If larger than
-  `max_open_connections` it will be reduced to be equal.
-
-- `max_connection_lifetime` `(string: "0s")` - Specifies the maximum amount of
-  time a connection may be reused. If &le; `0s`, connections are reused forever.
-
-- `username` `(string: "")` - The root credential username used in the connection URL.
-
-- `password` `(string: "")` - The root credential password used in the connection URL.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how dynamic usernames are generated.
-
-- `disable_escaping` `(boolean: false)` - Turns off the escaping of special characters inside of the username
-  and password fields. See the [databases secrets engine docs](/vault/docs/secrets/databases#disable-character-escaping)
-  for more information. Defaults to `false`.
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "hana-database-plugin",
-  "allowed_roles": "readonly",
-  "connection_url": "hdb://{{username}}:{{password}}@localhost:1433",
-  "max_open_connections": 5,
-  "max_connection_lifetime": "5s",
-  "username": "username",
-  "password": "password"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/hana
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(list: <required>)` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{name}}`, `{{password}}`, and `{{expiration}}` values will be
-  substituted.
-
-  - The expiration time will be HANA server time plus the role's `default_ttl`.
-    If `default_ttl` is 0 or not set, a SQL HdbError 438 will be returned.
-
-- `revocation_statements` `(list: [])` – Specifies the database statements to
-  be executed to revoke a user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The `{{name}}` value will be
-  substituted. If not provided, defaults to dropping the user only if they have
-  no dependent objects.
diff --git a/website/content/api-docs/secret/databases/index.mdx b/website/content/api-docs/secret/databases/index.mdx
deleted file mode 100644
index 2373410a042..00000000000
--- a/website/content/api-docs/secret/databases/index.mdx
+++ /dev/null
@@ -1,786 +0,0 @@
----
-layout: api
-page_title: Database - Secrets Engines - HTTP API
-description: Top page for database secrets engine information
----
-
-# Database secrets engine (API)
-
-This is the API documentation for the Vault Database secrets engine. For
-general information about the usage and operation of the database secrets engine,
-please see the
-[Vault database secrets engine documentation](/vault/docs/secrets/databases).
-
-This documentation assumes the database secrets engine is enabled at the
-`/database` path in Vault. Since it is possible to enable secrets engines at any
-location, please update your API calls accordingly.
-
-## Configure connection
-
-This endpoint configures the connection string used to communicate with the
-desired database. In addition to the parameters listed here, each Database
-plugin has additional, database plugin specific, parameters for this endpoint.
-Please read the HTTP API for the plugin you'd wish to configure to see the full
-list of additional parameters.
-
-~> This endpoint distinguishes between `create` and `update` ACL capabilities.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name for this database
-  connection. This is specified as part of the URL.
-
-- `plugin_name` `(string: <required>)` - Specifies the name of the plugin to use
-  for this connection.
-
-- `plugin_version` `(string: "")` - Specifies the semantic version of the plugin
-  to use for this connection.
-
-- `verify_connection` `(bool: true)` – Specifies if the connection is verified
-  during initial configuration. Defaults to true.
-
-- `allowed_roles` `(list: [])` - List of the roles allowed to use this connection.
-  Defaults to empty (no roles), if contains a `*` any role can use this connection.
-
-- `root_rotation_statements` `(list: [])` - Specifies the database statements to be
-  executed to rotate the root user's credentials. See the plugin's API page for more
-  information on support and formatting for this parameter.
-
-- `password_policy` `(string: "")` - The name of the
-  [password policy](/vault/docs/concepts/password-policies) to use when generating passwords
-  for this database. If not specified, this will use a default policy defined as:
-  20 characters with at least 1 uppercase, 1 lowercase, 1 number, and 1 dash character.
-
-~> We highly recommended that you use a Vault-specific user rather than the admin user
-in your database when configuring the plugin. This user will be used to
-create/update/delete users within the database so it will need to have the appropriate
-permissions to do so. If the plugin supports
-[rotating the root credentials](#rotate-root-credentials), we highly recommended
-you perform that action after configuring the plugin. This will change the password
-of the user configured in this step. The new password will **not** be viewable by users.
-
-### Common fields
-
-There are several common fields that you will see across many of the database plugins.
-Please reference the individual plugin documentation for details on whether these fields
-are supported and any additional details about them.
-
-- `connection_url` `(string)` - Specifies the connection string used to connect to the
-  database. Some plugins use `url` rather than `connection_url`. This allows for simple
-  templating of the username and password of the root user. Typically, this is done by
-  including a `{{username}}`, `{{name}}`, and/or `{{password}}` field within the string.
-  These fields are typically be replaced with the values in the `username` and
-  `password` fields.
-
-- `username` `(string)` - Specifies the name of the user to use as the "root" user when
-  connecting to the database. This "root" user is used to create/update/delete users
-  managed by these plugins, so you will need to ensure that this user has permissions to
-  manipulate users appropriate to the database. This is typically used in the
-  `connection_url` field via the templating directive `{{username}}` or `{{name}}`.
-
-- `password` `(string)` - Specifies the password to use when connecting with the
-  `username`. This value will not be returned by Vault when performing a read upon the
-  configuration. This is typically used in the `connection_url` field via the templating
-  directive `{{password}}`.
-
-- `disable_escaping` `(boolean: false)` - Determines whether special characters in the
-  username and password fields will be escaped. Useful for alternate connection string
-  formats like ADO. More information regarding this parameter can be found on the
-  [databases secrets engine docs.](/vault/docs/secrets/databases#disable-character-escaping)
-  Defaults to `false`.
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "mysql-database-plugin",
-  "allowed_roles": "readonly",
-  "connection_url": "{{username}}:{{password}}@tcp(127.0.0.1:3306)/",
-  "username": "vaultuser",
-  "password": "secretpassword"
-}
-```
-
-### Sample cURL request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/mysql
-```
-
-### Sample CLI request
-
-```shell-session
-$ vault write database/config/mysql \
-    plugin_name="mysql-database-plugin" \
-    allowed_roles="readonly" \
-    connection_url="{{username}}:{{password}}@tcp(127.0.0.1:3306)/" \
-    username="vaultuser" \
-    password="secretpassword"
-```
-
-### Sample CLI request with ADO-style connection string
-
-```shell-session
-$ vault write database/config/mssql \
-    plugin_name="mssql-database-plugin" \
-    connection_url='server=localhost;port=1433;user id={{username}};password={{password}};database=mssql;' \
-    username="vaultuser" \
-    password='your#StrongPassword%' \
-    disable_escaping="true"
-```
-
-## Read connection
-
-This endpoint returns the configuration settings for a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `GET`  | `/database/config/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the connection to read.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/database/config/mysql
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "allowed_roles": ["readonly"],
-    "connection_details": {
-      "connection_url": "{{username}}:{{password}}@tcp(127.0.0.1:3306)/",
-      "username": "vaultuser"
-    },
-    "password_policy": "",
-    "plugin_name": "mysql-database-plugin",
-    "plugin_version": "",
-    "root_credentials_rotate_statements": []
-  }
-}
-```
-
-## List connections
-
-This endpoint returns a list of available connections. Only the connection names
-are returned, not any values.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `LIST` | `/database/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/database/config
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["db-one", "db-two"]
-  }
-}
-```
-
-## Delete connection
-
-This endpoint deletes a connection.
-
-| Method   | Path                     |
-| :------- | :----------------------- |
-| `DELETE` | `/database/config/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the connection to delete.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/database/config/mysql
-```
-
-## Reset connection
-
-This endpoint closes a connection and it's underlying plugin and restarts it
-with the configuration stored in the barrier.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/database/reset/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the connection to reset.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/database/reset/mysql
-```
-
-## Reload plugin
-
-This endpoint performs the same operation as
-[reset connection](/vault/api-docs/secret/databases#reset-connection) but for
-all connections that reference a specific plugin name. This can be useful to
-restart a specific plugin after it's been upgraded in the plugin catalog.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `POST` | `/database/reload/:plugin_name` |
-
-### Parameters
-
-- `plugin_name` `(string: <required>)` – Specifies the name of the plugin for
-  which all connections should be reset. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/database/reload/postgresql-database-plugin
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "connections": ["pg1", "pg2"],
-    "count": 2
-  }
-}
-```
-
-## Rotate root credentials
-
-This endpoint is used to rotate the "root" user credentials stored for
-the database connection. This user must have permissions to update its own
-password.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/database/rotate-root/:name` |
-
-!> **Use caution:** the root user's password will not be accessible once rotated so it is highly
-recommended that you create a user for Vault to utilize rather than using the actual root user.
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the connection to rotate.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/database/rotate-root/mysql
-```
-
-## Create role
-
-This endpoint creates or updates a role definition.
-
-~> This endpoint distinguishes between `create` and `update` ACL capabilities.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/database/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create. This
-  is specified as part of the URL.
-
-- `db_name` `(string: <required>)` - The name of the database connection to use
-  for this role.
-
-- `default_ttl` `(string/int: 0)` - Specifies the TTL for the leases
-  associated with this role. Accepts time suffixed strings (`1h`) or an integer
-  number of seconds. Defaults to system/engine default TTL time.
-
-- `max_ttl` `(string/int: 0)` - Specifies the maximum TTL for the leases
-  associated with this role. Accepts time suffixed strings (`1h`) or an integer
-  number of seconds. Defaults to `sys/mounts`'s default TTL time; this value is allowed to be less than the mount max TTL (or, if not set, the system max TTL), but it is not allowed to be longer. See also [The TTL General Case](/vault/docs/concepts/tokens#the-general-case).
-
-- `creation_statements` `(list: <required>)` – Specifies the database
-  statements executed to create and configure a user. See the plugin's API page
-  for more information on support and formatting for this parameter.
-
-- `revocation_statements` `(list: [])` – Specifies the database statements to
-  be executed to revoke a user. See the plugin's API page for more information
-  on support and formatting for this parameter.
-
-- `rollback_statements` `(list: [])` – Specifies the database statements to be
-  executed to rollback a create operation in the event of an error. Not every
-  plugin type will support this functionality. See the plugin's API page for
-  more information on support and formatting for this parameter.
-
-- `renew_statements` `(list: [])` – Specifies the database statements to be
-  executed to renew a user. Not every plugin type will support this
-  functionality. See the plugin's API page for more information on support and
-  formatting for this parameter.
-
-@include 'db-secrets-credential-types.mdx'
-
-### Sample payload
-
-```json
-{
-  "db_name": "mysql",
-  "creation_statements": [
-    "CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'",
-    "GRANT SELECT ON *.* TO '{{name}}'@'%'"
-  ],
-  "default_ttl": "1h",
-  "max_ttl": "24h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/roles/my-role
-```
-
-## Read role
-
-This endpoint queries the role definition.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/database/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to read. This
-  is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/database/roles/my-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "creation_statements": [
-      "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';",
-      "GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";"
-    ],
-    "credential_type": "password",
-    "db_name": "mysql",
-    "default_ttl": 3600,
-    "max_ttl": 86400,
-    "renew_statements": [],
-    "revocation_statements": [],
-    "rollback_statements": []
-  }
-}
-```
-
-## List roles
-
-This endpoint returns a list of available roles. Only the role names are
-returned, not any values.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `LIST` | `/database/roles` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/database/roles
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "data": {
-    "keys": ["dev", "prod"]
-  },
-  "lease_duration": 2764800,
-  "lease_id": "",
-  "renewable": false
-}
-```
-
-## Delete role
-
-This endpoint deletes the role definition.
-
-| Method   | Path                    |
-| :------- | :---------------------- |
-| `DELETE` | `/database/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to delete. This
-  is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/database/roles/my-role
-```
-
-## Generate credentials
-
-This endpoint generates a new set of dynamic credentials based on the named
-role.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/database/creds/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create
-  credentials against. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/database/creds/my-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "username": "root-1430158508-126",
-    "password": "132ae3ef-5a64-7499-351e-bfe59f3a2a21"
-  }
-}
-```
-
-## Create static role
-
-This endpoint creates or updates a static role definition. Static Roles are a
-1-to-1 mapping of a Vault Role to a user in a database which are automatically
-rotated based on the configured `rotation_period` or `rotation_schedule`.
-
-~> This endpoint distinguishes between `create` and `update` ACL capabilities.
-
-~> Vault will rotate the password when creating a static role. Vault must do
-this in order to know the password.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/database/static-roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create. This
-  is specified as part of the URL.
-
-- `username` `(string: <required>)` – Specifies the database username that this
-  Vault role corresponds to.
-
-- `db_name` `(string: <required>)` - The name of the database connection to use
-  for this role.
-
-- `rotation_period` `(string/int)` – Specifies the amount of time Vault should
-  wait before rotating the password. The minimum is 5 seconds.  Uses [duration
-  format strings](/vault/docs/concepts/duration-format). Mutually exclusive
-  with `rotation_schedule`.
-
-- `rotation_schedule` `(string)` – A cron-style string that will define the
-  schedule on which rotations should occur. This should be a "standard"
-  [cron-style](https://en.wikipedia.org/wiki/Cron) string made of five fields
-  of which each entry defines the minute, hour, day of month, month, and day of
-  week respectively. For example, a value of `0 0 * * SAT` will set rotations
-  to occur on Saturday at 00:00. Mutually exclusive with `rotation_period`.
-
-  ~> **Warning**: The `rotation_period` and `rotation_schedule` fields are
-  mutually exclusive. One of them must be set but not both.
-
-- `rotation_window` `(string/int)` – Specifies the amount of time in which the
-  rotation is allowed to occur starting from a given `rotation_schedule`. If
-  the credential is not rotated during this window, due to a failure or
-  otherwise, it will not be rotated until the next scheduled rotation. The
-  minimum is 1 hour. Uses [duration format strings](/vault/docs/concepts/duration-format).
-  Optional when `rotation_schedule` is set and disallowed when `rotation_period`
-  is set.
-
-- `rotation_statements` `(list: [])` – Specifies the database statements to be
-  executed to rotate the password for the configured database user. Not every
-  plugin type will support this functionality. See the plugin's API page for
-  more information on support and formatting for this parameter.
-
-@include 'db-secrets-credential-types.mdx'
-
-### Sample payload with rotation period
-
-```json
-{
-  "db_name": "mysql",
-  "username": "static-database-user",
-  "rotation_statements": [
-    "ALTER USER \"{{name}}\" IDENTIFIED BY '{{password}}';"
-  ],
-  "rotation_period": "1h"
-}
-```
-
-### Sample payload with rotation schedule
-
-```json
-{
-  "db_name": "mysql",
-  "username": "static-database-user",
-  "rotation_statements": [
-    "ALTER USER \"{{name}}\" IDENTIFIED BY '{{password}}';"
-  ],
-  "rotation_schedule": "0 0 * * SAT",
-  "rotation_window": "1h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/static-roles/my-static-role
-```
-
-## Read static role
-
-This endpoint queries the static role definition.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/database/static-roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the static role to read.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/database/static-roles/my-static-role
-```
-
-### Sample response with rotation period
-
-```json
-{
-  "data": {
-    "credential_type": "password",
-    "db_name": "mysql",
-    "username": "static-user",
-    "rotation_statements": [
-      "ALTER USER \"{{name}}\" IDENTIFIED BY '{{password}}';"
-    ],
-    "rotation_period": 3600
-  }
-}
-```
-
-### Sample response with rotation schedule
-
-```json
-{
-  "data": {
-    "credential_type": "password",
-    "db_name": "mysql",
-    "username": "static-user",
-    "rotation_statements": [
-      "ALTER USER \"{{name}}\" IDENTIFIED BY '{{password}}';"
-    ],
-    "rotation_schedule": "0 0 * * SAT",
-    "rotation_window": 3600
-  }
-}
-```
-
-## List static roles
-
-This endpoint returns a list of available static roles. Only the role names are
-returned, not any values.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `LIST` | `/database/static-roles` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/database/static-roles
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "data": {
-    "keys": ["dev-static", "prod-static"]
-  }
-}
-```
-
-## Delete static role
-
-This endpoint deletes the static role definition. The user, having been defined externally,
-must be cleaned up manually.
-
-| Method   | Path                           |
-| :------- | :----------------------------- |
-| `DELETE` | `/database/static-roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the static role to
-  delete. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/database/static-roles/my-role
-```
-
-## Get static credentials
-
-This endpoint returns the current credentials based on the named static role.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/database/static-creds/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the static role to get
-  credentials for. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/database/static-creds/my-static-role
-```
-
-### Sample response with rotation period
-
-```json
-{
-  "data": {
-    "username": "static-user",
-    "password": "132ae3ef-5a64-7499-351e-bfe59f3a2a21",
-    "last_vault_rotation": "2019-05-06T15:26:42.525302-05:00",
-    "rotation_period": 30,
-    "ttl": 28
-  }
-}
-```
-
-### Sample response with rotation schedule
-
-```json
-{
-  "data": {
-    "username": "static-user",
-    "password": "132ae3ef-5a64-7499-351e-bfe59f3a2a21",
-    "last_vault_rotation": "2019-05-06T15:26:42.525302-05:00",
-    "rotation_schedule": "0 0 * * SAT",
-    "rotation_window": 3600,
-    "ttl": 5000
-  }
-}
-```
-
-## Rotate static role credentials
-
-This endpoint is used to rotate the Static Role credentials stored for a given
-role name. While Static Roles are rotated automatically by Vault at configured
-rotation periods, users can use this endpoint to manually trigger a rotation to
-change the stored password and reset the TTL of the Static Role's password.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/database/rotate-role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the Static Role to
-  trigger the password rotation for. The name is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/database/rotate-role/my-static-role
-```
diff --git a/website/content/api-docs/secret/databases/influxdb.mdx b/website/content/api-docs/secret/databases/influxdb.mdx
deleted file mode 100644
index 7f463403853..00000000000
--- a/website/content/api-docs/secret/databases/influxdb.mdx
+++ /dev/null
@@ -1,136 +0,0 @@
----
-layout: api
-page_title: Influxdb - Database - Secrets Engines - HTTP API
-description: >-
-  The Influxdb plugin for Vault's database secrets engine generates database
-  credentials to access Influxdb servers.
----
-
-# Influxdb database plugin HTTP API
-
-@include 'x509-sha1-deprecation.mdx'
-
-The Influxdb database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the Influxdb database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Secrets Engine](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `host` `(string: <required>)` – Specifies a Influxdb
-  host to connect to.
-
-- `port` `(int: 8086)` – Specifies the default port to use if none is provided
-  as part of the host URI. Defaults to Influxdb's default transport port, 8086.
-
-- `username` `(string: <required>)` – Specifies the username to use for
-  superuser access.
-
-- `password` `(string: <required>)` – Specifies the password corresponding to
-  the given username.
-
-- `tls` `(bool: true)` – Specifies whether to use TLS when connecting to
-  Influxdb.
-
-- `insecure_tls` `(bool: false)` – Specifies whether to skip verification of the
-  server certificate when using TLS.
-
-- `pem_bundle` `(string: "")` – Specifies concatenated PEM blocks containing a
-  certificate and private key; a certificate, private key, and issuing CA
-  certificate; or just a CA certificate.
-
-- `pem_json` `(string: "")` – Specifies JSON containing a certificate and
-  private key; a certificate, private key, and issuing CA certificate; or just a
-  CA certificate. For convenience format is the same as the output of the
-  `issue` command from the `pki` secrets engine; see
-  [the pki documentation](/vault/docs/secrets/pki).
-
-- `connect_timeout` `(string: "5s")` – Specifies the connection timeout to use.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how
-dynamic usernames are generated.
-
-TLS works as follows:
-
-- If `tls` is set to true, the connection will use TLS; this happens
-  automatically if `pem_bundle`, `pem_json`, or `insecure_tls` is set
-
-- If `insecure_tls` is set to true, the connection will not perform verification
-  of the server certificate; this also sets `tls` to true
-
-- If only `issuing_ca` is set in `pem_json`, or the only certificate in
-  `pem_bundle` is a CA certificate, the given CA certificate will be used for
-  server certificate verification; otherwise the system CA certificates will be
-  used
-
-- If `certificate` and `private_key` are set in `pem_bundle` or `pem_json`,
-  client auth will be turned on for the connection
-
-`pem_bundle` should be a PEM-concatenated bundle of a private key + client
-certificate, an issuing CA certificate, or both. `pem_json` should contain the
-same information; for convenience, the JSON format is the same as that output by
-the issue command from the PKI secrets engine.
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "influxdb-database-plugin",
-  "allowed_roles": "readonly",
-  "host": "influxdb1.local",
-  "username": "user",
-  "password": "pass"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/influxdb/config/connection
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(list: [])` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{username}}` and `{{password}}` values will be substituted. If not
-  provided, defaults to a generic create user statements that creates a
-  non-superuser.
-
-- `revocation_statements` `(list: [])` – Specifies the database statements to
-  be executed to revoke a user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The `{{username}}` value will be
-  substituted. If not provided defaults to a generic drop user statement.
-
-- `rollback_statements` `(list: [])` – Specifies the database statements to be
-  executed to rollback a create operation in the event of an error. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{username}}` value will be substituted. If not provided, defaults to
-  a generic drop user statement.
diff --git a/website/content/api-docs/secret/databases/mongodb.mdx b/website/content/api-docs/secret/databases/mongodb.mdx
deleted file mode 100644
index 6cdbc50c0eb..00000000000
--- a/website/content/api-docs/secret/databases/mongodb.mdx
+++ /dev/null
@@ -1,151 +0,0 @@
----
-layout: api
-page_title: MongoDB - Database - Secrets Engines - HTTP API
-description: >-
-  The MongoDB plugin for Vault's database secrets engine generates database
-  credentials to access MongoDB servers.
----
-
-# MongoDB database plugin HTTP API
-
-@include 'x509-sha1-deprecation.mdx'
-
-The MongoDB database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the MongoDB database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Backend](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `connection_url` `(string: <required>)` – Specifies the MongoDB standard
-  connection string (URI). This field can be templated and supports passing the
-  username and password parameters in the following format {{field_name}}. A
-  templated connection URL is required when using root credential rotation.
-
-- `write_concern` `(string: "")` - Specifies the MongoDB [write
-  concern][mongodb-write-concern]. This is set for the entirety of the session,
-  maintained for the lifecycle of the plugin process. Must be a serialized JSON
-  object, or a base64-encoded serialized JSON object. The JSON payload values
-  map to the values in the [Safe][mgo-safe] struct from the mgo driver.
-
-- `username` `(string: "")` - The root credential username used in the connection URL.
-
-- `password` `(string: "")` - The root credential password used in the connection URL.
-
-- `tls_certificate_key` `(string: "")` - x509 certificate for connecting to the database.
-  This must be a PEM encoded version of the private key and the certificate combined.
-
-- `tls_ca` `(string: "")` - x509 CA file for validating the certificate presented by the
-  MongoDB server. Must be PEM encoded.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how
-  dynamic usernames are generated.
-
-<details>
-<summary><b>Default Username Template</b></summary>
-
-```
-{{ printf "v-%s-%s-%s-%s" (.DisplayName | truncate 15) (.RoleName | truncate 15) (random 20) (unix_time) | replace "." "-"  | truncate 100 }}
-```
-
-<details>
-  <summary><b>Example Usernames:</b></summary>
-
-| Example       |                                                      |
-| ------------- | ---------------------------------------------------- |
-| `DisplayName` | `token`                                              |
-| `RoleName`    | `myrolename`                                         |
-| Username      | `v-token-myrolename-jNFRlKsZZMxJEx60o66i-1614294836` |
-
-| Example       |                                                                     |
-| ------------- | ------------------------------------------------------------------- |
-| `DisplayName` | `amuchlonger_dispname`                                              |
-| `RoleName`    | `role-name-with-dashes`                                             |
-| Username      | `v-amuchlonger_dis-role-name-with--jNFRlKsZZMxJEx60o66i-1614294836` |
-
-</details>
-</details>
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "mongodb-database-plugin",
-  "allowed_roles": "readonly",
-  "connection_url": "mongodb://{{username}}:{{password}}@mongodb.acme.com:27017/admin?ssl=true",
-  "write_concern": "{ \"wmode\": \"majority\", \"wtimeout\": 5000 }",
-  "username": "admin",
-  "password": "Password!"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/mongodb
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(string: <required>)` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  serialized JSON object, or a base64-encoded serialized JSON object.
-  The object can optionally contain a `db` string for session connection,
-  and must contain a `roles` array. This array contains objects that holds
-  a `role`, and an optional `db` value, and is similar to the BSON document that
-  is accepted by MongoDB's `roles` field. Vault will transform this array into
-  such format. For more information regarding the `roles` field, refer to
-  [MongoDB's documentation](https://docs.mongodb.com/manual/reference/method/db.createUser/).
-
-- `revocation_statements` `(string: "")` – Specifies the database statements to
-  be executed to revoke a user. Must be a serialized JSON object, or a base64-encoded
-  serialized JSON object. The object can optionally contain a `db` string. If no
-  `db` value is provided, it defaults to the `admin` database.
-
-### Sample creation statement
-
-```json
-{
-  "db": "admin",
-  "roles": [
-    {
-      "role": "read",
-      "db": "foo"
-    }
-  ]
-}
-```
-
-### Sample revocation statement
-
-```json
-{
-  "db": "vault-db"
-}
-```
-
-[mongodb-write-concern]: https://docs.mongodb.com/manual/reference/write-concern/
-[mgo-safe]: https://godoc.org/gopkg.in/mgo.v2#Safe
diff --git a/website/content/api-docs/secret/databases/mongodbatlas.mdx b/website/content/api-docs/secret/databases/mongodbatlas.mdx
deleted file mode 100644
index c895b92ce11..00000000000
--- a/website/content/api-docs/secret/databases/mongodbatlas.mdx
+++ /dev/null
@@ -1,109 +0,0 @@
----
-layout: 'api'
-page_title: 'MongoDB Atlas - Database - Secrets Engines - HTTP API'
-description: |-
-  The MongoDB Atlas plugin for Vault's Database Secrets Engine generates MongoDB Database User credentials for MongoDB Atlas.
----
-
-# MongoDB atlas database plugin HTTP API
-
-The MongoDB Atlas plugin is one of the supported plugins for the Database
-Secrets Engine. This plugin generates MongoDB Atlas Database User credentials dynamically based on
-configured roles.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Backend](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `public_key` `(string: <required>)` – The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.
-- `private_key` `(string: <required>)` - The Private Programmatic API Key used to connect with MongoDB Atlas API.
-- `project_id` `(string: <required>)` - The [Project ID](https://docs.atlas.mongodb.com/api/#project-id) the Database User should be created within.
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how
-  dynamic usernames are generated.
-
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "mongodbatlas-database-plugin",
-  "allowed_roles": "readonly",
-  "public_key": "aPublicKey",
-  "private_key": "aPrivateKey",
-  "project_id": "aProjectID"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/mongodbatlas
-```
-
-## Statements
-
-Statements are configured during Vault role creation and are used by the plugin to
-determine what is sent to MongoDB Atlas upon user creation, renewal, and
-revocation. For more information on configuring roles see the [Role API](/vault/api-docs/secret/databases#create-role)
-in the Database Secrets Engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(string: <required>)` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  serialized JSON object, or a base64-encoded serialized JSON object.
-  The object can optionally contain a `database_name`, the name of
-  the authentication database to log into MongoDB. In Atlas deployments of
-  MongoDB, the options for the authentication database include admin (default) and $external database.
-  The object must also contain a `roles` array, and from Vault version 1.6.0 (plugin
-  version 0.2.0) may optionally contain a `scopes` array. The `roles` array
-  contains objects that hold a series of roles `roleName`, an optional
-  `databaseName` and `collectionName` value. The `scopes` array determines
-  which clusters and data lakes the user has access to, and defaults to all
-  scopes if omitted. For more information regarding the `roles` and `scopes`
-  fields, refer to [MongoDB Atlas documentation](https://docs.atlas.mongodb.com/reference/api/database-users-create-a-user/).
-- `default_ttl` `(string/int): 0` - Specifies the TTL for the leases associated with this role.
-  Accepts time suffixed strings (`1h`) or an integer number of seconds. Defaults to system/engine default TTL time.
-- `max_ttl` `(string/int): 0` - Specifies the maximum TTL for the leases associated with this role. Accepts time
-  suffixed strings (`1h`) or an integer number of seconds. Defaults to `sys/mounts` default TTL time; this value
-  is allowed to be less than the mount max TTL (or, if not set, the system max TTL),
-  but it is not allowed to be longer. See also [The TTL General Case](/vault/docs/concepts/tokens#the-general-case).
-
-### Sample creation statement
-
-```json
-{
-  "database_name": "admin",
-  "roles": [
-    {
-      "databaseName": "admin",
-      "roleName": "atlasAdmin"
-    },
-    {
-      "collectionName": "acollection",
-      "roleName": "read"
-    }
-  ],
-  "scopes": [
-    {
-      "name": "a-cluster",
-      "type": "CLUSTER"
-    }
-  ]
-}
-```
diff --git a/website/content/api-docs/secret/databases/mssql.mdx b/website/content/api-docs/secret/databases/mssql.mdx
deleted file mode 100644
index 888968cfc98..00000000000
--- a/website/content/api-docs/secret/databases/mssql.mdx
+++ /dev/null
@@ -1,129 +0,0 @@
----
-layout: api
-page_title: MSSQL - Database - Secrets Engines - HTTP API
-description: >-
-  The MSSQL plugin for Vault's database secrets engine generates database
-  credentials to access MSSQL servers.
----
-
-# MSSQL database plugin HTTP API
-
-The MSSQL database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the MSSQL database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Backend](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `connection_url` `(string: <required>)` - Specifies the MSSQL DSN. This field
-  can be templated and supports passing the username and password
-  parameters in the following format {{field_name}}. A templated connection URL is
-  required when using root credential rotation.
-
-- `max_open_connections` `(int: 4)` - Specifies the maximum number of open
-  connections to the database.
-
-- `max_idle_connections` `(int: 0)` - Specifies the maximum number of idle
-  connections to the database. A zero uses the value of `max_open_connections`
-  and a negative value disables idle connections. If larger than
-  `max_open_connections` it will be reduced to be equal.
-
-- `max_connection_lifetime` `(string: "0s")` - Specifies the maximum amount of
-  time a connection may be reused. If <= `0s` connections are reused forever.
-
-- `username` `(string: "")` - The root credential username used in the connection URL.
-
-- `password` `(string: "")` - The root credential password used in the connection URL.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how
-  dynamic usernames are generated.
-
-- `contained_db` `(bool: false)` - If set, specifies that the connection being configured is to a
-  [Contained Database](https://docs.microsoft.com/en-us/sql/relational-databases/databases/contained-databases?view=sql-server-ver15),
-  like AzureSQL.
-
-- `disable_escaping` `(boolean: false)` - Turns off the escaping of special characters inside of the username
-  and password fields. See the [databases secrets engine docs](/vault/docs/secrets/databases#disable-character-escaping)
-  for more information. Defaults to `false`.
-
-<details>
-<summary><b>Default Username Template</b></summary>
-
-```
-{{ printf "v-%s-%s-%s-%s" (.DisplayName | truncate 20) (.RoleName | truncate 20) (random 20) (unix_time) | truncate 128 }}
-```
-
-<details>
-  <summary><b>Example Usernames:</b></summary>
-
-| Example       |                                                      |
-| ------------- | ---------------------------------------------------- |
-| `DisplayName` | `token`                                              |
-| `RoleName`    | `myrolename`                                         |
-| Username      | `v-token-myrolename-jNFRlKsZZMxJEx60o66i-1614294836` |
-
-| Example       |                                                                               |
-| ------------- | ----------------------------------------------------------------------------- |
-| `DisplayName` | `amuchlonger_dispname`                                                        |
-| `RoleName`    | `role-name-with-dashes`                                                       |
-| Username      | `v-amuchlonger_dispname-role-name-with-dashe-LUHU9xqm6YNisikA3iCQ-1614294836` |
-
-</details>
-</details>
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "mssql-database-plugin",
-  "allowed_roles": "readonly",
-  "connection_url": "sqlserver://{{username}}:{{password}}@localhost:1433",
-  "max_open_connections": 5,
-  "max_connection_lifetime": "5s",
-  "username": "sa",
-  "password": "yourStrong(!)Password"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/mssql
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(list: <required>)` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{name}}` and `{{password}}` values will be substituted.
-
-- `revocation_statements` `(list: [])` – Specifies the database statements to
-  be executed to revoke a user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The `{{name}}` value will be
-  substituted. If not provided defaults to a generic drop user statement.
diff --git a/website/content/api-docs/secret/databases/mysql-maria.mdx b/website/content/api-docs/secret/databases/mysql-maria.mdx
deleted file mode 100644
index bdce2662bdf..00000000000
--- a/website/content/api-docs/secret/databases/mysql-maria.mdx
+++ /dev/null
@@ -1,178 +0,0 @@
----
-layout: api
-page_title: MySQL/MariaDB - Database - Secrets Engines - HTTP API
-description: >-
-  The MySQL/MariaDB plugin for Vault's database secrets engine generates
-  database credentials to access MySQL and MariaDB servers.
----
-
-# MySQL/MariaDB database plugin HTTP API
-
-@include 'x509-sha1-deprecation.mdx'
-
-The MySQL database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the MySQL database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Backend](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `connection_url` `(string: <required>)` - Specifies the MySQL DSN. This field
-  can be templated and supports passing the username and password
-  parameters in the following format `{{field_name}}`. A templated connection URL is
-  required when using root credential rotation.
-
-- `max_open_connections` `(int: 4)` - Specifies the maximum number of open
-  connections to the database.
-
-- `max_idle_connections` `(int: 0)` - Specifies the maximum number of idle
-  connections to the database. A zero uses the value of `max_open_connections`
-  and a negative value disables idle connections. If larger than
-  `max_open_connections` it will be reduced to be equal.
-
-- `max_connection_lifetime` `(string: "0s")` - Specifies the maximum amount of
-  time a connection may be reused. If &le; 0s connections are reused forever.
-
-- `username` `(string: "")` - The root credential username used in the connection URL.
-
-- `password` `(string: "")` - The root credential password used in the connection URL.
-
-- `auth_type` `(string: "")` - If set to `gcp_iam`, will enable IAM authentication to a Google
-  CloudSQL instance. For more information on authenticating to CloudSQL via IAM, please refer to
-  Google's official documentation [here.](https://cloud.google.com/sql/docs/postgres/authentication).
-
-- `service_account_json` `(string: "")` - JSON encoded credentials for a GCP Service Account to use
-  for IAM authentication. Requires `auth_type` to be `gcp_iam`.
-
-- `tls_certificate_key` `(string: "")` - x509 certificate for connecting to the database.
-  This must be a PEM encoded version of the private key and the certificate combined.
-
-- `tls_ca` `(string: "")` - x509 CA file for validating the certificate presented by the
-  MySQL server. Must be PEM encoded.
-
-- `tls_server_name` `(string: "")` - Specifies the subject alternative name should be present in the
-  server's certificate.
-
-- `tls_skip_verify` `(boolean: false)` - When set to true, disables the server certificate verification.
-  Setting this to true is not recommended for production.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how
-  dynamic usernames are generated.
-
-- `disable_escaping` `(boolean: false)` - Turns off the escaping of special characters inside of the username
-  and password fields. See the [databases secrets engine docs](/vault/docs/secrets/databases#disable-character-escaping)
-  for more information. Defaults to `false`.
-
-**Default Username Templates:**
-
-<details>
-<summary><b><code>mysql-database-plugin</code></b></summary>
-
-```
-{{ printf "v-%s-%s-%s-%s" (.DisplayName | truncate 10) (.RoleName | truncate 10) (random 20) (unix_time) | truncate 32 }}
-```
-
-<details>
-<summary><b>Example Usernames:</b></summary>
-
-| Example       |                                    |
-| ------------- | ---------------------------------- |
-| `DisplayName` | `token`                            |
-| `RoleName`    | `myrolename`                       |
-| Username      | `v-token-myrolename-jNFRlKsZZMxJE` |
-
-| Example       |                                    |
-| ------------- | ---------------------------------- |
-| `DisplayName` | `amuchlonger_dispname`             |
-| `RoleName`    | `role-name-with-dashes`            |
-| Username      | `v-amuchlonge-role-name--LUHU9xqm` |
-
-</details>
-</details>
-
-<p></p>
-
-<details>
-<summary>
-  <code>mysql-aurora-database-plugin</code>, <code>mysql-rds-database-plugin</code>, <code>mysql-legacy-database-plugin</code>
-</summary>
-
-```
-{{ printf "v-%s-%s-%s" (.RoleName | truncate 4) (random 20) | truncate 16 }}
-```
-
-<details>
-  <summary><b>Example Usernames:</b></summary>
-
-| Example       |                    |
-| ------------- | ------------------ |
-| `DisplayName` | `token`            |
-| `RoleName`    | `myrolename`       |
-| Username      | `v-myro-jNFRlKsZZ` |
-
-| Example       |                         |
-| ------------- | ----------------------- |
-| `DisplayName` | `amuchlonger_dispname`  |
-| `RoleName`    | `role-name-with-dashes` |
-| Username      | `v-role-b9ODeKsfl`      |
-
-</details>
-</details>
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "mysql-database-plugin",
-  "allowed_roles": "readonly",
-  "connection_url": "{{username}}:{{password}}@tcp(127.0.0.1:3306)/",
-  "max_open_connections": 5,
-  "max_connection_lifetime": "5s",
-  "username": "root",
-  "password": "mysql"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/mysql
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(list: <required>)` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{name}}` and `{{password}}` values will be substituted. The
-  generated password will be a random alphanumeric 20 character string.
-
-- `revocation_statements` `(list: [])` – Specifies the database statements to
-  be executed to revoke a user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The `{{name}}` value will be
-  substituted. If not provided defaults to a generic drop user statement.
diff --git a/website/content/api-docs/secret/databases/oracle.mdx b/website/content/api-docs/secret/databases/oracle.mdx
deleted file mode 100644
index 69539e5f494..00000000000
--- a/website/content/api-docs/secret/databases/oracle.mdx
+++ /dev/null
@@ -1,132 +0,0 @@
----
-layout: api
-page_title: Oracle - Database - Secrets Engines - HTTP API
-description: >-
-  The Oracle plugin for Vault's database secrets engine generates database
-  credentials to access Oracle servers.
----
-
-# Oracle database plugin HTTP API
-
-The Oracle database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the Oracle database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Backend](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `connection_url` `(string: <required>)` - Specifies the Oracle DSN.
-
-- `max_open_connections` `(int: 4)` - Specifies the maximum number of open
-  connections to the database.
-
-- `max_idle_connections` `(int: 0)` - Specifies the maximum number of idle
-  connections to the database. A zero uses the value of `max_open_connections`
-  and a negative value disables idle connections. If larger than
-  `max_open_connections` it will be reduced to be equal.
-
-- `max_connection_lifetime` `(string: "0s")` - Specifies the maximum amount of
-  time a connection may be reused. If <= `0s` connections are reused forever.
-
-- `username` `(string: "")` - The root credential username used in the connection URL.
-
-- `password` `(string: "")` - The root credential password used in the connection URL.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how
-  dynamic usernames are generated.
-
-- `disable_escaping` `(boolean: false)` - Turns off the escaping of special characters inside of the username
-  and password fields. See the [databases secrets engine docs](/vault/docs/secrets/databases#disable-character-escaping)
-  for more information. Defaults to `false`.
-
-- `split_statements` `(boolean: true)` - Indicates that the provided statements
-  specified should be split on semi-colons. Set `split_statements` to true to
-  specify multiple SQL statements in a single string. Set `split_statements` to
-  `false` for complex queries such as stored or inline procedures.
-
-- `disconnect_sessions` `(boolean: true)` -  Indicates the plugin should
-  disconnect any open sessions before running revocation statements. If
-  `disconnect_sessions` is `false`, the revocation statements **must** include
-  session disconnect logic.
-
-<details>
-<summary><b>Default Username Template</b></summary>
-
-```
-{{ printf "V_%s_%s_%s_%s" (.DisplayName | truncate 8) (.RoleName | truncate 8) (random 20) (unix_time) | truncate 30 | uppercase | replace "-" "_" | replace "." "_" }}
-```
-
-<details>
-<summary><b>Example Usernames:</b></summary>
-
-| Example       |                                  |
-| ------------- | -------------------------------- |
-| `DisplayName` | `token`                          |
-| `RoleName`    | `myrolename`                     |
-| Username      | `V_TOKEN_MYROLENA_JNFRLKSZZMXJE` |
-
-| Example       |                                  |
-| ------------- | -------------------------------- |
-| `DisplayName` | `amuchlonger_dispname`           |
-| `RoleName`    | `role-name-with-dashes`          |
-| Username      | `V_AMUCHLON_ROLE_NAM_LUHU9XQM6Y` |
-
-</details>
-</details>
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "oracle-database-plugin",
-  "allowed_roles": "readonly",
-  "connection_url": "{{username}}/{{password}}@localhost:1521/OraDoc.localhost",
-  "max_open_connections": 5,
-  "max_connection_lifetime": "5s",
-  "username": "system",
-  "password": "Oracle"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/oracle
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(string: <required>)` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{name}}` and `{{password}}` values will be substituted.
-
-- `revocation_statements` `(string: "")` – Specifies the database statements to
-  be executed to revoke a user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The `{{name}}` value will be
-  substituted. If not provided defaults to a generic drop user statement.
diff --git a/website/content/api-docs/secret/databases/postgresql.mdx b/website/content/api-docs/secret/databases/postgresql.mdx
deleted file mode 100644
index 894fd81454d..00000000000
--- a/website/content/api-docs/secret/databases/postgresql.mdx
+++ /dev/null
@@ -1,206 +0,0 @@
----
-layout: api
-page_title: PostgreSQL - Database - Secrets Engines - HTTP API
-description: >-
-  The PostgreSQL plugin for Vault's database secrets engine generates database
-  credentials to access PostgreSQL servers.
----
-
-# PostgreSQL database plugin HTTP API
-
-The PostgreSQL database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the PostgreSQL database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Backend](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `connection_url` `(string: <required>)` - Specifies the PostgreSQL DSN. This field
-  can be templated and supports passing the username and password
-  parameters in the following format `{{field_name}}`. Certificate authentication
-  can be used by setting `?sslmode=` to be any of the applicable values as outlined in
-  the [Postgres SQL documentation](https://www.postgresql.org/docs/11/libpq-ssl.html#LIBPQ-SSL-PROTECTION)
-  and giving the SSL credentials in the `sslrootcert`, `sslcert` and `sslkey` credentials.
-  A templated connection URL is required when using root credential rotation. This field
-  supports both format string types, URI and keyword/value. Both formats support multiple
-  host connection strings.
-  Due to how `pgx` works, parameters such as `sslrootcert`, `sslcert`, `sslkey` are treated as paths
-  on the Vault server.
-
-- `max_open_connections` `(int: 4)` - Specifies the maximum number of open
-  connections to the database.
-
-- `max_idle_connections` `(int: 0)` - Specifies the maximum number of idle
-  connections to the database. A zero uses the value of `max_open_connections`
-  and a negative value disables idle connections. If larger than
-  `max_open_connections` it will be reduced to be equal.
-
-- `max_connection_lifetime` `(string: "0s")` - Specifies the maximum amount of
-  time a connection may be reused. If <= `0s`, connections are reused forever.
-
-- `username` `(string: "")` - The root credential username used in the connection URL.
-
-- `password` `(string: "")` - The root credential password used in the connection URL.
-
-- `auth_type` `(string: "")` - If set to `gcp_iam`, will enable IAM authentication to a Google
-  CloudSQL instance. For more information on authenticating to CloudSQL via IAM, please refer to
-  Google's official documentation [here.](https://cloud.google.com/sql/docs/postgres/authentication).
-
-- `service_account_json` `(string: "")` - JSON encoded credentials for a GCP Service Account to use
-  for IAM authentication. Requires `auth_type` to be `gcp_iam`.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how
-  dynamic usernames are generated.
-
-- `disable_escaping` `(boolean: false)` - Turns off the escaping of special characters inside of the username
-  and password fields. See the [databases secrets engine docs](/vault/docs/secrets/databases#disable-character-escaping)
-  for more information. Defaults to `false`.
-
-- `password_authentication` `(string: "password")` - When set to "scram-sha-256", passwords will be hashed by Vault and stored as-is by PostgreSQL.
-  Using "scram-sha-256" requires a minimum version of PostgreSQL 10. Available options are "scram-sha-256" and "password". The default is "password".
-  When set to "password", passwords will be sent to PostgreSQL in plaintext format and may appear in PostgreSQL logs as-is.
-  For more information, please refer to the [PostgreSQL documentation](https://www.postgresql.org/docs/current/sql-createrole.html#password).
-
-
-<details>
-<summary><b>Default Username Template</b></summary>
-
-```
-{{ printf "v-%s-%s-%s-%s" (.DisplayName | truncate 8) (.RoleName | truncate 8) (random 20) (unix_time) | truncate 63 }}
-```
-
-<details>
-<summary><b>Example Usernames:</b></summary>
-
-| Example       |                                                    |
-| ------------- | -------------------------------------------------- |
-| `DisplayName` | `token`                                            |
-| `RoleName`    | `myrolename`                                       |
-| Username      | `v-token-myrolena-jNFRlKsZZMxJEx60o66i-1614294836` |
-
-| Example       |                                                       |
-| ------------- | ----------------------------------------------------- |
-| `DisplayName` | `amuchlonger_dispname`                                |
-| `RoleName`    | `role-name-with-dashes`                               |
-| Username      | `v-amuchlon-role-nam-LUHU9xqm6YNisikA3iCQ-1614294836` |
-
-</details>
-</details>
-
-### Sample payload with URI-format connection string
-
-```json
-{
-  "plugin_name": "postgresql-database-plugin",
-  "allowed_roles": "readonly",
-  "connection_url": "postgresql://{{username}}:{{password}}@localhost:5432/postgres",
-  "max_open_connections": 5,
-  "max_connection_lifetime": "5s",
-  "username": "username",
-  "password": "password"
-}
-```
-
-### Sample payload with Keyword/Value-format connection string
-
-```json
-{
-  "plugin_name": "postgresql-database-plugin",
-  "allowed_roles": "readonly",
-  "connection_url": "host=localhost port=5432 user={{username}} password={{password}}",
-  "max_open_connections": 5,
-  "max_connection_lifetime": "5s",
-  "username": "username",
-  "password": "password"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/postgresql
-```
-
-### Connection strings with multiple hosts
-
-Postgres supports multiple hosts in the connection string. An example use-case for this might be having
-Postgres set up with Replication Manager. However, there are some formatting rules to consider when using
-this feature. Please refer to the ["Specifying Multiple Hosts" section of the
-official Postgres documentation](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING)
-for more information. Below are two small examples.
-
-#### URI-format Multi-Host string:
-
-```json
-{
-  "connection_url": "postgresql://{{username}}:{{password}}@hostone:5432,hosttwo:5432,hostthree:9999/postgres"
-}
-```
-
-#### Keyword/Value-format Multi-Host string:
-
-```json
-{
-  "connection_url": "host=hostone,hosttwo,hostthree port=5432,5432,9999 user={{username}} password={{password}} dbname=postgres"
-}
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(list: <required>)` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{name}}`, `{{password}}` and `{{expiration}}` values will be
-  substituted. The generated password will be a random alphanumeric 20 character
-  string.
-
-- `revocation_statements` `(list: [])` – Specifies the database statements to
-  be executed to revoke a user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The `{{name}}` value will be
-  substituted. If not provided defaults to a generic drop user statement.
-
-- `rollback_statements` `(list: [])` – Specifies the database statements to be
-  executed rollback a create operation in the event of an error. Not every
-  plugin type will support this functionality. Must be a semicolon-separated
-  string, a base64-encoded semicolon-separated string, a serialized JSON string
-  array, or a base64-encoded serialized JSON string array. The `{{name}}` value
-  will be substituted.
-
-- `renew_statements` `(list: [])` – Specifies the database statements to be
-  executed to renew a user. Not every plugin type will support this
-  functionality. Must be a semicolon-separated string, a base64-encoded
-  semicolon-separated string, a serialized JSON string array, or a
-  base64-encoded serialized JSON string array. The `{{name}}` and
-  `{{expiration}}` values will be substituted.
-
-- `rotation_statements` `(list: [])` – Specifies the database statements to be
-  executed to rotate the password for a given username. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{name}}` and `{{password}}` values will be substituted. The
-  generated password will be a random alphanumeric 20 character string.
diff --git a/website/content/api-docs/secret/databases/redis.mdx b/website/content/api-docs/secret/databases/redis.mdx
deleted file mode 100644
index 2f8c2980ae6..00000000000
--- a/website/content/api-docs/secret/databases/redis.mdx
+++ /dev/null
@@ -1,76 +0,0 @@
----
-layout: api
-page_title: Redis - Database - Secrets Engines - HTTP API
-description: >-
-  The Redis plugin for Vault's database secrets engine generates [ACL credentials](https://redis.io/docs/manual/security/acl/)
-  to access Redis servers.
----
-
-# Redis database plugin HTTP API
-
-The Redis database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the Redis database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Secrets Engine](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `host` `(string: <required>)` – Specifies the host to connect to.
-
-- `port` `(int: <required>)` – Specifies the port number of the connection.
-
-- `username` `(string: <required>)` – Specifies the username for Vault to use.
-
-- `password` `(string: <required>)` – Specifies the password corresponding to the given username.
-
-- `tls` `(bool: false)` – Specifies whether to use TLS when connecting to Redis.
-
-- `insecure_tls` `(bool: false)` – Specifies whether to skip verification of the
-server certificate when using TLS.
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "redis-database-plugin",
-  "host": "localhost://127.0.0.1",
-  "username": "user",
-  "password": "pass",
-  "allowed-roles": "my-*-role"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/redis
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(list: [])` – Specifies a JSON string containing
-[Redis ACL rules](https://redis.io/commands/acl-cat) to assign to created users. If not provided, defaults to
-a read-only user that can read any key.
diff --git a/website/content/api-docs/secret/databases/rediselasticache.mdx b/website/content/api-docs/secret/databases/rediselasticache.mdx
deleted file mode 100644
index bc58dfae656..00000000000
--- a/website/content/api-docs/secret/databases/rediselasticache.mdx
+++ /dev/null
@@ -1,64 +0,0 @@
----
-layout: api
-page_title: Redis ElastiCache - Database - Secrets Engines - HTTP API
-description: >-
-  The Redis ElastiCache plugin for Vault's database secrets engine generates new passwords for ElastiCache users.
----
-
-# Redis ElastiCache database plugin HTTP API
-
-The Redis ElastiCache database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates static database credentials based on
-configured roles for the Redis ElastiCache database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Secrets Engine](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `url` `(string: <required>)` – Specifies the primary endpoint to connect to.
-
-- `access_key_id` `(string)` – Specifies the IAM `access_key_id` for Vault to use. If omitted, authentication falls back on
-the AWS credentials provider chain and tries to infer authentication from the environment.
-
-- `secret_access_key` `(string)` – Specifies the IAM `secret_access_key` corresponding to the given `access_key_id`.
-If omitted, authentication falls back on the AWS credentials provider chain and tries to infer authentication from the environment.
-
-- `region` `(string)` – Specifies the AWS region where to ElastiCache cluster is provisioned. If omitted, falls back on
-the context from the environment.
-
-### Deprecated parameters
-
-- `username` `(string)` – Use `access_key_id` instead, it is strictly equivalent.
-
-- `password` `(string)` – Use `secret_access_key` instead, it is strictly equivalent.
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "redis-elasticache-database-plugin",
-  "url": "primary-endpoint.my-cluster.xxx.yyy.cache.amazonaws.com:6379",
-  "access_key_id": "AKI***",
-  "secret_access_key": "ktriNYvULAWLzUmTGb***",
-  "region": "us-east-1",
-  "allowed-roles": "*"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/my-redis-cluster
-```
diff --git a/website/content/api-docs/secret/databases/redshift.mdx b/website/content/api-docs/secret/databases/redshift.mdx
deleted file mode 100644
index 4ad6de87a41..00000000000
--- a/website/content/api-docs/secret/databases/redshift.mdx
+++ /dev/null
@@ -1,122 +0,0 @@
----
-layout: api
-page_title: Redshift - Database - Secrets Engines - HTTP API
-description: >-
-  The Redshift plugin for Vault's database secrets engine generates database
-  credentials to access the AWS Redshift service.
----
-
-# Redshift database plugin HTTP API
-
-The Redshift database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the Redshift database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Backend](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `connection_url` `(string: <required>)` - Specifies the Redshift DSN. This field
-  can be templated and supports passing the username and password
-  parameters in the following format `{{field_name}}`. A templated connection URL is
-  required when using root credential rotation.
-
-- `max_open_connections` `(int: 4)` - Specifies the maximum number of open
-  connections to the database.
-
-- `max_idle_connections` `(int: 0)` - Specifies the maximum number of idle
-  connections to the database. A zero uses the value of `max_open_connections`
-  and a negative value disables idle connections. If larger than
-  `max_open_connections` it will be reduced to be equal.
-
-- `max_connection_lifetime` `(string: "0s")` - Specifies the maximum amount of
-  time a connection may be reused. If <= `0s` connections are reused forever.
-
-- `username` `(string: "")` - The root credential username used in the connection URL.
-
-- `password` `(string: "")` - The root credential password used in the connection URL.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how dynamic usernames are generated.
-
-- `disable_escaping` `(boolean: false)` - Turns off the escaping of special characters inside of the username
-  and password fields. See the [databases secrets engine docs](/vault/docs/secrets/databases#disable-character-escaping)
-  for more information. Defaults to `false`.
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "redshift-database-plugin",
-  "allowed_roles": "readonly",
-  "connection_url": "postgresql://{{username}}:{{password}}@localhost:5432/dev",
-  "max_open_connections": 5,
-  "max_connection_lifetime": "5s",
-  "username": "username",
-  "password": "password"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/redshift
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(list: <required>)` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{name}}`, `{{password}}` and `{{expiration}}` values will be
-  substituted. The generated password will be a random alphanumeric 20 character
-  string.
-
-- `revocation_statements` `(list: [])` – Specifies the database statements to
-  be executed to revoke a user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The `{{name}}` value will be
-  substituted. If not provided defaults to a generic drop user statement.
-
-- `rollback_statements` `(list: [])` – Specifies the database statements to be
-  executed rollback a create operation in the event of an error. Not every
-  plugin type will support this functionality. Must be a semicolon-separated
-  string, a base64-encoded semicolon-separated string, a serialized JSON string
-  array, or a base64-encoded serialized JSON string array. The `{{name}}` value
-  will be substituted.
-
-- `renew_statements` `(list: [])` – Specifies the database statements to be
-  executed to renew a user. Not every plugin type will support this
-  functionality. Must be a semicolon-separated string, a base64-encoded
-  semicolon-separated string, a serialized JSON string array, or a
-  base64-encoded serialized JSON string array. The `{{name}}` and
-  `{{expiration}}` values will be substituted.
-
-- `rotation_statements` `(list: [])` – Specifies the database statements to be
-  executed to rotate the password for a given username. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{name}}` and `{{password}}` values will be substituted. The
-  generated password will be a random alphanumeric 20 character string.
diff --git a/website/content/api-docs/secret/databases/snowflake.mdx b/website/content/api-docs/secret/databases/snowflake.mdx
deleted file mode 100644
index 2d58f39184f..00000000000
--- a/website/content/api-docs/secret/databases/snowflake.mdx
+++ /dev/null
@@ -1,131 +0,0 @@
----
-layout: api
-page_title: Snowflake - Database - Secrets Engines - HTTP API
-description: >-
-  The Snowflake plugin for Vault's database secrets engine generates database
-  credentials to access Snowflake servers.
----
-
-# Snowflake database plugin HTTP API
-
-The Snowflake database plugin is one of the supported plugins for the database
-secrets engine. This plugin generates database credentials dynamically based on
-configured roles for the Snowflake database.
-
-## Configure connection
-
-In addition to the parameters defined by the [Database
-Backend](/vault/api-docs/secret/databases#configure-connection), this plugin
-has a number of parameters to further configure a connection.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/database/config/:name` |
-
-### Parameters
-
-- `connection_url` `(string: <required>)` - Specifies the Snowflake DSN. This field
-  can be templated and supports passing the username and password
-  parameters in the following format `{{field_name}}`. A templated connection URL is
-  required when using root credential rotation.
-
-- `max_open_connections` `(int: 4)` - Specifies the maximum number of open
-  connections to the database.
-
-- `max_idle_connections` `(int: 0)` - Specifies the maximum number of idle
-  connections to the database. A zero uses the value of `max_open_connections`
-  and a negative value disables idle connections. If larger than
-  `max_open_connections` it will be reduced to be equal.
-
-- `max_connection_lifetime` `(string: "0s")` - Specifies the maximum amount of
-  time a connection may be reused. If <= `0s` connections are reused forever.
-
-- `username` `(string: "")` - The root credential username used in the connection URL.
-
-- `password` `(string: "")` - The root credential password used in the connection URL.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how dynamic usernames are generated.
-
-- `disable_escaping` `(boolean: false)` - Turns off the escaping of special characters inside of the username
-  and password fields. See the [databases secrets engine docs](/vault/docs/secrets/databases#disable-character-escaping)
-  for more information. Defaults to `false`.
-
-### Sample payload
-
-```json
-{
-  "plugin_name": "snowflake-database-plugin",
-  "allowed_roles": "readonly",
-  "connection_url": "{{username}}:{{password}}@ecxxxx.west-us-1.azure/db_name",
-  "max_open_connections": 5,
-  "max_connection_lifetime": "5s",
-  "username": "username",
-  "password": "password"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/database/config/snowflake
-```
-
-## Statements
-
-Statements are configured during role creation and are used by the plugin to
-determine what is sent to the database on user creation, renewing, and
-revocation. For more information on configuring roles see the [Role
-API](/vault/api-docs/secret/databases#create-role) in the database secrets engine docs.
-
-### Parameters
-
-The following are the statements used by this plugin. If not mentioned in this
-list the plugin does not support that statement type.
-
-- `creation_statements` `(list: <required>)` – Specifies the database
-  statements executed to create and configure a user. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{name}}` and `{{expiration}}` values will be substituted.
-
-  The following values will be substituted depending on the
-  [credential_type](/vault/api-docs/secret/databases#credential_type) of the role:
-
-  - `{{password}}` is substituted for the `password` credential type
-  - `{{public_key}}` is substituted for the `rsa_private_key` credential type
-
-- `revocation_statements` `(list: [])` – Specifies the database statements to
-  be executed to revoke a user. Must be a semicolon-separated string, a
-  base64-encoded semicolon-separated string, a serialized JSON string array, or
-  a base64-encoded serialized JSON string array. The `{{name}}` value will be
-  substituted. If not provided defaults to a generic drop user statement.
-
-- `rollback_statements` `(list: [])` – Specifies the database statements to be
-  executed rollback a create operation in the event of an error. Not every
-  plugin type will support this functionality. Must be a semicolon-separated
-  string, a base64-encoded semicolon-separated string, a serialized JSON string
-  array, or a base64-encoded serialized JSON string array. The `{{name}}` value
-  will be substituted.
-
-- `renew_statements` `(list: [])` – Specifies the database statements to be
-  executed to renew a user. Not every plugin type will support this
-  functionality. Must be a semicolon-separated string, a base64-encoded
-  semicolon-separated string, a serialized JSON string array, or a
-  base64-encoded serialized JSON string array. The `{{name}}` and
-  `{{expiration}}` values will be substituted.
-
-- `rotation_statements` `(list: [])` – Specifies the database statements to be
-  executed to rotate the password for a given username. Must be a
-  semicolon-separated string, a base64-encoded semicolon-separated string, a
-  serialized JSON string array, or a base64-encoded serialized JSON string
-  array. The `{{name}}` value will be substituted.
-
-  The following values will be substituted depending on the
-  [credential_type](/vault/api-docs/secret/databases#credential_type) of the role:
-
-  - `{{password}}` is substituted for the `password` credential type
-  - `{{public_key}}` is substituted for the `rsa_private_key` credential type
diff --git a/website/content/api-docs/secret/gcp.mdx b/website/content/api-docs/secret/gcp.mdx
deleted file mode 100644
index 6b4fdce3b52..00000000000
--- a/website/content/api-docs/secret/gcp.mdx
+++ /dev/null
@@ -1,746 +0,0 @@
----
-layout: api
-page_title: Google Cloud - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault Google Cloud secrets engine.
----
-
-# Google Cloud secrets engine (API)
-
-This is the API documentation for the Vault Google Cloud Platform (GCP)
-secrets engine. For general information about the usage and operation of
-the GCP secrets engine, please see [these docs](/vault/docs/secrets/gcp).
-
-This documentation assumes the GCP secrets engine is enabled at the `/gcp` path
-in Vault. Since it is possible to mount secrets engines at any path, please
-update your API calls accordingly.
-
-## Write config
-
-| Method | Path          |
-| :----- | :------------ |
-| `POST` | `/gcp/config` |
-
-This endpoint configures shared information for the secrets engine.
-
-### Parameters
-
-- `credentials` (`string:""`) - JSON credentials (either file contents or '@path/to/file')
-  See docs for [alternative ways](/vault/docs/secrets/gcp#setup)
-  to pass in to this parameter, as well as the
-  [required permissions](/vault/docs/secrets/gcp#required-permissions).
-
-- `ttl` (`int: 0 || string:"0s"`) – Specifies default config TTL for long-lived credentials
-  (i.e. service account keys). Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `max_ttl` (`int: 0 || string:"0s"`)– Specifies the maximum config TTL for long-lived credentials
-  (i.e. service account keys). Uses [duration format strings](/vault/docs/concepts/duration-format).\*\*
-
-### Sample payload
-
-```json
-{
-  "credentials": "<JSON string>",
-  "ttl": 3600,
-  "max_ttl": 14400
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcp/config
-```
-
-## Rotate root credentials
-
-Request to rotate the GCP service account credentials used by Vault
-for this mount. A new key will be generated for the service account,
-replacing the internal value, and then a deletion of the old service
-account key is scheduled. Note that this does not create a new service
-account, only a new version of the service account key.
-
-This path is only valid if Vault has been configured to use GCP credentials via
-the `config/` endpoint where "credentials" were specified. Additionally, the
-provided service account must have permissions to create and delete service
-account keys.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/gcp/config/rotate-root` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    https://127.0.0.1:8200/v1/gcp/config/rotate-root
-```
-
-## Read config
-
-| Method | Path          |
-| :----- | :------------ |
-| `GET`  | `/gcp/config` |
-
-Credentials will be omitted from returned data.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcp/config
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "ttl": "1h",
-    "max_ttl": "4h"
-  }
-}
-```
-
-## Create/Update roleset
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/gcp/roleset/:name` |
-
-This method allows you to create a roleset or update an existing roleset. See [docs](/vault/docs/secrets/gcp#bindings) for the GCP secrets backend
-to learn more about what happens when you create or update a roleset.
-
-**If you update a roleset's bindings, this will effectively revoke any secrets
-generated under this roleset.**
-
-### Parameters
-
-- `name` (`string: <required>`): Required. Name of the role. Cannot be updated.
-- `secret_type` (`string: "access_token"`): Type of secret generated for this role set. Accepted values: `access_token`, `service_account_key`. Cannot be updated.
-- `project` (`string: <required>`): Name of the GCP project that this roleset's service account will belong to. Cannot be updated.
-- `bindings` (`string: <required>`): Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string)
-- `token_scopes` (`array: []`): List of OAuth scopes to assign to `access_token` secrets generated under this role set (`access_token` role sets only)
-
-### Sample payload
-
-```json
-{
-  "secret_type": "access_token",
-  "project": "mygcpproject",
-  "bindings": "...",
-  "token_scopes": [
-    "https://www.googleapis.com/auth/cloud-platform",
-    "https://www.googleapis.com/auth/bigquery"
-  ]
-}
-```
-
-#### Sample bindings:
-
-See [bindings format docs](/vault/docs/secrets/gcp#bindings) for more information.
-
-```hcl
-resource "//cloudresourcemanager.googleapis.com/projects/mygcpproject" {
-  roles = [
-    "roles/viewer"
-  ],
-}
-
-resource "//bigquery.googleapis.com/projects/my-project/datasets/mydataset" {
-  roles = [
-    "roles/bigquery.dataViewer"
-  ],
-}
-
-resource "https://selflink/to/my/resource" {
-  roles = [
-    "project/mygcpproject/roles/projcustomrole",
-    "organizations/myorg/roles/orgcustomrole"
-  ],
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset
-```
-
-## Rotate roleset account
-
-| Method | Path                        |                    |
-| :----- | :-------------------------- | ------------------ |
-| `POST` | `/gcp/roleset/:name/rotate` | `204 (empty body)` |
-
-This will rotate the service account this roleset uses to generate secrets.
-(this also replaces the key `access_token` roleset). This can be used to invalidate
-old secrets generated by the roleset or fix issues if a roleset's service account
-(and/or keys) was changed outside of Vault (i.e. through GCP APIs/cloud console).
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset/rotate
-```
-
-## Rotate roleset account key (`access_token` roleset only)
-
-| Method | Path                            |                    |
-| :----- | :------------------------------ | ------------------ |
-| `POST` | `/gcp/roleset/:name/rotate-key` | `204 (empty body)` |
-
-This will rotate the service account key this roleset uses to generate
-access tokens. This does not recreate the roleset service account.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset/rotate-key
-```
-
-## Read roleset
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/gcp/roleset/:name` |
-
-### Parameters
-
-- `name` (`string:<required>`): Name of the roleset to read.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "secret_type": "access_token",
-    "service_account_email": "vault-myroleset-XXXXXXXXXX@myproject.gserviceaccounts.com",
-    "service_account_project": "service-account-project",
-    "bindings": {
-      "project/mygcpproject": ["roles/viewer"],
-      "https://selflink/to/my/resource": [
-        "project/mygcpproject/roles/projcustomrole",
-        "organizations/myorg/roles/orgcustomrole"
-      ]
-    },
-    "token_scopes": ["https://www.googleapis.com/auth/cloud-platform"]
-  }
-}
-```
-
-## List rolesets
-
-| Method | Path            |
-| :----- | :-------------- |
-| `LIST` | `/gcp/rolesets` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/gcp/rolesets
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["my-token-roleset", "my-sakey-roleset"]
-  }
-}
-```
-
-## Delete roleset
-
-This endpoint deletes an existing roleset by the given name.
-
-| Method   | Path                 |
-| :------- | :------------------- |
-| `DELETE` | `/gcp/roleset/:name` |
-
-### Parameters
-
-- `name` (`string:<required>`): Name of the roleset to delete.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset
-```
-
-## Create/Update static account
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `/gcp/static-account/:name` |
-
-This method allows you to create a static account or update an existing static account. See [docs](/vault/docs/secrets/gcp#bindings) for the GCP secrets backend
-to learn more about what happens when you create or update a static account.
-
-**If you update a static account's bindings, this will effectively revoke any secrets
-generated under this static account.**
-
-### Parameters
-
-- `name` (`string: <required>`): Name of the static account. Cannot be updated.
-- `secret_type` (`string: "access_token"`): Type of secret generated for this static account. Accepted values: `access_token`, `service_account_key`. Cannot be updated.
-- `service_account_email` (`string: <required>`): Email of the GCP service account to manage. Cannot be updated.
-- `bindings` (`string`): Bindings configuration string (expects HCL or JSON format in raw or base64-encoded string). Optional.
-- `token_scopes` (`array: []`): List of OAuth scopes to assign to `access_token` secrets generated under this static account (`access_token` static accounts only)
-
-### Sample payload
-
-```json
-{
-  "secret_type": "access_token",
-  "service_account_email": "example@mygcpproject.iam.gserviceaccount.com",
-  "bindings": "...",
-  "token_scopes": [
-    "https://www.googleapis.com/auth/cloud-platform",
-    "https://www.googleapis.com/auth/bigquery"
-  ]
-}
-```
-
-#### Sample bindings:
-
-See [bindings format docs](/vault/docs/secrets/gcp#bindings) for more information.
-
-```hcl
-resource "//cloudresourcemanager.googleapis.com/projects/mygcpproject" {
-  roles = [
-    "roles/viewer"
-  ],
-}
-
-resource "//bigquery.googleapis.com/projects/my-project/datasets/mydataset" {
-  roles = [
-    "roles/bigquery.dataViewer"
-  ],
-}
-
-resource "https://selflink/to/my/resource" {
-  roles = [
-    "project/mygcpproject/roles/projcustomrole",
-    "organizations/myorg/roles/orgcustomrole"
-  ],
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcp/static-account/my-token-account
-```
-
-## Rotate static account key (`access_token` static account only)
-
-| Method | Path                            |                           |
-| :----- | :------------------------------ | ------------------------- |
-| `POST` | `/gcp/static-account/:name/rotate-key` | `204 (empty body)` |
-
-This will rotate the service account key this static account uses to generate
-access tokens. This does not recreate the service account.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    https://127.0.0.1:8200/v1/gcp/static-account/my-token-account/rotate-key
-```
-
-## Read static account
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `GET`  | `/gcp/static-account/:name` |
-
-### Parameters
-
-- `name` (`string:<required>`): Name of the static account to read.
-
-This endpoint will only return bindings that are managed through the secrets engine. Bindings
-manually managed outside of Vault will not be returned.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcp/static-account/my-token-account
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "secret_type": "access_token",
-    "service_account_email": "example@mygcpproject.iam.gserviceaccount.com",
-    "service_account_project": "mygcpproject",
-    "bindings": {
-      "project/mygcpproject": ["roles/viewer"],
-      "https://selflink/to/my/resource": [
-        "project/mygcpproject/roles/projcustomrole",
-        "organizations/myorg/roles/orgcustomrole"
-      ]
-    },
-    "token_scopes": ["https://www.googleapis.com/auth/cloud-platform"]
-  }
-}
-```
-
-## List static accounts
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `LIST` | `/gcp/static-accounts` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/gcp/static-accounts
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["my-token-account", "my-sakey-account"]
-  }
-}
-```
-
-## Delete static account
-
-This endpoint deletes an existing static account by the given name.
-
-| Method   | Path                        |
-| :------- | :-------------------------- |
-| `DELETE` | `/gcp/static-account/:name` |
-
-### Parameters
-
-- `name` (`string:<required>`): Name of the static account to delete.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/gcp/static-account/my-token-account
-```
-
-## Create/Update impersonated account
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `POST` | `/gcp/impersonated-account/:name` |
-
-This method allows you to create an impersonated account or update an existing
-impersonated account.
-
-### Parameters
-
-- `name` (`string: <required>`): Name of the impersonated account. Cannot be updated.
-- `service_account_email` (`string: <required>`): Email of the GCP service account to
-  manage. Cannot be updated.
-- `token_scopes` (`array: []`): List of OAuth scopes to assign to access tokens
-  generated under this impersonation account.
-- `ttl` (`duration: ""`): Lifetime of the token generated. Defaults to 1 hour and
-  is limited to a maximum of 12 hours. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-```json
-{
-  "service_account_email": "projectOwner@my-project.iam.gserviceaccount.com",
-  "token_scopes": [
-    "https://www.googleapis.com/auth/cloud-platform",
-    "https://www.googleapis.com/auth/bigquery"
-  ],
-  "ttl": "2h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcp/impersonated-account/my-token-impersonate
-```
-
-## Read impersonated account
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `GET`  | `/gcp/impersonated-account/:name` |
-
-### Parameters
-
-- `name` (`string:<required>`): Name of the impersonated account to read.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcp/impersonated-account/my-token-impersonate
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "service_account_email": "projectOwner@my-project.iam.gserviceaccount.com",
-    "service_account_project": "my-project",
-    "token_scopes": [
-      "https://www.googleapis.com/auth/cloud-platform",
-      "https://www.googleapis.com/auth/bigquery"
-    ],
-    "ttl": 7200
-  },
-}
-```
-## List impersonated accounts
-
-This endpoint lists the configured Vault roles for impersonated accounts.
-
-| Method | Path                         |
-| :----- | :---------------------       |
-| `LIST` | `/gcp/impersonated-accounts` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/gcp/impersonated-accounts
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "my-token-impersonate",
-      "secondary-role"
-    ]
-  }
-}
-```
-
-## Delete impersonated account
-
-This endpoint deletes an existing impersonated account by the given name.
-
-| Method   | Path                              |
-| :------- | :-------------------------------- |
-| `DELETE` | `/gcp/impersonated-account/:name` |
-
-### Parameters
-
-- `name` (`string:<required>`): Name of the impersonated account to delete.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/gcp/impersonated-account/my-token-impersonate
-```
-
-## Generate secret (IAM service account creds): OAuth2 access token
-
-| Method         | Path                                                    |
-| :------------- | :------------------------------------------------------ |
-| `GET` / `POST` | `/gcp/roleset/:roleset/token`                           |
-| `GET` / `POST` | `/gcp/static-account/:static-account/token`             |
-| `GET` / `POST` | `/gcp/impersonated-account/:impersonated-account/token` |
-| `GET` / `POST` | `/gcp/token/:roleset` (deprecated)                      |
-
-Generates an OAuth2 token with the scopes defined on the roleset, static
-account, or impersonated account. This OAuth access token can
-be used in GCP API calls, e.g. `curl -H "Authorization: Bearer $TOKEN" ...`
-
-Tokens are non-revocable and non-renewable and have a static TTL of an hour. The TTL configured
-for the backend (either through the default system TTLs or through the `config/` endpoint)
-do not apply.
-
-### Parameters
-
-- `roleset` (`string:<required>`): Name of an roleset with secret type `access_token` to generate access_token under.
-- `static-account` (`string:<required>`): Name of the static account with secret type `access_token` to generate access_token under.
-- `impersonated-account` (`string:<required>`): Name of the impersonated account to
-  generate access_token_under.
-
-### Sample request
-
-**Roleset:**
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcp/roleset/my-token-roleset/token
-```
-
-**Static account:**
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcp/static-account/my-token-account/token
-```
-
-**Impersonated account:**
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcp/impersonated-account/my-token-impersonate/token
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "<uuid>",
-  "data": {
-    "token": "ya29.c.Elp5Be3ga87...",
-    "expires_at_seconds": 1537400046,
-    "token_ttl": 3599
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Generate secret (IAM service account creds): service account key
-
-| Method         | Path                                      |
-| :------------- | :---------------------------------------- |
-| `GET` / `POST` | `/gcp/roleset/:roleset/key`               |
-| `GET` / `POST` | `/gcp/static-account/:static-account/key` |
-| `GET` / `POST` | `/gcp/key/:roleset` (deprecated)          |
-
-
-If using `GET` ('read'), the optional parameters will be set to their defaults. Use `POST` if you
-want to specify different values for these params.
-
-These keys are renewable and have TTL/max TTL as defined by either the backend config
-or the system default if config was not defined.
-
-### Parameters
-
-- `roleset` (`string:<required>`): Name of an roleset with secret type `service_account_key` to generate key under.
-- `static-account` (`string:<required>`): Name of an static account with secret type `service_account_key` to generate key under.
-- `key_algorithm` (`string:"KEY_ALG_RSA_2048"`): Key algorithm used to generate key. Defaults to 2k RSA key
-  You probably should not choose other values (i.e. 1k), but accepted values are
-  `enum(`[`ServiceAccountKeyAlgorithm`](https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts.keys#ServiceAccountKeyAlgorithm)`)`
-- `key_type` (`string:"TYPE_GOOGLE_CREDENTIALS_FILE`): Private key type to generate. Defaults to JSON credentials file.
-  Accepted values are `enum(`[`ServiceAccountPrivateKeyType`](https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts.keys#ServiceAccountPrivateKeyType)`)`
-- `ttl` (`string: ""`): Specifies the Time To Live value provided using a [duration format string](/vault/docs/concepts/duration-format). If not set, uses the system default value.
-
-### Sample payload
-
-```json
-{
-  "key_algorithm": "KEY_ALG_RSA_2048",
-  "key_type": "TYPE_GOOGLE_CREDENTIALS_FILE"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcp/roleset/my-key-roleset/key
-```
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcp/roleset/my-key-roleset/key
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "<uuid>",
-  "lease_id": "gcp/roleset/my-key-roleset/key/<uuid>",
-  "renewable": true,
-  "lease_duration": 3600,
-  "data": {
-    "private_key_data": "<base64-encoded private key data>",
-    "key_algorithm": "TYPE_GOOGLE_CREDENTIALS_FILE",
-    "key_type": "KEY_ALG_RSA_2048"
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Revoking/Renewing secrets
-
-See docs on how to [renew](/vault/api-docs/system/leases#renew-lease) and [revoke](/vault/api-docs/system/leases#revoke-lease) leases.
-Note this only applies to service account keys.
diff --git a/website/content/api-docs/secret/gcpkms.mdx b/website/content/api-docs/secret/gcpkms.mdx
deleted file mode 100644
index c2e172f5c11..00000000000
--- a/website/content/api-docs/secret/gcpkms.mdx
+++ /dev/null
@@ -1,878 +0,0 @@
----
-layout: api
-page_title: Google Cloud KMS - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault Google Cloud KMS secrets engine.
----
-
-# Google Cloud KMS secrets engine (API)
-
-This is the API documentation for the Vault Google Cloud KMS secrets engine. For
-general information about the usage and operation of the Google Cloud KMS
-secrets engine, please see the
-[Google Cloud KMS documentation](/vault/docs/secrets/gcpkms).
-
-This documentation assumes the Google Cloud KMS secrets engine is enabled at the
-`/gcpkms` path in Vault. Since it is possible to enable secrets engines at any
-location, please update your API calls accordingly.
-
-## Configure credentials
-
-This endpoint configures the Google Cloud KMS secrets engine with credentials
-and manages the requested scope(s) for authentication.
-
-| Method | Path            |
-| :----- | :-------------- |
-| `POST` | `gcpkms/config` |
-
-### Example policy
-
-```hcl
-path "gcpkms/config" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Parameters
-
-- `credentials` (`string: ""`) -
-  The credentials to use for authenticating to Google Cloud. Leave this blank to
-  use the Default Application Credentials or instance metadata authentication.
-
-- `scopes` (`array<string>: []`) -
-  The list of full-URL scopes to request when authenticating. By default, this
-  requests https://www.googleapis.com/auth/cloudkms.
-
-### Sample payload
-
-```json
-{
-  "credentials": "< JSON credentials... >"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcpkms/config
-```
-
-## Read configuration
-
-This endpoint returns the configuration endpoint for the Google Cloud KMS
-secrets engine. The credentials are not returned.
-
-| Method | Path            |
-| :----- | :-------------- |
-| `GET`  | `gcpkms/config` |
-
-### Example policy
-
-```hcl
-path "gcpkms/config" {
-  capabilities = ["read"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcpkms/config
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "scopes": ["https://www.googleapis.com/auth/cloudkms"]
-  }
-}
-```
-
-## Delete configuration
-
-This endpoint deletes any configuration for the Google Cloud KMS secrets engine.
-If there is no configuration, the endpoint still returns successfully.
-
-| Method   | Path            |
-| :------- | :-------------- |
-| `DELETE` | `gcpkms/config` |
-
-### Example policy
-
-```hcl
-path "gcpkms/config" {
-  capabilities = ["delete"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/gcpkms/config
-```
-
-## Decrypt ciphertext
-
-This endpoint uses the named encryption key to decrypt the ciphertext string. For symmetric key types, the provided ciphertext must come from a previous invocation of the `/encrypt` endpoint. For asymmetric key types, the provided ciphertext must be from the encrypt operation against the corresponding key version's public key.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `POST` | `gcpkms/decrypt/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/decrypt/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Parameters
-
-- `key` (`string: ""`) -
-  Name of the key in Vault to use for decryption. This key must already exist in
-  Vault and must map back to a Google Cloud KMS key.
-  This is specified as part of the URL.
-
-- `additional_authenticated_data` (`string: ""`) -
-  Optional data that was specified during encryption of this payload.
-
-- `ciphertext` (`string: ""`) -
-  Ciphertext to decrypt as previously returned from an encrypt operation. This
-  must be base64-encoded ciphertext as previously returned from an encrypt
-  operation.
-
-- `key_version` (`int: 0`) -
-  Integer version of the crypto key version to use for decryption. This is
-  required for asymmetric keys. For symmetric keys, Cloud KMS will choose the
-  correct version automatically.
-
-### Sample payload
-
-```json
-{
-  "ciphertext": "CiQAuMv0..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcpkms/decrypt/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "plaintext": "hello world"
-  }
-}
-```
-
-## Encrypt plaintext
-
-This endpoint uses the named encryption key to encrypt arbitrary plaintext
-string data. The response will be base64-encoded encrypted ciphertext.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `POST` | `gcpkms/encrypt/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/encrypt/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Parameters
-
-- `key` (`string: ""`) -
-  Name of the key in Vault to use for encryption. This key must already exist in
-  Vault and must map back to a Google Cloud KMS key.
-  This is specified as part of the URL.
-
-- `additional_authenticated_data` (`string: ""`) -
-  Optional base64-encoded data that, if specified, must also be provided to
-  decrypt this payload.
-
-- `key_version` (`int: 0`) -
-  Integer version of the crypto key version to use for encryption. If unspecified,
-  this defaults to the latest active crypto key version.
-
-- `plaintext` (`string: ""`) -
-  Plaintext value to be encrypted. This can be a string or binary, but the size
-  is limited. See the Google Cloud KMS documentation for information on size
-  limitations by key types.
-
-### Sample payload
-
-```json
-{
-  "plaintext": "hello world"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcpkms/encrypt/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "ciphertext": "CiQAuMv0...",
-    "key_version": "1"
-  }
-}
-```
-
-## Re-Encrypt existing ciphertext
-
-This endpoint uses the named encryption key to re-encrypt the underlying
-cryptokey to the latest version for this ciphertext without disclosing the
-original plaintext value to the requestor. This is similar to "rewrapping" in
-Vault's transit secrets engine.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `gcpkms/reencrypt/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/reencrypt/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Parameters
-
-- `key` (`string: ""`) -
-  Name of the key to use for encryption. This key must already exist in Vault and
-  Google Cloud KMS.
-  This is specified as part of the URL.
-
-- `additional_authenticated_data` (`string: ""`) -
-  Optional data that, if specified, must also be provided during decryption.
-
-- `ciphertext` (`string: ""`) -
-  Ciphertext to be re-encrypted to the latest key version. This must be ciphertext
-  that Vault previously generated for this named key.
-
-- `key_version` (`int: 0`) -
-  Integer version of the crypto key version to use for re-encryption. If unspecified,
-  this defaults to the latest active crypto key version.
-
-### Sample payload
-
-```json
-{
-  "ciphertext": "CiQAuMv0..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcpkms/reencrypt/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "ciphertext": "0lX848IG...",
-    "key_version": "3"
-  }
-}
-```
-
-## Sign digest
-
-This endpoint uses the named encryption key to sign digest string data. The
-response will include the base64-encoded signature.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `gcpkms/sign/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/sign/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Parameters
-
-- `key` (`string: ""`) -
-  Name of the key in Vault to use for signing. This key must already exist in
-  Vault and must map back to a Google Cloud KMS key.
-  This is specified as part of the URL.
-
-- `key_version` (`int: <required>`) -
-  Integer version of the crypto key version to use for signing.
-
-- `digest` (`string: <required>`) -
-  Digest to sign. This digest is the base64 encoded binary value, and must match
-  the signing algorithm digest of the Cloud KMS key, for example:
-
-      ```text
-      $ openssl dgst -sha256 -binary /my/file | base64
-      ```
-
-### Sample payload
-
-```json
-{
-  "key_version": "1",
-  "digest": "LoM6lxd8YS+hUynZwrlCG20ViUUqqbNNNmh7HCtOkSc="
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcpkms/sign/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "signature": "MGYCMQCOfWMc21jBevoRRo4zGjYsCXer8s..."
-  }
-}
-```
-
-## Verify digest
-
-This endpoint uses the named encryption key to verify a signature and digest
-string data.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `gcpkms/verify/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/verify/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Parameters
-
-- `key` (`string: ""`) -
-  Name of the key in Vault to use for verifying. This key must already exist in
-  Vault and must map back to a Google Cloud KMS key.
-  This is specified as part of the URL.
-
-- `key_version` (`int: <required>`) -
-  Integer version of the crypto key version to use for verifying.
-
-- `digest` (`string: <required>`) -
-  Digest that was signed. This digest is the base64 encoded binary value, and must match
-  the signing algorithm digest of the Cloud KMS key. For example:
-
-      ```text
-      $ openssl dgst -sha256 -binary /my/file | base64
-      ```
-
-- `signature` (`string: <required>`) -
-  Signature of the digest as returned from a signing operation.
-
-### Sample payload
-
-```json
-{
-  "key_version": "1",
-  "digest": "LoM6lxd8YS+hUynZwrlCG20ViUUqqbNNNmh7HCtOkSc=",
-  "signature": "MGQCMEN2rgg6sj2vUEC3IcKDD+UprtMnxDoB3..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcpkms/verify/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "valid": true
-  }
-}
-```
-
-## List keys
-
-This endpoint lists the named keys available for use in Vault. It does not list
-all Google Cloud KMS keys.
-
-| Method | Path          |
-| :----- | :------------ |
-| `LIST` | `gcpkms/keys` |
-
-### Example policy
-
-```hcl
-path "gcpkms/keys" {
-  capabilities = ["list"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/gcpkms/keys
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["my-key"]
-  }
-}
-```
-
-## Create/Update Google Cloud KMS key
-
-This endpoint is used to create or update a Google Cloud KMS key. In addition to
-registering the key in Vault, this endpoint will also create the corresponding
-Google Cloud KMS key with the given configuration options.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `gcpkms/keys/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/keys/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Parameters
-
-- `key` (`string: ""`) -
-  Name of the key in Vault.
-  This is specified as part of the URL.
-
-- `crypto_key` (`string: ""`) -
-  Name of the crypto key to use. If the given crypto key does not exist, Vault
-  will try to create it. This defaults to the name of the key given to Vault as
-  the parameter if unspecified.
-
-- `key_ring` (`string: ""`) -
-  Full Google Cloud resource ID of the key ring with the project and location
-  (e.g. projects/my-project/locations/global/keyRings/my-keyring). If the given
-  key ring does not exist, Vault will try to create it during a create operation.
-
-- `labels` (`map<string>string: nil`) -
-  Arbitrary key=value labels to apply to the crypto key. To specify multiple
-  labels, specify this argument multiple times (e.g. labels="a=b" labels="c=d").
-
-- `rotation_period` (`string: ""`) -
-  Amount of time between crypto key version rotations. This is specified as a
-  time duration value like 72h (72 hours). The smallest possible value is 24h.
-
-- `protection_level` (`string: "software"`) -
-  Level of protection to use for the key management. Valid values are `software`
-  and `hsm`. The default value is `software`. The value cannot be changed after
-  creation.
-
-- `purpose` (`string: "encrypt_decrypt"`) -
-  Purpose of the key. Valid options are `asymmetric_decrypt`, `asymmetric_sign`,
-  and `encrypt_decrypt`. The default value is `encrypt_decrypt`. The value cannot
-  be changed after creation.
-
-- `algorithm` (`string: "symmetric_encryption"`) -
-  Algorithm to use for encryption, decryption, or signing. The value depends on
-  the key purpose. The value cannot be changed after creation. See table below
-  for the supported algorithms of each purpose.
-
-  | Purpose              | Supported Algorithms                                                                                                                                                                                                                            |
-  | :------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-  | `encrypt_decrypt`    | `symmetric_encryption`                                                                                                                                                                                                                          |
-  | `asymmetric_decrypt` | `rsa_decrypt_oaep_2048_sha256`<br/>`rsa_decrypt_oaep_3072_sha256`<br/>`rsa_decrypt_oaep_4096_sha256`                                                                                                                                            |
-  | `asymmetric_sign`    | `rsa_sign_pss_2048_sha256`<br/>`rsa_sign_pss_3072_sha256`<br/>`rsa_sign_pss_4096_sha256`<br/>`rsa_sign_pkcs1_2048_sha256`<br/>`rsa_sign_pkcs1_3072_sha256`<br/>`rsa_sign_pkcs1_4096_sha256`<br/>`ec_sign_p256_sha256`<br/>`ec_sign_p384_sha384` |
-
-### Sample payload
-
-```json
-{
-  "key_ring": "projects/my-project/locations/my-location/keyRings/my-keyring",
-  "labels": {
-    "foo": "bar"
-  },
-  "rotation_period": "72h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcpkms/keys/my-key
-```
-
-## Delete Google Cloud KMS key
-
-This endpoint deletes a key from both Vault and Google Cloud KMS. This will
-disable all crypto key versions for this crypto key in Google Cloud KMS and
-delete Vault's reference to the crypto key.
-
-| Method   | Path               |
-| :------- | :----------------- |
-| `DELETE` | `gcpkms/keys/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/keys/my-key" {
-  capabilities = ["delete"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/gcpkms/keys/my-key
-```
-
-## Read Google Cloud KMS key
-
-This endpoint reads data about a Google Cloud KMS crypto key, including the key
-status and current primary key version.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `gcpkms/keys/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/keys/my-key" {
-  capabilities = ["read"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcpkms/keys/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "id": "projects/my-project/locations/my-location/keyRings/my-keyring/cryptoKeys/my-crypto-key",
-    "labels": {
-      "foo": "bar"
-    },
-    "next_rotation_time_seconds": 1536613424,
-    "primary_version": "3",
-    "purpose": "encrypt_decrypt",
-    "rotation_schedule_seconds": 259200,
-    "state": "enabled"
-  }
-}
-```
-
-## Read Vault key configuration
-
-This endpoint reads data about a Vault's configuration of the key.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `gcpkms/keys/config/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/keys/config/my-key" {
-  capabilities = ["read"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/gcpkms/keys/config/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "name": "my-key",
-    "crypto_key": "projects/my-project/locations/my-location/keyRings/my-keyring/cryptoKeys/my-crypto-key",
-    "min_version": 10
-  }
-}
-```
-
-## Update Vault key configuration
-
-This endpoint is used to update Vault's information about an existing key.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `gcpkms/keys/config/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/keys/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Parameters
-
-- `key` (`string: ""`) -
-  Name of the key in Vault.
-  This is specified as part of the URL.
-
-- `min_version` (`int: 0`) -
-  Minimum allowed crypto key version. If set to a positive value, key versions
-  less than the given value are not permitted to be used. If set to 0 or a
-  negative value, there is no minimum key version.
-
-- `max_version` (`int: 0`) -
-  Maximum allowed crypto key version. If set to a positive value, key versions
-  greater than the given value are not permitted to be used. If set to 0 or a
-  negative value, there is no maximum key version.
-
-### Sample payload
-
-```json
-{
-  "min_version": 10
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcpkms/keys/config/my-key
-```
-
-## Deregister crypto key
-
-This endpoint deregisters an existing reference Vault has to a crypto key in
-Google Cloud KMS. The underlying Google Cloud KMS key remains unchanged.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `gcpkms/keys/deregister/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/keys/deregister/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    https://127.0.0.1:8200/v1/gcpkms/keys/deregister/my-key
-```
-
-## Register crypto key
-
-This endpoint registers an existing crypto key in Google Cloud KMS and makes it
-available for encryption and decryption in Vault.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `gcpkms/keys/register/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/keys/register/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Parameters
-
-- `key` (`string: ""`) -
-  Name of the key to register in Vault. This will be the named used to refer to
-  the underlying crypto key when encrypting or decrypting data.
-  This is specified as part of the URL.
-
-- `crypto_key` (`string: ""`) -
-  Full resource ID of the crypto key including the project, location, key ring,
-  and crypto key like "projects/%s/locations/%s/keyRings/%s/cryptoKeys/%s". This
-  crypto key must already exist in Google Cloud KMS unless verify is set to
-  "false".
-
-- `verify` (`bool: true`) -
-  Verify that the given Google Cloud KMS crypto key exists and is accessible
-  before creating the storage entry in Vault. Set this to "false" if the key will
-  not exist at creation time.
-
-### Sample payload
-
-```json
-{
-  "crypto_key": "projects/my-project/locations/my-location/keyRings/my-keyring/cryptoKeys/my-crypto-key",
-  "verify": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/gcpkms/keys/register/my-key
-```
-
-## Rotate crypto key
-
-This endpoint rotates a crypto key by creating a new crypto key version for the
-corresponding Google Cloud KMS key and updates the new crypto key to be the
-primary key for future encryptions.
-
-**It can take up to 2 hours for a new crypto key version to become the primary,
-so be sure to issue a read operation if you require new data to be encrypted
-with this key.**
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `gcpkms/keys/rotate/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/keys/rotate/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    https://127.0.0.1:8200/v1/gcpkms/keys/rotate/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "key_version": "3"
-  }
-}
-```
-
-## Trim KMS key versions
-
-This endpoint deletes old crypto key versions that are older than the key's specified `min_version`.
-
-**Data encrypted with older key versions will be irrecoverable!**
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `gcpkms/keys/trim/:key` |
-
-### Example policy
-
-```hcl
-path "gcpkms/keys/trim/my-key" {
-  capabilities = ["create", "update"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    https://127.0.0.1:8200/v1/gcpkms/keys/trim/my-key
-```
diff --git a/website/content/api-docs/secret/identity/entity-alias.mdx b/website/content/api-docs/secret/identity/entity-alias.mdx
deleted file mode 100644
index 13d71355e46..00000000000
--- a/website/content/api-docs/secret/identity/entity-alias.mdx
+++ /dev/null
@@ -1,255 +0,0 @@
----
-layout: api
-page_title: 'Identity Secret Backend: Entity Alias - HTTP API'
-description: >-
-  This is the API documentation for managing entity aliases in the identity
-  store.
----
-
-~> **NOTE:** Be careful in granting permissions to non-readonly identity endpoints.
-If a user can modify an entity, they can grant it additional privileges through
-policies.  If a user can modify an alias they can login with, they can bind it to
-an entity with higher privileges.
-
-## Create an entity alias
-
-~> **IMPORTANT NOTE:** Prior to creating any alias it is important to consider the cardinality of the alias' name,
-since there are potential security issues to be aware of. The main one revolves around alias reuse. It is possible
-for multiple authenticated entities to be bound to the same alias, and therefore gain access to all of its privileges.
-It is recommended, whenever possible, to create a unique alias for each entity. This is especially true in the case
-of machine generated entities.
-
-This endpoint creates a new alias for an entity.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/identity/entity-alias` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the alias. Name should be the identifier
-  of the client in the authentication source. For example, if the alias belongs
-  to userpass backend, the name should be a valid username within userpass
-  auth method. If the alias belongs to GitHub, it should be the GitHub username. If the alias 
-  belongs to an approle auth method, the name should be a valid RoleID.
-
-- `id` `(string: <optional>)` - ID of the entity alias. If set, updates the
-  corresponding entity alias.
-
-- `canonical_id` `(string: <required>)` - Entity ID to which this alias belongs to.
-
-- `mount_accessor` `(string: <required>)` - Accessor of the mount to which the
-  alias should belong to.
-
-- `custom_metadata` `(map<string|string>: <optional>)` - A map of arbitrary string to string valued 
-  user-provided metadata meant to describe the alias.
-
-### Sample payload
-
-```json
-{
-  "name": "testuser",
-  "canonical_id": "404e57bc-a0b1-a80f-0a73-b6e92e8a52d3",
-  "mount_accessor": "auth_userpass_e50b1a44",
-  "custom_metadata": {
-    "contact_email": "james_updated@example.com"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/entity-alias
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "canonical_id": "404e57bc-a0b1-a80f-0a73-b6e92e8a52d3",
-    "id": "34982d3d-e3ce-5d8b-6e5f-b9bb34246c31"
-  }
-}
-```
-
-## Read entity alias by ID
-
-This endpoint queries the entity alias by its identifier.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `GET`  | `/identity/entity-alias/id/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Identifier of entity alias.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/identity/entity-alias/id/34982d3d-e3ce-5d8b-6e5f-b9bb34246c31
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "creation_time": "2017-07-25T21:41:09.820717636Z",
-    "canonical_id": "404e57bc-a0b1-a80f-0a73-b6e92e8a52d3",
-    "custom_metadata": {
-      "contact_email":"james@example.com"
-    },
-    "id": "34982d3d-e3ce-5d8b-6e5f-b9bb34246c31",
-    "last_update_time": "2017-07-25T21:41:09.820717636Z",
-    "local": false,
-    "metadata": {
-      "group": "san_francisco",
-      "region": "west"
-    },
-    "mount_accessor": "auth_userpass_e50b1a44",
-    "mount_path": "userpass/",
-    "mount_type": "userpass",
-    "name": "testuser"
-  }
-}
-```
-
-## Update entity alias by ID
-
-This endpoint is used to update an existing entity alias.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `POST` | `/identity/entity-alias/id/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Identifier of the entity alias.
-
-- `name` `(string: "")` - Name of the alias. Name should be the identifier
-  of the client in the authentication source. For example, if the alias belongs
-  to userpass backend, the name should be a valid username within userpass
-  backend. If alias belongs to GitHub, it should be the GitHub username.
-
-- `canonical_id` `(string: "")` - Entity ID to which this alias belongs to.
-
-- `mount_accessor` `(string: "")` - Accessor of the mount to which the
-  alias should belong to.
-
-- `custom_metadata` `(map<string|string>: <optional>)` - A map of arbitrary string to string valued 
-  user-provided metadata meant to describe the alias.
-
-### Sample payload
-
-```json
-{
-  "name": "testuser",
-  "canonical_id": "404e57bc-a0b1-a80f-0a73-b6e92e8a52d3",
-  "mount_accessor": "auth_userpass_e50b1a44"
-   "custom_metadata": {
-    "contact_email": "james@example.com"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/entity-alias/id/34982d3d-e3ce-5d8b-6e5f-b9bb34246c31
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "canonical_id": "404e57bc-a0b1-a80f-0a73-b6e92e8a52d3",
-    "id": "34982d3d-e3ce-5d8b-6e5f-b9bb34246c31"
-  }
-}
-```
-
-## Delete entity alias by ID
-
-This endpoint deletes an alias from its corresponding entity.
-
-| Method   | Path                            |
-| :------- | :------------------------------ |
-| `DELETE` | `/identity/entity-alias/id/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Identifier of the entity alias.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/entity-alias/id/34982d3d-e3ce-5d8b-6e5f-b9bb34246c31
-```
-
-## List entity aliases by ID
-
-The list by ID endpoint returns the available entity aliases and key data by their identifiers.
-
-| Method | Path                                  |
-| :----- | :------------------------------------ |
-| `LIST` | `/identity/entity-alias/id`           |
-| `GET`  | `/identity/entity-alias/id?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/entity-alias/id
-```
-
-### Sample response
-
-```json
-{
-    "data": {
-        "key_info": {
-            "35405f3c-884a-a3ff-4176-bac57f220811": {
-                "canonical_id": "0c34f097-6313-9597-3b22-91e34072ad28",
-                "custom_metadata": null,
-                "local": false,
-                "mount_accessor": "auth_jwt_e47c5220",
-                "mount_path": "auth/tfc_jwt/",
-                "mount_type": "jwt",
-                "name": "app-alias-1"
-            },
-            "4065d8c7-4fa6-db9d-e190-f9644c09638a": {
-                "canonical_id": "21c6f2bf-b9b0-db44-242f-18bf76cb9ff0",
-                "custom_metadata": null,
-                "local": false,
-                "mount_accessor": "auth_ns_token_79c4d932",
-                "mount_path": "auth/token/",
-                "mount_type": "ns_token",
-                "name": "app-alias-2"
-            }
-        },
-        "keys": [
-            "35405f3c-884a-a3ff-4176-bac57f220811",
-            "4065d8c7-4fa6-db9d-e190-f9644c09638a"
-        ]
-    }
-}
-```
diff --git a/website/content/api-docs/secret/identity/entity.mdx b/website/content/api-docs/secret/identity/entity.mdx
deleted file mode 100644
index 0d2e16fd7f5..00000000000
--- a/website/content/api-docs/secret/identity/entity.mdx
+++ /dev/null
@@ -1,447 +0,0 @@
----
-layout: api
-page_title: 'Identity Secret Backend: Entity - HTTP API'
-description: This is the API documentation for managing entities in the identity store.
----
-
-## Create an entity
-
-This endpoint creates or updates an Entity.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/identity/entity` |
-
-### Parameters
-
-- `name` `(string: entity-<UUID>)` – Name of the entity.
-
-- `id` `(string: <optional>)` - ID of the entity. If set, updates the
-  corresponding existing entity.
-
-- `metadata` `(key-value-map: {})` – Metadata to be associated with the
-  entity.
-
-- `policies` `(list of strings: [])` – Policies to be tied to the entity.
-
-- `disabled` `(bool: false)` – Whether the entity is disabled. Disabled
-  entities' associated tokens cannot be used, but are not revoked.
-
-### Sample payload
-
-```json
-{
-  "metadata": {
-    "organization": "hashicorp",
-    "team": "vault"
-  },
-  "policies": ["eng-dev", "infra-dev"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/entity
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "id": "8d6a45e5-572f-8f13-d226-cd0d1ec57297",
-    "aliases": null
-  }
-}
-```
-
-## Read entity by ID
-
-This endpoint queries the entity by its identifier.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/identity/entity/id/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Identifier of the entity.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/identity/entity/id/8d6a45e5-572f-8f13-d226-cd0d1ec57297
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "bucket_key_hash": "177553e4c58987f4cc5d7e530136c642",
-    "creation_time": "2017-07-25T20:29:22.614756844Z",
-    "disabled": false,
-    "id": "8d6a45e5-572f-8f13-d226-cd0d1ec57297",
-    "last_update_time": "2017-07-25T20:29:22.614756844Z",
-    "metadata": {
-      "organization": "hashicorp",
-      "team": "vault"
-    },
-    "name": "entity-c323de27-2ad2-5ded-dbf3-0c7ef98bc613",
-    "aliases": [],
-    "policies": ["eng-dev", "infra-dev"]
-  }
-}
-```
-
-## Update entity by ID
-
-This endpoint is used to update an existing entity.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/identity/entity/id/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Identifier of the entity.
-- `name` `(string: entity-<UUID>)` – Name of the entity.
-- `metadata` `(key-value-map: {})` – Metadata to be associated with the entity.
-- `policies` `(list of strings: [])` – Policies to be tied to the entity.
-- `disabled` `(bool: false)` – Whether the entity is disabled. Disabled
-  entities' associated tokens cannot be used, but are not revoked.
-
-### Sample payload
-
-```json
-{
-  "name": "updatedEntityName",
-  "metadata": {
-    "organization": "hashicorp",
-    "team": "nomad"
-  },
-  "policies": ["eng-developers", "infra-developers"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/entity/id/8d6a45e5-572f-8f13-d226-cd0d1ec57297
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "id": "8d6a45e5-572f-8f13-d226-cd0d1ec57297",
-    "aliases": null
-  }
-}
-```
-
-## Delete entity by ID
-
-This endpoint deletes an entity and all its associated aliases.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/identity/entity/id/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Identifier of the entity.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/entity/id/8d6a45e5-572f-8f13-d226-cd0d1ec57297
-```
-
-## Batch delete entities
-
-This endpoint deletes all entities provided.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `POST` | `/identity/entity/batch-delete` |
-
-### Parameters
-
-- `entity_ids` `([]string: <required>)` – List of entity identifiers to delete.
-
-### Sample payload
-
-```json
-{
-  "entity_ids": [
-    "02fe5a88-912b-6794-62ed-db873ef86a95",
-    "3bf81bc9-44df-8138-57f9-724a9ae36d04",
-    "627fba68-98c9-c012-71ba-bfb349585ce1",
-    "6c4c805b-b384-3d0e-4d51-44d349887b96",
-    "70a72feb-35d1-c775-0813-8efaa8b4b9b5",
-    "f1092a67-ce34-48fd-161d-c13a367bc1cd",
-    "faedd89a-0d82-c197-c8f9-93a3e6cf0cd0"
-  ]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/entity/batch-delete
-```
-
-## List entities by ID
-
-This endpoint returns a list of available entities by their identifiers.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `LIST` | `/identity/entity/id`           |
-| `GET`  | `/identity/entity/id?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/entity/id
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "02fe5a88-912b-6794-62ed-db873ef86a95",
-      "3bf81bc9-44df-8138-57f9-724a9ae36d04",
-      "627fba68-98c9-c012-71ba-bfb349585ce1",
-      "6c4c805b-b384-3d0e-4d51-44d349887b96",
-      "70a72feb-35d1-c775-0813-8efaa8b4b9b5",
-      "f1092a67-ce34-48fd-161d-c13a367bc1cd",
-      "faedd89a-0d82-c197-c8f9-93a3e6cf0cd0"
-    ]
-  }
-}
-```
-
-## Create/Update entity by name
-
-This endpoint is used to create or update an entity by a given name.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/identity/entity/name/:name` |
-
-### Parameters
-
-- `name` `(string: entity-<UUID>)` – Name of the entity.
-
-- `metadata` `(key-value-map: {})` – Metadata to be associated with the entity.
-
-- `policies` `(list of strings: [])` – Policies to be tied to the entity.
-
-- `disabled` `(bool: false)` – Whether the entity is disabled. Disabled
-  entities' associated tokens cannot be used, but are not revoked.
-
-### Sample payload
-
-```json
-{
-  "metadata": {
-    "organization": "hashicorp",
-    "team": "nomad"
-  },
-  "policies": ["eng-developers", "infra-developers"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/entity/name/testentityname
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "aliases": null,
-    "id": "0826be06-577c-a076-3942-2f92da0310ce"
-  }
-}
-```
-
-## Read entity by name
-
-This endpoint queries the entity by its name.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `GET`  | `/identity/entity/name/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the entity.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/identity/entity/name/testentityname
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "aliases": [],
-    "creation_time": "2018-09-19T17:20:27.705389973Z",
-    "direct_group_ids": [],
-    "disabled": false,
-    "group_ids": [],
-    "id": "0826be06-577c-a076-3942-2f92da0310ce",
-    "inherited_group_ids": [],
-    "last_update_time": "2018-09-19T17:20:27.705389973Z",
-    "merged_entity_ids": null,
-    "metadata": {
-      "organization": "hashicorp",
-      "team": "nomad"
-    },
-    "name": "testentityname",
-    "policies": ["eng-developers", "infra-developers"]
-  }
-}
-```
-
-## Delete entity by name
-
-This endpoint deletes an entity and all its associated aliases, given the
-entity name.
-
-| Method   | Path                          |
-| :------- | :---------------------------- |
-| `DELETE` | `/identity/entity/name/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the entity.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/entity/name/testentityname
-```
-
-## List entities by name
-
-This endpoint returns a list of available entities by their names.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `LIST` | `/identity/entity/name`           |
-| `GET`  | `/identity/entity/name?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/entity/name
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["testentityname"]
-  }
-}
-```
-
-## Merge entities
-
-This endpoint merges many entities into one entity. Additionally, all groups associated with `from_entity_ids` are merged with those of `to_entity_id`.
-Note that if these entities contain aliases sharing the same mount accessor, the merge will fail unless `conflicting_alias_ids_to_keep` is present, and
-entities must be merged one at a time. This is because each entity can only have one alias with each mount accessor - for more
-information, see the [identity concepts page](/vault/docs/concepts/identity).
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/identity/entity/merge` |
-
-### Parameters
-
-- `from_entity_ids` `(list of strings: <required>)` - Entity IDs which need to get
-  merged.
-
-- `to_entity_id` `(string: <required>)` - Entity ID into which all the other
-  entities need to get merged.
-
-- `force` `(bool: false)` - Setting this will follow the 'mine' strategy for
-  merging MFA secrets. If there are secrets of the same type both in entities
-  that are merged from and in entity into which all others are getting merged,
-  secrets in the destination will be unaltered. If not set, this API will throw
-  an error containing all the conflicts.
-
-- `conflicting_alias_ids_to_keep` `(list of strings: [])` - A list of entity
-  aliases to keep in the case where the to-Entity and from-Entity have aliases
-  with the same mount accessor. In the case where alias share mount accessors,
-  the alias ID given in this list will be kept or merged, and the other alias will be deleted.
-  Note that merges requiring this parameter must have only one from-Entity.
-
-### Sample payload
-
-```json
-{
-  "to_entity_id": "f2cdefbe-f510-a226-77fa-989a48ba6abc",
-  "from_entity_ids": [
-    "1ade80ec-ba5c-8eed-91e2-b9dcd41d6fff",
-    "270976d0-9bab-14a5-4b92-3861805ef73d"
-  ]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/entity/merge
-```
diff --git a/website/content/api-docs/secret/identity/group-alias.mdx b/website/content/api-docs/secret/identity/group-alias.mdx
deleted file mode 100644
index b4592eef478..00000000000
--- a/website/content/api-docs/secret/identity/group-alias.mdx
+++ /dev/null
@@ -1,196 +0,0 @@
----
-layout: api
-page_title: 'Identity Secret Backend: Group Alias - HTTP API'
-description: >-
-  This is the API documentation for managing the group aliases in the identity
-  store.
----
-
-## Create a group alias
-
-This endpoint creates or updates a group alias.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/identity/group-alias` |
-
-### Parameters
-
-- `name` `(string: entity-<UUID>)` – Name of the group alias.
-
-- `id` `(string: <optional>)` - ID of the group alias. If set, updates the
-  corresponding existing group alias.
-
-- `mount_accessor` `(string: "")` – Mount accessor which this alias belongs
-  to.
-
-- `canonical_id` `(string: "")` - ID of the group to which this is an alias.
-
-### Sample payload
-
-```json
-{
-  "canonical_id": "b86920ea-2831-00ff-15c5-a3f923f1ee3b",
-  "mount_accessor": "auth_github_232a90dc",
-  "name": "dev-team"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/group-alias
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "canonical_id": "b86920ea-2831-00ff-15c5-a3f923f1ee3b",
-    "id": "ca726050-d8ac-6f1f-4210-3b5c5b613824"
-  }
-}
-```
-
-## Update group alias by ID
-
-This endpoint is used to update an existing group alias.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/identity/group-alias/id/:id` |
-
-### Parameters
-
-- `id` `(string: <optional>)` - ID of the group alias.
-
-- `name` `(string: entity-<UUID>)` – Name of the group alias.
-
-- `mount_accessor` `(string: "")` – Mount accessor which this alias belongs
-  to.
-
-- `canonical_id` `(string: "")` - ID of the group to which this is an alias.
-
-### Sample payload
-
-```json
-{
-  "canonical_id": "b86920ea-2831-00ff-15c5-a3f923f1ee3b",
-  "mount_accessor": "auth_github_232a90dc",
-  "name": "dev-team"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/group-alias/id/ca726050-d8ac-6f1f-4210-3b5c5b613824
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "canonical_id": "b86920ea-2831-00ff-15c5-a3f923f1ee3b",
-    "id": "ca726050-d8ac-6f1f-4210-3b5c5b613824"
-  }
-}
-```
-
-## Read group alias by ID
-
-This endpoint queries the group alias by its identifier.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/identity/group-alias/id/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – ID of the group alias.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/identity/group-alias/id/ca726050-d8ac-6f1f-4210-3b5c5b613824
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "canonical_id": "b86920ea-2831-00ff-15c5-a3f923f1ee3b",
-    "creation_time": "2017-11-13T20:09:41.661694Z",
-    "id": "ca726050-d8ac-6f1f-4210-3b5c5b613824",
-    "last_update_time": "2017-11-13T20:09:41.661694Z",
-    "merged_from_canonical_ids": null,
-    "metadata": null,
-    "mount_accessor": "auth_github_232a90dc",
-    "mount_path": "",
-    "mount_type": "github",
-    "name": "dev-team"
-  }
-}
-```
-
-## Delete group alias by ID
-
-This endpoint deletes a group alias.
-
-| Method   | Path                           |
-| :------- | :----------------------------- |
-| `DELETE` | `/identity/group-alias/id/:id` |
-
-## Parameters
-
-- `id` `(string: <required>)` – ID of the group alias.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/group-alias/id/ca726050-d8ac-6f1f-4210-3b5c5b613824
-```
-
-## List group alias by ID
-
-This endpoint returns a list of available group aliases by their identifiers.
-
-| Method | Path                                 |
-| :----- | :----------------------------------- |
-| `LIST` | `/identity/group-alias/id`           |
-| `GET`  | `/identity/group-alias/id?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/group-alias/id
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["ca726050-d8ac-6f1f-4210-3b5c5b613824"]
-  }
-}
-```
diff --git a/website/content/api-docs/secret/identity/group.mdx b/website/content/api-docs/secret/identity/group.mdx
deleted file mode 100644
index abcd419059f..00000000000
--- a/website/content/api-docs/secret/identity/group.mdx
+++ /dev/null
@@ -1,385 +0,0 @@
----
-layout: api
-page_title: 'Identity Secret Backend: Group - HTTP API'
-description: This is the API documentation for managing groups in the identity store.
----
-
-~> **NOTE:** Be careful in granting permissions to non-readonly identity group
-endpoints. If a user can modify group membership, they can add their entity to
-a group with higher privileges.
-
-## Create a group
-
-This endpoint creates or updates a Group.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `POST` | `/identity/group` |
-
-### Parameters
-
-- `name` `(string: entity-<UUID>)` – Name of the group. If set (and
-  ID is not set), updates the corresponding existing group.
-
-- `id` `(string: <optional>)` - ID of the group. If set, updates the
-  corresponding existing group.
-
-- `type` `(string: "internal")` - Type of the group, `internal` or `external`.
-  Defaults to `internal`.
-
-- `metadata` `(key-value-map: {})` – Metadata to be associated with the
-  group.
-
-- `policies` `(list of strings: [])` – Policies to be tied to the group.
-
-- `member_group_ids` `(list of strings: [])` - Group IDs to be assigned as
-  group members.
-
-- `member_entity_ids` `(list of strings: [])` - Entity IDs to be assigned as
-  group members.
-
-### Sample payload
-
-```json
-{
-  "metadata": {
-    "hello": "world"
-  },
-  "policies": ["grouppolicy1", "grouppolicy2"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/group
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "id": "363926d8-dd8b-c9f0-21f8-7b248be80ce1",
-    "name": "group_ab813d63"
-  }
-}
-```
-
-## Read group by ID
-
-This endpoint queries the group by its identifier.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `GET`  | `/identity/group/id/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Identifier of the group.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/identity/group/id/363926d8-dd8b-c9f0-21f8-7b248be80ce1
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "alias": {},
-    "creation_time": "2017-11-13T19:36:47.102945Z",
-    "id": "363926d8-dd8b-c9f0-21f8-7b248be80ce1",
-    "last_update_time": "2017-11-13T19:36:47.102945Z",
-    "member_entity_ids": [],
-    "member_group_ids": null,
-    "metadata": {
-      "hello": "world"
-    },
-    "modify_index": 1,
-    "name": "group_ab813d63",
-    "policies": ["grouppolicy1", "grouppolicy2"],
-    "type": "internal"
-  }
-}
-```
-
-## Update group by ID
-
-This endpoint is used to update an existing group.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/identity/group/id/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Identifier of the entity.
-
-- `name` `(string: entity-<UUID>)` – Name of the group.
-
-- `type` `(string: "internal")` - Type of the group, `internal` or `external`.
-  Defaults to `internal`.
-
-- `metadata` `(key-value-map: {})` – Metadata to be associated with the
-  group.
-
-- `policies` `(list of strings: [])` – Policies to be tied to the group.
-
-- `member_group_ids` `(list of strings: [])` - Group IDs to be assigned as
-  group members.
-
-- `member_entity_ids` `(list of strings: [])` - Entity IDs to be assigned as
-  group members.
-
-### Sample payload
-
-```json
-{
-  "name": "testgroupname",
-  "metadata": {
-    "hello": "everyone"
-  },
-  "policies": ["grouppolicy2", "grouppolicy3"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/group/id/363926d8-dd8b-c9f0-21f8-7b248be80ce1
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "id": "363926d8-dd8b-c9f0-21f8-7b248be80ce1",
-    "name": "testgroupname"
-  }
-}
-```
-
-## Delete group by ID
-
-This endpoint deletes a group.
-
-| Method   | Path                     |
-| :------- | :----------------------- |
-| `DELETE` | `/identity/group/id/:id` |
-
-## Parameters
-
-- `id` `(string: <required>)` – Identifier of the group.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/group/id/363926d8-dd8b-c9f0-21f8-7b248be80ce1
-```
-
-## List groups by ID
-
-This endpoint returns a list of available groups by their identifiers.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `LIST` | `/identity/group/id`           |
-| `GET`  | `/identity/group/id?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/group/id
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "052567cf-1580-6f20-50c8-d38bc46dae6e",
-      "26da8035-6691-b89e-67ac-ebf9ea7f9893",
-      "363926d8-dd8b-c9f0-21f8-7b248be80ce1",
-      "5c4a5720-7408-c113-1dcc-9ede725d0ac8",
-      "d55e0f34-5c16-38ae-87af-324c9b656c43",
-      "e4e56e04-0dec-9b68-9b20-a450975d898e"
-    ]
-  }
-}
-```
-
-## Create/Update group by name
-
-This endpoint is used to create or update a group by its name.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/identity/group/name/:name` |
-
-### Parameters
-
-- `name` `(string: entity-<UUID>)` – Name of the group.
-
-- `type` `(string: "internal")` - Type of the group, `internal` or `external`.
-  Defaults to `internal`.
-
-- `metadata` `(key-value-map: {})` – Metadata to be associated with the
-  group.
-
-- `policies` `(list of strings: [])` – Policies to be tied to the group.
-
-- `member_group_ids` `(list of strings: [])` - Group IDs to be assigned as
-  group members.
-
-- `member_entity_ids` `(list of strings: [])` - Entity IDs to be assigned as
-  group members.
-
-### Sample payload
-
-```json
-{
-  "metadata": {
-    "hello": "everyone"
-  },
-  "policies": ["grouppolicy2", "grouppolicy3"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/group/name/testgroupname
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "b98b4a3d-a9f1-e151-11e1-ad91cfb08351",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "id": "5a3a04a0-0c3a-a4c3-74e8-26b1adbeaece",
-    "name": "testgroupname"
-  },
-  "warnings": null
-}
-```
-
-## Read group by name
-
-This endpoint queries the group by its name.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `GET`  | `/identity/group/name/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the group.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/identity/group/name/testgroupname
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "alias": {},
-    "creation_time": "2018-09-19T22:02:04.395128091Z",
-    "id": "5a3a04a0-0c3a-a4c3-74e8-26b1adbeaece",
-    "last_update_time": "2018-09-19T22:02:04.395128091Z",
-    "member_entity_ids": [],
-    "member_group_ids": null,
-    "metadata": {
-      "foo": "bar"
-    },
-    "modify_index": 1,
-    "name": "testgroupname",
-    "parent_group_ids": null,
-    "policies": ["grouppolicy1", "grouppolicy2"],
-    "type": "internal"
-  }
-}
-```
-
-## Delete group by name
-
-This endpoint deletes a group, given its name.
-
-| Method   | Path                         |
-| :------- | :--------------------------- |
-| `DELETE` | `/identity/group/name/:name` |
-
-## Parameters
-
-- `name` `(string: <required>)` – Name of the group.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/group/name/testgroupname
-```
-
-## List groups by name
-
-This endpoint returns a list of available groups by their names.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `LIST` | `/identity/group/name`           |
-| `GET`  | `/identity/group/name?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/group/name
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["testgroupname"]
-  }
-}
-```
diff --git a/website/content/api-docs/secret/identity/index.mdx b/website/content/api-docs/secret/identity/index.mdx
deleted file mode 100644
index e649db30ee4..00000000000
--- a/website/content/api-docs/secret/identity/index.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
----
-layout: api
-page_title: Identity - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault Identity secrets engine.
----
-
-# Identity secrets engine (API)
-
-This is the API documentation for the Vault Identity secrets engine. For general
-information about the usage and operation of the Identity secrets engine, please
-see the [Vault Identity documentation](/vault/docs/secrets/identity).
-
-## API sections
-
-- [Entity](/vault/api-docs/secret/identity/entity)
-- [Entity Alias](/vault/api-docs/secret/identity/entity-alias)
-- [Group](/vault/api-docs/secret/identity/group)
-- [Group Alias](/vault/api-docs/secret/identity/group-alias)
-- [Identity Tokens](/vault/api-docs/secret/identity/tokens)
-- [Lookup](/vault/api-docs/secret/identity/lookup)
-- [OIDC Provider](/vault/api-docs/secret/identity/oidc-provider)
-- [MFA](/vault/api-docs/secret/identity/mfa)
diff --git a/website/content/api-docs/secret/identity/lookup.mdx b/website/content/api-docs/secret/identity/lookup.mdx
deleted file mode 100644
index 5bcb00efe8a..00000000000
--- a/website/content/api-docs/secret/identity/lookup.mdx
+++ /dev/null
@@ -1,131 +0,0 @@
----
-layout: api
-page_title: 'Identity Secret Backend: Lookup - HTTP API'
-description: |-
-  This is the API documentation for entity and group lookups from identity
-  store.
----
-
-## Lookup an entity
-
-This endpoint looks up an entity based on the given criteria. The criteria can
-be `name`, `id`, `alias_id`, or a combination of `alias_name` and
-`alias_mount_accessor`.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/identity/lookup/entity` |
-
-### Parameters
-
-- `name` `(string: "")` – Name of the entity.
-
-- `id` `(string: "")` - ID of the entity.
-
-- `alias_id` `(string: "")` - ID of the alias.
-
-- `alias_name` `(string: "")` - Name of the alias. This should be supplied in
-  conjunction with `alias_mount_accessor`.
-
-- `alias_mount_accessor` `(string: "")` - Accessor of the mount to which the
-  alias belongs to. This should be supplied in conjunction with `alias_name`.
-
-### Sample payload
-
-```json
-{
-  "id": "043fedec-967d-b2c9-d3af-0c467b04e1fd"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/lookup/entity
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "aliases": [],
-    "creation_time": "2017-11-13T21:01:33.543497Z",
-    "direct_group_ids": [],
-    "group_ids": [],
-    "id": "043fedec-967d-b2c9-d3af-0c467b04e1fd",
-    "inherited_group_ids": [],
-    "last_update_time": "2017-11-13T21:01:33.543497Z",
-    "merged_entity_ids": null,
-    "metadata": null,
-    "name": "entity_43cc451b",
-    "policies": null
-  }
-}
-```
-
-## Lookup a group
-
-This endpoint looks up a group based on the given criteria. The criteria can
-be `name`, `id`, `alias_id`, or a combination of `alias_name` and
-`alias_mount_accessor`.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/identity/lookup/group` |
-
-### Parameters
-
-- `name` `(string: "")` – Name of the group.
-
-- `id` `(string: "")` - ID of the group.
-
-- `alias_id` `(string: "")` - ID of the alias.
-
-- `alias_name` `(string: "")` - Name of the alias. This should be supplied in
-  conjunction with `alias_mount_accessor`.
-
-- `alias_mount_accessor` `(string: "")` - Accessor of the mount to which the
-  alias belongs to. This should be supplied in conjunction with `alias_name`.
-
-### Sample payload
-
-```json
-{
-  "id": "70a4bdef-9da3-4460-b524-bb08542eef25"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/lookup/group
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "alias": {},
-    "creation_time": "2017-11-13T21:06:44.475587Z",
-    "id": "70a4bdef-9da3-4460-b524-bb08542eef25",
-    "last_update_time": "2017-11-13T21:06:44.475587Z",
-    "member_entity_ids": [],
-    "member_group_ids": null,
-    "metadata": null,
-    "modify_index": 1,
-    "name": "group_eaf2aab1",
-    "policies": null,
-    "type": "internal"
-  }
-}
-```
diff --git a/website/content/api-docs/secret/identity/mfa/duo.mdx b/website/content/api-docs/secret/identity/mfa/duo.mdx
deleted file mode 100644
index 831c2eea60e..00000000000
--- a/website/content/api-docs/secret/identity/mfa/duo.mdx
+++ /dev/null
@@ -1,180 +0,0 @@
----
-layout: api
-page_title: /identity/mfa/method/duo - HTTP API
-description: >-
-  The '/identity/mfa/method/duo' endpoint focuses on managing Duo MFA behaviors in Vault.
----
-
-## Create Duo MFA method
-
-This endpoint creates a new MFA method of type Duo.
-
-| Method | Path                       |
-|:-------|:---------------------------|
-| `POST` | `/identity/mfa/method/duo` |
-
-### Parameters
-
-- `method_name` `(string)` - The unique name identifier for this MFA method. Supported from Vault 1.13.0.
-
-- `username_format` `(string)` - A template string for mapping Identity names to MFA methods. Values to substitute should be placed in `{{}}`. For example, `"{{identity.entity.name}}"`. If blank, the Entity's Name field is used as-is.
-
-- `secret_key` `(string: <required>)` - Secret key for Duo.
-
-- `integration_key` `(string: <required>)` - Integration key for Duo.
-
-- `api_hostname` `(string: <required>)` - API hostname for Duo.
-
-- `push_info` `(string)` - Push information for Duo.
-
-- `use_passcode` `(bool: false)` - If true, the user is reminded to use the passcode upon MFA validation.
-
-### Sample payload
-
-```json
-{
-  "username_format": "{{identity.entity.aliases.auth_userpass_1793464a.name}}",
-  "secret_key": "BIACEUEAXI20BNWTEYXT",
-  "integration_key": "8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz",
-  "api_hostname": "api-2b5c39f5.duosecurity.com",
-  "method_name": "ns1_duo"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/method/duo
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "method_id": "0888fd69-4ea2-91d7-415e-c4bba548529b"
-  }
-}
-```
-
-## Update Duo MFA method
-
-This endpoint updates the configuration of an MFA method of type Duo.
-
-| Method | Path                                  |
-|:-------|:--------------------------------------|
-| `POST` | `/identity/mfa/method/duo/:method_id` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` - UUID of the MFA method.
-
-- and all of the parameters documented under the preceding "Create" endpoint.
-
-### Sample payload
-
-Identical to the preceding "Create" endpoint.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/method/duo/4194659f-139b-400b-b5dd-86bfb726759d
-```
-
-## Read Duo MFA method
-
-This endpoint queries the MFA configuration of Duo type for a given method
-ID.
-
-| Method | Path                                  |
-|:-------|:--------------------------------------|
-| `GET`  | `/identity/mfa/method/duo/:method_id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – UUID of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/mfa/method/duo/4194659f-139b-400b-b5dd-86bfb726759d
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "api_hostname": "api-2b5c39f5.duosecurity.com",
-    "id": "4194659f-139b-400b-b5dd-86bfb726759d",
-    "integration_key": "BIACEUEAXI20BNWTEYXT",
-    "pushinfo": "",
-    "secret_key": "8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz",
-    "type": "duo",
-    "username_format": "{{identity.entity.aliases.auth_userpass_1793464a.name}}",
-    "use_passcode": false
-  }
-}
-```
-
-## Delete Duo MFA method
-
-This endpoint deletes a Duo MFA method. MFA methods can only be deleted if they're not currently in use
-by a [login enforcement](/vault/api-docs/secret/identity/mfa/login-enforcement).
-
-| Method   | Path                                  |
-|:---------|:--------------------------------------|
-| `DELETE` | `/identity/mfa/method/duo/:method_id` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` - UUID of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/mfa/method/duo/4194659f-139b-400b-b5dd-86bfb726759d
-```
-
-## List Duo MFA methods
-
-This endpoint lists Duo MFA methods that are visible in the current namespace or in parent namespaces.
-
-| Method | Path                       |
-|:-------|:---------------------------|
-| `LIST` | `/identity/mfa/method/duo` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/mfa/method/duo
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "4194659f-139b-400b-b5dd-86bfb726759d"
-    ]
-  }
-}
-```
diff --git a/website/content/api-docs/secret/identity/mfa/index.mdx b/website/content/api-docs/secret/identity/mfa/index.mdx
deleted file mode 100644
index 39923c3e195..00000000000
--- a/website/content/api-docs/secret/identity/mfa/index.mdx
+++ /dev/null
@@ -1,27 +0,0 @@
----
-layout: api
-page_title: /identity/mfa - HTTP API
-description: >-
-  The '/identity/mfa' endpoint focuses on managing login MFA behaviors in Vault.
----
-
-# `/identity/mfa`
-
-## Supported MFA types.
-
-- [TOTP](/vault/api-docs/secret/identity/mfa/totp)
-
-- [Okta](/vault/api-docs/secret/identity/mfa/okta)
-
-- [Duo](/vault/api-docs/secret/identity/mfa/duo)
-
-- [PingID](/vault/api-docs/secret/identity/mfa/pingid)
-
-## Other
-
-- [Login Enforcement](/vault/api-docs/secret/identity/mfa/login-enforcement)
-- [MFA Validate](/vault/api-docs/system/mfa/validate)
-
-While the above endpoints are available in all editions of Vault,
-they are namespace aware. MFA methods and login enforcements created in one namespace are separate from other
-namespaces. In the community version of Vault, everything operates in the root namespace.
diff --git a/website/content/api-docs/secret/identity/mfa/login-enforcement.mdx b/website/content/api-docs/secret/identity/mfa/login-enforcement.mdx
deleted file mode 100644
index a122403666d..00000000000
--- a/website/content/api-docs/secret/identity/mfa/login-enforcement.mdx
+++ /dev/null
@@ -1,153 +0,0 @@
----
-layout: api
-page_title: /identity/mfa/login-enforcement - HTTP API
-description: >-
-  The '/identity/mfa/login-enforcement' endpoint focuses on specifying which MFA methods should be used
-  when logging in.
----
-
-## Create a login enforcement
-
-This endpoint creates or updates a login enforcement that specifies which MFA methods should be used when logging into
-Vault. If there are multiple login enforcements, each one needs to be satisfied before a login attempt  succeeds.
-
-| Method | Path                                    |
-| :----- |:----------------------------------------|
-| `POST` | `/identity/mfa/login-enforcement/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name for this login enforcement configuration.
-
-- `mfa_method_ids` `([]string: <required>)` - Array of MFA method UUIDs to use. These will be ORed together, meaning
-if several IDs are specified, any one of them is sufficient to login.
-
-- `auth_method_accessors` `([]string: [])` - Array of auth mount accessor IDs. If present, only auth methods
-corresponding to the given accessors are checked during login.
-
-- `auth_method_types` `([]string: [])` - Array of auth method types. If present, only auth methods
-corresponding to the given types are checked during login.
-
-- `identity_group_ids` `([]string: [])` - Array of identity group IDs. If present, only entities belonging
-to one of the given groups are checked during login. Note that these IDs can be from the current namespace or
-a child namespace.
-
-- `identity_entity_ids` `([]string: [])` - Array of identity entity IDs. If present, only entities with the given
-IDs are checked during login. Note that these IDs can be from the current namespace or a child namespace.
-
-Note that while none of `auth_method_accessors`, `auth_method_types`, `identity_group_ids`, or `identity_entity_ids` is
-individually required, at least one of those four fields must be present to create a login enforcement.
-
-### Sample payload
-
-```json
-{
-  "mfa_method_ids": ["134f7ce9-feae-4c6c-9ed7-ab3e413dbfce"],
-  "auth_method_accessors": ["auth_userpass_337fdb6a"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/login-enforcement/foo
-```
-
-## Read login enforcement
-
-This endpoint reads the login enforcement configuration for a given name.
-
-| Method | Path                                    |
-| :----- |:----------------------------------------|
-| `GET`  | `/identity/mfa/login-enforcement/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the login enforcement.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/mfa/login-enforcement/foo
-
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "auth_method_accessors": [
-      "auth_userpass_337fdb6a"
-    ],
-    "auth_method_types": [],
-    "id": "24167a6c-759a-c596-6d48-391c89c4befc",
-    "identity_entity_ids": [],
-    "identity_group_ids": [],
-    "mfa_method_ids": [
-      "c1372abf-bf64-1f26-c2a4-cbcfa135b775"
-    ],
-    "name": "foo",
-    "namespace_id": "root"
-  }
-}
-```
-
-## Delete login enforcement
-
-This endpoint deletes a login enforcement configuration by the given name.
-
-| Method   | Path                                    |
-| :------- |:----------------------------------------|
-| `DELETE` | `/identity/mfa/login-enforcement/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the login enforcement.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/mfa/login-enforcement/foo
-
-```
-
-## List login enforcements
-
-This endpoint lists login enforcements that are visible in the current namespace or in parent namespaces.
-
-| Method | Path                              |
-|:-------|:----------------------------------|
-| `LIST` | `/identity/mfa/login-enforcement` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/mfa/login-enforcement
-
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "foo"
-    ]
-  }
-}
-```
diff --git a/website/content/api-docs/secret/identity/mfa/okta.mdx b/website/content/api-docs/secret/identity/mfa/okta.mdx
deleted file mode 100644
index 7aac74a25a9..00000000000
--- a/website/content/api-docs/secret/identity/mfa/okta.mdx
+++ /dev/null
@@ -1,174 +0,0 @@
----
-layout: api
-page_title: /identity/mfa/method/okta - HTTP API
-description: >-
-  The '/identity/mfa/method/okta' endpoint focuses on managing Okta MFA behaviors in Vault.
----
-
-## Create okta MFA method
-
-This endpoint creates a new MFA method of type Okta.
-
-| Method | Path                        |
-|:-------|:----------------------------|
-| `POST` | `/identity/mfa/method/okta` |
-
-### Parameters
-
-- `method_name` `(string)` - The unique name identifier for this MFA method. Supported from Vault 1.13.0.
-
-- `username_format` `(string)` - A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`. For example, `"{{identity.entity.name}}@example.com"`. If blank, the Entity's Name field is used as-is.
-
-- `org_name` `(string: <required>)` - Name of the organization to be used in the Okta API.
-
-- `api_token` `(string: <required>)` - Okta API key.
-
-- `base_url` `(string)` - If set, will be used as the base domain for API requests. Examples are okta.com, oktapreview.com, and okta-emea.com.
-
-- `primary_email` `(bool: false)` - If set, the username will only match the primary email for the account.
-
-### Sample payload
-
-```json
-{
-  "username_format": "{{identity.entity.aliases.auth_userpass_1793464a.name}}",
-  "org_name": "dev-262778",
-  "api_token": "0081u7KrReNkzmABZJAP2oDyIXccveqx9vIOEyCZDC"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/method/okta
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "method_id": "0888fd69-4ea2-91d7-415e-c4bba548529b"
-  }
-}
-```
-
-## Update okta MFA method
-
-This endpoint updates the configuration of an MFA method of type Okta.
-
-| Method | Path                                   |
-|:-------|:---------------------------------------|
-| `POST` | `/identity/mfa/method/okta/:method_id` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` - UUID of the MFA method.
-
-- and all of the parameters documented under the preceding "Create" endpoint.
-
-### Sample payload
-
-Identical to the preceding "Create" endpoint.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/method/okta/1db034b5-81f1-4a2b-8c2b-0f51ed0bd9fc
-```
-
-## Read okta MFA method
-
-This endpoint queries the MFA configuration of Okta type for a given method
-name.
-
-| Method | Path                                   |
-|:-------|:---------------------------------------|
-| `GET`  | `/identity/mfa/method/okta/:method_id` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` – UUID of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/mfa/method/okta/1db034b5-81f1-4a2b-8c2b-0f51ed0bd9fc
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "api_token": "0081u7KrReNkzmABZJAP2oDyIXccveqx9vIOEyCZDC",
-    "id": "1db034b5-81f1-4a2b-8c2b-0f51ed0bd9fc",
-    "name": "my_okta",
-    "org_name": "dev-262778",
-    "type": "okta",
-    "username_format": "{{identity.entity.aliases.auth_userpass_1793464a.name}}"
-  }
-}
-```
-
-## Delete okta MFA method
-
-This endpoint deletes a Okta MFA method. The MFA methods can only be deleted if they're not currently in use
-by a [login enforcement](/vault/api-docs/secret/identity/mfa/login-enforcement).
-
-| Method   | Path                                   |
-|:---------|:---------------------------------------|
-| `DELETE` | `/identity/mfa/method/okta/:method_id` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` - UUID of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/mfa/method/okta/1db034b5-81f1-4a2b-8c2b-0f51ed0bd9fc
-```
-
-## List okta MFA methods
-
-This endpoint lists Okta MFA methods that are visible in the current namespace or in parent namespaces.
-
-| Method | Path                        |
-|:-------|:----------------------------|
-| `LIST` | `/identity/mfa/method/okta` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/mfa/method/okta
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "1db034b5-81f1-4a2b-8c2b-0f51ed0bd9fc"
-    ]
-  }
-}
-```
diff --git a/website/content/api-docs/secret/identity/mfa/pingid.mdx b/website/content/api-docs/secret/identity/mfa/pingid.mdx
deleted file mode 100644
index 18b2061328b..00000000000
--- a/website/content/api-docs/secret/identity/mfa/pingid.mdx
+++ /dev/null
@@ -1,158 +0,0 @@
----
-layout: api
-page_title: /identity/mfa/method/pingid - HTTP API
-description: >-
-  The '/identity/mfa/method/pingid' endpoint focuses on managing PingID MFA behaviors in Vault.
----
-
-## Create PingID MFA method
-
-This endpoint creates an MFA method of type PingID.
-
-| Method | Path                          |
-|:-------|:------------------------------|
-| `POST` | `/identity/mfa/method/pingid` |
-
-### Parameters
-
-- `method_name` `(string)` - The unique name identifier for this MFA method. Supported from Vault 1.13.0.
-
-- `username_format` `(string)` - A template string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`. For example, `"{{identity.entity.name}}@example.com"`. If blank, the Entity's Name field is used as-is.
-
-- `settings_file_base64` `(string: <required>)` - A base64-encoded third-party settings file retrieved from PingID's configuration page.
-
-### Sample payload
-
-```json
-{
-  "username_format": "{{identity.entity.aliases.auth_userpass_1793464a.name}}",
-  "settings_file_base64": "AA8owj3..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/method/pingid
-```
-
-## Update PingID MFA method
-
-This endpoint updates the configuration of an MFA method of type PingID.
-
-| Method | Path                                     |
-|:-------|:-----------------------------------------|
-| `POST` | `/identity/mfa/method/pingid/:method_id` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` - UUID of the MFA method.
-
-- and all of the parameters documented under the preceding "Create" endpoint.
-
-### Sample payload
-
-Identical to the preceding "Create" endpoint.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/method/pingid/f8381105-67f0-4105-8662-4b07ae5c1233
-```
-
-## Read PingID MFA method
-
-This endpoint queries the MFA configuration of PingID type for a given method
-name.
-
-| Method | Path                              |
-|:-------|:----------------------------------|
-| `GET`  | `/identity/mfa/method/pingid/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – UUID of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/mfa/method/pingid/f8381105-67f0-4105-8662-4b07ae5c1233
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "use_signature": true,
-    "idp_url": "https://idpxnyl3m.pingidentity.com/pingid",
-    "admin_url": "https://idpxnyl3m.pingidentity.com/pingid",
-    "authenticator_url": "https://authenticator.pingone.com/pingid/ppm",
-    "id": "f8381105-67f0-4105-8662-4b07ae5c1233",
-    "org_alias": "181459b0-9fb1-4938-8c86...",
-    "type": "pingid",
-  }
-}
-```
-
-## Delete PingID MFA method
-
-This endpoint deletes a PingID MFA method. MFA methods can only be deleted if they're not currently in use
-by a [login enforcement](/vault/api-docs/secret/identity/mfa/login-enforcement).
-
-| Method   | Path                              |
-|:---------|:----------------------------------|
-| `DELETE` | `/identity/mfa/method/pingid/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` - UUID of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/mfa/method/pingid/f8381105-67f0-4105-8662-4b07ae5c1233
-```
-
-## List PingID MFA methods
-
-This endpoint lists PingID MFA methods that are visible in the current namespace or in parent namespaces.
-
-| Method | Path                          |
-|:-------|:------------------------------|
-| `LIST` | `/identity/mfa/method/pingid` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/mfa/method/pingid
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "f8381105-67f0-4105-8662-4b07ae5c1233"
-    ]
-  }
-}
-```
diff --git a/website/content/api-docs/secret/identity/mfa/totp.mdx b/website/content/api-docs/secret/identity/mfa/totp.mdx
deleted file mode 100644
index 411946c598f..00000000000
--- a/website/content/api-docs/secret/identity/mfa/totp.mdx
+++ /dev/null
@@ -1,302 +0,0 @@
----
-layout: api
-page_title: /identity/mfa/method/totp - HTTP API
-description: >-
-  The '/identity/mfa/method/totp' endpoint focuses on managing TOTP MFA behaviors in Vault.
----
-
-## Create TOTP MFA method
-
-This endpoint creates an MFA method of type TOTP.
-
-| Method | Path                        |
-|:-------|:----------------------------|
-| `POST` | `/identity/mfa/method/totp` |
-
-### Parameters
-
-- `method_name` `(string)` - The unique name identifier for this MFA method. Supported from Vault 1.13.0.
-
-- `issuer` `(string: <required>)` - The name of the key's issuing organization.
-
-- `period` `(int or duration format string: 30)` - The length of time used to generate a counter for the TOTP token calculation.
-
-- `key_size` `(int: 20)` – Specifies the size in bytes of the generated key.
-
-- `qr_size` `(int: 200)` - The pixel size of the generated square QR code.
-
-- `algorithm` `(string: "SHA1")` – Specifies the hashing algorithm used to generate the TOTP code. Options include "SHA1", "SHA256" and "SHA512".
-
-- `digits` `(int: 6)` - The number of digits in the generated TOTP token. This value can either be 6 or 8.
-
-- `skew` `(int: 1)` - The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.
-
-- `max_validation_attempts` `(int: 5)` - The maximum number of consecutive failed validation attempts.
-
-### Sample payload
-
-```json
-{
-  "issuer": "vault"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/method/totp
-```
-
-## Update TOTP MFA method
-
-This endpoint updates the configuration of an MFA method of type TOTP.
-
-| Method | Path                                   |
-|:-------|:---------------------------------------|
-| `POST` | `/identity/mfa/method/totp/:method_id` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` - UUID of the MFA method.
-
-- and all of the parameters documented under the preceding "Create" endpoint.
-
-### Sample payload
-
-Identical to the preceding "Create" endpoint.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/method/totp/1f36d4cf-52c9-475d-a5cd-49c573c54e55
-```
-
-## Read TOTP MFA method
-
-This endpoint queries the MFA configuration of TOTP type for a given method
-ID.
-
-| Method | Path                                   |
-|:-------|:---------------------------------------|
-| `GET`  | `/identity/mfa/method/totp/:method_id` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` – UUID of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/mfa/method/totp/4c6b1968-b385-4c46-ac5e-9b74e7b206be
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "algorithm": "SHA1",
-    "digits": 6,
-    "id": "4c6b1968-b385-4c46-ac5e-9b74e7b206be",
-    "issuer": "vault",
-    "key_size": 20,
-    "period": 30,
-    "qr_size": 200,
-    "skew": 1,
-    "type": "totp",
-    "namespace": ""
-  }
-}
-```
-
-## Delete TOTP MFA method
-
-This endpoint deletes a TOTP MFA method.  MFA methods can only be deleted if they're not currently in use
-by a [login enforcement](/vault/api-docs/secret/identity/mfa/login-enforcement).
-
-| Method   | Path                                   |
-|:---------|:---------------------------------------|
-| `DELETE` | `/identity/mfa/method/totp/:method_id` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` - UUID of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/mfa/method/totp/4c6b1968-b385-4c46-ac5e-9b74e7b206be
-```
-
-## List TOTP MFA methods
-
-This endpoint lists TOTP MFA methods that are visible in the current namespace or in parent namespaces.
-
-| Method | Path                        |
-|:-------|:----------------------------|
-| `LIST` | `/identity/mfa/method/totp` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/mfa/method/totp
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "1f36d4cf-52c9-475d-a5cd-49c573c54e55",
-      "4c6b1968-b385-4c46-ac5e-9b74e7b206be"
-    ]
-  }
-}
-```
-
-## Generate a TOTP MFA secret
-
-This endpoint generates an MFA secret in the entity of the calling token, if it
-doesn't exist already, using the configuration stored under the given MFA
-method ID.
-
-| Method | Path                                 |
-|:-------|:-------------------------------------|
-| `POST` | `/identity/mfa/method/totp/generate` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` - UUID of the MFA method.
-
-### Sample payload
-
-```json
-{
-  "method_id": "1f36d4cf-52c9-475d-a5cd-49c573c54e55"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/method/totp/generate
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "barcode": "iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BAAAGc0lEQVR4nOyd244bOQxEZxbz/7+cRQI4sLWiyCLlTU1wzkMAu1uXTIGSxUv3148fH2DEP396AvDK189/Pj97jR/W9Wi/fs7uz/pZya5H92dk40fzjeY1+XtiIWYgiBkIYsbX84dba7O6B0z3hmgPqO5Z6/WsH3VvynjuDwsxA0HMQBAzvnZfZueI6Pvs93r2+z6ax7qWZ+2zPSP7PutfPW8of08sxAwEMQNBzNjuISqRLyc7X6jnkex8UPVBqXtJxk2PORZiBoKYgSBmXNlDsriIeq6J+umeG1RfVjav7L4JWIgZCGIGgpix3UO6a6MaU4/OD9Fnda2P2qnxl2ge1fbKOFiIGQhiBoKY8bKHdH052V5Q3VPUz9n42XhR++zzStWXVgELMQNBzEAQM37tIbd9MtX4Qvc8EI13q32210Sfb8wHCzEDQcxAEDM+f6532e/86nmiPYk31X2sZP1Pz0PVGP+pPRZiBoKYgSBmbPeQ/9xUvP6geg7p9leNj3RrH7v1K+reRm7vNwBBzEAQM471IVmt3oN31V9E93Xr3KNx1BrD7t+jMl8sxAwEMQNBzDjm9lZj5d04gZoLHPX3rjjFu3J5T/8/LMQMBDEDQcyQ6kPUHNsH1TU+Gi/qr+rLmo6zfq6eTzr9YiFmIIgZCGLG5/M69y5fzfr9Ol613bQ/NaYe9bui5gKczmNYiBkIYgaCmHF85mK01t2KO2Q1h9l43dzgbhxG7b+zZ2EhZiCIGQhiRuvZ77dygNVY+3q9es5Qv1+vT2sIlb0OCzEDQcxAEDMkX1bXN7S2z8brxl2q40b3rXR9bxn4sr4RCGIGgpjxUh8S0a2feFdNYrd/Ndad9Xsrpv/cHgsxA0HMQBAzPk/reXdN7fqA3ln/PZnndE9SxsFCzEAQMxDEjJd4iJqrqtYiPlBr9qZE81znk7V/F8TUjUEQMxDEjO1ze9U1PqtFzO5X87VW1H6i+XXqyneQl/UXgSBmIIgZpdzebgxdPWdMfVnr/dHn23XsWb18VpP4DBZiBoKYgSBmbPOyukzr2Lvnlu781FzkaF7deezAQsxAEDMQxIxjTP33TcN8JpXqOOp9qg8tm586n8qehYWYgSBmIIgZrfcYZvGPW2tztZ0aj8nGzb7Prnfr5z+wED8QxAwEMaP0PvVpzV63zru6pld//6t7SvRZzXmO5rPrBwsxA0HMQBAzpGeddH08WT/VNTv6vZ/NJxp/Wh8S9ZvN5/T/x0LMQBAzEMSMY0y9mpdV3YPU+pNsnGm+1v9dyxhBjaExCGIGgpixPYdUzwUdf/8JNV+qu3dE/aj9Z/Un0XzWcTiHGIMgZiCIGaX3qf+++fLe0f0dP83FVfO0VNS9jXOIMQhiBoKY8esc0vUBqb4ttY49Q13js/uzPKsuSr4XFmIGgpiBIGaM8rKmz0bJxo36nZ5Xov6zcbvnFqWWEQsxA0HMQBAzSs9cXKneH8ULpnUV0/lle0Y3DqOOv2uPhZiBIGYgiBnbOvVunfdKNyf2to9L9UV1Y/Tr/ep5iXiIIQhiBoKYcczLys4P1b2lGwNf23dr99Q8rqnvrOvr+sBC/EAQMxDEjG1M/UHXFxWhxAUq31evd5nmjWU+MvKyvgEIYgaCmLF9F+7Ul7TSrbdQzw/qeOv9K7f+v0o7LMQMBDEDQcw4vj8kYlpf3vUFZe2jeVbbVX1Y1fE6eyAWYgaCmIEgZmyfdVL9XT7NAb5F9xyh7n3Tc1IlToKFmIEgZiCIGaV3UHXrv6P23fyubj1K1l80zwg17yq6vhsfCzE DQcxAEDOOz+2troUZaq1hNP40lr/eP61TicbP5nO6joWYgSBmIIgZx7ysiNu+ruj6dB5q7D4ii5Oo82EP+UYgiBkIYob0/pCV2/Uda7/TunX1PJHNq9qvGvN/HgcLMQNBzEAQM1p5WdM6kI mv5zReNo9uvtet+WTz+sBC/EAQMxDEjO0zF99dA9it+6jOM7qe+dKqde7V/qP5nP5eWIgZCGIGgpix3UNUbsXkq/Xd2Thd35zqE5v66Hb9YCFmIIgZCGLGlT3kwS1fUbcGsVq3HvUXnY/U+ ExEZW/DQsxAEDMQxIzS+0Mybq3REd1c3ur5qBs7z/a4zjNWsBAzEMQMBDHjZQ+Z+oAeqGv42o9aq5j1m5HN51ZdfWX+WIgZCGIGgpixfX8I/DmwEDP+DQAA//9kwGH4xZewMgAAAABJRU5E rkJggg==",
-    "url": "otpauth://totp/vault:4746fb81-028c-cd4e-026b-7dd18fe4c2f4?algorithm=SHA1&digits=6&issuer=vault&period=30&secret=XVE7TOZWJVEWQOATOD7 U53IEAJG72Z2I"
-  }
-}
-```
-
-## Administratively generate a TOTP MFA secret
-
-This endpoint can be used to generate a TOTP MFA secret. Unlike the `generate`
-API which stores the generated secret on the entity ID of the calling token,
-the `admin-generate` API stores the generated secret on the given entity ID.
-
-| Method | Path                                       |
-|:-------|:-------------------------------------------|
-| `POST` | `/identity/mfa/method/totp/admin-generate` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` - UUID of the MFA method.
-
-- `entity_id` `(string: <required>)` - Entity ID on which the generated secret
-  needs to get stored.
-
-### Sample payload
-
-```json
-{
-  "method_id": "4746fb81-028c-cd4e-026b-7dd18fe4c2f4",
-  "entity_id": "9189f7fd-e3f5-436b-a835-cb14864b1e01"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/identity/mfa/method/totp/admin-generate
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "barcode": "iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BAAAGZElEQVR4nOyd7W4jNwxFkyLv/8pbpMAAHnUo8pJyc1Oc82OB2KOP9QVFSyTlrz9/PsCIv356AnDn6/ufz89e48i6ov6u59f319ezfqtWnf2/snHX19XnVL7bYyFmIIgZCGLG5/e61V2b37WWXkRr9+lxonEvqv1XfeHK6/NYiBkIYgaCmPH19GK2j4ieX9/P9h0R2T6l+pzqYzKfmM0zQvk8sRAzEMQMBDHj0YdMqa6Z1TOvyDdF/VTPnqLnVzIfePLEHAsxA0HMQBAz3uJDqvuVbO1Vv/934yzReNV4ykmwEDMQxAwEMePRh5xeG6fxjNXnVM+Y1HHVM7Tq56R8nliIGQhiBoKYcfMhp2LT6hp7UY2hV8dTY/KZT1N9SufzxELMQBAzEMSMf3zI6X2HembUXbuz8dT9g+qLIiafJxZiBoKYgSBm3OpDunlMartTubrdeEUWI1dzAqa5wK9gIWYgiBkIYsaReIi6P1jbqd/7qznDqm9SfcKJs6sVLMQMBDEDQcz43K3z3fqLaf336fiFymQf8dRe8aVYiBkIYgaCmHHzIdW8pGo8QT1rOuULTvkc9a6TqD+lTgULMQNBzEAQMx7jIRdqjV7ULvpbrReJxl/nodYodseLxu/GWz6wED8QxAwEMeN2X9ZK9/4neRLDNfrUc919yPp8t/8PLMQPBDEDQcyQ6tTVO0JWqvGT6PWu75jub6L+T/kg4iHGIIgZCGLGKB5yKn5SpVuDWKXrI0/4jgssxAwEMQNBzNieZWV0v/erZ0Knxp3OYxoXqoyPhZiBIGYgiBmPub1q7m7G6fiB2n+3niSbZwT7kP8RCGIGgpjxeF9W5iPU8/+ofUY1r6q6ZkfzmtbJV2skozw04iHGIIgZCGKGlJeVvZ61V+MX07OiqJ9oftE41fGm9TD4EEMQxAwEMaN010lW1zGNoVfX+OrZl/rcfx0P2c0XCzEDQcxAEDMe87K68YBubH7tdxonmcb0q+2qZ2DK/gkLMQNBzEAQM2516lXUs6GIbA3v+qruPinrX/Ud0Xx288JCzEAQMxDEjG2NYXf/odztsXuuEoOu9BO93933RONm86n0h4WYgSBmIIgZt9+gqtaDq7m3K2rObnc+UT/Z36f2MZ28MCzEDAQxA0HMaJ1lTevBo/5OxRsysv1O9Fx1nO4Z3QcW4geCmIEgZki/H1Klu+Z369PVeVXHexfEQ34RCGIGgpjxWGN40c1VXdtXaxW79SLTOvqonVpDqdavkNv7C0AQMxDEjNK9vdP4gFq3ntV1Z+NEf099ZEZ1vrv+sBAzEMQMBDFjW2PYjT9U4xqqT1D7/ak4j5rn9QoWYgaCmIEgZpTu7e2u5Vk/4aQO3XFSHUc9s1rnNfVdr/1hIWYgiBkIYsZtH6LGA9Z20d8Z3fuq1HyqUznC1fZVX0c8xBgEMQNBzNje2xvxrlzYan1K1H82fjXOUfU12XzW5yufBxZiBoKYgSBmSL+FezE9s1lR9yHq2VvUT7fefOpjd58fFmIGgpiBIGZId52sr6u5u9M7RtTn1Hmr8ZzqnSvK2R4WYgaCmIEgZmzjIdHr3Rzfi278I3pdvStFrWVUfU52d8quPRZiBoKYgSBmbOvU//Xwobr1U7FpNV8qatetm4+onvU9jYuFmIEgZiCIGbf7srLv1d01vLsWqzmzapymeyaWfQ5qXtsrWIgZCGIGgphR+g2q9f0V9Y6SartsXtP8qOmZWDTe5AwMCzEDQcxAEDMeY+rVfUj0fLddN9Y+3feodfPd+pnKvLAQMxDEDAQxY1unPo11q+2i8adxCXV+an/qfHbzwELMQBAzEMQMKaYediL6FDVmruaBTWsU1bMwdT67/zcWYgaCmIEgZrR+g+piPata18Tu9/Zurq5aTxLNV833qs6nMg8sxAwEMQNBzHisD8lQ6y3W/qt3kpyuS8/ez3xiNL/qfMjL+oUgiBkIYkYppn7R9THd56s5tBGn60myfcSJ3GMsxAwEMQNBzGjdlxXRja1068mj9tla3c3DysaLxon+fgILMQNBzEAQM476kG5c5aJ7BnS6bqX6+jS/jLysXwCCmIEgZmx/x7DK6btCurF31WdMawPfkXOMhZiBIGYgiBmPvx+iUo2RV/vp3llSpZuXpfqgbNwnsBAzEMQMBDHjSH0InAMLMePvAAAA//8x2VnbmmL6HQAAAABJRU5ErkJggg==",
-    "url": "otpauth://totp/vault:4746fb81-028c-cd4e-026b-7dd18fe4c2f4?algorithm=SHA1&digits=6&issuer=vault&period=30&secret=6HQ4RZ7GM6MMLRKVDCI23LXNZF7UDZ2U"
-  }
-}
-```
-
-### Administratively destroy TOTP MFA secret
-
-This endpoint deletes a TOTP MFA secret from the given entity ID.
-
-To overwrite a secret on the entity,
-explicitly deleting the secret first is required. This API can be used to delete the secret
-and the `generate` or `admin-generate` APIs should be used to regenerate a new
-secret.
-
-| Method | Path                                      |
-|:-------|:------------------------------------------|
-| `POST` | `/identity/mfa/method/totp/admin-destroy` |
-
-### Parameters
-
-- `method_id` `(string: <required>)` - UUID of the MFA method.
-
-- `entity_id` `(string: <required>)` - Entity ID from which the MFA secret
-  should be removed.
-
-### Sample payload
-
-```json
-{
-  "method_id": "4746fb81-028c-cd4e-026b-7dd18fe4c2f4",
-  "entity_id": "9189f7fd-e3f5-436b-a835-cb14864b1e01"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/mfa/method/totp/admin-destroy
-```
diff --git a/website/content/api-docs/secret/identity/oidc-provider.mdx b/website/content/api-docs/secret/identity/oidc-provider.mdx
deleted file mode 100644
index db46867d96a..00000000000
--- a/website/content/api-docs/secret/identity/oidc-provider.mdx
+++ /dev/null
@@ -1,834 +0,0 @@
----
-layout: api
-page_title: 'OIDC Identity Provider'
-description: >-
-  This is the API documentation for configuring and managing OIDC providers with Vault.
----
-
-## Create or update a provider
-
-This endpoint creates or updates a Provider.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `identity/oidc/provider/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the provider. This parameter is specified as part of the URL.
-
-- `issuer` `(string: <optional>)` - Specifies what will be used as the `scheme://host:port` component for the `iss` claim of ID tokens. This defaults to a URL with
-  Vault's `api_addr` as the `scheme://host:port` component and `/v1/:namespace/identity/oidc/provider/:name` as the path
-  component. If provided explicitly, it must point to a Vault instance that is network reachable by clients for ID token validation.
-
-- `allowed_client_ids` `([]string: <optional>)` – The client IDs that are permitted to use the provider. If empty, no clients are allowed. If `"*"` is provided, all clients are allowed.
-
-- `scopes_supported` `([]string: <optional>)` – The scopes available for requesting on the provider.
-
-### Sample payload
-
-```json
-{
-  "allowed_client_ids": ["*"],
-  "scopes_supported": ["test-scope"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider
-```
-
-## Read provider by name
-
-This endpoint queries the OIDC provider by its name.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/identity/oidc/provider/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the provider.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-      "allowed_client_ids":["*"],
-      "issuer":"",
-      "scopes_supported":["test-scope"]
-    }
-}
-```
-
-## List providers
-
-This endpoint returns a list of all OIDC providers.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `LIST` | `/identity/oidc/provider`           |
-
-### Query parameters
-
-- `allowed_client_id` `(string: <optional>)` – Filters the list of OIDC providers to those
-  that allow the given client ID in their set of [allowed_client_ids](/vault/api-docs/secret/identity/oidc-provider#allowed_client_ids).
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/oidc/provider
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "key_info": {
-      "default": {
-        "allowed_client_ids": [
-          "*"
-        ],
-        "issuer": "http://127.0.0.1:8200/v1/identity/oidc/provider/default",
-        "scopes_supported": []
-      }
-    },
-    "keys": [
-      "default"
-    ]
-  }
-}
-```
-
-## Delete provider by name
-
-This endpoint deletes an OIDC provider.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/identity/oidc/provider/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the provider.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider
-```
-
-## Create or update a scope
-
-This endpoint creates or updates a scope.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `identity/oidc/scope/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the scope. This parameter is specified as part of the URL. The `openid` scope name is reserved.
-
-- `template` `(string: <optional>)` - The [JSON template](/vault/docs/concepts/oidc-provider#scopes)
-  string for the scope. This may be provided as escaped JSON or base64 encoded JSON.
-
-- `description` `(string: <optional>)` – A description of the scope.
-
-### Sample payload
-
-```json
-{
-   "template":"{ \"groups\": {{identity.entity.groups.names}} }",
-   "description":"A simple scope example."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/oidc/scope/test-scope
-```
-
-## Read scope by name
-
-This endpoint queries a scope by its name.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/identity/oidc/scope/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the scope.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/identity/oidc/scope/test-scope
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-      "description":"A simple scope example.",
-      "template":"{ \"groups\": {{identity.entity.groups.names}} }"
-   }
-}
-```
-
-## List scopes
-
-This endpoint returns a list of all configured scopes.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `LIST` | `/identity/oidc/scope`           |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/oidc/scope
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-      "keys":[
-         "test-scope"
-      ]
-   }
-}
-```
-
-## Delete scope by name
-
-This endpoint deletes a scope.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/identity/oidc/scope/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the scope.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/oidc/scope/test-scope
-```
-
-## Create or update a client
-
-This endpoint creates or updates a client.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `identity/oidc/client/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the client. This parameter is specified as part of the URL.
-
-- `key` `(string: "default")` – A reference to a [named key](/vault/api-docs/secret/identity/tokens#create-a-named-key)
-  resource. This key will be used to sign ID tokens for the client. This cannot be modified
-  after creation. If not supplied, defaults to the built-in [default key](/vault/docs/concepts/oidc-provider#keys).
-
-- `redirect_uris` `([]string: <optional>)` - Redirection URI values used by the client. One of these values
-  must exactly match the `redirect_uri` parameter value used in each [authentication request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
-
-- `assignments` `([]string: <optional>)` – A list of assignment resources associated with
-  the client. Client assignments limit the Vault entities and groups that are allowed to
-  authenticate through the client. By default, no Vault entities are allowed. To allow all
-  Vault entities to authenticate through the client, supply the built-in
-  [allow_all](/vault/docs/concepts/oidc-provider#assignments) assignment.
-
-- `client_type` `(string: "confidential")` – The [client type](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1)
-  based on its ability to maintain confidentiality of credentials. This cannot be modified
-  after creation. The following list details the differences between confidential and public
-  clients in Vault:
-  - `confidential`
-    - Capable of maintaining the confidentiality of its credentials
-    - Has a client secret
-    - Uses the `client_secret_basic` or `client_secret_post` [client authentication method](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication)
-    - May use Proof Key for Code Exchange ([PKCE](https://datatracker.ietf.org/doc/html/rfc7636))
-      for the authorization code flow
-  - `public`
-    - Not capable of maintaining the confidentiality of its credentials
-    - Does not have a client secret
-    - Uses the `none` [client authentication method](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication)
-    - Must use Proof Key for Code Exchange ([PKCE](https://datatracker.ietf.org/doc/html/rfc7636))
-      for the authorization code flow
-
-- `id_token_ttl` `(int or duration: "24h")` – The time-to-live for ID tokens obtained by the client.
-  Accepts [duration format strings](/vault/docs/concepts/duration-format). The value should be less than the `verification_ttl`
-  on the key.
-
-- `access_token_ttl` `(int or duration: "24h")` – The time-to-live for access tokens obtained by the client.
-  Accepts [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-```json
-{
-   "key":"test-key",
-   "access_token_ttl":"30m",
-   "id_token_ttl":"1h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/oidc/client/test-client
-```
-
-## Read client by name
-
-This endpoint queries a client by its name.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/identity/oidc/client/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the client.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/identity/oidc/client/test-client
-```
-
-### Sample response
-
-```json
-{
-  "data":{
-      "access_token_ttl":1800,
-      "assignments":[],
-      "client_id":"014zXvcvbvIZWwD5NfD1Uzmv7c5JBRMb",
-      "client_secret":"hvo_secret_bZtgQPBZaJXK7F5vOI7JlvEuLOfOUS7DmwynFjE3xKcsen7TyowqPFfYFXG2tbWM",
-      "client_type": "confidential",
-      "id_token_ttl":3600,
-      "key":"test-key",
-      "redirect_uris":[]
-   }
-}
-```
-
-## List clients
-
-This endpoint returns a list of all configured clients.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `LIST` | `/identity/oidc/client`         |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/oidc/client
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "key_info": {
-      "my-app": {
-        "access_token_ttl": 86400,
-        "assignments": [
-          "allow_all"
-        ],
-        "client_id": "wGr981oYLJbcr4zrUriYxjxSc80JL7HW",
-        "client_type": "confidential",
-        "id_token_ttl": 86400,
-        "key": "default",
-        "redirect_uris": [
-          "http://localhost:5555/callback"
-        ]
-      }
-    },
-    "keys": [
-      "my-app"
-    ]
-  }
-}
-```
-
-## Delete client by name
-
-This endpoint deletes a client.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/identity/oidc/client/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the client.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/oidc/client/test-client
-```
-
-## Create or update an assignment
-
-This endpoint creates or updates an assignment.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `identity/oidc/assignment/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the assignment. This parameter is specified as part of the URL.
-
-- `entity_ids` `([]string: <optional>)` - A list of Vault [entity](/vault/docs/secrets/identity#entities-and-aliases) IDs.
-
-- `group_ids` `([]string: <optional>)` – A list of Vault [group](/vault/docs/secrets/identity#identity-groups) IDs.
-
-### Sample payload
-
-```json
-{
-   "group_ids":["262ca5b9-7b69-0a84-446a-303dc7d778af"],
-   "entity_ids":["b6094ac6-baf4-6520-b05a-2bd9f07c66da"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/oidc/assignment/test-assignment
-```
-
-## Read assignment by name
-
-This endpoint queries an assignment by its name.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/identity/oidc/assignment/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the assignment.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/identity/oidc/assignment/test-assignment
-```
-
-### Sample response
-
-```json
-{
-  "data":{
-      "entity_ids":[
-         "b6094ac6-baf4-6520-b05a-2bd9f07c66da"
-      ],
-      "group_ids":[
-         "262ca5b9-7b69-0a84-446a-303dc7d778af"
-      ]
-   }
-}
-```
-
-## List assignments
-
-This endpoint returns a list of all configured assignments.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `LIST` | `/identity/oidc/assignment`           |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/oidc/assignment
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-      "keys":[
-         "test-assignment"
-      ]
-   }
-}
-```
-
-## Delete assignment by name
-
-This endpoint deletes an assignment.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/identity/oidc/assignment/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the assignment.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/oidc/assignment/test-assignment
-```
-
-## Read provider OpenID configuration
-
-Returns OpenID Connect Metadata for a named OIDC provider. The response is a
-compliant [OpenID Provider Configuration Response](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse).
-
-| Method | Path                                                             |
-| :----- | :--------------------------------------------------------------- |
-| `GET`  | `/identity/oidc/provider/:name/.well-known/openid-configuration` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the provider. This parameter is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider/.well-known/openid-configuration
-```
-
-### Sample response
-
-```json
-{
-  "issuer": "http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider",
-  "jwks_uri": "http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider/.well-known/keys",
-  "authorization_endpoint": "http://127.0.0.1:8200/ui/vault/identity/oidc/provider/test-provider/authorize",
-  "token_endpoint": "http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider/token",
-  "userinfo_endpoint": "http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider/userinfo",
-  "request_parameter_supported": false,
-  "request_uri_parameter_supported": false,
-  "id_token_signing_alg_values_supported": [
-    "RS256",
-    "RS384",
-    "RS512",
-    "ES256",
-    "ES384",
-    "ES512",
-    "EdDSA"
-  ],
-  "response_types_supported": [
-    "code"
-  ],
-  "scopes_supported": [
-    "openid"
-  ],
-  "subject_types_supported": [
-    "public"
-  ],
-  "grant_types_supported": [
-    "authorization_code"
-  ],
-  "token_endpoint_auth_methods_supported": [
-    "client_secret_basic",
-    "client_secret_post",
-    "none"
-  ],
-  "code_challenge_methods_supported": [
-    "plain",
-    "S256"
-  ]
-}
-```
-
-## Read provider public keys
-
-Query this path to retrieve the public portion of keys for an OIDC provider.
-Clients can use them to validate the authenticity of an identity token.
-
-| Method | Path                                             |
-| :----- | :----------------------------------------------- |
-| `GET`  | `/identity/oidc/provider/:name/.well-known/keys` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the provider. This parameter is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider/.well-known/keys
-```
-
-### Sample response
-
-```json
-{
-  "keys": [
-    {
-      "use": "sig",
-      "kty": "RSA",
-      "kid": "ee7c0920-fdb9-5c1a-9c69-6dab710d1a09",
-      "alg": "RS256",
-      "n": "zdFjUV9lBw5nQPvTtwH-gzKgRG7iepvYbFoc2hNB0-inJL25oh-mvNW3GS8jPY5XHLsiWa_1TKKE99JrKQgane2C96soFeOvR7SozbCeH8_FpZelH1Pym1NV038j05Vp87uB9FeKPsy1PNOLPTs_Fp42JIAenly7ojYwPp1s61p9V0U9rOhtldY7GkXHLN9s8v3aJjxqrTS3Puhs9MFS7EgRrEDAc69uiLXCoYXKygjXddvJi6j446XxnO2eTRMGl1f2t04s_vDgVnFQgjQSKYWPbOMhf2slkeR47fqE3qqUDzINxauqMbkW-PlLP9IN0crR2uC07cG2os4RxN4YHw",
-      "e": "AQAB"
-    },
-    {
-      "use": "sig",
-      "kty": "RSA",
-      "kid": "6e468221-b7c2-9d2d-744d-33b7ae0357cb",
-      "alg": "RS256",
-      "n": "rMaucILJKiFg_lkCE8ZEV_8jiYdaVDjKkc-8XPBW8S34wIRl1EbsgCYfMHtJnIJ_3eUgOVorW5KVeN9C8W16LR3lhqRWS9y4qlt0AcWpOvsmxr5q5dS_QqgCjeftCKwJzUsMi5bMW8wKjRZdd-qLz6X1rVSZWX82G0So8nRBg9d3MNJbKcdIJrRbrxWkm8U9xMqRouzbyQ2Hsp2rRVgGh7yjEA6daI5Ao8UsPdBmlCM9oKZ1_Kje5JTfZKeHlT-58vn_ylCjMVlapLuUsDN6He2kPVyOzGbie297VOfjmB7QX0ah1f7Ni1UJFJYHrVK9wMfCLTltSFZBcQ9--FlVdQ",
-      "e": "AQAB"
-    }
-  ]}
-```
-
-## Authorization endpoint
-
-Provides the [Authorization Endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint)
-for an OIDC provider. This allows OIDC clients to request an authorization code
-to be used for the [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth).
-
-| Method      | Path                                      |
-| :---------- | :---------------------------------------- |
-| `GET/POST`  | `/identity/oidc/provider/:name/authorize` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the provider. This parameter is specified as part of the URL.
-
-- `scope` `(string: <required>)` - A space-delimited list of scopes to be requested. The `openid` scope is required.
-
-- `response_type` `(string: <required>)` - The OIDC authentication flow to be used. The following response types are supported: `code`.
-
-- `client_id` `(string: <required>)` - The ID of the requesting client.
-
-- `redirect_uri` `(string: <required>)` - The redirection URI to which the response will be sent.
-
-- `state` `(string: <optional>)` - A value used to maintain state between the authentication request and client.
-
-- `nonce` `(string: <optional>)` - A value that is returned in the ID token nonce claim. It is used to mitigate replay attacks, so we *strongly encourage* providing this optional parameter.
-
-- `max_age` `(integer: <optional>)` - The allowable elapsed time in seconds since the last
-  time the end-user was actively authenticated.
-
-- `code_challenge` `(string: <optional>)` - The [PKCE](https://datatracker.ietf.org/doc/html/rfc7636)
-  code challenge derived from the client's code verifier. Optional for `confidential` clients.
-  Required for `public` clients.
-
-- `code_challenge_method` `(string: "plain")` - The method that was used to derive the
-  [PKCE](https://datatracker.ietf.org/doc/html/rfc7636) code challenge. The following
-  methods are supported: `S256`, `plain`.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET \
-    --header "X-Vault-Token: ..." \
-    -G \
-    -d "response_type=code" \
-    -d "client_id=$CLIENT_ID" \
-    -d "state=af0ifjsldkj" \
-    -d "nonce=abcdefghijk" \
-    --data-urlencode "scope=openid" \
-    --data-urlencode "redirect_uri=http://127.0.0.1:8251/callback" \
-    http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider/authorize
-```
-
-### Sample response
-
-```json
-{
-  "code": "BDSc9kVYljxND93YpveBuJtSvguM3AWe",
-  "state": "af0ifjsldkj"
-}
-```
-
-## Token endpoint
-
-Provides the [Token Endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint)
-for an OIDC provider.
-
-| Method  | Path                                  |
-| :------ | :------------------------------------ |
-| `POST`  | `/identity/oidc/provider/:name/token` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the provider. This parameter is
-  specified as part of the URL.
-
-- `code` `(string: <required>)` - The authorization code received from the
-  provider's authorization endpoint.
-
-- `grant_type` `(string: <required>)` - The authorization grant type. The
-  following grant types are supported: `authorization_code`.
-
-- `redirect_uri` `(string: <required>)` - The callback location where the
-  authorization request was sent. This must match the `redirect_uri` used when the
-  original authorization code was generated.
-
-- `client_id` `(string: <optional>)` - The ID of the requesting client. This parameter
-  is required for `public` clients which do not have a client secret or `confidential`
-  clients using the `client_secret_post` client authentication method.
-
-- `client_secret` `(string: <optional>)` - The secret of the requesting client. This
-  parameter is required for `confidential` clients using the `client_secret_post` client
-  authentication method.
-
-- `code_verifier` `(string: <optional>)` - The code verifier associated with the given
-  `code`. Required for authorization codes that were granted using [PKCE](https://datatracker.ietf.org/doc/html/rfc7636).
-  Required for `public` clients.
-
-### Headers
-
-- `Authorization: Basic` `(string: <optional>)` - An HTTP Basic authentication scheme header
-  including the `client_id` and `client_secret` as described in the [client_secret_basic](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication)
-  authentication method. This header is only required for `confidential` clients using
-  the `client_secret_basic` client authentication method.
-
-### Sample request
-
-```shell-session
-$ BASIC_AUTH_CREDS=$(printf "%s:%s" "$CLIENT_ID" "$CLIENT_SECRET" | base64)
-$ curl \
-    --request POST \
-    --header "Authorization: Basic $BASIC_AUTH_CREDS" \
-    -H 'Content-Type: application/x-www-form-urlencoded' \
-    -d "code=4RL50r78p8HsNJY0GVUNGfjLHnpkRf3N" \
-    -d "grant_type=authorization_code" \
-    -d "redirect_uri=http://127.0.0.1:8251/callback" \
-    http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider/token
-```
-
-### Sample response
-
-```json
-{
-  "access_token": "b.AAAAAQJEH5VXjfjUESCwySTKk2MS1MGVNc9oU-N2EyoLKVo9SYa-NnOWAXloYfrlO45UWC3R1PC5ZShl3JdmRJ0264julNnlBduSNXJkYjgCQsFQwXTKHcjhqdNsmJNMWiPaHPn5NLSpNQVtzAxfHADt4r9rmX-UEG5seOWbmK_Z5WwS_4a8-wcVPB7FpOGzfBydP7yMxHu-3H1TWyQvYVr28XUfYxcBbdlzxhJn0yqkWItgmZ25xEOp7SW7Pg4tYB7AXfk",
-  "expires_in": 3600,
-  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImEzMjk5ZWVmLTllNDEtOGNiYS1kNWExLTZmZWM2NjIyODRjYyJ9.eyJhdF9oYXNoIjoiMUdlQlEzUFdtUjJ2ajZVU2swSW42USIsImF1ZCI6InpTSktMVmk0R1BYS1o3TTZzUUEwY3FNc05VaHNPYkVTIiwiY19oYXNoIjoiN09SOUszNmhNdllENzJkUkFLUHhNdyIsImNvbnRhY3QiOnsiZW1haWwiOiJ2YXVsdEBoYXNoaWNvcnAuY29tIiwicGhvbmVfbnVtYmVyIjoiMTIzLTQ1Ni03ODkwIn0sImV4cCI6MTYzMzEwNjI5NCwiZ3JvdXBzIjpbImVuZ2luZWVyaW5nIl0sImlhdCI6MTYzMzEwNDQ5NCwiaXNzIjoiaHR0cDovLzEyNy4wLjAuMTo4MjAwL3YxL2lkZW50aXR5L29pZGMvcHJvdmlkZXIvbXktcHJvdmlkZXIiLCJuYW1lc3BhY2UiOiJyb290Iiwibm9uY2UiOiJhYmNkZWZnaGlqayIsInN1YiI6IjUwMDA3OTZlLTM2ZGYtMGQ4Yy02NDYwLTgxODUzZDliMjY2NyIsInVzZXJuYW1lIjoiZW5kLXVzZXIifQ.ehdLj6jnrJvltar1kkVSyNK48w2M5vkh5DTFJFZDqatnDWhQbbKGLZnVgd3wD6KPboXRaUwhGe4jDiTIiSoJaovOhsia77NKukym_ROLvGZw-LG7xaYkzJLnmEfeQhelLxWe0DHPROB7VXcFqBx8vX5hkuoVyqrB87vwiobK42pDPZ9MRsmbM2yzBC3wrnT7RQFtT4q2Bbyt9YIAHUaq9rU0PwJRoNISw6of1uQHo3_UzLdpwth7PEOEcI47OBGFA5vR_Gw3ocREfSrUWfCWOInAKCT43cImvg4Bts6qiZYfv9n-iNBq4AihGqq_VEF-hB1Hrprn7VgnEZ1VjUHaQQ",
-  "token_type": "Bearer"
-}
-```
-
-## UserInfo endpoint
-
-Provides the [UserInfo Endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo)
-for an OIDC provider. The UserInfo Endpoint is an OAuth 2.0 Protected
-Resource that returns Claims about the authenticated End-User.
-
-| Method  | Path                                     |
-| :------ | :--------------------------------------- |
-| `POST`  | `/identity/oidc/provider/:name/userinfo` |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the provider. This parameter is
-specified as part of the URL.
-
-### Headers
-
-- Access Token `(string: <required>)` - The access token provided by the
-`Authorization: Bearer <access_token>` HTTP header acquired from the authorization
-endpoint.
-
-### Sample request
-
-```shell-session
-$ curl \
-    -X GET \
-    --header "Authorization: Bearer $ACCESS_TOKEN" \
-    http://127.0.0.1:8200/v1/identity/oidc/provider/test-provider/userinfo
-```
-
-### Sample response
-
-```json
-{
-  "contact": {
-    "email": "vault@hashicorp.com",
-    "phone_number": "123-456-7890"
-  },
-  "groups": [
-    "engineering"
-  ],
-  "sub": "5000796e-36df-0d8c-6460-81853d9b2667",
-  "username": "end-user"}
-```
diff --git a/website/content/api-docs/secret/identity/tokens.mdx b/website/content/api-docs/secret/identity/tokens.mdx
deleted file mode 100644
index 326effc58ea..00000000000
--- a/website/content/api-docs/secret/identity/tokens.mdx
+++ /dev/null
@@ -1,519 +0,0 @@
----
-layout: api
-page_title: 'Identity Secret Backend: Identity Tokens - HTTP API'
-description: >-
-  This is the API documentation for configuring, acquiring, and validating vault
-  issued identity tokens.
----
-
-## Configure the identity tokens backend
-
-This endpoint updates configurations for OIDC-compliant identity tokens issued by Vault.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `identity/oidc/config` |
-
-### Parameters
-
-- `issuer` `(string: "")` – Issuer URL to be used in the iss claim of the token. If not set, Vault's api_addr will be used. The issuer is a case sensitive URL using the https scheme that contains scheme, host, and an optional port number.
-
-### Sample payload
-
-```json
-{
-  "issuer": "https://example.com:1234"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/oidc/config
-```
-
-### Sample response
-
-```json
-{
-  "data": null,
-  "warnings": [
-    "If \"issuer\" is set explicitly, all tokens must be validated against that address, including those issued by secondary clusters. Setting issuer to \"\" will restore the default behavior of using the cluster's api_addr as the issuer."
-  ]
-}
-```
-
-## Read configurations for the identity tokens backend
-
-This endpoint queries vault identity tokens configurations.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `identity/oidc/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/oidc/config
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "issuer": "https://example.com:1234"
-  }
-}
-```
-
-## Create a named key
-
-This endpoint creates or updates a named key which is used by a role to sign tokens.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `identity/oidc/key/:name` |
-
-### Parameters
-
-- `name` `(string)` – Name of the named key.
-
-- `rotation_period` `(int or time string: "24h")` - How often to generate a new signing key. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `verification_ttl` `(int or time string: "24h")` - Controls how long the public portion of a signing key will be available for verification after being rotated. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `allowed_client_ids` `(list: [])` - Array of role client ids allowed to use this key for signing. If empty, no roles are allowed. If "\*", all roles are allowed.
-
-- `algorithm` `(string: "RS256")` - Signing algorithm to use. Allowed values are: RS256 (default), RS384, RS512, ES256, ES384, ES512, EdDSA.
-
-### Sample payload
-
-```json
-{
-  "rotation_period": "12h",
-  "verification_ttl": 43200
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/oidc/key/named-key-001
-```
-
-## Read a named key
-
-This endpoint queries a named key and returns its configurations.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `identity/oidc/key/:name` |
-
-### Parameters
-
-- `name` `(string)` – Name of the key.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/oidc/key/named-key-001
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "algorithm": "RS256",
-    "rotation_period": 43200,
-    "verification_ttl": 43200
-  }
-}
-```
-
-## Delete a named key
-
-This endpoint deletes a named key.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `identity/oidc/key/:name` |
-
-### Parameters
-
-- `name` `(string)` – Name of the key.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/oidc/key/named-key-001
-```
-
-## List named keys
-
-This endpoint will List all named keys.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `LIST` | `identity/oidc/key` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/oidc/key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["named-key-001", "named-key-002"]
-  }
-}
-```
-
-## Rotate a named key
-
-This endpoint rotates a named key.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `POST` | `identity/oidc/key/:name/rotate` |
-
-### Parameters
-
-- `name` `(string)` – Name of the key to be rotated.
-
-- `verification_ttl` `(string: <optional>)` - Controls how long the public portion of the key will be available for verification after being rotated. Setting verification_ttl here will override the verification_ttl set on the key.
-
-### Sample payload
-
-```json
-{
-  "verification_ttl": 0
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/oidc/key/named-key-001/rotate
-```
-
-## Create or update a role
-
-Create or update a role. ID tokens are generated against a role and signed against a named key.
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `POST` | `identity/oidc/role/:name` |
-
-### Parameters
-
-- `name` `(string)` – Name of the role.
-
-- `key` `(string)` – A configured named key, the key must already exist.
-
-- `template` `(string: <optional>)` - The template string to use for generating tokens. This may be in string-ified JSON or base64 format.
-
-- `client_id` `(string: <optional>)` - Optional client ID. A random ID will be generated if left unset.
-
-- `ttl` `(int or time string: "24h")` - TTL of the tokens generated against the role. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-```json
-{
-  "key": "named-key-001",
-  "ttl": "12h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/oidc/role/role-001
-```
-
-## Read a role
-
-This endpoint queries a role and returs its configuration.
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `GET`  | `identity/oidc/role/:name` |
-
-### Parameters
-
-- `name` `(string)` – Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/oidc/role/role-001
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "client_id": "PGE8tf4RmJkDwvjI1FgARkXEmH",
-    "key": "named-key-001",
-    "template": "",
-    "ttl": 43200
-  }
-}
-```
-
-## Delete a role
-
-This endpoint deletes a role.
-
-| Method   | Path                       |
-| :------- | :------------------------- |
-| `DELETE` | `identity/oidc/role/:name` |
-
-### Parameters
-
-- `name` `(string)` – Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/identity/oidc/role/role-001
-```
-
-## List roles
-
-This endpoint will list all signing keys.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `LIST` | `identity/oidc/role` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/identity/oidc/role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["role-001", "role-002", "testrole"]
-  }
-}
-```
-
-## Generate a signed ID token
-
-Use this endpoint to generate a signed ID (OIDC) token.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `GET`  | `identity/oidc/token/:name` |
-
-### Parameters
-
-- `name` `(string: "")` – The name of the role against which to generate a signed ID token
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/oidc/token/role-001
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "client_id": "P6CfCzyHsQY4pMcA6kWAOCItA7",
-    "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjJkMGI4YjlkLWYwNGQtNzFlYy1iNjc0LWM3MzU4NDMyYmM1YiJ9.eyJhdWQiOiJQNkNmQ3p5SHNRWTRwTWNBNmtXQU9DSXRBNyIsImV4cCI6MTU2MTQ4ODQxMiwiaWF0IjoxNTYxNDAyMDEyLCJpc3MiOiJodHRwczovL2V4YW1wbGUuY29tOjEyMzQiLCJzdWIiOiI2YzY1ZWFmNy1kNGY0LTEzMzMtMDJiYy0xYzc1MjE5YzMxMDIifQ.IcbWTmks7P5eVtwmIBl5rL1B88MI55a9JJuYVLIlwE9aP_ilXpX5fE38CDm5PixDDVJb8TI2Q_FO4GMMH0ymHDO25ZvA917WcyHCSBGaQlgcS-WUL2fYTqFjSh-pezszaYBgPuGvH7hJjlTZO6g0LPCyUWat3zcRIjIQdXZum-OyhWAelQlveEL8sOG_ldyZ8v7fy7GXDxfJOK1kpw5AX9DXJKylbwZTBS8tLb-7edq8uZ0lNQyWy9VPEW_EEIZvGWy0AHua-Loa2l59GRRP8mPxuMYxH_c88x1lsSw0vH9E3rU8AXLyF3n4d40PASXEjZ-7dnIf4w4hf2P4L0xs_g",
-    "ttl": 86400
-  }
-}
-```
-
-## Introspect a signed ID token
-
-This endpoint can verify the authenticity and active state of a signed ID token.
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `POST` | `identity/oidc/introspect` |
-
-### Parameters
-
-- `token` `(string)` – A signed OIDC compliant ID token
-
-- `client_id` `(string: <optional>)` - Specifying the client ID additionally requires the token to contain a matching `aud` claim
-
-### Sample payload
-
-```json
-{
-  "token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImE4NDQ4YmVkLTk4ZTMtMDNhMC01ODY4LTdmOWYyZDc5NWY2NSJ9.eyJhdWQiOiJpUDdyV1A4dmhDVFFpOTAydGhaR0hUazJMbyIsImV4cCI6MTU2MTQ4OTE0OSwiaWF0IjoxNTYxNDAyNzQ5LCJpc3MiOiJodHRwOi8vMTI3LjAuMC4xOjgyMDAvdjEvaWRlbnRpdHkvb2lkYyIsInN1YiI6IjQ1NDQxZTg3LWMyMWQtYzY5NS0wNGM3LWU0YmU4MGU1M2Y0ZiJ9.IYZx1bBofBgwphLZggugFUE7V3ZLFDNr0UYv3hhc4RlIu5WgFZPRjpKVXPdORozYJJB_37aJW6qm5j8nNSz4WrWUmMcrVxoZi2VBExu-GcHHniEPRryR9t_45rqP2MycLBz0dICOjFDWvfkp6ddyCsQfkRnplPGCaN67MUEdgYQf5QNyxaG-yabRPiATY_OtXSjiNsMhJe6ZloYTZZc9gTTfKcKQf4mfy5yRY6471qkqeTuYNhKjwdkEnCSaEjHmCdZOYC5DAet16eQ7ankcwBno17_zs7vbPmkXNttALOrjSQgGe1td1SCfZeg5UOs7_IPk0qqdwOdyQ8wsrDmSyg"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/identity/oidc/introspect
-```
-
-### Sample response
-
-```json
-{
-  "active": true
-}
-```
-
-## Read .well-known configurations
-
-Query this path to retrieve a set of claims about the identity tokens' configuration. The response is a compliant [OpenID Provider Configuration Response](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse).
-
-| Method | Path                                             |
-| :----- | :----------------------------------------------- |
-| `GET`  | `identity/oidc/.well-known/openid-configuration` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/oidc/.well-known/openid-configuration
-```
-
-### Sample response
-
-```json
-{
-  "issuer": "https://example.com/v1/identity/oidc",
-  "authorization_endpoint": "",
-  "token_endpoint": "",
-  "jwks_uri": "https://example.com/v1/identity/oidc/.well-known/keys",
-  "response_types_supported": null,
-  "subject_types_supported": ["public"],
-  "id_token_signing_alg_values_supported": ["RS256"],
-  "scopes_supported": null,
-  "token_endpoint_auth_methods_supported": null,
-  "claims_supported": null
-}
-```
-
-## Read plugin identity .well-known configurations
-
-Use the `.well-known` endpoint to retrieve an
-[OpenID Provider Configuration Response](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse)
-with a set of claims about the identity token configuration for a plugin.
-
-| Method | Path                                             |
-| :----- | :----------------------------------------------- |
-| `GET`  | `identity/oidc/plugins/.well-known/openid-configuration` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/oidc/plugins/.well-known/openid-configuration
-```
-
-### Sample response
-
-```json
-{
-  "issuer": "https://example.com/v1/identity/oidc/plugins",
-  "authorization_endpoint": "",
-  "token_endpoint": "",
-  "jwks_uri": "https://example.com/v1/identity/oidc/plugins/.well-known/keys",
-  "response_types_supported": null,
-  "subject_types_supported": ["public"],
-  "id_token_signing_alg_values_supported": ["RS256"],
-  "scopes_supported": null,
-  "token_endpoint_auth_methods_supported": null,
-  "claims_supported": null
-}
-```
-
-## Read active public keys
-
-Query this path to retrieve the public portion of named keys. Clients can use this to validate the authenticity of an identity token.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET \
-    http://127.0.0.1:8200/v1/identity/oidc/.well-known/keys
-```
-
-### Sample response
-
-```json
-{
-  "keys": [
-    {
-      "use": "sig",
-      "kty": "RSA",
-      "kid": "94178020-55b5-e18d-b32b-1010ba5a35b4",
-      "alg": "RS256",
-      "n": "1bt-V8T7g0zr7koNbdppFrUM5YrnybPDOt-cK3MKmL1FcN3aOltCw9tCYStHgm8mIz_DJ1HgIjA-DcK_O9gacEGFCidUuudV8O4TixToHEVyRe1yXu-Q98hwkm9JtFF9PvMzDXhn4s3bLanOZzO15JAdVCo0JnwSIT9Ay3LxPLbWHYbPj7ROScuvic99OyvWz87qBK-AoXmxo9lRNY39LtieMr1D2iq0HvtjHkfiarr34CSTcuksknOsY49BU5ktrs_YJSEVpeRQ8RywY1sWrq8w_UmGsNFfPr--crXQw0ekJCXzmotsRHE5jwMuhjuucVlnyQFBYEdfDB_iPbC7Hw",
-      "e": "AQAB"
-    }
-  ]
-}
-```
diff --git a/website/content/api-docs/secret/index.mdx b/website/content/api-docs/secret/index.mdx
deleted file mode 100644
index efe63dc780b..00000000000
--- a/website/content/api-docs/secret/index.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
----
-layout: api
-page_title: Secrets Engines - HTTP API
-description: |-
-  Each secrets engine publishes its own set of API paths and methods. These
-  endpoints are documented in this section.
----
-
-# Secrets engines
-
-Each secrets engine publishes its own set of API paths and methods. These
-endpoints are documented in this section. secrets engines are enabled at a path,
-but the documentation will assume the default paths for simplicity. If you are
-enabled at a different path, you should adjust your API calls accordingly.
-
-For the API documentation for a specific secrets engine, please choose a secrets
-engine from the navigation.
diff --git a/website/content/api-docs/secret/key-management/awskms.mdx b/website/content/api-docs/secret/key-management/awskms.mdx
deleted file mode 100644
index 37699d421b0..00000000000
--- a/website/content/api-docs/secret/key-management/awskms.mdx
+++ /dev/null
@@ -1,51 +0,0 @@
----
-layout: api
-page_title: AWS KMS - Key Management - Secrets Engines - HTTP API
-description: The AWS KMS API documentation for the Key Management secrets engine.
----
-
-# AWS KMS (API)
-
-The Key Management secrets engine supports lifecycle management of keys in [AWS KMS](https://aws.amazon.com/kms/)
-regions. This is accomplished by configuring a KMS provider resource with the `awskms` provider and
-other provider-specific parameter values.
-
-The following sections provide API documentation that is specific to AWS KMS.
-
-## Create/Update KMS provider
-
-This endpoint creates or updates a KMS provider. If a KMS provider with the given `name`
-does not exist, it will be created. If the KMS provider exists, it will be updated with
-the given parameter values.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/keymgmt/kms/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the KMS provider to create or update.
-  This is provided as part of the request URL.
-
-- `provider` `(string: <required>)` – Specifies the name of a KMS provider that's external to
-  Vault. Must be set to `awskms`. Cannot be changed after creation.
-
-- `key_collection` `(string: <required>)` – Refers to the name of an AWS
-  [region](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/?p=ngi&loc=2).
-  Cannot be changed after creation.
-
-- `credentials` `(map<string|string>: nil)` – The credentials to use for authentication with
-  AWS KMS. Supplying values for this parameter is optional, as credentials may also be specified
-  as environment variables. Credentials provided to this parameter will take precedence over
-  credentials provided via environment variables.
-
-  - `access_key` `(string: <required>)` - The AWS access key ID. May also be specified
-    by the `AWS_ACCESS_KEY_ID` environment variable.
-  - `secret_key` `(string: <required>)` - The AWS secret access key. May also be specified
-    by the `AWS_SECRET_ACCESS_KEY` environment variable.
-  - `session_token` `(string: <optional>)` - The AWS session token. May also be specified
-    by the `AWS_SESSION_TOKEN` environment variable.
-  - `endpoint` `(string: <optional>)` - The KMS API endpoint to be used to make AWS KMS
-    requests. May also be specified by the `AWS_KMS_ENDPOINT` environment variable. This
-    is useful when connecting to KMS over a [VPC Endpoint](https://docs.aws.amazon.com/kms/latest/developerguide/kms-vpc-endpoint.html).
-    If not set, the secrets engine will use the default API endpoint for the region.
diff --git a/website/content/api-docs/secret/key-management/azurekeyvault.mdx b/website/content/api-docs/secret/key-management/azurekeyvault.mdx
deleted file mode 100644
index b6a649c88d7..00000000000
--- a/website/content/api-docs/secret/key-management/azurekeyvault.mdx
+++ /dev/null
@@ -1,49 +0,0 @@
----
-layout: api
-page_title: Azure Key Vault - Key Management - Secrets Engines - HTTP API
-description: The Azure Key Vault API documentation for the Key Management secrets engine.
----
-
-# Azure key Vault (API)
-
-The Key Management secrets engine supports lifecycle management of keys in named
-[Azure Key Vault](https://docs.microsoft.com/en-us/azure/key-vault/) instances.
-This is accomplished by configuring a KMS provider resource with the `azurekeyvault`
-provider and other provider-specific parameter values.
-
-The following sections provide API documentation that is specific to Azure Key Vault.
-
-## Create/Update KMS provider
-
-This endpoint creates or updates a KMS provider. If a KMS provider with the given `name`
-does not exist, it will be created. If the KMS provider exists, it will be updated with
-the given parameter values.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/keymgmt/kms/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the KMS provider to create or update.
-  This is provided as part of the request URL.
-
-- `provider` `(string: <required>)` – Specifies the name of a KMS provider that's external to
-  Vault. Must be set to `azurekeyvault`. Cannot be changed after creation.
-
-- `key_collection` `(string: <required>)` – Refers to the name of an existing Azure Key Vault
-  instance. Cannot be changed after creation.
-
-- `credentials` `(map<string|string>: nil)` – The credentials to use for authentication with
-  Azure Key Vault. Supplying values for this parameter is optional, as credentials may also
-  be specified as environment variables. Environment variables will take precedence over
-  credentials provided via this parameter.
-
-  - `tenant_id` `(string: <required>)` - The tenant ID for the Azure Active Directory
-    organization. May also be specified by the `AZURE_TENANT_ID` environment variable.
-  - `client_id` `(string: <required or MSI>)` - The client ID for credentials to invoke the
-    Azure APIs. May also be specified by the `AZURE_CLIENT_ID` environment variable.
-  - `client_secret` `(string: <required or MSI>)` - The client secret for credentials to invoke
-    the Azure APIs. May also be specified by the `AZURE_CLIENT_SECRET` environment variable.
-  - `environment` `(string: "AzurePublicCloud")` - The Azure Cloud environment API endpoints to
-    use. May also be specified by the `AZURE_ENVIRONMENT` environment variable.
diff --git a/website/content/api-docs/secret/key-management/gcpkms.mdx b/website/content/api-docs/secret/key-management/gcpkms.mdx
deleted file mode 100644
index b491c09f459..00000000000
--- a/website/content/api-docs/secret/key-management/gcpkms.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
----
-layout: api
-page_title: GCP Cloud KMS - Key Management - Secrets Engines - HTTP API
-description: The GCP Cloud KMS API documentation for the Key Management secrets engine.
----
-
-# GCP Cloud KMS (API)
-
-The Key Management secrets engine supports lifecycle management of keys in [GCP Cloud KMS](https://cloud.google.com/security-key-management)
-[key rings](https://cloud.google.com/kms/docs/resource-hierarchy#key_rings). This is accomplished by
-configuring a KMS provider resource with the `gcpckms` provider and other provider-specific parameter
-values.
-
-The following sections provide API documentation that is specific to GCP Cloud KMS.
-
-## Create/Update KMS provider
-
-This endpoint creates or updates a KMS provider. If a KMS provider with the given `name`
-does not exist, it will be created. If the KMS provider exists, it will be updated with
-the given parameter values.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/keymgmt/kms/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the KMS provider to create or update.
-  This is provided as part of the request URL.
-
-- `provider` `(string: <required>)` – Specifies the name of a KMS provider that's external to
-  Vault. Must be set to `gcpckms`. Cannot be changed after creation.
-
-- `key_collection` `(string: <required>)` – Refers to the
-  [resource ID](https://cloud.google.com/kms/docs/resource-hierarchy#retrieve_resource_id)
-  of an existing GCP Cloud KMS [key ring](https://cloud.google.com/kms/docs/resource-hierarchy#key_rings).
-  Cannot be changed after creation.
-
-- `credentials` `(map<string|string>: nil)` – The credentials to use for authentication with GCP
-  Cloud KMS. Supplying values for this parameter is optional, as credentials may also be specified
-  as environment variables. See the [authentication](/vault/docs/secrets/key-management/gcpkms#authentication)
-  section for details on precedence.
-
-  - `service_account_file` `(string: <required>)` - The path to a Google service account key file. The
-    key file must be readable on the host that Vault server is running on. May also be provided by the
-    `GOOGLE_CREDENTIALS` environment variable or by
-    [application default credentials](https://cloud.google.com/docs/authentication/production).
diff --git a/website/content/api-docs/secret/key-management/index.mdx b/website/content/api-docs/secret/key-management/index.mdx
deleted file mode 100644
index 223fe959890..00000000000
--- a/website/content/api-docs/secret/key-management/index.mdx
+++ /dev/null
@@ -1,552 +0,0 @@
----
-layout: api
-page_title: Key Management - Secrets Engines - HTTP API
-description: The API documentation for the Key Management secrets engine.
----
-
-# Key management secrets engine (API)
-
-This is the API documentation for the Key Management secrets engine. For general
-information about the usage and operation of the secrets engine, please see the
-[Key Management secrets engine documentation](/vault/docs/secrets/key-management).
-
-This documentation assumes the Key Management secrets engine is enabled at the
-`/keymgmt` path in Vault. Since it is possible to enable secrets engines at any
-location, please update your API calls accordingly.
-
-## Create key
-
-This endpoint creates a named cryptographic key of a specified type. These parameters
-set cannot be changed after key creation.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/keymgmt/key/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key to create.
-  This is provided as part of the request URL.
-
-- `type` `(string: "rsa-2048")` – Specifies the type of cryptographic key to create. The
-  following key types are supported:
-
-  - `aes256-gcm96` - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
-  - `rsa-2048` - RSA with bit size of 2048 (asymmetric)
-  - `rsa-3072` - RSA with bit size of 3072 (asymmetric)
-  - `rsa-4096` - RSA with bit size of 4096 (asymmetric)
-  - `ecdsa-p256` - ECDSA using the P-256 elliptic curve (asymmetric)
-  - `ecdsa-p384` - ECDSA using the P-384 elliptic curve (asymmetric)
-  - `ecdsa-p521` - ECDSA using the P-521 elliptic curve (asymmetric)
-
-### Sample payload
-
-```json
-{
-  "type": "rsa-2048"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/keymgmt/key/example-key
-```
-
-## Read key
-
-This endpoint returns information about a named key. The `keys` object will hold information
-regarding each key version. Different information will be returned depending on the key type.
-For example, an asymmetric key will return its public key in a PEM encoding.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/keymgmt/key/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key to read.
-  This is provided as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/keymgmt/key/example-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "deletion_allowed": false,
-    "keys": {
-      "1": {
-        "creation_time": "2020-11-02T15:54:58.768473-08:00",
-        "public_key": "-----BEGIN PUBLIC KEY----- ... -----END PUBLIC KEY-----"
-      },
-      "2": {
-        "creation_time": "2020-11-04T16:58:47.591718-08:00",
-        "public_key": "-----BEGIN PUBLIC KEY----- ... -----END PUBLIC KEY-----"
-      }
-    },
-    "latest_version": 2,
-    "min_enabled_version": 1,
-    "name": "example-key",
-    "type": "rsa-2048"
-  }
-}
-```
-
-## List keys
-
-This endpoint returns a list of all existing keys.
-
-| Method | Path           |
-| :----- | :------------- |
-| `LIST` | `/keymgmt/key` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/keymgmt/key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-key"]
-  }
-}
-```
-
-## Update key
-
-This endpoint updates a named key.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/keymgmt/key/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key to update.
-  This is provided as part of the request URL.
-
-- `min_enabled_version` `(int: 0)` – Specifies the minimum enabled version of the key. All
-  versions of the key less than the specified version will be disabled for cryptographic
-  operations in the KMS provider that the key has been distributed to. Setting this value to
-  `0` means that all versions will be enabled.
-
-- `deletion_allowed` `(bool: false)` – Specifies if the key is allowed to be deleted.
-
-### Sample payload
-
-```json
-{
-  "min_enabled_version": 0,
-  "deletion_allowed": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/keymgmt/key/example-key
-```
-
-## Rotate key
-
-This endpoint rotates the version of a named key.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `/keymgmt/key/:name/rotate` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key to rotate.
-  This is provided as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/keymgmt/key/example-key/rotate
-```
-
-## Delete key
-
-This endpoint deletes a named key. The key must be removed from all KMS providers that it's
-been distributed to and have `deletion_allowed` set to `true` in order to be deleted.
-
-| Method   | Path                 |
-| :------- | :------------------- |
-| `DELETE` | `/keymgmt/key/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key to delete.
-  This is provided as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/keymgmt/key/example-key
-```
-
-## List KMS providers of key
-
-This endpoint returns a list of all KMS providers that the named key has been distributed to.
-Currently, a key can only be distributed to a single KMS provider.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `LIST` | `/keymgmt/key/:name/kms` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key.
-  This is provided as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/keymgmt/key/example-key/kms
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-kms"]
-  }
-}
-```
-
-## Create/Update KMS provider
-
-This endpoint creates or updates a KMS provider. If a KMS provider with the given `name`
-does not exist, it will be created. If the KMS provider exists, it will be updated with
-the given parameter values.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/keymgmt/kms/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the KMS provider to create or update.
-  This is provided as part of the request URL.
-
-- `provider` `(string: <required>)` – Specifies the name of a KMS provider that's external to
-  Vault. Cannot be changed after creation. For more information about each provider, refer to
-  the [KMS Providers](/vault/docs/secrets/key-management#kms-providers) section. The following values
-  are supported:
-
-  - `azurekeyvault`
-  - `awskms`
-  - `gcpckms`
-
-### Common parameters
-
-There are common parameters that expect different values depending on the specified `provider`.
-Please reference the API documentation for individual KMS providers to determine which values to
-set for each of the parameters listed below.
-
-- `key_collection` `(string: <required>)` – Refers to a location to store keys in the specified
-  `provider`. Cannot be changed after creation. The expected value for this parameter will differ
-  depending on the specified `provider`.
-
-- `credentials` `(map<string|string>: nil)` – The credentials to use for authentication with
-  the specified `provider`. Supplying values for this parameter is optional, as credentials may
-  also be specified as environment variables. The expected keys and values for this parameter
-  will differ depending on the specified `provider`.
-
-### Sample payload
-
-```json
-{
-  "credentials": [
-    "client_id=example-client-id",
-    "client_secret=example-client-secret",
-    "tenant_id=example-tenant-id"
-  ],
-  "key_collection": "example-keyvault-name",
-  "provider": "azurekeyvault"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/keymgmt/kms/example-kms
-```
-
-## Read KMS provider
-
-This endpoint returns information about a KMS provider.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/keymgmt/kms/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the KMS provider to read.
-  This is provided as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/keymgmt/kms/example-kms
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "key_collection": "example-keyvault-name",
-    "provider": "azurekeyvault"
-  }
-}
-```
-
-## List KMS providers
-
-This endpoint returns a list of all existing KMS providers.
-
-| Method | Path           |
-| :----- | :------------- |
-| `LIST` | `/keymgmt/kms` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/keymgmt/kms
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-kms"]
-  }
-}
-```
-
-## Delete KMS provider
-
-This endpoint deletes a KMS provider. A KMS provider cannot be deleted until all keys
-that have been distributed to it are removed.
-
-| Method   | Path                 |
-| :------- | :------------------- |
-| `DELETE` | `/keymgmt/kms/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the KMS provider to delete.
-  This is provided as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/keymgmt/kms/example-kms
-```
-
-## Distribute key to KMS provider
-
-This endpoint distributes a named key to the KMS provider. The key will be securely delivered
-(i.e., wrapped for protection in transit) following the key import specification of the KMS
-provider. The parameters set cannot be changed after the key has been distributed.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `POST` | `/keymgmt/kms/:name/key/:key_name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the KMS provider to distribute the given key
-  to. This is provided as part of the request URL.
-
-- `key_name` `(string: <required>)` – Specifies the name of the key to distribute to the given KMS
-  provider. This is provided as part of the request URL.
-
-- `purpose` `([]string: <required>)` – Specifies the purpose of the key. The purpose defines a set
-  of cryptographic capabilities that the key will have in the KMS provider. A key must have at
-  least one of the supported purposes. The following values are supported:
-
-  - `encrypt`
-  - `decrypt`
-  - `sign`
-  - `verify`
-  - `wrap`
-  - `unwrap`
-
-- `protection` `(string: "hsm")` – Specifies the protection of the key. The protection defines
-  where cryptographic operations are performed with the key in the KMS provider. The following
-  values are supported:
-
-  - `hsm`
-  - `software`
-
-### Sample payload
-
-```json
-{
-  "protection": "hsm",
-  "purpose": "encrypt,decrypt"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/keymgmt/kms/example-kms/key/example-key
-```
-
-## Read key in KMS provider
-
-This endpoint returns information about a key that's been distributed to a KMS provider.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `GET`  | `/keymgmt/kms/:name/key/:key_name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the KMS provider. This is provided as
-  part of the request URL.
-
-- `key_name` `(string: <required>)` – Specifies the name of the key. This is provided as part
-  of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/keymgmt/kms/example-kms/key/example-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "name": "example-key-<unix_timestamp>",
-    "protection": "hsm",
-    "purpose": "encrypt,decrypt",
-    "versions": {
-      "1": "c96a8956194f4632bc3837b64a1b45b1",
-      "2": "01ce657d33f64eb38f9432be543f3f52"
-    }
-  }
-}
-```
-
-## List keys in KMS provider
-
-This endpoint returns a list of all keys that have been distributed to the given KMS
-provider. Many keys can be distributed to a single KMS provider.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `LIST` | `/keymgmt/kms/:name/key` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the KMS provider.
-  This is provided as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/keymgmt/kms/example-kms/key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-key"]
-  }
-}
-```
-
-## Remove key from KMS provider
-
-This endpoint removes a named key from the KMS provider. This will only delete the key from
-the KMS provider. The key will still exist in the secrets engine and can be redistributed to
-a KMS provider at a later time. To permanently delete the key from the secrets engine, the
-[Delete Key](#delete-key) API must be invoked.
-
-| Method   | Path                               |
-| :------- | :--------------------------------- |
-| `DELETE` | `/keymgmt/kms/:name/key/:key_name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the KMS provider. This is provided as
-  part of the request URL.
-
-- `key_name` `(string: <required>)` – Specifies the name of the key. This is provided as part
-  of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/keymgmt/kms/example-kms/key/example-key
-```
diff --git a/website/content/api-docs/secret/kmip.mdx b/website/content/api-docs/secret/kmip.mdx
deleted file mode 100644
index 5f9442aee7b..00000000000
--- a/website/content/api-docs/secret/kmip.mdx
+++ /dev/null
@@ -1,609 +0,0 @@
----
-layout: api
-page_title: KMIP - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault KMIP secrets engine.
----
-
-# KMIP secrets engine (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault KMIP secrets engine. For general
-information about the usage and operation of
-the KMIP secrets engine, please see [these docs](/vault/docs/secrets/kmip).
-
-This documentation assumes the KMIP secrets engine is enabled at the `/kmip` path
-in Vault. Since it is possible to mount secrets engines at any path, please
-update your API calls accordingly.
-
-## Write config
-
-| Method | Path           |
-| :----- | :------------- |
-| `POST` | `/kmip/config` |
-
-This endpoint configures shared information for the secrets engine. After writing
-to it the KMIP engine will generate a CA and start listening for KMIP requests.
-If the server was already running and any non-client settings are changed, the
-server will be restarted using the new settings. All generated CAs will use
-entropy augmentation to generate their certificates if entropy augmentation
-is enabled.
-
-### Parameters
-
-- `listen_addrs` (`list: ["127.0.0.1:5696"] || string`) - Address and port the
-  KMIP server should listen on. Can be given as a JSON list or a
-  comma-separated string list. If multiple values are given, all will be
-  listened on.
-- `connection_timeout` (`int: 1 || string:"1s"`) - Duration in either an integer
-  number of seconds (10) or an integer time unit (10s) within which connections
-  must become ready.
-
-- `server_hostnames` (`list: ["localhost"] || string`) - Hostnames to include in
-  the server's TLS certificate as SAN DNS names. The first will be used as the
-  common name (CN).
-
-- `server_ips` (`list: [] || string`) - IPs to include in the server's TLS
-  certificate as SAN IP addresses. Localhost (IPv4 and IPv6) will be automatically
-  included.
-- `tls_ca_key_type` (`string: "ec"`) - CA key type, `rsa` or `ec`.
-
-- `tls_ca_key_bits` (`int: 521`) - CA key bits, valid values depend on key type.
-
-- `tls_min_version` (`string: "tls12"`) - Minimum TLS version to accept.
-
-- `default_tls_client_key_type` (`string: "ec"`): - Client certificate key type,
-  `rsa` or `ec`.
-
-- `default_tls_client_key_bits` (`int: 521`): - Client certificate key bits, valid
-  values depend on key type.
-
-- `default_tls_client_ttl` (`int: 86400 || string:"24h"`) – Client certificate
-  TTL in either an integer number of seconds (10) or an integer time unit (10s).
-
-### Sample payload
-
-```json
-{
-  "listen_addrs": "127.0.0.1:5696,192.168.1.2:9000",
-  "connection_timeout": "1s",
-  "server_hostnames": "myhostname1,myhostname2",
-  "server_ips": "192.168.1.2",
-  "tls_ca_key_type": "ec",
-  "tls_ca_key_bits": 521,
-  "tls_min_version": "tls11",
-  "default_tls_client_key_type": "ec",
-  "default_tls_client_key_bits": 224,
-  "default_tls_client_ttl": 86400
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/kmip/config
-```
-
-## Read config
-
-| Method | Path           |
-| :----- | :------------- |
-| `GET`  | `/kmip/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/kmip/config
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "listen_addrs": ["127.0.0.1:5696", "192.168.1.2:9000"],
-    "connection_timeout": "1s",
-    "server_hostnames": ["myhostname1", "myhostname2"],
-    "server_ips": ["192.168.1.2"],
-    "tls_ca_key_type": "ec",
-    "tls_ca_key_bits": 521,
-    "tls_min_version": "tls11",
-    "default_tls_client_key_type": "ec",
-    "default_tls_client_key_bits": 224,
-    "default_tls_client_ttl": 86400
-  }
-}
-```
-
-## Read CA
-
-| Method | Path       |
-| :----- | :--------- |
-| `GET`  | `/kmip/ca` |
-
-Returns the CA certificates in PEM format. Returns an error if config has never
-been written.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/kmip/ca
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "ca_pem": "-----BEGIN CERTIFICATE-----\nMIICNzCCAZigAwIBAgIUApNsRil/dzQy3XT+yjZQEpcA49kwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE4MzIzM1oX\nDTI5MDYyMTE4MzMwM1owKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWlu\ndGVybWVkaWF0ZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAGWJGwPjGGoXivBv\nLJwR+fIG3z6Ei06bhZgTaRW/U3eA5oivxubxOVZPe1BJGWCsIVNjxMZAN4Pswki7\nAHme9bdJAUbQw33tC1iAb0wjzIpoPv1+pdSk6wYZTCKzOYWCbsTb3SOIetpk7sQw\niM17agwIRK9qGvX3Q4PBfEKEpstAjoaJo2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYD\nVR0TAQH/BAgwBgEB/wIBCTAdBgNVHQ4EFgQUKMwPpRxU2Uzydv21bc8ePfUpGFEw\nHwYDVR0jBBgwFoAUwrPrJc9EsU6kTWJ5hXkJV4PEq9swCgYIKoZIzj0EAwIDgYwA\nMIGIAkIBRCarRMer42Ni/fKQBTi+uFk+2sPyCxCYDWTfMFAusC51dC2F91mUL77R\nkHxauSkh5gcZVAch/dg/L0ewP0AZUBUCQgE1VqoBN9klFky7LHfl62p6PgprH7d1\nYCvYVbWdBNnEdrL2P9aKsuCewdqycZVJLmM36cHnOAEGg1yea8soQL0Ylw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIICKTCCAYugAwIBAgIUOBgW1GCH+n5gC6m8Ff5jq+5DmO8wCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE4MzIzM1oX\nDTI5MDYyMTE4MzMwM1owHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MIGb\nMBAGByqGSM49AgEGBSuBBAAjA4GGAAQA7vkbmKJR+SVBTJjAFnma0ynTIi64doZA\n5oOXIAExvOyyI2KBNfqXxgzt/51u9vvixQf3VX/1Jph+0fkIcIYUEmIBFAH7Th1X\n0EOOdmMHfN0YkXDEUUdKIZyQxgA7o3DF+JAVg1cdBV7S8jZyXik7pL+IFnlYdfvN\nUZcArUkMfKo1cZajZjBkMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/\nAgEKMB0GA1UdDgQWBBTCs+slz0SxTqRNYnmFeQlXg8Sr2zAfBgNVHSMEGDAWgBTC\ns+slz0SxTqRNYnmFeQlXg8Sr2zAKBggqhkjOPQQDAgOBiwAwgYcCQgGjKAC371/5\npxgYdLVBmVC6Aa+oOvwGfnich2YLSLbThySED7+fXl1BY43VU703ad6M34fStf6z\nwFZvVZVK188DCQJBJcSZ7YA3PjOre+epJHtAba+1CkAdbSAeGhBDgHdIEP1/FDvx\n+U2QYeVZ7kAVnkzPxa17V0yqjxDtQDTiOw/ZV5c=\n-----END CERTIFICATE-----"
-  }
-}
-```
-
-## Write scope
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/kmip/scope/:scope` |
-
-Creates a new scope with the given name.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    https://127.0.0.1:8200/v1/kmip/scope/myscope
-```
-
-## List scopes
-
-| Method | Path          |
-| :----- | :------------ |
-| `LIST` | `/kmip/scope` |
-
-List existing scopes.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/kmip/scope
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["myscope"]
-  }
-}
-```
-
-## Delete scope
-
-| Method   | Path                 |
-| :------- | :------------------- |
-| `DELETE` | `/kmip/scope/:scope` |
-
-Delete a scope by name.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-- `force` (`bool: false`) - Force scope deletion. If KMIP managed objects have
-  been created within the scope this param must be provided or the deletion will
-  fail. This value should be supplied as a query parameter, or as an argument in
-  the CLI.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/kmip/scope/myscope?force=false
-```
-
-## Write role
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `POST` | `/kmip/scope/:scope/role/:role` |
-
-Creates or updates a role.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-- `role` (`string: <required>`) - Name of role. This is part of the request URL.
-- `tls_client_key_type` (`string`): - Client certificate key type,
-  `rsa` or `ec`. Overrides engine-wide default managed in `config` endpoint.
-- `tls_client_key_bits` (`int`): - Client certificate key bits, valid
-  values depend on key type. Overrides engine-wide default managed in `config`
-  endpoint.
-- `tls_client_ttl` (`int or string`) – Client certificate
-  TTL in either an integer number of seconds (10) or an integer time unit (10s).
-  Overrides engine-wide default managed in `config` endpoint.
-- `operation_none` (`bool: false`) - Remove all permissions
-  from this role. May not be specified with any other
-  `operation_` params.
-- `operation_all` (`bool: false`) - Grant all permissions
-  to this role. May not be specified with any other
-  `operation_` params.
-- `operation_activate` (`bool: false`) - Grant permission to use the KMIP
-  `Activate` operation.
-- `operation_add_attribute` (`bool: false`) - Grant permission to use the KMIP
-  `Add Attribute` operation.
-- `operation_create` (`bool: false`) - Grant permission to use the KMIP
-  `Create` operation.
-- `operation_decrypt` (`bool: false`) - Grant permission to use the KMIP
-  `Decrypt` operation.
-- `operation_destroy` (`bool: false`) - Grant permission to use the KMIP
-  `Destroy` operation.
-- `operation_discover_versions` (`bool: false`) - Grant permission to use the KMIP
-  `Discover Versions` operation.
-- `operation_encrypt` (`bool: false`) - Grant permission to use the KMIP
-  `Encrypt` operation.
-- `operation_get` (`bool: false`) - Grant permission to use the KMIP
-  `Get` operation.
-- `operation_get_attribute_list` (`bool: false`) - Grant permission to use the KMIP
-  `Get Attribute List` operation.
-- `operation_get_attributes` (`bool: false`) - Grant permission to use the KMIP
-  `Get Attributes` operation.
-- `operation_import` (`bool: false`) - Grant permission to use the KMIP
-  `Import` operation.
-- `operation_locate` (`bool: false`) - Grant permission to use the KMIP
-  `Locate` operation.
-- `operation_query` (`bool: false`) - Grant permission to use the KMIP
-  `Query` operation.
-- `operation_register` (`bool: false`) - Grant permission to use the KMIP
-  `Register` operation.
-- `operation_rekey` (`bool: false`) - Grant permission to use the KMIP
-  `Rekey` operation.
-- `operation_revoke` (`bool: false`) - Grant permission to use the KMIP
-  `Revoke` operation.
-
-### Sample payload
-
-```json
-{
-  "operation_activate": true,
-  "operation_add_attribute": true,
-  "operation_create": true,
-  "operation_decrypt": true,
-  "operation_destroy": true,
-  "operation_discover_versions": true,
-  "operation_encrypt": true,
-  "operation_get": true,
-  "operation_get_attribute_list": true,
-  "operation_get_attributes": true,
-  "operation_import": true,
-  "operation_locate": true,
-  "operation_query": true,
-  "operation_register": true,
-  "operation_rekey": true,
-  "operation_revoke": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/kmip/scope/myscope/role/myrole
-```
-
-## Read role
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `GET`  | `/kmip/scope/:scope/role/:role` |
-
-Read a role.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-- `role` (`string: <required>`) - Name of role. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/kmip/scope/myscope/role/myrole
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "operation_activate": true,
-    "operation_add_attribute": true,
-    "operation_create": true,
-    "operation_decrypt": true,
-    "operation_destroy": true,
-    "operation_discover_versions": true,
-    "operation_encrypt": true,
-    "operation_get": true,
-    "operation_get_attribute_list": true,
-    "operation_get_attributes": true,
-    "operation_import": true,
-    "operation_locate": true,
-    "operation_query": true,
-    "operation_register": true,
-    "operation_rekey": true,
-    "operation_revoke": true
-  }
-}
-```
-
-## List roles
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `LIST` | `/kmip/scope/:scope/role` |
-
-List roles with a scope.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/kmip/scope/myscope/role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["myrole"]
-  }
-}
-```
-
-## Delete role
-
-| Method   | Path                            |
-| :------- | :------------------------------ |
-| `DELETE` | `/kmip/scope/:scope/role/:role` |
-
-Delete a role by name.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-- `role` (`string: <required>`) - Name of role. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/kmip/scope/myscope/role/myrole
-```
-
-## Generate credential
-
-| Method | Path                                                |
-| :----- | :-------------------------------------------------- |
-| `POST` | `/kmip/scope/:scope/role/:role/credential/generate` |
-
-Create a new client certificate tied to the given role and scope.
-This endpoint uses entropy augmentation to generate the client certificate
-if entropy augmentation is enabled.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-- `role` (`string: <required>`) - Name of role. This is part of the request URL.
-- `format` (`string: "pem"`) - Format to return the certificate, private key,
-  and CA chain in. One of `pem`, `pem_bundle`, or `der`.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    https://127.0.0.1:8200/v1/kmip/scope/myscope/role/myrole/credential/generate
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIICNzCCAZigAwIBAgIUKOGtsdXdMjjGni52EsaMQ7ozhCEwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE4NTgyMVoX\nDTI5MDYyMTE4NTg1MVowKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWlu\ndGVybWVkaWF0ZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEATHNhNvU0GMtzl6A\nPbNaCoF0jV3z09RCfLKEqMl/MXv/AlPcfiqCQeOWBwWHv76epPWkCCo+IlNq8ldQ\neVe52p6mABMvRjE6BZ/eLea27zImI6waK7nZ2hqx0npb8ivdbwmrgp0NQnv0sJ+o\nPeLa2vh9wDK1NJebmOv0yRAbCw2CH7Rbo2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYD\nVR0TAQH/BAgwBgEB/wIBCTAdBgNVHQ4EFgQU2naFRym+xfFvZm2TNRBXNf3MJSsw\nHwYDVR0jBBgwFoAUFrA/R807R0BnIt395KzaXdP4n00wCgYIKoZIzj0EAwIDgYwA\nMIGIAkIAkb8EdHCXgPpQsKYedMz4X2j5CFSVdZTWsPVw1XuSXIsIsc6018V4z9Kp\nkPacsHZTBR636y2toqRPDG4y9MLqFFkCQgCV1jEkiNhhKc+ZWuDjerdqNvLnCbe+\n7t4fiG9zQgWwh6IxL11cNyGVz9gS9af32DtuYf0xwFLOwLgn1RadC9Pd7Q==\n-----END CERTIFICATE-----",
-      "-----BEGIN CERTIFICATE-----\nMIICKTCCAYugAwIBAgIUOcs4pXlp+UgGiUKfKlcxIE/woPEwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE4NTgyMVoX\nDTI5MDYyMTE4NTg1MVowHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MIGb\nMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAcst7uNwu77WtLDkbz4ILYDiQ3BgS++qU\nOoNKcKyvNe8YX6PtrdQWPTaxT4MZNHZvTv+BAQTQqGLKrstpkjXPh+sBn7V4trkT\nMCtxUjIGneURUXS4IC/KJEA60P7ep7MrGnJfG/N4m+Q/a6BuxKhdEavXtepniCMz\npHw4DCpW/9m2t16jZjBkMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/\nAgEKMB0GA1UdDgQWBBQWsD9HzTtHQGci3f3krNpd0/ifTTAfBgNVHSMEGDAWgBQW\nsD9HzTtHQGci3f3krNpd0/ifTTAKBggqhkjOPQQDAgOBiwAwgYcCQR7iNoA4nBV3\ndSn8nfafklFvHZxoKR1j3nn+56z4JHD6TNr//GNqQiqnM3P//Tce+E4KzEax4xRg\nhaLURgPLNBjOAkIAqW+1/+v9D0vXOU1WPc+/oFvhSjYnr5qqcTL7by5fsmMXzAIe\nLODXiODxdppXXnMZPCPZh6MGgUwEGYeCnaXopWc=\n-----END CERTIFICATE-----"
-    ],
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIICOzCCAZygAwIBAgIUeOkn0HAdoh31nGkVKdafpCNuhFEwCgYIKoZIzj0EAwIw\nKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTAeFw0x\nOTA2MjQxOTAwMDlaFw0xOTA2MjUxOTAwMzlaMCAxDjAMBgNVBAsTBWlsVjYzMQ4w\nDAYDVQQDEwUyRnlWTjCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAA0rIy0h2DL3\nzmTXVj2v22Kz0N1EUUATlRgBj1XBsBA1Pdd7CSZoefmh/u6Z8TjtRX9Z1aj9Bb/d\nJxS3zB4mguULAF4k7bLH1gKXMVC6NYjjk3mfxH5jG4QY8S8n6uyqzNgI5KRJ2Hyj\nm8549Nvq3rvs8yOVXPSOGzkJ5KdUmSvXicMQo2cwZTAOBgNVHQ8BAf8EBAMCA6gw\nEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFEuzruLILCil5Fp32ZjE4AhD\nU268MB8GA1UdIwQYMBaAFNp2hUcpvsXxb2ZtkzUQVzX9zCUrMAoGCCqGSM49BAMC\nA4GMADCBiAJCAeeuaIsgO9ro7opzZ9y9hSHkKB5WA5Qc7ePoSiKHNNbVvIJMkjRQ\nC9YtUMQNnQ8wE6D/9xvR+9OBIi7t16iHGPGbAkIA6WIG6HHRNUXnHPIiW8iy/04O\nfVqZgJHJEeyGQbwdaehs+Z5xOz6TA4Z3uZOAMnPcb+KDwchnQ8CJnmT/KnnT5D8=\n-----END CERTIFICATE-----",
-    "private_key": "-----BEGIN EC PRIVATE KEY-----\nMIHcAgEBBEIBB4xDj9SUtb6Z466lVQIf3ucy21q5S2Fp9bzTQ0Ch5Vg2+DhUZUa1\nDjKvDdICY6hLPBFAwcOUFdDXr4kH/i8wuRWgBwYFK4EEACOhgYkDgYYABAANKyMt\nIdgy985k11Y9r9tis9DdRFFAE5UYAY9VwbAQNT3XewkmaHn5of7umfE47UV/WdWo\n/QW/3ScUt8weJoLlCwBeJO2yx9YClzFQujWI45N5n8R+YxuEGPEvJ+rsqszYCOSk\nSdh8o5vOePTb6t677PMjlVz0jhs5CeSnVJkr14nDEA==\n-----END EC PRIVATE KEY-----",
-    "serial_number": "728181095563584845125173905844944137943705466376"
-  }
-}
-```
-
-## Sign CSR
-
-| Method | Path                                            |
-| :----- | :---------------------------------------------- |
-| `POST` | `/kmip/scope/:scope/role/:role/credential/sign` |
-
-Create a new client certificate tied to the given role and scope,
-based on a Certificate Signing Request (CSR) provided as input.
-The key type and key bits used in the CSR must match those of the role.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-- `role` (`string: <required>`) - Name of role. This is part of the request URL.
-- `format` (`string: "pem"`) - Format to return the certificate, private key,
-  and CA chain in. One of `pem`, `pem_bundle`, or `der`.
-- `csr` (`string`) - CSR in PEM format.
-
-### Sample request
-
-```
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data '{"csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIC5DCCAcwCAQIwaTEMMAoGA1UEAwwDRUtNMQ8wDQYDVQQKDAZOZXRBcHAxEjAQ\nBgNVBAsMCVNvbGlkRmlyZTESMBAGA1UEBwwJU3Vubnl2YWxlMRMwEQYDVQQIDApD\nYWxpZm9ybmlhMQswCQYDVQQGEwJVUzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC\nAQoCggEBALFjeR5ZeKlTSLNKLr0Gl4DEH1oICDZj3oMYAEGMO/uW/4YleFmYSkPc\nxqqT/i6nlys+ZvLMtFdTr4lZBVsVD/AhjDVVBKuxaHIbolZFBjVxY3J2MuCWS2hB\nN2pRmGgnlpPwiu0VpA1bNJ/Shw3Zol9OnYliZAzc6U/hMxDUP7yQHSU5Q9T3vHV2\n3xR38PmeXKqdG+S68/cuhEHtUPa1mTagntkYU5BDOKpcmPenEam7itR+Tp1yZupp\n5sdfI/5trO4YI6jtUmMsA5PaNlKMDqzwjkiI8+kd+aDgIJa5c9VeEXC/PkjXRJ9G\nC/mSQOhM84EaYAU6zDw9B78j5ca2izsCAwEAAaA2MDQGCSqGSIb3DQEJDjEnMCUw\nDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA0GCSqGSIb3DQEB\nCwUAA4IBAQBXW2nA4EsNYDLo8gzBqsM3AFYTdYTO+Q2wu0fUZp3cX3AOIYFstW6/\nrCpdU3/z5ICS9i4ZHfJOAeKtBeOE+VCt7xI/+ZH1D7I9mNWZ7wp+ZXWImzRtEmBZ\nSj6wVa2Igmtiqr2UQegWnp5MG5Ds37DvmBoFDvcGMKy3tVJamSXFhqtdY2QSzYMM\nCjuqNUjll4RUUurjKmET8ZVHjLXGI3MxGVVg6aC3TtYuK12DFEFSy8LlfVn6kXS4\nPTe4Y6ffW5JykdW85xMq5RM6rpwsrVaKvVFOwn9O7lGZLeq4HFPcjY2SXZxAT+bi\nb/t+UQOjhlb0X2YdjPGHjFd+spZQ6u0a\n-----END CERTIFICATE REQUEST-----"}'
-    https://127.0.0.1:8200/v1/kmip/scope/myscope/role/myrole/credential/sign
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIICNzCCAZigAwIBAgIUKOGtsdXdMjjGni52EsaMQ7ozhCEwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE4NTgyMVoX\nDTI5MDYyMTE4NTg1MVowKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWlu\ndGVybWVkaWF0ZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEATHNhNvU0GMtzl6A\nPbNaCoF0jV3z09RCfLKEqMl/MXv/AlPcfiqCQeOWBwWHv76epPWkCCo+IlNq8ldQ\neVe52p6mABMvRjE6BZ/eLea27zImI6waK7nZ2hqx0npb8ivdbwmrgp0NQnv0sJ+o\nPeLa2vh9wDK1NJebmOv0yRAbCw2CH7Rbo2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYD\nVR0TAQH/BAgwBgEB/wIBCTAdBgNVHQ4EFgQU2naFRym+xfFvZm2TNRBXNf3MJSsw\nHwYDVR0jBBgwFoAUFrA/R807R0BnIt395KzaXdP4n00wCgYIKoZIzj0EAwIDgYwA\nMIGIAkIAkb8EdHCXgPpQsKYedMz4X2j5CFSVdZTWsPVw1XuSXIsIsc6018V4z9Kp\nkPacsHZTBR636y2toqRPDG4y9MLqFFkCQgCV1jEkiNhhKc+ZWuDjerdqNvLnCbe+\n7t4fiG9zQgWwh6IxL11cNyGVz9gS9af32DtuYf0xwFLOwLgn1RadC9Pd7Q==\n-----END CERTIFICATE-----",
-      "-----BEGIN CERTIFICATE-----\nMIICKTCCAYugAwIBAgIUOcs4pXlp+UgGiUKfKlcxIE/woPEwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE4NTgyMVoX\nDTI5MDYyMTE4NTg1MVowHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MIGb\nMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAcst7uNwu77WtLDkbz4ILYDiQ3BgS++qU\nOoNKcKyvNe8YX6PtrdQWPTaxT4MZNHZvTv+BAQTQqGLKrstpkjXPh+sBn7V4trkT\nMCtxUjIGneURUXS4IC/KJEA60P7ep7MrGnJfG/N4m+Q/a6BuxKhdEavXtepniCMz\npHw4DCpW/9m2t16jZjBkMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/\nAgEKMB0GA1UdDgQWBBQWsD9HzTtHQGci3f3krNpd0/ifTTAfBgNVHSMEGDAWgBQW\nsD9HzTtHQGci3f3krNpd0/ifTTAKBggqhkjOPQQDAgOBiwAwgYcCQR7iNoA4nBV3\ndSn8nfafklFvHZxoKR1j3nn+56z4JHD6TNr//GNqQiqnM3P//Tce+E4KzEax4xRg\nhaLURgPLNBjOAkIAqW+1/+v9D0vXOU1WPc+/oFvhSjYnr5qqcTL7by5fsmMXzAIe\nLODXiODxdppXXnMZPCPZh6MGgUwEGYeCnaXopWc=\n-----END CERTIFICATE-----"
-    ],
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIICOzCCAZygAwIBAgIUeOkn0HAdoh31nGkVKdafpCNuhFEwCgYIKoZIzj0EAwIw\nKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTAeFw0x\nOTA2MjQxOTAwMDlaFw0xOTA2MjUxOTAwMzlaMCAxDjAMBgNVBAsTBWlsVjYzMQ4w\nDAYDVQQDEwUyRnlWTjCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAA0rIy0h2DL3\nzmTXVj2v22Kz0N1EUUATlRgBj1XBsBA1Pdd7CSZoefmh/u6Z8TjtRX9Z1aj9Bb/d\nJxS3zB4mguULAF4k7bLH1gKXMVC6NYjjk3mfxH5jG4QY8S8n6uyqzNgI5KRJ2Hyj\nm8549Nvq3rvs8yOVXPSOGzkJ5KdUmSvXicMQo2cwZTAOBgNVHQ8BAf8EBAMCA6gw\nEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFEuzruLILCil5Fp32ZjE4AhD\nU268MB8GA1UdIwQYMBaAFNp2hUcpvsXxb2ZtkzUQVzX9zCUrMAoGCCqGSM49BAMC\nA4GMADCBiAJCAeeuaIsgO9ro7opzZ9y9hSHkKB5WA5Qc7ePoSiKHNNbVvIJMkjRQ\nC9YtUMQNnQ8wE6D/9xvR+9OBIi7t16iHGPGbAkIA6WIG6HHRNUXnHPIiW8iy/04O\nfVqZgJHJEeyGQbwdaehs+Z5xOz6TA4Z3uZOAMnPcb+KDwchnQ8CJnmT/KnnT5D8=\n-----END CERTIFICATE-----",
-    "serial_number": "728181095563584845125173905844944137943705466376"
-  }
-}
-```
-
-## Lookup credential
-
-| Method | Path                                              |
-| :----- | :------------------------------------------------ |
-| `GET`  | `/kmip/scope/:scope/role/:role/credential/lookup` |
-
-Read a certificate by serial number. The private key cannot be obtained except
-at generation time.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-- `role` (`string: <required>`) - Name of role. This is part of the request URL.
-- `serial_number` (`string: <required>`) - Serial number of certificate to revoke.
-- `format` (`string: "pem"`) - Format to return the certificate, private key,
-  and CA chain in. One of `pem`, `pem_bundle`, or `der`.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/kmip/scope/myscope/role/myrole/credential/lookup?serial_number=728181095563584845125173905844944137943705466376
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIICNzCCAZigAwIBAgIUGptwpwpVvxlx3sBniJ7TRGD9gCkwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE5MDY0N1oX\nDTI5MDYyMTE5MDcxN1owKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWlu\ndGVybWVkaWF0ZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEADO48mMu5V2PTbcg\nq0JPB5ReWwnUHhfFh/+XLP8ZM112JpOFutlcUYYZ23jAlvrlYZ+m1E0ASr0592ZM\n9CwIXy3zAJChPrV3tiofhINR5PPqCF42FcfNj4l7VN/XeYMN6dslX+O4dPn/DsbH\nZi7kWr5KSOR939ULFaRMYe3l2MxaYZ2do2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYD\nVR0TAQH/BAgwBgEB/wIBCTAdBgNVHQ4EFgQUPP7VJOGk3qR0qKqx3TLN1R8JDiQw\nHwYDVR0jBBgwFoAUBHr+hhaorPU2jIF35DTBDhL7uWowCgYIKoZIzj0EAwIDgYwA\nMIGIAkIA7G82rqLYb6bKrQZzhpNwvVIFOSocEJrUbP0E0D8dEeOmKs43C70P5e0s\nTrrpNAMEsK6vXWtM+QcrZZp+yyM6k3QCQgG8cxFIl8tgoMKWe0+cDeOoHtczopRy\nSk+Tt7DNNP9sfYK11g7w8xzbtW4ZuZKKoYRbxN+eQHn5c+8akMSt4h71Dg==\n-----END CERTIFICATE-----",
-      "-----BEGIN CERTIFICATE-----\nMIICKDCCAYugAwIBAgIUWv6jrjNbsvdX43l4s10HaJkSxOMwCgYIKoZIzj0EAwIw\nHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE5MDY0N1oX\nDTI5MDYyMTE5MDcxN1owHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MIGb\nMBAGByqGSM49AgEGBSuBBAAjA4GGAAQAP6C8d9ZUalKBM1NdALtEMlv+dwFnK88F\n8bp7i6hV55vER45FtKKciQwWoA91FjfWTrDYPHb1X4OPZvcjQGnIJ1AAj+BSzEWr\neJXNo46RxLLl+cndiVDqlbJlhE9qVn9ueLHhPIPNSFZneY9cTj5+EOPyKiBCo4xB\ndTtVr29lLu/JwM2jZjBkMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/\nAgEKMB0GA1UdDgQWBBQEev6GFqis9TaMgXfkNMEOEvu5ajAfBgNVHSMEGDAWgBQE\nev6GFqis9TaMgXfkNMEOEvu5ajAKBggqhkjOPQQDAgOBigAwgYYCQUlJqNoWCz4H\npjMNphxD4A8lfWtIrajGUhSxE9+JWRzoPpEJSwVobvryU2SO5u0sfqxtcmX/sBjY\n12N5QVFfqpB3AkErsjg8eMkh+OMalmWxRYtTuZt+i4DPm1CKEVIkUT8ZBXYTIl9V\nG3TG8lmby/8e+YUwJEKVvOy6tVI8ExEoVslwKw==\n-----END CERTIFICATE-----"
-    ],
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIICOjCCAZygAwIBAgIUf4zFBobFJMkSIvM7CfceSVfYNggwCgYIKoZIzj0EAwIw\nKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTAeFw0x\nOTA2MjQxOTA3MTBaFw0xOTA2MjUxOTA3NDBaMCAxDjAMBgNVBAsTBW5BcUswMQ4w\nDAYDVQQDEwU0Qjd2STCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAdxHrbr/EXUz\nzWCd9HMUDus6r/3QF1Y3u9dPD2UwM76J3aICmykkm7xoYpoyg4chBEDxBWh2YkGT\na4WFMoXBa+k1AZhdvlj8tjOUlYZrTCLB9FBPCGz3JB4f5cmbG5JVsQ8qnBPiyV3e\nU21cWM6mWlhZKHWIdBU2pj+eXW78K5LMu2sWo2cwZTAOBgNVHQ8BAf8EBAMCA6gw\nEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFAT0QZOpZCTMCz7F8+BvF2xs\nZSfkMB8GA1UdIwQYMBaAFDz+1SThpN6kdKiqsd0yzdUfCQ4kMAoGCCqGSM49BAMC\nA4GLADCBhwJBPxBV4DgPi5zihRnxu7zTNeqe/xlvrEt1uTff8QtW3JsigbBDHV+A\nxBe7vc8mL8VQPG7BFKvvxuQvOAeeQ+AR8ZoCQgDtbaWgLtfbzKvwlY48e6dLeBpK\nDu1DaZq+79EON2lhWQ+ULHblJc5cK0F6Ff5OC89aDnV1TWQDHeR91mZdYiWZZQ==\n-----END CERTIFICATE-----",
-    "serial_number": "728181095563584845125173905844944137943705466376"
-  }
-}
-```
-
-## List credential serial numbers
-
-| Method | Path                                       |
-| :----- | :----------------------------------------- |
-| `LIST` | `/kmip/scope/:scope/role/:role/credential` |
-
-List the serial numbers of all certificates within a role.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-- `role` (`string: <required>`) - Name of role. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/kmip/scope/myscope/role/myrole/credential
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["728181095563584845125173905844944137943705466376"]
-  }
-}
-```
-
-## Revoke credential
-
-| Method | Path                                              |
-| :----- | :------------------------------------------------ |
-| `POST` | `/kmip/scope/:scope/role/:role/credential/revoke` |
-
-Delete a certificate, thereby revoking it.
-
-### Parameters
-
-- `scope` (`string: <required>`) - Name of scope. This is part of the request URL.
-- `role` (`string: <required>`) - Name of role. This is part of the request URL.
-- `serial_number` (`string: ""`) - Serial number of certificate to revoke.
-  Exactly one of `serial_number` or `certificate` must be provided.
-- `certificate` (`string: """`) - Certificate to revoke, in PEM format.
-  Exactly one of `serial_number` or `certificate` must be provided.
-
-### Sample payload
-
-```json
-{
-  "serial_number": "728181095563584845125173905844944137943705466376"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/kmip/scope/myscope/role/myrole/credential/revoke
-```
diff --git a/website/content/api-docs/secret/kubernetes.mdx b/website/content/api-docs/secret/kubernetes.mdx
deleted file mode 100644
index bd1ff196114..00000000000
--- a/website/content/api-docs/secret/kubernetes.mdx
+++ /dev/null
@@ -1,422 +0,0 @@
----
-layout: api
-page_title: Kubernetes - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault Kubernetes secrets engine.
----
-
-# Kubernetes secrets engine (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault Kubernetes secrets engine. To
-learn more about the usage and operation, see the
-[Kubernetes secrets engine documentation](/vault/docs/secrets/kubernetes).
-
-This documentation assumes the Kubernetes secrets engine is mounted at the
-`/kubernetes` path in Vault. Since it is possible to enable secrets engines at
-any location, please update your API calls accordingly.
-
-## Write configuration
-
-This endpoint configures the plugin with the necessary information to reach the
-Kubernetes API and authenticate with it.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/kubernetes/config`      |
-
-### Parameters
-
-- `kubernetes_host` `(string: "https://$KUBERNETES_SERVICE_HOST:KUBERNETES_SERVICE_PORT_HTTPS")` -
-  Kubernetes API URL to connect to. Must be specified if the standard pod environment
-  variables `KUBERNETES_SERVICE_HOST` or `KUBERNETES_SERVICE_PORT_HTTPS` are not set.
-- `kubernetes_ca_cert` `(string: "")` - PEM encoded CA certificate to verify the
-  Kubernetes API server certificate. Defaults to the local pod's CA certificate
-  at `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt` if found, or
-  otherwise the host's root CA set.
-- `service_account_jwt` `(string: "")` - The JSON web token of the service account
-  used by the secrets engine to manage Kubernetes credentials. Defaults to the local pod's
-  JWT at `/var/run/secrets/kubernetes.io/serviceaccount/token` if found.
-- `disable_local_ca_jwt` `(bool: false)` - Disable defaulting to the local CA
-  certificate and service account JWT when running in a Kubernetes pod.
-
-### Sample payload
-
-```json
-{
-  "kubernetes_host": "https://192.168.99.100:8443",
-  "kubernetes_ca_cert": "-----BEGIN CERTIFICATE-----\n.....\n-----END CERTIFICATE-----"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/kubernetes/config
-```
-
-## Read configuration
-
-Returns the config previously set, excluding credentials.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/kubernetes/config`      |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/kubernetes/config
-```
-
-### Sample response
-
-```json
-{
-  "data":{
-    "kubernetes_host": "https://192.168.99.100:8443",
-    "kubernetes_ca_cert": "-----BEGIN CERTIFICATE-----.....-----END CERTIFICATE-----",
-    "disable_local_ca_jwt": false
-  }
-}
-```
-
-## Delete configuration
-
-Deletes the config previously set.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/kubernetes/config`      |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE
-    http://127.0.0.1:8200/v1/kubernetes/config
-```
-
-## Create role
-
-A role configures what service account tokens can be generated, and what
-permissions will be attached to them. The permissions attached to a service
-account token depend on the Kubernetes roles applied to its service account.
-
-Each Kubernetes secrets engine role can operate in one of 3 modes. Each successive
-mode generates more Kubernetes objects, and therefore requires more permissions
-for Vault's own Kubernetes service account.
-
-* Generate a service account token for a pre-existing service account - set `service_account_name`.
-* Generate a service account _and_ a token, and bind a pre-existing Kubernetes role - set `kubernetes_role_name`.
-* Generate a Kubernetes role, role binding, service account and token - set `generated_role_rules`.
-
-Only one of `service_account_name`, `kubernetes_role_name` or
-`generated_role_rules` can be set.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/kubernetes/roles/:name`     |
-
-### Parameters
-
-- `name` `(string: <required>)` - The name of the role. Included in the path.
-- `allowed_kubernetes_namespaces` `(array: [])` - The list of Kubernetes
-  namespaces this role can generate credentials for. If set to `"*"` all
-  namespaces are allowed. If set with `allowed_kubernetes_namespace_selector`, the conditions are
-  `OR`ed.
-- `allowed_kubernetes_namespace_selector` `(string: "")` - A label selector for Kubernetes
-  namespaces in which credentials can be generated. Accepts either a JSON or YAML object. The value
-  should be of type
-  [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta)
-  as illustrated in [Sample Payload 4](/vault/api-docs/secret/kubernetes#sample-payload-4) and
-  [Sample Payload 5](/vault/api-docs/secret/kubernetes#sample-payload-5) below.
-  If set with `allowed_kubernetes_namespaces`, the conditions are `OR`ed.
-- `token_max_ttl` `(string: "")` - The maximum TTL for generated Kubernetes
-  tokens, specified in seconds or as a Go duration format string, e.g. `"1h"`.
-  If not set or set to 0, the [system default](/vault/docs/configuration#max_lease_ttl) will be used.
-- `token_default_ttl` `(string: "")` - The default TTL for generated Kubernetes
-  tokens, specified in seconds or as a Go duration format string, e.g. `"1h"`.
-  If not set or set to 0, the [system default](/vault/docs/configuration#default_lease_ttl) will be used.
-- `token_default_audiences` `(string: "")` - The default intended audiences for generated Kubernetes
-  tokens, specified by a comma separated string. e.g `"custom-audience-0,custom-audience-1"`.
-  If not set or set to `""`, the Kubernetes cluster default for audiences of service account tokens will be used.
-- `service_account_name` `(string: "")` - The pre-existing service account to
-  generate tokens for. Mutually exclusive with all role parameters. If set, only
-  a Kubernetes token will be created when credentials are requested. See the
-  [Kubernetes service account documentation](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/)
-  for more details on service accounts.
-- `kubernetes_role_name` `(string: "")` - The pre-existing Role or ClusterRole
-  to bind a generated service account to. If set, Kubernetes token, service
-  account, and role binding objects will be created when credentials are requested.
-  See the [Kubernetes roles documentation](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole)
-  for more details on Kubernetes roles.
-- `kubernetes_role_type` `(string: "Role")` - Specifies whether the Kubernetes
-  role is a `Role` or `ClusterRole`.
-- `generated_role_rules` `(string: "")` - The Role or ClusterRole rules to use
-  when generating a role. Accepts either JSON or YAML formatted rules. If set, the
-  entire chain of Kubernetes objects will be generated when credentials are
-  requested. The value should be a `rules` key with an array of
-  [PolicyRule](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#policyrule-v1-rbac-authorization-k8s-io)
-  objects, as illustrated in the
-  [Kubernetes RBAC documentation](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
-  and [Sample Payload 3](/vault/api-docs/secret/kubernetes#sample-payload-3) below.
-- `name_template` `(string: "")` - The name template to use when generating
-  service accounts, roles and role bindings. If unset, a default template is
-  used. See [username templating](/vault/docs/concepts/username-templating)
-  for details on how to write a custom template.
-- `extra_annotations` `(map<string|string>: nil)` - Additional annotations to
-  apply to all generated Kubernetes objects. See the
-  [Kubernetes annotations documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/)
-  for more details on annotations.
-- `extra_labels` `(map<string|string>: nil)` - Additional labels to apply to
-  all generated Kubernetes objects. See the
-  [Kubernetes labels documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/)
-  for more details on labels.
-
-### Sample payload 1
-
-To generate tokens for a pre-existing service account:
-
-```json
-{
-  "allowed_kubernetes_namespaces": "*",
-  "service_account_name": "default",
-  "token_max_ttl": "24h"
-}
-```
-
-### Sample payload 2
-
-To generate tokens for a pre-existing ClusterRole:
-
-```json
-{
-  "allowed_kubernetes_namespaces": "*",
-  "kubernetes_role_type": "ClusterRole",
-  "kubernetes_role_name": "vault-k8s-secrets-role"
-}
-```
-
-### Sample payload 3
-
-To generate tokens for a defined set of Kubernetes role rules:
-
-```json
-{
-  "allowed_kubernetes_namespaces": "*",
-  "generated_role_rules": "rules:\n- apiGroups: [\"\"]\n  resources: [\"pods\"]\n  verbs: [\"list\"]\n",
-}
-```
-
-Or to define the same rules as JSON:
-
-```json
-{
-  "allowed_kubernetes_namespaces": "*",
-  "generated_role_rules": "'rules': [{'apiGroups': [''],'resources': ['pods'],'verbs': ['list']}]"
-}
-```
-
-### Sample payload 4
-
-To generate tokens in namespaces based on a label selector for the namespaces:
-
-```json
-{
-  "allowed_kubernetes_namespace_selector": "matchLabels:\n  stage: prod\n  sa-generator: vault",
-  "service_account_name": "default",
-}
-```
-
-Or to define the same selector as JSON:
-
-```json
-{
-  "allowed_kubernetes_namespace_selector": "'{'matchLabels':{'stage':'prod','sa-generator':'vault'}}",
-  "service_account_name": "default",
-}
-```
-
-### Sample payload 5
-
-To generate tokens in namespaces based on a label selector for the namespaces and via a normal
-namespace array:
-
-```json
-{
-  "allowed_kubernetes_namespaces": "vault-system,testing",
-  "allowed_kubernetes_namespace_selector": "'{'matchLabels':{'stage':'prod','sa-generator':'vault'}}",
-  "service_account_name": "default",
-}
-```
-
-In the payload above, the token can be generated for any namespace that either contains the labels
-defined in the selector, or is named `vault-system` or `testing`.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/kubernetes/roles/default-role
-```
-
-## Read role
-
-Returns the previously configured role.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `GET`  | `/kubernetes/roles/:name`     |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/kubernetes/role/default-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "additional_metadata": {},
-    "allowed_kubernetes_namespaces": [
-      "*"
-    ],
-    "generated_role_rules": "",
-    "kubernetes_role_name": "",
-    "kubernetes_role_type": "Role",
-    "name": "default-role",
-    "name_template": "",
-    "service_account_name": "default",
-    "token_default_ttl": 0,
-    "token_max_ttl": 86400
-  }
-}
-```
-
-## List roles
-
-Lists all the roles that are configured.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `LIST` | `/kubernetes/roles`               |
-| `GET`  | `/kubernetes/roles?list=true`     |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/kubernetes/roles
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["default-role", "prod-role"]
-  }
-}
-```
-
-## Delete role
-
-Deletes the previously configured role.
-
-| Method   | Path                          |
-| :------- | :---------------------------- |
-| `DELETE` | `/kubernetes/roles/:role`     |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/kubernetes/role/default-role
-```
-
-## Generate credentials
-
-Generate a service account token.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/kubernetes/creds/:role` |
-
-### Parameters
-
-- `role` `(string: <required>)` - Name of the role to generate credentials for.
-- `kubernetes_namespace` `(string)` - The name of the Kubernetes
-  namespace in which to generate the credentials. Optional if the Vault role is configured
-  with a single namespace that is not `"*"`; required otherwise.
-- `cluster_role_binding` `(bool: false)` - If true, generate a ClusterRoleBinding
-  to grant permissions across the whole cluster instead of within a namespace.
-  Requires the Vault role to have `kubernetes_role_type` set to ClusterRole.
-- `ttl` `(string: "")` - The TTL of the generated Kubernetes service account token,
-  specified in seconds or as a Go duration format string, e.g. `"1h"`. The TTL
-  returned may be different from the TTL specified due to limits specified in
-  Kubernetes, Vault system-wide controls, or role-specific controls.
-- `audiences` `(string: "")` - A comma separated string containing the intended audiences
-  of the generated Kubernetes service account the token, e.g.  `"custom-audience-0,custom-audience-1"`.
-  If not set or set to `""`,
-  the [token_default_audiences](/vault/api-docs/secret/kubernetes#token_default_audiences) will be used.
-
-### Sample payload
-
-```json
-{
-  "kubernetes_namespace": "default",
-  "ttl": "1h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/kubernetes/creds/default-role
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "58fefc6c-5195-c17a-94f2-8f889f3df57c",
-  "lease_id": "kubernetes/creds/default-role/aWczfcfJ7NKUdiirJrPXIs38",
-  "renewable": false,
-  "lease_duration": 3600,
-  "data": {
-    "service_account_name": "default",
-    "service_account_namespace": "default",
-    "service_account_token": "eyJhbG..."
-  }
-}
-```
diff --git a/website/content/api-docs/secret/kv/index.mdx b/website/content/api-docs/secret/kv/index.mdx
deleted file mode 100644
index 6abdfbaa7d4..00000000000
--- a/website/content/api-docs/secret/kv/index.mdx
+++ /dev/null
@@ -1,15 +0,0 @@
----
-layout: api
-page_title: KV - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault KV secrets engine.
----
-
-# KV secrets engine (API)
-
-This backend can be run in one of two versions. Each of which have a distinct API.
-Choose the version below you are running. For more information on the KV secrets
-engine see the [Vault kv documentation](/vault/docs/secrets/kv).
-
-- [KV Version 1 API](/vault/api-docs/secret/kv/kv-v1)
-
-- [KV Version 2 API](/vault/api-docs/secret/kv/kv-v2)
diff --git a/website/content/api-docs/secret/kv/kv-v1.mdx b/website/content/api-docs/secret/kv/kv-v1.mdx
deleted file mode 100644
index 029d5fa349f..00000000000
--- a/website/content/api-docs/secret/kv/kv-v1.mdx
+++ /dev/null
@@ -1,166 +0,0 @@
----
-layout: api
-page_title: KV - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault KV secrets engine, version 1.
----
-
-# KV secrets engine - version 1 (API)
-
-This is the API documentation for the Vault KV secrets engine. For general
-information about the usage and operation of the version 1 KV secrets engine, please
-see the [Vault KV documentation](/vault/docs/secrets/kv/kv-v1). For information
-about the differences between KV version 1 and version 2, please [see the KV overview
-documentation](/vault/docs/secrets/kv).
-
-~> Note: This documentation assumes the kv secrets engine is enabled at the
-`/secret` path in Vault. Since it is possible to enable secrets engines at any
-location, please update your API calls accordingly.
-
-## Read secret
-
-This endpoint retrieves the secret at the specified location.
-
-| Method | Path            |
-| :----- | :-------------- |
-| `GET`  | `/secret/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the secret to read.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/secret/my-secret
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "data": {
-    "foo": "bar",
-    "ttl": "1h"
-  },
-  "lease_duration": 3600,
-  "lease_id": "",
-  "renewable": false
-}
-```
-
-_Note_: the `lease_duration` field, which will be populated if a "ttl" field
-was included in the data, is advisory. No lease is created. This is a way for
-writers to indicate how often a given value should be re-read by the client.
-See the [Vault KV secrets engine documentation](/vault/docs/secrets/kv/kv-v1#ttls)
-for more details.
-
-## List secrets
-
-This endpoint returns a list of key names at the specified location. Folders are
-suffixed with `/`. The input must be a folder; list on a file will not return a
-value. Note that no policy-based filtering is performed on keys; do not encode
-sensitive information in key names. The values themselves are not accessible via
-this API.
-
-| Method | Path            |
-| :----- | :-------------- |
-| `LIST` | `/secret/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the secrets to list.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/secret/my-secret
-```
-
-### Sample response
-
-The example below shows output for a query path of `secret/` when there are
-secrets at `secret/foo` and `secret/foo/bar`; note the difference in the two
-entries.
-
-```json
-{
-  "auth": null,
-  "data": {
-    "keys": ["foo", "foo/"]
-  },
-  "lease_duration": 2764800,
-  "lease_id": "",
-  "renewable": false
-}
-```
-
-## Create/Update secret
-
-This endpoint stores a secret at the specified location. If the value does not
-yet exist, the calling token must have an ACL policy granting the `create`
-capability. If the value already exists, the calling token must have an ACL
-policy granting the `update` capability.
-
-| Method | Path            |
-| :----- | :-------------- |
-| `POST` | `/secret/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the secrets to
-  create/update. This is specified as part of the URL.
-
-- `:key` `(string: "")` – Specifies a key in the payload, paired with an associated value, to
-  be held at the given location. Multiple key/value pairs can be specified, and
-  all will be returned on a read operation. A key called `ttl` will trigger
-  some special behavior. See the [Vault KV secrets engine
-  documentation](/vault/docs/secrets/kv/kv-v1#ttls) for details.
-
-### Sample payload
-
-```json
-{
-  "foo": "bar",
-  "zip": "zap"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/secret/my-secret
-```
-
-## Delete secret
-
-This endpoint deletes the secret at the specified location.
-
-| Method   | Path            |
-| :------- | :-------------- |
-| `DELETE` | `/secret/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the secret to delete.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/secret/my-secret
-```
diff --git a/website/content/api-docs/secret/kv/kv-v2.mdx b/website/content/api-docs/secret/kv/kv-v2.mdx
deleted file mode 100644
index 317652d9e2e..00000000000
--- a/website/content/api-docs/secret/kv/kv-v2.mdx
+++ /dev/null
@@ -1,758 +0,0 @@
----
-layout: api
-page_title: KV - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault KV secrets engine, version 2.
----
-
-# KV secrets engine - version 2 (API)
-
-This is the API documentation for the Vault KV secrets engine while running in
-versioned mode. For general information about the usage and operation of the version 2
-KV secrets engine, please see the [Vault KV documentation](/vault/docs/secrets/kv/kv-v2).
-For information about the differences between KV version 1 and version 2, please [see the KV overview
-documentation](/vault/docs/secrets/kv).
-
-## Configure the KV engine
-
-This path configures backend level settings that are applied to every key in the
-key-value store.
-
-| Method | Path                         |
-|:-------|:-----------------------------|
-| `POST` | `/:secret-mount-path/config` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount to config,
-  such as `secret`. This is specified as part of the URL.
-
-- `max_versions` `(int: 0)` – The number of versions to keep per key. This value
-  applies to all keys, but a key's metadata setting can overwrite this value.
-  Once a key has more than the configured allowed versions, the oldest version
-  will be permanently deleted. When 0 is used or the value is unset, Vault
-  will keep 10 versions.
-
-- `cas_required` `(bool: false)` – If true all keys will require the cas
-  parameter to be set on all write requests.
-
-- `delete_version_after` `(string:"0s")` – If set, specifies the length
-  of time before a version is deleted.
-  Accepts [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-```json
-{
-  "max_versions": 5,
-  "cas_required": false,
-  "delete_version_after": "3h25m19s"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/secret/config
-```
-
-## Read KV engine configuration
-
-This path retrieves the current configuration for the secrets backend at the
-given path.
-
-| Method | Path                         |
-|:-------|:-----------------------------|
-| `GET`  | `/:secret-mount-path/config` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount to read the config,
-  of, such as `secret`. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/secret/config
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "cas_required": false,
-    "delete_version_after": "3h25m19s",
-    "max_versions": 0
-  }
-}
-```
-
-## Read secret version
-
-This endpoint retrieves the secret at the specified location. The metadata
-fields `created_time`, `deletion_time`, `destroyed`, and `version` are version
-specific. The `custom_metadata` field is part of the secret's key metadata and
-is included in the response whether or not the calling token has `read` access to
-the associated [metadata endpoint](/vault/api-docs/secret/kv/kv-v2#read-secret-metadata).
-
-| Method | Path                                                     |
-|:-------|:---------------------------------------------------------|
-| `GET`  | `/:secret-mount-path/data/:path?version=:version-number` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to read, such as `secret`. This is specified as part of the URL.
-- `path` `(string: <required>)` – Specifies the path of the secret to read.
-  This is specified as part of the URL.
-- `version` `(int: 0)` - Specifies the version to return. If not set the latest
-  version is returned.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/secret/data/my-secret?version=2
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "data": {
-      "foo": "bar"
-    },
-    "metadata": {
-      "created_time": "2018-03-22T02:24:06.945319214Z",
-      "custom_metadata": {
-        "owner": "jdoe",
-        "mission_critical": "false"
-      },
-      "deletion_time": "",
-      "destroyed": false,
-      "version": 2
-    }
-  }
-}
-```
-
-## Create/Update secret
-
-This endpoint creates a new version of a secret at the specified location. If
-the value does not yet exist, the calling token must have an ACL policy granting
-the `create` capability. If the value already exists, the calling token must
-have an ACL policy granting the `update` capability.
-
-| Method | Path                             |
-|:-------|:---------------------------------|
-| `POST` | `/:secret-mount-path/data/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to update, such as `secret`. This is specified as part of the URL.
-
-- `path` `(string: <required>)` – Specifies the path of the secret to update.
-  This is specified as part of the URL.
-
-- `options` `(Map: <optional>)` – An object that holds option settings.
-
-  - `cas` `(int: <optional>)` - This flag is required if `cas_required` is set
-    to true on either the secret or the engine's config. If not set the write
-    will be allowed. In order for a write to be successful, `cas` must be set to
-    the current version of the secret. If set to 0 a write will only be allowed if
-    the key doesn't exist as unset keys do not have any version information. Also
-    remember that soft deletes do not remove any underlying version data from storage.
-    In order to write to a soft deleted key, the cas parameter must match the key's
-    current version.
-
-- `data` `(Map: <required>)` – The contents of the data map will be stored and
-  returned on read.
-
-### Sample payload
-
-```json
-{
-  "options": {
-    "cas": 0
-  },
-  "data": {
-    "foo": "bar",
-    "zip": "zap"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/secret/data/my-secret
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "created_time": "2018-03-22T02:36:43.986212308Z",
-    "custom_metadata": {
-      "owner": "jdoe",
-      "mission_critical": "false"
-    },
-    "deletion_time": "",
-    "destroyed": false,
-    "version": 1
-  }
-}
-```
-
-## Patch secret
-
-This endpoint provides the ability to patch an _existing_ secret at the specified
-location. The secret must neither be deleted nor destroyed. The calling token must
-have an ACL policy granting the `patch` capability. Currently, only
-[JSON merge patch](https://datatracker.ietf.org/doc/html/draft-ietf-appsawg-json-merge-patch-07)
-is supported and must be specified using a `Content-Type` header value of
-`application/merge-patch+json`. A new version will be created upon successfully
-applying a patch with the provided data.
-
-| Method  | Path                             |
-|:--------|:---------------------------------|
-| `PATCH` | `/:secret-mount-path/data/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-   the secret to patch, such as `secret`. This is specified as part of the URL.
-
-- `path` `(string: <required>)` – Specifies the path of the secret to patch.
-   This is specified as part of the URL.
-
-- `options` `(Map: <optional>)` – An object that holds option settings.
-
-  - `cas` `(int: <optional>)` - This flag is required if `cas_required` is set to true on either
-    the secret or the engine's config. In order for a write to be successful, `cas` must be set
-    to the current version of the secret. A patch operation must be attempted on an existing
-    key, thus the provided `cas` value must be greater than 0.
-
-- `data` `(Map: <required>)` – The contents of the data map will be applied as a partial
-  update to the existing entry via a JSON merge patch to the existing entry.
-
-### Sample payload
-
-```json
-{
-  "options": {
-    "cas": 1
-  },
-  "data": {
-    "foo": "a",
-    "bar": {
-      "baz": "b"
-    }
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --header "Content-Type: application/merge-patch+json"
-    --request PATCH \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/secret/data/my-secret
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "created_time": "2021-09-10T15:26:08.684999Z",
-    "custom_metadata": {
-      "owner": "jdoe",
-      "mission_critical": "false"
-    },
-    "deletion_time": "",
-    "destroyed": false,
-    "version": 2
-  }
-}
-```
-
-## Read secret subkeys
-
-This endpoint provides the subkeys within a secret entry that exists
-at the requested path. The secret entry at this path will be retrieved
-and stripped of all data by replacing underlying values of leaf keys
-(i.e. non-map keys or map keys with no underlying subkeys) with `null`.
-
-| Method | Path                                |
-|:-------|:------------------------------------|
-| `GET`  | `/:secret-mount-path/subkeys/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to read, such as `secret`. This is specified as part of the URL.
-- `path` `(string: <required>)` – Specifies the path of the secret to read.
-  This is specified as part of the URL.
-- `version` `(int: 0)` - Specifies the version to return. If not set the latest
-  version is returned.
-- `depth` `(int: 0)` - Specifies the deepest nesting level to provide in the output.
-  The default value 0 will not impose any limit. If non-zero, keys that reside at the
-  specified `depth` value will be artificially treated as leaves and will thus be `null`
-  even if further underlying subkeys exist.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/secret/subkeys/my-secret?version=1
-```
-
-### Sample secret data
-
-```json
-{
-  "foo": "abc",
-  "bar": {
-    "baz": "def"
-  },
-  "quux": {}
-}
-```
-
-### Sample response
-
-```json
-{
-  "subkeys": {
-    "foo": null,
-    "bar": {
-      "baz": null
-    },
-    "quux": null
-  },
-  "metadata": {
-    "created_time": "2021-12-14T20:28:00.773477Z",
-    "custom_metadata": null,
-    "deletion_time": "",
-    "destroyed": false,
-    "version": 1
-  }
-}
-```
-
-## Delete latest version of secret
-
-This endpoint issues a soft delete of the secret's latest version at the
-specified location. This marks the version as deleted and will stop it from
-being returned from reads, but the underlying data will not be removed. A
-delete can be undone using the `undelete` path.
-
-| Method   | Path                 |
-| :------- | :------------------- |
-| `DELETE` | `/:secret-mount-path/data/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to delete, such as `secret`. This is specified as part of the URL.
-- `path` `(string: <required>)` – Specifies the path of the secret to delete.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/secret/data/my-secret
-```
-
-## Delete secret versions
-
-This endpoint issues a soft delete of the specified versions of the secret. This
-marks the versions as deleted and will stop them from being returned from reads,
-but the underlying data will not be removed. A delete can be undone using the
-`undelete` path.
-
-| Method | Path                               |
-|:-------|:-----------------------------------|
-| `POST` | `/:secret-mount-path/delete/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to delete, such as `secret`. This is specified as part of the URL.
-- `path` `(string: <required>)` – Specifies the path of the secret to delete.
-  This is specified as part of the URL.
-- `versions` `([]int: <required>)` - The versions to be deleted. The versioned
-  data will not be deleted, but it will no longer be returned in normal get
-  requests.
-
-### Sample payload
-
-```json
-{
-  "versions": [1, 2]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/secret/delete/my-secret
-```
-
-## Undelete secret versions
-
-Undeletes the data for the provided version and path in the key-value store.
-This restores the data, allowing it to be returned on get requests.
-
-| Method | Path                                 |
-|:-------|:-------------------------------------|
-| `POST` | `/:secret-mount-path/undelete/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to undelete, such as `secret`. This is specified as part of the URL.
-
-- `path` `(string: <required>)` – Specifies the path of the secret to undelete.
-  This is specified as part of the URL.
-
-- `versions` `([]int: <required>)` - The versions to undelete. The versions will
-  be restored and their data will be returned on normal get requests.
-
-### Sample payload
-
-```json
-{
-  "versions": [1, 2]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/secret/undelete/my-secret
-```
-
-## Destroy secret versions
-
-Permanently removes the specified version data for the provided key and version
-numbers from the key-value store.
-
-| Method | Path                                |
-|:-------|:------------------------------------|
-| `PUT`  | `/:secret-mount-path/destroy/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to destroy, such as `secret`. This is specified as part of the URL.
-
-- `path` `(string: <required>)` – Specifies the path of the secret to destroy.
-  This is specified as part of the URL.
-
-- `versions` `([]int: <required>)` - The versions to destroy. Their data will be
-  permanently deleted.
-
-### Sample payload
-
-```json
-{
-  "versions": [1, 2]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request PUT \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/secret/destroy/my-secret
-```
-
-## List secrets
-
-This endpoint returns a list of key names at the specified location. Folders are
-suffixed with `/`. The input must be a folder; list on a file will not return a
-value. Note that no policy-based filtering is performed on keys; do not encode
-sensitive information in key names. The values themselves are not accessible via
-this command. 
-
-To list secrets for KV v2, a user must have a policy granting them the list capability on this `/metadata/` path - even if all the rest of their interactions with the KV v2 are via the `/data/` APIs. Access to at least list the `/metadata/` path should typically also be granted.
-
-| Method | Path                                 |
-|:-------|:-------------------------------------|
-| `LIST` | `/:secret-mount-path/metadata/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-the secret to list, such as `secret`. This is specified as part of the URL.
-
-- `path` `(string: <required>)` – Specifies the path of the secrets to list.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    https://127.0.0.1:8200/v1/secret/metadata/my-secret
-```
-
-### Sample response
-
-The example below shows output for a query path of `secret/` when there are
-secrets at `secret/foo` and `secret/foo/bar`; note the difference in the two
-entries.
-
-```json
-{
-  "data": {
-    "keys": ["foo", "foo/"]
-  }
-}
-```
-
-## Read secret metadata
-
-This endpoint retrieves the metadata and versions for the secret at the
-specified path. Metadata is version-agnostic.
-
-| Method | Path                                 |
-|:-------|:-------------------------------------|
-| `GET`  | `/:secret-mount-path/metadata/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to read, such as `secret`. This is specified as part of the URL.
-
-- `path` `(string: <required>)` – Specifies the path of the secret to read.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/secret/metadata/my-secret
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "cas_required": false,
-    "created_time": "2018-03-22T02:24:06.945319214Z",
-    "current_version": 3,
-    "delete_version_after": "3h25m19s",
-    "max_versions": 0,
-    "oldest_version": 0,
-    "updated_time": "2018-03-22T02:36:43.986212308Z",
-    "custom_metadata": {
-      "foo": "abc",
-      "bar": "123",
-      "baz": "5c07d823-3810-48f6-a147-4c06b5219e84"
-    },
-    "versions": {
-      "1": {
-        "created_time": "2018-03-22T02:24:06.945319214Z",
-        "deletion_time": "",
-        "destroyed": false
-      },
-      "2": {
-        "created_time": "2018-03-22T02:36:33.954880664Z",
-        "deletion_time": "",
-        "destroyed": false
-      },
-      "3": {
-        "created_time": "2018-03-22T02:36:43.986212308Z",
-        "deletion_time": "",
-        "destroyed": false
-      }
-    }
-  }
-}
-```
-
-## Create/Update metadata
-
-This endpoint creates or updates the metadata of a secret at the specified location.
-It does not create a new version.
-
-| Method | Path                                 |
-|:-------|:-------------------------------------|
-| `POST` | `/:secret-mount-path/metadata/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to update, such as `secret`. This is specified as part of the URL.
-
-- `path` `(string: <required>)` – Specifies the path of the secret to update.
-  This is specified as part of the URL.
-
-- `max_versions` `(int: 0)` – The number of versions to keep per key. If not
-  set, the backend’s configured max version is used. Once a key has more than
-  the configured allowed versions, the oldest version will be permanently
-  deleted.
-
-- `cas_required` `(bool: false)` – If true, the key will require the `cas`
-  parameter to be set on all write requests. If false, the backend’s
-  configuration will be used.
-
-- `delete_version_after` `(string:"0s")` – Set the `delete_version_after` value
-  to a duration to specify the `deletion_time` for all new versions
-  written to this key. If not set, the backend's `delete_version_after` will be
-  used. If the value is greater than the backend's `delete_version_after`, the
-  backend's `delete_version_after` will be used. Accepts [duration format
-  strings](/vault/docs/concepts/duration-format).
-
-- `custom_metadata` `(map<string|string>: nil)` - A map of arbitrary string to string valued user-provided metadata meant
-  to describe the secret.
-
-### Sample payload
-
-```json
-{
-  "max_versions": 5,
-  "cas_required": false,
-  "delete_version_after": "3h25m19s",
-  "custom_metadata": {
-    "foo": "abc",
-    "bar": "123",
-    "baz": "5c07d823-3810-48f6-a147-4c06b5219e84"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/secret/metadata/my-secret
-```
-
-## Patch metadata
-
-This endpoint patches an existing metadata entry of a secret at the specified
-location. The calling token must have an ACL policy granting the `patch`
-capability. Currently, only JSON merge patch is supported and must be specified
-using a `Content-Type` header value of `application/merge-patch+json`. It does
-not create a new version.
-
-| Method  | Path                                 |
-|:--------|:-------------------------------------|
-| `PATCH` | `/:secret-mount-path/metadata/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to patch, such as `secret`. This is specified as part of the URL.
-
-- `path` `(string: <required>)` – Specifies the path of the secret to patch.
-  This is specified as part of the URL.
-
-- `max_versions` `(int: 0)` – The number of versions to keep per key. If not
-  set, the backend’s configured max version is used. Once a key has more than
-  the configured allowed versions, the oldest version will be permanently
-  deleted.
-
-- `cas_required` `(bool: false)` – If true, the key will require the `cas`
-  parameter to be set on all write requests. If false, the backend’s
-  configuration will be used.
-
-- `delete_version_after` `(string:"0s")` – Set the `delete_version_after` value
-  to a duration to specify the `deletion_time` for all new versions
-  written to this key. If not set, the backend's `delete_version_after` will be
-  used. If the value is greater than the backend's `delete_version_after`, the
-  backend's `delete_version_after` will be used. Accepts [duration format
-  strings](/vault/docs/concepts/duration-format).
-
-- `custom_metadata` `(map<string|string>: nil)` - A map of arbitrary string to string valued user-provided metadata meant
-  to describe the secret.
-
-### Sample payload
-
-```json
-{
-  "max_versions": 5,
-  "custom_metadata": {
-    "bar": "123"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --header "Content-Type: application/merge-patch+json"
-    --request PATCH \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/secret/metadata/my-secret
-```
-
-## Delete metadata and all versions
-
-This endpoint permanently deletes the key metadata and all version data for the
-specified key. All version history will be removed.
-
-| Method   | Path                     |
-|:---------|:-------------------------|
-| `DELETE` | `/:secret-mount-path/metadata/:path` |
-
-### Parameters
-
-- `secret-mount-path` `(string: <required>)` - The path to the KV mount containing
-  the secret to delete, such as `secret`. This is specified as part of the URL.
-
-- `path` `(string: <required>)` – Specifies the path of the secret to delete.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    https://127.0.0.1:8200/v1/secret/metadata/my-secret
-```
diff --git a/website/content/api-docs/secret/ldap.mdx b/website/content/api-docs/secret/ldap.mdx
deleted file mode 100644
index dadb4e8f60f..00000000000
--- a/website/content/api-docs/secret/ldap.mdx
+++ /dev/null
@@ -1,811 +0,0 @@
----
-layout: api
-page_title: LDAP - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault LDAP secrets engine.
----
-
-# LDAP secrets engine (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault LDAP secrets engine. For general
-information about the usage and operation of the LDAP secrets engine,
-please see the [LDAP secrets engine docs](/vault/docs/secrets/ldap).
-
-This documentation assumes the LDAP secrets engine is enabled at the `/ldap` path
-in Vault. Since it is possible to mount secrets engines at any path, please
-update your API calls accordingly.
-
-## Configuration management
-
-This endpoint configures the LDAP secret engine to manage user entries.
-
-| Method   | Path               |
-| :------- | :----------------- |
-| `POST`   | `/ldap/config` |
-| `GET`    | `/ldap/config` |
-| `DELETE` | `/ldap/config` |
-
--> **Note**: The LDAP entry used by `config` should have the necessary privileges
-to search and change entry passwords in LDAP.
-
-### Parameters
-
-- `binddn` `(string: <required>)` - Distinguished name (DN) of object to bind for managing user entries.
-  For example, `cn=vault,ou=Users,dc=hashicorp,dc=com`.
-- `bindpass` `(string: <required>)` - Password to use along with `binddn` for managing user entries.
-- `url` `(string: "ldap://127.0.0.1")` - The LDAP server to connect to. Examples: `ldaps://ldap.myorg.com`,
-  `ldaps://ldap.myorg.com:636`. This can also be a comma-delineated list of URLs, e.g.
-  `ldaps://ldap.myorg.com, ldaps://ldap.myorg.com:636`, in which case the servers will be tried in-order if
-  there are errors during the connection process.`.
-- `password_policy` `(string: <optional>)` - The name of the [password policy](/vault/docs/concepts/password-policies)
-  to use to generate passwords. Note that this accepts the name of the policy, not the policy itself.
-- `schema` `(string: "openldap")` - The LDAP schema to use when storing entry passwords.
-  Valid schemas include `openldap`, `ad`, and `racf`.
-- `userdn` `(string: <optional>)` - The base DN under which to perform user search in
-  [library management](/vault/api-docs/secret/ldap#library-management) and [static roles](/vault/api-docs/secret/ldap#static-roles).
-  For example, `ou=Users,dc=hashicorp,dc=com`.
-- `userattr` `(string: <optional>)` – The attribute field name used to perform user search
-  in [library management](/vault/api-docs/secret/ldap#library-management) and [static roles](/vault/api-docs/secret/ldap#static-roles).
-  Defaults to `cn` for the `openldap` schema, `userPrincipalName` for the `ad` schema, and
-  `racfid` for the `racf` schema.
-- `upndomain` (string: `optional`) - The domain (userPrincipalDomain) used to construct a UPN
-  string for authentication. The constructed UPN will appear as `[binddn]@[upndomain]`. For
-  example, if `upndomain=example.com` and `binddn=admin`, the UPN string `admin@example.com`
-  will be used to log in to Active Directory.
-- `request_timeout` `(integer: 90, string: "90s" <optional>)` - Timeout, in seconds, for the connection when
-  making requests against the server before returning back an error.
-- `starttls` `(bool: <optional>)` - If true, issues a `StartTLS` command after establishing an unencrypted connection.
-- `insecure_tls` `(bool: <optional>)` - If true, skips LDAP server SSL certificate verification - insecure,
-  use with caution!
-- `certificate` `(string: <optional>)` - CA certificate to use when verifying LDAP server certificate, must be
-  x509 PEM encoded.
-- `client_tls_cert` `(string: <optional>)` - Client certificate to provide to the LDAP server, must be x509
-  PEM encoded.
-- `client_tls_key` `(string: <optional>)` - Client key to provide to the LDAP server, must be x509 PEM encoded.
-- `skip_static_role_import_rotation` `(bool: false)` - The default value to use for `skip_import_rotation` when
-  creating static roles. This field can be overridden on an individual role level during [role creation](#static-roles).
-  See the [static roles section](#static-roles) for more detailed information and caveats.
-
-**Deprecated Parameters**:
-
-- `length` `(int: 64)` - The length of generated password strings. Note: some schemas may require shorter
-  password lengths (such as `racf`). Mutually exclusive with `password_policy`
-- `connection_timeout` `(integer: 30 or string: "30s")` - Timeout, in
-   seconds, before trying the next URL in your Vault configuration when
-   attempting to connect to your LDAP server. When both
-   `connection_timeout` and `request_timeout` are set, Vault uses the
-   smaller of the two values for connection **and** request timeouts.
-
-**Note about password generation**:
-
-`length` and `password_policy` cannot both be set in the configuration. The `POST` endpoint will reject the
-configuration if both are specified.
-
-- If neither are set, this will default to a reasonable default password generation algorithm (the same algorithm as
-  prior to the introduction of password policies).
-- If `length` is set, the same algorithm is used, but with the length specified instead of the default length.
-- If `password_policy` is set, the password will be generated from the associated
-  [password policy](/vault/docs/concepts/password-policies). The policy is not exercised prior to saving the configuration.
-  The policy will need to exist prior to passwords needing to be generated by this engine, but does not need to exist
-  prior to saving the configuration.
-
-See [LDAP secrets engine docs](/vault/docs/secrets/ldap) for additional information.
-
-### Sample payload
-
-```json
-{
-  "binddn": "cn=vault,ou=Users,dc=hashicorp,dc=com",
-  "bindpass": "pa$$w0rd",
-  "url": "ldaps://127.0.0.11"
-}
-```
-
-### Sample POST request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ldap/config
-```
-
-### Sample GET request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    https://127.0.0.1:8200/v1/ldap/config
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "binddn": "cn=admin,dc=hashicorp,dc=com",
-    "case_sensitive_names": false,
-    "certificate": "",
-    "insecure_tls": false,
-    "length": 64,
-    "schema": "openldap",
-    "starttls": false,
-    "tls_max_version": "tls12",
-    "tls_min_version": "tls12",
-    "url": "ldap://127.0.0.1"
-  }
-}
-```
-
-## Rotate root password
-
-The `rotate-root` endpoint offers password rotation for the `binddn` entry used to manage LDAP.
-This generated password will only be known to Vault and will not be retrievable once rotated.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/ldap/rotate-root` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/ldap/rotate-root
-```
-
-## Static roles
-
-The `static-role` endpoint configures Vault to manage the passwords of existing individual LDAP entries.
-
-| Method   | Path                               |
-| :------- | :--------------------------------- |
-| `GET`    | `/ldap/static-role`            |
-| `GET`    | `/ldap/static-role/:role_name` |
-| `POST`   | `/ldap/static-role/:role_name` |
-| `DELETE` | `/ldap/static-role/:role_name` |
-
-### Parameters
-
-- `username` `(string: <required>)` - The username of the existing LDAP entry to manage
-  password rotation for. LDAP search for the username will be rooted at the [userdn](/vault/api-docs/secret/ldap#userdn)
-  configuration value. The attribute to use when searching for the user can be configured
-  with the [userattr](/vault/api-docs/secret/ldap#userattr) configuration value. This is useful
-  when `dn` isn't used for login purposes (such as SSH). Cannot be modified after creation.<br />
-  **Example:** `"bob"`
-- `dn` `(string: <optional>)` - Distinguished name (DN) of the existing LDAP entry to manage
-  password rotation for. If given, it will take precedence over `username` for the LDAP
-  search performed during password rotation. Cannot be modified after creation.<br />
-  **Example:** `cn=bob,ou=Users,dc=hashicorp,dc=com`
-- `rotation_period` `(string: <required>)` - How often Vault should rotate the password of the user entry. Accepts
-  [duration format strings](/vault/docs/concepts/duration-format). The minimum rotation period is 5 seconds.<br />
-  **Example:** `"3600", "5s", "1h"`
-- `skip_import_rotation` `(boolean: false)` - When set on a role creation request, Vault will not rotate the
-  pre-existing password of the associated LDAP entry. Note: This means that Vault will not be able to supply the
-  password to `GET` requests until the password is rotated (either automatically or manually by `rotate-role`). This
-  field overrides `skip_static_role_import_rotation` from the ldap config if both are set.
-
-### Sample payload
-
-```json
-{
-  "dn": "cn=hashicorp,ou=Users,dc=hashicorp,dc=com",
-  "rotation_period": "24h",
-  "username": "hashicorp"
-}
-```
-
-### Sample POST request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ldap/static-role/hashicorp
-```
-
-### Sample GET request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/ldap/static-role/hashicorp
-```
-
-### Sample GET response
-
-```json
-{
-  "data": {
-    "dn": "uid=hashicorp,ou=Users,dc=hashicorp,dc=com",
-    "last_vault_rotation": "2020-02-19T11:31:53.7812-05:00",
-    "rotation_period": 86400,
-    "username": "hashicorp"
-  }
-}
-```
-
-### Sample LIST response
-
-```json
-["hashicorp", "bob"]
-```
-
-## Static role passwords
-
-The `static-cred` endpoint offers the credential information for a given static-role.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `GET`  | `/ldap/static-cred/:role_name` |
-
-#### Sample get request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/ldap/static-cred/hashicorp
-```
-
-#### Sample get response
-
-```json
-{
-  "dn": "uid=hashicorp,ou=Users,dc=hashicorp,dc=com",
-  "last_vault_rotation": "2020-02-19T11:31:53.7812-05:00",
-  "password": "LTNfyn7pS7XEZIxEYQ2sEAWic02PEP7zSvIs0xMqIjaU0ORzLhKOKVmYLxL1Xkyv",
-  "last_password": "?@09AZSen9TzUwK7ZhafS7B0GuWGraQjfWEna5SwnmF/tVaKFqjXhhGV/Z0v/pBJ",
-  "rotation_period": 86400,
-  "ttl": 86072,
-  "username": "hashicorp"
-}
-```
-
-## Manually rotate static role password
-
-The `rotate-role` endpoint rotates the password of an existing static role.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `POST` | `/ldap/rotate-role/:role_name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/ldap/rotate-role/:role_name
-```
-
-## Dynamic roles
-
-Create or update a dynamic role configuration. This provides instructions to Vault on how to create an
-LDAP domain user account.
-
-### Create/Delete dynamic role configuration
-
-Creates, updates, or deletes a dynamic role.
-
-| Method   | Path                        |
-| :------- | :-------------------------- |
-| `POST`   | `/ldap/role/:role_name` |
-| `DELETE` | `/ldap/role/:role_name` |
-
-The `POST` endpoint allows for partial updates of existing roles. If a role exists and a `POST` request is made
-against it, only the keys specified in the request will be updated. To delete a value, specify the key with an
-empty string as the value. Example: `vault write ldap/role/myrole default_ttl=""`
-
-#### Parameters
-
-- `role_name` `(string, required)` - The name of the dynamic role.
-- `creation_ldif` `(string, required)` - A templatized LDIF string used to create a user account. This may contain
-  multiple LDIF entries. The `creation_ldif` can also be used to add the user account to an **_existing_** group.
-  All LDIF entries are performed in order. If Vault encounters an error while executing the `creation_ldif` it will
-  stop at the first error and not execute any remaining LDIF entries. If an error occurs and `rollback_ldif` is
-  specified, the LDIF entries in `rollback_ldif` will be executed. See `rollback_ldif` for more details. This field
-  may optionally be provided as a base64 encoded string.
-- `deletion_ldif` `(string, required)` - A templatized LDIF string used to delete the user account once its TTL has
-  expired. This may contain multiple LDIF entries. All LDIF entries are performed in order. If Vault encounters an
-  error while executing an entry in the `deletion_ldif` it will attempt to continue executing any remaining entries.
-  This field may optionally be provided as a base64 encoded string.
-- `rollback_ldif` `(string, not required but recommended)` - A templatized LDIF string used to attempt to rollback
-  any changes in the event that execution of the `creation_ldif` results in an error. This may contain multiple LDIF
-  entries. All LDIF entries are performed in order. If Vault encounters an error while executing an entry in the
-  `rollback_ldif` it will attempt to continue executing any remaining entries. This field may optionally be provided
-  as a base64 encoded string.
-- `username_template` `(string)` - A template used to generate a dynamic username. This will be used to fill in the
-  `.Username` field within the `creation_ldif` string.
-
-<details>
-<summary><b>Default Username Template</b></summary>
-
-```
-v_{{.DisplayName}}_{{.RoleName}}_{{random 10}}_{{unix_time}}
-```
-
-<details>
-<summary><b>Example Usernames:</b></summary>
-
-| Example       |                                            |
-| ------------- | ------------------------------------------ |
-| `DisplayName` | `token`                                    |
-| `RoleName`    | `myrolename`                               |
-| Username      | `v_token_myrolename_uszt1n4cyh_1614294836` |
-
-| Example       |                                                                      |
-| ------------- | -------------------------------------------------------------------- |
-| `DisplayName` | `amuchlonger_dispname`                                               |
-| `RoleName`    | `role-name-with-dashes`                                              |
-| Username      | `v_amuchlonger_dispname_role-name-with-dashes_s0t9xb0jsa_1614294836` |
-
-</details>
-</details>
-
-- `default_ttl` `(string/int)` - Specifies the TTL for the leases associated with this role. Accepts
-  [duration format strings](/vault/docs/concepts/duration-format). Defaults to system/engine default TTL time.
-- `max_ttl` `(string/int)` - Specifies the maximum TTL for the leases associated with this role. Accepts
-  [duration format strings](/vault/docs/concepts/duration-format). Defaults to system/mount default TTL time;
-  this value is allowed to be less than the mount max TTL (or, if not set, the system max TTL),
-  but it is not allowed to be longer.
-
-The `creation_ldif`, `deletion_ldif`, `rollback_ldif`, and `username_template` fields are all templated fields. See
-[Username Templating](/vault/docs/concepts/username-templating) for details on how to use templating. Also see
-[Templates](#templates) for specifics on what data is available for each template.
-
-#### Sample payload
-
-Sample LDIF files:
-
-`creation.ldif`:
-
-```
-dn: cn={{.Username}},ou=users,dc=learn,dc=example
-objectClass: person
-objectClass: top
-cn: learn
-sn: {{.Password | utf16le | base64}}
-memberOf: cn=dev,ou=groups,dc=learn,dc=example
-userPassword: {{.Password}}
-```
-
-`deletion.ldif` & `rollback.ldif`:
-
-```
-dn: cn={{.Username}},ou=users,dc=learn,dc=example
-changetype: delete
-```
-
-Full Payload:
-
-```json
-{
-  "creation_ldif": "...",
-  "deletion_ldif": "...",
-  "rollback_ldif": "...",
-  "username_template": "...",
-  "default_ttl": "1h",
-  "max_ttl": "24h"
-}
-```
-
--> Note: The LDIF statements may optionally be base64 encoded. If they are base64 encoded when creating/updating the
-role configuration, the decoded version will be returned from the `GET` endpoint.
-
-#### Sample POST request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ldap/role/dynamic-role
-```
-
-### Read dynamic role configuration
-
-Retrieves a dynamic role's configuration.
-
-| Method | Path                        |
-| ------ | --------------------------- |
-| `GET`  | `/ldap/role/:role_name` |
-
-#### Response
-
-`200 OK`
-
-```json
-{
-  "creation_ldif": "...",
-  "default_ttl": 1800,
-  "deletion_ldif": "...",
-  "max_ttl": 0,
-  "rollback_ldif": "...",
-  "username_template": "..."
-}
-```
-
-### Templates
-
-LDIF and username templates use the [Go template syntax](https://golang.org/pkg/text/template/) to construct the
-LDIF/username that will be executed against the server. This is done because certain values (such as the username
-and password within an LDIF statement) are not known at configuration time. Additionally, the template gives a
-lot of flexibility to the operator to construct the LDIF and username.
-
-Templated fields are delimited by `{{` and `}}`. To reference a field (such as the generated `Username`), a period is
-placed in front of the field name. Example: `{{.Username}}`. Spaces can be included between `{{` and `}}`. For instance:
-`{{.Username|lowercase}}` is the same as `{{ .Username | lowercase }}`.
-
-If a field needs to be modified (such as SHA256 hashing, base64 encoding, etc.) the value can be sent to one of the
-[built-in functions](#template-functions). This uses a "pipe" syntax: `{{.Username | base64}}`. Values may be "piped"
-to multiple functions: `{{.Username | lowercase | base64}}`
-
-#### LDIF template fields
-
-The following parameters are available within the LDIF templates:
-
-`.Username` - The name of the generated user (optionally from `username_template`).<br />
-**Default pattern:** `v_<display name>_<role name>_<10 random chars>_<unix timestamp>`
-
-`.Password` - The generated password (optionally from
-[password policies](/vault/docs/concepts/password-policies))
-
-`.RoleName` - The name of the role that credentials are being generated for.
-
-`.DisplayName` - The display name associated with the authentication token used to make the credentials request.
-
-`.IssueTime` - The time that the lease was created. This time may be slightly earlier than the associated lease due to
-where this value is calculated compared with where Vault calculates details of the lease.<br />
-**Format:** 2006-01-02T15:04:05Z07:00 ([RFC3339](https://golang.org/pkg/time/#pkg-constants))
-
-`.IssueTimeSeconds` - The [unix time](https://en.wikipedia.org/wiki/Unix_time) the lease was created. This time may
-be slightly earlier than the associated lease due to where this value is calculated compared with where Vault
-calculates details of the lease.<br />
-**Format:** Integer indicating the number of seconds elapsed since January 1, 1970.
-
-`.ExpirationTime` - The time that the lease is set to expire. This time may be slightly earlier than the associated
-lease due to where this value is calculated compared with where Vault calculates details of the lease.<br />
-**Format:** 2006-01-02T15:04:05Z07:00 ([RFC3339](https://golang.org/pkg/time/#pkg-constants))
-
-`.ExpirationTimeSeconds` - The [unix time](https://en.wikipedia.org/wiki/Unix_time) the lease is set to expire. This
-time may be slightly earlier than the associated lease due to where this value is calculated compared with where Vault
-calculates details of the lease.<br />
-**Format:** Integer indicating the number of seconds elapsed since January 1, 1970.
-
-#### Username template fields
-
-The following parameters are available within the username template:
-
-**Important note:** If any of the following fields include dashes or underscores, they will not be removed/changed
-unless explicitly done so within the username template. For instance:
-
-If `RoleName` is `test-role` and the `username_template` is `v_{{.RoleName}}_{{unix_time}}`, the result of this template
-may be: `v_test-role_1234567890`. Note the `-` (dash) in the `test-role`. If the LDAP system Vault is managing
-restricts usernames/DNs to not allow for dashes (or other characters), the template must explicitly modify/remove those
-characters. In this example, the template can be changed to `v_{{.RoleName | replace "-" "_"}}` to replace
-the dashes with underscores. See [Template Functions](#template-functions) for more functions available.
-
-`.RoleName` - The name of the role the credentials are being generated from.
-
-`.DisplayName` - The display name associated with the user making the request against Value.
-
-#### Template functions
-
-Both the LDIF templates and the username template use the [Go template language](https://golang.org/pkg/text/template)
-so all [functions](https://golang.org/pkg/text/template/#hdr-Functions) and capabilities from that language are
-supported including functions such as `printf`.
-
-In addition to the functions available through the template language, the following custom functions are also available:
-
-`random` - Generates a random string from lowercase letters, uppercase letters, and numbers. Must include a
-number indicating how many characters to generate.<br />
-**Example:** `{{random 20}}` generates 20 random characters
-
-`truncate` - truncates the previous value to the provided number of characters.<br />
-**Example:** `{{.FieldName | truncate 10}}`
-
-`truncate_sha256` - Truncates the previous value to the provided number of characters. The last 8 characters of the
-truncated value will be the first 8 characters of the SHA256 hash of the truncated characters.
-
-This can aid in identifying values (such as the role & display names) if they need to be truncated to a particular
-length, particularly if the value has common prefixes. An example of this is having many roles with a common prefix in
-the name of the role, but the role name is truncated such that only the prefix is shown. This function will keep the
-non-prefix part of the role name in the username which will aid in identification while also keeping uniqueness.
-
-**Example:**<br />
-`v_{{.RoleName | truncate_sha256 15}}_{{unix_time}}`. <br />
-If two roles exist for this template, `myreallylongprefix-foobar` and `myreallylongprefix-bazqux`, the username for the first role
-would be `v_myrealle6da86ec_1234567890` and the username for the second role would be `v_myrealld0420a55_1234567890`.
-
-`uppercase` - Uppercases the provided value.<br />
-**Example:** `{{.FieldName | uppercase}}`
-
-`lowercase` - Lowercases the provided value.<br />
-**Example:** `{{.FieldName | lowercase}}`
-
-`replace` - Find/replace on the provided value.<br />
-**Example:** `{{.FieldName | replace "-" "_"}}`
-
-`sha256` - SHA256 hashes the provided value.<br />
-**Example:** `{{.FieldName | sha256}}`
-
-`base64` - Base64 encodes the provided value.<br />
-**Example:** `{{.FieldName | base64}}`
-
-`unix_time` - The current unix timestamp (number of seconds since Jan 1 1970).<br />
-**Example:** `{{unix_time}}`
-
-`unix_time_millis` - The current unix timestamp in milliseconds.<br />
-**Example:** `{{unix_time_millis}}`
-
-`timestamp` - The current time. Must provide a formatting string based on Go’s time package.<br />
-**Example:** `{{timestamp "2006-01-02T15:04:05Z"}}`
-
-`uuid` - Generates a random UUID.<br />
-**Example:** `{{uuid}}`
-
-##### LDIF template functions
-
-Additionally, the LDIF templates include an additional function to facilitate Active Directory password handling.
-The username template cannot use this function.
-
-`utf16le` - Encodes the provided value into UTF16-LE.<br />
-**Example:** `{{.FieldName | utf16le}}`
-
-## Dynamic role passwords
-
-The `creds` endpoint offers the credential information for a given dynamic role.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `GET`  | `/ldap/creds/:role_name` |
-
-#### Sample get request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/ldap/creds/dynamic-role
-```
-
-#### Sample get response
-
-```json
-{
-  "distinguished_names": [
-    "cn=v_token-dispname_testrole_jmZMnjS42a_1680580467,ou=users,dc=hashicorp,dc=com"
-  ],
-  "password": "OWexB3OzYYLFiotWxUS2EheGpriwR20fa2yA7JGTsnBREcxyqpwf73htofMihxcC",
-  "username": "v_token-dispname_testrole_jmZMnjS42a_1680580467"
-}
-```
-
-## Library set management
-
-The `library` endpoint configures the sets of service accounts that Vault will offer for check-out.
-
-| Method   | Path                    |
-| :------- | :---------------------- |
-| `LIST`   | `/ldap/library`           |
-| `POST`   | `/ldap/library/:set_name` |
-| `GET`    | `/ldap/library/:set_name` |
-| `DELETE` | `/ldap/library/:set_name` |
-
-When adding a service account to the library, Vault verifies it already exists in the LDAP directory.
-
-### Parameters
-
-- `name` `(string: "", required)` - The name of the set of service accounts.
-- `service_account_names` `(string: "", or list: [] required)` - The names of all the service accounts that can be
-  checked out from this set. These service accounts must only be used by Vault, and may only be in one set. These
-  service accounts must already exist in the LDAP directory.
-- `ttl` `(duration: "24h", optional)` - The maximum amount of time a single check-out lasts before Vault
-  automatically checks it back in. Defaults to 24 hours. Setting it to zero reflects an unlimited lending period.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-- `max_ttl` `(duration: "24h", optional)` - The maximum amount of time a check-out last with renewal before Vault
-  automatically checks it back in. Defaults to 24 hours. Setting it to zero reflects an unlimited lending period.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-- `disable_check_in_enforcement` `(bool: false, optional)` - Disable enforcing that service accounts must be
-  checked in by the entity or client token that checked them out. Defaults to false.
-
-### Sample POST request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ldap/library/accounting-team
-```
-
-### Sample POST payload
-
-```json
-{
-  "service_account_names": ["fizz@example.com", "buzz@example.com"],
-  "ttl": "10h",
-  "max_ttl": "20h",
-  "disable_check_in_enforcement": false
-}
-```
-
-### Sample GET response
-
-```json
-{
-  "service_account_names": ["fizz@example.com", "buzz@example.com"],
-  "ttl": "10h",
-  "max_ttl": "20h",
-  "disable_check_in_enforcement": false
-}
-```
-
-### Sample LIST response
-
-Performing a `LIST` on the `/ldap/library` endpoint will list the names of all the sets of service accounts Vault contains.
-
-```json
-["accounting-team"]
-```
-
-## Library set status check
-
-This endpoint provides the check-out status of service accounts in a library set.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/ldap/library/:set_name/status` |
-
-### Sample GET request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/ldap/library/accounting-team/status
-```
-
-### Sample GET response
-
-```json
-{
-  "request_id": "9e44c8b5-d142-5867-2a11-49f3ba71215a",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "buzz@example.com": {
-      "available": true
-    },
-    "fizz@example.com": {
-      "available": false,
-      "borrower_client_token": "4c653e473bf7e27c6759fccc3def20c44d776279",
-      "borrower_entity_id": "631256b1-8523-9838-5501-d0a1e2cdad9c"
-    }
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Check-Out management
-
-This endpoint provides service account check out for a library set.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `POST` | `/ldap/library/:set_name/check-out` |
-
-Returns a `200` if a credential is available, and a `400` if no credential is available.
-
-### Parameters
-
-- `name` `(string: "", required)` - The name of the set of service accounts.
-- `ttl` `(duration: "", optional)` - The maximum amount of time a check-out lasts before Vault
-  automatically checks it back in. Setting it to zero reflects an unlimited lending period.
-  Defaults to the set's `ttl`. If the requested `ttl` is higher than the set's, the set's will be used.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample POST request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ldap/library/accounting-team/check-out
-```
-
-### Sample POST payload
-
-```json
-{
-  "ttl": "1h"
-}
-```
-
-### Sample POST response
-
-```json
-{
-  "request_id": "364a17d4-e5ab-998b-ceee-b49929229e0c",
-  "lease_id": "ad/library/accounting-team/check-out/aoBsaBEI4PK96VnukubvYDlZ",
-  "renewable": true,
-  "lease_duration": 36000,
-  "data": {
-    "password": "?@09QW0KZ8DSBu3deIu7XLY1NZqzwhozmMAZ6v0IcZJGOjs5GvpVMvOeW7/duls2",
-    "service_account_name": "fizz@example.com"
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Check-In management
-
-By default, check-in must be called by the same entity or client token used for check-out.
-To disable this behavior, use the `disable_check_in_enforcement` toggle on the library set. Or, use
-the `ad/library/manage/:set_name/check-in` behavior to force check-in of the account. Access to the
-"manage" endpoint should only be granted to highly privileged Vault users, like Vault operators.
-
-If a caller attempts to check in a service account they're not authorized to check in, they will
-receive an error response. If they attempt to check in a service account they _are_ authorized to
-check in, but it's _already_ checked in, they will receive a successful response but the account
-will not be included in the `check_ins` listed. `check_ins` shows which service accounts were checked
-in _by this particular call_.
-
-| Method | Path                                    |
-| :----- | :-------------------------------------- |
-| `POST` | `/ldap/library/:set_name/check-in`        |
-| `POST` | `/ldap/library/manage/:set_name/check-in` |
-
-### Parameters
-
-- `name` `(string: "", required)` - The name of the set of service accounts.
-- `service_account_names` `(string: "", or list: [] optional)` - The names of all the service accounts to be
-  checked in. May be omitted if only one is checked out.
-
-### Sample POST request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ldap/library/accounting-team/check-in
-```
-
-### Sample POST payload
-
-```json
-{
-  "service_account_names": ["fizz@example.com"]
-}
-```
-
-### Sample POST response
-
-```json
-{
-  "request_id": "db45c714-3f68-b748-95bc-8f7467637a52",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "check_ins": ["fizz@example.com"]
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
diff --git a/website/content/api-docs/secret/mongodbatlas.mdx b/website/content/api-docs/secret/mongodbatlas.mdx
deleted file mode 100644
index 1c3d7564782..00000000000
--- a/website/content/api-docs/secret/mongodbatlas.mdx
+++ /dev/null
@@ -1,254 +0,0 @@
----
-layout: api
-page_title: MongoDB Atlas - Secrets Engines - HTTP API
-description: |-
-  The MongoDB Atlas Secrets Engine for Vault generates MongoDB Atlas Programmatic API Keys dynamically.
----
-
-# MongoDB atlas secrets engine
-
-The MongoDB Atlas Secrets Engine generates Programmatic API keys for MongoDB Atlas. This allows one to manage the lifecycle of these MongoDB Atlas secrets through Vault. The created MongoDB Atlas secrets are
-time-based and are automatically revoked when the Vault lease expires, unless renewed. Vault will create a Programmatic API key for each lease scoped to the MongoDB Atlas project or organization denoted with the included role(s). An IP Whitelist may also be configured for the Programmatic API key with desired IPs and/or CIDR blocks.
-
-The MongoDB Atlas Programmatic API Key Public and
-Private Key is returned to the caller. To learn more about Programmatic API Keys visit the [Programmatic API Keys Doc](https://docs.atlas.mongodb.com/reference/api/apiKeys/).
-
-## Configure connection
-
-In addition to the parameters defined by the Secrets Engines Backend, this plugin has a number of parameters to further configure a connection.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/mongodbatlas/config` |
-
-### Parameters
-
-- `public_key` `(string: <required>)` – The Public Programmatic API Key used to authenticate with the MongoDB Atlas API.
-- `private_key` `(string: <required>)` - The Private Programmatic API Key used to connect with MongoDB Atlas API.
-
-### Sample payload
-
-```json
-{
-  "public_key": "yhltsvan",
-  "private_key": "2c130c23-e6b6-4da8-a93f-a8bf33218830"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/mongodbatlas/config
-```
-
-## Create/Update programmatic API key role
-
-Programmatic API Key credential types create a Vault role to generate a Programmatic API Key at
-either the MongoDB Atlas Organization or Project level with the designated role(s) for programmatic access. If a role with the name does not exist, it will be created. If the role exists, it will be updated with the new attributes.
-
-| Method | Path           |
-| :----- | :------------- |
-| `POST` | `/roles/:name` |
-
-### Parameters
-
-- `name` `(string <required>)` - Unique identifier name of the role name
-- `organization_id` `(string <required>)` - Unique identifier for the organization to which
-  the target API Key belongs. Use the [orgs endpoint](https://www.mongodb.com/docs/atlas/reference/api/organization-get-all/)
-  to retrieve all organizations to which the authenticated user has access. Required if
-  `project_id` is not set.
-- `project_id` `(string <required>)` - Unique identifier for the project to which the target
-  API Key belongs. Use the [projects endpoint](https://www.mongodb.com/docs/atlas/reference/api/project-get-all/)
-  to retrieve all organizations to which the authenticated user has access. Required if
-  `organization_id` is not set.
-- `roles` `(list [string] <required>)` - List of roles that the API Key needs to have. If the roles array is provided:
-
-  -> **IMPORTANT:** Provide at least one role. Make sure all roles must be valid for the Organization or Project.
-
-  -> **NOTE:** Include all roles that you want this API Key to have. Any roles not in this array are removed.
-
-  - The Organization roles are:
-
-    - `ORG_OWNER`
-    - `ORG_MEMBER`
-    - `ORG_GROUP_CREATOR`
-    - `ORG_BILLING_ADMIN`
-    - `ORG_READ_ONLY`
-
-  - The Project roles are:
-    - `GROUP_CHARTS_ADMIN`
-    - `GROUP_CLUSTER_MANAGER`
-    - `GROUP_DATA_ACCESS_ADMIN`
-    - `GROUP_DATA_ACCESS_READ_ONLY`
-    - `GROUP_DATA_ACCESS_READ_WRITE`
-    - `GROUP_OWNER`
-    - `GROUP_READ_ONLY`
-
-* `ip_addresses` `(list [string] <Optional>)` - IP address to be added to the whitelist for the API key. This field is mutually exclusive with the cidrBlock field.
-* `cidr_blocks` `(list [string] <Optional>)` - Whitelist entry in CIDR notation to be added for the API key. This field is mutually exclusive with the ipAddress field.
-* `project_roles` `(list [string] <Optional>)` - Roles assigned when an Organization API key is assigned to a Projects API key.
-* `ttl` `(string <Optional>)` - Duration in seconds after which the issued credential should expire. Defaults to 0, in which case the value will fallback to the system/mount defaults.
-* `max_ttl` `(string <Optional>)` - The maximum allowed lifetime of credentials issued using this role.
-
-
-### Sample payload
-
-```json
-{
-  "project_id": "5cf5a45a9ccf6400e60981b6",
-  "roles": ["GROUP_CLUSTER_MANAGER"],
-  "cidr_blocks": ["192.168.1.3/32"],
-  "ip_addresses": ["192.168.1.3", "192.168.1.4"]
-}
-```
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/mongodbatlas/roles/test-programmatic-key
-```
-
-### Sample response
-
-```json
-{
-  "project_id": "5cf5a45a9ccf6400e60981b6",
-  "roles": ["GROUP_CLUSTER_MANAGER"],
-  "cidr_blocks": ["192.168.1.3/32"],
-  "ip_addresses": ["192.168.1.3", "192.168.1.4"],
-  "organization_id": "7cf5a45a9ccf6400e60981b7",
-  "ttl": "30m",
-  "max_ttl": "1h"
-}
-```
-
-## Read programmatic API key role
-
-| Method | Path           |
-| :----- | :------------- |
-| `GET`  | `/roles/:name` |
-
-### Parameters
-
-- `name` `(string <required>)` - Unique identifier name of the role name
-
-### Sample payload
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    --data @payload.json \
-    http://127.0.0.1:8200/mongodbatlas/roles/test-programmatic-key
-```
-
-### Sample response
-
-```json
-{
-  "project_id": "5cf5a45a9ccf6400e60981b6",
-  "roles": ["GROUP_CLUSTER_MANAGER"],
-  "cidr_blocks": ["192.168.1.3/32"],
-  "ip_addresses": ["192.168.1.3", "192.168.1.4"],
-  "organization_id": "7cf5a45a9ccf6400e60981b7",
-  "ttl": "30m",
-  "max_ttl": "1h"
-}
-```
-
-## List programmatic API key role
-
-| Method | Path     |
-| :----- | :------- |
-| `GET`  | `/roles` |
-
-### Sample payload
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    --data @payload.json \
-    http://127.0.0.1:8200/mongodbatlas/roles
-```
-
-### Sample response
-
-```json
-[
-  {
-    "project_id": "5cf5a45a9ccf6400e60981b6",
-    "roles": ["GROUP_CLUSTER_MANAGER"],
-    "cidr_blocks": ["192.168.1.3/32"],
-    "ip_addresses": ["192.168.1.3", "192.168.1.4"],
-    "organization_id": "7cf5a45a9ccf6400e60981b7",
-    "ttl": "30m",
-    "max_ttl": "1h"
-  },
-  {
-    "project_id": "5cf5a45a9ccf6400e60981b6",
-    "roles": ["READ"],
-    "cidr_blocks": ["192.168.1.3/35"],
-    "ip_addresses": ["192.168.1.5", "192.168.1.6"],
-    "organization_id": "7cf5a45a9ccf6400e60981b7",
-    "ttl": "30m",
-    "max_ttl": "1h"
-  }
-]
-```
-
-## Delete programmatic API key role
-
-| Method   | Path           |
-| :------- | :------------- |
-| `DELETE` | `/roles/:name` |
-
-### Parameters
-
-- `name` `(string <required>)` - Unique identifier name of the role name
-
-### Sample payload
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    --data @payload.json \
-    http://127.0.0.1:8200/mongodbatlas/roles/test-programmatic-key
-```
-
-## Read credential
-
-| Method | Path           |
-| :----- | :------------- |
-| `GET`  | `/creds/:name` |
-
-### Parameters
-
-- `name` `(string <required>)` - Unique identifier name of the credential
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/mongodbatlas/creds/0fLBv1c2YDzPlJB1PwsRRKHR
-```
-
-### Sample response
-
-```json
-{
-  "lease_duration": "20s",
-  "lease_renewable": true,
-  "description": "vault-test-1563980947-1318",
-  "private_key": "905ae89e-6ee8-40rd-ab12-613t8e3fe836",
-  "public_key": "klpruxce"
-}
-```
diff --git a/website/content/api-docs/secret/nomad.mdx b/website/content/api-docs/secret/nomad.mdx
deleted file mode 100644
index 1f315117362..00000000000
--- a/website/content/api-docs/secret/nomad.mdx
+++ /dev/null
@@ -1,332 +0,0 @@
----
-layout: api
-page_title: Nomad Secrets Engine- HTTP API
-description: This is the API documentation for the Vault Nomad secrets engine.
----
-
-# Nomad secrets engine (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault Nomad secrets engine. For general
-information about the usage and operation of the Nomad secrets engine, please see the
-[Vault Nomad secrets engine documentation](/vault/docs/secrets/nomad).
-
-This documentation assumes the Nomad secrets engine is mounted at the `/nomad` path
-in Vault. Since it is possible to mount secrets engines at any location, please
-update your API calls accordingly.
-
-## Configure access
-
-This endpoint configures the access information for Nomad. This access
-information is used so that Vault can communicate with Nomad and generate
-Nomad tokens.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/nomad/config/access` |
-
-### Parameters
-
-- `address` `(string: "")` – Specifies the address of the Nomad
-  instance, provided as `"protocol://host:port"` like `"http://127.0.0.1:4646"`.
-  This value can also be provided on individual calls with the NOMAD_ADDR
-  environment variable.
-
-- `token` `(string: "")` – Specifies the Nomad Management token to use.
-  This value can also be provided on individual calls with the NOMAD_TOKEN
-  environment variable.
-
-- `max_token_name_length` `(int: <optional>)` – Specifies the maximum length to
-  use for the name of the Nomad token generated with [Generate
-  Credential](#generate-credential). If omitted, `0` is used and ignored,
-  defaulting to the max value allowed by the Nomad version. For Nomad versions
-  0.8.3 and earlier, the default is `64`. For Nomad version 0.8.4 and later, the default is
-  `256`.
-
-- `ca_cert` `(string: "")` - CA certificate to use when verifying Nomad server certificate,
-  must be x509 PEM encoded.
-
-- `client_cert` `(string: "")` - Client certificate used for Nomad's TLS communication,
-  must be x509 PEM encoded and if this is set you need to also set client_key.
-
-- `client_key` `(string: "")` - Client key used for Nomad's TLS communication,
-  must be x509 PEM encoded and if this is set you need to also set client_cert.
-
-### Sample payload
-
-```json
-{
-  "address": "http://127.0.0.1:4646",
-  "token": "adha...",
-  "max_token_name_length": 256
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/nomad/config/access
-```
-
-## Read access configuration
-
-This endpoint queries for information about the Nomad connection.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/nomad/config/access` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/nomad/config/access
-```
-
-### Sample response
-
-```json
-  "data": {
-    "address": "http://localhost:4646/"
-  }
-```
-
-## Configure lease
-
-This endpoint configures the lease settings for generated tokens.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `POST` | `/nomad/config/lease` |
-
-### Parameters
-
-- `ttl` `(string: "")` – Specifies the ttl for the lease. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `max_ttl` `(string: "")` – Specifies the max ttl for the lease. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-```json
-{
-  "ttl": 1800,
-  "max_ttl": 3600
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/nomad/config/lease
-```
-
-## Read lease configuration
-
-This endpoint queries for information about the Lease TTL for the specified mount.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `GET`  | `/nomad/config/lease` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/nomad/config/lease
-```
-
-### Sample response
-
-```json
-  "data": {
-    "max_ttl": 86400,
-    "ttl": 86400
-  }
-```
-
-## Delete lease configuration
-
-This endpoint deletes the lease configuration.
-
-| Method   | Path                  |
-| :------- | :-------------------- |
-| `DELETE` | `/nomad/config/lease` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/nomad/config/lease
-```
-
-## Create/Update role
-
-This endpoint creates or updates the Nomad role definition in Vault. If the role does not exist, it will be created. If the role already exists, it will receive
-updated attributes.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/nomad/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of an existing role against
-  which to create this Nomad tokens. This is part of the request URL.
-
-- `policies` `(string: "")` – Comma separated list of Nomad policies the token is going to be created against. These need to be created beforehand in Nomad.
-
-- `global` `(bool: "false")` – Specifies if the token should be global, as defined in the [Nomad Documentation](/nomad/tutorials/access-control#acl-tokens).
-
-- `type` `(string: "client")` - Specifies the type of token to create when
-  using this role. Valid values are `"client"` or `"management"`.
-
-### Sample payload
-
-To create a client token with a custom policy:
-
-```json
-{
-  "policies": "readonly"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/nomad/role/monitoring
-```
-
-## Read role
-
-This endpoint queries for information about a Nomad role with the given name.
-If no role exists with that name, a 404 is returned.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/nomad/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to query. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/nomad/role/monitoring
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "lease": "0s",
-    "policies": ["example"],
-    "token_type": "client"
-  }
-}
-```
-
-## List roles
-
-This endpoint lists all existing roles in the secrets engine.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `LIST` | `/nomad/role`           |
-| `GET`  | `/nomad/role?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/nomad/role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example"]
-  }
-}
-```
-
-## Delete role
-
-This endpoint deletes a Nomad role with the given name. Even if the role does
-not exist, this endpoint will still return a successful response.
-
-| Method   | Path                |
-| :------- | :------------------ |
-| `DELETE` | `/nomad/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to delete. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request DELETE \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/nomad/role/example-role
-```
-
-## Generate credential
-
-This endpoint generates a dynamic Nomad token based on the given role
-definition.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/nomad/creds/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of an existing role against
-  which to create this Nomad token. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/nomad/creds/example
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "accessor_id": "c834ba40-8d84-b0c1-c084-3a31d3383c03",
-    "secret_id": "65af6f07-7f57-bb24-cdae-a27f86a894ce"
-  }
-}
-```
diff --git a/website/content/api-docs/secret/pki.mdx b/website/content/api-docs/secret/pki.mdx
deleted file mode 100644
index 44a3b072a56..00000000000
--- a/website/content/api-docs/secret/pki.mdx
+++ /dev/null
@@ -1,4889 +0,0 @@
----
-layout: api
-page_title: PKI - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault PKI secrets engine.
----
-
-# PKI secrets engine (API)
-
-@include 'x509-sha1-deprecation.mdx'
-
-This is the API documentation for the Vault PKI secrets engine. For general
-information about the usage and operation of the PKI secrets engine, please see
-the [PKI documentation](/vault/docs/secrets/pki).
-
-This documentation assumes the PKI secrets engine is enabled at the `/pki` path
-in Vault. Since it is possible to enable secrets engines at any location, please
-update your API calls accordingly.
-
-## Table of contents
-
-- [Notice About New Multi-Issuer Functionality](#notice-about-new-multi-issuer-functionality)
-- [ACME Certificate Issuance](#acme-certificate-issuance)
-  - [ACME Directories](#acme-directories)
-  - [Get ACME EAB Binding Token](#get-acme-eab-binding-token)
-  - [List Unused ACME EAB Binding Tokens](#list-unused-acme-eab-binding-tokens)
-  - [Delete Unused ACME EAB Binding Tokens](#delete-unused-acme-eab-binding-tokens)
-  - [Get ACME Configuration](#get-acme-configuration)
-  - [Set ACME Configuration](#set-acme-configuration)
-- [Issuing Certificates](#issuing-certificates)
-  - [List Roles](#list-roles)
-  - [Read Role](#read-role)
-  - [Generate Certificate and Key](#generate-certificate-and-key)
-  - [Generate Certificate and Key with External Policy <EnterpriseAlert inline="true" />](#generate-certificate-and-key-with-external-policy)
-  - [Sign Certificate](#sign-certificate)
-  - [Sign Certificate with External Policy <EnterpriseAlert inline="true" />](#sign-certificate-with-external-policy)
-  - [Sign Intermediate](#sign-intermediate)
-  - [Sign Intermediate with External Policy <EnterpriseAlert inline="true" />](#sign-intermediate-with-external-policy)
-  - [Sign Self-Issued](#sign-self-issued)
-  - [Sign Verbatim](#sign-verbatim)
-  - [Revoke Certificate](#revoke-certificate)
-  - [Revoke Certificate with Private Key](#revoke-certificate-with-private-key)
-  - [List Revoked Certificates](#list-revoked-certificates)
-  - [List Revocation Requests](#list-revocation-requests)
-  - [List Cross-Cluster Revocations](#list-cross-cluster-revocations)
-- [Accessing Authority Information](#accessing-authority-information)
-  - [List Issuers](#list-issuers)
-  - [Read Issuer Certificate](#read-issuer-certificate)
-  - [Read Default Issuer Certificate Chain](#read-default-issuer-certificate-chain)
-  - [Read Issuer CRL](#read-issuer-crl)
-  - [OCSP Request](#ocsp-request)
-  - [List Certificates](#list-certificates)
-  - [Read Certificate](#read-certificate)
-- [Managing Keys and Issuers](#managing-keys-and-issuers)
-  - [List Issuers](#list-issuers)
-  - [List Keys](#list-keys)
-  - [Generate Key](#generate-key)
-  - [Generate Root](#generate-root)
-  - [Generate Intermediate CSR](#generate-intermediate-csr)
-  - [Import CA Certificates and Keys](#import-ca-certificates-and-keys)
-  - [Read Issuer](#read-issuer)
-  - [Update Issuer](#update-issuer)
-  - [Revoke Issuer](#revoke-issuer)
-  - [Delete Issuer](#delete-issuer)
-  - [Import Key](#import-key)
-  - [Read Key](#read-key)
-  - [Update Key](#update-key)
-  - [Delete Key](#delete-key)
-  - [Delete All Issuers and Keys](#delete-all-issuers-and-keys)
-- [Managing Authority Information](#managing-authority-information)
-  - [List Roles](#list-roles)
-  - [Create/Update Role](#create-update-role)
-  - [Read Role](#read-role)
-  - [Delete Role](#delete-role)
-  - [Read Certificate Issuance External Policy Service (CIEPS) Configuration <EnterpriseAlert inline="true" />](#read-certificate-issuance-external-policy-service-cieps-configuration)
-  - [Set Certificate Issuance External Policy Service (CIEPS) Configuration <EnterpriseAlert inline="true" />](#set-certificate-issuance-external-policy-service-cieps-configuration)
-  - [Read URLs](#read-urls)
-  - [Set URLs](#set-urls)
-  - [Read Issuers Configuration](#read-issuers-configuration)
-  - [Set Issuers Configuration](#set-issuers-configuration)
-  - [Read Keys Configuration](#read-keys-configuration)
-  - [Set Keys Configuration](#set-keys-configuration)
-  - [Read Cluster Configuration](#read-cluster-configuration)
-  - [Set Cluster Configuration](#set-cluster-configuration)
-  - [Read CRL Configuration](#read-crl-configuration)
-  - [Set CRL Configuration](#set-crl-configuration)
-  - [Rotate CRLs](#rotate-crls)
-  - [Rotate Delta CRLs](#rotate-delta-crls)
-  - [Combining CRLs from the Same Issuer](#combine-crls-from-the-same-issuer)
-  - [Sign Revocation List](#sign-revocation-list)
-  - [Tidy](#tidy)
-  - [Read Automatic Tidy Configuration](#read-automatic-tidy-configuration)
-  - [Set Automatic Tidy Configuration](#set-automatic-tidy-configuration)
-  - [Tidy Status](#tidy-status)
-  - [Cancel Tidy](#cancel-tidy)
-- [Cluster Scalability](#cluster-scalability)
-- [Managed Key](#managed-keys) (Enterprise Only)
-- [Vault CLI with DER/PEM responses](#vault-cli-with-der-pem-responses)
-
-## Notice about new Multi-Issuer functionality
-
-Vault since 1.11.0 allows a single PKI mount to have multiple Certificate
-Authority (CA) certificates ("issuers") in a single mount, for the purpose
-of facilitating rotation. All issuers within a single mount are treated as a
-single Authority, meaning that:
-
- 1. Certificate Revocation List (CRL) configuration is common to all issuers,
- 2. All authority access URLs are common to all issuers,
- 3. Issued certificates' serial numbers will be unique across all issuers.
-
-However, since each issuer may have a distinct subject and keys, different
-issuers may have different CRLs.
-
-It is _strongly_ encouraged to limit the scope of CAs within a mount and not
-to mix different types of CAs (roots and intermediates).
-
-~> **Note**: Some functionality will not work if a default issuer is not
-   configured. Vault automatically selects the default issuer from the
-   current issuing certificate on migration from an older Vault version
-   (Vault < 1.11.0).
-
-## ACME certificate issuance
-
-Starting with Vault 1.14, Vault supports the [ACME certificate lifecycle
-management protocol](https://datatracker.ietf.org/doc/html/rfc8555) for issuing
-and renewing leaf server certificates.
-
-In order to use ACME, a [cluster path](#set-cluster-configuration) must be
-set and ACME must be [enabled in its configuration](#set-acme-configuration)
-with the [required headers](#acme-required-headers) enabled on the mount
-tuning.
-
-Using ACME with a role requires `no_store=false` to be set on the role; this
-allows the certificate to be stored and later fetched through the ACME
-protocol.
-
-### ACME directories
-
-Vault PKI supports the following ACME directories, providing different
-restrictions around usage (defaults, a specific issuer and/or a specific
-role). To interact with these directories, specify the directory URL in
-an ACME client. For example, with the EFF's [CertBot](https://certbot.eff.org/):
-
-```
-$ certbot certonly --server https://localhost:8200/v1/pki/acme/directory ...
-```
-
-These endpoints are unauthenticated from a Vault authentication model, but
-internally authenticated via the ACME protocol.
-
-| Method | Path                                                               | Default Directory Policy   | Issuer                | Role          |
-|:-------|:-------------------------------------------------------------------|:---------------------------|:----------------------|:--------------|
-| `ACME` | `/pki/acme/directory`                                              | `sign-verbatim`            | `default`             | Sign-Verbatim |
-| `ACME` | `/pki/acme/directory`                                              | `role:role_ref`            | Specified by the role | `:role_ref`   |
-| `ACME` | `/pki/acme/directory`                                              | `external-policy(:policy)` | Specified by CIEPS    | CIEPS         |
-| `ACME` | `/pki/issuer/:issuer_ref/acme/directory`                           | `sign-verbatim`            | `:issuer_ref`         | Sign-Verbatim |
-| `ACME` | `/pki/issuer/:issuer_ref/acme/directory`                           | `role:role_ref`            | `:issuer_ref`         | `:role_ref`   |
-| `ACME` | `/pki/roles/:role/acme/directory`                                  | (any)                      | Specified by the role | `:role`       |
-| `ACME` | `/pki/issuer/:issuer_ref/roles/:role/acme/directory`               | (any)                      | `:issuer_ref`         | `:role`       |
-| `ACME` | `/pki/external-policy(/:policy)/acme/directory`                    | (any)                      | Specified by CIEPS    | CIEPS         |
-| `ACME` | `/pki/issuer/:issuer_ref/external-policy(/:policy)/acme/directory` | (any)                      | Specified by CIEPS    | CIEPS         |
-
-When a role is not explicitly specified, behavior is specified by the
-`default_directory_policy` in the [ACME configuration](#set-acme-configuration).
-These directories can also be forbidden by setting that policy as `forbid`.  If
-the policy is `sign-verbatim` then _any_ identifier for which the client can
-prove ownership of will be issued for.  This is similar to using the
-[Sign Verbatim](#sign-verbatim) endpoint, but with additional verification
-that the client has proven ownership (within the ACME protocol) of the
-requested certificate identifiers. When `external-policy` is specified as the
-default value, the Certificate Issuance External
-Policy Service (CIEPS)<EnterpriseAlert inline="true" /> is used for
-validating and templating the certificate instead of a role; ACME's challenge
-validation is still enforced. An optional policy name can be specified by using
-`external-policy:policy`. Roles are not used when CIEPS is used.
-
-#### ACME challenge types
-
-Vault supports the following ACME challenge types presently:
-
- - `http-01`, supporting both `dns` and `ip` identifiers.
- - `dns-01`, supporting `dns` identifiers including wildcards.
- - `tls-alpn-01`, supporting only non-wildcard `dns` identifiers.
-
-A custom DNS resolver used by the server for looking up DNS names for use
-with both mechanisms can be added via the [ACME configuration](#set-acme-configuration).
-
-#### ACME external account bindings
-
-ACME External Account Binding (EAB) Policy can enforce that clients need to
-have a valid external account binding to Vault. Before registering a new account,
-an authenticated Vault client will need to [fetch a new EAB
-token](#get-acme-eab-binding-token). This returns two values: a key identifier
-and an HMAC key used by the ACME client to authenticate with EAB. For example:
-
-```
-$ vault write -f /pki/acme/new-eab
-$ certbot certonly --server https://localhost:8200/v1/pki/acme/directory \
-                   --eab-kid <id> --eab-hmac-key <hmac-key>
-```
-
-With or without EAB, requests from the ACME client are not authenticated using
-traditional Vault authentication, but are instead authenticated through the
-ACME protocol. With EAB however, a Vault authenticated client will have to
-fetch an EAB token and pass it to the ACME client for use on the initial
-registration: this binds the ACME client's registration to an authenticated
-Vault endpoint, but not further to the client's entity or other information.
-
-~> Note: Enabling EAB is strongly recommended for public-facing Vault
-   deployments. Use of the `VAULT_DISABLE_PUBLIC_ACME` environment variable
-   can be used to enforce all ACME instances have EAB enabled.
-
-#### ACME accounts
-
-ACME Accounts are created specific to a particular directory and are not
-portable across Performance Secondary clusters.
-
-#### ACME required headers
-
-ACME requires the following response headers (`allowed_response_headers`)
-to be specified by [mount tuning](/vault/api-docs/system/mounts#tune-mount-configuration):
-
- - `Replay-Nonce`
- - `Link`
- - `Location`
-
-On an existing mount, these can be specified by running the following command:
-
-```
-$ vault secrets tune -allowed-response-headers=Location -allowed-response-headers=Replay-Nonce \
-                     -allowed-response-headers=Link \
-                     pki/
-```
-
-### Get ACME EAB binding token
-
-This endpoint returns a new ACME binding token. The `id` response field can
-be used as the key identifier and the `key` response field be used as the
-EAB HMAC key in the ACME Client.
-
-Each call to this endpoint will generate and return a new EAB binding token
-that is linked to the specific ACME directory it resides under. EAB tokens
-are not usable across different ACME directories.
-
-| Method | Path                                               |
-|:-------|:---------------------------------------------------|
-| `POST` | `/pki/acme/new-eab`                                |
-| `POST` | `/pki/issuer/:issuer_ref/acme/new-eab`             |
-| `POST` | `/pki/roles/:role/acme/new-eab`                    |
-| `POST` | `/pki/issuer/:issuer_ref/roles/:role/acme/new-eab` |
-
-#### Parameters
-
-No parameters.
-
-#### Sample request
-
-```
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/pki/acme/new-eab
-```
-
-#### Sample response
-
-```
-{
-  "data": {
-    "created_on": "2023-05-24T14:33:00-04:00",
-    "id": "bc8088d9-3816-5177-ae8e-d8393265f7dd",
-    "key_type": "hs",
-    "acme_directory": "acme/directory",
-    "key": "MHcCAQE... additional data elided ...",
-  }
-}
-```
-
-### List unused ACME EAB binding tokens
-
-This endpoint returns a list of all unused ACME binding tokens; once used,
-they will be removed from this list.
-
-| Method | Path       |
-| :----- | :--------- |
-| `LIST` | `/pki/eab` |
-
-#### Sample request
-
-```
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/pki/eab
-```
-
-#### Sample response
-
-```
-{
-  "data": {
-    "key_info": {
-      "bc8088d9-3816-5177-ae8e-d8393265f7dd": {
-        "created_on": "2023-05-24T14:33:00-04:00",
-        "key_type": "hs",
-        "acme_directory": "acme/directory"
-      }
-    },
-    "keys": [
-      "bc8088d9-3816-5177-ae8e-d8393265f7dd"
-    ]
-  }
-}
-```
-
-### Delete unused ACME EAB binding tokens
-
-This endpoint allows the deletion of an unused ACME binding token.
-
-| Method   | Path               |
-| :------- | :----------------- |
-| `DELETE` | `/pki/eab/:key_id` |
-
-#### Parameters
-
- - `key_id` `(string: <required>)` - The id of the EAB binding token to
-   delete. This is part of the request URL.
-
-#### Sample request
-
-```
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/pki/eab/bc8088d9-3816-5177-ae8e-d8393265f7dd
-```
-
-### Get ACME configuration
-
-This endpoint allows reading of the current ACME server configuration used by
-this mount.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/pki/config/acme` |
-
-#### Sample request
-
-```
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/config/acme
-```
-
-#### Sample response
-
-```
-{
-  "data": {
-    "allowed_issuers": [
-      "*"
-    ],
-    "allowed_roles": [
-      "*"
-    ],
-    "default_directory_policy": "sign-verbatim",
-    "dns_resolver": "",
-    "eab_policy": "not-required",
-    "enabled": true
-  },
-}
-```
-
-### Set ACME configuration
-
-This endpoint allows setting the ACME server configuration used by this
-mount.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/pki/config/acme` |
-
-#### Parameters
-
- - `allowed_issuers` `(list: ["*"])` - Specifies a list issuers allowed to
-   issue certificates via explicit ACME paths. If an allowed role specifies
-   an issuer outside this list, it will be allowed. The default value `*`
-   allows every issuer within the mount.
-
-  - `allow_role_ext_key_usage` `(bool: false)` - whether the ExtKeyUsage field
-   from a role is used, defaults to false meaning that certificate will be
-   signed with ServerAuth.
-
- - `allowed_roles` `(list: ["*"])` - Specifies a list of roles allowed to
-   issue certificates via explicit ACME paths.  The default value `*` allows
-   every role within the mount to be used.  If the `default_directory_policy`
-   specifies a role, it must be allowed under this configuration.
-
- - `default_directory_policy` `(string: "sign-verbatim")` - Specifies the
-   behavior of the default ACME directory.  Can be `forbid`, `sign-verbatim`
-   or a role given by `role:<role_name>`.  If a role is used, it must be
-   present in `allowed_roles`.
-
- - `dns_resolver` `(string: "")` - An optional overriding DNS resolver to
-   use for challenge verification lookups. When not specified, the default
-   system resolver will be used. This allows domains on peered networks with
-   an accessible DNS resolver to be validated.
-
- - `eab_policy` `(string: "not-required")` - Specified policy to enforce
-   around [External Account Bindings (EABs)](#acme-external-account-bindings).
-   The allowed values are:
-
-     - `not-required`, where EABs are not enforced but are validated if
-        specified.
-
-     - `new-account-required`, where new accounts are required to have EAB
-       but existing accounts can still be used.
-
-     - `always-required`, where all accounts regardless of age are required
-       to have EABs set.
-
- - `enabled` `(bool: false)` - Whether ACME is enabled on this mount. When
-   ACME is disabled, all requests to ACME directory URLs will return 404.
-
-#### Sample payload
-
-```
-{
-    "enabled": true
-}
-```
-
-#### Sample request
-
-```
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/config/acme
-```
-
-#### Sample response
-
-```
-{
-  "data": {
-    "allowed_issuers": [
-      "*"
-    ],
-    "allowed_roles": [
-      "*"
-    ],
-    "default_directory_policy": "sign-verbatim",
-    "dns_resolver": "",
-    "eab_policy": "not-required",
-    "enabled": true
-  }
-}
-```
-
-## Issuing certificates
-
-The following API endpoints allow users or operators to request certificates
-and are all authenticated.
-
-In general, for self-serve use, the `/pki/sign/:name` and `/pki/issue/:name`
-are sufficient to allow most users to access for ACL purposes. The per-issuer
-variants (`/pki/issuer/:issuer_ref/sign/:name` and
-`/pki/issuer/:issuer_ref/issue/:name`) allow the requester to override the
-role's chosen issuer, potentially allowing users to request certificates
-issued by the wrong parent authority.
-
-Some API endpoints included here are privileged and should only be accessed
-by trusted users or operators; these include the various `sign-verbatim`,
-`sign-self-signed` and `sign-intermediate` endpoints.
-
-If an issued certificate has been compromised, it should be revoked. The
-Vault PKI secrets engine presently only allows revocation by serial number;
-because this could allow users to deny access to other users, it should be
-restricted to operators.
-
-### List roles
-
-This endpoint returns a list of available roles. Only the role names are
-returned, not any values. It is useful to both operators and users.
-
-| Method | Path         |
-| :----- | :----------- |
-| `LIST` | `/pki/roles` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/pki/roles
-```
-
-#### Sample response
-
-```json
-{
-  "auth": null,
-  "data": {
-    "keys": ["dev", "prod"]
-  },
-  "lease_duration": 0,
-  "lease_id": "",
-  "renewable": false
-}
-```
-
-### Read role
-
-This endpoint queries the role definition. It is useful to both operators and
-users.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/pki/roles/:name` |
-
-#### Parameters
-
-- `name` `(string: <required>)` - Specifies the name of the role to read. This
-  is part of the request URL.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/roles/my-role
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "allow_any_name": false,
-    "allow_ip_sans": true,
-    "allow_localhost": true,
-    "allow_subdomains": false,
-    "allowed_domains": ["example.com", "foobar.com"],
-    "allowed_uri_sans": ["example.com", "spiffe://*"],
-    "allowed_other_sans": [
-      "1.3.6.1.4.1.311.20.2.3;utf8:devops@example.com",
-      "1.3.6.1.4.1.311.20.2.4;UTF-8:*"
-    ],
-    "client_flag": true,
-    "code_signing_flag": false,
-    "key_bits": 2048,
-    "key_type": "rsa",
-    "ttl": "6h",
-    "max_ttl": "12h",
-    "server_flag": true,
-    ... additional fields elided ...
-  }
-}
-```
-
-<a name="generate-certificate"></a>
-
-### Generate certificate and key
-
-This endpoint generates a new set of credentials (private key and certificate)
-based on the role named in the endpoint. The issuing CA certificate and full CA
-chain is returned as well, so that only the root CA need be in a client's trust
-store. Choice of issuing CA is determined first by the role (when using the
-`/pki/issue/:name` path) and then by the path (when using the
-`/pki/issuer/:issuer_ref/issue/name` path).
-
-It is suggested to limit access to the path-overridden issue endpoint (on
-`/pki/issuer/:issuer_ref/issue/:name`).
-
-~> **Note**: The private key is _not_ stored. If you do not save the private
-   key from the response, you will need to request a new certificate.
-
-| Method | Path                                  | Issuer        |
-| :----- | :------------------------------------ | :------------ |
-| `POST` | `/pki/issue/:name`                    | Role selected |
-| `POST` | `/pki/issuer/:issuer_ref/issue/:name` | Path selected |
-
-#### Parameters
-
-- `name` `(string: <required>)` - Specifies the name of the role to create the
-  certificate against. This is part of the request URL.
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-~> Note: This parameter is not present on the `/pki/issue/:name` path and
-   takes its value from the role's `issuer_ref` field.
-
-- `common_name` `(string: "")` - Specifies the requested CN for the
-  certificate. If the CN is allowed by role policy, it will be issued. If more
-  than one `common_name` is desired, specify the alternative names in the
-  `alt_names` list.
-
-~> Note: A value for `common_name` is required when [require_cn](#require_cn) is set to `true`
-
-- `alt_names` `(string: "")` - Specifies requested Subject Alternative Names, in
-  a comma-delimited list. These can be host names or email addresses; they will
-  be parsed into their respective fields. If any requested names do not match
-  role policy, the entire request will be denied.
-
-- `ip_sans` `(string: "")` - Specifies requested IP Subject Alternative Names,
-  in a comma-delimited list. Only valid if the role allows IP SANs (which is the
-  default).
-
-- `uri_sans` `(string: "")` - Specifies the requested URI Subject Alternative
-  Names, in a comma-delimited list. If any requested URIs do not match role policy,
-  the entire request will be denied.
-
-- `other_sans` `(string: "")` - Specifies custom OID/UTF8-string SANs. These
-  must match values specified on the role in `allowed_other_sans` (see role
-  creation for allowed_other_sans globbing rules).
-  The format is the same as OpenSSL: `<oid>;<type>:<value>` where the
-  only current valid type is `UTF8`. This can be a comma-delimited list or a
-  JSON string slice.
-
-- `ttl` `(string: "")` - Specifies requested Time To Live. Cannot be greater
-  than the role's `max_ttl` value. If not provided, the role's `ttl` value will
-  be used. Note that the role values default to system values if not explicitly
-  set. See `not_after` as an alternative for setting an absolute end date
-  (rather than a relative one).
-
-- `format` `(string: "pem")` - Specifies the format for returned data. Can be
-  `pem`, `der`, or `pem_bundle`; defaults to `pem`. If `der`, the output is
-  base64 encoded. If `pem_bundle`, the `certificate` field will contain the
-  private key and certificate, concatenated; if the issuing CA is not a
-  Vault-derived self-signed root, this will be included as well.
-
-- `private_key_format` `(string: "der")` - Specifies the format for marshaling
-  the private key within the private_key response field. Defaults to `der` which will
-  return either base64-encoded DER or PEM-encoded DER, depending on the value of
-  `format`. The other option is `pkcs8` which will return the key marshalled as
-  PEM-encoded PKCS8.
-
-~> **Note** that this does not apply to the private key within the certificate
-  field if `format=pem_bundle` parameter is specified.
-
-- `exclude_cn_from_sans` `(bool: false)` - If true, the given `common_name` will
-  not be included in DNS or Email Subject Alternate Names (as appropriate).
-  Useful if the CN is not a hostname or email address, but is instead some
-  human-readable identifier.
-
-- `not_after` `(string)` - Set the Not After field of the certificate with
-  specified date value. The value format should be given in UTC format
-  `YYYY-MM-ddTHH:MM:SSZ`. Supports the Y10K end date for IEEE 802.1AR-2018
-  standard devices, `9999-12-31T23:59:59Z`.
-
-- `remove_roots_from_chain` `(bool: false)` - If true, the returned `ca_chain`
-  field will not include any self-signed CA certificates. Useful if end-users
-  already have the root CA in their trust store.
-
-- `user_ids` `(string: "")` - Specifies the comma-separated list of requested
-  User ID (OID 0.9.2342.19200300.100.1.1) Subject values to be placed on the
-  signed certificate. This field is validated against `allowed_user_ids` on
-  the role.
-
-#### Sample payload
-
-```json
-{
-  "common_name": "www.example.com"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/issue/my-role
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "pki/issue/test/7ad6cfa5-f04f-c62a-d477-f33210475d05",
-  "renewable": false,
-  "lease_duration": 21600,
-  "data": {
-    "expiration": "1654105687",
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE-----\n",
-    "issuing_ca": "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n",
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n"
-    ],
-    "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAnVHfwoKsUG1GDVyWB1AFroaKl2ImMBO8EnvGLRrmobIkQvh+\n...\nQN351pgTphi6nlCkGPzkDuwvtxSxiCWXQcaxrHAL7MiJpPzkIBq1\n-----END RSA PRIVATE KEY-----\n",
-    "private_key_type": "rsa",
-    "serial_number": "39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58"
-  },
-  "warnings": "",
-  "auth": null
-}
-```
-
-### Generate certificate and key with external policy <EnterpriseAlert inline="true" />
-
-Similar to the [generate certificate and key](#generate-certificate-and-key)
-endpoint, this endpoint generate key material and certificate via an external
-policy engine. The private key material stays local to Vault, with the external
-service getting only an empty CSR. Any parameters passed to this endpoint are
-passed verbatim to the Certificate Issuance External
-Policy Service (CIEPS)<EnterpriseAlert inline="true" />. The
-response format is the same between both endpoints.
-
-It is suggested to limit access to the path-overridden issue endpoint (on
-`/pki/issuer/:issuer_ref/external-policy/issue/:policy`) and let the CIEPS
-engine override the issuer as necessary.
-
-| Method | Path                                                      | Issuer                      |
-| :----- |:----------------------------------------------------------| :-------------------------- |
-| `POST` | `/pki/external-policy/issue(/:policy)`                    | `default` or CIEPS-selected |
-| `POST` | `/pki/issuer/:issuer_ref/external-policy/issue(/:policy)` | Path or CIEPS selected      |
-
-#### Parameters
-
-- `policy` `(string: <optional>)` - Specifies the name of the policy to create
-  the certificate against. This is part of the request URL and is passed to the
-  external CIEPS engine.
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-~> Note: This parameter is not present on the `/pki/external-policy/sign/:policy`
-   path and takes its value from the CIEPS engine response's `issuer_ref`
-   field, which can override the user-requested issuer.
-
-- `format` `(string: "pem")` - Specifies the format for returned data. Can be
-  `pem`, `der`, or `pem_bundle`; defaults to `pem`. If `der`, the output is
-  base64 encoded. If `pem_bundle`, the `certificate` field will contain the
-  private key and certificate, concatenated; if the issuing CA is not a
-  Vault-derived self-signed root, this will be included as well.
-
-- `key_type` `(string: "rsa")` - Specifies the desired key type; must be `rsa`, `ed25519`
-  or `ec`.
-
-~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-   and thus should not be used: `ed25519`.
-
-- `key_bits` `(int: 0)` - Specifies the number of bits to use for the
-  generated keys. Allowed values are 0 (universal default); with
-  `key_type=rsa`, allowed values are: 2048 (default), 3072, 4096 or 8192;
-  with `key_type=ec`, allowed values are: 224, 256 (default),
-  384, or 521; ignored with `key_type=ed25519`.
-
-- `private_key_format` `(string: "der")` - Specifies the format for marshaling
-  the private key within the private_key response field. Defaults to `der` which will
-  return either base64-encoded DER or PEM-encoded DER, depending on the value of
-  `format`. The other option is `pkcs8` which will return the key marshalled as
-  PEM-encoded PKCS8.
-
-~> **Note** that this does not apply to the private key within the certificate
-  field if `format=pem_bundle` parameter is specified.
-
-
-- `remove_roots_from_chain` `(bool: false)` - If true, the returned `ca_chain`
-  field will not include any self-signed CA certificates. Useful if end-users
-  already have the root CA in their trust store.
-
-Other parameters may be specified and will not be parsed by Vault but may be
-recognized based on external CIEPS engine definition.
-
-#### Sample payload
-
-```json
-{
-  "common_name": "example.com",
-  "key_type": "rsa",
-  "key_bits": 2048
-}
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "expiration": "1654105687",
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE-----\n",
-    "issuing_ca": "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n",
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n"
-    ],
-    "serial_number": "39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:52"
-  },
-  "auth": null
-}
-```
-
-### Sign certificate
-
-This endpoint signs a new certificate based upon the provided CSR and the
-supplied parameters, subject to the restrictions contained in the role named in
-the endpoint. The issuing CA certificate and the full CA chain is returned as
-well, so that only the root CA need be in a client's trust store.
-
-It is suggested to limit access to the path-overridden sign endpoint (on
-`/pki/issuer/:issuer_ref/sign/:name`).
-
-| Method | Path                                 | Issuer        |
-| :----- | :----------------------------------- | :------------ |
-| `POST` | `/pki/sign/:name`                    | Role selected |
-| `POST` | `/pki/issuer/:issuer_ref/sign/:name` | Path selected |
-
-#### Parameters
-
-- `name` `(string: <required>)` - Specifies the name of the role to create the
-  certificate against. This is part of the request URL.
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-~> Note: This parameter is not present on the `/pki/sign/:name` path and
-   takes its value from the role's `issuer_ref` field.
-
-- `csr` `(string: <required>)` - Specifies the PEM-encoded CSR.
-
-- `common_name` `(string: <required>)` - Specifies the requested CN for the
-  certificate. If the CN is allowed by role policy, it will be issued. If
-  more than one `common_name` is desired, specify the alternative names in
-  the `alt_names` list.
-
-- `alt_names` `(string: "")` - Specifies the requested Subject Alternative
-  Names, in a comma-delimited list. These can be host names or email addresses;
-  they will be parsed into their respective fields. If any requested names do
-  not match role policy, the entire request will be denied.
-
-- `other_sans` `(string: "")` - Specifies custom OID/UTF8-string SANs. These
-  must match values specified on the role in `allowed_other_sans` (see role
-  creation for allowed_other_sans globbing rules).
-  The format is the same as OpenSSL: `<oid>;<type>:<value>` where the
-  only current valid type is `UTF8`. This can be a comma-delimited list or a
-  JSON string slice.
-
-- `ip_sans` `(string: "")` - Specifies the requested IP Subject Alternative
-  Names, in a comma-delimited list. Only valid if the role allows IP SANs (which
-  is the default).
-
-- `uri_sans` `(string: "")` - Specifies the requested URI Subject Alternative
-  Names, in a comma-delimited list. If any requested URIs do not match role policy,
-  the entire request will be denied.
-
-- `ttl` `(string: "")` - Specifies the requested Time To Live. Cannot be greater
-  than the role's `max_ttl` value. If not provided, the role's `ttl` value will
-  be used. Note that the role values default to system values if not explicitly
-  set. See `not_after` as an alternative for setting an absolute end date
-  (rather than a relative one).
-
-- `format` `(string: "pem")` - Specifies the format for returned data. Can be
-  `pem`, `der`, or `pem_bundle`. If `der`, the output is base64 encoded. If
-  `pem_bundle`, the `certificate` field will contain the certificate and, if the
-  issuing CA is not a Vault-derived self-signed root, it will be concatenated
-  with the certificate.
-
-- `exclude_cn_from_sans` `(bool: false)` - If true, the given `common_name` will
-  not be included in DNS or Email Subject Alternate Names (as appropriate).
-  Useful if the CN is not a hostname or email address, but is instead some
-  human-readable identifier.
-
-- `not_after` `(string)` - Set the Not After field of the certificate with
-  specified date value. The value format should be given in UTC format
-  `YYYY-MM-ddTHH:MM:SSZ`. Supports the Y10K end date for IEEE 802.1AR-2018
-  standard devices, `9999-12-31T23:59:59Z`.
-
-- `remove_roots_from_chain` `(bool: false)` - If true, the returned `ca_chain`
-  field will not include any self-signed CA certificates. Useful if end-users
-  already have the root CA in their trust store.
-
-- `user_ids` `(string: "")` - Specifies the comma-separated list of requested
-  User ID (OID 0.9.2342.19200300.100.1.1) Subject values to be placed on the
-  signed certificate. This field is validated against `allowed_user_ids` on
-  the role.
-
-#### Sample payload
-
-```json
-{
-  "csr": "...",
-  "common_name": "example.com"
-}
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "pki/sign/test/7ad6cfa5-f04f-c62a-d477-f33210475d05",
-  "renewable": false,
-  "lease_duration": 21600,
-  "data": {
-    "expiration": "1654105687",
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE-----\n",
-    "issuing_ca": "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n",
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n"
-    ],
-    "serial_number": "39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58"
-  },
-  "auth": null
-}
-```
-
-### Sign certificate with external policy <EnterpriseAlert inline="true" />
-
-Similar to the [sign certificate](#sign-certificate) endpoint, this endpoint
-signs the specified leaf CSR via an external policy engine. Any parameters
-passed to this endpoint are passed verbatim to the Certificate Issuance External
-Policy Service (CIEPS)<EnterpriseAlert inline="true" />. The response format is the same
-between both endpoints.
-
-It is suggested to limit access to the path-overridden sign endpoint (on
-`/pki/issuer/:issuer_ref/external-policy/sign/:policy`) and let the CIEPS
-engine override the issuer as necessary.
-
-| Method | Path                                                     | Issuer                      |
-| :----- |:---------------------------------------------------------| :-------------------------- |
-| `POST` | `/pki/external-policy/sign(/:policy)`                    | `default` or CIEPS-selected |
-| `POST` | `/pki/issuer/:issuer_ref/external-policy/sign(/:policy)` | Path or CIEPS selected      |
-
-#### Parameters
-
-- `policy` `(string: <optional>)` - Specifies the name of the policy to create
-  the certificate against. This is part of the request URL and is passed to the
-  external CIEPS engine.
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-~> Note: This parameter is not present on the `/pki/external-policy/sign/:policy`
-   path and takes its value from the CIEPS engine response's `issuer_ref`
-   field, which can override the user-requested issuer.
-
-- `csr` `(string: <required>)` - Specifies the PEM-encoded CSR.
-
-- `format` `(string: "pem")` - Specifies the format for returned data. Can be
-  `pem`, `der`, or `pem_bundle`; defaults to `pem`. If `der`, the output is
-  base64 encoded. If `pem_bundle`, the `certificate` field will contain the
-  private key and certificate, concatenated; if the issuing CA is not a
-  Vault-derived self-signed root, this will be included as well.
-
-- `private_key_format` `(string: "der")` - Specifies the format for marshaling
-  the private key within the private_key response field. Defaults to `der` which will
-  return either base64-encoded DER or PEM-encoded DER, depending on the value of
-  `format`. The other option is `pkcs8` which will return the key marshalled as
-  PEM-encoded PKCS8.
-
-~> **Note** that this does not apply to the private key within the certificate
-  field if `format=pem_bundle` parameter is specified.
-
-- `remove_roots_from_chain` `(bool: false)` - If true, the returned `ca_chain`
-  field will not include any self-signed CA certificates. Useful if end-users
-  already have the root CA in their trust store.
-
-Other parameters may be specified and will not be parsed by Vault but may be
-recognized based on external CIEPS engine definition.
-
-#### Sample payload
-
-```json
-{
-  "csr": "...",
-  "common_name": "example.com",
-  "key_attestation": "..."
-}
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "expiration": "1654105687",
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE-----\n",
-    "issuing_ca": "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n",
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n"
-    ],
-    "serial_number": "39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:52"
-  },
-  "auth": null
-}
-```
-
-### Sign intermediate
-
-This endpoint uses the configured CA certificate to issue a certificate with
-appropriate values for acting as an intermediate CA. Distribution points use the
-values set via `config/urls`. Values set in the CSR are ignored unless
-`use_csr_values` is set to true, in which case the values from the CSR are used
-verbatim.
-
-This endpoint can be used both when signing a Vault-backed intermediate or
-when signing an externally-owned intermediate.
-
-~> **Note**: This is a privileged endpoint, as callers are granted a new
-   intermediate certificate, with which they can issue for arbitrary names.
-   Access to this endpoint should be restricted by policy to only trusted
-   operators.
-
-| Method | Path                                        | Issuer    |
-| :----- | :------------------------------------------ | :-------  |
-| `POST` | `/pki/root/sign-intermediate`               | `default` |
-| `POST` | `/pki/issuer/:issuer_ref/sign-intermediate` | Selected  |
-
-#### Parameters
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-~> Note: This parameter is not present on the `/pki/root/sign-intermediate`
-   path and takes the value `default`.
-
-- `csr` `(string: <required>)` - Specifies the PEM-encoded CSR to be signed.
-
-- `common_name` `(string: <required>)` - Specifies the requested CN for the
-  certificate. If more than one `common_name` is desired, specify the
-  alternative names in the `alt_names` list.
-
-- `alt_names` `(string: "")` - Specifies the requested Subject Alternative
-  Names, in a comma-delimited list. These can be host names or email addresses;
-  they will be parsed into their respective fields.
-
-- `ip_sans` `(string: "")` - Specifies the requested IP Subject Alternative
-  Names, in a comma-delimited list.
-
-- `uri_sans` `(string: "")` - Specifies the requested URI Subject Alternative
-  Names, in a comma-delimited list.
-
-- `other_sans` `(string: "")` - Specifies custom OID/UTF8-string SANs. These
-  must match values specified on the role in `allowed_other_sans` (see role
-  creation for allowed_other_sans globbing rules).
-  The format is the same as OpenSSL: `<oid>;<type>:<value>` where the
-  only current valid type is `UTF8`. This can be a comma-delimited list or a
-  JSON string slice.
-
-- `ttl` `(string: "")` - Specifies the requested Time To Live (after which the
-  certificate will be expired). This cannot be larger than the engine's max (or,
-  if not set, the system max). However, this can be after the expiration of the
-  signing CA. See `not_after` as an alternative for setting an absolute end date
-  (rather than a relative one).
-
-- `format` `(string: "pem")` - Specifies the format for returned data. Can be
-  `pem`, `der`, or `pem_bundle`. If `der`, the output is base64 encoded. If
-  `pem_bundle`, the `certificate` field will contain the certificate and, if the
-  issuing CA is not a Vault-derived self-signed root, it will be concatenated
-  with the certificate.
-
-- `max_path_length` `(int: -1)` - Specifies the maximum path length to encode in
-  the generated certificate. `-1`, means no limit, unless the signing
-  certificate has a maximum path length set, in which case the path length is
-  set to one less than that of the signing certificate. A limit of `0` means a
-  literal path length of zero.
-
-- `exclude_cn_from_sans` `(bool: false)` - If true, the given `common_name` will
-  not be included in DNS or Email Subject Alternate Names (as appropriate).
-  Useful if the CN is not a hostname or email address, but is instead some
-  human-readable identifier.
-
-- `use_csr_values` `(bool: false)` - If set to `true`, then: 1) Subject
-  information, including names and alternate names, will be preserved from the
-  CSR rather than using the values provided in the other parameters to this
-  path; 2) Any key usages (for instance, non-repudiation) requested in the CSR
-  will be added to the basic set of key usages used for CA certs signed by this
-  path; 3) Extensions requested in the CSR will be copied into the issued
-  certificate.
-
-- `permitted_dns_domains` `(string: "")` - A comma separated string (or, string
-  array) containing DNS domains for which certificates are allowed to be issued
-  or signed by this CA certificate. Supports subdomains via a `.` in front of
-  the domain, as per [RFC 5280 Section 4.2.1.10 - Name
-  Constraints](https://tools.ietf.org/html/rfc5280#section-4.2.1.10)
-
-- `ou` `(string: "")` - Specifies the OU (OrganizationalUnit) values in the
-  subject field of the resulting certificate. This is a comma-separated string
-  or JSON array.
-
-- `organization` `(string: "")` - Specifies the O (Organization) values in the
-  subject field of the resulting certificate. This is a comma-separated string
-  or JSON array.
-
-- `country` `(string: "")` - Specifies the C (Country) values in the subject
-  field of the resulting certificate. This is a comma-separated string or JSON
-  array.
-
-- `locality` `(string: "")` - Specifies the L (Locality) values in the subject
-  field of the resulting certificate. This is a comma-separated string or JSON
-  array.
-
-- `province` `(string: "")` - Specifies the ST (Province) values in the subject
-  field of the resulting certificate. This is a comma-separated string or JSON
-  array.
-
-- `street_address` `(string: "")` - Specifies the Street Address values in the
-  subject field of the resulting certificate. This is a comma-separated string
-  or JSON array.
-
-- `postal_code` `(string: "")` - Specifies the Postal Code values in the
-  subject field of the resulting certificate. This is a comma-separated string
-  or JSON array.
-
-- `serial_number` `(string: "")` -  - Specifies the requested Subject's named
-  [Serial Number](https://datatracker.ietf.org/doc/html/rfc4519#section-2.31)
-  value, if any. If you want more than one, specify alternative names in the
-  `alt_names` map using OID 2.5.4.5. Note that this has no impact on the
-  Certificate's serial number field, which Vault randomly generates.
-
-- `not_before_duration` `(duration: "30s")` - Specifies the duration by which to
-  backdate the NotBefore property. This value has no impact in the validity period
-  of the requested certificate, specified in the `ttl` field.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `not_after` `(string)` - Set the Not After field of the certificate with
-  specified date value. The value format should be given in UTC format
-  `YYYY-MM-ddTHH:MM:SSZ`. Supports the Y10K end date for IEEE 802.1AR-2018
-  standard devices, `9999-12-31T23:59:59Z`.
-
-- `signature_bits` `(int: 0)` - Specifies the number of bits to use in
-  the signature algorithm; accepts 256 for SHA-2-256, 384 for SHA-2-384,
-  and 512 for SHA-2-512. Defaults to 0 to automatically detect based
-  on issuer's key length (SHA-2-256 for RSA keys, and matching the curve size
-  for NIST P-Curves).
-
-~> **Note**: ECDSA and Ed25519 issuers do not follow configuration of the
-   `signature_bits` value; only RSA issuers will change signature types
-   based on this parameter.
-
-- `skid` `(string: "")` - Value for the Subject Key Identifier field
-  (RFC 5280 Section 4.2.1.2). Specified as a string in hex format. Default
-  is empty, allowing Vault to automatically calculate the SKID according
-  to method one in the above RFC section.
-
-~> **Note**: This value should ONLY be used when cross-signing to mimic
-   the existing certificate's SKID value; this is necessary to allow
-   certain TLS implementations (such as OpenSSL) which use SKID/AKID
-   matches in chain building to restrict possible valid chains.
-
-- `use_pss` `(bool: false)` - Specifies whether or not to use PSS signatures
-  over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for
-  ECDSA/Ed25519 issuers.
-
-#### Sample payload
-
-```json
-{
-  "csr": "...",
-  "common_name": "example.com"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/root/sign-intermediate
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "expiration": "1654105687",
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE-----\n",
-    "issuing_ca": "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n",
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n"
-    ],
-    "serial_number": "39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58"
-  },
-  "auth": null
-}
-```
-
-### Sign Intermediate with External Policy <EnterpriseAlert inline="true" />
-
-Similar to [sign intermediate](#sign-intermediate), this endpoint accepts a
-CSR and returns a certificate with appropriate values for acting as an
-intermediate CA via an external policy engine. Any parameters passed to this
-endpoint are passed verbatim to the Certificate Issuance External Policy Service
-(CIEPS)<EnterpriseAlert inline="true" />.
-The response format is the same between both endpoints.
-
-It is suggested to limit access to the path-overridden issue endpoint
-(on /pki/issuer/:issuer_ref/external-policy/issue/:policy) and let the CIEPS
-engine override the issuer as necessary.
-
-| Method | Path                                                                | Issuer                    |
-|--------|---------------------------------------------------------------------|---------------------------|
-| POST   | /pki/external-policy/sign-intermediate(/:policy)                    | default or CIEPS-selected |
-| POST   | /pki/issuer/:issuer_ref/external-policy/sign-intermediate(/:policy) | Path or CIEPS selected    |
-
-#### Parameters
-
-- `policy` `(string: <optional>)` - Specifies the name of the policy to create
-  the certificate against. This is part of the request URL and is passed to the
-  external CIEPS engine.
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-~> Note: This parameter is not present on the `/pki/external-policy/sign-intermediate`
-path and takes its value from the CIEPS engine response's `issuer_ref`
-field, which can override the user-requested issuer.
-
-- `csr` `(string: <required>)` - Specifies the PEM-encoded CSR.
-
-- `format` `(string: "pem")` - Specifies the format for returned data. Can be
-  `pem`, `der`, or `pem_bundle`; defaults to `pem`. If `der`, the output is
-  base64 encoded. If `pem_bundle`, the `certificate` field will contain the
-  private key and certificate, concatenated; if the issuing CA is not a
-  Vault-derived self-signed root, this will be included as well.
-
-- `private_key_format` `(string: "pem")` - Specifies the format for marshaling
-  the private key within the private_key response field. Defaults to `der` which will
-  return either base64-encoded DER or PEM-encoded DER, depending on the value of
-  `format`. The other option is `pkcs8` which will return the key marshalled as
-  PEM-encoded PKCS8.
-
-~> **Note** that this does not apply to the private key within the certificate
-field if `format=pem_bundle` parameter is specified.
-
-Other parameters may be specified and will not be parsed by Vault but may be
-recognized based on external CIEPS engine definition.
-
-#### Sample payload
-
-```json
-{
-  "csr": "..."
-}
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "expiration": "1654105687",
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE-----\n",
-    "issuing_ca": "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n",
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n"
-    ],
-    "serial_number": "39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58"
-  },
-  "auth": null
-}
-```
-
-### Sign Self-Issued
-
-This endpoint uses the configured CA certificate to sign a self-issued
-certificate (which will usually be a self-signed certificate as well).
-
-~> **_This is an extremely privileged endpoint_**. The given certificate will be
-   signed as-is with only minimal validation performed (is it a CA cert, and is it
-   actually self-issued). The only values that will be changed will be the
-   authority key ID, the issuer DN, and, if set, any distribution points.<br /><br />
-   It is recommended to limit this endpoint to only trusted operators.
-
-This is generally only needed for root certificate rolling in cases where you
-don't want/can't get access to a CSR (such as if it's a root stored in Vault
-where the key is not exposed). If you don't know whether you need this
-endpoint, you most likely should be using a different endpoint (such as
-`sign-intermediate`).
-
-| Method | Path                                       | Issuer    | Requires `sudo` capability |
-| :----- | :----------------------------------------- | :-------- | :------------------------- |
-| `POST` | `/pki/root/sign-self-issued`               | `default` | yes                        |
-| `POST` | `/pki/issuer/:issuer_ref/sign-self-issued` | Selected  | no                         |
-
-#### Parameters
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-~> Note: This parameter is not present on the `/pki/root/sign-self-issued`
-   path and takes the value `default`.
-
-- `certificate` `(string: <required>)` - Specifies the PEM-encoded self-issued certificate.
-
-- `require_matching_certificate_algorithms` `(bool: false)` - If true, requires
-that the public key algorithm of the CA match that of the submitted certificate.
-
-#### Sample payload
-
-```json
-{
-  "certificate": "..."
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/root/sign-self-issued
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE-----\n",
-    "issuing_ca": "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n"
-  },
-  "auth": null
-}
-```
-
-### Sign verbatim
-
-This endpoint signs a new certificate based upon the provided CSR. Values are
-taken verbatim from the CSR; the _only_ restriction is that this endpoint will
-refuse to issue an intermediate CA certificate (see the
-`/pki/root/sign-intermediate` endpoint for that functionality.)
-
-**This is a potentially dangerous endpoint and only highly trusted users should
-have access.**
-
-| Method | Path                                            | Issuer    |
-| :----- | :---------------------------------------------- | :-------- |
-| `POST` | `/pki/sign-verbatim(/:name)`                    | `default` |
-| `POST` | `/pki/issuer/:issuer_ref/sign-verbatim(/:name)` | Selected  |
-
-#### Parameters
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-~> Note: This parameter is not present on the `/pki/root/sign-self-issued`
-   path and takes the value `default`.
-
-- `name` `(string: "")` - Specifies a role. If set, the following parameters
-  from the role will have effect: `ttl`, `max_ttl`, `generate_lease`, `no_store` and `not_before_duration`.
-
-- `csr` `(string: <required>)` - Specifies the PEM-encoded CSR.
-
-- `key_usage` `(list: ["DigitalSignature", "KeyAgreement", "KeyEncipherment"])` -
-  Specifies the default key usage constraint on the issued certificate. Valid
-  values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage - simply
-  drop the `KeyUsage` part of the value. Values are not case-sensitive. To
-  specify no default key usage constraints, set this to an empty list.
-
-~> Note: previous versions of this document incorrectly called this a constraint;
-   this value is only used as a default when the `KeyUsage` extension is missing
-   from the CSR.
-
-- `ext_key_usage` `(list: [])` -
-  Specifies the default extended key usage constraint on the issued certificate. Valid
-  values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage - simply
-  drop the `ExtKeyUsage` part of the value. Values are not case-sensitive. To
-  specify no key default usage constraints, set this to an empty list.
-
-~> Note: previous versions of this document incorrectly called this a constraint;
-   this value is only used as a default when the `ExtendedKeyUsage` extension is
-   missing from the CSR.
-
-- `ext_key_usage_oids` `(string: "")` - A comma-separated string or list of extended key usage oids.
-
-~> Note: This value is only used as a default when the `ExtendedKeyUsage`
-   extension is missing from the CSR.
-
-- `ttl` `(string: "")` - Specifies the requested Time To Live. Cannot be greater
-  than the engine's `max_ttl` value. If not provided, the engine's `ttl` value
-  will be used, which defaults to system values if not explicitly set. See
-  `not_after` as an alternative for setting an absolute end date (rather than
-  a relative one).
-
-- `format` `(string: "pem")` - Specifies the format for returned data. Can be
-  `pem`, `der`, or `pem_bundle`. If `der`, the output is base64 encoded. If
-  `pem_bundle`, the `certificate` field will contain the certificate and, if the
-  issuing CA is not a Vault-derived self-signed root, it will be concatenated
-  with the certificate.
-
-- `not_after` `(string)` - Set the Not After field of the certificate with
-  specified date value. The value format should be given in UTC format
-  `YYYY-MM-ddTHH:MM:SSZ`. Supports the Y10K end date for IEEE 802.1AR-2018
-  standard devices, `9999-12-31T23:59:59Z`.
-
-- `signature_bits` `(int: 0)` - Specifies the number of bits to use in
-  the signature algorithm; accepts 256 for SHA-2-256, 384 for SHA-2-384,
-  and 512 for SHA-2-512. Defaults to 0 to automatically detect based
-  on issuer's key length (SHA-2-256 for RSA keys, and matching the curve size
-  for NIST P-Curves).
-
-~> **Note**: ECDSA and Ed25519 issuers do not follow configuration of the
-   `signature_bits` value; only RSA issuers will change signature types
-   based on this parameter.
-
-- `use_pss` `(bool: false)` - Specifies whether or not to use PSS signatures
-  over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for
-  ECDSA/Ed25519 issuers.
-
-- `remove_roots_from_chain` `(bool: false)` - If true, the returned `ca_chain`
-  field will not include any self-signed CA certificates. Useful if end-users
-  already have the root CA in their trust store.
-
-- `user_ids` `(string: "")` - Specifies the comma-separated list of requested
-  User ID (OID 0.9.2342.19200300.100.1.1) Subject values to be placed on the
-  signed certificate. No validation on names is performed using this endpoint.
-
-#### Sample payload
-
-```json
-{
-  "csr": "..."
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/sign-verbatim
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "pki/sign-verbatim/7ad6cfa5-f04f-c62a-d477-f33210475d05",
-  "renewable": false,
-  "lease_duration": 21600,
-  "data": {
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE-----\n",
-    "issuing_ca": "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n",
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDUTCCAjmgAwIBAgIJAKM+z4MSfw2mMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV\n...\nG/7g4koczXLoUM3OQXd5Aq2cs4SS1vODrYmgbioFsQ3eDHd1fg==\n-----END CERTIFICATE-----\n"
-    ],
-    "serial_number": "39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58"
-  },
-  "auth": null
-}
-```
-
-### Revoke certificate
-
-This endpoint revokes a certificate using its serial number. This is an
-alternative option to the standard method of revoking using Vault lease IDs. A
-successful revocation will rotate the CRL.
-
-~> **Note**: This operation is privileged as it allows revocation of arbitrary
-   certificates based purely on their serial number. It does not validate that
-   the requesting user issued the certificate or has possession of the private
-   key.<br /><br />
-   It is not possible to revoke issuers using this path.
-
-| Method | Path          |
-| :----- | :------------ |
-| `POST` | `/pki/revoke` |
-
-#### Parameters
-
-~> Note: either `serial_number` or `certificate` (but not both) must be
-   specified on requests to this endpoint.
-
-- `serial_number` `(string: <optional>)` - Specifies the serial number of the
-  certificate to revoke, in hyphen-separated or colon-separated hexadecimal.
-
-- `certificate` `(string: <optional>)` - Specifies the certificate to revoke,
-  in PEM format. This certificate must have been signed by one of the issuers
-  in this mount in order to be accepted for revocation.
-
-#### Sample payload
-
-```json
-{
-  "serial_number": "39:dd:2e..."
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/revoke
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "revocation_time": 1433269787
-  }
-}
-```
-
-### Revoke certificate with private key
-
-This endpoint revokes a certificate using its private key as proof that the
-request is authorized by an appropriate individual (Proof of Possession).
-
-This is an alternative option to the standard method of revoking using Vault
-lease IDs or revocation via serial number. A successful revocation will
-rotate the CRL.
-
-It is not possible to revoke issuers using this path.
-
-~> **Note**: This operation is **NOT** privileged, as it validates revocation
-   has a private key corresponding to a certificate signed by Vault. However,
-   to avoid third parties performing a denial-of-service (DOS) against Vault,
-   we've made this endpoint authenticated. Thus it is strongly encouraged to
-   generally allow all access to this path via ACLs.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/pki/revoke-with-key` |
-
-#### Parameters
-
-~> Note: either `serial_number` or `certificate` (but not both) must be
-   specified on requests to this endpoint.
-
-- `serial_number` `(string: <optional>)` - Specifies the serial number of the
-  certificate to revoke, in hyphen-separated or colon-separated hexadecimal.
-
-- `certificate` `(string: <optional>)` - Specifies the certificate to revoke,
-  in PEM format. This certificate must have been signed by one of the issuers
-  in this mount in order to be accepted for revocation.
-
-- `private_key` `(string: <required>)` - Specifies the private key (in PEM
-  format) corresponding to the certificate issued by Vault that is attempted
-  to be revoked. This endpoint must be called several times (with each unique
-  certificate/serial number) if this private key is used in multiple
-  certificates as Vault does not maintain such a mapping.
-
-#### Sample payload
-
-```json
-{
-  "serial_number": "39:dd:2e...",
-  "private_key": "-----BEGIN PRIVATE KEY-----\n..."
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/revoke-with-key
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "revocation_time": 1433269787
-  }
-}
-```
-
-
-### List revoked certificates
-
-This endpoint returns a list of serial numbers that have been revoked on the local cluster.
-
-| Method | Path              |
-|:-------|:------------------|
-| `LIST` | `/certs/revoked`  |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/pki/certs/revoked
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "3d:80:91:c3:c2:34:3b:81:69:3d:92:a3:80:69:db:53:04:26:ab:b4"
-    ]
-  }
-}
-```
-
-### List revocation requests
-
-This endpoint returns a list of serial numbers that have been requested to
-be revoked on any cluster, along with information about the request's state
-and which cluster it originated on.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `LIST` | `/certs/revocation-queue` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/pki/certs/revocation-queue
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "key_info": {
-      "3d:80:91:c3:c2:34:3b:81:69:3d:92:a3:80:69:db:53:04:26:ab:b4": {
-        "requesting_cluster": "48327b28-8325-6d79-6a0b-4cbaa6f27b4a"
-      }
-    },
-    "keys": [
-      "3d:80:91:c3:c2:34:3b:81:69:3d:92:a3:80:69:db:53:04:26:ab:b4"
-    ]
-  }
-}
-```
-
-### List Cross-Cluster revocations
-
-This endpoint returns a list of serial numbers that have been revoked on any
-cluster, along with the clusters that have a copy of that revoked certificate.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `LIST` | `/certs/unified-revoked` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/pki/certs/unified-revoked
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "key_info": {
-      "7f:fd:12:5b:16:29:bb:28:ea:24:bc:a1:80:f7:4e:6e:a0:69:b9:95": {
-        "revoking_clusters": [
-          "48327b28-8325-6d79-6a0b-4cbaa6f27b4a"
-        ]
-      }
-    },
-    "keys": [
-      "7f:fd:12:5b:16:29:bb:28:ea:24:bc:a1:80:f7:4e:6e:a0:69:b9:95"
-    ]
-  }
-}
-```
-
----
-
-## Accessing authority information
-
-All consumers of the PKI Secrets Engine mount point will have access to the
-following unauthenticated APIs, useful for reading information about the
-certificate authority in this mount point.
-
-This includes information about [CA certificates](#read-issuer-certificate),
-[their chains](#read-default-issuer-certificate-chain), and [their signed
-CRLs](#read-issuer-crl), containing an encoded list of revoked certificates
-previously issued by this authority. Individual issued [certificates can
-also be read](#read-certificate), assuming their serial number is known.
-Finally, the list of issuing certificates is public information in this
-mount.
-
-### List issuers
-
-This endpoint returns a list of issuers currently provisioned in this mount.
-The response includes both the issuer's identifier as well as the name chosen
-by the operators; either can be used to refer to the issuer later.
-
-This endpoint is unauthenticated.
-
-| Method | Path           |
-| :----- | :------------- |
-| `LIST` | `/pki/issuers` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --request LIST \
-    http://127.0.0.1:8200/v1/pki/issuers
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "key_info": {
-      "1ae8ce9d-2f70-0761-a465-8c9840a247a2": {
-        "issuer_name": "imported-root"
-      },
-      "3dc79a5a-7a6c-70e2-1123-94b88557ba12": {
-        "issuer_name": "root-x1"
-      }
-    },
-    "keys": [
-      "1ae8ce9d-2f70-0761-a465-8c9840a247a2",
-      "3dc79a5a-7a6c-70e2-1123-94b88557ba12"
-    ]
-  }
-}
-```
-
-<a name="read-ca-certificate"></a>
-
-### Read issuer certificate
-
-This endpoint retrieves the specified issuer's certificate.
-
-Note that the response differs between the older `/pki/cert/ca`
-path and the newer `/pki/issuer/:issuer_ref/json` path; the latter
-includes the full `ca_chain` of the issuer, removing the need for a separate
-endpoint.
-
-These are unauthenticated endpoints.
-
-~> Note: this endpoint accepts the `If-Modified-Since` header, to respond with
-   304 Not Modified when the requested resource has not changed. This header
-   needs to be allowed on the PKI mount by tuning the `passthrough_request_headers`
-   option. In order for clients to know the last modified time, the response
-   header `Last-Modified` needs to be added to the mount tunable
-   `allowed_response_headers`.
-
-| Method | Path                           | Issuer    | Format                                                                            |
-| :----- | :----------------------------- | :-------- |:----------------------------------------------------------------------------------|
-| `GET`  | `/pki/cert/ca`                 | `default` | JSON                                                                              |
-| `GET`  | `/pki/ca`                      | `default` | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") |
-| `GET`  | `/pki/ca/pem`                  | `default` | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") |
-| `GET`  | `/pki/issuer/:issuer_ref/json` | Selected  | JSON                                                                              |
-| `GET`  | `/pki/issuer/:issuer_ref/der`  | Selected  | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") |
-| `GET`  | `/pki/issuer/:issuer_ref/pem`  | Selected  | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") |
-
-#### Parameters
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-~> Note: This parameter is not present on the `/pki/cert/ca` and
-   `/pki/ca(/pem)?` paths and takes the implicit value `default`.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/pki/issuer/root-x1/json
-```
-
-#### Sample response
-
-```text
-{
-  "data": {
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDFDCCAfygAwIBAgIUXgxy54mKooz5soqQoRINazH/3pQwDQYJKoZIhvcNAQEL\n...",
-      "-----BEGIN CERTIFICATE-----\nMIIDFTCCAf2gAwIBAgIUUo/qwLm5AyqUWqFHw1MlgwUtS/kwDQYJKoZIhvcNAQEL\n..."
-    ],
-    "certificate": "-----BEGIN CERTIFICATE-----\nnMIIDFDCCAfygAwIBAgIUXgxy54mKooz5soqQoRINazH/3pQwDQYJKoZIhvcNAQEL...",
-    "revocation_time": 0
-  }
-}
-```
-
-<a name="read-ca-certificate-chain"></a>
-
-### Read default issuer certificate chain
-
-This endpoint retrieves the default issuer's CA certificate chain, including
-the default issuer.
-
-To read [other issuers' chains](#read-issuer-certificate), use the
-`/pki/issuer/:issuer_ref/json` endpoint instead.
-
-These are unauthenticated endpoints.
-
-| Method | Path                 | Issuer    | Format                                                                            |
-| :----- | :------------------- | :-------- |:----------------------------------------------------------------------------------|
-| `GET`  | `/pki/ca_chain`      | `default` | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") |
-| `GET`  | `/pki/cert/ca_chain` | `default` | JSON                                                                              |
-
-~> **Note**: As of Vault 1.11.0, these endpoints now return the full chain
-   (including the default issuer's certificate and all parent issuers known
-   to Vault) in these responses.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/pki/ca_chain
-```
-
-#### Sample response
-
-```text
-<PEM-encoded certificate chain>
-```
-
-<a name="read-crl"></a>
-
-### Read issuer CRL
-
-This endpoint retrieves the specified issuer's CRL.
-
-Note that the response differs between the older `/pki/cert/crl` path and
-the newer `/pki/issuer/:issuer_ref/crl` path; the latter correctly places the
-PEM-encoded CRL in the `crl` field whereas the former incorrectly places it
-in the `certificate` field.
-
-Endpoints with type `complete` are full CRLs containing all revoked
-certificates (as of the time of generation. Endpoints with type `delta`
-contain incremental CRLs on top of the last complete CRL, with any new
-certificates that have been revoked. See the [revocation configuration
-section](#set-crl-configuration) for more information about these options.
-The delta CRL clears when the next complete CRL is rebuilt. Consumers of
-delta CRLs will need to update their client to support fetching the
-corresponding full CRL when it has been regenerated; otherwise, some serial
-numbers may not appear in the local copy of the full CRL if the remote
-complete and delta CRLs has been regenerated.
-
-Endpoints with source `local` only include cluster-local revocations. When
-the `unified_crl` parameters is enabled in the [CRL
-configuration](#set-crl-configuration), endpoints with source `unified`
-will have revocations from all clusters. Generally use of the `unified`
-source is more consistent with expectations of external apps, but see
-the [PKI Considerations](/vault/docs/secrets/pki/considerations) page
-for a discussion on cluster size and unified CRLs/OCSP.
-
-<EnterpriseAlert product="vault">
-  Unified CRLs require a Vault Enterprise license or HCP Plus cluster.
-</EnterpriseAlert>
-
-These are unauthenticated endpoints.
-
-~> **Note**: As of Vault 1.11.0, these endpoints now serve a [version 2](https://datatracker.ietf.org/doc/html/rfc5280#section-5.1.2.1) CRL response.
-
-~> Note: this endpoint accepts the `If-Modified-Since` header, to respond with
-   304 Not Modified when the requested resource has not changed. This header
-   needs to be allowed on the PKI mount by tuning the `passthrough_request_headers`
-   option. In order for clients to know the last modified time, the response
-   header `Last-Modified` needs to be added to the mount tunable
-   `allowed_response_headers`.
-
-| Method | Path                                            | Issuer    | Format                                                                            | Type     | Source  |
-| :----- | :---------------------------------------------- | :-------- | :-------------------------------------------------------------------------------- | :------- | :------ |
-| `GET`  | `/pki/cert/crl`                                 | `default` | JSON                                                                              | Complete | Local   |
-| `GET`  | `/pki/crl`                                      | `default` | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Complete | Local   |
-| `GET`  | `/pki/crl/pem`                                  | `default` | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Complete | Local   |
-| `GET`  | `/pki/cert/delta-crl`                           | `default` | JSON                                                                              | Delta    | Local   |
-| `GET`  | `/pki/crl/delta`                                | `default` | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Delta    | Local   |
-| `GET`  | `/pki/crl/delta/pem`                            | `default` | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Delta    | Local   |
-| `GET`  | `/pki/issuer/:issuer_ref/crl`                   | Selected  | JSON                                                                              | Complete | Local   |
-| `GET`  | `/pki/issuer/:issuer_ref/crl/der`               | Selected  | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Complete | Local   |
-| `GET`  | `/pki/issuer/:issuer_ref/crl/pem`               | Selected  | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Complete | Local   |
-| `GET`  | `/pki/issuer/:issuer_ref/crl/delta`             | Selected  | JSON                                                                              | Delta    | Local   |
-| `GET`  | `/pki/issuer/:issuer_ref/crl/delta/der`         | Selected  | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Delta    | Local   |
-| `GET`  | `/pki/issuer/:issuer_ref/crl/delta/pem`         | Selected  | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Delta    | Local   |
-| `GET`  | `/pki/cert/unified-crl`                         | `default` | JSON                                                                              | Complete | Unified |
-| `GET`  | `/pki/unified-crl`                              | `default` | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Complete | Unified |
-| `GET`  | `/pki/unified-crl/pem`                          | `default` | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Complete | Unified |
-| `GET`  | `/pki/cert/unified-delta-crl`                   | `default` | JSON                                                                              | Delta    | Unified |
-| `GET`  | `/pki/unified-crl/delta`                        | `default` | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Delta    | Unified |
-| `GET`  | `/pki/unified-crl/delta/pem`                    | `default` | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Delta    | Unified |
-| `GET`  | `/pki/issuer/:issuer_ref/unified-crl`           | Selected  | JSON                                                                              | Complete | Unified |
-| `GET`  | `/pki/issuer/:issuer_ref/unified-crl/der`       | Selected  | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Complete | Unified |
-| `GET`  | `/pki/issuer/:issuer_ref/unified-crl/pem`       | Selected  | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Complete | Unified |
-| `GET`  | `/pki/issuer/:issuer_ref/unified-crl/delta`     | Selected  | JSON                                                                              | Delta    | Unified |
-| `GET`  | `/pki/issuer/:issuer_ref/unified-crl/delta/der` | Selected  | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Delta    | Unified |
-| `GET`  | `/pki/issuer/:issuer_ref/unified-crl/delta/pem` | Selected  | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Delta    | Unified |
-
-#### Parameters
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-~> Note: This parameter is not present on the `/pki/cert/crl` and
-   `/pki/crl(/pem)?` paths and takes the implicit value `default`.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/pki/issuer/root-x1/crl
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "crl": "-----BEGIN X509 CRL-----\nMIIBizB1AgEBMA0GCSqGSIb3DQEBCwUAMBIxEDAOBgNVBAMTB3Jvb3QgeDEXDTIy\n..."
-  }
-}
-```
-
-### OCSP request
-
-This endpoint retrieves an OCSP response (revocation status) for a given serial number. The request/response formats are
-based on [RFC 6960](https://datatracker.ietf.org/doc/html/rfc6960)
-
-Endpoints with source `local` only include cluster-local revocations. When
-the `unified_crl` parameters is enabled in the [CRL
-configuration](#set-crl-configuration), endpoints with source `unified`
-will have revocations from all clusters. Generally use of the `unified`
-source is more consistent with expectations of external apps, but see
-the [PKI Considerations](/vault/docs/secrets/pki/considerations) page
-for a discussion on cluster size and unified CRLs/OCSP.
-
-<EnterpriseAlert product="vault">
-  Unified OCSP requires a Vault Enterprise license or HCP Plus cluster.
-</EnterpriseAlert>
-
-At this time there are certain limitations of the OCSP implementation at this path:
-
- 1. Only a single serial number within the request will appear in the response,
- 1. None of the extensions defined in the RFC are supported for requests or responses,
- 1. Ed25519 backed CA's are not supported for OCSP requests,
- 1. Note that this API will not work with the Vault client as both request and responses are DER encoded, and
- 1. Note that KMS based issuers which require PSS support are not supported either (such as PKCS#11 HSMs or GCP in certain scenarios).
-
-These are unauthenticated endpoints.
-
-| Method | Path                                                       | Response Format                                                                   | Source  |
-| :----- | :--------------------------------------------------------- | :-------------------------------------------------------------------------------- | :------ |
-| `GET`  | `/pki/ocsp/<base 64+URL encoded ocsp DER request>`         | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Local   |
-| `POST` | `/pki/ocsp`                                                | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Local   |
-| `GET`  | `/pki/unified-ocsp/<base 64+URL encoded ocsp DER request>` | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Unified |
-| `POST` | `/pki/unified-ocsp`                                        | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") | Unified |
-
-#### Parameters
-
- - None
-
-#### Sample request
-
-```shell-session
-openssl ocsp -no_nonce -issuer issuer.pem -CAfile ca_chain.pem -cert cert-to-revoke.pem -text -url $VAULT_ADDR/v1/pki/ocsp
-```
-
-### List certificates
-
-This endpoint returns a list of the current certificates by serial number only.
-The response does not include the [special serial numbers](#read-certificate-serial-param-values)
-(`ca`, `ca_chain`, and `crl`) that can be used with `/pki/cert/:serial`.
-
-This includes only certificates issued by this mount with `no_store=false`.
-While root generation does create entries here, importing certificates
-(including both roots and intermediates) will not cause the imported
-certificate's serial number to appear in this list.
-
-~> Note: The endpoint to list all certificates is authenticated. This is to
-   prevent automated enumeration of issued certificates for internal services;
-   however, this information should generally be considered non-sensitive and
-   the certificates themselves are exposed without authentication (provided
-   their serial number is known).<br /><br />
-   Many Public CAs participate in the Certificate Transparency initiative,
-   where all issued certificates are publicly disclosed in the interest
-   of third-party verification of CA integrity.
-
-| Method | Path         |
-| :----- | :----------- |
-| `LIST` | `/pki/certs` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/pki/certs
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "keys": [
-      "17:67:16:b0:b9:45:58:c0:3a:29:e3:cb:d6:98:33:7a:a6:3b:66:c1",
-      "26:0f:76:93:73:cb:3f:a0:7a:ff:97:85:42:48:3a:aa:e5:96:03:21"
-    ]
-  }
-}
-```
-
-<a name="read-raw-certificate"></a>
-
-### Read certificate
-
-This endpoint retrieves the certificate specified by its serial number,
-including issued certificates.
-
-~> Note: With the exception of the special values (`ca`, `crl`, and
-   `ca_chain`), `/pki/cert/:serial` will return different results on
-   different clusters. This is because stored certificates are not
-   replicated across different Performance Replication clusters.
-
-These are unauthenticated endpoints.
-
-| Method | Path                        | Format                                                                            |
-| :----- | :-------------------------- |:----------------------------------------------------------------------------------|
-| `GET`  | `/pki/cert/:serial`         | JSON                                                                              |
-| `GET`  | `/pki/cert/:serial/raw`     | DER [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") |
-| `GET`  | `/pki/cert/:serial/raw/pem` | PEM [\[1\]](#vault-cli-with-der-pem-responses "Vault CLI With DER/PEM Responses") |
-
-#### Parameters
-
-- `serial` `(string: <required>)` - Specifies the serial of the key to read.
-  This is part of the request URL. Valid values for `serial` are:
-
-<a name="read-certificate-serial-param-values"></a>
-
-  - `<serial>` for the certificate with the given serial number, in hyphen-separated or colon-separated hexadecimal.
-  - `ca` for the _default_ issuer's CA certificate
-  - `crl` for the _default_ issuer's CRL
-  - `ca_chain` for the _default_ issuer's CA trust chain.
-
-~> **Note**: As of Vault 1.11.0, these endpoints return the full chain
-   (including this certificate and all parent issuers known to Vault) in
-   the `ca_chain` response, for both the `certificate` and newer `ca_chain`
-   fields. The root certificate is no longer elided.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/pki/cert/67:b4:f7:2c:aa:ef:b9:30:f6:ae:f5:12:21:79:ac:08:8a:86:89:72
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIGmDCCBYCgAwIBAgIHBzEB3fTzhTANBgkqhkiG9w0BAQsFADCBjDELMAkGA1UE\n...",
-    "revocation_time": 1667400107,
-    "revocation_time_rfc3339": "2022-11-02T14:41:47.327515Z",
-    "issuer_id": "e27bf456-51e1-d937-0001-4a609184fd9b"
-  }
-}
-```
-
----
-
-## Managing keys and issuers
-
-The following endpoints are highly privileged and allow operators to generate
-or import new issuer certificates and keys, remove existing keys and issuers,
-or read internal information about keys and issuers.
-
-### List issuers
-
-Refer to the [earlier section](#list-issuers) for more information about
-listing issuers.
-
-### List keys
-
-This endpoint returns a list of keys currently provisioned in this mount.
-The response includes both the key's identifier as well as the name chosen
-by the operators; either can be used to refer to the key later.
-
-This endpoint is authenticated.
-
-| Method | Path         |
-| :----- | :----------- |
-| `LIST` | `/pki/keys`  |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/pki/keys
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "key_info": {
-      "f9244f54-adc7-4a5c-6b08-6ca3a3325620": {
-        "key_name": "imported-root-key"
-      },
-    },
-    "keys": [
-      "f9244f54-adc7-4a5c-6b08-6ca3a3325620",
-    ]
-  }
-}
-```
-
-### Generate key
-
-This endpoint generates a new private key for use in the PKI mount. This key
-can be used with either the [root](#generate-root) or [intermediate](#generate-intermediate-csr)
-endpoints, using the `type=existing` variant.
-
-If the path ends with `exported`, the private key will be returned in the
-response; if it is `internal` the private key will not be returned and _cannot
-be retrieved later_; if it is `kms`, a [managed keys](#managed-keys) will be
-used.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `POST` | `/pki/keys/generate/:type`         |
-
-#### Parameters
-
-- `type` `(string: <required>)` - Specifies the type of the key to
-  create. If `exported`, the private key will be returned in the response; if
-  `internal` the private key will not be returned and _cannot be retrieved
-  later_; `kms` is also supported: [see below for more details about managed
-  keys](#managed-keys). This parameter is part of the request URL.
-
-- `key_name` `(string: "")` - When a new key is created with this request,
-  optionally specifies the name for this. The global ref `default` may not
-  be used as a name.
-
-- `key_type` `(string: "rsa")` - Specifies the desired key type; must be `rsa`, `ed25519`
-  or `ec`.
-
-~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-   and thus should not be used: `ed25519`.
-
-- `key_bits` `(int: 0)` - Specifies the number of bits to use for the
-  generated keys. Allowed values are 0 (universal default); with
-  `key_type=rsa`, allowed values are: 2048 (default), 3072, 4096 or 8192;
-  with `key_type=ec`, allowed values are: 224, 256 (default),
-  384, or 521; ignored with `key_type=ed25519`.
-
-#### Managed keys parameters
-
-See [Managed Keys](#managed-keys) for additional details on this feature, if
-`type` was set to `kms`. One of the following parameters must be set
-
-- `managed_key_name` `(string: "")` - The managed key's configured name.
-
-- `managed_key_id` `(string: "")` - The managed key's UUID.
-
-#### Sample payload
-
-```json
-{
-  "key_type": "ec",
-  "key_bits": "256",
-  "key_name": "root-key-2022"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/keys/generate/internal
-```
-
-#### Sample response
-
-```json
-{
-  "request_id": "8ad22b2f-7d14-f2cd-a10a-d1abc33676ab",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "key_id": "adda2443-a8aa-d181-9d07-07c7be6a76ab",
-    "key_name": "root-key-2022",
-    "key_type": "ec"
-  },
-  "warnings": null
-}
-```
-
-### Generate root
-
-This endpoint generates a new self-signed CA certificate and private key. If
-the path ends with `exported`, the private key will be returned in the
-response; if it is `internal` the private key will not be returned and _cannot
-be retrieved later_; if it is `existing`, the key specified by `key_ref` will
-be reused for this root; if it is `kms`, a [managed keys](#managed-keys) will
-be used.
-
-This generated root will sign its own CRL. Authority Access distribution points
-use the values set via `config/urls`.
-
-~> **Note**: As of Vault 1.11.0, the PKI Secrets Engine now supports multiple
-   issuers under a single mount. Use the management operations in this section
-   to [list](#list-issuers) and [modify issuers](#update-issuer) within this
-   mount. No issuers will be overridden by calling this operation. Deleting
-   individual keys and issuers should be preferred to calling `DELETE /pki/root`,
-   [which deletes everything](#delete-all-issuers-and-keys).
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `POST` | `/pki/root/generate/:type`         |
-| `POST` | `/pki/issuers/generate/root/:type` |
-| `POST` | `/pki/root/rotate/:type`           |
-
-#### Parameters
-
-- `type` `(string: <required>)` - Specifies the type of the root to
-  create. If `exported`, the private key will be returned in the response; if
-  `internal` the private key will not be returned and _cannot be retrieved
-  later_; if `existing`, we use the value of the `key_ref` parameter to find
-  existing key material to create the CSR; `kms` is also supported: [see below
-  for more details about managed keys](#managed-keys). This parameter is part
-  of the request URL.
-
-- `issuer_name` `(string: "")` - Provides a name to the specified issuer. The
-  name must be unique across all issuers and not be the reserved value
-  `default`. When no value is supplied and the path is `/pki/root/rotate/:type`,
-  the default value of `"next"` will be used.
-
-- `key_name` `(string: "")` - When a new key is created with this request,
-  optionally specifies the name for this. The global ref `default` may not
-  be used as a name.
-
-- `key_ref` `(string: "default")` - Specifies the key (either `default`, by
-  name, or by identifier) to use for generating this request. Only suitable
-  for `type=existing` requests.
-
-- `common_name` `(string: <required>)` - Specifies the requested CN for the
-  certificate. If more than one `common_name` is desired, specify the
-  alternative names in the `alt_names` list.
-
-- `alt_names` `(string: "")` - Specifies the requested Subject Alternative
-  Names, in a comma-delimited list. These can be host names or email addresses;
-  they will be parsed into their respective fields.
-
-- `ip_sans` `(string: "")` - Specifies the requested IP Subject Alternative
-  Names, in a comma-delimited list.
-
-- `uri_sans` `(string: "")` - Specifies the requested URI Subject Alternative
-  Names, in a comma-delimited list.
-
-- `other_sans` `(string: "")` - Specifies custom OID/UTF8-string SANs. These
-  must match values specified on the role in `allowed_other_sans` (see role
-  creation for allowed_other_sans globbing rules).
-  The format is the same as OpenSSL: `<oid>;<type>:<value>` where the
-  only current valid type is `UTF8`. This can be a comma-delimited list or a
-  JSON string slice.
-
-- `ttl` `(string: "")` - Specifies the requested Time To Live (after which the
-  certificate will be expired). This cannot be larger than the engine's max (or,
-  if not set, the system max). See `not_after` as an alternative for setting an
-  absolute end date (rather than a relative one).
-
-- `format` `(string: "pem")` - Specifies the format for returned data. Can be
-  `pem`, `der`, or `pem_bundle`. If `der`, the output is base64 encoded. If
-  `pem_bundle`, the `certificate` field will contain the private key (if
-  exported) and certificate, concatenated; if the issuing CA is not a
-  Vault-derived self-signed root, this will be included as well.
-
-- `private_key_format` `(string: "der")` - Specifies the format for marshaling
-  the private key within the private_key response field. Defaults to `der` which will
-  return either base64-encoded DER or PEM-encoded DER, depending on the value of
-  `format`. The other option is `pkcs8` which will return the key marshalled as
-  PEM-encoded PKCS8.
-
-~> **Note** that this does not apply to the private key within the certificate
-  field if `format=pem_bundle` parameter is specified.
-
-- `key_type` `(string: "rsa")` - Specifies the desired key type; must be `rsa`, `ed25519`
-  or `ec`.
-
-~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-   and thus should not be used: `ed25519`.
-
-- `key_bits` `(int: 0)` - Specifies the number of bits to use for the
-  generated keys. Allowed values are 0 (universal default); with
-  `key_type=rsa`, allowed values are: 2048 (default), 3072, 4096 or 8192;
-  with `key_type=ec`, allowed values are: 224, 256 (default),
-  384, or 521; ignored with `key_type=ed25519`.
-
-- `max_path_length` `(int: -1)` - Specifies the maximum path length to encode in
-  the generated certificate. `-1` means no limit. Unless the signing certificate
-  has a maximum path length set, in which case the path length is set to one
-  less than that of the signing certificate. A limit of `0` means a literal
-  path length of zero.
-
-- `exclude_cn_from_sans` `(bool: false)` - If true, the given `common_name` will
-  not be included in DNS or Email Subject Alternate Names (as appropriate).
-  Useful if the CN is not a hostname or email address, but is instead some
-  human-readable identifier.
-
-- `permitted_dns_domains` `(string: "")` - A comma separated string (or, string
-  array) containing DNS domains for which certificates are allowed to be issued
-  or signed by this CA certificate. Note that subdomains are allowed, as per
-  [RFC 5280 Section 4.2.1.10 - Name
-  Constraints](https://tools.ietf.org/html/rfc5280#section-4.2.1.10).
-
-- `ou` `(string: "")` - Specifies the OU (OrganizationalUnit) values in the
-  subject field of the resulting certificate. This is a comma-separated string
-  or JSON array.
-
-- `organization` `(string: "")` - Specifies the O (Organization) values in the
-  subject field of the resulting certificate. This is a comma-separated string
-  or JSON array.
-
-- `country` `(string: "")` - Specifies the C (Country) values in the subject
-  field of the resulting certificate. This is a comma-separated string or JSON
-  array.
-
-- `locality` `(string: "")` - Specifies the L (Locality) values in the subject
-  field of the resulting certificate. This is a comma-separated string or JSON
-  array.
-
-- `province` `(string: "")` - Specifies the ST (Province) values in the subject
-  field of the resulting certificate. This is a comma-separated string or JSON
-  array.
-
-- `street_address` `(string: "")` - Specifies the Street Address values in the
-  subject field of the resulting certificate. This is a comma-separated string
-  or JSON array.
-
-- `postal_code` `(string: "")` - Specifies the Postal Code values in the
-  subject field of the resulting certificate. This is a comma-separated string
-  or JSON array.
-
-- `serial_number` `(string: "")` -  - Specifies the default Subject's named
-  [Serial Number](https://datatracker.ietf.org/doc/html/rfc4519#section-2.31)
-  value, if any. If you want more than one, specify alternative names in the
-  `alt_names` map using OID 2.5.4.5. Note that this has no impact on the
-  Certificate's serial number field, which Vault randomly generates.
-
-- `not_before_duration` `(duration: "30s")` - Specifies the duration by which to
-  backdate the NotBefore property. This value has no impact in the validity period
-  of the requested certificate, specified in the `ttl` field.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `not_after` `(string)` - Set the Not After field of the certificate with
-  specified date value. The value format should be given in UTC format
-  `YYYY-MM-ddTHH:MM:SSZ`. Supports the Y10K end date for IEEE 802.1AR-2018
-  standard devices, `9999-12-31T23:59:59Z`.
-
-* ~> Note: Keys of type `rsa` currently only support PKCS#1 v1.5 signatures.
-
-#### Managed keys parameters
-
-See [Managed Keys](#managed-keys) for additional details on this feature, if
-`type` was set to `kms`. One of the following parameters must be set
-
-- `managed_key_name` `(string: "")` - The managed key's configured name.
-
-- `managed_key_id` `(string: "")` - The managed key's UUID.
-
-#### Sample payload
-
-```json
-{
-  "common_name": "example.com"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/root/generate/internal
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "expiration": "1654105687",
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE-----\n",
-    "issuing_ca": "-----BEGIN CERTIFICATE-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE-----\n",
-    "serial_number": "39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58",
-    "issuer_id": "7b493f17-6c08-ff73-cf1a-99bfcc448a73",
-    "issuer_name": "",
-    "key_id": "22b82e37-529d-7251-7d78-3862bfd069ac",
-    "key_name": ""
-  },
-  "auth": null
-}
-```
-
-<a name="generate-intermediate"></a>
-
-### Generate intermediate CSR
-
-This endpoint returns a new CSR for signing, optionally generating a new private
-key. If using Vault as a root (and, like many other CAs), the various parameters
-on the final signed certificate are set at signing time and _may or may not honor
-the parameters set here_ (and transmitted in the returned CSR).
-
-Note that this API supports [Managed Keys](/vault/docs/enterprise/managed-keys);
-additional details are available [below in a dedicated section](#managed-keys).
-
-The parameters below are mostly meant as a helper function; not all possible
-parameters that can be set in a CSR are supported in this request.
-
-No new issuer is yet created by this call; note that a new key may be
-generated depending on the `type` request parameter.
-
-~> **Note**: In order to complete the intermediate generation, the CSR must be
-   signed and the resulting certificate imported. This may involve working with
-   external systems (such as an external or offline root CA) to transmit the
-   CSR and complete the signing before the signed intermediate certificate is
-   [imported](#import-ca-certificate-and-keys) into this mount.
-
-| Method | Path                                       | Private key source (`type`) |
-| :----- |:-------------------------------------------| :-------------------------- |
-| `POST` | `/pki/intermediate/generate/:type`         | specified per request       |
-| `POST` | `/pki/issuers/generate/intermediate/:type` | specified per request       |
-| `POST` | `/pki/intermediate/cross-sign`             | `existing`                  |
-
-#### Parameters
-
-- `type` `(string: <required>)` - Specifies the type of the intermediate to
-  create. If `exported`, the private key will be returned in the response; if
-  `internal` the private key will not be returned and _cannot be retrieved
-  later_; if `existing`, we expect the `key_ref` parameter to use existing
-  key material to create the CSR; `kms` is also supported: [see below for more
-  details](#managed-keys). This parameter is part of the request URL.
-
-- `common_name` `(string: <required>)` - Specifies the requested CN for the
-  certificate. If more than one `common_name` is desired, specify the
-  alternative names in the `alt_names` list.
-
-- `alt_names` `(string: "")` - Specifies the requested Subject Alternative
-  Names, in a comma-delimited list. These can be host names or email addresses;
-  they will be parsed into their respective fields.
-
-- `ip_sans` `(string: "")` - Specifies the requested IP Subject Alternative
-  Names, in a comma-delimited list.
-
-- `uri_sans` `(string: "")` - Specifies the requested URI Subject Alternative
-  Names, in a comma-delimited list.
-
-- `other_sans` `(string: "")` - Specifies custom OID/UTF8-string SANs. These
-  must match values specified on the role in `allowed_other_sans` (see role
-  creation for allowed_other_sans globbing rules).
-  The format is the same as OpenSSL: `<oid>;<type>:<value>` where the
-  only current valid type is `UTF8`. This can be a comma-delimited list or a
-  JSON string slice.
-
-- `format` `(string: "pem")` - Specifies the format for returned data. This can be
-  `pem`, `der`, or `pem_bundle`; defaults to `pem`. If `der`, the output is
-  base64 encoded. If `pem_bundle`, the `csr` field will contain the private key
-  (if exported) and CSR, concatenated.
-
-- `private_key_format` `(string: "der")` - Specifies the format for marshaling
-  the private key within the private_key response field. Defaults to `der` which will
-  return either base64-encoded DER or PEM-encoded DER, depending on the value of
-  `format`. The other option is `pkcs8` which will return the key marshalled as
-  PEM-encoded PKCS8.
-
-~> **Note** that this does not apply to the private key within the certificate
-  field if `format=pem_bundle` parameter is specified.
-
-- `key_type` `(string: "rsa")` - Specifies the desired key type; must be `rsa`, `ed25519`
-  or `ec`. Not suitable for `type=existing` requests.
-
-~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-   and thus should not be used: `ed25519`.
-
-~> **Note**: Keys of type `rsa` currently only support PKCS#1 v1.5 signatures.
-   This includes any managed keys.
-
-- `key_bits` `(int: 0)` - Specifies the number of bits to use for the
-  generated keys. Allowed values are 0 (universal default); with
-  `key_type=rsa`, allowed values are: 2048 (default), 3072, 4096, or 8192;
-  with `key_type=ec`, allowed values are: 224, 256 (default),
-  384, or 521; ignored with `key_type=ed25519`. Not suitable for
-  `type=existing` requests.
-
-- `key_name` `(string: "")` - When a new key is created with this request,
-  optionally specifies the name for this. The global ref `default` may not
-  be used as a name.
-
-- `key_ref` `(string: "default")` - Specifies the key (either `default`, by
-  name, or by identifier) to use for generating this request. Only suitable
-  for `type=existing` requests.
-
-- `signature_bits` `(int: 0)` - Specifies the number of bits to use in
-  the signature algorithm; accepts 256 for SHA-2-256, 384 for SHA-2-384,
-  and 512 for SHA-2-512. Defaults to 0 to automatically detect based
-  on issuer's key length (SHA-2-256 for RSA keys, and matching the curve size
-  for NIST P-Curves).
-
-~> **Note**: ECDSA and Ed25519 issuers do not follow configuration of the
-`signature_bits` value; only RSA issuers will change signature types
-based on this parameter.
-
-- `exclude_cn_from_sans` `(bool: false)` - If true, the given `common_name` will
-  not be included in DNS or Email Subject Alternate Names (as appropriate).
-  Useful if the CN is not a hostname or email address, but is instead some
-  human-readable identifier.
-
-- `ou` `(string: "")` - Specifies the OU (OrganizationalUnit) values in the
-  subject field of the resulting CSR. This is a comma-separated string
-  or JSON array.
-
-- `organization` `(string: "")` - Specifies the O (Organization) values in the
-  subject field of the resulting CSR. This is a comma-separated string
-  or JSON array.
-
-- `country` `(string: "")` - Specifies the C (Country) values in the subject
-  field of the resulting CSR. This is a comma-separated string or JSON
-  array.
-
-- `locality` `(string: "")` - Specifies the L (Locality) values in the subject
-  field of the resulting CSR. This is a comma-separated string or JSON
-  array.
-
-- `province` `(string: "")` - Specifies the ST (Province) values in the subject
-  field of the resulting CSR. This is a comma-separated string or JSON
-  array.
-
-- `street_address` `(string: "")` - Specifies the Street Address values in the
-  subject field of the resulting CSR. This is a comma-separated string
-  or JSON array.
-
-- `postal_code` `(string: "")` - Specifies the Postal Code values in the
-  subject field of the resulting CSR. This is a comma-separated string
-  or JSON array.
-
-- `serial_number` `(string: "")` - Specifies the requested Subject's named
-  [Serial Number](https://datatracker.ietf.org/doc/html/rfc4519#section-2.31)
-  value, if any. If you want more than one, specify alternative names in the
-  `alt_names` map using OID 2.5.4.5. Note that this has no impact on the
-  Certificate's serial number field, which Vault randomly generates.
-
-- `add_basic_constraints` `(bool: false)` - Whether to add a Basic Constraints
-  extension with CA: true. Only needed as a workaround in some compatibility
-  scenarios with Active Directory Certificate Services.
-
-#### Managed keys parameters
-
-See [Managed Keys](#managed-keys) for additional details on this feature, if
-`type` was set to `kms`. One of the following parameters must be set
-
-- `managed_key_name` `(string: "")` - The managed key's configured name.
-
-- `managed_key_id` `(string: "")` - The managed key's UUID.
-
-#### Sample payload
-
-```json
-{
-  "common_name": "www.example.com"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/intermediate/generate/exported
-```
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIDzDCCAragAwIBAgIUOd0ukLcjH43TfTHFG9qE0FtlMVgwCwYJKoZIhvcNAQEL\n...\numkqeYeO30g1uYvDuWLXVA==\n-----END CERTIFICATE REQUEST-----\n",
-    "private_key": "-----BEGIN RSA PRIVATE KEY-----\\nMIIEpAIBAAKCAQEAwsANtGz9gS3o5SwTSlOG1l-----END RSA PRIVATE KEY-----",
-    "private_key_type": "rsa"
-  },
-  "warnings": null,
-  "auth": null
-}
-```
-
-
-<a name="submit-ca-information"></a>
-<a name="set-signed-intermediate"></a>
-
-### Import CA certificates and keys
-
-This endpoint allows submitting (importing) the CA information for the backend
-via a PEM file containing the CA certificate and any private keys, concatenated
-together, in any order.
-
-Each certificate will be validated to ensure it is a valid CA (has an asserted
-isCA basic constraint); non-CA certs will err. Any provided CRLs will be
-ignored. Each unique certificate and private key will be imported as its own
-issuer or key entry; duplicates (including with existing keys) will be ignored.
-
-The response will indicate what issuers and keys were created as part of this
-request (in the `imported_issuers` and `imported_keys`), along with a `mapping`
-field, indicating which keys belong to which issuers (including from already
-imported entries present in the same bundle). In Vault 1.14.0, the response
-also contains an `existing_issuers` and `existing_keys` fields, which specifies
-the issuer and key IDs of any entries in the bundle that already
-existed within this mount.
-
-| Method | Path                           | Allows private keys | Request Parameter |
-| :----- | :----------------------------- | :------------------ | :---------------- |
-| `POST` | `/pki/config/ca`               | yes                 | `pem_bundle`      |
-| `POST` | `/pki/issuers/import/bundle`   | yes                 | `pem_bundle`      |
-| `POST` | `/pki/issuers/import/cert`     | no                  | `pem_bundle`      |
-| `POST` | `/pki/intermediate/set-signed` | no                  | `certificate`     |
-
-~> **Note**: endpoints which allow importing private keys _should_ be considered
-   highly privileged and restricted appropriately. Endpoints which allow
-   importing issuers should also be restricted, but note that issuers without
-   keys are unable to issue certificates or CRLs.
-
-~> Note: Vault will deduplicate differently-encoded but same-valued keys and
-   issuers. This means the returned certificate _may_ differ in encoding from
-   the one provided on subsequent re-imports of the same issuer or key.
-
-~> Note: This import may fail due to CRL rebuilding issues or other potential
-   issues; this may impact long-term use of these issuers, but some issuers or
-   keys may still be imported as a result of this process.
-
-~> Warning: See the [note](/vault/docs/secrets/pki/considerations#issuer-subjects-and-crls)
-   regarding Subject naming on externally created CA certificates and
-   shortcomings with CRL building.
-
-#### Parameters
-
-- `pem_bundle` `(string: <required>)` - Specifies the unencrypted private key
-  and certificate, concatenated in PEM format.
-
-~> Note: this parameter is on the `/pki/config/ca` and `/pki/issuers/import/*`
-   paths; it is not on the `/pki/intermediate/set-signed` path.
-
-- `certificate` `(string: <required>)` - Specifies the certificates to import,
-  concatenated in PEM format.
-
-~> Note: this parameter is **only** on the `/pki/intermediate/set-signed` path.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data "@payload.json" \
-    http://127.0.0.1:8200/v1/pki/config/ca
-```
-
-Note that if you provide the data through the HTTP API, it must be
-JSON-formatted, with newlines replaced with `\n`, like so:
-
-```json
-{
-  "pem_bundle": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END CERTIFICATE-----"
-}
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "imported_issuers": ["1ae8ce9d-2f70-0761-a465-8c9840a247a2"],
-    "imported_keys": ["97be2525-717a-e2f7-88da-0a20e11aad88"],
-    "mapping": {
-      "1ae8ce9d-2f70-0761-a465-8c9840a247a2": "97be2525-717a-e2f7-88da-0a20e11aad88"
-    },
-    "existing_issuers": [],
-    "existing_keys": []
-  }
-}
-```
-
-### Read issuer
-
-This endpoint allows an operator to fetch a single issuer certificate and its
-chain, including internal information not exposed on the [unauthenticated
-`/pki/issuer/:issuer_ref/json`](#read-issuer-certificate) endpoint. This
-includes information about the name, the key material, if an explicitly
-constructed chain has been set, what the behavior is for signing longer TTL'd
-certificates, and what usage modes are set on this issuer.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/pki/issuer/:issuer_ref` |
-
-#### Parameters
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/issuer/default
-```
-
-#### Sample response
-
-```text
-{
-  "data": {
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDFDCCAfygAwIBAgIUXgxy54mKooz5soqQoRINazH/3pQwDQYJKoZIhvcNAQEL\n...",
-      "-----BEGIN CERTIFICATE-----\nMIIDFTCCAf2gAwIBAgIUUo/qwLm5AyqUWqFHw1MlgwUtS/kwDQYJKoZIhvcNAQEL\n..."
-    ],
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDFDCCAfygAwIBAgIUXgxy54mKooz5soqQoRINazH/3pQwDQYJKoZIhvcNAQEL\n...",
-    "issuer_id": "7545992c-1910-0898-9e64-d575549fbe9c",
-    "issuer_name": "root-x1",
-    "key_id": "baadd98d-ec5a-66ac-06b7-dfc91c02c9cf",
-    "leaf_not_after_behavior": "truncate",
-    "manual_chain": null,
-    "usage": "read-only,issuing-certificates,crl-signing,ocsp-signing"
-  }
-}
-```
-
-### Update issuer
-
-This endpoint allows an operator to manage a single issuer, updating various
-properties about it, including its name, an explicitly constructed chain,
-what the behavior is for signing longer TTL'd certificates, and what usage
-modes are set on this issuer.
-
-Note that it is not possible to change the certificate of this issuer; to
-do so, import a new issuer and a new `issuer_id` will be assigned.
-
-| Method  | Path                      |
-| :------ | :------------------------ |
-| `POST`  | `/pki/issuer/:issuer_ref` |
-| `PATCH` | `/pki/issuer/:issuer_ref` |
-
-~> **Note** `POST`ing to this endpoint causes Vault to overwrite the previous
-   contents of the issuer, using the provided request data (and any defaults
-   for elided parameters). It does not update only the provided fields.<br /><br />
-   Since Vault 1.11.0, Vault supports the PATCH operation to this endpoint,
-   using the [JSON patch format](https://datatracker.ietf.org/doc/html/rfc6902)
-   supported by KVv2, allowing update of specific fields. Note that
-   `vault write` uses `POST`.
-
-#### Parameters
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-
-- `issuer_name` `(string: "")` - Provides a name to the specified issuer. The
-  name must be unique across all issuers and not be the reserved value
-  `default`.
-
-- `leaf_not_after_behavior` `(string: "err")` - Behavior of a leaf's
-  `NotAfter` field during issuance. Valid options are:
-
-  - `err`, to error if the computed `NotAfter` exceeds that of this issuer;
-  - `truncate` to silently truncate the requested `NotAfter` value to that
-    of this issuer; or
-  - `permit` to allow this issuance to succeed with a `NotAfter` value
-    exceeding that of this issuer.
-
-~> Note: Not all values result in leaf certificates that can be validated
-   through the entire validity period. It is suggested to use `truncate` for
-   intermediate CAs and `permit` only for root CAs. This is because
-   (root) certificates in browsers' trust stores typically aren't checked
-   for validity, whereas intermediate CA certificates sent in TLS connections
-   are checked for validity at the time of use. This means that a leaf
-   certificate permitted to be issued for longer than the intermediate likely
-   won't continue to validate after the intermediate has expired.
-
-- `manual_chain` `([]string: nil)` - Chain of issuer references to build this
-  issuer's computed CAChain field from, when non-empty.
-
-~> Note: the `manual_chain` field is an advanced field useful when automatic
-   chain building isn't desired. The first element _must_ be the present
-   issuer's reference. Subsequent references _should_ validate previous
-   entries, terminating with a root certificate. _Ideally_ a single linear
-   chain would come first (from this issuer to a single root certificate)
-   before any parallel, alternate chains appear.<br /><br />
-   This field is especially useful for cross-signed intermediates within
-   Vault. Because each cross-signed intermediate will only know of the
-   one root, but issuance should serve both, update the issuers' entries
-   with the desired `manual_chain` value.<br /><br />
-   The CA Chain returned by a GET to the issuer configuration is the same
-   chain presented during signing and (if this issuer is the default) on
-   the `/ca_chain` path. Setting `manual_chain` thus allows controlling
-   the presented chain as desired.
-
-- `usage` `([]string: read-only,issuing-certificates,crl-signing,ocsp-signing)` - Allowed
-  usages for this issuer. Valid options are:
-
-  - `read-only`, to allow this issuer to be read; implict; always allowed;
-  - `issuing-certificates`, to allow this issuer to be used for issuing other
-    certificates; or
-  - `crl-signing`, to allow this issuer to be used for signing CRLs. This is
-    separate from the CRLSign KeyUsage on the x509 certificate, but this usage
-    cannot be set unless that KeyUsage is allowed on the x509 certificate.
-  - `ocsp-signing`, to allow this issuer to be used for signing OCSP responses
-
-~> Note: The `usage` field allows for a soft-delete capability on the issuer,
-   or to prevent use of the issuer prior to it being enabled. For example,
-   as issuance is rotated to a new issuer, the old issuer could be marked
-   `usage=read-only,crl-signing,ocsp-signing`, allowing existing certificates to be revoked
-   (and the CRL updated), but preventing new certificate issuance. After all
-   certificates issued under this certificate have expired, this certificate
-   could be marked `usage=read-only`, freezing the CRL. Finally, after a grace
-   period, the issuer could be deleted.
-
-- `revocation_signature_algorithm` `(string: "")` - Which signature algorithm
-  to use when building CRLs. See Go's [`x509.SignatureAlgorithm`](https://pkg.go.dev/crypto/x509#SignatureAlgorithm)
-  constant for possible values. This flag allows control over hash function
-  and signature scheme (PKCS#1v1.5 vs PSS). The default (empty string) value
-  is for Go to select the signature algorithm automatically, which may not
-  always work.
-
-~> Note: This can fail if the underlying key does not support the requested
-   signature algorithm; this may not always be known at modification time.
-   This most commonly needs to be modified when using PKCS#11 managed keys
-   with the `CKM_RSA_PKCS_PSS` mechanism type.
-
-- `issuing_certificates` `(array<string>: nil)` - Specifies the URL values for
-  the Issuing Certificate field. This can be an array or a comma-separated
-  string list. See also [RFC 5280 Section 4.2.2.1](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.1)
-  for information about the Authority Information Access field.
-
-- `crl_distribution_points` `(array<string>: nil)` - Specifies the URL values
-  for the CRL Distribution Points field. This can be an array or a
-  comma-separated string list. See also [RFC 5280 Section 4.2.1.13](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.13)
-  for information about the CRL Distribution Points field.
-
-~> Note: When multiple Performance Replication clusters are enabled, each
-   cluster will have its own CRL. Additionally, when multiple issuers are
-   in use under a single mount, each issuer will also have its own CRL
-   distribution point. These separate CRLs should either be aggregated into a
-   single CRL (externally; as Vault does not support this functionality)
-   or multiple `crl_distribution_points` should be specified here, pointing
-   to each cluster and issuer.
-
-- `ocsp_servers` `(array<string>: nil)` - Specifies the URL values for the OCSP
-  Servers field. This can be an array or a comma-separated string list. See also
-  [RFC 5280 Section 4.2.2.1](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.1)
-  for information about the Authority Information Access field.
-
-- `enable_aia_url_templating` `(bool: false)` - Specifies that the above AIA
-  URL values (`issuing_certificates`, `crl_distribution_points`, and
-  `ocsp_servers`) should be templated. This replaces the literal value
-  `{{issuer_id}}` with the ID of the issuer doing the issuance, the
-  literal value `{{cluster_path}}` with the value of `path` from the
-  cluster-local configuration endpoint `/config/cluster`, and the
-  literal value `{{cluster_aia_path}}` with the value of `aia_path` from
-  the cluster-local configuration endpoint `/config/cluster`.
-
-~> **Note**: If no cluster-local address is present and templating is used,
-   issuance will fail.
-
-#### Sample payload
-
-```json
-{
-  "issuer_name": "root-x1"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/issuer/default
-```
-
-#### Sample response
-
-```text
-{
-  "data": {
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDFDCCAfygAwIBAgIUXgxy54mKooz5soqQoRINazH/3pQwDQYJKoZIhvcNAQEL\n...",
-      "-----BEGIN CERTIFICATE-----\nMIIDFTCCAf2gAwIBAgIUUo/qwLm5AyqUWqFHw1MlgwUtS/kwDQYJKoZIhvcNAQEL\n..."
-    ],
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDFDCCAfygAwIBAgIUXgxy54mKooz5soqQoRINazH/3pQwDQYJKoZIhvcNAQEL\n...",
-    "issuer_id": "7545992c-1910-0898-9e64-d575549fbe9c",
-    "issuer_name": "root-x1",
-    "key_id": "baadd98d-ec5a-66ac-06b7-dfc91c02c9cf",
-    "leaf_not_after_behavior": "truncate",
-    "manual_chain": null,
-    "usage": "read-only,issuing-certificates,crl-signing,ocsp-signing",
-    "revocation_signature_algorithm": "",
-    "issuing_certificates": ["<url1>", "<url2>"],
-    "crl_distribution_points": ["<url1>", "<url2>"],
-    "ocsp_servers": ["<url1>", "<url2>"]
-  }
-}
-```
-
-### Revoke issuer
-
-This endpoint allows an operator to revoke an issuer certificate, marking it
-unable to issue new certificates and adding it to other issuers' CRLs, if they
-have signed this issuer's certificate. This will cause all CRLs to be rebuilt.
-
-This is mostly provided for book-keeping and as a soft-delete feature, to
-ensure this issuer is not accidentally reused in the future.
-
-~> **Warning**: This operation cannot be undone!
-
-~> Note: This operation **does not** have any impact on other clusters or
-   mounts and **may not** have any impact on whether clients consider these
-   issuers revoked. Revoked issuers will not appear on their own CRLs. Revoked
-   issuers may not appear on other CRLs if a suitable parent is not present in
-   the same mount point. Revoked issuers will still need to be revoked in any
-   other mounts they appear in, both as issuers, in the event of issuer reuse,
-   and as issued certificates, in the event of an external parent mount.
-
-| Method  | Path                             |
-| :------ | :------------------------------- |
-| `POST`  | `/pki/issuer/:issuer_ref/revoke` |
-
-#### Parameters
-
-No parameters.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/pki/issuer/old-intermediate/revoke
-```
-
-#### Sample response
-
-```text
-{
-  "data": {
-    "ca_chain": [
-      "-----BEGIN CERTIFICATE-----\nMIIDFDCCAfygAwIBAgIUXgxy54mKooz5soqQoRINazH/3pQwDQYJKoZIhvcNAQEL\n...",
-      "-----BEGIN CERTIFICATE-----\nMIIDFTCCAf2gAwIBAgIUUo/qwLm5AyqUWqFHw1MlgwUtS/kwDQYJKoZIhvcNAQEL\n..."
-    ],
-    "certificate": "-----BEGIN CERTIFICATE-----\nMIIDFDCCAfygAwIBAgIUXgxy54mKooz5soqQoRINazH/3pQwDQYJKoZIhvcNAQEL\n...",
-    "issuer_id": "7545992c-1910-0898-9e64-d575549fbe9c",
-    "issuer_name": "old-intermediate",
-    "key_id": "baadd98d-ec5a-66ac-06b7-dfc91c02c9cf",
-    "leaf_not_after_behavior": "truncate",
-    "manual_chain": null,
-    "usage": "read-only,issuing-certificates,crl-signing"
-    "revocation_time": 1433269787,
-  }
-}
-```
-
-### Delete issuer
-
-This endpoint deletes the specified issuer. A warning is emitted and the
-default is cleared if this issuer is the default issuer.
-
-~> **Note**: If an issuer is incorrectly deleted, but its key material
-   remains, it is possible to re-import just the issuer certificate. The
-   `issuer_id` will change, but the name can be re-assigned to the new
-   issuer.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/pki/issuer/:issuer_ref` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/pki/issuer/root-x1
-```
-
-### Import key
-
-This endpoint allows an operator to import a single pem encoded `rsa`, `ec`, or `ed25519`
-key.
-
-~> **Note**: This API does not protect against importing keys using insecure combinations of
-  algorithm and key length.
-
-| Method | Path               |
-|:-------|:-------------------|
-| `POST` | `/pki/keys/import` |
-
-#### Parameters
-
-- `pem_bundle` `(string: <required>)` - Specifies the unencrypted private key in PEM format.
-
-- `key_name` `(string: "")` - Provides a name to the specified key. The
-  name must be unique across all keys and not be the reserved value
-  `default`.
-
-#### Sample payload
-
-```json
-{
-  "key_name": "my-imported-key",
-  "pem_bundle": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END CERTIFICATE-----"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/keys/import
-```
-
-#### Sample response
-
-```text
-{
-  "data": {
-    "key_id": "2cf03991-b052-1dc3-393e-374b41f8dcd8",
-    "key_name": "my-imported-key",
-    "key_type": "rsa"
-  },
-}
-```
-
-### Read key
-
-This endpoint allows an operator to fetch information about an existing key.
-
-~> **Note**: Vault does not allow reading the value of the private key after
-   it has been created.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/pki/key/:key_ref` |
-
-#### Parameters
-
-- `key_ref` `(string: <required>)` - Reference to an existing key,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default key, or the name assigned
-  to a key. This parameter is part of the request URL.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/key/default
-```
-
-#### Sample response
-
-```text
-{
-  "data": {
-    "key_id": "8c4046f8-52a8-0974-29d2-745d8a0dd848",
-    "key_name": "key-root-x1",
-    "key_type": "rsa"
-  }
-}
-```
-
-### Update key
-
-This endpoint allows an operator to manage a single key. Currently, the only
-parameter that is configurable is the key's name.
-
-Note that it is not possible to change the private key of this key; to
-do so, import a new key and a new `key_id` will be assigned.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/pki/key/:key_ref` |
-
-~> **Note** `POST`ing to this endpoint causes Vault to overwrite the previous
-   contents of the key, using the provided request data (and any defaults
-   for elided parameters). It does not update only the provided fields.
-
-#### Parameters
-
-- `key_ref` `(string: <required>)` - Reference to an existing key,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default key, or the name assigned
-  to a key. This parameter is part of the request URL.
-
-- `key_name` `(string: "")` - Provides a name to the specified key. The
-  name must be unique across all keys and not be the reserved value
-  `default`.
-
-#### Sample payload
-
-```json
-{
-  "key_name": "key-root-x1"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/key/default
-```
-
-#### Sample response
-
-```text
-{
-  "data": {
-    "key_id": "8c4046f8-52a8-0974-29d2-745d8a0dd848",
-    "key_name": "key-root-x1",
-    "key_type": "rsa"
-  }
-}
-```
-
-### Delete key
-
-This endpoint deletes the specified key. A warning is emitted and the
-default is cleared if this key is the default key.
-
-~> **Note**: Because Vault does not allow exporting the private key
-   after it is initially generated, deletion of keys is a sensitive
-   operation. Additionally, one key may be used by more than one issuer.
-   As a result, Vault prohibits deletion of keys until **all** issuers
-   using this key have also been deleted. If these issuers are still
-   necessary for chain building, re-import them without the corresponding
-   keys after the key has been deleted or use the soft-delete feature
-   of issuers.
-
-| Method   | Path                |
-| :------- | :------------------ |
-| `DELETE` | `/pki/key/:key_ref` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/pki/key/key-root-x1
-```
-
-### Delete all issuers and keys
-
-This endpoint deletes all issuers and keys within the mount. It is highly
-recommended to use the individual delete operations instead. This mount
-will be unusable until new issuers and keys are provisioned.
-
-_This endpoint requires sudo/root privileges._
-
-| Method   | Path        |
-| :------- | :---------- |
-| `DELETE` | `/pki/root` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/pki/root
-```
-
----
-
-## Managing authority information
-
-The following privileged endpoints allow the operator to control information
-about the core contents of certificates and to perform privileged operations
-like rotating the CRLs or performing tidy operations.
-
-### List roles
-
-Refer to the [earlier section](#list-roles) for more information about
-listing roles.
-
-### Create/Update role
-
-This endpoint creates or updates the role definition. Note that the
-`allowed_domains`, `allow_subdomains`, `allow_glob_domains`, and
-`allow_any_name` attributes are additive; between them nearly and across
-multiple roles nearly any issuing policy can be accommodated. `server_flag`,
-`client_flag`, and `code_signing_flag` are additive as well. If a client
-requests a certificate that is not allowed by the CN policy in the role, the
-request is denied.
-
-| Method  | Path               |
-| :------ | :----------------- |
-| `POST`  | `/pki/roles/:name` |
-| `PATCH` | `/pki/roles/:name` |
-
-~> **Note** `POST`ing to this endpoint when the role already exists causes
-   Vault to overwrite the contents of the role, using the provided request
-   data (and any defaults for elided parameters). It does not update only
-   the provided fields.<br /><br />
-   Since Vault 1.11.0, Vault supports the PATCH operation to this endpoint,
-   using the [JSON patch format](https://datatracker.ietf.org/doc/html/rfc6902)
-   supported by KVv2, allowing update of specific fields. Note that
-   `vault write` uses `POST`.
-
-#### Parameters
-
-- `name` `(string: <required>)` - Specifies the name of the role to create. This
-  is part of the request URL.
-
-- `issuer_ref`: `(string: "default")` - Specifies the default issuer of this
-  request. May be the value `default`, a name, or an issuer ID. Use ACLs to
-  prevent access to the `/pki/issuer/:issuer_ref/{issue,sign}/:name` paths
-  to prevent users overriding the role's `issuer_ref` value.
-
-~> Note: This parameter is stored as-is; if the reference is to a name, it
-   is **not** resolve to an identifier. Deletion of issuers (or updating their
-   names) **may** result in issuance failing or using an unexpected issuer.
-
-~> **Note**: existing roles from previous Vault versions are migrated to use
-   the `issuer_ref=default`.
-
-- `ttl` `(string: "")` - Specifies the Time To Live value to be used for the
-  validity period of the requested certificate, provided as a string duration
-  with time suffix. Hour is the largest suffix. The value specified is strictly
-  used for future validity. If not set, uses the system default value or the
-  value of `max_ttl`, whichever is shorter. See `not_after` as an alternative
-  for setting an absolute end date (rather than a relative one).
-
-- `max_ttl` `(string: "")` - Specifies the maximum Time To Live provided as a
-  string duration with time suffix. Hour is the largest suffix. If not set,
-  defaults to the system maximum lease TTL.
-
-- `allow_localhost` `(bool: true)` - Specifies if clients can request
-  certificates for `localhost` as one of the requested common names. This is
-  useful for testing and to allow clients on a single host to talk securely.
-
-~> **Note**: This strictly applies to `localhost` and `localdomain` when this
-   option is enabled. Additionally, even if this option is disabled, if either
-   name is included in `allowed_domains`, the match rules for that option
-   could permit issuance of a certificate for `localhost`.
-
-- `allowed_domains` `(list: [])` - Specifies the domains this role is allowed
-  to issue certificates for. This is used with the `allow_bare_domains`,
-  `allow_subdomains`, and `allow_glob_domains` options to determine the type
-  of matching between these domains and the values of common name, DNS-typed
-  SAN entries, and Email-typed SAN entries. When `allow_any_name` is used,
-  this attribute has no effect.
-
-~> **Note**: The three options `allow_bare_domains`, `allow_subdomains`, and
-   `allow_glob_domains` are each independent of each other. That is, at least
-   one type of allowed matching must describe the relationship between the
-   `allowed_domains` list and the names on the issued certificate. For example,
-   given `allowed_domain=foo.*.example.com` and `allow_subdomains=true` and
-   `allow_glob_domains=true`, a request for `bar.foo.baz.example.com` won't
-   be permitted, even though it `foo.baz.example.com` matches the glob
-   `foo.*.example.com` and `bar` is a subdomain of that.
-
-- `allowed_domains_template` `(bool: false)` - When set, `allowed_domains`
-  may contain templates, as with [ACL Path Templating](/vault/docs/concepts/policies).
-  Non-templated domains are also still permitted.
-
-- `allow_bare_domains` `(bool: false)` - Specifies if clients can request
-  certificates matching the value of the actual domains themselves; e.g. if a
-  configured domain set with `allowed_domains` is `example.com`, this allows
-  clients to actually request a certificate containing the name `example.com` as
-  one of the DNS values on the final certificate. In some scenarios, this can be
-  considered a security risk. Note that when an `allowed_domain` field contains
-  a potential wildcard character (for example, `allowed_domains=*.example.com`)
-  and `allow_bare_domains` and `allow_wildcard_certificates` are both enabled,
-  issuance of a wildcard certificate for `*.example.com` will be permitted.
-
-- `allow_subdomains` `(bool: false)` - Specifies if clients can request
-  certificates with CNs that are subdomains of the CNs allowed by the other role
-  options. _This includes wildcard subdomains._ For example, an
-  `allowed_domains` value of `example.com` with this option set to true will
-  allow `foo.example.com` and `bar.example.com` as well as `*.example.com`. To
-  restrict issuance of wildcards by this option, see `allow_wildcard_certificates`
-  below. This option is redundant when using the `allow_any_name` option.
-
-- `allow_glob_domains` `(bool: false)` - Allows names specified in
-  `allowed_domains` to contain glob patterns (e.g. `ftp*.example.com`). Clients
-  will be allowed to request certificates with names matching the glob
-  patterns.
-
-~> **Note**: These globs behave like shell-style globs and can match
-  across multiple domain parts. For example, `allowed_domains=*.example.com`
-  with `allow_glob_domains` enabled will match not only `foo.example.com` but
-  also `baz.bar.foo.example.com`.
-
-~> **Warning**: Glob patterns will match wildcard domains and permit their
-   issuance unless otherwise restricted by `allow_wildcard_certificates`. For
-   instance, with `allowed_domains=*.*.example.com` and both `allow_glob_domains`
-   and `allow_wildcard_certificates` enabled, we will permit the issuance of
-   a wildcard certificate for `*.foo.example.com`.
-
-- `allow_wildcard_certificates` `(bool: true)` - Allows the issuance of
-  certificates with [RFC 6125](https://tools.ietf.org/html/rfc6125) wildcards
-  in the CN field. When set to `false`, this prevents wildcards from being
-  issued even if they would've been allowed by an option above. We support
-  the following four wildcard types:
-
-  - `*.example.com`, a single wildcard as the entire left-most label,
-  - `foo*.example.com`, a single suffixed wildcard in the left-most label,
-  - `*foo.example.com`, a single prefixed wildcard in the left-most label, and
-  - `f*o.example.com`, a single interior wildcard in the left-most label.
-
-- `allow_any_name` `(bool: false)` - Specifies if clients can request any CN.
-  Useful in some circumstances, but make sure you understand whether it is
-  appropriate for your installation before enabling it. Note that both
-  `enforce_hostnames` and `allow_wildcard_certificates` are still checked,
-  which may introduce limitations on issuance with this option.
-
-- `enforce_hostnames` `(bool: true)` - Specifies if only valid host names are
-  allowed for CNs, DNS SANs, and the host part of email addresses.
-
-- `allow_ip_sans` `(bool: true)` - Specifies if clients can request IP Subject
-  Alternative Names. No authorization checking is performed except to verify
-  that the given values are valid IP addresses.
-
-- `allowed_uri_sans` `(string: "")` - Defines allowed URI Subject
-  Alternative Names. No authorization checking is performed except to verify
-  that the given values are valid URIs. This can be a comma-delimited list or
-  a JSON string slice. Values can contain glob patterns (e.g.
-  `spiffe://hostname/*`).
-
-- `allowed_uri_sans_template` `(bool: false)` - When set, `allowed_uri_sans`
-  may contain templates, as with [ACL Path Templating](/vault/docs/concepts/policies).
-  Non-templated domains are also still permitted.
-
-- `allowed_other_sans` `(string: "")` - Defines allowed custom OID/UTF8-string
-  SANs. This can be a comma-delimited list or a JSON string slice, where
-  each element has the same format as OpenSSL: `<oid>;<type>:<value>`, but
-  the only valid type is `UTF8` or `UTF-8`. The `value` part of an element
-  may be a `*` to allow any value with that OID.
-  Alternatively, specifying a single `*` will allow any `other_sans` input.
-
-- `allowed_serial_numbers` `(string: "")` - If set, an array of allowed serial
-  numbers to be requested during certificate issuance. These values support
-  shell-style globbing. When empty, custom-specified serial numbers will be
-  forbidden. It is strongly recommended to allow Vault to generate random
-  serial numbers instead.
-
-- `server_flag` `(bool: true)` - Specifies if certificates are flagged for
-  server authentication use. See [RFC 5280 Section 4.2.1.12](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12)
-  for information about the Extended Key Usage field.
-
-- `client_flag` `(bool: true)` - Specifies if certificates are flagged for
-  client authentication use. See [RFC 5280 Section 4.2.1.12](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12)
-  for information about the Extended Key Usage field.
-
-- `code_signing_flag` `(bool: false)` - Specifies if certificates are flagged
-  for code signing use. See [RFC 5280 Section 4.2.1.12](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12)
-  for information about the Extended Key Usage field.
-
-- `email_protection_flag` `(bool: false)` - Specifies if certificates are
-  flagged for email protection use. See [RFC 5280 Section 4.2.1.12](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12)
-  for information about the Extended Key Usage field.
-
-- `key_type` `(string: "rsa")` - Specifies the type of key to generate for
-  generated private keys and the type of key expected for submitted CSRs.
-  Currently, `rsa`, `ec`, and `ed25519` are supported, or when signing
-  existing CSRs, `any` can be specified to allow keys of either type
-  and with any bit size (subject to >=2048 bits for RSA keys or >= 224 for EC keys).
-  When `any` is used, this role cannot generate certificates and can only
-  be used to sign CSRs.
-
-~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-   and thus should not be used: `ed25519`.
-
-- `key_bits` `(int: 0)` - Specifies the number of bits to use for the
-  generated keys. Allowed values are 0 (universal default); with
-  `key_type=rsa`, allowed values are: 2048 (default), 3072, 4096 or 8192;
-  with `key_type=ec`, allowed values are: 224, 256 (default),
-  384, or 521; ignored with `key_type=ed25519` or in signing operations
-  when `key_type=any`.
-
-- `signature_bits` `(int: 0)` - Specifies the number of bits to use in
-  the signature algorithm; accepts 256 for SHA-2-256, 384 for SHA-2-384,
-  and 512 for SHA-2-512. Defaults to 0 to automatically detect based
-  on issuer's key length (SHA-2-256 for RSA keys, and matching the curve size
-  for NIST P-Curves).
-
-~> **Note**: ECDSA and Ed25519 issuers do not follow configuration of the
-   `signature_bits` value; only RSA issuers will change signature types
-   based on this parameter.
-
-- `use_pss` `(bool: false)` - Specifies whether or not to use PSS signatures
-  over PKCS#1v1.5 signatures when a RSA-type issuer is used. Ignored for
-  ECDSA/Ed25519 issuers.
-
-- `key_usage` `(list: ["DigitalSignature", "KeyAgreement", "KeyEncipherment"])` -
-  Specifies the allowed key usage constraint on issued certificates. Valid
-  values can be found at https://golang.org/pkg/crypto/x509/#KeyUsage - simply
-  drop the `KeyUsage` part of the value. Values are not case-sensitive. To
-  specify no key usage constraints, set this to an empty list. See
-  [RFC 5280 Section 4.2.1.3](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3)
-  for more information about the Key Usage field.
-
-- `ext_key_usage` `(list: [])` -
-  Specifies the allowed extended key usage constraint on issued certificates. Valid
-  values can be found at https://golang.org/pkg/crypto/x509/#ExtKeyUsage - simply
-  drop the `ExtKeyUsage` part of the value. Values are not case-sensitive. To
-  specify no key usage constraints, set this to an empty list. See
-  [RFC 5280 Section 4.2.1.12](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12)
-  for information about the Extended Key Usage field.
-
-- `ext_key_usage_oids` `(string: "")` - A comma-separated string or list of extended
-  key usage oids. Useful for adding EKUs not supported by the Go standard library.
-
-- `use_csr_common_name` `(bool: true)` - When used with the CSR signing
-  endpoint, the common name in the CSR will be used instead of taken from the
-  JSON data. This does not include any requested SANs in the CSR; use
-  `use_csr_sans` for that.
-
-- `use_csr_sans` `(bool: true)` - When used with the CSR signing endpoint, the
-  subject alternate names in the CSR will be used instead of taken from the JSON
-  data. This does not include the common name in the CSR; use
-  `use_csr_common_name` for that.
-
-- `ou` `(string: "")` - Specifies the OU (OrganizationalUnit) values in the
-  subject field of issued certificates. This is a comma-separated string or
-  JSON array.
-
-- `organization` `(string: "")` - Specifies the O (Organization) values in the
-  subject field of issued certificates. This is a comma-separated string or
-  JSON array.
-
-- `country` `(string: "")` - Specifies the C (Country) values in the
-  subject field of issued certificates. This is a comma-separated string or
-  JSON array.
-
-- `locality` `(string: "")` - Specifies the L (Locality) values in the
-  subject field of issued certificates. This is a comma-separated string or
-  JSON array.
-
-- `province` `(string: "")` - Specifies the ST (Province) values in the
-  subject field of issued certificates. This is a comma-separated string or
-  JSON array.
-
-- `street_address` `(string: "")` - Specifies the Street Address values in the
-  subject field of issued certificates. This is a comma-separated string or
-  JSON array.
-
-- `postal_code` `(string: "")` - Specifies the Postal Code values in the
-  subject field of issued certificates. This is a comma-separated string or
-  JSON array.
-
-- `generate_lease` `(bool: false)` - Specifies if certificates issued/signed
-  against this role will have Vault leases attached to them. Certificates can be
-  added to the CRL by `vault revoke <lease_id>` when certificates are associated
-  with leases. It can also be done using the `pki/revoke` endpoint. However,
-  when lease generation is disabled, invoking `pki/revoke` would be the only way
-  to add the certificates to the CRL. When large number of certificates are
-  generated with long lifetimes, it is recommended that lease generation be
-  disabled, as large amount of leases adversely affect the startup time of Vault.
-
-- `no_store` `(bool: false)` - If set, certificates issued/signed against this
-  role will not be stored in the storage backend. This can improve performance
-  when issuing large numbers of certificates. However, certificates issued in
-  this way cannot be enumerated or revoked via serial number. Certificates may
-  still be revoked via [BYOC revocation](#certificate-1).
-  This option is recommend only for certificates that are non-sensitive,
-  extremely short-lived, or have high volume/turn-over that would prohibit
-  storage. This option implies a value of `false` for `generate_lease`.
-
-- `require_cn` `(bool: true)` - If set to false, makes the `common_name` field
-  optional while generating a certificate.
-
-- `policy_identifiers` `(list: [])` - A comma-separated string or list of policy
-  OIDs.
-
-- `basic_constraints_valid_for_non_ca` `(bool: false)` - Mark Basic Constraints
-  valid when issuing non-CA certificates.
-
-- `not_before_duration` `(duration: "30s")` - Specifies the duration by which to
-  backdate the NotBefore property. This value has no impact in the validity period
-  of the requested certificate, specified in the `ttl` field.
-
-- `not_after` `(string)` - Set the Not After field of the certificate with
-  specified date value. The value format should be given in UTC format
-  `YYYY-MM-ddTHH:MM:SSZ`. Supports the Y10K end date for IEEE 802.1AR-2018
-  standard devices, `9999-12-31T23:59:59Z`.
-
-- `cn_validations` `(list: ["email", "hostname"])` - Validations to run on the
-  Common Name field of the certificate. Valid values include:
-
-   - `email`, to ensure the Common Name is an email address (contains an `@` sign),
-   - `hostname`, to ensure the Common Name is a hostname (otherwise).
-
-  Multiple values can be separated with a comma or specified as a list and use
-  OR semantics (either email or hostname in the CN are allowed). When the
-  special value "disabled" is used (must be specified alone), none of the usual
-  validation is run (including but not limited to `allowed_domains` and basic
-  correctness validation around email addresses and domain names). This allows
-  non-standard CNs to be used verbatim from the request.
-
-- `allowed_user_ids` `(string: "")` - Comma separated, globbing list of User ID
-  Subject components to allow on requests. By default, no user IDs are allowed.
-  Use the bare wildcard `*` value to allow any value. See also the `user_ids`
-  request parameter.
-
-#### Sample payload
-
-```json
-{
-  "allowed_domains": ["example.com"],
-  "allow_subdomains": true
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/roles/my-role
-```
-
-### Read role
-
-Refer to the [earlier section](#read-role) for more information about
-reading roles.
-
-### Delete role
-
-This endpoint deletes the role definition. Deleting a role **does not**
-revoke certificates previously issued under this role.
-
-| Method   | Path               |
-| :------- | :----------------- |
-| `DELETE` | `/pki/roles/:name` |
-
-#### Parameters
-
-- `name` `(string: <required>)` - Specifies the name of the role to delete. This
-  is part of the request URL.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/pki/roles/my-role
-```
-
-### Read Certificate Issuance External Policy Service (CIEPS) configuration <EnterpriseAlert inline="true" />
-
-This endpoint reads the Certificate Issuance External Policy Service
-(CIEPS) engine <EnterpriseAlert inline="true" /> connection properties.
-
-On top of the configuration parameters documented below, this endpoint
-returns the following parameters:
-
- - `external_service_last_updated` - An RFC 3339 timestamp indicating when the
-   configuration was last modified.
-
- - `external_service_validated` - Indicates whether a successful connection to
-   the external policy engine has been made under this configuration.
-
- - `last_successful_request` - Timestamp of the last successful request to
-   the external policy engine.
-
-Note that the last two parameters are node-specific and will be reset
-whenever the mount reloads (e.g., leadership election or seal/unseal).
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `GET`  | `/pki/config/external-policy` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/config/external-policy
-```
-
-#### Sample Response
-
-```
-{
-  "data": {
-    "enabled": false,
-    "external_service_last_updated": "0001-01-01T00:00:00Z",
-    "external_service_url": "",
-    "external_service_validated": false,
-    "last_successful_request": "",
-    "timeout": 15000000000,
-    "trusted_ca": "",
-    "trusted_leaf_certificate_bundle": "",
-    "vault_client_cert_bundle": ""
-  },
-}
-
-```
-
-### Set Certificate Issuance External Policy Service (CIEPS) configuration <EnterpriseAlert inline="true" />
-
-This endpoint allows enabling the Certificate Issuance External Policy Service
-(CIEPS) <EnterpriseAlert inline="true" /> engine and configuring connection
-properties.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/pki/config/external-policy` |
-
-#### Parameters
-
- - `enabled` `(bool: false)` - Enables or disables the external policy
-   service. When disabled, issuance mechanisms under `external-policy`
-   paths (e.g., `/pki/external-policy/sign/:policy`) will not work.
-
- - `external_service_url` `(string: <required>)` - URI to the external
-   policy engine. Must use the `https://` scheme.
-
- - `timeout` `(string: "")` - This is how long any particular API request
-   should wait for a timeout at various layers of the stack. Defaults to
-   `15s`.
-
- - `trusted_ca` `(string: "")` - A PEM bundle of trusted CAs to verify the
-   certificates presented by the external policy engine against. Optional;
-   one of `trusted_ca` or `trusted_leaf_certificate_bundle` must be specified.
-
- - `trusted_leaf_certificate_bundle` `(string: "")` - A PEM bundle of pinned
-   non-CA leaf certificates that must be presented by the external policy
-   engine. Optional; one of `trusted_ca` or `trusted_leaf_certificate_bundle`
-   must be specified.
-
- - `vault_client_cert_bundle` `(string: "")` - A PEM bundle of a private key
-   and one or more certificates to present during authentication to the
-   external policy service.
- - `entity_jmespath` `(string: "")` - A JMESPath expression that will select and filter entity metadata to the service. By default no entity metadata beyond the entity id is sent, use "@" to send all information
-
- - `group_jmespath` `(string: "")` - A JMESPath expression that will select and filter entity group metadata to the service. By default no group entity metadata is sent, use "@" to send all information
-#### Sample payload
-
-```json
-{
-  "enabled": true,
-  "external_service_url": "https://cieps.dadgarcorp.internal",
-  "trusted_ca": "-----BEGIN CERTIFICATE-----...."
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/config/external-policy
-```
-
-### Read URLs
-
-This endpoint fetches the URLs to be encoded in generated certificates. No URL
-configuration will be returned until the configuration is set.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/pki/config/urls` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/config/urls
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "issuing_certificates": ["<url1>", "<url2>"],
-    "crl_distribution_points": ["<url1>", "<url2>"],
-    "ocsp_servers": ["<url1>", "<url2>"]
-  },
-  "auth": null
-}
-```
-
-### Set URLs
-
-This endpoint allows setting the issuing certificate endpoints, CRL distribution
-points, and OCSP server endpoints that will be encoded into issued certificates.
-You can update any of the values at any time without affecting the other
-existing values. To remove the values, simply use a blank string as the
-parameter.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/pki/config/urls` |
-
-~> **Note**: When using multiple issuers within the same mount, it is strongly
-   suggested to use the per-issuer AIA information instead of the global
-   AIA information. If any of the per-issuer AIA fields are set, the entire
-   issuer's preferences will be used instead. Otherwise, these fields are used
-   as a fallback.<br /><br />
-   This can be achieved by using _templated_ global AIA values, but setting
-   the cluster-local address in configuration. When used, this value **must**
-   be set on all performance replication clusters, otherwise issuance will
-   fail!
-
-#### Parameters
-
-- `issuing_certificates` `(array<string>: nil)` - Specifies the URL values for
-  the Issuing Certificate field. This can be an array or a comma-separated
-  string list. See also [RFC 5280 Section 4.2.2.1](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.1)
-  for information about the Authority Information Access field.
-
-- `crl_distribution_points` `(array<string>: nil)` - Specifies the URL values
-  for the CRL Distribution Points field. This can be an array or a
-  comma-separated string list. See also [RFC 5280 Section 4.2.1.13](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.13)
-  for information about the CRL Distribution Points field.
-
-~> Note: When multiple Performance Replication clusters are enabled, each
-   cluster will have its own CRL. Additionally, when multiple issuers are
-   in use under a single mount, each issuer will also have its own CRL
-   distribution point. These separate CRLs should either be aggregated into a
-   single CRL (externally; as Vault does not support this functionality)
-   or multiple `crl_distribution_points` should be specified here, pointing
-   to each cluster and issuer.
-
-- `ocsp_servers` `(array<string>: nil)` - Specifies the URL values for the OCSP
-  Servers field. This can be an array or a comma-separated string list. See also
-  [RFC 5280 Section 4.2.2.1](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.2.1)
-  for information about the Authority Information Access field.
-
-- `enable_templating` `(bool: false)` - Specifies that the above AIA
-  URL values (`issuing_certificates`, `crl_distribution_points`, and
-  `ocsp_servers`) should be templated. This replaces the literal value
-  `{{issuer_id}}` with the ID of the issuer doing the issuance, the
-  literal value `{{cluster_path}}` with the value of `path` from the
-  cluster-local configuration endpoint `/config/cluster`, and the
-  literal value `{{cluster_aia_path}}` with the value of `aia_path` from
-  the cluster-local configuration endpoint `/config/cluster`.
-
-  For example, the following values can be used globally to ensure all AIA
-  URIs use the cluster-local, per-issuer canonical reference, but with
-  the issuing CA certificate and CRL distribution points to potentially
-  use an external, non-Vault CDN.
-
-   - `issuing_certificates={{cluster_aia_path}}/issuer/{{issuer_id}}/der`
-   - `crl_distribution_points={{cluster_aia_path}}/issuer/{{issuer_id}}/crl/der`
-   - `ocsp_servers={{cluster_aia_path}}/ocsp`
-
-~> **Note**: If no cluster-local address is present and templating is used,
-   issuance will fail.
-
-#### Sample payload
-
-```json
-{
-  "issuing_certificates": ["{{cluster_aia_path}}/issuer/{{issuer_id}}/der"],
-  "crl_distribution_points": ["{{cluster_aia_path}}/issuer/{{issuer_id}}/crl/der"],
-  "ocsp_servers": ["{{cluster_aia_path}}/ocsp"]
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/config/urls
-```
-
-### Read issuers configuration
-
-This endpoint allows getting the value of the default issuer.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `GET`  | `/pki/config/issuers` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/config/issuers
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "default": "3dc79a5a-7a6c-70e2-1123-94b88557ba12",
-    "default_follows_latest_issuer": "false"
-  }
-}
-```
-
-### Set issuers configuration
-
-This endpoint allows setting the value of the default issuer.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `POST` | `/pki/config/issuers` |
-| `POST` | `/pki/root/replace`   |
-
-#### Parameters
-
-- `default` `(string: "")` - Specifies the default issuer (by reference;
-  either a name or an ID). When no value is specified and the path is
-  `/pki/root/replace`, the default value of `"next"` will be used.
-
-- `default_follows_latest_issuer` `(bool: false)` - Specifies whether a
-  root creation or an issuer import operation updates the default issuer
-  to the newly added issuer.
-
-  While the new multi-issuer functionality of 1.11 was backwards compatible
-  on a per-API basis, some applications relied explicitly on unsafe behavior
-  across multiple APIs that we addressed. For instance, calling
-  `/intermediate/generate/:type` would silently remove any (potentially
-  in-use!) key material and generate new private keys. While our response to
-  this endpoint is backwards compatible (returning a new key and safely
-  preserving old keys), some applications implicitly relied on this behavior.
-  This new option is meant to provide compatibility across API calls to these
-  callers: the newly created issuer (once _imported_ -- not on intermediate
-  generation) will become the default and it will look (to anyone strictly
-  using old APIs) that it is the only issuer in the mount. However, it is
-  encouraged for applications to update to the newer, safer semantics
-  associated with [multi-issuer rotation](/vault/docs/secrets/pki/rotation-primitives).
-
-~> Note: When an import creates more than one new issuer with key material
-   known to this mount, no default update will occur.
-
-#### Sample payload
-
-```json
-{
-  "default": "root-x1"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/config/issuers
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "default": "3dc79a5a-7a6c-70e2-1123-94b88557ba12"
-  }
-}
-```
-
-### Read keys configuration
-
-This endpoint allows getting the value of the default key.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/pki/config/keys` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/config/keys
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "default": "baadd98d-ec5a-66ac-06b7-dfc91c02c9cf"
-  }
-}
-```
-
-### Set keys configuration
-
-This endpoint allows setting the value of the default key.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/pki/config/keys` |
-
-#### Parameters
-
-- `default` `(string: "")` - Specifies the default key (by reference;
-  either a name or an ID).
-
-#### Sample payload
-
-```json
-{
-  "default": "baadd98d-ec5a-66ac-06b7-dfc91c02c9cf"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/config/keys
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "default": "baadd98d-ec5a-66ac-06b7-dfc91c02c9cf"
-  }
-}
-```
-
-### Read cluster configuration
-
-This endpoint fetches the cluster-local configuration.
-
-The cluster-local config has `path`, which sets the URL to this mount on
-a particular performance replication cluster. This is useful for populating
-`{{cluster_path}}` during AIA URL templating, but may be used for other
-values in the future.
-
-It also has `aia_path`, which allows using a non-Vault, external responder,
-setting the `{{cluster_aia_path}}` value for AIA URL templating. This is
-useful for distributing CA and CRL information over an unsecured, non-TLS
-channel.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `GET`  | `/pki/config/cluster` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/config/cluster
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "path": "<url>",
-    "aia_path": "<url>"
-  },
-  "auth": null
-}
-```
-
-### Set cluster configuration
-
-This endpoint sets cluster-local configuration.
-
-The cluster-local config has `path`, which sets the URL to this mount on
-a particular performance replication cluster. This is useful for populating
-`{{cluster_path}}` during AIA URL templating, but may be used for other
-values in the future.
-
-It also has `aia_path`, which allows using a non-Vault, external responder,
-setting the `{{cluster_aia_path}}` value for AIA URL templating. This is
-useful for distributing CA and CRL information over an unsecured, non-TLS
-channel.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `POST` | `/pki/config/cluster` |
-
-#### Parameters
-
-- `path` `(string: "")` - Specifies the path to this performance replication
-  cluster's API mount path, including any namespaces as path components.
-  For example, `https://pr-a.vault.example.com/v1/ns1/pki-root`.
-
-- `aia_path` `(string: "")` - Specifies the path to this performance replication
-  cluster's AIA distribution point; may refer to an external, non-Vault responder.
-  This is for resolving AIA URLs and providing the `{{cluster_aia_path}}` template
-  parameter and will not be used for other purposes. As such, unlike `path` above,
-  this could safely be an insecure transit mechanism (like HTTP without TLS).
-
-#### Sample payload
-
-```json
-{
-  "path": "https://...",
-  "aia_path": "http://..."
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/config/cluster
-```
-
-### Read CRL configuration
-
-This endpoint allows getting the duration for which the generated CRL should be
-marked valid. No CRL configuration will be returned until the configuration is
-set, but the CRL will still default to enabled with 72h expiration.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `GET`  | `/pki/config/crl` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/config/crl
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "disable": false,
-    "expiry": "72h",
-    "ocsp_disable": false,
-    "ocsp_expiry": "12h",
-    "auto_rebuild": false,
-    "auto_rebuild_grace_period": "12h",
-    "enable_delta": false,
-    "delta_rebuild_interval": "15m",
-    "cross_cluster_revocation": true,
-    "unified_crl": true,
-    "unified_crl_on_existing_paths": true
-  },
-  "auth": null
-}
-```
-
-<a name="set-crl-configuration"></a>
-
-### Set revocation configuration
-
-This endpoint allows setting the duration for which the generated CRL should be
-marked valid. If the CRL is disabled, it will return a signed but zero-length
-CRL for any request. If enabled, it will re-build the CRL.
-
-If the `ocsp_disable` key is set to `true`, the OCSP responder will always
-respond with an Unauthorized OCSP response to any request.
-
-~> **Note**: This parameter is global, across all clusters and issuers. Use
-   the per-issuer `usage` field to disable CRL building for a specific
-   issuer, while leaving the global CRL building enabled.
-
-~> Note: Disabling the CRL does not affect whether revoked certificates are
-stored internally. Certificates that have been revoked when a role's
-certificate storage is enabled will continue to be marked and stored as
-revoked until `tidy` has been run with the desired safety buffer. Re-enabling
-CRL generation will then result in all such certificates becoming a part of
-the CRL.
-
-~> Note: Enabling automatic rebuilding of CRLs disables immediate regeneration
-   on revocation. This is in line with the behavior of other CAs which only
-   rebuild CRLs periodically. We suggest manually hitting the rotate if a
-   fresh CRL is necessary after a revocation. For the most part though, CRLs
-   should not be relied upon for the latest certificate status information,
-   and OCSP should be used instead.
-
-~> Note: The periodic function which controls automatic rebuilding of CRLs
-   and delta CRLs only executes once a minute; this prevents high system load
-   but limits the granularity of the temporal options below.
-
-~> Note: The `unified_crl`, `unified_crl_on_existing_paths`, and
-   `cross_cluster_revocation` parameters are all Vault Enterprise only
-   functionality. While they appear in the responses on Vault Community Edition, they cannot
-   be enabled.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `POST` | `/pki/config/crl` |
-
-#### Parameters
-
-- `expiry` `(string: "72h")` - The amount of time the generated CRL should be valid.
-
-- `disable` `(bool: false)` - Disables or enables CRL building.
-
-- `ocsp_disable` `(bool: false)` - Disables or enables the OCSP responder in Vault.
-
-- `ocsp_expiry` `(string: "12h")` - The amount of time an OCSP response can be cached for,
-  (controls the NextUpdate field), useful for OCSP stapling refresh durations. If set to 0
-  the NextUpdate field is not set, indicating newer revocation information is available
-  all the time.
-
-- `auto_rebuild` `(bool: false)` - Enables or disables periodic rebuilding of
-  the CRL upon expiry.
-
-- `auto_rebuild_grace_period` `(string: "12h")` - Grace period before CRL expiry
-  to attempt rebuild of CRL. Must be shorter than the CRL expiry period.
-
-- `enable_delta` `(bool: false)` - Enables or disables building of delta CRLs
-  with up-to-date revocation information, augmenting the last complete CRL.
-  This option requires `auto_rebuild` to also be enabled.
-
-- `delta_rebuild_interval` `(string: "15m")` - Interval to check for new
-  revocations on, to regenerate the delta CRL. Must be shorter than CRL
-  expiry.
-
-- `cross_cluster_revocation` `(bool: false)` -
-  <EnterpriseAlert product="vault" inline /> Enables cross-cluster revocation
-  request queues. When a serial not issued on this local cluster is presented
-  to Vault via the [`/revoke` API](#revoke-certificate), it is replicated
-  across clusters and the cluster which issued that certificate will revoke
-  it if it is online.
-
-~> Note: API calls to revoke a certificate with Bring Your Own Certificate
-   (BYOC) will always trigger a local revocation of that certificate. No
-   cross-cluster revocation request will be created.<br /><br />
-   API calls to revoke a certificate with Proof of Possession (PoP) cannot
-   be satisfied if the certificate is not available locally and will
-   not result in a cross-cluster revocation request.
-
-- `unified_crl` `(bool: false)` -
-  <EnterpriseAlert product="vault" inline /> Enables unified CRL and OCSP building. This
-  synchronizes all revocations between clusters; a single, unified CRL will be
-  built on the active node of the primary performance replication (PR)
-  cluster. Any node in any PR cluster will be able to serve this unified CRL
-  and respond to unified OCSP inquiries.
-
-~> Note: This option ensures existing, non-expired revocations are
-   consistently reported. If a certificate was issued and stored on one
-   cluster, but revoked via BYOC on another, this option will inform the
-   issuing cluster of the revocation.
-
-- `unified_crl_on_existing_paths` `(bool: false)` -
-  <EnterpriseAlert product="vault" inline /> Enables serving the
-  unified CRL and OCSP on the existing, previously cluster-local paths
-  (e.g., `/pki/crl` will now contain the unified CRL when enabled). This
-  allows transitioning AIA-based consumption of CRLs to a unified view
-  without having to re-issue certificates or update scripts pulling
-  a single CRL.
-
-#### Sample payload
-
-```json
-{
-  "expiry": "48h",
-  "disable": "false",
-  "ocsp_disable": "false",
-  "ocsp_expiry": "12h",
-  "auto_rebuild": "true",
-  "auto_rebuild_grace_period": "8h",
-  "enable_delta": "true",
-  "delta_rebuild_interval": "10m",
-  "cross_cluster_revocation": true,
-  "unified_crl": true,
-  "unified_crl_on_existing_paths": true,
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/config/crl
-```
-
-### Rotate CRLs
-
-This endpoint forces a rotation of all issuers' CRLs. This can be used by
-administrators to cut the size of the CRL if it contains a number of
-certificates that have now expired, but has not been rotated due to no further
-certificates being revoked. If no certificates have been revoked, but the CRL
-has expired or is close to expiring, administrators **must** hit this endpoint
-to manually rotate the CRL. This rotates all CRLs on the present cluster,
-and **must** be called on every cluster.
-
-~> **Note**: Mirroring the behavior of earlier Vault versions, we add
-   certificates revoked by an unknown issuer to the default issuer's CRL.
-   To fully purge old revoked, unexpired certificates, it is not sufficient
-   to delete their issuer and is instead necessary to **remove** the mount
-   completely.
-
-~> **Note**: As of Vault 1.12, it is suggested to switch to enabling the CRL's
-   `auto_rebuild` functionality to avoid having to manually hit the Rotate
-   endpoint when the CRL expires. This ensures a valid CRL is always
-   maintained, at the expense of potentially not being up-to-date. If a
-   revocation occurs that must be immediately propagated, this endpoint can
-   be used to regenerate the CRL, though distribution must still occur outside
-   of Vault (either manually or via AIA where supported).
-
-| Method | Path              |
-| :----- | :---------------- |
-| `GET`  | `/pki/crl/rotate` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/crl/rotate
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "success": true
-  }
-}
-```
-
-### Rotate delta CRLs
-
-This endpoint forces a rotation of all issuers' delta CRLs, when enabled.
-This can be used by administrators to force a rebuild of a delta CRL if
-high-profile revocations have occurred and there's a long high interval
-between delta rebuilds (`delta_rebuild_interval`).
-
-See notes about rotating regular CRLs above as they apply here as well.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/pki/crl/rotate-delta` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/crl/rotate
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "success": true
-  }
-}
-```
-
-### Combine CRLs from the same issuer
-
-This endpoint allows combining multiple different CRLs that have been signed by the
-same issuer into a single signed CRL. This is useful to generate a single authoritative
-CRL of revocations across distinct Vault clusters such as primary and performance replica
-clusters.
-
-
-| Method | Path                                  |
-|:-------|:--------------------------------------|
-| `POST` | `/pki/issuer/:issuer_ref/resign-crls` |
-
-
-#### Parameters
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-- `crls` `(list of strings: <required>)` - A list of PEM encoded CRLs that have been
-  signed by the issuer
-- `crl_number` `(int: <required>)` - The sequence number to be written within the CRL
-  Number extension.
-- `delta_crl_base_number` `(int: -1)` - Using a value of 0 or greater specifies the base CRL revision
-  number to encode within a Delta CRL indicator extension, otherwise the extension will
-  not be added; defaults to -1.
-- `format` `(string: pem)` - The format of the combined CRL, can be "pem" or "der".
-  If "der", the value will be base64 encoded; Defaults to "pem".
-- `next_update` `(string: 72h)` - The amount of time the generated CRL should be
-  valid; defaults to 72 hours.
-
-#### Sample payload
-
-```json
-{
-  "crl_number": "10",
-  "next_update": "24h",
-  "crls": ["<PEM crl 1>", "<PEM crl 2>"],
-  "format": "pem"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    -request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/issuer/default/resign-crls
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "crl": "<PEM encoded crl>"
-  }
-}
-```
-
-### Sign revocation list
-
-This endpoint allows generating a CRL based on the provided parameter data from any external
-source and signed by the specified issuer. Values are taken verbatim from the parameters provided.
-
-**This is a potentially dangerous endpoint and only highly trusted users should have access.**
-
-| Method | Path                                           |
-|:-------|:-----------------------------------------------|
-| `POST` | `/pki/issuer/:issuer_ref/sign-revocation-list` |
-
-
-#### Parameters
-
-- `issuer_ref` `(string: <required>)` - Reference to an existing issuer,
-  either by Vault-generated identifier, the literal string `default` to
-  refer to the currently configured default issuer, or the name assigned
-  to an issuer. This parameter is part of the request URL.
-- `crl_number` `(int: <required>)` - The sequence number to be written within the CRL
-  Number extension.
-- `delta_crl_base_number` `(int: -1)` - Using a value of 0 or greater specifies the base CRL revision
-  number to encode within a Delta CRL indicator extension, otherwise the extension will
-  not be added; defaults to -1.
-- `format` `(string: pem)` - The format of the combined CRL, can be "pem" or "der".
-  If "der", the value will be base64 encoded; Defaults to "pem".
-- `next_update` `(string: 72h)` - The amount of time the generated CRL should be
-  valid; defaults to 72 hours.
-- `revoked_certs` `(type: slice of maps)` - Each element contains revocation information for a
-  single serial number along with the revocation time and the serial's extensions if any. Each
-  element can have the following key/values
-   - `serial_number` `(type: string)` - the serial number of the revoked cert
-   - `revocation_time` `(type: string)` - the revocation time, unix int format or RFC3339 encoding supported
-   - `extensions` `(type: slice of maps)` - A slice of all extensions that should be added to the revoked
-      certificate entry. Each ele,ent contains a map with the following entries
-     - `id` `(type: string)` - an ASN1 object identifier in dot notation
-     - `critical` `(type: bool)` - should the extension be marked critical
-     - `value` `(type: string)` - base64 encoded bytes for extension value
-- `extensions` `(type: slice of maps)` - A slice of all extensions that should be added to the generated
-  CRL each element containing a map with the following entries.
-   - `id` `(type: string)` - an ASN1 object identifier in dot notation
-   - `critical` `(type: bool)` - should the extension be marked critical
-   - `value` `(type: string)` - base64 encoded bytes for extension value
-
-~> **Note**:: The following extension ids are not allowed to be provided and can be influenced by other parameters
-  - `2.5.29.20`: CRL Number
-  - `2.5.29.27`: Delta CRL
-  - `2.5.29.35`: Authority Key Identifier
-
-#### Sample payload
-
-```json
-{
-  "crl_number": "10",
-  "next_update": "24h",
-  "format": "pem",
-  "revoked_certs": [
-    {
-      "serial_number": "39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58",
-      "revocation_time": "2009-11-10T23:00:00Z"
-    },
-    {
-      "serial_number": "40:33:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58",
-      "revocation_time": "1257894000"
-    }
-  ]
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    -request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/issuer/default/sign-revocation-list
-```
-
-#### Sample response
-
-```json
-{
-  "data": {
-    "crl": "<PEM encoded crl>"
-  }
-}
-```
-
-### Tidy
-
-This endpoint allows tidying up the storage backend and/or CRL by removing
-certificates that have expired and are past a certain buffer period beyond their
-expiration time.
-
-| Method | Path        |
-| :----- | :---------- |
-| `POST` | `/pki/tidy` |
-
-~> Note: it is encouraged to use the [automatic tidy capabilities](#configure-automatic-tidy)
-   to ensure this gets run periodically.
-
-#### Parameters
-
-- `tidy_cert_store` `(bool: false)` - Specifies whether to tidy up the certificate
-  store.
-
-- `tidy_revoked_certs` `(bool: false)` - Set to true to remove all invalid and
-  expired certificates from storage. A revoked storage entry is considered
-  invalid if the entry is empty, or the value within the entry is empty. If a
-  certificate is removed due to expiry, the entry will also be removed from the
-  CRL, and the CRL will be rotated.
-
-- `tidy_revoked_cert_issuer_associations` `(bool: false)` - Set to true to associate
-  revoked certificates with their corresponding issuers; this improves the
-  performance of OCSP and CRL building, by shifting work to a tidy operation
-  instead.
-
-~> Note: With multiple issuers, a CA which issued a particular revoked
-   certificate may be removed and re-added, resulting in a different issuer
-   ID value. When building CRLs, these links are automatically updated for any
-   missing or added issuers, but during OCSP this value is computed and then
-   discarded, potentially causing a performance penalty on each request.
-   During regular CA operations, it is not necessary to run this operation.
-   <br /><br />
-   It is suggested to run this tidy when removing or importing new issuers and
-   on the first upgrade to a post-1.11 Vault version, but otherwise not to run
-   it during automatic tidy operations.
-
-- `tidy_expired_issuers` `(bool: false)` - Set to true to automatically remove
-  expired issuers after the `issuer_safety_buffer` duration has elapsed. We
-  log the issuer certificate on removal to allow recovery; no keys are removed
-  during this process.
-
-~> Note: The default issuer will not be removed even if it has expired and is
-   past the `issuer_safety_buffer` specified.
-
-- `tidy_move_legacy_ca_bundle` `(bool: false)` - Set to true to backup any
-  legacy CA/issuers bundle (from Vault versions earlier than 1.11) to
-  `config/ca_bundle.bak`. This can be restored with `sys/raw` back to
-  `config/ca_bundle` if necessary, but won't impact mount startup (as
-  mounts will attempt to read the latter and do a migration of CA issuers
-  if present). Migration will only occur after `issuer_safety_buffer` has
-  passed since the last successful migration.
-
-- `tidy_revocation_queue` `(bool: false)` - Set to true to remove stale
-  revocation request entries that haven't been confirmed by any active
-  node of a performance replication (PR) cluster. Only runs on the active
-  node of the primary cluster.
-
-~> Note: this tidy is only applicable on Vault Enterprise.
-
-- `tidy_cross_cluster_revoked_certs` `(bool: false)` - Set to true to remove
-  expired, cross-cluster revocation entries. This is the cross-cluster
-  equivalent of `tidy_revoked_certs`. Only runs on the active node of the
-  primary cluster.
-
-~> Note: this tidy is only applicable on Vault Enterprise.
-
-- `safety_buffer` `(string: "")` - Specifies a duration using [duration format strings](/vault/docs/concepts/duration-format)
-  used as a safety buffer to ensure certificates are not expunged prematurely; as an example, this can keep
-  certificates from being removed from the CRL that, due to clock skew, might
-  still be considered valid on other hosts. For a certificate to be expunged,
-  the time must be after the expiration time of the certificate (according to
-  the local clock) plus the duration of `safety_buffer`. Defaults to `72h`.
-
-- `issuer_safety_buffer` `(string: "")` - Specifies a duration that issuers
-  should be kept for, past their `NotAfter` validity period. Defaults to
-  365 days as hours (`8760h`).
-
-- `pause_duration` `(string: "0s")` - Specifies the duration to pause
-  between tidying individual certificates. This releases the revocation
-  lock and allows other operations to continue while tidy is paused.
-  This allows an operator to control tidy's resource utilization within
-  a timespan: the LIST operation will remain in memory, but the space
-  between reading, parsing, and updates on-disk cert entries will be
-  increased, decreasing resource utilization.
-
-  Does not affect `tidy_expired_issuers`.
-
-~> Note: Using too long of a `pause_duration` can result in tidy operations
-   not concluding during this lifetime! Using too short of a pause duration
-   (but non-zero) can lead to lock contention. Use [tidy's cancellation](#cancel-tidy)
-   to stop a running operation after the sleep period is over.
-
-- `revocation_queue_safety_buffer` `(string: "")` - Specifies a duration
-  after which cross-cluster revocation requests will be removed as expired.
-  This should be set high enough that, if a cluster disappears for a while
-  but later comes back, any revocation requests which it should process will
-  still be there, but not too long as to fill up storage with too many invalid
-  requests. Defaults to `48h`.
-
- - `tidy_acme` `(bool: false)` - Set to true to tidy stale ACME accounts,
-   orders, authorizations, EABs, and challenges. ACME orders are tidied (deleted)
-   `safety_buffer` after the certificate associated with them expires, or after
-   the order and relevant authorizations have expired if no certificate was
-   produced. Authorizations are tidied with the corresponding order.
-
-   When a valid ACME Account is at least `acme_account_safety_buffer`
-   old, and has no remaining orders associated with it, the account is
-   marked as revoked. After another `acme_account_safety_buffer` has
-   passed from the revocation or deactivation date, a revoked or
-   deactivated ACME account is deleted.
-
- - `acme_account_safety_buffer` `(string: "720h")` - The amount of time that
-   must pass after creation that an account with no orders is marked revoked,
-   and the amount of time after being marked revoked or deactivated. The
-   default is 30 days as hours.
-
-#### Sample payload
-
-```json
-{
-  "safety_buffer": "24h"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/tidy
-```
-
-### Read automatic tidy configuration
-
-This endpoint fetches the current automatic tidy configuration.
-
-This is the combination of the periodic invocation parameters described
-[in the below write handler](#set-automatic-tidy-configuration) and
-the tidy parameters [described above in the tidy endpoint](#tidy).
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/pki/config/auto-tidy` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/pki/config/auto-tidy
-```
-
-#### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "enabled": false,
-    "interval_duration": 43200,
-    "issuer_safety_buffer": 31536000,
-    "maintain_stored_certificate_counts": false,
-    "pause_duration": "0s",
-    "publish_stored_certificate_count_metrics": false,
-    "revocation_queue_safety_buffer": 172800,
-    "safety_buffer": 259200,
-    "tidy_cert_store": false,
-    "tidy_cross_cluster_revoked_certs": false,
-    "tidy_expired_issuers": false,
-    "tidy_move_legacy_ca_bundle": false,
-    "tidy_revocation_queue": false,
-    "tidy_revoked_cert_issuer_associations": false,
-    "tidy_revoked_certs": false
-  },
-  "auth": null
-}
-```
-
-<a name="configure-automatic-tidy"></a>
-
-### Set automatic tidy configuration
-
-This endpoint allows configuring periodic tidy operations, using the tidy mechanism
-described above. Status is from automatically run tidies are still reported at the
-status endpoint described below.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/pki/config/auto-tidy` |
-
-#### Parameters
-
-The below parameters are in addition to the regular parameters accepted by the
-[`/pki/tidy` endpoint](#tidy) documented above.
-
-- `enabled` `(bool: false)` - Specifies whether automatic tidy is enabled or not.
-
-- `interval_duration` `(string: "")` - Specifies the duration between automatic tidy
-  operations; note that this is from the end of one operation to the start of
-  the next so the time of the operation itself does not need to be considered.
-  Defaults to 12h
-
-- `maintain_stored_certificate_counts` `(bool: false)` - When enabled,
-  maintains expensive counts of certificates. During initialization of the
-  mount, a LIST of all certificates is performed to get a baseline figure and
-  throughout operations like issuance, revocation, and subsequent tidies, the
-  figure is updated.
-
-~> *Note*: It is strongly recommend to not enable this value if 50k or more
-   certificates are stored in the mount or if many PKI mounts are in use in
-   this cluster. Instead, use audit logs and aggregate this data externally
-   to Vault so as not to impact Vault performance.
-
-- `publish_stored_certificate_count_metrics` `(bool: false)` - When enabled,
-  publishes the value computed by `maintain_stored_certificate_counts` to
-  the mount's metrics. This requires the former to be enabled.
-
-#### Sample payload
-
-```json
-{
-  "enabled": true,
-  "tidy_revoked_cert_issuer_associations": true,
-  "safety_buffer": "24h"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/pki/config/auto-tidy
-```
-
-### Tidy status
-
-This is a read only endpoint that returns information about the current tidy
-operation, or the most recent if none are currently running.
-
-The result includes the following fields:
-
-* `safety_buffer`: the value of this parameter when initiating the tidy operation
-* `tidy_cert_store`: the value of this parameter when initiating the tidy operation
-* `tidy_revoked_certs`: the value of this parameter when initiating the tidy operation
-* `state`: one of *Inactive*, *Running*, *Finished*, *Error*, *Cancelling*, or *Cancelled*
-* `error`: the error message, if the operation ran into an error
-* `time_started`: the time the operation started
-* `time_finished`: the time the operation finished
-* `message`: One of *Tidying certificate store: checking entry N of TOTAL* or
-  *Tidying revoked certificates: checking certificate N of TOTAL*
-* `cert_store_deleted_count`: The number of certificate storage entries deleted
-* `revoked_cert_deleted_count`: The number of revoked certificate entries deleted
-* `missing_issuer_cert_count`: The number of revoked certificates which were missing a valid issuer reference
-* `tidy_expired_issuers`: the value of this parameter when initiating the tidy operation
-* `issuer_safety_buffer`: the value of this parameter when initiating the tidy operation
-* `tidy_move_legacy_ca_bundle`: the value of this parameter when initiating the tidy operation
-* `tidy_revocation_queue`: the value of this parameter when initiating the tidy operation
-* `revocation_queue_deleted_count`: the number of revocation queue entries deleted
-* `tidy_cross_cluster_revoked_certs`: the value of this parameter when initiating the tidy operation
-* `cross_revoked_cert_deleted_count`: the number of cross-cluster revoked certificate entries deleted
-* `revocation_queue_safety_buffer`: the value of this parameter when initiating the tidy operation
-* `pause_duration`: the value of this parameter when initiating the tidy operation
-* `last_auto_tidy_finished`: the time when the last auto-tidy operation finished; may be different than `time_finished` especially if the last operation was a manually executed tidy operation. Set to current time at mount time to delay the initial auto-tidy operation; not persisted.
-
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/pki/tidy-status` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/pki/tidy-status
-
-```
-
-#### Sample response
-
-```json
-  "data": {
-    "safety_buffer": 60,
-    "tidy_cert_store": true,
-    "tidy_revoked_certs": true,
-    "error": null,
-    "message": "Tidying certificate store: checking entry 234 of 488",
-    "revoked_cert_deleted_count": 0,
-    "cert_store_deleted_count": 2,
-    "state": "Running",
-    "time_started": "2021-10-20T14:52:13.510161-04:00",
-    "time_finished": null
-  },
-```
-
-### Cancel tidy
-
-This endpoint allows cancelling a running tidy operation. It takes no
-parameter and cancels the tidy at the next available checkpoint, which
-may process additional certificates between when the operation was
-marked as cancelled and when the operation stopped.
-
-The response to this endpoint is the same as the [status](#tidy-status).
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/pki/tidy-cancel` |
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/pki/tidy-cancel
-
-```
-
-#### Sample response
-
-```json
-  "data": {
-    "safety_buffer": 60,
-    "tidy_cert_store": true,
-    "tidy_revoked_certs": true,
-    "error": null,
-    "message": "Tidying certificate store: checking entry 234 of 488",
-    "revoked_cert_deleted_count": 0,
-    "cert_store_deleted_count": 2,
-    "state": "Cancelling",
-    "time_started": "2021-10-20T14:52:13.510161-04:00",
-    "time_finished": null
-  },
-```
-
----
-
-## Cluster scalability
-
-See [PKI Cluster Scalability](/vault/docs/secrets/pki/considerations#cluster-scalability) in the considerations page.
-
-## Managed keys
-
-~> Note: Managed keys are an Enterprise only feature.
-
-The [Generate Root](#generate-root) and [Generate Intermediate](#generate-intermediate)
-API calls can leverage the Managed Keys feature, delegating operations that
-require private key material to an external system.
-
-To leverage a Managed Key, assuming it has already been configured, set the type
-parameter to `kms` within either, [Generate Root](#generate-root) or
-[Generate Intermediate](#generate-intermediate) APIs, and one of either
-`managed_key_name` or `managed_key_id` parameters specifying a Managed Key to use.
-As with the `internal` type for those APIs, if the type parameter is set to `kms`,
-there is no way to read/fetch the private key.
-
-The API call will fail if the specified Managed Key is not properly configured or
-arguments detailing private key attributes are specified such as `key_type` or
-`key_bits`.
-
-Once either of the certificate APIs have successfully executed, all other PKI
-operations behave the same, with no other special configuration or parameters required.
-
-
-## Vault CLI with DER/PEM responses
-
-The Vault CLI can only display JSON responses. For APIs that return non-JSON formatted
-data such as DER and PEM formats, `vault read` will fail without the `-format=raw`
-option added in Vault 1.13 or another client such as `curl` must be used.
diff --git a/website/content/api-docs/secret/rabbitmq.mdx b/website/content/api-docs/secret/rabbitmq.mdx
deleted file mode 100644
index 2c8cac7d11a..00000000000
--- a/website/content/api-docs/secret/rabbitmq.mdx
+++ /dev/null
@@ -1,310 +0,0 @@
----
-layout: api
-page_title: RabbitMQ - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault RabbitMQ secrets engine.
----
-
-# RabbitMQ secrets engine (API)
-
-This is the API documentation for the Vault RabbitMQ secrets engine. For general
-information about the usage and operation of the RabbitMQ secrets engine, please
-see the [RabbitMQ documentation](/vault/docs/secrets/rabbitmq).
-
-This documentation assumes the RabbitMQ secrets engine is enabled at the
-`/rabbitmq` path in Vault. Since it is possible to enable secrets engines at any
-location, please update your API calls accordingly.
-
-## Configure connection
-
-This endpoint configures the connection string used to communicate with
-RabbitMQ.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/rabbitmq/config/connection` |
-
-### Parameters
-
-- `connection_uri` `(string: <required>)` – Specifies the RabbitMQ connection URI.
-
-- `username` `(string: <required>)` – Specifies the RabbitMQ management administrator username.
-
-- `password` `(string: <required>)` – Specifies the RabbitMQ management administrator password.
-
-- `verify_connection` `(bool: true)` – Specifies whether to verify connection URI, username, and password.
-
-- `password_policy` `(string: "")` - Specifies a [password policy](/vault/docs/concepts/password-policies) to
-  use when creating dynamic credentials. Defaults to generating an alphanumeric password if not set.
-
-- `username_template` `(string)` - [Template](/vault/docs/concepts/username-templating) describing how
-  dynamic usernames are generated.
-
-### Sample payload
-
-```json
-{
-  "connection_uri": "https://...",
-  "username": "user",
-  "password": "password",
-  "password_policy": "rabbitmq_policy"
-}
-```
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/rabbitmq/config/connection
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault write rabbitmq/config/connection \
-    connection_uri="http://localhost:8080" \
-    username="user" \
-    password="password" \
-    password_policy="rabbitmq_policy"
-```
-
-</Tab>
-</Tabs>
-
-## Configure lease
-
-This endpoint configures the lease settings for generated credentials.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/rabbitmq/config/lease` |
-
-### Parameters
-
-- `ttl` `(int: 0)` – Specifies the lease ttl provided in seconds.
-
-- `max_ttl` `(int: 0)` – Specifies the maximum ttl provided in seconds.
-
-### Sample payload
-
-```json
-{
-  "ttl": 1800,
-  "max_ttl": 3600
-}
-```
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/rabbitmq/config/lease
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault write rabbitmq/config/lease \
-    ttl=1800 \
-    max_ttl=3600
-```
-
-</Tab>
-</Tabs>
-
-## Create role
-
-This endpoint creates or updates the role definition.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/rabbitmq/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create. This
-  is specified as part of the URL.
-
-- `tags` `(string: "")` – Specifies a comma-separated RabbitMQ management tags.
-
-- `vhosts` `(string: "")` – Specifies a map of virtual hosts to
-  permissions.
-
-- `vhost_topics` `(string: "")` – Specifies a map of virtual hosts and exchanges
-  to topic permissions. This option requires RabbitMQ 3.7.0 or later.
-
-### Sample payload
-
-```json
-{
-  "tags": "tag1,tag2",
-  "vhosts": "{\"/\": {\"configure\":\".*\", \"write\":\".*\", \"read\": \".*\"}}",
-  "vhost_topics": "{\"/\": {\"amq.topic\": {\"write\":\".*\", \"read\": \".*\"}}}"
-}
-```
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/rabbitmq/roles/my-role
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault write rabbitmq/roles/my-role \
-    tags="tag1,tag2" \
-    vhosts="..." \
-    vhost_topics="..."
-```
-
-</Tab>
-</Tabs>
-
-## Read role
-
-This endpoint queries the role definition.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/rabbitmq/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to read. This
-  is specified as part of the URL.
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/rabbitmq/roles/my-role
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault read rabbitmq/roles/my-role
-```
-
-</Tab>
-</Tabs>
-
-### Sample response
-
-```json
-{
-  "data": {
-    "tags": "",
-    "vhosts": "{\"/\": {\"configure\":\".*\", \"write\":\".*\", \"read\": \".*\"}}",
-    "vhost_topics": "{\"/\": {\"amq.topic\": {\"write\":\".*\", \"read\": \".*\"}}}"
-  }
-}
-```
-
-## Delete role
-
-This endpoint deletes the role definition.
-
-| Method   | Path                    |
-| :------- | :---------------------- |
-| `DELETE` | `/rabbitmq/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to delete. This
-  is specified as part of the URL.
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/rabbitmq/roles/my-role
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-vault delete rabbitmq/roles/my-role
-```
-
-</Tab>
-</Tabs>
-
-## Generate credentials
-
-This endpoint generates a new set of dynamic credentials based on the named
-role.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/rabbitmq/creds/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create
-  credentials against. This is specified as part of the URL.
-
-### Sample request
-
-<Tabs>
-<Tab heading="cURL">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/rabbitmq/creds/my-role
-```
-
-</Tab>
-<Tab heading="CLI">
-
-```shell-session
-$ vault read rabbitmq/creds/my-role
-```
-
-</Tab>
-</Tabs>
-
-### Sample response
-
-```json
-{
-  "data": {
-    "username": "root-4b95bf47-281d-dcb5-8a60-9594f8056092",
-    "password": "e1b6c159-ca63-4c6a-3886-6639eae06c30"
-  }
-}
-```
diff --git a/website/content/api-docs/secret/ssh.mdx b/website/content/api-docs/secret/ssh.mdx
deleted file mode 100644
index dc29706364e..00000000000
--- a/website/content/api-docs/secret/ssh.mdx
+++ /dev/null
@@ -1,926 +0,0 @@
----
-layout: api
-page_title: SSH - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault SSH secrets engine.
----
-
-# SSH secrets engine (API)
-
-This is the API documentation for the Vault SSH secrets engine. For general
-information about the usage and operation of the SSH secrets engine, please see
-the [SSH documentation](/vault/docs/secrets/ssh).
-
-This documentation assumes the SSH secrets engine is enabled at the `/ssh` path
-in Vault. Since it is possible to enable secrets engines at any location, please
-update your API calls accordingly.
-
-## Create/Update role
-
-This endpoint creates or updates a named role.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/ssh/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create. This
-  is part of the request URL.
-
-- `default_user` `(string: "")` – Specifies the default username for which a
-  credential will be generated. When the endpoint `creds/` is used without a
-  username, this value will be used as default username. Its recommended to
-  create individual roles for each username to ensure absolute isolation between
-  usernames. This is required for OTP type roles.
-
-  When `default_user_template` is set to `true`, this field can contain an identity
-  template with any prefix or suffix, like `ssh-{{identity.entity.id}}-user`.
-
-  For the CA type, if you wish this to be a valid principal, it must also be
-  in `allowed_users`.
-
-- `default_user_template` `(bool: false)` - If set, `default_users` can be specified
-  using identity template values. A non-templated user is also permitted.
-
-- `cidr_list` `(string: "")` – Specifies a comma separated list of CIDR blocks
-  for which the role is applicable for. It is possible that a same set of CIDR
-  blocks are part of multiple roles. This is a required parameter, unless the
-  role is registered under the `/config/zeroaddress` endpoint. Note:
-  [Not applicable for CA type]
-
-- `exclude_cidr_list` `(string: "")` – Specifies a comma-separated list of CIDR
-  blocks. IP addresses belonging to these blocks are not accepted by the role.
-  This is particularly useful when big CIDR blocks are being used by the role
-  and certain parts need to be kept out. Note:
-  [Not applicable for CA type]
-
-- `port` `(int: 22)` – Specifies the port number for SSH connection. Port number
-  does not play any role in OTP generation. For the `otp` secrets engine type, this is
-  just a way to inform the client about the port number to use. The port number
-  will be returned to the client by Vault along with the OTP.
-
-- `key_type` `(string: <required>)` – Specifies the type of credentials
-  generated by this role. This can be either `otp` or `ca`.
-
-- `allowed_users` `(string: "")` – If this option is not specified, or if it is
-  `*`, the client can request a credential for any valid user at the remote
-  host, including the admin user. To only allow an explicit list of users, set
-  this parameter using a comma-separated username list to enforce it. When this
-  parameter is set, the credentials are created only for `default_user` and
-  usernames listed. Setting this option will enable all the users with access
-  this role to fetch credentials for all other usernames in this list.
-  When `allowed_users_template` is set to `true`, this field can contain an identity
-  template with any prefix or suffix, like `ssh-{{identity.entity.id}}-user`.
-  Use with caution. N.B.: if the type is `ca`, an empty list does not allow any user;
-  instead you must use `*` to enable this behavior.
-
-- `allowed_users_template` `(bool: false)` - If set, `allowed_users` can be specified
-  using identity template policies. Non-templated users are also permitted.
-
-- `allowed_domains` `(string: "")` – A comma-separated list of domains for which 
-  a client can request a host certificate. If this option is explicitly set to
-  `"*"`, then credentials can be created for any domain. See also
-  `allow_bare_domains` and `allow_subdomains`.
-
-- `allowed_domains_template` `(bool: false)` - If set, `allowed_domains` can be
-  specified using identity template policies. Non-templated domains are also
-  permitted.
-
-- `ttl` `(string: "")` – Specifies the Time To Live value provided as a string
-  duration with time suffix. Hour is the largest suffix. If not set, uses the
-  system default value or the value of `max_ttl`, whichever is shorter.
-
-- `max_ttl` `(string: "")` – Specifies the maximum Time To Live provided as a
-  string duration with time suffix. Hour is the largest suffix. If not set,
-  defaults to the system maximum lease TTL.
-
-- `allowed_critical_options` `(string: "")` – Specifies a comma-separated list
-  of critical options that certificates can have when signed. To allow any
-  critical options, set this to an empty string. Will default to allowing any
-  critical options.
-
-- `allowed_extensions` `(string: "")` – Specifies a comma-separated list of
-  extensions that certificates can have when signed. To allow a user to specify
-  any extension, set this to `"*"`. If not set, users will not be allowed to
-  specify extensions and will get the extensions specified within `default_extensions`.
-  For the list of extensions, take a look at the [sshd
-  manual's](https://man.openbsd.org/sshd#AUTHORIZED_KEYS_FILE_FORMAT)
-  `AUTHORIZED_KEYS FILE FORMAT` section. You should add a `permit-` before the
-  name of extension to allow it.
-
-- `default_critical_options` `(map<string|string>: "")` – Specifies a map of
-  critical options certificates should have if none are provided when signing.
-  This field takes in key value pairs in JSON format. Note that these are not
-  restricted by `allowed_critical_options`. Defaults to none.
-
-- `default_extensions` `(map<string|string>: "")` – Specifies a map of
-  extensions certificates should have if none are provided when signing. This
-  field takes in key value pairs in JSON format. Note that these are not
-  restricted by `allowed_extensions`. Defaults to none.
-
-- `allow_user_certificates` `(bool: false)` – Specifies if certificates are
-  allowed to be signed for use as a 'user'.
-
-- `allow_host_certificates` `(bool: false)` – Specifies if certificates are
-  allowed to be signed for use as a 'host'.
-
-- `allow_bare_domains` `(bool: false)` – Specifies if host certificates that are
-  requested are allowed to use the base domains listed in `allowed_domains`, e.g.
-  "example.com". This is a separate option as in some cases this can be
-  considered a security threat.
-
-- `allow_subdomains` `(bool: false)` – Specifies if host certificates that are
-  requested are allowed to be subdomains of those listed in `allowed_domains`,
-  e.g. if "example.com" is part of `allowed_domains`, this allows
-  "foo.example.com".
-
-- `allow_user_key_ids` `(bool: false)` – Specifies if users can override the key
-  ID for a signed certificate with the "key_id" field. When false, the key ID
-  will always be the token display name. The key ID is logged by the SSH server
-  and can be useful for auditing.
-
-- `key_id_format` `(string: "")` – When supplied, this value specifies a custom
-  format for the key id of a signed certificate. The following variables are
-  available for use: '{{token_display_name}}' - The display name of the token used
-  to make the request. '{{role_name}}' - The name of the role signing the request.
-  '{{public_key_hash}}' - A SHA256 checksum of the public key that is being signed.
-  e.g. "custom-keyid-{{token_display_name}}"
-
-- `allowed_user_key_lengths` `(map<string|(int|[]int|string)>: "")` – Specifies a
-  map of ssh key types and their expected sizes which are allowed to be signed by
-  the CA type. To specify multiple sizes, either use a comma-separated list or an
-  array of allowed key widths. We support both OpenSSH-style key identifiers and
-  short names (`rsa`, `ecdsa`, `dsa`, or `ed25519`) as keys. For example, a valid
-  policy to allow common RSA and ECDSA key lengths might be:
-
-  ```
-  {
-    "rsa": [2048, 3072, 4096],
-    "ec": 256,
-    "ecdsa-sha2-nistp521": 0
-  }
-  ```
-
-  Note that when an algorithm identifier uniquely specifies a key length (such as
-  with `ecdsa-sha2-nistp256` or `ed25519`), the value of the length is ignored (and
-  can be zero).
-
-  ~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-     and thus should not be used: `ed25519`.
-
-- `algorithm_signer` `(string: "default")` - Algorithm to sign keys with. Valid
-  values are `ssh-rsa`, `rsa-sha2-256`, `rsa-sha2-512`, or `default`. This
-  value may also be left blank to use the signer's default algorithm, and must
-  be left blank or have value `default` for CA key types other than RSA.
-
-  ~> **Note**: The value of `default` may change over time as vulnerabilities
-  in algorithms are discovered. The present value for RSA keys is equivalent
-  to `rsa-sha2-256`.
-
-  ~> **Warning**: The `algorithm_signer` value `ssh-rsa` uses the SHA-1 hash
-  algorithm. This algorithm is now considered insecure and is not supported by
-  current OpenSSH versions. As a result, Vault has made the new default
-  `rsa-sha2-256` for RSA CA keys. It is strongly encouraged for all users to
-  migrate to `rsa-sha2-256` or `default` if the role was created with an
-  explicit `algorithm_signer=rsa-sha` parameter or has been migrated to such.
-
-- `not_before_duration` `(duration: "30s")` – Specifies the duration by which to
-  backdate the `ValidAfter` property. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-```json
-{
-  "key_type": "otp"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ssh/roles/my-role
-```
-
-## Read role
-
-This endpoint queries a named role.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/ssh/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to read. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/ssh/roles/my-role
-```
-
-### Sample response
-
-For an OTP role:
-
-```json
-{
-  "cidr_list": "x.x.x.x/y",
-  "default_user": "username",
-  "key_type": "otp",
-  "port": 22
-}
-```
-
-For a CA role:
-
-```json
-{
-  "allow_bare_domains": false,
-  "allow_host_certificates": true,
-  "allow_subdomains": false,
-  "allow_user_key_ids": false,
-  "allow_user_certificates": true,
-  "allowed_critical_options": "",
-  "allowed_extensions": "",
-  "default_critical_options": {},
-  "default_extensions": {},
-  "max_ttl": "768h",
-  "ttl": "4h"
-}
-```
-
-## List roles
-
-This endpoint returns a list of available roles. Only the role names are
-returned, not any values.
-
-| Method | Path         |
-| :----- | :----------- |
-| `LIST` | `/ssh/roles` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/ssh/roles
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "data": {
-    "keys": ["dev", "prod"],
-    "key_info": {
-      "dev": {
-        "key_type": "ca"
-      }
-    }
-  },
-  "lease_duration": 2764800,
-  "lease_id": "",
-  "renewable": false
-}
-```
-
-## Delete role
-
-This endpoint deletes a named role.
-
-| Method   | Path               |
-| :------- | :----------------- |
-| `DELETE` | `/ssh/roles/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to delete. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ssh/roles/my-role
-```
-
-## List Zero-Address roles
-
-This endpoint returns the list of configured zero-address roles.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/ssh/config/zeroaddress` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/ssh/config/zeroaddress
-```
-
-### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "roles": ["otp_key_role"]
-  },
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Configure Zero-Address roles
-
-This endpoint configures zero-address roles.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/ssh/config/zeroaddress` |
-
-### Parameters
-
-- `roles` `(string: <required>)` – Specifies a string containing comma separated
-  list of role names which allows credentials to be requested for any IP
-  address. CIDR blocks previously registered under these roles will be ignored.
-
-### Sample payload
-
-```json
-{
-  "roles": ["otp_key_role"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ssh/config/zeroaddress
-```
-
-## Delete Zero-Address role
-
-This endpoint deletes the zero-address roles configuration.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/ssh/config/zeroaddress` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/ssh/config/zeroaddress
-```
-
-## Generate SSH credentials
-
-This endpoint creates credentials for a specific username and IP with the
-parameters defined in the given role.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/ssh/creds/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create
-  credentials against. This is part of the request URL.
-
-- `username` `(string: "")` – Specifies the username on the remote host.
-
-- `ip` `(string: <required>)` – Specifies the IP of the remote host.
-
-### Sample payload
-
-```json
-{
-  "ip": "1.2.3.4"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ssh/creds/my-role
-```
-
-### Sample response
-
-For an OTP role:
-
-```json
-{
-  "lease_id": "sshs/creds/c3c2e60c-5a48-415a-9d5a-a41e0e6cdec5/3ee6ad28-383f-d482-2427-70498eba4d96",
-  "renewable": false,
-  "lease_duration": 2764800,
-  "data": {
-    "ip": "127.0.0.1",
-    "key": "6d6411fd-f622-ea0a-7e2c-989a745cbbb2",
-    "key_type": "otp",
-    "port": 22,
-    "username": "rajanadar"
-  },
-  "warnings": null,
-  "auth": null
-}
-```
-
-## List roles by IP
-
-This endpoint lists all of the roles with which the given IP is associated.
-
-| Method | Path          |
-| :----- | :------------ |
-| `POST` | `/ssh/lookup` |
-
-### Parameters
-
-- `ip` `(string: <required>)` – Specifies the IP of the remote host.
-
-### Sample payload
-
-```json
-{
-  "ip": "1.2.3.4"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ssh/lookup
-```
-
-### Sample response
-
-An array of roles as a secret structure.
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "roles": [
-      "fe6f61b7-7e4a-46a6-b2c8-0d530b8513df",
-      "6d6411fd-f622-ea0a-7e2c-989a745cbbb2"
-    ]
-  },
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Verify SSH OTP
-
-This endpoint verifies if the given OTP is valid. This is an unauthenticated
-endpoint.
-
-| Method | Path          |
-| :----- | :------------ |
-| `POST` | `/ssh/verify` |
-
-### Parameters
-
-- `otp` `(string: <required>)` – Specifies the One-Time-Key that needs to be
-  validated.
-
-### Sample payload
-
-```json
-{
-  "otp": "bad2b3-..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ssh/verify
-```
-
-### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "ip": "127.0.0.1",
-    "username": "rajanadar"
-  },
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Submit CA information
-
-This endpoint allows submitting the CA information for the secrets engine via an SSH
-key pair. _If you have already set a certificate and key, they will be
-overridden._
-
-| Method | Path             |
-| :----- | :--------------- | -------------------------- |
-| `POST` | `/ssh/config/ca` | `200/204 application/json` |
-
-### Parameters
-
-- `private_key` `(string: "")` – Specifies the private key part the SSH CA key
-  pair; required if `generate_signing_key` is false.
-
-- `public_key` `(string: "")` – Specifies the public key part of the SSH CA key
-  pair; required if `generate_signing_key` is false.
-
-- `generate_signing_key` `(bool: true)` – Specifies if Vault should generate
-  the signing key pair internally. If `true`, an RSA key pair is generated, and
-  the generated public key is returned so you can add it to your configuration.
-  If `false`, then you must provide `private_key` and `public_key`, but these
-  can be of any valid signing key type.
-
-- `key_type` `(string: ssh-rsa)` - Specifies the desired key type for the
-  generated SSH CA key when `generate_signing_key` is set to `true`. Valid
-  values are OpenSSH key type identifiers (`ssh-rsa`, `ecdsa-sha2-nistp256`,
-  `ecdsa-sha2-nistp384`, `ecdsa-sha2-nistp521`, or `ssh-ed25519`) or an
-  algorithm (`rsa`, `ec`, or `ed25519`).
-
-  ~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-      and thus should not be used: `ed25519`.
-
-- `key_bits` `(int: 0)` - Specifies the desired key bits for the generated SSH
-  CA key when `generate_signing_key` is set to `true`. This is only used for
-  variable length keys (such as `ssh-rsa`, where the value of `key_bits`
-  specifies the size of the RSA key pair to generate; with the default `0`
-  value resulting in a 4096-bit key) or when the `ec` algorithm is specified
-  in `key_type` (where the value of `key_bits` identifies which NIST P-curve
-  to use; `256`, `384`, or `521`, with the default `0` value resulting in a
-  NIST P-256 key).
-
-### Sample payload
-
-```json
-{
-  "generate_signing_key": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ssh/config/ca
-```
-
-### Sample response
-
-This will return a `204` response if `generate_signing_key` was unset or false.
-
-This will return a `200` response if `generate_signing_key` was true:
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "public_key": "ssh-rsa AAAAHHNzaC1y...\n"
-  },
-  "warnings": null
-}
-```
-
-## Delete CA information
-
-This endpoint deletes the CA information for the backend via an SSH key pair.
-
-| Method   | Path             |
-| :------- | :--------------- |
-| `DELETE` | `/ssh/config/ca` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/ssh/config/ca
-```
-
-## Read public key (Unauthenticated)
-
-This endpoint returns the configured/generated public key. This is an unauthenticated
-endpoint.
-
-~> Note: this is a raw response endpoint without JSON encoding; use
-   `vault read -format=raw` or an external tool (e.g., `curl`) to fetch this
-   value.
-
-| Method | Path              | Content-Type     |
-| :----- | :---------------- | ---------------- |
-| `GET`  | `/ssh/public_key` | `200 text/plain` |
-
-### Sample request
-
-```shell-session
-$ curl http://127.0.0.1:8200/v1/ssh/public_key
-```
-
-### Sample response
-
-```text
-    ssh-rsa AAAAHHNzaC1y...
-```
-
-## Read public key (Authenticated)
-
-This endpoint reads the configured/generated public key.
-
-| Method | Path             |
-| :----- | :--------------- |
-| `GET`  | `/ssh/config/ca` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/ssh/config/ca
-```
-
-### Sample response
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "public_key": "ssh-rsa AAAAHHNzaC1y...\n"
-  },
-  "warnings": null
-}
-```
-
-## Sign SSH key
-
-This endpoint signs an SSH public key based on the supplied parameters and 
-subject to the restrictions of the role named in the path. Both `create` and 
-`update` policy capabilities are needed to sign and update SSH keys. If only 
-`create` capability is granted, and a SSH key does not exist, it will be created 
-using the default parameters already configured. If only `update` capability is 
-available and a SSH key does not exist, an error will be returned and SSH keys 
-must exist already before may be updated.
-
-It is similar to the endpoint `/ssh/issue/:name`. Instead of issuing new
-SSH credentials, this returns a certificate for the given SSH public key.
-
-The issued certificate uses the defaults specified in the role named in
-this endpoint. Where not restricted by the parameters of this role, the
-parameters of the issued certificate can be further customized in this API call.
-
-~> **Note**: The issued certificate is returned but _not_ stored by Vault.
-   If you do not save it from the response, request it again by repeating
-   this request.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `POST` | `/ssh/sign/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to sign. This
-  is part of the request URL.
-
-- `public_key` `(string: <required>)` – Specifies the SSH public key that should
-  be signed.
-
-- `ttl` `(string: "")` – Specifies the Requested Time To Live. Cannot be greater
-  than the role's `max_ttl` value. If not provided, the role's `ttl` value will
-  be used. Note that the role values default to system values if not explicitly
-  set.
-
-- `valid_principals` `(string: "")` – Specifies valid principals, either
-  usernames or hostnames, that the certificate should be signed for.
-
-- `cert_type` `(string: "user")` – Specifies the type of certificate to be
-  created; either "user" or "host".
-
-- `key_id` `(string: "")` – Specifies the key id that the created certificate
-  should have. If not specified, the display name of the token will be used.
-
-- `critical_options` `(map<string|string>: "")` – Specifies a map of the
-  critical options that the certificate should be signed for. Defaults to none.
-
-- `extensions` `(map<string|string>: "")` – Specifies a map of the extensions
-  that the certificate should be signed for. Defaults to none.
-
-### Sample payload
-
-```json
-{
-  "public_key": "ssh-rsa ..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ssh/sign/my-key
-```
-
-### Sample response
-
-```json
-{
-  "lease_id": "ssh/sign/example/097bf207-96dd-0041-0e83-b23bd1923993",
-  "renewable": false,
-  "lease_duration": 21600,
-  "data": {
-    "serial_number": "f65ed2fd21443d5c",
-    "signed_key": "ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1y...\n"
-  },
-  "auth": null
-}
-```
-
-## Generate certificate and key
-
-This endpoint issues a new set of SSH credentials (private key and certificate).
-
-It is similar to the endpoint `/ssh/sign/:name`: Instead of signing an existing
-SSH public key, it generates and issues new SSH credentials (key and certificate).
-
-The issued certificate uses the defaults specified in the role named in
-this endpoint. Where not restricted by the parameters of this role, the
-parameters of the issued certificate can be further customized in this API call.
-
-~> **Note**: The issued credentials are returned but _not_ stored by Vault.
-   If you do not save them from the response, issue new credentials by using
-   this request again. This endpoint is available with Vault version 1.12+.
-
-| Method | Path               |
-| :----- | :----------------  |
-| `POST` | `/ssh/issue/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to create the
-  certificate against. This is part of the request URL.
-
-- `key_type` `(string: "rsa")` – Specifies the desired key type; must be `rsa`, `ed25519`
-  or `ec`.
-
-- `key_bits` `(int: 0)` – Specifies the number of bits to use for the
-  generated keys. Allowed values are 0 (universal default); with
-  `key_type=rsa`, allowed values are: 2048 (default), 3072, or
-  4096; with `key_type=ec`, allowed values are: 256 (default), 384,
-  or 521; ignored with `key_type=ed25519`.
-
-- `ttl` `(string: "")` – Specifies the Requested Time To Live. Cannot be greater
-  than the role's `max_ttl` value. If not provided, the role's `ttl` value will
-  be used. Note that the role values default to system values if not explicitly
-  set.
-
-- `valid_principals` `(string: "")` – Specifies valid principals, either
-  usernames or hostnames, that the certificate should be signed for.
-
-- `cert_type` `(string: "user")` – Specifies the type of certificate to be
-  created; either "user" or "host".
-
-- `key_id` `(string: "")` – Specifies the key id that the created certificate
-  should have. If not specified, the display name of the token will be used.
-
-- `critical_options` `(map<string|string>: "")` – Specifies a map of the
-  critical options that the certificate should be signed for. Defaults to none.
-
-- `extensions` `(map<string|string>: "")` – Specifies a map of the extensions
-  that the certificate should be signed for. Defaults to none.
-
-### Sample payload
-
-```json
-{
-  "key_type": "rsa",
-  "key_bits":  2048
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/ssh/issue/my-role
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "94fd1102-08a1-c207-0e3e-657e8f80c09e",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "serial_number": "1e965817eb12a511",
-    "signed_key": "ssh-rsa-cert-v01@openssh.com AAAAHHN...\n",
-    "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQIBAAKCAQEAwer03vkQrPV+wWpbisJJv2CKqHmMz+Ej0ctLbhpOmR2CY9S9\n...\nQN351pgTphi6nlCkGPzkDuwvtxSxiCWXQcaxrHAL7MiJpPzkIBq1\n-----END RSA PRIVATE KEY-----\n",
-    "private_key_type": "rsa"
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Tidy host keys
-
-This endpoint removes all existing host keys from Vault, if any are present.
-These keys were used with the Dynamic Keys functionality, which were removed
-from this engine.
-
-~> Note: This does not clean up any pending dynamic key leases and will not
-   remove these keys from systems with authorized hosts entries created by
-   Vault. That must be done manually by an operator, potentially before the
-   removal of these host keys if they are necessary to access these
-   systems.<br /><br />
-   For a more effective cleanup process, it is suggest to stay on Vault 1.12,
-   manually revoke all dynamic key leases, wait for this to finish, and then
-   upgrade to Vault 1.13+.
-
-| Method   | Path                     |
-| :------- | :----------------------- |
-| `DELETE` | `/ssh/tidy/dynamic-keys` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/ssh/issue/my-role
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "message": "Removed 15 of 15 host keys."
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
diff --git a/website/content/api-docs/secret/terraform.mdx b/website/content/api-docs/secret/terraform.mdx
deleted file mode 100644
index 62dd5e29c95..00000000000
--- a/website/content/api-docs/secret/terraform.mdx
+++ /dev/null
@@ -1,305 +0,0 @@
----
-layout: api
-page_title: Terraform Cloud Secret Backend - HTTP API
-description: This is the API documentation for the Vault Terraform Cloud secret backend.
----
-
-# Terraform Cloud secret backend HTTP API
-
-This is the API documentation for the Vault Terraform Cloud secret backend. For general
-information about the usage and operation of the Terraform Cloud backend, please see the
-[Vault Terraform Cloud backend documentation](/vault/docs/secrets/terraform).
-
-This documentation assumes the Terraform Cloud backend is mounted at the `/terraform` path
-in Vault. Since it is possible to mount secret backends at any location, please
-update your API calls accordingly.
-
-## Configure access
-
-This endpoint configures the access information for Terraform Cloud. This access
-information is used so that Vault can communicate with Terraform Cloud and generate
-Terraform Cloud tokens.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/terraform/config` |
-
-### Parameters
-
-- `address` `(string: "")` – Specifies the address of the Terraform Cloud
-  server, if using Terraform Enterprise, provided as `"protocol://host:port"`.
-  The default is `https://app.terraform.io` for Terraform Cloud.
-
-- `token` `(string: "")` – Specifies the Terraform Cloud authentication token to
-  use. This token must have the needed permissions to manage all Organization,
-  Team, and User tokens desired for this mount.
-
-### Sample payload
-
-```json
-{
-  "address": "https://app.terraform.io",
-  "token": "glhf..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/terraform/config
-```
-
-## Read access configuration
-
-This endpoint queries for information about the Terraform Cloud connection.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/terraform/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/terraform/config
-```
-
-### Sample response
-
-```json
-  "data": {
-    "address": "https://app.terraform.io",
-    "base_path": "/api/v2/"
-  }
-```
-
-## Create/Update role
-
-This endpoint creates or updates the Terraform Cloud role definition in Vault.
-If the role does not exist, it will be created. If the role already exists, it
-will receive updated attributes.
-
-Terraform Cloud offers three distinct types of API tokens with varying level of
-access: Organizations, Teams, and Users. A Vault Role can manage a single type
-of API token at a time, determined by how it is configured:
-
-- To manage an Organization API token, provide the organization
-  name with the `organization` parameter
-- To manage a Team API token, provide the `team_id` parameter
-- To manage a User API token, provide a `user_id` parameter
-
-~> **Special Note:** both Organizations and Teams can only have a single active API
-token at any given time. Generating a new token for a team or organization will
-effectively revoke any existing tokens, regardless if those tokens were
-originally created by Vault. As such, requesting an Organization or Team token
-from Vault will return the same token indefinitely until that token is rotated
-with the `/rotate-role` endpoint.
-
-Please see the [Terraform Cloud API
-Token documentation for more
-information](/terraform/cloud-docs/users-teams-organizations/api-tokens).
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/terraform/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name for the Vault role. This is
-  part of the request URL.
-
-- `organization` `(string: "")` – Organization name to manage the single API
-  token. Organizations can only have a single active API token at any given
-  time. Conflicts with `user_id`.
-
-- `team_id` `(string: "")` – Team ID to manage the single API token. Teams can
-  only have a single active API token at any given time. Conflicts with
-  `user_id`.
-
-- `user_id` `(string: "")` – User ID to manage dynamic tokens. Conflicts with
-  `organization` and `team_id`.
-
-- `ttl` `(duration: "")` – Specifies the TTL for this role. If not
-  provided, the default Vault TTL is used. Only applies to User API tokens.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `max_ttl` `(duration: "")` – Specifies the max TTL for this role. If not
-  provided, the default Vault Max TTL is used. Only applies to User API tokens.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-To create a Vault role to manage a Terraform Cloud User tokens
-
-```json
-{
-  "user_id": "user-glhf1234",
-  "ttl": "1h",
-  "max_ttl": "24h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/terraform/role/tfuser
-```
-
-## Read role
-
-This endpoint queries for information about a Terraform Cloud role with the given name.
-If no role exists with that name, a 404 is returned.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/terraform/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to query. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/terraform/role/tfuser
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "max_ttl": 86400,
-    "name": "tfuser",
-    "ttl": 3600,
-    "user_id": "user-glhf1234"
-  }
-}
-```
-
-## List roles
-
-This endpoint lists all existing roles in the backend.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `LIST` | `/terraform/role`           |
-| `GET`  | `/terraform/role?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/terraform/role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["tfuser"]
-  }
-}
-```
-
-## Delete role
-
-This endpoint deletes a Terraform Cloud role with the given name. Even if the role does
-not exist, this endpoint will still return a successful response.
-
-| Method   | Path                    |
-| :------- | :---------------------- |
-| `DELETE` | `/terraform/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to delete. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request DELETE \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/terraform/role/tfuser
-```
-
-## Rotate role
-
-This endpoint rotates the credentials for a Terraform Cloud role that manages an
-Organization or Team. This endpoint is only valid for those roles; attempting to
-rotate a role that manages user tokens will result in an error.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/terraform/rotate-role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the role to rotate. This
-  is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/terraform/rotate-role/testing
-```
-
-## Generate credential
-
-This endpoint returns a Terraform Cloud token based on the given role
-definition. For Organization and Team roles, the same API token is returned
-until the token is rotated with `rotate-role`. For User roles, a new token is
-generated with each request.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `GET`  | `/terraform/creds/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of an existing role against
-  which to create this Terraform Cloud token. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/terraform/creds/example
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "71629848-778d-f9ae-c396-0b02fae2adda",
-  "lease_id": "terraform/creds/tfuser/dWa2E5aiIX7jJfyMqPm1fSPr",
-  "lease_duration": 60,
-  "renewable": true,
-  "data": {
-    "token": "<example-token>",
-    "token_id": "at-example"
-  },
-  "warnings": null
-}
-```
diff --git a/website/content/api-docs/secret/totp.mdx b/website/content/api-docs/secret/totp.mdx
deleted file mode 100644
index c9944974be8..00000000000
--- a/website/content/api-docs/secret/totp.mdx
+++ /dev/null
@@ -1,269 +0,0 @@
----
-layout: api
-page_title: TOTP - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault TOTP secrets engine.
----
-
-# TOTP secrets engine (API)
-
-This is the API documentation for the Vault TOTP secrets engine. For general
-information about the usage and operation of the TOTP secrets engine, please see
-the [TOTP documentation](/vault/docs/secrets/totp).
-
-This documentation assumes the TOTP secrets engine is enabled at the `/totp`
-path in Vault. Since it is possible to enable secrets engines at any location,
-please update your API calls accordingly.
-
-## Create key
-
-This endpoint creates or updates a key definition.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/totp/keys/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key to create. This is specified as part of the URL.
-
-- `generate` `(bool: false)` – Specifies if a key should be generated by Vault or if a key is being passed from another service.
-
-- `exported` `(bool: true)` – Specifies if a QR code and url are returned upon generating a key. Only used if generate is true.
-
-- `key_size` `(int: 20)` – Specifies the size in bytes of the Vault generated key. Only used if generate is true.
-
-- `url` `(string: "")` – Specifies the TOTP key url string that can be used to configure a key. Only used if generate is false.
-
-- `key` `(string: <required - if generate is false and url is empty>)` – Specifies the root key used to generate a TOTP code. Only used if generate is false.
-
-- `issuer` `(string: "" <required - if generate is true>)` – Specifies the name of the key’s issuing organization.
-
-- `account_name` `(string: "" <required - if generate is true>)` – Specifies the name of the account associated with the key.
-
-- `period` `(int or duration format string: 30)` – Specifies the length of time in seconds used to generate a counter for the TOTP code calculation.
-
-- `algorithm` `(string: "SHA1")` – Specifies the hashing algorithm used to generate the TOTP code. Options include "SHA1", "SHA256" and "SHA512".
-
-- `digits` `(int: 6)` – Specifies the number of digits in the generated TOTP code. This value can be set to 6 or 8.
-
-- `skew` `(int: 1)` – Specifies the number of delay periods that are allowed when validating a TOTP code. This value can be either 0 or 1. Only used if generate is true.
-
-- `qr_size` `(int: 200)` – Specifies the pixel size of the square QR code when generating a new key. Only used if generate is true and exported is true. If this value is 0, a QR code will not be returned.
-
-### Sample payload
-
-```json
-{
-  "url": "otpauth://totp/Google:test@gmail.com?secret=Y64VEVMBTSXCYIWRSHRNDZW62MPGVU2G&issuer=Google"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/totp/keys/my-key
-```
-
-### Sample payload
-
-```json
-{
-  "generate": true,
-  "issuer": "Google",
-  "account_name": "test@gmail.com"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/totp/keys/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "barcode": "iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BAAAGXklEQVR4nOyd4Y4iOQyEmRPv/8p7upX6BJm4XbbDbK30fT9GAtJJhpLjdhw3z1+/HmDEP396AvDO878/X1+9i1frWvu5Po/6Xz+P2kft1nFVa1f7z+YdjT/5PrEQMxDEDAQx4/n6orsGr6z9ZP1mviMbP/MBav/R6/U61Ud0vk8sxAwEMQNBzHju3lTvv6P2ajwS9Ve9zz+9pkfjRp+r/SjzwULMQBAzEMSMrQ/pUo0bouun7dW9LXVvrBq/TMBCzEAQMxDEjKM+JFqT17W4mu9Y+49eq/OL3r/GVX3CJ7KtWIgZCGIGgpix9SHTtXGa4476qfoa1adVc+HV/6/yfWIhZiCIGQhixpsP6Z4nulD3lqavV7q+Yvo6G7/zfWIhZiCIGQhixteJ/Rh1Da3e71d9RjRul2ocdeK7xELMQBAzEMSM3z6ku6dTrdOo1l9M6y5O7clVx5n4SCzEDAQxA0HMuN3L+qlavqj9itpePY+VtVdrHqfzeQULMQNBzEAQM97ikAv1vr/brltTeCp/svarcjLe2F1PnbohCGIGgphRqjG8mJ6PmtYMVnP363Vqv6d8qZrzf2AhfiCIGQhixm0c8n+jQ8+7+jZ4cY3PrlfHO/1Ml+45st18sRAzEMQMBDHjdxyixgPqs0lWsvvwqH00zrSO41R80p3XXXssxAwEMQNBzJCeuaieo6pedzGtb1/76fqgLH6ofg+dZ65gIWYgiBkIYsbbs9/V+/EVde1V+62eh1I/r/qIrs+Ixo2uYy/LGAQxA0HMeNvLilDX1OraXc2jVNtPzxJXr6v+HzuwEDMQxAwEMWNbp95d21WmzzBR6066e07dPMq0XoW9LEMQxAwEMUOqUz+1p9ONd07Xz586u6yifp/4EEMQxAwEMUPay7rIcthqTrx6v1/NTX+qZrIbF63v34GFmIEgZiCIGdvfU++e1a3GM2oOPjtvpfbfjS+qeZFJXgcLMQNBzEAQM6Tn9p7OLVdrFqP5TFF9ZXTdqfqTV7AQMxDEDAQx482HdPMPGdN8SjeHr6710zzJidrCB/kQTxDEDAQxY7uXdTGNC9S9pK6vqs6nWzdyej53PhELMQNBzEAQM0o59YtTz/xQfVO3jmOdl0rmE6f5ort5YSFmIIgZCGLGbU69eka3ep+v5sCzcbp5jZXMR0zr+aPPqVM3BkHMQBAzRs/tjejmwj9d05ihzq96nQr5EEMQxAwEMWPrQy6q9/fdevFTcVA0v+n5K7U/tf4lGhcfYgiCmIEgZtw+6+RCXUurvkKlepZ2vS5i+oyTaby0GxcLMQNBzEAQM0r5kKnv6K6xK9X4R13zu+eyJnXpazssxAwEMQNBzNj+fkg3nqjGK9laPz1vleXwq2v+p+vciUMMQRAzEMSM298xrOYDVqrtpmtzt59uHqc6v2zcBxbiB4KYgSBmbOvUV7q577VdOIliXqLr87p7Tere2YnrsRAzEMQMBDFj+zuGar3Gp+rNp3kUtR5lmj/Jxo/GvZsvFmIGgpiBIGbcPi/rW+MPPaeqOs407xL1E1E9lzWpg8FCzEAQMxDEDOk3qC66a7f6fsSn1uz18+o8P+GzsBAzEMQMBDFjm1Ov7L3s3p+2/6lcfoa6ZxaNm50DWyEOMQRBzEAQM7Zne6PX3XilW5M3zbd0c/3ZHpvqY6P+7j7HQsxAEDMQxIxRPqRaT6Kuzemkh7WJ3RrJbJxq7eOuPyzEDAQxA0HMKJ3t/XbxobW/Gmdka/PpPMxPgoWYgSBmIIgZ0m9QrXTP1mb9Ru2y+/hsD2xaM9jN5UfjEIf8RSCIGQhiRus3qLp7ONU6jK4vynxMdn10XdY+m4/SHxZiBoKYgSBm3MYhGdl9/qkzvN18ilpDqF6nxiPVGs3Xz7EQMxDEDAQx4/ZcVoR6fqobZ6h7Vtm81TVejZdWuvHNXXssxAwEMQNBzHju3pyujdO68Ky9Wm+h9qPGJVG/6nyU+WIhZiCIGQhixtaHdFF9hlqLeOrcVPcMQDeOmtTNYyFmIIgZCGLGUR/SPQs73QuL5tGtiVznlc1X/T8iXtthIWYgiBkIYsbWh3T3nNS1dXqe6tReW8S0Hr1b5/LAQvxAEDMQxIw3H9I9nzU9R6XGHdn41dx4d4+rGp9En7OX9ReAIGYgiBlff6IWG2KwEDP+DQAA//+TDHXGhqE4+AAAAABJRU5ErkJggg==",
-    "url": "otpauth://totp/Google:test@gmail.com?algorithm=SHA1&digits=6&issuer=Google&period=30&secret=HTXT7KJFVNAJUPYWQRWMNVQE5AF5YZI2"
-  }
-}
-```
-
-If a QR code is returned, it consists of base64-formatted PNG bytes. You can embed it in a web page by including the base64 string in an `img` tag with the prefix `data:image/png;base64`
-
-```
-<img src="data:image/png;base64,iVBORw0KGgoAAAANSUh.." />
-```
-
-## Read key
-
-This endpoint queries the key definition.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/totp/keys/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key to read. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/totp/keys/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "account_name": "test@gmail.com",
-    "algorithm": "SHA1",
-    "digits": 6,
-    "issuer": "Google",
-    "period": 30
-  }
-}
-```
-
-## List keys
-
-This endpoint returns a list of available keys. Only the key names are
-returned, not any values.
-
-| Method | Path         |
-| :----- | :----------- |
-| `LIST` | `/totp/keys` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/totp/keys
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "data": {
-    "keys": ["my-key"]
-  },
-  "lease_duration": 0,
-  "lease_id": "",
-  "renewable": false
-}
-```
-
-## Delete key
-
-This endpoint deletes the key definition.
-
-| Method   | Path               |
-| :------- | :----------------- |
-| `DELETE` | `/totp/keys/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key to delete. This
-  is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/totp/keys/my-key
-```
-
-## Generate code
-
-This endpoint generates a new time-based one-time use password based on the named
-key.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/totp/code/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key to create
-  credentials against. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/totp/code/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "code": "810920"
-  }
-}
-```
-
-## Validate code
-
-This endpoint validates a time-based one-time use password generated from the named
-key.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/totp/code/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the key used to generate the password. This is specified as part of the URL.
-
-- `code` `(string: <required>)` – Specifies the password you want to validate.
-
-### Sample payload
-
-```json
-{
-  "code": "123802"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/totp/code/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "valid": true
-  }
-}
-```
diff --git a/website/content/api-docs/secret/transform.mdx b/website/content/api-docs/secret/transform.mdx
deleted file mode 100644
index 2b71a4d7f94..00000000000
--- a/website/content/api-docs/secret/transform.mdx
+++ /dev/null
@@ -1,2142 +0,0 @@
----
-layout: api
-page_title: Transform - Secrets Engines - HTTP API
-description: This is the API documentation for the Transform secrets engine.
----
-
-# Transform secrets engine (API)
-
-This is the API documentation for the Transform secrets engine. For general
-information about the usage and operation of the secrets engine, please see the
-[Transform secrets engine documentation](/vault/docs/secrets/transform).
-
-This documentation assumes the transform secrets engine is enabled at the
-`/transform` path in Vault. Since it is possible to enable secrets engines at any
-location, please update your API calls accordingly.
-
-## Create/Update role
-
-This endpoint creates or updates the role with the given `name`. If a role with
-the name does not exist, it will be created. If the role exists, it will be
-updated with the new attributes.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/transform/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the role to create. This is part of the request URL.
-
-- `transformations` (`list: []`) -
-  Specifies the transformations that can be used with this role.
-
-### Sample payload
-
-```json
-{
-  "transformations": ["creditcard-fpe", "creditcard-masking"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/role/example-role
-```
-
-## Read role
-
-This endpoint queries an existing role by the given name.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/transform/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the role to read. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transform/role/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "transformations": ["creditcard-fpe", "creditcard-masking"]
-  }
-}
-```
-
-## List roles
-
-This endpoint lists all existing roles in the secrets engine.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `LIST` | `/transform/role` |
-
-### Parameters
-
-- `filter` `(string: "*")` –
-  If provided, only returns role names that match the given glob.
-
-### Sample request
-
-```shell-session
-$ curl
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/transform/role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-role"]
-  }
-}
-```
-
-## Delete role
-
-This endpoint deletes an existing role by the given name.
-
-| Method   | Path                    |
-| :------- | :---------------------- |
-| `DELETE` | `/transform/role/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the role to delete. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/transform/role/example-role
-```
-
-## Create/Update transformation <sup>DEPRECATED (1.6)</sup>
-
-This endpoint creates or updates a transformation with the given `name`. If a
-transformation with the name does not exist, it will be created. If the
-transformation exists, it will be updated with the new attributes. This
-endpoint is deprecated as of version 1.6 in favor of the type specific
-configuration endpoints, and will be removed in a future release.
-
-- [FPE](#create-update-fpe-transformation)
-- [Masking](#create-update-masking-transformation)
-- [Tokenization](#create-update-tokenization-transformation)
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `POST` | `/transform/transformation/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the transformation to create or update. This is part of
-  the request URL.
-
-- `type` `(string: <required>)` -
-  Specifies the type of transformation to perform. The types currently supported
-  by this backend are `fpe`, `masking`, and `tokenization`. This value cannot be
-  modified by an update operation after creation.
-
-- `template` `(string: <required>)` -
-  Specifies the template name to use for matching value on encode and decode
-  operations when using this transformation. Ignored by the tokenization
-  transformation type.
-
-- `tweak_source` `(string: "supplied")` -
-  Specifies the source of where the tweak value comes from. Valid sources are
-  `supplied`, `generated`, and `internal`. Only used when the type is FPE.
-
-- `masking_character` `(string: "*")` -
-  Specifies the character to use for masking. If multiple characters are
-  provided, only the first one is used and the rest is ignored. Only used when
-  the type is masking.
-
-- `allowed_roles` `(list: [])` -
-  Specifies a list of allowed roles that this transformation can be assigned to.
-  A role using this transformation must exist in this list in order for
-  encode and decode operations to properly function.
-
-- `deletion_allowed` `(bool: false)` -
-  If true, this transform can be deleted. Otherwise deletion is blocked while
-  this value remains false. 
-
-### Sample payload
-
-```json
-{
-  "type": "fpe",
-  "template": "builtin/creditcardnumber",
-  "tweak_source": "internal",
-  "allowed_roles": ["example-role"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/transformation/example-transformation
-```
-
-## Create/Update FPE transformation
-
-This endpoint creates or updates an FPE transformation with the given `name`. If a
-transformation with the name does not exist, it will be created. If the
-transformation exists, it will be updated with the new attributes.
-
-| Method | Path                                   |
-| :----- | :------------------------------------- |
-| `POST` | `/transform/transformations/fpe/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the transformation to create or update. This is part of
-  the request URL.
-
-- `template` `(string: <required>)` -
-  Specifies the template name to use for matching value on encode and decode
-  operations when using this transformation.
-
-- `tweak_source` `(string: "supplied")` -
-  Specifies the source of where the tweak value comes from. Valid sources are
-  `supplied`, `generated`, and `internal`. Only used when the type is FPE.
-
-- `allowed_roles` `(list: [])` -
-  Specifies a list of allowed roles that this transformation can be assigned to.
-  A role using this transformation must exist in this list in order for
-  encode and decode operations to properly function.
-
-- `deletion_allowed` `(bool: false)` -
-  If true, this transform can be deleted. Otherwise deletion is blocked while this
-  value remains false. Note that deleting the transform deletes the underlying 
-  key making decoding of FPE encoded values impossible without restoring from a 
-  backup.
-
-### Sample payload
-
-```json
-{
-  "template": "builtin/creditcardnumber",
-  "tweak_source": "internal",
-  "allowed_roles": ["example-role"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/transformations/fpe/example-transformation
-```
-
-## Create/Update masking transformation
-
-This endpoint creates or updates a masking transformation with the given `name`. If a
-transformation with the name does not exist, it will be created. If the
-transformation exists, it will be updated with the new attributes.
-
-| Method | Path                                       |
-| :----- | :----------------------------------------- |
-| `POST` | `/transform/transformations/masking/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the transformation to create or update. This is part of
-  the request URL.
-
-- `template` `(string: <required>)` -
-  Specifies the template name to use for matching value on encode and decode
-  operations when using this transformation.
-
-- `masking_character` `(string: "*")` -
-  Specifies the character to use for masking. If multiple characters are
-  provided, only the first one is used and the rest is ignored. Only used when
-  the type is masking.
-
-- `allowed_roles` `(list: [])` -
-  Specifies a list of allowed roles that this transformation can be assigned to.
-  A role using this transformation must exist in this list in order for
-  encode and decode operations to properly function.
-
-### Sample payload
-
-```json
-{
-  "template": "builtin/creditcardnumber",
-  "masking_character": "X",
-  "allowed_roles": ["example-role"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/transformations/masking/example-transformation
-```
-
-## Create/Update tokenization transformation
-
-This endpoint creates or updates a tokenization transformation with the given `name`. If a
-transformation with the name does not exist, it will be created. If the
-transformation exists, it will be updated with the new attributes.
-
-| Method | Path                                            |
-| :----- | :---------------------------------------------- |
-| `POST` | `/transform/transformations/tokenization/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the transformation to create or update. This is part of
-  the request URL.
-
-- `mapping_mode` `(string: "default")` -
-  Specifies the mapping mode for stored tokenization values. `default`
-  is strongly recommended for highest security. `exportable` allows
-  for all plaintexts to be decoded via the export-decoded endpoint
-  in an emergency.
-
-- `convergent` `(bool: false)` - 
-  Specifies whether to use convergent tokenization, where tokenization of the same
-  plaintext more than once results in the same token.  Defaults to false as unique
-  tokens are more desirable from a security standpoint if there isn't a use-case
-  need for convergence.  This property cannot be changed after the transform
-  is created.
-
-- `max_ttl`: `(duration: "0")` -
-  The maximum TTL of a token. If 0 or unspecified, tokens may have no expiration.
-
-- `allowed_roles` `(list: [])` -
-  Specifies a list of allowed roles that this transformation can be assigned to.
-  A role using this transformation must exist in this list in order for
-  encode and decode operations to properly function.
-
-- `stores` `(list: ["builtin/internal"])` -
-  The list of tokenization stores to use for tokenization state. Vault's
-  internal storage is used by default.
-
-- `deletion_allowed` `(bool: false)` -
-  If true, this transform can be deleted. Otherwise deletion is blocked while this
-  value remains false. Note that deleting the transform deletes the underlying key 
-  making decoding of tokenized values impossible without restoring from a backup.
-
-### Sample payload
-
-```json
-{
-  "max_ttl": "365d",
-  "allowed_roles": ["example-role"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/transformations/tokenization/example-transformation
-```
-
-## Import key for FPE transformation
-
-This endpoint imports an existing AES-256 key into a new FPE transformation.
-Currently, importing a key into an existing FPE transformation is not supported.
-
-| Method | Path                                          |
-| :----- | :-------------------------------------------- |
-| `POST` | `/transform/transformations/fpe/:name/import` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  create. This is specified as part of the URL.
-
-- `ciphertext` `(string: <required>)` - A base64-encoded string that contains
-two values: an ephemeral 256-bit AES key wrapped using the wrapping key
-returned by Vault and the encryption of the import key material under the
-provided AES key. The wrapped AES key should be the first 512 bytes of the
-ciphertext, and the encrypted key material should be the remaining bytes.
-
-- `hash_function` `(string: "SHA256")` - The hash function used for the
-RSA-OAEP step of creating the ciphertext. Supported hash functions are:
-`SHA1`, `SHA224`, `SHA256`, `SHA384`, and `SHA512`. If not specified,
-the hash function defaults to SHA256.
-
-- `template` `(string: <required>)` -
-  Specifies the template name to use for matching value on encode and decode
-  operations when using this transformation.
-
-- `tweak_source` `(string: "supplied")` -
-  Specifies the source of where the tweak value originated. Valid sources are
-  `supplied`, `generated`, and `internal`. Only used when the type is FPE.
-
-- `allowed_roles` `(list: [])` -
-  Specifies a list of allowed roles that this transformation can be assigned to.
-  A role using this transformation must exist in this list for the
-  encode and decode operations to function properly.
-
-### Sample payload
-
-```json
-{
-  "ciphertext": "...",
-  "template": "builtin/creditcardnumber",
-  "tweak_source": "internal",
-  "allowed_roles": ["example-role"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/transformations/fpe/example-transformation/import
-```
-
-## Import key for tokenization transformation
-
-This endpoint imports an existing AES-256 key into a new tokenization transformation.
-To import key material into an existing key, see the tokenization `import_version/` endpoint.
-
-~> **Note:** At this time, tokenization transformations with imported keys do not support
-convergent tokenization.
-
-| Method | Path                                                   |
-| :----- | :----------------------------------------------------- |
-| `POST` | `/transform/transformations/tokenization/:name/import` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  create. This is specified as part of the URL.
-
-- `ciphertext` `(string: <required>)` - A base64-encoded string that contains
-two values: an ephemeral 256-bit AES key wrapped using the wrapping key
-returned by Vault and the encryption of the import key material under the
-provided AES key. The wrapped AES key should be the first 512 bytes of the
-ciphertext, and the encrypted key material should be the remaining bytes.
-
-- `hash_function` `(string: "SHA256")` - The hash function used for the
-RSA-OAEP step of creating the ciphertext. Supported hash functions are:
-`SHA1`, `SHA224`, `SHA256`, `SHA384`, and `SHA512`. If not specified,
-the hash function defaults to SHA256.
-
-- `allow_rotation` `(bool: false)` - If set, the imported key can be rotated
-within Vault by using the `rotate` endpoint.
-
-~> **NOTE**: Once an imported key is rotated within Vault, it will no longer
-support importing key material with the `import_version` endpoint.
-
-- `mapping_mode` `(string: "default")` -
-  Specifies the mapping mode for stored tokenization values. `default`
-  is strongly recommended for highest security. `exportable` allows
-  for all plaintexts to be decoded via the export-decoded endpoint
-  in an emergency.
-
-- `max_ttl`: `(duration: "0")` -
-  The maximum TTL of a token. If 0 or unspecified, tokens may have no expiration.
-
-- `allowed_roles` `(list: [])` -
-  Specifies a list of allowed roles that this transformation can be assigned to.
-  A role using this transformation must exist in this list in order for
-  encode and decode operations to properly function.
-
-- `stores` `(list: ["builtin/internal"])` -
-  The list of tokenization stores to use for tokenization state. Vault's
-  internal storage is used by default.
-
-### Sample payload
-
-```json
-{
-  "ciphertext": "...",
-  "max_ttl": "365d",
-  "allowed_roles": ["example-role"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/transformations/tokenization/example-transformation/import
-```
-
-## Import key version for tokenization transformation
-
-This endpoint imports new key material into an existing tokenization transformation with an imported key.
-
-| Method | Path                                                           |
-| :----- | :------------------------------------------------------------- |
-| `POST` | `/transform/transformations/tokenization/:name/import_version` |
-
-~> **Note**: Transformations whose key material was generated by Vault do not support
-importing key material. Only transformations that were created through the `import`
-endpoint can import new key material from an external source.
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the transformation to
-  create. This is specified as part of the URL.
-
-- `ciphertext` `(string: <required>)` - A base64-encoded string that contains
-two values: an ephemeral 256-bit AES key wrapped using the wrapping key
-returned by Vault and the encryption of the import key material under the
-provided AES key. The wrapped AES key should be the first 512 bytes of the
-ciphertext, and the encrypted key material should be the remaining bytes.
-
-- `hash_function` `(string: "SHA256")` - The hash function used for the
-RSA-OAEP step of creating the ciphertext. Supported hash functions are:
-`SHA1`, `SHA224`, `SHA256`, `SHA384`, and `SHA512`. If not specified,
-the hash function defaults to SHA256.
-
-### Sample payload
-
-```json
-{
-  "ciphertext": "...",
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/transformations/tokenization/example-transformation/import_version
-```
-
-## Get wrapping key
-
-This endpoint is used to retrieve the wrapping key to use to import keys.
-The returned key will be a 4096-bit RSA public key.
-
-| Method | Path                     |
-| :---- | :------------------------ |
-| `GET` | `/transform/wrapping_key` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/transform/wrapping_key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "public_key": "..."
-  },
-}
-```
-
-## Read transformation
-
-This endpoint queries an existing transformation by the given name.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `GET`  | `/transform/transformation/:name` |
-
-- `name` `(string: <required>)` –
-  Specifies the name of the role to read. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transform/transformation/example-transformation
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "allowed_roles": ["example-role"],
-    "templates": ["builtin/creditcardnumber"],
-    "tweak_source": "internal",
-    "type": "fpe"
-  }
-}
-```
-
-## List transformation
-
-This endpoint lists all existing transformations in the secrets engine.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `LIST` | `/transform/transformation` |
-
-### Sample request
-
-```shell-session
-$ curl
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/transform/transformation
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-transformation"]
-  }
-}
-```
-
-## Delete transformation
-
-This endpoint deletes an existing transformation by the given name.
-
-| Method   | Path                               |
-| :------- | :--------------------------------- |
-| `DELETE` | `/transform/transformation/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the transformation to delete. This is part of the
-  request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/transform/transformation/example-transformation
-```
-
-## Create/Update template
-
-This endpoint creates or updates a template with the given `name`. If a
-template with the name does not exist, it will be created. If the
-template exists, it will be updated with the new attributes.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `/transform/template/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the template to create. This is part of the
-  request URL.
-
-- `type` `(string: <required>)` -
-  Specifies the type of pattern matching to perform. The only type currently
-  supported by this backend is `regex`.
-
-- `pattern` `(string: <required>)` -
-  Specifies the pattern used to match a particular value. For regex type
-  matching, capture group determines the set of character that should be matched
-  against. Any matches outside of capture groups are retained
-  post-transformation.
-
-- `alphabet` `(string)` -
-  Specifies the name of the alphabet to use when this template is used for FPE
-  encoding and decoding operations.
-
--	`encode_format` `(string: "")` -
-  The regular expression template to use to format encoded values. This can be
-  used to normalize the encoded output. If absent or empty, encoded values will
-  preserve the format of the input value. This is only used during FPE
-  transformations.
-
-- `decode_formats` `(key-value-map: {})` -
-  An optional map of regular expression templates that can be used to customize
-  decoded output. For example, this can be used to decode only the last four
-  digits of a credit card number. This is only used during FPE transformations.
-
-### Sample payload
-
-```json
-{
-  "type": "regex",
-  "alphabet": "builtin/numeric",
-  "pattern": "(\\d{3})[-/](\\d{2})[-/](\\d{4})",
-  "encode_format": "$1-$2-$3",
-  "decode_formats": {
-    "first-three": "$1",
-    "last-four": "$3"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/template/example-template
-```
-
-## Read template
-
-This endpoint queries an existing template by the given name.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `GET`  | `/transform/template/:name` |
-
-- `name` `(string: <required>)` –
-  Specifies the name of the role to read. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transform/template/example-template
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "alphabet": "builtin/numeric",
-    "decode_formats": {
-      "first-three": "$1",
-      "last-four": "$3"
-    },
-    "encode_format": "$1-$2-$3",
-    "pattern": "(\\d{3})[-/](\\d{2})[-/](\\d{4})",
-    "type": "regex"
-  }
-}
-```
-
-## List template
-
-This endpoint lists all existing templates in the secrets engine.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `LIST` | `/transform/template` |
-
-### Sample request
-
-```shell-session
-$ curl
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/transform/template
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-template"]
-  }
-}
-```
-
-## Delete template
-
-This endpoint deletes an existing template by the given name.
-
-| Method   | Path                        |
-| :------- | :-------------------------- |
-| `DELETE` | `/transform/template/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the template to delete. This is part of the
-  request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/transform/template/example-template
-```
-
-## Create/Update alphabet
-
-This endpoint creates or updates an alphabet with the given `name`. If an
-alphabet with the name does not exist, it will be created. If the
-alphabet exists, it will be updated with the new attributes.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `/transform/alphabet/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the transformation to create. This is part of the
-  request URL.
-
-- `alphabet` `(string: <required>)` –
-  Specifies the set of characters that can exist within the provided value
-  and the encoded or decoded value for a FPE transformation.
-
-### Sample payload
-
-```json
-{
-  "alphabet": "abc"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/alphabet/example-alphabet
-```
-
-## Read alphabet
-
-This endpoint queries an existing alphabet by the given name.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `GET`  | `/transform/alphabet/:name` |
-
-- `name` `(string: <required>)` –
-  Specifies the name of the role to read. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transform/alphabet/example-alphabet
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "alphabet": "abc"
-  }
-}
-```
-
-## List alphabets
-
-This endpoint lists all existing alphabets in the secrets engine.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `LIST` | `/transform/alphabet` |
-
-### Sample request
-
-```shell-session
-$ curl
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/transform/alphabet
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-alphabet"]
-  }
-}
-```
-
-## Delete alphabet
-
-This endpoint deletes an existing alphabet by the given name.
-
-| Method   | Path                        |
-| :------- | :-------------------------- |
-| `DELETE` | `/transform/alphabet/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the alphabet to delete. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/transform/alphabet/example-alphabet
-```
-
-## Create/Update tokenization store
-
-This endpoint creates or updates a storage configuration for use with tokenization.
-The database user configured here should only have permission to `SELECT`,
-`INSERT`, and `UPDATE` rows in the tables.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/transform/stores/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the store to create or update. This is part of
-  the request URL.
-
-- `type` `(string: <required>)` -
-  Specifies the type of store. Currently only `sql` is supported.
-
-- `driver` `(string: <required>)` -
-  Specifies the database driver to use, and thus which SQL database type.
-  Currently the supported options are `postgres`, `mysql`, and `mssql`.
-
-- `connection_string` `(string: <required>)` -
-  A database connection string with template slots for username and password that
-  Vault will use for locating and connecting to a database. Each
-  database driver type has a different syntax for its connection strings.
-
-  > When using MySQL, make sure to append `?parseTime=true` to enable timestamp parsing.
-
-- `username`: `(string: <required>)` -
-  The username value to use when connecting to the database.
-
-- `password`: `(string: <required>)` -
-  The password value to use when connecting to the database.
-
-- `supported_transformations: `(list: ["tokenization"])` The types of transformations this store can host. Currently only`tokenization`
-  is supported.
-
-- `schema`: `(string: "public")` -
-  The schema within the database to expect tokenization state tables.
-
-- `max_open_connections` `(int: 4)` -
-  The maximum number of connections to the database at any given time.
-
-- `max_idle_connections` `(int: 4)` -
-  The maximum number of idle connections to the database at any given time.
-
-- `max_connection_lifetime` `(duration: 0)` -
-  The maximum amount of time a connection can be open before closing it.
-  0 means no limit. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payloads
-
-```json
-{
-  "type": "sql",
-  "driver": "postgres",
-  "connection_string": "postgresql://{{username}}:{{password}}@mydb.conhugeco.com/tokens",
-  "username": "vault_user",
-  "password": "very_secret"
-}
-```
-
-```json
-{
-  "type": "sql",
-  "driver": "mysql"
-  "connection_string": "{{username}}:{{password}}@tcp(mydb.conhugeco.com:3306)/tokens",
-  "username": "vault_user",
-  "password": "very_secret"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/stores/example-store
-```
-
-## Create/Update store schema
-
-This endpoint creates or updates the underlying schema in an SQL type
-tokenization store. The provided username and password are only used during
-this call. This is so one may use a user with DDL privileges to create
-or update the schema, but still use a much more limited user for ordinary
-operation.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `POST` | `/transform/stores/:name/schema` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the store to create or update. This is part of
-  the request URL.
-
-- `username`: `(string: <required>)` -
-  The username value to use when connecting to the database.
-
-- `password`: `(string: <required>)` -
-  The password value to use when connecting to the database.
-
-- `transformation_type`: `(string: "tokenization")` -
-  The transformation type. Currently only `tokenization` is supported.
-
-### Sample payload
-
-```json
-{
-  "username": "ddl_user",
-  "password": "very_secret"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    https://127.0.0.1:8200/v1/transform/stores/example-store/schema
-```
-
-## Read store
-
-This endpoint queries an existing store by the given name.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/transform/stores/:name` |
-
-- `name` `(string: <required>)` –
-  Specifies the name of the role to read. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transform/stores/example-store
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "type": "sql",
-    "connection_string": "postgresql://{{username}}:{{password}}@mydb.conhugeco.com/tokens",
-    "supported_transformations": ["tokenization"]
-  }
-}
-```
-
-## List stores
-
-This endpoint lists all existing stores in the secrets engine.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `LIST` | `/transform/stores` |
-
-### Sample request
-
-```shell-session
-$ curl
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/transform/store
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["example-store"]
-  }
-}
-```
-
-## Delete store
-
-This endpoint deletes an existing store configuration by the given name.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/transform/stores/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the store to delete. This is part of the
-  request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/transform/stores/example-store
-```
-
-## Encode
-
-This endpoint encodes the provided value using a named role.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/transform/encode/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` –
-  Specifies the role name to use for this operation. This is specified as part
-  of the URL.
-
-- `value` `(string: <required>)` –
-  Specifies the value to be encoded.
-
-- `transformation` `(string)` –
-  Specifies the transformation within the role that should be used for this
-  encode operation. If a single transformation exists for role, this parameter
-  may be skipped and will be inferred. If multiple transformations exist, one
-  must be specified.
-
-- `expiration` `(string: "")` -
-  Only applicable for tokenization transforms.
-  Either [`ttl`](/vault/api-docs/secret/transform#ttl) or `expiration` may 
-  be configured but not both at the same time. Capped to the role's [`max_ttl`](/vault/api-docs/secret/transform#max_ttl) 
-  value if that's set. When omitted the tokenization transforms shall never 
-  expire. The provided string must be a RFC3339 formatted time and date.
-
-- `ttl` `(duration "0")` -
-  Specifies the TTL of the resulting token. Only applicable for tokenization
-  transformations.
-
-- `metadata` `(string)` -
-  For tokenization transforms, a list of key value pairs of the form
-  `key1=value1,key2=value2,`... These optional metadata values will be
-  stored with the value and can be retrieved with the
-  [metadata](#retrieve-token-metadata) endpoint.
-
-- `tweak` `(string)` –
-  Specifies the **base64 encoded** tweak to use. Only applicable for FPE
-  transformations with `supplied` as the tweak source. The tweak must be a
-  7-byte value that is then base64 encoded.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` -
-  Specifies a list of items to be encoded in a single batch. When this
-  parameter is set, the 'value', 'transformation', 'ttl', 'tweak' and
-  'reference' parameters are ignored. Instead, the aforementioned parameters
-  should be provided within each object in the list.
-
-  ```json
-  [
-    {
-      "value": "1111-1111-1111-1111",
-      "transformation": "ccn-fpe"
-    },
-    {
-      "value": "2222-2222-2222-2222",
-      "transformation": "ccn-masking",
-      "reference": "order#1234"
-    },
-    {
-      "value": "3333-3333-3333-3333",
-      "transformation": "ccn-tokenization",
-      "ttl": "42d"
-    }
-  ]
-  ```
-
-**NOTE:** The response payload may return a tweak along with the encoded value
-if the `tweak_source` for the specified transformation is set to `generated`.
-The resource owner should properly store this tweak, which must be supplied back
-when decrypting the encoded value.
-
-### Sample payload
-
-```json
-{
-  "value": "1111-2222-3333-4444",
-  "transformation": "ccn-fpe"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform/encode/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "encoded_value": "5682-4613-6822-8064"
-  }
-}
-```
-
-### Sample payload
-
-```json
-{
-  "batch_input": [
-    {
-      "transformation": "ccn-fpe",
-      "value": "1111-2222-3333-4444"
-    },
-    {
-      "transformation": "ccn-tokenization",
-      "value": "1111-2222-3333-4444",
-      "reference": "order#1234"
-    }
-  ]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform/encode/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "batch_results": [
-      {
-        "encoded_value": "5682-4613-6822-8064"
-      },
-      {
-        "encoded_value": "Q4tYgFXHxURXf9MLekG82L51vSAQrDnpAiaB37J4VPRxoQEB3fRpwR",
-        "reference": "order#1234"
-      }
-    ]
-  }
-}
-```
-
-## Decode
-
-This endpoint decodes the provided value using a named role.
-
-| Method | Path                                            |
-| :----- | :---------------------------------------------- |
-| `POST` | `/transform/decode/:role_name(/:decode_format)` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` –
-  Specifies the role name to use for this operation. This is specified as part
-  of the URL.
-
-- `value` `(string: <required>)` –
-  Specifies the value to be decoded.
-
-- `decode_format` `(string)` -
-  The name of the decode format to use for decoding. These are defined in
-  `decode_formats` when creating the transformation's template, and can be used
-  to selectively decode or format the output. If one is not defined or
-  specified, the template's pattern will be used. Only applicable for FPE
-  transformations.
-
-- `transformation` `(string)` –
-  Specifies the transformation within the role that should be used for this
-  decode operation. If a single transformation exists for role, this parameter
-  may be skipped and will be inferred. If multiple transformations exist, one
-  must be specified.
-
-- `tweak` `(string)` – Specifies the **base64 encoded** tweak to use. Only
-  applicable for FPE transformations with `supplied` or `generated` as the tweak
-  source. The tweak must be a 7-byte value that is then base64 encoded.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` -
-  Specifies a list of items to be decoded in a single batch. When this
-  parameter is set, the 'value', 'transformation', 'tweak' and
-  'reference' parameters are ignored. Instead, the aforementioned parameters
-  should be provided within each object in the list.
-
-  ```json
-  [
-    {
-      "value": "5682-4613-6822-8064",
-      "transformation": "ccn-fpe"
-    }
-  ]
-  ```
-
-### Sample payload
-
-```json
-{
-  "value": "418-56-4374",
-  "transformation": "example-transformation"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform/decode/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "decoded_value": "111-22-3333"
-  }
-}
-```
-
-### Sample payload
-
-```json
-{
-  "value": "418-56-4374",
-  "transformation": "example-transformation"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform/decode/example-role/last-four
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "decoded_value": "4444"
-  }
-}
-```
-
-### Sample payload
-
-```json
-{
-  "batch_input": [
-    {
-      "transformation": "ccn-fpe",
-      "value": "5682-4613-6822-8064",
-      "reference": "order#1234"
-    },
-    {
-      "transformation": "ccn-tokenization",
-      "value": "Q4tYgFXHxURXf9MLekG82L51vSAQrDnpAiaB37J4VPRxoQEB3fRpwR"
-    }
-  ]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform/decode/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "batch_results": [
-      {
-        "encoded_value": "1111-2222-3333-4444",
-        "reference": "order#1234"
-      },
-      {
-        "encoded_value": "1111-2222-3333-4444"
-      }
-    ]
-  }
-}
-```
-
-## Validate token
-
-This endpoint determines if a provided tokenized value is valid and unexpired.
-Only valid for tokenization transformations.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `POST` | `/transform/validate/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` –
-  Specifies the role name to use for this operation. This is specified as part
-  of the URL.
-
-- `value` `(string: <required>)` –
-  Specifies the token for which to check validity.
-
-- `transformation` `(string)` –
-  Specifies the transformation within the role that should be used for this
-  decode operation. If a single transformation exists for role, this parameter
-  may be skipped and will be inferred. If multiple transformations exist, one
-  must be specified.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` -
-  Specifies a list of items to be validated in a single batch. When this
-  parameter is set, the 'value', 'transformation' and
-  'reference' parameters are ignored. Instead, the aforementioned parameters
-  should be provided within each object in the list.
-
-  ```json
-  [
-    {
-      "value": "CAESLAoYChAhsIt7Urh6GmN2VnxAeuLGENuF8fkFEhBYz7wwdFyJPrhyDmvZg7L0",
-      "transformation": "ccn-tokenization"
-    }
-  ]
-  ```
-
-### Sample payload
-
-```json
-{
-  "value": "CAESLAoYChAhsIt7Urh6GmN2VnxAeuLGENuF8fkFEhBYz7wwdFyJPrhyDmvZg7L0",
-  "transformation": "ccn-tokenization"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform/validate/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "valid": true
-  }
-}
-```
-
-## Check tokenization
-
-This endpoint determines if a provided plaintext value has an valid, unexpired
-tokenized value. Note that this cannot return the token, just confirm that a
-tokenized value exists, but works for all tokenization modes.
-This endpoint is only valid for tokenization transformations.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `POST` | `/transform/tokenized/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` –
-  Specifies the role name to use for this operation. This is specified as part
-  of the URL.
-
-- `value` `(string: <required>)` –
-  Specifies the token to plaintext for which to check whether it has been tokenized.
-
-- `transformation` `(string)` –
-  Specifies the transformation within the role that should be used for this
-  decode operation. If a single transformation exists for role, this parameter
-  may be skipped and will be inferred. If multiple transformations exist, one
-  must be specified.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` -
-  Specifies a list of items to be decoded in a single batch. When this
-  parameter is set, the 'value', 'transformation', and 'reference' parameters are
-  ignored. Instead, the aforementioned parameters should be provided within
-  each object in the list. In addition, batched requests can add the 'reference'
-  field described above.
-
-  ```json
-  [
-    {
-      "value": "1111-1111-1111-1111",
-      "transformation": "ccn-tokenization"
-    }
-  ]
-  ```
-
-### Sample payload
-
-```json
-{
-  "value": "1111-1111-1111-1111",
-  "transformation": "ccn-tokenization"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform/tokenized/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "tokenized": true
-  }
-}
-```
-
-## Lookup token
-
-This endpoint returns the token given a plaintext and optionally an
-expiration or range of expirations.  This operation is only supported
-if the transformation is configured as 'convergent', or if the mapping
-mode is exportable and the storage backend is external.  Tokens may be
-looked up with an explicit expiration, an expiration value of "any", or with a range
-of acceptable expiration times. This endpoint is only valid for tokenization
-transformations.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `POST` | `/transform/tokens/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` –
-  Specifies the role name to use for this operation. This is specified as part
-  of the URL.
-
-- `value` `(string: <required>)` –
-  Specifies the token to test for whether it has a valid tokenization.
-
-- `expiration` `(string: "")` - The precise expiration of the token.  If omitted,
-  this specifically searches for tokens with no expiration.  If the string
-  "any", will return tokens with any or no expiration.  Otherwise,
-  the string must be the RFC3339 formatted time and date of expiration. `expiration`
-  may not be used at the same time as `min_expiration` and `max_expiration`.
-
-- `min_expiration` `(string: "")` - The minimum expiration time of the token,
-  inclusive, as an RFC3339 formatted time and date.
-  `min_expiration` may not be used at the same time as `expiration`.
-  When provided, `max_expiration` must also be provided.
-
-- `max_expiration` `(string: "")` - The maximum expiration time of the token,
-  inclusive, as an RFC3339 formatted time and date.
-  `max_expiration` may not be used at the same time as `expiration`.
-  When provided, `min_expiration` must also be provided.
-
-- `transformation` `(string)` –
-  Specifies the transformation within the role that should be used for this
-  lookup operation. If a single transformation exists for role, this parameter
-  may be skipped and will be inferred. If multiple transformations exist, one
-  must be specified.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using `batch_input` below.
-
-- `batch_input` `(array<object>: nil)` -
-  Specifies a list of items to be decoded in a single batch. When this
-  parameter is set, the `value`, `transformation`, and `reference` parameters are
-  ignored. Instead, the aforementioned parameters should be provided within
-  each object in the list. In addition, batched requests can add the `reference`
-  field described above.
-
-  ```json
-  [
-    {
-      "value": "1111-1111-1111-1111",
-      "expiration": "any",
-      "transformation": "ccn-tokenization"
-    }
-  ]
-  ```
-
-### Sample payload
-
-```json
-{
-  "value": "1111-1111-1111-1111",
-  "min_expiration": "2022-06-06T3:14:15+00:00",
-  "min_expiration": "2022-06-07T9:26:53+00:00",
-  "transformation": "ccn-tokenization"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform/tokens/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "tokens": [
-      "AHLdmFvTRknMBgrNSy6Ba7xJxG28KkZeHKqxGJ7e45G3V9UbcUr6gdv83ozwRRQwLfJgyHZvfa9rh7kU9xJXVdY"
-    ]
-  }
-}
-```
-
-## Retrieve token metadata
-
-This endpoint retrieves metadata for a tokenized value using a named role.
-Only valid for tokenization transformations.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `POST` | `/transform/metadata/:role_name` |
-
-### Parameters
-
-- `role_name` `(string: <required>)` –
-  Specifies the role name to use for this operation. This is specified as part
-  of the URL.
-
-- `value` `(string: <required>)` –
-  Specifies the token for which to retrieve metadata.
-
-- `transformation` `(string)` –
-  Specifies the transformation within the role that should be used for this
-  decode operation. If a single transformation exists for role, this parameter
-  may be skipped and will be inferred. If multiple transformations exist, one
-  must be specified.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` -
-  Specifies a list of items to be decoded in a single batch. When this
-  parameter is set, the 'value' parameter is
-  ignored. Instead, the aforementioned parameters should be provided within
-  each object in the list. In addition, batched requests can add the 'reference'
-  field described above.
-
-  ```json
-  [
-    {
-      "value": "CAESLAoYChAhsIt7Urh6GmN2VnxAeuLGENuF8fkFEhBYz7wwdFyJPrhyDmvZg7L0",
-      "transformation": "ccn-tokenization"
-    }
-  ]
-  ```
-
-### Sample payload
-
-```json
-{
-  "value": "CAESLAoYChAhsIt7Urh6GmN2VnxAeuLGENuF8fkFEhBYz7wwdFyJPrhyDmvZg7L0",
-  "transformation": "ccn-tokenization"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform/encode/example-role
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "metadata": "Department=Marketing"
-    "expiration_time": "2020-11-04T04:00:00+00:00",
-  }
-}
-```
-
-## Snapshot tokenization state
-
-This endpoint starts or continues retrieving a snapshot of the stored
-state of a tokenization transform. This state is protected as it is
-in the underlying store, and so is safe for storage or transport. Snapshots
-may be used for backup purposes or to migrate from one store to another.
-If more than one store is configured for a tokenization transform, the
-snapshot data contains the contents of the first store.
-
-Since more values may exist than can be returned in a single call, if
-a snapshot has more values, the response will contain the `continuation`
-field, an opaque value that if provided on a subsequent call will resume
-snapshotting at the next value. If absent, the end of the snapshot has
-been reached.
-
-Snapshots are guaranteed to contain the values present at the time
-of the first call to start the snapshot. Values tokenized after the
-snapshot began may or may not be included.
-
-| Method | Path                                                     |
-| :----- | :------------------------------------------------------- |
-| `POST` | `/transform/transformations/tokenization/snapshot/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the transformation to snapshot.
-
-- `limit` `(int: 1000)` -
-  The maximum number of tokenized value states to return on this call.
-
-- `continuation` `string: ""` -
-  If absent or empty, a new snapshot is started. If present, the
-  snapshot should continue at the next available value.
-
-### Sample payload
-
-```json
-{
-  "limit": 3,
-  "continuation": "2F1nUpUKMZUBnwQ77qByt1"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1//transform/transformations/tokenization/snapshot/sample-transform
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "continuation": "2F1nUpUKMZUBnwQ77qBt4D",
-    "values": [
-      "CiDiVGJaXlcS0ky4mRVvfLdxk7FWh8ATcFMSbQRtWCs/HxJ8CAESIGQH2oukpwPAFoK2SaKUcYAxrnxtvJn7n5d3dWx2eCLcIkZ3FXcQKu5+Bnl4NzOSL2ZkU5t9OOpQOMg0lwsMkq0Vm98ANGC9RabaP2ePddzTkD58GBvsVetYVnqHQFZufQ2pw/EXkFIWMg4I4KvX4vf/////ARCgHw==",
-      "CiADFWL7/equiN83oWl/MvYWRYQLvjUxDVvoxK1Ghw4drBJ8CAESIOWPEUBUq4ATLY83P3vLknmWlKYjKVwTgB1z7hYGdyHPIka2nyOX1z3D4pMsZWwMFJlNBiT1Lb4MMZ6CUbclykLw/LBG5GTWQbOXx/3Vd54RAA82382mUem8Lu8BCMJYAa6vj/6aS9CLMg4I4KvX4vf/////ARCIJw==",
-      "CiBf2+RqeiXmIHIh2fytEKOesTZ5U31D4BZ5xyhpuj3UfRJ8CAESIOWPEUBUq4ATLY83P3vLknmWlKYjKVwTgB1z7hYGdyHPIkbbU3ho25Om5AsuLUdsAPiEnyRGbtUUDxrvSoz5T1OVY363dN08cN8diJJro+AE/Zv4QMnq9Vbu8FD237YkLV1bnX/t29ZMMg4I4KvX4vf/////ARDwLg=="
-    ]
-  }
-}
-```
-
-## Restore tokenization state
-
-This endpoint restores previously snapshotted tokenization state values
-to the underlying store(s) of a tokenization transform. Calls to this
-endpoint are idempotent, so multiple outputs from a snapshot run can
-be applied via restore in any order and duplicates will not cause a problem.
-
-Values snapshotted from a `default` mapping mode store cannot be restored
-into an `exportable` mode store and vice versa.
-
-| Method | Path                                                    |
-| :----- | :------------------------------------------------------ |
-| `POST` | `/transform/transformations/tokenization/restore/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the transformation to restore.
-
-- `values` `([]string: <required>)` -
-  Any number of tokenization state values from a previous snapshot call.
-
-### Sample payload
-
-```json
-{
-  "values": [
-    "CiDiVGJaXlcS0ky4mRVvfLdxk7FWh8ATcFMSbQRtWCs/HxJ8CAESIGQH2oukpwPAFoK2SaKUcYAxrnxtvJn7n5d3dWx2eCLcIkZ3FXcQKu5+Bnl4NzOSL2ZkU5t9OOpQOMg0lwsMkq0Vm98ANGC9RabaP2ePddzTkD58GBvsVetYVnqHQFZufQ2pw/EXkFIWMg4I4KvX4vf/////ARCgHw==",
-    "CiADFWL7/equiN83oWl/MvYWRYQLvjUxDVvoxK1Ghw4drBJ8CAESIOWPEUBUq4ATLY83P3vLknmWlKYjKVwTgB1z7hYGdyHPIka2nyOX1z3D4pMsZWwMFJlNBiT1Lb4MMZ6CUbclykLw/LBG5GTWQbOXx/3Vd54RAA82382mUem8Lu8BCMJYAa6vj/6aS9CLMg4I4KvX4vf/////ARCIJw==",
-    "CiBf2+RqeiXmIHIh2fytEKOesTZ5U31D4BZ5xyhpuj3UfRJ8CAESIOWPEUBUq4ATLY83P3vLknmWlKYjKVwTgB1z7hYGdyHPIkbbU3ho25Om5AsuLUdsAPiEnyRGbtUUDxrvSoz5T1OVY363dN08cN8diJJro+AE/Zv4QMnq9Vbu8FD237YkLV1bnX/t29ZMMg4I4KvX4vf/////ARDwLg=="
-  ]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1//transform/transformations/tokenization/restore/sample-transform
-```
-
-## Export decoded tokenization state
-
-This endpoint starts or continues retrieving an export of tokenization
-state, including the tokens and their decoded values. This call is only
-supported on tokenization stores configured with the `exportable` mapping
-mode. Refer to the Tokenization
-[documentation](/vault/docs/secrets/transform/tokenization#security-considerations)
-for when to use the `exportable` mapping mode.
-Decoded values are in Base64 representation.
-
-Since more values may exist than can be returned in a single call, if
-an export has more values, the response will contain the `continuation`
-field, an opaque value that if provided on a subsequent call will resume
-snapshotting at the next value. If absent, the end of the export has
-been reached.
-
-Exports are guaranteed to contain the values present at the time
-of the first call to start the export. Values tokenized after the
-snapshot began may or may not be included.
-
-| Method | Path                                                           |
-| :----- | :------------------------------------------------------------- |
-| `POST` | `/transform/transformations/tokenization/export-decoded/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` –
-  Specifies the name of the transformation to export.
-
-- `limit` `(int: 1000)` -
-  The maximum number of tokenized value states to return on this call.
-
-- `continuation` `string: ""` -
-  If absent or empty, a new export is started. If present, the
-  export should continue at the next available value.
-
-### Sample payload
-
-```json
-{
-  "limit": 3,
-  "continuation": "2F1nUpUKMZUBnwQ77qByt1"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1//transform/transformations/tokenization/export-decoded/sample-transform
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "continuation": "4hELrrmGAwhHFjmMFny",
-    "values": [
-      {
-        "plaintext": "dmFsdWUtMA==",
-        "token": "Q4tYgFXHxUaPhDdV9rx2CduZGPxjYpAp1K523AUsNM5A2Z6DrXj3zz"
-      },
-      {
-        "plaintext": "dmFsdWUtMg==",
-        "token": "Q4tYgFXHxUNyMfqRW6fA82DYvMigwdf6JjATauyVzqx2SsmUShMhN5",
-        "expiration_time": "2021-03-15T00:31:10Z"
-      },
-      {
-        "plaintext": "dmFsdWUtMQ==",
-        "token": "Q4tYgFXHxUNtW27owABRv5GjuxjXTCGebPr7xkqRAY18YVmfZsk2MV"
-      }
-    ]
-  }
-}
-```
-
-## Rotate tokenization key
-
-This endpoint rotates the version of the named key. After rotation,
-new requests will be encoded with the new version of the key.
-
-| Method | Path                                                  |
-| :----- | :---------------------------------------------------- |
-| `POST` | `/transform/tokenization/keys/:transform_name/rotate` |
-
-### Parameters
-
-- `transform_name` `(string: <required>)` –
-  Specifies the transform name to use for this operation. This is specified as part
-  of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/transform/tokenization/keys/transform_name/rotate
-```
-
-## Update tokenization key config
-
-This endpoint allows the minimum key version to be set for
-decode operations.
-Only valid for tokenization transformations.
-
-| Method | Path                                                  |
-| :----- | :---------------------------------------------------- |
-| `POST` | `/transform/tokenization/keys/:transform_name/config` |
-
-### Parameters
-
-- `transform_name` `(string: <required>)` –
-  Specifies the transform name to use for this operation. This is specified as part
-  of the URL.
-
-- `min_decryption_version` `(int: <optional>)` –
-  Specifies the minimum key version that vault can use to decode values for the
-  corresponding transform.
-
-- `auto_rotate_period` `(duration: "0", optional)` - The period at which this key
-  should be rotated automatically. Setting this to "0" will disable automatic key
-  rotation. This value cannot be shorter than one hour. Uses
-  [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-```json
-[
-  {
-    "min_decryption_version": 1,
-    "auto_rotate_period": "4320h"
-  }
-]
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform/tokenization/keys/transform_name/config
-```
-
-## List tokenization key configuration
-
-List all tokenization keys.
-Only valid for tokenization transformations.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `LIST` | `/transform/tokenization/keys/` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/transform/tokenization/keys/
-```
-
-## Read tokenization key configuration
-
-Read tokenization key configuration for a particular transform.
-Only valid for tokenization transformations.
-
-| Method | Path                                           |
-| :----- | :--------------------------------------------- |
-| `GET`  | `/transform/tokenization/keys/:transform_name` |
-
-### Parameters
-
-- `transform_name` `(string: <required>)` –
-  Specifies the transform name to use for this operation. This is specified as part
-  of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transform/tokenization/keys/:transform_name
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "latest_version": 1,
-    "min_available_version": 0,
-    "min_decryption_version": 1,
-    "auto_rotate_period": "4320h",
-    "name": "transform_name"
-  }
-}
-```
-
-## Trim tokenization key version
-
-This endpoint trims older key versions setting a minimum version for the keyring.
-Once trimmed, previous versions of the key cannot be recovered.
-
-| Method | Path                                                |
-| :----- | :-------------------------------------------------- |
-| `POST` | `/transform/tokenization/keys/:transform_name/trim` |
-
-### Parameters
-
-- `transform_name` `(string: <required>)` –
-  Specifies the transform name to use for this operation. This is specified as part
-  of the URL.
-
-- `min_available_version` `(int: <required>)` –
-  Specifies minimum key version available for use for this transform. All versions below
-  this will be permanently forgotten. Cannot be set below `min_decryption_version` or above
-  `latest_version`.
-
-### Sample payload
-
-```json
-{
-  "min_available_version": 1
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transform//transform/tokenization/keys/:transform_name/trim
-```
diff --git a/website/content/api-docs/secret/transit.mdx b/website/content/api-docs/secret/transit.mdx
deleted file mode 100644
index 4bcf4fe4dcc..00000000000
--- a/website/content/api-docs/secret/transit.mdx
+++ /dev/null
@@ -1,1955 +0,0 @@
----
-layout: api
-page_title: Transit - Secrets Engines - HTTP API
-description: This is the API documentation for the Vault Transit secrets engine.
----
-
-# Transit secrets engine (API)
-
-This is the API documentation for the Vault Transit secrets engine. For general
-information about the usage and operation of the Transit secrets engine, please
-see the [transit documentation](/vault/docs/secrets/transit).
-
-This documentation assumes the transit secrets engine is enabled at the
-`/transit` path in Vault. Since it is possible to enable secrets engines at any
-location, please update your API calls accordingly.
-
-## Create key
-
-This endpoint creates a new named encryption key of the specified type. The
-values set here cannot be changed after key creation.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `POST` | `/transit/keys/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  create. This is specified as part of the URL.
-
-- `convergent_encryption` `(bool: false)` – If enabled, the key will support
-  convergent encryption, where the same plaintext creates the same ciphertext.
-  This requires _derived_ to be set to `true`. When enabled, each
-  encryption(/decryption/rewrap/datakey) operation will derive a `nonce` value
-  rather than randomly generate it.
-
-- `derived` `(bool: false)` – Specifies if key derivation is to be used. If
-  enabled, all encrypt/decrypt requests to this named key must provide a context
-  which is used for key derivation.
-
-- `exportable` `(bool: false)` - Enables keys to be exportable. This
-  allows for all the valid keys in the key ring to be exported. Once set, this
-  cannot be disabled.
-
-- `allow_plaintext_backup` `(bool: false)` - If set, enables taking backup of
-  named key in the plaintext format. Once set, this cannot be disabled.
-
-- `type` `(string: "aes256-gcm96")` – Specifies the type of key to create. The
-  currently-supported types are:
-
-  - `aes128-gcm96` – AES-128 wrapped with GCM using a 96-bit nonce size AEAD
-    (symmetric, supports derivation and convergent encryption)
-  - `aes256-gcm96` – AES-256 wrapped with GCM using a 96-bit nonce size AEAD
-    (symmetric, supports derivation and convergent encryption, default)
-  - `chacha20-poly1305` – ChaCha20-Poly1305 AEAD (symmetric, supports
-    derivation and convergent encryption)
-  - `ed25519` – ED25519 (asymmetric, supports derivation). When using
-    derivation, a sign operation with the same context will derive the same
-    key and signature; this is a signing analogue to `convergent_encryption`.
-  - `ecdsa-p256` – ECDSA using the P-256 elliptic curve (asymmetric)
-  - `ecdsa-p384` – ECDSA using the P-384 elliptic curve (asymmetric)
-  - `ecdsa-p521` – ECDSA using the P-521 elliptic curve (asymmetric)
-  - `rsa-2048` - RSA with bit size of 2048 (asymmetric)
-  - `rsa-3072` - RSA with bit size of 3072 (asymmetric)
-  - `rsa-4096` - RSA with bit size of 4096 (asymmetric)
-  - `hmac` - HMAC (HMAC generation, verification)
-  - `managed_key` - External key configured via the [Managed Keys](/vault/docs/enterprise/managed-keys) feature (enterprise only)
-
-  ~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-     and thus should not be used: `chacha20-poly1305` and `ed25519`.
-
-  ~> **Note**: All key types support HMAC through the use of a second randomly
-     generated key created key creation time or rotation.  The HMAC key type only
-     supports HMAC, and behaves identically to other algorithms with
-     respect to the HMAC operations but supports key import.  By default,
-     the HMAC key type uses a 256-bit key.
-
-  ~> **Note**: When key type is `managed_key`, either the `managed_key_name` or
-     `managed_key_id` parameter must be specified.
-- `key_size` `(int: "0", optional)` - The key size in bytes for algorithms
-  that allow variable key sizes.  Currently only applicable to HMAC, where
-  it must be between 32 and 512 bytes.
-- `auto_rotate_period` `(duration: "0", optional)` – The period at which
-  this key should be rotated automatically. Setting this to "0" (the default)
-  will disable automatic key rotation. This value cannot be shorter than one
-  hour. Uses [duration format strings](/vault/docs/concepts/duration-format).
-- `managed_key_name` `(string: "")` - The name of the managed key to use for this transit key.
-- `managed_key_id` `(string: "")` - The UUID of the managed key to use for this transit key.
-### Sample payload
-
-```json
-{
-  "type": "ecdsa-p256",
-  "derived": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/keys/my-key
-```
-
-## Import key
-
-This endpoint imports existing key material into a new transit-managed encryption key.
-To import key material into an existing key, see the `import_version/` endpoint.
-
-This supports one of two forms:
-
- 1. Private/Symmetric Key import, requiring the `ciphertext`, `hash_function`
-    parameters be set (and automatically deriving the public key), or
- 2. Public Key-only import, restricting the operations that can be done with
-    this key, and requiring only the `public_key` parameter.
-
-The remaining parameters (including `name`, `type`, `allow_rotation`,
-`derived`, `context`, `exportable`, `allow_plaintext_backup`, and
-`auto_rotate_period`) remain the same across both versions of this call.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/transit/keys/:name/import` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  create. This is specified as part of the URL.
-
-- `ciphertext` `(string: <required>)` - A base64-encoded string that contains
-two values: an ephemeral 256-bit AES key wrapped using the wrapping key
-returned by Vault and the encryption of the import key material under the
-provided AES key. The wrapped AES key should be the first 512 bytes of the
-ciphertext, and the encrypted key material should be the remaining bytes.
-See the BYOK section of the [Transit secrets engine documentation](/vault/docs/secrets/transit#bring-your-own-key-byok)
-for more information on constructing the ciphertext. If `public_key` is set,
-this field is not required.
-
-- `hash_function` `(string: "SHA256")` - The hash function used for the
-RSA-OAEP step of creating the ciphertext. Supported hash functions are:
-`SHA1`, `SHA224`, `SHA256`, `SHA384`, and `SHA512`. If not specified,
-the hash function defaults to SHA256.
-
-- `type` `(string: <required>)` – Specifies the type of key to create. The
-  currently-supported types are:
-
-  - `aes128-gcm96` – AES-128 wrapped with GCM using a 96-bit nonce size AEAD
-    (symmetric, supports derivation and convergent encryption)
-  - `aes256-gcm96` – AES-256 wrapped with GCM using a 96-bit nonce size AEAD
-    (symmetric, supports derivation and convergent encryption, default)
-  - `chacha20-poly1305` – ChaCha20-Poly1305 AEAD (symmetric, supports
-    derivation and convergent encryption)
-  - `ed25519` – ED25519 (asymmetric, supports derivation). When using
-    derivation, a sign operation with the same context will derive the same
-    key and signature; this is a signing analogue to `convergent_encryption`.
-  - `ecdsa-p256` – ECDSA using the P-256 elliptic curve (asymmetric)
-  - `ecdsa-p384` – ECDSA using the P-384 elliptic curve (asymmetric)
-  - `ecdsa-p521` – ECDSA using the P-521 elliptic curve (asymmetric)
-  - `rsa-2048` - RSA with bit size of 2048 (asymmetric)
-  - `rsa-3072` - RSA with bit size of 3072 (asymmetric)
-  - `rsa-4096` - RSA with bit size of 4096 (asymmetric)
-
-- `public_key` `(string: "", optional)` - A plaintext PEM public key to be
-imported. This limits the operations available under this key to verification
-and encryption, depending on the key type and algorithm, as no private key
-is available.
-
-- `allow_rotation` `(bool: false)` - If set, the imported key can be rotated
-within Vault by using the `rotate` endpoint.
-
-~> **NOTE**: Once an imported key is rotated within Vault, it will no longer
-support importing key material with the `import_version` endpoint.
-
-- `derived` `(bool: false)` – Specifies if key derivation is to be used. If
-  enabled, all encrypt/decrypt requests to this named key must provide a context
-  which is used for key derivation.
-
-- `context` `(string: "")` - A base64-encoded string providing a context for
-key derivation. Required if `derived` is set to `true`.
-
-- `exportable` `(bool: false)` - Enables keys to be exportable. This
-  allows for all the valid keys in the key ring to be exported. Once set, this
-  cannot be disabled.
-
-- `allow_plaintext_backup` `(bool: false)` - If set, enables taking backup of
-  named key in the plaintext format. Once set, this cannot be disabled.
-
-- `auto_rotate_period` `(duration: "0", optional)` – The period at which
-  this key should be rotated automatically. Setting this to "0" (the default)
-  will disable automatic key rotation. This value cannot be shorter than one
-  hour.
-
-### Sample payload
-
-```json
-{
-  "type": "ed25519",
-  "ciphertext": "..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/keys/my-key/import
-```
-
-## Import key version
-
-This endpoint imports new key material into an existing imported key.
-
-See description and note in [Import Key](#import-key) above about importing
-public and private keys.
-
-Notably, using this method, a private key matching a public key can be
-imported at a later date.
-
-| Method | Path                                 |
-| :----- | :----------------------------------- |
-| `POST` | `/transit/keys/:name/import_version` |
-
-~> **Note**: Keys whose material was generated by Vault do not support
-importing key material. Only keys that were previously imported into
-Vault can import new key material from an external source.
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  create. This is specified as part of the URL.
-
-- `ciphertext` `(string: <required>)` - A base64-encoded string that contains
-two values: an ephemeral 256-bit AES key wrapped using the wrapping key
-returned by Vault and the encryption of the import key material under the
-provided AES key. The wrapped AES key should be the first 512 bytes of the
-ciphertext, and the encrypted key material should be the remaining bytes.
-See the BYOK section of the [Transit secrets engine documentation](/vault/docs/secrets/transit#bring-your-own-key-byok)
-for more information on constructing the ciphertext.
-
-- `hash_function` `(string: "SHA256")` - The hash function used for the
-RSA-OAEP step of creating the ciphertext. Supported hash functions are:
-`SHA1`, `SHA224`, `SHA256`, `SHA384`, and `SHA512`. If not specified,
-the hash function defaults to SHA256.
-
-- `public_key` `(string: "", optional)` - A plaintext PEM public key to be
-imported. This limits the operations available under this key to verification
-and encryption, depending on the key type and algorithm, as no private key
-is available.
-
-- `version` `(int, optional)` - Key version to be updated, if left empty,
-a new version will be created unless a private key is specified and the
-'Latest' key is missing a private key.
-
-### Sample payload
-
-```json
-{
-  "ciphertext": "..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/keys/my-key/import_version
-```
-
-## Get wrapping key
-
-This endpoint is used to retrieve the wrapping key to use for importing keys.
-The returned key will be a 4096-bit RSA public key.
-
-| Method | Path                   |
-| :---- | :---------------------- |
-| `GET` | `/transit/wrapping_key` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/transit/wrapping_key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "public_key": "..."
-  },
-}
-```
-
-## Read key
-
-This endpoint returns information about a named encryption key. The `keys`
-object shows the creation time of each key version; the values are not the keys
-themselves. Depending on the type of key, different information may be returned,
-e.g. an asymmetric key will return its public key in a standard format for the
-type.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `GET`  | `/transit/keys/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  read. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transit/keys/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "type": "aes256-gcm96",
-    "deletion_allowed": false,
-    "derived": false,
-    "exportable": false,
-    "allow_plaintext_backup": false,
-    "keys": {
-      "1": 1442851412
-    },
-    "min_decryption_version": 1,
-    "min_encryption_version": 0,
-    "name": "foo",
-    "supports_encryption": true,
-    "supports_decryption": true,
-    "supports_derivation": true,
-    "supports_signing": false,
-    "imported": false
-  }
-}
-```
-
-The `keys` attribute lists each version of the key, and the time that key was created as seconds since the Unix epoch.
-The sample response shows a key that was created on September 22, 2015 7:50:12 PM GMT, and has not been rotated.
-
-The fields `supports_encryption`, `supports_decryption`, `supports_derivation` and `supports_signing` are
-derived from the type of the key, and indicate which operations may be performed with it.
-
-## List keys
-
-This endpoint returns a list of keys. Only the key names are returned (not the
-actual keys themselves).
-
-| Method | Path            |
-| :----- | :-------------- |
-| `LIST` | `/transit/keys` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/transit/keys
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["foo", "bar"]
-  },
-  "lease_duration": 0,
-  "lease_id": "",
-  "renewable": false
-}
-```
-
-## Delete key
-
-This endpoint deletes a named encryption key. It will no longer be possible to
-decrypt any data encrypted with the named key. Because this is a potentially
-catastrophic operation, the `deletion_allowed` tunable must be set in the key's
-`/config` endpoint.
-
-| Method   | Path                  |
-| :------- | :-------------------- |
-| `DELETE` | `/transit/keys/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  delete. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/transit/keys/my-key
-```
-
-## Update key configuration
-
-This endpoint allows tuning configuration values for a given key. (These values
-are returned during a read operation on the named key.)
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/transit/keys/:name/config` |
-
-### Parameters
-
-- `min_decryption_version` `(int: 0)` – Specifies the minimum version of
-  ciphertext allowed to be decrypted. Adjusting this as part of a key rotation
-  policy can prevent old copies of ciphertext from being decrypted, should they
-  fall into the wrong hands. For signatures, this value controls the minimum
-  version of signature that can be verified against. For HMACs, this controls
-  the minimum version of a key allowed to be used as the key for verification.
-
-- `min_encryption_version` `(int: 0)` – Specifies the minimum version of the
-  key that can be used to encrypt plaintext, sign payloads, or generate HMACs.
-  Must be `0` (which will use the latest version) or a value greater or equal
-  to `min_decryption_version`.
-
-- `deletion_allowed` `(bool: false)` - Specifies if the key is allowed to be
-  deleted.
-
-- `exportable` `(bool: false)` - Enables keys to be exportable. This
-  allows for all the valid keys in the key ring to be exported. Once set, this
-  cannot be disabled.
-
-- `allow_plaintext_backup` `(bool: false)` - If set, enables taking backup of
-  named key in the plaintext format. Once set, this cannot be disabled.
-
-- `auto_rotate_period` `(duration: "", optional)` – The period at which this
-  key should be rotated automatically. Setting this to "0" will disable automatic
-  key rotation. This value cannot be shorter than one hour. When no value is
-  provided, the period remains unchanged. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-### Sample payload
-
-```json
-{
-  "deletion_allowed": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/keys/my-key/config
-```
-
-## Rotate key
-
-This endpoint rotates the version of the named key. After rotation, new
-plaintext requests will be encrypted with the new version of the key. To upgrade
-ciphertext to be encrypted with the latest version of the key, use the `rewrap`
-endpoint. This is only supported with keys that support encryption and
-decryption operations.
-
-For algorithms with a configurable key size, the rotated key will use the same
-key size as the previous version.
-
-~> **Note**: For imported keys, rotation is only supported if the
-`allow_rotation` field was set to `true` on import. Once an imported key is
-rotated within Vault, it will not support further import operations.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/transit/keys/:name/rotate` |
-
-### Parameters
-
-- `managed_key_name` `(string: "")` - The name of the managed key to use for this transit key.
-- `managed_key_id` `(string: "")` - The UUID of the managed key to use for this transit key.
-
-~> **Note**: If the key to be rotated is of type `managed_key`, either the `managed_key_name` or
-   the `managed_key_id` for the new key must be provided.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/transit/keys/my-key/rotate
-```
-
-## Sign CSR
-
-This endpoint signs a CSR with the `:name` key, allowing the key material
-never to leave Transit. If no template CSR is specified, an empty CSR is
-signed, otherwise, a copy of the specified CSR with key material replaced
-with this key material is signed.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/transit/keys/:name/csr` |
-
-### Parameters
-
- - `name` `(string: <required>)` - Specifies the name of the key to
-   sign the CSR with. This is specified as part of the URL.
-
- - `version` `(string: "")` - Specifies the version of the CSR key to
-   use for signing.  If the version is set to `latest` or is not set,
-   the current key will be returned.
-
- - `csr` `(string: "")` - Optional PEM-encoded CSR template to use
-   as a basis for the new CSR signed by this key. If not set, an empty
-   CSR is used.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/transit/keys/my-key/csr
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "name": "my-key",
-    "version": 1,
-    "csr": "-----BEGIN ..."
-  }
-}
-```
-
-## Set Certificate Chain
-
-This endpoint sets the certificate chain associated with the `:name` key,
-allowing the key material never to leave Transit and for certificates to
-be tracked in a single mount. Note that this allows updating and rotating
-the chain as it will overwrite any previously set certificate chain.
-
-| Method | Path                                  |
-| :----- | :------------------------------------ |
-| `POST` | `/transit/keys/:name/set-certificate` |
-
-### Parameters
-
- - `name` `(string: <required>)` - Specifies the name of the key to
-   import the certificate chain against. This is specified as part of the
-   URL.
-
- - `version` `(string: "")` - Specifies the version of the key to import the
-   chain against.  If the version is set to `latest` or is not set, the current
-   key will be returned.
-
- - `certificate_chain` `(string: "")` - Optional PEM-encoded CSR template to use
-   as a basis for the new CSR signed by this key. If not set, an empty
-   CSR is used.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/transit/keys/my-key/set-certificate
-```
-
-## Securely export key
-
-This endpoint returns a wrapped copy of the `source` key, protected by the
-`destination` key using the BYOK method accepted by the
-`/transit/keys/:name/import` API. This allows an operator using two separate
-Vault instances to secure established shared key material, without exposing
-either key in plaintext and needing to run a manual BYOK import using the
-CLI helper utility.
-
-| Method | Path                                                   |
-| :----- | :----------------------------------------------------- |
-| `GET`  | `/transit/byok-export/:destination/:source(/:version)` |
-
-### Parameters
-
-- `destination` `(string: <required>)` - Specifies the name of the key to
-  encrypt the `source` key to: this is usually another mount or cluster's
-  wrapping key (from `/transit/wrapping_key`). This is specified as part of
-  the URL.
-
-~> Note: This destination key type must be an RSA key type.
-
-- `source` `(string: <required>)` - Specifies the source key to encrypt, to
-  copy (encrypted) to another cluster. This is specified as part of the URL.
-
-- `version` `(string: "")` - Specifies the version of the source key to
-  wrap. If omitted, all versions of the key will be returned. This is
-  specified as part of the URL. If the version is set to `latest`, the
-  current key will be returned.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transit/byok-export/wrapping-key/to-be-shared-key/1
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "name": "foo",
-    "keys": {
-      "1": "H/0T+CKQ8I82KJWpPk ... additional response elided ...",
-    }
-  }
-}
-```
-
-
-## Export key
-
-This endpoint returns the named key. The `keys` object shows the value of the
-key for each version. If `version` is specified, the specific version will be
-returned. If `latest` is provided as the version, the current key will be
-provided. Depending on the type of key, different information may be returned.
-The key must be exportable to support this operation and the version must still
-be valid.
-
-| Method | Path                                         |
-| :----- | :------------------------------------------- |
-| `GET`  | `/transit/export/:key_type/:name(/:version)` |
-
-### Parameters
-
-- `key_type` `(string: <required>)` – Specifies the type of the key to export.
-  This is specified as part of the URL. Valid values are:
-
-  - `encryption-key`
-  - `signing-key`
-  - `hmac-key`
-  - `public-key`, to return the corresponding public keys of private key
-    asymmetric keys (EC with NIST P-curves or Ed25519 and RSA).
-  - `certificate-chain`, to return the imported certificate chain (via
-    `set-certificate`) corresponding to this key and version.
-
-- `name` `(string: <required>)` – Specifies the name of the key to read
-  information about. This is specified as part of the URL.
-
-- `version` `(string: "")` – Specifies the version of the key to read. If omitted,
-  all versions of the key will be returned. This is specified as part of the
-  URL. If the version is set to `latest`, the current key will be returned.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transit/export/encryption-key/my-key/1
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "name": "foo",
-    "keys": {
-      "1": "eyXYGHbTmugUJn6EtYD/yVEoF6pCxm4R/cMEutUm3MY=",
-      "2": "Euzymqx6iXjS3/NuGKDCiM2Ev6wdhnU+rBiKnJ7YpHE="
-    }
-  }
-}
-```
-
-## Write keys configuration
-
-This endpoint maintains global configuration across all keys. This
-allows removing the upsert capability of the `/encrypt/:key` endpoint,
-preventing new keys from being created if none exists.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/transit/config/keys` |
-
-### Parameters
-
-- `disable_upsert` `(bool: false)` - Specifies whether to disable upserting on
-  encryption (automatic creation of unknown keys).
-
-### Sample payload
-
-```json
-{
-  "disable_upsert": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/config/keys
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "disable_upsert": true,
-  }
-}
-```
-
-## Read keys configuration
-
-This endpoint maintains global configuration across all keys. This
-allows removing the upsert capability of the `/encrypt/:key` endpoint,
-preventing new keys from being created if none exists.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/transit/config/keys` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transit/config/keys
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "disable_upsert": false,
-  }
-}
-```
-
-## Encrypt data
-
-This endpoint encrypts the provided plaintext using the named key. This path
-supports the `create` and `update` policy capabilities as follows: if the user
-has the `create` capability for this endpoint in their policies, and the key
-does not exist, it will be upserted with default values (whether the key
-requires derivation depends on whether the context parameter is empty or not).
-If the user only has `update` capability and the key does not exist, an error
-will be returned.
-
-~> Note: If upsert is disallowed by global keys configuration, `create`
-   requests will behave like `update` requests.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/transit/encrypt/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  encrypt against. This is specified as part of the URL.
-
-- `plaintext` `(string: <required>)` – Specifies **base64 encoded** plaintext to
-  be encoded.
-
-- `associated_data` `(string: "")` - Specifies **base64 encoded** associated
-  data (also known as additional data or AAD) to also be authenticated with
-  AEAD ciphers (`aes128-gcm96`, `aes256-gcm`, and `chacha20-poly1305`).
-
-- `context` `(string: "")` – Specifies the **base64 encoded** context for key
-  derivation. This is required if key derivation is enabled for this key.
-
-- `key_version` `(int: 0)` – Specifies the version of the key to use for
-  encryption. If not set, uses the latest version. Must be greater than or
-  equal to the key's `min_encryption_version`, if set.
-
-- `nonce` `(string: "")` – Specifies the **base64 encoded** nonce value. This
-  must be provided if convergent encryption is enabled for this key and the key
-  was generated with Vault 0.6.1. Not required for keys created in 0.6.2+. The
-  value must be exactly 96 bits (12 bytes) long and the user must ensure that
-  for any given context (and thus, any given encryption key) this nonce value is
-  **never reused**.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` – Specifies a list of items to be
-  encrypted in a single batch. When this parameter is set, if the parameters
-  'plaintext', 'context' and 'nonce' are also set, they will be ignored.
-  Any batch output will preserve the order of the batch input. The
-  format for the input is:
-
-  ```json
-  [
-    {
-      "context": "c2FtcGxlY29udGV4dA==",
-      "plaintext": "dGhlIHF1aWNrIGJyb3duIGZveA=="
-    },
-    {
-      "context": "YW5vdGhlcnNhbXBsZWNvbnRleHQ=",
-      "plaintext": "dGhlIHF1aWNrIGJyb3duIGZveA=="
-    }
-  ]
-  ```
-
-- `type` `(string: "aes256-gcm96")` –This parameter is required when encryption
-  key is expected to be created. When performing an upsert operation, the type
-  of key to create.
-
-- `convergent_encryption` `(string: "")` – This parameter will only be used when
-  a key is expected to be created. Whether to support convergent encryption.
-  This is only supported when using a key with key derivation enabled and will
-  require all requests to carry both a context and 96-bit (12-byte) nonce. The
-  given nonce will be used in place of a randomly generated nonce. As a result,
-  when the same context and nonce are supplied, the same ciphertext is
-  generated. It is _very important_ when using this mode that you ensure that
-  all nonces are unique for a given context. Failing to do so will severely
-  impact the ciphertext's security.
-
-- `partial_failure_response_code` `(int: 400)` Ordinarily, if a batch item fails
-  to encrypt due to a bad input, but other batch items succeed, the HTTP response
-  code is 400 (Bad Request).  Some applications may want to treat partial failures
-  differently.  Providing the parameter returns the given response code integer
-  instead of a failed status code in this case. If all values fail an error
-  code is still returned.  Be warned that some failures (such as failure to
-  decrypt) could be indicative of a security breach and should not be
-  ignored.
-
-~>**NOTE:** All plaintext data **must be base64-encoded**. The reason for this
-requirement is that Vault does not require that the plaintext is "text". It
-could be a binary file such as a PDF or image. The easiest safe transport
-mechanism for this data as part of a JSON payload is to base64-encode it.
-
-### Sample payload
-
-Fist, encode the plaintext with base64:
-
-```shell-session
-$ echo "the quick brown fox" | base64
-dGhlIHF1aWNrIGJyb3duIGZveAo=
-```
-
-Use the base64-encoded plaintext in the payload:
-
-```json
-{
-  "plaintext": "dGhlIHF1aWNrIGJyb3duIGZveAo="
-}
-```
-
-!> Vault HTTP API imposes a maximum request size of 32MB to prevent a denial of service attack. This can be tuned per [`listener` block](/vault/docs/configuration/listener/tcp) in the Vault server configuration.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/encrypt/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "ciphertext": "vault:v1:XjsPWPjqPrBi1N2Ms2s1QM798YyFWnO4TR4lsFA="
-  }
-}
-```
-
-## Decrypt data
-
-This endpoint decrypts the provided ciphertext using the named key.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/transit/decrypt/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  decrypt against. This is specified as part of the URL.
-
-- `ciphertext` `(string: <required>)` – Specifies the ciphertext to decrypt.
-
-- `associated_data` `(string: "")` - Specifies **base64 encoded** associated
-  data (also known as additional data or AAD) to also be authenticated with
-  AEAD ciphers (`aes128-gcm96`, `aes256-gcm`, and `chacha20-poly1305`).
-
-- `context` `(string: "")` – Specifies the **base64 encoded** context for key
-  derivation. This is required if key derivation is enabled.
-
-- `nonce` `(string: "")` – Specifies a base64 encoded nonce value used during
-  encryption. Must be provided if convergent encryption is enabled for this key
-  and the key was generated with Vault 0.6.1. Not required for keys created in
-  0.6.2+.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` – Specifies a list of items to be
-  decrypted in a single batch. When this parameter is set, if the parameters
-  'ciphertext', 'context' and 'nonce' are also set, they will be ignored.
-  Any batch output will preserve the order of the batch input. Format
-  for the input goes like this:
-
-  ```json
-  [
-    {
-      "context": "c2FtcGxlY29udGV4dA==",
-      "ciphertext": "vault:v1:/DupSiSbX/ATkGmKAmhqD0tvukByrx6gmps7dVI="
-    },
-    {
-      "context": "YW5vdGhlcnNhbXBsZWNvbnRleHQ=",
-      "ciphertext": "vault:v1:XjsPWPjqPrBi1N2Ms2s1QM798YyFWnO4TR4lsFA="
-    }
-  ]
-  ```
-- `partial_failure_response_code` `(int: 400)` Ordinarily, if a batch item fails
-  to encrypt due to a bad input, but other batch items succeed, the HTTP response
-  code is 400 (Bad Request).  Some applications may want to treat partial failures
-  differently.  Providing the parameter returns the given response code integer
-  instead of a failed status code in this case. If all values fail an error
-  code is still returned.  Be warned that some failures (such as failure to
-  decrypt) could be indicative of a security breach and should not be
-  ignored.
-
-### Sample payload
-
-```json
-{
-  "ciphertext": "vault:v1:XjsPWPjqPrBi1N2Ms2s1QM798YyFWnO4TR4lsFA="
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/decrypt/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "plaintext": "dGhlIHF1aWNrIGJyb3duIGZveAo="
-  }
-}
-```
-
-## Rewrap data
-
-This endpoint rewraps the provided ciphertext using the latest version of the
-named key. Because this never returns plaintext, it is possible to delegate this
-functionality to untrusted users or scripts.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/transit/rewrap/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  re-encrypt against. This is specified as part of the URL.
-
-- `ciphertext` `(string: <required>)` – Specifies the ciphertext to re-encrypt.
-
-- `context` `(string: "")` – Specifies the **base64 encoded** context for key
-  derivation. This is required if key derivation is enabled.
-
-- `key_version` `(int: 0)` – Specifies the version of the key to use for the
-  operation. If not set, uses the latest version. Must be greater than or equal
-  to the key's `min_encryption_version`, if set.
-
-- `nonce` `(string: "")` – Specifies a base64 encoded nonce value used during
-  encryption. Must be provided if convergent encryption is enabled for this key
-  and the key was generated with Vault 0.6.1. Not required for keys created in
-  0.6.2+.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` – Specifies a list of items to be
-  re-encrypted in a single batch. When this parameter is set, if the parameters
-  'ciphertext', 'context' and 'nonce' are also set, they will be ignored.
-  Any batch output will preserve the order of the batch input. Format
-  for the input goes like this:
-
-  ```json
-  [
-    {
-      "context": "c2FtcGxlY29udGV4dA==",
-      "ciphertext": "vault:v1:/DupSiSbX/ATkGmKAmhqD0tvukByrx6gmps7dVI="
-    },
-    {
-      "context": "YW5vdGhlcnNhbXBsZWNvbnRleHQ=",
-      "ciphertext": "vault:v1:XjsPWPjqPrBi1N2Ms2s1QM798YyFWnO4TR4lsFA="
-    }
-  ]
-  ```
-
-### Sample payload
-
-```json
-{
-  "ciphertext": "vault:v1:XjsPWPjqPrBi1N2Ms2s1QM798YyFWnO4TR4lsFA="
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/rewrap/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "ciphertext": "vault:v2:abcdefgh"
-  }
-}
-```
-
-## Generate data key
-
-This endpoint generates a new high-entropy key and the value encrypted with the
-named key. Optionally return the plaintext of the key as well. Whether plaintext
-is returned depends on the path; as a result, you can use Vault ACL policies to
-control whether a user is allowed to retrieve the plaintext value of a key. This
-is useful if you want an untrusted user or operation to generate keys that are
-then made available to trusted users.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/transit/datakey/:type/:name` |
-
-### Parameters
-
-- `type` `(string: <required>)` – Specifies the type of key to generate. If
-  `plaintext`, the plaintext key will be returned along with the ciphertext. If
-  `wrapped`, only the ciphertext value will be returned. This is specified as
-  part of the URL.
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  use to encrypt the datakey. This is specified as part of the URL.
-
-- `context` `(string: "")` – Specifies the key derivation context, provided as a
-  base64-encoded string. This must be provided if derivation is enabled.
-
-- `nonce` `(string: "")` – Specifies a nonce value, provided as base64 encoded.
-  Must be provided if convergent encryption is enabled for this key and the key
-  was generated with Vault 0.6.1. Not required for keys created in 0.6.2+. The
-  value must be exactly 96 bits (12 bytes) long and the user must ensure that
-  for any given context (and thus, any given encryption key) this nonce value is
-  **never reused**.
-
-- `bits` `(int: 256)` – Specifies the number of bits in the desired key. Can be
-  128, 256, or 512.
-
-### Sample payload
-
-```json
-{
-  "context": "Ab3=="
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/datakey/plaintext/my-key
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "plaintext": "dGhlIHF1aWNrIGJyb3duIGZveAo=",
-    "ciphertext": "vault:v1:abcdefgh"
-  }
-}
-```
-
-## Generate random bytes
-
-This endpoint returns high-quality random bytes of the specified length.
-
-| Method | Path                                 |
-| :----- | :----------------------------------- |
-| `POST` | `/transit/random(/:source)(/:bytes)` |
-
-### Parameters
-
-- `bytes` `(int: 32)` – Specifies the number of bytes to return. This value can
-  be specified either in the request body, or as a part of the URL.
-
-- `format` `(string: "base64")` – Specifies the output encoding. Valid options
-  are `hex` or `base64`.
-
-- `source` `(string: "platform")` - Specifies the source of the requested bytes.
-  `platform`, the default, sources bytes from the platform's entropy source.
-  `seal` sources from entropy augmentation (enterprise only).
-  `all` mixes bytes from all available sources.
-
-### Sample payload
-
-```json
-{
-  "format": "hex"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/random/164
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "random_bytes": "dGhlIHF1aWNrIGJyb3duIGZveAo="
-  }
-}
-```
-
-## Hash data
-
-This endpoint returns the cryptographic hash of given data using the specified
-algorithm.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/transit/hash(/:algorithm)` |
-
-### Parameters
-
-- `algorithm` `(string: "sha2-256")` – Specifies the hash algorithm to use. This
-  can also be specified as part of the URL. Currently-supported algorithms are:
-
-  - `sha2-224`
-  - `sha2-256`
-  - `sha2-384`
-  - `sha2-512`
-  - `sha3-224`
-  - `sha3-256`
-  - `sha3-384`
-  - `sha3-512`
-
-  ~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-     and thus should not be used: `sha3-224`, `sha3-256`, `sha3-384`, and
-     `sha3-512`.
-
-- `input` `(string: <required>)` – Specifies the **base64 encoded** input data.
-
-- `format` `(string: "hex")` – Specifies the output encoding. This can be either
-  `hex` or `base64`.
-
-### Sample payload
-
-```json
-{
-  "input": "adba32=="
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/hash/sha2-512
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "sum": "dGhlIHF1aWNrIGJyb3duIGZveAo="
-  }
-}
-```
-
-## Generate HMAC
-
-This endpoint returns the digest of given data using the specified hash
-algorithm and the named key. The key can be of any type supported by `transit`,
-as each `transit` key version has an independent, random 256-bit HMAC secret key. If
-the key is of a type that supports rotation, the latest (current) version will
-be used.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `POST` | `/transit/hmac/:name(/:algorithm)` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  generate hmac against. This is specified as part of the URL.
-
-- `key_version` `(int: 0)` – Specifies the version of the key to use for the
-  operation. If not set, uses the latest version. Must be greater than or equal
-  to the key's `min_encryption_version`, if set.
-
-- `algorithm` `(string: "sha2-256")` – Specifies the hash algorithm to use. This
-  can also be specified as part of the URL. Currently-supported algorithms are:
-
-  - `sha2-224`
-  - `sha2-256`
-  - `sha2-384`
-  - `sha2-512`
-  - `sha3-224`
-  - `sha3-256`
-  - `sha3-384`
-  - `sha3-512`
-
-  ~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-     and thus should not be used: `sha3-224`, `sha3-256`, `sha3-384`, and
-     `sha3-512`.
-
-- `input` `(string: "")` – Specifies the **base64 encoded** input data. One of
-  `input` or `batch_input` must be supplied.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` – Specifies a list of items for processing.
-  When this parameter is set, if the parameter 'input' is also set, it will be
-  ignored. Responses are returned in the 'batch_results' array component of the
-  'data' element of the response. Any batch output will preserve the order of
-  the batch input. If the input data value of an item is invalid, the
-  corresponding item in the 'batch_results' will have the key 'error' with a value
-  describing the error. The format for batch_input is:
-
-  ```json
-  {
-    "batch_input": [
-      {
-        "input": "adba32=="
-      },
-      {
-        "input": "aGVsbG8gd29ybGQuCg=="
-      }
-    ]
-  }
-  ```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/hmac/my-key/sha2-512
-```
-
-### Sample payload
-
-```json
-{
-  "input": "adba32=="
-}
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "hmac": "dGhlIHF1aWNrIGJyb3duIGZveAo="
-  }
-}
-```
-
-### Sample payload with batch_input
-
-```json
-{
-  "batch_input": [
-    {
-      "input": "adba32=="
-    },
-    {
-      "input": "adba32=="
-    },
-    {},
-    {
-      "input": ""
-    }
-  ]
-}
-```
-
-### Sample response for batch_input
-
-```json
-{
-  "data": {
-    "batch_results": [
-      {
-        "hmac": "vault:v1:1jFhRYWHiddSKgEFyVRpX8ieX7UU+748NBwHKecXE3hnGBoAxrfgoD5U0yAvji7b5X6V1fP"
-      },
-      {
-        "hmac": "vault:v1:1jFhRYWHiddSKgEFyVRpX8ieX7UU+748NBwHKecXE3hnGBoAxrfgoD5U0yAvji7b5X6V1fP"
-      },
-      {
-        "error": "missing input for HMAC"
-      },
-      {
-        "hmac": "vault:v1:/wsSP6iQ9ECO9RRkefKLXey9sDntzSjoiW0vBrWfUsYB0ISroyC6plUt/jN7gcOv9O+Ecow"
-      }
-    ]
-  }
-}
-```
-
-## Sign data
-
-This endpoint returns the cryptographic signature of the given data using the
-named key and the specified hash algorithm. The key must be of a type that
-supports signing.
-
-| Method | Path                                    |
-| :----- | :-------------------------------------- |
-| `POST` | `/transit/sign/:name(/:hash_algorithm)` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key to
-  use for signing. This is specified as part of the URL.
-
-- `key_version` `(int: 0)` – Specifies the version of the key to use for
-  signing. If not set, uses the latest version. Must be greater than or equal
-  to the key's `min_encryption_version`, if set.
-
-- `hash_algorithm` `(string: "sha2-256")` – Specifies the hash algorithm to use for
-  supporting key types (notably, not including `ed25519` which specifies its
-  own hash algorithm). This can also be specified as part of the URL.
-  Currently-supported algorithms are:
-
-  - `sha1`
-  - `sha2-224`
-  - `sha2-256`
-  - `sha2-384`
-  - `sha2-512`
-  - `sha3-224`
-  - `sha3-256`
-  - `sha3-384`
-  - `sha3-512`
-  - `none`
-
-  ~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-     and thus should not be used: `sha3-224`, `sha3-256`, `sha3-384`, and
-     `sha3-512`.
-
-  ~> ** Warning:** `sha1` should be considered a compromised algorithm and used
-  only for legacy applications. Signing using SHA-1 can be blocked by operators by
-  assigning the following policy corresponding to a named key:
-
-  ```hcl
-  path "/transit/sign/:name/sha1" {
-    capabilities = ["deny"]
-  }
-  ```
-
-  ~> **Note**: using `hash_algorithm=none` requires setting `prehashed=true`
-     and `signature_algorithm=pkcs1v15`. This generates a `PKCSv1_5_NoOID`
-     signature rather than the `PKCSv1_5_DERnull` signature type usually
-     created. See [RFC 3447 Section 9.2](https://www.rfc-editor.org/rfc/rfc3447#section-9.2).
-
-- `input` `(string: "")` – Specifies the **base64 encoded** input data. One of
-  `input` or `batch_input` must be supplied.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` – Specifies a list of items for processing.
-  When this parameter is set, any supplied 'input' or 'context' parameters will be
-  ignored. Responses are returned in the 'batch_results' array component of the
-  'data' element of the response. Any batch output will preserve the order of the
-  batch input. If the input data value of an item is invalid, the
-  corresponding item in the 'batch_results' will have the key 'error' with a value
-  describing the error. The format for batch_input is:
-
-  ```json
-  {
-    "batch_input": [
-      {
-        "input": "adba32==",
-        "context": "abcd"
-      },
-      {
-        "input": "aGVsbG8gd29ybGQuCg==",
-        "context": "efgh"
-      }
-    ]
-  }
-  ```
-
-- `context` `(string: "")` - Base64 encoded context for key derivation.
-  Required if key derivation is enabled; currently only available with ed25519
-  keys.
-
-- `prehashed` `(bool: false)` - Set to `true` when the input is already hashed.
-  If the key type is `rsa-2048`, `rsa-3072` or `rsa-4096`, then the algorithm used to hash
-  the input should be indicated by the `hash_algorithm` parameter. Just as the
-  value to sign should be the base64-encoded representation of the exact binary
-  data you want signed, when set, `input` is expected to be base64-encoded
-  binary hashed data, not hex-formatted. (As an example, on the command line,
-  you could generate a suitable input via `openssl dgst -sha256 -binary | base64`.)
-
-- `signature_algorithm` `(string: "pss")` – When using a RSA key, specifies the RSA
-  signature algorithm to use for signing. Supported signature types are:
-
-  - `pss`
-  - `pkcs1v15`
-
-- `marshaling_algorithm` `(string: "asn1")` – Specifies the way in which the signature should be marshaled. This currently only applies to ECDSA keys. Supported types are:
-
-  - `asn1`: The default, used by OpenSSL and X.509
-  - `jws`: The version used by JWS (and thus for JWTs). Selecting this will
-    also change the output encoding to URL-safe Base64 encoding instead of
-    standard Base64-encoding.
-
-- `salt_length` `(string: "auto")` – The salt length used to sign. This currently only applies to the RSA PSS signature scheme. Options are:
-
-  - `auto`: The default used by Golang (causing the salt to be as large as possible when signing)
-  - `hash`: Causes the salt length to equal the length of the hash used in the signature
-  - An integer between the minimum and the maximum permissible salt lengths for the given RSA key size.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/sign/my-key/sha2-512
-```
-
-### Sample payload
-
-```json
-{
-  "input": "adba32=="
-}
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "signature": "vault:v1:MEUCIQCyb869d7KWuA0hBM9b5NJrmWzMW3/pT+0XYCM9VmGR+QIgWWF6ufi4OS2xo1eS2V5IeJQfsi59qeMWtgX0LipxEHI="
-  }
-}
-```
-
-### Sample payload with batch_input
-
-Given an ed25519 key with derived keys set, the context parameter is expected for each batch_input item, and
-the response will include the derived public key for each item.
-
-```
-{
-  "batch_input": [
-    {
-      "input": "adba32==",
-      "context": "efgh"
-    },
-    {
-      "input": "adba32==",
-      "context": "abcd"
-    },
-    {}
-  ]
-}
-```
-
-### Sample response for batch_input
-
-```
-{
-  "data": {
-    "batch_results": [
-      {
-        "signature": "vault:v1:+R3cxAy6j4KriYzAyExU6p1glnyT/eLDSaUZO7gr8a8kgi/zSynNbOBSDJcGaAfLD1OF2hGupYBYTjmZMNoVAA==",
-        "publickey": "2fQIaaem7+EhSGs3jUebAS/8qP2+sUrmxOmgqZIZc0c="
-      },
-      {
-        "signature": "vault:v1:3hBwA88lnuAVJqb5rCCEstzKYaBTeSdejk356BTCE/nKwySOhzQH3mWCvJZwbRptNGa7ia5ykosYYdJz+aIKDA==",
-        "publickey": "goDXuePo7L9z6HOw+a54O4HeV189BLECK9nAUudwp4Y="
-      },
-      {
-        "error": "missing input"
-      }
-    ]
-  },
-}
-```
-
-## Verify signed data
-
-This endpoint returns whether the provided signature is valid for the given
-data.
-
-| Method | Path                                      |
-| :----- | :---------------------------------------- |
-| `POST` | `/transit/verify/:name(/:hash_algorithm)` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the encryption key that
-  was used to generate the signature or HMAC.
-
-- `hash_algorithm` `(string: "sha2-256")` – Specifies the hash algorithm to use. This
-  can also be specified as part of the URL. Currently-supported algorithms are:
-
-  - `sha1`
-  - `sha2-224`
-  - `sha2-256`
-  - `sha2-384`
-  - `sha2-512`
-  - `sha3-224`
-  - `sha3-256`
-  - `sha3-384`
-  - `sha3-512`
-  - `none`
-
-  ~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-     and thus should not be used: `sha3-224`, `sha3-256`, `sha3-384`, and
-     `sha3-512`.
-
-  ~> ** Warning:** `sha1` should be considered a compromised algorithm. Signatures
-  verified using the algorithm could be forgeries. Verification using SHA-1 can
-  be blocked by operators by assigning the following policy corresponding to a
-  named key:
-
-  ```hcl
-  path "/transit/verify/:name/sha1" {
-    capabilities = ["deny"]
-  }
-  ```
-
-  ~> **Note**: using `hash_algorithm=none` requires setting `prehashed=true`
-     and `signature_algorithm=pkcs1v15`. This verifies a `PKCSv1_5_NoOID`
-     signature rather than the `PKCSv1_5_DERnull` signature type usually
-     verified. See [RFC 3447 Section 9.2](https://www.rfc-editor.org/rfc/rfc3447#section-9.2).
-
-- `input` `(string: "")` – Specifies the **base64 encoded** input data. One of
-  `input` or `batch_input` must be supplied.
-
-- `signature` `(string: "")` – Specifies the signature output from the
-  `/transit/sign` function. Either this must be supplied or `hmac` must be
-  supplied.
-
-- `hmac` `(string: "")` – Specifies the signature output from the
-  `/transit/hmac` function. Either this must be supplied or `signature` must be
-  supplied.
-
-- `reference` `(string: "")` -
-  A user-supplied string that will be present in the `reference` field on the
-  corresponding `batch_results` item in the response, to assist in understanding
-  which result corresponds to a particular input. Only valid on batch requests
-  when using ‘batch_input’ below.
-
-- `batch_input` `(array<object>: nil)` – Specifies a list of items for processing.
-  When this parameter is set, any supplied 'input', 'hmac' or 'signature' parameters
-  will be ignored. 'batch_input' items should contain an 'input' parameter and
-  either an 'hmac' or 'signature' parameter. All items in the batch must consistently
-  supply either 'hmac' or 'signature' parameters. It is an error for some items to
-  supply 'hmac' while others supply 'signature'. Responses are returned in the
-  'batch_results' array component of the 'data' element of the response. Any batch
-  output will preserve the order of the batch input. If the input data value of an
-  item is invalid, the corresponding item in the 'batch_results' will have the key
-  'error' with a value describing the error. The format for batch_input is:
-
-  ```json
-  {
-    "batch_input": [
-      {
-        "input": "adba32==",
-        "hmac": "vault:v1:1jFhRYWHiddSKgEFyVRpX8ieX7UU+748NBwHKecXE3hnGBoAxrfgoD5U0yAvji7b5X6V1fP"
-      },
-      {
-        "input": "aGVsbG8gd29ybGQuCg==",
-        "hmac": "vault:v1:/wsSP6iQ9ECO9RRkefKLXey9sDntzSjoiW0vBrWfUsYB0ISroyC6plUt/jN7gcOv9O+Ecow"
-      }
-    ]
-  }
-  ```
-
-- `context` `(string: "")` - Base64 encoded context for key derivation.
-  Required if key derivation is enabled; currently only available with ed25519
-  keys.
-
-- `prehashed` `(bool: false)` - Set to `true` when the input is already
-  hashed. If the key type is `rsa-2048`, `rsa-3072` or `rsa-4096`, then the algorithm used
-  to hash the input should be indicated by the `hash_algorithm` parameter.
-
-- `signature_algorithm` `(string: "pss")` – When using a RSA key, specifies the RSA
-  signature algorithm to use for signature verification. Supported signature types
-  are:
-
-  - `pss`
-  - `pkcs1v15`
-
-- `marshaling_algorithm` `(string: "asn1")` – Specifies the way in which the signature was originally marshaled. This currently only applies to ECDSA keys. Supported types are:
-
-  - `asn1`: The default, used by OpenSSL and X.509
-  - `jws`: The version used by JWS (and thus for JWTs). Selecting this will
-    also expect the input encoding to URL-safe Base64 encoding instead of
-    standard Base64-encoding.
-
-- `salt_length` `(string: "auto")` – The salt length used to sign. This currently only applies to the RSA PSS signature scheme. Options are:
-
-  - `auto`: The default used by Golang (causing the salt to be as large as possible when signing)
-  - `hash`: Causes the salt length to equal the length of the hash used in the signature
-  - An integer between the minimum and the maximum permissible salt lengths for the given RSA key size.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/verify/my-key/sha2-512
-```
-
-### Sample payload
-
-```json
-{
-  "input": "abcd13==",
-  "signature": "vault:v1:MEUCIQCyb869d7KWuA..."
-}
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "valid": true
-  }
-}
-```
-
-### Sample payload with batch_input
-
-```
-{
-  "batch_input": [
-    {
-      "input": "adba32==",
-      "context": "abcd",
-      "signature": "vault:v1:3hBwA88lnuAVJqb5rCCEstzKYaBTeSdejk356BTCE/nKwySOhzQH3mWCvJZwbRptNGa7ia5ykosYYdJz+aIKDA=="
-    },
-    {
-      "input": "adba32==",
-      "context": "efgh",
-      "signature": "vault:v1:3hBwA88lnuAVJqb5rCCEstzKYaBTeSdejk356BTCE/nKwySOhzQH3mWCvJZwbRptNGa7ia5ykosYYdJz+aIKDA=="
-    },
-    {
-      "input": "",
-      "context": "abcd",
-      "signature": "vault:v1:C/pxm5V1RI6kqudLdbLdj5Bpm2P38FKgvxoV69oNXphvJukRcQIqjZO793jCa2JPYPG21Y7vquDWy/Ff4Ma4AQ=="
-    }
-  ]
-}
-```
-
-### Sample response for batch_input
-
-```
-{
-  "data": {
-    "batch_results": [
-      {
-        "valid": true
-      },
-      {
-        "valid": false
-      },
-      {
-        "valid": true
-      }
-    ]
-  },
-}
-```
-
-## Backup key
-
-This endpoint returns a plaintext backup of a named key. The backup contains all
-the configuration data and keys of all the versions along with the HMAC key.
-The response from this endpoint can be used with the `/restore` endpoint to
-restore the key.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/transit/backup/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the key.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/transit/backup/aes
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "backup": "eyJwb2xpY3kiOnsibmFtZSI6ImFlcyIsImtleXMiOnsiMSI6eyJrZXkiOiJXK3k4Z0dOMHdiTDJLOU95NXFPN1laMGtjdzMvR0ZiNWM4STBzdlNMMnFNPSIsImhtYWNfa2V5IjoiUDBTcjh1YTJaZERNUTdPd2h4RGp1Z0U5d0JSR3Q2QXl6K0t4TzN5Z2M5ST0iLCJ0aW1lIjoiMjAxNy0xMi0wOFQxMTo1MDowOC42MTM4MzctMDU6MDAiLCJlY194IjpudWxsLCJlY195IjpudWxsLCJlY19kIjpudWxsLCJyc2Ffa2V5IjpudWxsLCJwdWJsaWNfa2V5IjoiIiwiY3JlYXRpb25fdGltZSI6MTUxMjc1MTgwOH19LCJkZXJpdmVkIjpmYWxzZSwia2RmIjowLCJjb252ZXJnZW50X2VuY3J5cHRpb24iOmZhbHNlLCJleHBvcnRhYmxlIjpmYWxzZSwibWluX2RlY3J5cHRpb25fdmVyc2lvbiI6MSwibWluX2VuY3J5cHRpb25fdmVyc2lvbiI6MCwibGF0ZXN0X3ZlcnNpb24iOjEsImFyY2hpdmVfdmVyc2lvbiI6MSwiZGVsZXRpb25fYWxsb3dlZCI6ZmFsc2UsImNvbnZlcmdlbnRfdmVyc2lvbiI6MCwidHlwZSI6MCwiYmFja3VwX2luZm8iOnsidGltZSI6IjIwMTctMTItMDhUMTE6NTA6MjkuMjI4MTU3LTA1OjAwIiwidmVyc2lvbiI6MX0sInJlc3RvcmVfaW5mbyI6bnVsbH0sImFyY2hpdmVkX2tleXMiOnsia2V5cyI6W3sia2V5IjpudWxsLCJobWFjX2tleSI6bnVsbCwidGltZSI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIiwiZWNfeCI6bnVsbCwiZWNfeSI6bnVsbCwiZWNfZCI6bnVsbCwicnNhX2tleSI6bnVsbCwicHVibGljX2tleSI6IiIsImNyZWF0aW9uX3RpbWUiOjB9LHsia2V5IjoiVyt5OGdHTjB3YkwySzlPeTVxTzdZWjBrY3czL0dGYjVjOEkwc3ZTTDJxTT0iLCJobWFjX2tleSI6IlAwU3I4dWEyWmRETVE3T3doeERqdWdFOXdCUkd0NkF5eitLeE8zeWdjOUk9IiwidGltZSI6IjIwMTctMTItMDhUMTE6NTA6MDguNjEzODM3LTA1OjAwIiwiZWNfeCI6bnVsbCwiZWNfeSI6bnVsbCwiZWNfZCI6bnVsbCwicnNhX2tleSI6bnVsbCwicHVibGljX2tleSI6IiIsImNyZWF0aW9uX3RpbWUiOjE1MTI3NTE4MDh9XX19Cg=="
-  }
-}
-```
-
-## Restore key
-
-This endpoint restores the backup as a named key. This will restore the key
-configurations and all the versions of the named key along with HMAC keys. The
-input to this endpoint should be the output of `/backup` endpoint.
-
-~> For safety, by default the backend will refuse to restore to an existing
-key. If you want to reuse a key name, it is recommended you delete the key
-before restoring. It is a good idea to attempt restoring to a different key
-name first to verify that the operation successfully completes.
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `POST` | `/transit/restore(/:name)` |
-
-### Parameters
-
-- `backup` `(string: <required>)` - Backed up key data to be restored. This
-  should be the output from the `/backup` endpoint.
-
-- `name` `(string: <optional>)` - If set, this will be the name of the
-  restored key.
-
-- `force` `(bool: false)` - If set, force the restore to proceed even if a key
-  by this name already exists.
-
-### Sample payload
-
-```json
-{
-    "backup": "eyJwb2xpY3kiOnsibmFtZSI6ImFlcyIsImtleXMiOnsiMSI6eyJrZXkiOiJXK3k4Z0dOMHdiTDJLOU95NXFPN1laMGtjdzMvR0ZiNWM4STBzdlNMMnFNPSIsImhtYWNfa2V5IjoiUDBTcjh1YTJaZERNUTdPd2h4RGp1Z0U5d0JSR3Q2QXl6K0t4TzN5Z2M5ST0iLCJ0aW1lIjoiMjAxNy0xMi0wOFQxMTo1MDowOC42MTM4MzctMDU6MDAiLCJlY194IjpudWxsLCJlY195IjpudWxsLCJlY19kIjpudWxsLCJyc2Ffa2V5IjpudWxsLCJwdWJsaWNfa2V5IjoiIiwiY3JlYXRpb25fdGltZSI6MTUxMjc1MTgwOH19LCJkZXJpdmVkIjpmYWxzZSwia2RmIjowLCJjb252ZXJnZW50X2VuY3J5cHRpb24iOmZhbHNlLCJleHBvcnRhYmxlIjpmYWxzZSwibWluX2RlY3J5cHRpb25fdmVyc2lvbiI6MSwibWluX2VuY3J5cHRpb25fdmVyc2lvbiI6MCwibGF0ZXN0X3ZlcnNpb24iOjEsImFyY2hpdmVfdmVyc2lvbiI6MSwiZGVsZXRpb25fYWxsb3dlZCI6ZmFsc2UsImNvbnZlcmdlbnRfdmVyc2lvbiI6MCwidHlwZSI6MCwiYmFja3VwX2luZm8iOnsidGltZSI6IjIwMTctMTItMDhUMTE6NTA6MjkuMjI4MTU3LTA1OjAwIiwidmVyc2lvbiI6MX0sInJlc3RvcmVfaW5mbyI6bnVsbH0sImFyY2hpdmVkX2tleXMiOnsia2V5cyI6W3sia2V5IjpudWxsLCJobWFjX2tleSI6bnVsbCwidGltZSI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIiwiZWNfeCI6bnVsbCwiZWNfeSI6bnVsbCwiZWNfZCI6bnVsbCwicnNhX2tleSI6bnVsbCwicHVibGljX2tleSI6IiIsImNyZWF0aW9uX3RpbWUiOjB9LHsia2V5IjoiVyt5OGdHTjB3YkwySzlPeTVxTzdZWjBrY3czL0dGYjVjOEkwc3ZTTDJxTT0iLCJobWFjX2tleSI6IlAwU3I4dWEyWmRETVE3T3doeERqdWdFOXdCUkd0NkF5eitLeE8zeWdjOUk9IiwidGltZSI6IjIwMTctMTItMDhUMTE6NTA6MDguNjEzODM3LTA1OjAwIiwiZWNfeCI6bnVsbCwiZWNfeSI6bnVsbCwiZWNfZCI6bnVsbCwicnNhX2tleSI6bnVsbCwicHVibGljX2tleSI6IiIsImNyZWF0aW9uX3RpbWUiOjE1MTI3NTE4MDh9XX19Cg=="
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/restore
-```
-
-## Trim key
-
-This endpoint trims older key versions setting a minimum version for the
-keyring. Once trimmed, previous versions of the key cannot be recovered.
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `POST` | `/transit/keys/:name/trim` |
-
-### Parameters
-
-- `min_available_version` `(int: <required>)` - The minimum available version
-  for the key ring. All versions before this version will be permanently
-  deleted. This value can at most be equal to the lesser of
-  `min_decryption_version` and `min_encryption_version`. This is not allowed to
-  be set when either `min_encryption_version` or `min_decryption_version` is set
-  to zero.
-
-### Sample payload
-
-```json
-{
-  "min_available_version": 2
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/keys/my-key/trim
-```
-
-## Configure cache
-
-This endpoint is used to configure the transit engine's cache. Note that configuration
-changes will not be applied until the transit plugin is reloaded which can be achieved
-using the [`/sys/plugins/reload/backend`][sys-plugin-reload-backend] endpoint.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/transit/cache-config` |
-
-### Parameters
-
-- `size` `(int: 0)` - Specifies the size in terms of number of entries. A size of
-  `0` means unlimited. A _Least Recently Used_ (LRU) caching strategy is used for a
-  non-zero cache size. Must be 0 (default) or a value greater or equal to 10 (minimum cache size).
-
-### Sample payload
-
-```json
-{
-  "size": 456
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..."
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/transit/cache-config
-```
-
-## Read transit cache configuration
-
-This endpoint retrieves configurations for the transit engine's cache.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/transit/cache-config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..."
-    --request GET \
-    http://127.0.0.1:8200/v1/transit/cache-config
-```
-
-### Sample response
-
-```json
-  "data": {
-    "size": 0
-  },
-```
-
-## Managed keys <EnterpriseAlert inline="true" />
-
-Managed Keys can be used with the Transit Secrets Engine to perform cryptographic operations. Currently,
-[Sign Data](#sign-data) and [Verify Signed Data](#verify-signed-data) are well-supported across all the managed key types.
-
-Only PKCS#11 managed keys support [Encrypt Data](#encrypt-data) and [Decrypt Data](#decrypt-data) operations at this time. We
-are planning on adding support for AWS, GCP and Azure managed keys at a later time.
-
-When a Transit key is created of type `managed_key`, Transit will look up the key by name or ID, and will
-attempt to generate the key when key generation is allowed (as specified when the [Create/Update Managed Key](/vault/api-docs/system/managed-keys#create-update-managed-key)
-endpoint is called). Key generation is currently supported for cloud KMSes and for certain PKCS#11 mechanisms
-on HSMs. This is a best effort operation, so certain KMS/HSM/key configurations will require the key to exist
-externally prior to use with Transit.
-
-For key types and mechanisms that require an IV, this value can be provided via the `nonce` parameter of
-the [Encrypt Data](#encrypt-data) and [Decrypt Data](#decrypt-data) endpoints.
-
-Signing and verifying data with a Managed Key through Transit may require pre-hashing of the data. Transit
-can be informed that data is pre-hashed with the `prehashed` parameter of the [Sign Data](#sign-data) and
-[Verify Signed Data](#verify-signed-data) endpoints.
-
diff --git a/website/content/api-docs/system/audit-hash.mdx b/website/content/api-docs/system/audit-hash.mdx
deleted file mode 100644
index 59b24a60223..00000000000
--- a/website/content/api-docs/system/audit-hash.mdx
+++ /dev/null
@@ -1,64 +0,0 @@
----
-layout: api
-page_title: /sys/audit-hash - HTTP API
-description: |-
-  The `/sys/audit-hash` endpoint is used to hash data using an audit device's
-  hash function and salt.
----
-
-# `/sys/audit-hash`
-
-@include 'alerts/restricted-admin.mdx'
-
-The `/sys/audit-hash` endpoint is used to calculate the hash of the data used by
-an audit device's hash function and salt. This can be used to search audit logs
-for a hashed value when the original value is known.
-
-## Calculate hash
-
-This endpoint hashes the given input data with the specified audit device's
-hash function and salt. This endpoint can be used to discover whether a given
-plaintext string (the `input` parameter) appears in the audit log in obfuscated
-form.
-
-The audit log records requests and responses. Since the Vault API is JSON-based,
-any binary data returned from an API call (such as a DER-format certificate) is
-base64-encoded by the Vault server in the response. As a result such information
-should also be base64-encoded to supply into the `input` parameter.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/sys/audit-hash/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the audit device to
-  generate hashes for. This is part of the request URL.
-
-- `input` `(string: <required>)` – Specifies the input string to hash.
-
-### Sample payload
-
-```json
-{
-  "input": "my-secret-vault"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/audit-hash/example-audit
-```
-
-### Sample response
-
-```json
-{
-  "hash": "hmac-sha256:08ba35..."
-}
-```
diff --git a/website/content/api-docs/system/audit.mdx b/website/content/api-docs/system/audit.mdx
deleted file mode 100644
index 89616162648..00000000000
--- a/website/content/api-docs/system/audit.mdx
+++ /dev/null
@@ -1,136 +0,0 @@
----
-layout: api
-page_title: /sys/audit - HTTP API
-description: The `/sys/audit` endpoint is used to enable and disable audit devices.
----
-
-# `/sys/audit`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/audit` endpoint is used to list, enable, and disable audit devices.
-Audit devices must be enabled before use, and more than one device may be
-enabled at a time.
-
-## List enabled audit devices
-
-This endpoint lists only the enabled audit devices (it does not list all
-available audit devices).
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path         |
-|:-------|:-------------|
-| `GET`  | `/sys/audit` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/audit
-```
-
-### Sample response
-
-```javascript
-{
-  "file": {
-    "type": "file",
-    "description": "Store logs in a file",
-    "options": {
-      "file_path": "/var/log/vault.log"
-    }
-  }
-}
-```
-
-## Enable audit device
-
-This endpoint enables a new audit device at the supplied path. The path can be a
-single word name or a more complex, nested path.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path               |
-|:-------|:-------------------|
-| `POST` | `/sys/audit/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path in which to enable the audit
-  device. This is part of the request URL.
-
-- `description` `(string: "")` – Specifies a human-friendly description of the
-  audit device.
-
-- `options` `(map<string|string>: nil)` – Specifies configuration options to pass to the audit device itself.
-  There are a set of [common options](#common-configuration-options)
-  which can be applied to all types of audit device.
-  For more details, please see the relevant page for an audit device `type`,
-  under [Audit Devices docs](/vault/docs/audit).
-
-- `type` `(string: <required>)` – Specifies the type of the audit device.
-  Valid types are `file`, `socket` and `syslog`.
-
-Additionally, the following options are allowed in Vault Community Edition, but
-relevant functionality is only supported in Vault Enterprise:
-
-- `local` `(bool: false)` – Applies exclusively to performance replication. Specifies if the audit device is local within the cluster only. Local
-  audit devices are not replicated nor (if a secondary) removed by replication.
-
-#### Common configuration options
-
-@include 'audit-options-common.mdx'
-
-### Sample payload
-
-```json
-{
-  "type": "file",
-  "options": {
-    "file_path": "/var/log/vault/log"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/audit/example-audit
-```
-
-## Disable audit device
-
-This endpoint disables the audit device at the given path.
-
-~> Note: Once an audit device is disabled, you will no longer be able to HMAC values
-for comparison with entries in the audit logs. This is true even if you re-enable
-the audit device at the same path, as a new salt will be created for hashing.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method   | Path               |
-|:---------|:-------------------|
-| `DELETE` | `/sys/audit/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the audit device to
-  delete. This is part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/audit/example-audit
-```
diff --git a/website/content/api-docs/system/auth.mdx b/website/content/api-docs/system/auth.mdx
deleted file mode 100644
index 8fded9bfc7b..00000000000
--- a/website/content/api-docs/system/auth.mdx
+++ /dev/null
@@ -1,391 +0,0 @@
----
-layout: api
-page_title: /sys/auth - HTTP API
-description: The `/sys/auth` endpoint is used to manage auth methods in Vault.
----
-
-# `/sys/auth`
-
-The `/sys/auth` endpoint is used to list, create, update, and delete auth
-methods. Auth methods convert user or machine-supplied information into a
-token which can be used for all future requests.
-
-## List auth methods
-
-This endpoint lists all enabled auth methods.
-
-| Method | Path        |
-| :----- | :---------- |
-| `GET`  | `/sys/auth` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/auth
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "9bc0fab8-d65c-3961-afe6-d05f50c5fd22",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "github/": {
-      "accessor": "auth_github_badd7fd0",
-      "config": {
-        "default_lease_ttl": 0,
-        "force_no_cache": false,
-        "max_lease_ttl": 0,
-        "token_type": "default-service"
-      },
-      "deprecation_status": "supported",
-      "description": "",
-      "external_entropy_access": false,
-      "local": false,
-      "options": null,
-      "plugin_version": "",
-      "running_plugin_version": "v1.12.0+builtin.vault",
-      "running_sha256": "",
-      "seal_wrap": false,
-      "type": "github",
-      "uuid": "4b42d1a4-0a0d-3c88-ae90-997e0c8b41be"
-    },
-    "token/": {
-      "accessor": "auth_token_bd90f507",
-      "config": {
-        "default_lease_ttl": 0,
-        "force_no_cache": false,
-        "max_lease_ttl": 0,
-        "token_type": "default-service"
-      },
-      "description": "token based credentials",
-      "external_entropy_access": false,
-      "local": false,
-      "options": null,
-      "plugin_version": "",
-      "running_plugin_version": "v1.12.0+builtin.vault",
-      "running_sha256": "",
-      "seal_wrap": false,
-      "type": "token",
-      "uuid": "e162baec-721b-7657-7913-c960df402f8a"
-    }
-  },
-  "warnings": null
-}
-```
-
-## Enable auth method
-
-This endpoint enables a new auth method. After enabling, the auth method can
-be accessed and configured via the auth path specified as part of the URL. This
-auth path will be nested under the `auth` prefix.
-
-For example, enable the "foo" auth method will make it accessible at
-`/auth/foo`.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `POST` | `/sys/auth/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path in which to enable the auth
-  method. This is part of the request URL.
-
-  !> **NOTE:** Use ASCII printable characters to specify the desired path.
-
-- `description` `(string: "")` – Specifies a human-friendly description of the
-  auth method.
-
-- `type` `(string: <required>)` – Specifies the name of the authentication
-  method type, such as "github" or "token".
-
-- `config` `(map<string|string>: nil)` – Specifies configuration options for
-  this auth method. These are the possible values:
-
-  - `default_lease_ttl` `(string: "")` - The default lease duration, specified
-    as a string duration like "5s" or "30m".
-
-  - `max_lease_ttl` `(string: "")` - The maximum lease duration, specified as a
-    string duration like "5s" or "30m".
-
-  - `audit_non_hmac_request_keys` `(array: [])` - List of keys that will not be
-    HMAC'd by audit devices in the request data object.
-
-  - `audit_non_hmac_response_keys` `(array: [])` - List of keys that will not be
-    HMAC'd by audit devices in the response data object.
-
-  - `listing_visibility` `(string: "")` - Specifies whether to show this mount
-    in the UI-specific listing endpoint. Valid values are `"unauth"` or `"hidden"`,
-    with the default `""` being equivalent to `"hidden"`.
-
-  - `passthrough_request_headers` `(array: [])` - List of headers to allow
-    and pass from the request to the plugin.
-
-  - `allowed_response_headers` `(array: [])` - List of headers to allow,
-    allowing a plugin to include them in the response.
-
-  - `plugin_version` `(string: "")` – Specifies the semantic version of the plugin
-    to use, e.g. "v1.0.0". If unspecified, the server will select any matching
-    unversioned plugin that may have been registered, the latest versioned plugin
-    registered, or a built-in plugin in that order of precedence.
-
-  - `identity_token_key` `(string: "")` - The key to use for signing plugin workload
-    identity tokens. If not provided, this will default to Vault's OIDC
-    [default key](/vault/docs/concepts/oidc-provider#keys).
-
-Additionally, the following options are allowed in Vault open-source, but
-relevant functionality is only supported in Vault Enterprise:
-
-- `local` `(bool: false)` – Specifies if the auth method is local only. Local
-  auth methods are not replicated nor (if a secondary) removed by replication.
-  Local auth mounts also generate entities for tokens issued. The entity will
-  be replicated across clusters and the aliases generated on the local auth
-  mount will be local to the cluster. If the goal of marking an auth method
-  as `local` was to comply with GDPR guidelines, then care must be taken to not
-  set the data pertaining to local auth mount or local auth mount aliases in the
-  metadata of the associated entity. Metadata related to local auth mount aliases
-  can be stored as `custom_metadata` on the alias itself which will also be
-  retained locally to the cluster.
-
-  ~> ** Warning:** Remember, policies when using replication secondaries are
-  validated by the local cluster. An administrator that can set up a local auth
-  method mount can assign policies to tokens that are valid on the replication
-  primary if a request is forwarded. Never give untrusted administrators the
-  ability to assign policies or configure authentication methods.
-
-- `seal_wrap` `(bool: false)` - Enable seal wrapping for the mount, causing
-  values stored by the mount to be wrapped by the seal's encryption capability.
-
-### Sample payload
-
-```json
-{
-  "type": "github",
-  "description": "Login with GitHub"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/auth/my-auth
-```
-
-## Read auth method configuration
-
-This endpoints returns the configuration of the auth method at the given path.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `GET`  | `/sys/auth/:path` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/auth/my-auth
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "8d2a1e33-4c00-46a5-f50d-4dc5f5d96f12",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "accessor": "auth_github_badd7fd0",
-    "config": {
-      "default_lease_ttl": 0,
-      "force_no_cache": false,
-      "max_lease_ttl": 0,
-      "token_type": "default-service"
-    },
-    "deprecation_status": "supported",
-    "description": "",
-    "external_entropy_access": false,
-    "local": false,
-    "options": null,
-    "plugin_version": "",
-    "running_plugin_version": "v1.12.0+builtin.vault",
-    "running_sha256": "",
-    "seal_wrap": false,
-    "type": "github",
-    "uuid": "4b42d1a4-0a0d-3c88-ae90-997e0c8b41be"
-  },
-  "warnings": null
-}
-```
-
-
-## Disable auth method
-
-This endpoint disables the auth method at the given auth path.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method   | Path              |
-| :------- | :---------------- |
-| `DELETE` | `/sys/auth/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path to disable. This is part of
-  the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/auth/my-auth
-```
-
-## Read auth method tuning
-
-- This endpoint reads the given auth path's configuration. This endpoint requires
-`sudo` capability on the final path, but the same functionality can be achieved
-without `sudo` via `sys/mounts/auth/[auth-path]/tune`._
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/sys/auth/:path/tune` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path in which to tune.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/auth/my-auth/tune
-```
-
-### Sample response
-
-```json
-{
-  "default_lease_ttl": 2764800,
-  "description": "",
-  "force_no_cache": false,
-  "max_lease_ttl": 2764800,
-  "token_type": "default-service"
-}
-```
-
-## Tune auth method
-
-Tune configuration parameters for a given auth path. _This endpoint
-requires `sudo` capability on the final path, but the same functionality
-can be achieved without `sudo` via `sys/mounts/auth/[auth-path]/tune`._
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/sys/auth/:path/tune` |
-
-### Parameters
-
-- `default_lease_ttl` `(int: 0)` – Specifies the default time-to-live. If set on
-  a specific auth path, this overrides the global default.
-
-- `max_lease_ttl` `(int: 0)` – Specifies the maximum time-to-live. If set on a
-  specific auth path, this overrides the global default.
-
-- `description` `(string: "")` – Specifies the description of the mount. This
-  overrides the current stored value, if any.
-
-- `audit_non_hmac_request_keys` `(array: [])` - Specifies the list of keys
-  that will not be HMAC'd by audit devices in the request data object.
-
-- `audit_non_hmac_response_keys` `(array: [])` - Specifies the list of keys
-  that will not be HMAC'd by audit devices in the response data object.
-
-- `listing_visibility` `(string: "")` - Specifies whether to show this mount
-  in the UI-specific listing endpoint. Valid values are `"unauth"` or `"hidden"`,
-  with the default `""` being equivalent to `"hidden"`.
-
-- `passthrough_request_headers` `(array: [])` - List of headers to allow
-  and pass from the request to the plugin.
-
-- `allowed_response_headers` `(array: [])` - List of headers to allow,
-  allowing a plugin to include them in the response.
-
-- `token_type` `(string: "")` – Specifies the type of tokens that should be
-  returned by the mount. The following values are available:
-
-  - `default-service`: Unless the auth method requests a different type, issue
-    service tokens
-  - `default-batch`: Unless the auth method requests a different type, issue
-    batch tokens
-  - `service`: Override any auth method preference and always issue service
-    tokens from this mount
-  - `batch`: Override any auth method preference and always issue batch tokens
-    from this mount
-
-- `plugin_version` `(string: "")` – Specifies the semantic version of the plugin
-  to use, e.g. "v1.0.0". Changes will not take effect until the mount is reloaded.
-
-- `user_lockout_config` `(map<string|string>: nil)` – Specifies the user lockout configuration
-  for the mount. User lockout feature was added in Vault 1.13. These are the possible values:
-
-  - `lockout_threshold` `(string: "")` - Specifies the number of failed login attempts after
-    which the user is locked out, specified as a string like "15".
-
-  - `lockout_duration` `(string: "")` - Specifies the duration for which an user will be locked out,
-    specified as a string duration like "5s" or "30m".
-
-  - `lockout_counter_reset` `(string: "")` - Specifies the duration after which the lockout counter is
-    reset with no failed login attempts, specified as a string duration like "5s" or "30m".
-
-  - `lockout_disable` `(bool: false)` - Disables the user lockout feature for this mount
-     if set to true.
-
-### Sample payload
-
-```json
-{
-  "default_lease_ttl": 1800,
-  "max_lease_ttl": 86400,
-  "audit_non_hmac_request_keys": ["client_nonce"],
-  "user_lockout_config":{
-    "lockout_threshold":"20",
-    "lockout_duration":"5m",
-    "lockout_counter_reset":"5m"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/auth/my-auth/tune
-```
diff --git a/website/content/api-docs/system/capabilities-accessor.mdx b/website/content/api-docs/system/capabilities-accessor.mdx
deleted file mode 100644
index ed53ebec286..00000000000
--- a/website/content/api-docs/system/capabilities-accessor.mdx
+++ /dev/null
@@ -1,62 +0,0 @@
----
-layout: api
-page_title: /sys/capabilities-accessor - HTTP API
-description: |-
-  The `/sys/capabilities-accessor` endpoint is used to fetch the capabilities of
-  the token associated with an accessor, on the given paths.
----
-
-# `/sys/capabilities-accessor`
-
-The `/sys/capabilities-accessor` endpoint is used to fetch the capabilities of
-the token associated with the given accessor. The capabilities returned will be
-derived from the policies that are on the token, and from the policies to which
-the token is entitled to through the entity and entity's group memberships.
-
-## Query token accessor capabilities
-
-This endpoint returns the capabilities of the token associated with the given
-accessor, for the given path. Multiple paths are taken in at once and the
-capabilities of the token associated with the given accessor for each path is
-returned. For backwards compatibility, if a single path is supplied, a
-`capabilities` field will also be returned.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/sys/capabilities-accessor` |
-
-### Parameters
-
-- `accessor` `(string: <required>)` – Accessor of the token for which
-  capabilities are being queried.
-
-- `paths` `(list: <required>)` – Paths on which capabilities are being
-  queried.
-
-### Sample payload
-
-```json
-{
-  "accessor": "abcd1234",
-  "paths": ["secret/foo"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/capabilities-accessor
-```
-
-### Sample response
-
-```json
-{
-  "capabilities": ["delete", "list", "read", "update"],
-  "secret/foo": ["delete", "list", "read", "update"]
-}
-```
diff --git a/website/content/api-docs/system/capabilities-self.mdx b/website/content/api-docs/system/capabilities-self.mdx
deleted file mode 100644
index 1fb0eb7cf63..00000000000
--- a/website/content/api-docs/system/capabilities-self.mdx
+++ /dev/null
@@ -1,58 +0,0 @@
----
-layout: api
-page_title: /sys/capabilities-self - HTTP API
-description: |-
-  The `/sys/capabilities-self` endpoint is used to fetch the capabilities of
-  client token on the given paths.
----
-
-# `/sys/capabilities-self`
-
-The `/sys/capabilities-self` endpoint is used to fetch the capabilities of the
-token used to make the API call, on the given paths. The capabilities returned
-will be derived from the policies that are on the token, and from the policies
-to which the token is entitled to through the entity and entity's group
-memberships.
-
-## Query self capabilities
-
-This endpoint returns the capabilities of client token on the given paths. The
-client token is the Vault token with which this API call is made. Multiple
-paths are taken in at once and the capabilities of the token for each path is
-returned. For backwards compatibility, if a single path is supplied, a
-`capabilities` field will also be returned.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/sys/capabilities-self` |
-
-### Parameters
-
-- `paths` `(list: <required>)` – Paths on which capabilities are being queried.
-
-### Sample payload
-
-```json
-{
-  "paths": ["secret/foo"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/capabilities-self
-```
-
-### Sample response
-
-```json
-{
-  "capabilities": ["delete", "list", "read", "update"],
-  "secret/foo": ["delete", "list", "read", "update"]
-}
-```
diff --git a/website/content/api-docs/system/capabilities.mdx b/website/content/api-docs/system/capabilities.mdx
deleted file mode 100644
index db06f118103..00000000000
--- a/website/content/api-docs/system/capabilities.mdx
+++ /dev/null
@@ -1,60 +0,0 @@
----
-layout: api
-page_title: /sys/capabilities - HTTP API
-description: |-
-  The `/sys/capabilities` endpoint is used to fetch the capabilities of a token
-  on the given paths.
----
-
-# `/sys/capabilities`
-
-The `/sys/capabilities` endpoint is used to fetch the capabilities of a token
-on the given paths. The capabilities returned will be derived from the policies
-that are on the token, and from the policies to which the token is entitled to
-through the entity and entity's group memberships.
-
-## Query token capabilities
-
-This endpoint returns the list of capabilities of a given token on the given
-paths. Multiple paths are taken in at once and the capabilities of the token
-for each path is returned. For backwards compatibility, if a single path is
-supplied, a `capabilities` field will also be returned.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/sys/capabilities` |
-
-### Parameters
-
-- `paths` `(list: <required>)` – Paths on which capabilities are being queried.
-
-- `token` `(string: <required>)` – Token for which capabilities are being
-  queried.
-
-### Sample payload
-
-```json
-{
-  "token": "abcd1234",
-  "paths": ["secret/foo"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/capabilities
-```
-
-### Sample response
-
-```json
-{
-  "capabilities": ["delete", "list", "read", "update"],
-  "secret/foo": ["delete", "list", "read", "update"]
-}
-```
diff --git a/website/content/api-docs/system/config-auditing.mdx b/website/content/api-docs/system/config-auditing.mdx
deleted file mode 100644
index a06bac7ba1a..00000000000
--- a/website/content/api-docs/system/config-auditing.mdx
+++ /dev/null
@@ -1,130 +0,0 @@
----
-layout: api
-page_title: /sys/config/auditing - HTTP API
-description: The `/sys/config/auditing` endpoint is used to configure auditing settings.
----
-
-# `/sys/config/auditing/request-headers`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/config/auditing` endpoint is used to configure auditing settings.
-
-## Read all audited request headers
-
-This endpoint lists the request headers that are configured to be audited.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path                                   |
-| :----- | :------------------------------------- |
-| `GET`  | `/sys/config/auditing/request-headers` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/config/auditing/request-headers
-```
-
-### Sample response
-
-```json
-{
-  "headers": {
-    "X-Forwarded-For": {
-      "hmac": true
-    }
-  }
-}
-```
-
-## Read single audit request header
-
-This endpoint lists the information for the given request header.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path                                         |
-| :----- | :------------------------------------------- |
-| `GET`  | `/sys/config/auditing/request-headers/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the request header to
-  query. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/config/auditing/request-headers/my-header
-```
-
-### Sample response
-
-```json
-{
-  "X-Forwarded-For": {
-    "hmac": true
-  }
-}
-```
-
-## Create/Update audit request header
-
-This endpoint enables auditing of a header.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path                                         |
-| :----- | :------------------------------------------- |
-| `POST` | `/sys/config/auditing/request-headers/:name` |
-
-### Parameters
-
-- `hmac` `(bool: false)` – Specifies if this header's value should be HMAC'ed in
-  the audit logs.
-
-### Sample payload
-
-```json
-{
-  "hmac": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/config/auditing/request-headers/my-header
-```
-
-## Delete audit request header
-
-This endpoint disables auditing of the given request header.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method   | Path                                         |
-| :------- | :------------------------------------------- |
-| `DELETE` | `/sys/config/auditing/request-headers/:name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/config/auditing/request-headers/my-header
-```
diff --git a/website/content/api-docs/system/config-control-group.mdx b/website/content/api-docs/system/config-control-group.mdx
deleted file mode 100644
index 0385ed4a43c..00000000000
--- a/website/content/api-docs/system/config-control-group.mdx
+++ /dev/null
@@ -1,83 +0,0 @@
----
-layout: api
-page_title: /sys/config/control-group - HTTP API
-description: The '/sys/config/control-group' endpoint configures control groups.
----
-
-# `/sys/config/control-group`
-
-@include 'alerts/enterprise-only.mdx'
-
-The `/sys/config/control-group` endpoint is used to configure Control Group
-settings.
-
-## Read control group settings
-
-This endpoint returns the current Control Group configuration.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `GET`  | `/sys/config/control-group` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/config/control-group
-```
-
-### Sample response
-
-```json
-{
-  "max_ttl": "4h"
-}
-```
-
-## Configure control group settings
-
-This endpoint allows configuring control groups.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `/sys/config/control-group` |
-
-### Parameters
-
-- `max_ttl` `int` – The maximum ttl for a control group wrapping token. This can be provided in seconds or duration (2h).
-
-### Sample payload
-
-```json
-{
-  "max_ttl": "4h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/config/control-group
-```
-
-## Delete control group settings
-
-This endpoint removes any control group configuration.
-
-| Method   | Path                        |
-| :------- | :-------------------------- |
-| `DELETE` | `/sys/config/control-group` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/config/control-group
-```
diff --git a/website/content/api-docs/system/config-cors.mdx b/website/content/api-docs/system/config-cors.mdx
deleted file mode 100644
index a6f03ae5b2b..00000000000
--- a/website/content/api-docs/system/config-cors.mdx
+++ /dev/null
@@ -1,102 +0,0 @@
----
-layout: api
-page_title: /sys/config/cors - HTTP API
-description: >-
-  The '/sys/config/cors' endpoint configures how the Vault server responds to
-  cross-origin requests.
----
-
-# `/sys/config/cors`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/config/cors` endpoint is used to configure CORS settings.
-
-- **`sudo` required** – All CORS endpoints require `sudo` capability in
-  addition to any path-specific capabilities.
-
-## Read CORS settings
-
-This endpoint returns the current CORS configuration.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/sys/config/cors` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/config/cors
-```
-
-### Sample response
-
-```json
-{
-  "enabled": true,
-  "allowed_origins": ["http://www.example.com"],
-  "allowed_headers": [
-    "Content-Type",
-    "X-Requested-With",
-    "X-Vault-AWS-IAM-Server-ID",
-    "X-Vault-No-Request-Forwarding",
-    "X-Vault-Token",
-    "Authorization",
-    "X-Vault-Wrap-Format",
-    "X-Vault-Wrap-TTL"
-  ]
-}
-```
-
-## Configure CORS settings
-
-This endpoint allows configuring the origins that are permitted to make
-cross-origin requests, as well as headers that are allowed on cross-origin requests.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/sys/config/cors` |
-
-### Parameters
-
-- `allowed_origins` `(string or string array: <required>)` – A wildcard (`*`), comma-delimited string, or array of strings specifying the origins that are permitted to make cross-origin requests.
-
-- `allowed_headers` `(string or string array: "" or [])` – A comma-delimited string or array of strings specifying headers that are permitted to be on cross-origin requests. Headers set via this parameter will be appended to the list of headers that Vault allows by default.
-
-### Sample payload
-
-```json
-{
-  "allowed_origins": "*",
-  "allowed_headers": "X-Custom-Header"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/config/cors
-```
-
-## Delete CORS settings
-
-This endpoint removes any CORS configuration.
-
-| Method   | Path               |
-| :------- | :----------------- |
-| `DELETE` | `/sys/config/cors` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/config/cors
-```
diff --git a/website/content/api-docs/system/config-group-policy-application.mdx b/website/content/api-docs/system/config-group-policy-application.mdx
deleted file mode 100644
index 0a343316a77..00000000000
--- a/website/content/api-docs/system/config-group-policy-application.mdx
+++ /dev/null
@@ -1,94 +0,0 @@
----
-layout: api
-page_title: /sys/config/group-policy-application - HTTP API
-description: The '/sys/config/group-policy-application' endpoint is used to configure the global mode for group policy application.
----
-
-# `/sys/config/group-policy-application`
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-<Warning>
-  The group policy application mode only applies to ACL policies and no longer
-  affects Vault sentinel role governing policies (RGPs) for the following Vault
-  versions:
-
-  - `1.15.0+`
-  - `1.14.4+`
-  - `1.13.8+`
-
-</Warning>
-
-The `sys/config/group-policy-application` endpoint can be used to configure the
-mode of policy application for identity groups in Vault. This setting dictates
-the behavior across all groups in all namespaces in Vault.
-
-Vault allows you to add entities and groups from any namespace into an identity group.
-However, historically, any policies attached to that group would only apply when the
-Vault token authorizing a request was created in the same namespace as that group,
-or a descendent namespace. This endpoint allows relaxing that restriction: when the mode is set to the default,
-`within_namespace_hierarchy`, the historical behaviour is maintained,
-but when set to `any`, group policies apply to all members of a group,
-regardless of what namespace the request token came from.
-
-Note that this configuration will be replicated between primary and secondaries, that
-is to say, primaries cannot have a different policy application mode to secondaries.
-
-## Get group policy application information
-
-This endpoint returns the current group policy application mode, which will be
-either `within_namespace_hierarchy` or `any`.
-
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `GET`  | `/sys/config/group-policy-application` |
-
-### Sample request
-
-```shell-session
-$ curl \
-  --header "X-Vault-Token: ..." \
-    'http://127.0.0.1:8200/v1/sys/config/group-policy-application'
-```
-
-### Sample response
-
-```json
-{
-   "group_policy_application_mode": "within_namespace_hierarchy"
-}
-```
-
-## Set group policy application information
-
-This endpoint allows you to modify the current group policy application mode, which can be
-either `within_namespace_hierarchy` or `any`. `within_namespace_hierarchy`
-restricts policy application to only policies from groups from parent namespaces, and
-`any` does not restrict policy application in any way, and policies will apply from any namespace,
-irrespective of namespace hierarchy.
-
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST`, `PUT`  | `/sys/config/group-policy-application` |
-
-### Sample payload
-
-```json
-{
-   "group_policy_application_mode": "any"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-  --request POST \
-  --header "X-Vault-Token: ..." \
-  --data @payload.json \
-  'http://127.0.0.1:8200/v1/sys/config/group-policy-application'
-```
diff --git a/website/content/api-docs/system/config-reload.mdx b/website/content/api-docs/system/config-reload.mdx
deleted file mode 100644
index 73d6d948c8a..00000000000
--- a/website/content/api-docs/system/config-reload.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
----
-layout: api
-page_title: /sys/config/reload - HTTP API
-description: The '/sys/config/reload' endpoint is used to reload specific parts of Vault's configuration.
----
-
-# `/sys/config/reload`
-
-@include 'alerts/restricted-root.mdx'
-
-The `sys/config/reload` endpoint allows reloading specific parts of Vault's configuration.
-Currently, it only supports reloading license information from files on disk.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `POST` | `/sys/config/reload/:subsystem` |
-
-### Parameters
-
-- `subsystem` `(string: <required>)` - Specifies the subsystem for Vault to reload. This is part of the request URL.
-
-## Reload license file <EnterpriseAlert product="vault" inline />
-
-When the `:subsystem` URL parameter is specified as `license`, Vault re-reads
-the license file if the license was provided using the `license_path` configuration
-option or the `VAULT_LICENSE_PATH` environment variable.  The updated license is
-applied to Vault, and Vault will then enable/disable licensed features if the features
-of the given license are different from those of the license Vault is currently using.
-
-### Sample request
-
-```shell-session
-$ curl \
-  -X POST \
-  --header "X-Vault-Token: ..." \
-    'http://127.0.0.1:8200/v1/sys/config/reload/license'
-```
diff --git a/website/content/api-docs/system/config-state.mdx b/website/content/api-docs/system/config-state.mdx
deleted file mode 100644
index fd4981d4ee4..00000000000
--- a/website/content/api-docs/system/config-state.mdx
+++ /dev/null
@@ -1,81 +0,0 @@
----
-layout: api
-page_title: /sys/config/state - HTTP API
-description: The '/sys/config/state' endpoint is used to retrieve the configuration state.
----
-
-# `/sys/config/state`
-
-@include 'alerts/restricted-root.mdx'
-
-The endpoints under `sys/config/state` return Vault's configuration state.
-Currently, it only supports returning a sanitized version of the configuration.
-
-## Get sanitized configuration state
-
-This endpoint returns a sanitized version of the configuration state. The
-configuration excludes certain fields and mappings in the configuration file
-that can potentially contain sensitive information, which includes values from
-`Storage.Config`, `HAStorage.Config`, `Seals.Config` and the
-`Telemetry.CirconusAPIToken` value.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `GET`  | `/sys/config/state/sanitized` |
-
-### Sample request
-
-```shell-session
-$ curl \
-  --header "X-Vault-Token: ..." \
-    'http://127.0.0.1:8200/v1/sys/config/state/sanitized'
-```
-
-### Sample response
-
-```json
-{
-  "api_addr": "http://127.0.0.1:8200",
-  "cache_size": 0,
-  "cluster_addr": "",
-  "cluster_cipher_suites": "",
-  "cluster_name": "",
-  "default_lease_ttl": 0,
-  "default_max_request_duration": 0,
-  "disable_cache": false,
-  "disable_clustering": false,
-  "disable_indexing": false,
-  "disable_mlock": false,
-  "disable_performance_standby": false,
-  "disable_printable_check": false,
-  "disable_sealwrap": false,
-  "enable_ui": true,
-  "listeners": [
-    {
-      "config": {
-        "address": "127.0.0.1:8200",
-        "tls_disable": 1
-      },
-      "type": "tcp"
-    }
-  ],
-  "log_format": "",
-  "log_level": "",
-  "max_lease_ttl": 0,
-  "pid_file": "",
-  "plugin_directory": "/opt/vault/plugins",
-  "raw_storage_endpoint": false,
-  "seals": [
-    {
-      "disabled": false,
-      "type": "shamir"
-    }
-  ],
-  "storage": {
-    "cluster_addr": "",
-    "disable_clustering": false,
-    "redirect_addr": "http://127.0.0.1:8200",
-    "type": "inmem"
-  }
-}
-```
diff --git a/website/content/api-docs/system/config-ui-custom-messages.mdx b/website/content/api-docs/system/config-ui-custom-messages.mdx
deleted file mode 100644
index 7d69e471969..00000000000
--- a/website/content/api-docs/system/config-ui-custom-messages.mdx
+++ /dev/null
@@ -1,242 +0,0 @@
----
-layout: api
-page_title: /sys/config/ui/custom-messages - HTTP API
-description: The '/sys/config/ui/custom-messages' endpoint configures the custom messages that the UI displays prior to and immediately following login operations.
----
-
-# `/sys/config/ui/custom-messages`
-
-The `/sys/config/ui/custom-messages` endpoint is used to list, create, read, update, or delete custom messages.
-
-## List custom messages
-
-This endpoint returns a list of all custom messages that exist.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `LIST` | `/sys/config/ui/custom-messages/` |
-
-### Parameters
-
-- `active` `(bool: <optional>)` - A flag indicating whether to only include custom messages whose active property is set to the value specified in the results. If this parameter is omitted, the results include both active and inactive custom messages.
-
-- `authenticated` `(bool: <optional>)` - A flag indicating whether to only include custom messages whose authenticated property is set to the value specified in the results. If this parameter is omitted, the results include both authenticated and unauthenticated custom messages.
-
-- `type` `(string: <optional>)` - A flag that can only be set to either `banner` or `modal`. It indicates whether to only include custom messages whose type property is set to the value specified in the results. If this parameter is omitted, the results include both types of custom messages.
-
-### Sample request
-
-```shell-session
-$ curl --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/sys/config/ui/custom-messages?active=true&authenticated=false&type=modal
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "key_info": {
-      "01234567-89ab-cdef-0123-456789abcdef": {
-        "title": "Post-login Advisory",
-        "type": "modal",
-        "authenticated": false,
-        "start_time": "2024-01-01T00:00:00.000000000Z",
-        "end_time": null
-      }
-    },
-    "keys": [
-      "01234567-89ab-cdef-0123-456789abcdef"
-    ]
-  }
-}
-```
-
-## Create custom message
-
-This endpoint allows the creation of a new custom message. Vault allows up to 100 custom messages
-per namespace. If this endpoint is called to create a custom message when the maximum number of
-custom messages already exists, an error will be returned.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `POST` | `/sys/config/ui/custom-messages/` |
-
-### Parameters
-
-- `title` `(string: <required>)` - The title of the custom message.
-
-- `authenticated` `(bool: <optional>)` - A flag indicating whether the custom message is displayed post-login (`true`) or pre-login (`false`). If this parameter is omitted, the custom message is created as post-login. Pre-login messages may be retrieved by anonymous clients, as such their content should not contain any sensitive information.
-
-- `type` `(string: <optional>)` - The type of the custom message. Must be either `banner` or `modal`. If this parameter is omitted, the custom message type is set to `banner`.
-
-- `message` `(string: <required>)` - The base64 encoded message body of the custom message.
-
-- `link` `(Map: <optional>)` - A link object that contains a single property. The property key is the link title and its value is the URL.
-
-- `options` `(Map: <optional>)` - A map of custom UI properties to set for the custom message.
-
-- `start_time` `(string: <required>)` - A RFC3339 formatted timestamp that marks the beginning of the custom message's active period.
-
-- `end_time` `(string: <optional>)` - A RFC3339 formatted timestamp that marks the end of the custom message's active period. If no end time is provided, the custom message's active period never ends.
-
-### Sample payload
-
-```json
-{
-  "title": "Post-login Advisory",
-  "authenticated": true,
-  "type": "modal",
-  "message": "TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2NpbmcgZWxpdC4gQ3VyYWJpdHVyIG51bGxhIGF1Z3VlLCBwbGFjZXJhdCBxdWlzIHJpc3VzIGJsYW5kaXQsIG1vbGVzdGllIGltcGVyZGlldCBtYXNzYS4gU2VkIGJsYW5kaXQgcnV0cnVtIG9kaW8gcXVpcyB2YXJpdXMuIEZ1c2NlIHB1cnVzIG9yY2ksIG1heGltdXMgYWMgbGliZXJvLgo=",
-  "start_time": "2024-01-01T00:00:00.000Z"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/config/ui/custom-messages
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "id": "01234567-89ab-cdef-0123-456789abcdef",
-    "active": true,
-    "start_time": "2023-10-15T02:36:43.986212308Z",
-    "end_time": null,
-    "type": "modal",
-    "authenticated": false,
-  }
-}
-```
-
-## Read custom message
-
-This endpoint returns the properties of a specific custom message.
-
-| Method |                                      |
-| :----- | :----------------------------------- |
-| `GET`  | `/sys/config/ui/custom-messages/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` - The unique ID assigned to the custom message at creation time.
-
-### Sample request
-
-```shell-session
-$ curl --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/config/ui/custom-messages/01234567-89ab-cdef-0123-456789abcdef
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "id": "01234567-89ab-cdef-0123-456789abcdef",
-    "title": "Pre-login Advisory",
-    "active": true,
-    "authenticated": false,
-    "type": "banner",
-    "message": "TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2NpbmcgZWxpdC4gQ3VyYWJpdHVyIG51bGxhIGF1Z3VlLCBwbGFjZXJhdCBxdWlzIHJpc3VzIGJsYW5kaXQsIG1vbGVzdGllIGltcGVyZGlldCBtYXNzYS4gU2VkIGJsYW5kaXQgcnV0cnVtIG9kaW8gcXVpcyB2YXJpdXMuIEZ1c2NlIHB1cnVzIG9yY2ksIG1heGltdXMgYWMgbGliZXJvLgo.",
-    "link": {
-      "click here": "https://www.learnmore.com",
-    },
-    "options": {},
-    "start_time": "2018-03-22T02:24:06.945319214Z",
-    "end_time": null,
-  }
-}
-```
-
-## Update custom message
-
-This endpoint updates the properties of a specific custom message.
-
-| Method |                                      |
-| :----- | :----------------------------------- |
-| `POST` | `/sys/config/ui/custom-messages/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` - The unique ID assigned to the custom message at creation time.
-
-- `title` `(string: <required>)` - The title of the custom message.
-
-- `authenticated` `(bool: <optional>)` - A flag indicating whether the custom message is displayed post-login (`true`) or pre-login (`false`). If this parameter is omitted, the custom message is created as post-login. Pre-login messages may be retrieved by anonymous clients, as such their content should not contain any sensitive information.
-
-- `type` `(string: <optional>)` - The type of the custom message. Must be either `banner` or `modal`. If this parameter is omitted, the custom message type is set to `banner`.
-
-- `message` `(string: <required>)` - The base64 encoded message body of the custom message.
-
-- `link` `(Map: <optional>)` - A link object that contains a single property. The property key is the link title and its value is the URL.
-
-- `options` `(Map: <optional>)` - A map of custom UI properties to set for the custom message.
-
-- `start_time` `(string: <required>)` - A RFC3339 formatted timestamp that marks the beginning of the custom message's active period.
-
-- `end_time` `(string: <optional>)` - A RFC3339 formatted timestamp that marks the end of the custom message's active period. If no end time is provided, the custom message's active period never ends.
-
-### Sample payload
-
-```json
-{
-  "title": "Pre-login Advisory",
-  "authenticated": false,
-  "type": "modal",
-  "message": "TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2NpbmcgZWxpdC4gQ3VyYWJpdHVyIG51bGxhIGF1Z3VlLCBwbGFjZXJhdCBxdWlzIHJpc3VzIGJsYW5kaXQsIG1vbGVzdGllIGltcGVyZGlldCBtYXNzYS4gU2VkIGJsYW5kaXQgcnV0cnVtIG9kaW8gcXVpcyB2YXJpdXMuIEZ1c2NlIHB1cnVzIG9yY2ksIG1heGltdXMgYWMgbGliZXJvLgo=",
-  "start_time": "2024-01-01T00:00:00.000Z"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/config/ui/custom-messages/01234567-89ab-cdef-0123-456789abcdef
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "active": true,
-    "title": "Pre-login Advisory",
-    "start_time": "2023-10-15T02:36:43.986212308Z",
-    "end_time": null,
-    "type": "modal",
-    "message": "TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2NpbmcgZWxpdC4gQ3VyYWJpdHVyIG51bGxhIGF1Z3VlLCBwbGFjZXJhdCBxdWlzIHJpc3VzIGJsYW5kaXQsIG1vbGVzdGllIGltcGVyZGlldCBtYXNzYS4gU2VkIGJsYW5kaXQgcnV0cnVtIG9kaW8gcXVpcyB2YXJpdXMuIEZ1c2NlIHB1cnVzIG9yY2ksIG1heGltdXMgYWMgbGliZXJvLgo",
-    "authenticated": false,
-  }
-}
-```
-
-## Delete custom message
-
-This endpoint deletes a specific custom message.
-
-| Method   |                                      |
-| :------- | :----------------------------------- |
-| `DELETE` | `/sys/config/ui/custom-messages/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` - The unique ID assigned to the custom message at creation time.
-
-### Sample request
-
-```shell-session
-$ curl --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/config/ui/custom-messages/01234567-89ab-cdef-0123-456789abcdef
-```
diff --git a/website/content/api-docs/system/config-ui-headers.mdx b/website/content/api-docs/system/config-ui-headers.mdx
deleted file mode 100644
index 40c716d0290..00000000000
--- a/website/content/api-docs/system/config-ui-headers.mdx
+++ /dev/null
@@ -1,136 +0,0 @@
----
-layout: api
-page_title: /sys/config/ui/headers - HTTP API
-description: The '/sys/config/ui/headers' endpoint configures the UI.
----
-
-# `/sys/config/ui/headers`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/config/ui/headers` endpoint is used to configure UI header settings.
-
-- **`sudo` required** – All of these endpoints require the `sudo` capability in
-  addition to any path-specific capabilities.
-
-## Read UI header settings
-
-This endpoint returns the given UI header configuration.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/sys/config/ui/headers/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the custom header.
-
-- `multivalue` `(bool: <optional>)` - Returns multiple values if true.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/config/ui/headers/X-Custom-Header
-```
-
-### Sample response
-
-```json
-{
-  "value": "custom-value"
-}
-```
-
-### Sample request (Multi value)
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/config/ui/headers/X-Custom-Header?multivalue=true
-```
-
-### Sample response
-
-```json
-{
-  "values": ["custom-value-1", "custom-value-2"]
-}
-```
-
-## Configure UI headers
-
-This endpoint allows configuring the values to be returned for the UI header.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/sys/config/ui/headers/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – The name of the custom header.
-
-- `values` `(list: <required>)` - The values to be returned from the header.
-
-### Sample payload
-
-```json
-{
-  "values": ["custom value 1", "custom value 2"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/config/ui/headers/X-Custom-Header
-```
-
-## Delete a UI header
-
-This endpoint removes a UI header.
-
-| Method   | Path                           |
-| :------- | :----------------------------- |
-| `DELETE` | `/sys/config/ui/headers/:name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/config/ui/headers/X-Custom-Header
-```
-
-## List UI headers
-
-This endpoint returns a list of configured UI headers.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `LIST` | `/sys/config/ui/headers` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/sys/config/ui/headers
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["X-Custom...", "X-Header..."]
-  }
-}
-```
diff --git a/website/content/api-docs/system/control-group.mdx b/website/content/api-docs/system/control-group.mdx
deleted file mode 100644
index 8ffd0f5870c..00000000000
--- a/website/content/api-docs/system/control-group.mdx
+++ /dev/null
@@ -1,102 +0,0 @@
----
-layout: api
-page_title: /sys/control-group - HTTP API
-description: The '/sys/control-group' endpoint handles the Control Group workflow.
----
-
-## Authorize control group request
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-This endpoint authorizes a control group request.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/sys/control-group/authorize` |
-
-### Parameters
-
-- `accessor` `(string: <required>)` – The accessor for the control group wrapping token.
-
-### Sample payload
-
-```json
-{
-  "accessor": "0ad21b78-e9bb-64fa-88b8-1e38db217bde"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/control-group/authorize
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "approved": false
-  }
-}
-```
-
-## Check control group request status
-
-This endpoint checks the status of a control group request.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/sys/control-group/request` |
-
-### Parameters
-
-- `accessor` `(string: <required>)` – The accessor for the control group wrapping token.
-
-### Sample payload
-
-```json
-{
-  "accessor": "0ad21b78-e9bb-64fa-88b8-1e38db217bde"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/control-group/request
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "approved": false,
-    "request_path": "secret/foo",
-    "request_entity": {
-      "id": "c8b6e404-de4b-50a4-2917-715ff8beec8e",
-      "name": "Bob"
-    },
-    "authorizations": [
-      {
-        "entity_id": "6544a3ec-d3cd-443b-b87b-4fd2e889e0b7",
-        "entity_name": "Abby Jones"
-      },
-      {
-        "entity_id": "919084a4-417e-42ee-9d78-87fa2843af37",
-        "entity_name": "James Franklin"
-      }
-    ]
-  }
-}
-```
diff --git a/website/content/api-docs/system/decode-token.mdx b/website/content/api-docs/system/decode-token.mdx
deleted file mode 100644
index 1ab60447855..00000000000
--- a/website/content/api-docs/system/decode-token.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
----
-layout: api
-page_title: /sys/decode-token - HTTP API
-description: The `/sys/decode-token` endpoint is used to decode the encoded token which is the result of /sys/generate-root.
----
-
-# `/sys/decode-token`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/decode-token` endpoint is used to decode the encoded token which is the result of the [/sys/generate-root](/vault/api-docs/system/generate-root) API.
-
-## Parameters
-
-- `encoded_token` `(string: <required>)` – Specifies the encoded token (result from /sys/generate-root).
-
-- `otp` `(string: <required>)` - Specifies the otp code for decode.
-
-## Sample response
-
-```json
-{
-  "request_id": "9bc0fab8-d65c-3961-afe6-d05f50c5fd22",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "token": "4RUmoevJ3lsLni9sTXcNnRE1"
-  },
-  "warnings": null
-}
-```
diff --git a/website/content/api-docs/system/experiments.mdx b/website/content/api-docs/system/experiments.mdx
deleted file mode 100644
index 5483645e451..00000000000
--- a/website/content/api-docs/system/experiments.mdx
+++ /dev/null
@@ -1,48 +0,0 @@
----
-layout: api
-page_title: /sys/experiments - HTTP API
-description: The `/sys/experiments` endpoint returns information about experiments on the Vault node.
----
-
-# `/sys/experiments`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/experiments` endpoint returns information about experiments on the Vault node.
-
-## Read experiments
-
-This endpoint returns the experiments available and enabled on the Vault node.
-Experiments are per-node and cannot be changed while the node is running. See
-the [`-experiment`](/vault/docs/commands/server#experiment) flag and the
-[`experiments`](/vault/docs/configuration#experiments) config key documentation for
-details on enabling experiments.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/sys/experiments` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/experiments
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "cb48b1e2-635c-52e9-db79-ad9a54ed3e88",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "available": [
-      "events.alpha1"
-    ],
-    "enabled": []
-  },
-  "warnings": null
-}
-```
diff --git a/website/content/api-docs/system/generate-recovery-token.mdx b/website/content/api-docs/system/generate-recovery-token.mdx
deleted file mode 100644
index c775a9854db..00000000000
--- a/website/content/api-docs/system/generate-recovery-token.mdx
+++ /dev/null
@@ -1,173 +0,0 @@
----
-layout: api
-page_title: /sys/generate-recovery-token - HTTP API
-description: |-
-  The `/sys/generate-recovery-token/` endpoints are used to create a new
-  recovery token for Vault.  They are only active in recovery mode.
----
-
-# `/sys/generate-recovery-token`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/generate-recovery-token` endpoint is used to create a new recovery
-token for Vault.
-
-## Read recovery token generation progress
-
-This endpoint reads the configuration and process of the current root generation
-attempt.
-
-| Method | Path                                   |
-| :----- | :------------------------------------- |
-| `GET`  | `/sys/generate-recovery-token/attempt` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/generate-recovery-token/attempt
-```
-
-### Sample response
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "progress": 1,
-  "required": 3,
-  "encoded_token": "",
-  "pgp_fingerprint": "",
-  "otp_length": 24,
-  "complete": false
-}
-```
-
-If a recovery token generation is started, `progress` is how many unseal keys
-have been provided for this generation attempt, where `required` must be reached
-to complete. The `nonce` for the current attempt and whether the attempt is
-complete is also displayed.
-
-If a PGP key is being used to encrypt the final root
-token, its fingerprint will be returned.
-
-If an OTP is being used to encode the final root token it will be returned only
-once, on the response to the start request.
-
-The OTP is a base62 string, with length of otp_length.
-The raw bytes (char codes) of the token will be XOR'd with
-this value before being returned as a response to the final unseal
-key, encoded as base64.
-
-## Start recovery token generation
-
-This endpoint initializes a new recovery token generation attempt. Only a single
-recovery token generation attempt can take place at a time.
-
-| Method | Path                                   |
-| :----- | :------------------------------------- |
-| `POST` | `/sys/generate-recovery-token/attempt` |
-
-### Parameters
-
-- `pgp_key` `(string: <optional>)` – Specifies a base64-encoded PGP public key.
-  The raw bytes of the token will be encrypted with this value before being
-  returned to the final unseal key provider.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/generate-recovery-token/attempt
-```
-
-### Sample response
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "progress": 1,
-  "required": 3,
-  "encoded_token": "",
-  "otp": "2vPFYG8gUSW9npwzyvxXMug0",
-  "otp_length": 24,
-  "complete": false
-}
-```
-
-## Cancel recovery token generation
-
-This endpoint cancels any in-progress recovery token generation attempt. This
-clears any progress made. This must be called to change the OTP or PGP key being
-used.
-
-| Method   | Path                                   |
-| :------- | :------------------------------------- |
-| `DELETE` | `/sys/generate-recovery-token/attempt` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/generate-recovery-token/attempt
-```
-
-## Provide key share to generate recovery token
-
-This endpoint is used to enter a single root key share to progress the
-recovery token generation attempt. If the threshold number of root key shares
-is reached, Vault will complete the recovery token generation and issue the new
-token. Otherwise, this API must be called multiple times until that threshold
-is met. The attempt nonce must be provided with each call.
-
-Note that once a token has been issued, Vault is unsealed. The token lives
-only in memory and thus will only be valid until the next restart.
-
-| Method | Path                                  |
-| :----- | :------------------------------------ |
-| `POST` | `/sys/generate-recovery-token/update` |
-
-### Parameters
-
-- `key` `(string: <required>)` – Specifies a single root key share.
-
-- `nonce` `(string: <required>)` – Specifies the nonce of the attempt.
-
-### Sample payload
-
-```json
-{
-  "key": "acbd1234",
-  "nonce": "ad235"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/generate-recovery-token/update
-```
-
-### Sample response
-
-This returns a JSON-encoded object indicating the attempt nonce, and completion
-status, and the encoded recovery token, if the attempt is complete.
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "progress": 3,
-  "required": 3,
-  "pgp_fingerprint": "",
-  "complete": true,
-  "encoded_token": "FPzkNBvwNDeFh4SmGA8c+w=="
-}
-```
diff --git a/website/content/api-docs/system/generate-root.mdx b/website/content/api-docs/system/generate-root.mdx
deleted file mode 100644
index 20d8deca4a1..00000000000
--- a/website/content/api-docs/system/generate-root.mdx
+++ /dev/null
@@ -1,168 +0,0 @@
----
-layout: api
-page_title: /sys/generate-root - HTTP API
-description: |-
-  The `/sys/generate-root/` endpoints are used to create a new root key for
-  Vault.
----
-
-# `/sys/generate-root`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/generate-root` endpoint is used to create a new root key for Vault.
-
-## Read root generation progress
-
-This endpoint reads the configuration and process of the current root generation
-attempt.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `GET`  | `/sys/generate-root/attempt` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/generate-root/attempt
-```
-
-### Sample response
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "progress": 1,
-  "required": 3,
-  "encoded_token": "",
-  "pgp_fingerprint": "",
-  "otp_length": 24,
-  "complete": false
-}
-```
-
-If a root generation is started, `progress` is how many unseal keys have been
-provided for this generation attempt, where `required` must be reached to
-complete. The `nonce` for the current attempt and whether the attempt is
-complete is also displayed.
-
-If a PGP key is being used to encrypt the final root
-token, its fingerprint will be returned.
-
-If an OTP is being used to encode the final root token it will be returned only
-once, on the response to the start request.
-
-The OTP is a base62 string, with length of otp_length.
-The raw bytes (char codes) of the token will be XOR'd with
-this value before being returned as a response to the final unseal
-key, encoded as base64.
-
-## Start root token generation
-
-This endpoint initializes a new root generation attempt. Only a single root
-generation attempt can take place at a time.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/sys/generate-root/attempt` |
-
-### Parameters
-
-- `pgp_key` `(string: <optional>)` – Specifies a base64-encoded PGP public key.
-  The raw bytes of the token will be encrypted with this value before being
-  returned to the final unseal key provider.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/generate-root/attempt
-```
-
-### Sample response
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "progress": 1,
-  "required": 3,
-  "encoded_token": "",
-  "otp": "2vPFYG8gUSW9npwzyvxXMug0",
-  "otp_length": 24,
-  "complete": false
-}
-```
-
-## Cancel root generation
-
-This endpoint cancels any in-progress root generation attempt. This clears any
-progress made. This must be called to change the OTP or PGP key being used.
-
-| Method   | Path                         |
-| :------- | :--------------------------- |
-| `DELETE` | `/sys/generate-root/attempt` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/generate-root/attempt
-```
-
-## Provide key share to generate root
-
-This endpoint is used to enter a single root key share to progress the root
-generation attempt. If the threshold number of root key shares is reached,
-Vault will complete the root generation and issue the new token. Otherwise,
-this API must be called multiple times until that threshold is met. The attempt
-nonce must be provided with each call.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `/sys/generate-root/update` |
-
-### Parameters
-
-- `key` `(string: <required>)` – Specifies a single root key share.
-
-- `nonce` `(string: <required>)` – Specifies the nonce of the attempt.
-
-### Sample payload
-
-```json
-{
-  "key": "acbd1234",
-  "nonce": "ad235"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/generate-root/update
-```
-
-### Sample response
-
-This returns a JSON-encoded object indicating the attempt nonce, and completion
-status, and the encoded root token, if the attempt is complete.
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "progress": 3,
-  "required": 3,
-  "pgp_fingerprint": "",
-  "complete": true,
-  "encoded_token": "FPzkNBvwNDeFh4SmGA8c+w=="
-}
-```
diff --git a/website/content/api-docs/system/ha-status.mdx b/website/content/api-docs/system/ha-status.mdx
deleted file mode 100644
index 86183b3255c..00000000000
--- a/website/content/api-docs/system/ha-status.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-layout: api
-page_title: /sys/ha-status - HTTP API
-description: The `/sys/ha-status` endpoint is used to check the HA status of a Vault cluster.
----
-
-# `/sys/ha-status`
-
-The `/sys/ha-status` endpoint is used to check the HA status of a Vault cluster.
-It lists the active node and the peers that it's heard from since it became active.
-
-## HA status
-
-This endpoint returns the HA status of the Vault cluster.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/sys/ha-status` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/ha-status
-```
-
-### Sample response
-
-```json
-{
-  "Nodes": [
-    {
-      "hostname": "node1",
-      "api_address": "http://10.0.0.2:8200",
-      "cluster_address": "https://10.0.0.2:8201",
-      "active_node": true,
-      "last_echo": null,
-      "version": "1.11.0",
-      "upgrade_version": "1.11.0",
-      "redundancy_zone": "a"
-    },
-    {
-      "hostname": "node2",
-      "api_address": "http://10.0.0.3:8200",
-      "cluster_address": "https://10.0.0.3:8201",
-      "active_node": false,
-      "last_echo": "2021-11-29T10:29:09.202235-05:00",
-      "version": "1.11.0",
-      "upgrade_version": "1.11.0",
-      "redundancy_zone": "a"
-    },
-    {
-      "hostname": "node3",
-      "api_address": "http://10.0.0.4:8200",
-      "cluster_address": "https://10.0.0.4:8201",
-      "active_node": false,
-      "last_echo": "2021-11-29T10:29:07.402548-05:00",
-      "version": "1.11.0",
-      "upgrade_version": "1.11.0",
-      "redundancy_zone": "a"
-    }
-  ]
-}
-```
-Note that in the above sample response, `upgrade_version` and `redundancy_zone` are Enterprise-only fields.
diff --git a/website/content/api-docs/system/health.mdx b/website/content/api-docs/system/health.mdx
deleted file mode 100644
index fe3fb76b47d..00000000000
--- a/website/content/api-docs/system/health.mdx
+++ /dev/null
@@ -1,131 +0,0 @@
----
-layout: api
-page_title: /sys/health - HTTP API
-description: The `/sys/health` endpoint is used to check the health status of Vault.
----
-
-# `/sys/health`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/health` endpoint is used to check the health status of Vault.
-
-## Read health information
-
-This endpoint returns the health status of Vault. This matches the semantics of
-a Consul HTTP health check and provides a simple way to monitor the health of a
-Vault instance.
-
-| Method | Path          |
-| :----- | :------------ |
-| `HEAD` | `/sys/health` |
-| `GET`  | `/sys/health` |
-
-The default status codes are:
-
-- `200` if initialized, unsealed, and active
-- `429` if unsealed and standby
-- `472` if disaster recovery mode replication secondary and active
-- `473` if performance standby
-- `501` if not initialized
-- `503` if sealed
-
-### Parameters
-
-- `standbyok` `(bool: false)` – Specifies if being a standby should still return
-  the active status code instead of the standby status code. This is useful when
-  Vault is behind a non-configurable load balancer that just wants a 200-level
-  response. This will not apply if the node is a performance standby.
-
-- `perfstandbyok` `(bool: false)` – Specifies if being a performance standby should
-  still return the active status code instead of the performance standby status code.
-  This is useful when Vault is behind a non-configurable load balancer that just wants
-  a 200-level response.
-
-- `activecode` `(int: 200)` – Specifies the status code that should be returned
-  for an active node.
-
-- `standbycode` `(int: 429)` – Specifies the status code that should be returned
-  for a standby node.
-
-- `drsecondarycode` `(int: 472)` – Specifies the status code that should be
-  returned for a DR secondary node.
-
-- `performancestandbycode` `(int: 473)` – Specifies the status code that should be
-  returned for a performance standby node.
-
-- `sealedcode` `(int: 503)` – Specifies the status code that should be returned
-  for a sealed node.
-
-- `uninitcode` `(int: 501)` – Specifies the status code that should be returned
-  for a uninitialized node.
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/health
-```
-
-### Sample response
-
-This response is only returned for a `GET` request.
-
-Note: `replication_performance_mode` and `replication_dr_mode` reflect the state of
-the active node in the cluster; if you are querying it for a standby that has
-just come up, it can take a small time for the active node to inform the
-standby of its status.
-
-```json
-{
-  "initialized": true,
-  "sealed": false,
-  "standby": false,
-  "performance_standby": false,
-  "replication_performance_mode": "disabled",
-  "replication_dr_mode": "disabled",
-  "server_time_utc": 1516639589,
-  "version": "0.9.2",
-  "cluster_name": "vault-cluster-3bd69ca2",
-  "cluster_id": "00af5aa8-c87d-b5fc-e82e-97cd8dfaf731"
-}
-```
-
-### Sample request to customize the status code being returned
-
-```shell-session
-$ curl -i https://127.0.0.1:8200/v1/sys/health\?drsecondarycode\=200
-
-HTTP/2 200
-cache-control: no-store
-content-type: application/json
-strict-transport-security: max-age=31536000; includeSubDomains
-content-length: 364
-date: Wed, 26 Jan 2022 09:21:13 GMT
-```
-
-### Sample response
-
-This response is only returned for a `GET` request.
-
-Note: `replication_performance_mode` and `replication_dr_mode` reflect the state of
-the active node in the cluster; if you are querying it for a standby that has
-just come up, it may take time for the active node to inform the
-standby of its status.
-
-```json
-{
-  "initialized": true,
-  "sealed": false,
-  "standby": false,
-  "performance_standby": false,
-  "replication_performance_mode": "disabled",
-  "replication_dr_mode": "secondary",
-  "server_time_utc": 1643188873,
-  "version": "1.9.0+prem",
-  "cluster_name": "SECONDARY",
-  "cluster_id": "d2fbb13b-0830-70a3-4751-57b6b6d95d01",
-  "last_wal":13,
-  "license":{"state":"none","expiry_time":"","terminated":false}
-}
-```
diff --git a/website/content/api-docs/system/host-info.mdx b/website/content/api-docs/system/host-info.mdx
deleted file mode 100644
index 061f84ffa8b..00000000000
--- a/website/content/api-docs/system/host-info.mdx
+++ /dev/null
@@ -1,84 +0,0 @@
----
-layout: api
-page_title: /sys/host-info - HTTP API
-description: The '/sys/host-info' endpoint is used to retrieve host information
----
-
-# `/sys/host-info`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/host-info` endpoint is used retrieve information about the
-host instance that the Vault server is running on.
-
-## Collect host information
-
-This endpoint returns information about the host instance that the Vault
-server is running on. The data returned includes CPU information, CPU
-times, disk usage, host info, and memory statistics.
-
-| Method | Path             |
-| :----- | :--------------- |
-| `GET`  | `/sys/host-info` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/host-info
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "cpu": [
-      {
-        "cpu": 0,
-        "vendorId": "GenuineIntel",
-        "family": "6",
-        "model": "78",
-        ...
-      },
-      ...
-    ],
-    "cpu_times": [
-      {
-        "cpu": "cpu",
-        "user": 7491,
-        "system": 16833,
-        "idle": 5726276,
-        ...
-      },
-      ...
-    ],
-    "disk": [
-      {
-        "path": "/",
-        "fstype": "ext4",
-        "total": 410352476160,
-        "free": 102141169664,
-        "used": 306428051456,
-        ...
-      },
-      ...
-    ],
-    "host": {
-      "hostname": "vault-server-1",
-      "uptime": 28618,
-      "bootTime": 1570114491,
-      "procs": 439,
-      ...
-    },
-    "memory": {
-      "total": 17179869184,
-      "available": 6203424768,
-      "used": 10976444416,
-      ...
-    },
-    "timestamp": "2019-10-03T22:51:49.715927Z"
-  }
-}
-```
diff --git a/website/content/api-docs/system/in-flight-req.mdx b/website/content/api-docs/system/in-flight-req.mdx
deleted file mode 100644
index be8e762e85b..00000000000
--- a/website/content/api-docs/system/in-flight-req.mdx
+++ /dev/null
@@ -1,43 +0,0 @@
----
-layout: api
-page_title: /sys/in-flight-req - HTTP API
-description: The `/sys/in-flight-req` endpoint is used to get information on in-flight requests.
----
-
-# `/sys/in-flight-req`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/in-flight-req` endpoint is used to get information on in-flight requests.
-The returned information contains the `start_time`, `client_remote_address`, `request_path`,
-`request_method`, and `client_id` of the in-flight requests.
-
-## Collect In-Flight request information
-
-This endpoint returns the information about the in-flight requests.
-
-| Method | Path        |
-| :----- | :---------- |
-| `GET`  | `/sys/in-flight-req` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/in-flight-req
-```
-
-### Sample response
-
-```json
-{
-  "9049326b-ceed-1033-c099-96c5cc97db1f": {
-    "start_time": "2021-11-19T09:13:01.34157-08:00",
-    "client_remote_address": "127.0.0.3:49816",
-    "request_path": "/v1/sys/in-flight-req",
-    "request_method": "GET",
-    "client_id": "",
-  }
-}
-```
diff --git a/website/content/api-docs/system/index.mdx b/website/content/api-docs/system/index.mdx
deleted file mode 100644
index 11b7485f28d..00000000000
--- a/website/content/api-docs/system/index.mdx
+++ /dev/null
@@ -1,16 +0,0 @@
----
-layout: api
-page_title: System Backend - HTTP API
-description: |-
-  The system backend is a default backend in Vault that is mounted at the `/sys`
-  endpoint. This endpoint cannot be disabled or moved, and is used to configure
-  Vault and interact with many of Vault's internal features.
----
-
-# System backend
-
-The system backend is a default backend in Vault that is mounted at the `/sys`
-endpoint. This endpoint cannot be disabled or moved, and is used to configure
-Vault and interact with many of Vault's internal features.
-
-For more information about a particular path, please click on it in the sidebar.
diff --git a/website/content/api-docs/system/init.mdx b/website/content/api-docs/system/init.mdx
deleted file mode 100644
index 2b9ee679ed9..00000000000
--- a/website/content/api-docs/system/init.mdx
+++ /dev/null
@@ -1,118 +0,0 @@
----
-layout: api
-page_title: /sys/init - HTTP API
-description: The `/sys/init` endpoint is used to initialize a new Vault.
----
-
-# `/sys/init`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/init` endpoint is used to initialize a new Vault.
-
-## Read initialization status
-
-This endpoint returns the initialization status of Vault.
-
-| Method | Path        |
-| :----- | :---------- |
-| `GET`  | `/sys/init` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/init
-```
-
-### Sample response
-
-```json
-{
-  "initialized": true
-}
-```
-
-## Start initialization
-
-This endpoint initializes a new Vault. The Vault must not have been previously
-initialized. The recovery options, as well as the stored shares option, are only
-available when using [Auto Unseal](/vault/docs/concepts/seal#auto-unseal).
-
-| Method | Path        |
-| :----- | :---------- |
-| `POST`  | `/sys/init` |
-
-### Parameters
-
-- `pgp_keys` `(array<string>: nil)` – Specifies an array of PGP public keys used
-  to encrypt the output unseal keys. Ordering is preserved. The keys must be
-  base64-encoded from their original binary representation. The size of this
-  array must be the same as `secret_shares`.
-
-- `root_token_pgp_key` `(string: "")` – Specifies a PGP public key used to
-  encrypt the initial root token. The key must be base64-encoded from its
-  original binary representation.
-
-- `secret_shares` `(int: <required>)` – Specifies the number of shares to
-  split the root key into.
-
-- `secret_threshold` `(int: <required>)` – Specifies the number of shares
-  required to reconstruct the root key. This must be less than or equal
-  `secret_shares`.
-
-Additionally, the following options are only supported using Auto Unseal:
-
-- `stored_shares` `(int: <required>)` – Specifies the number of shares that
-  should be encrypted by the HSM and stored for auto-unsealing. Currently must
-  be the same as `secret_shares`.
-
-- `recovery_shares` `(int: 0)` – Specifies the number of shares to
-  split the recovery key into. This is only available when using Auto Unseal.
-
-- `recovery_threshold` `(int: 0)` – Specifies the number of shares
-  required to reconstruct the recovery key. This must be less than or equal to
-  `recovery_shares`. This is only available when using Auto Unseal.
-
-- `recovery_pgp_keys` `(array<string>: nil)` – Specifies an array of PGP public
-  keys used to encrypt the output recovery keys. Ordering is preserved. The keys
-  must be base64-encoded from their original binary representation. The size of
-  this array must be the same as `recovery_shares`. This is only available when using Auto Unseal.
-
-### Sample payload
-
-```json
-{
-  "secret_shares": 10,
-  "secret_threshold": 5
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/init
-```
-
-### Sample response
-
-A JSON-encoded object including the (possibly encrypted, if `pgp_keys` was
-provided) root keys, base 64 encoded root keys and initial root token:
-
-```json
-{
-  "keys": ["one", "two", "three"],
-  "keys_base64": ["cR9No5cBC", "F3VLrkOo", "zIDSZNGv"],
-  "root_token": "foo"
-}
-```
-
--> **Warning:** Please be reminded that recovery keys are used as an 
-authentication flow for rekeying and regeneration of root credentials and cannot 
-be used to unseal Vault in the case of the unavailability of the seal mechanism.
-Refer to the full warning in the documentation for 
-[Auto Unseal](/vault/docs/concepts/seal#auto-unseal).
-
diff --git a/website/content/api-docs/system/inspect/index.mdx b/website/content/api-docs/system/inspect/index.mdx
deleted file mode 100644
index 3d4e1cb64cd..00000000000
--- a/website/content/api-docs/system/inspect/index.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
----
-layout: api
-page_title: /sys/internal/inspect - HTTP API
-description: >-
-  This endpoint is intended to inspect a specific internal subsystem for debugging purposes, and turned off by default.
-  Once turned on, it can be accessed with a root token or sudo privileges
----
-
-# `/sys/internal/inspect`
-
-The `/sys/internal/inspect` family of endpoints is intended to inspect a specific internal subsystem for debugging purposes.
-This endpoint is off by default. See the
-[Vault configuration documentation](/vault/docs/configuration) to
-enable. Once the endpoint is turned on, it can be accessed with a root token or sudo privileges.
-
-~> **NOTE**: These endpoints are only available in Vault version 1.13+. Backwards compatibility is not guaranteed. These endpoints are subject to change or may disappear without notice.
-
-
-## Supported inspection paths
-
-- [Router](/vault/api-docs/system/inspect/router)
-
diff --git a/website/content/api-docs/system/inspect/router.mdx b/website/content/api-docs/system/inspect/router.mdx
deleted file mode 100644
index 181553f8a57..00000000000
--- a/website/content/api-docs/system/inspect/router.mdx
+++ /dev/null
@@ -1,272 +0,0 @@
----
-layout: api
-page_title: /sys/internal/inspect/router - HTTP API
-description: >-
-  The '/sys/internal/inspect/router' endpoint focuses on viewing the contents of specific structures in the internal router subsystem.
----
-
-# `/sys/internal/inspect/router`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/internal/inspect/router` endpoint is intended for a Vault admin to inspect the internal components of Vault's router.
-This endpoint can be accessed with a root token or sudo privileges.
-
-## Root
-
-This endpoint returns a list of router entries in the router's root tree.
-
-| Method | Path          |
-| :----- | :------------ |
-| `GET`  | `/sys/internal/inspect/router/root` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/internal/inspect/router/root
-```
-
-### Sample response
-```json
-{
-  "request_id": "819de627-d3bc-27f4-0e3c-5c5fb0b204ee",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "root": [
-      {
-        "accessor": "auth_token_d5fcf970",
-        "mount_namespace": "",
-        "mount_path": "token/",
-        "mount_type": "token",
-        "storage_prefix": "sys/token/",
-        "tainted": false,
-        "uuid": "de61dd8c-a181-ccc2-457d-908e417d10b0"
-      },
-      {
-        "accessor": "cubbyhole_58b6727b",
-        "mount_namespace": "",
-        "mount_path": "cubbyhole/",
-        "mount_type": "cubbyhole",
-        "storage_prefix": "logical/496bc2e4-b641-2561-1829-f6557bf1fedc/",
-        "tainted": false,
-        "uuid": "496bc2e4-b641-2561-1829-f6557bf1fedc"
-      },
-      {
-        "accessor": "identity_2ccfb6ab",
-        "mount_namespace": "",
-        "mount_path": "identity/",
-        "mount_type": "identity",
-        "storage_prefix": "logical/b15e93e0-5bf1-07b0-86d3-563f9c77eef1/",
-        "tainted": false,
-        "uuid": "b15e93e0-5bf1-07b0-86d3-563f9c77eef1"
-      },
-      {
-        "accessor": "system_0157e00a",
-        "mount_namespace": "",
-        "mount_path": "sys/",
-        "mount_type": "system",
-        "storage_prefix": "sys/",
-        "tainted": false,
-        "uuid": "8ac2615e-8a73-fe66-52a6-a422f7e3273f"
-      }
-    ]
-  },
-  "warnings": null
-}
-```
-
-## Mount UUID cache
-
-This endpoint returns a list of mount entries in the router's mount UUID cache.
-
-| Method | Path          |
-| :----- | :------------ |
-| `GET`  | `/sys/internal/inspect/router/uuid` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/internal/inspect/router/uuid
-```
-
-### Sample response
-```json
-{
-  "request_id": "71512d6c-bb77-2e05-c24e-07c964139fdb",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "uuid": [
-      {
-        "accessor": "auth_token_d5fcf970",
-        "mount_namespace": "",
-        "mount_path": "token/",
-        "mount_type": "token",
-        "uuid": "de61dd8c-a181-ccc2-457d-908e417d10b0"
-      },
-      {
-        "accessor": "cubbyhole_58b6727b",
-        "mount_namespace": "",
-        "mount_path": "cubbyhole/",
-        "mount_type": "cubbyhole",
-        "uuid": "496bc2e4-b641-2561-1829-f6557bf1fedc"
-      },
-      {
-        "accessor": "system_0157e00a",
-        "mount_namespace": "",
-        "mount_path": "sys/",
-        "mount_type": "system",
-        "uuid": "8ac2615e-8a73-fe66-52a6-a422f7e3273f"
-      },
-      {
-        "accessor": "identity_2ccfb6ab",
-        "mount_namespace": "",
-        "mount_path": "identity/",
-        "mount_type": "identity",
-        "uuid": "b15e93e0-5bf1-07b0-86d3-563f9c77eef1"
-      }
-    ]
-  },
-  "warnings": null
-}
-```
-
-## Mount accessor cache
-
-This endpoint returns a list of mount entries in the router's mount accessor cache.
-
-| Method | Path          |
-| :----- | :------------ |
-| `GET`  | `/sys/internal/inspect/router/accessor` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/internal/inspect/router/accessor
-```
-
-### Sample request
-
-```json
-{
-  "request_id": "4b7de90d-75e0-978f-bc23-23c23b19a604",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "accessor": [
-      {
-        "accessor": "auth_token_d5fcf970",
-        "mount_namespace": "",
-        "mount_path": "token/",
-        "mount_type": "token",
-        "uuid": "de61dd8c-a181-ccc2-457d-908e417d10b0"
-      },
-      {
-        "accessor": "cubbyhole_58b6727b",
-        "mount_namespace": "",
-        "mount_path": "cubbyhole/",
-        "mount_type": "cubbyhole",
-        "uuid": "496bc2e4-b641-2561-1829-f6557bf1fedc"
-      },
-      {
-        "accessor": "identity_2ccfb6ab",
-        "mount_namespace": "",
-        "mount_path": "identity/",
-        "mount_type": "identity",
-        "uuid": "b15e93e0-5bf1-07b0-86d3-563f9c77eef1"
-      },
-      {
-        "accessor": "system_0157e00a",
-        "mount_namespace": "",
-        "mount_path": "sys/",
-        "mount_type": "system",
-        "uuid": "8ac2615e-8a73-fe66-52a6-a422f7e3273f"
-      }
-    ]
-  },
-  "warnings": null
-}
-```
-
-
-## Storage prefix tree
-
-This endpoint returns a list of mount entries in the router's storage prefix tree.
-
-| Method | Path          |
-| :----- | :------------ |
-| `GET`  | `/sys/internal/inspect/router/storage` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/internal/inspect/router/storage
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "ff94bb22-3d4d-8199-6882-f0e4188e10bd",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "storage": [
-      {
-        "accessor": "identity_2ccfb6ab",
-        "mount_namespace": "",
-        "mount_path": "identity/",
-        "mount_type": "identity",
-        "storage_prefix": "logical/b15e93e0-5bf1-07b0-86d3-563f9c77eef1/",
-        "tainted": false,
-        "uuid": "b15e93e0-5bf1-07b0-86d3-563f9c77eef1"
-      },
-      {
-        "accessor": "system_0157e00a",
-        "mount_namespace": "",
-        "mount_path": "sys/",
-        "mount_type": "system",
-        "storage_prefix": "sys/",
-        "tainted": false,
-        "uuid": "8ac2615e-8a73-fe66-52a6-a422f7e3273f"
-      },
-      {
-        "accessor": "auth_token_d5fcf970",
-        "mount_namespace": "",
-        "mount_path": "token/",
-        "mount_type": "token",
-        "storage_prefix": "sys/token/",
-        "tainted": false,
-        "uuid": "de61dd8c-a181-ccc2-457d-908e417d10b0"
-      },
-      {
-        "accessor": "cubbyhole_58b6727b",
-        "mount_namespace": "",
-        "mount_path": "cubbyhole/",
-        "mount_type": "cubbyhole",
-        "storage_prefix": "logical/496bc2e4-b641-2561-1829-f6557bf1fedc/",
-        "tainted": false,
-        "uuid": "496bc2e4-b641-2561-1829-f6557bf1fedc"
-      }
-    ]
-  },
-  "warnings": null
-}
-```
-
-
-
-
diff --git a/website/content/api-docs/system/internal-counters.mdx b/website/content/api-docs/system/internal-counters.mdx
deleted file mode 100644
index f4bf44beacc..00000000000
--- a/website/content/api-docs/system/internal-counters.mdx
+++ /dev/null
@@ -1,1002 +0,0 @@
----
-layout: api
-page_title: /sys/internal/counters - HTTP API
-description: >-
-  The `/sys/internal/counters` endpoints are used to return data about Vault usage.
----
-
-# `/sys/internal/counters`
-
-The `/sys/internal/counters` endpoints are used to return data about the number of Tokens and Entities in Vault. They return information for the entire cluster.
-
-## Entities
-
-This endpoint returns the total number of Entities.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `GET`  | `/sys/internal/counters/entities` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/internal/counters/entities
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "75cbaa46-e741-3eba-2be2-325b1ba8f03f",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "counters": {
-      "entities": {
-        "total": 1
-      }
-    }
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Tokens
-
-This endpoint returns the total number of Tokens.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `GET`  | `/sys/internal/counters/tokens` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/internal/counters/tokens
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "75cbaa46-e741-3eba-2be2-325b1ba8f03f",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "counters": {
-      "service_tokens": {
-        "total": 1
-      }
-    }
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Client count
-
-This endpoint returns client activity information for a given billing
-period, which is represented by the `start_time` and `end_time` parameters.
-
-There are a few things to keep in mind while using this API.
-
-- For Vault versions before 1.11, the activity information only accounts for
-the activity of the latest contiguous months in the billing period.
-For example, if the billing period is from Jan 2022 to June 2022, and the
-activity subsystem in Vault was not capturing data for the months Jan to March,
-the response will only include information for May and June. Note that if no
-`start_time` and `end_time` parameters are specified, the billing period defaults
-to 12 months, so the endpoint will return activity information from the end of the
-previous month to the start of 12 months prior to that date.
-
-- As of 1.11, this behavior has been modified to return all available data within
-the specified billing period.
-
-- As of 1.12, the `end_time` can be the current month.
-
-- The response contains the total activity for the billing period and the
-attributions of the total activity against specific components in Vault. This
-helps in understanding the total activity better by knowing which components in
-Vault lead to that top-level activity count. First-level of attribution
-breakdowns are by namespaces and months, under the `by_namespaces` and `months`
-JSON block, respectively.
-
-```json
-{
-   "by_namespace":[],
-   "months":[],
-}
-```
-
-- `by_namespaces` breakdowns provide attributions of each namespace to the total
-activity count. Mount level attributions further break down these namespaces
-attributions, wherein information can be found on the attributions of each mount
-path within a given namespace to the overall activity of the namespace.
-
-```json
-{
-   "by_namespace":[
-      {
-         "namespace_id":"root",
-         "namespace_path":"",
-         "counts":{},
-         "mounts":[
-            {
-               "path":"auth/up1/",
-               "counts":{}
-            },
-            {
-               "path":"auth/up2/",
-               "counts":{}
-            }
-         ]
-      }
-   ]
-}
-```
-
-- `months` breakdowns provide attributions of each month to the total activity
-count. These month-level attributions are further broken down into namespace and mount
-level attributions for each month.
-
-```json
-{
-   "months":[
-      {
-         "timestamp":"2021-05-01T00:00:00Z",
-         "counts":{},
-         "namespaces":[
-            {
-               "namespace_id":"root",
-               "namespace_path":"",
-               "counts":{},
-               "mounts":[
-                  {
-                     "path":"auth/up2/",
-                     "counts":{}
-                  },
-                  {
-                     "path":"auth/up1/",
-                     "counts":{}
-                  }
-               ]
-            },
-            {
-               "namespace_id":"s07UR",
-               "namespace_path":"ns1/",
-               "counts":{},
-               "mounts":[
-                  {
-                     "path":"auth/up1/",
-                     "counts":{}
-                  },
-                  {
-                     "path":"auth/up2/",
-                     "counts":{}
-                  }
-               ]
-            }
-         ],
-         "new_clients":{}
-      }
-   ],
-}
-```
-
-- Each entry in the `months` breakdown contains a `new_clients` block. When a
-token is first used within a billing period, it is considered a new client for
-that billing period. This means that all the active clients in the first month
-of the billing period will be considered new clients for that billing period.
-While these tokens could be generated and counted in the previous billing
-period, they are still considered new clients in the context of the given
-billing period. For each subsequent month in the same billing period, the tokens
-used in those months that were unused in previous months of the same billing
-period are considered new clients for that month. Hence, the computation of new
-clients differs for each combination of `start_time` and `end_time`.
-
-- The `new_clients` block within the `months` breakdown will also be further
-broken down by namespaces and mounts for visibility into which components in
-Vault lead to the new clients for each month.
-
-```json
-{
-   "months":[
-      {
-         "new_clients":{
-            "counts":{},
-            "namespaces":[
-               {
-                  "namespace_id":"root",
-                  "namespace_path":"",
-                  "counts":{},
-                  "mounts":[
-                     {
-                        "path":"auth/up2/",
-                        "counts":{}
-                     },
-                     {
-                        "path":"auth/up1/",
-                        "counts":{}
-                     }
-                  ]
-               }
-            ]
-         }
-      }
-   ],
-}
-```
-
-- The `distinct_entities` field name has been deprecated since Vault 1.10. Refer to
-`entity_clients` field instead. The `distinct_entities` field is currently
-returned by the API for backward compatibility and it may be removed in the future.
-
-- The `non_entity_tokens` field name has been deprecated since Vault 1.10. Refer to
-`non_entity_clients` field instead. The `non_entity_tokens` field is currently
-returned by the API for backward compatibility, and it may be removed in the future.
-
-- If the `end_date` supplied to the API is for the current month, the activity
-information returned by this API will only be till the previous month. The
-activity system is designed to process the accumulated activity only at the end
-of the month. Since the system does not fully process the current month's
-information, it will not be added to the API response.
-
-- The response includes the actual time period covered, which may not exactly
-match the query parameters due to the month granularity of data or missing
-months in the requested time range.
-
-- Note that if the `end_date` specified is the current month,
-the last element in the `months` response stanza, signifying the current month, will
-not have namespace attribution for the `new_clients` stanza. Furthermore, the
-`new_clients` counts returned for the current month will be an approximation.
-That is to say, the response will appear as follows.
-
-```json
-{
-   "months":[
-      {
-         "timestamp":"current_month_timestamp",
-         "counts":{
-            "distinct_entities":"exact int value",
-            "entity_clients":"exact int value",
-            "non_entity_tokens":"exact int value",
-            "non_entity_clients":"exact int value",
-            "clients":"exact int value"
-         },
-         "namespaces": [
-               {
-                  "namespace_id":"root",
-                  "namespace_path":"path",
-                  "counts":{
-                     "distinct_entities":"exact int value",
-                     "entity_clients":"exact int value",
-                     "non_entity_tokens":"exact int value",
-                     "non_entity_clients":"exact int value",
-                     "clients":"exact int value"
-                  },
-                  "mounts":[
-                     {
-                        "path":"auth/up2/",
-                        "counts":{
-                           "distinct_entities":"exact int value",
-                           "entity_clients":"exact int value",
-                           "non_entity_tokens":"exact int value",
-                           "non_entity_clients":"exact int value",
-                           "clients":"exact int value"
-                        },
-                     },
-                  ]
-               },
-         ],
-         "new_clients":{
-            "counts":{
-               "distinct_entities":"approx int value",
-               "entity_clients":"approx int value",
-               "non_entity_tokens":"approx int value",
-               "non_entity_clients":"approx int value",
-               "clients":"approx int value"
-            },
-            "namespaces":[]
-         }
-      }
-   ],
-}
-```
-
-
-Please visit the [client count](/vault/docs/concepts/client-count) concepts page for
-more information on how clients map to these client IDs and how they are
-counted, or for more information about how the new clients for the current month
-are estimated in a billing period.
-
-The response will include all child namespaces of the namespace in which the
-request was made. If some namespace has subsequently been deleted, its path will
-be listed as "deleted namespace :ID:." Deleted namespaces are reported only for
-queries in the root namespace because the information about the namespace path
-is unknown.
-
-This endpoint was added in Vault 1.6.
-
-@include 'alerts/restricted-root.mdx'
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `GET`  | `/sys/internal/counters/activity` |
-
-### Parameters
-
-- `start_time` `(string, optional)` - An RFC3339 timestamp or Unix epoch time. Specifies the start of the
-  period for which client counts will be reported. If no start time is specified, the `default_report_months`
-  prior to the `end_time` will be used.
-- `end_time` `(string, optional)` - An RFC3339 timestamp or Unix epoch time. Specifies the end of the period
-  for which client counts will be reported. If no end time is specified, the end of the previous calendar
-  month will be used.
-- `limit_namespaces` `(int, optional)` - Controls the total number of by_namespace data returned. This can
-   be used to return the client counts for the specified number of namespaces having highest activity.
-   If no `limit_namespaces` parameter is specified, client counts for all namespaces in specified usage period is returned.
-- `current_billing_period` `(bool, optional)` - Uses the builtin billing start
-  timestamp as `start_time` and the current time as the `end_time`, returning a
-  response with the current billing period information without having to
-  explicitly provide a start and end time.
-
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/internal/counters/activity
-```
-
-### Sample response
-
-```json
-{
-   "request_id":"26be5ab9-dcac-9237-ec12-269a8ca647d5",
-   "lease_id":"",
-   "renewable":false,
-   "lease_duration":0,
-   "data":{
-      "by_namespace":[
-         {
-            "namespace_id":"root",
-            "namespace_path":"",
-            "counts":{
-               "distinct_entities":20,
-               "entity_clients":20,
-               "non_entity_tokens":10,
-               "non_entity_clients":10,
-               "clients":30
-            },
-            "mounts":[
-               {
-                  "path":"auth/up1/",
-                  "counts":{
-                     "distinct_entities":10,
-                     "entity_clients":10,
-                     "non_entity_tokens":10,
-                     "non_entity_clients":10,
-                     "clients":20
-                  }
-               },
-               {
-                  "path":"auth/up2/",
-                  "counts":{
-                     "distinct_entities":5,
-                     "entity_clients":5,
-                     "non_entity_tokens":5,
-                     "non_entity_clients":5,
-                     "clients":10
-                  }
-               }
-            ]
-         },
-         {
-            "namespace_id":"s07UR",
-            "namespace_path":"ns1/",
-            "counts":{
-               "distinct_entities":5,
-               "entity_clients":5,
-               "non_entity_tokens":5,
-               "non_entity_clients":5,
-               "clients":10
-            },
-            "mounts":[
-               {
-                  "path":"auth/up1/",
-                  "counts":{
-                     "distinct_entities":0,
-                     "entity_clients":0,
-                     "non_entity_tokens":5,
-                     "non_entity_clients":5,
-                     "clients":5
-                  }
-               },
-               {
-                  "path":"auth/up2/",
-                  "counts":{
-                     "distinct_entities":5,
-                     "entity_clients":5,
-                     "non_entity_tokens":0,
-                     "non_entity_clients":0,
-                     "clients":5
-                  }
-               }
-            ]
-         }
-      ],
-      "end_time":"2021-05-31T23:59:59Z",
-      "months":[
-         {
-            "timestamp":"2021-05-01T00:00:00Z",
-            "counts":{
-               "distinct_entities":20,
-               "entity_clients":20,
-               "non_entity_tokens":10,
-               "non_entity_clients":10,
-               "clients":30
-            },
-            "namespaces":[
-               {
-                  "namespace_id":"root",
-                  "namespace_path":"",
-                  "counts":{
-                     "distinct_entities":15,
-                     "entity_clients":15,
-                     "non_entity_tokens":5,
-                     "non_entity_clients":5,
-                     "clients":20
-                  },
-                  "mounts":[
-                     {
-                        "path":"auth/up2/",
-                        "counts":{
-                           "distinct_entities":10,
-                           "entity_clients":10,
-                           "non_entity_tokens":5,
-                           "non_entity_clients":5,
-                           "clients":15
-                        }
-                     },
-                     {
-                        "path":"auth/up1/",
-                        "counts":{
-                           "distinct_entities":3,
-                           "entity_clients":3,
-                           "non_entity_tokens":2,
-                           "non_entity_clients":2,
-                           "clients":5
-                        }
-                     }
-                  ]
-               },
-               {
-                  "namespace_id":"s07UR",
-                  "namespace_path":"ns1/",
-                  "counts":{
-                     "distinct_entities":5,
-                     "entity_clients":5,
-                     "non_entity_tokens":5,
-                     "non_entity_clients":5,
-                     "clients":10
-                  },
-                  "mounts":[
-                     {
-                        "path":"auth/up1/",
-                        "counts":{
-                           "distinct_entities":0,
-                           "entity_clients":0,
-                           "non_entity_tokens":5,
-                           "non_entity_clients":5,
-                           "clients":5
-                        }
-                     },
-                     {
-                        "path":"auth/up2/",
-                        "counts":{
-                           "distinct_entities":5,
-                           "entity_clients":5,
-                           "non_entity_tokens":0,
-                           "non_entity_clients":0,
-                           "clients":5
-                        }
-                     }
-                  ]
-               }
-            ],
-            "new_clients":{
-               "counts":{
-                  "distinct_entities":10,
-                  "entity_clients":10,
-                  "non_entity_tokens":10,
-                  "non_entity_clients":10,
-                  "clients":20
-               },
-               "namespaces":[
-                  {
-                     "namespace_id":"root",
-                     "namespace_path":"",
-                     "counts":{
-                        "distinct_entities":5,
-                        "entity_clients":5,
-                        "non_entity_tokens":5,
-                        "non_entity_clients":5,
-                        "clients":10
-                     },
-                     "mounts":[
-                        {
-                           "path":"auth/up2/",
-                           "counts":{
-                              "distinct_entities":0,
-                              "entity_clients":0,
-                              "non_entity_tokens":5,
-                              "non_entity_clients":5,
-                              "clients":5
-                           }
-                        },
-                        {
-                           "path":"auth/up1/",
-                           "counts":{
-                              "distinct_entities":5,
-                              "entity_clients":5,
-                              "non_entity_tokens":0,
-                              "non_entity_clients":0,
-                              "clients":5
-                           }
-                        }
-                     ]
-                  },
-                  {
-                     "namespace_id":"s07UR",
-                     "namespace_path":"ns1/",
-                     "counts":{
-                        "distinct_entities":5,
-                        "entity_clients":5,
-                        "non_entity_tokens":5,
-                        "non_entity_clients":5,
-                        "clients":10
-                     },
-                     "mounts":[
-                        {
-                           "path":"auth/up1/",
-                           "counts":{
-                              "distinct_entities":0,
-                              "entity_clients":0,
-                              "non_entity_tokens":5,
-                              "non_entity_clients":5,
-                              "clients":5
-                           }
-                        },
-                        {
-                           "path":"auth/up2/",
-                           "counts":{
-                              "distinct_entities":5,
-                              "entity_clients":5,
-                              "non_entity_tokens":0,
-                              "non_entity_clients":0,
-                              "clients":5
-                           }
-                        }
-                     ]
-                  }
-               ]
-            }
-         },
-         {
-            "timestamp":"2021-04-01T00:00:00Z",
-            "counts":{
-               "distinct_entities":5,
-               "entity_clients":5,
-               "non_entity_tokens":5,
-               "non_entity_clients":5,
-               "clients":10
-            },
-            "namespaces":[
-               {
-                  "namespace_id":"root",
-                  "namespace_path":"",
-                  "counts":{
-                     "distinct_entities":5,
-                     "entity_clients":5,
-                     "non_entity_tokens":5,
-                     "non_entity_clients":5,
-                     "clients":10
-                  },
-                  "mounts":[
-                     {
-                        "path":"auth/up1/",
-                        "counts":{
-                           "distinct_entities":0,
-                           "entity_clients":0,
-                           "non_entity_tokens":5,
-                           "non_entity_clients":5,
-                           "clients":5
-                        }
-                     },
-                     {
-                        "path":"auth/up2/",
-                        "counts":{
-                           "distinct_entities":5,
-                           "entity_clients":5,
-                           "non_entity_tokens":0,
-                           "non_entity_clients":0,
-                           "clients":5
-                        }
-                     }
-                  ]
-               }
-            ],
-            "new_clients":{
-               "counts":{
-                  "distinct_entities":5,
-                  "entity_clients":5,
-                  "non_entity_tokens":5,
-                  "non_entity_clients":5,
-                  "clients":10
-               },
-               "namespaces":[
-                  {
-                     "namespace_id":"root",
-                     "namespace_path":"",
-                     "counts":{
-                        "distinct_entities":5,
-                        "entity_clients":5,
-                        "non_entity_tokens":5,
-                        "non_entity_clients":5,
-                        "clients":10
-                     },
-                     "mounts":[
-                        {
-                           "path":"auth/up1/",
-                           "counts":{
-                              "distinct_entities":0,
-                              "entity_clients":0,
-                              "non_entity_tokens":5,
-                              "non_entity_clients":5,
-                              "clients":5
-                           }
-                        },
-                        {
-                           "path":"auth/up2/",
-                           "counts":{
-                              "distinct_entities":5,
-                              "entity_clients":5,
-                              "non_entity_tokens":0,
-                              "non_entity_clients":0,
-                              "clients":5
-                           }
-                        }
-                     ]
-                  }
-               ]
-            }
-         }
-      ],
-      "start_time":"2021-01-01T00:00:00Z",
-      "total":{
-         "distinct_entities":20,
-         "entity_clients":20,
-         "non_entity_tokens":20,
-         "non_entity_clients":20,
-         "clients":40
-      }
-   },
-   "wrap_info":null,
-   "warnings":null,
-   "auth":null
-}
-```
-
-### Sample request for a single month
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/internal/counters/activity?end_time=2020-06-30T00%3A00%3A00Z&start_time=2020-06-01T00%3A00%3A00Z
-```
-
-### Sample request to get client counts for top 2 namespaces with highest activity for a usage period
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/internal/counters/activity?end_time=2020-06-30T00%3A00%3A00Z&start_time=2020-06-01T00%3A00%3A00Z&limit_namespaces=2
-```
-
-## Partial month client count
-
-This endpoint returns the client activity in the current month. The response
-will have activity attributions per namespace, per mount within each namespaces,
-and new clients information.
-
-The time period is from the start of the current month, up until the time that
-this request was made.
-
-Note: the client count may be inaccurate in the moments following a Vault
-reboot, or leadership change. The estimate will stabilize when background
-loading of client data has completed.
-
-This endpoint was added in Vault 1.7.
-
-@include 'alerts/restricted-root.mdx'
-
-| Method | Path                                      |
-| :----- | :---------------------------------------- |
-| `GET`  | `/sys/internal/counters/activity/monthly` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/internal/counters/activity/monthly
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "d0d37f90-96ec-28c7-b59c-b53612cbbcad",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "by_namespace": [
-      {
-        "counts": {
-          "clients": 1,
-          "distinct_entities": 0,
-          "entity_clients": 0,
-          "non_entity_clients": 1,
-          "non_entity_tokens": 1
-        },
-        "mounts": [
-          {
-            "counts": {
-              "clients": 1,
-              "distinct_entities": 0,
-              "entity_clients": 0,
-              "non_entity_clients": 1,
-              "non_entity_tokens": 0
-            },
-            "mount_path": "auth_token_0747d59c"
-          }
-        ],
-        "namespace_id": "root",
-        "namespace_path": ""
-      }
-    ],
-    "clients": 1,
-    "distinct_entities": 0,
-    "entity_clients": 0,
-    "months": [
-      {
-        "counts": {
-          "clients": 1,
-          "distinct_entities": 0,
-          "entity_clients": 0,
-          "non_entity_clients": 1,
-          "non_entity_tokens": 0
-        },
-        "namespaces": [
-          {
-            "counts": {
-              "clients": 1,
-              "distinct_entities": 0,
-              "entity_clients": 0,
-              "non_entity_clients": 1,
-              "non_entity_tokens": 0
-            },
-            "mounts": [
-              {
-                "counts": {
-                  "clients": 1,
-                  "distinct_entities": 0,
-                  "entity_clients": 0,
-                  "non_entity_clients": 1,
-                  "non_entity_tokens": 0
-                },
-                "mount_path": "auth_token_0747d59c"
-              }
-            ],
-            "namespace_id": "root",
-            "namespace_path": ""
-          }
-        ],
-        "new_clients": {
-          "counts": {
-            "clients": 1,
-            "distinct_entities": 0,
-            "entity_clients": 0,
-            "non_entity_clients": 1,
-            "non_entity_tokens": 0
-          },
-          "namespaces": [
-            {
-              "counts": {
-                "clients": 1,
-                "distinct_entities": 0,
-                "entity_clients": 0,
-                "non_entity_clients": 1,
-                "non_entity_tokens": 0
-              },
-              "mounts": [
-                {
-                  "counts": {
-                    "clients": 1,
-                    "distinct_entities": 0,
-                    "entity_clients": 0,
-                    "non_entity_clients": 1,
-                    "non_entity_tokens": 0
-                  },
-                  "mount_path": "auth_token_0747d59c"
-                }
-              ],
-              "namespace_id": "root",
-              "namespace_path": ""
-            }
-          ]
-        },
-        "timestamp": "2022-04-01T04:00:00Z"
-      }
-    ],
-    "non_entity_clients": 1,
-    "non_entity_tokens": 1
-  },
-  "warnings": null
-}
-```
-
-## Update the client count configuration
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/internal/counters/config` endpoint is used to configure logging of active clients.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `POST` | `/sys/internal/counters/config` |
-
-### Parameters
-
-- `default_report_months` `(integer: 12)` - The number of months to report if no `start_time` is specified in a query.
-- `enabled` `(string: enable, disable, default)` - Enable or disable counting of client activity. When set to `default`, the client
-  counts are enabled on Enterprise builds and disabled on community builds. Disabling the feature during the middle of a month will
-  discard any data recorded for that month, but does not delete previous months.
-- `retention_months` `(integer: 24)` - The number of months of history to retain.
-
-Any missing parameters are left at their existing value.
-
-### Sample payload
-
-```json
-{
-  "enabled": "enable",
-  "default_report_months": 3,
-  "retention_months": 12
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST
-    --header "X-Vault-Token: ..." \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/internal/counters/config
-```
-
-## Read the client count configuration
-
-Reading the configuration shows the current settings, as well as a flag as to whether any data can be queried.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `GET` | `/sys/internal/counters/config` |
-
-- `enabled` `(string)` - returns `default-enabled` or `default-disabled` if the configuration is `default`.
-- `queries_available` `(bool)` - indicates whether any usage report is available. This will initially be
-  false until the end of the first calendar month after the feature is enabled.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/internal/counters/config
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "25a94b99-b49a-c4ac-cb7b-5ba0eb390a25",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "default_report_months": 12,
-    "enabled": "default-enabled",
-    "queries_available": true,
-    "retention_months": 24,
-    "reporting_enabled": false,
-    "billing_start_timestamp": "2022-03-01T00:00:00Z",
-  },
-  "warnings": null
-}
-```
-
-## Activity export
-
-This endpoint returns an export of the clients that had activity within the
-provided start and end times. The returned set of client information will be
-deduplicated over the time window and will show the earliest activity logged for
-each client. The output will be ordered chronologically by month of activity.
-
-~> **NOTE**: This endpoint is currently in tech preview status.
-
-There are a few things to keep in mind while using this API.
-
-- The response includes the actual time period covered, which may not exactly
-match the query parameters due to the month granularity of data or missing
-months in the requested time range.
-
-- If the `end_date` supplied to the API is for the current month, the activity
-information returned by this API will include activity for this month, however
-it may be up to 20 minutes delayed.
-
-This endpoint was added in Vault 1.11.
-
-@include 'alerts/restricted-root.mdx'
-
-| Method | Path                                      |
-| :----- | :---------------------------------------- |
-| `GET`  | `/sys/internal/counters/activity/export` |
-
-### Parameters
-
-- `start_time` `(string, optional)` - An RFC3339 timestamp or Unix epoch time. Specifies the start of the
-  period for which client counts will be reported. If no start time is specified, the `default_report_months`
-  prior to the `end_time` will be used.
-- `end_time` `(string, optional)` - An RFC3339 timestamp or Unix epoch time. Specifies the end of the period
-  for which client counts will be reported. If no end time is specified, the end of the previous calendar
-  month will be used.
-- `format` `(string, optional)` - The desired format of the output file. Allowed
-    values are `csv` and `json`. If no format is provided a default of `json`
-    will be used.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/internal/counters/activity/export
-```
-
-### Sample response
-
-```json
-{"client_id":"3f210722-7210-98e8-1f0d-e6a39ffb29c6","namespace_id":"root","timestamp":1653350457,"mount_accessor":"auth_userpass_bb52979d"}
-{"client_id":"X/Yed4Oj4cqODj9tSHjKwnRy5QVSBRlX3COxjjWSXyI=","namespace_id":"root","timestamp":1653350491,"non_entity":true,"mount_accessor":"auth_token_f6f2c11c"}
-{"client_id":"d93405dc-b592-b1c3-a520-14e618d359c1","namespace_id":"root","timestamp":1653350501,"mount_accessor":"auth_userpass_bb52979d"}
-```
-
diff --git a/website/content/api-docs/system/internal-specs-openapi.mdx b/website/content/api-docs/system/internal-specs-openapi.mdx
deleted file mode 100644
index 0ffc62dce9b..00000000000
--- a/website/content/api-docs/system/internal-specs-openapi.mdx
+++ /dev/null
@@ -1,75 +0,0 @@
----
-layout: api
-page_title: /sys/internal/specs/openapi - HTTP API
-description: >-
-  The `/sys/internal/specs/openapi` endpoint is used to generate an OpenAPI
-  document of the mounted backends.
----
-
-# `/sys/internal/specs/openapi`
-
-The `/sys/internal/specs/openapi` endpoint is used to generate an OpenAPI document of the mounted backends.
-The response conforms to the [OpenAPI V3 specification](https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.2.md),
-with path names matching the mount names used by the Vault server (i.e. customizations with `-path` will be reflected).
-The set of included paths is based on the permissions of the request token.
-
-The response may include Vault-specific [extensions](https://github.com/oai/openapi-specification/blob/master/versions/3.0.2.md#specification-extensions). Three are currently defined:
-
-- `x-vault-sudo` - Endpoint requires [sudo](/vault/docs/concepts/policies#sudo) privileges.
-- `x-vault-unauthenticated` - Endpoint is unauthenticated.
-- `x-vault-create-supported` - Endpoint allows creation of new items, in addition to updating existing items.
-
-Basic documentation will be generated for all paths, but a newer path definition structure now allows for
-more detailed documentation to be added. At this time the `/sys` endpoints have been updated to use the new
-structure, and other endpoints will be modified incrementally.
-
-## Get OpenAPI document
-
-This endpoint returns a single OpenAPI document describing all paths visible to the requester.
-
-| Method | Path                          |
-| :----- | :---------------------------- |
-| `GET`  | `/sys/internal/specs/openapi` |
-
-### Parameters
-
-- `generic_mount_paths` `(bool: false)` – Used to specify whether to use generic mount paths. If set, the mount paths will be replaced with a dynamic parameter: `{mountPath}`
-
-
-### Sample request
-
-```shell-session
-$ curl http://127.0.0.1:8200/v1/sys/internal/specs/openapi?generic_mount_paths=false
-```
-
-### Sample response
-
-```json
-{
-  "openapi": "3.0.2",
-  "info": {
-    "title": "HashiCorp Vault API",
-    "description": "HTTP API that gives you full access to Vault. All API routes are prefixed with `/v1/`.",
-    "version": "1.0.0",
-    "license": {
-      "name": "Mozilla Public License 2.0",
-      "url": "https://www.mozilla.org/en-US/MPL/2.0"
-    }
-  },
-  "paths": {
-    "/auth/token/create": {
-      "description": "The token create path is used to create new tokens.",
-      "post": {
-        "summary": "The token create path is used to create new tokens.",
-        "tags": [
-          "auth"
-        ],
-        "responses": {
-          "200": {
-            "description": "OK"
-          }
-        }
-      }
-    },
-    ...
-```
diff --git a/website/content/api-docs/system/internal-ui-authenticated-messages.mdx b/website/content/api-docs/system/internal-ui-authenticated-messages.mdx
deleted file mode 100644
index add1485d2b9..00000000000
--- a/website/content/api-docs/system/internal-ui-authenticated-messages.mdx
+++ /dev/null
@@ -1,59 +0,0 @@
----
-layout: api
-page_title: /sys/internal/ui/authenticated-messages - HTTP API
-description: >-
-  The `/sys/internal/ui/authenticated-messages` endpoint retrieves active post-login custom messages.
----
-
-# `/sys/internal/ui/authenticated-messages`
-
-The `/sys/internal/ui/authenticated-messages` endpoint is used by the UI to
-retrieve the active post-login custom messages so that it can display them.
-
-When retrieving custom messages, the results will include active messages from
-the current namespace along with custom messages that exist all of the ancestral
-namespaces up to and including the root namespace.
-
-This should only be used internally by the UI. Due to the nature of its
-intended usage, there is no guarantee on backwards compatibility for this endpoint.
-
-## Get post-login custom messages
-
-This endpoint lists the active post-login custom messages.
-
-| Method | Path                                        |
-| :----- | :------------------------------------------ |
-| `GET`  | `/sys/internal/ui/authenticated-messages` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/internal/ui/authenticated-messages
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "key_info": {
-      "01234567-89ab-cdef-0123-456789abcdef": {
-        "title": "Post-login Advisory",
-        "message": "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur nulla augue, placerat quis risus blandit, molestie imperdiet massa. Sed blandit rutrum odio quis varius. Fusce purus orci, maximus ac libero.",
-        "type": "modal",
-        "authenticated": true,
-        "start_time": "2024-01-01T00:00:00.000000000Z",
-        "end_time": null,
-        "options": null,
-        "link": {
-          "Details": "https://www.example.org/details"
-        }
-      }
-    },
-    "keys": [
-      "01234567-89ab-cdef-0123-456789abcdef"
-    ]
-  }
-}
-```
diff --git a/website/content/api-docs/system/internal-ui-feature.mdx b/website/content/api-docs/system/internal-ui-feature.mdx
deleted file mode 100644
index 138a807e0de..00000000000
--- a/website/content/api-docs/system/internal-ui-feature.mdx
+++ /dev/null
@@ -1,38 +0,0 @@
----
-layout: api
-page_title: /sys/internal/ui/feature-flags - HTTP API
-description: >-
-  The `/sys/internal/ui/feature-flags` endpoint exposes feature flags to the UI.
----
-
-# `/sys/internal/ui/feature-flags`
-
-The `/sys/internal/ui/feature-flags` endpoint is used to expose feature flags
-to the UI so that it can change its behavior in response, even before a user logs in.
-
-This is currently only being used internally for the UI and is
-an unauthenticated endpoint. Due to the nature of its intended usage, there is no
-guarantee on backwards compatibility for this endpoint.
-
-## Get enabled feature flags
-
-This endpoint lists the enabled feature flags relevant to the UI.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `GET`  | `/sys/internal/ui/feature-flags` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/internal/ui/feature-flags
-```
-
-### Sample response
-
-```json
-{
-  "feature-flags": []
-}
-```
diff --git a/website/content/api-docs/system/internal-ui-mounts.mdx b/website/content/api-docs/system/internal-ui-mounts.mdx
deleted file mode 100644
index c3815a2c32d..00000000000
--- a/website/content/api-docs/system/internal-ui-mounts.mdx
+++ /dev/null
@@ -1,113 +0,0 @@
----
-layout: api
-page_title: /sys/internal/ui/mounts - HTTP API
-description: >-
-  The `/sys/internal/ui/mounts` endpoint is used to manage mount listing
-  visibility.
----
-
-# `/sys/internal/ui/mounts`
-
-The `/sys/internal/ui/mounts` endpoint is used to manage mount listing
-visibility. The response generated by this endpoint is based on the
-`listing_visibility` value on the mount, which can be set during mount time or
-via mount tuning. This is currently only being used internally, for the UI and
-for CLI preflight checks, and is an unauthenticated endpoint.
-
-If called with a valid token in `X-Vault-Token` header, the response will
-include additional mounts which the token has been granted path capabilities on.
-
-Due to the nature of its intended usage, there is no guarantee on backwards
-compatibility for this endpoint.
-
-## Get available visible mounts
-
-This endpoint lists all enabled auth methods.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/sys/internal/ui/mounts` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/internal/ui/mounts
-```
-
-### Sample response
-
-```json
-{
-  "auth": {
-    "github/": {
-      "description": "GitHub auth",
-      "type": "github"
-    }
-  },
-  "secret": {
-    "custom-secrets/": {
-      "description": "Custom secrets",
-      "options": {
-        "version": "2"
-      },
-      "type": "kv"
-    }
-  }
-}
-```
-
-## Get single mount details
-
-This endpoint lists details for a specific mount path. This is an
-authenticated endpoint, and is currently only being used internally.
-
-The calling token should not be granted permissions to these API endpoints
-directly, but instead rely on permissions granted to the individual mount path.
-This means that if you give a token a policy with capabilities on a `:path`
-(e.g. `/secret/*`), the token will be able to call
-`sys/internal/ui/mounts/:path` (e.g. `sys/internal/ui/mounts/secret`) without
-having to add that literal path to the policy document.
-
-On certain mounts, it is possible to call an arbitrary path within the engine
-(for example, `/sys/internal/ui/mounts/secret/path/to/secret` when the mount
-path is `/secret`). If called in this manner, then this endpoint will return the
-data for the mount that hosts that path. Therefore, a call to
-`/sys/internal/ui/mounts/secret/path/to/secret` and a call to
-`/sys/internal/ui/mounts/secret` will yield an identical response.
-
-Due to the nature of its intended usage, there is no guarantee on backwards
-compatibility for this endpoint.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `GET`  | `/sys/internal/ui/mounts/:path` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/internal/ui/mounts/cubbyhole
-```
-
-### Sample response
-
-```json
-{
-  "accessor": "cubbyhole_50fbe8d2",
-  "config": {
-    "default_lease_ttl": 0,
-    "force_no_cache": false,
-    "max_lease_ttl": 0
-  },
-  "description": "per-token private secret storage",
-  "external_entropy_access": false,
-  "local": true,
-  "options": null,
-  "path": "cubbyhole/",
-  "seal_wrap": false,
-  "type": "cubbyhole",
-  "uuid": "4bb40403-d9ba-d2ee-087a-4c6d371db5f2"
-}
-```
diff --git a/website/content/api-docs/system/internal-ui-namespaces.mdx b/website/content/api-docs/system/internal-ui-namespaces.mdx
deleted file mode 100644
index d6019ccefe2..00000000000
--- a/website/content/api-docs/system/internal-ui-namespaces.mdx
+++ /dev/null
@@ -1,38 +0,0 @@
----
-layout: api
-page_title: /sys/internal/ui/namespaces - HTTP API
-description: >-
-  The `/sys/internal/ui/namespaces` endpoint exposes namespaces to the UI.
----
-
-# `/sys/internal/ui/namespaces`
-
-The `/sys/internal/ui/namespaces` endpoint is used to expose namespaces
-to the UI so that it can change its behavior in response, even before a user logs in.
-
-This is currently only being used internally for the UI and is
-an unauthenticated endpoint. Due to the nature of its intended usage, there is no
-guarantee on backwards compatibility for this endpoint.
-
-## Get namespaces
-
-This endpoint lists the namespaces relevant to the UI.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `GET`  | `/sys/internal/ui/namespaces` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/internal/ui/namespaces
-```
-
-### Sample response
-
-```json
-{
-  "namespaces": []
-}
-```
diff --git a/website/content/api-docs/system/internal-ui-resultant-acl.mdx b/website/content/api-docs/system/internal-ui-resultant-acl.mdx
deleted file mode 100644
index d2990a9cef8..00000000000
--- a/website/content/api-docs/system/internal-ui-resultant-acl.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
----
-layout: api
-page_title: /sys/internal/ui/resultant-acl - HTTP API
-description: >-
-  The `/sys/internal/ui/resultant-acl` endpoint exposes resultant-acl to the UI.
----
-
-# `/sys/internal/ui/resultant-acl`
-
-The `/sys/internal/ui/resultant-acl` endpoint is used to expose resultant-acl
-to the UI so that it can change its behavior in response.
-
-This is currently only being used internally for the UI. Due to the nature of its
-intended usage, there is no guarantee on backwards compatibility for this endpoint.
-
-## Get resultant-acl
-
-This endpoint lists the resultant-acl relevant to the UI.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `GET`  | `/sys/internal/ui/resultant-acl` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/internal/ui/resultant-acl
-```
-
-### Sample response
-
-```json
-{
-  "resultant-acl": []
-}
-```
diff --git a/website/content/api-docs/system/internal-ui-unauthenticated-messages.mdx b/website/content/api-docs/system/internal-ui-unauthenticated-messages.mdx
deleted file mode 100644
index 0b4f76812de..00000000000
--- a/website/content/api-docs/system/internal-ui-unauthenticated-messages.mdx
+++ /dev/null
@@ -1,58 +0,0 @@
----
-layout: api
-page_title: /sys/internal/ui/unauthenticated-messages - HTTP API
-description: >-
-  The `/sys/internal/ui/unauthenticated-messages` endpoint retrieves active pre-login custom messages.
----
-
-# `/sys/internal/ui/unauthenticated-messages`
-
-The `/sys/internal/ui/unauthenticated-messages` endpoint is used by the UI to
-retrieve the active pre-login custom messages so that it can display them.
-
-When retrieving custom messages, the results will include active messages from
-the current namespace along with custom messages that exist all of the ancestral
-namespaces up to and including the root namespace.
-This should only be used internally by the UI. Due to the nature of its
-intended usage, there is no guarantee on backwards compatibility for this endpoint.
-
-## Get pre-login custom messages
-
-This endpoint lists the active pre-login custom messages.
-
-| Method | Path                                        |
-| :----- | :------------------------------------------ |
-| `GET`  | `/sys/internal/ui/unauthenticated-messages` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/internal/ui/unauthenticated-messages
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "key_info": {
-      "01234567-89ab-cdef-0123-456789abcdef": {
-        "title": "Pre-login Warning",
-        "message": "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur nulla augue, placerat quis risus blandit, molestie imperdiet massa. Sed blandit rutrum odio quis varius. Fusce purus orci, maximus ac libero.",
-        "type": "modal",
-        "authenticated": false,
-        "start_time": "2024-01-01T00:00:00.000000000Z",
-        "end_time": null,
-        "options": null,
-        "link": {
-          "Details": "https://www.example.org/details"
-        }
-      }
-    },
-    "keys": [
-      "01234567-89ab-cdef-0123-456789abcdef"
-    ]
-  }
-}
-```
diff --git a/website/content/api-docs/system/internal-ui-version.mdx b/website/content/api-docs/system/internal-ui-version.mdx
deleted file mode 100644
index 962c059a0d7..00000000000
--- a/website/content/api-docs/system/internal-ui-version.mdx
+++ /dev/null
@@ -1,51 +0,0 @@
----
-layout: api
-page_title: /sys/internal/ui/version - HTTP API
-description: >-
-  The `/sys/internal/ui/version` endpoint exposes the software version of Vault.
----
-
-# `/sys/internal/ui/version`
-
-The `/sys/internal/ui/version` endpoint exposes the Vault software version
-so the Vault UI can display the information to logged in users.
-
-Vault uses internal endpoints to provide information to the Vault UI
-and/or Vault CLI. Internal endpoints are explicitly intended to support
-Vault functionality, so we do not recommend them for general use
-and do not guarantee backwards compatibility across versions.
-
-## Get version
-
-Return the current software version of Vault.
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `GET`  | `/sys/internal/ui/version` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/internal/ui/version
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "d585b9be-9c6f-a05f-939b-490cf062ebbe",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "version": "1.16.0"
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null,
-  "mount_type": "system"
-}
-```
diff --git a/website/content/api-docs/system/key-status.mdx b/website/content/api-docs/system/key-status.mdx
deleted file mode 100644
index 57dc8e87ba8..00000000000
--- a/website/content/api-docs/system/key-status.mdx
+++ /dev/null
@@ -1,53 +0,0 @@
----
-layout: api
-page_title: /sys/key-status - HTTP API
-description: |-
-  The `/sys/key-status` endpoint is used to query info about the current
-  encryption key of Vault.
----
-
-# `/sys/key-status`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/key-status` endpoint is used to query info about the current
-encryption key of Vault.
-
-## Get encryption key status
-
-This endpoint returns information about the current encryption key used by
-Vault.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `GET`  | `/sys/key-status` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/key-status
-
-```
-
-### Sample response
-
-```json
-{
-  "term": 3,
-  "install_time": "2015-05-29T14:50:46.223692553-07:00",
-  "encryptions": 74718331
-}
-```
-
-The `term` parameter is the sequential key number. `install_time` is the
-time that encryption key was installed. `encryptions` is the estimated
-number of encryptions made by the key including those on other cluster
-nodes.  
-
-Note that the estimated encryption count is aggregated from secondary 
-Vault nodes to the primary but not in the other direction.  Thus the
-count only accurately reflects the cluster-wide estimate when queried
-on the primary.
diff --git a/website/content/api-docs/system/leader.mdx b/website/content/api-docs/system/leader.mdx
deleted file mode 100644
index bcd39870e11..00000000000
--- a/website/content/api-docs/system/leader.mdx
+++ /dev/null
@@ -1,45 +0,0 @@
----
-layout: api
-page_title: /sys/leader - HTTP API
-description: |-
-  The `/sys/leader` endpoint is used to check the high availability status and
-  current leader of Vault.
----
-
-# `/sys/leader`
-
-The `/sys/leader` endpoint is used to check the high availability status and
-current leader of Vault.
-
-## Read leader status
-
-This endpoint returns the high availability status and current leader instance
-of Vault.
-
-| Method | Path          |
-| :----- | :------------ |
-| `GET`  | `/sys/leader` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/leader
-```
-
-### Sample response
-
-```json
-{
-  "ha_enabled": true,
-  "is_self": false,
-  "active_time": "2024-01-09T00:11:46.439409062Z",
-  "leader_address": "https://127.0.0.1:8200/",
-  "leader_cluster_address": "https://127.0.0.1:8201/",
-  "performance_standby": false,
-  "performance_standby_last_remote_wal": 0,
-  "last_wal": 0,
-  "raft_committed_index": 0,
-  "raft_applied_index": 0
-}
-```
diff --git a/website/content/api-docs/system/lease-count-quotas.mdx b/website/content/api-docs/system/lease-count-quotas.mdx
deleted file mode 100644
index dc2c513c50e..00000000000
--- a/website/content/api-docs/system/lease-count-quotas.mdx
+++ /dev/null
@@ -1,166 +0,0 @@
----
-layout: api
-page_title: /sys/quotas/lease-count - HTTP API
-description: The `/sys/quotas/lease-count` endpoint is used to create, edit and delete lease count quotas.
----
-
-# `/sys/quotas/lease-count`
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-admin.mdx'
-
-The `/sys/quotas/lease-count` endpoint is used to create, edit and delete lease count quotas.
-
-## Create or update a lease count quota
-
-This endpoint is used to create a lease count quota with an identifier, `name`.
-A lease count quota must include a `max_leases` value with an optional `path`
-that can either be a namespace or mount, and can optionally include a path suffix following
-the mount to restrict more specific API paths.
-
-Upon creating a lease count quota, it will be populated with the current count of leases from this path. If there are
-more leases present than the specified `max_leases`, this will cause the lease count to go over the specified
-`max_leases`.
-
-The initial population process can cause a lot of work for Vault - and while creating one lease count quota
-is always fine, if you're planning to create — for example — thousands of lease count quotas for paths with
-millions of leases in an automated way, it is recommended to space out the creation requests.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `POST` | `/sys/quotas/lease-count/:name` |
-
-### Parameters
-
-- `name` `(string: "")` - The name of the quota.
-- `path` `(string: "")` - Path of the mount or namespace to apply the quota.
-  A blank path configures a global lease count quota. For example `namespace1/`
-  adds a quota to a full namespace, `namespace1/auth/userpass` adds a quota to
-  `userpass` in `namespace1`, and `namespace1/kv-v2/data/foo/bar` adds a quota to
-  a specific secret on a KV v2 mount in `namespace1`. A trailing glob (`*`) can also
-  be added as part of the path after the mount to match paths that share the same prefix
-  prior to the glob. `namespace1/kv-v2/data/foo/*` would match both `namespace1/kv-v2/data/foo/bar`
-  and `namespace1/kv-v2/data/foo/baz`. Updating this field on an existing
-  quota can have "moving" effects. For example, updating `namespace1` to
-  `namespace1/auth/userpass` moves this quota from being a namespace quota to a
-  namespace-specific mount quota. Non-global quotas are not inherited by child
-  namespaces.
-- `max_leases` `(int: 0)` - Maximum number of leases allowed by the quota rule.
-- `role` `(string: "")` - If set on a quota where `path` is set to an auth mount with a
-  concept of roles (such as `/auth/approle/`), this will make the quota restrict login
-  requests to that mount that are made with the specified role. The request will fail if
-  the auth mount does not have a concept of roles, or `path` is not an auth mount.
-- `inheritable` `(bool: false)` - If set to `true` on a quota where `path` is set to a namespace,
-   the same quota will be cumulatively applied to all child namespace. The `inheritable` parameter cannot be set to
-  `true` if the `path` does not specify a namespace. Only the quotas associated
-  with the root namespace are inheritable by default.
-
-
-### Sample payload
-
-```json
-{
-  "path": "",
-  "max_leases": 1000
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/quotas/lease-count/global-lease-count-quota
-```
-
-## Delete a lease count quota
-
-A lease count quota can be deleted by `name`.
-
-| Method   | Path                            |
-| :------- | :------------------------------ |
-| `DELETE` | `/sys/quotas/lease-count/:name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request DELETE \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/quotas/lease-count/global-lease-count-quota
-```
-
-## Get a lease count quota
-
-A lease count quota can be retrieved by `name`.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `GET`  | `/sys/quotas/lease-count/:name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/quotas/lease-count/global-lease-count-quota
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "21514bc6-2c19-42b9-a8a7-cab27aff5815",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "max_leases": 1000,
-    "name": "global-lease-count-quota",
-    "path": "",
-    "role": "",
-    "type": "lease-count"
-  },
-  "warnings": null
-}
-```
-
-## List lease count quotas
-
-This endpoint returns a list of all the lease count quotas. A 404 response will
-be returned if no lease count quota has been created.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `LIST` | `/sys/quotas/lease-count` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request LIST \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/quotas/lease-count
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "data": {
-    "keys": ["global-lease-count-quota"]
-  },
-  "lease_duration": 0,
-  "lease_id": "",
-  "renewable": false,
-  "request_id": "ab633ee1-a692-ba03-083b-f1bd91c51c28",
-  "warnings": null,
-  "wrap_info": null
-}
-```
-
diff --git a/website/content/api-docs/system/leases.mdx b/website/content/api-docs/system/leases.mdx
deleted file mode 100644
index 1d9d6709cdc..00000000000
--- a/website/content/api-docs/system/leases.mdx
+++ /dev/null
@@ -1,315 +0,0 @@
----
-layout: api
-page_title: /sys/leases - HTTP API
-description: The `/sys/leases` endpoints are used to view and manage leases.
----
-
-# `/sys/leases`
-
-The `/sys/leases` endpoints are used to view and manage leases in Vault.
-
-## Read lease
-
-This endpoint retrieve lease metadata.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/sys/leases/lookup` |
-
-### Parameters
-
-- `lease_id` `(string: <required>)` – Specifies the ID of the lease to lookup.
-
-### Sample payload
-
-```json
-{
-  "lease_id": "aws/creds/deploy/abcd-1234..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/leases/lookup
-```
-
-### Sample response
-
-```json
-{
-  "id": "auth/token/create/25c75065466dfc5f920525feafe47502c4c9915c",
-  "issue_time": "2017-04-30T10:18:11.228946471-04:00",
-  "expire_time": "2017-04-30T11:18:11.228946708-04:00",
-  "last_renewal_time": null,
-  "renewable": true,
-  "ttl": 3558
-}
-```
-
-## List leases
-
-This endpoint returns a list of lease ids.
-
-**This endpoint requires 'sudo' capability.**
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `LIST` | `/sys/leases/lookup/:prefix` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/sys/leases/lookup/aws/creds/deploy/
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["abcd-1234...", "efgh-1234...", "ijkl-1234..."]
-  }
-}
-```
-
-## Renew lease
-
-This endpoint renews a lease, requesting to extend the lease. Token leases
-cannot be renewed using this endpoint, use instead the auth/token/renew endpoint.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/sys/leases/renew` |
-
-### Parameters
-
-- `lease_id` `(string: <required>)` – Specifies the ID of the lease to extend. This
-  parameter can either be specified in a json request, as shown below, or provided as
-  a path parameter to the endpoint, like /sys/leases/revoke/:lease_id. If both are
-  provided, the leaseID in the request json takes precedence.
-
-- `increment` `(int: 0)` – Specifies the requested amount of time (in seconds)
-  to extend the lease.
-
-### Sample payload
-
-```json
-{
-  "lease_id": "aws/creds/deploy/abcd-1234...",
-  "increment": 1800
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/leases/renew
-```
-
-### Sample response
-
-```json
-{
-  "lease_id": "aws/creds/deploy/abcd-1234...",
-  "renewable": true,
-  "lease_duration": 2764790
-}
-```
-
-## Revoke lease
-
-This endpoint revokes a lease immediately.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/sys/leases/revoke` |
-
-### Parameters
-
-- `lease_id` `(string: <required>)` – Specifies the ID of the lease to revoke. This
-  parameter can either be specified in a json request, as shown below, or provided as
-  a path parameter to the endpoint, like /sys/leases/revoke/:lease_id. If both are
-  provided, the leaseID in the request json takes precedence.
-- `sync` `(bool: false)` - Instead of the default behaviour of queueing the lease
-  revocation, sync=true will revoke the lease immediately and only return once
-  complete.
-
-### Sample payload
-
-```json
-{
-  "lease_id": "postgresql/creds/readonly/abcd-1234..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/leases/revoke
-```
-
-## Revoke force
-
-This endpoint revokes all secrets or tokens generated under a given prefix
-immediately. Unlike `/sys/leases/revoke-prefix`, this path ignores backend errors
-encountered during revocation. This is _potentially very dangerous_ and should
-only be used in specific emergency situations where errors in the backend or the
-connected backend service prevent normal revocation.
-
-By ignoring these errors, Vault abdicates responsibility for ensuring that the
-issued credentials or secrets are properly revoked and/or cleaned up. Access to
-this endpoint should be tightly controlled.
-
-**This endpoint requires 'sudo' capability.**
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `POST` | `/sys/leases/revoke-force/:prefix` |
-
-### Parameters
-
-- `prefix` `(string: <required>)` – Specifies the prefix to revoke. This is
-  specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/leases/revoke-force/aws/creds
-```
-
-## Revoke prefix
-
-This endpoint revokes all secrets (via a lease ID prefix) or tokens (via the
-tokens' path property) generated under a given prefix immediately. This requires
-`sudo` capability and access to it should be tightly controlled as it can be
-used to revoke very large numbers of secrets/tokens at once.
-
-**This endpoint requires 'sudo' capability.**
-
-| Method | Path                                |
-| :----- | :---------------------------------- |
-| `POST` | `/sys/leases/revoke-prefix/:prefix` |
-
-### Parameters
-
-- `prefix` `(string: <required>)` – Specifies the prefix to revoke. This is
-  specified as part of the URL.
-- `sync` `(bool: false)` - Instead of the default behaviour of queueing the lease
-  revocations, sync=true will revoke ths leases immediately and only return once
-  complete.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/leases/revoke-prefix/aws/creds
-```
-
-## Tidy leases
-
-This endpoint cleans up the dangling storage entries for leases: for each lease
-entry in storage, Vault will verify that it has an associated valid non-expired
-token in storage, and if not, the lease will be revoked.
-
-Generally, running this is not needed unless upgrade notes or support personnel
-suggest it. This may perform a lot of I/O to the storage method so should be
-used sparingly.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `POST` | `/sys/leases/tidy` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/leases/tidy
-```
-
-## Lease counts
-
-This endpoint returns the total count of a `type` of lease, as well as a count
-per mount point. Note that it currently only supports type "irrevocable".
-
-This can help determine if particular endpoints are disproportionately
-resulting in irrevocable leases.
-
-This endpoint was added in Vault 1.8.
-
-### Parameters
-
-- `type` `(string: <required>)` - Specifies the type of lease.
-- `include_child_namespaces` (bool: false) - Specifies if leases in child
-  namespaces should be included in the result.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/sys/leases/count` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/leases/count \
-    -d type=irrevocable
-```
-
-## Leases list
-
-This endpoint returns the total count of a `type` of lease, as well as a list
-of leases per mount point. Note that it currently only supports type
-"irrevocable".
-
-This can help determine if particular endpoints or causes are disproportionately
-resulting in irrevocable leases.
-
-This endpoint was added in Vault 1.8.
-
-### Parameters
-
-- `type` `(string: <required>)` - Specifies the type of lease.
-- `include_child_namespaces` (bool: false) - Specifies if leases in child
-  namespaces should be included in the result
-- `limit` (string: "") - Specifies the maximum number of leases to return in a
-  request. To return all results, set to `none`. If not set, this API will
-  return a maximum of 10,000 leases. If not set to `none` and there exist more
-  leases than `limit`, the response will include a warning.
-
-| Method | Path          |
-| :----- | :------------ |
-| `GET`  | `/sys/leases` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/leases \
-    -d type=irrevocable
-```
diff --git a/website/content/api-docs/system/license.mdx b/website/content/api-docs/system/license.mdx
deleted file mode 100644
index dda63f1bed4..00000000000
--- a/website/content/api-docs/system/license.mdx
+++ /dev/null
@@ -1,100 +0,0 @@
----
-layout: api
-page_title: /sys/license/status - HTTP API
-description: |-
-  The `/sys/license/status` endpoint is used to view the license used in
-  Vault.
----
-
-# `/sys/license/status`
-
-@include 'alerts/enterprise-only.mdx'
-
-The `/sys/license/status` endpoint is used to view update the license used in
-Vault.
-
-## License status
-
-This endpoint returns information about licensing. See [license autoloading](/vault/docs/enterprise/license/autoloading) for additional background.
-
-In the response:
-
-- `autoloading_used` will be true if an autoloaded license was provided to the
-  node, false otherwise. This should always be true from Vault 1.11.0 onward.
-- `autoloaded` is the autoloaded license if autoloading_used is true.
-- `persisted_autoload` is the autoloaded license the active node last wrote to
-  storage; this is only used to detect inconsistently licensed nodes in the
-  cluster. It cannot be used as a license itself.
-- `stored` was used for the stored license prior to Vault 1.11.0. Stored licenses are no longer supported.
-
-`autoloaded`, and `persisted_autoload` will both have the same structure.
-
-| Method | Path                  |
-| :----- | :-------------------- |
-| `GET`  | `/sys/license/status` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/license/status
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "autoloading_used": true,
-    "autoloaded": {
-      "expiration_time": "2022-05-17T23:59:59Z",
-      "features": [
-        "HSM",
-        "Performance Replication",
-        "DR Replication",
-        "MFA",
-        "Sentinel",
-        "Seal Wrapping",
-        "Control Groups",
-        "Performance Standby",
-        "Namespaces",
-        "KMIP",
-        "Entropy Augmentation",
-        "Transform Secrets Engine",
-        "Lease Count Quotas",
-        "Key Management Secrets Engine",
-        "Automated Snapshots"
-      ],
-      "license_id": "060d7820-fa59-f95c-832b-395db0aeb9ba",
-      "performance_standby_count": 9999,
-      "start_time": "2021-05-17T00:00:00Z",
-      "termination_time": "2031-05-17T23:59:59Z"
-    },
-    "persisted_autoload": {
-      "expiration_time": "2022-05-17T23:59:59Z",
-      "features": [
-        "HSM",
-        "Performance Replication",
-        "DR Replication",
-        "MFA",
-        "Sentinel",
-        "Seal Wrapping",
-        "Control Groups",
-        "Performance Standby",
-        "Namespaces",
-        "KMIP",
-        "Entropy Augmentation",
-        "Transform Secrets Engine",
-        "Lease Count Quotas",
-        "Key Management Secrets Engine",
-        "Automated Snapshots"
-      ],
-      "license_id": "060d7820-fa59-f95c-832b-395db0aeb9ba",
-      "performance_standby_count": 9999,
-      "start_time": "2021-05-17T00:00:00Z",
-      "termination_time": "2031-05-17T23:59:59Z"
-    }
-  }
-}
-```
diff --git a/website/content/api-docs/system/loggers.mdx b/website/content/api-docs/system/loggers.mdx
deleted file mode 100644
index 19ab633959d..00000000000
--- a/website/content/api-docs/system/loggers.mdx
+++ /dev/null
@@ -1,154 +0,0 @@
----
-layout: api
-page_title: /sys/loggers - HTTP API
-description: The `/sys/loggers` endpoint is used modify the verbosity level of logging.
----
-
-# `/sys/loggers`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/loggers` endpoint is used modify the verbosity level of logging.
-
-!> **NOTE:** Changes made to the log level using this endpoint are not persisted and will be restored
-to either the default log level (info) or the level specified using `log_level` in vault.hcl or the `VAULT_LOG_LEVEL`
-environment variable once the Vault service is reloaded or restarted.
-
-## Modify verbosity level of all loggers
-
-| Method  | Path           |
-| :------ | :------------- |
-| `POST`  | `/sys/loggers` |
-
-### Parameters
-
-- `level` `(string: <required>)` – Specifies the log verbosity level to be set for all loggers.
-Supported values (in order of detail) are `"trace"`, `"debug"`, `"info"`, `"warn"`, and `"error"`.
-
-### Sample payload
-
-```json
-{
-  "level": "debug",
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/loggers
-```
-
-## Modify verbosity level of a single logger
-
-| Method  | Path                 |
-| :------ | :------------------- |
-| `POST`  | `/sys/loggers/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the logger to be modified (e.g. `audit`, `core`, `expiration`).
-- `level` `(string: <required>)` – Specifies the log verbosity level to be set for the provided logger.
-Supported values (in order of detail) are `"trace"`, `"debug"`, `"info"`, `"warn"`, and `"error"`.
-
-### Sample payload
-
-```json
-{
-  "level": "debug",
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/loggers/core
-```
-
-## Read verbosity level of all loggers
-
-| Method | Path           |
-| :----- | :------------- |
-| `GET`  | `/sys/loggers` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/sys/loggers
-```
-
-### Sample response
-
-```json
-{
-    "audit": "trace",
-    "core": "info",
-    "policy": "debug"
-}
-```
-
-## Read verbosity level of a single logger
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/sys/loggers/:name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    https://127.0.0.1:8200/v1/sys/loggers/core
-```
-
-### Sample response
-
-```json
-{
-    "core": "info"
-}
-```
-
-## Revert verbosity of all loggers to configured level
-
-| Method    | Path           |
-| :-------- | :------------- |
-| `DELETE`  | `/sys/loggers` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/loggers
-```
-
-## Revert verbosity of a single logger to configured level
-
-| Method    | Path                 |
-| :-------- | :------------------- |
-| `DELETE`  | `/sys/loggers/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the logger to be modified (e.g. `audit`, `core`, `expiration`).
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/loggers/core
-```
diff --git a/website/content/api-docs/system/managed-keys.mdx b/website/content/api-docs/system/managed-keys.mdx
deleted file mode 100644
index d0ba49ffc83..00000000000
--- a/website/content/api-docs/system/managed-keys.mdx
+++ /dev/null
@@ -1,371 +0,0 @@
----
-layout: api
-page_title: /sys/managed-keys - HTTP API
-description: The `/sys/managed-keys` endpoint is used to manage the managed keys in Vault.
----
-
-# `/sys/managed-keys`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/managed-keys` endpoint is used to manage the Managed Key configuration within Vault.
-See the [Managed Keys](/vault/docs/enterprise/managed-keys) section for further details on the Managed Keys system.
-
-## List managed keys.
-
-This endpoint lists all the Managed Keys of a certain type within the namespace.
-
-| Method | Path                      |
-|:-------|:--------------------------|
-| `LIST` | `/sys/managed-keys/:type` |
-
-### Parameters
-- `type` `(string: <required>)` – The backend type of keys to be listed.
-Supported options are `pkcs11`, `awskms` and `azurekeyvault`.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request LIST \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/managed-keys/pkcs11
-```
-
-### Sample response
-
-```json
-{
-  "keys": [
-    "hsm-key1",
-    "hsm-key2"
-  ]
-}
-```
-
-## Create/Update managed key
-
-An endpoint that will create or update a Managed Key within a given namespace. The :type refers to the backend type
-that the key is to use, such as `pkcs11`. The :name argument is unique name within all managed key types in
-the namespace.
-
-| Method | Path                            |
-|:-------|:--------------------------------|
-| `POST` | `/sys/managed-keys/:type/:name` |
-
-### Sample payload
-
-```json
-{
-  "library": "softhsm",
-  "slot": "693149389",
-  "pin": "12345",
-  "key_label": "hsm-key1",
-  "mechanism": "0x0001"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/managed-keys/pkcs11/hsm-key1
-```
-
-### Generic parameters
-- `name` `(string: <required>)` - A unique lowercase name that serves as identifying the key. Must be
-  unique throughout all types in the namespace.
-
-- `type` `(string: <required>)` – The backend type that will be leveraged for the managed key.
-  Supported options are `pkcs11`, `awskms` and `azurekeyvault`.
-
-- `allow_generate_key` `(string: "false")` - If no existing key can be found in the referenced backend, instructs
-  Vault to generate a key within the backend.
-
-- `allow_replace_key` `(string: "false")` - Controls the ability for Vault to replace through generation or importing
-  a key into the configured backend even if a key is present, if set to false those operations are forbidden
-  if a key exists.
-
-- `allow_store_key` `(string: "false")` - Controls the ability for Vault to export a Vault private key
-  to the configured HSM, if "false" those operations will be forbidden.
-
-- `any_mount` `(string: "false")` - Allow usage from any mount point within the namespace if "true". If "false"
-  specific mount points will need their `allowed_managed_keys` parameter to be updated with the key name to
-  grant usage.
-
-- `usages` `(comma-delimited string: "sign,verify")` - A comma-delimited list of the allowed usages of this key. Valid values
-  are encrypt, decrypt, sign, verify, wrap, unwrap, mac, and random.
-
-#### PKCS#11 backend parameters
-
-<Note>
-  The <code>pkcs11</code> backend is only available with Vault Enterprise plus HSMs
-</Note>
-
-- `type` `(string: "pkcs11")` - To select a PKCS#11 backend, the type parameter must be set to `pkcs11`.
-
-- `library` `(string: <required>)` - The name of the `kms_library` stanza to use from Vault's config to
-   lookup the local library path. See [kms_library stanza](/vault/docs/configuration/kms-library) for further details.
-
-- `key_label` `(string: <required>)` - The label of the key to use. If the key does not exist
-  and generation is enabled, this is the label that will be given to the generated key. This
-  value or `key_id` must be specified.
-
-- `key_id` `(string: <required>)` - The id of a PKCS#11 key to use. As key ids are created by
-  the HSM, it is an error if the key does not yet exist. This value or `key_label` must be
-  specified.
-
-- `mechanism` `(string: <required>)` - The encryption/decryption mechanism to use,
-  specified as a hexadecimal (prefixed by 0x) string. The following are supported mechanisms
-    - `0x1041` `CKM_ECDSA`
-    - `0x000D` `CKM_RSA_PKCS_PSS`
-    - `0x0009` `CKM_RSA_PKCS_OAEP`
-    - `0x0001` `CKM_RSA_PKCS`
-
-  ~> **Note**: It is possible to use unsupported mechanisms with a managed key, however automatic key generation is only
-  possible with the above supported mechanisms. Automatic key generation is also currently a best effort operation and may
-  not function correctly on all HSMs.
-
-- `pin` `(string: <required>)`: The PIN for login.
-
-- `slot` `(string: <slot or token label required>)`: The slot number to use,
-  specified as a string in a decimal format (e.g. `"2305843009213693953"`).
-
-  ~> **Note**: Slots are typically listed as hex-decimal values in the OS setup
-  utility but this configuration uses their decimal equivalent. For example, using the
-  HSM command-line `pkcs11-tool`, a slot listed as `0x2000000000000001`in hex is equal
-  to `2305843009213693953` in decimal; these values may be listed shorter or
-  differently as determined by the HSM in use.
-
-- `token_label` `(string: <slot or token label required>)`: The slot token label to
-  use.
-
-- `curve` `(string: "" <required if allow_generate_key is true>)` - supplies the curve value when using the `CKM_ECDSA mechanism`.
-  The supported values are
-    - `P384`
-    - `P521`
-    - `P256`
-
-- `key_bits` `(int: 0 <required if allow_generate_key is true>)` - supplies the size in bits of the key when using `CKM_RSA_PKCS_PSS`,
-  `CKM_RSA_PKCS_OAEP` or `CKM_RSA_PKCS` as a value for `mechanism`.
-  The supported values are
-    - 2048
-    - 3072
-    - 4096
-
-- `force_rw_session` `(string: "false")` - Force all operations to open up
-  a read-write session to the HSM. This is a boolean expressed as a string (e.g.
-  `"true"`). This key is mainly to work around a limitation within AWS's CloudHSM v5
-  pkcs11 implementation.
-
-- `max_parallel` `(int: 1)` - The number of concurrent requests that may be in
-  flight to the HSM at any given time.
-
-#### AWS KMS parameters
-- `type` `(string: "awskms")` - To select an AWS KMS backend, the type parameter must be set to `awskms`.
-
-- `access_key` `(string: <required>)`: The AWS access key to use. This may also be provided in
-  the `AWS_ACCESS_KEY_ID` environment variable or as part of the AWS profile from the AWS CLI or
-  instance profile.
-
-- `curve` `(string: "" <required if allow_generate_key is true>)`: The curve to use for an ECDSA key.
-  This field is used when `key_type` is `ECDSA`. Supported options are `P256`, `P384`, or `P521`.
-
-- `endpoint` `(string: "")`: Used to specify a custom AWS endpoint. If not set, Vault will use
-  the default API endpoint for your region.
-
-- `key_bits` `(string: <required>)`: The size in bits for an RSA key. This field is required when
-  `key_type` is `RSA`. Supported values are `2048`, `3072`, and `4096`.
-
-- `key_type` `(string: <required>)`: The type of key to use. Supported values are `RSA` and
-  `ECDSA` (not case sensitive). If the key type is `RSA`, the `key_bits` field is also required.
-  If the key type is `ECDSA`, the `curve` field is required.
-
-- `kms_key` `(string: <required>)`: An identifier for the key. If `allow_generate_key` is set to
-  `false`, the value can be either an ARN, an AWS alias, or the key ID generated by AWS KMS. If
-  `allow_generate_key` is set to `true`, the value must be an AWS alias. If a key with the provided
-  alias does not already exist, Vault will generate a key and create an alias for it using this parameter.
-
-  ~> **Note**: when creating a key through AWS KMS to be used with managed keys, note
-  that the key usage must be `SIGN_VERIFY`. When using an elliptic curve key, the
-  combination `key_type=ECDSA` and `curve=P256` corresponds to the AWS Key Spec
-  `ECC_NIST_P256`.
-
-- `region` `(string: "us-east-1")`: The AWS region where the keys are stored (or will be stored).
-  This may also be provided in the `AWS_REGION` or `AWS_DEFAULT_REGION` environment variables,
-  from your `~/.aws/config` file, or from instance metadata.
-
-- `secret_key` `(string: <required>)`: The AWS secret key ID to use. This may also be provided in
-  the `AWS_SECRET_ACCESS_KEY` environment variable or as part of the AWS profile from the AWS CLI
-  or instance profile.
-
-#### Azure key Vault parameters
-- `type` `(string: "azurekeyvault")` - To select an Azure Key Vault backend, the type parameter must be set to `azurekeyvault`.
-
-- `tenant_id` `(string: <required>)`: The tenant id for the Azure Active Directory organization.
-
-- `client_id` `(string: <required or MSI>)`: The client id for credentials to query the Azure APIs.
-
-- `client_secret` `(string: <required or MSI>)`: The client secret for credentials to query the
-  Azure APIs.
-
-- `environment` `(string: "AZUREPUBLICCLOUD")`: The Azure Cloud environment API endpoints to use.
-
-- `vault_name` `(string: <required>)`: The Key Vault vault to use the encryption keys for
-  encryption and decryption.
-
-- `key_name` `(string: <required>)`: The Key Vault key to use for encryption and decryption.
-
-- `resource` `(string: "vault.azure.net")`: The Azure Key Vault resource's DNS Suffix to connect
-  to. Needs to be changed to connect to Azure's Managed HSM KeyVault instance type.
-
-- `key_bits` `(string: <required if allow_generate_key is true>)`: The size in bits for an RSA key.
-   This field is required when `key_type` is `RSA`. Supported values are `2048`, `3072`, and `4096`.
-
-- `key_type` `(string: <required>)`: The type of key to use. At this time only supported value is `RSA-HSM`.
-
-#### GCP Cloud KMS parameters
-- `type` `(string: "gcpckms")` - To select an GCP Cloud KMS backend, the type parameter must be set to `gcpckms`.
-
-- `credentials` `(string: <required>)`: The path of the credential file to use for authenticating to GCP.
-  This can also be provided in the `GOOGLE_CREDENTIALS` or `GOOGLE_APPLICATION_CREDENTIALS` environment variable.
-
-- `crypto_key` `(string: <required>)`: The name of the GCP Cloud KMS key. If there is no existing key
-  and `allow_generate_key` is `true`, Vault will generate a key with this name.
-
-- `crypto_key_version` `(string: "1")`: The version of the key to use.
-
-- `key_ring` `(string: <required>)`: The name of the key ring in GCP Cloud KMS. This needs to be created
-  prior to key creation.
-
-- `project` `(string: <required>)`: The ID of the GCP project. This can also be provided with
-  the `GOOGLE_PROJECT` environment variable.
-
-- `region` `(string: <required>)`: The region where the key ring was created. This can also be provided
-  with the `GOOGLE_REGION` environment variable.
-
-- `algorithm` `(string: <required>)`: The signature algorithm to be used with the key. Supported
-  values for signature algorithms are:
-  - `EC_SIGN_P256_SHA256`
-  - `EC_SIGN_P384_SHA384`
-  - `RSA_SIGN_PSS_2048_SHA256`
-  - `RSA_SIGN_PSS_3072_SHA256`
-  - `RSA_SIGN_PSS_4096_SHA256`
-  - `RSA_SIGN_PSS_4096_SHA512`
-  - `RSA_SIGN_PKCS1_2048_SHA256`
-  - `RSA_SIGN_PKCS1_3072_SHA256`
-  - `RSA_SIGN_PKCS1_4096_SHA256`
-  - `RSA_SIGN_PKCS1_4096_SHA512`
-
-  For more information, see the GCP Cloud KMS [documentation for signing algorithms](https://cloud.google.com/kms/docs/algorithms).
-
-## Read managed key
-
-This endpoint returns the managed key configuration at the given path.
-
-| Method | Path                            |
-|:-------|:--------------------------------|
-| `GET`  | `/sys/managed-keys/:type/:name` |
-
-### Parameters
-- `name` `(string: <required>)` - The lowercase name identifying the key.
-
-- `type` `(string: <required>)` – The backend type for the managed key. Supported options are `pkcs11`, `awskms` and `azurekeyvault`.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/managed-keys/pkcs11/hsm-key1
-```
-
-### Sample response
-
-```json
-{
-  "UUID": "af0a688e-d2c1-fc07-b365-40325674114d",
-  "allow_generate_key": true,
-  "allow_replace_key": false,
-  "allow_store_key": false,
-  "any_mount": false,
-  "curve": "",
-  "force_rw_session": false,
-  "key_bits": 0,
-  "key_label": "test-kms-root",
-  "library": "softhsm",
-  "mechanism": 1,
-  "name": "hsm-key1",
-  "pin": "redacted",
-  "slot": 1,
-  "token_label": "",
-  "type": "pkcs11"
-}
-```
-
-## Test sign with a managed key
-
-This endpoint allows an operator to validate that a managed key configuration works
-by signing and verifying some randomly generated data. If the call returns a successful HTTP
-status code, the configuration can be considered valid.
-
-~> **Note**: if key generation is allowed and no existing key can be found, this call will generate the key
-
-| Method | Path                                      |
-|:-------|:------------------------------------------|
-| `POST` | `/sys/managed-keys/:type/:name/test/sign` |
-
-### Parameters
-- `name` `(string: <required>)` - The lowercase name identifying the key.
-
-- `type` `(string: <required>)` – The backend type for the managed key. Supported options are `pkcs11`, `awskms`, `azurekeyvault`, or `gcpckms`.
-
-- `use_pss` `(bool: false)` - Use RSA PSS signatures within the signing/verification api calls.
-
-- `hash_algorithm` `(string: sha2-256)` - Use the following hashing algorithm within the signing/verification api calls.
-  The supported values are
-   - sha1
-   - sha2-224
-   - sha2-256
-   - sha2-384
-   - sha2-512
-   - sha3-224
-   - sha3-256
-   - sha3-384
-   - sha3-512
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/managed-keys/pkcs11/hsm-key1/test/sign
-```
-
-
-## Delete managed key
-
-This endpoint deletes the managed key at the given path provided it is not
-listed within any mount point's `allowed_managed_keys`.
-
-| Method   | Path                            |
-|:---------|:--------------------------------|
-| `DELETE` | `/sys/managed-keys/:type/:name` |
-
-### Parameters
-- `name` `(string: <required>)` - The lowercase name identifying the key.
-
-- `type` `(string: <required>)` – The backend type for the managed key. Supported options are `pkcs11`, `awskms` and `azurekeyvault`.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request DELETE \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/managed-keys/pkcs11/hsm-key1
-```
diff --git a/website/content/api-docs/system/metrics.mdx b/website/content/api-docs/system/metrics.mdx
deleted file mode 100644
index f574111db89..00000000000
--- a/website/content/api-docs/system/metrics.mdx
+++ /dev/null
@@ -1,70 +0,0 @@
----
-layout: api
-page_title: /sys/metrics - HTTP API
-description: The `/sys/metrics` endpoint is used to get telemetry metrics for Vault.
----
-
-# `/sys/metrics`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/metrics` endpoint is used to get telemetry metrics for Vault.
-
-## Read telemetry metrics
-
-This endpoint returns the telemetry metrics for Vault. It can be used by metrics
-collections systems like [Prometheus](https://prometheus.io) that use a pull
-model for metrics collection.
-
-| Method | Path           |
-| :----- | :------------- |
-| `GET`  | `/sys/metrics` |
-
-### Parameters
-
-- `format` `(string: "")` – Specifies the format used for the returned metrics. The
-  default metrics format is JSON. Setting `format` to `prometheus` will return the
-  metrics in [Prometheus format](https://prometheus.io/docs/instrumenting/exposition_formats/#text-based-format).
-
-### Sample request
-
-```shell-session
-$ curl \
-  --header "X-Vault-Token: ..." \
-    'http://127.0.0.1:8200/v1/sys/metrics?format=prometheus'
-```
-
-### Sample response
-
-This response is only returned for a `GET` request.
-
-```
-# HELP vault_audit_log_request vault_audit_log_request
-# TYPE vault_audit_log_request summary
-vault_audit_log_request{quantile="0.5"} 0.005927000194787979
-vault_audit_log_request{quantile="0.9"} 0.005927000194787979
-vault_audit_log_request{quantile="0.99"} 0.005927000194787979
-vault_audit_log_request_sum 0.014550999738276005
-vault_audit_log_request_count 2
-# HELP vault_audit_log_request_failure vault_audit_log_request_failure
-# TYPE vault_audit_log_request_failure counter
-vault_audit_log_request_failure 0
-# HELP vault_audit_log_response vault_audit_log_response
-# TYPE vault_audit_log_response summary
-vault_audit_log_response{quantile="0.5"} NaN
-vault_audit_log_response{quantile="0.9"} NaN
-vault_audit_log_response{quantile="0.99"} NaN
-vault_audit_log_response_sum 0.0057669999077916145
-vault_audit_log_response_count 1
-# HELP vault_audit_log_response_failure vault_audit_log_response_failure
-# TYPE vault_audit_log_response_failure counter
-vault_audit_log_response_failure 0
-# HELP vault_barrier_get vault_barrier_get
-# TYPE vault_barrier_get summary
-vault_barrier_get{quantile="0.5"} 0.011938000097870827
-vault_barrier_get{quantile="0.9"} 0.011938000097870827
-vault_barrier_get{quantile="0.99"} 0.011938000097870827
-vault_barrier_get_sum 0.1814980012131855
-vault_barrier_get_count 36
-...
-```
diff --git a/website/content/api-docs/system/mfa/duo.mdx b/website/content/api-docs/system/mfa/duo.mdx
deleted file mode 100644
index 92f87556007..00000000000
--- a/website/content/api-docs/system/mfa/duo.mdx
+++ /dev/null
@@ -1,122 +0,0 @@
----
-layout: api
-page_title: /sys/mfa/method/duo - HTTP API
-description: >-
-  The '/sys/mfa/method/duo' endpoint focuses on managing Duo MFA behaviors in
-  Vault Enterprise.
----
-
-## Configure Duo MFA method
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint defines a MFA method of type Duo.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `POST` | `/sys/mfa/method/duo/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the MFA method.
-
-- `mount_accessor` `(string: <required>)` - The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.
-
-- `username_format` `(string)` - A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`. For example, `"{{alias.name}}@example.com"`. If blank, the Alias's Name field will be used as-is. Currently-supported mappings:
-
-  - alias.name: The name returned by the mount configured via the `mount_accessor` parameter
-  - entity.name: The name configured for the Entity
-  - alias.metadata.`<key>`: The value of the Alias's metadata parameter
-  - entity.metadata.`<key>`: The value of the Entity's metadata parameter
-
-- `secret_key` `(string)` - Secret key for Duo.
-
-- `integration_key` `(string)` - Integration key for Duo.
-
-- `api_hostname` `(string)` - API hostname for Duo.
-
-- `push_info` `(string)` - Push information for Duo.
-
-### Sample payload
-
-```json
-{
-  "mount_accessor": "auth_userpass_1793464a",
-  "secret_key": "BIACEUEAXI20BNWTEYXT",
-  "integration_key": "8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz",
-  "api_hostname": "api-2b5c39f5.duosecurity.com"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/mfa/method/duo/my_duo
-```
-
-## Read Duo MFA method
-
-This endpoint queries the MFA configuration of Duo type for a given method
-name.
-
-| Method | Path                        |
-| :----- | :-------------------------- |
-| `GET`  | `/sys/mfa/method/duo/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/mfa/method/duo/my_duo
-
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "api_hostname": "api-2b5c39f5.duosecurity.com",
-    "id": "0ad21b78-e9bb-64fa-88b8-1e38db217bde",
-    "integration_key": "BIACEUEAXI20BNWTEYXT",
-    "mount_accessor": "auth_userpass_1793464a",
-    "name": "my_duo",
-    "pushinfo": "",
-    "secret_key": "8C7THtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz",
-    "type": "duo",
-    "username_format": ""
-  }
-}
-```
-
-## Delete Duo MFA method
-
-This endpoint deletes a Duo MFA method.
-
-| Method   | Path                        |
-| :------- | :-------------------------- |
-| `DELETE` | `/sys/mfa/method/duo/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/mfa/method/duo/my_duo
-
-```
diff --git a/website/content/api-docs/system/mfa/index.mdx b/website/content/api-docs/system/mfa/index.mdx
deleted file mode 100644
index 643234a3f78..00000000000
--- a/website/content/api-docs/system/mfa/index.mdx
+++ /dev/null
@@ -1,40 +0,0 @@
----
-layout: api
-page_title: /sys/mfa - HTTP API
-description: >-
-  The '/sys/mfa' endpoint focuses on managing MFA behaviors in Vault Enterprise
-  MFA.
----
-
-# `/sys/mfa`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/mfa` endpoint focuses on managing Multi-factor Authentication (MFA)
-behaviors in Vault Enterprise MFA.
-
-## Supported MFA types
-
-- [TOTP](/vault/api-docs/system/mfa/totp)
-
-- [Okta](/vault/api-docs/system/mfa/okta)
-
-- [Duo](/vault/api-docs/system/mfa/duo)
-
-- [PingID](/vault/api-docs/system/mfa/pingid)
-
-## Step-up enterprise MFA
-
-[Vault Enterprise](/vault/docs/enterprise/mfa) allows MFA for login and access to
-sensitive resources in Vault.  The Step-up Enterprise MFA expects the method
-creator to specify a name for the method; Login MFA does not, and instead
-returns an ID when a method is created. Although MFA methods supported with Step-up Enterprise MFA are supported with the Login MFA, they use different API endpoints.
-
-- Step-up Enterprise MFA: `sys/mfa/method/:type/:/name`
-- Login MFA: `identity/mfa/method/:type`
-
-~> **Note:** While the `sys/mfa` endpoint is supported for both Vault Community and Enterprise editions, `sys/mfa/method/:type/:/name` is only supported for Vault Enterprise.
-
-Refer to the [Login MFA
-FAQ](/vault/docs/auth/login-mfa/faq#q-are-there-new-mfa-api-endpoints-introduced-as-part-of-the-new-vault-version-1-10-mfa-for-login-functionality) document
-for more details.
diff --git a/website/content/api-docs/system/mfa/okta.mdx b/website/content/api-docs/system/mfa/okta.mdx
deleted file mode 100644
index 07ec62f7cc7..00000000000
--- a/website/content/api-docs/system/mfa/okta.mdx
+++ /dev/null
@@ -1,120 +0,0 @@
----
-layout: api
-page_title: /sys/mfa/method/okta - HTTP API
-description: >-
-  The '/sys/mfa/method/okta' endpoint focuses on managing Okta MFA behaviors in
-  Vault Enterprise.
----
-
-## Configure okta MFA method
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint defines a MFA method of type Okta.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/sys/mfa/method/okta/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the MFA method.
-
-- `mount_accessor` `(string: <required>)` - The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.
-
-- `username_format` `(string)` - A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`. For example, `"{{alias.name}}@example.com"`. If blank, the Alias's Name field will be used as-is. Currently-supported mappings:
-
-  - alias.name: The name returned by the mount configured via the `mount_accessor` parameter
-  - entity.name: The name configured for the Entity
-  - alias.metadata.`<key>`: The value of the Alias's metadata parameter
-  - entity.metadata.`<key>`: The value of the Entity's metadata parameter
-
-- `org_name` `(string)` - Name of the organization to be used in the Okta API.
-
-- `api_token` `(string)` - Okta API key.
-
-- `base_url` `(string)` - If set, will be used as the base domain for API requests. Examples are okta.com, oktapreview.com, and okta-emea.com.
-
-- `primary_email` `(bool: false)` - If set, the username will only match the primary email for the account.
-
-### Sample payload
-
-```json
-{
-  "mount_accessor": "auth_userpass_1793464a",
-  "org_name": "dev-262778",
-  "api_token": "0081u7KrReNkzmABZJAP2oDyIXccveqx9vIOEyCZDC"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/mfa/method/okta/my_okta
-```
-
-## Read okta MFA method
-
-This endpoint queries the MFA configuration of Okta type for a given method
-name.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `GET`  | `/sys/mfa/method/okta/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/mfa/method/okta/my_okta
-
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "api_token": "0081u7KrReNkzmABZJAP2oDyIXccveqx9vIOEyCZDC",
-    "id": "e39f08a1-a42d-143d-5b87-15c61d89c15a",
-    "mount_accessor": "auth_userpass_1793464a",
-    "name": "my_okta",
-    "org_name": "dev-262778",
-    "production": true,
-    "type": "okta",
-    "username_format": ""
-  }
-}
-```
-
-## Delete okta MFA method
-
-This endpoint deletes a Okta MFA method.
-
-| Method   | Path                         |
-| :------- | :--------------------------- |
-| `DELETE` | `/sys/mfa/method/okta/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/mfa/method/okta/my_okta
-
-```
diff --git a/website/content/api-docs/system/mfa/pingid.mdx b/website/content/api-docs/system/mfa/pingid.mdx
deleted file mode 100644
index ee322bc61a0..00000000000
--- a/website/content/api-docs/system/mfa/pingid.mdx
+++ /dev/null
@@ -1,114 +0,0 @@
----
-layout: api
-page_title: /sys/mfa/method/pingid - HTTP API
-description: >-
-  The '/sys/mfa/method/pingid' endpoint focuses on managing PingID MFA behaviors
-  in Vault Enterprise.
----
-
-## Configure PingID MFA method
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint defines a MFA method of type PingID.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/sys/mfa/method/pingid/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the MFA method.
-
-- `mount_accessor` `(string: <required>)` - The mount to tie this method to for use in automatic mappings. The mapping will use the Name field of Aliases associated with this mount as the username in the mapping.
-
-- `username_format` `(string)` - A format string for mapping Identity names to MFA method names. Values to substitute should be placed in `{{}}`. For example, `"{{alias.name}}@example.com"`. If blank, the Alias's Name field will be used as-is. Currently-supported mappings:
-
-  - alias.name: The name returned by the mount configured via the `mount_accessor` parameter
-  - entity.name: The name configured for the Entity
-  - alias.metadata.`<key>`: The value of the Alias's metadata parameter
-  - entity.metadata.`<key>`: The value of the Entity's metadata parameter
-
-- `settings_file_base64` `(string)` - A base64-encoded third-party settings file retrieved from PingID's configuration page.
-
-### Sample payload
-
-```json
-{
-  "mount_accessor": "auth_userpass_1793464a",
-  "settings_file_base64": "AA8owj3..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/mfa/method/pingid/ping
-```
-
-## Read PingiD MFA method
-
-This endpoint queries the MFA configuration of PingID type for a given method
-name.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/sys/mfa/method/pingid/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/mfa/method/pingid/ping
-
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "use_signature": true,
-    "idp_url": "https://idpxnyl3m.pingidentity.com/pingid",
-    "admin_url": "https://idpxnyl3m.pingidentity.com/pingid",
-    "authenticator_url": "https://authenticator.pingone.com/pingid/ppm",
-    "mount_accessor": "auth_userpass_1793464a",
-    "name": "ping",
-    "org_alias": "181459b0-9fb1-4938-8c86...",
-    "type": "pingid",
-    "username_format": ""
-  }
-}
-```
-
-## Delete PingID MFA method
-
-This endpoint deletes a PingID MFA method.
-
-| Method   | Path                           |
-| :------- | :----------------------------- |
-| `DELETE` | `/sys/mfa/method/pingid/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/mfa/method/pingid/ping
-
-```
diff --git a/website/content/api-docs/system/mfa/totp.mdx b/website/content/api-docs/system/mfa/totp.mdx
deleted file mode 100644
index b4f40577915..00000000000
--- a/website/content/api-docs/system/mfa/totp.mdx
+++ /dev/null
@@ -1,238 +0,0 @@
----
-layout: api
-page_title: /sys/mfa/method/totp - HTTP API
-description: >-
-  The '/sys/mfa/method/totp' endpoint focuses on managing TOTP MFA behaviors in
-  Vault Enterprise.
----
-
-## Configure TOTP MFA method
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint defines a MFA method of type TOTP.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/sys/mfa/method/totp/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the MFA method.
-
-- `issuer` `(string: <required>)` - The name of the key's issuing organization.
-
-- `period` `(int or duration format string: 30)` - The length of time used to generate a counter for the TOTP token calculation.
-
-- `key_size` `(int: 20)` – Specifies the size in bytes of the generated key.
-
-- `qr_size` `(int: 200)` - The pixel size of the generated square QR code.
-
-- `algorithm` `(string: "SHA1")` – Specifies the hashing algorithm used to generate the TOTP code. Options include "SHA1", "SHA256" and "SHA512".
-
-- `digits` `(int: 6)` - The number of digits in the generated TOTP token. This value can either be 6 or 8.
-
-- `skew` `(int: 1)` - The number of delay periods that are allowed when validating a TOTP token. This value can either be 0 or 1.
-
-- `max_validation_attempts` `(int: 5)` - The maximum number of consecutive TOTP code failed validation.
-
-### Sample payload
-
-```json
-{
-  "issuer": "vault"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/mfa/method/totp/my_totp
-```
-
-## Read TOTP MFA method
-
-This endpoint queries the MFA configuration of TOTP type for a given method
-name.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `GET`  | `/sys/mfa/method/totp/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/mfa/method/totp/my_totp
-
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "algorithm": "SHA1",
-    "digits": 6,
-    "id": "865587ba-6229-7f2a-6da0-609d5370af70",
-    "issuer": "vault",
-    "key_size": 20,
-    "name": "my_totp",
-    "period": 30,
-    "qr_size": 200,
-    "skew": 1,
-    "type": "totp"
-    "max_validation_attempts": 5
-  }
-}
-```
-
-## Delete TOTP MFA method
-
-This endpoint deletes a TOTP MFA method.
-
-| Method   | Path                         |
-| :------- | :--------------------------- |
-| `DELETE` | `/sys/mfa/method/totp/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/mfa/method/totp/my_totp
-
-```
-
-## Generate a TOTP MFA secret
-
-This endpoint generates an MFA secret in the entity of the calling token, if it
-doesn't exist already, using the configuration stored under the given MFA
-method name.
-
-| Method | Path                                  |
-| :----- | :------------------------------------ |
-| `GET`  | `/sys/mfa/method/totp/:name/generate` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the MFA method.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/mfa/method/totp/my_totp/generate
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "barcode": "iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BAAAGc0lEQVR4nOyd244bOQxEZxbz/7+cRQI4sLWiyCLlTU1wzkMAu1uXTIGSxUv3148fH2DEP396AvDK189/Pj97jR/W9Wi/fs7uz/pZya5H92dk40fzjeY1+XtiIWYgiBkIYsbX84dba7O6B0z3hmgPqO5Z6/WsH3VvynjuDwsxA0HMQBAzvnZfZueI6Pvs93r2+z6ax7qWZ+2zPSP7PutfPW8of08sxAwEMQNBzNjuISqRLyc7X6jnkex8UPVBqXtJxk2PORZiBoKYgSBmXNlDsriIeq6J+umeG1RfVjav7L4JWIgZCGIGgpix3UO6a6MaU4/OD9Fnda2P2qnxl2ge1fbKOFiIGQhiBoKY8bKHdH052V5Q3VPUz9n42XhR++zzStWXVgELMQNBzEAQM37tIbd9MtX4Qvc8EI13q32210Sfb8wHCzEDQcxAEDM+f6532e/86nmiPYk31X2sZP1Pz0PVGP+pPRZiBoKYgSBmbPeQ/9xUvP6geg7p9leNj3RrH7v1K+reRm7vNwBBzEAQM471IVmt3oN31V9E93Xr3KNx1BrD7t+jMl8sxAwEMQNBzDjm9lZj5d04gZoLHPX3rjjFu3J5T/8/LMQMBDEDQcyQ6kPUHNsH1TU+Gi/qr+rLmo6zfq6eTzr9YiFmIIgZCGLG5/M69y5fzfr9Ol613bQ/NaYe9bui5gKczmNYiBkIYgaCmHF85mK01t2KO2Q1h9l43dzgbhxG7b+zZ2EhZiCIGQhiRuvZ77dygNVY+3q9es5Qv1+vT2sIlb0OCzEDQcxAEDMkX1bXN7S2z8brxl2q40b3rXR9bxn4sr4RCGIGgpjxUh8S0a2feFdNYrd/Ndad9Xsrpv/cHgsxA0HMQBAzPk/reXdN7fqA3ln/PZnndE9SxsFCzEAQMxDEjJd4iJqrqtYiPlBr9qZE81znk7V/F8TUjUEQMxDEjO1ze9U1PqtFzO5X87VW1H6i+XXqyneQl/UXgSBmIIgZpdzebgxdPWdMfVnr/dHn23XsWb18VpP4DBZiBoKYgSBmbPOyukzr2Lvnlu781FzkaF7deezAQsxAEDMQxIxjTP33TcN8JpXqOOp9qg8tm586n8qehYWYgSBmIIgZrfcYZvGPW2tztZ0aj8nGzb7Prnfr5z+wED8QxAwEMaP0PvVpzV63zru6pld//6t7SvRZzXmO5rPrBwsxA0HMQBAzpGeddH08WT/VNTv6vZ/NJxp/Wh8S9ZvN5/T/x0LMQBAzEMSMY0y9mpdV3YPU+pNsnGm+1v9dyxhBjaExCGIGgpixPYdUzwUdf/8JNV+qu3dE/aj9Z/Un0XzWcTiHGIMgZiCIGaX3qf+++fLe0f0dP83FVfO0VNS9jXOIMQhiBoKY8esc0vUBqb4ttY49Q13js/uzPKsuSr4XFmIGgpiBIGaM8rKmz0bJxo36nZ5Xov6zcbvnFqWWEQsxA0HMQBAzSs9cXKneH8ULpnUV0/lle0Y3DqOOv2uPhZiBIGYgiBnbOvVunfdKNyf2to9L9UV1Y/Tr/ep5iXiIIQhiBoKYcczLys4P1b2lGwNf23dr99Q8rqnvrOvr+sBC/EAQMxDEjG1M/UHXFxWhxAUq31evd5nmjWU+MvKyvgEIYgaCmLF9F+7Ul7TSrbdQzw/qeOv9K7f+v0o7LMQMBDEDQcw4vj8kYlpf3vUFZe2jeVbbVX1Y1fE6eyAWYgaCmIEgZmyfdVL9XT7NAb5F9xyh7n3Tc1IlToKFmIEgZiCIGaV3UHXrv6P23fyubj1K1l80zwg17yq6vhsfCzE DQcxAEDOOz+2troUZaq1hNP40lr/eP61TicbP5nO6joWYgSBmIIgZx7ysiNu+ruj6dB5q7D4ii5Oo82EP+UYgiBkIYob0/pCV2/Uda7/TunX1PJHNq9qvGvN/HgcLMQNBzEAQM1p5WdM6kI mv5zReNo9uvtet+WTz+sBC/EAQMxDEjO0zF99dA9it+6jOM7qe+dKqde7V/qP5nP5eWIgZCGIGgpix3UNUbsXkq/Xd2Thd35zqE5v66Hb9YCFmIIgZCGLGlT3kwS1fUbcGsVq3HvUXnY/U+ ExEZW/DQsxAEDMQxIzS+0Mybq3REd1c3ur5qBs7z/a4zjNWsBAzEMQMBDHjZQ+Z+oAeqGv42o9aq5j1m5HN51ZdfWX+WIgZCGIGgpixfX8I/DmwEDP+DQAA//9kwGH4xZewMgAAAABJRU5E rkJggg==",
-    "url": "otpauth://totp/vault:4746fb81-028c-cd4e-026b-7dd18fe4c2f4?algorithm=SHA1&digits=6&issuer=vault&period=30&secret=XVE7TOZWJVEWQOATOD7 U53IEAJG72Z2I"
-  }
-}
-```
-
-## Administratively generate a TOTP MFA secret
-
-This endpoint can be used to generate a TOTP MFA secret. Unlike the `generate`
-API which stores the generated secret on the entity ID of the calling token,
-the `admin-generate` API stores the generated secret on the given entity ID.
-
-| Method | Path                                        |
-| :----- | :------------------------------------------ |
-| `POST` | `/sys/mfa/method/totp/:name/admin-generate` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Name of the MFA method.
-
-- `entity_id` `(string: <required>)` - Entity ID on which the generated secret
-  needs to get stored.
-
-### Sample payload
-
-```json
-{
-  "entity_id": "4746fb81-028c-cd4e-026b-7dd18fe4c2f4"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/mfa/method/totp/my_totp/admin-generate
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "barcode": "iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BAAAGZElEQVR4nOyd7W4jNwxFkyLv/8pbpMAAHnUo8pJyc1Oc82OB2KOP9QVFSyTlrz9/PsCIv356AnDn6/ufz89e48i6ov6u59f319ezfqtWnf2/snHX19XnVL7bYyFmIIgZCGLG5/e61V2b37WWXkRr9+lxonEvqv1XfeHK6/NYiBkIYgaCmPH19GK2j4ieX9/P9h0R2T6l+pzqYzKfmM0zQvk8sRAzEMQMBDHj0YdMqa6Z1TOvyDdF/VTPnqLnVzIfePLEHAsxA0HMQBAz3uJDqvuVbO1Vv/934yzReNV4ykmwEDMQxAwEMePRh5xeG6fxjNXnVM+Y1HHVM7Tq56R8nliIGQhiBoKYcfMhp2LT6hp7UY2hV8dTY/KZT1N9SufzxELMQBAzEMSMf3zI6X2HembUXbuz8dT9g+qLIiafJxZiBoKYgSBm3OpDunlMartTubrdeEUWI1dzAqa5wK9gIWYgiBkIYsaReIi6P1jbqd/7qznDqm9SfcKJs6sVLMQMBDEDQcz43K3z3fqLaf336fiFymQf8dRe8aVYiBkIYgaCmHHzIdW8pGo8QT1rOuULTvkc9a6TqD+lTgULMQNBzEAQMx7jIRdqjV7ULvpbrReJxl/nodYodseLxu/GWz6wED8QxAwEMeN2X9ZK9/4neRLDNfrUc919yPp8t/8PLMQPBDEDQcyQ6tTVO0JWqvGT6PWu75jub6L+T/kg4iHGIIgZCGLGKB5yKn5SpVuDWKXrI0/4jgssxAwEMQNBzNieZWV0v/erZ0Knxp3OYxoXqoyPhZiBIGYgiBmPub1q7m7G6fiB2n+3niSbZwT7kP8RCGIGgpjxeF9W5iPU8/+ofUY1r6q6ZkfzmtbJV2skozw04iHGIIgZCGKGlJeVvZ61V+MX07OiqJ9oftE41fGm9TD4EEMQxAwEMaN010lW1zGNoVfX+OrZl/rcfx0P2c0XCzEDQcxAEDMe87K68YBubH7tdxonmcb0q+2qZ2DK/gkLMQNBzEAQM2516lXUs6GIbA3v+qruPinrX/Ud0Xx288JCzEAQMxDEjG2NYXf/odztsXuuEoOu9BO93933RONm86n0h4WYgSBmIIgZt9+gqtaDq7m3K2rObnc+UT/Z36f2MZ28MCzEDAQxA0HMaJ1lTevBo/5OxRsysv1O9Fx1nO4Z3QcW4geCmIEgZki/H1Klu+Z369PVeVXHexfEQ34RCGIGgpjxWGN40c1VXdtXaxW79SLTOvqonVpDqdavkNv7C0AQMxDEjNK9vdP4gFq3ntV1Z+NEf099ZEZ1vrv+sBAzEMQMBDFjW2PYjT9U4xqqT1D7/ak4j5rn9QoWYgaCmIEgZpTu7e2u5Vk/4aQO3XFSHUc9s1rnNfVdr/1hIWYgiBkIYsZtH6LGA9Z20d8Z3fuq1HyqUznC1fZVX0c8xBgEMQNBzNje2xvxrlzYan1K1H82fjXOUfU12XzW5yufBxZiBoKYgSBmSL+FezE9s1lR9yHq2VvUT7fefOpjd58fFmIGgpiBIGZId52sr6u5u9M7RtTn1Hmr8ZzqnSvK2R4WYgaCmIEgZmzjIdHr3Rzfi278I3pdvStFrWVUfU52d8quPRZiBoKYgSBmbOvU//Xwobr1U7FpNV8qatetm4+onvU9jYuFmIEgZiCIGbf7srLv1d01vLsWqzmzapymeyaWfQ5qXtsrWIgZCGIGgphR+g2q9f0V9Y6SartsXtP8qOmZWDTe5AwMCzEDQcxAEDMeY+rVfUj0fLddN9Y+3feodfPd+pnKvLAQMxDEDAQxY1unPo11q+2i8adxCXV+an/qfHbzwELMQBAzEMQMKaYediL6FDVmruaBTWsU1bMwdT67/zcWYgaCmIEgZrR+g+piPata18Tu9/Zurq5aTxLNV833qs6nMg8sxAwEMQNBzHisD8lQ6y3W/qt3kpyuS8/ez3xiNL/qfMjL+oUgiBkIYkYppn7R9THd56s5tBGn60myfcSJ3GMsxAwEMQNBzGjdlxXRja1068mj9tla3c3DysaLxon+fgILMQNBzEAQM476kG5c5aJ7BnS6bqX6+jS/jLysXwCCmIEgZmx/x7DK6btCurF31WdMawPfkXOMhZiBIGYgiBmPvx+iUo2RV/vp3llSpZuXpfqgbNwnsBAzEMQMBDHjSH0InAMLMePvAAAA//8x2VnbmmL6HQAAAABJRU5ErkJggg==",
-    "url": "otpauth://totp/vault:4746fb81-028c-cd4e-026b-7dd18fe4c2f4?algorithm=SHA1&digits=6&issuer=vault&period=30&secret=6HQ4RZ7GM6MMLRKVDCI23LXNZF7UDZ2U"
-  }
-}
-```
-
-### Administratively destroy TOTP MFA secret
-
-This endpoint deletes a TOTP MFA secret from the given entity ID.
-
-Note that in order to overwrite a secret on the entity, it is required to
-explicitly delete the secret first. This API can be used to delete the secret
-and the `generate` or `admin-generate` APIs should be used to regenerate a new
-secret.
-
-| Method | Path                                  |
-| :----- | :------------------------------------ |
-| `POST` | `/sys/mfa/method/:name/admin-destroy` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the MFA method.
-
-- `entity_id` `(string: <required>)` - Entity ID from which the MFA secret
-  should be removed.
-
-### Sample payload
-
-```json
-{
-  "entity_id": "4746fb81-028c-cd4e-026b-7dd18fe4c2f4"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/mfa/method/totp/my_totp/admin-destroy
-```
diff --git a/website/content/api-docs/system/mfa/validate.mdx b/website/content/api-docs/system/mfa/validate.mdx
deleted file mode 100644
index 52e3c3c19fe..00000000000
--- a/website/content/api-docs/system/mfa/validate.mdx
+++ /dev/null
@@ -1,93 +0,0 @@
----
-layout: api
-page_title: /sys/mfa/validate - HTTP API
-description: >-
-  The '/sys/mfa/validate' endpoint focuses on validating login MFA requests.
-  If validation succeeds, it returns an auth response which includes a client token.
----
-
-## Validate login MFA request
-
-This endpoint validates a login request which is subject to MFA validation.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST`  | `/sys/mfa/validate` |
-
-### Parameters
-
-- `mfa_request_id` `(string: <required>)` – A unique identification of an MFA restricted login request.
- This can be found in the MFA requirement included in the auth response of the login request.
-
-- `mfa_payload` `(map<string|[]string>: <required>)` - A map of login MFA methodIDs to passcode credentials.
-MFA methodIDs are UUID strings which are used as keys of the map. The values of the map are
-string slices. In cases where an MFA method is configured not to use passcodes, the passcode remains an empty string.
-
-
-### Sample payload
-
-```json
-{
-  "mfa_request_id": "5879c74a-1418-1948-7be9-97b209d693a7",
-  "mfa_payload": {
-      "d16fd3c2-50de-0b9b-eed3-0301dadeca10": ["910201"]
-  }
-}
-```
-
-As of Vault 1.13.0, it is also possible to use an MFA method name as the key to the `mfa_payload`.
-In versions 1.12.x and below,`passcode=` was used for Duo MFA only. Starting in version 1.13.x, `passcode=` is optional for all supported MFA methods.
-
-```json
-{
-  "mfa_request_id": "5879c74a-1418-1948-7be9-97b209d693a7",
-  "mfa_payload": {
-      "sample_mfa_method_name": ["passcode=910201"]
-  }
-}
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/mfa/validate
-```
-
-### Sample response
-
-In cases where MFA validation fails, a 403 status code is returned with
-the details about the error.
-If MFA validation succeeds, the response is identical to a successful
-login request which contains a client token and its accessor.
-
-```json
-{
-  "request_id": "7e7dec1d-311a-ecbd-4dd0-ff12a5e38959",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": null,
-  "warnings": null,
-  "auth": {
-    "client_token": "hvs.CAESIKZJNqQbG9E9cQGPXh68NWxi3xp7yPa1Z1RWv1P9UyHVGh4KHGh2cy5GUmYzTzdJOWhIZGFNSm5jdTBsSVNFSTk",
-    "accessor": "3fBgbEmHyA5IWABmVEjqManI",
-    "policies": [
-      "default"
-    ],
-    "token_policies": [
-      "default"
-    ],
-    "identity_policies": null,
-    "metadata": {
-      "username": "alice"
-    },
-    "orphan": true,
-    "entity_id": "caeac75b-dbfe-58be-e3fc-957549b7292e",
-    "lease_duration": 2764800,
-    "renewable": true,
-    "mfa_requirement": null
-  }
-}
-```
diff --git a/website/content/api-docs/system/monitor.mdx b/website/content/api-docs/system/monitor.mdx
deleted file mode 100644
index 11b493e6c9e..00000000000
--- a/website/content/api-docs/system/monitor.mdx
+++ /dev/null
@@ -1,49 +0,0 @@
----
-layout: api
-page_title: /sys/monitor - HTTP API
-description: The `/sys/monitor` endpoint is used to receive streaming logs from the Vault server.
----
-
-# `/sys/monitor`
-
-@include 'alerts/restricted-admin.mdx'
-
-The `/sys/monitor` endpoint is used to receive streaming logs from the Vault server.
-
-If Vault is emitting log messages faster than a receiver can process them, then
-some log lines will be dropped.
-
-## Monitor system logs
-
-This endpoint streams logs back to the client from Vault. Note that unlike most API endpoints in Vault, this one
-does not return JSON by default. This will send back data in whatever log format Vault has been configured with. By
-default, this is text.
-
-| Method | Path           |
-| :----- | :------------- |
-| `GET`  | `/sys/monitor` |
-
-### Parameters
-
-- `log_level` `(string: "info")` – Specifies the log level to use when streaming logs. This defaults to `info`
-  if not specified.
-
-- `log_format` `(string: "standard")` – Specifies the log format to emit when streaming logs. Supported values are "standard" and "json". The default is `standard`,
-if not specified.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    'http://127.0.0.1:8200/v1/sys/monitor?log_level=debug'
-```
-
-### Sample response
-
-```
-2020-09-15T11:28:09.188-0700 [INFO]  core: successful mount: namespace= path=foo/ type=kv
-2020-09-15T11:28:18.265-0700 [DEBUG] core.secrets.deletion: clearing view: namespace=root path=foo/ total_keys=0
-2020-09-15T11:28:18.265-0700 [DEBUG] core.secrets.deletion: view cleared: namespace=root path=foo/
-2020-09-15T11:28:18.265-0700 [INFO]  core: successfully unmounted: path=foo/ namespace=
-```
diff --git a/website/content/api-docs/system/mounts.mdx b/website/content/api-docs/system/mounts.mdx
deleted file mode 100644
index 6e86d17dd36..00000000000
--- a/website/content/api-docs/system/mounts.mdx
+++ /dev/null
@@ -1,412 +0,0 @@
----
-layout: api
-page_title: /sys/mounts - HTTP API
-description: The `/sys/mounts` endpoint is used to manage secrets engines in Vault.
----
-
-# `/sys/mounts`
-
-The `/sys/mounts` endpoint is used to manage secrets engines in Vault.
-
-## List mounted secrets engines
-
-This endpoints lists all the mounted secrets engines.
-
-| Method | Path          |
-| :----- | :------------ |
-| `GET`  | `/sys/mounts` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/mounts
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "48d2c601-97a0-3904-f549-4fcbc740d718",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "cubbyhole/": {
-      "accessor": "cubbyhole_eb4503de",
-      "config": {
-        "default_lease_ttl": 0,
-        "force_no_cache": false,
-        "max_lease_ttl": 0
-      },
-      "description": "per-token private secret storage",
-      "external_entropy_access": false,
-      "local": true,
-      "options": null,
-      "plugin_version": "",
-      "running_plugin_version": "v1.12.0+builtin.vault",
-      "running_sha256": "",
-      "seal_wrap": false,
-      "type": "cubbyhole",
-      "uuid": "79ddaa52-fa07-6f19-653a-f0777f6439fd"
-    },
-    "identity/": {
-      "accessor": "identity_68a03448",
-      "config": {
-        "default_lease_ttl": 0,
-        "force_no_cache": false,
-        "max_lease_ttl": 0
-      },
-      "description": "identity store",
-      "external_entropy_access": false,
-      "local": false,
-      "options": null,
-      "plugin_version": "",
-      "running_plugin_version": "v1.12.0+builtin.vault",
-      "running_sha256": "",
-      "seal_wrap": false,
-      "type": "identity",
-      "uuid": "45f79a67-58f7-3f87-892c-9032084e7801"
-    },
-    "secret/": {
-      "accessor": "kv_aedd93c1",
-      "config": {
-        "default_lease_ttl": 0,
-        "force_no_cache": false,
-        "max_lease_ttl": 0
-      },
-      "deprecation_status": "supported",
-      "description": "key/value secret storage",
-      "external_entropy_access": false,
-      "local": false,
-      "options": {
-        "version": "2"
-      },
-      "plugin_version": "",
-      "running_plugin_version": "v0.13.0+builtin",
-      "running_sha256": "",
-      "seal_wrap": false,
-      "type": "kv",
-      "uuid": "8074a73f-6921-c0cd-589a-016405dc46ec"
-    },
-    "sys/": {
-      "accessor": "system_f8df2902",
-      "config": {
-        "default_lease_ttl": 0,
-        "force_no_cache": false,
-        "max_lease_ttl": 0,
-        "passthrough_request_headers": ["Accept"]
-      },
-      "description": "system endpoints used for control, policy and debugging",
-      "external_entropy_access": false,
-      "local": false,
-      "options": null,
-      "plugin_version": "",
-      "running_plugin_version": "v1.12.0+builtin.vault",
-      "running_sha256": "",
-      "seal_wrap": false,
-      "type": "system",
-      "uuid": "c79f4f66-4cfa-4521-9d31-b1238b0a6800"
-    }
-  },
-  "warnings": null
-}
-```
-
-`default_lease_ttl` or `max_lease_ttl` values of 0 mean that the system defaults
-are used by this backend.
-
-## Enable secrets engine
-
-This endpoint enables a new secrets engine at the given path.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/sys/mounts/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path where the secrets engine
-  will be mounted. This is specified as part of the URL.
-
-  !> **NOTE:** Use ASCII printable characters to specify the desired path.
-
-- `type` `(string: <required>)` – Specifies the type of the backend, such as
-  "aws".
-
-- `description` `(string: "")` – Specifies the human-friendly description of the
-  mount.
-
-- `config` `(map<string|string>: nil)` – Specifies configuration options for
-  this mount; if set on a specific mount, values will override any global
-  defaults (e.g. the system TTL/Max TTL)
-
-  - `default_lease_ttl` `(string: "")` - The default lease duration, specified
-    as a string duration like "5s" or "30m".
-
-  - `max_lease_ttl` `(string: "")` - The maximum lease duration, specified as a
-    string duration like "5s" or "30m".
-
-  - `force_no_cache` `(bool: false)` - Disable caching.
-
-  - `audit_non_hmac_request_keys` `(array: [])` - List of keys that will not be
-    HMAC'd by audit devices in the request data object.
-
-  - `audit_non_hmac_response_keys` `(array: [])` - List of keys that will not be
-    HMAC'd by audit devices in the response data object.
-
-  - `listing_visibility` `(string: "")` - Specifies whether to show this mount
-    in the UI-specific listing endpoint. Valid values are `"unauth"` or
-    `"hidden"`. If not set, behaves like `"hidden"`.
-
-  - `passthrough_request_headers` `(array: [])` - List of headers to allow
-    and pass from the request to the plugin.
-
-  - `allowed_response_headers` `(array: [])` - List of headers to allow,
-    allowing a plugin to include them in the response.
-
-  - `plugin_version` `(string: "")` – Specifies the semantic version of the plugin
-    to use, e.g. "v1.0.0". If unspecified, the server will select any matching
-    unversioned plugin that may have been registered, the latest versioned plugin
-    registered, or a built-in plugin in that order of precedence.
-
-  - `allowed_managed_keys` `(array: [])` - List of managed key registry entry names
-    that the mount in question is allowed to access.
-
-  - `delegated_auth_accessors` `(array: [])` - List of allowed authentication mount
-    accessors the backend can request delegated authentication for.
-
-  - `identity_token_key` `(string: "")` - The key to use for signing plugin workload
-    identity tokens. If not provided, this will default to Vault's OIDC
-    [default key](/vault/docs/concepts/oidc-provider#keys).
-
-- `options` `(map<string|string>: nil)` - Specifies mount type specific options
-  that are passed to the backend.
-
-  _Key/Value (KV)_
-
-  - `version` `(string: "1")` - The version of the KV to mount. Set to "2" for mount
-    KV v2.
-
-Additionally, the following options are allowed in Vault open-source, but
-relevant functionality is only supported in Vault Enterprise:
-
-- `local` `(bool: false)` – Specifies if the secrets engine is a local mount
-  only. Local mounts are not replicated nor (if a secondary) removed by
-  replication.
-
-- `seal_wrap` `(bool: false)` - Enable seal wrapping for the mount, causing
-  values stored by the mount to be wrapped by the seal's encryption capability.
-
-- `external_entropy_access` `(bool: false)` - Enable the secrets engine to access
-  Vault's external entropy source.
-
-### Sample payload
-
-```json
-{
-  "type": "aws",
-  "config": {
-    "force_no_cache": true
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/mounts/my-mount
-```
-
-## Disable secrets engine
-
-This endpoint disables the mount point specified in the URL.
-
-| Method   | Path                |                    |
-| :------- | :------------------ | ------------------ |
-| `DELETE` | `/sys/mounts/:path` | `204 (empty body)` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/mounts/my-mount
-```
-
-### Force disable
-
-Because disabling a secrets engine revokes secrets associated with this mount,
-possible errors can prevent the secrets engine from being disabled if the
-revocation fails.
-
-The best way to resolve this is to figure out the underlying issue and then
-disable the secrets engine once the underlying issue is resolved. Often, this can be as
-simple as increasing the timeout (in the event of timeout errors).
-
-For recovery situations where the secret was manually removed from the
-secrets backing service, one can force a secrets engine disable in Vault by
-performing a [force revoke](/vault/api-docs/system/leases)
-on the mount prefix, followed by a secrets disable when that completes.
-If the underlying secrets were not manually cleaned up, this method might result
-in dangling credentials. This is meant for extreme circumstances.
-
-## Get the configuration of a secret engine
-
-This endpoint returns the configuration of a specific secret engine.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/sys/mounts/:path` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/mounts/cubbyhole
-```
-
-### Sample response
-
-```json
-{
-  "config": {
-    "default_lease_ttl": 0,
-    "force_no_cache": false,
-    "max_lease_ttl": 0
-  },
-  "description": "per-token private secret storage",
-  "accessor": "cubbyhole_db85f061",
-  "external_entropy_access": false,
-  "options": null,
-  "uuid": "9c0e211a-904d-e41d-e1a2-7f1ff2bb8461",
-  "type": "cubbyhole",
-  "local": true,
-  "seal_wrap": false,
-  "request_id": "efdab917-ade2-1802-b8fa-fe2e6486d4e5",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "accessor": "cubbyhole_db85f061",
-    "config": {
-      "default_lease_ttl": 0,
-      "force_no_cache": false,
-      "max_lease_ttl": 0
-    },
-    "description": "per-token private secret storage",
-    "external_entropy_access": false,
-    "local": true,
-    "options": null,
-    "plugin_version": "",
-    "running_plugin_version": "v1.12.0+builtin.vault",
-    "running_sha256": "",
-    "seal_wrap": false,
-    "type": "cubbyhole",
-    "uuid": "9c0e211a-904d-e41d-e1a2-7f1ff2bb8461"
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Read mount configuration
-
-This endpoint reads the given mount's configuration. Unlike the `mounts`
-endpoint, this will return the current time in seconds for each TTL, which may
-be the system default or a mount-specific value.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `GET`  | `/sys/mounts/:path/tune` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/mounts/my-mount/tune
-```
-
-### Sample response
-
-```json
-{
-  "default_lease_ttl": 3600,
-  "max_lease_ttl": 7200,
-  "force_no_cache": false
-}
-```
-
-## Tune mount configuration
-
-This endpoint tunes configuration parameters for a given mount point.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/sys/mounts/:path/tune` |
-
-### Parameters
-
-- `default_lease_ttl` `(int: 0)` – Specifies the default time-to-live. This
-  overrides the global default. A value of `0` is equivalent to the system
-  default TTL.
-
-- `max_lease_ttl` `(int: 0)` – Specifies the maximum time-to-live. This
-  overrides the global default. A value of `0` are equivalent and set to the
-  system max TTL.
-
-- `description` `(string: "")` – Specifies the description of the mount. This
-  overrides the current stored value, if any.
-
-- `audit_non_hmac_request_keys` `(array: [])` - Specifies the list of keys that
-  will not be HMAC'd by audit devices in the request data object.
-
-- `audit_non_hmac_response_keys` `(array: [])` - Specifies the list of keys that
-  will not be HMAC'd by audit devices in the response data object.
-
-- `listing_visibility` `(string: "")` - Specifies whether to show this mount in
-  the UI-specific listing endpoint. Valid values are `"unauth"` or `"hidden"`.
-  If not set, behaves like `"hidden"`.
-
-- `passthrough_request_headers` `(array: [])` - List of headers to allow
-  and pass from the request to the plugin.
-
-- `allowed_response_headers` `(array: [])` - List of headers to allow,
-  allowing a plugin to include them in the response.
-
-- `allowed_managed_keys` `(array: [])` - List of managed key registry entry names
-  that the mount in question is allowed to access.
-
-- `plugin_version` `(string: "")` – Specifies the semantic version of the plugin
-  to use, e.g. "v1.0.0". Changes will not take effect until the mount is reloaded.
-
-- `delegated_auth_accessors` `(array: [])` - List of allowed authentication mount
-  accessors the backend can request delegated authentication for.
-
-### Sample payload
-
-```json
-{
-  "default_lease_ttl": 1800,
-  "max_lease_ttl": 3600
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/mounts/my-mount/tune
-```
diff --git a/website/content/api-docs/system/namespaces.mdx b/website/content/api-docs/system/namespaces.mdx
deleted file mode 100644
index 84fc6d5d1a8..00000000000
--- a/website/content/api-docs/system/namespaces.mdx
+++ /dev/null
@@ -1,284 +0,0 @@
----
-layout: api
-page_title: /sys/namespaces - HTTP API
-description: The `/sys/namespaces` endpoint is used manage namespaces in Vault.
----
-
-# `/sys/namespaces`
-
-The `/sys/namespaces` endpoint is used manage namespaces in Vault.
-
-## List namespaces
-
-This endpoints lists all the namespaces.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `LIST` | `/sys/namespaces` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    -X LIST \
-    http://127.0.0.1:8200/v1/sys/namespaces
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "key_info": {
-      "bar/": {
-        "custom_metadata": {},
-        "id": "HWmNL",
-        "path": "bar/"
-      },
-      "foo/": {
-        "custom_metadata": {},
-        "id": "5q39x",
-        "path": "foo/"
-      }
-    },
-    "keys": [
-      "bar/",
-      "foo/"
-    ]
-  }
-}
-```
-
-## Create namespace
-
-This endpoint creates a namespace at the given path.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST` | `/sys/namespaces/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path where the namespace
-  will be created.
-- `custom_metadata` `(map<string|string>: nil)` - A map of arbitrary string to string valued user-provided metadata meant
-  to describe the namespace.
-
-### Sample payload
-
-```json
-{
-  "custom_metadata": {
-    "foo": "abc",
-    "bar": "123"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/namespaces/ns1
-```
-
-## Patch namespace
-
-This endpoint patches an existing namespace at the specified path.
-
-| Method   | Path                    |
-| :------- | :---------------------- |
-| `PATCH`  | `/sys/namespaces/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the path of the existing namespace.
-- `custom_metadata` `(map<string|string>: nil)` - A map of arbitrary string to string valued user-provided metadata meant
-  to describe the namespace.
-
-### Sample payload
-
-```json
-{
-  "custom_metadata": {
-    "foo": "abc",
-    "bar": "123"
-  }
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --header "Content-Type: application/merge-patch+json"
-    --request PATCH \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/namespaces/ns1
-```
-
-## Delete namespace
-
-This endpoint deletes a namespace at the specified path.
-
-| Method   | Path                    |
-| :------- | :---------------------- |
-| `DELETE` | `/sys/namespaces/:path` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/namespaces/ns1
-```
-
-## Read namespace information
-
-This endpoint gets the metadata for the given namespace path.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `GET`  | `/sys/namespaces/:path` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/namespaces/ns1
-```
-
-### Sample response
-
-```json
-{
-  "id": "gsudj",
-  "path": "ns1/",
-  "custom_metadata": {
-    "foo": "abc",
-    "bar": "123"
-  }
-}
-```
-
-## Lock namespace
-
-This endpoint locks the API for the current namespace path or optional subpath.
-The behavior when interacting with Vault from a locked namespace is described in
-[API Locked Response](/vault/docs/concepts/namespace-api-lock#api-locked-response).
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST`  | `/sys/namespaces/api-lock/lock/:subpath` |
-
-### Sample request - current namespace
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/namespaces/api-lock/lock
-```
-
-### Sample response - current namespace
-
-```json
-{
-    "unlock_key": "<unlock key for current/ns/path>"
-}
-```
-
-### Sample request - X-Vault-Namespace
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --header "X-Vault-Namespace: some/path
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/namespaces/api-lock/lock
-```
-
-### Sample response - X-Vault-Namespace
-
-```json
-{
-    "unlock_key": "<unlock key for some/path>"
-}
-```
-
-### Sample request - descendant of current namespace
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/namespaces/api-lock/lock/some/descendant/subpath
-```
-
-### Sample response - descendant of current namespace
-
-```json
-{
-    "unlock_key": "<unlock key for current/ns/path/some/descendant/subpath>"
-}
-```
-
-## Unlock namespace
-
-This endpoint unlocks the api for the current namespace path or optional subpath.
-
-| Method | Path                    |
-| :----- | :---------------------- |
-| `POST`  | `/sys/namespaces/api-lock/unlock/:subpath` |
-
-### Sample payload - current namespace Non-Root
-
-```json
-{
-  "unlock_key": "<unlock key for current/ns/path>"
-}
-```
-
-### Sample request - current namespace Non-Root
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/namespaces/api-lock/unlock
-```
-
-### Sample request - current namespace root
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: <some root token>" \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/namespaces/api-lock/unlock
-```
-
-### Sample payload - descendant namespace Non-Root
-
-```json
-{
-  "unlock_key": "<unlock key for current/ns/path/some/descendant/subpath>"
-}
-```
-
-### Sample request - descendant namespace Non-Root
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/namespaces/api-lock/unlock/some/descendant/path
-```
diff --git a/website/content/api-docs/system/plugins-catalog.mdx b/website/content/api-docs/system/plugins-catalog.mdx
deleted file mode 100644
index c2f912c920a..00000000000
--- a/website/content/api-docs/system/plugins-catalog.mdx
+++ /dev/null
@@ -1,282 +0,0 @@
----
-layout: api
-page_title: /sys/plugins/catalog - HTTP API
-description: The `/sys/plugins/catalog` endpoint is used to manage plugins.
----
-
-# `/sys/plugins/catalog`
-
-The `/sys/plugins/catalog` endpoint is used to read, register, update, and
-remove plugins in Vault's catalog. Plugins must be registered before use, and
-once registered backends can use the plugin by querying the catalog.
-
-## LIST plugins
-
-This endpoint lists the plugins in the catalog by type.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/sys/plugins/catalog` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/plugins/catalog
-```
-
-### Sample response
-
-```json
-{
-    "data": {
-        "auth": [
-            "aws",
-            "azure",
-            "custom-auth-plugin",
-            "gcp",
-            "ldap"
-        ],
-        "database": [
-            "cassandra-database-plugin",
-            "mssql-database-plugin",
-            "mysql-database-plugin",
-            "postgresql-database-plugin"
-        ],
-        "detailed": [
-            {
-                "builtin": true,
-                "deprecation_status": "supported",
-                "name": "aws",
-                "type": "auth",
-                "version": "v1.12.0+builtin.vault"
-            },
-            ...
-            {
-                "builtin": true,
-                "deprecation_status": "supported",
-                "name": "cassandra-database-plugin",
-                "type": "database",
-                "version": "v1.12.0+builtin.vault"
-            },
-            ...
-            {
-                "builtin": true,
-                "deprecation_status": "supported",
-                "name": "aws",
-                "type": "secret",
-                "version": "v1.12.0+builtin.vault"
-            },
-            ...
-            {
-                "builtin": false,
-                "name": "example-plugin",
-                "type": "secret",
-                "oci_image": "example-secret-plugin-oci-image",
-                "runtime": "example-runtime",
-                "version": "v1.0.0"
-            },
-            ...
-        ],
-        "secret": [
-            "ad",
-            "aws",
-            "azure",
-            "gcp",
-            "transit",
-            "example-plugin",
-        ]
-    }
-}
-```
-
-## LIST plugins
-
-This endpoint lists the plugins in the catalog by type.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `LIST` | `/sys/plugins/catalog/auth`     |
-| `LIST` | `/sys/plugins/catalog/database` |
-| `LIST` | `/sys/plugins/catalog/secret`   |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST
-    http://127.0.0.1:8200/v1/sys/plugins/catalog/auth
-```
-
-### Sample response
-
-```json
-{
-    "data": {
-        "keys": [
-            "aws",
-            "azure",
-            "custom-auth-plugin",
-            "gcp",
-            "ldap"
-        ]
-    }
-}
-```
-
-## Register plugin
-
-This endpoint registers a new plugin, or updates an existing one with the
-supplied name.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `POST` | `/sys/plugins/catalog/:type/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name for this plugin. The name
-  is what is used to look up plugins in the catalog. This is part of the request
-  URL.
-
-- `type` `(string: <required>)` – Specifies the type of this plugin. May be
-  "auth", "database", or "secret".
-
-- `oci_image` `(string: "")` - Specifies OCI image to run. If specified, setting `command`,
-  `args`, and `env` will update the container's entrypoint, args, and environment
-  variables (append-only) respectively.
-
-- `runtime` `(string: "")` - Specifies Vault plugin runtime to use if `oci_image` is specified.
-  See [/sys/plugins/runtimes/catalog](/vault/api-docs/system/plugins-runtimes-catalog) for additional information.
-
-- `version` `(string: "")` - Specifies the semantic version of the plugin. Used as the tag
-  when specifying `oci_image`, but with any leading 'v' trimmed.
-
-- `sha256` `(string: <required>)` – This is the SHA256 sum of the plugin's
-  binary or the OCI image. Before a plugin is run, its SHA will be checked against this value.
-  If they do not match the plugin can not be run.
-
-- `command` `(string: <required>)` - Specifies the command used to execute the
-  plugin. This is relative to the plugin directory. e.g. `"myplugin"`, or if `oci_image`
-  is also specified, it is relative to the image's working directory.
-
-- `args` `(array: [])` – Specifies the arguments used to execute the plugin. If
-  the arguments are provided here, the `command` parameter should only contain
-  the named program. e.g. `"--my_flag=1"`.
-
-- `env` `(array: [])` – Specifies the environment variables used during the
-  execution of the plugin. Each entry is of the form "key=value". e.g
-  `"FOO=BAR"`.
-
-### Sample payload
-
-```json
-{
-  "sha256": "d130b9a0fbfddef9709d8ff92e5e6053ccd246b78632fc03b8548457026961e9",
-  "command": "mysql-database-plugin"
-}
-```
-
-### Sample payload using OCI image
-
-```json
-{
-  "sha256": "d150b9a0fbfddef9709d8ff92e5e6053ccd246b78632fc03b8548457026961a9",
-  "oci_image": "example-secret-plugin-oci-image",
-  "runtime": "example-runtime"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/plugins/catalog/secret/example-plugin
-```
-
-## Read plugin
-
-This endpoint returns the configuration data for the plugin with the given name.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path                                                |
-| :----- | :-------------------------------------------------- |
-| `GET`  | `/sys/plugins/catalog/:type/:name?version=:version` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the plugin to retrieve.
-  This is part of the request URL.
-
-- `type` `(string: <required>)` – Specifies the type of this plugin. May be
-  "auth", "database", or "secret".
-
-- `version` `(string: "")` – The semantic version of the plugin to read. Required
-  if the plugin was registered with a version.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/plugins/catalog/secret/example-plugin?version=v1.0.0
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "args": [],
-    "builtin": false,
-    "runtime": "example-runtime",
-    "oci_image": "example-secret-plugin-oci-image",
-    "command": "/example-secret-plugin",
-    "name": "example-plugin",
-    "sha256": "0TC5oPv93vlwnY/5Ll5gU8zSRreGMvwDuFSEVwJpYek=",
-    "version": "v1.0.0"
-  }
-}
-```
-
-## Remove plugin from catalog
-
-This endpoint removes the plugin with the given name.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method   | Path                                                |
-| :------- | :-------------------------------------------------- |
-| `DELETE` | `/sys/plugins/catalog/:type/:name?version=:version` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the plugin to delete.
-  This is part of the request URL.
-
-- `type` `(string: <required>)` – Specifies the type of this plugin. May be
-  "auth", "database", or "secret".
-
-- `version` `(string: "")` – Specifies the semantic version of the plugin
-  to delete.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/plugins/catalog/secret/example-plugin?version=v1.0.0
-```
diff --git a/website/content/api-docs/system/plugins-reload.mdx b/website/content/api-docs/system/plugins-reload.mdx
deleted file mode 100644
index eee8804de2f..00000000000
--- a/website/content/api-docs/system/plugins-reload.mdx
+++ /dev/null
@@ -1,122 +0,0 @@
----
-layout: api
-page_title: /sys/plugins/reload - HTTP API
-description: The `/sys/plugins/reload` endpoints are used to reload plugins.
----
-
-# `/sys/plugins/reload`
-
-## Reload plugin
-
-The `/sys/plugins/reload/:type/:name` endpoint reloads a named plugin across all
-namespaces. It is only available in the root namespace. All instances of the plugin
-will be killed, and any newly pinned version of the plugin will be started in
-their place.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `POST` | `/sys/plugins/reload/:type/:name` |
-
-### Parameters
-
-- `type` `(string: <required>)` – The type of the plugin, as registered in the
-  plugin catalog. One of "auth", "secret", "database", or "unknown". If "unknown",
-  all plugin types with the provided name will be reloaded.
-
-- `name` `(string: <required>)` – The name of the plugin to reload, as registered
-  in the plugin catalog.
-
-- `scope` `(string: "")` - The scope of the reload. If omitted, reloads the
-  plugin or mounts on this Vault instance. If 'global', will begin reloading the
-  plugin on all instances of a cluster.
-
-### Sample payload
-
-```json
-{
-  "scope": "global"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/plugins/reload/auth/mock-plugin
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "reload_id": "bdddb8df-ccb6-1b09-670d-efa9d3f2c11b"
-  },
-  ...
-}
-```
-
--> Note: If no plugins are reloaded on the node that serviced the request, a
-warning will also be returned in the response.
-
-## Reload plugins within a namespace
-
-The `/sys/plugins/reload/backend` endpoint is used to reload mounted plugin
-backends. Either the plugin name (`plugin`) or the desired plugin backend mounts
-(`mounts`) must be provided, but not both. In the case that the plugin name is
-provided, all mounted paths that use that plugin backend will be reloaded.
-
-This API is available in all namespaces, and is limited to reloading plugins in
-use within the request's namespace.
-
-| Method | Path -                        |
-| :----- | :---------------------------- |
-| `POST` | `/sys/plugins/reload/backend` |
-
-### Parameters
-
-- `plugin` `(string: "")` – The name of the plugin to reload, as
-  registered in the plugin catalog.
-
-- `mounts` `(array: [])` – Array or comma-separated string mount paths
-  of the plugin backends to reload.
-
-- `scope` `(string: "")` - The scope of the reload. If omitted, reloads the
-  plugin or mounts on this Vault instance. If 'global', will begin reloading the
-  plugin on all instances of a cluster.
-
-### Sample payload
-
-```json
-{
-  "plugin": "mock-plugin",
-  "scope": "global"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/plugins/reload/backend
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "reload_id": "bdddb8df-ccb6-1b09-670d-efa9d3f2c11b"
-  },
-  ...
-}
-```
-
--> Note: If no plugins are reloaded on the node that serviced the request, a
-warning will also be returned in the response.
diff --git a/website/content/api-docs/system/plugins-runtimes-catalog.mdx b/website/content/api-docs/system/plugins-runtimes-catalog.mdx
deleted file mode 100644
index ae5a5688fb9..00000000000
--- a/website/content/api-docs/system/plugins-runtimes-catalog.mdx
+++ /dev/null
@@ -1,187 +0,0 @@
----
-layout: api
-page_title: /sys/plugins/runtimes/catalog - HTTP API
-description: The `/sys/plugins/runtimes/catalog` endpoint is used to manage plugin runtimes.
----
-
-# `/sys/plugins/runtimes/catalog`
-
-The `/sys/plugins/runtimes/catalog` manages plugin runtimes in your Vault catalog by reading, registering,
-updating, and removing plugin runtime information. Plugin runtimes must be registered before use, and
-once registered, backends can use the plugin runtime by referencing them when registering a plugin.
-
-## LIST plugin runtimes
-
-The list endpoint returns a list of the plugin runtimes in the catalog.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `LIST`  | `/sys/plugins/runtimes/catalog` |
-| `GET`  | `/sys/plugins/runtimes/catalog` |
-| `LIST`  | `/sys/plugins/runtimes/catalog?type=:type` |
-| `GET`  | `/sys/plugins/runtimes/catalog?type=:type` |
-
-### Parameters
-
-- `type` `(string: <required>)` – Specifies the plugin runtime type to list. Currently
-  only accepts "container".
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST
-    http://127.0.0.1:8200/v1/sys/plugins/runtimes/catalog
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "runtimes": [
-      {
-        "name": "example-plugin-runtime",
-        "type": "container",
-        "oci_runtime": "example-oci-runtime",
-        "cgroup_parent": "/examplelimit/",
-        "cpu_nanos": 1000,
-        "memory_bytes": 10000000
-      },
-      ...
-    ]
-  }
-}
-```
-
-## Register plugin runtime
-
-The registration endpoint registers a new plugin runtime, or updates an existing one with the
-supplied type and name.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `POST` | `/sys/plugins/runtimes/catalog/:type/:name` |
-
-### Parameters
-
-- `type` `(string: <required>)` – Specifies the plugin runtime type. Currently
-  only accepts "container".
-
-- `name` `(string: <required>)` – Part of the request URL. Specifies the plugin runtime name.
-   Use the runtime name to look up plugin runtimes in the catalog.
-
-- `rootless` `(bool: false)` - Whether the container runtime is running as a
-  non-privileged user. Must be set if plugin container images are also configured
-  to run as a non-root user.
-
-- `oci_runtime` `(string: <optional>)` – Specifies OCI-compliant container runtime to use.
-  Default is "runsc", gVisor's OCI runtime.
-
-- `cgroup_parent` `(string: <optional>)` – Specifies the parent cgroup to set for each container.
-  Use the cgroup to control the total resource usage for a group of plugins.
-
-- `cpu_nanos` `(int: <optional>)` – Specifies cpu limit to set per container in billionths of a CPU.
-  Defaults to no limit.
-
-- `memory_bytes` `(int: <optional>)` – Specifies memory limit to set per container in bytes.
-  Defaults to no limit.
-
-### Sample payload
-
-```json
-{
-  "oci_runtime": "example-oci-runtime",
-  "cgroup_parent": "/examplelimit/",
-  "cpu_nanos": 1000,
-  "memory_bytes": 10000000
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/plugins/runtimes/catalog/container/example-plugin-runtime
-```
-
-## Read plugin runtime
-
-The read endpoint returns the configuration data for the plugin runtime with the given type and name.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method | Path                                                |
-| :----- | :-------------------------------------------------- |
-| `GET`  | `/sys/plugins/runtimes/catalog/:type/:name` |
-
-### Parameters
-
-- `type` `(string: <required>)` – Specifies the type of this plugin runtime. Currently
-  only accepts "container".
-
-- `name` `(string: <required>)` – Part of the request URL. Specifies the name of the plugin runtime to retrieve.
-
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/plugins/runtimes/catalog/container/example-plugin-runtime
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "name": "example-plugin-runtime",
-    "type": "container",
-    "oci_runtime": "example-oci-runtime",
-    "cgroup_parent": "/examplelimit/",
-    "cpu_nanos": 1000,
-    "memory_bytes": 10000000
-  }
-}
-```
-
-## Remove plugin runtime from catalog
-
-The remove endpoint removes the plugin runtime with the given type and name. Note that
-the request will fail if any registered plugin references the plugin runtime.
-
-- **`sudo` required** – This endpoint requires `sudo` capability in addition to
-  any path-specific capabilities.
-
-| Method   | Path                                                |
-| :------- | :-------------------------------------------------- |
-| `DELETE` | `/sys/plugins/runtimes/catalog/:type/:name` |
-
-### Parameters
-
-- `type` `(string: <required>)` – Specifies the type of this plugin runtime. Currently
-  only accepts "container".
-
-- `name` `(string: <required>)` – Part of the request URL. Specifies the name of the plugin runtime to delete.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/plugins/runtimes/catalog/container/example-plugin-runtime
-```
diff --git a/website/content/api-docs/system/policies-password.mdx b/website/content/api-docs/system/policies-password.mdx
deleted file mode 100644
index 9e17f8403d9..00000000000
--- a/website/content/api-docs/system/policies-password.mdx
+++ /dev/null
@@ -1,198 +0,0 @@
----
-layout: api
-page_title: /sys/policies/password - HTTP API
-description: >-
-  The `/sys/policies/password` endpoints are used to manage password generation policies in Vault.
----
-
-# `/sys/policies/password/`
-
-The `/sys/policies/password/` endpoints are used to manage password generation policies in Vault.
-Not all secret engines utilize password policies, so check the documentation for the engine you
-are using for compatibility.
-
-~> Password policies are only available in Vault version 1.5+.
-
-See [Password Policies](/vault/docs/concepts/password-policies) for details of how password policies work
-as well as the syntax of the policies themselves.
-
-## Create/Update password policy
-
-This endpoint adds a new or updates an existing password policy. Once a policy is updated,
-it takes effect immediately to all associated secret engines.
-
-Prior to Vault saving the password policy, it will attempt to generate a number of passwords
-from the policy. This helps prevent creating password policies that are impossible to satisfy
-as well as prevent password policies that are overly restrictive which prevents both a poor
-security posture for the policy as well as preventing performance problems due to slow
-generation times.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/sys/policies/password/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the password policy to create.
-  This is specified as part of the request URL.
-
-- `policy` `(string: <required>)` - Specifies the password policy document. This can be
-  base64-encoded to avoid string escaping. See [Password Policy Syntax](/vault/docs/concepts/password-policies#password-policy-syntax)
-  for details on password policy definitions.
-
-### Sample payload
-
-```json
-{
-  "policy": "length = 20\nrule \"charset\" { ..."
-}
-```
-
-### Sample request
-
-**cURL:**
-
-```shell
-$ cat payload.json
-{
-  "policy": "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\n"
-}
-
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/policies/password/my-policy
-```
-
-**Vault CLI:**
-
-```shell
-$ cat my-policy.hcl
-length = 20
-rule "charset" {
-    charset = "abcde"
-}
-
-$ vault write sys/policies/password/my-policy policy=@my-policy.hcl
-```
-
-## List password policies
-
-This endpoints list the password policies.
-
-| Method  | Path                               |
-| :------ | :--------------------------------- |
-| `LIST`  | `/sys/policies/password`           |
-| `GET`   | `/sys/policies/password?list=true` |
-
-### Sample request
-
-```shell
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/sys/policies/password
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "58e2540f-8c51-6390-46de-38e279e75468",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "keys": [
-      "my-policy"
-    ]
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Read password policy
-
-This endpoint retrieves information about the named password policy.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/sys/policies/password/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the password policy to retrieve.
-  This is specified as part of the request URL.
-
-### Sample request
-
-```shell
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/policies/password/my-policy
-```
-
-### Sample response
-
-```json
-{
-  "policy": "length = 20\nrule \"charset\" { ..."
-}
-```
-
-## Delete password policy
-
-This endpoint deletes the password policy with the given name. This does not check if any
-secret engines are using it prior to deletion, so you should ensure that any engines that
-are utilizing this password policy are changed to a different policy (or to that engines'
-default behavior).
-
-| Method   | Path                           |
-| :------- | :----------------------------- |
-| `DELETE` | `/sys/policies/password/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the password policy to delete.
-  This is specified as part of the request URL.
-
-### Sample request
-
-```shell
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE
-    http://127.0.0.1:8200/v1/sys/policies/password/my-policy
-```
-
-## Generate password from password policy
-
-This endpoint generates a password from the specified existing password policy.
-
-| Method | Path                                    |
-| :----- | :-------------------------------------- |
-| `GET`  | `/sys/policies/password/:name/generate` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the password policy to generate
-  a password from. This is specified as part of the request URL.
-
-### Sample request
-
-```shell
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/policies/password/my-policy/generate
-```
-
-### Sample response
-
-```json
-{
-  "password": "..."
-}
-```
diff --git a/website/content/api-docs/system/policies.mdx b/website/content/api-docs/system/policies.mdx
deleted file mode 100644
index 8ce662873e8..00000000000
--- a/website/content/api-docs/system/policies.mdx
+++ /dev/null
@@ -1,379 +0,0 @@
----
-layout: api
-page_title: /sys/policies/ - HTTP API
-description: >-
-  The `/sys/policies/` endpoints are used to manage ACL, RGP, and EGP policies
-  in Vault.
----
-
-# `/sys/policies/`
-
-The `/sys/policies` endpoints are used to manage ACL, RGP, and EGP policies in Vault.
-
-<Note>
-<code>/sys/policies</code> endpoints are only available in Vault version 0.9+.
-RGPs and EGPs are Vault Enterprise upgrade features that are not available in
-Vault Open Source or basic Vault Enterprise installations.
-</Note>
-
-## List ACL policies
-
-This endpoint lists all configured ACL policies.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `LIST` | `/sys/policies/acl` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    -X LIST --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/policies/acl
-```
-
-### Sample response
-
-```json
-{
-  "keys": ["root", "my-policy"]
-}
-```
-
-## Read ACL policy
-
-This endpoint retrieves information about the named ACL policy.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/sys/policies/acl/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to retrieve.
-  This is specified as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/policies/acl/my-policy
-```
-
-### Sample response
-
-```json
-{
-  "name": "deploy",
-  "policy": "path \"secret/foo\" {..."
-}
-```
-
-## Create/Update ACL policy
-
-This endpoint adds a new or updates an existing ACL policy. Once a policy is
-updated, it takes effect immediately to all associated users.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST`  | `/sys/policies/acl/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to create.
-  This is specified as part of the request URL.
-
-- `policy` `(string: <required>)` - Specifies the policy document. This can be
-  base64-encoded to avoid string escaping.
-
-### Sample payload
-
-```json
-{
-  "policy": "path \"secret/foo\" {..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/policies/acl/my-policy
-```
-
-## Delete ACL policy
-
-This endpoint deletes the ACL policy with the given name. This will immediately
-affect all users associated with this policy. (A deleted policy set on a token
-acts as an empty policy.)
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/sys/policies/acl/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to delete.
-  This is specified as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/policies/acl/my-policy
-```
-
-## List RGP policies
-
-This endpoint lists all configured RGP policies.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `LIST` | `/sys/policies/rgp` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    -X LIST --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/policies/rgp
-```
-
-### Sample response
-
-```json
-{
-  "keys": ["webapp", "database"]
-}
-```
-
-## Read RGP policy
-
-This endpoint retrieves information about the named RGP policy.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/sys/policies/rgp/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to retrieve.
-  This is specified as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/policies/rgp/webapp
-```
-
-### Sample response
-
-```json
-{
-  "name": "webapp",
-  "policy": "rule main = {...",
-  "enforcement_level": "soft-mandatory"
-}
-```
-
-## Create/Update RGP policy
-
-This endpoint adds a new or updates an existing RGP policy. Once a policy is
-updated, it takes effect immediately to all associated users.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/sys/policies/rgp/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to create.
-  This is specified as part of the request URL.
-
-- `policy` `(string: <required>)` - Specifies the policy document. This can be
-  base64-encoded to avoid string escaping.
-
-- `enforcement_level` `(string: <required>)` - Specifies the enforcement level
-  to use. This must be one of `advisory`, `soft-mandatory`, or
-  `hard-mandatory`.
-
-### Sample payload
-
-```json
-{
-  "policy": "rule main = {...",
-  "enforcement_level": "soft-mandatory"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/policies/rgp/webapp
-```
-
-## Delete RGP policy
-
-This endpoint deletes the RGP policy with the given name. This will immediately
-affect all users associated with this policy. (A deleted policy set on a token
-acts as an empty policy.)
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/sys/policies/rgp/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to delete.
-  This is specified as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/policies/rgp/webapp
-```
-
-## List EGP policies
-
-This endpoint lists all configured EGP policies. Since EGP policies act on a
-path, this endpoint returns two identifiers:
-
-- `keys` contains a mapping of names to associated paths in a format that
-  `vault list` understands
-- `name_path_map` contains an object mapping names to paths and glob status in
-  a more machine-friendly format
-
-| Method | Path                |
-| :----- | :------------------ |
-| `LIST` | `/sys/policies/egp` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    -X LIST --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/policies/egp
-```
-
-### Sample response
-
-```json
-{
-  "keys": ["breakglass"]
-}
-```
-
-## Read EGP policy
-
-This endpoint retrieves information about the named EGP policy.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/sys/policies/egp/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to retrieve.
-  This is specified as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/policies/egp/breakglass
-```
-
-### Sample response
-
-```json
-{
-  "enforcement_level": "soft-mandatory",
-  "name": "breakglass",
-  "paths": ["*"],
-  "policy": "rule main = {..."
-}
-```
-
-## Create/Update EGP policy
-
-This endpoint adds a new or updates an existing EGP policy. Once a policy is
-updated, it takes effect immediately to all associated users.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `POST` | `/sys/policies/egp/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to create.
-  This is specified as part of the request URL.
-
-- `policy` `(string: <required>)` - Specifies the policy document. This can be
-  base64-encoded to avoid string escaping.
-
-- `enforcement_level` `(string: <required>)` - Specifies the enforcement level
-  to use. This must be one of `advisory`, `soft-mandatory`, or
-  `hard-mandatory`.
-
-- `paths` `(string or array: required)` - Specifies the paths on which this EGP
-  should be applied, either as a comma-separated list or an array. Glob
-  characters can denote suffixes, e.g. `secret/*`; a path of `*` will affect
-  all authenticated and login requests.
-
-### Sample payload
-
-```json
-{
-  "policy": "rule main = {...",
-  "paths": ["*", "secret/*", "transit/keys/*"],
-  "enforcement_level": "soft-mandatory"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/policies/egp/breakglass
-```
-
-## Delete EGP policy
-
-This endpoint deletes the EGP policy with the given name from all paths on which it was configured.
-
-| Method   | Path                      |
-| :------- | :------------------------ |
-| `DELETE` | `/sys/policies/egp/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to delete.
-  This is specified as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/policies/egp/breakglass
-```
diff --git a/website/content/api-docs/system/policy.mdx b/website/content/api-docs/system/policy.mdx
deleted file mode 100644
index 52863af3678..00000000000
--- a/website/content/api-docs/system/policy.mdx
+++ /dev/null
@@ -1,120 +0,0 @@
----
-layout: api
-page_title: /sys/policy - HTTP API
-description: The `/sys/policy` endpoint is used to manage ACL policies in Vault.
----
-
-# `/sys/policy`
-
-The `/sys/policy` endpoint is used to manage ACL policies in Vault.
-
-## List policies
-
-This endpoint lists all configured policies.
-
-| Method | Path          |
-| :----- | :------------ |
-| `GET`  | `/sys/policy` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/policy
-```
-
-### Sample response
-
-```json
-{
-  "policies": ["root", "deploy"]
-}
-```
-
-## Read policy
-
-This endpoint retrieve the policy body for the named policy.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/sys/policy/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to retrieve.
-  This is specified as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/policy/my-policy
-```
-
-### Sample response
-
-```json
-{
-  "name": "my-policy",
-  "rules": "path \"secret/*\"...
-}
-```
-
-## Create/Update policy
-
-This endpoint adds a new or updates an existing policy. Once a policy is
-updated, it takes effect immediately to all associated users.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/sys/policy/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to create.
-  This is specified as part of the request URL.
-
-- `policy` `(string: <required>)` - Specifies the policy document.
-
-### Sample payload
-
-```json
-{
-  "policy": "path \"secret/foo\" {..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/policy/my-policy
-```
-
-## Delete policy
-
-This endpoint deletes the policy with the given name. This will immediately
-affect all users associated with this policy.
-
-| Method   | Path                |
-| :------- | :------------------ |
-| `DELETE` | `/sys/policy/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Specifies the name of the policy to delete.
-  This is specified as part of the request URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/policy/my-policy
-```
diff --git a/website/content/api-docs/system/pprof.mdx b/website/content/api-docs/system/pprof.mdx
deleted file mode 100644
index 4f1d371f50f..00000000000
--- a/website/content/api-docs/system/pprof.mdx
+++ /dev/null
@@ -1,222 +0,0 @@
----
-layout: api
-page_title: /sys/pprof - HTTP API
-description: The `/sys/pprof` endpoint is used to query profiling information.
----
-
-# `/sys/pprof`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/pprof` endpoint is used to query. The response returned by
-these endpoints are equivalent to those returned by the `http/pprof`
-package.
-
-## Index
-
-This endpoint returns an HTML page listing the available profiles.
-
-| Method | Path          |
-| :----- | :------------ |
-| `GET`  | `/sys/pprof/` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/
-```
-
-## Allocs
-
-This endpoint returns a sampling of historical memory allocations over the life
-of the program.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `GET`  | `/sys/pprof/allocs` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/allocs
-```
-
-## Block
-
-This endpoint returns a sampling of goroutines involved in blocking on
-synchronization primitives.
-
-It is included for completeness, but since Vault doesn't normally enable
-collection of this data, it won't return anything useful with the standard
-Vault binary.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `GET`  | `/sys/pprof/block` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/block
-```
-
-## Cmdline
-
-This endpoint returns the running program's command line, with arguments
-separated by NUL bytes.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/sys/pprof/cmdline` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/cmdline
-```
-
-## Goroutine
-
-This endpoint returns stack traces of all current goroutines.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/sys/pprof/goroutine` |
-
-### Parameters
-
-- `debug` `(int: 0)` - Specifies special arguments for the collection.
-A value of `2` results in the stack traces being returned as text
-instead of the default pprof format.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/goroutine
-```
-
-## Heap
-
-This endpoint returns a sampling of memory allocations of live object.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `GET`  | `/sys/pprof/heap` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/heap
-```
-
-## Mutex
-
-This endpoint returns a sampling of goroutines holding contended mutexes.
-
-It is included for completeness, but since Vault doesn't normally enable
-collection of this data, it won't return anything useful with the standard
-Vault binary.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `GET`  | `/sys/pprof/mutex` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/mutex
-```
-
-## Profile
-
-This endpoint returns a pprof-formatted cpu profile payload. Profiling
-lasts for duration specified in seconds GET parameter, or for 30 seconds
-if not specified.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/sys/pprof/profile` |
-
-### Parameters
-
-- `seconds` `(int: 30)` - Specifies the duration to run the profiling
-  command. This value is specified as a query parameter.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/profile
-```
-
-## Symbol
-
-This endpoint returns the program counters listed in the request.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/sys/pprof/symbol` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/symbol
-```
-
-## Threadcreate
-
-This endpoint returns stack traces of goroutines that led to the creation of
-new OS threads.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/sys/pprof/threadcreate` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/threadcreate
-```
-
-
-## Trace
-
-This endpoint returns the execution trace in binary form. Tracing lasts
-for duration specified in seconds GET parameter, or for 1 second if not
-specified.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/sys/pprof/trace` |
-
-### Parameters
-
-- `seconds` `(int: 1)` - Specifies the duration to run the tracing
-  command. This value is specified as a query parameter.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/pprof/trace
-```
diff --git a/website/content/api-docs/system/quotas-config.mdx b/website/content/api-docs/system/quotas-config.mdx
deleted file mode 100644
index d0d021dddae..00000000000
--- a/website/content/api-docs/system/quotas-config.mdx
+++ /dev/null
@@ -1,115 +0,0 @@
----
-layout: api
-page_title: /sys/quotas/config - HTTP API
-description: The `/sys/quotas/config` endpoint is used to configure rate limit quotas.
----
-
-# `/sys/quotas/config`
-
-@include 'alerts/restricted-admin.mdx'
-
-
-The `/sys/quotas/config` endpoint is used to configure rate limit quotas.
-
-## Create or update the rate limit configuration
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/sys/quotas/config` |
-
-### Parameters
-
-- `rate_limit_exempt_paths` `([]string: [])` - Specifies the list of exempt paths
-  from all rate limit quotas. Exempt paths are relative and apply to all
-  namespaces. When `rate_limit_exempt_paths` is empty, Vault applies quotas to
-  all relative paths. Access to exemption data is read-only from the admin namespace.
-  **You cannot update `rate_limit_exempt_paths` from the admin namespace**
-- `global_rate_limit_exempt_paths` `([]string: [])` -Specifies the list of
-  exempt paths from all rate limit quotas. Global exempt paths are absolute and
-  do not apply across namespaces. When `global_rate_limit_exempt_paths` is empty,
-  Vault applies quotas to all absolute paths. You can only add, update, or delete
-  global paths within the scope of the calling namespace.
-- `enable_rate_limit_audit_logging` `(bool: false)` - If set, starts audit logging
-  of requests that get rejected due to rate limit quota rule violations.
-- `enable_rate_limit_response_headers` `(bool: false)` - If set, additional rate
-  limit quota HTTP headers will be added to responses. These include:
-  - `Retry-After`: If the request is blocked due to rate limiting, this will
-    be a suggested time, in seconds, to wait before retry after. The time suggested
-    will be the amount of time in seconds remaining before the rate limit quota
-    applicable to this request is reset. Identical to the `X-Ratelimit-Reset` header.
-  - `X-Ratelimit-Limit`: The limit of the rate limit quota applicable to this request.
-  - `X-Ratelimit-Remaining`: The remaining requests in the current interval for the
-    rate limit quota applicable to this request.
-  - `X-Ratelimit-Reset` The amount of time in seconds remaining before the rate limit quota
-    applicable to this request is reset. Identical to the `Retry-After` header.
-
-
-### Sample payload
-
-```json
-{
-  "rate_limit_exempt_paths": [
-    "sys/internal/ui/mounts",
-    "sys/generate-recovery-token/attempt",
-    "sys/generate-recovery-token/update",
-    "sys/generate-root/attempt",
-    "sys/generate-root/update",
-    "sys/health",
-    "sys/seal-status",
-    "sys/unseal"
-  ],
-  "enable_rate_limit_audit_logging": true,
-  "enable_rate_limit_response_headers": true
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/quotas/config
-```
-
-## Get the rate limit configuration
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/sys/quotas/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/quotas/config
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "259801bd-a0c9-9350-8eb9-26c91afd19c6",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "enable_rate_limit_audit_logging": false,
-    "enable_rate_limit_response_headers": false,
-    "rate_limit_exempt_paths": [
-      "sys/internal/ui/mounts",
-      "sys/generate-recovery-token/attempt",
-      "sys/generate-recovery-token/update",
-      "sys/generate-root/attempt",
-      "sys/generate-root/update",
-      "sys/health",
-      "sys/seal-status",
-      "sys/unseal"
-    ]
-  },
-  "warnings": null
-}
-```
diff --git a/website/content/api-docs/system/rate-limit-quotas.mdx b/website/content/api-docs/system/rate-limit-quotas.mdx
deleted file mode 100644
index e479781fea2..00000000000
--- a/website/content/api-docs/system/rate-limit-quotas.mdx
+++ /dev/null
@@ -1,162 +0,0 @@
----
-layout: api
-page_title: /sys/quotas/rate-limit - HTTP API
-description: The `/sys/quotas/rate-limit` endpoint is used to create, edit and delete rate limit quotas.
----
-
-# `/sys/quotas/rate-limit`
-
-@include 'alerts/restricted-admin.mdx'
-
-The `/sys/quotas/rate-limit` endpoint is used to create, edit and delete rate limit quotas.
-
-## Create or update a rate limit quota
-
-This endpoint is used to create a rate limit quota with an identifier, `name`.
-A rate limit quota must include a `rate` value with an optional `path` that can
-either be a namespace or mount, and can optionally include a path suffix following
-the mount to restrict more specific API paths.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/sys/quotas/rate-limit/:name` |
-
-### Parameters
-
-- `name` `(string: "")` - The name of the quota.
-- `path` `(string: "")` - Path of the mount or namespace to apply the quota.
-  A blank path configures a global rate limit quota. For example `namespace1/`
-  adds a quota to a full namespace, `namespace1/auth/userpass` adds a quota to
-  `userpass` in `namespace1`, and `namespace1/kv-v2/data/foo/bar` adds a quota to
-  a specific secret on a KV v2 mount in `namespace1`. A trailing glob (`*`) can also
-  be added as part of the path after the mount to match paths that share the same prefix
-  prior to the glob. `namespace1/kv-v2/data/foo/*` would match both
-  `namespace1/kv-v2/data/foo/bar` and `namespace1/kv-v2/data/foo/baz`. Updating this field on
-  an existing quota can have "moving" effects. For example, updating `namespace1` to
-  `namespace1/auth/userpass` moves this quota from being a namespace quota to a
-  namespace specific mount quota. Non-global quotas are not inherited by child
-  namespaces. **Note, namespaces are supported in Enterprise only**.
-- `rate` `(float: 0.0)` - The maximum number of requests in a given interval to
-  be allowed by the quota rule. The `rate` must be positive.
-- `interval` `(string: "")` - The duration to enforce rate limiting for (default `"1s"`).
-- `block_interval` `(string: "")` - If set, when a client reaches a rate limit
-  threshold, the client will be prohibited from any further requests until after
-  the 'block_interval' has elapsed.
-- `role` `(string: "")` - If set on a quota where `path` is set to an auth mount with a
-  concept of roles (such as `/auth/approle/`), this will make the quota restrict login
-  requests to that mount that are made with the specified role. The request will fail if
-  the auth mount does not have a concept of roles, or `path` is not an auth mount.
-- `inheritable` `(bool: false)` - If set to `true` on a quota where `path` is set to a namespace,
-  the same quota will be cumulatively applied to all child namespace. The `inheritable`
-  parameter cannot be set to `true` if the `path` does not specify a namespace. Only quotas
-  associated with the root namespace quotas are inheritable by default.
-
-### Sample payload
-
-```json
-{
-  "path": "",
-  "rate": 897.3,
-  "interval": "2m",
-  "block_interval": "5m"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/quotas/rate-limit/global-rate-limiter
-```
-
-## Delete a rate limit quota
-
-A rate limit quota can be deleted by `name`.
-
-| Method   | Path                           |
-| :------- | :----------------------------- |
-| `DELETE` | `/sys/quotas/rate-limit/:name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request DELETE \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/quotas/rate-limit/global-rate-limiter
-```
-
-## Get a rate limit quota
-
-A rate limit quota can be retrieved by `name`.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/sys/quotas/rate-limit/:name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/quotas/rate-limit/global-rate-limiter
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "d0870811-455d-3dfd-459f-aee016e6fb68",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "block_interval": 300,
-    "interval": 2,
-    "name": "global-rate-limiter",
-    "path": "",
-    "rate": 897.3,
-    "role": "",
-    "type": "rate-limit"
-  },
-  "warnings": null
-}
-```
-
-## List rate limit quotas
-
-This endpoint returns a list of all the rate limit quotas.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `LIST` | `/sys/quotas/rate-limit` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request LIST \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/quotas/rate-limit
-```
-
-### Sample response
-
-```json
-{
-  "auth": null,
-  "data": {
-    "keys": ["global-rate-limiter", "kv-rate-limiter"]
-  },
-  "lease_duration": 0,
-  "lease_id": "",
-  "renewable": false,
-  "request_id": "ab633ee1-a692-ba03-083b-f1bd91c51c28",
-  "warnings": null,
-  "wrap_info": null
-}
-```
diff --git a/website/content/api-docs/system/raw.mdx b/website/content/api-docs/system/raw.mdx
deleted file mode 100644
index 7e788358b3d..00000000000
--- a/website/content/api-docs/system/raw.mdx
+++ /dev/null
@@ -1,146 +0,0 @@
----
-layout: api
-page_title: /sys/raw - HTTP API
-description: The `/sys/raw` endpoint is used to access the raw underlying store in Vault.
----
-
-# `/sys/raw`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/raw` endpoint is used to access the raw underlying store in Vault.
-
-This endpoint is off by default. See the
-[Vault configuration documentation](/vault/docs/configuration) to
-enable.
-
-## Read raw
-
-This endpoint reads the value of the key at the given path. This is the raw path
-in the storage backend and not the logical path that is exposed via the mount
-system.
-
-| Method | Path             |
-| :----- | :--------------- |
-| `GET`  | `/sys/raw/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the raw path in the storage backend.
-  This is specified as part of the URL.
-
-- `compressed` `(bool: true)` - Attempt to decompress the value.
-
-- `encoding` `(string: "")` - Specifies the encoding of the returned data. Defaults to no encoding.
-  "base64" returns the value encoded in base64.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/raw/secret/foo
-```
-
-### Sample response
-
-```json
-{
-  "value": "{'foo':'bar'}"
-}
-```
-
-## Create/Update raw
-
-This endpoint updates the value of the key at the given path. This is the raw
-path in the storage backend and not the logical path that is exposed via the
-mount system.
-
-| Method | Path             |
-| :----- | :--------------- |
-| `POST`  | `/sys/raw/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the raw path in the storage backend.
-  This is specified as part of the URL.
-
-- `value` `(string: <required>)` – Specifies the value of the key.
-
-- `compression_type` `(string: "")` - Create/update using the compressed form of `value`. Supported `compression_type`
-  values are `gzip`, `lzw`, `lz4`, `snappy`, or `""`. `""` means no compression is used. If omitted and key already exists,
-  update uses the same compression (or no compression) as the existing value.
-
-- `encoding` `(string: "")` - Specifies the encoding of `value`. Defaults to no encoding.
-  Use "base64" if `value` is encoded in base64.
-
-### Sample payload
-
-```json
-{
-  "value": "{\"foo\": \"bar\"}"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/raw/secret/foo
-```
-
-## List raw
-
-This endpoint returns a list keys for a given path prefix.
-
-**This endpoint requires 'sudo' capability.**
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `LIST` | `/sys/raw/:prefix`           |
-| `GET`  | `/sys/raw/:prefix?list=true` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/sys/raw/logical
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["abcd-1234...", "efgh-1234...", "ijkl-1234..."]
-  }
-}
-```
-
-## Delete raw
-
-This endpoint deletes the key with given path. This is the raw path in the
-storage backend and not the logical path that is exposed via the mount system.
-
-| Method   | Path             |
-| :------- | :--------------- |
-| `DELETE` | `/sys/raw/:path` |
-
-### Parameters
-
-- `path` `(string: <required>)` – Specifies the raw path in the storage backend.
-  This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/raw/secret/foo
-```
diff --git a/website/content/api-docs/system/rekey-recovery-key.mdx b/website/content/api-docs/system/rekey-recovery-key.mdx
deleted file mode 100644
index cca8dc3103d..00000000000
--- a/website/content/api-docs/system/rekey-recovery-key.mdx
+++ /dev/null
@@ -1,363 +0,0 @@
----
-layout: api
-page_title: /sys/rekey-recovery-key - HTTP API
-description: >-
-  The `/sys/rekey-recovery-key` endpoints are used to rekey the recovery keys
-  for Vault.
----
-
-# `/sys/rekey-recovery-key`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/rekey-recovery-key` endpoints are used to rekey the recovery keys for
-Vault. Key recovery endpoints are only applicable to seals that support recovery
-keys.
-
-## Read rekey progress
-
-This endpoint reads the configuration and progress of the current rekey attempt.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `GET`  | `/sys/rekey-recovery-key/init` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/rekey-recovery-key/init
-```
-
-### Sample response
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "t": 3,
-  "n": 5,
-  "progress": 1,
-  "required": 3,
-  "pgp_fingerprints": ["abcd1234"],
-  "backup": true,
-  "verification_required": false
-}
-```
-
-If a rekey is started, then `n` is the new shares to generate and `t` is the
-threshold required for the new shares. `progress` is how many recovery keys have
-been provided for this rekey, where `required` must be reached to complete. The
-`nonce` for the current rekey operation is also displayed. If PGP keys are being
-used to encrypt the final shares, the key fingerprints and whether the final
-keys will be backed up to physical storage will also be displayed.
-`verification_required` indicates whether verification was enabled for this
-operation.
-
-## Start rekey
-
-This endpoint initializes a new rekey attempt. Only a single recovery key rekey
-attempt can take place at a time, and changing the parameters of a rekey
-requires canceling and starting a new rekey, which will also provide a new
-nonce.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/sys/rekey-recovery-key/init` |
-
-### Parameters
-
-- `secret_shares` `(int: <required>)` – Specifies the number of shares to split
-  the recovery key into.
-
-- `secret_threshold` `(int: <required>)` – Specifies the number of shares
-  required to reconstruct the recovery key. This must be less than or equal to
-  `secret_shares`.
-
-- `pgp_keys` `(array<string>: nil)` – Specifies an array of PGP public keys used
-  to encrypt the output recovery key shares. Ordering is preserved. The keys must be
-  base64-encoded from their original binary representation. The size of this
-  array must be the same as `secret_shares`.
-
-- `backup` `(bool: false)` – Specifies if using PGP-encrypted keys, whether
-  Vault should also store a plaintext backup of the PGP-encrypted keys at
-  `core/recovery-keys-backup` in the physical storage backend. These can then
-  be retrieved and removed via the `sys/rekey-recovery-key/backup` endpoint.
-
-- `require_verification` `(bool: false)` – This turns on verification
-  functionality. When verification is turned on, after successful authorization
-  with the current unseal keys, the new unseal keys are returned but the
-  recovery key is not actually rotated. The new keys must be provided to
-  authorize the actual rotation of the key. This ensures that the new keys have
-  been successfully saved and protects against a risk of the keys being lost
-  after rotation but before they can be persisted. This can be used with
-  without `pgp_keys`, and when used with it, it allows ensuring that the
-  returned keys can be successfully decrypted before committing to the new
-  shares, which the backup functionality does not provide.
-
-### Sample payload
-
-```json
-{
-  "secret_shares": 10,
-  "secret_threshold": 5
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/rekey-recovery-key/init
-```
-
-## Cancel rekey
-
-This endpoint cancels any in-progress rekey. This clears the rekey settings as
-well as any progress made. This must be called to change the parameters of the
-rekey. Note: verification is still a part of a rekey. If rekeying is canceled
-during the verification flow, the current unseal keys remain valid.
-
-| Method   | Path                           |
-| :------- | :----------------------------- |
-| `DELETE` | `/sys/rekey-recovery-key/init` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/rekey-recovery-key/init
-```
-
-## Read backup key
-
-This endpoint returns the backup copy of PGP-encrypted recovery key shares. The
-returned value is the nonce of the rekey operation and a map of PGP key
-fingerprint to hex-encoded PGP-encrypted key.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `GET`  | `/sys/rekey/recovery-key-backup` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/rekey/recovery-key-backup
-```
-
-### Sample response
-
-```json
-{
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "keys": {
-    "abcd1234": "..."
-  }
-}
-```
-
-## Delete backup key
-
-This endpoint deletes the backup copy of PGP-encrypted recovery key shares.
-
-| Method   | Path                             |
-| :------- | :------------------------------- |
-| `DELETE` | `/sys/rekey/recovery-key-backup` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token" \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/rekey/recovery-key-backup
-```
-
-## Submit key
-
-This endpoint is used to enter a single recovery key share to progress the rekey
-of the Vault. If the threshold number of recovery key shares is reached, Vault
-will complete the rekey. Otherwise, this API must be called multiple times until
-that threshold is met. The rekey nonce operation must be provided with each
-call.
-
-When the operation is complete, this will return a response like the example
-below; otherwise the response will be the same as the `GET` method against
-`sys/rekey/init`, providing status on the operation itself.
-
-If verification was requested, successfully completing this flow will
-immediately put the operation into a verification state, and provide the nonce
-for the verification operation.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `POST` | `/sys/rekey-recovery-key/update` |
-
-### Parameters
-
-- `key` `(string: <required>)` – Specifies a single recovery share key.
-
-- `nonce` `(string: <required>)` – Specifies the nonce of the rekey operation.
-
-### Sample payload
-
-```json
-{
-  "key": "AB32...",
-  "nonce": "abcd1234..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token" \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/rekey-recovery-key/update
-```
-
-### Sample response
-
-```json
-{
-  "complete": true,
-  "keys": ["one", "two", "three"],
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "pgp_fingerprints": ["abcd1234"],
-  "keys_base64": ["base64keyvalue"],
-  "backup": true,
-  "verification_required": true,
-  "verification_nonce": "8b112c9e-2738-929d-bcc2-19aff249ff10"
-}
-```
-
-If the keys are PGP-encrypted, an array of key fingerprints will also be
-provided (with the order in which the keys were used for encryption) along with
-whether or not the keys were backed up to physical storage.
-
-## Read rekey recovery key verification progress
-
-This endpoint reads the configuration and progress of the current rekey
-verification attempt.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `GET`  | `/sys/rekey-recovery-key/verify` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/rekey-recovery-key/verify
-```
-
-### Sample response
-
-```json
-{
-  "nonce": "8b112c9e-2738-929d-bcc2-19aff249ff10",
-  "t": 3,
-  "n": 5,
-  "progress": 1
-}
-```
-
-`n` is the total number of new shares that were generated and `t` is the
-threshold required for the new shares to pass verification. `progress` is how
-many of the new unseal keys have been provided for this verification operation.
-The `nonce` for the current rekey operation is also displayed.
-
-## Cancel rekey verification
-
-This endpoint cancels any in-progress rekey verification operation. This clears
-any progress made and resets the nonce. Unlike a `DELETE` against
-`sys/rekey-recovery-key/init`, this only resets the current verification
-operation, not the entire rekey atttempt. The return value is the same as `GET`
-along with the new nonce.
-
-| Method   | Path                             |
-| :------- | :------------------------------- |
-| `DELETE` | `/sys/rekey-recovery-key/verify` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token" \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/rekey-recovery-key/verify
-```
-
-### Sample response
-
-```json
-{
-  "nonce": "5827bbc1-0110-5725-cc21-beddc129d942",
-  "t": 3,
-  "n": 5,
-  "progress": 0
-}
-```
-
-## Submit verification key
-
-This endpoint is used to enter a single new key share to progress the rekey
-verification operation. If the threshold number of new key shares is reached,
-Vault will complete the rekey by performing the actual rotation of the recovery
-key. Otherwise, this API must be called multiple times until that threshold is
-met. The nonce must be provided with each call.
-
-When the operation is complete, this will return a response like the example
-below; otherwise the response will be the same as the `GET` method against
-`sys/rekey-recovery-key/verify`, providing status on the operation itself.
-
-| Method | Path                             |
-| :----- | :------------------------------- |
-| `POST` | `/sys/rekey-recovery-key/verify` |
-
-### Parameters
-
-- `key` `(string: <required>)` – Specifies a single recovery share key from the
-  new set of shares.
-
-- `nonce` `(string: <required>)` – Specifies the nonce of the rekey
-  verification operation.
-
-### Sample payload
-
-```json
-{
-  "key": "A58d...",
-  "nonce": "5a27bbc1..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token" \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/rekey-recovery-key/verify
-```
-
-### Sample response
-
-```json
-{
-  "nonce": "5827bbc1-0110-5725-cc21-beddc129d942",
-  "complete": true
-}
-```
diff --git a/website/content/api-docs/system/rekey.mdx b/website/content/api-docs/system/rekey.mdx
deleted file mode 100644
index fc95fddc98f..00000000000
--- a/website/content/api-docs/system/rekey.mdx
+++ /dev/null
@@ -1,363 +0,0 @@
----
-layout: api
-page_title: /sys/rekey - HTTP API
-description: The `/sys/rekey` endpoints are used to rekey the unseal keys for Vault.
----
-
-# `/sys/rekey`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/rekey` endpoints are used to rekey the unseal keys for Vault.
-
-On seals that support stored keys (e.g. HSM PKCS11), the recovery key share(s)
-can be provided to rekey the root key since no unseal keys are available. The
-secret shares, secret threshold, and stored shares parameters must be set to 1.
-Upon successful rekey, no split unseal key shares are returned.
-
-## Read rekey progress
-
-This endpoint reads the configuration and progress of the current rekey attempt.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `GET`  | `/sys/rekey/init` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/rekey/init
-```
-
-### Sample response
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "t": 3,
-  "n": 5,
-  "progress": 1,
-  "required": 3,
-  "pgp_fingerprints": ["abcd1234"],
-  "backup": true,
-  "verification_required": false
-}
-```
-
-If a rekey is started, then `n` is the new shares to generate and `t` is the
-threshold required for the new shares. `progress` is how many unseal keys have
-been provided for this rekey, where `required` must be reached to complete. The
-`nonce` for the current rekey operation is also displayed. If PGP keys are being
-used to encrypt the final shares, the key fingerprints and whether the final
-keys will be backed up to physical storage will also be displayed.
-`verification_required` indicates whether verification was enabled for this
-operation.
-
-## Start rekey
-
-This endpoint initializes a new rekey attempt. Only a single rekey attempt can
-take place at a time, and changing the parameters of a rekey requires canceling
-and starting a new rekey, which will also provide a new nonce.
-
-| Method | Path              |
-| :----- | :---------------- |
-| `POST` | `/sys/rekey/init` |
-
-### Parameters
-
-- `secret_shares` `(int: <required>)` – Specifies the number of shares to split
-  the root key into.
-
-- `secret_threshold` `(int: <required>)` – Specifies the number of shares
-  required to reconstruct the root key. This must be less than or equal to
-  `secret_shares`.
-
-- `pgp_keys` `(array<string>: nil)` – Specifies an array of PGP public keys used
-  to encrypt the output unseal keys. Ordering is preserved. The keys must be
-  base64-encoded from their original binary representation. The size of this
-  array must be the same as `secret_shares`.
-
-- `backup` `(bool: false)` – Specifies if using PGP-encrypted keys, whether
-  Vault should also store a plaintext backup of the PGP-encrypted keys at
-  `core/unseal-keys-backup` in the physical storage backend. These can then
-  be retrieved and removed via the `sys/rekey/backup` endpoint.
-
-- `require_verification` `(bool: false)` – This turns on verification
-  functionality. When verification is turned on, after successful authorization
-  with the current unseal keys, the new unseal keys are returned but the master
-  key is not actually rotated. The new keys must be provided to authorize the
-  actual rotation of the root key. This ensures that the new keys have been
-  successfully saved and protects against a risk of the keys being lost after
-  rotation but before they can be persisted. This can be used with or without
-  `pgp_keys`, and when used with it, it allows ensuring that the returned keys
-  can be successfully decrypted before committing to the new shares, which the
-  backup functionality does not provide.
-
-### Sample payload
-
-```json
-{
-  "secret_shares": 10,
-  "secret_threshold": 5
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/rekey/init
-```
-
-## Cancel rekey
-
-This endpoint cancels any in-progress rekey. This clears the rekey settings as
-well as any progress made. This must be called to change the parameters of the
-rekey. Note: verification is still a part of a rekey. If rekeying is canceled
-during the verification flow, the current unseal keys remain valid.
-
-| Method   | Path              |
-| :------- | :---------------- |
-| `DELETE` | `/sys/rekey/init` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/rekey/init
-```
-
-## Read backup key
-
-This endpoint returns the backup copy of PGP-encrypted unseal keys. The returned
-value is the nonce of the rekey operation and a map of PGP key fingerprint to
-hex-encoded PGP-encrypted key.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/sys/rekey/backup` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/rekey/backup
-```
-
-### Sample response
-
-```json
-{
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "keys": {
-    "abcd1234": "..."
-  }
-}
-```
-
-## Delete backup key
-
-This endpoint deletes the backup copy of PGP-encrypted unseal keys.
-
-| Method   | Path                |
-| :------- | :------------------ |
-| `DELETE` | `/sys/rekey/backup` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/rekey/backup
-```
-
-## Submit key
-
-This endpoint is used to enter a single root key share to progress the rekey
-of the Vault. If the threshold number of root key shares is reached, Vault
-will complete the rekey. Otherwise, this API must be called multiple times until
-that threshold is met. The rekey nonce operation must be provided with each
-call.
-
-When the operation is complete, this will return a response like the example
-below; otherwise the response will be the same as the `GET` method against
-`sys/rekey/init`, providing status on the operation itself.
-
-If verification was requested, successfully completing this flow will
-immediately put the operation into a verification state, and provide the nonce
-for the verification operation.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/sys/rekey/update` |
-
-### Parameters
-
-- `key` `(string: <required>)` – Specifies a single master share key.
-
-- `nonce` `(string: <required>)` – Specifies the nonce of the rekey operation.
-
-### Sample payload
-
-```json
-{
-  "key": "AB32...",
-  "nonce": "abcd1234..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/rekey/update
-```
-
-### Sample response
-
-```json
-{
-  "complete": true,
-  "keys": ["one", "two", "three"],
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "pgp_fingerprints": ["abcd1234"],
-  "keys_base64": ["base64keyvalue"],
-  "backup": true,
-  "verification_required": true,
-  "verification_nonce": "8b112c9e-2738-929d-bcc2-19aff249ff10"
-}
-```
-
-If the keys are PGP-encrypted, an array of key fingerprints will also be
-provided (with the order in which the keys were used for encryption) along with
-whether or not the keys were backed up to physical storage.
-
-## Read rekey verification progress
-
-This endpoint reads the configuration and progress of the current rekey
-verification attempt.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `GET`  | `/sys/rekey/verify` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/rekey/verify
-```
-
-### Sample response
-
-```json
-{
-  "nonce": "8b112c9e-2738-929d-bcc2-19aff249ff10",
-  "t": 3,
-  "n": 5,
-  "progress": 1
-}
-```
-
-`n` is the total number of new shares that were generated and `t` is the
-threshold required for the new shares to pass verification. `progress` is how
-many of the new unseal keys have been provided for this verification operation.
-The `nonce` for the current rekey operation is also displayed.
-
-## Cancel rekey verification
-
-This endpoint cancels any in-progress rekey verification operation. This clears
-any progress made and resets the nonce. Unlike a `DELETE` against
-`sys/rekey/init`, this only resets the current verification operation, not the
-entire rekey attempt. The return value is the same as `GET` along with the new
-nonce.
-
-| Method   | Path                |
-| :------- | :------------------ |
-| `DELETE` | `/sys/rekey/verify` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/rekey/verify
-```
-
-### Sample response
-
-```json
-{
-  "nonce": "5827bbc1-0110-5725-cc21-beddc129d942",
-  "t": 3,
-  "n": 5,
-  "progress": 0
-}
-```
-
-## Submit verification key
-
-This endpoint is used to enter a single new key share to progress the rekey
-verification operation. If the threshold number of new key shares is reached,
-Vault will complete the rekey by performing the actual rotation of the master
-key. Otherwise, this API must be called multiple times until that threshold is
-met. The nonce must be provided with each call.
-
-When the operation is complete, this will return a response like the example
-below; otherwise the response will be the same as the `GET` method against
-`sys/rekey/verify`, providing status on the operation itself.
-
-| Method | Path                |
-| :----- | :------------------ |
-| `POST` | `/sys/rekey/verify` |
-
-### Parameters
-
-- `key` `(string: <required>)` – Specifies a single master share key from the
-  new set of shares.
-
-- `nonce` `(string: <required>)` – Specifies the nonce of the rekey
-  verification operation.
-
-### Sample payload
-
-```json
-{
-  "key": "A58d...",
-  "nonce": "5a27bbc1..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/rekey/verify
-```
-
-### Sample response
-
-```json
-{
-  "nonce": "5827bbc1-0110-5725-cc21-beddc129d942",
-  "complete": true
-}
-```
diff --git a/website/content/api-docs/system/remount.mdx b/website/content/api-docs/system/remount.mdx
deleted file mode 100644
index 3a5745769cf..00000000000
--- a/website/content/api-docs/system/remount.mdx
+++ /dev/null
@@ -1,117 +0,0 @@
----
-layout: api
-page_title: /sys/remount - HTTP API
-description: >-
-  The '/sys/remount' endpoint is used remount a mounted backend to a new
-  endpoint.
----
-
-# Remount ( API )
-
-The Remount documentation details the endpoints required to trigger and monitor the status of a remount operation.
-
-## Move backend
-
-The `/sys/remount` endpoint moves an already-mounted backend to a new mount point. Remounting works for both secret
-engines and auth methods.
-
-Vault returns a migration ID when the remount operation completes. You
-can use the migration ID to look up the status of the mount migration.
-More details about the remount operation are described in
-[Mount Migration](/vault/docs/concepts/mount-migration).
-
-~> Note: This endpoint requires a policy with both `sudo` and `update` capabilities to `sys/remount`
-
-~> Note: A mount migration will revoke all leases for the secrets of a secrets backend or tokens of an auth backend,
-depending on which type of backend is being moved.
-
-
-| Method | Path           |
-| :----- | :------------- |
-| `POST` | `/sys/remount` |
-
-### Parameters
-
-- `from` `(string: <required>)` – Specifies the previous mount point.
-
-- `to` `(string: <required>)` – Specifies the new destination mount point.
-
-### Sample payload ( cross namespace )
-
-```json
-{
-  "from": "ns1/ns2/secret",
-  "to": "ns1/ns3/new-secret"
-}
-```
-
-### Sample payload ( cross namespace, auth mount )
-
-```json
-{
-  "from": "ns1/ns2/auth/approle",
-  "to": "ns1/ns3/auth/new-approle"
-}
-```
-
-### Sample payload ( within namespace )
-
-```json
-{
-  "from": "secret",
-  "to": "new-secret"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/remount
-```
-
-### Sample response
-
-```json
-{
-  "migration_id": "ef3ba21c-8be8-4e5f-8d00-cb46a532c665"
-}
-```
-
-## Monitor migration status
-
-This endpoint is used to monitor the status of a mount migration operation, using the ID returned in the response
-of the `sys/remount` call. The response contains the passed-in ID, the source and target mounts, and a status field
-that displays `in-progress`, `success` or `failure`.
-
-| Method | Path           |
-| :----- | :------------- |
-| `GET` | `/sys/remount/status/:migration_id` |
-
-### Parameters
-
-- `migration_id` `(string: <required>)` – Specifies the id of the mount migration
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/remount/status/ef3ba21c-8be8-4e5f-8d00-cb46a532c665
-```
-
-### Sample response
-
-```json
-{
-  "migration_id": "ef3ba21c-8be8-4e5f-8d00-cb46a532c665",
-  "migration_info": {
-    "source_mount": "ns1/ns2/secret",
-    "target_mount": "ns1/ns3/new-secret",
-    "status": "in-progress",
-  }
-}
-```
diff --git a/website/content/api-docs/system/replication/index.mdx b/website/content/api-docs/system/replication/index.mdx
deleted file mode 100644
index 9fd50e515ff..00000000000
--- a/website/content/api-docs/system/replication/index.mdx
+++ /dev/null
@@ -1,272 +0,0 @@
----
-layout: api
-page_title: /sys/replication - HTTP API
-description: >-
-  The '/sys/replication' endpoint focuses on managing general operations in
-  Vault Enterprise replication
----
-
-# `/sys/replication`
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-## Attempt recovery
-
-This endpoint attempts recovery if replication is in an adverse state. For
-example: an error has caused replication to stop syncing.
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `POST` | `/sys/replication/recover` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/recover
-```
-
-### Sample response
-
-```json
-{
-  "warnings": ["..."]
-}
-```
-
-## Reindex replication
-
-This endpoint reindexes the local data storage. This can cause a very long delay
-depending on the number and size of objects in the data store.
-
-**This endpoint requires 'sudo' capability.**
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `POST` | `/sys/replication/reindex` |
-
-### Parameters
-
-- `diff` `(bool: false)` – Enables a slower re-indexing which will perform a key
-  level check to diagnose issues. Defaults false.
-
-- `force` `(bool: false)` – Forces a complete re-indexing which only scans data
-  available in the storage. Defaults false.
-
-- `skip_flush` `(bool: false)` – Skips the tree flushing stage of the reindex
-  process. This setting can be used to reduce the amount of time the tree is locked
-  during a reindex process. If this node is killed before the full tree has been
-  asynchronously flushed the reindex may not have applied fully and a new reindex
-  may need to be done. Defaults false.
-
-### Sample payload
-
-```json
-{}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/reindex
-```
-
-### Sample response
-
-```json
-{
-  "warnings": ["..."]
-}
-```
-
-## Check status
-
-This endpoint print information about the status of replication (mode,
-sync progress, etc).
-
-This is an unauthenticated endpoint.
-
-| Method | Path                      |
-| :----- | :------------------------ |
-| `GET`  | `/sys/replication/status` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/replication/status
-```
-
-### Sample response
-
-The printed status of the replication environment. As an example, for a
-performance primary and DR primary node, it will look something like:
-
-```json
-{
-  "data": {
-    "dr": {
-      "cluster_id": "f2c21cb5-523f-617b-20ac-c913d9154ba6",
-      "known_secondaries": ["3"],
-      "last_wal": 291,
-      "merkle_root": "38543b95d44132138003939addbaf94125ec184e",
-      "mode": "primary",
-      "primary_cluster_addr": "",
-      "secondaries": [
-        {
-          "api_address": "https://127.0.0.1:49264",
-          "cluster_address": "https://127.0.0.1:49267",
-          "connection_status": "connected",
-          "last_heartbeat": "2020-06-10T15:40:47-07:00",
-          "node_id": "3"
-        }
-      ]
-    },
-    "performance": {
-      "cluster_id": "1598d434-dfec-1f48-f019-3d22a8075bf9",
-      "known_secondaries": ["2"],
-      "last_wal": 291,
-      "merkle_root": "43f40fc775b40cc76cd5d7e289b2e6eaf4ba138c",
-      "mode": "primary",
-      "primary_cluster_addr": "",
-      "secondaries": [
-        {
-          "api_address": "https://127.0.0.1:49253",
-          "cluster_address": "https://127.0.0.1:49256",
-          "connection_status": "connected",
-          "last_heartbeat": "2020-06-10T15:40:46-07:00",
-          "node_id": "2"
-        }
-      ]
-    }
-  }
-}
-```
-
-Possible values for `connection_status` are `connected` or `disconnected`. `last_heartbeat` is the timestamp of the
-last time this node exchanged heartbeats with another node.
-
-### Sample response from performance secondary & DR primary
-
-The printed status of the replication environment. As an example, for a
-performance secondary and DR primary node, it will look something like:
-
-```json
-{
-  "data": {
-    "dr": {
-      "cluster_id": "e4bfa800-002e-7b6d-14c2-617855ece02f",
-      "known_secondaries": ["4"],
-      "last_wal": 455,
-      "merkle_root": "cdcf796619240ce19dd8af30fa700f64c8006e3d",
-      "mode": "primary",
-      "primary_cluster_addr": "",
-      "secondaries": [
-        {
-          "api_address": "https://127.0.0.1:49277",
-          "cluster_address": "https://127.0.0.1:49281",
-          "connection_status": "connected",
-          "last_heartbeat": "2020-06-10T15:40:46-07:00",
-          "node_id": "4"
-        }
-      ]
-    },
-    "performance": {
-      "cluster_id": "1598d434-dfec-1f48-f019-3d22a8075bf9",
-      "known_primary_cluster_addrs": ["https://127.0.0.1:8201"],
-      "last_remote_wal": 291,
-      "merkle_root": "43f40fc775b40cc76cd5d7e289b2e6eaf4ba138c",
-      "corrupted_merkle_tree": false,
-      "last_corruption_check_epoch": "1694456090",
-      "mode": "secondary",
-      "primaries": [
-        {
-          "api_address": "https://127.0.0.1:49244",
-          "cluster_address": "https://127.0.0.1:8201",
-          "connection_status": "connected",
-          "last_heartbeat": "2020-06-10T15:40:46-07:00"
-        }
-      ],
-      "primary_cluster_addr": "https://127.0.0.1:8201",
-      "secondary_id": "2",
-      "state": "stream-wals"
-    }
-  }
-}
-```
-
-## `/sys/replication/merkle-check`
-
-The Merkle check endpoint prints information about the corruption
-status of the Merkle tree. The corruption information provides insight
-about whether any current replication issues can be resolved by
-reindexing the tree. We recommend consulting the Merkle check endpoint
-**before** reindexing to ensure the process will be useful as  reindexing
-can be time-consuming and lead to downtime.
-
-You must provide an authentication token when calling `replication/merkle-check`.
-
-| Method  | Path                            |
-| :------ | :------------------------------ |
-| `POST`  | `/sys/replication/merkle-check` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/replication/merkle-check
-```
-
-### Sample response
-
-The response provides information about the health of the Merkle composite tree.
-The `merkle_corruption_report` stanza provides information about merkle tree
-corruption.  The `corrupted_root` field indicates whether the root of the tree
-is corrupted. The `corrupted_tree_map` field identifies any corruption in the
-roots of its subtrees, including replicated and local subtrees. In the event of
-corruption within a page or subpage of the tree, `corrupted_tree_map` includes
-the page number along with a list of corrupted subpage numbers. The status details
-indicate the extent of corruption within the merkle tree.
-
-```json
-{
-  "request_id": "d4b2ad1a-6e5f-7f9e-edfe-558eb89a40e6",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "merkle_corruption_report": {
-      "corrupted_root": false,
-      "corrupted_tree_map": {
-        "1": {
-          "corrupted_index_tuples_map": {
-            "5": {
-              "corrupted": false,
-              "subpages": [
-                28
-              ]
-            }
-          },
-          "corrupted_subtree_root": false,
-          "root_hash": "DyGc6rQTV9XgyNSff3zimhi3FJM=",
-          "tree_type": "replicated"
-        },
-        "2": {
-          "corrupted_index_tuples_map": null,
-          "corrupted_subtree_root": false,
-          "root_hash": "EXmRTdfYCZTm5i9wLef9RQqyLCw=",
-          "tree_type": "local"
-        }
-      },
-      "last_corruption_check_epoch": "2023-09-11T11:25:59.44956-07:00"
-    }
-  }
-}
-```
diff --git a/website/content/api-docs/system/replication/replication-dr.mdx b/website/content/api-docs/system/replication/replication-dr.mdx
deleted file mode 100644
index ef020a94656..00000000000
--- a/website/content/api-docs/system/replication/replication-dr.mdx
+++ /dev/null
@@ -1,908 +0,0 @@
----
-layout: api
-page_title: /sys/replication - HTTP API
-description: >-
-  The '/sys/replication/dr' endpoint focuses on managing general operations in
-  Vault Enterprise Disaster Recovery replication
----
-
-# `/sys/replication/dr`
-
-## Check DR status
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-This endpoint prints information about the status of replication (mode,
-sync progress, etc).
-
-This is an unauthenticated endpoint.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `GET`  | `/sys/replication/dr/status` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/replication/dr/status
-```
-
-### Sample response from primary
-
-The printed status of the replication environment. As an example, for a
-primary, it will look something like:
-
-```json
-{
-  "data": {
-    "cluster_id": "d4095d41-3aee-8791-c421-9bc7f88f7c3e",
-    "known_secondaries": ["3"],
-    "corrupted_merkle_tree": false,
-    "last_corruption_check_epoch": "1694456090",
-    "last_wal": 241,
-    "merkle_root": "56794a98e52598f35974024fba6691f047e772e9",
-    "mode": "primary",
-    "secondaries": [
-      {
-        "api_address": "https://127.0.0.1:49264",
-        "cluster_address": "https://127.0.0.1:49267",
-        "connection_status": "connected",
-        "last_heartbeat": "2020-06-10T15:40:47-07:00",
-        "node_id": "3"
-      }
-    ]
-  }
-}
-```
-
-### Sample response from secondary
-
-The printed status of the replication environment. As an example, for a
-secondary, it will look something like:
-
-```json
-{
-  "data": {
-    "cluster_id": "d4095d41-3aee-8791-c421-9bc7f88f7c3e",
-    "known_primary_cluster_addrs": ["https://127.0.0.1:8201"],
-    "last_remote_wal": 241,
-    "merkle_root": "56794a98e52598f35974024fba6691f047e772e9",
-    "mode": "secondary",
-    "primaries": [
-      {
-        "api_address": "https://127.0.0.1:49244",
-        "cluster_address": "https://127.0.0.1:8201",
-        "connection_status": "connected",
-        "last_heartbeat": "2020-06-10T15:40:46-07:00"
-      }
-    ],
-    "primary_cluster_addr": "https://127.0.0.1:8201",
-    "secondary_id": "3",
-    "state": "stream-wals"
-  }
-}
-```
-
-## Enable DR primary replication
-
-@include 'alerts/restricted-root.mdx'
-
-@include 'alerts/enterprise-only.mdx'
-
-This endpoint enables DR replication in primary mode. This is used when DR replication
-is currently disabled on the cluster (if the cluster is already a secondary, it
-must be promoted).
-
-| Method | Path                                 |
-| :----- | :----------------------------------- |
-| `POST` | `/sys/replication/dr/primary/enable` |
-
-### Parameters
-
-- `primary_cluster_addr` `(string: "")` – Specifies the cluster address that the
-  primary gives to secondary nodes. Useful if the primary's cluster address is
-  not directly accessible and must be accessed via an alternate path/address,
-  such as through a TCP-based load balancer.
-
-### Sample payload
-
-```json
-{}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/dr/primary/enable
-```
-
-## Demote DR primary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint demotes a DR primary cluster to a secondary. This DR secondary cluster
-will not attempt to connect to a primary (see the update-primary call), but will
-maintain knowledge of its cluster ID and can be reconnected to the same
-DR replication set without wiping local storage.
-
-| Method | Path                                 |
-| :----- | :----------------------------------- |
-| `POST` | `/sys/replication/dr/primary/demote` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/dr/primary/demote
-```
-
-## Disable DR primary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint disables DR replication entirely on the cluster. Any secondaries will
-no longer be able to connect. Caution: re-enabling this node as a primary or
-secondary will change its cluster ID; in the secondary case this means a wipe of
-the underlying storage when connected to a primary, and in the primary case,
-secondaries connecting back to the cluster (even if they have connected before)
-will require a wipe of the underlying storage.
-
-| Method | Path                                  |
-| :----- | :------------------------------------ |
-| `POST` | `/sys/replication/dr/primary/disable` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/dr/primary/disable
-```
-
-## Generate DR secondary token
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint generates a DR secondary activation token for the
-cluster with the given opaque identifier, which must be unique. This
-identifier can later be used to revoke a DR secondary's access.
-
-**This endpoint requires 'sudo' capability.**
-
-| Method | Path                                          |
-| :----- | :-------------------------------------------- |
-| `POST` | `/sys/replication/dr/primary/secondary-token` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Specifies an opaque identifier, e.g. 'us-east'
-
-- `ttl` `(string: "30m")` – Specifies the TTL for the secondary activation
-  token.
-
-- `secondary_public_key` `(string: "")` – Specifies the secondary's generated
-  public key, if using encryption rather than response wrapping to protect the
-  secondary credentials. (Vault 1.3+). Use this to avoid making an API call to
-  the primary during secondary activation.
-
-### Sample payload
-
-```json
-{
-  "id": "us-east-1"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/dr/primary/secondary-token
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": null,
-  "warnings": null,
-  "wrap_info": {
-    "token": "fb79b9d3-d94e-9eb6-4919-c559311133d6",
-    "ttl": 300,
-    "creation_time": "2016-09-28T14:41:00.56961496-04:00",
-    "wrapped_accessor": ""
-  }
-}
-```
-
-## Revoke DR secondary token
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint revokes a DR secondary's ability to connect to the DR primary cluster;
-the DR secondary will immediately be disconnected and will not be allowed to
-connect again unless given a new activation token.  This command can be run from any node on the DR primary cluster.
-
-| Method | Path                                           |
-| :----- | :--------------------------------------------- |
-| `POST` | `/sys/replication/dr/primary/revoke-secondary` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Specifies an opaque identifier, e.g. 'us-east'
-
-### Sample payload
-
-```json
-{
-  "id": "us-east"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/dr/primary/revoke-secondary
-```
-
-## Generate DR secondary public key
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint allows generating a public key that is used to encrypt the returned
-credential information (instead of using a response wrapped token). This avoids
-needing to make an API call to the primary during activation.
-
-| Method | Path                                                |
-| :----- | :-------------------------------------------------- |
-| `POST` | `/sys/replication/dr/secondary/generate-public-key` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/generate-public-key
-```
-
-## Enable DR secondary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint enables replication on a DR secondary using a DR secondary activation
-token.
-
-!> This will immediately clear all data in the secondary cluster!
-
-| Method | Path                                   |
-| :----- | :------------------------------------- |
-| `POST` | `/sys/replication/dr/secondary/enable` |
-
-### Parameters
-
-- `token` `(string: <required>)` – Specifies the secondary activation token
-  fetched from the primary.
-
-- `primary_api_addr` `(string: "")` – Set this to the API address (normal Vault
-  address) to override the value embedded in the token. This can be useful if
-  the primary's redirect address is not accessible directly from this cluster
-  (e.g. through a load balancer).
-
-- `ca_file` `(string: "")` – Specifies the path to a CA root file (PEM format)
-  that the secondary can use when unwrapping the token from the primary. If this
-  and ca_path are not given, defaults to system CA roots.
-
-- `ca_path` `(string: "")` – Specifies the path to a CA root directory
-  containing PEM-format files that the secondary can use when unwrapping the
-  token from the primary. If this and ca_file are not given, defaults to system
-  CA roots.
-
-### Sample payload
-
-```json
-{
-  "token": "..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/enable
-```
-
-## Promote DR secondary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint promotes the DR secondary cluster to DR primary. For data safety and
-security reasons, new secondary tokens will need to be issued to other
-secondaries, and there should never be more than one primary at a time.
-
-If the DR secondary's primary cluster is also in a performance replication set,
-the DR secondary will be promoted into that replication set. Care should be
-taken when promoting to ensure multiple performance primary clusters are not
-active at the same time.
-
-If the DR secondary's primary cluster is a performance secondary, the promoted
-cluster will attempt to connect to the performance primary cluster using the
-same secondary token.
-
-This endpoint requires a DR Operation Token to be provided as means of
-authorization. See the [DR Operation Token API
-docs](#generate-disaster-recovery-operation-token) for more information.
-
-!> Only one performance primary should be active at a given time. Multiple primaries may
-result in data loss!
-
-~> It is not safe to replicate from a newer version of Vault to an older version.
-When upgrading replicated clusters, ensure that upstream clusters are always
-on older versions of Vault than downstream clusters. See
-[Upgrading Vault](/vault/docs/upgrading#replication-installations) for an example.
-
-
-| Method | Path                                    |
-| :----- | :-------------------------------------- |
-| `POST` | `/sys/replication/dr/secondary/promote` |
-
-### Parameters
-
-- `dr_operation_token` `(string: <required>)` - DR operation token used to authorize this request.
-- `primary_cluster_addr` `(string: "")` – Specifies the cluster address that the
-  primary gives to secondary nodes. Useful if the primary's cluster address is
-  not directly accessible and must be accessed via an alternate path/address
-  (e.g. through a load balancer).
-- `force` `(bool: false)` - If true the cluster will be promoted even if it fails
-  certain safety checks. Caution: Forcing promotion could result in data loss if
-  data isn't fully replicated.
-
-### Sample payload
-
-```json
-{
-  "dr_operation_token": "ijH8tphEHaBtgx+IvPfxDsSi2LV4j9k+Lad6eqT5cJw="
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/promote
-```
-
-### Sample response
-
-```json
-{
-  "progress": 0,
-  "required": 1,
-  "complete": false,
-  "request_id": "ad8f9074-0e24-d30e-83cd-595c9652ff89",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "complete": false,
-    "progress": 0,
-    "required": 1
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-## Disable DR secondary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint disables DR replication entirely on the cluster. The cluster will no
-longer be able to connect to the DR primary.
-
-This endpoint requires a DR Operation Token to be provided as means of authorization. See the DR Operation Token API docs for more information.
-
-!> Re-enabling this node as a DR primary or secondary will change its cluster ID;
-in the secondary case this means a wipe of the underlying storage when connected
-to a primary, and in the primary case, secondaries connecting back to the
-cluster (even if they have connected before) will require a wipe of the
-underlying storage.
-
-| Method | Path                                    |
-| :----- | :-------------------------------------- |
-| `POST` | `/sys/replication/dr/secondary/disable` |
-
-### Sample payload
-
-```json
-{
-  "dr_operation_token": "..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/disable
-```
-
-## Update DR secondary's primary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-The update endpoint changes the primary cluster assigned to a DR
-secondary cluster. Changing the primary cluster assignment does not
- wipe data in the secondary cluster.
-
-This endpoint requires a DR Operation Token to be provided as means of
-authorization. See the [DR Operation Token API
-docs](#generate-disaster-recovery-operation-token) for more information.
-
-There are two ways to update the primary assignment:
-
-1. **Use a secondary activation token with the `token` parameter**. An
-    activation token is required after a DR failover when updating a newly
-    demoted DR secondary cluster.
-
-1. **Use primary cluster addresses with the `update_primary_addrs` parameter**.
-    During the update, cluster addresses are pinged one at a time via gRPC.
-    The first cluster to respond successfully is assigned as the new primary
-    address. Updating with cluster addresses is not allowed after a DR
-    failover when updating a newly demoted DR secondary cluster.
-
-The two update methods are mutually exclusive. You may use one or the
-other, but not both. A good rule of thumb is to use `token` on DR secondary
-clusters and `update_primary_addrs` on performance secondary clusters.
-
-| Method | Path                                           |
-| :----- | :--------------------------------------------- |
-| `POST` | `/sys/replication/dr/secondary/update-primary` |
-
-### Parameters
-
-- `dr_operation_token` `(string: <required>)` - DR operation token used to authorize this request.
-
-- `token` `(string: <required>)` – Specifies the secondary activation token
-  fetched from the primary. If you set this to a blank string, the cluster will
-  stay a secondary but clear its knowledge of any past primary (and thus not
-  attempt to connect to the previous primary). This can be useful if the primary
-  is down to stop the secondary from trying to reconnect to it.
-
-- `primary_api_addr` `(string: )` – Specifies the API address (normal Vault
-  address) to override the value embedded in the token. This can be useful if
-  the primary's redirect address is not accessible directly from this cluster.
-
-- `ca_file` `(string: "")` – Specifies the path to a CA root file (PEM format)
-  that the secondary can use when unwrapping the token from the primary. If this
-  and ca_path are not given, defaults to system CA roots.
-
-- `ca_path` `string: ()` – Specifies the path to a CA root directory containing
-  PEM-format files that the secondary can use when unwrapping the token from the
-  primary. If this and ca_file are not given, defaults to system CA roots.
-
-- `update_primary_addrs` `array: []` – List of cluster addresses for potential
-  primary clusters. These addresses will be pinged in sequence, and if any of them
-  respond successfully, these will be recorded as the new primary addresses. This is
-  a lighter weight version of specifying a token and should result in less disruption
-  of replication.
-
-### Sample payload
-
-```json
-{
-  "dr_operation_token": "...",
-  "token": "..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/update-primary
-```
-
-### Sample payload
-
-```json
-{
-  "dr_operation_token": "...",
-  "update_primary_addrs": ["10.0.0.2:8201"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/update-primary
-```
-
-## Generate disaster recovery operation token
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/replication/dr/secondary/generate-operation-token` endpoint is used to create a new Disaster
-Recovery operation token for a DR secondary. These tokens are used to authorize
-certain DR Operations. They should be treated like traditional root tokens by
-being generated when needed and deleted soon after.
-
-## Read generation progress
-
-@include 'alerts/enterprise-only.mdx'
-
-This endpoint reads the configuration and process of the current generation
-attempt.
-
-| Method | Path                                                             |
-| :----- | :--------------------------------------------------------------- |
-| `GET`  | `/sys/replication/dr/secondary/generate-operation-token/attempt` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/generate-operation-token/attempt
-```
-
-### Sample response
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "progress": 1,
-  "required": 3,
-  "encoded_token": "",
-  "pgp_fingerprint": "",
-  "complete": false
-}
-```
-
-If a generation is started, `progress` is how many unseal keys have been
-provided for this generation attempt, where `required` must be reached to
-complete. The `nonce` for the current attempt and whether the attempt is
-complete is also displayed. If a PGP key is being used to encrypt the final
-token, its fingerprint will be returned. Note that if an OTP is being used to
-encode the final token, it will never be returned.
-
-## Start token generation
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint initializes a new generation attempt. Only a single
-generation attempt can take place at a time.
-
-| Method | Path                                                             |
-| :----- | :--------------------------------------------------------------- |
-| `POST` | `/sys/replication/dr/secondary/generate-operation-token/attempt` |
-
-### Parameters
-
-- `pgp_key` `(string: <optional>)` – Specifies a base64-encoded PGP public key.
-  The raw bytes of the token will be encrypted with this value before being
-  returned to the final unseal key provider.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/generate-operation-token/attempt
-```
-
-### Sample response
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "progress": 1,
-  "required": 3,
-  "encoded_token": "",
-  "otp": "2vPFYG8gUSW9npwzyvxXMug0",
-  "otp_length": 24,
-  "complete": false
-}
-```
-
-## Cancel generation
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint cancels any in-progress generation attempt. This clears any
-progress made. This must be called to change the OTP or PGP key being used.
-
-| Method   | Path                                                             |
-| :------- | :--------------------------------------------------------------- |
-| `DELETE` | `/sys/replication/dr/secondary/generate-operation-token/attempt` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/generate-operation-token/attempt
-```
-
-## Provide key share to generate token
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint is used to enter a single root key share to progress the
-generation attempt. If the threshold number of root key shares is reached,
-Vault will complete the generation and issue the new token. Otherwise,
-this API must be called multiple times until that threshold is met. The attempt
-nonce must be provided with each call.
-
-| Method | Path                                                            |
-| :----- | :-------------------------------------------------------------- |
-| `POST` | `/sys/replication/dr/secondary/generate-operation-token/update` |
-
-### Parameters
-
-- `key` `(string: <required>)` – Specifies a single root key share.
-
-- `nonce` `(string: <required>)` – Specifies the nonce of the attempt.
-
-### Sample payload
-
-```json
-{
-  "key": "acbd1234",
-  "nonce": "ad235"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/generate-operation-token/update
-```
-
-### Sample response
-
-This returns a JSON-encoded object indicating the attempt nonce, and completion
-status, and the encoded token, if the attempt is complete.
-
-```json
-{
-  "started": true,
-  "nonce": "2dbd10f1-8528-6246-09e7-82b25b8aba63",
-  "progress": 3,
-  "required": 3,
-  "pgp_fingerprint": "",
-  "complete": true,
-  "encoded_token": "FPzkNBvwNDeFh4SmGA8c+w=="
-}
-```
-
-## Delete DR operation token
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint revokes the DR Operation Token. This token does not have a TTL
-and therefore should be deleted when it is no longer needed.
-
-| Method | Path                                                   |
-| :----- | :----------------------------------------------------- |
-| `POST` | `/sys/replication/dr/secondary/operation-token/delete` |
-
-### Parameters
-
-- `dr_operation_token` `(string: <required>)` - DR operation token used to authorize this request.
-
-### Sample payload
-
-```json
-{
-  "dr_operation_token": "..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/operation-token/delete
-```
-
-## Reindex Replication
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint reindexes the local data storage. This can cause a very long delay
-depending on the number and size of objects in the data store.
-
-**This endpoint requires a disaster recovery operation token.**
-
-| Method | Path                                     |
-| :----- | :--------------------------------------- |
-| `POST` | `/sys/replication/dr/secondary/reindex` |
-
-### Parameters
-
-- `diff` `(bool: false)` – Enables a slower re-indexing which will perform a key
-  level check to diagnose issues. Defaults false.
-
-- `force` `(bool: false)` – Forces a complete re-indexing which only scans data
-  available in the storage. Defaults false.
-
-- `skip_flush` `(bool: false)` – Skips the tree flushing stage of the reindex
-  process. This setting can be used to reduce the amount of time the tree is locked
-  during a reindex process. If this node is killed before the full tree has been
-  asynchronously flushed the reindex may not have applied fully and a new reindex
-  may need to be done. Defaults false.
-
-- `dr_operation_token` `(string: <required>)` - DR operation token used to authorize
-  this request.
-
-### Sample Payload
-
-```json
-{
-  "dr_operation_token": "..."
-}
-```
-
-### Sample Request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/reindex
-```
-
-### Sample Response
-
-```json
-{
-  "warnings": ["..."]
-}
-```
-
-## `/sys/replication/dr/secondary/merkle-check`
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-The Merkle check endpoint prints information about the corruption status of the Merkle tree on a DR
-secondary cluster. Check [merkle tree corruption](/vault/api-docs/system/replication#check-merkle-tree-corruption) for more details.
-
-Requests to `/sys/replication/dr/secondary/merkle-check` must provide a DR
-Operation Token as authorization. See the [DR Operation Token API
-docs](#generate-disaster-recovery-operation-token) for more information.
-
-| Method  | Path                                         |
-| :------ | :------------------------------------------- |
-| `POST`  | `/sys/replication/dr/secondary/merkle-check` |
-
-### Parameters
-
-- `dr_operation_token` `(string: <required>)` - DR operation token used to authorize the request.
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/replication/dr/secondary/merkle-check
-```
-
-### Sample response
-
-The response provides information about the health of the Merkle composite tree.
-It indicates whether the root of the tree is corrupted and also identifies any
-corruption in the roots of its subtrees, including replicated and local subtrees.
-In the event of corruption within a page or subpage of the tree, it includes the
-page number along with a list of corrupted subpage numbers. The status details
-indicate the extent of corruption within the Merkle tree.
-
-```json
-{
-  "request_id": "d4b2ad1a-6e5f-7f9e-edfe-558eb89a40e6",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "merkle_corruption_report": {
-      "corrupted_root": false,
-      "corrupted_tree_map": {
-        "1": {
-          "corrupted_index_tuples_map": {
-            "5": {
-              "corrupted": false,
-              "subpages": [
-                28
-              ]
-            }
-          },
-          "corrupted_subtree_root": false,
-          "root_hash": "DyGc6rQTV9XgyNSff3zimhi3FJM=",
-          "tree_type": "replicated"
-        },
-        "2": {
-          "corrupted_index_tuples_map": null,
-          "corrupted_subtree_root": false,
-          "root_hash": "EXmRTdfYCZTm5i9wLef9RQqyLCw=",
-          "tree_type": "local"
-        }
-      },
-      "last_corruption_check_epoch": "2023-09-11T11:25:59.44956-07:00"
-    }
-  }
-}
-```
diff --git a/website/content/api-docs/system/replication/replication-performance.mdx b/website/content/api-docs/system/replication/replication-performance.mdx
deleted file mode 100644
index 99318c5c003..00000000000
--- a/website/content/api-docs/system/replication/replication-performance.mdx
+++ /dev/null
@@ -1,682 +0,0 @@
----
-layout: api
-page_title: /sys/replication - HTTP API
-description: >-
-  The '/sys/replication/performance' endpoint focuses on managing general
-  operations in Vault Enterprise Performance Replication
----
-
-# `/sys/replication/performance`
-
-## Check performance status
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-This endpoint prints information about the status of replication (mode,
-sync progress, etc).
-
-This is an unauthenticated endpoint.
-
-| Method | Path                                  |
-| :----- | :------------------------------------ |
-| `GET`  | `/sys/replication/performance/status` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/replication/performance/status
-```
-
-### Sample response from primary
-
-The printed status of the replication environment. As an example, for a
-primary, it will look something like:
-
-```json
-{
-  "data": {
-    "cluster_id": "d4095d41-3aee-8791-c421-9bc7f88f7c3e",
-    "known_secondaries": ["2"],
-    "last_wal": 87,
-    "merkle_root": "c31e40f6ff02f32c37b70e6a4d58732ac812abf0",
-    "corrupted_merkle_tree": false,
-    "last_corruption_check_epoch": "1694456090",
-    "mode": "primary",
-    "secondaries": [
-      {
-        "api_address": "https://127.0.0.1:49264",
-        "cluster_address": "https://127.0.0.1:49267",
-        "connection_status": "connected",
-        "last_heartbeat": "2020-06-10T15:40:47-07:00",
-        "node_id": "2"
-      }
-    ]
-  }
-}
-```
-
-### Sample response from secondary
-
-The printed status of the replication environment. As an example, for a
-secondary, it will look something like:
-
-```json
-{
-  "data": {
-    "cluster_id": "06dcf957-6630-44ae-bdd9-117d5f4d70d7",
-    "known_primary_cluster_addrs": ["https://127.0.0.1:8201"],
-    "last_remote_wal": 87,
-    "merkle_root": "c31e40f6ff02f32c37b70e6a4d58732ac812abf0",
-    "mode": "secondary",
-    "primaries": [
-      {
-        "api_address": "https://127.0.0.1:49244",
-        "cluster_address": "https://127.0.0.1:8201",
-        "connection_status": "connected",
-        "last_heartbeat": "2020-06-10T15:40:46-07:00"
-      }
-    ],
-    "primary_cluster_addr": "https://127.0.0.1:8201",
-    "secondary_id": "2",
-    "state": "stream-wals"
-  }
-}
-```
-
-## Enable performance primary replication
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint enables replication in primary mode. This is used when replication
-is currently disabled on the cluster (if the cluster is already a secondary, it
-must be promoted).
-
-!> Only one primary should be active at a given time. Multiple primaries may
-result in data loss!
-
-| Method | Path                                          |
-| :----- | :-------------------------------------------- |
-| `POST` | `/sys/replication/performance/primary/enable` |
-
-### Parameters
-
-- `primary_cluster_addr` `(string: "")` – Specifies the cluster address that the
-  primary gives to secondary nodes. Useful if the primary's cluster address is
-  not directly accessible and must be accessed via an alternate path/address,
-  such as through a TCP-based load balancer. If not set, uses vault's configured
-  cluster address.
-
-### Sample payload
-
-```json
-{}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/performance/primary/enable
-```
-
-## Demote performance primary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint demotes a performance primary cluster to a performance secondary.
-This secondary cluster will not attempt to connect to a primary (see the update-primary call),
-but will maintain knowledge of its cluster ID and can be reconnected to the same
-replication set without wiping local storage.
-
-| Method | Path                                          |
-| :----- | :-------------------------------------------- |
-| `POST` | `/sys/replication/performance/primary/demote` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/performance/primary/demote
-```
-
-## Disable performance primary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint disables Performance Replication entirely on the cluster. Any
-performance secondaries will no longer be able to connect. Caution: re-enabling
-this node as a primary or secondary will change its cluster ID; in the secondary
-case this means a wipe of the underlying storage when connected to a primary,
-and in the primary case, secondaries connecting back to the cluster (even if
-they have connected before) will require a wipe of the underlying storage.
-
-| Method | Path                                           |
-| :----- | :--------------------------------------------- |
-| `POST` | `/sys/replication/performance/primary/disable` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/performance/primary/disable
-```
-
-## Generate performance secondary token
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint generates a performance secondary activation token for the
-cluster with the given opaque identifier, which must be unique. This
-identifier can later be used to revoke a secondary's access.
-
-**This endpoint requires 'sudo' capability.**
-
-| Method | Path                                                   |
-| :----- | :----------------------------------------------------- |
-| `POST` | `/sys/replication/performance/primary/secondary-token` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Specifies an opaque identifier, e.g. 'us-east'
-
-- `ttl` `(string: "30m")` – Specifies the TTL for the secondary activation
-  token.
-
-- `secondary_public_key` `(string: "")` – Specifies the secondary's generated
-  public key, if using encryption rather than response wrapping to protect the
-  secondary credentials. (Vault 1.3+)
-
-### Sample payload
-
-```json
-{
-  "id": "us-east-1"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/performance/primary/secondary-token
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": null,
-  "warnings": null,
-  "wrap_info": {
-    "token": "fb79b9d3-d94e-9eb6-4919-c559311133d6",
-    "ttl": 300,
-    "creation_time": "2016-09-28T14:41:00.56961496-04:00",
-    "wrapped_accessor": ""
-  }
-}
-```
-
-## Revoke performance secondary token
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint revokes a performance secondary's ability to connect to the
-performance primary cluster; the secondary will immediately be disconnected and
-will not be allowed to connect again unless given a new activation token.
-
-| Method | Path                                                    |
-| :----- | :------------------------------------------------------ |
-| `POST` | `/sys/replication/performance/primary/revoke-secondary` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Specifies an opaque identifier, e.g. 'us-east'
-
-### Sample payload
-
-```json
-{
-  "id": "us-east"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/performance/primary/revoke-secondary
-```
-
-## Create paths filter
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint is used to modify the mounts and namespaces that are filtered to a secondary.
-Filtering can be specified in allow mode or deny mode. In allow
-mode the secret and auth mounts that are specified are included to the
-selected secondary. In deny mode, the mount and namespace paths are excluded.
-
-| Method | Path                                                    |
-| :----- | :------------------------------------------------------ |
-| `POST` | `/sys/replication/performance/primary/paths-filter/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Specifies the unique performance secondary identifier. Note that this identifier is
-  not arbitrary. This should be the secondary cluster ID as reported by the `cluster_id` field of the [replication status](/vault/api-docs/system/replication#check-status) API
-  endpoint. If, for example, a new performance secondary token
-  [is created](/vault/api-docs/system/replication/replication-performance#generate-performance-secondary-token), and used to call
-  [update-primary](/vault/api-docs/system/replication/replication-performance#update-performance-secondary-s-primary), then path filters will need
-  to be re-created via this API endpoint.
-
-- `mode` `(string: "allow")` – Specifies the filtering mode. Available values
-  are "allow" and "deny".
-
-- `paths` `(array: [])` – The list of mount and namespace paths that are filtered.
-
-### Sample payload
-
-```json
-{
-  "mode": "allow",
-  "paths": ["secret/", "ns1/"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/performance/primary/paths-filter/mySecondaryID
-```
-
-## Read paths filter
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint is used to read the mode and the mount/namespace paths that are filtered
-for a secondary.
-
-| Method | Path                                                    | |
-| :----- | :------------------------------------------------------ | ------------------ |
-| `GET`  | `/sys/replication/performance/primary/paths-filter/:id` | `200 (empty body)` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Specifies the unique performance secondary identifier.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/replication/performance/primary/paths-filter/mySecondaryID
-```
-
-### Sample response
-
-```json
-{
-  "mode": "allow",
-  "paths": ["secret/", "ns1/"]
-}
-```
-
-## Delete paths filter
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint is used to delete the mount and namespace filters for a secondary.
-
-| Method   | Path                                                    |
-| :------- | :------------------------------------------------------ |
-| `DELETE` | `/sys/replication/performance/primary/paths-filter/:id` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Specifies the unique performance secondary identifier.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/replication/performance/primary/paths-filter/mySecondaryID
-```
-
-## Read dynamically generated filter (PRIMARY)
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint is used to read the namespace and the mount paths that are dynamically
-filtered for a secondary on the primary.
-
-| Method | Path                                                      | |
-| :----- | :-------------------------------------------------------- | ------------------ |
-| `GET`  | `/sys/replication/performance/primary/dynamic-filter/:id` | `200 (empty body)` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Specifies the unique performance secondary identifier.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/replication/performance/primary/dynamic-filter/mySecondaryID
-```
-
-### Sample response
-
-```json
-{
-  "dynamic_filtered_mounts": ["ns1/ns2/secret/", "ns1/kv/"],
-  "dynamic_filtered_namespaces": ["ns1/", "ns1/ns2/"]
-}
-```
-
-## Read dynamically generated filter (SECONDARY)
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint is used to read the namespace and the mount paths that are dynamically
-filtered for a secondary on the secondary.
-
-| Method | Path                                                        | |
-| :----- | :---------------------------------------------------------- | ------------------ |
-| `GET`  | `/sys/replication/performance/secondary/dynamic-filter/:id` | `200 (empty body)` |
-
-### Parameters
-
-- `id` `(string: <required>)` – Specifies the unique performance secondary identifier.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/replication/performance/secondary/dynamic-filter/mySecondaryID
-```
-
-### Sample response
-
-```json
-{
-  "dynamic_filtered_mounts": ["ns1/ns2/secret/", "ns1/kv/"],
-  "dynamic_filtered_namespaces": ["ns1/", "ns1/ns2/"]
-}
-```
-
-## Fetch performance secondary public key
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint allows fetching a public key that is used to encrypt the returned
-credential information (instead of using a response wrapped token). This avoids
-needing to make an API call to the primary during activation.
-
-| Method | Path                                                         |
-| :----- | :----------------------------------------------------------- |
-| `POST` | `/sys/replication/performance/secondary/generate-public-key` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/performance/secondary/generate-public-key
-```
-
-## Enable performance secondary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint enables Performance Replication on a secondary using a secondary activation
-token.
-
-!> This will immediately clear all data in the secondary cluster!
-
-| Method | Path                                            |
-| :----- | :---------------------------------------------- |
-| `POST` | `/sys/replication/performance/secondary/enable` |
-
-### Parameters
-
-- `token` `(string: <required>)` – Specifies the secondary activation token
-  fetched from the primary.
-
-- `primary_api_addr` `(string: "")` – Set this to the API address (normal Vault
-  address) to override the value embedded in the token. This can be useful if
-  the primary's redirect address is not accessible directly from this cluster
-  (e.g. through a load balancer).
-
-- `ca_file` `(string: "")` – Specifies the path to a CA root file (PEM format)
-  that the secondary can use when unwrapping the token from the primary. If this
-  and ca_path are not given, defaults to system CA roots.
-
-- `ca_path` `(string: "")` – Specifies the path to a CA root directory
-  containing PEM-format files that the secondary can use when unwrapping the
-  token from the primary. If this and ca_file are not given, defaults to system
-  CA roots.
-
-### Sample payload
-
-```json
-{
-  "token": "..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/performance/secondary/enable
-```
-
-## Promote performance secondary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint promotes the performance secondary cluster to performance primary.
-For data safety and security reasons, new secondary tokens will need to be
-issued to other secondaries, and there should never be more than one performance
-primary at a time.
-
-| Method | Path                                             |
-| :----- | :----------------------------------------------- |
-| `POST` | `/sys/replication/performance/secondary/promote` |
-
-### Parameters
-
-- `primary_cluster_addr` `(string: "")` – Specifies the cluster address that the
-  primary gives to secondary nodes. Useful if the primary's cluster address is
-  not directly accessible and must be accessed via an alternate path/address
-  (e.g. through a load balancer).
-- `force` `(bool: false)` - If true the cluster will be promoted even if it fails
-  certain safety checks. Caution: Forcing promotion could result in data loss if
-  data isn't fully replicated.
-
-### Sample payload
-
-```json
-{}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/performance/secondary/promote
-```
-
-## Disable performance secondary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-This endpoint disables Performance Replication entirely on the cluster. The cluster will no
-longer be able to connect to the performance primary.
-
-!> Re-enabling this node as a performance primary or secondary will change its cluster ID;
-in the secondary case this means a wipe of the underlying storage when connected
-to a primary, and in the primary case, secondaries connecting back to the
-cluster (even if they have connected before) will require a wipe of the
-underlying storage.
-
-| Method | Path                                             |
-| :----- | :----------------------------------------------- |
-| `POST` | `/sys/replication/performance/secondary/disable` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/replication/performance/secondary/disable
-```
-
-## Update performance secondary's primary
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-The update endpoint changes the primary cluster assigned to a
-performance secondary cluster. Changing the primary cluster assignment
-does not wipe data in the secondary cluster.
-
-There are two ways to update the primary assignment:
-
-1. **Use a secondary activation token with the `token` parameter**.
-1. **Use primary cluster addresses with the `update_primary_addrs` parameter**.
-   During the update, cluster addresses are pinged one at a time via gRPC. The
-   first cluster to respond successfully is assigned as the new primary address.
-
-The two update methods are mutually exclusive. You may use one or the other,
-but not both. A good rule of thumb is to use `token` on DR secondary
-clusters and `update_primary_addrs` on performance secondary clusters.
-
-| Method | Path                                                    |
-| :----- | :------------------------------------------------------ |
-| `POST` | `/sys/replication/performance/secondary/update-primary` |
-
-### Parameters
-
-- `token` `(string: <required>)` – Specifies the secondary activation token
-  fetched from the primary. If you set this to a blank string, the cluster will
-  stay a secondary but clear its knowledge of any past primary (and thus not
-  attempt to connect to the previous primary). This can be useful if the primary
-  is down to stop the secondary from trying to reconnect to it.
-
-- `primary_api_addr` `(string: )` – Specifies the API address (normal Vault
-  address) to override the value embedded in the token. This can be useful if
-  the primary's redirect address is not accessible directly from this cluster.
-
-- `ca_file` `(string: "")` – Specifies the path to a CA root file (PEM format)
-  that the secondary can use when unwrapping the token from the primary. If this
-  and ca_path are not given, defaults to system CA roots.
-
-- `ca_path` `string: ()` – Specifies the path to a CA root directory containing
-  PEM-format files that the secondary can use when unwrapping the token from the
-  primary. If this and ca_file are not given, defaults to system CA roots.
-
-- `update_primary_addrs` `array: []` – List of cluster addresses for potential
-  primary clusters. These addresses will be pinged in sequence, and if any of them
-  respond successfully, these will be recorded as the new primary addresses. This is
-  a lighter weight version of specifying a token and should result in less disruption
-  of replication.
-
-### Sample payload
-
-```json
-{
-  "token": "..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/performance/secondary/update-primary
-```
-
-### Sample payload
-
-```json
-{
-  "update_primary_addrs": ["10.0.0.2:8201"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/replication/performance/secondary/update-primary
-```
diff --git a/website/content/api-docs/system/rotate-config.mdx b/website/content/api-docs/system/rotate-config.mdx
deleted file mode 100644
index 226189ad866..00000000000
--- a/website/content/api-docs/system/rotate-config.mdx
+++ /dev/null
@@ -1,86 +0,0 @@
----
-layout: api
-page_title: /sys/rotate/config - HTTP API
-description: The `/sys/rotate/config` endpoint is used to configure automatic key rotation.
----
-
-# `/sys/rotate/config`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/rotate` endpoint is used to configure automatic key rotation.
-
-## Configure automatic key rotation
-
-This endpoint configures the automatic rotation of the backend encryption key. By
-default, the key is rotated after just under 4 billion encryptions, to satisfy the
-recommendation of [NIST SP 800-38D](https://csrc.nist.gov/publications/detail/sp/800-38d/final).
-One can configure rotations after fewer encryptions or on a time based schedule.
-
-## Create or update the auto rotation configuration
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/sys/rotate/config` |
-
-### Parameters
-
-- `max_operations` `(int: 3865470566)` - Specify the limit of encryptions after which
-  the key will be automatically rotated. The number must be between 1,000,000 and the
-  default.
-- `interval` `(string: "") - If set, the age of the active key at which an
-  automatic rotation is triggered. Specified as a Go duration string (e.g.
-  4320h), the value must be at least 24 hours.
-- `enabled` `(bool: true)` - If set to false, automatic rotations will not
-  be performed. Tracking of encryption counts will continue.
-
-### Sample payload
-
-```json
-{
-  "max_operations": 2000000000,
-  "interval": "4320h"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/rotate/config
-```
-
-## Get the auto rotation configuration
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `GET`  | `/sys/rotate/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request GET \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/rotate/config
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "f3d91b4a-69bf-4aaf-b928-df7a5486c130",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "max_operations": 2000000000,
-    "interval": "4320h",
-    "enabled": true
-  },
-  "warnings": null
-}
-```
diff --git a/website/content/api-docs/system/rotate.mdx b/website/content/api-docs/system/rotate.mdx
deleted file mode 100644
index a94a038b4ca..00000000000
--- a/website/content/api-docs/system/rotate.mdx
+++ /dev/null
@@ -1,33 +0,0 @@
----
-layout: api
-page_title: /sys/rotate - HTTP API
-description: The `/sys/rotate` endpoint is used to rotate the encryption key.
----
-
-# `/sys/rotate`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/rotate` endpoint is used to rotate the encryption key.
-
-## Rotate encryption key
-
-This endpoint triggers a rotation of the backend encryption key. This is the key
-that is used to encrypt data written to the storage backend, and is not provided
-to operators. This operation is done online. Future values are encrypted with
-the new key, while old values are decrypted with previous encryption keys.
-
-This path requires `sudo` capability in addition to `update`.
-
-| Method | Path          |
-| :----- | :------------ |
-| `POST` | `/sys/rotate` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/rotate
-```
diff --git a/website/content/api-docs/system/seal-backend-status.mdx b/website/content/api-docs/system/seal-backend-status.mdx
deleted file mode 100644
index 37155192000..00000000000
--- a/website/content/api-docs/system/seal-backend-status.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
----
-layout: api
-page_title: /sys/seal-backend-status - HTTP API
-description: The `/sys/seal-backend-status` endpoint is used to check the status of each seal backend.
----
-
-# `/sys/seal-backend-status`
-
-The `/sys/seal-backend-status` endpoint is used to display the status of
-each backing seal, namely whether each backend is healthy.
-
-## Seal Backend Status
-
-This endpoint returns the seal status of the Vault. This is an unauthenticated
-endpoint.
-
-| Method | Path                       |
-| :----- | :------------------------- |
-| `GET`  | `/sys/seal-backend-status` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/seal-backend-status
-```
-
-### Sample response
-
-
-```json
-{ 
-  "healthy": false,
-  "unhealthy_since": "2023-09-22T08:34:11Z",
-  "backends": [
-     {
-      "name": "hsm",
-      "healthy": true
-     },
-     {
-      "name": "transit",
-      "healthy": false,
-      "unhealthy_since": "2023-09-22T08:34:11Z"
-     }
-  ]
-}
-```
diff --git a/website/content/api-docs/system/seal-status.mdx b/website/content/api-docs/system/seal-status.mdx
deleted file mode 100644
index feb69e68e3c..00000000000
--- a/website/content/api-docs/system/seal-status.mdx
+++ /dev/null
@@ -1,67 +0,0 @@
----
-layout: api
-page_title: /sys/seal-status - HTTP API
-description: The `/sys/seal-status` endpoint is used to check the seal status of a Vault.
----
-
-# `/sys/seal-status`
-
-The `/sys/seal-status` endpoint is used to check the seal status of a Vault.
-
-## Seal status
-
-This endpoint returns the seal status of the Vault. This is an unauthenticated
-endpoint.
-
-| Method | Path               |
-| :----- | :----------------- |
-| `GET`  | `/sys/seal-status` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    http://127.0.0.1:8200/v1/sys/seal-status
-```
-
-### Sample response
-
-The "t" parameter is the threshold, and "n" is the number of shares.
-
-```json
-{
-  "type": "shamir",
-  "initialized": true,
-  "sealed": true,
-  "t": 3,
-  "n": 5,
-  "progress": 2,
-  "nonce": "",
-  "version": "1.11.0",
-  "build_date": "2022-05-03T08:34:11Z",
-  "migration": false,
-  "recovery_seal": false,
-  "storage_type": "file"
-}
-```
-
-Sample response when Vault is unsealed.
-
-```json
-{
-  "type": "shamir",
-  "initialized": true,
-  "sealed": false,
-  "t": 3,
-  "n": 5,
-  "progress": 0,
-  "nonce": "",
-  "version": "1.11.0",
-  "build_date": "2022-05-03T08:34:11Z",
-  "migration": false,
-  "cluster_name": "vault-cluster-336172e1",
-  "cluster_id": "f94053ad-d80e-4270-2006-2efd67d0910a",
-  "recovery_seal": false,
-  "storage_type": "file"
-}
-```
diff --git a/website/content/api-docs/system/seal.mdx b/website/content/api-docs/system/seal.mdx
deleted file mode 100644
index 2eef0ea0aa9..00000000000
--- a/website/content/api-docs/system/seal.mdx
+++ /dev/null
@@ -1,30 +0,0 @@
----
-layout: api
-page_title: /sys/seal - HTTP API
-description: The `/sys/seal` endpoint seals the Vault.
----
-
-# `/sys/seal`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/seal` endpoint seals the Vault.
-
-## Seal
-
-This endpoint seals the Vault. In HA mode, only an active node can be sealed.
-Standby nodes should be restarted to get the same effect. Requires a token with
-`root` policy or `sudo` capability on the path.
-
-| Method | Path        |
-| :----- | :---------- |
-| `POST` | `/sys/seal` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/seal
-```
diff --git a/website/content/api-docs/system/sealwrap-rewrap.mdx b/website/content/api-docs/system/sealwrap-rewrap.mdx
deleted file mode 100644
index d08237b987c..00000000000
--- a/website/content/api-docs/system/sealwrap-rewrap.mdx
+++ /dev/null
@@ -1,72 +0,0 @@
----
-layout: api
-page_title: /sys/sealwrap/rewrap - HTTP API
-description: >-
-  The `/sys/sealwrap/rewrap` endpoint is used to rewrap all seal wrapped
-  entries.
----
-
-# `/sys/sealwrap/rewrap`
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/sealwrap/rewrap` endpoint is used to rewrap all seal wrapped entries.
-This is useful when you want to upgrade seal wrapped entries to use the latest
-key, for example, after a seal migration or after rotating the remote keyring.
-
-## Read rewrap status
-
-This endpoint reports whether a seal rewrap process is currently running.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `GET`  | `/sys/sealwrap/rewrap` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/sealwrap/rewrap
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "entries": {
-      "failed": 0,
-      "processed": 30,
-      "succeeded": 30
-    },
-    "is_running": false
-  }
-}
-```
-
-## Start a seal rewrap process
-
-This endpoint starts a seal rewrap process if one is not currently running.
-The process will run in the background. Check the vault server logs for status
-and progress updates.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/sys/sealwrap/rewrap` |
-
-The default status codes are:
-
-- `200` if a seal rewrap process is already running
-- `204` if a seal rewrap process was started
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/sealwrap/rewrap
-```
diff --git a/website/content/api-docs/system/secrets-sync.mdx b/website/content/api-docs/system/secrets-sync.mdx
deleted file mode 100644
index 4827785d87a..00000000000
--- a/website/content/api-docs/system/secrets-sync.mdx
+++ /dev/null
@@ -1,961 +0,0 @@
----
-layout: api
-page_title: /sys/sync - HTTP API
-description: The `/sys/sync` endpoints are used to configure destinations and associate secrets to sync with these destinations.
----
-
-# `/sys/sync`
-
-The `/sys/sync` endpoints are used to configure destinations and associate secrets to sync with these destinations.
-
-Each destination type has its own endpoint for creation & update operations, but share the same endpoints for read &
-delete operations.
-
-## Configuration
-
-The `sys/sync/config` endpoint is used to set configuration parameters for the sync system as a whole.
-
-@include 'alerts/restricted-admin.mdx'
-
-| Method  | Path              |
-|:--------|:------------------|
-| `PATCH` | `sys/sync/config` |
-
-### Parameters
-
-- `disabled` `(bool: false)` - Disables sync operations from sending secrets in Vault to external destinations when
-set to true. While disabled, actions performed in Vault which trigger a sync operation will instead get queued to be
-processed once syncing is reactivated. Queued operations will have a status of `PENDING` until they are completed.
-This is provided as a safety mechanism for emergencies.
-
-- `queue_capacity` `(int: 1,000,000)` - Maximum number of pending sync operations allowed on the internal queue.
-
-### Sample payload
-```json
-{
-    "disabled": "true",
-    "queue_capacity": 1000000
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request PATCH \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/sync/config
-```
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "lease_id": "",
-    "lease_duration": 0,
-    "renewable": false,
-    "data": {
-        "disabled": true,
-        "queue_capacity": 1000000
-    },
-    "warnings": null,
-    "mount_type": "system"
-}
-```
-
-## List destinations
-
-This endpoint lists all configured sync destination names regrouped by destination type.
-
-| Method | Path                     |
-|:-------|:-------------------------|
-| `LIST` | `/sys/sync/destinations` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/sys/sync/destinations
-```
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "lease_id": "",
-    "renewable": false,
-    "lease_duration": 0,
-    "data": {
-        "key_info": {
-            "aws-sm/": [
-                "my-dest-1"
-            ],
-            "gh/": [
-                "my-dest-1"
-            ]
-        },
-        "keys": [
-            "aws-sm/",
-            "gh/"
-        ],
-        "total_destinations": 2
-    },
-    "wrap_info": null,
-    "warnings": null,
-    "auth": null
-}
-```
-
-## List destinations by type
-
-This endpoint lists all configured sync destination names for a given type.
-
-| Method | Path                           |
-|:-------|:-------------------------------|
-| `LIST` | `/sys/sync/destinations/:type` |
-
-### Parameters
-
-- `type` `(string: <required>)` - Specifies the destination type. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/sys/sync/destinations/aws-sm
-```
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "lease_id": "",
-    "renewable": false,
-    "lease_duration": 0,
-    "data": {
-        "keys": [
-            "my-dest-1"
-        ],
-        "total_destinations": 1
-    },
-    "wrap_info": null,
-    "warnings": null,
-    "auth": null
-}
-```
-
-## Read destination
-
-This endpoint retrieves information about the destination of a given type and name. Sensitive information from the
-connection details are obfuscated.
-
-| Method | Path                                 |
-|:-------|:-------------------------------------|
-| `GET`  | `/sys/sync/destinations/:type/:name` |
-
-### Parameters
-
-- `type` `(string: <required>)` - Specifies the destination type. This is specified as part of the URL.
-
-- `name` `(string: <required>)` - Specifies the name for this destination. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/sync/destinations/aws-sm/my-store-1
-```
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "lease_id": "",
-    "renewable": false,
-    "lease_duration": 0,
-    "data": {
-        "connection_details": {
-            "access_key_id": "*****",
-            "secret_access_key": "*****",
-            "region": "us-west-1"
-        },
-        "name": "my-store-1",
-        "options": {
-            "granularity_level": "secret-path",
-            "secret_name_template": "vault/{{ .MountAccessor }}/{{ .SecretPath }}"
-        },
-        "type": "aws-sm"
-    },
-    "wrap_info": null,
-    "warnings": null,
-    "auth": null
-}
-```
-
-## Delete destination
-
-This endpoint deletes information about the destination of a given type and name if it exists. Destinations still managing
-associations cannot be deleted unless they are also purged.
-
-| Method   | Path                                              |
-|:---------|:--------------------------------------------------|
-| `DELETE` | `/sys/sync/destinations/:type/:name?purge=:purge` |
-
-### Parameters
-
-- `type` `(string: <required>)` - Specifies the destination type. This is specified as part of the URL.
-
-- `name` `(string: <required>)` - Specifies the name for this destination. This is specified as part of the URL.
-
-- `purge` `(bool: false)` - If true, asynchronously unsync all secrets and delete all associations managed by this destination
-before it is deleted.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/sync/destinations/aws-sm/my-store-1
-```
-
-## Create/Update AWS Secrets Manager destination
-
-This endpoint creates a destination to synchronize secrets with the AWS Secrets manager.
-
-| Method | Path                                  |
-|:-------|:--------------------------------------|
-| `POST` | `/sys/sync/destinations/aws-sm/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Specifies the name for this destination. This is specified as part of the URL.
-
-- `access_key_id` `(string: "")` - Access key id to authenticate against the AWS secrets manager. If omitted, authentication
-fallbacks on the AWS credentials provider chain and tries to infer authentication from the environment.
-
-- `secret_access_key` `(string: "")` - Secret access key to authenticate against the AWS secrets manager. If omitted,
-authentication fallbacks on the AWS credentials provider chain and tries to infer authentication from the environment.
-
-- `role_arn` `(string: "")` - Specifies a role to assume when connecting to AWS. When assuming a role, Vault uses temporary
-STS credentials to authenticate. An initial session with the proper trust relationship must exist for Vault to be able to
-assume this role. The role can be in a different account.
-
-- `external_id` `(string: "")` - Optional extra protection that must match the trust policy granting access to the AWS IAM
-role ARN. We recommend using a different random UUID per destination.
-
-- `region` `(string: "")` - Region where to manage the secrets manager entries. If omitted, configuration fallbacks on
-the AWS credentials provider chain and tries to infer region from the environment.
-
-- `secret_name_template` `(string: "")` - Template to use when generating the secret names on the external system.
-The default template yields names like `vault/kv_1234/my-secret`. See [this documentation](/vault/docs/sync#name-template) for more details.
-
-- `custom_tags` `(map<string|string>: nil)` - List of custom tags or labels to set on the synced secrets at the destination.
-Custom tags are merged with internal built-in tags.
-
-- `granularity` `(string: "secret-path")` - Determines what level of information is synced as a distinct resource at the
-destination. See [this documentation](/vault/docs/sync#granularity) for more details.
-
-### Sample payload
-```json
-{
-    "access_key_id": "AKI***",
-    "secret_access_key": "ktri****",
-    "region": "us-west-1"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/sync/destinations/aws-sm/my-store-1
-```
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "lease_id": "",
-    "renewable": false,
-    "lease_duration": 0,
-    "data": {
-        "connection_details": {
-            "access_key_id": "*****",
-            "secret_access_key": "*****",
-            "region": "us-west-1"
-        },
-        "name": "my-store-1",
-        "options": {
-            "custom_tags": {},
-            "granularity_level": "secret-path",
-            "secret_name_template": "vault/{{ .MountAccessor }}/{{ .SecretPath }}"
-        },
-        "type": "aws-sm"
-    },
-    "wrap_info": null,
-    "warnings": null,
-    "auth": null
-}
-```
-
-## Create/Update Azure Key Vault destination
-
-This endpoint creates a destination to synchronize secrets with an Azure Key Vault instance.
-
-| Method | Path                                    |
-|:-------|:----------------------------------------|
-| `POST` | `/sys/sync/destinations/azure-kv/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Specifies the name for this destination. This is specified as part of the URL.
-
-- `key_vault_uri` `(string: <required>)` - URI of an existing Azure Key Vault instance.
-
-- `client_id` `(string: <required>)` - Client ID of an Azure app registration.
-
-- `client_secret` `(string: <required>)` - Client secret of an Azure app registration.
-
-- `tenant_id` `(string: <required>)` - ID of the target Azure tenant.
-
-- `cloud` `(string: "cloud")` - Specifies a cloud for the client. The default is Azure Public Cloud.
-
-- `secret_name_template` `(string: "")` - Template to use when generating the secret names on the external system.
-The default template yields names like `vault-kv-1234-my-secret`. See [this documentation](/vault/docs/sync#name-template) for more details.
-
-- `custom_tags` `(map<string|string>: nil)` - List of custom tags or labels to set on the synced secrets at the destination.
-Custom tags are merged with internal built-in tags.
-
-- `granularity` `(string: "secret-path")` - Determines what level of information is synced as a distinct resource at the
-destination. See [this documentation](/vault/docs/sync#granularity) for more details.
-
-
-### Sample payload
-```json
-{
-    "key_vault_uri": "https://keyvault-1234abcd.vault.azure.net",
-    "tenant_id": "uuid",
-    "client_id": "uuid",
-    "client_secret": "90y8Q***"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/sync/destinations/aws-sm/my-store-1
-```
-
-## Create/Update GCP Secret Manager destination
-
-This endpoint creates a destination to synchronize secrets with the GCP Secret Manager.
-
-| Method | Path                                  |
-|:-------|:--------------------------------------|
-| `POST` | `/sys/sync/destinations/gcp-sm/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Specifies the name for this destination. This is specified as part of the URL.
-
-- `credentials` `(string: <required>)` - JSON credentials (either file contents or '@path/to/file')
-See docs for [alternative ways](/vault/docs/secrets/gcp#authentication) to pass in to this parameter
-
-- `project_id` `(string: <optional>)` - The target project to manage secrets in. If set,
-  overrides the project ID derived from the service account JSON credentials or application
-  default credentials. The service account must be [authorized](https://cloud.google.com/iam/docs/service-account-overview#locations)
-  to perform Secret Manager actions in the target project.
-
-- `secret_name_template` `(string: "")` - Template to use when generating the secret names on the external system.
-The default template yields names like `vault/kv_1234/my-secret`. See [this documentation](/vault/docs/sync#name-template) for more details.
-
-- `custom_tags` `(map<string|string>: nil)` - List of custom tags or labels to set on the synced secrets at the destination.
-Custom tags are merged with internal built-in tags.
-
-- `granularity` `(string: "secret-path")` - Determines what level of information is synced as a distinct resource at the
-destination. See [this documentation](/vault/docs/sync#granularity) for more details.
-
-### Sample payload
-```json
-{
-    "credentials": "<JSON string>"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/sync/destinations/gcp-sm/my-store-1
-```
-
-## Create/Update GitHub Repository Action destination
-
-This endpoint creates a destination to synchronize action secrets with a GitHub repository.
-
-| Method | Path                              |
-|:-------|:----------------------------------|
-| `POST` | `/sys/sync/destinations/gh/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Specifies the name for this destination. This is specified as part of the URL.
-
-- `access_token` `(string: <optional>)` - Fine-grained or personal access token.
-  Use `access_token` as an alternative to authenticating with a GitHub app.
-
-- `app_name` `(string: <optional>)` - The name of a GitHub App configured in Vault to use for
-  authentication. Use `app_name` and `installation_id` as an alternative to
-  authenticating with an access token.
-
-  - `installation_id` `(string: <optional>)` - The installation ID of the GitHub
-  app to use for authentication. Required when using `app_name` for
-  authentication.
-
-- `repository_owner` `(string: <required>)` - GitHub organization or username that owns the repository. For example, if a repository is located at https://github.com/hashicorp/vault.git the owner is hashicorp.
-
-- `repository_name` `(string: <required>)` - Name of the repository. For example, if a repository is located at https://github.com/hashicorp/vault.git the name is vault.
-
-- `secret_name_template` `(string: "")` - Template to use when generating the secret names on the external system.
-The default template yields names like `VAULT_KV_1234_MY_SECRET`. See [this documentation](/vault/docs/sync#name-template) for more details.
-
-- `granularity` `(string: "secret-key")` - Determines what level of information is synced as a distinct resource at the
-destination. See [this documentation](/vault/docs/sync#granularity) for more details.
-
-### Sample payload
-```json
-{
-    "access_token": "github_pat_12345",
-    "repository_owner": "my-organization-or-username",
-    "repository_name": "my-repository"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/sync/destinations/gh/my-store-1
-```
-
-## Create/Update Vercel Project destination
-
-This endpoint creates a destination to synchronize secrets with a Vercel Project.
-
-| Method | Path                                          |
-|:-------|:----------------------------------------------|
-| `POST` | `/sys/sync/destinations/vercel-project/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` - Specifies the name for this destination. This is specified as part of the URL.
-
-- `access_token` `(string: <required>)` - Vercel API access token with the permissions to manage environment variables.
-
-- `project_id` `(string: <required>)` - Project ID where to manage environment variables.
-
-- `team_id` `(string: "")` - Team ID the project belongs to. Optional.
-
-- `deployment_environments` `([]string: <required>)` - Deployment environments where the environment variables are available. Accepts 'development', 'preview' and 'production'.
-
-- `secret_name_template` `(string: "")` - Template to use when generating the secret names on the external system.
-The default template yields names like `vault/kv_1234/my-secret`. See [this documentation](/vault/docs/sync#name-template) for more details.
-
-- `granularity` `(string: "secret-key")` - Determines what level of information is synced as a distinct resource at the
-destination. See [this documentation](/vault/docs/sync#granularity) for more details.
-
-### Sample payload
-```json
-{
-    "access_token": "<token>>",
-    "project_id": "prj_12345",
-    "deployment_environments": ["development", "preview", "production"]
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/sync/destinations/vercel-project/my-store-1
-```
-
-## Read associations
-
-This endpoint returns all existing associations for a given destination. An association references the mount via its accessor.
-Associations also contain the latest sync status for the secret they represent.
-
-<Note>
-
-  In the event a synchronization operation does not succeed, the sync status will indicate the cause
-  of the error and is a useful tool when troubleshooting.
-
-</Note>
-
-| Method | Path                                              |
-|:-------|:--------------------------------------------------|
-| `GET`  | `/sys/sync/destinations/:type/:name/associations` |
-
-### Parameters
-
-- `type` `(string: <required>)` - Specifies the destination type. This is specified as part of the URL.
-
-- `name` `(string: <required>)` - Specifies the name for this destination. This is specified as part of the URL.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/sync/destinations/aws-sm/my-store-1/associations
-```
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "lease_id": "",
-    "renewable": false,
-    "lease_duration": 0,
-    "data": {
-        "associated_secrets": {
-            "kv_eb4acbae/my-secret-1": {
-                "accessor": "kv_eb4acbae",
-                "secret_name": "my-secret-1",
-                "sync_status": "SYNCED",
-                "updated_at": "2023-09-20T10:51:53.961861096-04:00"
-            }
-        },
-        "store_name": "my-store-1",
-        "store_type": "aws-sm"
-    },
-    "wrap_info": null,
-    "warnings": null,
-    "auth": null
-}
-```
-
-## Set association
-
-The set endpoint links a secret to an existing destination using the secret name
-and mount path and triggers a sync operation. If the secret is already
-associated with the destination, Vault performs a refresh without recreating the
-link. Triggering a refresh is useful to push the secret to external systems
-or retry a failed sync operation if the underlying problem that caused the
-failure has been resolved.
-
-<Note>
-
-  Only KV-v2 secrets are supported at the moment.
-
-</Note>
-
-| Method | Path                                                  |
-|:-------|:------------------------------------------------------|
-| `POST` | `/sys/sync/destinations/:type/:name/associations/set` |
-
-### Parameters
-
-- `type` `(string: <required>)` - Specifies the destination type. This is specified as part of the URL.
-
-- `name` `(string: <required>)` - Specifies the name for this destination. This is specified as part of the URL.
-
-- `mount` `(string: <required>)` - Specifies the mount where the secret is located. For example, if you can read a secret
-with `vault kv get -mount=my-kv my-secret-1`, the mount name is `my-kv`.
-
-- `secret_name` `(string: <required>)` - Specifies the name of the secret to synchronize. For example, if you can read a secret
-with `vault kv get -mount=my-kv my-secret-1`, the secret name is `my-secret-1`.
-
-### Sample payload
-```json
-{
-    "mount": "my-kv",
-    "secret_name": "my-secret-1"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/sync/destinations/aws-sm/my-store-1/associations/set
-```
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "lease_id": "",
-    "renewable": false,
-    "lease_duration": 0,
-    "data": {
-        "associated_secrets": {
-            "kv_eb4acbae/my-secret-1": {
-                "accessor": "kv_eb4acbae",
-                "secret_name": "my-secret-1",
-                "sync_status": "SYNCED",
-                "updated_at": "2023-09-20T10:51:53.961861096-04:00"
-            }
-        },
-        "store_name": "my-store-1",
-        "store_type": "aws-sm"
-    },
-    "wrap_info": null,
-    "warnings": null,
-    "auth": null
-}
-```
-
-## Remove association
-
-The remove endpoint unlinks a secret from an existing destination based on the
-secret name and mount path, and triggers an unsync operation. Unsync
-operations delete the secret from the external system. The unsync operation
-reports success if the targeted association is removed, does not exist, or the
-secret was already removed from the external system.
-
-| Method | Path                                                     |
-|:-------|:---------------------------------------------------------|
-| `POST` | `/sys/sync/destinations/:type/:name/associations/remove` |
-
-### Parameters
-
-- `type` `(string: <required>)` - Specifies the destination type. This is specified as part of the URL.
-
-- `name` `(string: <required>)` - Specifies the name for this destination. This is specified as part of the URL.
-
-- `mount` `(string: <required>)` - Specifies the mount where the secret is located. For example, if you can read a secret
-with `vault kv get -mount=my-kv my-secret-1`, the mount name is `my-kv`.
-
-- `name` `(string: <required>)` - Specifies the name of the secret to synchronize. For example, if you can read a secret
-with `vault kv get -mount=my-kv my-secret-1`, the secret name is `my-secret-1`.
-
-### Sample payload
-```json
-{
-    "mount": "my-kv",
-    "secret_name": "my-secret-1"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/sync/destinations/aws-sm/my-store-1/associations/remove
-```
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "lease_id": "",
-    "renewable": false,
-    "lease_duration": 0,
-    "data": {
-        "associated_secrets": {
-            "kv_eb4acbae/my-secret-1": {
-                "accessor": "kv_eb4acbae",
-                "secret_name": "my-secret-1",
-                "sync_status": "UNSYNCED",
-                "updated_at": "2023-09-20T10:51:53.961861096-04:00"
-            }
-        },
-        "store_name": "my-store-1",
-        "store_type": "aws-sm"
-    },
-    "wrap_info": null,
-    "warnings": null,
-    "auth": null
-}
-```
-
-## List associations
-
-This endpoint lists all secrets referenced by at least one association. Each secret can be associated with multiple
-destinations, so the total number of associations can be greater than the total number of synced secrets.
-
-| Method | Path                     |
-|:-------|:-------------------------|
-| `LIST` | `/sys/sync/associations` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/sys/sync/associations
-```
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "lease_id": "",
-    "renewable": false,
-    "lease_duration": 0,
-    "data": {
-        "key_info": {
-            "my-kv-1/my-secret-1": [
-                {
-                    "mount": "my-kv-1/",
-                    "secret_path": "my-secret-1"
-                }
-            ],
-            "my/kv/1/my/secret/1": [
-                {
-                    "mount": "my/kv/1/",
-                    "secret_path": "my/secret/1"
-                }
-            ]
-        },
-        "keys": [
-            "my/kv/1/my/secret/1",
-            "my-kv-1/my-secret-1"
-        ],
-        "total_associations": 4,
-        "total_secrets": 2
-    },
-    "wrap_info": null,
-    "warnings": null,
-    "auth": null
-}
-```
-
-## Read destinations by secret
-
-This endpoint returns all destinations associated with the provided secret reference.
-
-<Note>
-
-  The request is available either with path parameters or request parameters to support
-  mounts or secrets with forward slash characters (`/`).
-
-</Note>
-
-| Method | Path                                  |
-|:-------|:--------------------------------------|
-| `GET`  | `/sys/sync/associations/:mount/:name` |
-
-| Method | Path                                                                 |
-|:-------|:---------------------------------------------------------------------|
-| `GET`  | `/sys/sync/associations/destinations?mount=:mount&secret_name=:name` |
-
-### Parameters
-
-- `mount` `(string: <required>)` - Specifies the mount where the secret is located. For example, if you can read a secret
-with `vault kv get -mount=my-kv my-secret-1`, the mount name is `my-kv`.
-
-- `name` `(string: <required>)` - Specifies the name of the synchronized secret. For example, if you can read a secret
-with `vault kv get -mount=my-kv my-secret-1`, the secret name is `my-secret-1`.
-
-### Sample requests
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/sync/associations/my-kv-1/my-secret-1
-```
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/sync/associations/destinations?mount=my-kv-1&secret_name=my-secret-1
-```
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "lease_id": "",
-    "renewable": false,
-    "lease_duration": 0,
-    "data": {
-        "associated_destinations": {
-            "aws-sm/my-dest-1": {
-                "type": "aws-sm",
-                "name": "my-dest-1",
-                "sync_status": "UNSYNCED",
-                "updated_at": "2023-11-02T14:24:24.07391144-04:00"
-            },
-            "gh/my-dest-1": {
-                "type": "gh",
-                "name": "my-dest-1",
-                "sync_status": "SYNCED",
-                "updated_at": "2023-11-02T14:24:28.719833506-04:00"
-            }
-        }
-    },
-    "wrap_info": null,
-    "warnings": null,
-    "auth": null
-}
-```
-
-## Configure a custom GitHub app
-
-Use the `POST` operation with `sys/sync/github-apps` endpoint to configure a
-custom GitHub application for syncing secrets with GitHub repositories.
-
-
-| Method | Path                         |
-|:-------|:-----------------------------|
-| `POST` | `sys/sync/github-apps/:name` |
-
-
-### Parameters
-
-- `name` `(string: <required>)` - Specifies a custom name for the GitHub
-application that is used when configuring the destination. Although this can be any name, we recommend using the same app name configured in GitHub.
-
-- `app_id` `(string: <required>)` - Specifies the GitHub application ID, provided by GitHub.
-
-- `private_key` `(string: <required>)` - Specifies the private key used to authenticate with the GitHub application.
-
-### Sample payload
-```json
-{
-    "app_id": "true",
-    "private_key":  "<PRIVATE KEY PEM>"
-}
-```
-
-### Sample requests
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json
-    http://127.0.0.1:8200/v1/sys/sync/github-apps/my-custom-app
-```
-
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "data": {
-        "app_id": 123456,
-        "fingerprint": "<fingerprint>",
-        "name": "my-custom-app",
-        "private_key": "*****"
-    },
-    "mount_type": "system"
-}
-```
-
-## Read custom GitHub app
-
-Use the `GET` operation with `sys/sync/github-apps` to view details about the
-configured GitHub application.
-
-
-| Method | Path                         |
-|:-------|:-----------------------------|
-| `GET`  | `sys/sync/github-apps/:name` |
-
-
-### Parameters
-
-- `name` `(string: <required>)` - Specifies a custom name for the GitHub application.
-
-
-### Sample requests
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/sync/github-apps/my-custom-app
-```
-
-
-### Sample response
-
-```json
-{
-    "request_id": "uuid",
-    "data": {
-        "app_id": 123456,
-        "fingerprint": "<fingerprint>",
-        "name": "my-custom-app",
-        "private_key": "*****"
-    },
-    "mount_type": "system"
-}
-```
-
-## Delete custom GitHub app
-
-Use the `DELETE` operation with `sys/sync/github-apps` to delete a configured
-GitHub application.
-
-You cannot delete applications with active authentication destination
-references. Deleting an application configuration **does not** delete the GitHub
-application from GitHub.
-
-
-| Method   | Path                         |
-|:---------|:-----------------------------|
-| `DELETE` | `sys/sync/github-apps/:name` |
-
-
-### Parameters
-
-- `name` `(string: <required>)` - Specifies a custom name for the GitHub application.
-
-
-### Sample requests
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/sync/github-apps/my-custom-app
-```
diff --git a/website/content/api-docs/system/step-down.mdx b/website/content/api-docs/system/step-down.mdx
deleted file mode 100644
index 697cd874d1f..00000000000
--- a/website/content/api-docs/system/step-down.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
----
-layout: api
-page_title: /sys/step-down - HTTP API
-description: The `/sys/step-down` endpoint causes the node to give up active status.
----
-
-# `/sys/step-down`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/step-down` endpoint causes the node to give up active status.
-
-## Step down leader
-
-The step-down endpoint forces nodes to give up "active" status. If you
-call the endpoint against a non-active node, for example, a DR or
- performance standby node, Vault forwards the request to the active
-  node.
-  
-    Note that the node will sleep
-for ten seconds before attempting to grab the active lock again, but if no
-standby nodes grab the active lock in the interim, the same node may become the
-active node again. Requires a token with `root` policy or `sudo` capability on
-the path.
-
-| Method | Path             |
-| :----- | :--------------- |
-| `POST` | `/sys/step-down` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/step-down
-```
diff --git a/website/content/api-docs/system/storage/index.mdx b/website/content/api-docs/system/storage/index.mdx
deleted file mode 100644
index 7dd3b67e447..00000000000
--- a/website/content/api-docs/system/storage/index.mdx
+++ /dev/null
@@ -1,15 +0,0 @@
----
-layout: api
-page_title: /sys/storage - HTTP API
-description: |-
-
-  The '/sys/storage' endpoints are used to manage Vault's storage backends.
----
-
-# `/sys/storage`
-
-@include 'alerts/restricted-root.mdx'
-
-This API sub-section is currently only used to manage [Raft](/vault/api-docs/system/storage/raft) storage backend.
-
-On Enterprise there are additional endpoints for working with [Raft Automated Snapshots](/vault/api-docs/system/storage/raftautosnapshots).
diff --git a/website/content/api-docs/system/storage/raft.mdx b/website/content/api-docs/system/storage/raft.mdx
deleted file mode 100644
index bc18fc0d9ed..00000000000
--- a/website/content/api-docs/system/storage/raft.mdx
+++ /dev/null
@@ -1,251 +0,0 @@
----
-layout: api
-page_title: /sys/storage/raft - HTTP API
-description: |-
-
-  The `/sys/storage/raft` endpoints are used to manage Vault's Raft storage
-  backend.
----
-
-# `/sys/storage/raft`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/storage/raft` endpoints are used to manage Vault's Raft storage
-backend.
-
-## Join a raft cluster
-
-This endpoint joins a new server node to the Raft cluster. When using Shamir
-seal, as soon as the Vault server is brought up, this API should be invoked
-instead of `sys/init`. This API completes in 2 phases. Once this is invoked,
-the joining node will receive a challenge from the Raft's leader node. This
-challenge can be answered by the joining node only after a successful unseal.
-Hence, the joining node should be unsealed using the unseal keys of the Raft's
-leader node.
-
-| Method | Path                     |
-| :----- | :----------------------- |
-| `POST` | `/sys/storage/raft/join` |
-
-### Parameters
-
-- `leader_api_addr` `(string: <required>)` – Address of the leader node in the
-  Raft cluster to which this node is trying to join.
-
-- `retry` `(bool: false)` - Retry joining the Raft cluster in case of
-  failures.
-
-- `leader_ca_cert` `(string: "")` - CA certificate used to communicate with
-  Raft's leader node.
-
-- `leader_client_cert` `(string: "")` - Client certificate used to communicate
-  with Raft's leader node.
-
-- `leader_client_key` `(string: "")` - Client key used to communicate with
-  Raft's leader node.
-
-- `leader_tls_servername` `(string: "")` - TLS servername to use when connecting with HTTPS.
-  Should match one of the names in the DNS SANs of the remote server certificate.
-
-- `auto_join` `(string: "")` - Defines any cloud auto-join metadata. If
-  supplied, Vault will attempt to automatically discover peers in addition to what
-  can be provided via 'leader_api_addr'.
-
-- `auto_join_scheme` `(string: "https")` - URI scheme to be used for `auto_join`.
-
-- `auto_join_port` `(int: 8200)` - Port to be used for `auto_join`.
-
-- `non_voter` `(bool: false) (enterprise)` - If set, will make the server not
-  participate in the Raft quorum, and have it only receive the data replication
-  stream. This can be used to add read scalability to a cluster in cases where a
-  high volume of reads to servers are needed. The default is false.
-
-Additionally, the following options are allowed in Vault open-source, but
-relevant functionality is only supported in Vault Enterprise:
-
-- `non_voter` `(bool: false)` - Joins the node to the cluster in non-voter mode
-  which results in Vault's data being replicated to it, but does not contribute
-  to the quorum count.
-
-### Sample payload
-
-```json
-{
-  "leader_api_addr": "https://127.0.0.1:8200",
-  "leader_ca_cert": "-----BEGIN CERTIFICATE-----\nMIIDKTCCAhGgAwIBAgIUcd+Uyk1Tz+FhcbYP0zmynlkARoEwDQYJKoZIhvcNAQEL\nBQAwFDESMBAGA1UEAxMJbG9jYWxob3N0MB4XDTE5MDYyNDIyMjgzNVoXDTE5MDYy\nNzIyMjkwNVowADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKdYr6rU\n21vYf7q/cpPigtBchqHvGZvpbA9DZucuUdQ0g4oAXRyShQ8omzmZOmO4A1GI3gqz\nHBePSYl+1IZCwgbPBk2CH7MhlMMINdwoEH6IxFgHNBkNK6GbwnGLyKL0Sym88ly1\n+sPP6+llS8uWNKu5GcObHLysD3Ce6QTt3usDPiw0cxp/KL1EkMi2dT7PvxTsX137\nsEsuQcylltGEtRb67xvFBP8XhQZAEGw+u4S3EmtwWMwZixB45WQhj2Ncz5U0+w8V\ncp9DSqB1QheoGPBBI62jHle05kzG85ZKmLBgHE6HEGS8biIHpannM7dgI0cRH6i2\nF69N0rcbzK+NInUCAwEAAaOBhjCBgzAOBgNVHQ8BAf8EBAMCA6gwHQYDVR0lBBYw\nFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQWBBQelJT5fthHdbCyD5zaI4tw\n7mfp8zAfBgNVHSMEGDAWgBSuG6hyoOWoiGvSA3kqwo9DirS+pzASBgNVHREBAf8E\nCDAGhwR/AAABMA0GCSqGSIb3DQEBCwUAA4IBAQCmetSH5w835RbbyHZD8e3ClHzi\n210SrvzWkx3N0JcBOjs47jlLuqVTl0HRr2xMoIkErFbhPDBXARYV8eezhQ6G5M60\n8AwVsG56rCa1l0weK2JfnEWgkwXZ/zbpZ2yNkWatWNSHdlJwGp99JTSriQYNOnMG\nWvBDA8ukoOkIJd/a8+aXZBdUiAcFvlLWmX73pYGTlnQDiIqJvhrlkgCKPvzZqvV+\njtz7kCt9EfT6sN6Xcny7GusRBSs+XfEe8u10+mbud+ufE/QSJ2D3tTYrS6eGqpVD\nrezD8jS9PfZgQfHXVaphMADyw4flaSVxfJ/ZRFxXql3oJSuj02+VX6QsXex+\n-----END CERTIFICATE-----",
-  "leader_client_cert": "-----BEGIN CERTIFICATE-----\nMIIDNTCCAh2gAwIBAgIULkPFG+qu7tGv21Plc1sg4eGbMPkwDQYJKoZIhvcNAQEL\nBQAwFDESMBAGA1UEAxMJbG9jYWxob3N0MB4XDTE5MDYyNDIyMjgwNVoXDTI5MDYy\nMTIyMjgzNVowFDESMBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEAwszD+A5vWD8S1N632ElHA5Px2dk97wJBKNYc/7RPNptn\n+EOmMTXPfuA3LB92FoSMCR7ye3wvSTzyK9nqafS7U2tlOF4PJrJoNZyzrVwBVLXg\n7Pd8qQxnxbonc3bscWZuEfbFsugkPHgBtnSkyCffXKhhwM5LbJqmK5cfJRZZ0eRy\nwmOCQCJ8ZmN2KfjHiGSEw9v19CNtvFNLyfiTZZLO9M5n4dgainZZCs+vdKD7tSJf\nycwWiZ4ezOwLMIgxdbLYKVglbZsPcMVVPLTskmY8WiHUM6sy3HAbFQn20Rj7JGE6\nldR3NX80YtCMt8/d+xzBfxu4x8juxHCgZFGt3nUS0wIDAQABo38wfTAOBgNVHQ8B\nAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUrhuocqDlqIhr0gN5\nKsKPQ4q0vqcwHwYDVR0jBBgwFoAUrhuocqDlqIhr0gN5KsKPQ4q0vqcwGgYDVR0R\nBBMwEYIJbG9jYWxob3N0hwR/AAABMA0GCSqGSIb3DQEBCwUAA4IBAQBRno9NOaat\n8g1ma/6OxP1JUt1VRao4+t2GQTCJ697d2SmpHr8CYanMPog+QhDj/lderA/oS0V3\n2jruH9CyH0smFMIsLBZpnRIwdhTISbIXdU3Uvcd6nne/f7LiUUmqf8YS9SHxWPFq\nI72QvtPrsjYKCZwJsHZe071lYScjrjGnlUhhbrug2g6/ZMHJ7mndGE022zMn/XD/\njrrKE6fCDCjJ4PRrta7+G7BvsFHqMSQ+2/947TGohxW69cbNyDeiQVDQ5mpJUy2b\nnOCVVnq0nafSuvBTHCCLxjd7f+9TiB/B3qT8GA9V6LANDSdQ15MRIhpup/yosmqX\nl5goCY/j3bDh\n-----END CERTIFICATE-----",
-  "leader_client_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEAp1ivqtTbW9h/ur9yk+KC0FyGoe8Zm+lsD0Nm5y5R1DSDigBd\nHJKFDyibOZk6Y7gDUYjeCrMcF49JiX7UhkLCBs8GTYIfsyGUwwg13CgQfojEWAc0\nGQ0roZvCcYvIovRLKbzyXLX6w8/r6WVLy5Y0q7kZw5scvKwPcJ7pBO3e6wM+LDRz\nGn8ovUSQyLZ1Ps+/FOxfXfuwSy5BzKWW0YS1FvrvG8UE/xeFBkAQbD67hLcSa3BY\nzBmLEHjlZCGPY1zPlTT7DxVyn0NKoHVCF6gY8EEjraMeV7TmTMbzlkqYsGAcTocQ\nZLxuIgelqeczt2AjRxEfqLYXr03StxvMr40idQIDAQABAoIBAHCOhhkw8hnklITX\nIAm34KSklylz2JW1eqkJfL0huogwigjYFciSBE0d0sn69fr8Wb8Nf8tSjSKLjbqd\nQ/TKEhbiSCr5yriBbb2AWDmr+OwisW1D6xaudRpN2Yrlqh1wkt2P6LPS8sehodtp\n9oEIloSqC1o1ii6czAXD3JckJzuJ66yoVyCo2oVC3NETujjJRhdRcNY0dYUGx47M\n+hQo7b4s79wlMFmccrgyJcKI7Ra3DtMrBIaVXm4WcjX2x4DduZX6L4mfG83uLWng\nhbvcEPKGamUErjPGYixKE5XOwgJT6Nzq/ZZJZpok6DbHBCtqvwwByWlfLzh8lc4o\nz+Pl5EECgYEA3pJXRM+SdVUCnWIpMFOAiNstOwz3nm0/c8GDdYYNq0ere1tKCVV0\nii+ujMQY8vEdRrp7fbqJEPJANyI6sM4Jc2nxMveFuBoEsEClZuE4KBFquW8CQU4R\nGNkzKF1W0GaTI5O4QDUag+lFG6TPCwZiejTIkt65o5bnSzGLgdC546sCgYEAwHr9\nlq9HytWkV9OLz0zbcAUEIrFAljnC32Mybsj8LzdSKIZ3wErf9Txh8zqZqMyhedxL\nOn17cpJAq5Vi71uXOaxnhkf7TPuRs8nBRRJfgyNHPXuXLkuWeuvXEe/PIC+nvOIX\nas0Ab0Pvx0fRGl4EkZ2pV9oDAEUezbVVZCoO8l8CgYEAp4p3YNfzwpj0d+5tXPBu\ngBakzJ+tQjewnP1dbLk1TuqLXjdQ2wfVyzOrbFEtCquPwy8bSICDLxt8VURR88eU\n+6kTJK+InBYR029GUtRUhmzd7qpugyQ14IOXa9ofQI8GUbCf8M1IoWWWXQHJzN3I\ngX98QHqiOU+d2k94WYb6dzMCgYA3E7p2oMdZShLRss3hzqtH/Zd2WeQSWIrjox3u\nR4Kp/Bl9UST5GDPHl7SrhcwsWgmmthusq/VkDmeE8aUyurGmJigla3mESMQjfwrX\nue8sti6PcEsNS0HPAKc1EbriCeDkkomC3RBPxk/ZZTp3YgnKpSOs6MxNCnpLAKVj\nmQlX3wKBgQCFYyYJdCKMoaoMrNjMM34sAfTqmZT4Hbxg9KM4OMDSxyvIi0ZaVcnB\nkzssvt0FOMucp4o7h8Iujt8xsgnBHwg81IV7WOw+ZwpUDAzgVc7+kCU6CLd2Q40j\n5uFnuRgiWeGm1aT4arNLWlJrDLSGbyrf59SlGJV1hmu/7SMaYIZHSQ==\n-----END RSA PRIVATE KEY-----"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/storage/raft/join
-```
-
-**Note:** Unseal the joining node immediately after this API is invoked.
-
-## Read raft configuration
-
-This endpoint returns the details of all the nodes in the raft cluster.
-
-| Method | Path                              |
-| :----- | :-------------------------------- |
-| `GET`  | `/sys/storage/raft/configuration` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/storage/raft/configuration
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "ca4b5a1d-38d6-e27e-e756-269521328a15",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "config": {
-      "index": 24,
-      "servers": [
-        {
-          "address": "127.0.0.1:8201",
-          "leader": true,
-          "node_id": "raft1",
-          "protocol_version": "\u0003",
-          "voter": true
-        },
-        {
-          "address": "127.0.0.2:8201",
-          "leader": false,
-          "node_id": "raft2",
-          "protocol_version": "\u0003",
-          "voter": true
-        }
-      ]
-    }
-  },
-  "warnings": null
-}
-```
-
-## Remove a node from raft cluster
-
-This endpoint removes a node from the raft cluster. An optional `dr_operation_token`
-may be provided if the node is in a DR secondary cluster.
-
-| Method | Path                            |
-| :----- | :------------------------------ |
-| `POST` | `/sys/storage/raft/remove-peer` |
-
-### Sample payload
-
-```json
-{
-  "server_id": "raft1",
-  "dr_operation_token": ""
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/storage/raft/remove-peer
-```
-
-## Take a snapshot of the raft cluster
-
-This endpoint returns a snapshot of the current state of the raft cluster. The
-snapshot is returned as binary data and should be redirected to a file.
-Unavailable if Raft is used exclusively for `ha_storage`.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `GET`  | `/sys/storage/raft/snapshot` |
-
-@include 'raft-large-snapshots.mdx'
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/storage/raft/snapshot > raft.snap
-```
-
-## Restore raft using a snapshot
-
-Installs the provided snapshot, returning the cluster to the state defined in
-it. Unavailable if Raft is used exclusively for `ha_storage`.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/sys/storage/raft/snapshot` |
-
-@include 'raft-large-snapshots.mdx'
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data-binary @raft.snap \
-    http://127.0.0.1:8200/v1/sys/storage/raft/snapshot
-```
-
-## Force restore raft using a snapshot
-
-Installs the provided snapshot, returning the cluster to the state defined in
-it. This is same as writing to `/sys/storage/raft/snapshot` except that this
-bypasses checks ensuring the Autounseal or shamir keys are consistent with the
-snapshot data. Unavailable if Raft is used exclusively for `ha_storage`.
-
-| Method | Path                               |
-| :----- | :--------------------------------- |
-| `POST` | `/sys/storage/raft/snapshot-force` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data-binary @raft.snap \
-    http://127.0.0.1:8200/v1/sys/storage/raft/snapshot-force
-```
-
-## Bootstrap an HA node
-
-When a node uses Raft exclusively for `ha_storage`, this endpoint is used to activate
-Raft.  It is analogous to using `sys/init` to initialize storage, in that it
-only needs to be done once per cluster, after which `vault operator raft join`
-is used to add more nodes to the Raft cluster.
-
-| Method | Path                         |
-| :----- | :--------------------------- |
-| `POST` | `/sys/storage/raft/bootstrap` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/storage/raft/bootstrap
-```
diff --git a/website/content/api-docs/system/storage/raftautopilot.mdx b/website/content/api-docs/system/storage/raftautopilot.mdx
deleted file mode 100644
index 633aba4a8c8..00000000000
--- a/website/content/api-docs/system/storage/raftautopilot.mdx
+++ /dev/null
@@ -1,255 +0,0 @@
----
-layout: api
-page_title: /sys/storage/raft/autopilot - HTTP API
-description: |-
-
-  The `/sys/storage/raft/autopilot` endpoints are used to manage raft clusters using autopilot with Vault's Integrated Storage backend.
-
----
-
-# `/sys/storage/raft/autopilot`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/storage/raft/autopilot` endpoints are used to manage raft clusters using autopilot
-with Vault's [Integrated Storage backend](/vault/docs/internals/integrated-storage).
-Refer to the [Integrated Storage Autopilot](/vault/tutorials/raft/raft-autopilot) tutorial to learn how to manage raft clusters using autopilot.
-
-## Get cluster state
-
-This endpoint is used to retrieve the raft cluster state. See the [docs page](/vault/docs/commands/operator/raft#autopilot-state) for a description of the output.
-
-| Method | Path                                |
-| :----- | :---------------------------------- |
-| `GET`  | `/sys/storage/raft/autopilot/state` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/storage/raft/autopilot/state
-```
-
-### Sample response
-
-```json
-{
-  "healthy": true,
-  "failure_tolerance": 1,
-  "servers": {
-    "raft1": {
-      "id": "raft1",
-      "name": "raft1",
-      "address": "127.0.0.1:8201",
-      "node_status": "alive",
-      "last_contact": "0s",
-      "last_term": 3,
-      "last_index": 459,
-      "healthy": true,
-      "stable_since": "2021-03-19T20:14:11.831678-04:00",
-      "status": "leader",
-      "meta": null
-    },
-    "raft2": {
-      "id": "raft2",
-      "name": "raft2",
-      "address": "127.0.0.2:8201",
-      "node_status": "alive",
-      "last_contact": "516.49595ms",
-      "last_term": 3,
-      "last_index": 459,
-      "healthy": true,
-      "stable_since": "2021-03-19T20:14:19.831931-04:00",
-      "status": "voter",
-      "meta": null
-    },
-    "raft3": {
-      "id": "raft3",
-      "name": "raft3",
-      "address": "127.0.0.3:8201",
-      "node_status": "alive",
-      "last_contact": "196.706591ms",
-      "last_term": 3,
-      "last_index": 459,
-      "healthy": true,
-      "stable_since": "2021-03-19T20:14:25.83565-04:00",
-      "status": "voter",
-      "meta": null
-    }
-  },
-  "leader": "raft1",
-  "voters": ["raft1", "raft2", "raft3"],
-  "non_voters": null
-}
-```
-
-### Enterprise only
-Vault Enterprise will include additional output in its API response to indicate the current state of redundancy zones,
-automated upgrade progress (if any), and optimistic failure tolerance.
-
-#### Sample response (Enterprise)
-```json
-{
-  "failure_tolerance": 0,
-  "healthy": true,
-  "leader": "vault_1",
-  "optimistic_failure_tolerance": 3,
-  "redundancy_zones": {
-    "a": {
-      "servers": [
-        "vault_1",
-        "vault_2",
-        "vault_5"
-      ],
-      "voters": [
-        "vault_1"
-      ],
-      "failure_tolerance": 2
-    },
-    "b": {
-      "servers": [
-        "vault_3",
-        "vault_4"
-      ],
-      "voters": [
-        "vault_3"
-      ],
-      "failure_tolerance": 1
-    }
-  },
-  "upgrade_info": {
-    "other_version_non_voters": [
-      "vault_2",
-      "vault_4"
-    ],
-    "other_version_voters": [
-      "vault_1",
-      "vault_3"
-    ],
-    "redundancy_zones": {
-      "a": {
-        "target_version_non_voters": [
-          "vault_5"
-        ],
-        "other_version_voters": [
-          "vault_1"
-        ],
-        "other_version_non_voters": [
-          "vault_2"
-        ]
-      },
-      "b": {
-        "other_version_voters": [
-          "vault_3"
-        ],
-        "other_version_non_voters": [
-          "vault_4"
-        ]
-      }
-    },
-    "status": "await-new-voters",
-    "target_version": "1.12.0",
-    "target_version_non_voters": [
-      "vault_5"
-    ]
-  },
-  "voters": [
-    "vault_1",
-    "vault_3"
-  ]
-}
-```
-
-## Get configuration
-
-This endpoint is used to get the configuration of the autopilot subsystem of Integrated Storage.
-
-| Method | Path                                        |
-| :----- | :------------------------------------------ |
-| `GET`  | `/sys/storage/raft/autopilot/configuration` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/storage/raft/autopilot/configuration
-```
-
-### Sample response
-
-```json
-{
-  "cleanup_dead_servers": false,
-  "dead_server_last_contact_threshold": "24h0m0s",
-  "last_contact_threshold": "10s",
-  "max_trailing_logs": 1000,
-  "min_quorum": 0,
-  "server_stabilization_time": "10s",
-  "disable_upgrade_migration": true
-}
-```
-
-Note that in the above sample response, `disable_upgrade_migration` is an Enterprise-only field.
-
-## Set configuration
-
-This endpoint is used to modify the configuration of the autopilot subsystem of Integrated Storage.
-
-| Method | Path                                        |
-| :----- | :------------------------------------------ |
-| `POST` | `/sys/storage/raft/autopilot/configuration` |
-
-### Parameters
-
-- `cleanup_dead_servers` `(bool: false)` - Controls whether to remove dead servers from
-  the Raft peer list periodically or when a new server joins. This requires that
-  `min_quorum` is also set.
-
-- `last_contact_threshold` `(string: "10s")` - Limit on the amount of time a server can
-  go without leader contact before being considered unhealthy.
-
-- `dead_server_last_contact_threshold` `(string: "24h")` - Limit on the amount of time
-  a server can go without leader contact before being considered failed. This
-  takes effect only when `cleanup_dead_servers` is `true`. This can not be set to a value
-  smaller than 1m.
-
-- `max_trailing_logs` `(int: 1000)` - Amount of entries in the Raft Log that a server
-  can be behind before being considered unhealthy.
-
-- `min_quorum` `(int: 3)` - Minimum number of servers allowed in a cluster before
-  autopilot can prune dead servers. This should at least be 3. Applicable only for
-  voting nodes.
-
-- `server_stabilization_time` `(string: "10s")` - Minimum amount of time a server must
-  be in a stable, healthy state before it can be added to the cluster.
-
-- `disable_upgrade_migration` `(bool: false)` - Disables automatically upgrading Vault using
-  autopilot. (Enterprise-only)
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/storage/raft/autopilot/configuration
-```
-
-### Sample payload
-
-```json
-{
-  "cleanup_dead_servers": true,
-  "last_contact_threshold": "10s",
-  "dead_server_last_contact_threshold": "24h",
-  "max_trailing_logs": "1000",
-  "min_quorum": "3",
-  "server_stabilization_time": "10s",
-  "disable_upgrade_migration": true
-}
-```
-
-Note that in the above sample payload, `disable_upgrade_migration` is an Enterprise-only field.
diff --git a/website/content/api-docs/system/storage/raftautosnapshots.mdx b/website/content/api-docs/system/storage/raftautosnapshots.mdx
deleted file mode 100644
index 9973d0eb7a2..00000000000
--- a/website/content/api-docs/system/storage/raftautosnapshots.mdx
+++ /dev/null
@@ -1,272 +0,0 @@
----
-layout: api
-page_title: /sys/storage/raft/snapshot-auto - HTTP API
-description: |-
-
-  The `/sys/storage/raft/snapshot-auto` endpoints are used to manage automated
-  snapshots with Vault's Raft storage backend.
----
-
-# `/sys/storage/raft/snapshot-auto`
-
-@include 'alerts/enterprise-only.mdx'
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/storage/raft/snapshot-auto` endpoints are used to manage automated
-snapshots with Vault's Raft storage backend.
-
-## Create/update an automated snapshots config
-
-**This endpoint requires sudo capability.**
-
-This endpoint creates or updates a named configuration. Each configuration
-has an interval controlling how often snapshots are taken, a destination
-where the snapshots are written, as well as a retention policy governing when
-older snapshots get deleted.
-
-Note that for cloud storage types, you can either provide credentials explicitly
-using the parameters below, or for GCP and AWS you can omit them and rely on the
-other mechanisms the cloud provider's SDK allows for authenticating, e.g.
-environment variables or files on disk in predefined locations.
-
-| Method | Path                                           |
-| :----- | :--------------------------------------------- |
-| `POST` | `/sys/storage/raft/snapshot-auto/config/:name` |
-
-### Parameters
-
-- `name` `(string: <required>)` – Name of the configuration to modify.
-
-- `interval` `(integer or string: <required>)` - Time between snapshots. This
-  can be either an integer number of seconds, or a Go duration format string (e.g. 24h)
-
-- `retain` `(integer: 1)` - How many snapshots are to be kept; when writing a
-  snapshot, if there are more snapshots already stored than this number, the
-  oldest ones will be deleted.
-
-- `path_prefix` `(string: <required>)` - For `storage_type=local`, the directory to
-  write the snapshots in. For cloud storage types, the bucket prefix to use.
-  Types `azure-blob` and `google-gcs` require a trailing `/` (slash).
-  Types `local` and `aws-s3` the trailing `/` is optional.
-
-- `file_prefix` `(string: "vault-snapshot")` - Within the directory or bucket
-  prefix given by `path_prefix`, the file or object name of snapshot files
-  will start with this string.
-
-- `storage_type` `(string: <required>)` - One of "local", "azure-blob", "aws-s3",
-  or "google-gcs". The remaining parameters described below are all specific to
-  the selected `storage_type` and prefixed accordingly.
-
-#### storage_type=local
-
-- `local_max_space` `(integer: <required>)` - For `storage_type=local`, the maximum
-  space, in bytes, to use for all snapshots with the given `file_prefix` in the `path_prefix` directory. 
-  Snapshot attempts will fail if there is not enough
-  space left in this allowance.
-
-#### storage_type=aws-s3
-
-- `aws_s3_bucket` `(string: <required>)` - S3 bucket to write snapshots to.
-
-- `aws_s3_region` `(string: <required>)` - AWS region bucket is in.
-
-- `aws_access_key_id` `(string)` - AWS access key ID.
-
-- `aws_secret_access_key` `(string)` - AWS secret access key.
-
-- `aws_session_token` `(string)` - AWS session token.
-
-- `aws_s3_endpoint` `(string)` - AWS endpoint. This is typically only set when
-  using a non-AWS S3 implementation like Minio.
-
-- `aws_s3_disable_tls` `(boolean)` - Disable TLS for the S3 endpoint. This
-  should only be used for testing purposes, typically in conjunction with
-  `aws_s3_endpoint`.
-
-- `aws_s3_force_path_style` `(boolean)` - Use the endpoint/bucket URL style
-  instead of bucket.endpoint. May be needed when setting `aws_s3_endpoint`.
-
-- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents.
-
-- `aws_s3_server_side_encryption` `(boolean)` - Use AES256 to encrypt bucket contents. Cannot use with `aws_s3_enable_kms` parameter.
-
-- `aws_s3_kms_key` `(string)` - Use named KMS key, when `aws_s3_enable_kms=true`
-
-#### storage_type=google-gcs
-
-- `google_gcs_bucket` `(string: <required>)` GCS bucket to write snapshots to.
-
-- `google_service_account_key` `(string)` - Google service account key in JSON format. Depending
-  on how the API is invoked, this may be need to be JSON-escaped, e.g. for newlines and double quotes.
-  The raw value looks like this:
-
-```json
-{
-  "type": "service_account",
-  "project_id": "project-id",
-  "private_key_id": "key-id",
-  "private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
-  "client_email": "service-account-email",
-  "client_id": "client-id",
-  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
-  "token_uri": "https://accounts.google.com/o/oauth2/token",
-  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
-  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
-}
-```
-
-- `google_endpoint` `(string)` - GCS endpoint. This is typically only set when
-  using a non-Google GCS implementation like fake-gcs-server.
-
-- `google_disable_tls` `(boolean)` - Disable TLS for the GCS endpoint. This
-  should only be used for testing purposes, typically in conjunction with
-  `google_endpoint`.
-
-#### storage_type=azure-blob
-
-- `azure_container_name` `(string: <required>)` - Azure container name to write
-  snapshots to.
-
-- `azure_account_name` `(string)` - Azure account name.
-
-- `azure_account_key` `(string)` - Azure account key.
-
-- `azure_blob_environment` `(string)` - Azure blob environment.
-
-- `azure_endpoint` `(string)` - Azure blob storage endpoint. This is typically
-  only set when using a non-Azure implementation like Azurite.
-
-### Sample payload
-
-```json
-{
-  "interval": "24h",
-  "retain": 7,
-  "path_prefix": "/opt/vault/snapshots/",
-  "storage_type": "local",
-  "local_max_space": 10000000
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/storage/raft/snapshot-auto/config/config1
-```
-
-## List automated snapshots configs
-
-**This endpoint requires sudo capability.**
-
-This endpoint lists named configurations.
-
-| Method | Path                                     |
-| :----- | :--------------------------------------- |
-| `LIST` | `/sys/storage/raft/snapshot-auto/config` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request LIST \
-    http://127.0.0.1:8200/v1/sys/storage/raft/snapshot-auto/config
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "keys": ["config1"]
-  }
-}
-```
-
-## Read automated snapshots config
-
-**This endpoint requires sudo capability.**
-
-This endpoint reads a named configuration.
-
-| Method | Path                                           |
-| :----- | :--------------------------------------------- |
-| `GET`  | `/sys/storage/raft/snapshot-auto/config/:name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/storage/raft/snapshot-auto/config/config1
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "file_prefix": "vault-snapshot",
-    "interval": 86400,
-    "local_max_space": 10000000,
-    "path_prefix": "/opt/vault/snapshots/",
-    "retain": 7,
-    "storage_type": "local"
-  }
-}
-```
-
-## Delete automated snapshots config
-
-**This endpoint requires sudo capability.**
-
-This endpoint deletes a named configuration.
-
-| Method   | Path                                           |
-| :------- | :--------------------------------------------- |
-| `DELETE` | `/sys/storage/raft/snapshot-auto/config/:name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request DELETE \
-    http://127.0.0.1:8200/v1/sys/storage/raft/snapshot-auto/config/config1
-```
-
-## Read automated snapshots status
-
-This endpoint returns the status of a named configuration.
-
-| Method | Path                                           |
-| :----- | :--------------------------------------------- |
-| `GET`  | `/sys/storage/raft/snapshot-auto/status/:name` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/storage/raft/snapshot-auto/status/config1
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "last_snapshot_end": "2020-10-28T11:17:21-04:00",
-    "last_snapshot_error": "",
-    "last_snapshot_start": "2020-10-28T11:17:21-04:00",
-    "last_snapshot_url": "file:///opt/vault/snapshots/vault-snapshot-1603898241699731000.snap",
-    "snapshot_start": "2020-10-28T11:17:21-04:00",
-    "snapshot_url": "file:///opt/vault/snapshots/vault-snapshot-1603898241699731000.snap"
-  }
-}
-```
diff --git a/website/content/api-docs/system/tools.mdx b/website/content/api-docs/system/tools.mdx
deleted file mode 100644
index 13983b6ea60..00000000000
--- a/website/content/api-docs/system/tools.mdx
+++ /dev/null
@@ -1,118 +0,0 @@
----
-layout: api
-page_title: /sys/tools - HTTP API
-description: This is the API documentation for a general set of crypto  tools.
----
-
-# `/sys/tools`
-
-The `/sys/tools` endpoints are a general set of tools.
-
-## Generate random bytes
-
-This endpoint returns high-quality random bytes of the specified length.
-
-| Method | Path                                   |
-| :----- | :------------------------------------- |
-| `POST` | `/sys/tools/random(/:source)(/:bytes)` |
-
-### Parameters
-
-- `bytes` `(int: 32)` – Specifies the number of bytes to return. This value can
-  be specified either in the request body, or as a part of the URL.
-
-- `format` `(string: "base64")` – Specifies the output encoding. Valid options
-  are `hex` or `base64`.
-
-- `source` `(string: "platform")` - Specifies the source of the requested bytes.
-  `platform`, the default, sources bytes from the platform's entropy source.
-  `seal` sources from entropy augmentation (enterprise only).
-  `all` mixes bytes from all available sources.
-
-### Sample payload
-
-```json
-{
-  "format": "hex"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/tools/random/164
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "random_bytes": "dGhlIHF1aWNrIGJyb3duIGZveAo="
-  }
-}
-```
-
-## Hash data
-
-This endpoint returns the cryptographic hash of given data using the specified
-algorithm.
-
-| Method | Path                           |
-| :----- | :----------------------------- |
-| `POST` | `/sys/tools/hash(/:algorithm)` |
-
-### Parameters
-
-- `algorithm` `(string: "sha2-256")` – Specifies the hash algorithm to use. This
-  can also be specified as part of the URL. Currently-supported algorithms are:
-
-  - `sha2-224`
-  - `sha2-256`
-  - `sha2-384`
-  - `sha2-512`
-  - `sha3-224`
-  - `sha3-256`
-  - `sha3-384`
-  - `sha3-512`
-
-  ~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-     and thus should not be used: `sha3-224`, `sha3-256`, `sha3-384`, and
-     `sha3-512`.
-
-- `input` `(string: <required>)` – Specifies the **base64 encoded** input data.
-
-- `format` `(string: "hex")` – Specifies the output encoding. This can be either
-  `hex` or `base64`.
-
-### Sample payload
-
-```json
-{
-  "input": "adba32=="
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/tools/hash/sha2-512
-```
-
-### Sample response
-
-```json
-{
-  "data": {
-    "sum": "dGhlIHF1aWNrIGJyb3duIGZveAo="
-  }
-}
-```
diff --git a/website/content/api-docs/system/unseal.mdx b/website/content/api-docs/system/unseal.mdx
deleted file mode 100644
index 86bbcfc3533..00000000000
--- a/website/content/api-docs/system/unseal.mdx
+++ /dev/null
@@ -1,82 +0,0 @@
----
-layout: api
-page_title: /sys/unseal - HTTP API
-description: The `/sys/unseal` endpoint is used to unseal the Vault.
----
-
-# `/sys/unseal`
-
-@include 'alerts/restricted-root.mdx'
-
-The `/sys/unseal` endpoint is used to unseal the Vault.
-
-## Submit unseal key
-
-This endpoint is used to enter a single root key share to progress the
-unsealing of the Vault. If the threshold number of root key shares is reached,
-Vault will attempt to unseal the Vault. Otherwise, this API must be called
-multiple times until that threshold is met.
-
-Either the `key` or `reset` parameter must be provided; if both are provided,
-`reset` takes precedence.
-
-| Method | Path          |
-| :----- | :------------ |
-| `POST` | `/sys/unseal` |
-
-### Parameters
-
-- `key` `(string: "")` – Specifies a single root key share. This is required
-  unless `reset` is true.
-
-- `reset` `(bool: false)` – Specifies if previously-provided unseal keys are
-  discarded and the unseal process is reset.
-
-- `migrate` `(bool: false)` - Available in 1.0 - Used to migrate the seal
-  from shamir to autoseal or autoseal to shamir. Must be provided on all unseal
-  key calls.
-
-### Sample payload
-
-```json
-{
-  "key": "abcd1234..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/unseal
-```
-
-### Sample response
-
-The "t" parameter is the threshold, and "n" is the number of shares.
-
-```json
-{
-  "sealed": true,
-  "t": 3,
-  "n": 5,
-  "progress": 2,
-  "version": "0.6.2"
-}
-```
-
-Sample response when Vault is unsealed.
-
-```json
-{
-  "sealed": false,
-  "t": 3,
-  "n": 5,
-  "progress": 0,
-  "version": "0.6.2",
-  "cluster_name": "vault-cluster-d6ec3c7f",
-  "cluster_id": "3e8b3fec-3749-e056-ba41-b62a63b997e8"
-}
-```
diff --git a/website/content/api-docs/system/user-lockout.mdx b/website/content/api-docs/system/user-lockout.mdx
deleted file mode 100644
index 0b573114e07..00000000000
--- a/website/content/api-docs/system/user-lockout.mdx
+++ /dev/null
@@ -1,222 +0,0 @@
----
-layout: api
-page_title: /sys/locked-users - HTTP API
-description: The `/sys/locked-users` endpoint is used to manage locked users in Vault.
----
-
-# `/sys/locked-users`
-
-The `/sys/locked-users` endpoint is used to list and unlock locked users in Vault.
-
-Refer to the [user lockout](/vault/docs/concepts/user-lockout) overview for more details about how Vault handles lockouts.
-
-## List locked users
-
-The list endpoint returns information on the users currently locked by Vault.
-
-The response will include all child namespaces of the namespace in which the
-request was made. If some namespace has subsequently been deleted, its path will
-be listed as "deleted namespace :ID:." Deleted namespaces are reported only for
-queries in the root namespace because the information about the namespace path
-is unknown. The response will be returned in the decreasing order of locked user
-counts.
-
-This endpoint was added in Vault 1.13.
-
-| Method | Path             |
-| :----- | :--------------- |
-| `GET` | `/sys/locked-users` |
-
-### Parameters
-
-- `mount_accessor` `(string, optional)` -  Specifies the identifier of the auth mount entry to which the user
-belongs in the namespace in which the request was made. If no mount accessor is specified,
-the response includes locked users in all child namespaces of the namespace in which the request was made.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/locked-users
-```
-
-### Sample response
-
-```json
-{
-   "request_id":"26be5ab9-dcac-9237-ec12-269a8ca647d5",
-   "lease_id":"",
-   "renewable":false,
-   "lease_duration":0,
-   "data":{
-      "by_namespace":[
-         {
-            "namespace_id":"BzIex",
-            "namespace_path":"ns1/",
-            "counts": 3,
-            "mount_accessors":[
-               {
-                  "mount_accessor":"auth_userpass_79e2fe02",
-                  "counts":3,
-                  "alias_identifiers":[
-                      {"user3"},
-                      {"user4"},
-                      {"user5"},
-                  ]
-               },
-            ]
-         },
-         {
-            "namespace_id":"root",
-            "namespace_path":"",
-            "counts":2,
-            "mount_accessors":[
-               {
-                  "mount_accessor":"auth_userpass_837f35fc",
-                  "counts":2,
-                  "alias_identifiers":[
-                      {"user1"},
-                      {"user2"}
-                  ]
-               },
-            ]
-         },
-          {
-            "namespace_id":"v1lb9",
-            "namespace_path":"ns1/ns2/",
-            "counts":1,
-            "mount_accessors":[
-               {
-                  "mount_accessor":"auth_userpass_af8d1d32",
-                  "counts":1,
-                  "alias_identifiers":[
-                      {"user6"}
-                  ]
-               },
-            ]
-         }
-      ],
-      "total":6
-   },
-   "wrap_info":null,
-   "warnings":null,
-   "auth":null
-}
-```
-
-For deleted namespaces, the response will look like:
-
-```json
-{
-   "request_id":"26be5ab9-dcac-9237-ec12-269a8ca647d5",
-   "lease_id":"",
-   "renewable":false,
-   "lease_duration":0,
-   "data":{
-      "by_namespace":[
-         {
-            "namespace_id":"BzIex",
-            "namespace_path":"ns1/",
-            "counts": 3,
-            "mount_accessors":[
-               {
-                  "mount_accessor":"auth_userpass_79e2fe02",
-                  "counts":3,
-                  "alias_identifiers":[
-                      {"user3"},
-                      {"user4"},
-                      {"user5"},
-                  ]
-               },
-            ]
-         },
-         {
-            "namespace_id":"root",
-            "namespace_path":"",
-            "counts":2,
-            "mount_accessors":[
-               {
-                  "mount_accessor":"auth_userpass_837f35fc",
-                  "counts":2,
-                  "alias_identifiers":[
-                      {"user1"},
-                      {"user2"}
-                  ]
-               },
-            ]
-         },
-          {
-            "namespace_id":"v1lb9",
-            "namespace_path":"deleted namespace v1lb9",
-            "counts":1,
-            "mount_accessors":[
-               {
-                  "mount_accessor":"auth_userpass_af8d1d32",
-                  "counts":1,
-                  "alias_identifiers":[
-                      {"user6"}
-                  ]
-               },
-            ]
-         }
-      ],
-      "total":6
-   },
-   "wrap_info":null,
-   "warnings":null,
-   "auth":null
-}
-```
-
-
-### Sample request with mount accessor
-
-#### Sample payload
-
-```json
-{
-  "mount_accessor": "auth_userpass_af8d1d32"
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --data @payload.json \
-    --request GET \
-    http://127.0.0.1:8200/v1/sys/locked-users
-```
-
-## Unlock user
-
-The unlock user endpoint frees a locked user with the provided `mount_accessor` and `alias_identifier` in the given namespace.
-The unlock command is idempotent. Calls to the endpoint succeed even if the user matching the provided `mount_accessor` and `alias_identifier` is not currently locked.
-
-
-This endpoint was added in Vault 1.13.
-
-| Method | Path             |
-| :----- | :--------------- |
-| `POST` | `/sys/locked-users/:mount_accessor/unlock/:alias-identifier` |
-
-### Parameters
-
-- `mount_accessor` `(string, required)` - Specifies the identifier of the auth mount entry to which the user
-belongs
-- `alias_identifier` `(string, required)` - The name of the alias (user). For example, if the alias
-belongs to userpass backend, the name should be a valid username within userpass auth method. If the alias belongs
-to an approle auth method, the name should be a valid RoleID. If the alias belongs to an ldap auth method, the name
-should be a valid username.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/locked-users/auth_userpass_af8d1d32/unlock/bsmith
-```
diff --git a/website/content/api-docs/system/version-history.mdx b/website/content/api-docs/system/version-history.mdx
deleted file mode 100644
index da76e0d244d..00000000000
--- a/website/content/api-docs/system/version-history.mdx
+++ /dev/null
@@ -1,64 +0,0 @@
----
-layout: api
-page_title: /sys/version-history - HTTP API
-description: The `/sys/version-history` endpoint is used to retrieve the version history of a Vault.
----
-
-# `/sys/version-history`
-
-~> **NOTE**: Tracking Vault version history was added in Vault version 1.9.0. Entries for versions installed prior to version 1.9.0 will not be available via this API.
-This API was added in 1.10.0.
-
-The `/sys/version-history` endpoint is used to retrieve the version history of a Vault.
-
-## Read version history
-
-This endpoint returns the version history of the Vault. The response will contain the following keys:
-
-- `keys`: a list of installed versions in chronological order based on the time installed
-- `key_info`: a map indexed by the versions found in the `keys` list containing the following subkeys:
-  - `build_date`: the time (in UTC) at which the Vault binary used to run the Vault server was built. **Note: Only tracked from version 1.11.0 or greater**
-  - `previous_version`: the version installed prior to this version or `null` if no prior version exists
-  - `timestamp_installed`: the time (in UTC) at which the version was installed
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `LIST`  | `/sys/version-history` |
-
-### Sample request
-
-```shell-session
-$ curl \
-    -X LIST --header "X-Vault-Token: ..." \
-    http://127.0.0.1:8200/v1/sys/version-history
-```
-
-### Sample response
-
-```json
-{
-  "keys": ["1.9.0", "1.9.1", "1.9.2", "1.11.0"],
-  "key_info": {
-    "1.9.0": {
-      "build_date": null,
-      "previous_version": null,
-      "timestamp_installed": "2021-11-18T10:23:16Z"
-    },
-    "1.9.1": {
-      "build_date": null,
-      "previous_version": "1.9.0",
-      "timestamp_installed": "2021-12-13T11:09:52Z"
-    },
-    "1.9.2": {
-      "build_date": null,
-      "previous_version": "1.9.1",
-      "timestamp_installed": "2021-12-23T10:56:37Z"
-    },
-    "1.11.0": {
-      "build_date": "2022-05-03T08:34:11Z",
-      "previous_version": null,
-      "timestamp_installed": "2022-05-03T13:16:04Z"
-    }
-  }
-}
-```
diff --git a/website/content/api-docs/system/wrapping-lookup.mdx b/website/content/api-docs/system/wrapping-lookup.mdx
deleted file mode 100644
index 146c3770ddb..00000000000
--- a/website/content/api-docs/system/wrapping-lookup.mdx
+++ /dev/null
@@ -1,58 +0,0 @@
----
-layout: api
-page_title: /sys/wrapping/lookup - HTTP API
-description: The `/sys/wrapping/lookup` endpoint returns wrapping token properties.
----
-
-# `/sys/wrapping/lookup`
-
-The `/sys/wrapping/lookup` endpoint returns wrapping token properties.
-
-## Wrapping lookup
-
-This endpoint looks up wrapping properties for the given token.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/sys/wrapping/lookup` |
-
-### Parameters
-
-- `token` `(string: <required>)` – Specifies the wrapping token ID.
-
-### Sample payload
-
-```json
-{
-  "token": "abcd1234"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/wrapping/lookup
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "481320f5-fdf8-885d-8050-65fa767fd19b",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": {
-    "creation_path": "sys/wrapping/wrap",
-    "creation_time": "2016-09-28T14:16:13.07103516-04:00",
-    "creation_ttl": 300
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
diff --git a/website/content/api-docs/system/wrapping-rewrap.mdx b/website/content/api-docs/system/wrapping-rewrap.mdx
deleted file mode 100644
index 6da9f02e203..00000000000
--- a/website/content/api-docs/system/wrapping-rewrap.mdx
+++ /dev/null
@@ -1,64 +0,0 @@
----
-layout: api
-page_title: /sys/wrapping/rewrap - HTTP API
-description: >-
-  The `/sys/wrapping/rewrap` endpoint can be used to rotate a wrapping token and
-  refresh its TTL.
----
-
-# `/sys/wrapping/rewrap`
-
-The `/sys/wrapping/rewrap` endpoint can be used to rotate a wrapping token and
-refresh its TTL.
-
-## Wrapping rewrap
-
-This endpoint rewraps a response-wrapped token. The new token will use the same
-creation TTL as the original token and contain the same response. The old token
-will be invalidated. This can be used for long-term storage of a secret in a
-response-wrapped token when rotation is a requirement.
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/sys/wrapping/rewrap` |
-
-### Parameters
-
-- `token` `(string: <required>)` – Specifies the wrapping token ID.
-
-### Sample payload
-
-```json
-{
-  "token": "abcd1234..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/wrapping/rewrap
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": null,
-  "warnings": null,
-  "wrap_info": {
-    "token": "3b6f1193-0707-ac17-284d-e41032e74d1f",
-    "ttl": 300,
-    "creation_time": "2016-09-28T14:22:26.486186607-04:00",
-    "creation_path": "sys/wrapping/wrap"
-  }
-}
-```
diff --git a/website/content/api-docs/system/wrapping-unwrap.mdx b/website/content/api-docs/system/wrapping-unwrap.mdx
deleted file mode 100644
index 49297a4a8c8..00000000000
--- a/website/content/api-docs/system/wrapping-unwrap.mdx
+++ /dev/null
@@ -1,76 +0,0 @@
----
-layout: api
-page_title: /sys/wrapping/unwrap - HTTP API
-description: The `/sys/wrapping/unwrap` endpoint unwraps a wrapped response.
----
-
-# `/sys/wrapping/unwrap`
-
-The `/sys/wrapping/unwrap` endpoint unwraps a wrapped response.
-
-## Wrapping unwrap
-
-This endpoint returns the original response inside the given wrapping token.
-Unlike simply reading `cubbyhole/response` (which is deprecated), this endpoint
-provides additional validation checks on the token, returns the original value
-on the wire rather than a JSON string representation of it, and ensures that the
-response is properly audit-logged.
-
-This endpoint can be used by using a wrapping token as the client token in the
-API call, in which case the `token` parameter is not required; or, a different
-token with permissions to access this endpoint can make the call and pass in the
-wrapping token in the `token` parameter. Do _not_ use the wrapping token in both
-locations; this will cause the wrapping token to be revoked but the value to be
-unable to be looked up, as it will basically be a double-use of the token!
-
-| Method | Path                   |
-| :----- | :--------------------- |
-| `POST` | `/sys/wrapping/unwrap` |
-
-### Parameters
-
-- `token` `(string: "")` – Specifies the wrapping token ID. This is required if
-  the client token is not the wrapping token. Do not use the wrapping token in
-  both locations.
-
-### Sample payload
-
-```json
-{
-  "token": "abcd1234..."
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/wrapping/unwrap
-```
-
-Or you can use token to unwrap without authentication in vault
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: abcd1234..." \
-    --request POST \
-    http://127.0.0.1:8200/v1/sys/wrapping/unwrap
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "8e33c808-f86c-cff8-f30a-fbb3ac22c4a8",
-  "lease_id": "",
-  "lease_duration": 2592000,
-  "renewable": false,
-  "data": {
-    "zip": "zap"
-  },
-  "warnings": null
-}
-```
diff --git a/website/content/api-docs/system/wrapping-wrap.mdx b/website/content/api-docs/system/wrapping-wrap.mdx
deleted file mode 100644
index 8071097fe82..00000000000
--- a/website/content/api-docs/system/wrapping-wrap.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-layout: api
-page_title: /sys/wrapping/wrap - HTTP API
-description: |-
-  The `/sys/wrapping/wrap` endpoint wraps the given values in a
-  response-wrapped token.
----
-
-# `/sys/wrapping/wrap`
-
-The `/sys/wrapping/wrap` endpoint wraps the given values in a response-wrapped
-token.
-
-## Wrapping wrap
-
-This endpoint wraps the given user-supplied data inside a response-wrapped
-token.
-
-| Method | Path                 |
-| :----- | :------------------- |
-| `POST` | `/sys/wrapping/wrap` |
-
-### Parameters
-
-- `:any` `(map<string|string>: nil)` – Parameters should be supplied as
-  keys/values in a JSON object. The exact set of given parameters will be
-  contained in the wrapped response.
-
-### Sample payload
-
-```json
-{
-  "foo": "bar",
-  "zip": "zap"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --header "X-Vault-Wrap-TTL: 60" \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/wrapping/wrap
-```
-
-### Sample response
-
-```json
-{
-  "request_id": "",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": null,
-  "warnings": null,
-  "wrap_info": {
-    "token": "fb79b9d3-d94e-9eb6-4919-c559311133d6",
-    "ttl": 300,
-    "creation_time": "2016-09-28T14:41:00.56961496-04:00",
-    "creation_path": "sys/wrapping/wrap"
-  }
-}
-```
diff --git a/website/content/docs/agent-and-proxy/agent/apiproxy.mdx b/website/content/docs/agent-and-proxy/agent/apiproxy.mdx
deleted file mode 100644
index ce80caa1754..00000000000
--- a/website/content/docs/agent-and-proxy/agent/apiproxy.mdx
+++ /dev/null
@@ -1,100 +0,0 @@
----
-layout: docs
-page_title: Vault Agent API Proxy
-description: >-
-  Vault Agent's API Proxy functionality allows you to use Vault Agent's API as a proxy
-  for Vault's API.
----
-
-# Vault Agent API proxy
-
-Vault Agent's API Proxy functionality allows you to use Vault Agent's API as a proxy
-for Vault's API.
-
-~> Note: This functionality will be deprecated in a future release. Please
-switch to using [Vault Proxy](/vault/docs/agent-and-proxy/proxy) for API proxying purposes, instead.
-
-<Note title="Use Vault Proxy for static secret caching">
-
-  [Static secret caching](/vault/docs/agent-and-proxy/proxy/caching/static-secret-caching)
-  (KVv1 and KVv2) with API proxy minimizes the number of requests forwarded to
-  Vault. Vault Agent does not support static secret caching with API proxy. We
-  recommend using [Vault Proxy](/vault/docs/agent-and-proxy/proxy) for API Proxy
-  related workflows.
-
-</Note>
-
-## Functionality
-
-The [`listener` stanza](/vault/docs/agent-and-proxy/agent#listener-stanza) for Vault Agent configures a listener for Vault Agent. If
-its `role` is not set to `metrics_only`, it will act as a proxy for the Vault server that
-has been configured in the [`vault` stanza](/vault/docs/agent-and-proxy/agent#vault-stanza) of Vault Agent. This enables access to the Vault
-API from the Agent API, and can be configured to optionally allow or force the automatic use of
-the Auto-Auth token for these requests, as described below.
-
-If a `listener` has been configured alongside a `cache` stanza, the API Proxy will
-first attempt to utilize the cache subsystem for qualifying requests, before forwarding the
-request to Vault. See the [caching docs](/vault/docs/agent-and-proxy/agent/caching) for more information on caching.
-
-## Using Auto-Auth token
-
-Vault Agent allows for easy authentication to Vault in a wide variety of
-environments using [Auto-Auth](/vault/docs/agent-and-proxy/autoauth). By setting the
-`use_auto_auth_token` (see below) configuration, clients will not be required
-to provide a Vault token to the requests made to the Agent. When this
-configuration is set, if the request doesn't already bear a token, then the
-auto-auth token will be used to forward the request to the Vault server. This
-configuration will be overridden if the request already has a token attached,
-in which case, the token present in the request will be used to forward the
-request to the Vault server.
-
-## Forcing Auto-Auth token
-
-Vault Agent can be configured to force the use of the auto-auth token by using
-the value `force` for the `use_auto_auth_token` option. This configuration
-overrides the default behavior described above in [Using Auto-Auth
-Token](/vault/docs/agent-and-proxy/agent/apiproxy#using-auto-auth-token), and instead ignores any
-existing Vault token in the request and instead uses the auto-auth token.
-
-
-## Configuration (`api_proxy`)
-
-The top level `api_proxy` block has the following configuration entries:
-
-- `use_auto_auth_token` `(bool/string: false)` - If set, the requests made to Agent
-without a Vault token will be forwarded to the Vault server with the
-auto-auth token attached. If the requests already bear a token, this
-configuration will be overridden and the token in the request will be used to
-forward the request to the Vault server. If set to `"force"` Agent will use the
-auto-auth token, overwriting the attached Vault token if set.
-
-The following two `api_proxy` options are only useful when making requests to a Vault
-Enterprise cluster, and are documented as part of its
-[Eventual Consistency](/vault/docs/enterprise/consistency#vault-agent-and-consistency-headers)
-page.
-
-- `enforce_consistency` `(string: "never")` - Set to one of `"always"`
-or `"never"`.
-
-- `when_inconsistent` `(string: optional)` - Set to one of `"fail"`, `"retry"`,
-or `"forward"`.
-
-### Example configuration
-
-Here is an example of a `listener` configuration alongside `api_proxy` configuration to force the use of the auto_auth token
-and enforce consistency.
-
-```hcl
-# Other Vault agent configuration blocks
-# ...
-
-api_proxy {
-  use_auto_auth_token = "force"
-  enforce_consistency = "always"
-}
-
-listener "tcp" {
-    address = "127.0.0.1:8100"
-    tls_disable = true
-}
-```
diff --git a/website/content/docs/agent-and-proxy/agent/caching/index.mdx b/website/content/docs/agent-and-proxy/agent/caching/index.mdx
deleted file mode 100644
index 6d8e49fe862..00000000000
--- a/website/content/docs/agent-and-proxy/agent/caching/index.mdx
+++ /dev/null
@@ -1,269 +0,0 @@
----
-layout: docs
-page_title: Vault Agent Caching
-description: |-
-  Vault Agent Caching allows client-side caching of responses containing newly
-  created tokens and responses containing leased secrets generated off of these
-  newly created tokens.
----
-
-# Vault Agent caching
-
-<Note title="Use Vault Proxy for static secret caching">
-
-  [Static secret caching](/vault/docs/agent-and-proxy/proxy/caching/static-secret-caching)
-  (KVv1 and KVv2) with API proxy minimizes the number of requests forwarded to
-  Vault. Vault Agent does not support static secret caching with API proxy. We
-  recommend using [Vault Proxy](/vault/docs/agent-and-proxy/proxy) for API Proxy
-  related workflows.
-
-</Note>
-
-Vault Agent Caching allows client-side caching of responses containing newly
-created tokens and responses containing leased secrets generated off of these
-newly created tokens. The renewals of the cached tokens and leases are also
-managed by the agent.
-
-## Caching and renewals
-
-Response caching and renewals are managed by the agent only under these
-specific scenarios.
-
-1. Token creation requests are made through the agent. This means that any
-   login operations performed using various auth methods and invoking the token
-   creation endpoints of the token auth method via the agent will result in the
-   response getting cached by the agent. Responses containing new tokens will
-   be cached by the agent only if the parent token is already being managed by
-   the agent or if the new token is an orphan token.
-
-2. Leased secret creation requests are made through the agent using tokens that
-   are already managed by the agent. This means that any dynamic credentials
-   that are issued using the tokens managed by the agent, will be cached and
-   its renewals are taken care of.
-
-## Persistent cache
-
-Vault Agent can restore tokens and leases from a persistent cache file created
-by a previous Vault Agent process.
-
-Refer to the [Vault Agent Persistent
-Caching](/vault/docs/agent-and-proxy/agent/caching/persistent-caches) page for more information on
-this functionality.
-
-## Cache evictions
-
-The eviction of cache entries pertaining to secrets will occur when the agent
-can no longer renew them. This can happen when the secrets hit their maximum
-TTL or if the renewals result in errors.
-
-Agent does some best-effort cache evictions by observing specific request types
-and response codes. For example, if a token revocation request is made via the
-agent and if the forwarded request to the Vault server succeeds, then agent
-evicts all the cache entries associated with the revoked token. Similarly, any
-lease revocation operation will also be intercepted by the agent and the
-respective cache entries will be evicted.
-
-Note that while agent evicts the cache entries upon secret expirations and upon
-intercepting revocation requests, it is still possible for the agent to be
-completely unaware of the revocations that happen through direct client
-interactions with the Vault server. This could potentially lead to stale cache
-entries. For managing the stale entries in the cache, an endpoint
-`/agent/v1/cache-clear`(see below) is made available to manually evict cache
-entries based on some of the query criteria used for indexing the cache entries.
-
-## Request uniqueness
-
-In order to detect repeat requests and return cached responses, Agent needs
-to have a way to uniquely identify the requests. This computation as it stands
-today takes a simplistic approach (may change in future) of serializing and
-hashing the HTTP request along with all the headers and the request body. This
-hash value is then used as an index into the cache to check if the response is
-readily available. The consequence of this approach is that the hash value for
-any request will differ if any data in the request is modified. This has the
-side-effect of resulting in false negatives if say, the ordering of the request
-parameters are modified. As long as the requests come in without any change,
-caching behavior should be consistent. Identical requests with differently
-ordered request values will result in duplicated cache entries. A heuristic
-assumption that the clients will use consistent mechanisms to make requests,
-thereby resulting in consistent hash values per request is the idea upon which
-the caching functionality is built upon.
-
-## Renewal management
-
-The tokens and leases are renewed by the agent using the secret renewer that is
-made available via the Vault server's [Go
-API](https://godoc.org/github.com/hashicorp/vault/api#Renewer). Agent performs
-all operations in memory and does not persist anything to storage. This means
-that when the agent is shut down, all the renewal operations are immediately
-terminated and there is no way for agent to resume renewals after the fact.
-Note that shutting down the agent does not indicate revocations of the secrets,
-instead it only means that renewal responsibility for all the valid unrevoked
-secrets are no longer performed by the Vault agent.
-
-### Agent CLI
-
-Agent's listener address will be picked up by the CLI through the
-`VAULT_AGENT_ADDR` environment variable. This should be a complete URL such as
-`"http://127.0.0.1:8200"`.
-
-## API
-
-### Cache clear
-
-This endpoint clears the cache based on given criteria. To use this
-API, some information on how the agent caches values should be known
-beforehand. Each response that is cached in the agent will be indexed on some
-factors depending on the type of request. Those factors can be the `token` that
-is belonging to the cached response, the `token_accessor` of the token
-belonging to the cached response, the `request_path` that resulted in the
-cached response, the `lease` that is attached to the cached response, the
-`namespace` to which the cached response belongs to, and a few more. This API
-exposes some factors through which associated cache entries are fetched and
-evicted. For listeners without caching enabled, this API will still be available,
-but will do nothing (there is no cache to clear) and will return a `200` response.
-
-| Method | Path                    | Produces               |
-| :----- | :---------------------- | :--------------------- |
-| `POST` | `/agent/v1/cache-clear` | `200 application/json` |
-
-#### Parameters
-
-- `type` `(strings: required)` - The type of cache entries to evict. Valid
-  values are `request_path`, `lease`, `token`, `token_accessor`, and `all`.
-  If the `type` is set to `all`, the _entire cache_ is cleared.
-
-- `value` `(string: required)` - An exact value or the prefix of the value for
-  the `type` selected. This parameter is optional when the `type` is set
-  to `all`.
-
-- `namespace` `(string: optional)` - This is only applicable when the `type` is set to
-  `request_path`. The namespace of which the cache entries to be evicted for
-  the given request path.
-
-### Sample payload
-
-```json
-{
-  "type": "token",
-  "value": "hvs.rlNjegSKykWcplOkwsjd8bP9"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:1234/agent/v1/cache-clear
-```
-
-## Configuration (`cache`)
-
-The presence of the top level `cache` block in any way (including an empty `cache` block)  will enable the cache.
-The top level `cache` block has the following configuration entry:
-
-- `persist` `(object: optional)` - Configuration for the persistent cache.
-
-The `cache` block also supports the `use_auto_auth_token`, `enforce_consistency`, and
-`when_inconsistent` configuration values of the `api_proxy` block
-[described in the API Proxy documentation](/vault/docs/agent-and-proxy/agent/apiproxy#configuration-api_proxy) only to
-maintain backwards compatibility. This configuration **cannot** be specified alongside `api_proxy` equivalents,
-should not be preferred over configuring these values in the `api_proxy` block,
-and `api_proxy` should be the preferred place to configure these values.
-
--> **Note:** When the `cache` block is defined, at least one
-[template][agent-template] or [listener][agent-listener] must also be defined
-in the config, otherwise there is no way to utilize the cache.
-
-[agent-template]: /vault/docs/agent-and-proxy/agent/template
-[agent-listener]: /vault/docs/agent-and-proxy/agent#listener-stanza
-
-### Configuration (Persist)
-
-These are common configuration values that live within the `persist` block:
-
-- `type` `(string: required)` - The type of the persistent cache to use,
-  e.g. `kubernetes`. _Note_: when using HCL this can be used as the key for
-  the block, e.g. `persist "kubernetes" {...}`. Currently, only `kubernetes`
-  is supported.
-
-- `path` `(string: required)` - The path on disk where the persistent cache file
-  should be created or restored from.
-
-- `keep_after_import` `(bool: optional)` - When set to true, a restored cache file
-  is not deleted. Defaults to `false`.
-
-- `exit_on_err` `(bool: optional)` - When set to true, if any errors occur during
-  a persistent cache restore, Vault Agent will exit with an error. Defaults to `true`.
-
-- `service_account_token_file` `(string: optional)` - When `type` is set to `kubernetes`,
-this configures the path on disk where the Kubernetes service account token can be found.
-Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
-
-## Configuration (`listener`)
-
-- `listener` `(array of objects: required)` - Configuration for the listeners.
-
-There can be one or more `listener` blocks at the top level. Adding a listener enables
-the [API Proxy](/vault/docs/agent-and-proxy/agent/apiproxy) and enables the API proxy to use the cache, if configured.
-These configuration values are common to both `tcp` and `unix` listener blocks. Blocks of type
-`tcp` support the standard `tcp` [listener](/vault/docs/configuration/listener/tcp)
-options. Additionally, the `role` string option is available as part of the top level
-of the `listener` block, which can be configured to `metrics_only` to serve only metrics,
-or the default role, `default`, which serves everything (including metrics).
-
-- `type` `(string: required)` - The type of the listener to use. Valid values
-  are `tcp` and `unix`.
-  _Note_: when using HCL this can be used as the key for the block, e.g.
-  `listener "tcp" {...}`.
-
-- `address` `(string: required)` - The address for the listener to listen to.
-  This can either be a URL path when using `tcp` or a file path when using
-  `unix`. For example, `127.0.0.1:8200` or `/path/to/socket`. Defaults to
-  `127.0.0.1:8200`.
-
-- `tls_disable` `(bool: false)` - Specifies if TLS will be disabled.
-
-- `tls_key_file` `(string: optional)` - Specifies the path to the private key
-  for the certificate.
-
-- `tls_cert_file` `(string: optional)` - Specifies the path to the certificate
-  for TLS.
-
-### Example configuration
-
-Here is an example of a cache configuration with the optional `persist` block,
-alongside a regular listener, and a listener that only serves metrics.
-
-```hcl
-# Other Vault agent configuration blocks
-# ...
-
-cache {
-	persist = {
-		type = "kubernetes"
-		path = "/vault/agent-cache/"
-		keep_after_import = true
-		exit_on_err = true
-		service_account_token_file = "/tmp/serviceaccount/token"
-	}
-}
-
-listener "tcp" {
-    address = "127.0.0.1:8100"
-    tls_disable = true
-}
-
-listener "tcp" {
-    address = "127.0.0.1:3000"
-    tls_disable = true
-    role = "metrics_only"
-}
-```
-
-## Tutorial
-
-Refer to the [Vault Agent
-Caching](/vault/tutorials/vault-agent/agent-caching)
-tutorial to learn how to use the Vault Agent to increase the availability of tokens and secrets to clients using its Caching function.
diff --git a/website/content/docs/agent-and-proxy/agent/caching/persistent-caches/index.mdx b/website/content/docs/agent-and-proxy/agent/caching/persistent-caches/index.mdx
deleted file mode 100644
index 9ae86cadb26..00000000000
--- a/website/content/docs/agent-and-proxy/agent/caching/persistent-caches/index.mdx
+++ /dev/null
@@ -1,46 +0,0 @@
----
-layout: docs
-page_title: Vault Agent Persistent Caching
-description: Vault Agent Caching
----
-
-# Vault Agent persistent caching
-
-Vault Agent can restore tokens and leases from a persistent cache file created
-by a previous Vault Agent process. The persistent cache is a BoltDB file that
-includes tuples encrypted by a generated encryption key. The encrypted tuples
-include the Vault token used to retrieve secrets, leases for tokens/secrets, and
-secret values.
-
--> **Note:** Vault Agent Persistent Caching will only restore _leased_
-secrets. Secrets that are not renewable, such as KV v2, will not be persisted.
-
-In order to use Vault Agent persistent cache, auto-auth must be used. If the
-auto-auth token has expired by the time the cache is restored, the cache will
-be invalidated and secrets will need to be re-fetched from Vault.
-
-If Vault Agent templating is enabled alongside of the persistent cache, Vault
-Agent will automatically route templating requests through the cache. This
-ensures template requests are cached and restored properly.
-
--> **Note** Vault Agent persistent cache is currently supported only in a
-Kubernetes environment.
-
-## Vault agent persistent cache types
-
-Please see the sidebar for available types and their usage/configuration.
-
-## Persistent cache example configuration
-
-Here is an example of a persistent cache configuration.
-
-```hcl
-# Other Vault agent configuration blocks
-# ...
-
-cache {
-  persist "kubernetes" {
-    path = "/vault/agent-cache"
-  }
-}
-```
diff --git a/website/content/docs/agent-and-proxy/agent/caching/persistent-caches/kubernetes.mdx b/website/content/docs/agent-and-proxy/agent/caching/persistent-caches/kubernetes.mdx
deleted file mode 100644
index 46fdad01f82..00000000000
--- a/website/content/docs/agent-and-proxy/agent/caching/persistent-caches/kubernetes.mdx
+++ /dev/null
@@ -1,25 +0,0 @@
----
-layout: docs
-page_title: Kubernetes - Vault Agent Persistent Cache
-description: Kubernetes Persistent Cache for Vault Agent Caching
----
-
-# Vault Agent Kubernetes persistent cache
-
-When `kubernetes` is configured for the persistent cache type, Vault Agent will optimize the
-persistent cache specifically for Kubernetes. This type of persistent cache requires a Kubernetes
-service account token. The service account token is used during encryption and decryption of the
-persistent cache as an additional integrity check.
-
-The Vault Agent persistent cache file in Kubernetes should only be used for handing off Vault tokens
-and leases between initialization and sidecar Vault Agent containers. This cache file should be shared
-using a memory volume between the Vault Agent containers.
-
-If the Vault Agent Injector for Kubernetes is being used, the persistent cache is automatically configured
-and used if the annotation [`vault.hashicorp.com/agent-cache-enable: true`](/vault/docs/platform/k8s/injector/annotations#vault-hashicorp-com-agent-cache-enable) is set.
-
-## Configuration
-
-- `service_account_token_file` `(string: optional)` - When type is set to `kubernetes`,
-  this configures the path on disk where the Kubernetes service account token can be found.
-  Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
diff --git a/website/content/docs/agent-and-proxy/agent/generate-config/index.mdx b/website/content/docs/agent-and-proxy/agent/generate-config/index.mdx
deleted file mode 100644
index 4f66f5f6aa2..00000000000
--- a/website/content/docs/agent-and-proxy/agent/generate-config/index.mdx
+++ /dev/null
@@ -1,129 +0,0 @@
----
-layout: docs
-page_title: agent generate-config - Command
-description: |-
-  Generates a simple Vault Agent configuration file from the given parameters.
----
-
-# agent generate-config
-
-Generates a simple Vault Agent configuration file from the given parameters.
-
-Currently, the only supported configuration type is `env-template`, which
-helps you generate a configuration file with environment variable templates
-for running Vault Agent in
-[process supervisor](/vault/docs/agent-and-proxy/agent/process-supervisor)
-mode.
-
-For every specified secret `-path`, the command will attempt to generate one or
-multiple `env_template` entries based on the `JSON` key(s) stored in the
-specified secret. If the secret `-path` ends with `/*`, the command will
-attempt to recurse through the secrets tree rooted at the given path,
-generating `env_template` entries for each encountered secret. Currently,
-only [kv-v1](/vault/docs/secrets/kv/kv-v1) and
-[kv-v2](/vault/docs/secrets/kv/kv-v2) paths are supported.
-
-The command specified in the `-exec` option will be used to generate an
-`exec` entry, which will tell Vault Agent which child process to run.
-
-In addition to the `env_template` entries, the command generates an `auto_auth`
-section with `token_file` authentication method. While this method is very
-convenient for local testing, it should **NOT** be used in production. In a
-production environment, please use any other
-[Auto-Auth method](/vault/docs/agent-and-proxy/autoauth/methods) instead.
-
-By default, the file will be generated in the local directory as `agent.hcl`
-unless a path is specified as an argument.
-
-## Example
-
-Before generating a configuration file, let's insert a secret `foo`:
-
-```shell-session
-$ vault kv put -mount=secret foo user="admin" password="s3cr3t"
-```
-
-Generate an agent configuration file which will reference `secret/foo`:
-
-```shell-session
-$ vault agent generate-config \
-         -type="env-template" \
-         -exec="./my-app arg1 arg2" \
-         -namespace="my/ns/" \
-         -path="secret/foo" \
-         my-config.hcl
-```
-
-**Expected output:**
-
-<CodeBlockConfig hideClipboard>
-
-```plaintext
-Successfully generated "my-config.hcl" configuration file!
-Warning: the generated file uses 'token_file' authentication method, which is not suitable for production environments.
-```
-
-</CodeBlockConfig>
-
-This will produce `my-config.hcl` file in the current directory with contents
-similar to the following:
-
-```hcl
-auto_auth {
-
-  method {
-    type = "token_file"
-
-    config {
-      token_file_path = "/Users/avean/.vault-token"
-    }
-  }
-}
-
-template_config {
-  static_secret_render_interval = "5m"
-  exit_on_retry_failure         = true
-  max_connections_per_host      = 10
-}
-
-vault {
-  address = "http://localhost:8200"
-}
-
-env_template "FOO_PASSWORD" {
-  contents             = "{{ with secret \"secret/data/foo\" }}{{ .Data.data.password }}{{ end }}"
-  error_on_missing_key = true
-}
-env_template "FOO_USER" {
-  contents             = "{{ with secret \"secret/data/foo\" }}{{ .Data.data.user }}{{ end }}"
-  error_on_missing_key = true
-}
-
-exec {
-  command                   = ["./my-app", "arg1", "arg2"]
-  restart_on_secret_changes = "always"
-  restart_stop_signal       = "SIGTERM"
-}
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included in all commands.
-
-- `type` `(string: <required>)` - The type of configuration file to generate;
-  currently, only `env-template` is supported.
-
-- `path` `(string: "")` - Path to a kv-v1 or kv-v2 secret
-  (e.g. `secret/data/foo`, `kv-v2/my-app/*`); multiple secrets and tail `*`
-  wildcards are allowed.
-
-- `-exec` `(string: "env")` - The command to execute in agent process
-  supervisor mode.
-
-
-## Tutorial
-
-Refer to the [Vault Agent - secrets as environment
-variables](/vault/tutorials/vault-agent/agent-env-vars) tutorial for an
-end-to-end example.
diff --git a/website/content/docs/agent-and-proxy/agent/index.mdx b/website/content/docs/agent-and-proxy/agent/index.mdx
deleted file mode 100644
index 21a8ba28634..00000000000
--- a/website/content/docs/agent-and-proxy/agent/index.mdx
+++ /dev/null
@@ -1,414 +0,0 @@
----
-layout: docs
-page_title: Vault Agent
-description: |-
-  Vault Agent is a client-side daemon that can be used to perform some Vault
-  functionality automatically.
----
-
-# What is Vault Agent?
-
-Vault Agent aims to remove the initial hurdle to adopt Vault by providing a
-more scalable and simpler way for applications to integrate with Vault, by
-providing the ability to render [templates][template] containing the secrets
-required by your application, without requiring changes to your application.
-
-![Vault Agent workflow](/img/vault-agent-workflow.png)
-
-Vault Agent is a client daemon that provides the following features:
-
-- [Auto-Auth][autoauth] - Automatically authenticate to Vault and manage the
-  token renewal process for locally-retrieved dynamic secrets.
-- [API Proxy][apiproxy] - Allows Vault Agent to act as a proxy for Vault's API,
-  optionally using (or forcing the use of) the Auto-Auth token.
-- [Caching][caching] - Allows client-side caching of responses containing newly
-  created tokens and responses containing leased secrets generated off of these
-  newly created tokens. The agent also manages the renewals of the cached tokens and leases.
-- [Windows Service][winsvc] - Allows running the Vault Agent as a Windows
-  service.
-- [Templating][template] - Allows rendering of user-supplied templates by Vault
-  Agent, using the token generated by the Auto-Auth step.
-- [Process Supervisor Mode][process-supervisor] - Runs a child process with Vault
-  secrets injected as environment variables.
-
-## Auto-Auth
-
-Vault Agent allows easy authentication to Vault in a wide variety of
-environments. Please see the [Auto-Auth docs][autoauth]
-for information.
-
-Auto-Auth functionality takes place within an `auto_auth` configuration stanza.
-
-## API proxy
-
-Vault Agent can act as an API proxy for Vault, allowing you to talk to Vault's
-API via a listener defined for Agent. It can be configured to optionally allow or force the automatic use of
-the Auto-Auth token for these requests. Please see the [API Proxy docs][apiproxy]
-for more information.
-
-API Proxy functionality takes place within a defined `listener`, and its behaviour can be configured with an
-[`api_proxy` stanza](/vault/docs/agent-and-proxy/agent/apiproxy#configuration-api_proxy).
-
-## Caching
-
-Vault Agent allows client-side caching of responses containing newly created tokens
-and responses containing leased secrets generated off of these newly created tokens.
-Please see the [Caching docs][caching] for information.
-
-## API
-
-### Quit
-
-This endpoint triggers shutdown of the agent. By default, it is disabled, and can
-be enabled per listener using the [`agent_api`][agent-api] stanza. It is recommended
-to only enable this on trusted interfaces, as it does not require any authorization to use.
-
-| Method | Path             |
-| :----- | :--------------- |
-| `POST` | `/agent/v1/quit` |
-
-### Cache
-
-See the [caching](/vault/docs/agent-and-proxy/agent/caching#api) page for details on the cache API.
-
-## Configuration
-
-### Command options
-
-- `-log-level` ((#\_log_level)) `(string: "info")` - Log verbosity level. Supported values (in
-  order of descending detail) are `trace`, `debug`, `info`, `warn`, and `error`. This can
-  also be specified via the `VAULT_LOG_LEVEL` environment variable.
-
-- `-log-format` ((#\_log_format)) `(string: "standard")` - Log format. Supported values
-  are `standard` and `json`. This can also be specified via the
-  `VAULT_LOG_FORMAT` environment variable.
-
-- `-log-file` ((#\_log_file)) - the absolute path where Vault Agent should save
-  log messages. Paths that end with a path separator use the default file name,
-  `agent.log`. Paths that do not end with a file extension use the default
-  `.log` extension. If the log file rotates, Vault Agent appends the current
-  timestamp to the file name at the time of rotation. For example:
-
-  `log-file` | Full log file | Rotated log file
-  ---------- | ------------- | ----------------
-  `/var/log` | `/var/log/agent.log` | `/var/log/agent-{timestamp}.log`
-  `/var/log/my-diary` | `/var/log/my-diary.log` | `/var/log/my-diary-{timestamp}.log`
-  `/var/log/my-diary.txt` | `/var/log/my-diary.txt` | `/var/log/my-diary-{timestamp}.txt`
-
-- `-log-rotate-bytes` ((#\_log_rotate_bytes)) - to specify the number of
-  bytes that should be written to a log before it needs to be rotated. Unless specified,
-  there is no limit to the number of bytes that can be written to a log file.
-
-- `-log-rotate-duration` ((#\_log_rotate_duration)) - to specify the maximum
-  duration a log should be written to before it needs to be rotated. Must be a duration
-  value such as 30s. Defaults to 24h.
-
-- `-log-rotate-max-files` ((#\_log_rotate_max_files)) - to specify the maximum
-  number of older log file archives to keep. Defaults to `0` (no files are ever deleted).
-  Set to `-1` to discard old log files when a new one is created.
-
-### Configuration file options
-
-These are the currently-available general configuration options:
-
-- `vault` <code>([vault][vault]: <optional\>)</code> - Specifies the remote Vault server the Agent connects to.
-
-- `auto_auth` <code>([auto_auth][autoauth]: <optional\>)</code> - Specifies the method and other options used for Auto-Auth functionality.
-
-- `api_proxy` <code>([api_proxy][apiproxy]: <optional\>)</code> - Specifies options used for API Proxy functionality.
-
-- `cache` <code>([cache][caching]: <optional\>)</code> - Specifies options used for Caching functionality.
-
-- `listener` <code>([listener][listener]: <optional\>)</code> - Specifies the addresses and ports on which the Agent will respond to requests.
-
-  ~> **Note:** On `SIGHUP` (`kill -SIGHUP $(pidof vault)`), Vault Agent will attempt to reload listener TLS configuration.
-  This method can be used to refresh certificates used by Vault Agent without having to restart its process.
-
-- `pid_file` `(string: "")` - Path to the file in which the agent's Process ID
-  (PID) should be stored
-
-- `exit_after_auth` `(bool: false)` - If set to `true`, the agent will exit
-  with code `0` after a single successful auth, where success means that a
-  token was retrieved and all sinks successfully wrote it. If you have
-  `template` stanzas defined in your agent configuration, the agent
-  waits for the configured templates to render successfully before
-  exiting. If you use environment templates (`env_template` ) and set
-  `exit_after_auth` to true, Vault agent will not run the child processes
-  defined in your `exec` stanza.
-
-- `disable_idle_connections` `(string array: [])` - A list of strings that disables idle connections for various features in Vault Agent.
-  Valid values include: `auto-auth`, `caching`, `proxying`, and `templating`. `proxying` configures this for the API proxy, which is
-  identical in function to `caching` for historical reasons. Can also be configured by setting the `VAULT_AGENT_DISABLE_IDLE_CONNECTIONS`
-  environment variable as a comma separated string. This environment variable will override any values found in a configuration file.
-
-- `disable_keep_alives` `(string array: [])` - A list of strings that disables keep alives for various features in Vault Agent.
-  Valid values include: `auto-auth`, `caching`, `proxying`, and `templating`. `proxying` configures this for the API proxy, which is
-  identical in function to `caching` for historical reasons. Can also be configured by setting the `VAULT_AGENT_DISABLE_KEEP_ALIVES`
-  environment variable as a comma separated string. This environment variable will override any values found in a configuration file.
-
-- `template` <code>([template][template]: <optional\>)</code> - Specifies options used for templating Vault secrets to files.
-
-- `template_config` <code>([template_config][template-config]: <optional\>)</code> - Specifies templating engine behavior.
-
-- `exec` <code>([exec][process-supervisor]: <optional\>)</code> - Specifies options for vault agent to run a child process
-  that injects secrets (via `env_template` stanzas) as environment variables.
-
-- `env_template` <code>([env_template][template]: <optional\>)</code> - Multiple blocks accepted. Each block contains
-  the options used for templating Vault secrets as environment variables via the
-  [process supervisor mode](/vault/docs/agent-and-proxy/agent/process-supervisor).
-
-- `telemetry` <code>([telemetry][telemetry]: <optional\>)</code> – Specifies the telemetry
-  reporting system. See the [telemetry Stanza](/vault/docs/agent-and-proxy/agent#telemetry-stanza) section below
-  for a list of metrics specific to Agent.
-
-- `log_level` - Equivalent to the [`-log-level` command-line flag](#_log_level).
-
-  ~> **Note:** On `SIGHUP` (`kill -SIGHUP $(pidof vault)`), Vault Agent will update the log level to the value
-  specified by configuration file (including overriding values set using CLI or environment variable parameters).
-
-- `log_format` - Equivalent to the [`-log-format` command-line flag](#_log_format).
-
-- `log_file` - Equivalent to the [`-log-file` command-line flag](#_log_file).
-
-- `log_rotate_duration` - Equivalent to the [`-log-rotate-duration` command-line flag](#_log_rotate_duration).
-
-- `log_rotate_bytes` - Equivalent to the [`-log-rotate-bytes` command-line flag](#_log_rotate_bytes).
-
-- `log_rotate_max_files` - Equivalent to the [`-log-rotate-max-files` command-line flag](#_log_rotate_max_files).
-
-### vault stanza
-
-There can at most be one top level `vault` block, and it has the following
-configuration entries:
-
-- `address` `(string: <optional>)` - The address of the Vault server to
-  connect to. This should be a Fully Qualified Domain Name (FQDN) or IP
-  such as `https://vault-fqdn:8200` or `https://172.16.9.8:8200`.
-  This value can be overridden by setting the `VAULT_ADDR` environment variable.
-
-- `ca_cert` `(string: <optional>)` - Path on the local disk to a single PEM-encoded
-  CA certificate to verify the Vault server's SSL certificate. This value can
-  be overridden by setting the `VAULT_CACERT` environment variable.
-
-- `ca_path` `(string: <optional>)` - Path on the local disk to a directory of
-  PEM-encoded CA certificates to verify the Vault server's SSL certificate.
-  This value can be overridden by setting the `VAULT_CAPATH` environment
-  variable.
-
-- `client_cert` `(string: <optional>)` - Path on the local disk to a single
-  PEM-encoded CA certificate to use for TLS authentication to the Vault server.
-  This value can be overridden by setting the `VAULT_CLIENT_CERT` environment
-  variable.
-
-- `client_key` `(string: <optional>)` - Path on the local disk to a single
-  PEM-encoded private key matching the client certificate from `client_cert`.
-  This value can be overridden by setting the `VAULT_CLIENT_KEY` environment
-  variable.
-
-- `tls_skip_verify` `(string: <optional>)` - Disable verification of TLS
-  certificates. Using this option is highly discouraged as it decreases the
-  security of data transmissions to and from the Vault server. This value can
-  be overridden by setting the `VAULT_SKIP_VERIFY` environment variable.
-
-- `tls_server_name` `(string: <optional>)` - Name to use as the SNI host when
-  connecting via TLS. This value can be overridden by setting the
-  `VAULT_TLS_SERVER_NAME` environment variable.
-
-- `namespace` `(string: <optional>)` - Namespace to use for all of Vault Agent's
-  requests to Vault. This can also be specified by command line or environment variable.
-  The order of precedence is: this setting lowest, followed by the environment variable
-  `VAULT_NAMESPACE`, and then the highest precedence command-line option `-namespace`.
-  If none of these are specified, defaults to the root namespace.
-
-#### retry stanza
-
-The `vault` stanza may contain a `retry` stanza that controls how failing Vault
-requests are handled, whether these requests are issued in order to render
-templates, or are proxied requests coming from the api proxy subsystem.
-Auto-auth, however, has its own notion of retrying and is not affected by this
-section.
-
-For requests from the templating engine, Vaul Agent will reset its retry counter and
-perform retries again once all retries are exhausted. This means that templating
-will retry on failures indefinitely unless `exit_on_retry_failure` from the
-[`template_config`][template-config] stanza is set to `true`.
-
-Here are the options for the `retry` stanza:
-
-- `num_retries` `(int: 12)` - Specify how many times a failing request will
-  be retried. A value of `0` translates to the default, i.e. 12 retries.
-  A value of `-1` disables retries. The environment variable `VAULT_MAX_RETRIES`
-  overrides this setting.
-
-There are a few subtleties to be aware of here. First, requests originating
-from the proxy cache will only be retried if they resulted in specific HTTP
-result codes: any 50x code except 501 ("not implemented"), as well as 412
-("precondition failed"); 412 is used in Vault Enterprise 1.7+ to indicate a
-stale read due to eventual consistency. Requests coming from the template
-subsystem are retried regardless of the failure.
-
-Second, templating retries may be performed by both the templating engine _and_
-the cache proxy if Vault Agent [persistent
-cache][persistent-cache] is enabled. This is due to the
-fact that templating requests go through the cache proxy when persistence is
-enabled.
-
-Third, the backoff algorithm used to set the time between retries differs for
-the template and cache subsystems. This is a technical limitation we hope
-to address in the future.
-
-### listener stanza
-
-Vault Agent supports one or more [listener][listener_main] stanzas. Listeners
-can be configured with or without [caching][caching], but will use the cache if it
-has been configured, and will enable the [API proxy][apiproxy]. In addition to the standard
-listener configuration, an Agent's listener configuration also supports the following:
-
-- `require_request_header` `(bool: false)` - Require that all incoming HTTP
-  requests on this listener must have an `X-Vault-Request: true` header entry.
-  Using this option offers an additional layer of protection from Server Side
-  Request Forgery attacks. Requests on the listener that do not have the proper
-  `X-Vault-Request` header will fail, with a HTTP response status code of `412: Precondition Failed`.
-
-- `role` `(string: default)` - `role` determines which APIs the listener serves.
-  It can be configured to `metrics_only` to serve only metrics, or the default role, `default`,
-  which serves everything (including metrics). The `require_request_header` does not apply
-  to `metrics_only` listeners.
-
-- `agent_api` <code>([agent_api][agent-api]: <optional\>)</code> - Manages optional Agent API endpoints.
-
-#### agent_api stanza
-
-- `enable_quit` `(bool: false)` - If set to `true`, the agent will enable the [quit](/vault/docs/agent-and-proxy/agent#quit) API.
-
-### telemetry stanza
-
-Vault Agent supports the [telemetry][telemetry] stanza and collects various
-runtime metrics about its performance, the auto-auth and the cache status:
-
-| Metric                           | Description                                          | Type    |
-| -------------------------------- | ---------------------------------------------------- | ------- |
-| `vault.agent.auth.failure`       | Number of authentication failures                    | counter |
-| `vault.agent.auth.success`       | Number of authentication successes                   | counter |
-| `vault.agent.proxy.success`      | Number of requests successfully proxied              | counter |
-| `vault.agent.proxy.client_error` | Number of requests for which Vault returned an error | counter |
-| `vault.agent.proxy.error`        | Number of requests the agent failed to proxy         | counter |
-| `vault.agent.cache.hit`          | Number of cache hits                                 | counter |
-| `vault.agent.cache.miss`         | Number of cache misses                               | counter |
-
-## Start Vault agent
-
-To run Vault Agent:
-
-1. [Download](/vault/downloads) the Vault binary where the client application runs
-   (virtual machine, Kubernetes pod, etc.)
-
-1. Create a Vault Agent configuration file. (See the [Example
-   Configuration](#example-configuration) section for an example configuration.)
-
-1. Start a Vault Agent with the configuration file.
-
-   **Example:**
-
-   ```shell-session
-   $ vault agent -config=/etc/vault/agent-config.hcl
-   ```
-
-   To get help, run:
-
-   ```shell-session
-   $ vault agent -h
-   ```
-
-As with Vault, the `-config` flag can be used in three different ways:
-
-- Use the flag once to name the path to a single specific configuration file.
-- Use the flag multiple times to name multiple configuration files, which will be composed at runtime.
-- Use the flag to name a directory of configuration files, the contents of which will be composed at runtime.
-
-## Example configuration
-
-An example configuration, with very contrived values, follows:
-
-```hcl
-pid_file = "./pidfile"
-
-vault {
-  address = "https://vault-fqdn:8200"
-  retry {
-    num_retries = 5
-  }
-}
-
-auto_auth {
-  method "aws" {
-    mount_path = "auth/aws-subaccount"
-    config = {
-      type = "iam"
-      role = "foobar"
-    }
-  }
-
-  sink "file" {
-    config = {
-      path = "/tmp/file-foo"
-    }
-  }
-
-  sink "file" {
-    wrap_ttl = "5m"
-    aad_env_var = "TEST_AAD_ENV"
-    dh_type = "curve25519"
-    dh_path = "/tmp/file-foo-dhpath2"
-    config = {
-      path = "/tmp/file-bar"
-    }
-  }
-}
-
-cache {
-  // An empty cache stanza still enables caching
-}
-
-api_proxy {
-  use_auto_auth_token = true
-}
-
-listener "unix" {
-  address = "/path/to/socket"
-  tls_disable = true
-
-  agent_api {
-    enable_quit = true
-  }
-}
-
-listener "tcp" {
-  address = "127.0.0.1:8100"
-  tls_disable = true
-}
-
-template {
-  source = "/etc/vault/server.key.ctmpl"
-  destination = "/etc/vault/server.key"
-}
-
-template {
-  source = "/etc/vault/server.crt.ctmpl"
-  destination = "/etc/vault/server.crt"
-}
-```
-
-[vault]: /vault/docs/agent-and-proxy/agent#vault-stanza
-[autoauth]: /vault/docs/agent-and-proxy/autoauth
-[caching]: /vault/docs/agent-and-proxy/agent/caching
-[apiproxy]: /vault/docs/agent-and-proxy/agent/apiproxy
-[persistent-cache]: /vault/docs/agent-and-proxy/agent/caching/persistent-caches
-[template]: /vault/docs/agent-and-proxy/agent/template
-[process-supervisor]: /vault/docs/agent-and-proxy/agent/process-supervisor
-[template-config]: /vault/docs/agent-and-proxy/agent/template#template-configurations
-[agent-api]: /vault/docs/agent-and-proxy/agent/#agent_api-stanza
-[listener]: /vault/docs/agent-and-proxy/agent#listener-stanza
-[listener_main]: /vault/docs/configuration/listener/tcp
-[winsvc]: /vault/docs/agent-and-proxy/agent/winsvc
-[telemetry]: /vault/docs/configuration/telemetry
diff --git a/website/content/docs/agent-and-proxy/agent/process-supervisor.mdx b/website/content/docs/agent-and-proxy/agent/process-supervisor.mdx
deleted file mode 100644
index 210967aeb0e..00000000000
--- a/website/content/docs/agent-and-proxy/agent/process-supervisor.mdx
+++ /dev/null
@@ -1,157 +0,0 @@
----
-layout: docs
-page_title: Vault Agent's Process Supervisor Mode
-description: >-
-  Vault Agent's Process Supervisor Mode allows Vault secrets to be injected
-  into a process via environment variables using Consul Template markup.
----
-
-# Vault Agent's Process Supervisor mode
-
-Vault Agent's Process Supervisor Mode allows Vault secrets to be injected into
-a process via environment variables using
-[Consul Template markup][consul-templating-language].
-
--> If you are running your applications in a Kubernetes cluster, we recommend
-  evaluating the [Vault Secrets Operator](/vault/docs/platform/k8s/vso) and
-  the [Vault Agent Sidecar Injector](/vault/docs/platform/k8s/injector)
-  instead.
-
-## Functionality
-
-Vault Agent will inject secrets referenced in the `env_template` configuration
-blocks as environment variables into the child process specified in the `exec` block.
-
-When you start Vault Agent in process supervisor mode, it will wait until each
-environment variable template has rendered at least once before starting the
-process. If `restart_on_secret_changes` is set to `always` (default), Agent
-will restart the process whenever an update to an injected secret is detected.
-This could be either a static secret update (done on
-[`static_secret_render_interval`](/vault/docs/agent-and-proxy/agent/template#static_secret_render_interval))
-or dynamic secret being close to its expiration.
-
-In many ways, Vault Agent will mirror the child process. Standard intput and
-output streams (`stdin` / `stdout` / `stderr`) are all forwarded to the child
-process. Additionally, Vault Agent will exit when the child process exits on
-its own with the same exit code.
-
-## Configuration
-
--> Agent's [generate-config](/vault/docs/agent-and-proxy/agent/generate-config)
-   tool will help you get started by generating a valid agent configuration
-   file from the given inputs.
-
-The process supervisor mode requires at least one `env_template` block and
-exactly one top level `exec` block. It is incompatible with regular file
-`template` entries.
-
-### `env_template`
-
-`env_template` stanza maps the template specified in the `contents` field or
-referenced in the `source` field to the environment variable name in the title
-of the stanza. It uses the same
-[templating language](/vault/docs/agent-and-proxy/agent/template#templating-language)
-as file templates but permits only a subset of
-[its configuration parameters](/vault/docs/agent-and-proxy/agent/template#template_configurations):
-
-- environment variable name `(string: <required>)` - the name of the
-  environment variable to which the contents of the template should map.
-
-- `contents` `(string: "")` - This option allows embedding the contents of
-  a template in the configuration file rather then supplying the `source` path to
-  the template file. This is useful for short templates. This option is mutually
-  exclusive with the `source` option.
-
-- `source` `(string: "")` - Path on disk to use as the input template. This
-  option is required if not using the `contents` option.
-
-- `error_on_missing_key` `(bool: false)` - Exit with an error when accessing
-  a struct or map field/key that does notexist. The default behavior will print `<no value>`
-  when accessing a field that does not exist. It is highly recommended you set this
-  to "true". Also see
-  [`exit_on_retry_failure` in global Vault Agent Template Config](/vault/docs/agent-and-proxy/agent/template#interaction-between-exit_on_retry_failure-and-error_on_missing_key).
-
-- `left_delimiter` `(string: "{{")` - Delimiter to use in the template. The
-  default is "{{" but for some templates, it may be easier to use a different
-  delimiter that does not conflict with the output file itself.
-
-- `right_delimiter` `(string: "}}")` - Delimiter to use in the template. The
-  default is "}}" but for some templates, it may be easier to use a different
-  delimiter that does not conflict with the output file itself.
-
-### `exec`
-
-The top level `exec` block has the following configuration entries.
-
-- `command` `(string array: required)` - Specify the command for the child
-  process with optional arguments. The executable's path must be either
-  absolute or relative to the current working directory.
-
-- `restart_on_secret_changes` `(string: "always")` - Controls whether agent
-  will restart the child process on secret changes. There are two types of
-  secret changes relevant to this configuration: a static secret update (on
-  [static_secret_render_interval`](/vault/docs/agent-and-proxy/agent/template#static_secret_render_interval))
-  and dynamic secret being close to its expiration. The configuration supports
-  two options: `always` and `never`.
-
-- `restart_stop_signal` `(string: "SIGTERM")` - Signal to send to the child
-  process when a secret has been updated and the process needs to be restarted.
-  The process has 30 seconds after this signal is sent until `SIGKILL` is sent
-  to force the child process to stop.
-
-
-## Configuration example
-
-The following example was generated using
-[`vault agent generate-config`](/vault/docs/agent-and-proxy/agent/generate-config),
-a configuration helper tool. Given this configuration, Vault Agent will run
-the child process (`./my-app arg1 arg2`) with two additional environment
-variables (`FOO_USER` and `FOO_PASSWORD`) populated with secrets from Vault.
-
-```hcl
-auto_auth {
-
-  method {
-    type = "token_file"
-
-    config {
-      token_file_path = "/Users/avean/.vault-token"
-    }
-  }
-}
-
-template_config {
-  static_secret_render_interval = "5m"
-  exit_on_retry_failure         = true
-  max_connections_per_host      = 10
-}
-
-vault {
-  address = "http://localhost:8200"
-}
-
-env_template "FOO_PASSWORD" {
-  contents             = "{{ with secret \"secret/data/foo\" }}{{ .Data.data.password }}{{ end }}"
-  error_on_missing_key = true
-}
-env_template "FOO_USER" {
-  contents             = "{{ with secret \"secret/data/foo\" }}{{ .Data.data.user }}{{ end }}"
-  error_on_missing_key = true
-}
-
-exec {
-  command                   = ["./my-app", "arg1", "arg2"]
-  restart_on_secret_changes = "always"
-  restart_stop_signal       = "SIGTERM"
-}
-```
-
-[consul-templating-language]: https://github.com/hashicorp/consul-template/blob/v0.28.1/docs/templating-language.md
-[template-config]: /vault/docs/agent-and-proxy/agent/template#template-configurations
-
-
-## Tutorial
-
-Refer to the [Vault Agent - secrets as environment
-variables](/vault/tutorials/vault-agent/agent-env-vars) tutorial for an
-end-to-end example.
diff --git a/website/content/docs/agent-and-proxy/agent/template.mdx b/website/content/docs/agent-and-proxy/agent/template.mdx
deleted file mode 100644
index 61939cf45cd..00000000000
--- a/website/content/docs/agent-and-proxy/agent/template.mdx
+++ /dev/null
@@ -1,362 +0,0 @@
----
-layout: docs
-page_title: Vault Agent Template
-description: >-
-  Vault Agent's Template functionality allows Vault secrets to be rendered to
-  files using Consul Template markup.
----
-
-# Vault Agent templates
-
-Vault Agent's Template functionality allows Vault secrets to be rendered to files
-or environment variables (via the [Process Supervisor Mode](/vault/docs/agent-and-proxy/agent/process-supervisor))
-using [Consul Template markup][consul-templating-language].
-
-## Functionality
-
-The `template_config` stanza configures overall default behavior for the
-templating engine. Note that `template_config` can only be defined once, and is
-different from the `template` stanza. Unlike `template` which focuses on where
-and how a specific secret is rendered, `template_config` contains parameters
-affecting how the templating engine as a whole behaves and its interaction with
-the rest of Agent. This includes, but is not limited to, program exit behavior.
-Other parameters that apply to the templating engine as a whole may be added
-over time.
-
-The `template` stanza configures the Vault agent for rendering secrets to files
-using Consul Template markup language. Multiple `template` stanzas can be
-defined to render multiple files.
-
-When the agent is started with templating enabled, it will attempt to acquire a
-Vault token using the configured auto-auth Method. On failure, it will back off
-for a short while (including some randomness to help prevent thundering herd
-scenarios) and retry. On success, secrets defined in the templates will be
-retrieved from Vault and rendered locally.
-
-## Templating language
-
-The template output content can be provided directly as part of the `contents`
-option in a `template` stanza or as a separate `.ctmpl` file and specified in
-the `source` option of a `template` stanza.
-
-In order to fetch secrets from Vault, whether those are static secrets, dynamic
-credentials, or certificates, Vault Agent templates require the use of the
-`secret`
-[function](https://github.com/hashicorp/consul-template/blob/master/docs/templating-language.md#secret)
-or `pkiCert`
-[function](https://github.com/hashicorp/consul-template/blob/main/docs/templating-language.md#pkicert)
-from Consul Template.
-
-The `secret` function works for all types of secrets and depending on the type
-of secret that's being rendered by this function, template will have different
-renewal behavior as detailed in the [Renewals
-section](#renewals-and-updating-secrets). The `pkiCert` function is intended to
-work specifically for certificates issued by the [PKI Secrets
-Engine](/vault/docs/secrets/pki). Refer to the [Certificates](#certificates) section
-for differences in certificate renewal behavior between `secret` and `pkiCert`.
-
-The following links contain additional resources for the templating language used by Vault Agent templating.
-
-- [Consul Templating Documentation][consul-templating-language]
-- [Go Templating Language Documentation](https://pkg.go.dev/text/template#pkg-overview)
-
-### Template language example
-
-The following is an example of a template that retrieves a generic secret from Vault's
-KV store:
-```
-{{ with secret "secret/my-secret" }}
-{{ .Data.data.foo }}
-{{ end }}
-```
-
-The following is an example of a template that issues a PKI certificate in
-Vault's PKI secrets engine. The fetching of the certificate or key from a PKI role
-through this function will be based on the certificate's expiration.
-
-To generate a new certificate and create a bundle with the key, certificate, and CA, use:
-```
-{{ with pkiCert "pki/issue/my-domain-dot-com" "common_name=foo.example.com" }}
-{{ .Data.Key }}
-{{ .Data.Cert }}
-{{ .Data.CA }}
-{{ end }}
-```
-
-To fetch only the issuing CA for this mount, use:
-
-```
-{{- with secret "pki/cert/ca" -}}
-{{ .Data.certificate }}
-{{- end -}}
-```
-
-Alternatively, `pki/cert/ca_chain` can be used to fetch the full CA chain.
-
-## Global configurations
-
-The top level `template_config` block has the following configuration entries that affect
-all templates:
-
-- `exit_on_retry_failure` `(bool: false)` - This option configures Vault Agent
-to exit after it has exhausted its number of template retry attempts due to
-failures.
-
-- `static_secret_render_interval` `(string or integer: 5m)` - If specified, configures
-  how often Vault Agent Template should render non-leased secrets such as KV v2.
-  This setting will not change how often Vault Agent Templating renders leased
-  secrets. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `max_connections_per_host` `(int: 10)` - Limits the total number of connections
-  that the Vault Agent templating engine can use for a particular Vault host. This limit
-  includes connections in the dialing, active, and idle states.
-
-- `lease_renewal_threshold` `(float: 0.9)` - How long Vault Agent's template
-  engine should wait for to refresh dynamic, non-renewable leases, measured as
-  a fraction of the lease duration.
-
-### `template_config` stanza example
-
-```hcl
-template_config {
-  exit_on_retry_failure = true
-  static_secret_render_interval = "10m"
-  max_connections_per_host = 20
-}
-```
-
-In another example `template_config` with [`error_on_missing_key` parameter in the template stanza](/vault/docs/agent-and-proxy/agent/template#error_on_missing_key)
-as well as `exit_on_retry_failure` result in the agent exiting in case of no key
-/ value issues instead of the default retry behavior.
-
-```hcl
-template_config {
-  exit_on_retry_failure = true
-  static_secret_render_interval = "10m"
-  max_connections_per_host = 20
-}
-
-template {
-  source      = "/tmp/agent/template.ctmpl"
-  destination = "/tmp/agent/render.txt"
-  error_on_missing_key = true
-}
-```
-
-### Interaction between `exit_on_retry_failure` and `error_on_missing_key`
-
-The parameter
-[`error_on_missing_key`](/vault/docs/agent-and-proxy/agent/template#error_on_missing_key) can be
-specified within the `template` stanza which determines if a template should
-error when a key is missing in the secret. When `error_on_missing_key` is not
-specified or set to `false` and the key to render is not in the secret's
-response, the templating engine will ignore it (or render `"<no value>"`) and
-continue on with its rendering.
-
-If the desire is to have Agent fail and exit on a missing key, both
-`template.error_on_missing_key` and `template_config.exit_on_retry_failure` must
-be set to true. Otherwise, the templating engine will error and render to its
-destination, but agent will not exit and will retry until the key exists or until
-the process is terminated.
-
-Note that a missing key from a secret's response is different from a missing or
-non-existent secret. The templating engine will always error if a secret is
-missing, but will only error for a missing key if `error_on_missing_key` is set.
-Whether Vault Agent will exit when the templating engine errors depends on the
-value of `exit_on_retry_failure`.
-
-## Template configurations
-
-The top level `template` block has multiple configuration entries. The
-parameters found in the template configuration section in the consul-template
-[documentation
-page](https://github.com/hashicorp/consul-template/blob/main/docs/configuration.md#templates)
-can be used here:
-
-<Tip>
-
-The parameters marked with `Δ` below are only applicable to file templates and
-cannot be used with `env_template` entries in process supervisor mode.
-
-</Tip>
-
-- `source` `(string: "")` - Path on disk to use as the input template. This
-  option is required if not using the `contents` option.
-- `destination`Δ `(string: required)` - Path on disk where the rendered secrets should
-  be created. If the parent directories do not exist, Vault
-  Agent will attempt to create them, unless `create_dest_dirs` is false.
-- `create_dest_dirs`Δ `(bool: true)` - This option tells Vault Agent to create
-  the parent directories of the destination path if they do not exist.
-- `contents` `(string: "")` - This option allows embedding the contents of
-  a template in the configuration file rather then supplying the `source` path to
-  the template file. This is useful for short templates. This option is mutually
-  exclusive with the `source` option.
-- `command`Δ `(string: "")` - This is the optional command to run when the
-  template is rendered. The command will only run if the resulting template changes.
-  The command must return within 30s (configurable), and it must have a successful
-  exit code. Vault Agent is not a replacement for a process monitor or init system.
-  This is deprecated in favor of the `exec` option.
-- `command_timeout`Δ `(duration: 30s)` - This is the maximum amount of time to
-  wait for the optional command to return. This is deprecated in favor of the
-  `exec` option.
-- `error_on_missing_key` `(bool: false)` - Exit with an error when accessing
-  a struct or map field/key that does notexist. The default behavior will print `<no value>`
-  when accessing a field that does not exist. It is highly recommended you set this
-  to "true". Also see [`exit_on_retry_failure` in global Vault Agent Template Config](/vault/docs/agent-and-proxy/agent/template#interaction-between-exit_on_retry_failure-and-error_on_missing_key).
-- `exec`Δ `(object: optional)` - The exec block executes a command when the
-  template is rendered and the output has changed. The block parameters are
-  `command` `(string or array: required)` and `timeout` `(string: optional, defaults
-  to 30s)`. `command` can be given as a string or array of strings to execute, such as
-  `"touch myfile"` or `["touch", "myfile"]`. To protect against command injection, we
-  strongly recommend using an array of strings, and we attempt to parse that way first.
-  Note also that using a comma with the string approach will cause it to be interpreted as an
-  array, which may not be desirable.
-- `perms`Δ `(string: "")` - This is the permission to render the file. If
-  this option is left unspecified, Vault Agent will attempt to match the permissions
-  of the file that already exists at the destination path. If no file exists at that
-  path, the permissions are 0644.
-- `backup`Δ `(bool: true)` - This option backs up the previously rendered template
-  at the destination path before writing a new one. It keeps exactly one backup.
-  This option is useful for preventing accidental changes to the data without having
-  a rollback strategy.
-- `left_delimiter` `(string: "{{")` - Delimiter to use in the template. The
-  default is "{{" but for some templates, it may be easier to use a different
-  delimiter that does not conflict with the output file itself.
-- `right_delimiter` `(string: "}}")` - Delimiter to use in the template. The
-  default is "}}" but for some templates, it may be easier to use a different
-  delimiter that does not conflict with the output file itself.
-- `sandbox_path`Δ `(string: "")` - If a sandbox path is provided, any path
-  provided to the `file` function is checked that it falls within the sandbox path.
-  Relative paths that try to traverse outside the sandbox path will exit with an error.
-- `wait`Δ `(object: required)` - This is the `minimum(:maximum)` to wait before rendering
-  a new template to disk and triggering a command, separated by a colon (`:`).
-
-
-### Example `template` stanza
-
-```hcl
-template {
-  source      = "/tmp/agent/template.ctmpl"
-  destination = "/tmp/agent/render.txt"
-  error_on_missing_key = true
-}
-```
-
-If you only want to use the Vault agent to render one or more templates and do
-not need to sink the acquired credentials, you can omit the `sink` stanza from
-the `auto_auth` stanza in the agent configuration.
-
-## Renewals and updating secrets
-
-The Vault Agent templating automatically renews and fetches secrets/tokens.
-Unlike [Vault Agent caching](/vault/docs/agent-and-proxy/agent/caching), the behavior of how Vault Agent
-templating does this depends on the type of secret or token. The following is a
-high level overview of different behaviors.
-
-### Renewable secrets
-
-If a secret or token is renewable, Vault Agent will renew the secret after 2/3
-of the secret's lease duration has elapsed.
-
-### Non-Renewable secrets
-
-If a secret or token isn't renewable or leased, Vault Agent will fetch the secret every 5 minutes.
-This can be configured using Template config [static_secret_render_interval](/vault/docs/agent-and-proxy/agent/template#static_secret_render_interval) (requires Vault 1.8+).
-Non-renewable secrets include (but not limited to) [KV Version 2](/vault/docs/secrets/kv/kv-v2).
-
-### Non-Renewable leased secrets
-
-If a secret or token is non-renewable but leased, Vault Agent will fetch the secret when 85% of the
-secrets time-to-live (TTL) is reached. Leased, non-renewable secrets include (but not limited
-to) dynamic secrets such as [database credentials](/vault/docs/secrets/databases) and [KV Version 1](/vault/docs/secrets/kv/kv-v1).
-
-### Static roles
-
-If a secret has a `rotation_period`, such as a [database static role](/vault/docs/secrets/databases#static-roles),
-Vault Agent template will fetch the new secret as it changes in Vault. It does
-this by inspecting the secret's time-to-live (TTL).
-
-### Certificates
-
-As of Vault 1.11, certificates can be rendered using either `pkiCert` or
-`secret` template functions, although it is recommended to use `pkiCert` to
-avoid unnecessarily generating certificates whenever Agent restarts or
-re-authenticates.
-
-#### Rendering using the `pkiCert` template function
-
-If a [certificate](/vault/docs/secrets/pki) is rendered using the `pkiCert` template
-function, Vault Agent template will have the following fetching and re-rendering
-behaviors on certificates:
-
-- Fetches a new certificate on Agent startup if none has been previously
-rendered or the current rendered one has expired.
-- On Agent's auto-auth re-authentication, due to a token expiry for example,
-skip fetching unless the current rendered one has expired.
-
-#### Rendering using the `secret` template function
-
-If a [certificate](/vault/docs/secrets/pki) is rendered using the `secret` template
-function, Vault Agent template will have the following fetching and re-rendering
-behaviors on certificates:
-
-- Fetches a new certificate on Agent startup, even if previously rendered
-  certificates are still valid.
-- If `generate_lease` is unset or set to `false`, it uses the certificate's
-  `validTo` field to determine re-fetch interval.
-- If `generate_lease` is set to `true`, apply the non-renewable, leased secret
-  rules.
-- On Agent's auto-auth re-authentication, due to a token expiry for example, it
-  fetches and re-renders a new certificate even if the existing certificate is
-  valid.
-
-## Templating configuration example
-
-The following demonstrates Vault Agent Templates configuration blocks.
-
-```hcl
-# Other Vault agent configuration blocks
-# ...
-
-template_config {
-  static_secret_render_interval = "10m"
-  exit_on_retry_failure = true
-  max_connections_per_host = 20
-}
-
-template {
-  source      = "/tmp/agent/template.ctmpl"
-  destination = "/tmp/agent/render.txt"
-}
-
-template {
-  contents     = "{{ with secret \"secret/my-secret\" }}{{ .Data.data.foo }}{{ end }}"
-  destination  = "/tmp/agent/render-content.txt"
-}
-```
-
-And the following demonstrates how the templates look when using `env_template` with
-[Process Supervisor Mode](/vault/docs/agent-and-proxy/agent/process-supervisor)
-
-
-```hcl
-# Other Vault agent configuration blocks
-# ...
-
-template_config {
-  static_secret_render_interval = "10m"
-  exit_on_retry_failure = true
-  max_connections_per_host = 20
-}
-
-env_template "MY_ENV_VAR" {
-  contents = "{{ with secret \"secret/my-secret\" }}{{ .Data.data.foo }}{{ end }}"
-}
-
-env_template "ENV_VAR_FROM_FILE" {
-  source = "/tmp/agent/template.ctmpl"
-}
-```
-
-[consul-templating-language]: https://github.com/hashicorp/consul-template/blob/v0.28.1/docs/templating-language.md
-[process-supervisor]: /vault/docs/agent-and-proxy/agent/process-supervisor
diff --git a/website/content/docs/agent-and-proxy/agent/versions.mdx b/website/content/docs/agent-and-proxy/agent/versions.mdx
deleted file mode 100644
index 9d8e6a64cff..00000000000
--- a/website/content/docs/agent-and-proxy/agent/versions.mdx
+++ /dev/null
@@ -1,64 +0,0 @@
----
-layout: docs
-page_title: Vault Agent Version Compatibility
-description: |-
-  Guidelines for running different versions of Agent and Vault server
----
-
-# Running different versions of Agent and Vault server
-
-There is no requirement to run identical versions of Vault Agent and Vault server.
-It is safe to run different versions. However, you may not be able to take
-advantage of all the newest features in Vault if you do not upgrade to
-the most recent versions of Agent and Vault server.
-
-The Agent writes a note to the logs when it detects a mismatch between
-Agent and Vault server versions. The note is purely informative to assist
-with debugging when the problem may be related to a version mismatch.
-For example, when a newer Agent version expects functionality that is
-not available in an older version of Vault.
-
-This document describes the common cases.  There may be occasional exceptions, which if intentional will be called out in the CHANGELOG in a `CHANGES` section.  If unintentional/undocumented these should be treated as bugs and reported.
-
-## When Vault Agent is older
-
-In most cases, Vault server upgrades are backwards compatible with
-older versions of Vault Agent. In the rare case where a Vault upgrade is
-**not** backwards compatible, we document the relevant information in
-the Vault upgrade guide.
-
-Auto-auth:
-- new auth methods that have been introduced since Agent was built will be unavailable
-- existing auth methods should continue to function normally
-
-Proxy:
-- since Agent simply mirrors the incoming requests, even if an incoming request uses an endpoint that didn't exist when that version of Agent was compiled, that won't impede Agent's ability to proxy the request
-
-Templating:
-- the templating language features that interact with the Vault server use stable Vault APIs to retrieve and renew secrets
-- even if new secret engine types are introduced in newer Vault releases, these should not require an Agent upgrade to access via templates
-
-##  When Vault Agent is newer
-
-Newer Vault Agent versions will not work with older versions of Vault if
-the Agent depends on features that do not exist in older Vault server
-versions. Whenever possible, we release newer functionality as opt-in
-and provide graceful degradation when connecting to an older Vault
-server instance. But the new functionality may be required in cases
-where the change relates  unless there's a very good reason (such as a
-serious security flaw being patched)
-
-Auto-auth:
-- Agent may support authentication methods that are unavailable in older versions of Vault.
-- Agent may make use of newer functionality for existing authentication methods.
-
-Proxy:
-- since Agent simply mirrors the incoming requests, it is unlikely that incompatibilities would surface in proxying, but new functionality may not be available
-- example: When client-controlled consistency support was added to Agent, it started looking for X-Vault-Index headers in responses, and started providing X-Vault-Index headers in proxied requests.  Older Vault Enterprise servers that don't make use of these headers would ignore the new request header and not emit them either.  Agent proxying behaviour continued unchanged, unable to take advantage of the new functionality, but also not impeded in its previously existing behavior.
-
-Templating:
-- We do not anticipate incompatibility between Agent templating and
-older Vault servers. However, it is possible to write templates that
-makes request for functionality not available in the upstream Vault
-server. For example, `{{ with secret "secret/my-secret?some-new-option" }}`
-- we would not deliberately make a change to templating that breaks existing deployments
diff --git a/website/content/docs/agent-and-proxy/agent/winsvc.mdx b/website/content/docs/agent-and-proxy/agent/winsvc.mdx
deleted file mode 100644
index 80f19a94c23..00000000000
--- a/website/content/docs/agent-and-proxy/agent/winsvc.mdx
+++ /dev/null
@@ -1,112 +0,0 @@
----
-layout: docs
-page_title: Vault Agent Windows Service
-description: >-
-  Vault Agent can be run as a Windows service.
----
-
-# Vault Agent Windows service
-
-Vault Agent can be run as a Windows service. In order to do this, you need to register Vault Agent with the Windows
-Service Control Manager. After Vault Agent is registered, it can be started like any other Windows
-service.
-
-**Note:** These commands should be run in a PowerShell session with Administrator capabilities.
-
-## Register Vault Agent as a Windows service
-
-There are multiple ways to register Vault Agent as a Windows service. One way is to use
-[`sc.exe`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create). `sc.exe` works
-best if the path to your Vault binary and its associated agent config file do not contain spaces. `sc.exe` can be
-pretty tricky to get working correctly if your path contains spaces, as paths containing spaces must be quoted,
-and escaping quotes correctly in a way that makes `sc.exe` happy is non-trivial. If your path contains spaces, or you prefer not to use `sc.exe`, another
-alternative is to use the
-[`New-Service`](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-service?view=powershell-5.1)
-cmdlet. `New-Service` is less picky about the method used to escape quotes, and can sometimes be easier. Examples of
-both will be shown below.
-
-### Using sc.exe
-
-~> **Important Note:** Ensure the executable path of the service is quoted, especially when it contains spaces, to avoid
-potential privilege escalation risks.
-
-If you use `sc.exe`, make sure you specify `sc.exe` explicitly, and not just `sc`. The command below shows the creation
-of Vault Agent as a service, using "Vault Agent" as the display name, and starting automatically when Windows starts.
-The `binPath` argument should include the fully qualified path to the Vault executable, as well as any arguments required.
-
-```shell-session
-PS C:\Windows\system32> sc.exe create VaultAgent binPath="C:\vault\vault.exe agent -config=C:\vault\agent-config.hcl" displayName="Vault Agent" start=auto
-[SC] CreateService SUCCESS
-```
-
-Note that the spacing after the `=` in all of the arguments is intentional and required.
-
-If you receive a success message, your service is registered with the service manager.
-
-If you get an error, please verify the path to the binary and check the arguments, by running the contents of
-`binPath=` directly in a PowerShell session and observing the results.
-
-### Using New-Service
-
-The syntax is slightly different for `New-Service`, but the gist is the same. The invocation below is equivalent to the
-`sc.exe` one above.
-
-```shell-session
-PS C:\Windows\system32> New-Service -Name "VaultAgent" -BinaryPathName "C:\vault\vault.exe agent -config=C:\vault\agent-config.hcl" -DisplayName "Vault Agent" -StartupType "Automatic"
-
-Status   Name               DisplayName
-------   ----               -----------
-Stopped  VaultAgent         Vault Agent
-```
-
-As mentioned previously, `New-Service` is easier to use if the path to your Vault executable and/or agent config contains spaces.
-Below is an example of how to configure Vault Agent as a service using a path with spaces.
-
-```shell-session
-PS C:\Windows\system32> New-Service -Name "VaultAgent" -BinaryPathName '"C:\my dir\vault.exe" agent -config="C:\my dir\agent-config.hcl"' -DisplayName "Vault Agent" -StartupType "Automatic"
-
-Status   Name               DisplayName
-------   ----               -----------
-Stopped  VaultAgent         Vault Agent
-```
-
-Note that only the paths themselves are double quoted, and the entire `BinaryPathName` is wrapped in single quotes, in order
-to escape the double quotes used for the paths.
-
-If anything goes wrong during this process, and you need to manually edit the path later, use the Registry Editor to find
-the following key: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VaultAgent`. You can edit the `ImagePath` value
-at that key to the correct path.
-
-## Start the Vault Agent service
-
-There are multiple ways to start the service.
-
-- Using the `sc.exe` command.
-- Using the `Start-Service` cmdlet.
-- Go to the Windows Service Manager, and look for **VaultAgent** in the service name column. Click the
-  `Start` button to start the service.
-
-### Example starting Vault Agent using `sc.exe`
-
-```shell-session
-PS C:\Windows\system32> sc.exe start VaultAgent
-
-SERVICE_NAME: VaultAgent
-     TYPE               : 10  WIN32_OWN_PROCESS
-     STATE              : 4  RUNNING
-                             (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
-     WIN32_EXIT_CODE    : 0  (0x0)
-     SERVICE_EXIT_CODE  : 0  (0x0)
-     CHECKPOINT         : 0x0
-     WAIT_HINT          : 0x0
-     PID                : 6548
-     FLAGS              :
-```
-
-### Example starting Vault Agent using `Start-Service`
-
-```shell-session
-PS C:\Windows\system32> Start-Service -Name "VaultAgent"
-```
-
-Note that in the case where the service was started successfully, `New-Service` does not return any output.
diff --git a/website/content/docs/agent-and-proxy/autoauth/index.mdx b/website/content/docs/agent-and-proxy/autoauth/index.mdx
deleted file mode 100644
index f24a2d03e8a..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/index.mdx
+++ /dev/null
@@ -1,351 +0,0 @@
----
-layout: docs
-page_title: Vault Agent and Vault Proxy Auto-Auth
-description: |-
-  Vault Agent and Vault Proxy's Auto-Auth functionality allows easy and automatic
-  authentication to Vault in a variety of environments.
----
-
-# Vault Agent and Vault Proxy Auto-Auth
-
-The Auto-Auth functionality of Vault Agent and Vault Proxy allow for
-easy authentication in a wide variety of environments.
-
-## Functionality
-
-Auto-Auth consists of two parts: a Method, which is the authentication method
-that should be used in the current environment; and any number of Sinks, which
-are locations where the agent should write a token any time the current token
-value has changed.
-
-When Vault Agent or Vault Proxy are started with Auto-Auth enabled, it will attempt to acquire a
-Vault token using the configured Method. On failure, it will exponentially back
-off and then retry. On success, unless the auth method is configured to wrap
-the tokens, it will keep the resulting token renewed until renewal is no longer
-allowed or fails, at which point it will attempt to reauthenticate.
-
-Every time an authentication is successful, the token is written to the
-configured Sinks, subject to their configuration.
-
-## Advanced functionality
-
-Sinks support some advanced features, including the ability for the written
-values to be encrypted or
-[response-wrapped](/vault/docs/concepts/response-wrapping).
-
-Both mechanisms can be used concurrently; in this case, the value will be
-response-wrapped, then encrypted.
-
-### Response-Wrapping tokens
-
-There are two ways that tokens can be response-wrapped:
-
-1. By the auth method. This allows the end client to introspect the
-   `creation_path` of the token, helping prevent Man-In-The-Middle (MITM)
-   attacks. However, because auto-auth cannot then unwrap the token and rewrap
-   it without modifying the `creation_path`, we are not able to renew the
-   token; it is up to the end client to renew the token. Agent and Proxy both
-   stay daemonized in this mode since some auth methods allow for reauthentication
-   on certain events.
-
-2. By any of the token sinks. Because more than one sink can be configured, the
-   token must be wrapped after it is fetched, rather than wrapped by Vault as
-   it's being returned. As a result, the `creation_path` will always be
-   `sys/wrapping/wrap`, and validation of this field cannot be used as
-   protection against MITM attacks. However, this mode allows auto-auth to keep
-   the token renewed for the end client and automatically reauthenticate when
-   it expires.
-
-### Encrypting tokens
-
-~> Support for encrypted tokens is experimental; if input/output formats
-change, we will make every effort to provide backwards compatibility.
-
-Tokens can be encrypted, using a Diffie-Hellman exchange to generate an
-ephemeral key. In this mechanism, the client receiving the token writes a
-generated public key to a file. The sink responsible for writing the token to
-that client looks for this public key and uses it to compute a shared secret
-key, which is then used to encrypt the token via AES-GCM. The nonce, encrypted
-payload, and the sink's public key are then written to the output file, where
-the client can compute the shared secret and decrypt the token value.
-
-~> NOTE: Token encryption is not a protection against MITM attacks! The purpose
-of this feature is for forward-secrecy and coverage against bare token values
-being persisted. A MITM that can write to the sink's output and/or client
-public-key input files could attack this exchange. Using TLS to protect the
-transit of tokens is highly recommended.
-
-To help mitigate MITM attacks, additional authenticated data (AAD) can be
-provided to Agent and Proxy. This data is written as part of the AES-GCM tag and must
-match on both Agent and Proxy and the client. This of course means that protecting
-this AAD becomes important, but it provides another layer for an attacker to
-have to overcome. For instance, if the attacker has access to the file system
-where the token is being written, but not to read configuration or read
-environment variables, this AAD can be generated and passed to Agent or Proxy and
-the client in ways that would be difficult for the attacker to find.
-
-When using AAD, it is always a good idea for this to be as fresh as possible;
-generate a value and pass it to your client and Agent or Proxy on startup. Additionally,
-Agent and Proxy a Trust On First Use model; after it finds a generated public key,
-it will reuse that public key instead of looking for new values that have been
-written.
-
-If writing a client that uses this feature, it will likely be helpful to look
-at the
-[dhutil](https://github.com/hashicorp/vault/blob/main/helper/dhutil/dhutil.go)
-library. This shows the expected format of the public key input and envelope
-output formats.
-
-## Configuration
-
-The top level `auto_auth` block has two configuration entries:
-
-- `method` `(object: required)` - Configuration for the method
-
-- `sinks` `(array of objects: optional)` - Configuration for the sinks
-
-### Configuration (Method)
-
-~> Auto-auth does not support using tokens with a limited number of uses. Auto-auth
-does not track the number of uses remaining, and may allow the token to
-expire before attempting to renew it. For example, if using AppRole auto-auth,
-you must use 0 (meaning unlimited) as the value for
-[`token_num_uses`](/vault/api-docs/auth/approle#token_num_uses).
-
-These are common configuration values that live within the `method` block:
-
-- `type` `(string: required)` - The type of the method to use, e.g. `aws`,
-  `gcp`, `azure`, etc. _Note_: when using HCL this can be used as the key for
-  the block, e.g. `method "aws" {...}`.
-
-- `mount_path` `(string: optional)` - The mount path of the method. If not
-  specified, defaults to a value of `auth/<method type>`.
-
-- `namespace` `(string: optional)` - Namespace in which the mount lives.
-  The order of precedence is: this setting lowest, followed by the
-  environment variable `VAULT_NAMESPACE`, and then the highest precedence
-  command-line option `-namespace`.
-  If none of these are specified, defaults to the root namespace.
-  Note that because sink response wrapping and templating are also based
-  on the client created by auto-auth, they use the same namespace.
-  If specified alongside the `namespace` option in the Vault Stanza of
-  [Vault Agent](/vault/docs/agent-and-proxy/agent#vault-stanza) or
-  [Vault Proxy](/vault/docs/agent-and-proxy/proxy#vault-stanza), that
-  configuration will take precedence on everything except auto-auth.
-
-- `wrap_ttl` `(string or integer: optional)` - If specified, the written token
-  will be response-wrapped by auto-auth. This is more secure than wrapping by
-  sinks, but does not allow the auto-auth to keep the token renewed or
-  automatically reauthenticate when it expires. Rather than a simple string,
-  the written value will be a JSON-encoded
-  [SecretWrapInfo](https://godoc.org/github.com/hashicorp/vault/api#SecretWrapInfo)
-  structure. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `min_backoff` `(string or integer: "1s")` - The minimum backoff time auto-auth
-  will delay before retrying after a failed auth attempt. The backoff will start
-  at the configured value and double (with some randomness) after successive
-  failures, capped by `max_backoff.` If Agent templating is being used, this
-  value is also used as the min backoff time for the templating server.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `max_backoff` `(string or integer: "5m")` - The maximum time Agent will delay
-  before retrying after a failed auth attempt. The backoff will start at
-  `min_backoff` and double (with some randomness) after successive failures,
-  capped by `max_backoff.` If Agent templating is being used, this value is also
-  used as the max backoff time for the templating server. `max_backoff` is the
-  duration between retries, and **not** the duration that retries will be
-  performed before giving up. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `exit_on_err` `(bool: false)` - When set to true, Vault Agent and Vault Proxy
-  will exit if any errors occur during authentication. This configurable only affects login
-  attempts for new tokens (either initial or expired tokens) and will not exit for errors on
-  valid token renewals.
-
-- `config` `(object: required)` - Configuration of the method itself. See the
-  sidebar for information about each method.
-
-### Configuration (Sinks)
-
-These configuration values are common to all Sinks:
-
-- `type` `(string: required)` - The type of the method to use, e.g. `file`.
-  _Note_: when using HCL this can be used as the key for the block, e.g. `sink "file" {...}`.
-
-- `wrap_ttl` `(string or integer: optional)` - If specified, the written token
-  will be response-wrapped by the sink. This is less secure than wrapping by
-  the method, but allows auto-auth to keep the token renewed and automatically
-  reauthenticate when it expires. Rather than a simple string, the written
-  value will be a JSON-encoded
-  [SecretWrapInfo](https://godoc.org/github.com/hashicorp/vault/api#SecretWrapInfo)
-  structure. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `dh_type` `(string: optional)` - If specified, the type of Diffie-Hellman exchange to
-  perform, meaning, which ciphers and/or curves. Currently only `curve25519` is
-  supported.
-
-- `dh_path` `(string: required if dh_type is set)` - The path from which the
-  auto-auth should read the client's initial parameters (e.g. curve25519 public
-  key).
-
-- `derive_key` `(bool: false)` - If specified, the final encryption key is
-  calculated by using HKDF-SHA256 to derive a key from the calculated shared
-  secret and the two public keys for enhanced security. This is recommended
-  if backward compatibility isn't a concern.
-
-- `aad` `(string: optional)` - If specified, additional authenticated data to
-  use with the AES-GCM encryption of the token. Can be any string, including
-  serialized data.
-
-- `aad_env_var` `(string: optional)` - If specified, AAD will be read from the
-  given environment variable rather than a value in the configuration file.
-
-- `config` `(object: required)` - Configuration of the sink itself. See the
-  sidebar for information about each sink.
-
-### Auto auth examples
-
-Auto-Auth configuration objects take two separate forms when specified in HCL
-and JSON. The following examples are meant to clarify the differences between
-the two formats.
-
-#### Sinks (HCL format)
-
-The HCL format may define any number of sink objects with an optional wrapping
-`sinks {...}` object.
-
-~> Note: The [corresponding JSON format](#sinks-json-format) _must_ specify a
-`"sinks" : [...]` array to encapsulate all `sink` JSON objects.
-
-```hcl
-// Other Vault Agent or Vault Proxy configuration blocks
-// ...
-
-auto_auth {
-  method {
-    type = "approle"
-
-    config = {
-      role_id_file_path = "/etc/vault/roleid"
-      secret_id_file_path = "/etc/vault/secretid"
-    }
-  }
-
-  sinks {
-    sink {
-      type = "file"
-
-      config = {
-        path = "/tmp/file-foo"
-      }
-    }
-  }
-}
-```
-
-The following valid HCL omits the wrapping `sinks` object while specifying
-multiple sinks.
-
-```hcl
-// Other Vault Agent or Vault Proxy configuration blocks
-// ...
-
-auto_auth {
-  method {
-    type = "approle"
-
-    config = {
-      role_id_file_path = "/etc/vault/roleid"
-      secret_id_file_path = "/etc/vault/secretid"
-    }
-  }
-
-  sink {
-    type = "file"
-
-    config = {
-      path = "/tmp/file-foo"
-    }
-  }
-
-  sink {
-    type = "file"
-
-    config = {
-      path = "/tmp/file-bar"
-    }
-  }
-}
-```
-
-#### Sinks (JSON format)
-
-The following JSON configuration illustrates the need for a `sinks: [...]` array
-wrapping any number of `sink` objects.
-
-```hcl
-{
-  "auto_auth" : {
-    "method" : [
-      {
-        type = "approle"
-
-        config = {
-          role_id_file_path = "/etc/vault/roleid"
-          secret_id_file_path = "/etc/vault/secretid"
-        }
-      }
-    ],
-    "sinks" : [
-      {
-        "sink" : {
-          type = "file"
-
-          config = {
-            path = "/tmp/file-foo"
-          }
-        }
-      }
-    ]
-  }
-}
-```
-
-Multiple sinks are defined by appending more `sink` objects within the `sinks`
-array:
-
-```hcl
-{
-  "auto_auth" : {
-    "method" : [
-      {
-        type = "approle"
-
-        config = {
-          role_id_file_path = "/etc/vault/roleid"
-          secret_id_file_path = "/etc/vault/secretid"
-        }
-      }
-    ],
-    "sinks" : [
-      {
-        "sink" : {
-          type = "file"
-
-          config = {
-            path = "/tmp/file-foo"
-          }
-        }
-      },
-      {
-        "sink" : {
-          type = "file"
-
-          config = {
-            path = "/tmp/file-bar"
-          }
-        }
-      }
-    ]
-  }
-}
-```
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/alicloud.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/alicloud.mdx
deleted file mode 100644
index 87b0ff34498..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/alicloud.mdx
+++ /dev/null
@@ -1,60 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth AliCloud Method
-description: AliCloud Method for Vault Auto-Auth
----
-
-# Vault agent Auto-Auth AliCloud method
-
-The `alicloud` method performs authentication against the [AliCloud Auth
-method](/vault/docs/auth/alicloud).
-
-## Credentials
-
-Auto-auth will use the first credential it can successfully obtain in the following order:
-
-1. [Environment variables](https://github.com/aliyun/alibaba-cloud-sdk-go/blob/master/sdk/auth/credentials/providers/env.go)
-2. A static credential configuration
-3. Instance metadata (recommended)
-
-Wherever possible, we recommend using instance metadata for credentials. These rotate every hour
-and require no effort on your part to provision, making instance metadata the most secure of the three methods. If
-using instance metadata _and_ a custom `credential_poll_interval`, be sure the frequency is set for
-less than an hour, because instance metadata credentials expire every hour.
-
-Environment variables are given first precedence to provide the ability to quickly override your
-configuration.
-
-## Configuration
-
-### General
-
-- `role` `(string: required)` - The role to authenticate against on Vault.
-
-- `region` `(string: required)` - The AliCloud region in which the Vault agent resides. Example: "us-west-1".
-
-- `credential_poll_interval` `(integer: optional)` - In seconds, how frequently the Vault agent should check for new credentials.
-
-### Optional static credential configuration (Not preferred)
-
-If instance metadata is not available, you may provide credential information through the parameters below.
-
-- `access_key` `(string: optional)` - The access key to use.
-
-- `secret_key` `(string: optional)` - The secret key to use.
-
-- `access_token` `(string: optional)` - The access token to use.
-
-- `role_arn` `(string: optional)` - The role ARN to use.
-
-- `role_session_name` `(string: optional)` - The role session name to use.
-
-- `role_session_expiration` `(string: optional)` - The role session expiration to use.
-
-- `private_key` `(string: optional)` - The private key to use.
-
-- `public_key_id` `(string: optional)` - The public key ID to use.
-
-- `session_expiration` `(string: optional)` - The session expiration to use.
-
-- `role_name` `(string: optional)` - The role name to use.
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/approle.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/approle.mdx
deleted file mode 100644
index 348985d8064..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/approle.mdx
+++ /dev/null
@@ -1,98 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth AppRole Method
-description: AppRole Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth AppRole method
-
-The `approle` method reads in a role ID and a secret ID from files and sends
-the values to the [AppRole Auth
-method](/vault/docs/auth/approle).
-
-The method caches values and it is safe to delete the role ID/secret ID files
-after they have been read. In fact, by default, after reading the secret ID,
-the agent will delete the file. New files or values written at the expected
-locations will be used on next authentication and the new values will be
-cached.
-
-## Configuration
-
-- `role_id_file_path` `(string: required)` - The path to the file with role ID
-
-- `secret_id_file_path` `(string: optional)` - The path to the file with secret
-  ID.
-  If not set, only the `role-id` will be used.
-  In that case, the AppRole should have `bind_secret_id` set to `false` otherwise
-  Vault Agent wouldn't be able to login.
-
-- `remove_secret_id_file_after_reading` `(bool: optional, defaults to true)` -
-  This can be set to `false` to disable the default behavior of removing the
-  secret ID file after it's been read.
-
-- `secret_id_response_wrapping_path` `(string: optional)` - If set, the value
-  at `secret_id_file_path` will be expected to be a [Response-Wrapping
-  Token](/vault/docs/concepts/response-wrapping)
-  containing the output of the secret ID retrieval endpoint for the role (e.g.
-  `auth/approle/role/webservers/secret-id`) and the creation path for the
-  response-wrapping token must match the value set here.
-
-## Example configuration
-
-An example configuration, using approle to enable [auto-auth](/vault/docs/agent-and-proxy/autoauth)
-and creating both a plaintext token sink and a [response-wrapped token sink file](/vault/docs/agent-and-proxy/autoauth#wrap_ttl), follows:
-
-```hcl
-pid_file = "./pidfile"
-
-vault {
-  address = "https://127.0.0.1:8200"
-}
-
-auto_auth {
-  method {
-    type      = "approle"
-
-    config = {
-      role_id_file_path = "roleid"
-      secret_id_file_path = "secretid"
-      remove_secret_id_file_after_reading = false
-    }
-  }
-
-  sink {
-    type = "file"
-    wrap_ttl = "30m"
-    config = {
-      path = "sink_file_wrapped_1.txt"
-    }
-  }
-
-  sink {
-    type = "file"
-    config = {
-      path = "sink_file_unwrapped_2.txt"
-    }
-  }
-}
-
-
-api_proxy {
-  use_auto_auth_token = true
-}
-
-listener "tcp" {
-  address = "127.0.0.1:8100"
-  tls_disable = true
-}
-
-template {
-  source      = "/etc/vault/server.key.ctmpl"
-  destination = "/etc/vault/server.key"
-}
-
-template {
-  source      = "/etc/vault/server.crt.ctmpl"
-  destination = "/etc/vault/server.crt"
-}
-```
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/aws.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/aws.mdx
deleted file mode 100644
index 8f3d8280a31..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/aws.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth AWS Method
-description: AWS Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth AWS method
-
-The `aws` method performs authentication against the [AWS Auth
-method](/vault/docs/auth/aws). Both `ec2` and `iam`
-authentication types are supported. If `ec2` is used, the agent will store the
-reauthentication value in memory and use it for reauthenticating, but will not
-persist it to disk.
-
-Due to the complexity of the Trust On First Use (TOFU) model used in the `ec2`
-method, we recommend the `iam` method when possible.
-
-## Credentials
-
-Vault will use the AWS SDK's normal credential chain behavior, which means it
-will use the first valid credentials it finds in the following order:
-
-1. A static credential configuration
-2. Environment variables
-3. A file containing credentials
-4. From any identity services available in its physical environment like container environment variables or role-based instance metadata
-
-Wherever possible, we recommend using identity services (method 4) for credentials.
-These rotate regularly and require no effort on your part to provision, making
-identity services the most secure of the four methods. If using identity services _and_ a custom
-`credential_poll_interval`, be sure the frequency is set low enough to pick up new credentials
-from the physical environment as they become available.
-
-To use identity services, choose the `iam` type and leave the `access_key`, `secret_key`, and `session_token`
-parameters unset in your configuration.
-
-## Configuration
-
-- `type` `(string: required)` - The type of authentication; must be `ec2` or `iam`.
-
-- `role` `(string: required)` - The role to authenticate against on Vault.
-
-- `credential_poll_interval` `(integer: optional)` - In seconds, how frequently the Vault agent should check for new credentials if using the iam type.
-
-- `access_key` `(string: optional)` - When using static credentials, the access key to use.
-
-- `secret_key` `(string: optional)` - When using static credentials, the secret key to use.
-
-- `region` `(string: "us-east-1")` - The region to use for signing the authentication request. The
-  region Agent uses should match that corresponding to
-  [`sts_endpoint`](/vault/api-docs/auth/aws#sts_endpoint),
-  if a custom endpoint has been configured on the Vault server.
-
-- `session_token` `(string: optional)` - The session token to use for authentication, if needed.
-
-- `header_value` `(string: optional)` - If configured in Vault, the value to use for
-  [`iam_server_id_header_value`](/vault/api-docs/auth/aws#iam_server_id_header_value).
-
-- `nonce` `(string: optional)` - If not provided, Vault will generate a new UUID every time `vault agent` runs.
-  If set, make sure you understand the importance of generating a good, unique `nonce` and protecting it.
-  See [Client Nonce](/vault/docs/auth/aws#client-nonce) for more information.
-
-## Tutorial
-
-Refer to the [Vault Agent with
-AWS](/vault/tutorials/vault-agent/agent-aws) tutorial to learn how to integrate Vault Agent with IAM AWS' native authentication.
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/azure.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/azure.mdx
deleted file mode 100644
index 541dc9a4169..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/azure.mdx
+++ /dev/null
@@ -1,63 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth Azure Method
-description: Azure Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth Azure method
-
-The `azure` method reads in Azure instance credentials and uses them to
-authenticate with the [Azure Auth
-method](/vault/docs/auth/azure). It reads most
-parameters needed for authentication directly from instance information based
-on the value of the `resource` parameter.
-
-## Configuration
-
-- `role` `(string: required)` - The role to authenticate against on Vault
-
-- `authenticate_from_environment` `(boolean: false)` - If set to true, will attempt to make an Azure
-  identity object through Azure specific environment variables, in priority order and as specified [in
-  Azure documentation][environment-variables]. Will work seamlessly with Azure
-  [Workload Identity][workload-identity] and others.
-
-~> Note: If `authenticate_from_environment` is set to true, `object_id`, and `client_id` will be ignored
-in favour of that authentication approach.
-
-- `scope` `(string: optional)` - The scope to use when obtaining a token. If not supplied, will default to
-  the value used for `resource` appended with "`/.default`" appended as a suffix. For more information on
-  scopes in Azure, see [this document][scopes].
-
-- `resource` `(string: required)` - The resource name to use when getting identity information.
-
-- `object_id` `(string: optional)` - The object ID of the user-assigned managed identity to use
-  when acquiring an [access token][azure-access-token]. Only one of `object_id` or `client_id`
-  may be provided.
-
-- `client_id` `(string: optional)` - The client ID of the user-assigned managed identity to use
-  when acquiring an [access token][azure-access-token]. Only one of `object_id` or `client_id`
-  may be provided.
-
-
-## Example configuration
-
-Example client auto-auth configuration block for an [Azure Workload Identity][workload-identity]:
-
-```hcl
-auto_auth {
-  method {
-    type = "azure"
-    config = {
-      authenticate_from_environment = true
-      role = "dev-role"
-      resource = "https://management.azure.com/"
-    }
-  }
-}
-```
-
-
-[azure-access-token]: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http
-[environment-variables]: https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity#readme-environment-variables
-[workload-identity]: https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview
-[scopes]: https://learn.microsoft.com/en-us/azure/active-directory/develop/scopes-oidc
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/cert.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/cert.mdx
deleted file mode 100644
index 8a04bac8b5f..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/cert.mdx
+++ /dev/null
@@ -1,35 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth Cert Method
-description: Cert Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth cert method
-
-The `cert` method uses the configured TLS certificates from the `vault` stanza of
-the agent configuration and takes an optional `name` parameter. There is no option
-to use certificates which differ from those used in the `vault` stanza.
-
-It is strongly advised to provide TLS settings in the configuration stanza
-within the auth method to avoid agent cache, if also enabled, from using the
-same TLS settings when proxying requests. If TLS settings are not present in the
-config stanza, Agent and Proxy will fall back to using TLS settings from their respective
-[`vault` Stanzas](/vault/docs/agent-and-proxy/agent#vault-stanza).
-
-## Configuration
-
-- `name` `(string: optional)` - The trusted certificate role which should be used
-  when authenticating with TLS. If a `name` is not specified, the auth method will
-  try to authenticate against [all trusted certificates](/vault/docs/auth/cert#authentication).
-
-- `ca_cert` `(string: optional)` - Path on the local disk to a single
-  PEM-encoded CA certificate to verify the Vault server's SSL certificate.
-
-- `client_cert` `(string: optional)` - Path on the local disk to a single
-  PEM-encoded client certificate to use for cert auth method authentication.
-
-- `client_key` `(string: optional)` - Path on the local disk to a single
-  PEM-encoded private key matching the client certificate from client_cert.
-
-- `reload` `(bool: optional, default: false)` - If true, causes the local x509 key-pair to be reloaded from disk on each authentication attempt.
-  This is useful in situations where client certificates are short-lived and automatically renewed.
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/cf.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/cf.mdx
deleted file mode 100644
index b6aa3dd4831..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/cf.mdx
+++ /dev/null
@@ -1,19 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth CF Method
-description: CF Method for Vault Auto-Auth
----
-
-# Vault agent Auto-Auth CF method
-
-The `cf` method performs authentication against the [CF Auth
-method](/vault/docs/auth/cf).
-
-## Credentials
-
-The Vault agent will use the `CF_INSTANCE_CERT` and `CF_INSTANCE_KEY` env variables to
-construct a valid login call for CF.
-
-## Configuration
-
-- `role` `(string: required)` - The role to authenticate against on Vault.
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/gcp.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/gcp.mdx
deleted file mode 100644
index 51b1692d845..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/gcp.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth GCP Method
-description: GCP Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth GCP method
-
-The `gcp` method performs authentication against the [GCP Auth
-method](/vault/docs/auth/gcp). Both `gce` and `iam`
-authentication types are supported.
-
-## Credentials
-
-Vault will use the GCP SDK's normal credential chain behavior. You can set a
-static `credentials` value, but it is usually not needed. If running on GCE
-using Application Default Credentials, you may need to specify the service
-account and project since ADC does not provide metadata used to automatically
-determine these.
-
-## Configuration
-
-- `type` `(string: required)` - The type of authentication; must be `gce` or `iam`
-
-- `role` `(string: required)` - The role to authenticate against on Vault
-
-- `credentials` `(string: optional)` - When using static credentials, the
-  contents of the JSON credentials file
-
-- `service_account` `(string: optional)` - The service account to use, if it
-  cannot be automatically determined
-
-- `jwt_exp` `(string or int: optional)` - The number of minutes a generated JWT
-  should be valid for when using the `iam` method; defaults to 15 minutes
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/index.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/index.mdx
deleted file mode 100644
index c9e7645e88a..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/index.mdx
+++ /dev/null
@@ -1,12 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth Methods
-description: Methods for Vault Auto-Auth
----
-
-# Vault Auto-Auth methods
-
-Auto-auth is a mechanism used by Vault Agent and Vault Proxy to authenticate
-to Vault in an automatic manner, given a set of parameters allowing the
-authentication. Please see the sidebar for available methods and their
-usage/configuration.
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/jwt.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/jwt.mdx
deleted file mode 100644
index febb3c65da4..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/jwt.mdx
+++ /dev/null
@@ -1,30 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth JWT Method
-description: JWT Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth JWT method
-
-The `jwt` method reads in a JWT from a file and sends it to the [JWT Auth
-method](/vault/docs/auth/jwt).
-
-## Configuration
-
-- `path` `(string: required)` - The path to the JWT file
-
-- `role` `(string: required)` - The role to authenticate against on Vault
-
-- `remove_jwt_after_reading` `(bool: optional, defaults to true)` -
-  This can be set to `false` to disable the default behavior of removing the
-  JWT after it's been read.
-
-- `remove_jwt_follows_symlinks` `(bool: optional, defaults to false)` -
-This can be set to `true` to follow symlinks when removing the JWT after it has been read
-when executing the `remove_jwt_after_reading` behaviour. If set to false, it will delete
-the symlink, not the JWT. Does nothing if `remove_jwt_after_reading` is false.
-
-- `jwt_read_period` `(duration: "0.5s", optional)` - The duration after which
-Agent will attempt to read the JWT stored at `path`. Defaults to `1m` if
-`remove_jwt_after_reading` is set to `true`, or `0.5s` otherwise.
-Uses [duration format strings](/vault/docs/concepts/duration-format).
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/kerberos.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/kerberos.mdx
deleted file mode 100644
index d2f9979f58d..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/kerberos.mdx
+++ /dev/null
@@ -1,35 +0,0 @@
----
-layout: 'docs'
-page_title: 'Vault Auto-Auth Kerberos Method'
-sidebar_current: 'docs-agent-and-proxy-autoauth-methods-kerberos'
-description: |-
-  Kerberos Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth Kerberos method
-
-The `kerberos` auto-auth method provides an automated mechanism to retrieve
-a Vault token for Kerberos entities. It reads in configuration and
-identification information from the surrounding environment, and uses
-it to authenticate to Vault.
-
-For more on this auth method, see the [Kerberos auth method](/vault/docs/auth/kerberos).
-
-## Configuration
-
-- `krb5conf_path` `(string: required)` is the path to a valid `krb5.conf` file describing how to
-  communicate with the Kerberos environment.
-- `keytab_path` `(string: required)` is the path to the `keytab` in which the entry lives for the
-  entity authenticating to Vault. Keytab files should be protected from other
-  users on a shared server using appropriate file permissions.
-- `username` `(string: required)` is the username for the entry _within_ the `keytab` to use for
-  logging into Kerberos. This username must match a service account in LDAP.
-- `service` `(string: required)` is the service principal name to use in obtaining a service ticket for
-  gaining a SPNEGO token. This service must exist in LDAP.
-- `realm` `(string: required)` is the name of the Kerberos realm. This realm must match the UPNDomain
-  configured on the LDAP connection. This check is case-sensitive.
-- `disable_fast_negotiation` `(bool: optional)` is for disabling the Kerberos auth method's default
-  of using FAST negotiation. FAST is a pre-authentication framework for Kerberos.
-  It includes a mechanism for tunneling pre-authentication exchanges using armoured
-  KDC messages. FAST provides increased resistance to passive password guessing attacks.
-  Some common Kerberos implementations do not support FAST negotiation. The default is false.
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/kubernetes.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/kubernetes.mdx
deleted file mode 100644
index 57e03ec65a7..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/kubernetes.mdx
+++ /dev/null
@@ -1,24 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth Kubernetes Method
-description: Kubernetes Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth kubernetes method
-
-The `kubernetes` method reads in a Kubernetes service account token from the
-running pod (via `/var/run/secrets/kubernetes.io/serviceaccount/token`) and
-sends it to the [Kubernetes Auth
-method](/vault/docs/auth/kubernetes/).
-
-## Configuration
-
-- `role` `(string: required)` - The role to authenticate against on Vault
-- `token_path` `(string: optional)` - The file path to a custom JWT token to use
-  for authentication. If omitted, the default service account token path is used.
-
-## Tutorial
-
-Refer to the [Vault Agent with
-Kubernetes](/vault/tutorials/kubernetes/agent-kubernetes)
-tutorial to learn how to authenticate the clients using a Kubernetes Service Account Token and manage the tokens lifecycle.
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/ldap.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/ldap.mdx
deleted file mode 100644
index f2569e378fd..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/ldap.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth LDAP Method
-description: LDAP Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth LDAP Method
-
-The `ldap` method reads in a password from a file and sends it to the [LDAP Auth
-method](/vault/docs/auth/ldap).
-
-## Configuration
-
-- `password_file_path` `(string: required)` - The path to the password file
-
-- `username` `(string: required)` - The username to authenticate against on Vault
-
-- `remove_password_after_reading` `(bool: optional, defaults to true)` -
-  This can be set to `false` to disable the default behavior of removing the
-  password after it's been read.
-
-- `remove_password_follows_symlinks` `(bool: optional, defaults to false)` -
-This can be set to `true` to follow symlinks when removing the password after
-it has been read when executing the `remove_password_after_reading` behaviour.
-If set to false, it will delete the symlink, not the password file. Does
-nothing if `remove_password_after_reading` is false.
-
-- `password_read_period` `(duration: "0.5s", optional)` - The duration after which 
-auto-auth will attempt to read the password stored at `password_file_path`.
-Defaults to `1m` if `remove_password_after_reading` is set to `true`, or `0.5s`
-otherwise. Uses [duration format
-strings](/vault/docs/concepts/duration-format).
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/oci.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/oci.mdx
deleted file mode 100644
index 643ad08b4da..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/oci.mdx
+++ /dev/null
@@ -1,43 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth OCI (Oracle Cloud Infrastructure) Method
-description: OCI (Oracle Cloud Infrastructure) Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth OCI (Oracle Cloud infrastructure) method
-
-The `oci` method performs authentication against the [OCI Auth
-method](/vault/docs/auth/oci).
-
-## Credentials
-
-The method use to authenticate is set using the `type` parameter. Valid values are `apikey` to authenticate using
-API Key credentials and `instance` for Instance Principal credentials.
-
-If `apikey` is used, the Vault agent will use the first credential it can successfully obtain in the following order:
-
-1. Environment variables:
-  - `OCI_tenancy_ocid`
-  - `OCI_user_ocid`
-  - `OCI_fingerprint`
-  - `OCI_private_key_path`
-2. Configuration file in `$HOME/.oci/config`
-3. Path to configuration file defined in the `OCI_CONFIG_FILE` environment variable
-4. Configuration file in `$HOME/.obmcs/config`
-
-Wherever possible, we recommend using instance principal for credentials. These are rotated automatically by OCI
-and require no effort on your part to provision, making instance principal the most secure of the three methods. If
-using instance principal _and_ a custom `credential_poll_interval`, be sure the frequency is set to a value that is less
-than OCI's rotation frequency. This is currently documented as
-[multiple times a day](https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/callingservicesfrominstances.htm#faq),
-but from experience, credentials are rotated every 10 to 15 minutes.
-
-## Configuration
-
-### General
-
-- `type` `(string: required)` - The type of authentication to use. Valid values are `apikey` and `instance`.
-
-- `role` `(string: required)` - The role to authenticate against on Vault.
-
-- `credential_poll_interval` `(duration: "60s", optional)` - In seconds, how frequently the Vault auto-auth method should check for new credentials.
diff --git a/website/content/docs/agent-and-proxy/autoauth/methods/token_file.mdx b/website/content/docs/agent-and-proxy/autoauth/methods/token_file.mdx
deleted file mode 100644
index 69645d2c62d..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/methods/token_file.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-layout: docs
-page_title: Vault Auto-Auth Token File Method
-description: Token File Method for Vault Auto-Auth
----
-
-# Vault Auto-Auth token file method
-
-~> Note: This authentication method is tailored for the development experience,
-and to facilitate getting started with Vault Agent and Vault Proxy. Vault Agent and
-Vault Proxy should never be configured to use this auto-auth method in a production environment.
-
-The `token_file` method reads in an existing, valid Vault token from a file, and uses that
-token in lieu of authenticating itself. While it's a first class auto-auth method for all intents
-and purposes, it naturally doesn't authenticate itself, as it requires a token from elsewhere. Like
-other auto-auth methods, this method will attempt to renew the token, as appropriate.
-
-This auto-auth method is especially useful when testing Vault Agent or Vault Proxy without needing to set up
-any authentication methods in Vault. For long-running Agent or Proxy processes, we strongly recommend another
-auto-auth method, such that Agent and Proxy are issuing their own own authentication requests to Vault.
-
-## Configuration
-
-- `token_file_path` `(string: required)` - The path to the file with the token inside. This token cannot be a wrapping token.
-
-## Example configuration
-
-An example configuration for Vault Agent, using the `token_file` method to enable [auto-auth](/vault/docs/agent-and-proxy/autoauth), follows:
-
-```hcl
-pid_file = "./pidfile"
-
-vault {
-  address = "https://127.0.0.1:8200"
-}
-
-auto_auth {
-  method {
-    type = "token_file"
-
-    config = {
-      token_file_path = "/home/username/.vault-token"
-    }
-  }
-}
-
-
-api_proxy {
-  use_auto_auth_token = true
-}
-
-listener "tcp" {
-  address = "127.0.0.1:8100"
-  tls_disable = true
-}
-
-template {
-  source      = "/etc/vault/server.key.ctmpl"
-  destination = "/etc/vault/server.key"
-}
-
-template {
-  source      = "/etc/vault/server.crt.ctmpl"
-  destination = "/etc/vault/server.crt"
-}
-```
diff --git a/website/content/docs/agent-and-proxy/autoauth/sinks/file.mdx b/website/content/docs/agent-and-proxy/autoauth/sinks/file.mdx
deleted file mode 100644
index 9e96e8900ea..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/sinks/file.mdx
+++ /dev/null
@@ -1,27 +0,0 @@
----
-layout: docs
-page_title: Vault Agent and Vault Proxy Auto-Auth File Sink
-description: File sink for Auto-Auth
----
-
-# Vault agent and Vault proxy Auto-Auth file sink
-
-The `file` sink writes tokens, optionally response-wrapped and/or encrypted, to
-a file. This may be a local file or a file mapped via some other process (NFS,
-Gluster, CIFS, etc.).
-
-Once the sink writes the file, it is up to the client to control lifecycle;
-generally it is best for the client to remove the file as soon as it is seen.
-
-It is also best practice to write the file to a ramdisk, ideally an encrypted
-ramdisk, and use appropriate filesystem permissions. The file is currently
-written with `0640` permissions as default, but can be overridden with the optional
-'mode' setting.
-
-## Configuration
-
-- `path` `(string: required)` - The path to use to write the token file
-- `mode` `(int: optional)` - A string containing an octal number representing the bit pattern for the file mode, similar to chmod. Set to `0000` to prevent Vault from modifying the file mode. Note: This configuration option is only available in Vault 1.3.0 and above.
-
-~> Note: Configuration options for response-wrapping and encryption for the sink
-file are located within the [options common to all sinks](/vault/docs/agent-and-proxy/autoauth#configuration-sinks) documentation.
diff --git a/website/content/docs/agent-and-proxy/autoauth/sinks/index.mdx b/website/content/docs/agent-and-proxy/autoauth/sinks/index.mdx
deleted file mode 100644
index 55a12d6b73a..00000000000
--- a/website/content/docs/agent-and-proxy/autoauth/sinks/index.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-layout: docs
-page_title: Vault Agent and Vault Proxy Auto-Auth Sinks
-description: Sinks for Auto-Auth
----
-
-# Vault agent and Vault proxy Auto-Auth sinks
-
-Every time an auto-auth authentication is successful, the token is written to the
-enabled Sinks, subject to their configuration. Today, we only support one
-type of sink, [file sink](/vault/docs/agent-and-proxy/autoauth/sinks/file).
diff --git a/website/content/docs/agent-and-proxy/index.mdx b/website/content/docs/agent-and-proxy/index.mdx
deleted file mode 100644
index e9f82e7c9b4..00000000000
--- a/website/content/docs/agent-and-proxy/index.mdx
+++ /dev/null
@@ -1,109 +0,0 @@
----
-layout: docs
-page_title: Vault Agent and Vault Proxy
-description: |-
-  Vault Agent and Vault Proxy are daemons that can be used to perform some Vault
-  functionality automatically.
----
-
-# Vault Agent and Vault Proxy
-
-A valid client token must accompany most requests to Vault. This
-includes all API requests, as well as via the Vault CLI and other libraries.
-Therefore, Vault clients must first authenticate with Vault to acquire a token.
-Vault provides several authentication methods to assist in
-delivering this initial token.
-
-![Client authentication](/img/diagram-vault-agent.png)
-
-If the client can securely acquire the token, all subsequent requests (e.g., request
-database credentials, read key/value secrets) are processed based on the
-trust established by a successful authentication.
-
-This means that client application must invoke the Vault API to authenticate
-with Vault and manage the acquired token, in addition to invoking the API to
-request secrets from Vault. This implies code changes to client applications
-along with additional testing and maintenance of the application.
-
-The following code example implements Vault API to authenticate with Vault
-through [AppRole auth method](/vault/docs/auth/approle#code-example), and then uses
-the returned client token to read secrets at `kv-v2/data/creds`.
-
-```go
-package main
-
-import (
-    ...snip...
-    vault "github.com/hashicorp/vault/api"
-)
-
-// Fetches a key-value secret (kv-v2) after authenticating via AppRole
-func getSecretWithAppRole() (string, error) {
-    config := vault.DefaultConfig()
-
-    client := vault.NewClient(config)
-    wrappingToken := ioutil.ReadFile("path/to/wrapping-token")
-    unwrappedToken := client.Logical().Unwrap(strings.TrimSuffix(string(wrappingToken), "\n"))
-
-    secretID := unwrappedToken.Data["secret_id"]
-    roleID := os.Getenv("APPROLE_ROLE_ID")
-
-    params := map[string]interface{}{
-        "role_id":   roleID,
-        "secret_id": secretID,
-    }
-    resp := client.Logical().Write("auth/approle/login", params)
-    client.SetToken(resp.Auth.ClientToken)
-
-    secret, err := client.Logical().Read("kv-v2/data/creds")
-    if err != nil {
-        return "", fmt.Errorf("unable to read secret: %w", err)
-    }
-
-    data := secret.Data["data"].(map[string]interface{})
-
-    ...snip...
-}
-```
-
-For some Vault deployments, making (and maintaining) these changes to
-applications may not be a problem, and may actually be preferred. This may be
-applied to scenarios where you have a small number of applications, or you want
-to keep strict, customized control over how each application interacts with
-Vault. However, in other situations where you have a large number of
-applications, as in large enterprises, you may not have the resources or expertise
-to update and maintain the Vault integration code for every application. When
-third party applications are being deployed by the application, it is prohibited
-to add the Vault integration code.
-
-### Introduce Vault Agent and Vault Proxy to the workflow
-
-[Vault Agent][vaultagent] and [Vault Proxy][vaultproxy] aim to remove this initial hurdle to adopt Vault by providing a
-more scalable and simpler way for applications to integrate with Vault. Vault Agent can
-obtain secrets and provide them to applications, and Vault Proxy can act as
-a proxy between Vault and the application, optionally simplifying the authentication process
-and caching requests.
-
-
-| Capability                                                                               |    Vault Agent     | Vault Proxy |
-|------------------------------------------------------------------------------------------|:------------------:|:-----------:|
-| [Auto-Auth][autoauth] to authenticate with Vault                                         |         x          |      x      |
-| [Caching][caching] the newly created tokens and leases                                   |         x          |      x      |
-| Run as a [Windows Service][winsvc]                                                       |         x          |             |
-| [Templating][template] to render user-supplied templates                                 |         x          |             |
-| [API Proxy][apiproxy] to act as a proxy for Vault API                                    | Will be deprecated |      x      |
-| [Process Supervisor][exec] for injecting secrets as environment variables into a process |         x          |             |
-
-To learn more, refer to the [Vault Agent][vaultagent] or [Vault
-Proxy][vaultproxy] documentation page.
-
-
-[autoauth]: /vault/docs/agent-and-proxy/autoauth
-[caching]: /vault/docs/agent-and-proxy/agent/caching
-[apiproxy]: /vault/docs/agent-and-proxy/proxy/apiproxy
-[template]: /vault/docs/agent-and-proxy/agent/template
-[exec]: /vault/docs/agent-and-proxy/agent/process-supervisor
-[template-config]: /vault/docs/agent-and-proxy/agent/template#template-configurations
-[vaultagent]: /vault/docs/agent-and-proxy/agent
-[vaultproxy]: /vault/docs/agent-and-proxy/proxy
-[winsvc]: /vault/docs/agent-and-proxy/agent/winsvc
diff --git a/website/content/docs/agent-and-proxy/proxy/apiproxy.mdx b/website/content/docs/agent-and-proxy/proxy/apiproxy.mdx
deleted file mode 100644
index cf5dcae2a6f..00000000000
--- a/website/content/docs/agent-and-proxy/proxy/apiproxy.mdx
+++ /dev/null
@@ -1,97 +0,0 @@
----
-layout: docs
-page_title: Vault Proxy API Proxy
-description: >-
-  Vault Proxy's API Proxy functionality allows you to use Vault Proxy's API as a proxy
-  for Vault's API.
----
-
-# Vault Proxy API proxy
-
-Vault Proxy's API Proxy functionality allows you to use Vault Proxy's API as a proxy
-for Vault's API.
-
-## Functionality
-
-The [`listener` stanza](/vault/docs/agent-and-proxy/proxy#listener-stanza) for Vault Proxy configures a listener for Vault Proxy. If
-its `role` is not set to `metrics_only`, it will act as a proxy for the Vault server that
-has been configured in the [`vault` stanza](/vault/docs/agent-and-proxy/proxy#vault-stanza) of Proxy. This enables access to the Vault
-API from the Proxy API, and can be configured to optionally allow or force the automatic use of
-the Auto-Auth token for these requests, as described below.
-
-If a `listener` has been configured alongside a `cache` stanza, the API Proxy will
-first attempt to utilize the cache subsystem for qualifying requests, before forwarding the
-request to Vault. See the [caching docs](/vault/docs/agent-and-proxy/proxy/caching) for more information on caching.
-
-## Using Auto-Auth token
-
-Vault Proxy allows for easy authentication to Vault in a wide variety of
-environments using [Auto-Auth](/vault/docs/agent-and-proxy/autoauth). By setting the
-`use_auto_auth_token` (see below) configuration, clients will not be required
-to provide a Vault token to the requests made to the Proxy. When this
-configuration is set, if the request doesn't already bear a token, then the
-auto-auth token will be used to forward the request to the Vault server. This
-configuration will be overridden if the request already has a token attached,
-in which case, the token present in the request will be used to forward the
-request to the Vault server.
-
-## Forcing Auto-Auth token
-
-Vault Proxy can be configured to force the use of the auto-auth token by using
-the value `force` for the `use_auto_auth_token` option. This configuration
-overrides the default behavior described above in [Using Auto-Auth
-Token](/vault/docs/agent-and-proxy/proxy/apiproxy#using-auto-auth-token), and instead ignores any
-existing Vault token in the request and instead uses the auto-auth token.
-
-
-## Configuration (`api_proxy`)
-
-The top level `api_proxy` block has the following configuration entries:
-
-- `use_auto_auth_token` `(bool/string: false)` - If set, the requests made to Proxy
-without a Vault token will be forwarded to the Vault server with the
-auto-auth token attached. If the requests already bear a token, this
-configuration will be overridden and the token in the request will be used to
-forward the request to the Vault server. If set to `"force"` Proxy will use the
-auto-auth token, overwriting the attached Vault token if set.
-
-- `prepend_configured_namespace` `(bool: false)` - If set, when Proxy has a
-  namespace configured, such as through the
-  [Vault stanza](/vault/docs/agent-and-proxy/proxy#vault-stanza), all requests
-  proxied to Vault will have the configured namespace prepended to the namespace
-  header. If Proxy's namespace is set to `ns1` and Proxy is sent a request with the
-  namespace `ns2`, the request will go to the `ns1/ns2` namespace. Likewise, if Proxy
-  is sent a request without a namespace, the request will go to the `ns1` namespace.
-  In essence, what this means is that all proxied requests must go to the configured
-  namespace or to its child namespaces.
-
-The following two `api_proxy` options are only useful when making requests to a Vault
-Enterprise cluster, and are documented as part of its
-[Eventual Consistency](/vault/docs/enterprise/consistency#vault-agent-and-consistency-headers)
-page.
-
-- `enforce_consistency` `(string: "never")` - Set to one of `"always"`
-or `"never"`.
-
-- `when_inconsistent` `(string: optional)` - Set to one of `"fail"`, `"retry"`,
-or `"forward"`.
-
-### Example configuration
-
-Here is an example of a `listener` configuration alongside `api_proxy` configuration to force the use of the auto_auth token
-and enforce consistency.
-
-```hcl
-# Other Vault Proxy configuration blocks
-# ...
-
-api_proxy {
-  use_auto_auth_token = "force"
-  enforce_consistency = "always"
-}
-
-listener "tcp" {
-    address = "127.0.0.1:8100"
-    tls_disable = true
-}
-```
diff --git a/website/content/docs/agent-and-proxy/proxy/caching/index.mdx b/website/content/docs/agent-and-proxy/proxy/caching/index.mdx
deleted file mode 100644
index 5ad628c5a7a..00000000000
--- a/website/content/docs/agent-and-proxy/proxy/caching/index.mdx
+++ /dev/null
@@ -1,267 +0,0 @@
----
-layout: docs
-page_title: Vault Proxy Caching
-description: |-
-  Vault Proxy Caching allows client-side caching of responses containing newly
-  created tokens and responses containing leased secrets generated off of these
-  newly created tokens.
----
-
-# Vault Proxy caching
-
-Vault Proxy caching allows client-side caching of responses containing newly
-created tokens and responses containing leased secrets generated off of these
-newly created tokens. The renewals of the cached tokens and leases are also
-managed by the proxy. Additionally, with `cache_static_secrets` set to `true`,
-Vault Proxy [can be configured to cache KVv1 and KVv2 secrets][static-secret-caching].
-
-## Caching and renewals
-
-Response caching and renewals for dynamic secrets are managed by Proxy only under these
-specific scenarios.
-
-1. Token creation requests are made through the proxy. This means that any
-   login operations performed using various auth methods and invoking the token
-   creation endpoints of the token auth method via the proxy will result in the
-   response getting cached by the proxy. Responses containing new tokens will
-   be cached by the proxy only if the parent token is already being managed by
-   the proxy or if the new token is an orphan token.
-
-2. Leased secret creation requests are made through the proxy using tokens that
-   are already managed by the proxy. This means that any dynamic credentials
-   that are issued using the tokens managed by the proxy, will be cached and
-   its renewals are taken care of.
-
-## Static secret caching
-
-You can configure Vault Proxy to cache dynamic secrets and static (KVv1 and KVv2)
-secrets. When you enable caching for static secrets. Proxy keeps a cached entry
-of the secret but only provides the cached response to requests made with tokens
-that can access the secret. As a result, multiple requests to Vault Proxy for
-the same KV secret only require a single, initial request to be forwarded to Vault.
-
-Static secret caching is disabled by default. To enable caching for static secrets you must
-configure [auto-auth](/vault/docs/agent-and-proxy/autoauth) and ensure the
-auto-auth token has permission to subscribe to KV
-[event](/vault/docs/concepts/events) updates.
-
-Once configured, Proxy uses the auto-auth token to subscribe to KV events, and
-monitors the subscription feed to know when to update the secrets in its cache.
-
-For more information on static secret caching, refer to the
-[Vault Proxy static secret caching][static-secret-caching] overview.
-
-## Persistent cache
-
-Vault Proxy can restore secrets, such as, tokens, leases, and static secrets, from a persistent
-cache file created by a previous Vault Proxy process.
-
-Refer to the [Vault Proxy Persistent
-Caching](/vault/docs/agent-and-proxy/proxy/caching/persistent-caches) page for more information on
-this functionality.
-
-## Cache evictions
-
-The eviction of cache entries pertaining to dynamic secrets will occur when the proxy
-can no longer renew them. This can happen when the secrets hit their maximum
-TTL or if the renewals result in errors.
-
-Vault Proxy does some best-effort cache evictions by observing specific request types
-and response codes. For example, if a token revocation request is made via the
-proxy and if the forwarded request to the Vault server succeeds, then proxy
-evicts all the cache entries associated with the revoked token. Similarly, any
-lease revocation operation will also be intercepted by the proxy and the
-respective cache entries will be evicted.
-
-Note that while proxy evicts the cache entries upon secret expirations and upon
-intercepting revocation requests, it is still possible for the proxy to be
-completely unaware of the revocations that happen through direct client
-interactions with the Vault server. This could potentially lead to stale cache
-entries. For managing the stale entries in the cache, an endpoint
-`/proxy/v1/cache-clear`(see below) is made available to manually evict cache
-entries based on some of the query criteria used for indexing the cache entries.
-
-## Request uniqueness
-
-In order to detect repeat requests and return cached responses, Proxy needs
-to have a way to uniquely identify the requests. This computation as it stands
-today takes a simplistic approach (may change in future) of serializing and
-hashing the HTTP request along with all the headers and the request body. This
-hash value is then used as an index into the cache to check if the response is
-readily available. The consequence of this approach is that the hash value for
-any request will differ if any data in the request is modified. This has the
-side-effect of resulting in false negatives if say, the ordering of the request
-parameters are modified. As long as the requests come in without any change,
-caching behavior should be consistent. Identical requests with differently
-ordered request values will result in duplicated cache entries. A heuristic
-assumption that the clients will use consistent mechanisms to make requests,
-thereby resulting in consistent hash values per request is the idea upon which
-the caching functionality is built upon.
-
-## Renewal management
-
-The tokens and leases are renewed by the proxy using the secret renewer that is
-made available via the Vault server's [Go
-API](https://godoc.org/github.com/hashicorp/vault/api#Renewer). Proxy performs
-all operations in memory and does not persist anything to storage. This means
-that when the proxy is shut down, all the renewal operations are immediately
-terminated and there is no way for the proxy to resume renewals after the fact.
-Note that shutting down the proxy does not indicate revocations of the secrets,
-instead it only means that renewal responsibility for all the valid unrevoked
-secrets are no longer performed by the Vault proxy.
-
-## API
-
-### Cache clear
-
-This endpoint clears the cache based on given criteria. To use this
-API, some information on how the proxy caches values should be known
-beforehand. Each response that is cached in the proxy will be indexed on some
-factors depending on the type of request. Those factors can be the `token` that
-is belonging to the cached response, the `token_accessor` of the token
-belonging to the cached response, the `request_path` that resulted in the
-cached response, the `lease` that is attached to the cached response, the
-`namespace` to which the cached response belongs to, and a few more. This API
-exposes some factors through which associated cache entries are fetched and
-evicted. For listeners without caching enabled, this API will still be available,
-but will do nothing (there is no cache to clear) and will return a `200` response.
-
-| Method | Path                    | Produces               |
-| :----- | :---------------------- | :--------------------- |
-| `POST` | `/proxy/v1/cache-clear` | `200 application/json` |
-
-#### Parameters
-
-- `type` `(strings: required)` - The type of cache entries to evict. Valid
-  values are `request_path`, `lease`, `token`, `token_accessor`, and `all`.
-  If the `type` is set to `all`, the _entire cache_ is cleared.
-
-- `value` `(string: required)` - An exact value or the prefix of the value for
-  the `type` selected. This parameter is optional when the `type` is set
-  to `all`.
-
-- `namespace` `(string: optional)` - This is only applicable when the `type` is set to
-  `request_path`. The namespace of which the cache entries to be evicted for
-  the given request path.
-
-### Sample payload
-
-```json
-{
-  "type": "token",
-  "value": "hvs.rlNjegSKykWcplOkwsjd8bP9"
-}
-```
-
-### Sample request
-
-```shell-session
-$ curl \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:1234/proxy/v1/cache-clear
-```
-
-## Configuration (`cache`)
-
-The presence of the top level `cache` block in any way (including an empty `cache` block)  will enable the cache.
-Note that either `cache_static_secrets` must be `true` and/or `disable_caching_dynamic_secrets` must
-be `false`, otherwise the cache does nothing. The top level `cache` block has the following configuration entries:
-
-- `persist` `(object: optional)` - Configuration for the persistent cache.
-
-- `cache_static_secrets` `(bool: false)` - Enables static secret caching when
-`true`.
-
-- `disable_caching_dynamic_secrets` `(bool: false)` - Disables dynamic secret caching when
-`true`.
-
--> **Note:** When the `cache` block is defined, a [listener][proxy-listener] must also be defined
-in the config, otherwise there is no way to utilize the cache.
-
-[proxy-listener]: /vault/docs/agent-and-proxy/proxy#listener-stanza
-
-### Configuration (Persist)
-
-These are common configuration values that live within the `persist` block:
-
-- `type` `(string: required)` - The type of the persistent cache to use,
-  e.g. `kubernetes`. _Note_: when using HCL this can be used as the key for
-  the block, e.g. `persist "kubernetes" {...}`. Currently, only `kubernetes`
-  is supported.
-
-- `path` `(string: required)` - The path on disk where the persistent cache file
-  should be created or restored from.
-
-- `keep_after_import` `(bool: optional)` - When set to true, a restored cache file
-  is not deleted. Defaults to `false`.
-
-- `exit_on_err` `(bool: optional)` - When set to true, if any errors occur during
-  a persistent cache restore, Vault Proxy will exit with an error. Defaults to `true`.
-
-- `service_account_token_file` `(string: optional)` - When `type` is set to `kubernetes`,
-this configures the path on disk where the Kubernetes service account token can be found.
-Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
-
-## Configuration (`listener`)
-
-- `listener` `(array of objects: required)` - Configuration for the listeners.
-
-There can be one or more `listener` blocks at the top level. Adding a listener enables
-the [API Proxy](/vault/docs/agent-and-proxy/proxy/apiproxy) and enables the API proxy to use the cache, if configured.
-These configuration values are common to both `tcp` and `unix` listener blocks. Blocks of type
-`tcp` support the standard `tcp` [listener](/vault/docs/configuration/listener/tcp)
-options. Additionally, the `role` string option is available as part of the top level
-of the `listener` block, which can be configured to `metrics_only` to serve only metrics,
-or the default role, `default`, which serves everything (including metrics).
-
-- `type` `(string: required)` - The type of the listener to use. Valid values
-  are `tcp` and `unix`.
-  _Note_: when using HCL this can be used as the key for the block, e.g.
-  `listener "tcp" {...}`.
-
-- `address` `(string: required)` - The address for the listener to listen to.
-  This can either be a URL path when using `tcp` or a file path when using
-  `unix`. For example, `127.0.0.1:8200` or `/path/to/socket`. Defaults to
-  `127.0.0.1:8200`.
-
-- `tls_disable` `(bool: false)` - Specifies if TLS will be disabled.
-
-- `tls_key_file` `(string: optional)` - Specifies the path to the private key
-  for the certificate.
-
-- `tls_cert_file` `(string: optional)` - Specifies the path to the certificate
-  for TLS.
-
-### Example configuration
-
-Here is an example of a cache configuration with the optional `persist` block,
-alongside a regular listener, and a listener that only serves metrics.
-
-```hcl
-# Other Vault Proxy configuration blocks
-# ...
-
-cache {
-	persist = {
-		type = "kubernetes"
-		path = "/vault/proxy-cache/"
-		keep_after_import = true
-		exit_on_err = true
-		service_account_token_file = "/tmp/serviceaccount/token"
-	}
-}
-
-listener "tcp" {
-    address = "127.0.0.1:8100"
-    tls_disable = true
-}
-
-listener "tcp" {
-    address = "127.0.0.1:3000"
-    tls_disable = true
-    role = "metrics_only"
-}
-```
-
-[static-secret-caching]: /vault/docs/agent-and-proxy/proxy/caching/static-secret-caching
diff --git a/website/content/docs/agent-and-proxy/proxy/caching/persistent-caches/index.mdx b/website/content/docs/agent-and-proxy/proxy/caching/persistent-caches/index.mdx
deleted file mode 100644
index 5c7fd7698ea..00000000000
--- a/website/content/docs/agent-and-proxy/proxy/caching/persistent-caches/index.mdx
+++ /dev/null
@@ -1,39 +0,0 @@
----
-layout: docs
-page_title: Vault Proxy Persistent Caching
-description: Vault Proxy Caching
----
-
-# Vault Proxy persistent caching
-
-Vault Proxy can restore tokens and leases from a persistent cache file created
-by a previous Vault Proxy process. The persistent cache is a BoltDB file that
-includes tuples encrypted by a generated encryption key. The encrypted tuples
-include the Vault token used to retrieve secrets, leases for tokens/secrets, and
-secret values.
-
-In order to use Vault Proxy persistent cache, auto-auth must be used. If the
-auto-auth token has expired by the time the cache is restored, the cache will
-be invalidated and secrets will need to be re-fetched from Vault.
-
--> **Note** Vault Proxy persistent cache is currently supported only in a
-Kubernetes environment.
-
-## Vault Proxy persistent cache types
-
-Please see the sidebar for available types and their usage/configuration.
-
-## Persistent cache example configuration
-
-Here is an example of a persistent cache configuration.
-
-```hcl
-# Other Vault Proxy configuration blocks
-# ...
-
-cache {
-  persist "kubernetes" {
-    path = "/vault/proxy-cache"
-  }
-}
-```
diff --git a/website/content/docs/agent-and-proxy/proxy/caching/persistent-caches/kubernetes.mdx b/website/content/docs/agent-and-proxy/proxy/caching/persistent-caches/kubernetes.mdx
deleted file mode 100644
index 4ea3af7c2f4..00000000000
--- a/website/content/docs/agent-and-proxy/proxy/caching/persistent-caches/kubernetes.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
----
-layout: docs
-page_title: Kubernetes - Vault Proxy Persistent Cache
-description: Kubernetes Persistent Cache for Vault Proxy Caching
----
-
-# Vault Proxy kubernetes persistent cache
-
-When `kubernetes` is configured for the persistent cache type, Vault Proxy will optimize the
-persistent cache specifically for Kubernetes. This type of persistent cache requires a Kubernetes
-service account token. The service account token is used during encryption and decryption of the
-persistent cache as an additional integrity check.
-
-The Vault Proxy persistent cache file in Kubernetes should only be used for handing off Vault tokens
-and leases between initialization and sidecar Vault Proxy containers. This cache file should be shared
-using a memory volume between the Vault Proxy containers.
-
-## Configuration
-
-- `service_account_token_file` `(string: optional)` - When type is set to `kubernetes`,
-  this configures the path on disk where the Kubernetes service account token can be found.
-  Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
diff --git a/website/content/docs/agent-and-proxy/proxy/caching/static-secret-caching.mdx b/website/content/docs/agent-and-proxy/proxy/caching/static-secret-caching.mdx
deleted file mode 100644
index 3a16a1a9b91..00000000000
--- a/website/content/docs/agent-and-proxy/proxy/caching/static-secret-caching.mdx
+++ /dev/null
@@ -1,183 +0,0 @@
----
-layout: docs
-page_title: Vault Proxy Static Secret Caching
-description: |-
-  Vault Proxy's static secret caching functionality allows you to cache KVv1 and KVv2 secrets for calling clients.
-  The secrets will be automatically updated by Proxy, minimizing requests made to Vault, and offering resiliency.
----
-
-# Vault Proxy static secret caching
-
-Use static secret caching with Vault Proxy to cache KVv1 and KVv2 secrets to
-minimize requests made to Vault and provide resilient connections for clients.
-
-## Step 1: Subscribe Vault Proxy to KV events
-
-Vault Proxy uses Vault events and auto-auth to monitor secret status and make
-appropriate cache updates.
-1. Enable [auto-auth](/vault/docs/agent-and-proxy/autoauth).
-1. Create an auto-auth token with permission to subscribe to KV event updates
-with the [Vault event system](/vault/docs/concepts/events). For example, to
-create a policy that grants access to static secret (KVv1 and KVv2) events,
-we need permission to subscribe to the `events` endpoint, as well as the
-`list` and `subscribe` permissions on KV secrets we want to get secrets
-from:
- ```hcl
-  path "sys/events/subscribe/kv*" {
-    capabilities = ["read"]
-  }
-
-  path "*" {
-    capabilities = ["list", "subscribe"]
-    subscribe_event_types = ["kv*"]
-  }
-   ```
-
-Subscribing to KV events means that Proxy receives updates as soon as a secret
-changes, which reduces staleness in the cache. Vault Proxy only checks for a
-secret update if an event notification indicates that the related secret was
-updated.
-
-## Step 2: Ensure tokens have `capabilities-self` access
-
-Tokens require `update` access to the
-[`sys/capabilies-self`](/vault/api-docs/system/capabilities-self) endpoint to
-request cached secrets. Vault tokens receive `update` permissions
-[by default](/vault/docs/concepts/policies#default-policy). If you have modified
-or removed the default policy, you must explicitly create a policy with the
-appropriate permissions. For example:
-```hcl
-  path "sys/capabilities-self" {
-    capabilities = ["update"]
-  }
-```
-
-## Step 3: Configure an appropriate refresh interval
-By default, Vault Proxy refreshes tokens every five minutes. You can change the
-default behavior and configure Proxy to verify and update cached token
-capabilities with the `static_secret_token_capability_refresh_interval`
-parameter in the `cache` configuration stanza. For example, to set a refresh
-interval of one minute:
-```hcl
-cache {
-  cache_static_secrets = true
-  static_secret_token_capability_refresh_interval = "1m"
-}
-```
-
-## Functionality
-
-With static secret caching, Vault Proxy caches `GET` requests for KVv1 and KVv2
-endpoints.
-
-When a client sends a `GET` request for a new KV secret, Proxy forwards the
-request to Vault but caches the response before forwarding it to the client. If
-that client makes subsequent `GET` requests for the same secret, Vault Proxy
-serves the cached response rather than forwarding the request to Vault.
-
-Similarly, when a token requests access to a KV secret, it must complete a
-success `GET` request. If the request is successful, Proxy caches the fact that
-the token was successful in addition to the result. Subsequent requests by the
-same token can then access this secret from the cache instead of Vault.
-
-Vault Proxy uses the [event system](/vault/docs/concepts/events) to keep the
-cache up to date. It monitors the KV event feed for events related to any secret
-currently stored in the cache, including modification events like updates and
-deletes. When Proxy detects a change in a cached secret, it will update or
-evict the cache entry as appropriate.
-
-Vault Proxy also checks and refreshes the access permissions of known tokens
-according to the window set with `static_secret_token_capability_refresh_interval`.
-By default, the refresh interval is five minutes.
-
-Every interval, Proxy calls [`sys/capabilies-self`](/vault/api-docs/system/capabilities-self) on
-behalf of every token in the cache to confirm the token still has permission to
-access the cached secret. If the result from Vault indicates that permission (or
-the token itself) was revoked, Proxy updates the cache entry so that the affected
-token can no longer access the relevant paths from the cache. The refresh interval
-is essentially the maximum period after which permission to read a KV secret is
-fully revoked for the relevant token.
-
-For token refresh to work, any token that will access the cache also needs
-`update` permission for [`sys/capabilies-self`](/vault/api-docs/system/capabilities-self).
-Having `update` permission for the token lets Proxy test capabilities for the
-token against multiple paths with a single request instead of testing for a `403`
-response for each path explicitly.
-
-<Tip title="Refresh is per token, not per secret">
-
-  If Proxy's API proxy is configured to use auto-authentication for tokens, and **all**
-  requests that pass through Vault Proxy use the same token, Proxy only
-  makes a single request to Vault every refresh interval, no matter how many
-  secrets are currently cached.
-
-</Tip>
-
-When static secret caching is enabled, Proxy returns `HIT` or `MISS` in the `X-Cache`
-response header for requests so client can tell if the response was served from
-the cache or forwarded from Vault. In the event of a hit, Proxy also sets the
-`Age` header to indicate, in seconds, how old the cache entry is.
-
-<Tip title="Old does not mean stale">
-
-  The fact that a cache entry is old, does not necessarily mean that the
-  information is out of date. Vault Proxy continually monitors KV events for
-  updates. A large value for `Age` may simply mean that the secret has not been
-  rotated recently.
-
-</Tip>
-
-## Configuration
-
-The top level `cache` block has the following configuration entries relating to static secret caching:
-
-- `cache_static_secrets` `(bool: false)` - Enables static secret caching when
-set to `true`. When `cache_static_secrets` and `auth_auth` are both enabled,
-Vault Proxy serves KV secrets directly from the cache to clients with
-sufficient permission.
-
-- `static_secret_token_capability_refresh_interval` `(duration: "5m", optional)` -
-Sets the interval as a [duration format string](/vault/docs/concepts/duration-format)
-at which Vault Proxy rechecks the permissions of tokens used to access cached
-secrets. The refresh interval is the maximum period after which permission to
-read a cached KV secret is fully revoked. Ignored when `cache_static_secrets`
-is `false`.
-
-### Example configuration
-
-The following example Vault Proxy configuration:
-- Defines a TCP listener (`listener`) with TLS disabled.
-- Forces clients using API proxy (`api_proxy`) to identify with an auto-auth token.
-- Configures auto-authentication (`auto-auth`) for `approle`.
-- Enables static secret caching with `cache_static_secrets`.
-- Sets an explicit token capability refresh window of 1 hour with `static_secret_token_capability_refresh_interval`.
-
-```hcl
-# Other Vault Proxy configuration blocks
-# ...
-
-cache {
-  cache_static_secrets = true
-  static_secret_token_capability_refresh_interval = "1h"
-}
-
-api_proxy {
-  use_auto_auth_token = "force"
-}
-
-listener "tcp" {
-    address = "127.0.0.1:8100"
-    tls_disable = true
-}
-
-auto_auth {
-  method {
-    type = "approle"
-    config = {
-      role_id_file_path = "roleid"
-      secret_id_file_path = "secretid"
-      remove_secret_id_file_after_reading = false
-    }
-  }
-```
-[event-system]: /vault/docs/concepts/events
diff --git a/website/content/docs/agent-and-proxy/proxy/index.mdx b/website/content/docs/agent-and-proxy/proxy/index.mdx
deleted file mode 100644
index 3893d4b4056..00000000000
--- a/website/content/docs/agent-and-proxy/proxy/index.mdx
+++ /dev/null
@@ -1,357 +0,0 @@
----
-layout: docs
-page_title: Vault Proxy
-description: |-
-  Vault Proxy is a daemon that can be used to perform some Vault
-  functionality automatically, and act as a proxy for Vault's APIs.
----
-
-# What is Vault Proxy?
-
-Vault Proxy aims to remove the initial hurdle to adopt Vault by providing a
-more scalable and simpler way for applications to integrate with Vault.
-Vault Proxy acts as an [API Proxy][apiproxy] for Vault, and can optionally allow
-or force interacting clients to use its [automatically authenticated token][autoauth].
-
-Vault Proxy is a client daemon that provides the following features:
-
-- [Auto-Auth][autoauth] - Automatically authenticate to Vault and manage the
-token renewal process for locally-retrieved dynamic secrets.
-- [API Proxy][apiproxy] - Acts as a proxy for Vault's API,
-optionally using (or forcing the use of) the Auto-Auth token.
-- [Caching][caching] - Allows client-side caching of responses containing newly
-created tokens and responses containing leased secrets generated off of these
-newly created tokens. The agent also manages the renewals of the cached tokens and leases.
-
-## Auto-Auth
-
-Vault Proxy allows easy authentication to Vault in a wide variety of
-environments. Please see the [Auto-Auth docs][autoauth]
-for information.
-
-Auto-Auth functionality takes place within an `auto_auth` configuration stanza.
-
-## API proxy
-
-Vault Proxy's primary purpose is to act as an API proxy for Vault, allowing you to talk to Vault's
-API via a listener. It can be configured to optionally allow or force the automatic use of
-the Auto-Auth token for these requests. Please see the [API Proxy docs][apiproxy]
-for more information.
-
-API Proxy functionality takes place within a defined `listener`, and its behaviour can be configured with an
-[`api_proxy` stanza](/vault/docs/agent-and-proxy/proxy/apiproxy#configuration-api_proxy).
-
-## Caching
-
-Vault Proxy allows client-side caching of responses containing newly created tokens
-and responses containing leased secrets generated off of these newly created tokens.
-Please see the [Caching docs][caching] for information.
-
-## API
-
-### Quit
-
-This endpoint triggers shutdown of the proxy. By default, it is disabled, and can
-be enabled per listener using the [`proxy_api`][proxy-api] stanza. It is recommended
-to only enable this on trusted interfaces, as it does not require any authorization to use.
-
-| Method | Path             |
-| :----- | :--------------- |
-| `POST` | `/proxy/v1/quit` |
-
-### Cache
-
-See the [caching](/vault/docs/agent-and-proxy/proxy/caching#api) page for details on the cache API.
-
-## Configuration
-
-### Command options
-
-- `-log-level` ((#\_log_level)) `(string: "info")` - Log verbosity level. Supported values (in
-order of descending detail) are `trace`, `debug`, `info`, `warn`, and `error`. This can
-also be specified via the `VAULT_LOG_LEVEL` environment variable.
-
-- `-log-format` ((#\_log_format)) `(string: "standard")` - Log format. Supported values
-are `standard` and `json`. This can also be specified via the
-`VAULT_LOG_FORMAT` environment variable.
-
-- `-log-file` ((#\_log_file)) - the absolute path where Vault Proxy should save
-  log messages. Paths that end with a path separator use the default file name,
-  `proxy.log`. Paths that do not end with a file extension use the default
-  `.log` extension. If the log file rotates, Vault Proxy appends the current
-  timestamp to the file name at the time of rotation. For example:
-
-  `log-file` | Full log file | Rotated log file
-  ---------- | ------------- | ----------------
-  `/var/log` | `/var/log/proxy.log` | `/var/log/proxy-{timestamp}.log`
-  `/var/log/my-diary` | `/var/log/my-diary.log` | `/var/log/my-diary-{timestamp}.log`
-  `/var/log/my-diary.txt` | `/var/log/my-diary.txt` | `/var/log/my-diary-{timestamp}.txt`
-
-- `-log-rotate-bytes` ((#\_log_rotate_bytes)) - to specify the number of
-bytes that should be written to a log before it needs to be rotated. Unless specified,
-there is no limit to the number of bytes that can be written to a log file.
-
-- `-log-rotate-duration` ((#\_log_rotate_duration)) - to specify the maximum
-duration a log should be written to before it needs to be rotated. Must be a duration
-value such as 30s. Defaults to 24h.
-
-- `-log-rotate-max-files` ((#\_log_rotate_max_files)) - to specify the maximum
-number of older log file archives to keep. Defaults to `0` (no files are ever deleted).
-Set to `-1` to discard old log files when a new one is created.
-
-### Configuration file options
-
-These are the currently-available general configuration options:
-
-- `vault` <code>([vault][vault]: <optional\>)</code> - Specifies the remote Vault server the Proxy connects to.
-
-- `auto_auth` <code>([auto_auth][autoauth]: <optional\>)</code> - Specifies the method and other options used for Auto-Auth functionality.
-
-- `api_proxy` <code>([api_proxy][apiproxy]: <optional\>)</code> - Specifies options used for API Proxy functionality.
-
-- `cache` <code>([cache][caching]: <optional\>)</code> - Specifies options used for Caching functionality.
-
-- `listener` <code>([listener][listener]: <optional\>)</code> - Specifies the addresses and ports on which the Proxy will respond to requests.
-
-~> **Note:** On `SIGHUP` (`kill -SIGHUP $(pidof vault)`), Vault Proxy will attempt to reload listener TLS configuration.
-This method can be used to refresh certificates used by Vault Proxy without having to restart its process.
-
-- `pid_file` `(string: "")` - Path to the file in which the Proxy's Process ID
-(PID) should be stored
-
-- `exit_after_auth` `(bool: false)` - If set to `true`, the proxy will exit
-with code `0` after a single successful auth, where success means that a
-token was retrieved and all sinks successfully wrote it
-
-- `disable_idle_connections` `(string array: [])` - A list of strings that disables idle connections for various features in Vault Proxy.
-Valid values include: `auto-auth`, and `proxying`. Can also be configured by setting the `VAULT_PROXY_DISABLE_IDLE_CONNECTIONS`
-environment variable as a comma separated string. This environment variable will override any values found in a configuration file.
-
-- `disable_keep_alives` `(string array: [])` - A list of strings that disables keep alives for various features in Vault Agent.
-Valid values include: `auto-auth`, and `proxying`. Can also be configured by setting the `VAULT_PROXY_DISABLE_KEEP_ALIVES`
-environment variable as a comma separated string. This environment variable will override any values found in a configuration file.
-
-- `telemetry` <code>([telemetry][telemetry]: <optional\>)</code> – Specifies the telemetry
-reporting system. See the [telemetry Stanza](/vault/docs/agent-and-proxy/proxy#telemetry-stanza) section below
-for a list of metrics specific to Proxy.
-
-- `log_level` - Equivalent to the [`-log-level` command-line flag](#_log_level).
-
-~> **Note:** On `SIGHUP` (`kill -SIGHUP $(pidof vault)`), Vault Proxy will update the log level to the value
-specified by configuration file (including overriding values set using CLI or environment variable parameters).
-
-- `log_format` - Equivalent to the [`-log-format` command-line flag](#_log_format).
-
-- `log_file` - Equivalent to the [`-log-file` command-line flag](#_log_file).
-
-- `log_rotate_duration` - Equivalent to the [`-log-rotate-duration` command-line flag](#_log_rotate_duration).
-
-- `log_rotate_bytes` - Equivalent to the [`-log-rotate-bytes` command-line flag](#_log_rotate_bytes).
-
-- `log_rotate_max_files` - Equivalent to the [`-log-rotate-max-files` command-line flag](#_log_rotate_max_files).
-
-### vault stanza
-
-There can at most be one top level `vault` block, and it has the following
-configuration entries:
-
-- `address` `(string: <optional>)` - The address of the Vault server to
-connect to. This should be a Fully Qualified Domain Name (FQDN) or IP
-such as `https://vault-fqdn:8200` or `https://172.16.9.8:8200`.
-This value can be overridden by setting the `VAULT_ADDR` environment variable.
-
-- `ca_cert` `(string: <optional>)` - Path on the local disk to a single PEM-encoded
-CA certificate to verify the Vault server's SSL certificate. This value can
-be overridden by setting the `VAULT_CACERT` environment variable.
-
-- `ca_path` `(string: <optional>)` - Path on the local disk to a directory of
-PEM-encoded CA certificates to verify the Vault server's SSL certificate.
-This value can be overridden by setting the `VAULT_CAPATH` environment
-variable.
-
-- `client_cert` `(string: <optional>)` - Path on the local disk to a single
-PEM-encoded CA certificate to use for TLS authentication to the Vault server.
-This value can be overridden by setting the `VAULT_CLIENT_CERT` environment
-variable.
-
-- `client_key` `(string: <optional>)` - Path on the local disk to a single
-PEM-encoded private key matching the client certificate from `client_cert`.
-This value can be overridden by setting the `VAULT_CLIENT_KEY` environment
-variable.
-
-- `tls_skip_verify` `(string: <optional>)` - Disable verification of TLS
-certificates. Using this option is highly discouraged as it decreases the
-security of data transmissions to and from the Vault server. This value can
-be overridden by setting the `VAULT_SKIP_VERIFY` environment variable.
-
-- `tls_server_name` `(string: <optional>)` - Name to use as the SNI host when
-connecting via TLS. This value can be overridden by setting the
-`VAULT_TLS_SERVER_NAME` environment variable.
-
-- `namespace` `(string: <optional>)` - Namespace to use for all of Vault Proxy's
-requests to Vault. This can also be specified by command line or environment variable.
-The order of precedence is: this setting lowest, followed by the environment variable
-`VAULT_NAMESPACE`, and then the highest precedence command-line option `-namespace`.
-If none of these are specified, defaults to the root namespace.
-
-#### retry stanza
-
-The `vault` stanza may contain a `retry` stanza that controls how failing Vault
-requests are handled. Auto-auth, however, has its own notion of retrying and is not
-affected by this section.
-
-Here are the options for the `retry` stanza:
-
-- `num_retries` `(int: 12)` - Specify how many times a failing request will
-be retried. A value of `0` translates to the default, i.e. 12 retries.
-A value of `-1` disables retries. The environment variable `VAULT_MAX_RETRIES`
-overrides this setting.
-
-Requests originating
-from the proxy cache will only be retried if they resulted in specific HTTP
-result codes: any 50x code except 501 ("not implemented"), as well as 412
-("precondition failed"); 412 is used in Vault Enterprise 1.7+ to indicate a
-stale read due to eventual consistency. Requests coming from the template
-subsystem are retried regardless of the failure.
-
-### listener stanza
-
-Vault Proxy supports one or more [listener][listener_main] stanzas. Listeners
-can be configured with or without [caching][caching], but will use the cache if it
-has been configured, and will enable the [API proxy][apiproxy]. In addition to the standard
-listener configuration, a Proxy's listener configuration also supports the following:
-
-- `require_request_header` `(bool: false)` - Require that all incoming HTTP
-requests on this listener must have an `X-Vault-Request: true` header entry.
-Using this option offers an additional layer of protection from Server Side
-Request Forgery attacks. Requests on the listener that do not have the proper
-`X-Vault-Request` header will fail, with a HTTP response status code of `412: Precondition Failed`.
-
-- `role` `(string: default)` - `role` determines which APIs the listener serves.
-It can be configured to `metrics_only` to serve only metrics, or the default role, `default`,
-which serves everything (including metrics). The `require_request_header` does not apply
-to `metrics_only` listeners.
-
-- `proxy_api` <code>([proxy_api][proxy-api]: <optional\>)</code> - Manages optional Proxy API endpoints.
-
-#### proxy_api stanza
-
-- `enable_quit` `(bool: false)` - If set to `true`, the Proxy will enable the [quit](/vault/docs/agent-and-proxy/proxy#quit) API.
-
-### telemetry stanza
-
-Vault Proxy supports the [telemetry][telemetry] stanza and collects various
-runtime metrics about its performance, the auto-auth and the cache status:
-
-| Metric                           | Description                                          | Type    |
-| -------------------------------- | ---------------------------------------------------- | ------- |
-| `vault.proxy.auth.failure`       | Number of authentication failures                    | counter |
-| `vault.proxy.auth.success`       | Number of authentication successes                   | counter |
-| `vault.proxy.proxy.success`      | Number of requests successfully proxied              | counter |
-| `vault.proxy.proxy.client_error` | Number of requests for which Vault returned an error | counter |
-| `vault.proxy.proxy.error`        | Number of requests the proxy failed to proxy         | counter |
-| `vault.proxy.cache.hit`          | Number of cache hits                                 | counter |
-| `vault.proxy.cache.miss`         | Number of cache misses                               | counter |
-
-## Start Vault proxy
-
-To run Vault Proxy:
-
-1. [Download](/vault/downloads) the Vault binary where the client application runs
-(virtual machine, Kubernetes pod, etc.)
-
-1. Create a Vault Proxy configuration file. (See the [Example
-Configuration](#example-configuration) section for an example configuration.)
-
-1. Start a Vault Proxy with the configuration file.
-
-**Example:**
-
-```shell-session
-$ vault proxy -config=/etc/vault/proxy-config.hcl
-   ```
-
-To get help, run:
-
-```shell-session
-$ vault proxy -h
-   ```
-
-As with Vault, the `-config` flag can be used in three different ways:
-
-- Use the flag once to name the path to a single specific configuration file.
-- Use the flag multiple times to name multiple configuration files, which will be composed at runtime.
-- Use the flag to name a directory of configuration files, the contents of which will be composed at runtime.
-
-## Example configuration
-
-An example configuration, with very contrived values, follows:
-
-```hcl
-pid_file = "./pidfile"
-
-vault {
-  address = "https://vault-fqdn:8200"
-  retry {
-    num_retries = 5
-  }
-}
-
-auto_auth {
-  method "aws" {
-    mount_path = "auth/aws-subaccount"
-    config = {
-      type = "iam"
-      role = "foobar"
-    }
-  }
-
-  sink "file" {
-    config = {
-      path = "/tmp/file-foo"
-    }
-  }
-
-  sink "file" {
-    wrap_ttl = "5m"
-    aad_env_var = "TEST_AAD_ENV"
-    dh_type = "curve25519"
-    dh_path = "/tmp/file-foo-dhpath2"
-    config = {
-      path = "/tmp/file-bar"
-    }
-  }
-}
-
-cache {
-  // An empty cache stanza still enables caching
-}
-
-api_proxy {
-  use_auto_auth_token = true
-}
-
-listener "unix" {
-  address = "/path/to/socket"
-  tls_disable = true
-
-  agent_api {
-    enable_quit = true
-  }
-}
-
-listener "tcp" {
-  address = "127.0.0.1:8100"
-  tls_disable = true
-}
-```
-
-[vault]: /vault/docs/agent-and-proxy/proxy#vault-stanza
-[autoauth]: /vault/docs/agent-and-proxy/autoauth
-[caching]: /vault/docs/agent-and-proxy/proxy/caching
-[apiproxy]: /vault/docs/agent-and-proxy/proxy/apiproxy
-[persistent-cache]: /vault/docs/agent-and-proxy/proxy/caching/persistent-caches
-[proxy-api]: /vault/docs/agent-and-proxy/proxy/#proxy_api-stanza
-[listener]: /vault/docs/agent-and-proxy/proxy#listener-stanza
-[listener_main]: /vault/docs/configuration/listener/tcp
-[telemetry]: /vault/docs/configuration/telemetry
diff --git a/website/content/docs/agent-and-proxy/proxy/versions.mdx b/website/content/docs/agent-and-proxy/proxy/versions.mdx
deleted file mode 100644
index 1c177ec3069..00000000000
--- a/website/content/docs/agent-and-proxy/proxy/versions.mdx
+++ /dev/null
@@ -1,53 +0,0 @@
----
-layout: docs
-page_title: Vault Proxy Version Compatibility
-description: |-
-  Guidelines for running different versions of Proxy and Vault server
----
-
-# Running different versions of Proxy and Vault server
-
-There is no requirement to run identical versions of Vault Proxy and Vault server.
-It is safe to run different versions. However, you may not be able to take
-advantage of all the newest features in Vault if you do not upgrade to
-the most recent versions of Proxy and Vault server.
-
-Proxy writes a note to the logs when it detects a mismatch between
-Proxy and Vault server versions. The note is purely informative to assist
-with debugging when the problem may be related to a version mismatch.
-For example, when a newer Proxy version expects functionality that is
-not available in an older version of Vault.
-
-This document describes the common cases.  There may be occasional exceptions, which if intentional will be called out in the CHANGELOG in a `CHANGES` section.  If unintentional/undocumented these should be treated as bugs and reported.
-
-## Older version of Proxy than Vault server
-
-In most cases, Vault server upgrades are backwards compatible with
-older versions of Vault Proxy. In the rare case where a Vault upgrade is
-**not** backwards compatible, we document the relevant information in
-the Vault upgrade guide.
-
-Auto-auth:
-- new auth methods that have been introduced since Proxy was built will be unavailable
-- existing auth methods should continue to function normally
-
-Proxy:
-- since Proxy simply mirrors the incoming requests, even if an incoming request uses an endpoint that didn't exist when that version of Proxy was compiled, that won't impede Proxy's ability to proxy the request
-
-## Newer version of Proxy than Vault server
-
-Newer Vault Agent versions will not work with older versions of Vault if
-the Proxy depends on features that do not exist in older Vault server
-versions. Whenever possible, we release newer functionality as opt-in
-and provide graceful degradation when connecting to an older Vault
-server instance. But the new functionality may be required in cases
-where the change relates  unless there's a very good reason (such as a
-serious security flaw being patched)
-
-Auto-auth:
-- Proxy may support authentication methods that are unavailable in older versions of Vault.
-- Proxy may make use of newer functionality for existing authentication methods.
-
-Proxy:
-- since Proxy simply mirrors the incoming requests, it is unlikely that incompatibilities would surface in proxying, but new functionality may not be available
-- example: When client-controlled consistency support was added to Proxy, it started looking for X-Vault-Index headers in responses, and started providing X-Vault-Index headers in proxied requests.  Older Vault Enterprise servers that don't make use of these headers would ignore the new request header and not emit them either.  Proxy proxying behaviour continued unchanged, unable to take advantage of the new functionality, but also not impeded in its previously existing behavior.
diff --git a/website/content/docs/audit/file.mdx b/website/content/docs/audit/file.mdx
deleted file mode 100644
index 7178ced67c1..00000000000
--- a/website/content/docs/audit/file.mdx
+++ /dev/null
@@ -1,63 +0,0 @@
----
-layout: docs
-page_title: File - Audit Devices
-description: The "file" audit device writes audit logs to a file.
----
-
-# File audit device
-
-The `file` audit device writes audit logs to a file. This is a very simple audit
-device: it appends logs to a file.
-
-The device does not currently assist with any log rotation. There are very
-stable and feature-filled log rotation tools already, so we recommend using
-existing tools.
-
-Sending a `SIGHUP` to the Vault process will cause `file` audit devices to close
-and re-open their underlying file, which can assist with log rotation needs.
-
-## Examples
-
-Enable at the default path:
-
-```shell-session
-$ vault audit enable file file_path=/var/log/vault_audit.log
-```
-
-Enable at a different path. It is possible to enable multiple copies of an audit
-device:
-
-```shell-session
-$ vault audit enable -path="vault_audit_1" file file_path=/home/user/vault_audit.log
-```
-
-Enable logs on stdout. This is useful when running in a container:
-
-```shell-session
-$ vault audit enable file file_path=stdout
-```
-
-## Configuration
-
-Note the difference between `audit enable` command options and the `file` backend
-configuration options. Use `vault audit enable -help` to see the command options.
-
-The `file` audit device supports the common configuration options documented on
-the [main Audit Devices page](/vault/docs/audit#common-configuration-options), and
-these device-specific options:
-
-- `file_path` `(string: <required>)` - The path to where the audit log will be
-  written. If a file already exists at the given path, the audit backend will
-  append to it. There are some special keywords:
-
-  - `stdout` writes the audit log to standard output
-
-  - `discard` discards output, instead of writing it to a device (useful in testing scenarios)
-
-- `mode` `(string: "0600")` - A string containing an octal number representing
-  the bit pattern for the file mode, similar to `chmod`. Set to `"0000"` to
-  prevent Vault from modifying the file mode.
-
-## Log file rotation
-
-To properly rotate Vault File Audit Device log files on BSD, Darwin, or Linux-based Vault servers, it is important that you configure your log rotation software to send the `vault` process a signal hang up / `SIGHUP` after each rotation of the log file.
diff --git a/website/content/docs/audit/index.mdx b/website/content/docs/audit/index.mdx
deleted file mode 100644
index 29fb416f4ca..00000000000
--- a/website/content/docs/audit/index.mdx
+++ /dev/null
@@ -1,189 +0,0 @@
----
-layout: docs
-page_title: Audit Devices
-description: Audit devices are mountable devices that log requests and responses in Vault.
----
-
-# Audit devices
-
-Audit devices are the components in Vault that collectively keep a detailed log of all
-requests to Vault, and their responses. Because every operation with Vault is an API
-request/response, when using a single audit device, the audit log contains _every_ interaction with
-the Vault API, including errors - except for a few paths which do not go via the audit system.
-
-The non-audited paths are:
-
-    sys/init
-    sys/seal-status
-    sys/seal
-    sys/step-down
-    sys/unseal
-    sys/leader
-    sys/health
-    sys/rekey/init
-    sys/rekey/update
-    sys/rekey/verify
-    sys/rekey-recovery-key/init
-    sys/rekey-recovery-key/update
-    sys/rekey-recovery-key/verify
-    sys/storage/raft/bootstrap
-    sys/storage/raft/join
-    sys/internal/ui/feature-flags
-
-and also, if the relevant listener configuration settings allow unauthenticated access:
-
-    sys/metrics
-    sys/pprof/*
-    sys/in-flight-req
-
-## Enabling multiple devices
-
-When multiple audit devices are enabled, Vault will attempt to send the audit
-logs to all of them. This allows you to not only have redundant copies, but also
-a way to check for data tampering in the logs themselves.
-
-Vault considers a request to be successful if it can log to *at least* one
-configured audit device (see: [Blocked Audit
-Devices](/vault/docs/audit#blocked-audit-devices) section below).  Therefore in order
-to build a complete picture of all audited actions, use the aggregate/union of
-the logs from each audit device.
-
-~> Note: It is **highly recommended** that you configure Vault to use multiple audit
-devices. Audit failures can prevent Vault from servicing requests, so it is
-important to provide at least one other device.
-
-
-## Format
-
-Each line in the audit log is a JSON object. The `type` field specifies what
-type of object it is. Currently, only two types exist: `request` and `response`.
-The line contains all of the information for any given request and response. By
-default, all the sensitive information is first hashed before logging in the
-audit logs.
-
-## Sensitive information
-
-The audit logs contain the full request and response objects for every
-interaction with Vault. The request and response can be matched utilizing a
-unique identifier assigned to each request.
-
-Most strings contained within requests and responses are hashed with a salt using HMAC-SHA256. The purpose of the hash is so that secrets aren't in plaintext within your audit logs. However, you're still able to check the value of secrets by generating HMACs yourself; this can be done with the audit device's hash function and salt by using the `/sys/audit-hash` API endpoint (see the documentation for more details).
-
-~> Currently, only strings that come from JSON or returned in JSON are
-HMAC'd. Other data types, like integers, booleans, and so on, are passed
-through in plaintext. We recommend that all sensitive data be provided as string values
-inside all JSON sent to Vault (i.e., that integer values are provided in quotes).
-
-While most strings are hashed, Vault does make some exceptions, such as auth and secrets, and users can enable additional exceptions using the [secrets enable](/vault/docs/commands/secrets/enable) command, and then tune it afterward.
-
-**see also**:
-
-[secrets tune](/vault/docs/commands/secrets/tune)
-
-[auth enable](/vault/docs/commands/auth/enable)
-
-[auth tune](/vault/docs/commands/auth/tune)
-
-## Enabling/Disabling audit devices
-
-When a Vault server is first initialized, no auditing is enabled. Audit
-devices must be enabled by a root user using `vault audit enable`.
-
-When enabling an audit device, options can be passed to it to configure it.
-For example, the command below enables the file audit device:
-
-```shell-session
-$ vault audit enable file file_path=/var/log/vault_audit.log
-```
-
-In the command above, we passed the "file_path" parameter to specify the path
-where the audit log will be written to. Each audit device has its own
-set of parameters. See the documentation to the left for more details.
-
-~> Note: Audit device configuration is replicated to all nodes within a
-cluster by default, and to performance/DR secondaries for Vault Enterprise clusters.
-Before enabling an audit device, ensure that all nodes within the cluster(s)
-will be able to successfully log to the audit device to avoid Vault being
-blocked from serving requests.
-An audit device can be limited to only within the node's cluster with the [`local`](/vault/api-docs/system/audit#local) parameter.
-
-When an audit device is disabled, it will stop receiving logs immediately.
-The existing logs that it did store are untouched.
-
-~> Note: Once an audit device is disabled, you will no longer be able to HMAC values
-for comparison with entries in the audit logs. This is true even if you re-enable
-the audit device at the same path, as a new salt will be created for hashing.
-
-## Blocked audit devices
-
-Audit device logs are critically important and ignoring auditing failures opens an avenue for attack. Vault will not respond to requests when no enabled audit devices can record them.
-
-Vault can distinguish between two types of audit device failures.
-
-- A blocking failure is one where an attempt to write to the audit device never completes. This is unlikely with a local disk device, but could occure with a network-based audit device.
-
-- When multiple audit devices are enabled, if any of them fail in a non-blocking fashion, Vault requests can still complete successfully provided at least one audit device successfully writes the audit record. If any of the audit devices fail in a blocking fashion however, Vault requests will hang until the blocking is resolved.
-
-In other words, Vault will not complete any requests until the blocked audit device can write.
-
-## Tutorial
-
-Refer to [Blocked Audit Devices](/vault/tutorials/monitoring/blocked-audit-devices) for a step-by-step tutorial.
-
-## API
-
-Audit devices also have a full HTTP API. Please see the [Audit device API
-docs](/vault/api-docs/system/audit) for more details.
-
-## Common configuration options
-
-@include 'audit-options-common.mdx'
-
-## Eliding list response bodies
-
-Some Vault responses can be very large. Primarily, this affects list operations -
-as Vault lacks pagination in its APIs, listing a very large collection can result
-in a response that is tens of megabytes long. Some audit backends are unable to
-process individual audit records of larger sizes.
-
-The contents of the response for a list operation is often not very interesting;
-most contain only a "keys" field, containing a list of IDs. Select API endpoints
-additionally return a "key_info" field, a map from ID to some additional
-information about the list entry - `identity/entity/id/` is an example of this.
-Even in this case, the response to a list operation is usually less-confidential
-or public information, for which having the full response in the audit logs is of
-lesser importance.
-
-The `elide_list_responses` audit option provides the flexibility to not write the
-full list response data from the audit log, to mitigate the creation of very long
-individual audit records.
-
-When enabled, it affects only audit records of `type=response` and
-`request.operation=list`. The values of `response.data.keys` and
-`response.data.key_info` will be replaced with a simple integer, recording how
-many entries were contained in the list (`keys`) or map (`key_info`) - therefore
-even with this feature enabled, it is still possible to see how many items were
-returned by a list operation.
-
-This extra processing only affects the response data fields `keys` and `key_info`,
-and only when they have the expected data types - in the event a list response
-contains data outside of the usual conventions that apply to Vault list responses,
-it will be left as is by this feature.
-
-Here is an example of an audit record that has been processed by this feature
-(formatted with extra whitespace, and with fields not relevant to the example
-omitted):
-```json
-{
-  "type": "response",
-  "request": {
-    "operation": "list"
-  },
-  "response": {
-    "data": {
-      "key_info": 4,
-      "keys": 4
-    }
-  }
-}
-```
diff --git a/website/content/docs/audit/socket.mdx b/website/content/docs/audit/socket.mdx
deleted file mode 100644
index f57b59876f5..00000000000
--- a/website/content/docs/audit/socket.mdx
+++ /dev/null
@@ -1,44 +0,0 @@
----
-layout: docs
-page_title: Socket - Audit Devices
-description: The "socket" audit device writes audit writes to a TCP or UDP socket.
----
-
-# Socket audit device
-
-The `socket` audit device writes to a TCP, UDP, or UNIX socket.
-
-~> **Warning:** The loss of audit logs may occur when using the UDP socket audit type. Because UDP socket audit type is connectionless, meaning the UDP endpoint becomes unavailable, it’s possible that any number of audit logs written to it may get lost, even though the request will still succeed. Vault does not provide an indication for the loss of audit logs. Therefore, we recommend using your device in conjunction with a secondary “non-socket” audit device to ensure accuracy and to guarantee that audit logs will not be lost.
-
-~> **Warning:** When using a TCP socket audit type, and connection loss to the socket occurs, a single audit entry may be omitted from the audit entry. The request from the TCP socket audit type will succeed despite the omission of the audit entry.
-
-## Enabling
-
-Enable at the default path:
-
-```shell-session
-$ vault audit enable socket
-```
-
-Supply configuration parameters via K=V pairs:
-
-```shell-session
-$ vault audit enable socket address=127.0.0.1:9090 socket_type=tcp
-```
-
-## Configuration
-
-The `socket` audit device supports the common configuration options documented on
-the [main Audit Devices page](/vault/docs/audit#common-configuration-options), and
-these device-specific options:
-
-- `address` `(string: "")` - The socket server address to use. Example
-  `127.0.0.1:9090` or `/tmp/audit.sock`.
-
-- `socket_type` `(string: "tcp")` - The socket type to use, any type compatible
-  with [net.Dial](https://golang.org/pkg/net/#Dial) is acceptable. It's
-  important to note if TCP is used and the destination socket becomes unavailable
-  Vault may become unresponsive per [Blocked Audit Devices](/vault/docs/audit/#blocked-audit-devices).
-
-- `write_timeout` `(string: 2s)` - The (deadline) time in seconds to allow writes to be completed over the socket.
-  A zero value means that write attempts will *not* time out.
diff --git a/website/content/docs/audit/syslog.mdx b/website/content/docs/audit/syslog.mdx
deleted file mode 100644
index 2aae6e6a0e2..00000000000
--- a/website/content/docs/audit/syslog.mdx
+++ /dev/null
@@ -1,45 +0,0 @@
----
-layout: docs
-page_title: Syslog - Audit Devices
-description: The "syslog" audit device writes audit logs to syslog.
----
-
-# Syslog audit device
-
-The `syslog` audit device writes audit logs to syslog.
-
-It currently does not support a configurable syslog destination, and always
-sends to the local agent. This device is only supported on Unix systems,
-and should not be enabled if any standby Vault instances do not support it.
-
-~> **Warning**: Audit messages generated for some operations can be quite
-large, and can be larger than a [maximum-size single UDP
-packet](https://tools.ietf.org/html/rfc5426#section-3.1). If possible with your
-syslog daemon, configure a TCP listener. Otherwise, consider using a `file`
-backend and having syslog configured to read entries from the file; or, enable
-both `file` and `syslog` so that a failure for a particular message to log
-directly to `syslog` will not result in Vault being blocked.
-
-## Examples
-
-Audit `syslog` device can be enabled by the following command:
-
-```shell-session
-$ vault audit enable syslog
-```
-
-Supply configuration parameters via K=V pairs:
-
-```shell-session
-$ vault audit enable syslog tag="vault" facility="AUTH"
-```
-
-## Configuration
-
-The `syslog` audit device supports the common configuration options documented on
-the [main Audit Devices page](/vault/docs/audit#common-configuration-options), and
-these device-specific options:
-
-- `facility` `(string: "AUTH")` - The syslog facility to use.
-
-- `tag` `(string: "vault")` - The syslog tag to use.
diff --git a/website/content/docs/auth/alicloud.mdx b/website/content/docs/auth/alicloud.mdx
deleted file mode 100644
index e5db4c81712..00000000000
--- a/website/content/docs/auth/alicloud.mdx
+++ /dev/null
@@ -1,112 +0,0 @@
----
-layout: docs
-page_title: AliCloud - Auth Methods
-description: The AliCloud auth method allows automated authentication of AliCloud entities.
----
-
-# AliCloud auth method
-
-The `alicloud` auth method provides an automated mechanism to retrieve
-a Vault token for AliCloud entities. Unlike most Vault auth methods, this
-method does not require manual first-deploying, or provisioning
-security-sensitive credentials (tokens, username/password, client certificates,
-etc), by operators. It treats AliCloud as a Trusted Third Party and uses a
-special AliCloud request signed with private credentials. A variety of credentials
-can be used to construct the request, but AliCloud offers
-[instance metadata](https://www.alibabacloud.com/help/faq-detail/49122.htm)
-that's ideally suited for the purpose. By launching an instance with a role,
-the role's STS credentials under instance metadata can be used to securely
-build the request.
-
-## Authentication workflow
-
-The AliCloud STS API includes a method,
-[`sts:GetCallerIdentity`](https://www.alibabacloud.com/help/doc-detail/43767.htm),
-which allows you to validate the identity of a client. The client signs
-a `GetCallerIdentity` query using the [AliCloud signature
-algorithm](https://www.alibabacloud.com/help/doc-detail/67332.htm). It then
-submits 2 pieces of information to the Vault server to recreate a valid signed
-request: the request URL, and the request headers. The Vault server then
-reconstructs the query and forwards it on to the AliCloud STS service and validates
-the result back.
-
-Importantly, the credentials used to sign the GetCallerIdentity request can come
-from the ECS instance metadata service for an ECS instance, which obviates the
-need for an operator to manually provision some sort of identity material first.
-However, the credentials can, in principle, come from anywhere, not just from
-the locations AliCloud has provided for you.
-
-Each signed AliCloud request includes the current timestamp and a nonce to mitigate
-the risk of replay attacks.
-
-It's also important to note that AliCloud does NOT include any sort
-of authorization around calls to `GetCallerIdentity`. For example, if you have
-a RAM policy on your credential that requires all access to be MFA authenticated,
-non-MFA authenticated credentials will still be able to authenticate to Vault
-using this method. It does not appear possible to enforce a RAM principal to be
-MFA authenticated while authenticating to Vault.
-
-## Authorization workflow
-
-The basic mechanism of operation is per-role.
-
-Roles are associated with a role ARN that has been pre-created in AliCloud.
-AliCloud's console displays each role's ARN. A role in Vault has a 1:1 relationship
-with a role in AliCloud, and must bear the same name.
-
-When a client assumes that role and sends its `GetCallerIdentity` request to Vault,
-Vault matches the arn of its assumed role with that of a pre-created role in Vault.
-It then checks what policies have been associated with the role, and grants a
-token accordingly.
-
-## Authentication
-
-### Via the CLI
-
-#### Enable AliCloud authentication in Vault.
-
-```shell-session
-$ vault auth enable alicloud
-```
-
-#### Configure the policies on the role.
-
-```shell-session
-$ vault write auth/alicloud/role/dev-role arn='acs:ram::5138828231865461:role/dev-role'
-```
-
-#### Perform the login operation
-
-```shell-session
-$ vault write auth/alicloud/login \
-        role=dev-role \
-        identity_request_url=$IDENTITY_REQUEST_URL_BASE_64 \
-        identity_request_headers=$IDENTITY_REQUEST_HEADERS_BASE_64
-```
-
-For the RAM auth method, generating the signed request is a non-standard
-operation. The Vault CLI supports generating this for you:
-
-```shell-session
-$ vault login -method=alicloud access_key=... secret_key=... security_token=... region=...
-```
-
-This assumes you have the AliCloud credentials you would find on an ECS instance using the
-following call:
-
-```
-curl 'http://100.100.100.200/latest/meta-data/ram/security-credentials/$ROLE_NAME'
-```
-
-Please note the `$ROLE_NAME` above is case-sensitive and must be consistent with how it's reflected
-on the instance.
-
-An example of how to generate the required request values for the `login` method
-can be found found in the
-[Vault CLI source code](https://github.com/hashicorp/vault-plugin-auth-alicloud/blob/master/tools/tools.go).
-
-## API
-
-The AliCloud auth method has a full HTTP API. Please see the
-[AliCloud Auth API](/vault/api-docs/auth/alicloud) for more
-details.
diff --git a/website/content/docs/auth/approle.mdx b/website/content/docs/auth/approle.mdx
deleted file mode 100644
index 626c634c5e8..00000000000
--- a/website/content/docs/auth/approle.mdx
+++ /dev/null
@@ -1,409 +0,0 @@
----
-layout: docs
-page_title: AppRole - Auth Methods
-description: |-
-  The AppRole auth method allows machines and services to authenticate with
-  Vault.
----
-
-# AppRole auth method
-
-The `approle` auth method allows machines or _apps_ to authenticate with
-Vault-defined _roles_. The open design of `AppRole` enables a varied set of
-workflows and configurations to handle large numbers of apps. This auth method
-is oriented to automated workflows (machines and services), and is less useful
-for human operators.
-
-An "AppRole" represents a set of Vault policies and login constraints that must
-be met to receive a token with those policies. The scope can be as narrow or
-broad as desired. An AppRole can be created for a particular machine, or even
-a particular user on that machine, or a service spread across machines. The
-credentials required for successful login depend upon the constraints set on
-the AppRole associated with the credentials.
-
-## Authentication
-
-### Via the CLI
-
-The default path is `/approle`. If this auth method was enabled at a different
-path, specify `auth/my-path/login` instead.
-
-```shell-session
-$ vault write auth/approle/login \
-    role_id=db02de05-fa39-4855-059b-67221c5c2f63 \
-    secret_id=6a174c20-f6de-a53c-74d2-6018fcceff64
-
-Key                Value
----                -----
-token              65b74ffd-842c-fd43-1386-f7d7006e520a
-token_accessor     3c29bc22-5c72-11a6-f778-2bc8f48cea0e
-token_duration     20m0s
-token_renewable    true
-token_policies     [default]
-```
-
-### Via the API
-
-The default endpoint is `auth/approle/login`. If this auth method was enabled
-at a different path, use that value instead of `approle`.
-
-```shell-session
-$ curl \
-    --request POST \
-    --data '{"role_id":"988a9df-...","secret_id":"37b74931..."}' \
-    http://127.0.0.1:8200/v1/auth/approle/login
-```
-
-The response will contain the token at `auth.client_token`:
-
-```json
-{
-  "auth": {
-    "renewable": true,
-    "lease_duration": 2764800,
-    "metadata": {},
-    "policies": ["default", "dev-policy", "test-policy"],
-    "accessor": "5d7fb475-07cb-4060-c2de-1ca3fcbf0c56",
-    "client_token": "98a4c7ab-b1fe-361b-ba0b-e307aacfd587"
-  }
-}
-```
-
--> **Application Integration:** See the [Code Example](#code-example) section
-for a code snippet demonstrating the authentication with Vault using the
-AppRole auth method.
-
-## Configuration
-
-Auth methods must be configured in advance before users or machines can
-authenticate. These steps are usually completed by an operator or configuration
-management tool.
-
-### Via the CLI
-
-1. Enable the AppRole auth method:
-
-   ```shell-session
-   $ vault auth enable approle
-   ```
-
-1. Create a named role:
-
-   ```shell-session
-   $ vault write auth/approle/role/my-role \
-       secret_id_ttl=10m \
-       token_num_uses=10 \
-       token_ttl=20m \
-       token_max_ttl=30m \
-       secret_id_num_uses=40
-   ```
-
-~> **Note:** If the token issued by your approle needs the ability to create child tokens, you will need to set token_num_uses to 0.
-
-For the complete list of configuration options, please see the API
-documentation.
-
-1. Fetch the RoleID of the AppRole:
-
-   ```shell-session
-   $ vault read auth/approle/role/my-role/role-id
-   role_id     db02de05-fa39-4855-059b-67221c5c2f63
-   ```
-
-1. Get a SecretID issued against the AppRole:
-
-   ```shell-session
-   $ vault write -f auth/approle/role/my-role/secret-id
-   secret_id               6a174c20-f6de-a53c-74d2-6018fcceff64
-   secret_id_accessor      c454f7e5-996e-7230-6074-6ef26b7bcf86
-   secret_id_ttl           10m
-   secret_id_num_uses      40
-   ```
-
-### Via the API
-
-1. Enable the AppRole auth method:
-
-   ```shell-session
-   $ curl \
-       --header "X-Vault-Token: ..." \
-       --request POST \
-       --data '{"type": "approle"}' \
-       http://127.0.0.1:8200/v1/sys/auth/approle
-   ```
-
-1. Create an AppRole with desired set of policies:
-
-   ```shell-session
-   $ curl \
-       --header "X-Vault-Token: ..." \
-       --request POST \
-       --data '{"policies": "dev-policy,test-policy"}' \
-       http://127.0.0.1:8200/v1/auth/approle/role/my-role
-   ```
-
-1. Fetch the identifier of the role:
-
-   ```shell-session
-   $ curl \
-       --header "X-Vault-Token: ..." \
-       http://127.0.0.1:8200/v1/auth/approle/role/my-role/role-id
-   ```
-
-   The response will look like:
-
-   ```json
-   {
-     "data": {
-       "role_id": "988a9dfd-ea69-4a53-6cb6-9d6b86474bba"
-     }
-   }
-   ```
-
-1. Create a new secret identifier under the role:
-
-   ```shell-session
-   $ curl \
-       --header "X-Vault-Token: ..." \
-       --request POST \
-        http://127.0.0.1:8200/v1/auth/approle/role/my-role/secret-id
-   ```
-
-   The response will look like:
-
-   ```json
-   {
-     "data": {
-       "secret_id_accessor": "45946873-1d96-a9d4-678c-9229f74386a5",
-       "secret_id": "37b74931-c4cd-d49a-9246-ccc62d682a25",
-       "secret_id_ttl": 600,
-       "secret_id_num_uses": 40
-     }
-   }
-   ```
-
-## Credentials/Constraints
-
-### RoleID
-
-RoleID is an identifier that selects the AppRole against which the other
-credentials are evaluated. When authenticating against this auth method's login
-endpoint, the RoleID is a required argument (via `role_id`) at all times. By
-default, RoleIDs are unique UUIDs, which allow them to serve as secondary
-secrets to the other credential information. However, they can be set to
-particular values to match introspected information by the client (for
-instance, the client's domain name).
-
-### SecretID
-
-SecretID is a credential that is required by default for any login (via
-`secret_id`) and is intended to always be secret. (For advanced usage,
-requiring a SecretID can be disabled via an AppRole's `bind_secret_id`
-parameter, allowing machines with only knowledge of the RoleID, or matching
-other set constraints, to fetch a token). SecretIDs can be created against an
-AppRole either via generation of a 128-bit purely random UUID by the role
-itself (`Pull` mode) or via specific, custom values (`Push` mode). Similarly to
-tokens, SecretIDs have properties like usage-limit, TTLs and expirations.
-
-#### Pull and push SecretID modes
-
-If the SecretID used for login is fetched from an AppRole, this is operating in
-Pull mode. If a "custom" SecretID is set against an AppRole by the client, it
-is referred to as a Push mode. Push mode mimics the behavior of the deprecated
-App-ID auth method; however, in most cases Pull mode is the better approach. The
-reason is that Push mode requires some other system to have knowledge of the
-full set of client credentials (RoleID and SecretID) in order to create the
-entry, even if these are then distributed via different paths. However, in Pull
-mode, even though the RoleID must be known in order to distribute it to the
-client, the SecretID can be kept confidential from all parties except for the
-final authenticating client by using [Response Wrapping](/vault/docs/concepts/response-wrapping).
-
-Push mode is available for App-ID workflow compatibility, which in some
-specific cases is preferable, but in most cases Pull mode is more secure and
-should be preferred.
-
-### Further constraints
-
-`role_id` is a required credential at the login endpoint. AppRole pointed to by
-the `role_id` will have constraints set on it. This dictates other `required`
-credentials for login. The `bind_secret_id` constraint requires `secret_id` to
-be presented at the login endpoint. Going forward, this auth method can support
-more constraint parameters to support varied set of Apps. Some constraints will
-not require a credential, but still enforce constraints for login. For
-example, `secret_id_bound_cidrs` will only allow logins coming from IP addresses
-belonging to configured CIDR blocks on the AppRole.
-
-## Tutorial
-
-Refer to the [AppRole Pull
-Authentication](/vault/tutorials/auth-methods/approle)
-tutorial to learn how to use the AppRole method to generate tokens for machines or apps.
-
-## User lockout
-
-@include 'user-lockout.mdx'
-
-## API
-
-The AppRole auth method has a full HTTP API. Please see the
-[AppRole API](/vault/api-docs/auth/approle) for more
-details.
-
-## Code example
-
-The following example demonstrates AppRole authentication with response
-wrapping.
-
-<CodeTabs>
-
-<CodeBlockConfig>
-
-```go
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	vault "github.com/hashicorp/vault/api"
-	auth "github.com/hashicorp/vault/api/auth/approle"
-)
-
-// Fetches a key-value secret (kv-v2) after authenticating via AppRole.
-func getSecretWithAppRole() (string, error) {
-	config := vault.DefaultConfig() // modify for more granular configuration
-
-	client, err := vault.NewClient(config)
-	if err != nil {
-		return "", fmt.Errorf("unable to initialize Vault client: %w", err)
-	}
-
-	// A combination of a Role ID and Secret ID is required to log in to Vault
-	// with an AppRole.
-	// First, let's get the role ID given to us by our Vault administrator.
-	roleID := os.Getenv("APPROLE_ROLE_ID")
-	if roleID == "" {
-		return "", fmt.Errorf("no role ID was provided in APPROLE_ROLE_ID env var")
-	}
-
-	// The Secret ID is a value that needs to be protected, so instead of the
-	// app having knowledge of the secret ID directly, we have a trusted orchestrator (https://learn.hashicorp.com/tutorials/vault/secure-introduction?in=vault/app-integration#trusted-orchestrator)
-	// give the app access to a short-lived response-wrapping token (https://developer.hashicorp.com/vault/docs/concepts/response-wrapping).
-	// Read more at: https://learn.hashicorp.com/tutorials/vault/approle-best-practices?in=vault/auth-methods#secretid-delivery-best-practices
-	secretID := &auth.SecretID{FromFile: "path/to/wrapping-token"}
-
-	appRoleAuth, err := auth.NewAppRoleAuth(
-		roleID,
-		secretID,
-		auth.WithWrappingToken(), // Only required if the secret ID is response-wrapped.
-	)
-	if err != nil {
-		return "", fmt.Errorf("unable to initialize AppRole auth method: %w", err)
-	}
-
-	authInfo, err := client.Auth().Login(context.Background(), appRoleAuth)
-	if err != nil {
-		return "", fmt.Errorf("unable to login to AppRole auth method: %w", err)
-	}
-	if authInfo == nil {
-		return "", fmt.Errorf("no auth info was returned after login")
-	}
-
-	// get secret from the default mount path for KV v2 in dev mode, "secret"
-	secret, err := client.KVv2("secret").Get(context.Background(), "creds")
-	if err != nil {
-		return "", fmt.Errorf("unable to read secret: %w", err)
-	}
-
-	// data map can contain more than one key-value pair,
-	// in this case we're just grabbing one of them
-	value, ok := secret.Data["password"].(string)
-	if !ok {
-		return "", fmt.Errorf("value type assertion failed: %T %#v", secret.Data["password"], secret.Data["password"])
-	}
-
-	return value, nil
-}
-```
-
-</CodeBlockConfig>
-
-<CodeBlockConfig>
-
-```cs
-using System;
-using System.Collections.Generic;
-using System.IO;
-using VaultSharp;
-using VaultSharp.V1.AuthMethods;
-using VaultSharp.V1.AuthMethods.AppRole;
-using VaultSharp.V1.AuthMethods.Token;
-using VaultSharp.V1.Commons;
-
-namespace Examples
-{
-    public class ApproleAuthExample
-    {
-        const string DefaultTokenPath = "../../../path/to/wrapping-token";
-
-        /// <summary>
-        /// Fetches a key-value secret (kv-v2) after authenticating to Vault via AppRole authentication
-        /// </summary>
-        public string GetSecretWithAppRole()
-        {
-            // A combination of a Role ID and Secret ID is required to log in to Vault with an AppRole.
-	        // The Secret ID is a value that needs to be protected, so instead of the app having knowledge of the secret ID directly,
-	        // we have a trusted orchestrator (https://developer.hashicorp.com/vault/tutorials/app-integration/secure-introduction?in=vault%2Fapp-integration#trusted-orchestrator)
-	        // give the app access to a short-lived response-wrapping token (https://developer.hashicorp.com/vault/docs/concepts/response-wrapping).
-	        // Read more at: https://learn.hashicorp.com/tutorials/vault/approle-best-practices?in=vault/auth-methods#secretid-delivery-best-practices
-            var vaultAddr = Environment.GetEnvironmentVariable("VAULT_ADDR");
-            if(String.IsNullOrEmpty(vaultAddr))
-            {
-                throw new System.ArgumentNullException("Vault Address");
-            }
-
-            var roleId = Environment.GetEnvironmentVariable("APPROLE_ROLE_ID");
-            if(String.IsNullOrEmpty(roleId))
-            {
-                throw new System.ArgumentNullException("AppRole Role Id");
-            }
-            // Get the path to wrapping token or fall back on default path
-            string pathToToken = !String.IsNullOrEmpty(Environment.GetEnvironmentVariable("WRAPPING_TOKEN_PATH")) ? Environment.GetEnvironmentVariable("WRAPPING_TOKEN_PATH") : DefaultTokenPath;
-            string wrappingToken = File.ReadAllText(pathToToken); // placed here by a trusted orchestrator
-
-            // We need to create two VaultClient objects for authenticating via AppRole. The first is for
-            // using the unwrap utility. We need to initialize the client with the wrapping token.
-            IAuthMethodInfo wrappedTokenAuthMethod = new TokenAuthMethodInfo(wrappingToken);
-            var vaultClientSettingsForUnwrapping = new VaultClientSettings(vaultAddr, wrappedTokenAuthMethod);
-
-            IVaultClient vaultClientForUnwrapping = new VaultClient(vaultClientSettingsForUnwrapping);
-
-            // We pass null here instead of the wrapping token to avoid depleting its single usage
-            // given that we already initialized our client with the wrapping token
-            Secret<Dictionary<string, object>> secretIdData =  vaultClientForUnwrapping.V1.System
-                .UnwrapWrappedResponseDataAsync<Dictionary<string, object>>(null).Result;
-
-            var secretId = secretIdData.Data["secret_id"]; // Grab the secret_id
-
-            // We create a second VaultClient and initialize it with the AppRole auth method and our new credentials.
-            IAuthMethodInfo authMethod = new AppRoleAuthMethodInfo(roleId, secretId.ToString());
-            var vaultClientSettings = new VaultClientSettings(vaultAddr, authMethod);
-
-            IVaultClient vaultClient = new VaultClient(vaultClientSettings);
-
-            // We can retrieve the secret from VaultClient
-            Secret<SecretData> kv2Secret = null;
-            kv2Secret = vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(path: "/creds").Result;
-
-            var password = kv2Secret.Data.Data["password"];
-
-            return password.ToString();
-        }
-    }
-}
-```
-
-</CodeBlockConfig>
-
-</CodeTabs>
diff --git a/website/content/docs/auth/aws.mdx b/website/content/docs/auth/aws.mdx
deleted file mode 100644
index e6119ddeff0..00000000000
--- a/website/content/docs/auth/aws.mdx
+++ /dev/null
@@ -1,907 +0,0 @@
----
-layout: docs
-page_title: AWS - Auth Methods
-description: The aws auth method allows automated authentication of AWS entities.
----
-
-# AWS auth method
-
-@include 'x509-sha1-deprecation.mdx'
-
-@include 'aws-sha1-deprecation.mdx'
-
-The `aws` auth method provides an automated mechanism to retrieve a Vault token
-for IAM principals and AWS EC2 instances. Unlike most Vault auth methods, this
-method does not require manual first-deploying, or provisioning
-security-sensitive credentials (tokens, username/password, client certificates,
-etc), by operators under many circumstances.
-
-## Authentication workflow
-
-There are two authentication types present in the aws auth method: `iam` and
-`ec2`.
-
-With the `iam` method, a special AWS request signed with AWS IAM credentials is
-used for authentication. The IAM credentials are automatically supplied to AWS
-instances in IAM instance profiles, Lambda functions, and others, and it is
-this information already provided by AWS which Vault can use to authenticate
-clients.
-
-With the `ec2` method, AWS is treated as a Trusted Third Party and
-cryptographically signed dynamic metadata information that uniquely represents
-each EC2 instance is used for authentication. This metadata information is
-automatically supplied by AWS to all EC2 instances.
-
-Based on how you attempt to authenticate, Vault will determine if you are
-attempting to use the `iam` or `ec2` type. Each has a different authentication
-workflow, and each can solve different use cases.
-
-Note: The `ec2` method was implemented before the primitives to implement the
-`iam` method were supported by AWS. The `iam` method is the recommended approach
-as it is more flexible and aligns with best practices to perform access
-control and authentication. See the section on comparing the two auth methods
-below for more information.
-
--> **Usage:** See the [Authentication](#authentication) section for Vault CLI
-and API usage examples. The [Code Example](#code-example) section provides a
-code snippet demonstrating the authentication with Vault using the AWS auth
-method.
-
-### IAM auth method
-
-The AWS STS API includes a method, [`sts:GetCallerIdentity`](http://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html), which allows you to validate the identity of a client. The client signs a `GetCallerIdentity` query using the [AWS Signature v4 algorithm](http://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html) and sends it to the Vault server. The credentials used to sign the GetCallerIdentity request can come from the EC2 instance metadata service for an EC2 instance, or from the AWS environment variables in an AWS Lambda function execution, which obviates the need for an operator to manually provision some sort of identity material first. However, the credentials can, in principle, come from anywhere, not just from the locations AWS has provided for you.
-
-The `GetCallerIdentity` query consists of four pieces of information: the request URL, the request body, the request headers, and the request method, as the AWS signature is computed over those fields. The Vault server reconstructs the query using this information and forwards it on to the AWS STS service. Depending on the response from the STS service, the server authenticates the client.
-
-Notably, clients don't need network-level access themselves to talk
-to the AWS STS API endpoint; they merely need access to the credentials to sign
-the request. However, it means that the Vault server does need network-level
-access to send requests to the STS endpoint.
-
-Each signed AWS request includes the current timestamp to mitigate the risk of
-replay attacks. In addition, Vault allows you to require an additional header,
-`X-Vault-AWS-IAM-Server-ID`, to be present to mitigate against different types
-of replay attacks (such as a signed `GetCallerIdentity` request stolen from a
-dev Vault instance and used to authenticate to a prod Vault instance). Vault
-further requires that this header be one of the headers included in the AWS
-signature and relies upon AWS to authenticate that signature.
-
-While AWS API endpoints support both signed GET and POST requests, for
-simplicity, the aws auth method supports only POST requests. It also does not
-support `presigned` requests, i.e., requests with `X-Amz-Credential`,
-`X-Amz-Signature`, and `X-Amz-SignedHeaders` GET query parameters containing
-the authenticating information.
-
-It's also important to note that Amazon does NOT appear to include any sort of
-authorization around calls to `GetCallerIdentity`. For example, if you have an
-IAM policy on your credential that requires all access to be MFA authenticated,
-non-MFA authenticated credentials (i.e., raw credentials, not those retrieved
-by calling `GetSessionToken` and supplying an MFA code) will still be able to
-authenticate to Vault using this method. It does not appear possible to enforce
-an IAM principal to be MFA authenticated while authenticating to Vault.
-
-### EC2 auth method
-
-Amazon EC2 instances have access to metadata which describes the instance. The
-Vault EC2 auth method leverages the components of this metadata to authenticate
-and distribute an initial Vault token to an EC2 instance. The data flow (which
-is also represented in the graphic below) is as follows:
-
-[![Vault AWS EC2 Authentication Flow](/img/vault-aws-ec2-auth-flow.png)](/img/vault-aws-ec2-auth-flow.png)
-
-1. An AWS EC2 instance fetches its [AWS Instance Identity Document][aws-iid]
-   from the [EC2 Metadata Service][aws-ec2-mds]. In addition to data itself, AWS
-   also provides the PKCS#7 signature of the data, and publishes the public keys
-   (by region) which can be used to verify the signature.
-
-1. The AWS EC2 instance makes a request to Vault with the PKCS#7 signature.
-   The PKCS#7 signature contains the Instance Identity Document.
-
-1. Vault verifies the signature on the PKCS#7 document, ensuring the information
-   is certified accurate by AWS. This process validates both the validity and
-   integrity of the document data. As an added security measure, Vault verifies
-   that the instance is currently running using the public EC2 API endpoint.
-
-1. Provided all steps are successful, Vault returns the initial Vault token to
-   the EC2 instance. This token is mapped to any configured policies based on the
-   instance metadata.
-
-[aws-iid]: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html
-[aws-ec2-mds]: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
-
-There are various modifications to this workflow that provide more or less
-security, as detailed later in this documentation.
-
-## Authorization workflow
-
-The basic mechanism of operation is per-role. Roles are registered in the
-method and associated with a specific authentication type that cannot be
-changed once the role has been created. Roles can also be associated with
-various optional restrictions, such as the set of allowed policies and max TTLs
-on the generated tokens. Each role can be specified with the constraints that
-are to be met during the login. Many of these constraints accept lists of
-required values. For any constraint which accepts a list of values, that
-constraint will be considered satisfied if any one of the values is matched
-during the login process. For example, one such constraint that is
-supported is to bind against a list of AMI IDs. A role which is bound to a
-specific list of AMIs can only be used for login by EC2 instances that are
-deployed to one of the AMIs that the role is bound to.
-
-The iam auth method allows you to specify bound IAM principal ARNs.
-Clients authenticating to Vault must have an ARN that matches one of the ARNs bound to
-the role they are attempting to login to. The bound ARN allows specifying a
-wildcard at the end of the bound ARN. For example, if the bound ARN were
-`arn:aws:iam::123456789012:*` it would allow any principal in AWS account
-123456789012 to login to it. Similarly, if it were
-`arn:aws:iam::123456789012:role/*` it would allow any IAM role in the AWS
-account to login to it. If you wish to specify a wildcard, you must give Vault
-`iam:GetUser` and `iam:GetRole` permissions to properly resolve the full user
-path.
-
-In general, role bindings that are specific to an EC2 instance are only checked
-when the ec2 auth method is used to login, while bindings specific to IAM
-principals are only checked when the iam auth method is used to login. However,
-the iam method includes the ability for you to "infer" an EC2 instance ID from
-the authenticated client and apply many of the bindings that would otherwise
-only apply specifically to EC2 instances.
-
-In many cases, an organization will use a "seed AMI" that is specialized after
-bootup by configuration management or similar processes. For this reason, a
-role entry in the method can also be associated with a "role tag" when using
-the ec2 auth type. These tags
-are generated by the method and are placed as the value of a tag with the
-given key on the EC2 instance. The role tag can be used to further restrict the
-parameters set on the role, but cannot be used to grant additional privileges.
-If a role with an AMI bind constraint has "role tag" enabled on the role, and
-the EC2 instance performing login does not have an expected tag on it, or if the
-tag on the instance is deleted for some reason, authentication fails.
-
-The role tags can be generated at will by an operator with appropriate API
-access. They are HMAC-signed by a per-role key stored within the method, allowing
-the method to verify the authenticity of a found role tag and ensure that it has
-not been tampered with. There is also a mechanism to deny list role tags if one
-has been found to be distributed outside of its intended set of machines.
-
-## IAM authentication inferences
-
-With the iam auth method, normally Vault will see the IAM principal that
-authenticated, either the IAM user or role. However, when you have an EC2
-instance in an IAM instance profile, Vault can actually see the instance ID of
-the instance and can "infer" that it's an EC2 instance. However, there are
-important security caveats to be aware of before configuring Vault to make that
-inference.
-
-Each AWS IAM role has a "trust policy" which specifies which entities are
-trusted to call
-[`sts:AssumeRole`](http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html)
-on the role and retrieve credentials that can be used to authenticate with that
-role. When AssumeRole is called, a parameter called RoleSessionName is passed
-in, which is chosen arbitrarily by the entity which calls AssumeRole. If you
-have a role with an ARN `arn:aws:iam::123456789012:role/MyRole`, then the
-credentials returned by calling AssumeRole on that role will be
-`arn:aws:sts::123456789012:assumed-role/MyRole/RoleSessionName` where
-RoleSessionName is the session name in the AssumeRole API call. It is this
-latter value which Vault actually sees.
-
-When you have an EC2 instance in an instance profile, the corresponding role's
-trust policy specifies that the principal `"Service": "ec2.amazonaws.com"` is
-trusted to call AssumeRole. When this is configured, EC2 calls AssumeRole on
-behalf of your instance, with a RoleSessionName corresponding to the
-instance's instance ID. Thus, it is possible for Vault to extract the instance
-ID out of the value it sees when an EC2 instance in an instance profile
-authenticates to Vault with the iam auth method. This is known as
-"inferencing." Vault can be configured, on a role-by-role basis, to infer that a
-caller is an EC2 instance and, if so, apply further bindings that apply
-specifically to EC2 instances -- most of the bindings available to the ec2
-auth method.
-
-However, it is very important to note that if any entity other than an AWS
-service is permitted to call AssumeRole on your role, then that entity can
-simply pass in your instance's instance ID and spoof your instance to Vault.
-This also means that anybody who is able to modify your role's trust policy
-(e.g., via
-[`iam:UpdateAssumeRolePolicy`](http://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAssumeRolePolicy.html),
-then that person could also spoof your instances. If this is a concern but you
-would like to take advantage of inferencing, then you should tightly restrict
-who is able to call AssumeRole on the role, tightly restrict who is able to call
-UpdateAssumeRolePolicy on the role, and monitor CloudTrail logs for calls to
-AssumeRole and UpdateAssumeRolePolicy. All of these caveats apply equally to
-using the iam auth method without inferencing; the point is merely
-that Vault cannot offer an iron-clad guarantee about the inference and it is up
-to operators to determine, based on their own AWS controls and use cases,
-whether or not it's appropriate to configure inferencing.
-
-## Mixing authentication types
-
-Vault allows you to configure using either the ec2 auth method or the iam auth
-method, but not both auth methods. Further, **assumed roles are not supported**
-and Vault prevents you from enforcing restrictions that it cannot enforce given
-the chosen auth type for a role. Some examples of how this works in practice:
-
-1. You configure a role with the ec2 auth type, with a bound AMI ID. A
-   client would not be able to login using the iam auth type.
-2. You configure a role with the iam auth type, with a bound IAM
-   principal ARN. A client would not be able to login with the ec2 auth method.
-3. You configure a role with the iam auth type and further configure
-   inferencing. You have a bound AMI ID and a bound IAM principal ARN. A client
-   must login using the iam method; the RoleSessionName must be a valid instance
-   ID viewable by Vault, and the instance must have come from the bound AMI ID.
-
-## Comparison of the IAM and EC2 methods
-
-The iam and ec2 auth methods serve similar and somewhat overlapping
-functionality, in that both authenticate some type of AWS entity to Vault.
-Here are some comparisons that illustrate why `iam` method is preferred over
-`ec2`.
-
-- What type of entity is authenticated:
-  - The ec2 auth method authenticates only AWS EC2 instances and is specialized
-    to handle EC2 instances, such as restricting access to EC2 instances from
-    a particular AMI, EC2 instances in a particular instance profile, or EC2
-    instances with a specialized tag value (via the role_tag feature).
-  - The iam auth method authenticates AWS IAM principals. This can
-    include IAM users, IAM roles assumed from other accounts, AWS Lambdas that
-    are launched in an IAM role, or even EC2 instances that are launched in an
-    IAM instance profile. However, because it authenticates more generalized IAM
-    principals, this method doesn't offer more granular controls beyond binding
-    to a given IAM principal without the use of inferencing.
-- How the entities are authenticated
-  - The ec2 auth method authenticates instances by making use of the EC2
-    instance identity document, which is a cryptographically signed document
-    containing metadata about the instance. This document changes relatively
-    infrequently, so Vault adds a number of other constructs to mitigate against
-    replay attacks, such as client nonces, role tags, instance migrations, etc.
-    Because the instance identity document is signed by AWS, you have a strong
-    guarantee that it came from an EC2 instance.
-  - The iam auth method authenticates by having clients provide a specially
-    signed AWS API request which the method then passes on to AWS to validate
-    the signature and tell Vault who created it. The actual secret (i.e.,
-    the AWS secret access key) is never transmitted over the wire, and the
-    AWS signature algorithm automatically expires requests after 15 minutes,
-    providing simple and robust protection against replay attacks. The use of
-    inferencing, however, provides a weaker guarantee that the credentials came
-    from an EC2 instance in an IAM instance profile compared to the ec2
-    authentication mechanism.
-  - The instance identity document used in the ec2 auth method is more likely to
-    be stolen given its relatively static nature, but it's harder to spoof. On
-    the other hand, the credentials of an EC2 instance in an IAM instance
-    profile are less likely to be stolen given their dynamic and short-lived
-    nature, but it's easier to spoof credentials that might have come from an
-    EC2 instance.
-- Specific use cases
-  - If you have non-EC2 instance entities, such as IAM users, Lambdas in IAM
-    roles, or developer laptops using [AdRoll's
-    Hologram](https://github.com/AdRoll/hologram) then you would need to use the
-    iam auth method.
-  - If you have EC2 instances, then you could use either auth method. If you
-    need more granular filtering beyond just the instance profile of given EC2
-    instances (such as filtering based off the AMI the instance was launched
-    from), then you would need to use the ec2 auth method, change the instance
-    profile associated with your EC2 instances so they have unique IAM roles
-    for each different Vault role you would want them to authenticate
-    to, or make use of inferencing. If you need to make use of role tags, then
-    you will need to use the ec2 auth method.
-
-## Recommended Vault IAM policy
-
-This specifies the recommended IAM policy needed by the AWS auth method. Note
-that if you are using the same credentials for the AWS auth and secret methods
-(e.g., if you're running Vault on an EC2 instance in an IAM instance profile),
-then you will need to add additional permissions as required by the AWS secret
-method.
-
-```json
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "ec2:DescribeInstances",
-        "iam:GetInstanceProfile",
-        "iam:GetUser",
-        "iam:GetRole"
-      ],
-      "Resource": "*"
-    },
-    {
-      "Effect": "Allow",
-      "Action": ["sts:AssumeRole"],
-      "Resource": ["arn:aws:iam::<AccountId>:role/<VaultRole>"]
-    },
-    {
-      "Sid": "ManageOwnAccessKeys",
-      "Effect": "Allow",
-      "Action": [
-        "iam:CreateAccessKey",
-        "iam:DeleteAccessKey",
-        "iam:GetAccessKeyLastUsed",
-        "iam:GetUser",
-        "iam:ListAccessKeys",
-        "iam:UpdateAccessKey"
-      ],
-      "Resource": "arn:aws:iam::*:user/${aws:username}"
-    }
-  ]
-}
-```
-
-Here are some of the scenarios in which Vault would need to use each of these
-permissions. This isn't intended to be an exhaustive list of all the scenarios
-in which Vault might make an AWS API call, but rather illustrative of why these
-are needed.
-
-- `ec2:DescribeInstances` is necessary when you are using the `ec2` auth method
-  or when you are inferring an `ec2_instance` entity type to validate that the
-  EC2 instance meets binding requirements of the role
-- `iam:GetInstanceProfile` is used when you have a `bound_iam_role_arn` in the
-  `ec2` auth method. Vault needs to determine which IAM role is attached to the
-  instance profile.
-- `iam:GetUser` and `iam:GetRole` are used when using the iam auth method and
-  binding to an IAM user or role principal to determine the [AWS IAM Unique Identifiers](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html#identifiers-unique-ids)
-  or when using a wildcard on the bound ARN to resolve the full ARN of the user
-  or role.
-- The `sts:AssumeRole` stanza is necessary when you are using [Cross Account
-  Access](#cross-account-access). The `Resource`s specified should be a list of
-  all the roles for which you have configured cross-account access, and each of
-  those roles should have this IAM policy attached (except for the
-  `sts:AssumeRole` statement).
-- The `ManageOwnAccessKeys` stanza is necessary when you have configured Vault
-  with static credentials, and wish to rotate these credentials with the
-  [Rotate Root Credentials](/vault/api-docs/auth/aws#rotate-root-credentials)
-  API call.
-
-## Client nonce
-
-Note: this only applies to the ec2 auth method.
-
-If an unintended party gains access to the PKCS#7 signature of the identity
-document (which by default is available to every process and user that gains
-access to an EC2 instance), it can impersonate that instance and fetch a Vault
-token. The method addresses this problem by using a Trust On First Use (TOFU)
-mechanism that allows the first client to present the PKCS#7 signature of the
-document to be authenticated and denying the rest. An important property of
-this design is detection of unauthorized access: if an unintended party authenticates,
-the intended client will be unable to authenticate and can raise an alert for
-investigation.
-
-During the first login, the method stores the instance ID that authenticated
-in a `accesslist`. One method of operation of the method is to disallow any
-authentication attempt for an instance ID contained in the access list, using the
-`disallow_reauthentication` option on the role, meaning that an instance is
-allowed to login only once. However, this has consequences for token rotation,
-as it means that once a token has expired, subsequent authentication attempts
-would fail. By default, reauthentication is enabled in this method, and can be
-turned off using `disallow_reauthentication` parameter on the registered role.
-
-In the default method of operation, the method will return a unique nonce
-during the first authentication attempt, as part of auth `metadata`. Clients
-should present this `nonce` for subsequent login attempts and it should match
-the `nonce` cached at the identity-accesslist entry at the method. Since only
-the original client knows the `nonce`, only the original client is allowed to
-reauthenticate. (This is the reason that this is a accesslist rather than a
-deny list; by default, it's keeping track of clients allowed to reauthenticate,
-rather than those that are not.). Clients can choose to provide a `nonce` even
-for the first login attempt, in which case the provided `nonce` will be tied to
-the cached identity-accesslist entry. It is recommended to use a strong `nonce`
-value in this case.
-
-It is up to the client to behave correctly with respect to the nonce; if the
-client stores the nonce on disk it can survive reboots, but could also give
-access to other users or applications on the instance. It is also up to the
-operator to ensure that client nonces are in fact unique; sharing nonces allows
-a compromise of the nonce value to enable an attacker that gains access to any
-EC2 instance to imitate the legitimate client on that instance. This is why
-nonces can be disabled on the method side in favor of only a single
-authentication per instance; in some cases, such as when using ASGs, instances
-are immutable and single-boot anyways, and in conjunction with a high max TTL,
-reauthentication may not be needed (and if it is, the instance can simply be
-shut down and allow ASG to start a new one).
-
-In both cases, entries can be removed from the accesslist by instance ID,
-allowing reauthentication by a client if the nonce is lost (or not used) and an
-operator approves the process.
-
-One other point: if available by the OS/distribution being used with the EC2
-instance, it is not a bad idea to firewall access to the signed PKCS#7 metadata
-to ensure that it is accessible only to the matching user(s) that require
-access.
-
-The client nonce which is generated by the backend and which gets returned
-along with the authentication response, will be audit logged in plaintext. If
-this is undesired, clients can supply a custom nonce to the login endpoint
-which will not be returned and hence will not be audit logged.
-
-## Advanced options and caveats
-
-### Dynamic management of policies via role tags
-
-Note: This only applies to the ec2 auth method or the iam auth method when
-inferencing is used.
-
-If the instance is required to have customized set of policies based on the
-role it plays, the `role_tag` option can be used to provide a tag to set on
-instances, for a given role. When this option is set, during login, along with
-verification of PKCS#7 signature and instance health, the method will query
-for the value of a specific tag with the configured key that is attached to the
-instance. The tag holds information that represents a _subset_ of privileges that
-are set on the role and are used to further restrict the set of the role's
-privileges for that particular instance.
-
-A `role_tag` can be created using `auth/aws/role/<role>/tag` endpoint
-and is immutable. The information present in the tag is SHA256 hashed and HMAC
-protected. The per-role key to HMAC is only maintained in the method. This prevents
-an adversarial operator from modifying the tag when setting it on the EC2 instance
-in order to escalate privileges.
-
-When 'role_tag' option is enabled on a role, the instances are required to have a
-role tag. If the tag is not found on the EC2 instance, authentication will fail.
-This is to ensure that privileges of an instance are never escalated for not
-having the tag on it or for getting the tag removed. If the role tag creation does
-not specify the policy component, the client will inherit the allowed policies set
-on the role. If the role tag creation specifies the policy component but it contains
-no policies, the token will contain only the `default` policy; by default, this policy
-allows only manipulation (revocation, renewal, lookup) of the existing token, plus
-access to its [cubbyhole](/vault/docs/secrets/cubbyhole).
-This can be useful to allow instances access to a secure "scratch space" for
-storing data (via the token's cubbyhole) but without granting any access to
-other resources provided by or resident in Vault.
-
-### Handling lost client nonces
-
-Note: This only applies to the ec2 auth method.
-
-If an EC2 instance loses its client nonce (due to a reboot, a stop/start of the
-client, etc.), subsequent login attempts will not succeed. If the client nonce
-is lost, normally the only option is to delete the entry corresponding to the
-instance ID from the identity `accesslist` in the method. This can be done via
-the `auth/aws/identity-accesslist/<instance_id>` endpoint. This allows a new
-client nonce to be accepted by the method during the next login request.
-
-Under certain circumstances there is another useful setting. When the instance
-is placed onto a host upon creation, it is given a `pendingTime` value in the
-instance identity document (documentation from AWS does not cover this option,
-unfortunately). If an instance is stopped and started, the `pendingTime` value
-is updated (this does not apply to reboots, however).
-
-The method can take advantage of this via the `allow_instance_migration`
-option, which is set per-role. When this option is enabled, if the client nonce
-does not match the saved nonce, the `pendingTime` value in the instance
-identity document will be checked; if it is newer than the stored `pendingTime`
-value, the method assumes that the client was stopped/started and allows the
-client to log in successfully, storing the new nonce as the valid nonce for
-that client. This essentially re-starts the TOFU mechanism any time the
-instance is stopped and started, so should be used with caution. Just like with
-initial authentication, the legitimate client should have a way to alert (or an
-alert should trigger based on its logs) if it is denied authentication.
-
-Unfortunately, the `allow_instance_migration` only helps during stop/start
-actions; the current metadata does not provide for a way to allow this
-automatic behavior during reboots. The method will be updated if this needed
-metadata becomes available.
-
-The `allow_instance_migration` option is set per-role, and can also be
-specified in a role tag. Since role tags can only restrict behavior, if the
-option is set to `false` on the role, a value of `true` in the role tag takes
-effect; however, if the option is set to `true` on the role, a value set in the
-role tag has no effect.
-
-### Disabling reauthentication
-
-Note: this only applies to the ec2 auth method.
-
-If in a given organization's architecture, a client fetches a long-lived Vault
-token and has no need to rotate the token, all future logins for that instance
-ID can be disabled. If the option `disallow_reauthentication` is set, only one
-login will be allowed per instance. If the intended client successfully
-retrieves a token during login, it can be sure that its token will not be
-hijacked by another entity.
-
-When `disallow_reauthentication` option is enabled, the client can choose not
-to supply a nonce during login, although it is not an error to do so (the nonce
-is simply ignored). Note that reauthentication is enabled by default. If only
-a single login is desired, `disallow_reauthentication` should be set explicitly
-on the role or on the role tag.
-
-The `disallow_reauthentication` option is set per-role, and can also be
-specified in a role tag. Since role tags can only restrict behavior, if the
-option is set to `false` on the role, a value of `true` in the role tag takes
-effect; however, if the option is set to `true` on the role, a value set in the
-role tag has no effect.
-
-### Deny listing role tags
-
-Note: this only applies to the ec2 auth method or the iam auth method
-when inferencing is used.
-
-Role tags are tied to a specific role, but the method has no control over, which
-instances using that role, should have any particular role tag; that is purely up
-to the operator. Although role tags are only restrictive (a tag cannot escalate
-privileges above what is set on its role), if a role tag is found to have been
-used incorrectly, and the administrator wants to ensure that the role tag has no
-further effect, the role tag can be placed on a `deny list` via the endpoint
-`auth/aws/roletag-denylist/<role_tag>`. Note that this will not invalidate the
-tokens that were already issued; this only blocks any further login requests from
-those instances that have the deny listed tag attached to them.
-
-### Expiration times and tidying of `denylist` and `accesslist` entries
-
-The expired entries in both identity `accesslist` and role tag `denylist` are
-deleted automatically. The entries in both of these lists contain an expiration
-time which is dynamically determined by three factors: `max_ttl` set on the role,
-`max_ttl` set on the role tag, and `max_ttl` value of the method mount. The
-least of these three dictates the maximum TTL of the issued token, and
-correspondingly will be set as the expiration times of these entries.
-
-The endpoints `auth/aws/tidy/identity-accesslist` and `auth/aws/tidy/roletag-denylist` are
-provided to clean up the entries present in these lists. These endpoints allow
-defining a safety buffer, such that an entry must not only be expired, but be
-past expiration by the amount of time dictated by the safety buffer in order
-to actually remove the entry.
-
-Automatic deletion of expired entries is performed by the periodic function
-of the method. This function does the tidying of both access list role tags
-and access list identities. Periodic tidying is activated by default and will
-have a safety buffer of 72 hours, meaning only those entries are deleted which
-were expired before 72 hours from when the tidy operation is being performed.
-This can be configured via `config/tidy/roletag-denylist` and `config/tidy/identity-accesslist`
-endpoints.
-
-### Varying public certificates
-
-Note: this only applies to the ec2 auth method.
-
-The AWS public certificate, which contains the public key used to verify the
-PKCS#7 signature, varies for different AWS regions. The primary AWS public
-certificate, which covers most AWS regions, is already included in Vault and
-does not need to be added. Instances whose PKCS#7 signatures cannot be
-verified by the default public certificate included in Vault can register a
-different public certificate which can be found [here](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html),
-via the `auth/aws/config/certificate/<cert_name>` endpoint.
-
-### Dangling tokens
-
-An EC2 instance, after authenticating itself with the method, gets a Vault token.
-After that, if the instance terminates or goes down for any reason, the method
-will not be aware of such events. The token issued will still be valid, until
-it expires. The token will likely be expired sooner than its lifetime when the
-instance fails to renew the token on time.
-
-### Cross account access
-
-To allow Vault to authenticate IAM principals and EC2 instances in other
-accounts, Vault supports using AWS STS (Security Token Service) to assume AWS
-IAM Roles in other accounts. For each target AWS account ID, you configure the
-IAM Role for Vault to assume using the `auth/aws/config/sts/<account_id>` and
-Vault will use credentials from assuming that role to validate IAM principals
-and EC2 instances in the target account.
-
-The account in which Vault is running (i.e. the master account) must be listed as
-a trusted entity in the IAM Role being assumed on the remote account. The Role itself
-should allow the permissions specified in the [Recommended Vault IAM
-Policy](#recommended-vault-iam-policy) except it doesn't need any further
-`sts:AssumeRole` permissions.
-
-Furthermore, in the master account, Vault must be granted the action `sts:AssumeRole`
-for the IAM Role to be assumed.
-
-### AWS instance metadata timeout
-
-@include 'aws-imds-timeout.mdx'
-
-## Authentication
-
-### Via the CLI
-
-#### Enable AWS EC2 authentication in Vault.
-
-```shell-session
-$ vault auth enable aws
-```
-
-#### Configure the credentials required to make AWS API calls
-
-If not specified, Vault will attempt to use standard environment variables
-(`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) or IAM EC2 instance role
-credentials if available.
-
-The IAM account or role to which the credentials map must allow the
-`ec2:DescribeInstances` action. In addition, if IAM Role binding is used (see
-`bound_iam_role_arn` below), `iam:GetInstanceProfile` must also be allowed.
-
-```shell-session
-$ vault write auth/aws/config/client secret_key=vCtSM8ZUEQ3mOFVlYPBQkf2sO6F/W7a5TVzrl3Oj access_key=VKIAJBRHKH6EVTTNXDHA
-```
-
-#### Configure the policies on the role.
-
-```shell-session
-$ vault write auth/aws/role/dev-role auth_type=ec2 bound_ami_id=ami-fce3c696 policies=prod,dev max_ttl=500h
-
-$ vault write auth/aws/role/dev-role-iam auth_type=iam \
-              bound_iam_principal_arn=arn:aws:iam::123456789012:role/MyRole policies=prod,dev max_ttl=500h
-```
-
-#### Configure a required X-Vault-AWS-IAM-Server-ID header (recommended)
-
-```shell-session
-$ vault write auth/aws/config/client iam_server_id_header_value=vault.example.com
-```
-
-#### Perform the login operation
-
-For the ec2 auth method, first fetch the PKCS#7 signature on the AWS instance:
-
-```shell-session
-$ SIGNATURE=$(curl -s http://169.254.169.254/latest/dynamic/instance-identity/rsa2048 | tr -d '\n')
-```
-
-then set the signature on the login endpoint:
-
-```shell-session
-$ vault write auth/aws/login role=dev-role \
-  pkcs7=$SIGNATURE
-```
-
-For the iam auth method, generating the signed request is a non-standard
-operation. The Vault cli supports generating this for you:
-
-```shell-session
-$ vault login -method=aws header_value=vault.example.com role=dev-role-iam
-```
-
-This assumes you have AWS credentials configured in the standard locations AWS
-SDKs search for credentials (environment variables, ~/.aws/credentials, IAM
-instance profile, or ECS task role, in that order). If you do not have IAM
-credentials available at any of these locations, you can explicitly pass them
-in on the command line (though this is not recommended), omitting
-`aws_security_token` if not applicable.
-
-```shell-session
-$ vault login -method=aws header_value=vault.example.com role=dev-role-iam \
-        aws_access_key_id=<access_key> \
-        aws_secret_access_key=<secret_key> \
-        aws_security_token=<security_token>
-```
-
-The region used defaults to `us-east-1`, but you can specify a custom region like so:
-
-```shell-session
-$ vault login -method=aws region=us-west-2 role=dev-role-iam
-```
-
-If the region is specified as `auto`, the Vault CLI will determine the region based
-on standard AWS credentials precedence as described earlier. Whichever method is used,
-be sure the designated region corresponds to that of the STS endpoint you're using.
-
-~> **Note:** If you are making use of AWS GovCloud and setting the `sts_endpoint`
-and `sts_region` role parameters to `us-gov-west-1` / `us-gov-east-1` then you must include
-the `region` argument in your login request with a matching value, i.e. `region=us-gov-west-1`.
-
-An example of how to generate the required request values for the `login` method
-can be found found in the [vault cli
-source code](https://github.com/hashicorp/vault/blob/main/builtin/credential/aws/cli.go).
-Using an approach such as this, the request parameters can be generated and
-passed to the `login` method:
-
-```shell-session
-$ vault write auth/aws/login role=dev-role-iam \
-        iam_http_request_method=POST \
-        iam_request_url=aHR0cHM6Ly9zdHMuYW1hem9uYXdzLmNvbS8= \
-        iam_request_body=QWN0aW9uPUdldENhbGxlcklkZW50aXR5JlZlcnNpb249MjAxMS0wNi0xNQ== \
-        iam_request_headers=eyJDb250ZW50LUxlbmd0aCI6IFsiNDMiXSwgIlVzZXItQWdlbnQiOiBbImF3cy1zZGstZ28vMS40LjEyIChnbzEuNy4xOyBsaW51eDsgYW1kNjQpIl0sICJYLVZhdWx0LUFXU0lBTS1TZXJ2ZXItSWQiOiBbInZhdWx0LmV4YW1wbGUuY29tIl0sICJYLUFtei1EYXRlIjogWyIyMDE2MDkzMFQwNDMxMjFaIl0sICJDb250ZW50LVR5cGUiOiBbImFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZDsgY2hhcnNldD11dGYtOCJdLCAiQXV0aG9yaXphdGlvbiI6IFsiQVdTNC1ITUFDLVNIQTI1NiBDcmVkZW50aWFsPWZvby8yMDE2MDkzMC91cy1lYXN0LTEvc3RzL2F3czRfcmVxdWVzdCwgU2lnbmVkSGVhZGVycz1jb250ZW50LWxlbmd0aDtjb250ZW50LXR5cGU7aG9zdDt4LWFtei1kYXRlO3gtdmF1bHQtc2VydmVyLCBTaWduYXR1cmU9YTY5ZmQ3NTBhMzQ0NWM0ZTU1M2UxYjNlNzlkM2RhOTBlZWY1NDA0N2YxZWI0ZWZlOGZmYmM5YzQyOGMyNjU1YiJdfQ==
-```
-
-### Via the API
-
-#### Enable AWS authentication in Vault.
-
-```
-curl -X POST -H "X-Vault-Token:123" "http://127.0.0.1:8200/v1/sys/auth/aws" -d '{"type":"aws"}'
-```
-
-#### Configure the credentials required to make AWS API calls.
-
-```
-curl -X POST -H "X-Vault-Token:123" "http://127.0.0.1:8200/v1/auth/aws/config/client" -d '{"access_key":"VKIAJBRHKH6EVTTNXDHA", "secret_key":"vCtSM8ZUEQ3mOFVlYPBQkf2sO6F/W7a5TVzrl3Oj"}'
-```
-
-#### Configure the policies on the role.
-
-```
-curl -X POST -H "X-Vault-Token:123" "http://127.0.0.1:8200/v1/auth/aws/role/dev-role -d '{"bound_ami_id":"ami-fce3c696","policies":"prod,dev","max_ttl":"500h"}'
-
-curl -X POST -H "X-Vault-Token:123" "http://127.0.0.1:8200/v1/auth/aws/role/dev-role-iam -d '{"auth_type":"iam","policies":"prod,dev","max_ttl":"500h","bound_iam_principal_arn":"arn:aws:iam::123456789012:role/MyRole"}'
-```
-
-#### Perform the login operation
-
-```
-curl -X POST "http://127.0.0.1:8200/v1/auth/aws/login" -d '{"role":"dev-role","pkcs7":"'$(curl -s http://169.254.169.254/latest/dynamic/instance-identity/rsa2048 | tr -d '\n')'","nonce":"5defbf9e-a8f9-3063-bdfc-54b7a42a1f95"}'
-
-curl -X POST "http://127.0.0.1:8200/v1/auth/aws/login" -d '{"role":"dev", "iam_http_request_method": "POST", "iam_request_url": "aHR0cHM6Ly9zdHMuYW1hem9uYXdzLmNvbS8=", "iam_request_body": "QWN0aW9uPUdldENhbGxlcklkZW50aXR5JlZlcnNpb249MjAxMS0wNi0xNQ==", "iam_request_headers": "eyJDb250ZW50LUxlbmd0aCI6IFsiNDMiXSwgIlVzZXItQWdlbnQiOiBbImF3cy1zZGstZ28vMS40LjEyIChnbzEuNy4xOyBsaW51eDsgYW1kNjQpIl0sICJYLVZhdWx0LUFXU0lBTS1TZXJ2ZXItSWQiOiBbInZhdWx0LmV4YW1wbGUuY29tIl0sICJYLUFtei1EYXRlIjogWyIyMDE2MDkzMFQwNDMxMjFaIl0sICJDb250ZW50LVR5cGUiOiBbImFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZDsgY2hhcnNldD11dGYtOCJdLCAiQXV0aG9yaXphdGlvbiI6IFsiQVdTNC1ITUFDLVNIQTI1NiBDcmVkZW50aWFsPWZvby8yMDE2MDkzMC91cy1lYXN0LTEvc3RzL2F3czRfcmVxdWVzdCwgU2lnbmVkSGVhZGVycz1jb250ZW50LWxlbmd0aDtjb250ZW50LXR5cGU7aG9zdDt4LWFtei1kYXRlO3gtdmF1bHQtc2VydmVyLCBTaWduYXR1cmU9YTY5ZmQ3NTBhMzQ0NWM0ZTU1M2UxYjNlNzlkM2RhOTBlZWY1NDA0N2YxZWI0ZWZlOGZmYmM5YzQyOGMyNjU1YiJdfQ==" }'
-```
-
-The response will be in JSON. For example:
-
-```javascript
-{
-  "auth": {
-    "renewable": true,
-    "lease_duration": 72000,
-    "metadata": {
-      "role_tag_max_ttl": "0s",
-      "role": "ami-f083709d",
-      "region": "us-east-1",
-      "nonce": "5defbf9e-a8f9-3063-bdfc-54b7a42a1f95",
-      "instance_id": "i-a832f734",
-      "ami_id": "ami-f083709d"
-    },
-    "policies": [
-      "default",
-      "dev",
-      "prod"
-    ],
-    "accessor": "5cd96cd1-58b7-2904-5519-75ddf957ec06",
-    "client_token": "150fc858-2402-49c9-56a5-f4b57f2c8ff1"
-  },
-  "warnings": null,
-  "wrap_info": null,
-  "data": null,
-  "lease_duration": 0,
-  "renewable": false,
-  "lease_id": "",
-  "request_id": "d7d50c06-56b8-37f4-606c-ccdc87a1ee4c"
-}
-```
-
-## API
-
-The AWS auth method has a full HTTP API. Please see the
-[AWS Auth API](/vault/api-docs/auth/aws) for more
-details.
-
-## Code example
-
-The following example demonstrates the AWS (IAM) auth method to authenticate with Vault.
-
-<CodeTabs>
-
-<CodeBlockConfig>
-
-```go
-package main
-
-import (
-	"context"
-	"fmt"
-
-	vault "github.com/hashicorp/vault/api"
-	auth "github.com/hashicorp/vault/api/auth/aws"
-)
-
-// Fetches a key-value secret (kv-v2) after authenticating to Vault via AWS IAM,
-// one of two auth methods used to authenticate with AWS (the other is EC2 auth).
-func getSecretWithAWSAuthIAM() (string, error) {
-	config := vault.DefaultConfig() // modify for more granular configuration
-
-	client, err := vault.NewClient(config)
-	if err != nil {
-		return "", fmt.Errorf("unable to initialize Vault client: %w", err)
-	}
-
-	awsAuth, err := auth.NewAWSAuth(
-		auth.WithRole("dev-role-iam"), // if not provided, Vault will fall back on looking for a role with the IAM role name if you're using the iam auth type, or the EC2 instance's AMI id if using the ec2 auth type
-	)
-	if err != nil {
-		return "", fmt.Errorf("unable to initialize AWS auth method: %w", err)
-	}
-
-	authInfo, err := client.Auth().Login(context.Background(), awsAuth)
-	if err != nil {
-		return "", fmt.Errorf("unable to login to AWS auth method: %w", err)
-	}
-	if authInfo == nil {
-		return "", fmt.Errorf("no auth info was returned after login")
-	}
-
-	// get secret from the default mount path for KV v2 in dev mode, "secret"
-	secret, err := client.KVv2("secret").Get(context.Background(), "creds")
-	if err != nil {
-		return "", fmt.Errorf("unable to read secret: %w", err)
-	}
-
-	// data map can contain more than one key-value pair,
-	// in this case we're just grabbing one of them
-	value, ok := secret.Data["password"].(string)
-	if !ok {
-		return "", fmt.Errorf("value type assertion failed: %T %#v", secret.Data["password"], secret.Data["password"])
-	}
-
-	return value, nil
-}
-```
-</CodeBlockConfig>
-
-<CodeBlockConfig>
-
-```cs
-using System;
-using System.Text;
-using Amazon.Runtime;
-using Amazon.Runtime.Internal;
-using Amazon.Runtime.Internal.Auth;
-using Amazon.Runtime.Internal.Util;
-using Amazon.SecurityToken;
-using Amazon.SecurityToken.Model;
-using Amazon.SecurityToken.Model.Internal.MarshallTransformations;
-using Newtonsoft.Json;
-using VaultSharp;
-using VaultSharp.V1.AuthMethods;
-using VaultSharp.V1.AuthMethods.AWS;
-using VaultSharp.V1.Commons;
-using VaultSharp.V1.SecretsEngines.AWS;
-
-namespace Examples
-{
-    public class AwsAuthExample
-    {
-        /// <summary>
-        /// Fetches a key-value secret (kv-v2) after authenticating to Vault via AWS IAM,
-        /// one of two auth methods used to authenticate with AWS (the other is EC2 auth).
-        /// </summary>
-        public string GetSecretAWSAuthIAM()
-        {
-            var vaultAddr = Environment.GetEnvironmentVariable("VAULT_ADDR");
-            if(String.IsNullOrEmpty(vaultAddr))
-            {
-                throw new System.ArgumentNullException("Vault Address");
-            }
-
-            var roleName = Environment.GetEnvironmentVariable("VAULT_ROLE");
-            if(String.IsNullOrEmpty(roleName))
-            {
-                throw new System.ArgumentNullException("Vault Role Name");
-            }
-
-            var amazonSecurityTokenServiceConfig = new AmazonSecurityTokenServiceConfig();
-
-            // Initialize BasicAWS Credentials w/ an accessKey and secretKey
-            Amazon.Runtime.AWSCredentials awsCredentials = new BasicAWSCredentials(accessKey: Environment.GetEnvironmentVariable("AWS_ACCESS_KEY_ID"),
-                                                                secretKey: Environment.GetEnvironmentVariable("AWS_SECRET_ACCESS_KEY"));
-
-            // Construct the IAM Request and add necessary headers
-            var iamRequest = GetCallerIdentityRequestMarshaller.Instance.Marshall(new GetCallerIdentityRequest());
-
-            iamRequest.Endpoint = new Uri(amazonSecurityTokenServiceConfig.DetermineServiceURL());
-            iamRequest.ResourcePath = "/";
-
-            iamRequest.Headers.Add("User-Agent", "some-agent");
-            iamRequest.Headers.Add("X-Amz-Security-Token", awsCredentials.GetCredentials().Token);
-            iamRequest.Headers.Add("Content-Type", "application/x-www-form-urlencoded; charset=utf-8");
-
-            new AWS4Signer().Sign(iamRequest, amazonSecurityTokenServiceConfig, new RequestMetrics(), awsCredentials.GetCredentials().AccessKey, awsCredentials.GetCredentials().SecretKey);
-            var iamSTSRequestHeaders = iamRequest.Headers;
-
-            // Convert headers to Base64 encoded version
-            var base64EncodedIamRequestHeaders = Convert.ToBase64String(Encoding.UTF8.GetBytes(JsonConvert.SerializeObject(iamSTSRequestHeaders)));
-
-            IAuthMethodInfo authMethod = new IAMAWSAuthMethodInfo(roleName: roleName, requestHeaders: base64EncodedIamRequestHeaders);
-            var vaultClientSettings = new VaultClientSettings(vaultAddr, authMethod);
-
-            IVaultClient vaultClient = new VaultClient(vaultClientSettings);
-
-            // We can retrieve the secret from the VaultClient object
-            Secret<SecretData> kv2Secret = null;
-            kv2Secret = vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(path: "/creds").Result;
-
-            var password = kv2Secret.Data.Data["password"];
-
-            return password.ToString();
-        }
-    }
-}
-```
-</CodeBlockConfig>
-
-</CodeTabs>
diff --git a/website/content/docs/auth/azure.mdx b/website/content/docs/auth/azure.mdx
deleted file mode 100644
index dae629a2ed6..00000000000
--- a/website/content/docs/auth/azure.mdx
+++ /dev/null
@@ -1,406 +0,0 @@
----
-layout: docs
-page_title: Azure - Auth Methods
-description: |-
-  The azure auth method plugin allows automated authentication of Azure Active
-  Directory.
----
-
-# Azure auth method
-
-The `azure` auth method allows authentication against Vault using
-Azure Active Directory credentials. It treats Azure as a Trusted Third Party
-and expects a [JSON Web Token (JWT)](https://tools.ietf.org/html/rfc7519)
-signed by Azure Active Directory for the configured tenant.
-
-This method supports authentication for system-assigned and user-assigned
-managed identities. See [Managed identities for Azure resources](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)
-for more information about these resources.
-
-This documentation assumes the Azure method is mounted at the `/auth/azure`
-path in Vault. Since it is possible to enable auth methods at any location,
-please update your API calls accordingly.
-
-## Prerequisites:
-
-The Azure auth method requires client credentials to access Azure APIs. The following
-are required to configure the auth method:
-
-- A configured [Azure AD application](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-integrating-applications)
-  which is used as the resource for generating MSI access tokens.
-- Client credentials (shared secret) with read access to particular Azure Resource Manager
-  resources. See [Azure AD Service to Service Client Credentials](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service).
-
-If Vault is hosted on Azure, Vault can use MSI to access Azure instead of a shared secret.
-A managed identity must be [enabled](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/)
-on the resource that acquires the access token.
-
-The following Azure [role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview#role-assignments)
-must be granted to the Azure AD application in order for the auth method to access Azure
-APIs during authentication.
-
-### Role assignments
-
-~> **Note:** The role assignments are only required when the
-[`vm_name`](/vault/api-docs/auth/azure#vm_name), [`vmss_name`](/vault/api-docs/auth/azure#vmss_name),
-or [`resource_id`](/vault/api-docs/auth/azure#resource_id) parameters are used on login.
-
-| Azure Environment | Login Parameter | Azure API Permission |
-| ----------- | --------------- | -------------------- |
-| Virtual Machine | [`vm_name`](/vault/api-docs/auth/azure#vm_name) | `Microsoft.Compute/virtualMachines/*/read` |
-| Virtual Machine Scale Set ([Uniform Orchestration][vmss-uniform]) | [`vmss_name`](/vault/api-docs/auth/azure#vmss_name) | `Microsoft.Compute/virtualMachineScaleSets/*/read` |
-| Virtual Machine Scale Set ([Flexible Orchestration][vmss-flex]) | [`vmss_name`](/vault/api-docs/auth/azure#vmss_name) | `Microsoft.Compute/virtualMachineScaleSets/*/read` `Microsoft.ManagedIdentity/userAssignedIdentities/*/read` |
-| Services that ([support managed identities][managed-identities]) for Azure resources | [`resource_id`](/vault/api-docs/auth/azure#resource_id) | `read` on the resource used to obtain the JWT |
-
-[vmss-uniform]: https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-orchestration-modes#scale-sets-with-uniform-orchestration
-[vmss-flex]: https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-orchestration-modes#scale-sets-with-flexible-orchestration
-[managed-identities]: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/managed-identities-status
-
-### API permissions
-
-The following [API permissions](https://learn.microsoft.com/en-us/azure/active-directory/develop/permissions-consent-overview#types-of-permissions)
-must be assigned to the service principal provided to Vault for managing the root rotation in Azure:
-
-| Permission Name               | Type        |
-| ----------------------------- | ----------- |
-| Application.ReadWrite.All     | Application |
-
-## Authentication
-
-### Via the CLI
-
-The default path is `/auth/azure`. If this auth method was enabled at a different
-path, specify `auth/my-path/login` instead.
-
-```shell-session
-$ vault write auth/azure/login \
-    role="dev-role" \
-    jwt="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
-    subscription_id="12345-..." \
-    resource_group_name="test-group" \
-    vm_name="test-vm"
-```
-
-The `role` and `jwt` parameters are required. When using
-`bound_service_principal_ids` and `bound_group_ids` in the token roles, all the
-information is required in the JWT (except for `vm_name`, `vmss_name`, `resource_id`). When
-using other `bound_*` parameters, calls to Azure APIs will be made and
-`subscription_id`, `resource_group_name`, and `vm_name`/`vmss_name` are all required
-and can be obtained through instance metadata.
-
-For example:
-
-```shell-session
-$ vault write auth/azure/login role="dev-role" \
-     jwt="$(curl -s 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' -H Metadata:true | jq -r '.access_token')" \
-     subscription_id=$(curl -s -H Metadata:true "http://169.254.169.254/metadata/instance?api-version=2017-08-01" | jq -r '.compute | .subscriptionId')  \
-     resource_group_name=$(curl -s -H Metadata:true "http://169.254.169.254/metadata/instance?api-version=2017-08-01" | jq -r '.compute | .resourceGroupName') \
-     vm_name=$(curl -s -H Metadata:true "http://169.254.169.254/metadata/instance?api-version=2017-08-01" | jq -r '.compute | .name')
-```
-
-### Via the API
-
-The default endpoint is `auth/azure/login`. If this auth method was enabled
-at a different path, use that value instead of `azure`.
-
-```shell-session
-$ curl \
-    --request POST \
-    --data '{"role": "dev-role", "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."}' \
-    https://127.0.0.1:8200/v1/auth/azure/login
-```
-
-The response will contain the token at `auth.client_token`:
-
-```json
-{
-  "auth": {
-    "client_token": "f33f8c72-924e-11f8-cb43-ac59d697597c",
-    "accessor": "0e9e354a-520f-df04-6867-ee81cae3d42d",
-    "policies": ["default", "dev", "prod"],
-    "lease_duration": 2764800,
-    "renewable": true
-  }
-}
-```
-
-## Configuration
-
-Auth methods must be configured in advance before machines can authenticate.
-These steps are usually completed by an operator or configuration management
-tool.
-
-### Via the CLI
-
-1. Enable Azure authentication in Vault:
-
-   ```shell-session
-   $ vault auth enable azure
-   ```
-
-1. Configure the Azure auth method:
-
-   ```shell-session
-   $ vault write auth/azure/config \
-       tenant_id=7cd1f227-ca67-4fc6-a1a4-9888ea7f388c \
-       resource=https://management.azure.com/ \
-       client_id=dd794de4-4c6c-40b3-a930-d84cd32e9699 \
-       client_secret=IT3B2XfZvWnfB98s1cie8EMe7zWg483Xy8zY004=
-   ```
-
-   For the complete list of configuration options, please see the API
-   documentation.
-
-1. Create a role:
-
-   ```shell-session
-   $ vault write auth/azure/role/dev-role \
-       policies="prod,dev" \
-       bound_subscription_ids=6a1d5988-5917-4221-b224-904cd7e24a25 \
-       bound_resource_groups=vault
-   ```
-
-   Roles are associated with an authentication type/entity and a set of Vault
-   policies. Roles are configured with constraints specific to the
-   authentication type, as well as overall constraints and configuration for
-   the generated auth tokens.
-
-   For the complete list of role options, please see the [API documentation](/vault/api-docs/auth/azure).
-
-### Via the API
-
-1. Enable Azure authentication in Vault:
-
-   ```shell-session
-   $ curl \
-       --header "X-Vault-Token: ..." \
-       --request POST \
-       --data '{"type": "azure"}' \
-       https://127.0.0.1:8200/v1/sys/auth/azure
-   ```
-
-1. Configure the Azure auth method:
-
-   ```shell-session
-   $ curl \
-       --header "X-Vault-Token: ..." \
-       --request POST \
-       --data '{"tenant_id": "...", "resource": "..."}' \
-       https://127.0.0.1:8200/v1/auth/azure/config
-   ```
-
-1. Create a role:
-
-   ```shell-session
-   $ curl \
-       --header "X-Vault-Token: ..." \
-       --request POST \
-       --data '{"policies": ["dev", "prod"], ...}' \
-       https://127.0.0.1:8200/v1/auth/azure/role/dev-role
-   ```
-
-## Azure managed identities
-
-There are two types of [managed identities](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview#managed-identity-types)
-in Azure: System-assigned and User-assigned. System-assigned identities are unique to
-every virtual machine in Azure. If the resources using Azure auth are recreated
-frequently, using system-assigned identities could result in many Vault entities being
-created. For environments with high ephemeral workloads, user-assigned identities are
-recommended.
-
-
-### Limitations
-
-The TTL of the access token returned by Azure AD for a managed identity is
-24hrs and is not configurable. See ([limitations of using managed identities][id-limitations])
-for more info.
-
-[id-limitations]: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/managed-identity-best-practice-recommendations#limitation-of-using-managed-identities-for-authorization
-
-## Azure debug logs
-
-The Azure auth plugin supports debug logging which includes additional information
-about requests and responses from the Azure API.
-
-To enable the Azure debug logs, set the following environment variable on the Vault
-server:
-
-```shell
-AZURE_GO_SDK_LOG_LEVEL=DEBUG
-```
-
-## API
-
-The Azure Auth Plugin has a full HTTP API. Please see the [API documentation](/vault/api-docs/auth/azure) for more details.
-
-## Code example
-
-The following example demonstrates the Azure auth method to authenticate
-with Vault.
-
-<CodeTabs>
-
-<CodeBlockConfig>
-
-```go
-package main
-
-import (
-	"context"
-	"fmt"
-
-	vault "github.com/hashicorp/vault/api"
-	auth "github.com/hashicorp/vault/api/auth/azure"
-)
-
-// Fetches a key-value secret (kv-v2) after authenticating to Vault via Azure authentication.
-// This example assumes you have a configured Azure AD Application.
-func getSecretWithAzureAuth() (string, error) {
-	config := vault.DefaultConfig() // modify for more granular configuration
-
-	client, err := vault.NewClient(config)
-	if err != nil {
-		return "", fmt.Errorf("unable to initialize Vault client: %w", err)
-	}
-
-	azureAuth, err := auth.NewAzureAuth(
-		"dev-role-azure",
-	)
-	if err != nil {
-		return "", fmt.Errorf("unable to initialize Azure auth method: %w", err)
-	}
-
-	authInfo, err := client.Auth().Login(context.Background(), azureAuth)
-	if err != nil {
-		return "", fmt.Errorf("unable to login to Azure auth method: %w", err)
-	}
-	if authInfo == nil {
-		return "", fmt.Errorf("no auth info was returned after login")
-	}
-
-	// get secret from the default mount path for KV v2 in dev mode, "secret"
-	secret, err := client.KVv2("secret").Get(context.Background(), "creds")
-	if err != nil {
-		return "", fmt.Errorf("unable to read secret: %w", err)
-	}
-
-	// data map can contain more than one key-value pair,
-	// in this case we're just grabbing one of them
-	value, ok := secret.Data["password"].(string)
-	if !ok {
-		return "", fmt.Errorf("value type assertion failed: %T %#v", secret.Data["password"], secret.Data["password"])
-	}
-
-	return value, nil
-}
-
-```
-</CodeBlockConfig>
-
-<CodeBlockConfig>
-
-```cs
-using System;
-using System.Collections.Generic;
-using System.IO;
-using System.Net;
-using System.Net.Http;
-using System.Text;
-using Newtonsoft.Json;
-using VaultSharp;
-using VaultSharp.V1.AuthMethods;
-using VaultSharp.V1.AuthMethods.Azure;
-using VaultSharp.V1.Commons;
-
-namespace Examples
-{
-    public class AzureAuthExample
-    {
-        public class InstanceMetadata
-        {
-            public string name { get; set; }
-            public string resourceGroupName { get; set; }
-            public string subscriptionId { get; set; }
-        }
-
-        const string MetadataEndPoint = "http://169.254.169.254/metadata/instance?api-version=2017-08-01";
-        const string AccessTokenEndPoint = "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/";
-
-        /// <summary>
-        /// Fetches a key-value secret (kv-v2) after authenticating to Vault via Azure authentication.
-        /// This example assumes you have a configured Azure AD Application.
-        /// </summary>
-        public string GetSecretWithAzureAuth()
-        {
-            string vaultAddr = Environment.GetEnvironmentVariable("VAULT_ADDR");
-            if(String.IsNullOrEmpty(vaultAddr))
-            {
-                throw new System.ArgumentNullException("Vault Address");
-            }
-
-            string roleName = Environment.GetEnvironmentVariable("VAULT_ROLE");
-            if(String.IsNullOrEmpty(roleName))
-            {
-                throw new System.ArgumentNullException("Vault Role Name");
-            }
-
-            string jwt = GetJWT();
-            InstanceMetadata metadata = GetMetadata();
-
-            IAuthMethodInfo authMethod = new AzureAuthMethodInfo(roleName: roleName, jwt: jwt, subscriptionId: metadata.subscriptionId, resourceGroupName: metadata.resourceGroupName, virtualMachineName: metadata.name);
-            var vaultClientSettings = new VaultClientSettings(vaultAddr, authMethod);
-
-            IVaultClient vaultClient = new VaultClient(vaultClientSettings);
-
-            // We can retrieve the secret from the VaultClient object
-            Secret<SecretData> kv2Secret = null;
-            kv2Secret = vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(path: "/creds").Result;
-
-            var password = kv2Secret.Data.Data["password"];
-
-            return password.ToString();
-        }
-
-        /// <summary>
-        /// Query Azure Resource Manage for metadata about the Azure instance
-        /// </summary>
-        private InstanceMetadata GetMetadata()
-        {
-            HttpWebRequest metadataRequest = (HttpWebRequest)WebRequest.Create(MetadataEndPoint);
-            metadataRequest.Headers["Metadata"] = "true";
-            metadataRequest.Method = "GET";
-
-            HttpWebResponse metadataResponse = (HttpWebResponse)metadataRequest.GetResponse();
-
-            StreamReader streamResponse = new StreamReader(metadataResponse.GetResponseStream());
-            string stringResponse = streamResponse.ReadToEnd();
-            var resultsDict = JsonConvert.DeserializeObject<Dictionary<string, InstanceMetadata>>(stringResponse);
-
-            return resultsDict["compute"];
-        }
-
-        /// <summary>
-        /// Query Azure Resource Manager (ARM) for an access token
-        /// </summary>
-        private string GetJWT()
-        {
-            HttpWebRequest request = (HttpWebRequest)WebRequest.Create(AccessTokenEndPoint);
-            request.Headers["Metadata"] = "true";
-            request.Method = "GET";
-
-            HttpWebResponse response = (HttpWebResponse)request.GetResponse();
-
-            // Pipe response Stream to a StreamReader and extract access token
-            StreamReader streamResponse = new StreamReader(response.GetResponseStream());
-            string stringResponse = streamResponse.ReadToEnd();
-            var resultsDict = JsonConvert.DeserializeObject<Dictionary<string, string>>(stringResponse);
-
-            return resultsDict["access_token"];
-        }
-    }
-}
-```
-
-</CodeBlockConfig>
-
-</CodeTabs>
diff --git a/website/content/docs/auth/cert.mdx b/website/content/docs/auth/cert.mdx
deleted file mode 100644
index ea4027ea3f2..00000000000
--- a/website/content/docs/auth/cert.mdx
+++ /dev/null
@@ -1,146 +0,0 @@
----
-layout: docs
-page_title: TLS Certificates - Auth Methods
-description: >-
-  The "cert" auth method allows users to authenticate with Vault using TLS
-  client certificates.
----
-
-# TLS certificates auth method
-
-@include 'x509-sha1-deprecation.mdx'
-
-The `cert` auth method allows authentication using SSL/TLS client certificates
-which are either signed by a CA or self-signed. SSL/TLS client certificates
-are defined as having an `ExtKeyUsage` extension with the usage set to either
-`ClientAuth` or `Any`.
-
-The trusted certificates and CAs are configured directly to the auth method
-using the `certs/` path. This method cannot read trusted certificates from an
-external source.
-
-CA certificates are associated with a role; role names and CRL names are normalized to
-lower-case.
-
-Please note that to use this auth method, `tls_disable` and `tls_disable_client_certs` must be false in the Vault
-configuration. This is because the certificates are sent through TLS communication itself.
-
-## Revocation checking
-
-Since Vault 0.4, the method supports revocation checking.
-
-An authorized user can submit PEM-formatted CRLs identified by a given name;
-these can be updated or deleted at will. They may also set the URL of a
-trusted CRL distribution point, and have Vault fetch the CRL as needed.
-
-When there are CRLs present, at the time of client authentication:
-
-- If the client presents any chain where no certificate in the chain matches a
-  revoked serial number, authentication is allowed
-
-- If there is no chain presented by the client without a revoked serial number,
-  authentication is denied
-
-This method provides good security while also allowing for flexibility. For
-instance, if an intermediate CA is going to be retired, a client can be
-configured with two certificate chains: one that contains the initial
-intermediate CA in the path, and the other that contains the replacement. When
-the initial intermediate CA is revoked, the chain containing the replacement
-will still allow the client to successfully authenticate.
-
-**N.B.**: Matching is performed by _serial number only_. For most CAs,
-including Vault's `pki` method, multiple CRLs can successfully be used as
-serial numbers are globally unique. However, since RFCs only specify that
-serial numbers must be unique per-CA, some CAs issue serial numbers in-order,
-which may cause clashes if attempting to use CRLs from two such CAs in the same
-mount of the method. The workaround here is to mount multiple copies of the
-`cert` method, configure each with one CA/CRL, and have clients connect to the
-appropriate mount.
-
-In addition, if a CRL distribution point is not set the method will not
-fetch the CRLs itself, the CRL's designated time to next update is not
-considered. If a CRL is no longer in use, it is up to the administrator to
-remove it from the method.
-
-In addition to automatic or manual CRL management, OCSP may be enabled for
-a configured certificate, in which case Vault will query the OCSP server either
-specified in the presented certificate or configured in the auth method to
-check revocation.
-
-## Authentication
-
-### Via the CLI
-
-The below authenticates against the `web` cert role by presenting a certificate
-(`cert.pem`) and key (`key.pem`) signed by the CA associated with the `web` cert
-role. Note that the name `web` ties to the configuration example below writing
-to a path of `auth/cert/certs/web`. If a certificate role name is not specified,
-the auth method will try to authenticate against all trusted certificates.
-
-~> **NOTE** The `-ca-cert` value used here is for the Vault TLS Listener CA
-certificate, not the CA that issued the client authentication certificate. This
-can be omitted if the CA used to issue the Vault server certificate is trusted
-by the local system executing this command.
-
-```shell-session
-$ vault login \
-    -method=cert \
-    -ca-cert=vault-ca.pem \
-    -client-cert=cert.pem \
-    -client-key=key.pem \
-    name=web
-```
-
-### Via the API
-
-The endpoint for the login is `/login`. The client simply connects with their
-TLS certificate and when the login endpoint is hit, the auth method will
-determine if there is a matching trusted certificate to authenticate the client.
-Optionally, you may specify a single certificate role to authenticate against.
-
-~> **NOTE** The `--cacert` value used here is for the Vault TLS Listener CA
-certificate, not the CA that issued the client authentication certificate. This
-can be omitted if the CA used to issue the Vault server certificate is trusted
-by the local system executing this command.
-
-```shell-session
-$ curl \
-    --request POST \
-    --cacert vault-ca.pem \
-    --cert cert.pem \
-    --key key.pem \
-    --data '{"name": "web"}' \
-    https://127.0.0.1:8200/v1/auth/cert/login
-```
-
-## Configuration
-
-Auth methods must be configured in advance before users or machines can
-authenticate. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the certificate auth method:
-
-   ```text
-   $ vault auth enable cert
-   ```
-
-1. Configure it with trusted certificates that are allowed to authenticate:
-
-   ```text
-   $ vault write auth/cert/certs/web \
-       display_name=web \
-       policies=web,prod \
-       certificate=@web-cert.pem \
-       ttl=3600
-   ```
-
-   This creates a new trusted certificate "web" with same display name and the
-   "web" and "prod" policies. The certificate (public key) used to verify
-   clients is given by the "web-cert.pem" file. Lastly, an optional `ttl` value
-   can be provided in seconds to limit the lease duration.
-
-## API
-
-The TLS Certificate auth method has a full HTTP API. Please see the
-[TLS Certificate API](/vault/api-docs/auth/cert) for more details.
diff --git a/website/content/docs/auth/cf.mdx b/website/content/docs/auth/cf.mdx
deleted file mode 100644
index 1c8b94d383e..00000000000
--- a/website/content/docs/auth/cf.mdx
+++ /dev/null
@@ -1,328 +0,0 @@
----
-layout: docs
-page_title: Cloud Foundry - Auth Methods
-description: The cf auth method allows automated authentication of Cloud Foundry instances.
----
-
-# Cloud Foundry (CF) auth method
-
-@include 'x509-sha1-deprecation.mdx'
-
-The `cf` auth method provides an automated mechanism to retrieve a Vault token
-for CF instances. It leverages CF's [App and Container Identity Assurance](https://content.pivotal.io/blog/new-in-pcf-2-1-app-container-identity-assurance-via-automatic-cert-rotation).
-At a high level, this works as follows:
-
-1. You construct a request to Vault including your `CF_INSTANCE_CERT`, signed by your `CF_INSTANCE_KEY`.
-2. Vault validates that the signature is no more than 300 seconds old, or 60 seconds in the future.
-3. Vault validates that the cert was issued by the CA certificate you've pre-configured.
-4. Vault validates that the request was signed by the private key for the `CF_INSTANCE_CERT`.
-5. Vault validates that the `CF_INSTANCE_CERT` application ID, space ID, and org ID presently exist.
-6. If all checks pass, Vault issues an appropriately-scoped token.
-
-## Known risks
-
-This authentication engine uses CF's instance identity service to authenticate users to Vault. Because
-CF makes its CA certificate and private key available to certain users at any time, it's possible for
-someone with access to them to self-issue identity certificates that meet the criteria for a Vault role,
-allowing them to gain unintended access to Vault.
-
-For this reason, we recommend that if you enable this auth method, you carefully guard access to the
-private key for your instance identity CA certificate. In CredHub, it can be obtained through the
-following call: `$ credhub get -n /cf/diego-instance-identity-root-ca`.
-
-Take extra steps to limit access to that path in CredHub, whether it be through use of CredHub's ACL
-system, or through carefully limiting the users who can access CredHub.
-
-## Usage
-
-### Preparing to configure the plugin
-
-To configure this plugin, you'll need to gather the CA certificate that CF uses to issue each `CF_INSTANCE_CERT`,
-and you'll need to configure it to access the CF API.
-
-To gain your instance identity CA certificate, in the [cf dev](https://github.com/cloudfoundry-incubator/cfdev)
-environment it can be found using:
-
-```shell-session
-$ bosh int --path /diego_instance_identity_ca ~/.cfdev/state/bosh/creds.yml
-```
-
-In environments containing Ops Manager, it can be found in CredHub. To gain access to CredHub, first install
-[the PCF command-line utility](https://docs.pivotal.io/tiledev/2-2/pcf-command.html) and authenticate to it
-using the `metadata` file it describes. These instructions also use [jq](https://stedolan.github.io/jq/) for
-ease of drilling into the particular part of the response you'll need.
-
-Once those steps are complete, get the credentials you'll use for CredHub:
-
-```shell-session
-$ pcf settings | jq '.products[0].director_credhub_client_credentials'
-```
-
-SSH into your Ops Manager VM:
-
-```shell-session
-$ ssh -i ops_mgr.pem ubuntu@$OPS_MGR_URL
-```
-
-Please note that the above OPS_MGR_URL shouldn't be prepended with `https://`.
-
-Log into CredHub with the credentials you obtained earlier:
-
-```shell-session
-$ credhub login --client-name=director_to_credhub --client-secret=some-secret
-```
-
-And view the root certificate CF uses to issue instance identity certificates:
-
-```shell-session
-$ credhub get -n /cf/diego-instance-identity-root-ca
-```
-
-The output to that call will include two certificates and one RSA key. You will need to copy the certificate
-under `ca: |` and place it into a file on your local machine that's properly formatted. Here's an example of
-a properly formatted CA certificate:
-
-```shell-session
-$ cat ca.crt
------BEGIN CERTIFICATE-----
-MIIDNDCCAhygAwIBAgITPqTy1qvfHNEVuxsl9l1glY85OTANBgkqhkiG9w0BAQsF
-ADAqMSgwJgYDVQQDEx9EaWVnbyBJbnN0YW5jZSBJZGVudGl0eSBSb290IENBMB4X
-DTE5MDYwNjA5MTIwMVoXDTIyMDYwNTA5MTIwMVowKjEoMCYGA1UEAxMfRGllZ28g
-SW5zdGFuY2UgSWRlbnRpdHkgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
-ADCCAQoCggEBALa8xGDYT/q3UzEKAsLDajhuHxPpIPFlCXwp6u8U5Qrf427Xof7n
-rXRKzRu3g7E20U/OwzgBi3VZs8T29JGNWeA2k0HtX8oQ+Wc8Qngz9M8t1h9SZlx5
-fGfxPt3x7xozaIGJ8p4HKQH1ZlirL7dzun7Y+7m6Ey8cMVsepqUs64r8+KpCbxKJ
-rV04qtTNlr0LG3yOxSHlip+DDvUVL3jSFz/JDWxwCymiFBAh0QjG1LKp2FisURoX
-GY+HJbf2StpK3i4dYnxQXQlMDpipozK7WFxv3gH4Q6YMZvlmIPidAF8FxfDIsYcq
-TgQ5q0pr9mbu8oKbZ74vyZMqiy+r9vLhbu0CAwEAAaNTMFEwHQYDVR0OBBYEFAHf
-pwqBhZ8/A6ZAvU+p5JPz/omjMB8GA1UdIwQYMBaAFAHfpwqBhZ8/A6ZAvU+p5JPz
-/omjMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBADuDJev+6bOC
-v7t9SS4Nd/zeREuF9IKsHDHrYUZBIO1aBQbOO1iDtL4VA3LBEx6fOgN5fbxroUsz
-X9/6PtxLe+5U8i5MOztK+OxxPrtDfnblXVb6IW4EKhTnWesS7R2WnOWtzqRQXKFU
-voBn3QckLV1o9eqzYIE/aob4z0GaVanA9PSzzbVPsX79RCD1B7NmV0cKEQ7IrCrh
-L7ElDV/GlNrtVdHjY0mwz9iu+0YJvxvcHDTERi106b28KXzJz+P5/hyg2wqRXzdI
-faXAjW0kuq5nxyJUALwxD/8pz77uNt4w6WfJoSDM6XrAIhh15K3tZg9EzBmAZ/5D
-jK0RcmCyaXw=
------END CERTIFICATE-----
-```
-
-An easy way to verify that your CA certificate is properly formatted is using OpenSSL like so:
-
-```shell-session
-$ openssl x509 -in ca.crt -text -noout
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            3e:a4:f2:d6:ab:df:1c:d1:15:bb:1b:25:f6:5d:60:95:8f:39:39
-    Signature Algorithm: sha256WithRSAEncryption
-        Issuer: CN=Diego Instance Identity Root CA
-        Validity
-            Not Before: Jun  6 09:12:01 2019 GMT
-            Not After : Jun  5 09:12:01 2022 GMT
-        Subject: CN=Diego Instance Identity Root CA
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:b6:bc:c4:60:d8:4f:fa:b7:53:31:0a:02:c2:c3:
-                    6a:38:6e:1f:13:e9:20:f1:65:09:7c:29:ea:ef:14:
-                    e5:0a:df:e3:6e:d7:a1:fe:e7:ad:74:4a:cd:1b:b7:
-                    83:b1:36:d1:4f:ce:c3:38:01:8b:75:59:b3:c4:f6:
-                    f4:91:8d:59:e0:36:93:41:ed:5f:ca:10:f9:67:3c:
-                    42:78:33:f4:cf:2d:d6:1f:52:66:5c:79:7c:67:f1:
-                    3e:dd:f1:ef:1a:33:68:81:89:f2:9e:07:29:01:f5:
-                    66:58:ab:2f:b7:73:ba:7e:d8:fb:b9:ba:13:2f:1c:
-                    31:5b:1e:a6:a5:2c:eb:8a:fc:f8:aa:42:6f:12:89:
-                    ad:5d:38:aa:d4:cd:96:bd:0b:1b:7c:8e:c5:21:e5:
-                    8a:9f:83:0e:f5:15:2f:78:d2:17:3f:c9:0d:6c:70:
-                    0b:29:a2:14:10:21:d1:08:c6:d4:b2:a9:d8:58:ac:
-                    51:1a:17:19:8f:87:25:b7:f6:4a:da:4a:de:2e:1d:
-                    62:7c:50:5d:09:4c:0e:98:a9:a3:32:bb:58:5c:6f:
-                    de:01:f8:43:a6:0c:66:f9:66:20:f8:9d:00:5f:05:
-                    c5:f0:c8:b1:87:2a:4e:04:39:ab:4a:6b:f6:66:ee:
-                    f2:82:9b:67:be:2f:c9:93:2a:8b:2f:ab:f6:f2:e1:
-                    6e:ed
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Subject Key Identifier:
-                01:DF:A7:0A:81:85:9F:3F:03:A6:40:BD:4F:A9:E4:93:F3:FE:89:A3
-            X509v3 Authority Key Identifier:
-                keyid:01:DF:A7:0A:81:85:9F:3F:03:A6:40:BD:4F:A9:E4:93:F3:FE:89:A3
-
-            X509v3 Basic Constraints: critical
-                CA:TRUE
-    Signature Algorithm: sha256WithRSAEncryption
-         3b:83:25:eb:fe:e9:b3:82:bf:bb:7d:49:2e:0d:77:fc:de:44:
-         4b:85:f4:82:ac:1c:31:eb:61:46:41:20:ed:5a:05:06:ce:3b:
-         58:83:b4:be:15:03:72:c1:13:1e:9f:3a:03:79:7d:bc:6b:a1:
-         4b:33:5f:df:fa:3e:dc:4b:7b:ee:54:f2:2e:4c:3b:3b:4a:f8:
-         ec:71:3e:bb:43:7e:76:e5:5d:56:fa:21:6e:04:2a:14:e7:59:
-         eb:12:ed:1d:96:9c:e5:ad:ce:a4:50:5c:a1:54:be:80:67:dd:
-         07:24:2d:5d:68:f5:ea:b3:60:81:3f:6a:86:f8:cf:41:9a:55:
-         a9:c0:f4:f4:b3:cd:b5:4f:b1:7e:fd:44:20:f5:07:b3:66:57:
-         47:0a:11:0e:c8:ac:2a:e1:2f:b1:25:0d:5f:c6:94:da:ed:55:
-         d1:e3:63:49:b0:cf:d8:ae:fb:46:09:bf:1b:dc:1c:34:c4:46:
-         2d:74:e9:bd:bc:29:7c:c9:cf:e3:f9:fe:1c:a0:db:0a:91:5f:
-         37:48:7d:a5:c0:8d:6d:24:ba:ae:67:c7:22:54:00:bc:31:0f:
-         ff:29:cf:be:ee:36:de:30:e9:67:c9:a1:20:cc:e9:7a:c0:22:
-         18:75:e4:ad:ed:66:0f:44:cc:19:80:67:fe:43:8c:ad:11:72:
-         60:b2:69:7c
-```
-
-You will also need to configure access to the CF API. To prepare for this, we will now
-use the [cf](https://docs.cloudfoundry.org/cf-cli/install-go-cli.html) command-line tool.
-
-First, while in the directory containing the `metadata` file you used earlier to authenticate
-to CF, run `$ pcf target`. This points the `cf` tool at the same place as the `pcf` tool. Next,
-run `$ cf api` to view the API endpoint that Vault will use.
-
-Next, configure a user for Vault to use. This plugin was tested with Org Manager level
-permissions, but lower level permissions _may_ be usable.
-
-```shell-session
-$ cf create-user vault pa55w0rd
-$ cf orgs
-$ cf org-users my-example-org
-$ cf set-org-role vault my-example-org OrgManager
-```
-
-Specifically, the `vault` user created here will need to be able to perform the following API calls:
-
-- Method: "GET", endpoint: "/v2/info"
-- Method: "POST", endpoint: "/oauth/token"
-- Method: "GET", endpoint: "/v2/apps/\$APP_ID"
-- Method: "GET", endpoint: "/v2/organizations/\$ORG_ID"
-- Method: "GET", endpoint: "/v2/spaces/\$SPACE_ID"
-
-Next, PCF often uses a self-signed certificate for TLS, which can be rejected at first
-with an error like:
-
-<CodeBlockConfig hideClipboard>
-
-```plaintext
-x509: certificate signed by unknown authority
-```
-
-</CodeBlockConfig>
-
-If you encounter this error, you will need to first gain a copy of the certificate that CF
-is using for the API via:
-
-```shell-session
-$ openssl s_client -showcerts -servername domain.com -connect domain.com:443
-```
-
-Here is an example of a real call:
-
-```shell-session
-$ openssl s_client -showcerts -servername api.sys.somewhere.cf-app.com -connect api.sys.somewhere.cf-app.com:443
-```
-
-Part of the response will contain a certificate, which you'll need to copy and paste to
-a well-formatted local file. Please see `ca.crt` above for an example of how the certificate
-should look, and how to verify it can be parsed using `openssl`. The walkthrough below presumes
-you name this file `cfapi.crt`.
-
-### Walkthrough
-
-After obtaining the information described above, a Vault operator will configure the CF auth method
-like so:
-
-```shell-session
-$ vault auth enable cf
-
-$ vault write auth/cf/config \
-      identity_ca_certificates=@ca.crt \
-      cf_api_addr=https://api.dev.cfdev.sh \
-      cf_username=vault \
-      cf_password=pa55w0rd \
-      cf_api_trusted_certificates=@cfapi.crt
-
-$ vault write auth/cf/roles/my-role \
-    bound_application_ids=2d3e834a-3a25-4591-974c-fa5626d5d0a1 \
-    bound_space_ids=3d2eba6b-ef19-44d5-91dd-1975b0db5cc9 \
-    bound_organization_ids=34a878d0-c2f9-4521-ba73-a9f664e82c7bf \
-    policies=my-policy
-```
-
-Once configured, from a CF instance containing real values for the `CF_INSTANCE_CERT` and
-`CF_INSTANCE_KEY`, login can be performed using:
-
-```shell-session
-$ vault login -method=cf role=test-role
-```
-
-For CF, we do also offer an agent that, once configured, can be used to obtain a Vault token on
-your behalf.
-
-### Enabling mutual TLS with the CF API
-
-The CF API can be configured to require mutual TLS with clients. This plugin supports mutual TLS by setting the
-`cf_api_mutual_tls_certificate` and `cf_api_mutual_tls_key` configuration properties.
-
-<CodeBlockConfig highlight="7-8">
-
-```shell-session
-$ vault write auth/cf/config \
-      identity_ca_certificates=@ca.crt \
-      cf_api_addr=https://api.dev.cfdev.sh \
-      cf_username=vault \
-      cf_password=pa55w0rd \
-      cf_api_trusted_certificates=@cfapi.crt \
-      cf_api_mutual_tls_certificate=@cfmutualtls.crt \
-      cf_api_mutual_tls_key=@cfmutualtls.key
-```
-
-</CodeBlockConfig>
-
-The provided certificate must be signed by a certificate authority trusted by the CF API. Obtaining such a certificate
-depends on the specifics of your deployment of Cloud Foundry.
-
-### Maintenance
-
-In testing we found that CF instance identity CA certificates were set to expire in 3 years. Some
-CF docs indicate they expire every 4 years. However long they last, at some point you may need
-to add another CA certificate - one that's soon to expire, and one that is currently or soon-to-be
-valid.
-
-```shell-session
-$ CURRENT=$(cat /path/to/current-ca.crt)
-$ FUTURE=$(cat /path/to/future-ca.crt)
-$ vault write auth/vault-plugin-auth-cf/config identity_ca_certificates="$CURRENT" identity_ca_certificates="$FUTURE"
-```
-
-If Vault receives a `CF_INSTANCE_CERT` matching _any_ of the `identity_ca_certificates`,
-the instance cert will be considered valid.
-
-A similar approach can be taken to update the `cf_api_trusted_certificates`.
-
-### Troubleshooting At-A-Glance
-
-If you receive an error containing `x509: certificate signed by unknown authority`, set
-`cf_api_trusted_certificates` as described above.
-
-If you're unable to authenticate using the `CF_INSTANCE_CERT`, first obtain a current copy
-of your `CF_INSTANCE_CERT` and copy it to your local environment. Then divide it into two
-files, each being a distinct certificate. The first certificate tends to be the actual
-`identity.crt`, and the second one tends to be the `intermediate.crt`. Verify each are
-properly named and formatted using a command like:
-
-```shell-session
-$ openssl x509 -in ca.crt -text -noout
-```
-
-Then, verify that the certificates are properly chained to the `ca.crt` you've configured:
-
-```shell-session
-$ openssl verify -CAfile ca.crt -untrusted intermediate.crt identity.crt
-```
-
-This should show a success response. If it doesn't, try to identify the root cause, be it
-an expired certificate, an incorrect `ca.crt`, or a Vault configuration that doesn't
-match the certificates you're checking.
-
-## API
-
-The CF auth method has a full HTTP API. Please see the [CF Auth API](/vault/api-docs/auth/cf)
-for more details.
diff --git a/website/content/docs/auth/gcp.mdx b/website/content/docs/auth/gcp.mdx
deleted file mode 100644
index c276cab2e95..00000000000
--- a/website/content/docs/auth/gcp.mdx
+++ /dev/null
@@ -1,601 +0,0 @@
----
-layout: docs
-page_title: Google Cloud - Auth Methods
-description: |-
-  The "gcp" auth method allows users and machines to authenticate to Vault using
-  Google Cloud service accounts.
----
-
-# Google Cloud auth method
-
-The `gcp` auth method allows Google Cloud Platform entities to authenticate to
-Vault. Vault treats Google Cloud as a trusted third party and verifies
-authenticating entities against the Google Cloud APIs. This backend allows for
-authentication of:
-
-- Google Cloud IAM service accounts
-- Google Compute Engine (GCE) instances
-
-This backend focuses on identities specific to Google _Cloud_ and does not
-support authenticating arbitrary Google or Google Workspace users or generic OAuth
-against Google.
-
-This plugin is developed in a separate GitHub repository at
-[hashicorp/vault-plugin-auth-gcp][repo],
-but is automatically bundled in Vault releases. Please file all feature
-requests, bugs, and pull requests specific to the GCP plugin under that
-repository.
-
-## Authentication
-
-### Via the CLI helper
-
-Vault includes a CLI helper that obtains a signed JWT locally and sends the
-request to Vault.
-
-```shell-session
-# Authentication to vault outside of Google Cloud
-$ vault login -method=gcp \
-    role="my-role" \
-    service_account="authenticating-account@my-project.iam.gserviceaccount.com" \
-    jwt_exp="15m" \
-    credentials=@path/to/signer/credentials.json
-```
-
-```shell-session
-# Authentication to vault inside of Google Cloud
-$ vault login -method=gcp role="my-role"
-```
-
-For more usage information, run `vault auth help gcp`.
-
--> **Note:** The `project` parameter has been removed in Vault 1.5.9+, 1.6.5+, and 1.7.2+.
-It is no longer needed for configuration and will be ignored if provided.
-
-### Via the CLI
-
-```shell-session
-$ vault write -field=token auth/gcp/login \
-    role="my-role" \
-    jwt="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
-```
-
-See [Generating JWTs](#generating-jwts) for ways to obtain the JWT token.
-
-### Via the API
-
-```shell-session
-$ curl \
-    --request POST \
-    --data '{"role":"my-role", "jwt":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."}' \
-    http://127.0.0.1:8200/v1/auth/gcp/login
-```
-
-See [API docs][api-docs] for expected response.
-
-## Configuration
-
-Auth methods must be configured in advance before users or machines can
-authenticate. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the Google Cloud auth method:
-
-   ```shell-session
-   $ vault auth enable gcp
-   ```
-
-1. Configure the auth method credentials if Vault is not running on Google Cloud:
-
-   ```text
-   $ vault write auth/gcp/config \
-       credentials=@/path/to/credentials.json
-   ```
-
-   If you are using instance credentials or want to specify credentials via
-   an environment variable, you can skip this step. To learn more, see the
-   [Google Cloud Credentials](#gcp-credentials) section below.
-
-   -> **Note**: If you're using a [Private Google Access](https://cloud.google.com/vpc/docs/configure-private-google-access)
-   environment, you will additionally need to configure your environment’s custom endpoints
-   via the [custom_endpoint](/vault/api-docs/auth/gcp#custom_endpoint) configuration parameter.
-
-1. Create a named role:
-
-   For an `iam`-type role:
-
-   ```shell-session
-   $ vault write auth/gcp/role/my-iam-role \
-       type="iam" \
-       policies="dev,prod" \
-       bound_service_accounts="my-service@my-project.iam.gserviceaccount.com"
-   ```
-
-   For a `gce`-type role:
-
-   ```shell-session
-   $ vault write auth/gcp/role/my-gce-role \
-       type="gce" \
-       policies="dev,prod" \
-       bound_projects="my-project1,my-project2" \
-       bound_zones="us-east1-b" \
-       bound_labels="foo:bar,zip:zap" \
-       bound_service_accounts="my-service@my-project.iam.gserviceaccount.com"
-   ```
-
-   Note that `bound_service_accounts` is only required for `iam`-type roles.
-
-   For the complete list of configuration options for each type, please see the
-   [API documentation][api-docs].
-
-## GCP credentials
-
-The Google Cloud Vault auth method uses the official Google Cloud Golang SDK.
-This means it supports the common ways of [providing credentials to Google
-Cloud][cloud-creds].
-
-1. The environment variable `GOOGLE_APPLICATION_CREDENTIALS`. This is specified
-   as the **path** to a Google Cloud credentials file, typically for a service
-   account. If this environment variable is present, the resulting credentials are
-   used. If the credentials are invalid, an error is returned.
-
-1. Default instance credentials. When no environment variable is present, the
-   default service account credentials are used.
-
-For more information on service accounts, please see the [Google Cloud Service
-Accounts documentation][service-accounts].
-
-To use this auth method, the service account must have the following minimum
-scope:
-
-```text
-https://www.googleapis.com/auth/cloud-platform
-```
-
-### Required GCP permissions
-
-#### Enabled GCP APIs
-
-The GCP project must have the following APIs enabled:
-
-- [iam.googleapis.com](https://console.cloud.google.com/flows/enableapi?apiid=iam.googleapis.com)
-  for `iam` and `gce` type roles.
-- [compute.googleapis.com](https://console.cloud.google.com/flows/enableapi?apiid=compute.googleapis.com)
-  for `gce` type roles.
-- [cloudresourcemanager.googleapis.com](https://console.cloud.google.com/flows/enableapi?apiid=cloudresourcemanager.googleapis.com)
-  for `iam` and `gce` type roles that set [`add_group_aliases`](/vault/api-docs/auth/gcp#add_group_aliases) to true.
-
-#### Vault server permissions
-
-**For `iam`-type Vault roles**, the service account [`credentials`](/vault/api-docs/auth/gcp#credentials)
-given to Vault can have the following role:
-
-```text
-roles/iam.serviceAccountKeyAdmin
-```
-
-**For `gce`-type Vault roles**, the service account [`credentials`](/vault/api-docs/auth/gcp#credentials)
-given to Vault can have the following role:
-
-```text
-roles/compute.viewer
-```
-
-If you instead wish to create a custom role with only the exact GCP permissions
-required, use the following list of permissions:
-
-```text
-iam.serviceAccounts.get
-iam.serviceAccountKeys.get
-compute.instances.get
-compute.instanceGroups.list
-```
-
-These allow Vault to:
-
-- verify the service account, either directly authenticating or associated with
-  authenticating GCE instance, exists
-- get the corresponding public keys for verifying JWTs signed by service account
-  private keys.
-- verify authenticating GCE instances exist
-- compare bound fields for GCE roles (zone/region, labels, or membership
-  in given instance groups)
-
-If you are using Group Aliases as described below, you will also need to add the
-`resourcemanager.projects.get` permission.
-
-#### Permissions for authenticating against Vault
-
-If you are authenticating to Vault from Google Cloud, you can skip the following step as
-Vault will generate and present the identity token of the service account configured
-on the instance or the pod.
-
-Note that the previously mentioned permissions are given to the _Vault servers_.
-The IAM service account or GCE instance that is **authenticating against Vault**
-must have the following role:
-
-```text
-roles/iam.serviceAccountTokenCreator
-```
-
-!> **WARNING:** Make sure this role is only applied so your service account can
-impersonate itself. If this role is applied GCP project-wide, this will allow the service
-account to impersonate any service account in the GCP project where it resides.
-See [Managing service account impersonation](https://cloud.google.com/iam/docs/impersonating-service-accounts)
-for more information.
-
-## Group aliases
-
-As of Vault 1.0, roles can specify an `add_group_aliases` boolean parameter
-that adds [group aliases][identity-group-aliases] to the auth response. These
-aliases can aid in building reusable policies since they are available as
-interpolated values in Vault's policy engine. Once enabled, the auth response
-will include the following aliases:
-
-```json
-[
-  "project-$PROJECT_ID",
-  "folder-$SUBFOLDER_ID",
-  "folder-$FOLDER_ID",
-  "organization-$ORG_ID"
-]
-```
-
-If you are using a custom role for Vault server, you will need to add the
-`resourcemanager.projects.get` permission to your custom role.
-
-## Implementation details
-
-This section describes the implementation details for how Vault communicates
-with Google Cloud to authenticate and authorize JWT tokens. This information is
-provided for those who are curious, but these details are not
-required knowledge for using the auth method.
-
-### IAM login
-
-IAM login applies only to roles of type `iam`. The Vault authentication workflow
-for IAM service accounts looks like this:
-
-[![Vault Google Cloud IAM Login Workflow](/img/vault-gcp-iam-auth-workflow.svg)](/img/vault-gcp-iam-auth-workflow.svg)
-
-1. The client generates a signed JWT using the Service Account Credentials
-   [`projects.serviceAccounts.signJwt`][signjwt-method] API method. For examples
-   of how to do this, see the [Generating JWTs](#generating-jwts) section.
-
-2. The client sends this signed JWT to Vault along with a role name.
-
-3. Vault extracts the `kid` header value, which contains the ID of the
-   key-pair used to generate the JWT, and the `sub` ID/email to find the service
-   account key. If the service account does not exist or the key is not linked to
-   the service account, Vault denies authentication.
-
-4. Vault authorizes the confirmed service account against the given role. If
-   that is successful, a Vault token with the proper policies is returned.
-
-### GCE login
-
-GCE login only applies to roles of type `gce` and **must be completed on an
-infrastructure running on Google Cloud**. These steps will not work from your 
-local laptop or another cloud provider.
-
-[![Vault Google Cloud GCE Login Workflow](/img/vault-gcp-gce-auth-workflow.svg)](/img/vault-gcp-gce-auth-workflow.svg)
-
-1. The client obtains an [instance identity metadata token][instance-identity]
-   on a GCE instance.
-
-2. The client sends this JWT to Vault along with a role name.
-
-3. Vault extracts the `kid` header value, which contains the ID of the
-   key-pair used to generate the JWT, to find the OAuth2 public cert to verify
-   this JWT.
-
-4. Vault authorizes the confirmed instance against the given role, ensuring
-   the instance matches the bound zones, regions, or instance groups. If that is
-   successful, a Vault token with the proper policies is returned.
-
-## Generating JWTs
-
-This section details the various methods and examples for obtaining JWT
-tokens.
-
-### Service account credentials API
-
-This describes how to use the GCP Service Account Credentials [API method][signjwt-method]
-directly to generate the signed JWT with the claims that Vault expects. Note the CLI
-does this process for you and is much easier, and that there is very little
-reason to do this yourself.
-
-#### curl example
-
-Vault requires the following minimum claim set:
-
-```json
-{
-  "sub": "$SERVICE_ACCOUNT_EMAIL_OR_ID",
-  "aud": "vault/$ROLE",
-  "exp": "$EXPIRATION"
-}
-```
-
-For the API method, providing the expiration claim `exp` is required. If it is omitted,
-it will not be added automatically and Vault will deny authentication. Expiration must
-be specified as a [NumericDate](https://tools.ietf.org/html/rfc7519#section-2) value
-(seconds from Epoch). This value must be before the max JWT expiration allowed for a
-role. This defaults to 15 minutes and cannot be more than 1 hour.
-
-If a user generates a token that expires after 15 minutes, and the gcp role has `max_jwt_exp` set to the default, Vault will return the following error: `Expiration date must be set to no more that 15 mins in JWT_CLAIM, otherwise the login request returns error "role requires that service account JWTs expire within 900 seconds`. In this case, the user must create a new signed JWT with a shorter expiration, or set `max_jwt_exp` to a higher value in the gcp role.
-
-One you have all this information, the JWT token can be signed using curl and
-[oauth2l](https://github.com/google/oauth2l):
-
-```shell-session
-ROLE="my-role"
-SERVICE_ACCOUNT="service-account@my-project.iam.gserviceaccount.com"
-OAUTH_TOKEN="$(oauth2l header cloud-platform)"
-EXPIRATION="<your_token_expiration>"
-JWT_CLAIM="{\\\"aud\\\":\\\"vault/${ROLE}\\\", \\\"sub\\\": \\\"${SERVICE_ACCOUNT}\\\", \\\"exp\\\": ${EXPIRATION}}"
-
-$ curl \
-  --header "${OAUTH_TOKEN}" \
-  --header "Content-Type: application/json" \
-  --request POST \
-  --data "{\"payload\": \"${JWT_CLAIM}\"}" \
-  "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${SERVICE_ACCOUNT}:signJwt"
-```
-
-#### gcloud example
-
-You can also do this through the (currently beta) gcloud command. Note that you will
-be required to provide the expiration claim `exp` as a part of the JWT input to the
-command.
-
-```shell-session
-$ gcloud beta iam service-accounts sign-jwt $INPUT_JWT_CLAIMS $OUTPUT_JWT_FILE \
-    --iam-account=service-account@my-project.iam.gserviceaccount.com \
-    --project=my-project
-```
-
-#### Golang example
-
-Read more on the
-[Google Open Source blog](https://opensource.googleblog.com/2017/08/hashicorp-vault-and-google-cloud-iam.html).
-
-### GCE
-
-You can autogenerate this token in Vault versions 1.8.2 or higher.
-
-GCE tokens **can only be generated from a GCE instance**.
-
-1.  Vault can automatically discover the identity token on a GCE/GKE instance. This simplifies
-    authenticating to Vault like so:
-
-    ```shell-session
-    $ vault login \
-      -method=gcp \
-      role="my-gce-role"
-    ```
-
-1.  The JWT token can also be obtained from the `"service-accounts/default/identity"` endpoint for a
-    instance's metadata server.
-
-    #### Curl example
-
-    ```shell-session
-    ROLE="my-gce-role"
-
-    $ curl \
-      --header "Metadata-Flavor: Google" \
-      --get \
-      --data-urlencode "audience=http://vault/${ROLE}" \
-      --data-urlencode "format=full" \
-      "http://metadata/computeMetadata/v1/instance/service-accounts/default/identity"
-    ```
-
-## API
-
-The GCP Auth Plugin has a full HTTP API. Please see the
-[API docs][api-docs] for more details.
-
-[jwt]: https://tools.ietf.org/html/rfc7519
-[signjwt-method]: https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signJwt
-[cloud-creds]: https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application
-[service-accounts]: https://cloud.google.com/compute/docs/access/service-accounts
-[api-docs]: /vault/api-docs/auth/gcp
-[identity-group-aliases]: /vault/api-docs/secret/identity/group-alias
-[instance-identity]: https://cloud.google.com/compute/docs/instances/verifying-instance-identity
-[repo]: https://github.com/hashicorp/vault-plugin-auth-gcp
-
-## Code example
-
-The following example demonstrates the Google Cloud auth method to authenticate
-with Vault.
-
-<CodeTabs>
-
-<CodeBlockConfig>
-
-```go
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	vault "github.com/hashicorp/vault/api"
-	auth "github.com/hashicorp/vault/api/auth/gcp"
-)
-
-// Fetches a key-value secret (kv-v2) after authenticating to Vault
-// via GCP IAM, one of two auth methods used to authenticate with
-// GCP (the other is GCE auth).
-func getSecretWithGCPAuthIAM() (string, error) {
-	config := vault.DefaultConfig() // modify for more granular configuration
-
-	client, err := vault.NewClient(config)
-	if err != nil {
-		return "", fmt.Errorf("unable to initialize Vault client: %w", err)
-	}
-
-	// For IAM-style auth, the environment variable GOOGLE_APPLICATION_CREDENTIALS
-	// must be set with the path to a valid credentials JSON file, otherwise
-	// Vault will fall back to Google's default instance credentials.
-	// Learn about authenticating to GCS with service account credentials at https://cloud.google.com/docs/authentication/production
-	if pathToCreds := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS"); pathToCreds == "" {
-		fmt.Printf("WARNING: Environment variable GOOGLE_APPLICATION_CREDENTIALS was not set. IAM client for JWT signing and Vault server IAM client will both fall back to default instance credentials.\n")
-	}
-
-	svcAccountEmail := fmt.Sprintf("%s@%s.iam.gserviceaccount.com", os.Getenv("GCP_SERVICE_ACCOUNT_NAME"), os.Getenv("GOOGLE_CLOUD_PROJECT"))
-
-	// We pass the auth.WithIAMAuth option to use the IAM-style authentication
-	// of the GCP auth backend. Otherwise, we default to using GCE-style
-	// authentication, which gets its credentials from the metadata server.
-	gcpAuth, err := auth.NewGCPAuth(
-		"dev-role-iam",
-		auth.WithIAMAuth(svcAccountEmail),
-	)
-	if err != nil {
-		return "", fmt.Errorf("unable to initialize GCP auth method: %w", err)
-	}
-
-	authInfo, err := client.Auth().Login(context.TODO(), gcpAuth)
-	if err != nil {
-		return "", fmt.Errorf("unable to login to GCP auth method: %w", err)
-	}
-	if authInfo == nil {
-		return "", fmt.Errorf("login response did not return client token")
-	}
-
-	// get secret from the default mount path for KV v2 in dev mode, "secret"
-	secret, err := client.KVv2("secret").Get(context.Background(), "creds")
-	if err != nil {
-		return "", fmt.Errorf("unable to read secret: %w", err)
-	}
-
-	// data map can contain more than one key-value pair,
-	// in this case we're just grabbing one of them
-	value, ok := secret.Data["password"].(string)
-	if !ok {
-		return "", fmt.Errorf("value type assertion failed: %T %#v", secret.Data["password"], secret.Data["password"])
-	}
-
-	return value, nil
-}
-
-```
-
-</CodeBlockConfig>
-
-<CodeBlockConfig>
-
-```cs
-using System;
-using System.Collections.Generic;
-using System.IO;
-using System.Threading.Tasks;
-using Google.Apis.Auth.OAuth2;
-using Google.Apis.Services;
-using Google.Apis.Iam.v1;
-using Newtonsoft.Json;
-using VaultSharp;
-using VaultSharp.V1.AuthMethods;
-using VaultSharp.V1.AuthMethods.GoogleCloud;
-using VaultSharp.V1.Commons;
-
-using Data = Google.Apis.Iam.v1.Data;
-
-namespace Examples
-{
-    public class GCPAuthExample
-    {
-        /// <summary>
-        /// Fetches a key-value secret (kv-v2) after authenticating to Vault via GCP IAM,
-        /// one of two auth methods used to authenticate with GCP (the other is GCE auth).
-        /// </summary>
-        public string GetSecretGcp()
-        {
-            var vaultAddr = Environment.GetEnvironmentVariable("VAULT_ADDR");
-            if(String.IsNullOrEmpty(vaultAddr))
-            {
-                throw new System.ArgumentNullException("Vault Address");
-            }
-
-            var roleName = Environment.GetEnvironmentVariable("VAULT_ROLE");
-            if(String.IsNullOrEmpty(roleName))
-            {
-                throw new System.ArgumentNullException("Vault Role Name");
-            }
-
-            // Learn about authenticating to GCS with service account credentials at https://cloud.google.com/docs/authentication/production
-            if(String.IsNullOrEmpty(Environment.GetEnvironmentVariable("GOOGLE_APPLICATION_CREDENTIALS")))
-            {
-                Console.WriteLine("WARNING: Environment variable GOOGLE_APPLICATION_CREDENTIALS was not set. IAM client for JWT signing will fall back to default instance credentials.");
-            }
-
-            var jwt = SignJWT();
-
-            IAuthMethodInfo authMethod = new GoogleCloudAuthMethodInfo(roleName, jwt);
-            var vaultClientSettings = new VaultClientSettings(vaultAddr, authMethod);
-
-            IVaultClient vaultClient = new VaultClient(vaultClientSettings);
-
-            // We can retrieve the secret after creating our VaultClient object
-            Secret<SecretData> kv2Secret = null;
-            kv2Secret = vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(path: "/creds").Result;
-
-            var password = kv2Secret.Data.Data["password"];
-
-            return password.ToString();
-        }
-
-        /// <summary>
-        /// Generate signed JWT from GCP IAM
-        /// </summary>
-        private string SignJWT()
-        {
-            var roleName = Environment.GetEnvironmentVariable("GCP_ROLE");
-            var svcAcctName = Environment.GetEnvironmentVariable("GCP_SERVICE_ACCOUNT_NAME");
-            var gcpProjName = Environment.GetEnvironmentVariable("GOOGLE_CLOUD_PROJECT");
-
-            IamService iamService = new IamService(new BaseClientService.Initializer
-            {
-                HttpClientInitializer = GetCredential(),
-                ApplicationName = "Google-iamSample/0.1",
-            });
-
-            string svcEmail = $"{svcAcctName}@{gcpProjName}.iam.gserviceaccount.com";
-            string name = $"projects/-/serviceAccounts/{svcEmail}";
-
-            TimeSpan currentTime = (DateTime.UtcNow - new DateTime(1970, 1, 1));
-            int expiration = (int)(currentTime.TotalSeconds) + 900;
-
-            Data.SignJwtRequest requestBody = new Data.SignJwtRequest();
-            requestBody.Payload = JsonConvert.SerializeObject(new Dictionary<string, object> ()
-            {
-                { "aud", $"vault/{roleName}" } ,
-                { "sub", svcEmail } ,
-                { "exp", expiration }
-            });
-
-            ProjectsResource.ServiceAccountsResource.SignJwtRequest request = iamService.Projects.ServiceAccounts.SignJwt(requestBody, name);
-
-            Data.SignJwtResponse response = request.Execute();
-
-            return JsonConvert.SerializeObject(response.SignedJwt).Replace("\"", "");
-        }
-
-        public static GoogleCredential GetCredential()
-        {
-            GoogleCredential credential = Task.Run(() => GoogleCredential.GetApplicationDefaultAsync()).Result;
-            if (credential.IsCreateScopedRequired)
-            {
-                credential = credential.CreateScoped("https://www.googleapis.com/auth/cloud-platform");
-            }
-           return credential;
-        }
-    }
-}
-```
-</CodeBlockConfig>
-
-</CodeTabs>
diff --git a/website/content/docs/auth/github.mdx b/website/content/docs/auth/github.mdx
deleted file mode 100644
index fc5663a1728..00000000000
--- a/website/content/docs/auth/github.mdx
+++ /dev/null
@@ -1,118 +0,0 @@
----
-layout: docs
-page_title: GitHub - Auth Methods
-description: The GitHub auth method allows authentication with Vault using GitHub.
----
-
-# GitHub auth method
-
-The `github` auth method can be used to authenticate with Vault using a GitHub
-personal access token. This method of authentication is most useful for humans:
-operators or developers using Vault directly via the CLI.
-
-~> **IMPORTANT NOTE:** Vault does not support an OAuth workflow to generate
-GitHub tokens, so does not act as a GitHub application. As a result, this method
-uses personal access tokens. If the risks below are unacceptable to you, consider
-using a different authentication method.
-
-~> Any valid GitHub access token with the `read:org` scope for any user belonging
-to the Vault-configured organization can be used for authentication. If such a
-token is stolen from a third party service, and the attacker is able to make
-network calls to Vault, they will be able to log in as the user that generated
-the access token.
-
-~> If the GitHub team is part of an organization with SSO enabled, the user will 
-need to authorize the personal access token. Failing to do so for SSO users will 
-result in the personal access token not providing identity information. The token 
-issued by the auth method will only be assigned the default policy.
-
-## Authentication
-
-### Via the CLI
-
-The default path is `/github`. If this auth method was enabled at a different
-path, specify `-path=/my-path` in the CLI.
-
-```shell-session
-$ vault login -method=github token="MY_TOKEN"
-```
-
-### Via the API
-
-The default endpoint is `auth/github/login`. If this auth method was enabled
-at a different path, use that value instead of `github`.
-
-```shell-session
-$ curl \
-    --request POST \
-    --data '{"token": "MY_TOKEN"}' \
-    http://127.0.0.1:8200/v1/auth/github/login
-```
-
-The response will contain a token at `auth.client_token`:
-
-```json
-{
-  "auth": {
-    "renewable": true,
-    "lease_duration": 2764800,
-    "metadata": {
-      "username": "my-user",
-      "org": "my-org"
-    },
-    "policies": ["default", "dev-policy"],
-    "accessor": "f93c4b2d-18b6-2b50-7a32-0fecf88237b8",
-    "client_token": "1977fceb-3bfa-6c71-4d1f-b64af98ac018"
-  }
-}
-```
-
-## Configuration
-
-Auth methods must be configured in advance before users or machines can
-authenticate. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the GitHub auth method:
-
-   ```text
-   $ vault auth enable github
-   ```
-
-1. Use the `/config` endpoint to configure Vault to talk to GitHub.
-
-   ```text
-   $ vault write auth/github/config organization=hashicorp
-   ```
-
-   For the complete list of configuration options, please see the API
-   documentation.
-
-1. Map the users/teams of that GitHub organization to policies in Vault. Team
-   names must be "slugified":
-
-   ```text
-   $ vault write auth/github/map/teams/dev value=dev-policy
-   ```
-
-   In this example, when members of the team "dev" in the organization
-   "hashicorp" authenticate to Vault using a GitHub personal access token, they
-   will be given a token with the "dev-policy" policy attached.
-
-   ***
-
-   You can also create mappings for a specific user `map/users/<user>`
-   endpoint:
-
-   ```text
-   $ vault write auth/github/map/users/sethvargo value=sethvargo-policy
-   ```
-
-   In this example, a user with the GitHub username `sethvargo` will be
-   assigned the `sethvargo-policy` policy **in addition to** any team policies.
-
-## API
-
-The GitHub auth method has a full HTTP API. Please see the
-[GitHub Auth API](/vault/api-docs/auth/github) for more
-details.
diff --git a/website/content/docs/auth/index.mdx b/website/content/docs/auth/index.mdx
deleted file mode 100644
index 2609029a57b..00000000000
--- a/website/content/docs/auth/index.mdx
+++ /dev/null
@@ -1,59 +0,0 @@
----
-layout: docs
-page_title: Auth Methods
-description: Auth methods are mountable methods that perform authentication for Vault.
----
-
-# Auth methods
-
-Auth methods are the components in Vault that perform authentication and are
-responsible for assigning identity and a set of policies to a user. In all cases,
-Vault will enforce authentication as part of the request processing. In most cases,
-Vault will delegate the authentication administration and decision to the relevant configured
-external auth method (e.g., Amazon Web Services, GitHub, Google Cloud Platform, Kubernetes, Microsoft
-Azure, Okta ...).
-
-Having multiple auth methods enables you to use an auth method that makes the
-most sense for your use case of Vault and your organization.
-
-For example, on developer machines, the [GitHub auth method](/vault/docs/auth/github)
-is easiest to use. But for servers the [AppRole](/vault/docs/auth/approle)
-method is the recommended choice.
-
-To learn more about authentication, see the
-[authentication concepts page](/vault/docs/concepts/auth).
-
-## Enabling/Disabling auth methods
-
-Auth methods can be enabled/disabled using the CLI or the API.
-
-```shell-session
-$ vault auth enable userpass
-```
-
-When enabled, auth methods are similar to [secrets engines](/vault/docs/secrets):
-they are mounted within the Vault mount table and can be accessed
-and configured using the standard read/write API. All auth methods are mounted underneath the `auth/` prefix.
-
-By default, auth methods are mounted to `auth/<type>`. For example, if you
-enable "github", then you can interact with it at `auth/github`. However, this
-path is customizable, allowing users with advanced use cases to mount a single
-auth method multiple times.
-
-```shell-session
-$ vault auth enable -path=my-login userpass
-```
-
-When an auth method is disabled, all users authenticated via that method are
-automatically logged out.
-
-## External auth method considerations
-
-When using an external auth method (e.g., GitHub), Vault will call the external service
-at the time of authentication and for subsequent token renewals. If the status
-of an entity changes in the external system (e.g., an account expires or is
-disabled), Vault denies requests to **renew** tokens associated with the entity.
-However, any existing token remain valid for the original grant period unless
-they are explicitly revoked within Vault. Operators should set appropriate
-[token TTLs](/vault/docs/concepts/tokens#the-general-case) when using external
-authN methods.
diff --git a/website/content/docs/auth/jwt/index.mdx b/website/content/docs/auth/jwt/index.mdx
deleted file mode 100644
index f4649587677..00000000000
--- a/website/content/docs/auth/jwt/index.mdx
+++ /dev/null
@@ -1,393 +0,0 @@
----
-layout: docs
-page_title: JWT/OIDC - Auth Methods
-description: >-
-  The JWT/OIDC auth method allows authentication using OIDC and user-provided
-  JWTs
----
-
-# JWT/OIDC auth method
-
-@include 'x509-sha1-deprecation.mdx'
-
-The `jwt` auth method can be used to authenticate with Vault using
-[OIDC](https://en.wikipedia.org/wiki/OpenID_Connect) or by providing a
-[JWT](https://en.wikipedia.org/wiki/JSON_Web_Token).
-
-The OIDC method allows authentication via a configured OIDC provider using the
-user's web browser. This method may be initiated from the Vault UI or the
-command line. Alternatively, a JWT can be provided directly. The JWT is
-cryptographically verified using locally-provided keys, or, if configured, an
-OIDC Discovery service can be used to fetch the appropriate keys. The choice of
-method is configured per role.
-
-Both methods allow additional processing of the claims data in the JWT. Some of
-the concepts common to both methods will be covered first, followed by specific
-examples of OIDC and JWT usage.
-
-## OIDC authentication
-
-This section covers the setup and use of OIDC roles. If a JWT is to be provided directly,
-refer to the [JWT Authentication](/vault/docs/auth/jwt#jwt-authentication) section below. Basic
-familiarity with [OIDC concepts](https://developer.okta.com/blog/2017/07/25/oidc-primer-part-1)
-is assumed. The Authorization Code flow makes use of the Proof Key for Code
-Exchange (PKCE) extension.
-
-Vault includes two built-in OIDC login flows: the Vault UI, and the CLI
-using a `vault login`.
-
-### Redirect URIs
-
-An important part of OIDC role configuration is properly setting redirect URIs. This must be
-done both in Vault and with the OIDC provider, and these configurations must align. The
-redirect URIs are specified for a role with the `allowed_redirect_uris` parameter. There are
-different redirect URIs to configure the Vault UI and CLI flows, so one or both will need to
-be set up depending on the installation.
-
-**CLI**
-
-If you plan to support authentication via `vault login -method=oidc`, a localhost redirect URI
-must be set. This can usually be: `http://localhost:8250/oidc/callback`. Logins via the CLI may
-specify a different host and/or listening port if needed, and a URI with this host/port must match one
-of the configured redirected URIs. These same "localhost" URIs must be added to the provider as well.
-
-**Vault UI**
-
-Logging in via the Vault UI requires a redirect URI of the form:
-
-`https://{host:port}/ui/vault/auth/{path}/oidc/callback`
-
-The "host:port" must be correct for the Vault server, and "path" must match the path the JWT
-backend is mounted at (e.g. "oidc" or "jwt").
-
-If the [oidc_response_mode](/vault/api-docs/auth/jwt#oidc_response_mode) is set to `form_post`, then
-logging in via the Vault UI requires a redirect URI of the form:
-
-`https://{host:port}/v1/auth/{path}/oidc/callback`
-
-Prior to Vault 1.6, if [namespaces](/vault/docs/enterprise/namespaces) are in use,
-they must be added as query parameters, for example:
-
-`https://vault.example.com:8200/ui/vault/auth/oidc/oidc/callback?namespace=my_ns`
-
-For Vault 1.6+, it is no longer necessary to add the namespace as a query
-parameter in the redirect URI, if
-[`namespace_in_state`](/vault/api-docs/auth/jwt#namespace_in_state) is set to `true`,
-which is the default for new configs.
-
-### OIDC login (Vault UI)
-
-1. Select the "OIDC" login method.
-1. Enter a role name if necessary.
-1. Press "Sign In" and complete the authentication with the configured provider.
-
-### OIDC login (CLI)
-
-The CLI login defaults to path of `/oidc`. If this auth method was enabled at a
-different path, specify `-path=/my-path` in the CLI.
-
-```shell-session
-$ vault login -method=oidc port=8400 role=test
-
-Complete the login via your OIDC provider. Launching browser to:
-
-    https://myco.auth0.com/authorize?redirect_uri=http%3A%2F%2Flocalhost%3A8400%2Foidc%2Fcallback&client_id=r3qXc2bix9eF...
-```
-
-The browser will open to the generated URL to complete the provider's login. The
-URL may be entered manually if the browser cannot be automatically opened.
-
-- `skip_browser` (default: "false"). Toggle the automatic launching of the default browser to the login URL.
-
-The callback listener may be customized with the following optional parameters. These are typically
-not required to be set:
-
-- `mount` (default: "oidc")
-- `listenaddress` (default: "localhost")
-- `port` (default: 8250)
-- `callbackhost` (default: "localhost")
-- `callbackmethod` (default: "http")
-- `callbackport` (default: value set for `port`). This value is used in the `redirect_uri`, whereas
-  `port` is the localhost port that the listener is using. These two may be different in advanced setups.
-
-### OIDC provider configuration
-
-The OIDC authentication flow has been successfully tested with a number of providers. A full
-guide to configuring OAuth/OIDC applications is beyond the scope of Vault documentation, but a
-collection of provider configuration steps has been collected to help get started:
-[OIDC Provider Setup](/vault/docs/auth/jwt/oidc-providers)
-
-### OIDC configuration troubleshooting
-
-This amount of configuration required for OIDC is relatively small, but it can be tricky to debug
-why things aren't working. Some tips for setting up OIDC:
-
-- If a role parameter (e.g. `bound_claims`) requires a map value, it can't be set individually using
-  the Vault CLI. In these cases the best approach is to write the entire configuration as a single
-  JSON object:
-
-```text
-vault write auth/oidc/role/demo -<<EOF
-{
-  "user_claim": "sub",
-  "bound_audiences": "abc123",
-  "role_type": "oidc",
-  "policies": "demo",
-  "ttl": "1h",
-  "bound_claims": { "groups": ["mygroup/mysubgroup"] }
-}
-EOF
-```
-
-- Monitor Vault's log output. Important information about OIDC validation failures will be emitted.
-
-- Ensure Redirect URIs are correct in Vault and on the provider. They need to match exactly. Check:
-  http/https, 127.0.0.1/localhost, port numbers, whether trailing slashes are present.
-
-- Start simple. The only claim configuration a role requires is `user_claim`. After authentication is
-  known to work, you can add additional claims bindings and metadata copying.
-
-- `bound_audiences` is optional for OIDC roles and typically not required. OIDC providers will use
-  the client_id as the audience and OIDC validation expects this.
-
-- Check your provider for what scopes are required in order to receive all
-  of the information you need. The scopes "profile" and "groups" often need to be
-  requested, and can be added by setting `oidc_scopes="profile,groups"` on the role.
-
-- If you're seeing claim-related errors in logs, review the provider's docs very carefully to see
-  how they're naming and structuring their claims. Depending on the provider, you may be able to
-  construct a simple `curl` implicit grant request to obtain a JWT that you can inspect. An example
-  of how to decode the JWT (in this case located in the "access_token" field of a JSON response):
-
-  `cat jwt.json | jq -r .access_token | cut -d. -f2 | base64 -D`
-
-- As of Vault 1.2, the [`verbose_oidc_logging`](/vault/api-docs/auth/jwt#verbose_oidc_logging) role
-  option is available which will log the received OIDC token to the _server_ logs if debug-level logging is enabled. This can
-  be helpful when debugging provider setup and verifying that the received claims are what you expect.
-  Since claims data is logged verbatim and may contain sensitive information, this option should not be
-  used in production.
-
-- Azure requires some additional configuration when a user is a member of more
-  than 200 groups, described in [Azure-specific handling
-  configuration](/vault/docs/auth/jwt/oidc-providers/azuread#optional-azure-specific-configuration)
-
-## JWT authentication
-
-The authentication flow for roles of type "jwt" is simpler than OIDC since Vault
-only needs to validate the provided JWT.
-
-### JWT verification
-
-JWT signatures will be verified against public keys from the issuer. This process can be done in
-three different ways, though only one method may be configured for a single backend:
-
-- **Static Keys**. A set of public keys is stored directly in the backend configuration. See the
-  [jwt_validation_pubkeys](/vault/api-docs/auth/jwt#jwt_validation_pubkeys) 
-  configuration option.
-
-- **JWKS**. A JSON Web Key Set ([JWKS](https://tools.ietf.org/html/rfc7517)) URL and optional
-  certificate chain is configured. Keys will be fetched from this endpoint for authentication.
-  See the [jwks_url](/vault/api-docs/auth/jwt#jwks_url) and [jwks_ca_pem](/vault/api-docs/auth/jwt#jwks_ca_pem) 
-  configuration options.
-
-- **JWKS Pairs**. A list of JSON Web Key Set ([JWKS](https://tools.ietf.org/html/rfc7517)) URLs and optional
-  certificate chain for each is configured. Keys will be fetched from each endpoint for authentication, 
-  stopping at the first set to successfully verify the JWT signature. See the 
-  [jwks_pairs](/vault/api-docs/auth/jwt#jwks_pairs) configuration option.
-
-- **OIDC Discovery**. An OIDC Discovery URL and optional certificate chain is configured. Keys
-  will be fetched from this URL during authentication. When OIDC Discovery is used, OIDC validation
-  criteria (e.g. `iss`, `aud`, etc.) will be applied. See the [oidc_discovery_url](/vault/api-docs/auth/jwt#oidc_discovery_url)
-  and [oidc_discovery_ca_pem](/vault/api-docs/auth/jwt#oidc_discovery_ca_pem) configuration 
-  options.
-
-If multiple methods are needed, another instance of the backend can be mounted and configured
-at a different path.
-
-### Via the CLI
-
-```shell-session
-$ vault write auth/<path-to-jwt-backend>/login role=demo jwt=...
-```
-
-The default path for the JWT authentication backend is `/jwt`, so if you're using the default backend, the command would be:
-
-```shell-session
-$ vault write auth/jwt/login role=demo jwt=...
-```
-
-If your JWT auth backend is using a different path, use that path.
-
-### Via the API
-
-The default endpoint is `auth/jwt/login`. If this auth method was enabled
-at a different path, use that value instead of `jwt`.
-
-```shell-session
-$ curl \
-    --request POST \
-    --data '{"jwt": "your_jwt", "role": "demo"}' \
-    http://127.0.0.1:8200/v1/auth/jwt/login
-```
-
-The response will contain a token at `auth.client_token`:
-
-```json
-{
-  "auth": {
-    "client_token": "38fe9691-e623-7238-f618-c94d4e7bc674",
-    "accessor": "78e87a38-84ed-2692-538f-ca8b9f400ab3",
-    "policies": ["default"],
-    "metadata": {
-      "role": "demo"
-    },
-    "lease_duration": 2764800,
-    "renewable": true
-  }
-}
-```
-
-## Configuration
-
-Auth methods must be configured in advance before users or machines can
-authenticate. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the JWT auth method. Either the "jwt" or "oidc" name may be used. The
-   backend will be mounted at the chosen name.
-
-   ```text
-   $ vault auth enable jwt
-     or
-   $ vault auth enable oidc
-   ```
-
-1. Use the `/config` endpoint to configure Vault. To support JWT roles, either local keys, JWKS URL(s), or an OIDC
-   Discovery URL must be present. For OIDC roles, OIDC Discovery URL, OIDC Client ID and OIDC Client Secret are required. For the
-   list of available configuration options, please see the [API documentation](/vault/api-docs/auth/jwt).
-
-   ```text
-   $ vault write auth/jwt/config \
-       oidc_discovery_url="https://myco.auth0.com/" \
-       oidc_client_id="m5i8bj3iofytj" \
-       oidc_client_secret="f4ubv72nfiu23hnsj" \
-       default_role="demo"
-   ```
-
-   If you need to perform JWT verification with JWT token validation, then leave the `oidc_client_id` and `oidc_client_secret` blank. 
-
-   ```text
-   $ vault write auth/jwt/config \
-      oidc_discovery_url="https://MYDOMAIN.eu.auth0.com/" \
-      oidc_client_id="" \
-      oidc_client_secret="" \
-  ```
-
-1. Create a named role:
-
-   ```text
-   vault write auth/jwt/role/demo \
-       allowed_redirect_uris="http://localhost:8250/oidc/callback" \
-       bound_subject="r3qX9DljwFIWhsiqwFiu38209F10atW6@clients" \
-       bound_audiences="https://vault.plugin.auth.jwt.test" \
-       user_claim="https://vault/user" \
-       groups_claim="https://vault/groups" \
-       policies=webapps \
-       ttl=1h
-   ```
-
-   This role authorizes JWTs with the given subject and audience claims, gives
-   it the `webapps` policy, and uses the given user/groups claims to set up
-   Identity aliases.
-
-   For the complete list of configuration options, please see the API
-   documentation.
-
-### Bound claims
-
-Once a JWT has been validated as being properly signed and not expired, the
-authorization flow will validate that any configured "bound" parameters match.
-In some cases there are dedicated parameters, for example `bound_subject`,
-which must match the JWT's `sub` parameter. A role may also be configured to
-check arbitrary claims through the `bound_claims` map. The map contains a set
-of claims and their required values. For example, assume `bound_claims` is set
-to:
-
-```json
-{
-  "division": "Europe",
-  "department": "Engineering"
-}
-```
-
-Only JWTs containing both the "division" and "department" claims, and
-respective matching values of "Europe" and "Engineering", would be authorized.
-If the expected value is a list, the claim must match one of the items in the list.
-To limit authorization to a set of email addresses:
-
-```json
-{
-  "email": ["fred@example.com", "julie@example.com"]
-}
-```
-
-Bound claims can optionally be configured with globs. See the [API documentation](/vault/api-docs/auth/jwt#bound_claims_type) for more details.
-
-### Claims as metadata
-
-Data from claims can be copied into the resulting auth token and alias metadata by configuring `claim_mappings`. This role
-parameter is a map of items to copy. The map elements are of the form: `"<JWT claim>":"<metadata key>"`. Assume
-`claim_mappings` is set to:
-
-```json
-{
-  "division": "organization",
-  "department": "department"
-}
-```
-
-This specifies that the value in the JWT claim "division" should be copied to the metadata key "organization". The JWT
-"department" claim value will also be copied into metadata but will retain the key name. If a claim is configured in `claim_mappings`,
-it must existing in the JWT or else the authentication will fail.
-
-Note: the metadata key name "role" is reserved and may not be used for claim mappings. Since Vault 1.16 the role name is available 
-by the key `role` in the alias metadata of the entity after a successful login.
-
-### Claim specifications and JSON pointer
-
-Some parameters (e.g. `bound_claims`, `groups_claim`, `claim_mappings`, `user_claim`) are
-used to point to data within the JWT. If the desired key is at the top of level of the JWT,
-the name can be provided directly. If it is nested at a lower level, a JSON Pointer may be
-used.
-
-Assume the following JSON data to be referenced:
-
-```json
-{
-  "division": "North America",
-  "groups": {
-    "primary": "Engineering",
-    "secondary": "Software"
-  }
-}
-```
-
-A parameter of `"division"` will reference "North America", as this is a top level key. A parameter
-`"/groups/primary"` uses JSON Pointer syntax to reference "Engineering" at a lower level. Any valid
-JSON Pointer can be used as a selector. Refer to the
-[JSON Pointer RFC](https://tools.ietf.org/html/rfc6901) for a full description of the syntax.
-
-## Tutorial
-
-Refer to the following tutorials for OIDC auth method usage examples:
-
-- [OIDC Auth Method](/vault/tutorials/auth-methods/oidc-auth)
-- [Azure Active Directory with OIDC Auth Method and External
-  Groups](/vault/tutorials/auth-methods/oidc-auth-azure)
-- [OIDC Authentication with Okta](/vault/tutorials/auth-methods/vault-oidc-okta)
-- [OIDC Authentication with Google Workspace](/vault/tutorials/auth-methods/google-workspace-oauth)
-
-## API
-
-The JWT Auth Plugin has a full HTTP API. Please see the
-[API docs](/vault/api-docs/auth/jwt) for more details.
diff --git a/website/content/docs/auth/jwt/oidc-providers/adfs.mdx b/website/content/docs/auth/jwt/oidc-providers/adfs.mdx
deleted file mode 100644
index 9578e99ab20..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/adfs.mdx
+++ /dev/null
@@ -1,341 +0,0 @@
----
-layout: docs
-page_title: Configure Vault with ADFS for OIDC
-description: >-
-  Configure Vault to use Active Directory Federation Services (ADFS)
-  as an OIDC provider.
----
-
-# Configure Vault with ADFS for OIDC
-
-Configure your Vault instance to work with Active Directory Federation Services
-(ADFS) and use ADFS accounts with OIDC for Vault login.
-
-## Before you start
-
-1. **You must have Vault v1.15.0+**.
-1. **You must be running ADFS on Windows Server**.
-1. **You must have an OIDC client secret from your ADFS instance**.
-1. **You must know your Vault admin token**. If you do not have a valid admin
-   token, you can generate a new token in the Vault UI or with the
-   [Vault CLI](/vault/docs/commands/token/create).
-
-## Step 1: Enable the OIDC authN method for Vault
-
-<Tabs>
-
-<Tab heading="Vault CLI">
-
-1. Save your Vault instance URL to the `VAULT_ADDR` environment variable:
-   ```shell-session
-   $ export VAULT_ADDR="<URL_FOR_YOUR_VAULT_INSTALLATION>"
-   ```
-   For example:
-
-   <CodeBlockConfig hideClipboard>
-
-   ```shell-session
-   $ export VAULT_ADDR="https://myvault.example.com:8200"
-   ```
-
-   </CodeBlockConfig>
-
-1. Save your Vault instance URL to the `VAULT_TOKEN` environment variable:
-   ```shell-session
-   $ export VAULT_TOKEN="<YOUR_VAULT_ACCESS_TOKEN>"
-   ```
-   For example:
-
-   <CodeBlockConfig hideClipboard>
-
-   ```shell-session
-   $ export VAULT_TOKEN="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
-   ```
-
-   </CodeBlockConfig>
- 
-1. **If you use Vault Enterprise or Vault HCP**, set the namespace where you
-   have the OIDC plugin mounted to the `VAULT_NAMESPACE` environment variable:
-   ```shell-session
-   $ export VAULT_NAMESPACE="<OIDC_NAMESPACE>"
-   ```
-   For example:
-
-   <CodeBlockConfig hideClipboard>
-
-   ```shell-session
-   $ export VAULT_NAMESPACE="oidc-ns"
-   ```
-
-   </CodeBlockConfig>
-
-1. Enable the OIDC authentication plugin:
-  ```shell-session
-  $ vault auth enable -path=<YOUR_OIDC_MOUNT_PATH> oidc
-  ```
-  For example:
-
-  <CodeBlockConfig hideClipboard>
-
-  ```shell-session
-  $ vault auth enable -path=/adfs oidc
-  ```
-
-  </CodeBlockConfig>
-
-</Tab>
-
-<Tab heading="Vault UI">
-
-1. Open the web UI for your Vault instance.
-1. Select **Access** from the left-hand menu.
-1. Right click **Enable new method** on the Access page. 
-1. Select **OIDC**.
-1. Click **Next**.
-1. Set the mount path for the OIDC plugin. For example, `adfs`.
-1. Click **Enable Method**.
-1. Click **Save** to enable the plugin.
-
-</Tab>
-
-</Tabs>
-
-## Step 2: Create a new application group in ADFS
-
-<Note title="Save the client ID">
-
-  Make note of the 32-character **client identifier** provided by ADFS for your
-  new application group (for example, `d879d6fb-d2de-4596-b39c-191b2f83c03f`).
-  You will need the client ID to configure your OIDC plugin for Vault.
-
-</Note>
-
-1. Open your Windows Server UI.
-1. Go to the Server Manager screen and click **Tools**.
-1. Select **AD FS Management**.
-1. Right-click on **Application Groups** and select **Add Application Group...**.
-1. Follow the prompts to create a new application group with the following
-   information: 
-    - **Name**: Vault
-    - **Description**: a short description explaining the purpose of the application
-      group. For example, "Enable access to Vault".
-    - **Application type**: Server application
-    - **Redirect URI**: add the callback URL of your OIDC plugin for web
-      redirects and the local OIDC callback URL for Vault CLI redirects. For
-      example, `https://myvault.example.com:8200/ui/vault/auth/<YOUR_OIDC_MOUNT_PATH>/oidc/callback`
-      and `http://localhost:8250/oidc/callback`.
-1. Check the **Generate a shared secret** box and save the secret string.
-1. Confirm the application group details and correct information before closing.
-
-## Step 3: Configure the webhook in ADFS
-
-1. Open the Vault application group in from the ADFS management screen.
-1. Click **Add application...**
-1. Select **Web API**.
-1. Follow the prompts to configure a new webhook with the following information:
-   - Identifier: the client ID of your application group
-   - Access control policy: select an existing policy or `Permit everyone`
-   - Enable `allatclaims`, `email`, `openid`, and `profile`
-1. Select the new webhook (Vault - Web API) from the properties screen of the
-   Vault application group.
-1. Open the **Issuance Transform Rules** tab.
-1. Click **Add Rule...** and follow the prompts to create a new authentication
-   rule with the following information:
-   - Select **Send LDAP Attributes as Claims**
-   - Rule name: `LDAP Group`
-   - Attribute store: `Active Directory`
-   - LDAP attribute: `Token-Groups - Unqualified Names`
-   - Outgoing claim type: `Group`
-      
-[![Screenshot of the Transform Claim Rule Configuration](/img/adfs-oidc-ldapgroupoption.png)](/img/adfs-oidc-ldapgroupoption.png)
-
-## Step 4: Create a default ADFS role in Vault
-
-Use the `vault write` CLI command to create a default role for users
-authenticating with ADFS where:
-
-- `ADFS_APPLICATION_GROUP_CLIENT_ID` is the client ID provided by ADFS.
-- `YOUR_OIDC_MOUNT_PATH` is the mount path for the OIDC plugin.. For example,
-  `adfs`.
-- `ADFS_ROLE` is the name of your role. For example, `adfs-default`.
-
-```shell-session
-$ vault write auth/<YOUR_OIDC_MOUNT_PATH>/role/<ADFS_ROLE> \
-  bound_audiences="<ADFS_APPLICATION_GROUP_CLIENT_ID>" \
-  allowed_redirect_uris="${VAULT_ADDR}/ui/vault/auth/<YOUR_OIDC_MOUNT_PATH>/oidc/callback" \
-  allowed_redirect_uris="http://localhost:8250/oidc/callback" \
-  user_claim="upn" groups_claim="group" token_policies="default"
-```
-
-<Tip>
-
-Using `upn` value for `user_claim` tells Vault to consider the user email
-associated with the ADFS authentication token as an entity alias.
-
-</Tip>
-
-## Step 5: Configure the OIDC plugin
-
-Use the client ID and shared secret for your ADFS application group to finish
-configuring the OIDC plugin. 
-
-<Tabs>
-
-<Tab heading="Vault CLI">
-
-Use the `vault write` CLI command to save the configuration details for the OIDC
-plugin where:
-
-- `ADFS_URL` is the discovery URL for your ADFS instance. For example,
-  `https://adfs.example.com/adfs`
-- `ADFS_APPLICATION_GROUP_CLIENT_ID` is the client ID provided by ADFS.
-- `YOUR_OIDC_MOUNT_PATH` is the mount path for the OIDC plugin.. For example,
-  `adfs`.
-- `ADFS_APPLICATION_GROUP_SECRET` is the shared secret for your ADFS application
-  group.
-- `ADFS_ROLE` is the name of your role. For example, `adfs-default`.
-
-
-```shell-session
-$ vault write auth/<YOUR_OIDC_MOUNT_PATH>/config \
-  oidc_discovery_url="<ADFS_URL>" \
-  oidc_client_id="<ADFS_APPLICATION_GROUP_CLIENT_ID>" \
-  oidc_client_secret="<ADFS_APPLICATION_GROUP_SECRET>" \
-  default_role="<ADFS_ROLE>" 
-```
-
-</Tab>
-
-<Tab heading="Vault UI">
-
-1. Open the Vault UI.
-1. Select the OIDC plugin from the **Access** screen.
-1. Click **Enable Method** and follow the prompts to configure the OIDC plugin
-   with the following information:
-   - OIDC discovery URL: the discovery URL for your ADFS instance. For example,
-     `https://adfs.example.com/adfs`.
-   - Default role: the name of your new ADFS role. For example, `adfs-default`.
-1. Click **OIDC Options** and set your OIDC information:
-    - OIDC client ID: the application group client ID provided by ADFS.
-    - OIDC client secret: the shared secret for your ADFS application group.
-1. Save your changes.
-
-</Tab>
-
-</Tabs>
-
-
-## OPTIONAL: Link Active Directory groups to Vault
-
-1. Enable the KV secret engine in Vault for ADFS:
-   ```shell-session
-   $ vault secrets enable -path=<ADFS_KV_PLUGIN_PATH> kv-v2
-   ```
-   For example:
-
-  <CodeBlockConfig hideClipboard>
-
-  ```shell-session
-   $ vault secrets enable -path=adfs-kv kv-v2
-  ```
-
-  </CodeBlockConfig>
-
-1. Create a read-only policy against the KV plugin for ADFS:
-   ```shell-session
-   $ vault policy write <RO_ADFS_POLICY_NAME> - << EOF
-   # Read and list policy for the ADFS KV mount
-   path "<ADFS_KV_PLUGIN_PATH>/*" {
-     capabilities = ["read", "list"]
-   }
-   EOF
-   ```
-   For example:
-
-  <CodeBlockConfig hideClipboard>
-
-  ```shell-session
-   $ vault policy write read-adfs-test - << EOF
-   # Read and list policy for the ADFS KV mount
-   path "adfs-kv/*" {
-     capabilities = ["read", "list"]
-   }
-   EOF
-  ```
-
-  </CodeBlockConfig>
-
-1. Write a test value to the KV plugin:
-  ```shell-session
-  $ vault kv put <ADFS_KV_PLUGIN_PATH>/test test_key="test value"
-   ```
-   For example:
-
-  <CodeBlockConfig hideClipboard>
-
-  ```shell-session
-  $ vault kv put adfs-kv/test test_key="test value"
-  ```
-
-  </CodeBlockConfig>
-
-Now you can create a Vault group and link to an AD group:
-
-<Tabs>
-
-<Tab heading="Vault CLI">
-
-1. Create an external group in Vault and save the group ID to a file named
-   `group_id.txt`:
-  ```shell-session
-  $ vault write \
-    -format=json \
-    identity/group name="<YOUR_NEW_VAULT_GROUP_NAME>" \
-    policies="<RO_ADFS_POLICY_NAME>" \
-    type="external" | jq -r ".data.id" > group_id.txt
-  ```
-1. Retrieve the mount accessor for the ADFS authentication method and save it to
-   a file named `accessor_adfs.txt`:
-   ```shell-session
-   $ vault auth list -format=json | \
-     jq -r '.["<YOUR_OIDC_MOUNT_PATH>/"].accessor' > \
-     accessor_adfs.txt
-   ```
-1. Create a group alias:
-   ```shell-session
-   $ vault write identity/group-alias \
-     name="<YOUR_EXISTING_AD_GROUP>"  \
-     mount_accessor=$(cat accessor_adfs.txt) \
-     canonical_id="$(cat group_id.txt)"
-   ```
-1. Login to Vault as an AD user who is a member of YOUR_EXISTING_AD_GROUP.
-1. Read your test value from the KV plugin:
-  ```shell-session
-  $ vault kv list -mount=secret <ADFS_KV_PLUGIN_PATH>/test
-  ```
-
-</Tab>
-
-<Tab heading="Vault UI">
-
-1. Open the Vault UI.
-1. Select **Access**. 
-1. Select **Groups**.
-1. Click **Create group**.
-1. Follow the prompts to create an external group with the following
-   information:
-     - Name: your new Vault group name
-     - Type: `external`
-     - Policies: the read-only ADFS policy you created. For example,
-       `read-adfs-test`.
-1. Click on **Add alias** and follow the prompts to map the Vault group name
-   to an existing group on your AD:
-   - Name: the name of an existing AD group (**must match exactly**).
-   - Auth Backend: `<YOUR_OIDC_MOUNT_PATH>/ (oidc)`
-1. Login to Vault as an AD user who is a member of the aliased AD group.
-1. Read your test value from the KV plugin.
-
-</Tab>
-
-</Tabs>
-
diff --git a/website/content/docs/auth/jwt/oidc-providers/auth0.mdx b/website/content/docs/auth/jwt/oidc-providers/auth0.mdx
deleted file mode 100644
index 01499cada84..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/auth0.mdx
+++ /dev/null
@@ -1,13 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods - Auth0
-description: OIDC provider configuration for Auth0
----
-
-# Auth0
-
-1. Select Create Application (Regular Web App).
-1. Configure Allowed Callback URLs.
-1. Copy client ID and secret.
-1. If you see Vault errors involving signature, check the application's Advanced > OAuth settings
-   and verify that signing algorithm is "RS256".
diff --git a/website/content/docs/auth/jwt/oidc-providers/azuread.mdx b/website/content/docs/auth/jwt/oidc-providers/azuread.mdx
deleted file mode 100644
index 088f64ef52d..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/azuread.mdx
+++ /dev/null
@@ -1,155 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods - Azure Active Directory
-description: OIDC provider configuration for Azure Active Directory
----
-
-# Azure active directory (AAD)
-
-~> **Note:** Azure Active Directory Applications that have custom signing keys as a result of using
-the [claims-mapping](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-claims-mapping)
-feature are currently not supported for OIDC authentication.
-
-Reference: [Azure Active Directory v2.0 and the OpenID Connect protocol](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc)
-
-1. Choose your Azure tenant.
-
-1. Go to **Azure Active Directory** and
-   [register an application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app)
-   for Vault.
-
-1. Add Redirect URIs with the "Web" type. You may include two redirect URIs,
-   one for CLI access another one for Vault UI access.
-
-    - `http://localhost:8250/oidc/callback`
-    - `https://hostname:port_number/ui/vault/auth/oidc/oidc/callback`
-
-1. Record the "Application (client) ID" as you will need it as the `oidc_client_id`.
-
-1. Under **Endpoints**, copy the OpenID Connect metadata document URL, omitting the `/well-known...` portion.
-
-   - The endpoint URL (`oidc_discovery_url`) will look like: https://login.microsoftonline.com/tenant-guid-dead-beef-aaaa-aaaa/v2.0
-
-1. Under **Certificates & secrets**,
-   [add a client secret](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)
-   Record the secret's value as you will need it as the `oidc_client_secret` for Vault.
-
-### Connect AD group with Vault external group
-
-Reference: [Azure Active Directory with OIDC Auth Method and External Groups](/vault/tutorials/auth-methods/oidc-auth-azure)
-
-To connect the AD group with a [Vault external groups](/vault/docs/secrets/identity#external-vs-internal-groups),
-you will need
-[Azure AD v2.0 endpoints](https://docs.microsoft.com/en-gb/azure/active-directory/develop/azure-ad-endpoint-comparison).
-You should set up a [Vault policy](/vault/tutorials/policies/policies) for the Azure AD group to use.
-
-1. Go to **Azure Active Directory** and choose your Vault application.
-
-1. Go to **Token configuration** and **Add groups claim**. Select "All" or "SecurityGroup" based on
-   [which groups for a user](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims)
-   you want returned in the claim.
-
-1. In Vault, enable the OIDC auth method.
-
-1. Configure the OIDC auth method with the `oidc_client_id` (application ID), `oidc_client_secret`
-   (client secret), and `oidc_discovery_url` (endpoint URL) you recorded from Azure.
-   ```shell
-   vault write auth/oidc/config \
-      oidc_client_id="your_client_id" \
-      oidc_client_secret="your_client_secret" \
-      default_role="your_default_role" \
-      oidc_discovery_url="https://login.microsoftonline.com/tenant_id/v2.0"
-   ```
-
-1. Configure the [OIDC Role](/vault/api-docs/auth/jwt#create-role) with the following:
-
-   - `user_claim` should be `"sub"` or `"oid"` following the
-   [recommendation](https://learn.microsoft.com/en-us/azure/active-directory/develop/id-token-claims-reference#use-claims-to-reliably-identify-a-user)
-  from Azure.
-   - `allowed_redirect_uris` should be the two redirect URIs for Vault CLI and UI access.
-   - `groups_claim` should be set to `"groups"`.
-   - `oidc_scopes` should be set to `"https://graph.microsoft.com/.default"`.
-   
-   ```shell
-   vault write auth/oidc/role/your_default_role \
-      user_claim="sub" \
-      allowed_redirect_uris="http://localhost:8250/oidc/callback,https://online_version_hostname:port_number/ui/vault/auth/oidc/oidc/callback"  \
-      groups_claim="groups" \
-      oidc_scopes="https://graph.microsoft.com/.default" \
-      policies=default
-   ```
-
-1. In Vault, create the [external group](/vault/api-docs/secret/identity/group).
-   Record the group ID as you will need it for the group alias.
-
-1. From Vault, retrieve the [OIDC accessor ID](/vault/api-docs/system/auth#list-auth-methods)
-   from the OIDC auth method as you will need it for the group alias's `mount_accessor`.
-
-1. Go to the Azure AD Group you want to attach to Vault's external group. Record the `objectId`
-   as you will need it as the group alias name in Vault.
-
-1. In Vault, create a [group alias](/vault/api-docs/secret/identity/group-alias)
-   for the external group and set the `objectId` as the group alias name.
-   ```shell
-   vault write identity/group-alias \
-      name="your_ad_group_object_id" \
-      mount_accessor="vault_oidc_accessor_id" \
-      canonical_id="vault_external_group_id"
-   ```
-
-### Optional azure-specific configuration
-
-If a user is a member of more than 200 groups (directly or indirectly), Azure will
-send `_claim_names` and `_claim_sources`. For example, returned claims might look like:
-
-```json
-{
-  "_claim_names": {
-    "groups": "src1"
-  },
-  "_claim_sources": {
-    "src1": {
-      "endpoint": "https://graph.windows.net...."
-    }
-  }
-}
-```
-
-The OIDC auth method role can be configured to include the user ID in the endpoint URL,
-which will be used by Vault to retrieve the groups for the user. Additional API permissions
-must be added to the Azure app in order to request the additional groups from the Microsoft
-Graph API.
-
-To set the proper permissions on the Azure app:
-
-1. Locate the application under "App Registrations" in Azure
-1. Navigate to the "API Permissions" page for the application
-1. Add a permission
-1. Select "Microsoft Graph"
-1. Select "Delegated permissions"
-1. Add the [User.Read](https://learn.microsoft.com/en-us/graph/permissions-reference#delegated-permissions-93) permission
-1. Check the "Grant admin consent for Default Directory" checkbox
-1. Configure the OIDC auth method in Vault by setting `"provider_config"` to Azure.
-   ```shell
-   vault write auth/oidc/config -<<"EOH"
-   {
-     "oidc_client_id": "your_client_id",
-     "oidc_client_secret": "your_client_secret",
-     "default_role": "your_default_role",
-     "oidc_discovery_url": "https://login.microsoftonline.com/tenant_id/v2.0",
-     "provider_config": {
-        "provider": "azure"
-     }
-   }
-   EOH
-   ```
-
-1. Add `"profile"` to `oidc_scopes` so the user's ID comes back on the JWT.
-   ```shell
-   vault write auth/oidc/role/your_default_role \
-    user_claim="email" \
-    allowed_redirect_uris="http://localhost:8250/oidc/callback,https://online_version_hostname:port_number/ui/vault/auth/oidc/oidc/callback"  \
-    groups_claim="groups" \
-    oidc_scopes="profile" \
-    policies="default"
-   ```
diff --git a/website/content/docs/auth/jwt/oidc-providers/forgerock.mdx b/website/content/docs/auth/jwt/oidc-providers/forgerock.mdx
deleted file mode 100644
index 8f02b765214..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/forgerock.mdx
+++ /dev/null
@@ -1,42 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods - ForgeRock
-description: OIDC provider configuration for ForgeRock
----
-
-# ForgeRock
-
-1. Navigate to Applications -> OAuth 2.0 -> Clients in ForgeRock Access Management.
-1. Create new client.
-1. Configure Client ID, Client Secret, Scopes and Redirection URIs.
-  - `client ID`
-  - `client secret`
-  - `allowed_redirect_uris` should be the two redirect URIs for Vault CLI and UI access.
-  - `oidc_scopes` should be set to the OIDC scopes.
-1. Save Client ID and Client Secret.
-
-### Configuration
-
-1. In Vault, enable the OIDC auth method.
-
-1. Configure the OIDC auth method with the `oidc_client_id` (client ID), `oidc_client_secret`
-   (client secret), and `oidc_discovery_url` (endpoint URL) from ForgeRock.
-   ```shell
-   vault write auth/oidc/config \
-      oidc_client_id="your_client_id" \
-      oidc_client_secret="your_client_secret" \
-      default_role="your_default_role" \
-      oidc_discovery_url="https://openam.example.com:8443/openam/oauth2"
-   ```
-
-1. Configure the [OIDC Role](/vault/api-docs/auth/jwt) with the following:
-  - `user_claim` should be `"sub"`.
-  - `allowed_redirect_uris` should be the two redirect URIs for Vault CLI and UI access.
-  - `oidc_scopes` should be set to the OIDC scopes.
-   ```shell
-   vault write auth/oidc/role/your_default_role \
-      user_claim="sub" \
-      allowed_redirect_uris="http://localhost:8250/oidc/callback,https://online_version_hostname:port_number/ui/vault/auth/oidc/oidc/callback"  \
-      oidc_scopes="your_oidc_scopes" \
-      policies=default
-   ```
diff --git a/website/content/docs/auth/jwt/oidc-providers/gitlab.mdx b/website/content/docs/auth/jwt/oidc-providers/gitlab.mdx
deleted file mode 100644
index 8abf8ea78c8..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/gitlab.mdx
+++ /dev/null
@@ -1,12 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods - Gitlab
-description: OIDC provider configuration for Gitlab
----
-
-# Gitlab
-
-1. Visit Settings > Applications.
-1. Fill out Name and Redirect URIs.
-1. Making sure to select the "openid" scope.
-1. Copy client ID and secret.
diff --git a/website/content/docs/auth/jwt/oidc-providers/google.mdx b/website/content/docs/auth/jwt/oidc-providers/google.mdx
deleted file mode 100644
index 7ba7f73c7c6..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/google.mdx
+++ /dev/null
@@ -1,115 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods - Google
-description: OIDC provider configuration for Google
----
-
-# Google
-
-Main reference: [Using OAuth 2.0 to Access Google APIs](https://developers.google.com/identity/protocols/OAuth2)
-
-1. Visit the [Google API Console](https://console.developers.google.com).
-1. Create or a select a project.
-1. Navigate to Menu > APIs & Services
-1. Create a new credential via Credentials > Create Credentials > OAuth Client ID.
-1. Configure the OAuth Consent Screen. Application Name is required. Save.
-1. Select application type: "Web Application".
-1. Configure Authorized [Redirect URIs](/vault/docs/auth/jwt#redirect-uris).
-1. Save client ID and secret.
-
-### Optional google-specific configuration
-
-Google-specific configuration is available when using Google as an identity provider from the
-Vault JWT/OIDC auth method. The configuration allows Vault to obtain Google Workspace group membership and
-user information during the JWT/OIDC authentication flow. The group membership obtained from Google Workspace
-may be used for Identity group alias association. The user information obtained from Google Workspace can be
-used to copy claims data into resulting auth token and alias metadata via [claim_mappings](/vault/api-docs/auth/jwt#claim_mappings).
-
-#### Setup
-
-To set up the Google-specific handling, you'll need:
-
-- A Google Workspace account with the [super admin role](https://support.google.com/a/answer/2405986?hl=en)
-  for granting domain-wide delegation API client access, or a service account that has been granted
-  [the necessary](https://cloud.google.com/identity/docs/how-to/setup#auth-no-dwd) group admin roles.
-- The ability to create a service account in [Google Cloud Platform](https://console.developers.google.com/iam-admin/serviceaccounts).
-- To enable the [Admin SDK API](https://console.developers.google.com/apis/api/admin.googleapis.com/overview).
-- An OAuth 2.0 application with an [internal user type](https://support.google.com/cloud/answer/10311615#user-type).
-  We **do not** recommend using an external user type since it would allow _any user_ with a
-  Google account to authenticate with Vault.
-
-The Google-specific handling that's used to fetch Google Workspace groups and user information in Vault uses either
-Google Workspace Domain-Wide Delegation of Authority for authentication and authorization, or group admin roles granted to a GCP service account.
-
-Links to steps for setting up authentication and authorization:
-- [DWDoA](https://developers.google.com/workspace/guides/create-credentials#service-account)
-- [Without DWDoA](https://cloud.google.com/identity/docs/how-to/setup#auth-no-dwd)
-
-In **step 11** within the section titled
-[Optional: Set up domain-wide delegation for a service account](https://developers.google.com/workspace/guides/create-credentials#optional_set_up_domain-wide_delegation_for_a_service_account),
-the only OAuth scopes that should be granted are:
-
-- `https://www.googleapis.com/auth/admin.directory.group.readonly`
-- `https://www.googleapis.com/auth/admin.directory.user.readonly`
-
-~> This is an **important security step** in order to give the service account the least set of privileges
-that enable the feature.
-
-#### Configuration
-
-- `provider` `(string: <required>)` - Name of the provider. Must be set to "gsuite".
-- `gsuite_service_account` `(string: <optional>)` - Either the path to or the contents of a Google service
-  account key file in JSON format. If given as a file path, it must refer to a file that's readable on
-  the host that Vault is running on. If given directly as JSON contents, the JSON must be properly escaped.
-  If left empty, Application Default Credentials will be used.
-- `gsuite_admin_impersonate` `(string: <optional>)` - Email address of a Google Workspace admin to impersonate.
-- `fetch_groups` `(bool: false)` - If set to true, groups will be fetched from Google Workspace.
-- `fetch_user_info` `(bool: false)` - If set to true, user info will be fetched from Google Workspace using the configured [user_custom_schemas](#user_custom_schemas).
-- `groups_recurse_max_depth` `(int: <optional>)` - Group membership recursion max depth. Defaults to 0, which means don't recurse.
-- `user_custom_schemas` `(string: <optional>)` - Comma-separated list of Google Workspace [custom schemas](https://developers.google.com/admin-sdk/directory/v1/guides/manage-schemas).
-  Values set for Google Workspace users using custom schema fields will be fetched and made available as claims that can be used with [claim_mappings](/vault/api-docs/auth/jwt#claim_mappings). Required if [fetch_user_info](#fetch_user_info) is set to true.
-- `impersonate_principal` `(string: <optional>)` - Service account email that has been granted domain-wide delegation of authority in Google Workspace.
-  Required if accessing the Google Workspace Directory API through domain-wide delegation of authority, without using a service account key.
-  The service account vault is running under must be granted the `iam.serviceAccounts.signJwt` permission on this service account.
-  If `gsuite_admin_impersonate` is specified, that	Workspace user will be impersonated.
-- `domain` `(string: <optional>)` - The domain to get groups from. Set this if your workspace is configured with more than one domain.
-
-Example configuration:
-
-```
-vault write auth/oidc/config -<<EOF
-{
-    "oidc_discovery_url": "https://accounts.google.com",
-    "oidc_client_id": "your_client_id",
-    "oidc_client_secret": "your_client_secret",
-    "default_role": "your_default_role",
-    "provider_config": {
-        "provider": "gsuite",
-        "gsuite_service_account": "/path/to/service-account.json",
-        "gsuite_admin_impersonate": "admin@gsuitedomain.com",
-        "fetch_groups": true,
-        "fetch_user_info": true,
-        "groups_recurse_max_depth": 5,
-        "user_custom_schemas": "Education,Preferences",
-        "impersonate_principal": "sa@project.iam.gserviceaccount.com"
-    }
-}
-EOF
-```
-
-#### Role
-
-The [user_claim](/vault/api-docs/auth/jwt#user_claim) value of the role must be set to
-one of either `sub` or `email` for the Google Workspace group and user information
-queries to succeed.
-
-Example role:
-
-```
-vault write auth/oidc/role/your_default_role \
-    allowed_redirect_uris="http://localhost:8200/ui/vault/auth/oidc/oidc/callback,http://localhost:8250/oidc/callback" \
-    user_claim="sub" \
-    groups_claim="groups" \
-    claim_mappings="/Education/graduation_date"="graduation_date" \
-    claim_mappings="/Preferences/shirt_size"="shirt_size"
-```
diff --git a/website/content/docs/auth/jwt/oidc-providers/ibmisam.mdx b/website/content/docs/auth/jwt/oidc-providers/ibmisam.mdx
deleted file mode 100644
index 1c304aba906..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/ibmisam.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods - IBM Security Access Manager (ISAM)
-description: OIDC provider configuration for IBM Security Access Manager (recently renamed to IBM Security Verify Access)
----
-
-# IBM ISAM
-
-The [IBM ISAM](https://www.ibm.com/de-de/products/verify-access) identity provider
-returns group membership claims as a space-separated list of strings (e.g.
-`groups: "group-1 group-2"`) instead of a list of strings.
-
-To properly obtain group membership when using IBMISAM as the identity provider for
-Vault's OIDC Auth Method, the `ibmisam` provider must be explicitly configured as
-shown below.
-
-```shell
-vault write auth/oidc/config -<<"EOH"
-{
-   "oidc_client_id": "your_client_id",
-   "oidc_client_secret": "your_client_secret",
-   "default_role": "your_default_role",
-   "oidc_discovery_url": "https://your.idp.host",
-   "provider_config": {
-      "provider": "ibmisam"
-   }
-}
-EOH
-```
-
-This will instruct the OIDC Auth Method to parse the space-separated groups claims string
-into individual groups. Note that the role's [`groups_claim`](/vault/api-docs/auth/jwt#groups_claim)
-value must be properly configured to target the groups claim for your IBM ISAM identity
-provider.
diff --git a/website/content/docs/auth/jwt/oidc-providers/index.mdx b/website/content/docs/auth/jwt/oidc-providers/index.mdx
deleted file mode 100644
index 3c2822047a4..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/index.mdx
+++ /dev/null
@@ -1,28 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods
-description: OIDC provider configuration quick starts
----
-
-# OIDC provider configuration
-
-This page collects high-level setup steps on how to configure an OIDC
-application for various providers. For more general usage and operation
-information, see the [Vault JWT/OIDC method documentation](/vault/docs/auth/jwt).
-
-OIDC providers are often highly configurable, and you should become familiar with
-their recommended settings and best practices. The guides listed below are
-largely community-driven and intended to help you get started. Corrections
-and additions may be submitted via the [Vault Github repository](https://github.com/hashicorp/vault).
-
-- [ADFS](/vault/docs/auth/jwt/oidc-providers/adfs)
-- [Auth0](/vault/docs/auth/jwt/oidc-providers/auth0)
-- [Azure AD](/vault/docs/auth/jwt/oidc-providers/azuread)
-- [ForgeRock](/vault/docs/auth/jwt/oidc-providers/forgerock)
-- [Gitlab](/vault/docs/auth/jwt/oidc-providers/gitlab)
-- [Google](/vault/docs/auth/jwt/oidc-providers/google)
-- [Keycloak](/vault/docs/auth/jwt/oidc-providers/keycloak)
-- [Kubernetes](/vault/docs/auth/jwt/oidc-providers/kubernetes)
-- [Okta](/vault/docs/auth/jwt/oidc-providers/okta)
-- [SecureAuth](/vault/docs/auth/jwt/oidc-providers/secureauth)
-- [IBMISAM](/vault/docs/auth/jwt/oidc-providers/ibmisam)
diff --git a/website/content/docs/auth/jwt/oidc-providers/keycloak.mdx b/website/content/docs/auth/jwt/oidc-providers/keycloak.mdx
deleted file mode 100644
index 758e486cdcc..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/keycloak.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods - Keycloak
-description: OIDC provider configuration for Keycloak
----
-
-# Keycloak
-
-1. Select/create a Realm and Client. Select a Client and visit Settings.
-1. Client Protocol: openid-connect
-1. Access Type: confidential
-1. Standard Flow Enabled: On
-1. Configure Root URL such as `http://vault.example.com`
-1. Configure Valid Redirect URIs such as
-    - `http://vault.example.com/ui/vault/auth/oidc/oidc/callback`
-    - `http://vault.example.com/oidc/oidc/callback`
-1. Save.
-1. Visit Credentials. Select Client ID and Secret and note the generated secret.
diff --git a/website/content/docs/auth/jwt/oidc-providers/kubernetes.mdx b/website/content/docs/auth/jwt/oidc-providers/kubernetes.mdx
deleted file mode 100644
index 6f8d0379243..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/kubernetes.mdx
+++ /dev/null
@@ -1,233 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods - Kubernetes
-description: OIDC provider configuration for Kubernetes
----
-
-# Kubernetes
-
-Kubernetes can function as an OIDC provider such that Vault can validate its
-service account tokens using JWT/OIDC auth.
-
--> **Note:** The JWT auth engine does **not** use Kubernetes' `TokenReview` API
-during authentication, and instead uses public key cryptography to verify the
-contents of JWTs. This means tokens that have been revoked by Kubernetes will
-still be considered valid by Vault until their expiry time. To mitigate this
-risk, use short TTLs for service account tokens or use
-[Kubernetes auth](/vault/docs/auth/kubernetes) which _does_ use the `TokenReview` API.
-
-## Use service account issuer discovery
-
-When using service account issuer discovery, you only need to provide the JWT
-auth mount with an OIDC discovery URL, and sometimes a TLS certificate authority
-to trust. This makes it the most straightforward method to configure if your
-Kubernetes cluster meets the requirements.
-
-Kubernetes cluster requirements:
-
-* [`ServiceAccountIssuerDiscovery`][k8s-sa-issuer-discovery] feature enabled.
-  * Present from 1.18, defaults to enabled from 1.20.
-* kube-apiserver's `--service-account-issuer` flag is set to a URL that is
-  reachable from Vault. Public by default for most managed Kubernetes solutions.
-* Must use short-lived service account tokens when logging in.
-  * Tokens mounted into pods default to short-lived from 1.21.
-
-Configuration steps:
-
-1. Ensure OIDC discovery URLs do not require authentication, as detailed
-   [here][k8s-sa-issuer-discovery]:
-
-   ```bash
-   kubectl create clusterrolebinding oidc-reviewer  \
-      --clusterrole=system:service-account-issuer-discovery \
-      --group=system:unauthenticated
-   ```
-
-1. Find the issuer URL of the cluster.
-
-   ```bash
-   ISSUER="$(kubectl get --raw /.well-known/openid-configuration | jq -r '.issuer')"
-   ```
-
-1. Enable and configure JWT auth in Vault.
-
-  1. If Vault is running in Kubernetes:
-
-     ```bash
-     kubectl exec vault-0 -- vault auth enable jwt
-     kubectl exec vault-0 -- vault write auth/jwt/config \
-        oidc_discovery_url=https://kubernetes.default.svc.cluster.local \
-        oidc_discovery_ca_pem=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-     ```
-
-  1. Alternatively, if Vault is _not_ running in Kubernetes:
-
-     -> **Note:** When Vault is outside the cluster, the `$ISSUER` endpoint below may
-     or may not be reachable. If not, you can configure JWT auth using
-     [`jwt_validation_pubkeys`](#using-jwt-validation-public-keys) instead.
-
-     ```bash
-     vault auth enable jwt
-     vault write auth/jwt/config oidc_discovery_url="${ISSUER}"
-     ```
-
-1. Configure a role and log in as detailed [below](#creating-a-role-and-logging-in).
-
-[k8s-sa-issuer-discovery]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-issuer-discovery
-
-## Use JWT validation public keys
-
-This method can be useful if Kubernetes' API is not reachable from Vault or if
-you would like a single JWT auth mount to service multiple Kubernetes clusters
-by chaining their public signing keys.
-
-<Note title="Rotation of the JWT Signing Key in Kubernetes">
-  Should the JWT Signing Key used by Kubernetes be rotated,
-  this process should be repeated with the new key.
-</Note>
-
-Kubernetes cluster requirements:
-
-* [`ServiceAccountIssuerDiscovery`][k8s-sa-issuer-discovery] feature enabled.
-  * Present from 1.18, defaults to enabled from 1.20.
-  * This requirement can be avoided if you can access the Kubernetes master
-    nodes to read the public signing key directly from disk at
-    `/etc/kubernetes/pki/sa.pub`. In this case, you can skip the steps to
-    retrieve and then convert the key as it will already be in PEM format.
-* Must use short-lived service account tokens when logging in.
-  * Tokens mounted into pods default to short-lived from 1.21.
-
-Configuration steps:
-
-1. Fetch the service account signing public key from your cluster's JWKS URI.
-
-   ```bash
-   # Query the jwks_uri specified in /.well-known/openid-configuration
-   kubectl get --raw "$(kubectl get --raw /.well-known/openid-configuration | jq -r '.jwks_uri' | sed -r 's/.*\.[^/]+(.*)/\1/')"
-   ```
-
-1. Convert the keys from JWK format to PEM. You can use a CLI tool or an online
-   converter such as [this one][jwk-to-pem].
-
-1. Configure the JWT auth mount with those public keys.
-
-   ```bash
-   vault write auth/jwt/config \
-      jwt_validation_pubkeys="-----BEGIN PUBLIC KEY-----
-   MIIBIjANBgkqhkiG9...
-   -----END PUBLIC KEY-----","-----BEGIN PUBLIC KEY-----
-   MIIBIjANBgkqhkiG9...
-   -----END PUBLIC KEY-----"
-   ```
-
-1. Configure a role and log in as detailed [below](#creating-a-role-and-logging-in).
-
-[jwk-to-pem]: https://8gwifi.org/jwkconvertfunctions.jsp
-
-## Create a role and logging in
-
-Once your JWT auth mount is configured, you're ready to configure a role and
-log in. The following assumes you use the projected service account token
-available in all pods by default. See [Specifying TTL and audience](#specifying-ttl-and-audience)
-below if you'd like to control the audience or TTL.
-
-1. Choose any value from the array of default audiences. In these examples,
-   there is only one audience in the `aud` array,
-   `https://kubernetes.default.svc.cluster.local`.
-
-   To find the default audiences, either create a fresh token (requires
-   `kubectl` v1.24.0+):
-
-   ```shell-session
-   $ kubectl create token default | cut -f2 -d. | base64 --decode
-   {"aud":["https://kubernetes.default.svc.cluster.local"], ... "sub":"system:serviceaccount:default:default"}
-   ```
-
-   Or read a token from a running pod's filesystem:
-
-   ```shell-session
-   $ kubectl exec my-pod -- cat /var/run/secrets/kubernetes.io/serviceaccount/token | cut -f2 -d. | base64 --decode
-   {"aud":["https://kubernetes.default.svc.cluster.local"], ... "sub":"system:serviceaccount:default:default"}
-   ```
-
-1. Create a role for JWT auth that the `default` service account from the
-   `default` namespace can use.
-
-   ```bash
-   vault write auth/jwt/role/my-role \
-      role_type="jwt" \
-      bound_audiences="<AUDIENCE-FROM-PREVIOUS-STEP>" \
-      user_claim="sub" \
-      bound_subject="system:serviceaccount:default:default" \
-      policies="default" \
-      ttl="1h"
-   ```
-
-1. Pods or other clients with access to a service account JWT can then log in.
-
-   ```bash
-   vault write auth/jwt/login \
-      role=my-role \
-      jwt=@/var/run/secrets/kubernetes.io/serviceaccount/token
-   # OR equivalent to:
-   curl \
-      --fail \
-      --request POST \
-      --header "X-Vault-Request: true" \
-      --data '{"jwt":"<JWT-TOKEN-HERE>","role":"my-role"}' \
-      "${VAULT_ADDR}/v1/auth/jwt/login"
-   ```
-
-## Specify TTL and audience
-
-If you would like to specify a custom TTL or audience for service account tokens,
-the following pod spec illustrates a volume mount that overrides the default
-admission injected token. This is especially relevant if you are unable to
-disable the [--service-account-extend-token-expiration][k8s-extended-tokens]
-flag for `kube-apiserver` and want to use short TTLs.
-
-When using the resulting token, you will need to set `bound_audiences=vault`
-when creating roles in Vault's JWT auth mount.
-
-```yaml
-apiVersion: v1
-kind: Pod
-metadata:
-  name: nginx
-spec:
-  # automountServiceAccountToken is redundant in this example because the
-  # mountPath used overlaps with the default path. The overlap stops the default
-  # admission injected token from being created. You can use this option to
-  # ensure only a single token is mounted if you choose a different mount path.
-  automountServiceAccountToken: false
-  containers:
-    - name: nginx
-      image: nginx
-      volumeMounts:
-      - name: custom-token
-        mountPath: /var/run/secrets/kubernetes.io/serviceaccount
-  volumes:
-  - name: custom-token
-    projected:
-      defaultMode: 420
-      sources:
-      - serviceAccountToken:
-          path: token
-          expirationSeconds: 600 # 10 minutes is the minimum TTL
-          audience: vault        # Must match your JWT role's `bound_audiences`
-      # The remaining sources are included to mimic the rest of the default
-      # admission injected volume.
-      - configMap:
-          name: kube-root-ca.crt
-          items:
-          - key: ca.crt
-            path: ca.crt
-      - downwardAPI:
-          items:
-          - fieldRef:
-              apiVersion: v1
-              fieldPath: metadata.namespace
-            path: namespace
-```
-
-[k8s-extended-tokens]: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/#options
diff --git a/website/content/docs/auth/jwt/oidc-providers/okta.mdx b/website/content/docs/auth/jwt/oidc-providers/okta.mdx
deleted file mode 100644
index d80f4942bee..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/okta.mdx
+++ /dev/null
@@ -1,19 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods - Okta
-description: OIDC provider configuration for Okta
----
-
-# Okta
-
-1. Make sure an Authorization Server has been created. The "Issuer" field shown on the Setting page
-   will be used as the `oidc_discovery_url`.
-1. Visit Applications > Add Application (Web).
-1. Configure Login redirect URIs. Save.
-1. Save client ID and secret.
-
-Note your policy will need `oidc_scopes` to include `profile` to get a full profile
-("[Fat Token](https://support.okta.com/help/s/article/Okta-Groups-or-Attribute-Missing-from-Id-Token)").
-You will also need to configure bound audience along the lines of
-`"bound_audiences": ["api://default", "0a4........."]` if you are using the default
-authorization server.
diff --git a/website/content/docs/auth/jwt/oidc-providers/secureauth.mdx b/website/content/docs/auth/jwt/oidc-providers/secureauth.mdx
deleted file mode 100644
index 491bc2d3c39..00000000000
--- a/website/content/docs/auth/jwt/oidc-providers/secureauth.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider Setup - Auth Methods - SecureAuth
-description: OIDC provider configuration for SecureAuth
----
-
-# SecureAuth
-
-The [SecureAuth](https://www.secureauth.com/) identity provider returns group membership
-claims as a comma-separated list of strings (e.g. `groups: "group-1,group-2"`) instead
-of a list of strings.
-
-To properly obtain group membership when using SecureAuth as the identity provider for
-Vault's OIDC Auth Method, the `secureauth` provider must be explicitly configured as
-shown below.
-
-```shell
-vault write auth/oidc/config -<<"EOH"
-{
-   "oidc_client_id": "your_client_id",
-   "oidc_client_secret": "your_client_secret",
-   "default_role": "your_default_role",
-   "oidc_discovery_url": "https://idp.sasp.gosecureauth.com/your_secure_auth",
-   "provider_config": {
-      "provider": "secureauth"
-   }
-}
-EOH
-```
-
-This will instruct the OIDC Auth Method to parse the comma-separated groups claims string
-into individual groups. Note that the role's [`groups_claim`](/vault/api-docs/auth/jwt#groups_claim)
-value must be properly configured to target the groups claim for your SecureAuth identity
-provider.
diff --git a/website/content/docs/auth/kerberos.mdx b/website/content/docs/auth/kerberos.mdx
deleted file mode 100644
index d808ede5783..00000000000
--- a/website/content/docs/auth/kerberos.mdx
+++ /dev/null
@@ -1,235 +0,0 @@
----
-layout: docs
-page_title: Kerberos - Auth Methods
-description: The Kerberos auth method allows automated authentication of Kerberos entities.
----
-
-# Kerberos auth method
-
-@include 'x509-sha1-deprecation.mdx'
-
-The `kerberos` auth method provides an automated mechanism to retrieve
-a Vault token for Kerberos entities.
-
-[Kerberos](https://web.mit.edu/kerberos/) is a network authentication
-protocol invented by MIT in the 1980s. Its name is inspired by Cerberus,
-the three-headed hound of Hades from Greek mythology. The three heads
-refer to Kerberos' three entities - an authentication server, a ticket
-granting server, and a principals database. Kerberos underlies
-authentication in Active Directory, and its purpose is to _distribute_
-a network's authentication workload.
-
-Vault's Kerberos auth method was originally written by the folks at
-[Winton](https://github.com/wintoncode), to whom we owe a special thanks
-for both originally building the plugin, and for collaborating to bring
-it into HashiCorp's maintenance.
-
-## Prerequisites
-
-Kerberos is a very hands-on auth method. Other auth methods like
-[LDAP](/vault/docs/auth/ldap) and
-[Azure](/vault/docs/auth/azure) only require
-a cursory amount of knowledge for configuration and use.
-Kerberos, on the other hand, is best used by people already familiar
-with it. We recommend that you use simpler authentication methods if
-your use case is achievable through them. If not, we recommend that
-before approaching Kerberos, you become familiar with its fundamentals.
-
-- [MicroNugget: How Kerberos Works in Windows Active Directory](https://www.youtube.com/watch?v=kp5d8Yv3-0c)
-- [MIT's Kerberos Documentation](https://web.mit.edu/kerberos/)
-- [Kerberos: The Definitive Guide](https://www.amazon.com/Kerberos-Definitive-Guide-ebook-dp-B004P1J81C/dp/B004P1J81C/ref=mt_kindle?_encoding=UTF8&me=&qid=1573685442)
-
-Regardless of how you gain your knowledge, before using this auth method,
-ensure you are comfortable with Kerberos' high-level architecture, and
-ensure you've gone through the exercise of:
-
-- Creating a valid `krb5.conf` file
-- Creating a valid `keytab` file
-- Authenticating to your domain server with your `keytab` file using `kinit`
-
-With that knowledge in hand, and with an environment that's already tested
-and confirmed working, you will be ready to use Kerberos with Vault.
-
-## Configuration
-
-- Enable Kerberos authentication in Vault:
-
-```shell-session
-$ vault auth enable \
-    -passthrough-request-headers=Authorization \
-    -allowed-response-headers=www-authenticate \
-    kerberos
-```
-
-- Create a `keytab` for the Kerberos plugin (this keytab is used by the Vault server itself, another keytab should be generated for login purposes):
-
-```shell-session
-$ ktutil
-ktutil:  addent -password -p your_service_account@REALM.COM -e aes256-cts -k 1
-Password for your_service_account@REALM.COM:
-ktutil:  list -e
-slot KVNO Principal
----- ---- ---------------------------------------------------------------------
-  1    1            your_service_account@REALM.COM (aes256-cts-hmac-sha1-96)
-ktutil:  wkt vault.keytab
-```
-
-The KVNO (`-k 1`) should match the KVNO of the service account. An error will show in the Vault logs if this is incorrect.
-
-Different encryption types can also be added to the `keytab`, for example `-e rc4-hmac` with additional `addent` commands.
-
-Then base64 encode it:
-
-```shell-session
-$ base64 vault.keytab > vault.keytab.base64
-```
-
-- Configure the Kerberos auth method with the `keytab` and
-  entry name that will be used to verify inbound login
-  requests:
-
-```shell-session
-$ vault write auth/kerberos/config \
-    keytab=@vault.keytab.base64 \
-    service_account="vault_svc"
-```
-
-- Configure the Kerberos auth method to communicate with
-  LDAP using the service account configured above. This is
-  a sample LDAP configuration. Yours will vary. Ensure you've
-  first tested your configuration from the Vault server using
-  a tool like `ldapsearch`.
-
-```shell-session
-$ vault write auth/kerberos/config/ldap \
-    binddn=vault_svc@MATRIX.LAN \
-    bindpass=$VAULT_SVC_PASSWORD \
-    groupattr=sAMAccountName \
-    groupdn="DC=MATRIX,DC=LAN" \
-    groupfilter="(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))" \
-    userdn="CN=Users,DC=MATRIX,DC=LAN" \
-    userattr=sAMAccountName \
-    upndomain=MATRIX.LAN \
-    url=ldaps://somewhere.foo
-```
-
-The LDAP above relies upon the same code as the LDAP auth method.
-See [its documentation](/vault/docs/auth/ldap)
-for further discussion of available parameters.
-
-- Configure the Vault policies that should be granted to those
-  who successfully authenticate based on their LDAP group membership.
-  Since this is identical to the LDAP auth method, see
-  [Group Membership Resolution](/vault/docs/auth/ldap#group-membership-resolution)
-  and [LDAP Group -> Policy Mapping](/vault/docs/auth/ldap#ldap-group-policy-mapping)
-  for further discussion.
-
-```shell-session
-$ vault write auth/kerberos/groups/engineering-team \
-    policies=engineers
-```
-
-The above group grants the "engineers" policy to those who authenticate
-via Kerberos and are found to be members of the "engineering-team" LDAP
-group.
-
-## Authentication
-
-From a client machine with a valid `krb5.conf` and `keytab`, perform a command
-like the following:
-
-```shell-session
-$ vault login -method=kerberos \
-    username=grace \
-    service=HTTP/my-service \
-    realm=MATRIX.LAN \
-    keytab_path=/etc/krb5/krb5.keytab  \
-    krb5conf_path=/etc/krb5.conf \
-    disable_fast_negotiation=false
-```
-
-- `krb5conf_path` is the path to a valid `krb5.conf` file describing how to
-  communicate with the Kerberos environment.
-- `keytab_path` is the path to the `keytab` in which the entry lives for the
-  entity authenticating to Vault. Keytab files should be protected from other
-  users on a shared server using appropriate file permissions.
-- `username` is the username for the entry _within_ the `keytab` to use for
-  logging into Kerberos. This username must match a service account in LDAP.
-- `service` is the service principal name to use in obtaining a service ticket for
-  gaining a SPNEGO token. This service must exist in LDAP.
-- `realm` is the name of the Kerberos realm. This realm must match the UPNDomain
-  configured on the LDAP connection. This check is case-sensitive.
-- `disable_fast_negotiation` is for disabling the Kerberos auth method's default
-  of using FAST negotiation. FAST is a pre-authentication framework for Kerberos.
-  It includes a mechanism for tunneling pre-authentication exchanges using armoured
-  KDC messages. FAST provides increased resistance to passive password guessing attacks.
-  Some common Kerberos implementations do not support FAST negotiation.
-- `remove_instance_name` removes any instance names from a Kerberos service 
-  principal name when parsing the keytab file. For example when this is set to true, 
-  if a keytab has the service principal name `foo/localhost@example.com`, the CLI 
-  will strip the service principal name to just be `foo@example.com`.
-
-## Troubleshooting
-
-### Identify the malfunctioning piece
-
-Once the malfunctioning piece of the journey is identified, you can focus
-your debugging efforts in the most useful direction.
-
-1. Use `ldapsearch` while logged into your machine hosting Vault to ensure
-   your LDAP configuration is functional.
-2. Authenticate to your domain server using `kinit`, your `keytab`, and your
-   `krb5.conf`. Do this with both Vault's `keytab`, and any client `keytab` being
-   used for logging in. This ensures your Kerberos network is working.
-3. While logged into your client machine, verify you can reach Vault
-   through the following command: `$ curl $VAULT_ADDR/v1/sys/health`.
-
-### Build clear steps to reproduce the problem
-
-If possible, make it easy for someone else to reproduce the problem who
-is outside of your company. For instance, if you expect that you should
-be able to login using a command like:
-
-```shell-session
-$ vault login -method=kerberos \
-    username=my-name \
-    service=HTTP/my-service \
-    realm=EXAMPLE.COM \
-    keytab_path=/etc/krb5/krb5.keytab  \
-    krb5conf_path=/etc/krb5.conf
-```
-
-Then make sure you're ready to share the error output of that command, the
-contents of the `krb5.conf` file, and [the entries listed](https://docs.oracle.com/cd/E19683-01/806-4078/6jd6cjs1q/index.html)
-in the `keytab` file.
-
-After you've stripped the issue down to its simplest form, if you still
-encounter difficulty resolving it, it will be much easier to gain assistance
-by posting your reproduction to the [Vault Forum](https://discuss.hashicorp.com/c/vault)
-or by providing it to [HashiCorp Support](https://www.hashicorp.com/support)
-(if applicable.)
-
-### Additional troubleshooting resources
-
-- [Troubleshooting Vault](/vault/tutorials/monitoring/troubleshooting-vault)
-- [The plugin's code](https://github.com/hashicorp/vault-plugin-auth-kerberos)
-
-The Vault Kerberos library has a working integration test environment that
-can be referenced as an example of a full Kerberos and LDAP environment.
-It runs through Docker and can be started through either one of the following
-commands:
-
-```shell-session
-$ make integration
-$ make dev-env
-```
-
-These commands run variations of [a script](https://github.com/hashicorp/vault-plugin-auth-kerberos/blob/master/scripts/integration_env.sh)
-that spins up a full environment, adds users, and executes a login from a
-client.
-
-## API
-
-The Kerberos auth method has a full HTTP API. Please see the
-[Kerberos auth method API](/vault/api-docs/auth/kerberos) for more
-details.
diff --git a/website/content/docs/auth/kubernetes.mdx b/website/content/docs/auth/kubernetes.mdx
deleted file mode 100644
index 4e6cc191982..00000000000
--- a/website/content/docs/auth/kubernetes.mdx
+++ /dev/null
@@ -1,451 +0,0 @@
----
-layout: docs
-page_title: Kubernetes - Auth Methods
-description: |-
-  The Kubernetes auth method allows automated authentication of Kubernetes
-  Service Accounts.
----
-
-# Kubernetes auth method
-
-@include 'x509-sha1-deprecation.mdx'
-
-The `kubernetes` auth method can be used to authenticate with Vault using a
-Kubernetes Service Account Token. This method of authentication makes it easy to
-introduce a Vault token into a Kubernetes Pod.
-
-You can also use a Kubernetes Service Account Token to [log in via JWT auth][k8s-jwt-auth].
-See the section on [How to work with short-lived Kubernetes tokens][short-lived-tokens]
-for a summary of why you might want to use JWT auth instead and how it compares to
-Kubernetes auth.
-
--> **Note:** If you are upgrading to Kubernetes v1.21+, ensure the config option
-`disable_iss_validation` is set to true. Assuming the default mount path, you
-can check with `vault read -field disable_iss_validation auth/kubernetes/config`.
-See [Kubernetes 1.21](#kubernetes-1-21) below for more details.
-
-## Authentication
-
-### Via the CLI
-
-The default path is `/kubernetes`. If this auth method was enabled at a
-different path, specify `-path=/my-path` in the CLI.
-
-```shell-session
-$ vault write auth/kubernetes/login role=demo jwt=...
-```
-
-### Via the API
-
-The default endpoint is `auth/kubernetes/login`. If this auth method was enabled
-at a different path, use that value instead of `kubernetes`.
-
-```shell-session
-$ curl \
-    --request POST \
-    --data '{"jwt": "<your service account jwt>", "role": "demo"}' \
-    http://127.0.0.1:8200/v1/auth/kubernetes/login
-```
-
-The response will contain a token at `auth.client_token`:
-
-```json
-{
-  "auth": {
-    "client_token": "38fe9691-e623-7238-f618-c94d4e7bc674",
-    "accessor": "78e87a38-84ed-2692-538f-ca8b9f400ab3",
-    "policies": ["default"],
-    "metadata": {
-      "role": "demo",
-      "service_account_name": "myapp",
-      "service_account_namespace": "default",
-      "service_account_secret_name": "myapp-token-pd21c",
-      "service_account_uid": "aa9aa8ff-98d0-11e7-9bb7-0800276d99bf"
-    },
-    "lease_duration": 2764800,
-    "renewable": true
-  }
-}
-```
-
-## Configuration
-
-Auth methods must be configured in advance before users or machines can
-authenticate. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the Kubernetes auth method:
-
-  ```bash
-  vault auth enable kubernetes
-  ```
-
-1. Use the `/config` endpoint to configure Vault to talk to Kubernetes. Use
-  `kubectl cluster-info` to validate the Kubernetes host address and TCP port.
-  For the list of available configuration options, please see the
-  [API documentation](/vault/api-docs/auth/kubernetes).
-
-  ```bash
-  vault write auth/kubernetes/config \
-      token_reviewer_jwt="<your reviewer service account JWT>" \
-      kubernetes_host=https://192.168.99.100:<your TCP port or blank for 443> \
-      kubernetes_ca_cert=@ca.crt
-  ```
-
-  !> **Note:** The pattern Vault uses to authenticate Pods depends on sharing
-  the JWT token over the network. Given the [security model of
-  Vault](/vault/docs/internals/security), this is allowable because Vault is
-  part of the trusted compute base. In general, Kubernetes applications should
-  **not** share this JWT with other applications, as it allows API calls to be
-  made on behalf of the Pod and can result in unintended access being granted
-  to 3rd parties.
-
-1. Create a named role:
-
-  ```text
-  vault write auth/kubernetes/role/demo \
-      bound_service_account_names=myapp \
-      bound_service_account_namespaces=default \
-      policies=default \
-      ttl=1h
-  ```
-
-  This role authorizes the "myapp" service account in the default
-  namespace and it gives it the default policy.
-
-  For the complete list of configuration options, please see the [API
-  documentation](/vault/api-docs/auth/kubernetes).
-
-## Kubernetes 1.21
-
-Starting in version [1.21][k8s-1.21-changelog], the Kubernetes
-`BoundServiceAccountTokenVolume` feature defaults to enabled. This changes the
-JWT token mounted into containers by default in two ways that are important for
-Kubernetes auth:
-
-* It has an expiry time and is bound to the lifetime of the pod and service account.
-* The value of the JWT's `"iss"` claim depends on the cluster's configuration.
-
-The changes to token lifetime are important when configuring the
-[`token_reviewer_jwt`](/vault/api-docs/auth/kubernetes#token_reviewer_jwt) option.
-If a short-lived token is used,
-Kubernetes will revoke it as soon as the pod or service account are deleted, or
-if the expiry time passes, and Vault will no longer be able to use the
-`TokenReview` API. See [How to work with short-lived Kubernetes tokens][short-lived-tokens]
-below for details on handling this change.
-
-In response to the issuer changes, Kubernetes auth has been updated in Vault
-1.9.0 to not validate the issuer by default. The Kubernetes API does the same
-validation when reviewing tokens, so enabling issuer validation on the Vault
-side is duplicated work. Without disabling Vault's issuer validation, it is not
-possible for a single Kubernetes auth configuration to work for default mounted
-pod tokens with both Kubernetes 1.20 and 1.21. Note that auth mounts created
-before Vault 1.9 will maintain the old default, and you will need to explicitly
-set `disable_iss_validation=true` before upgrading Kubernetes to 1.21. See
-[Discovering the service account `issuer`](#discovering-the-service-account-issuer)
-below for guidance if you wish to enable issuer validation in Vault.
-
-[k8s-1.21-changelog]: https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.21.md#api-change-2
-[short-lived-tokens]: #how-to-work-with-short-lived-kubernetes-tokens
-
-### How to work with short-lived kubernetes tokens
-
-There are a few different ways to configure auth for Kubernetes pods when
-default mounted pod tokens are short-lived, each with their own tradeoffs. This
-table summarizes the options, each of which is explained in more detail below.
-
-| Option                               | All tokens are short-lived | Can revoke tokens early | Other considerations |
-| ------------------------------------ | -------------------------- | ----------------------- | -------------------- |
-| Use local token as reviewer JWT      | Yes                        | Yes                     | Requires Vault (1.9.3+) to be deployed on the Kubernetes cluster |
-| Use client JWT as reviewer JWT       | Yes                        | Yes                     | Operational overhead |
-| Use long-lived token as reviewer JWT | No                         | Yes                     |                      |
-| Use JWT auth instead                 | Yes                        | No                      |                      |
-
--> **Note:** By default, Kubernetes currently extends the lifetime of admission
-injected service account tokens to a year to help smooth the transition to
-short-lived tokens. If you would like to disable this, set
-[--service-account-extend-token-expiration=false][k8s-extended-tokens] for
-`kube-apiserver` or specify your own `serviceAccountToken` volume mount. See
-[here](/vault/docs/auth/jwt/oidc-providers/kubernetes#specifying-ttl-and-audience) for an example.
-
-[k8s-extended-tokens]: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/#options
-
-#### Use local service account token as the reviewer JWT
-
-When running Vault in a Kubernetes pod the recommended option is to use the pod's local
-service account token. Vault will periodically re-read the file to support
-short-lived tokens. To use the local token and CA certificate, omit
-`token_reviewer_jwt` and `kubernetes_ca_cert` when configuring the auth method.
-Vault will attempt to load them from `token` and `ca.crt` respectively inside
-the default mount folder `/var/run/secrets/kubernetes.io/serviceaccount/`.
-
-```bash
-vault write auth/kubernetes/config \
-    kubernetes_host=https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT
-```
-
-!> **Note:** Requires Vault 1.9.3+. In earlier versions the service account
-token and CA certificate is read once and stored in Vault storage.
-When the service account token expires or is revoked, Vault will no longer be
-able to use the `TokenReview` API and client authentication will fail.
-
-#### Use the Vault client's JWT as the reviewer JWT
-
-When configuring Kubernetes auth, you can omit the `token_reviewer_jwt`, and Vault
-will use the Vault client's JWT as its own auth token when communicating with
-the Kubernetes `TokenReview` API. If Vault is running in Kubernetes, you also need
-to set `disable_local_ca_jwt=true`.
-
-This means Vault does not store any JWTs and allows you to use short-lived tokens
-everywhere but adds some operational overhead to maintain the cluster role
-bindings on the set of service accounts you want to be able to authenticate with
-Vault. Each client of Vault would need the `system:auth-delegator` ClusterRole:
-
-```bash
-kubectl create clusterrolebinding vault-client-auth-delegator \
-  --clusterrole=system:auth-delegator \
-  --group=group1 \
-  --serviceaccount=default:svcaccount1 \
-  ...
-```
-
-#### Continue using long-lived tokens
-
-You can create a long-lived secret using the instructions [here][k8s-create-secret]
-and use that as the `token_reviewer_jwt`. In this example, the `vault` service
-account would need the `system:auth-delegator` ClusterRole:
-
-```bash
-kubectl apply -f - <<EOF
-apiVersion: v1
-kind: Secret
-metadata:
-  name: vault-k8s-auth-secret
-  annotations:
-    kubernetes.io/service-account.name: vault
-type: kubernetes.io/service-account-token
-EOF
-```
-
-Using this maintains previous workflows but does not benefit from the improved
-security posture of short-lived tokens.
-
-[k8s-create-secret]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-a-service-account-api-token
-
-#### Use JWT auth
-
-Kubernetes auth is specialized to use Kubernetes' `TokenReview` API. However, the
-JWT tokens Kubernetes generates can also be verified using Kubernetes as an OIDC
-provider. The JWT auth method documentation has [instructions][k8s-jwt-auth] for
-setting up JWT auth with Kubernetes as the OIDC provider.
-
-[k8s-jwt-auth]: /vault/docs/auth/jwt/oidc-providers/kubernetes
-
-This solution allows you to use short-lived tokens for all clients and removes
-the need for a reviewer JWT. However, the client tokens cannot be revoked before
-their TTL expires, so it is recommended to keep the TTL short with that
-limitation in mind.
-
-### Discovering the service account `issuer`
-
--> **Note:** From Vault 1.9.0, `disable_iss_validation` and `issuer` are deprecated
-and the default for `disable_iss_validation` has changed to `true` for new
-Kubernetes auth mounts. The following section only applies if you have set
-`disable_iss_validation=false` or created your mount before 1.9 with the default
-value, but `disable_iss_validation=true` is the new recommended value for all
-versions of Vault.
-
-Kubernetes 1.21+ clusters may require setting the service account
-[`issuer`](/vault/api-docs/auth/kubernetes#issuer) to the same value as
-`kube-apiserver`'s `--service-account-issuer` flag. This is because the service
-account JWTs for these clusters may have an issuer specific to the cluster
-itself, instead of the old default of `kubernetes/serviceaccount`. If you are
-unable to check this value directly, you can run the following and look for the
-`"iss"` field to find the required value:
-
-```bash
-echo '{"apiVersion": "authentication.k8s.io/v1", "kind": "TokenRequest"}' \
-  | kubectl create -f- --raw /api/v1/namespaces/default/serviceaccounts/default/token \
-  | jq -r '.status.token' \
-  | cut -d . -f2 \
-  | base64 -d
-```
-
-Most clusters will also have that information available at the
-`.well-known/openid-configuration` endpoint:
-
-```bash
-kubectl get --raw /.well-known/openid-configuration | jq -r .issuer
-```
-
-This value is then used when configuring Kubernetes auth, e.g.:
-
-```bash
-vault write auth/kubernetes/config \
-  kubernetes_host="https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT" \
-  issuer="\"test-aks-cluster-dns-d6cbb78e.hcp.uksouth.azmk8s.io\""
-```
-
-## Configuring kubernetes
-
-This auth method accesses the [Kubernetes TokenReview API][k8s-tokenreview] to
-validate the provided JWT is still valid. Kubernetes should be running with
-`--service-account-lookup`. This is defaulted to true from Kubernetes 1.7.
-Otherwise deleted tokens in Kubernetes will not be properly revoked and
-will be able to authenticate to this auth method.
-
-Service Accounts used in this auth method will need to have access to the
-TokenReview API. If Kubernetes is configured to use RBAC roles, the Service
-Account should be granted permissions to access this API. The following
-example ClusterRoleBinding could be used to grant these permissions:
-
-```yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: role-tokenreview-binding
-  namespace: default
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:auth-delegator
-subjects:
-  - kind: ServiceAccount
-    name: vault-auth
-    namespace: default
-```
-
-## API
-
-The Kubernetes Auth Plugin has a full HTTP API. Please see the
-[API docs](/vault/api-docs/auth/kubernetes) for more details.
-
-[k8s-tokenreview]: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#tokenreview-v1-authentication-k8s-io
-
-## Code example
-
-The following example demonstrates the Kubernetes auth method to authenticate
-with Vault.
-
-<CodeTabs>
-
-<CodeBlockConfig>
-
-```go
-package main
-
-import (
-	"fmt"
-	"os"
-
-	vault "github.com/hashicorp/vault/api"
-	auth "github.com/hashicorp/vault/api/auth/kubernetes"
-)
-
-// Fetches a key-value secret (kv-v2) after authenticating to Vault with a Kubernetes service account.
-// For a more in-depth setup explanation, please see the relevant readme in the hashicorp/vault-examples repo.
-func getSecretWithKubernetesAuth() (string, error) {
-	// If set, the VAULT_ADDR environment variable will be the address that
-	// your pod uses to communicate with Vault.
-	config := vault.DefaultConfig() // modify for more granular configuration
-
-	client, err := vault.NewClient(config)
-	if err != nil {
-		return "", fmt.Errorf("unable to initialize Vault client: %w", err)
-	}
-
-	// The service-account token will be read from the path where the token's
-	// Kubernetes Secret is mounted. By default, Kubernetes will mount it to
-	// /var/run/secrets/kubernetes.io/serviceaccount/token, but an administrator
-	// may have configured it to be mounted elsewhere.
-	// In that case, we'll use the option WithServiceAccountTokenPath to look
-	// for the token there.
-	k8sAuth, err := auth.NewKubernetesAuth(
-		"dev-role-k8s",
-		auth.WithServiceAccountTokenPath("path/to/service-account-token"),
-	)
-	if err != nil {
-		return "", fmt.Errorf("unable to initialize Kubernetes auth method: %w", err)
-	}
-
-	authInfo, err := client.Auth().Login(context.TODO(), k8sAuth)
-	if err != nil {
-		return "", fmt.Errorf("unable to log in with Kubernetes auth: %w", err)
-	}
-	if authInfo == nil {
-		return "", fmt.Errorf("no auth info was returned after login")
-	}
-
-	// get secret from Vault, from the default mount path for KV v2 in dev mode, "secret"
-	secret, err := client.KVv2("secret").Get(context.Background(), "creds")
-	if err != nil {
-		return "", fmt.Errorf("unable to read secret: %w", err)
-	}
-
-	// data map can contain more than one key-value pair,
-	// in this case we're just grabbing one of them
-	value, ok := secret.Data["password"].(string)
-	if !ok {
-		return "", fmt.Errorf("value type assertion failed: %T %#v", secret.Data["password"], secret.Data["password"])
-	}
-
-	return value, nil
-}
-```
-</CodeBlockConfig>
-
-<CodeBlockConfig>
-
-```cs
-using System;
-using System.IO;
-using VaultSharp;
-using VaultSharp.V1.AuthMethods;
-using VaultSharp.V1.AuthMethods.Kubernetes;
-using VaultSharp.V1.Commons;
-
-namespace Examples
-{
-    public class KubernetesAuthExample
-    {
-        const string DefaultTokenPath = "path/to/service-account-token";
-
-        // Fetches a key-value secret (kv-v2) after authenticating to Vault with a Kubernetes service account.
-        // For a more in-depth setup explanation, please see the relevant readme in the hashicorp/vault-examples repo.
-        public string GetSecretWithK8s()
-        {
-            var vaultAddr = Environment.GetEnvironmentVariable("VAULT_ADDR");
-            if(String.IsNullOrEmpty(vaultAddr))
-            {
-                throw new System.ArgumentNullException("Vault Address");
-            }
-
-            var roleName = Environment.GetEnvironmentVariable("VAULT_ROLE");
-            if(String.IsNullOrEmpty(roleName))
-            {
-                throw new System.ArgumentNullException("Vault Role Name");
-            }
-
-            // Get the path to service account token or fall back on default path
-            string pathToToken = String.IsNullOrEmpty(Environment.GetEnvironmentVariable("SA_TOKEN_PATH")) ? DefaultTokenPath : Environment.GetEnvironmentVariable("SA_TOKEN_PATH");
-            string jwt = File.ReadAllText(pathToToken);
-
-            IAuthMethodInfo authMethod = new KubernetesAuthMethodInfo(roleName, jwt);
-            var vaultClientSettings = new VaultClientSettings(vaultAddr, authMethod);
-
-            IVaultClient vaultClient = new VaultClient(vaultClientSettings);
-
-            // We can retrieve the secret after creating our VaultClient object
-            Secret<SecretData> kv2Secret = null;
-            kv2Secret = vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(path: "/creds").Result;
-
-            var password = kv2Secret.Data.Data["password"];
-
-            return password.ToString();
-        }
-    }
-}
-```
-</CodeBlockConfig>
-
-</CodeTabs>
diff --git a/website/content/docs/auth/ldap.mdx b/website/content/docs/auth/ldap.mdx
deleted file mode 100644
index cead3960ef6..00000000000
--- a/website/content/docs/auth/ldap.mdx
+++ /dev/null
@@ -1,285 +0,0 @@
----
-layout: docs
-page_title: LDAP - Auth Methods
-description: |-
-  The "ldap" auth method allows users to authenticate with Vault using LDAP
-  credentials.
----
-
-# LDAP auth method
-
-@include 'x509-sha1-deprecation.mdx'
-
-The `ldap` auth method allows authentication using an existing LDAP
-server and user/password credentials. This allows Vault to be integrated
-into environments using LDAP without duplicating the user/pass configuration
-in multiple places.
-
-The mapping of groups and users in LDAP to Vault policies is managed by using
-the `users/` and `groups/` paths.
-
-## A note on escaping
-
-**It is up to the administrator** to provide properly escaped DNs. This
-includes the user DN, bind DN for search, and so on.
-
-The only DN escaping performed by this method is on usernames given at login
-time when they are inserted into the final bind DN, and uses escaping rules
-defined in RFC 4514.
-
-Additionally, Active Directory has escaping rules that differ slightly from the
-RFC; in particular it requires escaping of '#' regardless of position in the DN
-(the RFC only requires it to be escaped when it is the first character), and
-'=', which the RFC indicates can be escaped with a backslash, but does not
-contain in its set of required escapes. If you are using Active Directory and
-these appear in your usernames, please ensure that they are escaped, in
-addition to being properly escaped in your configured DNs.
-
-For reference, see [RFC 4514](https://www.ietf.org/rfc/rfc4514.txt) and this
-[TechNet post on characters to escape in Active
-Directory](http://social.technet.microsoft.com/wiki/contents/articles/5312.active-directory-characters-to-escape.aspx).
-
-## Authentication
-
-### Via the CLI
-
-```shell-session
-$ vault login -method=ldap username=mitchellh
-Password (will be hidden):
-Successfully authenticated! The policies that are associated
-with this token are listed below:
-
-admins
-```
-
-### Via the API
-
-```shell-session
-$ curl \
-    --request POST \
-    --data '{"password": "foo"}' \
-    http://127.0.0.1:8200/v1/auth/ldap/login/mitchellh
-```
-
-The response will be in JSON. For example:
-
-```javascript
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": null,
-  "auth": {
-    "client_token": "c4f280f6-fdb2-18eb-89d3-589e2e834cdb",
-    "policies": [
-      "admins"
-    ],
-    "metadata": {
-      "username": "mitchellh"
-    },
-    "lease_duration": 0,
-    "renewable": false
-  }
-}
-```
-
-## Configuration
-
-Auth methods must be configured in advance before users or machines can
-authenticate. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the ldap auth method:
-
-   ```text
-   $ vault auth enable ldap
-   ```
-
-1. Configure connection details for your LDAP server, information on how to
-   authenticate users, and instructions on how to query for group membership. The
-   configuration options are categorized and detailed below.
-
-### Connection parameters
-
-- `url` (string, required) - The LDAP server to connect to. Examples: `ldap://ldap.myorg.com`, `ldaps://ldap.myorg.com:636`. This can also be a comma-delineated list of URLs, e.g. `ldap://ldap.myorg.com,ldaps://ldap.myorg.com:636`, in which case the servers will be tried in-order if there are errors during the connection process.
-- `starttls` (bool, optional) - If true, issues a `StartTLS` command after establishing an unencrypted connection.
-- `insecure_tls` - (bool, optional) - If true, skips LDAP server SSL certificate verification - insecure, use with caution!
-- `certificate` - (string, optional) - CA certificate to use when verifying LDAP server certificate, must be x509 PEM encoded.
-- `client_tls_cert` - (string, optional) - Client certificate to provide to the LDAP server, must be x509 PEM encoded.
-- `client_tls_key` - (string, optional) - Client certificate key to provide to the LDAP server, must be x509 PEM encoded.
-
-### Binding parameters
-
-There are two alternate methods of resolving the user object used to authenticate the end user: _Search_ or _User Principal Name_. When using _Search_, the bind can be either anonymous or authenticated. User Principal Name is a method of specifying users supported by Active Directory. More information on UPN can be found [here](<https://msdn.microsoft.com/en-us/library/ms677605(v=vs.85).aspx#userPrincipalName>).
-
-`userfilter` works with both authenticated and anonymous _Search_.
-In order for `userfilter` to apply for authenticated searches, `binddn` and `bindpass` must be set.
-For anonymous search, `discoverdn` must be set to `true`, and `deny_null_bind` must be set to false.
-
-#### Binding - authenticated search
-
-- `binddn` (string, optional) - Distinguished name of object to bind when performing user and group search. Example: `cn=vault,ou=Users,dc=example,dc=com`
-- `bindpass` (string, optional) - Password to use along with `binddn` when performing user search.
-- `userdn` (string, optional) - Base DN under which to perform user search. Example: `ou=Users,dc=example,dc=com`
-- `userattr` (string, optional) - Attribute on user attribute object matching the username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
-- `userfilter` (string, optional) - Go template used to construct a ldap user search filter. The template can access the following context variables: \[`UserAttr`, `Username`\]. The default userfilter is `({{.UserAttr}}={{.Username}})` or `(userPrincipalName={{.Username}}@UPNDomain)` if the `upndomain` parameter is set. The user search filter can be used to restrict what user can attempt to log in. For example, to limit login to users that are not contractors, you could write `(&(objectClass=user)({{.UserAttr}}={{.Username}})(!(employeeType=Contractor)))`.
-
-@include 'ldap-auth-userfilter-warning.mdx'
-
-#### Binding - anonymous search
-
-- `discoverdn` (bool, optional) - If true, use anonymous bind to discover the bind DN of a user
-- `userdn` (string, optional) - Base DN under which to perform user search. Example: `ou=Users,dc=example,dc=com`
-- `userattr` (string, optional) - Attribute on user attribute object matching the username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
-- `userfilter` (string, optional) - Go template used to construct a ldap user search filter. The template can access the following context variables: \[`UserAttr`, `Username`\]. The default userfilter is `({{.UserAttr}}={{.Username}})` or `(userPrincipalName={{.Username}}@UPNDomain)` if the `upndomain` parameter is set. The user search filter can be used to restrict what user can attempt to log in. For example, to limit login to users that are not contractors, you could write `(&(objectClass=user)({{.UserAttr}}={{.Username}})(!(employeeType=Contractor)))`.
-- `deny_null_bind` (bool, optional) - This option prevents users from bypassing authentication when providing an empty password. The default is `true`.
-- `anonymous_group_search` (bool, optional) - Use anonymous binds when performing LDAP group searches. Defaults to `false`.
-
-@include 'ldap-auth-userfilter-warning.mdx'
-
-#### Alias dereferencing
-
-- `dereference_aliases` (string, optional) - Control how aliases are dereferenced when performing the search. Possible values are: `never`, `finding`, `searching`, and `always`. `finding` will only dereference aliases during name resolution of the base. `searching` will dereference aliases after name resolution.
-
-#### Binding - user principal name (AD)
-
-- `upndomain` (string, optional) - userPrincipalDomain used to construct the UPN string for the authenticating user. The constructed UPN will appear as `[username]@UPNDomain`. Example: `example.com`, which will cause vault to bind as `username@example.com`.
-
-### Group membership resolution
-
-Once a user has been authenticated, the LDAP auth method must know how to resolve which groups the user is a member of. The configuration for this can vary depending on your LDAP server and your directory schema. There are two main strategies when resolving group membership - the first is searching for the authenticated user object and following an attribute to groups it is a member of. The second is to search for group objects of which the authenticated user is a member of. Both methods are supported.
-
-- `groupfilter` (string, optional) - Go template used when constructing the group membership query. The template can access the following context variables: \[`UserDN`, `Username`\]. The default is `(|(memberUid={{.Username}})(member={{.UserDN}})(uniqueMember={{.UserDN}}))`, which is compatible with several common directory schemas. To support nested group resolution for Active Directory, instead use the following query: `(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))`.
-- `groupdn` (string, required) - LDAP search base to use for group membership search. This can be the root containing either groups or users. Example: `ou=Groups,dc=example,dc=com`
-- `groupattr` (string, optional) - LDAP attribute to follow on objects returned by `groupfilter` in order to enumerate user group membership. Examples: for groupfilter queries returning _group_ objects, use: `cn`. For queries returning _user_ objects, use: `memberOf`. The default is `cn`.
-
-_Note_: When using _Authenticated Search_ for binding parameters (see above) the distinguished name defined for `binddn` is used for the group search. Otherwise, the authenticating user is used to perform the group search.
-
-Use `vault path-help` for more details.
-
-### Other
-
-- `username_as_alias` (bool, optional) - If set to true, forces the auth method to use the username passed by the user as the alias name.
-- `max_page_size` (int, optional) - If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control to request pages of up to the given size. This can be used to avoid hitting the LDAP server's maximum result size limit. Otherwise, the LDAP backend will not use the paged search control.
-
-## Examples:
-
-### Scenario 1
-
-- LDAP server running on `ldap.example.com`, port 389.
-- Server supports `STARTTLS` command to initiate encryption on the standard port.
-- CA Certificate stored in file named `ldap_ca_cert.pem`
-- Server is Active Directory supporting the userPrincipalName attribute. Users are identified as `username@example.com`.
-- Groups are nested, we will use `LDAP_MATCHING_RULE_IN_CHAIN` to walk the ancestry graph.
-- Group search will start under `ou=Groups,dc=example,dc=com`. For all group objects under that path, the `member` attribute will be checked for a match against the authenticated user.
-- Group names are identified using their `cn` attribute.
-
-```shell-session
-$ vault write auth/ldap/config \
-    url="ldap://ldap.example.com" \
-    userdn="ou=Users,dc=example,dc=com" \
-    groupdn="ou=Groups,dc=example,dc=com" \
-    groupfilter="(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))" \
-    groupattr="cn" \
-    upndomain="example.com" \
-    certificate=@ldap_ca_cert.pem \
-    insecure_tls=false \
-    starttls=true
-...
-```
-
-### Scenario 2
-
-- LDAP server running on `ldap.example.com`, port 389.
-- Server supports `STARTTLS` command to initiate encryption on the standard port.
-- CA Certificate stored in file named `ldap_ca_cert.pem`
-- Server does not allow anonymous binds for performing user search.
-- Bind account used for searching is `cn=vault,ou=users,dc=example,dc=com` with password `My$ecrt3tP4ss`.
-- User objects are under the `ou=Users,dc=example,dc=com` organizational unit.
-- Username passed to vault when authenticating maps to the `sAMAccountName` attribute.
-- Group membership will be resolved via the `memberOf` attribute of _user_ objects. That search will begin under `ou=Users,dc=example,dc=com`.
-
-```shell-session
-$ vault write auth/ldap/config \
-    url="ldap://ldap.example.com" \
-    userattr=sAMAccountName \
-    userdn="ou=Users,dc=example,dc=com" \
-    groupdn="ou=Users,dc=example,dc=com" \
-    groupfilter="(&(objectClass=person)(uid={{.Username}}))" \
-    groupattr="memberOf" \
-    binddn="cn=vault,ou=users,dc=example,dc=com" \
-    bindpass='My$ecrt3tP4ss' \
-    certificate=@ldap_ca_cert.pem \
-    insecure_tls=false \
-    starttls=true
-...
-```
-
-### Scenario 3
-
-- LDAP server running on `ldap.example.com`, port 636 (LDAPS)
-- CA Certificate stored in file named `ldap_ca_cert.pem`
-- User objects are under the `ou=Users,dc=example,dc=com` organizational unit.
-- Username passed to vault when authenticating maps to the `uid` attribute.
-- User bind DN will be auto-discovered using anonymous binding.
-- Group membership will be resolved via any one of `memberUid`, `member`, or `uniqueMember` attributes. That search will begin under `ou=Groups,dc=example,dc=com`.
-- Group names are identified using the `cn` attribute.
-
-```shell-session
-$ vault write auth/ldap/config \
-    url="ldaps://ldap.example.com" \
-    userattr="uid" \
-    userdn="ou=Users,dc=example,dc=com" \
-    discoverdn=true \
-    groupdn="ou=Groups,dc=example,dc=com" \
-    certificate=@ldap_ca_cert.pem \
-    insecure_tls=false \
-    starttls=true
-...
-```
-
-## LDAP group -> policy mapping
-
-Next we want to create a mapping from an LDAP group to a Vault policy:
-
-```shell-session
-$ vault write auth/ldap/groups/scientists policies=foo,bar
-```
-
-This maps the LDAP group "scientists" to the "foo" and "bar" Vault policies.
-We can also add specific LDAP users to additional (potentially non-LDAP)
-groups. Note that policies can also be specified on LDAP users as well.
-
-```shell-session
-$ vault write auth/ldap/groups/engineers policies=foobar
-$ vault write auth/ldap/users/tesla groups=engineers policies=zoobar
-```
-
-This adds the LDAP user "tesla" to the "engineers" group, which maps to
-the "foobar" Vault policy. User "tesla" itself is associated with "zoobar"
-policy.
-
-Finally, we can test this by authenticating:
-
-```shell-session
-$ vault login -method=ldap username=tesla
-Password (will be hidden):
-Successfully authenticated! The policies that are associated
-with this token are listed below:
-
-default, foobar, zoobar
-```
-
-## Note on policy mapping
-
-It should be noted that user -> policy mapping happens at token creation time. And changes in group membership on the LDAP server will not affect tokens that have already been provisioned. To see these changes, old tokens should be revoked and the user should be asked to reauthenticate.
-
-## User lockout
-
-@include 'user-lockout.mdx'
-
-## API
-
-The LDAP auth method has a full HTTP API. Please see the
-[LDAP auth method API](/vault/api-docs/auth/ldap) for more
-details.
diff --git a/website/content/docs/auth/login-mfa/faq.mdx b/website/content/docs/auth/login-mfa/faq.mdx
deleted file mode 100644
index 8c8e46698c3..00000000000
--- a/website/content/docs/auth/login-mfa/faq.mdx
+++ /dev/null
@@ -1,123 +0,0 @@
----
-layout: docs
-page_title: Login MFA FAQ
-description: An FAQ page to answer the most commonly asked questions about login mfa.
----
-
-# Login MFA FAQ
-
-This FAQ section contains frequently asked questions about the Login MFA feature.
-
-- [Q: What MFA features can I access if I upgrade to Vault version 1.10?](#q-what-mfa-features-can-i-access-if-i-upgrade-to-vault-version-1-10)
-- [Q: What are the various MFA workflows that are available to me as a Vault user as of Vault version 1.10, and how are they different?](#q-what-are-the-various-mfa-workflows-that-are-available-to-me-as-a-vault-user-as-of-vault-version-1-10-and-how-are-they-different)
-- [Q: What is the Legacy MFA feature?](#q-what-is-the-legacy-mfa-feature)
-- [Q: Will HCP Vault support MFA?](#q-will-hcp-vault-support-mfa)
-- [Q: What is Single-Phase MFA vs. Two-Phase MFA?](#q-what-is-single-phase-mfa-vs-two-phase-mfa)
-- [Q: Are there new MFA API endpoints introduced as part of the new Vault version 1.10 MFA for login functionality?](#q-are-there-new-mfa-api-endpoints-introduced-as-part-of-the-new-vault-version-1-10-mfa-for-login-functionality)
-- [Q: How do MFA configurations differ between the Login MFA and Step-up Enterprise MFA?](#q-how-do-mfa-configurations-differ-between-the-login-mfa-and-step-up-enterprise-mfa)
-- [Q: What are the ways to configure the various MFA workflows?](#q-what-are-the-ways-to-configure-the-various-mfa-workflows)
-- [Q: What MFA mechanism is used with the different MFA workflows in Vault version 1.10?](#q-which-mfa-mechanism-is-used-with-the-different-mfa-workflows-in-vault-version-1-10)
-- [Q: Are namespaces supported with the MFA workflows that Vault has as of Vault version 1.10?](#q-are-namespaces-supported-with-the-mfa-workflows-that-vault-has-as-of-vault-version-1-10)
-- [Q: I use the Vault Agent. Does MFA pose any challenges for me?](#q-i-use-the-vault-agent-does-mfa-pose-any-challenges-for-me)
-- [Q: I am a Step-up Enterprise MFA user using MFA for login. Should I migrate to the new Login MFA?](#q-i-am-a-step-up-enterprise-mfa-user-using-mfa-for-login-should-i-migrate-to-the-new-login-mfa)
-- [Q: I am a Step-up Enterprise MFA user using MFA for login. What are the steps to migrate to Login MFA?](#q-i-am-a-step-up-enterprise-mfa-user-using-mfa-for-login-what-are-the-steps-to-migrate-to-login-mfa)
-
-### Q: what MFA features can i access if i upgrade to Vault version 1.10?
-
-Vault supports Step-up Enterprise MFA as part of our Enterprise edition. The Step-up Enterprise MFA provides MFA on login, or for step-up access to sensitive resources in Vault using ACL and Sentinel policies, and is configurable through the CLI/API.
-
-Starting with Vault version 1.10, Vault Community Edition provides [MFA on login](/vault/docs/auth/login-mfa) only. This is also available with Vault Enterprise and configurable through the CLI/API.
-
-The Step-up Enterprise MFA will co-exist with the newly introduced Login MFA starting with Vault version 1.10.
-
-### Q: what are the various MFA workflows that are available to me as a Vault user as of Vault version 1.10, and how are they different?
-
-| MFA workflow                                   | What does it do?                                                                                                                                                                                                                                                                                    | Who manages the MFA?              | Community vs. Enterprise Support    |
-| ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | ----------------------------- |
-| [Login MFA](/vault/docs/auth/login-mfa)              | MFA in Vault Community Edition provides MFA on login. CLI, API, and UI-based login are supported.                                                                                                                                                                                                                 | MFA is managed by Vault           | Supported in Vault Community Edition        |
-| [Okta Auth MFA](/vault/docs/auth/okta#mfa)           | This is MFA as part of [Okta Auth method](/vault/docs/auth/okta) in Vault Community Edition, where MFA is enforced by Okta on login. MFA must be satisfied for authentication to be successful. This is different from the Okta MFA method used with Login MFA and Step-up Enterprise MFA. CLI/API login are supported. | MFA is managed externally by Okta | Supported in Vault Community Edition        |
-| [Step-up Enterprise MFA](/vault/docs/enterprise/mfa) | MFA in Vault Enterprise provides MFA for login and for step-up access to sensitive resources in Vault. Supports CLI/API based login, and ACL/Sentinel policies.                                                                                                                                     | MFA is managed by Vault           | Supported in Vault Enterprise |
-
-~> **Note**: [The Legacy MFA](/vault/docs/v1.10.x/auth/mfa) is a **deprecated** MFA workflow in Vault Community Edition. Refer [here](#q-what-is-the-legacy-mfa-feature) for more details.
-
-### Q: what is the legacy MFA feature?
-
-[Legacy MFA](/vault/docs/v1.10.x/auth/mfa) is functionality that was available in Vault Community Edition, prior to introducing MFA in the Enterprise version. This is now a deprecated feature. Please see the [Vault Feature Deprecation Notice and Plans](/vault/docs/deprecation) for detailed product plans around deprecated features. We plan to remove Legacy MFA in 1.11.
-
-### Q: will HCP Vault support MFA?
-
-Yes, HCP Vault will support MFA across all tiers and offering as part of the April 2022 release.
-
-### Q: what is Single-Phase MFA vs. Two-Phase MFA?
-
-- **Single-Phase MFA:** This is a single request mechanism where the required MFA information, such as MFA method ID, is provided via the X-Vault-MFA header in a single MFA request that is used to authenticate into Vault.
-
-~> **Note**: If the configured MFA methods need a passcode, it needs to be provided in the request, such as in the case of TOTP or Duo.
-If the configured MFA methods, such as PingID, Okta, or Duo, do not require a passcode and have out of band mechanisms for verifying the extra factor, Vault will send an inquiry to the other service's APIs to determine whether the MFA request has yet been verified.
-
-- **Two-Phase MFA:** This is a two-request MFA method that is more conventionally used.
-  - The MFA passcode required for the configured MFA method is not provided in a header of the login request that is MFA-restricted. Instead, the user first authenticates to the auth method, and on successful authentication to the auth method, an MFA requirement is returned to the user. The MFA requirement contains the MFA RequestID and constraints applicable to the MFA as configured by the operator.
-  - The user then must make a second request to the new endpoint `sys/mfa/validate`, providing the MFA RequestID in the request, and an MFA payload which includes the MFA methodIDs passcode (if applicable). If MFA validation passes, the new Vault token will be persisted and returned to the user in the response, just like a regular Vault token created using a non-MFA-restricted auth method.
-
-### Q: are there new MFA API endpoints introduced as part of the new Vault version 1.10 MFA for login functionality?
-
-Yes, this feature adds the following new MFA configuration endpoints: `identity/mfa/method`, `identity/mfa/login-enforcement`, and `sys/mfa/validate`. Refer to the [documentation](/vault/api-docs/secret/identity/mfa/duo) for more details.
-
-### Q: how do MFA configurations differ between the login MFA and step-up enterprise MFA?
-
-All MFA methods supported with the Step-up Enterprise MFA are supported with the Login MFA, but they use different API endpoints:
-
-- Step-up Enterprise MFA: `sys/mfa/method/:type/:/name`
-- Login MFA: `identity/mfa/method/:type`
-
-There are also two differences in how methods are defined in the two systems.
-The Step-up Enterprise MFA expects the method creator to specify a name for the method; Login MFA does not, and instead returns an ID when a method is created.
-The Step-up Enterprise MFA uses the combination of mount accessors plus a `username_format` template string, whereas in Login MFA, these are combined into a single field `username_format`, which uses the same identity [templating format](/vault/docs/concepts/policies#templated-policies) as used in policies.
-
-### Q: what are the ways to configure the various MFA workflows?
-
-| MFA workflow                                   | Configuration methods                                                                     | Details                                                                                                                                                                                                                                                                                     |
-| ---------------------------------------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [Login MFA](/vault/docs/auth/login-mfa)              | CLI/API. The UI does not support the configuration of Login MFA as of Vault version 1.10. | Configured using the `identity/mfa/method` endpoints, then passing those method IDs to the `identity/mfa/login-enforcement` endpoint. MFA methods supported: TOTP, Okta, Duo, PingID.                                                                                                       |
-| [Okta Auth MFA](/vault/docs/auth/okta)               | CLI/API                                                                                   | MFA methods supported: [TOTP](https://help.okta.com/en/prod/Content/Topics/Security/mfa-totp-seed.htm) , [Okta Verify Push](https://help.okta.com/en/prod/Content/Topics/Mobile/ov-admin-config.htm). |
-| [Step-up Enterprise MFA](/vault/docs/enterprise/mfa) | CLI/API                                                                                   | [Configured](/vault/api-docs/system/mfa) using the `sys/mfa/method` endpoints and by referencing those methods in policies. MFA Methods supported: TOTP, Okta, Duo, PingID                                                                                                                             |
-
-### Q: which MFA mechanism is used with the different MFA workflows in Vault version 1.10?
-
-| MFA workflow                                   | UI        | CLI/API                                                                                                                                   | Single-Phase                | Two-Phase                   |
-| ---------------------------------------------- | --------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | --------------------------- |
-| [Login MFA](/vault/docs/auth/login-mfa)              | Supported | Supported. You can select single-phase MFA by supplying the X-Vault-MFA header. In the absence of this header, the Two- Phase MFA is used | N/A                         | Supported                   |
-| [Okta Auth MFA](/vault/docs/auth/okta)               | N/A       | N/A                                                                                                                                       | MFA is not managed by Vault | MFA is not managed by Vault |
-| [Step-up Enterprise MFA](/vault/docs/enterprise/mfa) | N/A       | Supported                                                                                                                                 | Supported                   | N/A                         |
-
-### Q: are namespaces supported with the MFA workflows that Vault has as of Vault version 1.10?
-
-The Step-up Enterprise MFA configurations can only be configured in the root [namespace](/vault/docs/enterprise/mfa#namespaces), although they can be referenced in other namespaces via the policies.
-The Login MFA supports namespaces awareness. Users will need a Vault Enterprise license to user or configure Login MFA with namespaces. MFA method configurations can be defined per namespace with Login MFA, and used in enforcements defined in that namespace and its children. Everything operates in the root namespace in Vault Community Edition. MFA login enforcements can also be defined per namespace, and applied to that namespace and its children.
-
-### Q: i use the Vault agent. does MFA pose any challenges for me?
-
-The Vault Agent should not use MFA to authenticate to Vault; it should be able to relay requests with MFA-related headers to Vault successfully.
-
-### Q: i am a step-up enterprise MFA user using MFA for login. should i migrate to the new login MFA?
-
-If you are currently using Enterprise MFA, evaluate your MFA specific use cases to determine whether or not you should migrate to [Login MFA](/vault/docs/auth/login-mfa).
-
-Here are some considerations:
-
-- If you use the Step-up Enterprise MFA for login (with Sentinel EGP), you may find value in the simpler Login MFA workflow. We recommend that you to test this out to evaluate if this meets all your requirements.
-- If you use the Step-up Enterprise MFA for more than login, please be aware that the new MFA workflow only supports the login use case. You will still need to use the Step-up Enterprise MFA for non-login use cases.
-
-### Q: i am a step-up enterprise MFA user using MFA for login. what are the steps to migrate to login MFA?
-
-Refer to the question [Q: I am a Step-up Enterprise MFA user using MFA for login. Should I migrate to the new Login MFA?](#q-i-am-a-step-up-enterprise-mfa-user-using-mfa-for-login-should-i-migrate-to-the-new-login-mfa) to evaluate whether or not you should migrate.
-
-If you wish to migrate to Login MFA, follow these steps and guidelines to migrate successfully.
-
-1. First, create new MFA methods using the `identity/mfa/method` endpoints. These should mostly use the same fields as the MFA methods you defined using the `sys/mfa` method while keeping the following in mind:
-
-   -the new endpoints yield an ID instead of allowing you to define a name
-
-   -the new non-TOTP endpoints have a username_format field instead of username_format+mount_accessor fields; see [Templated Policies](/vault/docs/concepts/policies#templated-policies) for the username_format format.
-
-1. Instead of writing sentinel EGP rules to require that logins use MFA, use the `identity/mfa/login_enforcement` endpoint to specify the MFA methods.
diff --git a/website/content/docs/auth/login-mfa/index.mdx b/website/content/docs/auth/login-mfa/index.mdx
deleted file mode 100644
index 40a119008e7..00000000000
--- a/website/content/docs/auth/login-mfa/index.mdx
+++ /dev/null
@@ -1,236 +0,0 @@
----
-layout: docs
-page_title: Multi-Factor Authentication (MFA) for Login - Auth Methods
-description: |-
-  Multi-factor authentication (MFA) is supported for several authentication
-  methods.
----
-
-# Login MFA
-
-Vault supports Multi-factor Authentication (MFA) for authenticating to
-an auth method using different authentication types. We use the term `Login MFA` to distinguish
-this feature and the [Vault Enterprise MFA](/vault/docs/enterprise/mfa).
-Login MFA is built on top of the Identity system of Vault.
-
-## MFA types
-
-MFA in Vault includes the following login types:
-
-- `Time-based One-time Password (TOTP)` - If configured and enabled on a login path,
-  this would require a TOTP passcode along with a Vault token to be presented
-  while invoking the API login request. The passcode will be validated against the
-  TOTP key present in the caller's identify in Vault.
-
-- `Okta` - If Okta push is configured and enabled on a login path, then the enrolled
-  device of the user will receive a push notification to either approve or deny access
-  to the API. The Okta username will be derived from the caller identity's
-  alias.
-
-- `Duo` - If Duo push is configured and enabled on a login path, then the enrolled
-  device of the user will receive a push notification to either approve or deny access
-  to the API. The Duo username will be derived from the caller identity's
-  alias. Note that Duo could also be configured to use passcodes for authentication.
-
-- `PingID` - If PingID push is configured and enabled on a login path, the
-  enrolled device of the user will receive a push notification to either approve or deny
-  access to the API. The PingID username will be derived from the caller
-  identity's alias.
-
-## Login MFA procedure
-
-~> **NOTE:** Vault's built-in Login MFA feature does not protect against brute forcing of
-TOTP passcodes by default. We recommend that per-client [rate limits](/vault/docs/concepts/resource-quotas)
-are applied to the relevant login and/or mfa paths (e.g. `/sys/mfa/validate`). External MFA
-methods (`Duo`, `Ping` and `Okta`) may already provide configurable rate limiting. Rate limiting of
-Login MFA paths are enforced by default in Vault 1.10.1 and above.
-
-Login MFA can be configured to secure further authenticating to an auth method. To enable login
-MFA, an MFA method needs to be configured. Please see [Login MFA API](/vault/api-docs/secret/identity/mfa) for details
-on how to configure an MFA method. Once an MFA method is configured, an operator can configure an MFA enforcement using the returned unique MFA method ID.
-Please see [Login MFA Enforcement API](/vault/api-docs/secret/identity/mfa/login-enforcement)
-for details on how to configure an MFA enforcement config. MFA could be enforced for an entity, a group of
-entities, a specific auth method accessor, or an auth method type. A login request that matches
-any MFA enforcement restrictions is subject to further MFA validation,
-such as a one-time passcode, before being authenticated.
-
-There are two ways to validate a login request that is subject to MFA validation.
-
-### Single-Phase login
-
-In the Single-phase login, the required MFA information is embedded in a login request using
-the `X-Vault-MFA` header. In this case, the MFA validation is done
-as a part of the login request.
-
-MFA credentials are retrieved from the `X-Vault-MFA` HTTP header. Before Vault 1.13.0, the format of
-the header is `mfa_method_id[:passcode]` for TOTP, Okta, and PingID. However, for Duo, it is `mfa_method_id[:passcode=<passcode>]`.
-The item in the `[]` is optional. From Vault 1.13.0, the format is consistent for all supported MFA methods, and one can use either of the above two formats.
-If there are multiple MFA methods that need to be validated, a user can pass in multiple `X-Vault-MFA` HTTP headers.
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --header "X-Vault-MFA: d16fd3c2-50de-0b9b-eed3-0301dadeca10:695452" \
-    http://127.0.0.1:8200/v1/auth/userpass/login/alice
-```
-
-If an MFA method does not require a passcode, the login request MFA header only contains the method ID.
-
-```shell-session
- $ curl \
-     --header "X-Vault-Token: ..." \
-     --header "X-Vault-MFA: d16fd3c2-50de-0b9b-eed3-0301dadeca10" \
-     http://127.0.0.1:8200/v1/auth/userpass/login/alice
-```
-
-Starting in Vault 1.13.0, an operator can configure a name for an MFA method.
-This name should be unique in the namespace in which the MFA method is configured.
-The MFA method name can be used in the MFA header.
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --header "X-Vault-MFA: sample_mfa_method_name:695452" \
-    http://127.0.0.1:8200/v1/auth/userpass/login/alice
-```
-
-In cases where the MFA method is configured in a specific namespace, the MFA method name should be prefixed with the namespace path.
-Below shows an example where an MFA method is configured in `ns1`.
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --header "X-Vault-MFA: ns1/sample_mfa_method_name:695452" \
-    http://127.0.0.1:8200/v1/auth/userpass/login/alice
-```
-
-### Two-Phase login
-
-The more conventional and prevalent MFA method is a two-request mechanism, also referred to as Two-phase Login MFA.
-In Two-phase login, the `X-Vault-MFA` header is not provided in the request. In this case, after sending a regular login request,
-the user receives an auth response in which MFA requirements are included. MFA requirements contain an MFA request ID
-which identifies the login request that needs validation. In addition, MFA requirements contain MFA constraints
-that determine which MFA types should be used to validate the request, the corresponding method IDs, and
-a boolean value showing whether the MFA method uses passcodes or not. MFA constraints form a nested map in MFA Requirement
-and represent all MFA enforcements that match a login request. While the example below is for the userpass login,
-note that this can affect the login response on any auth mount protected by MFA validation.
-
-#### Sample Two-Phase login response
-
-```json
-{
-  "request_id": "1044c151-13ea-1cf5-f6ed-000c42efd477",
-  "lease_id": "",
-  "lease_duration": 0,
-  "renewable": false,
-  "data": null,
-  "warnings": [
-    "A login request was issued that is subject to MFA validation. Please make sure to validate the login by sending another request to mfa/validate endpoint."
-  ],
-  "auth": {
-    "client_token": "",
-    "accessor": "",
-    "policies": null,
-    "token_policies": null,
-    "identity_policies": null,
-    "metadata": null,
-    "orphan": false,
-    "entity_id": "",
-    "lease_duration": 0,
-    "renewable": false,
-    "mfa_requirement": {
-      "mfa_request_id": "d0c9eec7-6921-8cc0-be62-202b289ef163",
-      "mfa_constraints": {
-        "enforcementConfigUserpass": {
-          "any": [
-            {
-              "type": "totp",
-              "id": "820997b3-110e-c251-7e8b-ff4aa428a6e1",
-              "uses_passcode": true,
-              "name": "sample_mfa_method_name",
-            }
-          ]
-        }
-      }
-    }
-  }
-}
-```
-
-Note that the `uses_passcode` boolean value will always show true for TOTP, and false for Okta and PingID.
-For Duo method, the value can be configured as part of the method configuration, using the `use_passcode` parameter.
-Please see [Duo API](/vault/api-docs/secret/identity/mfa/duo) for details
-on how to configure the boolean value for Duo.
-
-To validate the MFA restricted login request, the user sends a second request to the [validate](/vault/api-docs/system/mfa/validate)
-endpoint including the MFA request ID and MFA payload. MFA payload contains a map of methodIDs and their associated credentials.
-If the configured MFA methods, such as PingID, Okta, and Duo, do not require a passcode, the associated
-credentials will be a list with one empty string.
-
-#### Sample payload
-
-```json
-{
-  "mfa_request_id": "5879c74a-1418-1948-7be9-97b209d693a7",
-  "mfa_payload": {
-    "d16fd3c2-50de-0b9b-eed3-0301dadeca10": ["910201"]
-  }
-}
-```
-
-If an MFA method is configured in a namespace, the MFA method name prefixed with the namespace path can be used in the validation payload.
-
-```json
-{
-  "mfa_request_id": "5879c74a-1418-1948-7be9-97b209d693a7",
-  "mfa_payload": {
-    "ns1/sample_mfa_method_name": ["910201"]
-  }
-}
-```
-
-#### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/mfa/validate
-```
-
-#### Sample CLI request
-
-A user is also able to use the CLI write command to validate the login request.
-
-```shell-session
-$ vault write sys/mfa/validate -format=json @payload.json
-```
-
-#### Interactive CLI for login MFA
-
-Vault supports an interactive way of authenticating to an auth method using CLI only if the
-login request is subject to a single MFA method validation. In this situation, if the MFA method
-is configured to use passcodes, after sending a regular login request, the user is prompted to
-insert the passcode. Upon successful MFA validation, a client token is returned.
-If the configured MFA methods, such as PingID, Okta, and Duo, do not require a passcode and have out of band
-mechanisms for verifying the extra factor, the user is notified to check their authenticator application.
-This alleviates a user from sending the second request separately to validate a login request.
-To disable the interactive login experience, a user needs to pass in the `non-interactive` flag to the login request.
-
-```shell-session
-$ vault write -non-interactive sys/mfa/validate -format=json @payload.json
-```
-
-To get started with Login MFA, refer to the [Login MFA](/vault/tutorials/auth-methods/multi-factor-authentication) tutorial.
-
-
-### TOTP passcode validation rate limit
-
-Rate limiting of Login MFA paths are enforced by default in Vault 1.10.1 and above.
-By default, Vault allows for 5 consecutive failed TOTP passcode validation.
-This value can also be configured by adding `max_validation_attempts` to the TOTP configuration.
-If the number of consecutive failed TOTP passcode validation exceeds the configured value, the user
-needs to wait until a fresh TOTP passcode is available.
diff --git a/website/content/docs/auth/oci.mdx b/website/content/docs/auth/oci.mdx
deleted file mode 100644
index c39cac704eb..00000000000
--- a/website/content/docs/auth/oci.mdx
+++ /dev/null
@@ -1,234 +0,0 @@
----
-layout: docs
-page_title: OCI Auth method
-description: >-
-  The OCI Auth method for Vault enables authentication and authorization using
-  OCI Identity credentials.
----
-
-# OCI auth method
-
-The OCI Auth method for Vault enables authentication and authorization using [OCI Identity](https://docs.cloud.oracle.com/iaas/Content/Identity/Concepts/overview.htm) credentials.
-
-This plugin is developed in a separate GitHub repository at https://github.com/hashicorp/vault-plugin-auth-oci,
-but is automatically bundled in Vault releases. Please file all feature requests, bugs, and pull requests
-specific to the OCI plugin under that repository.
-
-## OCI roles
-
-The OCI Auth method authorizes using roles, as shown here:
-![Role Based Authorization](/img/oci/oci-role-based-authz.png)
-
-There is a many-to-many relationship between various items seen above:
-
-- A user can belong to many identity groups.
-- An identity group can contain many users.
-- A compute instance can belong to many dynamic groups.
-- A dynamic group can contain many compute instances.
-- A role defined in Vault can be mapped to many groups and dynamic groups.
-- A single role can be mapped to both groups and dynamic groups.
-- A Vault policy can be mapped from different roles.
-
-The `ocid_list` field of a role is a list of [Group or Dynamic Group](https://docs.cloud.oracle.com/iaas/Content/Identity/Concepts/overview.htm#one) OCIDs. Only members of these Groups or Dynamic Groups are allowed to take this role.
-
-## Configuration
-
-### Configure the OCI tenancy to run Vault
-
-The OCI Auth method requires [instance principal](https://blogs.oracle.com/cloud-infrastructure/announcing-instance-principals-for-identity-and-access-management) credentials to call OCI Identity APIs, and therefore the Vault server needs to run inside an OCI compute instance.
-
-Follow the steps below to add policies to your tenancy that allow the OCI compute instance in which the Vault server is running to call certain OCI Identity APIs.
-
-1. In your tenancy, [launch the compute instance(s)](https://docs.cloud.oracle.com/iaas/Content/Compute/Tasks/launchinginstance.htm) that will run the Vault server. The [VCN](https://docs.cloud.oracle.com/iaas/Content/Network/Tasks/managingVCNs.htm) in which you launch the Compute Instance should have a [Service Gateway](https://docs.cloud.oracle.com/iaas/Content/Network/Tasks/servicegateway.htm) added to it .
-1. Make a note of the Oracle Cloud Identifier (OCID) of the compute instance(s) running Vault.
-1. In your tenancy, [create a dynamic group](https://docs.cloud.oracle.com/iaas/Content/Identity/Tasks/managingdynamicgroups.htm) with the name VaultDynamicGroup to contain the computer instance(s).
-1. Add the OCID of the compute instance(s) to the dynamic group.
-1. Add the following policies to the root compartment of your tenancy that allow the dynamic group to call specific Identity APIs.
-
-   ```plaintext
-   allow dynamic-group VaultDynamicGroup to {AUTHENTICATION_INSPECT} in tenancy
-   allow dynamic-group VaultDynamicGroup to {GROUP_MEMBERSHIP_INSPECT} in tenancy
-   ```
-
-### Configure the OCI auth method
-
-First, enable the OCI Auth method.
-
-```shell-session
-$ vault auth enable oci
-```
-
-Then, configure your home tenancy in the Vault, so that only users or instances from your tenancy will be allowed to log into Vault through the OCI Auth method. 
-  
-1. Create a file named `hometenancyid.json` with the below content using the
-   tenancy OCID. To find your tenancy OCID, see
-  the [Oracle Cloud IDs documentation](https://docs.cloud.oracle.com/iaas/Content/General/Concepts/identifiers.htm).
-
-   ```json
-   { "home_tenancy_id": "your tenancy ocid here" }
-   ```
-
-1. Configure the `home_tenancy_id` parameter in the Vault.
-
-   ```shell-session
-   $ curl --header "X-Vault-Token: $roottoken" --request POST \
-      --data @hometenancyid.json \
-      http://127.0.0.1:8200/v1/auth/oci/config (127.0.0.1:8200/v1/auth/oci/config)
-   ```
-
-Continue by creating a Vault administrator role in the OCI Auth method. The `vaultadminrole` allows the administrator of Vault to log into Vault and grants them the permissions allowed in the policy.
-
-1. Create a file named `vaultadminrole.json` with the below contents. Replace the `ocid_list` with the
-Group or Dynamic Group OCIDs in your tenancy that has users or instances that you want to take the Vault admin role.
-
-   - For testing in dev mode, you can add the OCID of the dynamic group previously created.
-   - In production, add only the OCID of groups and dynamic groups that can take the admin role in Vault.
-
-      ```json
-      {
-         "token_policies": "vaultadminpolicy",
-         "token_ttl": "1800",
-         "ocid_list": "ocid1.group.oc1..aaaaaaaaiqnblimpvmegkqh3bxilrdvjobr7qd223g275idcqhexamplefq,ocid1.dynamicgroup.oc1..aaaaaaaa5hmfyrdaxvmt52ekju5n7ffamn2pdvxaq6esb2vzzoduexamplea"
-      }
-      ```
-
-1. Create the Vault admin role:
-
-   ```shell-session
-   $ curl --header "X-Vault-Token: $roottoken" --request POST \
-      --data @vaultadminrole.json \
-      http://127.0.0.1:8200/v1/auth/oci/role/vaultadminrole (127.0.0.1:8200/v1/auth/oci/role/vaultadminrole)
-   ```
-
-### Log in to Vault using OCI auth
-
-As a result of both methods described below, you will get a response that includes a token with the previously added policy.
-
-You can use the received token to read or write secrets, and add roles per the instructions in [/docs/secrets/kv/kv-v1](/vault/docs/secrets/kv/kv-v1).
-
-For both methods to work:
-- The VAULT_ADDR export has to be specified, as shown earlier in this page; when testing in dev mode in the same compute instance that the Vault is running on, this is [http://127.0.0.1:8200](http://127.0.0.1:8200/).
-
-#### Log in with instance principals
-
-```shell-session
-$ vault login -method=oci auth_type=instance role=vaultadminrole
-```
-
-This assumes that the compute instance that you are logging in from should be a part of a dynamic group that was added to the Vault admin role. If logging on from a different compute instance than the one on which Vault is running on, the compute should have connectivity to the endpoint specified in VAULT_ADDR. 
-
-#### Log in with an API key
-
-```shell-session
-$ vault login -method=oci auth_type=apikey role=vaultadminrole
-```
-
-This assumes you have an OCI API key.
-
-If you don't have an API key:
-
-1. [Add an API Key](https://docs.cloud.oracle.com/iaas/Content/API/Concepts/apisigningkey.htm) for a user in the console. This user should be part of a group that has previously been added to the Vault admin role.
-1. Create the config file `~/.oci/config` using the user's credentials as detailed in [https://docs.cloud.oracle.com/iaas/Content/API/Concepts/sdkconfig.htm](https://docs.cloud.oracle.com/iaas/Content/API/Concepts/sdkconfig.htm).
-1. Ensure that the region in the config matches the region of the compute instance that is running Vault.
-
-
-### Manage roles in the OCI auth method
-
-1.  Similar to creating the Vault administrator role, create other roles mapped to other policies. Create a file named devrole.json with the following contents. Replace ocid_list with Groups or Dynamic Groups in your tenancy.
-
-   ```json
-   {
-   "token_policies": "devpolicy",
-   "token_ttl": "1500",
-   "ocid_list": "ocid1.group.oc1..aaaaaaaaiqnblimpvmgrouplrdvjobr7qd223g275idcqhexamplefq,ocid1.dynamicgroup.oc1..aaaaaaaa5hmfyrdaxvmdg2u5n7ffamn2pdvxaq6esb2vzzoduexamplea"
-   }
-   ```
-
-2.  Add the role.
-
-   ```shell-session
-   $ curl --header "X-Vault-Token: $token" --request POST \
-      --data @devrole.json \
-      http://127.0.0.1:8200/v1/auth/oci/role/devrole (127.0.0.1:8200/v1/auth/oci/role/devrole)
-   ```
-
-3.  Login to Vault assuming the devrole.
-
-   ```shell-session
-   $ vault login -method=oci auth_type=instance role=devrole
-   ```
-
-## Authentication
-
-You can authenticate with the Vault CLI or by communicating with the API directly.
-
-### Via the CLI
-
-With Compute Instance credentials:
-
-```shell-session
-$ vault login -method=oci auth_type=instance role=devrole
-```
-
-With User credentials ([SDK configuration](https://docs.cloud.oracle.com/iaas/Content/API/Concepts/sdkconfig.htm)):
-
-```shell-session
-$ vault login -method=oci auth_type=apikey role=devrole
-```
-
-### Via the API
-
-1.  Sign the following request with your OCI credentials and obtain the signing string and the authorization header. Replace the endpoint, scheme (http or https) & role of the URL corresponding to your Vault configuration. For more information on signing, see [signing the request](https://docs.cloud.oracle.com/iaas/Content/API/Concepts/signingrequests.htm).
-
-    http://127.0.0.1/v1/auth/oci/login/devrole
-
-1.  On signing the above request, you will get the following headers.
-
-   The signing string (line breaks inserted into the (request-target) header for easier reading):
-
-   <CodeBlockConfig hideClipboard>
-
-   ```text
-   date: Fri, 22 Aug 2019 21:02:19 GMT
-   (request-target): get /v1/auth/oci/login/devrole
-   host: 127.0.0.1
-   ```
-
-   </CodeBlockConfig>
-
-   The Authorization header:
-
-   <CodeBlockConfig hideClipboard>
-
-   ```text
-   Signature version="1",headers="date (request-target) host",keyId="ocid1.t
-   enancy.oc1..aaaaaaaaba3pv6wkcr4jqae5f15p2b2m2yt2j6rx32uzr4h25vqstifsfdsq/
-   ocid1.user.oc1..aaaaaaaat5nvwcna5j6aqzjcaty5eqbb6qt2jvpkanghtgdaqedqw3ryn
-   jq/73:61:a2:21:67:e0:df:be:7e:4b:93:1e:15:98:a5:b7",algorithm="rsa-sha256
-   ",signature="GBas7grhyrhSKHP6AVIj/h5/Vp8bd/peM79H9Wv8kjoaCivujVXlpbKLjMPe
-   DUhxkFIWtTtLBj3sUzaFj34XE6YZAHc9r2DmE4pMwOAy/kiITcZxa1oHPOeRheC0jP2dqbTll
-   8fmTZVwKZOKHYPtrLJIJQHJjNvxFWeHQjMaR7M="
-   ```
-
-   </CodeBlockConfig>
-
-1.  Add the signed headers to the "request_headers" field and make the actual request to Vault. For example:
-
-   <CodeBlockConfig hideClipboard>
-
-   ```sh
-   POST http://127.0.0.1/v1/auth/oci/login/devrole
-      "request_headers": {
-         "date": ["Fri, 22 Aug 2019 21:02:19 GMT"],
-         "(request-target)": ["get /v1/auth/oci/login/devrole"],
-         "host": ["127.0.0.1"],
-         "content-type": ["application/json"],
-         "authorization": ["Signature algorithm=\"rsa-sha256\",headers=\"date (request-target) host\",keyId=\"ocid1.tenancy.oc1..aaaaaaaaba3pv6wkcr4jqae5f15p2b2m2yt2j6rx32uzr4h25vqstifsfdsq/ocid1.user.oc1..aaaaaaaat5nvwcna5j6aqzjcaty5eqbb6qt2jvpkanghtgdaqedqw3rynjq/73:61:a2:21:67:e0:df:be:7e:4b:93:1e:15:98:a5:b7\",signature=\"GBas7grhyrhSKHP6AVIj/h5/Vp8bd/peM79H9Wv8kjoaCivujVXlpbKLjMPeDUhxkFIWtTtLBj3sUzaFj34XE6YZAHc9r2DmE4pMwOAy/kiITcZxa1oHPOeRheC0jP2dqbTll8fmTZVwKZOKHYPtrLJIJQHJjNvxFWeHQjMaR7M=\",version=\"1\""]
-      }
-   ```
-
-   </CodeBlockConfig>
-
-## API
-
-The OCI Auth method has a full HTTP API. Please see the [API docs](/vault/api-docs/auth/oci) for more details.
\ No newline at end of file
diff --git a/website/content/docs/auth/okta.mdx b/website/content/docs/auth/okta.mdx
deleted file mode 100644
index 798fac1c6a6..00000000000
--- a/website/content/docs/auth/okta.mdx
+++ /dev/null
@@ -1,153 +0,0 @@
----
-layout: docs
-page_title: Okta - Auth Methods
-description: |-
-  The Okta auth method allows users to authenticate with Vault using Okta
-  credentials.
----
-
-# Okta auth method
-
-The `okta` auth method allows authentication using Okta and user/password
-credentials. This allows Vault to be integrated into environments using Okta.
-
-The mapping of groups in Okta to Vault policies is managed by using the
-[users](/vault/api-docs/auth/okta#register-user) and [groups](/vault/api-docs/auth/okta#register-group)
-APIs.
-
-## Authentication
-
-### Via the CLI
-
-The default path is `/okta`. If this auth method was enabled at a different
-path, specify `-path=/my-path` in the CLI.
-
-```shell-session
-$ vault login -method=okta username=my-username
-```
-
-### Via the API
-
-The default endpoint is `auth/okta/login`. If this auth method was enabled
-at a different path, use that value instead of `okta`.
-
-```shell-session
-$ curl \
-    --request POST \
-    --data '{"password": "MY_PASSWORD"}' \
-    http://127.0.0.1:8200/v1/auth/okta/login/my-username
-```
-
-The response will contain a token at `auth.client_token`:
-
-```json
-{
-  "auth": {
-    "client_token": "abcd1234-7890...",
-    "policies": ["admins"],
-    "metadata": {
-      "username": "mitchellh"
-    }
-  }
-}
-```
-
-### MFA
-
-Okta Verify Push and TOTP MFA methods, and Google TOTP are supported during login. For TOTP, the current
-passcode may be provided via the `totp` parameter:
-
-```shell-session
-$ vault login -method=okta username=my-username totp=123456
-```
-
-If both Okta TOTP and Google TOTP are enabled in your Okta account, make sure to pass in
-the `provider` name to which the `totp` code belong.
-
-```shell-session
-$ vault login -method=okta username=my-username totp=123456 provider=GOOGLE
-```
-
-If `totp` is not set and MFA Push is configured in Okta, a Push will be sent during login.
-
-The auth method uses the Okta [Authentication API](https://developer.okta.com/docs/reference/api/authn/).
-It does not manage Okta [sessions](https://developer.okta.com/docs/reference/api/sessions/) for authenticated
-users. This means that if MFA Push is configured, it will be required during both login and token renewal.
-
-Note that this MFA support is integrated with Okta Auth and is limited strictly to login
-operations. It is not related to [Enterprise MFA](/vault/docs/enterprise/mfa).
-
-## Configuration
-
-Auth methods must be configured in advance before users or machines can
-authenticate. These steps are usually completed by an operator or configuration
-management tool.
-
-### Via the CLI
-
-1. Enable the Okta auth method:
-
-  ```shell-session
-  $ vault auth enable okta
-  ```
-
-1. Configure Vault to communicate with your Okta account:
-
-  ```shell-session
-  $ vault write auth/okta/config \
-     base_url="okta.com" \
-     org_name="dev-123456" \
-     api_token="00abcxyz..."
-  ```
-
-  -> **Note**: Support for okta auth with no API token is deprecated in Vault 1.4.
-  If no token is supplied, Vault will function, but only locally configured
-  group membership will be available. Without a token, groups will not be
-  queried.
-
-  For the complete list of configuration options, please see the
-  [API documentation](/vault/api-docs/auth/okta).
-
-1. Map an Okta group to a Vault policy:
-
-  ```shell-session
-  $ vault write auth/okta/groups/scientists policies=nuclear-reactor
-  ```
-
-  In this example, anyone who successfully authenticates via Okta who is a
-  member of the "scientists" group will receive a Vault token with the
-  "nuclear-reactor" policy attached.
-
-1. It is also possible to add users directly:
-
-  ```shell-session
-  $ vault write auth/okta/groups/engineers policies=autopilot
-  $ vault write auth/okta/users/tesla groups=engineers
-  ```
-
-  This adds the Okta user "tesla" to the "engineers" group, which maps to
-  the "autopilot" Vault policy.
-
-  -> **Note**: The user-policy mapping via group membership happens at token _creation
-  time_. Any changes in group membership in Okta will not affect existing
-  tokens that have already been provisioned. To see these changes, users
-  will need to re-authenticate. You can force this by revoking the
-  existing tokens.
-
-### Okta API token permissions
-
-The `okta` auth method uses the [Authentication](https://developer.okta.com/docs/reference/api/authn/)
-and [User Groups](https://developer.okta.com/docs/reference/api/users/#get-user-s-groups)
-APIs to authenticate users and obtain their group membership. The [`api_token`](/vault/api-docs/auth/okta#api_token)
-provided to the auth method's configuration must have sufficient privileges to exercise
-these Okta APIs.
-
-It is recommended to configure the auth method with a minimally permissive API token.
-To do so, create the API token using an administrator with the standard
-[Read-only Admin](https://help.okta.com/en/prod/Content/Topics/Security/administrators-read-only-admin.htm)
-role. Custom roles may also be used to grant minimal permissions to the Okta API token.
-
-## API
-
-The Okta auth method has a full HTTP API. Please see the
-[Okta Auth API](/vault/api-docs/auth/okta) for more details.
diff --git a/website/content/docs/auth/radius.mdx b/website/content/docs/auth/radius.mdx
deleted file mode 100644
index f535cf588e6..00000000000
--- a/website/content/docs/auth/radius.mdx
+++ /dev/null
@@ -1,82 +0,0 @@
----
-layout: docs
-page_title: RADIUS - Auth Methods
-description: |-
-  The "radius" auth method allows users to authenticate with Vault using an
-  existing RADIUS server.
----
-
-# RADIUS auth method
-
-The `radius` auth method allows users to authenticate with Vault using an
-existing RADIUS server that accepts the PAP authentication scheme.
-
-## Authentication
-
-The default path is `/radius`. If this auth method was enabled at a different
-path, specify `-path=/my-path` in the CLI.
-
-### Via the CLI
-
-```shell-session
-$ vault login -method=radius username=sethvargo
-```
-
-### Via the API
-
-The default endpoint is `auth/radius/login`. If this auth method was enabled
-at a different path, use that value instead of `radius`.
-
-```shell-session
-$ curl \
-    --request POST \
-    --data '{"password": "..."}' \
-    http://127.0.0.1:8200/v1/auth/radius/login/sethvargo
-```
-
-The response will contain a token at `auth.client_token`:
-
-```json
-{
-  "auth": {
-    "client_token": "c4f280f6-fdb2-18eb-89d3-589e2e834cdb",
-    "policies": ["admins"],
-    "metadata": {
-      "username": "mitchellh"
-    }
-  }
-}
-```
-
-## Configuration
-
-### Via the CLI
-
-1. Enable the radius auth method:
-
-   ```text
-   $ vault auth enable radius
-   ```
-
-1. Configure connection details for your RADIUS server.
-
-   ```text
-   $ vault write auth/radius/users/mitchellh policies=admins
-   ```
-
-   For the complete list of configuration options, please see the API
-   documentation.
-
-   The above creates a new mapping for user "mitchellh" that will be associated
-   with the "admins" policy.
-
-   Alternatively, Vault can assign a configurable set of policies to any user
-   that successfully authenticates with the RADIUS server but has no explicit
-   mapping in the `users/` path. This is done through the
-   `unregistered_user_policies` configuration parameter.
-
-## API
-
-The RADIUS auth method has a full HTTP API. Please see the
-[RADIUS Auth API](/vault/api-docs/auth/radius) for more
-details.
diff --git a/website/content/docs/auth/saml.mdx b/website/content/docs/auth/saml.mdx
deleted file mode 100644
index 0843f783d24..00000000000
--- a/website/content/docs/auth/saml.mdx
+++ /dev/null
@@ -1,181 +0,0 @@
----
-layout: docs
-page_title: SAML - Auth Methods
-description: >-
-  The "saml" auth method allows users to authenticate with Vault using their
-  identity in a SAML identity provider.
----
-
-# SAML auth method
-
-<EnterpriseAlert />
-
-The `saml` auth method allows users to authentication with Vault using their identity
-within a [SAML V2.0](https://saml.xml.org/saml-specifications) identity provider.
-Authentication is suited for human users by requiring interaction with a web browser.
-
-## Authentication
-
-<Tabs>
-
-<Tab heading="Vault CLI">
-
-The CLI login defaults to the `/saml` path. If this auth method was enabled at a
-different path, specify `-path=/my-path` in the CLI.
-
-```shell-session
-$ vault login -method=saml role=admin
-
-Complete the login via your SAML provider. Launching browser to:
-
-    https://company.okta.com/app/vault/abc123eb9xnIfzlaf697/sso/saml?SAMLRequest=fJI9b9swEIZ3%2FwqBu0SJ%2FpBDRAZce4iBtDViN0MX40Sda...
-```
-
-The CLI opens the default browser to the generated URL where users must authenticate
-with the configured SAML identity provider. The URL may be manually entered into the
-browser if it cannot be automatically opened.
-
-The CLI login behavior may be customized with the following optional parameters:
-
-- `skip_browser` (default: `false`): If set to `true`, automatic launching of the default
-  browser will be skipped. The SAML identity provider URL must be manually entered in a
-  browser to complete the authentication flow.
-- `abort_on_error` (default: `false`): If set to `true`, the CLI returns an error and
-  exits with a non-zero value if it cannot launch the default browser.
-
-</Tab>
-
-<Tab heading="Vault UI">
-
-1. Select "SAML" from the "Method" select box.
-1. Enter a role name for the "Role" field or leave blank to use
-   the [default role](/vault/api-docs/auth/saml#default_role).
-1. Press **Sign in with SAML Provider** and complete the authentication with the
-   configured SAML identity provider.
-
-</Tab>
-
-</Tabs>
-
-## Configuration
-
-Auth methods must be configured in advance before users or machines can
-authenticate. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the SAML authentication method with the `auth enable` CLI command:
-
-   ```shell-session
-   $ vault auth enable saml
-   ```
-
-1. Use the `/config` endpoint to save the configuration of your SAML identity provider and
-   set the default role. You can configure the trust relationship with the SAML Identity
-   Provider by either providing a URL for its Metadata document:
-
-   ```shell-session
-   $ vault write auth/saml/config \
-      default_role="admin" \
-      idp_metadata_url="https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml/metadata" \
-      entity_id="https://my.vault/v1/auth/saml" \
-      acs_urls="https://my.vault/v1/auth/saml/callback"
-   ```
-
-   or by setting the configuration Metadata manually:
-
-   ```shell-session
-   $ vault write auth/saml/config \
-      default_role="admin" \
-      idp_sso_url="https://company.okta.com/app/abc123eb9xnIfzlaf697/sso/saml" \
-      idp_entity_id="https://www.okta.com/abc123eb9xnIfzlaf697" \
-      idp_cert="@path/to/cert.pem" \
-      entity_id="https://my.vault/v1/auth/saml" \
-      acs_urls="https://my.vault/v1/auth/saml/callback"
-   ```
-
-1. Create a named role:
-
-   ```shell-session
-   $ vault write auth/saml/role/admin \
-       bound_subjects="*@hashicorp.com" \
-       bound_subjects_type="glob" \
-       token_policies="writer" \
-       bound_attributes=group="admin" \
-       ttl="1h"
-   ```
-
-   This role authorizes users that have a subject with an `@hashicorp.com` suffix and
-   are in the `admin` group to authenticate. It also gives the resulting Vault token a
-   time-to-live of 1 hour and the `writer` policy.
-
-Refer to the SAML [API documentation](/vault/api-docs/auth/saml) for a
-complete list of configuration options.
-
-### Assertion consumer service URLs
-
-The [`acs_urls`](/vault/api-docs/auth/saml#acs_urls) configuration parameter determines
-where the SAML response will be sent after users authenticate with the configured SAML
-identity provider in their browser.
-
-The values provided to Vault must:
-
-- Match or be a subset of the configured values for the SAML application within the
-  configured identity provider.
-- Be directed to the auth method's [assertion consumer service
-  callback](/vault/api-docs/auth/saml#assertion-consumer-service-callback) API.
-
-<Note>
-  It is highly recommended and enforced by some identity providers to TLS-protect the
-  assertion consumer service URLs. A warning will be returned from Vault if any of the
-  configured assertion consumer service URLs are not protected by TLS.
-</Note>
-
-#### Configuration for replication
-
-To support a single auth method mount being used across Vault [replication](/vault/docs/enterprise/replication)
-clusters, `acs_urls` supports configuration of multiple values. For example, to support
-SAML authentication on a primary and secondary Vault cluster, the following `acs_urls`
-configuration could be given:
-
-   ```shell-session
-   $ vault write auth/saml/config \
-      acs_urls="https://primary.vault/v1/auth/saml/callback,https://secondary.vault/v1/auth/saml/callback"
-   ```
-
-The Vault UI and CLI will automatically request the proper assertion consumer service URL
-for the cluster they're configured to communicate with. This means that the entirety of the
-authentication flow will stay within the targeted cluster.
-
-#### Configuration for namespaces
-
-The SAML auth method can be used within Vault [namespaces](/vault/docs/enterprise/namespaces).
-The assertion consumer service URLs configured in both Vault and the identity provider must
-include the namespace path segment.
-
-The following table provides assertion consumer service URLs given different namespace paths:
-
-| Namespace path  | Assertion consumer service URL                        |
-|-----------------|-------------------------------------------------------|
-| `admin/`        | `https://my.vault/v1/admin/auth/saml/callback`        |
-| `org/security/` | `https://my.vault/v1/org/security/auth/saml/callback` |
-
-### Bound attributes
-
-Once the user has been authenticated the authorization flow will validate
-that both the [`bound_subjects`](/vault/api-docs/auth/saml#bound_subjects) and
-[`bound_attributes`](/vault/api-docs/auth/saml#bound_attributes) match expected
-values configured for the role. This can be used to restrict access to Vault for
-a subset of users in the SAML identity provider.
-
-For example, a role with `bound_subjects=*@hashicorp.com` and
-`bound_attributes=groups=support,engineering` will only authorize users whose subject has
-an `@hashicorp.com` suffix and that are in either the `support` or `engineering` group.
-
-Whether it should be an exact match or interpret `*` as a wildcard can be
-controlled by the [`bound_subjects_type`](/vault/api-docs/auth/saml#bound_subjects_type) and
-[`bound_attributes_type`](/vault/api-docs/auth/saml#bound_attributes_type) parameters.
-
-## API
-
-The SAML authentication plugin has a full HTTP API. Refer to the
-[SAML API documentation](/vault/api-docs/auth/saml) for more details.
diff --git a/website/content/docs/auth/token.mdx b/website/content/docs/auth/token.mdx
deleted file mode 100644
index f00a6455e06..00000000000
--- a/website/content/docs/auth/token.mdx
+++ /dev/null
@@ -1,40 +0,0 @@
----
-layout: docs
-page_title: Token - Auth Methods
-description: The token store auth method is used to authenticate using tokens.
----
-
-# Token auth method
-
-The `token` auth method is built-in and automatically available at `/auth/token`. It
-allows users to authenticate using a token, as well to create new tokens, revoke
-secrets by token, and more.
-
-When any other auth method returns an identity, Vault core invokes the
-token method to create a new unique token for that identity.
-
-The token store can also be used to bypass any other auth method:
-you can create tokens directly, as well as perform a variety of other
-operations on tokens such as renewal and revocation.
-
-Please see the [token concepts](/vault/docs/concepts/tokens) page dedicated
-to tokens.
-
-## Authentication
-
-### Via the CLI
-
-```shell-session
-$ vault login token=<token>
-```
-
-### Via the API
-
-The token is set directly as a header for the HTTP API. The header should be
-either `X-Vault-Token: <token>` or `Authorization: Bearer <token>`.
-
-## API
-
-The Token auth method has a full HTTP API. Please see the
-[Token auth method API](/vault/api-docs/auth/token) for more
-details.
diff --git a/website/content/docs/auth/userpass.mdx b/website/content/docs/auth/userpass.mdx
deleted file mode 100644
index 0cd10c63d9f..00000000000
--- a/website/content/docs/auth/userpass.mdx
+++ /dev/null
@@ -1,97 +0,0 @@
----
-layout: docs
-page_title: Userpass - Auth Methods
-description: >-
-  The "userpass" auth method allows users to authenticate with Vault using a
-  username and password.
----
-
-# Userpass auth method
-
-The `userpass` auth method allows users to authenticate with Vault using
-a username and password combination.
-
-The username/password combinations are configured directly to the auth
-method using the `users/` path. This method cannot read usernames and
-passwords from an external source.
-
-The method lowercases all submitted usernames, e.g. `Mary` and `mary` are the
-same entry.
-
-## Authentication
-
-### Via the CLI
-
-```shell-session
-$ vault login -method=userpass \
-    username=mitchellh \
-    password=foo
-```
-
-### Via the API
-
-```shell-session
-$ curl \
-    --request POST \
-    --data '{"password": "foo"}' \
-    http://127.0.0.1:8200/v1/auth/userpass/login/mitchellh
-```
-
-The response will contain the token at `auth.client_token`:
-
-```json
-{
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": null,
-  "auth": {
-    "client_token": "c4f280f6-fdb2-18eb-89d3-589e2e834cdb",
-    "policies": ["admins"],
-    "metadata": {
-      "username": "mitchellh"
-    },
-    "lease_duration": 0,
-    "renewable": false
-  }
-}
-```
-
-## Configuration
-
-Auth methods must be configured in advance before users or machines can
-authenticate. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the userpass auth method:
-
-   ```shell-session
-   $ vault auth enable userpass
-   ```
-
-   This enables the userpass auth method at `auth/userpass`. To enable it at a different path, use the `-path` flag:
-
-   ```shell-session
-   $ vault auth enable -path=<path> userpass
-   ```
-
-1. Configure it with users that are allowed to authenticate:
-
-   ```shell-session
-   $ vault write auth/<userpass:path>/users/mitchellh \
-       password=foo \
-       policies=admins
-   ```
-
-   This creates a new user "mitchellh" with the password "foo" that will be
-   associated with the "admins" policy. This is the only configuration
-   necessary.
-
-## User lockout
-
-@include 'user-lockout.mdx'
-
-## API
-
-The Userpass auth method has a full HTTP API. Please see the [Userpass auth
-method API](/vault/api-docs/auth/userpass) for more details.
diff --git a/website/content/docs/browser-support.mdx b/website/content/docs/browser-support.mdx
deleted file mode 100644
index 0d5e36127cc..00000000000
--- a/website/content/docs/browser-support.mdx
+++ /dev/null
@@ -1,20 +0,0 @@
----
-layout: docs
-page_title: Browser Support
-sidebar_title: Browser Support
-description: |-
-  List of browser suppport.
----
-
-# Vault UI browser support
-
-Vault currently supports all 'evergreen' and updated browsers. the following browsers are supported:
-
-- Chrome
-- Firefox
-- Safari
-- Microsoft Edge
-
-!> **Warning**: Using an unsupported browser such as Internet Explorer 11 (IE 11) may cause degradation in feature functionality, and in some cases, Vault features may not operate. We encourage using one of the supported browsers listed for Vault UI.
-
-Please note that HashiCorp, in alignment with Microsoft's stance on IE 11, no longer supports Internet Explorer 11 (IE 11). For further information on IE 11, please reference Microsoft's [support site](https://docs.microsoft.com/en-US/lifecycle/faq/internet-explorer-microsoft-edge).
diff --git a/website/content/docs/commands/agent.mdx b/website/content/docs/commands/agent.mdx
deleted file mode 100644
index 4888316c3b2..00000000000
--- a/website/content/docs/commands/agent.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
----
-layout: docs
-page_title: agent - Command
-description: The "agent" command is used to start Vault Agent
----
-
-# agent
-
-Please see the [Vault Agent documentation page](/vault/docs/agent-and-proxy/agent).
diff --git a/website/content/docs/commands/audit/disable.mdx b/website/content/docs/commands/audit/disable.mdx
deleted file mode 100644
index 7950fbc6266..00000000000
--- a/website/content/docs/commands/audit/disable.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
----
-layout: docs
-page_title: audit disable - Command
-description: |-
-  The "audit disable" command disables an audit device at a given path, if one
-  exists. This command is idempotent, meaning it succeeds even if no audit
-  device is enabled at the path.
----
-
-# audit disable
-
-The `audit disable` command disables an audit device at a given path, if one
-exists. This command is idempotent, meaning it succeeds even if no audit device
-is enabled at the path.
-
-Once an audit device is disabled, no future audit logs are dispatched to it. The
-data associated with the audit device is unaffected. For example, if you
-disabled an audit device that was logging to a file, the file would still exist
-and have stored contents.
-
-~> Note: Once an audit device is disabled, you will no longer be able to HMAC values
-for comparison with entries in the audit logs. This is true even if you re-enable
-the audit device at the same path, as a new salt will be created for hashing.
-
-## Examples
-
-Disable the audit device enabled at "file/":
-
-```shell-session
-$ vault audit disable file/
-Success! Disabled audit device (if it was enabled) at: file/
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/audit/enable.mdx b/website/content/docs/commands/audit/enable.mdx
deleted file mode 100644
index 0d459febaf6..00000000000
--- a/website/content/docs/commands/audit/enable.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
----
-layout: docs
-page_title: audit enable - Command
-description: The "audit enable" command enables an audit device at a given path.
----
-
-# audit enable
-
-The `audit enable` command enables an audit device at a given path. If an audit
-device already exists at the given path, an error is returned. Additional
-options for configuring the audit device are provided as `KEY=VALUE`. Each audit
-device declares its own set of configuration options.
-
-Once an audit device is enabled, almost every request and response will be
-logged to the device.
-
-## Examples
-
-Enable the audit device "file" enabled at "file/":
-
-```shell-session
-$ vault audit enable file file_path=/tmp/my-file.txt
-Success! Enabled the file audit device at: file/
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-- `-description` `(string: "")` - Human-friendly description for the purpose of
-  this audit device.
-
-- `-local` `(bool: false)` - Mark the audit device as a local-only device.
-  Local devices are not replicated or removed by replication.
-
-- `-path` `(string: "")` - Place where the audit device will be accessible. This
-  must be unique across all audit devices. This defaults to the "type" of the
-  audit device.
-
-All audit devices support the following common options which can be supplied after
-the flags documented above:
-
-@include 'audit-options-common.mdx'
-
-For device specific options, refer to the relevant audit device type under the [Audit Devices](/vault/docs/audit)
-overview.
diff --git a/website/content/docs/commands/audit/index.mdx b/website/content/docs/commands/audit/index.mdx
deleted file mode 100644
index 40c7297bafd..00000000000
--- a/website/content/docs/commands/audit/index.mdx
+++ /dev/null
@@ -1,60 +0,0 @@
----
-layout: docs
-page_title: audit - Command
-description: |-
-  The "audit" command groups subcommands for interacting with Vault's audit
-  devices. Users can list, enable, and disable audit devices.
----
-
-# audit
-
-The `audit` command groups subcommands for interacting with Vault's audit
-devices. Users can list, enable, and disable audit devices.
-
-For more information, please see the [audit device
-documentation](/vault/docs/audit)
-
-## Examples
-
-Enable an audit device:
-
-```shell-session
-$ vault audit enable file file_path=/tmp/my-file.txt
-Success! Enabled the file audit device at: file/
-```
-
-List all audit devices:
-
-```shell-session
-$ vault audit list
-Path     Type    Description
-----     ----    -----------
-file/    file    n/a
-```
-
-Disable an audit device:
-
-```shell-session
-$ vault audit disable file/
-Success! Disabled audit device (if it was enabled) at: file/
-```
-
-~> Note: Once an audit device is disabled, you will no longer be able to HMAC values
-for comparison with entries in the audit logs. This is true even if you re-enable
-the audit device at the same path, as a new salt will be created for hashing.
-
-## Usage
-
-```text
-Usage: vault audit <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    disable    Disables an audit device
-    enable     Enables an audit device
-    list       Lists enabled audit devices
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/audit/list.mdx b/website/content/docs/commands/audit/list.mdx
deleted file mode 100644
index 80d595572a9..00000000000
--- a/website/content/docs/commands/audit/list.mdx
+++ /dev/null
@@ -1,48 +0,0 @@
----
-layout: docs
-page_title: audit list - Command
-description: |-
-  The "audit list" command lists the audit devices enabled. The output lists the
-  enabled audit devices and options for those devices.
----
-
-# audit list
-
-The `audit list` command lists the audit devices enabled. The output lists the
-enabled audit devices and options for those devices.
-
-## Examples
-
-List all audit devices:
-
-```shell-session
-$ vault audit list
-Path     Type    Description
-----     ----    -----------
-file/    file    n/a
-```
-
-List detailed audit device information:
-
-```shell-session
-$ vault audit list -detailed
-Path     Type    Description    Replication    Options
-----     ----    -----------    -----------    -------
-file/    file    n/a            replicated     file_path=/var/log/audit.log
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-detailed` `(bool: false)` - Print detailed information such as options and
-  replication status about each auth device.
diff --git a/website/content/docs/commands/auth/disable.mdx b/website/content/docs/commands/auth/disable.mdx
deleted file mode 100644
index fd451aa4652..00000000000
--- a/website/content/docs/commands/auth/disable.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
----
-layout: docs
-page_title: auth disable - Command
-description: |-
-  The "auth disable" command disables an auth method at a given path, if one
-  exists. This command is idempotent, meaning it succeeds even if no auth method
-  is enabled at the path.
----
-
-# auth disable
-
-The `auth disable` command disables an auth method at a given path, if one
-exists. This command is idempotent, meaning it succeeds even if no auth method
-is enabled at the path.
-
-Once an auth method is disabled, it can no longer be used for authentication.
-**All access tokens generated via the disabled auth method are immediately
-revoked.** This command will block until all tokens are revoked.
-
-## Examples
-
-Disable the auth method enabled at "userpass/":
-
-```shell-session
-$ vault auth disable userpass/
-Success! Disabled the auth method (if it existed) at: userpass/
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/auth/enable.mdx b/website/content/docs/commands/auth/enable.mdx
deleted file mode 100644
index f19c418d080..00000000000
--- a/website/content/docs/commands/auth/enable.mdx
+++ /dev/null
@@ -1,94 +0,0 @@
----
-layout: docs
-page_title: auth enable - Command
-description: |-
-  The "auth enable" command enables an auth method at a given path. If an auth
-  method already exists at the given path, an error is returned. After the auth
-  method is enabled, it usually needs configuration.
----
-
-# auth enable
-
-The `auth enable` command enables an auth method at a given path. If an auth
-method already exists at the given path, an error is returned. After the auth
-method is enabled, it usually needs configuration. The configuration varies by
-auth method.
-
-An auth method is responsible for authenticating users or machines and assigning
-them policies and a token with which they can access Vault. Authentication is
-usually mapped to policy. Please see the [policies
-concepts](/vault/docs/concepts/policies) page for more information.
-
-## Examples
-
-Enable the auth method "userpass" enabled at "userpass/":
-
-```shell-session
-$ vault auth enable userpass
-Success! Enabled the userpass auth method at: userpass/
-```
-
-Create a user:
-
-```shell-session
-$ vault write auth/userpass/users/sethvargo password=secret
-Success! Data written to: auth/userpass/users/sethvargo
-```
-
-For more information on the specific configuration options and paths, please see
-the [auth method](/vault/docs/auth) documentation.
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-- `-audit-non-hmac-request-keys` `(string: "")` - Key that will not be HMAC'd
-  by audit devices in the request data object. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-  An example of this is provided in the [tune section](/vault/docs/commands/auth/tune).
-
-- `-audit-non-hmac-response-keys` `(string: "")` - Key that will not be HMAC'd
-  by audit devices in the response data object. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-default-lease-ttl` `(duration: "")` - The default lease TTL for this auth
-  method. If unspecified, this defaults to the Vault server's globally
-  configured default lease TTL, or a previously configured value for the auth
-  method. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `-passthrough-request-headers` `(string: "")` - request header values that will
-  be sent to the auth method. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-allowed-response-headers` `(string: "")` - response header values that the auth
-  method will be allowed to set. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-description` `(string: "")` - Human-friendly description for the purpose of
-  this auth method.
-
-- `-listing-visibility` `(string: "")` - The flag to toggle whether to show the
-  mount in the UI-specific listing endpoint. Valid values are `"unauth"` or `"hidden"`,
-  with the default `""` being equivalent to `"hidden"`.
-
-
-- `-local` `(bool: false)` - Mark the auth method as local-only. Local auth
-  methods are not replicated nor removed by replication.
-
-- `-max-lease-ttl` `(string: "")` - The maximum lease duration, specified as
-  a string duration like "5s" or "30m".
-
-- `-path` `(string: "")` - Place where the auth method will be accessible. This
-  must be unique across all auth methods. This defaults to the "type" of the
-  auth method. The auth method will be accessible at `/auth/<path>`.
-
-- `-seal-wrap` `(bool: false)` - Enable seal wrapping for the mount, causing
-  values stored by the mount to be wrapped by the seal's encryption capability.
-
-- `-token-type` `(string: "")` - Specifies the type of tokens that should be
-  returned by the auth method.
-
-- `-plugin-version` `(string: "")` - Configures the semantic version of the plugin
-  to use. If unspecified, implies the built-in or any matching unversioned plugin
-  that may have been registered.
diff --git a/website/content/docs/commands/auth/help.mdx b/website/content/docs/commands/auth/help.mdx
deleted file mode 100644
index 3bb4adb736b..00000000000
--- a/website/content/docs/commands/auth/help.mdx
+++ /dev/null
@@ -1,43 +0,0 @@
----
-layout: docs
-page_title: auth help - Command
-description: The "auth help" command prints usage and help for an auth method.
----
-
-# auth help
-
-The `auth help` command prints usage and help for an auth method.
-
-- If given a TYPE, this command prints the default help for the auth method of
-  that type.
-
-- If given a PATH, this command prints the help output for the auth method
-  enabled at that path. This path must already exist.
-
-Each auth method produces its own help output.
-
-## Examples
-
-Get usage instructions for the userpass auth method:
-
-```shell-session
-$ vault auth help userpass
-Usage: vault login -method=userpass [CONFIG K=V...]
-
-  The userpass auth method allows users to authenticate using Vault's
-  internal user database.
-
-# ...
-```
-
-Print usage for the auth method enabled at my-method/
-
-```shell-session
-$ vault auth help my-method/
-# ...
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/auth/index.mdx b/website/content/docs/commands/auth/index.mdx
deleted file mode 100644
index 5e7d73a7bc2..00000000000
--- a/website/content/docs/commands/auth/index.mdx
+++ /dev/null
@@ -1,79 +0,0 @@
----
-layout: docs
-page_title: auth - Command
-description: |-
-  The "auth" command groups subcommands for interacting with Vault's auth
-  methods. Users can list, enable, disable, and get help for different auth
-  methods.
----
-
-# auth
-
-The `auth` command groups subcommands for interacting with Vault's auth methods.
-Users can list, enable, disable, and get help for different auth methods.
-
-For more information, please see the [auth method
-documentation](/vault/docs/auth) or the [authentication
-concepts](/vault/docs/concepts/auth) page.
-
-To authenticate to Vault as a user or machine, use the [`vault login`](/vault/docs/commands/login) command instead. This command is for
-interacting with the auth methods themselves, not authenticating to Vault.
-
-## Examples
-
-Enable an auth method:
-
-```shell-session
-$ vault auth enable userpass
-Success! Enabled userpass auth method at: userpass/
-```
-
-List all auth methods:
-
-```shell-session
-$ vault auth list
-Path         Type        Description
-----         ----        -----------
-token/       token       token based credentials
-userpass/    userpass    n/a
-```
-
-Get help about how to authenticate to a particular auth method:
-
-```shell-session
-$ vault auth help userpass/
-Usage: vault login -method=userpass [CONFIG K=V...]
-# ...
-```
-
-Disable an auth method:
-
-```shell-session
-$ vault auth disable userpass/
-Success! Disabled the auth method (if it existed) at: userpass/
-```
-
-Tune an auth method:
-
-```shell-session
-$ vault auth tune -max-lease-ttl=30m userpass/
-Success! Tuned the auth method at: userpass/
-```
-
-## Usage
-
-```text
-Usage: vault auth <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    disable    Disables an auth method
-    enable     Enables a new auth method
-    help       Prints usage for an auth method
-    list       Lists enabled auth methods
-    tune       Tunes an auth method configuration
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/auth/list.mdx b/website/content/docs/commands/auth/list.mdx
deleted file mode 100644
index 3ac64313dad..00000000000
--- a/website/content/docs/commands/auth/list.mdx
+++ /dev/null
@@ -1,72 +0,0 @@
----
-layout: docs
-page_title: auth list - Command
-description: |-
-  The "auth list" command lists the auth methods enabled. The output lists the
-  enabled auth methods and options for those methods.
----
-
-# auth list
-
-The `auth list` command lists the auth methods enabled. The output lists the
-enabled auth methods and options for those methods.
-
-## Deprecation status column
-
-As of 1.12, all built-in auth engines will have an associated Deprecation
-Status. This status will be reflected in the `Deprecation Status` column, seen
-below. All auth engines which are not provided by built-in plugins will show a
-`Deprecation Status` of "n/a".
-
-## Version columns
-
-The `-detailed` view displays some version information for each mount.
-
-The Version field indicates the configured version for the plugin. Empty, or "n/a",
-indicates the built-in or any matching unversioned plugin that may have been registered.
-
-Running Version indicates the actual plugin version running, which may differ from
-Version if the plugin hasn't been reloaded since the configured version was updated
-using the `secrets tune` command. Finally, the Running SHA256 field indicates the
-SHA256 sum of the running plugin's binary. This may be different from the SHA256
-registered in the catalog if the plugin hasn't been reloaded since the plugin
-version was overwritten in the catalog.
-
-## Examples
-
-List all auth methods:
-
-```shell-session
-$ vault auth list
-Path         Type        Description
-----         ----        -----------
-token/       token       token based credentials
-userpass/    userpass    n/a
-```
-
-List detailed auth method information:
-
-```shell-session
-$ vault auth list -detailed
-Path        Plugin     Accessor                 Default TTL    Max TTL    Token Type         Replication    Seal Wrap    External Entropy Access    Options    Description                UUID                                    Deprecation Status
-----        ------     --------                 -----------    -------    ----------         -----------    ---------    -----------------------    -------    -----------                ----                                    ------------------
-app-id/     app-id     auth_app-id_c88ad56f     system         system     default-service    replicated     false        false                      map[]      n/a                        a7c702b4-0dba-02b6-483c-2fd6be33240a    pending removal
-approle/    approle    auth_approle_95df932e    system         system     default-service    replicated     false        false                      map[]      n/a                        931df9d1-8737-b7dc-4ca2-3e0e892fce92    supported
-token/      token      auth_token_aafab997      system         system     default-service    replicated     false        false                      map[]      token based credentials    6eb5db7b-ac7f-4304-1f52-9b802c6f06c1    n/a
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-detailed` `(bool: false)` - Print detailed information such as configuration
-  and replication status about each auth method.
diff --git a/website/content/docs/commands/auth/move.mdx b/website/content/docs/commands/auth/move.mdx
deleted file mode 100644
index cb5e3a5000d..00000000000
--- a/website/content/docs/commands/auth/move.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: auth move - Command
-description: |-
-  The "auth move" command moves an existing auth method to a new path. All
-  tokens from the old auth method are revoked, but all configurations
-  associated with the engine are preserved.
----
-
-# auth move
-
-The `auth move` command moves an existing auth method to a new path. Any
-leases from the old auth method are revoked, but all configuration associated
-with the engine is preserved. The command can be issued for a move within or across
-namespaces, using namespace prefixes in the arguments.
-
-The command will trigger a remount operation and uses the returned migration ID to poll the 
-status of the operation until a terminal state of `success` or `failure` is reached.
-
-**Moving an existing auth method will revoke any leases from the old
-method.**
-
-## Examples
-
-Move the existing auth method at ns1/approle/ to ns2/new-approle/:
-
-```shell-session
-$ vault auth move ns1/auth/approle/ ns2/auth/new-approle/
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/auth/tune.mdx b/website/content/docs/commands/auth/tune.mdx
deleted file mode 100644
index 950868f35af..00000000000
--- a/website/content/docs/commands/auth/tune.mdx
+++ /dev/null
@@ -1,185 +0,0 @@
----
-layout: docs
-page_title: auth tune - Command
-description: |-
-  The "auth tune" command tunes the configuration options for the auth method at
-  the given PATH.
----
-
-# auth tune
-
-The `auth tune` command tunes the configuration options for the auth method at
-the given PATH. 
-
-<Note>
-
-The argument corresponds to the **path** where the auth method is
-enabled, not the auth **type**.
-
-</Note>
-
-## Examples
-
-Before tuning the auth method configuration, view the current configuration of the
-auth method enabled at `github/`.
-
-```shell-session
-$ vault read sys/auth/github/tune
-Key                  Value
----                  -----
-default_lease_ttl    768h
-description          n/a
-force_no_cache       false
-max_lease_ttl        768h
-token_type           default-service
-```
-
-The default lease for the auth method enabled at `github/` is currently set to
-768 hours. Tune this value to 72 hours.
-
-```shell-session
-$ vault auth tune -default-lease-ttl=72h github/
-Success! Tuned the auth method at: github/
-```
-
-Verify the updated configuration.
-
-<CodeBlockConfig highlight="1,4">
-
-```shell-session
-$ vault read sys/auth/github/tune
-Key                  Value
----                  -----
-default_lease_ttl    72h
-description          n/a
-force_no_cache       false
-max_lease_ttl        768h
-token_type           default-service
-```
-
-</CodeBlockConfig>
-
-To restore back to the system default, you can use `-1`. 
-
-```shell-session
-$ vault auth tune -default-lease-ttl=-1 github/
-Success! Tuned the auth method at: github/
-```
-
-Verify the updated configuration.
-
-<CodeBlockConfig highlight="1,4">
-
-```shell-session
-$ vault read sys/auth/github/tune
-Key                  Value
----                  -----
-default_lease_ttl    768h
-description          n/a
-force_no_cache       false
-max_lease_ttl        768h
-token_type           default-service
-```
-
-</CodeBlockConfig>
-
-You can specify multiple audit non-hmac request keys.
-
-```shell-session
-$ vault auth tune -audit-non-hmac-request-keys=value1 -audit-non-hmac-request-keys=value2 github/
-Success! Tuned the auth method at: github/
-```
-
-### Enable user lockout
-
-User lockout feature is only supported for
-[userpass](/vault/docs/auth/userpass), [ldap](/vault/docs/auth/ldap), and
-[approle](/vault/docs/auth/approle) auth methods.
-
-Tune the `userpass/` auth method to lock out the user after 10 failed login
-attempts within 10 minutes.
-
-```shell-session
-$ vault auth tune -user-lockout-threshold=10  -user-lockout-duration=10m userpass/
-Success! Tuned the auth method at: userpass/
-```
-
-View the current configuration of the auth method enabled at `userpass/`.
-
-<CodeBlockConfig highlight="1,11-13">
-
-```shell-session
-$ vault read sys/auth/userpass/tune
-
-Key                  Value
----                  -----
-default_lease_ttl    768h
-description          n/a
-force_no_cache       false
-max_lease_ttl        768h
-token_type           default-service
-user_lockout_counter_reset_duration    0s
-user_lockout_disable                   false
-user_lockout_duration                  10m
-user_lockout_threshold                 10
-```
-
-</CodeBlockConfig>
-
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-- `-allowed-response-headers` `(string: "")` - response header values that the auth
-  method will be allowed to set.
-
-- `-audit-non-hmac-request-keys` `(string: "")` - Key that will not be HMAC'd
-  by audit devices in the request data object. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-audit-non-hmac-response-keys` `(string: "")` - Key that will not be HMAC'd
-  by audit devices in the response data object. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-default-lease-ttl` `(duration: "")` - The default lease TTL for this auth
-  method. If unspecified, this defaults to the Vault server's globally
-  configured default lease TTL, or a previously configured value for the auth
-  method.
-
-- `-description` `(string: "")` - Specifies the description of the auth method.
-  This overrides the current stored value, if any.
-
-- `-listing-visibility` `(string: "")` - The flag to toggle whether to show the
-  mount in the UI-specific listing endpoint. Valid values are `"unauth"` or `"hidden"`.
-  Passing empty string leaves the current setting unchanged.
-
-- `-max-lease-ttl` `(duration: "")` - The maximum lease TTL for this auth
-  method. If unspecified, this defaults to the Vault server's globally
-  configured [maximum lease TTL](/vault/docs/configuration#max_lease_ttl), or a
-  previously configured value for the auth method. This value is allowed to
-  override the server's global max TTL; it can be longer or shorter.
-
-- `-passthrough-request-headers` `(string: "")` - request header values that will
-  be sent to the auth method. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-token-type` `(string: "")` - Specifies the type of tokens that should be
-  returned by the auth method.
-
-- `-plugin-version` `(string: "")` - Configures the semantic version of the plugin
-  to use. The new version will not start running until the mount is
-  [reloaded](/vault/docs/commands/plugin/reload).
-
-- `-user-lockout-threshold` `(string: "")` - Specifies the number of failed login attempts 
-  after which the user is locked out. User lockout feature was added in Vault 1.13. 
-
-- `-user-lockout-duration` `(duration: "")` - Specifies the duration for which a user will be locked out.
-  User lockout feature was added in Vault 1.13.
-
-- `-user-lockout-counter-reset-duration` `(duration: "")` - Specifies the duration after which the lockout 
-  counter is reset with no failed login attempts. User lockout feature was added in Vault 1.13.
-
-- `-user-lockout-disable` `(bool: false)` - Disables the user lockout feature if set to true. User lockout feature was added in Vault 1.13.
-
diff --git a/website/content/docs/commands/debug.mdx b/website/content/docs/commands/debug.mdx
deleted file mode 100644
index 12e880bd9d7..00000000000
--- a/website/content/docs/commands/debug.mdx
+++ /dev/null
@@ -1,182 +0,0 @@
----
-layout: docs
-page_title: debug - Command
-description: |-
-  The "debug" command monitors a Vault server, probing information about
-  it for a certain duration.
----
-
-# debug
-
-The `debug` command starts a process that monitors a Vault server, probing
-information about it for a certain duration.
-
-Gathering information about the state of the Vault cluster often requires the
-operator to access all necessary information via various API calls and terminal
-commands. The `debug` command aims to provide a simple workflow that produces a
-consistent output to help operators retrieve and share information about the
-server in question.
-
-The `debug` command honors the same variables that the base command
-accepts, such as the token stored via a previous login or the environment
-variables `VAULT_TOKEN` and `VAULT_ADDR`. The token used determines the
-permissions and, in turn, the information that `debug` may be able to collect.
-The address specified determines the target server that will be probed against.
-
-If the command is interrupted, the information collected up until that
-point gets persisted to an output directory.
-
-## Permissions
-
-Regardless of whether a particular target is provided, the ability for `debug`
-to fetch data for the target depends on the token provided. Some targets, such
-as `server-status`, queries unauthenticated endpoints which means that it can be
-queried all the time. Other targets require the token to have ACL permissions to
-query the matching endpoint in order to get a proper response. Any errors
-encountered during capture due to permissions or otherwise will be logged in the
-index file.
-
-The following policy can be used for generating debug packages with all targets:
-
-```hcl
-path "auth/token/lookup-self" {
-  capabilities = ["read"]
-}
-
-path "sys/pprof/*" {
-  capabilities = ["read"]
-}
-
-path "sys/config/state/sanitized" {
-  capabilities = ["read"]
-}
-
-path "sys/monitor" {
-  capabilities = ["read"]
-}
-
-path "sys/host-info" {
-  capabilities = ["read"]
-}
-
-path "sys/in-flight-req" {
-  capabilities = ["read"]
-}
-```
-
-## Capture targets
-
-The `-target` flag can be specified multiple times to capture specific
-information when debug is running. By default, it captures all information.
-
-| Target               | Description                                                                       |
-| :------------------- | :-------------------------------------------------------------------------------- |
-| `config`             | Sanitized version of the configuration state.                                     |
-| `host`               | Information about the instance running the server, such as CPU, memory, and disk. |
-| `metrics`            | Telemetry information.                                                            |
-| `pprof`              | Runtime profiling data, including heap, CPU, goroutine, and trace profiling.      |
-| `replication-status` | Replication status.                                                               |
-| `server-status`      | Health and seal status.                                                           |
-
-Note that the `config`, `host`,`metrics`, and `pprof` targets are only queried
-on active and performance standby nodes due to the the fact that the information
-pertains to the local node and the request should not be forwarded.
-
-Additionally, host information is not available on the OpenBSD platform due to
-library limitations in fetching the data without enabling `cgo`.
-
-[Enterprise] Telemetry can be gathered from a DR Secondary active node via the
-`metrics` target if [unauthenticated_metrics_access](/vault/docs/configuration/listener/tcp#unauthenticated_metrics_access) is enabled.
-
-## Output layout
-
-The output of the bundled information, once decompressed, is contained within a
-single directory. Each target, with the exception of profiling data, is captured
-in a single file. For each of those targets collection is represented as a JSON
-array object, with each entry captured at each interval as a JSON object.
-
-```shell-session
-$ tree vault-debug-2019-10-15T21-44-49Z/
-vault-debug-2019-10-15T21-44-49Z/
-├── 2019-10-15T21-44-49Z
-│   ├── goroutine.prof
-│   ├── heap.prof
-│   ├── profile.prof
-│   └── trace.out
-├── 2019-10-15T21-45-19Z
-│   ├── goroutine.prof
-│   ├── heap.prof
-│   ├── profile.prof
-│   └── trace.out
-├── 2019-10-15T21-45-49Z
-│   ├── goroutine.prof
-│   ├── heap.prof
-│   ├── profile.prof
-│   └── trace.out
-├── 2019-10-15T21-46-19Z
-│   ├── goroutine.prof
-│   ├── heap.prof
-│   ├── profile.prof
-│   └── trace.out
-├── 2019-10-15T21-46-49Z
-│   ├── goroutine.prof
-│   └── heap.prof
-├── config.json
-├── host_info.json
-├── index.json
-├── metrics.json
-├── replication_status.json
-└── server_status.json
-```
-
-## Examples
-
-Start debug using reasonable defaults:
-
-```shell-session
-$ vault debug
-```
-
-Start debug with different duration, intervals, and metrics interval values, and
-skip compression:
-
-```shell-session
-$ vault debug -duration=1m -interval=10s -metrics-interval=5s -compress=false
-```
-
-Start debug with specific targets:
-
-```shell-session
-$ vault debug -target=host -target=metrics
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Command options
-
-- `-compress` `(bool: true)` - Toggles whether to compress output package The
-  default is true.
-
-- `-duration` `(int or time string: "2m")` - Duration to run the command. The
-  default is 2m0s.
-
-- `-interval` `(int or time string: "30s")` - The polling interval at which to
-  collect profiling data and server state. The default is 30s.
-
-- `-log-format` `(string: "standard")` - Log format to be captured if "log"
-  target specified. Supported values are "standard" and "json". The default is
-  "standard".
-
-- `-metrics-interval` `(int or time string: "10s")` - The polling interval at
-  which to collect metrics data. The default is 10s.
-
-- `-output` `(string)` - Specifies the output path for the debug package. Defaults
-  to a time-based generated file name.
-
-- `-target` `(string: all targets)` - Target to capture, defaulting to all if
-  none specified. This can be specified multiple times to capture multiple
-  targets. Available targets are: config, host, metrics, pprof,
-  replication-status, server-status.
diff --git a/website/content/docs/commands/delete.mdx b/website/content/docs/commands/delete.mdx
deleted file mode 100644
index 57ea7cd4950..00000000000
--- a/website/content/docs/commands/delete.mdx
+++ /dev/null
@@ -1,42 +0,0 @@
----
-layout: docs
-page_title: delete - Command
-description: |-
-  The "delete" command deletes secrets and configuration from Vault at the given
-  path. The behavior of "delete" is delegated to the backend corresponding to
-  the given path.
----
-
-# delete
-
-The `delete` command deletes secrets and configuration from Vault at the given
-path (wrapper command for HTTP DELETE). The behavior of "delete" is delegated to
-the backend corresponding to the given path.
-
-## Examples
-
-Remove data in the static secrets engine:
-
-```shell-session
-$ vault delete secret/my-secret
-```
-
-Uninstall an encryption key in the transit backend:
-
-```shell-session
-$ vault delete transit/keys/my-key
-```
-
-Note: changing the `deletion_allowed` parameter to `true` is necessary for the
-key to be successfully deleted, you can read more on key parameters [here](/vault/api-docs/secret/transit#update-key-configuration)
-
-Delete an IAM role:
-
-```shell-session
-$ vault delete aws/roles/ops
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/events.mdx b/website/content/docs/commands/events.mdx
deleted file mode 100644
index 51a91c81be5..00000000000
--- a/website/content/docs/commands/events.mdx
+++ /dev/null
@@ -1,102 +0,0 @@
----
-layout: docs
-page_title: events - Command
-description: |-
-  The "events" command interacts with the Vault events notifications subsystem.
----
-
-# events
-
-<EnterpriseAlert product="vault" />
-
-Use the `events` command to get a real-time display of
-[event notifications](/vault/docs/concepts/events) generated by Vault and to subscribe to Vault
-event notifications. Note that the `events subscribe` runs indefinitly and will not exit on
-its own unless it encounters an unexpected error. Similar to `tail -f` in the
-Unix world, you must terminate the process from the command line to end the
-`events` command.
-
-Specify the desired event types (also called "topics") as a glob pattern. To
-match against multiple event types, use `*` as a wildcard. The command returns
-serialized JSON objects in the default protobuf JSON serialization format with
-one line per event received.
-
-## Examples
-
-Subscribe to all event notifications:
-
-```shell-session
-$ vault events subscribe '*'
-```
-
-Subscribe to all KV event notifications:
-
-```shell-session
-$ vault events subscribe 'kv*'
-```
-
-Subscribe to all `kv-v2/data-write` event notifications:
-
-```shell-session
-$ vault events subscribe kv-v2/data-write
-```
-
-Subscribe to all KV event notifications in the current and `ns1` namespaces for the secret `secret/data/foo` that do not involve writing data:
-
-```shell-session
-$ vault events subscribe -namespaces=ns1 -filter='data_path == secret/data/foo and operation != "data-write"' 'kv*'
-```
-
-## Usage
-
-`events subscribe` supports the following flags in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Options
-
-- `-timeout`: `(duration: "")` - close the WebSocket automatically after the
-  specified duration.
-
-- `-namespaces` `(string)` - Additional **child** namespaces for the
-  subscription. Repeat the flag to add additional namespace patterns to the
-  subscription request. Vault automatically prepends the issuing namespace for
-  the request to the provided namespace. For example, if you include
-  `-namespaces=ns2` on a request made in the `ns1` namespace, Vault will attempt
-  to subscribe you to event notifications under the `ns1/ns2` and `ns1` namespaces. You can
-  use the `*` character to include wildcards in the namespace pattern. By
-  default, Vault will only subscribe to event notifications in the requesting namespace.
-
-<Note>
-  To subscribe to event notifications across multiple namespaces, you must provide a root
-  token or a token associated with appropriate policies across all the targeted
-  namespaces. Refer to
-  the <a href="/vault/tutorials/enterprise/namespaces">Secure multi-tenancy with
-  namespaces</a>tutorial for configuring your Vault instance appropriately.
-</Note>
-
-- `-filter` `(string: "")` - Filter expression used to select event notifications to be sent
-  through the WebSocket.
-
-Refer to the [Filter expressions](/vault/docs/concepts/filtering) guide for a complete
-list of filtering options and an explanation on how Vault evaluates filter expressions.
-
-  The following values are available in the filter expression:
-  - `event_type`: the event type, e.g., `kv-v2/data-write`.
-	- `operation`: the operation name that caused the event notification, e.g., `write`.
-	- `source_plugin_mount`: the mount of the plugin that produced the event notification,
-    e.g., `secret/`
-	- `data_path`: the API path that can be used to access the data of the secret related to the event notification, e.g., `secret/data/foo`
-	- `namespace`: the path of the namespace that created the event notification, e.g., `ns1/`
-
-    The filter string is empty by default. Unfiltered subscription requests match to
-    all event notifications that the requestor has access to for the target event type. When the
-    filter string is not empty, Vault applies the filter conditions after the policy
-    checks to narrow the event notifications provided in the response.
-
-    Filters can be straightforward path matches like
-    `data_path == secret/data/foo`, which specifies that Vault should pass
-    return event notifications that refer to the `secret/data/foo` secret to the WebSocket.
-    Or more complex statements that exclude specific operations. For example:
-      ```
-      data_path == secret/data/foo and operation != write
-      ```
diff --git a/website/content/docs/commands/hcp/connect.mdx b/website/content/docs/commands/hcp/connect.mdx
deleted file mode 100644
index ebf9dadce1b..00000000000
--- a/website/content/docs/commands/hcp/connect.mdx
+++ /dev/null
@@ -1,60 +0,0 @@
----
-layout: docs
-page_title: hcp connect - Command
-description: |-
-  Use "hcp connect" command to authenticate users and machines to HCP with explicit
-  credentials or an HCP token and interactive browser login.
----
-
-# hcp connect
-
-The `hcp connect` command authenticates users and machines to HCP with explicit
-credentials or an HCP token and interactive browser login.
-
-By default, the `hcp connect` command uses interactive authentication that requires
-users to log into the HashiCorp Cloud Platform with a browser.
-
-Non-interactive login requires a service principal credential that was
-previously generated through the HCP portal. The service principal must have
-access to the requested organization, project, and HCP Vault cluster.
-
-If authentication succeeds, the Vault CLI saves the returned HCP token and HCP
-Vault address in the local cache.
-
-## Examples
-
-Connect to HCP interactively:
-
-```shell-session
-$ vault hcp connect
-The default web browser has been opened at <auth_url>. Please continue the login in the web browser.
-Success!
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Command options
-
-- `-client-id` `(string: "")` - Client ID belonging to a service principal
-credential generated in the HCP Portal. **Required for non-interactive
-authentication**.
-
-- `-secret-id` `(string: "")` - Secret ID belonging to a service principal
-credential previously generated in the HCP Portal. **Required for
-non-interactive authentication**.
-
-- `-organization-id` `(string: "")` - Optional ID of the desired HCP
-organization. If `organization-id` is empty and the user is associated with
-multiple HCP organizations, the CLI prompts the user to select from a list
-of available organizations.
-
-- `-project-id` `(string: "")` - Optional ID of the desired HCP project. If
-  `project-id` is empty and the user is associated with more than one HCP
-   project, the CLI prompts the user to select from a list of available projects.
-
-- `-cluster-id` `(string: "")` - Optional ID of the desired HCP Vault cluster.
-If `cluster-id` is empty and the user is associated with multiple HCP clusters,
-the CLI prompts the user to select from a list of available clusters.
diff --git a/website/content/docs/commands/hcp/disconnect.mdx b/website/content/docs/commands/hcp/disconnect.mdx
deleted file mode 100644
index f8ac8767123..00000000000
--- a/website/content/docs/commands/hcp/disconnect.mdx
+++ /dev/null
@@ -1,23 +0,0 @@
----
-layout: docs
-page_title: hcp disconnect - Command
-description: |-
-  Use "hcp disconnect" command invalidates live sessions to a HCP Vault cluster.
----
-
-# hcp disconnect
-
-The `hcp disconnect` command invalidates live sessions to a HCP Vault cluster.
-
-## Examples
-
-Disconnect from HCP:
-
-```shell-session
-$ vault hcp disconnect
-```
-
-## Usage
-
-All [standard set of
-flags](/vault/docs/commands) are included.
diff --git a/website/content/docs/commands/hcp/index.mdx b/website/content/docs/commands/hcp/index.mdx
deleted file mode 100644
index 52e27769368..00000000000
--- a/website/content/docs/commands/hcp/index.mdx
+++ /dev/null
@@ -1,27 +0,0 @@
----
-layout: docs
-page_title: hcp - Command
-description: |-
-  Use "hcp" commands to authenticate users and machines to HCP with explicit
-  credentials or an HCP token and interactive browser login and to invalidate any live authentication session.
----
-
-# hcp
-
-Use `hcp` commands to manage authentication to HCP via proxy,
-which allows clients to connect to this cluster securely over the internet with a proxy address and to invalidate any live authentication session.
-
-## Examples
-
-Connect to HCP:
-
-```shell-session
-$ vault hcp connect
-The default web browser has been opened at <auth_url>. Please continue the login in the web browser.
-Success!
-```
-
-Disconnect from HCP:
-```shell-session
-$ vault hcp disconnect
-```
diff --git a/website/content/docs/commands/index.mdx b/website/content/docs/commands/index.mdx
deleted file mode 100644
index 6aa2eea3ce4..00000000000
--- a/website/content/docs/commands/index.mdx
+++ /dev/null
@@ -1,444 +0,0 @@
----
-layout: docs
-page_title: Commands (CLI)
-description: |-
-  In addition to a verbose HTTP API, Vault features a command-line interface
-  that wraps common functionality and formats output. The Vault CLI is a single
-  static binary. It is a thin wrapper around the HTTP API. Every CLI command
-  maps directly to the HTTP API internally.
----
-
-# Vault commands (CLI)
-
-~> **Note:** The Vault command-line interface (CLI) changed substantially in
-0.9.2+ and may cause confusion while using older versions of Vault with this
-documentation. Read our [upgrade
-guide](/vault/docs/upgrading/upgrade-to-0.9.2#backwards-compatible-cli-changes) for
-more information.
-
-In addition to a verbose [HTTP API](/vault/api-docs), Vault features a command-line
-interface (CLI) that wraps common functionality and formats output. The Vault
-CLI is a single static binary. It is a thin wrapper around the HTTP API. Every
-CLI command maps directly to the HTTP API internally.
-
-## CLI command structure
-
-Each command is represented as a command or subcommand, and there are a number
-of command and subcommand options available: HTTP options, output options, and
-command-specific options.
-
-Construct your Vault CLI command such that the command options precede its path
-and arguments if any:
-
-<CodeBlockConfig hideClipboard>
-
-```text
-vault <command> [options] [path] [args]
-```
-
-</CodeBlockConfig>
-
-- `options` - [Flags](/vault/docs/commands#flags) to specify additional settings
-- `args` - API arguments specific to the operation
-
--> **NOTE:** Use the [command help](#command-help) to display available options
-and arguments.
-
-#### Examples:
-
-The following `write` command creates a new user (`bob`) in the userpass auth
-method. It passes the `-address` flag to specify the Vault server address which
-precedes the path (`auth/userpass/users/bob`) and its
-[argument](/vault/api-docs/auth/userpass#create-update-user)
-(`password="long-password"`) at last.
-
-```shell-session
-$ vault write -address="http://127.0.0.1:8200" auth/userpass/users/bob password="long-password"
-```
-
-If multiple options (`-address` and `-namespace`) and
-[arguments](/vault/api-docs/auth/userpass#create-update-user) (`password` and
-`policies`) are specified, the command would look like:
-
-```shell-session
-$ vault write -address="http://127.0.0.1:8200" -namespace="my-organization" \
-        auth/userpass/users/bob password="long-password" policies="admin"
-```
-
-The options (flags) come after the command (or subcommand) preceding the path,
-and the args always follow the path to set API parameter values.
-
-The four most common operations in Vault are [read](/vault/docs/commands/read),
-[write](/vault/docs/commands/write), [delete](/vault/docs/commands/delete), and
-[list](/vault/docs/commands/list). These operations work on most paths in Vault. Some
-paths will contain secrets while other paths may contain configuration. Whatever it
-is, the primary interface for reading and writing data to Vault is similar.
-
-### Print cURL command
-
-To see the equivalent API call to perform the same operation, use the
-`-output-curl-string` flag after the subcommand.
-
-```shell-session
-$ vault write -output-curl-string  auth/userpass/users/bob password="long-password"
-
-curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: $(vault print token)" -d '{"password":"long-password"}' http://127.0.0.1:8200/v1/auth/userpass/users/bob
-```
-
-#### Print policy requirements
-
-To view the policy requirements to perform an operation, use the `-output-policy` flag after the subcommand.
-
-```
-$ vault kv put -output-policy kv/secret value=itsasecret
-
-path "kv/data/secret" {
-  capabilities = ["create", "update"]
-}
-```
-
-## Command help
-
-There are two primary ways to get help in Vault: [CLI help (`help`)](#cli-help)
-and [API help (`path-help`)](#api-help).
-
-### CLI help
-
-Use `help` (or `-h` for shorthand) to see the CLI help output which corresponds
-to your Vault version.
-
-To get CLI help:
-
-```shell-session
-$ vault help
-```
-
-**Example:** To get help on the `kv` command.
-
-```shell-session
-$ vault kv help
-```
-
-The help output displays available subcommands, parameters, and command flags.
-
-### API help
-
-To invoke the Vault API paths, you can use the [read](/vault/docs/commands/read) (for
-HTTP GET), [write](/vault/docs/commands/write) (for HTTP PUT or POST),
-[delete](/vault/docs/commands/delete) (for HTTP DELETE), and
-[list](/vault/docs/commands/list) (for HTTP LIST) commands.
-
-Use `path-help` to get Vault API help:
-
-```shell-session
-$ vault path-help -h
-```
-
-The `path-help` retrieves API help on any API paths. Vault API paths provide
-built-in help in markdown format. This includes system paths, secret engines,
-and auth methods.
-
-**Example:** API help on the [`sys/mounts/`](/vault/api-docs/system/mounts) path.
-
-```shell-session
-$ vault path-help sys/mounts
-Request:        mounts
-Matching Route: ^mounts$
-
-List the currently mounted backends.
-
-## DESCRIPTION
-
-This path responds to the following HTTP methods.
-
-    GET /
-        Lists all the mounted secret backends.
-
-    GET /<mount point>
-        Get information about the mount at the specified path.
-
-    POST /<mount point>
-        Mount a new secret backend to the mount point in the URL.
-
-    POST /<mount point>/tune
-        Tune configuration parameters for the given mount point.
-
-    DELETE /<mount point>
-        Unmount the specified mount point.
-```
-
-The help output displays supported child-paths and available parameters if there
-are any.
-
-## Command input
-
-To write data to Vault, the input can be a part of the command in key-value
-format.
-
-```shell-session
-$ vault kv put secret/password value=itsasecret
-```
-
-However, some Vault API require more advanced structures such as maps. You can
-use stdin or file input instead.
-
-### stdin
-
-Some commands in Vault can read data from stdin using `-` as the value. If `-`
-is the entire argument, Vault expects to read a JSON object from stdin:
-
-```shell-session
-$ echo -n '{"value":"itsasecret"}' | vault kv put secret/password -
-```
-
-In addition to reading full JSON objects, Vault can read just a value from
-stdin:
-
-```shell-session
-$ echo -n "itsasecret" | vault kv put secret/password value=-
-```
-
-### Files
-
-Some commands can also read data from a file on disk. The usage is similar to
-stdin as documented above. If an argument starts with `@`, Vault will read it as
-a file:
-
-```shell-session
-$ vault kv put secret/password @data.json
-```
-
-Or specify the contents of a file as a value:
-
-```shell-session
-$ vault kv put secret/password value=@data.txt
-```
-
-Note that if an argument is supplied in a @key=value format, Vault will treat that as a
-kv pair with the key being `@key`, not a file called `key=value`. This also means that Vault
-does not support filenames with `=` in them.
-
-## Mount flag syntax (KV)
-
-All `kv` commands can alternatively refer to the path to the KV secrets engine using a flag-based syntax like `$ vault kv get -mount=secret password`
-instead of `$ vault kv get secret/password`. The mount flag syntax was created to mitigate confusion caused by the fact that for KV v2 secrets,
-their full path (used in policies and raw API calls) actually contains a nested `/data/` element (e.g. `secret/data/password`) which can be easily overlooked when using
-the above KV v1-like syntax `secret/password`. To avoid this confusion, all KV-specific docs pages will use the `-mount` flag.
-
-## Exit codes
-
-The Vault CLI aims to be consistent and well-behaved unless documented
-otherwise.
-
-- Local errors such as incorrect flags, failed validations, or wrong numbers
-  of arguments return an exit code of 1.
-
-- Any remote errors such as API failures, bad TLS, or incorrect API parameters
-  return an exit status of 2
-
-Some commands override this default where it makes sense. These commands
-document this anomaly.
-
-## Autocompletion
-
-The `vault` command features opt-in autocompletion for flags, subcommands, and
-arguments (where supported).
-
-Enable autocompletion by running:
-
-```shell-session
-$ vault -autocomplete-install
-```
-
-~> Be sure to **restart your shell** after installing autocompletion!
-
-When you start typing a Vault command, press the `<tab>` character to show a
-list of available completions. Type `-<tab>` to show available flag completions.
-
-If the `VAULT_*` environment variables are set, the autocompletion will
-automatically query the Vault server and return helpful argument suggestions.
-
-## Token helper
-
-By default, the Vault CLI uses a "token helper" to cache the token after
-authentication. This is conceptually similar to how a website securely stores
-your session information as a cookie in the browser. Token helpers are
-customizable, and you can even build your own.
-
-The default token helper stores the token in `~/.vault-token`. You can delete
-this file at any time to "logout" of Vault.
-
-## Environment variables
-
-The CLI reads the following environment variables to set behavioral defaults.
-This can alleviate the need to repetitively type a flag. Flags always take
-precedence over the environment variables. Each of the following environment 
-variables must be set on the Vault process.  In Vault 1.13+, all environment 
-variables available to the Vault process will be logged during startup.
-
-### `VAULT_TOKEN`
-
-Vault authentication token. Conceptually similar to a session token on a
-website, the `VAULT_TOKEN` environment variable holds the contents of the token.
-For more information, please see the [token
-concepts](/vault/docs/concepts/tokens) page.
-
-### `VAULT_ADDR`
-
-Address of the Vault server expressed as a URL and port, for example:
-`https://127.0.0.1:8200/`.
-
-### `VAULT_CACERT`
-
-Path to a PEM-encoded CA certificate _file_ on the local disk. This file is used
-to verify the Vault server's SSL certificate. This environment variable takes
-precedence over `VAULT_CAPATH`.
-
-### `VAULT_CAPATH`
-
-Path to a _directory_ of PEM-encoded CA certificate files on the local disk.
-These certificates are used to verify the Vault server's SSL certificate.
-
-### `VAULT_CLIENT_CERT`
-
-Path to a PEM-encoded client certificate on the local disk. This file is used
-for TLS communication with the Vault server.
-
-### `VAULT_CLIENT_KEY`
-
-Path to an unencrypted, PEM-encoded private key on disk which corresponds to the
-matching client certificate.
-
-### `VAULT_CLIENT_TIMEOUT`
-
-Timeout variable. The default value is 60s.
-
-### `VAULT_CLUSTER_ADDR`
-
-Address that should be used for other cluster members to connect to this node
-when in High Availability mode.
-
-### `VAULT_FORMAT`
-
-Provide Vault output (read/status/write) in the specified format. Valid formats are "table", "json", or "yaml".
-
-### `VAULT_LICENSE`
-
-[Enterprise, Server only] Specify a license to use for this node. This takes
-precedence over [#VAULT_LICENSE_PATH](#vault_license_path) and
-[license_path in config](/vault/docs/configuration#license_path).
-
-### `VAULT_LICENSE_PATH`
-
-[Enterprise, Server only] Specify a path to a license on disk to use for this node.
-This takes precedence over [license_path in config](/vault/docs/configuration#license_path).
-
-### `VAULT_LOG_LEVEL`
-
-Set the Vault server's log level. The supported values are `trace`, `debug`,
-`info`, `warn`, and `err`. The default log leve is `info`.
-
-### `VAULT_MAX_RETRIES`
-
-Maximum number of retries when certain error codes are encountered. The default
-is `2`, for three total attempts. Set this to `0` or less to disable retrying.
-
-Error codes that are retried are 412 (client consistency requirement not
-satisfied) and all 5xx except for 501 (not implemented).
-
-### `VAULT_REDIRECT_ADDR`
-
-Address that should be used when clients are redirected to this node when in
-High Availability mode.
-
-### `VAULT_SKIP_VERIFY`
-
-Do not verify Vault's presented certificate before communicating with it.
-Setting this variable is not recommended and voids Vault's [security
-model](/vault/docs/internals/security).
-
-### `VAULT_TLS_SERVER_NAME`
-
-Name to use as the SNI host when connecting via TLS.
-
-### `VAULT_CLI_NO_COLOR`
-
-If provided, Vault output will not include ANSI color escape sequence characters.
-
-### `VAULT_RATE_LIMIT`
-
-This environment variable will limit the rate at which the `vault` command
-sends requests to Vault.
-
-This environment variable has the format `rate[:burst]` (where items in `[]` are
-optional). If not specified, the burst value defaults to rate. Both rate and
-burst are specified in "operations per second". If the environment variable is
-not specified, then the rate and burst will be unlimited _i.e._ rate
-limiting is off by default.
-
-_Note:_ The rate is limited for each invocation of the `vault` CLI. Since
-each invocation of the `vault` CLI typically only makes a few requests,
-this environment variable is most useful when using the Go
-[Vault client API](/vault/api-docs/libraries#go).
-
-### `VAULT_NAMESPACE`
-
-The namespace to use for the command. Setting this is not necessary
-but allows using relative paths.
-
-### `VAULT_SRV_LOOKUP`
-
-Enables the client to lookup the host through DNS SRV look up as described in this
-[draft](https://tools.ietf.org/html/draft-andrews-http-srv-02).
-This is not designed for high-availability, just discovery.
-The draft specifies that the SRV record lookup is ignored if a port is given.
-
-### `VAULT_MFA`
-
-**ENTERPRISE ONLY**
-
-MFA credentials in the format `mfa_method_name[:key[=value]]` (items in `[]` are
-optional). Note that when using the environment variable, only one credential
-can be supplied. If a MFA method expects multiple credential values, or if there
-are multiple MFA methods specified on a path, then the CLI flag `-mfa` should be
-used.
-
-### `VAULT_HTTP_PROXY`
-
-HTTP or HTTPS proxy location which should be used by all requests to access Vault.
- When present, this overrides the default proxy resolution behavior.
-Format should be `http://server:port` or `https://server:port`.
-
-(See `VAULT_PROXY_ADDR` below).
-
-### `VAULT_PROXY_ADDR`
-
-HTTP or HTTPS proxy location which should be used by all requests to access Vault.
- When present, this overrides the default proxy resolution behavior.
-Format should be `http://server:port` or `https://server:port`.
-
-~> Note: When using `VAULT_HTTP_PROXY` or `VAULT_PROXY_ADDR` any of the standard
- proxy variables found in the environment will be ignored.
-Specifically `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY`.
-All requests will resolve the specified proxy; there is no way to exclude
- domains from consulting the proxy server.
-
-~> Note: If both `VAULT_HTTP_PROXY` and `VAULT_PROXY_ADDR` environment
-variables are supplied, `VAULT_PROXY_ADDR` will be prioritized and preferred.
-
-### `VAULT_DISABLE_REDIRECTS`
-
-Prevents the Vault client from following redirects. By default, the Vault client will automatically follow a single redirect.
-
-~> **Note:** Disabling redirect following behavior could cause issues with commands such as 'vault operator raft snapshot' as this command redirects the request to the cluster's primary node.
-
-## Flags
-
-There are different CLI flags that are available depending on subcommands. Some
-flags, such as those used for setting HTTP and output options, are available
-globally, while others are specific to a particular subcommand. For a complete
-list of available flags, run:
-
-```shell-session
-$ vault <subcommand> -h
-```
\ No newline at end of file
diff --git a/website/content/docs/commands/kv/delete.mdx b/website/content/docs/commands/kv/delete.mdx
deleted file mode 100644
index 3ddcfd3c55e..00000000000
--- a/website/content/docs/commands/kv/delete.mdx
+++ /dev/null
@@ -1,48 +0,0 @@
----
-layout: docs
-page_title: kv delete - Command
-description: |-
-  The "kv delete" command deletes the data for the provided path in the key/value secrets engine.
----
-
-# kv delete
-
-The `kv delete` command deletes the data for the provided path in
-the key/value secrets engine. If using KV version 2, its versioned data will
-not be fully removed, but marked as deleted and will no longer be returned in
-normal get requests.
-
-## Examples
-
-Delete the latest version of the key "creds":
-
-```shell-session
-$ vault kv delete -mount=secret creds
-Success! Data deleted (if it existed) at: secret/creds
-```
-
-**[KV version 2]** Delete version 11 of key "creds":
-
-```shell-session
-$ vault kv delete -mount=secret -versions=11 creds
-Success! Data deleted (if it existed) at: secret/data/creds
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
-
-### Command options
-
-- `-mount` `(string: "")` - Specifies the path where the KV backend is mounted.
-  If specified, the next argument will be interpreted as the secret path. If
-  this flag is not specified, the next argument will be interpreted as the
-  combined mount path and secret path, with /data/ automatically inserted for
-  KV v2 secrets.
-
-- `-versions` `([]int: <required>)` - The versions to be deleted. The versioned
-  data will not be deleted, but it will no longer be returned in normal get
-  requests.
-
-~> **NOTE:** The `-versions` command option is only for KV v2.
diff --git a/website/content/docs/commands/kv/destroy.mdx b/website/content/docs/commands/kv/destroy.mdx
deleted file mode 100644
index e7d3b8816fd..00000000000
--- a/website/content/docs/commands/kv/destroy.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
----
-layout: docs
-page_title: kv destroy - Command
-description: |-
-  The "kv destroy" command permanently removes the specified version data for
-  the provided key and version numbers from the key-value store.
----
-
-# kv destroy
-
-~> **NOTE:** This is a [KV version 2](/vault/docs/secrets/kv/kv-v2) secrets
-engine command, and not available for Version 1.
-
-The `kv destroy` command permanently removes the specified versions' data
-from the key/value secrets engine. If no key exists at the path, no action is
-taken.
-
-## Examples
-
-Destroy version 11 of the key "creds":
-
-```shell-session
-$ vault kv destroy -mount=secret -versions=11 creds
-Success! Data written to: secret/destroy/creds
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-mount` `(string: "")` - Specifies the path where the KV backend is mounted. 
-  If specified, the next argument will be interpreted as the secret path. If 
-  this flag is not specified, the next argument will be interpreted as the 
-  combined mount path and secret path, with /data/ automatically inserted for 
-  KV v2 secrets.
-
-- `-versions` `([]int: <required>)` - The versions to destroy. Their data will
-  be permanently deleted.
diff --git a/website/content/docs/commands/kv/enable-versioning.mdx b/website/content/docs/commands/kv/enable-versioning.mdx
deleted file mode 100644
index 98cb3d03ac5..00000000000
--- a/website/content/docs/commands/kv/enable-versioning.mdx
+++ /dev/null
@@ -1,33 +0,0 @@
----
-layout: docs
-page_title: kv enable-versioning - Command
-description: |-
-  The "kv enable-versioning" command turns on versioning for the backend
-  at the provided path.
----
-
-# kv enable-versioning
-
-The `kv enable-versioning` command turns on versioning for an existing
-non-versioned key/value secrets engine (KV version 1) at its path.
-
-## Examples
-
-This command turns on versioning for the KV version 1 secrets engine enabled at
-"secret".
-
-```shell-session
-$ vault kv enable-versioning secret
-Success! Tuned the secrets engine at: secret/
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
diff --git a/website/content/docs/commands/kv/get.mdx b/website/content/docs/commands/kv/get.mdx
deleted file mode 100644
index c20e29afd97..00000000000
--- a/website/content/docs/commands/kv/get.mdx
+++ /dev/null
@@ -1,80 +0,0 @@
----
-layout: docs
-page_title: kv get - Command
-description: |-
-  The "kv get" command retrieves the value from Vault's key-value store at the
-  given key name. If no key exists with that name, an error is returned. If a
-  key exists with that name but has no data, nothing is returned.
----
-
-# kv get
-
-The `kv get` command retrieves the value from KV secrets engine at the given
-key name. If no key exists with that name, an error is returned. If a key exists
-with the name but has no data, nothing is returned.
-
-## Examples
-
-Retrieve the data of the key "creds":
-
-```shell-session
-$ vault kv get -mount=secret creds
-== Secret Path ==
-secret/data/creds
-
-======= Metadata =======
-Key                Value
----                -----
-created_time       2022-06-15T20:23:40.067093Z
-custom_metadata    <nil>
-deletion_time      n/a
-destroyed          false
-version            1
-
-====== Data ======
-Key         Value
----         -----
-passcode    my-long-passcode
-```
-
-If KV version 1 secrets engine is enabled at "secret", the output has no
-metadata since there is no versioning information associated with the data:
-
-```shell-session
-$ vault kv get -mount=secret creds
-====== Data ======
-Key         Value
----         -----
-passcode    my-long-passcode
-```
-
-Return only the "creds" "passcode" key:
-
-```shell-session
-$ vault kv get -mount=secret -field=passcode creds
-my-long-passcode
-```
-
-## Usage
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name. Specifying
-  this option will take precedence over other formatting directives. The result
-  will not have a trailing newline making it ideal for piping to other
-  processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-mount` `(string: "")` - Specifies the path where the KV backend is mounted. 
-  If specified, the next argument will be interpreted as the secret path. If 
-  this flag is not specified, the next argument will be interpreted as the 
-  combined mount path and secret path, with /data/ automatically inserted for 
-  KV v2 secrets.
-
-- `-version` `(int: 0)` - Specifies the version to return. If not set the
-  latest version is returned.
diff --git a/website/content/docs/commands/kv/index.mdx b/website/content/docs/commands/kv/index.mdx
deleted file mode 100644
index 3c644e28652..00000000000
--- a/website/content/docs/commands/kv/index.mdx
+++ /dev/null
@@ -1,141 +0,0 @@
----
-layout: docs
-page_title: kv - Command
-description: |-
-  The "kv" command groups subcommands for interacting with Vault's key/value
-  secret engine.
----
-
-# kv
-
-The `kv` command groups subcommands for interacting with Vault's key/value
-secrets engine (both [KV version 1](/vault/docs/secrets/kv/kv-v1) and [KV
-Version 2](/vault/docs/secrets/kv/kv-v2).
-
-## Syntax
-
-Option flags for a given subcommand are provided after the subcommand, but before the arguments.
-
-The path to where the secrets engine is mounted can be indicated with the `-mount` flag, such as `vault kv get -mount=secret creds`.
-
-The deprecated path-like syntax can also be used (e.g. `vault kv get secret/creds`), but this should be avoided
-for KV v2, because it is not actually the full API path to the secret 
-(secret/data/foo) and may cause confusion.
-
-~> A `flag provided but not defined: -mount` error means you are using an older version of Vault before the 
-mount flag syntax was introduced. Upgrade to at least Vault 1.11, or refer to previous versions of the docs 
-which only use the old syntax to refer to the mount path.
-
-## Examples
-
-Create or update the key named "creds" in the KV version 2 enabled at "secret"
-with the value "passcode=my-long-passcode":
-
-```shell-session
-$ vault kv put -mount=secret creds passcode=my-long-passcode
-== Secret Path ==
-secret/data/creds
-
-======= Metadata =======
-Key                Value
----                -----
-created_time       2022-06-15T20:14:17.107852Z
-custom_metadata    <nil>
-deletion_time      n/a
-destroyed          false
-version            1
-```
-
-Read this value back:
-
-```shell-session
-$ vault kv get -mount=secret creds
-== Secret Path ==
-secret/data/creds
-
-======= Metadata =======
-Key                Value
----                -----
-created_time       2022-06-15T20:14:17.107852Z
-custom_metadata    <nil>
-deletion_time      n/a
-destroyed          false
-version            1
-
-====== Data ======
-Key         Value
----         -----
-passcode    my-long-passcode
-```
-
-Get metadata for the key named "creds":
-
-```shell-session
-$ vault kv metadata get -mount=secret creds
-=== Metadata Path ===
-secret/metadata/creds
-
-========== Metadata ==========
-Key                     Value
----                     -----
-cas_required            false
-created_time            2022-06-15T20:14:17.107852Z
-current_version         1
-custom_metadata         <nil>
-delete_version_after    0s
-max_versions            0
-oldest_version          0
-updated_time            2022-06-15T20:14:17.107852Z
-
-====== Version 1 ======
-Key              Value
----              -----
-created_time     2022-06-15T20:14:17.107852Z
-deletion_time    n/a
-destroyed        false
-```
-
-Get a specific version of the key named "creds":
-
-```shell-session
-$ vault kv get -mount=secret -version=1 creds
-== Secret Path ==
-secret/data/creds
-
-======= Metadata =======
-Key                Value
----                -----
-created_time       2022-06-15T20:14:17.107852Z
-custom_metadata    <nil>
-deletion_time      n/a
-destroyed          false
-version            1
-
-====== Data ======
-Key         Value
----         -----
-passcode    my-long-passcode
-```
-
-## Usage
-
-```text
-Usage: vault kv <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    delete               Deletes versions in the KV store
-    destroy              Permanently removes one or more versions in the KV store
-    enable-versioning    Turns on versioning for a KV store
-    get                  Retrieves data from the KV store
-    list                 List data or secrets
-    metadata             Interact with Vault's Key-Value storage
-    patch                Sets or updates data in the KV store without overwriting
-    put                  Sets or updates data in the KV store
-    rollback             Rolls back to a previous version of data
-    undelete             Undeletes versions in the KV store
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/kv/list.mdx b/website/content/docs/commands/kv/list.mdx
deleted file mode 100644
index c28c0cc1547..00000000000
--- a/website/content/docs/commands/kv/list.mdx
+++ /dev/null
@@ -1,49 +0,0 @@
----
-layout: docs
-page_title: kv list - Command
-description: |-
-  The "kv list" command lists data from Vault's KV secrets engine at the given
-  path.
----
-
-# kv list
-
-The `kv list` command returns a list of key names at the specified location.
-Folders are suffixed with /. The input must be a folder; list on a file will not
-return a value. Note that no policy-based filtering is performed on keys; do not
-encode sensitive information in key names. The values themselves are not
-accessible via this command.
-
-Use this command to list all existing key names at a specific path.
-
-## Examples
-
-List values under the key "my-app":
-
-```shell-session
-$ vault kv list -mount=secret my-app/
-Keys
-----
-admin_creds
-domain
-eng_creds
-qa_creds
-release
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
-
-### Output options
-
-- `-mount` `(string: "")` - Specifies the path where the KV backend is mounted.
-  If specified, the next argument will be interpreted as the secret path. If
-  this flag is not specified, the next argument will be interpreted as the
-  combined mount path and secret path, with /data/ automatically inserted for
-  KV v2 secrets.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
diff --git a/website/content/docs/commands/kv/metadata.mdx b/website/content/docs/commands/kv/metadata.mdx
deleted file mode 100644
index c1c571845d9..00000000000
--- a/website/content/docs/commands/kv/metadata.mdx
+++ /dev/null
@@ -1,163 +0,0 @@
----
-layout: docs
-page_title: kv metadata - Command
-description: |-
-  The "kv metadata" command has subcommands for interacting with the metadata
-  endpoint in Vault's key-value store.
----
-
-# kv metadata
-
-~> **NOTE:** This is a [KV version 2](/vault/docs/secrets/kv/kv-v2) secrets
-engine command, and not available for Version 1.
-
-The `kv metadata` command has subcommands for interacting with the metadata and
-versions for the versioned secrets (KV version 2 secrets engine) at the
-specified path.
-
-## Usage
-
-```text
-Usage: vault kv metadata <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    delete    Deletes all versions and metadata for a key in the KV store
-    get       Retrieves key metadata from the KV store
-    put       Sets or updates key settings in the KV store
-```
-
-### kv metadata delete
-
-The `kv metadata delete` command deletes all versions and metadata for the
-provided key.
-
-#### Examples
-
-Deletes all versions and metadata of the key "creds":
-
-```shell-session
-$ vault kv metadata delete -mount=secret creds
-Success! Data deleted (if it existed) at: secret/metadata/creds
-```
-
-### kv metadata get
-
-The `kv metadata get` command retrieves the metadata of the versioned secrets at
-the given key name. If no key exists with that name, an error is returned.
-
-#### Examples
-
-Retrieves the metadata of the key name, "creds":
-
-```shell-session
-$ vault kv metadata get -mount=secret creds
-=== Metadata Path ===
-secret/metadata/creds
-
-========== Metadata ==========
-Key                     Value
----                     -----
-cas_required            false
-created_time            2019-06-28T15:53:30.395814Z
-current_version         5
-delete_version_after    0s
-max_versions            0
-oldest_version          0
-updated_time            2019-06-28T16:01:47.40064Z
-
-====== Version 1 ======
-Key              Value
----              -----
-created_time     2019-06-28T15:53:30.395814Z
-deletion_time    n/a
-destroyed        false
-
-====== Version 2 ======
-Key              Value
----              -----
-created_time     2019-06-28T16:01:36.676912Z
-deletion_time    n/a
-destroyed        false
-
-...
-```
-
-### kv metadata put
-
-The `kv metadata put` command can be used to create a blank key in the KV v2
-secrets engine or to update key configuration for a specified key.
-
-#### Examples
-
-Create a key in the KV v2 with no data at the key "creds":
-
-```shell-session
-$ vault kv metadata put -mount=secret creds
-Success! Data written to: secret/metadata/creds
-```
-
-Set the maximum number of versions to keep for the key "creds":
-
-```shell-session
-$ vault kv metadata put -mount=secret -max-versions=5 creds
-Success! Data written to: secret/metadata/creds
-```
-
-**NOTE:** If not set, the backend’s configured max version is used. Once a key
-has more than the configured allowed versions the oldest version will be
-permanently deleted.
-
-Require Check-and-Set for the key "creds":
-
-```shell-session
-$ vault kv metadata put -mount=secret -cas-required creds
-```
-
-**NOTE:** When check-and-set is required, the key will require the `cas`
-parameter to be set on all write requests. Otherwise, the backend’s
-configuration will be used.
-
-Set the length of time before a version is deleted for the key "creds":
-
-```shell-session
-$ vault kv metadata put -mount=secret -delete-version-after="3h25m19s" creds
-```
-
-**NOTE:** If not set, the backend's configured Delete-Version-After is used. If
-set to a duration greater than the backend's, the backend's Delete-Version-After
-setting will be used. Any changes to the Delete-Version-After setting will only
-be applied to new versions.
-
-#### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-#### Subcommand options
-
-- `-cas-required` `(bool: false)` - If true the key will require the cas
-  parameter to be set on all write requests. If false, the backend’s
-  configuration will be used. The default is false.
-
-- `-max-versions` `(int: 0)` - The number of versions to keep per key. If not
-  set, the backend’s configured max version is used. Once a key has more than the
-  configured allowed versions the oldest version will be permanently deleted.
-
-- `-delete-version-after` `(string:"0s")` – Set the `delete-version-after` value
-  to a duration to specify the `deletion_time` for all new versions written to
-  this key. If not set, the backend's `delete_version_after` will be used. If
-  the value is greater than the backend's `delete_version_after`, the backend's
-  `delete_version_after` will be used. Accepts [duration format strings](/vault/docs/concepts/duration-format).
-
-- `-custom-metadata` `(string: "")` - Specifies a key-value pair for the
-  `custom_metadata` field. This can be specified multiple times to add multiple
-  pieces of metadata.
-
-- `-mount` `(string: "")` - Specifies the path where the KV backend is mounted. 
-  If specified, the next argument will be interpreted as the secret path. If 
-  this flag is not specified, the next argument will be interpreted as the 
-  combined mount path and secret path, with /data/ automatically inserted for 
-  KV v2 secrets.
diff --git a/website/content/docs/commands/kv/patch.mdx b/website/content/docs/commands/kv/patch.mdx
deleted file mode 100644
index c0f87e47d2c..00000000000
--- a/website/content/docs/commands/kv/patch.mdx
+++ /dev/null
@@ -1,91 +0,0 @@
----
-layout: docs
-page_title: kv patch - Command
-description: |-
-  The "kv patch" command writes the data to the given path in the key-value
-  store. The data can be of any type.
----
-
-# kv patch
-
-~> **NOTE:** This is a [KV version 2](/vault/docs/secrets/kv/kv-v2) secrets
-engine command, and not available for Version 1.
-
-The `kv patch` command writes the data to the given path in the KV v2 secrets
-engine. The data can be of any type. Unlike the `kv put` command, the `patch`
-command combines the change with existing data instead of replacing them.
-Therefore, this command makes it easy to make a partial updates to an existing
-data.
-
-## Examples
-
-If you wish to add an additional key-value (`ttl=48h`) to the existing data at
-the key "creds":
-
-```shell-session
-$ vault kv patch -mount=secret creds ttl=48h
-== Secret Path ==
-secret/data/creds
-
-======= Metadata =======
-Key              Value
----              -----
-created_time     2019-06-06T16:46:22.090654Z
-deletion_time    n/a
-destroyed        false
-version          6
-```
-
-**NOTE:** The `kv put` command requires both the existing data and
-the data you wish to add in order to accomplish the same result.
-
-```shell-session
-$ vault kv put -mount=secret creds ttl=48h passcode=my-long-passcode
-```
-
-The data can also be consumed from a file on disk by prefixing with the "@"
-symbol. For example:
-
-```shell-session
-$ vault kv patch -mount=secret creds @data.json
-```
-
-Or it can be read from stdin using the "-" symbol:
-
-```shell-session
-$ echo "abcd1234" | vault kv patch -mount=secret foo bar=-
-```
-
-## Usage
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name. Specifying
-  this option will take precedence over other formatting directives. The result
-  will not have a trailing newline making it ideal for piping to other
-  processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-method` `(string: "patch")` - Specifies the patch method to use. Valid
-  methods are `patch` and `rw`. The `patch` method uses an HTTP `PATCH` request
-  to apply the partial update. The `rw` method will fetch the secret's data,
-  perform an in-memory update, and write the updated data.
-
-- `-cas` `(int: 0)` - Specifies the value to use for the Check-And-Set operation.
-  This flag will only be used for the `patch` method. This flag is required if
-  `cas_required` is set to `true` on either the secret or the engine's config.
-  In order for a `patch` to be successful, `-cas` must be set to the current
-  version of the secret. This flag will be ignored for the `rw` method.
-  Instead, its value will be derived from fetching the current version of the
-  secret.
-
-- `-mount` `(string: "")` - Specifies the path where the KV backend is mounted. 
-  If specified, the next argument will be interpreted as the secret path. If 
-  this flag is not specified, the next argument will be interpreted as the 
-  combined mount path and secret path, with /data/ automatically inserted for 
-  KV v2 secrets.
diff --git a/website/content/docs/commands/kv/put.mdx b/website/content/docs/commands/kv/put.mdx
deleted file mode 100644
index 4384a2942ba..00000000000
--- a/website/content/docs/commands/kv/put.mdx
+++ /dev/null
@@ -1,74 +0,0 @@
----
-layout: docs
-page_title: kv put - Command
-description: |-
-  The "kv put" command writes the data to the given path in the KV secrets
-  engine. The data can be of any type.
----
-
-# kv put
-
-The `kv put` command writes the data to the given path in the KV secrets
-engine.
-
-If working with KV v2, this command creates a new version of a secret at the
-specified location. If working with KV v1, this command stores the given secret
-at the specified location.
-
-Regardless of the KV version, if the value does not yet exist at the specified
-path, the calling token must have an ACL policy granting the "create"
-capability. If the value already exists, the calling token must have an ACL
-policy granting the "update" capability.
-
-## Examples
-
-Writes the data to the key "creds":
-
-```shell-session
-$ vault kv put -mount=secret creds passcode=my-long-passcode
-```
-
-The data can also be consumed from a file on disk by prefixing with the "@"
-symbol. For example:
-
-```shell-session
-$ vault kv put -mount=secret foo @data.json
-```
-
-Or it can be read from stdin using the "-" symbol:
-
-```shell-session
-$ echo "abcd1234" | vault kv put -mount=secret foo bar=-
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name. Specifying
-  this option will take precedence over other formatting directives. The result
-  will not have a trailing newline making it ideal for piping to other
-  processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-cas` `(int: 0)` - Specifies to use a Check-And-Set operation. If not set the
-  write will be allowed. In order for a write to be successful, `cas` must be set to 
-  the current version of the secret. If set to 0 a write will only be allowed if 
-  the key doesn’t exist as unset keys do not have any version information. Also 
-  remember that soft deletes do not remove any underlying version data from storage.
-  In order to write to a soft deleted key, the cas parameter must match the key's 
-  current version. The default is -1.
-
-- `-mount` `(string: "")` - Specifies the path where the KV backend is mounted. 
-  If specified, the next argument will be interpreted as the secret path. If 
-  this flag is not specified, the next argument will be interpreted as the 
-  combined mount path and secret path, with /data/ automatically inserted for 
-  KV v2 secrets.
diff --git a/website/content/docs/commands/kv/rollback.mdx b/website/content/docs/commands/kv/rollback.mdx
deleted file mode 100644
index 58897c1e338..00000000000
--- a/website/content/docs/commands/kv/rollback.mdx
+++ /dev/null
@@ -1,54 +0,0 @@
----
-layout: docs
-page_title: kv rollback - Command
-description: |-
-  The "kv rollback" command restores a given previous version to the current
-  version at the given path.
----
-
-# kv rollback
-
-~> **NOTE:** This is a [KV version 2](/vault/docs/secrets/kv/kv-v2) secrets
-engine command, and not available for Version 1.
-
-The `kv rollback` command restores a given previous version to the current
-version at the given path. The value is written as a new version; for instance,
-if the current version is 5 and the rollback version is 2, the data from version
-2 will become version 6. This command makes it easy to restore unintentionally
-overwritten data.
-
-## Examples
-
-Restores the version 2 of the data at key "creds":
-
-```shell-session
-$ vault kv rollback -mount=secret -version=2 creds
-Key              Value
----              -----
-created_time     2019-06-06T17:07:19.299831Z
-deletion_time    n/a
-destroyed        false
-version          6
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-mount` `(string: "")` - Specifies the path where the KV backend is mounted. 
-  If specified, the next argument will be interpreted as the secret path. If 
-  this flag is not specified, the next argument will be interpreted as the 
-  combined mount path and secret path, with /data/ automatically inserted for 
-  KV v2 secrets.
-
-- `-version` `(int: 0)` - Specifies the version number that should be made
-  current again.
diff --git a/website/content/docs/commands/kv/undelete.mdx b/website/content/docs/commands/kv/undelete.mdx
deleted file mode 100644
index 5933b00cca6..00000000000
--- a/website/content/docs/commands/kv/undelete.mdx
+++ /dev/null
@@ -1,48 +0,0 @@
----
-layout: docs
-page_title: kv undelete - Command
-description: |-
-  The "kv undelete" command undeletes the data for the provided version and path
-  in the key-value store. This restores the data, allowing it to be returned on
-  get requests.
----
-
-# kv undelete
-
-~> **NOTE:** This is a [KV version 2](/vault/docs/secrets/kv/kv-v2) secrets
-engine command, and not available for Version 1.
-
-The `kv undelete` command undoes the deletes of the data for the provided version
-and path in the key-value store. This restores the data, allowing it to be
-returned on get requests.
-
-## Examples
-
-Undelete version 3 of the key "creds":
-
-```shell-session
-$ vault kv undelete -mount=secret -versions=3 creds
-Success! Data written to: secret/undelete/creds
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-mount` `(string: "")` - Specifies the path where the KV backend is mounted. 
-  If specified, the next argument will be interpreted as the secret path. If 
-  this flag is not specified, the next argument will be interpreted as the 
-  combined mount path and secret path, with /data/ automatically inserted for 
-  KV v2 secrets.
-
-- `-versions` `([]int: <required>)` - Specifies the version number that should
-  be made current again.
diff --git a/website/content/docs/commands/lease/index.mdx b/website/content/docs/commands/lease/index.mdx
deleted file mode 100644
index b1de95902fe..00000000000
--- a/website/content/docs/commands/lease/index.mdx
+++ /dev/null
@@ -1,62 +0,0 @@
----
-layout: docs
-page_title: lease - Command
-description: |-
-  The "lease" command groups subcommands for interacting with leases attached to
-  secrets.
----
-
-# lease
-
-The `lease` command groups subcommands for interacting with leases attached to
-secrets. For leases attached to tokens, use the [`vault token`](/vault/docs/commands/token) subcommand.
-
-## Examples
-
-Lookup a lease:
-
-```shell-session
-$ vault lease lookup database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-Key             Value
----             -----
-expire_time     2021-03-17T11:55:50.755313-05:00
-id              database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-issue_time      2021-03-17T11:45:50.755312-05:00
-last_renewal    <nil>
-renewable       true
-ttl             9m52s
-```
-
-Renew a lease:
-
-```shell-session
-$ vault lease renew database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-Key                Value
----                -----
-lease_id           database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-lease_duration     5m
-lease_renewable    true
-```
-
-Revoke a lease:
-
-```shell-session
-$ vault lease revoke database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-Success! Revoked lease: database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-```
-
-## Usage
-
-```text
-Usage: vault lease <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    lookup    Lookup lease information by lease id
-    renew     Renews the lease of a secret
-    revoke    Revokes leases and secrets
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/lease/lookup.mdx b/website/content/docs/commands/lease/lookup.mdx
deleted file mode 100644
index 6d9aed6d3ca..00000000000
--- a/website/content/docs/commands/lease/lookup.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: lease lookup - Command
-description: |-
-  The "lease lookup" command retrieves information about a lease.
----
-
-# lease lookup
-
-The `lease lookup` command retrieves information on the lease of a secret.
-
-Every secret in Vault has a lease associated with it. Users can look up
-information on the lease by referencing the lease ID.
-
-## Examples
-
-Lookup a lease:
-
-```shell-session
-$ vault lease lookup database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-Key             Value
----             -----
-expire_time     2021-03-17T11:55:50.755313-05:00
-id              database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-issue_time      2021-03-17T11:45:50.755312-05:00
-last_renewal    <nil>
-renewable       true
-ttl             9m52s
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/lease/renew.mdx b/website/content/docs/commands/lease/renew.mdx
deleted file mode 100644
index f90ec757d7b..00000000000
--- a/website/content/docs/commands/lease/renew.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
----
-layout: docs
-page_title: lease renew - Command
-description: |-
-  The "lease renew" command renews the lease on a secret, extending the time
-  that it can be used before it is revoked by Vault.
----
-
-# lease renew
-
-The `lease renew` command renews the lease on a secret, extending the time that
-it can be used before it is revoked by Vault.
-
-Every secret in Vault has a lease associated with it. If the owner of the secret
-wants to use it longer than the lease, then it must be renewed. Renewing the
-lease does not change the contents of the secret.
-
-## Examples
-
-Renew a lease:
-
-```shell-session
-$ vault lease renew database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-Key                Value
----                -----
-lease_id           database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-lease_duration     5m
-lease_renewable    true
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-- `-increment` `(duration: "")` - Request a specific increment in seconds. Vault
-  is not required to honor this request.
diff --git a/website/content/docs/commands/lease/revoke.mdx b/website/content/docs/commands/lease/revoke.mdx
deleted file mode 100644
index dc8618fc8dc..00000000000
--- a/website/content/docs/commands/lease/revoke.mdx
+++ /dev/null
@@ -1,45 +0,0 @@
----
-layout: docs
-page_title: lease revoke - Command
-description: |-
-  The "lease revoke" command revokes the lease on a secret, invalidating the
-  underlying secret.
----
-
-# lease revoke
-
-The `lease revoke` command revokes the lease on a secret, invalidating the
-underlying secret.
-
-## Examples
-
-Revoke a lease:
-
-```shell-session
-$ vault lease revoke database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-Success! Revoked lease: database/creds/readonly/27e1b9a1-27b8-83d9-9fe0-d99d786bdc83
-```
-
-Revoke a lease which starts with a prefix:
-
-```shell-session
-$ vault lease revoke -prefix database/creds
-Success! Revoked any leases with prefix: database/creds
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-- `-force` `(bool: false)` - Delete the lease from Vault even if the secret
-  engine revocation fails. This is meant for recovery situations where the
-  secret in the target secrets engine was manually removed. If this flag is
-  specified, -prefix is also required. This is aliased as "-f". The default is
-  false.
-
-- `-prefix` `(bool: false)` - Treat the ID as a prefix instead of an exact lease
-  ID. This can revoke multiple leases simultaneously. The default is false.
-
-- `-sync` `(bool: false)` - Make the operation synchronous instead of queuing the
-revocations to be done in the background.
diff --git a/website/content/docs/commands/license/get.mdx b/website/content/docs/commands/license/get.mdx
deleted file mode 100644
index afddfbc51ca..00000000000
--- a/website/content/docs/commands/license/get.mdx
+++ /dev/null
@@ -1,52 +0,0 @@
----
-layout: docs
-page_title: license get - Command
-description: |-
-  The "license get" command reports on the license in use.
----
-
-# license get
-
-The `license get` command reports on the license in use.  With the `-signed`
-flag, it will return the actual license string, but only if the license
-is stored, as opposed to [autoloaded](/vault/docs/enterprise/license/autoloading).
-
-## Examples
-
-Describe current license:
-
-```shell-session
-$ vault license get
-Key                          Value
----                          -----
-expiration_time              2022-05-17T23:59:59Z
-features                     [HSM Performance Replication DR Replication MFA Sentinel Seal Wrapping Control Groups Performance Standby Namespaces KMIP Entropy Augmentation Transform Secrets Engine Lease Count Quotas Key Management Secrets Engine Automated Snapshots]
-license_id                   060d7820-fa59-f95c-832b-395db0aeb9ba
-performance_standby_count    9999
-start_time                   2021-05-17T00:00:00Z
-termination_time             2031-05-17T23:59:59Z
-```
-
-Get stored license string:
-
-```shell-session
-$ vault license get -signed
-02MV4UU43BK5H...
-```
-
-Try to get stored license string when using autoloading:
-
-```shell-session
-$ vault license get -signed
-License not found or using a temporary license.
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Command options
-
-- `-signed` `(bool: false)` - Return the signed license string when using a
-stored license.
diff --git a/website/content/docs/commands/license/index.mdx b/website/content/docs/commands/license/index.mdx
deleted file mode 100644
index 4ebe8c193b4..00000000000
--- a/website/content/docs/commands/license/index.mdx
+++ /dev/null
@@ -1,60 +0,0 @@
----
-layout: docs
-page_title: license - Command
-description: |-
-  The "license" command groups subcommands for interacting with Vault licenses.
----
-
-# license
-
-The `license` command groups subcommands for interacting with Vault licenses
-
-For more information, please see the [license documentation](/vault/docs/enterprise/license)
-
-## Examples
-
-Query current license in use by a node:
-
-```shell-session
-$ vault license get
-Key                          Value
----                          -----
-expiration_time              2022-05-17T23:59:59.999Z
-features                     [HSM Performance Replication DR Replication MFA Sentinel Seal Wrapping Control Groups Performance Standby Namespaces KMIP Entropy Augmentation Transform Secrets Engine Lease Count Quotas Key Management Secrets Engine Automated Snapshots]
-license_id                   060d7820-fa59-f95c-832b-395db0aeb9ba
-performance_standby_count    9999
-start_time                   2021-05-17T00:00:00Z
-```
-
-Inspect a license string:
-
-```shell-session
-$ vault license inspect ~/vaults/license
-Source: /Users/ncc/vaults/license
-Product: vault
-License ID: 060d7820-fa59-f95c-832b-395db0aeb9ba
-Customer ID: 5401ae3b-136b-3e47-3b43-432927fa03e7
-Installation ID: *
-Issue Time: 2021-05-17 19:33:47.93981585 +0000 UTC
-Start Time: 2021-05-17 00:00:00 +0000 UTC
-Expiration Time: 2022-05-17 23:59:59.999 +0000 UTC
-{"license_id":"060d7820-fa59-f95c-832b-395db0aeb9ba","customer_id":"5401ae3b-136b-3e47-3b43-432927fa03e7","installation_id":"*","issue_time":"2021-05-17T19:33:47.93981585Z","start_time":"2021-05-17T00:00:00Z","expiration_time":"2022-05-17T23:59:59.999Z","flags":{"modules":["multi-dc-scale","governance-policy","advanced-data-protection"]},"features":["HSM","Performance Replication","DR Replication","MFA","Sentinel","Seal Wrapping","Control Groups","Performance Standby","Namespaces","KMIP","Entropy Augmentation","Transform Secrets Engine","Lease Count Quotas","Key Management Secrets Engine","Automated Snapshots"],"performance_standby_count":9999}
-
-License is valid
-
-```
-
-## Usage
-
-```text
-Usage: vault license <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    get      Query Vault's license
-    inspect  View the contents of a license string
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/license/inspect.mdx b/website/content/docs/commands/license/inspect.mdx
deleted file mode 100644
index 40b973e13ad..00000000000
--- a/website/content/docs/commands/license/inspect.mdx
+++ /dev/null
@@ -1,58 +0,0 @@
----
-layout: docs
-page_title: license inspect - Command
-description: |-
-  The "license inspect" command describes the contents of a signed license string.
----
-
-# license inspect
-
-The `license inspect` command describes the contents of a signed license string.
-
-## Examples
-
-Describe license in the environment (either `VAULT_LICENSE` for a raw value
-or `VAULT_LICENSE_PATH` for the path to a file containing the value):
-
-```shell-session
-$ vault license inspect
-Source: /Users/ncc/vaults/license
-Product: vault
-License ID: 060d7820-fa59-f95c-832b-395db0aeb9ba
-Customer ID: 5401ae3b-136b-3e47-3b43-432927fa03e7
-Installation ID: *
-Issue Time: 2021-05-17 19:33:47.93981585 +0000 UTC
-Start Time: 2021-05-17 00:00:00 +0000 UTC
-Expiration Time: 2022-05-17 23:59:59.999 +0000 UTC
-Termination Time: 2031-05-17 23:59:59.999 +0000 UTC
-{"license_id":"060d7820-fa59-f95c-832b-395db0aeb9ba","customer_id":"5401ae3b-136b-3e47-3b43-432927fa03e7","installation_id":"*","issue_time":"2021-05-17T19:33:47.93981585Z","start_time":"2021-05-17T00:00:00Z","expiration_time":"2022-05-17T23:59:59.999Z","flags":{"modules":["multi-dc-scale","governance-policy","advanced-data-protection"]},"features":["HSM","Performance Replication","DR Replication","MFA","Sentinel","Seal Wrapping","Control Groups","Performance Standby","Namespaces","KMIP","Entropy Augmentation","Transform Secrets Engine","Lease Count Quotas","Key Management Secrets Engine","Automated Snapshots"],"performance_standby_count":9999}
-
-License is valid
-```
-
-Describe license at given path:
-
-```shell-session
-$ vault license inspect ~/vaults/license
-Source: /Users/ncc/vaults/license
-Product: vault
-License ID: 060d7820-fa59-f95c-832b-395db0aeb9ba
-Customer ID: 5401ae3b-136b-3e47-3b43-432927fa03e7
-Installation ID: *
-Issue Time: 2021-05-17 19:33:47.93981585 +0000 UTC
-Start Time: 2021-05-17 00:00:00 +0000 UTC
-Expiration Time: 2022-05-17 23:59:59.999 +0000 UTC
-Termination Time: 2031-05-17 23:59:59.999 +0000 UTC
-{"license_id":"060d7820-fa59-f95c-832b-395db0aeb9ba","customer_id":"5401ae3b-136b-3e47-3b43-432927fa03e7","installation_id":"*","issue_time":"2021-05-17T19:33:47.93981585Z","start_time":"2021-05-17T00:00:00Z","expiration_time":"2022-05-17T23:59:59.999Z","flags":{"modules":["multi-dc-scale","governance-policy","advanced-data-protection"]},"features":["HSM","Performance Replication","DR Replication","MFA","Sentinel","Seal Wrapping","Control Groups","Performance Standby","Namespaces","KMIP","Entropy Augmentation","Transform Secrets Engine","Lease Count Quotas","Key Management Secrets Engine","Automated Snapshots"],"performance_standby_count":9999}
-
-License is valid
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Command options
-
-- `-installation-id` `(string: "")` - Installation ID to validate the license against
diff --git a/website/content/docs/commands/list.mdx b/website/content/docs/commands/list.mdx
deleted file mode 100644
index 9caed719a0f..00000000000
--- a/website/content/docs/commands/list.mdx
+++ /dev/null
@@ -1,25 +0,0 @@
----
-layout: docs
-page_title: list - Command
-description: |-
-  The "list" command lists data from Vault at the given path. This can be used
-  to list keys in a, given secrets engine.
----
-
-# list
-
-The `list` command lists data from Vault at the given path (wrapper command for
-HTTP LIST). This can be used to list keys in a given secrets engine.
-
-## Examples
-
-List available entities by their identifiers:
-
-```shell-session
-$ vault list identity/entity/id
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/login.mdx b/website/content/docs/commands/login.mdx
deleted file mode 100644
index 58070604b3b..00000000000
--- a/website/content/docs/commands/login.mdx
+++ /dev/null
@@ -1,156 +0,0 @@
----
-layout: docs
-page_title: login - Command
-description: |-
-  The "login" command authenticates users or machines to Vault using the
-  provided arguments. A successful authentication results in a Vault token -
-  conceptually similar to a session token on a website.
----
-
-# login
-
-The `login` command authenticates users or machines to Vault using the provided
-arguments. A successful authentication results in a Vault token - conceptually
-similar to a session token on a website. By default, this token is cached on the
-local machine for future requests.
-
-The `-method` flag allows using other auth methods, such as userpass,
-github, or cert. For these, additional "K=V" pairs may be required. For more
-information about the list of configuration parameters available for a given
-auth method, use the "vault auth help TYPE" command. You can also use "vault
-auth list" to see the list of enabled auth methods.
-
-If an auth method is enabled at a non-standard path, the `-method`
-flag still refers to the canonical type, but the `-path` flag refers to the
-enabled path.
-
-If the authentication is requested with response wrapping (via `-wrap-ttl`),
-the returned token is automatically unwrapped unless:
-
-- The `-token-only` flag is used, in which case this command will output
-  the wrapping token.
-
-- The `-no-store` flag is used, in which case this command will output the
-  details of the wrapping token.
-
-## Examples
-
-By default, login uses a "token" method and reads from stdin:
-
-```shell-session
-$ vault login
-Token (will be hidden):
-Success! You are now authenticated. The token information displayed below
-is already stored in the token helper. You do NOT need to run "vault login"
-again. Future Vault requests will automatically use this token.
-
-Key                  Value
----                  -----
-token                s.nDj4BB2tK8NaFffwBZBxyIa1
-token_accessor       ZuaObqdTeCHZ4oa9HWmdQJuZ
-token_duration       ∞
-token_renewable      false
-token_policies       ["root"]
-identity_policies    []
-policies             ["root"]
-```
-
-Alternatively, the token may be provided as a command line argument (note that
-this may be captured by shell history or process listings):
-
-```shell-session
-$ vault login s.3jnbMAKl1i4YS3QoKdbHzGXq
-Success! You are now authenticated. The token information displayed below
-is already stored in the token helper. You do NOT need to run "vault login"
-again. Future Vault requests will automatically use this token.
-
-Key                  Value
----                  -----
-token                s.3jnbMAKl1i4YS3QoKdbHzGXq
-token_accessor       7Uod1Rm0ejUAz77Oh7SxpAM0
-token_duration       767h59m49s
-token_renewable      true
-token_policies       ["admin" "default"]
-identity_policies    []
-policies             ["admin" "default"]
-```
-
-To login with a different method, use `-method`:
-
-```shell-session
-$ vault login -method=userpass username=my-username
-Password (will be hidden):
-Success! You are now authenticated. The token information below is already
-stored in the token helper. You do NOT need to run "vault login" again. Future
-requests will use this token automatically.
-
-Key                    Value
----                    -----
-token                  s.2y4SU3Sk46dK3p2Y8q2jSBwL
-token_accessor         8J125x9SZyB76MI9uF2jSJZf
-token_duration         768h
-token_renewable        true
-token_policies         ["default"]
-identity_policies      []
-policies               ["default"]
-token_meta_username    my-username
-```
-
-~> Notice that the command option (`-method=userpass`) precedes the command
-argument (`username=my-username`).
-
-If a github auth method was enabled at the path "github-prod":
-
-```shell-session
-$ vault login -method=github -path=github-prod
-Success! You are now authenticated. The token information below is already
-stored in the token helper. You do NOT need to run "vault login" again. Future
-requests will use this token automatically.
-
-Key                    Value
----                    -----
-token                  s.2f3c5L1MHtnqbuNCbx90utmC
-token_accessor         JLUIXJ6ltUftTt2UYRl2lTAC
-token_duration         768h
-token_renewable        true
-token_policies         ["default"]
-identity_policies      []
-policies               ["default"]
-token_meta_org         hashicorp
-token_meta_username    my-username
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name, in the format
-  specified in the `-format` directive. The result will not have a trailing
-  newline making it ideal for piping to other processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-method` `(string "token")` - Type of authentication to use such as
-  "userpass" or "ldap". Note this corresponds to the TYPE, not the enabled path.
-  Use -path to specify the path where the authentication is enabled.
-
-- `-no-print` `(bool: false)` - Do not display the token. The token will
-  still be stored to the configured token helper. The default is false.
-
-- `-no-store` `(bool: false)` - Do not persist the token to the token helper
-  (usually the local filesystem) after authentication for use in future
-  requests. The token will only be displayed in the command output.
-
-- `-path` `(string: "")` - Remote path in Vault where the auth method
-  is enabled. This defaults to the TYPE of method (e.g. userpass -> userpass/).
-
-- `-token-only` `(bool: false)` - Output only the token with no verification.
-  This flag is a shortcut for "-field=token -no-store". Setting those
-  flags to other values will have no affect.
diff --git a/website/content/docs/commands/monitor.mdx b/website/content/docs/commands/monitor.mdx
deleted file mode 100644
index 53af78d0520..00000000000
--- a/website/content/docs/commands/monitor.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
----
-layout: docs
-page_title: monitor - Command
-description: |-
-  The "monitor" command displays the server logs of a Vault server in real
-  time.
----
-
-# monitor
-
-The `monitor` command shows a real time display of the server logs of a Vault
-server. This command accepts a log level as an argument, which can be different
-from the log level that the Vault server was started with.
-
-The `monitor` command honors the `VAULT_ADDR` environment variable. The address
-specified determines the target server that will be monitored.
-
-Note that this command is designed to run indefinitely. It is similar to
-`tail -f` in the Unix world. This command will not exit on its own unless
-it encounters an unexpected error. As a user, you must terminate this
-process yourself to shut it down.
-
-If Vault is emitting log messages faster than a receiver can process them, the
-some log lines will be dropped.
-
-## Examples
-
-Monitor server logs at the `debug` log level:
-
-```shell-session
-$ vault monitor -log-level=debug
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-log-level` `(string: "info")` - Monitor the Vault server at this log level.
-  Valid log levels are (in order of detail) "trace", "debug", "info",
-  "warn", "error". If this option is not specified, "info" is used.
-
-- `-log-format` `(string: "standard")` - Format to emit logs.
-  Valid formats are "standard", and "json". 
-  If this option is not specified, "standard" is used.
diff --git a/website/content/docs/commands/namespace.mdx b/website/content/docs/commands/namespace.mdx
deleted file mode 100644
index d52a3fa88af..00000000000
--- a/website/content/docs/commands/namespace.mdx
+++ /dev/null
@@ -1,98 +0,0 @@
----
-layout: docs
-page_title: namespace - Command
-description: The "namespace" command groups subcommands for interacting with namespaces.
----
-
-# namespace
-
-The `namespace` command groups subcommands for interacting with namespaces.
-
-## Examples
-
-List all namespaces:
-
-```shell-session
-$ vault namespace list
-```
-
-List all namespaces with additional details such as namespace ID and custom metadata:
-
-```shell-session
-$ vault namespace list -detailed
-```
-
-Create a namespace at the path `ns1/` with no custom metadata:
-
-```shell-session
-$ vault namespace create ns1/
-```
-
-Create a namespace at the path `ns1/` with multiple custom metadata keys:
-
-```shell-session
-$ vault namespace create -custom-metadata=foo=abc -custom-metadata=bar=123 ns1/
-```
-
-Patch an existing namespace at the path `ns1/` to add custom metadata key `bar` and remove key `foo`
-
-```shell-session
-$ vault namespace patch -custom-metadata=bar=123 -remove-custom-metadata=foo ns1/
-```
-
-Delete the namespace at path `ns1/`:
-
-```shell-session
-$ vault namespace delete ns1/
-```
-
-Lookup the namespace information at path `ns1/`:
-
-```shell-session
-$ vault namespace lookup ns1/
-```
-
-Lock the API for the current namespace:
-
-```shell-session
-$ vault namespace lock
-```
-
-Lock the API for a descendant namespace at path `current/namespace/ns1/`:
-
-```shell-session
-$ vault namespace lock ns1/
-```
-
-Unlock the API for the current namespace:
-
-```shell-session
-$ vault namespace unlock -unlock-key <unlock key>
-```
-
-Unlock the API for a descendant namespace at path `current/namespacens1/`:
-
-```shell-session
-$ vault namespace unlock -unlock-key <unlock key> ns1/
-```
-
-## Usage
-
-```text
-Usage: vault namespace <subcommand> [options] [args]
-
-  This command groups subcommands for interacting with Vault namespaces.
-  These set of subcommands operate on the context of the namespace that the
-  current logged in token belongs to.
-
-Subcommands:
-    create   Create a new namespace
-    delete   Delete an existing namespace
-    list     List child namespaces
-    lookup   Look up an existing namespace
-    lock     Lock the API for a namespace
-    unlock   Unlock the API for a namespace
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/operator/diagnose.mdx b/website/content/docs/commands/operator/diagnose.mdx
deleted file mode 100644
index 65d780ec95d..00000000000
--- a/website/content/docs/commands/operator/diagnose.mdx
+++ /dev/null
@@ -1,228 +0,0 @@
----
-layout: docs
-page_title: operator diagnose - Command
-description: |-
-  "vault operator diagnose" is a new operator-centric command, focused on providing a clear description 
-  of what is working in Vault, and what is not working. The command focuses on why Vault cannot serve requests,
-  but will also warn on configurations or statuses that it deems to be unsafe in some way. 
-
----
-
-# operator diagnose
-
-The operator diagnose command should be used primarily when vault is down or 
-partially inoperational. The command can be used safely regardless of the state 
-vault is in, but may return meaningless results for some of the test cases if the 
-vault server is already running. 
-
-Note: if you run the diagnose command proactively, either before a server 
-starts or while a server is operational, please consult the documentation 
-on the individual checks below to see which checks are returning false error 
-messages or warnings.
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-#### Output layout
-
-The operator diagnose command will output a set of lines in the CLI. 
-Each line will begin with a prefix in parenthesis. These are:. 
-
-- `[ success ]` - Denotes that the check was successful.
-- `[ warning ]` - Denotes that the check has passed, but that there may be potential
-issues to look into that may relate to the issues vault is experiencing. Diagnose warns 
-frequently. These warnings are meant to serve as starting points in the debugging process. 
-- `[ failure ]` - Denotes that the check has failed. Failures are critical issues in the eyes 
-of the diagnose command.
-
-In addition to these prefixed lines, there may be output lines that are not prefixed, but are 
-color-coded purple. These are advice lines from Diagnose, and are meant to offer general guidance 
-on how to go about fixing potential warnings or failures that may arise.
-
-Warn or fail prefixes in nested checks will bubble up to the parent if the prefix superceeds the 
-parent prefix. Fail superceeds warn, and warn superceeds ok. For example, if the TLS checks under
-the Storage check fails, the `[ failure ]` prefix will bubble up to the Storage check. 
-
-### Command options
-
-- `-config` `(string; "")` - The path to the vault configuration file used by 
-the vault server on startup. 
-
-### Diagnose checks
-
-The following section details the various checks that Diagnose runs. Check names in documentation
-will be separated by slashes to denote that they are nested, when applicable. For example, a check 
-documented as `A / B` will show up as `B` in the `operator diagnose` output, and will be nested
-(indented) under `A`. 
-
-#### Vault diagnose
-
-`Vault Diagnose` is the top level check that contains the rest of the checks. It will report the status
-of the check 
-
-#### Check operating system / check open file limit
-
-`Check Open File Limit` verifies that the open file limit value is set high enough for vault 
-to run effectively. We recommend setting these limits to at least 1024768. 
-
-This check will be skipped on openbsd, arm, and windows. 
-
-#### Check operating system / check disk usage
-
-`Check Disk Usage` will report disk usage for each partition. For each partition on a prod host,
-we recommend having at least 5% of the partition free to use, and at least 1 GB of space. 
-
-This check will be skipped on openbsd and arm.
-
-#### Parse configuration
-
-`Parse Configuration` will check the vault server config file for syntax errors. It will check
-for extra values in the configuration file, repeated stanzas, and stanzas that do not belong 
-in the configuration file (for example a "tcpp" listener as opposed to a tcp listener). 
-
-Currently, the `storage` stanza is not checked. 
-
-#### Check storage / create storage backend
-
-`Create Storage Backend` ensures that the storage stanza configured in the vault server config
-has enough information to create a storage object internally. Common errors will have to do
-with misconfigured fields in the storage stanza. 
-
-#### Check storage / check consul TLS
-
-`Check Consul TLS` verifies TLS information included in the storage stanza if the storage type 
-is consul. If a certificate chain is provided, Diagnose parses the root, intermediate, and leaf
-certificates, and checks each one for correctness. 
-
-#### Check storage / check consul direct storage access
-
-`Check Consul Direct Storage Access` is a consul-specific check that ensures Vault is not accessing
-the consul server directly, but rather through a local agent. 
-
-#### Check storage / check raft folder permissions
-
-`Check Raft Folder Permissions` computes the permissions on the raft folder, checks that a boltDB file 
-has been initialized within the folder previously, and ensures that the folder is not too permissive, but 
-at the same time has enough permissions to be used. The raft folder should not have `other` permissions, but 
-should have `group rw` or `owner rw`, depending on different setups. This check also warns if it detects a
-symlink being used. 
-
-Note that this check will warn that a raft file has not been created if diagnose is run without any
-pre-existing server runs.
-
-This check will be skipped on windows. 
-
-#### Check storage / check raft folder ownership
-
-`Check Raft Folder Ownership` ensures that vault does not need to run as root to access the boltDB folder. 
-
-Note that this check will warn that a raft file has not been created if diagnose is run without any
-pre-existing server runs. 
-
-This check will be skipped on windows. 
-
-#### Check storage / check for raft quorum
-
-`Check For Raft Quorum` uses the FSM to ensure that there were an odd number of voters in the raft quorum when 
-vault was last running. 
-
-Note that this check will warn that there are 0 voters if diagnose is run without any pre-existing server runs. 
-
-#### Check storage / check storage access
-
-`Check Storage Access` will try to write a dud value, named `diagnose/latency/<uuid>`, to storage. 
-Ensure that there is no important data at this location before running diagnose, as this check 
-will overwrite that data. This check will then try to list and read the value it wrote to ensure 
-the name and value is as expected. 
-
-`Check Storage Access` will warn if any operation takes longer than 100ms, and error out if the 
-entire check takes longer than 30s. 
-
-#### Check service discovery / check consul service discovery TLS
-
-`Check Consul Service Discovery TLS` verifies TLS information included in the service discovery
- stanza if the storage type is consul. If a certificate chain is provided, Diagnose parses 
- the root, intermediate, and leaf certificates, and checks each one for correctness. 
-
-#### Check service discovery / check consul direct service discovery
-
-`Check Consul Direct Service Discovery` is a consul-specific check that ensures Vault
-is not accessing the consul server directly, but rather through a local agent. 
-
-#### Create Vault server configuration seals
-
-`Create Vault Server Configuration Seals` creates seals from the vault configuration 
-stanza and verifies they can be initialized and finalized. 
-
-#### Check transit seal TLS
-
-`Check Transit Seal TLS` checks the TLS client certificate, key, and CA certificate
-provided in a transit seal stanza (if one exists) for correctness. 
-
-#### Create core configuration / initialize randomness for core
-
-`Initialize Randomness for Core` ensures that vault has access to the randReader that 
-the vault core uses. 
-
-#### HA storage
-
-This check and any nested checks will be the same as the `Check Storage` checks.
-The only difference is that the checks here will be run on whatever is specified in the 
-`ha_storage` section of the vault configuration, as opposed to the `storage` section. 
-
-#### Determine redirect address
-
-Ensures that one of the `VAULT_API_ADDR`, `VAULT_REDIRECT_ADDR`, or `VAULT_ADVERTISE_ADDR` 
-environment variables are set, or that the redirect address is specified in the vault 
-configuration.
-
-#### Check cluster address
-
-Parses the cluster address from the `VAULT_CLUSTER_ADDR` environment variable, or from the 
-redirect address or cluster address specified in the vault configuration, and checks that 
-the address is of the form `host:port`. 
-
-#### Check core creation
-
-`Check Core Creation` verifies the logical configuration checks that vault does when it 
-creates a core object. These are runtime checks, meaning any errors thrown by this diagnose
-test will also be thrown by the vault server itself when it is run. 
-
-#### Check for autoloaded license
-
-`Check For Autoloaded License` is an enterprise diagnose check, which verifies that vault 
-has access to a valid autoloaded license that will not expire in the next 30 days.
-
-#### Start listeners / check listener TLS
-
-`Check Listener TLS` verifies the server certificate file and key are valid and matching. 
-It also checks the client CA file, if one is provided, for a valid certificate, and performs
-the standard runtime listener checks on the listener configuration stanza, such as verifying 
-that the minimum and maximum TLS versions are within the bounds of what vault supports. 
-
-Like all the other Diagnose TLS checks, it will warn if any of the certificates provided are 
-set to expire within the next month. 
-
-#### Start listeners / create listeners
-
-`Create Listeners` uses the listener configuration to initialize the listeners, erroring with 
-a server error if anything goes wrong. 
-
-#### Check autounseal encryption
-
-`Check Autounseal Encryption` will initialize the barrier using the seal stanza, if the seal
-type is not a shamir seal, and use it to encrypt and decrypt a dud value. 
-
-#### Check server before runtime
-
-`Check Server Before Runtime` achieves parity with the server run command, running through 
-the runtime code checks before the server is initialized to ensure that nothing fails. 
-This check will never fail without another diagnose check failing. 
diff --git a/website/content/docs/commands/operator/generate-root.mdx b/website/content/docs/commands/operator/generate-root.mdx
deleted file mode 100644
index b619ffda84e..00000000000
--- a/website/content/docs/commands/operator/generate-root.mdx
+++ /dev/null
@@ -1,94 +0,0 @@
----
-layout: docs
-page_title: operator generate-root - Command
-description: |-
-  The "operator generate-root" command generates a new root token by combining a
-  quorum of share holders.
----
-
-# operator generate-root
-
-The `operator generate-root` command generates a new root token by combining a
-quorum of share holders. With the `-dr-token` or `-recovery-token` options,
-it can generate a DR operation token or a recovery token in the same way.
-
-One of the following must be provided to start the root token generation:
-
-- A base64-encoded one-time-password (OTP) provided via the `-otp` flag. Use the
-  `-generate-otp` flag to generate a usable value. The resulting token is XORed
-  with this value when it is returned. Use the `-decode` flag to output the
-  final value.
-
-- A file containing a PGP key or a
-  [keybase](/vault/docs/concepts/pgp-gpg-keybase) username in the `-pgp-key`
-  flag. The resulting token is encrypted with this public key.
-
-An unseal key may be provided directly on the command line as an argument to the
-command. If key is specified as "-", the command will read from stdin. If a TTY
-is available, the command will prompt for text.
-
-Please see the [generate root guide](/vault/tutorials/operations/generate-root) for
-step-by-step instructions.
-
-## Examples
-
-Generate an OTP code for the final token:
-
-```shell-session
-$ vault operator generate-root -generate-otp
-```
-
-Start a root token generation:
-
-```shell-session
-$ vault operator generate-root -init
-```
-
-Enter an unseal key to progress root token generation:
-
-```shell-session
-$ vault operator generate-root
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-cancel` `(bool: false)` - Reset the root token generation progress. This
-  will discard any submitted unseal keys or configuration.
-
-- `-decode` `(string: "")` - Decode and output the generated root token. This
-  option requires the `-otp` flag be set to the OTP used during initialization.
-  If value is "-" then read the encoded token from stdin.
-
-- `-generate-otp` `(bool: false)` - Generate and print a high-entropy
-  one-time-password (OTP) suitable for use with the "-init" flag.
-
-- `-init` `(bool: false)` - Start a root token generation. This can only be done
-  if there is not currently one in progress.
-
-- `-nonce` `(string; "")`- Nonce value provided at initialization. The same
-  nonce value must be provided with each unseal key.
-
-- `-otp` `(string: "")` - OTP code to use with `-decode` or `-init`.
-
-- `-pgp-key` `(keybase or pgp)`- Path to a file on disk containing a binary or
-  base64-encoded public PGP key. This can also be specified as a Keybase
-  username using the format `keybase:<username>`. When supplied, the generated
-  root token will be encrypted and base64-encoded with the given public key.
-
-- `-status` `(bool: false)` - Print the status of the current attempt without
-  providing an unseal key. The default is false.
-
-- `-dr-token` `(bool: false)` - Generate DR operation token
-
-- `-recovery-token` `(bool: false)` - Generate recovery token
diff --git a/website/content/docs/commands/operator/index.mdx b/website/content/docs/commands/operator/index.mdx
deleted file mode 100644
index e268da6ef4d..00000000000
--- a/website/content/docs/commands/operator/index.mdx
+++ /dev/null
@@ -1,67 +0,0 @@
----
-layout: docs
-page_title: operator - Command
-description: |-
-  The "operator" command groups subcommands for operators interacting with
-  Vault. Most users will not need to interact with these commands.
----
-
-# operator
-
-The `operator` command groups subcommands for operators interacting with Vault.
-Most users will not need to interact with these commands.
-
-## Examples
-
-Initialize a new Vault cluster:
-
-```shell-session
-$ vault operator init
-Unseal Key 1: sP/4C/fwIDjJmHEC2bi/1Pa43uKhsUQMmiB31GRzFc0R
-Unseal Key 2: kHkw2xTBelbDFIMEgEC8NVX7NDSAZ+rdgBJ/HuJwxOX+
-Unseal Key 3: +1+1ZnkQDfJFHDZPRq0wjFxEuEEHxDDOQxa8JJ/AYWcb
-Unseal Key 4: cewseNJTLovmFrgpyY+9Hi5OgJlJgGGCg7PZyiVdPwN0
-Unseal Key 5: wyd7rMGWX5fi0k36X4e+C4myt5CoTmJsHJ0rdYT7BQcF
-
-Initial Root Token: 6662bb4a-afd0-4b6b-faad-e237fb564568
-
-# ...
-```
-
-Force a Vault to resign leadership in a cluster:
-
-```shell-session
-$ vault operator step-down
-Success! Stepped down: https://127.0.0.1:8200
-```
-
-Rotate Vault's underlying encryption key:
-
-```shell-session
-$ vault operator rotate
-Success! Rotated key
-
-Key Term        2
-Install Time    01 Jan 07 12:30 UTC
-```
-
-## Usage
-
-```text
-Usage: vault operator <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    generate-root    Generates a new root token
-    init             Initializes a server
-    key-status       Provides information about the active encryption key
-    rekey            Generates new unseal keys
-    rotate           Rotates the underlying encryption key
-    seal             Seals the Vault server
-    step-down        Forces Vault to resign active duty
-    unseal           Unseals the Vault server
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/operator/init.mdx b/website/content/docs/commands/operator/init.mdx
deleted file mode 100644
index d8b3558b555..00000000000
--- a/website/content/docs/commands/operator/init.mdx
+++ /dev/null
@@ -1,125 +0,0 @@
----
-layout: docs
-page_title: operator init - Command
-description: |-
-  The "operator init" command initializes a Vault server. Initialization is the
-  process by which Vault's storage backend is prepared to receive data. Since
-  Vault servers share the same storage backend in HA mode, you only need to
-  initialize one Vault to initialize the storage backend.
----
-
-# operator init
-
-The `operator init` command initializes a Vault server. Initialization is the
-process by which Vault's storage backend is prepared to receive data. Since
-Vault servers share the same storage backend in HA mode, you only need to
-initialize one Vault to initialize the storage backend.
-This command cannot be run against already-initialized Vault cluster.
-
-During initialization, Vault generates a root key, which is stored in the storage backend alongside all other Vault data. The root key itself is encrypted and requires an _unseal key_ to decrypt it.
-
-The default Vault configuration uses [Shamir's Secret Sharing](https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing) to split the root key into a configured number of shards (referred as key shares, or unseal keys). A certain threshold of shards is required to reconstruct the root key, which is then used to decrypt the Vault's encryption key.
-
-Refer to the [Seal/Unseal](/vault/docs/concepts/seal#seal-unseal) documentation for further details.
-
-## Examples
-
-Start initialization with the default options:
-
-```shell-session
-$ vault operator init
-```
-
-Initialize, but encrypt the unseal keys with pgp keys:
-
-```shell-session
-$ vault operator init \
-    -key-shares=3 \
-    -key-threshold=2 \
-    -pgp-keys="keybase:hashicorp,keybase:jefferai,keybase:sethvargo"
-```
-
-Initialize Auto Unseal with a non-default threshold and number of recovery keys, and encrypt the recovery keys with pgp keys:
-
-```shell-session
-$ vault operator init \
-    -recovery-shares=7 \
-    -recovery-threshold=4 \
-    -recovery-pgp-keys="keybase:jeff,keybase:chris,keybase:brian,keybase:calvin,keybase:matthew,keybase:vishal,keybase:nick"
-```
-
-Encrypt the initial root token using a pgp key:
-
-```shell-session
-$ vault operator init -root-token-pgp-key="keybase:hashicorp"
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "")` - Print the output in the given format. Valid formats
-  are "table", "json", or "yaml". The default is table. This can also be
-  specified via the `VAULT_FORMAT` environment variable.
-
-### Common options
-
-- `-key-shares` `(int: 5)` - Number of key shares to split the generated master
-  key into. This is the number of "unseal keys" to generate. This is aliased as
-  `-n`.
-
-- `-key-threshold` `(int: 3)` - Number of key shares required to reconstruct the
-  root key. This must be less than or equal to -key-shares. This is aliased as
-  `-t`.
-
-- `-pgp-keys` `(string: "...")` - Comma-separated list of paths to files on disk
-  containing public PGP keys OR a comma-separated list of Keybase usernames
-  using the format `keybase:<username>`. When supplied, the generated unseal
-  keys will be encrypted and base64-encoded in the order specified in this list.
-  The number of entries must match -key-shares, unless -stored-shares are used.
-
-- `-root-token-pgp-key` `(string: "")` - Path to a file on disk containing a
-  binary or base64-encoded public PGP key. This can also be specified as a
-  Keybase username using the format `keybase:<username>`. When supplied, the
-  generated root token will be encrypted and base64-encoded with the given
-  public key.
-
-- `-status` `(bool": false)` - Print the current initialization status. An exit
-  code of 0 means the Vault is already initialized. An exit code of 1 means an
-  error occurred. An exit code of 2 means the Vault is not initialized.
-
-### Consul options
-
-- `-consul-auto` `(bool: false)` - Perform automatic service discovery using
-  Consul in HA mode. When all nodes in a Vault HA cluster are registered with
-  Consul, enabling this option will trigger automatic service discovery based on
-  the provided -consul-service value. When Consul is Vault's HA backend, this
-  functionality is automatically enabled. Ensure the proper Consul environment
-  variables are set (CONSUL_HTTP_ADDR, etc). When only one Vault server is
-  discovered, it will be initialized automatically. When more than one Vault
-  server is discovered, they will each be output for selection. The default is
-  false.
-
-- `-consul-service` `(string: "vault")` - Name of the service in Consul under
-  which the Vault servers are registered.
-
-### HSM and KMS options
-
-- `-recovery-pgp-keys` `(string: "...")` - Behaves like `-pgp-keys`, but for the
-  recovery key shares. This is only available with [Auto Unseal](/vault/docs/concepts/seal#auto-unseal) seals (HSM, KMS and Transit seals).
-
-- `-recovery-shares` `(int: 5)` - Number of key shares to split the recovery key
-  into. This is only available with [Auto Unseal](/vault/docs/concepts/seal#auto-unseal) seals (HSM, KMS and Transit seals).
-
-- `-recovery-threshold` `(int: 3)` - Number of key shares required to
-  reconstruct the recovery key. This is only available with [Auto Unseal](/vault/docs/concepts/seal#auto-unseal) seals (HSM, KMS and Transit seals).
-
-- `-stored-shares` `(int: 0)` - Number of unseal keys to store on an HSM. This
-  must be equal to `-key-shares`.
-
--> **Recovery keys:** Refer to the
- [Seal/Unseal](/vault/docs/concepts/seal#recovery-key) documentation to learn more
- about recovery keys.
diff --git a/website/content/docs/commands/operator/key-status.mdx b/website/content/docs/commands/operator/key-status.mdx
deleted file mode 100644
index e39545e7442..00000000000
--- a/website/content/docs/commands/operator/key-status.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: operator key-status - Command
-description: |-
-  The "operator key-status" provides information about the active encryption
-  key.
----
-
-# operator key-status
-
-The `operator key-status` provides information about the active encryption key.
-Specifically, the current key term and the key installation time.
-
-## Examples
-
-Get the key status:
-
-```shell-session
-$ vault operator key-status
-Key Term          2
-Install Time      01 Jan 17 12:30 UTC
-Encryption Count  4494
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
diff --git a/website/content/docs/commands/operator/members.mdx b/website/content/docs/commands/operator/members.mdx
deleted file mode 100644
index 1b9029fef1b..00000000000
--- a/website/content/docs/commands/operator/members.mdx
+++ /dev/null
@@ -1,39 +0,0 @@
----
-layout: docs
-page_title: operator members - Command
-description: |-
-  The "operator members" command provides information about the nodes making up an HA cluster.
----
-
-# operator members
-
-The `operator members` lists the active node and the peers that it's heard from
-since it became active.
-
-## Examples
-
-Get the key status:
-
-```shell-session
-$ vault operator members
-Host Name            API Address              Cluster Address           Active Node    Version    Upgrade Version    Redundancy Zone    Last Echo
----------            -----------              ---------------           -----------    -------    ---------------    ---------------    ---------
-josh-C02ZT9DYMD6R    http://127.0.0.1:8200    https://127.0.0.1:8201    true           1.11.0     1.11.0             a                  n/a
-josh-C02ZT9DYMD6R    http://127.0.0.2:8200    https://127.0.0.2:8201    false          1.11.0     1.11.0             a                  2022-05-23T15:51:19-07:00
-josh-C02ZT9DYMD6R    http://127.0.0.3:8200    https://127.0.0.3:8201    false          1.11.0     1.11.0             b                  2022-05-23T15:51:19-07:00
-josh-C02ZT9DYMD6R    http://127.0.0.4:8200    https://127.0.0.4:8201    false          1.11.0     1.11.0             b                  2022-05-23T15:51:22-07:00
-josh-C02ZT9DYMD6R    http://127.0.0.5:8200    https://127.0.0.5:8201    false          1.11.0     1.12.0             a                  2022-05-23T15:51:20-07:00
-~
-```
-Note that in the above output, `Upgrade Version` and `Redundancy Zone` are Enterprise-only fields.
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
diff --git a/website/content/docs/commands/operator/migrate.mdx b/website/content/docs/commands/operator/migrate.mdx
deleted file mode 100644
index 111db247185..00000000000
--- a/website/content/docs/commands/operator/migrate.mdx
+++ /dev/null
@@ -1,142 +0,0 @@
----
-layout: docs
-page_title: operator migrate - Command
-description: >-
-  The "operator migrate" command copies data between storage backends to
-  facilitate
-
-  migrating Vault between configurations. It operates directly at the storage
-
-  level, with no decryption involved.
----
-
-# operator migrate
-
-The `operator migrate` command copies data between storage backends to facilitate
-migrating Vault between configurations. It operates directly at the storage
-level, with no decryption involved. Keys in the destination storage backend will
-be overwritten, and the destination should _not_ be initialized prior to the
-migrate operation. The source data is not modified, with the exception of a small lock
-key added during migration.
-
-This is intended to be an offline operation to ensure data consistency, and Vault
-will not allow starting the server if a migration is in progress.
-
-## Examples
-
-Migrate all keys:
-
-```shell-session
-$ vault operator migrate -config migrate.hcl
-
-2018-09-20T14:23:23.656-0700 [INFO ] copied key: data/core/seal-config
-2018-09-20T14:23:23.657-0700 [INFO ] copied key: data/core/wrapping/jwtkey
-2018-09-20T14:23:23.658-0700 [INFO ] copied key: data/logical/fd1bed89-ffc4-d631-00dd-0696c9f930c6/31c8e6d9-2a17-d98f-bdf1-aa868afa1291/archive/metadata
-2018-09-20T14:23:23.660-0700 [INFO ] copied key: data/logical/fd1bed89-ffc4-d631-00dd-0696c9f930c6/31c8e6d9-2a17-d98f-bdf1-aa868afa1291/metadata/5kKFZ4YnzgNfy9UcWOzxxzOMpqlp61rYuq6laqpLQDnB3RawKpqi7yBTrawj1P
-...
-```
-
-Migration is done in a consistent, sorted order. If the migration is halted or
-exits before completion (e.g. due to a connection error with a storage backend),
-it may be resumed from an arbitrary key prefix:
-
-```shell-session
-$ vault operator migrate -config migrate.hcl -start "data/logical/fd"
-```
-
-## Configuration
-
-The `operator migrate` command uses a dedicated configuration file to specify the source
-and destination storage backends. The format of the storage stanzas is identical
-to that used to [configure Vault](/vault/docs/configuration/storage),
-with the only difference being that two stanzas are required: `storage_source` and `storage_destination`.
-
-```hcl
-storage_source "mysql" {
-  username = "user1234"
-  password = "secret123!"
-  database = "vault"
-}
-
-storage_destination "consul" {
-  address = "127.0.0.1:8500"
-  path    = "vault/"
-}
-```
-
-## Migrating to integrated raft storage
-
-### Example configuration
-
-The below configuration will migrate away from Consul storage to integrated
-raft storage. The raft data will be stored on the local filesystem in the
-defined `path`. `node_id` can optionally be set to identify this node.
-[cluster_addr](/vault/docs/configuration#cluster_addr) must be set to the
-cluster hostname of this node. For more configuration options see the [raft
-storage configuration documentation](/vault/docs/configuration/storage/raft).
-
-If the original configuration uses "raft" for `ha_storage` a different
-`path` needs to be declared for the path in `storage_destination` and the new
-configuration for the node post-migration.
-
-```hcl
-storage_source "consul" {
-  address = "127.0.0.1:8500"
-  path    = "vault"
-}
-
-storage_destination "raft" {
-  path = "/path/to/raft/data"
-  node_id = "raft_node_1"
-}
-cluster_addr = "http://127.0.0.1:8201"
-```
-
-### Run the migration
-
-Vault will need to be offline during the migration process. First, stop Vault.
-Then, run the migration on the server you wish to become a the new Vault node.
-
-```shell-session
-$ vault operator migrate -config migrate.hcl
-
-2018-09-20T14:23:23.656-0700 [INFO ] copied key: data/core/seal-config
-2018-09-20T14:23:23.657-0700 [INFO ] copied key: data/core/wrapping/jwtkey
-2018-09-20T14:23:23.658-0700 [INFO ] copied key: data/logical/fd1bed89-ffc4-d631-00dd-0696c9f930c6/31c8e6d9-2a17-d98f-bdf1-aa868afa1291/archive/metadata
-2018-09-20T14:23:23.660-0700 [INFO ] copied key: data/logical/fd1bed89-ffc4-d631-00dd-0696c9f930c6/31c8e6d9-2a17-d98f-bdf1-aa868afa1291/metadata/5kKFZ4YnzgNfy9UcWOzxxzOMpqlp61rYuq6laqpLQDnB3RawKpqi7yBTrawj1P
-...
-```
-
-After migration has completed, the data is stored on the local file system. To
-use the new storage backend with Vault, update Vault's configuration file as
-described in the [raft storage configuration
-documentation](/vault/docs/configuration/storage/raft). Then start and unseal the
-vault server.
-
-### Join additional nodes
-
-After migration the raft cluster will only have a single node. Additional peers
-should be joined to this node.
-
-If the cluster was previously HA-enabled using "raft" as the `ha_storage`, the
-nodes will have to re-join to the migrated node before unsealing.
-
-## Usage
-
-The following flags are available for the `operator migrate` command.
-
-- `-config` `(string: <required>)` - Path to the migration configuration file.
-
-- `-start` `(string: "")` - Migration starting key prefix. Only keys at or after this value will be copied.
-
-- `-reset` - Reset the migration lock. A lock file is added during migration to prevent
-  starting the Vault server or another migration. The `-reset` option can be used to
-  remove a stale lock file if present.
-
-- `-max-parallel` `int: 10` - Allows the operator to specify the maximum number of lightweight threads (goroutines)
-  which may be used to migrate data in parallel. This can potentially speed up migration on slower backends at
-  the cost of more resources (e.g. CPU, memory). Permitted values range from `1` (synchronous) to the maximum value
-  for an `integer`. If not supplied, a default of `10` parallel goroutines will be used.
-
-  ~> Note: The maximum number of concurrent requests handled by a storage backend is ultimately governed by the
-  storage backend configuration setting, which enforces a maximum number of concurrent requests (`max_parallel`).
diff --git a/website/content/docs/commands/operator/raft.mdx b/website/content/docs/commands/operator/raft.mdx
deleted file mode 100644
index 9b7f91da94e..00000000000
--- a/website/content/docs/commands/operator/raft.mdx
+++ /dev/null
@@ -1,365 +0,0 @@
----
-layout: docs
-page_title: operator raft - Command
-description: >-
-  The "operator raft" command is used to interact with the integrated Raft storage backend.
----
-
-# operator raft
-
-This command groups subcommands for operators to manage the Integrated Storage Raft backend.
-
-```text
-Usage: vault operator raft <subcommand> [options] [args]
-
- This command groups subcommands for operators interacting with the Vault
- integrated Raft storage backend. Most users will not need to interact with these
- commands. Here are a few examples of the Raft operator commands:
-
-Subcommands:
-    join           Joins a node to the Raft cluster
-    list-peers     Returns the Raft peer set
-    remove-peer    Removes a node from the Raft cluster
-    snapshot       Restores and saves snapshots from the Raft cluster
-```
-
-## join
-
-This command is used to join a new node as a peer to the Raft cluster. In order
-to join, there must be at least one existing member of the cluster. If Shamir
-seal is in use, then unseal keys are to be supplied before or after the
-join process, depending on whether it's being used exclusively for HA.
-
-If raft is used for `storage`, the node must be joined before unsealing and the
-`leader-api-addr` argument must be provided. If raft is used for `ha_storage`,
-the node must be first unsealed before joining and the `leader-api-addr` must
-_not_ be provided.
-
-```text
-Usage: vault operator raft join [options] <leader-api-addr>
-
-  Join the current node as a peer to the Raft cluster by providing the address
-  of the Raft leader node.
-
-	  $ vault operator raft join "http://127.0.0.2:8200"
-```
-
-The `join` command also allows operators to specify cloud auto-join configuration
-instead of a static IP address or hostname. When provided, Vault will attempt to
-automatically discover and resolve potential leader addresses based on the provided
-auto-join configuration.
-
-Vault uses go-discover to support the auto-join functionality. Please see the
-go-discover
-[README](https://github.com/hashicorp/go-discover/blob/master/README.md) for
-details on the format.
-
-By default, Vault will attempt to reach discovered peers using HTTPS and port 8200.
-Operators may override these through the `--auto-join-scheme` and `--auto-join-port`
-CLI flags respectively.
-
-```text
-Usage: vault operator raft join [options] <auto-join-configuration>
-  Join the current node as a peer to the Raft cluster by providing cloud auto-join
-  metadata configuration.
-    $ vault operator raft join "provider=aws region=eu-west-1 ..."
-```
-
-### Parameters
-
-The following flags are available for the `operator raft join` command.
-
-- `-leader-ca-cert` `(string: "")` - CA cert to communicate with Raft leader.
-
-- `-leader-client-cert` `(string: "")` - Client cert to authenticate to Raft leader.
-
-- `-leader-client-key` `(string: "")` - Client key to authenticate to Raft leader.
-
-- `-non-voter` `(bool: false) (enterprise)` - This flag is used to make the
-  server not participate in the Raft quorum, and have it only receive the data
-  replication stream. This can be used to add read scalability to a cluster in
-  cases where a high volume of reads to servers are needed. The default is false.
-  See [`retry_join_as_non_voter`](/vault/docs/configuration/storage/raft#retry_join_as_non_voter)
-  for the equivalent config option when using `retry_join` stanzas instead.
-
-- `-retry` `(bool: false)` - Continuously retry joining the Raft cluster upon
-  failures. The default is false.
-
-~> **Note:** Please be aware that the content (not the path to the file) of the certificate or key is expected for these parameters: `-leader-ca-cert`, `-leader-client-cert`, `-leader-client-key`.
-
-## list-peers
-
-This command is used to list the full set of peers in the Raft cluster.
-
-```text
-Usage: vault operator raft list-peers
-
-  Provides the details of all the peers in the Raft cluster.
-
-	  $ vault operator raft list-peers
-```
-
-### Example output
-
-```json
-{
- ...
-  "data": {
-    "config": {
-      "index": 62,
-      "servers": [
-        {
-          "address": "127.0.0.2:8201",
-          "leader": true,
-          "node_id": "node1",
-          "protocol_version": "3",
-          "voter": true
-        },
-        {
-          "address": "127.0.0.4:8201",
-          "leader": false,
-          "node_id": "node3",
-          "protocol_version": "3",
-          "voter": true
-        }
-      ]
-    }
-  }
-}
-```
-
-## remove-peer
-
-This command is used to remove a node from being a peer to the Raft cluster. In
-certain cases where a peer may be left behind in the Raft configuration even
-though the server is no longer present and known to the cluster, this command
-can be used to remove the failed server so that it is no longer affects the Raft
-quorum.
-
-```text
-Usage: vault operator raft remove-peer <server_id>
-
-  Removes a node from the Raft cluster.
-
-	  $ vault operator raft remove-peer node1
-```
-
-<Note>
-  Once a node is removed, its Raft data needs to be deleted before it may be joined back into an existing cluster. This requires shutting down the Vault process, deleting the data, then restarting the Vault process on the removed node.
-</Note>
-
-## snapshot
-
-This command groups subcommands for operators interacting with the snapshot
-functionality of the integrated Raft storage backend. There are 2 subcommands
-supported: `save` and `restore`.
-
-```text
-Usage: vault operator raft snapshot <subcommand> [options] [args]
-
-  This command groups subcommands for operators interacting with the snapshot
-  functionality of the integrated Raft storage backend.
-
-Subcommands:
-    restore    Installs the provided snapshot, returning the cluster to the state defined in it
-    save       Saves a snapshot of the current state of the Raft cluster into a file
-```
-
-### snapshot save
-
-Takes a snapshot of the Vault data. The snapshot can be used to restore Vault to
-the point in time when a snapshot was taken.
-
-```text
-Usage: vault operator raft snapshot save <snapshot_file>
-
-  Saves a snapshot of the current state of the Raft cluster into a file.
-
-	  $ vault operator raft snapshot save raft.snap
-```
-
-~> **Note:** Snapshot is not supported when Raft is used only for `ha_storage`.
-
-### snapshot restore
-
-Restores a snapshot of Vault data taken with `vault operator raft snapshot save`.
-
-```text
-Usage: vault operator raft snapshot restore <snapshot_file>
-
-  Installs the provided snapshot, returning the cluster to the state defined in it.
-
-	  $ vault operator raft snapshot restore raft.snap
-```
-
-### snapshot inspect
-
-Inspects a snapshot file taken from a Vault Raft cluster and prints a table showing the number of keys and the amount of space used.
-
-```text
-Usage: vault operator raft snapshot inspect <snapshot_file>
-```
-
-For example:
-
-```shell-session
-$ vault operator raft snapshot inspect raft.snap
-```
-
-## autopilot
-
-This command groups subcommands for operators interacting with the autopilot
-functionality of the integrated Raft storage backend. There are 3 subcommands
-supported: `get-config`, `set-config` and `state`.
-
-For a more detailed overview of autopilot features, see the [concepts page](/vault/docs/concepts/integrated-storage/autopilot).
-
-```text
-Usage: vault operator raft autopilot <subcommand> [options] [args]
-
-This command groups subcommands for operators interacting with the autopilot
-functionality of the integrated Raft storage backend.
-
-Subcommands:
-    get-config    Returns the configuration of the autopilot subsystem under integrated storage
-    set-config    Modify the configuration of the autopilot subsystem under integrated storage
-    state         Displays the state of the raft cluster under integrated storage as seen by autopilot
-```
-
-### autopilot state
-
-Displays the state of the raft cluster under integrated storage as seen by
-autopilot. It shows whether autopilot thinks the cluster is healthy or not,
-and how many nodes could fail before the cluster becomes unhealthy ("Failure Tolerance").
-
-State includes a list of all servers by nodeID and IP address. Last Index
-indicates how close the state on each node is to the leader's.
-
-A node can have a status of "leader", "voter", and
-"[non-voter](/vault/docs/concepts/integrated-storage#non-voting-nodes-enterprise-only)".
-
-```text
-Usage: vault operator raft autopilot state
-
-  Displays the state of the raft cluster under integrated storage as seen by autopilot.
-
-    $ vault operator raft autopilot state
-```
-
-#### Example output
-
-```text
-Healthy:                      true
-Failure Tolerance:            1
-Leader:                       raft1
-Voters:
-   raft1
-   raft2
-   raft3
-Servers:
-   raft1
-      Name:            raft1
-      Address:         127.0.0.1:8201
-      Status:          leader
-      Node Status:     alive
-      Healthy:         true
-      Last Contact:    0s
-      Last Term:       3
-      Last Index:      38
-   raft2
-      Name:            raft2
-      Address:         127.0.0.2:8201
-      Status:          voter
-      Node Status:     alive
-      Healthy:         true
-      Last Contact:    2.514176729s
-      Last Term:       3
-      Last Index:      38
-```
-Vault Enterprise will include additional output related to automated upgrades and redundancy zones.
-
-#### Example Vault enterprise output
-
-```text
-Redundancy Zones:
-   a
-      Servers: vault_1, vault_2, vault_5
-      Voters: vault_1
-      Failure Tolerance: 2
-   b
-      Servers: vault_3, vault_4
-      Voters: vault_3
-      Failure Tolerance: 1
-Upgrade Info:
-   Status: await-new-voters
-   Target Version: 1.12.0
-   Target Version Voters:
-   Target Version Non-Voters: vault_5
-   Other Version Voters: vault_1, vault_3
-   Other Version Non-Voters: vault_2, vault_4
-   Redundancy Zones:
-      a
-         Target Version Voters:
-         Target Version Non-Voters: vault_5
-         Other Version Voters: vault_1
-         Other Version Non-Voters: vault_2
-      b
-         Target Version Voters:
-         Target Version Non-Voters:
-         Other Version Voters: vault_3
-         Other Version Non-Voters: vault_4
-```
-
-### autopilot get-config
-
-Returns the configuration of the autopilot subsystem under integrated storage.
-
-```text
-Usage: vault operator raft autopilot get-config
-
-  Returns the configuration of the autopilot subsystem under integrated storage.
-
-    $ vault operator raft autopilot get-config
-```
-
-### autopilot set-config
-
-Modify the configuration of the autopilot subsystem under integrated storage.
-
-```text
-Usage: vault operator raft autopilot set-config [options]
-
-  Modify the configuration of the autopilot subsystem under integrated storage.
-
-	  $ vault operator raft autopilot set-config -server-stabilization-time 10s
-
-```
-
-Flags applicable to this command are the following:
-
-- `cleanup-dead-servers` `(bool)` - Controls whether to remove dead servers from
-  the Raft peer list periodically or when a new server joins. This requires that
-  `min-quorum` is also set. Defaults to `false`.
-
-- `last-contact-threshold` `(string)` - Limit on the amount of time a server can
-  go without leader contact before being considered unhealthy. Defaults to `10s`.
-
-- `dead-server-last-contact-threshold` `(string)` - Limit on the amount of time
-  a server can go without leader contact before being considered failed.
-  This takes effect only when `cleanup_dead_servers` is set as `true`. Defaults to `24h`.
-  
-  -> **Note:** A failed server that autopilot has removed from the raft configuration cannot rejoin the cluster without being reinitialized.  
-
-- `max-trailing-logs` `(int)` - Amount of entries in the Raft Log that a server
-  can be behind before being considered unhealthy. Defaults to `1000`.
-
-- `min-quorum` `(int)` - Minimum number of servers that should always be present in a cluster.
-  Autopilot will not prune servers below this number. This should be set to the expected number
-  of voters in your cluster. There is no default.
-
-- `server-stabilization-time` `(string)` - Minimum amount of time a server must be in a healthy state before it
-  can become a voter. Until that happens, it will be visible as a peer in the cluster, but as a non-voter, meaning it
-  won't contribute to quorum. Defaults to `10s`.
-
-- `disable-upgrade-migration` `(bool)` - Controls whether to disable automated
-  upgrade migrations, an Enterprise-only feature. Defaults to `false`.
diff --git a/website/content/docs/commands/operator/rekey.mdx b/website/content/docs/commands/operator/rekey.mdx
deleted file mode 100644
index 2ff5539a1f5..00000000000
--- a/website/content/docs/commands/operator/rekey.mdx
+++ /dev/null
@@ -1,164 +0,0 @@
----
-layout: docs
-page_title: operator rekey - Command
-description: |-
-  The "operator rekey" command generates a new set of unseal keys. This can
-  optionally change the total number of key shares or the required threshold of
-  those key shares to reconstruct the root key. This operation is zero
-  downtime, but it requires the Vault is unsealed and a quorum of existing
-  unseal keys are provided.
----
-
-# operator rekey
-
-The `operator rekey` command generates a new set of unseal keys. This can
-optionally change the total number of key shares or the required threshold of
-those key shares to reconstruct the root key. This operation is zero downtime,
-but it requires the Vault is unsealed and a quorum of existing unseal keys are
-provided.
-
-An unseal key may be provided directly on the command line as an argument to the
-command. If key is specified as "-", the command will read from stdin. If a TTY
-is available, the command will prompt for text.
-
-Please see the [rotating and rekeying](/vault/tutorials/operations/rekeying-and-rotating) for
-step-by-step instructions.
-
-## Examples
-
-Initialize a rekey:
-
-```shell-session
-$ vault operator rekey \
-    -init \
-    -key-shares=15 \
-    -key-threshold=9
-```
-
-Initialize a rekey when Auto Unseal is used for the Vault cluster:
-
-```shell-session
-$ vault operator rekey \
-    -target=recovery \
-    -init \
-    -key-shares=15 \
-    -key-threshold=9
-```
-
-Initialize a rekey and activate the verification process:
-
-```shell-session
-$ vault operator rekey \
-    -init \
-    -key-shares=15 \
-    -key-threshold=9 \
-    -verify
-```
-
-Rekey and encrypt the resulting unseal keys with PGP:
-
-```shell-session
-$ vault operator rekey \
-    -init \
-    -key-shares=3 \
-    -key-threshold=2 \
-    -pgp-keys="keybase:hashicorp,keybase:jefferai,keybase:sethvargo"
-```
-
-Rekey an Auto Unseal vault and encrypt the resulting recovery keys with PGP:
-
-```shell-session
-$ vault operator rekey \
-    -target=recovery \
-    -init \
-    -pgp-keys=keybase:grahamhashicorp
-    -key-shares=1
-    -key-threshold=1
-```
-
-Store encrypted PGP keys in Vault's core:
-
-```shell-session
-$ vault operator rekey \
-    -init \
-    -pgp-keys="..." \
-    -backup
-```
-
-Retrieve backed-up unseal keys:
-
-```shell-session
-$ vault operator rekey -backup-retrieve
-```
-
-Delete backed-up unseal keys:
-
-```shell-session
-$ vault operator rekey -backup-delete
-```
-
-Perform the verification of the rekey using the verification nonce:
-
-```shell-session
-$ vault operator rekey -verify -nonce="..."
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-cancel` `(bool: false)` - Reset the rekeying progress. This will discard any submitted unseal keys
-  or configuration. The default is false.
-
-- `-init` `(bool: false)` - Initialize the rekeying operation. This can only be
-  done if no rekeying operation is in progress. Customize the new number of key
-  shares and key threshold using the `-key-shares` and `-key-threshold flags`.
-
-- `-key-shares` `(int: 5)` - Number of key shares to split the generated master
-  key into. This is the number of "unseal keys" to generate. This is aliased as
-  `-n`
-
-- `-key-threshold` `(int: 3)` - Number of key shares required to reconstruct the
-  root key. This must be less than or equal to -key-shares. This is aliased as
-  `-t`.
-
-- `-nonce` `(string: "")` - Nonce value provided at initialization. The same
-  nonce value must be provided with each unseal key.
-
-- `-pgp-keys` `(string: "...")` - Comma-separated list of paths to files on disk
-  containing public PGP keys OR a comma-separated list of Keybase usernames
-  using the format `keybase:<username>`. When supplied, the generated unseal
-  keys will be encrypted and base64-encoded in the order specified in this list.
-
-- `-status` `(bool: false)` - Print the status of the current attempt without
-  providing an unseal key. The default is false.
-
-- `-target` `(string: "barrier")` - Target for rekeying. "recovery" only applies
-  when HSM support is enabled or using [Auto Unseal](/vault/docs/concepts/seal#auto-unseal).
-
-- `-verify` `(bool: false)` - Indicate during the phase `-init` that the
-  verification process is activated for the rekey. Along with `-nonce` option
-  it indicates that the nonce given is for the verification process.
-
-### Backup options
-
-- `-backup` `(bool: false)` - Store a backup of the current PGP encrypted unseal
-  keys in Vault's core. The encrypted values can be recovered in the event of
-  failure or discarded after success. See the -backup-delete and
-  \-backup-retrieve options for more information. This option only applies when
-  the existing unseal keys were PGP encrypted.
-
-- `-backup-delete` `(bool: false)` - Delete any stored backup unseal keys.
-
-- `-backup-retrieve` `(bool: false)` - Retrieve the backed-up unseal keys. This
-  option is only available if the PGP keys were provided and the backup has not
-  been deleted.
diff --git a/website/content/docs/commands/operator/rotate.mdx b/website/content/docs/commands/operator/rotate.mdx
deleted file mode 100644
index a9de0d0fd48..00000000000
--- a/website/content/docs/commands/operator/rotate.mdx
+++ /dev/null
@@ -1,41 +0,0 @@
----
-layout: docs
-page_title: operator rotate - Command
-description: |-
-  The "operator rotate" rotates the underlying encryption key which is used to
-  secure data written to the storage backend. This installs a new key in the key
-  ring. This new key is used to encrypt new data, while older keys in the ring
-  are used to decrypt older data.
----
-
-# operator rotate
-
-The `operator rotate` rotates the underlying encryption key which is used to
-secure data written to the storage backend. This installs a new key in the key
-ring. This new key is used to encrypted new data, while older keys in the ring
-are used to decrypt older data.
-
-This is an online operation and does not cause downtime. This command is run
-per-cluster (not per-server), since Vault servers in HA mode share the same
-storage backend.
-
-## Examples
-
-Rotate Vault's encryption key:
-
-```shell-session
-$ vault operator rotate
-Key Term        3
-Install Time    01 May 17 10:30 UTC
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
diff --git a/website/content/docs/commands/operator/seal.mdx b/website/content/docs/commands/operator/seal.mdx
deleted file mode 100644
index 9edbb885a04..00000000000
--- a/website/content/docs/commands/operator/seal.mdx
+++ /dev/null
@@ -1,42 +0,0 @@
----
-layout: docs
-page_title: operator seal - Command
-description: >-
-  The "operator seal" command seals the Vault server. Sealing tells the Vault
-  server to
-
-  stop responding to any operations until it is unsealed. When sealed, the Vault
-
-  server discards its in-memory root key to unlock the data, so it is
-
-  physically blocked from responding to operations unsealed.
----
-
-# operator seal
-
-The `operator seal` seals the Vault server. Sealing tells the Vault server to
-stop responding to any operations until it is unsealed. When sealed, the Vault
-server discards its in-memory root key to unlock the data, so it is physically
-blocked from responding to operations unsealed.
-
-If an unseal is in progress, sealing the Vault will reset the unsealing process.
-Users will have to re-enter their portions of the root key again.
-
-This command does nothing if the Vault server is already sealed.
-
-For more information on sealing and unsealing, please the [seal concepts
-page](/vault/docs/concepts/seal).
-
-## Examples
-
-Seal a Vault server:
-
-```shell-session
-$ vault operator seal
-Success! Vault is sealed.
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/operator/step-down.mdx b/website/content/docs/commands/operator/step-down.mdx
deleted file mode 100644
index a22ae341b77..00000000000
--- a/website/content/docs/commands/operator/step-down.mdx
+++ /dev/null
@@ -1,33 +0,0 @@
----
-layout: docs
-page_title: operator step-down - Command
-description: |-
-  The "operator step-down" forces the Vault server at the given address to step
-  down from active duty.
----
-
-# operator step-down
-
-The `operator step-down` forces the active Vault node within an [HA cluster](/vault/docs/concepts/ha)
-to step down from active duty. When executed against a non-active node, i.e. a 
-standby or [performance standby](/vault/docs/enterprise/performance-standby) node, 
-the request will be forwarded to the active node.  While the 
-affected node will have a delay before attempting to acquire 
-the leader lock again, if no other Vault nodes acquire the
-lock beforehand, it is possible for the same node to re-acquire
-the lock and become active again. Due to the locking architecture, there may be a period of time
-before another node grabs the lock and finishes transitioning to active operation where the cluster has no active node. During the period where none of the nodes are active, forwarding of requests to the leader node will fail.
-
-## Examples
-
-Force a Vault server to step down as the leader:
-
-```shell-session
-$ vault operator step-down
-Success! Stepped down: http://127.0.0.1:8200
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/operator/unseal.mdx b/website/content/docs/commands/operator/unseal.mdx
deleted file mode 100644
index 700224ace70..00000000000
--- a/website/content/docs/commands/operator/unseal.mdx
+++ /dev/null
@@ -1,62 +0,0 @@
----
-layout: docs
-page_title: operator unseal - Command
-description: |-
-  The "operator unseal" allows the user to provide a portion of the root key
-  to unseal a Vault server.
----
-
-# operator unseal
-
-The `operator unseal` allows the user to provide a portion of the root key to
-unseal a Vault server. Vault starts in a sealed state. It cannot perform
-operations until it is unsealed. This command accepts a portion of the master
-key (an "unseal key").
-
-The unseal key can be supplied as an argument to the command, but this is
-not recommended as the unseal key will be available in your history:
-
-```shell-session
-$ vault operator unseal IXyR0OJnSFobekZMMCKCoVEpT7wI6l+USMzE3IcyDyo=
-```
-
-Instead, run the command with no arguments and it will prompt for the key:
-
-```shell-session
-$ vault operator unseal
-Key (will be hidden): IXyR0OJnSFobekZMMCKCoVEpT7wI6l+USMzE3IcyDyo=
-```
-
-For more information on sealing and unsealing, please the [seal concepts
-page](/vault/docs/concepts/seal).
-
-## Examples
-
-Provide an unseal key:
-
-```shell-session
-$ vault operator unseal
-Key (will be hidden):
-Sealed: false
-Key Shares: 1
-Key Threshold: 1
-Unseal Progress: 0
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-migrate` `(bool: false)` - Indicate that this share is provided with the intent that it is part of a seal migration process.
-
-- `-reset` `(bool: false)` - Discard any previously entered keys to the unseal
-  process.
diff --git a/website/content/docs/commands/operator/usage.mdx b/website/content/docs/commands/operator/usage.mdx
deleted file mode 100644
index 894624760cd..00000000000
--- a/website/content/docs/commands/operator/usage.mdx
+++ /dev/null
@@ -1,74 +0,0 @@
----
-layout: docs
-page_title: operator usage - Command
-description: |-
-  "operator usage" produces a report on active clients.
----
-
-# operator usage
-
-The `operator usage` command allows an administrator to retrieve a
-[client count](/vault/docs/concepts/client-count) report
-for the default reporting period, or for a specific time range of months.
-
-The command output will list clients by distinct entities, non-entity tokens, and total
-active clients for each namespace, and the total for the entire cluster. It may
-indicate that no data is available for the requested time range, which may be
-because the client count reporting is disabled, the time range is too far
-in the past, or no data has yet been collected since the feature was enabled.
-
-> Refer to the [Vault Usage Metrics](/vault/tutorials/monitoring/usage-metrics) tutorial to learn more about usage metrics,
-> including required policy and data collection details.
-
-## Examples
-
-Retrieve the client counts for the default reporting period:
-
-```shell-session
-$ vault operator usage
-Period start: 2019-11-01T00:00:00Z
-Period end: 2020-10-31T23:59:59Z
-
-Namespace path   Distinct entities   Non-Entity tokens   Active clients
---------------   -----------------   -----------------   --------------
-[root]           1581                332                 1913
-
-Total            1581                332                 1913
-```
-
-Retrieve the client counts for a specific month in the past:
-
-```shell-session
-$ vault operator usage -start-time=2020-01 -end-time=2020-01
-Period start: 2020-01-01T00:00:00Z
-Period end: 2020-01-31T23:59:59Z
-
-Namespace path   Distinct entities   Non-Entity tokens   Active clients
---------------   -----------------   -----------------   --------------
-[root]           954                 176                 1130
-
-Total            954                 176                 1130
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-start-time` `(date)` - Start month of the report to generate. May be given as YYYY-MM-DD, YYYY-MM-DD,
-  a full RFC3339 timestamp, or a Unix epoch timestamp. Defaults to the configurable `default_report_months`
-  prior to `end-time`.
-
-- `-end-time` `(date: previous month)` - End month of the report to generate. Defaults to the end of the
-  previous calendar month.
-
-The output shows the exact time range being reported, which may not match the input parameters if a full
-month is not available, or if the available reports are a subset of the months requested.
diff --git a/website/content/docs/commands/operator/utilization.mdx b/website/content/docs/commands/operator/utilization.mdx
deleted file mode 100644
index eb639d20102..00000000000
--- a/website/content/docs/commands/operator/utilization.mdx
+++ /dev/null
@@ -1,83 +0,0 @@
----
-layout: docs
-page_title: operator utilization - Command
-description: |-
-  The "operator utilization" generates license utilization reporting bundles for the Vault Enterprise users.
----
-
-# operator utilization
-
-The `operator utilization` allows the Vault Enterprise users to generate license
-utilization reporting bundles. When users have disabled automated license
-reporting, use this command to manually generate the report and send it to
-HashiCorp.
-
-<Note title="Vault Enterprise">
-
-Refer to the [manual license utilization
-reporting](/vault/docs/enterprise/license/manual-reporting) page to learn more
-about reporting your Vault Enterprise license utilization.
-
-</Note>
-
-## Examples
-
-Create a license utilization bundle that includes all persisted historical
-snapshots and has the default bundle name
-(`vault-utilization-<time_stamp>.json`):
-
-```shell-session
-$ vault operator utilization
-Success! License utilization reporting bundle written to: vault-utilization-2024-02-16T22-23-25Z.json
-```
-
-Create a license utilization bundle with a message about the bundle, and output
-the file at the specified path, `/utilization/reports/latest.json`.
-
-```shell-session
-$ vault operator utilization \
-    -message="Change Control 654987" \
-    -output="/utilization/reports/latest.json"
-```
-
-**Example output:**
-
-<CodeBlockConfig hideClipboard>
-
-```plaintext
-Success! License utilization reporting bundle written to: /utilization/reports/latest.json
-```
-
-</CodeBlockConfig>
-
-The message, `Change Control 654987`, is included in the _server log_, but not
-in the bundle.
-
-**Example entry in the server log:**
-
-<CodeBlockConfig hideClipboard>
-
-```plaintext
-[INFO]  reporting: generating license utilization bundle
-[INFO]  reporting: generating license utilization bundle: message="Change Control 654987"
-```
-
-</CodeBlockConfig>
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Command options
-
-- `-message` `(string; "")` - Provide context about the conditions under which
-the report was generated and submitted. This message is not included in the
-license utilization bundle but will be included in the vault server logs.
-
-- `-output` `(string; "")` - Specifies the output path for the bundle. Defaults
-to a time-based generated file name.
-
-- `-today-only` `(bool: false)` - To include only today’s snapshot, no
-historical snapshots. If no snapshots were persisted in the last 24 hrs, it
-takes a snapshot and exports it to a bundle.
diff --git a/website/content/docs/commands/patch.mdx b/website/content/docs/commands/patch.mdx
deleted file mode 100644
index 882f64025da..00000000000
--- a/website/content/docs/commands/patch.mdx
+++ /dev/null
@@ -1,87 +0,0 @@
----
-layout: docs
-page_title: patch - Command
-description: |-
-  The "patch" command updates data in Vault at the given path. The data can be
-  credentials, secrets, configuration, or arbitrary data. The specific behavior
-  of this command is determined at the thing mounted at the path.
----
-
-# patch
-
-The `patch` command updates data in Vault at the given path (wrapper command for
-HTTP PATCH using the [JSON Patch format](https://datatracker.ietf.org/doc/html/rfc6902)).
-The data can be credentials, secrets, configuration, or arbitrary data. The specific
-behavior of the `patch` command is determined at the thing mounted at the path.
-
-Data is specified as "**key=value**" pairs on the command line. If the value begins
-with an "**@**", then it is loaded from a file. If the value for a key is "**-**", Vault
-will read the value from stdin rather than the command line.
-
-Some API fields require more advanced structures such as maps. These cannot
-directly be represented on the command line. However, direct control of the
-request parameters can be achieved by using `-` as the only data argument.
-This causes `vault patch` to read a JSON blob containing all request parameters
-from stdin. This argument will be ignored if used in conjunction with any
-"key=value" pairs.
-
-For a full list of examples and paths, please see the documentation that
-corresponds to the secrets engines in use.
-
-Unlike [the `write` command](/vault/docs/commands/write), the `patch` command only
-modifies data specified on the command line.
-
-## Examples
-
-Updates a PKI role to modify a single parameter:
-
-```shell-session
-$ vault patch pki/roles/example allow_localhost=false
-```
-
-### API versus CLI
-
-Updates a PKI role to modify the `allow_localhost` parameter:
-
-```shell-session
-$ vault patch pki/roles/example allow_localhost=false
-```
-
-Equivalent cURL command for this operation:
-
-```shell-session
-$ tee request_payload.json -<<EOF
-{
-   "organization": "hashicorp"
-}
-EOF
-
-$ curl --header "X-Vault-Token: $VAULT_TOKEN" \
-    --request PATCH \
-    --header 'Content-Type: application/merge-patch+json'
-    --data @request_payload.json \
-    $VAULT_ADDR/v1/pki/roles/example
-```
-
-The `vault patch` command simplifies the API call.
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name, in the format
-  specified in the `-format` directive. The result will not have a trailing
-  newline making it ideal for piping to other processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-force` `(bool: false)` - Allow the operation to continue with no key=value
-  pairs. This allows writing to keys that do not need or expect data. This is
-  aliased as `-f`.
diff --git a/website/content/docs/commands/path-help.mdx b/website/content/docs/commands/path-help.mdx
deleted file mode 100644
index 4099fb1104d..00000000000
--- a/website/content/docs/commands/path-help.mdx
+++ /dev/null
@@ -1,91 +0,0 @@
----
-layout: docs
-page_title: path-help - Command
-description: |-
-  The "path-help" command retrieves API help for paths. All endpoints in Vault
-  provide built-in help in markdown format. This includes system paths, secret
-  engines, and auth methods.
----
-
-# path-help
-
-The `path-help` command retrieves API help for paths. All endpoints in Vault
-provide built-in help in markdown format. This includes system paths, secret
-engines, and auth methods.
-
-The help system is the easiest way to learn how to use the various systems
-in Vault, and also allows you to discover new paths.
-
-Before using `path-help`, it is important to understand "paths" within Vault.
-Paths are the parameters used for `vault read`, `vault write`, etc. An example
-path is `secret/foo`, or `aws/config/root`. The paths available depend on the
-secrets engines in use. Because of this, the interactive help is an
-indispensable tool to finding what paths are supported.
-
-To discover what paths are supported, use `vault path-help PATH`. For example,
-if you enabled the AWS secrets engine, you can use `vault path-help aws` to find
-the paths supported by that backend. The paths are shown with regular
-expressions, which can make them hard to parse, but they are also extremely
-exact.
-
-## Examples
-
-Get help output for the KV secrets engine:
-
-```shell-session
-$ vault path-help secret
-## DESCRIPTION
-
-The KV backend reads and writes arbitrary secrets to the backend.
-The secrets are encrypted/decrypted by Vault: they are never stored
-unencrypted in the backend and the backend never has an opportunity to
-see the unencrypted value.
-
-Leases can be set on a per-secret basis. These leases will be sent down
-when that secret is read, and it is assumed that some outside process will
-revoke and/or replace the secret at that path.
-
-## PATHS
-
-The following paths are supported by this backend. To view help for
-any of the paths below, use the help command with any route matching
-the path pattern. Note that depending on the policy of your auth token,
-you may or may not be able to access certain paths.
-
-    ^.*$
-        Pass-through secret storage to the storage backend, allowing you to
-        read/write arbitrary data into secret storage.
-```
-
-Once you've found a path you like, you can learn more about it by using `vault path-help <path>` where "path" is a path that matches one of the regular
-expressions from the backend help.
-
-```shell-session
-$ vault path-help secret/password
-Request:        password
-Matching Route: ^.*$
-
-Pass-through secret storage to the storage backend, allowing you to
-read/write arbitrary data into secret storage.
-
-## PARAMETERS
-
-    lease (string)
-        Lease time for this key when read. Ex: 1h
-
-## DESCRIPTION
-
-The pass-through backend reads and writes arbitrary data into secret storage,
-encrypting it along the way.
-
-A lease can be specified when writing with the "lease" field. If given, then
-when the secret is read, Vault will report a lease with that duration. It
-is expected that the consumer of this backend properly writes renewed keys
-before the lease is up. In addition, revocation must be handled by the
-user of this backend.
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/pki/health-check.mdx b/website/content/docs/commands/pki/health-check.mdx
deleted file mode 100644
index 568a9d40782..00000000000
--- a/website/content/docs/commands/pki/health-check.mdx
+++ /dev/null
@@ -1,552 +0,0 @@
----
-layout: docs
-page_title: pki health-check - Command
-description: |-
-  The "pki health-check" command verifies the health of the given PKI secrets
-  engine mount against an optional configuration.
----
-
-# pki health-check
-
-The `pki health-check` command verifies the health of the given PKI secrets
-engine mount against an optional configuration.
-
-This runs with the permissions of the given token, reading various APIs from
-the mount and `/sys` against the given Vault server
-
-Mounts need to be specified with any namespaces prefixed in the path, e.g.,
-`ns1/pki`.
-
-## Examples
-
-Performs a basic health check against the `pki-root` mount:
-
-```shell-session
-$ vault pki health-check pki-root/
-```
-
-Configuration can be specified using the `-health-config` flag:
-
-```shell-session
-$ vault pki health-check -health-config=mycorp-root.json pki-root/
-```
-
-Using the `-list` flag will show the list of health checks and any
-known configuration values (with their defaults) that will be run
-against this mount:
-
-```shell-session
-$ vault pki health-check -list pki-root/
-```
-
-## Usage
-
-The following flags are unique to this command:
-
- - `-default-disabled` - When specified, results in all health checks being
-   disabled by default unless enabled by the configuration file explicitly.
-  The default is `false`, meaning all default-enabled health checks will run.
-
- - `-health-config` `(string: "")` - Path to JSON configuration file to
-   modify health check execution and parameters.
-
- - `-list` - When specified, no health checks are run, but all known health
-   checks are printed. Still requires a positional mount argument. The default
-   is `false`, meaning no listing is printed and health checks will execute.
-
- - `-return-indicator` `(string: "default")` - Behavior of the return value
-   (exit code) of this command:
-     - `permission`, for exiting with a non-zero code when the tool lacks
-       permissions or has a version mismatch with
-       the server;
-     - `critical`, for exiting with a non-zero code when a check returns a
-       critical status in addition to the above;
-     - `warning`, for exiting with a non-zero status when a check returns a
-       warning status in addition to the above;
-     - `informational`, for exiting with a non-zero status when a check
-       returns an informational status in addition to the above;
-     - `default`, for the default behavior based on severity of message
-        and only returning a zero exit status when all checks have passed
-        and no execution errors have occurred.
-
-This command respects the `-format` parameter to control the presentation of
-output sent to stdout. Fatal errors that prevent health checks from executing
-may not follow this formatting.
-
-## Return status and output
-
-This command returns the following exit codes:
-
- - `0` - Everything is good.
- - `1` - Usage error (check CLI parameters).
- - `2` - Informational message from a health check.
- - `3` - Warning message from a health check.
- - `4` - Critical message from a health check.
- - `5` - A version mismatch between health check and Vault Server occurred,
-	     preventing one or more health checks from being fully run.
- - `6` - A permission denied message was returned from Vault Server for
-	     one or more health checks.
-
-Note that an exit code of `5` (due to a version mismatch) is not necessarily
-fatal to the health check. For example, the `crl_validity_period` health
-check will return an invalid version warning when run against Vault 1.11 as
-no Delta CRL exists for this version of Vault, but this will not impact its
-ability to check the complete CRL.
-
-Each health check outputs one or results in a list. This list contains a
-mapping of keys (`status`, `status_code`, `endpoint`, and `message`) to
-values returned by the health check. An endpoint may occur in more than
-one health check and is not necessarily guaranteed to exist on the server
-(e.g., using wildcards to indicate all matching paths have the same
-result). Tabular form elides the status code, as this is meant to be
-consumed programatically.
-
-These correspond to the following health check status values:
-
- - status `not_applicable` / status code `0`: exit code `0`.
- - status `ok` / status code `1`: exit code `0`
- - status `informational` / status code `2`: exit code `2`.
- - status `warning` / status code `3`: exit code `3`.
- - status `critical` / status code `4`: exit code `4`.
- - status `invalid_version` / status code `5`: exit code `5`.
- - status `insufficient_permissions` / status code `6`: exit code `6`.
-
-## Health checks
-
-The following health checks are currently implemented. More health checks may
-be added in future releases and may default to being enabled.
-
-### CA validity period
-
-**Name**: `ca_validity_period`
-
-**Accessed APIs**:
-
- - `LIST /issuers` (unauthenticated)
- - `READ /issuer/:issuer_ref/json` (unauthenticated)
-
-**Config Parameters**:
-
- - `root_expiry_critical` `(duration: 182d)` - for a duration within which the root's lifetime is considered critical
- - `intermediate_expiry_critical` `(duration: 30d)` - for a duration within which the intermediate's lifetime is considered critical
- - `root_expiry_warning` `(duration: 365d)` -  for a duration within which the root's lifetime is considered warning
- - `intermediate_expiry_warning` `(duration: 60d)` - for a duration within which the intermediate's lifetime is considered warning
- - `root_expiry_informational` `(duration: 730d)` - for a duration within which the root's lifetime is considered informational
- - `intermediate_expiry_informational` `(duration: 180d)` - for a duration within which the intermediate's lifetime is considered informational
-
-This health check will check each issuer in the mount for validity status, returning a list. If a CA expires within the next 30 days, the result will be critical. If a root CA expires within the next 12 months or an intermediate CA within the next 2 months, the result will be a warning. If a root CA expires within 24 months or an intermediate CA within 6 months, the result will be informational.
-
-**Remediation steps**:
-
-1. Perform a [CA rotation operation](/vault/docs/secrets/pki/rotation-primitives)
-   to check for CAs that are about to expire.
-1. Migrate from expiring CAs to new CAs.
-1. Delete any expired CAs with one of the following options:
-  - Run [tidy](/vault/api-docs/secret/pki#tidy) manually with `vault write <mount>/tidy tidy_expired_issuers=true`.
-  - Use the Vault API to call [delete issuer](/vault/api-docs/secret/pki#delete-issuer).
-
-
-### CRL validity period
-
-**Name**: `crl_validity_period`
-
-**Accessed APIs**:
-
- - `LIST /issuers` (unauthenticated)
- - `READ /config/crl` (optional)
- - `READ /issuer/:issuer_ref/crl` (unauthenticated)
- - `READ /issuer/:issuer_ref/crl/delta` (unauthenticated)
-
-**Config Parameters**:
-
- - `crl_expiry_pct_critical` `(int: 95)` - the percentage of validity period after which a CRL should be considered critically close to expiry
- - `delta_crl_expiry_pct_critical` `(int: 95)` - the percentage of validity period after which a Delta CRL should be considered critically close to expiry
-
-This health check checks each issuer's CRL for validity status, returning a list. Unlike CAs, where a date-based duration makes sense due to effort required to successfully rotate, rotating CRLs are much easier, so a percentage based approach makes sense. If the chosen percentage exceeds that of the `grace_period` from the CRL configuration, an informational message will be issued rather than OK.
-
-For informational purposes, it reads the CRL config and suggests enabling auto-rebuild CRLs if not enabled.
-
-**Remediation steps**:
-
-Use `vault write` to enable CRL auto-rebuild:
-
-```shell-session
-$ vault write <mount>/config/crl auto_rebuild=true
-```
-
-### Hardware-Backed root certificate
-
-**Name**: `hardware_backed_root`
-
-**APIs**:
-
- - `LIST /issuers` (unauthenticated)
- - `READ /issuer/:issuer_ref`
- - `READ /key/:key_ref`
-
-**Config Parameters**:
-
- - `enabled` `(boolean: false)` - defaults to not being run.
-
-This health check checks issuers for root CAs backed by software keys. While Vault is secure, for production root certificates, we'd recommend the additional integrity of KMS-backed keys. This is an informational check only. When all roots are KMS-backed, we'll return OK; when no issuers are roots, we'll return not applicable.
-
-Read more about hardware-backed keys within [Vault Enterprise Managed Keys](/vault/docs/enterprise/managed-keys)
-
-### Root certificate issued Non-CA leaves
-
-**Name**: `root_issued_leaves`
-
-**APIs**:
-
- - `LIST /issuers` (unauthenticated)
- - `READ /issuer/:issuer_ref/pem` (unauthenticated)
- - `LIST /certs`
- - `READ /certs/:serial` (unauthenticated)
-
-**Config Parameters**:
-
- - `certs_to_fetch` `(int: 100)` - a quantity of leaf certificates to fetch to see if any leaves have been issued by a root directly.
-
-This health check verifies whether a proper CA hierarchy is in use. We do this by fetching `certs_to_fetch` leaf certificates (configurable) and seeing if they are a non-issuer leaf and if they were signed by a root issuer in this mount. If one is found, we'll issue a warning about this, and recommend setting up an intermediate CA.
-
-**Remediation steps**:
-
-1. Restrict the use of `sign`, `sign-verbatim`, `issue`, and ACME APIs against
-   the root issuer.
-1. Create an intermediary issuer in a different mount.
-1. Have the root issuer sign the new intermediary issuer.
-1. Issue new leaf certificates using the intermediary issuer.
-
-### Role allows implicit localhost issuance
-
-**Name**: `role_allows_localhost`
-
-**APIs**:
-
- - `LIST /roles`
- - `READ /roles/:name`
-
-**Config Parameters**: (none)
-
-Checks whether any roles exist that allow implicit localhost based issuance
-(`allow_localhost=true`) with a non-empty `allowed_domains` value.
-
-**Remediation steps**:
-
-1. Set `allow_localhost` to `false` for all roles.
-1. Update the `allowed_domains` field with an explicit list of allowed
-   localhost-like domains.
-
-### Role allows Glob-Based wildcard issuance
-
-**Name**: `role_allows_glob_wildcards`
-
-**APIs**:
-
- - `LIST /roles`
- - `READ /roles/:name`
-
-**Config Parameters**:
-
- - `allowed_roles` `(list: nil)` - an allow-list of roles to ignore.
-
-Check each role to see whether or not it allows wildcard issuance **and** glob
-domains. Wildcards and globs can interact and result in nested wildcards among
-other (potentially dangerous) quirks.
-
-**Remediation steps**:
-
-1. Split any role that need both of `allow_glob_domains` and `allow_wildcard_certificates` to be true into two roles.
-1. Continue splitting roles until both of the following are true for all roles:
-    - The role has `allow_glob_domains` **or** `allow_wildcard_certificates`, but
-      not both.
-    - Roles with `allow_glob_domains` **and** `allow_wildcard_certificates` are
-      the only roles required for **all** SANs on the certificate.
-1. Add the roles that allow glob domains and wildcards to `allowed_roles` so
-   Vault ignores them in future checks.
-
-### Role sets `no_store=false` and performance
-
-**Name**: `role_no_store_false`
-
-**APIs**:
-
- - `LIST /roles`
- - `READ /roles/:name`
- - `LIST /certs`
- - `READ /config/crl`
-
-**Config Parameters**:
-
- - `allowed_roles` `(list: nil)` - an allow-list of roles to ignore.
-
-Checks each role to see whether `no_store` is set to `false`.
-
-<Warning>
-
-Vault will provide warnings and performance will suffer if you have a large
-number of certificates without temporal CRL auto-rebuilding and set `no_store`
-to `true`.
-
-</Warning>
-
-
-**Remediation steps**:
-
-1. Update none-ACME roles with `no_store=false`. **NOTE**: Roles used for ACME
-   issuance must have `no_store`  set to `true`.
-1. Set your certificate lifetimes as short as possible.
-1. Use [BYOC revocations](/vault/api-docs/secret/pki#revoke-certificate) to
-   revoke certificates as needed.
-
-### Accessibility of audit information
-
-**Name**: `audit_visibility`
-
-**APIs**:
-
- - `READ /sys/mounts/:mount/tune`
-
-**Config Parameters**:
-
- - `ignored_parameters` `(list: nil)` - a list of parameters to ignore their HMAC status.
-
-This health check checks whether audit information is accessible to log consumers, validating whether our list of safe and unsafe audit parameters are generally followed. These are informational responses, if any are present.
-
-**Remediation steps**:
-
-Use `vault secrets tune` to set the desired audit parameters:
-
-```shell-session
-$ vault secrets tune \
-  -audit-non-hmac-response-keys=certificate \
-  -audit-non-hmac-response-keys=issuing_ca \
-  -audit-non-hmac-response-keys=serial_number \
-  -audit-non-hmac-response-keys=error \
-  -audit-non-hmac-response-keys=ca_chain \
-  -audit-non-hmac-request-keys=certificate \
-  -audit-non-hmac-request-keys=issuer_ref \
-  -audit-non-hmac-request-keys=common_name \
-  -audit-non-hmac-request-keys=alt_names \
-  -audit-non-hmac-request-keys=other_sans \
-  -audit-non-hmac-request-keys=ip_sans \
-  -audit-non-hmac-request-keys=uri_sans \
-  -audit-non-hmac-request-keys=ttl \
-  -audit-non-hmac-request-keys=not_after \
-  -audit-non-hmac-request-keys=serial_number \
-  -audit-non-hmac-request-keys=key_type \
-  -audit-non-hmac-request-keys=private_key_format \
-  -audit-non-hmac-request-keys=managed_key_name \
-  -audit-non-hmac-request-keys=managed_key_id \
-  -audit-non-hmac-request-keys=ou \
-  -audit-non-hmac-request-keys=organization \
-  -audit-non-hmac-request-keys=country \
-  -audit-non-hmac-request-keys=locality \
-  -audit-non-hmac-request-keys=province \
-  -audit-non-hmac-request-keys=street_address \
-  -audit-non-hmac-request-keys=postal_code \
-  -audit-non-hmac-request-keys=permitted_dns_domains \
-  -audit-non-hmac-request-keys=policy_identifiers \
-  -audit-non-hmac-request-keys=ext_key_usage_oids \
-  -audit-non-hmac-request-keys=csr \
-   <mount>
-```
-
-### ACL policies allow problematic endpoints
-
-**Name**: `policy_allow_endpoints`
-
-**APIs**:
-
- - `LIST /sys/policy`
- - `READ /sys/policy/:name`
-
-**Config Parameters**:
-
- - `allowed_policies` `(list: nil)` -  a list of policies to allow-list for access to insecure APIs.
-
-This health check checks whether unsafe access to APIs (such as `sign-intermediate`, `sign-verbatim`, and `sign-self-issued`) are allowed. Any findings are a critical result and should be rectified by the administrator or explicitly allowed.
-
-### Allow If-Modified-Since requests
-
-**Name**: `allow_if_modified_since`
-
-**APIs**:
-
- - `READ /sys/internal/ui/mounts`
-
-**Config Parameters**: (none)
-
-This health check verifies if the `If-Modified-Since` header has been added to `passthrough_request_headers` and if `Last-Modified` header has been added to `allowed_response_headers`. This is an informational message if both haven't been configured, or a warning if only one has been configured.
-
-**Remediation steps**:
-
-1. Update `allowed_response_headers` and `passthrough_request_headers` for all
-   policies with `vault secrets tune`:
-
-  ```shell-session
-  $ vault secrets tune \
-      -passthrough-request-headers="If-Modified-Since" \
-      -allowed-response-headers="Last-Modified" \
-      <mount>
-  ```
-
-1. Update ACME-specific headers with `vault secrets tune` (if you are using ACME):
-
-  ```shell-session
-  $ vault secrets tune \
-      -passthrough-request-headers="If-Modified-Since" \
-      -allowed-response-headers="Last-Modified" \
-      -allowed-response-headers="Replay-Nonce" \
-      -allowed-response-headers="Link" \
-      -allowed-response-headers="Location" \
-      <mount>
-  ```
-
-### Auto-Tidy disabled
-
-**Name**: `enable_auto_tidy`
-
-**APIs**:
-
- - `READ /config/auto-tidy`
-
-**Config Parameters**:
-
- - `interval_duration_critical` `(duration: 7d)` - the maximum allowed interval_duration to hit critical threshold.
- - `interval_duration_warning` `(duration: 2d)` - the maximum allowed interval_duration to hit a warning threshold.
- - `pause_duration_critical` `(duration: 1s)` - the maximum allowed pause_duration to hit a critical threshold.
- - `pause_duration_warning` `(duration: 200ms)` - the maximum allowed pause_duration to hit a warning threshold.
-
-This health check verifies that auto-tidy is enabled, with sane defaults for interval_duration and pause_duration. Any disabled findings will be informational, as this is a best-practice but not strictly required, but other findings w.r.t. `interval_duration` or `pause_duration` will be critical/warnings.
-
-**Remediation steps**
-
-Use `vault write` to enable auto-tidy with the recommended defaults:
-
-```shell-session
-$ vault write <mount>/config/auto-tidy \
-    enabled=true \
-    tidy_cert_store=true \
-    tidy_revoked_certs=true \
-    tidy_acme=true \
-    tidy_revocation_queue=true \
-    tidy_cross_cluster_revoked_certs=true \
-    tidy_revoked_cert_issuer_associations=true
-```
-
-### Tidy hasn't run
-
-**Name**: `tidy_last_run`
-
-**APIs**:
-
- - `READ /tidy-status`
-
-**Config Parameters**:
-
- - `last_run_critical` `(duration: 7d)` - the critical delay threshold between when tidy should have last run.
- - `last_run_warning` `(duration: 2d)` - the warning delay threshold between when tidy should have last run.
-
-This health check verifies that tidy has run within the last run window. This can be critical/warning alerts as this can start to seriously impact Vault's performance.
-
-**Remediation steps**:
-
-1. Schedule a manual run of tidy with `vault write`:
-
-  ```shell-session
-  $ vault write <mount>/tidy \
-      tidy_cert_store=true \
-      tidy_revoked_certs=true \
-      tidy_acme=true \
-      tidy_revocation_queue=true \
-      tidy_cross_cluster_revoked_certs=true \
-      tidy_revoked_cert_issuer_associations=true
-  ```
-
-1. Review the tidy status endpoint, `vault read <mount>/tidy-status` for
-   additional information.
-1. Re-configure auto-tidy based on the log information and results of your
-   manual run.
-
-
-### Too many certificates
-
-**Name**: `too_many_certs`
-
-**APIs**:
-
- - `READ /tidy-status`
- - `LIST /certs`
-
-**Config Parameters**:
-
- - `count_critical` `(int: 250000)` - the critical threshold at which there are too many certs.
- - `count_warning` `(int: 50000)` - the warning threshold at which there are too many certs.
-
-This health check verifies that this cluster has a reasonable number of certificates. Ideally this would be fetched from tidy's status or a new metric reporting format, but as a fallback when tidy hasn't run, a list operation will be performed instead.
-
-**Remediation steps**:
-
-1. Verify that tidy ran recently with `vault read`:
-    ```shell-session
-    $ vault read <mount>/tidy-status
-    ````
-1. Schedule a manual run of tidy with `vault write`:
-    ```shell-session
-    $ vault write <mount>/tidy \
-      tidy_cert_store=true \
-      tidy_revoked_certs=true \
-      tidy_acme=true \
-      tidy_revocation_queue=true \
-      tidy_cross_cluster_revoked_certs=true \
-      tidy_revoked_cert_issuer_associations=true
-    ```
-1. Enable `auto-tidy`.
-1. Make sure that you are not renewing certificates too soon. Certificate
-   lifetimes should reflect the expected usage of the certificate. If the TTL is
-   set appropriately, most certificates renew at approximately 2/3 of their
-   lifespan.
-1. Consider setting the `no_store` field for all roles to `true` and use [BYOC revocations](/vault/api-docs/secret/pki#revoke-certificate) to avoid storage.
-
-### Enable ACME issuance
-
-**Name**: `enable_acme_issuance`
-
-**APIs**:
-
-- `READ /config/acme`
-- `READ /config/cluster`
-- `LIST /issuers` (unauthenticated)
-- `READ /issuer/:issuer_ref/json` (unauthenticated)
-
-**Config Parameters**: (none)
-
-This health check verifies that ACME is enabled within a mount that contains an intermediary issuer, as this is considered a best-practice to support a self-rotating PKI infrastructure.
-
-Review the [ACME Certificate Issuance](/vault/api-docs/secret/pki#acme-certificate-issuance)
-API documentation to learn about enabling ACME support in Vault.
-
-### ACME response headers
-
-**Name**: `allow_acme_headers`
-
-**APIs**:
-
-- `READ /sys/internal/ui/mounts`
-
-**Config Parameters**: (none)
-
-This health check verifies if the `"Replay-Nonce`, `Link`, and `Location` headers have been added to `allowed_response_headers`, when the ACME feature is enabled. The ACME protocol will not work if these headers are not added to the mount.
-
-**Remediation steps**:
-
-Use `vault secrets tune` to add the missing headers to `allowed_response_headers`:
-```shell-session
-$ vault secrets tune \
-  -allowed-response-headers="Last-Modified" \
-  -allowed-response-headers="Replay-Nonce" \
-  -allowed-response-headers="Link" \
-  -allowed-response-headers="Location" \
-  <mount>
-```
diff --git a/website/content/docs/commands/pki/index.mdx b/website/content/docs/commands/pki/index.mdx
deleted file mode 100644
index 0a98b34e0b9..00000000000
--- a/website/content/docs/commands/pki/index.mdx
+++ /dev/null
@@ -1,94 +0,0 @@
----
-layout: docs
-page_title: pki - Command
-description: |-
-  The "pki" command groups subcommands for interacting with Vault's PKI
-  secrets engine.
----
-
-# pki
-
-The `pki` command groups subcommands for interacting with Vault's
-[PKI Secrets Engine](/vault/docs/secrets/pki).
-
-## Syntax
-
-Option flags for a given subcommand are provided after the subcommand, but before the arguments.
-
-## Example health check
-
-To [health check](/vault/docs/commands/pki/health-check) a mount, use the
-`vault pki health-check <mount>` command:
-
-```
-$ vault pki health-check pki
-ca_validity_period
-------------------
-status    endpoint                                            message
-------    --------                                            -------
-ok        /pki/issuer/da41ffb1-cc6d-5a5c-f147-e4d7beeb1b73    Issuer's validity (2032-12-17) is OK
-
-... more output elided ...
-```
-
-## Example verify sign
-
-To [verify](/vault/docs/commands/pki/verify-sign) the signature between two
-issuer certificates, use the `vault pki verify-sign <parent> <child>` command:
-
-```shell-session
-$ vault pki verify-sign pki_root/issuer/root pki_int/issuer/FirstDepartment
-issuer:pki_root/issuer/root
-issued:pki_int/issuer/FirstDepartment
-
-field              value
------              -----
-subject_match      true
-path_match         true
-trust_match        true
-key_id_match       true
-signature_match    true
-```
-
-## Example list child issuers
-
-To [list intermediate](/vault/docs/commands/pki/list-intermediates) certificates
-potentially issued by a certificate inside vault, use the
-`vault pki list-intermediates <parent>` command:
-
-```shell-session
-$ vault pki list-intermediates /pki_root/issuer/default
-intermediate                                             match?
-------------                                             ------
-pki_int_2/issuer/d4404ccc-3ad4-83a9-f5df-398637654b3b    true
-pki_int_2/issuer/db0b0a6c-6641-ac15-363a-4e5261315581    true
-pki_root/issuer/9464c4fe-e8a6-d96a-0566-021575e7382c     true
-pki_int/issuer/2f958ec5-1838-336e-331b-07032379b958      true
-pki_int/issuer/b8cc0b41-e0e9-1a92-12c4-6849c9d6f837      true
-```
-
-## Example issue
-
-To [issue](/vault/docs/commands/pki/issue) a new issuer certificate, use the
-`vault pki issue <parent-certificate-path> <mount>` command:
-
-```shell-session
-$ vault pki issue -issuer_name="FirstDepartment" /pki_root/issuer/default /pki_int/ common_name="first-department.example.com"
-Key                               Value
----                               -----
-ca_chain                          [-----BEGIN CERTIFICATE-----
-MIIDsDCCApigAwIBAgIULEPuHTW7UDtAQg+qcc18osNWgZIwDQYJKoZIhvcNAQEL...
-```
-
-## Example reissue
-
-To [reissue](/vault/docs/commands/pki/reissue) an issuer certificate, using the
-same fields as an existing issuer template, use the
-`vault pki reissue <parent-certificate-path> <template> <mount>` command:
-
-```shell-session
-$ vault pki reissue -issuer_name="SecondDepartment" /pki_root/issuer/default /pki_int/issuer/FirstDepartment /pki_int_2/ common_name="second-department.example.com"
-Key                               Value
----                               -----
-ca_chain                          [-----BEGIN CERTIFICATE-----
-MIID0DCCArigAwIBAgIUdfRe05B5eRXsg3pvsJ/g94eYuWkwDQYJKoZIhvcNAQEL```
diff --git a/website/content/docs/commands/pki/issue.mdx b/website/content/docs/commands/pki/issue.mdx
deleted file mode 100644
index 674f1fa4f87..00000000000
--- a/website/content/docs/commands/pki/issue.mdx
+++ /dev/null
@@ -1,72 +0,0 @@
----
-layout: docs
-page_title: pki issue - Command
-description: |-
-  The "pki issue" command issues a new intermediate ("issuer") certificate,
-  using a parent certificate in vault.
----
-
-# pki issue
-
-This command creates a intermediate certificate authority certificate signed by
-the `<parent>` in the `<child_mount>`, using the options to determine the fields
-on that certificate.
-
-## Usage
-
-Usage: `vault pki issue [flags] <parent> <child_mount> [options]`
-
-- `[flags]` are optional arguments described below
-
-- `<parent>` is the fully qualified path of the Certificate Authority in vault
-  which will issue the new intermediate certificate.
-
-- `<child_mount>` is the path of the mount in vault where the new issuer is saved.
-
-- `[options]` are the superset of the k=v options passed to generate-intermediate-csr
-  and sign-intermediate commands.  At least one option must be set.
-  See [below](/vault/docs/commands/pki/issue#options).
-
-### Flags
-
-- `-type` `(string: "internal")` - This determines the type of key use for the
-   newly created certificate.  Valid types are `"existing"` - where we link to
-   a key already present in the vault-backend to be used (and expect option
-   arguments `"key_ref"`) - `"internal"` - to generate a new key for this
-   certificate - or `"kms"` - to link to an external key.  Exported keys are not
-   available through this API.
-
-- `-issuer_name` `(string: "")` - If present, the newly created issuer will be
-   given this name.
-
-### Options
-
-Other than `type` (which is passed as a flag, see above), this command accepts
-all options provided to the
-[Generate CSR](/vault/api-docs/secret/pki#generate-intermediate-csr) and
-[Sign Intermediate](/vault/api-docs/secret/pki#sign-intermediate) endpoints.
-
-### Accessed APIs
-
-Note that the vault user running this command will need to have access to the
-following API endpoints, each representing a step in the process:
-
- - `READ /:parent` - used to check validity
- - `WRITE /:child_mount/intermediate/generate/:type` - used to generate the csr
- - `WRITE /:parent/sign-intermediate` - used to sign the csr
- - `WRITE /:child_mount/issuers/import/cert` - used to import the new issuer,
- and the issuer chain
- - `UPDATE /:child_mount/issuer/:issuer_refs` - used to both name the new
- issuer, and also set the name of the parent in the issuer chain
- - `READ /:child_mount/issuer/:new_issuer_ref` - used to verify completion,
- generate the output
-
-## Examples
-
-```shell-session
-$ vault pki issue -issuer_name="FirstDepartment" /pki_root/issuer/default /pki_int/ common_name="first-department.example.com"
-Key                               Value
----                               -----
-ca_chain                          [-----BEGIN CERTIFICATE-----
-MIIDsDCCApigAwIBAgIULEPuHTW7UDtAQg+qcc18osNWgZIwDQYJKoZIhvcNAQEL...
-```
diff --git a/website/content/docs/commands/pki/list-intermediates.mdx b/website/content/docs/commands/pki/list-intermediates.mdx
deleted file mode 100644
index aa0606c3e4c..00000000000
--- a/website/content/docs/commands/pki/list-intermediates.mdx
+++ /dev/null
@@ -1,89 +0,0 @@
----
-layout: docs
-page_title: pki list-intermediates - Command
-description: |-
-  The "pki list-intermediates" command searches a mount, or set of mounts for
-  child certificates.
----
-
-# pki list-intermediates
-
-This command determines which of a list of certificates were issued by a given
-parent certificate.
-
-## Usage
-
-Usage: `vault pki list-intermediates [flags] <parent> [child] [child] [child...`
-
-Lists the set of intermediate CAs issued by this parent issuer.
-
-- `[flags]` listed below determine the type of match required between the `<parent>`
-  and each potential child, and the type of output
-
-- `<parent>` is the certificate that might be the issuer which everything is
-  verified against.
-
-- `[child]` is an optional path to a certificate to be compared to the `<parent>`,
-  or pki mounts to look for certificates on. If `[child]` is omitted entirely, the
-  list will be constructed from all accessible pki mounts.
-
-This returns a list of issuing certificates and whether they are a match.
-By default, the type of match required is whether the `<parent>` has the
-expected subject, [authority/subject key id match](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1), and could have (directly) signed this issuer.
-The match criteria can be updated by changed the corresponding flag.
-
-### Flags
-
-- `-use_names` `(bool: "false")` - this determines how issuers are referred to
-  in the output, whether by issuer_id (the default), or by their name, or status
-  as default issuer (when use_names is true)
-
-The following flags determine what sorts of relationship between the parent and
-potential child issuers are considered a match.
-
-- `-subject_match` `(bool: "true")` - determines whether the subject of the
-  parent-issuer must match the issuer of the potential child for this to be
-  considered a match
-
-- `-key_id_match` `(bool: "true")` - determines whether the identifier of the
-  parent-issuer must match the IUI of the potential child for this to be
-  considered a match
-
-- `-direct_verify` `(bool: "true")` - determines whether it is required for this
-  to be a match that someone trusting the parent certificate would trust the
-  potential-child certificate (without any more information)
-
-- `-indirect-sign` `(bool: "true")` - determines whether it is required for this
-  to be a match that if someone trusted the first certificate, they would trust
-  the potential-child certificate (using the certificate chains available)
-
-- `-path_contains` `(bool: "false")` - determines whether it is required for
-  this to be a match for the ca_chain of the potential child certificate to
-  contain the parent certificate
-
-### Accessed APIs
-
-Note that the vault user running this command will need to have access to the
-following API endpoints, each representing a step in the process:
-
-- `READ /:parent`
-- `LIST /sys/mounts` - when no `[child]` argument is provided, this is used to
-find a list of pki mounts
-- `LIST /:child_mount/issuers/` - when no `[child]` argument is provided, or the
-`[child]` argument is a mount rather than an issuer, this is used to find a list
-of pki issuers on the mount
-- `READ /:child` - each potential child issuer is read for comparison against
-the parent
-
-## Examples
-
-```shell-session
-$ vault pki list-intermediates /pki_root/issuer/default
-intermediate                                             match?
-------------                                             ------
-pki_int_2/issuer/d4404ccc-3ad4-83a9-f5df-398637654b3b    true
-pki_int_2/issuer/db0b0a6c-6641-ac15-363a-4e5261315581    true
-pki_root/issuer/9464c4fe-e8a6-d96a-0566-021575e7382c     true
-pki_int/issuer/2f958ec5-1838-336e-331b-07032379b958      true
-pki_int/issuer/b8cc0b41-e0e9-1a92-12c4-6849c9d6f837      true
-```
diff --git a/website/content/docs/commands/pki/reissue.mdx b/website/content/docs/commands/pki/reissue.mdx
deleted file mode 100644
index cb11d5a6c9a..00000000000
--- a/website/content/docs/commands/pki/reissue.mdx
+++ /dev/null
@@ -1,88 +0,0 @@
----
-layout: docs
-page_title: pki reissue - Command
-description: |-
-  The "pki reissue" command issues a new intermediate ("issuer") certificate,
-  using an existing certificate in vault as a template, and using a parent
-  certificate in vault to issue the new certificate.
----
-
-# pki reissue
-
-Frequently, a reissued CA certificate is to be very similar to another.
-This command enables reissuing a CA, using an existing issuer within
-Vault as a template, but allowing modifications to the desired attributes.
-
-## Usage
-
-Usage: `vault pki reissue [flags] <parent> <template> <child_mount> [options]`
-
-- `[flags]` are optional arguments described below.
-
-- `<parent>` is the fully qualified path of the Certificate Authority in vault
-  which will issue the new intermediate certificate.
-
-- `<template>` is the fully qualified path of an intermediate certificate in vault
-  which will be used to populate certificate fields not overridden by `[options]`.
-
-~> **Note**: not all possible certificate fields are supported by Vault, and
-  this template reader covers only those vault generates as a best effort.  If
-  unknown fields are set, such as when an external CA was imported into Vault,
-  there may not be a warning that those are missing from the new issuer.
-
-- `<child_mount>` is the path of the mount in vault where the new issuer is saved.
-
-- `[options]` are the superset of the k=v options passed to generate/intermediate
-  and sign-intermediate commands.  See [below](/vault/docs/commands/pki/reissue#options).
-
-The output of this command when it is successful is to read the resulting new
-issuer entry.
-
-### Flags
-
-- `-type` `(string: "internal")` - This determines the type of key use for the
-   newly created certificate.  Valid types are `"existing"` - where we link to
-   a key already present in the vault-backend to be used - `"internal"` - to
-   generate a new key for this certificate - or `"kms"` - to link to an external
-   key.  Exported keys are not available through this API.
-
-~> **Note**: It is only possible to generate a new certificate with an existing
-   key that exists in the same mount where that key-material exists.  This
-   command is expected to fail should the template exist on a different mount,
-   `existing` is the selected type, and no `key_ref` for a key in the new issuer
-   mount is provided.
-
-- `-issuer_name` `(string: "")` - If present, the newly created issuer will be
-   given this name.
-
-### Options
-
-Other than `type` (which is passed as a flag, see above), this command accepts
-all options provided to the
-[Generate CSR](/vault/api-docs/secret/pki#generate-intermediate-csr) and
-[Sign Intermediate](/vault/api-docs/secret/pki#sign-intermediate) endpoints.
-
-### Accessed APIs
-
-Note that the vault user running this command will need to have access to the
-following API endpoints, each representing a step in the process:
-
- - `READ /:parent` - used to check validity
- - `READ /:template` - used to generate the options for the new certificate
- - `WRITE /:child_mount/intermediate/generate/:type` - used to generate the csr
- - `WRITE /:parent/sign-intermediate` - used to sign the csr
- - `WRITE /:child_mount/issuers/import/cert` - used to import the new issuer,
- and the issuer chain
- - `UPDATE /:child_mount/issuer/:issuer_refs` - used to both name the new
- issuer, and also set the name of the parent in the issuer chain
- - `READ /:child_mount/issuer/:new_issuer_ref` - used to verify completion,
- generate the output
-
-## Examples
-
-```shell-session
-$ vault pki reissue -issuer_name="SecondDepartment" /pki_root/issuer/default /pki_int/issuer/FirstDepartment /pki_int_2/ common_name="second-department.example.com"
-Key                               Value
----                               -----
-ca_chain                          [-----BEGIN CERTIFICATE-----
-MIID0DCCArigAwIBAgIUdfRe05B5eRXsg3pvsJ/g94eYuWkwDQYJKoZIhvcNAQEL```
diff --git a/website/content/docs/commands/pki/verify-sign.mdx b/website/content/docs/commands/pki/verify-sign.mdx
deleted file mode 100644
index ec4c68a7f2c..00000000000
--- a/website/content/docs/commands/pki/verify-sign.mdx
+++ /dev/null
@@ -1,56 +0,0 @@
----
-layout: docs
-page_title: pki verify-sign - Command
-description: |-
-  The "pki verify-sign" command verifies the relationship between two issuer
-  certificates in vault
----
-
-# pki verify-sign
-
-This command verifies whether the listed issuer has signed the listed issued
-certificate.
-
-This command returns five fields of information:
-
-- `signature_match`: was the key of the issuer used to sign the issued.
-
-- `path_match`: the possible issuer appears in the valid certificate chain
-	of the issued.
-
-- `key_id_match`: does the [key id](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1)
-  of the issuer match the key_id of the subject.
-
-- `subject_match`: does the subject name of the issuer match the issuer
-	subject of the issued.
-
-- `trust_match`: if someone trusted the parent issuer, is the chain
-  provided sufficient to trust the child issued.
-
-## Usage
-
-Usage: `vault pki verify-sign <parent> <child>`
-
-- `<parent>` is the fully name-spaced path to the issuer certificate which will be
-used to verify the `<child>` certificate
-
-- `<child>` is the fully name-spaced path to the potential child-certificate to be
-verified
-
-A fully namespaced path looks like, for instance, 'ns1/mount1/issuer/issuerName/json'.
-
-## Example
-
-```shell-session
-$ vault pki verify-sign pki_root/issuer/root pki_int/issuer/FirstDepartment
-issuer:pki_root/issuer/root
-issued:pki_int/issuer/FirstDepartment
-
-field              value
------              -----
-subject_match      true
-path_match         true
-trust_match        true
-key_id_match       true
-signature_match    true
-```
diff --git a/website/content/docs/commands/plugin/deregister.mdx b/website/content/docs/commands/plugin/deregister.mdx
deleted file mode 100644
index 2353773b282..00000000000
--- a/website/content/docs/commands/plugin/deregister.mdx
+++ /dev/null
@@ -1,30 +0,0 @@
----
-layout: docs
-page_title: plugin deregister - Command
-description: |-
-  The "plugin deregister" command deregisters a new plugin in Vault's plugin
-  catalog.
----
-
-# plugin deregister
-
-The `plugin deregister` command deregisters an existing plugin from Vault's
-plugin catalog. If the plugin does not exist, no error is returned. The plugin's
-type of "auth", "database", or "secret" must be included.
-
-## Examples
-
-Deregister a plugin:
-
-```shell-session
-$ vault plugin deregister auth my-custom-plugin
-Success! Deregistered plugin (if it was registered): my-custom-plugin
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-- `-version` `(string: "")` - Semantic version of the plugin to deregister. 
-  If unset, only an unversioned plugin may be deregistered.
diff --git a/website/content/docs/commands/plugin/index.mdx b/website/content/docs/commands/plugin/index.mdx
deleted file mode 100644
index bdd5876df74..00000000000
--- a/website/content/docs/commands/plugin/index.mdx
+++ /dev/null
@@ -1,71 +0,0 @@
----
-layout: docs
-page_title: plugin - Command
-description: |-
-  The "plugin" command groups subcommands for interacting with
-  Vault's plugins and the plugin catalog.
----
-
-# plugin
-
-The `plugin` command groups subcommands for interacting with Vault's plugins and
-the plugin catalog
-
-## Examples
-
-List all available secret plugins in the catalog:
-
-```shell-session
-$ vault plugin list secret
-
-Name            Version
-----            -------
-ad              v0.14.0+builtin
-alicloud        v0.13.0+builtin
-...
-```
-
-Register a new secret plugin to the catalog:
-
-```shell-session
-$ vault plugin register \
-  -sha256=d3f0a8be02f6c074cf38c9c99d4d04c9c6466249 \
-  secret my-custom-plugin
-Success! Registered plugin: my-custom-plugin
-```
-
-Get information about a plugin in the catalog:
-
-```shell-session
-$ vault plugin info secret my-custom-plugin
-Key                   Value
----                   -----
-args                  []
-builtin               false
-command               my-custom-plugin
-deprecation_status    n/a
-name                  my-custom-plugin
-oci_image             n/a
-runtime               n/a
-sha256                33e72f3d30ff2acdbf3cf3c8fa1c8945b60dab876c4226ab25617a63c9f16cc5
-version               n/a
-```
-
-## Usage
-
-```text
-Usage: vault plugin <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    deregister       Deregister an existing plugin in the catalog
-    info             Read information about a plugin in the catalog
-    list             Lists available plugins
-    register         Registers a new plugin in the catalog
-    reload           Reload mounted plugin backend
-    reload-status    Get the status of an active or recently completed global plugin reload
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/plugin/info.mdx b/website/content/docs/commands/plugin/info.mdx
deleted file mode 100644
index 8dee985ddc4..00000000000
--- a/website/content/docs/commands/plugin/info.mdx
+++ /dev/null
@@ -1,73 +0,0 @@
----
-layout: docs
-page_title: plugin info - Command
-description: The "plugin info" command displays information about a plugin in the catalog.
----
-
-# plugin info
-
-The `plugin info` displays information about a plugin in the catalog.
-The plugin's type of "auth", "database", or "secret" must be included.
-
-## deprecation_status field
-
-As of 1.12, all builtin plugins will have an associated Deprecation
-Status. This status will be reflected in the `deprecation_status` key/value
-pair, seen below.
-
-## Examples
-
-Display information about a plugin
-
-```shell-session
-$ vault plugin info -version=v1.0.0 auth my-custom-plugin
-
-Key                   Value
----                   -----
-args                  []
-builtin               false
-command               my-custom-plugin
-deprecation_status    n/a
-name                  my-custom-plugin
-oci_image             n/a
-runtime               n/a
-sha256                04ce575260fa3a2cfc477d13ac327108c50838a03917ec4d6df38ecdc64452d1
-version               v1.0.0
-```
-
-```shell-session
-$ vault plugin info database postgresql-database-plugin
-Key                   Value
----                   -----
-args                  []
-builtin               true
-command               n/a
-deprecation_status    supported
-name                  postgresql-database-plugin
-oci_image             n/a
-runtime               n/a
-sha256                n/a
-version               n/a
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name. Specifying
-  this option will take precedence over other formatting directives. The result
-  will not have a trailing newline making it ideal for piping to other
-  processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-plugin-version` `(string: "")` - Semantic version of the plugin to read from
-  the catalog. If unspecified, refers to the unversioned plugin registered with
-  the same name and type, or the built-in plugin, in that order of precedence.
diff --git a/website/content/docs/commands/plugin/list.mdx b/website/content/docs/commands/plugin/list.mdx
deleted file mode 100644
index 422f1abdc19..00000000000
--- a/website/content/docs/commands/plugin/list.mdx
+++ /dev/null
@@ -1,61 +0,0 @@
----
-layout: docs
-page_title: plugin list - Command
-description: The "plugin list" command lists all available plugins in the plugin catalog.
----
-
-# plugin list
-
-The `plugin list` command lists all available plugins in the plugin catalog.
-It can be used alone or with a type such as "auth", "database", or "secret".
-
-## Deprecation status column
-
-As of 1.12, all builtin plugins will have an associated Deprecation
-Status. This status will be reflected in the `Deprecation Status` column, seen
-below. All non-builtin plugins will show a `Deprecation Status` of "n/a".
-
-## Examples
-
-List all available plugins in the catalog.
-
-```shell-session
-$ vault plugin list
-Name                                 Type        Version
-----                                 ----        -------
-alicloud                             auth        v0.13.0+builtin
-# ...
-
-$ vault plugin list database
-Name                                 Version
-----                                 -------
-cassandra-database-plugin            v1.13.0+builtin.vault
-# ...
-```
-
-List detailed plugin information:
-
-```shell-session
-$ vault plugin list -detailed
-Name        Type    Version                  Container    Deprecation Status
-----        ----    -------                  ---------    ------------------
-alicloud    auth    v0.12.0+builtin          false        supported
-app-id      auth    v1.12.0+builtin.vault    false        pending removal
-# ...
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-detailed` `(bool: false)` - Print detailed information such as version and
-deprecation status about each plugin.
diff --git a/website/content/docs/commands/plugin/register.mdx b/website/content/docs/commands/plugin/register.mdx
deleted file mode 100644
index 7750ae60b6e..00000000000
--- a/website/content/docs/commands/plugin/register.mdx
+++ /dev/null
@@ -1,69 +0,0 @@
----
-layout: docs
-page_title: plugin register - Command
-description: |-
-  The "plugin register" command registers a new plugin in Vault's plugin
-  catalog.
----
-
-# plugin register
-
-The `plugin register` command registers a new plugin in Vault's plugin catalog.
-The plugin's type of "auth", "database", or "secret" must be included.
-
-## Examples
-
-Register a plugin:
-
-```shell-session
-$ vault plugin register \
-    -sha256=d3f0a8be02f6c074cf38c9c99d4d04c9c6466249 \
-    auth my-custom-plugin
-Success! Registered plugin: my-custom-plugin
-```
-
-Register a plugin with custom args:
-
-```shell-session
-$ vault plugin register \
-    -sha256=d3f0a8be02f6c074cf38c9c99d4d04c9c6466249 \
-    -args=--with-glibc,--with-curl-bindings \
-    auth my-custom-plugin
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-sha256` `(string: <required>)` - SHA256 of the plugin binary or the OCI image
-  provided. This is required for all plugins.
-
-- `-args` `([]string: [])` - Argument to pass to the plugin when starting. This
-  flag can be specified multiple times to specify multiple args.
-
-- `-command` `(string: "")` - Command to spawn the plugin. This defaults to the
-  name of the plugin if both `-oci_image` and `-command` are unspecified.
-
-- `-env` `([]string: [])` - Environment variables to set for the plugin when
-  starting. This flag can be specified multiple times to specify multiple
-  environment variables.
-
-- `-oci_image` `(string: "")` - OCI image to run. If specified, setting `-command`,
-  `-args`, and `-env` will update the container's entrypoint, args, and environment
-  variables (append-only) respectively.
-
-- `-runtime` `(string: "")` - Vault plugin runtime to use if `-oci_image` is
-  specified.
-
-- `-version` `(string: "")` - Semantic version of the plugin. Used as the tag
-  when specifying `-oci_image`, but any leading 'v' will automatically be trimmed.
-
diff --git a/website/content/docs/commands/plugin/reload.mdx b/website/content/docs/commands/plugin/reload.mdx
deleted file mode 100644
index 0772e1ca99a..00000000000
--- a/website/content/docs/commands/plugin/reload.mdx
+++ /dev/null
@@ -1,72 +0,0 @@
----
-layout: docs
-page_title: plugin reload - Command
-description: |-
-  The "plugin reload" command reloads mounted plugins.
----
-
-# plugin reload
-
-The `plugin reload` command is used to reload mounted plugin backends. Either
-the plugin name (`plugin`) or the desired plugin backend mounts (`mounts`)
-must be provided, but not both. In the case that the plugin name is provided,
-all mounted paths that use that plugin backend will be reloaded.
-
-If run with a Vault namespace other than the root namespace, only plugins
-running in the same namespace will be reloaded.
-
-## Examples
-
-Reload a plugin by type and name:
-
-```shell-session
-$ vault plugin reload -type=auth -plugin my-custom-plugin
-Success! Reloaded plugin: my-custom-plugin
-```
-
-Reload an auth plugin by mount:
-
-```shell-session
-$ vault plugin reload \
-  -mounts auth/my-custom-plugin-1 \
-  -mounts auth/my-custom-plugin-2
-Success! Reloaded mounts: [auth/my-custom-plugin-1/ auth/my-custom-plugin-2/]
-```
-
-Reload a secrets plugin by mount:
-
-```shell-session
-$ vault plugin reload \
-  -mounts my-custom-plugin-1 \
-  -mounts my-custom-plugin-2
-Success! Reloaded mounts: [my-custom-plugin-1/ my-custom-plugin-2/]
-```
-
-Reload a secrets plugin named "my-custom-plugin" across all nodes and replicated clusters:
-
-```shell-session
-$ vault plugin reload \
-  -type=secret \
-  -plugin=my-custom-plugin \
-  -scope=global
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Command options
-
-- `-plugin` `(string: "")` - The name of the plugin to reload, as registered in
-  the plugin catalog.
-
-- `-type` `(string: "")` - The type of plugin to reload, one of auth, secret, or
-  database. Mutually exclusive with -mounts. If not provided, all plugins
-  with a matching name will be reloaded.
-
-- `-mounts` `(array: [])` - Array or comma-separated string mount paths of the
-  plugin backends to reload.
-
-- `-scope` `(string: "")` - The scope of the reload. For local reloads, omit this flag.
-  For reloads that span multiple Vault clusters, use `global`.
diff --git a/website/content/docs/commands/plugin/runtime/deregister.mdx b/website/content/docs/commands/plugin/runtime/deregister.mdx
deleted file mode 100644
index a9180fb5c70..00000000000
--- a/website/content/docs/commands/plugin/runtime/deregister.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: plugin runtime deregister - Command
-description: |-
-  The "plugin runtime deregister" command deregisters a plugin runtime in Vault's plugin
-  runtime catalog.
----
-
-# plugin runtime deregister
-
-Deregister an existing plugin runtime in the catalog with the given name.
-Returns an error if a registered plugin references the named plugin runtime or
-the named runtime does not exist.
-
-<Note title="Limited type support">
-  Support for runtime types is currently limited to `container`.
-</Note>
-
-## Examples
-
-Deregister a plugin:
-
-```shell-session
-$ vault plugin runtime deregister -type=container my-plugin-runtime
-Success! Deregistered plugin runtime: my-plugin-runtime
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-- `-type` `(string: <required>)` - Plugin runtime type. Vault currently only supports
-  `container` runtime type.
diff --git a/website/content/docs/commands/plugin/runtime/index.mdx b/website/content/docs/commands/plugin/runtime/index.mdx
deleted file mode 100644
index 42aea697b23..00000000000
--- a/website/content/docs/commands/plugin/runtime/index.mdx
+++ /dev/null
@@ -1,83 +0,0 @@
----
-layout: docs
-page_title: plugin runtime - Command
-description: |-
-  The "plugin runtime" command groups subcommands for interacting with
-  Vault's plugin runtimes, configuring the context within which external
-  plugins can be run.
----
-
-# plugin runtime
-
-The `plugin runtime` command groups subcommands for interacting with
-and configuring the context within which your external plugins run.
-
-<Note title="Limited type support">
-  Support for runtime types is currently limited to `container`.
-</Note>
-
-<Note title="Limited OS support">
-  Support for the 'container` runtime is currently limited to Linux.
-</Note>
-
-If you register a container plugin without referencing a plugin runtime, it will
-use [gVisor's](https://gvisor.dev/) OCI runtime `runsc` by default, with no
-resource limits. You can use plugin runtimes to configure other OCI-compliant
-runtimes such as `runc`. Vault does not come packaged with any supporting
-container runtimes, and you must separately install whichever you want to use.
-
-To use a registered plugin runtime, use the `-runtime` option with the
-[plugin registration command](/vault/docs/commands/plugin/register).
-
-See [containerized plugins](/vault/docs/plugins/containerized-plugins) for more
-details on running external plugins in containers.
-
-## Examples
-
-Register a new plugin runtime to the catalog:
-
-```shell-session
-$ vault plugin runtime register -type=container -oci_runtime=runc runc
-Success! Registered plugin runtime: runc
-```
-
-List all available plugin runtimes in the catalog:
-
-```shell-session
-$ vault plugin runtime list
-
-Name    Type         OCI Runtime    Parent Cgroup    CPU Nanos    Memory Bytes
-----    ----         -----------    -------------    ---------    ------------
-runc    container    runc           n/a              0            0
-```
-
-Get information about a plugin runtime in the catalog:
-
-```shell-session
-$ vault plugin runtime info -type=container runc
-Key              Value
----              -----
-cgroup_parent    n/a
-cpu_nanos        0
-memory_bytes     0
-name             runc
-oci_runtime      runc
-type             container
-```
-
-## Usage
-
-```text
-Usage: vault plugin runtime <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    deregister    Deregister an existing plugin runtime in the catalog
-    info          Read information about a plugin runtime in the catalog
-    list          Lists available plugin runtimes
-    register      Registers a new plugin runtime in the catalog
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/plugin/runtime/info.mdx b/website/content/docs/commands/plugin/runtime/info.mdx
deleted file mode 100644
index 481d9266d2b..00000000000
--- a/website/content/docs/commands/plugin/runtime/info.mdx
+++ /dev/null
@@ -1,50 +0,0 @@
----
-layout: docs
-page_title: plugin runtime info - Command
-description: The "plugin runtime info" command displays information about a plugin runtime in the catalog.
----
-
-# plugin runtime info
-
-Displays information about a plugin runtime in the catalog with the given name. If
-the plugin runtime does not exist, an error is returned.
-
-<Note title="Limited type support">
-  Support for runtime types is currently limited to `container`.
-</Note>
-
-## Examples
-
-Display information about a plugin
-
-```shell-session
-$ vault plugin runtime info -type=container runc
-Key              Value
----              -----
-cgroup_parent    n/a
-cpu_nanos        0
-memory_bytes     0
-name             runc
-oci_runtime      runc
-type             container
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-field` `(string: "")` - Print information for the named field without a
-  trailing newline. The `-field` parameter takes precedence over other
-  formatting directives.
-
-- `-format` `(string: "table")` - Print the output for the current command in
-  the given format. Valid formats are `table`, `json`, or `yaml`. Use the
-  `VAULT_FORMAT` environment variable to set your output preferences globally.
-
-### Command options
-
-- `-type` `(string: "")` - Plugin runtime type. Vault currently only supports
-  `container` runtime type.
diff --git a/website/content/docs/commands/plugin/runtime/list.mdx b/website/content/docs/commands/plugin/runtime/list.mdx
deleted file mode 100644
index 80f48c27ace..00000000000
--- a/website/content/docs/commands/plugin/runtime/list.mdx
+++ /dev/null
@@ -1,40 +0,0 @@
----
-layout: docs
-page_title: plugin runtime list - Command
-description: The "plugin runtime list" command lists all available plugin runtimes in the plugin runtime catalog.
----
-
-# plugin list
-
-List all plugin runtimes currently registered with Vault. Returns all the
-available plugin runtimes or an error if the set of registered runtimes is empty.
-Vault considers any registered plugin runtime "available", regardless of whether
-it is currently in use.
-
-## Examples
-
-List all available plugin runtimes in the catalog.
-
-```shell-session
-$ vault plugin runtime list
-
-Name    Type         OCI Runtime    Parent Cgroup    CPU Nanos    Memory Bytes
-----    ----         -----------    -------------    ---------    ------------
-runc    container    runc           n/a              0            0
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output for the current command in
-  the given format. Valid formats are `table`, `json`, or `yaml`. Use the
-  `VAULT_FORMAT` environment variable to set your output preferences globally.
-
-### Command options
-
-- `-type` `(string: "")` - Plugin runtime type. Vault currently only supports
-  `container` runtime type.
diff --git a/website/content/docs/commands/plugin/runtime/register.mdx b/website/content/docs/commands/plugin/runtime/register.mdx
deleted file mode 100644
index 75119d4e726..00000000000
--- a/website/content/docs/commands/plugin/runtime/register.mdx
+++ /dev/null
@@ -1,62 +0,0 @@
----
-layout: docs
-page_title: plugin runtime register - Command
-description: |-
-  The "plugin runtime register" command registers a new plugin runtime in Vault's plugin runtime
-  catalog.
----
-
-# plugin runtime register
-
-Register a new plugin runtime in the plugin runtime catalog of your Vault instance.
-
-<Note title="Limited type support">
-  Support for runtime types is currently limited to `container`.
-</Note>
-
-To use a registered plugin runtime, use the `-runtime` option with the
-[plugin registration command](/vault/docs/commands/plugin/register).
-
-## Examples
-
-Register a plugin runtime:
-
-```shell-session
-$ vault plugin runtime register -type=container -oci_runtime=runc runc
-Success! Registered plugin runtime: runc
-```
-
-Register a plugin runtime with resource limits:
-
-```shell-session
-vault plugin runtime register \
-    -type=container \
-    -cpu_nanos=100000000 \
-  runsc
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Command options
-
-- `-type` `(string: <required>)` - Plugin runtime type. Vault currently only
-  supports `container` as a runtime type.
-
-- `-rootless` `(bool: false)` - Whether the container runtime is running as a
-  non-privileged user. Must be set if plugin container images are also configured
-  to run as a non-root user.
-
-- `-cgroup_parent` `(string: "")` - Parent cgroup to set for each container.
-  Use `cgroup_parent` to control the total resource usage for a group of plugins.
-
-- `-cpu_nanos` `(int: 0)` - CPU limit to set per container in billionths of a
-  CPU core. Defaults to no limit.
-
-- `-memory_bytes` `(int: 0)` - Memory limit to set per container in bytes.
-  Defaults to no limit.
-
-- `-oci_runtime` `(string: "")` - Open Container Initiative (OCI) compliant
-  container runtime to use. Default is the gVisor OCI runtime, `runsc`.
diff --git a/website/content/docs/commands/policy/delete.mdx b/website/content/docs/commands/policy/delete.mdx
deleted file mode 100644
index 05c1cadd70b..00000000000
--- a/website/content/docs/commands/policy/delete.mdx
+++ /dev/null
@@ -1,30 +0,0 @@
----
-layout: docs
-page_title: policy delete - Command
-description: |-
-  The "policy delete" command deletes the policy named NAME in the Vault server.
-  Once the policy is deleted, all tokens associated with the policy are affected
-  immediately.
----
-
-# policy delete
-
-The `policy delete` command deletes the policy named NAME in the Vault server.
-Once the policy is deleted, all tokens associated with the policy are affected
-immediately.
-
-Note that it is not possible to delete the "default" or "root" policies. These
-are built-in policies.
-
-## Examples
-
-Delete the policy named "my-policy":
-
-```shell-session
-$ vault policy delete my-policy
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/policy/fmt.mdx b/website/content/docs/commands/policy/fmt.mdx
deleted file mode 100644
index 9a3ba7e513e..00000000000
--- a/website/content/docs/commands/policy/fmt.mdx
+++ /dev/null
@@ -1,27 +0,0 @@
----
-layout: docs
-page_title: policy fmt - Command
-description: |-
-  The "policy fmt" formats a local policy file to the policy specification. This
-  command will overwrite the file at the given PATH with the properly-formatted
-  policy file contents.
----
-
-# policy fmt
-
-The `policy fmt` formats a local policy file to the policy specification. This
-command will overwrite the file at the given PATH with the properly-formatted
-policy file contents.
-
-## Examples
-
-Format the local file "my-policy.hcl":
-
-```shell-session
-$ vault policy fmt my-policy.hcl
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/policy/index.mdx b/website/content/docs/commands/policy/index.mdx
deleted file mode 100644
index 1f66e7d8d33..00000000000
--- a/website/content/docs/commands/policy/index.mdx
+++ /dev/null
@@ -1,52 +0,0 @@
----
-layout: docs
-page_title: policy - Command
-description: |-
-  The "policy" command groups subcommands for interacting with policies. Users
-  can write, read, and list policies in Vault.
----
-
-# policy
-
-The `policy` command groups subcommands for interacting with policies. Users can
-write, read, and list policies in Vault.
-
-For more information, please see the [policy
-documentation](/vault/docs/concepts/policies).
-
-## Examples
-
-List all enabled policies:
-
-```shell-session
-$ vault policy list
-```
-
-Create a policy named "my-policy" from contents on local disk:
-
-```shell-session
-$ vault policy write my-policy ./my-policy.hcl
-```
-
-Delete the policy named my-policy:
-
-```shell-session
-$ vault policy delete my-policy
-```
-
-## Usage
-
-```text
-Usage: vault policy <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    delete    Deletes a policy by name
-    list      Lists the installed policies
-    read      Prints the contents of a policy
-    write     Uploads a named policy from a file
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/policy/list.mdx b/website/content/docs/commands/policy/list.mdx
deleted file mode 100644
index 849670b37f4..00000000000
--- a/website/content/docs/commands/policy/list.mdx
+++ /dev/null
@@ -1,33 +0,0 @@
----
-layout: docs
-page_title: policy list - Command
-description: |-
-  The "policy list" command Lists the names of the policies that are installed
-  on the Vault server.
----
-
-# policy list
-
-The `policy list` command Lists the names of the policies that are installed on
-the Vault server.
-
-## Examples
-
-List the available policies:
-
-```shell-session
-$ vault policy list
-default
-root
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
diff --git a/website/content/docs/commands/policy/read.mdx b/website/content/docs/commands/policy/read.mdx
deleted file mode 100644
index 7b2b1bbd328..00000000000
--- a/website/content/docs/commands/policy/read.mdx
+++ /dev/null
@@ -1,31 +0,0 @@
----
-layout: docs
-page_title: policy read - Command
-description: |-
-  The "policy read" command prints the contents and metadata of the Vault policy
-  named NAME. If the policy does not exist, an error is returned.
----
-
-# policy read
-
-The `policy read` command prints the contents and metadata of the Vault policy
-named NAME. If the policy does not exist, an error is returned.
-
-## Examples
-
-Read the policy named "my-policy":
-
-```shell-session
-$ vault policy read my-policy
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
diff --git a/website/content/docs/commands/policy/write.mdx b/website/content/docs/commands/policy/write.mdx
deleted file mode 100644
index b9ff586e7f6..00000000000
--- a/website/content/docs/commands/policy/write.mdx
+++ /dev/null
@@ -1,36 +0,0 @@
----
-layout: docs
-page_title: policy write - Command
-description: |-
-  The "policy write" command uploads a policy with name NAME from the contents
-  of a local file PATH or stdin. If PATH is "-", the policy is read from stdin.
-  Otherwise, it is loaded from the file at the given path on the local disk.
----
-
-# policy write
-
-The `policy write` command uploads a policy with name NAME from the contents of
-a local file PATH or stdin. If PATH is "-", the policy is read from stdin.
-Otherwise, it is loaded from the file at the given path on the local disk.
-
-For details on the policy syntax, please see the [policy
-documentation](/vault/docs/concepts/policies).
-
-## Examples
-
-Upload a policy named "my-policy" from "/tmp/policy.hcl" on the local disk:
-
-```shell-session
-$ vault policy write my-policy /tmp/policy.hcl
-```
-
-Upload a policy from stdin:
-
-```shell-session
-$ cat my-policy.hcl | vault policy write my-policy -
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/print.mdx b/website/content/docs/commands/print.mdx
deleted file mode 100644
index 9b5f8607c69..00000000000
--- a/website/content/docs/commands/print.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: docs
-page_title: version - Command
-description: The "print" command prints the Vault token currently in use.
----
-
-# print
-
-The `print` command prints the Vault token currently in use. The only available subcommand is `token`.
-
-## Examples
-
-Print the current token.
-
-```shell-session
-$ vault print token
-hvs.CAESICaie3Dm0_Hx001QuMabo1IXnyKkx_FuE14MH7zir_bqGh4KHGh2cy5wQnJsZzZ6WG82b29HUlI3eFdEQ0NPQzQ
-```
\ No newline at end of file
diff --git a/website/content/docs/commands/proxy.mdx b/website/content/docs/commands/proxy.mdx
deleted file mode 100644
index 4a1d0e4f0a2..00000000000
--- a/website/content/docs/commands/proxy.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
----
-layout: docs
-page_title: proxy - Command
-description: The "proxy" command is used to start Vault Proxy
----
-
-# proxy
-
-Please see the [Vault Proxy documentation page](/vault/docs/agent-and-proxy/proxy).
diff --git a/website/content/docs/commands/read.mdx b/website/content/docs/commands/read.mdx
deleted file mode 100644
index 9cc1d402dc4..00000000000
--- a/website/content/docs/commands/read.mdx
+++ /dev/null
@@ -1,77 +0,0 @@
----
-layout: docs
-page_title: read - Command
-description: |-
-  The "read" command reads data from Vault at the given path. This can be used
-  to read secrets, generate dynamic credentials, get configuration details, and
-  more.
----
-
-# read
-
-The `read` command reads data from Vault at the given path (wrapper command for
-HTTP GET). You can use the command to read secrets, generate dynamic
-credentials, get configuration details, and more.
-
-## Examples
-
-Read entity details of a given ID:
-
-```shell-session
-$ vault read identity/entity/id/2f09126d-d161-abb8-2241-555886491d97
-```
-
-Generate dynamic AWS credentials for a `my-role`:
-
-```shell-session
-$ vault read aws/creds/my-role
-```
-
-### API versus CLI
-
-Assuming that you have KV version 2 (`kv-v2`) secrets engine enabled at
-`secret/`, the following command reads secrets at the `secret/data/customers`
-API path:
-
-```shell-session
-$ vault read secret/data/customers
-```
-
-This is equivalent to:
-
-```shell-session
-$ curl --request GET --header "X-Vault-Token: $VAULT_TOKEN" \
-    $VAULT_ADDR/v1/secret/data/customers
-```
-
-Since KV secrets engine is a commonly used feature, Vault CLI provides the
-[`kv`](/vault/docs/commands/kv) command. Read secrets from the `secret/data/customers`
-path using the `kv` CLI command:
-
-```shell-session
-$ vault kv get -mount=secret customers
-```
-
--> **Comparison:** All three commands retrieve the same data, but display the
-output in a different format. By default, `vault read` prints output in
-key-value format. The `curl` command prints the response in JSON. Since the
-`kv` command is designed to handle operations associated with KV secrets
-engine, it prints the output in more structured format that is easy to read.
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name, in the format
-  specified in the `-format` directive. The result will not have a trailing
-  newline making it ideal for piping to other processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", "yaml", or "raw". This can also be specified
-  via the `VAULT_FORMAT` environment variable.
-
-For a full list of examples and paths, please see the documentation that
-corresponds to the secrets engine in use.
diff --git a/website/content/docs/commands/secrets/disable.mdx b/website/content/docs/commands/secrets/disable.mdx
deleted file mode 100644
index 4d22ec06a03..00000000000
--- a/website/content/docs/commands/secrets/disable.mdx
+++ /dev/null
@@ -1,49 +0,0 @@
----
-layout: docs
-page_title: secrets disable - Command
-description: |-
-  The "secrets disable" command disables an secrets engine at a given PATH. The
-  argument corresponds to the enabled PATH of the engine, not the TYPE! All
-  secrets created by this engine are revoked and its Vault data is removed.
----
-
-# secrets disable
-
-The `secrets disable` command disables an secrets engine at a given PATH. The
-argument corresponds to the enabled PATH of the engine, not the TYPE! All
-secrets created by this engine are revoked and its Vault data is removed.
-
-When a secrets engine is disabled, **all secrets generated via the secrets
-engine are immediately revoked.** Care should be taken when disabling a
-secret mount with a large number of secrets, as it can cause a high load on
-the system during revocation time.
-
-## Examples
-
-Disable the secrets engine enabled at aws/:
-
-```shell-session
-$ vault secrets disable aws/
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
-
-## Force disable
-
-Because `secrets disable` revokes secrets associated with this mount, possible
-errors can prevent the secrets engine from being disabled if the revocation
-fails.
-
-The best way to resolve this is to figure out the underlying issue and then
-disable the secrets engine once the underlying issue is resolved. Often, this
-can be as simple as increasing the timeout (in the event of timeout errors).
-
-For recovery situations where the secret was manually removed from the
-secrets backing service, one can force a secrets engine disable in Vault by
-performing a [prefix force revoke](/vault/docs/commands/lease/revoke) on the mount
-prefix, followed by a `secrets disable` when that completes. 
-If the underlying secrets were not manually cleaned up, this method might result
-in dangling credentials. This is meant for extreme circumstances.
diff --git a/website/content/docs/commands/secrets/enable.mdx b/website/content/docs/commands/secrets/enable.mdx
deleted file mode 100644
index 350dc6bc5d6..00000000000
--- a/website/content/docs/commands/secrets/enable.mdx
+++ /dev/null
@@ -1,113 +0,0 @@
----
-layout: docs
-page_title: secrets enable - Command
-description: |-
-  The "secrets enable" command enables a secrets engine at a given path. If an
-  secrets engine already exists at the given path, an error is returned. After
-  the secrets engine is enabled, it usually needs configuration. The
-  configuration varies by secrets engine.
----
-
-# secrets enable
-
-The `secrets enable` command enables a secrets engine at a given path. If an
-secrets engine already exists at the given path, an error is returned. After the
-secrets engine is enabled, it usually needs configuration. The configuration
-varies by secrets engine.
-
-By default, secrets engines are enabled at the path corresponding to their TYPE,
-but users can customize the path using the `-path` option.
-
-Some secrets engines persist data, some act as data pass-through, and some
-generate dynamic credentials. The secrets engine will likely require
-configuration after it is mounted. For details on the specific configuration
-options, please see the [secrets engine
-documentation](/vault/docs/secrets).
-
-## Examples
-
-Enable the AWS secrets engine at "aws/":
-
-```shell-session
-$ vault secrets enable aws
-Success! Enabled the aws secrets engine at: aws/
-```
-
-Enable the SSH secrets engine at ssh-prod/:
-
-```shell-session
-$ vault secrets enable -path=ssh-prod ssh
-```
-
-Enable the database secrets engine with an explicit maximum TTL of 30m:
-
-```shell-session
-$ vault secrets enable -max-lease-ttl=30m database
-```
-
-Enable a custom plugin (after it is registered in the plugin registry):
-
-```shell-session
-$ vault secrets enable -path=my-secrets my-plugin
-```
-
-For more information on the specific configuration options and paths, please see
-the [secrets engine](/vault/docs/secrets) documentation.
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-- `-audit-non-hmac-request-keys` `(string: "")` - Key that will not be HMAC'd
-  by audit devices in the request data object. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-  An example of this is provided in the [tune section](/vault/docs/commands/secrets/tune).
-
-- `-audit-non-hmac-response-keys` `(string: "")` - Key that will not be HMAC'd
-  by audit devices in the response data object. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-default-lease-ttl` `(duration: "")` - The default lease TTL for this secrets
-  engine. If unspecified, this defaults to the Vault server's globally
-  configured default lease TTL.
-
-- `-description` `(string: "")` - Human-friendly description for the purpose of
-  this engine.
-
-- `-force-no-cache` `(bool: false)` - Force the secrets engine to disable
-  caching. If unspecified, this defaults to the Vault server's globally
-  configured cache settings. This does not affect caching of the underlying
-  encrypted data storage.
-
-- `-local` `(bool: false)` - Mark the secrets engine as local-only. Local
-  engines are not replicated or removed by replication.
-
-- `-max-lease-ttl` `(duration: "")` The maximum lease TTL for this secrets
-  engine. If unspecified, this defaults to the Vault server's globally
-  configured maximum lease TTL.
-
-- `-path` `(string: "")` Place where the secrets engine will be accessible. This
-  must be unique cross all secrets engines. This defaults to the "type" of the
-  secrets engine.
-  
-  !> **Case-sensitive:** The path where you enable secrets engines is case-sensitive. For
-  example, the KV secrets engine enabled at `kv/` and `KV/` are treated as two
-  distinct instances of KV secrets engine.
-
-- `-passthrough-request-headers` `(string: "")` - request header values that will
-  be sent to the secrets engine. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-allowed-response-headers` `(string: "")` - response header values that the secrets
-  engine will be allowed to set. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-allowed-managed-keys` `(string: "")` - Managed key name(s) that the mount
-  in question is allowed to access. Note that multiple keys may be specified
-  either by providing the key names as a comma separated string or by providing
-  this option multiple times, each time with 1 key.
-
-- `-plugin-version` `(string: "")` - Configures the semantic version of the plugin
-  to use. If unspecified, implies the built-in or any matching unversioned plugin
-  that may have been registered.
diff --git a/website/content/docs/commands/secrets/index.mdx b/website/content/docs/commands/secrets/index.mdx
deleted file mode 100644
index a88cb59f48d..00000000000
--- a/website/content/docs/commands/secrets/index.mdx
+++ /dev/null
@@ -1,79 +0,0 @@
----
-layout: docs
-page_title: secrets - Command
-description: |-
-  The "secrets" command groups subcommands for interacting with Vault's secrets
-  engines.
----
-
-# secrets
-
-The `secrets` command groups subcommands for interacting with Vault's secrets
-engines. Each secrets engine behaves differently. Please see the documentation
-for more information.
-
-Some secrets engines persist data, some act as data pass-through, and some
-generate dynamic credentials. The secrets engine will likely require
-configuration after it is mounted. For details on the specific configuration
-options, please see the [secrets engine
-documentation](/vault/docs/secrets).
-
-## Examples
-
-Enable a secrets engine:
-
-```shell-session
-$ vault secrets enable database
-Success! Enabled the database secrets engine at: database/
-```
-
-List all secrets engines:
-
-```shell-session
-$ vault secrets list
-Path          Type         Description
-----          ----         -----------
-cubbyhole/    cubbyhole    per-token private secret storage
-database/     database     n/a
-secret/       kv           key/value secret storage
-sys/          system       system endpoints used for control, policy and debugging
-```
-
-Move a secrets engine to a new path:
-
-```shell-session
-$ vault secrets move database/ db-prod/
-Success! Moved secrets engine database/ to: db-prod/
-```
-
-Tune a secrets engine:
-
-```shell-session
-$ vault secrets tune -max-lease-ttl=30m db-prod/
-Success! Tuned the secrets engine at: db-prod/
-```
-
-Disable a secrets engine:
-
-```shell-session
-$ vault secrets disable db-prod/
-Success! Disabled the secrets engine (if it existed) at: db-prod/
-```
-
-## Usage
-
-```text
-Usage: vault secrets <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    disable    Disable a secrets engine
-    enable     Enable a secrets engine
-    list       List enabled secrets engines
-    move       Move a secrets engine to a new path
-    tune       Tune a secrets engine configuration
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/secrets/list.mdx b/website/content/docs/commands/secrets/list.mdx
deleted file mode 100644
index 65b866e25a2..00000000000
--- a/website/content/docs/commands/secrets/list.mdx
+++ /dev/null
@@ -1,78 +0,0 @@
----
-layout: docs
-page_title: secrets list - Command
-description: |-
-  The "secrets list" command lists the enabled secrets engines on the Vault
-  server. This command also outputs information about the enabled path including
-  configured TTLs and human-friendly descriptions. A TTL of "system" indicates
-  that the system default is in use.
----
-
-# secrets list
-
-The `secrets list` command lists the enabled secrets engines on the Vault server.
-This command also outputs information about the enabled path including
-configured TTLs and human-friendly descriptions. A TTL of "system" indicates
-that the system default is in use.
-
-## Deprecation status column
-
-As of 1.12, all built-in secrets engines will have an associated Deprecation
-Status. This status will be reflected in the `Deprecation Status` column, seen
-below. All secrets engines which are not provided by built-in plugins will show a
-`Deprecation Status` of "n/a".
-
-## Version columns
-
-The `-detailed` view displays some version information for each mount.
-
-The Version field indicates the configured version for the plugin. Empty, or "n/a",
-indicates the built-in or any matching unversioned plugin that may have been registered.
-
-Running Version indicates the actual plugin version running, which may differ from
-Version if the plugin hasn't been reloaded since the configured version was updated
-using the `secrets tune` command. Finally, the Running SHA256 field indicates the
-SHA256 sum of the running plugin's binary. This may be different from the SHA256
-registered in the catalog if the plugin hasn't been reloaded since the plugin
-version was overwritten in the catalog.
-
-## Examples
-
-List all enabled secrets engines:
-
-```shell-session
-$ vault secrets list
-Path          Type         Accessor              Description
-----          ----         --------              -----------
-cubbyhole/    cubbyhole    cubbyhole_548b4dc5    per-token private secret storage
-secret/       kv           identity_aa00c06d     key/value secret storage
-sys/          system       system_547412e3       system endpoints used for control, policy and debugging
-```
-
-List all enabled secrets engines with detailed output:
-
-```shell-session
-$ vault secrets list -detailed
-Path           Plugin        Accessor               Default TTL    Max TTL    Force No Cache    Replication    Seal Wrap    External Entropy Access    Options    Description                                                UUID                                  Version    Running Version          Running SHA256    Deprecation Status
-----           ------        --------               -----------    -------    --------------    -----------    ---------    -----------------------    -------    -----------                                                ----                                  -------    ---------------          --------------    ------------------
-cubbyhole/     cubbyhole     cubbyhole_b16d1bc0     n/a            n/a        false             local          false        false                      map[]      per-token private secret storage                           8c64d56b-9d46-d667-1155-a8c1a83a5d01  n/a        v1.12.0+builtin.vault    n/a               n/a
-identity/      identity      identity_3d67c936      system         system     false             replicated     false        false                      map[]      identity store                                             5aa1e59c-33b5-9dec-05d6-c80c9a800557  n/a        v1.12.0+builtin.vault    n/a               n/a
-postgresql/    postgresql    postgresql_f0a54308    system         system     false             replicated     false        false                      map[]      n/a                                                        8cdc1d2d-0713-eaa6-17e3-49790a60650b  n/a        v1.12.0+builtin.vault    n/a               deprecated
-sys/           system        system_c86bd362        n/a            n/a        false             replicated     true         false                      map[]      system endpoints used for control, policy and debugging    e3193999-0875-d38d-3458-21d9f2762c80  n/a        v1.12.0+builtin.vault    n/a               n/a
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-detailed` `(bool: false)` - Print detailed information such as configuration
-  and replication status about each secrets engine.
diff --git a/website/content/docs/commands/secrets/move.mdx b/website/content/docs/commands/secrets/move.mdx
deleted file mode 100644
index e8956cb3afc..00000000000
--- a/website/content/docs/commands/secrets/move.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: secrets move - Command
-description: |-
-  The "secrets move" command moves an existing secrets engine to a new path. All
-  leases from the old secrets engine are revoked, but all configurations
-  associated with the engine are preserved.
----
-
-# secrets move
-
-The `secrets move` command moves an existing secrets engine to a new path. Any
-leases from the old secrets engine are revoked, but all configuration associated
-with the engine is preserved. The command can be issued for a move within or across
-namespaces, using namespace prefixes in the arguments.
-
-The command will trigger a remount operation and uses the returned migration ID to poll the 
-status of the operation until a terminal state of `success` or `failure` is reached.
-
-**Moving an existing secrets engine will revoke any leases from the old
-engine.**
-
-## Examples
-
-Move the existing secrets engine at ns1/secret/ to ns2/kv/:
-
-```shell-session
-$ vault secrets move ns1/secret/ ns2/kv/
-```
-
-## Usage
-
-There are no flags beyond the [standard set of flags](/vault/docs/commands)
-included on all commands.
diff --git a/website/content/docs/commands/secrets/tune.mdx b/website/content/docs/commands/secrets/tune.mdx
deleted file mode 100644
index 4074374888c..00000000000
--- a/website/content/docs/commands/secrets/tune.mdx
+++ /dev/null
@@ -1,99 +0,0 @@
----
-layout: docs
-page_title: secrets tune - Command
-description: |-
-  The "secrets tune" command tunes the configuration options for the secrets engine at the given PATH.
----
-
-# secrets tune
-
-The `secrets tune` command tunes the configuration options for the secrets
-engine at the given PATH. The argument corresponds to the PATH where the secrets
-engine is enabled, not the type.
-
-## Examples
-
-Before tuning the secret mount, view the current configuration of the
-mount enabled at "pki/":
-
-```shell-session
-$ vault read sys/mounts/pki/tune
-Key                             Value
----                             -----
-default_lease_ttl               12h
-description                     Example PKI mount
-force_no_cache                  false
-max_lease_ttl                   24h
-```
-
-Tune the default lease, exclude `common_name` and `serial_number` from being HMAC'd in the audit log for the PKI secrets engine:
-
-```shell-session
-$ vault secrets tune -default-lease-ttl=18h -audit-non-hmac-request-keys=common_name -audit-non-hmac-response-keys=serial_number pki/
-Success! Tuned the secrets engine at: pki/
-
-$ vault read sys/mounts/pki/tune
-Key                             Value
----                             -----
-audit_non_hmac_request_keys     [common_name]
-audit_non_hmac_response_keys    [serial_number]
-default_lease_ttl               18h
-description                     Example PKI mount
-force_no_cache                  false
-max_lease_ttl                   24h
-```
-
-Specify multiple audit non-hmac request keys:
-
-```shell-session
-$ vault secrets tune -audit-non-hmac-request-keys=common_name -audit-non-hmac-request-keys=ttl pki/
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-- `-allowed-response-headers` `(string: "")` - response header values that the
-  secrets engine will be allowed to set. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-audit-non-hmac-request-keys` `(string: "")` - Key that will not be HMAC'd
-  by audit devices in the request data object. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-audit-non-hmac-response-keys` `(string: "")` - Key that will not be HMAC'd
-  by audit devices in the response data object. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-default-lease-ttl` `(duration: "")` - The default lease TTL for this secrets
-  engine. If unspecified, this defaults to the Vault server's globally
-  configured default lease TTL, or a previously configured value for the secrets
-  engine. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `-description` `(string: "")` - Specifies the description of the mount.
-  This overrides the current stored value, if any.
-
-- `-listing-visibility` `(string: "")` - The flag to toggle whether to show the
-  mount in the UI-specific listing endpoint. Valid values are `"unauth"` or `"hidden"`.
-  Passing empty string leaves the current setting unchanged.
-
-- `-max-lease-ttl` `(duration: "")` - The maximum lease TTL for this secrets
-  engine. If unspecified, this defaults to the Vault server's globally
-  configured [maximum lease TTL](/vault/docs/configuration#max_lease_ttl), or a
-  previously configured value for the secrets engine. This value is allowed to
-  override the server's global max TTL; it can be longer or shorter.
-  Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `-passthrough-request-headers` `(string: "")` - request header values that will
-  be sent to the secrets engine. Note that multiple keys may be
-  specified by providing this option multiple times, each time with 1 key.
-
-- `-allowed-managed-keys` `(string: "")` - Managed key name(s) that the mount
-  in question is allowed to access. Note that multiple keys may be specified
-  either by providing the key names as a comma separated string or by providing
-  this option multiple times, each time with 1 key.
-
-- `-plugin-version` `(string: "")` - Configures the semantic version of the plugin
-  to use. The new version will not start running until the mount is
-  [reloaded](/vault/docs/commands/plugin/reload).
diff --git a/website/content/docs/commands/server.mdx b/website/content/docs/commands/server.mdx
deleted file mode 100644
index ce0b987534a..00000000000
--- a/website/content/docs/commands/server.mdx
+++ /dev/null
@@ -1,129 +0,0 @@
----
-layout: docs
-page_title: server - Command
-description: |-
-  The "server" command starts a Vault server that responds to API requests. By
-  default, Vault will start in a "sealed" state. The Vault cluster must be
-  initialized before use.
----
-
-# server
-
-The `server` command starts a Vault server that responds to API requests. By
-default, Vault will start in a "sealed" state. The Vault cluster must be
-initialized before use, usually by the `vault operator init` command. Each Vault
-server must also be unsealed using the `vault operator unseal` command or the
-API before the server can respond to requests.
-
-For more information, please see:
-
-- [`operator init` command](/vault/docs/commands/operator/init) for information
-  on initializing a Vault server.
-
-- [`operator unseal` command](/vault/docs/commands/operator/unseal) for
-  information on providing unseal keys.
-
-- [Vault configuration](/vault/docs/configuration) for the syntax and
-  various configuration options for a Vault server.
-
-## Examples
-
-Start a server with a configuration file:
-
-```shell-session
-$ vault server -config=/etc/vault/config.hcl
-```
-
-Run in "dev" mode with a custom initial root token:
-
-```shell-session
-$ vault server -dev -dev-root-token-id="root"
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Command options
-
-- `-config` `(string: "")` - Path to a configuration file or directory of
-  configuration files. This flag can be specified multiple times to load
-  multiple configurations. If the path is a directory, all files which end in
-  .hcl or .json are loaded.
-
-- `-log-level` ((#\_log_level)) `(string: "info")` - Log verbosity level. Supported values (in
-  order of descending detail) are `trace`, `debug`, `info`, `warn`, and `error`. This can
-  also be specified via the `VAULT_LOG_LEVEL` environment variable.
-
-- `-log-format` ((#\_log_format)) `(string: "standard")` - Log format. Supported values
-  are `standard` and `json`. This can also be specified via the
-  `VAULT_LOG_FORMAT` environment variable.
-
-- `-log-file` ((#\_log_file)) - The absolute path where Vault should save log
-  messages in addition to other, existing outputs like journald / stdout. Paths
-  that end with a path separator use the default file name, `vault.log`. Paths
-  that do not end with a file extension use the default `.log` extension. If the
-  log file rotates, Vault appends the current timestamp to the file name
-  at the time of rotation. For example:
-
-  | `log-file`              | Full log file           | Rotated log file                    |
-  |-------------------------|-------------------------|-------------------------------------|
-  | `/var/log`              | `/var/log/vault.log`    | `/var/log/vault-{timestamp}.log`    |
-  | `/var/log/my-diary`     | `/var/log/my-diary.log` | `/var/log/my-diary-{timestamp}.log` |
-  | `/var/log/my-diary.txt` | `/var/log/my-diary.txt` | `/var/log/my-diary-{timestamp}.txt` |
-
-- `-log-rotate-bytes` ((#\_log_rotate_bytes)) - to specify the number of
-  bytes that should be written to a log before it needs to be rotated. Unless specified,
-  there is no limit to the number of bytes that can be written to a log file.
-
-- `-log-rotate-duration` ((#\_log_rotate_duration)) - to specify the maximum
-  duration a log should be written to before it needs to be rotated. Must be a duration
-  value such as 30s. Defaults to 24h.
-
-- `-log-rotate-max-files` ((#\_log_rotate_max_files)) - to specify the maximum
-  number of older log file archives to keep. Defaults to 0 (no files are ever deleted).
-  Set to -1 to discard old log files when a new one is created.
-
-- `-experiment` `(string array: [])` - The name of an experiment to enable for this node.
-  This flag can be specified multiple times to enable multiple experiments. Experiments
-  should NOT be used in production, and the associated APIs may have backwards incompatible
-  changes between releases. Additional experiments can also be specified via the
-  `VAULT_EXPERIMENTS` environment variable as a comma-separated list, or via the
-  [`experiments`](/vault/docs/configuration#experiments) config key.
-
-- `VAULT_ALLOW_PENDING_REMOVAL_MOUNTS` `(bool: false)` - (environment variable)
-  Allow Vault to be started with builtin engines which have the `Pending Removal`
-  deprecation state. This is a temporary stopgap in place in order to perform an
-  upgrade and disable these engines. Once these engines are marked `Removed` (in
-  the next major release of Vault), the environment variable will no longer work
-  and a downgrade must be performed in order to remove the offending engines. For
-  more information, see the [deprecation faq](/vault/docs/deprecation/faq/#q-what-are-the-phases-of-deprecation).
-
-### Dev options
-
-- `-dev` `(bool: false)` - Enable development mode. In this mode, Vault runs
-  in-memory and starts unsealed. As the name implies, do not run "dev" mode in
-  production.
-
-- `-dev-tls` `(bool: false)` - Enable TLS development mode. In this mode, Vault runs
-  in-memory and starts unsealed with a generated TLS CA, certificate and key.
-  As the name implies, do not run "dev" mode in production.
-
-- `-dev-tls-cert-dir` `(string: "")` - Directory where generated TLS files are created if `-dev-tls` is specified. If left unset, files are generated in a temporary directory.
-
-- `-dev-listen-address` `(string: "127.0.0.1:8200")` - Address to bind to in
-  "dev" mode. This can also be specified via the `VAULT_DEV_LISTEN_ADDRESS`
-  environment variable.
-
-- `-dev-root-token-id` `(string: "")` - Initial root token. This only applies
-  when running in "dev" mode. This can also be specified via the
-  `VAULT_DEV_ROOT_TOKEN_ID` environment variable.
-
-  _Note:_ The token ID should not start with the `s.` prefix.
-
-- `-dev-no-store-token` `(string: "")` - Do not persist the dev root token to
-  the token helper (usually the local filesystem) for use in future requests.
-  The token will only be displayed in the command output.
-
-- `-dev-plugin-dir` `(string: "")` - Directory from which plugins are allowed to be loaded. Only applies in "dev" mode, it will automatically register all the plugins in the provided directory.
diff --git a/website/content/docs/commands/ssh.mdx b/website/content/docs/commands/ssh.mdx
deleted file mode 100644
index 9395ed1981e..00000000000
--- a/website/content/docs/commands/ssh.mdx
+++ /dev/null
@@ -1,106 +0,0 @@
----
-layout: docs
-page_title: ssh - Command
-description: |-
-  The "ssh" command establishes an SSH connection with the target machine using
-  credentials obtained from an SSH secrets engine.
----
-
-# ssh
-
-The `ssh` command establishes an SSH connection with the target machine.
-
-This command uses one of the SSH secrets engines to authenticate and
-automatically establish an SSH connection to a host. This operation requires
-that the SSH secrets engine is mounted and configured.
-
-The user must have `ssh` installed locally - this command will exec out to it
-with the proper commands to provide an "SSH-like" consistent experience.
-
-## Examples
-
-SSH using the OTP mode (requires [sshpass](https://linux.die.net/man/1/sshpass)
-for full automation):
-
-```shell-session
-$ vault ssh -mode=otp -role=my-role user@1.2.3.4
-```
-
-SSH using the CA mode:
-
-```shell-session
-$ vault ssh -mode=ca -role=my-role user@1.2.3.4
-```
-
-SSH using CA mode with host key verification:
-
-```shell-session
-$ vault ssh \
-    -mode=ca \
-    -role=my-role \
-    -host-key-mount-point=host-signer \
-    -host-key-hostnames=example.com \
-    user@example.com
-```
-
-For step-by-step guides and instructions for each of the available SSH
-auth methods, please see the corresponding [SSH secrets
-engine](/vault/docs/secrets/ssh).
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name, in the format
-  specified in the `-format` directive. The result will not have a trailing
-  newline making it ideal for piping to other processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### SSH options
-
-- `-mode` `(string: "")` - Name of the authentication mode (ca, dynamic, otp)."
-
-- `-mount-point` `(string: "ssh/")` - Mount point to the SSH secrets engine.
-
-- `-no-exec` `(bool: false)` - Print the generated credentials, but do not
-  establish a connection.
-
-- `-role` `(string: "")` - Name of the role to use to generate the key.
-
-- `-strict-host-key-checking` `(string: "")` - Value to use for the SSH
-  configuration option "StrictHostKeyChecking". The default is ask. This can
-  also be specified via the `VAULT_SSH_STRICT_HOST_KEY_CHECKING` environment
-  variable.
-
-- `-user-known-hosts-file` `(string: "~/.ssh/known_hosts")` - Value to use for
-  the SSH configuration option "UserKnownHostsFile". This can also be specified
-  via the `VAULT_SSH_USER_KNOWN_HOSTS_FILE` environment variable.
-
-### CA mode options
-
-- `-host-key-hostnames` `(string: "*")` - List of hostnames to delegate for the
-  CA. The default value allows all domains and IPs. This is specified as a
-  comma-separated list of values. This can also be specified via the
-  `VAULT_SSH_HOST_KEY_HOSTNAMES` environment variable.
-
-- `-host-key-mount-point` `(string: "")` - Mount point to the SSH
-  secrets engine where host keys are signed. When given a value, Vault will
-  generate a custom "known_hosts" file with delegation to the CA at the provided
-  mount point to verify the SSH connection's host keys against the provided CA.
-  By default, host keys are validated against the user's local "known_hosts"
-  file. This flag forces strict key host checking and ignores a custom user
-  known hosts file. This can also be specified via the
-  `VAULT_SSH_HOST_KEY_MOUNT_POINT` environment variable.
-
-- `-private-key-path` `(string: "~/.ssh/id_rsa")` - Path to the SSH private key
-  to use for authentication. This must be the corresponding private key to
-  `-public-key-path`.
-
-- `-public-key-path` `(string: "~/.ssh/id_rsa.pub")` - Path to the SSH public
-  key to send to Vault for signing.
diff --git a/website/content/docs/commands/status.mdx b/website/content/docs/commands/status.mdx
deleted file mode 100644
index ab7d4153011..00000000000
--- a/website/content/docs/commands/status.mdx
+++ /dev/null
@@ -1,69 +0,0 @@
----
-layout: docs
-page_title: status - Command
-description: |-
-  The "status" command prints the current state of Vault including whether it is
-  sealed and if HA mode is enabled. This command prints regardless of whether
-  the Vault is sealed.
----
-
-# status
-
-The `status` command prints the current state of Vault including whether it is
-sealed and if HA mode is enabled. This command prints regardless of whether the
-Vault is sealed.
-
-The exit code reflects the seal status:
-
-- 0 - unsealed
-- 1 - error
-- 2 - sealed
-
-## Examples
-
-Check the status:
-
-```shell-session
-$ vault status
-
-Sealed: false
-Key Shares: 5
-Key Threshold: 3
-Unseal Progress: 0
-Unseal Nonce:
-Version: x.y.z
-Build Date: 2022-05-03T08:34:11Z
-Cluster Name: vault-cluster-49ffd45f
-Cluster ID: d2dad792-fb99-1c8d-452e-528d073ba205
-
-High-Availability Enabled: false
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-By default, the output is displayed in "table" format.
-
-#### Output fields
-
-1. The field for total shares is displayed as `"n"` instead of `n` in yaml outputs. 
-2. The following fields in "table" format are displayed only when relevant:
-- "Unseal Progress" and "Unseal Nonce" are displayed when vault is sealed.
-- "HCP Link Status" and "HCP Link Resource ID" are displayed when HCP link is configured.
-- "Seal Migration in Progress" is displayed when it is in progress.
-- "Cluster Name" and "Cluster ID" are displayed if they have a value.
-- "Raft Committed Index", "Raft Applied Index", "Last WAL" are diplayed if they are non-zero.
-- "Warnings" are displayed if the warnings apply.
-- The following fields are displayed only when HA mode is enabled and is unsealed:
-  - "HA Cluster".
-  - "HA Mode".
-  - "Active Since" is displayed if the node is active and has a valid active time.
-  - "Performance Standby" Node and "Performance Standby Last Remote WAL" are displayed for performance standby nodes.
diff --git a/website/content/docs/commands/token-helper.mdx b/website/content/docs/commands/token-helper.mdx
deleted file mode 100644
index 7a52fbc0441..00000000000
--- a/website/content/docs/commands/token-helper.mdx
+++ /dev/null
@@ -1,69 +0,0 @@
----
-layout: docs
-page_title: Token Helpers
-description: >-
-  The Vault CLI supports external token helpers that make retrieving, setting
-  and erasing tokens simpler to use.
----
-
-# Token helpers
-
-A token helper is an external program that Vault calls to save, retrieve or erase
-a saved token. The token helper could be a very simple script or a more complex
-program depending on your needs. The interface to the external token helper is
-extremely simple.
-
-By default the Vault CLI provides a built in tool for authenticating with any
-of the enabled authentication backends. Once authenticated, the CLI will store
-the generated token on disk in the `~/.vault-token` file. By using a token helper,
-this default functionality can be changed.
-
-## Configuration
-
-To configure a token helper, edit (or create) the file `~/.vault` and add a line similar to:
-
-```
-token_helper = "/path/to/token/helper.sh"
-```
-
-You will need to use the fully qualified path to the token helper script. The script should be executable.
-
-## Developing a token helper
-
-The interface to a token helper is extremely simple: the script is passed with one argument that could be `get`, `store` or `erase`. If the argument is `get`, the script should do whatever work it needs to do to retrieve the stored token and then print the token to `STDOUT`. If the argument is `store`, Vault is asking you to store the token. Finally, if the argument is `erase`, your program should erase the stored token.
-
-If your program succeeds, it should exit with status code 0. If it encounters an issue that prevents it from working, it should exit with some other status code. You should write a user-friendly error message to `STDERR`. You should never write anything other than the token to `STDOUT`, as Vault assumes whatever it gets on `STDOUT` is the token.
-
-### Example token helper
-
-This is an example token helper written in Ruby that stores and retrieves tokens in a json file called `~/.vault_tokens`. The key is the environment variable \$VAULT_ADDR, this allows the Vault user to easily store and retrieve tokens from a number of different Vault servers.
-
-```ruby
-#!/usr/bin/env ruby
-
-require 'json'
-
-unless ENV['VAULT_ADDR']
-  STDERR.puts "No VAULT_ADDR environment variable set. Set it and run me again!"
-  exit 100
-end
-
-begin
-  tokens = JSON.parse(File.read("#{ENV['HOME']}/.vault_tokens"))
-rescue Errno::ENOENT => e
-  # file doesn't exist so create a blank hash for it
-  tokens = {}
-end
-
-case ARGV.first
-when 'get'
-  print tokens[ENV['VAULT_ADDR']] if tokens[ENV['VAULT_ADDR']]
-  exit 0
-when 'store'
-  tokens[ENV['VAULT_ADDR']] = STDIN.read
-when 'erase'
-  tokens.delete!(ENV['VAULT_ADDR'])
-end
-
-File.open("#{ENV['HOME']}/.vault_tokens", 'w') { |file| file.write(tokens.to_json) }
-```
diff --git a/website/content/docs/commands/token/capabilities.mdx b/website/content/docs/commands/token/capabilities.mdx
deleted file mode 100644
index dc26fdbad2d..00000000000
--- a/website/content/docs/commands/token/capabilities.mdx
+++ /dev/null
@@ -1,44 +0,0 @@
----
-layout: docs
-page_title: token capabilities - Command
-description: |-
-  The "token capabilities" command fetches the capabilities of a token for a
-  given path.
----
-
-# token capabilities
-
-The `token capabilities` command fetches the capabilities of a token for a given
-path.
-
-If a TOKEN is provided as an argument, this command uses the "/sys/capabilities"
-endpoint and permission. If no TOKEN is provided, this command uses the
-"/sys/capabilities-self" endpoint and permission with the locally authenticated
-token.
-
-## Examples
-
-List capabilities for the local token on the "secret/foo" path:
-
-```shell-session
-$ vault token capabilities secret/foo
-read
-```
-
-List capabilities for a token on the "cubbyhole/foo" path:
-
-```shell-session
-$ vault token capabilities 96ddf4bc-d217-f3ba-f9bd-017055595017 database/creds/readonly
-deny
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
diff --git a/website/content/docs/commands/token/create.mdx b/website/content/docs/commands/token/create.mdx
deleted file mode 100644
index 5914f6f5170..00000000000
--- a/website/content/docs/commands/token/create.mdx
+++ /dev/null
@@ -1,129 +0,0 @@
----
-layout: docs
-page_title: token create - Command
-description: |-
-  The "token create" command creates a new token that can be used for
-  authentication. This token will be created as a child of the currently
-  authenticated token. The generated token will inherit all policies and
-  permissions of the currently authenticated token unless you explicitly define
-  a subset list policies to assign to the token.
----
-
-# token create
-
-The `token create` command creates a new token that can be used for
-authentication. This token will be created as a child of the currently
-authenticated token. The generated token will inherit all policies and
-permissions of the currently authenticated token unless you explicitly define a
-subset list policies to assign to the token.
-
-A ttl can also be associated with the token. If a ttl is not associated with the
-token, then it cannot be renewed. If a ttl is associated with the token, it will
-expire after that amount of time unless it is renewed.
-
-Metadata associated with the token (specified with `-metadata`) is written to
-the audit log when the token is used.
-
-If a role is specified, the role may override parameters specified here.
-
-## Examples
-
-Create a token attached to specific policies:
-
-```shell-session
-$ vault token create -policy=my-policy -policy=other-policy
-Key                Value
----                -----
-token              95eba8ed-f6fc-958a-f490-c7fd0eda5e9e
-token_accessor     882d4a40-3796-d06e-c4f0-604e8503750b
-token_duration     768h
-token_renewable    true
-token_policies     [default my-policy other-policy]
-```
-
-Create a periodic token:
-
-```shell-session
-$ vault token create -period=30m
-Key                Value
----                -----
-token              fdb90d58-af87-024f-fdcd-9f95039e353a
-token_accessor     4cd9177c-034b-a004-c62d-54bc56c0e9bd
-token_duration     30m
-token_renewable    true
-token_policies     [my-policy]
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name. Specifying
-  this option will take precedence over other formatting directives. The result
-  will not have a trailing newline making it ideal for piping to other processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-display-name` `(string: "")` - Name to associate with this token. This is a
-  non-sensitive value that can be used to help identify created secrets (e.g.
-  prefixes).
-
-- `-entity-alias`  `(string: "")` - Name of the entity alias to associate with
-  during token creation. Only works in combination with -role argument and used
-  entity alias must be listed in allowed_entity_aliases. If this has been
-  specified, the entity will not be inherited from the parent.
-
-- `-explicit-max-ttl` `(duration: "")` - Explicit maximum lifetime for the
-  token. Unlike normal TTLs, the maximum TTL is a hard limit and cannot be
-  exceeded. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `-id` `(string: "")` - Value for the token. By default, this is an
-  auto-generated value. Specifying this value requires sudo permissions.
-
-- `-metadata` `(k=v: "")` - Arbitrary key=value metadata to associate with the
-  token. This metadata will show in the audit log when the token is used. This
-  can be specified multiple times to add multiple pieces of metadata.
-
-- `-no-default-policy` `(bool: false)` - Detach the "default" policy from the
-  policy set for this token.
-
-- `-orphan` `(bool: false)` - Create the token with no parent. This prevents the
-  token from being revoked when the token which created it expires. Setting this
-  value requires sudo permissions.
-
-- `-period` `(duration: "")` - If specified, every renewal will use the given
-  period. Periodic tokens do not expire as long as they are actively being
-  renewed (unless `-explicit-max-ttl` is also provided). Setting this value
-  requires sudo permissions. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `-policy` `(string: "")` - Name of a policy to associate with this token. This
-  can be specified multiple times to attach multiple policies.
-
-- `-renewable` `(bool: true)` - Allow the token to be renewed up to it's maximum
-  TTL.
-
-- `-role` `(string: "")` - Name of the role to create the token against.
-  Specifying -role may override other arguments. The locally authenticated Vault
-  token must have permission for `auth/token/create/<role>`.
-
-- `-ttl` `(duration: "")` - Initial TTL to associate with the token. Token
-  renewals may be able to extend beyond this value, depending on the configured
-  maximumTTLs. Uses [duration format strings](/vault/docs/concepts/duration-format).
-
-- `-type` `(string: "service")` - The type of token to create. Can be "service" or "batch".
-
-- `-use-limit` `(int: 0)` - Number of times this token can be used. After the
-  last use, the token is automatically revoked. By default, tokens can be used
-  an unlimited number of times until their expiration.
-
-- `-wrap-ttl` `(duration: "")` -  Wraps the response in a cubbyhole token with the
-  requested TTL. The response is available via the "vault unwrap" command. The TTL
-  is specified as a numeric string with suffix like "30s" or "5m". This can also be
-  specified via the `VAULT_WRAP_TTL` environment variable.
diff --git a/website/content/docs/commands/token/index.mdx b/website/content/docs/commands/token/index.mdx
deleted file mode 100644
index d4a4645c922..00000000000
--- a/website/content/docs/commands/token/index.mdx
+++ /dev/null
@@ -1,53 +0,0 @@
----
-layout: docs
-page_title: token - Command
-description: |-
-  The "token" command groups subcommands for interacting with tokens. Users can
-  create, lookup, renew, and revoke tokens.
----
-
-# token
-
-The `token` command groups subcommands for interacting with tokens. Users can
-create, lookup, renew, and revoke tokens.
-
-For more information on tokens, please see the [token concepts
-page](/vault/docs/concepts/tokens).
-
-## Examples
-
-Create a new token:
-
-```shell-session
-$ vault token create
-```
-
-Revoke a token:
-
-```shell-session
-$ vault token revoke 96ddf4bc-d217-f3ba-f9bd-017055595017
-```
-
-Renew a token:
-
-```shell-session
-$ vault token renew 96ddf4bc-d217-f3ba-f9bd-017055595017
-```
-
-## Usage
-
-```text
-Usage: vault token <subcommand> [options] [args]
-
-  # ...
-
-Subcommands:
-    capabilities    Print capabilities of a token on a path
-    create          Create a new token
-    lookup          Display information about a token
-    renew           Renew a token lease
-    revoke          Revoke a token and its children
-```
-
-For more information, examples, and usage about a subcommand, click on the name
-of the subcommand in the sidebar.
diff --git a/website/content/docs/commands/token/lookup.mdx b/website/content/docs/commands/token/lookup.mdx
deleted file mode 100644
index a96a5bcd967..00000000000
--- a/website/content/docs/commands/token/lookup.mdx
+++ /dev/null
@@ -1,50 +0,0 @@
----
-layout: docs
-page_title: token lookup - Command
-description: |-
-  The "token lookup" displays information about a token or accessor. If a TOKEN
-  is not provided, the locally authenticated token is used.
----
-
-# token lookup
-
-The `token lookup` displays information about a token or accessor. If a TOKEN is
-not provided, the locally authenticated token is used.
-
-## Examples
-
-Get information about the locally authenticated token (this uses the
-`/auth/token/lookup-self` endpoint and permission):
-
-```shell-session
-$ vault token lookup
-```
-
-Get information about a particular token (this uses the `/auth/token/lookup`
-endpoint and permission):
-
-```shell-session
-$ vault token lookup 96ddf4bc-d217-f3ba-f9bd-017055595017
-```
-
-Get information about a token via its accessor:
-
-```shell-session
-$ vault token lookup -accessor 9793c9b3-e04a-46f3-e7b8-748d7da248da
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(default: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-accessor` `(bool: false)` - Treat the argument as an accessor instead of a
-  token. When this option is selected, the output will NOT include the token.
diff --git a/website/content/docs/commands/token/renew.mdx b/website/content/docs/commands/token/renew.mdx
deleted file mode 100644
index c957db9f1b4..00000000000
--- a/website/content/docs/commands/token/renew.mdx
+++ /dev/null
@@ -1,55 +0,0 @@
----
-layout: docs
-page_title: token renew - Command
-description: |-
-  The "token renew" renews a token's lease, extending the amount of time it can
-  be used. If a TOKEN is not provided, the locally authenticated token is used.
-  Lease renewal will fail if the token is not renewable, the token has already
-  been revoked, or if the token has already reached its maximum TTL.
----
-
-# token renew
-
-The `token renew` renews a token's lease, extending the amount of time it can be
-used. If a TOKEN is not provided, the locally authenticated token is used. Lease
-renewal will fail if the token is not renewable, the token has already been
-revoked, or if the token has already reached its maximum TTL.
-
-## Examples
-
-Renew a token (this uses the `/auth/token/renew` endpoint and permission):
-
-```shell-session
-$ vault token renew 96ddf4bc-d217-f3ba-f9bd-017055595017
-```
-
-Renew the currently authenticated token (this uses the `/auth/token/renew-self`
-endpoint and permission):
-
-```shell-session
-$ vault token renew
-```
-
-Renew a token requesting a specific increment value:
-
-```shell-session
-$ vault token renew -increment=30m 96ddf4bc-d217-f3ba-f9bd-017055595017
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(default: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-increment` `(duration: "")` - Request a specific increment for renewal.
-  Vault will not honor this request for periodic tokens. If not supplied, Vault will use
-  the default TTL. This is specified as a numeric string with suffix like "30s"
-  or "5m". This is aliased as "-i".
diff --git a/website/content/docs/commands/token/revoke.mdx b/website/content/docs/commands/token/revoke.mdx
deleted file mode 100644
index a281d4607a5..00000000000
--- a/website/content/docs/commands/token/revoke.mdx
+++ /dev/null
@@ -1,52 +0,0 @@
----
-layout: docs
-page_title: token revoke - Command
-description: |-
-  The "token revoke" revokes authentication tokens and their children. If a
-  TOKEN is not provided, the locally authenticated token is used.
----
-
-# token revoke
-
-The `token revoke` revokes authentication tokens and their children. If a TOKEN
-is not provided, the locally authenticated token is used. The `-mode` flag can
-be used to control the behavior of the revocation.
-
-## Examples
-
-Revoke a token and all the token's children:
-
-```shell-session
-$ vault token revoke 96ddf4bc-d217-f3ba-f9bd-017055595017
-Success! Revoked token (if it existed)
-```
-
-Revoke a token leaving the token's children:
-
-```shell-session
-$ vault token revoke -mode=orphan 96ddf4bc-d217-f3ba-f9bd-017055595017
-Success! Revoked token (if it existed)
-```
-
-Revoke a token by accessor:
-
-```shell-session
-$ vault token revoke -accessor 9793c9b3-e04a-46f3-e7b8-748d7da248da
-Success! Revoked token (if it existed)
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-- `-accessor` `(bool: false)` - Treat the argument as an accessor instead of a
-  token.
-
-- `-mode` `(string: "")` - Type of revocation to perform. If unspecified, Vault
-  will revoke the token and all of the token's children. If "orphan", Vault will
-  revoke only the token, leaving the children as orphans. If "path", tokens
-  created from the given authentication path prefix are deleted along with their
-  children.
-
-- `-self` - Perform the revocation on the currently authenticated token.
diff --git a/website/content/docs/commands/transit/import.mdx b/website/content/docs/commands/transit/import.mdx
deleted file mode 100644
index 2a8c7205560..00000000000
--- a/website/content/docs/commands/transit/import.mdx
+++ /dev/null
@@ -1,62 +0,0 @@
----
-layout: docs
-page_title: transit import and transit import-version - Command
-description: |-
-  The "transit import" and "transit import-version" commands import the
-  specified key into Transit, via the Transit BYOK mechanism.
----
-
-# transit import and transit import-version
-
-The `transit import` and `transit import-version` commands import the
-specified key into Transit, via the [Transit BYOK
-mechanism](/vault/docs/secrets/transit#bring-your-own-key-byok). The former
-imports this key as a new key, failing if it already exists, whereas the
-latter will only update an existing key in Transit to a new version of the
-key material.
-
-This needs access to read the transit mount's wrapping key (at
-`transit/wrapping_key`) and the ability to write to either import
-endpoints (either `transit/keys/:name/import` or
-`transit/keys/:name/import_version`).
-
-## Examples
-
-Imports a 2048-bit RSA key as a new key:
-
-```
-$ vault transit import transit/keys/test-key @test-key type=rsa-2048
-Retrieving transit wrapping key.
-Wrapping source key with ephemeral key.
-Encrypting ephemeral key with transit wrapping key.
-Submitting wrapped key to Vault transit.
-Success!
-```
-
-Imports a new version of an existing key:
-
-```
-$ vault transit import-version transit/keys/test-key @test-key-updated
-Retrieving transit wrapping key.
-Wrapping source key with ephemeral key.
-Encrypting ephemeral key with transit wrapping key.
-Submitting wrapped key to Vault transit.
-Success!
-```
-
-## Usage
-
-This command does not have any unique flags and respects core Vault CLI
-commands. See `vault transit import -help` for more information.
-
-This command requires two positional arguments:
-
- 1. `PATH`, the path to the transit key to import in the format of
-    `<mount>/keys/<key-name>`, where `<mount>` is the path to the mount
-    (using `-namespace=<ns>` to specify any namespaces), and `<key-name>`
-    is the desired name of the key.
- 2. `KEY`, the key material to import in Standard Base64 encoding (either
-    of a raw key in the case of symmetric keys such as AES, or of the DER
-    encoded format for asymmetric keys such as RSA). If the value for `KEY`
-    begins with an `@`, the CLI argument is assumed to be a path to a file
-    on disk to be read.
diff --git a/website/content/docs/commands/transit/index.mdx b/website/content/docs/commands/transit/index.mdx
deleted file mode 100644
index 72f8291eb07..00000000000
--- a/website/content/docs/commands/transit/index.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
----
-layout: docs
-page_title: transit - Command
-description: |-
-  The "transit" command groups subcommands for interacting with Vault's Transit
-  secrets engine.
----
-
-# transit
-
-The `transit` command groups subcommands for interacting with Vault's
-[Transit Secrets Engine](/vault/docs/secrets/transit).
-
-## Syntax
-
-Option flags for a given subcommand are provided after the subcommand, but before the arguments.
-
-## Examples
-
-To [import](/vault/docs/commands/transit/import) keys into a mount via the
-[Transit BYOK](/vault/docs/secrets/transit#bring-your-own-key-byok)
-mechanism, use the `vault transit import <path> <key>` or
-`vault transit import-version <path> <key>` commands:
-
-```
-$ vault transit import transit/keys/test-key @test-key type=rsa-2048
-Retrieving transit wrapping key.
-Wrapping source key with ephemeral key.
-Encrypting ephemeral key with transit wrapping key.
-Submitting wrapped key to Vault transit.
-Success!
-```
diff --git a/website/content/docs/commands/unwrap.mdx b/website/content/docs/commands/unwrap.mdx
deleted file mode 100644
index b53caa64758..00000000000
--- a/website/content/docs/commands/unwrap.mdx
+++ /dev/null
@@ -1,45 +0,0 @@
----
-layout: docs
-page_title: unwrap - Command
-description: |-
-  The "unwrap" command unwraps a wrapped secret from Vault by the given token.
-  The result is the same as the "vault read" operation on the non-wrapped
-  secret. If no token is given, the data in the currently authenticated token is
-  unwrapped.
----
-
-# unwrap
-
-The `unwrap` command unwraps a wrapped secret from Vault by the given token. The
-result is the same as the "vault read" operation on the non-wrapped secret. If
-no token is given, the data in the currently authenticated token is unwrapped.
-
-## Examples
-
-Unwrap the data in the cubbyhole secrets engine for a token:
-
-```shell-session
-$ vault unwrap 3de9ece1-b347-e143-29b0-dc2dc31caafd
-```
-
-Unwrap the data in the active token:
-
-```shell-session
-$ vault login 848f9ccf-7176-098c-5e2b-75a0689d41cd
-$ vault unwrap # unwraps 848f9ccf...
-```
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name, in the format
-  specified in the `-format` directive. The result will not have a trailing
-  newline making it ideal for piping to other processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
diff --git a/website/content/docs/commands/version-history.mdx b/website/content/docs/commands/version-history.mdx
deleted file mode 100644
index 7b6c901da25..00000000000
--- a/website/content/docs/commands/version-history.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
----
-layout: docs
-page_title: version-history - Command
-description: |-
-  The "version-history" command prints the historical list of installed Vault versions in chronological order.
----
-
-# version-history
-
-The `version-history` command prints the historical list of installed Vault versions in chronological order.
-
-```shell-session
-Note: Version tracking was added in 1.9.0. Earlier versions have not been tracked.
-      The Build Date will only be available for versions 1.11.0 or greater.
-
-Version  Installation Time     Build Date
--------  -----------------     ----------
-1.9.0    2021-11-18T10:23:16Z
-1.9.1    2022-12-13T11:09:52Z
-1.9.2    2021-12-23T10:56:37Z
-1.11.0   2022-05-03T13:16:04Z  2022-05-03T08:34:11Z
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/docs/commands) included on all commands.
-
-### Output options
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table" or json". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
diff --git a/website/content/docs/commands/version.mdx b/website/content/docs/commands/version.mdx
deleted file mode 100644
index 719903aa01a..00000000000
--- a/website/content/docs/commands/version.mdx
+++ /dev/null
@@ -1,21 +0,0 @@
----
-layout: docs
-page_title: version - Command
-description: The "version" command prints the version of Vault.
----
-
-# version
-
-The `version` command prints the Vault version:
-
-```shell-session
-$ vault version
-Vault v1.2.3
-```
-
-It can also be printed by adding the flags `--version` or `-v` to the `vault` command:
-
-```shell-session
-$ vault -v
-Vault v1.2.3, built 2022-05-03T08:34:11Z
-```
diff --git a/website/content/docs/commands/web.mdx b/website/content/docs/commands/web.mdx
deleted file mode 100644
index 3b29dd0c129..00000000000
--- a/website/content/docs/commands/web.mdx
+++ /dev/null
@@ -1,84 +0,0 @@
----
-layout: docs
-page_title: Web REPL - Command
-description: |-
-  The Vault web user interface (UI) includes an advanced mode that mimics some basic commands from the Vault CLI. It can be useful for users more familiar with the CLI or API as it lets a user directly input the paths they wish to manipulate.
-
----
-
-
-# Web REPL
-
-The Vault web user interface (UI) includes an advanced mode that mimics some basic commands from the Vault CLI. It can be useful for users more familiar with the CLI or API as it lets a user directly input the paths they wish to manipulate.
-
-~> **Note:** The Vault Web REPL is _not_ a full terminal emulator. Features like environment variables, HEREDOC, or piping of data or files will not work unless explicitly documented.
-
-## Command history
-The Web REPL will keep a history of all of the commands you've entered in your current session. If you refresh the browser or use the `clearall` command, this history will be reset.
-
-To cycle through the command history, you can use the up and down arrows when the REPL input has focus. If you reach either beginning of the history by pressing up, it will cycle back to the most recent command. Pressing the down arrow will stop at an empty prompt after the most recent command.
-
-## Commands
-The Vault Web REPL implements the Create/Read/Update/Delete/List (CRUDL) commands from the Vault CLI. With these basic commands, a user can interact with most of the Vault API even if there aren't explicit screens for it in Vault's Web UI.
-
-All commands can optionally be prefixed with `vault` as if you were using the CLI - the intent being that a large number of example commands from the documentation should work via simply copy and pasting them from the documentation site into the web REPL.
-
-### delete
-`delete` in the Web REPL is the same as using the [`delete`](/vault/docs/commands/delete) command in the CLI. It can be used to delete secrets and configuration from Vault at the given path via an HTTP DELETE.
-
-### kv-get
-The Web REPL is a convenience method exclusively for reading secrets from a KV version 2 secrets engine, much like [`kv read`](/vault/docs/commands/kv/read). The command `kv-get secret/foo` is functionally equivalent to running the REPL `read` command with the full API path: `read secret/data/foo`.
-
-There is also a `-metadata` flag that is shorthand for `-field=metadata`.
-
-### list
-The Web REPL `list` command is functionally identical to the CLI [`list`](/vault/docs/commands/list) command. It is used to list keys at a given path such as roles in an auth method, or keys for a given secrets engine. The Web REPL version issues a GET with the `?list=true` query parameter as described in the [API overview](/vault/api-docs#api-operations) since web browsers do not support custom HTTP verbs.
-
-### read
-Like the CLI [`read`](/vault/docs/commands/read) command, the Web REPL `read` performs an HTTP GET on a given path.
-
-Also like the CLI `read`, the REPL implements `-field` and `-format` flags. The output defaults to "table" format, but also supports "json" output.
-
-### write
-This is a Web REPL implementation of the CLI [`write`](/vault/docs/commands/write) command - it will perform an HTTP POST to the given path with the given data. Notably the special "**@**" syntax from the CLI is not implemented - data must be specified as arguments to the command. Because of this, any API fields that require data structures not expressible as arguments are not supported.
-This is the major shortcoming of the Vault Web REPL.
-
-
-## Command options
-
-### field
-If you are only interested in a single field in the response, you can use the `-field` flag which will specify that the REPL should only print that field in the response. Using this in conjunction with `-wrap-ttl` is nice because you can return just the wrapped token by doing something like this:
-```
-kv-get secret/one -wrap-ttl=10m -field=token
-```
-### force
-Some delete paths require using `-force` as a confirmation that the delete is intentional. Using `delete` without this flag on a path that needs it will result in an error that tells you `-force` is required.
-
-### format
-`read` commands default to the "table" format, if you would like to see the JSON format of a response, you can pass `-format=json`. This is most often useful for responses that have deeply nested objects that don't fit well in the table format.
-
-### metadata
-As mentioned above in the `kv-get` section - this flag is shorthand for `-field=metadata` which is useful when reading secrets from the KVv2 secrets engine.
-
-### wrap-ttl
-Like the `vault` CLI, the Web REPL supports creating [response-wrapping tokens](/vault/docs/concepts/response-wrapping#response-wrapping-token-creation).The format is also the same: it can be an integer that sets the wrapping TTL for a number of seconds, or it can be a string that specifys the length of the duration in seconds (`15s`), miniutes (`20m`), or hours (`25h`).
-
-## REPL-specific commands
-
-### api
-This will navigate you to an interactive OpenAPI explorer in the Vault UI. This explorer will only contain the paths your current `VAULT_TOKEN` has permissions to operate on.
-
-### clear
-This will clear all of the output currently in the Web REPL log.
-
-### clearall
-This clears the output _and_ the command history in the Web REPL. After running `clearall`, arrowing up won't show previously executed commands.
-
-### fullscreen
-`fullscreen` will toggle the Web REPL into a view that expands to cover the whole browser window.
-
-### help
-Submitting the form with no input or typing `help` in the Web REPL will print out a list of available commands with short descriptions.
-
-### refresh
-If you've run a command in the Web REPL that affects the data on a page you're currently on in the Vault UI, the UI does not automatically refresh. The `refresh` command is a convenient way to refresh the current route without having to navigate away or fully refresh the browser application.
diff --git a/website/content/docs/commands/write.mdx b/website/content/docs/commands/write.mdx
deleted file mode 100644
index b73a77a47da..00000000000
--- a/website/content/docs/commands/write.mdx
+++ /dev/null
@@ -1,121 +0,0 @@
----
-layout: docs
-page_title: write - Command
-description: |-
-  The "write" command writes data to Vault at the given path. The data can be
-  credentials, secrets, configuration, or arbitrary data. The specific behavior
-  of this command is determined at the thing mounted at the path.
----
-
-# write
-
-The `write` command writes data to Vault at the given path (wrapper command for
-HTTP PUT or POST). The data can be credentials, secrets, configuration, or
-arbitrary data. The specific behavior of the `write` command is determined at
-the thing mounted at the path.
-
-Data is specified as "**key=value**" pairs on the command line. If the value begins
-with an "**@**", then it is loaded from a file. If the value for a key is "**-**", Vault
-will read the value from stdin rather than the command line.
-
-Some API fields require more advanced structures such as maps. These cannot
-directly be represented on the command line. However, direct control of the
-request parameters can be achieved by using `-` as the only data argument.
-This causes `vault write` to read a JSON blob containing all request parameters
-from stdin. This argument will be ignored if used in conjunction with any
-"key=value" pairs.
-
-For a full list of examples and paths, please see the documentation that
-corresponds to the secrets engines in use.
-
-## Examples
-
-Store an arbitrary secrets in the token's cubbyhole.
-
-```shell-session
-$ vault write cubbyhole/git-credentials username="student01" password="p@$$w0rd"
-```
-
-Create a new encryption key in the transit secrets engine:
-
-```shell-session
-$ vault write -force transit/keys/my-key
-```
-
-The `-force` flag allows the write operation without input data. (See [command
-options](#command-options).)
-
-Upload an AWS IAM policy from a file on disk:
-
-```shell-session
-$ vault write aws/roles/ops policy=@policy.json
-```
-
-Configure access to Consul by providing an access token:
-
-```shell-session
-$ echo $MY_TOKEN | vault write consul/config/access token=-
-```
-
-### API versus CLI
-
-Create a token with TTL set to 8 hours, limited to 3 uses, and attach `admin`
-and `secops` policies.
-
-```shell-session
-$ vault write auth/token/create policies="admin" policies="secops" ttl=8h num_uses=3
-```
-
-Equivalent cURL command for this operation:
-
-```shell-session
-$ tee request_payload.json -<<EOF
-{
-   "policies": ["admin", "secops"],
-   "ttl": "8h",
-   "num_uses": 3
-}
-EOF
-
-$ curl --header "X-Vault-Token: $VAULT_TOKEN" \
-    --request POST \
-    --data @request_payload.json \
-    $VAULT_ADDR/v1/auth/token/create
-```
-
-The `vault write` command simplifies the API call.
-
-Since token management is a common task, Vault CLI provides a
-[`token`](/vault/docs/commands/token) command with
-[`create`](/vault/docs/commands/token/create) subcommand. The CLI command simplifies
-the token creation. Use the `vault create` command with options to set the token
-TTL, policies, and use limit.
-
-```shell-session
-$ vault token create -policy=admin -policy=secops -ttl=8h -use-limit=3
-```
-
--> **Syntax:** The command options start with `-` (e.g. `-ttl`) while API path
-parameters do not (e.g. `ttl`). You always set the API parameters after the path
-you are invoking.
-
-## Usage
-
-The following flags are available in addition to the [standard set of
-flags](/vault/docs/commands) included on all commands.
-
-### Output options
-
-- `-field` `(string: "")` - Print only the field with the given name, in the format
-  specified in the `-format` directive. The result will not have a trailing
-  newline making it ideal for piping to other processes.
-
-- `-format` `(string: "table")` - Print the output in the given format. Valid
-  formats are "table", "json", or "yaml". This can also be specified via the
-  `VAULT_FORMAT` environment variable.
-
-### Command options
-
-- `-force` `(bool: false)` - Allow the operation to continue with no key=value
-  pairs. This allows writing to keys that do not need or expect data. This is
-  aliased as `-f`.
diff --git a/website/content/docs/concepts/auth.mdx b/website/content/docs/concepts/auth.mdx
deleted file mode 100644
index 54b9e9ec1fa..00000000000
--- a/website/content/docs/concepts/auth.mdx
+++ /dev/null
@@ -1,227 +0,0 @@
----
-layout: docs
-page_title: Authentication
-description: >-
-  Before performing any operation with Vault, the connecting client must be
-  authenticated.
----
-
-# Authentication
-
-Authentication in Vault is the process by which user or machine supplied
-information is verified against an internal or external system. Vault supports
-multiple [auth methods](/vault/docs/auth) including GitHub,
-LDAP, AppRole, and more. Each auth method has a specific use case.
-
-Before a client can interact with Vault, it must _authenticate_ against an
-auth method. Upon authentication, a token is generated. This token is
-conceptually similar to a session ID on a website. The token may have attached
-policy, which is mapped at authentication time. This process is described in
-detail in the [policies concepts](/vault/docs/concepts/policies) documentation.
-
-## auth methods
-
-Vault supports a number of auth methods. Some backends are targeted
-toward users while others are targeted toward machines. Most authentication
-backends must be enabled before use. To enable an auth method:
-
-```shell-session
-$ vault write sys/auth/my-auth type=userpass
-```
-
-This enables the "userpass" auth method at the path "my-auth". This
-authentication will be accessible at the path "my-auth". Often you will see
-authentications at the same path as their name, but this is not a requirement.
-
-To learn more about this authentication, use the built-in `path-help` command:
-
-```shell-session
-$ vault path-help auth/my-auth
-# ...
-```
-
-Vault supports multiple auth methods simultaneously, and you can even
-mount the same type of auth method at different paths. Only one
-authentication is required to gain access to Vault, and it is not currently
-possible to force a user through multiple auth methods to gain
-access, although some backends do support MFA.
-
-## Tokens
-
-There is an [entire page dedicated to tokens](/vault/docs/concepts/tokens),
-but it is important to understand that authentication works by verifying
-your identity and then generating a token to associate with that identity.
-
-For example, even though you may authenticate using something like GitHub,
-Vault generates a unique access token for you to use for future requests.
-The CLI automatically attaches this token to requests, but if you're using
-the API you'll have to do this manually.
-
-This token given for authentication with any backend can also be used
-with the full set of token commands, such as creating new sub-tokens,
-revoking tokens, and renewing tokens. This is all covered on the
-[token concepts page](/vault/docs/concepts/tokens).
-
-## Authenticating
-
-### Via the CLI
-
-To authenticate with the CLI, `vault login` is used. This supports many
-of the built-in auth methods. For example, with GitHub:
-
-```shell-session
-$ vault login -method=github token=<token>
-...
-```
-
-After authenticating, you will be logged in. The CLI command will also
-output your raw token. This token is used for revocation and renewal.
-As the user logging in, the primary use case of the token is renewal,
-covered below in the "Auth Leases" section.
-
-To determine what variables are needed for an auth method,
-supply the `-method` flag without any additional arguments and help
-will be shown.
-
-If you're using a method that isn't supported via the CLI, then the API
-must be used.
-
-### Via the API
-
-API authentication is generally used for machine authentication. Each
-auth method implements its own login endpoint. Use the `vault path-help`
-mechanism to find the proper endpoint.
-
-For example, the GitHub login endpoint is located at `auth/github/login`.
-And to determine the arguments needed, `vault path-help auth/github/login` can
-be used.
-
-## Auth leases
-
-Just like secrets, identities have
-[leases](/vault/docs/concepts/lease) associated with them. This means that
-you must reauthenticate after the given lease period to continue accessing
-Vault.
-
-To set the lease associated with an identity, reference the help for
-the specific auth method in use. It is specific to each backend
-how leasing is implemented.
-
-And just like secrets, identities can be renewed without having to
-completely reauthenticate. Just use `vault token renew <token>` with the
-leased token associated with your identity to renew it.
-
-## Code example
-
-The following code snippet demonstrates how to renew auth tokens.
-
-<CodeTabs heading="token renewal example">
-
-<CodeBlockConfig lineNumbers>
-
-```go
-package main
-
-import (
-	"context"
-	"fmt"
-	"log"
-
-	vault "github.com/hashicorp/vault/api"
-	auth "github.com/hashicorp/vault/api/auth/userpass"
-)
-
-// Once you've set the token for your Vault client, you will need to
-// periodically renew its lease.
-//
-// A function like this should be run as a goroutine to avoid blocking.
-//
-// Production applications may also wish to be more tolerant of failures and
-// retry rather than exiting.
-//
-// Additionally, enterprise Vault users should be aware that due to eventual
-// consistency, the API may return unexpected errors when running Vault with
-// performance standbys or performance replication, despite the client having
-// a freshly renewed token. See https://developer.hashicorp.com/vault/docs/enterprise/consistency#vault-1-7-mitigations
-// for several ways to mitigate this which are outside the scope of this code sample.
-func renewToken(client *vault.Client) {
-	for {
-		vaultLoginResp, err := login(client)
-		if err != nil {
-			log.Fatalf("unable to authenticate to Vault: %v", err)
-		}
-		tokenErr := manageTokenLifecycle(client, vaultLoginResp)
-		if tokenErr != nil {
-			log.Fatalf("unable to start managing token lifecycle: %v", tokenErr)
-		}
-	}
-}
-
-// Starts token lifecycle management. Returns only fatal errors as errors,
-// otherwise returns nil so we can attempt login again.
-func manageTokenLifecycle(client *vault.Client, token *vault.Secret) error {
-	renew := token.Auth.Renewable // You may notice a different top-level field called Renewable. That one is used for dynamic secrets renewal, not token renewal.
-	if !renew {
-		log.Printf("Token is not configured to be renewable. Re-attempting login.")
-		return nil
-	}
-
-	watcher, err := client.NewLifetimeWatcher(&vault.LifetimeWatcherInput{
-		Secret:    token,
-		Increment: 3600, // Learn more about this optional value in https://developer.hashicorp.com/vault/docs/concepts/lease#lease-durations-and-renewal
-	})
-	if err != nil {
-		return fmt.Errorf("unable to initialize new lifetime watcher for renewing auth token: %w", err)
-	}
-
-	go watcher.Start()
-	defer watcher.Stop()
-
-	for {
-		select {
-		// `DoneCh` will return if renewal fails, or if the remaining lease
-		// duration is under a built-in threshold and either renewing is not
-		// extending it or renewing is disabled. In any case, the caller
-		// needs to attempt to log in again.
-		case err := <-watcher.DoneCh():
-			if err != nil {
-				log.Printf("Failed to renew token: %v. Re-attempting login.", err)
-				return nil
-			}
-			// This occurs once the token has reached max TTL.
-			log.Printf("Token can no longer be renewed. Re-attempting login.")
-			return nil
-
-		// Successfully completed renewal
-		case renewal := <-watcher.RenewCh():
-			log.Printf("Successfully renewed: %#v", renewal)
-		}
-	}
-}
-
-func login(client *vault.Client) (*vault.Secret, error) {
-	// WARNING: A plaintext password like this is obviously insecure.
-	// See the hashicorp/vault-examples repo for full examples of how to securely
-	// log in to Vault using various auth methods. This function is just
-	// demonstrating the basic idea that a *vault.Secret is returned by
-	// the login call.
-	userpassAuth, err := auth.NewUserpassAuth("my-user", &auth.Password{FromString: "my-password"})
-	if err != nil {
-		return nil, fmt.Errorf("unable to initialize userpass auth method: %w", err)
-	}
-
-	authInfo, err := client.Auth().Login(context.TODO(), userpassAuth)
-	if err != nil {
-		return nil, fmt.Errorf("unable to login to userpass auth method: %w", err)
-	}
-	if authInfo == nil {
-		return nil, fmt.Errorf("no auth info was returned after login")
-	}
-
-	return authInfo, nil
-}
-```
-
-</CodeBlockConfig>
-
-</CodeTabs>
diff --git a/website/content/docs/concepts/client-count/counting.mdx b/website/content/docs/concepts/client-count/counting.mdx
deleted file mode 100644
index af2d0dd7fc7..00000000000
--- a/website/content/docs/concepts/client-count/counting.mdx
+++ /dev/null
@@ -1,201 +0,0 @@
----
-layout: docs
-page_title: Client count calculation
-description: |-
-  Technical overview of client count calculations in Vault 
----
-
-# Client count calculation
-
-Vault provides usage telemetry for the number of clients based on the number of
-unique entity assignments within a Vault cluster over a given billing period:
-
-- Standard entity assignments based on authentication method for active entities. 
-- Constructed entity assignments for active non-entity tokens, including batch
-  tokens created by performance standby nodes.
-- Certificate entity assignments for ACME connections.
-
-```markdown
-CLIENT_COUNT_PER_CLUSTER = UNIQUE_STANDARD_ENTITIES +
-                           UNIQUE_CONSTRUCTED_ENTITIES +
-                           UNIQUE CERTIFICATE_ENTITIES
-```
-
-Vault does not aggregate or de-duplicate clients across clusters, but all logs
-and precomputed reports are included in DR replication.
-
-<Note heading="Certificate entities currently reported as non-entity clients">
-
-  Vault currently rolls certificate entities into the non-entity client count
-  in the UI and API query requests. For more detailed information on certificate
-  entities, use the
-  [internal counter endpoint](/vault/api-docs/system/internal-counters) to query
-  monthly data for the PKI mount path or export historic data and look for
-  `client_type=pki-acme`.
-
-</Note>
-
-## How Vault tracks clients
-
-Each time a client authenticates, Vault checks whether the corresponding entity
-ID has already been recorded in the client log as active for the current month:
-
-- **If no record exists**, Vault adds an entry for the entity ID.
-- If a record exists but the entity was last active **prior to the current month**,
-  Vault adds a new entry to the client record for the entity ID.
-- If a record exists and the entity was last active **within the current month**,
-  Vault does not add a new entry to the client record for the entity ID.
-
-For example:
-
-- Two non-entity tokens under the same namespace, with the same alias name and
-  policy assignment receive the same entity assignment and are only counted
-  **once**.
-- Two authentication requests from a single ACME client for the same certificate
-  identifiers from different mounts receive the same entity assignments and
-  are counted **once**.
-- An application authenticating with AppRole receive the same entity assignment
-  every time and only counted **once**.
-
-At the **end of each month**, Vault pre-computes reports for each cluster on the
-number of active entities, per namespace, for each time period within the
-configured retention period. By de-duplicating records from the current month
-against records for the previous month, Vault ensures entities that remain
-active within every calendar month are only counted once for the year.
-
-The deduplication process has two additional consequences:
-
-1. Detailed reporting lags by 1 month at the start of the billing period.
-1. Billing period reports that include the current month must use an
-   approximation for the number of new clients in the current month.
-
-## How Vault approximates current-month client count
-
-Vault approximates client count for the current month using a
-[hyperloglog algorithm](https://en.wikipedia.org/wiki/HyperLogLog) that looks
-at the difference between the cardinalities of:
-
-- the number of clients across the **entire** billing period, and
-- the number of clients across the billing period **excluding** clients from the current month.
-
-The approximation algorithm uses the
-[axiomhq](https://github.com/axiomhq/hyperloglog) library with fourteen
-registers and sparse representations (when applicable). The multiset for the
-calculation is the total number of clients within a billing period, and the
-accuracy estimate for the approximation decreases as the difference between the
-number of clients in the current month and the number of clients in the billing
-period increases.
-
-### Testing verification for client count approximations 
-
-Given `CM` as the number of clients for the current month and `BP` as the number
-of clients in the billing period, we found that the approximation becomes
-increasingly imprecise as:
-
-- the difference between `BC` and `CM` increases
-- the value of `CM` approaches zero.
-- the number of months in the billing period increase.
-
-The maximum observed error rate
-(`ER = (FOUND_NEW_CLIENTS / EXPECTED_NEW_CLIENTS)`) was 30% for 10,000 clients
-or less, with an error rate of 5 &ndash; 10% in the average case.
-
-For the purposes of predictive analysis, the following tables list a random
-sample the values we found during testing for `CM`, `BP`, and `ER`.
-
-<Tabs>
-
-<Tab heading="Single-month tests">
-
-| Current month (`CM`) | Billing period (`BP`) | Error rate (`ER`) |
-| :-----------------: | :------------------: | :---------------: |
-| 7                   | 10                   | 0%                |
-| 20                  | 600                  | 0%                |
-| 20                  | 1000                 | 0%                |
-| 20                  | 6000                 | 10%               |
-| 20                  | 10000                | 10%               |
-| 200                 | 600                  | 0%                |
-| 200                 | 10000                | 7%                |
-| 400                 | 6000                 | 5%                |
-| 2000                | 10000                | 4%                |
-
-</Tab>
-
-<Tab heading="Multi-month / multi-segment tests">
-
-| Current month (`CM`) | Billing period (`BP`) | Error rate (`ER`) |
-| :-----------------: | :------------------: | :---------------: |
-| 20                  | 15                   |      0%           |
-| 20                  | 100                  |      0%           |
-| 20                  | 1000                 |      0%           |
-| 20                  | 10000                |      30%          |
-| 200                 | 10000                |      6%           |
-| 2000                | 10000                |      2%           |
-
-</Tab>
-
-</Tabs>
-
-## Resource costs for client computation
-
-In addition to the storage used for storing the pre-computed reports, each
-active entity in the client log consumes a few bytes of storage. As a safety
-measure against runaway storage growth, Vault limits the number of entity
-records to 656,000 per month, but typical storage costs are much less.
-
-On average, 1000 monthly active entities requires 1.5 MiB of storage capacity
-over the default 24-month retention period.
-
-@include "content-footer-title.mdx"
-
-<Tabs>
-
-<Tab heading="Related concepts">
-<ul>
-  <li>
-    <a href="/vault/docs/concepts/client-count/">Clients and entities</a>
-  </li>
-  <li>
-    <a href="/vault/docs/concepts/client-count/faq">Client count FAQ</a>
-  </li>
-</ul>
-</Tab>
-
-<Tab heading="Related API docs">
-<ul>
-  <li>
-    <a href="/vault/api-docs/system/internal-counters#client-count">Client Count API</a>
-  </li>
-  <li>
-    <a href="/vault/api-docs/system/internal-counters">Internal counters API</a>
-  </li>
-</ul>
-</Tab>
-
-<Tab heading="Related tutorials">
-<ul>
-  <li>
-    <a href="/vault/tutorials/monitoring/usage-metrics">
-      Vault Usage Metrics in Vault UI
-    </a>
-  </li>
-  <li>
-    <a href="/vault/tutorials/monitoring/usage-metrics">KMIP Client metrics</a>
-  </li>
-</ul>
-</Tab>
-
-<Tab heading="Other resources">
-<ul>
-  <li>
-    <a href="https://github.com/axiomhq/hyperloglog#readme">Accuracy estimates for the axiomhq hyperloglog library</a>
-  </li>
-  <li>
-    Blog post: <a href="https://www.hashicorp.com/blog/onboarding-applications-to-vault-using-terraform-a-practical-guide">
-      Onboarding Applications to Vault Using Terraform: A Practical Guide
-    </a>
-  </li>
-</ul>
-</Tab>
-
-</Tabs>
\ No newline at end of file
diff --git a/website/content/docs/concepts/client-count/faq.mdx b/website/content/docs/concepts/client-count/faq.mdx
deleted file mode 100644
index a076324e2fe..00000000000
--- a/website/content/docs/concepts/client-count/faq.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-layout: docs
-page_title: FAQ
-description: |-
-  Answers to the most commonly asked questions about client count in Vault.
----
-
-# Client count FAQ
-
-| Definitions             |
-| ----------------------- |
-| [What is a client?](#what-is-a-client) |
-| [What is the difference between an entity client, non-entity client, and certificate client?](#eclient-vs-neclient) |
-
-| Computing client count  |
-| ----------------------- |
-| [Can I compute clients for Vault versions before v1.6?](#before-1-6) |
-| [Can I compute KMIP clients for Vault?](#kmip) |
-| [Can I compute changes in clients month to month from the UI for Vault v1.8 &nbsp; v1.10?](#month-to-month) |
-| [Do child namespaces create duplication in the client count?](#namespace-dupes) |
-| [Does the Nomad-Vault integration affect client counts?](#nomad) |
-| [Are batch tokens counted differently than service tokens?](#batch-tokens) |
-| [Do custom user filters affect client counts?](#custom-filters) |
-| [Does mount migration affect client counts?](#mount-migration) |
-
-| Upgrading and migration |
-| ----------------------- |
-| [How has client count changed across different Vault versions?](#logic-improvements) |
-| [How has the usage metric UI changed across different Vault versions?](#ui-improvements) |
-| [Are there any known client count issues in the UI/API?](#uiapi-ki) |
-| [What happens to client count when I upgrade?](#what-happens-at-upgrade) |
-
-| Usage                   |
-| ----------------------- |
-| [Can I view the list of unique client IDs that contributed to my client count aggregate?](#view-data) |
-| [Is clientID viewable in the audit logs for non-entity tokens?](#clientid-in-logs) |
-| [Can I skip client computation for a period of time during the billing period?](#skip-computation) |
-| [Are there conditions that will cause me to lose client data?](#lost-data) |
-| [What happens if a portion of the data is missing for my billing period?](#missing-data) |
-| [Can I disable client counting?](#disable-client-count) |
-| [Can I configure Vault to log the client count data?](#log-client-count) |
-
-| Vault auditor tool      |
-| ----------------------- |
-| [What is the Vault auditor?](##vault-auditor) |
-| [Are there any known client count issues in the auditor tool?](#auditor-ki) |
-
-## Definitions ((#definitions))
-
-@include 'faq/client-count/definitions.mdx'
-
-## Computing client count ((#computing-clients))
-
-@include 'faq/client-count/computing-clients.mdx'
-
-## Upgrading and migration ((#upgrading))
-
-@include 'faq/client-count/upgrading.mdx'
-
-## Usage ((#usage))
-
-@include 'faq/client-count/usage.mdx'
-
-## Vault auditor tool ((#auditor))
-
-@include 'faq/client-count/tools.mdx'
diff --git a/website/content/docs/concepts/client-count/index.mdx b/website/content/docs/concepts/client-count/index.mdx
deleted file mode 100644
index 109d10a229c..00000000000
--- a/website/content/docs/concepts/client-count/index.mdx
+++ /dev/null
@@ -1,183 +0,0 @@
----
-layout: docs
-page_title: Clients and entities
-description: |-
-  Technical overview covering the concept of clients, entities, and entity IDs
-  in Vault 
----
-
-# Clients and entities
-
-Anything that connects and authenticates to Vault to accomplish a task is a
-**client**. For example, a user logging into a cluster to manage policies or a
-machine-based system (application or cloud service) requesting a database token
-are both considered clients.
-
-![Vault Client Workflows](https://www.datocms-assets.com/2885/1617325020-valult-client-workflows.png)
-
-While there are many different potential clients, the most common are:
-
-1. **Human users** interacting directly with Vault.
-1. **Applications and microservices**.
-1. **Servers and platforms** like VMs, Docker containers, or Kubernetes pods.
-1. **Orchestrators** like Nomad, Terraform, Ansible, ACME, and other continuous
-   integration / continuous delivery (CI/CD) pipelines.
-1. **Vault agents and proxies** that act on behalf of an application or
-   microservice.
-
-## Identity and entity assignment
-
-Authorized clients can connect to Vault with a variety of authentication methods.
-
-Authorization source       | AuthN method
--------------------------- | ---------------------------------
-Externally managed or SSO  | Active Directory, LDAP, OIDC, JWT, GitHub, username+password
-Platform- or server-based  | Kubernetes, AWS, GCP, Azure, Cert, Cloud Foundry
-Self                       | AppRole, tokens with no associated authN path or role
-
-![Vault client types](https://www.datocms-assets.com/2885/1617325030-vault-clients.png)
-
-When a client authenticates, Vault assigns a unique identifier
-(**client entity**) in the [Vault identity system](/vault/docs/secrets/identity)
-based on the authentication method used or a previously assigned alias.
-**Entity aliases** let clients authenticate with multiple methods but still be
-associated with a single policy, share resources, and count as the same entity,
-regardless of the authentication method used for a particular session.
-
-## Standard entity assignments
-
-@include "authn-names.mdx"
-
-Each authentication method has a unique ID string that corresponds to a client
-entity used for telemetry. For example, a microservice authenticating with
-AppRole takes the associated role ID as the entity. If you are running at scale
-and have multiple copies of the microservices using the same role id, the full
-set of instances will share the same identifier.
-
-As a result, it is critical that you configure different clients
-(microservices, humans, applications, services, platforms, servers, or pipelines)
-in a way that results in distinct clients having unique identifiers. For example,
-the role IDs should be different **between** two microservices, MicroserviceA and
-MicroServiceB, even if the **specific instances** of MicroServiceA and
-MicroServiceB share a common role ID.
-
-## Entity assignment with ACME
-
-Vault treats all ACME connections that authenticate under the same certificate
-identifier (domain) as the same **certificate entity** for client count
-calculations.
-
-For example:
-
-- ACME client requests (from the same server or separate servers) for the same
-  certificate identifier (a unique combination of CN,DNS, SANS and IP SANS)
-  are treated as the same entity.
-- If an ACME client makes a request for `a.test.com`, and subsequently makes a new
-  request for `b.test.com` and `*.test.com` then two distinct entities will be created,
-  one for `a.test.com` and another for the combination of `b.test.com` and `*.test.com`.
-- Overlap of certificate identifiers from different ACME clients will be treated
-  as the same entity e.g. if client 1 requests `a.test.com` and client 2 requests
-  `a.test.com` a single entity is created for both requests.
-
-## Entity assignment with namespaces
-
-A namespace represents a isolated, logical space within a single Vault
-cluster and is typically used for administrative purposes.
-
-When a client authenticates **within a given namespace**, Vault assigns the same
-client entity to activities within any child namespaces because the namespaces
-exist within the same larger scope.
-
-When a client authenticates **across namespace boundaries**, Vault treats the
-single client as two distinct entities because the client is operating
-across different scopes with different policy assignments and resources.
-
-For example:
-
-- Different requests under parent and child namespaces from a single client
-  authenticated under the **parent** namespace are assigned **the same entity
-  ID**. All the client activities occur **within** the boundaries of the
-  namespace referenced in the original authentication request.
-- Different requests under parent and child namespaces from a single client
-  authenticated under the **child** namespace are assigned **different entity
-  IDs**. Some of the client activities occur **outside** the boundaries of the
-  namespace referenced in the original authentication request.
-- Requests by the same client to two different namespaces, NAMESPACE<sub>A</sub>
-  and NAMESPACE<sub>B</sub> are assigned **different entity IDs**.
-
-## Entity assignment with non-entity tokens
-
-Vault uses tokens as the core method for authentication. You can use tokens to
-authenticate directly, or use token [auth methods](/vault/docs/concepts/auth)
-to dynamically generate tokens based on external identities.
-
-When clients authenticate with the [token auth method](/vault/docs/auth/token)
-**without** a client identity, the result is a **non-entity token**. For example,
-a service might use the token authentication method to create a token for a user
-whose explicit identity is unknown. 
-
-Ultimately, non-entity tokens trace back to a particular client or purpose so
-Vault assigns unique entity IDs to non-entity tokens based on a combination of
-the:
-
-- assigned entity alias name (if present),
-- associated policies, and
-- namespace under which the token was created.
-
-In **rare** cases, tokens may be created outside of the Vault identity system
-**without** an associated entity or identity. Vault treats every unaffiliated
-token as a unique client for production usage. We strongly discourage the use of
-unaffiliated tokens and recommend that you always associate a token with an
-entity alias and token role.
-
-<Note title="Behavior change in Vault 1.9+">
-  As of Vault 1.9, all non-entity tokens with the same namespace and policy
-  assignments are treated as the same client entity. Prior to Vault 1.9, every
-  non-entity token was treated as a unique client entity, which drastically
-  inflated telemetry around client count.
-
-  If you are using Vault 1.8 or earlier, and need to address client count
-  inflation without upgrading, we recommend creating a
-  [token role](/vault/api-docs/auth/token#create-update-token-role) with
-  allowable entity aliases and assigning all tokens to an appropriate
-  [role and entity alias name](/vault/api-docs/auth/token#create-token) before
-  using them.
-</Note>
-
-@include "content-footer-title.mdx"
-
-<Tabs>
-
-<Tab heading="Related concepts">
-<ul>
-  <li>
-    <a href="/vault/docs/concepts/client-count/counting">Client count calculation</a>
-  </li>
-  <li>
-    <a href="/vault/docs/concepts/client-count/faq">Client count FAQ</a>
-  </li>
-</ul>
-</Tab>
-
-<Tab heading="Related tutorials">
-<ul>
-  <li>
-    <a href="/vault/tutorials/auth-methods/identity">Identity: Entities and Groups</a>
-  </li>
-  <li>
-    <a href="/vault/tutorials/enterprise/namespaces">Secure Multi-Tenancy with Namespaces</a>
-  </li>
-</ul>
-</Tab>
-
-<Tab heading="Other resources">
-<ul>
-  <li>
-    Article: <a href="https://www.hashicorp.com/identity-based-security-and-low-trust-networks">
-      Identity-based Security and Low-trust Networks
-    </a>
-  </li>
-</ul>
-</Tab>
-
-</Tabs>
diff --git a/website/content/docs/concepts/dev-server.mdx b/website/content/docs/concepts/dev-server.mdx
deleted file mode 100644
index 9b3443850c3..00000000000
--- a/website/content/docs/concepts/dev-server.mdx
+++ /dev/null
@@ -1,56 +0,0 @@
----
-layout: docs
-page_title: Dev Server Mode
-description: >-
-  The dev server in Vault can be used for development or to experiment with
-  Vault.
----
-
-# "Dev" server mode
-
-You can start Vault as a server in "dev" mode like so: `vault server -dev`.
-This dev-mode server requires no further setup, and your local `vault` CLI will
-be authenticated to talk to it. This makes it easy to experiment with Vault or
-start a Vault instance for development. Every feature of Vault is available in
-"dev" mode. The `-dev` flag just short-circuits a lot of setup to insecure
-defaults.
-
-~> **Warning:** Never, ever, ever run a "dev" mode server in production.
-It is insecure and will lose data on every restart (since it stores data
-in-memory). It is only made for development or experimentation.
-
-## Properties
-
-The properties of the dev server (some can be overridden with command line
-flags or by specifying a configuration file):
-
-- **Initialized and unsealed** - The server will be automatically initialized
-  and unsealed. You don't need to use `vault operator unseal`. It is ready
-  for use immediately.
-
-- **In-memory storage** - All data is stored (encrypted) in-memory. Vault
-  server doesn't require any file permissions.
-
-- **Bound to local address without TLS** - The server is listening on
-  `127.0.0.1:8200` (the default server address) _without_ TLS.
-
-- **Automatically Authenticated** - The server stores your root access
-  token so `vault` CLI access is ready to go. If you are accessing Vault
-  via the API, you'll need to authenticate using the token printed out.
-
-- **Single unseal key** - The server is initialized with a single unseal
-  key. The Vault is already unsealed, but if you want to experiment with
-  seal/unseal, then only the single outputted key is required.
-
-- **Key Value store mounted** - A v2 KV secret engine is mounted at
-  `secret/`. Please be aware that there are differences with v1 KV.
-  If you want to use v1, use this flag `-dev-kv-v1`.
-
-## Use case
-
-The dev server should be used for experimentation with Vault features, such
-as different auth methods, secrets engines, audit devices, etc.
-If you're new to Vault, you may want to pick up with [Your First Secret](/vault/tutorials/getting-started/getting-started-first-secret) in our getting started guide.
-
-In addition to experimentation, the dev server is very easy to automate
-for development environments.
diff --git a/website/content/docs/concepts/duration-format.mdx b/website/content/docs/concepts/duration-format.mdx
deleted file mode 100644
index f39332f4480..00000000000
--- a/website/content/docs/concepts/duration-format.mdx
+++ /dev/null
@@ -1,39 +0,0 @@
----
-layout: docs
-page_title: Duration String Format
-description: A description of Vault's duration string format used throughout Vault.
----
-
-# Duration string format
-
-Vault uses a unique duration string format as part of its configuration and APIs.
-This format is used throughout Vault wherever durations are provided. For
-example, telemetry configuration contains various options using this format, such as
-`usage_gauge_period`, which is the interval of collection for high-cardinality usage data.
-
-## How it works
-
-A duration string is a possibly signed sequence of decimal numbers, each with an optional fraction and
-an optional unit suffix. If no unit is given, we interpret the numbers as seconds.
-
-Valid time units are:
-
-- `ns` Nanoseconds
-- `us` (or `µs`): Microseconds
-- `ms`: Milliseconds
-- `s`: Seconds
-- `m`: Minutes
-- `h`: Hours
-- `d`: Days
-
-## Examples
-
-Example values could be:
-
-- `100` (One hundred seconds, equivalent to `100s`)
-- `60h` (Sixty hours)
-- `1.5h` (One and a half hours)
-- `50d` (Fifty days)
-- `100ms` (One hundred milliseconds)
-- `50ns` (Fifty nanoseconds)
-
diff --git a/website/content/docs/concepts/events.mdx b/website/content/docs/concepts/events.mdx
deleted file mode 100644
index 9a3d0d7af24..00000000000
--- a/website/content/docs/concepts/events.mdx
+++ /dev/null
@@ -1,207 +0,0 @@
----
-layout: docs
-page_title: Event Notications
-description: >-
-  Event notifications allow Vault and plugins to exchange arbitrary activity
-  data within Vault and with external subscribers via WebSockets.
----
-
-# Event Notifications
-
-<EnterpriseAlert product="vault" />
-
-Event notifications are arbitrary, **non-secret** data that can be exchanged between producers (Vault and plugins)
-and subscribers (Vault components and external users via the API).
-
-## Event types
-
-<!-- This information will probably be migrated to the plugin pages eventually -->
-
-Internal components of Vault as well as external plugins can generate event notifications.
-These are published to "event types", sometimes called "topics" in other event systems.
-All event notifications of a specific event type will have the same format for their
-additional `metadata` field.
-
-The following event types are currently generated by Vault and its builtin plugins automatically:
-
-| Plugin   | Event Type                          | Metadata                                       | Vault version |
-|----------|-------------------------------------|------------------------------------------------|---------------|
-| database | `database/config-delete`            | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/config-write`             | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/creds-create`             | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/reload`                   | `modified`, `operation`, `path`, `plugin_name` | 1.16          |
-| database | `database/reset`                    | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/role-create`              | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/role-delete`              | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/role-update`              | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/root-rotate-fail`         | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/root-rotate`              | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/rotate-fail`              | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/rotate`                   | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/static-creds-create-fail` | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/static-creds-create`      | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/static-role-create`       | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/static-role-delete`       | `modified`, `operation`, `path`, `name`        | 1.16          |
-| database | `database/static-role-update`       | `modified`, `operation`, `path`, `name`        | 1.16          |
-| kv       | `kv-v1/delete`                      | `modified`, `operation`, `path`                | 1.13          |
-| kv       | `kv-v1/write`                       | `data_path`, `modified`, `operation`, `path`   | 1.13          |
-| kv       | `kv-v2/config-write`                | `data_path`, `modified`, `operation`, `path`   | 1.13          |
-| kv       | `kv-v2/data-delete`                 | `modified`, `operation`, `path`                | 1.13          |
-| kv       | `kv-v2/data-patch`                  | `data_path`, `modified`, `operation`, `path`   | 1.13          |
-| kv       | `kv-v2/data-write`                  | `data_path`, `modified`, `operation`, `path`   | 1.13          |
-| kv       | `kv-v2/delete`                      | `modified`, `operation`, `path`                | 1.13          |
-| kv       | `kv-v2/destroy`                     | `modified`, `operation`, `path`                | 1.13          |
-| kv       | `kv-v2/metadata-delete`             | `modified`, `operation`, `path`                | 1.13          |
-| kv       | `kv-v2/metadata-patch`              | `data_path`, `modified`, `operation`, `path`   | 1.13          |
-| kv       | `kv-v2/metadata-write`              | `data_path`, `modified`, `operation`, `path`   | 1.13          |
-| kv       | `kv-v2/undelete`                    | `data_path`, `modified`, `operation`, `path`   | 1.13          |
-
-
-## Event notifications format
-
-Event notifications may be formatted in protobuf binary format or as JSON.
-See `EventReceived` in [`sdk/logical/event.proto`](https://github.com/hashicorp/vault/blob/main/sdk/logical/event.proto) in the relevant Vault version for the protobuf schema.
-
-When formatted as JSON, the event notification conforms to the [CloudEvents](https://cloudevents.io/) specification.
-
-- `id` `(string)` - CloudEvents unique identifier for the event notification. The `id` is unique for each event notification, and event notifications with the same `id` represent the same event notification.
-
-- `source` `(string)` - CloudEvents source, which is set to `vault://` followed by the Raft node ID or the hostname of the host that generated the event notification.
-
-- `specversion` `(string)` - The CloudEvents specification version this conforms to.
-
-- `type` `(string)` - CloudEvents type this event notification corresponds to, which is currently always `*`.
-
-- ` datacontenttype` `(string)` - CloudEvents content type of the event notification, which is currently always `application/json`.
-
-- `time` `(string)` - ISO 8601-formatted timestamp for when the event notificcation was generated.
-
-- ` data` `(object)` - Vault-specific data.
-
-  - `event` `(Event)` - contains the event notification that happened.
-
-    - `id` `(string)` - (repeat of the `id` parameter)
-
-    - `metadata` `(object)` - arbitrary extra data customized for the event type.
-
-  - `event_type` `(string)` - the event type that was published.
-
-  - `plugin_info` `(PluginInfo)` - information about the plugin that generated the event, if applicable.
-
-    - `mount_class` `(string)` - the class of plugin, e.g., `secret`, `auth`.
-
-    - `mount_accessor` `(string)` - the unique ID of the mounted plugin.
-
-    - `mount_path` `(string)` - the path that the plugin is mounted at.
-
-    - `plugin` `(string)` - the name of the plugin, e.g., `kv`.
-
-Here is an example event notification in JSON format:
-
-```json
-{
-  "id": "a3be9fb1-b514-519f-5b25-b6f144a8c1ce",
-  "source": "vault://mycluster",
-  "specversion": "1.0",
-  "type": "*",
-  "data": {
-    "event": {
-      "id": "a3be9fb1-b514-519f-5b25-b6f144a8c1ce",
-      "metadata": {
-        "current_version": "1",
-        "data_path": "secret/data/foo",
-        "modified": "true",
-        "oldest_version": "0",
-        "operation": "data-write",
-        "path": "secret/data/foo"
-      }
-    },
-    "event_type": "kv-v2/data-write",
-    "plugin_info": {
-      "mount_class": "secret",
-      "mount_accessor": "kv_5dc4d18e",
-      "mount_path": "secret/",
-      "plugin": "kv"
-    }
-  },
-  "datacontentype": "application/cloudevents",
-  "time": "2023-09-12T15:19:49.394915-07:00"
-}
-```
-
-## Subscribing to event notifications
-
-Vault has an API endpoint, `/v1/sys/events/subscribe/{eventType}`, that allows users to subscribe to event notifications via a
-WebSocket stream.
-This endpoint supports the standard authentication and authorization workflows used by other Vault endpoints.
-The `{eventType}` parameter is a non-empty string of what event type to subscribe to, which may contain wildcards (`*`)
-to subscribe to multiple event types, e.g., `kv-v2/data-*`.
-
-By default, the event notifications are delivered in protobuf binary format.
-The endpoint can also format the data as JSON if the `json` query parameter is set to `true`:
-
-```shell-session
-$ wscat -H "X-Vault-Token: $(vault print token)" --connect 'ws://127.0.0.1:8200/v1/sys/events/subscribe/kv-v2/data-write?json=true
-{"id":"a3be9fb1-b514-519f-5b25-b6f144a8c1ce","source":"vault://mycluster","specversion":"1.0","type":"*","data":{"event":{"id":"a3be9fb1-b514-519f-5b25-b6f144a8c1ce","metadata":{"current_version":"1","data_path":"secret/data/foo","modified":"true","oldest_version":"0","operation":"data-write","path":"secret/data/foo"}},"event_type":"kv-v2/data-write","plugin_info":{"mount_class":"secret","mount_accessor":"kv_5dc4d18e","mount_path":"secret/","plugin":"kv"}},"datacontentype":"application/cloudevents","time":"2023-09-12T15:19:49.394915-07:00"}
-...
-```
-
-The Vault CLI support this endpoint via the `events subscribe` command, which will output a stream of
-JSON for the requested event notifications (one line per event notification):
-
-```shell-session
-$ vault events subscribe kv-v2/data-write
-{"id":"a3be9fb1-b514-519f-5b25-b6f144a8c1ce","source":"vault://mycluster","specversion":"1.0","type":"*","data":{"event":{"id":"a3be9fb1-b514-519f-5b25-b6f144a8c1ce","metadata":{"current_version":"1","data_path":"secret/data/foo","modified":"true","oldest_version":"0","operation":"data-write","path":"secret/data/foo"}},"event_type":"kv-v2/data-write","plugin_info":{"mount_class":"secret","mount_accessor":"kv_5dc4d18e","mount_path":"secret/","plugin":"kv"}},"datacontentype":"application/cloudevents","time":"2023-09-12T15:19:49.394915-07:00"}
-...
-```
-
-## Policies
-
-To subscribe to an event notification, you must have the following policy grants:
-
-1. `read` capability on `/v1/sys/events/subscribe/{eventType}`, where `{eventType}` is the event type that will be
-   subscribed to. The path may contain wildcards.
-
-   An example blanket policy is:
-   ```hcl
-   path "sys/events/subscribe/*" {
-       capabilities = ["read"]
-   }
-   ```
-
-2. `list` and `subscribe` capabilities on the *path of the secret* for events
-    related to secrets. The policy must also provide a `subscribe_event_types`
-    entry with the specific event notifications subscribers are allowed to use. For example,
-    to receive event notifications related to the KV secrets engine path,
-     `secret/my-data`, a valid policy would be:
-
-   ```hcl
-   path "secret/my-data" {
-     capabilities = ["list", "subscribe"]
-     subscribe_event_types = ["*"]
-   }
-   ```
-
-Vault continuously evaluates policies for WebSocket subscriptions and
-caches the results for a short period of time to improve performance.
-As a result, event notifications **may** still be sent for a few minutes after a token is
-revoked or a policy is deleted.
-
-## Supported versions
-
-| Version | Support                                     |
-|---------|---------------------------------------------|
-| <= 1.12 | Not supported                               |
-| 1.13    | Supported; **disabled** by default          |
-| 1.14    | Supported; **disabled** by default          |
-| 1.15    | Supported (beta); **enabled** by default    |
-| 1.16+   | Generally available; **enabled** by default |
-
-For versions where event notifications are disabled by default, you can enable the
-functionality with the `events.alpha1`
-[experiment option](/vault/docs/configuration#experiments) in your Vault
-configuration or from the command line with the `-experiments` flag. For example:
-
-```shell-session
-$ vault server -experiment events.alpha1
-```
diff --git a/website/content/docs/concepts/filtering/audit.mdx b/website/content/docs/concepts/filtering/audit.mdx
deleted file mode 100644
index c1c8c139c53..00000000000
--- a/website/content/docs/concepts/filtering/audit.mdx
+++ /dev/null
@@ -1,165 +0,0 @@
----
-layout: docs
-page_title: Audit Filtering
-description: |-
-  How to filter audit entries in Vault.
----
-
-[filter syntax]: /vault/docs/concepts/filtering
-
-# Filtering audit entries
-
-This page describes how to use filters with Vault audit devices to fine tune which
-audit entries should be written to an audit log.
-
-Starting in Vault 1.16.0, audit devices can be enabled with a `filter` option, which
-is used to evaluate audit entries and determine if they should be written to a particular
-audit log. Please ensure you are familiar with the [filtering concept](/vault/docs/concepts/filtering) before
-attempting to configure an audit device with a filter.
-
-Audit devices with and without filtering configured will all function simultaneously
-in Vault. Using a filtered audit device does not restrict Operators from *only* using
-the filter and fallback type devices described on this page.
-
-<Note title="Advanced audit feature">
-  The use of filtering in Vault's audit system should be considered an advanced feature.
-  Whilst it has been designed to be simple and flexible, exclusively enabling filtered
-  devices without a fallback configured could result in some requests and responses that are not audited.
-</Note>
-
-Please see the [Vault security model](/vault/docs/internals/security) for further
-information about how all requests and responses to Vault are usually audited.
-
-
-## `filter` option
-
-All audit device types ([file](/vault/docs/audit/file), [socket](/vault/docs/audit/socket)
-and [syslog](/vault/docs/audit/syslog)) support the `filter` option at the time they
-are enabled. After successfully enabling a device with a filter, every audit entry
-that Vault sends to that audit device will be compared to the expression in the filter.
-Only audit entries that match the filter will be written to the device's audit log.
-
-### Valid `filter` properties
-
-Filters can **only** reference the following properties of an audit entry:
-
-* `mount_point` - Path to the mount (e.g. [auth method](/vault/docs/auth), [secret engine](/vault/docs/secrets)),
-including namespaces.
-* `mount_type` - Type of mount being interacted with.
-* `namespace` - [Namespace](/vault/docs/enterprise/namespaces) 'path' that the request is taking place within.
-* `operation` - [Operation](/vault/docs/glossary#operation) being performed.
-* `path` - Full path of the request.
-
-### Example filters
-
-The following are examples that could be supplied as a `filter` value.
-
-| Purpose                                                                                | Filter                                  |
-|----------------------------------------------------------------------------------------|-----------------------------------------|
-| Only persist audit entries for requests within `ns1`                                   | `namespace == ns1`                      |
-| Only persist audit entries for requests that are **not** in the root namespace         | `namespace != \"\"`                     |
-| Only persist audit entries that interact with `kv` engines                             | `mount_type == kv`                      |
-| Only persist audit entries that attempt to perform `read` operations                   | `operation == read`                     |
-| Only persist audit entries for requests that interact with `kv` within namespace `ns2` | `namespace == ns2 and mount_type == kv` |
-
-### Scenario: `kv` only
-
-A Vault Operator wants only `kv` type audit entries to be written to an audit log for a particular device.
-
-1. Enable an audit device with the following filter option:
-
-    ```
-    vault audit enable -path kv-only file file_path=/var/audit.log filter="mount_type == kv"
-    ```
-
-2. List the enabled audit devices:
-
-    ```
-    vault audit list --detailed
-    ```
-
-3. Enable a `kv` secrets engine:
-
-    ```
-    vault secrets enable -path my-kv kv-v2
-    ```
-
-4. Write secret data to the `kv` engine:
-
-    ```
-    vault kv put my-kv foo=bar
-    ```
-
-5. Disable the audit device:
-
-    ```
-    vault audit disable -path kv-only
-    ```
-
-The steps above performed a number of actions against Vault that generate audit entries.
-However, only two of them had a `mount_type` of `kv` (steps 3 and 4).
-
-Viewing the contents of the file audit log at `/var/audit.log` will show that only audit
-entries related to steps 3 and 4, with a request and response audit entry for each.
-
-### Test message
-
-When enabling an audit device, Vault will (by default) attempt to send a test message
-to the device. In cases where filtering is configured on a device, it may be possible
-for the evaluation of the filter to result in the test message failing to meet the specified
-predicate expression, and therefore not being written to the audit device's sink. This test
-message will always be present in `fallback` devices (described below).
-
-The properties of the test message are as follows:
-
-* `mount_point` - not present
-* `mount_type` - not present.
-* `namespace` - not present.
-* `operation` - `update`.
-* `path` - `sys/audit/test`.
-
-Vault Operators should use this when trying to understand when they should or
-should not expect a test message to appear in the sink for a newly enabled audit device.
-
-## Fallback device
-
-The ability to filter audit entries can provide great flexibility to your workflows,
-however the additional complexity can make it possible for a Vault Operator to configure their
-audit devices in such a way that some audit entries are missed out from audit logs entirely.
-Therefore, we strongly encourage you to test out audit configurations in your non-production
-environments before deploying them to production.
-
-The `fallback` audit device is the (non-mandatory) mechanism by which Vault can
-continue to adhere to Vault's [security model](/vault/docs/internals/security),
-that all requests and responses are successfully logged before the client receives
-any secret material.
-
-When exclusively using filtered audit devices, enable the fallback audit device to
-catch any audit entries that would otherwise be missed.
-
-This means Vault is able to provide the same guarantee that 'at least one device must
-successfully write an audit entry' as when only standard/non-filtered audit devices
-are enabled.
-
-<Note title="Single fallback device">
-  Vault supports enabling only a single fallback audit device.
-</Note>
-
-#### Enabling the fallback audit device
-
-[Enabling the fallback audit device](/vault/docs/audit#fallback) requires supplying the `fallback` option:
-
-```shell-session
-vault audit enable -path=my-fallback -description="fallback device" file file_path=/tmp/audit.fallback.log fallback=true
-```
-
-### Metrics
-
-When the fallback device is enabled, and required to persist an audit entry to the audit log,
-Vault will emit a [fallback 'success' metric](/vault/docs/internals/telemetry/metrics/audit#vault-audit-fallback-success) on
-a successful write to the audit log.
-
-If audit devices are enabled that make use of filtering, but no fallback audit device
-has been enabled, Vault will produce a [fallback 'miss' metric](/vault/docs/internals/telemetry/metrics/audit#vault-audit-fallback-miss)
-as a way to allow Operators to understand how many auditable Vault entries are not
-being persisted to their audit logs.
diff --git a/website/content/docs/concepts/filtering/index.mdx b/website/content/docs/concepts/filtering/index.mdx
deleted file mode 100644
index d335757631d..00000000000
--- a/website/content/docs/concepts/filtering/index.mdx
+++ /dev/null
@@ -1,179 +0,0 @@
----
-layout: docs
-page_title: Filtering
-description: >-
-  An introduction to the filtering syntax used in Vault.
----
-
-# Filter expressions in Vault
-
-Filter expressions use matching operators and selector values to parse
-out important or relevant information. In some situations, you can use filter
-expressions to control how Vault processes results.
-
-## Filter expression syntax
-
-Basic filter expressions are always written in plain text with a
-**matching operator**, a **selector**, and a **selector value**.
-
-- the **matching operator** tells Vault how to compare the selector and selector
-  value.
-- the **selector** is a [JSON pointer](https://tools.ietf.org/html/rfc6901) that
-  indicates which field or parameter in a JSON object to consider.
-- the **selector value** is a JSON pointer, number, or string that defines a
-  pattern Vault can filter against.
-
-For example, in the filter expression:
-
-```text
-product/name == "Vault"
-```
-
-- Equality (`==`) is the matching operator.
-- The JSON pointer `product/name` is the selector.
-- The string "Vault" is the selector value.
-
-Complex filter expressions also allow Boolean logic and parenthesis. For example:
-
-```text
-(product/name == "Vault") and (timestamp < "2024-02-01")
-```
-
-When parsing filter expressions, Vault ignores whitespace unless the whitespace
-is part of a literal string.
-
-Filter expression
-`product/name=="Vault"` and `product/name == "Vault"` generate the same results
-while `product/name == " Vault "` and `product/name == "Vault"` generate
-different results.
-
-<Note title="Selectors are not universal">
-
-  Filtering-enabled endpoints can support different selectors. Make sure to
-  consult the API documentation for a given endpoint when constructing your
-  filter expressions.
-
-</Note>
-<Tabs>
-
-<Tab heading="Matching operators">
-
-
-
-```text
-// Equality & Inequality checks
-<Selector> == "<Value>"
-<Selector> != "<Value>"
-
-// Emptiness checks
-<Selector> is empty
-<Selector> is not empty
-
-// Contains checks or Substring Matching
-"<Value>" in <Selector>
-"<Value>" not in <Selector>
-<Selector> contains "<Value>"
-<Selector> not contains "<Value>"
-
-// Regular Expression Matching
-<Selector> matches "<Value>"
-<Selector> not matches "<Value>"
-```
-
-</Tab>
-
-<Tab heading="Selectors">
-
-
-Selectors must be valid JSON pointers enclosed in quotes with a leading slash (`/`).
-
-
-JSON pointers use forward slashes to define paths through a JSON block. For
-example, to target the product name in:
-
-```json
-{ "product":
-  {
-    "name": "Vault",
-    "version": "1.16.0"
-  },
-  {
-    "name": "Boundary",
-    "version": "0.15.0"
-  }
-}
-
-```
-
-The selector would be `/product/name`.
-
-
-</Tab>
-
-<Tab heading="Selector values">
-
-
-Selector values can be any valid selector, integer, floating point number, or
-string. Numbers and strings should be quoted in double quotes or backticks.
-
-Strings quoted in backticks are treated as literal values and escape sequences
-like `\n` are not expanded.
-
-| Value             | Type    | Expanded value    |
-|-------------------|---------|-------------------|
-| "Vault\tBoundary" | string  | "Vault	Boundary" |
-| `Vault\tBoundary` | string  | "Vault\tBoundary" |
-| "10"              | integer | "10"              |
-| `10`              | integer | "10"              |
-| "0.75"            | float   | "0.75"            |
-
-
-</Tab>
-
-</Tabs>
-
-## Complex expressions
-
-Complex expressions combine basic expressions with logical operators, grouping, and matching expressions.
-
-```text
-// Logical Or - evaluates to true if either sub-expression does
-<Expression 1> or <Expression 2>
-
-// Logical And - evaluates to true if both sub-expressions do
-<Expression 1 > and <Expression 2>
-
-// Logical Not - evaluates to true if the sub-expression does not
-not <Expression 1>
-
-// Grouping - Overrides normal precedence rules
-( <Expression 1> )
-
-// Inspects data to check for a match
-<Matching Expression 1>
-```
-
-Vault uses standard operator precedence when resolving complex
-expressions. For example, the expression
-`<Expression 1> and not <Expression 2> or <Expression 3>` resolves
-the same as
-`( <Expression 1> and (not <Expression 2> )) or <Expression 3>`.
-
-
-## Performance
-
-Filters consume a portion of CPU time on the Vault node where they run.
-
-<Note title="Regular expressions">
-  Using multiple/complex expressions including regular expressions
-  (regex) will have a larger impact on performance than fewer/simpler filters.
-</Note>
-
-Always test your filters in pre-production environments to ensure correctness.
-
-Ideally you should [codify your management of Vault](/vault/tutorials/operations/codify-mgmt-vault-terraform)
-using tools such as [Terraform](https://www.terraform.io/), to prevent accidentally enabling an audit device
-in a production environment with untested/incorrect settings.
-
-Finally, always ensure you profile production-like workloads within your pre-production
-environments in order to accurately assess the performance of Vault.
diff --git a/website/content/docs/concepts/ha.mdx b/website/content/docs/concepts/ha.mdx
deleted file mode 100644
index a67b92665af..00000000000
--- a/website/content/docs/concepts/ha.mdx
+++ /dev/null
@@ -1,183 +0,0 @@
----
-layout: docs
-page_title: High Availability
-description: >-
-  Vault can be highly available, allowing you to run multiple Vaults to protect
-  against outages.
----
-
-# High availability mode (HA)
-
-Vault supports a multi-server mode for high availability. This mode protects
-against outages by running multiple Vault servers. High availability mode
-is automatically enabled when using a data store that supports it.
-
-You can tell if a data store supports high availability mode ("HA") by starting
-the server and seeing if "(HA available)" is output next to the data store
-information. If it is, then Vault will automatically use HA mode. This
-information is also available on the
-[Configuration](/vault/docs/configuration) page.
-
-To be highly available, one of the Vault server nodes grabs a lock within the
-data store. The successful server node then becomes the active node; all other
-nodes become standby nodes. At this point, if the standby nodes receive a
-request, they will either [forward the request](#request-forwarding) or
-[redirect the client](#client-redirection) depending on the current
-configuration and state of the cluster -- see the sections below for details.
-Due to this architecture, HA does not enable increased scalability. In general,
-the bottleneck of Vault is the data store itself, not Vault core. For example:
-to increase the scalability of Vault with Consul, you would generally scale
-Consul instead of Vault.
-
-Certain storage backends can support high availability mode, which enable them
-to store both Vault's information in addition to the HA lock. However, Vault
-also supports split data/HA mode, whereby the lock value and the rest of the
-data live separately. This can be done by specifying both the
-[`storage`](/vault/docs/configuration#storage) and
-[`ha_storage`](/vault/docs/configuration#ha_storage) stanzas in the configuration file
-with different backends. For instance, a Vault cluster can be set up to use
-Consul as the [`ha_storage`](/vault/docs/configuration#ha_storage) to manage the lock,
-and use Amazon S3 as the [`storage`](/vault/docs/configuration#storage) for all other
-persisted data.
-
-The sections below explain the server communication patterns and each type of
-request handling in more detail. At a minimum, the requirements for redirection
-mode must be met for an HA cluster to work successfully.
-
-## Server-to-Server communication
-
-Both methods of request handling rely on the active node advertising
-information about itself to the other nodes. Rather than over the network, this
-communication takes place within Vault's encrypted storage; the active node
-writes this information and unsealed standby Vault nodes can read it.
-
-For the client redirection method, this is the extent of server-to-server
-communication -- no direct communication with only encrypted entries in the
-data store used to transfer state.
-
-For the request forwarding method, the servers need direct communication with
-each other. In order to perform this securely, the active node also advertises,
-via the encrypted data store entry, a newly-generated private key (ECDSA-P521)
-and a newly-generated self-signed certificate designated for client and server
-authentication. Each standby uses the private key and certificate to open a
-mutually-authenticated TLS 1.2 connection to the active node via the advertised
-cluster address. When client requests come in, the requests are serialized,
-sent over this TLS-protected communication channel, and acted upon by the
-active node. The active node then returns a response to the standby, which
-sends the response back to the requesting client.
-
-## Request forwarding
-
-If request forwarding is enabled (turned on by default in 0.6.2), clients can
-still force the older/fallback redirection behavior (see below) if desired by
-setting the `X-Vault-No-Request-Forwarding` header to any non-empty value.
-
-Successful cluster setup requires a few configuration parameters, although some
-can be automatically determined.
-
-## Client redirection
-
-If `X-Vault-No-Request-Forwarding` header in the request is set to a non-empty
-value, the standby nodes will redirect the client using a `307` status code to
-the _active node's_ redirect address.
-
-This is also the fallback method used when request forwarding is turned off or
-there is an error performing the forwarding. As such, a redirect address is
-always required for all HA setups.
-
-Some HA data store drivers can autodetect the redirect address, but it is often
-necessary to configure it manually via a top-level value in the configuration
-file. The key for this value is [`api_addr`](/vault/docs/configuration#api_addr) and
-the value can also be specified by the `VAULT_API_ADDR` environment variable,
-which takes precedence.
-
-What the [`api_addr`](/vault/docs/configuration#api_addr) value should be set to
-depends on how Vault is set up. There are two common scenarios: Vault servers
-accessed directly by clients, and Vault servers accessed via a load balancer.
-
-In both cases, the [`api_addr`](/vault/docs/configuration#api_addr) should be a full
-URL including scheme (`http`/`https`), not simply an IP address and port.
-
-### Direct access
-
-When clients are able to access Vault directly, the
-[`api_addr`](/vault/docs/configuration#api_addr) for each node should be that node's
-address. For instance, if there are two Vault nodes:
-
-- `A`, accessed via `https://a.vault.mycompany.com:8200`
-- `B`, accessed via `https://b.vault.mycompany.com:8200`
-
-Then node `A` would set its
-[`api_addr`](/vault/docs/configuration#api_addr) to
-`https://a.vault.mycompany.com:8200` and node `B` would set its
-[`api_addr`](/vault/docs/configuration#api_addr) to
-`https://b.vault.mycompany.com:8200`.
-
-This way, when `A` is the active node, any requests received by node `B` will
-cause it to redirect the client to node `A`'s
-[`api_addr`](/vault/docs/configuration#api_addr) at `https://a.vault.mycompany.com`,
-and vice-versa.
-
-### Behind load balancers
-
-Sometimes clients use load balancers as an initial method to access one of the
-Vault servers, but actually have direct access to each Vault node. In this
-case, the Vault servers should actually be set up as described in the above
-section, since for redirection purposes the clients have direct access.
-
-However, if the only access to the Vault servers is via the load balancer, the
-[`api_addr`](/vault/docs/configuration#api_addr) on each node should be the same: the
-address of the load balancer. Clients that reach a standby node will be
-redirected back to the load balancer; at that point hopefully the load
-balancer's configuration will have been updated to know the address of the
-current leader. This can cause a redirect loop and as such is not a recommended
-setup when it can be avoided.
-
-### Per-Node cluster listener addresses
-
-Each [`listener`](/vault/docs/configuration/listener) block in Vault's configuration
-file contains an [`address`](/vault/docs/configuration/listener/tcp#address) value on
-which Vault listens for requests. Similarly, each
-[`listener`](/vault/docs/configuration/listener) block can contain a
-[`cluster_address`](/vault/docs/configuration/listener/tcp#cluster_address) on which
-Vault listens for server-to-server cluster requests. If this value is not set,
-its IP address will be automatically set to same as the
-[`address`](/vault/docs/configuration/listener/tcp#address) value, and its port will
-be automatically set to the same as the
-[`address`](/vault/docs/configuration/listener/tcp#address) value plus one (so by
-default, port `8201`).
-
-Note that _only_ active nodes have active listeners. When a node becomes active
-it will start cluster listeners, and when it becomes standby it will stop them.
-
-### Per-Node cluster address
-
-Similar to the [`api_addr`](/vault/docs/configuration#api_addr),
-[`cluster_addr`](/vault/docs/configuration#cluster_addr) is the value that each node,
-if active, should advertise to the standbys to use for server-to-server
-communications, and lives as a top-level value in the configuration file. On
-each node, this should be set to a host name or IP address that a standby can
-use to reach one of that node's
-[`cluster_address`](/vault/docs/configuration#cluster_address) values set in the
-[`listener`](/vault/docs/configuration/listener) blocks, including port. (Note that
-this will always be forced to `https` since only TLS connections are used
-between servers.)
-
-This value can also be specified by the `VAULT_CLUSTER_ADDR` environment
-variable, which takes precedence.
-
-## Storage support
-
-Currently there are several storage backends that support high availability
-mode, including [Consul](/vault/docs/configuration/storage/consul),
-[ZooKeeper](/vault/docs/configuration/storage/zookeeper) and [etcd](/vault/docs/configuration/storage/etcd). These may
-change over time, and the [configuration page](/vault/docs/configuration) should be
-referenced.
-
-HashiCorp recommends [Vault Integrated Storage](/vault/docs/configuration/storage/raft) as the default HA backend for new deployments of Vault. [Consul Storage Backend](/vault/docs/configuration/storage/consul) is also a supported option and used by many production deployments. See the [comparison chart](/vault/docs/configuration/storage#integrated-storage-vs-consul-as-vault-storage) for help deciding which option is best for you.
-
-If you're interested in implementing another backend or adding HA support to
-another backend, we'd love your contributions. Adding HA support requires
-implementing the
-[`physical.HABackend`](https://pkg.go.dev/github.com/hashicorp/vault/sdk/physical#HABackend)
-interface for the storage backend.
diff --git a/website/content/docs/concepts/identity.mdx b/website/content/docs/concepts/identity.mdx
deleted file mode 100644
index 8ecb9c015a8..00000000000
--- a/website/content/docs/concepts/identity.mdx
+++ /dev/null
@@ -1,201 +0,0 @@
----
-layout: docs
-page_title: 'Identity'
-description: >-
-  Vault provides an identity management solution to maintain clients who are recognized by Vault.
----
-
-# Identity
-
-This document contains conceptual information about **Identity** along with an
-overview of the various terminologies and their concepts. The idea of Identity
-is to maintain the clients who are recognized by Vault. As such, Vault provides
-an identity management solution through the **Identity secrets engine**. For
-more information about the Identity secrets engine and how it is used, refer to
-the [Identity Secrets Engine](/vault/docs/secrets/identity) documentation.
-
-## Entities and aliases
-
-Each user may have multiple accounts with various identity providers, and Vault
-supports many of those providers to authenticate with Vault. Vault Identity can
-tie authentications from various auth methods to a single representation. This representation of a consolidated identity is called an **Entity** and their
-corresponding accounts with authentication providers can be mapped as
-**Aliases**. In essence, each entity is made up of zero or more aliases. An entity cannot have more than one alias for
-a particular authentication backend.
-
-For example, a user with accounts in both GitHub and LDAP can be mapped to a
-single entity in Vault with two aliases, one of type GitHub and one of type
-LDAP.
-
-![Entity  overview](/img/vault-identity-doc-1.png)
-
-However, if both aliases are created on the same auth mount, such as
-a Github mount, both aliases cannot be mapped to the same entity. The aliases can
-have the same auth type, as long as the auth mounts are different, and
-still be associated to the same entity. The diagrams below illustrate both valid
-and invalid scenarios.
-
-![Valid Alias Mapping](/img/vault-identity-doc-4.png)
-![Invalid Alias Mapping](/img/vault-identity-doc-5.png)
-
-When a client authenticates via any credential backend (except the Token
-backend), Vault creates a new entity. It attaches a new alias to it if a
-corresponding entity does not already exist. The entity identifier will be tied
-to the authenticated token. When such tokens are used, their entity identifiers
-are audit logged, marking a trail of actions performed by specific users.
-
-~> Vault Entity is used to count the number of Vault clients. To learn more
-about client count, refer to the [Client Count](/vault/docs/concepts/client-count)
-documentation.
-
-## Entity management
-
-Entities in Vault **do not** automatically pull identity information from
-anywhere. It needs to be explicitly managed by operators. This way, it is
-flexible in terms of administratively controlling the number of entities to be
-synced against Vault. In some sense, Vault will serve as a _cache_ of
-identities and not as a _source_ of identities.
-
-## Entity policies
-
-Vault policies can be assigned to entities which will grant _additional_
-permissions to the token on top of the existing policies on the token. If the
-token presented on the API request contains an identifier for the entity and if
-that entity has a set of policies on it, then the token will be capable of
-performing actions allowed by the policies on the entity as well.
-
-![Entity policies](/img/vault-identity-doc-2.png)
-
-This is a paradigm shift in terms of _when_ the policies of the token get
-evaluated. Before identity, the policy names on the token were immutable (not
-the contents of those policies though). But with entity policies, along with
-the immutable set of policy names on the token, the evaluation of policies
-applicable to the token through its identity will happen at request time. This
-also adds enormous flexibility to control the behavior of already issued
-tokens.
-
-It is important to note that the policies on the entity are only a means to grant
-_additional_ capabilities and not a replacement for the policies on the token.
-To know the full set of capabilities of the token with an associated entity
-identifier, the policies on the token should be taken into account.
-
-~> **NOTE:** Be careful in granting permissions to non-readonly identity endpoints.
-If a user can modify an entity, they can grant it additional privileges through
-policies. If a user can modify an alias they can login with, they can bind it to
-an entity with higher privileges. If a user can modify group membership, they
-can add their entity to a group with higher privileges.
-
-## Mount bound aliases
-
-Vault supports multiple authentication backends and also allows enabling the
-same type of authentication backend on different mount paths. The alias name of
-the user will be unique within the backend's mount. But identity store needs to
-uniquely distinguish between conflicting alias names across different mounts of
-these identity providers. Hence, the alias name in combination with the
-authentication backend mount's accessor, serve as the unique identifier of an
-alias.
-
-The table below shows what information each of the supported auth methods uses
-to form the alias name. This is the identifying information that is used to match or create
-an entity. If no entities are explicitly created or merged, then one [entity will be implicitly created](#implicit-entities)
-for each object on the right-hand side of the table, when it is used to authenticate on
-a particular auth mount point.
-
-| Auth method         | Name reported by auth method                                                                        |
-| ------------------- | --------------------------------------------------------------------------------------------------- |
-| AliCloud            | Principal ID                                                                                        |
-| AppRole             | Role ID                                                                                             |
-| AWS IAM             | Configurable via `iam_alias` to one of: Role ID (default), IAM unique ID, Full ARN                  |
-| AWS EC2             | Configurable via `ec2_alias` to one of: Role ID (default), EC2 instance ID, AMI ID                  |
-| Azure               | Subject (from JWT claim)                                                                            |
-| Cloud Foundry       | App ID                                                                                              |
-| GitHub              | User login name associated with token                                                               |
-| Google Cloud        | Configurable via `iam_alias` to one of: Role ID (default), Service account unique ID                |
-| JWT/OIDC            | Configurable via `user_claim` to one of the presented claims (no default value)                     |
-| Kerberos            | Username                                                                                            |
-| Kubernetes          | Configurable via `alias_name_source` to one of: Service account UID (default), Service account name |
-| LDAP                | Username                                                                                            |
-| OCI                 | Role name                                                                                           |
-| Okta                | Username                                                                                            |
-| RADIUS              | Username                                                                                            |
-| TLS Certificate     | Subject CommonName                                                                                  |
-| Token               | `entity_alias`, if provided                                                                         |
-| Username (userpass) | Username                                                                                            |
-
-## Local auth methods
-
-**Vault Enterprise:** All the auth methods will generate an entity by default
-when a token is being issued, with the exception of token store. This is applicable
-for both mounts that are shared between clusters and cluster local auth mounts (using `local=true`)
-when Vault replication is in use.
-If the goal of marking an auth method as `local` was to comply to GDPR guidelines,
-then care must be taken to not set the data pertaining to local auth mount or local auth
-mount aliases in the metadata of the associated entity.
-
-## Implicit entities
-
-Operators can create entities for all the users of an auth mount beforehand and
-assign policies to them, so that when users login, the desired capabilities to
-the tokens via entities are already assigned. But if that's not done, upon a
-successful user login from any of the authentication backends, Vault will
-create a new entity and assign an alias against the login that was successful.
-
-Note that the tokens created using the token authentication backend will not
-normally have any associated identity information. An existing or new implicit
-entity can be assigned by using the `entity_alias` parameter, when creating a
-token using a token role with a configured list of `allowed_entity_aliases`.
-
-## Identity auditing
-
-If the token used to make API calls has an associated entity identifier, it
-will be audit logged as well. This leaves a trail of actions performed by
-specific users.
-
-## Identity groups
-
-Vault identity has support for **groups**. A group can contain multiple entities
-as its members. A group can also have subgroups. Policies set on the group are
-granted to all members of the group. During request time, when the token's
-entity ID is being evaluated for the policies that it has access to, policies
-that are inherited due to group memberships are granted along with the policies
-on the entity itself.
-
-![Identity overview](/img/vault-identity-doc-3.png)
-
-## Group hierarchical permissions
-
-Entities can be direct members of groups, in which case they inherit the
-policies of the groups they belong to. Entities can also be indirect members of
-groups. For example, if a GroupA has GroupB as subgroup, then members of GroupB
-are indirect members of GroupA. Hence, the members of GroupB will have access
-to policies on both GroupA and GroupB.
-
-## External vs internal groups
-
-By default, the groups created in identity store are called **internal groups**.
-The membership management of these groups should be carried out
-manually.
-
-A group can also be created as an **external group**. In this case, the
-entity membership in the group is managed semi-automatically. An external group
-serves as a mapping to a group that is outside of the identity store. External
-groups can have one (and only one) alias. This alias should map to a notion of
-a group that is outside of the identity store.
-
-For example, groups in LDAP and teams in GitHub.
-A username in LDAP belonging to a group in LDAP can get its
-entity ID added as a member of a group in Vault automatically during _logins_
-and _token renewals_. This works only if the group in Vault is an external
-group and has an alias that maps to the group in LDAP.
-
-~> **NOTE:** If the user is removed from the group in LDAP, the user will
-not immediately be removed from the external group in Vault. The group
-membership change will be reflected in Vault only upon the
-subsequent **login** or **renewal** operation.
-
-For information about Identity Secrets Engine, refer to [Identity Secrets Engine](/vault/docs/secrets/identity).
-
-## Tutorial
-
-Refer to the [Identity: Entities and
-Groups](/vault/tutorials/auth-methods/identity) tutorial to learn how Vault supports mutliple authentication methods and enables the same authentication method to be used with different mount paths.
diff --git a/website/content/docs/concepts/index.mdx b/website/content/docs/concepts/index.mdx
deleted file mode 100644
index 70c6ab2f421..00000000000
--- a/website/content/docs/concepts/index.mdx
+++ /dev/null
@@ -1,13 +0,0 @@
----
-layout: docs
-page_title: Concepts
-description: Concepts that are important to understand for Vault usage.
----
-
-# Concepts
-
-This section covers some concepts that are important to understand for day to
-day Vault usage and operation. Every page in this section is recommended
-reading for anyone consuming or operating Vault.
-
-Please use the navigation to the left to learn more about a topic.
diff --git a/website/content/docs/concepts/integrated-storage/autopilot.mdx b/website/content/docs/concepts/integrated-storage/autopilot.mdx
deleted file mode 100644
index 18cd10b0d7a..00000000000
--- a/website/content/docs/concepts/integrated-storage/autopilot.mdx
+++ /dev/null
@@ -1,127 +0,0 @@
----
-layout: docs
-page_title: Integrated Storage Autopilot
-description: Learn about the autopilot subsystem of integrated raft storage in Vault.
----
-
-# Autopilot
-
-Autopilot enables automated workflows for managing Raft clusters. The current
-feature set includes 3 main features: Server Stabilization, Dead Server Cleanup
-and State API. These three features were introduced in Vault 1.7. The Enterprise
-feature set includes 2 main features: Automated Upgrades and Redundancy Zones.
-These two features were introduced in Vault 1.11.
-
-## Server stabilization
-
-Server stabilization helps to retain the stability of the Raft cluster by safely
-joining new voting nodes to the cluster. When a new voter node is joined to an
-existing cluster, autopilot adds it as a non-voter instead, and waits for a
-pre-configured amount of time to monitor it's health. If the node remains to be
-healthy for the entire duration of stabilization, then that node will be
-promoted as a voter. The server stabilization period can be tuned using
-`server_stabilization_time` (see below).
-
-## Dead server cleanup
-
-Dead server cleanup automatically removes nodes deemed unhealthy from the
-Raft cluster, avoiding the manual operator intervention. This feature can be
-tuned using the `cleanup_dead_servers`, `dead_server_last_contact_threshold`,
-and `min_quorum` (see below).
-
-## State API
-
-State API provides detailed information about all the nodes in the Raft cluster
-in a single call. This API can be used for monitoring for cluster health.
-
-### Follower health
-
-Follower node health is determined by 2 factors.
-
-- Its ability to heartbeat to leader node at regular intervals. Tuned using
-  `last_contact_threshold` (see below).
-- Its ability to keep up with data replication from the leader node. Tuned using
-  `max_trailing_logs` (see below).
-
-### Default configuration
-
-By default, Autopilot will be enabled with clusters using Vault 1.7+,
-although dead server cleanup is not enabled by default. Upgrade of
-Raft clusters deployed with older versions of Vault will also transition to use
-Autopilot automatically.
-
-Autopilot exposes a [configuration
-API](/vault/api-docs/system/storage/raftautopilot#set-configuration) to manage its
-behavior. Autopilot gets initialized with the following default values. If these default values do not meet your expected autopilot behavior, don't forget to set them to your desired values.
-
-- `cleanup_dead_servers` - `false`
-  - This controls whether to remove dead servers from
-    the Raft peer list periodically or when a new server joins. This requires that
-    `min-quorum` is also set.
-
-- `dead_server_last_contact_threshold` - `24h`
-  - Limit on the amount of time
-    a server can go without leader contact before being considered failed. This
-    takes effect only when `cleanup_dead_servers` is set.
-
-- `min_quorum` - This doesn't default to anything and should be set to the expected
-  number of voters in your cluster when `cleanup_dead_servers` is set as `true`.
-  - Minimum number of servers that should always be present in a cluster.
-  Autopilot will not prune servers below this number.
-
-- `max_trailing_logs` - `1000`
-  - Amount of entries in the Raft Log that a server
-    can be behind before being considered unhealthy.
-
-- `last_contact_threshold` - `10s`
-  - Limit on the amount of time a server can go without leader contact before being considered unhealthy.
-
-- `server_stabilization_time` - `10s`
-  - Minimum amount of time a server must be in a healthy state before it can become a voter. Until that happens,
-    it will be visible as a peer in the cluster, but as a non-voter, meaning it won't contribute to quorum.
-
-- `disable_upgrade_migration` - `false`
-  - Controls whether to disable automated upgrade migrations, an Enterprise-only feature.
-
-~> **Note**: Autopilot in Vault does similar things to what autopilot does in
-[Consul](https://www.consul.io/). However, the configuration in these 2 systems
-differ in terms of default values and thresholds; some additional parameters
-might also show up in Vault in comparison to Consul as well. Autopilot in Vault
-and Consul use different technical underpinnings requiring these differences, to
-provide the autopilot functionality.
-
-## Automated upgrades
-
-Automated Upgrades lets you automatically upgrade a cluster of Vault nodes to a new version as
-updated server nodes join the cluster. Once the number of nodes on the new version is
-equal to or greater than the number of nodes on the old version, Autopilot will promote
-the newer versioned nodes to voters, demote the older versioned nodes to non-voters,
-and initiate a leadership transfer from the older version leader to one of the newer
-versioned nodes. After the leadership transfer completes, the older versioned non-voting
-nodes can be removed from the cluster.
-
-## Redundancy zones
-
-Redundancy Zones provide both scaling and resiliency benefits by deploying non-voting
-nodes alongside voting nodes on a per availability zone basis. When using redundancy zones,
-each zone will have exactly one voting node and as many additional non-voting nodes as desired.
-If the voting node in a zone fails, a non-voting node will be automatically promoted to
-voter. If an entire zone is lost, a non-voting node from another zone will be promoted to voter,
-maintaining quorum. These non-voting nodes function not only as hot standbys, but also
-increase read scalability.
-
-## Replication
-
-DR secondary and Performance secondary clusters have their own Autopilot configurations, managed
-independently of their primary.
-
-The [Autopilot API](/vault/api-docs/system/storage/raftautopilot) uses DR operation tokens for
-authorization when executed against a DR secondary cluster.
-
-## Tutorial
-
-Refer to the following tutorials to learn more.
-
-- [Integrated Storage Autopilot](/vault/tutorials/raft/raft-autopilot)
-- [Fault Tolerance with Redundancy Zones](/vault/tutorials/raft/raft-redundancy-zones)
-- [Automate Upgrades with Vault Enterprise](/vault/tutorials/raft/raft-upgrade-automation)
diff --git a/website/content/docs/concepts/integrated-storage/index.mdx b/website/content/docs/concepts/integrated-storage/index.mdx
deleted file mode 100644
index 6e1d8c79ca0..00000000000
--- a/website/content/docs/concepts/integrated-storage/index.mdx
+++ /dev/null
@@ -1,388 +0,0 @@
----
-layout: docs
-page_title: Integrated Storage
-description: Learn about the integrated raft storage in Vault.
----
-
-# Integrated storage
-
-Vault supports a number of storage options for the durable storage of Vault's
-information. As of Vault 1.4 an Integrated Storage option is offered. This
-storage backend does not rely on any third party systems, implements high
-availability semantics, supports Enterprise Replication features, and provides
-backup/restore workflows.
-
-The option stores Vault's data on the server's filesystem and
-uses a consensus protocol to replicate data to each server in the cluster. More
-information on the internals of Integrated Storage can be found in the
-[Integrated Storage internals
-documentation](/vault/docs/internals/integrated-storage/). Additionally, the
-[Configuration](/vault/docs/configuration/storage/raft/) docs can help in configuring
-Vault to use Integrated Storage.
-
-The sections below go into various details on how to operate Vault with
-Integrated Storage.
-
-## Server-to-Server communication
-
-Once nodes are joined to one another they begin to communicate using mTLS over
-Vault's cluster port. The cluster port defaults to `8201`. The TLS information
-is exchanged at join time and is rotated on a cadence.
-
-A requirement for Integrated Storage is that the
-[`cluster_addr`](/vault/docs/concepts/ha#per-node-cluster-address) configuration option
-is set. This allows Vault to assign an address to the node ID at join time.
-
-## Cluster membership
-
-This section will outline how to bootstrap and manage a cluster of Vault nodes
-running Integrated Storage.
-
-Integrated Storage is bootstrapped during the [initialization
-process](/vault/tutorials/getting-started/getting-started-deploy#initializing-the-vault),
-and results in a cluster of size 1. Depending on the [desired deployment
-size](/vault/docs/internals/integrated-storage/#deployment-table), nodes can be joined
-to the active Vault node.
-
-### Joining nodes
-
-Joining is the process of taking an uninitialized Vault node and making it a
-member of an existing cluster. In order to authenticate the new node to the
-cluster it must use the same seal mechanism. If using a Auto Unseal the node
-must be configured to use the same KMS provider and Key as the cluster it's
-attempting to join. If using a Shamir seal the unseal keys must be provided to
-the new node before the join process can complete. Once a node has successfully
-joined, data from the active node can begin to replicate to it. Once a node has
-been joined it cannot be re-joined to a different cluster.
-
-You can either join the node automatically via the config file or manually through the
-API (both methods described below). When joining a node, the API address of the leader node must be used. We
-recommend setting the [`api_addr`](/vault/docs/concepts/ha#direct-access) configuration
-option on all nodes to make joining simpler.
-
-#### `retry_join` configuration
-
-This method enables setting one, or more, target leader nodes in the config file.
-When an uninitialized Vault server starts up it will attempt to join each potential
-leader that is defined, retrying until successful. When one of the specified
-leaders become active this node will successfully join. When using Shamir seal,
-the joined nodes will still need to be unsealed manually. When using Auto Unseal
-the node will be able to join and unseal automatically.
-
-An example [`retry_join`](/vault/docs/configuration/storage/raft#retry_join-stanza)
-config can be seen below:
-
-```hcl
-storage "raft" {
-  path    = "/var/raft/"
-  node_id = "node3"
-
-  retry_join {
-    leader_api_addr = "https://node1.vault.local:8200"
-  }
-  retry_join {
-    leader_api_addr = "https://node2.vault.local:8200"
-  }
-}
-```
-
-Note, in each [`retry_join`](/vault/docs/configuration/storage/raft#retry_join-stanza)
-stanza, you may provide a single
-[`leader_api_addr`](/vault/docs/configuration/storage/raft#leader_api_addr) or
-[`auto_join`](/vault/docs/configuration/storage/raft#auto_join) value. When a cloud
-[`auto_join`](/vault/docs/configuration/storage/raft#auto_join) configuration value is
-provided, Vault will use [go-discover](https://github.com/hashicorp/go-discover)
-to automatically attempt to discover and resolve potential Raft leader
-addresses.
-
-See the go-discover
-[README](https://github.com/hashicorp/go-discover/blob/master/README.md) for
-details on the format of the [`auto_join`](/vault/docs/configuration/storage/raft#auto_join) value.
-
-```hcl
-storage "raft" {
-  path    = "/var/raft/"
-  node_id = "node3"
-
-  retry_join {
-    auto_join = "provider=aws region=eu-west-1 tag_key=vault tag_value=... access_key_id=... secret_access_key=..."
-  }
-}
-```
-
-By default, Vault will attempt to reach discovered peers using HTTPS and port 8200. Operators may override these through the
-[`auto_join_scheme`](/vault/docs/configuration/storage/raft#auto_join_scheme) and
-[`auto_join_port`](/vault/docs/configuration/storage/raft#auto_join_port) fields
-respectively.
-
-```hcl
-storage "raft" {
-  path    = "/var/raft/"
-  node_id = "node3"
-
-  retry_join {
-    auto_join = "provider=aws region=eu-west-1 tag_key=vault tag_value=... access_key_id=... secret_access_key=..."
-    auto_join_scheme = "http"
-    auto_join_port = 8201
-  }
-}
-```
-
-#### Join from the CLI
-
-Alternatively you can use the [`join` CLI
-command](/vault/docs/commands/operator/raft/#join) or the API to join a node. The
-active node's API address will need to be specified:
-
-```shell-session
-$ vault operator raft join https://node1.vault.local:8200
-```
-
-#### Non-Voting nodes (Enterprise only)
-
-Nodes that are joined to a cluster can be specified as non-voters. A non-voting
-node has all of Vault's data replicated to it, but does not contribute to the
-quorum count. This can be used in conjunction with [Performance
-Standby](/vault/docs/enterprise/performance-standby/) nodes to add read scalability to
-a cluster in cases where a high volume of reads to servers are needed.
-
-```shell-session
-$ vault operator raft join -non-voter https://node1.vault.local:8200
-```
-
-### Removing peers
-
-Removing a peer node is a necessary step when you no longer want the node in the
-cluster. This could happen if the node is rotated for a new one, the hostname
-permanently changes and can no longer be accessed, you're attempting to shrink
-the size of the cluster, or for many other reasons. Removing the peer will
-ensure the cluster stays at the desired size, and that quorum is maintained.
-
-To remove the peer you can issue a
-[`remove-peer`](/vault/docs/commands/operator/raft#remove-peer) command and provide the
-node ID you wish to remove:
-
-```shell-session
-$ vault operator raft remove-peer node1
-Peer removed successfully!
-```
-
-### Listing peers
-
-To see the current peer set for the cluster you can issue a
-[`list-peers`](/vault/docs/commands/operator/raft#list-peers) command. All the voting
-nodes that are listed here contribute to the quorum and a majority must be alive
-for Integrated Storage to continue to operate.
-
-```shell-session
-$ vault operator raft list-peers
-Node     Address                   State       Voter
-----     -------                   -----       -----
-node1    node1.vault.local:8201    follower    true
-node2    node2.vault.local:8201    follower    true
-node3    node3.vault.local:8201    leader      true
-```
-
-## Integrated storage and TLS
-
-We've glossed over some details in the above sections on bootstrapping clusters.
-The instructions are sufficient for most cases, but some users have run into
-problems when using auto-join and TLS in conjunction with things like auto-scaling.
-The issue is that [go-discover](https://github.com/hashicorp/go-discover) on
-most platforms returns IPs (not hostnames), and because the IPs aren't knowable
-in advance, the TLS certificates used to secure the Vault API port don't contain
-these IPs in their IP SANs.
-
-### Vault networking recap
-
-Before we explore solutions to this problem, let's recapitulate how Vault nodes
-speak to one another.
-
-Vault exposes two TCP ports: [the API port](/vault/docs/configuration#api_addr) and
-[the cluster port](/vault/docs/configuration#cluster_addr).
-
-The API port is where clients send their Vault HTTP requests.
-
-For a single-node Vault cluster you don't worry about a cluster port as it won't be used.
-
-When you have multiple nodes, you also need a cluster port. This is used by Vault
-nodes to issue RPCs to one another, e.g. to forward requests from a standby node
-to the active node, or when Raft is in use, to handle leader election and
-replication of stored data.
-
-The cluster port is secured using a TLS certificate that the Vault active node
-generates internally. It's clear how this can work when not using integrated
-storage: every node has at least read access to storage, so once the active
-node has persisted the certificate, the standby nodes can fetch it, and all
-agree on how cluster traffic should be encrypted.
-
-It's less clear how this works with Integrated Storage, as there is a chicken
-and egg problem. Nodes don't have a shared view of storage until the raft
-cluster has been formed, but we're trying to form the raft cluster! To solve
-this problem, a Vault node must speak to another Vault node using the API port
-instead of the cluster port. This is currently the only situation in which
-Vault Community Edition does this (Vault Enterprise also does something similar when setting
-up replication.)
-
-- `node2` wants to join the cluster, so issues challenge API request to existing member `node1`
-- `node1` replies to challenge request with (1) an encrypted random UUID and (2) seal config
-- `node2` must decrypt UUID using seal; if using auto-unseal can do it directly, if using Shamir must wait for user to provide enough unseal keys to perform decryption
-- `node2` sends decrypted UUID back to `node1` using answer API
-- `node1` sees `node2` can be trusted (since it has seal access) and replies with a bootstrap package which includes the cluster TLS certificate and private key
-- `node2` gets sent a raft snapshot over the cluster port
-
-After this procedure the new node will never again send traffic to the API port.
-All subsequent inter-node communication will use the cluster port.
-
-![Raft Join Process](/img/raft-join-detailed.png)
-
-### Assisted raft join techniques
-
-The simplest option is to do it by hand: issue [`raft join`](/vault/docs/commands/operator/raft#join) commands specifying the explicit names
-or IPs of the nodes to join to. In this section we look at other TLS-compatible
-options that lend themselves more to automation.
-
-#### Autojoin with TLS servername
-
-As of Vault 1.6.2, the simplest option might be to specify a
-[`leader_tls_servername`](/vault/docs/configuration/storage/raft#leader_tls_servername)
-in the [`retry_join`](/vault/docs/configuration/storage/raft#retry_join-stanza) stanza
-which matches a [DNS
-SAN](https://en.wikipedia.org/wiki/Subject_Alternative_Name) in the certificate.
-
-Note that names in a certificate's DNS SAN don't actually have to be registered
-in a DNS server. Your nodes may have no names found in DNS, while still
-using certificate(s) that contain this shared `servername` in their DNS SANs.
-
-#### Autojoin but constrain CIDR, list all possible IPs in certificate
-
-If all the vault node IPs are assigned from a small subnet, e.g. a `/28`, it
-becomes practical to put all the IPs that exist in that subnet into the IP SANs
-of the TLS certificate the nodes will share.
-
-The drawback here is that the cluster may someday outgrow the CIDR and changing
-it may be a pain. For similar reasons this solution may be impractical when
-using non-voting nodes and dynamically scaling clusters.
-
-#### Load balancer instead of autojoin
-
-Most Vault instances are going to have a load balancer (LB) between clients and
-the Vault nodes. In that case, the LB knows how to route traffic to working
-Vault nodes, and there's no need for auto-join: we can just use
-[`retry_join`](/vault/docs/configuration/storage/raft#retry_join-stanza) with the LB
-address as the target.
-
-One potential issue here: some users want a public facing LB for clients to
-connect to Vault, but aren't comfortable with Vault internal traffic
-egressing from the internal network it normally runs on.
-
-## Outage recovery
-
-### Quorum maintained
-
-This section outlines the steps to take when a single server or multiple servers
-are in a failed state but quorum is still maintained. This means the remaining
-alive servers are still operational, can elect a leader, and are able to process
-write requests.
-
-If the failed server is recoverable, the best option is to bring it back online
-and have it reconnect to the cluster with the same host address. This will return
-the cluster to a fully healthy state.
-
-If this is impractical, you need to remove the failed server. Usually, you can
-issue a [`remove-peer`](/vault/docs/commands/operator/raft#remove-peer) command to
-remove the failed server if it's still a member of the cluster.
-
-If the [`remove-peer`](/vault/docs/commands/operator/raft#remove-peer) command isn't
-possible or you'd rather manually re-write the cluster membership a
-[`raft/peers.json`](#manual-recovery-using-peers-json) file can be written to
-the configured data directory.
-
-### Quorum lost
-
-In the event that multiple servers are lost, causing a loss of quorum and a
-complete outage, partial recovery is still possible.
-
-If the failed servers are recoverable, the best option is to bring them back
-online and have them reconnect to the cluster using the same host addresses.
-This will return the cluster to a fully healthy state.
-
-If the failed servers are not recoverable, partial recovery is possible using
-data on the remaining servers in the cluster. There may be data loss in this
-situation because multiple servers were lost, so information about what's
-committed could be incomplete. The recovery process implicitly commits all
-outstanding Raft log entries, so it's also possible to commit data that was
-uncommitted before the failure.
-
-See the section below on manual recovery using
-[`peers.json`](#manual-recovery-using-peers-json) for details of the recovery
-procedure. You include only the remaining servers in the
-[`peers.json`](#manual-recovery-using-peers-json) recovery file. The
-cluster should be able to elect a leader once the remaining servers are all
-restarted with an identical
-[`peers.json`](#manual-recovery-using-peers-json) configuration.
-
-Any servers you introduce later can be fresh with totally clean data
-directories and joined using Vault's join command.
-
-In extreme cases, it should be possible to recover with just a single remaining
-server by starting that single server with itself as the only peer in the
-[`peers.json`](#manual-recovery-using-peers-json) recovery file.
-
-### Manual recovery using peers.json
-
-Using `raft/peers.json` for recovery can cause uncommitted Raft log entries to be
-implicitly committed, so this should only be used after an outage where no other
-option is available to recover a lost server. Make sure you don't have any
-automated processes that will put the peers file in place on a periodic basis.
-
-To begin, stop all remaining servers.
-
-The next step is to go to the [configured data
-path](/vault/docs/configuration/storage/raft/#path) of each Vault server. Inside that
-directory, there will be a `raft/` sub-directory. We need to create a
-`raft/peers.json` file. The file should be formatted as a JSON array containing
-the node ID, `address:port`, and suffrage information of each Vault server you
-wish to be in the cluster:
-
-```json
-[
-  {
-    "id": "node1",
-    "address": "node1.vault.local:8201",
-    "non_voter": false
-  },
-  {
-    "id": "node2",
-    "address": "node2.vault.local:8201",
-    "non_voter": false
-  },
-  {
-    "id": "node3",
-    "address": "node3.vault.local:8201",
-    "non_voter": false
-  }
-]
-```
-
-- `id` `(string: <required>)` - Specifies the node ID of the server. This can be
-  found in the config file, or inside the `node-id` file in the server's data
-  directory if it was auto-generated.
-- `address` `(string: <required>)` - Specifies the host and port of the server. The
-  port is the server's cluster port.
-- `non_voter` `(bool: <false>)` - This controls whether the server is a non-voter.
-  If omitted, it will default to false, which is typical for most clusters. This
-  is an enterprise only feature.
-
-Create entries for all servers. You must confirm that servers you do not
-include here have indeed failed and will not later rejoin the cluster. Ensure
-that this file is the same across all remaining server nodes.
-
-At this point, you can restart all the remaining servers. The cluster should be
-in an operable state again. One of the nodes should claim leadership and become
-active.
-
-### Other recovery methods
-
-For other, non-quorum related recovery [Vault's
-recovery](/vault/docs/concepts/recovery-mode/) mode can be used.
diff --git a/website/content/docs/concepts/lease-count-quota-exceeded.mdx b/website/content/docs/concepts/lease-count-quota-exceeded.mdx
deleted file mode 100644
index 5e2d8463aec..00000000000
--- a/website/content/docs/concepts/lease-count-quota-exceeded.mdx
+++ /dev/null
@@ -1,41 +0,0 @@
----
-layout: docs
-page_title: Lease count quota exceeded
-description: |-
-  Vault Enterprise error when quota limit is reached.
----
-
-# Lease count quota exceeded
-
-Vault returns a `429 - Too Many Requests` response if a new lease request
-violates the quota limit, to guard against [lease
-explosions](/vault/docs/concepts/lease-explosions):
-
-
-```
-Error making API request.
-
-URL: PUT https://127.0.0.1:61555/v1/auth/userpass/login/foo
-Code: 429. Errors:
-
-* 1 error occurred:
-	* request path "auth/userpass/login/foo": lease count quota exceeded
-```
-
-To resolve the error:
-
-1. Check for client-side errors that result in excessive lease creation and
-   correct them.
-1. Tune your lease count quota to accommodate any expected increases in lease
-   creation. For example, due to new feature releases or an increase in users.
-
-## Tutorial
-
-Refer to [Protecting Vault with Resource
-Quotas](/vault/tutorials/operations/resource-quotas) for a
-step-by-step tutorial.
-
-## API
-
-Lease count quotas can be managed over the HTTP API. Please see
-[Lease Count Quotas API](/vault/api-docs/system/lease-count-quotas) for more details.
diff --git a/website/content/docs/concepts/lease-explosions.mdx b/website/content/docs/concepts/lease-explosions.mdx
deleted file mode 100644
index 48934d11729..00000000000
--- a/website/content/docs/concepts/lease-explosions.mdx
+++ /dev/null
@@ -1,379 +0,0 @@
----
-layout: docs
-page_title: 'Lease Explosions'
-description: >-
-  Learn about lease explosions and how you can prevent them.
----
-
-# Lease Explosions
-
-As your Vault environment scales to meet deployment needs, it is important to avoid over-subscription. A lease explosion can occur when operators reach over-subscription and clients create leases much faster than Vault is set to revoke them. If this continues unchecked, the active node can run out of memory. Once a lease explosion occurs, mitigation is time consuming and resource intensive.
-
-This document shows you how to prevent lease explosions, mitigate when a lease explosion occurs, and clean up your environment after a lease explosion.
-
-Applications and users can overwhelm system resources through consistent and high-volume API requests, resulting in denial-of-service issues in some Vault nodes or even the entire Vault cluster. Review [Vault resource quotas](/vault/docs/concepts/resource-quotas) to learn more about enabling rate-limit quotas and lease-count quotas to protect against requests which could trigger lease explosions.
-
-These are common observations and behaviors operators experience as their Vault deployment matures:
-
-- TTL values for dynamic secret leases or authentication tokens could be too high, resulting in unused leases consuming storage space while waiting to expire.
-
-- Rapid lease count growth disproportionate to the number of clients is a sign of misconfiguration or potential anti-patterns in client usage.
-
-- Lease revocation is failing. This can be caused by failures in an external service in the case of dynamic secrets.
-
-- Valid credentials which have already been leased are not being reused when possible. e.g. a badly behaving app requests new credentials from Vault every time it starts instead of caching ones it previously requested and using them again. This encourages a build up of leases associated with otherwise unused credentials.
-
-- The Vault server is not processing lease revocations as quickly as they're expiring. Usually, this is due to insufficient IOPS for the storage backend.
-
-You can approach lease explosions in three phases:
-
-- Preventing lease explosions
-
-- Mitigating lease explosions
-
-- Cleaning up after lease explosions
-
-## Preventing lease explosions
-
-Prevention is the best tool against lease explosion. The following are three important areas you can focus on to prevent lease explosion in your Vault environment.
-
-Although no technical maximum exists, high lease counts can cause degradation in system performance. We recommend short default time-to-live (TTL) values on tokens and leases to avoid a large backlog of unexpired leases or many simultaneous expirations. Review [Vault lease limits](/vault/docs/internals/limits#lease-limits) to learn more.
-
-### Client best practices
-
-Ensure clients using Vault adhere to best practices for their authentication and secret retrieval, and do not make excessive dynamic secrets requests or service token authentications. Review [Lease Concepts](/vault/docs/concepts/lease) and [Auth Concepts](/vault/docs/concepts/auth) to learn more.
-
-You should avoid these client behavior anti-patterns:
-Long TTLs configured, leading to a slow build over-subscription.
-Acute aberrant client behavior leading to rapid over-subscription.
-A combination of both.
-
-#### AppRole
-
-As Vault matures in your environment, it's important to review and ensure client behavior best practices around machine-based authentication as it can have more impact on lease explosion than human-based authentication typically does. 
-
-- [Recommended pattern for Vault AppRole use](/vault/tutorials/recommended-patterns/pattern-approle)
-
-- [How and why to use AppRole correctly in HashiCorp Vault](https://www.hashicorp.com/blog/how-and-why-to-use-approle-correctly-in-hashicorp-vault)
-
-### Monitoring key metrics
-
-Proactive monitoring is key to identifying behavior and usage patterns before they become problematic. Review the following resources for more details:
-
-- [Vault key metrics](/well-architected-framework/reliability/reliability-vault-monitoring-key-metrics)
-
-- [Vault anti-patterns poor metrics](/well-architected-framework/operational-excellence/security-vault-anti-patterns#poor-metrics-or-no-telemetry-data)
-
-### Implementation guardrails
-
-You can choose the appropriate token type for your use case, and use resource quotas as guardrails against lease explosion in your implementation.
-
-#### TTLs
-
-| TTL type | Notes |
-| -------- |------ |
-| [System-wide maximum TTL](/vault/docs/configuration#default_lease_ttl) and [system-wide default TTL](/vault/docs/configuration#max_lease_ttl) | TTL values which you specify in the Vault server configuration file; they are the last used values by Vault in terms of precedence after mount TTLs and high granularity TTLs |
-| [Mount maximum TTL](/vault/api-docs/system/mounts#default_lease_ttl-1) and [mount default TTL](/vault/api-docs/system/mounts#max_lease_ttl-1) | TTL values specified on a per mount instance of auth method or secrets engine. In terms of precedence, these TTL values override system-wide TTLs, but are overridden by highly granular TTLs. |
-| Highly granular TTLs, for example: [Database secrets engine role default TTL](/vault/api-docs/secret/databases#default_ttl) and [Database secrets engine role maximum TTL](/vault/api-docs/secret/databases#max_ttl) | These TTLs are specified on a role, group, or user level, and their values override both mount and system-wide TTL values. |
-
-More details are available in the [Token Time-To-Live, periodic tokens, and explicit max TTLs](/vault/docs/concepts/tokens#token-time-to-live-periodic-tokens-and-explicit-max-ttls) and [Lease limits](/vault/docs/internals/limits#lease-limits) documentation.
-
-You should also review the details in the Vault anti-patterns guide: [not adjusting the default lease time](/well-architected-framework/operational-excellence/security-vault-anti-patterns#not-adjusting-the-default-lease-time) for a clear explanation of the issue and solution.
-
-The following are examples for setting default and maximum TTL values using the Vault API and CLI, which you can reference when setting values for your implementation.
-
-<Note>
-
-Adjusting TTL values is not a retroactive operation, and affects just those leases or tokens issued after you make the changes.
-
-</Note>
-
-Update the default TTL to 8 hours and maximum TTL to 12 hours on a username and password auth method user named "alice". The value of `$VAULT_TOKEN` should be that of a token with capabilities to perform the operations.
-
-<Tabs>
-
-<Tab heading="API" group="api">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: $VAULT_TOKEN" \
-    --request POST \
-    --data '{"token_ttl":"8h","token_max_ttl":"12h"}' \
-    $VAULT_ADDR/v1/auth/userpass/users/alice
-```
-
-This command is not expected to produce output, but you can read the user to confirm the settings.
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: $VAULT_TOKEN" \
-    --request GET \
-    --silent \
-    $VAULT_ADDR/v1/auth/userpass/users/alice \
-    | jq
-```
-
-Example output:
-
-<CodeBlockConfig hideClipboard>
-
-```json
-{
-  "request_id": "4cfc0293-a3f3-9b3b-b668-82aea63ced91",
-  "lease_id": "",
-  "renewable": false,
-  "lease_duration": 0,
-  "data": {
-    "token_bound_cidrs": [],
-    "token_explicit_max_ttl": 0,
-    "token_max_ttl": 43200,
-    "token_no_default_policy": false,
-    "token_num_uses": 0,
-    "token_period": 0,
-    "token_policies": [],
-    "token_ttl": 28800,
-    "token_type": "default"
-  },
-  "wrap_info": null,
-  "warnings": null,
-  "auth": null
-}
-```
-
-</CodeBlockConfig>
-
-When Alice authenticates with Vault and gets a token, its default TTL value is set to 28800 seconds (8 hours) and the maximum TTL value is 43200 seconds (12 hours).
-
-</Tab>
-
-<Tab heading="CLI" group="cli">
-
-```shell-session
-$ VAULT_TOKEN=$VAULT_TOKEN vault write /auth/userpass/users/alice \
-    token_ttl="8h" token_max_ttl="12h"
-```
-
-Example output:
-
-<CodeBlockConfig hideClipboard>
-
-```plaintext
-Success! Data written to: auth/userpass/users/alice
-```
-
-</CodeBlockConfig>
-
-You can read the user to confirm the settings.
-
-```shell-session
-$ VAULT_TOKEN=$VAULT_TOKEN vault read /auth/userpass/users/alice
-```
-
-Example output:
-
-<CodeBlockConfig hideClipboard>
-
-```plaintext
-Key                        Value
----                        -----
-token_bound_cidrs          []
-token_explicit_max_ttl     0s
-token_max_ttl              12h
-token_no_default_policy    false
-token_num_uses             0
-token_period               0s
-token_policies             []
-token_ttl                  8h
-token_type                 default
-```
-
-</CodeBlockConfig>
-
-When Alice next authenticates with Vault and gets a token, its default TTL value is set to 8 hours and the maximum TTL value is 12 hours.
-
-</Tab>
-
-</Tabs>
-
-#### Resource Quotas
-You can use quotas to control Vault resource usage in the form of API rate limiting quotas and [lease count quotas](/vault/tutorials/operations/resource-quotas#lease-count-quotas). For the purposes of this overview, lease count quotas are most relevant as you can cap the maximum number of leases generated on a per-mount basis.
-
-Use this feature for use cases where a hard limit to the number of leases makes sense. Also, be sure to [monitor Vault audit device logs](/vault/tutorials/monitoring/monitor-telemetry-audit-splunk) where Vault emits messages about failures related to exceeding the quota.
-
-The following examples demonstrate creating a lease count quota on an instance of the Approle auth method, for the role named "webapp" to restrict leases to no more than 100. The value of `$VAULT_TOKEN` should be that of a token capable of performing the operations.
-
-<Tabs>
-
-<Tab heading="API" group="api">
-
-1. Create a payload file containing the lease quota parameters.
-
-   ```shell-session
-   $ cat > payload.json << EOF
-   {
-     "path": "auth/approle",
-     "role": "webapp",
-     "max_leases": 100
-   }
-   EOF
-   ```
-
-1. Write the webapp-tokens lease count quota.
-
-   ```shell-session
-   $ curl \
-    --request POST \
-    --header "X-Vault-Token: $VAULT_TOKEN" \
-    --data @payload.json \
-    $VAULT_ADDR/v1/sys/quotas/lease-count/webapp-tokens
-   ```
-
-   This command is not expected to produce output, but you can read the user to confirm the settings.
-
-1. Confirm settings.
-
-   ```shell-session
-   $ curl \
-       --header "X-Vault-Token: $VAULT_TOKEN" \
-       --request GET \
-       --silent \
-       $VAULT_ADDR/v1/sys/quotas/lease-count/webapp-tokens \
-       | jq
-   ```
-
-   Example output:
-   
-   <CodeBlockConfig hideClipboard>
-   
-   ```json
-   {
-     "request_id": "188e22f1-dc1a-251a-a0a1-005e256fe70f",
-     "lease_id": "",
-     "renewable": false,
-     "lease_duration": 0,
-     "data": {
-       "counter": 0,
-       "inheritable": true,
-       "max_leases": 100,
-       "name": "webapp-tokens",
-       "path": "auth/approle/",
-       "role": "webapp",
-       "type": "lease-count"
-     },
-     "wrap_info": null,
-     "warnings": null,
-     "auth": null
-   }
-   ```
-
-   </CodeBlockConfig>
-
-</Tab>
-
-<Tab heading="CLI" group="cli">
-
-Write the webapp-tokens lease count quota.
-
-```shell-session
-$ vault write sys/quotas/lease-count/webapp-tokens \
-   max_leases=100 \
-   path="auth/approle" \
-   role="webapp"
-```
-
-Example output:
-
-<CodeBlockConfig hideClipboard>
-
-```plaintext
-Success! Data written to: sys/quotas/lease-count/webapp-tokens
-```
-
-</CodeBlockConfig>
-
-Confirm the setting.
-
-```shell-session
-$ vault read sys/quotas/lease-count/webapp-tokens
-```
-
-Example output:
-
-<CodeBlockConfig hideClipboard>
-
-```plaintext
-Key            Value
----            -----
-counter        0
-inheritable    true
-max_leases     100
-name           webapp-tokens
-path           auth/approle/
-role           webapp
-type           lease-count
-```
-
-</CodeBlockConfig>
-
-</Tab>
-
-</Tabs>
-
-The limit is set to 100 leases for the AppRole auth method role named webapp.
-
-<Note>
-
-Enabling the rate limit audit logging may have an impact on the Vault performance if the volume of rejected requests is large.
-
-</Note>
-
-Review these resources for a deeper dive into controlling Vault resources:
-
-- [Vault resource quotas](/vault/docs/concepts/resource-quotas)
-
-- [Vault Enterprise lease count quotas](/vault/docs/enterprise/lease-count-quotas)
-
-- [Query audit device logs](/vault/tutorials/monitoring/query-audit-device-logs)
-
-#### Token type
-
-In some use cases, batch tokens can be a better fit than service tokens with respect to lease explosion. Review the following resources for help deciding when to use batch tokens and when to use service tokens:
-
-- [Vault service tokens vs batch tokens](/vault/tutorials/tokens/batch-tokens#service-tokens-vs-batch-tokens)
-
-- [Service vs batch token lease handling](/vault/docs/concepts/tokens#service-vs-batch-token-lease-handling)
-
-## Mitigating lease explosions
-
-Ultimately, the number of leases a system can handle is unique to the Vault deployment and environment. 
-
-### Increase resources
-
-Increasing available resources in your Vault cluster can help mitigate lease explosion and allow for cluster recovery. Review [hardware sizing](/well-architected-framework/zero-trust-security/raft-reference-architecture#hardware-sizing-for-vault-servers), and focus on increasing available RAM.
-
-#### Within Vault
-
-Use the information from the Implementation guardrails section to adjust TTL values from the default values according to your use case needs.
-
-#### External to Vault
-
-You can use firewalls or load balancers to limit API calls to Vault from aberrant clients.)
-
-[Knowledge base article around load balancing](https://support.hashicorp.com/hc/en-us/articles/14496042865427-Vault-Global-Load-Balancing-Patterns)
-[Vault & load balancing](/vault/tutorials/day-one-raft/raft-reference-architecture#load-balancer-recommendations)
-
-## Cleaning up environment after lease explosions
-
-Once the acute event subsides, the Vault active node will continue to purge leases. Sometimes, the explosion is so great, you will need to manually intervene to revoke [leases](/vault/api-docs/system/leases). If you are running a version of Vault prior to 1.13.0, this lease revocation can cause further performance degradation.
-
-Revoking or forcefully revoking leases is potentially a dangerous operation. You should ensure that you have recent valid snapshots of the cluster. Users of Vault versions prior to 1.13.0 on integrated storage must also perform freelist compaction. Vault Enterprise customers should consider proactively contacting the [Customer Support team](https://support.hashicorp.com) for help with this process.
-
-## Additional resources
-
-Proactive monitoring and periodic usage analysis are some of the best practices for Vault operators. Review the following resources for more details.
-
-- [Vault key metrics for common health checks](/well-architected-framework/reliability/reliability-vault-monitoring-key-metrics)
-
-- [Troubleshoot irrevocable leases](/vault/tutorials/monitoring/troubleshoot-irrevocable-leases)
-
-- [Troubleshooting Vault](/vault/tutorials/monitoring/troubleshooting-vault)
diff --git a/website/content/docs/concepts/lease.mdx b/website/content/docs/concepts/lease.mdx
deleted file mode 100644
index 0773ec09d4b..00000000000
--- a/website/content/docs/concepts/lease.mdx
+++ /dev/null
@@ -1,89 +0,0 @@
----
-layout: docs
-page_title: 'Lease, Renew, and Revoke'
-description: >-
-  Vault provides a lease with every secret. When this lease is expired, Vault
-  will revoke that secret.
----
-
-# Lease, renew, and revoke
-
-With every dynamic secret and `service` type authentication token, Vault
-creates a _lease_: metadata containing information such as a time duration,
-renewability, and more. Vault promises that the data will be valid for the
-given duration, or Time To Live (TTL). Once the lease is expired, Vault can
-automatically revoke the data, and the consumer of the secret can no longer be
-certain that it is valid.
-
-The benefit should be clear: consumers of secrets need to check in with
-Vault routinely to either renew the lease (if allowed) or request a
-replacement secret. This makes the Vault audit logs more valuable and
-also makes key rolling a lot easier.
-
-All dynamic secrets in Vault are required to have a lease. Even if the data is
-meant to be valid for eternity, a lease is required to force the consumer
-to check in routinely.
-
-In addition to renewals, a lease can be _revoked_. When a lease is revoked, it
-invalidates that secret immediately and prevents any further renewals. For
-example, with the [AWS secrets engine](/vault/docs/secrets/aws), the
-access keys will be deleted from AWS the moment a lease is revoked. This
-renders the access keys invalid from that point forward.
-
-Revocation can happen manually via the API, via the `vault lease revoke` cli command,
-the user interface (UI) under the Access tab, or automatically by Vault. When a lease
-is expired, Vault will automatically revoke that lease. When a token is revoked,
-Vault will revoke all leases that were created using that token.
-
-**Note**: The [Key Value Backend](/vault/docs/secrets/kv) which stores
-arbitrary secrets does not issue leases although it will sometimes return a
-lease duration; see the documentation for more information.
-
-## Lease IDs
-
-When reading a dynamic secret, such as via `vault read`, Vault always returns a
-`lease_id`. This is the ID used with commands such as `vault lease renew` and `vault lease revoke` to manage the lease of the secret.
-
-## Lease durations and renewal
-
-Along with the lease ID, a _lease duration_ can be read. The lease duration is
-a Time To Live value: the time in seconds for which the lease is valid. A
-consumer of this secret must renew the lease within that time.
-
-When renewing the lease, the user can request a specific amount of time they
-want remaining on the lease, termed the `increment`. This is not an increment
-at the end of the current TTL; it is an increment _from the current time_. For
-example, `vault lease renew -increment=3600 my-lease-id` would request that the TTL of the lease
-be adjusted to 1 hour (3600 seconds). Having the increment be rooted at the
-current time instead of the end of the lease makes it easy for users to reduce
-the length of leases if they don't actually need credentials for the full
-possible lease period, allowing those credentials to expire sooner and
-resources to be cleaned up earlier.
-
-The requested increment is completely advisory. The backend in charge of the
-secret can choose to completely ignore it. For most secrets, the backend does
-its best to respect the increment, but often limits it to ensure renewals every
-so often.
-
-As a result, the return value of renewals should be carefully inspected to
-determine what the new lease is.
-
-
--> To implement token renewal logic in your application code, refer to the [code example in the Authentication doc](/vault/docs/concepts/auth#code-example).
-
-## Prefix-based revocation
-
-In addition to revoking a single secret, operators with proper access control
-can revoke multiple secrets based on their lease ID prefix.
-
-Lease IDs are structured in a way that their prefix is always the path where
-the secret was requested from. This lets you revoke trees of secrets. For
-example, to revoke all AWS access keys, you can do `vault lease revoke -prefix aws/`.
-For more information about revoke command please check
-[cli's lease revoke](/vault/docs/commands/lease/revoke#lease-revoke)
-command docs.
-
-This is very useful if there is an intrusion within a specific system: all
-secrets of a specific backend or a certain configured backend can be revoked
-quickly and easily.
-
diff --git a/website/content/docs/concepts/mount-migration.mdx b/website/content/docs/concepts/mount-migration.mdx
deleted file mode 100644
index 17060f1076f..00000000000
--- a/website/content/docs/concepts/mount-migration.mdx
+++ /dev/null
@@ -1,86 +0,0 @@
----
-layout: docs
-page_title: Mount Migration
-description: Move secrets and auth mounts within and across namespaces
----
-
-# Mount migration
-
-Vault supports moving secrets and auth mounts, both within and across namespaces. The operation
-is supported by API endpoints and a CLI helper around them.
-
-## Why
-
-There can be several reasons for wanting to migrate mounts. In Vault Community Edition, the use cases could be for 
-renaming mounts to align with org standards. 
-There may be more potential for use cases on Enterprise as namespaces come into the picture. 
-When migrating from a Community binary to an Enterprise binary, organizations may want to divide their 
-mounts across several namespaces. Mounts may also be moved across namespaces when there is a reorganization
-of roles and responsibilities.
-
-## Async behavior
-
-The first thing to note about the `sys/remount` endpoint is that it is an asynchronous endpoint. An invocation
-will start the migration process, and the API will return a migration ID. This ID, in turn, be used to monitor
-the migration status using the `sys/remount/status` endpoint.
-
-## Namespaces
-
-The `sys/remount` endpoint can move mounts across namespaces with the namespaces supplied as prefixes
-on the path arguments. In this case, namespaces, for both the source and destination mounts, must be 
-either the namespace in which the `/sys/remount` endpoint is called or the children of that namespace. Let us assume that 
-we have three namespaces ns1/, ns1/ns2/, and ns1/ns3. We want to move the mount `my-secret` from ns1/ns2/my-secret to ns1/ns3/my-secret. 
-Moving the mount can be accomplished in two ways. The first way is to invoke `/sys/remount` from the root namespace with the `from` argument as ns1/ns2/my-secret 
-and `to` argument as ns1/ns3/my-secret. The second way is to invoke `/sys/remount` from the namespace ns1/, with `from` as ns2/my-secret and `to` 
-as ns3/my-secret.
-
-## Leases
-
-The remount operation will result in existing leases on a mount being revoked. On mounts with a large number of leases, the revocation process and hence remounting as a whole may be a time consuming process.
-Any dynamic secrets for a secrets mount and any tokens associated
-with an auth mount, will be revoked during the remount process.
-
-## Configurations
-
-The remount operation will retain all the configurations of the mount. For example, if you create a read-only role
-on a database mount or a user on a userpass mount, those will be available at the new location after remounting.
-
-## Cleanup operations
-
-There are two primary cleanup operations that Vault operators will need to keep in mind after performing a remount.
-
-### Entities and aliases
-
-Any aliases that refer to users on the auth mount could now point to an invalid mount when an auth mount is moved. Pointing to an invalid mount may not be the case for every instance;
-a remount within a namespace will end in the aliases pointing to a valid mount.
-Still, a remount across namespaces will always result in the aliases pointing to an invalid mount. In the latter case,
-the Vault operator should find and remove those aliases from the source namespace, and create equivalent aliases
-and entities for the new mount in the target namespace. If new entities and aliases aren't created in the target namespace,
-Vault will dynamically generate them upon login operations.
-
-### Policies
-
-Remounting can also result in policies referring to invalid paths. Any policy that refers to a moved secrets engine
-would need to be updated to point to the new location of the engine, assuming that the policy is in the target namespace 
-or a parent of the target namespace, or updated to remove the original mount path if not. 
-Any policies associated with roles on a moved auth mount need to be inspected
-to see if they still refer to valid paths after the remount operation. Say in namespace ns1/, a child of the root namespace, a role on the mount approle/
-has policies granting access to /my-secret. If the mount is moved to another child of the root namespace, say ns2/,
-which does not have a secrets engine called my-secret/, the Vault operator would either create an equivalent my-secret/
-mount in ns2/, or update the policy to refer to paths valid from the ns2/ namespace.
-
-## Quotas
-
-The mount being moved may have rate limit or lease count quotas.. The remount process
-will update these quotas to refer to the new path of the mount.
-
-## Path filters
-
-The remount operation will respect any existing path filters. Three uses cases, in particular, are shown below.
-here. 
-* If a mount is moved into a namespace denylisted on a secondary cluster, it will not be available on that cluster.
-* If a mount is moved from a namespace denylisted on a secondary cluster to one that is not, it will now be available
-on the cluster.
-* If a mount is specifically denylisted on a secondary cluster and is moved, it will now be available on the cluster.
-
-
diff --git a/website/content/docs/concepts/namespace-api-lock.mdx b/website/content/docs/concepts/namespace-api-lock.mdx
deleted file mode 100644
index 090ca51dcb8..00000000000
--- a/website/content/docs/concepts/namespace-api-lock.mdx
+++ /dev/null
@@ -1,85 +0,0 @@
----
-layout: docs
-page_title: Namespace API Lock
-description: Lock the Vault API on a per-namespace basis.
----
-
-# Namespace lock and unlock
-
-Vault makes the API available (unlocked) by default for all namespaces. In
-this state, Vault can respond to all API/CLI ('API' from here on out) requests
-as normal.
-
-A Vault administrator can lock the API for particular namespaces. In this state,
-Vault blocks all but a selected few API endpoints from responding to clients
-operating in a locked namespace (or a descendant of a locked namespace). The
-endpoints that do respond, the exempt paths, are largely the same as the Vault
-unauthenticated paths. They are mainly used for checking the status of various
-systems (e.g., `sys/health`), or for unlocking the API.
-
-When the API is locked for a particular namespace, it is also locked for all
-descendants of that namespace. If the API was already locked for a descendant,
-that lock will remain, but Vault must be unlocked for the parent before
-unlocking the descendant.
-
-## Why?
-
-Blocking access to much of Vault can be an important break-glass tool in the
-event of unexpected behavior.
-
-For HCP Vault, this provides functionality analogous to sealing Vault, without
-the Vault administrator requesting that the Managed Service Provider seal/unseal
-Vault.
-
-This feature also becomes valuable for secure multitenancy in a variety of Vault
-deployment strategies. You can restrict Vault access for just part of an
-organization, without affecting adjacent parts of the business. If unexpected
-behavior is detected in sub-organization A, an administrator can disable Vault
-access for any entity under sub-organization A, without disabling access for
-sub-organization B. Once the cause has been identified and resolved, the API can
-be unlocked for sub-organization A.
-
-## Locking
-
-The API can be locked by running `vault namespace lock` (or via the API) while
-operating in the namespace to lock. Optionally, a subpath can be provided to
-lock a descendant of the current namespace.
-
-An unlock key will be returned, which can be used to unlock the API for that
-namespace. Preserve this key to unlock the API in the future.
-
-When the API is locked for a namespace, it will also be locked for all
-descendants of that namespace. If an authenticated client attempts to access
-Vault from a locked namespace, the returned error will inform that client of the
-locking namespace.
-
-## Unlocking
-
-The API can be unlocked by running `vault namespace unlock` (or via the API)
-while operating in the namespace to unlock. Optionally, a subpath can be
-provided to unlock a descendant of the current namespace.
-
-In general, an unlock key is required to unlock the API. This is the same as the
-unlock key provided when the namespace was locked.
-
-The unlock key requirement can be overriden by using a root token with the
-unlock request. In this case, the unlock key does not need to be provided.
-
-When the API is unlocked, it will also be unlocked for all descendants that were
-locked with it. If a descendant namespace was previously locked, that lock will
-remain in place.
-
-## API locked response
-
-If a request is made to a non-exempt path from a locked namespace, e.g. `nsA`,
-Vault responds with an HTTP 503: Service Unavailable. It will also produce the
-following error:
-
-`API access to this namespace has been locked by an administrator - "nsA" must be unlocked to gain access.`
-
-Similarly, the same error will return if a request is made in a descendant of
-`nsA`.
-
-## How does this work with replication?
-
-API Lock status is replicated to all clusters, and observed at all nodes.
diff --git a/website/content/docs/concepts/oidc-provider.mdx b/website/content/docs/concepts/oidc-provider.mdx
deleted file mode 100644
index b95d4e7ac9f..00000000000
--- a/website/content/docs/concepts/oidc-provider.mdx
+++ /dev/null
@@ -1,218 +0,0 @@
----
-layout: docs
-page_title: OIDC Provider
-description: >-
-  Describes how Vault can be an OIDC identity provider.
----
-
-# OIDC provider
-
-This document provides conceptual information about the Vault **OpenID Connect (OIDC) identity
-provider** feature. This feature enables client applications that speak the OIDC protocol to
-leverage Vault's source of [identity](/vault/docs/concepts/identity) and wide range of [authentication methods](/vault/docs/auth)
-when authenticating end-users. For more information about the usage of Vault's OIDC provider,
-refer to the [OIDC identity provider](/vault/docs/secrets/identity/oidc-provider) documentation.
-
-## Configuration options
-
-The next few sections of the document provide implementation details for each resource that permits Vault configuration as an OIDC identity provider.
-
-### OIDC providers
-
-Each Vault namespace will contain a built-in provider resource named `default`. The `default`
-provider will allow all client applications within the namespace to use it for OIDC flows.
-The `default` provider can be modified but not deleted.
-
-Additionally, a Vault namespace may contain several provider resources. Each configured provider will publish the APIs listed within the [OIDC flow](/vault/docs/concepts/oidc-provider#oidc-flow) section. The APIs will be served via backend path-based routing on Vault's listen [address](/vault/docs/configuration/listener/tcp#address).
-
-A provider has the following configuration parameters:
-
-* **Issuer URL**: used in the `iss` claim of ID tokens
-* **Allowed client IDs**: limits which clients can access the provider
-* **Scopes supported**: limits what identity information is available as claims
-
-The issuer URL parameter is necessary for the validation of ID tokens by clients. If an URL parameter is not provided explicitly, it will default to a URL with Vault's [api_addr](/vault/docs/configuration#api_addr) as the `scheme://host:port` component and `/v1/:namespace/identity/oidc/provider/:name` as the path component. This means tokens issued by a provider in a specified Vault cluster must be validated within that same cluster. If the issuer URL is provided explicitly, it must point to a Vault instance that is network-reachable by clients for ID token validation.
-
-The allowed client IDs parameter utilizes the list of client IDs that have been generated by Vault as a part of client registration. By default, all clients will be *disallowed*. Providing `*` as the parameter value will allow all clients to use the provider.
-
-The scopes parameter employs a list of references to named scope resources. The values provided are discoverable by the `scopes_supported` key in the OIDC discovery document of the provider. By default, a provider will have the `openid` scope available. See the scopes section below for more details on the `openid` scope.
-
-### Scopes
-
-Providers may reference scope resources via the `scopes_supported` parameter to make specific identity information available as claims.
-
-A scope will have the following configuration parameters:
-
-* **Description**: identity information captured by the scope
-* **Template**: maps individual claims to Vault identity information
-
-
-The template parameter takes advantage of the [JSON-based templating](/vault/api-docs/secret/identity/tokens#template) used by identity tokens for claims mapping. This means the parameter will take a JSON string of arbitrary structure where the values may be replaced with specific identity information. Template parameters that are not present for a Vault identity are omitted from the resulting claims without an error.
-
-
-Example of a JSON template for a scope:
-
-```
-{
-    "username": {{identity.entity.aliases.$MOUNT_ACCESSOR.name}},
-    "contact": {
-        "email": {{identity.entity.metadata.email}},
-        "phone_number": {{identity.entity.metadata.phone_number}}
-    },
-    "groups": {{identity.entity.groups.names}}
-}
-```
-
-The full list of template parameters are included in the following table:
-
-| Name                                                                             | Description                                                                             |
-| :------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------- |
-| `identity.entity.id`                                                             | The entity's ID                                                                         |
-| `identity.entity.name`                                                           | The entity's name                                                                       |
-| `identity.entity.groups.ids`                                                     | The IDs of the groups the entity is a member of                                         |
-| `identity.entity.groups.names`                                                   | The names of the groups the entity is a member of                                       |
-| `identity.entity.metadata`                                                       | Metadata associated with the entity                                                     |
-| `identity.entity.metadata.<metadata key>`                                        | Metadata associated with the entity for the given key                                   |
-| `identity.entity.aliases.<mount accessor>.id`                                    | Entity alias ID for the given mount                                                     |
-| `identity.entity.aliases.<mount accessor>.name`                                  | Entity alias name for the given mount                                                   |
-| `identity.entity.aliases.<mount accessor>.metadata`                              | Metadata associated with the alias for the given mount                                  |
-| `identity.entity.aliases.<mount accessor>.metadata.<metadata key>`               | Metadata associated with the alias for the given mount and metadata key                 |
-| `identity.entity.aliases.<mount accessor>.custom_metadata`                       | Custom metadata associated with the alias for the given mount                           |
-| `identity.entity.aliases.<mount accessor>.custom_metadata.<custom_metadata key>` | Custom metadata associated with the alias for the given mount and custom metadata key   |
-| `time.now`                                                                       | Current time as integral seconds since the Epoch                                        |
-| `time.now.plus.<duration>`                                                       | Current time plus a [duration format string](/vault/docs/concepts/duration-format)                 |
-| `time.now.minus.<duration>`                                                      | Current time minus a [duration format string](/vault/docs/concepts/duration-format)                |
-
-
-Several named scopes can be made available on an individual provider. Note that the top-level keys in a JSON template may conflict with those in another scope. When scopes are made available on a provider, their templates are checked for top-level conflicts. A warning will be issued to the Vault operator if any conflicts are found. This may result in an error if the scopes are requested in an OIDC Authentication Request.
-
-The `openid` scope is a unique case scope that may not be modified or deleted. The scope will exist in Vault and supported by each provider by default. The scope represents the minimum set of claims required by the OIDC specification for inclusion in ID tokens. As such, templates may not contain top-level keys that overwrite the claims populated by the openid scope.
-
-The following defines the claims key and value mapping for the `openid` scope:
-
-* `iss`- configured issuer of the provider
-* `sub`- unique entity ID of the Vault user
-* `aud`- ID of the client
-* `iat`- time of token issue
-* `exp`- time of token issue + ID token TTL
-
-### Client applications
-
-A client resource represents an application that wants to delegate end-user authentication
-to Vault using the OIDC protocol. The information provided by a client resource can be used
-to configure an OIDC [relying party](https://openid.net/specs/openid-connect-core-1_0.html#Terminology).
-
-A client has the following configuration parameters:
-
-* **Redirect URIs**: limits the valid redirect URIs in an authentication request
-* **Assignments**: determine who can authenticate with the client
-* **Key**: used to sign the ID tokens
-*	**ID token TTL**: specifies the time-to-live for ID tokens
-* **Access token TTL**: specifies the time-to-live for access tokens
-* **Client type**: determines the client's ability to maintain confidentiality of credentials
-
-The `key` parameter is optional. The key will be used to sign ID tokens for the client.
-It cannot be modified after creation. If not supplied, defaults to the built-in
-[default key](/vault/docs/concepts/oidc-provider#keys).
-
-A `client_id` is generated and returned after a successful client registration. The
-`client_id` uniquely identifies the client. Its value will be a string with 32 random
-characters from the base62 character set.
-
-~> **Note**: At least one of the redirect URIs of a client must exactly match the `redirect_uri` parameter used in an authentication request initiated by the client.
-
-#### Client types
-
-A client resource has a `client_type` parameter which specifies the OAuth 2.0
-[client type](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1) based on
-its ability to maintain confidentiality of credentials. The following sections detail
-the differences between confidential and public clients in Vault.
-
-##### Confidential
-
-Confidential clients are capable of maintaining the confidentiality of their credentials.
-Confidential clients have a `client_secret`. The `client_secret` will have a prefix of
-`hvo_secret` followed by 64 random characters in the base62 character set.
-
-Confidential clients may use Proof Key for Code Exchange ([PKCE](https://datatracker.ietf.org/doc/html/rfc7636))
-during the authorization code flow.
-
-Confidential clients must authenticate to the token endpoint using the
-`client_secret_basic` or `client_secret_post` [client authentication method](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication).
-
-##### Public
-
-Public clients are not capable of maintaining the confidentiality of their credentials.
-As such, public clients do not have a `client_secret`.
-
-Public clients must use Proof Key for Code Exchange ([PKCE](https://datatracker.ietf.org/doc/html/rfc7636))
-during the authorization code flow.
-
-Public clients use the `none` [client authentication method](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication).
-
-### Assignments
-
-Assignment resources are referenced by clients via the `assignments` parameter. This parameter limits the set of Vault users allowed to authenticate. The assignments of an associated client are validated during the authentication request, ensuring that the Vault identity associated with the request is a member of the assignment's entities or groups.
-
-Each Vault namespace will contain a built-in assignment resource named `allow_all`. The
-`allow_all` assignment allows all Vault entities to authenticate through a client. The
-`allow_all` assignment cannot be modified or deleted.
-
-### Keys
-
-Key resources are referenced by clients via the `key` parameter. This parameter specifies
-the key that will be used to sign ID tokens for the client. See existing
-[documentation](/vault/api-docs/secret/identity/tokens#create-a-named-key) for details on keyring
-management, supported signing algorithms, rotation periods, and verification TTLs. Currently,
-a key referenced by a client cannot be changed.
-
-Each Vault namespace will contain a built-in key resource named `default`. The `default`
-key can be modified but not deleted. Clients that don't specify the `key` parameter at
-creation time will use the `default` key.
-
-The `default` key will have the following configuration:
-
-- `algorithm` - `RS256`
-- `allowed_client_ids` - `*`
-- `rotation_period` - `24h`
-- `verification_ttl` - `24h`
-
-## OIDC flow
-
-~> **Note**: The Vault OIDC Provider feature currently only supports the [authorization code flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth).
-
-The following sections provide implementation details for the OIDC compliant APIs provided by Vault OIDC providers.
-
-Vault OIDC providers enable registered clients to authenticate and obtain identity information (or "claims") for their end-users. They do this by providing the APIs and behavior required to satisfy the OIDC specification for the [authorization code flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth). All clients are treated as first-party. This means that end-users will not be required to provide consent to the provider as detailed in section [3.1.2.4](https://openid.net/specs/openid-connect-core-1_0.html#Consent) of the OIDC specification. The provider will release information to clients as long as the end-user has ACL access to the provider and their identity has been authorized via an assignment.
-
-Vault OIDC providers implement Proof Key for Code Exchange ([PKCE](https://datatracker.ietf.org/doc/html/rfc7636))
-to mitigate authorization code interception attacks. PKCE is required for `public` client types
-and optional for `confidential` client types.
-
-### OpenID configuration
-
-Each provider offers an unauthenticated endpoint that facilitates OIDC Discovery. All required metadata listed in [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata) is included in the discovery document. Additionally, the recommended `userinfo_endpoint` and `scopes_supported` metadata are included.
-
-### Keys
-
-Each provider offers an unauthenticated endpoint that provides the public portion of keys used to sign ID tokens. The keys are published in a JSON Web Key Set [(JWKS)](https://datatracker.ietf.org/doc/html/rfc7517) format. The keyset for an individual provider contains the keys referenced by all clients via the `allowed_client_ids` configuration parameter. A `Cache-Control` header to set based on responses, allowing clients to refresh their keys upon rotation. The `max-age` of the header is set based on the earliest rotation time of any of the keys in the keyset.
-
-### Authorization endpoint
-
-Each provider offers an authenticated [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint). The authorization endpoint for each provider is added to Vault's [default policy](/vault/docs/concepts/policies#default-policy) using the `identity/oidc/provider/+/authorize` path. The endpoint incorporates all required [authentication request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest) parameters as input.
-
-The endpoint [validates](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequestValidation) client requests and ensures that all required parameters are present and valid. The `redirect_uri` of the request is validated against the client's `redirect_uris`. The requesting Vault entity will be validated against the client's `assignments`. An appropriate [error code](https://openid.net/specs/openid-connect-core-1_0.html#AuthError) is returned for invalid requests.
-
-An authorization code is generated with a successful validation of the request. The authorization code is single-use and cached with a lifetime of approximately 5 minutes, which mitigates the risk of leaks. A response including the original `state` presented by the client and `code` will be returned to the Vault UI which initiated the request. Vault will issue an HTTP 302 redirect to the `redirect_uri` of the request, which includes the `code` and `state` as query parameters.
-
-### Token endpoint
-
-Each provider will offer a [token endpoint](/vault/api-docs/secret/identity/oidc-provider#token-endpoint). The endpoint may be unauthenticated in Vault but is authenticated by requiring a `client_secret` as described in [client authentication](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication). The endpoint ingests all required [token request](/vault/api-docs/secret/identity/oidc-provider#parameters-15) parameters as input. The endpoint [validates](https://openid.net/specs/openid-connect-core-1_0.html#TokenRequestValidation) the client requests and exchanges an authorization code for the ID token and access token. The cache of authorization codes will be verified against the code presented in the exchange. The appropriate [error codes](https://openid.net/specs/openid-connect-core-1_0.html#TokenErrorResponse) are returned for all invalid requests.
-
-The ID token is generated and returned upon successful client authentication and request validation. The ID token will contain a combination of required and configurable claims. The required claims are enumerated in the scopes section above for the `openid` scope. The configurable claims are populated by templates associated with the scopes provided in the authentication request that generated the authorization code.
-
-An access token is also generated and returned upon successful client authentication and request validation. The access token is a Vault [batch token](/vault/docs/concepts/tokens#batch-tokens) with a policy that only provides read access to the issuing provider's [userinfo endpoint](/vault/api-docs/secret/identity/oidc-provider#userinfo-endpoint). The access token is also a TTL as defined by the `access_token_ttl` of the requesting client.
-
-### UserInfo endpoint
-
-Each provider provides an authenticated [userinfo endpoint](/vault/api-docs/secret/identity/oidc-provider#userinfo-endpoint). The endpoint accepts the access token obtained from the token endpoint as a [bearer token](/vault/api-docs#authentication). The userinfo response is a JSON object with the `application/json` content type. The JSON object contains claims for the Vault entity associated with the access token. The claims returned are determined by the scopes requested in the authentication request that produced the access token. The `sub` claim is always returned as the entity ID in the userinfo response.
diff --git a/website/content/docs/concepts/password-policies.mdx b/website/content/docs/concepts/password-policies.mdx
deleted file mode 100644
index e04b2b7a488..00000000000
--- a/website/content/docs/concepts/password-policies.mdx
+++ /dev/null
@@ -1,403 +0,0 @@
----
-layout: docs
-page_title: Password Policies
-description: >-
-  Password policies are used in some secret engines to allow users to define how passwords are generated
-  for dynamic & static users within those engines.
----
-
-# Password policies
-
-A password policy is a set of instructions on how to generate a password, similar to other password
-generators. These password policies are used in a subset of secret engines to allow you to configure
-how a password is generated for that engine. Not all secret engines utilize password policies, so check
-the documentation for the engine you are using for compatibility.
-
-**Note:** Password policies are unrelated to [Policies](/vault/docs/concepts/policies) other than sharing similar names.
-
-Password policies are available in Vault version 1.5+. [API docs can be found here](/vault/api-docs/system/policies-password).
-
-!> Password policies are an advanced usage of Vault. This generates credentials for external systems
-(databases, LDAP, AWS, etc.) and should be used with caution.
-
-## Design
-
-Password policies fundamentally have two parts: a length, and a set of rules that a password must
-adhere to. Passwords are randomly generated from the de-duplicated union of charsets found in all rules
-and then checked against each of the rules to determine if the candidate password is valid according
-to the policy. See [Candidate Password Generation](#candidate-password-generation) for details on how
-passwords are generated prior to being checked against the rule set.
-
-A rule is an assertion upon a candidate password string that indicates whether or not
-the password is acceptable. For example: a "charset" rule states that a password must have at least one
-lowercase letter in it. This rule will reject any passwords that do not have any lowercase letters in it.
-
-Multiple rules may be specified within a policy to create more complex rules, such as requiring at least
-one lowercase letter, at least one uppercase letter, and at least one number.
-
-The flow looks like:
-
-[![Vault Password Policy Flow](/img/vault-password-policy-flow.svg)](/img/vault-password-policy-flow.svg)
-
-## Candidate password generation
-
-How a candidate password is generated is extremely important. Great care must be placed to ensure that
-passwords aren't created in a way that can be exploited by threat actors. This section describes how we
-generate passwords within password policies to ensure that passwords are generated as securely as possible.
-
-To generate a candidate password, three things are needed:
-
-1. A [cryptographically secure random number generator](https://golang.org/pkg/crypto/rand/) (RNG).
-2. A character set (charset) to select characters from.
-3. The length of the password.
-
-At a high level, we use our RNG to generate N numbers that correspond to indices into the charset
-array where N is the length of the password we wish to create. Each value returned from the RNG is then
-used to extract a character from the charset into the password.
-
-For example, let's generate a password of length 8 from the charset `abcdefghij`:
-
-The RNG is used to generate 8 random values. For our example let's say those values are:
-
-`[3, 2, 0, 8, 7, 3, 5, 1]`
-
-Each of these values is an index into the charset array:
-
-`[3, 2, 0, 8, 7, 3, 5, 1]` => `[d, c, a, i, h, d, f, b]`
-
-This gives us our candidate password: `dcaihdfb` which can then be run through the rules of the policy.
-
-In a real world scenario, the values in the random array will be between `[0-255]` as that is the range of
-values that a single byte can be. The value is restricted to the size of the charset array by using the
-[modulo operation](https://en.wikipedia.org/wiki/Modulo_operation) to prevent referencing a character
-outside the bounds of the charset. However this can introduce a problem with bias.
-
-### Preventing bias
-
-When using the [modulo operation](https://en.wikipedia.org/wiki/Modulo_operation) to generate a password,
-you must be very careful to prevent the introduction of bias. When generating a random number between
-[0-255] for a charset that has a length that isn't evenly divisible into 256, some of the first characters
-in the charset may be selected more frequently than the remaining characters.
-
-To demonstrate this, let's simplify the math. Assume that we have a charset of length 10: `abcdefghij`.
-Let's also assume that our RNG generates values `[0-25]`. The first 10 values `0-9` correspond to each
-character in our charset. The next 10 values `10-19` also correspond to each character in our charset.
-However, the next 6 values `20-25` correspond to only the first 6 characters in the charset. This means
-that those 6 characters `abcdef` can be selected more often than the last 4 characters `ghij`.
-
-In order to prevent this from happening, we calculate the maximum value that we can allow an index to be.
-This is based on the length of the charset we are selecting from. In the example above, the maximum index
-value we should allow is 19 as that represents the largest integer multiple of the length of the charset
-array that is less than the maximum value that our RNG can generate. When our RNG generates any values
-larger than our maximum allowed value, that number is ignored and we continue to the next number. Passwords
-do not lose any length because we continue generating numbers until the password is fully filled in to the
-length requested.
-
-## Performance characteristics
-
-Characterizing password generation performance with this model is heavily dependent on the policy
-configuration. In short, the more restrictive the policy, the longer it will take to generate a password.
-This generalization isn't always true, but is a general guideline. The performance curve can be generalized:
-
-`(time to generate a candidate password) * (number of candidate passwords generated)`
-
-Where the number of times a candidate password needs to be generated is a function of how likely a given
-candidate password does not pass all of the rules.
-
-Here are some example policy configurations with their performance characteristics below. Each of these
-policies have the same charset that candidate passwords are generated from (94 characters). The only
-difference is the minimum number of characters for various character subsets.
-
-<details>
-<summary>No Minimum Characters</summary>
-
-```hcl
-rule "charset" {
-  charset = "abcdefghijklmnopqrstuvwxyz"
-}
-rule "charset" {
-  charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-}
-rule "charset" {
-  charset = "0123456789"
-}
-rule "charset" {
-  charset = "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"
-}
-```
-
-</details>
-
-<details>
-<summary>1 uppercase, 1 lowercase, 1 numeric</summary>
-
-```hcl
-rule "charset" {
-  charset = "abcdefghijklmnopqrstuvwxyz"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "0123456789"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"
-}
-```
-
-</details>
-
-<details>
-<summary>1 uppercase, 1 lowercase, 1 numeric, 1 from all ASCII characters</summary>
-
-```hcl
-rule "charset" {
-  charset = "abcdefghijklmnopqrstuvwxyz"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "0123456789"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"
-  min-chars = 1
-}
-```
-
-</details>
-
-<details>
-<summary>1 uppercase, 1 lowercase, 1 numeric, 1 from <code>!@#$</code></summary>
-
-```hcl
-rule "charset" {
-  charset = "abcdefghijklmnopqrstuvwxyz"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "0123456789"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "!@#$"
-  min-chars = 1
-}
-# Fleshes out the rest of the symbols but doesn't add any required characters
-rule "charset" {
-  charset = "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"
-}
-```
-
-</details>
-
-[![Password Policy Performance](/img/vault-password-policy-performance.svg)](/img/vault-password-policy-performance.svg)
-
-As more characters are generated, the amount of time increases (as seen in `No Minimum Characters`).
-This upward trend can be dwarfed by restricting charsets. When a password is short, the chances of a character
-being selected from a subset is smaller. For instance, if you have a 1 character password from the charset
-`abcde` the chances of selecting `c` from it is 1/5. However if you have a 2 character password, the chances
-of selecting `c` at least once are greater than 1/5 because you have a second chance to select `c` from
-the charset.
-
-In these examples, as the length of the password increases, the amount of time to generate a password trends
-down, levels off, and then slowly increases. This is a combination of the two effects listed above: increasing
-time to generate more characters vs the chances of the character subsets being selected. When a single subset is
-very small (such as `!@#$`) the chances of it being selected are much smaller (4/94) than if the subset is larger
-(26/94 for lowercase characters). This can result in a dramatic loss of performance.
-
-<details>
-<summary><b>Click here for more details on password generation probabilities</b></summary>
-
-In the examples above, the charset being used to generate candidate passwords is 94 characters long.
-Randomly choosing a given character from the 94 character charset has a 1/94 chance. Choosing a single
-character from it after N tries (where N is the length of the password) is `1-(1-1/94)^N`.
-
-If we expand this to look at a subset of characters (such as lowercase characters) the chances of selecting
-a character from that subset is `1-(1-L/94)^N` where `L` is the length of the subset. For lowercase
-characters, we get a probability of `1-(1-26/94)^N`.
-
-If we do this for uppercase letters as well as numbers, then we get a combined probability curve:
-
-`p = (1-(1-26/94)^N) * (1-(1-26/94)^N) * (1-(1-10/94)^N)`
-
-[![Chance of Generating a Good Password - 1](/img/vault-password-policy-chance.svg)](/img/vault-password-policy-chance.svg)
-
-It should be noted that this probability curve only applies to this specific policy. To understand the
-performance characteristics of a given policy, you should run your policy with the
-[`generate`](/vault/api-docs/system/policies-password) endpoint to see how much time the policy takes to
-produce passwords.
-
-</details>
-
-## Password policy syntax
-
-Password policies are defined in [HCL](https://github.com/hashicorp/hcl) or JSON which defines
-the length of the password and a set of rules a password must adhere to.
-
-See the [API docs](/vault/api-docs/system/policies-password) for examples of the commands to save/read/etc.
-password policies
-
-Here is a very simple policy which generates 20 character passwords from lowercase characters:
-
-```hcl
-length = 20
-rule "charset" {
-  charset = "abcdefghijklmnopqrstuvwxyz"
-}
-```
-
-Multiple rules may be specified, including multiple rules of the same type. For instance, the following
-policy will generate a 20 character password with at least one lowercase letter, at least one uppercase
-letter, at least one number, and at least one symbol from the set `!@#$%^&*`:
-
-```hcl
-length = 20
-rule "charset" {
-  charset = "abcdefghijklmnopqrstuvwxyz"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "0123456789"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "!@#$%^&*"
-  min-chars = 1
-}
-```
-
-At least one charset must be specified for a policy to be valid. In order to generate a password, a charset
-must be available to select characters from and password policies do not have a default charset.
-The following policy is **NOT** valid and will be rejected:
-
-```hcl
-length = 20
-```
-
-## Configuration & available rules
-
-### `length` parameter
-
-- `length` `(int: <required>)` - Specifies how long the generated password will be. Must be >= 4.
-
-Length is **not** a rule. It is the only part of the configuration that does not adhere to the guess-
-and-check approach of rules.
-
-### Rule `charset`
-
-Allows you to specify a minimum number of characters from a given charset. For instance: a password must
-have at least one lowercase letter. This rule also helps construct the charset that the password generation
-utilizes. In order to generate a password, a charset must be specified.
-
-If multiple charsets are specified, all of the charsets will be combined and de-duplicated prior to
-generating any candidate passwords. Each individual `charset` rule will still need to be adhered to in
-order to successfully generate passwords.
-
-~> After combining and de-duplicating charsets, the length of the charset that candidate passwords
-are generated from must be no longer than 256 characters.
-
-#### Parameters
-
-- `charset` `(string: <required>)` – A string representation of the character set that this rule observes.
-  Accepts UTF-8 compatible strings. All characters within the string must be printable.
-  Please note that the JSON output returned may be escaped for the special and control characters such as <,>,& etc as per the JSON specification.
-- `min-chars` `(int: 0)` - Specifies a minimum number of characters required from the charset specified in
-  this rule. For example: if `min-chars = 2`, the password must have at least 2 characters from `charset`.
-
-#### Example
-
-```hcl
-length = 20
-rule "charset" {
-  charset = "abcde"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "01234"
-  min-chars = 1
-}
-```
-
-This policy will generate passwords from the charset `abcde01234`. However, the password must have at
-least one character that is from `abcde` and at least one character from `01234`. If charsets overlap
-between rules, the charsets will be de-duplicated to prevent bias towards the overlapping set.
-For instance: if you have two charset rules: `abcde` & `cdefg`, the charset `abcdefg` will be used to
-generate candidate passwords, but a least one character from each `abcde` & `cdefg` must still appear
-in the password.
-
-If `min-chars` is not specified (or set to `0`) then this charset will not have a minimum required number
-of characters, but it will be used to select characters from. Example:
-
-```hcl
-length = 8
-rule "charset" {
-  charset = "abcde"
-}
-rule "charset" {
-  charset = "01234"
-  min-chars = 1
-}
-```
-
-This policy generates 8 character passwords from the charset `abcde01234` and requires at least one
-character from `01234` to be in it, but does not require any characters from `abcde`. The password
-`04031945` may result from this policy, even though no alphabetical characters are in it.
-
-## Default password policy
-
-Vault ships with a default password policy that applies to any password 
-generated by Vault without an explicit policy assignment. The default
-policy requires passwords include:
-
-- 20 characters total
-- 1 uppercase character
-- 1 lowercase character
-- 1 number
-- 1 special character
-
-
-```hcl
-length = 20
-
-rule "charset" {
-  charset = "abcdefghijklmnopqrstuvwxyz"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "0123456789"
-  min-chars = 1
-}
-rule "charset" {
-  charset = "-"
-  min-chars = 1
-}
-```
-
-
-
-## Tutorial
-
-Refer to [User Configurable Password Generation for Secret
-Engines](/vault/tutorials/policies/password-policies)
-for a step-by-step tutorial.
diff --git a/website/content/docs/concepts/pgp-gpg-keybase.mdx b/website/content/docs/concepts/pgp-gpg-keybase.mdx
deleted file mode 100644
index 300e76fc30c..00000000000
--- a/website/content/docs/concepts/pgp-gpg-keybase.mdx
+++ /dev/null
@@ -1,188 +0,0 @@
----
-layout: docs
-page_title: 'Using PGP, GnuPG, and Keybase'
-description: |-
-  Vault has the ability to integrate with OpenPGP-compatible programs like
-  GnuPG and services like Keybase.io to provide an additional layer of security
-  when performing certain operations.  This page details the various PGP
-  integrations, their use, and operation.
----
-
-# Using PGP, GnuPG, and keybase
-
-Vault has the ability to integrate with OpenPGP-compatible programs like GnuPG
-and services like Keybase.io to provide an additional layer of security when
-performing certain operations. This page details the various PGP integrations,
-their use, and operation.
-
-Keybase.io support is available only in the command-line tool and not via the
-Vault HTTP API, tools that help with initialization should use the Keybase.io
-API in order to obtain the PGP keys needed for a secure initialization if you
-want them to use Keybase for keys.
-
-Once the Vault has been initialized, it is possible to use Keybase to decrypt
-the shards and unseal normally.
-
-## Initializing with PGP
-
-One of the early fundamental problems when bootstrapping and initializing Vault
-was that the first user (the initializer) received a plain-text copy of all of
-the unseal keys. This defeats the promises of Vault's security model, and it
-also makes the distribution of those keys more difficult. Since Vault 0.3,
-Vault can optionally be initialized using PGP keys. In this mode, Vault will
-generate the unseal keys and then immediately encrypt them using the given
-users' public PGP keys. Only the owner of the corresponding private key is then
-able to decrypt the value, revealing the plain-text unseal key.
-
-First, you must create, acquire, or import the appropriate key(s) onto the
-local machine from which you are initializing Vault. This guide will not
-attempt to cover all aspects of PGP keys but give examples using two popular
-programs: Keybase and GnuPG.
-
-For beginners, we suggest using [Keybase.io](https://keybase.io/) ("Keybase")
-as it can be both simpler and has a number of useful behaviors and properties
-around key management, such as verification of users' identities using a number
-of public online sources. It also exposes the ability for users to have PGP
-keys generated, stored, and managed securely on their servers. Using Vault with
-Keybase will be discussed first as it is simpler.
-
-## Initializing with keybase
-
-To generate unseal keys for Keybase users, Vault accepts the `keybase:` prefix
-to the `-pgp-keys` argument:
-
-```shell-session
-$ vault operator init -key-shares=3 -key-threshold=2 \
-    -pgp-keys="keybase:jefferai,keybase:vishalnayak,keybase:sethvargo"
-```
-
-This requires far fewer steps than traditional PGP (e.g. with `gpg`) because
-Keybase handles a few of the tedious steps. The output will be the similar to
-the following:
-
-```
-Key 1: wcBMA37rwGt6FS1VAQgAk1q8XQh6yc...
-Key 2: wcBMA0wwnMXgRzYYAQgAavqbTCxZGD...
-Key 3: wcFMA2DjqDb4YhTAARAAeTFyYxPmUd...
-...
-```
-
-The output should be rather long in comparison to a regular unseal key. These
-keys are encrypted, and only the user holding the corresponding private key can
-decrypt the value. The keys are encrypted in the order in which specified in
-the `-pgp-keys` attribute. As such, the keys belong to respective Keybase
-accounts of `jefferai`, `vishalnayak`, and `sethvargo`. These keys can be
-distributed over almost any medium, although common sense and judgement are
-best advised. The encrypted keys are base64 encoded before returning.
-
-### Unsealing with keybase
-
-As a user, the easiest way to decrypt your unseal key is with the Keybase CLI
-tool. You can download it from [Keybase.io download
-page](https://keybase.io/download). After you have downloaded and configured
-the Keybase CLI, you are now tasked with entering your unseal key. To get the
-plain-text unseal key, you must decrypt the value given to you by the
-initializer. To get the plain-text value, run the following command:
-
-```shell-session
-$ echo "wcBMA37..." | base64 --decode | keybase pgp decrypt
-```
-
-And replace `wcBMA37...` with the encrypted key.
-
-You will be prompted to enter your Keybase passphrase. The output will be the
-plain-text unseal key.
-
-```
-6ecb46277133e04b29bd0b1b05e60722dab7cdc684a0d3ee2de50ce4c38a357101
-```
-
-This is your unseal key in plain-text and should be guarded the same way you
-guard a password. Now you can enter your key to the `unseal` command:
-
-```shell-session
-$ vault operator unseal
-Key (will be hidden): ...
-```
-
----
-
-## Initializing with GnuPG
-
-GnuPG is an open-source implementation of the OpenPGP standard and is available
-on nearly every platform. For more information, please see the [GnuPG
-manual](https://gnupg.org/gph/en/manual.html).
-
-To create a new PGP key, run, following the prompts:
-
-```shell-session
-$ gpg --gen-key
-```
-
-To import an existing key, download the public key onto disk and run:
-
-```shell-session
-$ gpg --import key.asc
-```
-
-Once you have imported the users' public keys, you need to save their values
-to disk as either base64 or binary key files. For example:
-
-```shell-session
-$ gpg --export 348FFC4C | base64 > seth.asc
-```
-
-These key files must exist on disk in base64 (the "standard" base64 character set,
-without ASCII armoring) or binary. Once saved to disk, the path to these files
-can be specified as an argument to the `-pgp-keys` flag.
-
-```shell-session
-$ vault operator init -key-shares=3 -key-threshold=2 \
-    -pgp-keys="jeff.asc,vishal.asc,seth.asc"
-```
-
-The result should look something like this:
-
-```
-Key 1: wcBMA37rwGt6FS1VAQgAk1q8XQh6yc...
-Key 2: wcBMA0wwnMXgRzYYAQgAavqbTCxZGD...
-Key 3: wcFMA2DjqDb4YhTAARAAeTFyYxPmUd...
-...
-```
-
-The output should be rather long in comparison to a regular unseal key. These
-keys are encrypted, and only the user holding the corresponding private key
-can decrypt the value. The keys are encrypted in the order in which specified
-in the `-pgp-keys` attribute. As such, the first key belongs to Jeff, the second
-to Vishal, and the third to Seth. These keys can be distributed over almost any
-medium, although common sense and judgement are best advised. The encrypted
-keys are base64 encoded before returning.
-
-### Unsealing with GnuPG
-
-Assuming you have been given an unseal key that was encrypted using your public
-PGP key, you are now tasked with entering your unseal key. To get the
-plain-text unseal key, you must decrypt the value given to you by the
-initializer. To get the plain-text value, run the following command:
-
-```shell-session
-$ echo "wcBMA37..." | base64 --decode | gpg -dq
-```
-
-And replace `wcBMA37...` with the encrypted key.
-
-If you encrypted your private PGP key with a passphrase, you may be prompted to
-enter it. After you enter your password, the output will be the plain-text
-key:
-
-```
-6ecb46277133e04b29bd0b1b05e60722dab7cdc684a0d3ee2de50ce4c38a357101
-```
-
-This is your unseal key in plain-text and should be guarded the same way you
-guard a password. Now you can enter your key to the `unseal` command:
-
-```shell-session
-$ vault operator unseal
-Key (will be hidden): ...
-```
diff --git a/website/content/docs/concepts/policies.mdx b/website/content/docs/concepts/policies.mdx
deleted file mode 100644
index ba6dcc24c3d..00000000000
--- a/website/content/docs/concepts/policies.mdx
+++ /dev/null
@@ -1,878 +0,0 @@
----
-layout: docs
-page_title: Policies
-description: >-
-  Policies are how authorization is done in Vault, allowing you to restrict
-  which parts of Vault a user can access.
----
-
-# Policies
-
-Everything in Vault is path-based, and policies are no exception. Policies
-provide a declarative way to grant or forbid access to certain paths and
-operations in Vault. This section discusses policy workflows and syntaxes.
-
-Policies are **deny by default**, so an empty policy grants no permission in the
-system.
-
-## Policy-authorization workflow
-
-Before a human or machine can gain access, an administrator must configure Vault
-with an [auth method](/vault/docs/concepts/auth). Authentication is
-the process by which human or machine-supplied information is verified against
-an internal or external system.
-
-Consider the following diagram, which illustrates the steps a security team
-would take to configure Vault to authenticate using a corporate LDAP or
-ActiveDirectory installation. Even though this example uses LDAP, the concept
-applies to all auth methods.
-
-[![Vault Auth Workflow](/img/vault-policy-workflow.svg)](/img/vault-policy-workflow.svg)
-
-1. The security team configures Vault to connect to an auth method.
-   This configuration varies by auth method. In the case of LDAP, Vault
-   needs to know the address of the LDAP server and whether to connect using TLS.
-   It is important to note that Vault does not store a copy of the LDAP database -
-   Vault will delegate the authentication to the auth method.
-
-1. The security team authors a policy (or uses an existing policy) which grants
-   access to paths in Vault. Policies are written in HCL in your editor of
-   preference and saved to disk.
-
-1. The policy's contents are uploaded and stored in Vault and referenced by name.
-   You can think of the policy's name as a pointer or symlink to its set of rules.
-
-1. Most importantly, the security team maps data in the auth method to a policy.
-   For example, the security team might create mappings like:
-
-   > Members of the OU group "dev" map to the Vault policy named "readonly-dev".
-
-   or
-
-   > Members of the OU group "ops" map to the Vault policies "admin" and "auditor".
-
-Now Vault has an internal mapping between a backend authentication system and
-internal policy. When a user authenticates to Vault, the actual authentication
-is delegated to the auth method. As a user, the flow looks like:
-
-[![Vault Auth Workflow](/img/vault-auth-workflow.svg)](/img/vault-auth-workflow.svg)
-
-1. A user attempts to authenticate to Vault using their LDAP credentials,
-   providing Vault with their LDAP username and password.
-
-1. Vault establishes a connection to LDAP and asks the LDAP server to verify the
-   given credentials. Assuming this is successful, the LDAP server returns the
-   information about the user, including the OU groups.
-
-1. Vault maps the result from the LDAP server to policies inside Vault using the
-   mapping configured by the security team in the previous section. Vault then
-   generates a token and attaches the matching policies.
-
-1. Vault returns the token to the user. This token has the correct policies
-   assigned, as dictated by the mapping configuration that was setup by the
-   security team in advance.
-
-The user then uses this Vault token for future operations. If the user performs
-the authentication steps again, they will get a _new_ token. The token will have
-the same permissions, but the actual token will be different. Authenticating a
-second time does not invalidate the original token.
-
-## Policy syntax
-
-Policies are written in [HCL][hcl] or JSON and describe which paths in Vault a
-user or machine is allowed to access.
-
-[hcl]: https://github.com/hashicorp/hcl
-
-Here is a very simple policy which grants read capabilities to the [KVv1](/vault/api-docs/secret/kv/kv-v1) path
-`"secret/foo"`:
-
-```hcl
-path "secret/foo" {
-  capabilities = ["read"]
-}
-```
-
-When this policy is assigned to a token, the token can read from `"secret/foo"`.
-However, the token cannot update or delete `"secret/foo"`, since the
-capabilities do not allow it. Because policies are **deny by default**, the
-token would have no other access in Vault.
-
-Here is a more detailed policy, and it is documented inline:
-
-```hcl
-# This section grants all access on "secret/*". further restrictions can be
-# applied to this broad policy, as shown below.
-path "secret/*" {
-  capabilities = ["create", "read", "update", "patch", "delete", "list"]
-}
-
-# Even though we allowed secret/*, this line explicitly denies
-# secret/super-secret. this takes precedence.
-path "secret/super-secret" {
-  capabilities = ["deny"]
-}
-
-# Policies can also specify allowed, disallowed, and required parameters. here
-# the key "secret/restricted" can only contain "foo" (any value) and "bar" (one
-# of "zip" or "zap").
-path "secret/restricted" {
-  capabilities = ["create"]
-  allowed_parameters = {
-    "foo" = []
-    "bar" = ["zip", "zap"]
-  }
-}
-```
-
-Policies use path-based matching to test the set of capabilities against a
-request. A policy `path` may specify an exact path to match, or it could specify
-a glob pattern which instructs Vault to use a prefix match:
-
-```hcl
-# Permit reading only "secret/foo". an attached token cannot read "secret/food"
-# or "secret/foo/bar".
-path "secret/foo" {
-  capabilities = ["read"]
-}
-
-# Permit reading everything under "secret/bar". an attached token could read
-# "secret/bar/zip", "secret/bar/zip/zap", but not "secret/bars/zip".
-path "secret/bar/*" {
-  capabilities = ["read"]
-}
-
-# Permit reading everything prefixed with "zip-". an attached token could read
-# "secret/zip-zap" or "secret/zip-zap/zong", but not "secret/zip/zap
-path "secret/zip-*" {
-  capabilities = ["read"]
-}
-```
-
-In addition, a `+` can be used to denote any number of characters bounded
-within a single path segment (this appeared in Vault 1.1):
-
-```hcl
-# Permit reading the "teamb" path under any top-level path under secret/
-path "secret/+/teamb" {
-  capabilities = ["read"]
-}
-
-# Permit reading secret/foo/bar/teamb, secret/bar/foo/teamb, etc.
-path "secret/+/+/teamb" {
-  capabilities = ["read"]
-}
-```
-
-Vault's architecture is similar to a filesystem. Every action in Vault has a
-corresponding path and capability - even Vault's internal core configuration
-endpoints live under the `"sys/"` path. Policies define access to these paths and
-capabilities, which controls a token's access to credentials in Vault.
-
-~> **Note:** The policy rules that Vault applies are determined by the most-specific match
-available, using the priority rules described below. This may be an exact match
-or the longest-prefix match of a glob. If the same pattern appears in multiple
-policies, we take the union of the capabilities. If different patterns appear in
-the applicable policies, we take only the highest-priority match from those
-policies.
-
-This means if you define a policy for `"secret/foo*"`, the policy would
-also match `"secret/foobar"`. Specifically, when there are potentially multiple
-matching policy paths, `P1` and `P2`, the following matching criteria is applied:
-
-1. If the first wildcard (`+`) or glob (`*`) occurs earlier in `P1`, `P1` is lower priority
-1. If `P1` ends in `*` and `P2` doesn't, `P1` is lower priority
-1. If `P1` has more `+` (wildcard) segments, `P1` is lower priority
-1. If `P1` is shorter, it is lower priority
-1. If `P1` is smaller lexicographically, it is lower priority
-
-For example, given the two paths, `"secret/*"` and `"secret/+/+/foo/*"`, the first
-wildcard appears in the same place, both end in `*` and the latter has two wildcard
-segments while the former has zero. So we end at rule (3), and give `"secret/+/+/foo/*"`
-_lower_ priority.
-
-!> **Informational:**The glob character referred to in this documentation is the asterisk (`*`).
-It _is not a regular expression_ and is only supported **as the last character of the path**!
-
-When providing `list` capability, it is important to note that since listing
-always operates on a prefix, policies must operate on a prefix because Vault
-will sanitize request paths to be prefixes.
-
-### Capabilities
-
-Each path must define one or more capabilities which provide fine-grained
-control over permitted (or denied) operations. As shown in the examples above,
-capabilities are always specified as a list of strings, even if there is only
-one capability.
-
-To determine the capabilities needed to perform a specific operation, the `-output-policy` flag can be added to the CLI subcommand. For an example, refer to the [Print Policy Requirements](/vault/docs/commands#print-policy-requirements) document section.
-
-The list of capabilities include the following:
-
-- `create` (`POST/PUT`) - Allows creating data at the given path. Very few
-  parts of Vault distinguish between `create` and `update`, so most operations
-  require both `create` and `update` capabilities. Parts of Vault that
-  provide such a distinction are noted in documentation.
-
-- `read` (`GET`) - Allows reading the data at the given path.
-
-- `update` (`POST/PUT`) - Allows changing the data at the given path. In most
-  parts of Vault, this implicitly includes the ability to create the initial
-  value at the path.
-
-- `patch` (`PATCH`) - Allows partial updates to the data at a given path.
-
-- `delete` (`DELETE`) - Allows deleting the data at the given path.
-
-- `list` (`LIST`) - Allows listing values at the given path. Note that the
-  keys returned by a `list` operation are _not_ filtered by policies. Do not
-  encode sensitive information in key names. Not all backends support listing.
-
-In the list above, the associated HTTP verbs are shown in parenthesis next to
-the capability. When authoring policy, it is usually helpful to look at the HTTP
-API documentation for the paths and HTTP verbs and map them back onto
-capabilities. While the mapping is not strictly 1:1, they are often very
-similarly matched.
-
-In addition to the standard set, there are some capabilities that do not map to
-HTTP verbs.
-
-- `sudo` - Allows access to paths that are _root-protected_. Tokens are not
-  permitted to interact with these paths unless they have the `sudo`
-  capability (in addition to the other necessary capabilities for performing
-  an operation against that path, such as `read` or `delete`).
-
-  For example, modifying the audit log backends requires a token with `sudo`
-  privileges.
-
-- `deny` - Disallows access. This always takes precedence regardless of any
-  other defined capabilities, including `sudo`.
-
-- `subscribe` - Allows subscribing to [events](/vault/docs/concepts/events)
-  for the given path.
-
-~> **Note:** Capabilities usually map to the HTTP verb, and not the underlying
-action taken. This can be a common source of confusion. Generating database
-credentials _creates_ database credentials, but the HTTP request is a GET which
-corresponds to a `read` capability. Thus, to grant access to generate database
-credentials, the policy would grant `read` access on the appropriate path.
-
-## Templated policies
-
-The policy syntax allows for doing variable replacement in some policy strings
-with values available to the token. Currently `identity` information can be
-injected, and currently the `path` keys in policies allow injection.
-
-### Parameters
-
-| Name                                                                             | Description                                                                           |
-| :------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------ |
-| `identity.entity.id`                                                             | The entity's ID                                                                       |
-| `identity.entity.name`                                                           | The entity's name                                                                     |
-| `identity.entity.metadata.<metadata key>`                                        | Metadata associated with the entity for the given key                                 |
-| `identity.entity.aliases.<mount accessor>.id`                                    | Entity alias ID for the given mount                                                   |
-| `identity.entity.aliases.<mount accessor>.name`                                  | Entity alias name for the given mount                                                 |
-| `identity.entity.aliases.<mount accessor>.metadata.<metadata key>`               | Metadata associated with the alias for the given mount and metadata key               |
-| `identity.entity.aliases.<mount accessor>.custom_metadata.<custom_metadata key>` | Custom metadata associated with the alias for the given mount and custom metadata key |
-| `identity.groups.ids.<group id>.name`                                            | The group name for the given group ID                                                 |
-| `identity.groups.names.<group name>.id`                                          | The group ID for the given group name                                                 |
-| `identity.groups.ids.<group id>.metadata.<metadata key>`                         | Metadata associated with the group for the given key                                  |
-| `identity.groups.names.<group name>.metadata.<metadata key>`                     | Metadata associated with the group for the given key                                  |
-
-### Examples
-
-The following policy creates a section of the KVv2 Secret Engine to a specific user
-
-```hcl
-path "secret/data/{{identity.entity.id}}/*" {
-  capabilities = ["create", "update", "patch", "read", "delete"]
-}
-
-path "secret/metadata/{{identity.entity.id}}/*" {
-  capabilities = ["list"]
-}
-```
-
-If you wanted to create a shared section of KV that is associated with entities that are in a
-group.
-
-```hcl
-# In the example below, the group ID maps a group and the path
-path "secret/data/groups/{{identity.groups.ids.fb036ebc-2f62-4124-9503-42aa7A869741.name}}/*" {
-  capabilities = ["create", "update", "patch", "read", "delete"]
-}
-
-path "secret/metadata/groups/{{identity.groups.ids.fb036ebc-2f62-4124-9503-42aa7A869741.name}}/*" {
-  capabilities = ["list"]
-}
-```
-
-~> **Note:** When developing templated policies, use IDs wherever possible. Each ID is
-unique to the user, whereas names can change over time and can be reused. This
-ensures that if a given user or group name is changed, the policy will be
-mapped to the intended entity or group.
-
-If you want to use the metadata associated with an authentication plugin in your
-templates, you will need to get its _mount accessor_ and access it via the
-`aliases` key.
-
-You can get the mount accessor value using the following command:
-
-```shellsession
-$> vault auth list
-Path           Type          Accessor                    Description
-----           ----          --------                    -----------
-kubernetes/    kubernetes    auth_kubernetes_xxxx        n/a
-token/         token         auth_token_yyyy             token based credentials
-```
-
-The following templated policy allow to read the path associated with the
-Kubernetes service account namespace of the identity:
-
-```hcl
-path "secret/data/{{identity.entity.aliases.auth_kubernetes_xxxx.metadata.service_account_namespace}}/*" {
-  capabilities = ["read"]
-}
-```
-
-## Fine-grained control
-
-In addition to the standard set of capabilities, Vault offers finer-grained
-control over permissions at a given path. The capabilities associated with a
-path take precedence over permissions on parameters.
-
-### Parameter constraints
-
-!> **Note:** The use of [globs](/vault/docs/concepts/policies#policy-syntax) (`*`) may result in [surprising or unexpected behavior](#parameter-constraints-limitations).
-
-~> **Note:** The `allowed_parameters`, `denied_parameters`, and `required_parameters` fields are not supported for policies used with the [version 2 kv secrets engine](/vault/docs/secrets/kv/kv-v2).
-
-See the [API Specification](/vault/api-docs/secret/kv/kv-v2) for more information.
-
-Policies can take into account HTTP request parameters to further
-constrain requests, using the following options:
-
-- `required_parameters` - A list of parameters that must be specified.
-
-  ```hcl
-  # This requires the user to create "secret/profile" with a parameter/key named
-  # "name" and "id" where kv v1 is enabled at "secret/".
-  path "secret/profile" {
-    capabilities = ["create"]
-    required_parameters = ["name", "id"]
-  }
-  ```
-
-- `allowed_parameters` - A list of keys and values that are
-  permitted on the given path.
-
-  - Setting a parameter with a value of the empty list allows the parameter to
-    contain any value.
-
-    ```hcl
-    # This allows the user to update the password parameter value set on any
-    # users configured for userpass auth method. The password value can be
-    # anything. However, the user cannot update other parameter values such as
-    # token_ttl.
-    path "auth/userpass/users/*" {
-      capabilities = ["update"]
-      allowed_parameters = {
-        "password" = []
-      }
-    }
-    ```
-
-    -> **Usage example:** The [ACL Policy Path
-    Templating](/vault/tutorials/policies/policy-templating)
-    tutorial demonstrates the use of `allowed_parameters` to permit a user to
-    update the user's password when using the [userpass auth
-    method](/vault/docs/auth/userpass) to log in with Vault.
-
-  - Setting a parameter with a value of a populated list allows the parameter
-    to contain only those values.
-
-    ```hcl
-    # This allows the user to create or update an encryption key for transit
-    # secrets engine enabled at "transit/". When you do, you can set the
-    # "auto_rotate_period" parameter value so that the key gets rotated.
-    # However, the rotation period must be "8h", "24h", or "5d". Any other value
-    # will result in an error.
-    path "transit/keys/*" {
-      capabilities = ["create", "update"]
-      allowed_parameters = {
-        "auto_rotate_period" = ["8h", "24h", "5d"]
-      }
-    }
-    ```
-
-  - If any keys are specified, all non-specified parameters will be denied
-    unless the parameter `"*"` is set to an empty array, which will
-    allow all other parameters to be modified. Parameters with specific values
-    will still be restricted to those values.
-
-    ```hcl
-    # When kv v1 secrets engine is enabled at "secret/", this allows the user to
-    # create "secret/foo" with a parameter named "bar". The parameter "bar" can
-    # only contain the values "zip" or "zap", but any other parameters may be
-    # created with any value.
-    path "secret/foo" {
-      capabilities = ["create"]
-      allowed_parameters = {
-        "bar" = ["zip", "zap"]
-        "*"   = []
-      }
-    }
-    ```
-
-- `denied_parameters` - A list of keys and values that are not permitted on the given
-  path. Any values specified here take precedence over `allowed_parameters`.
-
-  - Setting a parameter with a value of the empty list denies any changes to
-    that parameter.
-
-    ```hcl
-    # This allows the user to update the userpass auth method's user
-    # configurations (e.g., "password") but cannot update the "token_policies"
-    # and "policies" parameter values.
-    path "auth/userpass/users/*" {
-      capabilities = ["update"]
-      denied_parameters = {
-        "token_policies" = []
-        "policies" = []
-      }
-    }
-    ```
-
-  - Setting a parameter with a value of a populated list denies any parameter
-    containing those values.
-
-    ```hcl
-    # This allows the user to create or update token roles. However, the
-    # "allowed_policies" parameter value cannot be "admin", but the user can
-    # assign any other policies to the parameter.
-    path "auth/token/roles/*" {
-      capabilities = ["create", "update"]
-      denied_parameters = {
-        "allowed_policies" = ["admin"]
-      }
-    }
-    ```
-
-  - Setting to `"*"` will deny any parameter.
-
-    ```hcl
-    # This allows the user to create or update an encryption key for transit
-    # secrets engine enabled at "transit/". However, the user cannot set any of
-    # the configuration parameters. As a result, the created key will have all
-    # parameters set to default values.
-    path "transit/keys/*" {
-      capabilities = ["create", "update"]
-      denied_parameters = {
-        "*" = []
-      }
-    }
-    ```
-
-  - If any parameters are specified, all non-specified parameters are allowed,
-    unless `allowed_parameters` is also set, in which case normal rules apply.
-
-Parameter values also support prefix/suffix globbing. Globbing is enabled by
-prepending or appending or prepending a splat (`*`) to the value:
-
-```hcl
-# Only allow a parameter named "bar" with a value starting with "foo-*".
-path "secret/foo" {
-  capabilities = ["create"]
-  allowed_parameters = {
-    "bar" = ["foo-*"]
-  }
-}
-```
-
-~> **Note:** the only value that can be used with the `*` parameter is `[]`.
-
-#### Parameter constraints limitations
-
-##### Default values
-
-Evaluation of policies with `allowed_parameters`, `denied_parameters`, and `required_parameters` happens
-without consideration of parameters' default values.
-
-Given the following policy:
-
-```hcl
-# The "no_store" parameter cannot be false
-path "secret/foo" {
-  capabilities = ["create"]
-  denied_parameters = {
-    "no_store" = [false, "false"]
-  }
-}
-```
-
-The following operation will error, because "no_store" is set to false:
-
-```shell-session
-$ vault write secret/foo no_store=false value=bar
-```
-
-Whereas the following operation will succeed, even if the "no_store"
-parameter must be a boolean, and it defaults to false:
-
-```shell-session
-# Succeeds because "no_store=false" isn't present in the parameters
-$ vault write secret/foo value=bar
-```
-
-This is because the policy evaluator does not know what the default value is for
-the "no_store" parameter. All it sees is that the denied parameter isn't present
-in the command.
-
-This can be resolved by requiring the "no_store" parameter in your policy:
-
-```hcl
-path "secret/foo" {
-  capabilities = ["create"]
-  required_parameters = ["no_store"]
-  denied_parameters = {
-    "no_store" = [false, "false"]
-  }
-}
-```
-
-The following command, which previously succeeded, will now fail under the new policy
-because there is no "no_store" parameter:
-
-```shell-session
-$ vault write secret/foo value=bar
-```
-
-##### Globbing
-
-It's also important to note that the use of globbing may result in surprising
-or unexpected behavior:
-
-```hcl
-# This allows the user to create, update, or patch "secret/foo" with a parameter
-# named "bar". the values passed to parameter "bar" must start with "baz/"
-# so values like "baz/quux" are fine. however, values like
-# "baz/quux,wibble,wobble,wubble" would also be accepted. the API that
-# underlies "secret/foo" might allow comma delimited values for the "bar"
-# parameter, and if it did, specifying a value like
-# "baz/quux,wibble,wobble,wubble" would result in 4 different values getting
-# passed along. seeing values like "wibble" or "wobble" getting passed to
-# "secret/foo" might surprise someone that expected the allowed_parameters
-# constraint to only allow values starting with "baz/".
-path "secret/foo" {
-  capabilities = ["create", "update", "patch"]
-  allowed_parameters = {
-    "bar" = ["baz/*"]
-  }
-}
-```
-
-### Required response wrapping TTLs
-
-These parameters can be used to set minimums/maximums on TTLs set by clients
-when requesting that a response be
-[wrapped](/vault/docs/concepts/response-wrapping), with a granularity of a
-second. These use [duration format strings](/vault/docs/concepts/duration-format).
-
-In practice, setting a minimum TTL of one second effectively makes response
-wrapping mandatory for a particular path.
-
-- `min_wrapping_ttl` - The minimum allowed TTL that clients can specify for a
-  wrapped response. In practice, setting a minimum TTL of one second
-  effectively makes response wrapping mandatory for a particular path. It can
-  also be used to ensure that the TTL is not too low, leading to end targets
-  being unable to unwrap before the token expires.
-
-- `max_wrapping_ttl` - The maximum allowed TTL that clients can specify for a
-  wrapped response.
-
-```hcl
-# This effectively makes response wrapping mandatory for this path by setting min_wrapping_ttl to 1 second.
-# This also sets this path's wrapped response maximum allowed TTL to 90 seconds.
-path "auth/approle/role/my-role/secret-id" {
-    capabilities = ["create", "update"]
-    min_wrapping_ttl = "1s"
-    max_wrapping_ttl = "90s"
-}
-```
-
-If both are specified, the minimum value must be less than the maximum. In
-addition, if paths are merged from different stanzas, the lowest value
-specified for each is the value that will result, in line with the idea of
-keeping token lifetimes as short as possible.
-
-## Built-in policies
-
-Vault has two built-in policies: `default` and `root`. This section describes
-the two built-in policies.
-
-### Default policy
-
-The `default` policy is a built-in Vault policy that cannot be removed. By
-default, it is attached to all tokens, but may be explicitly excluded at token
-creation time by supporting authentication methods.
-
-The policy contains basic functionality such as the ability for the token to
-look up data about itself and to use its cubbyhole data. However, Vault is not
-prescriptive about its contents. It can be modified to suit your needs; Vault
-will never overwrite your modifications. If you want to stay up-to-date with
-the latest upstream version of the `default` policy, simply read the contents
-of the policy from an up-to-date `dev` server, and write those contents into
-your Vault's `default` policy.
-
-To view all permissions granted by the default policy on your Vault
-installation, run:
-
-```shell-session
-$ vault read sys/policy/default
-```
-
-To disable attachment of the default policy:
-
-```shell-session
-$ vault token create -no-default-policy
-```
-
-or via the API:
-
-```shell-session
-$ curl \
-  --request POST \
-  --header "X-Vault-Token: ..." \
-  --data '{"no_default_policy": "true"}' \
-  https://vault.hashicorp.rocks/v1/auth/token/create
-```
-
-### Root policy
-
-The `root` policy is a built-in Vault policy that cannot be modified or removed.
-Any user associated with this policy becomes a root user. A root user can do
-_anything_ within Vault. As such, it is **highly recommended** that you revoke
-any root tokens before running Vault in production.
-
-When a Vault server is first initialized, there always exists one root user.
-This user is used to do the initial configuration and setup of Vault. After
-configured, the initial root token should be revoked and more strictly
-controlled users and authentication should be used.
-
-To revoke a root token, run:
-
-```shell-session
-$ vault token revoke "<token>"
-```
-
-or via the API:
-
-```shell-session
-$ curl \
-  --request POST \
-  --header "X-Vault-Token: ..." \
-  --data '{"token": "<token>"}' \
-  https://vault.hashicorp.rocks/v1/auth/token/revoke
-```
-
-For more information, please read:
-
-- [Production Hardening](/vault/tutorials/operations/production-hardening)
-- [Generating a Root Token](/vault/tutorials/operations/generate-root)
-
-## Managing policies
-
-Policies are authored (written) in your editor of choice. They can be authored
-in HCL or JSON, and the syntax is described in detail above. Once saved,
-policies must be uploaded to Vault before they can be used.
-
-### Listing policies
-
-To list all registered policies in Vault:
-
-```shell-session
-$ vault read sys/policy
-```
-
-or via the API:
-
-```shell-session
-$ curl \
-  --header "X-Vault-Token: ..." \
-  https://vault.hashicorp.rocks/v1/sys/policy
-```
-
-~> **Note:** You may also see the CLI command `vault policies`. This is a convenience
-wrapper around reading the sys endpoint directly. It provides the same
-functionality but formats the output in a special manner.
-
-### Creating policies
-
-Policies may be created (uploaded) via the CLI or via the API. To create a new
-policy in Vault:
-
-```shell-session
-$ vault policy write policy-name policy-file.hcl
-```
-
-or via the API:
-
-```shell-session
-$ curl \
-  --request POST \
-  --header "X-Vault-Token: ..." \
-  --data '{"policy":"path \"...\" {...} "}' \
-  https://vault.hashicorp.rocks/v1/sys/policy/policy-name
-```
-
-In both examples, the name of the policy is "policy-name". You can think of this
-name as a pointer or symlink to the policy ACLs. Tokens are attached policies by
-name, which are then mapped to the set of rules corresponding to that name.
-
-### Updating policies
-
-Existing policies may be updated to change permissions via the CLI or via the
-API. To update an existing policy in Vault, follow the same steps as creating a
-policy, but use an existing policy name:
-
-```shell-session
-$ vault write sys/policy/my-existing-policy policy=@updated-policy.json
-```
-
-or via the API:
-
-```shell-session
-$ curl \
-  --request POST \
-  --header "X-Vault-Token: ..." \
-  --data '{"policy":"path \"...\" {...} "}' \
-  https://vault.hashicorp.rocks/v1/sys/policy/my-existing-policy
-```
-
-### Deleting policies
-
-Existing policies may be deleted via the CLI or API. To delete a policy:
-
-```shell-session
-$ vault delete sys/policy/policy-name
-```
-
-or via the API:
-
-```shell-session
-$ curl \
-  --request DELETE \
-  --header "X-Vault-Token: ..." \
-  https://vault.hashicorp.rocks/v1/sys/policy/policy-name
-```
-
-This is an idempotent operation. Vault will not return an error when deleting a
-policy that does not exist.
-
-## Associating policies
-
-Vault can automatically associate a set of policies to a token based on an
-authorization. This configuration varies significantly between authentication
-backends. For simplicity, this example will use Vault's built-in userpass
-auth method.
-
-A Vault administrator or someone from the security team would create the user in
-Vault with a list of associated policies:
-
-```shell-session
-$ vault write auth/userpass/users/sethvargo \
-    password="s3cr3t!" \
-    policies="dev-readonly,logs"
-```
-
-This creates an authentication mapping to the policy such that, when the user
-authenticates successfully to Vault, they will be given a token which has the list
-of policies attached.
-
-The user wishing to authenticate would run
-
-```shell-session
-$ vault login -method="userpass" username="sethvargo"
-Password (will be hidden): ...
-```
-
-If the provided information is correct, Vault will generate a token, assign the
-list of configured policies to the token, and return that token to the
-authenticated user.
-
-## Root protected API endpoints
-
-~> **Note:** Vault treats the HTTP POST and PUT verbs as equivalent, so for each mention
-of POST in the table below, PUT may also be used. Vault uses the non-standard LIST HTTP
-verb, but also allows list requests to be made using the GET verb along with `?list=true`
-as a query parameter, so for each mention of LIST in the table above, GET with `?list=true`
-may also be used.
-
-The following paths requires a root token or `sudo` capability in the policy:
-
-| Path                                                                                                                                                   | HTTP verb         | Description                                                                                                         |
-| ------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------- | ------------------------------------------------------------------------------------------------------------------- |
-| [auth/token/accessors](/vault/api-docs/auth/token#list-accessors)                                                                                      | LIST              | List token accessors for all current Vault service tokens                                                           |
-| [auth/token/create](/vault/api-docs/auth/token#create-token)                                                                                           | POST              | Create a periodic or an orphan token (`period` or `no_parent`) option                                               |
-| [auth/token/revoke-orphan](/vault/api-docs/auth/token#revoke-token-and-orphan-children)                                                                | POST              | Revoke a token but not its child tokens, which will be orphaned                                                     |
-| [pki/root](/vault/api-docs/secret/pki#delete-all-issuers-and-keys)                                                                                     | DELETE            | Delete the current CA key ([pki secrets engine](/vault/docs/secrets/pki))                                           |
-| [pki/root/sign-self-issued](/vault/api-docs/secret/pki#sign-self-issued)                                                                               | POST              | Use the configured CA certificate to sign a self-issued certificate ([pki secrets engine](/vault/docs/secrets/pki)) |
-| [sys/audit](/vault/api-docs/system/audit)                                                                                                              | GET               | List enabled audit devices                                                                                          |
-| [sys/audit/:path](/vault/api-docs/system/audit)                                                                                                        | POST, DELETE      | Enable or remove an audit device                                                                                    |
-| [sys/auth/:path](/vault/api-docs/system/auth)                                                                                                          | GET, POST, DELETE | Manage the auth methods (enable, read, and delete)                                                                  |
-| [sys/auth/:path/tune](/vault/api-docs/system/auth#tune-auth-method)                                                                                    | GET, POST         | Manage the auth methods (enable, read, delete, and tune)                                                            |
-| [sys/config/auditing/request-headers](/vault/api-docs/system/config-auditing)                                                                          | GET               | List the request headers that are configured to be audited                                                          |
-| [sys/config/auditing/request-headers/:name](/vault/api-docs/system/config-auditing)                                                                    | GET, POST, DELETE | Manage the auditing headers (create, update, read and delete)                                                       |
-| [sys/config/cors](/vault/api-docs/system/config-cors)                                                                                                  | GET, POST, DELETE | Configure CORS setting                                                                                              |
-| [sys/config/ui/headers](/vault/api-docs/system/config-ui)                                                                                              | GET, LIST         | Configure the UI settings                                                                                           |
-| [sys/config/ui/headers/:name](/vault/api-docs/system/config-ui#name)                                                                                   | POST, DELETE      | Configure custom HTTP headers to be served with the UI                                                              |
-| [sys/internal/inspect/router/:tag](/vault/api-docs/system/inspect/router)                                                                              | GET               | Inspect the internal components of Vault's router. `tag` must be one of root, uuid, accessor, or storage            |
-| [sys/leases/lookup/:prefix](/vault/api-docs/system/leases#list-leases)                                                                                 | LIST              | List lease IDs                                                                                                      |
-| [sys/leases/revoke-force/:prefix](/vault/api-docs/system/leases#revoke-force)                                                                          | POST              | Revoke all secrets or tokens ignoring backend errors                                                                |
-| [sys/leases/revoke-prefix/:prefix](/vault/api-docs/system/leases#revoke-prefix)                                                                        | POST              | Revoke all secrets generated under a given prefix                                                                   |
-| [sys/plugins/catalog/:type/:name](/vault/api-docs/system/plugins-catalog#register-plugin)                                                              | GET, POST, DELETE | Register a new plugin, or read/remove an existing plugin                                                            |
-| [sys/raw:path](/vault/api-docs/system/raw)                                                                                                             | GET, POST, DELETE | Used to access the raw underlying store in Vault                                                                    |
-| [sys/raw:prefix](/vault/api-docs/system/raw#list-raw)                                                                                                  | GET, LIST         | Returns a list keys for a given path prefix                                                                         |
-| [sys/remount](/vault/api-docs/system/remount)                                                                                                          | POST              | Moves an already-mounted backend to a new mount point                                                               |
-| [sys/replication/reindex](/vault/api-docs/system/replication#reindex-replication)                                                                      | POST              | Reindex the local data storage                                                                                      |
-| [sys/replication/performance/primary/secondary-token](/vault/api-docs/system/replication/replication-performance#generate-performance-secondary-token) | POST              | Generate a performance secondary activation token                                                                   |
-| [sys/replication/dr/primary/secondary-token](/vault/api-docs/system/replication/replication-dr#generate-dr-secondary-token)                            | POST              | Generate a DR secondary activation token                                                                            |
-| [sys/rotate](/vault/api-docs/system/rotate)                                                                                                            | POST              | Trigger a rotation of the backend encryption key                                                                    |
-| [sys/seal](/vault/api-docs/system/seal)                                                                                                                | POST              | Seals the Vault                                                                                                     |
-| [sys/step-down](/vault/api-docs/system/step-down)                                                                                                      | POST              | Forces a node to give up active status                                                                              |
-| [sys/storage/raft/snapshot-auto/config](/vault/api-docs/system/storage/raftautosnapshots#list-automated-snapshots-configs)                             | LIST              | Lists named configurations                                                                                          |
-| [sys/storage/raft/snapshot-auto/config/:name](/vault/api-docs/system/storage/raftautosnapshots)                                                        | GET, POST, DELETE | Creates or updates a named configuration                                                                            |
-
-### Tokens
-
-Tokens have two sets of policies: identity policies, which are computed
-based on the entity and its groups, and token policies, which are either defined
-based on the login method or, in the case of explicit token creates via the API,
-are an input to the token creation. What follows concerns token policies
-exclusively: a token's identity policies cannot be controlled except by modifying
-the underlying entities, groups, and group memberships.
-
-Tokens are associated with their policies at creation time. For example:
-
-```shell-session
-$ vault token create -policy=dev-readonly -policy=logs
-```
-
-Normally the only policies that may be specified are those which are present
-in the current token's (i.e. the new token's parent's) token policies.
-However, root users can assign any policies.
-
-There is no way to modify the policies associated with a token once the token
-has been issued. The token must be revoked and a new one acquired to receive a
-new set of policies.
-
-However, the _contents_ of policies are parsed in real-time whenever the token is used.
-As a result, if a policy is modified, the modified rules will be in force the
-next time a token, with that policy attached, is used to make a call to Vault.
-
-## Tutorial
-
-Refer to the following tutorials for further learning:
-
-- [Vault Policies](/vault/tutorials/policies/policies)
-- [ACL Policy Path Templating](/vault/tutorials/policies/policy-templating)
diff --git a/website/content/docs/concepts/recovery-mode.mdx b/website/content/docs/concepts/recovery-mode.mdx
deleted file mode 100644
index c46e8d530b8..00000000000
--- a/website/content/docs/concepts/recovery-mode.mdx
+++ /dev/null
@@ -1,77 +0,0 @@
----
-layout: docs
-page_title: Recovery Mode
-description: Recovery mode allows for doing surgery on a Vault that won't start.
----
-
-# Recovery mode
-
-Vault can be started using the `-recovery` flag to bring it up in Recovery Mode.
-The main purpose of recovery mode is to allow direct access to storage in case
-Vault isn't starting up due to some newly discovered bug.  This probably won't
-be helpful without a Vault expert on hand to advise.
-
-Differences between recovery mode and regular Vault operation:
-- none of the usual subsystems run, e.g. expiration, clustering, RPCs from other nodes
-- instead of a regular unseal request, unseal a node by generating a recovery token
-- all requests are to `sys/raw` and are authenticated using the recovery token
-
-## Recovery process
-
-The usual way recovery mode is used is:
-- seal or stop all nodes in the cluster
-- if using Integrated Storage, run `vault status` on each node to find the highest-index ones
-  (this will require they be running and sealed, as if unsealed a new leader might be
-  elected and writes could happen, confusing the issue)
-- restart the target node in recovery mode
-- generate a recovery token on that node
-- use the recovery token to perform sys/raw requests to repair the node
-- if using Integrated Storage, reform the raft cluster as described below
-
-## Integrated storage for HA only (ha_storage)
-
-If Integrated Storage is used in hybrid mode (i.e. for `ha_storage`),
-recovery mode will not allow for changes to the Raft data but instead allow for
-modification of the underlying physical data that is associated with Vault's
-storage backend.  This means that the notes regarding Integrated Storage in
-this doc do not apply.
-
-## Integrated storage
-
-With Integrated Storage, not all nodes are equal.  It's possible that some
-nodes are further behind - i.e. haven't applied as many Raft logs.  It is
-important when choosing a node to use for recovery that it has the highest
-AppliedIndex found in the cluster.
-
-Each node's AppliedIndex value can be obtained by running `vault status` against
-the node sealed nodes of the cluster after bringing it down.
-
-## Recovery tokens
-
-Recovery tokens are issued in much the same way as root tokens are generated,
-only using a different endpoint, and the Vault node must be sealed first.
-Unlike root tokens, the recovery token is not persisted, so if Vault
-is restarted into recovery mode a new one must be generated.
-
-Only a single recovery token can be generated. If lost, restart Vault and
-generate a new one.
-
-## Raw requests
-
-Requests can be issued to `sys/raw` in just the same way as in regular Vault
-server mode. The only difference is that in recovery mode, `X-Vault-Token`
-must contain a recovery token instead of a service or batch token.
-
-## Reform the raft cluster
-
-Recovery mode Vault automatically resizes the cluster to size 1.  This is
-necessary because the Raft protocol won't allow changes to be made without a
-quorum, and in recovery mode we wish to make changes using a single node.
-
-This means that after having used recovery mode, part of the procedure for
-returning to active service must include re-forming the raft cluster.  There
-are two ways to do so: either delete the vault data directory on the other nodes
-and re-join them to the recovered node, or use the
-[Manual Recovery Using peers.json](/vault/docs/concepts/integrated-storage#manual-recovery-using-peers-json)
-approach to get all nodes to agree on what nodes are part of the cluster.
-
diff --git a/website/content/docs/concepts/resource-quotas.mdx b/website/content/docs/concepts/resource-quotas.mdx
deleted file mode 100644
index 01b94126e27..00000000000
--- a/website/content/docs/concepts/resource-quotas.mdx
+++ /dev/null
@@ -1,78 +0,0 @@
----
-layout: docs
-page_title: Resource Quotas
-description: Providing measures against misbehaving applications and users overdrawing resources in Vault.
----
-
-# Resource quotas
-
-Every single interaction with Vault, whether to put secrets into the key/value
-store or to generate new pairs of database credentials for the MySQL database,
-needs to go through Vault’s API.
-
-One side effect of the API driven model is that applications and users can
-misbehave by overwhelming system resources through consistent and high volume API
-requests resulting in denial-of-service issues in some Vault nodes or even the
-entire Vault cluster. This risk is significantly increased when Vault API endpoints
-are exposed to thousands or millions of services deployed across a global infrastructure,
-especially in use cases of Vault where Vault is deployed as a service for internal
-developers.
-
-Vault provides a feature, resource quotas, that allows Vault operators to specify
-limits on resources used in Vault. Specifically, Vault allows operators to create
-and configure API rate limits. Users of Vault Enterprise have a second option, alongside
-rate limits, [lease-count quotas](/vault/docs/enterprise/lease-count-quotas), which can
-limit the number of leases that can be in use at one time.
-
-## Rate limit quotas
-
-Vault allows operators to create rate limit quotas which enforce API rate
-limiting using a [token bucket](https://en.wikipedia.org/wiki/Token_bucket) algorithm.
-A rate limit quota can be created at the root level or defined on a namespace,
-mount, or full API path by specifying a `path` when creating the quota. The rate
-limiter is applied to each unique client IP address on a per-node basis (i.e. rate limit
-quotas are not replicated). A client may invoke `rate` requests at any given second,
-after which they may invoke additional requests at `rate` per-second.
-
-A rate limit quota defined at the root level (i.e. empty `path`) is inherited by
-all namespaces and mounts. It acts as a single rate limiter for the entire Vault
-API. A rate limit quota defined on a namespace takes precedence over the global
-rate limit quota, a rate limit quota defined for a mount takes precedence over
-the global and namespace rate limit quotas, and a rate limit quota defined for
-a specific path will take precedence over global, namespace, and mount quotas.
-Additionally, quotas defined with a `role` to limit login requests made using
-that role on the specified auth mount will take precedence over all other quotas.
-In other words, the most specific quota rule will be applied.
-
-A rate limit can be created with an optional `block_interval`, such that when set
-to a non-zero value, any client that hits a rate limit threshold will be blocked
-from all subsequent requests for a duration of `block_interval` seconds.
-
-Vault also allows the inspection of the state of rate limiting in a Vault node
-through various [metrics](/vault/docs/internals/telemetry/metrics/core-system#quota-metrics) exposed
-and through enabling optional audit logging.
-
-## Exempt routes
-
-By default, the following paths are exempt from rate limiting. However, Vault
-operators can override the set of paths that are exempt from all rate limit
-resource quotas by updating the `rate_limit_exempt_paths` configuration field.
-
-- `sys/generate-recovery-token/attempt`
-- `sys/generate-recovery-token/update`
-- `sys/generate-root/attempt`
-- `sys/generate-root/update`
-- `sys/health`
-- `sys/seal-status`
-- `sys/unseal`
-
-## Tutorial
-
-Refer to [Protecting Vault with Resource
-Quotas](/vault/tutorials/operations/resource-quotas) for a
-step-by-step tutorial.
-
-## API
-
-Rate limit quotas can be managed over the HTTP API. Please see
-[Rate Limit Quotas API](/vault/api-docs/system/rate-limit-quotas) for more details.
diff --git a/website/content/docs/concepts/response-wrapping.mdx b/website/content/docs/concepts/response-wrapping.mdx
deleted file mode 100644
index 53b4c79243a..00000000000
--- a/website/content/docs/concepts/response-wrapping.mdx
+++ /dev/null
@@ -1,175 +0,0 @@
----
-layout: docs
-page_title: Response Wrapping
-description: Wrapping responses in cubbyholes for secure distribution.
----
-
-# Response wrapping
-
-_Note_: Some of this information relies on features of response-wrapping tokens
-introduced in Vault 0.8 and may not be available in earlier releases.
-
-## Overview
-
-In many Vault deployments, clients can access Vault directly and consume
-returned secrets. In other situations, it may make sense to or be desired to
-separate privileges such that one trusted entity is responsible for interacting
-with most of the Vault API and passing secrets to the end consumer.
-
-However, the more relays a secret travels through, the more possibilities for
-accidental disclosure, especially if the secret is being transmitted in
-plaintext. For instance, you may wish to get a TLS private key to a machine
-that has been cold-booted, but since you do not want to store a decryption key
-in persistent storage, you cannot encrypt this key in transit.
-
-To help address this problem, Vault includes a feature called _response
-wrapping_. When requested, Vault can take the response it would have sent to an
-HTTP client and instead insert it into the
-[`cubbyhole`](/vault/docs/secrets/cubbyhole) of a single-use token,
-returning that single-use token instead.
-
-Logically speaking, the response is
-wrapped by the token, and retrieving it requires an unwrap operation against
-this token. Functionally speaking, the token provides authorization to use
-an encryption key from Vault's keyring to decrypt the data.
-
-This provides a powerful mechanism for information sharing in many
-environments. In the types of scenarios, described above, often the best
-practical option is to provide _cover_ for the secret information, be able to
-_detect malfeasance_ (interception, tampering), and limit _lifetime_ of the
-secret's exposure. Response wrapping performs all three of these duties:
-
-- It provides _cover_ by ensuring that the value being transmitted across the
-  wire is not the actual secret but a reference to such a secret, namely the
-  response-wrapping token. Information stored in logs or captured along the
-  way do not directly see the sensitive information.
-- It provides _malfeasance detection_ by ensuring that only a single party can
-  ever unwrap the token and see what's inside. A client receiving a token that
-  cannot be unwrapped can trigger an immediate security incident. In addition,
-  a client can inspect a given token before unwrapping to ensure that its
-  origin is from the expected location in Vault.
-- It _limits the lifetime_ of secret exposure because the response-wrapping
-  token has a lifetime that is separate from the wrapped secret (and often can
-  be much shorter), so if a client fails to come up and unwrap the token, the
-  token can expire very quickly.
-
-## Response-Wrapping tokens
-
-When a response is wrapped, the normal API response from Vault does not contain
-the original secret, but rather contains a set of information related to the
-response-wrapping token:
-
-- TTL: The TTL of the response-wrapping token itself
-- Token: The actual token value
-- Creation Time: The time that the response-wrapping token was created
-- Creation Path: The API path that was called in the original request
-- Wrapped Accessor: If the wrapped response is an authentication response
-  containing a Vault token, this is the value of the wrapped token's accessor.
-  This is useful for orchestration systems (such as Nomad) to be able to control
-  the lifetime of secrets based on their knowledge of the lifetime of jobs,
-  without having to actually unwrap the response-wrapping token or gain
-  knowledge of the token ID inside.
-
-Vault currently does not provide signed response-wrapping tokens, as it
-provides little extra protection. If you are being pointed to the correct Vault
-server, token validation is performed by interacting with the server itself; a
-signed token does not remove the need to validate the token with the server,
-since the token is not carrying data but merely an access mechanism and the
-server will not release data without validating it. If you are being attacked
-and pointed to the wrong Vault server, the same attacker could trivially give
-you the wrong signing public key that corresponds to the wrong Vault server.
-You could cache a previously valid key, but could also cache a previously valid
-address (and in most cases the Vault address will not change or will be set via
-a service discovery mechanism). As such, we rely on the fact that the token
-itself is not carrying authoritative data and do not sign it.
-
-## Response-Wrapping token operations
-
-Via the `sys/wrapping` path, several operations can be run against wrapping
-tokens:
-
-- Lookup (`sys/wrapping/lookup`): This allows fetching the response-wrapping
-  token's creation time, creation path, and TTL. This path is unauthenticated
-  and available to response-wrapping tokens themselves. In other words, a
-  response-wrapping token holder wishing to perform validation is always
-  allowed to look up the properties of the token.
-- Unwrap (`sys/wrapping/unwrap`): Unwrap the token, returning the response
-  inside. The response that is returned will be the original wire-format
-  response; it can be used directly with API clients.
-- Rewrap (`sys/wrapping/rewrap`): Allows migrating the wrapped data to a new
-  response-wrapping token. This can be useful for long-lived secrets. For
-  example, an organization may wish (or be required in a compliance scenario)
-  to have the `pki` backend's root CA key be returned in a long-lived
-  response-wrapping token to ensure that nobody has seen the key (easily
-  verified by performing lookups on the response-wrapping token) but available
-  for signing CRLs in case they ever accidentally change or lose the `pki`
-  mount. Often, compliance schemes require periodic rotation of secrets, so
-  this helps achieve that compliance goal without actually exposing what's
-  inside.
-- Wrap (`sys/wrapping/wrap`): A helper endpoint that echoes back the data sent
-  to it in a response-wrapping token. Note that blocking access to this
-  endpoint does not remove the ability for arbitrary data to be wrapped, as it
-  can be done elsewhere in Vault.
-
-## Response-Wrapping token creation
-
-Response wrapping is per-request and is triggered by providing to Vault the
-desired TTL for a response-wrapping token for that request. This is set by the
-client using the `X-Vault-Wrap-TTL` header and can be either an integer number
-of seconds or a string duration of seconds (`15s`), minutes (`20m`), or hours
-(`25h`). When using the Vault CLI, you can set this via the `-wrap-ttl`
-parameter. When using the Go API, wrapping is triggered by [setting a helper
-function](https://godoc.org/github.com/hashicorp/vault/api#Client.SetWrappingLookupFunc)
-that tells the API the conditions under which to request wrapping, by mapping
-an operation and path to a desired TTL.
-
-If a client requests wrapping:
-
-1. The original HTTP response is serialized
-2. A new single-use token is generated with the TTL supplied by the client
-3. Internally, the original serialized response is stored in the single-use
-   token's cubbyhole
-4. A new response is generated, with the token ID, TTL, and path stored in the
-   new response's wrap information object
-5. The new response is returned to the caller
-
-Note that policies can control minimum/maximum wrapping TTLs; see the [policies
-concepts page](/vault/docs/concepts/policies) for
-more information.
-
-## Response-Wrapping token validation
-
-Proper validation of response-wrapping tokens is essential to ensure that any
-malfeasance is detected. It's also pretty straightforward.
-
-Validation is best performed by the following steps:
-
-1. If a client has been expecting delivery of a response-wrapping token and
-   none arrives, this may be due to an attacker intercepting the token and then
-   preventing it from traveling further. This should cause an alert to trigger
-   an immediate investigation.
-2. Perform a lookup on the response-wrapping token. This immediately tells you
-   if the token has already been unwrapped or is expired (or otherwise
-   revoked). If the lookup indicates that a token is invalid, it does not
-   necessarily mean that the data was intercepted (for instance, perhaps the
-   client took a long time to start up and the TTL expired) but should trigger
-   an alert for immediate investigation, likely with the assistance of Vault's
-   audit logs to see if the token really was unwrapped.
-3. With the token information in hand, validate that the creation path matches
-   expectations. If you expect to find a TLS key/certificate inside, chances
-   are the path should be something like `pki/issue/...`. If the path is not
-   what you expect, it is possible that the data contained inside was read and
-   then put into a new response-wrapping token. (This is especially likely if
-   the path starts with `cubbyhole` or `sys/wrapping/wrap`.) Particular care
-   should be taken with `kv` secrets engine: exact matches on the path are best
-   there. For example, if you expect a secret to come from `secret/foo` and
-   the interceptor provides a token with `secret/bar` as the path, simply
-   checking for a prefix of `secret/` is not enough.
-4. After prefix validation, unwrap the token. If the unwrap fails, the response
-   is similar to if the initial lookup fails: trigger an alert for immediate
-   investigation.
-
-Following those steps provides very strong assurance that the data contained
-within the response-wrapping token has never been seen by anyone other than the
-intended client and that any interception or tampering has resulted in a
-security alert.
diff --git a/website/content/docs/concepts/seal.mdx b/website/content/docs/concepts/seal.mdx
deleted file mode 100644
index 369b4ed2aea..00000000000
--- a/website/content/docs/concepts/seal.mdx
+++ /dev/null
@@ -1,393 +0,0 @@
----
-layout: docs
-page_title: Seal/Unseal
-description: >-
-  A Vault must be unsealed before it can access its data. Likewise, it can be
-  sealed to lock it down.
----
-
-# Seal/Unseal
-
-When a Vault server is started, it starts in a _sealed_ state. In this
-state, Vault is configured to know where and how to access the physical
-storage, but doesn't know how to decrypt any of it.
-
-_Unsealing_ is the process of obtaining the plaintext root key necessary to
-read the decryption key to decrypt the data, allowing access to the Vault.
-
-Prior to unsealing, almost no operations are possible with Vault. For
-example authentication, managing the mount tables, etc. are all not possible.
-The only possible operations are to unseal the Vault and check the status
-of the seal.
-
-## Why?
-
-The data stored by Vault is encrypted. Vault needs the _encryption key_ in order
-to decrypt the data. The encryption key is also stored with the data
-(in the _keyring_), but encrypted with another encryption key known as the _root key_.
-
-Therefore, to decrypt the data, Vault must decrypt the encryption key
-which requires the root key. Unsealing is the process of getting access to
-this root key. The root key is stored alongside all other Vault data,
-but is encrypted by yet another mechanism: the unseal key.
-
-To recap: most Vault data is encrypted using the encryption key in the keyring;
-the keyring is encrypted by the root key; and the root key is encrypted by
-the unseal key.
-
-## Shamir seals
-
-![Shahir seals](/img/vault-shamir-seal.png)
-
-The default Vault config uses a Shamir seal. Instead of distributing the unseal
-key as a single key to an operator, Vault uses an algorithm known as
-[Shamir's Secret Sharing](https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing)
-to split the key into shares. A certain threshold of shares is required to
-reconstruct the unseal key, which is then used to decrypt the root key.
-
-This is the _unseal_ process: the shares are added one at a time (in any
-order) until enough shares are present to reconstruct the key and
-decrypt the root key.
-
-## Unsealing
-
-The unseal process is done by running `vault operator unseal` or via the API.
-This process is stateful: each key can be entered via multiple mechanisms from
-multiple client machines and it will work. This allows each shares of the root
-key to be on a distinct client machine for better security.
-
-Note that when using the Shamir seal with multiple nodes, each node must be
-unsealed with the required threshold of shares. Partial unsealing of each node
-is not distributed across the cluster.
-
-Once a Vault node is unsealed, it remains unsealed until one of these things happens:
-
-1. It is resealed via the API (see below).
-
-2. The server is restarted.
-
-3. Vault's storage layer encounters an unrecoverable error.
-
--> **Note:** Unsealing makes the process of automating a Vault install
-difficult. Automated tools can easily install, configure, and start Vault,
-but unsealing it using Shamir is a very manual process. For most users
-Auto Unseal will provide a better experience.
-
-## Sealing
-
-There is also an API to seal the Vault. This will throw away the root
-key in memory and require another unseal process to restore it. Sealing
-only requires a single operator with root privileges.
-
-This way, if there is a detected intrusion, the Vault data can be locked
-quickly to try to minimize damages. It can't be accessed again without
-access to the root key shares.
-
-## Auto unseal
-
-Auto Unseal was developed to aid in reducing the operational complexity of
-keeping the unseal key secure. This feature delegates the responsibility of
-securing the unseal key from users to a trusted device or service. At startup
-Vault will connect to the device or service implementing the seal and ask it
-to decrypt the root key Vault read from storage.
-
-![Auto Unseal](/img/vault-auto-unseal.png)
-
-There are certain operations in Vault besides unsealing that
-require a quorum of users to perform, e.g. generating a root token. When
-using a Shamir seal the unseal keys must be provided to authorize these
-operations. When using Auto Unseal these operations require _recovery
-keys_ instead.
-
-Just as the initialization process with a Shamir seal yields unseal keys,
-initializing with an Auto Unseal yields recovery keys.
-
-It is still possible to seal a Vault node using the API. In this case Vault
-will remain sealed until restarted, or the unseal API is used, which with Auto
-Unseal requires the recovery key fragments instead of the unseal key fragments
-that would be provided with Shamir. The process remains the same.
-
-For a list of examples and supported providers, please see the
-[seal documentation](/vault/docs/configuration/seal).
-
--> **Warning:** Recovery keys cannot decrypt the root key, and thus are not
-sufficient to unseal Vault if the Auto Unseal mechanism isn't working. They
-are purely an authorization mechanism.  Using Auto Unseal 
-creates a strict Vault lifecycle dependency on the underlying seal mechanism. 
-This means that if the seal mechanism (such as the Cloud KMS key) becomes unavailable, 
-or deleted before the seal is migrated, then there is no ability to recover 
-access to the Vault cluster until the mechanism is available again. **If the seal 
-mechanism or its keys are permanently deleted, then the Vault cluster cannot be recovered, even
-from backups.**
-To mitigate this risk, we recommend careful controls around management of the seal
-mechanism, for example using 
-[AWS Service Control Policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html)
-or similar.  
-With Vault Enterprise secondary clusters (disaster or performance) can have a
-seal configured independently of the primary, and when properly configured guards 
-against *some* of this risk.  Unreplicated items such as local mounts could still 
-be lost.
-
-
-## Recovery key
-
-When Vault is initialized while using an HSM or KMS, rather than unseal keys
-being returned to the operator, recovery keys are returned. These are generated
-from an internal recovery key that is split via Shamir's Secret Sharing, similar
-to Vault's treatment of unseal keys when running without an HSM or KMS.
-
-Details about initialization and rekeying follow. When performing an operation
-that uses recovery keys, such as `generate-root`, selection of the recovery
-keys for this purpose, rather than the barrier unseal keys, is automatic.
-
-### Initialization
-
-When initializing, the split is performed according to the following CLI flags
-and their API equivalents in the [/sys/init](/vault/api-docs/system/init) endpoint:
-
-- `recovery-shares`: The number of shares into which to split the recovery
-  key. This value is equivalent to the `recovery_shares` value in the API
-  endpoint.
-- `recovery-threshold`: The threshold of shares required to reconstruct the
-  recovery key. This value is equivalent to the `recovery_threshold` value in
-  the API endpoint.
-- `recovery-pgp-keys`: The PGP keys to use to encrypt the returned recovery
-  key shares. This value is equivalent to the `recovery_pgp_keys` value in the
-  API endpoint, although as with `pgp_keys` the object in the API endpoint is
-  an array, not a string.
-
-Additionally, Vault will refuse to initialize if the option has not been set to
-generate a key, and no key is found. See
-[Configuration](/vault/docs/configuration/seal/pkcs11) for more details.
-
-### Rekeying
-
-#### Unseal key
-
-Vault's unseal key can be rekeyed using a normal `vault operator rekey`
-operation from the CLI or the matching API calls. The rekey operation is
-authorized by meeting the threshold of recovery keys. After rekeying, the new
-barrier key is wrapped by the HSM or KMS and stored like the previous key; it is not
-returned to the users that submitted their recovery keys.
-
-<EnterpriseAlert product="vault">
-  Seal wrapping requires Vault Enterprise
-</EnterpriseAlert>
-
-#### Recovery key
-
-The recovery key can be rekeyed to change the number of shares/threshold or to
-target different key holders via different PGP keys. When using the Vault CLI,
-this is performed by using the `-target=recovery` flag to `vault operator rekey`.
-
-Via the API, the rekey operation is performed with the same parameters as the
-[normal `/sys/rekey`
-endpoint](/vault/api-docs/system/rekey); however, the
-API prefix for this operation is at `/sys/rekey-recovery-key` rather than
-`/sys/rekey`.
-
-## Seal migration
-
-The Seal migration process cannot be performed without downtime, and due to the
-technical underpinnings of the seal implementations, the process requires that
-you briefly take the whole cluster down. While experiencing some downtime may
-be unavoidable, we believe that switching seals is a rare event and that the
-inconvenience of the downtime is an acceptable trade-off.
-
-~> **NOTE**: A backup should be taken before starting seal migration in case
-something goes wrong.
-
-~> **NOTE**: Seal migration operation will require both old and new seals to be
-available during the migration. For example, migration from Auto Unseal to Shamir
-seal will require that the service backing the Auto Unseal is accessible during
-the migration.
-
-~> **NOTE**: Seal migration from Auto Unseal to Auto Unseal of the same type is
-supported since Vault 1.6.0. However, there is a current limitation that
-prevents migrating from AWSKMS to AWSKMS; all other seal migrations of the same
-type are supported. Seal migration from One Auto Unseal type (AWS KMS) to
-different Auto Unseal type (HSM, Azure KMS, etc.) is also supported on older
-versions as well.
-
-### Migration post Vault 1.16.0 via Seal HA for Auto Seals (Enterprise)
-
-With Seal HA, migration between auto-unseal types (not including any Shamir
-seals) can be done fully online using Seal High Availability (Seal HA) without
-any downtime.
-
-1. Edit the Vault configuration, and add the new, target seal configuration.
-1. Send the Vault process the SIGHUP signal, triggering a configuration reload.
-1. Monitor the [`sys/sealwrap/rewrap`](/vault/api-docs/system/sealwrap-rewrap) endpoints,
-to see that rewrap is running, and/or [`sys/seal-backend-status`](/vault/api-docs/system/seal-backend-status),
-endpoints, waiting for `fully_wrapped` to be true, indicating all seal wrapped values are now
-wrapped by the new seal.  The logs also contain information about the rewrap progress.
-1. Edit the Vault configuration, removing the old seal configuration.
-1. Send the Vault process the SIGHUP signal, again allowing re-wrapping to complete.
-
-### Migration post Vault 1.5.1
-
-These steps are common for seal migrations between any supported kinds and for
-any storage backend.
-
-1. Take a standby node down and update the [seal
-   configuration](/vault/docs/configuration/seal).
-
-   - If the migration is from Shamir seal to Auto seal, add the desired new Auto
-     seal block to the configuration.
-   - If the migration is from Auto seal to Shamir seal, add `disabled = "true"`
-     to the old seal block.
-   - If the migration is from Auto seal to another Auto seal, add `disabled =
-     "true"` to the old seal block and add the desired new Auto seal block.
-
-   Now, bring the standby node back up and run the unseal command on each key, by
-   supplying the `-migrate` flag.
-
-   - Supply Shamir unseal keys if the old seal was Shamir, which will be migrated
-     as the recovery keys for the Auto seal.
-   - Supply recovery keys if the old seal is one of Auto seals, which will be
-     migrated as the recovery keys of the new Auto seal, or as Shamir unseal
-     keys if the new seal is Shamir.
-
-1. Perform step 1 for all the standby nodes, one at a time. It is necessary to
-   bring back the downed standby node before moving on to the other standby nodes,
-   specifically when Integrated Storage is in use for it helps to retain the
-   quorum.
-
-1. [Step down](/vault/docs/commands/operator/step-down) the
-   active node. One of the standby nodes will become the new active node.
-   When using Integrated Storage, ensure that quorum is reached and a leader is
-   elected.
-
-1. The new active node will perform the migration. Monitor the server log in
-   the active node to witness the completion of the seal migration process.
-   Wait for a little while for the migration information to replicate to all the
-   nodes in case of Integrated Storage. In enterprise Vault, switching an Auto seal
-   implies that the seal wrapped storage entries get re-wrapped. Monitor the log
-   and wait until this process is complete (look for `seal re-wrap completed`).
-
-1. Seal migration is now completed. Take down the old active node, update its
-   configuration to use the new seal blocks (completely unaware of the old seal type)
-   ,and bring it back up. It will be auto-unsealed if the new seal is one of the
-   Auto seals, or will require unseal keys if the new seal is Shamir.
-
-1. At this point, configuration files of all the nodes can be updated to only have the
-   new seal information. Standby nodes can be restarted right away and the active
-   node can be restarted upon a leadership change.
-
-### Migration pre 1.5.1
-
-#### Migration from shamir to auto unseal
-
-To migrate from Shamir keys to Auto Unseal, take your server cluster offline and
-update the [seal configuration](/vault/docs/configuration/seal) with the appropriate
-seal configuration. Bring your server back up and leave the rest of the nodes
-offline if using multi-server mode, then run the unseal process with the
-`-migrate` flag and bring the rest of the cluster online.
-
-All unseal commands must specify the `-migrate` flag. Once the required
-threshold of unseal keys are entered, unseal keys will be migrated to recovery
-keys.
-
-`$ vault operator unseal -migrate`
-
-#### Migration from auto unseal to shamir
-
-To migrate from Auto Unseal to Shamir keys, take your server cluster offline
-and update the [seal configuration](/vault/docs/configuration/seal) and add `disabled
-= "true"` to the seal block. This allows the migration to use this information
-to decrypt the key but will not unseal Vault. When you bring your server back
-up, run the unseal process with the `-migrate` flag and use the Recovery Keys
-to perform the migration. All unseal commands must specify the `-migrate` flag.
-Once the required threshold of recovery keys are entered, the recovery keys
-will be migrated to be used as unseal keys.
-
-#### Migration from auto unseal to auto unseal
-
-~> **NOTE**: Migration between same Auto Unseal types is supported in Vault
-1.6.0 and higher. For these pre-1.5.1 steps, it is only possible to migrate from
-one type of Auto Unseal to a different type (ie Transit -> AWSKMS).
-
-To migrate from Auto Unseal to a different Auto Unseal configuration, take your
-server cluster offline and update the existing [seal
-configuration](/vault/docs/configuration/seal) and add `disabled = "true"` to the seal
-block. Then add another seal block to describe the new seal.
-
-When you bring your server back up, run the unseal process with the `-migrate`
-flag and use the Recovery Keys to perform the migration. All unseal commands
-must specify the `-migrate` flag. Once the required threshold of recovery keys
-are entered, the recovery keys will be kept and used as recovery keys in the new
-seal.
-
-#### Migration with integrated storage
-
-Integrated Storage uses the Raft protocol underneath, which requires a quorum of
-servers to be online before the cluster is functional. Therefore, bringing the
-cluster back up one node at a time with the seal configuration updated, will not
-work in this case. Follow the same steps for each kind of migration described
-above with the exception that after the cluster is taken offline, update the
-seal configurations of all the nodes appropriately and bring them all back up.
-When the quorum of nodes are back up, Raft will elect a leader and the leader
-node that will perform the migration. The migrated information will be replicated to
-all other cluster peers and when the peers eventually become the leader,
-migration will not happen again on the peer nodes.
-
-## Seal High Availability (Enterprise)
-
-Seal High Availability (Seal HA) allows the configuration of more than one auto 
-seal mechanism such that Vault can tolerate the temporary loss of a seal service 
-or device for a time.  With Seal HA configured with at least two and no more than
-three auto seals, Vault can also start up and unseal if one of the 
-configured seals is still available (though Vault will remain in a degraded mode in 
-this case). While seals are unavailable, seal wrapping and entropy augmentation can 
-still occur using the remaining seals, and values produced while a seal is down will
-be re-wrapped with all the seals when all seals become healthy again.
-
-An operator should choose two seals that are unlikely to become unavailable at the 
-same time.  For example, they may choose KMS keys in two cloud regions, from
-two different providers; or a mix of HSM, KMS, or Transit seals.
-
-When an operator configures an additional seal or removes a seal (one at a time)
-and restarts or triggers a configuration reload on receipt of a `SIGHUP` signal, 
-Vault will automatically detect that it needs to re-wrap CSPs and seal wrapped
-values, and will start the process.  Seal re-wrapping can be monitored via the 
-logs or via the `sys/seal-status` endpoint.  While a re-wrap is in progress (or 
-could not complete successfully), changes to the seal configuration are not 
-allowed.
-
-In additional to high availability, Seal HA can be used to migrate between two 
-auto seals in a [simplified manner.](#migration-post-vault-1-16-0-via-seal-ha-for-auto-seals-enterprise)
-
-### Use and Configuration
-
-Refer to the [configuration](/vault/docs/configuration/seal/seal-ha) section
-for details on configuring Seal HA.
-
-### Seal Re-Wrapping
-
-Whenever seal configuration changes, Vault must re-wrap all CSPs and seal
-wrapped values, to ensure each value has an entry encrypted by all configured
-seals.  Vault detects these configuration changes automatically, and triggers
-a re-wrap.  Re-wraps can take some time, depending on the number of
-seal wrapped values.  While re-wrapping is in progress, no configuration changes
-to the seals can be made.
-
-Progress of the re-wrap can be monitored using 
-the [`sys/sealwrap/rewrap`](/vault/api-docs/system/sealwrap-rewrap) endpoint.
-
-### Limitations and Known Issues
-
-In order to limit complexity and increase safety, there are some limitations
-to the use and configuration of Seal HA:
-
-* Vault must be configured for a single seal at the time of initialization.
-Extra seals can then be added.
-* Seals must be added or removed one at a time.
-* Only auto seals can be used in HA configurations.  Shamir and auto cannot
-be mixed.
-* A maximum of three seals can be configured.
-* As seal wrapped values must be wrapped by all configured seals, it is possible
-that large values may fail to persist as the size of the entry is multiplied by 
-the number of seals causing it to exceed the storage entry size limit.   An example
-would be storing a large document in KVv2 with seal wrapping enabled.
-
-
diff --git a/website/content/docs/concepts/storage.mdx b/website/content/docs/concepts/storage.mdx
deleted file mode 100644
index 408e8b4708c..00000000000
--- a/website/content/docs/concepts/storage.mdx
+++ /dev/null
@@ -1,114 +0,0 @@
----
-layout: docs
-page_title: Storage
-sidebar_title: Storage
-description: >-
-  Vault relies on external storage to save its durable information.
----
-
-# Storage
-
-As described on our [Architecture](/vault/docs/internals/architecture) page, Vault's
-storage backend is untrusted storage used purely to keep encrypted information.
-
-## Supported storage backends
-
-@include 'ent-supported-storage.mdx'
-
-Many other options for storage are available with community support for Vault - see our
-[Storage Configuration](/vault/docs/configuration/storage) section for more
-information.
-
--> **Choosing a storage backend:** Refer to the [integrated storage vs. external
-storage](/vault/docs/configuration/storage#integrated-storage-vs-external-storage)
-section of the storage configuration page to help make a decision about which
-storage backend to use.
-
-## Backups
-
-Due to the highly flexible nature of Vault's potential storage configurations,
-providing exact guidance on backing up Vault is challenging.
-
-When backing up Vault, there are two pieces to consider:
-
-1. Vault's encrypted data in the storage backend
-2. Configuration files and management scripts for running the Vault server
-
-There's also a big question - what is the error case you're trying to guard
-against by saving a backup?
-
-### The big question - why take backups?
-
-It's important to consider the question of "why take a backup" while developing
-your ongoing backup and disaster recovery strategy.
-
-Taking a backup is recommended prior to upgrades, as downgrading Vault storage
-is not always possible. Generally, a backup is recommended any time a major
-change is planned for a cluster.
-
-More specifically, we recommend taking backups **before**, but not during, write
-operations to the `/sys` API (excluding the `/sys/leases`, `/sys/namespaces`,
-`/sys/tools`, `/sys/wrapping`, `/sys/policies`, and `/sys/pprof` endpoints).
-Some examples of workflows that write to the `/sys` API are upgrades and rekeys.
-In the future, this guidance may change for the Integrated Storage backend.
-
-Backups _can_ also help with accidental data deletions or modifications. In
-this case, the story can get a little tricky. If you simply recover a backup
-from 5AM with the correct data, but the current time is 10AM, you will lose data
-written between 5 and 10AM. Lucy Davinhart gave a HashiConf talk that serves as
-an interesting [case
-study](https://www.hashicorp.com/resources/oh-no-i-deleted-my-vault-secret).
-
-We do not recommend backups as protection against the failure of an individual
-machine. Vault servers can run in clusters, so to protect against server
-failure, we recommend running Vault in [HA
-mode](/vault/docs/internals/high-availability). With community features, a
-Vault cluster can extend across multiple availability zones within a region.
-
-Vault Enterprise supports replicated clusters and disaster recovery for data
-center failure. When using Vault Community Edition in [HA
-Mode](/vault/docs/internals/high-availability), a backup can help guard against the
-failure of a data center.
-
-Ultimately, backups are not a replacement for running in HA, or for using
-replication with Vault Enterprise. As you develop a plan for recovering from or
-guarding against failure, you should consider both backups and HA as critical
-components of that plan.
-
-### Backing up vault's persisted data
-
-Backups and restores are ideally performed while Vault is offline. If offline
-backups are not feasible, we recommend using a storage backend that supports
-atomic snapshots (such as
-[Consul](/consul/commands/snapshot) or [Integrated
-Storage](/vault/docs/commands/operator/raft#snapshot)).
-
-~> If your storage backend does not support atomic snapshots, we recommend only
-taking offline backups.
-
-To perform a backup or restore of Vault's encrypted data when using a
-HashiCorp-supported storage backend, see the instructions linked below. For
-other storage backends, follow the documentation of that backend for taking and
-restoring backups.
-
-- Integrated Storage [snapshots](/vault/docs/commands/operator/raft#snapshot)
-- Consul [snapshots](/consul/commands/snapshot)
-
-#### Backing up multiple clusters
-
-If you are using Vault Enterprise [Performance
-Replication](/vault/docs/enterprise/replication#performance-replication-and-disaster-recovery-dr-replication),
-you should plan to take backups of the active node on each of your clusters.
-
-### Configuration
-
-In addition to backing up Vault's encrypted data via the storage backend, you
-may also wish to save the server configuration files, any scripts for managing
-the Vault service, and ensure you can reinstall any user-installed plugins. The
-location of these files will be specific to your installation of Vault.
-
-~> **NOTE**: Although a backup or snapshot of Vault's data from the storage
-backend is encrypted, some of your configuration may be sensitive (a Vault token
-for Transit Autounseal or a TLS private key in your configuration, for example).
-The presence of this information in your backups will mean that they may need
-to be carefully protected.
diff --git a/website/content/docs/concepts/tokens.mdx b/website/content/docs/concepts/tokens.mdx
deleted file mode 100644
index 9f702da6a33..00000000000
--- a/website/content/docs/concepts/tokens.mdx
+++ /dev/null
@@ -1,289 +0,0 @@
----
-layout: docs
-page_title: Tokens
-description: Tokens are a core auth method in Vault. Concepts and important features.
----
-
-# Tokens
-
-<Warning heading="Internal token structure is volatile">
-  Tokens are opaque values so their structure is undocumented and subject to change.
-  Scripts and automations that rely on the internal structure of a token in scripts will break.
-</Warning>
-
-Tokens are the core method for _authentication_ within Vault. Tokens
-can be used directly or [auth methods](/vault/docs/concepts/auth)
-can be used to dynamically generate tokens based on external identities.
-
-If you've gone through the getting started guide, you probably noticed that
-`vault server -dev` (or `vault operator init` for a non-dev server) outputs an
-initial "root token." This is the first method of authentication for Vault.
-It is also the only auth method that cannot be disabled.
-
-As stated in the [authentication concepts](/vault/docs/concepts/auth),
-all external authentication mechanisms, such as GitHub, map down to dynamically
-created tokens. These tokens have all the same properties as a normal manually
-created token.
-
-Within Vault, tokens map to information. The most important information mapped
-to a token is a set of one or more attached
-[policies](/vault/docs/concepts/policies). These policies control what the token
-holder is allowed to do within Vault. Other mapped information includes
-metadata that can be viewed and is added to the audit log, such as creation
-time, last renewal time, and more.
-
-Read on for a deeper dive into token concepts.  See the
-[tokens tutorial](/vault/tutorials/tokens/tokens)
-for details on how these concepts play out in practice.
-
-## Token types
-
-As of Vault 1.0, there are two types of tokens: `service` tokens and `batch`
-tokens. A section near the bottom of this page contains detailed information
-about their differences, but it is useful to understand other token concepts
-first. The features in the following sections all apply to service tokens, and
-their applicability to batch tokens is discussed later.
-
-## The token store
-
-Often in documentation or in help channels, the "token store" is referenced.
-This is the same as the [`token` authentication
-backend](/vault/docs/auth/token). This is a special
-backend in that it is responsible for creating and storing tokens, and cannot
-be disabled. It is also the only auth method that has no login
-capability -- all actions require existing authenticated tokens.
-
-## Root tokens
-
-Root tokens are tokens that have the `root` policy attached to them. Root
-tokens can do anything in Vault. _Anything_. In addition, they are the only
-type of token within Vault that can be set to never expire without any renewal
-needed. As a result, it is purposefully hard to create root tokens; in fact
-there are only three ways to create root tokens:
-
-1. The initial root token generated at `vault operator init` time -- this token has no
-   expiration
-1. By using another root token; a root token with an expiration cannot create a
-   root token that never expires
-1. By using `vault operator generate-root` ([example](/vault/tutorials/operations/generate-root))
-   with the permission of a quorum of unseal key holders
-
-Root tokens are useful in development but should be extremely carefully guarded
-in production. In fact, the Vault team recommends that root tokens are only
-used for just enough initial setup (usually, setting up auth methods
-and policies necessary to allow administrators to acquire more limited tokens)
-or in emergencies, and are revoked immediately after they are no longer needed.
-If a new root token is needed, the `operator generate-root` command and associated
-[API endpoint](/vault/api-docs/system/generate-root) can be used to generate one on-the-fly.
-
-It is also good security practice for there to be multiple eyes on a terminal
-whenever a root token is live. This way multiple people can verify as to the
-tasks performed with the root token, and that the token was revoked immediately
-after these tasks were completed.
-
-## Token hierarchies and orphan tokens
-
-Normally, when a token holder creates new tokens, these tokens will be created
-as children of the original token; tokens they create will be children of them;
-and so on. When a parent token is revoked, all of its child tokens -- and all
-of their leases -- are revoked as well. This ensures that a user cannot escape
-revocation by simply generating a never-ending tree of child tokens.
-
-Often this behavior is not desired, so users with appropriate access can create
-`orphan` tokens. These tokens have no parent -- they are the root of their own
-token tree. These orphan tokens can be created:
-
-1. Via `write` access to the `auth/token/create-orphan` endpoint
-1. By having `sudo` or `root` access to the `auth/token/create`
-   and setting the `no_parent` parameter to `true`
-1. Via token store roles
-1. By logging in with any other (non-`token`) auth method
-
-Users with appropriate permissions can also use the `auth/token/revoke-orphan`
-endpoint, which revokes the given token but rather than revoke the rest of the
-tree, it instead sets the tokens' immediate children to be orphans. Use with
-caution!
-
-## Token accessors
-
-When tokens are created, a token accessor is also created and returned. This
-accessor is a value that acts as a reference to a token and can only be used to
-perform limited actions:
-
-1. Look up a token's properties (not including the actual token ID)
-1. Look up a token's capabilities on a path
-1. Renew the token
-1. Revoke the token
-
-The token _making the call_, _not_ the token associated with the accessor, must
-have appropriate permissions for these functions.
-
-There are many useful workflows around token accessors. As an example, a
-service that creates tokens on behalf of another service (such as the
-[Nomad](https://www.nomadproject.io/) scheduler) can store the accessor
-correlated with a particular job ID. When the job is complete, the accessor can
-be used to instantly revoke the token given to the job and all of its leased
-credentials, limiting the chance that a bad actor will discover and use them.
-
-Audit devices can optionally be set to not obfuscate token accessors in audit
-logs. This provides a way to quickly revoke tokens in case of an emergency.
-However, it also means that the audit logs can be used to perform a larger-scale
-denial of service attack.
-
-Finally, the only way to "list tokens" is via the `auth/token/accessors`
-command, which actually gives a list of token accessors. While this is still a
-dangerous endpoint (since listing all of the accessors means that they can then
-be used to revoke all tokens), it also provides a way to audit and revoke the
-currently-active set of tokens.
-
-## Token Time-To-Live, periodic tokens, and explicit max TTLs
-
-Every non-root token has a time-to-live (TTL) associated with it, which is a
-current period of validity since either the token's creation time or last
-renewal time, whichever is more recent. (Root tokens may have a TTL associated,
-but the TTL may also be 0, indicating a token that never expires). After the
-current TTL is up, the token will no longer function -- it, and its associated
-leases, are revoked.
-
-If the token is renewable, Vault can be asked to extend the token validity
-period using `vault token renew` or the appropriate renewal endpoint. At this
-time, various factors come into play. What happens depends upon whether the
-token is a periodic token (available for creation by `root`/`sudo` users, token
-store roles, or some auth methods), has an explicit maximum TTL
-attached, or neither.
-
-### The general case
-
-In the general case, where there is neither a period nor explicit maximum TTL
-value set on the token, the token's lifetime since it was created will be
-compared to the maximum TTL. This maximum TTL value is dynamically generated
-and can change from renewal to renewal, so the value cannot be displayed when a
-token's information is looked up. It is based on a combination of factors:
-
-1. The system max TTL, which is 32 days but can be changed in Vault's
-   configuration file.
-1. The max TTL set on a mount using [mount
-   tuning](/vault/api-docs/system/mounts). This value
-   is allowed to override the system max TTL -- it can be longer or shorter,
-   and if set this value will be respected.
-1. A value suggested by the auth method that issued the token. This
-   might be configured on a per-role, per-group, or per-user basis. This value
-   is allowed to be less than the mount max TTL (or, if not set, the system max
-   TTL), but it is not allowed to be longer.
-
-Note that the values in (2) and (3) may change at any given time, which is why
-a final determination about the current allowed max TTL is made at renewal time
-using the current values. It is also why it is important to always ensure that
-the TTL returned from a renewal operation is within an allowed range; if this
-value is not extending, likely the TTL of the token cannot be extended past its
-current value and the client may want to reauthenticate and acquire a new
-token. However, outside of direct operator interaction, Vault will never revoke
-a token before the returned TTL has expired.
-
-### Explicit max TTLs
-
-Tokens can have an explicit max TTL set on them. This value becomes a hard
-limit on the token's lifetime -- no matter what the values in (1), (2), and (3)
-from the general case are, the token cannot live past this explicitly-set
-value. This has an effect even when using periodic tokens to escape the normal
-TTL mechanism.
-
-### Periodic tokens
-
-In some cases, having a token be revoked would be problematic -- for instance,
-if a long-running service needs to maintain its SQL connection pool over a long
-period of time. In this scenario, a periodic token can be used. Periodic tokens
-can be created in a few ways:
-
-1. By having `sudo` capability or a `root` token with the `auth/token/create`
-   endpoint
-1. By using token store roles
-1. By using an auth method that supports issuing these, such as
-   AppRole
-
-At issue time, the TTL of a periodic token will be equal to the configured
-period. At every renewal time, the TTL will be reset back to this configured
-period, and as long as the token is successfully renewed within each of these
-periods of time, it will never expire. Outside of `root` tokens, it is
-currently the only way for a token in Vault to have an unlimited lifetime.
-
-The idea behind periodic tokens is that it is easy for systems and services to
-perform an action relatively frequently -- for instance, every two hours, or
-even every five minutes. Therefore, as long as a system is actively renewing
-this token -- in other words, as long as the system is alive -- the system is
-allowed to keep using the token and any associated leases. However, if the
-system stops renewing within this period (for instance, if it was shut down),
-the token will expire relatively quickly. It is good practice to keep this
-period as short as possible, and generally speaking it is not useful for humans
-to be given periodic tokens.
-
-There are a few important things to know when using periodic tokens:
-
-- When a periodic token is created via a token store role, the _current_ value
-  of the role's period setting will be used at renewal time
-- A token with both a period and an explicit max TTL will act like a periodic
-  token but will be revoked when the explicit max TTL is reached
-
-## CIDR-Bound tokens
-
-Some tokens are able to be bound to CIDR(s) that restrict the range of client
-IPs allowed to use them. These affect all tokens except for non-expiring root
-tokens (those with a TTL of zero). If a root token has an expiration, it also
-is affected by CIDR-binding.
-
-## Token types in detail
-
-There are currently two types of tokens.
-
-### Service tokens
-
-Service tokens are what users will generally think of as "normal" Vault tokens.
-They support all features, such as renewal, revocation, creating child tokens,
-and more. They are correspondingly heavyweight to create and track.
-
-### Batch tokens
-
-Batch tokens are encrypted blobs that carry enough information for them to
-be used for Vault actions, but they require no storage on disk to track them.
-As a result they are extremely lightweight and scalable, but lack most of the
-flexibility and features of service tokens.
-
-### Token type comparison
-
-This reference chart describes the difference in behavior between service and
-batch tokens.
-
-|                                                     |                                          Service Tokens |                                    Batch Tokens |
-| --------------------------------------------------- | ------------------------------------------------------: | ----------------------------------------------: |
-| Can Be Root Tokens                                  |                                                     Yes |                                              No |
-| Can Create Child Tokens                             |                                                     Yes |                                              No |
-| Can be Renewable                                    |                                                     Yes |                                              No |
-| Manually Revocable                                  |                                                     Yes |                                              No |
-| Can be Periodic                                     |                                                     Yes |                                              No |
-| Can have Explicit Max TTL                           |                                                     Yes |                    No (always uses a fixed TTL) |
-| Has Accessors                                       |                                                     Yes |                                              No |
-| Has Cubbyhole                                       |                                                     Yes |                                              No |
-| Revoked with Parent (if not orphan)                 |                                                     Yes |                                   Stops Working |
-| Dynamic Secrets Lease Assignment                    |                                                    Self |                          Parent (if not orphan) |
-| Can be Used Across Performance Replication Clusters |                                                      No |                                 Yes (if orphan) |
-| Creation Scales with Performance Standby Node Count |                                                      No |                                             Yes |
-| Cost                                                | Heavyweight; multiple storage writes per token creation | Lightweight; no storage cost for token creation |
-
-### Service vs. batch token lease handling
-
-#### Service tokens
-
-Leases created by service tokens (including child tokens' leases) are tracked
-along with the service token and revoked when the token expires.
-
-#### Batch tokens
-
-Leases created by batch tokens are constrained to the remaining TTL of the
-batch tokens and, if the batch token is not an orphan, are tracked by the
-parent. They are revoked when the batch token's TTL expires, or when the batch
-token's parent is revoked (at which point the batch token is also denied access
-to Vault).
-
-As a corollary, batch tokens can be used across performance replication
-clusters, but only if they are orphan, since non-orphan tokens will not be able
-to ensure the validity of the parent token.
diff --git a/website/content/docs/concepts/transform.mdx b/website/content/docs/concepts/transform.mdx
deleted file mode 100644
index b66bc12527a..00000000000
--- a/website/content/docs/concepts/transform.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
----
-layout: docs
-page_title: Transform
-description: >-
-  Part of Vault's Advanced Data Protection solution, protecting sensitive information
-  stored outside of Vault.
----
-
-# Transform secrets engine
-
-Part of Vault's Advanced Data Protection solutions, Transform provides mechanisms
-for _transforming_ sensitive information to protect it even as it lives outside
-Vault's sphere.
-
-Transform consists of three modes, called _transformations_. Format Preserving
-Encryption (**FPE**) for encrypting and decrypting values while retaining their
-formats. **Masking** for replacing sensitive information with masking
-characters. And **Tokenization** which replaces sensitive information with
-mathematically unrelated tokens.
-
-## Comparison to transit
-
-Transit implements many traditional cryptographic primitives, such as AES encryption and
-RSA signatures (among others). Transform implements solutions to protect sensitive
-values in more narrow, but still critical use cases.
-
-## What solution when?
-
-When should one use a particular transform or transit encryption? Based on your
-use case and its requirements, this flowchart can help you choose the right
-solution.
-
-![Transit vs Transform](/img/transit-or-transform.png)
-
-Keep in mind that unlike all other solutions, Tokenization is stateful, and all
-values must be stored either within Vault or a supported external store. As such
-all other solutions will outperform and outscale tokenization.
diff --git a/website/content/docs/concepts/user-lockout.mdx b/website/content/docs/concepts/user-lockout.mdx
deleted file mode 100644
index 6acc305d062..00000000000
--- a/website/content/docs/concepts/user-lockout.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
----
-layout: docs
-page_title: User Lockout
-description: >-
-  If a user provides bad credentials several times in quick succession, 
-  Vault will stop trying to validate their credentials for a while, instead 
-  returning immediately with a permission denied error.
----
-
-# User lockout
-
-@include 'user-lockout.mdx'
-
-## Precedence
-
-The precedence for user lockout configuration is as follows: 
-
-Configuration for an auth mount using tune >> Configuration for an auth method in config file >> 
-Configuration for "all" auth methods in config file >> Default values.
-
-The precedence for user lockout disable is as follows: 
-
-Disable using environment variable VAULT_DISABLE_USER_LOCKOUT >> 
-Configuration for an auth mount using tune >> Configuration for an auth method in config file >> 
-Configuration for "all" auth methods in config file >> Default values.
-
-## Configuration
-
-User lockout parameters can be configured using config file for "all" auth methods or a specific auth method (userpass, ldap, or approle).
-Please see [user lockout configuration](/vault/docs/configuration/user-lockout#user_lockout-stanza) for more details. 
-
-The user lockout configuration for the auth method at a given path can be tuned using auth tune. Please see [auth tune command](/vault/docs/commands/auth/tune)
-or [auth tune api](/vault/api-docs/system/auth#tune-auth-method) for more details. 
-
-## API 
-
-Please see [sys/locked-users API](/vault/api-docs/system/user-lockout) for more details. 
\ No newline at end of file
diff --git a/website/content/docs/concepts/username-templating.mdx b/website/content/docs/concepts/username-templating.mdx
deleted file mode 100644
index 3297fab5567..00000000000
--- a/website/content/docs/concepts/username-templating.mdx
+++ /dev/null
@@ -1,158 +0,0 @@
----
-layout: docs
-page_title: Username Templating
-description: >-
-  Username templating are used in some secret engines to allow operators to define
-  how dynamic usernames are generated.
----
-
-# Username templating
-
-Some of the secrets engines that generate dynamic users for external systems provide the ability for Vault operators
-to customize how usernames are generated for said external systems. This customization feature uses the
-[Go template language](https://golang.org/pkg/text/template/). This page describes the basics of using these templates
-for username generation but does not go into great depth of using the templating language for more advanced usages.
-See the API documentation for the given secret engine to determine if it supports username templating and for more
-details on using it with that engine.
-
-~> When customizing how usernames are generated, take care to ensure you have enough randomness to ensure uniqueness
-otherwise multiple calls to create the credentials may interfere with each other.
-
-In addition to the functionality built into the Go template language, a number of additional functions are available:
-
-## Available functions
-
-### String/Character manipulation
-
-`lowercase` - Lowercases the input value.<br/>
-**Example**: `{{.FieldName | lowercase}}`
-
-`replace` - Find/replace on the input value.<br/>
-**Example**: `{{.FieldName | replace - _}}`
-
-`truncate` - truncates the input value to the specified number of characters.<br/>
-**Example**: `{{.FieldName | truncate 10}}`
-
-`truncate_sha256` - Truncates the input value to the specified number of characters. The last 8 characters of the
-new value will be replace by the first 8 characters of the SHA256 hash of the truncated characters.<br/>
-**Example**: `{{.FieldName | truncate_sha256 20}}`. If `FieldName` is `abcdefghijklmnopqrstuvwxyz`, all characters after
-the 12th (`l`) are removed and SHA256 hashed (`872808ffbf...1886ca6f20`).
-The first 8 characters of the hash (`872808ff`) are then appended to the end of the first 12 characters from the
-original value: `abcdefghijkl872808ff`.
-
-`uppercase` - Uppercases the input value.<br/>
-**Example**: `{{.FieldName | uppercase}}`
-
-### Generating values
-
-`random` - Generates a random string from lowercase letters, uppercase letters, and numbers. Must include a
-number indicating how many characters to generate.<br/>
-**Example**: `{{random 20}}` generates 20 random characters
-
-`timestamp` - The current time. Must provide a formatting string based on Go’s [time package](https://golang.org/pkg/time/).<br/>
-**Example**: `{{timestamp "2006-01-02T15:04:05Z"}}`
-
-`unix_time` - The current unix timestamp (number of seconds since Jan 1 1970).<br/>
-**Example**: `{{unix_time}}`
-
-`unix_time_millis` - The current unix timestamp in milliseconds.<br/>
-**Example**: `{{unix_time_millis}}`
-
-`uuid` - Generates a random UUID.<br/>
-**Example**: `{{uuid}}`
-
-### Hashing
-
-`base64` - Base64 encodes the input value.<br/>
-**Example**: `{{.FieldName | base64}}`
-
-`sha256` - SHA256 hashes the input value.<br/>
-**Example**: `{{.FieldName | sha256}}`
-
-## Examples
-
-Each secret engine provides a different set of data to the template. Please see the associated secret engine's
-documentation for details on what values are provided to the template. The examples below are modeled after the
-[Database engine's](/vault/docs/secrets/databases) data, however the specific fields that are provided from a given engine
-may differ from these examples. Additionally, the time is assumed to be 2009-02-13 11:31:30PM GMT
-(unix timestamp: 1234567890) and random characters are the ordered english alphabet: `abcdefghijklmnopqrstuvwxyz`.
-
--> Note: The space between `{{`/`}}` and the values/functions are optional.
-For instance: `{{.DisplayName}}` is equivalent to `{{ .DisplayName }}`
-
-| Field name    | Value                     |
-| ------------- | ------------------------- |
-| `DisplayName` | `token-with-display-name` |
-| `RoleName`    | `my_custom_database_role` |
-
-To reference either of these fields, a `.` must be put in front of the field name: `{{.DisplayName}}`. Custom functions
-do not include a `.` in front of them: `{{random 20}}`.
-
-### Basic example
-
-**Template**:
-
-```
-{{.DisplayName}}_{{.RoleName}}
-```
-
-**Username**:
-
-```
-token-with-display-name_my_custom_database_role
-```
-
-This is a basic example that references the two fields that are provided to the template. In simplest terms, this is
-a simple string substitution.
-
-~> This example does not have any randomness and should not be used when generating dynamic usernames. The purpose is to
-demonstrate referencing data within the Go template language.
-
-### Custom functions
-
-**Template**:
-
-```
-FOO_{{.DisplayName | replace "-" "_" | uppercase}}_{{.RoleName | replace "-" "_" | uppercase}}_{{timestamp "2006_01_02T15_04_05Z" | replace "-" "_"}}
-```
-
-**Username**:
-
-```
-FOO_TOKEN_WITH_DISPLAY_NAME_MY_CUSTOM_DATABASE_ROLE_2009_02_13T11_31_30Z_0700
-```
-
-`{{.DisplayName | replace "-" "_" | uppercase}}` - Replaces all dashes with underscores and then uppercases the display name.<br/>
-`{{.RoleName | replace "-" "_" | uppercase}}` - Replaces all dashes with underscores and then uppercases the role name.<br/>
-`{{timestamp "2006_01_02T15_04_05Z" | replace "-" "_"}}` - Generates the current timestamp using the provided format and
-replaces all dashes with underscores.
-
-### Truncating to maximum length
-
-**Template**:
-
-```
-{{printf "v_%s_%s_%s_%s" (.DisplayName | truncate 8) (.RoleName | truncate 8) (random 20) (unix_time) | truncate 45}}
-```
-
-**Username**:
-
-```
-v_token-wi_my_custo_abcdefghijklmnopqrst_1234
-```
-
-`.DisplayName | truncate 8` truncates the display name to 8 characters (`token-wi`).<br/>
-`.RoleName | truncate 8` truncates the role name to 8 characters (`my_custo`).<br/>
-`random 20` generates 20 random characters `abcdefghijklmnopqrst`.<br/>
-`unix_time` generates the current timestamp as the number of seconds since January 1, 1970 (`1234567890`).<br/>
-
-Each of these values are passed to `printf "v_%s_%s_%s_%s"` which prepends them with `v_` and puts an underscore between
-each field. This results in `v_token-wi_my_custo_abcdefghijklmnopqrst_1234567890`. This value is then passed to
-`truncate 45` where the last 6 characters are removed which results in `v_token-wi_my_custo_abcdefghijklmnopqrst_1234`.
-
-## Tutorial
-
-Refer to the following tutorials for step-by-step instructions.
-
-- [Database Secrets Engine with MongoDB](/vault/tutorials/db-credentials/database-mongodb#customize-the-generated-username-schema)
-- [Dynamic Secrets: Database Secrets Engine](/vault/tutorials/db-credentials/database-secrets#define-a-username-template)
diff --git a/website/content/docs/configuration/entropy-augmentation.mdx b/website/content/docs/configuration/entropy-augmentation.mdx
deleted file mode 100644
index b45b8addd7a..00000000000
--- a/website/content/docs/configuration/entropy-augmentation.mdx
+++ /dev/null
@@ -1,61 +0,0 @@
----
-layout: docs
-page_title: Entropy Augmentation - Configuration
-description: >-
-  Entropy augmentation enables Vault to sample entropy from external
-  cryptographic modules.
----
-
-# `Entropy augmentation` seal
-
-Entropy augmentation enables Vault to sample entropy from external cryptographic modules.
-Sourcing external entropy is done by configuring a supported [Seal](/vault/docs/configuration/seal) type which
-include: [PKCS11 seal](/vault/docs/configuration/seal/pkcs11), [AWS KMS](/vault/docs/configuration/seal/awskms), and
-[Vault Transit](/vault/docs/configuration/seal/transit).
-Vault Enterprises's external entropy support is activated by the presence of an `entropy "seal"`
-block in Vault's configuration file.
-
-~> **Note**: If using the Seal High Availability Beta, entropy will be retrieved
-from seals in priority order, using bytes from the first available and online seal.
-
-## Requirements
-
-A valid Vault Enterprise license is required for Entropy Augmentation.
-
-~> **Warning** This feature is not available with FIPS 140-2 Inside variants of Vault.
-
-Additionally, the following software packages and enterprise modules are required for sourcing entropy
-via the [PKCS11 seal](/vault/docs/configuration/seal/pkcs11):
-
-- Vault Enterprise with the Plus package
-- PKCS#11 compatible HSM integration library. Vault targets version 2.2 or
-  higher of PKCS#11. Depending on any given HSM, some functions (such as key
-  generation) may have to be performed manually.
-- The [GNU libltdl library](https://www.gnu.org/software/libtool/manual/html_node/Using-libltdl)
-  — ensure that it is installed for the correct architecture of your servers
-
-## `entropy` example
-
-This example shows configuring entropy augmentation through a PKCS11 HSM seal from Vault's configuration
-file:
-
-```hcl
-seal "pkcs11" {
-    ...
-}
-
-entropy "seal" {
-    mode = "augmentation"
-}
-```
-
-For a more detailed tutorial, visit the [HSM Entropy Challenge](/vault/tutorials/enterprise/hsm-entropy)
-on HashiCorp's Learn website.
-
-## `entropy augmentation` parameters
-
-These parameters apply to the `entropy` stanza in the Vault configuration file:
-
-- `mode` `(string: <required>)`: The mode determines which Vault operations requiring
-  entropy will sample entropy from the external source. Currently, the only mode supported
-  is `augmentation` which sources entropy for [Critical Security Parameters (CSPs)](/vault/docs/enterprise/entropy-augmentation#critical-security-parameters-csps).
diff --git a/website/content/docs/configuration/index.mdx b/website/content/docs/configuration/index.mdx
deleted file mode 100644
index bb5bb2ab2fc..00000000000
--- a/website/content/docs/configuration/index.mdx
+++ /dev/null
@@ -1,290 +0,0 @@
----
-layout: docs
-page_title: Server Configuration
-description: Vault server configuration reference.
----
-
-# Vault configuration
-
-Outside of development mode, Vault servers are configured using a file.
-The format of this file is [HCL](https://github.com/hashicorp/hcl) or JSON.
-
-@include 'plugin-file-permissions-check.mdx'
-
-An example configuration is shown below:
-
-```hcl
-ui            = true
-cluster_addr  = "https://127.0.0.1:8201"
-api_addr      = "https://127.0.0.1:8200"
-disable_mlock = true
-
-storage "raft" {
-  path = "/path/to/raft/data"
-  node_id = "raft_node_id"
-}
-
-listener "tcp" {
-  address       = "127.0.0.1:8200"
-  tls_cert_file = "/path/to/full-chain.pem"
-  tls_key_file  = "/path/to/private-key.pem"
-}
-
-telemetry {
-  statsite_address = "127.0.0.1:8125"
-  disable_hostname = true
-}
-```
-
-After the configuration is written, use the `-config` flag with `vault server`
-to specify where the configuration is.
-
-## Parameters
-
-- `storage` `([StorageBackend][storage-backend]: <required>)` –
-  Configures the storage backend where Vault data is stored. Please see the
-  [storage backends documentation][storage-backend] for the full list of
-  available storage backends. Running Vault in HA mode would require
-  coordination semantics to be supported by the backend. If the storage backend
-  supports HA coordination, HA backend options can also be specified in this
-  parameter block. If not, a separate `ha_storage` parameter should be
-  configured with a backend that supports HA, along with corresponding HA
-  options.
-
-- `ha_storage` `([StorageBackend][storage-backend]: nil)` – Configures
-  the storage backend where Vault HA coordination will take place. This must be
-  an HA-supporting backend. If not set, HA will be attempted on the backend
-  given in the `storage` parameter. This parameter is not required if the
-  storage backend supports HA coordination and if HA specific options are
-  already specified with `storage` parameter. (Refer to [Use Integrated Storage
-  for HA
-  Coordination](/vault/tutorials/raft/raft-ha-storage)
-  for a usage example.)
-
-- `listener` `([Listener][listener]: <required>)` – Configures how
-  Vault is listening for API requests.
-
-- `user_lockout` `([UserLockout][user-lockout]: nil)` –
-  Configures the user-lockout behaviour for failed logins. For more information, please see the
-  [user lockout configuration documentation](/vault/docs/configuration/user-lockout). 
-
-- `seal` `([Seal][seal]: nil)` – Configures the seal type to use for
-  auto-unsealing, as well as for
-  [seal wrapping][sealwrap] as an additional layer of data protection.
-
-- `cluster_name` `(string: <generated>)` – Specifies the identifier for the
-  Vault cluster. If omitted, Vault will generate a value. When connecting to
-  Vault Enterprise, this value will be used in the interface.
-
-- `cache_size` `(string: "131072")` – Specifies the size of the read cache used
-  by the physical storage subsystem. The value is in number of entries, so the
-  total cache size depends on the size of stored entries.
-
-- `disable_cache` `(bool: false)` – Disables all caches within Vault, including
-  the read cache used by the physical storage subsystem. This will very
-  significantly impact performance.
-
-- `disable_mlock` `(bool: false)` – Disables the server from executing the
-  `mlock` syscall. `mlock` prevents memory from being swapped to disk. Disabling
-  `mlock` is not recommended unless using [integrated storage](/vault/docs/internals/integrated-storage).
-  Follow the additional security precautions outlined below when disabling `mlock`.
-  This can also be provided via the environment variable `VAULT_DISABLE_MLOCK`.
-
-  Disabling `mlock` is not recommended unless the systems running Vault only
-  use encrypted swap or do not use swap at all. Vault only supports memory
-  locking on UNIX-like systems that support the mlock() syscall (Linux, FreeBSD, etc).
-  Non UNIX-like systems (e.g. Windows, NaCL, Android) lack the primitives to keep a
-  process's entire memory address space from spilling to disk and is therefore
-  automatically disabled on unsupported platforms.
-
-  Disabling `mlock` is strongly recommended if using [integrated
-  storage](/vault/docs/internals/integrated-storage) due to
-  the fact that `mlock` does not interact well with memory mapped files such as
-  those created by BoltDB, which is used by Raft to track state. When using
-  `mlock`, memory-mapped files get loaded into resident memory which causes
-  Vault's entire dataset to be loaded in-memory and cause out-of-memory
-  issues if Vault's data becomes larger than the available RAM. In this case,
-  even though the data within BoltDB remains encrypted at rest, swap should be
-  disabled to prevent Vault's other in-memory sensitive data from being dumped
-  into disk.
-
-  On Linux, to give the Vault executable the ability to use the `mlock`
-  syscall without running the process as root, run:
-
-  ```shell
-  sudo setcap cap_ipc_lock=+ep $(readlink -f $(which vault))
-  ```
-
-  ~> Note: Since each plugin runs as a separate process, you need to do the same
-  for each plugin in your [plugins
-  directory](/vault/docs/plugins/plugin-architecture#plugin-directory).
-
-  If you use a Linux distribution with a modern version of systemd, you can add
-  the following directive to the "[Service]" configuration section:
-
-  ```ini
-  LimitMEMLOCK=infinity
-  ```
-
-- `plugin_directory` `(string: "")` – A directory from which plugins are
-  allowed to be loaded. Vault must have permission to read files in this
-  directory to successfully load plugins, and the value cannot be a symbolic link.
-
-- `plugin_tmpdir` `(string: "")` - A directory that Vault can create temporary
-  files in to support Unix socket communication with containerized plugins. If
-  not set, Vault will use the system's default directory for temporary files.
-  Generally not necessary unless you are using
-  [containerized plugins](/vault/docs/plugins/containerized-plugins) and Vault
-  does not share a temporary folder with other processes, such as if using
-  systemd's [PrivateTmp](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#PrivateTmp=)
-  setting. This can also be specified via the `VAULT_PLUGIN_TMPDIR` environment
-  variable.
-
-  @include 'plugin-file-permissions-check.mdx'
-
-- `plugin_file_uid` `(integer: 0)` – Uid of the plugin directories and plugin binaries if they
-  are owned by an user other than the user running Vault. This only needs to be set if the
-  file permissions check is enabled via the environment variable `VAULT_ENABLE_FILE_PERMISSIONS_CHECK`.
-
-- `plugin_file_permissions` `(string: "")` – Octal permission string of the plugin
-  directories and plugin binaries if they have write or execute permissions for group or others.
-  This only needs to be set if the file permissions check is enabled via the environment variable
-  `VAULT_ENABLE_FILE_PERMISSIONS_CHECK`.
-
-- `telemetry` `([Telemetry][telemetry]: <none>)` – Specifies the telemetry
-  reporting system.
-
-- `default_lease_ttl` `(string: "768h")` – Specifies the default lease duration
-  for tokens and secrets. This is specified using a label suffix like `"30s"` or
-  `"1h"`. This value cannot be larger than `max_lease_ttl`.
-
-- `max_lease_ttl` `(string: "768h")` – Specifies the maximum possible lease
-  duration for tokens and secrets. This is specified using a label
-  suffix like `"30s"` or `"1h"`. Individual mounts can override this value
-  by tuning the mount with the `max-lease-ttl` flag of the
-  [auth](/vault/docs/commands/auth/tune#max-lease-ttl) or
-  [secret](/vault/docs/commands/secrets/tune#max-lease-ttl) commands.
-
-- `default_max_request_duration` `(string: "90s")` – Specifies the default
-  maximum request duration allowed before Vault cancels the request. This can
-  be overridden per listener via the `max_request_duration` value.
-
-- `detect_deadlocks` `(string: "")` - A comma separated string that specifies the internal 
-mutex locks that should be monitored for potential deadlocks. Currently supported values 
-include `statelock`, `quotas` and `expiration` which will cause "POTENTIAL DEADLOCK:"
-to be logged when an attempt at a core state lock appears to be deadlocked. Enabling this 
-can have a negative effect on performance due to the tracking of each lock attempt.
-
-- `raw_storage_endpoint` `(bool: false)` – Enables the `sys/raw` endpoint which
-  allows the decryption/encryption of raw data into and out of the security
-  barrier. This is a highly privileged endpoint.
-
-- `introspection_endpoint` `(bool: false)` - Enables the `sys/internal/inspect` endpoint
-  which allows users with a root token or sudo privileges to inspect certain subsystems inside Vault.
-
-- `ui` `(bool: false)` – Enables the built-in web UI, which is available on all
-  listeners (address + port) at the `/ui` path. Browsers accessing the standard
-  Vault API address will automatically redirect there. This can also be provided
-  via the environment variable `VAULT_UI`. For more information, please see the
-  [ui configuration documentation](/vault/docs/configuration/ui).
-
-- `pid_file` `(string: "")` - Path to the file in which the Vault server's
-  Process ID (PID) should be stored.
-
-- `enable_response_header_hostname` `(bool: false)` - Enables the addition of an HTTP header
-  in all of Vault's HTTP responses: `X-Vault-Hostname`. This will contain the
-  host name of the Vault node that serviced the HTTP request. This information
-  is best effort and is not guaranteed to be present. If this configuration
-  option is enabled and the `X-Vault-Hostname` header is not present in a response,
-  it means there was some kind of error retrieving the host name from the
-  operating system.
-
-- `enable_response_header_raft_node_id` `(bool: false)` - Enables the addition of an HTTP header
-  in all of Vault's HTTP responses: `X-Vault-Raft-Node-ID`. If Vault is participating
-  in a Raft cluster (i.e. using integrated storage), this header will contain the
-  Raft node ID of the Vault node that serviced the HTTP request. If Vault is not
-  participating in a Raft cluster, this header will be omitted, whether this configuration
-  option is enabled or not.
-
-- `log_level` `(string: "info")` - Log verbosity level.
-  Supported values (in order of descending detail) are `trace`, `debug`, `info`, `warn`, and `error`.
-  This can also be specified via the `VAULT_LOG_LEVEL` environment variable.
-
-  ~> Note: On SIGHUP (`sudo kill -s HUP` _pid of vault_), if a valid value is specified, Vault will update the existing log level,
-  overriding (even if specified) both the CLI flag and environment variable.
-
-  ~> Note: Not all parts of Vault's logging can have its log level be changed dynamically this way; in particular,
-  secrets/auth plugins are currently not updated dynamically.
-
-- `log_format` - Equivalent to the [`-log-format` command-line flag](/vault/docs/commands/server#_log_format).
-
-- `log_file` - Equivalent to the [`-log-file` command-line flag](/vault/docs/commands/server#_log_file).
-
-- `log_rotate_duration` - Equivalent to the [`-log-rotate-duration` command-line flag](/vault/docs/commands/server#_log_rotate_duration).
-
-- `log_rotate_bytes` - Equivalent to the [`-log-rotate-bytes` command-line flag](/vault/docs/commands/server#_log_rotate_bytes).
-
-- `log_rotate_max_files` - Equivalent to the [`-log-rotate-max-files` command-line flag](/vault/docs/commands/server#_log_rotate_max_files).
-
-- `experiments` `(string array: [])` - The list of experiments to enable for this node.
-  Experiments should NOT be used in production, and the associated APIs may have backwards
-  incompatible changes between releases. Additional experiments can also be specified via
-  the `VAULT_EXPERIMENTS` environment variable as a comma-separated list, or via the
-  [`-experiment`](/vault/docs/commands/server#experiment) flag.
-
-- `imprecise_lease_role_tracking` `(bool: "false")` - Skip lease counting by role if there are no role based quotas enabled.
-  When `imprecise_lease_role_tracking` is set to true and a new role-based quota is enabled, subsequent lease counts start from 0.
-  `imprecise_lease_role_tracking` affects role-based lease count quotas, but reduces latencies when not using role based quotas.
-
-### High availability parameters
-
-The following parameters are used on backends that support [high availability][high-availability].
-
-- `api_addr` `(string: "")` – Specifies the address (full URL) to advertise to
-  other Vault servers in the cluster for client redirection. This value is also
-  used for [plugin backends][plugins]. This can also be provided via the
-  environment variable `VAULT_API_ADDR`. In general this should be set as a full
-  URL that points to the value of the [`listener`](#listener) address.
-  This can be dynamically defined with a
-  [go-sockaddr template](https://pkg.go.dev/github.com/hashicorp/go-sockaddr/template)
-  that is resolved at runtime.
-
-- `cluster_addr` `(string: "")` – Specifies the address to advertise to other
-  Vault servers in the cluster for request forwarding. This can also be provided
-  via the environment variable `VAULT_CLUSTER_ADDR`. This is a full URL, like
-  `api_addr`, but Vault will ignore the scheme (all cluster members always
-  use TLS with a private key/certificate).
-  This can be dynamically defined with a
-  [go-sockaddr template](https://pkg.go.dev/github.com/hashicorp/go-sockaddr/template)
-  that is resolved at runtime.
-
-- `disable_clustering` `(bool: false)` – Specifies whether clustering features
-  such as request forwarding are enabled. Setting this to true on one Vault node
-  will disable these features _only when that node is the active node_. This
-  parameter cannot be set to `true` if `raft` is the storage type.
-
-### Vault enterprise parameters
-
-The following parameters are only used with Vault Enterprise
-
-- `disable_sealwrap` `(bool: false)` – Disables using [seal wrapping][sealwrap]
-  for any value except the root key. If this value is toggled, the new
-  behavior will happen lazily (as values are read or written).
-
-- `disable_performance_standby` `(bool: false)` – Specifies whether performance
-  standbys should be disabled on this node. Setting this to true on one Vault
-  node will disable this feature when this node is Active or Standby. It's
-  recommended to sync this setting across all nodes in the cluster.
-
-- `license_path` `(string: "")` - Path to license file. This can also be
-  provided via the environment variable `VAULT_LICENSE_PATH`, or the license
-  itself can be provided in the environment variable `VAULT_LICENSE`.
-
-[storage-backend]: /vault/docs/configuration/storage
-[listener]: /vault/docs/configuration/listener
-[seal]: /vault/docs/configuration/seal
-[sealwrap]: /vault/docs/enterprise/sealwrap
-[telemetry]: /vault/docs/configuration/telemetry
-[sentinel]: /vault/docs/configuration/sentinel
-[high-availability]: /vault/docs/concepts/ha
-[plugins]: /vault/docs/plugins
diff --git a/website/content/docs/configuration/kms-library.mdx b/website/content/docs/configuration/kms-library.mdx
deleted file mode 100644
index d83655abb5c..00000000000
--- a/website/content/docs/configuration/kms-library.mdx
+++ /dev/null
@@ -1,59 +0,0 @@
----
-layout: docs
-page_title: Kms Library - Configuration
-description: >-
-  The kms_library stanza allows node specific configuration for access to
-  KMS access libraries
----
-
-# `kms_library` stanza
-
-The `kms_library` stanza isolates platform specific configuration for managed keys.
-It defines logical names that are referenced within an API configuration keeping cluster
-and node specific details separated along with deployment concerns for each.
-
-At the moment managed keys are only available as a feature set within Vault Enterprise HSM edition.
-
-## Requirements
-
-The following software packages are required for Vault Enterprise HSM:
-
-- PKCS#11 compatible HSM integration library. Vault targets version 2.2 or
-  higher of PKCS#11. Depending on any given HSM, some functions (such as key
-  generation) may have to be performed manually.
-- The [GNU libltdl
-  library](https://www.gnu.org/software/libtool/manual/html_node/Using-libltdl.html)
-  — ensure that it is installed for the correct architecture of your servers
-
-## Configuration
-
-Multiple kms_library stanza's can be defined with the only limitation that the value for the
-name key needs to be a unique value across all the stanza definitions in a case-insensitive
-manner.
-
-The type argument only supports "pkcs11" at the moment.
-
-Example `kms_library` stanza:
-
-```hcl
-kms_library [TYPE] {
-  name = "<logical name>"
-  # ...
-}
-```
-
-## `pkcs11` parameters
-
-These parameters apply to the `kms_library` stanza of type `pkcs11` in the Vault configuration file:
-
-- `name` `(string: <required>)`: The logical name to be referenced by a managed key
-- `library` `(string: <required>)`: The path to the PKCS#11 library shared object file.
-
-For example:
-
-```hcl
-kms_library "pkcs11" {
-  name = "hsm1"
-  library = "/usr/lib/Cryptoki.so"
-}
-```
diff --git a/website/content/docs/configuration/listener/index.mdx b/website/content/docs/configuration/listener/index.mdx
deleted file mode 100644
index ec188c9d78d..00000000000
--- a/website/content/docs/configuration/listener/index.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
----
-layout: docs
-page_title: Listeners - Configuration
-description: |-
-  The listener stanza configures the addresses and ports on which Vault will
-  respond to requests.
----
-
-# `listener` stanza
-
-The `listener` stanza configures the addresses and ports on which Vault will
-respond to requests. At this time, there are two types of listeners:
-- [TCP][tcp]
-- [Unix Domain Socket][unix]
-
-[tcp]: /vault/docs/configuration/listener/tcp
-[unix]: /vault/docs/configuration/listener/unix
diff --git a/website/content/docs/configuration/listener/tcp.mdx b/website/content/docs/configuration/listener/tcp.mdx
deleted file mode 100644
index 7bf9e5083fe..00000000000
--- a/website/content/docs/configuration/listener/tcp.mdx
+++ /dev/null
@@ -1,544 +0,0 @@
----
-layout: docs
-page_title: TCP - Listeners - Configuration
-description: |-
-  The TCP listener configures Vault to listen on the specified TCP address and
-  port.
----
-
-# `tcp` listener
-
-The TCP listener configures Vault to listen on a TCP address/port.
-
-```hcl
-listener "tcp" {
-  address = "127.0.0.1:8200"
-}
-```
-
-The `listener` stanza may be specified more than once to make Vault listen on
-multiple interfaces. If you configure multiple listeners you also need to
-specify [`api_addr`][api-addr] and [`cluster_addr`][cluster-addr] so Vault will
-advertise the correct address to other nodes.
-
-## Sensitive data redaction for unauthenticated endpoints
-
-Unauthenticated API endpoints may return the following sensitive information:
-
-* Vault version number
-* Vault binary build date
-* Vault cluster name
-* IP address of nodes in the cluster
-
-Vault offers the ability to configure each `tcp` `listener` stanza such that,
-when appropriate, these values are redacted from responses.
-
-The following API endpoints support redaction based on `listener` stanza configuration:
-
-* [`/sys/health`](/vault/api-docs/system/health)
-* [`/sys/leader`](/vault/api-docs/system/leader)
-* [`/sys/seal-status`](/vault/api-docs/system/seal-status)
-
-Vault replaces redacted information with an empty string (`""`). Some Vault APIs
-also omit keys from the response when the corresponding value is empty (`""`).
-
-<Note title="Redacting values affects responses to all API clients">
-  The Vault CLI and UI consume Vault API responses. As a result, your redaction
-  settings will apply to CLI and UI output in addition to direct API calls.
-</Note>
-
-## Listener's custom response headers
-
-As of version 1.9, Vault supports defining custom HTTP response headers for the root path (`/`) and also on API endpoints (`/v1/*`).
-The headers are defined based on the returned status code. For example, a user can define a list of
-custom response headers for the `200` status code, and another list of custom response headers for
-the `307` status code. There is a `"/sys/config/ui"` [API endpoint](/vault/api-docs/system/config-ui) which allows users
-to set `UI` specific custom headers. If a header is configured in a configuration file, it is not allowed
-to be reconfigured through the `"/sys/config/ui"` [API endpoint](/vault/api-docs/system/config-ui). In cases where a
-custom header value needs to be modified or the custom header needs to be removed, the Vault's configuration file
-needs to be modified accordingly, and a `SIGHUP` signal needs to be sent to the Vault process.
-
-If a header is defined in the configuration file and the same header is used by the internal
-processes of Vault, the configured header is not accepted. For example, a custom header which has
-the `X-Vault-` prefix will not be accepted. A message will be logged in the Vault's logs
-upon start up indicating the header with `X-Vault-` prefix is not accepted.
-
-### Order of precedence
-
-If the same header is configured in both the configuration file and
-in the `"/sys/config/ui"` [API endpoint](/vault/api-docs/system/config-ui), the header in the configuration file takes precedence.
-For example, the `"Content-Security-Policy"` header is defined by default in the
-`"/sys/config/ui"` [API endpoint](/vault/api-docs/system/config-ui). If that header is also defined in the configuration file,
-the value in the configuration file is set in the response headers instead of the
-default value in the `"/sys/config/ui"` [API endpoint](/vault/api-docs/system/config-ui).
-
-## `tcp` listener parameters
-
-- `address` `(string: "127.0.0.1:8200")` – Specifies the address to bind to for
-  listening. This can be dynamically defined with a
-  [go-sockaddr template](https://pkg.go.dev/github.com/hashicorp/go-sockaddr/template)
-  that is resolved at runtime.
-
-- `cluster_address` `(string: "127.0.0.1:8201")` – Specifies the address to bind
-  to for cluster server-to-server requests. This defaults to one port higher
-  than the value of `address`. This does not usually need to be set, but can be
-  useful in case Vault servers are isolated from each other in such a way that
-  they need to hop through a TCP load balancer or some other scheme in order to
-  talk. This can be dynamically defined with a
-  [go-sockaddr template](https://pkg.go.dev/github.com/hashicorp/go-sockaddr/template)
-  that is resolved at runtime.
-
-- `chroot_namespace` `(string: "")` – Specifies an alternate top-level namespace
-  for the listener. Vault appends namespaces provided in the `X-Vault-Namespace`
-  header or the `-namespace` field in a CLI command to the top-level namespace
-  to determine the full namespace path for the request. For example, if
-  `chroot_namespace` is set to `admin` and the `X-Vault-Namespace` header is
-  `ns1`, the full namespace path is `admin/ns1`. Calls to the listener will fail
-   with a 4XX error if the top-level namespace provided for `chroot_namespace`
-   does not exist.
-- `http_idle_timeout` `(string: "5m")` - Specifies the maximum amount of time to
-  wait for the next request when keep-alives are enabled. If `http_idle_timeout`
-  is zero, the value of `http_read_timeout` is used. If both are zero, the value
-  of `http_read_header_timeout` is used. This is specified using a label suffix
-  like `"30s"` or `"1h"`.
-
-- `http_read_header_timeout` `(string: "10s")` - Specifies the amount of time
-  allowed to read request headers. This is specified using a label suffix like
-  `"30s"` or `"1h"`.
-
-- `http_read_timeout` `(string: "30s")` - Specifies the maximum duration for
-  reading the entire request, including the body. This is specified using a
-  label suffix like `"30s"` or `"1h"`.
-
-- `http_write_timeout` `string: "0")` - Specifies the maximum duration before
-  timing out writes of the response and is reset whenever a new request's header
-  is read. The default value of `"0"` means infinity. This is specified using a
-  label suffix like `"30s"` or `"1h"`.
-
-- `max_request_size` `(int: 33554432)` – Specifies a hard maximum allowed
-  request size, in bytes. Defaults to 32 MB if not set or set to `0`.
-  Specifying a number less than `0` turns off limiting altogether.
-
-- `max_request_duration` `(string: "90s")` – Specifies the maximum
-  request duration allowed before Vault cancels the request. This overrides
-  `default_max_request_duration` for this listener.
-
-- `proxy_protocol_behavior` `(string: "")` – When specified, enables a PROXY
-  protocol version 1 behavior for the listener.
-  Accepted Values:
-
-  - _use_always_ - The client's IP address will always be used.
-  - _allow_authorized_ - If the source IP address is in the
-    `proxy_protocol_authorized_addrs` list, the client's IP address will be used.
-    If the source IP is not in the list, the source IP address will be used.
-  - _deny_unauthorized_ - The traffic will be rejected if the source IP
-    address is not in the `proxy_protocol_authorized_addrs` list.
-
-- `proxy_protocol_authorized_addrs` `(string: <required-if-enabled> or array: <required-if-enabled> )` –
-  Specifies the list of allowed source IP addresses to be used with the PROXY protocol.
-  Not required if `proxy_protocol_behavior` is set to `use_always`. Source IPs should
-  be comma-delimited if provided as a string. At least one source IP must be provided,
-  `proxy_protocol_authorized_addrs` cannot be an empty array or string.
-
-- `redact_addresses` `(bool: false)` - Redacts `leader_address` and `cluster_leader_address` values in applicable API responses when `true`.
-
-- `redact_cluster_name` `(bool: false)` - Redacts `cluster_name` values in applicable API responses when `true`.
-
-- `redact_version` `(bool: false)` - Redacts `version` and `build_date` values in applicable API responses when `true`.
-
-- `tls_disable` `(string: "false")` – Specifies if TLS will be disabled. Vault
-  assumes TLS by default, so you must explicitly disable TLS to opt-in to
-  insecure communication.
-
-- `tls_cert_file` `(string: <required-if-enabled>, reloads-on-SIGHUP)` –
-  Specifies the path to the certificate for TLS. It requires a PEM-encoded file.
-  To configure the listener to use a CA certificate, concatenate the primary certificate and the CA
-  certificate together. The primary certificate should appear first in the
-  combined file. On `SIGHUP`, the path set here _at Vault startup_ will be used
-  for reloading the certificate; modifying this value while Vault is running
-  will have no effect for `SIGHUP`s.
-
-- `tls_key_file` `(string: <required-if-enabled>, reloads-on-SIGHUP)` –
-  Specifies the path to the private key for the certificate. It requires a PEM-encoded file.
-  If the key file is encrypted, you will be prompted to enter the passphrase on server startup.
-  The passphrase must stay the same between key files when reloading your
-  configuration using `SIGHUP`. On `SIGHUP`, the path set here _at Vault
-  startup_ will be used for reloading the certificate; modifying this value
-  while Vault is running will have no effect for `SIGHUP`s.
-
-- `tls_min_version` `(string: "tls12")` – Specifies the minimum supported
-  version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13".
-
-  ~> **Warning**: TLS 1.1 and lower (`tls10` and `tls11` values for the
-  `tls_min_version` and `tls_max_version` parameters) are widely considered
-  insecure.
-
-- `tls_max_version` `(string: "tls13")` – Specifies the maximum supported
-  version of TLS. Accepted values are "tls10", "tls11", "tls12" or "tls13".
-
-~> **Warning**: TLS 1.1 and lower (`tls10` and `tls11` values for the
-  `tls_min_version` and `tls_max_version` parameters) are widely considered
-  insecure.
-
-- `tls_cipher_suites` `(string: "")` – Specifies the list of supported
-  ciphersuites as a comma-separated-list. The list of all available ciphersuites
-  is available in the [Golang TLS documentation][golang-tls].
-
-  ~> **Note**: Go only consults the `tls_cipher_suites` list for TLSv1.2 and
-  earlier; the order of ciphers is not important. For this parameter to be
-  effective, the `tls_max_version` property must be set to `tls12` to prevent
-  negotiation of TLSv1.3, which is not recommended. For more information about
-  this and other TLS related changes, see the [Go TLS blog post][go-tls-blog].
-
-- `tls_prefer_server_cipher_suites` `(string: "false")` – Specifies to prefer the
-  server's ciphersuite over the client ciphersuites.
-
-  ~> **Warning**: The `tls_prefer_server_cipher_suites` parameter is
-  deprecated. Setting it has no effect. See the above
-  [Go blog post][go-tls-blog] for more information about
-  this change.
-
-- `tls_require_and_verify_client_cert` `(string: "false")` – Turns on client
-  authentication for this listener; the listener will require a presented
-  client cert that successfully validates against system CAs.
-
-- `tls_client_ca_file` `(string: "")` – PEM-encoded Certificate Authority file
-  used for checking the authenticity of client.
-
-- `tls_disable_client_certs` `(string: "false")` – Turns off client
-  authentication for this listener. The default behavior (when this is false)
-  is for Vault to request client certificates when available.
-
-  ~> **Warning**: The `tls_disable_client_certs` and `tls_require_and_verify_client_cert` fields in the listener stanza of the Vault server configuration are mutually exclusive fields. Please ensure they are not both set to true. TLS client verification remains optional with default settings and is not enforced.
-
-- `x_forwarded_for_authorized_addrs` `(string: <required-to-enable>)` –
-  Specifies the list of source IP CIDRs for which an X-Forwarded-For header
-  will be trusted. Comma-separated list or JSON array. This turns on
-  X-Forwarded-For support.  If for example Vault receives connections from the
-  load balancer's IP of `1.2.3.4`, adding `1.2.3.4` to `x_forwarded_for_authorized_addrs`
-  will result in the `remote_address` field in the audit log being populated with the
-  connecting client's IP, for example `3.4.5.6`. Note this requires the load balancer
-  to send the connecting client's IP in the `X-Forwarded-For` header.
-
-- `x_forwarded_for_hop_skips` `(string: "0")` – The number of addresses that will be
-  skipped from the _rear_ of the set of hops. For instance, for a header value
-  of `1.2.3.4, 2.3.4.5, 3.4.5.6, 4.5.6.7`, if this value is set to `"1"`, the address that
-  will be used as the originating client IP is `3.4.5.6`.
-
-- `x_forwarded_for_reject_not_authorized` `(string: "true")` – If set false,
-  if there is an X-Forwarded-For header in a connection from an unauthorized
-  address, the header will be ignored and the client connection used as-is,
-  rather than the client connection rejected.
-
-- `x_forwarded_for_reject_not_present` `(string: "true")` – If set false, if
-  there is no X-Forwarded-For header or it is empty, the client address will be
-  used as-is, rather than the client connection rejected.
-
-- `disable_replication_status_endpoints` `(bool: false)` - Disables replication
-  status endpoints for the configured listener when set to `true`.
-
-### `telemetry` parameters
-
-- `unauthenticated_metrics_access` `(bool: false)` - If set to true, allows
-  unauthenticated access to the `/v1/sys/metrics` endpoint.
-
-### `profiling` parameters
-
-- `unauthenticated_pprof_access` `(bool: false)` - If set to true, allows
-  unauthenticated access to the `/v1/sys/pprof` endpoint.
-
-### `inflight_requests_logging` parameters
-
-- `unauthenticated_in_flight_requests_access` `(bool: false)` - If set to true, allows
-  unauthenticated access to the `/v1/sys/in-flight-req` endpoint.
-
-### `custom_response_headers` parameters
-
-- `default` `(key-value-map: {})` - A map of string header names to an array of
-  string values. The default headers are set on all endpoints regardless of
-  the status code value. For an example, please refer to the
-  "Configuring custom http response headers" section.
-
-- `<specific status code>` `(key-value-map: {})` - A map of string header names
-  to an array of string values. These headers are set only when the specific status
-  code is returned. For example, `"200" = {"Header-A": ["Value1", "Value2"]}`, `"Header-A"`
-  is set when the http response status code is `"200"`.
-
-- `<collective status code>` `(key-value-map: {})` - A map of string header names
-  to an array of string values. These headers are set only when the response status
-  code falls under the collective status code.
-  For example, `"2xx" = {"Header-A": ["Value1", "Value2"]}`, `"Header-A"`
-  is set when the http response status code is `"200"`, `"204"`, etc.
-
-## `tcp` listener examples
-
-### Configuring TLS
-
-This example shows enabling a TLS listener.
-
-```hcl
-listener "tcp" {
-  tls_cert_file = "/etc/certs/vault.crt"
-  tls_key_file  = "/etc/certs/vault.key"
-}
-```
-
-### Listening on multiple interfaces
-
-This example shows Vault listening on a private interface, as well as localhost.
-
-```hcl
-listener "tcp" {
-  address = "127.0.0.1:8200"
-}
-
-listener "tcp" {
-  address = "10.0.0.5:8200"
-}
-
-# Advertise the non-loopback interface
-api_addr = "https://10.0.0.5:8200"
-cluster_addr = "https://10.0.0.5:8201"
-```
-
-### Configuring unauthenticated metrics access
-
-This example shows enabling unauthenticated metrics access.
-
-```hcl
-listener "tcp" {
-  telemetry {
-    unauthenticated_metrics_access = true
-  }
-}
-```
-
-### Configuring unauthenticated profiling access
-
-This example shows enabling unauthenticated profiling access.
-
-```hcl
-listener "tcp" {
-  profiling {
-    unauthenticated_pprof_access = true
-    unauthenticated_in_flight_request_access = true
-  }
-}
-```
-
-### Configuring custom http response headers
-
-Note: Requires Vault version 1.9 or newer. This example shows configuring custom http response headers.
-Operators can configure `"custom_response_headers"` sub-stanza in the listener stanza to set custom http
-headers appropriate to their applications. Examples of such headers are `"Strict-Transport-Security"`
-and `"Content-Security-Policy"` which are known HTTP headers, and could be configured to harden
-the security of an application communicating with the Vault endpoints. Note that vulnerability
-scans often examine such security related HTTP headers. In addition, application specific
-custom headers can also be configured. For example, `"X-Custom-Header"` has been configured
-in the example below.
-
-```hcl
-listener "tcp" {
-  custom_response_headers {
-    "default" = {
-      "Strict-Transport-Security" = ["max-age=31536000","includeSubDomains"],
-      "Content-Security-Policy" = ["connect-src https://clusterA.vault.external/"],
-      "X-Custom-Header" = ["Custom Header Default Value"],
-    },
-    "2xx" = {
-      "Content-Security-Policy" = ["connect-src https://clusterB.vault.external/"],
-      "X-Custom-Header" = ["Custom Header Value 1", "Custom Header Value 2"],
-    },
-    "301" = {
-      "Strict-Transport-Security" = ["max-age=31536000"],
-      "Content-Security-Policy" = ["connect-src https://clusterC.vault.external/"],
-    },
-  }
-}
-```
-
-In situations where a header is defined under several status code subsections,
-the header matching the most specific response code will be returned. For example,
-with the config example below, a `307` response would return `307 Custom header value`,
-while a `306` would return `3xx Custom header value`.
-
-```hcl
-listener "tcp" {
-  custom_response_headers {
-    "default" = {
-       "X-Custom-Header" = ["default Custom header value"]
-    },
-    "3xx" = {
-       "X-Custom-Header" = ["3xx Custom header value"]
-    },
-    "307" = {
-       "X-Custom-Header" = ["307 Custom header value"]
-    }
-  }
-}
-```
-
-### Listening on all IPv6 & IPv4 interfaces
-
-This example shows Vault listening on all IPv4 & IPv6 interfaces including localhost.
-
-```hcl
-listener "tcp" {
-  address         = "[::]:8200"
-  cluster_address = "[::]:8201"
-}
-```
-
-### Listening to specific IPv6 address
-
-This example shows Vault only using IPv6 and binding to the interface with the IP address: `2001:1c04:90d:1c00:a00:27ff:fefa:58ec`
-
-```hcl
-listener "tcp" {
-  address         = "[2001:1c04:90d:1c00:a00:27ff:fefa:58ec]:8200"
-  cluster_address = "[2001:1c04:90d:1c00:a00:27ff:fefa:58ec]:8201"
-}
-
-# Advertise the non-loopback interface
-api_addr = "https://[2001:1c04:90d:1c00:a00:27ff:fefa:58ec]:8200"
-cluster_addr = "https://[2001:1c04:90d:1c00:a00:27ff:fefa:58ec]:8201"
-```
-
-## Redaction examples
-
-Please see redaction settings above, for details on each redaction setting.
-
-Example configuration for the [`tcp`](/vault/docs/configuration/listener/tcp) listener,
-enabling [`redact_addresses`](/vault/docs/configuration/listener/tcp#redact_addresses),
-[`redact_cluster_name`](/vault/docs/configuration/listener/tcp#redact_cluster_name) and
-[`redact_version`](/vault/docs/configuration/listener/tcp#redact_version).
-
-```hcl
-ui            = true
-cluster_addr  = "https://127.0.0.1:8201"
-api_addr      = "https://127.0.0.1:8200"
-disable_mlock = true
-
-storage "raft" {
-  path = "/path/to/raft/data"
-  node_id = "raft_node_1"
-}
-
-listener "tcp" {
-  address             = "127.0.0.1:8200",
-  tls_cert_file = "/path/to/full-chain.pem"
-  tls_key_file  = "/path/to/private-key.pem"
-  redact_addresses    = "true"
-  redact_cluster_name = "true"
-  redact_version      = "true"
-}
-
-telemetry {
-  statsite_address = "127.0.0.1:8125"
-  disable_hostname = true
-}
-```
-
-### API: `/sys/health`
-In the following call to `/sys/health/` notice that `cluster_name` and `version`
-are both redacted. The `cluster_name` field is fully omitted from the response
-and `version` is the empty string (`""`).
-
-```shell-session
-$ curl -s https://127.0.0.1:8200/v1/sys/health | jq`:
-
-{
-  "initialized": true,
-  "sealed": false,
-  "standby": true,
-  "performance_standby": false,
-  "replication_performance_mode": "disabled",
-  "replication_dr_mode": "disabled",
-  "server_time_utc": 1696598650,
-  "version": "",
-  "cluster_id": "a1a7a078-0ae1-7fb9-41ec-2f4f583c773e"
-}
-```
-
-
-### API: `sys/leader`
-In the following call to `/sys/leader/` notice that `leader_address` and `leader_cluster_address`
-are both redacted and set to the empty string (`""`).
-
-```shell-session
-$ curl -s https://127.0.0.1:8200/v1/sys/leader | jq`:
-
-{
-  "ha_enabled": true,
-  "is_self": false,
-  "active_time": "0001-01-01T00:00:00Z",
-  "leader_address": "",
-  "leader_cluster_address": "",
-  "performance_standby": false,
-  "performance_standby_last_remote_wal": 0,
-  "raft_committed_index": 164,
-  "raft_applied_index": 164
-}
-```
-
-
-### API: `sys/seal-status`
-
-In the following call to `/sys/seal-status/` notice that `cluster_name`, `build_date`,
-and `version` are all redacted. The `cluster_name` field is fully omitted from
-the response while `build_date` and `version` are empty strings (`""`).
-
-```shell-session
-$ curl -s https://127.0.0.1:8200/v1/sys/seal-status | jq`:
-
-{
-  "type": "shamir",
-  "initialized": true,
-  "sealed": false,
-  "t": 1,
-  "n": 1,
-  "progress": 0,
-  "nonce": "",
-  "version": "",
-  "build_date": "",
-  "migration": false,
-  "cluster_id": "a1a7a078-0ae1-7fb9-41ec-2f4f583c773e",
-  "recovery_seal": false,
-  "storage_type": "raft"
-}
-```
-
-### CLI: `vault status`
-
-The CLI command `vault status` uses endpoints that support redacting data, so the
-output redacts `Version`, `Build Date`, `HA Cluster`, and `Active Node Address`.
-`Version`, `Build Date`, `HA Cluster` show `n/a` because the underlying endpoint
-returned the empty string, and  `Active Node Address` shows as `<none>` because
-it was omitted from the API response.
-
-```shell-session
-
-$ vault status
-
-Key                     Value
----                     -----
-Seal Type               shamir
-Initialized             true
-Sealed                  false
-Total Shares            5
-Threshold               3
-Version                 n/a
-Build Date              n/a
-Storage Type            raft
-HA Enabled              true
-HA Cluster              n/a
-HA Mode                 standby
-Active Node Address     <none>
-Raft Committed Index    219
-Raft Applied Index      219
-```
-
-[golang-tls]: https://golang.org/src/crypto/tls/cipher_suites.go
-[api-addr]: /vault/docs/configuration#api_addr
-[cluster-addr]: /vault/docs/configuration#cluster_addr
-[go-tls-blog]: https://go.dev/blog/tls-cipher-suites
diff --git a/website/content/docs/configuration/listener/unix.mdx b/website/content/docs/configuration/listener/unix.mdx
deleted file mode 100644
index f3c15151da3..00000000000
--- a/website/content/docs/configuration/listener/unix.mdx
+++ /dev/null
@@ -1,69 +0,0 @@
----
-layout: docs
-page_title: Unix - Listeners - Configuration
-description: |-
-  The Unix listener configures Vault to listen on the specified Unix domain socket.
----
-
-# `unix` listener
-
-The Unix listener configures Vault to listen on the specified Unix domain socket.
-
-```hcl
-listener "unix" {
-  address = "/run/vault.sock"
-}
-```
-
-The `listener` stanza may be specified more than once to make Vault listen on
-multiple sockets.
-
-## `unix` listener parameters
-- `address` `(string: "/run/vault.sock", <required>)` – Specifies the address to bind the Unix socket.
-
-- `socket_mode` `(string: "", <optional>)` – Changes the access
-  permissions and the special mode flags of the Unix socket.
-
-- `socket_user` `(string: "", <optional>)` – Changes the user owner of the Unix socket.
-
-- `socket_group` `(string: "", <optional>)` – Changes the group owner of the Unix socket.
-
-
-## `unix` listener examples
-
-### Listening on multiple sockets
-
-This example shows Vault listening on a specified socket, as well as the default.
-
-```hcl
-listener "unix" {}
-
-listener "unix" {
-  address = "/var/run/vault.sock"
-}
-```
-
-### Listening on multiple interfaces
-
-This example shows Vault listening on TCP localhost, as well as Unix socket.
-
-```hcl
-listener "unix" {
-  address = "/var/run/vault.sock"
-}
-
-listener "tcp" {
-  address = "127.0.0.1:8200"
-}
-```
-
-### Configuring permissions
-This example shows changing access permissions and ownership of the Unix socket.
-```hcl
-listener "unix" {
-  address = "/var/run/vault.sock"
-  socket_mode = "644"
-  socket_user = "1000"
-  socket_group = "1000"
-}
-```
\ No newline at end of file
diff --git a/website/content/docs/configuration/log-requests-level.mdx b/website/content/docs/configuration/log-requests-level.mdx
deleted file mode 100644
index 856f8bac6e3..00000000000
--- a/website/content/docs/configuration/log-requests-level.mdx
+++ /dev/null
@@ -1,46 +0,0 @@
----
-layout: docs
-page_title: Log Completed Requests - Configuration
-description: |-
-  Vault can be configured to log completed requests.
----
-
-# Log completed requests
-
-Vault can be configured to log completed requests using the `log_requests_level` configuration parameter.
-
-## Activating logging completed requests
-
-By default, logging completed requests is disabled. To activate request logging, set the `log_requests_level`
-configuration option in the Vault server configuration to the desired logging level. The acceptable logging levels are
-`error`, `warn`, `info`, `debug`, `trace`, and `off`, which is the default.
-
-Completed requests will be logged at the configured level, if Vault's log level includes this level of logs. For
-example, if `log_level` is set to `debug`, but `log_requests_level` is set to `trace`, completed requests will
-not be logged.
-
-If the Vault server is already running, you can still configure the parameter in the Vault server configuration,
-and then send a `SIGHUP` signal to the Vault process.
-
-```hcl
-log_requests_level = "debug"
-log_level = "debug"
-
-listener "tcp" {
-  # ...
-}
-```
-
-## Deactivating logging completed requests
-
-To deactivate logging completed requests, simply remove the `log_requests_level` configuration parameter
-from the Vault server configuration, or set it to `off`, and send a `SIGHUP` signal to the Vault process.
-
-```hcl
-log_requests_level = "off"
-log_level = "debug"
-
-listener "tcp" {
-  # ...
-}
-```
diff --git a/website/content/docs/configuration/replication.mdx b/website/content/docs/configuration/replication.mdx
deleted file mode 100644
index a3e917b4b01..00000000000
--- a/website/content/docs/configuration/replication.mdx
+++ /dev/null
@@ -1,48 +0,0 @@
----
-layout: docs
-page_title: Replication - Configuration
-description: |-
-  The replication stanza specifies various parameters for tuning replication related values.
----
-
-# `replication` stanza
-
-The `replication` stanza specifies various parameters for tuning replication related values.
-
-```hcl
-replication {
-  resolver_discover_servers = true
-  logshipper_buffer_length = 1000
-  logshipper_buffer_size = "5gb"
-  allow_forwarding_via_header = false
-  best_effort_wal_wait_duration = "2s"
-}
-```
-
-## `replication` parameters
-
-- `resolver_discover_servers` `(boolean: true)` - This feature should probably always be turned on. It enables secondary
-  cluster nodes to reach out to nodes in the primary cluster to request information on who the active node is. This
-  fixes an issue where a secondary cluster may only know about a single node in the primary cluster, and if that node
-  isn't the active node, the replication connection will not succeed. With resolving disabled, the only way around this
-  is to go through an onerous UpdatePrimary workflow, or do step-downs on the primary cluster until the one node known
-  by the secondary cluster is active.
-- `logshipper_buffer_length` `(integer: 16384)` - The maximum number of entries that the log shipper buffer can hold.
-  If this is not specified, a default of 16K will be used.
-- `logshipper_buffer_size` `(string: "")` - The maximum size that the log shipper buffer can be. This size can be
-  expressed as an integer, indicating the number of bytes, or as a capacity string. Capacity strings are a number,
-  followed by an optional space, followed by a suffix indicating the capacity. Valid suffixes are:
-  `kb, kib, mb, mib, gb, gib, tb, tib`, which correspond to kilobytes, kibibytes, megabytes, mebibytes, etc. Full
-  details on multiple-byte units in both powers of 2 and 10 can be found [on Wikipedia](https://en.wikipedia.org/wiki/Byte#Multiple-byte_units). The suffixes are not case-sensitive. If this
-  is not specified, Vault will attempt to read the total amount of memory available on the host it's running on. If
-  that succeeds, Vault will use 10% of the value found. If Vault is unable to read the amount of host memory, this
-  defaults to 1GB.
-- `allow_forwarding_via_header` `(boolean: false)` - Enable forwarding options for client controlled consistency,
-  i.e. `X-Vault-Inconsistent: forward-active-node` and `X-Vault-Forward: active-node`.
-- `best_effort_wal_wait_duration` `(duration: "2s")` - Legacy mitigation to try to prevent stale reads: when a
-  write is made via RPC, i.e. the node handling the request didn't do the write itself, wait up to this much
-  time to see the resulting WAL present locally before returning a response to the client.
-- `allow_forwarding_via_token` `(string: "")` - When set to `new_token`, requests sent to non-active nodes
-  are forwarded if the node does not yet have the token information in storage.
-
-Support for Server Side Consistent Tokens is now available. Refer to the [Server Side Consistent Token FAQ](/vault/docs/faq/ssct) for details.
diff --git a/website/content/docs/configuration/seal/alicloudkms.mdx b/website/content/docs/configuration/seal/alicloudkms.mdx
deleted file mode 100644
index 1f3f55c58ab..00000000000
--- a/website/content/docs/configuration/seal/alicloudkms.mdx
+++ /dev/null
@@ -1,108 +0,0 @@
----
-layout: docs
-page_title: AliCloud KMS - Seals - Configuration
-description: >-
-  The AliCloud KMS seal configures Vault to use AliCloud KMS as the seal
-  wrapping
-
-  mechanism.
----
-
-# `alicloudkms` seal
-
-<Note title="Seal wrapping requires Vault Enterprise">
-
-  All Vault versions support **auto-unseal** for AliCloud, but **seal wrapping**
-  requires Vault Enterprise.
-  
-  Vault Enterprise enables seal wrapping by default, which means the KMS service
-  must be available at runtime and not just during the unseal process. Refer to
-  the [Seal wrap](/vault/docs/enterprise/sealwrap) overview for more
-  information.
-
-</Note>
-
-
-The AliCloud KMS seal configures Vault to use AliCloud KMS as the seal wrapping mechanism.
-The AliCloud KMS seal is activated by one of the following:
-
-- The presence of a `seal "alicloudkms"` block in Vault's configuration file.
-- The presence of the environment variable `VAULT_SEAL_TYPE` set to `alicloudkms`. If
-  enabling via environment variable, all other required values specific to AliCloud
-  KMS (i.e. `VAULT_ALICLOUDKMS_SEAL_KEY_ID`) must be also supplied, as well as all
-  other AliCloud-related environment variables that lends to successful
-  authentication.
-
-## `alicloudkms` example
-
-This example shows configuring AliCloud KMS seal through the Vault configuration file
-by providing all the required values:
-
-```hcl
-seal "alicloudkms" {
-  region     = "us-east-1"
-  access_key = "0wNEpMMlzy7szvai"
-  secret_key = "PupkTg8jdmau1cXxYacgE736PJj4cA"
-  kms_key_id = "08c33a6f-4e0a-4a1b-a3fa-7ddfa1d4fb73"
-}
-```
-
-## `alicloudkms` parameters
-
-These parameters apply to the `seal` stanza in the Vault configuration file:
-
-- `region` `(string: <required> "us-east-1")`: The AliCloud region where the encryption key
-  lives. May also be specified by the `ALICLOUD_REGION`
-  environment variable.
-
-- `domain` `(string: "kms.us-east-1.aliyuncs.com")`: If set, overrides the endpoint
-  AliCloud would normally use for KMS for a particular region. May also be specified
-  by the `ALICLOUD_DOMAIN` environment variable.
-
-- `access_key` `(string: <required>)`: The AliCloud access key ID to use. May also be
-  specified by the `ALICLOUD_ACCESS_KEY` environment variable or as part of the
-  AliCloud profile from the AliCloud CLI or instance profile.
-
-- `secret_key` `(string: <required>)`: The AliCloud secret access key to use. May
-  also be specified by the `ALICLOUD_SECRET_KEY` environment variable or as
-  part of the AliCloud profile from the AliCloud CLI or instance profile.
-
-- `kms_key_id` `(string: <required>)`: The AliCloud KMS key ID to use for encryption
-  and decryption. May also be specified by the `VAULT_ALICLOUDKMS_SEAL_KEY_ID`
-  environment variable.
-
-- `disabled` `(string: "")`: Set this to `true` if Vault is migrating from an auto seal configuration. Otherwise, set to `false`.
-
-Refer to the [Seal Migration](/vault/docs/concepts/seal#seal-migration) documentation for more information about the seal migration process.
-
-## Authentication
-
-Authentication-related values must be provided, either as environment
-variables or as configuration parameters.
-
-~> **Note:** Although the configuration file allows you to pass in
-`ALICLOUD_ACCESS_KEY` and `ALICLOUD_SECRET_KEY` as part of the seal's parameters, it
-is _strongly_ recommended to set these values via environment variables.
-
-```text
-AliCloud authentication values:
-
-* `ALICLOUD_REGION`
-* `ALICLOUD_ACCESS_KEY`
-* `ALICLOUD_SECRET_KEY`
-```
-
-Note: The client uses the official AliCloud SDK and will use environment credentials,
-the specified credentials, or RAM role credentials in that order.
-
-## `alicloudkms` environment variables
-
-Alternatively, the AliCloud KMS seal can be activated by providing the following
-environment variables:
-
-```text
-Vault Seal specific values:
-
-* `VAULT_SEAL_TYPE`
-* `VAULT_ALICLOUDKMS_SEAL_KEY_ID`
-```
diff --git a/website/content/docs/configuration/seal/awskms.mdx b/website/content/docs/configuration/seal/awskms.mdx
deleted file mode 100644
index 66d51f8fc83..00000000000
--- a/website/content/docs/configuration/seal/awskms.mdx
+++ /dev/null
@@ -1,137 +0,0 @@
----
-layout: docs
-page_title: AWS KMS - Seals - Configuration
-description: |-
-  The AWS KMS seal configures Vault to use AWS KMS as the seal wrapping
-  mechanism.
----
-
-# `awskms` seal
-
-<Note title="Seal wrapping requires Vault Enterprise">
-
-  All Vault versions support **auto-unseal** for AWS, but **seal wrapping**
-  requires Vault Enterprise.
-  
-  Vault Enterprise enables seal wrapping by default, which means the KMS service
-  must be available at runtime and not just during the unseal process. Refer to
-  the [Seal wrap](/vault/docs/enterprise/sealwrap) overview for more
-  information.
-
-</Note>
-
-The AWS KMS seal configures Vault to use AWS KMS as the seal wrapping mechanism.
-The AWS KMS seal is activated by one of the following:
-
-- The presence of a `seal "awskms"` block in Vault's configuration file
-- The presence of the environment variable `VAULT_SEAL_TYPE` set to `awskms`. If
-  enabling via environment variable, all other required values specific to AWS
-  KMS (i.e. `VAULT_AWSKMS_SEAL_KEY_ID`) must be also supplied, as well as all
-  other AWS-related environment variables that lends to successful
-  authentication (i.e. `AWS_ACCESS_KEY_ID`, etc.).
-
-## `awskms` example
-
-This example shows configuring AWS KMS seal through the Vault configuration file
-by providing all the required values:
-
-```hcl
-seal "awskms" {
-  region     = "us-east-1"
-  access_key = "AKIAIOSFODNN7EXAMPLE"
-  secret_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
-  kms_key_id = "19ec80b0-dfdd-4d97-8164-c6examplekey"
-  endpoint   = "https://vpce-0e1bb1852241f8cc6-pzi0do8n.kms.us-east-1.vpce.amazonaws.com"
-}
-```
-
-## `awskms` parameters
-
-These parameters apply to the `seal` stanza in the Vault configuration file:
-
-- `region` `(string: "us-east-1")`: The AWS region where the encryption key
-  lives. If not provided, may be populated from the `AWS_REGION` or
-  `AWS_DEFAULT_REGION` environment variables, from your `~/.aws/config` file,
-  or from instance metadata.
-
-- `access_key` `(string: <required>)`: The AWS access key ID to use. May also be
-  specified by the `AWS_ACCESS_KEY_ID` environment variable or as part of the
-  AWS profile from the AWS CLI or instance profile.
-
-- `session_token` `(string: "")`: Specifies the AWS session token. This can
-  also be provided via the environment variable `AWS_SESSION_TOKEN`.
-
-- `secret_key` `(string: <required>)`: The AWS secret access key to use. May
-  also be specified by the `AWS_SECRET_ACCESS_KEY` environment variable or as
-  part of the AWS profile from the AWS CLI or instance profile.
-
-- `kms_key_id` `(string: <required>)`: The AWS KMS key ID or ARN to use for encryption
-  and decryption. May also be specified by the `VAULT_AWSKMS_SEAL_KEY_ID`
-  environment variable.  An alias in the format `alias/key-alias-name` may also be used here.
-
-- `disabled` `(string: "")`: Set this to `true` if Vault is migrating from an auto seal configuration. Otherwise, set to `false`.
-
-- `endpoint` `(string: "")`: The KMS API endpoint to be used to make AWS KMS
-  requests. May also be specified by the `AWS_KMS_ENDPOINT` environment
-  variable. This is useful, for example, when connecting to KMS over a [VPC
-  Endpoint](https://docs.aws.amazon.com/kms/latest/developerguide/kms-vpc-endpoint.html).
-  If not set, Vault will use the default API endpoint for your region.
-
-Refer to the [Seal Migration](/vault/docs/concepts/seal#seal-migration) documentation for more information about the seal migration process.
-
-## Authentication
-
-Authentication-related values must be provided, either as environment
-variables or as configuration parameters.
-
-~> **Note:** Although the configuration file allows you to pass in
-`AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` as part of the seal's parameters, it
-is _strongly_ recommended to set these values via environment variables.
-
-AWS authentication values:
-
-- `AWS_REGION` or `AWS_DEFAULT_REGION`
-- `AWS_ACCESS_KEY_ID`
-- `AWS_SECRET_ACCESS_KEY`
-
-Note: The client uses the official AWS SDK and will use the specified
-credentials, environment credentials, shared file credentials, or IAM role/ECS
-task credentials in that order, if the above AWS specific values are not
-provided.
-
-Vault needs the following permissions on the KMS key:
-
-- `kms:Encrypt`
-- `kms:Decrypt`
-- `kms:DescribeKey`
-
-These can be granted via IAM permissions on the principal that Vault uses, on
-the KMS key policy for the KMS key, or via KMS Grants on the key.
-
-## `awskms` environment variables
-
-Alternatively, the AWS KMS seal can be activated by providing the following
-environment variables.
-
-Vault Seal specific values:
-
-- `VAULT_SEAL_TYPE`
-- `VAULT_AWSKMS_SEAL_KEY_ID`
-
-## Key rotation
-
-This seal supports rotating the root keys defined in AWS KMS
-[doc](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html). Both automatic
-rotation and manual rotation is supported for KMS since the key information is stored with the
-encrypted data. Old keys must not be disabled or deleted and are used to decrypt older data.
-Any new or updated data will be encrypted with the current key defined in the seal configuration
-or set to current under a key alias.
-
-## AWS instance metadata timeout
-
-@include 'aws-imds-timeout.mdx'
-
-## Tutorial
-
-Refer to the [Auto-unseal using AWS KMS](/vault/tutorials/auto-unseal/autounseal-aws-kms)
-tutorial to learn how to auto-unseal Vault using AWS KMS.
diff --git a/website/content/docs/configuration/seal/azurekeyvault.mdx b/website/content/docs/configuration/seal/azurekeyvault.mdx
deleted file mode 100644
index 43b5d7dc275..00000000000
--- a/website/content/docs/configuration/seal/azurekeyvault.mdx
+++ /dev/null
@@ -1,127 +0,0 @@
----
-layout: docs
-page_title: Azure Key Vault - Seals - Configuration
-description: >-
-  The Azure Key Vault seal configures Vault to use Azure Key Vault as the seal
-  wrapping
-
-  mechanism.
----
-
-# `azurekeyvault` seal
-
-<Note title="Seal wrapping requires Vault Enterprise">
-
-  All Vault versions support **auto-unseal** for Azure Key Vault, but
-  **seal wrapping** requires Vault Enterprise.
-  
-  Vault Enterprise enables seal wrapping by default, which means the KMS service
-  must be available at runtime and not just during the unseal process. Refer to
-  the [Seal wrap](/vault/docs/enterprise/sealwrap) overview for more
-  information.
-
-</Note>
-
-The Azure Key Vault seal configures Vault to use Azure Key Vault as the seal
-wrapping mechanism. The Azure Key Vault seal is activated by one of the following:
-
-- The presence of a `seal "azurekeyvault"` block in Vault's configuration file.
-- The presence of the environment variable `VAULT_SEAL_TYPE` set to `azurekeyvault`.
-  If enabling via environment variable, all other required values specific to
-  Key Vault (i.e. `VAULT_AZUREKEYVAULT_VAULT_NAME`, etc.) must be also supplied, as
-  well as all other Azure-related environment variables that lends to successful
-  authentication (i.e. `AZURE_TENANT_ID`, etc.).
-
-## `azurekeyvault` example
-
-This example shows configuring Azure Key Vault seal through the Vault
-configuration file by providing all the required values:
-
-```hcl
-seal "azurekeyvault" {
-  tenant_id      = "46646709-b63e-4747-be42-516edeaf1e14"
-  client_id      = "03dc33fc-16d9-4b77-8152-3ec568f8af6e"
-  client_secret  = "DUJDS3..."
-  vault_name     = "hc-vault"
-  key_name       = "vault_key"
-}
-```
-
-## `azurekeyvault` parameters
-
-These parameters apply to the `seal` stanza in the Vault configuration file:
-
-- `tenant_id` `(string: <required>)`: The tenant id for the Azure Active Directory organization. May
-  also be specified by the `AZURE_TENANT_ID` environment variable.
-
-- `client_id` `(string: <required or MSI>)`: The client id for credentials to query the Azure APIs.
-  May also be specified by the `AZURE_CLIENT_ID` environment variable.
-
-- `client_secret` `(string: <required or MSI>)`: The client secret for credentials to query the Azure APIs.
-  May also be specified by the `AZURE_CLIENT_SECRET` environment variable.
-
-- `environment` `(string: "AZUREPUBLICCLOUD")`: The Azure Cloud environment API endpoints to use. May also
-  be specified by the `AZURE_ENVIRONMENT` environment variable.
-
-- `vault_name` `(string: <required>)`: The Key Vault vault to use the encryption keys for encryption and
-  decryption. May also be specified by the `VAULT_AZUREKEYVAULT_VAULT_NAME` environment variable.
-
-- `key_name` `(string: <required>)`: The Key Vault key to use for encryption and decryption. May also be specified by the
-  `VAULT_AZUREKEYVAULT_KEY_NAME` environment variable.
-
-- `resource` `(string: "vault.azure.net")`: The AZ KeyVault resource's DNS Suffix to connect to.
-  May also be specified in the `AZURE_AD_RESOURCE` environment variable.
-  Needs to be changed to connect to Azure's Managed HSM KeyVault instance type.
-
-- `disabled` `(string: "")`: Set this to `true` if Vault is migrating from an auto seal configuration. Otherwise, set to `false`.
-
-Refer to the [Seal Migration](/vault/docs/concepts/seal#seal-migration) documentation for more information about the seal migration process.
-
-
-## Authentication
-
-Authentication-related values must be provided, either as environment
-variables or as configuration parameters.
-
-Azure authentication values:
-
-- `AZURE_TENANT_ID`
-- `AZURE_CLIENT_ID`
-- `AZURE_CLIENT_SECRET`
-- `AZURE_ENVIRONMENT`
-- `AZURE_AD_RESOURCE`
-
-~> **Note:** If Vault is hosted on Azure, Vault can use Managed Service
-Identities (MSI) to access Azure instead of an environment and shared client id
-and secret. MSI must be
-[enabled](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/qs-configure-portal-windows-vm)
-on the VMs hosting Vault, and it is the preferred configuration since MSI
-prevents your Azure credentials from being stored as clear text. Refer to the
-[Production
-Hardening](/vault/tutorials/operations/production-hardening) tutorial
-for more best practices.
-
--> **Note:** If you are using a Managed HSM KeyVault, `AZURE_AD_RESOURCE` or the `resource`
-configuration parameter must be specified; usually this should point to `managedhsm.azure.net`,
-but could point to other suffixes depending on Azure environment.
-
-## `azurekeyvault` environment variables
-
-Alternatively, the Azure Key Vault seal can be activated by providing the following
-environment variables:
-
-- `VAULT_AZUREKEYVAULT_VAULT_NAME`
-- `VAULT_AZUREKEYVAULT_KEY_NAME`
-
-## Key rotation
-
-This seal supports rotating keys defined in Azure Key Vault. Key metadata is
-stored with the encrypted data to ensure the correct key is used during
-decryption operations. Simply [set up Azure Key Vault with key
-rotation](https://docs.microsoft.com/en-us/azure/key-vault/key-vault-key-rotation-log-monitoring)
-using Azure Automation Account and Vault will recognize newly rotated keys.
-
-## Tutorial
-
-Refer to the [Auto-unseal using Azure Key Vault](/vault/tutorials/auto-unseal/autounseal-azure-keyvault)
-tutorial to learn how to use the Azure Key Vault to auto-unseal a Vault server.
diff --git a/website/content/docs/configuration/seal/gcpckms.mdx b/website/content/docs/configuration/seal/gcpckms.mdx
deleted file mode 100644
index 01f2bf6f01f..00000000000
--- a/website/content/docs/configuration/seal/gcpckms.mdx
+++ /dev/null
@@ -1,130 +0,0 @@
----
-layout: docs
-page_title: GCP Cloud KMS - Seals - Configuration
-description: >-
-  The GCP Cloud KMS seal configures Vault to use GCP Cloud KMS as the seal
-  wrapping
-
-  mechanism.
----
-
-# `gcpckms` seal
-
-<Note title="Seal wrapping requires Vault Enterprise">
-
-  All Vault versions support **auto-unseal** for GCP Cloud, but **seal wrapping**
-  requires Vault Enterprise.
-  
-  Vault Enterprise enables seal wrapping by default, which means the KMS service
-  must be available at runtime and not just during the unseal process. Refer to
-  the [Seal wrap](/vault/docs/enterprise/sealwrap) overview for more
-  information.
-
-</Note>
-
-The GCP Cloud KMS seal configures Vault to use GCP Cloud KMS as the seal
-wrapping mechanism. The GCP Cloud KMS seal is activated by one of the following:
-
-- The presence of a `seal "gcpckms"` block in Vault's configuration file.
-- The presence of the environment variable `VAULT_SEAL_TYPE` set to `gcpckms`.
-  If enabling via environment variable, all other required values specific to
-  Cloud KMS (i.e. `VAULT_GCPCKMS_SEAL_KEY_RING`, etc.) must be also supplied, as
-  well as all other GCP-related environment variables that lends to successful
-  authentication (i.e. `GOOGLE_PROJECT`, etc.).
-
-## `gcpckms` example
-
-This example shows configuring GCP Cloud KMS seal through the Vault
-configuration file by providing all the required values:
-
-```hcl
-seal "gcpckms" {
-  credentials = "/usr/vault/vault-project-user-creds.json"
-  project     = "vault-project"
-  region      = "global"
-  key_ring    = "vault-keyring"
-  crypto_key  = "vault-key"
-}
-```
-
-## `gcpckms` parameters
-
-These parameters apply to the `seal` stanza in the Vault configuration file:
-
-- `credentials` `(string: <required>)`: The path to the credentials JSON file
-  to use. May be also specified by the `GOOGLE_CREDENTIALS` or
-  `GOOGLE_APPLICATION_CREDENTIALS` environment variable or set automatically if
-  running under Google App Engine, Google Compute Engine or Google Kubernetes
-  Engine.
-
-- `project` `(string: <required>)`: The GCP project ID to use. May also be
-  specified by the `GOOGLE_PROJECT` environment variable.
-
-- `region` `(string: <required>)`: The GCP region/location where the key ring
-  lives. May also be specified by the `GOOGLE_REGION` environment variable.
-
-- `key_ring` `(string: <required>)`: The GCP CKMS key ring to use. May also be
-  specified by the `VAULT_GCPCKMS_SEAL_KEY_RING` environment variable.
-
-- `crypto_key` `(string: <required>)`: The GCP CKMS crypto key to use for
-  encryption and decryption. May also be specified by the
-  `VAULT_GCPCKMS_SEAL_CRYPTO_KEY` environment variable.
-
-- `disabled` `(string: "")`: Set this to `true` if Vault is migrating from an auto seal configuration. Otherwise, set to `false`.
-
-Refer to the [Seal Migration](/vault/docs/concepts/seal#seal-migration) documentation for more information about the seal migration process.
-
-## Authentication &amp; permissions
-
-Authentication-related values must be provided, either as environment
-variables or as configuration parameters.
-
-GCP authentication values:
-
-- `GOOGLE_CREDENTIALS` or `GOOGLE_APPLICATION_CREDENTIALS`
-- `GOOGLE_PROJECT`
-- `GOOGLE_REGION`
-
-Note: The client uses the official Google SDK and will use the specified
-credentials, environment credentials, or [application default
-credentials](https://developers.google.com/identity/protocols/application-default-credentials)
-in that order, if the above GCP specific values are not provided.
-
-The service account needs the following minimum permissions on the crypto key:
-
-```text
-cloudkms.cryptoKeyVersions.useToEncrypt
-cloudkms.cryptoKeyVersions.useToDecrypt
-cloudkms.cryptoKeys.get
-```
-
-These permissions can be described with the following role:
-
-```text
-roles/cloudkms.cryptoKeyEncrypterDecrypter
-cloudkms.cryptoKeys.get
-```
-
-`cloudkms.cryptoKeys.get` permission is used for retrieving metadata information of keys from CloudKMS within this engine initialization process.
-
-## `gcpckms` environment variables
-
-Alternatively, the GCP Cloud KMS seal can be activated by providing the following
-environment variables:
-
-- `VAULT_SEAL_TYPE`
-- `VAULT_GCPCKMS_SEAL_KEY_RING`
-- `VAULT_GCPCKMS_SEAL_CRYPTO_KEY`
-
-## Key rotation
-
-This seal supports rotating keys defined in Google Cloud KMS
-[doc](https://cloud.google.com/kms/docs/rotating-keys). Both scheduled rotation and manual
-rotation is supported for CKMS since the key information. Old keys version must not be
-disabled or deleted and are used to decrypt older data. Any new or updated data will be
-encrypted with the primary key version.
-
-## Tutorial
-
-Refer to the [Auto-unseal using GCP Cloud KMS](/vault/tutorials/auto-unseal/autounseal-gcp-kms)
-guide for a step-by-step tutorial.
diff --git a/website/content/docs/configuration/seal/index.mdx b/website/content/docs/configuration/seal/index.mdx
deleted file mode 100644
index 1f5dd3e6a48..00000000000
--- a/website/content/docs/configuration/seal/index.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
----
-layout: docs
-page_title: Seals - Configuration
-description: >-
-  The seal stanza configures the seal type to use for additional data
-  protection.
----
-
-# `seal` stanza
-
-The `seal` stanza configures the seal type to use for additional data
-protection, such as using HSM or Cloud KMS solutions to encrypt and decrypt the
-root key. This stanza is optional, and in the case of the root key, Vault
-will use the Shamir algorithm to cryptographically split the root key if this
-is not configured.
-
-## Seal wrapping <EnterpriseAlert inline="true" product="vault" />
-
-The seal can also be used for seal wrapping to add an extra layer of protection
-and satisfy compliance and regulatory requirements.
-
-Seal wrap is enabled by default for Vault Enterprise. Refer to the
-[Seal wrap](/vault/docs/enterprise/sealwrap) overview for more information.
-
-## Configuration
-
-Seal configuration can be done through the Vault configuration file using the
-`seal` stanza:
-
-```hcl
-seal [TYPE] {
-  # ...
-}
-```
-
-For example:
-
-```hcl
-seal "pkcs11" {
-  # ...
-}
-```
-
-For configuration options which also read an environment variable, the
-environment variable will take precedence over values in the configuration file.
-
-[sealwrap]: /vault/docs/enterprise/sealwrap
\ No newline at end of file
diff --git a/website/content/docs/configuration/seal/ocikms.mdx b/website/content/docs/configuration/seal/ocikms.mdx
deleted file mode 100644
index ac5c2b5f59b..00000000000
--- a/website/content/docs/configuration/seal/ocikms.mdx
+++ /dev/null
@@ -1,128 +0,0 @@
----
-layout: docs
-page_title: OCI KMS - Seals - Configuration
-description: |-
-  The OCI KMS seal configures Vault to use OCI KMS as the seal wrapping
-  mechanism.
----
-
-# `ocikms` seal
-
-<Note title="Seal wrapping requires Vault Enterprise">
-
-  All Vault versions support **auto-unseal** for OCI KMS, but **seal wrapping**
-  requires Vault Enterprise.
-  
-  Vault Enterprise enables seal wrapping by default, which means the KMS service
-  must be available at runtime and not just during the unseal process. Refer to
-  the [Seal wrap](/vault/docs/enterprise/sealwrap) overview for more
-  information.
-
-</Note>
-
-The OCI KMS seal configures Vault to use OCI KMS as the seal wrapping mechanism.
-The OCI KMS seal is activated by one of the following:
-
-- The presence of a `seal "ocikms"` block in Vault's configuration file
-- The presence of the environment variable `VAULT_SEAL_TYPE` set to `ocikms`. If
-  enabling via environment variable, all other required values specific to OCI
-  KMS (i.e. `VAULT_OCIKMS_SEAL_KEY_ID`, `VAULT_OCIKMS_CRYPTO_ENDPOINT` `VAULT_OCIKMS_MANAGEMENT_ENDPOINT`) must be also supplied, as well as all
-  other OCI-related [environment variables][oci-sdk] that lends to successful
-  authentication.
-
-## `ocikms` example
-
-This example shows configuring the OCI KMS seal through the Vault configuration file
-by providing all the required values:
-
-```hcl
-seal "ocikms" {
-    key_id               = "ocid1.key.oc1.iad.afnxza26aag4s.abzwkljsbapzb2nrha5nt3s7s7p42ctcrcj72vn3kq5qx"
-    crypto_endpoint      = "https://afnxza26aag4s-crypto.kms.us-ashburn-1.oraclecloud.com"
-    management_endpoint  = "https://afnxza26aag4s-management.kms.us-ashburn-1.oraclecloud.com"
-    auth_type_api_key    = "true"
-}
-```
-
-## `ocikms` parameters
-
-These parameters apply to the `seal` stanza in the Vault configuration file:
-
-- `key_id` `(string: <required>)`: The OCI KMS key ID to use. May also be
-  specified by the `VAULT_OCIKMS_SEAL_KEY_ID` environment variable.
-- `crypto_endpoint` `(string: <required>)`: The OCI KMS cryptographic endpoint (or data plane endpoint)
-  to be used to make OCI KMS encryption/decryption requests. May also be specified by the `VAULT_OCIKMS_CRYPTO_ENDPOINT` environment
-  variable.
-- `management_endpoint` `(string: <required>)`: The OCI KMS management endpoint (or control plane endpoint)
-  to be used to make OCI KMS key management requests. May also be specified by the `VAULT_OCIKMS_MANAGEMENT_ENDPOINT` environment
-  variable.
-- `auth_type_api_key` `(boolean: false)`: Specifies if using API key to authenticate to OCI KMS service.
-  If it is `false`, Vault authenticates using the instance principal from the compute instance. See Authentication section for details. Default is `false`.
-
-- `disabled` `(string: "")`: Set this to `true` if Vault is migrating from an auto seal configuration. Otherwise, set to `false`.
-
-Refer to the [Seal Migration](/vault/docs/concepts/seal#seal-migration) documentation for more information about the seal migration process.
-
-## Authentication
-
-Authentication-related values must be provided, either as environment
-variables or as configuration parameters.
-
-If you want to use Instance Principal, add section configuration below and add further configuration settings as detailed in the [configuration docs](/vault/docs/configuration/).
-
-```hcl
-seal "ocikms" {
-    crypto_endpoint     = "<kms-crypto-endpoint>"
-    management_endpoint = "<kms-management-endpoint>"
-    key_id              = "<kms-key-id>"
-}
-# Notes:
-# crypto_endpoint can be replaced by VAULT_OCIKMS_CRYPTO_ENDPOINT environment var
-# management_endpoint can be replaced by VAULT_OCIKMS_MANAGEMENT_ENDPOINT environment var
-# key_id can be replaced by VAULT_OCIKMS_SEAL_KEY_ID environment var
-```
-
-If you want to use User Principal, the plugin will take the API key you defined for OCI SDK, often under `~/.oci/config`.
-
-```hcl
-seal "ocikms" {
-    auth_type_api_key   = true
-    crypto_endpoint     = "<kms-crypto-endpoint>"
-    management_endpoint = "<kms-management-endpoint>"
-    key_id              = "<kms-key-id>"
-}
-```
-
-To grant permission for a compute instance to use OCI KMS service, write policies for KMS access.
-
-- Create a [Dynamic Group][oci-dg] in your OCI tenancy.
-- Create a policy that allows the Dynamic Group to use or manage keys from OCI KMS. There are multiple ways to write these policies. The [OCI Identity Policy][oci-id] can be used as a reference or starting point.
-
-The most common policy allows a dynamic group of tenant A to use KMS's keys in tenant B:
-
-```text
-define tenancy tenantB as <tenantB-ocid>
-
-endorse dynamic-group <dynamic-group-name> to use keys in tenancy tenantB
-
-```
-
-```text
-define tenancy tenantA as <tenantA-ocid>
-
-define dynamic-group <dynamic-group-name> as <dynamic-group-ocid>
-
-admit dynamic-group <dynamic-group-name> of tenancy tenantA to use keys in compartment <key-compartment>
-
-```
-
-## `ocikms` rotate OCI KMS master key
-
-For the [OCI KMS key rotation feature][oci-kms-rotation], OCI KMS will create a new version of key internally. This process is independent from Vault, and Vault still uses the same `key_id` without any interruption.
-
-If you want to change the `key_id`: migrate to Shamir, change `key_id`, and then migrate to OCI KMS with the new `key_id`.
-
-[oci-sdk]: https://docs.cloud.oracle.com/iaas/Content/API/Concepts/sdkconfig.htm
-[oci-dg]: https://docs.cloud.oracle.com/iaas/Content/Identity/Tasks/managingdynamicgroups.htm
-[oci-id]: https://docs.cloud.oracle.com/iaas/Content/Identity/Concepts/policies.htm
-[oci-kms-rotation]: https://docs.cloud.oracle.com/iaas/Content/KeyManagement/Tasks/managingkeys.htm
diff --git a/website/content/docs/configuration/seal/pkcs11.mdx b/website/content/docs/configuration/seal/pkcs11.mdx
deleted file mode 100644
index 2a1ffe67967..00000000000
--- a/website/content/docs/configuration/seal/pkcs11.mdx
+++ /dev/null
@@ -1,292 +0,0 @@
----
-layout: docs
-page_title: PKCS11 - Seals - Configuration
-description: |-
-  The PKCS11 seal configures Vault to use an HSM with PKCS11 as the seal
-  wrapping mechanism.
----
-
-# `pkcs11` seal
-
-
-<Note title="Auto-unseal and seal wrapping requires Vault Enterprise">
-
-  Auto-unseal **and** seal wrapping for PKCS11 require Vault Enterprise.
-  
-  Vault Enterprise enables seal wrapping by default, which means the KMS service
-  must be available at runtime and not just during the unseal process. Refer to
-  the [Seal wrap](/vault/docs/enterprise/sealwrap) overview for more
-  information.
-
-</Note>
-
-The PKCS11 seal configures Vault to use an HSM with PKCS11 as the seal wrapping
-mechanism. Vault Enterprise's HSM PKCS11 support is activated by one of the
-following:
-
-- The presence of a `seal "pkcs11"` block in Vault's configuration file
-- The presence of the environment variable `VAULT_HSM_LIB` set to the library's
-  path as well as `VAULT_SEAL_TYPE` set to `pkcs11`. If enabling via environment
-  variable, all other required values (i.e. `VAULT_HSM_SLOT`) must be also
-  supplied.
-
-**IMPORTANT**: Having Vault generate its own key is the easiest way to get up
-and running, but for security, Vault marks the key as non-exportable. If your
-HSM key backup strategy requires the key to be exportable, you should generate
-the key yourself. The list of creation attributes that Vault uses to generate
-the key are listed at the end of this document.
-
-## Requirements
-
-The following software packages are required for Vault Enterprise HSM:
-
-- PKCS#11 compatible HSM integration library. Vault targets version 2.2 or
-  higher of PKCS#11. Depending on any given HSM, some functions (such as key
-  generation) may have to be performed manually.
-- The [GNU libltdl
-  library](https://www.gnu.org/software/libtool/manual/html_node/Using-libltdl.html)
-  — ensure that it is installed for the correct architecture of your servers
-
-## `pkcs11` example
-
-This example shows configuring HSM PKCS11 seal through the Vault configuration
-file by providing all the required values:
-
-```hcl
-seal "pkcs11" {
-  lib            = "/usr/vault/lib/libCryptoki2_64.so"
-  slot           = "2305843009213693953"
-  pin            = "AAAA-BBBB-CCCC-DDDD"
-  key_label      = "vault-hsm-key"
-  hmac_key_label = "vault-hsm-hmac-key"
-}
-```
-
-## `pkcs11` parameters
-
-These parameters apply to the `seal` stanza in the Vault configuration file:
-
-- `lib` `(string: <required>)`: The path to the PKCS#11 library shared object
-  file. May also be specified by the `VAULT_HSM_LIB` environment variable.
-
-  ~> **Note:** Depending on your HSM, the value of the `lib` parameter may be
-  either a binary or a dynamic library, and its use may require other libraries
-  depending on which system the Vault binary is currently running on (e.g.: a
-  Linux system may require other libraries to interpret Windows .dll files).
-
-- `slot` `(string: <slot or token label required>)`: The slot number to use,
-  specified as a string (e.g. `"2305843009213693953"`). May also be specified by
-  the `VAULT_HSM_SLOT` environment variable.
-
-  ~> **Note**: Slots are typically listed as hex-decimal values in the OS setup
-  utility but this configuration uses their decimal equivalent. For example, using the
-  HSM command-line `pkcs11-tool`, a slot listed as `0x2000000000000001`in hex is equal
-  to `2305843009213693953` in decimal; these values may be listed shorter or
-  differently as determined by the HSM in use.
-
-- `token_label` `(string: <slot or token label required>)`: The slot token label to
-  use. May also be specified by the `VAULT_HSM_TOKEN_LABEL` environment variable.
-
-- `pin` `(string: <required>)`: The PIN for login. May also be specified by the
-  `VAULT_HSM_PIN` environment variable. _If set via the environment variable,
-  it will need to be re-set if Vault is restarted._
-
-- `key_label` `(string: <required>)`: The label of the key to use. If the key
-  does not exist and generation is enabled, this is the label that will be given
-  to the generated key. May also be specified by the `VAULT_HSM_KEY_LABEL`
-  environment variable.
-
-- `default_key_label` `(string: "")`: This is the default key label for decryption
-  operations. Prior to 0.10.1, key labels were not stored with the ciphertext.
-  Seal entries now track the label used in encryption operations. The default value
-  for this field is the `key_label`. If `key_label` is rotated and this value is not
-  set, decryption may fail. May also be specified by the `VAULT_HSM_DEFAULT_KEY_LABEL`
-  environment variable. This value is ignored in new installations.
-
-- `key_id` `(string: "")`: The ID of the key to use. The value should be a hexadecimal
-  string (e.g., "0x33333435363434373537"). May also be specified by the
-  `VAULT_HSM_KEY_ID` environment variable.
-
-- `hmac_key_label` `(string: <required>)`: The label of the key to use for
-  HMACing. This needs to be a suitable type. If Vault tries to create this it
-  will attempt to use CKK_GENERIC_SECRET_KEY. If the key does not exist and
-  generation is enabled, this is the label that will be given to the generated
-  key. May also be specified by the `VAULT_HSM_HMAC_KEY_LABEL` environment
-  variable.
-
-- `default_hmac_key_label` `(string: "")`: This is the default HMAC key label for signing
-  operations. Prior to 0.10.1, HMAC key labels were not stored with the signature.
-  Seal entries now track the label used in signing operations. The default value
-  for this field is the `hmac_key_label`. If `hmac_key_label` is rotated and this
-  value is not set, signature verification may fail. May also be specified by the
-  `VAULT_HSM_HMAC_DEFAULT_KEY_LABEL` environment variable. This value is ignored in
-  new installations.
-
-- `hmac_key_id` `(string: "")`: The ID of the HMAC key to use. The value should be a
-  hexadecimal string (e.g., "0x33333435363434373537"). May also be specified by the
-  `VAULT_HSM_HMAC_KEY_ID` environment variable.
-
-- `mechanism` `(string: <best available>)`: The encryption/decryption mechanism to use,
-  specified as a decimal or hexadecimal (prefixed by `0x`) string. May also be
-  specified by the `VAULT_HSM_MECHANISM` environment variable.
-  Currently supported mechanisms (in order of precedence):
-
-  - `0x1085` `CKM_AES_CBC_PAD` (HMAC mechanism required)
-  - `0x1082` `CKM_AES_CBC` (HMAC mechanism required)
-  - `0x1087` `CKM_AES_GCM`
-  - `0x0009` `CKM_RSA_PKCS_OAEP`
-  - `0x0001` `CKM_RSA_PKCS`
-
-  ~> **Warning**: CKM_RSA_PKCS specifies the PKCS #1 v1.5 padding scheme, which is
-  in considered less secure than OAEP. Where possible, use of CKM_RSA_PKCS_OAEP is
-  recommended over CKM_RSA_PKCS.
-
-- `hmac_mechanism` `(string: "0x0251")`: The encryption/decryption mechanism to
-  use, specified as a decimal or hexadecimal (prefixed by `0x`) string.
-  Currently only `0x0251` (corresponding to `CKM_SHA256_HMAC` from the
-  specification) is supported. May also be specified by the
-  `VAULT_HSM_HMAC_MECHANISM` environment variable. This value is only required
-  for specific mechanisms.
-
-- `generate_key` `(string: "false")`: If no existing key with the label
-  specified by `key_label` can be found at Vault initialization time, instructs
-  Vault to generate a key. This is a boolean expressed as a string (e.g.
-  `"true"`). May also be specified by the `VAULT_HSM_GENERATE_KEY` environment
-  variable. Vault may not be able to successfully generate keys in all
-  circumstances, such as if proprietary vendor extensions are required to
-  create keys of a suitable type.
-
-- `force_rw_session` `(string: "false")`: Force all operations to open up
-  a read-write session to the HSM. This is a boolean expressed as a string (e.g.
-  `"true"`). May also be specified by the `VAULT_HSM_FORCE_RW_SESSION` environment
-  variable. This key is mainly to work around a limitation within AWS's CloudHSM v5
-  pkcs11 implementation.
-
-- `max_parallel` `(int: 1)` - The number of concurrent requests that may be
-  in flight to the HSM at any given time.
-
-- `disabled` `(string: "")`: Set this to `true` if Vault is migrating from an auto seal configuration. Otherwise, set to `false`.
-
-Refer to the [Seal Migration](/vault/docs/concepts/seal#seal-migration) documentation for more information about the seal migration process.
-  
-### Mechanism specific flags
-
-- `rsa_encrypt_local` `(string: "false")`: For HSMs that do not support encryption
-  for RSA keys, perform encryption locally. Available for mechanisms
-  `CKM_RSA_PKCS_OAEP` and `CKM_RSA_PKCS`. May also be specified by the
-  `VAULT_HSM_RSA_ENCRYPT_LOCAL` environment variable.
-
-- `rsa_oaep_hash` `(string: "sha256")`: Specify the hash algorithm to use for RSA
-  with OAEP padding. Valid values are sha1, sha224, sha256, sha384, and sha512.
-  Available for mechanism `CKM_RSA_PKCS_OAEP`. May also be specified by the
-  `VAULT_HSM_RSA_OAEP_HASH` environment variable.
-
-~> **Note:** Although the configuration file allows you to pass in
-`VAULT_HSM_PIN` as part of the seal's parameters, it is _strongly_ recommended
-to set this value via environment variables.
-
-## `pkcs11` environment variables
-
-Alternatively, the HSM seal can be activated by providing the following
-environment variables:
-
-```text
-VAULT_SEAL_TYPE
-VAULT_HSM_LIB
-VAULT_HSM_SLOT
-VAULT_HSM_TOKEN_LABEL
-VAULT_HSM_PIN
-VAULT_HSM_KEY_LABEL
-VAULT_HSM_DEFAULT_KEY_LABEL
-VAULT_HSM_KEY_ID
-VAULT_HSM_HMAC_KEY_LABEL
-VAULT_HSM_HMAC_DEFAULT_KEY_LABEL
-VAULT_HSM_HMAC_KEY_ID
-VAULT_HSM_MECHANISM
-VAULT_HSM_HMAC_MECHANISM
-VAULT_HSM_GENERATE_KEY
-VAULT_HSM_RSA_ENCRYPT_LOCAL
-VAULT_HSM_RSA_OAEP_HASH
-VAULT_HSM_FORCE_RW_SESSION
-```
-
-## Vault key generation attributes
-
-If Vault generates the HSM key for you, the following is the list of attributes
-it uses. These identifiers correspond to official PKCS#11 identifiers.
-
-### AES key
-
-- `CKA_CLASS`: `CKO_SECRET_KEY` (It's a secret key)
-- `CKA_KEY_TYPE`: `CKK_AES` (Key type is AES)
-- `CKA_VALUE_LEN`: `32` (Key size is 256 bits)
-- `CKA_LABEL`: Set to the key label set in Vault's configuration
-- `CKA_ID`: Set to a random 32-bit unsigned integer
-- `CKA_PRIVATE`: `true` (Key is private to this slot/token)
-- `CKA_TOKEN`: `true` (Key persists to the slot/token rather than being for one
-  session only)
-- `CKA_SENSITIVE`: `true` (Key is a sensitive value)
-- `CKA_ENCRYPT`: `true` (Key can be used for encryption)
-- `CKA_DECRYPT`: `true` (Key can be used for decryption)
-- `CKA_WRAP`: `true` (Key can be used for wrapping)
-- `CKA_UNWRAP`: `true` (Key can be used for unwrapping)
-- `CKA_EXTRACTABLE`: `false` (Key cannot be exported)
-
-### RSA key
-
-_Public Key_
-
-- `CKA_CLASS`: `CKO_PUBLIC_KEY` (It's a public key)
-- `CKA_KEY_TYPE`: `CKK_RSA` (Key type is RSA)
-- `CKA_LABEL`: Set to the key label set in Vault's configuration
-- `CKA_ID`: Set to a random 32-bit unsigned integer
-- `CKA_ENCRYPT`: `true` (Key can be used for encryption)
-- `CKA_WRAP`: `true` (Key can be used for wrapping)
-- `CKA_MODULUS_BITS`: `2048` (Key size is 2048 bits)
-- `CKA_PUBLIC_EXPONENT`: `0x10001` (Public exponent of 65537)
-- `CKA_TOKEN`: `true` (Key persists to the slot/token rather than being for one
-  session only)
-
-_Private Key_
-
-- `CKA_CLASS`: `CKO_PRIVATE_KEY` (It's a private key)
-- `CKA_KEY_TYPE`: `CKK_RSA` (Key type is RSA)
-- `CKA_LABEL`: Set to the key label set in Vault's configuration
-- `CKA_ID`: Set to a random 32-bit unsigned integer
-- `CKA_DECRYPT`: `true` (Key can be used for decryption)
-- `CKA_UNWRAP`: `true` (Key can be used for unwrapping)
-- `CKA_TOKEN`: `true` (Key persists to the slot/token rather than being for one
-  session only)
-- `CKA_EXTRACTABLE`: `false` (Key cannot be exported)
-
-### HMAC key
-
-- `CKA_CLASS`: `CKO_SECRET_KEY` (It's a secret key)
-- `CKA_KEY_TYPE`: `CKK_GENERIC_SECRET_KEY` (Key type is a generic secret key)
-- `CKA_VALUE_LEN`: `32` (Key size is 256 bits)
-- `CKA_LABEL`: Set to the HMAC key label set in Vault's configuration
-- `CKA_ID`: Set to a random 32-bit unsigned integer
-- `CKA_PRIVATE`: `true` (Key is private to this slot/token)
-- `CKA_TOKEN`: `true` (Key persists to the slot/token rather than being for one
-  session only)
-- `CKA_SENSITIVE`: `true` (Key is a sensitive value)
-- `CKA_SIGN`: `true` (Key can be used for signing)
-- `CKA_VERIFY`: `true` (Key can be used for verifying)
-- `CKA_EXTRACTABLE`: `false` (Key cannot be exported)
-
-## Key rotation
-
-This seal supports rotating keys by using different key labels to track key versions. To rotate
-the key value, generate a new key in a different key label in the HSM and update Vault's
-configuration with the new key label value. Restart your vault instance to pick up the new key
-label and all new encryption operations will use the updated key label. Old keys must not be disabled
-or deleted and are used to decrypt older data.
-
-**NOTE**: Prior to version 0.10.1, key information was not tracked with the ciphertext. If
-rotation is desired for data that was seal wrapped prior to this version must also set
-`default_key_label` and `hmac_default_key_label` to allow for decryption of older values.
-
-## Tutorial
-
-Refer to the [HSM Integration - Seal Wrap](/vault/tutorials/auto-unseal/seal-wrap)
-tutorial to learn how to enable the Seal Wrap feature to protect your data.
diff --git a/website/content/docs/configuration/seal/seal-ha.mdx b/website/content/docs/configuration/seal/seal-ha.mdx
deleted file mode 100644
index 4af6194bf43..00000000000
--- a/website/content/docs/configuration/seal/seal-ha.mdx
+++ /dev/null
@@ -1,113 +0,0 @@
----
-layout: docs
-page_title: Seal High Availability - Seals - Configuration
-description: |-
-  How to configure multiple Seals for high availability.
----
-
-# Seal High Availability
-
-<EnterpriseAlert product="vault" />
-
-[Seal High Availability](/vault/docs/concepts/seal#seal-high-availability-enterprise) 
-provides the means to configure at least two auto-seals (and no more than three)
-in order to have resilience against outage of a seal service or mechanism.   
-
-Using Seal HA involves configuring extra seals in Vault's server configuration file
-and restarting Vault or triggering a reload of it's configuration via sending
-it the SIGHUP signal.
-
-Before using Seal HA, one must have upgraded to Vault 1.16 or higher.
-
-## Adding and Removing Seals
-
-In order to use Seal HA, there must be more than one defined `seal` stanza
-in Vault's configuration.
-
-Seal HA adds two fields to these stanzas, `name`, and `priority`:
-
-```hcl
-seal [TYPE] {
-  name = "seal-name"
-  priority = "1"
-  # ...
-}
-```
-
-Name is optional, and if not specified is set to the type of the seal.  Names
-must be unique.  If using two seals of the same type name must be specified.
-Internally, name is used to disambiguate seal wrapped values in some cases,
-so renaming seals should be avoided if possible.
-
-Priority is mandatory if more than one seal is specified.  Priority tells Vault
-the order in which to try seals during unseal (least priority first), 
-in the case more than one seal can unwrap a seal wrapped value, the order
-in which to attempt decryption, and which order to attempt to source entropy
-for entropy augmentation.  This can be useful if your seals have different
-performance or cost characteristics.
-
-All configured, healthy seals are used to seal wrap values.  This means that
-for every write of a seal wrapped value or CSP, an encryption is requested
-from every configured seal, and the results are stored in the storage entry.
-When seals are unhealthy, Vault keeps track of values that could not be fully 
-wrapped and will re-wrap them once seals become healthy again.  Disabled seals 
-can still be used for decryption of wrapped values, but will be avoided when
-encrypting values.
-
-When reading a CSP or seal wrapped value, Vault will try to decrypt with the
-highest priority available seal, and then try other seals on failure.
-
-To add an additional seal, simply add another seal stanza, specifying priority
-and optionally name, and restart Vault.
-
-To remove a seal, remove the corresponding seal stanza and restart.  There must
-be at least one seal remaining.
-
-It is highly recommended to take a snapshot of your Vault storage before applying 
-any seal configuration change.
-
-Once Vault unseals with the new seal configuration, it will be available to process
-traffic even as re-wrapping proceeds.
-
-Here is a partial snippet of a two seal HA setup, using an AWS KMS seal as
-the primary (highest priority) seal, and a Azure KMS seal as well:
-
-```
-seal "awskms" {
-  name = "AWS"
-  priority = "1"
-  # ...
-}
-
-seal "azurekeyvault" {
-  name = "Azure"
-  priority = "2"
-  # ...
-}
-```
-
-### Safety checks
-
-Vault will reject seal configuration changes in the following circumstances,
-as a safety mechanism:
-
-* The old seal configuration and new seal configuration do not share one seal
-in common.  This is necessary as there would be no seal capable of decrypting
-CSPs or seal wrapped values previously written.
-
-* Seal re-wrapping is in progress.  Vault must be in a clean, fully wrapped state
-on the previous configuration before attempting a configuration change.
-
-* More than one seal is being added or removed at a time.  
-
-### Interaction with Shamir Seals
-
-Seal HA is only supported with auto seal mechanisms.  To use Seal HA when
-running a Shamir seal, first use the traditional 
-[seal migration](/vault/docs/concepts/seal#seal-migration) mechanism to migrate to
-an auto seal of your choice.  Afterwards you may follow the above
-instructions to add a second auto seal.
-
-Correspondingly, to migrate back to a shamir seal, first use the above
-instructions to move to a single auto seal, and use the traditional
-migration method to migrate back to a Shamir seal.
diff --git a/website/content/docs/configuration/seal/transit.mdx b/website/content/docs/configuration/seal/transit.mdx
deleted file mode 100644
index 29fc3fca138..00000000000
--- a/website/content/docs/configuration/seal/transit.mdx
+++ /dev/null
@@ -1,148 +0,0 @@
----
-layout: docs
-page_title: Vault Transit - Seals - Configuration
-description: |-
-  The Transit seal configures Vault to use Vault's Transit Secret Engine as the
-  autoseal mechanism.
----
-
-# `transit` seal
-
-
-<Note title="Seal wrap functionality requires Vault Enterprise">
-
-  All Vault versions support **auto-unseal** for Transit, but **seal wrapping**
-  requires Vault Enterprise.
-  
-  Vault Enterprise enables seal wrapping by default, which means the KMS service
-  must be available at runtime and not just during the unseal process. Refer to
-  the [Seal wrap](/vault/docs/enterprise/sealwrap) overview for more
-  information.
-
-</Note>
-
-The Transit seal configures Vault to use Vault's Transit Secret Engine as the
-autoseal mechanism.
-The Transit seal is activated by one of the following:
-
-- The presence of a `seal "transit"` block in Vault's configuration file
-- The presence of the environment variable `VAULT_SEAL_TYPE` set to `transit`.
-
-## `transit` example
-
-This example shows configuring Transit seal through the Vault configuration file
-by providing all the required values:
-
-```hcl
-seal "transit" {
-  address            = "https://vault:8200"
-  token              = "s.Qf1s5zigZ4OX6akYjQXJC1jY"
-  disable_renewal    = "false"
-
-  // Key configuration
-  key_name           = "transit_key_name"
-  mount_path         = "transit/"
-  namespace          = "ns1/"
-
-  // TLS Configuration
-  tls_ca_cert        = "/etc/vault/ca_cert.pem"
-  tls_client_cert    = "/etc/vault/client_cert.pem"
-  tls_client_key     = "/etc/vault/ca_cert.pem"
-  tls_server_name    = "vault"
-  tls_skip_verify    = "false"
-}
-```
-
-## `transit` parameters
-
-These parameters apply to the `seal` stanza in the Vault configuration file:
-
-- `address` `(string: <required>)`: The full address to the Vault cluster.
-  This may also be specified by the `VAULT_ADDR` environment variable.
-
-- `token` `(string: <required>)`: The Vault token to use. This may also be
-  specified by the `VAULT_TOKEN` environment variable.
-
-- `key_name` `(string: <required>)`: The transit key to use for encryption and
-  decryption. This may also be supplied using the `VAULT_TRANSIT_SEAL_KEY_NAME`
-  environment variable.
-
-- `key_id_prefix` `(string: "")`: An optional string to add to the key id
-  of values wrapped by this transit seal.  This can help disambiguate between
-  two transit seals.
-
-- `mount_path` `(string: <required>)`: The mount path to the transit secret engine.
-  This may also be supplied using the `VAULT_TRANSIT_SEAL_MOUNT_PATH` environment
-  variable.
-
-- `namespace` `(string: "")`: The namespace path to the transit secret engine.
-  This may also be supplied using the `VAULT_NAMESPACE` environment variable.
-
-- `disable_renewal` `(string: "false")`: Disables the automatic renewal of the token
-  in case the lifecycle of the token is managed with some other mechanism outside of
-  Vault, such as Vault Agent. This may also be specified using the
-  `VAULT_TRANSIT_SEAL_DISABLE_RENEWAL` environment variable.
-
-- `tls_ca_cert` `(string: "")`: Specifies the path to the CA certificate file used
-  for communication with the Vault server. This may also be specified using the
-  `VAULT_CACERT` environment variable.
-
-- `tls_client_cert` `(string: "")`: Specifies the path to the client certificate
-  for communication with the Vault server. This may also be specified using the
-  `VAULT_CLIENT_CERT` environment variable.
-
-- `tls_client_key` `(string: "")`: Specifies the path to the private key for
-  communication with the Vault server. This may also be specified using the
-  `VAULT_CLIENT_KEY` environment variable.
-
-- `tls_server_name` `(string: "")`: Name to use as the SNI host when connecting
-  to the Vault server via TLS. This may also be specified via the
-  `VAULT_TLS_SERVER_NAME` environment variable.
-
-- `tls_skip_verify` `(bool: "false")`: Disable verification of TLS certificates.
-  Using this option is highly discouraged and decreases the security of data
-  transmissions to and from the Vault server. This may also be specified using the
-  `VAULT_SKIP_VERIFY` environment variable.
-
-- `disabled` `(string: "")`: Set this to `true` if Vault is migrating from an auto seal configuration. Otherwise, set to `false`.
-
-Refer to the [Seal Migration](/vault/docs/concepts/seal#seal-migration) documentation for more information about the seal migration process.
-
-## Authentication
-
-Authentication-related values must be provided, either as environment
-variables or as configuration parameters.
-
-~> **Note:** Although the configuration file allows you to pass in
-`VAULT_TOKEN` as part of the seal's parameters, it is _strongly_ recommended
-to set these values via environment variables.
-
-The Vault token used to authenticate needs the following permissions on the
-transit key:
-
-```hcl
-path "<mount path>/encrypt/<key name>" {
-  capabilities = ["update"]
-}
-
-path "<mount path>/decrypt/<key name>" {
-  capabilities = ["update"]
-}
-```
-
-Other considerations for the token used:
-* it should probably be an [orphan token](/vault/docs/concepts/tokens#token-hierarchies-and-orphan-tokens),
-otherwise when the parent token expires or gets revoked the seal will break.
-* consider making it a [periodic token](/vault/docs/concepts/tokens#periodic-tokens)
-and not setting an explicit max TTL, otherwise at some point it will cease to be renewable.
-
-## Key rotation
-
-This seal supports key rotation using the Transit Secret Engine's key rotation endpoints. See
-[doc](/vault/api-docs/secret/transit#rotate-key). Old keys must not be disabled or deleted and are
-used to decrypt older data.
-
-## Tutorial
-
-Refer to the [Auto-unseal using Transit Secrets Engine](/vault/tutorials/auto-unseal/autounseal-transit)
-tutorial to learn how use the transit secrets engine to automatically unseal Vault.
diff --git a/website/content/docs/configuration/sentinel.mdx b/website/content/docs/configuration/sentinel.mdx
deleted file mode 100644
index 8cbc8e27d8b..00000000000
--- a/website/content/docs/configuration/sentinel.mdx
+++ /dev/null
@@ -1,40 +0,0 @@
----
-layout: docs
-page_title: Sentinel - Configuration
-description: |-
-  The sentinel stanza specifies configurations for Vault's Sentinel integration.
----
-
-# `sentinel` stanza
-
-The sentinel stanza specifies configurations for
-[Vault's Sentinel](/vault/docs/enterprise/sentinel) integration.
-
-```hcl
-sentinel {
-  additional_enabled_modules = ["http"]
-}
-```
-
-## Requirements
-
-A valid Vault Enterprise license is required for use of Sentinel policies.
-
-## `sentinel` parameters
-
-The sentinel stanza currently supports only one parameter, `additional_enabled_modules`.
-
-- `additional_enabled_modules` `(string array: [])`` - This parameter specifies a list of imports (modules)
-  to allow in Sentinel policies.
-
-  Vault currently enables all of Sentinel's [standard imports](https://docs.hashicorp.com/sentinel/imports)
-  except the "http" import, which has performance and security implications. In the future, if any new Sentinel
-  imports are not automatically enabled by Vault, users could enable them in this stanza.
-  Note that this setting cannot be used to load custom import plugins.
-
-  ~> **Warning**: Care should be taken when enabling imports (modules) which
-  could have performance and security implications in policies. Enabling the "http" import could cause your Vault
-  servers to submit outbound requests to arbitrary endpoints.  
-   See the
-  [Sentinel HTTP Import](https://docs.hashicorp.com/sentinel/imports/http)
-  documentation for more information.
diff --git a/website/content/docs/configuration/service-registration/consul.mdx b/website/content/docs/configuration/service-registration/consul.mdx
deleted file mode 100644
index bd73ce7e598..00000000000
--- a/website/content/docs/configuration/service-registration/consul.mdx
+++ /dev/null
@@ -1,192 +0,0 @@
----
-layout: docs
-page_title: Consul - Service Registration - Configuration
-description: >-
-  Consul Service Registration registers Vault as a service in Consul with a
-  default
-
-  health check.
----
-
-# Consul service registration
-
-Consul Service Registration registers Vault as a service in [Consul][consul] with
-a default health check. When Consul is configured as the storage backend, the stanza
-`service_registration` is not needed as it will automatically register Vault as a service.
-
-~> **Version information:** The `service_registration` configuration option was introduced in Vault 1.4.0.
-
-@include 'consul-dataplane-compat.mdx'
-
-- **HashiCorp Supported** – Consul Service Registration is officially supported
-  by HashiCorp.
-
-## Configuration
-
-```hcl
-service_registration "consul" {
-  address      = "127.0.0.1:8500"
-}
-```
-
-If Vault is running in HA mode, include the transfer protocol (`http://` or
-`https://`) in the address:
-
-```hcl
-service_registration "consul" {
-  address      = "http://127.0.0.1:8500"
-}
-```
-
-Once properly configured, an unsealed Vault installation should be available and
-accessible at:
-
-```text
-active.vault.service.consul
-```
-
-Unsealed Vault instances in standby mode are available at:
-
-```text
-standby.vault.service.consul
-```
-
-All unsealed Vault instances are available as healthy at:
-
-```text
-vault.service.consul
-```
-
-Sealed Vault instances will mark themselves as unhealthy to avoid being returned
-at Consul's service discovery layer.
-
-## `consul` parameters
-
-- `address` `(string: "127.0.0.1:8500")` – Specifies the address of the Consul
-  agent to communicate with. This can be an IP address, DNS record, or unix
-  socket. It is recommended that you communicate with a local Consul agent; do
-  not communicate directly with a server.
-
-- `check_timeout` `(string: "5s")` – Specifies the check interval used to send
-  health check information back to Consul. This is specified using a label
-  suffix like `"30s"` or `"1h"`.
-
-- `disable_registration` `(string: "false")` – Specifies whether Vault should
-  register itself with Consul.
-
-- `scheme` `(string: "http")` – Specifies the scheme to use when communicating
-  with Consul. This can be set to "http" or "https". It is highly recommended
-  you communicate with Consul over https over non-local connections. When
-  communicating over a unix socket, this option is ignored.
-
-- `service` `(string: "vault")` – Specifies the name of the service to register
-  in Consul.
-
-- `service_tags` `(string: "")` – Specifies a comma-separated list of case-sensitive
-  tags to attach to the service registration in Consul.
-
-- `service_address` `(string: nil)` – Specifies a service-specific address to
-  set on the service registration in Consul. If unset, Vault will use what it
-  knows to be the HA redirect address - which is usually desirable. Setting
-  this parameter to `""` will tell Consul to leverage the configuration of the
-  node the service is registered on dynamically. This could be beneficial if
-  you intend to leverage Consul's
-  [`translate_wan_addrs`][consul-translate-wan-addrs] parameter.
-
-- `token` `(string: "")` – Specifies the [Consul ACL token][consul-acl] with
-  permission to register the Vault service into Consul's service catalog.
-  This is **not** a Vault token. See the ACL section below for help.
-
-The following settings apply when communicating with Consul via an encrypted
-connection. You can read more about encrypting Consul connections on the
-[Consul encryption page][consul-encryption].
-
-- `tls_ca_file` `(string: "")` – Specifies the path to the CA certificate used
-  for Consul communication. This defaults to system bundle if not specified.
-  This should be set according to the
-  [`ca_file`](/consul/docs/agent/config/config-files#ca_file) setting in
-  Consul.
-
-- `tls_cert_file` `(string: "")` (optional) – Specifies the path to the
-  certificate for Consul communication. This should be set according to the
-  [`cert_file`](/consul/docs/agent/config/config-files#cert_file) setting
-  in Consul.
-
-- `tls_key_file` `(string: "")` – Specifies the path to the private key for
-  Consul communication. This should be set according to the
-  [`key_file`](/consul/docs/agent/config/config-files#key_file) setting
-  in Consul.
-
-- `tls_min_version` `(string: "tls12")` – Specifies the minimum TLS version to
-  use. Accepted values are `"tls10"`, `"tls11"`, `"tls12"` or `"tls13"`.
-
-- `tls_skip_verify` `(string: "false")` – Disable verification of TLS certificates.
-  Using this option is highly discouraged.
-
-## ACLs
-
-If using ACLs in Consul, you'll need appropriate permissions to register the
-Vault service. The following ACL policy will work for most use-cases, assuming
-that your service name is `vault`:
-
-```json
-{
-  "service": {
-    "vault": {
-      "policy": "write"
-    }
-  }
-}
-```
-
-## `consul` examples
-
-### Local agent
-
-This example shows a sample configuration which communicates with a local
-Consul agent running on `127.0.0.1:8500`.
-
-```hcl
-service_registration "consul" {}
-```
-
-### Detailed customization
-
-This example shows communicating with Consul on a custom address with an ACL
-token.
-
-```hcl
-service_registration "consul" {
-  address = "10.5.7.92:8194"
-  token   = "abcd1234"
-}
-```
-
-### Consul via unix socket
-
-This example shows communicating with Consul over a local unix socket.
-
-```hcl
-service_registration "consul" {
-  address = "unix:///tmp/.consul.http.sock"
-}
-```
-
-### Custom TLS
-
-This example shows using a custom CA, certificate, and key file to securely
-communicate with Consul over TLS.
-
-```hcl
-service_registration "consul" {
-  scheme        = "https"
-  tls_ca_file   = "/etc/pem/vault.ca"
-  tls_cert_file = "/etc/pem/vault.cert"
-  tls_key_file  = "/etc/pem/vault.key"
-}
-```
-
-[consul]: https://www.consul.io/ 'Consul by HashiCorp'
-[consul-acl]: /consul/docs/guides/acl 'Consul ACLs'
-[consul-encryption]: /consul/docs/agent/encryption 'Consul Encryption'
-[consul-translate-wan-addrs]: /consul/docs/agent/options#translate_wan_addrs 'Consul Configuration'
diff --git a/website/content/docs/configuration/service-registration/index.mdx b/website/content/docs/configuration/service-registration/index.mdx
deleted file mode 100644
index 0882fd56d6d..00000000000
--- a/website/content/docs/configuration/service-registration/index.mdx
+++ /dev/null
@@ -1,67 +0,0 @@
----
-layout: docs
-page_title: Service Registration - Configuration
-description: |-
-  The optional `service_registration` stanza configures Vault's mechanism for
-  service registration.
----
-
-# `service_registration` stanza
-
-The optional `service_registration` stanza configures Vault's mechanism for
-service registration. The `service_registration` stanza is designed for use cases
-where you would like to use a system like [Consul][consul] for [service
-discovery][consul-discovery], but use a different system for the [storage
-backend][storage-backend].
-
-When Consul is configured as the [storage backend][consul-backend], Vault
-implicitly uses Consul for service registration, so the `service_registration` stanza
-is not needed.
-
-For times when you would like to use a different storage backend, like
-[Raft][raft-backend], but still have service registration available, the
-`service_registration` stanza can be used:
-
-```hcl
-service_registration "consul" {
-  address = "127.0.0.1:8500"
-}
-storage "raft" {
-  path = "/path/to/raft/data"
-  node_id = "raft_node_1"
-}
-```
-
-For information about a specific service registration provider, visit the [Consul Service Registration][consul-service-registration] or [Kubernetes Service Registration
-][kubernetes-service-registration] pages.
-
-## Configuration
-
-Service registration configuration is done through the Vault configuration file
-using the `service_registration` stanza:
-
-```hcl
-service_registration [NAME] {
-  [PARAMETERS...]
-}
-```
-
-For example:
-
-```hcl
-service_registration "consul" {
-  address = "127.0.0.1:8500"
-}
-```
-
-For configuration options which also read an environment variable, the
-environment variable will take precedence over values in the configuration
-file.
-
-[consul]: https://www.consul.io/
-[consul-discovery]: https://www.consul.io/
-[storage-backend]: /vault/docs/configuration/storage
-[consul-backend]: /vault/docs/configuration/storage/consul
-[raft-backend]: /vault/docs/configuration/storage/raft
-[consul-service-registration]: /vault/docs/configuration/service-registration/consul
-[kubernetes-service-registration]: /vault/docs/configuration/service-registration/kubernetes
diff --git a/website/content/docs/configuration/service-registration/kubernetes.mdx b/website/content/docs/configuration/service-registration/kubernetes.mdx
deleted file mode 100644
index 339fab7cd5e..00000000000
--- a/website/content/docs/configuration/service-registration/kubernetes.mdx
+++ /dev/null
@@ -1,169 +0,0 @@
----
-layout: docs
-page_title: Kubernetes - Service Registration - Configuration
-description: >-
-  Kubernetes Service Registration labels Vault pods with their current status
-  for use with selectors.
----
-
-# Kubernetes service registration
-
-Kubernetes Service Registration tags Vault pods with their current status for
-use with selectors. Service registration is only available when Vault is running in
-[High Availability mode](/vault/docs/concepts/ha).
-
-- **HashiCorp Supported** – Kubernetes Service Registration is officially supported
-  by HashiCorp.
-
-## Configuration
-
-```hcl
-service_registration "kubernetes" {
-  namespace      = "my-namespace"
-  pod_name       = "my-pod-name"
-}
-```
-
-Alternatively, the namespace and pod name can be set through the following
-environment variables:
-
-- `VAULT_K8S_NAMESPACE`
-- `VAULT_K8S_POD_NAME`
-
-This allows you to set these parameters using
-[the Downward API](https://kubernetes.io/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/).
-
-If using only environment variables, the service registration stanza declaring
-you're using Kubernetes must still exist to indicate your intentions:
-
-```
-service_registration "kubernetes" {}
-```
-
-For service registration to succeed, Vault must be able to apply labels to pods
-in Kubernetes. The following RBAC rules are required to allow the service account
-associated with the Vault pods to update its own pod specification:
-
-```
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  namespace: mynamespace
-  name: vault-service-account
-rules:
-- apiGroups: [""]
-  resources: ["pods"]
-  verbs: ["get", "update", "patch"]
-```
-
-## Examples
-
-Once properly configured, enabling service registration will cause Kubernetes pods
-to come up with the following labels:
-
-```
-apiVersion: v1
-kind: Pod
-metadata:
-  name: vault
-  labels:
-    vault-active: "false"
-    vault-initialized: "true"
-    vault-perf-standby: "false"
-    vault-sealed: "false"
-    vault-version: 1.15.2
-```
-
-After shutdowns, Vault pods will bear the following labels:
-
-```
-apiVersion: v1
-kind: Pod
-metadata:
-  name: vault
-  labels:
-    vault-active: "false"
-    vault-initialized: "false"
-    vault-perf-standby: "false"
-    vault-sealed: "true"
-    vault-version: 1.15.2
-```
-
-## Label definitions
-
-- `vault-active` `(string: "true"/"false")` – Vault active is updated dynamically each time Vault's active status changes.
-  True indicates that this Vault pod is currently the leader. False indicates that this Vault pod is currently a standby.
-- `vault-initialized` `(string: "true"/"false")` – Vault initialized is updated dynamically each time Vault's initialization
-  status changes. True indicates that Vault is currently initialized. False indicates the Vault is currently uninitialized.
-- `vault-perf-standby` `(string: "true"/"false")` – Vault performance standby is updated dynamically each
-  time Vault's leader/standby status changes. **This field is only valuable if the pod is a member of a performance standby cluster**,
-  it will simply be set to "false" when it's not applicable. True indicates that this Vault pod is currently a performance standby. False indicates
-  that this Vault pod is currently a performance leader.
-- `vault-sealed` `(string: "true"/"false")` – Vault sealed is updated dynamically each
-  time Vault's sealed/unsealed status changes. True indicates that Vault is currently sealed. False indicates that Vault
-  is currently unsealed.
-- `vault-version` `(string: "1.15.2")` – Vault version is a string that will not change during a pod's lifecycle.
-
-## Working with vault's service discovery labels
-
-### Example service
-
-With labels applied to the pod, services can be created using selectors to filter pods with specific Vault HA roles,
-effectively allowing direct communication with subsets of Vault pods. Note the `vault-active: "true"` line below.
-
-```
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/instance: vault
-    app.kubernetes.io/name: vault
-    helm.sh/chart: vault-0.1.2
-  name: vault-active-us-east
-  namespace: default
-spec:
-  clusterIP: 10.7.254.51
-  ports:
-  - name: http
-    port: 8200
-    protocol: TCP
-    targetPort: 8200
-  - name: internal
-    port: 8201
-    protocol: TCP
-    targetPort: 8201
-  publishNotReadyAddresses: false
-  selector:
-    app.kubernetes.io/instance: vault
-    app.kubernetes.io/name: vault
-    component: server
-    vault-active: "true"
-  type: ClusterIP
-```
-
-Also, by setting `publishNotReadyAddresses: false` above, pods that have failed will be removed from the service pool.
-
-With this active service in place, we now have a dedicated endpoint that will always reach the active node. When
-setting up Vault replication, it can be used as the primary address:
-
-```shell-session
-$ vault write -f sys/replication/performance/primary/enable \
-    primary_cluster_addr='https://vault-active-us-east:8201'
-```
-
-### Example upgrades
-
-In conjunction with the pod labels and the `OnDelete` upgrade strategy, upgrades are much easier to orchestrate:
-
-```shell-session
-$ helm upgrade vault --set='server.image.tag=1.15.2'
-
-$ kubectl delete pod --selector=vault-active=false \
-    --selector=vault-version=1.2.3
-
-$ kubectl delete pod --selector=vault-active=true \
-    --selector=vault-version=1.2.3
-```
-
-When deleting an instance of a pod, the `StatefulSet` defining the desired state of the cluster will reschedule the
-deleted pods with the newest image.
diff --git a/website/content/docs/configuration/storage/aerospike.mdx b/website/content/docs/configuration/storage/aerospike.mdx
deleted file mode 100644
index c9bf68cef7d..00000000000
--- a/website/content/docs/configuration/storage/aerospike.mdx
+++ /dev/null
@@ -1,68 +0,0 @@
----
-layout: docs
-page_title: Aerospike - Storage Backends - Configuration
-description: |-
-  The Aerospike storage backend is used to persist Vault's data in an Aerospike
-  cluster.
----
-
-# Aerospike storage backend
-
-The Aerospike storage backend is used to persist Vault's data in an
-[Aerospike][aerospike] cluster.
-
-- **No High Availability** – the Aerospike backend does not support high
-  availability.
-
-- **Community Supported** – the Aerospike storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-- **64-bit only** - the Aerospike storage backend is not supported when Vault runs
-  on a 32-bit architecture, because the Aerospike Go client doesn't support 32-bits.
-
-```hcl
-storage "aerospike" {
-  hostname = "localhost"
-  port = "3000"
-  namespace = "test"
-  set = "vault"
-  username = "admin"
-  password = "admin"
-}
-```
-
-## `aerospike` parameters
-
-- `hostname` `(string: "127.0.0.1")` – Specifies the Aerospike seed hostname.
-
-- `port` `(string: "3000")` – Specifies the Aerospike seed port.
-
-- `hostlist` `(string: "")` – Aerospike host list, a comma separated list of potential hosts to seed the cluster.
-
-- `namespace` `(string: "test")` – Specifies the Aerospike storage namespace.
-
-- `set` `(string: "")` – Specifies the Aerospike storage set.
-
-- `username` `(string: "")` – Specifies the user used to authenticate with Aerospike
-  cluster. Access Control is available only in Aerospike Server Enterprise Edition.
-  Leave empty for clusters running without restricted access.
-
-- `password` `(string: "")` – Specifies the password used to authenticate with Aerospike
-  cluster. Access Control is available only in Aerospike Server Enterprise Edition.
-  Leave empty for clusters running without restricted access.
-
-- `cluster_name` `(string: "")` - Specifies the expected Aerospike cluster name. If set, server nodes must return this cluster ID in order to
-  join the client's view of the cluster. Should only be set when connecting to servers that
-  support the "cluster-name" info command. (v3.10+)
-
-- `auth_mode` `(string: "INTERNAL")` - Specifies the authentication mode when user/password is defined (INTERNAL/EXTERNAL).
-
-- `timeout` `(int: 30000)` - Initial host connection timeout duration in milliseconds.
-
-- `idle_timeout` `(int: 55000)` - Connection idle timeout in milliseconds. Every time a connection is used, its idle
-  deadline will be extended by this duration. When this deadline is reached,
-  the connection will be closed and discarded from the connection pool.
-
-[aerospike]: https://www.aerospike.com/
diff --git a/website/content/docs/configuration/storage/alicloudoss.mdx b/website/content/docs/configuration/storage/alicloudoss.mdx
deleted file mode 100644
index 5ff1197e144..00000000000
--- a/website/content/docs/configuration/storage/alicloudoss.mdx
+++ /dev/null
@@ -1,65 +0,0 @@
----
-layout: docs
-page_title: Alicloud OSS - Storage Backends - Configuration
-description: |-
-  The Alicloud OSS storage backend is used to persist Vault's data in
-  an Alicloud OSS bucket.
----
-
-# Alicloud OSS storage backend
-
-The Alicloud OSS storage backend is used to persist Vault's data in
-an [Alicloud OSS][alicloudoss] bucket.
-
-- **No High Availability** – the Alicloud OSS storage backend does not support
-  high availability.
-
-- **Community Supported** – the Alicloud OSS storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-```hcl
-storage "alicloudoss" {
-  access_key = "abcd1234"
-  secret_key = "defg5678"
-  endpoint   = "oss-us-west-1.aliyuncs.com"
-  bucket     = "my-bucket"
-}
-```
-
-## `alicloudoss` parameters
-
-- `bucket` `(string: <required>)` – Specifies the name of the OSS bucket. This
-  can also be provided via the environment variable `ALICLOUD_OSS_BUCKET`.
-
-- `endpoint` `(string: "")` – Specifies the OSS endpoint. This can also be
-  provided via the environment variable `ALICLOUD_OSS_ENDPOINT`.
-
-The following settings are used for authenticating to Alicloud.
-
-- `access_key` – Specifies the Alicloud access key. This can also be provided via
-  the environment variable `ALICLOUD_ACCESS_KEY`.
-
-- `secret_key` – Specifies the Alicloud secret key. This can also be provided via
-  the environment variable `ALICLOUD_SECRET_KEY`.
-
-- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
-  requests to Alicloud OSS.
-
-## `alicloudoss` examples
-
-### Default example
-
-This example shows using Alicloud OSS as a storage backend.
-
-```hcl
-storage "alicloudoss" {
-  access_key = "abcd1234"
-  secret_key = "defg5678"
-  endpoint   = "oss-us-west-1.aliyuncs.com"
-  bucket     = "my-bucket"
-}
-```
-
-[alicloudoss]: https://www.alibabacloud.com/product/oss
diff --git a/website/content/docs/configuration/storage/azure.mdx b/website/content/docs/configuration/storage/azure.mdx
deleted file mode 100644
index ab0b418496e..00000000000
--- a/website/content/docs/configuration/storage/azure.mdx
+++ /dev/null
@@ -1,76 +0,0 @@
----
-layout: docs
-page_title: Azure - Storage Backends - Configuration
-description: |-
-  The Azure storage backend is used to persist Vault's data in an Azure Storage
-  Container. The storage container must already exist and the provided account
-  credentials must have read and write  permissions to the storage container.
----
-
-# Azure storage backend
-
-The Azure storage backend is used to persist Vault's data in an
-[Azure Storage Container][azure-storage]. The storage container must already
-exist and the provided account credentials must have read and write permissions
-to the storage container. The storage account type must support block blobs. This
-currently includes the general purpose "Storage V2" type with _Standard_ performance
-(Premium will not work), as well as Premium "Block Blob Storage"
-([limited region availability](https://azure.microsoft.com/en-us/global-infrastructure/services/?products=storage&regions=all)).
-
-- **No High Availability** – the Azure storage backend does not support high
-  availability.
-
-- **Community Supported** – the Azure storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-```hcl
-storage "azure" {
-  accountName = "my-storage-account"
-  accountKey  = "abcd1234"
-  container   = "container-efgh5678"
-  environment = "AzurePublicCloud"
-}
-```
-
-The current implementation is limited to a maximum of 4 megabytes per blob.
-
-## `azure` parameters
-
-- `accountName` `(string: <required>)` – Specifies the Azure Storage account
-  name.
-
-- `accountKey` `(string: <optional>)` – Specifies the Azure Storage account key,
-  if left empty, uses managed identity auth.
-
-- `container` `(string: <required>)` – Specifies the Azure Storage Blob
-  container name.
-
-- `environment` `(string: "AzurePublicCloud")` - Specifies the cloud
-  environment the storage account belongs to by way of the case-insensitive
-  name defined in the [Azure Go SDK][azure-environment].
-
-- `arm_endpoint` `(string: "")` - Specifies the cloud environment
-  the storage account belongs to by way of the Azure Resource Manager endpoint
-  URL.
-
-- `max_parallel` `(string: "128")` – Specifies The maximum number of concurrent
-  requests to Azure.
-
-## `azure` examples
-
-This example shows configuring the Azure storage backend with a custom number of
-maximum parallel connections.
-
-```hcl
-storage "azure" {
-  accountName  = "my-storage-account"
-  accountKey   = "abcd1234"
-  container    = "container-efgh5678"
-  max_parallel = 512
-}
-```
-
-[azure-storage]: https://azure.microsoft.com/en-us/services/storage/
-[azure-environment]: https://godoc.org/github.com/Azure/go-autorest/autorest/azure#pkg-variables
diff --git a/website/content/docs/configuration/storage/cassandra.mdx b/website/content/docs/configuration/storage/cassandra.mdx
deleted file mode 100644
index 6d89ce236bc..00000000000
--- a/website/content/docs/configuration/storage/cassandra.mdx
+++ /dev/null
@@ -1,100 +0,0 @@
----
-layout: docs
-page_title: Cassandra - Storage Backends - Configuration
-description: |-
-  The Cassandra storage backend is used to persist Vault's data in an Apache
-  Cassandra cluster.
----
-
-# Cassandra storage backend
-
-The Cassandra storage backend is used to persist Vault's data in an [Apache
-Cassandra][cassandra] cluster.
-
-- **No High Availability** – the Cassandra storage backend does not support high
-  availability.
-
-- **Community Supported** – the Cassandra storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with it,
-  you may be referred to the original author.
-
-```hcl
-storage "cassandra" {
-  hosts            = "localhost"
-  consistency      = "LOCAL_QUORUM"
-  protocol_version = 3
-}
-```
-
-The Cassandra storage backend does not automatically create the keyspace and
-table. This sample configuration can be used as a guide, but you will want to
-ensure the keyspace [replication options][replication-options]
-are appropriate for your cluster:
-
-```cql
-CREATE KEYSPACE "vault" WITH REPLICATION = {
-    'class': 'SimpleStrategy',
-    'replication_factor': 1
-};
-
-CREATE TABLE "vault"."entries" (
-    bucket text,
-    key text,
-    value blob,
-    PRIMARY KEY (bucket, key)
-) WITH CLUSTERING ORDER BY (key ASC);
-```
-
-## `cassandra` parameters
-
-- `hosts` `(string: "127.0.0.1")` – Comma-separated list of Cassandra hosts to
-  connect to.
-
-- `keyspace` `(string: "vault")` Cassandra keyspace to use.
-
-- `table` `(string: "entries")` – Table within the `keyspace` in which to store
-  data.
-
-- `consistency` `(string: "LOCAL_QUORUM")` Consistency level to use when
-  reading/writing data. If set, must be one of `"ANY"`, `"ONE"`, `"TWO"`,
-  `"THREE"`, `"QUORUM"`, `"ALL"`, `"LOCAL_QUORUM"`, `"EACH_QUORUM"`, or
-  `"LOCAL_ONE"`.
-
-- `protocol_version` `(int: 2)` Cassandra protocol version to use.
-
-- `username` `(string: "")` – Username to use when authenticating with the
-  Cassandra hosts.
-
-- `password` `(string: "")` – Password to use when authenticating with the
-  Cassandra hosts.
-
-- `initial_connection_timeout` `(int: 0)` - A timeout in seconds to wait until an initial connection is established
-  with the Cassandra hosts. If not set, default value from Cassandra driver(gocql) will be used - 600ms
-
-- `connection_timeout` `(int: 0)` - A timeout in seconds for each query.
-  If not set, default value from Cassandra driver(gocql) will be used - 600ms
-
-- `simple_retry_policy_retries` `(int: 0)` - Useful for Cassandra cluster with several nodes.
-  If current master node is down request will be retried on the next node `simple_retry_policy_retries`
-  times, and the client won't get an error.
-
-- `tls` `(int: 0)` – If `1`, indicates the connection with the Cassandra hosts
-  should use TLS.
-
-- `pem_bundle_file` `(string: "")` - Specifies a file containing a
-  certificate and private key; a certificate, private key, and issuing CA
-  certificate; or just a CA certificate.
-
-- `pem_json_file` `(string: "")` - Specifies a JSON file containing a certificate
-  and private key; a certificate, private key, and issuing CA certificate;
-  or just a CA certificate.
-
-- `tls_skip_verify` `(int: 0)` - If `1`, then TLS host verification
-  will be disabled for Cassandra. Defaults to `0`.
-
-- `tls_min_version` `(string: "tls12")` - Minimum TLS version to use. Accepted
-  values are `tls10`, `tls11`, `tls12` or `tls13`. Defaults to `tls12`.
-
-[cassandra]: http://cassandra.apache.org/
-[replication-options]: https://docs.datastax.com/en/cassandra/2.1/cassandra/architecture/architectureDataDistributeReplication_c.html
diff --git a/website/content/docs/configuration/storage/cockroachdb.mdx b/website/content/docs/configuration/storage/cockroachdb.mdx
deleted file mode 100644
index 16f2b6766d3..00000000000
--- a/website/content/docs/configuration/storage/cockroachdb.mdx
+++ /dev/null
@@ -1,71 +0,0 @@
----
-layout: docs
-page_title: CockroachDB - Storage Backends - Configuration
-description: >-
-  The CockroachDB storage backend is used to persist Vault's data in a
-  CockroachDB server or cluster.
----
-
-# CockroachDB storage backend
-
-The CockroachDB storage backend is used to persist Vault's data in a
-[CockroachDB][cockroachdb] server or cluster.
-
-- **High Availability** – the CockroachDB storage backend supports high availability.
-
-- **Community Supported** – the CockroachDB storage backend is supported by the
-  community. While it has undergone development and review by HashiCorp
-  employees, they may not be as knowledgeable about the technology.
-
-```hcl
-storage "cockroachdb" {
-  connection_url = "postgres://user123:secret123!@localhost:5432/vault"
-}
-```
-
-**Note** - CockroachDB is compatible with the PostgreSQL database driver and
-uses that driver to interact with the database.
-
-## `cockroachdb` parameters
-
-- `connection_url` `(string: <required>)` – Specifies the connection string to
-  use to authenticate and connect to CockroachDB. A full list of supported
-  parameters can be found in the [pgx library][pgxlib] and [PostgreSQL connection string][pg_conn_docs]
-  documentation. For example connection string URLs, see the examples section below.
-
-- `table` `(string: "vault_kv_store")` – Specifies the name of the table in
-  which to write Vault data. If this table does not exist Vault will attempt to create it.
-
-- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
-  requests to CockroachDB.
-
-- `ha_enabled` `(string: "true|false")` - Default not enabled.
-
-- `ha_table` `(string: "vault_ha_locks")` - Specifies the name of the table to use
-  for storing high availability information.
-
-## `cockroachdb` examples
-
-This example shows connecting to a CockroachDB cluster using full SSL
-verification (recommended) and high availability enabled.
-
-```hcl
-storage "cockroachdb" {
-  connection_url = "postgres://user:pass@localhost:26257/database?sslmode=verify-full"
-  ha_enabled     = "true"
-}
-```
-
-To disable SSL verification (not recommended), replace `verify-full` with
-`disable`:
-
-```hcl
-storage "cockroachdb" {
-  connection_url = "postgres://user:pass@localhost:26257/database?sslmode=disable"
-  ha_enabled     = "true"
-}
-```
-
-[cockroachdb]: https://www.cockroachlabs.com/
-[pgxlib]: https://pkg.go.dev/github.com/jackc/pgx/stdlib
-[pg_conn_docs]: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
diff --git a/website/content/docs/configuration/storage/consul.mdx b/website/content/docs/configuration/storage/consul.mdx
deleted file mode 100644
index 073f73633e3..00000000000
--- a/website/content/docs/configuration/storage/consul.mdx
+++ /dev/null
@@ -1,271 +0,0 @@
----
-layout: docs
-page_title: Consul - Storage Backends - Configuration
-description: |-
-  The Consul storage backend is used to persist Vault's data in Consul's
-  key-value store. In addition to providing durable storage, inclusion of this
-  backend will also register Vault as a service in Consul with a default health
-  check.
----
-
-# Consul storage backend
-
-The Consul storage backend is used to persist Vault's data in [Consul's][consul]
-key-value store. In addition to providing durable storage, inclusion of this
-backend will also register Vault as a service in Consul with a default health
-check.
-
-@include 'consul-dataplane-compat.mdx'
-
-- **High Availability** – the Consul storage backend supports high availability.
-
-- **HashiCorp Supported** – the Consul storage backend is officially supported
-  by HashiCorp.
-
-```hcl
-storage "consul" {
-  address = "127.0.0.1:8500"
-  path    = "vault/"
-}
-```
-
-Once properly configured, an unsealed Vault installation should be available and
-accessible at:
-
-```text
-active.vault.service.consul
-```
-
-Unsealed Vault instances in standby mode are available at:
-
-```text
-standby.vault.service.consul
-```
-
-All unsealed Vault instances are available as healthy at:
-
-```text
-vault.service.consul
-```
-
-Sealed Vault instances will mark themselves as unhealthy to avoid being returned
-at Consul's service discovery layer.
-
-Note that if you have configured multiple listeners for Vault, you must specify
-which one Consul should advertise to the cluster using [`api_addr`][api-addr]
-and [`cluster_addr`][cluster-addr] ([example][listener-example]).
-
-## `consul` parameters
-
-- `address` `(string: "127.0.0.1:8500")` – Specifies the address of the Consul
-  agent to communicate with. This can be an IP address, DNS record, or unix
-  socket. It is recommended that you communicate with a local Consul agent; do
-  not communicate directly with a server.
-
-- `check_timeout` `(string: "5s")` – Specifies the check interval used to send
-  health check information back to Consul. This is specified using a label
-  suffix like `"30s"` or `"1h"`.
-
-- `consistency_mode` `(string: "default")` – Specifies the Consul
-  [consistency mode][consul-consistency]. Possible values are `"default"` or
-  `"strong"`.
-
-- `disable_registration` `(string: "false")` – Specifies whether Vault should
-  register itself with Consul.
-
-- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
-  requests to Consul. Make sure that your Consul agents are configured to
-  support this level of parallelism, see
-  [http_max_conns_per_client](/consul/docs/agent/config/config-files#http_max_conns_per_client).
-
-- `path` `(string: "vault/")` – Specifies the path in Consul's key-value store
-  where Vault data will be stored.
-
-- `scheme` `(string: "http")` – Specifies the scheme to use when communicating
-  with Consul. This can be set to "http" or "https". It is highly recommended
-  you communicate with Consul over https over non-local connections. When
-  communicating over a unix socket, this option is ignored.
-
-- `service` `(string: "vault")` – Specifies the name of the service to register
-  in Consul.
-
-- `service_tags` `(string: "")` – Specifies a comma-separated list of tags to
-  attach to the service registration in Consul.
-
-- `service_address` `(string: nil)` – Specifies a service-specific address to
-  set on the service registration in Consul. If unset, Vault will use what it
-  knows to be the HA redirect address - which is usually desirable. Setting
-  this parameter to `""` will tell Consul to leverage the configuration of the
-  node the service is registered on dynamically. This could be beneficial if
-  you intend to leverage Consul's
-  [`translate_wan_addrs`][consul-translate-wan-addrs] parameter.
-
-- `token` `(string: "")` – Specifies the [Consul ACL token][consul-acl] with
-  permission to read and write from the `path` in Consul's key-value store.
-  This is **not** a Vault token. This can also be provided via the environment
-  variable [`CONSUL_HTTP_TOKEN`][consul-token]. See the ACL section below for help.
-
-- `session_ttl` `(string: "15s")` - Specifies the minimum allowed [session
-  TTL][consul-session-ttl]. Consul server has a lower limit of 10s on the
-  session TTL by default. The value of `session_ttl` here cannot be lesser than
-  10s unless the `session_ttl_min` on the consul server's configuration has a
-  lesser value.
-
-- `lock_wait_time` `(string: "15s")` - Specifies the wait time before a lock
-  acquisition is made. This affects the minimum time it takes to cancel a
-  lock acquisition.
-
-The following settings apply when communicating with Consul via an encrypted
-connection. You can read more about encrypting Consul connections on the
-[Consul encryption page][consul-encryption].
-
-- `tls_ca_file` `(string: "")` – Specifies the path to the CA certificate used
-  for Consul communication. This defaults to system bundle if not specified.
-  This should be set according to the
-  [`ca_file`](/consul/docs/agent/config/config-files#ca_file) setting in
-  Consul.
-
-- `tls_cert_file` `(string: "")` (optional) – Specifies the path to the
-  certificate for Consul communication. This should be set according to the
-  [`cert_file`](/consul/docs/agent/config/config-files#cert_file) setting
-  in Consul.
-
-- `tls_key_file` `(string: "")` – Specifies the path to the private key for
-  Consul communication. This should be set according to the
-  [`key_file`](/consul/docs/agent/config/config-files#key_file) setting
-  in Consul.
-
-- `tls_min_version` `(string: "tls12")` – Specifies the minimum TLS version to
-  use. Accepted values are `"tls10"`, `"tls11"`, `"tls12"` or `"tls13"`.
-
-- `tls_skip_verify` `(string: "false")` – Disable verification of TLS certificates.
-  Using this option is highly discouraged.
-
-## ACLs
-
-If using ACLs in Consul, you'll need appropriate permissions. For Consul 0.8,
-the following will work for most use-cases, assuming that your service name is
-`vault` and the prefix being used is `vault/`:
-
-```json
-{
-  "key": {
-    "vault/": {
-      "policy": "write"
-    }
-  },
-  "service": {
-    "vault": {
-      "policy": "write"
-    }
-  },
-  "agent": {
-    "": {
-      "policy": "read"
-    }
-  },
-  "session": {
-    "": {
-      "policy": "write"
-    }
-  }
-}
-```
-
-For Consul 1.4+, the following example takes into account the changed ACL
-language:
-
-```json
-{
-  "key_prefix": {
-    "vault/": {
-      "policy": "write"
-    }
-  },
-  "service": {
-    "vault": {
-      "policy": "write"
-    }
-  },
-  "agent_prefix": {
-    "": {
-      "policy": "read"
-    }
-  },
-  "session_prefix": {
-    "": {
-      "policy": "write"
-    }
-  }
-}
-```
-
-## `consul` examples
-
-### Local agent
-
-This example shows a sample physical backend configuration which communicates
-with a local Consul agent running on `127.0.0.1:8500`.
-
-```hcl
-storage "consul" {}
-```
-
-### Detailed customization
-
-This example shows communicating with Consul on a custom address with an ACL
-token.
-
-```hcl
-storage "consul" {
-  address = "10.5.7.92:8194"
-  token   = "abcd1234"
-}
-```
-
-### Custom storage path
-
-This example shows storing data at a custom path in Consul's key-value store.
-This path must be readable and writable by the Consul ACL token, if Consul
-configured to use ACLs.
-
-```hcl
-storage "consul" {
-  path = "vault/"
-}
-```
-
-### Consul via unix socket
-
-This example shows communicating with Consul over a local unix socket.
-
-```hcl
-storage "consul" {
-  address = "unix:///tmp/.consul.http.sock"
-}
-```
-
-### Custom TLS
-
-This example shows using a custom CA, certificate, and key file to securely
-communicate with Consul over TLS.
-
-```hcl
-storage "consul" {
-  scheme        = "https"
-  tls_ca_file   = "/etc/pem/vault.ca"
-  tls_cert_file = "/etc/pem/vault.cert"
-  tls_key_file  = "/etc/pem/vault.key"
-}
-```
-
-[consul]: https://www.consul.io/ 'Consul by HashiCorp'
-[consul-acl]: /consul/docs/guides/acl 'Consul ACLs'
-[consul-consistency]: /consul/api-docs/features/consistency 'Consul Consistency Modes'
-[consul-encryption]: /consul/docs/agent/encryption 'Consul Encryption'
-[consul-translate-wan-addrs]: /consul/docs/agent/options#translate_wan_addrs 'Consul Configuration'
-[consul-token]: /consul/docs/commands/acl/set-agent-token#token-lt-value-gt- 'Consul Token'
-[consul-session-ttl]: /consul/docs/agent/options#session_ttl_min 'Consul Configuration'
-[api-addr]: /vault/docs/configuration#api_addr
-[cluster-addr]: /vault/docs/configuration#cluster_addr
-[listener-example]: /vault/docs/configuration/listener/tcp#listening-on-multiple-interfaces
diff --git a/website/content/docs/configuration/storage/couchdb.mdx b/website/content/docs/configuration/storage/couchdb.mdx
deleted file mode 100644
index f4a5540f71d..00000000000
--- a/website/content/docs/configuration/storage/couchdb.mdx
+++ /dev/null
@@ -1,44 +0,0 @@
----
-layout: docs
-page_title: CouchDB - Storage Backends - Configuration
-description: |-
-  The CouchDB storage backend is used to persist Vault's data in a CouchDB
-  database.
----
-
-# CouchDB storage backend
-
-The CouchDB storage backend is used to persist Vault's data in
-[CouchDB][couchdb] table.
-
-- **No High Availability** – the CouchDB backend does not support high
-  availability.
-
-- **Community Supported** – the CouchDB storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-```hcl
-storage "couchdb" {
-  endpoint = "https://my-couchdb-dns.tld:5984/my-database"
-  username = "admin"
-  password = "admin"
-}
-```
-
-## `couchdb` parameters
-
-- `endpoint` `(string: "")` – Specifies your CouchDB endpoint. This can also be
-  provided via the environment variable `COUCHDB_ENDPOINT`.
-
-- `username` `(string: "")` – Specifies the user to authenticate as. This can
-  also be provided via the environment variable `COUCHDB_USERNAME`.
-
-- `password` `(string: "")` – Specifies the user to authenticate as. This can
-  also be provided via the environment variable `COUCHDB_PASSWORD`.
-
-- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
-  requests to CouchDB.
-
-[couchdb]: http://couchdb.apache.org/
diff --git a/website/content/docs/configuration/storage/dynamodb.mdx b/website/content/docs/configuration/storage/dynamodb.mdx
deleted file mode 100644
index ba5d7eabf70..00000000000
--- a/website/content/docs/configuration/storage/dynamodb.mdx
+++ /dev/null
@@ -1,191 +0,0 @@
----
-layout: docs
-page_title: DynamoDB - Storage Backends - Configuration
-description: |-
-  The DynamoDB storage backend is used to persist Vault's data in DynamoDB
-  table.
----
-
-# DynamoDB storage backend
-
-The DynamoDB storage backend is used to persist Vault's data in
-[DynamoDB][dynamodb] table.
-
-- **High Availability** – the DynamoDB storage backend supports high
-  availability. Because DynamoDB uses the time on the Vault node to implement
-  the session lifetimes on its locks, significant clock skew across Vault nodes
-  could cause contention issues on the lock.
-
-- **Community Supported** – the DynamoDB storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with this
-  storage backend, you could be referred to the original author for support.
-
-```hcl
-storage "dynamodb" {
-  ha_enabled = "true"
-  region     = "us-west-2"
-  table      = "vault-data"
-}
-```
-
-For more information about the read/write capacity of DynamoDB tables, please
-see the [official AWS DynamoDB documentation][dynamodb-rw-capacity].
-
-## DynamoDB parameters
-
-- `endpoint` `(string: "")` – Specifies an alternative, AWS compatible, DynamoDB
-  endpoint. This can also be provided via the environment variable
-  `AWS_DYNAMODB_ENDPOINT`.
-
-- `ha_enabled` `(string: "false")` – Specifies whether this backend should be used
-  to run Vault in high availability mode. Valid values are "true" or "false". This
-  can also be provided via the environment variable `DYNAMODB_HA_ENABLED`.
-
-- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
-  requests.
-
-- `region` `(string "us-east-1")` – Specifies the AWS region. This can also be
-  provided via the environment variable `AWS_DEFAULT_REGION`.
-
-- `read_capacity` `(int: 5)` – Specifies the maximum number of reads consumed
-  per second on the table, for use if Vault creates the DynamoDB table. This has
-  no effect if the `table` already exists. This can also be provided via the
-  environment variable `AWS_DYNAMODB_READ_CAPACITY`.
-
-- `table` `(string: "vault-dynamodb-backend")` – Specifies the name of the
-  DynamoDB table in which to store Vault data. If the specified table does not
-  yet exist, it will be created during initialization. This can also be
-  provided via the environment variable `AWS_DYNAMODB_TABLE`. See the
-  information on the table schema below.
-
-- `write_capacity` `(int: 5)` – Specifies the maximum number of writes performed
-  per second on the table, for use if Vault creates the DynamoDB table. This value
-  has no effect if the `table` already exists. This can also be provided via the
-  environment variable `AWS_DYNAMODB_WRITE_CAPACITY`.
-
-The following settings are used for authenticating to AWS. If you are
-running your Vault server on an EC2 instance, you can also make use of the EC2
-instance profile service to provide the credentials Vault will use to make
-DynamoDB API calls. Leaving the `access_key` and `secret_key` fields empty will
-cause Vault to attempt to retrieve credentials from the AWS metadata service.
-
-- `access_key` `(string: <required>)` – Specifies the AWS access key. This can
-  also be provided via the environment variable `AWS_ACCESS_KEY_ID`.
-
-- `secret_key` `(string: <required>)` – Specifies the AWS secret key. This can
-  also be provided via the environment variable `AWS_SECRET_ACCESS_KEY`.
-
-- `session_token` `(string: "")` – Specifies the AWS session token. This can
-  also be provided via the environment variable `AWS_SESSION_TOKEN`.
-
-## Required AWS permissions
-
-The governing policy for the IAM user or EC2 instance profile that Vault uses
-to access DynamoDB must contain the following permissions for Vault to perform
-the required operations on the DynamoDB table:
-
-```javascript
-  "Statement": [
-    {
-      "Action": [
-        "dynamodb:DescribeLimits",
-        "dynamodb:DescribeTimeToLive",
-        "dynamodb:ListTagsOfResource",
-        "dynamodb:DescribeReservedCapacityOfferings",
-        "dynamodb:DescribeReservedCapacity",
-        "dynamodb:ListTables",
-        "dynamodb:BatchGetItem",
-        "dynamodb:BatchWriteItem",
-        "dynamodb:CreateTable",
-        "dynamodb:DeleteItem",
-        "dynamodb:GetItem",
-        "dynamodb:GetRecords",
-        "dynamodb:PutItem",
-        "dynamodb:Query",
-        "dynamodb:UpdateItem",
-        "dynamodb:Scan",
-        "dynamodb:DescribeTable"
-      ],
-      "Effect": "Allow",
-      "Resource": [ "arn:aws:dynamodb:us-east-1:... dynamodb table ARN" ]
-    },
-```
-
-## Table schema
-
-If you are going to create the DynamoDB table prior to the execution and
-initialization of Vault, you will need to create a table with these attributes:
-
-- Primary partition key: "Path", a string
-- Primary sort key: "Key", a string
-
-You might create the table via Terraform, with a configuration similar to this:
-
-```
-resource "aws_dynamodb_table" "dynamodb-table" {
-  name           = "${var.dynamoTable}"
-  read_capacity  = 1
-  write_capacity = 1
-  hash_key       = "Path"
-  range_key      = "Key"
-  
-  attribute {
-    name = "Path"
-    type = "S"
-  }
-
-  attribute {
-    name = "Key"
-    type = "S"
-  }
-
-  tags = {
-    Name        = "vault-dynamodb-table"
-    Environment = "prod"
-  }
-}
-```
-
-If a table with the configured name already exists, Vault will not modify it -
-and the Vault configuration values of `read_capacity` and `write_capacity` have
-no effect.
-
-If the table does not already exist, Vault will try to create it, with read and
-write capacities set to the values of `read_capacity` and `write_capacity`
-respectively.
-
-## AWS instance metadata timeout
-
-@include 'aws-imds-timeout.mdx'
-
-## DynamoDB examples of Vault configuration
-
-### Custom table and Read-Write capacity
-
-This example shows using a custom table name and read/write capacity.
-
-```hcl
-storage "dynamodb" {
-  table = "my-vault-data"
-
-  read_capacity  = 10
-  write_capacity = 15
-}
-```
-
-### Enabling high availability
-
-This example shows enabling high availability for the DynamoDB storage backend.
-
-```hcl
-api_addr = "https://vault-leader.my-company.internal"
-
-storage "dynamodb" {
-  ha_enabled    = "true"
-  ...
-}
-```
-
-[dynamodb]: https://aws.amazon.com/dynamodb/
-[dynamodb-rw-capacity]: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/WorkingWithTables.html#ProvisionedThroughput
diff --git a/website/content/docs/configuration/storage/etcd.mdx b/website/content/docs/configuration/storage/etcd.mdx
deleted file mode 100644
index 6dbc234a8ce..00000000000
--- a/website/content/docs/configuration/storage/etcd.mdx
+++ /dev/null
@@ -1,152 +0,0 @@
----
-layout: docs
-page_title: Etcd - Storage Backends - Configuration
-description: |-
-  The Etcd storage backend is used to persist Vault's data in Etcd. It supports
-  both the v2 and v3 Etcd APIs, and the version is automatically detected based
-  on the version of the Etcd cluster.
----
-
-# Etcd storage backend
-
-The Etcd storage backend is used to persist Vault's data in [Etcd][etcd]. It
-supports both the v2 and v3 Etcd APIs, and the version is automatically detected
-based on the version of the Etcd cluster.
-
-~> The Etcd v2 API has been deprecated with the release of Etcd v3.5, and will
-be decommissioned by Etcd v3.6. It will be removed from Vault in Vault 1.10.
-Users of the Etcd storage backend should prepare to
-[migrate](/vault/docs/commands/operator/migrate) Vault storage to an Etcd v3 cluster
-prior to upgrading to Vault 1.10. All storage migrations should have
-[backups](/vault/docs/concepts/storage#backing-up-vault-s-persisted-data) taken prior
-to migration.
-
-- **High Availability** – the Etcd storage backend supports high availability.
-  The v2 API has known issues with HA support and should not be used in HA
-  scenarios.
-
-- **Community Supported** – the Etcd storage backend is supported by CoreOS.
-  While it has undergone review by HashiCorp employees, they may not be as
-  knowledgeable about the technology. If you encounter problems with them, you
-  may be referred to the original author.
-
-```hcl
-storage "etcd" {
-  address  = "http://localhost:2379"
-  etcd_api = "v3"
-}
-```
-
-## `etcd` parameters
-
-- `address` `(string: "http://localhost:2379")` – Specifies the addresses of the
-  Etcd instances as a comma-separated list. This can also be provided via the
-  environment variable `ETCD_ADDR`.
-
-- `discovery_srv` `(string: "example.com")` - Specifies the domain name to
-  query for SRV records describing cluster endpoints. This can also be provided
-  via the environment variable `ETCD_DISCOVERY_SRV`.
-
-- `discovery_srv_name` `(string: "vault")` - Specifies the service name to use
-  when querying for SRV records describing cluster endpoints. This can also be
-  provided via the environment variable `ETCD_DISCOVERY_SRV_NAME`.
-
-- `etcd_api` `(string: "<varies>")` – Specifies the version of the API to
-  communicate with. By default, this is derived automatically. If the cluster
-  version is 3.1+ and there has been no data written using the v2 API, the
-  auto-detected default is v3.
-
-- `ha_enabled` `(string: "false")` – Specifies if high availability should be
-  enabled. This can also be provided via the environment variable
-  `ETCD_HA_ENABLED`.
-
-- `path` `(string: "/vault/")` – Specifies the path in Etcd where Vault data will
-  be stored.
-
-- `sync` `(string: "true")` – Specifies whether to sync the list of available
-  Etcd services on startup. This is a string that is coerced into a boolean
-  value. You may want to set this to false if your cluster is behind a proxy
-  server and syncing causes Vault to fail.
-
-- `username` `(string: "")` – Specifies the username to use when authenticating
-  with the Etcd server. This can also be provided via the environment variable
-  `ETCD_USERNAME`.
-
-- `password` `(string: "")` – Specifies the password to use when authenticating
-  with the Etcd server. This can also be provided via the environment variable
-  `ETCD_PASSWORD`.
-
-- `tls_ca_file` `(string: "")` – Specifies the path to the CA certificate used
-  for Etcd communication. This defaults to system bundle if not specified.
-
-- `tls_cert_file` `(string: "")` – Specifies the path to the certificate for
-  Etcd communication.
-
-- `tls_key_file` `(string: "")` – Specifies the path to the private key for Etcd
-  communication.
-
-- `request_timeout` `(string: "5s")` – Specifies timeout for requests
-  to etcd. 5 seconds should be long enough for most cases, even with internal
-  retry.
-
-- `lock_timeout` `(string: "15s")` – Specifies lock timeout for master
-  Vault instance. Set bigger value if you don't need faster recovery.
-
-- `max_receive_size` `(int)` – Specifies the client-side response receive limit.
-Make sure that "max_receive_size" >= server-side default send/recv limit.
-("--max-request-bytes" flag to etcd or "embed.Config.MaxRequestBytes").
-
-- `max_send_size` `(int)` – Specifies the client-side request send limit in bytes.
-Make sure that "max_send_size" < server-side default send/recv limit.
-("--max-request-bytes" flag to etcd or "embed.Config.MaxRequestBytes").
-
-## `etcd` Examples
-
-### DNS discovery of cluster members
-
-This example configures vault to discover the Etcd cluster members via SRV
-records as outlined in the
-[DNS Discovery protocol documentation][dns discovery].
-
-```hcl
-storage "etcd" {
-  discovery_srv = "example.com"
-}
-```
-
-### Custom authentication
-
-This example shows connecting to the Etcd cluster using a username and password.
-
-```hcl
-storage "etcd" {
-  username = "user1234"
-  password = "pass5678"
-}
-```
-
-### Custom path
-
-This example shows storing data in a custom path.
-
-```hcl
-storage "etcd" {
-  path = "my-vault-data/"
-}
-```
-
-### Enabling high availability
-
-This example shows enabling high availability for the Etcd storage backend.
-
-```hcl
-api_addr = "https://vault-leader.my-company.internal"
-
-storage "etcd" {
-  ha_enabled    = "true"
-  ...
-}
-```
-
-[etcd]: https://coreos.com/etcd 'Etcd by CoreOS'
-[dns discovery]: https://coreos.com/etcd/docs/latest/op-guide/clustering.html#dns-discovery 'Etcd cluster DNS Discovery'
diff --git a/website/content/docs/configuration/storage/filesystem.mdx b/website/content/docs/configuration/storage/filesystem.mdx
deleted file mode 100644
index 8c4c2498f07..00000000000
--- a/website/content/docs/configuration/storage/filesystem.mdx
+++ /dev/null
@@ -1,46 +0,0 @@
----
-layout: docs
-page_title: Filesystem - Storage Backends - Configuration
-description: |-
-  The Filesystem storage backend stores Vault's data on the filesystem using a
-  standard directory structure. It can be used for durable single server
-  situations, or to develop locally where durability is not critical.
----
-
-# Filesystem storage backend
-
-The Filesystem storage backend stores Vault's data on the filesystem using a
-standard directory structure. It can be used for durable single server
-situations, or to develop locally where durability is not critical.
-
-- **No High Availability** – the Filesystem backend does not support high
-  availability.
-
-- **HashiCorp Supported** – the Filesystem backend is officially supported by
-  HashiCorp.
-
-```hcl
-storage "file" {
-  path = "/mnt/vault/data"
-}
-```
-
-Even though Vault's data is encrypted at rest, you should still take appropriate
-measures to secure access to the filesystem.
-
-## `file` parameters
-
-- `path` `(string: <required>)` – The absolute path on disk to the directory
-  where the data will be stored. If the directory does not exist, Vault will
-  create it.
-
-## `file` examples
-
-This example shows the Filesystem storage backend being mounted at
-`/mnt/vault/data`.
-
-```hcl
-storage "file" {
-  path = "/mnt/vault/data"
-}
-```
diff --git a/website/content/docs/configuration/storage/foundationdb.mdx b/website/content/docs/configuration/storage/foundationdb.mdx
deleted file mode 100644
index 2eeacb6b8c7..00000000000
--- a/website/content/docs/configuration/storage/foundationdb.mdx
+++ /dev/null
@@ -1,163 +0,0 @@
----
-layout: docs
-page_title: FoundationDB - Storage Backends - Configuration
-description: |-
-  The FoundationDB storage backend is used to persist Vault's data in the
-  FoundationDB KV store.
----
-
-# FoundationDB storage backend
-
-The FoundationDB storage backend is used to persist Vault's data in
-[FoundationDB][foundationdb].
-
-The backend needs to be explicitly enabled at build time, and is not available
-in the standard Vault binary distribution. Please refer to the documentation
-accompanying the backend's source in the Vault source tree.
-
-- **High Availability** – the FoundationDB storage backend supports high
-  availability. The HA implementation relies on the clocks of the Vault
-  nodes inside the cluster being properly synchronized; clock skews are
-  susceptible to cause contention on the locks.
-
-- **Community Supported** – the FoundationDB storage backend is supported
-  by the community. While it has undergone review by HashiCorp employees,
-  they may not be as knowledgeable about the technology. If you encounter
-  problems with them, you may be referred to the original author.
-
-```hcl
-storage "foundationdb" {
-  api_version      = 520
-  cluster_file     = "/path/to/fdb.cluster"
-
-  tls_verify_peers = "I.CN=MyTrustedIssuer,I.O=MyCompany\, Inc.,I.OU=Certification Authority"
-  tls_ca_file      = "/path/to/ca_bundle.pem"
-  tls_cert_file    = "/path/to/cert.pem"
-  tls_key_file     = "/path/to/key.pem"
-  tls_password     = "PrivateKeyPassword"
-
-  path             = "vault-top-level-directory"
-  ha_enabled       = "true"
-}
-```
-
-## `foundationdb` parameters
-
-- `api_version` `(int)` - The FoundationDB API version to use; this is a
-  required parameter and doesn't have a default value. The minimum required API
-  version is 520.
-
-- `cluster_file` `(string)` - The path to the cluster file containing the
-  connection data for the target cluster; this is a required parameter and
-  doesn't have a default value.
-
-- `tls_verify_peers` `(string)` - The peer certificate verification criteria;
-  this parameter is mandatory if TLS is enabled. Refer to the [FoundationDB TLS][fdb-tls] documentation.
-
-- `tls_ca_file` `(string)` - The path to the CA certificate bundle file; this
-  parameter is mandatory if TLS is enabled.
-
-- `tls_cert_file` `(string)` - The path to the certificate file; specifying this
-  parameter together with `tls_key_file` will enable TLS support.
-
-- `tls_key_file` `(string)` - The path to the key file; specifying this
-  parameter together with `tls_cert_file` will enable TLS support.
-
-- `tls_password` `(string)` - The password needed to decrypt `tls_key_file`, if
-  it is encrypted; optional. This can also be specified via the
-  `FDB_TLS_PASSWORD` environment variable.
-
-- `path` `(string: "vault")` - The path of the top-level FoundationDB directory
-  (using the directory layer) under which the Vault data will reside.
-
-- `ha_enabled` `(string: "false")` - Whether or not to enable Vault
-  high-availability mode using the FoundationDB backend.
-
-## `foundationdb` tips
-
-### Cluster file
-
-The FoundationDB client expects to be able to update the cluster file at
-runtime, to keep it current with changes happening to the cluster.
-
-It does so by first writing a new cluster file alongside the current one,
-then atomically renaming it into place.
-
-This means the cluster file and the directory it resides in must be writable
-by the user Vault is running as. You probably want to isolate the cluster
-file into its own directory.
-
-### Multi-version client
-
-The FoundationDB client library version is tightly coupled to the server
-version; during cluster upgrades, multiple server versions will be running
-in the cluster, and the client must cope with that situation.
-
-This is handled by the (primary) client library having the ability to load
-a different, later version of the client library to connect to a particular
-server; it is referred to as the [multi-version client][multi-ver-client]
-feature.
-
-#### Client setup with `LD_LIBRARY_PATH`
-
-If you do not use mlock, you can use `LD_LIBRARY_PATH` to point the linker at
-the location of the primary client library.
-
-```shell-session
-$ export LD_LIBRARY_PATH=/dest/dir/for/primary:$LD_LIBRARY_PATH
-$ export FDB_NETWORK_OPTION_EXTERNAL_CLIENT_DIRECTORY=/dest/dir/for/secondary
-$ /path/to/bin/vault ...
-```
-
-#### Client setup with `RPATH`
-
-When running Vault with mlock, the Vault binary must have capabilities set to
-allow the use of mlock.
-
-```
-# setcap cap_ipc_lock=+ep /path/to/bin/vault
-$ getcap /path/to/bin/vault
-/path/to/bin/vault = cap_ipc_lock+ep
-```
-
-The presence of the capabilities will cause the linker to ignore
-`LD_LIBRARY_PATH`, for security reasons.
-
-In that case, we have to set an `RPATH` on the Vault binary at build time
-to replace the use of `LD_LIBRARY_PATH`.
-
-When building Vault, pass the `-r /dest/dir/for/primary` option to the Go
-linker, for instance:
-
-```shell-session
-$ make dev FDB_ENABLED=1 LD_FLAGS="-r /dest/dir/for/primary "
-```
-
-(Note the trailing space in the variable value above).
-
-You can verify `RPATH` is set on the Vault binary using `readelf`:
-
-```shell-session
-$ readelf -d /path/to/bin/vault | grep RPATH
- 0x000000000000000f (RPATH)              Library rpath: [/dest/dir/for/primary]
-```
-
-With the client libraries installed:
-
-```shell-session
-$ ldd /path/to/bin/vault
-...
-    libfdb_c.so => /dest/dir/for/primary/libfdb_c.so (0x00007f270ad05000)
-...
-```
-
-Now run Vault:
-
-```shell-session
-$ export FDB_NETWORK_OPTION_EXTERNAL_CLIENT_DIRECTORY=/dest/dir/for/secondary
-$ /path/to/bin/vault ...
-```
-
-[foundationdb]: https://www.foundationdb.org
-[fdb-tls]: https://apple.github.io/foundationdb/tls.html
-[multi-ver-client]: https://apple.github.io/foundationdb/api-general.html#multi-version-client-api
diff --git a/website/content/docs/configuration/storage/google-cloud-spanner.mdx b/website/content/docs/configuration/storage/google-cloud-spanner.mdx
deleted file mode 100644
index e5511fb0720..00000000000
--- a/website/content/docs/configuration/storage/google-cloud-spanner.mdx
+++ /dev/null
@@ -1,146 +0,0 @@
----
-layout: docs
-page_title: Google Cloud Spanner - Storage Backends - Configuration
-description: |-
-  The Google Cloud Spanner storage backend is used to persist Vault's data in
-  Spanner, a fully managed, mission-critical, relational database service that
-  offers transactional consistency at global scale.
----
-
-# Google Cloud spanner storage backend
-
-The Google Cloud Spanner storage backend is used to persist Vault's data in
-[Spanner][spanner-docs], a fully managed, mission-critical, relational database
-service that offers transactional consistency at global scale, schemas, SQL, and
-automatic, synchronous replication for high availability.
-
-- **High Availability** – the Google Cloud Spanner storage backend supports high
-  availability. Because the Google Cloud Spanner storage backend uses the system
-  time on the Vault node to acquire sessions, clock skew across Vault servers
-  can cause lock contention.
-
-- **Community Supported** – the Google Cloud Spanner storage backend is
-  supported by the community. While it has undergone review by HashiCorp
-  employees, they may not be as knowledgeable about the technology. If you
-  encounter problems with them, you may be referred to the original author.
-
-```hcl
-storage "spanner" {
-  database = "projects/my-project/instances/my-instance/databases/my-database"
-}
-```
-
-For more information on schemas or Google Cloud Spanner, please see the [Google
-Cloud Spanner documentation][spanner-docs].
-
-## `spanner` setup
-
-To use the Google Cloud Spanner Vault storage backend, you must have a Google
-Cloud Platform account. Either using the API or web interface, create a database
-and the following tables:
-
--> You can choose "Edit as text" and copy-paste the following as the schema.
-These are the default table names. If you choose to use different table names,
-you will need to update the configuration accordingly.
-
-```sql
-CREATE TABLE Vault (
-  Key       STRING(MAX) NOT NULL,
-  Value     BYTES(MAX),
-) PRIMARY KEY (Key);
-
-CREATE TABLE VaultHA (
-  Key           STRING(MAX) NOT NULL,
-  Value         STRING(MAX),
-  Identity      STRING(36) NOT NULL,
-  Timestamp     TIMESTAMP NOT NULL,
-) PRIMARY KEY (Key);
-```
-
-The Google Cloud Spanner storage backend does not support creating the table
-automatically at this time, but this could be a future enhancement. For more
-information on schemas or Google Cloud Spanner, please see the [Google Cloud
-Spanner documentation][spanner-docs].
-
-## `spanner` authentication
-
-The Google Cloud Spanner Vault storage backend uses the official Google Cloud
-Golang SDK. This means it supports the common ways of [providing credentials to
-Google Cloud][cloud-creds].
-
-1. The environment variable `GOOGLE_APPLICATION_CREDENTIALS`. This is specified
-   as the **path** to a Google Cloud credentials file, typically for a service
-   account. If this environment variable is present, the resulting credentials are
-   used. If the credentials are invalid, an error is returned.
-
-1. Default instance credentials. When no environment variable is present, the
-   default service account credentials are used.
-
-For more information on service accounts, please see the [Google Cloud Service
-Accounts documentation][service-accounts].
-
-To use this storage backend, the service account must have the following
-minimum scope(s):
-
-```text
-https://www.googleapis.com/auth/google-cloud-spanner.data
-```
-
-## `spanner` parameters
-
-- `database` `(string: <required>)` – Specifies the name of the database. Note
-  that this is specified as a "path" including the project ID and instance, for
-  example:
-
-  ```text
-  projects/my-project/instances/my-instance/databases/my-database
-  ```
-
-- `table` `(string: "Vault")` - Specifies the name of the table where
-  data will be stored and retrieved.
-
-- `max_parallel` `(int: 128)` - Specifies the maximum number of parallel
-  operations to take place.
-
-### High availability parameters
-
-- `ha_enabled` `(string: "false")` - Specifies if high availability mode is
-  enabled. This is a boolean value, but it is specified as a string like "true"
-  or "false".
-
-- `ha_table` `(string: "VaultHA")` - Specifies the name of the table to use for
-  storing high availability information. By default, this is the name of the
-  `table` suffixed with "HA".
-
-## `spanner` examples
-
-### High availability
-
-This example shows configuring Google Cloud Spanner with high availability
-enabled.
-
-```hcl
-api_addr = "https://vault-leader.my-company.internal"
-
-storage "spanner" {
-  database   = "projects/demo/instances/abc123/databases/vault-data"
-  ha_enabled = "true"
-}
-```
-
-### Custom tables
-
-This example shows listing custom table names for data and HA with the Google
-Cloud Spanner Vault storage backend.
-
-```hcl
-storage "spanner" {
-  database = "projects/demo/instances/abc123/databases/vault-data"
-  table    = "VaultData"
-  ha_table = "VaultLeader"
-}
-```
-
-[cloud-creds]: https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application
-[service-accounts]: https://cloud.google.com/compute/docs/access/service-accounts
-[spanner-docs]: https://cloud.google.com/spanner/docs/
diff --git a/website/content/docs/configuration/storage/google-cloud-storage.mdx b/website/content/docs/configuration/storage/google-cloud-storage.mdx
deleted file mode 100644
index eddbf93f661..00000000000
--- a/website/content/docs/configuration/storage/google-cloud-storage.mdx
+++ /dev/null
@@ -1,159 +0,0 @@
----
-layout: docs
-page_title: Google Cloud Storage - Storage Backends - Configuration
-description: |-
-  The Google Cloud Storage storage backend is used to persist Vault's data in
-  Google Cloud Storage.
----
-
-# Google Cloud storage storage backend
-
-The Google Cloud Storage storage backend is used to persist Vault's data in
-[Google Cloud Storage][gcs-docs].
-
-- **High Availability** – the Google Cloud Storage storage backend supports high
-  availability. Because the Google Cloud Storage storage backend uses the system
-  time on the Vault node to acquire sessions, clock skew across Vault servers
-  can cause lock contention.
-
-- **Community Supported** – the Google Cloud Storage storage backend is
-  supported by the community. While it has undergone review by HashiCorp
-  employees, they may not be as knowledgeable about the technology. If you
-  encounter problems with them, you may be referred to the original author.
-
-```hcl
-storage "gcs" {
-  bucket = "my-storage-bucket"
-}
-```
-
-For more information on schemas or Google Cloud Storage, please see the [Google
-Cloud Storage documentation][gcs-docs].
-
-## `gcs` setup
-
-To use the Google Cloud Storage Vault storage backend, you must have a Google
-Cloud Platform account with permissions to create Google Cloud Storage buckets.
-
-To use the Google Cloud Storage Vault storage backend, you must have a Google
-Cloud Platform account. Either using the API or web interface, create a bucket
-using the [`gsutil`][cloud-sdk] command. Bucket names must be globally unique
-across all of Google Cloud, so choose a unique name:
-
-```shell-session
-$ gsutil mb gs://mycompany-vault-data
-```
-
-Even though the data is encrypted in transit and at rest, be sure to set the
-appropriate permissions on the bucket to limit exposure. You may want to create
-a service account that limits Vault's interactions with Google Cloud to objects
-in the storage bucket using IAM permissions.
-
-Here is a sample [Google Cloud IAM][iam] policy that grants the proper
-permissions to a [service account][service-accounts]. Be sure to replace the
-value with the value for your service account.
-
-```json
-{
-  "bindings": [
-    {
-      "role": "roles/storage.objectAdmin",
-      "members": ["serviceAccount:my-vault@gserviceaccount.com"]
-    }
-  ]
-}
-```
-
-Then give Vault the service account's credential file as a configuration option.
-
-For more information on schemas or Google Cloud Storage, please see the [Google
-Cloud Storage documentation][gcs-docs].
-
-## `gcs` authentication
-
-The Google Cloud Storage Vault storage backend uses the official Google Cloud
-Golang SDK. This means it supports the common ways of [providing credentials to
-Google Cloud][cloud-creds].
-
-1. The environment variable `GOOGLE_APPLICATION_CREDENTIALS`. This is specified
-   as the **path** to a Google Cloud credentials file, typically for a service
-   account. If this environment variable is present, the resulting credentials are
-   used. If the credentials are invalid, an error is returned.
-
-1. Default instance credentials. When no environment variable is present, the
-   default service account credentials are used.
-
-For more information on service accounts, please see the [Google Cloud Service
-Accounts documentation][service-accounts].
-
-To use this storage backend, the service account must have the following
-minimum scope(s):
-
-```text
-https://www.googleapis.com/auth/devstorage.read_write
-```
-
-## `gcs` parameters
-
-- `bucket` `(string: <required>)` – Specifies the name of the bucket to use for
-  storage. Alternatively, this parameter can be omitted and the `GOOGLE_STORAGE_BUCKET` 
-  environment variable can be used to set the name of the bucket. If both the environment
-  variable and the parameter in the stanza are set, the value of the environment variable
-  will take precedence.
-
-- `chunk_size` `(string: "8192")` – Specifies the maximum size (in kilobytes) to
-  send in a single request. If set to 0, it will attempt to send the whole
-  object at once, but will not retry any failures. If you are not storing large
-  objects in Vault, it is recommended to set this to a low value (minimum is
-  256), since it will reduce the amount of memory Vault uses. Alternatively, this parameter
-  can be omitted and the `GOOGLE_STORAGE_CHUNK_SIZE` environment variable can be used to set 
-  the chunk size. If both the environment variable and the parameter in the stanza are set, 
-  the value of the environment variable will take precedence.
-
-- `max_parallel` `(int: 128)` - Specifies the maximum number of parallel
-  operations to take place.
-
-### High availability parameters
-
-- `ha_enabled` `(string: "false")` - Specifies if high availability mode is
-  enabled. This is a boolean value, but it is specified as a string like "true"
-  or "false". Alternatively, this parameter can be omitted and the 
-  `GOOGLE_STORAGE_HA_ENABLED` environment variable can be used to 
-  enable or disable high availability. If both the environment variable and 
-  the parameter in the stanza are set, the value of the environment variable will 
-  take precedence.
-  
-## `gcs` examples
-
-### High availability
-
-This example shows configuring Google Cloud Storage with high availability
-enabled.
-
-```hcl
-api_addr = "https://vault-leader.my-company.internal"
-
-storage "gcs" {
-  bucket        = "mycompany-vault-data"
-  ha_enabled    = "true"
-}
-```
-
-### Custom chunk size
-
-This example shows setting a custom chunk size for uploads. When uploading large
-data to Vault, setting a lower number can reduce Vault's memory consumption, but
-will increase the number of outbound requests.
-
-```hcl
-storage "gcs" {
-  bucket     = "mycompany-vault-data"
-  chunk_size = "512"
-}
-```
-
-[cloud-creds]: https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application
-[cloud-sdk]: https://cloud.google.com/sdk/downloads
-[gcs-docs]: https://cloud.google.com/storage/docs/
-[iam]: https://cloud.google.com/iam/docs/
-[service-accounts]: https://cloud.google.com/compute/docs/access/service-accounts
diff --git a/website/content/docs/configuration/storage/in-memory.mdx b/website/content/docs/configuration/storage/in-memory.mdx
deleted file mode 100644
index 0f8f1f6f1d8..00000000000
--- a/website/content/docs/configuration/storage/in-memory.mdx
+++ /dev/null
@@ -1,42 +0,0 @@
----
-layout: docs
-page_title: In-Memory - Storage Backends - Configuration
-description: |-
-  The In-Memory storage backend is used to persist Vault's data entirely
-  in-memory on the same machine in which Vault is running. This is useful for
-  development and experimentation, but use of this backend is highly discouraged
-  in production except in very specific use-cases.
----
-
-# In-Memory storage backend
-
-The In-Memory storage backend is used to persist Vault's data entirely in-memory
-on the same machine in which Vault is running. This is useful for development
-and experimentation, but use of this backend is **highly discouraged in
-production**. All data is lost when Vault or the machine on which it is running
-is restarted.
-
-- **No High Availability** – the In-Memory backend does not support high
-  availability.
-
-- **Not Production Recommended** – the In-Memory backend is not recommended for
-  production installations as data does not persist beyond restarts.
-
-- **HashiCorp Supported** – the In-Memory backend is officially supported by
-  HashiCorp.
-
-```hcl
-storage "inmem" {}
-```
-
-## `inmem` parameters
-
-The In-Memory storage backend has no configuration parameters.
-
-## `inmem` examples
-
-This example shows activating the In-Memory storage backend.
-
-```hcl
-storage "inmem" {}
-```
diff --git a/website/content/docs/configuration/storage/index.mdx b/website/content/docs/configuration/storage/index.mdx
deleted file mode 100644
index 6d43c306285..00000000000
--- a/website/content/docs/configuration/storage/index.mdx
+++ /dev/null
@@ -1,96 +0,0 @@
----
-layout: docs
-page_title: Storage Backends - Configuration
-description: |-
-  The storage stanza configures the storage backend, which represents the
-  location for the durable storage of Vault's information. Each backend has
-  pros, cons, advantages, and trade-offs. For example, some backends support
-  high availability while others provide a more robust backup and restoration
-  process.
----
-
-# `storage` stanza
-
-The `storage` stanza configures the storage backend, which represents the
-location for the durable storage of Vault's information. Each backend has pros,
-cons, advantages, and trade-offs. For example, some backends support high
-availability while others provide a more robust backup and restoration process.
-For information about a specific backend, choose one from the navigation on the
-left.
-
-## Configuration
-
-Storage backend configuration is done through the Vault configuration file using
-the `storage` stanza:
-
-```hcl
-storage [NAME] {
-  [PARAMETERS...]
-}
-```
-
-For example:
-
-```hcl
-storage "file" {
-  path = "/mnt/vault/data"
-}
-```
-
-For configuration options which also read an environment variable, the
-environment variable will take precedence over values in the configuration
-file.
-
-## Integrated storage vs. external storage
-
-HashiCorp recommends using Vault's [integrated
-storage](/vault/docs/configuration/storage/raft) for most use cases rather than
-configuring another system to store Vault data externally. (Integrated Storage is
-an **embedded Vault data storage** available in Vault 1.4 or later.) Prior to Vault 1.4, Consul was the recommended Vault storage.
-
--> **NOTE:** [HCP Vault](https://cloud.hashicorp.com/products/vault) clusters
-use Integrated Storage as their storage backend.
-
-The table below compares the characteristics of Integrated Storage and External
-Storage. Suppose you decide that the additional operational complexity of external storage is worth it for your use case. In that case, there are several external storage options to choose from (e.g., [Consul](/vault/docs/configuration/storage/consul), [DynamoDB](/vault/docs/configuration/storage/dynamodb), etc.).
-
-|                                | Integrated Storage                                                                                                                                                                                                           | External Storage                                                                                                                                                                                                                      |
-| ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| HashiCorp Supported            | Yes                                                                                                                                                                                                                          | Limited support                                                                                                                                                                                                                       |
-| Operation                      | Operationally simpler with no additional software installation required.                                                                                                                                                     | Must install and configure the external storage environment outside of Vault. For high availability, the external storage should be clustered.                                                                                        |
-| Networking                     | One less network hop.                                                                                                                                                                                                        | Extra network hop between Vault and the external storage system (e.g., Consul cluster).                                                                                                                                               |
-| Troubleshooting and monitoring | Integrated Storage is a part of Vault; therefore, Vault is the only system you need to monitor and troubleshoot.                                                                                                             | The source of failure could be the external storage; therefore, you need to check the health of both Vault and the external storage. This requires expertise in the chosen storage backend and additional monitoring of that storage. |
-| Data location                  | The encrypted Vault data is stored on the same host where the Vault server process runs.                                                                                                                                     | The encrypted Vault data is stored where the external storage is located. Therefore, the Vault server and the data storage are hosted on physically separate hosts.                                                                   |
-| System requirements            | Avoid "burstable" CPU and storage options. SSDs should be used for the hard drive. <p />See the [Reference Architecture](/vault/tutorials/day-one-raft/raft-reference-architecture#system-requirements) guide. | Follow the system requirements given by your chosen storage backend.                                                                                                                                                                  |
-
-### Integrated storage vs. consul as Vault storage
-
-[HashiCorp Consul](/consul/docs/intro) is a comprehensive
-multi-cloud service networking solution including service mesh, service
-discovery, and network infrastructure automation. Vault can leverage
-Consul's [KV Store](/consul/api-docs/kv) to persist Vault data.
-
-The table below highlights the differences between Integrated Storage and
-Consul.
-
-|                     | Integrated Storage                                                                                                 | Consul                                                                                                                                                                                                                                                                                                                                           |
-| ------------------- | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Deployment          | Vault cluster is all you need.                                                                                     | Vault cluster & Consul cluster. <p />Use a dedicated Consul cluster for Vault storage, and it should not be used for other purposes (e.g., service discovery, service mesh). <p />See the [Vault with Consul Storage Reference Architecture](/vault/tutorials/day-one-consul/reference-architecture#recommended-architecture) guide. |
-| Data location       | Data is on disk.                                                                                                   | All data is in memory.                                                                                                                                                                                                                                                                                                                           |
-| System requirements | [System requirements](/vault/tutorials/day-one-raft/raft-reference-architecture#system-requirements) | [System requirements](/vault/tutorials/day-one-consul/reference-architecture#hardware-sizing-for-vault-servers)                                                                                                                                                                                                                      |
-| Snapshots           | Normal data backup strategy of your organization.                                                                  | More frequent snapshots are necessary since data is in memory.                                                                                                                                                                                                                                                                                   |
-| Max message size    | 1 MiB (Configurable using the [`max_entry_size`](/vault/docs/configuration/storage/raft#max_entry_size) parameter)       | 512 KiB (Configurable using the [`kv_max_value_size`](/consul/docs/agent/config/config-files#kv_max_value_size) parameter)                                                                                                                                                                                                                     |
-
-If you have a Vault cluster using Consul as its storage backend and wish to
-migrate to Integrated Storage, read the following tutorials:
-
-1. [Preflight Checklist - Migrating to Integrated
-   Storage](/vault/tutorials/raft/storage-migration-checklist)
-1. [Storage Migration tutorial - Consul to Integrated
-   Storage](/vault/tutorials/raft/raft-migration)
-
-## Tutorial
-
-Refer to the [Integrated
-Storage](/vault/tutorials/raft) tutorials
-to learn more about Integrated Storage.
diff --git a/website/content/docs/configuration/storage/manta.mdx b/website/content/docs/configuration/storage/manta.mdx
deleted file mode 100644
index c208e561861..00000000000
--- a/website/content/docs/configuration/storage/manta.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-layout: docs
-page_title: Manta - Storage Backends - Configuration
-description: >-
-  The Manta storage backend is used to persist Vault's data in Triton's Manta
-  Object
-
-  Storage. The storage folder must already exist.
----
-
-# Manta storage backend
-
-The Manta storage backend is used to persist Vault's data in [Triton's Manta Object
-Storage][manta-object-store]. The storage folder must already exist.
-
-- **No High Availability** – the Manta storage backend does not support high
-  availability.
-
-- **Community Supported** – the Manta storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-```hcl
-storage "manta" {
-  directory   = "manta-directory"
-  user = "myuser"
-  key_id = "40:9d:d3:f9:0b:86:62:48:f4:2e:a5:8e:43:00:2a:9b"
-}
-```
-
-## `manta` parameters
-
-- `directory` `(string: <required>)` – Specifies the name of the manta directory to use.
-  This will be in the `/stor/` folder in the specific manta account
-
-The following settings are used for authenticating to Manta.
-
-- `user` `(string: <required>)` – Specifies the Manta user account name. This can also be provided via
-  the environment variable `MANTA_USER`.
-
-- `key_id` `(string: <required>)` – The fingerprint of the public key of the SSH key pair to use for authentication with the Manta API.
-  It is assumed that the SSH agent has the private key corresponding to this key ID loaded. This can also be provided
-  via the environment variable `MANTA_KEY_ID`.
-
-- `subuser` - The name of a subuser that has been granted access to the Manta account. This can also be
-  provided via the environment variable `MANTA_SUBUSER`.
-- `url` – Specifies the Manta URL. Defaults to `https://us-east.manta.joyent.com`. This can also be provided via
-  the environment variable `MANTA_URL`.
-
-- `max_parallel` `(string: "128")` – Specifies The maximum number of concurrent
-  requests to Manta.
-
-## `manta` examples
-
-This example shows configuring the Azure storage backend with a custom number of
-maximum parallel connections.
-
-```hcl
-storage "manta" {
-  directory    = "vault-storage-directory"
-  max_parallel = 512
-}
-```
-
-[manta-object-store]: https://www.joyent.com/triton/object-storage
diff --git a/website/content/docs/configuration/storage/mssql.mdx b/website/content/docs/configuration/storage/mssql.mdx
deleted file mode 100644
index db5f5b5eeaf..00000000000
--- a/website/content/docs/configuration/storage/mssql.mdx
+++ /dev/null
@@ -1,82 +0,0 @@
----
-layout: docs
-page_title: MSSQL - Storage Backends - Configuration
-description: >-
-  The MSSQL storage backend is used to persist Vault's data in a Microsoft SQL
-  Server.
----
-
-# MSSQL storage backend
-
-The MSSQL storage backend is used to persist Vault's data in a Microsoft SQL Server.
-
-- **No High Availability** – the MSSQL storage backend does not support high
-  availability.
-
-- **Community Supported** – the MSSQL storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-```hcl
-storage "mssql" {
-  server = "localhost"
-  port = 1433
-  username = "user1234"
-  password = "secret123!"
-  database = "vault"
-  table = "vault"
-  appname = "vault"
-  schema = "dbo"
-  connectionTimeout = 30
-  logLevel = 0
-}
-```
-
-## `mssql` parameters
-
-- `server` `(string: <required>)` – host or host\instance.
-
-- `port` `(int: 1433)` – Specifies the port of the MSSQL host.
-
-- `username` `(string: "")` - enter the SQL Server Authentication user id or
-  the Windows Authentication user id in the DOMAIN\User format.
-  On Windows, if user id is empty or missing Single-Sign-On is used.
-
-- `password` `(string: "")` – specifies the MSSQL password to connect to
-  the database.
-
-- `database` `(string: "Vault")` – Specifies the name of the database. If the
-  database does not exist, Vault will attempt to create it.
-
-- `table` `(string: "Vault")` – Specifies the name of the table. If the table
-  does not exist, Vault will attempt to create it.
-
-- `schema` `(string: "dbo")` – Specifies the name of the schema. If the schema
-  does not exist, Vault will attempt to create it.
-
-- `appname` `(string: "Vault")` – the application name.
-
-- `connectionTimeout` `(int: 30)` – in seconds (default is 30).
-
-- `logLevel` `(int: 0)` – logging flags (default 0/no logging, 63 for full logging) .
-
-- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
-  requests to MSSQL.
-
-## `mssql` examples
-
-### Custom database, table and schema
-
-This example shows configuring the MSSQL backend to use a custom database and
-table name.
-
-```hcl
-storage "mssql" {
-  database = "my-vault"
-  table    = "vault-data"
-  schema   = "vlt"
-  username = "user1234"
-  password = "pass5678"
-}
-```
diff --git a/website/content/docs/configuration/storage/mysql.mdx b/website/content/docs/configuration/storage/mysql.mdx
deleted file mode 100644
index 70b97f7a5ff..00000000000
--- a/website/content/docs/configuration/storage/mysql.mdx
+++ /dev/null
@@ -1,100 +0,0 @@
----
-layout: docs
-page_title: MySQL - Storage Backends - Configuration
-description: |-
-  The MySQL storage backend is used to persist Vault's data in a MySQL server or
-  cluster.
----
-
-# MySQL storage backend
-
-The MySQL storage backend is used to persist Vault's data in a [MySQL][mysql]
-server or cluster.
-
-- **High Availability** – the MySQL storage backend supports high availability.
-  Note that due to the way mysql locking functions work they are lost if a connection
-  dies. If you would like to not have frequent changes in your elected leader you
-  can increase interactive_timeout and wait_timeout MySQL config to much higher than
-  default which is set at 8 hours.
-
-- **Community Supported** – the MySQL storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-```hcl
-storage "mysql" {
-  username = "user1234"
-  password = "secret123!"
-  database = "vault"
-}
-```
-
-## `mysql` parameters
-
-- `address` `(string: "127.0.0.1:3306")` – Specifies the address of the MySQL
-  host.
-
-- `database` `(string: "vault")` – Specifies the name of the database. If the
-  database does not exist, Vault will attempt to create it.
-
-- `table` `(string: "vault")` – Specifies the name of the table. If the table
-  does not exist, Vault will attempt to create it.
-
-- `tls_ca_file` `(string: "")` – Specifies the path to the CA certificate to
-  connect using TLS.
-
-- `plaintext_credentials_transmission` `(string: "")` - Provides authorization
-  to send credentials over plaintext. Failure to provide a value AND a failure
-  to provide a TLS CA certificate will warn that the credentials are being sent
-  over plain text. In the future, failure to do acknowledge or use TLS will
-  result in server start being prevented. This will be done to ensure credentials
-  are not leaked accidentally.
-
-- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
-  requests to MySQL.
-
-- `max_idle_connections` `(string: "0")` – Specifies the maximum number of idle
-  connections to the database. A zero uses value defaults to 2 idle connections
-  and a negative value disables idle connections. If larger than
-  `max_parallel` it will be reduced to be equal.
-
-- `max_connection_lifetime` `(string: "0")` – Specifies the maximum amount of
-  time in seconds that a connection may be reused. If <= 0s connections are reused forever.
-
-Additionally, Vault requires the following authentication information.
-
-- `username` `(string: <required>)` – Specifies the MySQL username to connect to
-  the database.
-
-- `password` `(string: <required>)` – Specifies the MySQL password to connect to
-  the database.
-
-### High availability parameters
-
-- `ha_enabled` `(string: "false")` - Specifies if high availability mode is
-  enabled. This is a boolean value, but it is specified as a string like "true"
-  or "false".
-
-- `lock_table` `(string: "vault_lock")` – Specifies the name of the table to
-  use for storing high availability information. By default, this is the name
-  of the `table` suffixed with `_lock`. If the table does not exist, Vault will
-  attempt to create it.
-
-## `mysql` examples
-
-### Custom database and table
-
-This example shows configuring the MySQL backend to use a custom database and
-table name.
-
-```hcl
-storage "mysql" {
-  database = "my-vault"
-  table    = "vault-data"
-  username = "user1234"
-  password = "pass5678"
-}
-```
-
-[mysql]: https://dev.mysql.com
diff --git a/website/content/docs/configuration/storage/oci-object-storage.mdx b/website/content/docs/configuration/storage/oci-object-storage.mdx
deleted file mode 100644
index 2cdcdaf55e1..00000000000
--- a/website/content/docs/configuration/storage/oci-object-storage.mdx
+++ /dev/null
@@ -1,85 +0,0 @@
----
-layout: docs
-page_title: OCI Object Storage - Storage Backends - Configuration
-description: >-
-  The OCI Object Storage backend is used to persist Vault's data in OCI Object
-  Storage.
----
-
-# OCI object storage storage backend
-
-The OCI Object Storage backend is used to persist Vault's data in OCI Object Storage.
-
-- **High Availability** – the OCI Object Storage backend supports high availability.
-
-- **Community Supported** – the OCI Object Storage backend is supported by the community. While it has undergone review by HashiCorp employees, they may not be as knowledgeable about the technology. If you encounter problems with them, you may be referred to the original author.
-
-```hcl
-storage "oci" {
-   region = "<oci_region>"
-   namespace_name = "<object_storage_namespace_name>"
-   bucket_name = "<vault_data_bucket_name>"
-   ha_enabled = "<boolean true/false>"
-   lock_bucket_name = "<leader_lock_bucket_name>"
-   auth_type_api_key = "<boolean setting for using api-key instead of instance principals>"
-}
-```
-
-For more information on OCI Object Storage, please see the Oracle's [OCI Object Storage documentation][ocios-docs].
-
-## `oci` setup
-
-To use the OCI Object Storage Vault storage backend, you must have a OCI account. Either using the API or web interface, create the data bucket and lock bucket if enabling high availability.
-
-The OCI Object Storage backend does not support creating the buckets automatically at this time.
-
-## `oci` authentication
-
-The OCI Object Storage Vault storage backend uses the official OCI Golang SDK. This means it supports the common ways of providing credentials to OCI.
-
-For more information on service accounts, please see the [OCI Identity documentation][oci-identity].
-
-## `oci` parameters
-
-- `region` `(string: <optional>)` - Specifies the OCI region where Vault should look for object storage buckets. If not specified the OCI Storage Backend will use the region specified in your OCI credentials configuration.
-
-- `namespace_name` `(string: <required>)` – Specifies the name of the OCI Object Storage namespaces containing the data bucket and the lock bucket.
-
-- `bucket_name` `(string: <required>)` - Specifies the name of the bucket that will be used to store the Vault data.
-
-### High availability parameters
-
-- `ha_enabled` `(string: "<required>")` - Specifies if high availability mode is
-  enabled. This is a boolean value, but it is specified as a string like "true"
-  or "false".
-
-- `lock_bucket_name` `(string: "<required>")` - Specifies the name of the bucket that will be used to store the node lease data.
-
-## `oci` examples
-
-### Standalone Vault instance
-
-This example shows configuring OCI Object Storage as a standalone instance.
-
-```hcl
-storage "oci" {
-    namespace_name = "MyNamespace"
-    bucket_name = "DataBucket"
-}
-```
-
-### High availability
-
-This example shows configuring OCI Object Storage with high availability enabled.
-
-```hcl
-storage "oci" {
-   namespace_name = "MyNamespace"
-   bucket_name = "DataBucket"
-   ha_enabled = "true"
-   lock_bucket_name = "LockBucket"
-}
-```
-
-[oci-identity]: https://docs.cloud.oracle.com/iaas/Content/Identity/Concepts/overview.htm
-[ocios-docs]: https://docs.cloud.oracle.com/iaas/Content/Object/Concepts/objectstorageoverview.htm
diff --git a/website/content/docs/configuration/storage/postgresql.mdx b/website/content/docs/configuration/storage/postgresql.mdx
deleted file mode 100644
index 85a8399bf41..00000000000
--- a/website/content/docs/configuration/storage/postgresql.mdx
+++ /dev/null
@@ -1,141 +0,0 @@
----
-layout: docs
-page_title: PostgreSQL - Storage Backends - Configuration
-description: |-
-  The PostgreSQL storage backend is used to persist Vault's data in a PostgreSQL
-  server or cluster.
----
-
-# PostgreSQL storage backend
-
-The PostgreSQL storage backend is used to persist Vault's data in a
-[PostgreSQL][postgresql] server or cluster.
-
-- **High Availability** – the PostgreSQL storage backend supports
-  high availability. Requires PostgreSQL 9.5 or later.
-
-- **Community Supported** – the PostgreSQL storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-```hcl
-storage "postgresql" {
-  connection_url = "postgres://user123:secret123!@localhost:5432/vault"
-}
-```
-
-~> **Note:** The PostgreSQL storage backend plugin will attempt to use SSL
-when connecting to the database. If SSL is not enabled the `connection_url`
-will need to be configured to disable SSL. See the documentation below
-to disable SSL.
-
-The PostgreSQL storage backend does not automatically create the table. Here is
-some sample SQL to create the schema and indexes.
-
-```sql
-CREATE TABLE vault_kv_store (
-  parent_path TEXT COLLATE "C" NOT NULL,
-  path        TEXT COLLATE "C",
-  key         TEXT COLLATE "C",
-  value       BYTEA,
-  CONSTRAINT pkey PRIMARY KEY (path, key)
-);
-
-CREATE INDEX parent_path_idx ON vault_kv_store (parent_path);
-```
-
-Store for HAEnabled backend
-
-```sql
-CREATE TABLE vault_ha_locks (
-  ha_key                                      TEXT COLLATE "C" NOT NULL,
-  ha_identity                                 TEXT COLLATE "C" NOT NULL,
-  ha_value                                    TEXT COLLATE "C",
-  valid_until                                 TIMESTAMP WITH TIME ZONE NOT NULL,
-  CONSTRAINT ha_key PRIMARY KEY (ha_key)
-);
-```
-
-If you're using a version of PostgreSQL prior to 9.5, create the following function:
-
-```sql
-CREATE FUNCTION vault_kv_put(_parent_path TEXT, _path TEXT, _key TEXT, _value BYTEA) RETURNS VOID AS
-$$
-BEGIN
-    LOOP
-        -- first try to update the key
-        UPDATE vault_kv_store
-          SET (parent_path, path, key, value) = (_parent_path, _path, _key, _value)
-          WHERE _path = path AND key = _key;
-        IF found THEN
-            RETURN;
-        END IF;
-        -- not there, so try to insert the key
-        -- if someone else inserts the same key concurrently,
-        -- we could get a unique-key failure
-        BEGIN
-            INSERT INTO vault_kv_store (parent_path, path, key, value)
-              VALUES (_parent_path, _path, _key, _value);
-            RETURN;
-        EXCEPTION WHEN unique_violation THEN
-            -- Do nothing, and loop to try the UPDATE again.
-        END;
-    END LOOP;
-END;
-$$
-LANGUAGE plpgsql;
-```
-
-## `postgresql` parameters
-
-- `connection_url` `(string: <required>)` – Specifies the connection string to
-  use to authenticate and connect to PostgreSQL. The connection URL can also be
-  set using the `VAULT_PG_CONNECTION_URL` environment variable. A full list of supported
-  parameters can be found in the [pgx library][pgxlib] and [PostgreSQL connection string][pg_conn_docs]
-  documentation. For example connection string URLs, see the examples section below.
-
-- `table` `(string: "vault_kv_store")` – Specifies the name of the table in
-  which to write Vault data. This table must already exist (Vault will not
-  attempt to create it).
-
-- `max_idle_connections` `(int)` - Default not set. Sets the maximum number of
-  connections in the idle connection pool. See
-  [golang docs on SetMaxIdleConns][golang_setmaxidleconns] for more information.
-  Requires 1.2 or later.
-
-- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
-  requests to PostgreSQL.
-
-- `ha_enabled` `(string: "true|false")` – Default not enabled, requires 9.5 or later.
-
-- `ha_table` `(string: "vault_ha_locks")` – Specifies the name of the table to use
-  for storing high availability information. This table must already exist (Vault
-  will not attempt to create it).
-
-## `postgresql` examples
-
-### Custom SSL verification
-
-This example shows connecting to a PostgreSQL cluster using full SSL
-verification (recommended).
-
-```hcl
-storage "postgresql" {
-  connection_url = "postgres://user:pass@localhost:5432/database?sslmode=verify-full"
-}
-```
-
-To disable SSL verification (not recommended), replace `verify-full` with
-`disable`:
-
-```hcl
-storage "postgresql" {
-  connection_url = "postgres://user:pass@localhost:5432/database?sslmode=disable"
-}
-```
-
-[golang_setmaxidleconns]: https://golang.org/pkg/database/sql/#DB.SetMaxIdleConns
-[postgresql]: https://www.postgresql.org/
-[pgxlib]: https://pkg.go.dev/github.com/jackc/pgx/stdlib
-[pg_conn_docs]: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
diff --git a/website/content/docs/configuration/storage/raft.mdx b/website/content/docs/configuration/storage/raft.mdx
deleted file mode 100644
index f8806114f8d..00000000000
--- a/website/content/docs/configuration/storage/raft.mdx
+++ /dev/null
@@ -1,253 +0,0 @@
----
-layout: docs
-page_title: Integrated Storage - Storage Backends - Configuration
-description: |-
-
-  The Integrated Storage (Raft) backend is used to persist Vault's data. Unlike all the other
-  storage backends, this backend does not operate from a single source for the
-  data. Instead all the nodes in a Vault cluster will have a replicated copy of
-  the entire data. The data is replicated across the nodes using the Raft
-  Consensus Algorithm.
----
-
-# Integrated storage (Raft) backend
-
-The Integrated Storage backend is used to persist Vault's data. Unlike other storage
-backends, Integrated Storage does not operate from a single source of data. Instead
-all the nodes in a Vault cluster will have a replicated copy of Vault's data.
-Data gets replicated across all the nodes via the [Raft Consensus
-Algorithm][raft].
-
-- **High Availability** – the Integrated Storage backend supports high availability.
-
-- **HashiCorp Supported** – the Integrated Storage backend is officially supported
-  by HashiCorp.
-
-```hcl
-storage "raft" {
-  path = "/path/to/raft/data"
-  node_id = "raft_node_1"
-}
-cluster_addr = "http://127.0.0.1:8201"
-```
-
-~> **Note:** When using the Integrated Storage backend, it is required to provide
-[`cluster_addr`](/vault/docs/concepts/ha#per-node-cluster-address) to indicate the address and port to be used for communication
-between the nodes in the Raft cluster.
-
-~> **Note:** When using the Integrated Storage backend, a separate
-[`ha_storage`](/vault/docs/configuration#ha_storage)
-backend cannot be declared.
-
-~> **Note:** When using the Integrated Storage backend, it is strongly recommended to
-set [`disable_mlock`](/vault/docs/configuration#disable_mlock) to `true`, and to disable memory swapping on the system.
-
-## `raft` parameters
-
-- `path` `(string: "")` – The file system path where all the Vault data gets
-  stored.
-  This value can be overridden by setting the `VAULT_RAFT_PATH` environment variable.
-
-- `node_id` `(string: "")` - The identifier for the node in the Raft cluster.
-  You can override `node_id` with the `VAULT_RAFT_NODE_ID` environment
-  variable.  When `VAULT_RAFT_NODE_ID` is unset, Vault assigns a random
-  GUID during initialization and writes the value to `data/node-id` in the
-  directory specified by the `path` parameter.
-
-- `performance_multiplier` `(integer: 0)` - An integer multiplier used by 
-  servers to scale key Raft timing parameters, where each increment translates to approximately 1 – 2 seconds of delay. For example, setting the multiplier to "3" translates to 3 – 6 seconds of total delay.  Tuning  the multiplier affects the time it
-  takes Vault to detect leader failures and to perform leader elections, at the
-  expense of requiring more network and CPU resources for better performance.
-  Omitting this value or setting it to 0 uses default timing described below. 
-  Lower values are used to tighten timing and increase sensitivity while higher 
-  values relax timings and reduce sensitivity.
-
-
-By default, Vault uses a balanced timing value of 5, which is suitable for most
-platforms and scenarios. You should only adjust the timing value when platform
-telemetry indicators that a change is needed or different timing is required due
-to the overall reliability your platform (network, etc.).
-
-Setting the timing value to 1 configures Raft to its highest performance (lowest
-delay) mode. The maximum allowed value is 10. 
-
-- `trailing_logs` `(integer: 10000)` - This controls how many log entries are
-  left in the log store on disk after a snapshot is made. This should only be
-  adjusted when followers cannot catch up to the leader due to a very large
-  snapshot size and high write throughput causing log truncation before a
-  snapshot can be fully installed. If you need to use this to recover a cluster,
-  consider reducing write throughput or the amount of data stored on Vault. The
-  default value is 10000 which is suitable for all normal workloads. The
-  `trailing_logs` metric is not the same as `max_trailing_logs`.
-
-- `snapshot_threshold` `(integer: 8192)` - This controls the minimum number of Raft
-  commit entries between snapshots that are saved to disk. This is a low-level
-  parameter that should rarely need to be changed. Very busy clusters
-  experiencing excessive disk IO may increase this value to reduce disk IO and
-  minimize the chances of all servers taking snapshots at the same time.
-  Increasing this trades off disk IO for disk space since the log will grow much
-  larger and the space in the `raft.db` file can't be reclaimed till the next
-  snapshot. Servers may take longer to recover from crashes or failover if this
-  is increased significantly as more logs will need to be replayed.
-
-- `snapshot_interval` `(integer: 120 seconds)` - The snapshot interval
-   controls how often Raft checks whether a snapshot operation is
-   required. Raft randomly staggers snapshots between the configured
-   interval and twice the configured interval to keep the entire cluster
-   from performing a snapshot at once. The default snapshot interval is
-   120 seconds.
-
-- `retry_join` `(list: [])` - A set of connection details for another node in the
-  cluster, which is used to help nodes locate a leader in order to join a cluster.
-  There can be one or more [`retry_join`](#retry_join-stanza) stanzas.
-
-  If the connection details for all nodes in the cluster are known in advance, you
-  can include these stanzas to enable nodes to automatically join the Raft cluster.
-  Once one of the nodes is initialized as the leader, the remaining nodes will use
-  their [`retry_join`](#retry_join-stanza) configuration to locate the leader and
-  join the cluster. Note that when using Shamir seal, the joined nodes will still
-  need to be unsealed manually.
-  See [the section below](#retry_join-stanza) for the parameters accepted by the
-  [`retry_join`](#retry_join-stanza) stanza.
-
-- `retry_join_as_non_voter` `(boolean: false)` - If set, causes any `retry_join`
-  config to join the Raft cluster as a non-voter. The node will not participate
-  in the Raft quorum but will still receive the data replication stream, adding
-  read scalability to a cluster. This option has the same effect as the
-  [`-non-voter`](/vault/docs/commands/operator/raft#non-voter) flag for the
-  `vault operator raft join` command, but only affects voting status when joining
-  via `retry_join` config. This setting can be overridden to true by setting the
-  `VAULT_RAFT_RETRY_JOIN_AS_NON_VOTER` environment variable to any non-empty value.
-  Only valid if there is at least one `retry_join` stanza.
-
-- `max_entry_size` `(integer: 1048576)` - This configures the maximum number of
-  bytes for a Raft entry. It applies to both Put operations and transactions.
-  Any put or transaction operation exceeding this configuration value will cause
-  the respective operation to fail. Raft has a suggested max size of data in a
-  Raft log entry. This is based on current architecture, default timing, etc.
-  Integrated Storage also uses a chunk size that is the threshold used for
-  breaking a large value into chunks. By default, the chunk size is the same as
-  Raft's max size log entry. The default value for this configuration is 1048576
-  -- two times the chunking size.
-  - **Note:** This option corresponds to [Consul's `kv_max_value_size` parameter](/consul/docs/agent/config/config-files#kv_max_value_size) for
-    Vault clusters using a Consul storage backend.  If you are migrating from Consul
-    storage to Raft Integrated Storage,  and have changed this value in Consul from its
-    default to a value larger than the Integrated Storage default of 1MB, then you will 
-    need to make the same change in Vault's Integrated Storage config.
-
-- `autopilot_reconcile_interval` `(string: "10s")` - This is the interval after
-  which autopilot will pick up any state changes. State change could mean multiple
-  things; for example a newly joined voter node, initially added as non-voter to
-  the Raft cluster by autopilot has successfully completed the stabilization
-  period thereby qualifying for being promoted as a voter, a node that has become
-  unhealthy and needs to be shown as such in the state API, a node has been marked
-  as dead needing eviction from Raft configuration, etc.
-
-- `autopilot_update_interval` `(string: "2s")` - This is the interval after which
-  autopilot will poll Vault for any updates to the information it cares about. This
-  includes things like the autopilot configuration, current autopilot state, raft
-  configuration, known servers, latest raft index, and stats for all the known servers.
-  The information that autopilot receives will be used to calculate its next state.
-
-- `autopilot_upgrade_version` `(string: "")` - This is an optional string that, if
-  provided, will be used reported to autopilot as Vault's version. This is then used
-  by autopilot when it makes decisions regarding
-  [automated upgrades](/vault/docs/enterprise/automated-upgrades). If omitted, the
-  version of Vault currently in use will be used. Note that this string must conform
-  to [Semantic Versioning](https://semver.org). Use of this feature requires Vault
-  Enterprise.
-
-- `autopilot_redundancy_zone` `(string: "")` - This is an optional string that specifies
-  Vault's [redundancy zone](/vault/docs/enterprise/redundancy-zones). This is reported to autopilot
-  and is used to enhance scaling and resiliency. Use of this feature requires Vault Enterprise.
-
-### `retry_join` stanza
-
-- `leader_api_addr` `(string: "")` - Address of a possible leader node.
-
-- `auto_join` `(string: "")` - Cloud auto-join configuration, using
-  [go-discover](https://github.com/hashicorp/go-discover) syntax.
-
-- `auto_join_scheme` `(string: "")` - The optional URI protocol scheme for addresses
-  discovered via auto-join. Available values are `http` or `https`.
-
-- `auto_join_port` `(uint: "")` - The optional port used for addressed discovered
-  via auto-join.
-
-- `leader_tls_servername` `(string: "")` - The TLS server name to use when
-  connecting with HTTPS.
-  Should match one of the names in the [DNS
-  SANs](https://en.wikipedia.org/wiki/Subject_Alternative_Name) of the remote
-  server certificate.
-  See also [Integrated Storage and TLS](/vault/docs/concepts/integrated-storage#autojoin-with-tls-servername)
-
-- `leader_ca_cert_file` `(string: "")` - File path to the CA cert of the
-  possible leader node.
-
-- `leader_client_cert_file` `(string: "")` - File path to the client certificate
-  for the follower node to establish client authentication with the possible
-  leader node.
-
-- `leader_client_key_file` `(string: "")` - File path to the client key for the
-  follower node to establish client authentication with the possible leader node.
-
-- `leader_ca_cert` `(string: "")` - CA cert of the possible leader node.
-
-- `leader_client_cert` `(string: "")` - Client certificate for the follower node
-  to establish client authentication with the possible leader node.
-
-- `leader_client_key` `(string: "")` - Client key for the follower node to
-  establish client authentication with the possible leader node.
-
-Each [`retry_join`](#retry_join-stanza) block may provide TLS certificates via
-file paths or as a single-line certificate string value with newlines delimited
-by `\n`, but not a combination of both. Each [`retry_join`](#retry_join-stanza)
-stanza may contain either a [`leader_api_addr`](#leader_api_addr) value or a
-cloud [`auto_join`](#auto_join) configuration value, but not both. When an
-[`auto_join`](#auto_join) value is provided, Vault will automatically attempt to
-discover and resolve potential Raft leader addresses using [go-discover](https://github.com/hashicorp/go-discover).
-See the go-discover
-[README](https://github.com/hashicorp/go-discover/blob/master/README.md)
-for details on the format of the `auto_join` value.
-
-By default, Vault will attempt to reach discovered peers using HTTPS and port 8200. Operators may override these through the
-[`auto_join_scheme`](#auto_join_scheme) and [`auto_join_port`](#auto_join_port)
-fields respectively.
-
-Example Configuration:
-
-```hcl
-storage "raft" {
-  path    = "/Users/foo/raft/"
-  node_id = "node1"
-
-  retry_join {
-    leader_api_addr = "http://127.0.0.2:8200"
-    leader_ca_cert_file = "/path/to/ca1"
-    leader_client_cert_file = "/path/to/client/cert1"
-    leader_client_key_file = "/path/to/client/key1"
-  }
-  retry_join {
-    leader_api_addr = "http://127.0.0.3:8200"
-    leader_ca_cert_file = "/path/to/ca2"
-    leader_client_cert_file = "/path/to/client/cert2"
-    leader_client_key_file = "/path/to/client/key2"
-  }
-  retry_join {
-    leader_api_addr = "http://127.0.0.4:8200"
-    leader_ca_cert_file = "/path/to/ca3"
-    leader_client_cert_file = "/path/to/client/cert3"
-    leader_client_key_file = "/path/to/client/key3"
-  }
-  retry_join {
-    auto_join = "provider=aws region=eu-west-1 tag_key=vault tag_value=... access_key_id=... secret_access_key=..."
-  }
-}
-```
-
-## Tutorial
-
-Refer to the [Integrated
-Storage](/vault/tutorials/raft) series of tutorials to learn more about implementing Vault using Integrated Storage.
-
-[raft]: https://raft.github.io/ 'The Raft Consensus Algorithm'
diff --git a/website/content/docs/configuration/storage/s3.mdx b/website/content/docs/configuration/storage/s3.mdx
deleted file mode 100644
index 14526bc051c..00000000000
--- a/website/content/docs/configuration/storage/s3.mdx
+++ /dev/null
@@ -1,123 +0,0 @@
----
-layout: docs
-page_title: S3 - Storage Backends - Configuration
-description: |-
-  The S3 storage backend is used to persist Vault's data in an Amazon S3
-  bucket.
----
-
-# S3 storage backend
-
-The S3 storage backend is used to persist Vault's data in an [Amazon S3][s3]
-bucket.
-
-- **No High Availability** – the S3 storage backend does not support high
-  availability.
-
-- **Community Supported** – the S3 storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-```hcl
-storage "s3" {
-  access_key = "abcd1234"
-  secret_key = "defg5678"
-  bucket     = "my-bucket"
-}
-```
-
-## `s3` parameters
-
-- `bucket` `(string: <required>)` – Specifies the name of the S3 bucket. This
-  can also be provided via the environment variable `AWS_S3_BUCKET`.
-
-- `endpoint` `(string: "")` – Specifies an alternative, AWS compatible, S3
-  endpoint. This can also be provided via the environment variable
-  `AWS_S3_ENDPOINT`.
-
-- `region` `(string "us-east-1")` – Specifies the AWS region. This can also be
-  provided via the environment variable `AWS_REGION` or `AWS_DEFAULT_REGION`,
-  in that order of preference.
-
-The following settings are used for authenticating to AWS. If you are
-running your Vault server on an EC2 instance, you can also make use of the EC2
-instance profile service to provide the credentials Vault will use to make
-S3 API calls. Leaving the `access_key` and `secret_key` fields empty will
-cause Vault to attempt to retrieve credentials from the AWS metadata service.
-
-- `access_key` – Specifies the AWS access key. This can also be provided via
-  the environment variable `AWS_ACCESS_KEY_ID`, AWS credential files, or by
-  IAM role.
-
-- `secret_key` – Specifies the AWS secret key. This can also be provided via
-  the environment variable `AWS_SECRET_ACCESS_KEY`, AWS credential files, or
-  by IAM role.
-
-- `session_token` `(string: "")` – Specifies the AWS session token. This can
-  also be provided via the environment variable `AWS_SESSION_TOKEN`.
-
-- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
-  requests to S3.
-
-- `s3_force_path_style` `(string: "false")` - Specifies whether to use host
-  bucket style domains with the configured endpoint.
-
-- `disable_ssl` `(string: "false")` - Specifies if SSL should be used for the
-  endpoint connection (highly recommended not to disable for production).
-
-- `kms_key_id` `(string: "")` - Specifies the ID or Alias of the KMS key used to
-  encrypt data in the S3 backend. Vault must have `kms:Encrypt`, `kms:Decrypt`
-  and `kms:GenerateDataKey` permissions for this KMS key. You can use 
-  `alias/aws/s3` to specify the default key for the account.
-
-- `path` `(string: "")` - Specifies the path in the S3 Bucket where Vault
-  data will be stored.
-
-## `s3` examples
-
-### Default example
-
-This example shows using Amazon S3 as a storage backend.
-
-```hcl
-storage "s3" {
-  access_key = "abcd1234"
-  secret_key = "defg5678"
-  bucket     = "my-bucket"
-}
-```
-
-### S3 KMS encryption with default key
-
-This example shows using Amazon S3 as a storage backend using KMS
-encryption with the default S3 KMS key for the account.
-
-```hcl
-storage "s3" {
-  access_key = "abcd1234"
-  secret_key = "defg5678"
-  bucket     = "my-bucket"
-  kms_key_id = "alias/aws/s3"
-}
-```
-
-### S3 KMS encryption with custom key
-
-This example shows using Amazon S3 as a storage backend using KMS
-encryption with a customer managed KMS key.
-
-```hcl
-storage "s3" {
-  access_key = "abcd1234"
-  secret_key = "defg5678"
-  bucket     = "my-bucket"
-  kms_key_id = "001234ac-72d3-9902-a3fc-0123456789ab"
-}
-```
-
-[s3]: https://aws.amazon.com/s3/
-
-## AWS instance metadata timeouts
-
-@include 'aws-imds-timeout.mdx'
diff --git a/website/content/docs/configuration/storage/swift.mdx b/website/content/docs/configuration/storage/swift.mdx
deleted file mode 100644
index 6f16e8ad4a0..00000000000
--- a/website/content/docs/configuration/storage/swift.mdx
+++ /dev/null
@@ -1,82 +0,0 @@
----
-layout: docs
-page_title: Swift - Storage Backends - Configuration
-description: |-
-  The Swift storage backend is used to persist Vault's data in an OpenStack
-  Swift Container.
----
-
-# Swift storage backend
-
-The Swift storage backend is used to persist Vault's data in an
-[OpenStack Swift Container][swift].
-
-- **No High Availability** – the Swift storage backend does not support high
-  availability.
-
-- **Community Supported** – the Swift storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-```hcl
-storage "swift" {
-  auth_url  = "https://..."
-  username  = "admin"
-  password  = "secret123!"
-  container = "my-storage-container"
-}
-```
-
-## `swift` parameters
-
-- `auth_url` `(string: <required>)` – Specifies the OpenStack authentication
-  endpoint. This can also be provided via the environment variable `OS_AUTH_URL`.
-
-- `container` `(string: <required>)` – Specifies the name of the Swift
-  container. This can also be provided via the environment variable
-  `OS_CONTAINER`.
-
-- `max_parallel` `(string: "128")` – The maximum number of concurrent requests.
-
-- `password` `(string: <required>)` – Specifies the OpenStack password. This can
-  also be provided via the environment variable `OS_PASSWORD`.
-
-- `tenant` `(string: "")` – Specifies the name of the tenant. If left blank,
-  this will default to the default tenant of the username. This can also be
-  provided via the environment variable `OS_TENANT_NAME`.
-
-- `username` `(string: <required>)` – Specifies the OpenStack account/username.
-  This can also be provided via the environment variable `OS_USERNAME`.
-
-- `region` `(string: "")` – Specifies the name of the region. This can also be provided via the environment variable `OS_REGION_NAME`.
-
-- `tenant_id` `(string: "")` - Specifies the id of the tenant. This can also be provided via the environment variable `OS_TENANT_ID`.
-
-- `domain` `(string: "")` - Specifies the name of the user domain. This can also be provided via the environment variable `OS_USER_DOMAIN_NAME`.
-
-- `project-domain` `(string: "")` - Specifies the name of the project's domain. This can also be provided via the environment variable `OS_PROJECT_DOMAIN_NAME`.
-
-- `trust_id` `(string: "")` - Specifies the id of the trust. This can also be provided via the environment variable `OS_TRUST_ID`.
-
-- `storage_url` `(string: "")` - Specifies storage URL from alternate authentication. This can also be provided via the environment variable `OS_STORAGE_URL`.
-
-- `auth_token` `(string: "")` - Specifies auth token from alternate authentication. This can also be provided via the environment variable `OS_AUTH_TOKEN`.
-
-## `swift` examples
-
-### Default example
-
-This example shows a default configuration for Swift.
-
-```hcl
-storage "swift" {
-  auth_url  = "https://os.internal/v1/auth"
-  container = "container-239"
-
-  username  = "user1234"
-  password  = "pass5678"
-}
-```
-
-[swift]: http://docs.openstack.org/developer/swift/
diff --git a/website/content/docs/configuration/storage/zookeeper.mdx b/website/content/docs/configuration/storage/zookeeper.mdx
deleted file mode 100644
index e2120e6a19e..00000000000
--- a/website/content/docs/configuration/storage/zookeeper.mdx
+++ /dev/null
@@ -1,150 +0,0 @@
----
-layout: docs
-page_title: Zookeeper - Storage Backends - Configuration
-description: The Zookeeper storage backend is used to persist Vault's data in Zookeeper.
----
-
-# Zookeeper storage backend
-
-The Zookeeper storage backend is used to persist Vault's data in
-[Zookeeper][zk].
-
-- **High Availability** – the Zookeeper storage backend supports high
-  availability.
-
-- **Community Supported** – the Zookeeper storage backend is supported by the
-  community. While it has undergone review by HashiCorp employees, they may not
-  be as knowledgeable about the technology. If you encounter problems with them,
-  you may be referred to the original author.
-
-```hcl
-storage "zookeeper" {
-  address = "localhost:2181"
-  path    = "vault/"
-}
-```
-
-## `zookeeper` parameters
-
-- `address` `(string: "localhost:2181")` – Specifies the addresses of the
-  Zookeeper instances as a comma-separated list.
-
-- `path` `(string: "vault/")` – Specifies the path in Zookeeper where data will
-  be stored.
-
-The following optional settings can be used to configure zNode ACLs:
-
-~> **Warning!** If neither `auth_info` nor `znode_owner` are set, the backend
-will not authenticate with Zookeeper and will set the `OPEN_ACL_UNSAFE` ACL on
-all nodes. In this scenario, anyone connected to Zookeeper could change Vault’s
-znodes and, potentially, take Vault out of service.
-
-- `auth_info` `(string: "")` – Specifies an authentication string in Zookeeper
-  AddAuth format. For example, `digest:UserName:Password` could be used to
-  authenticate as user `UserName` using password `Password` with the `digest`
-  mechanism.
-
-- `znode_owner` `(string: "")` – If specified, Vault will always set all
-  permissions (CRWDA) to the ACL identified here via the Schema and User parts
-  of the Zookeeper ACL format. The expected format is `schema:user-ACL-match`,
-  for example:
-
-  ```text
-  # Access for user "UserName" with corresponding digest "HIDfRvTv623G=="
-  digest:UserName:HIDfRvTv623G==
-  ```
-
-  ```text
-  # Access from localhost only
-  ip:127.0.0.1
-  ```
-
-  ```text
-  # Access from any host on the 70.95.0.0 network (Zookeeper 3.5+)
-  ip:70.95.0.0/16
-  ```
-
-- `tls_enabled` `(bool: false)` – Specifies if TLS communication with the Zookeeper
-  backend has to be enabled.
-
-- `tls_ca_file` `(string: "")` – Specifies the path to the CA certificate file used
-  for Zookeeper communication. Multiple CA certificates can be provided in the same file.
-
-- `tls_cert_file` `(string: "")` (optional) – Specifies the path to the
-  client certificate for Zookeeper communication.
-
-- `tls_key_file` `(string: "")` – Specifies the path to the private key for
-  Zookeeper communication.
-
-- `tls_min_version` `(string: "tls12")` – Specifies the minimum TLS version to
-  use. Accepted values are `"tls10"`, `"tls11"`, `"tls12"` or `"tls13"`.
-
-- `tls_skip_verify` `(bool: false)` – Disable verification of TLS certificates.
-  Using this option is highly discouraged.
-
-- `tls_verify_ip` `(bool: false)` - This property comes into play only when
-  'tls_skip_verify' is set to false. When 'tls_verify_ip' is set to 'true', the
-  zookeeper server's IP is verified in the presented certificates CN/SAN entry.
-  When set to 'false' the server's DNS name is verified in the certificates CN/SAN entry.
-
-## `zookeeper` examples
-
-### Custom address and path
-
-This example shows configuring Vault to communicate with a Zookeeper
-installation running on a custom port and to store data at a custom path.
-
-```hcl
-storage "zookeeper" {
-  address = "localhost:3253"
-  path    = "my-vault-data/"
-}
-```
-
-### zNode Vault user only
-
-This example instructs Vault to set an ACL on all of its zNodes which permit
-access only to the user "vaultUser". As per Zookeeper's ACL model, the digest
-value in `znode_owner` must match the user in `znode_owner`.
-
-```hcl
-storage "zookeeper" {
-  znode_owner = "digest:vaultUser:raxgVAfnDRljZDAcJFxznkZsExs="
-  auth_info   = "digest:vaultUser:abc"
-}
-```
-
-### zNode localhost only
-
-This example instructs Vault to only allow access from localhost. As this is the
-`ip` no `auth_info` is required since Zookeeper uses the address of the client
-for the ACL check.
-
-```hcl
-storage "zookeeper" {
-  znode_owner = "ip:127.0.0.1"
-}
-```
-
-### zNode connection over TLS.
-
-This example instructs Vault to connect to Zookeeper using the provided TLS configuration. The host verification will happen with the presented certificate using the servers IP because 'tls_verify_ip' is set to true.
-
-```hcl
-storage "zookeeper" {
-  address = "host1.com:5200,host2.com:5200,host3.com:5200"
-  path = "vault_path_on_zk/"
-  znode_owner = "digest:vault_user:digestvalueforpassword="
-  auth_info = "digest:vault_user:thisisthepassword"
-  redirect_addr = "http://localhost:8200"
-  tls_verify_ip = "true"
-  tls_enabled= "true"
-  tls_min_version= "tls12"
-  tls_cert_file = "/path/to/the/cert/file/zkcert.pem"
-  tls_key_file = "/path/to/the/key/file/zkkey.pem"
-  tls_skip_verify= "false"
-  tls_ca_file= "/path/to/the/ca/file/ca.pem"
-}
-```
-
-[zk]: https://zookeeper.apache.org/
diff --git a/website/content/docs/configuration/telemetry.mdx b/website/content/docs/configuration/telemetry.mdx
deleted file mode 100644
index 939f25d9b62..00000000000
--- a/website/content/docs/configuration/telemetry.mdx
+++ /dev/null
@@ -1,281 +0,0 @@
----
-layout: docs
-page_title: Telemetry - Configuration
-description: |-
-  The telemetry stanza specifies various configurations for Vault to publish
-  metrics to upstream systems.
----
-
-# `telemetry` stanza
-
-The `telemetry` stanza specifies various configurations for Vault to publish
-metrics to upstream systems. Available Vault metrics can be found in the
-[Telemetry internals documentation](/vault/docs/internals/telemetry).
-
-```hcl
-telemetry {
-  statsite_address = "statsite.company.local:8125"
-}
-```
-
-## `telemetry` parameters
-
-Due to the number of configurable parameters to the `telemetry` stanza,
-parameters on this page are grouped by the telemetry provider.
-
-### Common
-
-The following options are available on all telemetry configurations.
-
-- `usage_gauge_period` `(string: "10m")` - Specifies the interval at which high-cardinality
-  usage data is collected, such as token counts, entity counts, and secret counts.
-   A value of "none" disables the collection.  Uses [duration format strings](/vault/docs/concepts/duration-format).
-- `maximum_gauge_cardinality` `(int: 500)` - The maximum cardinality of gauge labels.
-- `disable_hostname` `(bool: false)` - Specifies if gauge values should be
-  prefixed with the local hostname.
-- `enable_hostname_label` `(bool: false)` - Specifies if all metric values should
-  contain the `host` label with the local hostname. It is recommended to enable
-  `disable_hostname` if this option is used.
-- `metrics_prefix` `(string: "vault")` - Specifies the prefix used for metric vaules. By default, metrics are prefixed with "vault".
-- `lease_metrics_epsilon` `(string: "1h")` - Specifies the size of the bucket used to measure future
-  lease expiration. For example, for the default value of 1 hour, the `vault.expire.leases.by_expiration`
-  metric will aggregate the total number of expiring leases for 1 hour buckets, starting from the current time.
-  Note that leases are put into buckets by rounding. For example, if `lease_metrics_epsilon` is set to 1h and
-  lease A expires 25 minutes from now, and lease B expires 35 minutes from now, then lease A will be in the first
-  bucket, which corresponds to 0-30 minutes, and lease B will be in the second bucket, which corresponds to 31-90
-  minutes. Uses [duration format strings](/vault/docs/concepts/duration-format).
-- `num_lease_metrics_buckets` `(int: 168)` - The number of expiry buckets for leases. For the default value, for
-  example, 168 value labels for the `vault.expire.leases.by_expiration` metric will be reported, where each value
-  each bucket is separated in time by the `lease_metrics_epsilon` parameter. For the default 1 hour value of
-  `lease_metrics_epsilon` and the default value of `num_lease_metrics_buckets`, `vault.expire.leases.by_expiration`
-  will report the total number of leases expiring within each hour from the current time to one week from the current time.
-- `add_lease_metrics_namespace_labels` `(bool: false)` - If this value is set to true, then `vault.expire.leases.by_expiration`
-  will break down expiring leases by both time and namespace. This parameter is disabled by default because enabling it can lead
-  to a large-cardinality metric.
-- `add_mount_point_rollback_metrics` `(bool: false)` - If this value is set to true, then `vault.rollback.attempt.{MOUNT_POINT}`
-  and `vault.route.rollback.{MOUNT_POINT}` metrics will be reported for every mount point. If this parameter is false, then
-  `vault.rollback.attempt` and `vault.route.rollback` metrics (which do not have the mount point in the metric name)
-  will be reported instead. This parameter is disabled by default starting in Vault 1.15 due to the high cardinality of
-  these metrics.
-- `filter_default` `(bool: true)` - This controls whether to allow metrics that have not been specified by the filter.
-  Defaults to `true`, which will allow all metrics when no filters are provided.
-  When set to `false` with no filters, no metrics will be sent.
-- `prefix_filter` `(string array: [])` - This is a list of filter rules to apply for allowing/blocking metrics by
-  prefix in the following format:
-  ```json
-  ["+vault.token", "-vault.expire", "+vault.expire.num_leases"]
-  ```
-  A leading "**+**" will enable any metrics with the given prefix, and a leading "**-**" will block them.
-  If there is overlap between two rules, the more specific rule will take precedence. Blocking will take priority if the same prefix is listed multiple times.
-
-
-### `statsite`
-
-These `telemetry` parameters apply to
-[statsite](https://github.com/armon/statsite).
-
-- `statsite_address` `(string: "")` - Specifies the address of a statsite server
-  to forward metrics data to.
-
-```hcl
-telemetry {
-  statsite_address = "statsite.company.local:8125"
-}
-```
-
-### `statsd`
-
-These `telemetry` parameters apply to
-[statsd](https://github.com/etsy/statsd).
-
-- `statsd_address` `(string: "")` - Specifies the address of a statsd server to
-  forward metrics to.
-
-```hcl
-telemetry {
-  statsd_address = "statsd.company.local:8125"
-}
-```
-
-### `circonus`
-
-These `telemetry` parameters apply to [Circonus](http://circonus.com/).
-
-- `circonus_api_token` `(string: "")` - Specifies a valid Circonus API Token
-  used to create/manage check. If provided, metric management is enabled.
-
-- `circonus_api_app` `(string: "nomad")` - Specifies a valid app name associated
-  with the API token.
-
-- `circonus_api_url` `(string: "https://api.circonus.com/v2")` - Specifies the
-  base URL to use for contacting the Circonus API.
-
-- `circonus_submission_interval` `(string: "10s")` - Specifies the interval at
-  which metrics are submitted to Circonus.
-
-- `circonus_submission_url` `(string: "")` - Specifies the
-  `check.config.submission_url` field, of a Check API object, from a previously
-  created HTTPTRAP check.
-
-- `circonus_check_id` `(string: "")` - Specifies the Check ID (**not check
-  bundle**) from a previously created HTTPTRAP check. The numeric portion of the
-  `check._cid` field in the Check API object.
-
-- `circonus_check_force_metric_activation` `(bool: false)` - Specifies if force
-  activation of metrics which already exist and are not currently active. If
-  check management is enabled, the default behavior is to add new metrics as
-  they are encountered. If the metric already exists in the check, it will
-  not be activated. This setting overrides that behavior.
-
-- `circonus_check_instance_id` `(string: "<hostname>:<application>")` - Serves
-  to uniquely identify the metrics coming from this _instance_. It can be used
-  to maintain metric continuity with transient or ephemeral instances as they
-  move around within an infrastructure. By default, this is set to
-  hostname:application name (e.g. "host123:nomad").
-
-- `circonus_check_search_tag` `(string: <service>:<application>)` - Specifies a
-  special tag which, when coupled with the instance id, helps to narrow down the
-  search results when neither a Submission URL or Check ID is provided. By
-  default, this is set to service:app (e.g. "service:nomad").
-
-- `circonus_check_display_name` `(string: "")` - Specifies a name to give a
-  check when it is created. This name is displayed in the Circonus UI Checks
-  list.
-
-- `circonus_check_tags` `(string: "")` - Comma separated list of additional
-  tags to add to a check when it is created.
-
-- `circonus_broker_id` `(string: "")` - Specifies the ID of a specific Circonus
-  Broker to use when creating a new check. The numeric portion of `broker._cid`
-  field in a Broker API object. If metric management is enabled and neither a
-  Submission URL nor Check ID is provided, an attempt will be made to search for
-  an existing check using Instance ID and Search Tag. If one is not found, a new
-  HTTPTRAP check will be created. By default, this is a random
-  Enterprise Broker is selected, or, the default Circonus Public Broker.
-
-- `circonus_broker_select_tag` `(string: "")` - Specifies a special tag which
-  will be used to select a Circonus Broker when a Broker ID is not provided. The
-  best use of this is to as a hint for which broker should be used based on
-  _where_ this particular instance is running (e.g. a specific geo location or
-  datacenter, dc:sfo).
-
-### `dogstatsd`
-
-These `telemetry` parameters apply to
-[DogStatsD](http://docs.datadoghq.com/guides/dogstatsd/).
-
-- `dogstatsd_addr` `(string: "")` - This provides the address of a DogStatsD
-  instance. DogStatsD is a protocol-compatible flavor of statsd, with the added
-  ability to decorate metrics with tags and event information. If provided,
-  Vault will send various telemetry information to that instance for
-  aggregation. This can be used to capture runtime information.
-
-* `dogstatsd_tags` `(string array: [])` - This provides a list of global tags
-  that will be added to all telemetry packets sent to DogStatsD. It is a list
-  of strings, where each string looks like "my_tag_name:my_tag_value".
-
-### `prometheus`
-
-These `telemetry` parameters apply to
-[prometheus](https://prometheus.io).
-
-- `prometheus_retention_time` `(string: "24h")` - Specifies the amount of time that
-  Prometheus metrics are retained in memory. Setting this to 0 will disable Prometheus telemetry.
-- `disable_hostname` `(bool: false)` - It is recommended to also enable the option
-  `disable_hostname` to avoid having prefixed metrics with hostname.
-
-The `/v1/sys/metrics` endpoint is only accessible on active nodes
-and automatically disabled on standby nodes. You can enable the `/v1/sys/metrics`
-endpoint on standby nodes by [enabling unauthenticated metrics access][telemetry-tcp].
-Standby nodes will never forward a request to `/v1/sys/metrics` to the active
-node. If unauthenticated metrics access is enabled, the standby node will
-respond with its own metrics. If unauthenticated metrics access is not enabled,
-then a standby node will attempt to service the request but fail and then
-redirect the request to the active node.
-
-Querying `/v1/sys/metrics` with one of the following headers:
-
- - `Accept: prometheus/telemetry`
- - `Accept: application/openmetrics-text`
-
-will return Prometheus formatted results. Most Prometheus servers automatically
-query scrape targets with these headers by default.
-
-A Vault token is required with `capabilities = ["read", "list"]` to
-/v1/sys/metrics. The Prometheus `bearer_token` or `bearer_token_file` options
-must be added to the scrape job.
-
-Vault does not use the default Prometheus path, so Prometheus must be configured
-to scrape `v1/sys/metrics` instead of the default scrape path.
-
-An example job_name stanza required in the [Prometheus config](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config) is provided below.
-
-```
-# prometheus.yml
-scrape_configs:
-  - job_name: 'vault'
-    metrics_path: "/v1/sys/metrics"
-    scheme: https
-    tls_config:
-      ca_file: your_ca_here.pem
-    bearer_token: "your_vault_token_here"
-    static_configs:
-    - targets: ['your_vault_server_here:8200']
-```
-
-An example telemetry configuration to be added to Vault's configuration file is shown below:
-
-```hcl
-telemetry {
-  prometheus_retention_time = "30s"
-  disable_hostname = true
-}
-```
-
-### `stackdriver`
-
-These `telemetry` parameters apply to [Stackdriver Monitoring](https://cloud.google.com/monitoring/).
-
-The Stackdriver telemetry provider uses the official Google Cloud Golang SDK. This means
-it supports the common ways of
-[providing credentials to Google Cloud](https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application).
-
-To use this telemetry provider, the service account must have the following
-minimum scope(s):
-
-```text
-https://www.googleapis.com/auth/cloud-platform
-https://www.googleapis.com/auth/monitoring
-https://www.googleapis.com/auth/monitoring.write
-```
-
-And the following IAM role(s):
-
-```text
-roles/monitoring.metricWriter
-```
-
-- `stackdriver_project_id` `(string: "")` - The Google Cloud ProjectID to send telemetry data to.
-- `stackdriver_location` `(string: "")` - The GCP or AWS region of the monitored resource.
-- `stackdriver_namespace` `(string: "")` - A namespace identifier for the telemetry data.
-- `stackdriver_debug_logs` `(bool: "false")` - Specifies if Vault writes additional stackdriver
-related debug logs to standard error output (stderr).
-
-It is recommended to also enable the option `disable_hostname` to avoid having prefixed
-metrics with hostname and enable instead `enable_hostname_label`.
-
-```hcl
-telemetry {
-  stackdriver_project_id = "my-test-project"
-  stackdriver_location = "us-east1-a"
-  stackdriver_namespace = "vault-cluster-a"
-  disable_hostname = true
-  enable_hostname_label = true
-}
-```
-
-Metrics from Vault can be found in [Metrics Explorer](https://cloud.google.com/monitoring/charts/metrics-explorer).
-All those metrics are shown with a resource type of `generic_task`, and the metric name
-is prefixed with `custom.googleapis.com/go-metrics/`.
-
-[telemetry-tcp]: /vault/docs/configuration/listener/tcp#telemetry-parameters
diff --git a/website/content/docs/configuration/ui.mdx b/website/content/docs/configuration/ui.mdx
deleted file mode 100644
index c2e6b859c8f..00000000000
--- a/website/content/docs/configuration/ui.mdx
+++ /dev/null
@@ -1,79 +0,0 @@
----
-layout: docs
-page_title: UI - Configuration
-description: |-
-  Vault features a user interface (web interface) for interacting with Vault.
-  Easily create, read, update, and delete secrets, authenticate, unseal, and
-  more with the Vault UI.
----
-
-# Vault UI
-
-Vault features a user interface (web interface) for interacting with Vault.
-Easily create, read, update, and delete secrets, authenticate, unseal, and
-more with the Vault UI.
-
--> The UI requires **Vault 0.10 or higher** or Vault Enterprise.
-
-## Activating the Vault UI
-
-The Vault UI is not activated by default. To activate the UI, set the `ui`
-configuration option in the Vault server configuration. Vault clients do not
-need to set this option, since they will not be serving the UI.
-
-```hcl
-ui = true
-
-listener "tcp" {
-  # ...
-}
-```
-
-For more information, please see the
-[Vault configuration options](/vault/docs/configuration).
-
-## Accessing the Vault UI
-
-The UI runs on the same port as the Vault listener. As such, you must configure
-at least one `listener` stanza in order to access the UI.
-
-```hcl
-listener "tcp" {
-  address = "10.0.1.35:8200"
-
-  # If bound to localhost, the Vault UI is only
-  # accessible from the local machine!
-  # address = "127.0.0.1:8200"
-}
-```
-
-In this case, the UI is accessible at the following URL from any machine on the
-subnet (provided no network firewalls are in place):
-
-```text
-https://10.0.1.35:8200/ui/
-```
-
-It is also accessible at any DNS entry that resolves to that IP address, such as
-the Consul service address (if using Consul):
-
-```text
-https://vault.service.consul:8200/ui/
-```
-
-### Note on TLS
-
-When using TLS (recommended), the certificate must be valid for all DNS entries
-you will be accessing the Vault UI on, and any IP addresses on the SAN. If you
-are running Vault with a self-signed certificate, any browsers that access the
-Vault UI will need to have the root CA installed. Failure to do so may result in
-the browser displaying a warning that the site is "untrusted". It is highly
-recommended that client browsers accessing the Vault UI install the proper CA
-root for validation to reduce the chance of a MITM attack.
-
-
-## Vault UI Web REPL
-
-The Vault UI includes an interactive Web REPL to interact with Vault's API much
-like the Vault CLI. For more on that, see the
-[Web REPL documentation](/vault/docs/commands/web).
diff --git a/website/content/docs/configuration/user-lockout.mdx b/website/content/docs/configuration/user-lockout.mdx
deleted file mode 100644
index f3c81c80522..00000000000
--- a/website/content/docs/configuration/user-lockout.mdx
+++ /dev/null
@@ -1,67 +0,0 @@
----
-layout: docs
-page_title: User Lockout - Configuration
-description: |-
-  The user_lockout stanza specifies various configurations for user lockout behaviour for
-  failed logins in vault. 
----
-# User lockout
-
-@include 'user-lockout.mdx'
-
-## `user_lockout` stanza
-
-The `user_lockout` stanza specifies various configurations for user lockout 
-behaviour for failed logins in vault. They can be configured for all supported auth methods
-(userpass, ldap and approle) using "all" user_lockout stanza name or for a specific auth method 
-using the auth method name in stanza. 
-
-Supported user_lockout stanza names are all, userpass, ldap and approle.
-
-The configurations for a specific auth method takes precedence over the configurations specified 
-for all auth methods using "all" user_lockout stanza name in the config file.
-
-## Configuration
-
-User lockouts configuration is done through the Vault configuration file using
-the `user_lockout` stanza:
-
-```hcl
-user_lockout [NAME] {
-  [PARAMETERS...]
-}
-```
-
-For example:
-
-```hcl
-user_lockout "all" {
-  lockout_duration = "10m"
-  lockout_counter_reset = "10m"
-}
-
-user_lockout "userpass" {
-  lockout_threshold = "25"
-  lockout_duration = "5m"
-}
-
-user_lockout "ldap" {
- disable_lockout = "true"
-}
-```
-
-Here, user lockout feature will be disabled for ldap auth methods. Userpass auth methods will have lockout threshold of 25, 
-lockout duration of 5 minutes, lockout counter reset of 10 minutes. Approle auth methods will have a lockout threshold of 
-5 (considers default as this value is not configured), lockout duration of 10 minutes and lockout counter reset of 10 minutes.
-
-The user lockout configuration for the auth method at a given path can be tuned using auth tune. Please see [auth tune command](/vault/docs/commands/auth/tune)
-or [auth tune api](/vault/api-docs/system/auth#tune-auth-method) for more details. 
-
-## `user_lockout` parameters
-
-The following options are available on all user_lockout configurations.
-
-- `lockout_threshold` `(string: "")` - Specifies the number of failed login attempts after which the user is locked out.
-- `lockout_duration` `(string: "")` - Specifies the duration for which an user will be locked out.
-- `lockout_counter_reset` `(string: "")` - Specifies the duration after which the lockout counter is reset with no failed login attempts.
-- `disable_lockout` `(bool: false)` - Disables the user lockout feature if set to true.
\ No newline at end of file
diff --git a/website/content/docs/deprecation/faq.mdx b/website/content/docs/deprecation/faq.mdx
deleted file mode 100644
index e96f91c57b2..00000000000
--- a/website/content/docs/deprecation/faq.mdx
+++ /dev/null
@@ -1,144 +0,0 @@
----
-layout: docs
-page_title: Feature Deprecation FAQ
-sidebar_title: FAQ
-description: |-
-  An FAQ page to communicate frequently asked questions concerning feature deprecations.
----
-
-# Feature deprecation FAQ
-
-This page provides frequently asked questions concerning decisions made about Vault feature deprecations. If you are looking for information about Vault licensing, refer to the [Licensing FAQ](/vault/docs/enterprise/license/faq) page. Pleaser refer to the [Feature Deprecation Notice and Plans](/vault/docs/deprecation) document for up-to-date information on Vault feature deprecations and notice.
-
-- [Q: What is the impact on anyone using the legacy MFA feature?](#q-what-is-the-impact-on-anyone-using-the-legacy-mfa-feature)
-- [Q: I'm currently using the Etcd storage backend feature. How does the deprecation impact me?](#q-i-m-currently-using-the-etcd-storage-backend-feature-how-does-the-deprecation-impact-me)
-- [Q: What should I do if I use Mount Filters, AppID, or any of the standalone DB engines?](#q-what-should-i-do-if-i-use-mount-filters-appid-or-any-of-the-standalone-db-engines)
-- [Q: What is the impact of removing support for X.509 certificates with signatures that use SHA-1?](#q-what-is-the-impact-of-removing-support-for-x-509-certificates-with-signatures-that-use-sha-1)
-- [Q: What are the phases of deprecation?](#q-what-are-the-phases-of-deprecation)
-
-### Q: what is the impact on anyone using the legacy MFA feature?
-
-If you are an Enterprise Vault user, there is no impact. There are no changes to the Enterprise MFA offering.
-
-If you use Vault Community Edition and use the legacy MFA, this will impact you since we plan to deprecate the legacy MFA feature. However, while we will continue to provide support for MFA in Vault Community Edition in the upcoming Vault 1.10 release, our target is to remove the legacy MFA feature from the product in the following Vault 1.11 release. Therefore, you should plan to migrate to the new MFA feature when Vault Community Edition supports it.
-
-### Q: i'm currently using the etcd storage backend feature. how does the deprecation impact me?
-
-The Etcd v2 has been deprecated with the release of Etcd v3.5 and will be decommissioned by Etcd v3.6. Etcd v2 API will be removed in Vault 1.10. The Etcd storage backend users should migrate Vault storage to an Etcd V3 cluster before upgrading to Vault 1.10. We recommend that you back up all storage migrations before upgrading.
-
-If you are an Enterprise user, we recommend that you consider migrating to HashiCorp supported storage backends: **Integrated Storage** or **Consul** (if your use case requires you to use this). Your HashiCorp sales or support representative can assist you with this decision.
-
-### Q: what should i do if i use mount filters, AppID, or any of the standalone DB engines?
-
-These features were deprecated in prior releases of Vault. We are targeting the removal of these features from the product in the Vault 1.12 release. Please plan to upgrade to these features before the release of Vault 1.12. Refer to the table below for a list of alternative features.
-
-| Deprecated Feature    | Alternative Feature                                                                                                 |
-| --------------------- | ------------------------------------------------------------------------------------------------------------------- |
-| Mount Filters         | [Path Filters](/vault/api-docs/system/replication/replication-performance#create-paths-filter) |
-| AppID                 | [AppRole auth method](/vault/docs/auth/approle)                                                                           |
-| Standalone DB engines | [Combined DB engines](/vault/docs/secrets/databases)                                                                      |
-
-**Note:** After upgrading to 1.12, any attempt to unseal a core with one of the following features enabled will result in a core shutdown. This may temporarily be overridden using the `VAULT_ALLOW_PENDING_REMOVAL_MOUNTS` environment variable when launching the Vault server. These features will be officially removed from Vault in version 1.13 and this environment variable will not work. In order to upgrade to 1.13, you will have to completely disable all removed features.
-
-### Q: what is the impact of removing support for x.509 certificates with signatures that use SHA-1?
-
-Starting with Vault 1.12.0, Vault will be built with Go 1.18 or later.
-The standard library in Go 1.18 and later [rejects X.509 signatures](https://go.dev/doc/go1.18#sha1) that use a SHA-1 hash.
-
-If this issue impacts your usage of Vault, you can temporarily work around it by deploying Vault with the environment variable `GODEBUG=x509sha1=1` set.
-This workaround will fail in a future version of Go, however, the Go team has not said when they will remove this workaround.
-
-If you want to check whether a certificate or CA contains a problematic signature, you can use the OpenSSL CLI:
-
-```shell-session
-$ openssl x509 -text -noout -in somecert.pem | grep sha1
-
-    Signature Algorithm: sha1WithRSAEncryption
-    Signature Algorithm: sha1WithRSAEncryption
-```
-
-Any signature algorithms that contain `sha1` will be potentially problematic.
-
-Here are the use cases that may still use certificates with SHA-1:
-
-#### Auth methods
-
-- [AWS Auth Method](/vault/docs/auth/aws): [AWS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html) can use SHA-1-based PKCS7 signatures for DSA key pairs.
-- [Cloud Foundry (CF) Auth Method ](/vault/docs/auth/cf)
-- [Kerberos Auth Method](/vault/docs/auth/kerberos)
-- [Kubernetes Auth Method](/vault/docs/auth/kubernetes)
-- [LDAP Auth Method](/vault/docs/auth/ldap)
-- [JWT/OIDC Auth Method](/vault/docs/auth/jwt/)
-- [TLS Certificates Auth Method](/vault/docs/auth/cert)
-
-#### Database secrets engines
-
-- [Cassandra Database Secrets Engine](/vault/docs/secrets/databases/cassandra)
-- [Couchbase Database Secrets Engine](/vault/docs/secrets/databases/couchbase)
-- [Elasticsearch Database Secrets Engine](/vault/docs/secrets/databases/elasticdb)
-- [InfluxDB Database Secrets Engine](/vault/docs/secrets/databases/influxdb)
-- [MongoDB Database Secrets Engine](/vault/docs/secrets/databases/mongodb)
-- [MySQL/MariaDB Database Secrets Engine](/vault/docs/secrets/databases/mysql-maria)
-
-#### Secrets engines
-
-- [Active Directory Secrets Engine](/vault/docs/secrets/ad)
-- [Consul Secrets Engine](/vault/docs/secrets/consul)
-- [Kubernetes Secrets Engine](/vault/docs/secrets/kubernetes)
-- [Nomad Secrets Engine](/vault/docs/secrets/nomad)
-- [LDAP Secrets Engine](/vault/docs/secrets/ldap)
-- [PKI Secrets Engine](/vault/docs/secrets/pki/)
-
-### Q: what are the phases of deprecation?
-
-As of version 1.12, Vault implements a multi-phased approach to deprecation. The intent of this approach is to provide sufficient warning that a feature will be removed and safe handling of stored data when the associated feature has been removed.
-
-The phases of deprecation are also known as "Deprecation Status". These statuses are currently reflected in builtin plugins and are exposed via the Vault `auth`, `secrets`, and `plugins` CLI/API endpoints. For more information, refer to the corresponding documentation.
-
-The four phases of deprecation are: `Supported`, `Deprecated`, `Pending Removal`, and `Removed`.
-
-**Note:** Deprecation Status currently only applies to builtin `auth` and `secrets` plugins. All external plugins will report a status of `n/a`. This is expected behavior.
-
-#### Supported
-
-This is the default status and reflects a feature which is still supported. There is no unique behavior or functionality associated with this status.
-
-#### Deprecated
-
-This status reflects a feature which has been marked for deprecation in a later release of Vault. This is the first phase of the deprecation process. A status of `Deprecated` has two effects:
-
-1. After an upgrade, any existing `Deprecated` feature (builtin auth/secrets plugins enabled via CLI or API prior to upgrade) will log `Warn`-level messages on unseal.
-
-2. All new usage of `Deprecated` features will log `Warn`-level messages.
-
-3. All `POST/GET/LIST` endpoints associated with this feature will return `warnings` in response data.
-
-#### Pending removal
-
-This status reflects a feature which has been officially deprecated in this release of Vault. This is the first phase in the process that fundamentally alters the behavior of Vault. The effects are two-fold:
-
-1. After an upgrade, any existing `Pending Removal` feature (builtin auth/secrets plugins enabled via CLI or API prior to upgrade) will log `Error`-level messages to the Vault log and cause an immediate shutdown of the Vault core.
-
-2. Any new `Pending Removal` will fail and log `Error`-level messages to the Vault log and CLI/API.
-
-##### VAULT_ALLOW_PENDING_REMOVAL_MOUNTS
-
-The `Pending Removal` behavior may be overriden using a new environment variable: [`VAULT_ALLOW_PENDING_REMOVAL_MOUNTS`](/vault/docs/commands/server#vault_allow_pending_removal_mounts). This environment variable effectively allows all `Pending Removal` features to be treated as `Deprecated`.
-
-#### Removed
-
-This status reflects a feature which has been officially removed from Vault. `Removed` is the last phase of the deprecation process. During this phase, code for this feature no longer exists within Vault.
-
-1. After an upgrade, any existing `Removed` feature will log `Error`-level messages to the Vault log and cause an immediate shutdown of the Vault core.
-
-2. Any new `Removed` features will fail and log `Error`-level messages to the Vault log and CLI/API.
-
-#### Migration path
-
-In order to successfully upgrade, use of the `Removed` feature must be discontinued. To accomplish this:
-
-1. Downgrade Vault to a previous version.
-
-2. Replace any `Removed` or `Pending Removal` feature with the [preferred alternative feature](#q-what-should-i-do-if-i-use-mount-filters-appid-or-any-of-the-standalone-db-engines).
-
-3. Upgrade to latest desired version.
diff --git a/website/content/docs/deprecation/index.mdx b/website/content/docs/deprecation/index.mdx
deleted file mode 100644
index 9ad32ae3c6e..00000000000
--- a/website/content/docs/deprecation/index.mdx
+++ /dev/null
@@ -1,43 +0,0 @@
----
-layout: docs
-page_title: Feature Deprecation Notice
-sidebar_title: Feature Deprecation Notice and Plans
-description: |-
-  An announcement page to communicate feature deprecations and plans.
----
-
-# Feature deprecation notice and plans
-
-This announcement page is maintained and updated periodically to communicate important decisions made concerning End of Support (EoS) for Vault features as well as features we have removed or disabled from the product. We document the removal of features, enable the community with a plan and timeline for eventual deprecations, and supply alternative paths to explore and evaluate to minimize business disruptions. If you have questions or concerns about a deprecated feature, please create a topic on [the community forum](https://discuss.hashicorp.com/c/vault/30) or raise a ticket with your support team. Please refer to the [FAQ](/vault/docs/deprecation/faq) page for frequently asked questions concerning Vault feature deprecations.
-
-**Deprecation Announcement**: This indicates the release version during which the announcement was made to deprecate a feature.
-
-**End of Support**: This indicates when a deprecated feature becomes unsupported. Consult the table below and consider the timeline provided to upgrade. If you use Vault Enterprise and require help with a deprecated feature, the Vault Support Team will provide limited support. However, we will not provide software patches or bug fixes. Refer to the [HashiCorp Support Policy](https://support.hashicorp.com/hc/en-us/articles/360021185113-Support-Period-and-End-of-Life-EOL-Policy) to understand our product support timeline.
-
-**Feature Removal**: This indicates that the feature is completely removed/disabled from the product.
-
-~> **Note**: All specified targeted version announcements for End of Support and Feature Removal may be subject to change.
-
-| Feature                                           | Deprecation announcement | End of Support | Feature Removal | Migration Path/Impact                                                                                                                                                                                                                                                                                                                              | Resources                                                                                                                                                                                                                                                        |
-| ------------------------------------------------- | ------------------------ | -------------- | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Active Directory Secrets Engine                  | 1.13                  | v1.18               | v1.19                 | Use the [LDAP Secrets Engine](/vault/docs/secrets/ldap) with the `ad` [schema](/vault/api-docs/secret/ldap#schema) | [Migration Guide](/vault/docs/secrets/ad/migration-guide) |
-| Vault Enterprise storage backend                  | N/A                  | v1.12               | N/A                 | Use [Integrated Storage](/vault/docs/configuration/storage/raft) or [Consul](/vault/docs/configuration/storage/consul) as your Vault's storage backend. Vault Enterprise will no longer start up if configured to use a storage backend other than Integrated Storage or Consul.  | [Upgrade Guide](/vault/docs/upgrading/upgrade-to-1.12.x)    |
-| Vault generation of Dynamic SSH Keys                 | v0.7.1                     | N/A            | v1.13           | Use the alternative [signed SSH certificates](/vault/docs/secrets/ssh/signed-ssh-certificates) feature which supports key pair generation as of Vault 1.12. SSH certificates do not require an external connection from Vault to provision the key/certificate and more secure than having Vault provision dynamic SSH keys.                  | [SSH Certificates](/vault/docs/secrets/ssh/signed-ssh-certificates)                                                                                                                                                                                               |
-| [Duplicative Docker Images](https://hub.docker.com/_/vault)                 | v1.12                     | 1.13            | v1.14           | Upon feature removal, the `vault` Docker image will no longer be updated. Only the [Verified Publisher](https://hub.docker.com/r/hashicorp/vault) `hashicorp/vault` image will be updated on DockerHub. Users of [Official Images](https://hub.docker.com/_/vault) will need to use `docker pull hashicorp/vault:<version>` instead of `docker pull vault:version` to get newer versions of Vault in Docker images. Currently, HashiCorp publishes and updates identical Docker images of Vault as Verified Publisher and Official images separately. | [The Verified Publisher Program](https://docs.docker.com/docker-hub/publish/) |
-| Etcd V2 API (Community)                 | v1.9                     | N/A            | v1.10           | The Etcd v2 has been deprecated with the release of Etcd v3.5, and will be decomissioned by Etcd v3.6. Etcd v2 API has been removed in Vaut 1.10. Users of Etcd storage backend must migrate Vault storage to an Etcd V3 cluster prior to upgrading to Vault 1.10. All storage migrations should be backed up prior to migration.                  | [Etcd Storage Backend](/vault/docs/configuration/storage/etcd)                                                                                                                                                                                                         |
-| Licenses in storage (ENT)         | v1.8                     | v1.10          | v1.11           | Migrate to [Autoloading](/vault/docs/enterprise/license/autoloading) by v1.11.                                                                                                                                                                                                                                                                           | [Vault License](/vault/docs/enterprise/license) [System Backend](/vault/api-docs/system/license) [FAQ](/vault/docs/enterprise/license/faq)                                                                                                              |
-| Mount Filters (ENT)              | v1.3                     | v1.10          | v1.11           | Use the alternative feature: [Path Filters](/vault/api-docs/system/replication/replication-performance#create-paths-filter).                                                                                                                                                                                                   | [API Deprecation Notice](/vault/api-docs/system/replication/replication-performance#create-mounts-filter-deprecated) [Filter Mount Replication Deprecation Notice](/vault/docs/upgrading/upgrade-to-1.3.0#filtered-mount-replication-deprecation) |
-| Legacy MFA (Community)                 | v1.0                     | N/A            | v1.11           | Based on your use case, use the Policy-based Enterprise MFA or Login MFA supported in Vault Community Edition as of v1.10.                                                                                                                                                                                                                                        | [Multi-Factor Authentication](/vault/docs/v1.10.x/auth/mfa)                                                                                                                                                                                                                    |
-| *****Standalone DB Engines (Community)      | v0.8                     | N/A            | v1.13           | Use the alternative DB secrets engine feature.                                                                                                                                                                                                                                                                                                      | [DB secrets engine](/vault/docs/secrets/databases)                                                                                                                                                                                                                     |
-| *****AppID (Community)                      | v0.6                     | N/A            | v1.13           | Use the alternative feature: [AppRole auth method](/vault/docs/auth/approle).                                                                                                                                                                                                                                                  | [AppID Auth Method Deprecation Notice](/vault/docs/auth/app-id)                                                                                                                                                                                                        |
-| AAD Graph on Azure Secrets Engine | v1.10                    | 1.11           | v1.12           | Microsoft will end its support of the [AAD Graph API on June 30, 2022](https://docs.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview). Support for Microsoft Graph API was introduced in Vault 1.9. If your Vault deployment is on a prior release, you may use the Azure Secrets Engine as an external plugin while you plan to upgrade. | [AAD (Azure Active Directory](https://vault-git-post-1-10-doc-changes-hashicorp.vercel.app/docs/secrets/azure#aad-azure-active-directory)                                                                                                                        |
-| Optional `api_token` parameter in Okta Auth Method  | v1.4                    | 1.11           | v1.12           | The `api_token` parameter on the Okta Auth Method will change from being optional to being required. | [API Documentation](/vault/api-docs/auth/okta#api_token) |
-| SHA-1 certificate signing | v1.11             | v1.11          | v1.12           | Go version 1.18 removes support for SHA-1 by default. As Vault updates its Go version to 1.18, you should plan to move off SHA-1 for certficate signing. Operators can set a Go [environmental variable](/vault/docs/deprecation/faq#q-what-is-the-impact-of-removing-support-for-x-509-certificates-with-signatures-that-use-sha-1) to restore SHA-1 support if they need to continue using SHA-1. It is unknown at this time when Go will remove the environmental variable support. Therefore, we highly encourage you to migrate off of SHA-1 for certificate signing. |[FAQ](/vault/docs/deprecation/faq#q-what-is-the-impact-of-removing-support-for-x-509-certificates-with-signatures-that-use-sha-1)|
-| Consul secrets engine parameter changes  | v1.11     | N/A     | N/A     | The `policies` parameter on the Consul secrets engine has been changed in favor of `consul_policies`. The `token_type` and `policy` parameters have been deprecated as the latest versions of Consul no longer support the older ACL system they were used for. | [Consul secrets engine API documentation](/vault/api-docs/secret/consul) |
-| Vault Agent API proxy support | v1.14 | v1.16 | v1.17 | Migrate to [Vault Proxy](/vault/docs/proxy/index) by v1.17|
-| Centrify Auth Method | v1.15 | v1.17 | v1.17 | Use as an external plugin, but support will not be available. | |
-| AWS secrets engine field change  | v1.16     | N/A     | N/A     | The `security_token` field returned for AssumeRole and FederationToken credentials is deprecated in favor of the current term `session_token`. | [AWS secrets engine API documentation](/vault/api-docs/secret/aws) |
-
-*If you use **Standalone DB Engines** or **AppID (Community)**, you should actively plan to migrate away from their usage. If you use these features and upgrade to Release 1.12, Vault will log error messages and shut down, and any attempts to add new mounts will result in an error.
-This behavior may temporarily be overridden when starting the Vault server by using the `VAULT_ALLOW_PENDING_REMOVAL_MOUNTS` environment variable until they are officially removed in Vault version 1.13.
-If you are still using these deprecated features and attempt to upgrade to 1.13 (the target feature removal timeframe), you will not be able to start up Vault without downgrading and migrating away from these features.
diff --git a/website/content/docs/enterprise/automated-integrated-storage-snapshots.mdx b/website/content/docs/enterprise/automated-integrated-storage-snapshots.mdx
deleted file mode 100644
index 20939ff4a72..00000000000
--- a/website/content/docs/enterprise/automated-integrated-storage-snapshots.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise Automated Integrated Storage Snapshots
-description: |-
-  Vault Enterprise can be configured to take automated snapshots
-  when using raft Integrated Storage and store them locally or
-  in the cloud.
----
-
-# Automated integrated storage snapshots
-
-@include 'alerts/enterprise-only.mdx'
-
-Any production system should include a provision for taking regular backups.
-Vault Enterprise can be configured to take and store snapshots at a specific
-interval.
-
-# Configuration
-
-There can be multiple named snapshot configurations, each with their own schedule
-and storage type. Storage type can either be `local` (meaning the snapshots will
-be stored in the same filesystem that the Vault servers see) or a cloud object
-storage service such as AWS S3.
-
-Local is not usually a good production option. Only the active node will be
-taking snapshots, but you can't predict which node is going to be active at
-any point in time, so unless you're using a distributed filesystem you'll
-be stuck checking each node's filesystem to find the snapshot you want. Moreover
-backups ought to be stored somewhere with redundancy, and ideally not on the
-same system they're meant to protect.
-
-Cloud storage types can usually be managed in two ways. The mode supported by
-all is providing explicit credentials during configuration. In addition, AWS
-and GCP can be used without specifying credentials, by ensuring that the VMs on
-which Vault is running have been granted permission to access the specified
-object store.
-
-<Note>
-
-Currently, Vault does not allow the use of AWS IAM Roles for EKS Service
-Accounts to authenticate to Amazon S3 buckets for the Automated Integrated
-Storage Snapshots.
-
-</Note>
-
-# vs snapshot agents
-
-Nomad and Consul Enterprise offer the same functionality in a slightly different way.
-They provide a `snapshot agent`, which is a standalone program that runs
-"outside" the cluster but otherwise behaves much the same as Vault's built-in
-automated snapshot mechanism.
-
-There are various trade-offs to this approach. The main reason Vault doesn't
-do things this way is that the snapshot agents need something to manage HA.
-One doesn't want a single point of failure for something as important
-as backups, which means running multiple snapshot agents, but that requires some
-way to coordinate among them to ensure that only one is actually taking snapshots
-at any given time. Consul already has an API for distributed locks, which is
-one way of doing this. Another option is to use an orchestrator like Kubernetes
-or Nomad to run the snapshot agent as a batch job. It seemed best not to assume
-that all Vault Enterprise users would be running Consul or an orchestrator.
-
-# See also
-
-Refer to the [API docs](/vault/api-docs/system/storage/raftautosnapshots) for the specifics
-of how to configure automated snapshots and query their status.
diff --git a/website/content/docs/enterprise/automated-upgrades.mdx b/website/content/docs/enterprise/automated-upgrades.mdx
deleted file mode 100644
index a9a6cc6e8b3..00000000000
--- a/website/content/docs/enterprise/automated-upgrades.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise Automated Upgrades
-description: |-
-  Vault Enterprise can upgrade itself automatically.
----
-
-# Automated upgrades
-
-@include 'alerts/enterprise-only.mdx'
-
-Operators running Vault Enterprise with integrated storage can use automated
-upgrades to upgrade the Vault version currently running in a cluster automatically.
- There are a few different ways to make this upgrade happen,
-and control which versions are being upgraded to. With no additional configuration,
-Vault will check the version of Vault that each node in the cluster is running. If a blue/green
-style deployment is desired, Vault uses the version of your choosing, regardless of
-which version of Vault is currently running.
-
-## Configuration
-A new key can be added to Vault's `storage` configuration stanza: `autopilot_upgrade_version`.
-The value for this key is a [SemVer](https://semver.org/) compatible version string of your choosing.
-When a version string is present, it will override the current version of Vault that is running to upgrade automatically.
-
-## Mechanics
-Whether you choose to use Vault's built-in version or a version of your own, the mechanics for performing
-automatic upgrades remain the same.
-
-When a Vault cluster is running and new nodes containing an updated Vault version join the cluster, the
-Autopilot subsystem within Vault will promote the new version nodes to voters when the number of nodes
-running the latest Vault version equals or exceeds the number of pre-existing nodes. Vault then demotes
-the previous version's nodes to non-voters. Finally, leadership transfers from the prior leader to a
-randomly selected node running the newest Vault version and waits for the user to remove the previous
-nodes from the cluster.
-
-Below is a flowchart depicting Autopilot's automated upgrade state machine.
-
-![Automated Upgrade State Machine](/img/autopilot-automated-upgrade.png)
-
-The status of the automated upgrade can be monitored by consulting the [Autopilot state API endpoint](/vault/api-docs/system/storage/raftautopilot#get-cluster-state).
-
-## Examples
-### Using vault's built-in version
-This is the easiest method to perform an automated upgrade; no configuration is needed, and automated upgrades
-are enabled by default.
-
-### Using a blue/green style deploy
-Specify something like: `1.11.0-release.1` for the `autopilot_upgrade_version` configuration key in your
-existing cluster. When you're ready to deploy a new set of nodes, specify `1.11.0-release.2` for the new
-nodes. Any time you need to deploy an updated set of nodes to the cluster, increment the final number.
-
-It's important to note that Autopilot uses strict [semantic versioning](https://semver.org) when parsing
-upgrade versions. This means that in the above example, `-release.1` is considered the _pre-release version_
-in semantic versioning terminology. The pre-release version is denoted by a hyphen `-` after the patch version.
-This is semantically different from the _build metadata_, which is denoted by a plus sign `+` after either the
-patch version or the pre-release version. Build metadata is ignored when parsing versions, while the pre-release
-version is not. A table with some examples will help illustrate this.
-
-| Current upgrade version | New node upgrade version | Equal? | Will the upgrade happen? | Why?                                                                               |
-|:------------------------|:-------------------------|:-------|:-------------------------|:-----------------------------------------------------------------------------------|
-| 1.11.0                  | 1.11.0                   | Yes    | No                       | Versions are equal                                                                 |
-| 1.11.0-release.1        | 1.11.0-release.2         | No     | Yes                      | New node version is greater than current version                                   |
-| 1.11.0-release.1        | 1.11.1                   | No     | Yes                      | New node version is greater than current version                                   |
-| 1.11.0                  | 1.11.0-release.1         | No     | No                       | New node version is less than current version                                      |
-| 1.11.0+release.1        | 1.11.0+release.2         | Yes    | No                       | `release.1` and `release.2` are build metadata and ignored when comparing versions |
-| 1.11.0-release.1+123    | 1.11.0-release.1+456     | Yes    | No                       | Versions are equal, build metadata is ignored. |
diff --git a/website/content/docs/enterprise/consistency.mdx b/website/content/docs/enterprise/consistency.mdx
deleted file mode 100644
index 40e92cb5058..00000000000
--- a/website/content/docs/enterprise/consistency.mdx
+++ /dev/null
@@ -1,230 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise Eventual Consistency
-description: Vault Enterprise Consistency Model
----
-
-# Vault eventual consistency
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-When running in a cluster, Vault has an eventual consistency model.
-Only one node (the leader) can write to Vault's storage.
-Users generally expect read-after-write consistency: in other
-words, after writing foo=1, a subsequent read of foo should return 1. Depending
-on the Vault configuration this isn't always the case. When using performance
-standbys with Integrated Storage, or when using performance replication,
-there are some sequences of operations that don't always yield read-after-write
-consistency.
-
-## Performance standby nodes
-
-When using the Integrated Storage backend without performance standbys, only
-a single Vault node (the active node) handles requests. Requests sent to
-regular standbys are handled by forwarding them to the active node. This Vault configuration
-gives Vault the same behavior as the default Consul consistency model.
-
-When using the Integrated Storage backend with performance standbys, both the
-active node and performance standbys can handle requests. If a performance standby
-handles a login request, or a request that generates a dynamic secret, the
-performance standby will issue a remote procedure call (RPC) to the active node to store the token
-and/or lease. If the performance standby handles any other request that
-results in a storage write, it will forward that request to the active node
-in the same way a regular standby forwards all requests.
-
-With Integrated Storage, all writes occur on the active node, which then issues
-RPCs to update the local storage on every other node. Between when the active
-node writes the data to its local disk, and when those RPCs are handled on the
-other nodes to write the data to their local disks, those nodes present a stale
-view of the data.
-
-As a result, even if you're always talking to the same performance standby,
-you may not get read-after-write semantics. The write gets sent to the active
-node, and if the subsequent read request occurs before the new data gets sent
-to the node handling the read request, the read request won't be able to take
-the write into account because the new data isn't present on that node yet.
-
-## Performance replication
-
-A similar phenomenon occurs when using performance replication. One example
-of how this manifests is when using shared mounts. If a KV secrets engine
-is mounted on the primary with `local=false`, it will exist on the secondary
-cluster as well. The secondary cluster can handle requests to that mount,
-though as with performance standbys, write requests must be forwarded - in
-this case to the primary active node. Once data is written to the primary cluster,
-it won't be visible on the secondary cluster until the data has been replicated
-from the primary. Therefore, on the secondary cluster, it initially appears as if
-the data write hasn't happened.
-
-If the secondary cluster is using Integrated Storage, and the read request is
-being handled on one of its performance standbys, the problem is exacerbated because it
-has to be sent first from the primary active node to the secondary active node,
-and then from there to the secondary performance standby, each of which can
-introduce their own form of lag.
-
-Even without shared secret engines, stale reads can still happen with performance
-replication. The Identity subsystem aims to provide a view on entities and
-groups which span across clusters. As such, when logging in to a secondary cluster
-using a shared mount, Vault tries to generate an entity and alias if they don't
-already exist, and these must be stored on the primary using an RPC. Something
-similar happens with groups.
-
-## Mitigations
-
-There has long been a partial mitigation for the above problems. When writing
-data via RPC, e.g. when a performance standby registers tokens and leases on the
-active node after a login or generating a dynamic secret, part of the response
-includes a number known as the "WAL index", aka Write-Ahead Log index.
-
-A full explanation of this is outside the scope of this document, but the short
-version is that both performance replication and performance standbys use log
-shipping to stay in sync with the upstream source of writes. The mitigation
-historically used by nodes doing writes via RPC is to look at the WAL index in
-the response and wait up to 2 seconds to see if that WAL index appear in the
-logs being shipped from upstream. Once the WAL index is seen, the Vault node
-handling the request that resulted in RPCs can return its own response to the
-client: it knows that any subsequent reads will be able to see the value that
-was just written. If the WAL index isn't seen within those 2 seconds, the Vault
-node completes the request anyway, returning a warning in the response.
-
-This mitigation option still exists in Vault 1.7, though now there is a
-configuration option to adjust the wait time:
-[best_effort_wal_wait_duration](/vault/docs/configuration/replication).
-
-## Vault 1.7 mitigations
-
-There are now a variety of other mitigations available:
-
-- per-request option to always forward the request to the active node
-- per-request option to conditionally forward the request to the active node
-  if it would otherwise result in a stale read
-- per-request option to fail requests if they might result in a stale read
-- Vault Proxy configuration to do the above for proxied requests
-
-The remainder of this document describes the tradeoffs of these mitigations and
-how to use them.
-
-Note that any headers requesting forwarding are disabled by default, and must
-be enabled using [allow_forwarding_via_header](/vault/docs/configuration/replication).
-
-### Unconditional forwarding (Performance standbys only)
-
-The simplest solution to never experience stale reads from a performance standby
-is to provide the following HTTP header in the request:
-
-```
-X-Vault-Forward: active-node
-```
-
-The drawback here is that if all your requests are forwarded to the active node,
-you might as well not be using performance standbys. So this mitigation only
-makes sense to use selectively.
-
-This mitigation will not help with stale reads relating to performance replication.
-
-### Conditional forwarding (Performance standbys only)
-
-As of Vault Enterprise 1.7, all requests that modify storage now return a new
-HTTP response header:
-
-```
-X-Vault-Index: <base64 value>
-```
-
-To ensure that the state resulting from that write request is visible to a
-subsequent request, add these headers to that second request:
-
-```
-X-Vault-Index: <base64 value taken from previous response>
-X-Vault-Inconsistent: forward-active-node
-```
-
-The effect will be that the node handling the request will look at the state
-it has locally, and if it doesn't contain the state described by the X-Vault-Index
-header, the node will forward the request to the active node.
-
-The drawback here is that when requests are forwarded to the active node,
-performance standbys provide less value. If this happens often enough
-the active node can become a bottleneck, limiting the horizontal read scalability
-performance standbys are intended to provide.
-
-### Retry stale requests
-
-As of Vault Enterprise 1.7, all requests that modify storage now return a new
-HTTP response header:
-
-```
-X-Vault-Index: <base64 value>
-```
-
-To ensure that the state resulting from that write request is visible to a
-subsequent request, add this headers to that second request:
-
-```
-X-Vault-Index: <base64 value taken from previous response>
-```
-
-When the desired state isn't present, Vault will return a failure response with
-HTTP status code 412. This tells the client that it should retry the request.
-The advantage over the Conditional Forwarding solution above is twofold:
-first, there's no additional load on the active node. Second, this solution
-is applicable to performance replication as well as performance standbys.
-
-The Vault Go API will now automatically retry 412s, and provides convenience
-methods for propagating the X-Vault-Index response header into the request
-header of subsequent requests. Those not using the Vault Go API will want
-to build equivalent functionality into their client library.
-
-### Vault proxy and consistency headers
-
-When configured, the [Vault API Proxy](/vault/docs/agent-and-proxy/proxy/apiproxy) will proxy incoming requests to Vault. There is
-Proxy configuration available in the `api_proxy` stanza that allows making use
-of some of the above mitigations without modifying clients.
-
-By setting `enforce_consistency="always"`, Proxy will always provide
-the `X-Vault-Index` consistency header. The value it uses for the header
-will be based on the responses that have passed through the Proxy previously.
-
-The option `when_inconsistent` controls how stale reads are prevented:
-
-- `"fail"` means that when a `412` response is seen, it is returned to the client
-- `"retry"` means that `412` responses will be retried automatically by Proxy,
-  so the client doesn't have to deal with them
-- `"forward"` makes Proxy provide the
-  `X-Vault-Inconsistent: forward-active-node` header as described above under
-  Conditional Forwarding
-
-## Vault 1.10 mitigations
-
-In Vault 1.10, the token format has changed, where service tokens now employ server side consistency.
-This means that by default, requests made
-to nodes which cannot support read-after-write consistency due to
-not having the necessary WAL index to check Vault tokens locally will output
-a 412 status code. The Vault Go API automatically retries when receiving 412s, so
-unless there is a considerable replication delay, users will experience
-read-after-write consistency.
-
-The replication option [allow_forwarding_via_token](/vault/docs/configuration/replication)
-can be used to enforce requests that would have returned 412s in the
-aforementioned way will be forwarded instead to the active node.
-
-Refer to the [Server Side Consistent Token FAQ](/vault/docs/faq/ssct) for details.
-
-## Client API helpers
-
-There are some new helpers in the `api` package to work with the new headers.
-`WithRequestCallbacks` and `WithResponseCallbacks` create a shallow clone of
-the client and populate it with the given callbacks. `RecordState` and
-`RequireState` are used to store the response header from one request and
-provide it in a subsequent request. For example:
-
-```go
-client := api.NewClient(api.DefaultConfig)
-var state string
-_, err := client.WithResponseCallbacks(api.RecordState(&state)).Write(path, data)
-secret, err := client.WithRequestCallbacks(api.RequireState(state)).Read(path)
-```
-
-This will retry the `Read` until the data stored by the `Write` is present.
-There are also callbacks to use forwarding: `ForwardInconsistent` and
-`ForwardAlways`.
diff --git a/website/content/docs/enterprise/control-groups.mdx b/website/content/docs/enterprise/control-groups.mdx
deleted file mode 100644
index 3f91e1acc72..00000000000
--- a/website/content/docs/enterprise/control-groups.mdx
+++ /dev/null
@@ -1,215 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise Control Groups
-description: Vault Enterprise has support for Control Group Authorization.
----
-
-# Vault Enterprise control groups
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-Vault Enterprise has support for Control Group Authorization. Control Groups
-add additional authorization factors to be required before satisfying a request.
-
-When a Control Group is required for a request, a limited duration response
-wrapping token is returned to the user instead of the requested data. The
-accessor of the response wrapping token can be passed to the authorizers
-required by the control group policy. Once all authorizations are satisfied,
-the wrapping token can be used to unwrap and process the original request.
-
-## Control group factors
-
-Control Groups can verify the following factors:
-
-- `Identity Groups` - Require an authorizer to be in a specific set of identity
-  groups.
-
-### Controlled capabilities
-
-Control group factors can be configured to trigger the control group workflow
-on specific capabilities. This is done with the `controlled_capabilities` field.
-Not specifying the `controlled_capabilities` field will necessitate the factor to be
-checked for all operations to the specified policy path. The `controlled_capabilities`
-field can differ per factor, so that different factors can be required for different
-operations.
-
-Finally, the capabilities in the `controlled_capabilities` stanza must be a subset of the
-`capabilities` specified in the policy itself. For example, a policy giving only `read` access to
-the path `secret/foo` cannot specify a control group factor with `list` as a controlled capability.
-
-Please see the following section for example ACL Policies.
-
-## Control groups in ACL policies
-
-Control Group requirements on paths are specified as `control_group` along
-with other ACL parameters.
-
-### Sample ACL policies
-
-```
-path "secret/foo" {
-    capabilities = ["read"]
-    control_group = {
-        factor "ops_manager" {
-            identity {
-                group_names = ["managers"]
-                approvals = 1
-            }
-        }
-    }
-}
-```
-
-The above policy grants `read` access to `secret/foo` only after one member of
-the "managers" group authorizes the request.
-
-```
-path "secret/foo" {
-    capabilities = ["create", "update"]
-    control_group = {
-        ttl = "4h"
-        factor "tech leads" {
-            identity {
-                group_names = ["managers", "leads"]
-                approvals = 2
-            }
-        }
-        factor "super users" {
-            identity {
-                group_names = ["superusers"]
-                approvals = 1
-            }
-        }
-    }
-}
-```
-
-The above policy grants `create` and `update` access to `secret/foo` only after
-two member of the "managers" or "leads" group and one member of the "superusers"
-group authorizes the request. If an authorizer is a member of both the
-"managers" and "superusers" group, one authorization for both factors will be
-satisfied.
-
-```
-path "secret/foo" {
-    capabilities = ["write","read"]
-    control_group = {
-        factor "admin" {
-            controlled_capabilities = ["write"]
-            identity {
-                group_names = ["admin"]
-                approvals = 1
-            }
-        }
-    }
-}
-```
-
-The above policy grants `read` access to `secret/foo` for anyone that has a vault token
-with this policy. It grants `write` access to `secret/foo` only after one member from the
-admin group authorizes the request.
-
-```
-path "kv/*" {
-    capabilities = ["create", "update","delete","list","sudo"]
-    control_group = {
-        factor "admin" {
-            controlled_capabilities = ["delete","list","sudo"]
-            identity {
-                group_names = ["admin"]
-                approvals = 1
-            }
-        }
-    }
-}
-path "kv/*" {
-    capabilities = ["create"]
-    control_group = {
-        factor "superuser" {
-            identity {
-                group_names = ["superuser"]
-                approvals = 2
-            }
-        }
-    }
-}
-
-```
-
-Because the second path stanza has a control group factor with no `controlled_capabilities` field,
-any token with this policy will be required to get 2 approvals from the `superuser` group before executing
-any operation against `kv/*`. In addition, by virtue of the `controlled_capabilities` field in the first
-path stanza, `delete`,`list`, and `sudo` operations will require an additional approval from the `admin` group.
-
-```
-path "kv/*" {
-    capabilities = ["read", "list", "create"]
-    control_group = {
-        controlled_capabilities = ["read"]
-        factor "admin" {
-            identity {
-                group_names = ["admin"]
-                approvals = 1
-            }
-        }
-        factor "superuser" {
-            controlled_capabilities = ["create"]
-            identity {
-                group_names = ["superuser"]
-                approvals = 1
-            }
-        }
-    }
-}
-```
-
-In this case, `read` will require one admin approval and `create` will require
-one superuser approval and one admin approval. `List` will require no extra approvals
-from any of the control group factors, and a token with this policy will not be required
-to go through the control group workflow in order to execute a read operation against `kv/*`.
-
-## Control groups in sentinel
-
-Control Groups are also supported in Sentinel policies using the `controlgroup`
-import. See [Sentinel Documentation](/vault/docs/enterprise/sentinel) for more
-details on available properties.
-
-### Sample sentinel policy
-
-```
-import "time"
-import "controlgroup"
-
-control_group = func() {
-    numAuthzs = 0
-    for controlgroup.authorizations as authz {
-		if "managers" in authz.groups.by_name {
-			if time.load(authz.time).unix > time.now.unix - 3600 {
-				numAuthzs = numAuthzs + 1
-			}
-		}
-    }
-    if numAuthzs >= 2 {
-        return true
-    }
-    return false
-}
-
-main = rule {
-    control_group()
-}
-```
-
-The above policy will reject the request unless two members of the `managers`
-group have authorized the request. Additionally it verifies the authorizations
-happened in the last hour.
-
-## Tutorial
-
-Refer to the [Control Groups](/vault/tutorials/enterprise/control-groups)
-tutorial to learn how to implement dual controller authorization within your policies.
-
-## API
-
-Control Groups can be managed over the HTTP API. Please see
-[Control Groups API](/vault/api-docs/system/control-group) for more details.
diff --git a/website/content/docs/enterprise/entropy-augmentation.mdx b/website/content/docs/enterprise/entropy-augmentation.mdx
deleted file mode 100644
index f0c0bcb00cb..00000000000
--- a/website/content/docs/enterprise/entropy-augmentation.mdx
+++ /dev/null
@@ -1,69 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise Entropy Augmentation
-description: |-
-  Vault Enterprise features a mechanism to sample entropy from external
-  cryptographic modules.
----
-
-# Entropy augmentation
-
-@include 'alerts/enterprise-only.mdx'
-
-<Warning>
-  Entropy augmentation <b>is not</b> available with "FIPS 140-2 Inside" variants of
-  Vault.
-</Warning>
-
-Vault Enterprise features a mechanism to sample entropy (or randomness for
-cryptographic operations) from external cryptographic modules via the [seals](/vault/docs/configuration/seal)
-interface. While the system entropy used by Vault is more than capable of
-operating in most threat models, there are some situations where additional
-entropy from hardware-based random number generators is desirable.
-
-To use this feature, you must have an active or trial license for Vault
-Enterprise. To start a trial, contact [HashiCorp sales](mailto:sales@hashicorp.com).
-
-# Critical security parameters (CSPs)
-
-Entropy augmentation allows Vault Enterprise to supplement its system entropy with
-entropy from an external cryptography module. Designed to operate in environments
-where alignment with cryptographic regulations like [NIST SP800-90B](https://csrc.nist.gov/publications/detail/sp/800-90b/final)
-is required or when augmented entropy from external sources such as hardware true
-random number generators (TRNGs) or [quantum computing TRNGs](https://www.hashicorp.com/blog/quantum-security-and-cryptography-in-hashicorp-vault/)
-are desirable, augmented entropy replaces system entropy when performing random
-number operations on critical security parameters (CSPs).
-
-These CSPs have been selected from our previous work in [evaluating Vault for conformance with
-FIPS 140-2 guidelines for key storage and key transport](https://www.datocms-assets.com/2885/1510600487-vault_compliance_letter_fips_140-2.pdf)
-and include (but not limited to) the following:
-
-- Vault’s root key
-- Keyring encryption keys
-- Auto Unseal recovery keys
-- TLS private keys for inter-node and inter cluster communication (HA leader, raft, and replication)
-- Enterprise MFA TOTP token keys
-- JWT token wrapping keys
-- Root tokens
-- DR operation tokens
-- [Transit](/vault/docs/secrets/transit) backend key generation and `/random` endpoint (`/random` only on Vault 1.11+)
-- [PKI](/vault/docs/secrets/pki) issuer key generation, but not for leaf certificate private keys
-- [`/sys/tools/random`](/vault/api-docs/system/tools#generate-random-bytes) endpoint (Vault 1.11+)
-- [SSH](/vault/docs/secrets/ssh) CA key generation, but not for key pair generation
-- [KMIP](/vault/docs/secrets/kmip) uses EA for its TLS CA, server, and client
-  certificates.
-- TOTP two factor keys.
-
-
-## Enabling/Disabling
-
-Entropy augmentation is disabled by default. To enable entropy augmentation Vault's
-[configuration file][configuration] must include a properly configured [entropy and seal stanza](/vault/docs/configuration/entropy-augmentation)
-for a supported seal type.
-
-[configuration]: /vault/docs/configuration
-
-## Tutorial
-
-Refer to the [HSM Integration - Entropy Augmentation](/vault/tutorials/enterprise/hsm-entropy) tutorial
-to learn how to use the Entropy Augmentation function to leverage an external Hardware Security Module to augment system entropy.
diff --git a/website/content/docs/enterprise/fips/fips1402.mdx b/website/content/docs/enterprise/fips/fips1402.mdx
deleted file mode 100644
index 4d46dfa46da..00000000000
--- a/website/content/docs/enterprise/fips/fips1402.mdx
+++ /dev/null
@@ -1,258 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise FIPS 140-2 Inside
-description: |-
-  Vault Enterprise features a special build with FIPS 140-2 support built into
-  the Vault binary. This can directly be used for FIPS compliance.
----
-
-# FIPS 140-2 inside
-
-@include 'alerts/enterprise-only.mdx'
-
-Special builds of Vault Enterprise (marked with a `fips1402` feature name)
-include built-in support for FIPS 140-2 compliance. Unlike using Seal Wrap
-for FIPS compliance, this binary has no external dependencies on a HSM.
-
-To use this feature, you must have an active or trial license for Vault
-Enterprise Plus (HSMs). To start a trial, contact [HashiCorp
-sales](mailto:sales@hashicorp.com).
-
-## Using FIPS 140-2 Vault enterprise
-
-FIPS 140-2 Inside versions of Vault Enterprise behave like non-FIPS versions
-of Vault. No restrictions are placed on algorithms; it is up to the operator
-to ensure Vault remains in a FIPS-compliant mode of operation. This means
-configuring some Secrets Engines to permit a limited set of algorithms (e.g.,
-forbidding ed25519-based CAs with PKI Secrets Engines).
-
-Because Vault Enterprise may return secrets in plain text, it is important to
-ensure the Vault server's `listener` configuration section utilizes TLS. This
-ensures secrets are transmitted securely from Server to Client. Additionally,
-note that TLSv1.3 will not work with FIPS 140-2 Inside, as HKDF is not a
-certified primitive. If TLSv1.3 is desired, it is suggested to front Vault
-Server with a FIPS-certified load balancer.
-
-A non-exhaustive list of potential compliance issues include:
-
- - Using Ed25519 or ChaCha20+Poly1305 keys with the Transit Secrets Engine,
- - Using Ed25519 keys as CAs in the PKI or SSH Secrets Engines,
- - Using FF3-1/FPE in Transform Secrets Engine, or
- - Using a Derived Key (using HKDF) for Agent auto-authing or the Transit
-   Secrets Engine.
- - Using **Entropy Augmentation**: because BoringCrypto uses its internal,
-   FIPS 140-2 approved RNG, it cannot mix entropy from other sources.
-   Attempting to use EA with FIPS 140-2 HSM enabled binaries will result
-   in failures such as `panic: boringcrypto: invalid code execution`.
-
-Hashicorp can only provide general guidance regarding using Vault Enterprise
-in a FIPS-compliant manner. We are not a NIST-certified testing laboratory
-and thus organizations may need to consult an approved auditor for final
-information.
-
-The FIPS 140-2 variant of Vault uses separate binaries; these are available
-from the following sources:
-
- - From the [Hashicorp Releases Page](https://releases.hashicorp.com/vault),
-   ending with the `+ent.fips1402` and `+ent.hsm.fips1402` suffixes.
- - From the [Docker Hub `hashicorp/vault-enterprise-fips`](https://hub.docker.com/r/hashicorp/vault-enterprise-fips)
-   container repository.
- - From the [AWS ECR `hashicorp/vault-enterprise-fips`](https://gallery.ecr.aws/hashicorp/vault-enterprise-fips)
-   container repository.
- - From the [Red Hat Access `hashicorp/vault-enterprise-fips`](https://catalog.redhat.com/software/containers/hashicorp/vault-enterprise-fips/628d50e37ff70c66a88517ea)
-   container repository.
-
-~> **Note**: When pulling the FIPS UBI-based images, note that they are
-   ultimately designed for OpenShift certification; consider either adding
-   the `--user root --cap-add IPC_LOCK` options, to allow Vault to enable
-   mlock, or use the `--env SKIP_SETCAP=1` option, to disable mlock
-   completely, as appropriate for your environment.
-
-### Usage restrictions
-
-#### Migration restrictions
-
-Hashicorp **does not** support in-place migrations from non-FIPS Inside
-versions of Vault to FIPS Inside versions of Vault, regardless of version.
-A fresh cluster installation is required to receive support. We generally
-recommend avoiding direct upgrades and replicated-migrations for several
-reasons:
-
- - Old entries remain encrypted with the old barrier key until overwritten,
-   this barrier key was likely not created by a FIPS library and thus
-   is not compliant.
- - Many secrets engines internally create keys; things like Transit create
-   and store keys, but don't store any data (inside of Vault) -- these would
-   still need to be accessible and rotated to a new, FIPS-compliant key.
-   Any PKI engines would have also created non-compliant keys, but rotation
-   of say, a Root CA involves a concerted, non-Vault effort to accomplish
-   and must be done thoughtfully.
-
-As such Hashicorp cannot provide support for workloads that are affected
-either technically or via non-compliance that results from converting
-existing cluster workloads to the FIPS 140-2 Inside binary.
-
-Instead, we suggest leaving the existing cluster in place, and carefully
-consider migration of specific workloads to the FIPS-backed cluster.  
-
-#### Entropy augmentation restrictions
-
-Entropy Augmentation **does not** work with FIPS 140-2 Inside. The internal
-BoringCrypto RNG is FIPS 140-2 certified and does not accept entropy from
-other sources. On Vault 1.11.0 and later, attempting to use Entropy
-Augmentation will result in a warning ("Entropy Augmentation is not supported...")
-and Entropy Augmentation will be disabled.
-
-#### TLS restrictions
-
-Vault Enterprise's FIPS modifications include restrictions to supported TLS
-cipher suites and key information. Only the following cipher suites are
-allowed:
-
- - `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`,
- - `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`,
- - `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`,
- - `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`,
- - `TLS_RSA_WITH_AES_128_GCM_SHA256`, and
- - `TLS_RSA_WITH_AES_256_GCM_SHA384`.
-
-Additionally, only the following key types are allowed in TLS chains of trust:
-
- - RSA 2048, 3072, 4096, 7680, and 8192-bit;
- - ECDSA P-256, P-384, and P-521.
-
-Finally, only TLSv1.2 or higher is supported in FIPS mode. These are in line
-with recent NIST guidance and recommendations.
-
-#### Heterogeneous cluster deployments
-
-Hashicorp does not support mixed deployment scenarios within the same Vault
-cluster, e.g., mixing FIPS and non-FIPS Vault binary versions, or mixing FIPS
-Inside with FIPS Seal Wrap clusters. Clusters nodes must be of a single
-binary/deployment type across the entire cluster. Usage of Seal Wrap with
-the FIPS Inside binary is permitted.
-
-Running a heterogeneous cluster is not permitted by FIPS, as components of
-the system are not compliant with FIPS.
-
-## Technical details
-
-Vault Enterprise's FIPS 140-2 Inside binaries rely on a special version of the
-Go toolchain which include a FIPS-validated BoringCrypto version. To ensure
-your version of Vault Enterprise includes FIPS support, after starting the
-server, make sure you see a line with `Fips: Enabled`, such as:
-
-```
-                    Fips: FIPS 140-2 Enabled, BoringCrypto version 7
-```
-
-~> **Note**: FIPS 140-2 Inside binaries depend on cgo, which require that a
-   GNU C Library (glibc) Linux distribution be used to run Vault. We've
-   additionally opted to certify only on the AMD64 architecture at this time.
-   This means these binaries will not work on Alpine Linux based containers.
-
-### FIPS 140-2 inside and external plugins
-
-Vault Enterprise's built-in plugins are compiled into the Vault binary using
-the same Go toolchain version that compiled the core Vault; this results in
-these plugins having FIPS 140-2 compliance status as well. This same guarantee
-does not apply to external plugins.
-
-### Validating FIPS 140-2 inside
-
-To validate that the FIPS 140-2 Inside binary correctly includes BoringCrypto,
-run `go tool nm` on the binary to get a symbol dump. On non-FIPS builds,
-searching for `goboringcrypto` in the output will yield no results, but on
-FIPS-enabled builds, you'll see many results with this:
-
-```
-$ go tool nm vault | grep -i goboringcrypto
-  4014d0 T _cgo_6880f0fbb71e_Cfunc__goboringcrypto_AES_cbc_encrypt
-  4014f0 T _cgo_6880f0fbb71e_Cfunc__goboringcrypto_AES_ctr128_encrypt
-  401520 T _cgo_6880f0fbb71e_Cfunc__goboringcrypto_AES_decrypt
-  401540 T _cgo_6880f0fbb71e_Cfunc__goboringcrypto_AES_encrypt
-  401560 T _cgo_6880f0fbb71e_Cfunc__goboringcrypto_AES_set_decrypt_key
-...additional lines elided...
-```
-
-All FIPS cryptographic modules must execute startup tests. BoringCrypto uses
-the `_goboringcrypto_BORINGSSL_bcm_power_on_self_test` symbol for this. To
-ensure the Vault Enterprise binary is correctly executing startup tests, use
-[GDB](https://www.sourceware.org/gdb/) to stop execution on this function to
-ensure it gets hit.
-
-```
-$ gdb --args vault server -dev
-...GDB startup messages elided...
-(gdb) break _goboringcrypto_BORINGSSL_bcm_power_on_self_test
-...breakpoint location elided...
-(gdb) run
-...additional GDB output elided...
-Thread 1 "vault" hit Breakpoint 1, 0x0000000000454950 in _goboringcrypto_BORINGSSL_bcm_power_on_self_test ()
-(gdb) backtrace
-#0 0x0000000000454950 in _goboringcrypto_BORINGSSL_bcm_power_on_self_test ()
-#1 0x00000000005da8f0 in runtime.asmcgocall () at /usr/local/hashicorp-fips-go-devel/src/runtime/asm_amd64.s:765
-#2 0x00007fffd07a5a18 in ?? ()
-#3 0x00007fffffffdf28 in ?? ()
-#4 0x000000000057ebce in runtime.persistentalloc.func1 () at /usr/local/hashicorp-fips-go-devel/src/runtime/malloc.go:1371
-#5 0x00000000005d8a49 in runtime.systemstack () at /usr/local/hashicorp-fips-go-devel/src/runtime/asm_amd64.s:383
-#6 0x00000000005dd189 in runtime.newproc (siz=6129989, fn=0x5d88fb <runtime.rt0_go+315>) at <autogenerated>:1
-#7 0x0000000000000000 in ?? ()
-```
-
-Exact output may vary.
-
-<div {...{"className":"alert alert-warning g-type-body"}}>
-
-**Note**: When executing Vault Enterprise within GDB, GDB must rewrite
-parts of the binary to permit stopping on the specified breakpoint. This
-results in the HMAC of the contained BoringCrypto library changing,
-breaking the FIPS integrity check. If execution were to be continued
-in the example above via the `continue` command, a message like the
-following would be emitted:
-
-```
-Continuing.
-FIPS integrity test failed.
-Expected: 18d35ae031f649825a4269d68d2e62583d060a31d359690f97b9c8bf8120cdf75b405f74be7018094da7eb5261f2f86d0f481cc3b5a9c7c432268d94bf91aad9
-Calculated: 111502a3201de3b23f54b29d79ca6a1a754f94ecfc57a379444aac0d3ada68bf3c06834e6d84e68599bdf763e28e2c994fcdaeac84adabd180b59cad5fc980bb
-
-Thread 1 "vault" received signal SIGABRT, Aborted.
-```
-
-This is expected. Rerunning Vault without GDB (or with no breakpoints
-set -- e.g., `delete 1`) will still result in this function executing, but
-with the FIPS integrity check succeeding.
-
-</div>
-
-### BoringCrypto certification
-
-BoringCrypto Version 7 uses the following FIPS 140-2 Certificate and software
-version:
-
- - NIST CMVP [Certificate #3678](https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/3678).
- - BoringSSL Release [`ae223d6138807a13006342edfeef32e813246b39`](https://github.com/google/boringssl/commit/ae223d6138807a13006342edfeef32e813246b39).
-
-The following algorithms were certified as part of this release:
-
- - RSA in all key sizes greater than or equal to 2048 bits (tested at 2048
-   and 3072 bits),
- - ECDSA and ECDH with P-224 (not accessible from Vault), P-256, P-384, and
-   P-521,
- - AES symmetric encryption with 128/192/256-bit CBC, ECB, and CRT modes and
-   128/256-bit GCM modes,
- - SHA-1 and SHA-2 (224, 256,384, and 512-bit variants),
- - HMAC+SHA-2 with 224, 256, 384, and 512-bit variants of SHA-2,
- - TLSv1.0/TLSv1.1 and TLSv1.2 KDFs,
- - AES-256 based CRT_DRBG CS-PRNG.
-
-### Leidos compliance
-
-See the updated [Leidos Compliance Letter (V Entr v1.10.0+entrfips) for FIPS Inside](https://www.datocms-assets.com/2885/1653327036-boringcrypto_compliance_letter_signed.pdf) using the Boring Crypto Libraries for more details. All [past letters](https://www.hashicorp.com/vault-compliance) are also available for reference.
-
-What is the difference between Seal Wrap FIPS 140 compliance and the new FIPS Inside compliance?
-- Only the storage of sensitive entries (seal wrapped entries) is covered by FIPS-validated crypto when using Seal Wrapping.
-- The TLS connection to Vault by clients is not covered by FIPS-validated crypto when using Seal Wrapping (it is when using FIPS 140-2 Inside, per items 1, 2, 7, and 13 in the updated letter).
-- The generation of key material  wasn't using FIPS-validated crypto in the Seal Wrap version (for example, the PKI certificates: item 8 in the updated FIPS 140-2 Inside letter; or SSH module: item 10 in the updated FIPS 140-2 Inside letter).
-- With Seal Wrapping, some entries were protected with FIPS-validated crypto, but all crypto in Vault wasn't FIPS certified. With FIPS 140-2 Inside, by default (if the algorithm is certified), Vault will be using the certified crypto implementation.
diff --git a/website/content/docs/enterprise/fips/index.mdx b/website/content/docs/enterprise/fips/index.mdx
deleted file mode 100644
index ee2cbf207e4..00000000000
--- a/website/content/docs/enterprise/fips/index.mdx
+++ /dev/null
@@ -1,50 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise FIPS
-description: An overview of FIPS compliance in Vault.
----
-
-# FIPS
-
-@include 'alerts/enterprise-only.mdx'
-
-The [Federal Information Processing Standard](https://www.nist.gov/federal-information-standards-fips)
-is a cryptography-focused certification standard for U.S. Government usage.
-
-Hashicorp's Vault Enterprise supports the modes of FIPS compliance documented below.
-
-## FIPS 140-2 inside
-
-Vault Enterprise now includes release flavors with FIPS 140-2 compliant
-cryptography built into the Vault binary. More information on these releases
-can be found on the [FIPS 140-2 Inside](/vault/docs/enterprise/fips/fips1402) page.
-
-## Seal wrap
-
-Before our FIPS Inside effort, Vault [depended on](https://www.hashicorp.com/vault-compliance)
-an external HSM for FIPS 140-2 compliance. This uses the [Seal Wrap](/vault/docs/enterprise/fips/sealwrap)
-functionality to wrap security relevant keys in an extra layer of encryption.
-
-## Comparison of versions
-
-The below table attempts to documents the FIPS compliance of various Vault
-operations between FIPS Inside and FIPS Seal Wrap. This table is by no means
-an official evaluation of either product; refer to the Leidos Letters of
-Attestation for that information.
-
-| Feature                           | FIPS Inside              | FIPS Seal Wrap                           |
-| :-------------------------------- | :----------------------- | :--------------------------------------- |
-| Entropy Augmentation              | Not Supported            | Yes                                      |
-| TLS Listener                      | Yes                      | No                                       |
-| Vault HA/DR/Raft TLS              | Yes                      | No                                       |
-| Barrier Storage                   | Yes                      | No                                       |
-| Seal Wrapping of CSPs             | With FIPS-Compliant HSM  | With FIPS-Compliant HSM                  |
-| SSH CA Operations                 | Yes with FIPS algorithms | No                                       |
-| Transit Operations                | Yes with FIPS algorithms | With Managed Keys and FIPS-Compliant HSM |
-| PKI Operations                    | Yes with FIPS algorithms | With Managed Keys and FIPS-Compliant HSM |
-| KMIP (Key Creation & Use)         | Yes with FIPS algorithms | No                                       |
-| Transform Tokenization            | Yes                      | No                                       |
-| Vault Agent TLS & Internal Crypto | Yes                      | No                                       |
-| Vault to External Plugin TLS      | Yes from Vault's side    | No                                       |
-| Plugin to third-party service TLS | Yes from Vault's side    | No                                       |
-| Auth Plugins' Internal Crypto     | Yes with FIPS algorithms | No                                       |
diff --git a/website/content/docs/enterprise/fips/sealwrap.mdx b/website/content/docs/enterprise/fips/sealwrap.mdx
deleted file mode 100644
index fd0614986c6..00000000000
--- a/website/content/docs/enterprise/fips/sealwrap.mdx
+++ /dev/null
@@ -1,63 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise FIPS Seal Wrap
-description: |-
-  Vault Enterprise features a mechanism to wrap values with an extra layer of
-  encryption for supporting seals. This can be used for FIPS Compliance with
-  a certified HSM.
----
-
-# Seal wrap for FIPS compliance
-
-@include 'alerts/enterprise-only.mdx'
-
-Vault Enterprise features a mechanism to wrap values with an extra layer of
-encryption for supporting [seals](/vault/docs/configuration/seal). This adds an
-extra layer of protection and is useful in some compliance and regulatory
-environments, including FIPS 140-2 environments.
-
-To use this feature, you must have an active or trial license for Vault
-Enterprise Plus (HSMs). To start a trial, contact [HashiCorp
-sales](mailto:sales@hashicorp.com).
-
-## Using seal wrap
-
-See [the Enterprise documentation](/vault/docs/enterprise/sealwrap) for instructions
-on how to use and enable Seal Wrap.
-
-## FIPS 140-2 compliance
-
-Vault's Seal Wrap feature has been evaluated by Leidos for compliance with
-FIPS 140-2 requirements. When used with a FIPS 140-2-compliant HSM, Vault will
-store Critical Security Parameters (CSPs) in a manner that is compliant with
-KeyStorage and KeyTransit requirements. This is on by default for many parts of
-Vault and opt-in for each individual mount; see the Activating Seal Wrapping
-section below for details.
-
-[View and download current Vault compliance letters](https://www.hashicorp.com/vault-compliance)
-
-### Updates since the latest FIPS compliance audit
-
-The following are values that take advantage of seal wrapping in the current
-release of Vault that have not yet been asserted as compliant by Leidos. The
-mechanism for seal wrapping is the same, they simply were not specifically
-evaluated by the auditors.
-
-- Root tokens
-- Replication secondary activation tokens
-- Client authentication information for the GCP Auth Backend
-- Client authentication information for the Kubernetes Auth Backend
-
-## Seal wrap and replication
-
-Because of the level of flexibility targeted for replication, values sent over
-replication connections do not currently meet KeyTransit requirements for FIPS
-140-2. Vault's clustering implementation does support best practices guidance
-given in FIPS 140-2, but the cryptographic implementation of TLS is not FIPS
-140-2 certified. We may look into providing certified TLS in the future for
-replication traffic; in the meantime, a transparent TCP proxy that supports
-certified FIPS 140-2 TLS (such as
-[stunnel](https://www.stunnel.org/index.html)) can be used for replication
-traffic if meeting KeyTransit requirements for replication is necessary.
-
-[configuration]: /vault/docs/configuration
diff --git a/website/content/docs/enterprise/hsm/behavior.mdx b/website/content/docs/enterprise/hsm/behavior.mdx
deleted file mode 100644
index 1ab5ed409ad..00000000000
--- a/website/content/docs/enterprise/hsm/behavior.mdx
+++ /dev/null
@@ -1,58 +0,0 @@
----
-layout: docs
-page_title: Behavioral Changes - HSM Integration - Vault Enterprise
-description: >-
-  Vault Enterprise HSM support changes the way Vault works with regard to unseal
-  and recovery keys as well as rekey and recovery operations.
----
-
-# Vault enterprise HSM behavioral changes
-
-@include 'alerts/enterprise-only.mdx'
-
-This page contains information about the behavioral differences that take
-effect when using Vault with an HSM.
-
-## Key split between unseal keys and recovery keys
-
-Normally, Vault uses a single set of unseal keys to perform both decryption of
-the cryptographic barrier and to authorize recovery operations, such as the
-[`generate-root`](/vault/api-docs/system/generate-root)
-functionality.
-
-When using an HSM, because the HSM automatically unseals the barrier but
-recovery operations should still have human oversight, Vault instead uses two
-sets of keys: unseal keys and recovery keys. 
-
--> **Recovery keys:** Refer to the
- [Seal/Unseal](/vault/docs/concepts/seal#recovery-key) documentation to learn more
- about recovery keys.
-
-## Unseal (Root) key
-
-Vault usually generates a root key and splits it using [Shamir's Secret
-Sharing](https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing) to prevent a
-single operator from being able to modify and unseal Vault (see more
-information about Vault's security model
-[here](/vault/docs/internals/security)).
-
-When using an HSM, Vault instead stores the root key, encrypted by the HSM,
-into its internal storage. As a result, during an `init` command, the number of
-key shares, threshold, and stored shares are required to be set to `1`, meaning
-to not split the root key, so that the single key share is itself the root
-key. (Vault does not do this automatically as it generally prefers to error
-rather than change parameters set by an operator.)
-
-Both rekeying the root key and rotation of the underlying data
-encryption key are supported when using an HSM.
-
-## Performance and availability
-
-When an HSM is used for generating various Critical Security Parameters (CSPs) or for entropy augmentation,
-interaction with the HSM becomes part of the request processing for
-functionality using it. This means the HSM must be online and available for
-those requests to succeed. Additionally, some operations are performed much
-more frequently than key generation where interaction with the HSM may
-impact performance. A mount with seal wrapping enabled will interact with
-the HSM on every write for example. Vault tokens (non-batch) generated with
-entropy augmentation enabled will interact with the HSM when created.
diff --git a/website/content/docs/enterprise/hsm/index.mdx b/website/content/docs/enterprise/hsm/index.mdx
deleted file mode 100644
index 9597b780424..00000000000
--- a/website/content/docs/enterprise/hsm/index.mdx
+++ /dev/null
@@ -1,45 +0,0 @@
----
-layout: docs
-page_title: HSM Integration - Vault Enterprise
-description: >-
-  Vault Enterprise has HSM support, allowing for external root key storage and
-  automatic unsealing.
----
-
-# Vault enterprise HSM support
-
-@include 'alerts/enterprise-only.mdx'
-
-- Root key Wrapping: Vault protects its root key by transiting it through
-  the HSM for encryption rather than splitting into key shares
-- Automatic Unsealing: Vault stores its HSM-wrapped root key in storage,
-  allowing for automatic unsealing
-- [Seal Wrapping](/vault/docs/enterprise/sealwrap) to provide FIPS
-  KeyStorage-conforming functionality for Critical Security Parameters
-- [Entropy Augmentation](/vault/docs/enterprise/entropy-augmentation) to
-  allow Vault to sample entropy from an external cryptographic module.
-
-HSM support is available for devices that support PKCS#11 version 2.20+
-interfaces and provide integration libraries, and is currently available for
-linux/amd64 platforms only. It has successfully been tested against many
-different vendor HSMs; HSMs that provide only subsets of the full PKCS#11
-specification can usually be supported but it depends on available
-cryptographic mechanisms.
-
-Please note however that configuration details, flags, and supported features
-within PKCS#11 vary depending on HSM model and configuration. Consult your
-HSM's documentation for more details.
-
-Some parts of Vault work differently when using an HSM. Please see the
-[Behavioral Changes](/vault/docs/enterprise/hsm/behavior) page for
-important information on these differences.
-
-The [Configuration](/vault/docs/configuration/seal/pkcs11) page contains
-configuration information.
-
-The [Security](/vault/docs/enterprise/hsm/security) page contains
-information about deploying Vault's HSM support in a secure fashion.
-
-Finally, the [Vault Interoperability Matrix](/vault/docs/interoperability-matrix) page contains
-information about HashiCorp partner products that have been verified to work with Vault 
-for Auto Unsealing / HSM Support and External Key Management.
diff --git a/website/content/docs/enterprise/hsm/security.mdx b/website/content/docs/enterprise/hsm/security.mdx
deleted file mode 100644
index deec7824267..00000000000
--- a/website/content/docs/enterprise/hsm/security.mdx
+++ /dev/null
@@ -1,41 +0,0 @@
----
-layout: docs
-page_title: Security Details - HSM Integration - Vault Enterprise
-description: Recommendations to ensure the security of a Vault Enterprise HSM deployment.
----
-
-# Vault enterprise HSM security details
-
-@include 'alerts/enterprise-only.mdx'
-
-This page provides information to help ensure that a Vault HSM deployment is
-performed as securely as possible.
-
-## PKCS#11 authentication
-
-PKCS#11 authentication occurs via a slot number and PIN. In practice, because
-the PIN is not required to be numeric (and some HSMs require more complex
-PINs), this behaves like a username and password.
-
-Like a username and password, these values should be protected. If they are
-stored in Vault's configuration file, read access to the file should be tightly
-controlled to appropriate users. (Vault's configuration file should always have
-tight write controls.) Rather than storing these values into Vault's
-configuration file, they can also be supplied via the environment; see the
-[Configuration](/vault/docs/configuration/seal/pkcs11) page for more details.
-
-The attack surface of stolen PKCS#11 credentials depends highly on the
-individual HSM, but generally speaking, it should be assumed that if an
-attacker can see these credentials and has access to a machine on which Vault
-is running, the attacker will be able to access the HSM key protecting Vault's
-root key. Therefore, it is extremely important that access to the machine on
-which Vault is running is also tightly controlled.
-
-## Recovery key shares protection
-
-Recovery key shares should be protected in the same way as your organization
-would protect key shares for the cryptographic barrier. As a quorum of recovery
-key shares can be used with the `generate-root` feature to generate a new root
-token, and root tokens can do anything within Vault, PGP encryption should
-always be used to protect the returned recovery key shares and the recovery
-share holders should be highly trusted individuals.
diff --git a/website/content/docs/enterprise/index.mdx b/website/content/docs/enterprise/index.mdx
deleted file mode 100644
index 25220a6310e..00000000000
--- a/website/content/docs/enterprise/index.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise
-description: |-
-  Vault Enterprise features a number of capabilities beyond the open
-  source offering that may be beneficial in certain workflows.
----
-
-# Vault enterprise
-
-Vault Enterprise includes a number of features that may be useful in specific
-workflows. Please use the sidebar navigation on the left to choose a specific
-topic.
-
-These features are part of [Vault Enterprise](https://www.hashicorp.com/vault?utm_source=oss&utm_medium=docs&utm_campaign=vault&_ga=1.201793489.1956619674.1489356624).
-
-## Vault enterprise licenses
-
-A Vault Enterprise license needs to be applied to a Vault cluster
-in order to use Vault Enterprise features.  See
-[Vault License](/vault/docs/enterprise/license) for details.
-
diff --git a/website/content/docs/enterprise/lease-count-quotas.mdx b/website/content/docs/enterprise/lease-count-quotas.mdx
deleted file mode 100644
index a8897119cc7..00000000000
--- a/website/content/docs/enterprise/lease-count-quotas.mdx
+++ /dev/null
@@ -1,107 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise Lease Count Quotas
-description: |-
-  Vault Enterprise features a mechanism to create lease count quotas.
----
-
-# Lease count quotas
-
-@include 'alerts/enterprise-only.mdx'
-
-Vault features an extension to resource quotas that allows operators to enforce
-limits on how many leases are created. For a given lease count quota, if the
-number of leases in the cluster hits the configured limit, `max_leases`,
-additional lease creations will be forbidden for all clients until the
-an operator modifies the configured limit, or a lease has been revoked or
-expired.
-
-Lease count quotas guard against [lease
-explosions](/vault/docs/concepts/lease-explosions).
-
-## Root tokens
-
-It is important to note that lease count quotas do not apply to the root tokens.
-If the number of leases in the cluster hits the configured limit, `max_leases`,
-an operator can still create a root token and access the cluster to try to
-recover.
-
-## Batch tokens
-
-Batch token creation is blocked when the lease count quota is exceeded, but
-batch tokens do not count toward the quota.
-
-All the nodes in the Vault cluster share the lease quota rules, meaning that the
-lease counters are shared, regardless of which node in the Vault cluster
-receives lease generation requests. Lease quotas can be imposed across Vault's
-API, or scoped down to API pertaining to specific namespaces or specific mounts.
-
-## Lease count quota inheritance
-
-A quota that is defined in the `root` namespace with no specified path is
-inherited by all namespaces. This type of quota is referred to as a `global`
-quota. Global quotas applie to the entire Vault API unless a more specific quota
-(higher precedence) quota has been defined.
-
-## Lease count quota precedence
-
-Lease count quota precedence is dictated by highest to lowest level of
-specificity. The rules are as follows:
-
-1. Global lease count quotas are applied to all mounts and namespaces only if no
-other, more specific namespace is defined.
-1. Lease count quotas defined on a namespace take precedence over the global
-quotas.
-1. Lease count quotas defined for a mount will take precedence over global
-and namespace quotas.
-1. Lease count quotas defined for a specific path will take
-precedence over global, namespace, and mount quotas.
-1. Lease count quotas defined with a login role for a specific auth mount will
-take precedence over every other quota when applying to login requests using
-that auth method and the specified role.
-
-The limits on quotas can either be increased or decreased. If a lower precedence
-quota is very restrictive and if it is desired to relax the limits in one
-namespace, or on a specific mount, it can be done using this precedence model.
-On the other hand, if a lower precedence quota is very liberal and if it is
-desired to further restrict usages in a specific namespace or mount, that can be
-done using the precedence model too.
-
-## Default lease count quota
-
-As of Vault 1.16.0, new installations of Vault Enterprise will include a default
-global quota with a `max_leases` value of `300000`. This value is an
-intentionally low limit, intended to prevent runaway leases in the event that no
-other lease count quota is specified.
-
-This limit will affect all new clusters with no pre-existing configuration. As
-with any other quota, the default can be directly increased, decreased, or
-removed using the [lease-count-quotas endpoints](/vault/api-docs/system/lease-count-quotas).
-
-The default may also be overridden by higher precedence quotas (specified for a
-namespace, mount, path, or role) as described in the [Lease count quota
-precedence](#lease-count-quota-precedence) section above.
-
-## Quota inspection
-
-Vault also allows the inspection of the state of lease count quotas in a Vault
-cluster through various
-[metrics](/vault/docs/internals/telemetry/metrics/core-system#quota-metrics)
-and through enabling optional audit logging.
-
-## Lease count quota exceeded
-
-Vault returns a `429 - Too Many Requests` response if a new lease request
-violates the quota limit. For more information on this error, refer to [the
-error document](/vault/docs/concepts/lease-count-quota-exceeded).
-
-## Tutorial
-
-Refer to [Protecting Vault with Resource
-Quotas](/vault/tutorials/operations/resource-quotas) for a
-step-by-step tutorial.
-
-## API
-
-Lease count quotas can be managed over the HTTP API. Please see
-[Lease Count Quotas API](/vault/api-docs/system/lease-count-quotas) for more details.
diff --git a/website/content/docs/enterprise/license/autoloading.mdx b/website/content/docs/enterprise/license/autoloading.mdx
deleted file mode 100644
index d153c4a1998..00000000000
--- a/website/content/docs/enterprise/license/autoloading.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: License Autoloading
-description: An overview of license autoloading.
----
-
-# License autoloading
-
-@include 'alerts/enterprise-only.mdx'
-
-Prior to Vault 1.8, Vault Enterprise would be licensed using special binaries
-that contained embedded licenses, or via a license written into Vault storage
-using the [POST sys/license API](/vault/api-docs/system/license#install-license).
-
-As of Vault 1.8 those options still exist but are deprecated, and the recommended
-mechanism for managing licenses is called License Autoloading. New clusters are
-required to use the autoloading method.
-
-License Autoloading can be done using one of these mechanisms, in decreasing order
-of priority (i.e. `VAULT_LICENSE` takes precedence over `VAULT_LICENSE_PATH`, which
-takes precedence over `license_path` in config.)
-
-- [VAULT_LICENSE environment variable](/vault/docs/commands#vault_license)
-- [VAULT_LICENSE_PATH environment variable](/vault/docs/commands#vault_license_path)
-- [license_path in config](/vault/docs/configuration#license_path)
-
-Nodes within a cluster should be consistently licensed. All nodes in a cluster
-should use autoloading, or none should. If autoloading is used, all nodes should
-use the same license string. Warnings will be written to the log when there
-are discrepancies.
-
-If autoloading is used, any existing stored license will be ignored. The presence
-of a stored license in conjunction with an autoloaded license will also result in
-logged warnings, which may require a service restart to clear.
diff --git a/website/content/docs/enterprise/license/faq.mdx b/website/content/docs/enterprise/license/faq.mdx
deleted file mode 100644
index d914081f5e7..00000000000
--- a/website/content/docs/enterprise/license/faq.mdx
+++ /dev/null
@@ -1,182 +0,0 @@
----
-layout: docs
-page_title: Frequently Asked Questions (FAQ)
-description: An overview of license.
----
-
-# License FAQ
-
-This FAQ section is for license changes and updates introduced for Vault Enterprise.
-- [Q: How do the license termination changes affect upgrades?](#q-how-do-the-license-termination-changes-affect-upgrades)
-- [Q: What impact on upgrades do the license termination behavior changes pose?](#q-what-impact-on-upgrades-do-the-license-termination-behavior-changes-pose)
-- [Q: Will these license changes impact HCP Vault?](#q-will-these-license-changes-impact-hcp-vault)
-- [Q: Do these license changes impact all Vault customers/licenses?](#q-do-these-license-changes-impact-all-vault-customers-licenses)
-- [Q: What is the product behavior change introduced by the licensing changes?](#q-what-is-the-product-behavior-change-introduced-by-the-licensing-changes)
-- [Q: How will Vault behave at startup when a license expires or terminates?](#q-how-will-vault-behave-at-startup-when-a-license-expires-or-terminates)
-- [Q: What is the impact on evaluation licenses due to this change?](#q-what-is-the-impact-on-evaluation-licenses-due-to-this-change)
-- [Q: Are there any changes to existing methods for manual license loading (API or CLI)?](#q-are-there-any-changes-to-existing-methods-for-manual-license-loading-api-or-cli)
-- [Q: Is there a grace period when evaluation licenses expire?](#q-is-there-a-grace-period-when-evaluation-licenses-expire)
-- [Q: Are the license files locked to a specific cluster?](#q-are-the-license-files-locked-to-a-specific-cluster)
-- [Q: Will a EULA check happen every time a Vault restarts?](#q-will-a-eula-check-happen-every-time-a-vault-restarts)
-- [Q: What scenarios should a customer plan for due to these license changes?](#q-what-scenarios-should-a-customer-plan-for-due-to-these-license-changes)
-- [Q: What is the migration path for customers who want to migrate from their existing license-as-applied-via-the-CLI flow to the license on disk flow?](#q-what-is-the-migration-path-for-customers-who-want-to-migrate-from-their-existing-license-as-applied-via-the-cli-flow-to-the-license-on-disk-flow)
-- [Q: What is the path for customers who want to downgrade/rollback from Vault 1.11 or later (auto-loaded license mandatory) to a pre-Vault 1.11 (auto-loading not mandatory, stored license supported)?](#q-what-is-the-path-for-customers-who-want-to-downgrade-rollback-from-vault-1-11-or-later-auto-loaded-license-mandatory-to-a-pre-vault-1-11-auto-loading-not-mandatory-stored-license-supported)
-- [Q: Is there a limited time for support of licenses that are in storage?](#q-is-there-a-limited-time-for-support-of-licenses-that-are-in-storage)
-- [Q: What are the steps to upgrade from one autoloaded license to another autoloaded license?](#q-what-are-the-steps-to-upgrade-from-one-autoloaded-license-to-another-autoloaded-license)
-- [Q: What are the Vault ADP module licensing changes introduced in 1.8?](#q-what-are-the-vault-adp-module-licensing-changes-introduced-in-1-8)
-- [Q: How can the new ADP modules be purchased and what features are customer entitled to as part of that purchase?](#q-how-can-the-new-adp-modules-be-purchased-and-what-features-are-customer-entitled-to-as-part-of-that-purchase)
-- [Q: What is the impact to customers based on these ADP module licensing changes?](#q-what-is-the-impact-to-customers-based-on-these-adp-module-licensing-changes)
-
-### Q: what is the product behavior change introduced by the licensing changes?
-
-Per the [feature deprecation plans](/vault/docs/deprecation), Vault will no longer support licenses in storage. An [auto-loaded license](/vault/docs/enterprise/license/autoloading) must be used instead. If you are using stored licenses, you must migrate to auto-loaded licenses prior to upgrading to Vault 1.11
-
-Vault 1.12 will also introduce different termination behavior for evaluation licenses versus non-evaluation licenses. An evaluation license will include a 30-day trial period after which a running Vault server will terminate. Vault servers using a non-evaluation license will not terminate.
-
-### Q: how do the license termination changes affect upgrades?
-Vault 1.12 will introduce changes to the license termination behavior. Upgrades when using expired licenses will now be limited.
-Vault will not startup if the build date of the binary is _after_ the expiration date of a license. License expiration date and binary build date compatibility can be verified using the [Check for Autoloaded License](/vault/docs/commands/operator/diagnose#check-for-autoloaded-license) check performed by the `vault operator diagnose` command.
-The build date of a binary can also be found using the [vault version](/vault/docs/commands/version#version) command.
-
-A user can expect the following to occur based on the following scenarios:
-
-**Evaluation or non-evaluation license is valid:**
-Vault will start normally
-
-**Evaluation or non-evaluation license is expired, binary build date _before_ license expiry date:**
-Vault will start normally
-
-**Evaluation or non-evaluation license is expired, binary build date _after_ license expiry date:**
-Vault will not start
-
-**Evaluation license is terminated:**
-Vault will not start independent of the binary's build date
-
-**Non-evaluation license is terminated, binary build date _before_ license expiry date:**
-Vault will start normally
-
-**Non-evaluation license is terminated, binary build date _after_ license expiry date:**
-Vault will not start
-
-The Vault support team can issue you a temporary evaluation license to allow for security upgrades if your license has expired.
-
-### Q: will these license changes impact HCP Vault?
-
-No, these changes will not impact HCP Vault.
-
-### Q: do these license changes impact all Vault customers/licenses?
-
-| Customer/licenses                                                                                                           | Impacted? |
-| --------------------------------------------------------------------------------------------------------------------------- | --------- |
-| ENT binaries (evaluation or non-evaluation downloaded from [releases.hashicorp.com](https://releases.hashicorp.com/vault/)) | Yes       |
-| Business-Source (BSL)                                                                                                       | No        |
-
-### Q: what is the product behavior change introduced by the licensing changes?
-
-With Vault 1.11, the use of an [auto-loaded license](/vault/docs/enterprise/license/autoloading) is required for Vault to start successfully.
-
-### Q: how will Vault behave at startup when a license expires or terminates?
-
-When a license expires, Vault continues to function until the license terminates. This behavior exists today and remains unchanged in Vault 1.11. The grace period, defined as the time between license expiration and license termination, is one day for evaluation licenses (as of 1.8), and ten years for non-evaluation licenses.
-Customers must provide a valid license before the grace period expires. This license is required to be [auto-loaded](/vault/docs/enterprise/license/autoloading). When license terminates (upon grace period expiry), Vault will seal itself and customers will need a valid license in order to successfully bring-up Vault. If a valid license was not installed after license expiry, customers will need to provide one, and this license will need to be auto-loaded.
-
-Vault 1.12 changes the license expiration and termination behavior. Evaluation licenses include a 30-day trial period after which a running Vault server will terminate. Non-evaluation licenses, however, will no longer terminate. When a non-evaluation license expires, Vault will continue to function but upgrades will be limited. The build date of the upgrade binary must be before the expiration date of the license.
-Vault will not start when attempting to use an expired license and binary with a build date _after_ the license expiration date. Attempting to [reload](/vault/api-docs/system/config-reload#reload-license-file) an expired license will result in an error if the build date of the running Vault server is _after_ the license expiration date.
-
-License expiration date and binary build date compatibility can be verified using the [Check for Autoloaded License](/vault/docs/commands/operator/diagnose#check-for-autoloaded-license) check performed by the `vault operator diagnose` command. The build date of a binary can also be found using the [vault version](/vault/docs/commands/version#version) command.
-
-### Q: what is the impact on evaluation licenses due to this change?
-
-As of Vault 1.8, any Vault cluster deployed must have a valid [auto-loaded](/vault/docs/enterprise/license/autoloading) license.
-
-Vault 1.12 introduces [expiration and termination behavior changes](#q-how-will-vault-behave-at-startup-when-a-license-expires-or-terminates) for non-evaluation licenses. Evaluation licenses will continue to have a 1-day grace period upon license expiry after which they will terminate. Vault will seal itself and shutdown once an evaluation license terminates.
-
-### Q: are there any changes to existing methods for manual license loading (API or CLI)?
-
-The [`/sys/license`](/vault/api-docs/v1.10.x/system/license#install-license) and [`/sys/license/signed`](/vault/api-docs/v1.10.x/system/license#read-signed-license) endpoints have been removed as of Vault 1.11. With that said, it is no longer possible to provide a license via the `/sys/license` endpoint. License [auto-loading](/vault/docs/enterprise/license/autoloading) must be used instead.
-The [`/sys/config/reload/license`](/vault/api-docs/system/config-reload#reload-license-file) endpoint can be used to reload an auto-loaded license provided as a path via an environment variable or configuration.
-
-### Q: is there a grace period when evaluation licenses expire?
-
-Evaluation licenses have a 1-day grace period. The grace period is the time until the license expires. Upon expiration, Vault will seal and will require a valid license to unseal and function properly.
-
-### Q: are the license files locked to a specific cluster?
-
-The changes to licenses apply to all nodes in a cluster. The license files are not locked to a cluster, but are independently applied to the appropriate clusters.
-
-### Q: will a EULA check happen every time a Vault restarts?
-
-Yes, starting with Vault 1.8, ENT binaries will be subjected to a EULA check. The release of Vault 1.8 introduces the EULA check for evaluation licenses (non-evaluation licenses are evaluated with a EULA check during contractual agreement) .
-Although the agreement to a EULA occurs only once (when the user receives their license), Vault will check for the presence of a valid license every time a node is restarted.
-
-Starting Vault 1.11, when customers deploy new Vault clusters, or upgrade existing Vault clusters, a valid [auto-loaded](/vault/docs/enterprise/license/autoloading) license must exist for the upgrade to be successful.
-
-### Q: what scenarios should a customer plan for due to these license changes?
-
-- **New Cluster Deployment**: When a customer deploys new clusters to Vault 1.11 or later, a valid license must exist to successfully deploy. This valid license must be on-disk ([auto-loaded](/vault/docs/enterprise/license/autoloading)).
-
-- **Eventual Migration**: Vault 1.11 removes support for in-storage licenses. Migrating to an auto-loaded license is required for Vault to start successfully using version 1.11 or greater. Pre-existing license storage entries will be automatically removed from storage upon startup.
-
-### Q: what is the migration path for customers who want to migrate from their existing license-as-applied-via-the-CLI flow to the license on disk flow?
-
-If a Vault cluster using a stored license is planned to be upgraded to Vault 1.11 or greater, the operator must migrate to using an auto-loaded license. The [`vault license get -signed`](/vault/docs/v1.10.x/commands/license/get) command (or underlying [`/sys/license/signed`](/vault/api-docs/v1.10.x/system/license#read-signed-license) endpoint) can be used to retrieve the license from storage in a running cluster.
-It is not necessary to remove the stored license entry. That will occur automatically upon startup in Vault 1.11 or greater. Prior to completing the [recommended upgrade steps](/vault/docs/upgrading), perform the following to ensure your license is properly configured:
-
-1. Use the command `vault license get -signed` to retrieve the license from storage of your running cluster.
-2. Put the license on disk
-3. Configure license auto-loading by specifying the [`license_path`](/vault/docs/configuration#license_path) config option or setting the [`VAULT_LICENSE`](/vault/docs/commands#vault_license) or [`VAULT_LICENSE_PATH`](/vault/docs/commands#vault_license_path) environment variable.
-
-### Q: what is the path for customers who want to downgrade/rollback from Vault 1.11 or later (auto-loaded license mandatory) to a pre-Vault 1.11 (auto-loading not mandatory, stored license supported)?
-
-The downgrade procedure remains the same for Vault customers who are currently on Vault 1.11 or later, have a license installed via auto-loading, and would like to downgrade their cluster to a pre-1.11 version. Please refer to the [upgrade procedures](/vault/tutorials/standard-procedures/sop-upgrade) that remind the customers that they must take a snapshot before the upgrade. Customers will need to restore their version from the snapshot, apply the pre-1.11 enterprise binary version they wish to roll back, and bring up the clusters.
-
-### Q: is there a limited time for support of licenses that are in storage?
-
-The support of licenses installed by alternative means often leads to difficulties providing the appropriate support. To provide the support expected by our customers, as we have announced in [Vault feature deprecations and plans](/vault/docs/deprecation) we are removing support for licenses in storage with Vault 1.11. This implies licensing endpoints that deal with licenses in storage will be removed, and Vault will no longer check for valid licenses in storage. This change requires that all customers have [auto-loaded](/vault/docs/enterprise/license/autoloading) licenses to upgrade to 1.11(+) successfully.
-
-### Q: what are the steps to upgrade from one autoloaded license to another autoloaded license?
-
-Follow these steps to migrate from one autoloaded license to another autoloaded license.
-
-1. Use the [`vault license inspect`](/vault/docs/commands/license/inspect) command to compare the new license against the output of the [`vault license get`](/vault/docs/commands/license/get) command. This is to ensure that you have the correct license.
-1. Backup the old license file in a safe location.
-1. Replace the old license file on each Vault server with the new one.
-1. Invoke the [reload command](/vault/api-docs/system/config-reload#reload-license-file) on each individual Vault server, starting with the standbys and doing the leader last. Invoking in this manner reduces possible disruptions if something was performed incorrectly with the above steps. You can either use the [reload command](/vault/api-docs/system/config-reload#reload-license-file) or send a SIGHUP.
-1. On each node, ensure that the new license is in use by using the [`vault license get`](/vault/docs/commands/license/get) command and/or checking the logs.
-
-# ADP licensing
-
-This FAQ section is for the Advanced Data Protection (ADP) license changes introduced in Vault Enterprise 1.8.
-
-### Q: what are the Vault ADP module licensing changes introduced in 1.8?
-
-As of Vault Enterprise 1.8, the functionality formerly sold as the Vault ADP module is now separated between two new modules:
-
-**ADP-KM** includes:
-
-- [Key Management Secrets Engine (KMSE)](/vault/docs/secrets/key-management)
-- [Key Management Interoperability (KMIP)](/vault/docs/secrets/kmip)
-- [MSSQL Transparent Data Encryption (TDE)](https://www.hashicorp.com/blog/enabling-transparent-data-encryption-for-microsoft-sql-with-vault)
-
-**ADP-Transform** includes:
-
-- [Transform Secrets Engine (TSE)](/vault/docs/secrets/transform)
-
-### Q: how can the new ADP modules be purchased and what features are customer entitled to as part of that purchase?
-
-**ADP-KM includes**:
-
-- This is the first Vault Enterprise module that can be purchased standalone. This means it can be purchased without the purchase of a Vault Enterprise Standard license.
-- ADP-KM still requires a Vault Enterprise binary. The Vault Enterprise Standard license is automatically included with the ADP-KM module, but customers are contractually prohibited from using any features besides those in Vault Community Edition and ADP-KM (KMSE and KMIP).
-
-**ADP-Transform includes**:
-
-- This module cannot be purchased as a standalone. It requires a Vault Enterprise binary, and customers must purchase the base Vault Enterprise Standard license (at least) to use the corresponding Enterprise features.
-- The ADP-Transform SKU can be applied as an add-on. This workflow is similar to the consolidated ADP SKU.
-
-### Q: what is the impact to customers based on these ADP module licensing changes?
-
-Customers need to be aware of the following as a result of these changes:
-
-- **New customers** may choose to purchase either or both of these modules. The old (consolidated) module is not available to them as an option.
-- **Existing customers** may continue with the consolidated Vault ADP module uninterrupted. They will only be converted to one or both new ADP modules the next time they make a change to their licensing details (i.e. contract change).
diff --git a/website/content/docs/enterprise/license/index.mdx b/website/content/docs/enterprise/license/index.mdx
deleted file mode 100644
index 6f2635507f1..00000000000
--- a/website/content/docs/enterprise/license/index.mdx
+++ /dev/null
@@ -1,13 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise License
-description: An overview of license.
----
-
-# Vault license
-
-@include 'alerts/enterprise-only.mdx'
-
-Licenses and EULA enhancements have been introduced in Vault 1.8 release. Please refer to the [FAQ](/vault/docs/enterprise/license/faq) for common questions concerning these changes.
-
-The [Install a HashiCorp Enterprise License](/vault/tutorials/enterprise/hashicorp-enterprise-license) tutorial provides the instruction to load your Vault license.
diff --git a/website/content/docs/enterprise/license/manual-reporting.mdx b/website/content/docs/enterprise/license/manual-reporting.mdx
deleted file mode 100644
index 8d2d98c0ab6..00000000000
--- a/website/content/docs/enterprise/license/manual-reporting.mdx
+++ /dev/null
@@ -1,173 +0,0 @@
----
-layout: docs
-page_title: Manual license utilization reporting
-description: >-
-  Manual license utilization reporting allows you to export, review, and send license utilization data to HashiCorp through the CLI or HCP Web Portal.
----
-
-# Manual license utilization reporting
-
-@include 'alerts/enterprise-only.mdx'
-
-Manual license utilization reporting allows you to export, review, and send
-license utilization data to HashiCorp via the CLI or HCP Web Portal. Use these
-reports to understand how much more you can deploy under your current contract,
-protect against overutilization, and budget for predicted consumption. Manual
-reporting shares the minimum data required to validate license utilization as
-defined in our contracts. The reports consist of mostly computed metrics and
-will never contain Personal Identifiable Information (PII) or other sensitive
-information. 
-
-Manual license utilization shares the same data as automated license utilization
-but is more time consuming. Unless you are running in an air-gapped environment
-or have another reason to report data manually, we strongly recommend using
-automated reporting instead. If you have disabled automated license reporting,
-you can re-enable it by reversing the opt-out process described in the
-[documentation](/vault/docs/enterprise/license/utilization-reporting#opt-out). 
-
-If you are considering manual reporting because you’re worried about your data,
-we strongly recommend that you review the [example
-payloads](#data-file-content), which are the same for automated and manual
-reporting. If you have further concerns with any of the automatically-reported
-data please bring them to your account manager before opting out of automated
-reporting in favor of manual reporting.
-
-## How to manually send data reports
-
-### Generate a data bundle
-
-Data bundles include collections of JSON snapshots that contain license
-utilization information.  
-
-1. Login into your [cluster node](/vault/tutorials/cloud/vault-access-cluster).
-1. Run this CLI command to generate a data bundle:
-
-   ```shell-session
-   $ vault operator utilization
-   ```
-
-   By default, the bundle will include all historical snapshots. 
-
-   You can provide context about the conditions under which the report was
-   generated and submitted by providing a comment. This optional comment will
-   not be included in the license utilization bundle, but will be included in
-   the Vault server logs. 
-
-   **Example:**
-
-   ```shell-session
-   $ vault operator utilization -message=”Change Control 654987” \
-        -output=”/utilization/reports/latest.json”
-   ```
-
-   This command will export all the persisted snapshots into a bundle. The
-   message “Change Control 654987” will not be included in the bundle but will
-   be included in Vault server logs. The `-output` flags specifies the output
-   location of the JSON bundle. 
-
-   **Available command flags:**
-
-   - `-message` `(string: “”)` - Provide context about the conditions under
-   which the report was generated and submitted. This message is not included
-   in the license utilization bundle but will be included in the vault server
-   logs. (optional)
-
-   - `-today-only` `(bool: false)` - To include only today’s snapshot, no
-   historical snapshots. If no snapshots were persisted in the last 24 hrs, it
-   takes a snapshot and exports it to a bundle. (optional)    
-   
-   - `-output` `(string: “”)` - Specifies the output path for the bundle.
-   Defaults to a time-based generated file name. (optional)
-
-
-### Send the data bundle to HashiCorp
-
-1. Go to https://portal.cloud.hashicorp.com/license-utilization/reports/create
-1. Click on **Choose files**, or drop your file(s) into the container.
-
-    a. If the upload succeeded, the HCP user interface will change the file
-    status to **Uploaded** in green.
-    
-    b. If the upload failed, the file status will say **Failed** in red, and
-    will include error information. 
-
-If the upload fails make sure you haven’t modified the file signature. If the
-error persists, please contact your account representative. 
-
-
-## Enable manual reporting
-
-Upgrade to a release that supports manual license utilization reporting. These
-releases include: 
-
-- Vault Enterprise 1.16.0 and later
-- Vault Enterprise 1.15.6 and later
-- Vault Enterprise 1.14.10 and later
-
-## Configuration
-
-Administrators can manage disk space for storing snapshots by defining the
-number of days snapshots can be retained. 
-
-```hcl
-reporting {
-    snapshot_retention_time = "2400h"
-}
-```
-
-The default retention period is 400 days. 
-
-## Data file content
-
-<CodeBlockConfig hideClipboard>
-
-```json
-{
-  "snapshot_version": 2,
-  "id": "0001JWAY00BRF8TEXC9CVRHBAC",
-  "timestamp": "2024-02-08T16:55:28.085215-08:00",
-  "schema_version": "2.0.0",
-  "product": "vault",
-  "process_id": "01HP5NJS21HN50FY0CBS0SYGCH",
-  "metrics": {
-    "clientcount.current_month_estimate.type.entity": {
-      "key": "clientcount.current_month_estimate.type.entity",
-      "value": 20,
-      "mode": "write"
-    },
-    "clientcount.current_month_estimate.type.nonentity": {
-      "key": "clientcount.current_month_estimate.type.nonentity",
-      "value": 11,
-      "mode": "write"
-    },
-    "clientcount.current_month_estimate.type.secret_sync": {
-      "key": "clientcount.current_month_estimate.type.secret_sync",
-      "value": 0,
-      "mode": "write"
-    },
-    "clientcount.previous_month_complete.type.entity": {
-      "key": "clientcount.previous_month_complete.type.entity",
-      "value": 0,
-      "mode": "write"
-    },
-    "clientcount.previous_month_complete.type.nonentity": {
-      "key": "clientcount.previous_month_complete.type.nonentity",
-      "value": 0,
-      "mode": "write"
-    },
-    "clientcount.previous_month_complete.type.secret_sync": {
-      "key": "clientcount.previous_month_complete.type.secret_sync",
-      "value": 0,
-      "mode": "write"
-    }
-  },
-  "product_version": "1.16.0+ent",
-  "license_id": "7d68b16a-74fe-3b9f-a1a7-08cf461fff1c",
-  "checksum": 6861637915450723051,
-  "metadata": {
-    "billing_start": "2023-05-04T00:00:00Z",
-    "cluster_id": "16d0ff5b-9d40-d7a7-384c-c9b95320c60e"
-  }
-```
-
-</CodeBlockConfig>
\ No newline at end of file
diff --git a/website/content/docs/enterprise/license/utilization-reporting.mdx b/website/content/docs/enterprise/license/utilization-reporting.mdx
deleted file mode 100644
index a0278d7e91b..00000000000
--- a/website/content/docs/enterprise/license/utilization-reporting.mdx
+++ /dev/null
@@ -1,295 +0,0 @@
----
-layout: docs
-page_title: Automated license utilization reporting
-description: >-
-  Learn what data HashiCorp collects to meter Enterprise license utilization. Enable or disable reporting. Review sample payloads and logs.
----
-
-# Automated license utilization reporting
-
-@include 'alerts/enterprise-only.mdx'
-
-Automated license utilization reporting sends license utilization data to
-HashiCorp without requiring you to manually collect and report them. It also
-lets you review your license usage with the monitoring solution you already use
-(for example Splunk, Datadog, or others) so you can optimize and manage your
-deployments. Use these reports to understand how much more you can deploy under
-your current contract, protect against overutilization, and budget for predicted
-consumption.  
-
-Automated reporting shares the minimum data required to validate license
-utilization as defined in our contracts. They consist of mostly computed metrics
-and will never contain Personal Identifiable Information (PII) or other
-sensitive information. Automated reporting shares the data with HashiCorp using
-a secure, unidirectional HTTPS API and makes an auditable record in the product
-logs each time it submits a report. The reporting process is GDPR compliant and submits
-reports roughly once every 24 hours.
-
-## Enable automated reporting
-
-To enable automated reporting, you need to make sure that outbound network
-traffic is configured correctly and upgrade your enterprise product to a version
-that supports it. If your installation is air-gapped or network settings are not
-in place, automated reporting will not work. 
-
-### 1. allow outbound HTTPS traffic on port 443
-
-Make sure that your network allows HTTPS egress on port 443 to
-https://reporting.hashicorp.services by allow-listing the following IP
-addresses: 
-
-- 100.20.70.12
-- 35.166.5.222
-- 23.95.85.111
-- 44.215.244.1
-
-### 2. upgrade
-
-Upgrade to a release that supports license utilization reporting. These
-releases include:
-
-- [Vault Enterprise 1.14.0](https://releases.hashicorp.com/vault/) and later
-- [Vault Enterprise 1.13.4](https://releases.hashicorp.com/vault/) and later 1.13.x versions
-- [Vault Enterprise 1.12.8](https://releases.hashicorp.com/vault/) and later 1.12.x versions
-- [Vault Enterprise 1.11.12](https://releases.hashicorp.com/vault/)
-
-### 3. check logs
-
-Automatic license utilization reporting will start sending data within roughly 24 hours.
-Check the server logs for records that the data sent successfully.
-
-You will find log entries similar to the following:
-
-<CodeBlockConfig hideClipboard>
-
-```
-[DEBUG] core.reporting: beginning snapshot export
-[DEBUG] core.reporting: creating payload
-[DEBUG] core.reporting: marshalling payload to json
-[DEBUG] core.reporting: generating authentication headers
-[DEBUG] core.reporting: creating request
-[DEBUG] core.reporting: sending request
-[DEBUG] core.reporting: performing request: method=POST url=https://reporting.hashicorp.services
-[DEBUG] core.reporting: recording audit record
-[INFO]  core.reporting: Report sent: auditRecord="{\"payload\":{\"payload_version\":\"1\",\"license_id\":\"97afe7b4-b9c8-bf19-bf35-b89b5cc0efea\",\"product\":\"vault\",\"product_version\":\"1.14.0-rc1+ent\",\"export_timestamp\":\"2023-06-01T09:34:44.215133-04:00\",\"snapshots\":[{\"snapshot_version\":1,\"snapshot_id\":\"0001J7H7KMEDRXKM5C1QJGBXV3\",\"process_id\":\"01H1T45CZK2GN9WR22863W2K32\",\"timestamp\":\"2023-06-01T09:34:44.215001-04:00\",\"schema_version\":\"1.0.0\",\"service\":\"vault\",\"metrics\":{\"clientcount.current_month_estimate\":{\"key\":\"clientcount.current_month_estimate\",\"kind\":\"sum\",\"mode\":\"write\",\"labels\":{\"type\":{\"entity\":20,\"nonentity\":11}}},\"clientcount.previous_month_complete\":{\"key\":\"clientcount.previous_month_complete\",\"kind\":\"sum\",\"mode\":\"write\",\"labels\":{\"type\":{\"entity\":10,\"nonentity\":11}}}}}],\"metadata\":{\"vault\":{\"billing_start\":\"2023-03-01T00:00:00Z\",\"cluster_id\":\"a8d95acc-ec0a-6087-d7f6-4f054ab2e7fd\"}}}}"
-[DEBUG] core.reporting: completed recording audit record
-[DEBUG] core.reporting: export finished successfully
-```
-
-</CodeBlockConfig>
-
-If your installation is air-gapped or your network doesn’t allow the correct
-egress, logs will show an error. 
-
-<CodeBlockConfig hideClipboard>
-
-```
-[DEBUG] core.reporting: beginning snapshot export
-[DEBUG] core.reporting: creating payload
-[DEBUG] core.reporting: marshalling payload to json
-[DEBUG] core.reporting: generating authentication headers
-[DEBUG] core.reporting: creating request
-[DEBUG] core.reporting: sending request
-[DEBUG] core.reporting: performing request: method=POST url=https://reporting.hashicorp.services
-[DEBUG] core.reporting: error status code received: statusCode=403
-```
-
-</CodeBlockConfig>
-
-In this case, reconfigure your network to allow egress and check back in 24
-hours. 
-
-## Opt out
-
-If your installation is air-gapped or you want to manually collect and report on
-the same license utilization metrics, you can opt-out of automated reporting. 
-
-Manually reporting these metrics can be time consuming. Opting out of automated
-reporting does not mean that you also opt out from sending license utilization
-metrics. Customers who opt out of automated reporting will still be required to
-manually collect and send license utilization metrics to HashiCorp. 
-
-If you are considering opting out because you’re worried about the data, we
-strongly recommend that you review the [example payloads](#example-payloads)
-before opting out. If you have concerns with any of the automatically-reported
-data please bring them to your account manager. 
-
-You have two options to opt out of automated reporting: 
-
-- HCL configuration (recommended) 
-- Environment variable (requires restart)
-
-
-#### HCL configuration
-
-Opting out in your product’s configuration file doesn’t require a system
-restart, and is the method we recommend. Add the following block to your server
-configuration file (e.g. `vault-config.hcl`).
-
-```hcl
-reporting {
-	license {
-		enabled = false
-   }
-}
-```
-
-<Warning>
-
-When you have a cluster, each node must have the reporting stanza in its
-configuration to be consistent. In the event of leadership change, nodes will
-use its server configuration to determine whether or not to opt-out the
-automated reporting. Inconsistent configuration between nodes will change the
-reporting status upon active unseal.
-
-</Warning>
-
-
-You will find the following entries in the server log.
-
-<CodeBlockConfig hideClipboard>
-
-```
-[DEBUG] core: reloading automated reporting
-[INFO]  core: opting out of automated reporting
-[DEBUG] activity: there is no reporting agent configured, skipping counts reporting
-```
-
-</CodeBlockConfig>
-
-#### Environment variable
-
-If you need to, you can also opt out using an environment variable, which will
-provide a startup message confirming that you have disabled automated reporting.
-This option requires a system restart. 
-
-<Note>
-
-If the reporting stanza exists in the configuration file, the
-`OPTOUT_LICENSE_REPORTING` value overrides the configuration.
-
-</Note>
-
-Set the following environment variable.
-
-```shell-session
-$ export OPTOUT_LICENSE_REPORTING=true
-```
-
-Now, restart your [Vault servers](/vault/docs/commands/server) from the shell
-where you set the environment variable.
-
-You will find the following entries in the server log.
-
-<CodeBlockConfig hideClipboard>
-
-```
-[INFO]  core: automated reporting disabled via environment variable: env=OPTOUT_LICENSE_REPORTING
-[INFO]  core: opting out of automated reporting
-[DEBUG] activity: there is no reporting agent configured, skipping counts reporting
-```
-
-</CodeBlockConfig>
-
-
-Check your product logs roughly 24 hours after opting out to make sure that the system
-isn’t trying to send reports. 
-
-If your configuration file and environment variable differ, the environment
-variable setting will take precedence.
-
-## Example payloads
-
-HashiCorp collects the following utilization data as JSON payloads:
-
-- `payload_version` - The version of this payload schema
-- `license_id` - The license ID for this product
-- `product` - The product that this contribution is for
-- `product_version` - The product version this contribution is for
-- `export_timestamp`- The date and time for this contribution
-- `snapshots` - An array of snapshot details. A snapshot is a structure that
-  represents a single data collection
-   - `snapshot_version` - The version of the snapshot package that produced this
-     snapshot
-   - `snapshot_id` - A unique identifier for this particular snapshot
-   - `process_id` - An identifier for the system that produced this snapshot
-   - `timestamp` - The date and time for this snapshot
-   - `schema_version` - The version of the schema associated with this snapshot
-   - `service` - The service that produced this snapshot (likely to be product
-     name)
-   - `metrics` - A map of representations of snapshot metrics contained within
-     this snapshot
-      - `key` - The key name associated with this metric
-      - `kind` - The kind of metric (feature, counter, sum, or mean)
-      - `mode` - The mode of operation associated with this metric (write or
-        collect)
-      - `labels` - The labels associated with each collected metric
-         - `entity` - The sum of tokens generated for a unique client identifier
-         - `nonentity` - The sum of tokens without an entity attached
-- `metadata` - Optional product-specific metadata
-   - `billing_start` - The billing start date associated with the reporting cluster (license start date if not configured)
-   - `cluster_id` - The cluster UUID as shown by `vault status` on the reporting
-     cluster
-   
-<CodeBlockConfig hideClipboard>
-
-```json
-{
-  "payload_version": "1",
-  "license_id": "97afe7b4-b9c8-bf19-bf35-b89b5cc0efea",
-  "product": "vault",
-  "product_version": "1.14.0-rc1+ent",
-  "export_timestamp": "2023-06-01T11:39:00.76643-04:00",
-  "snapshots": [
-    {
-      "snapshot_version": 1,
-      "snapshot_id": "0001J7HEWM1PEHPMF5YZT8EV65",
-      "process_id": "01H1VSQMNYAP77R566F1Y03GE6",
-      "timestamp": "2023-06-01T11:39:00.766099-04:00",
-      "schema_version": "1.0.0",
-      "service": "vault",
-      "metrics": {
-        "clientcount.current_month_estimate": {
-          "key": "clientcount.current_month_estimate",
-          "kind": "sum",
-          "mode": "write",
-          "labels": {
-            "type": {
-              "entity": 20,
-              "nonentity": 11
-            }
-          }
-        },
-        "clientcount.previous_month_complete": {
-          "key": "clientcount.previous_month_complete",
-          "kind": "sum",
-          "mode": "write",
-          "labels": {
-            "type": {
-              "entity": 10,
-              "nonentity": 11
-            }
-          }
-        }
-      }
-    }
-  ],
-  "metadata": {
-    "vault": {
-      "billing_start": "2023-03-01T00:00:00Z",
-      "cluster_id": "a8d95acc-ec0a-6087-d7f6-4f054ab2e7fd"
-    }
-  }
-}
-```
-
-</CodeBlockConfig>
-
-## Pre-1.9 counts
-
-When upgrading Vault from 1.8 (or earlier) to 1.9 (or later), utilization reporting will only include the [non-entity tokens](/vault/docs/concepts/client-count#non-entity-tokens) that are used after the upgrade.
-
-Starting in Vault 1.9, the activity log records and de-duplicates non-entity tokens by using the namespace and token's policies to generate a unique identifier. Because Vault did not create identifiers for these tokens before 1.9, the activity log cannot know whether this token has been seen pre-1.9. To prevent inaccurate and inflated counts, the activity log will ignore any counts of non-entity tokens that were created before the upgrade and only the non-entity tokens from versions 1.9 and later will be counted.
-
-See the client count [overview](/vault/docs/concepts/client-count) and [FAQ](/vault/docs/concepts/client-count/faq) for more information.
-
diff --git a/website/content/docs/enterprise/managed-keys.mdx b/website/content/docs/enterprise/managed-keys.mdx
deleted file mode 100644
index 688c65285dc..00000000000
--- a/website/content/docs/enterprise/managed-keys.mdx
+++ /dev/null
@@ -1,63 +0,0 @@
----
-layout: docs
-page_title: Managed Keys
-description: >-
-  Managed Keys is a system in Vault that defers all private key operations to a third party system.
----
-
-# Managed keys
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-Within certain environments, customers want to leverage key management systems
-external to Vault, when handling, storing, and interacting with
-private key material, or are required to do so by standards requirements.
-
-To satisfy these requirements, Vault has a centralized abstraction called
-*Managed Keys* that different secrets engines can plug into, allowing them to
-delegate these operations to a trusted external KMS.
-
-Minimally, a managed key consists of a named managed key entry managed by the
-[`sys/managed-key`](/vault/api-docs/system/managed-keys) API.  Besides a name,
-there are backend specific configurations to access the key in question.
-
-For PKCS#11 (HSM) backed managed keys, the managed key configuration must
-reference a [kms library stanza](/vault/docs/configuration/kms-library) which points
-to a PKCS#11 access library on the host machine.
-
-Note that a configured, named managed key corresponds to a single key within
-a backend.  More than one managed key can be configured targeting a single
-backend by creating multiple managed keys with the API.
-
-## Namespace support
-
-Every configured Managed Key is bound to a given namespace, defaulting to the
-root namespace. Any secrets engine's mount path must exist within the same namespace
-as the Managed Key for which it intends to use.
-
-## Backend support
-
-Managed Keys were developed to support different types of external backends. At
-this time supported backends are PKCS#11, AWS KMS, Azure Key Vault, and Google
-Cloud KMS. Support for additional integrations may be added in the future.
-
-## Secret and auth engine support
-
-The [PKI Secrets Engine](/vault/api-docs/secret/pki#managed-keys) has been integrated
-with Managed Keys to offer certificate generation, both root and intermediary
-PKI paths, leveraging private keys from an external trusted KMS.
-
-The [Transit Secrets Engine](/vault/api-docs/secret/transit#managed-keys) allows users
-to generate and verify cryptographic signatures with Managed Keys, and in some cases encrypt
-and decrypt data, or generate MACs and HMACs. These operations are performed on the KMS or HSM
-that hosts the Managed Key material.
-
-More engines may leverage managed keys in the future.
-
-## API
-
-Managed Keys can be managed over the HTTP API. Please see
-[Managed Keys API](/vault/api-docs/system/managed-keys) for more details.
-
-To configure PKI secrets engine with Managed Keys please see
-[PKI Secret API](/vault/api-docs/secret/pki#managed-keys)
diff --git a/website/content/docs/enterprise/mfa/index.mdx b/website/content/docs/enterprise/mfa/index.mdx
deleted file mode 100644
index 0c3916b706c..00000000000
--- a/website/content/docs/enterprise/mfa/index.mdx
+++ /dev/null
@@ -1,115 +0,0 @@
----
-layout: docs
-page_title: MFA Support - Vault Enterprise
-description: >-
-  Vault Enterprise has support for Multi-factor Authentication (MFA), using
-  different authentication types.
----
-
-# Vault enterprise MFA support
-
-@include 'alerts/enterprise-only.mdx'
-
-Vault Enterprise has support for Multi-factor Authentication (MFA), using
-different authentication types. MFA is built on top of the Identity system of
-Vault.
-
-## MFA types
-
-MFA in Vault can be of the following types.
-
-- `Time-based One-time Password (TOTP)` - If configured and enabled on a path,
-  this would require a TOTP passcode along with Vault token, to be presented
-  while invoking the API request. The passcode will be validated against the
-  TOTP key present in the identity of the caller in Vault.
-
-- `Okta` - If Okta push is configured and enabled on a path, then the enrolled
-  device of the user will get a push notification to approve or deny the access
-  to the API. The Okta username will be derived from the caller identity's
-  alias.
-
-- `Duo` - If Duo push is configured and enabled on a path, then the enrolled
-  device of the user will get a push notification to approve or deny the access
-  to the API. The Duo username will be derived from the caller identity's
-  alias.
-
-- `PingID` - If PingID push is configured and enabled on a path, then the
-  enrolled device of the user will get a push notification to approve or deny
-  the access to the API. The PingID username will be derived from the caller
-  identity's alias.
-
-## Configuring MFA methods
-
-MFA methods are globally managed within the `System Backend` using the HTTP API.
-Please see [MFA API](/vault/api-docs/system/mfa) for details on how to configure an MFA
-method.
-
-## MFA methods in policies
-
-MFA requirements on paths are specified as `mfa_methods` along with other ACL
-parameters.
-
-### Sample policy
-
-```hcl
-path "secret/foo" {
-  capabilities = ["read"]
-  mfa_methods  = ["dev_team_duo", "sales_team_totp"]
-}
-```
-
-The above policy grants `read` access to `secret/foo` only after _both_ the MFA
-methods `dev_team_duo` and `sales_team_totp` are validated.
-
-## Namespaces
-
-All MFA configurations must be configured in the root namespace. They can be
-referenced from ACL and Sentinel policies in any namespace via the method name
-and can be tied to a mount accessor in any namespace.
-
-When using [Sentinel
-EGPs](/vault/docs/enterprise/sentinel#endpoint-governing-policies-egps),
-any MFA configuration specified must be satisfied by all requests affected by
-the policy, which can be difficult if the configured paths spread across
-namespaces. One way to address this is to use a policy similar to the
-following, using `or` operators to allow MFA configurations tied to mount
-accessors in the various namespaces:
-
-```python
-import "mfa"
-
-has_mfa = rule {
-    mfa.methods.duons1.valid
-}
-
-has_mfa2 = rule {
-    mfa.methods.duons2.valid
-}
-
-main = rule {
-    has_mfa or has_mfa2
-}
-```
-
-When using TOTP, any user with ACL permissions can self-generate credentials.
-Admins can generate or destroy credentials only if the targeted entity is in
-the same namespace.
-
-## Supplying MFA credentials
-
-MFA credentials are retrieved from the `X-Vault-MFA` HTTP header. The format of
-the header is `mfa_method_name[:key[=value]]`. The items in the `[]` are
-optional.
-
-### Sample request
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --header "X-Vault-MFA:my_totp:695452" \
-    http://127.0.0.1:8200/v1/secret/foo
-```
-
-### API
-
-MFA can be managed entirely over the HTTP API. Please see [MFA API](/vault/api-docs/system/mfa) for more details.
diff --git a/website/content/docs/enterprise/mfa/mfa-duo.mdx b/website/content/docs/enterprise/mfa/mfa-duo.mdx
deleted file mode 100644
index bdafa5de009..00000000000
--- a/website/content/docs/enterprise/mfa/mfa-duo.mdx
+++ /dev/null
@@ -1,131 +0,0 @@
----
-layout: docs
-page_title: Duo MFA - MFA Support - Vault Enterprise
-description: Vault Enterprise supports Duo MFA type.
----
-
-# Duo MFA
-
-@include 'alerts/enterprise-only.mdx'
-
-This page demonstrates the Duo MFA on ACL'd paths of Vault.
-
-## Configuration
-
-1.  Enable the appropriate auth method:
-
-    ```text
-    $ vault auth enable userpass
-    ```
-
-1.  Fetch the mount accessor for the enabled auth method:
-
-    ```text
-    $ vault auth list -detailed
-    ```
-
-    The response will look like:
-
-    ```text
-    Path         Type        Accessor                  Plugin    Default TTL    Max TTL    Replication    Description
-    ----         ----        --------                  ------    -----------    -------    -----------    -----------
-    token/       token       auth_token_289703e9       n/a       system         system     replicated     token based credentials
-    userpass/    userpass    auth_userpass_54b8e339    n/a       system         system     replicated     n/a
-    ```
-
-1.  Configure Duo MFA:
-
-    ```text
-    $ vault write sys/mfa/method/duo/my_duo \
-        mount_accessor=auth_userpass_54b8e339 \
-        integration_key=BIACEUEAXI20BNWTEYXT \
-        secret_key=HIGTHtrIigh2rPZQMbguugt8IUftWhMRCOBzbuyz \
-        api_hostname=api-2b5c39f5.duosecurity.com
-    ```
-
-1.  Create a policy that gives access to secret through the MFA method created
-    above:
-
-    ```text
-    $ vault policy write duo-policy -<<EOF
-    path "secret/foo" {
-      capabilities = ["read"]
-      mfa_methods  = ["my_duo"]
-    }
-    EOF
-    ```
-
-1.  Create a user. MFA works only for tokens that have identity information on
-    them. Tokens created by logging in using auth methods will have the associated
-    identity information. Create a user in the `userpass` auth method and
-    authenticate against it:
-
-    ```text
-    $ vault write auth/userpass/users/testuser \
-        password=testpassword \
-        policies=duo-policy
-    ```
-
-1.  Create a login token:
-
-    ```text
-    $ vault write auth/userpass/login/testuser \
-        password=testpassword
-
-    Key                    Value
-    ---                    -----
-    token                  70f97438-e174-c03c-40fe-6bcdc1028d6c
-    token_accessor         a91d97f4-1c7d-6af3-e4bf-971f74f9fab9
-    token_duration         768h
-    token_renewable        true
-    token_policies         [default duo-policy]
-    token_meta_username    "testuser"
-    ```
-
-    Note that the CLI is not authenticated with the newly created token yet, we
-    did not call `vault login`, instead we used the login API to simply return a
-    token.
-
-1.  Fetch the entity ID from the token. The caller identity is represented by the
-    `entity_id` property of the token:
-
-    ```text
-    $ vault token lookup 70f97438-e174-c03c-40fe-6bcdc1028d6c
-
-    Key                 Value
-    ---                 -----
-    accessor            a91d97f4-1c7d-6af3-e4bf-971f74f9fab9
-    creation_time       1502245243
-    creation_ttl        2764800
-    display_name        userpass-testuser
-    entity_id           307d6c16-6f5c-4ae7-46a9-2d153ffcbc63
-    expire_time         2017-09-09T22:20:43.448543132-04:00
-    explicit_max_ttl    0
-    id                  70f97438-e174-c03c-40fe-6bcdc1028d6c
-    issue_time          2017-08-08T22:20:43.448543003-04:00
-    meta                map[username:testuser]
-    num_uses            0
-    orphan              true
-    path                auth/userpass/login/testuser
-    policies            [default duo-policy]
-    renewable           true
-    ttl                 2764623
-    ```
-
-1.  Login as the user:
-
-    ```text
-    $ vault login 70f97438-e174-c03c-40fe-6bcdc1028d6c
-    ```
-
-1.  Read a secret to trigger a Duo push. This will be a blocking call until
-    the push notification is either approved or declined:
-
-    ```text
-    $ vault read secret/foo
-
-    Key                 Value
-    ---                 -----
-    refresh_interval    768h
-    data                which can only be read after MFA validation
-    ```
diff --git a/website/content/docs/enterprise/mfa/mfa-okta.mdx b/website/content/docs/enterprise/mfa/mfa-okta.mdx
deleted file mode 100644
index 7fa58bfa69e..00000000000
--- a/website/content/docs/enterprise/mfa/mfa-okta.mdx
+++ /dev/null
@@ -1,129 +0,0 @@
----
-layout: docs
-page_title: Okta MFA - MFA Support - Vault Enterprise
-description: Vault Enterprise supports Okta MFA type.
----
-
-# Okta MFA
-
-@include 'alerts/enterprise-only.mdx'
-
-This page demonstrates the Okta MFA on ACL'd paths of Vault.
-
-## Configuration
-
-1.  Enable the appropriate auth method:
-
-    ```text
-    $ vault auth enable userpass
-    ```
-
-1.  Fetch the mount accessor for the enabled auth method:
-
-    ```text
-    $ vault auth list -detailed
-    ```
-
-    The response will look like:
-
-    ```text
-    Path         Type        Accessor                  Plugin    Default TTL    Max TTL    Replication    Description
-    ----         ----        --------                  ------    -----------    -------    -----------    -----------
-    token/       token       auth_token_289703e9       n/a       system         system     replicated     token based credentials
-    userpass/    userpass    auth_userpass_54b8e339    n/a       system         system     replicated     n/a
-    ```
-
-1.  Configure Okta MFA:
-
-    ```text
-    $ vault write sys/mfa/method/okta/my_okta \
-        mount_accessor=auth_userpass_54b8e339 \
-        org_name="dev-262775" \
-        api_token="0071u8PrReNkzmATGJAP2oDyIXwwveqx9vIOEyCZDC"
-    ```
-
-1.  Create a policy that gives access to secret through the MFA method created
-    above:
-
-    ```text
-    $ vault policy write okta-policy -<<EOF
-    path "secret/foo" {
-      capabilities = ["read"]
-      mfa_methods  = ["my_okta"]
-    }
-    EOF
-    ```
-
-1.  Create a user. MFA works only for tokens that have identity information on
-    them. Tokens created by logging in using auth methods will have the associated
-    identity information. Create a user in the `userpass` auth method and
-    authenticate against it:
-
-    ```text
-    $ vault write auth/userpass/users/testuser \
-        password=testpassword \
-        policies=okta-policy
-    ```
-
-1.  Create a login token:
-
-    ```text
-    $ vault write auth/userpass/login/testuser password=testpassword
-
-    Key                    Value
-    ---                    -----
-    token                  70f97438-e174-c03c-40fe-6bcdc1028d6c
-    token_accessor         a91d97f4-1c7d-6af3-e4bf-971f74f9fab9
-    token_duration         768h0m0s
-    token_renewable        true
-    token_policies         [default okta-policy]
-    token_meta_username    "testuser"
-    ```
-
-    Note that the CLI is not authenticated with the newly created token yet, we
-    did not call `vault login`, instead we used the login API to simply return a
-    token.
-
-1.  Fetch the entity ID from the token. The caller identity is represented by the
-    `entity_id` property of the token:
-
-    ```text
-    $ vault token lookup 70f97438-e174-c03c-40fe-6bcdc1028d6c
-
-    Key                     Value
-    ---                     -----
-    accessor                a91d97f4-1c7d-6af3-e4bf-971f74f9fab9
-    creation_time           1502245243
-    creation_ttl            2764800
-    display_name            userpass-testuser
-    entity_id               307d6c16-6f5c-4ae7-46a9-2d153ffcbc63
-    expire_time             2017-09-09T22:20:43.448543132-04:00
-    explicit_max_ttl        0
-    id                      70f97438-e174-c03c-40fe-6bcdc1028d6c
-    issue_time              2017-08-08T22:20:43.448543003-04:00
-    meta                    map[username:testuser]
-    num_uses                0
-    orphan                  true
-    path                    auth/userpass/login/testuser
-    policies                [default okta-policy]
-    renewable               true
-    ttl                     2764623
-    ```
-
-1.  Login as the user:
-
-    ```text
-    $ vault login 70f97438-e174-c03c-40fe-6bcdc1028d6c
-    ```
-
-1.  Read a secret to trigger an Okta push. This will be a blocking call until
-    the push notification is either approved or declined:
-
-    ```text
-    $ vault read secret/foo
-
-    Key                     Value
-    ---                     -----
-    refresh_interval        768h0m0s
-    data                    which can only be read after MFA validation
-    ```
diff --git a/website/content/docs/enterprise/mfa/mfa-pingid.mdx b/website/content/docs/enterprise/mfa/mfa-pingid.mdx
deleted file mode 100644
index 77581babaaf..00000000000
--- a/website/content/docs/enterprise/mfa/mfa-pingid.mdx
+++ /dev/null
@@ -1,128 +0,0 @@
----
-layout: docs
-page_title: PingID MFA - MFA Support - Vault Enterprise
-description: Vault Enterprise supports PingID MFA type.
----
-
-# PingID MFA
-
-@include 'alerts/enterprise-only.mdx'
-
-This page demonstrates PingID MFA on ACL'd paths of Vault.
-
-## Configuration
-
-1. Enable the appropriate auth method:
-
-   ```text
-   $ vault auth enable userpass
-   ```
-
-1. Fetch the mount accessor for the enabled auth method:
-
-   ```text
-   $ vault auth list -detailed
-   ```
-
-   The response will look like:
-
-   ```text
-   Path         Type        Accessor                  Plugin    Default TTL    Max TTL    Replication    Description
-   ----         ----        --------                  ------    -----------    -------    -----------    -----------
-   token/       token       auth_token_289703e9       n/a       system         system     replicated     token based credentials
-   userpass/    userpass    auth_userpass_54b8e339    n/a       system         system     replicated     n/a
-   ```
-
-1. Configure PingID MFA:
-
-   ```text
-   $ vault write sys/mfa/method/pingid/ping \
-       mount_accessor=auth_userpass_54b8e339 \
-       settings_file_base64="AABDwWaR..."
-   ```
-
-1. Create a policy that gives access to secret through the MFA method created
-   above:
-
-   ```
-   $ vault policy write ping-policy -<<EOF
-   path "secret/foo" {
-     capabilities = ["read"]
-     mfa_methods  = ["ping"]
-   }
-   EOF
-   ```
-
-1. Create a user. MFA works only for tokens that have identity information on
-   them. Tokens created by logging in using auth methods will have the associated
-   identity information. Create a user in the `userpass` auth method and
-   authenticate against it:
-
-   ```text
-   $ vault write auth/userpass/users/testuser \
-       password=testpassword \
-       policies=ping-policy
-   ```
-
-1. Create a login token:
-
-   ```text
-   $ vault write auth/userpass/login/testuser password=testpassword
-
-   Key                    Value
-   ---                    -----
-   token                  70f97438-e174-c03c-40fe-6bcdc1028d6c
-   token_accessor         a91d97f4-1c7d-6af3-e4bf-971f74f9fab9
-   token_duration         768h0m0s
-   token_renewable        true
-   token_policies         [default ping-policy]
-   token_meta_username    "testuser"
-   ```
-
-   Note that the CLI is not authenticated with the newly created token yet, we
-   did not call `vault login`, instead we used the login API to simply return a
-   token.
-
-1. Fetch the entity ID from the token. The caller identity is represented by the
-   `entity_id` property of the token:
-
-   ```text
-   $ vault token lookup 70f97438-e174-c03c-40fe-6bcdc1028d6c
-
-   Key                 Value
-   ---                 -----
-   accessor            a91d97f4-1c7d-6af3-e4bf-971f74f9fab9
-   creation_time       1502245243
-   creation_ttl        2764800
-   display_name        userpass-testuser
-   entity_id           307d6c16-6f5c-4ae7-46a9-2d153ffcbc63
-   expire_time         2017-09-09T22:20:43.448543132-04:00
-   explicit_max_ttl    0
-   id                  70f97438-e174-c03c-40fe-6bcdc1028d6c
-   issue_time          2017-08-08T22:20:43.448543003-04:00
-   meta                map[username:testuser]
-   num_uses            0
-   orphan              true
-   path                auth/userpass/login/testuser
-   policies            [default ping-policy]
-   renewable           true
-   ttl                 2764623
-   ```
-
-1. Login as the user:
-
-   ```text
-   $ vault login 70f97438-e174-c03c-40fe-6bcdc1028d6c
-   ```
-
-1. Read a secret to trigger a PingID push. This will be a blocking call until
-   the push notification is either approved or declined:
-
-   ```text
-   $ vault read secret/foo
-
-   Key                 Value
-   ---                 -----
-   refresh_interval    768h
-   data                which can only be read after MFA validation
-   ```
diff --git a/website/content/docs/enterprise/mfa/mfa-totp.mdx b/website/content/docs/enterprise/mfa/mfa-totp.mdx
deleted file mode 100644
index 3e2cc7129ff..00000000000
--- a/website/content/docs/enterprise/mfa/mfa-totp.mdx
+++ /dev/null
@@ -1,150 +0,0 @@
----
-layout: docs
-page_title: TOTP MFA - MFA Support - Vault Enterprise
-description: Vault Enterprise supports TOTP MFA type.
----
-
-# TOTP MFA
-
-@include 'alerts/enterprise-only.mdx'
-
-This page demonstrates the TOTP MFA on ACL'd paths of Vault.
-
-## Configuration
-
-1.  Enable the appropriate auth method:
-
-    ```text
-    $ vault auth enable userpass
-    ```
-
-1.  Fetch the mount accessor for the enabled auth method:
-
-    ```text
-    $ vault auth list -detailed
-    ```
-
-    The response will look like:
-
-    ```text
-    Path         Type        Accessor                  Plugin    Default TTL    Max TTL    Replication    Description
-    ----         ----        --------                  ------    -----------    -------    -----------    -----------
-    token/       token       auth_token_289703e9       n/a       system         system     replicated     token based credentials
-    userpass/    userpass    auth_userpass_54b8e339    n/a       system         system     replicated     n/a
-    ```
-
-1.  Configure TOTP MFA:
-
-    -> **Note**: Consider the algorithms supported by your authenticator. For example, Google Authenticator for Android supports only SHA1 as the value of `algorithm`.
-
-    ```text
-    $ vault write sys/mfa/method/totp/my_totp \
-        issuer=Vault \
-        period=30 \
-        key_size=30 \
-        algorithm=SHA256 \
-        digits=6
-    ```
-
-1.  Create a policy that gives access to secret through the MFA method created
-    above:
-
-    ```text
-    $ vault policy write totp-policy -<<EOF
-    path "secret/foo" {
-      capabilities = ["read"]
-      mfa_methods  = ["my_totp"]
-    }
-    EOF
-    ```
-
-1.  Create a user. MFA works only for tokens that have identity information on
-    them. Tokens created by logging in using auth methods will have the associated
-    identity information. Create a user in the `userpass` auth method and
-    authenticate against it:
-
-    ```text
-    $ vault write auth/userpass/users/testuser \
-        password=testpassword \
-        policies=totp-policy
-    ```
-
-1.  Create a login token:
-
-    ```text
-    $ vault write auth/userpass/login/testuser \
-        password=testpassword
-
-    Key                    Value
-    ---                    -----
-    token                  70f97438-e174-c03c-40fe-6bcdc1028d6c
-    token_accessor         a91d97f4-1c7d-6af3-e4bf-971f74f9fab9
-    token_duration         768h
-    token_renewable        true
-    token_policies         [default totp-policy]
-    token_meta_username    "testuser"
-    ```
-
-    Note that the CLI is not authenticated with the newly created token yet, we
-    did not call `vault login`, instead we used the login API to simply return a
-    token.
-
-1.  Fetch the entity ID from the token. The caller identity is represented by the
-    `entity_id` property of the token:
-
-    ```text
-    $ vault token lookup 70f97438-e174-c03c-40fe-6bcdc1028d6c
-
-    Key                 Value
-    ---                 -----
-    accessor            a91d97f4-1c7d-6af3-e4bf-971f74f9fab9
-    creation_time       1502245243
-    creation_ttl        2764800
-    display_name        userpass-testuser
-    entity_id           307d6c16-6f5c-4ae7-46a9-2d153ffcbc63
-    expire_time         2017-09-09T22:20:43.448543132-04:00
-    explicit_max_ttl    0
-    id                  70f97438-e174-c03c-40fe-6bcdc1028d6c
-    issue_time          2017-08-08T22:20:43.448543003-04:00
-    meta                map[username:testuser]
-    num_uses            0
-    orphan              true
-    path                auth/userpass/login/testuser
-    policies            [default totp-policy]
-    renewable           true
-    ttl                 2764623
-    ```
-
-1.  Generate TOTP method attached to the entity. This should be distributed to
-    the intended user to be able to generate TOTP passcode:
-
-    ```text
-    $ vault write sys/mfa/method/totp/my_totp/admin-generate \
-        entity_id=307d6c16-6f5c-4ae7-46a9-2d153ffcbc63
-
-    Key        Value
-    ---        -----
-    barcode    iVBORw0KGgoAAAANSUhEUgAAAM...
-    url        otpauth://totp/Vault:307d6c16-6f5c-4ae7-46a9-2d153ffcbc63?algo...
-    ```
-
-    Either the base64 encoded png barcode or the url should be given to the end
-    user. This barcode/url can be loaded into Google Authenticator or a similar
-    TOTP tool to generate codes.
-
-1.  Login as the user:
-
-    ```text
-    $ vault login 70f97438-e174-c03c-40fe-6bcdc1028d6c
-    ```
-
-1.  Read the secret, specifying the mfa flag:
-
-    ```text
-    $ vault read -mfa my_totp:146378 secret/data/foo
-
-    Key                 Value
-    ---                 -----
-    refresh_interval    768h
-    data                which can only be read after MFA validation
-    ```
diff --git a/website/content/docs/enterprise/namespaces/create-admin-namespace.mdx b/website/content/docs/enterprise/namespaces/create-admin-namespace.mdx
deleted file mode 100644
index bdfa2a0e7fe..00000000000
--- a/website/content/docs/enterprise/namespaces/create-admin-namespace.mdx
+++ /dev/null
@@ -1,120 +0,0 @@
----
-layout: docs
-page_title: Configure an administrative namespace
-description: >-
-  Step-by-step guide for setting up an administrative namespace with Vault
-  Enterprise
----
-
-# Create an administrative namespace <EnterpriseAlert product=vault inline=true />
-
-Grant access to a predefined subset of privileged system backend endpoints in
-the Vault API with an administrative namespace.
-
-<Tip title="HCP Vault has a built-in administrative namespace">
-
-  HCP Vault clusters include an administrative namespace (`admin`) by default.
-  For more information on managing namespaces with HCP Vault, refer to the
-  [HCP Vault namespace considerations](/vault/tutorials/cloud-ops/hcp-vault-namespace-considerations)
-  guide.
-
-</Tip>
-
-## Before you start
-
-- **You must have Vault Enterprise 1.15+ installed and running**.
-- **You must have access to your Vault configuration file**.
-- **You must have permission to create and manage namespaces for your Vault instance**.
-
-## Step 1: Create your namespace
-
-Use the `namespace create` CLI command to create a new namespace: 
-
-```shell-session
-$ vault namespace create YOUR_NAMESPACE_NAME
-```
-
-For example, to create a namespace called "ns_admin" under the root namespace:
-
-<CodeBlockConfig hideClipboard>
-
-```shell-session
-$ vault namespace create ns_admin
-```
-
-</CodeBlockConfig>
-
-## Step 2: Give the namespace admin permission
-
-To create an administrative namespace, set the `administrative_namespace_path`
-parameter in your Vault configuration with the absolute path of your new
-namespace. We recommend setting the namespace path with the other string
-assignments in your configuration file. For example: 
-
-<CodeBlockConfig highlight="3">
-
-```hcl 
-ui = true
-api_addr = "https://127.0.0.1:8200"
-administrative_namespace_path = "ns_admin/"
-```
-
-</CodeBlockConfig>
-
-## Step 3: Verify the new permissions
-
-To verify permissions for the administrative namespace, compare API responses
-from a restricted endpoint from your new namespace and another namespace without
-elevated permissions.
-
-1. If you do not already have a namespace you can use for testing, create a test
-   namespace called "ns_test" with the `namespace create` CLI command:
-    ```shell-session
-    $ vault namespace create ns_test
-    ```
-1. Use the `monitor` CLI command to call the `/sys/monitor` endpoint from your
-   test namespace:
-    ```shell-session
-    $ env VAULT_NAMESPACE="ns_test" vault monitor –log-level=debug
-    ```
-   You should see an unsupported path error:
-
-    <CodeBlockConfig hideClipboard>
-
-    ```shell-session
-    $ env VAULT_NAMESPACE="ns_test" vault monitor –log-level=debug
-
-    Error starting monitor: Error making API request.
-    Namespace: ns_test/
-    URL: GET http://127.0.0.1:8400/v1/sys/monitor?log_format=standard&log_level=debug
-    Code: 404. Errors:
-    * 1 error occurred:
-      * unsupported path
-    ```
-
-    </CodeBlockConfig>
-
-1. Now use the `monitor` command to call the `sys/monitor` endpoint from your
-   administrative namespace:
-    ```shell-session
-    $ env VAULT_NAMESPACE="ns_admin" vault monitor –log-level=debug
-    ```
-   You should see log data from your Vault instance streaming to the terminal:
-
-    <CodeBlockConfig hideClipboard>
-
-    ```shell-session
-    $ env VAULT_NAMESPACE="ns_admin" vault monitor –log-level=debug
-
-    2023-08-31T11:54:41.846+0200 [DEBUG] replication.index.perf: saved checkpoint: num_dirty=0
-    2023-08-31T11:54:41.961+0200 [DEBUG] replication.index.local: saved checkpoint: num_dirty=0
-    ```
-
-    </CodeBlockConfig>
-
-## Next steps
-
-- Follow the [Secure multi-tenancy with namespaces](/vault/tutorials/enterprise/namespaces)
-  tutorial to provide additional security and ensure teams can self-manage their
-  own environments.
-- Read more about [managing namespaces in Vault Enterprise](/vault/docs/enterprise/namespaces).
\ No newline at end of file
diff --git a/website/content/docs/enterprise/namespaces/index.mdx b/website/content/docs/enterprise/namespaces/index.mdx
deleted file mode 100644
index dddf1e73475..00000000000
--- a/website/content/docs/enterprise/namespaces/index.mdx
+++ /dev/null
@@ -1,165 +0,0 @@
----
-layout: docs
-page_title: Namespaces - Vault Enterprise
-description: >-
-  Vault Enterprise has support for Namespaces, a feature to enable Secure
-  Multi-tenancy (SMT) and self-management.
----
-
-# Vault Enterprise namespaces <EnterpriseAlert product=vault inline=true />
-
-Many organizations implement Vault as a service to provide centralized
-management of sensitive data and ensure that the different teams in an
-organization operate within isolated environments known as **tenants**.
-
-Multi-tenant environments have the following implementation challenges:
-
-- **Tenant isolation**. Teams within a Visualization as a Service (VaaS)
-  environment require strong isolation for their policies, secrets, and
-  identities. Tenant isolation may also be required due to organizational
-  security and privacy requirements or to address compliance regulations like
-  [GDPR](https://gdpr.eu).
-- **Long-term management**. Tenants typically have different policies and teams
-  request changes to their tenants at different rates. As a result, managing a
-  multi-tenant environment can become difficult for a single team as the number
-  of tenants within the organization grows.
-
-Namespaces support secure multi-tenancy (**SMT**) within a single Vault
-Enterprise instance with tenant isolation and administration delegation so Vault
-administrators can empower delegates to manage their own tenant environment.
-
-When you create a namespace, you establish an isolated environment with separate
-login paths that functions as a mini-Vault instance within your Vault
-installation. Users can then create and manage their sensitive data within the
-confines of that namespace, including:
-
-- secret engines
-- authentication methods
-- ACL, EGP, and RGP policies
-- password policies
-- entities
-- identity groups
-- tokens
-
-<Tip>
-
-  Namespaces are isolated environments, but Vault administrators can still share
-  and enforce global policies across namespaces with the
-  [group-policy-application](/vault/api-docs/system/config-group-policy-application)
-  endpoint of the Vault API.
-
-</Tip>
-
-## Namespace naming restrictions
-
-Valid Vault namespace names:
-
-- **CANNOT** end with `/`
-- **CANNOT** contain spaces
-- **CANNOT** be one of the following reserved strings:
-  - `root`
-  - `sys`
-  - `audit`
-  - `auth`
-  - `cubbyhole`
-  - `identity`
-
-Refer to the [Namespace limits section](/vault/docs/internals/limits#namespace-limits)
-of [Vault limits and maximums](/vault/docs/internals/limits) for storage limits
-related to managing namespaces.
-
-<Tip title="Related reading">
-
-  Read the
-  [Vault namespace and mount structuring](/vault/tutorials/enterprise/namespace-structure)
-  tutorial for best practices and recommendations for structuring your namespaces.
-
-</Tip>
-
-## Child namespaces
-
-A **child namespace** is any namespace that exists entirely within the scope of
-another namespace. The containing namespace is the **parent namespace**. For 
-example, given the namespace path `A/B/C`:
-
-- `A` is the top-most namespace and exists under the root namespace for the
-  Vault instance.
-- `B` is a child namespace of `A` and the parent namespace of `C`.
-- `C` is a child namespace of `B` and the grandchild namespace of `A`.
-
-Children can inherit elements from their parent namespaces. For example,
-policies for a child namespace might reference entities or groups from the parent
-namespace. Parent namespaces can also **assert** policies on identities within
-a child namespace. 
-
-Vault administrators can configure the desired inheritance behavior with the
-[group-policy-application](/vault/api-docs/system/config-group-policy-application)
-endpoint of the Vault API.
- 
-## Delegation and administrative namespaces
-
-Vault system administrators can assign administration rights to delegate
-admins to allow teams to self-manage their namespace. In addition to basic
-management, delegate admins can create child namespaces and assign admin rights
-to subordinate delegate admins.
-
-Additionally,
-[administrative namespaces](/vault/docs/enterprise/namespaces/create-admin-namespace)
-let Vault administrators grant access to a
-[predefined subset of privileged endpoints](#privileged-endpoints) by setting
-the relevant namespace parameters in their Vault configuration file.
-
-## Vault API and namespaces
-
-Users can perform API operations under a specific namespace by setting the
-`X-Vault-Namespace` header to the absolute or relative namespace path. Relative
-namespace paths are assumed to be child namespaces of the calling namespace.
-You can also provide an absolute namespace path without using the
-`X-Vault-Namespace` header.
-
-Vault constructs the fully qualified namespace path based on the calling
-namespace and the `X-Vault` header to route the request to the
-appropriate namespace. For example, the following requests all route to the
-`ns1/ns2/secret/foo` namespace:
-
-1. Path: `ns1/ns2/secret/foo`
-2. Path: `secret/foo`, Header: `X-Vault-Namespace: ns1/ns2/`
-3. Path: `ns2/secret/foo`, Header: `X-Vault-Namespace: ns1/`
-
-<Tip title="Vault Enterprise has a namespaces API">
-
-  Use the [/sys/namespaces](/vault/api-docs/system/namespaces) API or
-  [`namespace`](/vault/docs/commands/namespace) CLI command to manage
-  your namespaces.
-
-</Tip>
-
-## Restricted API paths
-
-The Vault API includes system backend endpoints, which are mounted under the
-`sys/` path. System endpoints let you interact with the internal features of
-your Vault instance.
-
-By default, Vault allows non-root calls to the less-sensitive system backend
-endpoints. But, for security reasons, Vault restricts access to some of the
-system backend endpoints to calls from the root namespace or calls that use a
-token in the root namespace with elevated permissions.
-
-Rather than granting access to the full set of  privileged `sys/` paths, Vault
-administrators can also grant access to a predefined subset of the restricted
-endpoints with an administrative namespace.
-
-@include 'api/restricted-endpoints.mdx'
-
-## Learn more
-
-Refer to the following tutorials to learn more about Vault namespaces:
-
-- [Secure Multi-Tenancy with Namespaces](/vault/tutorials/enterprise/namespaces)
-- [Secrets Management Across Namespaces without Hierarchical
-  Relationship](/vault/tutorials/enterprise/namespaces-secrets-sharing)
-- [Vault Namespace and Mount Structuring
-  Guide](/vault/tutorials/enterprise/namespace-structure)
-- [HCP Vault namespace
-  considerations](/vault/tutorials/cloud-ops/hcp-vault-namespace-considerations)
-- [Using many Namespaces](/vault/docs/enterprise/namespaces/namespace-limits)
diff --git a/website/content/docs/enterprise/namespaces/namespace-limits.mdx b/website/content/docs/enterprise/namespaces/namespace-limits.mdx
deleted file mode 100644
index 8f9b1830130..00000000000
--- a/website/content/docs/enterprise/namespaces/namespace-limits.mdx
+++ /dev/null
@@ -1,137 +0,0 @@
----
-layout: docs
-page_title: Run Vault Enterprise with many namespaces
-description: >-
-  Guidance for using thousands of namespaces with Vault Enterprise
----
-
-# Run Vault Enterprise with many namespaces
-
-Use namespaces to create isolated environments within Vault Enterprise.
-By default, Vault limits the number and depth of namespaces based on your
-storage configuration. The information below provides guidance on how to modify
-your namespace limits and what expect when operating a Vault cluster with 7000+
-namespaces.
-
-## Default namespace limits
-
-@include 'namespace-limits.mdx'
-
-## How to modify your namespace limit
-
-@include 'storage-entry-size.mdx'
-
-## Performance considerations
-
-Running Vault with thousands of namespaces can have operational impacts on a
-cluster. Below are some performance considerations to take into account before
-using thousands of namespaces.
-
-It is **not** recommended to use thousands of namespaces with any version of Vault
-lower than 1.13.9, 1.14.5, or 1.15.0. Improvements were released in those
-versions which can improve the reliability of Raft heartbeats when using many
-namespaces.
-
-<Note title="Testing parameters">
-
-  The aggregated performance data below assumes a 3-node Vault cluster running
-  on N2 standard VMs with Google Kubernetes Engine, default mounts, and
-  integrated storage. The results average metrics from multiple `n2-standard-16`
-  and `n2-standard-32` VMs with a varying number of namespaces.
-
-</Note>
-
-### Unseal times
-
-Vault sets up and initializes every mount after an unseal event. At minimum,
-the initialization process includes the default mounts for all active namespaces
-(`sys`, `identity`, `cubbyhole`, and `token`).
-
-The more namespaces and custom mounts in the deployment, the longer the
-post-unseal initialization takes. As a result, **even with auto-unseal**, Vault
-will be unresponsive during initialization for deployments with many namespaces.
-
-Post-unseal times observed during testing:
-
-| Number of namespaces | Unseal initialization time  |
-|----------------------|-------------------|
-| 10                   | ~5 seconds        |
-| 10000                | ~2-3 minutes      |
-| 20000                | ~12-14 minutes    |
-| 30000                | ~33-36 minutes    |
-
-
-### Cluster leadership transfer times
-
-Vault high availability clusters have a leader (also known as an active node)
-which is the server that accepts writes to the cluster and replicates the
-written data to the follower nodes. If the leader crashes or needs to be removed
-from the cluster, one of the follower nodes must take over leadership. This is
-known as a leadership transfer.
-
-Whenever a leadership transfer happens, the new active node must go through all
-of the mounts in the cluster and set them up before the node can be ready to be
-the leader. Because every namespace has at least 4 mounts (`sys`, `identity`,
-`cubbyhole`, and `token`), the time for a leadership transfer to complete will
-increase with the number of namespaces.
-
-Leadership transfer times observed for the [`vault operator step-down`](/vault/docs/commands/operator/step-down)
-command:
-
-| Number of namespaces | Time until a node is elected as leader |
-|----------------------|----------------------------------------|
-| 10                   | ~2 seconds                             |
-| 10000                | ~33-45 seconds                         |
-| 20000                | ~1-2 minutes                           |
-| 30000                | ~4 minutes                             |
-
-## System requirements
-
-### Minimum memory requirements
-
-Each namespace requires at least 435 KB of memory to store information
-about the paths available within the namespace. Given `N` namespaces, your
-Vault deployment must include at least (435 x N) KB memory for namespace support
-to avoid degraded performance.
-
-### Rollback and rotation worker requirements
-
-Sometimes, Vault secret and auth engines need to clean up data after a request
-is canceled or a request fails halfway through. Vault issues rollback operations
-every minute to each mount in order to periodically trigger the clean up
-process.
-
-By default, Vault uses 256 workers to perform rollback operations. Mounts with a
-large number of namespaces can become bottlenecks that slow down the overall
-rollback process. The effects of the slowdown vary based on the particular
-mounts. At minimum, your Vault deployment will take longer to fully purge stale
-data and periodic rotations may happen less frequently than intended.
-
-You can tell whether the number of rollback workers is sufficient by monitoring
-the following metrics:
-
-| Expected range | Metric                                                                                           |
-|----------------|--------------------------------------------------------------------------------------------------|
-| 0 – 256        | [`vault.rollback.queued`](/vault/docs/internals/telemetry/metrics/core-system#rollback-metrics)  |
-| 0 – 60000      | [`vault.rollback.waiting`](/vault/docs/internals/telemetry/metrics/core-system#rollback-metrics) |
-
-## Identity secret engine warnings
-
-When using OIDC with many namespaces, you may see warnings in your Vault logs
-from the `identity` secret mount under the `root` namespace. For example:
-
-```text
-2023-10-24T15:47:56.594Z [WARN]  secrets.identity.identity_51eb2411: error expiring OIDC public keys: err="context deadline exceeded"
-2023-10-24T15:47:56.594Z [WARN]  secrets.identity.identity_51eb2411: error rotating OIDC keys: err="context deadline exceeded"
-```
-
-The `secrets.identity` warnings occur because the root namespace is responsible
-for rotating the [OIDC keys](/vault/docs/secrets/identity/oidc-provider) of all
-other namespaces.
-
-<Warning title="Avoid OIDC with many namespaces">
-
-  Using Vault as an [OIDC provider](/vault/docs/concepts/oidc-provider) with
-  many namespaces can severely delay the rotation and invalidation of OIDC keys.
-
-</Warning>
diff --git a/website/content/docs/enterprise/performance-standby.mdx b/website/content/docs/enterprise/performance-standby.mdx
deleted file mode 100644
index 91dc4eab1fc..00000000000
--- a/website/content/docs/enterprise/performance-standby.mdx
+++ /dev/null
@@ -1,92 +0,0 @@
----
-layout: docs
-page_title: Performance Standby Nodes - Vault Enterprise
-description: Performance Standby Nodes - Vault Enterprise
----
-
-# Performance standby nodes
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-Vault supports a multi-server mode for high availability. This mode protects
-against outages by running multiple Vault servers. High availability mode
-is automatically enabled when using a data store that supports it. You can
-learn more about HA mode on the [Concepts](/vault/docs/concepts/ha) page.
-
-Vault Enterprise offers additional features that allow HA nodes to service
-read-only requests on the local standby node. Read-only requests are requests
-that do not modify Vault's storage.
-
-## Server-to-Server communication
-
-Performance Standbys require the request forwarding method described in the [HA
-Server-to-Server](/vault/docs/concepts/ha#server-to-server-communication) docs.
-Unlike regular standby nodes, performance standbys will **not** respect the
-`X-Vault-No-Request-Forwarding` header.
-
-A performance standby will connect to the active node over the existing request
-forwarding connection. If selected by the active node to be promoted to a
-performance standby it will be handed a newly-generated private key and certificate
-for use in creating a new mutually-authenticated TLS connection to the cluster
-port. This connection will be used to send updates from the active node to the
-standby.
-
-## Request forwarding
-
-A Performance Standby will attempt to process requests that come in. If a
-storage write is detected the standby will forward the request over the cluster
-port connection to the active node. If the request is read-only the Performance
-Standby will handle the requests locally.
-
-Sending requests to Performance Standbys that result in forwarded writes will be
-slightly slower than going directly to the active node. A client that has
-advanced knowledge of the behavior of the call can choose to point the request
-to the appropriate node.
-
-### Direct access
-
-A Performance Standby will tag itself as such in consul if service registration
-is enabled. To access the set of Performance Standbys the `performance-standby`
-tag can be used. For example to send requests to only the performance standbys
-`https://performance-standby.vault.dc1.consul` could be used (host name may vary
-based on consul configuration).
-
-### Behind load balancers
-
-Additionally, if you wish to point your load balancers at performance standby
-nodes, the `sys/health` endpoint can be used to determine if a node is a
-performance standby. See the [sys/health API](/vault/api-docs/system/health) docs for
-more info.
-
-## Disabling performance standbys
-
-To disable performance standbys the `disable_performance_standby` flag should be
-set to true in the Vault config file. This will both tell a standby not to
-attempt to enable performance mode and an active node to not allow any
-performance standby connections.
-
-This setting should be synced across all nodes in the cluster.
-
-## Monitoring performance standbys
-
-To verify your node is a performance standby the `vault status` command can be
-used:
-
-```shell-session
-$ vault status
-Key                                    Value
----                                    -----
-Seal Type                              shamir
-Sealed                                 false
-Total Shares                           1
-Threshold                              1
-Version                                0.11.0+ent
-Cluster Name                           vault-cluster-d040e74c
-Cluster ID                             9f82e03b-71fb-97a6-9c5a-46fa6715d6e4
-HA Enabled                             true
-HA Cluster                             https://127.0.0.1:8201
-HA Mode                                standby
-Active Node Address                    http://127.0.0.1:8200
-Performance Standby Node               true
-Performance Standby Last Remote WAL    380329
-```
diff --git a/website/content/docs/enterprise/pkcs11-provider/aws-xks.mdx b/website/content/docs/enterprise/pkcs11-provider/aws-xks.mdx
deleted file mode 100644
index 81cac0db6da..00000000000
--- a/website/content/docs/enterprise/pkcs11-provider/aws-xks.mdx
+++ /dev/null
@@ -1,287 +0,0 @@
----
-layout: docs
-page_title: AWS KMS External Key Store (XKS) - PKCS#11 Provider - Vault Enterprise
-description: |-
-  AWS KMS External Key Store can use Vault as a key store via the Vault PKCS#11 Provider.
----
-
-# Vault with AWS KMS external key store (XKS) via PKCS#11 and XKS proxy
-
-@include 'alerts/enterprise-only.mdx'
-
-~> **Note**: AWS [`xks-proxy`](https://github.com/aws-samples/aws-kms-xks-proxy) is used in this document as a sample implementation.
-
-Vault's KMIP Secrets Engine can be used as an external key store for the AWS KMS [External Key Store (XKS)](https://aws.amazon.com/blogs/aws/announcing-aws-kms-external-key-store-xks/) protocol using the AWS [`xks-proxy`](https://github.com/aws-samples/aws-kms-xks-proxy) along
-with the [Vault PKCS#11 Provider](/vault/docs/enterprise/pkcs11-provider).
-
-## Overview
-
-This is tested as working with Vault 1.11.0 Enterprise (and later) with Advanced Data Protection (KMIP support).
-
-Prerequisites:
-
-* A server capable of running XKS Proxy on port 443, which is exposed to the Internet or a VPC endpoint. This can be the same as the Vault server.
-* A valid DNS entry with a valid TLS certificate for XKS Proxy.
-* `libvault-pkcs11.so` downloaded from [releases.hashicorp.com](https://releases.hashicorp.com/vault-pkcs11-provider) for your platform and available on the XKS Proxy server.
-* Vault Enterprise with the KMIP Secrets Engine available and with TCP port 5696 accessible to where XKS Proxy will be running.
-
-There are 3 parts to this setup:
-
-1. Vault KMIP Secrets Engine standard setup. (There is nothing specific to XKS in this setup.)
-1. Vault PKCS#11 setup to tell the PKCS#11 provider (`libvault-pkcs11.so`) how to talk to the Vault KMIP Secrets Engine. (There is nothing specific to XKS in this setup.)
-1. XKS Proxy setup.
-
-~> **Important**: XKS has a strict 250 ms latency requirement.
-In order to serve requests with this latency, we recommend hosting Vault and the XKS proxy as close as possible
-to the desired KMS region.
-
-## Vault setup
-
-On the Vault server, we need to [setup the KMIP Secrets Engine](/vault/docs/secrets/kmip):
-
-1. Start the [KMIP Secrets Engine](/vault/docs/secrets/kmip) and listener:
-
-    ```sh
-    vault secrets enable kmip
-    vault write kmip/config listen_addrs=0.0.0.0:5696
-    ```
-
-1. Create a KMIP scope to contain the AES keys that will be accessible.
-   The KMIP scope is essentially an isolated namespace.
-   Here is an example creating one called `my-service` (which will be used throughout this document).
-
-    ```sh
-    vault write -f kmip/scope/my-service
-    ```
-
-1. Create a KMIP role that has access to the scope:
-
-    ```sh
-    vault write kmip/scope/my-service/role/admin operation_all=true
-    ```
-
-1. Create TLS credentials (a certificate, key, and CA bundle) for the KMIP role:
-
-    ~> **Note**: This command will output the credentials in plaintext.
-
-    ```sh
-    vault write -f -format=json kmip/scope/my-service/role/admin/credential/generate | tee kmip.json
-    ```
-
-    The response from the `credential/generate` endpoint is JSON.
-    The `.data.certificate` entry contains a bundle of the TLS client key and certificate we will use to connect to KMIP with from `xks-proxy`.
-    The `.data.ca_chain[]` entries contain the CA bundle to verify the KMIP server's certificate.
-    Save these to, e.g., `cert.pem` and `ca.pem`:
-
-    ```sh
-    jq --raw-output --exit-status '.data.ca_chain[]' kmip.json > ca.pem
-    jq --raw-output --exit-status '.data.certificate' kmip.json > cert.pem
-    ```
-
-## XKS proxy setup
-
-The rest of the steps take place on the XKS Proxy server.
-
-For this example, We will use an HTTPS proxy service like [ngrok](https://ngrok.com/) to forward connections
-to the XKS proxy. This helps to quickly setup a valid domain and TLS endpoint for testing.
-
-1. Start `ngrok`:
-
-   ```shell-session
-   $ ngrok http 8000
-   ```
-
-   This will output a domain that can be used to configure KMS later, such as `https://example.ngrok.io`.
-
-1. Copy the `libvault-pkcs11.so` binary to the server, such as `/usr/local/lib` (should be same as in the TOML config file below), and `chmod` it so that it is executable.
-
-1. Copy the TLS certificate bundle (e.g., `/etc/kmip/cert.pem`) and CA bundle (e.g., `/etc/kmip/ca.pem`) to the `xks-proxy` server (doesn't matter where, as long as the `xks-proxy` process has access to it) from the Vault setup.
-
-1. Create a `configuration/settings_vault.toml` file for the XKS to Vault PKCS#11 configuration,
-   and set the `XKS_PROXY_SETTINGS_TOML` environment variable to point to the file location.
-
-   The important settings to change:
-
-   * `[[external_key_stores]]`:
-     * change URI path prefix to anything you like
-     * choose random access ID
-     * choose random secret key
-     * set which key labels are accessible to XKS (`xks_key_id_set`)
-   * `[pkcs11]`: set the `PKCS11_HSM_MODULE` to the location of the `libvault-pkcs11.so` (or `.dylib`) file downloaded from [releases.hashicorp.com](https://releases.hashicorp.com/vault-pkcs11-provider).
-
-   ```toml
-   [server]
-   ip = "0.0.0.0"
-   port = 8000
-   region = "us-east-2"
-   service = "kms-xks-proxy"
-
-   [server.tcp_keepalive]
-   tcp_keepalive_secs = 60
-   tcp_keepalive_retries = 3
-   tcp_keepalive_interval_secs = 1
-
-   [tracing]
-   is_stdout_writer_enabled = true
-   is_file_writer_enabled = true
-   level = "DEBUG"
-   directory = "/var/local/xks-proxy/logs"
-   file_prefix = "xks-proxy.log"
-   rotation_kind = "HOURLY"
-
-   [security]
-   is_sigv4_auth_enabled = true
-   is_tls_enabled = true
-   is_mtls_enabled = false
-
-   [tls]
-   tls_cert_pem = "tls/server_cert.pem"
-   tls_key_pem = "tls/server_key.pem"
-   mtls_client_ca_pem = "tls/client_ca.pem"
-   mtls_client_dns_name = "us-east-2.alpha.cks.kms.aws.internal.amazonaws.com"
-
-   [[external_key_stores]]
-   uri_path_prefix = "/xyz"
-   sigv4_access_key_id = "AKIA4GBY3I6JCE5M2HPM"
-   sigv4_secret_access_key = "1234567890123456789012345678901234567890123="
-   xks_key_id_set = ["abc123"]
-
-   [pkcs11]
-   session_pool_max_size = 30
-   session_pool_timeout_milli = 0
-   session_eager_close = false
-   user_pin = ""
-   PKCS11_HSM_MODULE = "/usr/local/lib/libvault-pkcs11.so"
-   context_read_timeout_milli = 100
-
-   [limits]
-   max_plaintext_in_base64 = 8192
-   max_aad_in_base64 = 16384
-
-   [hsm_capabilities]
-   can_generate_iv = false
-   is_zero_iv_required = false
-   ```
-
-~> **Note**: `vault-pkcs11-provider` versions of 0.1.0–0.1.2 require the last two lines to be changed to `can_generate_iv = true` and `is_zero_iv_required = true`.
-
-1. Create a file, `/etc/vault-pkcs11.hcl` with the following contents:
-
-    ```hcl
-    slot {
-      server = "VAULT_ADDRESS:5696"
-      tls_cert_path = "/etc/kmip/cert.pem"
-      ca_path = "/etc/kmip/ca.pem"
-      scope = "my-service"
-    }
-    ```
-
-    This file is used by `libvault-pkcs11.so` to know how to find and communicate with the KMIP server.
-    See [the Vault docs](/vault/docs/enterprise/pkcs11-provider) for all available parameters and their usage.
-
-1. If you want to view the Vault logs (helpful when trying to find error messages), you can specify the `VAULT_LOG_FILE` (default is stdout) and `VAULT_LOG_LEVEL` (default is `INFO`). We'd recommend setting `VAULT_LOG_FILE` to something like `/tmp/vault.log` or `/var/log/vault.log`. Other useful log levels are `WARN` (quieter) and `TRACE` (very verbose, could possibly contain sensitive information, like raw network packets).
-
-1. Create an AES-256 key in KMIP, for example, using `pkcs11-tool` (usually installed with the OpenSC package). See the [Vault docs](/vault/docs/enterprise/pkcs11-provider) for the full setup.
-   ```sh
-   VAULT_LOG_FILE=/dev/null pkcs11-tool --module ./libvault-pkcs11.so --keygen -a abc123 --key-type AES:32 \
-       --extractable --allow-sw
-   Key generated:
-   Secret Key Object; AES length 32
-   VALUE:
-   label:      abc123
-   Usage:      encrypt, decrypt, wrap, unwrap
-   Access:     none
-   ```
-
-## Enable XKS in the AWS CLI
-
-
-1. Create the KMS custom key store with the appropriate parameters to point to your XKS proxy (in this example, through `ngrok`).
-
-   ```shell-session
-   $ aws kms create-custom-key-store \
-       --custom-key-store-name myVaultKeyStore \
-       --custom-key-store-type EXTERNAL_KEY_STORE \
-       --xks-proxy-uri-endpoint https://example.ngrok.io \
-       --xks-proxy-uri-path /xyz/kms/xks/v1 \
-       --xks-proxy-authentication-credential AccessKeyId=AKIA4GBY3I6JCE5M2HPM,RawSecretAccessKey=1234567890123456789012345678901234567890123= \
-       --xks-proxy-connectivity PUBLIC_ENDPOINT
-
-   {
-       "CustomKeyStoreId": "cks-d7a55fe93d63191d6"
-   }
-   ```
-
-1. Tell KMS to connect to the key store.
-
-   ```shell-session
-   $ aws kms connect-custom-key-store --custom-key-store-id cks-d7a55fe93d63191d6
-   ```
-
-1. Wait for the `ConnectionState` of your custom key store to be `CONNECTED`. This can take a few minutes.
-
-   ```shell-session
-   $ aws kms describe-custom-key-stores --custom-key-store-id cks-d7a55fe93d63191d6
-   ```
-
-1. Create a KMS key associated with the XKS key ID (`abc123` in this example):
-
-   ```shell-session
-   $ aws kms create-key --custom-key-store-id cks-d7a55fe93d63191d6 \
-       --xks-key-id abc123 --origin EXTERNAL_KEY_STORE
-   {
-       "KeyMetadata": {
-           "AWSAccountId": "111111111111",
-           "KeyId": "a93f205a-2a37-4338-aa64-92b4a4b0b67d",
-           "Arn": "arn:aws:kms:us-east-2:111111111111:key/a93f205a-2a37-4338-aa64-92b4a4b0b67d",
-           "CreationDate": "2022-12-22T11:03:23.695000-08:00",
-           "Enabled": true,
-           "Description": "",
-           "KeyUsage": "ENCRYPT_DECRYPT",
-           "KeyState": "Enabled",
-           "Origin": "EXTERNAL_KEY_STORE",
-           "CustomKeyStoreId": "cks-16460f66b34705025",
-           "KeyManager": "CUSTOMER",
-           "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
-           "KeySpec": "SYMMETRIC_DEFAULT",
-           "EncryptionAlgorithms": [
-               "SYMMETRIC_DEFAULT"
-           ],
-           "MultiRegion": false,
-           "XksKeyConfiguration": {
-               "Id": "abc123"
-           }
-       }
-   }
-   ```
-
-1. Encrypt some data with this key:
-
-   ```shell-session
-   $ aws kms encrypt --key-id a93f205a-2a37-4338-aa64-92b4a4b0b67d --plaintext YWJjMTIzCg==
-   {
-       "CiphertextBlob": "somerandomciphertextblob=",
-       "KeyId": "arn:aws:kms:us-east-2:111111111111:key/a93f205a-2a37-4338-aa64-92b4a4b0b67d",
-       "EncryptionAlgorithm": "SYMMETRIC_DEFAULT"
-   }
-
-1. Decypt the resulting ciphertext:
-
-   ```shell-session
-   $ aws kms decrypt --ciphertext-blob somerandomciphertextblob=
-   {
-       "KeyId": "arn:aws:kms:us-east-2:111111111111:key/a93f205a-2a37-4338-aa64-92b4a4b0b67d",
-       "Plaintext": "YWJjMTIzCg==",
-       "EncryptionAlgorithm": "SYMMETRIC_DEFAULT"
-   }
-   ```
-
-1. Optionally, clean up your key and key store with:
-
-   ```shell-session
-   $ aws kms disable-key --key-id a93f205a-2a37-4338-aa64-92b4a4b0b67d
-   $ aws kms disconnect-custom-key-store --custom-key-store-id cks-16460f66b34705025
-   $ aws kms delete-custom-key-store --custom-key-store-id cks-16460f66b34705025
-   ```
-
-   (The `aws kms delete-custom-key-store` command will not succeed until all keys in the key store have been disabled and deleted.)
\ No newline at end of file
diff --git a/website/content/docs/enterprise/pkcs11-provider/index.mdx b/website/content/docs/enterprise/pkcs11-provider/index.mdx
deleted file mode 100644
index 199b4774be3..00000000000
--- a/website/content/docs/enterprise/pkcs11-provider/index.mdx
+++ /dev/null
@@ -1,431 +0,0 @@
----
-layout: docs
-page_title: PKCS#11 Provider - Vault Enterprise
-description: |-
-  The Vault PKCS#11 Provider allows Vault KMIP Secrets Engine to be used via PKCS#11 calls.
-  The provider supports a subset of key generation, encryption, decryption and key storage operations.
-  This requires the Enterprise ADP-KM license.
----
-
-# PKCS#11 provider
-
-@include 'alerts/enterprise-only.mdx'
-
--> **Note**: This feature is part of the [KMIP Secret Engine](/vault/docs/secrets/kmip), which requires [Vault Enterprise](https://www.hashicorp.com/products/vault/)
-with the Advanced Data Protection Module.
-
-[PKCS#11](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html)
-is an open standard C API that provides a means to access cryptographic capabilities on a device.
-For example, it is often used to access a Hardware Security Module (HSM) (like a [Yubikey](https://www.yubico.com/)) from a local program (such as [GPG](https://gnupg.org/)).
-
-Vault provides a PKCS#11 library (or provider) so that Vault can be used as an SSM (Software Security Module).
-This allows a user to treat Vault like any other PKCS#11 device to manage keys, objects, and perform encryption and decryption in Vault using PKCS#11 calls.
-The PKCS#11 library connects to Vault's [KMIP Secrets Engine](/vault/docs/secrets/kmip) to provide cryptographic operations and object storage.
-
-## Platform support
-
-This library works with Vault Enterprise 1.11+ with the advanced data protection module in the license
-with the KMIP Secrets Engine.
-
-| Operating System | Architecture | Distribution      | glibc   |
-| ---------------- | -------------| ----------------- | ------- |
-| Linux            | x86-64       | RHEL 7 compatible | 2.17    |
-| Linux            | x86-64       | RHEL 8 compatible | 2.28    |
-| Linux            | x86-64       | RHEL 9 compatible | 2.34    |
-| macOS            | x86-64       | &mdash;           | &mdash; |
-
-_Note:_ `vault-pkcs11-provider` runs on _any_ glibc-based Linux distribution. The versions above are given in RHEL-compatible GLIBC versions; for your
-distro's glibc version, choose the `vault-pkcs11-provider` built against the same or older version as what your distro provides.
-
-The provider comes in the form of a shared C library, `libvault-pkcs11.so` (for Linux) or `libvault-pkcs11.dylib` (for macOS).
-It can be downloaded from [releases.hashicorp.com](https://releases.hashicorp.com/vault-pkcs11-provider).
-
-## Quick start
-
-1. To use the provider, you will need access to a Vault Enterprise instance with the KMIP Secrets Engine.
-
-    For example, you can start one locally (if you have a license in the `VAULT_LICENSE` environment variable) with:
-
-    ```sh
-    docker pull hashicorp/vault-enterprise &&
-    docker run --name vault \
-      -p 5696:5696 \
-      -p 8200:8200 \
-      --cap-add=IPC_LOCK \
-      -e VAULT_LICENSE=$(printenv VAULT_LICENSE) \
-      -e VAULT_ADDR=http://127.0.0.1:8200 \
-      -e VAULT_TOKEN=root \
-      hashicorp/vault-enterprise \
-      server -dev -dev-root-token-id root -dev-listen-address 0.0.0.0:8200
-    ```
-
-1. Configure the [KMIP Secrets Engine](/vault/docs/secrets/kmip) and a KMIP *scope*. The scope is used to hold keys and objects.
-
-    ~> **Note**: These commands will output the credentials in plaintext.
-
-    ```sh
-    vault secrets enable kmip
-    vault write kmip/config listen_addrs=0.0.0.0:5696
-    vault write -f kmip/scope/my-service
-    vault write kmip/scope/my-service/role/admin operation_all=true
-    vault write -f -format=json kmip/scope/my-service/role/admin/credential/generate | tee kmip.json
-    ```
-
-    ~> **Important**: When configuring KMIP in production, you will probably need to set the
-    `server_hostnames` and `server_ips` [configuration parameters](/vault/api-docs/secret/kmip#parameters),
-    otherwise the TLS connection to the KMIP Secrets Engine will fail due to certification validation errors.
-
-    This last line will generate a JSON file with the certificate, key, and CA certificate chain to connect
-    to the KMIP server. You'll need to save these to files so that the PKCS#11 provider can use them.
-
-    ```sh
-    jq --raw-output --exit-status '.data.ca_chain[]' kmip.json > ca.pem
-    jq --raw-output --exit-status '.data.certificate' kmip.json > cert.pem
-    ```
-    The certificate file from the KMIP Secrets Engine also contains the key.
-
-1. Create a configuration file called `vault-pkcs11.hcl`:
-
-    ```hcl
-    slot {
-      server = "127.0.0.1:5696"
-      tls_cert_path = "cert.pem"
-      ca_path = "ca.pem"
-      scope = "my-service"
-    }
-    ```
-
-    See [below](#configuration) for all available parameters.
-
-1. Copy the certificates from the KMIP credentials into the files specified in the configuration file (e.g., `cert.pem`, and `ca.pem`).
-
-1. You should now be able to use the `libvault-pkcs11.so` (or `.dylib`) library to access the KMIP Secrets Engine in Vault using any PKCS#11-compatible tool, like OpenSC's `pkcs11-tool`, e.g.:
-
-    ```sh
-    $ VAULT_LOG_FILE=/dev/null pkcs11-tool --module ./libvault-pkcs11.so -L
-    Available slots:
-    Slot 0 (0x0): Vault slot 0
-    token label        : Token 0
-    token manufacturer : HashiCorp
-    token model        : Vault Enterprise
-    token flags        : token initialized, PIN initialized, other flags=0x60
-    hardware version   : 1.12
-    firmware version   : 1.12
-    serial num         : 1234
-    pin min/max        : 0/255
-
-    $ VAULT_LOG_FILE=/dev/null pkcs11-tool --module ./libvault-pkcs11.so --keygen -a abc123 --key-type AES:32 \
-    --extractable --allow-sw 2>/dev/null
-    Key generated:
-    Secret Key Object; AES length 32
-    VALUE:
-    label:      abc123
-    Usage:      encrypt, decrypt, wrap, unwrap
-    Access:     none
-    ```
-
-    The `VAULT_LOG_FILE=/dev/null` setting is to prevent the Vault PKCS#11 driver logs from appearing in stdout (the default if no file is specified).
-    In production, it's good to set `VAULT_LOG_FILE` to point to somewhere more permanent, like `/var/log/vault.log`.
-
-## Configuration
-
-The PKCS#11 Provider can be configured through an HCL file and through envionment variables.
-
-The HCL file contains directives to map PKCS#11 device
-[slots](http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html#_Toc416959678) (logical devices)
-to Vault instances and KMIP scopes and configures how the library will authenticate to KMIP (with a client TLS certificate).
-The PKCS#11 library will look for this file in `vault-pkcs11.hcl` and `/etc/vault-pkcs11.hcl` by default, or you can override this by setting the `VAULT_KMIP_CONFIG` environment variable.
-
-For example,
-
-```hcl
-slot {
-    server = "127.0.0.1:5696"
-    tls_cert_path = "cert.pem"
-    ca_path = "ca.pem"
-    scope = "my-service"
-}
-```
-
-The `slot` block configures the first PKCS#11 slot to point to Vault.
-Most programs will use only one slot.
-
-- `server` (required): the Vault server's IP or DNS name and port number (5696 is the default).
-- `tls_cert_path` (required): the location of the client TLS certificate used to authenticate to the KMIP engine.
-- `tls_key_path` (optional, defaults to the value of `tls_cert_path`): the location of the encrypted or unencrypted TLS key used to authenticate to the KMIP engine.
-- `ca_path` (required): the location of the CA bundle that will be used to verify the server's certificate.
-- `scope` (required): the [KMIP scope](/vault/docs/secrets/kmip#scopes-and-roles) to authenticate against and where the TDE master keys and associated metadata will be stored.
-- `cache` (optional, default `true`): if the provider uses a cache to improve the performance of `C_GetAttributeValue` (KMIP: `GetAttributes`) calls.
-- `emulate_hardware` (optional, default `false`): specifies if the provider should report that it is connected to a hardware device.
-
-The default location the PKCS#11 library will look for the configuration file is the current directory (`vault-pkcs11.hcl`) and `/etc/vault-pkcs11.hcl`, but you can override this by setting the `VAULT_KMIP_CONFIG` environment variable to any file.
-
-Environment variables can be also used to configure these parameters and more.
-
-- `VAULT_KMIP_CONFIG`: location of the HCL configuration file. By default, the provider will check `./vault-pkcs11.hcl` and `/etc/vault-pkcs11.hcl`.
-- `VAULT_KMIP_CERT_FILE`: location of the TLS certificate used for authentication to the KMIP engine.
-- `VAULT_KMIP_KEY_FILE`: location of the TLS key used for authentication to the KMIP engine.
-- `VAULT_KMIP_KEY_PASSWORD`: password for the TLS key file, if it is encrypted to the KMIP engine.
-- `VAULT_KMIP_CA_FILE`: location of the TLS CA bundle used to authenticate the connection to the KMIP engine.
-- `VAULT_KMIP_SERVER`: address and port of the KMIP engine to use for encryption and storage.
-- `VAULT_KMIP_SCOPE`: KMIP scope to use for encryption and storage
-- `VAULT_KMIP_CACHE`: whether or not to cache `C_GetAttributeValue` (KMIP: `GetAttributes`) calls.
-- `VAULT_LOG_LEVEL`: the log level that the provider will use. Defaults to `WARN`. Valid values include `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`, and `OFF`.
-- `VAULT_LOG_FILE`: the location of the file the provider will use for logging. Defaults to standard out.
-- `VAULT_EMULATE_HARDWARE`: whether or not the provider will report that it is backed by a hardware device.
-
-## Encrypted TLS key support
-
-The TLS key returned by the KMIP engine is unencrypted by default.
-However, the PKCS#11 provider does support (limited) encryption options for the key using [RFC 1423](https://www.rfc-editor.org/rfc/rfc1423).
-We would only recommend using AES-256-CBC out of the available algorithms.
-
-The keys from KMIP should be ECDSA keys, and can be encrypted with a password with OpenSSL, e.g.,:
-
-```sh
-openssl ec -in cert.key -out encrypted.key -aes-256-cbc
-```
-
-The PKCS#11 provider will need access to the password to decrypt the TLS key.
-The password can be supplied to the provider in two ways:
-
-- The `VAULT_KMIP_KEY_PASSWORD` environment variable, or
-- the "PIN" parameter to the `C_Login` PKCS#11 function will be used to try to decrypt an encrypted TLS key.
-
-Note that only a single password can be supplied via the `VAULT_KMIP_KEY_PASSWORD`, so if multiple slots in the HCL file use encrypted TLS keys, they will need to be encrypted with the same password, or use the `C_Login` method to specify the password.
-
-## Error handling
-
-If an error occurs, the first place to check will be the `VAULT_LOG_FILE` for any relevant error messages.
-
-If the PKCS#11 provider returns an error code of `0x30` (`CKR_DEVICE_ERROR`), then an additional device error code may
-be available from the `C_SessionInfo` call.
-Here are the known device error codes the provider will return:
-
-| Code | Meaning                                                          |
-| ---- | ---------------------------------------------------------------- |
-| 400  | Invalid input was provided in the configuration or PKCS#11 call. |
-| 401  | Invalid credentials were provided.                               |
-| 404  | The object, attribute, or key was not found.                     |
-| 600  | An unknown I/O error occurred.                                   |
-| 601  | A KMIP engine error occured.                                     |
-
-## Capabilities
-
-The Vault PKCS#11 provider implements the following PKCS#11 provider profiles:
-
-- [Baseline](http://docs.oasis-open.org/pkcs11/pkcs11-profiles/v2.40/os/pkcs11-profiles-v2.40-os.html#_Toc416960548)
-- [Extended](http://docs.oasis-open.org/pkcs11/pkcs11-profiles/v2.40/os/pkcs11-profiles-v2.40-os.html#_Toc416960554)
-
-The following key genration mechanisms are currently supported:
-
-| Name               | Mechanism Number |Provider Version|Vault Version|
-| ------------------ | ---------------- |----------------|-------------|
-| RSA-PKCS           | `0x0000`         | 0.2.0          | 1.13        |
-| AES key generation | `0x1080`         | 0.1.0          | 1.12        |
-
-
-The following encryption mechanisms are currently supported:
-
-| Name               | Mechanism Number |Provider Version|Vault Version|
-| ------------------ | ---------------- |----------------|-------------|
-| RSA-PKCS           | `0x0001`         | 0.2.0          | 1.13        |
-| RSA-PKCS-OAEP      | `0x0009`         | 0.2.0          | 1.13        |
-| AES-ECB            | `0x1081`         | 0.2.0          | 1.13        |
-| AES-CBC            | `0x1082`         | 0.1.0          | 1.12        |
-| AES-CBC Pad        | `0x1085`         | 0.1.0          | 1.12        |
-| AES-CTR            | `0x1086`         | 0.1.0          | 1.12        |
-| AES-GCM            | `0x1087`         | 0.1.0          | 1.12        |
-| AES-OFB            | `0x2104`         | 0.2.0          | 1.13        |
-| AES-CFB128         | `0x2107`         | 0.2.0          | 1.13        |
-
-The following signing mechanisms are currently supported:
-
-| Name               | Mechanism Number |Provider Version|Vault Version|
-| ------------------ | ---------------- |----------------|-------------|
-| RSA-PKCS           | `0x0001`         | 0.2.0          | 1.13        |
-| SHA256-RSA-PKCS    | `0x0040`         | 0.2.0          | 1.13        |
-| SHA384-RSA-PKCS    | `0x0041`         | 0.2.0          | 1.13        |
-| SHA512-RSA-PKCS    | `0x0042`         | 0.2.0          | 1.13        |
-| SHA224-RSA-PKCS    | `0x0046`         | 0.2.0          | 1.13        |
-| SHA512-224-HMAC    | `0x0049`         | 0.2.0          | 1.13        |
-| SHA512-256-HMAC    | `0x004D`         | 0.2.0          | 1.13        |
-| SHA256-HMAC        | `0x0251`         | 0.2.0          | 1.13        |
-| SHA224-HMAC        | `0x0256`         | 0.2.0          | 1.13        |
-| SHA384-HMAC        | `0x0261`         | 0.2.0          | 1.13        |
-| SHA512-HMAC        | `0x0271`         | 0.2.0          | 1.13        |
-
-
-<Tabs>
-<Tab heading="Supported PKCS#11 Functions (version 0.2)">
-Here is the list of supported and unsupported PKCS#11 functions:
-
-- Encryption and decryption
-  - [X]  `C_EncryptInit`
-  - [X]  `C_Encrypt`
-  - [X]  `C_EncryptUpdate`
-  - [X]  `C_EncryptFinal`
-  - [X]  `C_DecryptInit`
-  - [X]  `C_Decrypt`
-  - [X]  `C_DecryptUpdate`
-  - [X]  `C_DecryptFinal`
-- Key management
-  - [X]  `C_GenerateKey`
-  - [X]  `C_GenerateKeyPair`
-  - [ ]  `C_WrapKey`
-  - [ ]  `C_UnwrapKey`
-  - [ ]  `C_DeriveKey`
-- Objects
-  - [X]  `C_CreateObject`
-  - [X]  `C_DestroyObject`
-  - [X]  `C_GetAttributeValue`
-  - [X]  `C_FindObjectsInit`
-  - [X]  `C_FindObjects`
-  - [X]  `C_FindObjectsFinal`
-  - [ ]  `C_SetAttributeValue`
-  - [ ]  `C_CopyObject`
-  - [ ]  `C_GetObjectSize`
-- Management
-  - [X]  `C_Initialize`
-  - [X]  `C_Finalize`
-  - [X]  `C_Login` (PIN is used as a passphrase for the TLS encryption key, if provided)
-  - [X]  `C_Logout`
-  - [X]  `C_GetInfo`
-  - [X]  `C_GetSlotList`
-  - [X]  `C_GetSlotInfo`
-  - [X]  `C_GetTokenInfo`
-  - [X]  `C_GetMechanismList`
-  - [X]  `C_GetMechanismInfo`
-  - [X]  `C_OpenSession`
-  - [X]  `C_CloseSession`
-  - [X]  `C_CloseAllSessions`
-  - [X]  `C_GetSessionInfo`
-  - [ ]  `C_InitToken`
-  - [ ]  `C_InitPIN`
-  - [ ]  `C_SetPIN`
-  - [ ]  `C_GetOperationState`
-  - [ ]  `C_SetOperationState`
-  - [ ]  `C_GetFunctionStatus`
-  - [ ]  `C_CancelFunction`
-  - [ ]  `C_WaitForSlotEvent`
-- Signing
-  - [X]  `C_SignInit`
-  - [X]  `C_Sign`
-  - [X]  `C_SignUpdate`
-  - [X]  `C_SignFinal`
-  - [ ]  `C_SignRecoverInit`
-  - [ ]  `C_SignRecover`
-  - [X]  `C_VerifyInit`
-  - [X]  `C_Verify`
-  - [X]  `C_VerifyUpdate`
-  - [X]  `C_VerifyFinal`
-  - [ ]  `C_VerifyRecoverInit`
-  - [ ]  `C_VerifyRecover`
-- Digests
-  - [ ]  `C_DigestInit`
-  - [ ]  `C_Digest`
-  - [ ]  `C_DigestUpdate`
-  - [ ]  `C_DigestKey`
-  - [ ]  `C_DigestFinal`
-  - [ ]  `C_DigestEncryptUpdate`
-  - [ ]  `C_DecryptDigestUpdate`
-  - [ ]  `C_SignEncryptUpdate`
-  - [ ]  `C_DecryptVerifyUpdate`
-- Random Number Generation (see note below)
-  - [X]  `C_SeedRandom`
-  - [X]  `C_GenerateRandom`
-
-</Tab>
-<Tab heading="Supported PKCS#11 Functions (version 0.1)">
-Here is the list of supported and unsupported PKCS#11 functions:
-
-- Encryption and decryption
-  - [X]  `C_EncryptInit`
-  - [X]  `C_Encrypt`
-  - [ ]  `C_EncryptUpdate`
-  - [ ]  `C_EncryptFinal`
-  - [X]  `C_DecryptInit`
-  - [X]  `C_Decrypt`
-  - [ ]  `C_DecryptUpdate`
-  - [ ]  `C_DecryptFinal`
-- Key management
-  - [X]  `C_GenerateKey`
-  - [ ]  `C_GenerateKeyPair`
-  - [ ]  `C_WrapKey`
-  - [ ]  `C_UnwrapKey`
-  - [ ]  `C_DeriveKey`
-- Objects
-  - [X]  `C_CreateObject`
-  - [X]  `C_DestroyObject`
-  - [X]  `C_GetAttributeValue`
-  - [X]  `C_FindObjectsInit`
-  - [X]  `C_FindObjects`
-  - [X]  `C_FindObjectsFinal`
-  - [ ]  `C_SetAttributeValue`
-  - [ ]  `C_CopyObject`
-  - [ ]  `C_GetObjectSize`
-- Management
-  - [X]  `C_Initialize`
-  - [X]  `C_Finalize`
-  - [X]  `C_Login` (PIN is used as a passphrase for the TLS encryption key, if provided)
-  - [X]  `C_Logout`
-  - [X]  `C_GetInfo`
-  - [X]  `C_GetSlotList`
-  - [X]  `C_GetSlotInfo`
-  - [X]  `C_GetTokenInfo`
-  - [X]  `C_GetMechanismList`
-  - [X]  `C_GetMechanismInfo`
-  - [X]  `C_OpenSession`
-  - [X]  `C_CloseSession`
-  - [X]  `C_CloseAllSessions`
-  - [X]  `C_GetSessionInfo`
-  - [ ]  `C_InitToken`
-  - [ ]  `C_InitPIN`
-  - [ ]  `C_SetPIN`
-  - [ ]  `C_GetOperationState`
-  - [ ]  `C_SetOperationState`
-  - [ ]  `C_GetFunctionStatus`
-  - [ ]  `C_CancelFunction`
-  - [ ]  `C_WaitForSlotEvent`
-- Signing
-  - [ ]  `C_SignInit`
-  - [ ]  `C_Sign`
-  - [ ]  `C_SignUpdate`
-  - [ ]  `C_SignFinal`
-  - [ ]  `C_SignRecoverInit`
-  - [ ]  `C_SignRecover`
-  - [ ]  `C_VerifyInit`
-  - [ ]  `C_Verify`
-  - [ ]  `C_VerifyUpdate`
-  - [ ]  `C_VerifyFinal`
-  - [ ]  `C_VerifyRecoverInit`
-  - [ ]  `C_VerifyRecover`
-- Digests
-  - [ ]  `C_DigestInit`
-  - [ ]  `C_Digest`
-  - [ ]  `C_DigestUpdate`
-  - [ ]  `C_DigestKey`
-  - [ ]  `C_DigestFinal`
-  - [ ]  `C_DigestEncryptUpdate`
-  - [ ]  `C_DecryptDigestUpdate`
-  - [ ]  `C_SignEncryptUpdate`
-  - [ ]  `C_DecryptVerifyUpdate`
-- Random Number Generation (see note below)
-  - [X]  `C_SeedRandom`
-  - [X]  `C_GenerateRandom`
-
-</Tab>
-</Tabs>
-
-## Limitations and notes
-
-Due to the nature of Vault, the KMIP Secrets Engine, and PKCS#11, there are some other limitations to be aware of:
-
-- The key and object IDs returned by `C_FindObjects`, etc., are randomized for each session, and cannot be shared between sessions; they have no meaning after a session is closed.
-  This is because KMIP objects, which are used to store the PKCS#11 objects, have long random strings as IDs, but the PKCS#11 object ID is limited to a 32-bit integer. Also, the PKCS#11 provider does not have any local storage.
-- The PKCS#11 provider's performance is heavily dependent on the latency to the Vault server and its performance.
-  This is because nearly all PKCS#11 API calls are translated 1-1 to KMIP calls, aside from some object attribute calls (which can be locally cached).
-  Multiple sessions can be safely used simultaneously though, and a single Vault server node has been tested as supporting thousands of ongoing sessions.
-- The object attribute cache is valid only for a single object per session, and will be cleared when another object's attributes are queried.
-- The random number generator function, `C_GenerateRandom`, is currently implemented in software in the library by calling out to Go's [`crypto/rand`](https://pkg.go.dev/crypto/rand) package,
-  and does **not** call Vault.
diff --git a/website/content/docs/enterprise/pkcs11-provider/oracle-tde.mdx b/website/content/docs/enterprise/pkcs11-provider/oracle-tde.mdx
deleted file mode 100644
index b2582645506..00000000000
--- a/website/content/docs/enterprise/pkcs11-provider/oracle-tde.mdx
+++ /dev/null
@@ -1,144 +0,0 @@
----
-layout: docs
-page_title: Oracle TDE - PKCS#11 Provider - Vault Enterprise
-description: |-
-  The Vault PKCS#11 Provider can be used to enable Oracle TDE.
----
-
-# Oracle TDE
-
-@include 'alerts/enterprise-only.mdx'
-
-[Oracle Transparent Data Encryption](https://docs.oracle.com/en/database/oracle/oracle-database/19/asoag/introduction-to-transparent-data-encryption.html) (TDE)
-is supported with the [Vault PKCS#11 provider](/vault/docs/enterprise/pkcs11-provider).
-In this setup, Vault's KMIP engine generates and store the "TDE Master Encryption Key" that the Oracle Database uses to encrypt and decrypt the "TDE Table Keys".
-Oracle will not have access to the TDE Master Encryption Key itself.
-
-## Requirements
-
-To setup Oracle TDE backed by Vault, the following are required:
-
-- A database running Oracle 19c Enterprise Edition
-- A Vault Enterprise 1.11+ server with Advanced Data Protection for KMIP support.
-- Vault has TCP port 5696 accessible to the Oracle database.
-- `libvault-pkcs11.so` downloaded from [releases.hashicorp.com](https://releases.hashicorp.com/vault-pkcs11-provider) for the operating system running the Oracle database.
-
-## Vault setup
-
-On the Vault server, we need to [setup the KMIP Secrets Engine](/vault/docs/secrets/kmip):
-
-1. Start the KMIP Secrets Engine and listener:
-
-    ```sh
-    vault secrets enable kmip
-    vault write kmip/config listen_addrs=0.0.0.0:5696
-    ```
-
-    ~> **Important**: When configuring KMIP for Oracle, you will probably need to set the
-    `server_hostnames` and `server_ips` [configuration parameters](/vault/api-docs/secret/kmip#parameters),
-    otherwise the TLS connection to the KMIP Secrets Engine will fail due to certification validation errors.
-    When configuring Oracle TDE, this error can manifest as the `sqlplus` session silently hanging.
-
-1. Create a KMIP scope to contain the TDE keys and objects.
-   The KMIP scope is essentially an isolated namespace.
-   For example, you can create a scope called `my-service`:
-
-    ```sh
-    vault write -f kmip/scope/my-service
-    ```
-
-1. Create a KMIP role that has access to the scope:
-
-    ```sh
-    vault write kmip/scope/my-service/role/admin operation_all=true
-    ```
-
-1. Create TLS credentials (a certificate, key, and CA bundle) for the KMIP role:
-
-    ~> **Note**: This command will output the credentials in plaintext.
-
-    ```sh
-    vault write -f -format=json kmip/scope/my-service/role/admin/credential/generate | tee kmip.json
-    ```
-
-    The response from the `credential/generate` endpoint is JSON.
-    The `.data.certificate` entry contains a bundle of the TLS client key and certificate we will use to connect to KMIP with from Oracle.
-    The `.data.ca_chain[]` entries contain the CA bundle to verify the KMIP server's certificate.
-    Save these to, e.g., `cert.pem` and `ca.pem`:
-
-    ```sh
-    jq --raw-output --exit-status '.data.ca_chain[]' kmip.json > ca.pem
-    jq --raw-output --exit-status '.data.certificate' kmip.json > cert.pem
-    ```
-
-## Oracle TDE preparation
-
-The rest of the steps take place on the Oracle server.
-
-We need to configure the Vault PKCS#11 provider.
-
-1. Copy the `libvault-pkcs11.so` binary into `$ORACLE_BASE/extapi/64/hsm`, and ensure there are no other PKCS#11 libraries in `$ORACLE_BASE/extapi/64/hsm`.
-
-1. Copy the TLS certificate and key bundle (e.g., `/etc/cert.pem`) and CA bundle (e.g., `/etc/ca.pem`) for the KMIP role (configured as above) to the Oracle server.
-   The exact location does not matter as long as the Oracle process has access to it.
-
-1. Create a configuration file, for example `/etc/vault-pkcs11.hcl`, with the following contents:
-
-    ```hcl
-    slot {
-      server = "VAULT_ADDRESS:5696"
-      tls_cert_path = "/etc/cert.pem"
-      ca_path = "/etc/ca.pem"
-      scope = "my-service"
-    }
-    ```
-
-    This file is used by `libvault-pkcs11.so` to know how to find and communicate with the KMIP engine in Vault.
-
-    In particular:
-    - The `slot` block configures the first PKCS#11 slot to point to Vault. Oracle will use this first slot.
-    - `server` should point to the Vault server's IP (or DNS name) and port number (5696 is the default).
-    - `tls_cert_path` should be the location on the Oracle database of the client TLS certificate and key bundle used to connect to Vault server.
-    - `ca_path` should be the location of the CA bundle on the Oracle database.
-    - `scope` is the KMIP scope to authenticate against and where the TDE master keys and associated metadata will be stored.
-
-    The default location the PKCS#11 library will look for the configuration file is the current directory (`./vault-pkcs11.hcl`) and `/etc/vault-pkcs11.hcl`, but you can override this by setting the `VAULT_KMIP_CONFIG` environment variable to any file.
-
-1. If you want to view the Vault logs (helpful when trying to find error messages), you can specify the `VAULT_LOG_FILE` (default is stdout) and `VAULT_LOG_LEVEL` (default is `INFO`). We'd recommend setting `VAULT_LOG_FILE` to something like `/tmp/vault.log` or `/var/log/vault.log`. Other useful log levels are `WARN` (quieter) and `TRACE` (verbose, could possibly contain sensitive information, like raw network packets).
-
-## Enable TDE 
-
-The only remaining step is to setup Oracle TDE for an external HSM using shared library, `libvault-pkcs11.so`.
-These steps are not specific to Vault, other than requiring the shared library, HCL configuration, and certificates be present.
-TDE is complex, but an example way to enable it is:
-
-1. Open a `sqlplus` session into the root container (or switch into it with `ALTER SESSION SET CONTAINER = CDB$ROOT;`).
-
-1. Set WALLET_ROOT and TDE_CONFIGURATION parameters on the Oracle database. The wallet root directory is only used to set the TDE configuration parameter. To learn more about the wallet parameters refer to the [Oracle TDE documentation](https://docs.oracle.com/en/database/oracle/oracle-database/19/refrn/TDE_CONFIGURATION.html).
-
-    ```sql
-    SQL> alter system set wallet_root='/opt/oracle/admin/ORCLCDB/wallet' scope=spfile;
-    SQL> shutdown immediate;
-    SQL> startup;
-    SQL> alter system set TDE_CONFIGURATION="KEYSTORE_CONFIGURATION=HSM" SCOPE=both;
-    ```
-1. Validate the parameters are set by querying `V$PARAMETER`
-
-    ```sql
-    SQL> SELECT name, value from V$PARAMETER WHERE NAME IN ('wallet_root','tde_configuration');
-
-    NAME                           VALUE
-    ------------------------------ --------------------------------------------------
-    wallet_root                    /opt/oracle/admin/ORCLCDB/wallet
-    tde_configuration              KEYSTORE_CONFIGURATION=HSM
-    ```
-
-1. Open the HSM wallet: `ADMINISTER KEY MANAGEMENT SET KEYSTORE OPEN IDENTIFIED BY "1234" CONTAINER = ALL;`.
-   The password `1234` here is used as the password for decrypting the TLS key, if it is stored encrypted on disk.
-   If the TLS key is not encrypted, this password is ignored.
-
-1. Create the TDE master key: `ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY USING TAG 'default' IDENTIFIED BY "1234" CONTAINER = ALL;`, again specifying the TLS key password if necessary.
-
-1. Finally, use TDE in a PDB, e.g., `CREATE TABLE test_tde (something CHAR(32) ENCRYPT);`.
-
-More extensive information on the details and procedures for Oracle TDE can be found in [Oracle's documentation](https://docs.oracle.com/en/database/oracle/oracle-database/19/asoag/configuring-transparent-data-encryption.html#GUID-753C4808-CC51-4DA1-A5C3-980417FDAB14).
diff --git a/website/content/docs/enterprise/redundancy-zones.mdx b/website/content/docs/enterprise/redundancy-zones.mdx
deleted file mode 100644
index f905ff20b52..00000000000
--- a/website/content/docs/enterprise/redundancy-zones.mdx
+++ /dev/null
@@ -1,38 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise Redundancy Zones
-description: |-
-  Vault Enterprise clusters can have hot standby nodes for scalability and resiliency.
----
-
-# Redundancy zones
-
-@include 'alerts/enterprise-only.mdx'
-
-Vault Enterprise Redundancy Zones provide both read scaling and resiliency benefits by enabling
-the deployment of non-voting nodes alongside voting nodes on a per availability zone basis.
-
-When using redundancy zones, if an operator chooses to deploy Vault across three availability zones,
-they could have two (or more) nodes (one voting/one+ non-voting) in each zone. In the event that a
-voting node in an availability zone fails, the redundancy zone configuration automatically
-promotes the non-voting node to a voting node. In the event that an entire availability zone is
-lost, a non-voting node in one of the existing availability zones would be promoted to a voting
-node, keeping quorum. This capability functions as a "hot standby" for server nodes while also
-providing enhanced read scalability.
-
-## Configuration
-A new key can be added to Vault's `storage` configuration stanza: `autopilot_redundancy_zone`.
-The value for this key is a string of your choosing and represents the zone this particular node
-should be in.
-
-## Mechanics
-Vault's Autopilot subsystem will always attempt to maintain exactly one voting node per redundancy
-zone. Any additional nodes beyond the first one will be demoted to non-voting status. Non-voting
-nodes can serve reads but can not participate in cluster elections.
-
-If redundancy zones are used in conjunction with automated upgrades, Autopilot will always try to
-ensure that Vault is never moving from a more healthy state to a less healthy state. Autopilot will
-wait to begin leadership transfer until it can ensure that there will be as much redundancy on the
-new Vault version as there was on the old Vault version.
-
-The status of redundancy zones can be monitored by consulting the [Autopilot state API endpoint](/vault/api-docs/system/storage/raftautopilot#get-cluster-state).
diff --git a/website/content/docs/enterprise/replication.mdx b/website/content/docs/enterprise/replication.mdx
deleted file mode 100644
index 599ef6e0142..00000000000
--- a/website/content/docs/enterprise/replication.mdx
+++ /dev/null
@@ -1,280 +0,0 @@
----
-layout: docs
-page_title: Replication - Vault Enterprise
-description: >-
-  Vault Enterprise has support for Replication, allowing critical data to be
-  replicated across clusters to support horizontally scaling and disaster
-  recovery workloads.
----
-
-# Vault Enterprise replication
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-## Overview
- 
-Many organizations have infrastructure that spans multiple datacenters. Vault
-provides the critical services of identity management, secrets storage, and
-policy management. This functionality is expected to be highly available and
-to scale as the number of clients and their functional needs increase; at the
-same time, operators would like to ensure that a common set of policies are
-enforced globally, and a consistent set of secrets and keys are exposed to
-applications that need to interoperate.
-
-Vault replication addresses both of these needs in providing consistency,
-scalability, and highly-available disaster recovery.
-
-Note: Using replication requires a storage backend that supports transactional updates, such as [Integrated Storage](/vault/docs/concepts/integrated-storage) or Consul.
-
-## Architecture
-
-The core unit of Vault replication is a **cluster**, which is comprised of a
-collection of Vault nodes (an active and its corresponding HA nodes). Multiple Vault
-clusters communicate in a one-to-many near real-time flow.
-
-Replication operates on a leader/follower model, wherein a leader cluster (known as a
-**primary**) is linked to a series of follower **secondary** clusters. The primary
-cluster acts as the system of record and asynchronously replicates most Vault data.
-
-All communication between primaries and secondaries is end-to-end encrypted
-with mutually-authenticated TLS sessions, setup via replication tokens which are
-exchanged during bootstrapping.
-
-## Replicated data
-
-What data is replicated between the primary and secondary depends on the type of
-replication that is configured between the primary and secondary. These types
-of relationships are either **disaster recovery** or
-**performance replication** relationships.
-
-![](/img/replication-overview.png)
-
-The following table shows a capability comparison between Disaster Recovery
-and Performance Replication.
-
-| Capability                                                                                                           | Disaster Recovery | Performance Replication                                                                                                                                                                        |
-| -------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Mirrors the configuration of a primary cluster                                                                       | Yes               | Yes                                                                                                                                                                                |
-| Mirrors the configuration of a primary cluster’s backends (i.e., auth methods, secrets engines, audit devices, etc.) | Yes               | Yes                                                                                                                                                                                |
-| Mirrors the tokens and leases for applications and users interacting with the primary cluster                        | Yes               | No. Secondaries keep track of their own tokens and leases. When the secondary is promoted, applications must reauthenticate and obtain new leases from the newly-promoted primary. |
-| Allows the secondary cluster to handle client requests                                                               | No                | Yes                                            |
-
-Everything written to storage is classified into one of three categories:
-* `replicated` (or "shared"): all downstream clusters receive it
-* `local`: only downstream disaster recovery clusters receive it
-* `ignored`: not replicated to downstream clusters at all
-
-When mounting a secret engine or auth method, you can choose whether to make it a
-local mount or a shared mount.
-
-Shared mounts (the default) usually replicate all their data to performance secondaries, but
-they can choose to designate specific storage paths as local.  For example, PKI mounts
-store certificates locally. If you query the roles on a shared PKI mount, you'll see
-the same result for that mount when you send the query to either the performance primary or
-secondary, but if you list stored certs, you'll see different values.
-
-Local mounts replicate their data only to disaster recovery secondaries.  A local mount
-created on a performance primary isn't visible at all to its performance secondaries.
-Local mounts can also be created on performance secondaries, in which case they aren't visible
-to the performance primary.
-
-There exist other storage entries that aren't mount specific.  For example, the Integrated
-Storage Autopilot configuration is an `ignored` storage entry, which allows for disaster recovery
-secondaries to have a different configuration than their primary.  Tokens and leases are written to
-`local` storage entries.
-
-## Performance replication
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-In Performance Replication, secondaries keep track of their own tokens and leases
-but share the underlying configuration, policies, and supporting secrets (KV values,
-encryption keys for `transit`, etc).
-
-If a user action would modify underlying shared state, the secondary forwards the request
-to the primary to be handled; this is transparent to the client. In practice, most
-high-volume workloads (reads in the `kv` backend, encryption/decryption operations
-in `transit`, etc.) can be satisfied by the local secondary, allowing Vault to scale
-relatively horizontally with the number of secondaries rather than vertically as
-in the past.
-
-<Note title="Performance replication does not include automated integrated storage snapshots">
-
-Vault does not replicate automated integrated storage snapshots as a part of
-performance replication. 
-
-You must explicitly configure each of the primary and secondary performance
-clusters to create individual automated snapshots replicas.
-
-</Note>
-
-### Paths filter
-
-The primary cluster's mount configuration gets replicated across its secondary
-clusters when you enable Performance Replication. In some cases, you may not
-want all data to be replicated. For example, your primary cluster is in the EU
-region, and you have a secondary cluster outside of the EU region. [General Data
-Protection Regulation (GDPR)](https://gdpr.eu/) requires that personally
-identifiable data not be physically transferred to locations outside the
-European Union unless the region or country has an equal rigor of data
-protection regulation as the EU.
-
-To comply with GDPR, leverage Vault's **paths filter**  feature to abide by
-data movements and sovereignty regulations while ensuring performance access
-across geographically distributed regions.
-
-You can set filters based on the mount path of the secrets engines and
-namespaces.
-
-![Performance Replication - primary](/img/vault-mount-filter-7.png)
-
-In the above example, the `EU_GDPR_data/` path and `office_FR` namespace will
-not be replicated and remain only on the primary cluster.
-
-On a similar note, if you want to avoid secondary cluster's data to be
-replicated, you can mark those secrets engine and/or auth methods **local**.
-Local secrets engines and auth methods are not replicated or removed by
-replication.
-
-**Example:** When you enable a secrets engine on a secondary cluster, use the
-`-local` flag.
-
-```shell-session
-$ vault secrets enable -local -path=us_west_data kv-v2
-```
-
--> **Learn:** Refer to the [Performance Replication with Paths
-Filter](/vault/tutorials/enterprise/paths-filter) tutorial for
-step-by-step instructions.
-
-
-## Disaster recovery (DR) replication
-
-In disaster recovery (or DR) replication, secondaries share the same underlying configuration,
-policy, and supporting secrets (KV values, encryption keys for `transit`, etc) infrastructure
-as the primary. They also share the same token and lease infrastructure as the primary, as
-they are designed to allow for continuous operations with applications connecting to the
-original primary on the election of the DR secondary.
-
-DR is designed to be a mechanism to protect against catastrophic failure of entire clusters.
-They do not forward service read or write requests until they are elected and become a new primary.
-
--> **Note**: Unlike with Performance Replication, local secret engines, auth methods and audit devices are replicated to a DR secondary.
-
-
-For more information on the capabilities of performance and disaster recovery replication, see the Vault Replication [API Documentation](/vault/api-docs/system/replication).
-
-## Primary and secondary cluster compatibility
-
-### Storage engines
-
-There is no requirement that both clusters use the same storage engine.
-
-### Seals
-
-There is no requirement that both clusters use the same seal type, but see
-[sealwrap](/vault/docs/enterprise/sealwrap#seal-wrap-and-replication) for the full
-details.
-
-Also note that enabling replication will modify the secondary seal.
-If the secondary uses an auto seal, its recovery configuration and keys
-will be replaced; if it uses shamir, its seal configuration and unseal
-keys will be replaced. Here seal/recovery configuration means the number of
-seal/recovery key fragments and the required threshold of those
-fragments.
-
-| Primary Seal | Secondary Seal (before) | Secondary Seal (after)                 | Secondary Recovery Key (after) | Impact on Secondary of Enabling Replication                                 |
-|--------------|-------------------------|----------------------------------------|--------------------------------|-----------------------------------------------------------------------------|
-| Shamir       | Shamir                  | Primary's shamir config & unseal keys  | N/A                            | Seal config and unseal keys replaced with primary's                         |
-| Shamir       | Auto                    | Unchanged                              | Receives primary seal          | Seal recovery config and keys replaced with primary's seal config and keys  |
-| Auto         | Auto                    | Unchanged                              | Receives primary recovery      | Seal recovery config and recovery keys replaced with primary's              |
-| Auto         | Shamir                  | Receives primary recovery              | N/A                            | Seal config and keys replaced with primary's recovery seal config and keys  |
-
-Note: Clusters with Shamir seal config do not have separate recovery keys. Auto includes HSM, Cloud KMS, and Transit auto-unseal.
-
-### Vault versions
-
-Vault changes are designed and tested to ensure that the
-[upgrade instructions](/vault/docs/upgrading#replication-installations) are viable, i.e.
-that a secondary can run a newer Vault version than its primary.
-
-That said, we do not recommend running replicated Vault clusters with different
-versions any longer than necessary to perform the upgrade.
-
-## Internals
-
-Details on the internal design of the replication feature can be found in the
-[replication internals](/vault/docs/internals/replication) document.
-
-## Security model
-
-Vault is trusted all over the world to keep secrets safe. As such, we have put
-extreme focus to detail to our replication model as well.
-
-### Primary/Secondary communication
-
-When a cluster is marked as the primary it generates a self-signed CA
-certificate. On request, and given a user-specified identifier, the primary
-uses this CA certificate to generate a private key and certificate and packages
-these, along with some other information, into a replication bootstrapping
-bundle, a.k.a. a secondary activation token. The certificate is used to perform
-TLS mutual authentication between the primary and that secondary.
-
-This CA certificate is never shared with secondaries, and no secondary ever has
-access to any other secondary’s certificate. In practice this means that
-revoking a secondary’s access to the primary does not allow it continue
-replication with any other machine; it also means that if a primary goes down,
-there is full administrative control over which cluster becomes primary. An
-attacker cannot spoof a secondary into believing that a cluster the attacker
-controls is the new primary without also being able to administratively direct
-the secondary to connect by giving it a new bootstrap package (which is an
-ACL-protected call).
-
-Vault makes use of Application Layer Protocol Negotiation on its cluster port.
-This allows the same port to handle both request forwarding and replication,
-even while keeping the certificate root of trust and feature set different.
-
-### Secondary activation tokens
-
-A secondary activation token is an extremely sensitive item and as such is
-protected via response wrapping. Experienced Vault users will note that the
-wrapping format for replication bootstrap packages is different from normal
-response wrapping tokens: it is a signed JWT. This allows the replication token
-to carry the redirect address of the primary cluster as part of the token. In
-most cases this means that simply providing the token to a new secondary is
-enough to activate replication, although this can also be overridden when the
-token is provided to the secondary.
-
-Secondary activation tokens should be treated like Vault root tokens. If
-disclosed to a bad actor, that actor can gain access to all Vault data. It
-should therefore be treated with utmost sensitivity. Like all
-response-wrapping tokens, once the token is used successfully (in this case, to
-activate a secondary) it is useless, so it is only necessary to safeguard it
-from one machine to the next. Like with root tokens, HashiCorp recommends that
-when a secondary activation token is live, there are multiple eyes on it from
-generation until it is used.
-
-Once a secondary is activated, its cluster information is stored safely behind
-its encrypted barrier.
-
-## Mutual TLS and load balancers
-
-Vault generates its own certificates for cluster members. All replication traffic
-uses the cluster port using these Vault-generated certificates after initial
-bootstrapping. Because of this, the cluster traffic can NOT be terminated at the
-cluster port at a load balancer level.
-
-## Tutorial
-
-Refer to the following tutorials replication setup and best practices:
-
-- [Setting up Performance Replication](/vault/tutorials/enterprise/performance-replication)
-- [Disaster Recovery Replication Setup](/vault/tutorials/enterprise/disaster-recovery)
-- [Performance Replication with Paths Filters](/vault/tutorials/enterprise/paths-filter)
-- [Monitoring Vault Replication](/vault/tutorials/monitoring/monitor-replication)
-
-## API
-
-The Vault replication component has a full HTTP API. Please see the
-[Vault Replication API](/vault/api-docs/system/replication) for more
-details.
diff --git a/website/content/docs/enterprise/sealwrap.mdx b/website/content/docs/enterprise/sealwrap.mdx
deleted file mode 100644
index da7664017e7..00000000000
--- a/website/content/docs/enterprise/sealwrap.mdx
+++ /dev/null
@@ -1,99 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise Seal Wrap
-description: |-
-  Vault Enterprise features a mechanism to wrap values with an extra layer of
-  encryption for supporting seals.
----
-
-# Seal wrap
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-Vault Enterprise features a mechanism to wrap values with an extra layer of
-encryption for supporting [seals](/vault/docs/configuration/seal). This adds an
-extra layer of protection and is useful in some compliance and regulatory
-environments, including FIPS 140-2 environments.
-
-To use this feature, you must have an active or trial license for Vault
-Enterprise Plus (HSMs). To start a trial, contact [HashiCorp
-sales](mailto:sales@hashicorp.com).
-
-## Enabling/Disabling
-
-Seal Wrap is enabled by default on supporting seals. This implies that the seal
-must be available throughout Vault's runtime. Most cloud-based seals should be
-quite reliable, but, for instance, if using an HSM in a non-HA setup a
-connection interruption to the HSM will result in issues with Vault
-functionality.
-
-To disable seal wrapping, set `disable_sealwrap = true` in Vault's
-[configuration file][configuration]. This will not affect auto-unsealing functionality; Vault's
-root key will still be protected by the seal wrapping mechanism. It will
-simply prevent other storage entries within Vault from being seal wrapped.
-
-_N.B._: This is a lazy downgrade; as keys are accessed or written their seal
-wrapping status will change. Similarly, if the flag is removed, it will be a
-lazy upgrade (which is the case when initially upgrading to a seal
-wrap-supporting version of Vault).
-
-## Activating seal wrapping
-
-For some values, seal wrapping is always enabled with a supporting seal. This
-includes the recovery key, any stored key shares, the root key, the keyring,
-and more; essentially, any Critical Security Parameter (CSP) within Vault's
-core. If upgrading from a version of Vault that did not support seal wrapping,
-the next time these values are read they will be seal-wrapped and stored.
-
-Backend mounts within Vault can also take advantage of seal wrapping. Seal
-wrapping can be activated at mount time for a given mount by mounting the
-backend with the `seal_wrap` configuration value set to `true`. (This value
-cannot currently be changed later.)
-
-A given backend's author can specify which values should be seal-wrapped by
-identifying where CSPs are stored.  They may also choose to seal wrap all or none
-of their values.
-
-Note that it is often an order of magnitude or two slower to write to and read
-from HSMs or remote seals. However, values will be cached in memory
-un-seal-wrapped (but still encrypted by Vault's built-in cryptographic barrier)
-in Vault, which will mitigate this for read-heavy workloads.
-
-## Seal wrap and replication
-
-Seal wrapping takes place below the replication logic. As a result, it is
-transparent to replication. Replication will convey which values should be
-seal-wrapped, but it is up to the seal on the local cluster to implement it.
-In practice, this means that seal wrapping can be used without needing to have
-the replicated keys on both ends of the connection; each cluster can have
-distinct keys in an HSM or in KMS.
-
-In addition, it is possible to replicate from a Shamir-protected primary
-cluster to clusters that use HSMs when seal wrapping is required in downstream
-datacenters but not in the primary.
-
-## Wrapped parameters
-
-Each plugin (whether secret or auth) maintains control over parameters it
-feels are best to Seal Wrap. These are usually just a few core values as
-Seal Wrapping does incur some performance overhead.
-
-Some examples of places where seal wrapping is used include:
-
-- The [LDAP](/vault/docs/auth/ldap), [RADIUS](/vault/docs/auth/radius),
-  [Okta](/vault/docs/auth/okta), and [AWS](/vault/docs/auth/aws) auth methods,
-  for storing their config.
-- [PKI](/vault/docs/secrets/pki) for storing the issuers and their keys,
-- [SSH](/vault/docs/secrets/ssh) for storing the CA's keys,
-- [KMIP](/vault/docs/secrets/kmip) for storing managed objects (externally-provided
-  keys) and its CA keys.
-- [Transit](/vault/docs/secrets/transit) for storing keys and their policy.
-
-## FIPS status
-
-See the [FIPS-specific Seal Wrap documentation](/vault/docs/enterprise/fips/sealwrap)
-for more information about using Seal Wrapping to achieve FIPS 140-2 compliance.
-Note that there are additional [FIPS considerations](/vault/docs/enterprise/sealwrap#seal-wrap-and-replication)
-regarding Seal Wrap usage and Vault Replication.
-
-[configuration]: /vault/docs/configuration
diff --git a/website/content/docs/enterprise/sentinel/examples.mdx b/website/content/docs/enterprise/sentinel/examples.mdx
deleted file mode 100644
index 8a562b4b23f..00000000000
--- a/website/content/docs/enterprise/sentinel/examples.mdx
+++ /dev/null
@@ -1,155 +0,0 @@
----
-layout: docs
-page_title: Sentinel Examples
-description: An overview of how Sentinel interacts with Vault Enterprise.
----
-
-# Examples
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-Following are some examples that help to introduce concepts. If you are
-unfamiliar with writing Sentinel policies in Vault, please read through to
-understand some best practices.
-
-Additional examples can be found [here](https://github.com/hashicorp/vault-guides/tree/master/governance).
-
-## MFA and CIDR check on login
-
-The following Sentinel policy requires the incoming user to successfully
-validate with an Okta MFA push request before authenticating with LDAP.
-Additionally, it ensures that only users on the 10.20.0.0/16 subnet are able to
-authenticate using LDAP.
-
-```python
-import "sockaddr"
-import "mfa"
-import "strings"
-
-# We expect logins to come only from our private IP range
-cidrcheck = rule {
-    sockaddr.is_contained("10.20.0.0/16", request.connection.remote_addr)
-}
-
-# Require ping MFA validation to succeed
-ping_valid = rule {
-    mfa.methods.ping.valid
-}
-
-main = rule when strings.has_prefix(request.path, "auth/ldap/login") {
-    ping_valid and cidrcheck
-}
-```
-
-Note the `rule when` construct on the `main` rule. This scopes the policy to
-the given condition.
-
-Vault takes a default-deny approach to security. Without such scoping, because
-active Sentinel policies must all pass successfully, the user would be forced
-to start with a passing status and then define the conditions under which
-access is denied, breaking the default-deny concept.
-
-By instead indicating the conditions under which the `main` rule (and thus, in
-this example, the entire policy) should be evaluated, the policy instead
-describes the conditions under which a matching request is successful. This
-keeps the default-deny feeling of Vault; if the evaluation condition isn't met,
-the policy is simply a no-op.
-
-## Allow only specific identity entities or groups
-
-```python
-main = rule {
-    identity.entity.name is "jeff" or
-    identity.entity.id is "fe2a5bfd-c483-9263-b0d4-f9d345efdf9f" or
-    "sysops" in identity.groups.names or
-    "14c0940a-5c07-4b97-81ec-0d423accb8e0" in keys(identity.groups.by_id)
-}
-```
-
-This example shows accessing Identity properties to make decisions, showing
-that for Identity values IDs or names can be used for reference.
-
-In general, it is more secure to use IDs. While convenient, entity names and
-group names can be switched from one entity to another, because their only
-constraint is that they must be unique. Using IDs guarantees that only that
-specific entity or group is sufficient; if the group or entity are deleted and
-recreated with the same name, the match will fail.
-
-## Instantly disallow all Previously-Generated tokens
-
-Imagine a break-glass scenario where it is discovered that there have been
-compromises of some unknown number of previously-generated tokens.
-
-In such a situation it would be possible to revoke all previous tokens, but
-this may take a while for a number of reasons, from requiring revocation of
-generated secrets to the simple delay required to remove many entries from
-storage. In addition, it could revoke tokens and generated secrets that later
-forensic analysis shows were not compromised, unnecessarily widening the impact
-of the mass revocation.
-
-In Vault's ACL system a simple deny could be put into place, but this is a very
-coarse-grained control and would require forethought to ensure that a policy
-that can be modified in such a way is attached to every token. It also would
-not prevent access to login paths or other unauthenticated paths.
-
-Sentinel offers much more fine-grained control:
-
-```python
-import "time"
-
-main = rule when not request.unauthenticated {
-    time.load(token.creation_time).unix >
-      time.load("2017-09-17T13:25:29Z").unix
-}
-```
-
-Created as an EGP on `*`, this will block all access to any path Sentinel
-operates on with a token created before the given time. Tokens created after
-this time, since they were not a part of the compromise, will not be subject to
-this restriction.
-
-## Delegate EGP policy management under a path
-
-The following policy gives token holders with this policy (via their tokens or
-their Identity entities/groups) the ability to write EGP policies that can only
-take effect at Vault paths below certain prefixes. This effectively delegates
-policy management to the team for their own key-value spaces.
-
-```python
-import "strings"
-
-data_match = func() {
-    # Make sure there is request data
-    if length(request.data else 0) is 0 {
-        return false
-    }
-
-    # Make sure request data includes paths
-    if length(request.data.paths else 0) is 0 {
-        return false
-    }
-
-    # For each path, verify that it is in the allowed list
-    for strings.split(request.data.paths, ",") as path {
-        # Make it easier for users who might be used to starting paths with
-        # slashes
-        sanitizedPath = strings.trim_prefix(path, "/")
-        if not strings.has_prefix(sanitizedPath, "dev-kv/teama/") and
-           not strings.has_prefix(sanitizedPath, "prod-kv/teama/") {
-            return false
-        }
-    }
-
-    return true
-}
-
-# Only care about writing; reading can be allowed by normal ACLs
-precond = rule {
-    request.operation in ["create", "update"] and
-    strings.has_prefix(request.path, "sys/policies/egp/")
-}
-
-main = rule when precond {
-    strings.has_prefix(request.path, "sys/policies/egp/teama-") and data_match()
-}
-```
diff --git a/website/content/docs/enterprise/sentinel/index.mdx b/website/content/docs/enterprise/sentinel/index.mdx
deleted file mode 100644
index 111e61a1c71..00000000000
--- a/website/content/docs/enterprise/sentinel/index.mdx
+++ /dev/null
@@ -1,205 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise Sentinel Integration
-description: An overview of how Sentinel interacts with Vault Enterprise.
----
-
-# Vault Enterprise and Sentinel integration
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-Vault Enterprise integrates HashiCorp Sentinel to provide a rich set of access
-control functionality. Because Vault is a security-focused product trusted with
-high-risk secrets and assets, and because of its default-deny stance,
-integration with Vault is implemented in a defense-in-depth fashion. This takes
-the form of multiple types of policies and a fixed evaluation order.
-
-## Policy types
-
-Vault's policy system has been expanded to support three types of policies:
-
-- `ACLs` - These are the [traditional Vault
-  policies](/vault/docs/concepts/policies) and remain unchanged.
-
-- `Role Governing Policies (RGPs)` - RGPs are Sentinel policies that are tied
-  to particular tokens, Identity entities, or Identity groups. They have access
-  to a rich set of controls across various aspects of Vault.
-
-- `Endpoint Governing Policies (EGPs)` - EGPs are Sentinel policies that are
-  tied to particular paths instead of tokens. They have access to as much
-  request information as possible, but they can take effect even on
-  unauthenticated paths, such as login paths.
-
-Not every unauthenticated path supports EGPs. For instance, the paths related
-to root token generation cannot support EGPs because it's already the mechanism
-of last resort if, for instance, all clients are locked out of Vault due to
-misconfigured EGPs.
-
-Like with ACLs, [root tokens](/vault/docs/concepts/tokens#root-tokens)
-are not subject to Sentinel policy checks.
-
-Sentinel execution should be considered to be significantly slower than normal
-ACL policy checking. If high performance is needed, testing should be performed
-appropriately when introducing Sentinel policies.
-
-### Policy enforcement levels
-
-Sentinel policies have three enforcement levels to choose from.
-
-| Level          | Description                                                                 |
-| -------------- | --------------------------------------------------------------------------- |
-| advisory       | The policy is allowed to fail. Can be used as a tool to educate new users.  |
-| soft-mandatory | The policy must pass unless an [override](#policy-overriding) is specified. |
-| hard-mandatory | The policy must pass.                                                       |
-
-## Policy evaluation
-
-Vault evaluates incoming requests against policies of all types that are
-applicable.
-
-![Policy evaluation](/img/diagram-policy-evaluation-workflow_light.png#light-theme-only)
-![Policy evaluation](/img/diagram-policy-evaluation-workflow_dark.png#dark-theme-only)
-
-1. If the request is unauthenticated, skip to evaluating the EGPs. Otherwise,
-   evaluate the token's ACL policies. These must grant access; as always, a
-   failure to be granted capabilities on a path via ACL policies denies the
-   request.
-2. Evaluate RGPs attached to the client token. All policies must pass according
-   to their enforcement level.
-3. Evaluate EGPs set on the requested path, and any prefix-matching EGPs set on
-   less-specific paths, are evaluated. All policies must pass according to their
-   enforcement level.
-
-Any failure at any of these steps results in a denied request.
-
-### RGPs and namespaces
-
-Policies, auth methods, secrets engines, and tokens are locked into the
-[namespace](/vault/docs/enterprise/namespaces) they are created in. However,
-identity groups can pull in entities and groups from other namespaces.
-
-<Tip>
-
-Refer to the [Set up entities and groups section of the Secure Multi-Tenancy
-with Namespaces
-tutorial](/vault/tutorials/enterprise/namespaces#set-up-entities-and-groups) for
-a step-by-step instruction.
-
-</Tip>
-
-<Warning>
-
-  As of the following versions, Vault only applies RPGs derived from identity
-  group membership to entities in child namespaces:
-
-  - `1.15.0+`
-  - `1.14.4+`
-  - `1.13.8+`
-
-</Warning>
-
-The scenarios below describe the relevant changes in more detail.
-
-#### Versions 1.15.0, 1.14.4, 1.13.8, and later
-
-The training namespace is a child namespace of the education namespace. The "Sun
-Shine" entity created in the training namespace is a member of the "Tester"
-group which is defined in the education namespace. The group members inherit the
-group-level policy.
-
-![Relationship](/img/diagram-rgp-namespace-post-115_light.png#light-theme-only)
-![Relationship](/img/diagram-rgp-namespace-post-115_dark.png#dark-theme-only)
-
-#### Versions 1.15.0-rc1, 1.14.3, 1.13.7, and earlier
-
-The training namespace is a child namespace of the education namespace. The "Sun
-Shine" entity created in the education namespace is a member of the "Tester"
-group which is defined in the training namespace. The group members inherit the
-group-level policy.
-
-![Relationship](/img/diagram-rgp-namespace-pre-115_light.png#light-theme-only)
-![Relationship](/img/diagram-rgp-namespace-pre-115_dark.png#dark-theme-only)
-
-While ACL policies and EGPs set rules on a specific path, an RGP does not
-specify a target path. RGPs are tied to tokens, identity entities, or identity
-groups that you can write rules without specifying a path.
-
-What if the deny-all RGP in the training namespace looked like:
-
-<CodeBlockConfig filename="deny-all.sentinel">
-
-```hcl
-precond = rule {
-   identity.entity.metadata.org_id is "A012345X"
-}
-
-main = rule when precond {
-   false
-}
-```
-
-</CodeBlockConfig>
-
-Vault checks the requesting token's entity metadata. If the `org_id` metadata
-exists and the value is `A012345X`, the request gets denied because the
-enforcement level is hard-mandatory. It does not matter if the request invokes a
-path starts with `/education` or `/education/training`, or even `/foo` because
-there is no path associated with the deny-all RGP.
-
-
-## Policy overriding
-
-Vault supports normal Sentinel overriding behavior. Requests to override can be
-specified on the command line via the `policy-override` flag or in HTTP
-requests by setting the `X-Vault-Policy-Override` header to `true`.
-
-Override requests are visible in Vault's audit log; in addition, override
-requests and their eventual status (whether they ended up being required) are
-logged as warnings in Vault's server logs.
-
-## MFA
-
-Sentinel policies support the [Identity-based MFA
-system](/vault/docs/enterprise/mfa) in Vault Enterprise. Within a single
-request, multiple checks of any named MFA method will only trigger
-authentication behavior for that method once, regardless of whether its
-validity is checked via ACLs, RGPs, or EGPs.
-
-EGPs can be used to require MFA on otherwise unauthenticated paths, such as
-login paths. On such paths, the request data will perform a lookahead to try to
-discover the appropriate Identity information to use for MFA. It may be
-necessary to pre-populate Identity entries or supply additional parameters with
-the request if you require more information to use MFA than the endpoint is
-able to glean from the original request alone.
-
-# Using Sentinel
-
-## Configuration
-
-Sentinel policies can be configured via the `sys/policies/rgp/` and
-`sys/policies/egp/` endpoints; see [the
-documentation](/vault/api-docs/system/policies) for more information.
-
-Once set, RGPs can be assigned to Identity entities and groups or to tokens
-just like ACL policies. As a result, they cannot share names with ACL policies.
-
-When setting an EGP, a list of paths must be provided specifying on which paths
-that EGP should take effect. Endpoints can have multiple distinct EGPs set on
-them; all are evaluated for each request. Paths can use a glob character (`*`)
-as the last character of the path to perform a prefix match; a path that
-consists only of a `*` will apply to the root of the API. Since requests are
-subject to an EGPs exactly matching the requested path and any glob EGPs
-sitting further up the request path, an EGP with a path of `*` will thus take
-effect on all requests.
-
-## Properties and examples
-
-See the [Examples](/vault/docs/enterprise/sentinel/examples) page for examples
-of Sentinel in action, and the
-[Properties](/vault/docs/enterprise/sentinel/properties) page for detailed
-property documentation.
-
-## Tutorial
-
-Refer to the [Sentinel Policies](/vault/tutorials/policies/sentinel)
-tutorial to learn how to author Sentinel policies in Vault.
diff --git a/website/content/docs/enterprise/sentinel/properties.mdx b/website/content/docs/enterprise/sentinel/properties.mdx
deleted file mode 100644
index b40582bb79d..00000000000
--- a/website/content/docs/enterprise/sentinel/properties.mdx
+++ /dev/null
@@ -1,185 +0,0 @@
----
-layout: docs
-page_title: Sentinel Properties
-description: An overview of how Sentinel interacts with Vault Enterprise.
----
-
-# Properties
-
-@include 'alerts/enterprise-and-hcp.mdx'
-
-Vault injects a rich set of data into the running Sentinel environment,
-allowing for very fine-grained controls. The set of available properties are
-enumerated on this page.
-
-The following properties are available for use in Sentinel policies.
-
-## Namespace properties
-
-The `namespace` (Sentinel) namespace gives access to information about the
-namespace in which the request is running. (This may or may not match the
-client's chosen namespace, if a request reaches into a child namespace).
-
-| Name   | Type     | Description                    |
-| :----- | :------- | :----------------------------- |
-| `id`   | `string` | The namespace ID               |
-| `path` | `string` | The root path of the namespace |
-
-## Request properties
-
-The following properties are available in the `request` namespace.
-
-| Name                     | Type                  | Description                                                                                 |
-| :----------------------- | :-------------------- | :------------------------------------------------------------------------------------------ |
-| `connection.remote_addr` | `string`              | TCP/IP source address of the client                                                         |
-| `data`                   | `map (string -> any)` | Raw request data                                                                            |
-| `operation`              | `string`              | Operation type, e.g. "read" or "update"                                                     |
-| `path`                   | `string`              | Path, with any leading `/` trimmed                                                          |
-| `policy_override`        | `bool`                | `true` if a `soft-mandatory` policy override was requested                                  |
-| `unauthenticated`        | `bool`                | `true` if the requested path is an unauthenticated path                                     |
-| `wrapping.ttl`           | `duration`            | The requested response-wrapping TTL in nanoseconds, suitable for use with the `time` import |
-| `wrapping.ttl_seconds`   | `int`                 | The requested response-wrapping TTL in seconds                                              |
-
-### Replication properties
-
-The following properties exists at the `replication.mode` namespace.
-
-| Name          | Type     | Description                                                                                                    |
-| :------------ | :------- | :------------------------------------------------------------------------------------------------------------- |
-| `dr`          | `string` | The state of DR replication. Valid values are "disabled", "bootstrapping", "primary", and "secondary"          |
-| `replication` | `string` | The state of performance replication. Valid values are "disabled", "bootstrapping", "primary", and "secondary" |
-
-## Token properties
-
-The following properties, if available, are in the `token` namespace. The
-namespace will not exist if there is no token information attached to a
-request, e.g. when logging in.
-
-| Name                       | Type                     | Description                                                                                                                        |
-| :------------------------- | :----------------------- | :--------------------------------------------------------------------------------------------------------------------------------- |
-| `creation_time`            | `string`                 | The timestamp of the token's creation, in RFC3339 format                                                                           |
-| `creation_time_unix`       | `int`                    | The timestamp of the token's creation, in seconds since Unix epoch UTC                                                             |
-| `creation_ttl`             | `duration`               | The TTL the token was first created with in nanoseconds, suitable for use with the `time` import                                   |
-| `creation_ttl_seconds`     | `int`                    | The TTL the token was first created with in seconds                                                                                |
-| `display_name`             | `string`                 | The display name set on the token, if any                                                                                          |
-| `entity_id`                | `string`                 | The Identity entity ID attached to the token, if any                                                                               |
-| `explicit_max_ttl`         | `duration`               | If the token has an explicit max TTL, the duration of the explicit max TTL in nanoseconds, suitable for use with the `time` import |
-| `explicit_max_ttl_seconds` | `int`                    | If the token has an explicit max TTL, the duration of the explicit max TTL in seconds                                              |
-| `metadata`                 | `map (string -> string)` | Metadata set on the token                                                                                                          |
-| `num_uses`                 | `int`                    | The number of uses remaining on a use-count-limited token; 0 if the token has no use-count limit                                   |
-| `path`                     | `string`                 | The request path that resulted in creation of this token                                                                           |
-| `period`                   | `duration`               | If the token has a period, the duration of the period in nanoseconds, suitable for use with the `time` import                      |
-| `period_seconds`           | `int`                    | If the token has a period, the duration of the period in seconds                                                                   |
-| `policies`                 | `list (string)`          | Policies directly attached to the token                                                                                            |
-| `role`                     | `string`                 | If created via a token role, the role that created the token                                                                       |
-| `type`                     | `string`                 | The type of token, currently will be either `batch` or `service`                                                                   |
-
-## Token namespace properties
-
-The following properties, if available, are in the `token.namespace` namespace.
-The (Sentinel) namespace will not exist if there is no token information attached to a
-request, e.g. when logging in.
-
-| Name   | Type     | Description                    |
-| :----- | :------- | :----------------------------- |
-| `id`   | `string` | The namespace ID               |
-| `path` | `string` | The root path of the namespace |
-
-## Identity properties
-
-The following properties, if available, are in the `identity` namespace. The
-namespace may not exist if there is no token information attached to the
-request; however, at login time the user's request data will be used to attempt
-to find any existing Identity information, or create some information to pass
-to MFA functions.
-
-### Entity properties
-
-These exist at the `identity.entity` namespace.
-
-| Name                | Type                     | Description                                                   |
-| :------------------ | :----------------------- | :------------------------------------------------------------ |
-| `creation_time`     | `string`                 | The entity's creation time in RFC3339 format                  |
-| `id`                | `string`                 | The entity's ID                                               |
-| `last_update_time`  | `string`                 | The entity's last update (modify) time in RFC3339 format      |
-| `metadata`          | `map (string -> string)` | Metadata associated with the entity                           |
-| `name`              | `string`                 | The entity's name                                             |
-| `merged_entity_ids` | `list (string)`          | A list of IDs of entities that have been merged into this one |
-| `aliases`           | `list (alias)`           | List of aliases associated with this entity                   |
-| `policies`          | `list (string)`          | List of the policies set on this entity                       |
-
-### Alias properties
-
-These can be retrieved from `identity.entity.aliases`.
-
-| Name                     | Type                     | Description                                                                                                                                   |
-| :----------------------- | :----------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------- |
-| `creation_time`          | `string`                 | The alias's creation time in RFC3339 format                                                                                                   |
-| `id`                     | `string`                 | The alias's ID                                                                                                                                |
-| `last_update_time`       | `string`                 | The alias's last update (modify) time in RFC3339 format                                                                                       |
-| `metadata`               | `map (string -> string)` | Metadata associated with the alias
-| `custom_metadata`        | `map (string -> string)` | Custom metadata associated with the alias                                                                                                            |
-| `merged_from_entity_ids` | `list (string)`          | If this alias was attached to the current entity via one or more merges, the original entity/entities will be in this list                    |
-| `mount_accessor`         | `string`                 | The immutable accessor of the mount that created this alias                                                                                   |
-| `mount_path`             | `string`                 | The path of the mount that created this alias; unlike the accessor, there is no guarantee that the current path represents the original mount |
-| `mount_type`             | `string`                 | The type of the mount that created this alias                                                                                                 |
-| `name`                   | `string`                 | The alias's name                                                                                                                              |
-
-### Groups properties
-
-These exist at the `identity.groups` namespace.
-
-| Name      | Type                    | Description                                                                                                                                     |
-| :-------- | :---------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------- |
-| `by_id`   | `map (string -> group)` | A map of group ID to group information                                                                                                          |
-| `by_name` | `map (string -> group)` | A map of group name to group information; unlike the group ID, there is no guarantee that the current name will always represent the same group |
-
-### Group properties
-
-These can be retrieved from the `identity.groups` maps.
-
-| Name                | Type                     | Description                                                        |
-| :------------------ | :----------------------- | :----------------------------------------------------------------- |
-| `creation_time`     | `string`                 | The group's creation time in RFC3339 format                        |
-| `id`                | `string`                 | The group's ID                                                     |
-| `last_update_time`  | `string`                 | The group's last update (modify) time in RFC3339 format            |
-| `metadata`          | `map (string -> string)` | Metadata associated with the group                                 |
-| `name`              | `string`                 | The group's name                                                   |
-| `member_entity_ids` | `list (string)`          | A list of IDs of entities that are directly assigned to this group |
-| `parent_group_ids`  | `list (string)`          | A list of IDs of groups that are parents of this group             |
-| `policies`          | `list (string)`          | List of the policies set on this group                             |
-
-## MFA properties
-
-These properties exist at the `mfa` namespace.
-
-| Name      | Type                     | Description                               |
-| :-------- | :----------------------- | :---------------------------------------- |
-| `methods` | `map (string -> method)` | A map of method name to method properties |
-
-### MFA method properties
-
-These properties can be accessed via the `mfa.methods` selector.
-
-| Name    | Type   | Description                                                                                                                                                                                                                                   |
-| :------ | :----- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `valid` | `bool` | Whether the method has successfully been validated; if validation has not been attempted, this will trigger the validation attempt. The result of the validation attempt will be used for this method for all policies for the given request. |
-
-## Control group properties
-
-These properties exist at the `controlgroup` namespace.
-
-| Name                   | Type                   | Description                                 |
-| :--------------------- | :--------------------- | :------------------------------------------ |
-| `time`, `request_time` | `string`               | The original request time in RFC3339 format |
-| `authorizations`       | `list (authorization)` | List of control group authorizations        |
-
-### Control group authorization
-
-These properties can be accessed via the `controlgroup.authorizations` selector.
-
-| Name     | Type              | Description                                                |
-| :------- | :---------------- | :--------------------------------------------------------- |
-| `time`   | `string`          | The authorization time in RFC3339 format                   |
-| `entity` | `identity.entity` | The identity entity for the authorizer.                    |
-| `groups` | `identity.groups` | The map of identity groups associated with the authorizer. |
diff --git a/website/content/docs/faq/index.mdx b/website/content/docs/faq/index.mdx
deleted file mode 100644
index 3c1056e4109..00000000000
--- a/website/content/docs/faq/index.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
----
-layout: docs
-page_title: Product Features FAQ
-sidebar_title: FAQ for product and features
-description: |-
-  An FAQ page for product and features.
----
-
-# Product features FAQ
-
-You can access a number of different FAQ pages to get answers to questions about our product and features. These FAQ pages are updated periodically so please check back for the latest updates and new FAQ questions.
diff --git a/website/content/docs/faq/ssct.mdx b/website/content/docs/faq/ssct.mdx
deleted file mode 100644
index aaf5999c392..00000000000
--- a/website/content/docs/faq/ssct.mdx
+++ /dev/null
@@ -1,127 +0,0 @@
----
-layout: docs
-page_title: Server Side Consistent Token FAQ
-description: An list of frequently asked questions about server side consistent tokens
----
-
-# Server side consistent token FAQ
-
-This FAQ section contains frequently asked questions about the Server Side Consistent Token feature.
-
-- [Q: What is the Server Side Consistent Token feature?](#q-what-is-the-server-side-consistent-token-feature)
-- [Q: I have Vault Community Edition. How does this feature impact me?](#q-i-have-vault-community-edition-how-does-this-feature-impact-me)
-- [Q: What token changes does the Server Side Consistent Tokens feature introduce?](#q-what-token-changes-does-the-server-side-consistent-tokens-feature-introduce)
-- [Q: Why are we changing the token?](#q-why-are-we-changing-the-token)
-- [Q: What type of tokens are impacted by this feature?](#q-what-type-of-tokens-are-impacted-by-this-feature)
-- [Q: Is there a new configuration that this feature introduces?](#q-is-there-a-new-configuration-that-this-feature-introduces)
-- [Q: Is there anything else I need to consider to achieve consistency, besides upgrading to Vault 1.10?](#q-is-there-anything-else-i-need-to-consider-to-achieve-consistency-besides-upgrading-to-vault-1-10)
-- [Q: What do I need to be paying attention to if I rely on tokens for some of my workflows?](#q-what-do-i-need-to-be-paying-attention-to-if-i-rely-on-tokens-for-some-of-my-workflows)
-- [Q: What are the main mitigation options that Vault offers to achieve consistency, and what are the differences between them?](#q-what-are-the-main-mitigation-options-that-vault-offers-to-achieve-consistency-and-what-are-the-differences-between-them)
-- [Q: Is this feature something I need with Consul Storage?](#q-is-this-feature-something-i-need-with-consul-storage)
-
-### Q: what is the server side consistent token feature?
-
-~> **Note**: This features requires Vault Enterprise.
-
-Vault has an [eventual consistency](/vault/docs/enterprise/consistency) model where only the leader can write to Vault's storage. When using performance standbys with Integrated Storage, there are sequences of operations that don't always yield read-after-write consistency, which may pose a challenge for some use cases.
-
-Several client-based mitigations were added in Vault version 1.7, which depended on some modifications to clients (provide the appropriate response header per request) so they can specify state. This may not be possible to do in some environments.
-
-To help with such cases, we’ve now added support for the Server Side Consistent Tokens feature in Vault version 1.10. See [Replication](/vault/docs/configuration/replication), [Vault Eventual Consistency](/vault/docs/enterprise/consistency), and [Upgrade to 1.10](/vault/docs/upgrading/upgrade-to-1.10.x).
-This feature provides a way for Service tokens, returned from logins (or token create requests), to have the relevant minimum WAL state information embedded within the token itself. Clients can then use this token to authenticate subsequent requests. Thus, clients can obtain read-after-write consistency for the token without typically having to make changes to their code or architecture.
-If a performance standby does not have the state required to authenticate the token, it returns a 412 error to allow the client to retry. If client retry is not possible, there is a server config to allow for the consistency.
-
-### Q: i have Vault Community Edition. how does this feature impact me?
-
-For the sake of standardization between Community and Enterprise, and due to the value of adding token prefixes in Vault for token scanning use cases, the token formats are changed across all Vault versions starting Vault 1.10. However, since there are no performance standbys or replication in Vault Community Edition, the new Vault token will always show the local index of the WAL as 0 to indicate there is nothing to wait for.
-
-### Q: what token changes does the server side consistent tokens feature introduce?
-
-Server Side Consistent Tokens introduces the following key changes:
-
-- Token length : Server side consistent tokens are longer, being 95+ characters as opposed to 27+ characters. Since the token can be subject to change (see [Token](/vault/docs/concepts/tokens)), we recommend that you plan for a maximum length of 255 bytes to future proof yourself if you have workflows that rely on the token size.
-- By default, Vault 1.10 will use the new token prefixes and new token format.
-- Tokens don't visibly have a ".namespaceID" suffix
-- Token prefix: Token prefixes are being changed as follows:
-
-| Token Type      | Old Prefix | New Prefix |
-| --------------- | ---------- | ---------- |
-| Service Tokens  | s.         | hvs.       |
-| Batch Tokens    | b.         | hvb.       |
-| Recovery Tokens | r.         | hvr.       |
-
-### Q: why are we changing the token?
-
-To help with use cases that need read-after-write consistency, the Server Side Consistent Tokens feature provides a way for Service tokens, returned from logins (or token create requests), to embed the relevant information for Vault servers using Integrated Storage to know the minimum WAL index that includes the storage write for the token. This entails changes to the service token format.
-
-The token prefix is being updated to make it easier for static-analysis code scanning tools to scan for Vault tokens, for example, to identify Vault tokens that are accidentally stored in a version control system.
-
-### Q: what type of tokens are impacted by this feature?
-
-With the exception of the prefix changes detailed above that apply to all token types, only Service tokens are impacted by the changes that are introduced by this feature. Other token types such as batch tokens, recovery tokens, or root service tokens are not impacted.
-
-### Q: is there a new configuration that this feature introduces?
-
-There is a new configuration in the replication section as follows:
-
-```
-replication { 
-  allow_forwarding_via_token = "new_token"
-}
-```
-
-This configuration allows Vault clusters to be configured so that requests made to performance standbys that don’t yet have the most up-to-date WAL index are forwarded to the active node. Please note that there will be extra load on the active node with this type of configuration.
-
-### Q: is there anything else i need to consider to achieve consistency, besides upgrading to Vault 1.10?
-
-Yes, there are several considerations to keep in mind, and possibly things that may require you to take action, depending on your use case.
-
-- As stated earlier, if a performance standby does not have the state required to authenticate the token, it returns a 412 error allowing the client to retry.
-- Ensure that your clients can retry for the best experience.
-- Starting with Go api version [1.1.0](https://pkg.go.dev/github.com/hashicorp/vault/api@v1.1.0), the Go client library enables automatic retries for 412 errors. By default, retries=2, or use client method [SetMaxRetries](https://pkg.go.dev/github.com/hashicorp/vault/api#Client.SetMaxRetries). Or, you can use the Vault environment variable [VAULT_MAX_RETRIES](/vault/docs/commands#vault_max_retries) to achieve the same result.
-- If you use a client library other than Go, you may still need to ensure that your client can handle 412 retries in order to achieve consistency.
-- If your client cannot retry, you can use the Vault server replication configuration `allow_forwarding_via_token`  to allow for consistency. As stated earlier, this will incur extra load on the server due to forwarding of requests that don't have the up-to-date WAL-state to the server:
-
-```
-replication { 
-  allow_forwarding_via_token = "new_token"
-}
-```
-
-~> **Note:** If you are generating root tokens or recovery tokens without using the Vault CLI, you will need to modify the OTP length used. refer [here](/vault/docs/upgrading/upgrade-to-1.10.x) for details.
-
-### Q: what do i need to be paying attention to if i rely on tokens for some of my workflows?
-
-Our documentation on [tokens](/vault/docs/concepts/tokens) clearly identifies that the token body itself is subject to change between versions and should not be relied on. We strongly recommend that you consider this while architecting your environment.
-
-However, if you use scripting and tooling to help in the authentication process for Vault-dependent applications, it is important that you take time to understand the changes (see [Replication](/vault/docs/configuration/replication), [Vault Eventual Consistency](/vault/docs/enterprise/consistency), and [Upgrade to 1.10](/vault/docs/upgrading/upgrade-to-1.10.x)), and test these changes in your specific dev environments before deploying this in production.
-
-If your workflow used the embedded NamespaceID suffix, you will need to perform a [token lookup](/vault/docs/commands/token/lookup) because this is currently absent in the new tokens.
-
-### Q: what are the main mitigation options that Vault offers to achieve consistency, and what are the differences between them?
-
-Vault offers the following options to achieve consistency:
-
-- [Client based mitigations](/vault/docs/enterprise/consistency#vault-1-7-mitigations), which was added in Vault Release 1.7, depend on some modifications to clients to include per request header options to ‘always forward the request to the active node’ OR to ‘conditionally forward the request to the active node’ if it would otherwise result in a stale read OR to ‘fail requests’ with error 412 if they might result in a stale read.
-- The Vault Agent can also be leveraged for proxied requests to achieve consistency via the above mitigations without client modifications
-- Server Side Consistent Tokens, added in Vault version 1.10, provide a more implicit way to achieve consistency, but only addresses consistency for new tokens.
-
-The following table outlines the main differences:
-
-| Client Controlled Consistency                                                                     | Agent with client controlled consistency settings                                                           | Server Side Consistent Tokens                                                                                      |
-| ------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| Needs Client side modifications for consistency (per request header options need to be included). | Vault Agent can also be leveraged to achieve consistency without client modifications for proxied requests. | Implicit way for consistency where the relevant minimum WAL state information is embedded within the token itself. |
-| Works across clusters too (Performance standbys and Performance Replication)                      | Single cluster only (Performance Standby)                                                                   | Single cluster only (Performance Standby)                                                                          |
-| Applies to any Vault operation                                                                    | Applies to any Vault operation                                                                              | Applies to login / token create requests only                                                                      |
-| May have performance implications via enforcing too much consistency                              | May have performance implications, via enforcing too much consistency for proxied requests                  | May have performance implications if server side configuration to forward requests to active nodes is leveraged.   |
-
-~> **Note:** Client controlled consistency headers , if configured, will take precedence over the server configuration.
-
-Finally, when speaking of performance implications above, there are two kinds that you should keep in mind while selecting the best option for your use case:
-
-- Using forwarding will impact horizontal scalability by placing additional load on the active node
-- No using forwarding will impact latency of client requests due to retrying until the state is consistency
-
-### Q: is this feature something i need with consul storage?
-
-Consul has a [default consistency model](/consul/api-docs/features/consistency) and this feature is not relevant with Consul storage.
diff --git a/website/content/docs/get-started/developer-qs.mdx b/website/content/docs/get-started/developer-qs.mdx
deleted file mode 100644
index 4a642a097d3..00000000000
--- a/website/content/docs/get-started/developer-qs.mdx
+++ /dev/null
@@ -1,631 +0,0 @@
----
-layout: docs
-page_title: Developer Quick Start
-description: Learn how to store and retrieve your first secret.
----
-
-# Developer quick start
-
-This quick start will explore how to use Vault client libraries inside your application code to store and retrieve your first secret value. Vault takes the security burden away from developers by providing a secure, centralized secret store for an application’s sensitive data: credentials, certificates, encryption keys, and more.
-
-The complete code samples for the steps below are available here:
-
-- [Go](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/go/example.go)
-- [Ruby](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/ruby/example.rb)
-- [C#](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/dotnet/Example.cs)
-- [Python](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/python/example.py)
-- [Java (Spring)](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/java/Example.java)
-- [OpenAPI-based Go](https://github.com/hashicorp/vault-client-go/#getting-started)
-- [OpenAPI-based .NET](https://github.com/hashicorp/vault-client-dotnet/#getting-started)
-
-For an out-of-the-box runnable demo application showcasing these concepts and more, see the hello-vault repositories ([Go](https://github.com/hashicorp/hello-vault-go), [C#](https://github.com/hashicorp/hello-vault-dotnet) and [Java/Spring Boot](https://github.com/hashicorp/hello-vault-spring)).
-
-## Prerequisites
-
-- [Docker](https://docs.docker.com/get-docker/) or a [local installation](/vault/tutorials/getting-started/getting-started-install) of the Vault binary
-- A development environment applicable to one of the languages in this quick start (currently **Go**, **Ruby**, **C#**, **Python**, **Java (Spring)**, and **Bash (curl)**)
-
--> **Note**: Make sure you are using the [latest version](https://docs.docker.com/engine/release-notes/) of Docker. Older versions may not work. As of 1.12.0, the recommended version of Docker is 20.10.17 or higher.
-
-## Step 1: start Vault
-
-!> **Warning**: This in-memory “dev” server is useful for practicing with Vault locally for the first time, but is insecure and **should never be used in production**. For developers who need to manage their own production Vault installations, this [page](/vault/tutorials/operations/production-hardening) provides some guidance on how to make your setup more production-friendly.
-
-Run the Vault server in a non-production "dev" mode in one of the following ways:
-
-**For Docker users, run this command**:
-
-```shell-session
-$ docker run -p 8200:8200 -e 'VAULT_DEV_ROOT_TOKEN_ID=dev-only-token' vault
-```
-
-**For non-Docker users, run this command**:
-
-```shell-session
-$ vault server -dev -dev-root-token-id="dev-only-token"
-```
-
-The `-dev-root-token-id` flag for dev servers tells the Vault server to allow full root access to anyone who presents a token with the specified value (in this case "dev-only-token").
-
-!> **Warning**: The [root token](/vault/docs/concepts/tokens#root-tokens) is useful for development, but allows full access to all data and functionality of Vault, so it must be carefully guarded in production. Ideally, even an administrator of Vault would use their own token with limited privileges instead of the root token.
-
-Vault is now listening over HTTP on port **8200**. With all the setup out of the way, it's time to get coding!
-
-## Step 2: install a client library
-
-To read and write secrets in your application, you need to first configure a client to connect to Vault.
-Let's install the Vault client library for your language of choice.
-
--> **Note**: Some of these libraries are currently community-maintained.
-
-<Tabs>
-<Tab heading="Go" group="go">
-
-[Go](https://pkg.go.dev/github.com/hashicorp/vault/api) (official) client library:
-
-```shell-session
-$ go get github.com/hashicorp/vault/api
-```
-
-Now, let's add the import statements for the client library to the top of the file.
-
-<CodeBlockConfig heading="import statements for client library" lineNumbers>
-
-```go
-import vault "github.com/hashicorp/vault/api"
-```
-
-</CodeBlockConfig>
-
-</Tab>
-<Tab heading="Ruby" group="ruby">
-
-
-[Ruby](https://github.com/hashicorp/vault-ruby) (official) client library:
-
-```shell-session
-$ gem install vault
-```
-
-Now, let's add the import statements for the client library to the top of the file.
-
-<CodeBlockConfig heading="import statements for client library" lineNumbers>
-
-```ruby
-require "vault"
-```
-
-</CodeBlockConfig>
-
-</Tab>
-<Tab heading="C#" group="cs">
-
-
-[C#](https://github.com/rajanadar/VaultSharp) client library:
-
-```shell-session
-$ dotnet add package VaultSharp
-```
-
-Now, let's add the import statements for the client library to the top of the file.
-
-<CodeBlockConfig heading="import statements for client library" lineNumbers>
-
-```cs
-using VaultSharp;
-using VaultSharp.V1.AuthMethods;
-using VaultSharp.V1.AuthMethods.Token;
-using VaultSharp.V1.Commons;
-```
-
-</CodeBlockConfig>
-
-</Tab>
-<Tab heading="Python" group="python">
-
-
-[Python](https://github.com/hvac/hvac) client library:
-
-```shell-session
-$ pip install hvac
-```
-
-Now, let's add the import statements for the client library to the top of the file.
-
-<CodeBlockConfig heading="import statements for client library" lineNumbers>
-
-```Python
-import hvac
-```
-
-</CodeBlockConfig>
-
-</Tab>
-<Tab heading="Java" group="java">
-
-
-[Java (Spring)](https://spring.io/projects/spring-vault) client library:
-
-Add the following to pom.xml:
-
-```xml
-<dependency>
-     <groupId>org.springframework.vault</groupId>
-     <artifactId>spring-vault-core</artifactId>
-     <version>2.3.1</version>
-</dependency>
-```
-
-Now, let's add the import statements for the client library to the top of the file.
-
-<CodeBlockConfig heading="import statements for client library" lineNumbers>
-
-```Java
-import org.springframework.vault.authentication.TokenAuthentication;
-import org.springframework.vault.client.VaultEndpoint;
-import org.springframework.vault.support.Versioned;
-import org.springframework.vault.core.VaultTemplate;
-```
-
-</CodeBlockConfig>
-
-</Tab>
-<Tab heading="OpenAPI Go (Beta)" group="openAPI-go">
-
-
-[OpenAPI Go](https://github.com/hashicorp/vault-client-go) (Beta) client library:
-
-```shell-session
-$ go get github.com/hashicorp/vault-client-go
-```
-
-Now, let's add the import statements for the client library to the top of the file.
-
-<CodeBlockConfig heading="import statements for client library" lineNumbers>
-
-```go
-import (
-	"github.com/hashicorp/vault-client-go"
-	"github.com/hashicorp/vault-client-go/schema"
-)
-```
-
-</CodeBlockConfig>
-
-
-</Tab>
-<Tab heading="OpenAPI .NET (Beta)" group="openAPI-dotnet">
-
-
-[OpenAPI .NET](https://github.com/hashicorp/vault-client-dotnet) (Beta) client library:
-
-Vault is a package available at [Hashicorp Nuget](https://www.nuget.org/profiles/hashicorp).
-
-
-```shell-session
-$ nuget install HashiCorp.Vault -Version "0.1.0-beta"
-```
-
-**Or:**
-
-```shell-session
-$ dotnet add package Hashicorp.Vault -version "0.1.0-beta"
-```
-
-Now, let's add the import statements for the client library to the top of the file.
-
-<CodeBlockConfig heading="import statements for client library" lineNumbers>
-
-```cs
-using Vault;
-using Vault.Client;
-```
-
-</CodeBlockConfig>
-
-</Tab>
-</Tabs>
-
-
-## Step 3: authenticate to Vault
-
-A variety of [authentication methods](/vault/docs/auth) can be used to prove your application's identity to the Vault server. To explore more secure authentication methods, such as via Kubernetes or your cloud provider, see the auth code snippets in the [vault-examples](https://github.com/hashicorp/vault-examples) repository.
-
-To keep things simple for our example, we'll just use the root token created in **Step 1**.
-Paste the following code to initialize a new Vault client that will use token-based authentication for all its requests:
-
-<Tabs>
-<Tab heading="Go">
-
-```go
-config := vault.DefaultConfig()
-
-config.Address = "http://127.0.0.1:8200"
-
-client, err := vault.NewClient(config)
-if err != nil {
-    log.Fatalf("unable to initialize Vault client: %v", err)
-}
-
-client.SetToken("dev-only-token")
-```
-
-</Tab>
-<Tab heading="Ruby" group="ruby">
-
-```ruby
-Vault.configure do |config|
-    config.address = "http://127.0.0.1:8200"
-    config.token = "dev-only-token"
-end
-```
-
-</Tab>
-<Tab heading="C#" group="cs">
-
-```cs
-IAuthMethodInfo authMethod = new TokenAuthMethodInfo(vaultToken: "dev-only-token");
-
-VaultClientSettings vaultClientSettings = new
-VaultClientSettings("http://127.0.0.1:8200", authMethod);
-IVaultClient vaultClient = new VaultClient(vaultClientSettings);
-```
-
-</Tab>
-<Tab heading="Python" group="python">
-
-```Python
-client = hvac.Client(
-    url='http://127.0.0.1:8200',
-    token='dev-only-token',
-)
-```
-
-</Tab>
-<Tab heading="Java" group="java">
-
-```Java
-VaultEndpoint vaultEndpoint = new VaultEndpoint();
-
-vaultEndpoint.setHost("127.0.0.1");
-vaultEndpoint.setPort(8200);
-vaultEndpoint.setScheme("http");
-
-VaultTemplate vaultTemplate = new VaultTemplate(
-    vaultEndpoint,
-    new TokenAuthentication("dev-only-token")
-);
-```
-
-</Tab>
-<Tab heading="Bash" group="bash">
-
-```shell-session
-$ export VAULT_TOKEN="dev-only-token"
-```
-
-</Tab>
-<Tab heading="OpenAPI Go (Beta)" group="openAPI-go">
-
-```go
-client, err := vault.New(
-   vault.WithAddress("http://127.0.0.1:8200"),
-   vault.WithRequestTimeout(30*time.Second),
-)
-if err != nil {
-   log.Fatal(err)
-}
-
-if err := client.SetToken("dev-only-token"); err != nil {
-   log.Fatal(err)
-}
-```
-
-</Tab>
-<Tab heading="OpenAPI .NET (Beta)" group="openAPI-dotnet">
-
-```cs
-string address = "http://127.0.0.1:8200";
-VaultConfiguration config = new VaultConfiguration(address);
-
-VaultClient vaultClient = new VaultClient(config);
-vaultClient.SetToken("dev-only-token");
-```
-
-</Tab>
-</Tabs>
-
-## Step 4: store a secret
-
-Secrets are sensitive data like API keys and passwords that we shouldn’t be storing in our code or configuration files. Instead, we want to store values like this in Vault.
-
-We'll use the Vault client we just initialized to write a secret to Vault, like so:
-
-<Tabs>
-<Tab heading="Go">
-
-```go
-secretData := map[string]interface{}{
-    "password": "Hashi123",
-}
-
-
-_, err = client.KVv2("secret").Put(context.Background(), "my-secret-password", secretData)
-if err != nil {
-    log.Fatalf("unable to write secret: %v", err)
-}
-
-fmt.Println("Secret written successfully.")
-```
-
-</Tab>
-<Tab heading="Ruby" group="ruby">
-
-```ruby
-secret_data = {data: {password: "Hashi123"}}
-Vault.logical.write("secret/data/my-secret-password", secret_data)
-
-puts "Secret written successfully."
-```
-
-</Tab>
-<Tab heading="C#" group="cs">
-
-```cs
-var secretData = new Dictionary<string, object> { { "password", "Hashi123" } };
-vaultClient.V1.Secrets.KeyValue.V2.WriteSecretAsync(
-    path: "/my-secret-password",
-    data: secretData,
-    mountPoint: "secret"
-).Wait();
-
-Console.WriteLine("Secret written successfully.");
-```
-
-</Tab>
-<Tab heading="Python" group="python">
-
-```Python
-create_response = client.secrets.kv.v2.create_or_update_secret(
-    path='my-secret-password',
-    secret=dict(password='Hashi123'),
-)
-
-print('Secret written successfully.')
-```
-
-</Tab>
-<Tab heading="Java" group="java">
-
-```Java
-Map<String, String> data = new HashMap<>();
-data.put("password", "Hashi123");
-
-Versioned.Metadata createResponse = vaultTemplate
-    .opsForVersionedKeyValue("secret")
-    .put("my-secret-password", data);
-
-System.out.println("Secret written successfully.");
-```
-
-</Tab>
-<Tab heading="Bash" group="bash">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: $VAULT_TOKEN" \
-    --header "Content-Type: application/json" \
-    --request POST \
-    --data '{"data": {"password": "Hashi123"}}' \
-    http://127.0.0.1:8200/v1/secret/data/my-secret-password
-```
-
-</Tab>
-<Tab heading="OpenAPI Go (Beta)" group="openAPI-go">
-
-```go
-_, err = client.Secrets.KVv2Write(context.Background(), "my-secret-password", schema.KVv2WriteRequest{
-   Data: map[string]any{
-      "password": "Hashi123",
-   },
-})
-if err != nil {
-   log.Fatal(err)
-}
-
-log.Println("Secret written successfully.")
-```
-
-</Tab>
-<Tab heading="OpenAPI .NET (Beta)" group="openAPI-dotnet">
-
-```cs
-var secretData = new Dictionary<string, string> { { "password", "Hashi123" } };
-
-// Write a secret
-var kvRequestData = new KVv2WriteRequest(secretData);
-
-vaultClient.Secrets.KVv2Write("my-secret-password", kvRequestData);
-```
-
-</Tab>
-</Tabs>
-
-A common way of storing secrets is as key-value pairs using the [KV secrets engine (v2)](/vault/docs/secrets/kv/kv-v2). In the code we've just added, `password` is the key in the key-value pair, and `Hashi123` is the value.
-
-We also provided the path to our secret in Vault. We will reference this path in a moment when we learn how to retrieve our secret.
-
-Run the code now, and you should see `Secret written successfully`. If not, check that you've used the correct value for the root token and Vault server address.
-
-## Step 5: retrieve a secret
-
-Now that we know how to write a secret, let's practice reading one.
-
-Underneath the line where you wrote a secret to Vault, let's add a few more lines, where we will be retrieving the secret and unpacking the value:
-
-<Tabs>
-<Tab heading="Go">
-
-```go
-secret, err := client.KVv2("secret").Get(context.Background(), "my-secret-password")
-if err != nil {
-    log.Fatalf("unable to read secret: %v", err)
-}
-
-value, ok := secret.Data["password"].(string)
-if !ok {
-log.Fatalf("value type assertion failed: %T %#v", secret.Data["password"], secret.Data["password"])
-}
-```
-
-</Tab>
-<Tab heading="Ruby" group="ruby">
-
-```ruby
-secret = Vault.logical.read("secret/data/my-secret-password")
-password = secret.data[:data][:password]
-```
-
-</Tab>
-<Tab heading="C#" group="cs">
-
-```cs
-Secret<SecretData> secret = vaultClient.V1.Secrets.KeyValue.V2.ReadSecretAsync(
-    path: "/my-secret-password",
-    mountPoint: "secret"
-).Result;
-
-var password = secret.Data.Data["password"];
-```
-
-</Tab>
-<Tab heading="Python" group="python">
-
-```Python
-read_response = client.secrets.kv.read_secret_version(path='my-secret-password')
-
-password = read_response['data']['data']['password']
-```
-
-</Tab>
-<Tab heading="Java" group="java">
-
-```Java
-Versioned<Map<String, Object>> readResponse = vaultTemplate
-    .opsForVersionedKeyValue("secret")
-    .get("my-secret-password");
-
-String password = "";
-if (readResponse != null && readResponse.hasData()) {
-    password = (String) readResponse.getData().get("password");
-}
-```
-
-</Tab>
-<Tab heading="Bash" group="bash">
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: $VAULT_TOKEN" \
-    http://127.0.0.1:8200/v1/secret/data/my-secret-password > secrets.json
-```
-
-</Tab>
-<Tab heading="OpenAPI Go (Beta)" group="openAPI-go">
-
-```go
-s, err := client.Secrets.KVv2Read(context.Background(), "my-secret-password")
-if err != nil {
-   log.Fatal(err)
-}
-
-log.Println("Secret retrieved:", s.Data)
-```
-
-</Tab>
-<Tab heading="OpenAPI .NET (Beta)" group="openAPI-dotnet">
-
-```cs
-VaultResponse<Object> resp = vaultClient.Secrets.KVv2Read("my-secret-password");
-Console.WriteLine(resp.Data);
-```
-
-</Tab>
-</Tabs>
-
-Last, confirm that the value we unpacked from the read response is correct:
-
-<Tabs>
-<Tab heading="Go">
-
-```go
-if value != "Hashi123" {
-    log.Fatalf("unexpected password value %q retrieved from vault", value)
-}
-
-fmt.Println("Access granted!")
-```
-
-</Tab>
-<Tab heading="Ruby" group="ruby">
-
-```ruby
-abort "Unexpected password" if password != "Hashi123"
-
-puts "Access granted!"
-```
-
-</Tab>
-<Tab heading="C#" group="cs">
-
-```cs
-if (password.ToString() != "Hashi123")
-{
-    throw new System.Exception("Unexpected password");
-}
-
-Console.WriteLine("Access granted!");
-```
-
-</Tab>
-<Tab heading="Python" group="python">
-
-```Python
-if password != 'Hashi123':
-    sys.exit('unexpected password')
-
-print('Access granted!')
-```
-
-</Tab>
-<Tab heading="Java" group="java">
-
-```Java
-if (!password.equals("Hashi123")) {
-    throw new Exception("Unexpected password");
-}
-
-System.out.println("Access granted!");
-```
-
-</Tab>
-<Tab heading="Bash" group="bash">
-
-```shell-session
-$ cat secrets.json | jq '.data.data'
-```
-
-</Tab>
-</Tabs>
-
-If the secret was fetched successfully, you should see the `Access granted!` message after you run the code. If not, check to see if you provided the correct path to your secret.
-
-**That's it! You've just written and retrieved your first Vault secret!**
-
-# Additional examples
-
-For more secure examples of client authentication, see the auth snippets in the [vault-examples](https://github.com/hashicorp/vault-examples) repo.
-
-For a runnable demo app that demonstrates more features, for example, how to keep your connection to Vault alive and how to connect to a database using Vault's dynamic database credentials, see the sample application hello-vault ([Go](https://github.com/hashicorp/hello-vault-go), [C#](https://github.com/hashicorp/hello-vault-dotnet)).
-
-To learn how to integrate applications with Vault without needing to always change your application code, see the [Vault Agent](/vault/docs/agent-and-proxy/agent) documentation.
diff --git a/website/content/docs/glossary.mdx b/website/content/docs/glossary.mdx
deleted file mode 100644
index 4e25b60e446..00000000000
--- a/website/content/docs/glossary.mdx
+++ /dev/null
@@ -1,144 +0,0 @@
----
-layout: docs
-page_title: Glossary of Terms
-sidebar_title: Glossary
-description: |-
-  Vault Glossary.
----
-
-# Glossary
-
-This page collects brief definitions of some of the technical terms used in the
-documentation for Vault.
-
-- [Audit Device](#audit-device)
-- [Auth Method](#auth-method)
-- [Barrier](#barrier)
-- [Client Token](#client-token)
-- [Plugin](#plugin)
-- [Request](#request)
-- [Secret](#secret)
-- [Secrets Engine](#secrets-engine)
-- [Server](#server)
-- [Storage Backend](#storage-backend)
-
-### Audit device
-
-An audit device is responsible for managing audit logs.
-Every request to Vault and response from Vault goes through the configured
-audit devices. This provides a simple way to integrate Vault with multiple
-audit logging destinations of different types.
-
-### Auth method
-
-An auth method is used to authenticate users or applications
-which are connecting to Vault. Once authenticated, the auth method returns the
-list of applicable policies which should be applied. Vault takes an
-authenticated user and returns a client token that can be used for future
-requests. As an example, the `userpass` auth method uses a username and
-password to authenticate the user. Alternatively, the `github` auth method
-allows users to authenticate via GitHub.
-
-### Barrier
-
-Almost everything Vault writes to storage is encrypted using the keyring, which is protected by the seal. We refer to this practice as "the barrier". There are a few exceptions to the rule, for example, the seal configuration is stored in an unencrypted file since it's needed to unseal the barrier, and the keyring is encrypted using the root key, while the root key is encrypted using the seal.
-
-### Client token
-
-A client token (aka "Vault Token") is conceptually
-similar to a session cookie on a web site. Once a user authenticates, Vault
-returns a client token which is used for future requests. The token is used by
-Vault to verify the identity of the client and to enforce the applicable ACL
-policies. This token is passed via HTTP headers.
-
-### Plugin
-
-Plugins are a feature of Vault that can be enabled, disabled, and customized to
-some degree. All Vault [auth methods](/vault/docs/auth) and [secrets engines](/vault/docs/secrets)
-are considered plugins.
-
-#### Built-in plugin
-
-Built-in plugins are shipped with Vault, often for commonly used
-implementations, and require no additional operator intervention to run.
-Built-in plugins are just like any other backend code inside Vault.
-
-#### External plugin
-
-External plugins are not shipped with Vault and require additional operator
-intervention to run. Vault's external plugins are completely separate,
-standalone applications that Vault executes and communicates with over RPC.
-Each time a Vault secret engine or auth method is mounted, a new process is
-spawned.
-
-#### External multiplexed plugin
-
-An external plugin may make use of [plugin multiplexing](/vault/docs/plugins/plugin-architecture#plugin-multiplexing).
-A multiplexed plugin allows a single plugin process to be used for multiple
-mounts of the same type.
-
-### Request
-
-A request being made to Vault contains all relevant parameters and context in order
-for Vault to be able to act accordingly. Vault represents this request internally
-in a way that understands:
-
-* Mount Point - Used to generate relative paths.
-* Mount Type - The type of mount the request is interacting with.
-* Namespace - The [namespace](/vault/docs/enterprise/namespaces) the request is taking place within.
-* Operation - See [the operation description](#operation) below for the supported operations.
-* Path - The full path of the request.
-
-<Note title="Request's Namespace">
-  The Namespace a request is targeting may be specified either as part of the path
-  or the Vault Namespace header.
-</Note>
-
-Please see our Enterprise documentation for further information on how
-[Namespaces can be specified](/vault/docs/enterprise/namespaces#vault-api-and-namespaces)
-as part of a request.
-
-#### Operation
-
-The request's operation can be one of the following: `alias-lookahead`, `create`, `delete`,
-`header`, `help`, `list`, `patch`, `read`, `renew`, `resolve-role`, `revoke`, `rollback`
-`update`.
-
-### Secret
-
-A secret is the term for anything returned by Vault which
-contains confidential or cryptographic material. Not everything returned by
-Vault is a secret, for example system configuration, status information, or
-policies are not considered secrets. Dynamic secrets always have an associated lease, and static secrets do not.
-This means clients cannot assume that the dynamic secret contents can be used
-indefinitely. Vault will revoke a dynamic secret at the end of the lease, and an
-operator may intervene to revoke the Dynamic Secret before the lease is over. This
-contract between Vault and its clients is critical, as it allows for changes
-in keys and policies without manual intervention.
-
-### Secrets engine
-
-A secrets engine is responsible for managing secrets.
-Simple secrets engines, such as the "kv" secrets engine, return the same
-secret when queried. Some secrets engines support using policies to
-dynamically generate a secret each time they are queried. This allows for
-unique secrets to be used which allows Vault to do fine-grained revocation and
-policy updates. As an example, a MySQL secrets engine could be configured with
-a "web" policy. When the "web" secret is read, a new MySQL user/password pair
-will be generated with a limited set of privileges for the web server.
-
-### Server
-
-Vault depends on a long-running instance which operates as a
-server. The Vault server provides an API which clients interact with and
-manages the interaction between all the secrets engines, ACL enforcement, and
-secret lease revocation. Having a server based architecture decouples clients
-from the security keys and policies, enables centralized audit logging, and
-simplifies administration for operators.
-
-### Storage backend
-
-A storage backend is responsible for durable storage of
-_encrypted_ data. Backends are not trusted by Vault and are only expected to
-provide durability. The storage backend is configured when starting the Vault
-server.
diff --git a/website/content/docs/index.mdx b/website/content/docs/index.mdx
deleted file mode 100644
index c18e1198c41..00000000000
--- a/website/content/docs/index.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-layout: docs
-page_title: Documentation
-description: |-
-  Vault reference documentation covering the main Vault concepts, feature FAQs, and CLI usage examples to start managing your secrets.
----
-
-# Documentation
-
-Welcome to the Vault documentation! This documentation is more of a reference guide for all available features and options of Vault. If you're just getting started with Vault, please start with the [introduction](/vault/docs/what-is-vault) instead, and work your way up to the [Getting Started](/vault/tutorials/getting-started/getting-started-install) guide.
diff --git a/website/content/docs/install.mdx b/website/content/docs/install.mdx
deleted file mode 100644
index fea6ea4bc71..00000000000
--- a/website/content/docs/install.mdx
+++ /dev/null
@@ -1,92 +0,0 @@
----
-layout: docs
-page_title: Install Vault
-description: |-
-  Download a precompiled binary, compile from source, or use a package.
----
-
-# Installing Vault
-
-There are several options to install Vault:
-
-1. Install from a [Package Manager](#package-manager).
-
-1. Use a [precompiled binary](#precompiled-binaries).
-
-1. Install [from source](#compiling-from-source).
-
-1. [Helm for Kubernetes](/vault/docs/platform/k8s/helm)
-
-@include 'versions.mdx'
-
-## Package manager
-
-HashiCorp manages packages for Ubuntu, Debian, Fedora, RHEL, Amazon
-Linux, and other distributions. Follow the instructions at [HashiCorp
-Tutorials][learn-vault-install] to add our PGP key, add a repository, and
-install.
-
-## Precompiled binaries
-
-To install the precompiled binary, [download](/vault/downloads) the applicable
-package for your system. Vault is packaged as a zip file.
-
-Once the zip is downloaded, unzip the file into your designated directory. The `vault` binary
-inside is all that is necessary to run Vault (or `vault.exe` for Windows). No
-additional files are required to run Vault.
-
-Copy the binary to your system. If you intend to access it from the
-command-line, ensure that you place the binary somewhere on your `PATH`.
-
-Refer to the [HashiCorp Tutorials][learn-vault-dev-server] to start a server, `put`
-your first secret, and use other features of Vault.
-
-## Compiling from source
-
-To compile from source, you will need [Go](https://golang.org) installed and
-properly configured (including a `GOPATH` environment variable set), as well as
-a copy of [`git`](https://www.git-scm.com/) in your `PATH`.
-
-Clone the Vault repository from GitHub into your `GOPATH`:
-
-```shell-session
-$ mkdir -p $GOPATH/src/github.com/hashicorp && cd $_
-$ git clone https://github.com/hashicorp/vault.git
-$ cd vault
-```
-
-Bootstrap the project. This will download and compile libraries and tools needed
-to compile Vault:
-
-```shell-session
-$ make bootstrap
-```
-
-Build Vault for your current system and put the binary in `./bin/` (relative to
-the git checkout). The `make dev` target is just a shortcut that builds `vault`
-for only your local build environment (no cross-compiled targets).
-
-```shell-session
-$ make dev
-```
-
-## Verifying the installation
-
-To verify Vault is installed, run `vault -h` on your system. You should
-see the help output. If you are executing it from the command line, ensure it is
-on your `PATH` to avoid receiving an error that Vault is not found.
-
-```shell-session
-$ vault -h
-```
-
-## Tutorial
-
-Following tutorials provide some guidance on production cluster deployment: 
-
-- [Day One Preparation](/vault/tutorials/day-one-raft) 
-- [Recommended Patterns](/vault/tutorials/recommended-patterns)
-
-
-[learn-vault-install]: /vault/tutorials/getting-started/getting-started-install
-[learn-vault-dev-server]: /vault/tutorials/getting-started/getting-started-dev-server
diff --git a/website/content/docs/internals/architecture.mdx b/website/content/docs/internals/architecture.mdx
deleted file mode 100644
index 29e20d48805..00000000000
--- a/website/content/docs/internals/architecture.mdx
+++ /dev/null
@@ -1,87 +0,0 @@
----
-layout: docs
-page_title: Architecture
-description: Learn about the internal architecture of Vault.
----
-
-# Architecture
-
-Vault is an intricate system with numerous distinct components. This page details the system architecture and hopes to assist Vault users and developers to build a mental model while understanding the theory of operation.
-
-~> **Note:** This page covers the technical details of Vault. The descriptions and elements contained within are for users that wish to learn about Vault without having to reference the source code. Although not required, we encourage all users and operators to review the provided information before using Vault due to its significance in an environment.
-
-# High-Level overview
-
-The diagram below illustrates the intricacies and distinct components of Vault.
-
-[![Architecture Overview](/img/layers.png)](/img/layers.png)
-
-Vault’s encryption layer, referred to as the _barrier_, is responsible for encrypting and decrypting Vault data. When the Vault server starts, it writes data to its storage backend. Since the storage backend resides outside the barrier, it’s considered untrusted so Vault will encrypt the data before it sends them to the storage backend. This mechanism ensures that if a malicious attacker attempts to gain access to the storage backend, the data cannot be compromised since it remains encrypted, until Vault decrypts the data. The storage backend provides a durable data persistent layer where data is secured and available across server restarts.
-
-When a Vault server is started, it begins in a _sealed_ state. Before any
-operation can be performed on Vault, it must be _unsealed_. This is done by
-providing the unseal keys. During the Vault initialization, it generates an
-encryption key, which is used to protect all Vault data. This key is protected by
-a root key that is stored alongside all other Vault data, but is encrypted by another mechanism: the unseal key.
-
-By default, Vault uses [Shamir's Secret
-Sharing](https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing) to split the
-unseal key into a configured number of shards (key shares or unseal
-keys). A precise number of shards are required to reconstruct the unseal key,
-which is then used to decrypt the Vault's root key.
-
-![Unseal keys](/img/vault-shamir-seal.png)
-
-Refer to the [Seal/Unseal](/vault/docs/concepts/seal#seal-unseal) documentation for
-further details.
-
-The number of shares and the minimum number of shards required can both be specified.
-Shamir's technique can be disabled, and the root key can be used directly for
-unsealing. Once Vault retrieves the encryption key, it decrypts the
-data in the storage backend, and enters the _unsealed_ state. Once unsealed,
-Vault loads the configured audit devices, auth methods, and secrets
-engines.
-
-~> **Note:** The default Vault configuration uses a Shamir seal; however, Vault can be [auto
-unsealed](/vault/docs/concepts/seal#auto-unseal) by a trusted cloud key management
-system (KMS) or hardware security module (HSM) to increase security.
-
-The configuration of the audit devices, auth methods, and secrets engines are security sensitive and are stored in Vault. Users with permissions can modify them and cannot be specified outside of the barrier. By storing them in Vault, changes are protected by the ACL system and tracked by audit logs.
-
-Requests may be processed from the HTTP API to the core once Vault is unsealed.
-The core manages the flow of requests through the system,
-enforces ACLs, and ensures audit logging is done.
-
-When a client first connects to Vault, the client needs to authenticate. Vault provides
-configurable auth methods and offers flexibility within the authentication mechanism
-used. Mechanisms such as username/password or GitHub may be
-used for operators, while applications may use public/private keys or tokens to
-authenticate. An authentication request that flows through the core and into an auth
-method determines if the request is valid and returns a list of
-associated policies.
-
-Policies are just a named ACL rule. For example, the "root" policy is built-in
-and permits access to all resources. You may create any number of named policies
-with fine-grained control over paths. Vault operates in an allowed-access mode, meaning the action is not allowed unless access is granted via a policy explicitly. Since a user may have multiple policies associated, actions are allowed when policy permits. Policies are stored and managed by an internal
-policy store. This internal store is affected through the system backend,
-which is always mounted at `sys/`.
-
-Once authentication takes place and an auth method provides a set of applicable
-policies, a new client token is generated and managed by the token store. This
-client token is used to make future requests.
-This token method is similar to a cookie sent by a website when a user logs in. Depending on the auth method configuration, the client
-token may have a lease associated with it, and may need to be renewed periodically to avoid invalidation.
-
-Once authenticated, requests are made by providing the client token. The client token is
-used to verify the client, ensuring they are authorized while loading the relevant policies. The
-policies are used to authorize the client request. The request is then routed to the secrets engine, which is processed depending on its type. When the secrets engine returns the secret, the core registers it with the expiration manager and attaches a lease ID.  Clients use the lease ID to renew or revoke their
-secret. The expiration manager automatically revokes the secret if a client allows the lease to expire.
-
-The core logs requests and responses to the audit broker, distributing the requests to all configured audit devices. Outside of the request
-flow, the core performs specific background activities. Lease management is critical, allowing expired client tokens or secrets to be revoked automatically. Additionally, Vault handles specific partial-failure cases by using write-ahead logging with a rollback manager. This is managed transparently within the core and is not user-visible.
-
-# Resources
-
-- To learn more about each components and sub-systems within Vault, select a topic from the left-navigation menu.
-- For in depth details, consult the code.
-- To get started with Vault, try out our [Getting Started](/vault/tutorials/getting-started) tutorial.
diff --git a/website/content/docs/internals/high-availability.mdx b/website/content/docs/internals/high-availability.mdx
deleted file mode 100644
index 85fefe03c07..00000000000
--- a/website/content/docs/internals/high-availability.mdx
+++ /dev/null
@@ -1,58 +0,0 @@
----
-layout: docs
-page_title: High Availability
-description: Learn about the high availability design of Vault.
----
-
-# High availability
-
-Vault can run in a high availability (HA) mode to protect against outages by running multiple Vault servers.
-
-
-# Design overview
-
-The primary design goal for making Vault Highly Available (HA) is to
-minimize downtime without affecting horizontal scalability. Vault is
-bound by the IO limits of the storage backend rather than the compute
-requirements. Being bound by the IO limits simplifies the HA approach and avoids complex
-coordination.
-
-Storage backends, such as Integrated Storage, provide additional coordinative
-functions enabling Vault to run in an HA configuration. Supported
-by the backend, Vault will automatically run in HA mode without further
-configuration.
-
-When running in HA mode, Vault servers have two states they
-can be: **standby** and **active**. For multiple Vault servers sharing a storage
-backend, only a single instance is active at any time. All standby instances are placed in hot standbys.
-
-Only the active server processes all requests; the standby server redirects all requests to an active Vault server.
-
-Meanwhile, if the active server is sealed, fails, or loses network connectivity,
-then one of the standby Vault server becomes the active instance.
-
-Please note that only _unsealed_ Vault servers may act as a standby.
-If a server is in a sealed state, it cannot act as a standby. Servers in a sealed state cannot
- serve any requests if the active server fails.
-
-# Performance standby nodes (Enterprise)
-
-Performance Standby Nodes service read-only requests from users or applications.
-Read-only requests are requests that do not modify Vault's storage. Vault quickly scales its ability to service these operations,
-providing a near-linear request-per-second scaling for most scenarios and secrets engines like KV and Transit. Traffic is distributed across performance standby nodes, allowing clients to scale these IOPS horizontally, and control high traffic workloads.
-
-If a request comes into a Performance Standby Node that causes a storage to write
-the request, the request is forwarded to the active server. Read-only requests are serviced locally on the Performance Standby.
-
-Like traditional HA standbys, a Performance Standby Node becomes the active instance when the active node is sealed, fails, or loses
-network connectivity.
-
-# Tutorial 
-
-Refer to the following tutorials to learn more.
-
-- [Vault with Integrated Storage Reference Architecture](/vault/tutorials/day-one-raft/raft-reference-architecture)
-- [Vault HA Cluster with Integrated Storage](/vault/tutorials/raft/raft-storage)
-- [Vault High Availability with Consul](/vault/tutorials/day-one-consul/ha-with-consul)
-- [Performance Standby Nodes](/vault/tutorials/enterprise/performance-standbys)
-
diff --git a/website/content/docs/internals/index.mdx b/website/content/docs/internals/index.mdx
deleted file mode 100644
index 909f5c6164b..00000000000
--- a/website/content/docs/internals/index.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
----
-layout: docs
-page_title: Internals
-description: >-
-  This section covers the internals of Vault and explains technical details of
-  Vaults operation.
----
-
-# Vault internals
-
-This section covers the internals of Vault and explains the technical
-details of how Vault functions, its architecture and security properties.
-
--> **Note:** Knowledge of Vault internals is recommended but not required to use Vault. However, if you're operating Vault, we recommend understanding the internals.
diff --git a/website/content/docs/internals/integrated-storage.mdx b/website/content/docs/internals/integrated-storage.mdx
deleted file mode 100644
index c2bf4d664ee..00000000000
--- a/website/content/docs/internals/integrated-storage.mdx
+++ /dev/null
@@ -1,271 +0,0 @@
----
-layout: docs
-page_title: Integrated Storage
-description: Learn about the integrated raft storage in Vault.
----
-
-# Integrated storage
-
-Vault supports several storage options for the durable storage of Vault's
-information. Each backend offers pros, cons, advantages, and trade-offs. For
-example, some backends support high availability while others provide a more
-robust backup and restoration process.
-
-As of Vault 1.4, an Integrated Storage option is offered. This storage backend
-does not rely on any third party systems; it implements high availability,
-supports Enterprise Replication features, and provides backup/restore workflows.
-
-## Consensus protocol
-
-Vault's Integrated Storage uses a [consensus
-protocol](<https://en.wikipedia.org/wiki/Consensus_(computer_science)>) to provide
-[Consistency](https://en.wikipedia.org/wiki/CAP_theorem) (as defined by CAP).
-The consensus protocol is based on ["Raft: In search of an Understandable
-Consensus Algorithm"](https://raft.github.io/raft.pdf). For a visual explanation
-of Raft, see [The Secret Lives of Data](http://thesecretlivesofdata.com/raft).
-
-### Raft protocol overview
-
-Raft is a consensus algorithm that is based on
-[Paxos](https://en.wikipedia.org/wiki/Paxos_%28computer_science%29). Compared
-to Paxos, Raft is designed to have fewer states and a simpler, more
-understandable algorithm.
-
-The Raft protocol will not be fully covered here. However, a high level description is 
-provided to help you build a mental model. Refer to the 
-complete specification that's described in [this paper](https://raft.github.io/raft.pdf).
-
-#### Terminology
-
-There are a few key terms to know when discussing Raft:
-
-- **Leader** - At any given time, the peer set elects a single node to be the leader.
-The leader is responsible for ingesting new log entries, replicating to followers,
-and managing when an entry is committed. The leader node is also the active Vault node and followers are standby nodes. Refer to the [High Availability](/vault/docs/internals/high-availability#design-overview) document for more information.
-
-- **Log** - An ordered sequence of entries (replicated log) to keep track of any cluster changes. The leader is responsible for _log replication_. When new data is written, for example, a new event creates a log entry. The leader then sends the new log entry to its followers. Any inconsistency within the replicated log entries will indicate an issue.
-
-- **FSM** - [Finite State Machine](https://en.wikipedia.org/wiki/Finite-state_machine).
-  A collection of finite states with transitions between them. As new logs
-  are applied, the FSM is allowed to transition between states. Application of the
-  same sequence of logs must result in the same state, meaning behavior must be deterministic.
-
-- **Peer set** - The set of all members participating in log replication. All server nodes are in the peer set of the local cluster.
-
-- **Quorum** - A majority of members from a peer set: for a set of size `n`,
-  quorum requires at least `(n+1)/2` members. For example, if there are 5 members
-  in the peer set, we would need 3 nodes to form a quorum. If a quorum of nodes is
-  unavailable for any reason, the cluster becomes _unavailable_ and no new logs
-  can be committed.
-
-- **Committed Entry** - An entry is considered _committed_ when it is durably stored
-  on a quorum of nodes. An entry is applied once its committed.
-
-#### Node states
-
-Raft nodes are always in one of three states: follower, candidate, or leader. All
-nodes initially start out as a follower. In this state, nodes can accept log entries
-from a leader and cast votes. If no entries are received for a period of time, nodes
-will self-promote to the candidate state. In the candidate state, nodes request votes from their peers. If a candidate receives a quorum of votes, then it is promoted to a leader. The leader must accept new log entries and replicate to all the other followers.
-
-#### Writing logs
-
-Once a cluster has a leader, it is able to accept new log entries. A client can
-request that a leader append a new log entry (from Raft's perspective, a log entry
-is an opaque binary blob). The leader then writes the entry to durable storage and
-attempts to replicate to a quorum of followers. Once the log entry is considered
-_committed_, it can be _applied_ to a finite state machine. The finite state machine
-is application specific; in Vault's case, we use
-[BoltDB](https://github.com/etcd-io/bbolt) to maintain a cluster state. Vault's writes
-are blocked until they are _committed_ and _applied_.
-
-#### Compacting logs
-
-It would be undesirable to allow a replicated log to grow in an unbounded
-fashion. Raft provides a mechanism by which the current state is saved to 
-snapshots and its related logs are compacted. Because of the FSM abstraction, 
-restoring the state of the FSM must result in the same state as a replay of old 
-logs. This allows Raft to capture the FSM state at a point in time and then remove 
-all the logs that were used to reach that state. This is performed automatically 
-without user intervention and prevents unbounded disk usage while also minimizing 
-the time spent replaying logs. One of the advantages of using BoltDB is that it 
-allows Vault's snapshots to be very light weight. Since Vault's data is already 
-persisted to disk in BoltDB, the snapshot process just needs to truncate the raft logs.
-
-#### Quorum
-
-Consensus is fault-tolerant while a cluster has quorum.
-If a quorum of nodes is unavailable, it is impossible to process log entries or reason
-about peer membership. For example, suppose there are only 2 peers: A and B. The quorum
-size is also 2, meaning both nodes must agree to commit a log entry. If either A or B
-fails, it is now impossible to reach quorum. This means the cluster is unable to add
-or remove a node or to commit any additional log entries. This results in
-_unavailability_. At this point, manual intervention is required to remove
-either A or B and restart the remaining node in bootstrap mode.
-
-A Raft cluster of 3 nodes can tolerate a single node failure while a cluster of
-5 can tolerate 2 node failures. The recommended Vault production deployment is
-to run 5 Vault servers per cluster. See the [Minimum &
-Scaling](#minimums-scaling) and [Deployment Table](#deployment-table) to learn
-more about the failure tolerance using Integrated Storage.
-
-#### Performance
-
-In terms of performance, Raft is comparable to Paxos. Assuming stable leadership,
-committing a log entry requires a single round trip to half of the cluster.
-Thus, performance is bound by disk I/O and network latency.
-
-### Raft in Vault
-
-When getting started, a single Vault server is
-[initialized](/vault/docs/commands/operator/init/#operator-init). At this point, the
-cluster is of size 1, which allows the node to self-elect as a leader. Once a
-leader is elected, other servers can be added to the peer set in a way that
-preserves consistency and safety.
-
-The join process is how new nodes are added to the Vault cluster; it uses an
-encrypted challenge/answer workflow. To accomplish this, all nodes in a single
-Raft cluster must share the same seal configuration. If using an Auto Unseal, the
-join process can use the configured seal to automatically decrypt the challenge
-and respond with the answer. If using a Shamir seal, the unseal keys must be
-provided to the node attempting to join the cluster before it can decrypt the
-challenge and respond with the decrypted answer.
-
-Since all servers participate as part of the peer set, they all know the current
-leader. When an API request arrives at a non-leader server, the request is
-forwarded to the leader.
-
-Similar to other storage backends, data that is written to the Raft log and FSM
-will be encrypted by Vault's barrier.
-
-### Quorum management
-
-#### Autopilot
-
-An [Autopilot feature](/vault/docs/concepts/integrated-storage/autopilot) 
-is available since 1.7.x & later versions that include configurable parameters 
-for when a node is treated as healthy before it's considered an eligible voter in the 
-quorum list. Other features which may be enabled include the ability to remove nodes 
-considered as dead from the quorum list after a certain period.
-
-Autopilot is enabled by default in Vault 1.7+. The default configuration values 
-should work well for most Vault deployments, but they can be changed if needed.
-
-Autopilot includes stabilization logic for nodes joining the cluster.
-Recently joined nodes are 
-accepted as non-voter initially until they are in sync with matching Raft index 
-and only after a stability thresholds are they then full voting members.
-Setting the stability threshold too low can result in cluster instability as nodes will be
-counted as voters before they are capable of voting.
-
-As of Vault 1.7, a dead server cleanup capability is available. With this feature 
-enabled, unhealthy nodes are automatically removed from the Raft cluster without 
-manual operator intervention. This is enabled via the [Autopilot API](/vault/api-docs/system/storage/raftautopilot).
-If you wish to decommission a node manually, this can be done with the 
-`remove peer` [command](/vault/docs/commands/operator/raft#remove-peer).
-
-#### Without autopilot
-
-Older versions of Vault, 1.6.x & lower, as well as cases where Autopilot may be 
-disabled or misconfigured, behave differently.
-
-In scenarios involving those when a node joins a Raft cluster, it attempts to 
-catch up with the rest of the nodes through the data that it's replicating from 
-the leader. While in this initial synchronisation state, the node cannot 
-vote but is counted for the purposes of quorum. If a number of new nodes join 
-the cluster simultaneously or at similar times, and thereby exceeding the failure
-tolerance of the cluster, quorum may be lost and the cluster can fail.
-
-For example, consider a scenario where there is a 3-node cluster with a large 
-amount of data and a failure tolerance of 1. An additional 3 new nodes then 
-join the cluster. The cluster now consists of 6 nodes with a failure tolerance 
-of 2, but since all 3 nodes are still catching up, this will result in a loss of 
-quorum.
-
-* A 3 node cluster with a large amount of data that's at a failure tolerance of 1.
-* Another 3 new nodes then join the cluster together.
-* Now the cluster consists of 6 nodes with a failure tolerance of 2, but all 3 new nodes are still catching up, resulting in a loss of quorum.
-
-For this reason, we recommend ensuring new nodes have Raft indexes that are
-close to the leader before adding additional nodes. Raft indexes are visible via
-`vault status`.
-
-### Deployment table
-
-Below is a table that shows quorum size and failure tolerance for various
-cluster sizes. The recommended production deployment consists of 5 servers. A
-single server deployment is _**highly**_ discouraged as data loss is inevitable
-in a failure scenario.
-
-<table class="table table-bordered table-striped">
-  <thead>
-    <tr>
-      <th>Servers</th>
-      <th>Quorum Size</th>
-      <th>Failure Tolerance</th>
-    </tr>
-  </thead>
-  <tbody>
-    <tr>
-      <td>1</td>
-      <td>1</td>
-      <td>0</td>
-    </tr>
-    <tr>
-      <td>2</td>
-      <td>2</td>
-      <td>0</td>
-    </tr>
-    <tr class="warning">
-      <td>3</td>
-      <td>2</td>
-      <td>1</td>
-    </tr>
-    <tr>
-      <td>4</td>
-      <td>3</td>
-      <td>1</td>
-    </tr>
-    <tr class="warning">
-      <td>5</td>
-      <td>3</td>
-      <td>2</td>
-    </tr>
-    <tr>
-      <td>6</td>
-      <td>4</td>
-      <td>2</td>
-    </tr>
-    <tr>
-      <td>7</td>
-      <td>4</td>
-      <td>3</td>
-    </tr>
-  </tbody>
-</table>
-
-### Minimums & scaling
-
-The [Vault Reference Architecture](/vault/tutorials/day-one-raft/raft-reference-architecture#recommended-architecture) 
-recommends a 5 node cluster to ensure a minimum failure tolerance of at least 2.
-
-It is good practise, wherever possible, to retain a failure tolerance of 2 or 
-more.
-
-A scaling approach can be pursued in the event of maintenance and other changes 
-where an additional pair of nodes (ie two) are added in an existing 5 node cluster 
-making for a 7 node cluster. Once new joiners are confirmed to be in sync then 
-the 2 older nodes can be stopped and or destroyed with the same processes being 
-repeated until all other nodes have been replaced. This use of additional nodes 
-on a temporary basis of a 7 node cluster arrangement, concluding back to 5 nodes, 
-may be one way to ensure sufficient failure tolerance is maintained and that 
-changes are made progressively in proportion to the cluster failure tolerance and 
-never exceeding the available failure tolerance in any given time.
-
-The intent with any change or scaling ought to be with the lose of quorum and 
-reduction of the quorum failure tolerances at the forefront and discouraging 
-any practises that compromise that.
-
-Scaling clusters up or down in pairs with 2 nodes each time also has the added 
-advantage of avoiding even numbers and it is always recommended to 
-allow for an odd number of total voters in any cluster.
diff --git a/website/content/docs/internals/limits.mdx b/website/content/docs/internals/limits.mdx
deleted file mode 100644
index c8abc9e21a4..00000000000
--- a/website/content/docs/internals/limits.mdx
+++ /dev/null
@@ -1,278 +0,0 @@
----
-layout: docs
-page_title: Limits and Maximums
-description: Learn about the maximum number of objects within Vault.
----
-
-# Vault limits and maximums
-
-Vault imposes fixed upper limits on the size of certain fields and
-objects, and configurable limits on others. Vault also has upper
-bounds that are a consequence of its underlying storage. This page
-attempts to collect these limits, to assist in planning Vault
-deployments.
-
-In some cases, the system will show performance problems in advance of
-the absolute limits being reached.
-
-## Storage-Related limits
-
-### Storage entry size
-
-@include 'storage-entry-size.mdx'
-
-Many of the other limits within Vault derive from the maximum size of
-a storage entry, as described in the next sections. It is possible to
-recover from an error where a storage entry has reached its maximum
-size by reconfiguring Vault or Consul to a larger maximum storage
-entry.
-
-### Mount point limits
-
-All secret engine mount points, and all auth mount points, must each fit
-within a single storage entry. Each JSON object describing a mount
-takes about 500 bytes, but is stored in compressed form at a typical cost of
-about 75 bytes. Each of (1) auth mounts, (2) secret engine mount points,
-(3) local-only auth methods, and (4) local-only secret engine mounts are
-stored separately, so the limit applies to each independently.
-
-|                                              | Consul default (512 KiB) | Integrated storage default (1 MiB) |
-| -------------------------------------------- | ------------------------ | ---------------------------------- |
-| Maximum number of secret engine mount points | ~7000                    | ~14000                             |
-| Maximum number of enabled auth methods       | ~7000                    | ~14000                             |
-| Maximum mount point length                   | no enforced limit        | no enforced limit                  |
-
-Specifying distinct per-mount options, or using long mount point paths, can
-increase the space required per mount.
-
-The number of mount points can be monitored by reading the
-[`sys/auth`](/vault/api-docs/system/auth) and
-[`sys/mounts`](/vault/api-docs/system/mounts) endpoints from the root namespace and
-similar sub-paths for namespaces respectively, like: `namespace1/sys/auth`,
-`namespace1/sys/mounts`, etc.
-
-Alternatively, use the
-[`vault.core.mount_table.num_entries`](/vault/docs/internals/telemetry/metrics/core-system#vault-core-mount_table-num_entries)
-and
-[`vault.core.mount_table.size`](/vault/docs/internals/telemetry/metrics/core-system#vault-core-mount_table-size)
-telemetry metrics to monitor the number of mount points and size of each mount table.
-
-### Namespace limits
-
-@include 'namespace-limits.mdx'
-
-### Entity and group limits
-
-The metadata that may be attached to an identity entity or an entity group
-has the following constraints:
-
-|                                       | Limit     |
-| ------------------------------------- | --------- |
-| Number of key-value pairs in metadata | 64        |
-| Metadata key size                     | 128 bytes |
-| Metadata value size                   | 512 bytes |
-
-Vault shards the entities across 256 storage entries. This creates a
-hard limit of 128MiB storage space used for entities on Consul, or
-256MiB on integrated storage with its default settings. Entity aliases
-are stored inline in the Entity objects and so consume the same pool
-of storage. Entity definitions are compressed within each storage
-entry, and the pre-compression size varies with the number of entity
-aliases and the amount of metadata. Minimally-populated entities
-about 200 bytes after compression.
-
-Group definitions are stored separately, in their own pool of 256
-storage entries. The size of each group object depends on the number
-of members and the amount of metadata. Group aliases and group
-membership information is stored inline in each Group object. A group
-with no metadata, holding 10 entities, will use about 500 bytes per
-group. A group holding 100 entities would instead consume about 4,000
-bytes.
-
-The following table shows a best-case estimate and a more conservative
-estimate for entities and groups. The number is slightly less than the
-amount that fits in one shard, to reflect the fact that the first
-shard to fill up will start inducing failures. This maximum will
-decrease if each entity has a large amount of metadata, or if each
-group has a large number of members.
-
-|                                                                                          | Consul default (512 KiB) | Integrated storage default (1 MiB) |
-| ---------------------------------------------------------------------------------------- | ------------------------ | ---------------------------------- |
-| Maximum number of identity entities (best case, 200 bytes per entity)                    | ~610,000                 | ~1,250,000                         |
-| Maximum number of identity entities (conservative case, 500 bytes per entity)            | ~250,000                 | ~480,000                           |
-| Maximum number of identity entities (maximum permitted metadata, 41160 bytes per entity) | 670                      | 2,400                              |
-| Maximum number of groups (10 entities per group)                                         | ~250,000                 | ~480,000                           |
-| Maximum number of groups (100 entities per group)                                        | ~22,000                  | ~50,000                            |
-| Maximum number of members in a group                                                     | ~11,500                  | ~23,000                            |
-
-The number of entities can be monitored using Vault's [telemetry](/vault/docs/internals/telemetry#token-identity-and-lease-metrics); see `vault.identity.num_entities` (total) or `vault.identity.entities.count` (by namespace).
-
-The cost of entity and group updates grows as the number of objects in
-each shard increases. This cost can be monitored via the
-`vault.identity.upsert_entity_txn` and
-the `vault.identity.upsert_group_txn` metrics.
-
-Very large internal groups should be avoided (more than 1000 members),
-because the membership list in a group must reside in a single storage entry.
-Instead, consider using [external groups](/vault/docs/concepts/identity#external-vs-internal-groups) or split the group up into multiple sub-groups.
-
-### Token limits
-
-One storage entry is used per token; there is thus no
-upper bound on the number of active tokens. There are no restrictions on
-the token metadata field, other than the entire token must fit into one
-storage entry:
-
-|                                       | Limit    |
-| ------------------------------------- | -------- |
-| Number of key-value pairs in metadata | no limit |
-| Metadata key size                     | no limit |
-| Metadata value size                   | no limit |
-| Total size of token metadata          | 512 KiB  |
-
-### Policy limits
-
-The maximum size of a policy is limited by the storage
-entry size. Policy lists that appear in tokens or entities must fit
-within a single storage entry.
-
-|                                                | Consul default (512 KiB) | Integrated storage default (1 MiB) |
-| ---------------------------------------------- | ------------------------ | ---------------------------------- |
-| Maximum policy size                            | 512 KiB                  | 1 MiB                              |
-| Maximum number of policies per namespace       | no limit                 | no limit                           |
-| Maximum number of policies per token           | ~14,000                  | ~28,000                            |
-| Maximum number of policies per entity or group | ~14,000                  | ~28,000                            |
-
-Each time a token is used, Vault must assemble the collection of
-policies attached to that token, to the entity, to any groups that the
-entity belongs to, and recursively to any groups that contain those groups.
-Very large numbers of policies are possible, but can cause Vault’s
-response time to increase. You can monitor the
-[`vault.core.fetch_acl_and_token`](/vault/docs/internals/telemetry#core-metrics)
-metric to determine if the time required to assemble an access control list
-is becoming excessive.
-
-### Versioned key-value store (kv-v2 secret engine)
-
-|                                                          | Limit                                                      |
-| -------------------------------------------------------- | ---------------------------------------------------------- |
-| Number of secrets                                        | no limit, up to available storage capacity                 |
-| Maximum size of one version of a secret                  | slightly less than one storage entry (512 KiB or 1024 KiB) |
-| Number of versions of a secret                           | default 10; configurable per-secret or per-mount           |
-| Maximum number of versions (not checked when configured) | at least 24,000                                            |
-
-Each version of a secret must fit in a single storage entry; the
-key-value pairs are converted to JSON before storage.
-
-Version metadata consumes 21 bytes per version and must fit in a
-single storage entry, separate from the stored data.
-
-Each secret also has version-agnostic metadata. This data can contain a `custom_metadata` field of
-user-provided key-value pairs. Vault imposes the following custom metadata limits:
-
-|                                           | Limit     |
-| ----------------------------------------- | --------- |
-| Number of custom metadata key-value pairs | 64        |
-| Custom metadata key size                  | 128 bytes |
-| Custom metadata value size                | 512 bytes |
-
-### Transit secret engine
-
-The maximum size of a Transit ciphertext or plaintext is limited by Vault's
-maximum request size, as described [below](#request-size).
-
-All archived versions of a single key must fit in a single storage entry.
-This limit depends on the key size.
-
-| Key length           | Consul default (512 KiB) | Integrated storage default (1 MiB) |
-| -------------------- | ------------------------ | ---------------------------------- |
-| aes128-gcm96 keys    | 2008                     | 4017                               |
-| aes256-gcm96 keys    | 1865                     | 3731                               |
-| chacha-poly1305 keys | 1865                     | 3731                               |
-| ed25519 keys         | 1420                     | 2841                               |
-| ecdsa-p256 keys      | 817                      | 1635                               |
-| ecdsa-p384 keys      | 659                      | 1318                               |
-| ecdsa-p523 keys      | 539                      | 1078                               |
-| 1024-bit RSA keys    | 169                      | 333                                |
-| 2048-bit RSA keys    | 116                      | 233                                |
-| 4096-bit RSA kyes    | 89                       | 178                                |
-
-## Other limits
-
-### Request size
-
-The maximum size of an HTTP request sent to Vault is limited by
-the `max_request_size` option in the [listener stanza](/vault/docs/configuration/listener/tcp). It defaults to 32 MiB. This value, minus the overhead of
-the HTTP request itself, places an upper bound on any Transit operation,
-and on the maximum size of any key-value secrets.
-
-### Request duration
-
-The maximum duration of a Vault operation is
-[`max_request_duration`](/vault/docs//configuration/listener/tcp), which defaults to
-90 seconds. If a particular secret engine takes longer than this to perform an
-operation on a remote service, the Vault client will see a failure.
-
-The environment variable [`VAULT_CLIENT_TIMEOUT`](/vault/docs/commands#vault_client_timeout) sets a client-side maximum duration as well,
-which is 60 seconds by default.
-
-### Cluster and replication limits
-
-There are no implementation limits on the maximum size of a cluster,
-or the maximum number of replicas associated with a primary. However,
-each replica or performance standby adds considerable overhead to the
-active node, as each write must be duplicated to all standbys. The overhead of
-resyncing multiple replicas at once is also high.
-
-Monitor the active Vault node's CPU and network utilization, as well as
-the lag between the last WAL and replica WAL, to determine if the
-maximum number of replicas has been exceeded.
-
-|                                        | Limit                                  |
-| -------------------------------------- | -------------------------------------- |
-| Maximum cluster size                   | no limit, up to active node capability |
-| Maximum number of DR replicas          | no limit, up to active node capability |
-| Maximum number of performance replicas | no limit, up to active node capability |
-
-### Lease limits
-
-A systemwide [maximum TTL](/vault/docs/configuration#max_lease_ttl), and a
-[maximum TTL per mount point](/vault/api-docs/system/mounts#max_lease_ttl-1) can be
-configured.
-
-Although no technical maximum exists, high lease counts can cause
-degradation in system performance. We recommend short default
-time-to-live values on tokens and leases to avoid a large backlog of
-unexpired leases, or a large number of simultaneous expirations.
-
-|                                    | Limit                     |
-| ---------------------------------- | ------------------------- |
-| Maximum number of leases           | advisory limit at 256,000 |
-| Maximum duration of lease or token | 768 hours by default      |
-
-The current number of unexpired leases can be monitored via the
-[`vault.expire.num_leases`](/vault/docs/internals/telemetry#token-identity-and-lease-metrics) metric.
-
-### Transform limits
-
-The Transform secret engine obeys the [FF3-1 minimum and maximum sizes
-on the length of an input](/vault/docs/secrets/transform#input-limits), which
-are a function of the alphabet size.
-
-### External plugin limits
-
-The [plugin system](/vault/docs/plugins) launches a separate process
-initiated by Vault that communicates over RPC. For each secret engine and auth
-method that's enabled as an external plugin, Vault will spawn a process on the
-host system. For the Database Secrets Engines, external database plugins will
-spawn a process for every configured connection.
-
-Regardless of plugin type, each of these processes will incur resource overhead
-on the system, including but not limited to resources such as CPU, memory,
-networking, and file descriptors. There's no specific limit on the number
-secrets engines, auth methods, or database configured connections that can be
-enabled. This ultimately depends on the particular plugin resource utilization,
-the extent to which that plugin is being called, and the available resources on
-the system. For plugins of the same type, each additional process will incur a
-roughly linear increase in resource utilization. This assumes the usage of each
-plugin of the same type is similar.
diff --git a/website/content/docs/internals/replication.mdx b/website/content/docs/internals/replication.mdx
deleted file mode 100644
index 2a359c3ff82..00000000000
--- a/website/content/docs/internals/replication.mdx
+++ /dev/null
@@ -1,240 +0,0 @@
----
-layout: docs
-page_title: Replication
-description: Learn about the details of multi-datacenter replication within Vault.
----
-
-# Replication (Vault enterprise)
-
-Vault Enterprise 0.7 adds support for multi-datacenter replication. Before
-using this feature, it is useful to understand the intended use cases, design
-goals, and high level architecture.
-
-Replication is based on a primary/secondary (1:N) model with asynchronous
-replication, focusing on high availability for global deployments. The
-trade-offs made in the design and implementation of replication reflect these
-high level goals.
-
-# Use cases
-
-Vault replication is based on a number of common use cases:
-
-- **Multi-Datacenter Deployments**: A common challenge is providing Vault to
-  applications across many datacenters in a highly-available manner. Running a
-  single Vault cluster imposes high latency of access for remote clients,
-  availability loss or outages during connectivity failures, and limits
-  scalability.
-
-- **Backup Sites**: Implementing a robust business continuity plan around the
-  loss of a primary datacenter requires the ability to quickly and easily fail
-  to a hot backup site.
-
-- **Scaling Throughput**: Applications that use Vault for
-  Encryption-as-a-Service or cryptographic offload may generate a very high
-  volume of requests for Vault. Replicating keys between multiple clusters
-  allows load to be distributed across additional servers to scale request
-  throughput.
-
-# Design goals
-
-Based on the use cases for Vault Replication, we had a number of design goals
-for the implementation:
-
-- **Availability**: Global deployments of Vault require high levels of
-  availability, and can tolerate reduced consistency. During full connectivity,
-  replication is nearly real-time between the primary and secondary clusters.
-  Degraded connectivity between a primary and secondary does not impact the
-  primary's ability to service requests, and the secondary will continue to
-  service reads on last-known data.
-
-- **Conflict Free**: Certain replication techniques allow for potential write
-  conflicts to take place. Particularly, any active/active configuration where
-  writes are allowed to multiple sites require a conflict resolution strategy.
-  This varies from techniques that allow for data loss like last-write-wins, or
-  techniques that require manual operator resolution like allowing multiple
-  values per key. We avoid the possibility of conflicts to ensure there is no
-  data loss or manual intervention required.
-
-- **Transparent to Clients**: Vault replication should be transparent to
-  clients of Vault, so that existing thin clients work unmodified. The Vault
-  servers handle the logic of request forwarding to the primary when necessary,
-  and multi-hop routing is performed internally to ensure requests are
-  processed.
-
-- **Simple to Operate**: Operating a replicated cluster should be simple to
-  avoid administrative overhead and potentially introducing security gaps.
-  Setup of replication is very simple, and secondaries can handle being
-  arbitrarily behind the primary, avoiding the need for operator intervention
-  to copy data or snapshot the primary.
-
-# Architecture
-
-The architecture of Vault replication is based on the design goals, focusing on
-the intended use cases. When replication is enabled, a cluster is set as either
-a _primary_ or _secondary_. The primary cluster is authoritative, and is the
-only cluster allowed to perform actions that write to the underlying data
-storage, such as modifying policies or secrets. Secondary clusters can service
-all other operations, such as reading secrets or sending data through
-`transit`, and forward any writes to the primary cluster. Disallowing multiple
-primaries ensures the cluster is conflict free and has an authoritative state.
-
-The primary cluster uses log shipping to replicate changes to all of the
-secondaries. This ensures writes are visible globally in near real-time when
-there is full network connectivity. If a secondary is down or unable to
-communicate with the primary, writes are not blocked on the primary and reads
-are still serviced on the secondary. This ensures the availability of Vault.
-When the secondary is initialized or recovers from degraded connectivity it
-will automatically reconcile with the primary.
-
-Lastly, clients can speak to any Vault server without a thick client. If a
-client is communicating with a standby instance, the request is automatically
-forwarded to an active instance. Secondary clusters will service reads locally
-and forward any write requests to the primary cluster. The primary cluster is
-able to service all request types.
-
-An important optimization Vault makes is to avoid replication of tokens or
-leases between clusters. Policies and secrets are the minority of data managed
-by Vault and tend to be relatively stable. Tokens and leases are much more
-dynamic, as they are created and expire rapidly. Keeping tokens and leases
-locally reduces the amount of data that needs to be replicated, and distributes
-the work of TTL management between the clusters. The caveat is that clients
-will need to re-authenticate if they switch the Vault cluster they are
-communicating with.
-
-# Implementation details
-
-It is important to understand the high-level architecture of replication to
-ensure the trade-offs are appropriate for your use case. The implementation
-details may be useful for those who are curious or want to understand more
-about the performance characteristics or failure scenarios.
-
-Using replication requires a storage backend that supports transactional
-updates, such as Consul. This allows multiple key/value updates to be
-performed atomically. Replication uses this to maintain a
-[Write-Ahead-Log][wal] (WAL) of all updates, so that the key update happens
-atomically with the WAL entry creation. The WALs are then used to perform log
-shipping between the Vault clusters. When a secondary is closely synchronized
-with a primary, Vault directly streams new WALs to be applied, providing near
-real-time replication. A bounded set of WALs are maintained for the
-secondaries, and older WALs are garbage collected automatically.
-
-When a secondary is initialized or is too far behind the primary there may not
-be enough WALs to synchronize. To handle this scenario, Vault maintains a
-[merkle index][merkle] of the encrypted keys. Any time a key is updated or
-deleted, the merkle index is updated to reflect the change. When a secondary
-needs to reconcile with a primary, they compare their merkle indexes to
-determine which keys are out of sync. The structure of the index allows this to
-be done very efficiently, usually requiring only two round trips and a small
-amount of data. The secondary uses this information to reconcile and then
-switches back into WAL streaming mode.
-
-Performance is an important concern for Vault, so WAL entries are batched and
-the merkle index is not flushed to disk with every operation. Instead, the
-index is updated in memory for every operation and asynchronously flushed to
-disk. As a result, a crash or power loss may cause the merkle index to become
-out of sync with the underlying keys. Vault uses the [ARIES][aries] recovery
-algorithm to ensure the consistency of the index under those failure
-conditions.
-
-Log shipping traditionally requires the WAL stream to be synchronized, which
-can introduce additional complexity when a new primary cluster is promoted.
-Vault uses the merkle index as the source of truth, allowing the WAL streams to
-be completely distinct and unsynchronized. This simplifies administration of
-Vault Replication for operators.
-
-## Addressing
-
-### Cluster addresses on the primary
-
-When a cluster is enabled as replication primary, it persists a cluster
-definition to storage, under `core/cluster/replicated/info` or
-`core/cluster/replicated-dr/info`.  An optional field of the cluster definition
-is `primary_cluster_addr`, which may be provided in the enable request.
-
-Performance standbys regularly issue heartbeat RPC requests to the active node, and
-one of the arguments to the RPC is the local node's `cluster_addr`.  The
-primary active node retains these cluster addresses received from its peers in
-an in-memory cache named `clusterPeerClusterAddrsCache` with a 15s expiry time.
-
-### Cluster addresses on the secondary
-
-When a secondary is enabled, its replication activation token (obtained from
-the primary) includes a `primary_cluster_addr` field.  This is taken from the
-persisted cluster definition created when the primary was enabled, or if no
-`primary_cluster_addr` was provided at that time, the token contains the
-`cluster_addr` of the current active node in the primary at the time the
-activation token is created.
-
-The secondary persists its own version of the cluster definition to storage,
-again under `core/cluster/replicated/info` or
-`core/cluster/replicated-dr/info`.  Here the `primary_cluster_addr` field is
-the one obtained from the activation token.
-
-The secondary active node regularly issues heartbeat RPC requests to the
-primary active node.  In response to these, the primary returns a response
-which includes a `ClusterAddrs` field, comprising the contents of its
-`clusterPeerClusterAddrsCache` plus the current active node's `cluster_addr`.
-The secondary uses the response to both to update its in-memory record of
-`known_primary_cluster_addrs`, and in addition it persists them to storage
-under `core/primary-addrs/dr` or `core/primary-addrs/perf`.  When this happens
-it logs the line `"replication: successful heartbeat"`, which includes the
-`ClusterAddrs` value obtained in the response.
-
-### Secondary RPC address resolution
-
-gRPC is given a list of target addresses for it to use in performing RPC
-requests.  gRPC will discover that performance standbys can't service most RPCs, and
-will quickly weed out all but the active node cluster address.  If the primary
-active node changes, gRPC will learn that its address is no longer viable and
-will automatically fail over to the new active node, assuming it's one of the
-known target addresses.
-
-The secondary runs a background resolver goroutine that, every few seconds,
-builds the gRPC target list of addresses for the primary.  Its output is logged
-at Trace level as `"loaded addresses"`.
-
-To build the primary cluster address list, the resolver goroutine normally
-simply concatenates `known_primary_cluster_addrs` with the
-`primary_cluster_addr` in the cluster definition in storage.
-
-There are two exceptions to that normal behaviour: the first time the goroutine
-goes through its loop, and when gRPC asks for a forced ResolveNow, which
-happens when it's unable to perform RPCs on any of its target addresses.  In
-both these cases, the resolver goroutine issues a special RemoteResolve RPC to
-the primary.  This RPC is special because unlike all the other replication
-RPCs, it can be serviced by performance standbys as well as the active node.  In
-either case the node will return the `primary_cluster_addr` stored in the
-primary's cluster definition, if any, or failing that the current active node's
-cluster address.  The result of the RemoteResolve call gets included in the
-list of target addresses the resolver gives to gRPC for regular RPCs to the
-primary.
-
-# Caveats
-
-~> **Mismatched Cluster Versions**: It is not safe to replicate from a newer
-version of Vault to an older version. When upgrading replicated clusters,
-ensure that upstream clusters are always on older version of Vault than
-downstream clusters. See
-[Upgrading Vault](/vault/docs/upgrading#replication-installations) for an example.
-
-- **Read-After-Write Consistency**: All write requests are forwarded from
-  secondaries to the primary cluster in order to avoid potential conflicts.
-  While replication is near real-time, it is not instantaneous, meaning there
-  is a potential for a client to write to a secondary and a subsequent read to
-  return an old value. Secondaries attempt to mask this from an individual
-  client making subsequent requests by stalling write requests until the write
-  is replicated or a timeout is reached (2 seconds). If the timeout is reached,
-  the client will receive a warning. Clients can also take steps to protect
-  against this, see [Consistency](/vault/docs/enterprise/consistency#mitigations).
-
-- **Stale Reads**: Secondary clusters service reads based on their
-  locally-replicated data. During normal operation updates from a primary are
-  received in near real-time by secondaries. However, during an outage or
-  network service disruption, replication may stall and secondaries may have
-  stale data. The cluster will automatically recover and reconcile any stale
-  data once the outage has recovered, but reads in the intervening period may
-  receive stale data.
-
-[wal]: https://en.wikipedia.org/wiki/Write-ahead_logging
-[merkle]: https://en.wikipedia.org/wiki/Merkle_tree
-[aries]: https://en.wikipedia.org/wiki/Algorithms_for_Recovery_and_Isolation_Exploiting_Semantics
diff --git a/website/content/docs/internals/rotation.mdx b/website/content/docs/internals/rotation.mdx
deleted file mode 100644
index 29c3970764c..00000000000
--- a/website/content/docs/internals/rotation.mdx
+++ /dev/null
@@ -1,75 +0,0 @@
----
-layout: docs
-page_title: Key Rotation
-description: Learn about the details of key rotation within Vault.
----
-
-# Key rotation
-
-Vault has multiple encryption keys that are used for various purposes. These keys support
-rotation so that they can be periodically changed or in response to a potential leak or
-compromise. It is useful to first understand the
-[high-level architecture](/vault/docs/internals/architecture) before learning about key rotation.
-
-As a review, Vault starts in a _sealed_ state. Vault is unsealed by providing the unseal keys.
-By default, Vault uses a technique known as [Shamir's secret sharing algorithm](https://en.wikipedia.org/wiki/Shamir's_Secret_Sharing)
-to split the root key into 5 shares, any 3 of which are required to reconstruct the master
-key. The root key is used to protect the encryption key, which is ultimately used to protect
-data written to the storage backend.
-
-![Key Rotate](/img/vault-key-rotate.png)
-
-To support key rotation, we need to support changing the unseal keys, root key, and the
-backend encryption key. We split this into two separate operations, `rekey` and `rotate`.
-
-The `rekey` operation is used to generate a new root key. When this is being done,
-it is possible to change the parameters of the key splitting, so that the number of shares
-and the threshold required to unseal can be changed. To perform a rekey a threshold of the
-current unseal keys must be provided. This is to prevent a single malicious operator from
-performing a rekey and invalidating the existing root key.
-
-Performing a rekey is fairly straightforward. The rekey operation must be initialized with
-the new parameters for the split and threshold. Once initialized, the current unseal keys
-must be provided until the threshold is met. Once met, Vault will generate the new master
-key, perform the splitting, and re-encrypt the encryption key with the new root key.
-The new unseal keys are then provided to the operator, and the old unseal keys are no
-longer usable.
-
-The `rotate` operation is used to change the encryption key used to protect data written
-to the storage backend. This key is never provided or visible to operators, who only
-have unseal keys. This simplifies the rotation, as it does not require the current key
-holders unlike the `rekey` operation. When `rotate` is triggered, a new encryption key
-is generated and added to a keyring. All new values written to the storage backend are
-encrypted with the new key. Old values written with previous encryption keys can still
-be decrypted since older keys are saved in the keyring. This allows key rotation to be
-done online, without an expensive re-encryption process.
-
-Both the `rekey` and `rotate` operations can be done online and in a highly available
-configuration. Only the active Vault instance can perform either of the operations
-but standby instances can still assume an active role after either operation. This is
-done by providing an online upgrade path for standby instances. If the current encryption
-key is `N` and a rotation installs `N+1`, Vault creates a special "upgrade" key, which
-provides the `N+1` encryption key protected by the `N` key. This upgrade key is only available
-for a few minutes enabling standby instances to do a periodic check for upgrades.
-This allows standby instances to update their keys and stay in-sync with the active Vault
-without requiring operators to perform another unseal.
-
-The `rotate/config` endpoint is used to configure the number of operations or time interval
-between automatic rotations of the backend encryption key.
-
-## NIST rotation guidance
-
-Periodic rotation of the encryption keys is recommended, even in the absence of
-compromise. Due to the nature of the AES-256-GCM encryption used, keys should be
-rotated before approximately 2<sup>32</sup> encryptions have been performed, following
-the guidelines of NIST publication 800-38D.
-
-As of Vault 1.7, Vault will automatically rotate the backend encryption key
-prior to reaching 2<sup>32</sup> encryption operations by default.
-
-Operators can estimate the number of encryptions by summing the following:
-
-- The `vault.barrier.put` telemetry metric.
-- The `vault.token.creation` metric where the `token_type` label is `batch`.
-- The `merkle.flushDirty.num_pages` metric.
-- The WAL index.
diff --git a/website/content/docs/internals/security.mdx b/website/content/docs/internals/security.mdx
deleted file mode 100644
index 0ccbe1aab02..00000000000
--- a/website/content/docs/internals/security.mdx
+++ /dev/null
@@ -1,190 +0,0 @@
----
-layout: docs
-page_title: Security Model
-description: Learn about the security model of Vault.
----
-
-# Security model
-
-Due to the nature of Vault and the confidentiality of data it manages,
-the Vault security model is very critical. The overall goal of Vault's security
-model is to provide [confidentiality, integrity, availability, accountability,
-authentication](https://en.wikipedia.org/wiki/Information_security).
-
-This means that data at rest and in transit must be secure from eavesdropping
-or tampering. Clients must be appropriately authenticated and authorized
-to access data or modify policies. All interactions must be auditable and traced
-uniquely back to the origin entity, and the system must be robust against intentional
-attempts to bypass any of its access controls.
-
-# Threat model
-
-The following are the various parts of the Vault threat model:
-
-- Eavesdropping on any Vault communication. Client communication with Vault
-  should be secure from eavesdropping as well as communication from Vault to
-  its storage backend or between Vault cluster nodes.
-
-- Tampering with data at rest or in transit. Any tampering should be detectable
-  and cause Vault to abort processing of the transaction.
-
-- Access to data or controls without authentication or authorization. All requests
-  must be proceeded by the applicable security policies.
-
-- Access to data or controls without accountability. If audit logging
-  is enabled, requests and responses must be logged before the client receives
-  any secret material.
-
-- Confidentiality of stored secrets. Any data that leaves Vault to rest in the
-  storage backend must be safe from eavesdropping. In practice, this means all
-  data at rest must be encrypted.
-
-- Availability of secret material in the face of failure. Vault supports
-  running in a highly available configuration to avoid loss of availability.
-
-The following are not considered part of the Vault threat model:
-
-- Protecting against arbitrary control of the storage backend. An attacker
-  that can perform arbitrary operations against the storage backend can
-  undermine security in any number of ways that are difficult or impossible to protect
-  against. As an example, an attacker could delete or corrupt all the contents
-  of the storage backend causing total data loss for Vault. The ability to control
-  reads would allow an attacker to snapshot in a well-known state and rollback state
-  changes if that would be beneficial to them.
-
-- Protecting against the leakage of the existence of secret material. An attacker
-  that can read from the storage backend may observe that secret material exists
-  and is stored, even if it is kept confidential.
-
-- Protecting against memory analysis of a running Vault. If an attacker is able
-  to inspect the memory state of a running Vault instance, then the confidentiality
-  of data may be compromised.
-
-- Protecting against flaws in external systems or services used by Vault.
-  Some authentication methods or secrets engines delegate sensitive operations to
-  systems external to Vault. If an attacker can compromise credentials or otherwise
-  exploit a vulnerability in these external systems, then the confidentiality or
-  integrity of data may be compromised.
-
-- Protecting against malicious plugins or code execution on the underlying host.
-  If an attacker can gain code execution or write privileges to the underlying host,
-  then the confidentiality or the integrity of data may be compromised.
-
-- Protecting against flaws in clients or systems that access Vault. If an attacker
-  can compromise a Vault client (e.g., system, browser) and obtain this client’s Vault
-  credentials, they can access Vault with the level of privilege associated with this
-  client.
-
-- Protecting against Vault administrators supplying vulnerable or malicious configuration
-  data. Any data provided as configuration values to Vault's administrative endpoints
-  (e.g. [secret engines](/vault/docs/secrets) configurations), or Vault's
-  configuration files should be validated. If an attacker can write to Vault's
-  configuration, then the confidentiality or integrity of data can be compromised.
-
-# External threat overview
-
-Vault architecture compromises of three distinct systems:
-
-- Client: Speaks to Vault over an API.
-- Server: Provides an API and serves requests.
-- Storage backend: Utilized by the server to read and write data.
-
-
-There is no mutual trust between the Vault client and server. Clients use
-[TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) to verify the
-identity of the server and to establish a secure communication channel. Servers
-require that a client provides a client token for every request which is used
-to identify the client. A client that does not provide their token is only
-permitted to make login requests.
-
-All server-to-server traffic between Vault instances within a cluster (i.e,
-high availability, enterprise replication or integrated storage) uses
-mutually-authenticated TLS to ensure the confidentiality and integrity of data
-in transit. Nodes are authenticated prior to joining the cluster by an
-[unseal challenge](/vault/docs/concepts/integrated-storage#vault-networking-recap) or
-a [one-time-use activation token](/vault/docs/enterprise/replication#security-model).
-
-The storage backends used by Vault are also untrusted by design. Vault uses a
-security barrier for all requests made to the backend. The security barrier
-automatically encrypts all data leaving Vault using a 256-bit [Advanced
-Encryption Standard
-(AES)](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) cipher in
-the [Galois Counter Mode
-(GCM)](https://en.wikipedia.org/wiki/Galois/Counter_Mode) with 96-bit nonces.
-The nonce is randomly generated for every encrypted object. When data is read
-from the security barrier, the GCM authentication tag is verified during the
-decryption process to detect any tampering.
-
-Depending on the backend used, Vault may communicate with the backend over TLS
-to provide an added layer of security. In some cases, such as a file backend,
-this is not applicable. Because storage backends are untrusted, an eavesdropper
-would only gain access to encrypted data even if communication with the backend
-was intercepted.
-
-# Internal threat overview
-
-Within the Vault system, a critical security concern is an attacker attempting
-to gain access to secret material they are not authorized to. This is an internal
-threat if the attacker is already permitted to some level of access to Vault, and is
-able to authenticate.
-
-When a client first authenticates with Vault, an auth method is used to verify
-the identity of the client and to return a list of associated ACL policies.
-This association is configured by operators of Vault ahead of time. For
-example, GitHub users in the "engineering" team may be mapped to the
-"engineering" and "ops" Vault policies. Vault then generates a client token
-which is a randomly generated, serialized value and maps it to the policy list.
-This client token is then returned to the client.
-
-On each request, a client provides this token. Vault then uses it to check that
-the token is valid and has not been revoked or expired, and generates an ACL
-based on the associated policies. Vault uses a strict default deny
-enforcement strategy. This means unless an associated policy allows for a given action,
-it will be denied. Each policy specifies a level of access granted to a path in
-Vault. When the policies are merged (if multiple policies are associated with a
-client), the highest access level permitted is used. For example, if the
-"engineering" policy permits read/update access to the "eng/" path, and the
-"ops" policy permits read access to the "ops/" path, then the user gets the
-union of those. Policy is matched using the most specific defined policy, which
-may be an exact match or the longest-prefix match glob pattern. See
-[Policy Syntax](/vault/docs/concepts/policies#policy-syntax) for more details.
-
-Certain operations are only permitted by "root" users, which is a distinguished
-policy built into Vault. This is similar to the concept of a root user on a
-Unix system or an administrator on Windows. In cases where clients are provided
-with root tokens or associated with the root policy, Vault supports the
-notion of "sudo" privilege. As part of a policy, users may be granted "sudo"
-privileges to certain paths, so that they can still perform security sensitive
-operations without being granted global root access to Vault.
-
-Lastly, Vault supports using a [Two-person
-rule](https://en.wikipedia.org/wiki/Two-person_rule) for unsealing using [Shamir's
-Secret Sharing
-technique](https://en.wikipedia.org/wiki/Shamir's_Secret_Sharing). When Vault
-is started, it starts in a _sealed_ state. This means that the encryption key
-needed to read and write from the storage backend is not yet known. The process
-of unsealing requires providing the root key so that the encryption key can
-be retrieved. The risk of distributing the root key is that a single
-malicious attacker with access to it can decrypt the entire Vault. Instead,
-Shamir's technique allows us to split the root key into multiple shares or
-parts. The number of shares and the threshold needed is configurable, but by
-default Vault generates 5 shares, any 3 of which must be provided to
-reconstruct the root key.
-
-By using a secret sharing technique, we avoid the need to place absolute trust
-in the holder of the root key, and avoid storing the root key at all. The
-root key is only retrievable by reconstructing the shares. The shares are not
-useful for making any requests to Vault, and can only be used for unsealing.
-Once unsealed the standard ACL mechanisms are used for all requests.
-
-To make an analogy, a bank puts security deposit boxes inside of a vault. Each
-security deposit box has a key, while the vault door has both a combination and
-a key. The vault is encased in steel and concrete so that the door is the only
-practical entrance. The analogy to Vault is that the cryptosystem is the
-steel and concrete protecting the data. While you could tunnel through the
-concrete or brute force the encryption keys, it would be prohibitively time
-consuming. Opening the bank vault requires two-factors: the key and the
-combination. Similarly, Vault requires multiple shares be provided to
-reconstruct the root key. Once unsealed, each security deposit boxes still
-requires that the owner provide a key, and similarly the Vault ACL system protects
-all the secrets stored.
diff --git a/website/content/docs/internals/telemetry/enable-telemetry.mdx b/website/content/docs/internals/telemetry/enable-telemetry.mdx
deleted file mode 100644
index 71ae8d58f58..00000000000
--- a/website/content/docs/internals/telemetry/enable-telemetry.mdx
+++ /dev/null
@@ -1,109 +0,0 @@
----
-layout: docs
-page_title: Enable Vault telemetry
-description: >-
-  Step-by-step guide to enabling telemetry gathering with Vault
----
-
-# Enable Vault telemetry gathering
-
-Collect telemetry data from your Vault installation.
-
-## Before you start
-
-- **You must have Vault 1.14 or later installed and running**.
-- **You must have access to your [Vault configuration](/vault/docs/configuration) file**.
-
-
-## Step 1: Choose an aggregation agent
-
-@include 'telemetry/supported-aggregation-agents.mdx'
-
-## Step 2: Enable at least one audit device
-
-To include audit-related metrics, you must enable auditing on at least one device
-with the `vault audit enable` command. For example, to enable auditing for the
-`file` device and save the logs to `/var/log/vault_audit.log`:
-
-```shell-session
-$ vault audit enable file file_path=/var/log/vault_audit.log
-```
-
-By default, Enterprise installations replicate audit devices to the secondary
-performance nodes in a cluster. To limit performance replication for an audit
-device, use the `local` flag to mark the device as local to the current node:
-
-```shell-session
-$ vault audit enable file -local file_path=/var/log/vault_audit.log
-```
-
-
-## Step 3: Configure telemetry collection
-
-To configure telemetry collection, update the telemetry stanza in your Vault
-configuration with your collection preferences and aggregation agent details.
-
-For example, the following `telemetry` stanza configures Vault with the standard
-telemetry defaults and connects it to a Statsite agent running on the default
-port within a company intranet at `mycompany.statsite`:
-
-```hcl
-telemetry {
-  usage_gauge_period = "10m"
-  maximum_gauge_cardinality = 500
-  disable_hostname = false
-  enable_hostname_label = false
-  lease_metrics_epsilon = "1h"
-  num_lease_metrics_buckets = 168
-  add_lease_metrics_namespace_labels = false
-  filter_default = true
-
-  statsite_address = "mycompany.statsite:8125"
-}
-```
-
-Many metrics solutions charge by the metric. You can set `filter_default` to
-false and use the `prefix_filter` parameter to include and exclude specific
-values based on metric name to avoid paying for irrelevant information.
-
-For example, to limit your telemetry to the core token metrics plus the number
-of leases set to expire:
-
-```hcl
-telemetry {
-  filter_default = false
-  prefix_filter = ["+vault.token", "-vault.expire", "+vault.expire.num_leases"]
-}
-```
-
-## Step 4: Choose a reporting solution
-
-You need to save or forward your telemetry data to a separate storage solution
-for reporting, analysis, and alerting. Which solution you need depends on the
-feature set provided by your aggregation agent and the protocol support of your
-reporting platform.
-
-Popular reporting solutions compatible with Vault:
-
-- [Grafana](https://grafana.com/grafana)
-- [Graphite](https://www.hostedgraphite.com)
-- [InfluxData: Telegraf](https://www.influxdata.com/time-series-platform/telegraf)
-- [InfluxData: InfluxDB](https://www.influxdata.com/products/influxdb-overview)
-- [InfluxData: Chronograf](https://www.influxdata.com/time-series-platform/telegraf)
-- [InfluxData: Kapacitor](https://www.influxdata.com/time-series-platform/kapacitor)
-- [Splunk](https://www.splunk.com)
-
-
-## Next steps
-
-- Review the
-  [Key metrics for common health checks](/well-architected-framework/reliability/reliability-vault-monitoring-key-metrics)
-  guide to identify metrics you may want to start monitoring immediately.
-- Review the full list of available
-  [telemetry parameters](/vault/docs/configuration/telemetry#telemetry-parameters).
-- Review the [Monitor telemetry and audit device log data](/vault/tutorials/monitoring/monitor-telemetry-audit-splunk)
-  tutorial for general monitoring guidance and steps to configure your
-  Vault telemetry for Splunk using Telegraf and Fluentd.
-- Review the
-  [Monitor telemetry with Prometheus and Grafana](/vault/tutorials/monitoring/monitor-telemetry-grafana-prometheus)
-  tutorial to configure your Vault telemetry for Prometheus and Grafana.
diff --git a/website/content/docs/internals/telemetry/index.mdx b/website/content/docs/internals/telemetry/index.mdx
deleted file mode 100644
index c4b36b84aad..00000000000
--- a/website/content/docs/internals/telemetry/index.mdx
+++ /dev/null
@@ -1,76 +0,0 @@
----
-layout: docs
-page_title: Telemetry
-description: |-
-  Learn about the telemetry data available in Vault
----
-
-# Telemetry
-
-The Vault server process collects various runtime metrics about the performance
-of different libraries and subsystems. These metrics are aggregated on a
-10-second interval and retained for one minute in memory. High-cardinality
-metrics, like `vault.kv.secret.count`, report every 10 minutes or at an interval
-configured with in the `telemetry` stanza.
-
-Telemetry from Vault must be streamed and stored in metrics aggregation
-software to monitor Vault and collect durable metrics.
-
-@include 'telemetry/supported-aggregation-agents.mdx'
-
-<Tip title="Start with key health metrics">
-
-  The [Well-Architected Framework](/well-architected-framework) documentation
-  includes a best practices guide on
-  [key Vault metrics for common health checks](/well-architected-framework/reliability/reliability-vault-monitoring-key-metrics).
-  We recommend reviewing the key metric recommendations to identify metrics you
-  may want to start monitoring immediately.
-
-</Tip>
-
-## Working with raw telemetry data
-
-You can view raw telemetry data for debugging purposes by interrupting the Vault
-process with `USR1` (on *nix) or `BREAK` (on Windows). When the Vault process
-receives this signal, it dumps telemetry data for the last 10 seconds to
-`stderr`.
-
-Raw telemetry data is prefixed with the relevant metric type:
-
-- **`[C]`** indicates the metric is a **counter**.
-- **`[G]`** indicates the metric is a **gauge**.
-- **`[S]`** indicates the metric is a **summary**.
-
-## Example raw telemetry dump
-
-```text
-[2017-12-19 20:37:50 +0000 UTC][G] 'vault.7f320e57f9fe.expire.num_leases': 5100.000
-[2017-12-19 20:37:50 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.num_goroutines': 39.000
-[2017-12-19 20:37:50 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.sys_bytes': 222746880.000
-[2017-12-19 20:37:50 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.malloc_count': 109189192.000
-[2017-12-19 20:37:50 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.free_count': 108408240.000
-[2017-12-19 20:37:50 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.heap_objects': 780953.000
-[2017-12-19 20:37:50 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.total_gc_runs': 232.000
-[2017-12-19 20:37:50 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.alloc_bytes': 72954392.000
-[2017-12-19 20:37:50 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.total_gc_pause_ns': 150293024.000
-[2017-12-19 20:37:50 +0000 UTC][S] 'vault.merkle.flushDirty': Count: 100 Min: 0.008 Mean: 0.027 Max: 0.183 Stddev: 0.024 Sum: 2.681 LastUpdated: 2017-12-19 20:37:59.848733035 +0000 UTC m=+10463.692105920
-[2017-12-19 20:37:50 +0000 UTC][S] 'vault.merkle.saveCheckpoint': Count: 4 Min: 0.021 Mean: 0.054 Max: 0.110 Stddev: 0.039 Sum: 0.217 LastUpdated: 2017-12-19 20:37:57.048458148 +0000 UTC m=+10460.891835029
-[2017-12-19 20:38:00 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.alloc_bytes': 73326136.000
-[2017-12-19 20:38:00 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.sys_bytes': 222746880.000
-[2017-12-19 20:38:00 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.malloc_count': 109195904.000
-[2017-12-19 20:38:00 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.free_count': 108409568.000
-[2017-12-19 20:38:00 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.heap_objects': 786342.000
-[2017-12-19 20:38:00 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.total_gc_pause_ns': 150293024.000
-[2017-12-19 20:38:00 +0000 UTC][G] 'vault.7f320e57f9fe.expire.num_leases': 5100.000
-[2017-12-19 20:38:00 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.num_goroutines': 39.000
-[2017-12-19 20:38:00 +0000 UTC][G] 'vault.7f320e57f9fe.runtime.total_gc_runs': 232.000
-[2017-12-19 20:38:00 +0000 UTC][S] 'vault.route.rollback.consul-': Count: 1 Sum: 0.013 LastUpdated: 2017-12-19 20:38:01.968471579 +0000 UTC m=+10465.811842067
-[2017-12-19 20:38:00 +0000 UTC][S] 'vault.rollback.attempt.consul-': Count: 1 Sum: 0.073 LastUpdated: 2017-12-19 20:38:01.968502743 +0000 UTC m=+10465.811873131
-[2017-12-19 20:38:00 +0000 UTC][S] 'vault.rollback.attempt.pki-': Count: 1 Sum: 0.070 LastUpdated: 2017-12-19 20:38:01.96867005 +0000 UTC m=+10465.812041936
-[2017-12-19 20:38:00 +0000 UTC][S] 'vault.route.rollback.auth-app-id-': Count: 1 Sum: 0.012 LastUpdated: 2017-12-19 20:38:01.969146401 +0000 UTC m=+10465.812516689
-[2017-12-19 20:38:00 +0000 UTC][S] 'vault.rollback.attempt.identity-': Count: 1 Sum: 0.063 LastUpdated: 2017-12-19 20:38:01.968029888 +0000 UTC m=+10465.811400276
-[2017-12-19 20:38:00 +0000 UTC][S] 'vault.rollback.attempt.database-': Count: 1 Sum: 0.066 LastUpdated: 2017-12-19 20:38:01.969394215 +0000 UTC m=+10465.812764603
-[2017-12-19 20:38:00 +0000 UTC][S] 'vault.barrier.get': Count: 16 Min: 0.010 Mean: 0.015 Max: 0.031 Stddev: 0.005 Sum: 0.237 LastUpdated: 2017-12-19 20:38:01.983268118 +0000 UTC m=+10465.826637008
-[2017-12-19 20:38:00 +0000 UTC][S] 'vault.merkle.flushDirty': Count: 100 Min: 0.006 Mean: 0.024 Max: 0.098 Stddev: 0.019 Sum: 2.386 LastUpdated: 2017-12-19 20:38:09.848158309 +0000 UTC m=+10473.691527099
-```
-
diff --git a/website/content/docs/internals/telemetry/metrics/all.mdx b/website/content/docs/internals/telemetry/metrics/all.mdx
deleted file mode 100644
index 5b0414a3b4a..00000000000
--- a/website/content/docs/internals/telemetry/metrics/all.mdx
+++ /dev/null
@@ -1,755 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: All metrics"
-description: >-
-  Full list of all telemetry values provided by Vault.
----
-
-# All Vault telemetry metrics
-
-For completeness, we provide a full list of available metrics below in
-alphabetic order by name.
-
-## Full metric list
-
-@include 'telemetry-metrics/database/close.mdx'
-
-@include 'telemetry-metrics/database/close/error.mdx'
-
-@include 'telemetry-metrics/database/createuser.mdx'
-
-@include 'telemetry-metrics/database/createuser/error.mdx'
-
-@include 'telemetry-metrics/database/initialize.mdx'
-
-@include 'telemetry-metrics/database/initialize/error.mdx'
-
-@include 'telemetry-metrics/database/name/close.mdx'
-
-@include 'telemetry-metrics/database/name/close/error.mdx'
-
-@include 'telemetry-metrics/database/name/createuser.mdx'
-
-@include 'telemetry-metrics/database/name/createuser/error.mdx'
-
-@include 'telemetry-metrics/database/name/initialize.mdx'
-
-@include 'telemetry-metrics/database/name/initialize/error.mdx'
-
-@include 'telemetry-metrics/database/name/renewuser.mdx'
-
-@include 'telemetry-metrics/database/name/renewuser/error.mdx'
-
-@include 'telemetry-metrics/database/name/revokeuser.mdx'
-
-@include 'telemetry-metrics/database/name/revokeuser/error.mdx'
-
-@include 'telemetry-metrics/database/renewuser.mdx'
-
-@include 'telemetry-metrics/database/renewuser/error.mdx'
-
-@include 'telemetry-metrics/database/revokeuser.mdx'
-
-@include 'telemetry-metrics/database/revokeuser/error.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/cert_store_current_entry.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/cert_store_deleted_count.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/cert_store_total_entries_remaining.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/cert_store_total_entries.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/duration.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/failure.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_current_entry.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_deleted_count.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_fixed_issuers.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_incorrect_issuers.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_remaining.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/start_time_epoch.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/success.mdx'
-
-@include 'telemetry-metrics/vault/audit/device/log_request_failure.mdx'
-
-@include 'telemetry-metrics/vault/audit/device/log_request.mdx'
-
-@include 'telemetry-metrics/vault/audit/device/log_response_failure.mdx'
-
-@include 'telemetry-metrics/vault/audit/device/log_response.mdx'
-
-@include 'telemetry-metrics/vault/audit/log_request_failure.mdx'
-
-@include 'telemetry-metrics/vault/audit/log_request.mdx'
-
-@include 'telemetry-metrics/vault/audit/log_response_failure.mdx'
-
-@include 'telemetry-metrics/vault/audit/log_response.mdx'
-
-@include 'telemetry-metrics/vault/audit/sink_success.mdx'
-
-@include 'telemetry-metrics/vault/audit/sink_failure.mdx'
-
-@include 'telemetry-metrics/vault/audit/fallback_success.mdx'
-
-@include 'telemetry-metrics/vault/audit/fallback_miss.mdx'
-
-@include 'telemetry-metrics/vault/autopilot/failure_tolerance.mdx'
-
-@include 'telemetry-metrics/vault/autopilot/healthy.mdx'
-
-@include 'telemetry-metrics/vault/autopilot/node/healthy.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/last/success/time.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/percent/maxspace/used.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/rotate/duration.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/save/duration.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/save/errors.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/snapshot/size.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/total/snapshot/size.mdx'
-
-@include 'telemetry-metrics/vault/azure/delete.mdx'
-
-@include 'telemetry-metrics/vault/azure/get.mdx'
-
-@include 'telemetry-metrics/vault/azure/list.mdx'
-
-@include 'telemetry-metrics/vault/azure/put.mdx'
-
-@include 'telemetry-metrics/vault/barrier/delete.mdx'
-
-@include 'telemetry-metrics/vault/barrier/get.mdx'
-
-@include 'telemetry-metrics/vault/barrier/list.mdx'
-
-@include 'telemetry-metrics/vault/barrier/put.mdx'
-
-@include 'telemetry-metrics/vault/cache/delete.mdx'
-
-@include 'telemetry-metrics/vault/cache/hit.mdx'
-
-@include 'telemetry-metrics/vault/cache/miss.mdx'
-
-@include 'telemetry-metrics/vault/cache/write.mdx'
-
-@include 'telemetry-metrics/vault/cassandra/delete.mdx'
-
-@include 'telemetry-metrics/vault/cassandra/get.mdx'
-
-@include 'telemetry-metrics/vault/cassandra/list.mdx'
-
-@include 'telemetry-metrics/vault/cassandra/put.mdx'
-
-@include 'telemetry-metrics/vault/cockroachdb/delete.mdx'
-
-@include 'telemetry-metrics/vault/cockroachdb/get.mdx'
-
-@include 'telemetry-metrics/vault/cockroachdb/list.mdx'
-
-@include 'telemetry-metrics/vault/cockroachdb/put.mdx'
-
-@include 'telemetry-metrics/vault/consul/delete.mdx'
-
-@include 'telemetry-metrics/vault/consul/get.mdx'
-
-@include 'telemetry-metrics/vault/consul/list.mdx'
-
-@include 'telemetry-metrics/vault/consul/put.mdx'
-
-@include 'telemetry-metrics/vault/consul/transaction.mdx'
-
-@include 'telemetry-metrics/vault/core/active.mdx'
-
-@include 'telemetry-metrics/vault/core/activity/fragment_size.mdx'
-
-@include 'telemetry-metrics/vault/core/activity/segment_write.mdx'
-
-@include 'telemetry-metrics/vault/core/check_token.mdx'
-
-@include 'telemetry-metrics/vault/core/fetch_acl_and_token.mdx'
-
-@include 'telemetry-metrics/vault/core/handle_login_request.mdx'
-
-@include 'telemetry-metrics/vault/core/handle_request.mdx'
-
-@include 'telemetry-metrics/vault/core/in_flight_requests.mdx'
-
-@include 'telemetry-metrics/vault/core/leadership_lost.mdx'
-
-@include 'telemetry-metrics/vault/core/leadership_setup_failed.mdx'
-
-@include 'telemetry-metrics/vault/core/license/expiration_time_epoch.mdx'
-
-@include 'telemetry-metrics/vault/core/locked_users.mdx'
-
-@include 'telemetry-metrics/vault/core/mount_table/num_entries.mdx'
-
-@include 'telemetry-metrics/vault/core/mount_table/size.mdx'
-
-@include 'telemetry-metrics/vault/core/performance_standby.mdx'
-
-@include 'telemetry-metrics/vault/core/post_unseal.mdx'
-
-@include 'telemetry-metrics/vault/core/pre_seal.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/dr/primary.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/dr/secondary.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/performance/primary.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/performance/secondary.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/write_undo_logs.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/build_progress.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/build_total.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/reindex_stage.mdx'
-
-@include 'telemetry-metrics/vault/core/seal_internal.mdx'
-
-@include 'telemetry-metrics/vault/core/seal_with_request.mdx'
-
-@include 'telemetry-metrics/vault/core/step_down.mdx'
-
-@include 'telemetry-metrics/vault/core/unseal.mdx'
-
-@include 'telemetry-metrics/vault/core/unsealed.mdx'
-
-@include 'telemetry-metrics/vault/couchdb/delete.mdx'
-
-@include 'telemetry-metrics/vault/couchdb/get.mdx'
-
-@include 'telemetry-metrics/vault/couchdb/list.mdx'
-
-@include 'telemetry-metrics/vault/couchdb/put.mdx'
-
-@include 'telemetry-metrics/vault/dynamodb/delete.mdx'
-
-@include 'telemetry-metrics/vault/dynamodb/get.mdx'
-
-@include 'telemetry-metrics/vault/dynamodb/list.mdx'
-
-@include 'telemetry-metrics/vault/dynamodb/put.mdx'
-
-@include 'telemetry-metrics/vault/etcd/delete.mdx'
-
-@include 'telemetry-metrics/vault/etcd/get.mdx'
-
-@include 'telemetry-metrics/vault/etcd/list.mdx'
-
-@include 'telemetry-metrics/vault/etcd/put.mdx'
-
-@include 'telemetry-metrics/vault/expire/fetch_lease_times_by_token.mdx'
-
-@include 'telemetry-metrics/vault/expire/fetch_lease_times.mdx'
-
-@include 'telemetry-metrics/vault/expire/job_manager/queue_length.mdx'
-
-@include 'telemetry-metrics/vault/expire/job_manager/total_jobs.mdx'
-
-@include 'telemetry-metrics/vault/expire/lease_expiration.mdx'
-
-@include 'telemetry-metrics/vault/expire/lease_expiration/error.mdx'
-
-@include 'telemetry-metrics/vault/expire/lease_expiration/time_in_queue.mdx'
-
-@include 'telemetry-metrics/vault/expire/leases/by_expiration.mdx'
-
-@include 'telemetry-metrics/vault/expire/num_irrevocable_leases.mdx'
-
-@include 'telemetry-metrics/vault/expire/num_leases.mdx'
-
-@include 'telemetry-metrics/vault/expire/register_auth.mdx'
-
-@include 'telemetry-metrics/vault/expire/register.mdx'
-
-@include 'telemetry-metrics/vault/expire/renew_token.mdx'
-
-@include 'telemetry-metrics/vault/expire/renew.mdx'
-
-@include 'telemetry-metrics/vault/expire/revoke_by_token.mdx'
-
-@include 'telemetry-metrics/vault/expire/revoke_force.mdx'
-
-@include 'telemetry-metrics/vault/expire/revoke_prefix.mdx'
-
-@include 'telemetry-metrics/vault/expire/revoke.mdx'
-
-@include 'telemetry-metrics/vault/gcs/delete.mdx'
-
-@include 'telemetry-metrics/vault/gcs/get.mdx'
-
-@include 'telemetry-metrics/vault/gcs/list.mdx'
-
-@include 'telemetry-metrics/vault/gcs/lock/lock.mdx'
-
-@include 'telemetry-metrics/vault/gcs/lock/unlock.mdx'
-
-@include 'telemetry-metrics/vault/gcs/lock/value.mdx'
-
-@include 'telemetry-metrics/vault/gcs/put.mdx'
-
-@include 'telemetry-metrics/vault/ha/rpc/client/echo.mdx'
-
-@include 'telemetry-metrics/vault/ha/rpc/client/echo/errors.mdx'
-
-@include 'telemetry-metrics/vault/ha/rpc/client/forward.mdx'
-
-@include 'telemetry-metrics/vault/ha/rpc/client/forward/errors.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/active/monthly.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/active/partial_month.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/active/reporting_period.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/alias/count.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/count.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/creation.mdx'
-
-@include 'telemetry-metrics/vault/identity/num_entities.mdx'
-
-@include 'telemetry-metrics/vault/identity/upsert_entity_txn.mdx'
-
-@include 'telemetry-metrics/vault/identity/upsert_group_txn.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/buffer/length.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/buffer/max_length.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/buffer/max_size.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/buffer/size.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/streamwals/guard_found.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/streamwals/missing_guard.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/streamwals/scanned_entries.mdx'
-
-@include 'telemetry-metrics/vault/merkle/flushdirty.mdx'
-
-@include 'telemetry-metrics/vault/merkle/flushdirty/num_pages.mdx'
-
-@include 'telemetry-metrics/vault/merkle/flushdirty/outstanding_pages.mdx'
-
-@include 'telemetry-metrics/vault/merkle/savecheckpoint.mdx'
-
-@include 'telemetry-metrics/vault/merkle/savecheckpoint/num_dirty.mdx'
-
-@include 'telemetry-metrics/vault/metrics/collection.mdx'
-
-@include 'telemetry-metrics/vault/metrics/collection/error.mdx'
-
-@include 'telemetry-metrics/vault/metrics/collection/interval.mdx'
-
-@include 'telemetry-metrics/vault/mssql/delete.mdx'
-
-@include 'telemetry-metrics/vault/mssql/get.mdx'
-
-@include 'telemetry-metrics/vault/mssql/list.mdx'
-
-@include 'telemetry-metrics/vault/mssql/put.mdx'
-
-@include 'telemetry-metrics/vault/mysql/delete.mdx'
-
-@include 'telemetry-metrics/vault/mysql/get.mdx'
-
-@include 'telemetry-metrics/vault/mysql/list.mdx'
-
-@include 'telemetry-metrics/vault/mysql/put.mdx'
-
-@include 'telemetry-metrics/vault/policy/delete_policy.mdx'
-
-@include 'telemetry-metrics/vault/policy/get_policy.mdx'
-
-@include 'telemetry-metrics/vault/policy/list_policies.mdx'
-
-@include 'telemetry-metrics/vault/policy/set_policy.mdx'
-
-@include 'telemetry-metrics/vault/postgres/delete.mdx'
-
-@include 'telemetry-metrics/vault/postgres/get.mdx'
-
-@include 'telemetry-metrics/vault/postgres/list.mdx'
-
-@include 'telemetry-metrics/vault/postgres/put.mdx'
-
-@include 'telemetry-metrics/vault/quota/lease_count/counter.mdx'
-
-@include 'telemetry-metrics/vault/quota/lease_count/max.mdx'
-
-@include 'telemetry-metrics/vault/quota/lease_count/violation.mdx'
-
-@include 'telemetry-metrics/vault/quota/rate_limit/violation.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/cursor/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/freelist/allocated_bytes.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/freelist/free_pages.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/freelist/pending_pages.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/freelist/used_bytes.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/node/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/node/dereferences.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/page/bytes_allocated.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/page/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/rebalance/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/rebalance/time.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/spill/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/spill/time.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/split/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/transaction/currently_open_read_transactions.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/transaction/started_read_transactions.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/write/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/write/time.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/follower/applied_index_delta.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/follower/last_heartbeat_ms.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/stats/applied_index.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/stats/commit_index.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/stats/fsm_pending.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/delete.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/entry_size.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/get.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/list.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/put.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/transaction.mdx'
-
-@include 'telemetry-metrics/vault/raft/apply.mdx'
-
-@include 'telemetry-metrics/vault/raft/barrier.mdx'
-
-@include 'telemetry-metrics/vault/raft/candidate/electself.mdx'
-
-@include 'telemetry-metrics/vault/raft/commitnumlogs.mdx'
-
-@include 'telemetry-metrics/vault/raft/committime.mdx'
-
-@include 'telemetry-metrics/vault/raft/compactlogs.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/apply.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/applybatch.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/applybatchnum.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/enqueue.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/restore.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/snapshot.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/store_config.mdx'
-
-@include 'telemetry-metrics/vault/raft/get.mdx'
-
-@include 'telemetry-metrics/vault/raft/leader/dispatchlog.mdx'
-
-@include 'telemetry-metrics/vault/raft/leader/dispatchnumlogs.mdx'
-
-@include 'telemetry-metrics/vault/raft/leader/lastcontact.mdx'
-
-@include 'telemetry-metrics/vault/raft/list.mdx'
-
-@include 'telemetry-metrics/vault/raft/peers.mdx'
-
-@include 'telemetry-metrics/vault/raft/replication/appendentries/log.mdx'
-
-@include 'telemetry-metrics/vault/raft/replication/appendentries/rpc.mdx'
-
-@include 'telemetry-metrics/vault/raft/replication/heartbeat.mdx'
-
-@include 'telemetry-metrics/vault/raft/replication/installsnapshot.mdx'
-
-@include 'telemetry-metrics/vault/raft/restore.mdx'
-
-@include 'telemetry-metrics/vault/raft/restoreusersnapshot.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/appendentries.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/appendentries/processlogs.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/appendentries/storelogs.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/installsnapshot.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/processheartbeat.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/requestvote.mdx'
-
-@include 'telemetry-metrics/vault/raft/snapshot/create.mdx'
-
-@include 'telemetry-metrics/vault/raft/snapshot/persist.mdx'
-
-@include 'telemetry-metrics/vault/raft/snapshot/takesnapshot.mdx'
-
-@include 'telemetry-metrics/vault/raft/state/candidate.mdx'
-
-@include 'telemetry-metrics/vault/raft/state/follower.mdx'
-
-@include 'telemetry-metrics/vault/raft/state/leader.mdx'
-
-@include 'telemetry-metrics/vault/raft/transition/heartbeat_timeout.mdx'
-
-@include 'telemetry-metrics/vault/raft/transition/leader_lease_timeout.mdx'
-
-@include 'telemetry-metrics/vault/raft/verify_leader.mdx'
-
-@include 'telemetry-metrics/vault/replication/fetchremotekeys.mdx'
-
-@include 'telemetry-metrics/vault/replication/fsm/last_remote_wal.mdx'
-
-@include 'telemetry-metrics/vault/replication/fsm/last_upstream_remote_wal.mdx'
-
-@include 'telemetry-metrics/vault/replication/merkle/commit_index.mdx'
-
-@include 'telemetry-metrics/vault/replication/merklediff.mdx'
-
-@include 'telemetry-metrics/vault/replication/merklesync.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/conflicting_pages.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/create_token_register_auth_lease.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/fetch_keys.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/forward.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/guard_hash.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/persist_alias.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/register_auth.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/register_lease.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/save_mfa_response_auth.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/stream_wals.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/sub_page_hashes.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/sync_counter.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/upsert_group.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/wrap_in_cubbyhole.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/dr/server/echo.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/dr/server/fetch_keys_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/auth_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/bootstrap_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/conflicting_pages_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/echo.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/forwarding_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/guard_hash_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/persist_alias_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/persist_persona_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/save_mfa_response_auth.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/stream_wals_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/sub_page_hashes_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/sync_counter_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/upsert_group_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/standby/server/create_token_register_auth_lease_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/standby/server/echo.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/standby/server/register_auth_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/standby/server/register_lease_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/standby/server/wrap_token_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/wal/gc.mdx'
-
-@include 'telemetry-metrics/vault/replication/wal/last_dr_wal.mdx'
-
-@include 'telemetry-metrics/vault/replication/wal/last_performance_wal.mdx'
-
-@include 'telemetry-metrics/vault/replication/wal/last_wal.mdx'
-
-@include 'telemetry-metrics/vault/rollback/attempt/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/rollback/attempt.mdx'
-
-@include 'telemetry-metrics/vault/rollback/inflight.mdx'
-
-@include 'telemetry-metrics/vault/rollback/queued.mdx'
-
-@include 'telemetry-metrics/vault/rollback/waiting.mdx'
-
-@include 'telemetry-metrics/vault/route/create/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/route/delete/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/route/list/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/route/read/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/route/rollback/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/route/rollback.mdx'
-
-@include 'telemetry-metrics/vault/runtime/alloc_bytes.mdx'
-
-@include 'telemetry-metrics/vault/runtime/free_count.mdx'
-
-@include 'telemetry-metrics/vault/runtime/gc_pause_ns.mdx'
-
-@include 'telemetry-metrics/vault/runtime/heap_objects.mdx'
-
-@include 'telemetry-metrics/vault/runtime/malloc_count.mdx'
-
-@include 'telemetry-metrics/vault/runtime/num_goroutines.mdx'
-
-@include 'telemetry-metrics/vault/runtime/sys_bytes.mdx'
-
-@include 'telemetry-metrics/vault/runtime/total_gc_pause_ns.mdx'
-
-@include 'telemetry-metrics/vault/runtime/total_gc_runs.mdx'
-
-@include 'telemetry-metrics/vault/s3/delete.mdx'
-
-@include 'telemetry-metrics/vault/s3/get.mdx'
-
-@include 'telemetry-metrics/vault/s3/list.mdx'
-
-@include 'telemetry-metrics/vault/s3/put.mdx'
-
-@include 'telemetry-metrics/vault/secret/kv/count.mdx'
-
-@include 'telemetry-metrics/vault/secret/lease/creation.mdx'
-
-@include 'telemetry-metrics/vault/secrets-sync/destinations.mdx'
-
-@include 'telemetry-metrics/vault/secrets-sync/associations.mdx'
-
-@include 'telemetry-metrics/vault/spanner/delete.mdx'
-
-@include 'telemetry-metrics/vault/spanner/get.mdx'
-
-@include 'telemetry-metrics/vault/spanner/list.mdx'
-
-@include 'telemetry-metrics/vault/spanner/lock/lock.mdx'
-
-@include 'telemetry-metrics/vault/spanner/lock/unlock.mdx'
-
-@include 'telemetry-metrics/vault/spanner/lock/value.mdx'
-
-@include 'telemetry-metrics/vault/spanner/put.mdx'
-
-@include 'telemetry-metrics/vault/swift/delete.mdx'
-
-@include 'telemetry-metrics/vault/swift/get.mdx'
-
-@include 'telemetry-metrics/vault/swift/list.mdx'
-
-@include 'telemetry-metrics/vault/swift/put.mdx'
-
-@include 'telemetry-metrics/vault/token/count.mdx'
-
-@include 'telemetry-metrics/vault/token/count/by_auth.mdx'
-
-@include 'telemetry-metrics/vault/token/count/by_policy.mdx'
-
-@include 'telemetry-metrics/vault/token/count/by_ttl.mdx'
-
-@include 'telemetry-metrics/vault/token/create_root.mdx'
-
-@include 'telemetry-metrics/vault/token/create.mdx'
-
-@include 'telemetry-metrics/vault/token/createaccessor.mdx'
-
-@include 'telemetry-metrics/vault/token/creation.mdx'
-
-@include 'telemetry-metrics/vault/token/lookup.mdx'
-
-@include 'telemetry-metrics/vault/token/revoke_tree.mdx'
-
-@include 'telemetry-metrics/vault/token/revoke.mdx'
-
-@include 'telemetry-metrics/vault/token/store.mdx'
-
-@include 'telemetry-metrics/vault/wal/deletewals.mdx'
-
-@include 'telemetry-metrics/vault/wal/flushready.mdx'
-
-@include 'telemetry-metrics/vault/wal/flushready/queue_len.mdx'
-
-@include 'telemetry-metrics/vault/wal/gc/deleted.mdx'
-
-@include 'telemetry-metrics/vault/wal/gc/total.mdx'
-
-@include 'telemetry-metrics/vault/wal/loadwal.mdx'
-
-@include 'telemetry-metrics/vault/wal/persistwals.mdx'
-
-@include 'telemetry-metrics/vault/zookeeper/delete.mdx'
-
-@include 'telemetry-metrics/vault/zookeeper/get.mdx'
-
-@include 'telemetry-metrics/vault/zookeeper/list.mdx'
-
-@include 'telemetry-metrics/vault/zookeeper/put.mdx'
diff --git a/website/content/docs/internals/telemetry/metrics/audit.mdx b/website/content/docs/internals/telemetry/metrics/audit.mdx
deleted file mode 100644
index 8ac90ce916f..00000000000
--- a/website/content/docs/internals/telemetry/metrics/audit.mdx
+++ /dev/null
@@ -1,37 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Audit metrics"
-description: >-
-  Technical reference for audit log telemetry values.
----
-
-# Audit log telemetry
-
-Audit log telemetry provides information on the health of your configured audit
-devices.
-
-## Default metrics
-
-@include 'telemetry-metrics/vault/audit/log_request_failure.mdx'
-
-@include 'telemetry-metrics/vault/audit/log_request.mdx'
-
-@include 'telemetry-metrics/vault/audit/log_response_failure.mdx'
-
-@include 'telemetry-metrics/vault/audit/log_response.mdx'
-
-@include 'telemetry-metrics/vault/audit/sink_success.mdx'
-
-@include 'telemetry-metrics/vault/audit/sink_failure.mdx'
-
-@include 'telemetry-metrics/vault/audit/fallback_success.mdx'
-
-@include 'telemetry-metrics/vault/audit/fallback_miss.mdx'
-
-## Audit device metrics
-
-@include 'telemetry-metrics/device-intro.mdx'
-
-@include 'telemetry-metrics/vault/audit/device/log_request.mdx'
-
-@include 'telemetry-metrics/vault/audit/device/log_response.mdx'
diff --git a/website/content/docs/internals/telemetry/metrics/authn.mdx b/website/content/docs/internals/telemetry/metrics/authn.mdx
deleted file mode 100644
index a44572bf2e2..00000000000
--- a/website/content/docs/internals/telemetry/metrics/authn.mdx
+++ /dev/null
@@ -1,95 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Authentication metrics"
-description: >-
-  Technical reference for authentication related telemetry values.
----
-
-# Authentication telemetry
-
-Authentication telemetry provides information on authentication-related
-objects and operations.
-
-## Identity metrics
-
-@include 'telemetry-metrics/vault/identity/entity/active/monthly.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/active/partial_month.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/active/reporting_period.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/alias/count.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/count.mdx'
-
-@include 'telemetry-metrics/vault/identity/entity/creation.mdx'
-
-@include 'telemetry-metrics/vault/identity/num_entities.mdx'
-
-@include 'telemetry-metrics/vault/identity/upsert_entity_txn.mdx'
-
-@include 'telemetry-metrics/vault/identity/upsert_group_txn.mdx'
-
-## Lease metrics
-
-@include 'telemetry-metrics/vault/expire/fetch_lease_times_by_token.mdx'
-
-@include 'telemetry-metrics/vault/expire/fetch_lease_times.mdx'
-
-@include 'telemetry-metrics/vault/expire/job_manager/queue_length.mdx'
-
-@include 'telemetry-metrics/vault/expire/job_manager/total_jobs.mdx'
-
-@include 'telemetry-metrics/vault/expire/lease_expiration.mdx'
-
-@include 'telemetry-metrics/vault/expire/lease_expiration/error.mdx'
-
-@include 'telemetry-metrics/vault/expire/lease_expiration/time_in_queue.mdx'
-
-@include 'telemetry-metrics/vault/expire/leases/by_expiration.mdx'
-
-@include 'telemetry-metrics/vault/expire/num_irrevocable_leases.mdx'
-
-@include 'telemetry-metrics/vault/expire/num_leases.mdx'
-
-@include 'telemetry-metrics/vault/expire/register_auth.mdx'
-
-@include 'telemetry-metrics/vault/expire/register.mdx'
-
-@include 'telemetry-metrics/vault/expire/renew_token.mdx'
-
-@include 'telemetry-metrics/vault/expire/renew.mdx'
-
-@include 'telemetry-metrics/vault/expire/revoke_by_token.mdx'
-
-@include 'telemetry-metrics/vault/expire/revoke_force.mdx'
-
-@include 'telemetry-metrics/vault/expire/revoke_prefix.mdx'
-
-@include 'telemetry-metrics/vault/expire/revoke.mdx'
-
-## Token metrics
-
-@include 'telemetry-metrics/vault/token/count.mdx'
-
-@include 'telemetry-metrics/vault/token/count/by_auth.mdx'
-
-@include 'telemetry-metrics/vault/token/count/by_policy.mdx'
-
-@include 'telemetry-metrics/vault/token/count/by_ttl.mdx'
-
-@include 'telemetry-metrics/vault/token/create_root.mdx'
-
-@include 'telemetry-metrics/vault/token/create.mdx'
-
-@include 'telemetry-metrics/vault/token/createaccessor.mdx'
-
-@include 'telemetry-metrics/vault/token/creation.mdx'
-
-@include 'telemetry-metrics/vault/token/lookup.mdx'
-
-@include 'telemetry-metrics/vault/token/revoke_tree.mdx'
-
-@include 'telemetry-metrics/vault/token/revoke.mdx'
-
-@include 'telemetry-metrics/vault/token/store.mdx'
\ No newline at end of file
diff --git a/website/content/docs/internals/telemetry/metrics/autosnap.mdx b/website/content/docs/internals/telemetry/metrics/autosnap.mdx
deleted file mode 100644
index 93009634ebd..00000000000
--- a/website/content/docs/internals/telemetry/metrics/autosnap.mdx
+++ /dev/null
@@ -1,30 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Automated snapshot metrics"
-description: >-
-  Technical reference for automated Raft snapshot telemetry values.
----
-
-# Automated snapshots telemetry
-
-<EnterpriseAlert product="vault" />
-
-Automated snapshot telemetry provides information on automatically scheduled snapshot activity for the
-[Raft storage snapshot](/vault/docs/enterprise/automated-integrated-storage-snapshots)
-feature.
-
-## Default metrics
-
-@include 'telemetry-metrics/vault/autosnapshots/last/success/time.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/percent/maxspace/used.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/rotate/duration.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/save/duration.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/save/errors.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/snapshot/size.mdx'
-
-@include 'telemetry-metrics/vault/autosnapshots/total/snapshot/size.mdx'
\ No newline at end of file
diff --git a/website/content/docs/internals/telemetry/metrics/availability.mdx b/website/content/docs/internals/telemetry/metrics/availability.mdx
deleted file mode 100644
index 90c9d6593cd..00000000000
--- a/website/content/docs/internals/telemetry/metrics/availability.mdx
+++ /dev/null
@@ -1,158 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Availability"
-description: >-
-  Technical reference for availability related telemetry values.
----
-
-# Availability telemetry
-
-Availability telemetry provides information about standby and active nodes in
-your Vault instance. Enterprise installations also include
-[replication](/vault/docs/enterprise/replication) metrics.
-
-## Default metrics
-
-@include 'telemetry-metrics/vault/ha/rpc/client/echo.mdx'
-
-@include 'telemetry-metrics/vault/ha/rpc/client/echo/errors.mdx'
-
-@include 'telemetry-metrics/vault/ha/rpc/client/forward.mdx'
-
-@include 'telemetry-metrics/vault/ha/rpc/client/forward/errors.mdx'
-
-## Merkle tree metrics
-
-@include 'telemetry-metrics/vault/merkle/flushdirty.mdx'
-
-@include 'telemetry-metrics/vault/merkle/flushdirty/num_pages.mdx'
-
-@include 'telemetry-metrics/vault/merkle/flushdirty/outstanding_pages.mdx'
-
-@include 'telemetry-metrics/vault/merkle/savecheckpoint.mdx'
-
-@include 'telemetry-metrics/vault/merkle/savecheckpoint/num_dirty.mdx'
-
-## Write-ahead log (WAL) telemetry
-
-@include 'telemetry-metrics/vault/wal/deletewals.mdx'
-
-@include 'telemetry-metrics/vault/wal/flushready.mdx'
-
-@include 'telemetry-metrics/vault/wal/flushready/queue_len.mdx'
-
-@include 'telemetry-metrics/vault/wal/gc/deleted.mdx'
-
-@include 'telemetry-metrics/vault/wal/gc/total.mdx'
-
-@include 'telemetry-metrics/vault/wal/loadwal.mdx'
-
-@include 'telemetry-metrics/vault/wal/persistwals.mdx'
-
-## Log shipping metrics
-
-@include 'telemetry-metrics/vault/logshipper/buffer/length.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/buffer/max_length.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/buffer/max_size.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/buffer/size.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/streamwals/guard_found.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/streamwals/missing_guard.mdx'
-
-@include 'telemetry-metrics/vault/logshipper/streamwals/scanned_entries.mdx'
-
-## Replication metrics <EnterpriseAlert product="vault" inline />
-
-@include 'telemetry-metrics/replication-note.mdx'
-
-@include 'telemetry-metrics/vault/replication/fetchremotekeys.mdx'
-
-@include 'telemetry-metrics/vault/replication/fsm/last_remote_wal.mdx'
-
-@include 'telemetry-metrics/vault/replication/fsm/last_upstream_remote_wal.mdx'
-
-@include 'telemetry-metrics/vault/replication/merkle/commit_index.mdx'
-
-@include 'telemetry-metrics/vault/replication/merklediff.mdx'
-
-@include 'telemetry-metrics/vault/replication/merklesync.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/conflicting_pages.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/create_token_register_auth_lease.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/fetch_keys.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/forward.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/guard_hash.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/persist_alias.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/register_auth.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/register_lease.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/save_mfa_response_auth.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/stream_wals.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/sub_page_hashes.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/sync_counter.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/upsert_group.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/client/wrap_in_cubbyhole.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/dr/server/echo.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/dr/server/fetch_keys_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/auth_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/bootstrap_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/conflicting_pages_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/echo.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/forwarding_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/guard_hash_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/persist_alias_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/persist_persona_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/save_mfa_response_auth.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/stream_wals_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/sub_page_hashes_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/sync_counter_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/server/upsert_group_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/standby/server/create_token_register_auth_lease_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/standby/server/echo.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/standby/server/register_auth_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/standby/server/register_lease_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/rpc/standby/server/wrap_token_request.mdx'
-
-@include 'telemetry-metrics/vault/replication/wal/gc.mdx'
-
-@include 'telemetry-metrics/vault/replication/wal/last_dr_wal.mdx'
-
-@include 'telemetry-metrics/vault/replication/wal/last_performance_wal.mdx'
-
-@include 'telemetry-metrics/vault/replication/wal/last_wal.mdx'
diff --git a/website/content/docs/internals/telemetry/metrics/core-system.mdx b/website/content/docs/internals/telemetry/metrics/core-system.mdx
deleted file mode 100644
index 46508c8051f..00000000000
--- a/website/content/docs/internals/telemetry/metrics/core-system.mdx
+++ /dev/null
@@ -1,167 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Core system metrics"
-description: >-
-  Technical reference for core system telemetry values.
----
-
-# Core system telemetry
-
-Core system telemetry provides information about the operational health of your
-Vault instance.
-
-## Default metrics
-
-@include 'telemetry-metrics/vault/core/active.mdx'
-
-@include 'telemetry-metrics/vault/core/activity/fragment_size.mdx'
-
-@include 'telemetry-metrics/vault/core/activity/segment_write.mdx'
-
-@include 'telemetry-metrics/vault/core/check_token.mdx'
-
-@include 'telemetry-metrics/vault/core/fetch_acl_and_token.mdx'
-
-@include 'telemetry-metrics/vault/core/handle_login_request.mdx'
-
-@include 'telemetry-metrics/vault/core/handle_request.mdx'
-
-@include 'telemetry-metrics/vault/core/in_flight_requests.mdx'
-
-@include 'telemetry-metrics/vault/core/leadership_lost.mdx'
-
-@include 'telemetry-metrics/vault/core/leadership_setup_failed.mdx'
-
-@include 'telemetry-metrics/vault/core/license/expiration_time_epoch.mdx'
-
-@include 'telemetry-metrics/vault/core/locked_users.mdx'
-
-@include 'telemetry-metrics/vault/core/mount_table/num_entries.mdx'
-
-@include 'telemetry-metrics/vault/core/mount_table/size.mdx'
-
-@include 'telemetry-metrics/vault/core/performance_standby.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/dr/primary.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/dr/secondary.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/performance/primary.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/performance/secondary.mdx'
-
-@include 'telemetry-metrics/vault/core/replication/write_undo_logs.mdx'
-
-@include 'telemetry-metrics/vault/core/step_down.mdx'
-
-## Barrier metrics
-
-@include 'telemetry-metrics/vault/barrier/delete.mdx'
-
-@include 'telemetry-metrics/vault/barrier/get.mdx'
-
-@include 'telemetry-metrics/vault/barrier/list.mdx'
-
-@include 'telemetry-metrics/vault/barrier/put.mdx'
-
-## Caching metrics
-
-@include 'telemetry-metrics/vault/cache/delete.mdx'
-
-@include 'telemetry-metrics/vault/cache/hit.mdx'
-
-@include 'telemetry-metrics/vault/cache/miss.mdx'
-
-@include 'telemetry-metrics/vault/cache/write.mdx'
-
-## Metric collection metrics
-
-@include 'telemetry-metrics/vault/metrics/collection.mdx'
-
-@include 'telemetry-metrics/vault/metrics/collection/error.mdx'
-
-@include 'telemetry-metrics/vault/metrics/collection/interval.mdx'
-
-## Quota metrics
-
-@include 'telemetry-metrics/quota-intro.mdx'
-
-@include 'telemetry-metrics/vault/quota/lease_count/counter.mdx'
-
-@include 'telemetry-metrics/vault/quota/lease_count/max.mdx'
-
-@include 'telemetry-metrics/vault/quota/lease_count/violation.mdx'
-
-@include 'telemetry-metrics/vault/quota/rate_limit/violation.mdx'
-
-## Rollback metrics
-
-@include 'telemetry-metrics/rollback-intro.mdx'
-
-@include 'telemetry-metrics/vault/rollback/attempt/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/rollback/attempt.mdx'
-
-@include 'telemetry-metrics/vault/rollback/inflight.mdx'
-
-@include 'telemetry-metrics/vault/rollback/queued.mdx'
-
-@include 'telemetry-metrics/vault/rollback/waiting.mdx'
-
-## Route metrics
-
-@include 'telemetry-metrics/route-intro.mdx'
-
-@include 'telemetry-metrics/vault/route/create/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/route/delete/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/route/list/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/route/read/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/route/rollback/mountpoint.mdx'
-
-@include 'telemetry-metrics/vault/route/rollback.mdx'
-
-## Runtime metrics
-
-@include 'telemetry-metrics/runtime-note.mdx'
-
-@include 'telemetry-metrics/vault/runtime/alloc_bytes.mdx'
-
-@include 'telemetry-metrics/vault/runtime/free_count.mdx'
-
-@include 'telemetry-metrics/vault/runtime/gc_pause_ns.mdx'
-
-@include 'telemetry-metrics/vault/runtime/heap_objects.mdx'
-
-@include 'telemetry-metrics/vault/runtime/malloc_count.mdx'
-
-@include 'telemetry-metrics/vault/runtime/num_goroutines.mdx'
-
-@include 'telemetry-metrics/vault/runtime/sys_bytes.mdx'
-
-@include 'telemetry-metrics/vault/runtime/total_gc_pause_ns.mdx'
-
-@include 'telemetry-metrics/vault/runtime/total_gc_runs.mdx'
-
-## Seal metrics
-
-@include 'telemetry-metrics/vault/core/post_unseal.mdx'
-
-@include 'telemetry-metrics/vault/core/pre_seal.mdx'
-
-@include 'telemetry-metrics/vault/core/seal_encrypt.mdx'
-
-@include 'telemetry-metrics/vault/core/seal_decrypt.mdx'
-
-@include 'telemetry-metrics/vault/core/seal_internal.mdx'
-
-@include 'telemetry-metrics/vault/core/seal_unreachable.mdx'
-
-@include 'telemetry-metrics/vault/core/seal_with_request.mdx'
-
-@include 'telemetry-metrics/vault/core/unseal.mdx'
-
-@include 'telemetry-metrics/vault/core/unsealed.mdx'
diff --git a/website/content/docs/internals/telemetry/metrics/database.mdx b/website/content/docs/internals/telemetry/metrics/database.mdx
deleted file mode 100644
index 5bf48f93ff9..00000000000
--- a/website/content/docs/internals/telemetry/metrics/database.mdx
+++ /dev/null
@@ -1,145 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Database metrics"
-description: >-
-  Technical reference for database telemetry values.
----
-
-# Database telemetry
-
-Database telemetry provides general information about configured secrets engines
-and databases.
-
-## Secrets database metrics
-
-@include 'telemetry-metrics/secretsdb-intro.mdx'
-
-@include 'telemetry-metrics/database/close.mdx'
-
-@include 'telemetry-metrics/database/close/error.mdx'
-
-@include 'telemetry-metrics/database/createuser.mdx'
-
-@include 'telemetry-metrics/database/createuser/error.mdx'
-
-@include 'telemetry-metrics/database/initialize.mdx'
-
-@include 'telemetry-metrics/database/initialize/error.mdx'
-
-@include 'telemetry-metrics/database/name/close.mdx'
-
-@include 'telemetry-metrics/database/name/close/error.mdx'
-
-@include 'telemetry-metrics/database/name/createuser.mdx'
-
-@include 'telemetry-metrics/database/name/createuser/error.mdx'
-
-@include 'telemetry-metrics/database/name/initialize.mdx'
-
-@include 'telemetry-metrics/database/name/initialize/error.mdx'
-
-@include 'telemetry-metrics/database/name/renewuser.mdx'
-
-@include 'telemetry-metrics/database/name/renewuser/error.mdx'
-
-@include 'telemetry-metrics/database/name/revokeuser.mdx'
-
-@include 'telemetry-metrics/database/name/revokeuser/error.mdx'
-
-@include 'telemetry-metrics/database/renewuser.mdx'
-
-@include 'telemetry-metrics/database/renewuser/error.mdx'
-
-@include 'telemetry-metrics/database/revokeuser.mdx'
-
-@include 'telemetry-metrics/database/revokeuser/error.mdx'
-
-## Cockroach database
-
-Metrics related to your Cockroach database **storage backend**.
-
-@include 'telemetry-metrics/vault/cockroachdb/delete.mdx'
-
-@include 'telemetry-metrics/vault/cockroachdb/get.mdx'
-
-@include 'telemetry-metrics/vault/cockroachdb/list.mdx'
-
-@include 'telemetry-metrics/vault/cockroachdb/put.mdx'
-
-## Couch database
-
-Metrics related to your Couch database **storage backend**.
-
-@include 'telemetry-metrics/vault/couchdb/delete.mdx'
-
-@include 'telemetry-metrics/vault/couchdb/get.mdx'
-
-@include 'telemetry-metrics/vault/couchdb/list.mdx'
-
-@include 'telemetry-metrics/vault/couchdb/put.mdx'
-
-## Dynamo database
-
-Metrics related to your Dynamo database **storage backend**.
-
-@include 'telemetry-metrics/vault/dynamodb/delete.mdx'
-
-@include 'telemetry-metrics/vault/dynamodb/get.mdx'
-
-@include 'telemetry-metrics/vault/dynamodb/list.mdx'
-
-@include 'telemetry-metrics/vault/dynamodb/put.mdx'
-
-## Google Cloud - Spanner
-
-Metrics related to your Spanner **storage backend**.
-
-@include 'telemetry-metrics/vault/spanner/delete.mdx'
-
-@include 'telemetry-metrics/vault/spanner/get.mdx'
-
-@include 'telemetry-metrics/vault/spanner/list.mdx'
-
-@include 'telemetry-metrics/vault/spanner/lock/lock.mdx'
-
-@include 'telemetry-metrics/vault/spanner/lock/unlock.mdx'
-
-@include 'telemetry-metrics/vault/spanner/lock/value.mdx'
-
-@include 'telemetry-metrics/vault/spanner/put.mdx'
-
-## Microsoft SQL Server (MSSQL)
-
-Metrics related to your SQL Server **storage backend**.
-
-@include 'telemetry-metrics/vault/mssql/delete.mdx'
-
-@include 'telemetry-metrics/vault/mssql/get.mdx'
-
-@include 'telemetry-metrics/vault/mssql/list.mdx'
-
-@include 'telemetry-metrics/vault/mssql/put.mdx'
-
-## MySQL
-
-Metrics related to your MySQL **storage backend**.
-
-@include 'telemetry-metrics/vault/mysql/delete.mdx'
-
-@include 'telemetry-metrics/vault/mysql/get.mdx'
-
-@include 'telemetry-metrics/vault/mysql/list.mdx'
-
-@include 'telemetry-metrics/vault/mysql/put.mdx'
-
-## PostgreSQL
-
-Metrics related to your PostgreSQL **storage backend**.
-
-@include 'telemetry-metrics/vault/postgres/delete.mdx'
-
-@include 'telemetry-metrics/vault/postgres/get.mdx'
-
-@include 'telemetry-metrics/vault/postgres/list.mdx'
-
-@include 'telemetry-metrics/vault/postgres/put.mdx'
\ No newline at end of file
diff --git a/website/content/docs/internals/telemetry/metrics/index.mdx b/website/content/docs/internals/telemetry/metrics/index.mdx
deleted file mode 100644
index 3b2476b00f1..00000000000
--- a/website/content/docs/internals/telemetry/metrics/index.mdx
+++ /dev/null
@@ -1,51 +0,0 @@
----
-layout: docs
-page_title: Metrics reference overview
-description: |-
-  Learn about how telemetry metrics are structured in Vault
----
-
-# Telemetry metrics overview 
-
-## Metric types
-
-Vault provides three types of telemetry metrics:
-
-- **Counter metrics** increment when an event occurs. Counters are cumulative
-  and reset at the end of reporting intervals. 
-- **Gauge metrics** provide measurements of current values.
-- **Summary metrics** provide observational values. Vault commonly uses
-  summaries to measure the time required to for a discrete event to complete.
-
-High-cardinality gauges, like `vault.kv.secret.count`, update at the interval
-configured with `usage_gauge_period` in the `telemetry` stanza. The default
-reporting interval for gauge metrics is 10 minutes.
-
-## Metric labels
-
-Some telemetry metrics come with additional metadata that provides context for
-the measurement. For example, a token metric might include the namespace it
-belongs to or the authentication method used to create it.
-
-Metric metadata is labeled and incorporated into the metric name for the
-in-memory telemetry and any other telemetry engine that does not support custom
-labels.
-
-The metric name in the table below is followed by a list of labels supported,
-in the order in which they appear, if flattened.
-
-
-| Label                  | Example                 | Description
-| ---------------------- | ----------------------- | ---------------------------
-| `auth_method`          | `userpass`              | Authorization engine type
-| `cluster`              | `vault-cluster-d54ad07` | Name of the cluster where the metric originated
-| `creation_ttl`         | `7d`                    | Time-to-live assigned at creation, rounded up to the next-highest bucket: `1m`, `10m`, `20m`, `1h`, `2h`, `1d`, `2d`, `7d`, `30d`, or `+Inf`
-| `mount_point`          | `auth/userpass/`        | Path at which an authentication method or secret engine is mounted
-| `name`                 | `memoryLimit`           | Name of the object being aggregated (for example, a quota or quota rule)
-| `namespace`            | `ns1`                   | A namespace path or `root` for the root namespace
-| `policy`               | `default`               | Name of the associated policy
-| `secret_engine`        | `aws`                   | Secrets engine type
-| `token_type`           | `service`               | Type of the associated token: `batch` or `service`
-| `peer_id`              | `node-1`                | Unique identifier of a raft peer node
-| `node_id`              | `node-42`               | Unique identifier of a raft peer node (duplicates `peer_id`)
-| `snapshot_config_name` | `config1`               | Name of the configuration used for automated snapshots
diff --git a/website/content/docs/internals/telemetry/metrics/policy.mdx b/website/content/docs/internals/telemetry/metrics/policy.mdx
deleted file mode 100644
index 242e3f84b50..00000000000
--- a/website/content/docs/internals/telemetry/metrics/policy.mdx
+++ /dev/null
@@ -1,21 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Policy metrics"
-description: >-
-  Technical reference for policy related telemetry values.
----
-
-# Policy telemetry
-
-Policy telemetry provides information on the time Vault spends on policy
-operations.
-
-## Default metrics
-
-@include 'telemetry-metrics/vault/policy/delete_policy.mdx'
-
-@include 'telemetry-metrics/vault/policy/get_policy.mdx'
-
-@include 'telemetry-metrics/vault/policy/list_policies.mdx'
-
-@include 'telemetry-metrics/vault/policy/set_policy.mdx'
\ No newline at end of file
diff --git a/website/content/docs/internals/telemetry/metrics/raft.mdx b/website/content/docs/internals/telemetry/metrics/raft.mdx
deleted file mode 100644
index 766c6c7a1ba..00000000000
--- a/website/content/docs/internals/telemetry/metrics/raft.mdx
+++ /dev/null
@@ -1,169 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Raft metrics"
-description: >-
-  Technical reference for integrated storage telemetry values.
----
-
-# Raft telemetry
-
-Raft telemetry provides information on 
-Vault [integrated storage](/vault/docs/configuration/storage/raft).
-
-## Default metrics
-
-@include 'telemetry-metrics/vault/raft/apply.mdx'
-
-@include 'telemetry-metrics/vault/raft/barrier.mdx'
-
-@include 'telemetry-metrics/vault/raft/candidate/electself.mdx'
-
-@include 'telemetry-metrics/vault/raft/commitnumlogs.mdx'
-
-@include 'telemetry-metrics/vault/raft/committime.mdx'
-
-@include 'telemetry-metrics/vault/raft/compactlogs.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/apply.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/applybatch.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/applybatchnum.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/enqueue.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/restore.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/snapshot.mdx'
-
-@include 'telemetry-metrics/vault/raft/fsm/store_config.mdx'
-
-@include 'telemetry-metrics/vault/raft/get.mdx'
-
-@include 'telemetry-metrics/vault/raft/list.mdx'
-
-@include 'telemetry-metrics/vault/raft/peers.mdx'
-
-@include 'telemetry-metrics/vault/raft/restore.mdx'
-
-@include 'telemetry-metrics/vault/raft/restoreusersnapshot.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/appendentries.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/appendentries/processlogs.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/appendentries/storelogs.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/installsnapshot.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/processheartbeat.mdx'
-
-@include 'telemetry-metrics/vault/raft/rpc/requestvote.mdx'
-
-@include 'telemetry-metrics/vault/raft/snapshot/create.mdx'
-
-@include 'telemetry-metrics/vault/raft/snapshot/persist.mdx'
-
-@include 'telemetry-metrics/vault/raft/snapshot/takesnapshot.mdx'
-
-@include 'telemetry-metrics/vault/raft/state/candidate.mdx'
-
-@include 'telemetry-metrics/vault/raft/state/follower.mdx'
-
-@include 'telemetry-metrics/vault/raft/state/leader.mdx'
-
-@include 'telemetry-metrics/vault/raft/transition/heartbeat_timeout.mdx'
-
-@include 'telemetry-metrics/vault/raft/transition/leader_lease_timeout.mdx'
-
-@include 'telemetry-metrics/vault/raft/verify_leader.mdx'
-
-## Autopilot metrics
-
-@include 'telemetry-metrics/raft-autopilot-note.mdx'
-
-@include 'telemetry-metrics/vault/autopilot/failure_tolerance.mdx'
-
-@include 'telemetry-metrics/vault/autopilot/healthy.mdx'
-
-@include 'telemetry-metrics/vault/autopilot/node/healthy.mdx'
-
-## Leadership change metrics
-
-@include 'telemetry-metrics/raft-leadership-intro.mdx'
-
-@include 'telemetry-metrics/vault/raft/leader/dispatchlog.mdx'
-
-@include 'telemetry-metrics/vault/raft/leader/dispatchnumlogs.mdx'
-
-@include 'telemetry-metrics/vault/raft/leader/lastcontact.mdx'
-
-## Raft replication metrics
-
-@include 'telemetry-metrics/vault/raft/replication/appendentries/log.mdx'
-
-@include 'telemetry-metrics/vault/raft/replication/appendentries/rpc.mdx'
-
-@include 'telemetry-metrics/vault/raft/replication/heartbeat.mdx'
-
-@include 'telemetry-metrics/vault/raft/replication/installsnapshot.mdx'
-
-## Storage metrics
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/cursor/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/freelist/allocated_bytes.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/freelist/free_pages.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/freelist/pending_pages.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/freelist/used_bytes.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/node/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/node/dereferences.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/page/bytes_allocated.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/page/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/rebalance/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/rebalance/time.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/spill/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/spill/time.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/split/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/transaction/currently_open_read_transactions.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/transaction/started_read_transactions.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/write/count.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/bolt/write/time.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/follower/applied_index_delta.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/follower/last_heartbeat_ms.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/stats/applied_index.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/stats/commit_index.mdx'
-
-@include 'telemetry-metrics/vault/raft_storage/stats/fsm_pending.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/delete.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/entry_size.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/get.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/list.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/put.mdx'
-
-@include 'telemetry-metrics/vault/raft-storage/transaction.mdx'
\ No newline at end of file
diff --git a/website/content/docs/internals/telemetry/metrics/secrets-sync.mdx b/website/content/docs/internals/telemetry/metrics/secrets-sync.mdx
deleted file mode 100644
index 7944c7fb66e..00000000000
--- a/website/content/docs/internals/telemetry/metrics/secrets-sync.mdx
+++ /dev/null
@@ -1,16 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Secrets Sync metrics"
-description: >-
-  Technical reference for secrets sync related telemetry values.
----
-
-# Secrets Sync telemetry
-
-Secrets Sync telemetry provides general information about configured sync resources and usage.
-
-## Default metrics
-
-@include 'telemetry-metrics/vault/secrets-sync/destinations.mdx'
-
-@include 'telemetry-metrics/vault/secrets-sync/associations.mdx'
diff --git a/website/content/docs/internals/telemetry/metrics/secrets.mdx b/website/content/docs/internals/telemetry/metrics/secrets.mdx
deleted file mode 100644
index 299f932fd99..00000000000
--- a/website/content/docs/internals/telemetry/metrics/secrets.mdx
+++ /dev/null
@@ -1,91 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Secrets metrics"
-description: >-
-  Technical reference for secrets telemetry values.
----
-
-# Secrets telemetry
-
-Secrets telemetry provides information about configured secrets engine
-operations.
-
-## Default metrics
-
-@include 'telemetry-metrics/vault/secret/kv/count.mdx'
-
-@include 'telemetry-metrics/vault/secret/lease/creation.mdx'
-
-## PKI metrics
-
-@include 'telemetry-metrics/secrets/pki/tidy/cert_store_current_entry.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/cert_store_deleted_count.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/cert_store_total_entries_remaining.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/cert_store_total_entries.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/duration.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/failure.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_current_entry.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_deleted_count.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_fixed_issuers.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_incorrect_issuers.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_remaining.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/start_time_epoch.mdx'
-
-@include 'telemetry-metrics/secrets/pki/tidy/success.mdx'
-
-## Secrets database metrics
-
-@include 'telemetry-metrics/secretsdb-intro.mdx'
-
-@include 'telemetry-metrics/database/close.mdx'
-
-@include 'telemetry-metrics/database/close/error.mdx'
-
-@include 'telemetry-metrics/database/createuser.mdx'
-
-@include 'telemetry-metrics/database/createuser/error.mdx'
-
-@include 'telemetry-metrics/database/initialize.mdx'
-
-@include 'telemetry-metrics/database/initialize/error.mdx'
-
-@include 'telemetry-metrics/database/name/close.mdx'
-
-@include 'telemetry-metrics/database/name/close/error.mdx'
-
-@include 'telemetry-metrics/database/name/createuser.mdx'
-
-@include 'telemetry-metrics/database/name/createuser/error.mdx'
-
-@include 'telemetry-metrics/database/name/initialize.mdx'
-
-@include 'telemetry-metrics/database/name/initialize/error.mdx'
-
-@include 'telemetry-metrics/database/name/renewuser.mdx'
-
-@include 'telemetry-metrics/database/name/renewuser/error.mdx'
-
-@include 'telemetry-metrics/database/name/revokeuser.mdx'
-
-@include 'telemetry-metrics/database/name/revokeuser/error.mdx'
-
-@include 'telemetry-metrics/database/renewuser.mdx'
-
-@include 'telemetry-metrics/database/renewuser/error.mdx'
-
-@include 'telemetry-metrics/database/revokeuser.mdx'
-
-@include 'telemetry-metrics/database/revokeuser/error.mdx'
diff --git a/website/content/docs/internals/telemetry/metrics/storage.mdx b/website/content/docs/internals/telemetry/metrics/storage.mdx
deleted file mode 100644
index 84539eb712e..00000000000
--- a/website/content/docs/internals/telemetry/metrics/storage.mdx
+++ /dev/null
@@ -1,196 +0,0 @@
----
-layout: docs
-page_title: "Telemetry reference: Storage plugin metrics"
-description: >-
-  Technical reference for individual storage plugin telemetry values.
----
-
-# Storage plugin telemetry
-
-Storage telemetry provides information on the health of Vault storage and your
-configured storage backends. For integrated storage metrics, refer to the
-[Raft telemetry](/vault/docs/internals/metrics/raft) metric list.
-
-## Barrier metrics
-
-@include 'telemetry-metrics/vault/barrier/delete.mdx'
-
-@include 'telemetry-metrics/vault/barrier/get.mdx'
-
-@include 'telemetry-metrics/vault/barrier/list.mdx'
-
-@include 'telemetry-metrics/vault/barrier/put.mdx'
-
-## Caching metrics
-
-@include 'telemetry-metrics/vault/cache/delete.mdx'
-
-@include 'telemetry-metrics/vault/cache/hit.mdx'
-
-@include 'telemetry-metrics/vault/cache/miss.mdx'
-
-@include 'telemetry-metrics/vault/cache/write.mdx'
-
-## Amazon S3 metrics
-
-@include 'telemetry-metrics/vault/s3/delete.mdx'
-
-@include 'telemetry-metrics/vault/s3/get.mdx'
-
-@include 'telemetry-metrics/vault/s3/list.mdx'
-
-@include 'telemetry-metrics/vault/s3/put.mdx'
-
-## Azure metrics
-
-@include 'telemetry-metrics/vault/azure/delete.mdx'
-
-@include 'telemetry-metrics/vault/azure/get.mdx'
-
-@include 'telemetry-metrics/vault/azure/list.mdx'
-
-@include 'telemetry-metrics/vault/azure/put.mdx'
-
-## Cassandra metrics
-
-@include 'telemetry-metrics/vault/cassandra/delete.mdx'
-
-@include 'telemetry-metrics/vault/cassandra/get.mdx'
-
-@include 'telemetry-metrics/vault/cassandra/list.mdx'
-
-@include 'telemetry-metrics/vault/cassandra/put.mdx'
-
-## Cockroach database metrics
-
-@include 'telemetry-metrics/vault/cockroachdb/delete.mdx'
-
-@include 'telemetry-metrics/vault/cockroachdb/get.mdx'
-
-@include 'telemetry-metrics/vault/cockroachdb/list.mdx'
-
-@include 'telemetry-metrics/vault/cockroachdb/put.mdx'
-
-## Consul metrics
-
-@include 'telemetry-metrics/vault/consul/delete.mdx'
-
-@include 'telemetry-metrics/vault/consul/get.mdx'
-
-@include 'telemetry-metrics/vault/consul/list.mdx'
-
-@include 'telemetry-metrics/vault/consul/put.mdx'
-
-@include 'telemetry-metrics/vault/consul/transaction.mdx'
-
-## Couch database metrics
-
-@include 'telemetry-metrics/vault/couchdb/delete.mdx'
-
-@include 'telemetry-metrics/vault/couchdb/get.mdx'
-
-@include 'telemetry-metrics/vault/couchdb/list.mdx'
-
-@include 'telemetry-metrics/vault/couchdb/put.mdx'
-
-## Dynamo database metrics
-
-@include 'telemetry-metrics/vault/dynamodb/delete.mdx'
-
-@include 'telemetry-metrics/vault/dynamodb/get.mdx'
-
-@include 'telemetry-metrics/vault/dynamodb/list.mdx'
-
-@include 'telemetry-metrics/vault/dynamodb/put.mdx'
-
-## Etcd metrics
-
-@include 'telemetry-metrics/vault/etcd/delete.mdx'
-
-@include 'telemetry-metrics/vault/etcd/get.mdx'
-
-@include 'telemetry-metrics/vault/etcd/list.mdx'
-
-@include 'telemetry-metrics/vault/etcd/put.mdx'
-
-## Google Cloud metrics
-
-@include 'telemetry-metrics/vault/gcs/delete.mdx'
-
-@include 'telemetry-metrics/vault/gcs/get.mdx'
-
-@include 'telemetry-metrics/vault/gcs/list.mdx'
-
-@include 'telemetry-metrics/vault/gcs/lock/lock.mdx'
-
-@include 'telemetry-metrics/vault/gcs/lock/unlock.mdx'
-
-@include 'telemetry-metrics/vault/gcs/lock/value.mdx'
-
-@include 'telemetry-metrics/vault/gcs/put.mdx'
-
-## Google Cloud - Spanner metrics
-
-@include 'telemetry-metrics/vault/spanner/delete.mdx'
-
-@include 'telemetry-metrics/vault/spanner/get.mdx'
-
-@include 'telemetry-metrics/vault/spanner/list.mdx'
-
-@include 'telemetry-metrics/vault/spanner/lock/lock.mdx'
-
-@include 'telemetry-metrics/vault/spanner/lock/unlock.mdx'
-
-@include 'telemetry-metrics/vault/spanner/lock/value.mdx'
-
-@include 'telemetry-metrics/vault/spanner/put.mdx'
-
-## Microsoft SQL Server (MSSQL) metrics
-
-@include 'telemetry-metrics/vault/mssql/delete.mdx'
-
-@include 'telemetry-metrics/vault/mssql/get.mdx'
-
-@include 'telemetry-metrics/vault/mssql/list.mdx'
-
-@include 'telemetry-metrics/vault/mssql/put.mdx'
-
-## MySQL metrics
-
-@include 'telemetry-metrics/vault/mysql/delete.mdx'
-
-@include 'telemetry-metrics/vault/mysql/get.mdx'
-
-@include 'telemetry-metrics/vault/mysql/list.mdx'
-
-@include 'telemetry-metrics/vault/mysql/put.mdx'
-
-## PostgreSQL metrics
-
-@include 'telemetry-metrics/vault/postgres/delete.mdx'
-
-@include 'telemetry-metrics/vault/postgres/get.mdx'
-
-@include 'telemetry-metrics/vault/postgres/list.mdx'
-
-@include 'telemetry-metrics/vault/postgres/put.mdx'
-
-## Swift metrics
-
-@include 'telemetry-metrics/vault/swift/delete.mdx'
-
-@include 'telemetry-metrics/vault/swift/get.mdx'
-
-@include 'telemetry-metrics/vault/swift/list.mdx'
-
-@include 'telemetry-metrics/vault/swift/put.mdx'
-
-## ZooKeeper metrics
-
-@include 'telemetry-metrics/vault/zookeeper/delete.mdx'
-
-@include 'telemetry-metrics/vault/zookeeper/get.mdx'
-
-@include 'telemetry-metrics/vault/zookeeper/list.mdx'
-
-@include 'telemetry-metrics/vault/zookeeper/put.mdx'
\ No newline at end of file
diff --git a/website/content/docs/internals/token.mdx b/website/content/docs/internals/token.mdx
deleted file mode 100644
index efa0796662c..00000000000
--- a/website/content/docs/internals/token.mdx
+++ /dev/null
@@ -1,51 +0,0 @@
----
-layout: docs
-page_title: Token Authentication
-description: Learn about the client token authentication in Vault.
----
-
-# Token authentication
-
-The `token` auth method is built-in and is at the core of
-client authentication. Other auth methods may be used to
-authenticate a client, but they eventually result in the generation of a client
-token managed by the `token` backend.
-
-Every token has a number of properties:
-
-- ID - The primary ID of a token is a randomly generated value
-- Display Name - Optionally, a human readable display name
-- Metadata - Metadata used for audit logging
-- Number of Uses - Optionally, a restricted use count
-- Parent ID - Optionally, a parent token which created this child token
-- Policies - An associated list of ACL policies
-- Source Path - The path at which the token was generated (e.g. `auth/github/login`)
-
-The properties of a token are immutable once created. The exception to this
-is the number of uses, which is decremented on each request. Each of these
-properties enable Vault to do a number of interesting things.
-
-Each token maintains the source path, or the login path, that was used
-to create the token. This is used to allow source based revocation. For example,
-if we believe our GitHub organization was compromised, we may want to revoke
-all tokens generated via `auth/github/login`. This would be done by using the
-`sys/revoke-prefix/` API with the `auth/github/` prefix. Revoking the
-prefix will revoke all client tokens generated at that path, as well as all
-dynamic secrets generated by those tokens. This provides a powerful "break glass"
-procedure during a potential compromise.
-
-If a token is created by another auth method, they do not have
-a parent token. However, any tokens created by the `auth/token/create` API
-have a parent token, namely the token used to make that request. By maintaining
-this parent-child relationship, Vault models token trees. Child tokens can
-be created with a subset of the parent policies, allowing for dropping of
-privileges. When a token is revoked, the entire sub-tree of tokens is revoked
-with it. This allows clients to safely generate child tokens and then revoke
-them all along with the root.
-
-Child tokens are very useful, especially when combined with limited use tokens.
-When a token is created, its use count can be optionally specified. Providing
-a use count of one makes a _one time token_. This means the token can be used
-for a single request before being automatically revoked. This can be generalized
-to any number of uses. Limited use tokens cannot be used to create sub-tokens,
-but they can be a powerful way to allow extremely limited access to Vault.
diff --git a/website/content/docs/interoperability-matrix.mdx b/website/content/docs/interoperability-matrix.mdx
deleted file mode 100644
index 47c4e42913e..00000000000
--- a/website/content/docs/interoperability-matrix.mdx
+++ /dev/null
@@ -1,95 +0,0 @@
----
-layout: docs
-page_title: Vault Interoperability Matrix
-description: Guide to viewing which partners Vault integrates with.
----
-
-# Vault interoperability matrix
-
-Vault integrates with various appliances, platforms and applications for different use cases. Below are two tables indicating the partner’s product that has been verified to work with Vault for [Auto Unsealing](/vault/docs/concepts/seal#auto-unseal) / [HSM Support](/vault/docs/enterprise/hsm) and [External Key Management](https://www.vaultproject.io/use-cases/key-management).
-
-Auto Unseal and HSM Support was developed to aid in reducing the operational complexity of keeping the unseal key secure. This feature delegates the responsibility of securing the unseal key from users to a trusted device or service. At startup Vault will connect to the device or service implementing the seal and ask it to decrypt the root key Vault read from storage.
-
-Vault centrally manages and automates encryption keys across environments allowing customers to control their own encryption keys used in third party services or products.
-
-## Vault seal and HSM interoperability
-
-The below table shows the partner product and if the partner’s technology works with each individual seal component.
-
-| Partner           | Product                                | Auto Unseal <br/> (Vault 0.9+)  | Entropy Augmentation <br/>(Vault 1.3+) | Seal Wrap  <br/>(Vault 0.9+)   | Managed Keys  <br/> (Vault 1.10+) | Min. Vault Version Verified |
-| ----------------- | -------------------------------------- | ------------ | -------------------- | ------------ |-------------- | --------------------------- |
-| AliCloud          | AliCloud KMS                           | Yes          | No                   | Yes          | No            | 0.11.2                      |
-| Atos              | Trustway Proteccio HSM                 | Yes          | Yes                  | Yes          | No            | 1.9                         |
-| AWS               | AWS KMS                                | Yes          | Yes                  | Yes          | Yes           | 0.9                         |
-| Crypto4a          | QxEDGE™️ HSP                            | Yes          | Yes                  | Yes          | Yes           | 1.9                         |
-| Entrust           | nShield HSM                            | Yes          | Yes                  | Yes          | Yes           | 1.3                         |
-| Fortanix          | FX2200 Series                          | Yes          | Yes                  | Yes          | No            | 0.10                        |
-| FutureX           | Vectera Plus, KMES Series 3            | Yes          | Yes                  | Yes          | Yes           | 1.5                         |
-| FutureX           | VirtuCrypt cloud HSM                   | Yes          | Yes                  | Yes          | Yes           | 1.5                         |
-| Google            | GCP Cloud KMS                          | Yes          | No                   | Yes          | Yes           | 0.9                         |
-| Marvell           | Cavium HSM                             | Yes          | Yes                  | Yes          | Yes           | 1.11                        |
-| Microsoft         | Azure Key Vault                        | Yes          | No                   | Yes          | Yes           | 0.10.2                      |
-| Oracle            | OCI KMS                                | Yes          | No                   | Yes          | No            | 1.2.3                       |
-| PrimeKey          | SignServer Hardware Appliance          | Yes          | Yes                  | Yes          | No            | 1.6                         |
-| Qrypt             | Quantum Entropy Service                | No           | Yes                  | No           | No            | 1.11                        |
-| Quintessence Labs | TSF  400                               | Yes          | Yes                  | Yes          | No            | 1.4                         |
-| Securosys SA      | Primus HSM                             | Yes          | Yes                  | Yes          | Yes           | 1.7                         |
-| Thales            | Luna HSM                               | Yes          | Yes                  | Yes          | Yes           | 1.4                         |
-| Thales            | Luna TCT HSM                           | Yes          | Yes                  | Yes          | Yes           | 1.4                         |   
-| Thales            | CipherTrust Manager                    | Yes          | Yes                  | Yes          | No            | 1.7                         |
-| Utimaco           | HSM                                    | Yes          | Yes                  | Yes          | Yes           | 1.4                         |
-| Yubico            | YubiHSM 2                              | Yes          | Yes                  | Yes          | No            | 1.5                         |
-<span style={{display:'block', textAlign:'right', fontSize:'12px'}}><em>Last Updated May 03, 2023</em></span>
-
-## Vault as an external key management system (EKMS)
-
-Partners who integrate with Vault to have Vault store and/or manage encryption keys with their products
-
-~> Note: HCP Vault Verified means that the integration has been verified to work with HCP Vault. All integrations have been verified with Vault self-managed.
-
-<span style={{fontSize:'12px'}}>
-Vault Secrets Engine Key: EKM Provider = <a href="/docs/platform/mssql">Vault EKM provider for SQL server</a>; KV = <a href="/docs/secrets/kv">KV secrets engine</a>; KMSE = <a href="/docs/secrets/key-management">Key Management Secrets Engine</a>; KMIP = <a href="/docs/secrets/kmip">KMIP Secrets Engine</a>; PKCS#11 = <a href="/docs/enterprise/pkcs11-provider">PKCS#11 Provider</a>; Transit = <a href="/docs/secrets/transit">Transit Secrets Engine</a>
-</span>
-
-| Partner           | Product                  | Vault Secrets Engine | Min. Vault Version Verified | HCP Vault Verified |
-| ----------------- | ------------------------ | -------------------- | --------------------------- | ------------------- |
-| AWS               | AWS KMS                  | KMSE                 | 1.8                         | Yes                 |
-| Baffle            | Shield                   | KV                  | 1.3                         | No                  |
-| Bloombase         | StoreSafe                | KMIP                 | 1.9                         | N/A                 |
-| Cloudian          | HyperStore 7.5.1         | KMIP                 | 1.12                        | N/A                 |
-| Cockroach Labs    | Cockroach Cloud DB       | KMSE                 | 1.10                        | N/A                 |
-| Cockroach Labs    | Cockroach DB             | Transit              | 1.10                        | Yes                 |
-| Commvault Systems | CommVault                | KMIP                 | 1.9                         | N/A                 |
-| Cribl             | Cribl Stream             | KV                  | 1.8                         | Yes                 |
-| DataStax          | DataStax Enterprise      | KMIP                 | 1.11                        | Yes                 |
-| Dell              | PowerMax                 | KMIP                 | 1.12.1                      | N/A                 |
-| EnterpriseDB      | Postgres Advanced Server | KMIP                 | 1.12.6                      | N/A                 |
-| Garantir          | GaraSign                 | Transit              | 1.5                         | Yes                 |
-| Google            | Google KMS               | KMSE                 | 1.9                         | N/A                 |
-| HPE               | Exmeral Data Fabric      | KMIP                 | 1.2                         | N/A                 |
-| Intel             | Key Broker Service       | KMIP                 | 1.11                        | N/A                 |
-| JumpWire          | JumpWire                 | KV                  | 1.12                        | Yes                 |
-| Micro Focus       | Connected Mx             | Transit              | 1.7                         | No                  |
-| Microsoft         | Azure Key Vault          | KMSE                 | 1.6                         | N/A                 |
-| Microsoft         | MSSSQL                   | EKM Provider         | 1.9                         | No                  |
-| MinIO             | Key Encryption Service   | KV                  | 1.11                        | No                  |
-| MongoDB           | Atlas                    | KMSE                 | 1.6                         | N/A                 |
-| MongoDB           | MongoDB Enterprise       | KMIP                 | 1.2                         | N/A                 |
-| MongoDB           | Client Libraries         | KMIP                 | 1.9                         | N/A                 |
-| NetApp            | ONTAP                    | KMIP                 | 1.2                         | N/A                 |
-| NetApp            | StorageGrid              | KMIP                 | 1.2                         | N/A                 |
-| Nutanix           | AHV/AOS 6.5.1.6          | KMIP                 | 1.12                        | N/A                 |
-| Ondat             | Trousseau                | Transit              | 1.9                         | Yes                 |
-| Oracle            | MySQL                    | KMIP                 | 1.2                         | N/A                 |
-| Oracle            | Oracle 19c               | PKCS#11              | 1.11                        | N/A                 |
-| Percona           | Server 8.0               | KMIP                 | 1.9                         | N/A                 |
-| Percona           | XtraBackup 8.0           | KMIP                 | 1.9                         | N/A                 |
-| Snowflake         | Snowflake                | KMSE                 | 1.6                         | N/A                 |
-| VMware            | vSphere 7.0, 8.0         | KMIP                 | 1.2                         | N/A                 |
-| VMware            | vSan 7.0, 8.0            | KMIP                 | 1.2                         | N/A                 |
-| Yugabyte          | Yugabyte Platform        | Transit              | 1.9                         | No                  |
-<span style={{display:'block', textAlign:'right', fontSize:'12px'}}><em>Last Updated August 25, 2023</em></span>
-
-Please reach out to [technologypartners@hashicorp.com](mailto:technologypartners@hashicorp.com) if there are any questions on the above tables. 
-
-Missing an integration? Join the [Vault Integration Program](/vault/docs/partnerships) and get the integration listed.
diff --git a/website/content/docs/partnerships.mdx b/website/content/docs/partnerships.mdx
deleted file mode 100644
index a7d66d51c97..00000000000
--- a/website/content/docs/partnerships.mdx
+++ /dev/null
@@ -1,187 +0,0 @@
----
-layout: docs
-page_title: Vault Integration Program
-description: Guide to partnership integrations and creating plugins for Vault.
----
-
-# Vault integration program
-
-The HashiCorp Vault Integration Program allows for partners to integrate their products to work with HashiCorp Vault (Open Source or Enterprise versions) or [HashiCorp Cloud Platform](https://cloud.hashicorp.com/) (HCP) Vault. Vault covers a relatively large surface area and thereby a large set of possible integrations, some of which require the partner to build a Vault plugin or an integration that results in the partner’s solution working tightly with Vault.
-
-Partners integrating their solutions via the Vault Integration Process provide their customers a verified and seamless user experience.
-
-This program is intended to be largely a self-service process with links and guidance to information sources, clearly defined steps, and checkpoints.
-
-## Types of Vault integrations
-
-Vault is an Identity-based security solution that leverages trusted sources of identity to keep secrets and application data secured with one centralized, audited workflow for tightly controlling access to secrets across applications, systems, and infrastructure while encrypting data both in flight and at rest. For a full description of the current features please refer to the Vault [website](/).
-
-There are two main types of integrations with Vault. The first is Runtime Integrations which use Vault as part of a workflow. Many partners have integrations that use existing Vault deployments to retrieve various types of secrets for use in a partner’s application or platform. The use cases can range from Vault storing and providing secrets, issuing or managing PKI certificates or acting as an external key management system.
-
-The second type is where a partner develops a custom plugin. Vault has a secure [plugin](/vault/docs/plugins) architecture. Vault’s plugins are completely separate, standalone applications that Vault executes and communicates with over RPC.
-
-Plugins can be broken into two categories, Secrets Engines and Auth Methods. They can be built-in and bundled with the Vault binary, or be external that has to be manually registered. Built-in plugins are developed by HashiCorp, while external plugins can be developed by HashiCorp, technology partners, or the community. There is a curated collection of all plugins, both built-in and external, located on the [Vault Integrations](/vault/integrations) page.
-
-The diagram below depicts the key Vault integration categories and types.
-
-![Integration Categories](/img/integration-program-vaulteco.png)
-
-Main Vault categories for partners to integrate with include:
-
-**Authentication Methods**: Authentication (or Auth) methods are plugin components in Vault that perform authentication and are responsible for assigning identity along with a set of policies to a user. Vault supports multiple auth methods/identity models and partners can build a plugin that allows Vault to authenticate against the partners’ platform. You can find more information about Vault Auth Methods [here](/vault/docs/auth/).
-
-**Runtime Integrations**: These types of integrations include integrations developed by partners that work with existing deployments of Vault and the partner’s product as part of the customer's identity/security workflow.
-
-Oftentimes these integrations involve modifying a partner’s product to become “Vault aware”. There are two main components that need to be considered for this type of integration:
-1. How is the application going to authenticate itself to Vault?
-1. Support of Namespaces
-
-There are many ways for an application to authenticate itself to Vault (see [Auth Methods](/vault/docs/auth/)), but we recommend partners use one of the following methods: [AppRole](/vault/docs/auth/approle), [JWT / OIDC](/vault/docs/auth/jwt), [TLS Certificates](/vault/docs/auth/cert) or [Username / Password](/vault/docs/auth/userpass). For an integration to be verified as production ready by HashiCorp, there needs to be at least one other Auth method supported besides [Token](/vault/docs/auth/token). Token is not recommended for use in production since it involves creating a manual long lived token (which is against best practice and poses a security risk). Using one of the above mentioned auth methods automatically creates short lived tokens and eliminates the need to manually generate a new token on a regular basis.
-
-As the number of customers using Vault Enterprise increases, partners are encouraged to support [Namespaces](/vault/tutorials/enterprise/namespaces). By supporting Namespaces, there is an additional benefit that an integration should be able to work with HCP Vault.
-
-HSM (Hardware Security Module) are specific types of runtime integrations and can be configured to work with new or existing Vault deployments. They provide an added level of security and compliance. The HSM communicates with Vault using the PKCS#11 protocol thereby resulting in the integration to primarily involve verification of the operation of the functionality. You can find more information about Vault’s HSM support [here](/vault/docs/enterprise/hsm). A list of HSMs that have been verified to work with Vault is shown in our [interoperability matrix](/vault/docs/interoperability-matrix).
-
-**Audit/Monitoring & Compliance**: Audit/Monitoring and Compliance are components in Vault that keep a detailed log of all requests and responses to Vault. Because every operation with Vault is an API request/response, the audit log contains every authenticated interaction with Vault, including errors. Vault supports multiple audit devices to support your business use case. You can find more information about Vault Audit Devices [here](/vault/docs/audit/).
-
-**Secrets Engines**: Secrets engines are plugin components which store, generate, or encrypt data. Secrets engines are provided with some set of data, that take some action on that data, and then return a result. Some secrets engines store and read data, like encrypted in-memory data structure, other secrets engines connect to other services. Examples of Secrets Engines include identity modules of Cloud providers like AWS, Azure IAM models, Cloud (LDAP), database or certificate management. You can find more information about Vault Secrets Engines [here](/vault/docs/secrets/).
-
--> **Note:** Integrations related Vault’s [storage](/vault/docs/concepts/storage) backend, [auto auth](/vault/docs/agent-and-proxy/autoauth), and [auto unseal](/vault/docs/concepts/seal#auto-unseal) functionality are not encouraged. Please reach out to [technologypartners@hashicorp.com](mailto:technologypartners@hashicorp.com) for any questions related to this.
-
-### HCP Vault
-
-HCP Vault is a managed version of Vault which is operated by HashiCorp to allow customers to quickly get up and running. HCP Vault uses the same binary as self-managed Vault Enterprise, and offers a consistent user experience. You can use the same Vault clients to communicate with HCP Vault as you use to communicate with Vault. Most runtime integrations can be verified with HCP Vault.
-
-Sign up for HCP Vault [here](https://portal.cloud.hashicorp.com/) and check out [this](/vault/tutorials/cloud) learn guide for quickly getting started.
-
-### Vault integration badges
-
-There are two types of badges that partners could receive: Vault Enterprise Verified and HCP Vault Verified badges. Partners will be issued the Vault Enterprise badge for integrations that work with Vault Enterprise features such as namespaces, HSM support, or key management. Partners will be issued the HCP Vault badge once their integration has been verified to work with HCP Vault. The badge(s) would be displayed on their partner page (example: [MongoDB](https://www.hashicorp.com/partners/tech/mongodb#vault) and can also be used on their own website to help provide better visibility and differentiation to customers. The process for verification of these integrations is detailed below.
-
-<span style={{display:'block', textAlign:'center'}}>
-<ImageConfig inline height={200} width={200}>
-
-![Vault Enterprise Badge](/img/VaultEnterprise_badge.png)
-
-</ImageConfig>
-<ImageConfig inline height={200} width={200}>
-
-![HCP Vault](/img/HCPV_badge.png)
-
-</ImageConfig>
-</span>
-
-## Development process
-
-The Vault integration development process is divided into six steps. By following these steps, Vault integrations can be developed alongside HashiCorp to ensure that the integrations are able to be verified and supported in Vault as quickly as possible. A visual representation of the self-guided steps is depicted below.
-
-![Development Process](/img/integration-program-devprocess.png)
-
-1. Engage: Initial contact between vendor and HashiCorp
-1. Enable: Information and articles to aid with the development of the integration
-1. Develop and Test: Integration development and testing process
-1. Review: HashiCorp verification of integration (iterative process)
-1. Release: Verified integration made available and listed on the HashiCorp website once the HashiCorp technology partnership agreement has been executed
-1. Support: Ongoing maintenance and support of the integration by the partner.
-
-### 1. engage
-
-Please begin by providing some basic information about the integration that is being built via a simple [webform](https://docs.google.com/forms/d/e/1FAIpQLSfQL1uj-mL59bd2EyCPI31LT9uvVT-xKyoHAb5FKIwWwwJ1qQ/viewform).
-
-This information is recorded and used by HashiCorp to track the integration through various stages. The information is also used to notify the integration developer of any overlapping work, perhaps coming from the community so you may better focus resources.
-
-Vault has a large and active community and ecosystem of partners that may have already started working on a similar integration. We'll do our best to connect similar parties to avoid duplicate work.
-
-### 2. enable
-
-While not mandatory, HashiCorp encourages partners to sign an MNDA (Mutual Non-Disclosure Agreement) to allow for open dialog and sharing of ideas during the integration process.
-
-In an effort to support our self-serve model, we’ve included links to resources, documentation, examples and best practices to guide you through the Vault integration development and testing process.
-
-- [Vault Tutorial and Learn Site](/vault/tutorials)
-- Sample development implemented by a [partner](https://www.hashicorp.com/integrations/venafi/vault/)
-- Example runtime integrations for reference: [F5](https://www.hashicorp.com/integrations/f5/vault), [ServiceNow](https://www.hashicorp.com/integrations/servicenow/vault)
-- [Vault Community Forum](https://discuss.hashicorp.com/c/vault)
-
-We encourage partners to closely follow the above guidance. Adopting the same structure and coding patterns helps expedite the review and release cycles.
-
-### 3. develop and test
-
-For our partners who are building runtime integrations with Vault, we encourage them to support multiple [authentication](/vault/docs/auth) methods (e.g. Approle, JWT, K8s) besides tokens. Additionally we encourage them to add as much flexibility when specifying paths for secrets engines. For our partners who want to build a plugin, the only knowledge necessary to write a plugin is basic command-line skills and knowledge of the Go programming language. When writing in Go-Language, HashiCorp has found the integration development process to be straightforward and simple when partners pay close attention and follow the resources by adopting the same structure and coding patterns to help expedite the review and release cycles.
-
-Please remember that all integrations should have the appropriate documentation to assist Vault users in configuring the integrations.
-
-**Auth Methods**
-
-- [Auth Methods documentation](/vault/docs/auth)
-- [Example of how to build, install, and maintain auth method plugins plugin](https://www.hashicorp.com/blog/building-a-vault-secure-plugin)
-- [Sample plugin code](https://github.com/hashicorp/vault-auth-plugin-example)
-
-**Runtime Integration**
-
-- [Vault Tutorial and Learn Site](/vault/tutorials)
-- [Auth Methods documentation](/vault/docs/auth)
-- [HSM documentation](/vault/docs/enterprise/hsm)
-- [HSM Configuration information](/vault/docs/configuration/seal/pkcs11)
-
-**Audit, Monitoring & Compliance Integration**
-
-- [Audit devices documentation](/vault/docs/audit)
-
-**Secrets Engine Integration**
-
-- [Secret engine documentation](/vault/docs/secrets)
-- [Custom Secrets Engines | Vault - HashiCorp Learn](/vault/tutorials/custom-secrets-engine)
-
-**HCP Vault**
-
-The process to spin up a testing instance of HCP Vault is very [straightforward](/vault/tutorials/cloud/get-started-vault). HCP has been designed as a turn-key managed service so configuration is minimal. Furthermore, HashiCorp provides all new users an initial credit which lasts for a couple of months when using the [development](https://cloud.hashicorp.com/products/vault/pricing) cluster. Used in conjunction with AWS free tier resources, there should be no cost beyond the time spent by the designated tester.
-
-There are a couple of items to consider when determining if the integration will work with HCP Vault.
-
-- Since HCP Vault is running Vault Enterprise, the integration will need to be aware of [Namespaces](/vault/tutorials/enterprise/namespaces). This is important as the main namespace in HCP Vault is called 'admin' which is different from the standard ‘root’ namespace in a self managed Vault instance. If the integration currently doesn't support namespaces, then an additional benefit of adding Namespace support iis that this will also enable it to work with all self managed Vault Enterprise installations.
-- HCP Vault is currently only deployed on AWS and so the partner’s application should be able to be deployed or run in AWS. This is vital so that HCP Vault is able to communicate with the application using a [private peered](/hcp/tutorials/networking/amazon-peering-hcp) connection via a [HashiCorp Virtual Network](/hcp/docs/hcp/network).
-
-Additional resources:
-
-- [HCP Sign up](/hcp/docs/hcp/network)
-- [Namespaces - Vault Enterprise](/vault/docs/enterprise/namespaces)
-- [Create a Vault Cluster on HCP | HashiCorp Learn](/vault/tutorials/cloud/get-started-vault)
-
-### 4. review
-
-During the review process, HashiCorp will provide feedback on the newly developed integration for both Vault and HCP Vault. This is an important step to allow HashiCorp to review and verify your Vault integration. Please reach out to [technologypartners@hashicorp.com](mailto:technologypartners@hashicorp.com) for verification.
-
-The review process can take some time to complete and may require some iterations through the code to address any problems identified by the HashiCorp team.
-
-Once the integration has been verified, the partner is requested to sign the HashiCorp Technology Partner Agreement to have their integration listed on the HashiCorp website upon release.
-
-### 5. release
-
-At this stage, it is expected that the integration is fully complete, the necessary documentation has been written, and HashiCorp has reviewed the integration.
-
-For Auth or Secret Engine plugins specifically, once the plugin has been verified by HashiCorp, it is recommended the plugin be hosted on Github so it can more easily be downloaded and installed within Vault. We also encourage partners to list their plugin on the [Vault Integrations](/vault/integrations) page. This is in addition to the listing of the plugin on the technology partners’ dedicated HashiCorp partner page. To have the plugin listed on the portal page, please do a pull request via the “edit in GitHub” link on the bottom of the page and add the plugin in the partner section.
-
-For HCP Vault verifications, the partner will be issued an HCP Vault Verified badge and will have this displayed on their partner page.
-
-### 6. support
-
-At HashiCorp, we view the release step as the beginning of the journey. Getting the integration built is just the first step in enabling users to leverage it against their infrastructure. Once development is completed, on-going effort is required to support the developed integration and address any issues in a timely manner.
-
-The expectation from the partner is to create a mechanism to track and resolve all critical issues within 48 hours, and all other issues within 5 business days. This is a requirement given the critical nature of Vault to customers’ operations. Partners who choose to not support their integration will not be considered a verified integration and cannot be listed on the website.
-
-## Checklist
-
-Below is a checklist of steps that should be followed during the Vault integration development process. This reiterates the steps described above.
-
-- Fill out the [Vault Integration webform](https://docs.google.com/forms/d/e/1FAIpQLSfQL1uj-mL59bd2EyCPI31LT9uvVT-xKyoHAb5FKIwWwwJ1qQ/viewform).
-- Develop and test Vault integration along with the documentation, send to [technologypartners@hashicorp.com](mailto:technologypartners@hashicorp.com), to schedule an initial review.
-- Address review feedback and finalize the development process.
-- Provide HashiCorp with credentials for underlying infrastructure for test purposes.
-- Demo the integration.
-- Execute HashiCorp Partner Agreement Documents, review logo guidelines, partner listing and more.
-- Plan to continue supporting the integration with additional functionality and responding to customer issues
-
-## Contact us
-
-For any questions or feedback, please contact us at: [technologypartners@hashicorp.com](mailto:technologypartners@hashicorp.com)
diff --git a/website/content/docs/platform/aws/index.mdx b/website/content/docs/platform/aws/index.mdx
deleted file mode 100644
index ec18f0ffca7..00000000000
--- a/website/content/docs/platform/aws/index.mdx
+++ /dev/null
@@ -1,23 +0,0 @@
----
-layout: docs
-page_title: AWS Marketplace
-description: >-
-  This section documents the official AWS Marketplace AMIs for Vault Open Source
-  and Vault Enterprise.
----
-
-# AWS marketplace
-
-Vault can be deployed onto Amazon Web Services (AWS) using HashiCorp’s official AWS Marketplace offerings. HashiCorp packages the latest version of both Vault Open Source and Vault Enterprise as Amazon Machine Images (AMIs).
-
-There are two varieties of Vault AMIs available through the AWS Marketplace. Vault Open Source is available as a public listing and can be subscribed to using the standard process for the AWS Marketplace. Vault Enterprise is also available through the AWS Marketplace. To learn more about consuming Vault Enterprise through the AWS Marketplace, please reach out to our sales team at the following address: <aws-marketplace@hashicorp.com>
-
-The AWS Marketplace listings can be found below.
-
-- [HashiCorp Vault](http://aws.amazon.com/marketplace/pp/B07YLYPLYB)
-
-## Use cases
-
-The Vault AMIs listed in the AWS Marketplace are intended to serve as an easy starting point for a Vault installation. Vault AMIs are built on top of a minimal Ubuntu distribution and contain up to date packages for both Vault and the underlying operating system dependencies.
-
-The Open Source Vault AMI is intended for development and test use cases. This listing will launch a non-HA Vault instance with Vault running and the Vault UI available. For production use cases, please see the [Architecture](/vault/docs/platform/aws/run#architecture) section of this documentation.
diff --git a/website/content/docs/platform/aws/lambda-extension.mdx b/website/content/docs/platform/aws/lambda-extension.mdx
deleted file mode 100644
index 3702c96aaa5..00000000000
--- a/website/content/docs/platform/aws/lambda-extension.mdx
+++ /dev/null
@@ -1,319 +0,0 @@
----
-layout: docs
-page_title: Vault Lambda Extension
-description: >-
-  The Vault Lambda Extension allows a Lambda function to read secrets from a Vault deployment.
----
-
-# Vault lambda extension
-
-AWS Lambda lets you run code without provisioning and managing servers.
-The [Vault Lambda Extension](https://github.com/hashicorp/vault-lambda-extension) utilizes the AWS Lambda Extensions API to help your Lambda function read secrets from your Vault deployment.
-You can use the [quick-start](https://github.com/hashicorp/vault-lambda-extension/tree/main/quick-start) directory which has an end-to-end example if you would like to try out the extension from scratch.
-
-~> **Note**: If you decide to create one from scratch, be aware that this will create real infrastructure with an associated cost as per AWS' pricing.
-
-## Usage
-
-To use the extension, include one of the following ARNs as a layer in your
-Lambda function, depending on your desired architecture.
-
-amd64 (x86_64):
-```text
-arn:aws:lambda:<your-region>:634166935893:layer:vault-lambda-extension:18
-```
-
-arm64:
-```text
-arn:aws:lambda:<your-region>:634166935893:layer:vault-lambda-extension-arm64:6
-```
-
-Where region may be any of `af-south-1`, `ap-east-1`, `ap-northeast-1`,
-`ap-northeast-2`, `ap-northeast-3`, `ap-south-1`, `ap-south-2`, `ap-southeast-1`,
-`ap-southeast-2`, `ca-central-1`, `eu-central-1`, `eu-north-1`, `eu-south-1`,
-`eu-west-1`, `eu-west-2`, `eu-west-3`, `me-south-1`, `sa-east-1`, `us-east-1`,
-`us-east-2`, `us-west-1`, `us-west-2`.
-
-The extension authenticates with Vault using [AWS IAM auth](/vault/docs/auth/aws),
-and all configuration is supplied via environment variables. There are two methods
-to read secrets, which can both be used side-by-side:
-
-- **Recommended**: Make unauthenticated requests to the extension's local proxy
-  server at `http://127.0.0.1:8200`, which will add an authentication header and
-  proxy to the configured `VAULT_ADDR`. Responses from Vault are returned without
-  modification.
-- Configure environment variables such as `VAULT_SECRET_PATH` for the extension
-  to read a secret and write it to disk.
-
-### Adding the extension to your existing lambda and Vault infrastructure
-
-#### Requirements
-
-- ARN of the role your Lambda runs as
-- An instance of Vault accessible from AWS Lambda
-- An authenticated `vault` client
-- A secret in Vault that you want your Lambda to access, and a policy giving read access to it
-- Your Lambda function must use one of the [supported runtimes](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-extensions-api.html) for extensions
-
-#### Step 1. configure Vault
-
-Enable the aws auth method.
-
-```shell-session
-$ vault auth enable aws
-```
-
-Configure the AWS client to use the default options.
-
-```shell-session
-$ vault write -force auth/aws/config/client
-```
-
-Create a role prefixed with the AWS environment name.
-
-```shell-session
-$ vault write auth/aws/role/vault-lambda-role \
-    auth_type=iam \
-    bound_iam_principal_arn="${YOUR_ARN}" \
-    policies="${YOUR_POLICY}" \
-    ttl=1h
-```
-
-#### Step 2. option a) install the extension for lambda functions packaged in zip archives
-
-If you deploy your Lambda function as a zip file, you can add the extension
-to your Lambda layers using the console or [cli](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html#configuration-layers-using):
-
-```text
-arn:aws:lambda:<your-region>:634166935893:layer:vault-lambda-extension:11
-```
-
-#### Step 2. option b) install the extension for lambda functions packaged in container images
-
-Alternatively, if you deploy your Lambda function as a container image, simply
-place the built binary in the `/opt/extensions` directory of your image.
-
-Fetch the binary from
-[releases.hashicorp.com](https://releases.hashicorp.com/vault-lambda-extension/).
-The following command requires cURL.
-
-```shell-session
-$ curl --silent https://releases.hashicorp.com/vault-lambda-extension/0.5.0/vault-lambda-extension_0.5.0_linux_amd64.zip \
-  --output vault-lambda-extension.zip
-```
-
-Unzip the downloaded binary.
-
-```shell-session
-$ unzip vault-lambda-extension.zip
-```
-
-Optionally, you can verify the integrity of the downloaded zip using the release
-archive checksum verification instructions
-[here](https://www.hashicorp.com/security).
-
-Or to build the binary from source. This requires Golang installed. Run from the root of this repository.
-
-```shell-session
-$ GOOS=linux GOARCH=amd64 go build -o vault-lambda-extension main.go
-```
-
-#### Step 3. configure vault-lambda-extension
-
-Configure the extension using [Lambda environment
-variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html):
-
-Set the Vault API address.
-
-```shell-session
-$ VAULT_ADDR=http://vault.example.com:8200
-```
-
-Set the AWS IAM auth mount point (i.e. the path segment after `auth/` from above).
-
-```shell-session
-$ VAULT_AUTH_PROVIDER=aws
-```
-
-Set the Vault role to authenticate as. Must be configured for the ARN of your
-Lambda's role.
-
-```shell-session
-$ VAULT_AUTH_ROLE=vault-lambda-role
-```
-
-The path to a secret in Vault. Can be static or dynamic. Unless
-VAULT_SECRET_FILE is specified, JSON response will be written to
-`/tmp/vault/secret.json`.
-
-```shell-session
-$ VAULT_SECRET_PATH=secret/lambda-app/token
-```
-
-If everything is correctly set up, your Lambda function can then read secret
-material from `/tmp/vault/secret.json`. The exact contents of the JSON object
-will depend on the secret read, but its schema is the [Secret struct](https://github.com/hashicorp/vault/blob/api/v1.0.4/api/secret.go#L15)
-from the Vault API module.
-
-Alternatively, you can send normal Vault API requests over HTTP to the local
-proxy at `http://127.0.0.1:8200`, and the extension will add authentication
-before forwarding the request. Vault responses will be returned unmodified.
-Although local communication is over plain HTTP, the proxy server will use TLS
-to communicate with Vault if configured to do so as detailed below.
-
-## Configuration
-
-The extension is configured via [Lambda environment variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html).
-Most of the [Vault CLI client's environment variables](/vault/docs/commands#environment-variables) are available,
-as well as some additional variables to configure auth, which secret(s) to read and
-where to write secrets.
-
-| Environment variable              | Description                                                                                                                                                                                                                                                                                                           | Required | Example value               |
-|-----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|-----------------------------|
-| `VLE_VAULT_ADDR`                  | Vault address to connect to. Takes precedence over `VAULT_ADDR` so that clients of the proxy server can be configured using the standard `VAULT_ADDR`                                                                                                                                                                 | No       | `https://x.x.x.x:8200`      |
-| `VAULT_ADDR`                      | Vault address to connect to if `VLE_VAULT_ADDR` is not set. Required if `VLE_VAULT_ADDR` is not set                                                                                                                                                                                                                   | No       | `https://x.x.x.x:8200`      |
-| `VAULT_AUTH_PROVIDER`             | Name of the configured AWS IAM auth route on Vault                                                                                                                                                                                                                                                                    | Yes      | `aws`                       |
-| `VAULT_AUTH_ROLE`                 | Vault role to authenticate as                                                                                                                                                                                                                                                                                         | Yes      | `lambda-app`                |
-| `VAULT_IAM_SERVER_ID`             | Value to pass to the Vault server via the [`X-Vault-AWS-IAM-Server-ID` HTTP Header for AWS Authentication](/vault/api-docs/auth/aws#iam_server_id_header_value)                                                                                                                                                       | No       | `vault.example.com`         |
-| `VAULT_SECRET_PATH`               | Secret path to read, written to `/tmp/vault/secret.json` unless `VAULT_SECRET_FILE` is specified                                                                                                                                                                                                                      | No       | `database/creds/lambda-app` |
-| `VAULT_SECRET_FILE`               | Path to write the JSON response for `VAULT_SECRET_PATH`                                                                                                                                                                                                                                                               | No       | `/tmp/db.json`              |
-| `VAULT_SECRET_PATH_FOO`           | Additional secret path to read, where FOO can be any name, as long as a matching `VAULT_SECRET_FILE_FOO` is specified                                                                                                                                                                                                 | No       | `secret/lambda-app/token`   |
-| `VAULT_SECRET_FILE_FOO`           | Must exist for any correspondingly named `VAULT_SECRET_PATH_FOO`. Name has no further effect beyond matching to the correct path variable                                                                                                                                                                             | No       | `/tmp/token`                |
-| `VAULT_RUN_MODE`                  | Available options are `default`, `proxy`, and `file`. Proxy mode makes requests to the extension's local proxy server. File mode configures the extension to read and write secrets to disk. Default mode uses both file and proxy mode. The default is `default`.                                                    | No       | `default`                   |
-| `VAULT_TOKEN_EXPIRY_GRACE_PERIOD` | Period at the end of the proxy server's auth token TTL where it will consider the token expired and attempt to re-authenticate to Vault. Must have a unit and be parseable by `time.Duration`. Defaults to 10s.                                                                                                       | No       | `1m`                        |
-| `VAULT_STS_ENDPOINT_REGION`       | The region of the STS regional endpoint to authenticate with. If the AWS IAM auth mount specified uses a regional STS endpoint, then this needs to match the region of that endpoint. Defaults to using the global endpoint, or the region the Lambda resides in if `AWS_STS_REGIONAL_ENDPOINTS` is set to `regional` | No       | `eu-west-1`                 |
-
-The remaining environment variables are not required, and function exactly as
-described in the [Vault Commands (CLI)](/vault/docs/commands#environment-variables) documentation. However,
-note that `VAULT_CLIENT_TIMEOUT` cannot extend the timeout beyond the 10s
-initialization timeout imposed by the Extensions API when writing files to disk.
-
-| Environment variable          | Description                                                                                                                                                                     | Required | Example value       |
-| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------- |
-| `VAULT_CACERT`                | Path to a PEM-encoded CA certificate _file_ on the local disk                                                                                                                   | No       | `/tmp/ca.crt`       |
-| `VAULT_CAPATH`                | Path to a _directory_ of PEM-encoded CA certificate files on the local disk                                                                                                     | No       | `/tmp/certs`        |
-| `VAULT_CLIENT_CERT`           | Path to a PEM-encoded client certificate on the local disk                                                                                                                      | No       | `/tmp/client.crt`   |
-| `VAULT_CLIENT_KEY`            | Path to an unencrypted, PEM-encoded private key on disk which corresponds to the matching client certificate                                                                    | No       | `/tmp/client.key`   |
-| `VAULT_CLIENT_TIMEOUT`        | Timeout for Vault requests. Default value is 60s. Ignored by proxy server. **Any value over 10s will exceed the Extensions API timeout and therefore have no effect**           | No       | `5s`                |
-| `VAULT_MAX_RETRIES`           | Maximum number of retries on `5xx` error codes. Defaults to 2. Ignored by proxy server                                                                                          | No       | `2`                 |
-| `VAULT_SKIP_VERIFY`           | Do not verify Vault's presented certificate before communicating with it. Setting this variable is not recommended and voids Vault's [security model](/vault/docs/internals/security) | No       | `true`              |
-| `VAULT_TLS_SERVER_NAME`       | Name to use as the SNI host when connecting via TLS                                                                                                                             | No       | `vault.example.com` |
-| `VAULT_RATE_LIMIT`            | Only applies to a single invocation of the extension. See [Vault Commands (CLI)](/vault/docs/commands#environment-variables) documentation for details. Ignored by proxy server       | No       | `10`                |
-| `VAULT_NAMESPACE`             | The namespace to use for pre-configured secrets. Ignored by proxy server                                                                                                        | No       | `education`         |
-| `VAULT_DEFAULT_CACHE_TTL`     | The time to live configuration (aka, TTL) of the cache used by proxy server. Must have a unit and be parsable as a time.Duration. Required for caching to be enabled.           | No       | `15m`               |
-| `VAULT_DEFAULT_CACHE_ENABLED` | Enable caching for all requests, without needing to set the X-Vault-Cache-Control header for each request. Must be set to a boolean value.                                      | No       | `true`              |
-| `VAULT_ASSUMED_ROLE_ARN`      | Valid ARN of an IAM role that can be assumed by the execution role assigned to your Lambda function.                                                                            | No       | `arn:aws:iam::123456789012:role/xaccounts3access`
-| `VAULT_LOG_LEVEL`             | Log verbosity level, one of TRACE, DEBUG, INFO, WARN, ERROR, OFF. Defaults to INFO.                                                                                             | No       | `DEBUG`
-
-### AWS STS client configuration
-
-In addition to Vault configuration, you can configure certain aspects of the STS
-client the extension uses through the usual AWS environment variables. For example,
-if your Vault instance's IAM auth is configured to use regional STS endpoints:
-
-```shell-session
-$ vault write auth/aws/config/client \
-     sts_endpoint="https://sts.eu-west-1.amazonaws.com" \
-     sts_region="eu-west-1"
-```
-
-Then you may need to configure the extension's STS client to also use the regional
-STS endpoint by setting `AWS_STS_REGIONAL_ENDPOINTS=regional`, because both the AWS Golang
-SDK and Vault IAM auth method default to using the global endpoint in many regions.
-See documentation on [`sts_regional_endpoints`](https://docs.aws.amazon.com/credref/latest/refdocs/setting-global-sts_regional_endpoints.html) for more information.
-
-### Caching
-
-Caching can be configured for the extension's local proxy server so that it does
-not forward every HTTP request to Vault. The main consideration behind caching
-design is to make caching an explicit opt-in at the request level, so that it is
-only enabled for scenarios where caching makes sense without negative impact in
-others. To turn on caching, set the environment variable
-`VAULT_DEFAULT_CACHE_TTL` to a valid value that is parsable as a time.Duration
-in Go, for example, "15m", "1h", "2m3s" or "1h2m3s", depending on application
-needs. An invalid or negative value will be treated the same as a missing value,
-in which case, caching will not be set up and enabled.
-
-Then requests with HTTP method of "GET", and the HTTP header
-`X-Vault-Cache-Control: cache` will be returned directly from the cache if
-there's a cache hit. On a cache miss the request will be forwarded to Vault and
-the response returned and cached. If the header is set to
-`X-Vault-Cache-Control: recache`, the cache lookup will be skipped, and the
-request will be forwarded to Vault and the response returned and cached.
-Currently, the cache key is a hash of the request URL path, headers, body, and
-token.
-
-Caching may also be enabled for all requests by setting the environment variable
-`VAULT_DEFAULT_CACHE_ENABLED` to `true`. Then all requests will be fetched and/or
-cached as though the header `X-Vault-Cache-Control: cache` was present. Setting
-the header to `nocache` on a request will opt-out of caching entirely in this
-configuration. Setting the header to `recache` will skip the cache lookup and
-return and cache the response from Vault as described previously.
-
-~> **Warning!** The Vault Lambda Extension's cache is only in-memory
-and will not be persisted when the Lambda execution environment shuts down.
-In order words, the cache TTL is capped to the duration of the Lambda execution environment.
-
-## Limitations
-
-Secrets written to disk or returned from the proxy server will not be automatically
-refreshed when they expire. This is particularly important if you configure the
-extension to write secrets to disk, because the extension will only write to disk
-once per execution environment, rather than once per function invocation. If you
-use [provisioned concurrency](https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html#configuration-concurrency-provisioned) or if your Lambda
-is invoked often enough that execution contexts live beyond the lifetime of the
-secret, then secrets on disk are likely to become invalid.
-
-In line with [Lambda best practices](https://docs.aws.amazon.com/lambda/latest/dg/best-practices.html), we recommend avoiding
-writing secrets to disk where possible, and exclusively consuming secrets via
-the proxy server. However, the proxy server will still not perform any additional
-processing with returned secrets such as automatic lease renewal. The proxy server's
-own Vault auth token is the only thing that gets automatically refreshed. It will
-synchronously refresh its own token before proxying requests if the token is
-expired (including a grace window), and it will attempt to renew its token if the
-token is nearly expired but renewable.
-
-## Performance impact
-
-AWS Lambda pricing is based on [number of invocations, time of execution and memory
-used](https://aws.amazon.com/lambda/pricing/). The following table details some approximate performance
-related statistics to help assess the cost impact of this extension. Note that AWS
-Lambda allocates [CPU power in proportion to memory](https://docs.aws.amazon.com/lambda/latest/dg/configuration-memory.html) so results
-will vary widely. These benchmarks were run with the minimum 128MB of memory allocated
-so aim to give an approximate baseline.
-
-| Metric         | Value                                                                              | Description                                                                                                                      | Derivation                                                                         |
-| -------------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
-| Layer size     | 8.5MB                                                                              | The size of the unpacked extension binary                                                                                        | `ls -la`                                                                           |
-| Init latency   | 8.5ms (standard deviation 2.4ms) + one network round trip to authenticate to Vault | Extension initialization time in a new execution environment. Authentication round trip time will be highly deployment-dependent | Instrumented in code                                                               |
-| Invoke latency | <1ms                                                                               | The base processing time for each function invocation, assuming no calls to the proxy server                                     | Instrumented in code                                                               |
-| Memory impact  | 12MB                                                                               | The marginal impact on "Max Memory Used" when running the extension                                                              | As reported by Lambda when running Hello World function with and without extension |
-
-## Uploading to your own AWS account and region
-
-If you would like to upload the extension as a Lambda layer in your own AWS
-account and region, you can do the following:
-
-```shell-session
-$ curl --silent https://releases.hashicorp.com/vault-lambda-extension/0.5.0/vault-lambda-extension_0.5.0_linux_amd64.zip \
-  --output vault-lambda-extension.zip
-```
-
-Set your target AWS region.
-
-```shell-session
-$ export REGION="YOUR REGION HERE"
-```
-
-Upload the extension as a Lambda layer.
-
-```shell-session
-$ aws lambda publish-layer-version \
-     --layer-name vault-lambda-extension \
-     --zip-file  "fileb://vault-lambda-extension.zip" \
-     --region "${REGION}"
-```
-
-## Tutorial
-
-For step-by-step instructions, refer to the [Vault AWS Lambda Extension](/vault/tutorials/app-integration/aws-lambda) tutorial for details on how to create an AWS Lambda function and use the Vault Lambda Extension to authenticate with Vault.
diff --git a/website/content/docs/platform/aws/run.mdx b/website/content/docs/platform/aws/run.mdx
deleted file mode 100644
index 7d9c6a86e10..00000000000
--- a/website/content/docs/platform/aws/run.mdx
+++ /dev/null
@@ -1,45 +0,0 @@
----
-layout: docs
-page_title: Running Vault
-description: >-
-  Vault can be launched from within the AWS Marketplace from the official Vault
-  Marketplace Listings.
----
-
-# Running Vault
-
-## Launching the Vault AMI
-
-When Vault is first launched from an official Marketplace AMI, it will come up in an uninitialized state and must be initialized via the [API](/vault/api-docs/system/init), [CLI](/vault/docs/commands/operator/init), or UI. The Marketplace AMI listens on port 8200 by default. It is recommended to restrict ingress networking to the Vault instance as much as possible when initially deploying Vault (through EC2 security groups or otherwise) because anyone with network access to Vault will be able to initialize it. To learn more about the default listener configuration, or to make changes, please see the [Vault Deployment Guide](/vault/tutorials/day-one-consul/deployment-guide#listener-stanza).
-
-Additionally on first launch, a new self-signed [certificate](/vault/docs/configuration/listener/tcp#tls_cert_file) and [key](/vault/docs/configuration/listener/tcp#tls_key_file) (unique to the EC2 instance) will be generated to secure Vault traffic using TLS. This is provided as a “more secure” (vs. unencrypted TCP traffic) temporary solution, but it is strongly recommended to replace these with your own certificate and key. Please note that when using a self-signed certificate, Vault clients will need to [skip](/vault/docs/commands#vault_skip_verify) the verification of Vault’s certificate, which voids Vault’s [security model](/vault/docs/internals/security).
-
-In order to begin using a newly launched Vault instance or cluster, it must be [unsealed](/vault/docs/concepts/seal) first. HashiCorp generally recommends using the [AWS KMS Seal](/vault/docs/configuration/seal/awskms) when running Vault on AWS.
-
-## Viewing the Vault UI
-
-The Vault UI is enabled by default. You can view the UI by navigating to `https://VAULT_INSTANCE_PUBLIC_IP:8200/` in a web browser. Please note that your web browser will likely show a security warning that the default self-signed TLS certificate `(Organization: HashiCorp, Common Name: Vault)` is not trusted, and that this can be ignored at your own risk until Vault’s certificate and key are replaced with your own valid ones.
-
-## Upgrading Vault
-
-New Vault AMIs are added to the AWS Marketplace listing regularly and contain the latest versions of Vault and updated operating system packages. However, new AMIs are not built and tested to support in-place upgrades of your existing Vault installation.
-
-To upgrade a Vault instance launched from an official AWS Marketplace AMI, please follow the normal upgrade instructions for a [non-HA installation](/vault/docs/upgrading#non-ha-installations).
-
-# Architecture
-
-HashiCorp’s AWS Marketplace offerings provide an easy way to deploy Vault in a single-instance configuration using the [Filesystem storage backend](/vault/docs/configuration/storage/filesystem), but for production use, we recommend running Vault on AWS with the same [general architecture](/vault/docs/internals/architecture) as running it anywhere else. While the Filesystem storage backend is officially supported by HashiCorp, it does not support High Availability. Because Vault data is stored on disk in this configuration, it is subject to the durability and availability of Amazon Elastic Block Store (EBS) and should be backed up accordingly.
-
-For additional guidance on best practices for running Vault in production, please refer to the [Production Hardening](/vault/tutorials/operations/production-hardening) tutorial.
-
-# Getting support
-
-## Community Edition
-
-For the Community Vault AMI, support can be obtained through the [community channels](https://www.vaultproject.io/community)
-
-[See the Vault Project on Github.com](https://github.com/hashicorp/vault)
-
-## Enterprise
-
-For customers that purchase the Enterprise Vault AMI through the AWS Marketplace, Enterprise Support is also available from HashiCorp. To learn more, [see our support website](https://support.hashicorp.com/hc/en-us)
diff --git a/website/content/docs/platform/github-actions.mdx b/website/content/docs/platform/github-actions.mdx
deleted file mode 100644
index cd00583c487..00000000000
--- a/website/content/docs/platform/github-actions.mdx
+++ /dev/null
@@ -1,46 +0,0 @@
----
-layout: docs
-page_title: GitHub Actions
-description: >-
-  GitHub Actions
----
-
-# GitHub actions
-
-Workflows in GitHub Actions can make use of secrets stored in Vault by using a
-[`vault-action`](https://github.com/marketplace/actions/hashicorp-vault) step.
-
-## Example
-
-Here is an example `vault-action` step in a workflow:
-
-```yaml
-jobs:
-    build:
-        # ...
-        steps:
-            # ...
-            - name: Import Secrets
-              uses: hashicorp/vault-action@v2.4.0
-              with:
-                url: https://vault.example.com:8200
-                token: ${{ secrets.VAULT_TOKEN }}
-                caCertificate: ${{ secrets.VAULT_CA_CERT }}
-                secrets: |
-                    secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;
-                    secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;
-                    secret/data/ci npm_token
-```
-
-This example will authenticate to Vault instance at `https://vault.example.com:8200` with the GitHub secrets defined in
-`VAULT_TOKEN` and `VAULT_CA_CERT`, and will add environment variables available for next steps in the workflow:
--  The secret at path `secret/data/ci/aws` with the key `accessKey` available in the environment variable `AWS_ACCESS_KEY_ID`
--  The secret at path `secret/data/ci/aws` with the key `secretKey` available in the environment variable `AWS_SECRET_ACCESS_KEY`
--  The secret at path `secret/data/ci` with the key `npm_token` available in the environment variable `NPM_TOKEN`
-
-## Further information
-
-For more information on using the `vault-action` GitHub Action, visit:
-
-- [Vault GitHub action documentation](https://github.com/marketplace/actions/hashicorp-vault)
-- [Vault GitHub actions tutorial](/vault/tutorials/app-integration/github-actions)
diff --git a/website/content/docs/platform/index.mdx b/website/content/docs/platform/index.mdx
deleted file mode 100644
index 23bb5d8e8b2..00000000000
--- a/website/content/docs/platform/index.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-layout: docs
-page_title: Platforms
-description: This section covers running Vault on various platforms (such as Kubernetes).
----
-
-# Platforms
-
-This section covers running Vault on various platforms (such as Kubernetes) and
-explains architecture, configuration, installation and security considerations.
diff --git a/website/content/docs/platform/k8s/csi/configurations.mdx b/website/content/docs/platform/k8s/csi/configurations.mdx
deleted file mode 100644
index 684a174dcc6..00000000000
--- a/website/content/docs/platform/k8s/csi/configurations.mdx
+++ /dev/null
@@ -1,162 +0,0 @@
----
-layout: docs
-page_title: Vault CSI Provider Configurations
-description: This section documents the configurables for the Vault CSI Provider.
----
-
-# Command line arguments
-
-The following command line arguments are supported by the Vault CSI provider.
-Most settings support being set by, in ascending order of precedence:
-
-- Environment variables
-- Command line arguments
-- Secret Provider Class parameters
-
-If installing via the helm chart, they can be set using e.g.
-`--set "csi.extraArgs={-debug=true}"`.
-
-- `-cache-size` `(int: 1000)` - Set the maximum number of Vault tokens that will
-  be cached in-memory. One Vault token will be stored for each pod on the same
-  node that mounts secrets. Setting to 0 will disable the cache and force each
-  volume mount request to reauthenticate to Vault.
-
-- `-debug` `(bool: false)` - Set to true to enable debug level logging.
-
-- `-endpoint` `(string: "/tmp/vault.sock")` - Path to unix socket on which the
-  provider will listen for gRPC calls from the driver.
-
-- `-health-addr` `(string: ":8080")` - The address of the HTTP listener
-  for reporting health.
-
-- `-hmac-secret-name` `(string: "vault-csi-provider-hmac-key")` - Configure the
-  Kubernetes secret name that the provider creates to store an HMAC key for
-  generating secret version hashes.
-
-- `-vault-addr` `(string: "https://127.0.0.1:8200")` - Default address
-  for connecting to Vault. Can also be specified via the `VAULT_ADDR` environment
-  variable. **Note:** It is highly recommended to only set the Vault address when
-  installing the helm chart. The helm chart will install Vault Agent as a sidecar
-  to the Vault CSI Provider for caching and renewals, but setting `-vault-addr`
-  here will cause the Vault CSI Provider to bypass the Agent's cache.
-
-- `-vault-mount` `(string: "kubernetes")` - Default Vault mount path
-  for Kubernetes authentication. Can be overridden per Secret Provider Class
-  object.
-
-- `-vault-namespace` `(string: "")` - (v1.1.0+) Default Vault namespace for Vault
-  requests. Can also be specified via the `VAULT_NAMESPACE` environment variable.
-
-- `-vault-tls-ca-cert` `(string: "")` - (v1.1.0+) Path on disk to a single
-  PEM-encoded CA certificate to trust for Vault. Takes precedence over
-  `-vault-tls-ca-directory`. Can also be specified via the `VAULT_CACERT`
-  environment variable.
-
-- `-vault-tls-ca-directory` `(string: "")` - (v1.1.0+) Path on disk to a
-  directory of PEM-encoded CA certificates to trust for Vault. Can also be
-  specified via the `VAULT_CAPATH` environment variable.
-
-- `-vault-tls-server-name` `(string: "")` - (v1.1.0+) Name to use as the SNI
-  host when connecting to Vault via TLS. Can also be specified via the
-  `VAULT_TLS_SERVER_NAME` environment variable.
-
-- `-vault-tls-client-cert` `(string: "")` - (v1.1.0+) Path on disk to a
-  PEM-encoded client certificate for mTLS communication with Vault. If set,
-  also requires `-vault-tls-client-key`. Can also be specified via the
-  `VAULT_CLIENT_CERT` environment variable.
-
-- `-vault-tls-client-key` `(string: "")` - (v1.1.0+) Path on disk to a
-  PEM-encoded client key for mTLS communication with Vault. If set, also
-  requires `-vault-tls-client-cert`. Can also be specified via the
-  `VAULT_CLIENT_KEY` environment variable.
-
-- `-vault-tls-skip-verify` `(bool: false)` - (v1.1.0+) Disable verification of
-  TLS certificates. Can also be specified via the `VAULT_SKIP_VERIFY` environment
-  variable.
-
-- `-version` `(bool: false)` - print version information and exit.
-
-
-# Secret provider class parameters
-
-The following parameters are supported by the Vault provider. Each parameter is
-an entry under `spec.parameters` in a SecretProviderClass object. The full
-structure is illustrated in the [examples](/vault/docs/platform/k8s/csi/examples).
-
-- `roleName` `(string: "")` - Name of the role to be used during login with Vault.
-
-- `vaultAddress` `(string: "")` - The address of the Vault server. **Note:** It is
-  highly recommended to only set the Vault address when installing the helm chart.
-  The helm chart will install Vault Agent as a sidecar to the Vault CSI Provider
-  for caching and renewals, but setting `vaultAddress` here will cause the Vault
-  CSI Provider to bypass the Agent's cache.
-
-- `vaultNamespace` `(string: "")` - The Vault [namespace](/vault/docs/enterprise/namespaces) to use.
-
-- `vaultSkipTLSVerify` `(string: "false")` - When set to true, skips verification of the Vault server
-  certificate. Setting this to true is not recommended for production.
-
-- `vaultCACertPath` `(string: "")` - The path on disk where the Vault CA certificate can be found
-  when verifying the Vault server certificate.
-
-- `vaultCADirectory` `(string: "")` - The directory on disk where the Vault CA certificate can be found
-  when verifying the Vault server certificate.
-
-- `vaultTLSClientCertPath` `(string: "")` - The path on disk where the client certificate can be found
-  for mTLS communications with Vault.
-
-- `vaultTLSClientKeyPath` `(string: "")` - The path on disk where the client key can be found
-  for mTLS communications with Vault.
-
-- `vaultTLSServerName` `(string: "")` - The name to use as the SNI host when connecting via TLS.
-
-- `vaultAuthMountPath` `(string: "kubernetes")` - The name of the auth mount used for login.
-  Can be a Kubernetes or JWT auth mount. Mutually exclusive with `vaultKubernetesMountPath`.
-
-- `vaultKubernetesMountPath` `(string: "kubernetes")` - The name of the auth mount used for login.
-  Can be a Kubernetes or JWT auth mount. Mutually exclusive with `vaultAuthMountPath`.
-
-- `audience` `(string: "")` - Specifies a custom audience for the requesting pod's service account token,
-  generated using the
-  [TokenRequest API](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/#TokenRequestSpec).
-  The resulting token is used to authenticate to Vault, so if you specify an
-  [audience](/vault/api-docs/auth/kubernetes#audience) for your Kubernetes auth
-  role, it must match the audience specified here. If not set, the token audiences will default to
-  the Kubernetes cluster's default API audiences.
-
-- `objects` `(array)` - An array of secrets to retrieve from Vault.
-
-  - `objectName` `(string: "")` - The alias of the object which can be referenced within the secret provider class and
-  the name of the secret file.
-
-  - `method` `(string: "GET")` - The type of HTTP request. Supported values include "GET" and "PUT".
-
-  - `secretPath` `(string: "")` - The path in Vault where the secret is located.
-    For secrets that are retrieved via HTTP GET method, the `secretPath` can include optional URI parameters,
-    for example, the [version of the KV2 secret](/vault/api-docs/secret/kv/kv-v2#read-secret-version):
-
-    ```yaml
-    objects: |
-      - objectName: "app-secret"
-        secretPath: "secret/data/test?version=1"
-        secretKey: "password"
-    ```
-
-  - `secretKey` `(string: "")` - The key in the Vault secret to extract. If omitted, the whole response from Vault will be written as JSON.
-
-  - `filePermission` `(integer: 0o644)` - The file permissions to set for this secret's file.
-
-  - `encoding` `(string: "utf-8")` - The encoding of the secret value. Supports decoding `utf-8` (default), `hex`, and `base64` values.
-
-  - `secretArgs` `(map: {})` - Additional arguments to be sent to Vault for a specific secret. Arguments can vary
-    for different secret engines. For example:
-
-    ```yaml
-    secretArgs:
-      common_name: 'test.example.com'
-      ttl: '24h'
-    ```
-
-    ~> `secretArgs` are sent as part of the HTTP request body. Therefore, they are only effective for HTTP PUT/POST requests, for instance,
-        the [request used to generate a new certificate](/vault/api-docs/secret/pki#generate-certificate).
-        To supply additional parameters for secrets retrieved via HTTP GET, include optional URI parameters in [`secretPath`](#secretpath).
diff --git a/website/content/docs/platform/k8s/csi/examples.mdx b/website/content/docs/platform/k8s/csi/examples.mdx
deleted file mode 100644
index a895f360cad..00000000000
--- a/website/content/docs/platform/k8s/csi/examples.mdx
+++ /dev/null
@@ -1,165 +0,0 @@
----
-layout: docs
-page_title: Vault CSI Provider Examples
-description: This section documents examples of using the Vault CSI Provider.
----
-
-# Vault CSI provider examples
-
-The following examples demonstrate how the Vault CSI Provider can be used.
-
-~> A common mistake is to not install the CSI Secret Store Driver before using the Vault CSI Provider.
-
-## File based dynamic database credentials
-
-The following Secret Provider Class retrieves dynamic database credentials from Vault and
-extracts the generated username and password. The secrets are then mounted as files in the
-configured mount location.
-
-```yaml
----
-apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
-kind: SecretProviderClass
-metadata:
-  name: vault-db-creds
-spec:
-  provider: vault
-  parameters:
-    roleName: 'app'
-    objects: |
-      - objectName: "dbUsername"
-        secretPath: "database/creds/db-app"
-        secretKey: "username"
-      - objectName: "dbPassword"
-        secretPath: "database/creds/db-app"
-        secretKey: "password"
-```
-
-Next, a pod can be created to use this Secret Provider Class to populate the secrets in the pod:
-
-```yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: app
-  labels:
-    app: demo
-spec:
-  selector:
-    matchLabels:
-      app: demo
-  replicas: 1
-  template:
-    metadata:
-      annotations:
-      labels:
-        app: demo
-    spec:
-      serviceAccountName: app
-      containers:
-        - name: app
-          image: my-app:1.0.0
-          volumeMounts:
-            - name: 'vault-db-creds'
-              mountPath: '/mnt/secrets-store'
-              readOnly: true
-      volumes:
-        - name: vault-db-creds
-          csi:
-            driver: 'secrets-store.csi.k8s.io'
-            readOnly: true
-            volumeAttributes:
-              secretProviderClass: 'vault-db-creds'
-```
-
-The pod mounts a CSI volume and specifies the Secret Provider Class (`vault-db-creds`) created above.
-The secrets created from that provider class are mounted to `/mnt/secrets-store`. When this pod is
-created the containers will find two files containing secrets:
-
-- `/mnt/secrets-store/dbUsername`
-- `/mnt/secrets-store/dbPassword`
-
-## Environment variable dynamic database credentials
-
-The following Secret Provider Class retrieves dynamic database credentials from Vault and
-extracts the generated username and password. The secrets are then synced to Kubernetes secrets
-so that they can be mounted as environment variables in the containers.
-
-```yaml
----
-apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
-kind: SecretProviderClass
-metadata:
-  name: vault-db-creds
-spec:
-  provider: vault
-  secretObjects:
-    - secretName: vault-db-creds-secret
-      type: Opaque
-      data:
-        - objectName: dbUsername # References dbUsername below
-          key: username # Key within k8s secret for this value
-        - objectName: dbPassword
-          key: password
-  parameters:
-    roleName: 'app'
-    objects: |
-      - objectName: "dbUsername"
-        secretPath: "database/creds/db-app"
-        secretKey: "username"
-      - objectName: "dbPassword"
-        secretPath: "database/creds/db-app"
-        secretKey: "password"
-```
-
-Next, a pod can be created which uses this Secret Provider Class to populate the secrets in the pod's environment:
-
-```yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: app
-  labels:
-    app: demo
-spec:
-  selector:
-    matchLabels:
-      app: demo
-  replicas: 1
-  template:
-    metadata:
-      annotations:
-      labels:
-        app: demo
-    spec:
-      serviceAccountName: app
-      containers:
-        - name: app
-          image: my-app:1.0.0
-          env:
-            - name: DB_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: vault-db-creds-secret
-                  key: username
-            - name: DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: vault-db-creds-secret
-                  key: password
-          volumeMounts:
-            - name: 'vault-db-creds'
-              mountPath: '/mnt/secrets-store'
-              readOnly: true
-      volumes:
-        - name: vault-db-creds
-          csi:
-            driver: 'secrets-store.csi.k8s.io'
-            readOnly: true
-            volumeAttributes:
-              secretProviderClass: 'vault-db-creds'
-```
-
-The pod mounts a CSI volume and specifies the Secret Provider Class (`vault-db-creds`) created above.
-The secrets created from that provider class are mounted to `/mnt/secrets-store`, additionally a Kubernetes
-secret called `vault-db-creds` is created and referenced in two environment variables.
diff --git a/website/content/docs/platform/k8s/csi/index.mdx b/website/content/docs/platform/k8s/csi/index.mdx
deleted file mode 100644
index bebc6bbb134..00000000000
--- a/website/content/docs/platform/k8s/csi/index.mdx
+++ /dev/null
@@ -1,130 +0,0 @@
----
-layout: docs
-page_title: Vault CSI Provider
-description: >-
-  The Vault CSI Provider allows pods to consume Vault secrets using CSI volumes.
----
-
-# Vault CSI provider
-
-The Vault CSI Provider allows pods to consume Vault secrets using
-[CSI Secrets Store](https://github.com/kubernetes-sigs/secrets-store-csi-driver) volumes.
-
-~> The Vault CSI Provider requires the [CSI Secret Store](https://github.com/kubernetes-sigs/secrets-store-csi-driver)
-Driver to be installed.
-
-## Overview
-
-At a high level, the CSI Secrets Store driver allows users to create `SecretProviderClass` objects.
-This object defines which secret provider to use and what secrets to retrieve. When pods requesting CSI volumes
-are created, the CSI Secrets Store driver will send the request to the Vault CSI Provider if the provider
-is `vault`. The Vault CSI Provider will then use Secret Provider Class specified and the pod's service account to retrieve
-the secrets from Vault, and mount them into the pod's CSI volume.
-
-The secret is retrieved from Vault and populated to the CSI secrets store volume during the `ContainerCreation` phase.
-This means that pods will be blocked from starting until the secrets have been read from Vault and written to the volume.
-
-### Features
-
-The following features are supported by the Vault CSI Provider:
-
-- All Vault secret engines supported.
-- Authentication using the requesting pod's service account.
-- TLS/mTLS communications with Vault.
-- Rendering Vault secrets to files.
-- Dynamic lease caching and renewal performed by Agent.
-- Syncing secrets to Kubernetes secrets to be used as environment variables.
-- Installation via [Vault Helm](/vault/docs/platform/k8s/helm)
-
-@include 'kubernetes-supported-versions.mdx'
-
-## Authenticating with Vault
-
-The Vault CSI Provider will authenticate with Vault as the service account of the
-pod that mounts the CSI volume. [Kubernetes](/vault/docs/auth/kubernetes) and
-[JWT](/vault/docs/auth/jwt) auth methods are supported. The pod's service account
-must be bound to a Vault role and a policy granting access to the secrets desired.
-
-It is highly recommended to run pods with dedicated Kubernetes service accounts to
-ensure applications cannot access more secrets than they require.
-
-## Secret provider class example
-
-The following is an example of a Secret Provider Class using the `vault` provider:
-
-```yaml
----
-apiVersion: secrets-store.csi.x-k8s.io/v1alpha1
-kind: SecretProviderClass
-metadata:
-  name: vault-db-creds
-spec:
-  # Vault CSI Provider
-  provider: vault
-  parameters:
-    # Vault role name to use during login
-    roleName: 'app'
-    # Vault address and TLS connection config is normally best configured by the
-    # helm chart, but can be overridden per SecretProviderClass:
-    # Vault's hostname
-    #vaultAddress: 'https://vault:8200'
-    # TLS CA certification for validation
-    #vaultCACertPath: '/vault/tls/ca.crt'
-    objects: |
-      - objectName: "dbUsername"
-        secretPath: "database/creds/db-app"
-        secretKey: "username"
-      - objectName: "dbPassword"
-        secretPath: "database/creds/db-app"
-        secretKey: "password"
-    # "objectName" is an alias used within the SecretProviderClass to reference
-    # that specific secret. This will also be the filename containing the secret.
-    # "secretPath" is the path in Vault where the secret should be retrieved.
-    # "secretKey" is the key within the Vault secret response to extract a value from.
-```
-
-~> Secret Provider Class is a namespaced object in Kubernetes.
-
-## Using secret provider classes
-
-An application pod uses the example Secret Provider Class above by mounting it as a CSI volume:
-
-```yaml
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: app
-  labels:
-    app: demo
-spec:
-  selector:
-    matchLabels:
-      app: demo
-  replicas: 1
-  template:
-    spec:
-      serviceAccountName: app
-      containers:
-        - name: app
-          image: my-app:1.0.0
-          volumeMounts:
-            - name: 'vault-db-creds'
-              mountPath: '/mnt/secrets-store'
-              readOnly: true
-      volumes:
-        - name: vault-db-creds
-          csi:
-            driver: 'secrets-store.csi.k8s.io'
-            readOnly: true
-            volumeAttributes:
-              secretProviderClass: 'vault-db-creds'
-```
-
-In this example `volumes.csi` is created on the application deployment and references
-the Secret Provider Class named `vault-db-creds`.
-
-## Tutorial
-
-Refer to the [Vault CSI Provider](/vault/tutorials/kubernetes/kubernetes-secret-store-driver)
-tutorial to learn how to set up Vault and its dependencies with a Helm chart.
diff --git a/website/content/docs/platform/k8s/csi/installation.mdx b/website/content/docs/platform/k8s/csi/installation.mdx
deleted file mode 100644
index e3a41988c85..00000000000
--- a/website/content/docs/platform/k8s/csi/installation.mdx
+++ /dev/null
@@ -1,123 +0,0 @@
----
-layout: docs
-page_title: Vault CSI Provider Installation
-description: The Vault CSI Provider can be installed using Vault Helm.
----
-
-# Installing the Vault CSI provider
-
-## Prerequisites
-
-- Kubernetes 1.16+ for both the master and worker nodes (Linux-only)
-- [Secrets store CSI driver](https://secrets-store-csi-driver.sigs.k8s.io/getting-started/installation.html) installed
-- `TokenRequest` endpoint available, which requires setting the flags
-  `--service-account-signing-key-file` and `--service-account-issuer` for
-  `kube-apiserver`. Set by default from 1.20+ and earlier in most managed services.
-
-## Installation using helm
-
-The [Vault Helm chart](/vault/docs/platform/k8s/helm) is the recommended way to
-install and configure the Vault CSI Provider in Kubernetes.
-
-To install a new instance of Vault and the Vault CSI Provider, first add the
-HashiCorp helm repository and ensure you have access to the chart:
-
-~> **Note:** Vault CSI Provider Helm installation requires Vault Helm 0.10.0+.
-
-@include 'helm/repo.mdx'
-
-Then install the chart and enable the CSI feature by setting the
-`csi.enabled` value to `true`:
-
-~> **Note:** this will also install the Vault server and Agent Injector.
-
-```shell-session
-$ helm install vault hashicorp/vault --set="csi.enabled=true"
-```
-
-Upgrades may be performed with `helm upgrade` on an existing installation. Please
-always run Helm with `--dry-run` before any install or upgrade to verify
-changes.
-
-You can see all the available values settings by running `helm inspect values hashicorp/vault` or by reading the [Vault Helm Configuration
-Docs](/vault/docs/platform/k8s/helm/configuration). Commonly used values in the Helm
-chart include limiting the namespaces the Vault CSI Provider runs in, TLS options and
-more.
-
-## Installation on OpenShift
-
-We recommend using the [Vault agent injector on Openshift](/vault/docs/platform/k8s/helm/openshift)
-instead of the Secrets Store CSI driver. OpenShift
-[does not recommend](https://docs.openshift.com/container-platform/4.9/storage/persistent_storage/persistent-storage-hostpath.html)
-using `hostPath` mounting in production or
-[certify Helm charts](https://github.com/redhat-certification/chart-verifier/blob/dbf89bff2d09142e4709d689a9f4037a739c2244/docs/helm-chart-checks.md#table-2-helm-chart-default-checks)
-using CSI objects because pods must run as privileged. Pods will have elevated access to
-other pods on the same node, which OpenShift does not recommend.
-
-You can run the Secrets Store CSI driver with additional
-security configurations on a OpenShift development
-or testing cluster.
-
-Deploy the Secrets Store CSI driver and Vault Helm chart
-to your OpenShift cluster.
-
-Then, patch the `DaemonSet` for the Vault CSI provider to
-run with a privileged security context.
-
-```shell-session
-$ kubectl patch daemonset vault-csi-provider \
-  --type='json' \
-  --patch='[{"op": "add", "path": "/spec/template/spec/containers/0/securityContext", "value": {"privileged": true} }]'
-```
-
-The Secrets Store CSI driver and Vault CSI provider need `hostPath` mount access.
-Add the service account for the Secrets Store CSI driver to the `privileged`
-[security context constraint](https://cloud.redhat.com/blog/managing-sccs-in-openshift).
-
-```shell-session
-$ oc adm policy add-scc-to-user privileged system:serviceaccount:${KUBERNETES_VAULT_NAMESPACE}:secrets-store-csi-driver
-```
-
-Add the service account for the Vault CSI provider to the `privileged`
-security context constraint.
-
-```shell-session
-$ oc adm policy add-scc-to-user privileged system:serviceaccount:${KUBERNETES_VAULT_NAMESPACE}:vault-csi-provider
-```
-
-You need to give additional access to the application retrieving secrets with the Vault CSI provider.
-Create a `SecurityContextConstraint` to `allowHostDirVolumePlugin`, `allowHostDirVolumePlugin`, and
-`allowHostPorts` for the application's service account.
-You can adjust the other attributes based on your application's runtime configuration.
-
-```shell-session
-$ cat > application-scc.yaml << EOF
-apiVersion: security.openshift.io/v1
-kind: SecurityContextConstraints
-metadata:
-  name: vault-csi-provider
-allowPrivilegedContainer: false
-allowHostDirVolumePlugin: true
-allowHostNetwork: true
-allowHostPorts: true
-allowHostIPC: false
-allowHostPID: false
-readOnlyRootFilesystem: false
-defaultAddCapabilities:
-- SYS_ADMIN
-runAsUser:
-  type: RunAsAny
-seLinuxContext:
-  type: RunAsAny
-fsGroup:
-  type: RunAsAny
-users:
-- system:serviceaccount:${KUBERNETES_APPLICATION_NAMESPACE}:${APPLICATION_SERVICE_ACCOUNT}
-EOF
-```
-
-Add the security context constraint for the application.
-
-```shell-session
-$ kubectl apply -f application-scc.yaml
-```
diff --git a/website/content/docs/platform/k8s/helm/configuration.mdx b/website/content/docs/platform/k8s/helm/configuration.mdx
deleted file mode 100644
index a369aa5ea2d..00000000000
--- a/website/content/docs/platform/k8s/helm/configuration.mdx
+++ /dev/null
@@ -1,1326 +0,0 @@
----
-layout: docs
-page_title: Configuration
-description: This section documents configuration options for the Vault Helm chart
----
-
-# Configuration
-
-@include 'helm/version.mdx'
-
-The chart is highly customizable using
-[Helm configuration values](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing).
-Each value has a default tuned for an optimal getting started experience
-with Vault. Before going into production, please review the parameters below
-and consider if they're appropriate for your deployment.
-
-- `global` - These global values affect multiple components of the chart.
-
-  - `enabled` (`boolean: true`) - The master enabled/disabled configuration. If this is true, most components will be installed by default. If this is false, no components will be installed by default and manually opting-in is required, such as by setting `server.enabled` to true.
-
-  - `namespace` (`string: ""`) - The namespace to deploy to. Defaults to the `helm` installation namespace.
-
-  - `imagePullSecrets` (`array: []`) - References secrets to be used when pulling images from private registries. See [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/) for more details. May be specified as an array of name map entries or just as an array of names:
-
-    ```yaml
-    imagePullSecrets:
-      - name: image-pull-secret
-    # or
-    imagePullSecrets:
-      - image-pull-secret
-    ```
-
-  - `tlsDisable` (`boolean: true`) - When set to `true`, changes URLs from `https` to `http` (such as the `VAULT_ADDR=http://127.0.0.1:8200` environment variable set on the Vault pods).
-
-  - `externalVaultAddr` (`string: ""`) - External vault server address for the injector and CSI provider to use. Setting this will disable deployment of a vault server. A service account with token review permissions is automatically created if `server.serviceAccount.create=true` is set for the external Vault server to use.
-
-  - `openshift` (`boolean: false`) - If `true`, enables configuration specific to OpenShift such as NetworkPolicy, SecurityContext, and Route.
-
-  - `psp` - Values that configure Pod Security Policy.
-
-    - `enable` (`boolean: false`) - When set to `true`, enables Pod Security Policies for Vault and Vault Agent Injector.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional annotations to
-      add to the Pod Security Policies. This can either be YAML or a YAML-formatted
-      multi-line templated string.
-
-      ```yaml
-      annotations:
-        seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
-        apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-        seccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default
-        apparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default
-      # or
-      annotations: |
-        seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
-        apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-        seccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default
-        apparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default
-      ```
-  - `serverTelemetry` - Values that configure metrics and telemetry
-
-    - `prometheusOperator` (`boolean: false`) - When set to `true`, enables integration with the
-      Prometheus Operator. Be sure to configure the top-level [`serverTelemetry`](/vault/docs/platform/k8s/helm/configuration#servertelemetry-1) section for more details
-      and required configuration values.
-
-- `injector` - Values that configure running a Vault Agent Injector Admission Webhook Controller within Kubernetes.
-
-  - `enabled` (`boolean or string: "-"`) - When set to `true`, the Vault Agent Injector Admission Webhook controller will be created. When set to `"-"`, defaults to the value of `global.enabled`.
-
-  - `externalVaultAddr` (`string: ""`) - Deprecated: Please use [global.externalVaultAddr](/vault/docs/platform/k8s/helm/configuration#externalvaultaddr) instead.
-
-  - `replicas` (`int: 1`) - The number of pods to deploy to create a highly available cluster of Vault Agent Injectors. Requires Vault K8s 0.7.0 to have more than 1 replica.
-
-  - `leaderElector` - Values that configure the Vault Agent Injector leader election for HA deployments.
-
-    - `enabled` (`boolean: true`) - When set to `true`, enables leader election for Vault Agent Injector. This is required when using auto-tls and more than 1 replica.
-
-  - `image` - Values that configure the Vault Agent Injector Docker image.
-
-    - `repository` (`string: "hashicorp/vault-k8s"`) - The name of the Docker image for Vault Agent Injector.
-
-    - `tag` (`string: "1.3.1"`) - The tag of the Docker image for the Vault Agent Injector. **This should be pinned to a specific version when running in production.** Otherwise, other changes to the chart may inadvertently upgrade your admission controller.
-
-    - `pullPolicy` (`string: "IfNotPresent"`) - The pull policy for container images. The default pull policy is `IfNotPresent` which causes the Kubelet to skip pulling an image if it already exists.
-
-  - `agentImage` - Values that configure the Vault Agent sidecar image.
-
-    - `repository` (`string: "hashicorp/vault"`) - The name of the Docker image for the Vault Agent sidecar. This should be set to the official Vault Docker image.
-
-    - `tag` (`string: "1.15.2"`) - The tag of the Vault Docker image to use for the Vault Agent Sidecar. **Vault 1.3.1+ is required by the admission controller**.
-
-  - `agentDefaults` - Values that configure the injected Vault Agent containers default values.
-
-    - `cpuLimit` (`string: "500m"`) - The default CPU limit for injected Vault Agent containers.
-
-    - `cpuRequest` (`string: "250m"`) - The default CPU request for injected Vault Agent containers.
-
-    - `memLimit` (`string: "128Mi"`) - The default memory limit for injected Vault Agent containers.
-
-    - `memRequest` (`string: "64Mi"`) - The default memory request for injected Vault Agent containers.
-
-    - `ephemeralLimit` (`string: ""`) - The default ephemeral storage limit for injected Vault Agent containers.
-
-    - `ephemeralRequest` (`string: ""`) - The default ephemeral storage request for injected Vault Agent containers.
-
-    - `template` (`string: "map"`) - The default template type for rendered secrets if no custom templates are defined.
-      Possible values include `map` and `json`.
-
-    - `templateConfig` - Default values within Agent's [`template_config` stanza](/vault/docs/agent-and-proxy/agent/template).
-
-      - `exitOnRetryFailure` (`boolean: true`) - Controls whether Vault Agent exits after it has exhausted its number of template retry attempts due to failures.
-
-      - `staticSecretRenderInterval` (`string: ""`) - Configures how often Vault Agent Template should render non-leased secrets such as KV v2. See the [Vault Agent Templates documentation](/vault/docs/agent-and-proxy/agent/template#non-renewable-secrets) for more details.
-
-  - `metrics` - Values that configure the Vault Agent Injector metric exporter.
-
-    - `enabled` (`boolean: false`) - When set to `true`, the Vault Agent Injector exports Prometheus metrics at the `/metrics` path.
-
-  - `authPath` (`string: "auth/kubernetes"`) - Mount path of the Vault Kubernetes Auth Method.
-
-  - `logLevel` (`string: "info"`) - Configures the log verbosity of the injector. Supported log levels: trace, debug, error, warn, info.
-
-  - `logFormat` (`string: "standard"`) - Configures the log format of the injector. Supported log formats: "standard", "json".
-
-  - `revokeOnShutdown` (`boolean: false`) - Configures all Vault Agent sidecars to revoke their token when shutting down.
-
-  - `securityContext` - Security context for the pod template and the injector container
-
-    - `pod` (`dictionary: {}`) - Defines the securityContext for the injector Pod, as YAML or a YAML-formatted multi-line templated string. Default if not specified:
-
-      ```yaml
-      runAsNonRoot: true
-      runAsGroup: {{ .Values.injector.gid | default 1000 }}
-      runAsUser: {{ .Values.injector.uid | default 100 }}
-      fsGroup: {{ .Values.injector.gid | default 1000 }}
-      ```
-
-    - `container` (`dictionary: {}`) - Defines the securityContext for the injector container, as YAML or a YAML-formatted multi-line templated string. Default if not specified:
-
-      ```yaml
-      allowPrivilegeEscalation: false
-      capabilities:
-        drop:
-          - ALL
-      ```
-
-  - `resources` (`dictionary: {}`) - The resource requests and limits (CPU, memory, etc.) for each container of the injector. This should be a YAML dictionary of a Kubernetes [resource](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) object. If this isn't specified, then the pods won't request any specific amount of resources, which limits the ability for Kubernetes to make efficient use of compute resources.<br /> **Setting this is highly recommended.**
-
-    ```yaml
-    resources:
-      requests:
-        memory: '256Mi'
-        cpu: '250m'
-      limits:
-        memory: '256Mi'
-        cpu: '250m'
-    ```
-
-  - `webhook` - Values that control the Mutating Webhook Configuration.
-
-    - `failurePolicy` (`string: "Ignore"`) - Configures failurePolicy of the webhook. To block pod creation while the webhook is unavailable, set the policy to `"Fail"`. See [Failure Policy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy).
-
-    - `matchPolicy` (`string: "Exact"`) - Specifies the approach to accepting changes based on the rules of the MutatingWebhookConfiguration. See [Match Policy](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy).
-
-    - `timeoutSeconds` (`int: 30`) - Specifies the number of seconds before the webhook request will be ignored or fails. If it is ignored or fails depends on the `failurePolicy`. See [timeouts](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts).
-
-    - `namespaceSelector` (`object: {}`) - The selector used by the admission webhook controller to limit what namespaces where injection can happen. If unset, all non-system namespaces are eligible for injection. See [Matching requests: namespace selector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector).
-
-      ```yaml
-      namespaceSelector:
-        matchLabels:
-          sidecar-injector: enabled
-      ```
-
-    - `objectSelector` (`object: {}`) - The selector used by the admission webhook controller to limit what objects can be affected by mutation. See [Matching requests: object selector](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector).
-
-      ```yaml
-      objectSelector:
-        matchLabels:
-          sidecar-injector: enabled
-      ```
-
-    - `annotations` (`string or object: {}`) - Defines additional annotations to attach to the webhook. This can either be YAML or a YAML-formatted multi-line templated string.
-
-  - `namespaceSelector` (`dictionary: {}`) - Deprecated: please use [`webhook.namespaceSelector`](/vault/docs/platform/k8s/helm/configuration#namespaceselector) instead.
-
-  - `objectSelector` (`dictionary: {}`) - Deprecated: please use [`webhook.objectSelector`](/vault/docs/platform/k8s/helm/configuration#objectselector) instead.
-
-  - `extraLabels` (`dictionary: {}`) - This value defines additional labels for Vault Agent Injector pods.
-
-    ```yaml
-    extraLabels:
-      'sample/label1': 'foo'
-      'sample/label2': 'bar'
-    ```
-
-  - `certs` - The certs section configures how the webhook TLS certs are configured. These are the TLS certs for the Kube apiserver communicating to the webhook. By default, the injector will generate and manage its own certs, but this requires the ability for the injector to update its own `MutatingWebhookConfiguration`. In a production environment, custom certs should probably be used. Configure the values below to enable this.
-
-    - `secretName` (`string: ""`) - secretName is the name of the Kubernetes secret that has the TLS certificate and private key to serve the injector webhook. If this is null, then the injector will default to its automatic management mode.
-
-    - `caBundle` (`string: ""`) - The PEM-encoded CA public certificate bundle for the TLS certificate served by the injector. This must be specified as a string and can't come from a secret because it must be statically configured on the Kubernetes `MutatingAdmissionWebhook` resource. This only needs to be specified if `secretName` is not null.
-
-    - `certName` (`string: "tls.crt"`) - The name of the certificate file within the `secretName` secret.
-
-    - `keyName` (`string: "tls.key"`) - The name of the key file within the `secretName` secret.
-
-  - `extraEnvironmentVars` (`dictionary: {}`) - Extra environment variables to set in the injector deployment.
-
-    ```yaml
-    # Example setting injector TLS options in a deployment:
-    extraEnvironmentVars:
-      AGENT_INJECT_TLS_MIN_VERSION: tls13
-      AGENT_INJECT_TLS_CIPHER_SUITES: ...
-    ```
-
-  - `affinity` - This value defines the [affinity](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity) for Vault Agent Injector pods. This can either be multi-line string or YAML matching the PodSpec's affinity field. It defaults to allowing only a single pod on each node, which minimizes risk of the cluster becoming unusable if a node is lost. If you need to run more pods per node (for example, testing on Minikube), set this value to `null`.
-
-    ```yaml
-    # Recommended default server affinity:
-    affinity: |
-      podAntiAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-        - labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
-              app.kubernetes.io/instance: "{{ .Release.Name }}"
-              component: webhook
-          topologyKey: kubernetes.io/hostname
-    ```
-
-  - `topologySpreadConstraints` (`array: []`) - [Topology settings](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/)
-    for injector pods. This can either be YAML or a YAML-formatted multi-line templated string.
-
-  - `tolerations` (`array: []`) - Toleration Settings for injector pods. This should be either a multi-line string or YAML matching the Toleration array.
-
-  - `nodeSelector` (`dictionary: {}`) - nodeSelector labels for injector pod assignment, formatted as a muli-line string or YAML map.
-
-  - `priorityClassName` (`string: ""`) - Priority class for injector pods
-
-  - `annotations` (`dictionary: {}`) - This value defines additional annotations for injector pods. This can either be YAML or a YAML-formatted multi-line templated string.
-
-    ```yaml
-    annotations:
-      "sample/annotation1": "foo"
-      "sample/annotation2": "bar"
-    # or
-    annotations: |
-      "sample/annotation1": "foo"
-      "sample/annotation2": "bar"
-    ```
-
-  - `failurePolicy` (`string: "Ignore"`) - Deprecated: please use [`webhook.failurePolicy`](/vault/docs/platform/k8s/helm/configuration#failurepolicy) instead.
-
-  - `webhookAnnotations` (`dictionary: {}`) - Deprecated: please use [`webhook.annotations`](/vault/docs/platform/k8s/helm/configuration#annotations-1) instead.
-
-  - `service` - The service section configures the Kubernetes service for the Vault Agent Injector.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional annotations to
-      add to the Vault Agent Injector service. This can either be YAML or a YAML-formatted
-      multi-line templated string.
-
-      ```yaml
-      annotations:
-        "sample/annotation1": "foo"
-        "sample/annotation2": "bar"
-      # or
-      annotations: |
-        "sample/annotation1": "foo"
-        "sample/annotation2": "bar"
-      ```
-
-  - `serviceAccount` - Injector serviceAccount specific config
-
-    - `annotations` (`dictionary: {}`) - Extra annotations to attach to the injector serviceAccount. This can either be YAML or a YAML-formatted multi-line templated string.
-
-  - `hostNetwork` (`boolean: false`) - When set to true, configures the Vault Agent Injector to run on the host network. This is useful
-    when alternative cluster networking is used.
-
-  - `port` (`int: 8080`) - Configures the port the Vault Agent Injector listens on.
-
-  - `podDisruptionBudget` (`dictionary: {}`) - A disruption budget limits the number of pods of a replicated application that are down simultaneously from voluntary disruptions.
-
-    ```yaml
-    podDisruptionBudget:
-      maxUnavailable: 1
-    ```
-
-  - `strategy` (`dictionary: {}`) - Strategy for updating the deployment. This can be a multi-line string or a YAML map.
-
-    ```yaml
-    strategy:
-      rollingUpdate:
-        maxSurge: 25%
-        maxUnavailable: 25%
-      type: RollingUpdate
-    # or
-    strategy: |
-      rollingUpdate:
-        maxSurge: 25%
-        maxUnavailable: 25%
-      type: RollingUpdate
-    ```
-
-  - `livenessProbe` - Values that configure the liveness probe for the injector.
-
-    - `failureThreshold` (`int: 2`) - When set to a value, configures how many probe failures will be tolerated by Kubernetes.
-
-    - `initialDelaySeconds` (`int: 60`) - Sets the initial delay of the liveness probe when the container starts.
-
-    - `periodSeconds` (`int: 5`) - When set to a value, configures how often (in seconds) to perform the probe.
-
-    - `successThreshold` (`int: 1`) - When set to a value, configures the minimum consecutive successes for the probe to be considered successful after having failed.
-
-    - `timeoutSeconds` (`int: 3`) - When set to a value, configures the number of seconds after which the probe times out.
-
-  - `readinessProbe` - Values that configure the readiness probe for the injector.
-
-    - `failureThreshold` (`int: 2`) - When set to a value, configures how many probe failures will be tolerated by Kubernetes.
-
-    - `initialDelaySeconds` (`int: 60`) - Sets the initial delay of the readiness probe when the container starts.
-
-    - `periodSeconds` (`int: 5`) - When set to a value, configures how often (in seconds) to perform the probe.
-
-    - `successThreshold` (`int: 1`) - When set to a value, configures the minimum consecutive successes for the probe to be considered successful after having failed.
-
-    - `timeoutSeconds` (`int: 3`) - When set to a value, configures the number of seconds after which the probe times out.
-
-  - `startupProbe` - Values that configure the startup probe for the injector.
-
-    - `failureThreshold` (`int: 2`) - When set to a value, configures how many probe failures will be tolerated by Kubernetes.
-
-    - `initialDelaySeconds` (`int: 60`) - Sets the initial delay of the startup probe when the container starts.
-
-    - `periodSeconds` (`int: 5`) - When set to a value, configures how often (in seconds) to perform the probe.
-
-    - `successThreshold` (`int: 1`) - When set to a value, configures the minimum consecutive successes for the probe to be considered successful after having failed.
-
-    - `timeoutSeconds` (`int: 3`) - When set to a value, configures the number of seconds after which the probe times out.
-
-- `server` - Values that configure running a Vault server within Kubernetes.
-
-  - `enabled` (`boolean or string: "-"`) - When set to `true`, the Vault server will be created. When set to `"-"`, defaults to the value of `global.enabled`.
-
-  - `enterpriseLicense` - This value refers to a Kubernetes secret that you have created that contains your enterprise license. If you are not using an enterprise image or if you plan to introduce the license key via another route, then leave secretName blank ("") or set it to null. Requires Vault Enterprise 1.8 or later.
-
-    - `secretName` (`string: ""`) - The name of the Kubernetes secret that holds the enterprise license. The secret must be in the same namespace that Vault is installed into.
-
-    - `secretKey` (`string: "license"`) - The key within the Kubernetes secret that holds the enterprise license.
-
-  - `image` - Values that configure the Vault Docker image.
-
-    - `repository` (`string: "hashicorp/vault"`) - The name of the Docker image for the containers running Vault.
-
-    - `tag` (`string: "1.15.2"`) - The tag of the Docker image for the containers running Vault. **This should be pinned to a specific version when running in production.** Otherwise, other changes to the chart may inadvertently upgrade your admission controller.
-
-    - `pullPolicy` (`string: "IfNotPresent"`) - The pull policy for container images. The default pull policy is `IfNotPresent` which causes the Kubelet to skip pulling an image if it already exists.
-
-  - `updateStrategyType` (`string: "OnDelete"`) - Configure the [Update Strategy Type](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies) for the StatefulSet.
-
-  - `logLevel` (`string: ""`) - Configures the Vault server logging verbosity. If set this will override values defined in the Vault configuration file.
-    Supported log levels include: `trace`, `debug`, `info`, `warn`, `error`.
-
-  - `logFormat` (`string: ""`) - Configures the Vault server logging format. If set this will override values defined in the Vault configuration file.
-    Supported log formats include: `standard`, `json`.
-
-  - `resources` (`dictionary: {}`) - The resource requests and limits (CPU, memory, etc.) for each container of the server. This should be a YAML dictionary of a Kubernetes [resource](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) object. If this isn't specified, then the pods won't request any specific amount of resources, which limits the ability for Kubernetes to make efficient use of compute resources. **Setting this is highly recommended.**
-
-    ```yaml
-    resources:
-      requests:
-        memory: '10Gi'
-      limits:
-        memory: '10Gi'
-    ```
-
-  - `ingress` - Values that configure Ingress services for Vault.
-
-    ~> If deploying on OpenShift, these ingress settings are ignored. Use the [`route`](#route) configuration to expose Vault on OpenShift. <br/> <br/>
-    If [`ha`](#ha) is enabled the Ingress will point to the active vault server via the `active` Service. This requires vault 1.4+ and [service_registration](/vault/docs/configuration/service-registration/kubernetes) to be set in the vault config.
-
-    - `enabled` (`boolean: false`) - When set to `true`, an [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) service will be created.
-
-    - `labels` (`dictionary: {}`) - Labels for the ingress service.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional annotations to
-      add to the Ingress service. This can either be YAML or a YAML-formatted
-      multi-line templated string.
-
-      ```yaml
-      annotations:
-        kubernetes.io/ingress.class: nginx
-        kubernetes.io/tls-acme: "true"
-      # or
-      annotations: |
-        kubernetes.io/ingress.class: nginx
-        kubernetes.io/tls-acme: "true"
-      ```
-
-    - `ingressClassName` (`string: ""`) - Specify the [IngressClass](https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class) that should be used to implement the Ingress
-
-    - `activeService` (`boolean: true`) - When HA mode is enabled and K8s service registration is being used, configure the ingress to point to the Vault active service.
-
-    - `extraPaths` (`array: []`) - Configures extra paths to prepend to the host configuration.
-      This is useful when working with annotation based services.
-
-      ```yaml
-      extraPaths:
-        - path: /*
-          backend:
-            service:
-              name: ssl-redirect
-              port:
-                number: use-annotation
-      ```
-
-    - `tls` (`array: []`) - Configures the TLS portion of the [Ingress spec](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls), where `hosts` is a list of the hosts defined in the Common Name of the TLS certificate, and `secretName` is the name of the Secret containing the required TLS files such as certificates and keys.
-
-      ```yaml
-      tls:
-        - hosts:
-            - sslexample.foo.com
-            - sslexample.bar.com
-          secretName: testsecret-tls
-      ```
-
-    - `hosts` - Values that configure the Ingress host rules.
-
-      - `host` (`string: "chart-example.local"`): Name of the host to use for Ingress.
-
-      - `paths` (`array: []`): Deprecated: `server.ingress.extraPaths` should be used instead. A list of paths that will be directed to the Vault service. At least one path is required.
-
-      ```yaml
-      paths:
-        - /
-        - /vault
-      ```
-
-  - `hostAliases` (`array: []`) - A list of aliases to be added to `/etc/hosts`. Specified as a YAML list following the [hostAlias format](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/)
-
-  - `route` - Values that configure Route services for Vault in OpenShift
-
-    ~> If [`ha`](#ha) is enabled the Route will point to the active vault server via the `active` Service (requires vault 1.4+ and [service_registration](/vault/docs/configuration/service-registration/kubernetes) to be set in the vault config).
-
-    - `enabled` (`boolean: false`) - When set to `true`, a Route for Vault will be created.
-
-    - `activeService` (`boolean: true`) - When HA mode is enabled and K8s service registration is being used, configure the route to point to the Vault active service.
-
-    - `labels` (`dictionary: {}`) - Labels for the Route
-
-    - `annotations` (`dictionary: {}`) - Annotations to add to the Route. This can either be YAML or a YAML-formatted multi-line templated string.
-
-    - `host` (`string: "chart-example.local"`) - Sets the hostname for the Route.
-
-    - `tls` (`dictionary: {termination: passthrough}`) - TLS config that will be passed directly to the route's TLS config, which can be used to configure other termination methods that terminate TLS at the router.
-
-  - `authDelegator` - Values that configure the Cluster Role Binding attached to the Vault service account.
-
-    - `enabled` (`boolean: true`) - When set to `true`, a Cluster Role Binding will be bound to the Vault service account. This Cluster Role Binding has the necessary privileges for Vault to use the [Kubernetes Auth Method](/vault/docs/auth/kubernetes).
-
-  - `readinessProbe` - Values that configure the readiness probe for the Vault pods.
-
-    - `enabled` (`boolean: true`) - When set to `true`, a readiness probe will be applied to the Vault pods.
-
-    - `path` (`string: ""`) - When set to a value, enables HTTP/HTTPS probes instead of using the default `exec` probe. The http/https scheme is controlled by the `tlsDisable` value.
-
-    - `failureThreshold` (`int: 2`) - When set to a value, configures how many probe failures will be tolerated by Kubernetes.
-
-    - `initialDelaySeconds` (`int: 5`) - When set to a value, configures the number of seconds after the container has started before probe initiates.
-
-    - `periodSeconds` (`int: 5`) - When set to a value, configures how often (in seconds) to perform the probe.
-
-    - `successThreshold` (`int: 1`) - When set to a value, configures the minimum consecutive successes for the probe to be considered successful after having failed.
-
-    - `timeoutSeconds` (`int: 3`) - When set to a value, configures the number of seconds after which the probe times out.
-
-    - `port` (`int: 8200`) - When set to a value, overrides the default port used for the server readiness probe.
-
-    ```yaml
-    readinessProbe:
-      enabled: true
-      path: /v1/sys/health?standbyok=true
-      failureThreshold: 2
-      initialDelaySeconds: 5
-      periodSeconds: 5
-      successThreshold: 1
-      timeoutSeconds: 3
-      port: 8200
-    ```
-
-  - `livenessProbe` - Values that configure the liveness probe for the Vault pods.
-
-    - `enabled` (`boolean: false`) - When set to `true`, a liveness probe will be applied to the Vault pods.
-
-    - `execCommand` (`array: []`) - Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
-
-    ```yaml
-    execCommand:
-      - /bin/sh
-      - -c
-      - /vault/userconfig/mylivenessscript/run.sh
-    ```
-
-    - `path` (`string: "/v1/sys/health?standbyok=true"`) - Path for the livenessProbe to use httpGet as the livenessProbe handler. The http/https scheme is controlled by the `tlsDisable` value.
-
-    - `initialDelaySeconds` (`int: 60`) - Sets the initial delay of the liveness probe when the container starts.
-
-    - `failureThreshold` (`int: 2`) - When set to a value, configures how many probe failures will be tolerated by Kubernetes.
-
-    - `periodSeconds` (`int: 5`) - When set to a value, configures how often (in seconds) to perform the probe.
-
-    - `successThreshold` (`int: 1`) - When set to a value, configures the minimum consecutive successes for the probe to be considered successful after having failed.
-
-    - `timeoutSeconds` (`int: 3`) - When set to a value, configures the number of seconds after which the probe times out.
-
-    - `port` (`int: 8200`) - Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler.
-
-    ```yaml
-    livenessProbe:
-      enabled: true
-      path: /v1/sys/health?standbyok=true
-      initialDelaySeconds: 60
-      failureThreshold: 2
-      periodSeconds: 5
-      successThreshold: 1
-      timeoutSeconds: 3
-      port: 8200
-    ```
-
-  - `terminationGracePeriodSeconds` (`int: 10`) - Optional duration in seconds the pod needs to terminate gracefully. See: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
-
-  - `preStopSleepSeconds` (`int: 5`) - Used to set the sleep time during the preStop step.
-
-  - `postStart` (`array: []`) - Used to define commands to run after the pod is ready. This can be used to automate processes such as initialization or bootstrapping auth methods.
-
-  ```yaml
-  postStart:
-    - /bin/sh
-    - -c
-    - /vault/userconfig/myscript/run.sh
-  ```
-
-  - `extraInitContainers` (`array: null`) - extraInitContainers is a list of init containers. Specified as a YAML list. This is useful if you need to run a script to provision TLS certificates or write out configuration files in a dynamic way.
-
-  - `extraContainers` (`array: null`) - The extra containers to be applied to the Vault server pods.
-
-  ```yaml
-  extraContainers:
-    - name: mycontainer
-      image: 'app:0.0.0'
-      env: ...
-  ```
-
-  - `extraEnvironmentVars` (`dictionary: {}`) - The extra environment variables to be applied to the Vault server.
-
-  ```yaml
-  # Extra Environment Variables are defined as key/value strings.
-  extraEnvironmentVars:
-    GOOGLE_REGION: global
-    GOOGLE_PROJECT: myproject
-    GOOGLE_APPLICATION_CREDENTIALS: /vault/userconfig/myproject/myproject-creds.json
-  ```
-
-  - `shareProcessNamespace` (`boolean: false`) - Enables process namespace sharing between Vault and the extraContainers. This is useful if Vault must be signaled, e.g. to send a SIGHUP for log rotation.
-
-  - `extraArgs` (`string: null`) - The extra arguments to be applied to the Vault server startup command.
-
-    ```yaml
-    extraArgs: '-config=/path/to/extra/config.hcl -log-format=json'
-    ```
-
-  - `extraPorts` (`array: []`) - additional ports to add to the server statefulset
-
-  ```yaml
-  extraPorts:
-    - containerPort: 8300
-      name: http-monitoring
-  ```
-
-  - `extraSecretEnvironmentVars` (`array: []`) - The extra environment variables populated from a secret to be applied to the Vault server.
-
-    - `envName` (`string: required`) -
-      Name of the environment variable to be populated in the Vault container.
-
-    - `secretName` (`string: required`) -
-      Name of Kubernetes secret used to populate the environment variable defined by `envName`.
-
-    - `secretKey` (`string: required`) -
-      Name of the key where the requested secret value is located in the Kubernetes secret.
-
-    ```yaml
-    # Extra Environment Variables populated from a secret.
-    extraSecretEnvironmentVars:
-      - envName: AWS_SECRET_ACCESS_KEY
-        secretName: vault
-        secretKey: AWS_SECRET_ACCESS_KEY
-    ```
-
-  - `extraVolumes` (`array: []`) - Deprecated: please use `volumes` instead. A list of extra volumes to mount to Vault servers. This is useful for bringing in extra data that can be referenced by other configurations at a well known path, such as TLS certificates. The value of this should be a list of objects. Each object supports the following keys:
-
-    - `type` (`string: required`) -
-      Type of the volume, must be one of "configMap" or "secret". Case sensitive.
-
-    - `name` (`string: required`) -
-      Name of the configMap or secret to be mounted. This also controls the path
-      that it is mounted to. The volume will be mounted to `/vault/userconfig/<name>` by default
-      unless `path` is configured.
-
-    - `path` (`string: /vault/userconfigs`) -
-      Name of the path where a configMap or secret is mounted. If not specified
-      the volume will be mounted to `/vault/userconfig/<name of volume>`.
-
-    - `defaultMode` (`string: "420"`) -
-      Default mode of the mounted files.
-
-    ```yaml
-    extraVolumes:
-      - type: 'secret'
-        name: 'vault-certs'
-        path: '/etc/pki'
-    ```
-
-  - `volumes` (`array: null`) - A list of volumes made available to all containers. This takes
-    standard Kubernetes volume definitions.
-
-    ```yaml
-    volumes:
-      - name: plugins
-        emptyDir: {}
-    ```
-
-  - `volumeMounts` (`array: null`) - A list of volumes mounts made available to all containers. This takes
-    standard Kubernetes volume definitions.
-
-    ```yaml
-    volumeMounts:
-      - mountPath: /usr/local/libexec/vault
-        name: plugins
-        readOnly: true
-    ```
-
-  - `affinity` - This value defines the [affinity](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity) for server pods. This should be either a multi-line string or YAML matching the PodSpec's affinity field. It defaults to allowing only a single pod on each node, which minimizes risk of the cluster becoming unusable if a node is lost. If you need to run more pods per node (for example, testing on Minikube), set this value to `null`.
-
-  ```yaml
-  # Recommended default server affinity:
-  affinity: |
-    podAntiAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-        matchLabels:
-          app.kubernetes.io/name: {{ template "vault.name" . }}
-          app.kubernetes.io/instance: "{{ .Release.Name }}"
-          component: server
-        topologyKey: kubernetes.io/hostname
-  ```
-
-  - `topologySpreadConstraints` (`array: []`) - [Topology settings](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/)
-    for server pods. This can either be YAML or a YAML-formatted multi-line templated string.
-
-  - `tolerations` (`array: []`) - This value defines the [tolerations](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) that are acceptable when being scheduled. This should be either a multi-line string or YAML matching the Toleration array in a PodSpec.
-
-  ```yaml
-  tolerations: |
-    - key: 'node.kubernetes.io/unreachable'
-      operator: 'Exists'
-      effect: 'NoExecute'
-      tolerationSeconds: 6000
-  ```
-
-  - `nodeSelector` (`dictionary: {}`) - This value defines additional node selection criteria for more control over where the Vault servers are deployed. This should be formatted as a multi-line string or YAML map.
-
-  ```yaml
-  nodeSelector: |
-    disktype: ssd
-  ```
-
-  - `networkPolicy` - Values that configure the Vault Network Policy.
-
-    - `enabled` (`boolean: false`) - When set to `true`, enables a Network Policy for the Vault cluster.
-
-    - `egress` (`array: []`) - This value configures the [egress](https://kubernetes.io/docs/concepts/services-networking/network-policies/) network policy rules.
-
-    ```yaml
-    egress:
-      - to:
-          - ipBlock:
-              cidr: 10.0.0.0/24
-        ports:
-          - protocol: TCP
-            port: 8200
-    ```
-
-    - `ingress` (`array: []`) - This value configures the [ingress](https://kubernetes.io/docs/concepts/services-networking/network-policies/) network policy rules. The default is below:
-
-    ```yaml
-    ingress:
-      - from:
-        - namespaceSelector: {}
-        ports:
-        - port: 8200
-          protocol: TCP
-        - port: 8201
-          protocol: TCP
-    ```
-
-  - `priorityClassName` (`string: ""`) - Priority class for server pods
-
-  - `extraLabels` (`dictionary: {}`) - This value defines additional labels for server pods.
-
-  ```yaml
-  extraLabels:
-    'sample/label1': 'foo'
-    'sample/label2': 'bar'
-  ```
-
-  - `annotations` (`dictionary: {}`) - This value defines additional annotations for server pods. This can either be YAML or a YAML-formatted multi-line templated string.
-
-  ```yaml
-  annotations:
-    "sample/annotation1": "foo"
-    "sample/annotation2": "bar"
-  # or
-  annotations: |
-    "sample/annotation1": "foo"
-    "sample/annotation2": "bar"
-  ```
-
-  - `service` - Values that configure the Kubernetes service created for Vault. These options are also used for the `active` and `standby` services when [`ha`](#ha) is enabled.
-
-    - `enabled` (`boolean: true`) - When set to `true`, a Kubernetes service will be created for Vault.
-
-    - `active` - Values that apply only to the vault-active service.
-
-      - `enabled` (`boolean: true`) - When set to `true`, the vault-active Kubernetes service will be created for Vault, selecting pods which label themselves as the cluster leader with `vault-active: "true"`.
-
-      - `annotations` (`dictionary: {}`) -  Extra annotations for the active service definition. This can either be YAML or a YAML-formatted multi-line templated string.
-
-    - `standby` - Values that apply only to the vault-standby service.
-
-      - `enabled` (`boolean: true`) - When set to `true`, the vault-standby Kubernetes service will be created for Vault, selecting pods which label themselves as a cluster follower with `vault-active: "false"`.
-
-      - `annotations` (`dictionary: {}`) -  Extra annotations for the standby service definition. This can either be YAML or a YAML-formatted multi-line templated string.
-
-    - `clusterIP` (`string`) - ClusterIP controls whether an IP address (cluster IP) is attached to the Vault service within Kubernetes. By default the Vault service will be given a Cluster IP address, set to `None` to disable. When disabled Kubernetes will create a "headless" service. Headless services can be used to communicate with pods directly through DNS instead of a round robin load balancer.
-
-    - `type` (`string: "ClusterIP"`) - Sets the type of service to create, such as `NodePort`.
-
-    - `externalTrafficPolicy` (`string: "Cluster"`) - The [externalTrafficPolicy](https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy) can be set to either Cluster or Local and is only valid for LoadBalancer and NodePort service types.
-
-    - `port` (`int: 8200`) - Port on which Vault server is listening inside the pod.
-
-    - `targetPort` (`int: 8200`) - Port on which the service is listening.
-
-    - `nodePort` (`int:`) - When type is set to `NodePort`, the bound node port can be configured using this value. A random port will be assigned if this is left blank.
-
-    - `activeNodePort` (`int:`) - (When HA mode is enabled) If type is set to "NodePort", a specific nodePort value can be configured for the `active` service, and will be random if left blank.
-
-    - `standbyNodePort` (`int:`) - (When HA mode is enabled) If type is set to "NodePort", a specific nodePort value can be configured for the `standby` service, will be random if left blank.
-
-    - `publishNotReadyAddresses` (`boolean: true`) - If true, do not wait for pods to be ready before including them in the services' targets. Does not apply to the headless service, which is used for cluster-internal communication.
-
-    - `instanceSelector`
-
-      - `enabled` (`boolean: true`) - When set to false, the service selector used for the vault, vault-active, and vault-standby services will not filter on `app.kubernetes.io/instance`. This means they may select pods from outside this deployment of the Helm chart. Does not affect the headless vault-internal service with `ClusterIP: None`.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional annotations for the service. This can either be YAML or a YAML-formatted multi-line templated string.
-
-    ```yaml
-    annotations:
-      "sample/annotation1": "foo"
-      "sample/annotation2": "bar"
-    # or
-    annotations: |
-      "sample/annotation1": "foo"
-      "sample/annotation2": "bar"
-    ```
-
-    - `ipFamilyPolicy` (`string: ""`) - The IP family and IP families options are to set the behaviour in a dual-stack environment. Omitting these values will let the service fall back to whatever the CNI dictates the defaults should be. These are only supported for kubernetes versions >=1.23. The service's [supported IP family policy](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services), can be either: `SingleStack`, `PreferDualStack`, or `RequireDualStack`.
-
-    - `serviceIPFamilies` (`array: []`) - Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.
-
-  - `serviceAccount` - Values that configure the Kubernetes service account created for Vault.
-
-    - `create` (`boolean: true`): If set to true, creates a service account used by Vault.
-
-    - `name` (`string: ""`): Name of the service account to use. If not set and create is true, a name is generated using the name of the installation (default is "vault").
-
-    - `createSecret` (`boolean: false`): Create a Kubernetes Secret object to store a non-expiring token for the service account. Prior to Kubernetes 1.24.0, Kubernetes used to generate this secret for each service account by default. Kubernetes recommends using short-lived tokens from the TokenRequest API or projected volumes instead if possible. For more details, see https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets. `server.serviceAccount.create` must be equal to 'true' in order to use this feature.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional annotations for the service account. This can either be YAML or a YAML-formatted multi-line templated string.
-
-    ```yaml
-    annotations:
-      "sample/annotation1": "foo"
-      "sample/annotation2": "bar"
-    # or
-    annotations: |
-      "sample/annotation1": "foo"
-      "sample/annotation2": "bar"
-    ```
-
-    - `extraLabels` (`dictionary: {}`) - This value defines additional labels for the Vault Server service account.
-
-    ```yaml
-    extraLabels:
-      'sample/label1': 'foo'
-      'sample/label2': 'bar'
-    ```
-
-    - `serviceDiscovery` - Values that configure permissions required for Vault Server to automatically discover and join a Vault cluster using pod metadata.
-
-      - `enabled` (`boolean: true`) - Enable or disable a service account role binding with the permissions required for Vault's Kubernetes [`service_registration`](/vault/docs/configuration/service-registration/kubernetes) config option.
-
-  - `dataStorage` - This configures the volume used for storing Vault data when not using external storage such as Consul.
-
-    - `enabled` (`boolean: true`) -
-      Enables a persistent volume to be created for storing Vault data when not using an external storage service.
-
-    - `size` (`string: 10Gi`) -
-      Size of the volume to be created for Vault's data storage when not using an external storage service.
-
-    - `storageClass` (`string: null`) -
-      Name of the storage class to use when creating the data storage volume.
-
-    - `mountPath` (`string: /vault/data`) -
-      Configures the path in the Vault pod where the data storage will be mounted.
-
-    - `accessMode` (`string: ReadWriteOnce`) -
-      Type of access mode of the storage device. See the [official Kubernetes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes) for more information.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional annotations to
-      add to the data PVCs. This can either be YAML or a YAML-formatted
-      multi-line templated string.
-
-    ```yaml
-    annotations:
-      kubernetes.io/my-pvc: foobar
-    # or
-    annotations: |
-      kubernetes.io/my-pvc: foobar
-    ```
-
-    - `labels` (`dictionary: {}`) - This value defines additional labels to add to the
-      data PVCs. This can either be YAML or a YAML-formatted multi-line templated
-      string.
-
-  - `persistentVolumeClaimRetentionPolicy` (`dictionary: {}`) - Specifies the Persistent Volume Claim (PVC) [retention policy](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention).
-
-  ```yaml
-  persistentVolumeClaimRetentionPolicy:
-    whenDeleted: Retain
-    whenScaled: Retain
-  ```
-
-  - `auditStorage` - This configures the volume used for storing Vault's audit logs. See the [Vault documentation](/vault/docs/audit) for more information.
-
-    - `enabled` (`boolean: false`) -
-      Enables a persistent volume to be created for storing Vault's audit logs.
-
-    - `size` (`string: 10Gi`) -
-      Size of the volume to be created for Vault's audit logs.
-
-    - `storageClass` (`string: null`) -
-      Name of the storage class to use when creating the audit storage volume.
-
-    - `mountPath` (`string: /vault/audit`) -
-      Configures the path in the Vault pod where the audit storage will be mounted.
-
-    - `accessMode` (`string: ReadWriteOnce`) -
-      Type of access mode of the storage device.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional annotations to
-      add to the audit PVCs. This can either be YAML or a YAML-formatted
-      multi-line templated string.
-
-    ```yaml
-    annotations:
-      kubernetes.io/my-pvc: foobar
-    # or
-    annotations: |
-      kubernetes.io/my-pvc: foobar
-    ```
-
-  - `labels` (`dictionary: {}`) - This value defines additional labels to add to the
-      audit PVCs. This can either be YAML or a YAML-formatted multi-line templated
-      string.
-
-  - `dev` - This configures `dev` mode for the Vault server.
-
-    - `enabled` (`boolean: false`) -
-      Enables `dev` mode for the Vault server. This mode is useful for experimenting with Vault without needing to unseal.
-
-    - `devRootToken` (`string: "root"`) - Configures the root token for the Vault development server.
-
-    ~> **Security Warning:** Never, ever, ever run a "dev" mode server in production. It is insecure and will lose data on every restart (since it stores data in-memory). It is only made for development or experimentation.
-
-  - `standalone` - This configures `standalone` mode for the Vault server.
-
-    - `enabled` (`boolean: true`) -
-      Enables `standalone` mode for the Vault server. This mode uses the `file` storage backend and requires a volume for persistence (`dataStorage`).
-
-    - `config` (`string or object: "{}"`) -
-      A raw string of extra HCL or JSON [configuration](/vault/docs/configuration) for Vault servers.
-      This will be saved as-is into a ConfigMap that is read by the Vault servers.
-      This can be used to add additional configuration that isn't directly exposed by the chart.
-      If an object is provided, it will be written as JSON.
-
-    ```yaml
-    # ExtraConfig values are formatted as a multi-line string:
-    config: |
-      api_addr = "http://POD_IP:8200"
-
-      listener "tcp" {
-        tls_disable = 1
-        address     = "0.0.0.0:8200"
-      }
-
-      storage "file" {
-        path = "/vault/data"
-      }
-    ```
-
-    This can also be set using Helm's `--set` flag (vault-helm v0.1.0 and later), using the following syntax:
-
-    ```shell
-    --set server.standalone.config='{ listener "tcp" { address = "0.0.0.0:8200" }'
-    ```
-
-  - `ha` - This configures `ha` mode for the Vault server.
-
-    - `enabled` (`boolean: false`) -
-      Enables `ha` mode for the Vault server. This mode uses a highly available backend storage (such as Consul) to store Vault's data. By default this is configured to use [Consul Helm](https://github.com/hashicorp/consul-helm). For a complete list of storage backends, see the [Vault documentation](/vault/docs/configuration).
-
-    - `apiAddr`: (`string: "{}"`) -
-      Set the API address configuration for a Vault cluster. If set to an empty string, the pod IP address is used.
-
-    - `clusterAddr` (`string: null`) - Set the [`cluster_addr`](/vault/docs/configuration#cluster_addr) configuration for Vault HA.
-      If null, defaults to `https://$(HOSTNAME).{{ template "vault.fullname" . }}-internal:8201`.
-
-    - `raft` - This configures `raft` integrated storage mode for the Vault server.
-
-      - `enabled` (`boolean: false`) -
-        Enables `raft` integrated storage mode for the Vault server. This mode uses persistent volumes for storage.
-
-      - `setNodeId` (`boolean: false`) - Set the Node Raft ID to the name of the pod.
-
-      - `config` (`string or object: "{}"`) -
-        A raw string of extra HCL or JSON [configuration](/vault/docs/configuration) for Vault servers.
-        This will be saved as-is into a ConfigMap that is read by the Vault servers.
-        This can be used to add additional configuration that isn't directly exposed by the chart.
-        If an object is provided, it will be written as JSON.
-
-    - `replicas` (`int: 3`) -
-      The number of pods to deploy to create a highly available cluster of Vault servers.
-
-    - `updatePartition` (`int: 0`) -
-      If an updatePartition is specified, all Pods with an ordinal that is greater than or equal to the partition will be updated when the StatefulSet’s `.spec.template` is updated. If set to `0`, this disables partition updates. For more information see the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#rolling-updates).
-
-    - `config` (`string or object: "{}"`) -
-      A raw string of extra HCL or JSON [configuration](/vault/docs/configuration) for Vault servers.
-      This will be saved as-is into a ConfigMap that is read by the Vault servers.
-      This can be used to add additional configuration that isn't directly exposed by the chart.
-      If an object is provided, it will be written as JSON.
-
-    ```yaml
-    # ExtraConfig values are formatted as a multi-line string:
-    config: |
-      ui = true
-      api_addr = "http://POD_IP:8200"
-      listener "tcp" {
-          tls_disable = 1
-          address     = "0.0.0.0:8200"
-      }
-
-      storage "consul" {
-          path = "vault/"
-          address = "HOST_IP:8500"
-      }
-    ```
-
-    This can also be set using Helm's `--set` flag (vault-helm v0.1.0 and later), using the following syntax:
-
-    ```shell
-    --set server.ha.config='{ listener "tcp" { address = "0.0.0.0:8200" }'
-    ```
-
-  - `disruptionBudget` - Values that configures the disruption budget policy. See the [official Kubernetes documentation](https://kubernetes.io/docs/tasks/run-application/configure-pdb/) for more information.
-
-    - `enabled` (`boolean: true`) -
-      Enables disruption budget policy to limit the number of pods that are down simultaneously from voluntary disruptions.
-
-    - `maxUnavailable` (`int: null`) -
-      The maximum number of unavailable pods. By default, this will be automatically
-      computed based on the `server.replicas` value to be `(n/2)-1`. If you need to set
-      this to `0`, you will need to add a `--set 'server.disruptionBudget.maxUnavailable=0'`
-      flag to the helm chart installation command because of a limitation in the Helm
-      templating language.
-
-  - `statefulSet` - This configures settings for the Vault Statefulset.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional annotations to
-      add to the Vault statefulset. This can either be YAML or a YAML-formatted
-      multi-line templated string.
-
-      ```yaml
-      annotations:
-        kubernetes.io/my-statefulset: foobar
-      # or
-      annotations: |
-        kubernetes.io/my-statefulset: foobar
-      ```
-
-  - `securityContext` - Set the Pod and container security contexts
-
-    - `pod` (`dictionary: {}`) - Defines the securityContext for the server Pods, as YAML or a YAML-formatted multi-line templated string.
-
-      Default if not specified and `global.openshift=false`:
-
-      ```yaml
-      runAsNonRoot: true
-      runAsGroup: {{ .Values.server.gid | default 1000 }}
-      runAsUser: {{ .Values.server.uid | default 100 }}
-      fsGroup: {{ .Values.server.gid | default 1000 }}
-      ```
-
-      Defaults to empty if not specified and `global.openshift=true`.
-
-    - `container` (`dictionary: {}`) - Defines the securityContext for the server containers, as YAML or a YAML-formatted multi-line templated string.
-
-      Default if not specified and `global.openshift=false`:
-
-      ```yaml
-      allowPrivilegeEscalation: false
-      ```
-
-      Defaults to empty if not specified and `global.openshift=true`.
-
-- `ui` - Values that configure the Vault UI.
-
-  - `enabled` (`boolean: false`) - If true, the UI will be enabled. The UI will only be enabled on Vault servers. If `server.enabled` is false, then this setting has no effect. To expose the UI in some way, you must configure `ui.service`.
-
-  - `serviceType` (`string: ClusterIP`) - The service type to register. This defaults to `ClusterIP`.
-    The available service types are documented on
-    [the Kubernetes website](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types).
-
-  - `publishNotReadyAddresses` (`boolean: true`) - If set to true, will route traffic to Vault pods that aren't ready (if they're sealed or uninitialized.
-
-  - `activeVaultPodOnly` (`boolean: false`) - If set to true, the UI service will only route to the active pod in a Vault HA cluster.
-
-  - `serviceNodePort` (`int: null`) - Sets the Node Port value when using `serviceType: NodePort` on the Vault UI service.
-
-  - `externalPort` (`int: 8200`) - Sets the external port value of the service.
-
-  - `targetPort` (`int: 8200`) - Sets the target port value of the service.
-
-  - `serviceIPFamilyPolicy` (`string: ""`) - The IP family and IP families options are to set the behaviour in a dual-stack environment. Omitting these values will let the service fall back to whatever the CNI dictates the defaults should be. These are only supported for kubernetes versions >=1.23. The service's [supported IP family policy](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services), can be either: `SingleStack`, `PreferDualStack`, or `RequireDualStack`.
-
-  - `serviceIPFamilies` (`array: []`) - Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.
-
-  - `externalTrafficPolicy` (`string: "Cluster"`) - The [externalTrafficPolicy](https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy) can be set to either Cluster or Local and is only valid for LoadBalancer and NodePort service types.
-
-  - `loadBalancerSourceRanges` (`array`) - This value defines additional source CIDRs when using `serviceType: LoadBalancer`.
-
-  ```yaml
-  loadBalancerSourceRanges:
-    - 10.0.0.0/16
-    - 120.78.23.3/32
-  ```
-
-  - `loadBalancerIP` (`string`) - This value defines the IP address of the load balancer when using `serviceType: LoadBalancer`.
-
-  - `annotations` (`dictionary: {}`) - This value defines additional annotations for the UI service. This can either be YAML or a YAML-formatted multi-line templated string.
-
-  ```yaml
-  annotations:
-    "sample/annotation1": "foo"
-    "sample/annotation2": "bar"
-  # or
-  annotations: |
-    "sample/annotation1": "foo"
-    "sample/annotation2": "bar"
-  ```
-
-- `csi` - Values that configure running the Vault CSI Provider.
-
-  - `enabled` (`boolean: false`) - When set to `true`, the Vault CSI Provider daemonset will be created.
-
-  - `image` - Values that configure the Vault CSI Provider Docker image.
-
-    - `repository` (`string: "hashicorp/vault-csi-provider"`) - The name of the Docker image for the Vault CSI Provider.
-
-    - `tag` (`string: "1.4.1"`) - The tag of the Docker image for the Vault CSI Provider.. **This should be pinned to a specific version when running in production.** Otherwise, other changes to the chart may inadvertently upgrade your CSI provider.
-
-    - `pullPolicy` (`string: "IfNotPresent"`) - The pull policy for container images. The default pull policy is `IfNotPresent` which causes the Kubelet to skip pulling an image if it already exists locally.
-
-  - `volumes` (`array: null`) - A list of volumes made available to all containers. This takes
-    standard Kubernetes volume definitions.
-
-    ```yaml
-    volumes:
-      - name: plugins
-        emptyDir: {}
-    ```
-
-  - `volumeMounts` (`array: null`) - A list of volumes mounts made available to all containers. This takes
-    standard Kubernetes volume mount definitions.
-
-    ```yaml
-    volumeMounts:
-      - mountPath: /usr/local/libexec/vault
-        name: plugins
-        readOnly: true
-    ```
-
-  - `resources` (`dictionary: {}`) - The resource requests and limits (CPU, memory, etc.) for each of the CSI containers. This should be a YAML dictionary of a Kubernetes [resource](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) object. If this isn't specified, then the pods won't request any specific amount of resources, which limits the ability for Kubernetes to make efficient use of compute resources.<br /> **Setting this is highly recommended.**
-
-    ```yaml
-    resources:
-      requests:
-        memory: '10Gi'
-      limits:
-        memory: '10Gi'
-    ```
-
-  - `hmacSecretName` (`string: ""`) - Override the default secret name for the CSI Provider's HMAC key used for generating secret versions.
-
-  - `daemonSet` - Values that configure the Vault CSI Provider daemonSet.
-
-    - `updateStrategy` - Values that configure the Vault CSI Provider update strategy.
-
-      - `type` (`string: "RollingUpdate"`) - The [type of update strategy](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies) to be used when the daemonset is updated using Helm upgrades.
-
-      - `maxUnavailable` (`int: null`) - The maximum number of unavailable pods during an upgrade.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional annotations to
-      add to the Vault CSI Provider daemonset. This can either be YAML or a YAML-formatted
-      multi-line templated string.
-
-      ```yaml
-      annotations:
-        foo: bar
-      # or
-      annotations: |
-        foo: bar
-      ```
-
-    - `extraLabels` (`dictionary: {}`) - This value defines additional labels for the CSI provider daemonset.
-
-    - `providersDir` (`string: "/etc/kubernetes/secrets-store-csi-providers"`) - Provider host path (must match the CSI provider's path)
-
-    - `kubeletRootDir` (`string: "/var/lib/kubelet"`) - Kubelet host path
-
-    - `securityContext` - Security context for the pod template and container in the csi provider daemonSet
-
-      - `pod` (`dictionary: {}`) - Pod-level securityContext. May be specified as YAML or a YAML-formatted multi-line templated string.
-
-      - `container` (`dictionary: {}`) - Container-level securityContext. May be specified as YAML or a YAML-formatted multi-line templated string.
-
-  - `pod` - Values that configure the Vault CSI Provider pod.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional annotations to
-      add to the Vault CSI Provider pods. This can either be YAML or a YAML-formatted
-      multi-line templated string.
-
-      ```yaml
-      annotations:
-        foo: bar
-      # or
-      annotations: |
-        foo: bar
-      ```
-
-    - `extraLabels` (`dictionary: {}`) - This value defines additional labels for CSI provider pods.
-
-    - `nodeSelector` (`dictionary: {}`) - [nodeSelector](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector) labels for csi pod assignment, formatted as a multi-line string or YAML map.
-
-    ```yaml
-    nodeSelector:
-      beta.kubernetes.io/arch: amd64
-    ```
-
-    - `affinity` (`dictionary: {}`) - This should be either a multi-line string or YAML matching the PodSpec's affinity field.
-
-    - `tolerations` (`array: []`) - Toleration Settings for CSI pods. This should be a multi-line string or YAML matching the Toleration array in a PodSpec.
-
-  - `priorityClassName` (`string: ""`) - Priority class for CSI Provider pods
-
-  - `serviceAccount` - Values that configure the Vault CSI Provider's serviceaccount.
-
-    - `annotations` (`dictionary: {}`) - This value defines additional
-      annotations for the serviceAccount definition. This can either be YAML or
-      a YAML-formatted multi-line templated string.
-
-      ```yaml
-      annotations:
-        foo: bar
-      # or
-      annotations: |
-        foo: bar
-      ```
-
-    - `extraLabels` (`dictionary: {}`) - This value defines additional labels for the CSI provider service account.
-
-  - `readinessProbe` - Values that configure the readiness probe for the Vault CSI Provider pods.
-
-    - `failureThreshold` (`int: 2`) - When set to a value, configures how many probe failures will be tolerated by Kubernetes.
-
-    - `initialDelaySeconds` (`int: 5`) - When set to a value, configures the number of seconds after the container has started before probe initiates.
-
-    - `periodSeconds` (`int: 5`) - When set to a value, configures how often (in seconds) to perform the probe.
-
-    - `successThreshold` (`int: 1`) - When set to a value, configures the minimum consecutive successes for the probe to be considered successful after having failed.
-
-    - `timeoutSeconds` (`int: 3`) - When set to a value, configures the number of seconds after which the probe times out.
-
-  - `livenessProbe` - Values that configure the liveness probe for the Vault CSI Provider pods.
-
-    - `initialDelaySeconds` (`int: 5`) - Sets the initial delay of the liveness probe when the container starts.
-
-    - `failureThreshold` (`int: 2`) - When set to a value, configures how many probe failures will be tolerated by Kubernetes.
-
-    - `periodSeconds` (`int: 5`) - When set to a value, configures how often (in seconds) to perform the probe.
-
-    - `successThreshold` (`int: 1`) - When set to a value, configures the minimum consecutive successes for the probe to be considered successful after having failed.
-
-    - `timeoutSeconds` (`int: 3`) - When set to a value, configures the number of seconds after which the probe times out.
-
-  - `debug` (`bool: false`) - When set to true, enables debug logging on the Vault CSI Provider daemonset.
-
-  - `extraArgs` (`array: []`) - The extra arguments to be applied to the CSI pod startup command. See [here](/vault/docs/platform/k8s/csi/configurations#command-line-arguments) for available flags.
-
-  - `agent` - Configures the Vault Agent sidecar for the CSI Provider
-    - `enabled` (`bool: true`) - whether to enable the agent sidecar for the CSI provider
-    - `extraArgs` (`array: []`) - The extra arguments to be applied to the agent startup command.
-
-    - `image` - Values that configure the Vault Agent sidecar image for the CSI Provider.
-      - `pullPolicy` (`string: "IfNotPresent"`) - The pull policy for agent image. The default pull policy is `IfNotPresent` which causes the Kubelet to skip pulling an image if it already exists.
-
-      - `repository` (`string: "hashicorp/vault"`) - The name of the Docker image for the Vault Agent sidecar. This should be set to the official Vault Docker image.
-
-      - `tag` (`string: "1.15.2"`) - The tag of the Vault Docker image to use for the Vault Agent Sidecar.
-
-    - `logFormat` (`string: "standard"`) -
-    - `logLevel` (`string: "info"`) -
-    - `resources` (`dictionary: {}`) - The resource requests and limits (CPU, memory, etc.) for the agent. This should be a YAML dictionary of a Kubernetes [resource](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) object.
-    ```yaml
-    resources:
-      requests:
-        memory: '256Mi'
-        cpu: '250m'
-      limits:
-        memory: '256Mi'
-        cpu: '250m'
-    ```
-
-- `serverTelemetry` - Values the configure metrics and telemetry. Enabling these features requires setting
-  the `telemetry {}` stanza in the Vault configuration. See the [telemetry](/vault/docs/configuration/telemetry)
-  [docs](/vault/docs/internals/telemetry) for more on the Vault configuration.
-
-  Currently, this chart does not support authenticating to Vault's metrics endpoint, so the following `telemetry {}` block must be included in the `listener "tcp" {}` stanza of the Vault configuration:
-
-  ```yaml
-  listener "tcp" {
-    tls_disable = 1
-    address     = "0.0.0.0:8200"
-
-    telemetry {
-      unauthenticated_metrics_access = "true"
-    }
-  }
-  ```
-
-  In addition, a top level `telemetry {}` stanza must also be included in the Vault configuration, such as:
-
-  ```yaml
-  telemetry {
-    prometheus_retention_time = "30s",
-    disable_hostname = true
-  }
-  ```
-
-  - `serviceMonitor` - Values that configure monitoring the Vault server
-
-    - `enabled` (`boolean: false`) - When set to `true`, enable deployment of the Vault Server
-      ServiceMonitor CustomResource. The Prometheus operator *must* be installed before enabling this
-      feature. If not, the chart will fail to install due to missing CustomResourceDefinitions provided by
-      the operator.
-
-      Instructions on how to install the Helm chart can be found [here](https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack).
-
-      More information can be found here in the
-      [these](https://github.com/prometheus-operator/prometheus-operator)
-      [repositories](https://github.com/prometheus-operator/kube-prometheus)
-
-    - `selectors` (`dictionary: {}`) - Selector labels to add to the ServiceMonitor.
-
-    - `interval` (`string: "30s"`) - Interval at which Prometheus scrapes metrics.
-
-    - `scrapeTimeout` (`string: "10s"`) - Timeout for Prometheus scrapes.
-
-  - `prometheusRules` - Values that configure Prometheus rules.
-
-    - `enabled` (`boolean: false`) - Deploy the PrometheusRule custom resource for AlertManager-based
-      alerts. Requires that AlertManager is properly deployed.
-
-    - `selectors` (`dictionary: {}`) - Selector labels to add to the Prometheus rules.
-
-    - `rules`: (`array: []`) - Prometheus rules to create.
-
-      For example:
-      ```yaml
-      rules:
-        - alert: vault-HighResponseTime
-          annotations:
-            message: The response time of Vault is over 500ms on average over the last 5 minutes.
-          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 500
-          for: 5m
-          labels:
-            severity: warning
-        - alert: vault-HighResponseTime
-          annotations:
-            message: The response time of Vault is over 1s on average over the last 5 minutes.
-          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 1000
-          for: 5m
-          labels:
-            severity: critical
-      ```
diff --git a/website/content/docs/platform/k8s/helm/enterprise.mdx b/website/content/docs/platform/k8s/helm/enterprise.mdx
deleted file mode 100644
index 989a234122f..00000000000
--- a/website/content/docs/platform/k8s/helm/enterprise.mdx
+++ /dev/null
@@ -1,133 +0,0 @@
----
-layout: docs
-page_title: Vault Enterprise License Management - Kubernetes
-description: >-
-  Vault Helm supports deploying Vault Enterprise, including license autoloading.
----
-
-# Vault enterprise license management
-
-You can use this Helm chart to deploy Vault Enterprise by following a few extra steps around licensing.
-
-~> **Note:** As of Vault Enterprise 1.8, the license must be specified via HCL configuration or environment variables on startup, unless the Vault cluster was created with an older Vault version and the license was stored. More information is available in the [Vault Enterprise License docs](/vault/docs/enterprise/license).
-
-@include 'helm/version.mdx'
-
-## Vault enterprise 1.8+
-
-### License install
-
-First create a Kubernetes secret using the contents of your license file. For example, the following commands create a secret with the name `vault-ent-license` and key `license`:
-
-```bash
-secret=$(cat 1931d1f4-bdfd-6881-f3f5-19349374841f.hclic)
-kubectl create secret generic vault-ent-license --from-literal="license=${secret}"
-```
-
--> **Note:** If you cannot find your `.hclic` file, please contact your sales team or Technical Account Manager.
-
-In your chart overrides, set the values of [`server.image`](/vault/docs/platform/k8s/helm/configuration#image-2) to one of the enterprise [release tags](https://hub.docker.com/r/hashicorp/vault-enterprise/tags). Also set the name of the secret you just created in [`server.enterpriseLicense`](/vault/docs/platform/k8s/helm/configuration#enterpriselicense).
-
-```yaml
-# config.yaml
-server:
-  image:
-    repository: hashicorp/vault-enterprise
-    tag: 1.15.2-ent
-  enterpriseLicense:
-    secretName: vault-ent-license
-```
-
-Now run `helm install`:
-
-```shell-session
-$ helm install hashicorp hashicorp/vault -f config.yaml
-```
-
-Once the cluster is [initialized and unsealed](/vault/docs/platform/k8s/helm/run), you may check the license status using the `vault license get` command:
-
-```shell
-kubectl exec -ti vault-0 -- vault license get
-```
-
-### License update
-
-To update the autoloaded license in Vault, you may do the following:
-
-- Update your license secret with the new license data
-
-```shell
-new_secret=$(base64 < ./new-license.hclic | tr -d '\n')
-
-cat > patch-license.yaml <<EOF
-data:
-  license: ${new_secret}
-EOF
-
-kubectl patch secret vault-ent-license --patch "$(cat patch-license.yaml)"
-```
-
-- Wait until [`vault license inspect`](/vault/docs/commands/license/inspect) shows the updated license
-
-  Since the `inspect` command is reading the license file from the mounted secret, this tells you when the updated secret has been propagated to the mount on the Vault pod.
-
-```shell
-kubectl exec vault-0 -- vault license inspect
-```
-
-- Reload Vault's license config
-
-  You may use the [`sys/config/reload/license` API endpoint](/vault/api-docs/system/config-reload#reload-license-file):
-
-```shell
-kubectl exec vault-0 -- vault write -f sys/config/reload/license
-```
-
-Or you may issue an HUP signal directly to Vault:
-
-```shell
-kubectl exec vault-0 -- pkill -HUP vault
-```
-
-- Verify that [`vault license get`](/vault/docs/commands/license/get) shows the updated license
-
-```shell
-kubectl exec vault-0 -- vault license get
-```
-
-## Vault enterprise prior to 1.8
-
-In your chart overrides, set the values of `server.image` to one of the enterprise [release tags](https://hub.docker.com/r/hashicorp/vault-enterprise/tags). Install the chart, and initialize and unseal vault as described in [Running Vault](/vault/docs/platform/k8s/helm/run).
-
-After Vault has been initialized and unsealed, setup a port-forward tunnel to the Vault Enterprise cluster:
-
-```shell
-kubectl port-forward vault-0 8200:8200
-```
-
-Next, in a separate terminal, create a `payload.json` file that contains the license key like this example:
-
-```json
-{
-  "text": "01ABCDEFG..."
-}
-```
-
-Finally, using curl, apply the license key to the Vault API:
-
-```bash
-curl \
-  --header "X-Vault-Token: VAULT_LOGIN_TOKEN_HERE" \
-  --request POST \
-  --data @payload.json \
-  http://127.0.0.1:8200/v1/sys/license
-
-```
-
-To verify that the license installation worked correctly, using `curl`, run the following:
-
-```shell
-curl \
-  --header "X-Vault-Token: VAULT_LOGIN_TOKEN_HERE" \
-  http://127.0.0.1:8200/v1/sys/license
-```
diff --git a/website/content/docs/platform/k8s/helm/examples/development.mdx b/website/content/docs/platform/k8s/helm/examples/development.mdx
deleted file mode 100644
index ba1038c6716..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/development.mdx
+++ /dev/null
@@ -1,25 +0,0 @@
----
-layout: 'docs'
-page_title: 'Development'
-sidebar_current: 'docs-platform-k8s-examples-development'
-description: |-
-  Describes how to set up a development Vault
----
-
-# Development
-
-@include 'helm/version.mdx'
-
-The below `values.yaml` can be used to set up a single development Vault server.
-
-```yaml
-server:
-  dev:
-    enabled: true
-```
-
-## Tutorial
-
-Refer to the [Injecting Secrets into Kubernetes Pods via Vault Helm
-Sidecar](/vault/tutorials/kubernetes/kubernetes-sidecar) tutorial
-to learn how to set up Vault and the Vault Agent Injector service with the Vault Helm chart.
diff --git a/website/content/docs/platform/k8s/helm/examples/enterprise-dr-with-raft.mdx b/website/content/docs/platform/k8s/helm/examples/enterprise-dr-with-raft.mdx
deleted file mode 100644
index 1781c4fb380..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/enterprise-dr-with-raft.mdx
+++ /dev/null
@@ -1,157 +0,0 @@
----
-layout: 'docs'
-page_title: 'Highly Available Vault Enterprise Disaster Recovery Clusters with Raft'
-sidebar_current: 'docs-platform-k8s-examples-enterprise-dr-with-raft'
-description: |-
-  Describes how to set up Diaster Recovery clusters with Integrated Storage (Raft)
----
-
-# Highly available Vault enterprise disaster recovery clusters with integrated storage (Raft)
-
-@include 'helm/version.mdx'
-
-The following is an example of creating a disaster recovery cluster using Vault Helm.
-
-For more information on Disaster Recovery, [see the official documentation](/vault/docs/enterprise/replication/).
-
--> For license configuration refer to [Running Vault Enterprise](/vault/docs/platform/k8s/helm/enterprise).
-
-## Primary cluster
-
-First, create the primary cluster:
-
-```shell
-helm install vault-primary hashicorp/vault \
-  --set='server.image.repository=hashicorp/vault-enterprise' \
-  --set='server.image.tag=1.15.2-ent' \
-  --set='server.ha.enabled=true' \
-  --set='server.ha.raft.enabled=true'
-```
-
-Next, initialize and unseal `vault-primary-0` pod:
-
-```shell
-kubectl exec -ti vault-primary-0 -- vault operator init
-kubectl exec -ti vault-primary-0 -- vault operator unseal
-```
-
-Finally, join the remaining pods to the Raft cluster and unseal them. The pods
-will need to communicate directly so we'll configure the pods to use the internal
-service provided by the Helm chart:
-
-```shell
-kubectl exec -ti vault-primary-1 -- vault operator raft join http://vault-primary-0.vault-primary-internal:8200
-kubectl exec -ti vault-primary-1 -- vault operator unseal
-
-kubectl exec -ti vault-primary-2 -- vault operator raft join http://vault-primary-0.vault-primary-internal:8200
-kubectl exec -ti vault-primary-2 -- vault operator unseal
-```
-
-To verify if the Raft cluster has successfully been initialized, run the following.
-
-First, login using the `root` token on the `vault-primary-0` pod:
-
-```shell
-kubectl exec -ti vault-primary-0 -- vault login
-```
-
-Next, list all the raft peers:
-
-```shell
-$ kubectl exec -ti vault-primary-0 -- vault operator raft list-peers
-
-Node                                    Address                        State       Voter
-----                                    -------                        -----       -----
-a1799962-8711-7f28-23f0-cea05c8a527d    vault-primary-0.vault-primary-internal:8201    leader      true
-e6876c97-aaaa-a92e-b99a-0aafab105745    vault-primary-1.vault-primary-internal:8201    follower    true
-4b5d7383-ff31-44df-e008-6a606828823b    vault-primary-2.vault-primary-internal:8201    follower    true
-```
-
-## Secondary cluster
-
-With the primary cluster created, next create a secondary cluster and enable
-disaster recovery replication.
-
-```shell
-helm install vault-secondary hashicorp/vault \
-  --set='server.image.repository=hashicorp/vault-enterprise' \
-  --set='server.image.tag=1.15.2-ent' \
-  --set='server.ha.enabled=true' \
-  --set='server.ha.raft.enabled=true'
-```
-
-Next, initialize and unseal `vault-secondary-0` pod:
-
-```shell
-kubectl exec -ti vault-secondary-0 -- vault operator init
-kubectl exec -ti vault-secondary-0 -- vault operator unseal
-```
-
-Finally, join the remaining pods to the Raft cluster and unseal them. The pods
-will need to communicate directly so we'll configure the pods to use the internal
-service provided by the Helm chart:
-
-```shell
-kubectl exec -ti vault-secondary-1 -- vault operator raft join http://vault-secondary-0.vault-secondary-internal:8200
-kubectl exec -ti vault-secondary-1 -- vault operator unseal
-
-kubectl exec -ti vault-secondary-2 -- vault operator raft join http://vault-secondary-0.vault-secondary-internal:8200
-kubectl exec -ti vault-secondary-2 -- vault operator unseal
-```
-
-To verify if the Raft cluster has successfully been initialized, run the following.
-
-First, login using the `root` token on the `vault-secondary-0` pod:
-
-```shell
-kubectl exec -ti vault-secondary-0 -- vault login
-```
-
-Next, list all the raft peers:
-
-```shell
-$ kubectl exec -ti vault-secondary-0 -- vault operator raft list-peers
-
-Node                                    Address                        State       Voter
-----                                    -------                        -----       -----
-a1799962-8711-7f28-23f0-cea05c8a527d    vault-secondary-0.vault-secondary-internal:8201    leader      true
-e6876c97-aaaa-a92e-b99a-0aafab105745    vault-secondary-1.vault-secondary-internal:8201    follower    true
-4b5d7383-ff31-44df-e008-6a606828823b    vault-secondary-2.vault-secondary-internal:8201    follower    true
-```
-
-## Enable disaster recovery replication on primary
-
-With the initial clusters setup, we can now configure them for disaster recovery replication.
-
-First, on the primary cluster, enable replication:
-
-```shell
-kubectl exec -ti vault-primary-0 -- vault write -f sys/replication/dr/primary/enable primary_cluster_addr=https://vault-primary-active:8201
-```
-
-Next, create a token the secondary cluster will use to configure replication:
-
-```shell
-kubectl exec -ti vault-primary-0 -- vault write sys/replication/dr/primary/secondary-token id=secondary
-```
-
-The token in the output will be used when configuring the secondary cluster.
-
-## Enable disaster recovery replication on secondary
-
-Using the token created in the last step, enable disaster recovery replication on the secondary:
-
-```shell
-kubectl exec -ti vault-secondary-0 -- vault write sys/replication/dr/secondary/enable token=<TOKEN FROM PRIMARY>
-```
-
-Last, delete the remainder secondary pods and unseal them using the primary unseal token
-after Kubernetes reschedules them:
-
-```shell
-kubectl delete pod vault-secondary-1
-kubectl exec -ti vault-secondary-1 -- vault operator unseal <PRIMARY UNSEAL TOKEN>
-
-kubectl delete pod vault-secondary-2
-kubectl exec -ti vault-secondary-2 -- vault operator unseal <PRIMARY UNSEAL TOKEN>
-```
diff --git a/website/content/docs/platform/k8s/helm/examples/enterprise-perf-with-raft.mdx b/website/content/docs/platform/k8s/helm/examples/enterprise-perf-with-raft.mdx
deleted file mode 100644
index 601064443f8..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/enterprise-perf-with-raft.mdx
+++ /dev/null
@@ -1,156 +0,0 @@
----
-layout: 'docs'
-page_title: 'Highly Available Vault Enterprise Performance Clusters with Raft'
-sidebar_current: 'docs-platform-k8s-examples-enterprise-perf-with-raft'
-description: |-
-  Describes how to set up Performance clusters with Integrated Storage (Raft)
----
-
-# Highly available Vault enterprise performance clusters with integrated storage (Raft)
-
-@include 'helm/version.mdx'
-
-The following is an example of creating a performance cluster using Vault Helm.
-
-For more information on Disaster Recovery, [see the official documentation](/vault/docs/enterprise/replication/).
-
--> For license configuration refer to [Running Vault Enterprise](/vault/docs/platform/k8s/helm/enterprise).
-
-## Primary cluster
-
-First, create the primary cluster:
-
-```shell
-helm install vault-primary hashicorp/vault \
-  --set='server.image.repository=hashicorp/vault-enterprise' \
-  --set='server.image.tag=1.15.2-ent' \
-  --set='server.ha.enabled=true' \
-  --set='server.ha.raft.enabled=true'
-```
-
-Next, initialize and unseal `vault-primary-0` pod:
-
-```shell
-kubectl exec -ti vault-primary-0 -- vault operator init
-kubectl exec -ti vault-primary-0 -- vault operator unseal
-```
-
-Finally, join the remaining pods to the Raft cluster and unseal them. The pods
-will need to communicate directly so we'll configure the pods to use the internal
-service provided by the Helm chart:
-
-```shell
-kubectl exec -ti vault-primary-1 -- vault operator raft join http://vault-primary-0.vault-primary-internal:8200
-kubectl exec -ti vault-primary-1 -- vault operator unseal
-
-kubectl exec -ti vault-primary-2 -- vault operator raft join http://vault-primary-0.vault-primary-internal:8200
-kubectl exec -ti vault-primary-2 -- vault operator unseal
-```
-
-To verify if the Raft cluster has successfully been initialized, run the following.
-
-First, login using the `root` token on the `vault-primary-0` pod:
-
-```shell
-kubectl exec -ti vault-primary-0 -- vault login
-```
-
-Next, list all the raft peers:
-
-```shell
-$ kubectl exec -ti vault-primary-0 -- vault operator raft list-peers
-
-Node                                    Address                        State       Voter
-----                                    -------                        -----       -----
-a1799962-8711-7f28-23f0-cea05c8a527d    vault-primary-0.vault-primary-internal:8201    leader      true
-e6876c97-aaaa-a92e-b99a-0aafab105745    vault-primary-1.vault-primary-internal:8201    follower    true
-4b5d7383-ff31-44df-e008-6a606828823b    vault-primary-2.vault-primary-internal:8201    follower    true
-```
-
-## Secondary cluster
-
-With the primary cluster created, next create a secondary cluster.
-
-```shell
-helm install vault-secondary hashicorp/vault \
-  --set='server.image.repository=hashicorp/vault-enterprise' \
-  --set='server.image.tag=1.15.2-ent' \
-  --set='server.ha.enabled=true' \
-  --set='server.ha.raft.enabled=true'
-```
-
-Next, initialize and unseal `vault-secondary-0` pod:
-
-```shell
-kubectl exec -ti vault-secondary-0 -- vault operator init
-kubectl exec -ti vault-secondary-0 -- vault operator unseal
-```
-
-Finally, join the remaining pods to the Raft cluster and unseal them. The pods
-will need to communicate directly so we'll configure the pods to use the internal
-service provided by the Helm chart:
-
-```shell
-kubectl exec -ti vault-secondary-1 -- vault operator raft join http://vault-secondary-0.vault-secondary-internal:8200
-kubectl exec -ti vault-secondary-1 -- vault operator unseal
-
-kubectl exec -ti vault-secondary-2 -- vault operator raft join http://vault-secondary-0.vault-secondary-internal:8200
-kubectl exec -ti vault-secondary-2 -- vault operator unseal
-```
-
-To verify if the Raft cluster has successfully been initialized, run the following.
-
-First, login using the `root` token on the `vault-secondary-0` pod:
-
-```shell
-kubectl exec -ti vault-secondary-0 -- vault login
-```
-
-Next, list all the raft peers:
-
-```shell
-$ kubectl exec -ti vault-secondary-0 -- vault operator raft list-peers
-
-Node                                    Address                        State       Voter
-----                                    -------                        -----       -----
-a1799962-8711-7f28-23f0-cea05c8a527d    vault-secondary-0.vault-secondary-internal:8201    leader      true
-e6876c97-aaaa-a92e-b99a-0aafab105745    vault-secondary-1.vault-secondary-internal:8201    follower    true
-4b5d7383-ff31-44df-e008-6a606828823b    vault-secondary-2.vault-secondary-internal:8201    follower    true
-```
-
-## Enable performance replication on primary
-
-With the initial clusters setup, we can now configure them for Performance Replication.
-
-First, on the primary cluster, enable replication:
-
-```shell
-kubectl exec -ti vault-primary-0 -- vault write -f sys/replication/performance/primary/enable primary_cluster_addr=https://vault-primary-active:8201
-```
-
-Next, create a token the secondary cluster will use to configure replication:
-
-```shell
-kubectl exec -ti vault-primary-0 -- vault write sys/replication/performance/primary/secondary-token id=secondary
-```
-
-The token in the output will be used when configuring the secondary cluster.
-
-## Enable performance replication on secondary
-
-Using the token created in the last step, enable Performance Replication on the secondary:
-
-```shell
-kubectl exec -ti vault-secondary-0 -- vault write sys/replication/performance/secondary/enable token=<TOKEN FROM PRIMARY>
-```
-
-Last, delete the remainder secondary pods and unseal them using the primary unseal token
-after Kubernetes reschedules them:
-
-```shell
-kubectl delete pod vault-secondary-1
-kubectl exec -ti vault-secondary-1 -- vault operator unseal <PRIMARY UNSEAL TOKEN>
-
-kubectl delete pod vault-secondary-2
-kubectl exec -ti vault-secondary-2 -- vault operator unseal <PRIMARY UNSEAL TOKEN>
-```
diff --git a/website/content/docs/platform/k8s/helm/examples/enterprise-with-raft.mdx b/website/content/docs/platform/k8s/helm/examples/enterprise-with-raft.mdx
deleted file mode 100644
index 3cd246f246e..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/enterprise-with-raft.mdx
+++ /dev/null
@@ -1,62 +0,0 @@
----
-layout: 'docs'
-page_title: 'Highly Available Vault Enterprise Cluster with Raft'
-sidebar_current: 'docs-platform-k8s-examples-enterprise-with-raft'
-description: |-
-  Describes how to set up a highly available Vault Enterprise cluster with Integrated Storage (Raft)
----
-
-# Highly available Vault enterprise cluster with integrated storage (Raft)
-
-@include 'helm/version.mdx'
-
-Integrated Storage (raft) can be enabled using the `server.ha.raft.enabled` value:
-
-```shell
-helm install vault hashicorp/vault \
-  --set='server.image.repository=hashicorp/vault-enterprise' \
-  --set='server.image.tag=1.15.2-ent' \
-  --set='server.ha.enabled=true' \
-  --set='server.ha.raft.enabled=true'
-```
-
--> For license configuration refer to [Running Vault Enterprise](/vault/docs/platform/k8s/helm/enterprise).
-
-Next, initialize and unseal `vault-0` pod:
-
-```shell
-kubectl exec -ti vault-0 -- vault operator init
-kubectl exec -ti vault-0 -- vault operator unseal
-```
-
-Finally, join the remaining pods to the Raft cluster and unseal them. The pods
-will need to communicate directly so we'll configure the pods to use the internal
-service provided by the Helm chart:
-
-```shell
-kubectl exec -ti vault-1 -- vault operator raft join http://vault-0.vault-internal:8200
-kubectl exec -ti vault-1 -- vault operator unseal
-
-kubectl exec -ti vault-2 -- vault operator raft join http://vault-0.vault-internal:8200
-kubectl exec -ti vault-2 -- vault operator unseal
-```
-
-To verify if the Raft cluster has successfully been initialized, run the following.
-
-First, login using the `root` token on the `vault-0` pod:
-
-```shell
-kubectl exec -ti vault-0 -- vault login
-```
-
-Next, list all the raft peers:
-
-```shell
-$ kubectl exec -ti vault-0 -- vault operator raft list-peers
-
-Node                                    Address                        State       Voter
-----                                    -------                        -----       -----
-a1799962-8711-7f28-23f0-cea05c8a527d    vault-0.vault-internal:8201    leader      true
-e6876c97-aaaa-a92e-b99a-0aafab105745    vault-1.vault-internal:8201    follower    true
-4b5d7383-ff31-44df-e008-6a606828823b    vault-2.vault-internal:8201    follower    true
-```
diff --git a/website/content/docs/platform/k8s/helm/examples/external.mdx b/website/content/docs/platform/k8s/helm/examples/external.mdx
deleted file mode 100644
index ae4c8854306..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/external.mdx
+++ /dev/null
@@ -1,25 +0,0 @@
----
-layout: 'docs'
-page_title: 'External Vault'
-sidebar_current: 'docs-platform-k8s-examples-external'
-description: |-
-  Describes how to set up an external Vault
----
-
-# External Vault
-
-@include 'helm/version.mdx'
-
-The below `values.yaml` can be used to set up an external vault server or
-cluster.
-
-```yaml
-injector:
-  externalVaultAddr: 'http://external-vault:8200'
-```
-
-## Learn
-
-Refer to the [Integrate a Kubernetes Cluster with an External
-Vault](/vault/tutorials/kubernetes/kubernetes-external-vault)
-guide for a step-by-step tutorial.
diff --git a/website/content/docs/platform/k8s/helm/examples/ha-tls.mdx b/website/content/docs/platform/k8s/helm/examples/ha-tls.mdx
deleted file mode 100644
index 46fa12b47bc..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/ha-tls.mdx
+++ /dev/null
@@ -1,100 +0,0 @@
----
-layout: 'docs'
-page_title: 'HA Cluster with Raft and TLS'
-sidebar_current: 'docs-platform-k8s-examples-ha-tls'
-description: |-
-  Describes how to set up a Raft HA Vault cluster with TLS certificate
----
-
-# HA Cluster with Raft and TLS
-
-The overview for [Integrated Storage and
-TLS](/vault/docs/concepts/integrated-storage#integrated-storage-and-tls) covers
-the various options for mitigating TLS verification warnings and bootstrapping
-your Raft cluster.
-
-Without proper configuration, you will see the following warning before cluster
-initialization:
-```shell
-core: join attempt failed: error="error during raft bootstrap init call: Put "https://vault-${N}.${SERVICE}:8200/v1/sys/storage/raft/bootstrap/challenge": x509: certificate is valid for ${SERVICE}, ${SERVICE}.${NAMESPACE}, ${SERVICE}.${NAMESPACE}.svc, ${SERVICE}.${NAMESPACE}.svc.cluster.local, not vault-${N}.${SERVICE}"
-```
-
-The examples below demonstrate two specific solutions. Both solutions ensure
-that the common name (CN) used for the `leader_api_addr` in the Raft stanza
-matches the name(s) listed in the TLS certificate.
-
-## Before you start
-
-1. Follow the steps from the example [HA Vault Cluster with Integrated
-Storage](/vault/docs/platform/k8s/helm/examples/ha-with-raft) to build the cluster.
-
-2. Follow the examples and instructions in [Standalone Server with
-TLS](/vault/docs/platform/k8s/helm/examples/standalone-tls) to create a TLS
-certificate.
-
-## Solution 1: Use auto-join and set the TLS server in your Raft configuration
-
-The join warning disappears if you use auto-join and set the expected TLS
-server name (`${CN}`) with
-[`leader_tls_servername`](/vault/docs/configuration/storage/raft#leader_tls_servername)
-in the Raft stanza for your Vault configuration.
-
-For example:
-<CodeBlockConfig highlight="6,14,22">
-
-```hcl
-storage "raft" {
-  path = "/vault/data"
-
-  retry_join {
-    leader_api_addr = "https://vault-0.${SERVICE}:8200"
-    leader_tls_servername = "${CN}"
-    leader_client_cert_file = "/vault/tls/vault.crt"
-    leader_client_key_file = "/vault/tls/vault.key"
-    leader_ca_cert_file = "/vault/tls/vault.ca"
-  }
-
-  retry_join {
-    leader_api_addr = "https://vault-1.${SERVICE}:8200"
-    leader_tls_servername = "${CN}"
-    leader_client_cert_file = "/vault/tls/vault.crt"
-    leader_client_key_file = "/vault/tls/vault.key"
-    leader_ca_cert_file = "/vault/tls/vault.ca"
-  }
-
-  retry_join {
-    leader_api_addr = "https://vault-2.${SERVICE}:8200"
-    leader_tls_servername = "${CN}"
-    leader_client_cert_file = "/vault/tls/vault.crt"
-    leader_client_key_file = "/vault/tls/vault.key"
-    leader_ca_cert_file = "/vault/tls/vault.ca"
-  }
-}
-```
-
-</CodeBlockConfig>
-
-## Solution 2:  Add a load balancer to your Raft configuration
-
-If you have a load balancer for your Vault cluster, you can add a single
-`retry_join` stanza to your Raft configuration and use the load balancer
-address for `leader_api_addr`.
-
-For example:
-<CodeBlockConfig highlight="5">
-
-```hcl
-storage "raft" {
-  path = "/vault/data"
-
-  retry_join {
-    leader_api_addr = "https://vault-active:8200"
-    leader_client_cert_file = "/vault/tls/vault.crt"
-    leader_client_key_file = "/vault/tls/vault.key"
-    leader_ca_cert_file = "/vault/tls/vault.ca"
-  }
-}
-```
-
-</CodeBlockConfig>
-
diff --git a/website/content/docs/platform/k8s/helm/examples/ha-with-consul.mdx b/website/content/docs/platform/k8s/helm/examples/ha-with-consul.mdx
deleted file mode 100644
index 411c30352a6..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/ha-with-consul.mdx
+++ /dev/null
@@ -1,75 +0,0 @@
----
-layout: 'docs'
-page_title: 'Highly Available Vault Cluster with Consul'
-sidebar_current: 'docs-platform-k8s-examples-ha-with-consul'
-description: |-
-  Describes how to set up a highly available Vault cluster with Consul backend
----
-
-# Highly available Vault cluster with consul
-
-@include 'helm/version.mdx'
-
-@include 'consul-dataplane-compat.mdx'
-
-The below `values.yaml` can be used to set up a five server Vault cluster using
-Consul as a highly available storage backend, Google Cloud KMS for Auto Unseal.
-
-```yaml
-server:
-  extraEnvironmentVars:
-    GOOGLE_REGION: global
-    GOOGLE_PROJECT: myproject
-    GOOGLE_APPLICATION_CREDENTIALS: /vault/userconfig/my-gcp-iam/myproject-creds.json
-
-  volumes:
-    - name: userconfig-my-gcp-iam
-      secret:
-        defaultMode: 420
-        secretName: my-gcp-iam
-
-  volumeMounts:
-    - mountPath: /vault/userconfig/my-gcp-iam
-      name: userconfig-my-gcp-iam
-      readOnly: true
-
-  affinity: |
-    podAntiAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        - labelSelector:
-            matchLabels:
-              app: {{ template "vault.name" . }}
-              release: "{{ .Release.Name }}"
-              component: server
-          topologyKey: kubernetes.io/hostname
-
-  service:
-    enabled: true
-
-  ha:
-    enabled: true
-    replicas: 5
-
-    config: |
-      ui = true
-
-      listener "tcp" {
-        tls_disable = 1
-        address = "[::]:8200"
-        cluster_address = "[::]:8201"
-      }
-
-      storage "consul" {
-        path = "vault"
-        address = "HOST_IP:8500"
-      }
-
-      seal "gcpckms" {
-         project     = "myproject"
-         region      = "global"
-         key_ring    = "vault-unseal-kr"
-         crypto_key  = "vault-unseal-key"
-      }
-
-      service_registration "kubernetes" {}
-```
diff --git a/website/content/docs/platform/k8s/helm/examples/ha-with-raft.mdx b/website/content/docs/platform/k8s/helm/examples/ha-with-raft.mdx
deleted file mode 100644
index 27391d2fcf7..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/ha-with-raft.mdx
+++ /dev/null
@@ -1,60 +0,0 @@
----
-layout: 'docs'
-page_title: 'Highly Available Vault Cluster with Raft'
-sidebar_current: 'docs-platform-k8s-examples-ha-with-raft'
-description: |-
-  Describes how to set up a highly available Vault cluster with Integrated Storage (Raft)
----
-
-# Highly available Vault cluster with integrated storage (Raft)
-
-@include 'helm/version.mdx'
-
-Integrated storage (raft) can be enabled using the `server.ha.raft.enabled` value:
-
-```shell
-helm install vault hashicorp/vault \
-  --set='server.ha.enabled=true' \
-  --set='server.ha.raft.enabled=true'
-```
-
-Next, initialize and unseal `vault-0` pod:
-
-```shell
-kubectl exec -ti vault-0 -- vault operator init
-kubectl exec -ti vault-0 -- vault operator unseal
-```
-
-Finally, join the remaining pods to the Raft cluster and unseal them. The pods
-will need to communicate directly so we'll configure the pods to use the internal
-service provided by the Helm chart:
-
-```shell
-kubectl exec -ti vault-1 -- vault operator raft join http://vault-0.vault-internal:8200
-kubectl exec -ti vault-1 -- vault operator unseal
-
-kubectl exec -ti vault-2 -- vault operator raft join http://vault-0.vault-internal:8200
-kubectl exec -ti vault-2 -- vault operator unseal
-```
-
-To verify if the Raft cluster has successfully been initialized, run the following.
-
-First, login using the `root` token on the `vault-0` pod:
-
-```shell
-kubectl exec -ti vault-0 -- vault login
-```
-
-Next, list all the raft peers:
-
-```shell
-$ kubectl exec -ti vault-0 -- vault operator raft list-peers
-
-Node                                    Address                        State       Voter
-----                                    -------                        -----       -----
-a1799962-8711-7f28-23f0-cea05c8a527d    vault-0.vault-internal:8201    leader      true
-e6876c97-aaaa-a92e-b99a-0aafab105745    vault-1.vault-internal:8201    follower    true
-4b5d7383-ff31-44df-e008-6a606828823b    vault-2.vault-internal:8201    follower    true
-```
-
-Vault with Integrated Storage (Raft) is now ready to use!
diff --git a/website/content/docs/platform/k8s/helm/examples/index.mdx b/website/content/docs/platform/k8s/helm/examples/index.mdx
deleted file mode 100644
index 4f20d3c9327..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/index.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
----
-layout: 'docs'
-page_title: 'Examples'
-sidebar_current: 'docs-platform-k8s-examples'
-description: |-
-  This section documents configuration options for the Vault Helm chart
----
-
-# Helm chart examples
-
-@include 'helm/version.mdx'
-
-These are a collection of examples of common configurations for Vault using the Helm chart.
-
-The following are different configuration examples to support a variety of
-deployment models. You can view the different examples from the list on the left.
-
-## Tutorial
-
-Refer to the [Run Vault on
-Kubernetes](/vault/tutorials/kubernetes)
-tutorial series to learn how to run Vault on Kubernetes.
diff --git a/website/content/docs/platform/k8s/helm/examples/injector-tls-cert-manager.mdx b/website/content/docs/platform/k8s/helm/examples/injector-tls-cert-manager.mdx
deleted file mode 100644
index 312d68619e9..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/injector-tls-cert-manager.mdx
+++ /dev/null
@@ -1,143 +0,0 @@
----
-layout: 'docs'
-page_title: 'Vault Agent Injector TLS with Cert-Manager'
-sidebar_current: 'docs-platform-k8s-examples-injector-tls-cert-manager'
-description: |-
-  Describes how to set up the Vault Agent Injector with certificates and keys generated by cert-manager.
----
-
-# Vault agent injector TLS with Cert-Manager
-
-The following instructions demonstrate how to configure the Vault Agent Injector to use certificates generated by [cert-manager](https://cert-manager.io/). This allows you to run multiple replicas of the Vault Agent Injector in a Kubernetes cluster.
-
-## Prerequisites
-
-Install cert-manager if not already installed (see the [cert-manager documentation](https://cert-manager.io/docs/installation/)). For example, with helm:
-
-```shell
-$ helm repo add jetstack https://charts.jetstack.io
-$ helm repo update
-$ helm install cert-manager jetstack/cert-manager \
-  --namespace cert-manager \
-  --create-namespace \
-  --set installCRDs=true
-```
-
-## Create a certificate authority (CA)
-
-For this example we will bootstrap a self-signed certificate authority (CA) [Issuer](https://cert-manager.io/docs/configuration/). If you already have a [ClusterIssuer](https://cert-manager.io/docs/concepts/issuer/) configured for your cluster, you may skip this step.
-
-```yaml
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: selfsigned
-spec:
-  selfSigned: {}
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: injector-selfsigned-ca
-spec:
-  isCA: true
-  commonName: Agent Inject CA
-  secretName: injector-ca-secret
-  duration: 87660h  # 10 years
-  privateKey:
-    algorithm: ECDSA
-    size: 256
-  issuerRef:
-    name: selfsigned
-    kind: Issuer
-    group: cert-manager.io
----
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: injector-ca-issuer
-spec:
-  ca:
-    secretName: injector-ca-secret
-```
-
-Save that to a file named `ca-issuer.yaml`, and apply to your Kubernetes cluster:
-
-```console
-$ kubectl apply -n vault -f ca-issuer.yaml
-issuer.cert-manager.io/selfsigned created
-certificate.cert-manager.io/injector-selfsigned-ca created
-issuer.cert-manager.io/injector-ca-issuer created
-
-$ kubectl -n vault get issuers -o wide
-NAME                 READY   STATUS                AGE
-injector-ca-issuer   True    Signing CA verified   7s
-selfsigned           True                          7s
-
-$ kubectl -n vault get certificates injector-selfsigned-ca -o wide
-NAME                     READY   SECRET               ISSUER       STATUS                                          AGE
-injector-selfsigned-ca   True    injector-ca-secret   selfsigned   Certificate is up to date and has not expired   32s
-```
-
-## Create the Vault agent injector certificate
-
-Next we can create a request for cert-manager to generate a certificate and key
-signed by the certificate authority above. This certificate and key will be used
-by the Vault Agent Injector for TLS communications with the Kubernetes API. 
-
-The Certificate request object references the CA issuer created above, and specifies the name of the Secret where the CA, Certificate, and Key will be stored by cert-manager.
-
-```yaml
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: injector-certificate
-spec:
-  secretName: injector-tls
-  duration: 24h
-  renewBefore: 144m  # roughly 10% of 24h
-  dnsNames:
-  - vault-agent-injector-svc
-  - vault-agent-injector-svc.vault
-  - vault-agent-injector-svc.vault.svc
-  issuerRef:
-    name: injector-ca-issuer
-  commonName: Agent Inject Cert
-```
-
-~> **Important Note:** The dnsNames for the certificate must be configured to use the name
-of the Vault Agent Injector Kubernetes service and namespace where it is deployed.
-
-In this example the Vault Agent Injector service name is `vault-agent-injector-svc` in the `vault` namespace.
-This uses the pattern `<k8s service name>.<k8s namespace>.svc`.
-
-Save the Certificate yaml to a file and apply to your cluster:
-
-```shell
-$ kubectl -n vault apply -f injector-certificate.yaml
-certificate.cert-manager.io/injector-certificate created
-
-$ kubectl -n vault get certificates injector-certificate -o wide
-NAME                   READY   SECRET         ISSUER               STATUS                                          AGE
-injector-certificate   True    injector-tls   injector-ca-issuer   Certificate is up to date and has not expired   41s
-
-$ kubectl -n vault get secret injector-tls
-NAME           TYPE                DATA   AGE
-injector-tls   kubernetes.io/tls   3      6m59s
-```
-
-## Configuration
-
-Now that a certificate authority and a signed certificate have been created, we can now configure
-Helm and the Vault Agent Injector to use them.
-
-Install the Vault Agent Injector with the following custom values:
-
-```shell
-$ helm install vault hashicorp/vault \
-  --namespace=vault \
-  --set injector.replicas=2 \
-  --set injector.leaderElector.enabled=false \
-  --set injector.certs.secretName=injector-tls \
-  --set injector.webhook.annotations="cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/injector-certificate"
-```
diff --git a/website/content/docs/platform/k8s/helm/examples/injector-tls.mdx b/website/content/docs/platform/k8s/helm/examples/injector-tls.mdx
deleted file mode 100644
index 6e5aac5e941..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/injector-tls.mdx
+++ /dev/null
@@ -1,132 +0,0 @@
----
-layout: 'docs'
-page_title: 'Vault Agent Injector TLS Configuration'
-sidebar_current: 'docs-platform-k8s-examples-injector-tls'
-description: |-
-  Describes how to set up the Vault Agent Injector with manually generated certificates and keys.
----
-
-# Vault agent injector TLS configuration
-
-@include 'helm/version.mdx'
-
-The following instructions demonstrate how to manually configure the Vault Agent Injector
-with self-signed certificates.
-
-## Create a certificate authority (CA)
-
-First, create a private key to be used by our custom Certificate Authority (CA):
-
-```shell
-$ openssl genrsa -out injector-ca.key 2048
-```
-
-Next, create a certificate authority certificate:
-
-~> **Important Note:** Values such as days (how long the certificate is valid for) should be configured for your environment.
-
-```shell
-$ openssl req \
-   -x509 \
-   -new \
-   -nodes \
-   -key injector-ca.key \
-   -sha256 \
-   -days 1825 \
-   -out injector-ca.crt \
-   -subj "/C=US/ST=CA/L=San Francisco/O=HashiCorp/CN=vault-agent-injector-svc"
-```
-
-## Create Vault agent injector certificate
-
-Next we can create a certificate and key signed by the certificate authority generated above. This
-certificate and key will be used by the Vault Agent Injector for TLS communications with the Kubernetes
-API.
-
-First, create a private key for the certificate:
-
-```shell
-$ openssl genrsa -out tls.key 2048
-```
-
-Next, create a certificate signing request (CSR) to be used when signing the certificate:
-
-```shell
-$ openssl req \
-   -new \
-   -key tls.key \
-   -out tls.csr \
-   -subj "/C=US/ST=CA/L=San Francisco/O=HashiCorp/CN=vault-agent-injector-svc"
-```
-
-After creating the CSR, create an extension file to configure additional parameters for signing
-the certificate.
-
-~> **Important Note:** The alternative names for the certificate must be configured to use the name
-of the Vault Agent Injector Kubernetes service and namespace where its created.
-
-In this example the Vault Agent Injector service name is `vault-agent-injector-svc` in the `vault` namespace.
-This uses the pattern `<k8s service name>.<k8s namespace>.svc.cluster.local`.
-
-```shell
-$ cat <<EOF >csr.conf
-authorityKeyIdentifier=keyid,issuer
-basicConstraints=CA:FALSE
-keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
-subjectAltName = @alt_names
-
-[alt_names]
-DNS.1 = vault-agent-injector-svc
-DNS.2 = vault-agent-injector-svc.vault
-DNS.3 = vault-agent-injector-svc.vault.svc
-DNS.4 = vault-agent-injector-svc.vault.svc.cluster.local
-EOF
-```
-
-Finally, sign the certificate:
-
-~> **Important Note:** Values such as days (how long the certificate is valid for) should be configured for your environment.
-
-```shell
-$ openssl x509 \
-  -req \
-  -in tls.csr \
-  -CA injector-ca.crt \
-  -CAkey injector-ca.key \
-  -CAcreateserial \
-  -out tls.crt \
-  -days 1825 \
-  -sha256 \
-  -extfile csr.conf
-```
-
-## Configuration
-
-Now that a certificate authority and a signed certificate have been created, we can now configure
-Helm and the Vault Agent Injector to use them.
-
-First, create a Kubernetes secret containing the certificate and key created above:
-
-~> **Important Note:** This example assumes the Vault Agent Injector is running in the `vault` namespace.
-
-```shell
-$ kubectl create secret generic injector-tls \
-    --from-file tls.crt \
-    --from-file tls.key \
-    --namespace=vault
-```
-
-Next, base64 encode the certificate authority so Kubernetes can verify the authenticity of the certificate:
-
-```shell
-$ export CA_BUNDLE=$(cat injector-ca.crt | base64)
-```
-
-Finally, install the Vault Agent Injector with the following custom values:
-
-```shell
-$ helm install vault hashicorp/vault \
-  --namespace=vault \
-  --set="injector.certs.secretName=injector-tls" \
-  --set="injector.certs.caBundle=${CA_BUNDLE?}"
-```
diff --git a/website/content/docs/platform/k8s/helm/examples/kubernetes-auth.mdx b/website/content/docs/platform/k8s/helm/examples/kubernetes-auth.mdx
deleted file mode 100644
index 08fe7eef411..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/kubernetes-auth.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
----
-layout: 'docs'
-page_title: 'Using Kubernetes Auth Method'
-sidebar_current: 'docs-platform-k8s-examples-kubernetes-auth'
-description: |-
-  Describes how to set up Kubernetes Auth method
----
-
-# Bootstrapping kubernetes auth method
-
-@include 'helm/version.mdx'
-
-In this example, we will walk through how to set up the [Kubernetes Auth Method](/vault/docs/auth/kubernetes).
-
-This assumes the following commands will be run inside a Vault pod running in Kubernetes.
-
-Exec into the Vault pod:
-
-```bash
-kubectl exec -it vault-0 -- /bin/sh
-```
-
-If you didn't set `server.dev.enabled=true`, you'll need to log in to Vault first using `vault login`.
-Then run the following commands to configure the Kubernetes Auth Method:
-
-```bash
-vault auth enable kubernetes
-vault write auth/kubernetes/config \
-    kubernetes_host=https://$KUBERNETES_SERVICE_HOST:$KUBERNETES_SERVICE_PORT
-```
-
-From here you can continue to configure Vault from the [Kubernetes Auth Method](/vault/docs/auth/kubernetes) documentation.
diff --git a/website/content/docs/platform/k8s/helm/examples/standalone-audit.mdx b/website/content/docs/platform/k8s/helm/examples/standalone-audit.mdx
deleted file mode 100644
index 66c486649a2..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/standalone-audit.mdx
+++ /dev/null
@@ -1,52 +0,0 @@
----
-layout: 'docs'
-page_title: 'Standalone Server with Audit Storage'
-sidebar_current: 'docs-platform-k8s-examples-standalone-audit'
-description: |-
-  Describes how to set up a standalone Vault with audit storage
----
-
-# Standalone server with audit storage
-
-@include 'helm/version.mdx'
-
-The below `values.yaml` can be used to set up a single server Vault cluster with
-auditing enabled.
-
-```yaml
-server:
-  standalone:
-    enabled: true
-    config: |
-      listener "tcp" {
-        tls_disable = true
-        address = "[::]:8200"
-        cluster_address = "[::]:8201"
-      }
-
-      storage "file" {
-        path = "/vault/data"
-      }
-
-  service:
-    enabled: true
-
-  dataStorage:
-    enabled: true
-    size: 10Gi
-    storageClass: null
-    accessMode: ReadWriteOnce
-
-  auditStorage:
-    enabled: true
-    size: 10Gi
-    storageClass: null
-    accessMode: ReadWriteOnce
-```
-
-After Vault has been deployed, initialized and unsealed, auditing can be enabled
-by running the following command against the Vault pod:
-
-```shell-session
-$ kubectl exec -ti <POD NAME> --  vault audit enable file file_path=/vault/audit/vault_audit.log
-```
diff --git a/website/content/docs/platform/k8s/helm/examples/standalone-load-balanced-ui.mdx b/website/content/docs/platform/k8s/helm/examples/standalone-load-balanced-ui.mdx
deleted file mode 100644
index 444b63ad7ba..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/standalone-load-balanced-ui.mdx
+++ /dev/null
@@ -1,43 +0,0 @@
----
-layout: 'docs'
-page_title: 'Standalone Server with Load Balanced UI'
-sidebar_current: 'docs-platform-k8s-examples-standalone-load-balanced-ui'
-description: |-
-  Describes how to set up a standalone Vault with a load balanced UI
----
-
-# Standalone server with load balanced UI
-
-@include 'helm/version.mdx'
-
-The below `values.yaml` can be used to set up a single server Vault cluster with a LoadBalancer to allow external access to the UI and API.
-
-```yaml
-server:
-  standalone:
-    enabled: true
-    config: |
-      ui = true
-
-      listener "tcp" {
-        tls_disable = 1
-        address = "[::]:8200"
-        cluster_address = "[::]:8201"
-      }
-      storage "file" {
-        path = "/vault/data"
-      }
-
-  service:
-    enabled: true
-
-  dataStorage:
-    enabled: true
-    size: 10Gi
-    storageClass: null
-    accessMode: ReadWriteOnce
-
-ui:
-  enabled: true
-  serviceType: LoadBalancer
-```
diff --git a/website/content/docs/platform/k8s/helm/examples/standalone-tls.mdx b/website/content/docs/platform/k8s/helm/examples/standalone-tls.mdx
deleted file mode 100644
index 682d755db06..00000000000
--- a/website/content/docs/platform/k8s/helm/examples/standalone-tls.mdx
+++ /dev/null
@@ -1,218 +0,0 @@
----
-layout: 'docs'
-page_title: 'Standalone Server with TLS'
-sidebar_current: 'docs-platform-k8s-examples-standalone-tls'
-description: |-
-  Describes how to set up a standalone Vault with TLS certificate
----
-
-# Standalone server with TLS
-
-@include 'helm/version.mdx'
-
-This example can be used to set up a single server Vault cluster using TLS.
-
-1. Create key & certificate using Kubernetes CA
-2. Store key & cert into [Kubernetes secrets store](https://kubernetes.io/docs/concepts/configuration/secret/)
-3. Configure helm chart to use Kubernetes secret from step 2
-
-## 1. create key & certificate using kubernetes CA
-
-There are four variables that will be used in this example.
-
-```bash
-# SERVICE is the name of the Vault service in kubernetes.
-# It does not have to match the actual running service, though it may help for consistency.
-export SERVICE=vault-server-tls
-
-# NAMESPACE where the Vault service is running.
-export NAMESPACE=vault-namespace
-
-# SECRET_NAME to create in the kubernetes secrets store.
-export SECRET_NAME=vault-server-tls
-
-# TMPDIR is a temporary working directory.
-export TMPDIR=/tmp
-
-# CSR_NAME will be the name of our certificate signing request as seen by kubernetes.
-export CSR_NAME=vault-csr
-```
-
-1. Create a key for Kubernetes to sign.
-
-   ```shell-session
-   $ openssl genrsa -out ${TMPDIR}/vault.key 2048
-   Generating RSA private key, 2048 bit long modulus
-...................................................................................................+++
-...............+++
-e is 65537 (0x10001)
-   ```
-
-2. Create a Certificate Signing Request (CSR).
-
-   1. Create a file `${TMPDIR}/csr.conf` with the following contents:
-
-      ```bash
-      cat <<EOF >${TMPDIR}/csr.conf
-      [req]
-      req_extensions = v3_req
-      distinguished_name = req_distinguished_name
-      [req_distinguished_name]
-      [ v3_req ]
-      basicConstraints = CA:FALSE
-      keyUsage = nonRepudiation, digitalSignature, keyEncipherment
-      extendedKeyUsage = serverAuth
-      subjectAltName = @alt_names
-      [alt_names]
-      DNS.1 = *.${SERVICE}
-      DNS.2 = *.${SERVICE}.${NAMESPACE}
-      DNS.3 = *.${SERVICE}.${NAMESPACE}.svc
-      DNS.4 = *.${SERVICE}.${NAMESPACE}.svc.cluster.local
-      IP.1 = 127.0.0.1
-      EOF
-      ```
-
-   2. Create a CSR.
-
-      ```bash
-      openssl req -new \
-                  -key ${TMPDIR}/vault.key \
-                  -subj "/CN=system:node:${SERVICE}.${NAMESPACE}.svc;/O=system:nodes" \
-                  -out ${TMPDIR}/server.csr \
-                  -config ${TMPDIR}/csr.conf
-      ```
-
-3. Create the certificate
-
-   ~> **Important Note:** If you are using EKS, certificate signing requirements have changed.  As per the AWS [certificate signing](https://docs.aws.amazon.com/eks/latest/userguide/cert-signing.html) documentation, EKS version `1.22` and later now requires the `signerName` to be `beta.eks.amazonaws.com/app-serving`, otherwise, the CSR will be approved but the certificate will not be issued.
-
-   1. Create a file `${TMPDIR}/csr.yaml` with the following contents:
-
-      ```bash
-      cat <<EOF >${TMPDIR}/csr.yaml
-      apiVersion: certificates.k8s.io/v1
-      kind: CertificateSigningRequest
-      metadata:
-        name: ${CSR_NAME}
-      spec:
-        signerName: kubernetes.io/kubelet-serving
-        groups:
-        - system:authenticated
-        request: $(base64 ${TMPDIR}/server.csr | tr -d '\n')
-        signerName: kubernetes.io/kubelet-serving
-        usages:
-        - digital signature
-        - key encipherment
-        - server auth
-      EOF
-      ```
-
-   2. Send the CSR to Kubernetes.
-
-      ```shell-session
-      $ kubectl create -f ${TMPDIR}/csr.yaml
-      certificatesigningrequest.certificates.k8s.io/vault-csr created
-      ```
-
-      -> If this process is automated, you may need to wait to ensure the CSR has been received and stored:
-      `kubectl get csr ${CSR_NAME}`
-
-   3. Approve the CSR in Kubernetes.
-
-      ```shell-session
-      $ kubectl certificate approve ${CSR_NAME}
-      certificatesigningrequest.certificates.k8s.io/vault-csr approved
-      ```
-
-   4. Verify that the certificate was approved and issued.
-      ```shell-session
-      $ kubectl get csr ${CSR_NAME}
-      NAME        AGE     SIGNERNAME                                    REQUESTOR                        CONDITION
-      vault-csr   1m13s   kubernetes.io/kubelet-serving                 kubernetes-admin                 Approved,Issued
-      ```
-
-## 2. store key, cert, and kubernetes CA into kubernetes secrets store
-
-1. Retrieve the certificate.
-
-   ```shell-session
-   $ serverCert=$(kubectl get csr ${CSR_NAME} -o jsonpath='{.status.certificate}')
-   ```
-
-   -> If this process is automated, you may need to wait to ensure the certificate has been created.
-   If it hasn't, this will return an empty string.
-
-2. Write the certificate out to a file.
-
-   ```shell-session
-   $ echo "${serverCert}" | openssl base64 -d -A -out ${TMPDIR}/vault.crt
-   ```
-
-3. Retrieve Kubernetes CA.
-
-   ```bash
-   kubectl get secret \
-     -o jsonpath="{.items[?(@.type==\"kubernetes.io/service-account-token\")].data['ca\.crt']}" \
-     | base64 --decode > ${TMPDIR}/vault.ca
-   ```
-
-4. Create the namespace.
-
-    ```shell-session
-    $ kubectl create namespace ${NAMESPACE}
-    namespace/vault-namespace created
-    ```
-
-5. Store the key, cert, and Kubernetes CA into Kubernetes secrets.
-
-   ```shell-session
-   $ kubectl create secret generic ${SECRET_NAME} \
-       --namespace ${NAMESPACE} \
-       --from-file=vault.key=${TMPDIR}/vault.key \
-       --from-file=vault.crt=${TMPDIR}/vault.crt \
-       --from-file=vault.ca=${TMPDIR}/vault.ca
-
-   # secret/vault-server-tls created
-   ```
-
-## 3. helm configuration
-
-The below `custom-values.yaml` can be used to set up a single server Vault cluster using TLS.
-This assumes that a Kubernetes `secret` exists with the server certificate, key and
-certificate authority:
-
-```yaml
-global:
-  enabled: true
-  tlsDisable: false
-
-server:
-  extraEnvironmentVars:
-    VAULT_CACERT: /vault/userconfig/vault-server-tls/vault.ca
-
-  volumes:
-    - name: userconfig-vault-server-tls
-      secret:
-        defaultMode: 420
-        secretName: vault-server-tls # Matches the ${SECRET_NAME} from above
-
-  volumeMounts:
-    - mountPath: /vault/userconfig/vault-server-tls
-      name: userconfig-vault-server-tls
-      readOnly: true
-
-  standalone:
-    enabled: true
-    config: |
-      listener "tcp" {
-        address = "[::]:8200"
-        cluster_address = "[::]:8201"
-        tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt"
-        tls_key_file  = "/vault/userconfig/vault-server-tls/vault.key"
-        tls_client_ca_file = "/vault/userconfig/vault-server-tls/vault.ca"
-      }
-
-      storage "file" {
-        path = "/vault/data"
-      }
-```
diff --git a/website/content/docs/platform/k8s/helm/index.mdx b/website/content/docs/platform/k8s/helm/index.mdx
deleted file mode 100644
index 53f410103b9..00000000000
--- a/website/content/docs/platform/k8s/helm/index.mdx
+++ /dev/null
@@ -1,65 +0,0 @@
----
-layout: docs
-page_title: Helm - Kubernetes
-description: >-
-  The Vault Helm chart is the recommended way to install and configure Vault on
-  Kubernetes.
----
-
-# Helm chart
-
-@include 'helm/version.mdx'
-
-The [Vault Helm chart](https://github.com/hashicorp/vault-helm)
-is the recommended way to install and configure Vault on Kubernetes.
-In addition to running Vault itself, the Helm chart is the primary
-method for installing and configuring Vault to integrate with other
-services such as Consul for High Availability (HA) deployments.
-
-This page assumes general knowledge of [Helm](https://helm.sh/) and
-how to use it. Using Helm to install Vault requires that Helm is
-properly installed and configured with your Kubernetes cluster.
-
-@include 'kubernetes-supported-versions.mdx'
-
-## Using the helm chart
-
-Helm must be installed and configured on your machine. Please refer to the [Helm
-documentation](https://helm.sh/) or the [Vault Installation to Minikube via
-Helm](/vault/tutorials/kubernetes/kubernetes-minikube-consul) tutorial.
-
-To use the Helm chart, add the Hashicorp helm repository and check that you have
-access to the chart:
-
-@include 'helm/repo.mdx'
-
--> **Important:** The Helm chart is new and under significant development.
-Please always run Helm with `--dry-run` before any install or upgrade to verify
-changes.
-
-Example chart usage:
-
-Installing the latest release of the Vault Helm chart with pods prefixed with
-the name `vault`.
-
-```shell-session
-$ helm install vault hashicorp/vault
-```
-
-Installing a specific version of the chart.
-
-@include 'helm/install.mdx'
-
-~> **Security Warning:** By default, the chart runs in standalone mode. This
-mode uses a single Vault server with a file storage backend. This is a less
-secure and less resilient installation that is **NOT** appropriate for a
-production setup. It is highly recommended to use a [properly secured Kubernetes
-cluster](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/),
-[learn the available configuration
-options](/vault/docs/platform/k8s/helm/configuration), and read the [production deployment
-checklist](/vault/docs/platform/k8s/helm/run#architecture).
-
-## Tutorial
-
-Refer to the [Kubernetes](/vault/tutorials/kubernetes)
-tutorials series to learn how to run Vault on Kubernetes.
diff --git a/website/content/docs/platform/k8s/helm/openshift.mdx b/website/content/docs/platform/k8s/helm/openshift.mdx
deleted file mode 100644
index 75e7c508470..00000000000
--- a/website/content/docs/platform/k8s/helm/openshift.mdx
+++ /dev/null
@@ -1,208 +0,0 @@
----
-layout: docs
-page_title: Running Vault - OpenShift
-description: >-
-  Vault can run directly on OpenShift in various configurations.  For
-  pure-OpenShift workloads, this enables Vault to also exist purely within
-  Kubernetes.
----
-
-# Run Vault on OpenShift
-
-@include 'helm/version.mdx'
-
-The following documentation describes installing, running, and using
-Vault and **Vault Agent Injector** on OpenShift.
-
-~> **Note:** We recommend using the Vault agent injector on Openshift
-instead of the Secrets Store CSI driver. OpenShift
-[does not recommend](https://docs.openshift.com/container-platform/4.9/storage/persistent_storage/persistent-storage-hostpath.html)
-using `hostPath` mounting in production or
-[certify Helm charts](https://github.com/redhat-certification/chart-verifier/blob/dbf89bff2d09142e4709d689a9f4037a739c2244/docs/helm-chart-checks.md#table-2-helm-chart-default-checks)
-using CSI objects because pods must run as privileged. If you would like to run the Secrets Store
-CSI driver on a development or testing cluster, refer to
-[installation instructions for the Vault CSI provider](/vault/docs/platform/k8s/csi/installation).
-
-## Requirements
-
-The following are required to install Vault and Vault Agent Injector
-on OpenShift:
-
-- Cluster Admin privileges to bind the `auth-delegator` role to Vault's service account
-- Helm v3.6+
-- OpenShift 4.3+
-- Vault Helm v0.6.0+
-- Vault K8s v0.4.0+
-
-~> **Note:** Support for Consul on OpenShift is available since [Consul 1.9](https://www.hashicorp.com/blog/introducing-openshift-support-for-consul-on-kubernetes). However, for highly available
-deployments, Raft integrated storage is recommended.
-
-## Additional resources
-
-The documentation, configuration and examples for Vault Helm and Vault K8s Agent Injector
-are applicable to OpenShift installations. For more examples see the existing documentation:
-
-- [Vault Helm documentation](/vault/docs/platform/k8s/helm)
-- [Vault K8s documentation](/vault/docs/platform/k8s/injector)
-
-## Helm chart
-
-The [Vault Helm chart](https://github.com/hashicorp/vault-helm)
-is the recommended way to install and configure Vault on OpenShift.
-In addition to running Vault itself, the Helm chart is the primary
-method for installing and configuring Vault Agent Injection Mutating
-Webhook.
-
-While the Helm chart automatically sets up complex resources and exposes the
-configuration to meet your requirements, it **does not automatically operate
-Vault.** You are still responsible for learning how to monitor, backup, upgrade,
-etc. the Vault cluster.
-
-~> **Security Warning:** By default, the chart runs in standalone mode. This
-mode uses a single Vault server with a file storage backend. This is a less
-secure and less resilient installation that is **NOT** appropriate for a
-production setup. It is highly recommended to use a [properly secured Kubernetes
-cluster](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/),
-[learn the available configuration
-options](/vault/docs/platform/k8s/helm/configuration), and read the [production deployment
-checklist](/vault/docs/platform/k8s/helm/run#architecture).
-
-## How-To
-
-### Install Vault
-
-To use the Helm chart, add the Hashicorp helm repository and check that you have
-access to the chart:
-
-@include 'helm/repo.mdx'
-
--> **Important:** The Helm chart is new and under significant development.
-Please always run Helm with `--dry-run` before any install or upgrade to verify
-changes.
-
-Use `helm install` to install the latest release of the Vault Helm chart.
-
-```shell-session
-$ helm install vault hashicorp/vault
-```
-
-Or install a specific version of the chart.
-
-@include 'helm/install.mdx'
-
-The `helm install` command accepts parameters to override default configuration
-values inline or defined in a file. For all OpenShift deployments, `global.openshift`
-should be set to `true`.
-
-Override the `server.dev.enabled` configuration value:
-
-```shell-session
-$ helm install vault hashicorp/vault \
-    --set "global.openshift=true" \
-    --set "server.dev.enabled=true"
-```
-
-Override all the configuration found in a file:
-
-```shell-session
-$ cat override-values.yml
-global:
-  openshift: true
-
-server:
-  ha:
-    enabled: true
-    replicas: 5
-##
-$ helm install vault hashicorp/vault \
-    --values override-values.yml
-```
-
-#### Dev mode
-
-The Helm chart may run a Vault server in development. This installs a single
-Vault server with a memory storage backend.
-
--> **Dev mode:** This is ideal for learning and demonstration environments but
-NOT recommended for a production environment.
-
-Install the latest Vault Helm chart in development mode.
-
-```shell-session
-$ helm install vault hashicorp/vault \
-    --set "global.openshift=true" \
-    --set "server.dev.enabled=true"
-```
-
-#### Highly available raft mode
-
-The following creates a Vault cluster using the Raft integrated storage backend.
-
-Install the latest Vault Helm chart in HA Raft mode:
-
-```shell-session
-$ helm install vault hashicorp/vault \
-  --set='global.openshift=true' \
-  --set='server.ha.enabled=true' \
-  --set='server.ha.raft.enabled=true'
-```
-
-Next, initialize and unseal `vault-0` pod:
-
-```shell-session
-$ oc exec -ti vault-0 -- vault operator init
-$ oc exec -ti vault-0 -- vault operator unseal
-```
-
-Finally, join the remaining pods to the Raft cluster and unseal them. The pods
-will need to communicate directly so we'll configure the pods to use the internal
-service provided by the Helm chart:
-
-```shell-session
-$ oc exec -ti vault-1 -- vault operator raft join http://vault-0.vault-internal:8200
-$ oc exec -ti vault-1 -- vault operator unseal
-
-$ oc exec -ti vault-2 -- vault operator raft join http://vault-0.vault-internal:8200
-$ oc exec -ti vault-2 -- vault operator unseal
-```
-
-To verify if the Raft cluster has successfully been initialized, run the following.
-
-First, login using the `root` token on the `vault-0` pod:
-
-```shell-session
-$ oc exec -ti vault-0 -- vault login
-```
-
-Next, list all the raft peers:
-
-```shell-session
-$ oc exec -ti vault-0 -- vault operator raft list-peers
-
-Node                                    Address                        State       Voter
-----                                    -------                        -----       -----
-a1799962-8711-7f28-23f0-cea05c8a527d    vault-0.vault-internal:8201    leader      true
-e6876c97-aaaa-a92e-b99a-0aafab105745    vault-1.vault-internal:8201    follower    true
-4b5d7383-ff31-44df-e008-6a606828823b    vault-2.vault-internal:8201    follower    true
-```
-
-Vault with integrated storage (Raft) is now ready to use!
-
-#### External mode
-
-The Helm chart may be run in external mode. This installs no Vault server and
-relies on a network addressable Vault server to exist.
-
-Install the latest Vault Helm chart in external mode.
-
-```shell-session
-$ helm install vault hashicorp/vault \
-    --set "global.openshift=true" \
-    --set "injector.externalVaultAddr=http://external-vault:8200"
-```
-
-## Tutorial
-
-Refer to the [Integrate a Kubernetes Cluster with an
-External Vault](/vault/tutorials/kubernetes/kubernetes-external-vault)
-tutorial to learn how to use an external Vault within a Kubernetes cluster.
diff --git a/website/content/docs/platform/k8s/helm/run.mdx b/website/content/docs/platform/k8s/helm/run.mdx
deleted file mode 100644
index 9cbb2f8f306..00000000000
--- a/website/content/docs/platform/k8s/helm/run.mdx
+++ /dev/null
@@ -1,582 +0,0 @@
----
-layout: docs
-page_title: Running Vault - Kubernetes
-description: >-
-  Vault can run directly on Kubernetes in various configurations.  For
-  pure-Kubernetes workloads, this enables Vault to also exist purely within
-  Kubernetes.
----
-
-# Run Vault on kubernetes
-
-Vault works with Kubernetes in various modes: `dev`, `standalone`, `ha`,
-and `external`.
-
-@include 'helm/version.mdx'
-
-## Helm chart
-
-The [Vault Helm chart](https://github.com/hashicorp/vault-helm)
-is the recommended way to install and configure Vault on Kubernetes.
-In addition to running Vault itself, the Helm chart is the primary
-method for installing and configuring Vault to integrate with other
-services such as Consul for High Availability (HA) deployments.
-
-While the Helm chart automatically sets up complex resources and exposes the
-configuration to meet your requirements, it **does not automatically operate
-Vault.** You are still responsible for learning how to monitor, backup, upgrade,
-etc. the Vault cluster.
-
-~> **Security Warning:** By default, the chart runs in standalone mode. This
-mode uses a single Vault server with a file storage backend. This is a less
-secure and less resilient installation that is **NOT** appropriate for a
-production setup. It is highly recommended to use a [properly secured Kubernetes
-cluster](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/),
-[learn the available configuration
-options](/vault/docs/platform/k8s/helm/configuration), and read the [production deployment
-checklist](/vault/docs/platform/k8s/helm/run#architecture).
-
-## How-To
-
-### Install Vault
-
-Helm must be installed and configured on your machine. Please refer to the [Helm
-documentation](https://helm.sh/) or the [Vault Installation to Minikube via
-Helm](/vault/tutorials/kubernetes/kubernetes-minikube-consul) tutorial.
-
-To use the Helm chart, add the Hashicorp helm repository and check that you have
-access to the chart:
-
-@include 'helm/repo.mdx'
-
--> **Important:** The Helm chart is new and under significant development.
-Please always run Helm with `--dry-run` before any install or upgrade to verify
-changes.
-
-Use `helm install` to install the latest release of the Vault Helm chart.
-
-```shell-session
-$ helm install vault hashicorp/vault
-```
-
-Or install a specific version of the chart.
-
-@include 'helm/install.mdx'
-
-The `helm install` command accepts parameters to override default configuration
-values inline or defined in a file.
-
-Override the `server.dev.enabled` configuration value:
-
-```shell-session
-$ helm install vault hashicorp/vault \
-    --set "server.dev.enabled=true"
-```
-
-Override all the configuration found in a file:
-
-```shell-session
-$ cat override-values.yml
-server:
-  ha:
-    enabled: true
-    replicas: 5
-##
-$ helm install vault hashicorp/vault \
-    --values override-values.yml
-```
-
-#### Dev mode
-
-The Helm chart may run a Vault server in development. This installs a single
-Vault server with a memory storage backend.
-
--> **Dev mode:** This is ideal for learning and demonstration environments but
-NOT recommended for a production environment.
-
-Install the latest Vault Helm chart in development mode.
-
-```shell-session
-$ helm install vault hashicorp/vault \
-    --set "server.dev.enabled=true"
-```
-
-#### Standalone mode
-
-The Helm chart defaults to run in `standalone` mode. This installs a single
-Vault server with a file storage backend.
-
-Install the latest Vault Helm chart in standalone mode.
-
-```shell-session
-$ helm install vault hashicorp/vault
-```
-
-#### HA mode
-
-The Helm chart may be run in high availability (HA) mode. This installs three
-Vault servers with an existing Consul storage backend. It is suggested that
-Consul is installed via the [Consul Helm
-chart](https://github.com/hashicorp/consul-helm).
-
-Install the latest Vault Helm chart in HA mode.
-
-```shell-session
-$ helm install vault hashicorp/vault \
-    --set "server.ha.enabled=true"
-```
-
-Refer to the [Vault Installation to Minikube via
-Helm](/vault/tutorials/kubernetes/kubernetes-minikube-consul) tutorial
-to learn how to set up Consul and Vault in HA mode.
-
-#### External mode
-
-The Helm chart may be run in external mode. This installs no Vault server and
-relies on a network addressable Vault server to exist.
-
-Install the latest Vault Helm chart in external mode.
-
-```shell-session
-$ helm install vault hashicorp/vault \
-    --set "injector.externalVaultAddr=http://external-vault:8200"
-```
-
-Refer to the [Integrate a Kubernetes Cluster with an
-External Vault](/vault/tutorials/kubernetes/kubernetes-external-vault)
-tutorial to learn how to use an external Vault within a Kubernetes cluster.
-
-### View the Vault UI
-
-The Vault UI is enabled but NOT exposed as service for security reasons. The
-Vault UI can also be exposed via port-forwarding or through a [`ui`
-configuration value](/vault/docs/platform/k8s/helm/configuration/#ui).
-
-Expose the Vault UI with port-forwarding:
-
-```shell-session
-$ kubectl port-forward vault-0 8200:8200
-Forwarding from 127.0.0.1:8200 -> 8200
-Forwarding from [::1]:8200 -> 8200
-##...
-```
-
-### Initialize and unseal Vault
-
-After the Vault Helm chart is installed in `standalone` or `ha` mode one of the
-Vault servers need to be
-[initialized](/vault/docs/commands/operator/init). The
-initialization generates the credentials necessary to
-[unseal](/vault/docs/concepts/seal#why) all the Vault
-servers.
-
-#### CLI initialize and unseal
-
-View all the Vault pods in the current namespace:
-
-```shell-session
-$ kubectl get pods -l app.kubernetes.io/name=vault
-NAME                                    READY   STATUS    RESTARTS   AGE
-vault-0                                 0/1     Running   0          1m49s
-vault-1                                 0/1     Running   0          1m49s
-vault-2                                 0/1     Running   0          1m49s
-```
-
-Initialize one Vault server with the default number of key shares and default
-key threshold:
-
-```shell-session
-$ kubectl exec -ti vault-0 -- vault operator init
-Unseal Key 1: MBFSDepD9E6whREc6Dj+k3pMaKJ6cCnCUWcySJQymObb
-Unseal Key 2: zQj4v22k9ixegS+94HJwmIaWLBL3nZHe1i+b/wHz25fr
-Unseal Key 3: 7dbPPeeGGW3SmeBFFo04peCKkXFuuyKc8b2DuntA4VU5
-Unseal Key 4: tLt+ME7Z7hYUATfWnuQdfCEgnKA2L173dptAwfmenCdf
-Unseal Key 5: vYt9bxLr0+OzJ8m7c7cNMFj7nvdLljj0xWRbpLezFAI9
-
-Initial Root Token: s.zJNwZlRrqISjyBHFMiEca6GF
-##...
-```
-
-The output displays the key shares and initial root key generated.
-
-Unseal the Vault server with the key shares until the key threshold is met:
-
-```sh
-## Unseal the first vault server until it reaches the key threshold
-$ kubectl exec -ti vault-0 -- vault operator unseal # ... Unseal Key 1
-$ kubectl exec -ti vault-0 -- vault operator unseal # ... Unseal Key 2
-$ kubectl exec -ti vault-0 -- vault operator unseal # ... Unseal Key 3
-```
-
-Repeat the unseal process for all Vault server pods. When all Vault server pods
-are unsealed they report READY `1/1`.
-
-```shell-session
-$ kubectl get pods -l app.kubernetes.io/name=vault
-NAME                                    READY   STATUS    RESTARTS   AGE
-vault-0                                 1/1     Running   0          1m49s
-vault-1                                 1/1     Running   0          1m49s
-vault-2                                 1/1     Running   0          1m49s
-```
-
-#### Google KMS auto unseal
-
-The Helm chart may be run with [Google KMS for Auto
-Unseal](/vault/docs/configuration/seal/gcpckms). This enables Vault server pods to
-auto unseal if they are rescheduled.
-
-Vault Helm requires the Google Cloud KMS credentials stored in
-`credentials.json` and mounted as a secret in each Vault server pod.
-
-##### Create the secret
-
-First, create the secret in Kubernetes:
-
-```bash
-kubectl create secret generic kms-creds --from-file=credentials.json
-```
-
-Vault Helm mounts this to `/vault/userconfig/kms-creds/credentials.json`.
-
-##### Config example
-
-This is a Vault Helm configuration that uses Google KMS:
-
-```yaml
-global:
-  enabled: true
-
-server:
-  extraEnvironmentVars:
-    GOOGLE_REGION: global
-    GOOGLE_PROJECT: <PROJECT NAME>
-    GOOGLE_APPLICATION_CREDENTIALS: /vault/userconfig/kms-creds/credentials.json
-
-  volumes:
-    - name: userconfig-kms-creds
-      secret:
-        defaultMode: 420
-        secretName: kms-creds
-
-  volumeMounts:
-    - mountPath: /vault/userconfig/kms-creds
-      name: userconfig-kms-creds
-      readOnly: true
-
-  ha:
-    enabled: true
-    replicas: 3
-
-    config: |
-      ui = true
-
-      listener "tcp" {
-        tls_disable = 1
-        address = "[::]:8200"
-        cluster_address = "[::]:8201"
-      }
-
-      seal "gcpckms" {
-        project     = "<NAME OF PROJECT>"
-        region      = "global"
-        key_ring    = "<NAME OF KEYRING>"
-        crypto_key  = "<NAME OF KEY>"
-      }
-
-      storage "consul" {
-        path = "vault"
-        address = "HOST_IP:8500"
-      }
-```
-
-#### Amazon KMS auto unseal
-
-The Helm chart may be run with [AWS KMS for Auto
-Unseal](/vault/docs/configuration/seal/awskms). This enables Vault server pods to auto
-unseal if they are rescheduled.
-
-Vault Helm requires the AWS credentials stored as environment variables that
-are defined in each Vault server pod.
-
-##### Create the secret
-
-First, create a secret with your KMS access key/secret:
-
-```shell-session
-$ kubectl create secret generic kms-creds \
-    --from-literal=AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID?}" \
-    --from-literal=AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY?}"
-```
-
-##### Config example
-
-This is a Vault Helm configuration that uses AWS KMS:
-
-```yaml
-global:
-  enabled: true
-
-server:
-  extraSecretEnvironmentVars:
-    - envName: AWS_ACCESS_KEY_ID
-      secretName: kms-creds
-      secretKey: AWS_ACCESS_KEY_ID
-    - envName: AWS_SECRET_ACCESS_KEY
-      secretName: kms-creds
-      secretKey: AWS_SECRET_ACCESS_KEY
-
-  ha:
-    enabled: true
-    config: |
-      ui = true
-
-      listener "tcp" {
-        tls_disable = 1
-        address = "[::]:8200"
-        cluster_address = "[::]:8201"
-      }
-
-      seal "awskms" {
-        region     = "KMS_REGION_HERE"
-        kms_key_id = "KMS_KEY_ID_HERE"
-      }
-
-      storage "consul" {
-        address = "HOST_IP:8500"
-        path = "vault/"
-      }
-```
-
-### Probes
-
-Probes are essential for detecting failures, rescheduling and using pods in
-Kubernetes. The helm chart offers configurable readiness and liveliness probes
-which can be customized for a variety of use cases.
-
-Vault's [/sys/health`](/vault/api-docs/system/health) endpoint can be customized to
-change the behavior of the health check. For example, we can change the Vault
-readiness probe to show the Vault pods are ready even if they're still uninitialized
-and sealed using the following probe:
-
-```yaml
-server:
-  readinessProbe:
-    enabled: true
-    path: '/v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204'
-```
-
-Using this customized probe, a `postStart` script could automatically run once the
-pod is ready for additional setup.
-
-### Upgrading Vault on kubernetes
-
-To upgrade Vault on Kubernetes, we follow the same pattern as
-[generally upgrading Vault](/vault/docs/upgrading), except we can use
-the Helm chart to update the Vault server StatefulSet. It is important to understand
-how to [generally upgrade Vault](/vault/docs/upgrading) before reading this
-section.
-
-The Vault StatefulSet uses `OnDelete` update strategy. It is critical to use `OnDelete` instead
-of `RollingUpdate` because standbys must be updated before the active primary. A
-failover to an older version of Vault must always be avoided.
-
-!> **IMPORTANT NOTE:** Always back up your data before upgrading! Vault does not
-make backward-compatibility guarantees for its data store. Simply replacing the
-newly-installed Vault binary with the previous version may not cleanly
-downgrade Vault, as upgrades may perform changes to the underlying data
-structure that make the data incompatible with a downgrade. If you need to roll
-back to a previous version of Vault, you should roll back your data store as
-well.
-
-#### Upgrading Vault servers
-
-!> **IMPORTANT NOTE:** Helm will install the latest chart found in a repo by default.
-It's recommended to specify the chart version when upgrading.
-
-To initiate the upgrade, set the `server.image` values to the desired Vault
-version, either in a values yaml file or on the command line. For illustrative
-purposes, the example below uses `vault:123.456`.
-
-```yaml
-server:
-  image:
-    repository: 'vault'
-    tag: '123.456'
-```
-
-Next, list the Helm versions and choose the desired version to install.
-
-```bash
-$ helm search repo hashicorp/vault
-NAME           	CHART VERSION	APP VERSION	DESCRIPTION
-hashicorp/vault	0.27.0       	1.15.2     	Official HashiCorp Vault Chart
-```
-
-Next, test the upgrade with `--dry-run` first to verify the changes sent to the
-Kubernetes cluster.
-
-```shell-session
-$ helm upgrade vault hashicorp/vault --version=0.27.0 \
-    --set='server.image.repository=vault' \
-    --set='server.image.tag=123.456' \
-    --dry-run
-```
-
-This should cause no changes (although the resources are updated). If
-everything is stable, `helm upgrade` can be run.
-
-The `helm upgrade` command should have updated the StatefulSet template for
-the Vault servers, however, no pods have been deleted. The pods must be manually
-deleted to upgrade. Deleting the pods does not delete any persisted data.
-
-If Vault is not deployed using `ha` mode, the single Vault server may be deleted by
-running:
-
-```shell-session
-$ kubectl delete pod <name of Vault pod>
-```
-
-If Vault is deployed using `ha` mode, the standby pods must be upgraded first.
-Vault has K8s service discovery built in (when enabled in the server configuration) and
-will automatically change the labels of the pod with its current leader status. These labels
-can be used to filter the pods.
-
-For example, select all pods that are Vault standbys:
-
-```shell-session
-$ kubectl get pods -l vault-active=false
-```
-
-Select the active Vault pod:
-
-```shell-session
-$ kubectl get pods -l vault-active=true
-```
-
-Next, sequentially delete every pod that is not the active primary, ensuring the quorum is maintained at all times:
-
-```shell-session
-$ kubectl delete pod <name of Vault pod>
-```
-
-If auto-unseal is not being used, the newly scheduled Vault standby pods needs
-to be unsealed:
-
-```shell-session
-$ kubectl exec -ti <name of pod> -- vault operator unseal
-```
-
-Finally, once the standby nodes have been updated and unsealed, delete the active
-primary:
-
-```shell-session
-$ kubectl delete pod <name of Vault primary>
-```
-
-Similar to the standby nodes, the former primary also needs to be unsealed:
-
-```shell-session
-$ kubectl exec -ti <name of pod> -- vault operator unseal
-```
-
-After a few moments the Vault cluster should elect a new active primary. The Vault
-cluster is now upgraded!
-
-### Protecting sensitive Vault configurations
-
-Vault Helm renders a Vault configuration file during installation and stores the
-file in a Kubernetes configmap. Some configurations require sensitive data to be
-included in the configuration file and would not be encrypted at rest once created
-in Kubernetes.
-
-The following example shows how to add extra configuration files to Vault Helm
-to protect sensitive configurations from being in plaintext at rest using Kubernetes
-secrets.
-
-First, create a partial Vault configuration with the sensitive settings Vault
-loads during startup:
-
-```shell-session
-$ cat <<EOF >>config.hcl
-storage "mysql" {
-username = "user1234"
-password = "secret123!"
-database = "vault"
-}
-EOF
-```
-
-Next, create a Kubernetes secret containing this partial configuration:
-
-```shell-session
-$ kubectl create secret generic vault-storage-config \
-    --from-file=config.hcl
-```
-
-Finally, mount this secret as an extra volume and add an additional `-config` flag
-to the Vault startup command:
-
-```shell-session
-$ helm install vault hashicorp/vault \
-  --set='server.volumes[0].name=userconfig-vault-storage-config' \
-  --set='server.volumes[0].secret.defaultMode=420' \
-  --set='server.volumes[0].secret.secretName=vault-storage-config' \
-  --set='server.volumeMounts[0].mountPath=/vault/userconfig/vault-storage-config' \
-  --set='server.volumeMounts[0].name=userconfig-vault-storage-config' \
-  --set='server.volumeMounts[0].readOnly=true' \
-  --set='server.extraArgs=-config=/vault/userconfig/vault-storage-config/config.hcl'
-```
-
-## Architecture
-
-We recommend running Vault on Kubernetes with the same
-[general architecture](/vault/docs/internals/architecture)
-as running it anywhere else. There are some benefits Kubernetes can provide
-that eases operating a Vault cluster and we document those below. The standard
-[production deployment](/vault/tutorials/operations/production-hardening) tutorial is still an
-important read even if running Vault within Kubernetes.
-
-### Production deployment checklist
-
-_End-to-End TLS._ Vault should always be used with TLS in production. If
-intermediate load balancers or reverse proxies are used to front Vault,
-they should not terminate TLS. This way traffic is always encrypted in transit
-to Vault and minimizes risks introduced by intermediate layers. See the
-[official documentation](/vault/docs/platform/k8s/helm/examples/standalone-tls/)
-for example on configuring Vault Helm to use TLS.
-
-_Single Tenancy._ Vault should be the only main process running on a machine.
-This reduces the risk that another process running on the same machine is
-compromised and can interact with Vault. This can be accomplished by using Vault
-Helm's `affinity` configurable. See the
-[official documentation](/vault/docs/platform/k8s/helm/examples/ha-with-consul/)
-for example on configuring Vault Helm to use affinity rules.
-
-_Enable Auditing._ Vault supports several auditing backends. Enabling auditing
-provides a history of all operations performed by Vault and provides a forensics
-trail in the case of misuse or compromise. Audit logs securely hash any sensitive
-data, but access should still be restricted to prevent any unintended disclosures.
-Vault Helm includes a configurable `auditStorage` option that provisions a persistent
-volume to store audit logs. See the
-[official documentation](/vault/docs/platform/k8s/helm/examples/standalone-audit/)
-for an example on configuring Vault Helm to use auditing.
-
-_Immutable Upgrades._ Vault relies on an external storage backend for persistence,
-and this decoupling allows the servers running Vault to be managed immutably.
-When upgrading to new versions, new servers with the upgraded version of Vault
-are brought online. They are attached to the same shared storage backend and
-unsealed. Then the old servers are destroyed. This reduces the need for remote
-access and upgrade orchestration which may introduce security gaps. See the
-[upgrade section](#how-to) for instructions
-on upgrading Vault on Kubernetes.
-
-_Upgrade Frequently._ Vault is actively developed, and updating frequently is
-important to incorporate security fixes and any changes in default settings such
-as key lengths or cipher suites. Subscribe to the Vault mailing list and
-GitHub CHANGELOG for updates.
-
-_Restrict Storage Access._ Vault encrypts all data at rest, regardless of which
-storage backend is used. Although the data is encrypted, an attacker with arbitrary
-control can cause data corruption or loss by modifying or deleting keys. Access
-to the storage backend should be restricted to only Vault to avoid unauthorized
-access or operations.
diff --git a/website/content/docs/platform/k8s/helm/terraform.mdx b/website/content/docs/platform/k8s/helm/terraform.mdx
deleted file mode 100644
index 4a77b107115..00000000000
--- a/website/content/docs/platform/k8s/helm/terraform.mdx
+++ /dev/null
@@ -1,275 +0,0 @@
----
-layout: 'docs'
-page_title: 'Configure Vault Helm using Terraform'
-sidebar_current: 'docs-platform-k8s-terraform'
-description: |-
-  Describes how to configure the Vault Helm chart using Terraform
----
-
-# Configuring Vault helm with terraform
-
-Terraform may also be used to configure and deploy the Vault Helm chart, by using the [Helm provider](https://registry.terraform.io/providers/hashicorp/helm/latest/docs).
-
-For example, to configure the chart to deploy [HA Vault with integrated storage (raft)](/vault/docs/platform/k8s/helm/examples/ha-with-raft), the values overrides can be set on the command-line, in a values yaml file, or with a Terraform configuration:
-
-<CodeTabs>
-<CodeBlockConfig>
-
-```shell-session
-$ helm install vault hashicorp/vault \
-  --set='server.ha.enabled=true' \
-  --set='server.ha.raft.enabled=true'
-```
-
-</CodeBlockConfig>
-
-<CodeBlockConfig>
-
-```yaml
-server:
-  ha:
-    enabled: true
-    raft:
-      enabled: true
-```
-
-</CodeBlockConfig>
-
-<CodeBlockConfig>
-
-```hcl
-provider "helm" {
-  kubernetes {
-    config_path = "~/.kube/config"
-  }
-}
-
-resource "helm_release" "vault" {
-  name       = "vault"
-  repository = "https://helm.releases.hashicorp.com"
-  chart      = "vault"
-
-  set {
-    name  = "server.ha.enabled"
-    value = "true"
-  }
-  set {
-    name  = "server.ha.raft.enabled"
-    value = "true"
-  }
-}
-```
-
-</CodeBlockConfig>
-</CodeTabs>
-
-The values file can also be used directly in the Terraform configuration with the [`values` directive](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release#values#values).
-
-## Further examples
-
-### Vault config as a multi-line string
-
-<CodeTabs>
-<CodeBlockConfig>
-
-```yaml
-server:
-  ha:
-    enabled: true
-    raft:
-      enabled: true
-      setNodeId: true
-      config: |
-        ui = false
-
-        listener "tcp" {
-          tls_disable = 1
-          address = "[::]:8200"
-          cluster_address = "[::]:8201"
-        }
-
-        storage "raft" {
-          path    = "/vault/data"
-        }
-
-        service_registration "kubernetes" {}
-
-        seal "awskms" {
-          region     = "us-west-2"
-          kms_key_id = "alias/my-kms-key"
-        }
-```
-
-</CodeBlockConfig>
-<CodeBlockConfig>
-
-```hcl
-resource "helm_release" "vault" {
-  name       = "vault"
-  repository = "https://helm.releases.hashicorp.com"
-  chart      = "vault"
-
-  set {
-    name  = "server.ha.enabled"
-    value = "true"
-  }
-  set {
-    name  = "server.ha.raft.enabled"
-    value = "true"
-  }
-  set {
-    name  = "server.ha.raft.setNodeId"
-    value = "true"
-  }
-  set {
-    name  = "server.ha.raft.config"
-    value = <<EOT
-ui = false
-
-listener "tcp" {
-  tls_disable = 1
-  address = "[::]:8200"
-  cluster_address = "[::]:8201"
-}
-
-storage "raft" {
-  path    = "/vault/data"
-}
-
-service_registration "kubernetes" {}
-
-seal "awskms" {
-  region     = "us-west-2"
-  kms_key_id = "alias/my-kms-key"
-}
-EOT
-  }
-}
-```
-
-</CodeBlockConfig>
-</CodeTabs>
-
-### Lists of volumes and volumeMounts
-
-<CodeTabs>
-<CodeBlockConfig>
-
-```yaml
-server:
-  volumes:
-    - name: userconfig-my-gcp-iam
-      secret:
-        defaultMode: 420
-        secretName: my-gcp-iam
-
-  volumeMounts:
-    - mountPath: /vault/userconfig/my-gcp-iam
-      name: userconfig-my-gcp-iam
-      readOnly: true
-```
-
-</CodeBlockConfig>
-
-<CodeBlockConfig>
-
-```hcl
-resource "helm_release" "vault" {
-  name       = "vault"
-  repository = "https://helm.releases.hashicorp.com"
-  chart      = "vault"
-
-  set {
-    name  = "server.volumes[0].name"
-    value = "userconfig-my-gcp-iam"
-  }
-  set {
-    name  = "server.volumes[0].secret.defaultMode"
-    value = "420"
-  }
-  set {
-    name  = "server.volumes[0].secret.secretName"
-    value = "my-gcp-iam"
-  }
-
-  set {
-    name  = "server.volumeMounts[0].mountPath"
-    value = "/vault/userconfig/my-gcp-iam"
-  }
-  set {
-    name  = "server.volumeMounts[0].name"
-    value = "userconfig-my-gcp-iam"
-  }
-  set {
-    name  = "server.volumeMounts[0].readOnly"
-    value = "true"
-  }
-}
-```
-
-</CodeBlockConfig>
-</CodeTabs>
-
-### Annotations
-
-Annotations can be set as a YAML map:
-
-<CodeTabs>
-
-<CodeBlockConfig>
-
-```yaml
-server:
-  ingress:
-    annotations:
-      service.beta.kubernetes.io/azure-load-balancer-internal: true
-      service.beta.kubernetes.io/azure-load-balancer-internal-subnet: apps-subnet
-```
-</CodeBlockConfig>
-
-<CodeBlockConfig>
-
-```hcl
-  set {
-    name = "server.ingress.annotations.service\\.beta\\.kubernetes\\.io/azure-load-balancer-internal"
-    value = "true"
-  }
-
-  set {
-    name = "server.ingress.annotations.service\\.beta\\.kubernetes\\.io/azure-load-balancer-internal-subnet"
-    value = "apps-subnet"
-  }
-```
-
-</CodeBlockConfig>
-</CodeTabs>
-
-or as a multi-line string:
-
-<CodeTabs>
-<CodeBlockConfig>
-
-```yaml
-server:
-  ingress:
-    annotations: |
-      service.beta.kubernetes.io/azure-load-balancer-internal: true
-      service.beta.kubernetes.io/azure-load-balancer-internal-subnet: apps-subnet
-```
-
-</CodeBlockConfig>
-<CodeBlockConfig>
-
-```hcl
-  set {
-    name = "server.ingress.annotations"
-    value = yamlencode({
-      "service.beta.kubernetes.io/azure-load-balancer-internal": "true"
-      "service.beta.kubernetes.io/azure-load-balancer-internal-subnet": "apps-subnet"
-    })
-    type = "auto"
-  }
-```
-
-</CodeBlockConfig>
-</CodeTabs>
diff --git a/website/content/docs/platform/k8s/index.mdx b/website/content/docs/platform/k8s/index.mdx
deleted file mode 100644
index 162ba5419b9..00000000000
--- a/website/content/docs/platform/k8s/index.mdx
+++ /dev/null
@@ -1,81 +0,0 @@
----
-layout: docs
-page_title: Kubernetes
-description: This section documents the official integration between Vault and Kubernetes.
----
-
-# Kubernetes
-
-Vault can be deployed into Kubernetes using the official HashiCorp Vault Helm chart.
-The Helm chart allows users to deploy Vault in various configurations:
-
-- Dev: a single in-memory Vault server for testing Vault
-- Standalone (default): a single Vault server persisting to a volume using the file storage backend
-- High-Availability (HA): a cluster of Vault servers that use an HA storage backend such as Consul (default)
-- External: a Vault Agent Injector server that depends on an external Vault server
-
-## Use cases
-
-**Running a Vault Service:** The Vault server cluster can run directly on Kubernetes.
-This can be used by applications running within Kubernetes as well as external to
-Kubernetes, as long as they can communicate to the server via the network.
-
-**Accessing and Storing Secrets:** Applications using the Vault service running in
-Kubernetes can access and store secrets from Vault using a number of different
-[secret engines](/vault/docs/secrets) and [authentication methods](/vault/docs/auth).
-
-**Running a Highly Available Vault Service:** By using pod affinities, highly available
-backend storage (such as Consul) and [auto-unseal](/vault/docs/concepts/seal#auto-unseal),
-Vault can become a highly available service in Kubernetes.
-
-**Encryption as a Service:** Applications using the Vault service running in Kubernetes
-can leverage the [Transit secret engine](/vault/docs/secrets/transit)
-as "encryption as a service". This allows applications to offload encryption needs
-to Vault before storing data at rest.
-
-**Audit Logs for Vault:** Operators can choose to attach a persistent volume
-to the Vault cluster which can be used to [store audit logs](/vault/docs/audit).
-
-**And more!** Vault can run directly on Kubernetes, so in addition to the
-native integrations provided by Vault itself, any other tool built for
-Kubernetes can choose to leverage Vault.
-
-## Getting started with Vault and kubernetes
-
-There are several ways to try Vault with Kubernetes in different environments.
-
-### Guides
-
-- [Vault Installation to Minikube via Helm with Integrated Storage](/vault/tutorials/kubernetes/kubernetes-minikube-raft) covers installing Vault locally using Minikube and the official Helm chart.
-
-- [Vault Installation to Red Hat OpenShift via Helm](/vault/tutorials/kubernetes/kubernetes-openshift) covers installing Vault using Helm on Red Hat's OpenShift platform.
-
-- [Integrate a Kubernetes Cluster with an External Vault](/vault/tutorials/kubernetes/kubernetes-external-vault) provides an example of making Vault accessible via a Kubernetes service and endpoint.
-
-- [Vault on Kubernetes Deployment Guide](/vault/tutorials/kubernetes/kubernetes-raft-deployment-guide) covers the steps required to install and configure a single HashiCorp Vault cluster.
-
-### High level comparison of integrations
-
-There are currently 3 different integrations to help Kubernetes workloads seamlessly consume secrets from Vault, without the need to modify the application to interact directly with Vault. Each integration addresses slightly different use-cases. The following is a brief overview of the strengths of each integration.
-
-#### Agent injector
-
-- No durable secret storage outside Vault. All secrets written to disk are in ephemeral in-memory volumes.
-- No highly privileged service accounts required. All secrets are fetched with the pod's own service account without the need for any other service accounts to impersonate it.
-- More mature solution, with proven production record and advanced features like templating,
-  wider array of auth methods, etc.
-
-#### Vault Secrets Operator
-
-- More native UX for app developers. Workloads can mount Kubernetes secrets without adding any Vault-specific configuration.
-- Reduced load on Vault. Secrets are synced per CRD instead of per consuming pod.
-- Better Vault secret availability. Kubernetes secrets act as a durable cluster-local cache of Vault secrets.
-
-#### Vault CSI provider
-
-- The CSI driver that the provider is based on is vendor neutral.
-- No durable secret storage outside Vault if the secret sync feature isn't used. All secrets written to disk are in ephemeral in-memory volumes.
-
-### Documentation
-
-- [Vault on Kubernetes Security Considerations](/vault/tutorials/kubernetes/kubernetes-security-concerns) provides recommendations specific to securely running Vault in a production Kubernetes environment.
diff --git a/website/content/docs/platform/k8s/injector-csi.mdx b/website/content/docs/platform/k8s/injector-csi.mdx
deleted file mode 100644
index 9b54b8be2bb..00000000000
--- a/website/content/docs/platform/k8s/injector-csi.mdx
+++ /dev/null
@@ -1,128 +0,0 @@
----
-layout: docs
-page_title: Agent Injector vs. Vault CSI Provider
-description: This section compares Sidecar Injector and Vault CSI Provider for Kubernetes and Vault integration.
----
-
-# Agent injector vs. Vault CSI provider
-
-This document explores two different methods for integrating HashiCorp Vault with Kubernetes. The information provided is intended for DevOps practitioners who understand secret management concepts and are familiar with HashiCorp Vault and Kubernetes. This document also offers practical guidance to help you understand and choose the best method for your use case.
-
-Information contained within this document details the contrast between the Agent Injector, also referred as _Vault Sidecar_ or _Sidecar_ in this document, and the Vault Container Storage Interface (CSI) provider used to integrate Vault and Kubernetes.
-
-## Vault sidecar agent injector
-
-The [Vault Sidecar Agent Injector](/vault/docs/platform/k8s/injector) leverages the [sidecar pattern](https://docs.microsoft.com/en-us/azure/architecture/patterns/sidecar) to alter pod specifications to include a Vault Agent container that renders Vault secrets to a shared memory volume. By rendering secrets to a shared volume, containers within the pod can consume Vault secrets without being Vault-aware. The injector is a Kubernetes mutating webhook controller. The controller intercepts pod events and applies mutations to the pod if annotations exist within the request. This functionality is provided by the [vault-k8s](https://github.com/hashicorp/vault-k8s) project and can be automatically installed and configured using the Vault Helm chart.
-
-![Vault Sidecar Injection Workflow](/img/vault-sidecar-inject-workflow.png)
-
-## Vault CSI provider
-
-The [Vault CSI provider](/vault/docs/platform/k8s/csi) allows pods to consume Vault secrets by using ephemeral [CSI Secrets Store](https://github.com/kubernetes-sigs/secrets-store-csi-driver) volumes. At a high level, the CSI Secrets Store driver enables users to create `SecretProviderClass` objects. These objects define which secret provider to use and what secrets to retrieve. When pods requesting CSI volumes are made, the CSI Secrets Store driver sends the request to the Vault CSI provider if the provider is `vault`. The Vault CSI provider then uses the specified `SecretProviderClass` and the pod’s service account to retrieve the secrets from Vault and mount them into the pod’s CSI volume. Note that the secret is retrieved from Vault and populated to the CSI secrets store volume during the `ContainerCreation` phase. Therefore, pods are blocked from starting until the secrets are read from Vault and written to the volume.
-
-![Vault Sidecar Injection Workflow](/img/vault-csi-workflow.png)
-
-~> **Note**: Secrets are fetched earlier in the pod lifecycle, therefore, they have fewer compatibility issues with Sidecars, such as Istio.
-
-Before we get into some of the similarities and differences between the two solutions, let's look at several common design considerations.
-
-- **Secret projections:** Every application requires secrets to explicitly presented. Typically, applications expect secrets to be either exported as environment variables or written to a file that the application can read on startup. Keep that in mind as you’re deciding on a suitable method to use.
-
-- **Secret scope:** Some applications are deployed across multiple Kubernetes environments (e.g., dev, qa, prod) across your data centers, the edge, or public clouds. Some services run outside of Kubernetes on VMs, serverless, or other cloud-managed services. You may face scenarios where these applications need to share sets of secrets across these heterogeneous environments. Scoping the secrets correctly to be either local to the Kubernetes environment or global across different environments helps ensure that each application can easily and securely access its own set of secrets within the environment it is deployed in.
-
-- **Secret types:** Secrets can be text files, binary files, tokens, or certs, or they can be statically or dynamically generated. They can also be valid permanently or time-scoped, and can vary in size. You need to consider the secret types your application requires and how they’re projected into the application.
-
-- **Secret definition:** You also need to consider how each secret is defined, created, updated, and removed, as well as the tooling associated with that process.
-
-- **Encryption:** Encrypting secrets both at rest and in transit is a critical requirement for many enterprise organizations.
-
-- **Governance:** Applications and secrets can have a many-to-many relationship that requires careful considerations when granting access for applications to retrieve their respective secrets. As the number of applications and secrets scale, so does the challenge of managing their access policies.
-
-- **Secrets updates and rotation:** Secrets can be leased, time-scoped, or automatically rotated, and each scenario needs to be a programmatic process to ensure the new secret is propagated to the application pods properly.
-
-- **Secret caching:** In certain Kubernetes environments (e.g., edge or retail), there is a potential need for secret caching in the case of communication or network failures between the environment and the secret storage.
-
-- **Auditability:** Keeping a secret access audit log detailing all secret access information is critical to ensure traceability of secret-access events.
-
-Now that you're familiar with some of the design considerations, we'll explore the similarities and differences between the two solutions to help you determine the best solution to use as you design and implement your secrets management strategy in a Kubernetes environment.
-
-## Similarities
-
-Both Agent Injection and Vault CSI solutions have the following similarities:
-
-- They simplify retrieving different types of secrets stored in Vault and expose them to the target pod running on Kubernetes without knowing the not-so-trivial Vault processes. It’s important to note that there is no need to change the application logic or code to use these solutions, therefore, making it easier to migrate brownfield applications into Kubernetes. Developers working on greenfield applications can leverage the Vault SDKs to integrate with Vault directly.
-
-- They support all types of Vault [secrets engines](/vault/docs/secrets). This support allows you to leverage an extensive set of secret types, ranging from static key-value secrets to dynamically generated database credentials and TLS certs with customized TTL.
-
-- They leverage the application’s Kubernetes pod service account token as [Secret Zero](https://www.hashicorp.com/resources/secret-zero-mitigating-the-risk-of-secret-introduction-with-vault) to authenticate with Vault via the Kubernetes auth method. With this method, there is no need to manage yet another separate identity to identify the application pods when authenticating to Vault.
-
-- Secret lifetime is tied to the lifetime of the pod for both methods. While this holds true for file contents inside the pod, this also holds true for Kubernetes secrets that CSI creates. Secrets are automatically created and deleted as the pod is created and deleted.
-
-![Vault's Kubernetes auth workflow](/img/k8s-auth-workflow.png)
-
-- They require the desired secrets to exist within Vault before deploying the application.
-
-- They require the pod’s service account to bind to a Vault role with a policy enabling access to desired secrets (that is, Kubernetes RBAC isn’t used to authorize access to secrets).
-
-- They can both be deployed via Helm.
-
-- They require successfully retrieving secrets from Vault before the pods are started.
-
-- They rely on user-defined pod annotations to retrieve the required secrets from Vault.
-
-## Differences
-
-Now that you understand the similarities, there are differences between these two solutions for considerations:
-
-- The Sidecar Agent Injector solution is composed of two elements:
-
-  - The Sidecar Service Injector, which is deployed as a cluster service and is responsible for intercepting Kubernetes apiserver pod events and mutating pod specs to add required sidecar containers
-  - The Vault Sidecar Container, which is deployed alongside each application pod and is responsible for authenticating into Vault, retrieving secrets from Vault, and rendering secrets for the application to consume.
-
-- In contrast, the Vault CSI Driver is deployed as a daemonset on every node in the Kubernetes cluster and uses the Secret Provider Class specified and the pod’s service account to retrieve the secrets from Vault and mount them into the pod’s CSI volume.
-
-- The Sidecar Agent Injector supports [all](/vault/docs/platform/k8s/injector/annotations#vault-hashicorp-com-auth-path) Vault [auto-auth](/vault/docs/agent-and-proxy/autoauth/methods) methods. The Sidecar CSI driver supports only Vault’s [Kubernetes auth method](/vault/docs/platform/k8s/csi/configurations#vaultkubernetesmountpath).
-
-- The Sidecar container launched with every application pod uses [Vault Agent](https://www.hashicorp.com/blog/why-use-the-vault-agent-for-secrets-management), which provides a powerful set of capabilities such as auto-auth, templating, and caching. The CSI driver does not use the Vault Agent and therefore lacks these functionalities.
-
-- The Vault CSI driver supports rendering Vault secrets into Kubernetes secrets and environment variables. Sidecar Injector Service does not support rendering secrets into Kubernetes secrets; however, there are ways to [agent templating](/vault/docs/platform/k8s/injector/examples#environment-variable-example) to render secrets into environment variables.
-
-- The CSI driver uses `hostPath` to mount ephemeral volumes into the pods, which some container platforms (e.g., OpenShift) disable by default. On the other hand, Sidecar Agent Service uses in-memory _tmpfs_ volumes.
-
-- Sidecar Injector Service [automatically](/vault/docs/agent-and-proxy/agent/template#renewals-and-updating-secrets) renews, rotates, and fetches secrets/tokens while the CSI Driver does not support that.
-
-## Comparison chart
-
-The below chart provides a high-level comparison between the two solutions.
-
-~> **Note:** Shared Memory Volume Environment Variable can be achieved through [Agent templating](/vault/docs/platform/k8s/injector/examples#environment-variable-example).
-
-![Comparison Chart](/img/comparison-table.png)
-
-## Going beyond the native kubernetes secrets
-
-On the surface, Kubernetes native secrets might seem similar to the two approaches presented above, but there are significant differences between them:
-
-- Kubernetes is not a secrets management solution. It does have native support for secrets, but that is quite different from an enterprise secrets management solution. Kubernetes secrets are scoped to the cluster only, and many applications will have some services running outside Kubernetes or in other Kubernetes clusters. Having these applications use Kubernetes secrets from outside a Kubernetes environment will be cumbersome and introduce authentication and authorization challenges. Therefore, considering the secret scope as part of the design process is critical.
-
-- Kubernetes secrets are static in nature. You can define secrets by using kubectl or the Kubernetes API, but once they are defined, they are stored in etcd and presented to pods only during pod creation. Defining secrets in this manner may create scenarios where secrets get stale, outdated, or expired, requiring additional workflows to update and rotate the secrets, and then re-deploy the application to use the new version, which can add complexity and become quite time-consuming. Ensure consideration is given to all requirements for secret freshness, updates, and rotation as part of your design process.
-
-- The secret access management security model is tied to the Kubernetes RBAC model. This model can be challenging for users who are not familiar with Kubernetes. Adopting a platform-agnostic security governance model can enable you to adapt workflows for applications regardless of how and where they are running.
-
-## Summary
-
-Designing secrets management in Kubernetes is an intricate task. There are multiple approaches, each with its own set of attributes. We recommend exploring the options presented in this document to increase your understanding of the internals and decide on the best option for your use case.
-
-## Additional resources
-
-- [HashiCorp Vault: Delivering Secrets with Kubernetes](https://medium.com/hashicorp-engineering/hashicorp-vault-delivering-secrets-with-kubernetes-1b358c03b2a3)
-
-- [Retrieve HashiCorp Vault Secrets with Kubernetes CSI](https://www.hashicorp.com/blog/retrieve-hashicorp-vault-secrets-with-kubernetes-csi)
-
-- [Mount Vault Secrets Through Container Storage Interface (CSI) Volume](/vault/tutorials/kubernetes/kubernetes-secret-store-driver)
-
-- [Injecting Secrets into Kubernetes Pods via Vault Agent Containers](/vault/tutorials/kubernetes/kubernetes-sidecar)
-
-- [Vault Sidecar Injector Configurations and Examples](/vault/docs/platform/k8s/injector/annotations)
-
-- [Vault CSI Driver Configurations and Examples](/vault/docs/platform/k8s/csi/configurations)
diff --git a/website/content/docs/platform/k8s/injector/annotations.mdx b/website/content/docs/platform/k8s/injector/annotations.mdx
deleted file mode 100644
index a98cfb390ae..00000000000
--- a/website/content/docs/platform/k8s/injector/annotations.mdx
+++ /dev/null
@@ -1,333 +0,0 @@
----
-layout: docs
-page_title: Agent Sidecar Injector Annotations
-description: This section documents the configurable annotations for the Vault Agent Injector.
----
-
-# Annotations
-
-The following are the available annotations for the injector. These annotations
-are organized into two sections: agent and vault. All of the annotations below
-change the configurations of the Vault Agent containers injected into the pod.
-
-## Agent annotations
-
-Agent annotations change the Vault Agent containers templating configuration. For
-example, agent annotations allow users to define what secrets they want, how to render
-them, optional commands to run, etc.
-
-- `vault.hashicorp.com/agent-inject` - configures whether injection is explicitly
-  enabled or disabled for a pod. This should be set to a `true` or `false` value.
-  Defaults to `false`.
-
-- `vault.hashicorp.com/agent-inject-status` - blocks further mutations
-  by adding the value `injected` to the pod after a successful mutation.
-
-- `vault.hashicorp.com/agent-configmap` - name of the configuration map where Vault
-  Agent configuration file and templates can be found.
-
-- `vault.hashicorp.com/agent-image` - name of the Vault docker image to use. This
-  value overrides the default image configured in the injector and is usually
-  not needed. Defaults to `hashicorp/vault:1.15.1`.
-
-- `vault.hashicorp.com/agent-init-first` - configures the pod to run the Vault Agent
-  init container first if `true` (last if `false`). This is useful when other init
-  containers need pre-populated secrets. This should be set to a `true` or `false`
-  value. Defaults to `false`.
-
-- `vault.hashicorp.com/agent-inject-command` - configures Vault Agent
-  to run a command after the template has been rendered. To map a command to a specific
-  secret, use the same unique secret name: `vault.hashicorp.com/agent-inject-command-SECRET-NAME`.
-  For example, if a secret annotation `vault.hashicorp.com/agent-inject-secret-foobar`
-  is configured, `vault.hashicorp.com/agent-inject-command-foobar` would map a command
-  to that secret.
-
-- `vault.hashicorp.com/agent-inject-secret` - configures Vault Agent
-  to retrieve the secrets from Vault required by the container. The name of the
-  secret is any unique string after `vault.hashicorp.com/agent-inject-secret-`,
-  such as `vault.hashicorp.com/agent-inject-secret-foobar`. The value is the path
-  in Vault where the secret is located.
-
-- `vault.hashicorp.com/agent-inject-template` - configures the template Vault Agent
-  should use for rendering a secret. The name of the template is any
-  unique string after `vault.hashicorp.com/agent-inject-template-`, such as
-  `vault.hashicorp.com/agent-inject-template-foobar`. This should map to the same
-  unique value provided in `vault.hashicorp.com/agent-inject-secret-`. If not provided,
-  a default generic template is used.
-
-- `vault.hashicorp.com/agent-inject-containers` - comma-separated list that specifies in
-  which containers the secrets volume should be mounted. If not provided, the secrets
-  volume will be mounted in all containers in the pod.
-
-- `vault.hashicorp.com/secret-volume-path` - configures where on the filesystem a secret
-  will be rendered. To map a path to a specific secret, use the same unique secret name:
-  `vault.hashicorp.com/secret-volume-path-SECRET-NAME`. For example, if a secret annotation
-  `vault.hashicorp.com/agent-inject-secret-foobar` is configured,
-  `vault.hashicorp.com/secret-volume-path-foobar` would configure where that secret
-  is rendered. If no secret name is provided, this sets the default for all rendered
-  secrets in the pod.
-
-- `vault.hashicorp.com/agent-inject-file` - configures the filename and path
-  in the secrets volume where a Vault secret will be written. This should be used
-  with `vault.hashicorp.com/secret-volume-path`, which mounts a memory volume to
-  the specified path. If `secret-volume-path` is used, the path can be omitted from
-  this value. To map a filename to a specific secret, use the same unique secret name:
-  `vault.hashicorp.com/agent-inject-file-SECRET-NAME`. For example, if a secret annotation
-  `vault.hashicorp.com/agent-inject-secret-foobar` is configured,
-  `vault.hashicorp.com/agent-inject-file-foobar` would configure the filename.
-
-- `vault.hashicorp.com/agent-inject-perms` - configures the permissions of the
-  file to create in the secrets volume. The name of the secret is the string
-  after "vault.hashicorp.com/agent-inject-perms-", and should map to the same
-  unique value provided in "vault.hashicorp.com/agent-inject-secret-". The value
-  is the octal permission, for example: `0644`.
-
-- `vault.hashicorp.com/agent-inject-template-file` - configures the path and filename of the
-  custom template to use. This should be used with `vault.hashicorp.com/extra-secret`,
-  which mounts a Kubernetes secret to `/vault/custom`. To map a template file to a specific secret,
-  use the same unique secret name: `vault.hashicorp.com/agent-inject-template-file-SECRET-NAME`.
-  For example, if a secret annotation `vault.hashicorp.com/agent-inject-secret-foobar` is configured,
-  `vault.hashicorp.com/agent-inject-template-file-foobar` would configure the template file.
-
-- `vault.hashicorp.com/agent-inject-default-template` - configures the default template type for rendering
-  secrets if no custom template is defined. Possible values include `map` and `json`. Defaults to `map`.
-
-- `vault.hashicorp.com/template-config-exit-on-retry-failure` - controls whether
-  Vault Agent exits after it has exhausted its number of template retry attempts
-  due to failures. Defaults to `true`. See [Vault Agent Template
-  Config](/vault/docs/agent-and-proxy/agent/template#template-configurations) for more details.
-
-- `vault.hashicorp.com/template-static-secret-render-interval` - If specified,
-  configures how often Vault Agent Template should render non-leased secrets such as KV v2.
-  See [Vault Agent Template Config](/vault/docs/agent-and-proxy/agent/template#template-configurations) for more details.
-
-- `vault.hashicorp.com/agent-extra-secret` - mounts Kubernetes secret as a volume at
-  `/vault/custom` in the sidecar/init containers. Useful for custom Agent configs with
-  auto-auth methods such as approle that require paths to secrets be present.
-
-- `vault.hashicorp.com/agent-inject-token` - configures Vault Agent to share the Vault
-  token with other containers in the pod, in a file named `token` in the root of the
-  secrets volume (i.e. `/vault/secrets/token`). This is helpful when other containers
-  communicate directly with Vault but require auto-authentication provided by Vault
-  Agent. This should be set to a `true` or `false` value. Defaults to `false`.
-
-- `vault.hashicorp.com/agent-limits-cpu` - configures the CPU limits on the Vault
-  Agent containers. Defaults to `500m`. Setting this to an empty string disables
-  CPU limits.
-
-- `vault.hashicorp.com/agent-limits-mem` - configures the memory limits on the Vault
-  Agent containers. Defaults to `128Mi`. Setting this to an empty string disables
-  memory limits.
-
-- `vault.hashicorp.com/agent-limits-ephemeral` - configures the ephemeral
-  storage limit on the Vault Agent containers. Defaults to unset, which
-  disables ephemeral storage limits. Also available as a command-line option
-  (`-ephemeral-storage-limit`) or environment variable (`AGENT_INJECT_EPHEMERAL_LIMIT`)
-  to set the default for all injected Agent containers. **Note:** Pod limits are
-  equal to the sum of all container limits. Setting this limit without setting it
-  for other containers will also affect the limits of other containers in the pod.
-  See [Kubernetes resources documentation][k8s-resources] for more details.
-
-- `vault.hashicorp.com/agent-requests-cpu` - configures the CPU requests on the
-  Vault Agent containers. Defaults to `250m`. Setting this to an empty string disables
-  CPU requests.
-
-- `vault.hashicorp.com/agent-requests-mem` - configures the memory requests on the
-  Vault Agent containers. Defaults to `64Mi`. Setting this to an empty string disables
-  memory requests.
-
-- `vault.hashicorp.com/agent-requests-ephemeral` - configures the ephemeral
-  storage requests on the Vault Agent Containers. Defaults to unset, which
-  disables ephemeral storage requests (and will default to the ephemeral limit
-  if set). Also available as a command-line option (`-ephemeral-storage-request`)
-  or environment variable (`AGENT_INJECT_EPHEMERAL_REQUEST`) to set the default
-  for all injected Agent containers. **Note:** Pod requests are equal to the sum
-  of all container requests. Setting this limit without setting it for other
-  containers will also affect the requests of other containers in the pod. See
-  [Kubernetes resources documentation][k8s-resources] for more details.
-
-- `vault.hashicorp.com/agent-revoke-on-shutdown` - configures whether the sidecar
-  will revoke it's own token before shutting down. This setting will only be applied
-  to the Vault Agent sidecar container. This should be set to a `true` or `false`
-  value. Defaults to `false`.
-
-- `vault.hashicorp.com/agent-revoke-grace` - configures the grace period, in seconds,
-  for revoking it's own token before shutting down. This setting will only be applied
-  to the Vault Agent sidecar container. Defaults to `5s`.
-
-- `vault.hashicorp.com/agent-pre-populate` - configures whether an init container
-  is included to pre-populate the shared memory volume with secrets prior to the
-  containers starting.
-
-- `vault.hashicorp.com/agent-pre-populate-only` - configures whether an init container
-  is the only injected container. If true, no sidecar container will be injected
-  at runtime of the pod. Enabling this option is recommended for workloads of
-  type `CronJob` or `Job` to ensure a clean pod termination.
-
-- `vault.hashicorp.com/preserve-secret-case` - configures Vault Agent to preserve
-  the secret name case when creating the secret files. This should be set to a `true`
-  or `false` value. Defaults to `false`.
-
-- `vault.hashicorp.com/agent-run-as-user` - sets the user (uid) to run Vault
-  agent as. Also available as a command-line option (`-run-as-user`) or
-  environment variable (`AGENT_INJECT_RUN_AS_USER`) for the injector. Defaults
-  to 100.
-
-- `vault.hashicorp.com/agent-run-as-group` - sets the group (gid) to run Vault
-  agent as. Also available as a command-line option (`-run-as-group`) or
-  environment variable (`AGENT_INJECT_RUN_AS_GROUP`) for the injector. Defaults
-  to 1000.
-
-- `vault.hashicorp.com/agent-set-security-context` - controls whether
-  `SecurityContext` is set in injected containers. Also available as a
-  command-line option (`-set-security-context`) or environment variable
-  (`AGENT_INJECT_SET_SECURITY_CONTEXT`). Defaults to `true`.
-
-- `vault.hashicorp.com/agent-run-as-same-user` - run the injected Vault agent
-  containers as the User (uid) of the first application container in the pod.
-  Requires `Spec.Containers[0].SecurityContext.RunAsUser` to be set in the pod
-  spec. Also available as a command-line option (`-run-as-same-user`) or
-  environment variable (`AGENT_INJECT_RUN_AS_SAME_USER`). Defaults to `false`.
-
-  ~> **Note**: If the first application container in the pod is running as root
-  (uid 0), the `run-as-same-user` annotation will fail injection with an error.
-
-- `vault.hashicorp.com/agent-share-process-namespace` - sets
-  [shareProcessNamespace] in the Pod spec where Vault Agent is injected.
-  Defaults to `false`.
-
-- `vault.hashicorp.com/agent-cache-enable` - configures Vault Agent to enable
-  [caching](/vault/docs/agent-and-proxy/agent/caching). In Vault 1.7+ this annotation will also enable
-  a Vault Agent persistent cache. This persistent cache will be shared between the init
-  and sidecar container to reuse tokens and leases retrieved by the init container.
-  Defaults to `false`.
-
-- `vault.hashicorp.com/agent-cache-use-auto-auth-token` - configures Vault Agent cache
-  to authenticate on behalf of the requester. Set to `force` to enable. Disabled
-  by default.
-
-- `vault.hashicorp.com/agent-cache-listener-port` - configures Vault Agent cache
-  listening port. Defaults to `8200`.
-
-- `vault.hashicorp.com/agent-copy-volume-mounts` - copies the mounts from the specified
-  container and mounts them to the Vault Agent containers. The service account volume is
-  ignored.
-
-- `vault.hashicorp.com/agent-service-account-token-volume-name` - the optional name of a projected volume containing a service account token for use with auto-auth against Vault's Kubernetes auth method. If the volume is mounted to another container in the deployment, the token volume will be mounted to the same location in the vault-agent containers. Otherwise it will be mounted at the default location of `/var/run/secrets/vault.hashicorp.com/serviceaccount/`.
-
-- `vault.hashicorp.com/agent-enable-quit` - enable the [`/agent/v1/quit` endpoint](/vault/docs/agent-and-proxy/agent#quit) on an injected agent. This option defaults to false, and if true will be set on the existing cache listener, or a new localhost listener with a basic cache stanza configured. The [agent-cache-listener-port annotation](/vault/docs/platform/k8s/injector/annotations#vault-hashicorp-com-agent-cache-listener-port) can be used to change the port.
-
-- `vault.hashicorp.com/agent-telemetry` - specifies the [telemetry](/vault/docs/configuration/telemetry) configuration for the
-  Vault Agent sidecar. The name of the config is any unique string after
-  `vault.hashicorp.com/agent-telemetry-`, such as `vault.hashicorp.com/agent-telemetry-prometheus_retention_time`.
-  This annotation can be reused multiple times to configure multiple settings for the agent telemetry.
-
-- `vault.hashicorp.com/go-max-procs` - set the `GOMAXPROCS` environment variable for injected agents
-
-- `vault.hashicorp.com/agent-json-patch` - change the injected agent sidecar container using a [JSON patch](https://jsonpatch.com/) before it is created.
-  This can be used to add, remove, or modify any attribute of the container.
-  For example, setting this to `[{"op": "replace", "path": "/name", "value": "different-name"}]` will update the agent container's name to be `different-name`
-  instead of the default `vault-agent`.
-
-- `vault.hashicorp.com/agent-init-json-patch` - same as `vault.hashicorp.com/agent-json-patch`, except that the JSON patch will be applied to the
-  injected init container instead.
-
-## Vault annotations
-
-Vault annotations change how the Vault Agent containers communicate with Vault. For
-example, Vault's address, TLS certificates to use, client parameters such as timeouts,
-etc.
-
-- `vault.hashicorp.com/auth-config` - configures additional parameters for the configured
-  authentication method. The name of the config is any unique string after
-  `vault.hashicorp.com/auth-config-`, such as `vault.hashicorp.com/auth-config-role-id-file-path`.
-  This annotation can be reused multiple times to configure multiple settings for the authentication
-  method. Some authentication methods may require additional secrets and should be mounted via the
-  `vault.hashicorp.com/agent-extra-secret` annotation. For a list of valid authentication configurations,
-  see the Vault Agent [auto-auth documentation](/vault/docs/agent-and-proxy/autoauth/methods).
-
-- `vault.hashicorp.com/auth-path` - configures the authentication path for the Kubernetes
-  auth method. Defaults to `auth/kubernetes`.
-
-- `vault.hashicorp.com/auth-type` - configures the authentication type for Vault Agent.
-  Defaults to `kubernetes`. For a list of valid authentication methods, see the Vault Agent
-  [auto-auth documentation](/vault/docs/agent-and-proxy/autoauth/methods).
-
-- `vault.hashicorp.com/auth-min-backoff` - set the [min_backoff](/vault/docs/agent-and-proxy/autoauth#min_backoff) option in the auto-auth config. Requires Vault 1.11+.
-
-- `vault.hashicorp.com/auth-max-backoff` - set the [max_backoff](/vault/docs/agent-and-proxy/autoauth#max_backoff) option in the auto-auth config
-
-- `vault.hashicorp.com/agent-auto-auth-exit-on-err` - set the [exit_on_err](/vault/docs/agent-and-proxy/autoauth#exit_on_err) option in the auto-auth config
-
-- `vault.hashicorp.com/ca-cert` - path of the CA certificate used to verify Vault's
-  TLS. This can also be set as the default for all injected Agents via the
-  `AGENT_INJECT_VAULT_CACERT_BYTES` environment variable which takes a PEM-encoded
-  certificate or bundle.
-
-- `vault.hashicorp.com/ca-key` - path of the CA public key used to verify Vault's
-  TLS.
-
-- `vault.hashicorp.com/client-cert` - path of the client certificate used when
-  communicating with Vault via mTLS.
-
-- `vault.hashicorp.com/client-key` - path of the client public key used when communicating
-  with Vault via mTLS.
-
-- `vault.hashicorp.com/client-max-retries` - configures number of Vault Agent retry
-  attempts when certain errors are encountered. Defaults to 2, for 3 total attempts.
-  Set this to `0` or less to disable retrying. Error codes that are retried are 412
-  (client consistency requirement not satisfied) and all 5xx except for 501 (not implemented).
-
-- `vault.hashicorp.com/client-timeout` - configures the request timeout threshold,
-  in seconds, of the Vault Agent when communicating with Vault. Defaults to `60s`
-  and accepts value types of `60`, `60s` or `1m`.
-
-- `vault.hashicorp.com/log-level` - configures the verbosity of the Vault Agent
-  log level. Default is `info`.
-
-- `vault.hashicorp.com/log-format` - configures the log type for Vault Agent. Possible
-  values are `standard` and `json`. Default is `standard`.
-
-- `vault.hashicorp.com/namespace` - configures the Vault Enterprise namespace to
-  be used when requesting secrets from Vault. Also available as a command-line
-  option (`-vault-namespace`) or environment variable
-  (`AGENT_INJECT_VAULT_NAMESPACE`) to set the default namespace for all injected
-  Agents.
-
-- `vault.hashicorp.com/proxy-address` - configures the HTTP proxy to use when connecting
-  to a Vault server.
-
-- `vault.hashicorp.com/role` - configures the Vault role used by the Vault Agent
-  auto-auth method. Required when `vault.hashicorp.com/agent-configmap` is not set.
-
-- `vault.hashicorp.com/service` - configures the Vault address for the injected
-  Vault Agent to use. This value overrides the default Vault address configured
-  in the injector, and may either be the address of a Vault service within the
-  same Kubernetes cluster as the injector, or an external Vault URL.
-
-- `vault.hashicorp.com/tls-secret` - name of the Kubernetes secret containing TLS
-  Client and CA certificates and keys. This is mounted to `/vault/tls`.
-
-- `vault.hashicorp.com/tls-server-name` - name of the Vault server to verify the
-  authenticity of the server when communicating with Vault over TLS.
-
-- `vault.hashicorp.com/tls-skip-verify` - if true, configures the Vault Agent to
-  skip verification of Vault's TLS certificate. It's not recommended to set this
-  value to true in a production environment.
-
-- `vault.hashicorp.com/agent-disable-idle-connections` - Comma-separated [list
-  of Vault Agent features](/vault/docs/agent-and-proxy/agent#disable_idle_connections) where idle
-  connections should be disabled. Also available as a command-line option
-  (`-disable-idle-connections`) or environment variable
-  (`AGENT_INJECT_DISABLE_IDLE_CONNECTIONS`) to set the default for all injected
-  Agents.
-
-- `vault.hashicorp.com/agent-disable-keep-alives` - Comma-separated [list of
-  Vault Agent features](/vault/docs/agent-and-proxy/agent#disable_keep_alives) where keep-alives
-  should be disabled. Also available as a command-line option
-  (`-disable-keep-alives`) or environment variable
-  (`AGENT_INJECT_DISABLE_KEEP_ALIVES`) to set the default for all injected
-  Agents.
-
-[k8s-resources]: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-requests-and-limits-of-pod-and-container
-[shareProcessNamespace]: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/
diff --git a/website/content/docs/platform/k8s/injector/examples.mdx b/website/content/docs/platform/k8s/injector/examples.mdx
deleted file mode 100644
index b9af233ed82..00000000000
--- a/website/content/docs/platform/k8s/injector/examples.mdx
+++ /dev/null
@@ -1,387 +0,0 @@
----
-layout: docs
-page_title: Vault Agent Sidecar Injector Examples
-description: This section documents examples of using the Vault Agent Injector.
----
-
-# Vault agent injector examples
-
-The following are different configuration examples to support a variety of
-deployment models.
-
-~> A common mistake is to set the annotation on the Deployment or other resource.
-Ensure that the injector annotations are specified on the pod specification when
-using higher level constructs such as deployments, jobs or statefulsets.
-
-## Before using the Vault agent injector
-
-Before applying Vault Agent injection annotations to pods, the following requirements
-should be satisfied.
-
-### Connectivity
-
-- the Kubernetes API can connect to the Vault Agent injector service on port `443`, and
-  the injector can connect to the Kubernetes API,
-- Vault can connect to the Kubernetes API,
-- Pods in the Kubernetes cluster can connect to Vault.
-
-~> Note: The Kubernetes API typically runs on the master nodes, and the Vault Agent injector
-on a worker node in a Kubernetes cluster. <br/><br/>
-On Kubernetes clusters that have aggregator routing enabled (ex. [GKE private
-clusters](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#add_firewall_rules)),
-the Kubernetes API will connect directly to the injector service endpoint,
-which is on port `8080`.
-
-### Kubernetes and Vault configuration
-
-- Kubernetes auth method should be configured and enabled in Vault,
-- Pod should have a service account,
-- desired secrets exist within Vault,
-- the service account should be bound to a Vault role with a policy enabling access to desired secrets.
-
-For more information on configuring the Vault Kubernetes auth method,
-[see the official documentation](/vault/docs/auth/kubernetes#configuration).
-
-## Debugging
-
-If an error occurs with a mutation request, Kubernetes will attach the error to the
-owner of the pod. Check the following for errors:
-
-- If the pod was created by a deployment or statefulset, check for errors in the `replicaset`
-  that owns the pod.
-- If the pod was created by a job, check the `job` for errors.
-
-## Patching existing pods
-
-To patch existing pods, a Kubernetes patch can be applied to add the required annotations
-to pods. When applying a patch, the pods will be rescheduled.
-
-First, create the patch:
-
-```bash
-cat <<EOF >> ./patch.yaml
-spec:
-  template:
-    metadata:
-      annotations:
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-inject-status: "update"
-        vault.hashicorp.com/agent-inject-secret-db-creds: "database/creds/db-app"
-        vault.hashicorp.com/agent-inject-template-db-creds: |
-          {{- with secret "database/creds/db-app" -}}
-          postgres://{{ .Data.username }}:{{ .Data.password }}@postgres:5432/appdb?sslmode=disable
-          {{- end }}
-        vault.hashicorp.com/role: "db-app"
-        vault.hashicorp.com/ca-cert: "/vault/tls/ca.crt"
-        vault.hashicorp.com/client-cert: "/vault/tls/client.crt"
-        vault.hashicorp.com/client-key: "/vault/tls/client.key"
-        vault.hashicorp.com/tls-secret: "vault-tls-client"
-EOF
-```
-
-Next, apply the patch:
-
-```bash
-kubectl patch deployment <MY DEPLOYMENT> --patch "$(cat patch.yaml)"
-```
-
-The pod should now be rescheduled with additional containers. The pod can be inspected
-using the `kubectl describe` command:
-
-```bash
-kubectl describe pod <name of pod>
-```
-
-## Deployments, StatefulSets, etc.
-
-The annotations for configuring Vault Agent injection must be on the pod
-specification. Since higher level resources such as Deployments wrap pod
-specification templates, Vault Agent Injector can be used with all of these
-higher level constructs, too.
-
-An example Deployment below shows how to enable Vault Agent injection:
-
-```yaml
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: app-example
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: app-example-deployment
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: app-example
-  template:
-    metadata:
-      labels:
-        app: app-example
-      annotations:
-        vault.hashicorp.com/agent-inject: 'true'
-        vault.hashicorp.com/agent-inject-secret-db-creds: 'database/creds/db-app'
-        vault.hashicorp.com/agent-inject-template-db-creds: |
-          {{- with secret "database/creds/db-app" -}}
-          postgres://{{ .Data.username }}:{{ .Data.password }}@postgres:5432/appdb?sslmode=disable
-          {{- end }}
-        vault.hashicorp.com/role: 'db-app'
-        vault.hashicorp.com/ca-cert: '/vault/tls/ca.crt'
-        vault.hashicorp.com/client-cert: '/vault/tls/client.crt'
-        vault.hashicorp.com/client-key: '/vault/tls/client.key'
-        vault.hashicorp.com/tls-secret: 'vault-tls-client'
-    spec:
-      containers:
-        - name: app
-          image: 'app:1.0.0'
-      serviceAccountName: app-example
-```
-
-## ConfigMap example
-
-The following example creates a deployment that mounts a Kubernetes ConfigMap
-containing Vault Agent configuration files. For a complete list of the Vault
-Agent configuration settings, [see the Agent documentation](/vault/docs/agent-and-proxy/agent/template#vault-agent-templates).
-
-```yaml
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: app-example
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: app-example-deployment
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: app-example
-  template:
-    metadata:
-      labels:
-        app: app-example
-      annotations:
-        vault.hashicorp.com/agent-inject: 'true'
-        vault.hashicorp.com/agent-configmap: 'my-configmap'
-        vault.hashicorp.com/tls-secret: 'vault-tls-client'
-    spec:
-      containers:
-        - name: app
-          image: 'app:1.0.0'
-      serviceAccountName: app-example
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: my-configmap
-data:
-  config.hcl: |
-    "auto_auth" = {
-      "method" = {
-        "config" = {
-          "role" = "db-app"
-        }
-        "type" = "kubernetes"
-      }
-
-      "sink" = {
-        "config" = {
-          "path" = "/home/vault/.token"
-        }
-
-        "type" = "file"
-      }
-    }
-
-    "exit_after_auth" = false
-    "pid_file" = "/home/vault/.pid"
-
-    "template" = {
-      "contents" = "{{- with secret \"database/creds/db-app\" -}}postgres://{{ .Data.username }}:{{ .Data.password }}@postgres:5432/mydb?sslmode=disable{{- end }}"
-      "destination" = "/vault/secrets/db-creds"
-    }
-
-    "vault" = {
-      "address" = "https://vault.demo.svc.cluster.local:8200"
-      "ca_cert" = "/vault/tls/ca.crt"
-      "client_cert" = "/vault/tls/client.crt"
-      "client_key" = "/vault/tls/client.key"
-    }
-  config-init.hcl: |
-    "auto_auth" = {
-      "method" = {
-        "config" = {
-          "role" = "db-app"
-        }
-        "type" = "kubernetes"
-      }
-
-      "sink" = {
-        "config" = {
-          "path" = "/home/vault/.token"
-        }
-
-        "type" = "file"
-      }
-    }
-
-    "exit_after_auth" = true
-    "pid_file" = "/home/vault/.pid"
-
-    "template" = {
-      "contents" = "{{- with secret \"database/creds/db-app\" -}}postgres://{{ .Data.username }}:{{ .Data.password }}@postgres:5432/mydb?sslmode=disable{{- end }}"
-      "destination" = "/vault/secrets/db-creds"
-    }
-
-    "vault" = {
-      "address" = "https://vault.demo.svc.cluster.local:8200"
-      "ca_cert" = "/vault/tls/ca.crt"
-      "client_cert" = "/vault/tls/client.crt"
-      "client_key" = "/vault/tls/client.key"
-    }
-```
-
-## Environment variable example
-
-The following example demonstrates how templates can be used to create environment
-variables. A template should be created that exports a Vault secret as an environment
-variable and the application container should source those files during startup.
-
-```yaml
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: web-deployment
-  labels:
-    app: web
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: web
-  template:
-    metadata:
-      labels:
-        app: web
-      annotations:
-        vault.hashicorp.com/agent-inject: 'true'
-        vault.hashicorp.com/role: 'web'
-        vault.hashicorp.com/agent-inject-secret-config: 'secret/data/web'
-        # Environment variable export template
-        vault.hashicorp.com/agent-inject-template-config: |
-          {{- with secret "secret/data/web" -}}
-            export api_key="{{ .Data.data.payments_api_key }}"
-          {{- end }}
-    spec:
-      serviceAccountName: web
-      containers:
-        - name: web
-          image: alpine:latest
-          command:
-            ['sh', '-c']
-          args:
-            ['source /vault/secrets/config && <entrypoint script>']
-          ports:
-            - containerPort: 9090
-```
-
-## AppRole authentication
-
-The following example demonstrates how the AppRole authentication method can be used by
-Vault Agent for retrieving secrets. A Kubernetes secret containing the AppRole secret ID
-and role ID should be created first.
-
-```yaml
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: web-deployment
-  labels:
-    app: web
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: web
-  template:
-    metadata:
-      labels:
-        app: web
-      annotations:
-        vault.hashicorp.com/agent-inject: 'true'
-        vault.hashicorp.com/agent-extra-secret: 'approle-example'
-        vault.hashicorp.com/auth-type: 'approle'
-        vault.hashicorp.com/auth-path: 'auth/approle'
-        vault.hashicorp.com/auth-config-role-id-file-path: '/vault/custom/role-id'
-        vault.hashicorp.com/auth-config-secret-id-file-path: '/vault/custom/secret-id'
-        vault.hashicorp.com/agent-inject-secret-db-creds: 'database/creds/db-app'
-        vault.hashicorp.com/agent-inject-template-db-creds: |
-          {{- with secret "database/creds/db-app" -}}
-          postgres://{{ .Data.username }}:{{ .Data.password }}@postgres.postgres.svc:5432/wizard?sslmode=disable
-          {{- end }}
-        vault.hashicorp.com/role: 'my-role'
-        vault.hashicorp.com/tls-secret: 'vault-tls'
-        vault.hashicorp.com/ca-cert: '/vault/tls/ca.crt'
-    spec:
-      serviceAccountName: web
-      containers:
-        - name: web
-          image: alpine:latest
-          args:
-            ['sh', '-c', 'source /vault/secrets/config && <entrypoint script>']
-          ports:
-            - containerPort: 9090
-```
-
-## PKI cert example
-
-The following example demonstrates how to use the [`pkiCert` function][pkiCert] and
-[`writeToFile` function][writeToFile] from consul-template to create two files
-from a template: one for the certificate and CA (`cert.pem`) and one for the key
-(`cert.key`) generated by [Vault's PKI Secrets Engine](/vault/docs/secrets/pki).
-
-```yaml
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: web-deployment
-  labels:
-    app: web
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: web
-  template:
-    metadata:
-      labels:
-        app: web
-      annotations:
-        vault.hashicorp.com/agent-inject: 'true'
-        vault.hashicorp.com/role: 'web'
-        vault.hashicorp.com/agent-inject-secret-certs: 'pki/issue/cert'
-        vault.hashicorp.com/agent-inject-template-certs: |
-          {{- with pkiCert "pki/issue/cert" "common_name=test.example.com" "ttl=2h" -}}
-          {{ .Cert }}{{ .CA }}{{ .Key }}
-          {{ .Key | writeToFile "/vault/secrets/cert.key" "vault" "vault" "0644" }}
-          {{ .CA | writeToFile "/vault/secrets/cert.pem" "vault" "vault" "0644" }}
-          {{ .Cert | writeToFile "/vault/secrets/cert.pem" "vault" "vault" "0644" "append" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: web
-      containers:
-        - name: web
-          image: nginx
-```
-
-[pkiCert]: https://github.com/hashicorp/consul-template/blob/main/docs/templating-language.md#pkicert
-[writeToFile]: https://github.com/hashicorp/consul-template/blob/main/docs/templating-language.md#writeToFile
diff --git a/website/content/docs/platform/k8s/injector/index.mdx b/website/content/docs/platform/k8s/injector/index.mdx
deleted file mode 100644
index eafb61addf5..00000000000
--- a/website/content/docs/platform/k8s/injector/index.mdx
+++ /dev/null
@@ -1,197 +0,0 @@
----
-layout: docs
-page_title: Agent Sidecar Injector Overview
-description: >-
-  The Vault Agent Sidecar Injector is a Kubernetes admission webhook that adds
-  Vault Agent containers to pods for consuming Vault secrets.
----
-
-# Agent sidecar injector
-
-The Vault Agent Injector alters pod specifications to include Vault Agent
-containers that render Vault secrets to a shared memory volume using
-[Vault Agent Templates](/vault/docs/agent-and-proxy/agent/template).
-By rendering secrets to a shared volume, containers within the pod can consume
-Vault secrets without being Vault aware.
-
-The injector is a [Kubernetes Mutation Webhook Controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/).
-The controller intercepts pod events and applies mutations to the pod if annotations exist within
-the request. This functionality is provided by the [vault-k8s](https://github.com/hashicorp/vault-k8s)
-project and can be automatically installed and configured using the
-[Vault Helm](https://github.com/hashicorp/vault-helm) chart.
-
-@include 'kubernetes-supported-versions.mdx'
-
-## Overview
-
-The Vault Agent Injector works by intercepting pod `CREATE` and `UPDATE`
-events in Kubernetes. The controller parses the event and looks for the metadata
-annotation `vault.hashicorp.com/agent-inject: true`. If found, the controller will
-alter the pod specification based on other annotations present.
-
-### Mutations
-
-At a minimum, every container in the pod will be configured to mount a shared
-memory volume. This volume is mounted to `/vault/secrets` and will be used by the Vault
-Agent containers for sharing secrets with the other containers in the pod.
-
-Next, two types of Vault Agent containers can be injected: init and sidecar. The
-init container will prepopulate the shared memory volume with the requested
-secrets prior to the other containers starting. The sidecar container will
-continue to authenticate and render secrets to the same location as the pod runs.
-Using annotations, the initialization and sidecar containers may be disabled.
-
-Last, two additional types of volumes can be optionally mounted to the Vault Agent
-containers. The first is secret volume containing TLS requirements such as client
-and CA (certificate authority) certificates and keys. This volume is useful when
-communicating and verifying the Vault server's authenticity using TLS. The second
-is a configuration map containing Vault Agent configuration files. This volume is
-useful to customize Vault Agent beyond what the provided annotations offer.
-
-### Authenticating with Vault
-
-The primary method of authentication with Vault when using the Vault Agent Injector
-is the service account attached to the pod. Other authentication methods can be configured
-using annotations.
-
-For Kubernetes authentication, the service account must be bound to a Vault role and a
-policy granting access to the secrets desired.
-
-A service account must be present to use the Vault Agent Injector with the Kubernetes
-authentication method. It is _not_ recommended to bind Vault roles to the default service
-account provided to pods if no service account is defined.
-
-### Requesting secrets
-
-There are two methods of configuring the Vault Agent containers to render secrets:
-
-- the `vault.hashicorp.com/agent-inject-secret` annotation, or
-- a configuration map containing Vault Agent configuration files.
-
-Only one of these methods may be used at any time.
-
-#### Secrets via annotations
-
-To configure secret injection using annotations, the user must supply:
-
-- one or more _secret_ annotations, and
-- the Vault role used to access those secrets.
-
-The annotation must have the format:
-
-```yaml
-vault.hashicorp.com/agent-inject-secret-<unique-name>: /path/to/secret
-```
-
-The unique name will be the filename of the rendered secret and must be unique if
-multiple secrets are defined by the user. For example, consider the following
-secret annotations:
-
-```yaml
-vault.hashicorp.com/agent-inject-secret-foo: database/roles/app
-vault.hashicorp.com/agent-inject-secret-bar: consul/creds/app
-vault.hashicorp.com/role: 'app'
-```
-
-The first annotation will be rendered to `/vault/secrets/foo` and the second
-annotation will be rendered to `/vault/secrets/bar`.
-
-It's possible to set the file format of the rendered secret using the annotation. For example the
-following secret will be rendered to `/vault/secrets/foo.txt`:
-
-```yaml
-vault.hashicorp.com/agent-inject-secret-foo.txt: database/roles/app
-vault.hashicorp.com/role: 'app'
-```
-
-The secret unique name must consist of alphanumeric characters, `.`, `_` or `-`.
-
-##### Secret templates
-
-~> Vault Agent uses the Consul Template project to render secrets. For more information
-on writing templates, see the [Consul Template documentation](https://github.com/hashicorp/consul-template).
-
-How the secret is rendered to the file is also configurable. To configure the template
-used, the user must supply a _template_ annotation using the same unique name of
-the secret. The annotation must have the following format:
-
-```yaml
-vault.hashicorp.com/agent-inject-template-<unique-name>: |
-  <
-    TEMPLATE
-    HERE
-  >
-```
-
-For example, consider the following:
-
-```yaml
-vault.hashicorp.com/agent-inject-secret-foo: 'database/creds/db-app'
-vault.hashicorp.com/agent-inject-template-foo: |
-  {{- with secret "database/creds/db-app" -}}
-  postgres://{{ .Data.username }}:{{ .Data.password }}@postgres:5432/mydb?sslmode=disable
-  {{- end }}
-vault.hashicorp.com/role: 'app'
-```
-
-The rendered secret would look like this within the container:
-
-```shell-session
-$ cat /vault/secrets/foo
-postgres://v-kubernet-pg-app-q0Z7WPfVN:A1a-BUEuQR52oAqPrP1J@postgres:5432/mydb?sslmode=disable
-```
-
-~> The default left and right template delimiters are `{{` and `}}`.
-
-If no template is provided the following generic template is used:
-
-```
-{{ with secret "/path/to/secret" }}
-    {{ range $k, $v := .Data }}
-        {{ $k }}: {{ $v }}
-    {{ end }}
-{{ end }}
-```
-
-For example, the following annotation will use the default template to render
-PostgreSQL secrets found at the configured path:
-
-```yaml
-vault.hashicorp.com/agent-inject-secret-foo: 'database/roles/pg-app'
-vault.hashicorp.com/role: 'app'
-```
-
-The rendered secret would look like this within the container:
-
-```shell-session
-$ cat /vault/secrets/foo
-password: A1a-BUEuQR52oAqPrP1J
-username: v-kubernet-pg-app-q0Z7WPfVNqqTJuoDqCTY-1576529094
-```
-
-~> Some secrets such as KV are stored in maps. Their data can be accessed using `.Data.data.<NAME>`
-
-### Renewals and updating secrets
-
-For more information on when Vault Agent fetches and renews secrets, see the
-[Agent documentation](/vault/docs/agent-and-proxy/agent/template#renewals-and-updating-secrets).
-
-### Vault agent configuration map
-
-For advanced use cases, it may be required to define Vault Agent configuration
-files to mount instead of using secret and template annotations. The Vault Agent
-Injector supports mounting ConfigMaps by specifying the name using the `vault.hashicorp.com/agent-configmap`
-annotation. The configuration files will be mounted to `/vault/configs`.
-
-The configuration map must contain either one or both of the following files:
-
-- **config-init.hcl** used by the init container. This must have `exit_after_auth` set to `true`.
-- **config.hcl** used by the sidecar container. This must have `exit_after_auth` set to `false`.
-
-An example of mounting a Vault Agent configmap [can be found here](/vault/docs/platform/k8s/injector/examples#configmap-example).
-
-## Tutorial
-
-Refer to the [Injecting Secrets into Kubernetes Pods via Vault Helm
-Sidecar](/vault/tutorials/kubernetes/kubernetes-sidecar) guide
-for a step-by-step tutorial.
diff --git a/website/content/docs/platform/k8s/injector/installation.mdx b/website/content/docs/platform/k8s/injector/installation.mdx
deleted file mode 100644
index ae052dbbaad..00000000000
--- a/website/content/docs/platform/k8s/injector/installation.mdx
+++ /dev/null
@@ -1,113 +0,0 @@
----
-layout: docs
-page_title: Agent Sidecar Injector Installation
-description: The Vault Agent Sidecar Injector can be installed using Vault Helm.
----
-
-# Installing the agent injector
-
-The [Vault Helm chart](/vault/docs/platform/k8s/helm) is the recommended way to
-install and configure the Agent Injector in Kubernetes.
-
-~> The Vault Agent Injector requires Vault 1.3.1 or greater.
-
-To install a new instance of Vault and the Vault Agent Injector, first add the
-Hashicorp helm repository and ensure you have access to the chart:
-
-@include 'helm/repo.mdx'
-
-Then install the chart and enable the injection feature by setting the
-`injector.enabled` value to `true`:
-
-```bash
-helm install vault hashicorp/vault --set="injector.enabled=true"
-```
-
-Upgrades may be performed with `helm upgrade` on an existing install. Please
-always run Helm with `--dry-run` before any install or upgrade to verify
-changes.
-
-You can see all the available values settings by running `helm inspect values hashicorp/vault` or by reading the [Vault Helm Configuration
-Docs](/vault/docs/platform/k8s/helm/configuration). Commonly used values in the Helm
-chart include limiting the namespaces the injector runs in, TLS options and
-more.
-
-## TLS options
-
-Admission webhook controllers require TLS to run within Kubernetes. The Injector
-defaults to supporting TLS 1.2 and above, and supports configuring the minimum
-supported TLS version and list of enabled cipher suites. These can be set via
-the following environment variables:
-
-| Environment variable             | Description                                                                                                                    |
-| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
-| `AGENT_INJECT_TLS_MIN_VERSION`   | Minimum supported version of TLS. Defaults to **tls12**. Accepted values are `tls10`, `tls11`, `tls12`, or `tls13`.            |
-| `AGENT_INJECT_TLS_CIPHER_SUITES` | Comma-separated list of enabled [cipher suites][tls-suites] for TLS 1.0-1.2. (Cipher suites are not configurable for TLS 1.3.) |
-
-~> **Warning**: TLS 1.1 and lower are generally considered insecure.
-
-These may be set in a Helm chart deployment via the
-[injector.extraEnvironmentVars](/vault/docs/platform/k8s/helm/configuration#extraenvironmentvars)
-option:
-
-```bash
-helm install vault hashicorp/vault \
-  --set="injector.extraEnvironmentVars.AGENT_INJECT_TLS_MIN_VERSION=tls13" \
-  --set="injector.extraEnvironmentVars.AGENT_INJECT_TLS_CIPHER_SUITES=..."
-```
-
-The Vault Agent Injector also supports two TLS management options:
-
-- Auto TLS generation (default)
-- Manual TLS
-
-### Auto TLS
-
-By default, the Vault Agent Injector will bootstrap TLS by generating a certificate
-authority and creating a certificate/key to be used by the controller. If using
-Vault Helm, the chart will automatically create the necessary DNS entries for the
-controller's service used to verify the certificate.
-
-### Manual TLS
-
-If desired, users can supply their own TLS certificates, key and certificate authority.
-The following is required to configure TLS manually:
-
-- Server certificate/key
-- Base64 PEM encoded Certificate Authority bundle
-
-For more information on configuring manual TLS, see the [Vault Helm cert values](/vault/docs/platform/k8s/helm/configuration#certs).
-
-This option may also be used in conjunction with [cert-manager for certificate management](/vault/docs/platform/k8s/helm/examples/injector-tls-cert-manager).
-
-## Multiple replicas and TLS
-
-The Vault Agent Injector can be run with multiple replicas if using [Manual
-TLS](#manual-tls) or [cert-manager](/vault/docs/platform/k8s/helm/examples/injector-tls-cert-manager), and as of v0.7.0 multiple replicas are also supported with
-[Auto TLS](#auto-tls). The number of replicas is controlled in the Vault Helm
-chart by the [injector.replicas
-value](/vault/docs/platform/k8s/helm/configuration#replicas).
-
-With Auto TLS and multiple replicas, a leader replica is determined by ownership
-of a ConfigMap named `vault-k8s-leader`. Another replica can become the leader
-once the current leader replica stops running, and the Kubernetes garbage
-collector deletes the ConfigMap. The leader replica is in charge of generating
-the CA and patching the webhook caBundle in Kubernetes, and also generating and
-distributing the certificate and key to the "followers". The followers read the
-certificate and key needed for the webhook service listener from a Kubernetes
-Secret, which is updated by the leader when a certificate is near expiration.
-
-With Manual TLS and multiple replicas,
-[injector.leaderElector.enabled](/vault/docs/platform/k8s/helm/configuration#enabled-2)
-can be set to `false` since leader determination is not necessary in this case.
-
-## Namespace selector
-
-By default, the Vault Agent Injector will process all namespaces in Kubernetes except
-the system namespaces `kube-system` and `kube-public`. To limit what namespaces
-the injector can work in a namespace selector can be defined to match labels attached
-to namespaces.
-
-For more information on configuring namespace selection, see the [Vault Helm namespaceSelector value](/vault/docs/platform/k8s/helm/configuration#namespaceselector).
-
-[tls-suites]: https://golang.org/src/crypto/tls/cipher_suites.go
diff --git a/website/content/docs/platform/k8s/vso/api-reference.mdx b/website/content/docs/platform/k8s/vso/api-reference.mdx
deleted file mode 100644
index e89f198dcb5..00000000000
--- a/website/content/docs/platform/k8s/vso/api-reference.mdx
+++ /dev/null
@@ -1,771 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator API Reference
-description: >-
-  The Vault Secrets Operator allows Pods to consume Vault secrets natively from Kubernetes Secrets.
----
-
-<!--
-  copied from docs/api/api-reference.md in the vault-secrets-operator repo.
-  commit SHA=513441e0a912dbae2ddd7dc6bcee6a562f8d52e1
--->
-# API Reference
-
-## Packages
-- [secrets.hashicorp.com/v1beta1](#secretshashicorpcomv1beta1)
-
-
-## secrets.hashicorp.com/v1beta1
-
-Package v1beta1 contains API Schema definitions for the secrets v1beta1 API group
-
-### Resource Types
-- [HCPAuth](#hcpauth)
-- [HCPAuthList](#hcpauthlist)
-- [HCPVaultSecretsApp](#hcpvaultsecretsapp)
-- [HCPVaultSecretsAppList](#hcpvaultsecretsapplist)
-- [SecretTransformation](#secrettransformation)
-- [SecretTransformationList](#secrettransformationlist)
-- [VaultAuth](#vaultauth)
-- [VaultAuthList](#vaultauthlist)
-- [VaultConnection](#vaultconnection)
-- [VaultConnectionList](#vaultconnectionlist)
-- [VaultDynamicSecret](#vaultdynamicsecret)
-- [VaultDynamicSecretList](#vaultdynamicsecretlist)
-- [VaultPKISecret](#vaultpkisecret)
-- [VaultPKISecretList](#vaultpkisecretlist)
-- [VaultStaticSecret](#vaultstaticsecret)
-- [VaultStaticSecretList](#vaultstaticsecretlist)
-
-
-
-#### Destination
-
-
-
-Destination provides the configuration that will be applied to the destination Kubernetes Secret during a Vault Secret -> K8s Secret sync.
-
-_Appears in:_
-- [HCPVaultSecretsAppSpec](#hcpvaultsecretsappspec)
-- [VaultDynamicSecretSpec](#vaultdynamicsecretspec)
-- [VaultPKISecretSpec](#vaultpkisecretspec)
-- [VaultStaticSecretSpec](#vaultstaticsecretspec)
-
-| Field | Description |
-| --- | --- |
-| `name` _string_ | Name of the Secret |
-| `create` _boolean_ | Create the destination Secret. If the Secret already exists this should be set to false. |
-| `overwrite` _boolean_ | Overwrite the destination Secret if it exists and Create is true. This is useful when migrating to VSO from a previous secret deployment strategy. |
-| `labels` _object (keys:string, values:string)_ | Labels to apply to the Secret. Requires Create to be set to true. |
-| `annotations` _object (keys:string, values:string)_ | Annotations to apply to the Secret. Requires Create to be set to true. |
-| `type` _[SecretType](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#secrettype-v1-core)_ | Type of Kubernetes Secret. Requires Create to be set to true. Defaults to Opaque. |
-| `transformation` _[Transformation](#transformation)_ | Transformation provides configuration for transforming the secret data before it is stored in the Destination. |
-
-
-#### HCPAuth
-
-
-
-HCPAuth is the Schema for the hcpauths API
-
-_Appears in:_
-- [HCPAuthList](#hcpauthlist)
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `HCPAuth`
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `spec` _[HCPAuthSpec](#hcpauthspec)_ |  |
-
-
-#### HCPAuthList
-
-
-
-HCPAuthList contains a list of HCPAuth
-
-
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `HCPAuthList`
-| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `items` _[HCPAuth](#hcpauth) array_ |  |
-
-
-#### HCPAuthServicePrincipal
-
-
-
-HCPAuthServicePrincipal provides HCPAuth configuration options needed for authenticating to HCP using a service principal configured in SecretRef.
-
-_Appears in:_
-- [HCPAuthSpec](#hcpauthspec)
-
-| Field | Description |
-| --- | --- |
-| `secretRef` _string_ | SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI/HCP) namespace which provides the HCP ServicePrincipal clientID, and clientSecret. The secret data must have the following structure { "clientID": "clientID", "clientSecret": "clientSecret", } |
-
-
-#### HCPAuthSpec
-
-
-
-HCPAuthSpec defines the desired state of HCPAuth
-
-_Appears in:_
-- [HCPAuth](#hcpauth)
-
-| Field | Description |
-| --- | --- |
-| `organizationID` _string_ | OrganizationID of the HCP organization. |
-| `projectID` _string_ | ProjectID of the HCP project. |
-| `allowedNamespaces` _string array_ | AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with this AuthMethod. This field allows administrators to customize which Kubernetes namespaces are authorized to use with this AuthMethod. While Vault will still enforce its own rules, this has the added configurability of restricting which HCPAuthMethods can be used by which namespaces. Accepted values: []{"*"} - wildcard, all namespaces. []{"a", "b"} - list of namespaces. unset - disallow all namespaces except the Operator's the HCPAuthMethod's namespace, this is the default behavior. |
-| `method` _string_ | Method to use when authenticating to Vault. |
-| `servicePrincipal` _[HCPAuthServicePrincipal](#hcpauthserviceprincipal)_ | ServicePrincipal provides the necessary configuration for authenticating to HCP using a service principal. For security reasons, only project-level service principals should ever be used. |
-
-
-
-
-#### HCPVaultSecretsApp
-
-
-
-HCPVaultSecretsApp is the Schema for the hcpvaultsecretsapps API
-
-_Appears in:_
-- [HCPVaultSecretsAppList](#hcpvaultsecretsapplist)
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `HCPVaultSecretsApp`
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `spec` _[HCPVaultSecretsAppSpec](#hcpvaultsecretsappspec)_ |  |
-
-
-#### HCPVaultSecretsAppList
-
-
-
-HCPVaultSecretsAppList contains a list of HCPVaultSecretsApp
-
-
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `HCPVaultSecretsAppList`
-| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `items` _[HCPVaultSecretsApp](#hcpvaultsecretsapp) array_ |  |
-
-
-#### HCPVaultSecretsAppSpec
-
-
-
-HCPVaultSecretsAppSpec defines the desired state of HCPVaultSecretsApp
-
-_Appears in:_
-- [HCPVaultSecretsApp](#hcpvaultsecretsapp)
-
-| Field | Description |
-| --- | --- |
-| `appName` _string_ | AppName of the Vault Secrets Application that is to be synced. |
-| `hcpAuthRef` _string_ | HCPAuthRef to the HCPAuth resource, can be prefixed with a namespace, eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to the namespace of the HCPAuth CR. If no value is specified for HCPAuthRef the Operator will default to the `default` HCPAuth, configured in the operator's namespace. |
-| `refreshAfter` _string_ | RefreshAfter a period of time, in duration notation e.g. 30s, 1m, 24h |
-| `rolloutRestartTargets` _[RolloutRestartTarget](#rolloutrestarttarget) array_ | RolloutRestartTargets should be configured whenever the application(s) consuming the HCP Vault Secrets App does not support dynamically reloading a rotated secret. In that case one, or more RolloutRestartTarget(s) can be configured here. The Operator will trigger a "rollout-restart" for each target whenever the Vault secret changes between reconciliation events. See RolloutRestartTarget for more details. |
-| `destination` _[Destination](#destination)_ | Destination provides configuration necessary for syncing the HCP Vault Application secrets to Kubernetes. |
-
-
-
-
-#### RolloutRestartTarget
-
-
-
-RolloutRestartTarget provides the configuration required to perform a rollout-restart of the supported resources upon Vault Secret rotation. The rollout-restart is triggered by patching the target resource's 'spec.template.metadata.annotations' to include 'vso.secrets.hashicorp.com/restartedAt' with a timestamp value of when the trigger was executed. E.g. vso.secrets.hashicorp.com/restartedAt: "2023-03-23T13:39:31Z"
- Supported resources: Deployment, DaemonSet, StatefulSet
-
-_Appears in:_
-- [HCPVaultSecretsAppSpec](#hcpvaultsecretsappspec)
-- [VaultDynamicSecretSpec](#vaultdynamicsecretspec)
-- [VaultPKISecretSpec](#vaultpkisecretspec)
-- [VaultStaticSecretSpec](#vaultstaticsecretspec)
-
-| Field | Description |
-| --- | --- |
-| `kind` _string_ |  |
-| `name` _string_ |  |
-
-
-#### SecretTransformation
-
-
-
-SecretTransformation is the Schema for the secrettransformations API
-
-_Appears in:_
-- [SecretTransformationList](#secrettransformationlist)
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `SecretTransformation`
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `spec` _[SecretTransformationSpec](#secrettransformationspec)_ |  |
-
-
-#### SecretTransformationList
-
-
-
-SecretTransformationList contains a list of SecretTransformation
-
-
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `SecretTransformationList`
-| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `items` _[SecretTransformation](#secrettransformation) array_ |  |
-
-
-#### SecretTransformationSpec
-
-
-
-SecretTransformationSpec defines the desired state of SecretTransformation
-
-_Appears in:_
-- [SecretTransformation](#secrettransformation)
-
-| Field | Description |
-| --- | --- |
-| `templates` _object (keys:string, values:[Template](#template))_ | Templates maps a template name to its Template. Templates are always included in the rendered K8s Secret with the specified key. |
-| `sourceTemplates` _[SourceTemplate](#sourcetemplate) array_ | SourceTemplates are never included in the rendered K8s Secret, they can be used to provide common template definitions, etc. |
-| `includes` _string array_ | Includes contains regex patterns used to filter top-level source secret data fields for inclusion in the final K8s Secret data. These pattern filters are never applied to templated fields as defined in Templates. They are always applied last. |
-| `excludes` _string array_ | Excludes contains regex patterns used to filter top-level source secret data fields for exclusion from the final K8s Secret data. These pattern filters are never applied to templated fields as defined in Templates. They are always applied before any inclusion patterns. To exclude all source secret data fields, you can configure the single pattern ".*". |
-
-
-
-
-#### SourceTemplate
-
-
-
-SourceTemplate provides source templating configuration.
-
-_Appears in:_
-- [SecretTransformationSpec](#secrettransformationspec)
-
-| Field | Description |
-| --- | --- |
-| `name` _string_ |  |
-| `text` _string_ | Text contains the Go text template format. The template references attributes from the data structure of the source secret. Refer to https://pkg.go.dev/text/template for more information. |
-
-
-#### StorageEncryption
-
-
-
-StorageEncryption provides the necessary configuration need to encrypt the storage cache entries using Vault's Transit engine.
-
-_Appears in:_
-- [VaultAuthSpec](#vaultauthspec)
-
-| Field | Description |
-| --- | --- |
-| `mount` _string_ | Mount path of the Transit engine in Vault. |
-| `keyName` _string_ | KeyName to use for encrypt/decrypt operations via Vault Transit. |
-
-
-#### Template
-
-
-
-Template provides templating configuration.
-
-_Appears in:_
-- [SecretTransformationSpec](#secrettransformationspec)
-- [Transformation](#transformation)
-
-| Field | Description |
-| --- | --- |
-| `name` _string_ | Name of the Template |
-| `text` _string_ | Text contains the Go text template format. The template references attributes from the data structure of the source secret. Refer to https://pkg.go.dev/text/template for more information. |
-
-
-#### TemplateRef
-
-
-
-TemplateRef points to templating text that is stored in a SecretTransformation custom resource.
-
-_Appears in:_
-- [TransformationRef](#transformationref)
-
-| Field | Description |
-| --- | --- |
-| `name` _string_ | Name of the Template in SecretTransformationSpec.Templates. the rendered secret data. |
-| `keyOverride` _string_ | KeyOverride to the rendered template in the Destination secret. If Key is empty, then the Key from reference spec will be used. Set this to override the Key set from the reference spec. |
-
-
-#### Transformation
-
-
-
-
-
-_Appears in:_
-- [Destination](#destination)
-
-| Field | Description |
-| --- | --- |
-| `templates` _object (keys:string, values:[Template](#template))_ | Templates maps a template name to its Template. Templates are always included in the rendered K8s Secret, and take precedence over templates defined in a SecretTransformation. |
-| `transformationRefs` _[TransformationRef](#transformationref) array_ | TransformationRefs contain references to template configuration from SecretTransformation. |
-| `includes` _string array_ | Includes contains regex patterns used to filter top-level source secret data fields for inclusion in the final K8s Secret data. These pattern filters are never applied to templated fields as defined in Templates. They are always applied last. |
-| `excludes` _string array_ | Excludes contains regex patterns used to filter top-level source secret data fields for exclusion from the final K8s Secret data. These pattern filters are never applied to templated fields as defined in Templates. They are always applied before any inclusion patterns. To exclude all source secret data fields, you can configure the single pattern ".*". |
-| `excludeRaw` _boolean_ | ExcludeRaw data from the destination Secret. Exclusion policy can be set globally by including 'exclude-raw` in the '--global-transformation-options' command line flag. If set, the command line flag always takes precedence over this configuration. |
-
-
-#### TransformationRef
-
-
-
-TransformationRef contains the configuration for accessing templates from an SecretTransformation resource. TransformationRefs can be shared across all syncable secret custom resources.
-
-_Appears in:_
-- [Transformation](#transformation)
-
-| Field | Description |
-| --- | --- |
-| `namespace` _string_ | Namespace of the SecretTransformation resource. |
-| `name` _string_ | Name of the SecretTransformation resource. |
-| `templateRefs` _[TemplateRef](#templateref) array_ | TemplateRefs map to a Template found in this TransformationRef. If empty, then all templates from the SecretTransformation will be rendered to the K8s Secret. |
-| `ignoreIncludes` _boolean_ | IgnoreIncludes controls whether to use the SecretTransformation's Includes data key filters. |
-| `ignoreExcludes` _boolean_ | IgnoreExcludes controls whether to use the SecretTransformation's Excludes data key filters. |
-
-
-#### VaultAuth
-
-
-
-VaultAuth is the Schema for the vaultauths API
-
-_Appears in:_
-- [VaultAuthList](#vaultauthlist)
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `VaultAuth`
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `spec` _[VaultAuthSpec](#vaultauthspec)_ |  |
-
-
-#### VaultAuthConfigAWS
-
-
-
-VaultAuthConfigAWS provides VaultAuth configuration options needed for authenticating to Vault via an AWS AuthMethod. Will use creds from `SecretRef` or `IRSAServiceAccount` if provided, in that order. If neither are provided, the underlying node role or instance profile will be used to authenticate to Vault.
-
-_Appears in:_
-- [VaultAuthSpec](#vaultauthspec)
-
-| Field | Description |
-| --- | --- |
-| `role` _string_ | Vault role to use for authenticating |
-| `region` _string_ | AWS Region to use for signing the authentication request |
-| `headerValue` _string_ | The Vault header value to include in the STS signing request |
-| `sessionName` _string_ | The role session name to use when creating a webidentity provider |
-| `stsEndpoint` _string_ | The STS endpoint to use; if not set will use the default |
-| `iamEndpoint` _string_ | The IAM endpoint to use; if not set will use the default |
-| `secretRef` _string_ | SecretRef is the name of a Kubernetes Secret in the consumer's (VDS/VSS/PKI) namespace which holds credentials for AWS. Expected keys include `access_key_id`, `secret_access_key`, `session_token` |
-| `irsaServiceAccount` _string_ | IRSAServiceAccount name to use with IAM Roles for Service Accounts (IRSA), and should be annotated with "eks.amazonaws.com/role-arn". This ServiceAccount will be checked for other EKS annotations: eks.amazonaws.com/audience and eks.amazonaws.com/token-expiration |
-
-
-#### VaultAuthConfigAppRole
-
-
-
-VaultAuthConfigAppRole provides VaultAuth configuration options needed for authenticating to Vault via an AppRole AuthMethod.
-
-_Appears in:_
-- [VaultAuthSpec](#vaultauthspec)
-
-| Field | Description |
-| --- | --- |
-| `roleId` _string_ | RoleID of the AppRole Role to use for authenticating to Vault. |
-| `secretRef` _string_ | SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which provides the AppRole Role's SecretID. The secret must have a key named `id` which holds the AppRole Role's secretID. |
-
-
-#### VaultAuthConfigGCP
-
-
-
-VaultAuthConfigGCP provides VaultAuth configuration options needed for authenticating to Vault via a GCP AuthMethod, using workload identity
-
-_Appears in:_
-- [VaultAuthSpec](#vaultauthspec)
-
-| Field | Description |
-| --- | --- |
-| `role` _string_ | Vault role to use for authenticating |
-| `workloadIdentityServiceAccount` _string_ | WorkloadIdentityServiceAccount is the name of a Kubernetes service account (in the same Kubernetes namespace as the Vault*Secret referencing this resource) which has been configured for workload identity in GKE. Should be annotated with "iam.gke.io/gcp-service-account". |
-| `region` _string_ | GCP Region of the GKE cluster's identity provider. Defaults to the region returned from the operator pod's local metadata server. |
-| `clusterName` _string_ | GKE cluster name. Defaults to the cluster-name returned from the operator pod's local metadata server. |
-| `projectID` _string_ | GCP project ID. Defaults to the project-id returned from the operator pod's local metadata server. |
-
-
-#### VaultAuthConfigJWT
-
-
-
-VaultAuthConfigJWT provides VaultAuth configuration options needed for authenticating to Vault.
-
-_Appears in:_
-- [VaultAuthSpec](#vaultauthspec)
-
-| Field | Description |
-| --- | --- |
-| `role` _string_ | Role to use for authenticating to Vault. |
-| `secretRef` _string_ | SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which provides the JWT token to authenticate to Vault's JWT authentication backend. The secret must have a key named `jwt` which holds the JWT token. |
-| `serviceAccount` _string_ | ServiceAccount to use when creating a ServiceAccount token to authenticate to Vault's JWT authentication backend. |
-| `audiences` _string array_ | TokenAudiences to include in the ServiceAccount token. |
-| `tokenExpirationSeconds` _integer_ | TokenExpirationSeconds to set the ServiceAccount token. |
-
-
-#### VaultAuthConfigKubernetes
-
-
-
-VaultAuthConfigKubernetes provides VaultAuth configuration options needed for authenticating to Vault.
-
-_Appears in:_
-- [VaultAuthSpec](#vaultauthspec)
-
-| Field | Description |
-| --- | --- |
-| `role` _string_ | Role to use for authenticating to Vault. |
-| `serviceAccount` _string_ | ServiceAccount to use when authenticating to Vault's authentication backend. This must reside in the consuming secret's (VDS/VSS/PKI) namespace. |
-| `audiences` _string array_ | TokenAudiences to include in the ServiceAccount token. |
-| `tokenExpirationSeconds` _integer_ | TokenExpirationSeconds to set the ServiceAccount token. |
-
-
-#### VaultAuthList
-
-
-
-VaultAuthList contains a list of VaultAuth
-
-
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `VaultAuthList`
-| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `items` _[VaultAuth](#vaultauth) array_ |  |
-
-
-#### VaultAuthSpec
-
-
-
-VaultAuthSpec defines the desired state of VaultAuth
-
-_Appears in:_
-- [VaultAuth](#vaultauth)
-
-| Field | Description |
-| --- | --- |
-| `vaultConnectionRef` _string_ | VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace, eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the Operator will default to the `default` VaultConnection, configured in the operator's namespace. |
-| `namespace` _string_ | Namespace to auth to in Vault |
-| `allowedNamespaces` _string array_ | AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with this AuthMethod. This field allows administrators to customize which Kubernetes namespaces are authorized to use with this AuthMethod. While Vault will still enforce its own rules, this has the added configurability of restricting which VaultAuthMethods can be used by which namespaces. Accepted values: []{"*"} - wildcard, all namespaces. []{"a", "b"} - list of namespaces. unset - disallow all namespaces except the Operator's the VaultAuthMethod's namespace, this is the default behavior. |
-| `method` _string_ | Method to use when authenticating to Vault. |
-| `mount` _string_ | Mount to use when authenticating to auth method. |
-| `params` _object (keys:string, values:string)_ | Params to use when authenticating to Vault |
-| `headers` _object (keys:string, values:string)_ | Headers to be included in all Vault requests. |
-| `kubernetes` _[VaultAuthConfigKubernetes](#vaultauthconfigkubernetes)_ | Kubernetes specific auth configuration, requires that the Method be set to `kubernetes`. |
-| `appRole` _[VaultAuthConfigAppRole](#vaultauthconfigapprole)_ | AppRole specific auth configuration, requires that the Method be set to `appRole`. |
-| `jwt` _[VaultAuthConfigJWT](#vaultauthconfigjwt)_ | JWT specific auth configuration, requires that the Method be set to `jwt`. |
-| `aws` _[VaultAuthConfigAWS](#vaultauthconfigaws)_ | AWS specific auth configuration, requires that Method be set to `aws`. |
-| `gcp` _[VaultAuthConfigGCP](#vaultauthconfiggcp)_ | GCP specific auth configuration, requires that Method be set to `gcp`. |
-| `storageEncryption` _[StorageEncryption](#storageencryption)_ | StorageEncryption provides the necessary configuration to encrypt the client storage cache. This should only be configured when client cache persistence with encryption is enabled. This is done by passing setting the manager's commandline argument --client-cache-persistence-model=direct-encrypted. Typically, there should only ever be one VaultAuth configured with StorageEncryption in the Cluster, and it should have the label: cacheStorageEncryption=true |
-
-
-
-
-#### VaultConnection
-
-
-
-VaultConnection is the Schema for the vaultconnections API
-
-_Appears in:_
-- [VaultConnectionList](#vaultconnectionlist)
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `VaultConnection`
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `spec` _[VaultConnectionSpec](#vaultconnectionspec)_ |  |
-
-
-#### VaultConnectionList
-
-
-
-VaultConnectionList contains a list of VaultConnection
-
-
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `VaultConnectionList`
-| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `items` _[VaultConnection](#vaultconnection) array_ |  |
-
-
-#### VaultConnectionSpec
-
-
-
-VaultConnectionSpec defines the desired state of VaultConnection
-
-_Appears in:_
-- [VaultConnection](#vaultconnection)
-
-| Field | Description |
-| --- | --- |
-| `address` _string_ | Address of the Vault server |
-| `headers` _object (keys:string, values:string)_ | Headers to be included in all Vault requests. |
-| `tlsServerName` _string_ | TLSServerName to use as the SNI host for TLS connections. |
-| `caCertSecretRef` _string_ | CACertSecretRef is the name of a Kubernetes secret containing the trusted PEM encoded CA certificate chain as `ca.crt`. |
-| `skipTLSVerify` _boolean_ | SkipTLSVerify for TLS connections. |
-
-
-
-
-#### VaultDynamicSecret
-
-
-
-VaultDynamicSecret is the Schema for the vaultdynamicsecrets API
-
-_Appears in:_
-- [VaultDynamicSecretList](#vaultdynamicsecretlist)
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `VaultDynamicSecret`
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `spec` _[VaultDynamicSecretSpec](#vaultdynamicsecretspec)_ |  |
-
-
-#### VaultDynamicSecretList
-
-
-
-VaultDynamicSecretList contains a list of VaultDynamicSecret
-
-
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `VaultDynamicSecretList`
-| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `items` _[VaultDynamicSecret](#vaultdynamicsecret) array_ |  |
-
-
-#### VaultDynamicSecretSpec
-
-
-
-VaultDynamicSecretSpec defines the desired state of VaultDynamicSecret
-
-_Appears in:_
-- [VaultDynamicSecret](#vaultdynamicsecret)
-
-| Field | Description |
-| --- | --- |
-| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace, eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will default to the `default` VaultAuth, configured in the operator's namespace. |
-| `namespace` _string_ | Namespace where the secrets engine is mounted in Vault. |
-| `mount` _string_ | Mount path of the secret's engine in Vault. |
-| `requestHTTPMethod` _string_ | RequestHTTPMethod to use when syncing Secrets from Vault. Setting a value here is not typically required. If left unset the Operator will make requests using the GET method. In the case where Params are specified the Operator will use the PUT method. Please consult [secrets](/vault/docs/secrets) if you are uncertain about what method to use. Of note, the Vault client treats PUT and POST as being equivalent. The underlying Vault client implementation will always use the PUT method. |
-| `path` _string_ | Path in Vault to get the credentials for, and is relative to Mount. Please consult [secrets](/vault/docs/secrets) if you are uncertain about what 'path' should be set to. |
-| `params` _object (keys:string, values:string)_ | Params that can be passed when requesting credentials/secrets. When Params is set the configured RequestHTTPMethod will be ignored. See RequestHTTPMethod for more details. Please consult [secrets](/vault/docs/secrets) if you are uncertain about what 'params' should/can be set to. |
-| `renewalPercent` _integer_ | RenewalPercent is the percent out of 100 of the lease duration when the lease is renewed. Defaults to 67 percent plus jitter. |
-| `revoke` _boolean_ | Revoke the existing lease on VDS resource deletion. |
-| `allowStaticCreds` _boolean_ | AllowStaticCreds should be set when syncing credentials that are periodically rotated by the Vault server, rather than created upon request. These secrets are sometimes referred to as "static roles", or "static credentials", with a request path that contains "static-creds". |
-| `rolloutRestartTargets` _[RolloutRestartTarget](#rolloutrestarttarget) array_ | RolloutRestartTargets should be configured whenever the application(s) consuming the Vault secret does not support dynamically reloading a rotated secret. In that case one, or more RolloutRestartTarget(s) can be configured here. The Operator will trigger a "rollout-restart" for each target whenever the Vault secret changes between reconciliation events. See RolloutRestartTarget for more details. |
-| `destination` _[Destination](#destination)_ | Destination provides configuration necessary for syncing the Vault secret to Kubernetes. |
-
-
-
-
-#### VaultPKISecret
-
-
-
-VaultPKISecret is the Schema for the vaultpkisecrets API
-
-_Appears in:_
-- [VaultPKISecretList](#vaultpkisecretlist)
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `VaultPKISecret`
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `spec` _[VaultPKISecretSpec](#vaultpkisecretspec)_ |  |
-
-
-#### VaultPKISecretList
-
-
-
-VaultPKISecretList contains a list of VaultPKISecret
-
-
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `VaultPKISecretList`
-| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `items` _[VaultPKISecret](#vaultpkisecret) array_ |  |
-
-
-#### VaultPKISecretSpec
-
-
-
-VaultPKISecretSpec defines the desired state of VaultPKISecret
-
-_Appears in:_
-- [VaultPKISecret](#vaultpkisecret)
-
-| Field | Description |
-| --- | --- |
-| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace, eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will default to the `default` VaultAuth, configured in the operator's namespace. |
-| `namespace` _string_ | Namespace to get the secret from in Vault |
-| `mount` _string_ | Mount for the secret in Vault |
-| `role` _string_ | Role in Vault to use when issuing TLS certificates. |
-| `revoke` _boolean_ | Revoke the certificate when the resource is deleted. |
-| `clear` _boolean_ | Clear the Kubernetes secret when the resource is deleted. |
-| `expiryOffset` _string_ | ExpiryOffset to use for computing when the certificate should be renewed. The rotation time will be difference between the expiration and the offset. Should be in duration notation e.g. 30s, 120s, etc. |
-| `issuerRef` _string_ | IssuerRef reference to an existing PKI issuer, either by Vault-generated identifier, the literal string default to refer to the currently configured default issuer, or the name assigned to an issuer. This parameter is part of the request URL. |
-| `rolloutRestartTargets` _[RolloutRestartTarget](#rolloutrestarttarget) array_ | RolloutRestartTargets should be configured whenever the application(s) consuming the Vault secret does not support dynamically reloading a rotated secret. In that case one, or more RolloutRestartTarget(s) can be configured here. The Operator will trigger a "rollout-restart" for each target whenever the Vault secret changes between reconciliation events. See RolloutRestartTarget for more details. |
-| `destination` _[Destination](#destination)_ | Destination provides configuration necessary for syncing the Vault secret to Kubernetes. If the type is set to "kubernetes.io/tls", "tls.key" will be set to the "private_key" response from Vault, and "tls.crt" will be set to "certificate" + "ca_chain" from the Vault response ("issuing_ca" is used when "ca_chain" is empty). The "remove_roots_from_chain=true" option is used with Vault to exclude the root CA from the Vault response. |
-| `commonName` _string_ | CommonName to include in the request. |
-| `altNames` _string array_ | AltNames to include in the request May contain both DNS names and email addresses. |
-| `ipSans` _string array_ | IPSans to include in the request. |
-| `uriSans` _string array_ | The requested URI SANs. |
-| `otherSans` _string array_ | Requested other SANs, in an array with the format oid;type:value for each entry. |
-| `userIDs` _string array_ | User ID (OID 0.9.2342.19200300.100.1.1) Subject values to be placed on the signed certificate. |
-| `ttl` _string_ | TTL for the certificate; sets the expiration date. If not specified the Vault role's default, backend default, or system default TTL is used, in that order. Cannot be larger than the mount's max TTL. Note: this only has an effect when generating a CA cert or signing a CA cert, not when generating a CSR for an intermediate CA. Should be in duration notation e.g. 120s, 2h, etc. |
-| `format` _string_ | Format for the certificate. Choices: "pem", "der", "pem_bundle". If "pem_bundle", any private key and issuing cert will be appended to the certificate pem. If "der", the value will be base64 encoded. Default: pem |
-| `privateKeyFormat` _string_ | PrivateKeyFormat, generally the default will be controlled by the Format parameter as either base64-encoded DER or PEM-encoded DER. However, this can be set to "pkcs8" to have the returned private key contain base64-encoded pkcs8 or PEM-encoded pkcs8 instead. Default: der |
-| `notAfter` _string_ | NotAfter field of the certificate with specified date value. The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ |
-| `excludeCNFromSans` _boolean_ | ExcludeCNFromSans from DNS or Email Subject Alternate Names. Default: false |
-
-
-
-
-#### VaultSecretLease
-
-
-
-
-
-_Appears in:_
-- [VaultDynamicSecretStatus](#vaultdynamicsecretstatus)
-
-| Field | Description |
-| --- | --- |
-| `id` _string_ | ID of the Vault secret. |
-| `duration` _integer_ | LeaseDuration of the Vault secret. |
-| `renewable` _boolean_ | Renewable Vault secret lease |
-| `requestID` _string_ | RequestID of the Vault secret request. |
-
-
-#### VaultStaticCredsMetaData
-
-
-
-
-
-_Appears in:_
-- [VaultDynamicSecretStatus](#vaultdynamicsecretstatus)
-
-| Field | Description |
-| --- | --- |
-| `lastVaultRotation` _integer_ | LastVaultRotation represents the last time Vault rotated the password |
-| `rotationPeriod` _integer_ | RotationPeriod is number in seconds between each rotation, effectively a "time to live". This value is compared to the LastVaultRotation to determine if a password needs to be rotated |
-| `rotationSchedule` _string_ | RotationSchedule is a "cron style" string representing the allowed schedule for each rotation. e.g. "1 0 * * *" would rotate at one minute past midnight (00:01) every day. |
-| `ttl` _integer_ | TTL is the seconds remaining before the next rotation. |
-
-
-#### VaultStaticSecret
-
-
-
-VaultStaticSecret is the Schema for the vaultstaticsecrets API
-
-_Appears in:_
-- [VaultStaticSecretList](#vaultstaticsecretlist)
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `VaultStaticSecret`
-| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `spec` _[VaultStaticSecretSpec](#vaultstaticsecretspec)_ |  |
-
-
-#### VaultStaticSecretList
-
-
-
-VaultStaticSecretList contains a list of VaultStaticSecret
-
-
-
-| Field | Description |
-| --- | --- |
-| `apiVersion` _string_ | `secrets.hashicorp.com/v1beta1`
-| `kind` _string_ | `VaultStaticSecretList`
-| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. |
-| `items` _[VaultStaticSecret](#vaultstaticsecret) array_ |  |
-
-
-#### VaultStaticSecretSpec
-
-
-
-VaultStaticSecretSpec defines the desired state of VaultStaticSecret
-
-_Appears in:_
-- [VaultStaticSecret](#vaultstaticsecret)
-
-| Field | Description |
-| --- | --- |
-| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace, eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will default to the `default` VaultAuth, configured in the operator's namespace. |
-| `namespace` _string_ | Namespace to get the secret from in Vault |
-| `mount` _string_ | Mount for the secret in Vault |
-| `path` _string_ | Path of the secret in Vault, corresponds to the `path` parameter for, [kv-v1](/vault/api-docs/secret/kv/kv-v1#read-secret) [kv-v2](/vault/api-docs/secret/kv/kv-v2#read-secret-version) |
-| `version` _integer_ | Version of the secret to fetch. Only valid for type kv-v2. Corresponds to version query parameter: [version](/vault/api-docs/secret/kv/kv-v2#version) |
-| `type` _string_ | Type of the Vault static secret |
-| `refreshAfter` _string_ | RefreshAfter a period of time, in duration notation e.g. 30s, 1m, 24h |
-| `hmacSecretData` _boolean_ | HMACSecretData determines whether the Operator computes the HMAC of the Secret's data. The MAC value will be stored in the resource's Status.SecretMac field, and will be used for drift detection and during incoming Vault secret comparison. Enabling this feature is recommended to ensure that Secret's data stays consistent with Vault. |
-| `rolloutRestartTargets` _[RolloutRestartTarget](#rolloutrestarttarget) array_ | RolloutRestartTargets should be configured whenever the application(s) consuming the Vault secret does not support dynamically reloading a rotated secret. In that case one, or more RolloutRestartTarget(s) can be configured here. The Operator will trigger a "rollout-restart" for each target whenever the Vault secret changes between reconciliation events. All configured targets wil be ignored if HMACSecretData is set to false. See RolloutRestartTarget for more details. |
-| `destination` _[Destination](#destination)_ | Destination provides configuration necessary for syncing the Vault secret to Kubernetes. |
diff --git a/website/content/docs/platform/k8s/vso/examples.mdx b/website/content/docs/platform/k8s/vso/examples.mdx
deleted file mode 100644
index 62a02e3e3a3..00000000000
--- a/website/content/docs/platform/k8s/vso/examples.mdx
+++ /dev/null
@@ -1,65 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator Examples
-description: >-
-  The Vault Secrets Operator allows Pods to consume Vault secrets natively from Kubernetes Secrets.
----
-
-# Vault Secrets Operator examples
-
-The Operator project provides the following examples:
-- Sample use-cases are documented [here](https://github.com/hashicorp/vault-secrets-operator#samples)
-- A Terraform based demo can be found [here](https://github.com/hashicorp/vault-secrets-operator/tree/main/demo)
-
-## JWT auth for Kubernetes clusters in private networks
-
-Vault Secrets Operator supports using the [JWT auth method](/vault/docs/platform/k8s/vso/api-reference#vaultauthconfigjwt).
-JWT auth [verifies tokens](/vault/docs/auth/jwt#jwt-verification) using the issuer's public signing key.
-Vault supports fetching this public key from the Kubernetes API, but if users can't expose the Kubernetes API to Vault, the public key can be provided directly using [`jwt_validation_pubkeys`](/vault/api-docs/auth/jwt#jwt_validation_pubkeys).
-To configure this please follow the steps outlined for [Using JWT validation public keys](/vault/docs/auth/jwt/oidc-providers/kubernetes#using-jwt-validation-public-keys)
-
-## Using VaultStaticSecrets for imagePullSecrets
-
-Vault Secret Operator supports Kubernetes' templating of Secrets based on their
-Secret [Type](https://kubernetes.io/docs/concepts/configuration/secret/#secret-types) by setting the
-`Destination.Type` field of the VaultStaticSecret. Users who have configured private container registries
-can use the `kubernetes.io/dockerconfigjson` or `kubernetes.io/dockerconfig` types to appropriately format
-a Kubernetes secret with the contents of their Vault KV Secret.
-
-```shell
-# Write the secret to Vault:
-$ vault kv put kvv2/docker/config .dockerconfigjson=`cat ~/.docker/config.json`
-```
-
-```yaml
-# Apply a VaultStaticSecret which populates the k8s secret named 'myregistryKey' in the applications namespace
-# Note: this Secret uses the `default` VaultAuthMethod.
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  namespace: awesomeapps
-  name: vault-kv-app
-spec:
-  type: kv-v2
-  mount: kvv2
-  path: docker/config
-  # dest k8s secret
-  destination:
-    name: myregistryKey
-    create: true
-    type: "kubernetes.io/dockerconfigjson"
----
-# Example pod from
-# https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
-apiVersion: v1
-kind: Pod
-metadata:
-  name: foo
-  namespace: awesomeapps
-spec:
-  containers:
-    - name: foo
-      image: janedoe/awesomeapp:v1
-  imagePullSecrets:
-   - name: myregistrykey
-```
diff --git a/website/content/docs/platform/k8s/vso/helm.mdx b/website/content/docs/platform/k8s/vso/helm.mdx
deleted file mode 100644
index 9107b94ea64..00000000000
--- a/website/content/docs/platform/k8s/vso/helm.mdx
+++ /dev/null
@@ -1,579 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator Helm Chart Configuration
-description: >-
-  Configuration for the Vault Secrets Operator Helm chart.
----
-
-# Vault Secrets Operator helm chart
-
-The chart is customizable using
-[Helm configuration values](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing).
-
-<!-- DO NOT EDIT. The docs below are generated automatically. To change, edit
-                  the vault-secrets-operator repo's values.yaml: file commit=12d914f6ad83b28d56bc629cde6cbfd5ce1475f0 -->
-<!-- codegen: start -->
-
-## Top-Level Stanzas
-
-Use these links to navigate to a particular top-level stanza.
-
-- [`controller`](#h-controller)
-- [`metricsService`](#h-metricsservice)
-- [`defaultVaultConnection`](#h-defaultvaultconnection)
-- [`defaultAuthMethod`](#h-defaultauthmethod)
-- [`telemetry`](#h-telemetry)
-- [`tests`](#h-tests)
-
-## All Values
-
-### controller ((#h-controller))
-
-- `controller` ((#v-controller)) - Top level configuration for the vault secrets operator deployment.
-  This consists of a controller and a kube rbac proxy container.
-
-  - `replicas` ((#v-controller-replicas)) (`integer: 1`) - Set the number of replicas for the operator.
-
-  - `hostAliases` ((#v-controller-hostaliases)) (`array<map>`) - Host Aliases settings for vault-secrets-operator pod.
-    The value is an array of PodSpec HostAlias maps.
-    ref: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
-    Example:
-    hostAliases:
-      - ip: 192.168.1.100
-        hostnames:
-        - vault.example.com
-
-  - `nodeSelector` ((#v-controller-nodeselector)) (`map`) - nodeSelector labels for vault-secrets-operator pod assignment.
-    ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
-    Example:
-    nodeSelector:
-      beta.kubernetes.io/arch: amd64
-
-  - `tolerations` ((#v-controller-tolerations)) (`array<map>`) - Toleration Settings for vault-secrets-operator pod.
-    The value is an array of PodSpec Toleration maps.
-    ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
-    Example:
-    tolerations:
-     - key: "key1"
-       operator: "Equal"
-       value: "value1"
-       effect: "NoSchedule"
-
-  - `affinity` ((#v-controller-affinity)) - Affinity settings for vault-secrets-operator pod.
-    The value is a map of PodSpec Affinity maps.
-    ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
-    Example:
-    affinity:
-      nodeAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-          nodeSelectorTerms:
-          - matchExpressions:
-            - key: topology.kubernetes.io/zone
-              operator: In
-              values:
-              - antarctica-east1
-              - antarctica-west1
-
-  - `kubeRbacProxy` ((#v-controller-kuberbacproxy)) - Settings related to the kubeRbacProxy container. This container is an HTTP proxy for the
-    controller manager which performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
-
-    - `image` ((#v-controller-kuberbacproxy-image)) - Image sets the repo and tag of the kube-rbac-proxy image to use for the controller.
-
-      - `pullPolicy` ((#v-controller-kuberbacproxy-image-pullpolicy)) (`string: IfNotPresent`)
-
-      - `repository` ((#v-controller-kuberbacproxy-image-repository)) (`string: gcr.io/kubebuilder/kube-rbac-proxy`)
-
-      - `tag` ((#v-controller-kuberbacproxy-image-tag)) (`string: v0.15.0`)
-
-    - `resources` ((#v-controller-kuberbacproxy-resources)) (`map`) - Configures the default resources for the kube rbac proxy container.
-      For more information on configuring resources, see the K8s documentation:
-      https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-
-      - `limits` ((#v-controller-kuberbacproxy-resources-limits))
-
-        - `cpu` ((#v-controller-kuberbacproxy-resources-limits-cpu)) (`string: 500m`)
-
-        - `memory` ((#v-controller-kuberbacproxy-resources-limits-memory)) (`string: 128Mi`)
-
-      - `requests` ((#v-controller-kuberbacproxy-resources-requests))
-
-        - `cpu` ((#v-controller-kuberbacproxy-resources-requests-cpu)) (`string: 5m`)
-
-        - `memory` ((#v-controller-kuberbacproxy-resources-requests-memory)) (`string: 64Mi`)
-
-  - `imagePullSecrets` ((#v-controller-imagepullsecrets)) (`array<map>`) - Image pull secret to use for private container registry authentication which will be applied to the controllers
-    service account. Alternatively, the value may be specified as an array of strings.
-    Example:
-    ```yaml
-    imagePullSecrets:
-      - name: pull-secret-name-1
-      - name: pull-secret-name-2
-    ```
-    Refer to https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry.
-
-  - `extraLabels` ((#v-controller-extralabels)) - Extra labels to attach to the deployment. This should be formatted as a YAML object (map)
-
-  - `annotations` ((#v-controller-annotations)) - This value defines additional annotations for the deployment. This should be formatted as a YAML object (map)
-
-  - `manager` ((#v-controller-manager)) - Settings related to the vault-secrets-operator container.
-
-    - `image` ((#v-controller-manager-image)) - Image sets the repo and tag of the vault-secrets-operator image to use for the controller.
-
-      - `pullPolicy` ((#v-controller-manager-image-pullpolicy)) (`string: IfNotPresent`)
-
-      - `repository` ((#v-controller-manager-image-repository)) (`string: hashicorp/vault-secrets-operator`)
-
-      - `tag` ((#v-controller-manager-image-tag)) (`string: 0.5.1`)
-
-    - `globalTransformationOptions` ((#v-controller-manager-globaltransformationoptions)) (`array<string>: ""`) - Global secret transformation options.
-
-      - `excludeRaw` ((#v-controller-manager-globaltransformationoptions-excluderaw)) (`boolean: false`) - excludeRaw directs the operator to prevent _raw secret data being stored
-        in the destination K8s Secret.
-
-    - `clientCache` ((#v-controller-manager-clientcache)) - Configures the client cache which is used by the controller to cache (and potentially persist) vault tokens that
-      are the result of using the VaultAuthMethod. This enables re-use of Vault Tokens
-      throughout their TTLs as well as the ability to renew.
-      Persistence is only useful in the context of Dynamic Secrets, so "none" is an okay default.
-
-      - `persistenceModel` ((#v-controller-manager-clientcache-persistencemodel)) (`string: ""`) - Defines the `-client-cache-persistence-model` which caches+persists vault tokens.
-        May also be set via the `VSO_CLIENT_CACHE_PERSISTENCE_MODEL` environment variable.
-        Valid values are:
-        "none" - in-memory client cache is used, no tokens are persisted.
-        "direct-unencrypted" - in-memory client cache is persisted, unencrypted. This is NOT recommended for any production workload.
-        "direct-encrypted" - in-memory client cache is persisted encrypted using the Vault Transit engine.
-        Note: It is strongly encouraged to not use the setting of "direct-unencrypted" in
-        production due to the potential of vault tokens being leaked as they would then be stored
-        in clear text.
-
-        default: "none"
-
-      - `cacheSize` ((#v-controller-manager-clientcache-cachesize)) (`integer: ""`) - Defines the size of the in-memory LRU cache *in entries*, that is used by the client cache controller.
-        May also be set via the `VSO_CLIENT_CACHE_SIZE` environment variable.
-        Larger numbers will increase memory usage by the controller, lower numbers will cause more frequent evictions
-        of the client cache which can result in additional Vault client counts.
-
-        default: 10000
-
-      - `storageEncryption` ((#v-controller-manager-clientcache-storageencryption)) - StorageEncryption provides the necessary configuration to encrypt the client storage
-        cache within Kubernetes objects using (required) Vault Transit Engine.
-        This should only be configured when client cache persistence with encryption is enabled and
-        will deploy an additional VaultAuthMethod to be used by the Vault Transit Engine.
-        E.g. when `controller.manager.clientCache.persistenceModel=direct-encrypted`
-        Supported Vault authentication methods for the Transit Auth method are: jwt, appRole,
-        aws, and kubernetes.
-        Typically, there should only ever be one VaultAuth configured with
-        StorageEncryption in the Cluster.
-
-        - `enabled` ((#v-controller-manager-clientcache-storageencryption-enabled)) (`boolean: false`) - toggles the deployment of the Transit VaultAuthMethod CR.
-
-        - `vaultConnectionRef` ((#v-controller-manager-clientcache-storageencryption-vaultconnectionref)) (`string: default`) - Vault Connection Ref to be used by the Transit VaultAuthMethod.
-          Default setting will use the default VaultConnectionRef, which must also be configured.
-
-        - `keyName` ((#v-controller-manager-clientcache-storageencryption-keyname)) (`string: ""`) - KeyName to use for encrypt/decrypt operations via Vault Transit.
-
-        - `transitMount` ((#v-controller-manager-clientcache-storageencryption-transitmount)) (`string: ""`) - Mount path for the Transit VaultAuthMethod.
-
-        - `namespace` ((#v-controller-manager-clientcache-storageencryption-namespace)) (`string: ""`) - Vault namespace for the Transit VaultAuthMethod CR.
-
-        - `method` ((#v-controller-manager-clientcache-storageencryption-method)) (`string: kubernetes`) - Vault Auth method to be used with the Transit VaultAuthMethod CR.
-
-        - `mount` ((#v-controller-manager-clientcache-storageencryption-mount)) (`string: kubernetes`) - Mount path for the Transit VaultAuthMethod.
-
-        - `kubernetes` ((#v-controller-manager-clientcache-storageencryption-kubernetes)) - Vault Kubernetes auth method specific configuration
-
-          - `role` ((#v-controller-manager-clientcache-storageencryption-kubernetes-role)) (`string: ""`) - Vault Auth Role to use
-            This is a required field and must be setup in Vault prior to deploying the helm chart
-            if `defaultAuthMethod.enabled=true`
-
-          - `serviceAccount` ((#v-controller-manager-clientcache-storageencryption-kubernetes-serviceaccount)) (`string: ""`) - Kubernetes ServiceAccount associated with the Transit Vault Auth Role
-            Defaults to using the Operator's service-account.
-
-          - `tokenAudiences` ((#v-controller-manager-clientcache-storageencryption-kubernetes-tokenaudiences)) (`array<string>: []`) - Token Audience should match the audience of the vault kubernetes auth role.
-
-        - `jwt` ((#v-controller-manager-clientcache-storageencryption-jwt)) - Vault JWT auth method specific configuration
-
-          - `role` ((#v-controller-manager-clientcache-storageencryption-jwt-role)) (`string: ""`) - Vault Auth Role to use
-            This is a required field and must be setup in Vault prior to deploying the helm chart
-            if using JWT for the Transit VaultAuthMethod.
-
-          - `secretRef` ((#v-controller-manager-clientcache-storageencryption-jwt-secretref)) (`string: ""`) - One of the following is required prior to deploying the helm chart
-            - K8s secret that contains the JWT
-            - K8s service account if a service account JWT is used as a Vault JWT auth token and
-            needs generating by VSO.
-
-            Name of Kubernetes Secret that has the Vault JWT auth token.
-            The Kubernetes Secret must contain a key named `jwt` which references the JWT token, and
-            must exist in the namespace of any consuming VaultSecret CR. This is a required field if
-            a JWT token is provided.
-
-          - `serviceAccount` ((#v-controller-manager-clientcache-storageencryption-jwt-serviceaccount)) (`string: default`) - Kubernetes ServiceAccount to generate a service account JWT
-
-          - `tokenAudiences` ((#v-controller-manager-clientcache-storageencryption-jwt-tokenaudiences)) (`array<string>: []`) - Token Audience should match the bound_audiences or the `aud` list in bound_claims if
-            applicable of the Vault JWT auth role.
-
-        - `appRole` ((#v-controller-manager-clientcache-storageencryption-approle)) - AppRole auth method specific configuration
-
-          - `roleId` ((#v-controller-manager-clientcache-storageencryption-approle-roleid)) (`string: ""`) - AppRole Role's RoleID to use for authenticating to Vault.
-            This is a required field when using appRole and must be setup in Vault prior to deploying
-            the helm chart.
-
-          - `secretRef` ((#v-controller-manager-clientcache-storageencryption-approle-secretref)) (`string: ""`) - Name of Kubernetes Secret that has the AppRole Role's SecretID used to authenticate with
-            Vault. The Kubernetes Secret must contain a key named `id` which references the AppRole
-            Role's SecretID, and must exist in the namespace of any consuming VaultSecret CR.
-            This is a required field when using appRole and must be setup in Vault prior to
-            deploying the helm chart.
-
-        - `aws` ((#v-controller-manager-clientcache-storageencryption-aws)) - AWS auth method specific configuration
-
-          - `role` ((#v-controller-manager-clientcache-storageencryption-aws-role)) (`string: ""`) - Vault Auth Role to use
-            This is a required field and must be setup in Vault prior to deploying the helm chart
-            if using the AWS for the Transit auth method.
-
-          - `region` ((#v-controller-manager-clientcache-storageencryption-aws-region)) (`string: ""`) - AWS region to use for signing the authentication request
-            Optional, but most commonly will be the EKS cluster region.
-
-          - `headerValue` ((#v-controller-manager-clientcache-storageencryption-aws-headervalue)) (`string: ""`) - Vault header value to include in the STS signing request
-
-          - `sessionName` ((#v-controller-manager-clientcache-storageencryption-aws-sessionname)) (`string: ""`) - The role session name to use when creating a WebIdentity provider
-
-          - `stsEndpoint` ((#v-controller-manager-clientcache-storageencryption-aws-stsendpoint)) (`string: ""`) - The STS endpoint to use; if not set will use the default
-
-          - `iamEndpoint` ((#v-controller-manager-clientcache-storageencryption-aws-iamendpoint)) (`string: ""`) - The IAM endpoint to use; if not set will use the default
-
-          - `secretRef` ((#v-controller-manager-clientcache-storageencryption-aws-secretref)) (`string: ""`) - The name of a Kubernetes Secret which holds credentials for AWS. Supported keys
-            include `access_key_id`, `secret_access_key`, `session_token`
-
-          - `irsaServiceAccount` ((#v-controller-manager-clientcache-storageencryption-aws-irsaserviceaccount)) (`string: ""`) - Name of a Kubernetes service account that is configured with IAM Roles
-            for Service Accounts (IRSA). Should be annotated with "eks.amazonaws.com/role-arn".
-
-        - `gcp` ((#v-controller-manager-clientcache-storageencryption-gcp))
-
-          - `role` ((#v-controller-manager-clientcache-storageencryption-gcp-role)) (`string: ""`) - Vault Auth Role to use
-            This is a required field and must be setup in Vault prior to deploying the helm chart
-            if using GCP for the Transit auth method.
-
-          - `workloadIdentityServiceAccount` ((#v-controller-manager-clientcache-storageencryption-gcp-workloadidentityserviceaccount)) (`string: ""`) - Name of a Kubernetes service account that is configured for workload
-            identity in GKE.
-
-          - `region` ((#v-controller-manager-clientcache-storageencryption-gcp-region)) (`string: ""`) - GCP Region of the GKE cluster's identity provider. Defaults to the
-            region returned from the operator pod's local metadata server if
-            unspecified.
-
-          - `clusterName` ((#v-controller-manager-clientcache-storageencryption-gcp-clustername)) (`string: ""`) - GKE cluster name. Defaults to the cluster-name returned from the
-            operator pod's local metadata server if unspecified.
-
-          - `projectID` ((#v-controller-manager-clientcache-storageencryption-gcp-projectid)) (`string: ""`) - GCP project id. Defaults to the project-id returned from the
-            operator pod's local metadata server if unspecified.
-
-        - `params` ((#v-controller-manager-clientcache-storageencryption-params)) (`map`) - Params to use when authenticating to Vault using this auth method.
-          params:
-            param-something1: "foo"
-
-        - `headers` ((#v-controller-manager-clientcache-storageencryption-headers)) (` map: ""`) - Headers to be included in all Vault requests.
-          headers:
-            X-vault-something1: "foo"
-
-    - `maxConcurrentReconciles` ((#v-controller-manager-maxconcurrentreconciles)) (`integer: ""`) - Defines the maximum number of concurrent reconciles for each controller.
-      May also be set via the `VSO_MAX_CONCURRENT_RECONCILES` environment variable.
-
-      default: 100
-
-    - `extraEnv` ((#v-controller-manager-extraenv)) (`array<map>`) - Defines additional environment variables to be added to the
-      vault-secrets-operator manager container.
-      Example:
-
-      ```yaml
-      extraEnv:
-        - name: HTTP_PROXY
-          value: http://proxy.example.com
-        - name: VSO_OUTPUT_FORMAT
-          value: json
-        - name: VSO_CLIENT_CACHE_SIZE
-          value: "20000"
-        - name: VSO_CLIENT_CACHE_PERSISTENCE_MODEL
-          value: "direct-encrypted"
-        - name: VSO_MAX_CONCURRENT_RECONCILES
-          value: "30"
-      ```
-
-    - `extraArgs` ((#v-controller-manager-extraargs)) (`array: []`) - Defines additional commandline arguments to be passed to the
-      vault-secrets-operator manager container.
-      extraArgs:
-      - -zap-log-level=5
-
-    - `resources` ((#v-controller-manager-resources)) (`map`) - Configures the default resources for the vault-secrets-operator container.
-      For more information on configuring resources, see the K8s documentation:
-      https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
-
-      - `limits` ((#v-controller-manager-resources-limits))
-
-        - `cpu` ((#v-controller-manager-resources-limits-cpu)) (`string: 500m`)
-
-        - `memory` ((#v-controller-manager-resources-limits-memory)) (`string: 128Mi`)
-
-      - `requests` ((#v-controller-manager-resources-requests))
-
-        - `cpu` ((#v-controller-manager-resources-requests-cpu)) (`string: 10m`)
-
-        - `memory` ((#v-controller-manager-resources-requests-memory)) (`string: 64Mi`)
-
-  - `podSecurityContext` ((#v-controller-podsecuritycontext)) - Configures the Pod Security Context
-    https://kubernetes.io/docs/tasks/configure-pod-container/security-context
-
-    - `runAsNonRoot` ((#v-controller-podsecuritycontext-runasnonroot)) (`boolean: true`)
-
-  - `securityContext` ((#v-controller-securitycontext)) - Configures the Container Security Context
-    https://kubernetes.io/docs/tasks/configure-pod-container/security-context
-
-    - `allowPrivilegeEscalation` ((#v-controller-securitycontext-allowprivilegeescalation)) (`boolean: false`)
-
-  - `controllerConfigMapYaml` ((#v-controller-controllerconfigmapyaml)) (`map`) - Sets the configuration settings used by the controller. Any custom changes will be reflected in the
-    data field of the configmap.
-    For more information on configuring resources, see the K8s documentation:
-    https://kubernetes.io/docs/concepts/configuration/configmap/
-
-    - `health` ((#v-controller-controllerconfigmapyaml-health))
-
-      - `healthProbeBindAddress` ((#v-controller-controllerconfigmapyaml-health-healthprobebindaddress)) (`string: :8081`)
-
-    - `leaderElection` ((#v-controller-controllerconfigmapyaml-leaderelection))
-
-      - `leaderElect` ((#v-controller-controllerconfigmapyaml-leaderelection-leaderelect)) (`boolean: true`)
-
-      - `resourceName` ((#v-controller-controllerconfigmapyaml-leaderelection-resourcename)) (`string: b0d477c0.hashicorp.com`)
-
-    - `metrics` ((#v-controller-controllerconfigmapyaml-metrics))
-
-      - `bindAddress` ((#v-controller-controllerconfigmapyaml-metrics-bindaddress)) (`string: 127.0.0.1:8080`)
-
-    - `webhook` ((#v-controller-controllerconfigmapyaml-webhook))
-
-      - `port` ((#v-controller-controllerconfigmapyaml-webhook-port)) (`integer: 9443`)
-
-  - `kubernetesClusterDomain` ((#v-controller-kubernetesclusterdomain)) (`string: cluster.local`) - Configures the environment variable KUBERNETES_CLUSTER_DOMAIN used by KubeDNS.
-
-  - `terminationGracePeriodSeconds` ((#v-controller-terminationgraceperiodseconds)) (`integer: 120`) - Duration in seconds the pod needs to terminate gracefully.
-    See: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
-
-  - `preDeleteHookTimeoutSeconds` ((#v-controller-predeletehooktimeoutseconds)) (`integer: 120`) - Timeout in seconds for the pre-delete hook
-
-### metricsService ((#h-metricsservice))
-
-- `metricsService` ((#v-metricsservice)) (`map`) - Configure the metrics service ports used by the metrics service.
-  Set the configuration fo the metricsService port.
-
-  - `ports` ((#v-metricsservice-ports)) (`map`) - Set the port settings for the metrics service.
-    For more information on configuring resources, see the K8s documentation:
-    https://kubernetes.io/docs/concepts/services-networking/service/
-
-  - `name` ((#v-metricsservice-ports-name)) (`string: https`)
-
-  - `port` ((#v-metricsservice-ports-port)) (`integer: 8443`)
-
-  - `protocol` ((#v-metricsservice-ports-protocol)) (`string: TCP`)
-
-  - `targetPort` ((#v-metricsservice-ports-targetport)) (`string: https`)
-
-  - `type` ((#v-metricsservice-type)) (`string: ClusterIP`)
-
-### defaultVaultConnection ((#h-defaultvaultconnection))
-
-- `defaultVaultConnection` ((#v-defaultvaultconnection)) - Configures the default VaultConnection CR which will be used by resources
-  if they do not specify a VaultConnection reference. The name is 'default' and will
-  always be installed in the same namespace as the operator.
-  NOTE:
-  * It is strongly recommended to deploy the vault secrets operator in a secure Vault environment
-    which includes a configuration utilizing TLS and installing Vault into its own restricted namespace.
-
-  - `enabled` ((#v-defaultvaultconnection-enabled)) (`boolean: false`) - toggles the deployment of the VaultAuthMethod CR
-
-  - `address` ((#v-defaultvaultconnection-address)) (`string: ""`) - Address of the Vault Server
-    Example: http://vault.default.svc.cluster.local:8200
-
-  - `caCertSecret` ((#v-defaultvaultconnection-cacertsecret)) (`string: ""`) - CACertSecret is the name of a Kubernetes secret containing the trusted PEM encoded CA certificate chain as `ca.crt`.
-    Note: This secret must exist prior to deploying the CR.
-
-  - `tlsServerName` ((#v-defaultvaultconnection-tlsservername)) (`string: ""`) - TLSServerName to use as the SNI host for TLS connections.
-
-  - `skipTLSVerify` ((#v-defaultvaultconnection-skiptlsverify)) (`boolean: false`) - SkipTLSVerify for TLS connections.
-
-  - `headers` ((#v-defaultvaultconnection-headers)) (`map`) - Headers to be included in all Vault requests.
-    headers:
-      X-vault-something: "foo"
-
-### defaultAuthMethod ((#h-defaultauthmethod))
-
-- `defaultAuthMethod` ((#v-defaultauthmethod)) - Configures and deploys the default VaultAuthMethod CR which will be used by resources
-  if they do not specify a VaultAuthMethod reference. The name is 'default' and will
-  always be installed in the same namespace as the operator.
-  NOTE:
-  * It is strongly recommended to deploy the vault secrets operator in a secure Vault environment
-    which includes a configuration utilizing TLS and installing Vault into its own restricted namespace.
-
-  - `enabled` ((#v-defaultauthmethod-enabled)) (`boolean: false`) - toggles the deployment of the VaultAuthMethod CR
-
-  - `namespace` ((#v-defaultauthmethod-namespace)) (`string: ""`) - Vault namespace for the VaultAuthMethod CR
-
-  - `allowedNamespaces` ((#v-defaultauthmethod-allowednamespaces)) (`array<string>: []`) - Kubernetes namespace glob patterns which are allow-listed for use with the default AuthMethod.
-
-  - `method` ((#v-defaultauthmethod-method)) (`string: kubernetes`) - Vault Auth method to be used with the VaultAuthMethod CR
-
-  - `mount` ((#v-defaultauthmethod-mount)) (`string: kubernetes`) - Mount path for the Vault Auth Method.
-
-  - `kubernetes` ((#v-defaultauthmethod-kubernetes)) - Vault Kubernetes auth method specific configuration
-
-    - `role` ((#v-defaultauthmethod-kubernetes-role)) (`string: ""`) - Vault Auth Role to use
-      This is a required field and must be setup in Vault prior to deploying the helm chart
-      if `defaultAuthMethod.enabled=true`
-
-    - `serviceAccount` ((#v-defaultauthmethod-kubernetes-serviceaccount)) (`string: default`) - Kubernetes ServiceAccount associated with the default Vault Auth Role
-
-    - `tokenAudiences` ((#v-defaultauthmethod-kubernetes-tokenaudiences)) (`array<string>: []`) - Token Audience should match the audience of the vault kubernetes auth role.
-
-  - `jwt` ((#v-defaultauthmethod-jwt)) - Vault JWT auth method specific configuration
-
-    - `role` ((#v-defaultauthmethod-jwt-role)) (`string: ""`) - Vault Auth Role to use
-      This is a required field and must be setup in Vault prior to deploying the helm chart
-      if using the JWT for the default auth method.
-
-    - `secretRef` ((#v-defaultauthmethod-jwt-secretref)) (`string: ""`) - One of the following is required prior to deploying the helm chart
-      - K8s secret that contains the JWT
-      - K8s service account if a service account JWT is used as a Vault JWT auth token and needs generating by VSO
-
-      Name of Kubernetes Secret that has the Vault JWT auth token.
-      The Kubernetes Secret must contain a key named `jwt` which references the JWT token, and must exist in the namespace
-      of any consuming VaultSecret CR. This is a required field if a JWT token is provided.
-
-    - `serviceAccount` ((#v-defaultauthmethod-jwt-serviceaccount)) (`string: default`) - Kubernetes ServiceAccount to generate a service account JWT
-
-    - `tokenAudiences` ((#v-defaultauthmethod-jwt-tokenaudiences)) (`array<string>: []`) - Token Audience should match the bound_audiences or the `aud` list in bound_claims if applicable
-      of the Vault JWT auth role.
-
-  - `appRole` ((#v-defaultauthmethod-approle)) - AppRole auth method specific configuration
-
-    - `roleId` ((#v-defaultauthmethod-approle-roleid)) (`string: ""`) - AppRole Role's RoleID to use for authenticating to Vault.
-      This is a required field when using appRole and must be setup in Vault prior to deploying the
-      helm chart.
-
-    - `secretRef` ((#v-defaultauthmethod-approle-secretref)) (`string: ""`) - Name of Kubernetes Secret that has the AppRole Role's SecretID used to authenticate with Vault.
-      The Kubernetes Secret must contain a key named `id` which references the AppRole Role's
-      SecretID, and must exist in the namespace of any consuming VaultSecret CR.
-      This is a required field when using appRole and must be setup in Vault prior to deploying the
-      helm chart.
-
-  - `aws` ((#v-defaultauthmethod-aws)) - AWS auth method specific configuration
-
-    - `role` ((#v-defaultauthmethod-aws-role)) (`string: ""`) - Vault Auth Role to use
-      This is a required field and must be setup in Vault prior to deploying the helm chart
-      if using the AWS for the default auth method.
-
-    - `region` ((#v-defaultauthmethod-aws-region)) (`string: ""`) - AWS region to use for signing the authentication request
-      Optional, but most commonly will be the region where the EKS cluster is running
-
-    - `headerValue` ((#v-defaultauthmethod-aws-headervalue)) (`string: ""`) - Vault header value to include in the STS signing request
-
-    - `sessionName` ((#v-defaultauthmethod-aws-sessionname)) (`string: ""`) - The role session name to use when creating a WebIdentity provider
-
-    - `stsEndpoint` ((#v-defaultauthmethod-aws-stsendpoint)) (`string: ""`) - The STS endpoint to use; if not set will use the default
-
-    - `iamEndpoint` ((#v-defaultauthmethod-aws-iamendpoint)) (`string: ""`) - The IAM endpoint to use; if not set will use the default
-
-    - `secretRef` ((#v-defaultauthmethod-aws-secretref)) (`string: ""`) - The name of a Kubernetes Secret which holds credentials for AWS. Supported keys include
-      `access_key_id`, `secret_access_key`, `session_token`
-
-    - `irsaServiceAccount` ((#v-defaultauthmethod-aws-irsaserviceaccount)) (`string: ""`) - Name of a Kubernetes service account that is configured with IAM Roles
-      for Service Accounts (IRSA). Should be annotated with "eks.amazonaws.com/role-arn".
-
-  - `gcp` ((#v-defaultauthmethod-gcp))
-
-    - `role` ((#v-defaultauthmethod-gcp-role)) (`string: ""`) - Vault Auth Role to use
-      This is a required field and must be setup in Vault prior to deploying the helm chart
-      if using GCP for the Transit auth method.
-
-    - `workloadIdentityServiceAccount` ((#v-defaultauthmethod-gcp-workloadidentityserviceaccount)) (`string: ""`) - Name of a Kubernetes service account that is configured for workload
-      identity in GKE.
-
-    - `region` ((#v-defaultauthmethod-gcp-region)) (`string: ""`) - GCP Region of the GKE cluster's identity provider. Defaults to the
-      region returned from the operator pod's local metadata server if
-      unspecified.
-
-    - `clusterName` ((#v-defaultauthmethod-gcp-clustername)) (`string: ""`) - GKE cluster name. Defaults to the cluster-name returned from the
-      operator pod's local metadata server if unspecified.
-
-    - `projectID` ((#v-defaultauthmethod-gcp-projectid)) (`string: ""`) - GCP project id. Defaults to the project-id returned from the
-      operator pod's local metadata server if unspecified.
-
-  - `params` ((#v-defaultauthmethod-params)) (`map`) - Params to use when authenticating to Vault
-    params:
-      param-something1: "foo"
-
-  - `headers` ((#v-defaultauthmethod-headers)) (`map`) - Headers to be included in all Vault requests.
-    headers:
-      X-vault-something1: "foo"
-
-### telemetry ((#h-telemetry))
-
-- `telemetry` ((#v-telemetry)) - Configures a Prometheus ServiceMonitor
-
-  - `serviceMonitor` ((#v-telemetry-servicemonitor))
-
-    - `enabled` ((#v-telemetry-servicemonitor-enabled)) (`boolean: false`) - The Prometheus operator *must* be installed before enabling this feature,
-      if not the chart will fail to install due to missing CustomResourceDefinitions
-      provided by the operator.
-
-      Instructions on how to install the Helm chart can be found here:
-       https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
-      More information can be found here:
-       https://github.com/prometheus-operator/prometheus-operator
-       https://github.com/prometheus-operator/kube-prometheus
-
-      Enable deployment of the Vault Secrets Operator ServiceMonitor CustomResource.
-
-    - `selectors` ((#v-telemetry-servicemonitor-selectors)) (`string: ""`) - Selector labels to add to the ServiceMonitor.
-      When empty, defaults to:
-       release: prometheus
-
-    - `scheme` ((#v-telemetry-servicemonitor-scheme)) (`string: https`) - Scheme of the service Prometheus scrapes metrics from. This must match the scheme of the metrics service of VSO
-
-    - `port` ((#v-telemetry-servicemonitor-port)) (`string: https`) - Port at which Prometheus scrapes metrics. This must match the port of the metrics service of VSO
-
-    - `path` ((#v-telemetry-servicemonitor-path)) (`string: /metrics`) - Path at which Prometheus scrapes metrics
-
-    - `bearerTokenFile` ((#v-telemetry-servicemonitor-bearertokenfile)) (`string: /var/run/secrets/kubernetes.io/serviceaccount/token`) - File Prometheus reads bearer token from for scraping metrics
-
-    - `interval` ((#v-telemetry-servicemonitor-interval)) (`string: 30s`) - Interval at which Prometheus scrapes metrics
-
-    - `scrapeTimeout` ((#v-telemetry-servicemonitor-scrapetimeout)) (`string: 10s`) - Timeout for Prometheus scrapes
-
-### tests ((#h-tests))
-
-- `tests` ((#v-tests)) - # Used by unit tests, and will not be rendered except when using `helm template`, this can be safely ignored.
-
-  - `enabled` ((#v-tests-enabled)) (`boolean: true`)
-
-  <!-- codegen: end -->
-
-## Helm chart examples
-
-The below `config.yaml` results in a single replica installation of the Vault Secrets Operator
-with a default vault connection and auth method custom resource deployed.
-It expects a local Vault installation within the kubernetes cluster
-accessible via `http://vault.default.svc.cluster.local:8200` with TLS disabled,
-and a [Vault Auth Method](/vault/docs/auth/kubernetes) to be setup against the `default` ServiceAccount.
-
-
-```yaml
-# config.yaml
-
-defaultVaultConnection:
-  enabled: true
-defaultAuthMethod:
-  enabled: true
-
-```
-
-## Customizing the helm chart
-
-If you need to extend the Helm chart with additional options, we recommend using a third-party tool,
-such as [kustomize](https://github.com/kubernetes-sigs/kustomize) using the project repo `config/` path
-in the [vault-secrets-operator](https://github.com/hashicorp/vault-secrets-operator) project.
diff --git a/website/content/docs/platform/k8s/vso/index.mdx b/website/content/docs/platform/k8s/vso/index.mdx
deleted file mode 100644
index 6f6b15d28cc..00000000000
--- a/website/content/docs/platform/k8s/vso/index.mdx
+++ /dev/null
@@ -1,59 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator
-description: >-
-  The Vault Secrets Operator allows Pods to consume HashiCorp secrets natively from Kubernetes Secrets.
----
-
-# Vault Secrets Operator
-
-The Vault Secrets Operator (VSO) allows Pods to consume Vault secrets and HCP Vault Secrets Apps natively from Kubernetes Secrets.
-
-## Overview
-
-The Vault Secrets Operator operates by watching for changes to its supported set of Custom Resource Definitions (CRD).
-Each CRD provides the specification required to allow the operator to synchronize from one of the supported sources for secrets to a Kubernetes Secret.
-The operator writes the *source* secret data directly to the *destination* Kubernetes Secret, ensuring that any
-changes made to the *source* are replicated to the *destination* over its lifetime. In this way, an application only needs
-to have access to the *destination* secret in order to make use of the secret data contained within.
-
-## Features
-
-The following features are supported by the Vault Secrets Operator:
-
-- Support for syncing from multiple secret sources.
-- Automatic secret drift and remediation.
-- Automatic secret rotation for `Deployment`, `ReplicaSet`, `StatefulSet` Kubernetes resource types.
-- Prometheus specific instrumentation for [monitoring](/vault/docs/platform/k8s/vso/telemetry) the Operator.
-- Support for installing using: `Helm` or `Kustomize`<br />
-*see the [installation](/vault/docs/platform/k8s/vso/installation) docs for more details*
-- Support for [secret data transformation](/vault/docs/platform/k8s/vso/secret-transformation).
-
-## Supported secret sources
-
-The Vault Secrets Operator supports syncing from multiple secret sources.
-Refer to the [secret sources overview](/vault/docs/platform/k8s/vso/sources) for more details.
-
-@include 'kubernetes-supported-versions.mdx'
-
-## Supported Kubernetes distributions
-
-The Vault Secrets Operator has been tested successfully in the following hosted Kubernetes environments:
-- Amazon Elastic Kubernetes Service (EKS)
-- Google Kubernetes Engine (GKE)
-- Microsoft Azure Kubernetes Service (AKS)
-- Red Hat OpenShift
-
-Basic integration tests are available in the project repository.
-Please report any issues [here](https://github.com/hashicorp/vault-secrets-operator/issues).
-
-## Threat model and security considerations
-HashiCorp takes security seriously and strives to enable users to configure their systems
-with security and safety in mind. Please see the Vault Secrets Operator's
-[Threat Model](https://github.com/hashicorp/vault-secrets-operator/blob/main/docs/threat-model/README.md)
-for highlights on how using the Vault Secrets Operator affects users' security posture and recommendations for running securely.
-
-## Tutorial
-
-Refer to the [Vault Secrets Operator on Kubernetes](/vault/tutorials/kubernetes/vault-secrets-operator)
-tutorial to learn the end-to-end workflow using the Vault Secrets Operator.
diff --git a/website/content/docs/platform/k8s/vso/installation.mdx b/website/content/docs/platform/k8s/vso/installation.mdx
deleted file mode 100644
index 182190b1d52..00000000000
--- a/website/content/docs/platform/k8s/vso/installation.mdx
+++ /dev/null
@@ -1,164 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator Installation
-description: >-
-  The Vault Secrets Operator can be installed using Helm.
----
-
-# Installing and upgrading the Vault Secrets Operator
-
-## Prerequisites
-
-- A Kubernetes cluster running 1.23+
-- Helm 3.7+
-- [Optional] Kustomize 4.5.7+
-
-## Installation using Helm
-
-[Install Helm](https://helm.sh/docs/intro/install) before beginning.
-
-The [Vault Secrets Operator Helm chart](/vault/docs/platform/k8s/vso/helm) is the recommended way of
-installing and configuring the Vault Secrets Operator.
-
-To install a new instance of the Vault Secrets Operator, first add the
-HashiCorp Helm repository and ensure you have access to the chart:
-
-```shell-session
-$ helm repo add hashicorp https://helm.releases.hashicorp.com
-"hashicorp" has been added to your repositories
-```
-
-```shell-session
-$ helm search repo hashicorp/vault-secrets-operator
-NAME           	CHART VERSION	APP VERSION	DESCRIPTION
-hashicorp/vault-secrets-operator	0.5.1       	0.5.1     	Official HashiCorp Vault Secrets Operator Chart
-```
-
-Then install the Operator:
-
-```shell-session
-$ helm install --version 0.5.1 --create-namespace --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator
-```
-
-## Upgrading using Helm
-
-You can upgrade an existing installation with the `helm upgrade` command.
-Please always run Helm with the `--dry-run` option before any install or upgrade to verify
-changes.
-
-Update the `hashicorp` Helm repo:
-```shell-session
-$ helm repo update hashicorp
-Hang tight while we grab the latest from your chart repositories...
-...Successfully got an update from the "hashicorp" chart repository
-Update Complete. ⎈Happy Helming!⎈
-```
-
-<Note title="Helm does not automatically update CRDs">
-  You must update all CRDs manually before upgrading VSO.
-  Refer to <a href="#updating-crds">Updating CRDs</a>.
-</Note>
-
-To upgrade your VSO release, replace `<TARGET_VSO_VERSION>` with the VSO version you are upgrading to:
-```shell-session
-$ helm show crds --version <TARGET_VSO_VERSION> hashicorp/vault-secrets-operator | kubectl apply -f -
-$ helm upgrade --version <TARGET_VSO_VERSION> --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator
-```
-
-For example, if you are upgrading to VSO 0.5.1:
-```shell-session
-$ helm show crds --version 0.5.1 hashicorp/vault-secrets-operator | kubectl apply -f -
-$ helm upgrade --version 0.5.1 --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator
-```
-
-## Updating CRDs when using Helm
-
-You must update the CRDs for VSO manually **before** you upgrade the
- operator when the operator is managed by Helm.
-
-**Any `kubectl` warnings related to `last-applied-configuration` should be safe to ignore.**
-
-To update the VSO CRDs, replace `<TARGET_VSO_VERSION>` with the VSO version you are upgrading to:
-```shell-session
-$ helm show crds --version <TARGET_VSO_VERSION> hashicorp/vault-secrets-operator | kubectl apply -f -
-```
-
-For example, if you are upgrading to VSO 0.5.1:
-```shell-session
-$ helm show crds --version 0.5.1 hashicorp/vault-secrets-operator | kubectl apply -f -
-
-customresourcedefinition.apiextensions.k8s.io/hcpauths.secrets.hashicorp.com created
-customresourcedefinition.apiextensions.k8s.io/hcpvaultsecretsapps.secrets.hashicorp.com created
-Warning: resource customresourcedefinitions/vaultauths.secrets.hashicorp.com is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
-customresourcedefinition.apiextensions.k8s.io/vaultauths.secrets.hashicorp.com configured
-Warning: resource customresourcedefinitions/vaultconnections.secrets.hashicorp.com is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
-customresourcedefinition.apiextensions.k8s.io/vaultconnections.secrets.hashicorp.com configured
-Warning: resource customresourcedefinitions/vaultdynamicsecrets.secrets.hashicorp.com is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
-customresourcedefinition.apiextensions.k8s.io/vaultdynamicsecrets.secrets.hashicorp.com configured
-Warning: resource customresourcedefinitions/vaultpkisecrets.secrets.hashicorp.com is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
-customresourcedefinition.apiextensions.k8s.io/vaultpkisecrets.secrets.hashicorp.com configured
-Warning: resource customresourcedefinitions/vaultstaticsecrets.secrets.hashicorp.com is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
-customresourcedefinition.apiextensions.k8s.io/vaultstaticsecrets.secrets.hashicorp.com configured
-```
-
-## Chart values
-
-Refer to the [VSO Helm chart](/vault/docs/platform/k8s/vso/helm)
- overview for a full list of supported chart values.
-
-## Installation using Kustomize
-
-You can install and update your installation using `kustomize` which allows you to extend the `config/` path of the VSO repository using Kustomize primitives.
-
-To install using Kustomize, download and untar/unzip the latest release from the [Releases Page](https://github.com/hashicorp/vault-secrets-operator/releases).
-```shell-session
-$ wget -q https://github.com/hashicorp/vault-secrets-operator/archive/refs/tags/v0.5.1.tar.gz
-$ tar -zxf v0.5.1.tar.gz
-$ cd vault-secrets-operator-0.5.1/
-```
-
-Next install using `kustomize build`:
-```shell-session
-$ kustomize build config/default | kubectl apply -f -
-namespace/vault-secrets-operator-system created
-customresourcedefinition.apiextensions.k8s.io/hcpauths.secrets.hashicorp.com created
-customresourcedefinition.apiextensions.k8s.io/hcpvaultsecretsapps.secrets.hashicorp.com created
-customresourcedefinition.apiextensions.k8s.io/vaultauths.secrets.hashicorp.com created
-customresourcedefinition.apiextensions.k8s.io/vaultconnections.secrets.hashicorp.com created
-customresourcedefinition.apiextensions.k8s.io/vaultdynamicsecrets.secrets.hashicorp.com created
-customresourcedefinition.apiextensions.k8s.io/vaultpkisecrets.secrets.hashicorp.com created
-customresourcedefinition.apiextensions.k8s.io/vaultstaticsecrets.secrets.hashicorp.com created
-serviceaccount/vault-secrets-operator-controller-manager created
-role.rbac.authorization.k8s.io/vault-secrets-operator-leader-election-role created
-clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-manager-role created
-clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-metrics-reader created
-clusterrole.rbac.authorization.k8s.io/vault-secrets-operator-proxy-role created
-rolebinding.rbac.authorization.k8s.io/vault-secrets-operator-leader-election-rolebinding created
-clusterrolebinding.rbac.authorization.k8s.io/vault-secrets-operator-manager-rolebinding created
-clusterrolebinding.rbac.authorization.k8s.io/vault-secrets-operator-proxy-rolebinding created
-configmap/vault-secrets-operator-manager-config created
-service/vault-secrets-operator-controller-manager-metrics-service created
-deployment.apps/vault-secrets-operator-controller-manager created
-```
-
-Confirm the operator has been installed by examining the pods:
-```shell-session
-$ kubectl get pods -n vault-secrets-operator-system
-NAMESPACE                       NAME                                                         READY   STATUS    RESTARTS   AGE
-vault-secrets-operator-system   vault-secrets-operator-controller-manager-56754d5496-cq69s   2/2     Running   0          1m17s
-```
-
-<Note title="Kustomize does not support all features of the Helm chart">
-
-  Notably it will not deploy default VaultAuthMethod, VaultConnection or Transit related resources.
-  Kustomize also does not support pre-delete hooks that the Helm chart uses to cleanup resources
-  and remove finalizers on the uninstall path. Please see [`config/samples`](https://github.com/hashicorp/vault-secrets-operator/tree/main/config/samples)
-  or `config/samples` in the downloaded release artifacts for additional resources.
-
-</Note>
-
-## Upgrade using Kustomize
-
-Upgrading using Kustomize is similar to installation: simply download the new release from github and follow
-the same steps as outlined in [Installation using Kustomize](#installation-using-kustomize).
-No additional steps are required to update the CRDs.
diff --git a/website/content/docs/platform/k8s/vso/openshift.mdx b/website/content/docs/platform/k8s/vso/openshift.mdx
deleted file mode 100644
index 5c03dfdf984..00000000000
--- a/website/content/docs/platform/k8s/vso/openshift.mdx
+++ /dev/null
@@ -1,73 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator on OpenShift
-description: >-
-  The Vault Secrets Operator may be installed on OpenShift clusters via the embedded OperatorHub or the Helm chart.
----
-
-# Run the Vault Secrets Operator on OpenShift
-
-The Vault Secrets Operator may be installed on OpenShift clusters via the embedded OperatorHub or the Helm chart.
-
-## OperatorHub
-
-The Vault Secrets Operator is certified by Red Hat and therefore included in the [OperatorHub section](https://access.redhat.com/documentation/en-us/openshift_container_platform/4.2/html/operators/olm-understanding-operatorhub) of an OpenShift cluster's web console.
-
-Navigate to the OperatorHub page of your OpenShift cluster and search for `Vault Secrets Operator`, then follow the instructions to install.
-
-## Helm chart
-
-The Vault Secrets Operator may also be installed in OpenShift using the Helm chart. (See [Installation](/vault/docs/platform/k8s/vso/installation) for an overview of installation using the [Helm chart](/vault/docs/platform/k8s/vso/helm).) The examples below show example [values.yaml files](https://helm.sh/docs/chart_template_guide/values_files/) for each configuration, which would be used with `helm install` as below:
-
-```shell-session
-$ helm install vault-secrets-operator hashicorp/vault-secrets-operator \
-  --create-namespace \
-  --namespace vault-secrets-operator \
-  --version 0.5.1 \
-  --values values.yaml
-```
-
-For OpenShift, increasing the memory [requests and limits](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) has proven necessary in some cases, so those settings are included in the examples below.
-
-### Default images
-
-These values would use the [default operator image](/vault/docs/platform/k8s/vso/helm#v-controller-manager-image) from HashiCorp's [Docker Hub repository][dockerhub].
-
-```yaml
-controller:
-  manager:
-    resources:
-      limits:
-        memory: 256Mi
-      requests:
-        memory: 128Mi
-```
-
-### UBI-based images certified by Red Hat
-
-These values would use [UBI-based](https://developers.redhat.com/products/rhel/ubi) images from the [Red Hat's certified container registry](https://catalog.redhat.com/software/containers/hashicorp/vault-secrets-operator/64dd558c892694d397c4bb06). Authentication may be required.
-
-```yaml
-controller:
-  kubeRbacProxy:
-    image:
-      repository: registry.redhat.io/openshift4/ose-kube-rbac-proxy
-      tag: v4.13.0
-  manager:
-    image:
-      repository: registry.connect.redhat.com/hashicorp/vault-secrets-operator
-      tag: 0.5.1-ubi
-    resources:
-      limits:
-        memory: 256Mi
-      requests:
-        memory: 128Mi
-```
-
-<Tip>
-
-UBI-based Vault Secrets Operator images are also published to HashiCorp's [DockerHub][dockerhub] and [Amazon ECR](https://gallery.ecr.aws/hashicorp/vault-secrets-operator) repositories.
-
-</Tip>
-
-[dockerhub]: https://hub.docker.com/r/hashicorp/vault-secrets-operator
diff --git a/website/content/docs/platform/k8s/vso/secret-transformation.mdx b/website/content/docs/platform/k8s/vso/secret-transformation.mdx
deleted file mode 100644
index 07831ed02f0..00000000000
--- a/website/content/docs/platform/k8s/vso/secret-transformation.mdx
+++ /dev/null
@@ -1,245 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator Secret Transformation
-description: >-
-  Learn how to transform Secret data with the Vault Secrets Operator.
----
-
-# Secret data transformation
-
-Utilizing advanced templating and data filters, the Vault Secrets Operator for Kubernetes (VSO) can
-transform source secret data, secret metadata, resource labels and annotations into a format that is
-compatible with your application. All secret data sources are supported. Secret transformations can
-be specified directly within a secret custom resource (CR), or by references to one or more
-[SecretTransformation](/vault/docs/platform/k8s/vso/api-reference#secrettransformation) custom resource
-instances, or both.
-
-## Templating
-
-VSO utilizes the data-driven [templates for Golang](https://pkg.go.dev/text/template) to generate
-secret data output. The template data input holds the secret data, secret metadata, resource labels
-and annotations.
-
-Templates are configured in a secret custom resource's
-[spec.Destination.Transformation.Templates](/vault/docs/platform/k8s/vso/api-reference#transformation),
-or in a SecretTransformation resource's [spec.templates](/vault/docs/platform/k8s/vso/api-reference#secrettransformationspec).
-
-VSO provides access to a large library of template functions, some of which are documented
-[below](#template-functions).
-
-### Secret data input
-
-Secret data is accessed through the `.Secrets` input member. It contains a map of secret
-key-value pairs, which are assumed to be sensitive information fetched from a
-[secret source](/vault/docs/platform/k8s/vso/sources).
-
-For example, to include a password in your application's secret, you might specify
-a template like:
-```go
-{{- printf "password=%s" (get .Secrets "password") -}}
-```
-
-### Secret metadata input
-
-Secret metadata is accessed through the `.Metadata` input member. It contains a map of metadata key to
-its value. The data should not contain any confidential information.
-
-For example, to include a secret metadata value in your application's secret, you might specify
-a template like:
-```go
-{{- printf "secretGroup=%s" (get .Metadata "secretGroup") -}}
-```
-
-### Resource annotations input
-
-Resource annotations are accessed through the `.Annotations` input member. The annotations consist
-of all `metadata.annotations` configured on the secret custom resource.
-
-For example, to include a value from the resource's annotations in your application's secret, you
-might specify a template like:
-```go
-{{- printf "host=%s" (get .Annotations "myapp.config/host") -}}
-```
-
-### Resource labels input
-
-Resource labels are accessed through the `.Labels` input member. The labels consist
-of all `metadata.labels` configured on the secret custom resource.
-
-For example, to include a value from the resource's labels in your application's secret, you
-might specify a template like:
-```go
-{{- printf "appType=%s" (get .Labels "appType") -}}
-```
-
-## Filters
-
-Filters are used to control which source secret data fields are included in the destination secret's
-data. They are specified as a set of exclude/include RE2 accepted [regular expressions](https://golang.org/s/re2syntax).
-
-Filters are configured in the `excludes` and `includes` fields of a secret custom resource's
-[spec.Destination.Transformation](/vault/docs/platform/k8s/vso/api-reference#transformation),
-or in a SecretTransformation resource's [spec](/vault/docs/platform/k8s/vso/api-reference#secrettransformationspec).
-
-All exclude patterns take precedence over any include patterns, and are never applied to templated keys.
-
-## Examples
-
-### Local transformation
-
-A VaultDynamicSecret configured to sync Postgres database credentials from Vault to the Kubernetes
-secret named `example-vds`.
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultDynamicSecret
-metadata:
-  namespace: example-ns
-  name: example-vds
-  annotations:
-    myapp.config/postgres-host: postgres-postgresql.postgres.svc.cluster.local:5432
-spec:
-  destination:
-    create: true
-    name: app-secret
-    transformation:
-      excludes:
-       - .*
-      templates:
-        url:
-          text: |
-            {{- $host := get .Annotations "myapp.config/postgres-host" -}}
-            {{- printf "postgresql://%s:%s@%s/postgres?sslmode=disable" (get .Secrets "username") (get .Secrets "password") $host -}}
-  path: creds/dev-postgres
-```
-
-The resulting Kubernetes secret includes a single key named `url`, with a valid Postgres connection
-URL as its value.
-
-```yaml
-url: postgresql://v-postgres-user:XUpah-password@postgres-postgresql.postgres.svc.cluster.local:5432/postgres?sslmode=disable
-```
-
-### Shared transformation
-
-The following manifest contains shared transformation templates and filters. All `templates` it provides
-will be included in the destination k8s secret. It also provides `sourceTemplates` that can be included
-in any template text configured in a secret CR or within the same resource instance.
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: SecretTransformation
-metadata:
-  name: vso-templates
-  namespace: example-vds
-spec:
-  excludes:
-    - password|username
-  templates:
-    url:
-      text: '{{- template "dbUrl" . -}}'
-  sourceTemplates:
-    - name: helpers
-      text: |
-        {{/*
-          create a Java props from SecretInput for this app
-        */}}
-        {{- define "appProps" -}}
-        {{- $host := get .Annotations "myapp.config/postgres-host" -}}
-        {{- printf "db.host=%s\n" $host -}}
-        {{- range $k, $v := .Secrets -}}
-        {{- printf "db.%s=%s\n" $k $v -}}
-        {{- end -}}
-        {{- end -}}
-        {{/*
-          create a JSON config from SecretInput for this app
-        */}}
-        {{- define "appJson" -}}
-        {{- $host := get .Annotations "myapp.config/postgres-host" -}}
-        {{- $copy := .Secrets | mustDeepCopy -}}
-        {{- $_ := set $copy "host" $host -}}
-        {{- mustToPrettyJson $copy -}}
-        {{- end -}}
-        {{/*
-          compose a Postgres URL from SecretInput for this app
-        */}}
-        {{- define "dbUrl" -}}
-        {{- $host := get .Annotations "myapp.config/postgres-host" -}}
-        {{- printf "postgresql://%s:%s@%s/postgres?sslmode=disable" (get .Secrets "username") (get .Secrets "password") $host -}}
-        {{- end -}}
-        {{/*
-          get the app name from the VSO resource's label
-        */}}
-        {{- define "appName" -}}
-        {{- get .Labels "myapp/name" -}}
-        {{- end -}}
-```
-
-The following `VaultDynamicSecret` manifest references the `SecretTransformation` above.
-All templates and filters from the reference object will be applied to the destination secret data.
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultDynamicSecret
-metadata:
-  namespace: example-ns
-  name: example-vds
-  annotations:
-    myapp.config/postgres-host: postgres-postgresql.postgres.svc.cluster.local:5432
-spec:
-  destination:
-    create: true
-    name: app-secret
-    transformation:
-      transformationRefs:
-        - name: vso-templates
-  path: creds/dev-postgres
-```
-
-The resulting Kubernetes secret includes a single key named `url`, with a valid Postgres connection
-URL as its value
-
-```yaml
-url: postgresql://v-postgres-user:XUpah-password@postgres-postgresql.postgres.svc.cluster.local:5432/postgres?sslmode=disable
-```
-
-### Template functions
-
-All template functions are provided by the [sprig](http://masterminds.github.io/sprig) library. Some common functions are mentioned below.
-For the complete list of functions see [allowedSprigFuncs](https://github.com/hashicorp/vault-secrets-operator/blob/main/internal/template/funcs.go#L26)
-
-### String functions
-
-`trim` removes any leading or trailing whitespaces from the input:
-```
-trim " host " -> `host`
-```
-
-### Encoding functions
-
-`b64enc` base64 encodes an input value
-```
-b64enc "host" -> `aG9zdAo=`
-```
-
-`b64dec` base64 decodes an input value
-```
-b64dec "aG9zdAo=" -> `host`
-```
-
-### Map functions
-
-`get` retrieves a value from a `map` input:
-```
-get .Secrets "baz" -> `qux`
-```
-
-## Related API references
-
-- [Transformation](/vault/docs/platform/k8s/vso/api-reference#transformation)
-- [HCPVaultSecretsApp](/vault/docs/platform/k8s/vso/api-reference#hcpvaultsecretsapp)
-- [VaultDynamicSecret](/vault/docs/platform/k8s/vso/api-reference#vaultdynamicsecret)
-- [VaultPKISecret](/vault/docs/platform/k8s/vso/api-reference#vaultpkisecret)
-- [VaultStaticSecret](/vault/docs/platform/k8s/vso/api-reference#vaultstaticsecret)
-- [SecretTransformation](/vault/docs/platform/k8s/vso/api-reference#secrettransformation)
diff --git a/website/content/docs/platform/k8s/vso/sources/hvs.mdx b/website/content/docs/platform/k8s/vso/sources/hvs.mdx
deleted file mode 100644
index 53f5f4a5c88..00000000000
--- a/website/content/docs/platform/k8s/vso/sources/hvs.mdx
+++ /dev/null
@@ -1,82 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator with HCP Vault Secrets
-description: >-
-  The Vault Secrets Operator allows Pods to consume HCP Vault Secrets natively from Kubernetes Secrets.
----
-
-# HCP Vault Secrets source
-
-## Overview
-
-The Vault secrets operator (VSO) syncs your [HCP Vault Secrets app](/hcp/docs/vault-secrets) (HVSA) to
-a Kubernetes Secret. Vault syncs each `HCPVaultSecretsApp` custom resource periodically to ensure that
-changes to the secret source are properly reflected in the Kubernetes secret.
-
-
-## Features
-
-- Periodic synchronization of HCP Vault Secrets app to a *destination* Kubernetes Secret.
-- Automatic drift detection and remediation when the destination Kubernetes Secret
-  is modified or deleted.
-- Supports all VSO features, including rollout-restarts on secret rotation or
-  during drift remediation.
-- Supports authentication to HCP using [HCP service principals](/hcp/docs/hcp/admin/iam/service-principals).
-
-
-### Supported HCP authentication methods
-
-| Backend                                                              | Description                                            |
-|----------------------------------------------------------------------|--------------------------------------------------------|
-| [HCP Service Principals](/hcp/docs/hcp/admin/iam/service-principals) | Relies on static credentials for authenticating to HCP |
-
-
-### HCP Vault Secrets sync example
-
-The following Kubernetes configuration can be used to sync the HCP Vault Secrets app, `vso-example`,
-to the Kubernetes Secret, `vso-app-secret`, in the `vso-example-ns` Kubernetes Namespace. It assumes that
-you have already setup [service principal Kubernetes secret](/vault/docs/platform/k8s/vso/api-reference#hcpauthserviceprincipal),
-and have created the HCP Vault Secrets app.
-
-Use the following Kubernetes configuration to sync your HCP Vault Secrets app, `vso-example`,
-to the Kubernetes secret, `vso-app-secret`, in the `vso-example-ns` Kubernetes namespace.
-The example configuration assumes you already a HCP Vault Secrets app created and have your
-[service principal Kubernetes secret](/vault/docs/platform/k8s/vso/api-reference#hcpauthserviceprincipal)
-configured.
-
-Refer to the [Kubernetes VSO installation guide](/vault/docs/platform/k8s/vso/installation)
-before applying any of the example configurations below.
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: HCPAuth
-metadata:
-  name: hcp-auth
-  namespace: vso-example-ns
-spec:
-  organizationID: xxxxxxxx-76e9-4e17-b5e9-xxxxxxxx4c33
-  projectID: xxxxxxxx-bd16-443f-a266-xxxxxxxxcb52
-  servicePrincipal:
-    secretRef: vso-app-sp
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: HCPVaultSecretsApp
-metadata:
-  name: vso-app
-  namespace: vso-example-ns
-spec:
-  appName: vso-app
-  hcpAuthRef: hcp-auth
-  destination:
-    create: true
-    name: vso-app-secret
-```
-
-@include 'vso/blurb-api-reference.mdx'
-
-## Tutorial
-
-Refer to the [HCP Vault Secrets with Vault Secrets Operator for
-Kubernetes](/vault/tutorials/hcp-vault-secrets-get-started/kubernetes-vso) tutorial to
-learn the end-to-end workflow using the Vault Secrets Operator.
diff --git a/website/content/docs/platform/k8s/vso/sources/index.mdx b/website/content/docs/platform/k8s/vso/sources/index.mdx
deleted file mode 100644
index 5b161e51323..00000000000
--- a/website/content/docs/platform/k8s/vso/sources/index.mdx
+++ /dev/null
@@ -1,15 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator
-description: >-
-  The Vault Secrets Operator allows Pods to consume Vault secrets natively from Kubernetes Secrets.
----
-
-# Vault Secrets Operator
-
-The [Vault Secrets Operator (VSO)](/vault/docs/platform/k8s/vso) supports syncing secrets from multiple sources.
-
-## Secret sources
-
-- [Vault](/vault/docs/platform/k8s/vso/sources/vault)
-- [HCP Vault Secrets](/vault/docs/platform/k8s/vso/sources/hvs)
diff --git a/website/content/docs/platform/k8s/vso/sources/vault/auth/aws.mdx b/website/content/docs/platform/k8s/vso/sources/vault/auth/aws.mdx
deleted file mode 100644
index bcc0d81b784..00000000000
--- a/website/content/docs/platform/k8s/vso/sources/vault/auth/aws.mdx
+++ /dev/null
@@ -1,253 +0,0 @@
----
-layout: docs
-page_title: AWS auth support for Vault Secrets Operator
-description: >-
-  Learn how AWS authentication works for Vault Secrets Operator
----
-
-# AWS auth support for Vault Secrets Operator
-
-The Vault Secrets Operator (VSO) supports
- [AWS authentication](/vault/docs/auth/aws) when accessing Vault. VSO
- can retrieve AWS credentials:
-
-- from an [IRSA-enabled Kubernetes service account][aws-irsa].
-- by inferring credentials from the underlying EKS node role.
-- by inferring credentials from the EC2 instance profile of the instance
-   where the operator pod is running.
-- from an explicitly provided static access key id and secret key.
-
-The following examples illustrate how to configure a Vault role and the corresponding VaultAuth profile in VSO for different AWS authentication scenarios.
-
-## IRSA
-
-1. Follow the Amazon documentation for [IAM roles for service accounts][aws-irsa]
-   to add an OIDC provider so your Kubernetes service account can assume an IAM
-   role.
-
-1. Create an appropriate authentication role in your Vault instance:
-
-  <CodeTabs>
-  <CodeBlockConfig>
-
-  ```shell-session
-  $ vault write auth/aws/role/<VAULT_AWS_IRSA_ROLE> \
-      auth_type="iam" \
-      policies="default" \
-      bound_iam_principal_arn="arn:aws:iam::<ACCOUNT_ID>:role/<IAM_IRSA_ROLE>"
-  ```
-
-  </CodeBlockConfig>
-  <CodeBlockConfig>
-
-  ```hcl
-  resource "vault_aws_auth_backend_role" "aws_irsa_role" {
-    backend                  = "auth/aws"
-    role                     = <VAULT_AWS_IRSA_ROLE>
-    auth_type                = "iam"
-    token_policies           = ["default"]
-    bound_iam_principal_arns = [
-      "arn:aws:iam::<ACCOUNT_ID>:role/<IAM_IRSA_ROLE>",
-    ]
-  }
-  ```
-
-  </CodeBlockConfig>
-  </CodeTabs>
-
-1. Create the corresponding authentication entry in VSO:
-
-  ```yaml
-  apiVersion: secrets.hashicorp.com/v1beta1
-  kind: VaultAuth
-  metadata:
-    name: vaultauth-aws-irsa-example
-    namespace: <K8S_NAMESPACE>
-  spec:
-    vaultConnectionRef: <VAULT_CONNECTION_NAME>
-    mount: aws
-    method: aws
-    aws:
-      role: <VAULT_AWS_IRSA_ROLE>
-      region: <AWS_REGION>
-      irsaServiceAccount: <SERVICE_ACCOUNT>
-  ```
-
-<Tip title="Terraform has IRSA support">
-
-  If you use Terraform to manage your Elastic Kubernetes (EKS) cluster, the
-  [AWS EKS module](https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest)
-  includes IRSA support through the
-  [IRSA submodule](https://registry.terraform.io/modules/terraform-aws-modules/iam/aws/latest/submodules/iam-role-for-service-accounts-eks).
-
-</Tip>
-
-## Node role
-
-1. Create an appropriate authentication role in your Vault instance:
-
-  <CodeTabs>
-  <CodeBlockConfig>
-
-  ```shell-session
-  $ vault write auth/aws/role/<VAULT_AWS_NODE_ROLE> \
-      auth_type="iam" \
-      policies="default" \
-      bound_iam_principal_arn="arn:aws:iam::<ACCOUNT_ID>:role/eks-nodes-<EKS_CLUSTER_NAME>"
-  ```
-
-  </CodeBlockConfig>
-  <CodeBlockConfig>
-
-  ```hcl
-  resource "vault_aws_auth_backend_role" "aws_node_role" {
-    backend                  = "auth/aws"
-    role                     = <VAULT_AWS_NODE_ROLE>
-    auth_type                = "iam"
-    token_policies           = ["default"]
-    bound_iam_principal_arns = [
-      "arn:aws:iam::<ACCOUNT_ID>:role/eks-nodes-<EKS_CLUSTER_NAME>",
-    ]
-  }
-  ```
-
-  </CodeBlockConfig>
-  </CodeTabs>
-
-1. Create the corresponding authentication entry in VSO:
-
-  ```yaml
-  apiVersion: secrets.hashicorp.com/v1beta1
-  kind: VaultAuth
-  metadata:
-    name: vaultauth-aws-node-example
-    namespace: <K8S_NAMESPACE>
-  spec:
-    vaultConnectionRef: <VAULT_CONNECTION_NAME>
-    mount: aws
-    method: aws
-    aws:
-      role: <VAULT_AWS_NODE_ROLE>
-      region: <AWS_REGION>
-  ```
-
-## Instance profile
-
-1. Create an appropriate authentication role in your Vault instance:
-
-  <CodeTabs>
-  <CodeBlockConfig>
-
-  ```shell-session
-  $ vault write auth/aws/role/<VAULT_AWS_INSTANCE_ROLE> \
-      auth_type="iam" \
-      policies="default" \
-      inferred_entity_type="ec2_instance" \
-      inferred_aws_region=-"<AWS_REGION>" \
-      bound_account_id="<ACCOUNT_ID>" \
-      bound_iam_principal_arn="arn:aws:iam::<ACCOUNT_ID>:instance-profile/eks-<INSTANCE_PROFILE_UUID>"
-  ```
-
-  </CodeBlockConfig>
-  <CodeBlockConfig>
-
-  ```hcl
-  resource "vault_aws_auth_backend_role" "aws_node_role" {
-    backend                  = "auth/aws"
-    role                     = <VAULT_AWS_INSTANCE_ROLE>
-    auth_type                = "iam"
-    token_policies           = ["default"]
-    inferred_entity_type     = "ec2_instance"
-    inferred_aws_region      = "<AWS_REGION>"
-    bound_account_ids        = ["<ACCOUNT_ID>"]
-    bound_iam_principal_arns = [
-      "arn:aws:iam::<ACCOUNT_ID>:role/eks-nodes-<EKS_CLUSTER_NAME>",
-    ]
-  }
-  ```
-
-  </CodeBlockConfig>
-  </CodeTabs>
-
-1. Create the corresponding authentication entry in VSO:
-
-  ```yaml
-  apiVersion: secrets.hashicorp.com/v1beta1
-  kind: VaultAuth
-  metadata:
-    name: vaultauth-aws-instance-example
-    namespace: <K8S_NAMESPACE>
-  spec:
-    vaultConnectionRef: <VAULT_CONNECTION_NAME>
-    mount: aws
-    method: aws
-    aws:
-      role: <VAULT_AWS_INSTANCE_ROLE>
-      region: <AWS_REGION>
-  ```
-
-## Static credentials
-
-1. Create an appropriate authentication role in your Vault instance:
-
-  <CodeTabs>
-  <CodeBlockConfig>
-
-  ```shell-session
-  $ vault write auth/aws/role/<VAULT_AWS_STATIC_ROLE> \
-      auth_type="iam" \
-      policies="default" \
-      bound_iam_principal_arn="arn:aws:iam::<ACCOUNT_ID>:role/<IAM_ROLE>"
-  ```
-
-  </CodeBlockConfig>
-  <CodeBlockConfig>
-
-  ```hcl
-  resource "vault_aws_auth_backend_role" "aws_static_role" {
-    backend                  = "auth/aws"
-    role                     = <VAULT_AWS_STATIC_ROLE>
-    auth_type                = "iam"
-    token_policies           = ["default"]
-    bound_iam_principal_arns = [
-      "arn:aws:iam::<ACCOUNT_ID>:role/<IAM_ROLE>",
-    ]
-  }
-  ```
-
-  </CodeBlockConfig>
-  </CodeTabs>
-
-1. Create the corresponding authentication entry in VSO:
-
-  ```yaml
-  apiVersion: v1
-  kind: Secret
-  metadata:
-    name: aws-static-creds
-    namespace: <K8S_NAMESPACE>
-  data:
-    access_key_id: <AWS_ACCESS_KEY_ID>
-    secret_access_key: <AWS_SECRET_ACCESS_KEY>
-    session_token: <AWS_SESSION_TOKEN>  # session_token is optional
-  ---
-  apiVersion: secrets.hashicorp.com/v1beta1
-  kind: VaultAuth
-  metadata:
-    name: vaultauth-aws-static-example
-    namespace: <K8S_NAMESPACE>
-  spec:
-    vaultConnectionRef: <VAULT_CONNECTION_NAME>
-    mount: aws
-    method: aws
-    aws:
-      role: <VAULT_AWS_STATIC_ROLE>
-      region: <AWS_REGION>
-      secretRef: aws-static-creds
-  ```
-
-# API
-
-See the full list of AWS VaultAuth options on the [VSO API page](/vault/docs/platform/k8s/vso/api-reference#vaultauthconfigaws).
-
-[aws-irsa]: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
diff --git a/website/content/docs/platform/k8s/vso/sources/vault/auth/gcp.mdx b/website/content/docs/platform/k8s/vso/sources/vault/auth/gcp.mdx
deleted file mode 100644
index 68531edb3cf..00000000000
--- a/website/content/docs/platform/k8s/vso/sources/vault/auth/gcp.mdx
+++ /dev/null
@@ -1,80 +0,0 @@
----
-layout: docs
-page_title: GCP auth support for Vault Secrets Operator
-description: >-
-  Learn how GCP authentication works for Vault Secrets Operator
----
-
-# GCP auth support for Vault Secrets Operator
-
-The Vault Secrets Operator (VSO) supports authenticating to Vault's [GCP auth](/vault/docs/auth/gcp) method, using Google's Kubernetes Engine (GKE) workload identity.
-
-1. Follow Google's [Use Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity) guide to enable workload identity on a GKE cluster so your Kubernetes service account can impersonate a Google IAM service account. 
-
-1. Create an appropriate authentication role in your Vault instance:
-
-  <CodeTabs>
-  <CodeBlockConfig>
-
-  ```shell-session
-  $ vault write auth/gcp/role/<VAULT_GCP_ROLE> \
-      type="iam" \
-      policies="default" \
-      max_jwt_exp=3600 \
-      bound_service_accounts="<SERVICE_ACCOUNT>@<GCP_PROJECT>.iam.gserviceaccount.com"
-  ```
-
-  </CodeBlockConfig>
-  <CodeBlockConfig>
-
-  ```hcl
-  resource "vault_gcp_auth_backend_role" "gcp_role" {
-    backend                = "auth/gcp"
-    role                   = <VAULT_GCP_ROLE>
-    type                   = "iam"
-    token_policies         = "default"
-    max_jwt_exp            = 3600
-    bound_service_accounts = [
-      "<SERVICE_ACCOUNT>@<GCP_PROJECT>.iam.gserviceaccount.com",
-    ]
-  }
-  ```
-
-  </CodeBlockConfig>
-  </CodeTabs>
-
-  <Note>
-
-    `max_jwt_exp` needs to be greater than or equal to 1 hour (3600)
-  
-  </Note>
-
-1. Create the corresponding authentication object for VSO:
-
-  ```yaml
-  apiVersion: secrets.hashicorp.com/v1beta1
-  kind: VaultAuth
-  metadata:
-    name: vaultauth-gcp-example
-    namespace: <K8S_NAMESPACE>
-  spec:
-    vaultConnectionRef: <VAULT_CONNECTION_NAME>
-    mount: gcp
-    method: gcp
-    gcp:
-      role: <VAULT_GCP_ROLE>
-      workloadIdentityServiceAccount: <K8S_SERVICE_ACCOUNT>
-  ```
-
-<Tip title="Terraform has workload identity support">
-
-  If you use Terraform to manage your GKE cluster, the
-  [GKE module](https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/latest)
-  includes workload identity support through the
-  [workload identity submodule](https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/latest/submodules/workload-identity).
-
-</Tip>
-
-# API
-
-See the full list of GCP VaultAuth options on the [VSO API page](/vault/docs/platform/k8s/vso/api-reference#vaultauthconfiggcp).
diff --git a/website/content/docs/platform/k8s/vso/sources/vault/index.mdx b/website/content/docs/platform/k8s/vso/sources/vault/index.mdx
deleted file mode 100644
index 5880d5945cb..00000000000
--- a/website/content/docs/platform/k8s/vso/sources/vault/index.mdx
+++ /dev/null
@@ -1,305 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator
-description: >-
-  The Vault Secrets Operator allows Pods to consume Vault secrets natively from Kubernetes Secrets.
----
-
-# Vault Secrets Operator
-
-The Vault Secrets Operator (VSO) supports Vault as a secret source, which
-lets you seamlessly integrate VSO with a Vault instance running on any
-platform.
-
-## Supported Vault platform and version
-
-| Platform                                  | Version |
-|-------------------------------------------|---------|
-| [Vault Enterprise/Community](/vault/docs) | 1.11+   |
-| [HCP Vault Dedicated](/hcp/docs/vault)    | 1.11+   |
-
-## Features
-
-Vault Secrets Operator supports the following Vault features:
-
-- Sync from multiple instances of Vault.
-- All Vault [secret engines](/vault/docs/secrets) supported.
-- TLS/mTLS communications with Vault.
-- Support for all VSO features, including performing a rollout-restart upon secret rotation or
-during drift remediation.
-- Cross Vault namespace authentication for Vault Enterprise 1.13+.
-
-### Supported Vault authentication methods
-
-| Backend                                                                            | Description                                                                                                 |
-|------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------|
-| [Kubernetes](/vault/docs/platform/k8s/vso/api-reference#vaultauthconfigkubernetes) | Relies on short-lived Kubernetes ServiceAccount tokens for Vault authentication                             |
-| [JWT](/vault/docs/platform/k8s/vso/api-reference#vaultauthconfigjwt)               | Relies on either static JWT tokens or short-lived Kubernetes ServiceAccount tokens for Vault authentication |
-| [AppRole](/vault/docs/platform/k8s/vso/api-reference#vaultauthconfigapprole)       | Relies on static AppRole credentials for Vault authentication                                               |
-| [AWS](/vault/docs/platform/k8s/vso/sources/vault/auth/aws)                         | Relies on AWS credentials for Vault authentication                                                          |
-| [GCP](/vault/docs/platform/k8s/vso/sources/vault/auth/gcp)                         | Relies on GCP credentials for Vault authentication                                                          |
-
-## Vault access and custom resource definitions
-
-`VaultConnection` and `VaultAuth` CRDs provide Vault connection and authentication configuration
-information for the operator. Consider `VaultConnection` and `VaultAuth` as foundational resources
-used by all secret replication type resources.
-
-### VaultConnection custom resource
-
-Provides the required configuration details for connecting to a single Vault server instance.
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultConnection
-metadata:
-  namespace: vso-example
-  name: vault-connection
-spec:
-  # required configuration
-  # address to the Vault server.
-  address: http://vault.vault.svc.cluster.local:8200
-
-  # optional configuration
-  # HTTP headers to be included in all Vault requests.
-  # headers: []
-  # TLS server name to use as the SNI host for TLS connections.
-  # tlsServerName: ""
-  # skip TLS verification for TLS connections to Vault.
-  # skipTLSVerify: false
-  # the trusted PEM encoded CA certificate chain stored in a Kubernetes Secret
-  # caCertSecretRef: ""
-```
-
-### VaultAuth custom resource
-
-Provide the configuration necessary for the Operator to authenticate to a single Vault server instance as
-specified in a `VaultConnection` custom resource.
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  namespace: vso-example
-  name: vault-auth
-spec:
-  # required configuration
-  # VaultConnectionRef of the corresponding VaultConnection CustomResource.
-  # If no value is specified the Operator will default to the `default` VaultConnection,
-  # configured in its own Kubernetes namespace.
-  vaultConnectionRef: vault-connection
-  # Method to use when authenticating to Vault.
-  method: kubernetes
-  # Mount to use when authenticating to auth method.
-  mount: kubernetes
-  # Kubernetes specific auth configuration, requires that the Method be set to kubernetes.
-  kubernetes:
-    # role to use when authenticating to Vault
-    role: example
-    # ServiceAccount to use when authenticating to Vault
-    # it is recommended to always provide a unique serviceAccount per Pod/application
-    serviceAccount: default
-
-  # optional configuration
-  # Vault namespace where the auth backend is mounted (requires Vault Enterprise)
-  # namespace: ""
-  # Params to use when authenticating to Vault
-  # params: []
-  # HTTP headers to be included in all Vault authentication requests.
-  # headers: []
-```
-
-## Vault secret custom resource definitions
-
-Provide the configuration necessary for the Operator to replicate a single Vault Secret to a single Kubernetes Secret.
-Each supported CRD is specialized to a *class* of Vault secret, documented below.
-
-### VaultStaticSecret custom resource
-
-Provides the configuration necessary for the Operator to synchronize a single Vault *static* Secret to a single Kubernetes Secret.<br />
-Supported secrets engines: [kv-v2](/vault/docs/secrets/kv/kv-v2), [kv-v1](/vault/docs/secrets/kv/kv-v1)
-
-##### KV version 1 secret example
-
-The KV secrets engine's `kvv1` mount path is specified under `spec.mount` of `VaultStaticSecret` custom resource. Please consult [KV Secrets Engine - Version 1 - Setup](/vault/docs/secrets/kv/kv-v1#setup) for configuring KV secrets engine version 1. The following results in a request to `http://127.0.0.1:8200/v1/kvv1/eng/apikey/google` to retrieve the secret.
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  namespace: vso-example
-  name: vault-static-secret-v1
-spec:
-  vaultAuthRef: vault-auth
-  mount: kvv1
-  type: kv-v1
-  path: eng/apikey/google
-  refreshAfter: 60s
-  destination:
-    create: true
-    name: static-secret1
-```
-
-##### KV version 2 secret example
-
-Set the KV secrets engine (`kvv2`) mount path with the `spec.mount` parameter of
-your `VaultStaticSecret` custom resource. For more advanced KV secrets engine
-version 2 configuration options, consult the
-[KV Secrets Engine - Version 2 - Setup](/vault/docs/secrets/kv/kv-v2#setup)
-guide.
-
-For example, to send requests to `http://127.0.0.1:8200/v1/kvv2/eng/apikey/google`
-to retrieve secrets:
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  namespace: vso-example
-  name: vault-static-secret-v2
-spec:
-  vaultAuthRef: vault-auth
-  mount: kvv2
-  type: kv-v2
-  path: eng/apikey/google
-  version: 2
-  refreshAfter: 60s
-  destination:
-    create: true
-    name: static-secret2
-```
-
-### VaultPKISecret custom resource
-Provides the configuration necessary for the Operator to synchronize a single Vault *PKI* Secret to a single Kubernetes Secret.<br />
-Supported secrets engines: [pki](/vault/docs/secrets/pki)
-
-The PKI secrets engine's mount path is specified under `spec.mount` of `VaultPKISecret` custom resource. Please consult [PKI Secrets Engine - Setup and Usage](/vault/docs/secrets/pki/setup) for configuring PKI secrets engine. The following results in a request to `http://127.0.0.1:8200/v1/pki/issue/default` to generate TLS certificates.
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultPKISecret
-metadata:
-  namespace: vso-example
-  name: vault-pki
-spec:
-  vaultAuthRef: vault-auth
-  mount: pki
-  role: default
-  commonName: example.com
-  format: pem
-  expiryOffset: 1s
-  ttl: 60s
-  namespace: tenant-1
-  destination:
-    create: true
-    name: pki1
-```
-
-### VaultDynamicSecret custom resource
-
-Provides the configuration necessary for the Operator to synchronize a single Vault *dynamic* Secret to a single Kubernetes Secret.<br />
-Supported secrets engines *non-exhaustive*: [databases](/vault/docs/secrets/databases), [aws](/vault/docs/secrets/aws),
-[azure](/vault/docs/secrets/azure), [gcp](/vault/docs/secrets/gcp), ...
-
-##### Database secret example
-
-Set the database secret engine mount path (`db`) with the `spec.mount` of your
-`VaultDynamicSecret` custom resource. For more advanced database secrets engine
-configuration options, consult the
-[Database Secrets Engine - Setup](/vault/docs/secrets/databases#setup) guide.
-
-For example, to send requests to
-`http://127.0.0.1:8200/v1/db/creds/my-postgresql-role` to generate a new
-credential:
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultDynamicSecret
-metadata:
-  namespace: vso-example
-  name: vault-dynamic-secret-db
-spec:
-  vaultAuthRef: vault-auth
-  mount: db
-  path: creds/my-postgresql-role
-  destination:
-    create: true
-    name: dynamic-db
-```
-
-##### AWS secret example
-
-Set the AWS secrets engine mount path (`aws`) with the `spec.mount` parameter of
-your `VaultDynamicSecret` custom resource. For more advanced AWS secrets engine
-configuration options, consult the
-[AWS Secrets Engine - Setup](/vault/docs/secrets/aws#setup) guide.
-
-For example, to send requests to `http://127.0.0.1:8200/v1/aws/creds/my-iam-role`
-to generate a new IAM credential:
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultDynamicSecret
-metadata:
-  namespace: vso-example
-  name: vault-dynamic-secret-aws-iam
-spec:
-  vaultAuthRef: vault-auth
-  mount: aws
-  path: creds/my-iam-role
-  destination:
-    create: true
-    name: dynamic-aws-iam
-```
-
-To send requests to `http://127.0.0.1:8200/v1/aws/sts/my-sts-role` to generate a new STS credential:
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultDynamicSecret
-metadata:
-  namespace: vso-example
-  name: vault-dynamic-secret-aws-sts
-spec:
-  vaultAuthRef: vault-auth
-  mount: aws
-  path: sts/my-sts-role
-  destination:
-    create: true
-    name: dynamic-aws-sts
-```
-
-##### HCP Vault Secrets Example
-
-
-```yaml
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultDynamicSecret
-metadata:
-  namespace: vso-example
-  name: vault-dynamic-secret-aws-iam-role
-spec:
-  vaultAuthRef: vault-auth
-  mount: aws
-  path: creds/my-iam-role
-  destination:
-    create: true
-    name: dynamic-aws-iam-role
-```
-
-@include 'vso/blurb-api-reference.mdx'
-
-## Tutorial
-
-Refer to the [Vault Secrets Operator on
-Kubernetes](/vault/tutorials/kubernetes/vault-secrets-operator) tutorial to
-learn the end-to-end workflow using the Vault Secrets Operator.
diff --git a/website/content/docs/platform/k8s/vso/telemetry.mdx b/website/content/docs/platform/k8s/vso/telemetry.mdx
deleted file mode 100644
index e58211e67b7..00000000000
--- a/website/content/docs/platform/k8s/vso/telemetry.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
----
-layout: docs
-page_title: Vault Secrets Operator Telemetry
-description: >-
-  The Vault Secrets Operator allows Pods to consume Vault secrets natively from Kubernetes Secrets.
----
-
-# Telemetry
-
-The Vault Secrets Operator is instrumented with Prometheus metrics in the following ways:
-* The operator will emit the default controller-runtime metrics as outlined in the [monitoring](https://book-v1.book.kubebuilder.io/beyond_basics/controller_metrics.html)
-* Custom metrics related to the operator internals which are defined in [`internal/metrics/metrics.go`](https://github.com/hashicorp/vault-secrets-operator/blob/main/internal/metrics/metrics.go)
-* Ability to deploy a Prometheus Service Monitor, configured via the Helm Chart [`telemetry`](/vault/docs/platform/k8s/vso/helm#h-telemetry) stanza.
-* Ability to deploy a Metrics Service, configured via the Helm Chart [`metricsService`](/vault/docs/platform/k8s/vso/helm#h-metricsservice) stanza.
diff --git a/website/content/docs/platform/mssql/changelog.mdx b/website/content/docs/platform/mssql/changelog.mdx
deleted file mode 100644
index d30107f0c8c..00000000000
--- a/website/content/docs/platform/mssql/changelog.mdx
+++ /dev/null
@@ -1,43 +0,0 @@
----
-layout: docs
-page_title: Vault EKM Provider Release Notes
-description: Release notes for the Vault EKM Provider for Microsoft SQL Server.
----
-
-# Release notes
-
-Each version is available to download from the
-[releases](https://releases.hashicorp.com/vault-mssql-ekm-provider/) page.
-
-## 0.2.2 (August 10th, 2023)
-
-BUGS
-
-* Fixed a bug that stopped the provider from successfully negotiating a TLS handshake directly with a Vault server in some configurations.
-
-## 0.2.1 (June 30th, 2023)
-
-BUGS
-
-* The provider now correctly uses a previous key version for decryption when the transit key is rotated but the DEK has not yet been re-encrypted.
-* Fixed a bug that prevented the provider from emitting Event logs.
-
-## 0.2.0 (July 15th, 2022)
-
-BUGS
-
-* Fixed a bug where rotating the Transit key would cause decryption failures.
-
-FEATURES
-
-* The config file now supports setting a Vault namespace, and a non-default transit or App Role mount path. See [Configuration][config] for details.
-
-IMPROVEMENTS
-
-* The config file is now stored inside ProgramData and will persist during future upgrades. See [Configuration][config] for details.
-
-## 0.1.0 (November 17th, 2021)
-
-Initial release.
-
-[config]: /vault/docs/platform/mssql/configuration
diff --git a/website/content/docs/platform/mssql/configuration.mdx b/website/content/docs/platform/mssql/configuration.mdx
deleted file mode 100644
index a19efdd62a2..00000000000
--- a/website/content/docs/platform/mssql/configuration.mdx
+++ /dev/null
@@ -1,28 +0,0 @@
----
-layout: docs
-page_title: Configure the Vault EKM Provider
-description: Configuration options for the Vault EKM Provider for Microsoft SQL Server.
----
-
-# Configuring the Vault EKM provider
-
-Configuration is stored in a `config.json` file under ProgramData in a path that
-mirrors the installation folder. This defaults to
-`C:\ProgramData\HashiCorp\Transit Vault EKM Provider\config.json`.
-
--> **Note:** If the Vault EKM Provider has already been installed, Microsoft
-    SQL Server needs to be restarted for configuration changes to take effect.
-
-The following options are supported:
-
-- `vaultApiBaseUrl` `(string: required)` - Address of Vault server, e.g.
-    `https://vault.example.com:8200`
-- `enableTrace` `(bool: false)` - Enable trace logging. Logs are viewable from
-    the event viewer. See [troubleshooting](/vault/docs/platform/mssql/troubleshooting)
-    for further details.
-- `namespace` `(string: "")` - Set the Vault namespace to use. Applies to both
-    AppRole and Transit.
-- `appRoleMountPath` `(string: "approle")` - Use this to specify the path to the
-    AppRole auth mount if it was set to a non-default path.
-- `transitMountPath` `(string: "transit")` - Use this to specify the path to the
-    Transit mount if it was set to a non-default path.
diff --git a/website/content/docs/platform/mssql/index.mdx b/website/content/docs/platform/mssql/index.mdx
deleted file mode 100644
index a5a8b3e9804..00000000000
--- a/website/content/docs/platform/mssql/index.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: Vault EKM provider for SQL Server
-description: >-
-  The Vault EKM module for Microsoft SQL Server allows Vault to act as a provider for TDE.
----
-
-# Vault EKM provider for SQL server
-
-<EnterpriseAlert product="vault">
-Requires&nbsp;
-<a href="https://www.hashicorp.com/products/vault/pricing">Vault Enterprise</a>
-&nbsp;with <b>Advanced Data Protection Key Management</b> module.
-</EnterpriseAlert>
-
-Microsoft SQL Server supports [Transparent Data Encryption][tde] (TDE). The
-Database Encryption Keys (DEK) can be protected by asymmetric Key Encryption
-Keys (KEK) managed by Vault's [Transit][transit] secret engine using SQL Server's
-[Extensible Key Management][tde] (EKM).
-
-[tde]: https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption?view=sql-server-ver15
-[ekm]: https://docs.microsoft.com/sql/relational-databases/security/encryption/extensible-key-management-ekm?view=sql-server-ver15
-[transit]: /vault/docs/secrets/transit
-
-
-See [installation](/vault/docs/platform/mssql/installation) and [configuration](/vault/docs/platform/mssql/configuration)
-for help getting started with the Vault EKM provider for SQL Server.
-
-## Features
-
-The following features are supported by the Vault EKM provider:
-
-* Management of KEK with Transit secret engine using `rsa-2048` key cipher
-* AppRole auth
diff --git a/website/content/docs/platform/mssql/installation.mdx b/website/content/docs/platform/mssql/installation.mdx
deleted file mode 100644
index b19e9e51c2c..00000000000
--- a/website/content/docs/platform/mssql/installation.mdx
+++ /dev/null
@@ -1,258 +0,0 @@
----
-layout: docs
-page_title: Install the Vault EKM Provider
-description: Installation steps for the Vault EKM Provider for Microsoft SQL Server.
----
-
-# Installing the Vault EKM provider
-
-This guide assumes you are installing the Vault EKM Provider for the first time.
-For upgrade instructions, see [upgrading](/vault/docs/platform/mssql/upgrading).
-
-## Prerequisites
-
-* Vault Enterprise server 1.9+ with a license for the Advanced Data Protection Key Management module
-* Microsoft Windows Server operating system
-* Microsoft SQL Server 2012 or newer for Windows (Windows SQL Server Express and SQL Server for Linux [does not support EKM][linux-ekm])
-* An authenticated Vault client
-
-To check your Vault version and license, you can run:
-
-```bash
-vault status
-vault license get -format=json
-```
-
-The list of features should include "Key Management Transparent Data Encryption".
-
-[linux-ekm]: https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-editions-and-components-2019?view=sql-server-ver15#Unsupported
-
-## Installing the Vault EKM provider
-
-## Configuring Vault
-
-The EKM provider requires AppRole auth and the Transit secret engine to be setup
-on the Vault server. The steps below can be used to configure Vault ready for the
-EKM provider to use it.
-
--> **Note:** rsa-2048 is currently the only supported key type.
-
-1. Set up AppRole auth:
-
-    ```bash
-    vault auth enable approle
-    vault write auth/approle/role/ekm-encryption-key-role \
-        token_ttl=20m \
-        max_token_ttl=30m \
-        token_policies=tde-policy
-    ```
-
--> **Note:** After authenticating to Vault with the AppRole, the EKM provider
-will re-use the token it receives until it expires, at which point it will
-authenticate using the AppRole credentials again; it will not attempt to renew
-its token. The example AppRole configuraiton here will work for this, but keep
-that in mind if you choose to use a different AppRole configuration.
-
-1. Retrieve the AppRole ID and secret ID for use later when configuring SQL Server:
-
-    ```bash
-    vault read auth/approle/role/ekm-encryption-key-role/role-id
-    vault write -f auth/approle/role/ekm-encryption-key-role/secret-id
-    ```
-
-1. Enable the transit secret engine and create a key:
-
-    ```bash
-    vault secrets enable transit
-    vault write -f transit/keys/ekm-encryption-key type="rsa-2048"
-    ```
-
-1. Create a policy for the Vault EKM provider to use. The following policy has
-    the minimum required permissions:
-
-    ```bash
-    vault policy write tde-policy -<<EOF
-    path "transit/keys/ekm-encryption-key" {
-        capabilities = ["create", "read", "update", "delete"]
-    }
-
-    path "transit/keys" {
-        capabilities = ["list"]
-    }
-
-    path "transit/encrypt/ekm-encryption-key" {
-        capabilities = ["update"]
-    }
-
-    path "transit/decrypt/ekm-encryption-key" {
-        capabilities = ["update"]
-    }
-
-    path "sys/license/status" {
-        capabilities = ["read"]
-    }
-    EOF
-    ```
-
-## Configuring SQL server
-
-The remaining steps are all run on the database server.
-
-### Install the EKM provider on the server
-
-1. Download and run the latest Vault EKM provider installer from
-  [releases.hashicorp.com](https://releases.hashicorp.com/vault-mssql-ekm-provider/)
-1. Enter your Vault server's address when prompted and complete the installer
-1. If you need to configure non-default namespace or mount paths for your AppRole and
-   Transit engines, see [configuration](/vault/docs/platform/mssql/configuration).
-
-### Configure the EKM provider using SQL
-
-Open Microsoft SQL Server Management Studio, and run the queries below to complete
-installation.
-
-1. Enable the EKM feature and create a cryptographic provider using the folder
-   you just installed the EKM provider into.
-
-    ```sql
-    -- Enable advanced options
-    USE master;
-    GO
-
-    EXEC sp_configure 'show advanced options', 1;
-    GO
-
-    RECONFIGURE;
-    GO
-
-    -- Enable EKM provider
-    EXEC sp_configure 'EKM provider enabled', 1;
-    GO
-
-    RECONFIGURE;
-    GO
-
-    CREATE CRYPTOGRAPHIC PROVIDER TransitVaultProvider
-    FROM FILE = 'C:\Program Files\HashiCorp\Transit Vault EKM Provider\TransitVaultEKM.dll'
-    GO
-    ```
-
-1. Next, create credentials for an admin to use EKM with your AppRole role and
-    secret ID from above:
-
-    ```sql
-    -- Replace <approle-role-id> and <approle-secret-id> with the values from
-    -- the earlier vault commands:
-    -- vault read auth/approle/role/ekm-encryption-key/role-id
-    -- vault write -f auth/approle/role/ekm-encryption-key/secret-id
-    CREATE CREDENTIAL TransitVaultCredentials
-        WITH IDENTITY = '<approle-role-id>',
-        SECRET = '<approle-secret-id>'
-    FOR CRYPTOGRAPHIC PROVIDER TransitVaultProvider;
-    GO
-
-    -- Replace <domain>\<login> with the SQL Server administrator's login
-    ALTER LOGIN "<domain>\<login>" ADD CREDENTIAL TransitVaultCredentials;
-    ```
-
-1. You can now create an asymmetric key using the transit key set up earlier:
-
-    ```sql
-    CREATE ASYMMETRIC KEY TransitVaultAsymmetric
-    FROM PROVIDER TransitVaultProvider
-    WITH
-    CREATION_DISPOSITION = OPEN_EXISTING,
-    PROVIDER_KEY_NAME = 'ekm-encryption-key';
-    ```
-
-    -> **Note:** This is the first step at which the EKM provider will communicate with Vault. If
-    Vault is misconfigured, this step is likely to fail. See
-    [troubleshooting](/vault/docs/platform/mssql/troubleshooting) for tips on specific error codes.
-
-1. Create another login from the new asymmetric key:
-
-    ```sql
-     -- Replace <approle-role-id> and <approle-secret-id> with the values from
-    -- the earlier vault commands again
-    CREATE CREDENTIAL TransitVaultTDECredentials
-        WITH IDENTITY = '<approle-role-id>',
-        SECRET = '<approle-secret-id>'
-    FOR CRYPTOGRAPHIC PROVIDER TransitVaultProvider;
-    GO
-
-    CREATE LOGIN TransitVaultTDELogin
-    FROM ASYMMETRIC KEY TransitVaultAsymmetric;
-    GO
-
-    ALTER LOGIN TransitVaultTDELogin
-    ADD CREDENTIAL TransitVaultTDECredentials;
-    GO
-    ```
-
-1. Finally, you can enable TDE and protect the database encryption key with
-   the asymmetric key managed by Vault's Transit secret engine:
-
-    ```sql
-    CREATE DATABASE TestTDE
-    GO
-
-    USE TestTDE;
-    GO
-
-    CREATE DATABASE ENCRYPTION KEY
-    WITH ALGORITHM = AES_256
-    ENCRYPTION BY SERVER ASYMMETRIC KEY TransitVaultAsymmetric;
-    GO
-
-    ALTER DATABASE TestTDE
-    SET ENCRYPTION ON;
-    GO
-    ```
-
-1. Check the status of database encryption using the following queries:
-    ```sql
-    SELECT * FROM sys.dm_database_encryption_keys;
-
-    SELECT (SELECT name FROM sys.databases WHERE database_id = k.database_id) as name,
-        encryption_state, key_algorithm, key_length,
-        encryptor_type, encryption_state_desc, encryption_scan_state_desc FROM sys.dm_database_encryption_keys k;
-
-    ```
-
-## Key rotation
-
-Both the database encryption key and Vault Transit's asymmetric key can be rotated independently.
-
-To rotate the database encryption key, you can execute the
-[following SQL query](https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-database-encryption-key-transact-sql?view=azuresqldb-current)
-in Microsoft SQL Server Management Studio:
-
-```sql
-USE TestTDE;
-GO
-
-ALTER DATABASE ENCRYPTION KEY
-REGENERATE WITH ALGORITHM = AES_256;
-GO
-
-SELECT * FROM sys.dm_database_encryption_keys;
-```
-
-To rotate the asymmetric key in Vault's Transit, you can use the standard
-[`/rotate`](/vault/api-docs/secret/transit#rotate-key) endpoint:
-
-```shell-session
-$ vault write -f transit/keys/ekm-encryption-key/rotate
-```
-
-After rotating the Vault asymmetric key, you can force SQL Server to re-encrypt the database encryption
-key with the newest version of the Vault key with:
-
-```sql
-USE TestTDE;
-GO
-
-ALTER DATABASE ENCRYPTION KEY
-ENCRYPTION BY SERVER ASYMMETRIC KEY TransitVaultAsymmetric;
-GO
-```
diff --git a/website/content/docs/platform/mssql/troubleshooting.mdx b/website/content/docs/platform/mssql/troubleshooting.mdx
deleted file mode 100644
index 534b6273764..00000000000
--- a/website/content/docs/platform/mssql/troubleshooting.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-layout: docs
-page_title: Troubleshoot the Vault EKM Provider
-description: Troubleshooting steps for the Vault EKM Provider for Microsoft SQL Server.
----
-
-# Troubleshooting the Vault EKM provider
-
-## Check windows event logs
-
-Logs from the Vault EKM provider will appear in Windows Event Viewer under
-"Windows Logs" > "Application" with source "Transit Vault EKM Provider".
-
-### Enable trace logging
-
-If the logs in the Event Viewer don't give enough information to help debug
-your issue, you can [enable trace logging](/vault/docs/platform/mssql/configuration#enabletrace).
-
-Restart SQL Server for the config change to take effect, and you should see more
-detailed logs in the same section of Windows Event Viewer.
-
-## Check SQL server error logs
-
-If the Vault EKM provider is not generating event logs, you may find some
-information in the SQL Server's error logs. Check for an event with ID
-17111 from "MSSQLSERVER" which details the file location of the error logs,
-for example "Logging SQL Server messages in file
-'C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\Log\ERRORLOG'."
-
-## Authenticode error
-
-When running the `CREATE CRYPTOGRAPHIC PROVIDER` SQL query, if you get an error
-"Cannot load library", you may see "Failed to verify Authenticode signature on
-DLL" in the error logs. This can normally be remediated by updating the CA trust
-store to include the latest Digicert certificates. Run the following to import
-the required certificates into the Root trust store:
-
-```powershell
-New-Item -ItemType Directory -Path certs
-certutil -syncwithWU .\certs\
-extrac32 -L .\certs\ .\certs\authrootstl.cab
-certutil -f -ent -AddStore Root .\certs\authroot.stl
-certutil -f -ent -AddStore Root .\certs\0563b8630d62d75abbc8ab1e4bdfb5a899b24d43.crt
-certutil -f -ent -AddStore Root .\certs\ddfb16cd4931c973a2037d3fc83a4d7d775d05e4.crt
-Remove-Item -Recurse .\certs\
-```
-
-## Error codes
-
-During installation, the EKM provider registers a manifest of coded event logs to aid debugging. You may see the following error codes during operation.
-
-### 2050 license error
-
-The EKM provider was unable to verify that Vault has the correct license features. This
-could be due to:
-
-- An incompatible Vault Enterprise license - see the installation [prerequisites](/vault/docs/platform/mssql/installation#prerequisites) for the required license feature.
-- Lack of network connectivity - Check Vault's audit logs to see if any requests are made to
-   authenticate via AppRole or query the `/sys/license/status` API.
-- Misconfigured AppRole auth - Ensure you provided the correct Role ID and Secret ID when
-   configuring the SQL Server `CREDENTIAL`. See the
-   [installation instructions](/vault/docs/platform/mssql/installation) for an end-to-end working example.
-- Incorrect policy permissions - The EKM provider requires the `read` capability
-   on the path `sys/license/status`. See the `tde-policy` created in the
-   [installation instructions](/vault/docs/platform/mssql/installation#configuring-vault)
-   for an example of a working policy.
diff --git a/website/content/docs/platform/mssql/upgrading.mdx b/website/content/docs/platform/mssql/upgrading.mdx
deleted file mode 100644
index 54956c98471..00000000000
--- a/website/content/docs/platform/mssql/upgrading.mdx
+++ /dev/null
@@ -1,42 +0,0 @@
----
-layout: docs
-page_title: Upgrade the Vault EKM Provider
-description: Upgrade steps for the Vault EKM Provider for Microsoft SQL Server.
----
-
-# Upgrading the Vault EKM provider
-
-~> **Note:** The upgrade process will put the database into maintenance mode and
-    require a restart. It is highly recommended to test this procedure in a
-    staging environment prior to running it on a production database.
-
-1. Disable the Vault EKM Provider, and verify it is marked disabled:
-
-    ```sql
-    ALTER CRYPTOGRAPHIC PROVIDER TransitVaultProvider DISABLE;
-    SELECT * FROM sys.cryptographic_providers;
-    ```
-
-1. Install the latest version from [releases.hashicorp.com][releases], following
-  the instructions in the installer.
-    1. If you get a "Files in Use" prompt while running the installer, select
-      "Do not close applications. A reboot will be required", and restart
-      after the installation has completed.
-1. Reload the provider DLL:
-
-    ```sql
-    ALTER CRYPTOGRAPHIC PROVIDER TransitVaultProvider
-        FROM FILE = 'C:\Program Files\HashiCorp\Transit Vault EKM Provider\TransitVaultEKM.dll';
-    ```
-
-1. Now re-enable the Vault EKM Provider and verify it is both marked enabled
-  and the version reported matches the version of the installer:
-
-    ```sql
-    ALTER CRYPTOGRAPHIC PROVIDER TransitVaultProvider ENABLE;
-    SELECT * FROM sys.cryptographic_providers;
-    ```
-
-1. Finally, restart Microsoft SQL Server.
-
-[releases]: https://releases.hashicorp.com/vault-mssql-ekm-provider/
diff --git a/website/content/docs/platform/servicenow/configuration.mdx b/website/content/docs/platform/servicenow/configuration.mdx
deleted file mode 100644
index 155653f3d27..00000000000
--- a/website/content/docs/platform/servicenow/configuration.mdx
+++ /dev/null
@@ -1,86 +0,0 @@
----
-layout: docs
-page_title: Configure Vault ServiceNow Credential Resolver
-description: This section documents the configurables for the Vault ServiceNow Credential Resolver.
----
-
-# Configuring the Vault credential resolver
-
-## MID server properties
-
-The following [properties] are supported by the Vault Credential Resolver:
-
-- `mid.external_credentials.vault.address` `(string: "")` - Address of Vault Agent as resolveable by the MID server.
-  For example, if Vault Agent is on the same server as the MID server it could be `https://127.0.0.1:8200`.
-
-- `mid.external_credentials.vault.ca` `(string: "")` - The CA certificate to trust for TLS in PEM format. If unset,
-  the system's trusted CAs will be used.
-
-- `mid.external_credentials.vault.tls_skip_verify` `(string: "")` - When set to true, skips verification of the Vault server
-  TLS certificiate. Setting this to true is not recommended for production.
-
-[properties]: https://docs.servicenow.com/bundle/quebec-servicenow-platform/page/product/mid-server/reference/r_MIDServerProperties.html#t_SetMIDServerProperties
-
-## Configuring discovery credentials
-
-To consume Vault credentials from your MID server, you will need to:
-
-* Create a secret in Vault
-* Configure the resolver to use that secret
-
-### Creating a secret in Vault
-
-The credential resolver supports reading credentials from the following secret engines:
-
-* [Active Directory](/vault/docs/secrets/ad)
-* [AD/OpenLDAP] (/vault/docs/secrets/ldap)
-* [AWS](/vault/docs/secrets/aws)
-* [KV v1](/vault/docs/secrets/kv/kv-v1)
-* [KV v2](/vault/docs/secrets/kv/kv-v2)
-
-When creating KV secrets, you must use the following keys for each component
-to ensure it is correctly mapped to ServiceNow's credential fields:
-
-Key         | Description                            | Supported aliases
-------------|----------------------------------------|------------------
-username    | The username                           | access_key
-password    | The password                           | secret_key, current_password
-private_key | The private SSH key                    |
-passphrase  | The passphrase for the private SSH key |
-
-Most ServiceNow credential types will expect at least a username and either
-a password or a private key. To help surface errors early, the credential
-resolver validates that a username and password are present for:
-
-* aws
-* basic
-* jdbc
-* jms
-* ssh_password
-* vmware
-* windows
-
-And the credential resolver expects the following types to specify at least
-a username and a private key:
-
-* api_key
-* cfg_chef_credentials
-* infoblox
-* sn_cfg_ansible
-* sn_disco_certmgmt_certificate_ca
-* ssh_private_key
-
-### Configuring the resolver to use a secret
-
-In the ServiceNow UI:
-
-* Navigate to "Discovery - Credentials" -> New
-  * Select a type from the list
-  * Tick "External credential store"
-  * Fill in a meaningful name
-  * Set "Credential ID" to the path in Vault where your secret is located, e.g.
-    for a KV v2 secret engine mounted at "secret", you might have a secret stored
-    under "ssh": `secret/data/ssh`. Check the [API docs](/vault/api-docs/secret/) for
-    your secret engine if you are unsure of the path to use
-  * **Optional:** Click "Test credential" and select a MID server and a target
-    to test against to test everything is working
diff --git a/website/content/docs/platform/servicenow/index.mdx b/website/content/docs/platform/servicenow/index.mdx
deleted file mode 100644
index 9c0c02af078..00000000000
--- a/website/content/docs/platform/servicenow/index.mdx
+++ /dev/null
@@ -1,43 +0,0 @@
----
-layout: docs
-page_title: Vault ServiceNow Credential Resolver
-description: >-
-  The Vault Credential Resolver allows ServiceNow MID servers to use Vault as an enterprise-grade external secret store.
----
-
-# Vault credential resolver
-
-ServiceNow® MID servers can use the Vault Credential Resolver to consume secrets
-directly from Vault for the purpose of performing discovery. See
-[installation](/vault/docs/platform/servicenow/installation) and
-[configuration](/vault/docs/platform/servicenow/configuration) for help getting started
-with the Vault Credential Resolver.
-
-## Overview
-
-ServiceNow uses MID servers deployed inside customer networks to perform
-agent-less discovery of their infrastructure. As infrastructure such as databases
-or servers are discovered, their attributes such as address and software versions
-are stored in a database. Naturally, this process requires a wide array of
-credentials. Customers can use ServiceNow's built-in credential storage, or install
-an external credential resolver to take advantage of their existing enterprise-grade
-secret storage solution.
-
-[![Architecture Overview](/img/servicenow-vault-credential-resolver-diagram.png)](/img/servicenow-vault-credential-resolver-diagram.png)
-
-The Vault Credential Resolver is one such resolver. The MID server will not
-store or cache any credentials marked as external, and will invoke the
-credential resolver each time it requires credentials.
-
-The Vault Credential Resolver is designed to communicate with a Vault Agent
-service installed on the same machine as the MID server. Authentication is
-handled between the Agent and Vault, and Vault Agent also handles caching and
-renewing leased secrets to ensure the load on Vault is minimized.
-
-### Features
-
-The following features are supported by the Vault Credential Resolver:
-
-- KV, Active Directory and AWS secret engines.
-- Communication with Vault via Vault Agent.
-- TLS communication with Vault Agent.
diff --git a/website/content/docs/platform/servicenow/installation.mdx b/website/content/docs/platform/servicenow/installation.mdx
deleted file mode 100644
index 58389524323..00000000000
--- a/website/content/docs/platform/servicenow/installation.mdx
+++ /dev/null
@@ -1,97 +0,0 @@
----
-layout: docs
-page_title: Install Vault ServiceNow Credential Resolver
-description: Installation steps for the Vault ServiceNow Credential Resolver.
----
-
-# Installing the Vault credential resolver
-
-## Prerequisites
-
-* ServiceNow version Quebec+ (untested on previous versions)
-* MID server version Quebec+ (untested on previous versions)
-* Discovery and external credential plugins activated on ServiceNow
-* Working Vault deployment accessible from the MID server
-
-## Installing Vault agent
-
-* Select your desired auth method from Agent's [supported auth methods](/vault/docs/agent-and-proxy/autoauth/methods)
-  and set it up in Vault
-  * For example, to set up AppRole auth and a role called `role1` with the `demo` policy attached:
-
-    ```bash
-    vault auth enable approle
-    vault write auth/approle/role/role1 bind_secret_id=true token_policies=demo
-    ```
-
-  * To get the files required for the example Agent config below, you can then
-    run:
-
-    ```bash
-    echo -n $(vault read -format json auth/approle/role/role1/role-id | jq -r '.data.role_id') > /path/to/roleID
-    echo -n $(vault write -format json -f auth/approle/role/role1/secret-id | jq -r '.data.secret_id') > /path/to/secretID
-    ```
-
-* Create an `agent.hcl` config file. Your exact configuration may vary, but you
-  must set `cache.use_auto_auth_token = true`, and the `listener`, `vault` and
-  `auto_auth` blocks are also required to set up a working Agent, e.g.:
-
-  ```hcl
-  listener "tcp" {
-    address = "127.0.0.1:8200"
-    tls_disable = false
-    tls_cert_file = "/path/to/cert.pem"
-    tls_key_file = "/path/to/key.pem"
-  }
-
-  cache {
-    use_auto_auth_token = true
-  }
-
-  vault {
-    address = "http://vault.example.com:8200"
-  }
-
-  auto_auth {
-      method {
-          type = "approle"
-          config = {
-              role_id_file_path = "/path/to/roleID"
-              secret_id_file_path = "/path/to/secretID"
-              remove_secret_id_file_after_reading = false
-          }
-      }
-  }
-  ```
-
-* Install Vault Agent as a service running `vault agent -config=/path/to/agent.hcl`
-  * Documentation for Windows service installation [here](/vault/docs/agent-and-proxy/agent/winsvc)
-
-## Uploading JAR file to MID server
-
-<Warning heading="Use the ServiceNow app store to install Vault Credential Resolver">
-  The steps documented below are for **pre ServiceNow UTAH versions**.
-
-  As of ServiceNow version UTAH, use the "HashiCorp Vault Credential Resolver" App 
-  from the ServiceNow App store to install the Vault Credential Resolver and verify
-  the jar file installed is `vault-servicenow-credential-resolver`. If you wish to
-  use a custom name, you must manually rename the deployed jar. 
-</Warning>
-
-* Download the latest version of the Vault Credential Resolver JAR file from
-  [releases.hashicorp.com](https://releases.hashicorp.com/vault-servicenow-credential-resolver/)
-* In ServiceNow, navigate to "MID server - JAR files" -> New
-  * Manage Attachments -> upload Vault Credential Resolver JAR
-  * Fill in name, version etc as desired
-  * Click Submit
-* Navigate to "MID server - Properties" -> New
-  * Set Name: `mid.external_credentials.vault.address`, Value: Address of Vault
-    Agent listener from previous step, e.g. `http://127.0.0.1:8200`
-  * **Optional:** Set the property `mid.external_credentials.vault.ca` to the
-    trusted CA in PEM format if using TLS between the MID server and Vault
-    Agent with a self-signed certificate.
-
-## Next steps
-
-See [configuration](/vault/docs/platform/servicenow/configuration) for details on
-configuring the resolver and using credentials for discovery.
diff --git a/website/content/docs/platform/servicenow/troubleshooting.mdx b/website/content/docs/platform/servicenow/troubleshooting.mdx
deleted file mode 100644
index c462a174058..00000000000
--- a/website/content/docs/platform/servicenow/troubleshooting.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
----
-layout: docs
-page_title: Troubleshooting the Vault ServiceNow Credential Resolver
-description: Troubleshooting tips for the Vault ServiceNow Credential Resolver.
----
-
-# Troubleshooting
-
-## Check the logs
-
-Check the [log files] inside `logs/` in the agent installation folder for logs and
-errors. The resolver logs a line for each credential ID that it successfully
-queries, and also logs the fields that the credentials were extracted from.
-
-If a particular credential ID is failing, search for that ID in the logs, and
-check that it is successfully queried and that the credentials were extracted
-from the fields you expected.
-
-You will also find any exceptions that the resolver throws in the logs, including
-if it didn't find the minimum set of required fields as specified in
-[configuration](/vault/docs/platform/servicenow/configuration#creating-a-secret-in-vault),
-or if it couldn't communicate with Vault.
-
-[log files]: https://docs.servicenow.com/bundle/quebec-servicenow-platform/page/product/mid-server/reference/r_MIDServerTroubleshooting.html
-
-## Use the test credential feature
-
-When creating or configuring a credential in the ServiceNow UI, you should be
-able to click "Test credential" to perform a quick targeted test. Select the
-MID server that should query Vault, and select a target that the credential
-should work for to check that everything works as expected. If it doesn't, check
-the logs for errors and debug information as detailed above.
diff --git a/website/content/docs/plugins/containerized-plugins/add-a-containerized-plugin.mdx b/website/content/docs/plugins/containerized-plugins/add-a-containerized-plugin.mdx
deleted file mode 100644
index 3eea8cbf7ac..00000000000
--- a/website/content/docs/plugins/containerized-plugins/add-a-containerized-plugin.mdx
+++ /dev/null
@@ -1,339 +0,0 @@
----
-layout: docs
-page_title: Add a containerized secrets plugin
-description: >-
-  Add a containerized secrets plugin to your Vault instance.
----
-
-# Add a containerized secrets plugin to Vault
-
-@include 'alerts/beta.mdx'
-
-Run your external secrets plugins in containers to increases the isolation
-between the plugin and Vault.
-
-## Before you start
-
-- **Your Vault instance must be running on Linux**.
-- **Your Vault instance must have local access to the Docker Engine API**.
-  Vault uses the [Docker SDK](https://pkg.go.dev/github.com/docker/docker) to
-  manage containerized plugins.
-- **You must have [gVisor](https://gvisor.dev/docs/user_guide/install/)
-  installed**. Vault uses `runsc` as the entrypoint to your container runtime.
-- **If you are using a container runtime other than gVisor, you must have a
-  `runsc`-compatible container runtime installed**.
-
-## Step 1: Install your container engine
-
-Install one of the supported container engines:
-
-  - [Docker](https://docs.docker.com/engine/install/)
-  - [Rootless Docker](https://docs.docker.com/engine/security/rootless/)
-
-## Step 2: Configure your container runtime 
-
-Update your container engine to use `runsc` for Unix sockets between the host
-and plugin binary.
-
-<Tabs>
-
-<Tab heading="Docker">
-
-  1. Add `runsc` to your
-     [Docker daemon configuration](https://docs.docker.com/config/daemon):
-
-      ```shell-session
-      $ sudo tee PATH_TO_DOCKER_DAEMON_CONFIG_FILE <<EOF
-      {
-        "runtimes": {
-          "runsc": {
-            "path": "PATH_TO_RUNSC_INSTALLATION",
-            "runtimeArgs": [
-              "--host-uds=all"
-            ]
-          }
-        }
-      }
-      EOF
-      ```
-
-  1. Restart Docker:
-
-      ```shell-session
-      $ sudo systemctl reload docker
-      ```
-
-</Tab>
-
-<Tab heading="Rootless Docker">
-
-  1. Create a configuration directory if it does not exist already:
-
-    ```shell-session
-    $ mkdir -p ~/.config/docker
-    ```
-
-  1. Add `runsc` to your Docker configuration:
-
-    ```shell-session
-    $ tee ~/.config/docker/daemon.json  <<EOF
-    {
-      "runtimes": {
-        "runsc": {
-          "path": "PATH_TO_RUNSC_INSTALLATION",
-          "runtimeArgs": [
-            "--host-uds=all"
-            "--ignore-cgroups"
-          ]
-        }
-      }
-    }
-    EOF
-    ```
-
-  1. Restart Docker:
-
-    ```shell-session
-    $ systemctl --user restart docker
-    ```
-
-</Tab>
-
-</Tabs>
-
-## Step 3: Update the HashiCorp `go-plugin` library
-
-You must build your plugin locally with v1.5.0+ of the HashiCorp
-[`go-plugin`](https://github.com/hashicorp/go-plugin) library to ensure the
-finished binary is compatible with containerization.
-
-Use `go install` to pull the latest version of the plugin library from the
-`hashicorp/go-plugin` repo on GitHub:
-
-```shell-session
-$ go install github.com/hashicorp/go-plugin@latest
-```
-
-<Tip title="The Vault SDK includes go-plugin">
-
-  If you build with the Vault SDK, you can update `go-plugin` with `go install`
-  by pulling the latest SDK version from the `hashicorp/vault` repo:
-
-  `go install github.com/hashicorp/vault/sdk@latest`
-
-</Tip>
-
-
-## Step 4: Build the plugin container
-
-Containerized plugins must run as a binary in the finished container and
-behave the same whether run in a container or as a standalone application:
-
-1. Build your plugin binary so it runs on Linux.
-1. Create a container file for your plugin with the compiled binary as the
-   entry-point.
-1. Build the image with a unique tag.
-
-For example, to build a containerized version of the built-in key-value (KV)
-secrets plugin for Docker:
-
-1. Clone the latest version of the KV secrets plugin from
-   `hashicorp/vault-plugin-secrets-kv`.
-    ```shell-session
-    $ git clone https://github.com/hashicorp/vault-plugin-secrets-kv.git
-    ```
-1. Build the Go binary for Linux.
-    ```shell-session
-    $ cd vault-plugin-secrets-kv ; CGO_ENABLED=0 GOOS=linux \
-    go build -o kv cmd/vault-plugin-secrets-kv/main.go
-    ```
-1. Create an empty Dockerfile.
-    ```shell-session
-    $ touch Dockerfile
-    ```
-1. Update the empty `Dockerfile` with your infrastructure build details and the
-   compiled binary as the entry-point.
-   ```Dockerfile
-   FROM gcr.io/distroless/static-debian12
-   COPY kv /bin/kv
-   ENTRYPOINT [ "/bin/kv" ]
-   ```
-1. Build the container image and assign an identifiable tag.
-   ```shell-session
-   $ docker build -t hashicorp/vault-plugin-secrets-kv:mycontainer .
-   ```
-
-## Step 5: Register the plugin
-
-Registering a containerized plugin with Vault is similar to registering any
-other external plugin that is available locally to Vault.
-
-1. Store the SHA256 of the plugin image:
-   ```shell-session
-   $ export SHA256=$(docker images \
-       --no-trunc \
-       --format="{{ .ID }}" \
-       YOUR_PLUGIN_IMAGE_TAG | cut -d: -f2)
-   ```
-   For example:
-   
-   <CodeBlockConfig hideClipboard>
-
-   ```shell-session
-   $ export SHA256=$(docker images \
-       --no-trunc \
-       --format="{{ .ID }}" \
-       hashicorp/vault-plugin-secrets-kv:mycontainer | cut -d: -f2)
-   ```
-   
-   </CodeBlockConfig>
-
-1. Register the plugin with `vault plugin register` and specify your plugin
-   image with the `oci_image` flag:
-   ```shell-session
-   $ vault plugin register \
-       -sha256="${SHA256}" \
-       -oci_image=YOUR_PLUGIN_IMAGE_TAG \
-       NEW_PLUGIN_TYPE NEW_PLUGIN_ID
-   ```
-   For example:
-   
-   <CodeBlockConfig hideClipboard>
-   
-   ```shell-session
-   $ vault plugin register \
-       -sha256="${SHA256}" \
-       -oci_image=hashicorp/vault-plugin-secrets-kv:mycontainer \
-       secret my-kv-container
-   ```
-   
-   </CodeBlockConfig>
-
-1. Enable the new plugin for your Vault instance with `vault secrets enable` and
-   the new plugin ID:
-   ```shell-session
-   $ vault secrets enable NEW_PLUGIN_ID
-   ```
-   For example:
-   
-   <CodeBlockConfig hideClipboard>
-   
-   ```shell-session
-   $ vault secrets enable my-kv-container
-   ```
-        
-   </CodeBlockConfig>
-
-
-<Tip title="Customize container behavior with registration flags">
-
-  You can provide additional information about the image entrypoint, command,
-  and environment with the `-command`, `-args`, and `-env` flags for
-  `vault plugin register`.
-
-</Tip>
-
-## Step 6: Test your plugin
-
-Now that the container is registered with Vault, you should be able to interact
-with it like any other plugin. Try writing then fetching a new secret with your
-new plugin.
-
-
-1. Use `vault write` to store a secret with your containerized plugin:
-   ```shell-session
-   $ vault write NEW_PLUGIN_ID/SECRET_PATH SECRET_KEY=SECRET_VALUE
-   ```
-   For example:
-   
-   <CodeBlockConfig hideClipboard>
-   
-   ```shell-session
-   $ vault write my-kv-container/testing subject=containers
-   Success! Data written to: my-kv-container/testing
-   ```
-    
-   </CodeBlockConfig>
-
-1. Fetch the secret you just wrote:
-   ```shell-session
-   $ vault read NEW_PLUGIN_ID/SECRET_PATH
-   ```
-   For example:
-   
-   <CodeBlockConfig hideClipboard>
-   
-   ```shell-session
-   $ vault read my-kv-container/testing
-   ===== Data =====
-   Key        Value
-   ---        -----
-   subject    containers
-   ```
-   
-   </CodeBlockConfig>
-
-## Use alternative runtimes ((#alt-runtimes))
-
-You can force Vault to use alternative runtimes provided the runtime is
-installed locally.
-
-To use an alternative runtime:
-
-1. Register and name the runtime with `vault plugin runtime register`. For
-   example, to register the default Docker runtime (`runc`) as `docker-rt`:
-   ```shell-session
-   $ vault plugin runtime register  \
-      -oci_runtime=runc             \
-      -type=container docker-rt
-   ```
-
-1. Use the `--runtime` flag during plugin registration to tell Vault what
-   runtime to use:
-   ```shell-session
-   $ vault plugin register  \
-      -runtime=RUNTIME_NAME \
-      -sha256="${SHA256}"   \
-      -oci_image=YOUR_PLUGIN_IMAGE_TAG \
-      NEW_PLUGIN_TYPE NEW_PLUGIN_ID
-   ```
-   For example:
-   
-   <CodeBlockConfig hideClipboard>
-   
-   ```shell-session
-   $ vault plugin register \
-      -runtime=docker-rt   \
-      -sha256="${SHA256}"  \
-      -oci_image=hashicorp/vault-plugin-secrets-kv:mycontainer \
-      secret my-kv-container
-   ```
-
-   </CodeBlockConfig>
-
-## Troubleshooting
-
-### Invalid backend version error
-
-If you run into the following error while registering your plugin:
-
-<CodeBlockConfig hideClipboard>
-
-```plaintext
-invalid backend version error: 2 errors occurred:
-        * error creating container: Error response from daemon: error while looking up the specified runtime path: exec: " /usr/bin/runsc": stat  /usr/bin/runsc: no such file or directory
-        * error creating container: Error response from daemon: error while looking up the specified runtime path: exec: " /usr/bin/runsc": stat  /usr/bin/runsc: no such file or directory
-```
-
-</CodeBlockConfig>
-
-it means that Vault cannot find the executable for `runsc`. Confirm the
-following is true before trying again:
-
-1. You have gVisor installed locally to Vault.
-1. The path to `runsc` is correct in you your Docker configuration.
-1. Vault has permission to run the `runsc` executable.
-
-If you still get errors when registering a plugin, the recommended workaround is
-to use the default Docker runtime (`runc`) as an
-[alternative runtime](#alt-runtimes).
\ No newline at end of file
diff --git a/website/content/docs/plugins/containerized-plugins/index.mdx b/website/content/docs/plugins/containerized-plugins/index.mdx
deleted file mode 100644
index 02a3115d3b0..00000000000
--- a/website/content/docs/plugins/containerized-plugins/index.mdx
+++ /dev/null
@@ -1,112 +0,0 @@
----
-layout: docs
-page_title: Containerized plugins overview
-description: Learn about running external Vault plugins in containers.
----
-
-# Containerized plugins overview
-
-@include 'alerts/beta.mdx'
-
-<Note title="Limited OS support">
-
-  Support for the `container` runtime is currently limited to Linux.
-
-</Note>
-
-Vault has a wide selection of builtin plugins to support integrating with other
-systems. For example, you can use plugins to exchange app identity information
-with an authentication service to receive a Vault token, or manage database
-credentials. You can also register **external** plugins with your Vault instance
-to extend the capabilities of your Vault server.
-
-By default, external plugins run as subprocesses that share the user and
-environment variables of your Vault instance. Administrators managing Vault
-instances on Linux can choose to run external plugins in containers. Running
-plugins in containers increases the isolation between individual plugins and
-between the plugins and Vault.
-
-## System requirements
-
-- **Your Vault instance must be running on Linux**.
-
-- **Your environment must provide Vault local access to the Docker Engine API**.
-  Vault uses the [Docker SDK](https://pkg.go.dev/github.com/docker/docker) to
-  manage containerized plugins.
-
-- **You must have a valid container runtime installed**. We recommend
-  [installing gVisor](https://gvisor.dev/docs/user_guide/install/) for your
-  container runtime as Vault specifies the `runsc` runtime by default.
-
-- **You must have all your plugin container images pulled and available locally**.
-  Vault does not currently support pulling images as part of the plugin
-  registration process.
-
-## Plugin requirements
-
-All plugins have the following basic requirements to be containerized:
-
-- **Your plugin must be built with at least v1.6.0 of the HashiCorp
-  [`go-plugin`](https://github.com/hashicorp/go-plugin) library**.
-
-- **The image entrypoint should run the plugin binary**.
-
-Some configurations have additional requirements for the container image, listed
-in [supported configurations](#supported-configurations).
-
-## Supported configurations
-
-Vault's containerized plugins are compatible with a variety of configurations.
-In particular, it has been tested with the following:
-
-- Default and [rootless](https://docs.docker.com/engine/security/rootless/) Docker.
-- OCI-compatible runtimes `runsc` and `runc`.
-- Plugin container images running as root and non-root users.
-- [Mlock](/vault/docs/configuration#disable_mlock) disabled or enabled.
-
-Not all combinations work and some have additional requirements, listed below.
-If you use a configuration that matches multiple headings, you should combine
-the requirements from each matching heading.
-
-### `runsc` runtime
-
-- You must pass an additional `--host-uds=create` flag to the `runsc` runtime.
-
-### Rootless Docker with `runsc` runtime
-
-- You must pass an additional `--ignore-cgroups` flag to the `runsc` runtime.
-  - Cgroup limits are not currently supported for this configuration.
-
-### Rootless Docker with non-root container user
-
-- You must use a container plugin runtime with
-  [`rootless`](/vault/docs/commands/plugin/runtime/register#rootless) enabled.
-- Your filesystem must have Posix 1e ACL support, available by default in most
-  modern Linux file systems.
-- Only supported for gVisor's `runsc` runtime.
-
-### Rootless Docker with mlock enabled
-
-- Only supported for gVisor's `runsc` runtime.
-
-### Non-root container user with mlock enabled
-
-- You must set the `IPC_LOCK` capability on the plugin binary.
-
-## Container lifecycle and metadata
-
-Like any other external plugin, Vault will automatically manage the lifecycle
-of plugin containers. If they are killed out of band, Vault will restart them
-before servicing any requests that need to be handled by them. Vault will also
-[multiplex](/vault/docs/plugins/plugin-architecture#plugin-multiplexing) multiple
-mounts to be serviced by the same container if the plugin supports multiplexing.
-
-Vault labels each plugin container with a standard set of metadata to help
-identify the owner of the container, including the cluster ID, Vault's own
-process ID, and the plugin's name, type, and version.
-
-## Plugin runtimes
-
-Users who require more control over plugin containers can use the "plugin
-runtime" APIs for finer grained settings. See the CLI documentation for
-[`vault plugin runtime`](/vault/docs/commands/plugin/runtime) for more details.
diff --git a/website/content/docs/plugins/index.mdx b/website/content/docs/plugins/index.mdx
deleted file mode 100644
index 4a0a1072c6b..00000000000
--- a/website/content/docs/plugins/index.mdx
+++ /dev/null
@@ -1,88 +0,0 @@
----
-layout: docs
-page_title: Plugin System
-description: Learn about Vault's plugin system.
----
-
-
-# Plugin system
-
-Vault supports 3 types of plugins; auth methods, secret engines, and database
-plugins. This concept allows both built-in and external plugins to be treated
-like building blocks. Any plugin can exist at multiple different mount paths.
-Different versions of a plugin may be at each location, with each version differing
-from Vault's version.
-
-A plugin is uniquely identified by its type (one of `secret`, `auth`, or
-`database`), name (e.g. `aws`), and version (e.g `v1.0.0`). An empty version
-implies either the built-in plugin or the single unversioned plugin that can
-be registered.
-
-See [Plugin Upgrade Procedure](/vault/docs/upgrading/plugins#plugin-upgrade-procedure)
-for details on how to upgrade a built-in plugin in-place.
-
-## Built-In plugins
-
-Built-in plugins are shipped with Vault, often for commonly used integrations,
-and can be used without any prerequisite steps.
-
-## External plugins
-
-External plugins are not shipped with Vault and require additional operator
-intervention to run.
-
-To run an external plugin, a binary or container image of the plugin is required. Plugin
-binaries can be obtained from [releases.hashicorp.com](https://releases.hashicorp.com/)
-or they can be [built from source](/vault/docs/plugins/plugin-development#building-a-plugin-from-source).
-Containerized plugins are not yet available from a registry and must currently
-be built.
-
-Vault's external plugins are completely separate, standalone applications that
-Vault executes and communicates with over RPC. Each time a Vault secret engine,
-auth method, or database plugin is mounted, a new process or container is spawned. However,
-plugins can be made to implement [plugin multiplexing](/vault/docs/plugins/plugin-architecture#plugin-multiplexing)
-to improve performance. Plugin multiplexing allows plugin instances to be
-reused across all mounts of a given type.
-
--> **NOTE:** See the [Vault Integrations](/vault/integrations) page to find a
-curated collection of official, partner, and community Vault plugins. 
-
-## Plugin versioning
-
-Vault supports managing, running and upgrading plugins using semantic version
-information.
-
-The plugin catalog optionally supports specifying a semantic version when
-registering an external plugin. Multiple versions of a plugin can be registered
-in the catalog simultaneously, and a version can be selected when mounting a
-plugin or tuning an existing mount in-place.
-
-If no version is specified when creating a new mount, the following precedence is used
-for any available plugins whose type and name match:
-
-* The plugin registered with no version
-* The plugin with the most recent semantic version among any registered versions
-* The plugin built into Vault
-
-### Built-In versions
-
-Vault will report a version for built-in plugins to indicate what version of the
-plugin code got built into Vault as a dependency. For example:
-
-```shell-session
-$ vault plugin list secret
-Name                Version
-----                -------
-ad                  v0.14.0+builtin
-alicloud            v0.13.0+builtin
-aws                 v1.12.0+builtin.vault
-# ...
-```
-
-Here, Vault has a dependency on `v0.14.0` of the [hashicorp/vault-plugin-secrets-ad](https://github.com/hashicorp/vault-plugin-secrets-ad)
-repo, and the `vault` metadata identifier for `aws` indicates that plugin's code was
-within the Vault repo. For plugins within the Vault repo, Vault's own major, minor,
-and patch versions are used to form the plugin version.
-
-The `builtin` metadata identifier is reserved and cannot be used when registering
-external plugins.
diff --git a/website/content/docs/plugins/plugin-architecture.mdx b/website/content/docs/plugins/plugin-architecture.mdx
deleted file mode 100644
index 6c02d1808b8..00000000000
--- a/website/content/docs/plugins/plugin-architecture.mdx
+++ /dev/null
@@ -1,190 +0,0 @@
----
-layout: docs
-page_title: External Plugin Architecture
-description: Learn about Vault's plugin architecture.
----
-
-# External plugin architecture
-
-Vault's external plugins are completely separate, standalone applications that Vault
-executes and communicates with over RPC. This means the plugin process does not
-share the same memory space as Vault and therefore can only access the
-interfaces and arguments given to it. This also means a crash in a plugin cannot
-crash the entirety of Vault.
-
-It is possible to enable a custom plugin with a name that's identical to a
-built-in plugin. In such a situation, Vault will always choose the custom plugin
-when enabling it.
-
--> **NOTE:** See the [Vault Integrations](/vault/integrations) page to find a
-curated collection of official, partner, and community Vault plugins.
-
-## External plugin lifecycle
-
-Vault external plugins are long-running processes that remain running once they are
-spawned by Vault, the parent process. Plugin processes can be started by Vault's
-active node and performance standby nodes. Additionally, there are cases where
-plugin processes may be terminated by Vault. These cases include, but are not
-limited to:
-
-- Vault active node step-down
-- Vault barrier seal
-- Vault graceful shutdown
-- Disabling a Secrets Engine or Auth method that uses external plugins
-- Database configured connection deletion
-- Database configured connection update
-- Database configured connection reset request
-- Database root credentials rotation
-- WAL Rollback from a previously failed root credentials rotation operation
-
-The lifecycle of plugin processes are managed automatically by Vault.
-Termination of these processes are typical in certain scenarios, such as the
-ones listed above. Vault will start plugin processes when they are enabled. A
-plugin process may be started or terminated through other internal processes
-within Vault as well. Since Vault manages and tracks the lifecycle of its
-plugins, these processes should not be terminated by anything other than Vault.
-If a plugin process is shutdown out-of-band, the plugin process will be lazily
-loaded when a request that requires the plugin is received by Vault.
-
-### External plugin scaling characteristics
-
-External plugins can leverage [Performance Standbys](/vault/docs/enterprise/performance-standby)
-without any explicit action by a plugin author. The default behavior of Vault
-Enterprise is to attempt to handle all requests, including requests to plugins,
-on performance standbys. If the plugin request makes any attempt to modify
-storage, the request will receive a readonly error, and the request routing
-code will then forward the full original request transparently to the active
-node. In other words, plugins can scale horizontally on Vault Enterprise
-without any effort on the plugin author's part.
-
-## Plugin communication
-
-Vault communicates with external plugins over RPC. To secure this
-communication, Vault creates a mutually authenticated TLS connection with the
-plugin's RPC server. Plugins make use of the AutoMTLS feature of
-[go-plugin](https://www.github.com/hashicorp/go-plugin) which will
-automatically negotiate mutual TLS for transport authentication.
-
-The [`api_addr`](/vault/docs/configuration#api_addr) must be set in order for the
-plugin process to establish communication with the Vault server during mount
-time. If the storage backend has HA enabled and supports automatic host address
-detection (e.g. Consul), Vault will automatically attempt to determine the
-`api_addr` as well.
-
-~> Note: Prior to Vault version 1.9.2, reading the original connection's TLS
-connection state is not supported in plugins.
-
-## Plugin registration
-
-An important consideration of Vault's plugin system is to ensure the plugin
-invoked by Vault is authentic and maintains integrity. There are two components
-that a Vault operator needs to configure before external plugins can be run- the
-plugin directory and the plugin catalog entry.
-
-### Plugin directory
-
-The plugin directory is a configuration option of Vault and can be specified in
-the [configuration file](/vault/docs/configuration).
-This setting specifies a directory in which all plugin binaries must live;
-_this value cannot be a symbolic link_. A plugin
-cannot be added to Vault unless it exists in the plugin directory. There is no
-default for this configuration option, and if it is not set, plugins cannot be
-added to Vault.
-
-@include 'plugin-file-permissions-check.mdx'
-
-### Plugin catalog
-
-The plugin catalog is Vault's list of approved plugins. The catalog is stored in
-Vault's barrier and can only be updated by a Vault user with sudo permissions.
-Upon adding a new plugin, the plugin name, SHA256 sum of the executable, and the
-command that should be used to run the plugin must be provided. The catalog will
-ensure the executable referenced in the command exists in the plugin
-directory. When added to the catalog, the plugin is not automatically executed,
-but becomes visible to backends and can be executed by them. For more
-information on the plugin catalog please see the [Plugin Catalog API
-docs](/vault/api-docs/system/plugins-catalog).
-
-An example of plugin registration in current versions of Vault:
-
-```shell-session
-$ vault plugin register -sha256=<SHA256 Hex value of the plugin binary> \
-    secret \                  # type
-    myplugin-database-plugin
-
-Success! Registered plugin: myplugin-database-plugin
-```
-
-Vault versions prior to v0.10.4 lacked the `vault plugin` operator and the
-registration step for them is:
-
-```shell-session
-$ vault write sys/plugins/catalog/database/myplugin-database-plugin \
-     sha256=<SHA256 Hex value of the plugin binary> \
-     command="myplugin"
-
-Success! Data written to: sys/plugins/catalog/database/myplugin-database-plugin
-```
-
-### Plugin execution
-
-When a backend wants to run a plugin, it first looks up the plugin, by name, in
-the catalog. It then checks the executable's SHA256 sum against the one
-configured in the plugin catalog. Finally Vault runs the command configured in
-the catalog, sending along the JWT formatted response wrapping token and mlock
-settings. Like Vault, plugins support [the use of mlock when available](/vault/docs/configuration#disable_mlock).
-
-~> Note: If Vault is configured with `mlock` enabled, then the Vault executable
-and each plugin executable in your [plugins directory](/vault/docs/plugins/plugin-architecture#plugin-directory)
-must be given the ability to use the `mlock` syscall.
-
-### Plugin upgrades
-
-External plugins may be updated by registering and reloading them. More details
-on the upgrade procedure can be found in
-[Upgrading Vault Plugins](/vault/docs/upgrading/plugins).
-
-## Plugin multiplexing
-
-To avoid spawning multiple plugin processes for mounts of the same type,
-plugins can implement plugin multiplexing. This allows a single
-plugin process to be used for multiple mounts of a given type. This single
-process will be multiplexed across all Vault namespaces for mounts of this
-type. Multiplexing a plugin does not affect the current behavior of existing
-plugins.
-
-To enable multiplexing, the plugin must be compiled with the `ServeMultiplex`
-function call from Vault's respective `plugin` or `dbplugin` SDK packages. At
-this time, there is no opt-out capability for plugins that implement
-multiplexing. To use a non-multiplexed plugin, run an older version of the
-plugin, i.e., the plugin calls the `Serve` function.
-
-More resources on implementing plugin multiplexing:
-* [Database secrets engines](/vault/docs/secrets/databases/custom#serving-a-plugin-with-multiplexing)
-* [Secrets engines and auth methods](/vault/docs/plugins/plugin-development)
-
-## Troubleshooting
-
-### Unrecognized remote plugin message
-
-If the following error is encountered when enabling a plugin secret engine or
-auth method:
-
-<CodeBlockConfig hideClipboard>
-
-```sh
-Unrecognized remote plugin message:
-
-This usually means that the plugin is either invalid or simply
-needs to be recompiled to support the latest protocol.
-```
-
-</CodeBlockConfig>
-
-Verify whether the Vault process has `mlock` enabled, and if so, run the
-following command against the plugin binary:
-
-```shell-session
-$ sudo setcap cap_ipc_lock=+ep <plugin-binary>
-```
-
diff --git a/website/content/docs/plugins/plugin-development.mdx b/website/content/docs/plugins/plugin-development.mdx
deleted file mode 100644
index 3947f886396..00000000000
--- a/website/content/docs/plugins/plugin-development.mdx
+++ /dev/null
@@ -1,158 +0,0 @@
----
-layout: docs
-page_title: Plugin Development
-description: Learn about Vault plugin development.
----
-
-# Plugin development
-
-~> Advanced topic! Plugin development is a highly advanced topic in Vault, and
-is not required knowledge for day-to-day usage. If you don't plan on writing any
-plugins, we recommend not reading this section of the documentation.
-
-Because Vault communicates to plugins over a RPC interface, you can build and
-distribute a plugin for Vault without having to rebuild Vault itself. This makes
-it easy for you to build a Vault plugin for your organization's internal use,
-for a proprietary API that you don't want to open source, or to prototype
-something before contributing it back to the main project.
-
-In theory, because the plugin interface is HTTP, you could even develop a plugin
-using a completely different programming language! (Disclaimer, you would also
-have to re-implement the plugin API which is not a trivial amount of work.)
-
-Developing a plugin is simple. The only knowledge necessary to write
-a plugin is basic command-line skills and basic knowledge of the
-[Go programming language](http://golang.org).
-
-Your plugin implementation needs to satisfy the interface for the plugin
-type you want to build. You can find these definitions in the docs for the
-backend running the plugin.
-
-~> Note: Plugins should be prepared to handle multiple concurrent requests
-from Vault.
-
-## Serving a plugin
-
-### Serving a plugin with multiplexing
-
-~> Plugin multiplexing requires `github.com/hashicorp/vault/sdk v0.5.4` or above.
-
-The following code exhibits an example main package for a Vault plugin using
-the Vault SDK for a secrets engine or auth method:
-
-```go
-package main
-
-import (
-	"os"
-
-	myPlugin "your/plugin/import/path"
-	"github.com/hashicorp/vault/api"
-	"github.com/hashicorp/vault/sdk/plugin"
-)
-
-func main() {
-	apiClientMeta := &api.PluginAPIClientMeta{}
-	flags := apiClientMeta.FlagSet()
-	flags.Parse(os.Args[1:])
-
-	tlsConfig := apiClientMeta.GetTLSConfig()
-	tlsProviderFunc := api.VaultPluginTLSProvider(tlsConfig)
-
-	err := plugin.ServeMultiplex(&plugin.ServeOpts{
-		BackendFactoryFunc: myPlugin.Factory,
-		TLSProviderFunc:    tlsProviderFunc,
-	})
-	if err != nil {
-		logger := hclog.New(&hclog.LoggerOptions{})
-
-		logger.Error("plugin shutting down", "error", err)
-		os.Exit(1)
-	}
-}
-```
-
-And that's basically it! You would just need to change `myPlugin` to your actual
-plugin.
-
-### Plugin backwards compatibility with Vault
-
-Let's take a closer look at a snippet from the above main package.
-
-```go
-	err := plugin.ServeMultiplex(&plugin.ServeOpts{
-		BackendFactoryFunc: myPlugin.Factory,
-		TLSProviderFunc:    tlsProviderFunc,
-	})
-```
-
-The call to `plugin.ServeMultiplex` ensures that the plugin will use
-Vault's [plugin
-multiplexing](/vault/docs/plugins/plugin-architecture#plugin-multiplexing) feature.
-However, this plugin will not be multiplexed if it is run by a version of Vault
-that does not support multiplexing. Vault will simply fall back to a plugin
-version that it can run. Additionally, we set the `TLSProviderFunc` to ensure
-that our plugin is backwards compatible with versions of Vault that do not
-support automatic mutual TLS for secure [plugin
-communication](/vault/docs/plugins/plugin-architecture#plugin-communication). If you
-are certain your plugin does not need backwards compatibility, this field can
-be omitted.
-
-[api_addr]: /vault/docs/configuration#api_addr
-
-## Leveraging plugin versioning
-
-@include 'plugin-versioning.mdx'
-
-Auth and secrets plugins based on `framework.Backend` from the SDK should set the
-[`RunningVersion`](https://github.com/hashicorp/vault/blob/sdk/v0.6.0/sdk/framework/backend.go#L95-L96)
-variable, and the framework will implement the version interface.
-
-Database plugins have a smaller API than `framework.Backend` exposes, and should
-instead implement the
-[`PluginVersioner`](https://github.com/hashicorp/vault/blob/sdk/v0.6.0/sdk/logical/logical.go#L150-L154)
-interface directly.
-
-## Plugin logging
-
-Auth and secrets plugins based on `framework.Backend` from the SDK can take
-advantage of the SDK's [default logger](https://github.com/hashicorp/vault/blob/fe55cbbf05586ec4c0cd9bdf865ec6f741a8933c/sdk/framework/backend.go#L437).
-No additional setup is required. The logger can be used like the following:
-
-```go
-func (b *backend) example() {
-    b.Logger().Trace("Trace level log")
-    b.Logger().Debug("Debug level log")
-    b.Logger().Info("Info level log")
-    b.Logger().Warn("Warn level log")
-    b.Logger().Error("Error level log")
-}
-```
-
-See the source code of [vault-auth-plugin-example](https://github.com/hashicorp/vault-auth-plugin-example)
-for a more complete example of a plugin using logging.
-
-## Building a plugin from source
-
-To build a plugin from source, first navigate to the location holding the
-desired plugin version. Next, run `go build` to obtain a new binary for the
-plugin. Finally,
-[register](/vault/docs/plugins/plugin-architecture#plugin-registration) the
-plugin and enable it.
-
-## Plugin development - resources
-
-For more information on how to register and enable your plugin, refer to the
-[Building Plugin Backends](/vault/tutorials/app-integration/plugin-backends)
-tutorial.
-
-Other HashiCorp plugin development resources:
-
-* [vault-auth-plugin-example](https://github.com/hashicorp/vault-auth-plugin-example)
-* [Custom Secrets Engines](/vault/tutorials/custom-secrets-engine)
-
-### Plugin development - resources - community
-
-See the [Vault Integrations](/vault/integrations) page to find Community
-plugin examples/guides developed by community members. HashiCorp does not
-validate these for correctness.
diff --git a/website/content/docs/plugins/plugin-management.mdx b/website/content/docs/plugins/plugin-management.mdx
deleted file mode 100644
index 0738cff63de..00000000000
--- a/website/content/docs/plugins/plugin-management.mdx
+++ /dev/null
@@ -1,131 +0,0 @@
----
-layout: docs
-page_title: Plugin Management
-description: >-
-  External Plugins are mountable backends that are implemented using Vault's
-  plugin system.
----
-
-# Plugin management
-
-External plugins are the components in Vault that can be implemented separately
-from Vault's built-in plugins. These plugins can be either authentication or
-secrets engines.
-
-The [`api_addr`][api_addr] must be set in order for the plugin process to
-establish communication with the Vault server during mount time. If the storage
-backend has HA enabled and supports automatic host address detection (e.g.
-Consul), Vault will automatically attempt to determine the `api_addr` as well.
-
-Detailed information regarding the plugin system can be found in the
-[internals documentation](/vault/docs/plugins).
-
-## Registering external plugins
-
-Before an external plugin can be mounted, it needs to be
-[registered](/vault/docs/plugins/plugin-architecture#plugin-registration) in the
-plugin catalog to ensure the plugin invoked by Vault is authentic and maintains
-integrity:
-
-```shell-session
-$ vault plugin register -sha256=<SHA256 Hex value of the plugin binary> \
-    secret \                  # type
-    passthrough-plugin
-
-Success! Registered plugin: passthrough-plugin
-```
-
-## Enabling/Disabling external plugins
-
-After the plugin is registered, it can be mounted by specifying the registered
-plugin name:
-
-```shell-session
-$ vault secrets enable -path=my-secrets passthrough-plugin
-Success! Enabled the passthrough-plugin secrets engine at: my-secrets/
-```
-
-Listing secrets engines will display secrets engines that are mounted as
-plugins:
-
-```shell-session
-$ vault secrets list
-Path         Type       Accessor            Plugin              Default TTL  Max TTL  Force No Cache  Replication Behavior  Description
-my-secrets/  plugin     plugin_deb84140     passthrough-plugin  system       system   false           replicated
-```
-
-Disabling an external plugins is identical to disabling a built-in plugin:
-
-```shell-session
-$ vault secrets disable my-secrets
-```
-
-## Upgrading plugins
-
-Upgrade instructions can be found in the [Upgrading Plugins - Guides][upgrading_plugins]
-page.
-
-[api_addr]: /vault/docs/configuration#api_addr
-[upgrading_plugins]: /vault/docs/upgrading/plugins
-
-## Plugin environment variables
-
-An advantage for external plugins over builtin plugins is they can specify
-additional environment variables because they are run in their own process.
-
--> Vault 1.16.0 changed the precedence given to plugin-specific environment
-variables so they take priority over Vault's environment. See full details in
-the [upgrade notes](/vault/docs/upgrading/upgrade-to-1.16.x).
-
-Use the `-env` flag once per environment variable that a plugin should be
-started with:
-
-```shell-session
-$ vault plugin register -sha256=<SHA256 Hex value of the plugin binary> \
-    -env REGION=eu \
-    -env TOKEN_FILE=/var/run/token \
-    secret \                  # type
-    passthrough-plugin
-
-Success! Registered plugin: passthrough-plugin
-```
-
-### Plugin-specific HTTP proxy settings
-
-Many tools and libraries automatically consume `HTTP_PROXY`, `HTTPS_PROXY`, and
-`NO_PROXY` environment variables to configure HTTP proxy settings, including the
-Go standard library's default HTTP client. You can use these environment
-variables to configure different network proxies for different plugins:
-
--> You must be using an external plugin to take advantage of custom environment
-variables. If you are using a builtin plugin, you can still download and register
-an external version of it in order to use this workflow. Check the
-[releases](https://releases.hashicorp.com/) page for the latest prebuilt plugin
-binaries.
-
-```shell-session
-$ vault plugin register -sha256=<SHA256 Hex value of the plugin binary> \
-    -env HTTP_PROXY=eu.example.com \
-    auth \
-    jwt-eu
-
-Success! Registered plugin: jwt-eu
-
-$ vault plugin register -sha256=<SHA256 Hex value of the plugin binary> \
-    -env HTTP_PROXY=us.example.com \
-    auth \
-    jwt-us
-
-Success! Registered plugin: jwt-us
-```
-
-You can then enable each plugin on its own path, and configure clients that
-should be associated with one or the other appropriately:
-
-```shell-session
-$ vault auth enable jwt-eu
-Success! Enabled the jwt-eu auth method at: auth/jwt-eu/
-
-$ vault auth enable jwt-us
-Success! Enabled the jwt-us auth method at: auth/jwt-us/
-```
diff --git a/website/content/docs/release-notes/1.10.0.mdx b/website/content/docs/release-notes/1.10.0.mdx
deleted file mode 100644
index 3f3b3a2ce74..00000000000
--- a/website/content/docs/release-notes/1.10.0.mdx
+++ /dev/null
@@ -1,170 +0,0 @@
----
-layout: docs
-page_title: 1.10.0
-description: |-
-  This page contains release notes for Vault 1.10.0
----
-
-# Vault 1.10.0 release notes
-
-**Software Release date:** Mar 23, 2022
-
-**Summary:** Vault version 1.10.0 offers features and enhancements that improve the user experience while closing the loop on key issues previously encountered by our customers. We are providing a summary of these improvements in these release notes.
-
-We encourage you to upgrade to the latest release to take advantage of the new benefits that we are providing. Additionally, with this latest release, we offer solutions to critical feature gaps that have been identified previously. For further information on product improvements, including a comprehensive list of bug fixes, please refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md) within the Vault 1.10.0 release.
-
-Some of these enhancements and changes in this release include:
-
-- Ability to view client counts per auth and changes to clients over months, therefore, providing more granular visibility into clients.
-- Extended the `sys/remount` API endpoint to support moving secrets engines and auth method mounts from one location to another, within a namespace or across namespaces.
-- Improved security posture that includes MFA on login for Vault Community Edition customers.
-- Ability to implicitely achieve consistency via tokens.
-- Support of PKCE on Vault’s OIDC auth method with Telemetry support for the Vault Agent.
-- Improvement of key areas and parity to support using Terraform Provider with Vault.
-
-## New features
-
-This section describes the new features introduced as part of Vault
-
-### Multi-Factor authentication (MFA) for Vault Community Edition
-
-Vault has had support for the [Step-up Enterprise MFA](/vault/docs/enterprise/mfa) as part of its Enterprise edition. The Step-up Enterprise MFA allows having an MFA on login, or for step-up access to sensitive resources in Vault.
-
-With Vault 1.10.0, MFA as part of [login](/vault/docs/auth/login-mfa) is now supported for Vault Community Edition. This demonstrates HashiCorp’s thought leadership in security and its continued endeavor to enable all Vault users to employ strong security policies with Vault.
-
-~> **Note:** The Legacy MFA in Vault Community Edition is a [deprecated](/vault/docs/deprecation) feature and will be removed in Vault 1.11.
-
-Refer to the [Login MFA FAQ](/vault/docs/auth/login-mfa/faq) to understand the various MFA workflows that are supported in Vault 1.10.0.
-
-### Vault OIDC provider with PKCE support
-
-Vault’s support to act as an OIDC provider is now generally available. Furthermore, Vault’s OIDC provider functionality can now support PKCE for authorization code flow as well. Thanks to all the excellent community feedback received, we have simplified the user experience around configuration of OIDC provider functionality.
-
-### Caching support for Vault lambda extension
-
-With 0.6.0, Vault Lambda Extension supports [caching](https://github.com/hashicorp/vault-lambda-extension#caching) in the local proxy server to avoid proxying every request to enable setting expiry time and invalidate cache, as needed.
-
-### Terraform provider for Vault
-
-We have introduced three new resources to enable configuration of the [KMIP secrets engine](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/kmip_secret_backend) using the Terraform Provider for Vault. In addition, frequent releases on the Terraform Provider for Vault have been incorporating the ability to configure newer resources and data sources. Please read the [documentation](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) for more details.
-
-### KV secrets engine v2 patch operations
-
-We now support an additional method for managing [KV v2 secrets](/vault/api-docs/secret/kv/kv-v2) to maintain least privilege security in certain types of automated environments. This feature creates a new PATCH capability that enables partial updates to KV v2 secrets without requiring the READ privilege to the entire endpoint for an entity.
-
-### DB2 dynamic secrets support
-
-Vault operators can leverage the openldap secrets engine to manage credentials for IBM DB2 and the LDAP security plugin for Db2. This allows Db2 to offload authentication and authorization to the LDAP security plugin and allows Vault to manage static credentials or even generate dynamic users. For more details, refer to the For more details, refer to the [IBM Db2 Credentials Management](/vault/tutorials/secrets-management/ibm-db2-openldap) tutorial.
-
-### Temporal transit key rotation
-
-Proper key management includes occasionally rotating encryption keys to reduce the risks of a nonce reuse and opportunities for keys to be compromised. Previously, there was no automated way to rotate keys that is native to Vault. Now, we have provided a new configuration element on transit keys and tokenization transform configurations where a time interval triggers the keys to automatically rotate after the interval has lapsed.
-
-### PKI HSM forwarding
-
-To address security and compliance needs, customers may require that keys be either created or stored within Hardware Security Models (HSMs). Vault 1.10.0 introduces an accommodation for this requirement with regards to the PKI Secrets Engine. We now support offloading selected PKI operations to HSMs, in particular allowing customers to both generate new PKI key pairs and sign/verify some certificate workflows. All of these operations are conducted in a way that never allows the private key material to leave the secure confines of the HSM itself.
-
-### AWS and AKV KMS forwarding
-
-The work done above to support HSM-backed PKI operations inspired us to consider what other key possession paradigms we could support. This led us to extend the implementation to support Cloud Key Management Systems in addition to HSMs. In Vault 1.10.0, users may generate new PKI pairs and perform sign/verify certificate workflows, all with those keys never leaving the cloud KMS itself. Vault 1.10.0 provides support for AWS Key Management Service and Azure Key Vault Key Management Service.
-
-### Server side consistent tokens
-
-Vault’s [eventual consistency](/vault/docs/enterprise/consistency) model precludes read-after-write guarantees when clients interact with performance standbys or performance replication clusters. The [Client Controlled Consistency](/vault/docs/enterprise/consistency#vault-1-7-mitigations) mitigations supported with Vault 1.7 provide ways to achieve consistency through client modifications or by using the agent for proxied requests, which is not possible in all cases. The Server Side Consistent Tokens feature provides an implicit way to achieve consistency by embedding the minimum Write-Ahead-Log state information in the Service tokens returned from logins or token-create requests. This feature introduces changes in the token format and the new tokesn will be the default tokens starting in Vault 1.10.0. Vault 1.10.0 is backwards compatible with old tokens.
-
-See [Replication](/vault/docs/configuration/replication), [Vault Eventual Consistency](/vault/docs/enterprise/consistency), [Upgrade to 1.10.0](/vault/docs/upgrading/upgrade-to-1.10.x) and [Server Side Consistent Token FAQ](/vault/docs/faq/ssct) to understand the various consistency options available with Vault 1.10.0 and the considerations to be aware of prior to selecting an option for your use case.
-
-## Vault agent features
-
-### Support for telemetry
-
-Starting with Vault 1.10.0, the Vault Agent supports a new metrics endpoint and [Telemetry](/vault/docs/agent#telemetry-stanza) metrics around run time, authentication success, authentication failures, cache hits, cache misses, proxy succes, and proxy client errors. This Vault Agent Telemetry should greatly help with the retrieval of key operational insights for Vault Agent deployments.
-
-### User-assigned managed identities for auto auth in Azure
-
-With this [enhancement](/vault/docs/agent/autoauth/methods/azure), users can specify user-assigned managed identities via the `object_id` and `client_id` when configuring Vault agent auto-auth for Azure. This enables users that have more than one user-assigned managed identity associated with their VM to specify which one they'd like to use when authenticating via the Vault's Azure auth method. Note that providing these parameters is an "exclusive or" operation.
-
-### Quit API endpoint with config
-
-Previously, for instances where the Agent is a sidecar in a Kubernetes job and the job hangs, you must either use `shareProcessNamespace: true` for the container so that the process kill signals can be sent, or avoid the sidecar container entirely and solely rely on an init container. With this [enhancement](/vault/docs/agent#quit), we have added support for a Quit API endpoint to automatically shut down the Vault Agent, therefore eliminating the need to perform the workarounds.
-
-## Other features and enhancements
-
-This section describes other features and enhancements introduced as part of the Vault 1.10.0 release.
-
-### Client count improvements
-
-We have introduced auth mount-based attribution of clients to help better understand where clients are being used within a cluster. This is available via UI and API. This is an enhancement on top of the namespace attribution capability we introduced in Vault 1.9.
-
-We have also introduced the ability to view changes to clients month over month via the client count API, and made other UI enhancements. Refer to [What is a Client?](/vault/docs/concepts/client-count) and [Client Count FAQ](/vault/docs/concepts/client-count/faq) for more details.
-
-### Mount migration
-
-We have made improvements to the `sys/remount` API endpoint to simplify the complexities of moving data, such as secret engine and authentication method configuration from one mount to another, within a namespace or across namespaces. This can help with restructuring namespaces and mounts for various reasons, including migrating mounts from root to other namespaces when transitioning to using namespaces for the first time. For step-by-step instructions, refer to the [Mount Move](/vault/tutorials/enterprise/mount-move) tutorial.
-
-### Scaling external database plugins
-
-Database plugins can now implement [plugin multiplexing](/vault/docs/plugins/plugin-architecture#plugin-multiplexing) which allows a single plugin process to be used for multiple database connections. Database plugin multiplexing will be enabled on the Oracle Database plugin starting in v0.6.0. We will extend this functionality to additional database plugins in subsequent releases.
-
-Any external database plugins that want to adopt multiplexing support will have to update their main.go call from [dbplugin.Serve()](https://github.com/hashicorp/vault/blob/sdk/v0.4.1/sdk/database/dbplugin/v5/plugin_server.go#L13) to [dbplugin.ServeMultiplex()](https://github.com/hashicorp/vault/blob/sdk/v0.4.1/sdk/database/dbplugin/v5/plugin_server.go#L42). Multiplexable database plugins are compatible with older versions of Vault down to Vault 1.6. Refer to this [Oracle Database PR](https://github.com/hashicorp/vault-plugin-database-oracle/pull/74) as an example of the upgrade process.
-
-### Consul secrets engine enhancements
-
-Consul has supported [namespace](/consul/docs/enterprise/namespaces), [admin partitions](/consul/docs/enterprise/admin-partitions) and [ACL roles](/consul/commands/acl/role) for some time now. In this release we have added enhancements to the Consul Secrets engine to support namespace awareness and add admin partition and role support for Consul ACL tokens. This significantly simplifies the integrations for customers who want to achieve a zero trust security posture with both Vault and Consul.
-
-### Using sessionStorage instead of localStorage for the Vault UI
-
-Prior to Vault 1.10.0, the Vault UI used localStorage to store authentication information. The data in localStorage was persisted in browsers and removed only on demand. Now, we have switched the Vault UI to use sessionStorage instead, which ensures that the authentication information is stored in the current browser tab alone, thereby improving security.
-
-### Advanced I/O handling for transform FPE
-
-The Transform Secrets Engine allows users to securely encrypt data while providing control over the output format. In Vault 1.9, we introduced [additional format fields](/vault/docs/release-notes/1.9.0#advanced-i-o-handling-for-tranform-fpe-adp-transform) on the templates used for this workflow. In Vault 1.10.0, we have now added those two new fields, `encode_format` and `decode_format`, to the Create Template page on the UI under Advanced Templating.
-
-## Breaking changes
-
-The following section details breaking changes introduced in Vault 1.10.0.
-
-### LDAP auth method entity alias mapping
-
-In Vault 1.9, we added support to provide custom user filters through the [userfilter](/vault/api-docs/auth/ldap#userfilter) parameter. This support changed the way that entity alias was mapped to an entity. Prior to Vault 1.9, alias names were always based on the [login username](/vault/api-docs/auth/ldap#username-3) (which in turn is based on the value of the [userattr](/vault/api-docs/auth/ldap#userattr)). In Vault 1.9, alias names no longer mapped to the login username. Instead, the mapping depends on other config values as well, such as [updomain](/vault/api-docs/auth/ldap#upndomain), [binddn](/vault/api-docs/auth/ldap#binddn), [discoverydn](/vault/api-docs/auth/ldap#discoverdn), and [userattr](/vault/api-docs/auth/ldap#userattr).
-
-With Vault 1.10.0, we re-introduced the option to force the alias name to map to the login username with the optional parameter username_as_alias. Users that have the LDAP auth method enabled prior to Vault 1.9 may want to consider setting this to true to revert back to the old behavior. Otherwise, depending on the other aforementioned config values, logins may generate a new and different entity for an existing user with a previous entity associated in Vault. This in turn affects client counts since there may be more than one entity tied to this user. The username_as_alias flag was also made available in subsequent Vault 1.8.x and Vault 1.9.x releases to allow for this to be set prior to a Vault 1.10.0 upgrade.
-
-## Known issues
-
-### Single Vault follower restart causes election even with established quorum
-
-We now support Server Side Consistent Tokens (See [Replication](/vault/docs/configuration/replication), [Vault Eventual Consistency](/vault/docs/enterprise/consistency), and [Upgrade to 1.10.0](/vault/docs/upgrading/upgrade-to-1.10.x).), which introduces a new token format that can only be used on nodes of 1.10 or higher version. This new format is enabled by default upon upgrading to the new version. Old format tokens can be read by Vault 1.10.0, but the new format Vault 1.10 tokens cannot be read by older Vault versions.
-
-For more details, see the [Server Side Consistent Tokens FAQ](/vault/docs/faq/ssct).
-
-Since service tokens are always created on the leader, as long as the leader is not upgraded before performance standbys, service tokens will be of the old format and still be usable during the upgrade process. However, the usual upgrade process we recommend can't be relied upon to always upgrade the leader last. Due to this known [issue](https://github.com/hashicorp/vault/issues/14153), a Vault cluster using Integrated Storage may result in a leader not being upgraded last, and this can trigger a re-election. This re-election can cause the upgraded node to become the leader, resulting in the newly created tokens on the leader to be unusable on nodes that have not yet been upgraded. Note that this issue does not impact Vault Community Edition users.
-
-We will have a fix for this issue in Vault 1.10.1. Until this issue is fixed, you may be at risk of having performance standbys unable to service requests until all nodes are upgraded. We recommended that you plan for a maintenance window to upgrade.
-
-### Limited policy shows unhelpful message in UI after mounting a secret engine
-
-When a user has a policy that allows creating a secret engine but not reading it, after successful creation, the user sees a message `n is undefined` instead of a permissions error. We will have a fix for this issue in an upcoming minor release.
-
-### Adding/Modifying Duo MFA method for enterprise MFA triggers a panic error
-
-When adding or modifying a Duo MFA method for step-up Enterprise MFA using the `sys/mfa/method/duo` endpoint, a panic gets triggered due to a missing schema field. We will have a fix for this in Vault 1.10.1. Until this issue is fixed, avoid making any changes to your Duo configuration if you are upgrading Vault to v1.10.0.
-
-### Sign in to UI using OIDC auth method results in an error
-
-Signing in to the Vault UI using an OIDC auth mount listed in the "tabs" of the form will result
-in the following error: "Authentication failed: role with oidc role_type is not allowed".
-The auth mounts listed in the "tabs" of the form are those that have [listing_visibility](/vault/api-docs/system/auth#listing_visibility-1)
-set to `unauth`.
-
-There is a workaround for this error that will allow you to sign in to Vault using the OIDC
-auth method. Select the "Other" tab instead of selecting the specific OIDC auth mount tab.
-From there, select "OIDC" from the "Method" select box and proceed to sign in to Vault.
-
-### Error initializing raft storage type with windows
-
-When trying to start Vault server 1.10.0 on Windows, and there is less than 100GB of free disk space, there is an initialization error with raft DB related to insufficient space on the disk. See this [issue](https://github.com/hashicorp/vault/issues/14895) for details.  Windows users should wait till 1.10.1 to upgrade.
-
-## Feature deprecations and EOL
-
-Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page for up-to-date information on feature deprecations and plans. An [Feature Deprecation FAQ](/vault/docs/deprecation/faq) page is also available to address questions concerning decisions made about Vault feature deprecations.
diff --git a/website/content/docs/release-notes/1.11.0.mdx b/website/content/docs/release-notes/1.11.0.mdx
deleted file mode 100644
index 07dafe59e0f..00000000000
--- a/website/content/docs/release-notes/1.11.0.mdx
+++ /dev/null
@@ -1,113 +0,0 @@
----
-layout: docs
-page_title: 1.11.0
-description: |-
-  This page contains release notes for Vault 1.11.0
----
-
-# Vault 1.11.0 release notes
-
-**Software Release date:** June 21, 2022
-
-**Summary:** Vault Release 1.11.0 offers features and enhancements that improve the user experience while closing the loop on key issues previously encountered by our customers. We are providing a summary of these improvements in these release notes.
-
-We encourage you to upgrade to the latest release to take advantage of the new benefits that we are providing. With this latest release, we offer solutions to critical feature gaps that have been identified previously. For further information on product improvements, including a comprehensive list of bug fixes, please refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md) within the Vault  release.
-
-
-Some of these enhancements and changes in this release include:
-
-- Vault Consul secrets engine provides a templating policy to allow node and service identities to be set on the Consul token creation
-- Snowflake secrets engine added a key/pair-based authentication
-- Vault adds a Kubernetes secrets engine to allow creating dynamic k8s service accounts
-- ADP-Transform extends its functionality by adding a convergent tokenization mode and a tokenization lookup
-- ADP-KM adds four new operations
-- Client count tooling improvements to help understand the attribution of clients better
-- Integration storage autopilot improvements include auto upgrade and redundancy zones
-- Plugin Multiplexing support is extended to secret and auth plugins, allowing them to be managed more efficiently with a single process
-
-
-## New features
-
-This section describes the new features introduced as part of Vault 1.11.0.
-
-### Configure GCP auth to target non-public good API addresses
-
-The GCP auth method only allows for public API endpoints to be configured for authentication purposes. Workloads running in GCP that do not have external internet access need the ability to authenticate using [Private Google Access](https://cloud.google.com/vpc/docs/private-google-access#pga). In Vault 1.11.0, we allow for customization of certain service endpoints. For more information, refer to the [GCP auth method](/vault/api-docs/auth/gcp#custom_endpoint) documentation.
-
-
-### Support for key/pair based authentication for snowflake
-
-In Vault 1.11.0, the Snowflake Database Engine supports an additional credential type that can be generated. For users not wanting to rely on the standard user/pass authentication to Snowflake, Vault can now dynamically generate RSA key pairs that allow users to authenticate into Snowflake. For more information, refer to the [Snowflake Database Secrets Engine](/vault/docs/secrets/databases/snowflake) and [Database Secrets Engine (API)](/vault/api-docs/secret/databases) documentation.
-
-### Dynamic kubernetes service account secrets
-
-Kubernetes service accounts must be manually generated and passed to a Kubernetes configuration file or the command line using a CLI tool such as kubectl to interact with Kubernetes clusters. With this method, service account credentials, which contain static secrets, can be exposed and would require a periodic manual rotation. To address this issue, we now support generating short-lived dynamic service accounts and associate role bindings to specific Kubernetes namespaces. For more information, refer to the [Kubernetes Auth Method](/vault/docs/auth/kubernetes) and [Kubernetes Auth Method (API)](/vault/api-docs/auth/kubernetes) documentation.
-
-### New KV secrets engine (v2) utilities
-
-The KV version 2 secrets engine now includes a set of utilities and enhancements for easier retrieval of key-value secrets and metadata. This includes:
-
-* New optional Vault CLI mount flag (`vault kv get -mount=secret foo`).
-* New flag to output a sample policy in HCL (`-output-policy`) for any Vault CLI command.
-* New KV convenience/helper methods (GET and PUT) added to the Go client library.
-
-For more details, refer to the [Version Key Value Secrets Engine](/vault/tutorials/secrets-management/versioned-kv) tutorial.
-
-### Support for node identity and service identity for Vault consul secrets engine
-
-Within the Consul secrets engine, practitioners writing a Vault role can specify node-identity or service-identity. You can also specify multiples of each identity on a Vault role. For more information, refer to the [Consul Secrets Engine](/vault/docs/secrets/consul) and [Consul Secrets Engine (API)](/vault/api-docs/secret/consul) documentation.
-
-### Autopilot (Vault enterprise)
-
-Vault release 1.7 introduced the Autopilot feature to Integrated Storage. In this release, new Autopilot features are added to Vault Enterprise to perform seamless automatic upgrades and support redundancy zones for improved cluster resiliency. Refer to the [autopilot endpoint](/vault/api-docs/system/storage/raftautopilot#sys-storage-raft-autopilot), [operator raft](/vault/docs/commands/operator/raft), [Autopilot](/vault/docs/concepts/integrated-storage/autopilot),  [Automated Upgrades](/vault/docs/enterprise/automated-upgrades), and [Redundancy Zones](/vault/docs/enterprise/redundancy-zones) documentation for more information.
-
-## Other features and enhancements
-
-This section describes other features and enhancements introduced as part of the Vault 1.11.0 release.
-
-### Import externally-generated keys into transit secrets engine
-
-Historically, Vault has only allowed the Transit secrets engine to utilize keys that were created by Vault itself. In this release, we have introduced an import feature for the Transit secrets engine that enables individuals to bring externally-generated encryption keys into a Transit keyring. These keys can then be used identically to internally-generated Transit keys.
-
-### Improved CA rotation
-
-PKI secrets engine users have sought a way to rotate root or intermediate CAs without causing service interruptions to any entities referencing them. Vault can now create the newly rotated PKI key pairs for servicing new certificates at the same path as the pre-existing keypair. This allows operators to gradually transition entities over to the new root certificate while the old is still active.
-
-### Client count tooling improvements
-
-We have made the following improvements to the Client Count tooling:
-
-* Provide the ability to export the unique clients that contribute to the client count aggregate for the selected billing period via a new [activity export API endpoint](/vault/api-docs/system/internal-counters#activity-export). This feature is available in tech preview mode.
-* Provide the ability to view changes to client counts month over month in the UI.
-
-### MFA enhancements
-
-Vault 1.10 introduced [Login MFA](/vault/docs/auth/login-mfa) support for Vault Community Edition. In this release, we included additional enhancements to the Login MFA feature by introducing the ability to configure Login MFA via the UI and providing an enhanced TOTP configuration experience via the QR code scan.
-
-### Vault agent: support for using an existing valid certificate upon re-authentication
-
-Enhancements have been made to the Vault Agent to support the parsing of a certificate that's been fetched. A new certificate will only be fetched upon a re-authentication if the certificate's lifetime has expired. This enhancement drastically reduces the resource overhead that Vault Agent users often experience due to over-fetching certificates.
-
-### Namespace enhancements for Vault terraform
-
-With Terraform Vault provider v3.7.0, we have made enhancements where it’s now possible to specify the namespace directly within the resource or data source. All resource or data source-specific namespaces are relative to their provider’s configured namespace. This enhancement encourages a better workflow for namespaces, reduces execution time when handling failures of a Terraform plan, and eases the burden on system resources such as memory, CPU, etc.
-
-### ADP-Tranform enhancements
-
-Two new enhancements were made to the Transform secrets engine. The first is Convergent Tokenization, which allows tokenization transformations to be configured as _convergent_. When enabled, this guarantees that tokenizing a given plaintext and expiration more than once always results in the same token value being produced. Please refer to the [Convergent Tokenization](/vault/docs/secrets/transform/tokenization#convergence) document for more information. Token Lookup allows you to look up the value of a token given its plaintext. While this is not typically encouraged from a security perspective, it may be necessary for particular circumstances that require this operation. Note that token lookup is only supported when convergence is enabled. For more information on the endpoint, refer to the [Lookup Token](/vault/api-docs/secret/transform#lookup-token) documentation.
-
-### KMIP support for import, query, encryption and decryption
-
-Previously, KMIP did not support certain operations such as import, decrypt, encrypt, and query. These operations are now supported. For a complete list of supported KMIP operations, please refer to the [Supported KMIP Operations](/vault/docs/secrets/kmip) documentation.
-
-@include 'pgx-params.mdx'
-
-## Known issues
-
-When you use Vault 1.11.0+ as a Consul's Connect CA, you may encounter an issue generating the leaf certificates ([GH-15525](https://github.com/hashicorp/consul/pull/15525)). Upgrade your [Consul version that includes the fix](https://support.hashicorp.com/hc/en-us/articles/11308460105491#01GMC24E6PPGXMRX8DMT4HZYTW) to avoid running into this problem. 
-
--> Refer to this [Knowledge Base article](https://support.hashicorp.com/hc/en-us/articles/11308460105491) for more details.
-
-## Feature deprecations and EOL
-
-Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page for up-to-date information on feature deprecations and plans. An [Feature Deprecation FAQ](/vault/docs/deprecation/faq) page is also available to address questions concerning decisions made about Vault feature deprecations.
diff --git a/website/content/docs/release-notes/1.12.0.mdx b/website/content/docs/release-notes/1.12.0.mdx
deleted file mode 100644
index f16b8723d82..00000000000
--- a/website/content/docs/release-notes/1.12.0.mdx
+++ /dev/null
@@ -1,161 +0,0 @@
----
-layout: docs
-page_title: 1.12.0
-description: |-
-  This page contains release notes for Vault 1.12.0
----
-
-# Vault 1.12.0 release notes
-
-**Software Release date:** Oct. 12, 2022
-
-**Summary:** Vault Release 1.12.0 offers features and enhancements that improve the user experience while solving critical  issues previously encountered by our customers. We are providing an overview  of improvements in this set of  release notes.
-
-We encourage you to upgrade to the latest release of Vault to take advantage of the new benefits provided. With this latest release, we offer solutions to critical feature gaps that were identified previously. Please refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md) within the Vault release for further information on product improvements, including a comprehensive list of bug fixes.
-
-Some of these enhancements and changes in this release include the following:
-
-
-- Vault Enterprise now supports **PKCS#11** provider plugin (client library) functionality.
-- Vault Enterprise can manage keys for **Oracle TDE**. This requires the Advanced Data Protection license.
-- **PKI Key revocation** improvements are made to Vault’s PKI engine, introducing a new OCSP responder and automatic CRL rebuilding (with up-to-date Delta CRL), that offers significant performance and data transfer improvements to revocation workflows.
-- **BYOK in Transform engines** now allow users to import their keys generated elsewhere.
-- **KMIP Server Profile** adds support for additional operations, allowing  Vault to claim support for the baseline server profile.
-- **Transform secrets engine** supports time-based auto-key rotation for tokenization.
-- **Path and Role-based Quotas** extend the existing Vault Quota support by allowing quotas to be extended to the API path suffixes and auth mount roles.
-- **Licensing** termination behavior has changed where non-evaluation licenses (production licenses) will no longer have a termination date.
-- **Redis Database Secrets Engine** is now available to manage static roles or generation of dynamic credentials, as well as root credential rotation on a stand-alone Redis server.
-- **AWS Elasticache Database Secrets Engine** is introduced to manage static credentials for AWS Elasticache instances. 
-
-~> **Vault Enterprise:** Use [Integrated Storage](/vault/docs/configuration/storage/raft) or [Consul](/vault/docs/configuration/storage/consul) as your Vault's storage backend. Vault Enterprise will no longer start up if configured to use a storage backend other than Integrated Storage or Consul. (See the [Upgrade Guide](/vault/docs/upgrading/upgrade-to-1.12.x).)
-
-## New features
-
-This section describes the new features introduced in Vault 1.12.0.
-
-### Transform secrets engine enhancements
-
--> **NOTE:** These features need the Vault Enterprise ADP License.
-
-#### Bring your own key (BYOK) for transform
-
-In release 1.11, we introduced BYOK support to Vault, enabling  customers to import existing keys into the Vault Transit Secrets Engine and  enabling secure and flexible Vault deployments.
-We  are extending that support to the Vault Transform Secrets Engine in this release.
-
-#### MSSQL support
-
-An MSSQL store is now available to be used as an external storage engine with tokenization Transform Secrets Engine. Refer to the following documents, [Transform Secrets Engine(API)](/vault/api-docs/secret/transform), [Transform Secrets Engine](/vault/docs/secrets/transform), and [Tokenization Transform](/vault/docs/secrets/transform/tokenization) for more information.
-
-#### Key auto rotation
-
-Periodic rotation of encryption keys is a recommended key management practice for a good security posture. In Vault release 1.10, we added support for Auto key rotation for Transit Secrets Engine. In Vault 1.12, the Transform secrets engine is now  enhanced, allowing users to set the rotation policy during key creation in a time interval, which will cause Vault to rotate the Transform keys when the time interval elapses automatically.
-
-Refer to the following documentation [Tokenization Transform](/vault/docs/secrets/transform/tokenization) and [Transform Secrets Engine(API)](/vault/api-docs/secret/transform#rotate-tokenization-key) for more information.
-
-### PKI secrets engine improvements
-
-#### PKI secrets engine revocation enhancements
-
-We are improving Vault PKI Engine’s revocation capabilities by adding support for the Online Certificate Status Protocol (OCSP) and a delta Certificate Revocation List (CRL) to track changes to the main CRL. These enhancements significantly streamline customer experience with the PKI engine making the certification revocation semantics easier to understand and manage. Additionally, support for automatic CRL rotation and periodic tidy operations help reduce operator burden, alleviate the demand on cluster resources during periods of high revocation, and ensure clients are always served valid CRLs. Finally, support for Bring-Your-Own-Cert (BYOC) allows revocation of `no_store=true` certificates and for Proof-of-Possession (PoP) allows end-users to safely revoke their own certificates (with corresponding private key) without operator intervention. 
-
-#### PKI and managed key support for RSA-PSS signatures
-
-Since its initial release, Vault's PKI secrets engine only supported RSA-PKCS#1v1.5 (Public Key Cryptographic Standards) signatures for issuers and leaves. To conform with NIST's guidance around key transport and for compatibility with newer HSM Firmware, we have included support for RSA-PSS signatures (Probabilistic Signature Scheme). See the section on [PSS Support in the PKI documentation](/vault/docs/secrets/pki/considerations#pss-support) for limitations of this feature.
-
-#### PKI telemetry improvements
-
-In this release, we are adding additional telemetry to Vault’s PKI secrets engine, enabling customers to gather better  insights into  certificate usage via the count of stored and revoked certificates. Additionally, the Vault `tidy` function is enhanced with additional metrics that reflect the remaining stored and revoked certificates.
-
-#### Auto-fetch CRL in the certificate auth method
-
-Operators will now be able to specify one or more CRL URLs that Vault will automatically fetch and keep up-to-date, rather than having to push the CRLs to the cert auth method. This should make certificate management easier for those users that have large cert auth deployments.
-
-#### GCP Cloud key manager support
-
-Managed Keys let Vault secrets engines (currently PKI) use keys stored in Cloud KMS systems for cryptographic operations like certificate signing.  Vault 1.12 adds support for GCP Cloud KMS to the Managed Key system, where previously AWS, Azure, and PKCS#11 Hardware Security Modules were supported.
-
-### KMIP server profile
-
-The [Baseline Server Profile](https://docs.oasis-open.org/kmip/kmip-profiles/v2.1/os/kmip-profiles-v2.1-os.html) specifies the basic functionality expected of a KMIP server.  In Vault 1.12, we offer support for the operations and attributes in the Baseline server profile. With this release, Vault Enterprise now supports the Symmetric Key lifecycle server profile, Baseline server profile, and the Basic Cryptographic server profile (as of Release 1.11), enabling the  support of KMIP integrations with various clients more effectively. This requires the Vault Enterprise ADP license.
-
-### SSH secrets engine support for generating keys
-
-Previously, Vault's SSH Secrets Engine when used as an SSH CA required requesters to provide their own public key for signing. In Vault 1.12, Vault can now generate credential key pairs dynamically, returning them to the requester.
-
-This was a community contributed enhancement.
-
-### Path and Role-Based resource quotas
-
-In this release, the existing resource quota functionality has been enhanced. In addition to applying the API rate limiting and lease quotas at the namespace or mount level, you can now use  the quotas to the [API path suffixes and auth mount roles](/vault/docs/enterprise/lease-count-quotas). This enhancement provides users with more control over issued certificates.
-
-### Client count improvements
-
-The billing period for client counting API can now be specified with the [current month](/vault/docs/concepts/client-count) for the end date parameter. When this is done the "new_clients" field will have an hyperlog approximate value indicating the number of new clients that came in the current month. Note that for the previous months, the number will be an exact value.
-
-### Redis database secrets engine
-
-With the support of the Redis database secrets engine, users can use Vault to manage static and dynamic credentials for Redis OSS. The engine  works similarly to other database secrets engines. Refer to the [Redis](/vault/docs/secrets/databases/redis) documentation for more information. Huge thanks to [Francis Hitchens](https://github.com/fhitchen), who contributed their repository to HashiCorp
-
-### AWS elasticache database secrets engine
-With the support of the AWS ElastiCache database secrets engine, users may use Vault to manage static credentials for AWS Elasticache instances. The engine will work similarly to other database secrets engines. Refer to the [elasticache](/vault/docs/secrets/databases/rediselasticache) documentation for more information.
-
-### LDAP secrets engine
-
-Vault 1.12 introduces a new LDAP secrets engine that unifies the user experience between the Active Directory (AD) secrets engine and OpenLDAP secrets engine. This new engine simplifies the user experience when Vault is used to manage credentials for directory services. This new engine supports all implementations from both of the engines mentioned above (AD, LDAP and RACF) and brings dynamic credential capabilities for users relying on Active Directory.
-
-~> **Note:** This engine does _not_ replace the current Active Directory secrets engine. We will continue to maintain the engine and provide bug fixes, but encourage all new users to use the unified LDAP engine. We will communicate the schedule to deprecate the Active Directory secrets engine well in advance, providing time for users to migrate over.
-
-### Terraform Vault provider: Vault version detection
-
-Vault Terraform provider v3.9.0 can now query Vault to detect the server’s version of the server and then perform a semantic version comparison against a provided minimum threshold version to determine whether a selected feature is available for use. This allows for the Vault provider to deterministically anticipate Vault’s behavior.
-
-### Plugin versioning
-
-In prior versions of Vault, plugins were not “version-aware,”  creating a suboptimal user experience during plugin installation and upgrades. In Vault 1.12, we are introducing the concept of versions to plugins, making plugins “version-aware” and allowing standardization of the release processes and offering a better user experience when installing and upgrading plugins.
-
-### PKCS#11 client support
-​​
-Software solutions often require cryptographic objects-like keys, X.509 certificates, or perform operations like a certificate or key generation, hashing, encryption, decryption, and signing. Hardware Security Modules (HSM) are traditionally used as a secure option, but are expensive and challenging to operationalize.
-
-Vault Enterprise 1.12 is a PKCS#11 2.40 compliant provider, extended profile. PKCS#11 is the standard protocol supported for integrating with HSMs. Support for this protocol is the first step to enabling customers to consolidate HSMs. It also has the operational flexibility and advantages of software for key generation, encryption, and object storage operations. The PKCS#11 support in Vault 1.12 supports a subset of key generation, encryption, decryption and key storage operations. This requires the Enterprise ADP-KM license.
-
-~> **Note:** With this feature, Vault does not become an HSM. HSMs are needed where customer use cases need FIPS 140-2 L2+ compliance support.
-
-### Oracle TDE
-
-With Vault 1.12, Vault Enterprise (ADP-KM) can now act as an external key manager for Oracle instances when Transparent Data Encryption is enabled. TDE allows users to conjure and use Vault to protect their Data Encryption Keys by using Vault to protect them using a Key Encryption Key. Reading and writing of data securely are handled transparently by Oracle database instances without needing user intervention. This will need the Enterprise ADP license.
-
-### UI support for okta number challenge
-
-In Vault 1.11, we added support for Okta’s Number Challenge feature in the CLI and API. In Vault 1.12, we’ve extended this support to the Vault UI, allowing users to complete the Okta Number Challenge from a web browser, the command line, and the HTTP API.
-
-### OIDC provider support in the UI
-Vault can now act as an OIDC provider for applications that wish to delegate authentication to Vault and leverage its identity system. As an OIDC provider, Vault supports PKCE for authorization code flow, preventing attacks such as SSRF. After OIDC provider functionality went GA, our design and user research team gathered feedback from community members, and we simplified the setup experience. With a few CLI commands or UI clicks, users can now have a default OIDC provider with its defaults configured and ready to go for applications to utilize the functionality.
-
-
-## Other features and enhancements
-
-### License termination behavior
-
-The Licensing termination behavior has changed where non-evaluation licenses (production licenses) no longer have a termination date, making Vault more robust for Vault Enterprise customers. Also refer to the updated [licensing FAQ](/vault/docs/enterprise/license/faq) for more information.
-
-### Namespace custom metadata
-Customers can now specify [custom metadata](/vault/api-docs/system/namespaces) on the namespaces. The new `vault namespace patch` [command](/vault/docs/commands/namespace) can be used to update existing namespaces with custom metadata as well. This will make it possible to tag namespaces with additional fields (For example: owner, region department) describing it.
-
-### Vault agent improvements
-
-Vault Agent introduced new configuration parameters that will significantly improve the use of Vault Agent. These includes:
-
-- Added `disable_idle_connections` configuration to disable leaving idle connections open in auto-auth, caching and templating.
-- Added `disable_keep_alives` configuration to disable keep alives in auto-auth, caching and templating.
-- JWT auto-auth now supports a `remove_jwt_after_reading` configuration option which defaults to true.
-
-
-
-## Known issues
-
-There are no known issues documented for this release.
-
-## Feature deprecations and EOL
-
-Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page for up-to-date information on feature deprecations and plans. A [Feature Deprecation FAQ](/vault/docs/deprecation/faq) page addresses questions about  decisions made about Vault feature deprecations.
diff --git a/website/content/docs/release-notes/1.13.0.mdx b/website/content/docs/release-notes/1.13.0.mdx
deleted file mode 100644
index c7d30a36b1b..00000000000
--- a/website/content/docs/release-notes/1.13.0.mdx
+++ /dev/null
@@ -1,138 +0,0 @@
----
-layout: docs
-page_title: 1.13.0
-description: |-
-  This page contains release notes for Vault 1.13.0
----
-
-# Vault 1.13.0 release notes
-
-**Software Release date:** March 1, 2023
-
-**Summary:** Vault Release 1.13.0 offers features and enhancements that improve
-the user experience while solving critical  issues previously encountered by our
-customers. We are providing an overview  of improvements in this set of  release
-notes.
-
-We encourage you to [upgrade](/vault/docs/upgrading) to the latest release of
-Vault to take advantage of the new benefits provided. With this latest release,
-we offer solutions to critical feature gaps that were identified previously.
-Please refer to the
-[Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#1130-rc1)
-within the Vault release for further information on product improvements,
-including a comprehensive list of bug fixes.
-
-Some of these enhancements and changes in this release include the following:
-
-- **PKI improvements:**
-   - **Cross Cluster PKI Certificate Revocation:** Introducing a new unified
-     OCSP responder and CRL builder that enables a certificate revocations and
-     CRL view across clusters for a given PKI mount.
-   - **PKI UI Beta:** New UI introducing cross-signing flow, overview page,
-     roles and keys view.
-   - **Health Checks:** Provide a health overview of PKI mounts for proactive
-     actions and troubleshooting.
-   - **Command Line:** Simplified CLI to discover, rotate issuers and related
-     commands for PKI mounts
-
-- **Azure Auth Improvements:**
-   - **Rotate-root support:** Add the ability to rotate the root account's
-     client secret defined in the auth method's configuration via the new
-     `rotate-root` endpoint.
-   - **Managed Identities authentication:** The auth method now allows any Azure
-     resource that supports managed identities to authenticate with Vault.
-   - **VMSS Flex authentication:** Add support for Virtual Machine Scale Set
-     (VMSS) Flex authentication.
-
-- **GCP Secrets Impersonated Account Support:** Add support for GCP service
-  account impersonation, allowing callers to generate a GCP access token without
-  requiring Vault to store or retrieve a GCP service account key for each role.
-- **Managed Keys in Transit Engine:** Support for offloading Transit Key
-  operations to HSMs/external KMS.
-- **KMIP Secret Engine Enhancements:** Implemented Asymmetric Key Lifecycle
-  Server and Advanced Cryptographic Server profiles. Added support for RSA keys
-  and operations such as:  MAC, MAC Verify, Sign, Sign Verify, RNG Seed and RNG
-  Retrieve.
-- **Vault as a SSM:** Support is planned for an upcoming Vault PKCS#11 Provider
-  version to include mechanisms for encryption, decryption, signing and
-  signature verification for AES and RSA keys.
-- **Replication (enterprise):** We fixed a bug that could cause a cluster to
-  wind up in a permanent merkle-diff/merkle-sync loop and never enter
-  stream-wals, particularly in cases of high write loads on the primary cluster.
-- **Share Secrets in Independent Namespaces (enterprise):** You can now add
-  users from namespaces outside a namespace hierarchy to a group in a given
-  namespace hierarchy. For Vault Agent, you can now grant it access to secrets
-  outside the namespace where it authenticated, and reduce the number of Agents
-  you need to run.
-- **User Lockout:** Vault now supports configuration to lock out users when they
-  have consecutive failed login attempts. This feature is **enabled by default**
-  in 1.13 for the userpass, ldap, and approle auth methods.
-- **Event System (Alpha):** Vault has a new experimental event system. Events
-  are currently only generated on writes to the KV secrets engine, but external
-  plugins can also be updated to start generating events.
-- **Kubernetes authentication plugin bug fix:** Ensures a consistent TLS
-  configuration for all k8s API requests. This fixes a bug where it was possible
-  for the http.Client's Transport to be missing the necessary root CAs to ensure
-  that all TLS connections between the auth engine and the Kubernetes API were
-  validated against the configured set of CA certificates.
-- **Kubernetes Secretes Engine on Vault UI:** Introducing Kubernetes secret
-  engine support on the UI
-- **Client Count UI improvements:** Combining current month and previous history
-  into one dashboard
-- **OCSP Support in the TLS Certificate Auth Method:** The auth method now can
-  check for revoked certificates using the OCSP protocol.
-- **UI Wizard removal:** The UI Wizard has been removed from the UI since the
-  information was occasionally out-of-date and did not align with the latest
-  changes. A new and enhanced UI experience is planned in a future release.
-
-- **Vault Agent improvements:**
-   - Auto-auth introduced `token_file` method which reads an existing token from
-     a file. The token file method is designed for development and testing. It
-     is not suitable for production deployment.
-   - Listeners for the Vault Agent can define a role set to `metrics_only` so
-     that a service can be configured to listen on a particular port to collect
-     metrics.
-   - Vault Agent can read configurations from multiple files.
-   - Users can specify the log file path using the `-log-file` command flag or
-     `VAULT_LOG_FILE` environment variable. This is particularly useful when
-     Vault Agent is running as a Windows service.
-
-- **OpenAPI-based Go & .NET Client Libraries (Public Beta):** Use the new Go &
-  .NET client libraries to interact with the Vault API from your applications.
-   - [OpenAPI-based Go client library](https://github.com/hashicorp/vault-client-go/)
-   - [OpenAPI-based .NET client library](https://github.com/hashicorp/vault-client-dotnet/)
-
-## Known issues
-
-When Vault is configured without a TLS certificate on the TCP listener, the Vault UI may throw an error that blocks you from performing operational tasks.
-
-The error message: `Q.randomUUID is not a function`
-
-<Note>
-
-Refer to this [Knowledge Base article](https://support.hashicorp.com/hc/en-us/articles/14512496697875) for more details and a workaround.
-
-</Note>
-
-The fix for this UI issue is coming in the Vault 1.13.1 release.
-
-@include 'perf-standby-token-create-forwarding-failure.mdx'
-
-@include 'known-issues/update-primary-data-loss.mdx'
-
-@include 'known-issues/internal-error-namespace-missing-policy.mdx'
-
-@include 'known-issues/ephemeral-loggers-memory-leak.mdx'
-
-@include 'known-issues/sublogger-levels-unchanged-on-reload.mdx'
-
-@include 'known-issues/expiration-metrics-fatal-error.mdx'
-
-@include 'known-issues/perf-secondary-many-mounts-deadlock.mdx'
-
-## Feature deprecations and EOL
-
-Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page
-for up-to-date information on feature deprecations and plans. A [Feature
-Deprecation FAQ](/vault/docs/deprecation/faq) page addresses questions about
-decisions made about Vault feature deprecations.
diff --git a/website/content/docs/release-notes/1.14.0.mdx b/website/content/docs/release-notes/1.14.0.mdx
deleted file mode 100644
index 5e4f18cd874..00000000000
--- a/website/content/docs/release-notes/1.14.0.mdx
+++ /dev/null
@@ -1,292 +0,0 @@
----
-layout: docs
-page_title: "1.14.0 release notes"
-description: |-
-  Key updates for  Vault 1.14.0
----
-
-# Vault 1.14.0 release notes
-
-**GA date:** June 21, 2023
-
-@include 'release-notes/intro.mdx'
-
-## Known issues and breaking changes
-
-Version | Issue
-------- | ------------------------------------------------------------
-1.14.0+ | [Users limited by control groups can only access issuer detail from PKI overview page](/vault/docs/upgrading/upgrade-to-1.14.x#ui-pki-control-groups)
-All     | [API calls to update-primary may lead to data loss](/vault/docs/upgrading/upgrade-to-1.14.x#update-primary-data-loss)
-1.14.0+ | [AWS static roles ignore changes to rotation period](/vault/docs/upgrading/upgrade-to-1.14.x#aws-static-role-rotation)
-1.14.0+ | [UI Collapsed navbar does not allow certain click events](/vault/docs/upgrading/upgrade-to-1.14.x#ui-collapsed-navbar)
-1.14.3 - 1.14.5 | [Vault storing references to ephemeral sub-loggers leading to unbounded memory consumption](/vault/docs/upgrading/upgrade-to-1.14.x#vault-is-storing-references-to-ephemeral-sub-loggers-leading-to-unbounded-memory-consumption)
-1.14.4 - 1.14.5 | [Internal error when vault policy in namespace does not exist](/vault/docs/upgrading/upgrade-to-1.14.x#internal-error-when-vault-policy-in-namespace-does-not-exist)
-1.14.0+ | [Sublogger levels not adjusted on reload](/vault/docs/upgrading/upgrade-to-1.14.x#sublogger-levels-unchanged-on-reload)
-1.14.5  | [Fatal error during expiration metrics gathering causing Vault crash](/vault/docs/upgrading/upgrade-to-1.15.x#fatal-error-during-expiration-metrics-gathering-causing-vault-crash)
-1.14.5 | [User lockout potential double logging](/vault/docs/upgrading/upgrade-to-1.14.x#user-lockout-logging)
-1.14.5 - 1.14.9 | [Deadlock can occur on performance secondary clusters with many mounts](/vault/docs/upgrading/upgrade-to-1.14.x#deadlock-can-occur-on-performance-secondary-clusters-with-many-mounts)
-
-## Vault companion updates
-
-Companion updates are Vault updates that live outside the main Vault binary.
-
-<table>
-  <thead>
-    <tr>
-      <th style={{verticalAlign: 'middle'}}>Release</th>
-      <th style={{verticalAlign: 'middle'}}>Update</th>
-      <th style={{verticalAlign: 'middle'}}>Description</th>
-    </tr>
-  </thead>
-  <tbody>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Vault Secrets Operator for Kubernetes
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Directly connect Vault secrets into Pods as native Kubernetes Secrets
-      without modifying your application code.
-      <br /><br />
-      Learn more: <a href="/vault/docs/platform/k8s/vso">Vault Secrets Operator</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td rowspan={2} style={{verticalAlign: 'middle'}}>
-      Terraform
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Use LDAP authentication from the unified LDAP engine to Terraform Vault
-      Provider.
-      <br /><br />
-      Learn more: <a href="/vault/docs/secrets/ldap">LDAP Secrets Engine</a>
-    </td>
-  </tr>
-  <tr>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Support for additional PKI issuers and keys endpoints.
-      <br /><br />
-      Learn more: <a href="/vault/docs/secrets/pki">PKI Secrets Engine</a>
-    </td>
-  </tr>
-  </tbody>
-</table>
-
-## Core updates
-
-Follow the learn more links for more information, or browse the list of
-[Vault tutorials updated to highlight changes for the most recent GA release](/vault/tutorials/new-release).
-
-<table>
-  <thead>
-    <tr>
-      <th style={{verticalAlign: 'middle'}}>Release</th>
-      <th style={{verticalAlign: 'middle'}}>Update</th>
-      <th style={{verticalAlign: 'middle'}}>Description</th>
-    </tr>
-  </thead>
-  <tbody>
-
-  <tr>
-    <td rowspan={2} style={{verticalAlign: 'middle'}}>
-      Public Key Infrastructure (PKI)
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Use ACME to automate certificate lifecycle management for private PKI
-      needs with standard ACME clients like Certbot and k8s cert-manager.
-      Request certificates from a Vault server without needing to know Vault
-      APIs or authentication mechanisms.
-      <br /><br />
-      Learn more:&nbsp;
-      <a href="/vault/api-docs/secret/pki#acme-certificate-issuance">PKI Secrets Engine API: ACME</a>
-    </td>
-  </tr>
-  <tr>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Use the improved PKI web UI to manage your PKI instance with intuitive
-      configuration and reasonable defaults for workflows, metadata, issuer
-      info, mount and tidy configuration, cross signing, multi-issuers etc.and
-      includes.
-      <br /><br />
-      Learn more:&nbsp;
-      <a href="/vault/api-docs/secret/pki#acme-certificate-issuance">PKI Secrets Engine</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Security patches
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Various security improvements to remediate low severity and informational
-      findings from a 3rd party security audit.
-      <br /><br />
-      Learn more: <a href="/vault/docs/internals/security">Vault security model</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td rowspan={2} style={{verticalAlign: 'middle'}}>
-      Vault Agent
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>BETA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Fetch secrets directly into your application as environment variables.
-      <br /><br />
-      Learn more: <a href="/vault/docs/agent-and-proxy/agent/process-supervisor">Process Supervisor Mode</a>
-    </td>
-  </tr>
-  <tr>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Use a new subcommand and daemon, Vault Proxy, to access the proxy
-      functionality of Vault Agent. Vault Proxy will handle Vault Agent proxy
-      functionality going forward to simplify use case decisions for users.
-      <br /><br />
-      Learn more: <a href="/vault/docs/agent-and-proxy/proxy">Vault Proxy</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td rowspan={3} style={{verticalAlign: 'middle'}}>
-      Plugin support
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Capture plugin metadata in the Vault audit log.
-      <br /><br />
-      Learn more: <a href="/vault/docs/audit/syslog">Syslog audit device</a>
-    </td>
-  </tr>
-  <tr>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Use X509 Authentication and Terraform Vault Provider in the MongoDB Atlas
-      Database Secrets Engine.
-      <br /><br />
-      Learn more:&nbsp;
-      <a href="/vault/docs/secrets/databases/mongodbatlas">MongoDB Atlas Database Secrets Engine</a>
-    </td>
-  </tr>
-  <tr>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Dependency updates and more robust multiplexing for secrets and
-      authentication plugins.
-      <br /><br />
-      Learn more:&nbsp;
-      <a href="/vault/docs/plugins/plugin-development#serving-a-plugin-with-multiplexing">
-        Serving a plugin with multiplexing (Plugin Development)
-      </a>
-    </td>
-  </tr>
-
-  <tr>
-    <td rowspan={2} style={{verticalAlign: 'middle'}}>
-      AWS support
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Monitoring and performance enhancements for the Vault Lambda extension.
-      <br /><br />
-      Learn more:&nbsp;
-      <a href="/vault/docs/platform/aws/lambda-extension">Vault Lambda Extension guide</a>
-    </td>
-  </tr>
-  <tr>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Use static roles for IAM users in the AWS Secrets Engine.
-      <br /><br />
-      Learn more: <a href="/vault/docs/secrets/aws">AWS Secrets Engine</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Vault GUI
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Streamlined and aligned navigation with HCP Vault UI.
-      <br /><br />
-      Learn more: <a href="/vault/docs/configuration/ui">Vault UI</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Transit
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      <b>Contributed by the Vault community</b>. Support for public-key only Transit
-      keys and BYOK-secured export of key material.
-      <br /><br />
-      Learn more: <a href="/vault/api-docs/secret/transit">Transit Secrets Engine</a>
-    </td>
-  </tr>
-
-  </tbody>
-</table>
-
-## Enterprise updates
-
-<table>
-  <thead>
-    <tr>
-      <th style={{verticalAlign: 'middle'}}>Release</th>
-      <th style={{verticalAlign: 'middle'}}>Update</th>
-      <th style={{verticalAlign: 'middle'}}>Description</th>
-    </tr>
-  </thead>
-  <tbody>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Vault replication
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Stability improvements based on customer feedback for Vault 1.13. See the
-      <a href="https://raw.githubusercontent.com/hashicorp/vault/main/CHANGELOG.md">
-        Vault changelog
-      </a>
-      for a full list of bug fixes.
-      <br /><br />
-      Learn more:&nbsp;
-      <a href="/vault/docs/internals/replication">Replication overview</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      License utilization reporting
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Enables automatic license utilization reporting for you and HashiCorp to
-      ensure transparent, accurate billing.
-      <br /><br />
-      Learn more:&nbsp;
-      <a href="/vault/docs/enterprise/license/utilization-reporting">Automated License utilization reporting</a>
-    </td>
-  </tr>
-
-  </tbody>
-</table>
-
-## Feature deprecations and EOL
-
-Deprecated in 1.14 | Retired in 1.14
------------------- | ---------------
-Vault Agent API proxy support | [Duplicative Docker Images](https://hub.docker.com/_/vault)
-
-@include 'release-notes/deprecation-note.mdx'
diff --git a/website/content/docs/release-notes/1.15.0.mdx b/website/content/docs/release-notes/1.15.0.mdx
deleted file mode 100644
index 5cbcaacbafe..00000000000
--- a/website/content/docs/release-notes/1.15.0.mdx
+++ /dev/null
@@ -1,258 +0,0 @@
----
-layout: docs
-page_title: "1.15.0 release notes"
-description: |-
-  Key updates for  Vault 1.15.0
----
-
-# Vault 1.15.0 release notes
-
-**GA date:** 2023-09-27
-
-@include 'release-notes/intro.mdx'
-
-## Known issues and breaking changes
-
-| Version         | Issue                                                                                                                                                                                                                             |
-|-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| 1.15.0+         | [Vault no longer reports rollback metrics by mountpoint](/vault/docs/upgrading/upgrade-to-1.15.x#rollback-metrics)                                                                                                                |
-| 1.15.0          | [Panic in AWS auth method during IAM-based login](/vault/docs/upgrading/upgrade-to-1.15.x#panic-in-aws-auth-method-during-iam-based-login)                                                                                        |
-| 1.15.0+         | [UI Collapsed navbar does not allow certain click events](/vault/docs/upgrading/upgrade-to-1.15.x#ui-collapsed-navbar)                                                                                                            |
-| 1.15            | [Vault file audit devices do not honor SIGHUP signal to reload](/vault/docs/upgrading/upgrade-to-1.15.x#file-audit-devices-do-not-honor-sighup-signal-to-reload)                                                                  |
-| 1.15.0 - 1.15.1 | [Vault storing references to ephemeral sub-loggers leading to unbounded memory consumption](/vault/docs/upgrading/upgrade-to-1.15.x#vault-is-storing-references-to-ephemeral-sub-loggers-leading-to-unbounded-memory-consumption) |
-| 1.15.0 - 1.15.1 | [Internal error when vault policy in namespace does not exist](/vault/docs/upgrading/upgrade-to-1.15.x#internal-error-when-vault-policy-in-namespace-does-not-exist)                                                              |
-| 1.15.0+         | [Sublogger levels not adjusted on reload](/vault/docs/upgrading/upgrade-to-1.15.x#sublogger-levels-unchanged-on-reload)                                                                                                           |
-| 1.15.0+         | [URL change for KV v2 plugin](/vault/docs/upgrading/upgrade-to-1.15.x#kv2-url-change)                                                                                                                                             |
-| 1.15.1          | [Fatal error during expiration metrics gathering causing Vault crash](/vault/docs/upgrading/upgrade-to-1.15.x#fatal-error-during-expiration-metrics-gathering-causing-vault-crash)                                                |
-| 1.15.0 - 1.15.4 | [Audit devices could log raw data despite configuration](/vault/docs/upgrading/upgrade-to-1.15.x#audit-devices-could-log-raw-data-despite-configuration)                                                                          |
-| 1.15.5          | [Unable to rotate LDAP credentials](/vault/docs/upgrading/upgrade-to-1.15.x#unable-to-rotate-ldap-credentials)                                                                                                                    |
-| 1.15.0 - 1.15.5 | [Deadlock can occur on performance secondary clusters with many mounts](/vault/docs/upgrading/upgrade-to-1.15.x#deadlock-can-occur-on-performance-secondary-clusters-with-many-mounts)                                            |
-
-
-## Vault companion updates
-
-Companion updates are Vault updates that live outside the main Vault binary.
-
-<table>
-  <thead>
-    <tr>
-      <th style={{verticalAlign: 'middle'}}>Release</th>
-      <th style={{verticalAlign: 'middle'}}>Update</th>
-      <th style={{verticalAlign: 'middle'}}>Description</th>
-    </tr>
-  </thead>
-  <tbody>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Vault Secrets Operator
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Run the Vault Secrets Operator (v0.3.0) on Red Hat OpenShift.
-      <br /><br />
-      Learn more: <a href="/vault/docs/platform/k8s/vso/openshift">Vault Secrets Operator</a>
-    </td>
-  </tr>
-  </tbody>
-</table>
-
-## Core updates
-
-Follow the learn more links for more information, or browse the list of
-[Vault tutorials updated to highlight changes for the most recent GA release](/vault/tutorials/new-release).
-
-<table>
-  <thead>
-    <tr>
-      <th style={{verticalAlign: 'middle'}}>Release</th>
-      <th style={{verticalAlign: 'middle'}}>Update</th>
-      <th style={{verticalAlign: 'middle'}}>Description</th>
-    </tr>
-  </thead>
-  <tbody>
-
-  <tr>
-    <td rowSpan={2} style={{verticalAlign: 'middle'}}>
-      Vault Agent
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Updated to use the latest Azure SDK version and Workload Identity
-      Federation (WIF).
-      <br /><br />
-      Learn more:&nbsp;
-      <a href="/vault/docs/agent-and-proxy/agent">What is Vault Agent?</a>
-    </td>
-  </tr>
-  <tr>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Fetch secrets directly into your application as environment variables.
-      <br /><br />
-      Learn more: <a href="/vault/docs/agent-and-proxy/agent/process-supervisor">Process Supervisor Mode</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      External plugins
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>BETA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Run external plugins in their own container with native container platform
-      controls.
-      <br /><br />
-      Learn more: <a href="/vault/docs/plugins/containerized-plugins">Containerize Vault plugins</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Eventing
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>BETA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Subscribe to notifications for various events in Vault. Includes support
-      for filtering, permissions, and cluster configurations with K-V secrets.
-      <br /><br />
-      Learn more: <a href="/vault/docs/concepts/events">Events</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td rowSpan={2} style={{verticalAlign: 'middle'}}>
-    Vault GUI
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      New LDAP secrets engine GUI.
-      <br /><br />
-      Learn more: <a href="/vault/docs/configuration/ui">Vault UI guide</a>
-    </td>
-  </tr>
-  <tr>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      &bull; New landing page dashboard.<br />
-      &bull; View secrets you have read access to under your directory.<br />
-      &bull; View diffs between previous and new secret versions.<br />
-      &bull; Copy and paste secret paths from the GUI to the Vault CLI or API.
-      <br /><br />
-      Learn more: <a href="/vault/docs/configuration/ui">Vault UI guide</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td rowSpan={2} style={{verticalAlign: 'middle'}}>
-      Secrets management
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Connect to Google Cloud Platform (GCP) Cloud SQL instances using native
-      IAM credentials.
-      <br /><br />
-      Learn more:&nbsp;
-      <a href="/vault/docs/sync/gcpsm">Google Cloud Platform Secret Manager</a>
-    </td>
-  </tr>
-  <tr>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Improved TTL management for database credentials with configurable
-      credential rotation.
-      <br /><br />
-      Learn more: <a href="/vault/api-docs/secret">Secrets engines</a>
-    </td>
-  </tr>
-
-  </tbody>
-</table>
-
-## Enterprise updates
-
-<table>
-  <thead>
-    <tr>
-      <th style={{verticalAlign: 'middle'}}>Release</th>
-      <th style={{verticalAlign: 'middle'}}>Update</th>
-      <th style={{verticalAlign: 'middle'}}>Description</th>
-    </tr>
-  </thead>
-  <tbody>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Secrets syncing
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>BETA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Sync Key Value (KV) v2 data between Vault and secrets managers from AWS,
-      Azure, Google Cloud Platform (GCP), GitHub, and Vercel.
-      <br /><br />
-      Learn more: <a href="/vault/docs/sync">Secrets Sync</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Public Key Infrastructure (PKI)
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Control Vault PKI issued certificates with the Certificate Issuance
-      External Policy Service (CIEPS) to ensure consistency and compliance to
-      enterprise standards.
-      <br /><br />
-      Learn more: <a href="/vault/docs/secrets/pki/cieps">Certificate Issuance External Policy Service (CIEPS)</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Replication
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>ENHANCED</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Holistic improvements to cluster replication including problem detection
-      and remediation.
-      <br /><br />
-      Learn more: <a href="/vault/docs/enterprise/replication">Vault Enterprise replication</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Seal High Availability
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>BETA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Enables Vault administrators to configure multiple KMS for seal keys to
-      ensure Vault availability in the event a single KMS becomes unavailable.
-      <br /><br />
-      Learn more: <a href="/vault/docs/configuration/seal/seal-ha">Seal wrap</a>
-    </td>
-  </tr>
-
-  <tr>
-    <td style={{verticalAlign: 'middle'}}>
-      Authentication
-    </td>
-    <td style={{verticalAlign: 'middle', textAlign: 'center'}}>GA</td>
-    <td style={{verticalAlign: 'middle'}}>
-      Authenticate to Vault with your SAML identity provider.
-      <br /><br />
-      Learn more: <a href="/vault/docs/auth/saml">SAML auth method</a>
-    </td>
-  </tr>
-
-  </tbody>
-</table>
-
-## Feature deprecations and EOL
-
-Deprecated in 1.15 | Retired in 1.15
------------------- | ---------------
-None | None
-
-@include 'release-notes/deprecation-note.mdx'
diff --git a/website/content/docs/release-notes/1.16.0.mdx b/website/content/docs/release-notes/1.16.0.mdx
deleted file mode 100644
index 634c2efcc0f..00000000000
--- a/website/content/docs/release-notes/1.16.0.mdx
+++ /dev/null
@@ -1,28 +0,0 @@
----
-layout: docs
-page_title: "1.16.0 release notes"
-description: |-
-  Key updates for  Vault 1.16.0
----
-
-# Vault 1.16.0 release notes
-
-**GA date:** 2024-02-28
-
-@include 'release-notes/intro.mdx'
-
-## Known issues and breaking changes
-
-| Version         | Issue                                                                                                                                                                                                                             |
-|-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| 1.16.0+         | [Existing clusters do not show the current Vault version in UI by default](/vault/docs/upgrading/upgrade-to-1.16.x#default-policy-changes)                                                                                                                |
-| 1.16.0+         | [Default LCQ enabled when upgrading pre-1.9](/vault/docs/upgrading/upgrade-to-1.16.x#default-lcq-pre-1.9-upgrade) |
-
-
-## Feature deprecations and EOL
-
-Deprecated in 1.15 | Retired in 1.15
------------------- | ---------------
-None | None
-
-@include 'release-notes/deprecation-note.mdx'
diff --git a/website/content/docs/release-notes/1.5.0.mdx b/website/content/docs/release-notes/1.5.0.mdx
deleted file mode 100644
index 91d03b93d11..00000000000
--- a/website/content/docs/release-notes/1.5.0.mdx
+++ /dev/null
@@ -1,63 +0,0 @@
----
-layout: docs
-page_title: 1.5.0
-description: |-
-  This page contains release notes for Vault 1.5.0.
----
-
-# Vault 1.5.0
-
-## Vault 1.5 release highlights
-
-**Resource Quotas:** A new set of functionality called Resource Quotas that allows operators to define API quotas which impose usage limits at the system, endpoint, and namespace level (Enterprise Only) in order to ensure applications and users do not overuse Vault’s resources. The following quota options will be supported:
-
-- **Lease Count Quotas (Enterprise Only):** Allows operators to specify lease count quotas. If the number of leases in the cluster hits the configured quota limits, additional lease creations will be forbidden for all clients until a lease has been revoked or has expired.
-- **Rate Limit Quotas (All versions):** Allows operators to specify request-per-second quotas. Rate limit quotas are applicable to every node in the Vault cluster, meaning each node will maintain separate counters to enforce rate limits. If the rate limit quota limit is hit on any of the nodes in the Vault cluster, additional requests will be canceled for all clients.
-
-**Splunk App for Monitoring Vault (Enterprise Only):** A new [Splunk App](https://splunkbase.splunk.com/app/5093/) providing information on how Vault is doing from an operational and security perspective. The app includes sample dashboards spanning operational metrics, usage metrics and some interpretive data from Vault’s audit logs:
-
-- Example **Operational Metrics (telemetry)** include Disk I/O, memory and CPU usage. Storage backend metrics are also included (if using Consul or Integrated Storage).
-- Example **Usage Metrics (telemetry)** include number of identity entities, number of service tokens, token TTL distribution, and secret KV count. The usage metrics are new to Vault telemetry (and are supported by all versions of Vault).
-- Example **Audit Log Interpretation** data includes requests by path, KV operations by path, distinct tokens by auth method, and leases created by path.
-
-**Replication UI Redesign (Enterprise Only):** Redesign of the replication UI for performance and DR primary and secondary clusters, to help understand the health of replication Vault better. Includes the following:
-
-- A new DR secondary replication dashboard, and an updated performance secondary replication dashboard
-- Updated DR and performance primary dashboards that include a list of known secondaries and their corresponding UI URLs (for easier context-switching between the UIs)
-- Redesigned management workflows
-
-**Integrated Storage for HA Coordination:** Vault now has the option to specify Integrated Storage as the HA coordination option for Vault, when any durable data storage backend (that may or may not support HA coordination) is used.
-
-**Vault Monitor Command:** A new command, “vault monitor”, which allows users to stream logs of a running Vault server. The log level selected can be different from the log level used by the server logs.
-
-**Password Policies:** Vault generates passwords as part of the dynamic secrets workflows. These passwords are created with high complexity for security reasons. However, certain organizations have internal policies that are less stringent and restricted to usage of certain character sets. The new Password Policies feature in Vault 1.5 allows an operator to configure secret engines to generate passwords that comply with character set requirements of those systems.
-
-**Namespace Support for SSH Helper:** Vault now has an option to allow users to specify the namespace of the SSH mount when using the SSH helper.
-
-**Static Credential Rotation Support for MS SQL Server:** Vault now allows static credential rotation for MS SQL.
-
-**Support for AWS IAM Roles for Kubernetes Service Accounts:** Vault now provides support for AWS IAM Roles for K8s Service Accounts (IRSA)
-
-**Support for Distributed Groups Claims on Azure:** Vault now supports group claims for Azure Active Directory users that are part of over 200 groups.
-
-**Performance Improvements for Transit:** Vault now features infrastructure improvements to how transit handles encryption/decryption calls with batch tokens.
-
-## What’s changed
-
-`storage/gcs:` The `credentials_file` config option has been removed. The `GOOGLE_APPLICATION_CREDENTIALS` environment variable or default credentials may be used instead
-
-`storage/raft:` The storage configuration now accepts a new max_entry_size config (similar to the max kv entry size parameter) that will limit the total size in bytes of any entry committed via raft. It defaults to `"1048576"` (1MiB).
-
-`token:` Token creation with custom token ID via id will no longer allow periods (`.`) as part of the input string. The final generated token value may contain periods, such as the `s.` prefix for service token indication.
-
-`token:` Token renewals will now return token policies within the `token_policies`, identity policies within `identity_policies`, and the full policy set within `policies`.
-
-`cubbyhole:` Reject reads and writes to an empty (`""`) path.
-
-`core:` Remove the addition of newlines to parsed configuration when using integer/boolean values
-
-`audit:` Token TTL and issue time are now provided in the auth portion of audit logs
-
-`audit:` Added `mount_type` field to requests and responses
-
-**For more detailed information, please refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md)**
diff --git a/website/content/docs/release-notes/1.6.0.mdx b/website/content/docs/release-notes/1.6.0.mdx
deleted file mode 100644
index fd7fe73bb27..00000000000
--- a/website/content/docs/release-notes/1.6.0.mdx
+++ /dev/null
@@ -1,52 +0,0 @@
----
-layout: docs
-page_title: 1.6.0
-description: |-
-  This page contains release notes for Vault 1.6.0.
----
-
-# Vault 1.6.0
-
-## Vault 1.6 release highlights
-
-**Transform: Tokenization Tech Preview (Enterprise ADP Module Only)**: Vault 1.6 introduces a new transformation method
-for tokenizing sensitive data stored in un-trusted/semi-trusted systems. Tokenization is available as part of the
-“Advanced Data Protection” module in Vault Enterprise. Tokenization provides non-reversible data protection pursuant to
-requirements for data irreversibility (PCI-DSS, GDPR, etc.). This feature is being released in a Tech Preview.
-
-**Integrated Storage Enhancements**: Continuing with the enhancements made to Vault’s Integrated storage, we are adding
-the following new features:
-
-- **Cloud auto-join** provides support for Vault nodes to automatically discover and join a cluster via specified cloud
-  metadata. This is particularly useful when IP addresses are not static.
-- **Automated snapshots** provides built-in Vault functionality for automated snapshots that takes snapshots of the
-  state of the Vault servers and saves them locally, or pushes them to an optional remote storage service.
-
-**UI improvements**
-
-- **New UI for Transform secrets engine (Enterprise ADP Module Only)**
-  - To configure FPE and Masking transformations, including custom alphabets and patterns for FPE.
-  - To create and manage roles and patterns for templated use in current and future FPE and masking transformations.
-- **Improvements to Vault Usage UI** to show new metrics for “active clients”, “unique entities” and “active direct
-  tokens” that help with understanding Vault usage
-
-**Support for seal migration** for all use cases to migrate from any to any unseal interface (including auto-unseal to auto-unseal of the same type)
-
-**Key Management Secrets Engine in Tech Preview (Enterprise ADP Module Only)** - A new Key Management Secrets Engine to
-help manage and securely distribute keys to various cloud KMS services. This feature is being released in Tech Preview
-to be used in conjunction with Microsoft’s Azure Key Vault.
-
-**Database secrets engine improvements**:
-
-- Extending the newly released Password Policy to the combined Database Secrets Engine to support for all databases
-- Add Couchbase support to the combined Database Secrets Engine to manage static and dynamic credentials for Couchbase
-- Add static credential rotation to Cassandra, InfluxDB and Elasticsearch
-- Add MongoDB Atlas root credential rotation
-- Added support for root credential & static credential rotation for HanaDB
-
-## What’s changed
-
-- Vault 1.6 will use Go 1.15, which has dropped support for 32-bit binaries for [Darwin](https://golang.org/doc/go1.15#darwin),
-  so we will no longer be issuing `darwin_386` builds of Vault.
-
-For more detailed information, please refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#160).
diff --git a/website/content/docs/release-notes/1.7.0.mdx b/website/content/docs/release-notes/1.7.0.mdx
deleted file mode 100644
index 7774e5e3801..00000000000
--- a/website/content/docs/release-notes/1.7.0.mdx
+++ /dev/null
@@ -1,64 +0,0 @@
----
-layout: docs
-page_title: 1.7.0
-description: |-
-  This page contains release notes for Vault 1.7.0.
----
-
-# Vault 1.7.0
-
-## Vault 1.7 release highlights
-
-### Secrets engine enhancements
-
-- **Tokenization (Enterprise ADP Module)**: General Availability of a new transformation method for tokenizing sensitive data stored in un-trusted/semi-trusted systems. Tokenization is available as part of the “Advanced Data Protection” module in Vault Enterprise. Tokenization provides non-reversible data protection pursuant to requirements for data irreversibility (PCI-DSS, GDPR, etc.).
-- **Key Management Secrets Engine General Availability (Enterprise ADP Module):** A new Key Management Secrets Engine to help manage and securely distribute keys to various cloud KMS services. This feature is to be used in conjunction with Microsoft’s Azure KeyVault (GA) and AWS KMS (Beta).
-- **UI for the Database Secrets Engine:** A new UI to enable users to connect external databases to Vault (with initial support for MongoDB), set up dynamic roles, and generate dynamic and static credentials.
-- **Snowflake Secrets Engine:** Snowflake support to the combined database secrets engine to manage static and dynamic credentials for the Snowflake platform.
-- **TFE/TFC Secrets Engine:** New secrets engine to allow TFE/TFC users to generate short-lived ephemeral user/team or organization tokens credentials to be used in their pipelines.
-- **Active Directory Dynamic Credentials:** Allows for creation of short lived AD accounts when using the OpenLDAP engine in "AD" mode.
-
-### Storage backend enhancements
-
-- **Integrated Storage Autopilot:** New autopilot enhancements to simplify and automate the cluster management operational experience. These include:
-  - Checks to monitor node health and status
-  - Server stabilization to prevent disruption to raft quorum due to an unstable new node
-  - Dead server cleanup to help maintain cluster stability
-    For Vault Enterprise, autopilot will automatically include non-voter considerations to the above functionality.
-- **Aerospike Storage Backend:** Support for using Aerospike as a community supported storage backend option.
-
-### Security and cryptography enhancements
-
-- **Barrier Auto Key Rotation:** Updates to allow Vault to automatically rotate to a new barrier key for future encryption after crossing the 2^32 encryption threshold, thereby improving security.
-- **KMIP Entropy Augmentation (Enterprise ADP Module):** The ability to use entropy augmentation to generate KMIP certificates.
-
-### Vault metrics enhancements
-
-- **Usage Metrics Visibility:**
-  - Vault Auditor now includes the active KMIP certificate count as part of the client usage metrics.
-  - Added metrics for active entity count.
-  - Added API for partial month client count.
-- **Telemetry Metrics:** Added new metrics related to lease expiration.
-
-### Performance and reliability improvements
-
-- **Expiration Manager Improvements:** Improved how Vault resources are consumed during lease revocations.
-- **Client Controlled Consistency (Enterprise):** New options to use configurable headers to control the consistency of reads after writes to performance secondary clusters and performance standby nodes.
-- **Memory Utilization Improvements (Enterprise):** The replication log buffer is now memory bound as well as length bound. This allows Vault to limit the memory footprint of the log buffer. The maximum size and length are now user configurable.
-
-### Other
-
-- **Username Customization:** Allows users to customize dynamically generated usernames.
-- **Add OTP Flag to Okta Login:** Allows for a one-time password to be passed in along with the Okta login command for users who are unable to accept/respond to an Okta MFA push notification.
-- **Extension of Evaluation License (Enterprise):** Extended the Vault Enterprise evaluation license from 30 minutes to 6 hours.
-- **Vault Agent Improvements:**
-  - Vault Agent can now run as a Windows Service.
-  - Added support for an agent persistent cache to allow for a graceful handoff between init and sidecar containers when using vault-k8s (mutating admissions controller) for secrets injection.
-- **Operator enhancement:** The Vault status command (which prints the current state of Vault including whether it is sealed and if HA mode is enabled) now works when a namespace is set.
-
-## Known issues
-
-- There is a known issue that may cause Autopilot to be unable to determine the leader node. This occurs if the IP in the raft peer list is different from the configured cluster address. If affected you should disable Autopilot by setting the VAULT_RAFT_AUTOPILOT_DISABLE environment variable to 1.
-- Autopilot is not currently supported with Integrated Storage's HA-only mode or with DR secondary clusters.
-
-For more detailed information, please refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#170).
diff --git a/website/content/docs/release-notes/1.8.0.mdx b/website/content/docs/release-notes/1.8.0.mdx
deleted file mode 100644
index 75fcd3fbe99..00000000000
--- a/website/content/docs/release-notes/1.8.0.mdx
+++ /dev/null
@@ -1,62 +0,0 @@
----
-layout: docs
-page_title: 1.8.0
-description: |-
-  This page contains release notes for Vault 1.8.0.
----
-
-# Vault 1.8.0
-
-## Vault 1.8 release highlights
-
-**Licensing Changes:** There are a few key licensing changes that are introduced with 1.8:
-
-- Autoloading of licenses which simplifies the license installation workflow via the ability to load a license from an environment variable or from the disk
-- The need for a valid license for Vault to successfully boot-up for EULA compliance.
-- The license can be in-storage (as is the case prior to 1.8), providing a seamless experience when existing clusters are upgraded to 1.8. Support for in-storage licenses will be removed in a future release, and so it is recommended that customers migrate to autoloaded licenses.
-- For new cluster deployments, licenses must be autoloaded.
-- Support for license-free trial period for Enterprise binaries (30 min/6h) has been removed, and a default 1-day grace time for eval licenses has now been introduced.
-
-**Vault Diagnose:** A new `vault operator diagnose` command enables faster troubleshooting and user-friendly diagnostics in situations when Vault is not starting.
-
-### Secrets engine enhancements
-
-- **Key Management Secrets Engine (Enterprise ADP-KM Module Only)**: Key Management Secrets Engine that was released as generally available for Azure in Vault 1.7, is now generally available for AWS.
-- **UI for the Database Secrets Engine:** Expansion of the UI for the database secrets engine, allowing for users to interact with MSSQL and MySQL database engines via the Vault UI.
-- **GCP Static Accounts:** The GCP secrets engine now has the ability to use existing service accounts for generation of service account keys and access tokens.
-- **Username templating:** With Vault 1.8 users have the ability to customize usernames for the snowflake, redshift, elasticsearch, influxdb, rabbitmq and mongodb atlas database engines.
-- **Active Directory:** Vault now has the ability to manually rotate a credential for an account being managed via the AD secrets engine.
-
-### Other enhancements
-
-- **ServiceNow Credential Resolver:** Vault can now act as an external credential store for the ServiceNow MID servers when using a ServiceNow workflow for service discovery
-- **RedHat certified helm charts:** Vault’s Kubernetes Helm charts are now certified by RedHat!
-- **Integrated Storage Autopilot:** Autopilot capabilities to monitor and manage clusters are now supported with DR.
-- **SSH Secrets Engine identity template support:** When configuring a role for the SSH Secrets Engine, users may now specify Vault identity templates in the _default_extensions_ field. This allows Vault to conform to the required identity semantics for services such as GitHub Enterprise when functioning as an SSH CA.
-
-- **Expiration manager improvements**
-
-  - Fair-sharing logic to help with lease revocations
-  - The ability to mark some leases as irrevocable
-  - The addition of an HTTP API and a CLI for operators to obtain information about irrevocable leases, to be able to tidy them
-
-- **Vault Agent Enhancements:** The following Vault Agent enhancements have been added to 1.8 to improve the operational experience.
-
-  - **Infinite Retry:** This release reintroduces the default behavior of agent template indefinitely retrying and not exit on failures.
-  - **Configurable timeout for non-renewable secrets:** Agent template now has the ability to configure how often to fetch non-renewable secrets (from the default 5m)
-  - **Update Agent Auth with GCP to use new SignJWT endpoint:** This enhancement should benefit GCP customers who want to use the Vault Agent to authenticate using GCP’s IAM Service Account Credentials for signing JWTs.
-
-- **Control Group triggers:** This enhancement provides flexibility to customers to apply control groups to only certain permissions in a path. Vault now supports a new parameter called controlled_capabilities in the control_group stanza factors. This is a list of permissions, which when invoked will result in the control group workflow only being triggered if the operation that initiated the request is included in the list.
-- **Password policies in namespaces:** Vault now supports setting up password policies in namespaces
-- **Obscuring secret Values in the UI:** Vault now provides the ability to mask secrets on entry - whether they be KV secrets or certificates - anywhere secrets are entered in the UI.
-
-### Deprecations:
-
-The following API endpoints have been deprecated and will be removed in a future release:
-
-- `POST sys/license` to store licenses in storage; it is recommended to use
-  [License Autoloading](/vault/docs/enterprise/license/autoloading) instead.
-
-- `/gcp/token/:roleset` and `/gcp/key/:roleset` paths for generating secrets for rolesets
-
-For more detailed information, please refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md).
diff --git a/website/content/docs/release-notes/1.9.0.mdx b/website/content/docs/release-notes/1.9.0.mdx
deleted file mode 100644
index 3a9b70883f5..00000000000
--- a/website/content/docs/release-notes/1.9.0.mdx
+++ /dev/null
@@ -1,119 +0,0 @@
----
-layout: docs
-page_title: 1.9.0
-description: |-
-  This page contains release notes for Vault 1.9.0.
----
-
-# Vault 1.9.0 release notes
-
-**Software Release Date**: November 19, 2021
-
-**Summary**: This document captures major updates as part of Vault release 1.9.0, including new features, breaking changes, enhancements, deprecation, and EOL plans. Refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md) for additional changes made within the Vault 1.9 release.
-
-## New features
-
-This section describes the new features introduced as part of Vault 1.9.0.
-
-### Client count improvements
-
-Several improvements to client count were made to help customers better track and identify client attribution and reduce overcomputing.
-
-#### Improved computation of client counts and usability within the usage metrics UI
-
-The improvements made include the following:
-
-* New logic enables de-duplication of non-entity tokens, thereby reducing their contribution towards the client count
-* New logic allows entities to be created for local auth mounts, thereby eliminating  non-entity-tokens being  issued by the local auth mounts and reducing the overall client count
-* Eliminates root tokens from the client count aggregate
-* Displays client counts per namespace (top ten, descending order by attribution) in the usage metrics UI with the ability to export data for all namespaces
-* Displays clients earlier than a month in the usage metrics UI (within ten minutes since initiation of computation)
-
-### Advanced data protection module (ADP) enhancements
-
-The following section provides details about the ADP module features added in this release.
-
-#### Advanced I/O handling for tranform FPE (ADP-Transform)
-
-Users of the Format Preserving Encryption (FPE) feature of ADP Transform will now benefit from increased flexibility with regards to formatting the input and output of their data. [Transformation templates](/vault/tutorials/adp/transform#advanced-handling) are receiving two new fields- **encode_format** and **decode_formats** -that allow users to specify and format individual [capturing groups](https://www.regular-expressions.info/refcapture.html) within the regular expressions that define their formats.
-
-#### MS SQL TDE (ADP-KM)
-
-We added support to Vault Enterprise for customers who want Vault to manage encryption keys for Transparent Data Encryption on MSSQL servers.
-
-#### Key management Secrets(KMS) engine - GCP (ADP-KM)
-
-The [KMS Engine for GCP](/vault/docs/secrets/gcpkms) provides key management via the Google Cloud KMS to assist with automating many GCP key management functions.
-
-## Other features and enhancements
-
-This section describes other features and enhancements introduced as part of the Vault 1.9 release.
-
-### Vault agent improvements
-
-Improvements were made to the Vault Agent Cache to ensure that [consul-template is always routed through the Vault Agent cache](/vault/docs/agent/template), therefore, eliminating the need for listeners to be defined in the Vault Agent for just templating.
-
-### Customized username generation for database dynamic credentials
-
-This feature enables customization of username for database dynamic credentials. This feature helps customers better manage and correlate usernames for various actions such as troubleshooting, etc. Vault 1.9 supports Postgres, MSSQL, MySQL, Oracle, MongoDB.
-
-### Customizable HTTP headers for Vault
-
-This feature allows security operators to configure [custom response headers](/vault/docs/configuration/listener/tcp) to HTTP root path (`/`) and API endpoints (`/v1/*`), in addition to the previously supported UI paths through the server HCL configuration file.
-
-### Support for IBM s390X CPU architecture
-
-This feature adds support for Vault to run on the IBM s390x architecture via the [equivalent binary](https://releases.hashicorp.com/vault/1.9.0+ent/).
-
-### Namespace API lock
-
-This [feature](/vault/docs/concepts/namespace-api-lock) allows namespace administrators to flexibly control operations such as locking APIs from child namespaces to which they have access. This enables them to restrict access to their domain in a multi-tenant environment and perform break-glass procedures in times of emergency to protect a cluster from within their child namespace.
-
-### Vault terraform provider v3
-
-We have upgraded the [Vault Terraform Provider](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) to the latest version of the [Terraform Plugin SDKv2](/terraform/plugin/sdkv2) to leverage new features.
-
-### Azure secrets engine
-
-The following enhancement are included:
-
-* Added `use_microsoft_graph_api` configuration parameter is added to use with Microsoft Graph API. We are targeting to remove Azure Active Directory API by [June 30, 2022](https://docs.microsoft.com/en-us/graph/migrate-azure-ad-graph-overview).
-* Rotate root API is now available to rotate client_secret immediately after configuration.
-
-### Customized metadata for KV
-
-This [enhancement](/vault/api-docs/secret/kv/kv-v2) provides the ability to set version-agnostic custom key metadata for Vault KVv2 secrets via a metadata endpoint. This custom metadata is also visible in the UI.
-
-## UI enhancements
-### Expanding the UI for more DB secrets engines
-
-We have been adding support for DB secrets engines in the UI over the past few releases. In the Vault 1.9 release, we have added support for [Oracle](/vault/docs/secrets/databases/oracle) and [ElasticSearch](/vault/docs/secrets/databases/elasticdb) and [PostgresSQL](/vault/docs/secrets/databases/postgresql) database secrets engines in the UI.
-
-### PKI certificate metadata
-
-The [PKI Secrets Engine](/vault/docs/secrets/pki) now displays additional PKI certificate metadata in the UI, such as date issued, date of expiry, serial number, and subject/name.
-
-## Tech preview features
-
-### KV secrets engine v2 patch operations
-
-This feature provides a more streamlined method for managing [KV v2 secrets](/vault/api-docs/secret/kv/kv-v2), enabling customers to better maintain least privilege security in automated environments. This feature allows performing partial updates to KV v2 secrets without requiring to read the full KV secret's key/value pairs.
-
-### Vault as an OIDC provider
-
-Vault can now act as an OIDC Provider so applications can leverage the pre-existing [Vault identities](/vault/api-docs/secret/identity) to authenticate into applications.
-
-## Breaking changes
-
-The following section details breaking changes introduced in Vault 1.9.
-
-### Removal of HTTP request counters
-
-In Vault 1.9, the [internal HTTP Request count API](/vault/api-docs/system/internal-counters#http-requests) was removed from the product. Calls to the endpoint will result in a **404 error** with a message stating that functionality on this path has been removed.
-Please refer to the [upgrade guide](/vault/docs/upgrading/upgrade-to-1.9.x) for more information.
-
-As called out in the documentation, Vault does not make backwards compatible guarantees on internal APIs (those prefaced with `sys/internal`). They are subject to change and may disappear without notice.
-
-## Feature deprecations and EOL
-
-Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page for up-to-date information on feature deprecations and plans. An [FAQ](/vault/docs/deprecation/faq) page is also available to address questions concerning decisions made about Vault feature deprecations.
diff --git a/website/content/docs/release-notes/index.mdx b/website/content/docs/release-notes/index.mdx
deleted file mode 100644
index c525f248bde..00000000000
--- a/website/content/docs/release-notes/index.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
----
-layout: docs
-page_title: Release Notes
-description: Release notes for new Vault versions.
----
-
-# Release notes
-
-Release notes describe major updates in new versions of Vault.
-
-Choose a version from the navigation sidebar to view the release notes for each
-of the major software packages in the Vault product line.
-
-Please refer to the
-[Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md) for
-further information on product improvements, including a comprehensive list of
-bug fixes.
\ No newline at end of file
diff --git a/website/content/docs/secrets/ad/index.mdx b/website/content/docs/secrets/ad/index.mdx
deleted file mode 100644
index f17e7964729..00000000000
--- a/website/content/docs/secrets/ad/index.mdx
+++ /dev/null
@@ -1,362 +0,0 @@
----
-layout: docs
-page_title: Active Directory - Secrets Engines
-description: >-
-  The Active Directory secrets engine allowing Vault to generate dynamic credentials.
----
-
-# Active directory secrets engine
-
-@include 'ad-secrets-deprecation.mdx'
-
-@include 'x509-sha1-deprecation.mdx'
-
-The Active Directory (AD) secrets engine is a plugin residing [here](https://github.com/hashicorp/vault-plugin-secrets-active-directory).
-It has two main features.
-
-The first feature (password rotation) is where the AD secrets engine rotates AD passwords dynamically.
-This is designed for a high-load environment where many instances may be accessing
-a shared password simultaneously. With a simple set up and a simple creds API,
-it doesn't require instances to be manually registered in advance to gain access.
-As long as access has been granted to the creds path via a method like
-[AppRole](/vault/api-docs/auth/approle), they're available. Passwords are
-lazily rotated based on preset TTLs and can have a length configured to meet your needs. Additionally,
-passwords can be manually rotated using the [rotate-role](/vault/api-docs/secret/ad#rotate-role-credentials) endpoint.
-
-The second feature (service account check-out) is where a library of service accounts can
-be checked out by a person or by machines. Vault will automatically rotate the password
-each time a service account is checked in. Service accounts can be voluntarily checked in, or Vault
-will check them in when their lending period (or, "ttl", in Vault's language) ends.
-
-## Password rotation
-
-### Customizing password generation
-
-There are two ways of customizing how passwords are generated in the Active Directory secret engine:
-
-1. [Password Policies](/vault/docs/concepts/password-policies)
-2. `length` and `formatter` fields within the [configuration](/vault/api-docs/secret/ad#password-parameters)
-
-Utilizing password policies is the recommended path as the `length` and `formatter` fields have
-been deprecated in favor of password policies. The `password_policy` field within the configuration
-cannot be specified alongside either `length` or `formatter` to prevent a confusing configuration.
-
-### A note on lazy rotation
-
-To drive home the point that passwords are rotated "lazily", consider this scenario:
-
-- A password is configured with a TTL of 1 hour.
-- All instances of a service using this password are off for 12 hours.
-- Then they wake up and again request the password.
-
-In this scenario, although the password TTL was set to 1 hour, the password wouldn't be rotated for 12 hours when it
-was next requested. "Lazy" rotation means passwords are rotated when all of the following conditions are true:
-
-- They are over their TTL
-- They are requested
-
-Therefore, the AD TTL can be considered a soft contract. It's fulfilled when the given password is next requested.
-
-To ensure your passwords are rotated as expected, we'd recommend you configure services to request each password at least
-twice as often as its TTL.
-
-### A note on escaping
-
-**It is up to the administrator** to provide properly escaped DNs. This
-includes the user DN, bind DN for search, and so on.
-
-The only DN escaping performed by this method is on usernames given at login
-time when they are inserted into the final bind DN, and uses escaping rules
-defined in RFC 4514.
-
-Additionally, Active Directory has escaping rules that differ slightly from the
-RFC; in particular it requires escaping of '#' regardless of position in the DN
-(the RFC only requires it to be escaped when it is the first character), and
-'=', which the RFC indicates can be escaped with a backslash, but does not
-contain in its set of required escapes. If you are using Active Directory and
-these appear in your usernames, please ensure that they are escaped, in
-addition to being properly escaped in your configured DNs.
-
-For reference, see [RFC 4514](https://www.ietf.org/rfc/rfc4514.txt) and this
-[TechNet post on characters to escape in Active
-Directory](http://social.technet.microsoft.com/wiki/contents/articles/5312.active-directory-characters-to-escape.aspx).
-
-### Quick setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1.  Enable the Active Directory secrets engine:
-
-    ```text
-    $ vault secrets enable ad
-    Success! Enabled the ad secrets engine at: ad/
-    ```
-
-    By default, the secrets engine will mount at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-2.  Configure the credentials that Vault uses to communicate with Active Directory
-    to generate passwords:
-
-    ```text
-    $ vault write ad/config \
-        binddn=$USERNAME \
-        bindpass=$PASSWORD \
-        url=ldaps://138.91.247.105 \
-        userdn='dc=example,dc=com'
-    ```
-
-    The `$USERNAME` and `$PASSWORD` given must have access to modify passwords
-    for the given account. It is possible to delegate access to change
-    passwords for these accounts to the one Vault is in control of, and this is
-    usually the highest-security solution.
-
-    If you'd like to do a quick, insecure evaluation, also set `insecure_tls` to true. However, this is NOT RECOMMENDED
-    in a production environment. In production, we recommend `insecure_tls` is false (its default) and is used with a valid
-    `certificate`.
-
-3.  Configure a role that maps a name in Vault to an account in Active Directory.
-    When applications request passwords, password rotation settings will be managed by
-    this role.
-
-    ```text
-    $ vault write ad/roles/my-application \
-        service_account_name="my-application@example.com"
-    ```
-
-4.  Grant "my-application" access to its creds at `ad/creds/my-application` using an
-    auth method like [AppRole](/vault/api-docs/auth/approle).
-
-### FAQ
-
-#### What if someone directly rotates an active directory password that Vault is managing?
-
-If an administrator at your company rotates a password that Vault is managing,
-the next time an application asks _Vault_ for that password, Vault won't know
-it.
-
-To maintain that application's up-time, Vault will need to return to a state of
-knowing the password. Vault will generate a new password, update it, and return
-it to the application(s) asking for it. This all occurs automatically, without
-human intervention.
-
-Thus, we wouldn't recommend that administrators directly rotate the passwords
-for accounts that Vault is managing. This may lead to behavior the
-administrator wouldn't expect, like finding very quickly afterwards that their
-new password has already been changed.
-
-The password `ttl` on a role can be updated at any time to ensure that the
-responsibility of updating passwords can be left to Vault, rather than
-requiring manual administrator updates.
-
-#### Why does Vault return the last password in addition to the current one?
-
-Active Directory promises _eventual consistency_, which means that new
-passwords may not be propagated to all instances immediately. To deal with
-this, Vault returns the current password with the last password if it's known.
-That way, if a new password isn't fully operational, the last password can also
-be used.
-
-## Service account Check-Out
-
-Vault offers the ability to check service accounts in and out. This is a separate,
-different set of functionality from the password rotation feature above. Let's walk
-through how to use it, with explanation at each step.
-
-First we'll need to enable the AD secrets engine and tell it how to talk to our AD
-server just as we did above.
-
-```shell-session
-$ vault secrets enable ad
-Success! Enabled the ad secrets engine at: ad/
-
-$ vault write ad/config \
-    binddn=$USERNAME \
-    bindpass=$PASSWORD \
-    url=ldaps://138.91.247.105 \
-    userdn='dc=example,dc=com'
-```
-
-Our next step is to designate a set of service accounts for check-out.
-
-```shell-session
-$ vault write ad/library/accounting-team \
-    service_account_names=fizz@example.com,buzz@example.com \
-    ttl=10h \
-    max_ttl=20h \
-    disable_check_in_enforcement=false
-```
-
-In this example, the service account names of `fizz@example.com` and `buzz@example.com` have
-already been created on the remote AD server. They've been set aside solely for Vault to handle.
-The `ttl` is how long each check-out will last before Vault checks in a service account,
-rotating its password during check-in. The `max_ttl` is the maximum amount of time it can live
-if it's renewed. These default to `24h`, and both use [duration format strings](/vault/docs/concepts/duration-format).
-Also by default, a service account must be checked in by the same Vault entity or client token that
-checked it out. However, if this behavior causes problems, set `disable_check_in_enforcement=true`.
-
-When a library of service accounts has been created, view their status at any time to see if they're
-available or checked out.
-
-```shell-session
-$ vault read ad/library/accounting-team/status
-Key                 Value
----                 -----
-buzz@example.com    map[available:true]
-fizz@example.com    map[available:true]
-```
-
-To check out any service account that's available, simply execute:
-
-```shell-session
-$ vault write -f ad/library/accounting-team/check-out
-Key                     Value
----                     -----
-lease_id                ad/library/accounting-team/check-out/EpuS8cX7uEsDzOwW9kkKOyGW
-lease_duration          10h
-lease_renewable         true
-password                ?@09AZKh03hBORZPJcTDgLfntlHqxLy29tcQjPVThzuwWAx/Twx4a2ZcRQRqrZ1w
-service_account_name    fizz@example.com
-```
-
-If the default `ttl` for the check-out is higher than needed, set the check-out to last
-for a shorter time by using:
-
-```shell-session
-$ vault write ad/library/accounting-team/check-out ttl=30m
-Key                     Value
----                     -----
-lease_id                ad/library/accounting-team/check-out/gMonJ2jB6kYs6d3Vw37WFDCY
-lease_duration          30m
-lease_renewable         true
-password                ?@09AZerLLuJfEMbRqP+3yfQYDSq6laP48TCJRBJaJu/kDKLsq9WxL9szVAvL/E1
-service_account_name    buzz@example.com
-```
-
-This can be a nice way to say, "Although I _can_ have a check-out for 24 hours, if I
-haven't checked it in after 30 minutes, I forgot or I'm a dead instance, so you can just
-check it back in."
-
-If no service accounts are available for check-out, Vault will return a 400 Bad Request.
-
-```shell-session
-$ vault write -f ad/library/accounting-team/check-out
-Error writing data to ad/library/accounting-team/check-out: Error making API request.
-
-URL: POST http://localhost:8200/v1/ad/library/accounting-team/check-out
-Code: 400. Errors:
-
-* No service accounts available for check-out.
-```
-
-To extend a check-out, renew its lease.
-
-```shell-session
-$ vault lease renew ad/library/accounting-team/check-out/0C2wmeaDmsToVFc0zDiX9cMq
-Key                Value
----                -----
-lease_id           ad/library/accounting-team/check-out/0C2wmeaDmsToVFc0zDiX9cMq
-lease_duration     10h
-lease_renewable    true
-```
-
-Renewing a check-out means its current password will live longer, since passwords are rotated
-anytime a password is _checked in_ either by a caller, or by Vault because the check-out `ttl`
-ends.
-
-To check a service account back in for others to use, call:
-
-```shell-session
-$ vault write -f ad/library/accounting-team/check-in
-Key          Value
----          -----
-check_ins    [fizz@example.com]
-```
-
-Most of the time this will just work, but if multiple service accounts checked out by the same
-caller, Vault will need to know which one(s) to check in.
-
-```shell-session
-$ vault write ad/library/accounting-team/check-in service_account_names=fizz@example.com
-Key          Value
----          -----
-check_ins    [fizz@example.com]
-```
-
-To perform a check-in, Vault verifies that the caller _should_ be able to check in a given service account.
-To do this, Vault looks for either the same [entity ID](/vault/tutorials/auth-methods/identity)
-used to check out the service account, or the same client token.
-
-If a caller is unable to check in a service account, or simply doesn't try,
-Vault will check it back in automatically when the `ttl` expires. However, if that is too long,
-service accounts can be forcibly checked in by a highly privileged user through:
-
-```shell-session
-$ vault write -f ad/library/manage/accounting-team/check-in
-Key          Value
----          -----
-check_ins    [fizz@example.com]
-```
-
-Or, alternatively, revoking the secret's lease has the same effect.
-
-```shell-session
-$ vault lease revoke ad/library/accounting-team/check-out/PvBVG0m7pEg2940Cb3Jw3KpJ
-All revocation operations queued successfully!
-```
-
-### Troubleshooting
-
-#### Old passwords are still valid for a period of time.
-
-During testing, we found that by default, many versions of Active Directory
-perpetuate old passwords for a short while. After we discovered this behavior,
-we found articles discussing it by searching for "AD password caching" and "OldPasswordAllowedPeriod". We
-also found [an article from Microsoft](https://support.microsoft.com/en-us/help/906305/new-setting-modifies-ntlm-network-authentication-behavior)
-discussing how to configure this behavior. This behavior appears to vary by AD
-version. We recommend you test the behavior of your particular AD server,
-and edit its settings to gain the desired behavior.
-
-#### I get a lot of 400 bad request's when trying to check out service accounts.
-
-This will occur when there aren't enough service accounts for those requesting them. Let's
-suppose our "accounting-team" service accounts are the ones being requested. When Vault
-receives a check-out call but none are available, Vault will log at debug level:
-"'accounting-team' had no check-outs available". Vault will also increment a metric
-containing the strings "active directory", "check-out", "unavailable", and "accounting-team".
-
-Once it's known _which_ library needs more service accounts for checkout, fix this issue
-by merely creating a new service account for it to use in Active Directory, then adding it to
-Vault like so:
-
-```shell-session
-$ vault write ad/library/accounting-team \
-    service_account_names=fizz@example.com,buzz@example.com,new@example.com
-```
-
-In this example, fizz and buzz were pre-existing but were still included in the call
-because we'd like them to exist in the resulting set. The new account was appended to
-the end.
-
-#### Sometimes Vault gives me a password but then AD says it's not valid.
-
-Active Directory is eventually consistent, meaning that it can take some time for word
-of a new password to travel across all AD instances in a cluster. In larger clusters, we
-have observed the password taking over 10 seconds to propagate fully. The simplest way to
-handle this is to simply wait and retry using the new password.
-
-#### When trying to read credentials i get 'LDAP result code 53 "Unwilling to perform"'
-
-Active Directory will only support password changes over a secure connection. Ensure that your configuration block is not using an unsecured LDAP connection.
-
-## Tutorial
-
-Refer to the [Active Directory Service Account Check-out](/vault/tutorials/secrets-management/active-directory) tutorial to learn how to enable a team to share a select set of service accounts.
-
-## API
-
-The Active Directory secrets engine has a full HTTP API. Please see the
-[Active Directory secrets engine API](/vault/api-docs/secret/ad) for more
-details.
diff --git a/website/content/docs/secrets/ad/migration-guide.mdx b/website/content/docs/secrets/ad/migration-guide.mdx
deleted file mode 100644
index a467ee47e45..00000000000
--- a/website/content/docs/secrets/ad/migration-guide.mdx
+++ /dev/null
@@ -1,163 +0,0 @@
----
-layout: docs
-page_title: Migration Guide - Active Directory - Secrets Engines
-description: >-
-  The guide for migrating from the Active Directory secrets engine to the LDAP secrets engine.
----
-
-# Migration guide - active directory secrets engine
-
-The Vault [Active Directory secrets engine](/vault/docs/secrets/ad) has been deprecated as
-of the Vault 1.13 release. This document provides guidance for migrating from the Active
-Directory secrets engine to the [LDAP secrets engine](/vault/docs/secrets/ldap) that was
-introduced in Vault 1.12.
-
-## Deprecation timeline
-
-Beginning from the Vault 1.13 release, we will continue to support the Active Directory (AD)
-secrets engine in maintenance mode for six major Vault releases. Maintenance mode means that
-we will fix bugs and security issues, but no new features will be added. All new feature
-development efforts will go towards the unified LDAP secrets engine. At Vault 1.18, we will
-mark the AD secrets engine as [pending removal](/vault/docs/deprecation/faq#pending-removal).
-At this time, Vault will begin to strongly signal operators that they need to migrate off of
-the AD secrets engine. At Vault 1.19, we will mark the AD secrets engine as
-[removed](/vault/docs/deprecation/faq#removed). At this time, the AD secrets engine will be
-removed from Vault. Vault will not start up with the AD secrets engine mounts enabled.
-
-## Migration steps
-
-The following sections detail how to migrate the AD secrets engine configuration and
-applications consuming secrets to the new LDAP secrets engine.
-
-### 1. enable LDAP secrets engine
-
-The LDAP secrets engine needs to be enabled in order to have a target for migration of
-existing AD secrets engine mounts. AD secrets engine mounts should be mapped 1-to-1 with
-new LDAP secrets engine mounts.
-
-To enable the LDAP secrets engine:
-
-```shell-session
-$ vault secrets enable ldap
-```
-
-To enable at a custom path:
-
-```shell-session
-$ vault secrets enable -path=<custom_path> ldap
-```
-
-If enabled at a custom path, the `/ldap/` path segment in API paths must be replaced with
-the custom path value.
-
-### 2. migrate configuration
-
-The AD secrets engine [configuration](/vault/api-docs/secret/ad#configuration)
-will need to be migrated to an LDAP secrets engine [configuration](/vault/api-docs/secret/ldap#configuration-management).
-The API paths and parameters will need to be considered during the migration.
-
-#### API path
-
-| AD Secrets Engine | LDAP Secrets Engine |
-| ----------------- |-------------------- |
-| [/ad/config](/vault/api-docs/secret/ad#configuration) | [/ldap/config](/vault/api-docs/secret/ad#configuration)    |
-
-#### Parameters
-
-The parameters from existing AD secrets engine configurations can generally be mapped 1-to-1
-to LDAP secrets engine configuration. The following LDAP secrets engine parameters are the
-exception and must be considered during the migration.
-
-| AD Secrets Engine | LDAP Secrets Engine | Details |
-| ----------------- | ------------------- | ------- |
-| N/A | [schema](/vault/api-docs/secret/ldap#schema) | Must be set to the `ad` option on the LDAP secrets engine configuration. |
-| [userdn](/vault/api-docs/secret/ad#userdn) | [userdn](/vault/api-docs/secret/ad#userdn) | Required to be set if using the [library sets](#4-migrate-library-sets) check-out feature. It can be optionally set if using the [static roles](#3-migrate-roles) feature without providing a distinguished name ([dn](/vault/api-docs/secret/ldap#dn)). |
-| [ttl](/vault/api-docs/secret/ad#ttl) | N/A | Replaced by static role [rotation_period](/vault/api-docs/secret/ldap#rotation_period). |
-| [max_ttl](/vault/api-docs/secret/ad#max_ttl) | N/A | Not supported for [static roles](#3-migrate-roles). Can be set using [max_ttl](/vault/api-docs/secret/ldap#max_ttl-1) for library sets. |
-| [last_rotation_tolerance](/vault/api-docs/secret/ad#last_rotation_tolerance) | N/A | Not supported by the LDAP secrets engine. Passwords will be rotated based on the static role [rotation_period](/vault/api-docs/secret/ldap#rotation_period). |
-
-### 3. migrate roles
-
-AD secrets engine [roles](/vault/api-docs/secret/ad#role-management) will need to be migrated
-to LDAP secrets engine [static roles](/vault/api-docs/secret/ldap#static-roles). The API paths,
-parameters, and rotation periods will need to be considered during the migration.
-
-#### API path
-
-| AD Secrets Engine | LDAP Secrets Engine |
-| ----------------- | ------------------- |
-| [/ad/roles/:role_name](/vault/api-docs/secret/ad#role-management) | [/ldap/static-role/:role_name](/vault/api-docs/secret/ldap#static-roles) |
-
-#### Parameters
-
-The following parameters must be migrated.
-
-| AD Secrets Engine | LDAP Secrets Engine | Details |
-| ----------------- | ------------------- | ------- |
-| [ttl](/vault/api-docs/secret/ad#ttl-1) | [rotation_period](/vault/api-docs/secret/ldap#rotation_period) | N/A |
-| [service_account_name](/vault/api-docs/secret/ad#service_account_name) | [username](/vault/api-docs/secret/ldap#username)    | If `username` is set without setting the [dn](/vault/api-docs/secret/ldap#dn) value, then the configuration [userdn](/vault/api-docs/secret/ldap#userdn) must also be set. |
-
-#### Rotation periods
-
-Rotations that occur from AD secrets engine [roles](/vault/api-docs/secret/ad#role-management)
-may conflict with rotations performed by LDAP secrets engine [static roles](/vault/api-docs/secret/ldap#static-roles)
-during the migration process. This could cause applications consuming passwords to read a
-password that gets invalidated by a rotation shortly after. To mitigate this, it's recommended
-to set an initial [rotation_period](/vault/api-docs/secret/ldap#rotation_period) that provides
-a large enough window to complete [application migrations](#5-migrate-applications) to minimize
-the chance of this happening. Additionally, tuning the AD secrets engine [last_rotation_tolerance](/vault/api-docs/secret/ad#last_rotation_tolerance)
-parameter could help mitigate applications reading stale passwords, since the parameter allows
-rotation of the password if it's been rotated out-of-band within a given duration.
-
-### 4. migrate library sets
-
-AD secrets engine [library sets](/vault/api-docs/secret/ad#library-management) will need to
-be migrated to LDAP secrets engine [library sets](/vault/api-docs/secret/ldap#library-set-management).
-The API paths and parameters will need to be considered during the migration.
-
-#### API path
-
-| AD Secrets Engine | LDAP Secrets Engine |
-| ----------------- | ------------------- |
-| [/ad/library/:set_name](/vault/api-docs/secret/ad#library-management) | [/ldap/library/:set_name](/vault/api-docs/secret/ldap#library-set-management) |
-
-#### Parameters
-
-The parameters from existing AD secrets engine library sets can be exactly mapped 1-to-1
-to LDAP secrets engine library sets. There are no exceptions to consider.
-
-### 5. migrate applications
-
-The AD secrets engine provides APIs to obtain credentials for AD users and service accounts.
-Applications, or Vault clients, are typically the consumer of these credentials. For applications
-to successfully migrate, they must begin using new API paths and response formats provided
-by the LDAP secrets engine. Additionally, they must obtain a Vault [token](/vault/docs/concepts/tokens)
-with an ACL [policy](/vault/docs/concepts/policies) that authorizes access to the new APIs.
-The following section details credential-providing APIs and how their response formats differ
-between the AD secrets engine and LDAP secrets engine.
-
-#### API paths
-
-| AD Secrets Engine | LDAP Secrets Engine | Details |
-| ----------------- | ------------------- | ------- |
-| [/ad/creds/:role_name](/vault/api-docs/secret/ad#retrieving-passwords) | [/ldap/static-cred/:role_name](/vault/api-docs/secret/ldap#static-role-passwords) | Response formats differ. Namely, `current_password` is now `password`.  See [AD response](/vault/api-docs/secret/ad#sample-get-response) and [LDAP response](/vault/api-docs/secret/ldap#sample-get-response-1) for the difference. |
-| [/ad/library/:set_name/check-out](/vault/api-docs/secret/ad#check-a-credential-out) | [/ldap/library/:set_name/check-out](/vault/api-docs/secret/ldap#check-out-management) | Response formats do not differ. |
-| [/ad/library/:set_name/check-in](/vault/api-docs/secret/ad#check-a-credential-in) | [/ldap/library/:set_name/check-in](/vault/api-docs/secret/ldap#check-in-management) | Response formats do not differ. |
-
-### 6. disable AD secrets engines
-
-AD secrets engine mounts can be disabled after successful migration of configuration and
-applications to the LDAP secrets engine. Note that disabling the secrets engine will erase
-its configuration from storage. This cannot be reversed.
-
-To disable the AD secrets engine:
-
-```shell-session
-$ vault secrets disable ad
-```
-
-To disable at a custom path:
-
-```shell-session
-$ vault secrets disable <custom_path>
-```
diff --git a/website/content/docs/secrets/alicloud.mdx b/website/content/docs/secrets/alicloud.mdx
deleted file mode 100644
index 17ff7cb7c76..00000000000
--- a/website/content/docs/secrets/alicloud.mdx
+++ /dev/null
@@ -1,211 +0,0 @@
----
-layout: docs
-page_title: AliCloud - Secrets Engines
-description: >-
-  The AliCloud secrets engine for Vault generates access tokens or STS
-  credentials
-
-  dynamically based on RAM policies or roles.
----
-
-# AliCloud secrets engine
-
-The AliCloud secrets engine dynamically generates AliCloud access tokens based on RAM
-policies, or AliCloud STS credentials based on RAM roles. This generally
-makes working with AliCloud easier, since it does not involve clicking in the web UI.
-The AliCloud access tokens are time-based and are automatically revoked when the Vault
-lease expires. STS credentials are short-lived, non-renewable, and expire on their own.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1.  Enable the AliCloud secrets engine:
-
-    ```text
-    $ vault secrets enable alicloud
-    Success! Enabled the alicloud secrets engine at: alicloud/
-    ```
-
-    By default, the secrets engine will mount at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  [Create a custom policy](https://www.alibabacloud.com/help/doc-detail/28640.htm)
-    in AliCloud that will be used for the access key you will give Vault. See "Example
-    RAM Policy for Vault".
-
-1.  [Create a user](https://www.alibabacloud.com/help/faq-detail/28637.htm) in AliCloud
-    with a name like "hashicorp-vault", and directly apply the new custom policy to that user
-    in the "User Authorization Policies" section.
-
-1.  Create an access key for that user in AliCloud, which is an action available in
-    AliCloud's UI on the user's page.
-
-1.  Configure that access key as the credentials that Vault will use to communicate with
-    AliCloud to generate credentials:
-
-    ```text
-    $ vault write alicloud/config \
-        access_key=0wNEpMMlzy7szvai \
-        secret_key=PupkTg8jdmau1cXxYacgE736PJj4cA
-    ```
-
-    Alternatively, the AliCloud secrets engine can pick up credentials set as environment variables,
-    or credentials available through instance metadata. Since it checks current credentials on every API call,
-    changes in credentials will be picked up almost immediately without a Vault restart.
-
-    If available, we recommend using instance metadata for these credentials as they are the most
-    secure option. To do so, simply ensure that the instance upon which Vault is running has sufficient
-    privileges, and do not add any config.
-
-1.  Configure a role describing how credentials will be granted.
-
-    To generate access tokens using only policies that have already been created in AliCloud:
-
-    ```text
-    $ vault write alicloud/role/policy-based \
-        remote_policies='name:AliyunOSSReadOnlyAccess,type:System' \
-        remote_policies='name:AliyunRDSReadOnlyAccess,type:System'
-    ```
-
-    To generate access tokens using only policies that will be dynamically created in AliCloud by
-    Vault:
-
-    ```text
-    $ vault write alicloud/role/policy-based \
-        inline_policies=-<<EOF
-    [
-        {
-          "Statement": [
-            {
-              "Action": "rds:Describe*",
-              "Effect": "Allow",
-              "Resource": "*"
-            }
-          ],
-          "Version": "1"
-        },
-        {...}
-    ]
-    EOF
-    ```
-
-    Both `inline_policies` and `remote_policies` may be used together. However, neither may be
-    used configuring how to generate STS credentials, like so:
-
-    ```text
-    $ vault write alibaba/role/role-based \
-          role_arn='acs:ram::5138828231865461:role/hastrustedactors'
-    ```
-
-    Any `role_arn` specified must have added "trusted actors" when it was being created. These
-    can only be added at role creation time. Trusted actors are entities that can assume the role.
-    Since we will be assuming the role to gain credentials, the `access_key` and `secret_key` in
-    the config must qualify as a trusted actor.
-
-### Helpful links
-
-- [More on roles](https://www.alibabacloud.com/help/doc-detail/28649.htm)
-- [More on policies](https://www.alibabacloud.com/help/doc-detail/28652.htm)
-
-### Example RAM policy for Vault
-
-While AliCloud credentials can be supplied by environment variables, an explicit
-setting in the `alicloud/config`, or through instance metadata, the resulting
-credentials need sufficient permissions to issue secrets. The necessary permissions
-vary based on the ways roles are configured.
-
-This is an example RAM policy that would allow you to create credentials using
-any type of role:
-
-```json
-{
-  "Statement": [
-    {
-      "Action": [
-        "ram:CreateAccessKey",
-        "ram:DeleteAccessKey",
-        "ram:CreatePolicy",
-        "ram:DeletePolicy",
-        "ram:AttachPolicyToUser",
-        "ram:DetachPolicyFromUser",
-        "ram:CreateUser",
-        "ram:DeleteUser",
-        "sts:AssumeRole"
-      ],
-      "Effect": "Allow",
-      "Resource": "*"
-    }
-  ],
-  "Version": "1"
-}
-```
-
-However, the policy you use should only allow the actions you actually need
-for how your roles are configured.
-
-If any roles are using `inline_policies`, you need the following actions:
-
-- `"ram:CreateAccessKey"`
-- `"ram:DeleteAccessKey"`
-- `"ram:AttachPolicyToUser"`
-- `"ram:DetachPolicyFromUser"`
-- `"ram:CreateUser"`
-- `"ram:DeleteUser"`
-
-If any roles are using `remote_policies`, you need the following actions:
-
-- All listed for `inline_policies`
-- `"ram:CreatePolicy"`
-- `"ram:DeletePolicy"`
-
-If any roles are using `role_arn`, you need the following actions:
-
-- `"sts:AssumeRole"`
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new access key by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault read alicloud/creds/policy-based
-    Key                Value
-    ---                -----
-    lease_id           alicloud/creds/policy-based/f3e92392-7d9c-09c8-c921-575d62fe80d8
-    lease_duration     768h
-    lease_renewable    true
-    access_key         0wNEpMMlzy7szvai
-    secret_key         PupkTg8jdmau1cXxYacgE736PJj4cA
-    ```
-
-    The `access_key` and `secret_key` returned are also known is an
-    `"AccessKeyId"`and `"AccessKeySecret"`, respectively, in the Alibaba's
-    docs.
-
-    Retrieving creds for a role using a `role_arn` will carry the additional
-    fields of `expiration` and `security_token`, like so:
-
-    ```text
-    $ vault read alicloud/creds/role-based
-    Key                Value
-    ---                -----
-    lease_id           alicloud/creds/role-based/f3e92392-7d9c-09c8-c921-575d62fe80d9
-    lease_duration     59m59s
-    lease_renewable    false
-    access_key         STS.L4aBSCSJVMuKg5U1vFDw
-    secret_key         wyLTSmsyPGP1ohvvw8xYgB29dlGI8KMiH2pKCNZ9
-    security_token     CAESrAIIARKAAShQquMnLIlbvEcIxO6wCoqJufs8sWwieUxu45hS9AvKNEte8KRUWiJWJ6Y+YHAPgNwi7yfRecMFydL2uPOgBI7LDio0RkbYLmJfIxHM2nGBPdml7kYEOXmJp2aDhbvvwVYIyt/8iES/R6N208wQh0Pk2bu+/9dvalp6wOHF4gkFGhhTVFMuTDRhQlNDU0pWTXVLZzVVMXZGRHciBTQzMjc0KgVhbGljZTCpnJjwySk6BlJzYU1ENUJuCgExGmkKBUFsbG93Eh8KDEFjdGlvbkVxdWFscxIGQWN0aW9uGgcKBW9zczoqEj8KDlJlc291cmNlRXF1YWxzEghSZXNvdXJjZRojCiFhY3M6b3NzOio6NDMyNzQ6c2FtcGxlYm94L2FsaWNlLyo=
-    expiration         2018-08-15T21:58:00Z
-    ```
-
-## API
-
-The AliCloud secrets engine has a full HTTP API. Please see the
-[AliCloud secrets engine API](/vault/api-docs/secret/alicloud) for more
-details.
diff --git a/website/content/docs/secrets/aws.mdx b/website/content/docs/secrets/aws.mdx
deleted file mode 100644
index c28086b0421..00000000000
--- a/website/content/docs/secrets/aws.mdx
+++ /dev/null
@@ -1,592 +0,0 @@
----
-layout: docs
-page_title: AWS - Secrets Engines
-description: |-
-  The AWS secrets engine for Vault generates access keys dynamically based on
-  IAM policies.
----
-
-# AWS secrets engine
-
-The AWS secrets engine generates AWS access credentials dynamically based on IAM
-policies. This generally makes working with AWS IAM easier, since it does not
-involve clicking in the web UI. Additionally, the process is codified and mapped
-to internal auth methods (such as LDAP). The AWS IAM credentials are time-based
-and are automatically revoked when the Vault lease expires.
-
-Vault supports three different types of credentials to retrieve from AWS:
-
-1. `iam_user`: Vault will create an IAM user for each lease, attach the managed
-   and inline IAM policies as specified in the role to the user, and if a
-   [permissions
-   boundary](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html)
-   is specified on the role, the permissions boundary will also be attached.
-   Vault will then generate an access key and secret key for the IAM user and
-   return them to the caller. IAM users have no session tokens and so no
-   session token will be returned. Vault will delete the IAM user upon reaching the TTL expiration.
-2. `assumed_role`: Vault will call
-   [sts:AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html)
-   and return the access key, secret key, and session token to the caller.
-3. `federation_token`: Vault will call
-   [sts:GetFederationToken](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html)
-   passing in the supplied AWS policy document and return the access key, secret
-   key, and session token to the caller.
-4. `session_token`: Vault will call
-   [sts:GetSessionToken](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html)
-   and return the access key, secret key, and session token to the caller.
-
-### Static roles
-The AWS secrets engine supports the concept of "static roles", which are
-a 1-to-1 mapping of Vault Roles to IAM users. The current password
-for the user is stored and automatically rotated by Vault on a
-configurable period of time. This is in contrast to dynamic secrets, where a
-unique username and password pair are generated with each credential request.
-When credentials are requested for the Role, Vault returns the current
-Access Key ID and Secret Access Key for the configured user, allowing anyone with the proper
-Vault policies to have access to the IAM credentials.
-
-Please see the [API documentation](/vault/api-docs/secret/aws#create-static-role) for details on this feature.
-
-### Plugin Workload Identity Federation (WIF)
-The AWS secrets engine supports the Plugin WIF workflow, and has a source of identity called
-a plugin identity token. The plugin identity token is a JWT that is internally signed by
-Vault's [identity token provider](/vault/api-docs/secret/identity/tokens). Given a trust
-relationship is configured between Vault and AWS via
-[Web Identity Federation]((https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html),
-the secrets engine can exchange its identity token for temporary STS credentials needed to
-perform its actions. This enables the secrets engine to operate without needing sensitive
-IAM security credentials as a part of its configuration.
-
-Please see the [API documentation](/vault/api-docs/secret/aws#configure-root-credentials) for more details on
-the fields associated with this feature.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1.  Enable the AWS secrets engine:
-
-    ```text
-    $ vault secrets enable aws
-    Success! Enabled the aws secrets engine at: aws/
-    ```
-
-    By default, the secrets engine will mount at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure the credentials that Vault uses to communicate with AWS to generate
-    the IAM credentials:
-
-    ```text
-    $ vault write aws/config/root \
-        access_key=AKIAJWVN5Z4FOFT7NLNA \
-        secret_key=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 \
-        region=us-east-1
-    ```
-
-    Internally, Vault will connect to AWS using these credentials. As such,
-    these credentials must be a superset of any policies which might be granted
-    on IAM credentials. Since Vault uses the official AWS SDK, it will use the
-    specified credentials. You can also specify the credentials via the standard
-    AWS environment credentials, shared file credentials, or IAM role/ECS task
-    credentials. (Note that you can't authorize vault with IAM role credentials if you plan
-    on using STS Federation Tokens, since the temporary security credentials
-    associated with the role are not authorized to use GetFederationToken.)
-
-    ~> **Notice:** Even though the path above is `aws/config/root`, do not use
-    your AWS root account credentials. Instead generate a dedicated user or
-    role.
-
-1.  Alternatively, configure the audience claim value and the role ARN to assume for plugin workload identity federation:
-
-    ```text
-    $ vault write aws/config/root \
-        identity_token_audience="<TOKEN AUDIENCE>" \
-        role_arn="<AWS ROLE ARN>"
-    ```
-
-    Vault's identity token provider will internally sign the plugin identity token JWT.
-    Given a trust relationship is configured between Vault and AWS via
-    Web Identity Federation, the secrets engine can exchange this identity token to obtain
-    ephemeral STS credentials.
-
-    ~> **Notice:** For this trust relationship to be established, AWS must have an
-    an [IAM OIDC identity provider](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc.html)
-    configured with information about the fully qualified and network-reachable
-    Issuer URL for Vault's plugin [identity token provider](/vault/api-docs/secret/identity/tokens#read-plugin-identity-well-known-configurations).
-    This is to ensure that AWS can fetch the JWKS [public keys](/vault/api-docs/secret/identity/tokens#read-active-public-keys)
-    and verify the plugin identity token signature. To configure Vault's Issuer,
-    please refer to the Identity Tokens
-    [documentation](/vault/api-docs/secret/identity/tokens#configure-the-identity-tokens-backend)
-
-1.  Configure a Vault role that maps to a set of permissions in AWS as well as an
-    AWS credential type. When users generate credentials, they are generated
-    against this role. An example:
-
-    ```text
-    $ vault write aws/roles/my-role \
-        credential_type=iam_user \
-        policy_document=-<<EOF
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Effect": "Allow",
-          "Action": "ec2:*",
-          "Resource": "*"
-        }
-      ]
-    }
-    EOF
-    ```
-
-    This creates a role named "my-role". When users generate credentials against
-    this role, Vault will create an IAM user and attach the specified policy
-    document to the IAM user. Vault will then create an access key and secret
-    key for the IAM user and return these credentials. You supply a
-    user inline policy and/or provide references to an existing AWS policy's full
-    ARN and/or a list of IAM groups:
-
-    ```text
-    $ vault write aws/roles/my-other-role \
-        policy_arns=arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess,arn:aws:iam::aws:policy/IAMReadOnlyAccess \
-        iam_groups=group1,group2 \
-        credential_type=iam_user \
-        policy_document=-<<EOF
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Effect": "Allow",
-          "Action": "ec2:*",
-          "Resource": "*"
-        }
-      ]
-    }
-    EOF
-    ```
-
-    For more information on IAM policies, please see the
-    [AWS IAM policy documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/PoliciesOverview.html).
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault read aws/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           aws/creds/my-role/f3e92392-7d9c-09c8-c921-575d62fe80d8
-    lease_duration     768h
-    lease_renewable    true
-    access_key         AKIAIOWQXTLW36DV7IEA
-    secret_key         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
-    session_token     <nil>
-    ```
-
-    Each invocation of the command will generate a new credential.
-
-    Unfortunately, IAM credentials are eventually consistent with respect to
-    other Amazon services. If you are planning on using these credential in a
-    pipeline, you may need to add a delay of 5-10 seconds (or more) after
-    fetching credentials before they can be used successfully.
-
-    If you want to be able to use credentials without the wait, consider using
-    the STS method of fetching keys. IAM credentials supported by an STS token
-    are available for use as soon as they are generated.
-
-1.  Rotate the credentials that Vault uses to communicate with AWS:
-
-    ```test
-    $ vault write -f aws/config/rotate-root
-    Key           Value
-    ---           -----
-    access_key    AKIA3ALIVABCDG5XC8H4
-    ```
-
-    <Note>
-
-      Calls from Vault to AWS may fail immediately after calling `aws/config/rotate-root` until
-      AWS becomes consistent again. Refer to
-      the <a href="/vault/api-docs/secret/aws#rotate-root-iam-credentials">AWS secrets engine API</a> reference
-      for additional information on rotating IAM credentials.
-
-    </Note>
-
-## Example IAM policy for Vault
-
-The `aws/config/root` credentials need permission to manage dynamic IAM users.
-Here is an example AWS IAM policy that grants the most commonly required
-permissions Vault needs:
-
-```json
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "iam:AttachUserPolicy",
-        "iam:CreateAccessKey",
-        "iam:CreateUser",
-        "iam:DeleteAccessKey",
-        "iam:DeleteUser",
-        "iam:DeleteUserPolicy",
-        "iam:DetachUserPolicy",
-        "iam:GetUser",
-        "iam:ListAccessKeys",
-        "iam:ListAttachedUserPolicies",
-        "iam:ListGroupsForUser",
-        "iam:ListUserPolicies",
-        "iam:PutUserPolicy",
-        "iam:AddUserToGroup",
-        "iam:RemoveUserFromGroup"
-      ],
-      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/vault-*"]
-    }
-  ]
-}
-```
-
-Vault also supports AWS Permissions Boundaries when creating IAM users. If you
-wish to enforce that Vault always attaches a permissions boundary to an IAM
-user, you can use a policy like:
-
-```json
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "iam:CreateAccessKey",
-        "iam:DeleteAccessKey",
-        "iam:DeleteUser",
-        "iam:ListAccessKeys",
-        "iam:ListAttachedUserPolicies",
-        "iam:ListGroupsForUser",
-        "iam:ListUserPolicies",
-        "iam:AddUserToGroup",
-        "iam:RemoveUserFromGroup"
-      ],
-      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/vault-*"]
-    },
-    {
-      "Effect": "Allow",
-      "Action": [
-        "iam:AttachUserPolicy",
-        "iam:CreateUser",
-        "iam:DeleteUserPolicy",
-        "iam:DetachUserPolicy",
-        "iam:PutUserPolicy"
-      ],
-      "Resource": ["arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/vault-*"],
-      "Condition": {
-        "StringEquals": {
-          "iam:PermissionsBoundary": [
-            "arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:policy/PolicyName"
-          ]
-        }
-      }
-    }
-  ]
-}
-```
-
-where the "iam:PermissionsBoundary" condition contains the list of permissions
-boundary policies that you wish to ensure that Vault uses. This policy will
-ensure that Vault uses one of the permissions boundaries specified (not all of
-them).
-
-## STS credentials
-
-The above demonstrated usage with `iam_user` credential types. As mentioned,
-Vault also supports `assumed_role`, `federation_token`, and `session_token`
-credential types.
-
-### STS federation tokens
-
-~> **Notice:** Due to limitations in AWS, in order to use the `federation_token`
-credential type, Vault **must** be configured with IAM user credentials. AWS
-does not allow temporary credentials (such as those from an IAM instance
-profile) to be used.
-
-An STS federation token inherits a set of permissions that are the combination
-(intersection) of four sets of permissions:
-
-1. The permissions granted to the `aws/config/root` credentials
-2. The user inline policy configured in the Vault role
-3. The managed policy ARNs configured in the Vault role
-4. An implicit deny policy on IAM or STS operations.
-
-Roles with a `credential_type` of `federation_token` can specify one or more of
-the `policy_document`, `policy_arns`, and `iam_groups` parameters in the Vault
-role.
-
-The `aws/config/root` credentials require IAM permissions for
-`sts:GetFederationToken` and the permissions to delegate to the STS
-federation token. For example, this policy on the `aws/config/root` credentials
-would allow creation of an STS federated token with delegated `ec2:*`
-permissions (or any subset of `ec2:*` permissions):
-
-```javascript
-{
-  "Version": "2012-10-17",
-  "Statement": {
-    "Effect": "Allow",
-    "Action": [
-      "ec2:*",
-      "sts:GetFederationToken"
-    ],
-    "Resource": "*"
-  }
-}
-```
-
-An `ec2_admin` role would then assign an inline policy with the same `ec2:*`
-permissions.
-
-```shell-session
-$ vault write aws/roles/ec2_admin \
-    credential_type=federation_token \
-    policy_document=@policy.json
-```
-
-The policy.json file would contain an inline policy with similar permissions,
-less the `sts:GetFederationToken` permission. (We could grant
-`sts:GetFederationToken` permissions, but STS attaches attach an implicit deny
-that overrides the allow.)
-
-```javascript
-{
-  "Version": "2012-10-17",
-  "Statement": {
-    "Effect": "Allow",
-    "Action": "ec2:*",
-    "Resource": "*"
-  }
-}
-```
-
-To generate a new set of STS federation token credentials, we simply write to
-the role using the aws/sts endpoint:
-
-```shell-session
-$ vault write aws/sts/ec2_admin ttl=60m
-Key            	Value
-lease_id       	aws/sts/ec2_admin/31d771a6-fb39-f46b-fdc5-945109106422
-lease_duration 	60m0s
-lease_renewable	false
-access_key     	ASIAJYYYY2AA5K4WIXXX
-secret_key     	HSs0DYYYYYY9W81DXtI0K7X84H+OVZXK5BXXXX
-session_token 	AQoDYXdzEEwasAKwQyZUtZaCjVNDiXXXXXXXXgUgBBVUUbSyujLjsw6jYzboOQ89vUVIehUw/9MreAifXFmfdbjTr3g6zc0me9M+dB95DyhetFItX5QThw0lEsVQWSiIeIotGmg7mjT1//e7CJc4LpxbW707loFX1TYD1ilNnblEsIBKGlRNXZ+QJdguY4VkzXxv2urxIH0Sl14xtqsRPboV7eYruSEZlAuP3FLmqFbmA0AFPCT37cLf/vUHinSbvw49C4c9WQLH7CeFPhDub7/rub/QU/lCjjJ43IqIRo9jYgcEvvdRkQSt70zO8moGCc7pFvmL7XGhISegQpEzudErTE/PdhjlGpAKGR3d5qKrHpPYK/k480wk1Ai/t1dTa/8/3jUYTUeIkaJpNBnupQt7qoaXXXXXXXXXX
-```
-
-### STS Session Tokens
-
-The `session_token` credential type is used to generate short-lived credentials under the root config.
-To create these with Vault and AWS, you must configure Vault to use IAM user credentials. AWS does not
-allow temporary credentials, like those from an IAM instance profile, to be used when generating session tokens.
-
-<Warning>
-
-  STS session tokens inherit any and all permissions granted to the user configured in `aws/config/root`.
-  In this expample, the `temp_user` role will obtain a policy with the same `ec2:*` permissions as the
-  root config. For this reason, assigning a role or policy is disallowed for this credential type.
-
-</Warning>
-
-```shell-session
-$ vault write aws/roles/temp_user \
-    credential_type=session_token
-```
-
-To generate a new set of STS federation token credentials, write to the `temp_user`
-role using the `aws/creds` endpoint:
-
-```shell-session
-$ vault read aws/sts/temp_user ttl=60m
-Key            	Value
-lease_id       	aws/creds/temp_user/w4eKbMaJOi1xLqG3MWk7y8n6
-lease_duration 	60m0s
-lease_renewable	false
-access_key     	ASIAJYYYY2AA5K4WIXXX
-secret_key     	HSs0DYYYYYY9W81DXtI0K7X84H+OVZXK5BXXXX
-session_token 	AQoDYXdzEEwasAKwQyZUtZaCjVNDiXXXXXXXXgUgBBVUUbSyujLjsw6jYzboOQ89vUVIehUw/9MreAifXFmfdbjTr3g6zc0me9M+dB95DyhetFItX5QThw0lEsVQWSiIeIotGmg7mjT1//e7CJc4LpxbW707loFX1TYD1ilNnblEsIBKGlRNXZ+QJdguY4VkzXxv2urxIH0Sl14xtqsRPboV7eYruSEZlAuP3FLmqFbmA0AFPCT37cLf/vUHinSbvw49C4c9WQLH7CeFPhDub7/rub/QU/lCjjJ43IqIRo9jYgcEvvdRkQSt70zO8moGCc7pFvmL7XGhISegQpEzudErTE/PdhjlGpAKGR3d5qKrHpPYK/k480wk1Ai/t1dTa/8/3jUYTUeIkaJpNBnupQt7qoaXXXXXXXXXX
-```
-
-Session tokens may also require an MFA-based TOTP to be provided if the IAM user is configured to require it.
-If so, the Vault role requires the MFA device serial number to be set, and the TOTP may be provided when
-reading credentials from the Vault role.
-
-```shell-session
-$ vault write aws/roles/mfa_user \
-    credential_type=session_token \
-    mfa_serial_number="arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:mfa/device-name"
-```
-
-```shell-session
-$ vault read aws/creds/mfa_user mfa_code=123456
-```
-
-### STS AssumeRole
-
-The `assumed_role` credential type is typically used for cross-account
-authentication or single sign-on (SSO) scenarios. In order to use an
-`assumed_role` credential type, you must configure outside of Vault:
-
-1. An IAM role
-2. IAM inline policies and/or managed policies attached to the IAM role
-3. IAM trust policy attached to the IAM role to grant privileges for Vault to
-   assume the role
-
-`assumed_role` credentials offer a few benefits over `federation_token`:
-
-1. Assumed roles can invoke IAM and STS operations, if granted by the role's
-   IAM policies.
-2. Assumed roles support cross-account authentication
-3. Temporary credentials (such as those granted by running Vault on an EC2
-   instance in an IAM instance profile) can retrieve `assumed_role` credentials
-   (but cannot retrieve `federation_token` credentials).
-
-The `aws/config/root` credentials must be allowed `sts:AssumeRole` through one of
-two methods:
-
-1.  The credentials have an IAM policy attached to them against the target role:
-    ```javascript
-    {
-      "Version": "2012-10-17",
-      "Statement": {
-        "Effect": "Allow",
-        "Action": "sts:AssumeRole",
-        "Resource": "arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:role/RoleNameToAssume"
-      }
-    }
-    ```
-
-1.  A trust policy is attached to the target IAM role for the principal:
-    ```javascript
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Effect": "Allow",
-          "Principal": {
-            "AWS": "arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/VAULT-AWS-ROOT-CONFIG-USER-NAME"
-          },
-          "Action": "sts:AssumeRole"
-        }
-      ]
-    }
-    ```
-
-When specifying a Vault role with a `credential_type` of `assumed_role`, you can
-specify more than one IAM role ARN. If you do so, Vault clients can select which
-role ARN they would like to assume when retrieving credentials from that role.
-
-Further, you can specify both a `policy_document` and `policy_arns` parameters;
-if specified, each acts as a filter on the IAM permissions granted to the
-assumed role. If `iam_groups` is specified, the inline and attached policies for
-each IAM group will be added to the `policy_document` and `policy_arns`
-parameters, respectively, when calling [sts:AssumeRole]. For an action to be
-allowed, it must be permitted by both the IAM policy on the AWS role that is
-assumed, the `policy_document` specified on the Vault role (if specified), and
-the managed policies specified by the `policy_arns` parameter. (The
-`policy_document` parameter is passed in as the `Policy` parameter to the
-[sts:AssumeRole] API call, while the `policy_arns` parameter is passed in as the
-`PolicyArns` parameter to the same call.)
-
-Note: When multiple `role_arns` are specified, clients requesting credentials
-can specify any of the role ARNs that are defined on the Vault role in order to
-retrieve credentials. However, when `policy_document`, `policy_arns`, or
-`iam_groups` are specified, that will apply to ALL role credentials retrieved
-from AWS.
-
-Let's create a "deploy" policy using the arn of our role to assume:
-
-```shell-session
-$ vault write aws/roles/deploy \
-    role_arns=arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:role/RoleNameToAssume \
-    credential_type=assumed_role
-```
-
-To generate a new set of STS assumed role credentials, we again write to
-the role using the aws/sts endpoint:
-
-```shell-session
-$ vault write aws/sts/deploy ttl=60m
-Key            	Value
-lease_id       	aws/sts/deploy/31d771a6-fb39-f46b-fdc5-945109106422
-lease_duration 	60m0s
-lease_renewable	false
-access_key     	ASIAJYYYY2AA5K4WIXXX
-secret_key     	HSs0DYYYYYY9W81DXtI0K7X84H+OVZXK5BXXXX
-session_token 	AQoDYXdzEEwasAKwQyZUtZaCjVNDiXXXXXXXXgUgBBVUUbSyujLjsw6jYzboOQ89vUVIehUw/9MreAifXFmfdbjTr3g6zc0me9M+dB95DyhetFItX5QThw0lEsVQWSiIeIotGmg7mjT1//e7CJc4LpxbW707loFX1TYD1ilNnblEsIBKGlRNXZ+QJdguY4VkzXxv2urxIH0Sl14xtqsRPboV7eYruSEZlAuP3FLmqFbmA0AFPCT37cLf/vUHinSbvw49C4c9WQLH7CeFPhDub7/rub/QU/lCjjJ43IqIRo9jYgcEvvdRkQSt70zO8moGCc7pFvmL7XGhISegQpEzudErTE/PdhjlGpAKGR3d5qKrHpPYK/k480wk1Ai/t1dTa/8/3jUYTUeIkaJpNBnupQt7qoaXXXXXXXXXX
-```
-
-[sts:assumerole]: https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
-
-## Troubleshooting
-
-### Dynamic IAM user errors
-
-If you get an error message similar to either of the following, the root credentials that you wrote to `aws/config/root` have insufficient privilege:
-
-```shell-session
-$ vault read aws/creds/deploy
-* Error creating IAM user: User: arn:aws:iam::000000000000:user/hashicorp is not authorized to perform: iam:CreateUser on resource: arn:aws:iam::000000000000:user/vault-root-1432735386-4059
-
-$ vault revoke aws/creds/deploy/774cfb27-c22d-6e78-0077-254879d1af3c
-Revoke error: Error making API request.
-
-URL: POST http://127.0.0.1:8200/v1/sys/revoke/aws/creds/deploy/774cfb27-c22d-6e78-0077-254879d1af3c
-Code: 400. Errors:
-
-* invalid request
-```
-
-If you get stuck at any time, simply run `vault path-help aws` or with a subpath for
-interactive help output.
-
-### STS federated token errors
-
-Vault generates STS tokens using the IAM credentials passed to `aws/config`.
-
-Those credentials must have two properties:
-
-- They must have permissions to call `sts:GetFederationToken`.
-- The capabilities of those credentials have to be at least as permissive as those requested
-  by policies attached to the STS creds.
-
-If either of those conditions are not met, a "403 not-authorized" error will be returned.
-
-See http://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html for more details.
-
-Vault 0.5.1 or later is recommended when using STS tokens to avoid validation
-errors for exceeding the AWS limit of 32 characters on STS token names.
-
-<Note title="AWS character limit includes path">
-
-  The AWS character limit for token names **includes** the full path to
-   the token. For example, `aws/sts/dev005_vault-test_testtest` (34
-   characters) exceeds the limit , but `aws/roles/dev005_vaulttest-test` (31
-   characters) does not.
-
-</Note>
-
-### AWS instance metadata timeouts
-
-@include 'aws-imds-timeout.mdx'
-
-## API
-
-The AWS secrets engine has a full HTTP API. Please see the
-[AWS secrets engine API](/vault/api-docs/secret/aws) for more
-details.
diff --git a/website/content/docs/secrets/azure.mdx b/website/content/docs/secrets/azure.mdx
deleted file mode 100644
index 0e3eedb0589..00000000000
--- a/website/content/docs/secrets/azure.mdx
+++ /dev/null
@@ -1,347 +0,0 @@
----
-layout: docs
-page_title: Azure - Secrets Engine
-description: |-
-  The Azure Vault secrets engine dynamically generates Azure
-  service principals and role assignments.
----
-
-# Azure secrets engine
-
-The Azure secrets engine dynamically generates Azure service principals along
-with role and group assignments. Vault roles can be mapped to one or more Azure
-roles, and optionally group assignments, providing a simple, flexible way to
-manage the permissions granted to generated service principals.
-
-Each service principal is associated with a Vault lease. When the lease expires
-(either during normal revocation or through early revocation), the service
-principal is automatically deleted.
-
-If an existing service principal is specified as part of the role configuration,
-a new password will be dynamically generated instead of a new service principal.
-The password will be deleted when the lease is revoked.
-
-## Setup
-
-<Note>
-
-  You can configure the Azure secrets engine with the Vault API or
-  established environment variables such as `AZURE_CLIENT_ID` or
-  `AZURE_CLIENT_SECRET`. If you use both methods, note that
-  environment variables always take precedence over API values.
-
-</Note>
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the Azure secrets engine:
-
-   ```shell
-   $ vault secrets enable azure
-   Success! Enabled the azure secrets engine at: azure/
-   ```
-
-   By default, the secrets engine will mount at the name of the engine. To
-   enable the secrets engine at a different path, use the `-path` argument.
-
-1. Configure the secrets engine with account credentials:
-
-   ```shell
-   $ vault write azure/config \
-       subscription_id=$AZURE_SUBSCRIPTION_ID \
-       tenant_id=$AZURE_TENANT_ID \
-       client_id=$AZURE_CLIENT_ID \
-       client_secret=$AZURE_CLIENT_SECRET
-
-   Success! Data written to: azure/config
-   ```
-
-   If you are running Vault inside an Azure VM with MSI enabled, `client_id` and
-   `client_secret` may be omitted. For more information on authentication, see the [authentication](#authentication) section below.
-
-1. Configure a role. A role may be set up with either an existing service principal, or
-   a set of Azure roles that will be assigned to a dynamically created service principal.
-
-To configure a role called "my-role" with an existing service principal:
-
-```shell-session
-$ vault write azure/roles/my-role \
-    application_object_id=<existing_app_obj_id> \
-    ttl=1h
-```
-
-Alternatively, to configure the role to create a new service principal with Azure roles:
-
-```shell-session
-$ vault write azure/roles/my-role ttl=1h azure_roles=-<<EOF
-    [
-        {
-            "role_name": "Contributor",
-            "scope":  "/subscriptions/<uuid>/resourceGroups/Website"
-        }
-    ]
-EOF
-```
-
-Roles may also have their own TTL configuration that is separate from the mount's
-TTL. For more information on roles see the [roles](#roles) section below.
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permissions, it can generate credentials. The usage pattern is the same
-whether an existing or dynamic service principal is used.
-
-To generate a credential using the "my-role" role:
-
-```shell-session
-$ vault read azure/creds/my-role
-
-Key                Value
----                -----
-lease_id           azure/creds/sp_role/1afd0969-ad23-73e2-f974-962f7ac1c2b4
-lease_duration     60m
-lease_renewable    true
-client_id          408bf248-dd4e-4be5-919a-7f6207a307ab
-client_secret      ad06228a-2db9-4e0a-8a5d-e047c7f32594
-```
-
-This endpoint generates a renewable set of credentials. The application can login
-using the `client_id`/`client_secret` and will have access provided by configured service
-principal or the Azure roles set in the "my-role" configuration.
-
-## Root credential rotation
-
-If the mount is configured with credentials directly, the credential's key may be
-rotated to a Vault-generated value that is not accessible by the operator.
-This will ensure that only Vault is able to access the "root" user that Vault uses to
-manipulate dynamic & static credentials.
-
-```shell-session
-vault write -f azure/rotate-root
-```
-
-For more details on this operation, please see the
-[Root Credential Rotation](/vault/api-docs/secret/azure#rotate-root) API docs.
-
-## Roles
-
-Vault roles let you configure either an existing service principal or a set of Azure roles, along with
-role-specific TTL parameters. If an existing service principal is not provided, the configured Azure
-roles will be assigned to a newly created service principal. The Vault role may optionally specify
-role-specific `ttl` and/or `max_ttl` values. When the lease is created, the more restrictive of the
-mount or role TTL value will be used.
-
-### Application object IDs
-
-If an existing service principal is to be used, the Application Object ID must be set on the Vault role.
-This ID can be found by inspecting the desired Application with the `az` CLI tool, or via the Azure Portal. Note
-that the Application **Object** ID must be provided, not the Application ID.
-
-### Azure roles
-
-If dynamic service principals are used, Azure roles must be configured on the Vault role.
-Azure roles are provided as a JSON list, with each element describing an Azure role and scope to be assigned.
-Azure roles may be specified using the `role_name` parameter ("Owner"), or `role_id`
-("/subscriptions/.../roleDefinitions/...").
-`role_id` is the definitive ID that's used during Vault operation; `role_name` is a convenience during
-role management operations. All roles _must exist_ when the configuration is written or the operation will fail. The role lookup priority is:
-
-1. If `role_id` is provided, it is validated and the corresponding `role_name` updated.
-1. If only `role_name` is provided, a case-insensitive search-by-name is made, succeeding
-   only if _exactly one_ matching role is found. The `role_id` field will updated with the matching role ID.
-
-The `scope` must be provided for every role assignment.
-
-### Azure groups
-
-If dynamic service principals are used, a list of Azure groups may be configured on the Vault role.
-When the service principal is created, it will be assigned to these groups. Similar to the format used
-for specifying Azure roles, Azure groups may be referenced by either their `group_name` or `object_id`.
-Group specification by name must yield a single matching group.
-
-Example of role configuration:
-
-```shell-session
-$ vault write azure/roles/my-role \
-    ttl=1h \
-    max_ttl=24h \
-    azure_roles=@az_roles.json \
-    azure_groups=@az_groups.json
-
-$ cat az_roles.json
-[
-  {
-    "role_name": "Contributor",
-    "scope":  "/subscriptions/<uuid>/resourceGroups/Website"
-  },
-  {
-    "role_id": "/subscriptions/<uuid>/providers/Microsoft.Authorization/roleDefinitions/<uuid>",
-    "scope":  "/subscriptions/<uuid>"
-  },
-  {
-    "role_name": "This won't matter as it will be overwritten",
-    "role_id": "/subscriptions/<uuid>/providers/Microsoft.Authorization/roleDefinitions/<uuid>",
-    "scope":  "/subscriptions/<uuid>/resourceGroups/Database"
-  }
-]
-
-$ cat az_groups.json
-[
-  {
-    "group_name": "foo"
-  },
-  {
-    "group_name": "This won't matter as it will be overwritten",
-    "object_id": "a6a834a6-36c3-4575-8e2b-05095963d603"
-  }
-]
-```
-
-### Permanently delete Azure objects
-
-If dynamic service principals are used, the option to permanently delete the applications and service principals created by Vault may be configured on the Vault role.
-When this option is enabled and a lease is expired or revoked, the application and service principal associated with the lease will be [permanently deleted](https://docs.microsoft.com/en-us/graph/api/directory-deleteditems-delete) from the Azure Active Directory.
-As a result, these objects will not count toward the [quota](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#active-directory-limits) of total resources in an Azure tenant. When this option is not enabled
-and a lease is expired or revoked, the application and service principal associated with the lease will be deleted, but not permanently. These objects will be available to restore for 30 days from deletion.
-
-Example of role configuration:
-
-```shell-session
-$ vault write azure/roles/my-role permanently_delete=true ttl=1h azure_roles=-<<EOF
-    [
-        {
-            "role_name": "Contributor",
-            "scope":  "/subscriptions/<uuid>/resourceGroups/Website"
-        }
-    ]
-EOF
-```
-
-## Authentication
-
-The Azure secrets backend must have sufficient permissions to read Azure role information and manage
-service principals. The authentication parameters can be set in the backend configuration or as environment
-variables. Environment variables will take precedence. The individual parameters are described in the
-[configuration][config] section of the API docs.
-
-If the client ID or secret are not present and Vault is running on an Azure VM, Vault will attempt to use
-[Managed Service Identity (MSI)](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/overview)
-to access Azure. Note that when MSI is used, tenant and subscription IDs must still be explicitly provided
-in the configuration or environment variables.
-
-### MS Graph API permissions
-
-The following MS Graph [API permissions](https://learn.microsoft.com/en-us/azure/active-directory/develop/permissions-consent-overview#types-of-permissions)
-must be assigned to the service principal provided to Vault for managing Azure. The permissions
-differ depending on if you're using [dynamic or existing](#choosing-between-dynamic-or-existing-service-principals)
-service principals.
-
-#### Dynamic Service Principals
-
-| Permission Name               | Type        |
-| ----------------------------- | ----------- |
-| Application.ReadWrite.OwnedBy | Application |
-| GroupMember.ReadWrite.All     | Application |
-
-~> **Note**: If you plan to use the [rotate root](/vault/api-docs/secret/azure#rotate-root)
-credentials API, you'll need to change `Application.ReadWrite.OwnedBy` to `Application.ReadWrite.All`.
-
-#### Existing Service Principals
-
-| Permission Name               | Type        |
-| ----------------------------- | ----------- |
-| Application.ReadWrite.All     | Application |
-| GroupMember.ReadWrite.All     | Application |
-
-### Role assignments
-
-The following Azure [role assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-cli)
-must be granted in order for the secrets engine to manage role assignments for service
-principles it creates.
-
-| Role                                           | Scope        | Security Principal                          |
-|------------------------------------------------| ------------ | ------------------------------------------- |
-| [User Access Administrator][user_access_admin] | Subscription | Service Principal ID given in configuration |
-
-## Choosing between dynamic or existing service principals
-
-Dynamic service principals are preferred if the desired Azure resources can be provided
-via the RBAC system and Azure roles defined in the Vault role. This form of credential is
-completely decoupled from any other clients, is not subject to permission changes after
-issuance, and offers the best audit granularity.
-
-Access to some Azure services cannot be provided with the RBAC system, however. In these
-cases, an existing service principal can be set up with the necessary access, and Vault
-can create new passwords for this service principal. Any changes to the service principal
-permissions affect all clients. Furthermore, Azure does not provide any logging with
-regard to _which_ credential was used for an operation.
-
-An important limitation when using an existing service principal is that Azure limits the
-number of passwords for a single Application. This limit is based on Application object
-size and isn't firmly specified, but in practice hundreds of passwords can be issued per
-Application. An error will be returned if the object size is reached. This limit can be
-managed by reducing the role TTL, or by creating another Vault role against a different
-Azure service principal configured with the same permissions.
-
-## Additional notes
-
-- **If a referenced Azure role doesn't exist, a credential will not be generated.**
-  Service principals will only be generated if _all_ role assignments are successful.
-  This is important to note if you're using custom Azure role definitions that might be deleted
-  at some point.
-
-- Azure roles are assigned only once, when the service principal is created. If the
-  Vault role changes the list of Azure roles, these changes will not be reflected in
-  any existing service principal, even after token renewal.
-
-- The time required to issue a credential is roughly proportional to the number of
-  Azure roles that must be assigned. This operation make take some time (10s of seconds
-  are common, and over a minute has been seen).
-
-- Service principal credential timeouts are not used. Vault will revoke access by
-  deleting the service principal.
-
-- The Application Name for dynamic service principals will be prefixed with `vault-`. Similarly
-  the `keyId` of any passwords added to an existing service principal will begin with
-  `ffffff`. These may be used to search for Vault-created credentials using the `az` tool
-  or Portal.
-
-## Azure debug logs
-
-The Azure secret engine plugin supports debug logging which includes additional information
-about requests and responses from the Azure API.
-
-To enable the Azure debug logs, set the `AZURE_GO_SDK_LOG_LEVEL`  environment variable to `DEBUG` on your Vault
-server:
-
-```shell
-AZURE_GO_SDK_LOG_LEVEL=DEBUG
-```
-
-## Help &amp; support
-
-The Azure secrets engine is written as an external Vault plugin and
-thus exists outside the main Vault repository. It is automatically bundled with
-Vault releases, but the code is managed separately.
-
-Please report issues, add feature requests, and submit contributions to the
-[vault-plugin-secrets-azure repo][repo] on GitHub.
-
-## Tutorial
-
-Refer to the [Azure Secrets
-Engine](/vault/tutorials/secrets-management/azure-secrets) tutorial
-to learn how to use the Azure secrets engine to dynamically generate Azure credentials.
-
-## API
-
-The Azure secrets engine has a full HTTP API. Please see the [Azure secrets engine API docs][api]
-for more details.
-
-[api]: /vault/api-docs/secret/azure
-[config]: /vault/api-docs/secret/azure#configure-access
-[repo]: https://github.com/hashicorp/vault-plugin-secrets-azure
-[user_access_admin]: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator
diff --git a/website/content/docs/secrets/consul.mdx b/website/content/docs/secrets/consul.mdx
deleted file mode 100644
index 5dd3ea9e268..00000000000
--- a/website/content/docs/secrets/consul.mdx
+++ /dev/null
@@ -1,210 +0,0 @@
----
-layout: docs
-page_title: Consul - Secrets Engines
-description: The Consul secrets engine for Vault generates tokens for Consul dynamically.
----
-
-# Consul secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
-The Consul secrets engine generates [Consul](https://www.consul.io/) API tokens
-dynamically based on Consul ACL policies.
-
--> **Note:** See the Consul Agent [config documentation](/consul/docs/agent/config/config-files#acl-parameters)
-for details on how to enable Consul's ACL system.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1. (Optional) If you're only looking to set up a quick test environment, you can start a
-    Consul Agent in dev mode in a separate terminal window.
-
-    ```shell-session
-    $ consul agent -dev -hcl "acl { enabled = true }"
-    ```
-
-1.  Enable the Consul secrets engine:
-
-    ```shell-session
-    $ vault secrets enable consul
-    Success! Enabled the consul secrets engine at: consul/
-    ```
-
-    By default, the secrets engine will mount at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault to connect and authenticate to Consul.
-
-    Vault can bootstrap the Consul ACL system automatically if it is enabled and hasn't already
-    been bootstrapped. If you have already bootstrapped the ACL system, then you will need to
-    provide Vault with a management token. This can either be the bootstrap token or another
-    management token you've created yourself.
-
-    1.  Configuring Vault without previously bootstrapping the Consul ACL system:
-
-        ```shell-session
-        $ vault write consul/config/access \
-            address="127.0.0.1:8500"
-        Success! Data written to: consul/config/access
-        ```
-
-        ~> **Note:** Vault will silently store the bootstrap token as the configuration token when
-        it performs the automatic bootstrap; it will not be presented to the user. If you need
-        another management token, you will need to generate one by writing a Vault role with the
-        `global-management` policy and then reading new creds back from it.
-
-    1. Configuring Vault after manually bootstrapping the Consul ACL system:
-
-        1.  For Consul 1.4 and above, use the command line to generate a token with the appropriate policy:
-
-            ```shell-session
-            $ CONSUL_HTTP_TOKEN="<bootstrap-token>" consul acl token create -policy-name="global-management"
-            AccessorID:   865dc5e9-e585-3180-7b49-4ddc0fc45135
-            SecretID:     ef35f0f1-885b-0cab-573c-7c91b65a7a7e
-            Description:
-            Local:        false
-            Create Time:  2018-10-22 17:40:24.128188 -0700 PDT
-            Policies:
-                00000000-0000-0000-0000-000000000001 - global-management
-            ```
-
-            ```shell-session
-            $ vault write consul/config/access \
-                address="127.0.0.1:8500" \
-                token="ef35f0f1-885b-0cab-573c-7c91b65a7a7e"
-            Success! Data written to: consul/config/access
-            ```
-
-        1.  For Consul versions below 1.4, acquire a [management token][consul-mgmt-token] from Consul, using the
-            `acl_master_token` from your Consul configuration file or another management token:
-
-            ```shell-session
-            $ curl \
-                --header "X-Consul-Token: my-management-token" \
-                --request PUT \
-                --data '{"Name": "sample", "Type": "management"}' \
-                https://consul.rocks/v1/acl/create
-            ```
-
-            Vault must have a management type token so that it can create and revoke ACL
-            tokens. The response will return a new token:
-
-            ```json
-            {
-            "ID": "7652ba4c-0f6e-8e75-5724-5e083d72cfe4"
-            }
-            ```
-
-1.  Configure a role that maps a name in Vault to a Consul ACL policy. Depending on your Consul version,
-    you will either provide a policy document and a token type, a list of policies or roles, or a set of
-    service or node identities. When users generate credentials, they are generated against this role.
-
-    1.  For Consul versions 1.8 and above, attach [a Consul node identity](/consul/commands/acl/token/create#node-identity) to the role.
-
-        ```shell-session
-        $ vault write consul/roles/my-role \
-            node_identities="server-1:dc1" \
-            node_identities="server-2:dc1"
-        Success! Data written to: consul/roles/my-role
-        ```
-
-    1.  For Consul versions 1.5 and above, attach either [a role in Consul](/consul/api-docs/acl/roles) or [a Consul service identity](/consul/commands/acl/token/create#service-identity) to the role:
-
-        ```shell-session
-        $ vault write consul/roles/my-role consul_roles="api-server"
-        Success! Data written to: consul/roles/my-role
-        ```
-
-        ```shell-session
-        $ vault write consul/roles/my-role \
-            service_identities="myservice-1:dc1,dc2" \
-            service_identities="myservice-2:dc1"
-        Success! Data written to: consul/roles/my-role
-        ```
-
-    1.  For Consul versions 1.4 and above, generate [a policy in Consul](/consul/tutorials/security/access-control-setup-production),
-        and proceed to link it to the role:
-
-        ```shell-session
-        $ vault write consul/roles/my-role consul_policies="readonly"
-        Success! Data written to: consul/roles/my-role
-        ```
-
-    1.  For Consul versions below 1.4, the policy must be base64-encoded. The policy language is
-        [documented by Consul](/consul/docs/security/acl/acl-legacy). Support for this method is
-        deprecated as of Vault 1.11.
-
-        Write a policy and proceed to link it to the role:
-
-        ```shell-session
-        $ vault write consul/roles/my-role policy="$(echo 'key "" { policy = "read" }' | base64)"
-        Success! Data written to: consul/roles/my-role
-        ```
-
-        -> **Token lease duration:** If you do not specify a value for `ttl` (or `lease` for Consul versions below 1.4) the
-        tokens created using Vault's Consul secrets engine are created with a Time To Live (TTL) of 30 days. You can change
-        the lease duration by passing `-ttl=<duration>` to the command above where duration is a [duration format strings](/vault/docs/concepts/duration-format).
-
-1.  You may further limit a role's access by adding the optional parameters `consul_namespace` and
-    `partition`. Please refer to Consul's [namespace documentation](/consul/docs/enterprise/namespaces) and
-    [admin partition documentation](/consul/docs/enterprise/admin-partitions) for further information about
-    these features.
-
-    1.  For Consul version 1.11 and above, link an admin partition to a role:
-
-        ```shell-session
-        $ vault write consul/roles/my-role consul_roles="admin-management" partition="admin1"
-        Success! Data written to: consul/roles/my-role
-        ```
-
-    1.  For Consul versions 1.7 and above, link a Consul namespace to the role:
-
-        ```shell-session
-        $ vault write consul/roles/my-role consul_roles="namespace-management" consul_namespace="ns1"
-        Success! Data written to: consul/roles/my-role
-        ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-Generate a new credential by reading from the `/creds` endpoint with the name
-of the role:
-
-```shell-session
-$ vault read consul/creds/my-role
-Key                 Value
----                 -----
-lease_id            consul/creds/my-role/b2469121-f55f-53c5-89af-a3ba52b1d6d8
-lease_duration      768h
-lease_renewable     true
-accessor            c81b9cf7-2c4f-afc7-1449-4e442b831f65
-consul_namespace    ns1
-local               false
-partition           admin1
-token               642783bf-1540-526f-d4de-fe1ac1aed6f0
-```
-
-!> **Expired token rotation:** Once a token's TTL expires, then Consul operations will no longer be allowed with it.
-This requires you to have an external process to rotate tokens. At this time, the recommended approach for operators
-is to rotate the tokens manually by creating a new token using the `vault read consul/creds/my-role` command. Once
-the token is synchronized with Consul, apply the token to the agents using the Consul API or CLI.
-
-## Tutorial
-
-Refer to [Administer Consul Access Control Tokens with
-Vault](/consul/tutorials/vault-secure/vault-consul-secrets) for a
-step-by-step tutorial.
-
-## API
-
-The Consul secrets engine has a full HTTP API. Please see the
-[Consul secrets engine API](/vault/api-docs/secret/consul) for more
-details.
-
-[consul-mgmt-token]: /consul/api-docs/acl#acl_create
diff --git a/website/content/docs/secrets/cubbyhole.mdx b/website/content/docs/secrets/cubbyhole.mdx
deleted file mode 100644
index 841ced4c2e4..00000000000
--- a/website/content/docs/secrets/cubbyhole.mdx
+++ /dev/null
@@ -1,63 +0,0 @@
----
-layout: docs
-page_title: Cubbyhole - Secrets Engines
-description: >-
-  The cubbyhole secrets engine can store arbitrary secrets scoped to a single
-  token.
----
-
-# Cubbyhole secrets engine
-
-The `cubbyhole` secrets engine is used to store arbitrary secrets within the
-configured physical storage for Vault namespaced to a token. In `cubbyhole`,
-paths are scoped per token. No token can access another token's cubbyhole. When
-the token expires, its cubbyhole is destroyed.
-
-Also unlike the `kv` secrets engine, because the cubbyhole's lifetime is
-linked to that of an authentication token, there is no concept of a TTL or
-refresh interval for values contained in the token's cubbyhole.
-
-Writing to a key in the `cubbyhole` secrets engine will completely replace the
-old value.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-The `cubbyhole` secrets engine is enabled by default. It cannot be disabled,
-moved, or enabled multiple times.
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials. The `cubbyhole` secrets
-engine allows for writing keys with arbitrary values.
-
-1. Write arbitrary data:
-
-   ```text
-   $ vault write cubbyhole/my-secret my-value=s3cr3t
-   Success! Data written to: cubbyhole/my-secret
-   ```
-
-1. Read arbitrary data:
-
-   ```text
-   $ vault read cubbyhole/my-secret
-   Key         Value
-   ---         -----
-   my-value    s3cr3t
-   ```
-
-## Tutorial
-
-Refer to the [Cubbyhole Response Wrapping](/vault/tutorials/secrets-management/cubbyhole-response-wrapping)
-tutorial to learn how to securely distribute the initial token to the trusted entity.
-
-## API
-
-The Cubbyhole secrets engine has a full HTTP API. Please see the
-[Cubbyhole secrets engine API](/vault/api-docs/secret/cubbyhole) for more
-details.
diff --git a/website/content/docs/secrets/databases/cassandra.mdx b/website/content/docs/secrets/databases/cassandra.mdx
deleted file mode 100644
index 8f98fd286d1..00000000000
--- a/website/content/docs/secrets/databases/cassandra.mdx
+++ /dev/null
@@ -1,95 +0,0 @@
----
-layout: docs
-page_title: Cassandra - Database - Secrets Engines
-description: |-
-  Cassandra is one of the supported plugins for the database secrets engine.
-  This plugin generates database credentials dynamically based on configured
-  roles for the Cassandra database.
----
-
-# Cassandra database secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
-Cassandra is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-the Cassandra database.
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-## Capabilities
-
-| Plugin Name                 | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| --------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `cassandra-database-plugin` | Yes                      | Yes           | Yes (1.6+)   | Yes (1.7+)             |
-
-## Setup
-
-1. Vault will need a Cassandra user with the following permissions:
-   ```text
-   GRANT CREATE ON ALL ROLES to '<YOUR USER>';
-   GRANT ALTER ON ALL ROLES to '<YOUR USER>';
-   GRANT DROP ON ALL ROLES to '<YOUR USER>';
-   GRANT AUTHORIZE ON ALL ROLES to '<YOUR USER>';
-   ```
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```text
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information:
-
-    ```text
-    $ vault write database/config/my-cassandra-database \
-        plugin_name="cassandra-database-plugin" \
-        hosts=127.0.0.1 \
-        protocol_version=4 \
-        username=vaultuser \
-        password=vaultpass \
-        allowed_roles=my-role
-    ```
-
-1.  Configure a role that maps a name in Vault to an SQL statement to execute to
-    create the database credential:
-
-    ```text
-    $ vault write database/roles/my-role \
-        db_name=my-cassandra-database \
-        creation_statements="CREATE USER '{{username}}' WITH PASSWORD '{{password}}' NOSUPERUSER; \
-              GRANT SELECT ON ALL KEYSPACES TO {{username}};" \
-        default_ttl="1h" \
-        max_ttl="24h"
-    Success! Data written to: database/roles/my-role
-    ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault read database/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    password           7iO-FxlVCdj8szsgGgsL
-    username           v_vaultuser_my_role_6zjahr4mjn5c9prgucy1_1602541475
-    ```
-
-## API
-
-The full list of configurable options can be seen in the [Cassandra database plugin API](/vault/api-docs/secret/databases/cassandra) page.
-
-For more information on the database secrets engine's HTTP API please see the [Database secret secrets engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/couchbase.mdx b/website/content/docs/secrets/databases/couchbase.mdx
deleted file mode 100644
index a009cd91930..00000000000
--- a/website/content/docs/secrets/databases/couchbase.mdx
+++ /dev/null
@@ -1,143 +0,0 @@
----
-layout: docs
-page_title: Couchbase - Database - Secrets Engines
-description: |-
-  Couchbase is one of the supported plugins for the database secrets engine.
-  This plugin generates database credentials dynamically based on configured
-  roles for the Couchbase database.
----
-
-# Couchbase database secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
-Couchbase is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-the Couchbase database.
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-## Capabilities
-
-| Plugin Name                 | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| --------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `couchbase-database-plugin` | Yes                      | Yes           | Yes          | Yes (1.7+)             |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```bash
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection configuration:
-
-    ```bash
-    $ vault write database/config/my-couchbase-database \
-        plugin_name="couchbase-database-plugin" \
-        hosts="couchbase://127.0.0.1" \
-        tls=true \
-        base64pem="${BASE64PEM}" \
-        username="vaultuser" \
-        password="vaultpass" \
-        allowed_roles="my-*-role"
-    ```
-
-    Where `${BASE64PEM}` is the server's root certificate authority in PEM
-    format, encoded as a base64 string with no new lines.
-
-    To connect to clusters prior to version 6.5.0, a `bucket_name` must also
-    be configured:
-
-    ```bash
-    $ vault write database/config/my-couchbase-database \
-        plugin_name="couchbase-database-plugin" \
-        hosts="couchbase://127.0.0.1" \
-        tls=true \
-        base64pem="${BASE64PEM}" \
-        username="vaultuser" \
-        password="vaultpass" \
-        allowed_roles="my-*-role" \
-        bucket_name="travel-sample"
-    ```
-
-1.  You should consider rotating the admin password. Note that if you do, the
-    new password will never be made available through Vault, so you should
-    create a Vault-specific database admin user for this.
-
-    ```bash
-    vault write -force database/rotate-root/my-couchbase-database
-    ```
-
-## Usage
-
-After the secrets engine is configured, configure dynamic and static roles
-to enable generating credentials.
-
-### Dynamic roles
-
-1.  Configure a dynamic role that maps a name in Vault to a JSON string
-    specifying a Couchbase RBAC role. The default value for
-    `creation_statements` is a read-only admin role:
-    `{"Roles": [{"role":"ro_admin"}]}`.
-
-    ```bash
-    $ vault write database/roles/my-dynamic-role \
-        db_name="my-couchbase-database" \
-        creation_statements='{"Roles": [{"role":"ro_admin"}]}' \
-        default_ttl="5m" \
-        max_ttl="1h"
-    ```
-
-    Note that any groups specified in the creation statement must already exist.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```bash
-    $ vault read database/creds/my-dynamic-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-dynamic-role/wiLNQjtcvCOT1VnN3qnUJnBz
-    lease_duration     5m
-    lease_renewable    true
-    password           mhyM-Gs7IpmOPnSqXEDe
-    username           v-root-my-dynamic-role-eXnVr4gm55dpM1EVgTYz-1596815027
-    ```
-
-### Static roles
-
-1.  Configure a static role that maps a name in Vault to an existing couchbase
-    user.
-
-    ```bash
-    $ vault write database/static-roles/my-static-role \
-        db_name="my-couchbase-database" \
-        username="my-existing-couchbase-user" \
-        rotation_period=5m
-    ```
-
-1.  Retrieve the credentials from the `/static-creds` endpoint:
-
-    ```bash
-    $ vault read database/static-creds/my-static-role
-    Key                    Value
-    ---                    -----
-    last_vault_rotation    2020-08-07T16:50:48.393354+01:00
-    password               Z4-KH8F-VK5VJc0hSkXQ
-    rotation_period        5m
-    ttl                    4m39s
-    username               my-existing-couchbase-user
-    ```
-
-## API
-
-The full list of configurable options can be seen in the [Couchbase database plugin API](/vault/api-docs/secret/databases/couchbase) page.
-
-For more information on the database secrets engine's HTTP API please see the [Database secret secrets engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/custom.mdx b/website/content/docs/secrets/databases/custom.mdx
deleted file mode 100644
index 3f1b7c770aa..00000000000
--- a/website/content/docs/secrets/databases/custom.mdx
+++ /dev/null
@@ -1,367 +0,0 @@
----
-layout: docs
-page_title: Custom - Database - Secrets Engines
-description: |-
-  The database secrets engine allows new functionality to be added through a
-  plugin interface without needing to modify Vault's core code. This allows you
-  write your own code to generate credentials in any database you wish. It also
-  allows databases that require dynamically linked libraries to be used as
-  plugins while keeping Vault itself statically linked.
----
-
-# Custom database secrets engines
-
-~> The interface for custom database plugins has changed in Vault 1.6. Vault will
-continue to recognize the now deprecated version of this interface for some time.
-If you are using a plugin with the deprecated interface, you should upgrade to the
-newest version. See [Upgrading database plugins](#upgrading-database-plugins)
-for more details.
-
-~> **Advanced topic!** Plugin development is a highly advanced topic in Vault,
-and is not required knowledge for day-to-day usage. If you don't plan on writing
-any plugins, feel free to skip this section of the documentation.
-
-The database secrets engine allows new functionality to be added through a
-plugin interface without needing to modify Vault's core code. This allows you
-write your own code to generate credentials in any database you wish. It also
-allows databases that require dynamically linked libraries to be used as plugins
-while keeping Vault itself statically linked.
-
-Please read the [Plugins internals](/vault/docs/plugins) docs for more
-information about the plugin system before getting started building your
-Database plugin.
-
-Database plugins can be made to implement
-[plugin multiplexing](/vault/docs/plugins/plugin-architecture#plugin-multiplexing)
-which allows a single plugin process to be used for multiple database
-connections. To enable multiplexing, the plugin must be compiled with the
-`ServeMultiplex` function call from Vault's `dbplugin` package.
-
-
-## Plugin interface
-
-All plugins for the database secrets engine must implement the same interface. This interface
-is found in `sdk/database/dbplugin/v5/database.go`
-
-```go
-type Database interface {
-	// Initialize the database plugin. This is the equivalent of a constructor for the
-	// database object itself.
-	Initialize(ctx context.Context, req InitializeRequest) (InitializeResponse, error)
-
-	// NewUser creates a new user within the database. This user is temporary in that it
-	// will exist until the TTL expires.
-	NewUser(ctx context.Context, req NewUserRequest) (NewUserResponse, error)
-
-	// UpdateUser updates an existing user within the database.
-	UpdateUser(ctx context.Context, req UpdateUserRequest) (UpdateUserResponse, error)
-
-	// DeleteUser from the database. This should not error if the user didn't
-	// exist prior to this call.
-	DeleteUser(ctx context.Context, req DeleteUserRequest) (DeleteUserResponse, error)
-
-	// Type returns the Name for the particular database backend implementation.
-	// This type name is usually set as a constant within the database backend
-	// implementation, e.g. "mysql" for the MySQL database backend. This is used
-	// for things like metrics and logging. No behavior is switched on this.
-	Type() (string, error)
-
-	// Close attempts to close the underlying database connection that was
-	// established by the backend.
-	Close() error
-}
-```
-
-Each of the request and response objects can also be found in `sdk/database/dbplugin/v5/database.go`.
-
-In each of the requests, you will see at least 1 `Statements` object (in `UpdateUserRequest`
-they are in sub-fields). This object represents the set of commands to run for that particular
-operation. For the `NewUser` function, this is a set of commands to create the user (and often
-set permissions for that user). These statements are from the following fields in the API:
-
-| API Argument               | Request Object                                     |
-| -------------------------- | -------------------------------------------------- |
-| `creation_statements`      | `NewUserRequest.Statements.Commands`               |
-| `revocation_statements`    | `DeleteUserRequest.Statements.Commands`            |
-| `rollback_statements`      | `NewUserRequest.RollbackStatements.Commands`       |
-| `renew_statements`         | `UpdateUserRequest.Expiration.Statements.Commands` |
-| `rotation_statements`      | `UpdateUserRequest.Password.Statements.Commands`   |
-| `root_rotation_statements` | `UpdateUserRequest.Password.Statements.Commands`   |
-
-In many of the built-in plugins, they replace `{{name}}` (or `{{username}}`), `{{password}}`,
-and/or `{{expiration}}` with the associated values. It is up to your plugin to perform these
-string replacements. There is a helper function located in `sdk/database/helper/dbutil`
-called `QueryHelper` that assists in doing this string replacement. You are not required to
-use it, but it will make your plugin's behavior consistent with the built-in plugins.
-
-The `InitializeRequest` object contains a map of keys to values. This data is what the
-user specified as the configuration for the plugin. Your plugin should use this
-data to make connections to the database. The response object contains a similar configuration
-map. The response object should contain the configuration map that should be saved within Vault.
-This allows the plugin to manipulate the configuration prior to saving it.
-
-It is also passed a boolean value (`InitializeRequest.VerifyConnection`) indicating if your
-plugin should initialize a connection to the database during the `Initialize` call. This
-function is called when the configuration is written. This allows the user to know whether
-the configuration is valid and able to connect to the database in question. If this is set to
-false, no connection should be made during the `Initialize` call, but subsequent calls to the
-other functions will need to open a connection.
-
-## Serving a plugin
-
-### Serving a plugin with multiplexing
-
-~> Plugin multiplexing requires `github.com/hashicorp/vault/sdk v0.4.0` or above.
-
-The plugin runs as a separate binary outside of Vault, so the plugin itself
-will need a `main` function. Use the `ServeMultiplex` function within
-`sdk/database/dbplugin/v5` to serve your multiplexed plugin.
-
-Below is an example setup:
-
-```go
-package main
-
-import (
-	"github.com/hashicorp/vault/api"
-	dbplugin "github.com/hashicorp/vault/sdk/database/dbplugin/v5"
-)
-
-func main() {
-	apiClientMeta := &api.PluginAPIClientMeta{}
-	flags := apiClientMeta.FlagSet()
-	flags.Parse(os.Args[1:])
-
-	err := Run()
-	if err != nil {
-		log.Println(err)
-		os.Exit(1)
-	}
-}
-
-func Run() error {
-	dbplugin.ServeMultiplex(dbType.(dbplugin.New))
-
-	return nil
-}
-
-func New() (interface{}, error) {
-	db, err := newDatabase()
-	if err != nil {
-		return nil, err
-	}
-
-	// This middleware isn't strictly required, but highly recommended to prevent accidentally exposing
-	// values such as passwords in error messages. An example of this is included below
-	db = dbplugin.NewDatabaseErrorSanitizerMiddleware(db, db.secretValues)
-	return db, nil
-}
-
-type MyDatabase struct {
-	// Variables for the database
-	password string
-}
-
-func newDatabase() (MyDatabase, error) {
-	// ...
-	db := &MyDatabase{
-		// ...
-	}
-	return db, nil
-}
-
-func (db *MyDatabase) secretValues() map[string]string {
-	return map[string]string{
-		db.password: "[password]",
-	}
-}
-```
-
-Replacing `MyDatabase` with the actual implementation of your database plugin.
-
-### Serving a plugin without multiplexing
-
-Serving a plugin without multiplexing requires calling the `Serve` function
-from `sdk/database/dbplugin/v5` to serve your plugin.
-
-The setup is exactly the same as the multiplexed case above, except for the
-`Run` function:
-
-```go
-func Run() error {
-	dbType, err := New()
-	if err != nil {
-		return err
-	}
-
-	dbplugin.Serve(dbType.(dbplugin.Database))
-
-	return nil
-}
-```
-
-## Running your plugin
-
-The above main package, once built, will supply you with a binary of your
-plugin. We also recommend if you are planning on distributing your plugin to
-build with [gox](https://github.com/mitchellh/gox) for cross platform builds.
-
-To use your plugin with the database secrets engine you need to place the binary in the
-plugin directory as specified in the [plugin internals](/vault/docs/plugins) docs.
-
-You should now be able to register your plugin into the Vault catalog. To do
-this your token will need sudo permissions.
-
-```shell-session
-$ vault write sys/plugins/catalog/database/mydatabase-database-plugin \
-    sha256="..." \
-    command="mydatabase"
-Success! Data written to: sys/plugins/catalog/database/mydatabase-database-plugin
-```
-
-Now you should be able to configure your plugin like any other:
-
-```shell-session
-$ vault write database/config/mydatabase \
-    plugin_name=mydatabase-database-plugin \
-    allowed_roles="readonly" \
-    myplugins_connection_details="..."
-```
-
-## Updating database plugins to leverage plugin versioning
-
-@include 'plugin-versioning.mdx'
-
-In addition to the `Database` interface above, database plugins can then also
-implement the
-[`PluginVersioner`](https://github.com/hashicorp/vault/blob/sdk/v0.6.0/sdk/logical/logical.go#L150-L154)
-interface:
-
-```go
-// PluginVersioner is an optional interface to return version info.
-type PluginVersioner interface {
-	// PluginVersion returns the version for the backend
-	PluginVersion() PluginVersion
-}
-
-type PluginVersion struct {
-	Version string
-}
-```
-
-## Upgrading database plugins to leverage plugin multiplexing
-
-### Background
-
-Scaling many external plugins can become resource intensive. To address
-performance problems with scaling external plugins, database plugins can be
-made to implement [plugin multiplexing](/vault/docs/plugins/plugin-architecture#plugin-multiplexing)
-which allows a single plugin process to be used for multiple database
-connections. To enable multiplexing, the plugin must be compiled with the
-`ServeMultiplex` function call from Vault's `dbplugin` package.
-
-### Upgrading your database plugin to leverage plugin multiplexing
-
-There is only one step required to upgrade from a non-multiplexed to a
-multiplexed database plugin: Change the `Serve` function call to `ServeMultiplex`.
-
-This will run the RPC server for the plugin just as before. However, the
-`ServeMultiplex` function takes the factory function directly as its argument.
-This factory function is a function that returns an object that implements the
-[`dbplugin.Database` interface](/vault/docs/secrets/databases/custom#plugin-interface).
-
-### When should plugin multiplexing be avoided?
-
-Some use cases that should avoid plugin multiplexing might include:
-
-* Plugin process level separation is required
-* Avoiding restart across all mounts/database connections for a plugin type on
-  crashes or plugin reload calls
-
-## Upgrading database plugins to the v5 interface
-
-### Background
-
-In Vault 1.6, the database interface changed. The new version is referred to as version 5
-and the previous version as version 4. This is due to prior versioning of the interface
-that was not explicitly exposed.
-
-The new interface was introduced for several reasons:
-
-1. [Password policies](/vault/docs/concepts/password-policies) introduced in Vault 1.5 required
-   that Vault be responsible for generating passwords. In the prior version, the database
-   plugin was responsible for generating passwords. This prevented integration with
-   password policies.
-2. Passwords needed to be generated by database plugins. This meant that plugin authors
-   were responsible for generating secure passwords. This should be done with a helper
-   function available within the Vault SDK, however there was nothing preventing an
-   author from generating insecure passwords.
-3. There were a number of inconsistencies within the version 4 interface that made it
-   confusing for authors. For instance: passwords were handled in 3 different ways.
-   `CreateUser` generated a password and returned it, `SetCredentials` receives a password
-   via a configuration struct and returns it, and `RotateRootCredentials` generated a
-   password and was expected to return an updated copy of its entire configuration
-   with the new password.
-4. The `SetCredentials` and `RotateRootCredentials` used for static credential rotation,
-   and rotating the root user's credentials respectively were essentially the same operation:
-   change a user's password. The only practical difference was which user it was referring
-   to. This was especially evident when `SetCredentials` was used when rotating root
-   credentials (unless static credential rotation wasn't supported by the plugin in question).
-5. The old interface included both `Init` and `Initialize` adding to the confusion.
-
-The new interface is roughly modeled after a [gRPC](https://grpc.io/) interface. It has improved
-future compatibility by not requiring changes to the interface definition to add additional data
-in the requests or responses. It also simplifies the interface by merging several into a single
-function call.
-
-### Upgrading your custom database
-
-Vault 1.6 supports both version 4 and version 5 database plugins. The support for version 4
-plugins will be removed in a future release. Version 5 database plugins will not function with
-Vault prior to version 1.6. If you upgrade your database plugins, ensure that you are only using
-Vault 1.6 or later. To determine if a plugin is using version 4 or version 5, the following is a
-list of changes in no particular order that you can check against your plugin to determine
-the version:
-
-1. The import path for version 4 is `github.com/hashicorp/vault/sdk/database/dbplugin`
-   whereas the import path for version 5 is `github.com/hashicorp/vault/sdk/database/dbplugin/v5`
-2. Version 4 has the following functions: `Initialize`, `Init`, `CreateUser`, `RenewUser`,
-   `RevokeUser`, `SetCredentials`, `RotateRootCredentials`, `Type`, and `Close`. You can see the
-   full function signatures in `sdk/database/dbplugin/plugin.go`.
-3. Version 5 has the following functions: `Initialize`, `NewUser`, `UpdateUser`, `DeleteUser`,
-   `Type`, and `Close`. You can see the full function signatures in
-   `sdk/database/dbplugin/v5/database.go`.
-
-If you are using a version 4 custom database plugin, the following are basic instructions
-for upgrading to version 5.
-
--> In version 4, password generation was the responsibility of the plugin. This is no longer
-the case with version 5. Vault is responsible for generating passwords and passing them to
-the plugin via `NewUserRequest.Password` and `UpdateUserRequest.Password.NewPassword`.
-
-1. Change the import path from `github.com/hashicorp/vault/sdk/database/dbplugin` to
-   `github.com/hashicorp/vault/sdk/database/dbplugin/v5`. The package name is the same, so any
-   references to `dbplugin` can remain as long as those symbols exist within the new package
-   (such as the `Serve` function).
-2. An easy way to see what functions need to be implemented is to put the following as a
-   global variable within your package: `var _ dbplugin.Database = (*MyDatabase)(nil)`. This
-   will fail to compile if the `MyDatabase` type does not adhere to the `dbplugin.Database` interface.
-3. Replace `Init` and `Initialize` with the new `Initialize` function definition. The fields that
-   `Init` was taking (`config` and `verifyConnection`) are now wrapped into `InitializeRequest`.
-   The returned `map[string]interface{}` object is now wrapped into `InitializeResponse`.
-   Only `Initialize` is needed to adhere to the `Database` interface.
-4. Update `CreateUser` to `NewUser`. The `NewUserRequest` object contains the username and
-   password of the user to be created. It also includes a list of statements for creating the
-   user as well as several other fields that may or may not be applicable. Your custom plugin
-   should use the password provided in the request, not generate one. If you generate a password
-   instead, Vault will not know about it and will give the caller the wrong password.
-5. `SetCredentials`, `RotateRootCredentials`, and `RenewUser` are combined into `UpdateUser`.
-   The request object, `UpdateUserRequest` contains three parts: the username to change, a
-   `ChangePassword` and a `ChangeExpiration` object. When one of the objects is not nil, this
-   indicates that particular field (password or expiration) needs to change. For instance, if
-   the `ChangePassword` field is not-nil, the user's password should be changed. This is
-   equivalent to calling `SetCredentials`. If the `ChangeExpiration` field is not-nil, the
-   user's expiration date should be changed. This is equivalent to calling `RenewUser`.
-   Many databases don't need to do anything with the updated expiration.
-6. Update `RevokeUser` to `DeleteUser`. This is the simplest change. The username to be
-   deleted is enclosed in the `DeleteUserRequest` object.
diff --git a/website/content/docs/secrets/databases/db2.mdx b/website/content/docs/secrets/databases/db2.mdx
deleted file mode 100644
index 978e12879b8..00000000000
--- a/website/content/docs/secrets/databases/db2.mdx
+++ /dev/null
@@ -1,29 +0,0 @@
----
-layout: docs
-page_title: IBM Db2 - Database - Credentials
-description: |-
-  Manage credentials for IBM Db2 using Vault's LDAP secrets engine.
----
-
-# IBM db2
-
-Access to Db2 is managed by facilities that reside outside the Db2 database system. By
-default, user authentication is completed by a security facility that relies on operating
-system based authentication of users and passwords. This means that the lifecycle of user
-identities in Db2 aren't capable of being managed using SQL statements and Vault's
-database secrets engine.
-
-To provide flexibility in accommodating authentication needs, Db2 ships with authentication
-[plugin modules](https://www.ibm.com/docs/en/db2/11.5?topic=ins-ldap-based-authentication-group-lookup-support)
-for Lightweight Directory Access Protocol (LDAP). This enables the Db2 database manager to
-authenticate users and obtain group membership defined in an LDAP directory, removing the
-requirement that users and groups be defined to the operating system.
-
-Vault's [LDAP secrets engine](/vault/docs/secrets/ldap) can be used to manage the lifecycle
-of credentials for Db2 environments that have been configured to delegate user authentication
-and group membership to an LDAP server.
-
-## Tutorial
-
-Refer to the [IBM Db2 Credential Management](/vault/tutorials/secrets-management/ibm-db2-openldap)
-tutorial to learn how to use Vault to manage both static and dynamic credentials for access to Db2.
diff --git a/website/content/docs/secrets/databases/elasticdb.mdx b/website/content/docs/secrets/databases/elasticdb.mdx
deleted file mode 100644
index 6c35b73c2e9..00000000000
--- a/website/content/docs/secrets/databases/elasticdb.mdx
+++ /dev/null
@@ -1,210 +0,0 @@
----
-layout: docs
-page_title: Elasticsearch - Database - Secrets Engines
-description: >-
-  Elasticsearch is one of the supported plugins for the database secrets engine.
-  This
-
-  plugin generates database credentials dynamically based on configured roles
-
-  for Elasticsearch.
----
-
-# Elasticsearch database secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
-Elasticsearch is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-Elasticsearch.
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-## Capabilities
-
-| Plugin Name                     | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| ------------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `elasticsearch-database-plugin` | Yes                      | Yes           | Yes (1.6+)   | Yes (1.8+)             |
-
-## Getting started
-
-To take advantage of this plugin, you must first enable Elasticsearch's native realm of security by activating X-Pack. These
-instructions will walk you through doing this using Elasticsearch 7.1.1.
-
-### Enable X-Pack security in elasticsearch
-
-Read [Securing the Elastic Stack](https://www.elastic.co/guide/en/elastic-stack-overview/7.1/elasticsearch-security.html) and
-follow [its instructions for enabling X-Pack Security](https://www.elastic.co/guide/en/elasticsearch/reference/7.1/setup-xpack.html).
-
-### Enable encrypted communications
-
-This plugin communicates with Elasticsearch's security API. ES requires TLS for these communications so they can be
-encrypted.
-
-To set up TLS in Elasticsearch, first read [encrypted communications](https://www.elastic.co/guide/en/elastic-stack-overview/7.1/encrypting-communications.html)
-and go through its instructions on [encrypting HTTP client communications](https://www.elastic.co/guide/en/elasticsearch/reference/7.1/configuring-tls.html#tls-http).
-
-After enabling TLS on the Elasticsearch side, you'll need to convert the .p12 certificates you generated to other formats so they can be
-used by Vault. [Here is an example using OpenSSL](https://stackoverflow.com/questions/15144046/converting-pkcs12-certificate-into-pem-using-openssl)
-to convert our .p12 certs to the pem format.
-
-Also, on the instance running Elasticsearch, we needed to install our newly generated CA certificate that was originally in the .p12 format.
-We did this by converting the .p12 CA cert to a pem, and then further converting that
-[pem to a crt](https://stackoverflow.com/questions/13732826/convert-pem-to-crt-and-key), adding that crt to `/usr/share/ca-certificates/extra`,
-and using `sudo dpkg-reconfigure ca-certificates`.
-
-The above instructions may vary if you are not using an Ubuntu machine. Please ensure you're using the methods specific to your operating
-environment. Describing every operating environment is outside the scope of these instructions.
-
-### Set up passwords
-
-When done, verify that you've enabled X-Pack by running `$ $ES_HOME/bin/elasticsearch-setup-passwords interactive`. You'll
-know it's been set up successfully if it takes you through a number of password-inputting steps.
-
-### Create a role for Vault
-
-Next, in Elasticsearch, we recommend that you create a user just for Vault to use in managing secrets.
-
-To do this, first create a role that will allow Vault the minimum privileges needed to administer users and passwords by performing a
-POST to Elasticsearch. To do this, we used the `elastic` vaultuser whose password we created in the
-`$ $ES_HOME/bin/elasticsearch-setup-passwords interactive` step.
-
-```shell-session
-$ curl \
-    -X POST \
-    -H "Content-Type: application/json" \
-    -d '{"cluster": ["manage_security"]}' \
-    http://vaultuser:$PASSWORD@localhost:9200/_xpack/security/role/vault
-```
-
-Next, create a user for Vault associated with that role.
-
-```shell-session
-$ curl \
-    -X POST \
-    -H "Content-Type: application/json" \
-    -d @data.json \
-    http://vaultuser:$PASSWORD@localhost:9200/_xpack/security/user/vault
-```
-
-The contents of `data.json` in this example are:
-
-```json
-{
- "password" : "myPa55word",
- "roles" : [ "vault" ],
- "full_name" : "Hashicorp Vault",
- "metadata" : {
-   "plugin_name": "Vault Plugin Database Elasticsearch",
-   "plugin_url": "https://github.com/hashicorp/vault-plugin-database-elasticsearch"
- }
-}
-```
-
-Now, Elasticsearch is configured and ready to be used with Vault.
-
-## Setup
-
-1. Enable the database secrets engine if it is not already enabled:
-
-   ```shell-session
-   $ vault secrets enable database
-   Success! Enabled the database secrets engine at: database/
-   ```
-
-   By default, the secrets engine will enable at the name of the engine. To
-   enable the secrets engine at a different path, use the `-path` argument.
-
-1. Configure Vault with the proper plugin and connection information:
-
-   ```shell-session
-   $ vault write database/config/my-elasticsearch-database \
-       plugin_name="elasticsearch-database-plugin" \
-       allowed_roles="internally-defined-role,externally-defined-role" \
-       username=vault \
-       password=myPa55word \
-       url=http://localhost:9200 \
-       ca_cert=/usr/share/ca-certificates/extra/elastic-stack-ca.crt.pem \
-       client_cert=$ES_HOME/config/certs/elastic-certificates.crt.pem \
-       client_key=$ES_HOME/config/certs/elastic-certificates.key.pem
-   ```
-
-## Usage
-
-After the secrets engine is configured, configure dynamic and static roles to enable generating credentials.
-
-### Dynamic Roles
-
-Dynamic roles generate new credentials for every request.
-
-1. Configure a role that maps a name in Vault to a role definition in Elasticsearch.
-   This is considered the most secure type of role because nobody can perform
-   a privilege escalation by editing a role's privileges out-of-band in
-   Elasticsearch:
-
-   ```shell-session
-   $ vault write database/roles/internally-defined-role \
-         db_name=my-elasticsearch-database \
-         creation_statements='{"elasticsearch_role_definition": {"indices": [{"names":["*"], "privileges":["read"]}]}}' \
-         default_ttl="1h" \
-         max_ttl="24h"
-   ```
-
-1. Alternatively, configure a role that maps a name in Vault to a pre-existing
-   role definition in Elasticsearch:
-
-   ```shell-session
-   $ vault write database/roles/externally-defined-role \
-         db_name=my-elasticsearch-database \
-         creation_statements='{"elasticsearch_roles": ["pre-existing-role-in-elasticsearch"]}' \
-         default_ttl="1h" \
-         max_ttl="24h"
-   ```
-
-1. Generate a new credential by reading from the `/creds` endpoint with the name
-   of the role:
-
-   ```shell-session
-   $ vault read database/creds/my-role
-   Key                Value
-   ---                -----
-   lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-   lease_duration     1h
-   lease_renewable    true
-   password           0ZsueAP-dqCNGZo35M0n
-   username           v-vaultuser-my-role-AgIViC5TdQHBdeiCxae0-1602541724
-   ```
-
-### Static Roles
-
-Static roles return the same credentials for every request. The credentials are rotated based on the schedule provided.
-
-1. Configure a static role that maps a name in Vault to a pre-existing user in Elasticsearch:
-
-   ```shell-session
-   $ vault write database/static-roles/my-static-role\
-         db_name=my-elasticsearch-database \
-         username=my-existing-elasticsearch-uername \
-         rotation_period="24h"
-   ```
-
-1. Retrieve the current username and password from the `/static-creds` endpoint:
-
-   ```shell-session
-   $ vault read database/static-creds/my-static-role
-   Key                    Value
-   ---                    -----
-   last_vault_rotation    2023-09-14T08:24:39.650491913-04:00
-   password               current-password
-   rotation_period        24h
-   ttl                    23h59m59s
-   username               my-existing-elasticsearch-uername
-   ```
-
-## API
-
-The full list of configurable options can be seen in the [Elasticsearch database plugin API](/vault/api-docs/secret/databases/elasticdb) page.
-
-For more information on the database secrets engine's HTTP API please see the
-[Database secrets engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/hanadb.mdx b/website/content/docs/secrets/databases/hanadb.mdx
deleted file mode 100644
index 9c8b77f967e..00000000000
--- a/website/content/docs/secrets/databases/hanadb.mdx
+++ /dev/null
@@ -1,85 +0,0 @@
----
-layout: docs
-page_title: HANA - Database - Secrets Engines
-description: |-
-  HANA is one of the supported plugins for the database secrets engine. This
-  plugin generates database credentials dynamically based on configured roles
-  for the HANA database.
----
-
-# HANA database secrets engine
-
-HANA is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-the HANA database.
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-## Capabilities
-
-| Plugin Name              | Root Credential Rotation | Dynamic Roles | Static Roles |
-| ------------------------ | ------------------------ | ------------- | ------------ |
-| `hanadb-database-plugin` | Yes (1.6+)               | Yes           | Yes (1.6+)   |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```text
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information:
-
-    ```text
-    $ vault write database/config/my-hana-database \
-        plugin_name=hana-database-plugin \
-        connection_url="hdb://{{username}}:{{password}}@localhost:1433" \
-        allowed_roles="my-role" \
-        username="vaultuser" \
-        password="vaultpass"
-    ```
-
-1.  Configure a role that maps a name in Vault to an SQL statement to execute to
-    create the database credential:
-
-    ```text
-    $ vault write database/roles/my-role \
-        db_name=my-hana-database \
-        creation_statements="CREATE USER {{name}} PASSWORD {{password}} VALID UNTIL '{{expiration}}';\
-            CALL GRANT_ACTIVATED_ROLE ( 'sap.hana.admin.roles::Monitoring', '{{name}}' );" \
-        default_ttl="12h" \
-        max_ttl="24h"
-    Success! Data written to: database/roles/my-role
-    ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault read database/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    password           sU4zWnITaABEP-Zwy4sF
-    username           v_vaultuser_my_role_jQbCLE6P2VtgsqPBXK0m_1602541873
-    ```
-
-## API
-
-The full list of configurable options can be seen in the [HANA database plugin API](/vault/api-docs/secret/databases/hanadb) page.
-
-For more information on the database secrets engine's HTTP API please see the
-[Database secrets engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/index.mdx b/website/content/docs/secrets/databases/index.mdx
deleted file mode 100644
index c08c0614a44..00000000000
--- a/website/content/docs/secrets/databases/index.mdx
+++ /dev/null
@@ -1,355 +0,0 @@
----
-layout: docs
-page_title: Database - Secrets Engines
-description: |-
-  The database secrets engine generates database credentials dynamically based
-  on configured roles. It works with a number of different databases through a
-  plugin interface. There are a number of built-in database types and an exposed
-  framework for running custom database types for extendability.
----
-
-# Databases
-
-The database secrets engine generates database credentials dynamically based on
-configured roles. It works with a number of different databases through a plugin
-interface. There are a number of built-in database types, and an exposed framework
-for running custom database types for extendability. This means that services
-that need to access a database no longer need to hardcode credentials: they can
-request them from Vault, and use Vault's [leasing mechanism](/vault/docs/concepts/lease)
-to more easily roll keys. These are referred to as "dynamic roles" or "dynamic
-secrets".
-
-Since every service is accessing the database with unique credentials, it makes
-auditing much easier when questionable data access is discovered. You can track
-it down to the specific instance of a service based on the SQL username.
-
-Vault makes use of its own internal revocation system to ensure that users
-become invalid within a reasonable time of the lease expiring.
-
-### Static roles
-
-Vault also supports **static roles** for all database secrets engines. Static
-roles are a 1-to-1 mapping of Vault roles to usernames in a database. With
-static roles, Vault stores and automatically rotates passwords for the
-associated database user based on a configurable period of time or rotation
-schedule.
-
-When a client requests credentials for the static role, Vault returns the
-current password for whichever database user is mapped to the requested role.
-With static roles, anyone with the proper Vault policies can access the
-associated user account in the database.
-
-<Warning title="Do not use static roles for root database credentials">
-   Do not manage the same root database credentials that you provide to Vault in
-   <tt>config/</tt> with static roles.
-
-   Vault does not distinguish between standard credentials and root credentials
-   when rotating passwords. If you assign your root credentials to a static
-   role, any dynamic or static users managed by that database configuration will
-   fail after rotation because the password for <tt>config/</tt> is no longer
-   valid.
-
-   If you need to rotate root credentials, use the
-   [Rotate root credentials](/vault/api-docs/secret/databases#rotate-root-credentials)
-   API endpoint.
-</Warning>
-
-Consult the [database capabilities table](#db-capabilities-table) to determine
-if your chosen database backend supports static roles.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the database secrets engine:
-
-   ```shell-session
-   $ vault secrets enable database
-   Success! Enabled the database secrets engine at: database/
-   ```
-
-   By default, the secrets engine will enable at the name of the engine. To
-   enable the secrets engine at a different path, use the `-path` argument.
-
-1. Configure Vault with the proper plugin and connection information:
-
-   ```shell-session
-   $ vault write database/config/my-database \
-       plugin_name="..." \
-       connection_url="..." \
-       allowed_roles="..." \
-       username="..." \
-       password="..." \
-   ```
-
-   ~> It is highly recommended a user within the database is created
-   specifically for Vault to use. This user will be used to manipulate
-   dynamic and static users within the database. This user is called the
-   "root" user within the documentation.
-
-   Vault will use the user specified here to create/update/revoke database
-   credentials. That user must have the appropriate permissions to perform
-   actions upon other database users (create, update credentials, delete, etc.).
-
-   This secrets engine can configure multiple database connections. For details
-   on the specific configuration options, please see the database-specific
-   documentation.
-
-1. After configuring the root user, it is highly recommended you rotate that user's
-   password such that the vault user is not accessible by any users other than
-   Vault itself:
-
-   ```shell-session
-   $ vault write -force database/rotate-root/my-database
-   ```
-
-   !> When this is done, the password for the user specified in the previous step
-   is no longer accessible. Because of this, it is highly recommended that a
-   user is created specifically for Vault to use to manage database
-   users.
-
-1. Configure a role that maps a name in Vault to a set of creation statements to
-   create the database credential:
-
-   ```shell-session
-   $ vault write database/roles/my-role \
-       db_name=my-database \
-       creation_statements="..." \
-       default_ttl="1h" \
-       max_ttl="24h"
-   Success! Data written to: database/roles/my-role
-   ```
-
-   The `{{username}}` and `{{password}}` fields will be populated by the plugin
-   with dynamically generated values. In some plugins the `{{expiration}}` field is also supported.
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```shell-session
-    $ vault read database/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    password           FSREZ1S0kFsZtLat-y94
-    username           v-vaultuser-e2978cd0-ugp7iqI2hdlff5hfjylJ-1602537260
-    ```
-
-## Database capabilities
-
-As of Vault 1.6, all databases support dynamic roles and static roles. All plugins except MongoDB Atlas support rotating
-the root user's credentials. MongoDB Atlas cannot support rotating the root user's credentials because it uses a public
-and private key pair to authenticate.
-
-<a id="db-capabilities-table" />
-
-
-| Database                                                               | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization | Credential Types          |
-| ---------------------------------------------------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |---------------------------|
-| [Cassandra](/vault/docs/secrets/databases/cassandra)                         | Yes                      | Yes           | Yes (1.6+)   | Yes (1.7+)             | password                     |
-| [Couchbase](/vault/docs/secrets/databases/couchbase)                         | Yes                      | Yes           | Yes          | Yes (1.7+)             | password                     |
-| [Elasticsearch](/vault/docs/secrets/databases/elasticdb)                     | Yes                      | Yes           | Yes (1.6+)   | Yes (1.8+)             | password                     |
-| [HanaDB](/vault/docs/secrets/databases/hanadb)                               | Yes (1.6+)               | Yes           | Yes (1.6+)   | Yes (1.12+)            | password                     |
-| [InfluxDB](/vault/docs/secrets/databases/influxdb)                           | Yes                      | Yes           | Yes (1.6+)   | Yes (1.8+)             | password                     |
-| [MongoDB](/vault/docs/secrets/databases/mongodb)                             | Yes                      | Yes           | Yes          | Yes (1.7+)             | password                     |
-| [MongoDB Atlas](/vault/docs/secrets/databases/mongodbatlas)                  | No                       | Yes           | Yes          | Yes (1.8+)             | password, client_certificate |
-| [MSSQL](/vault/docs/secrets/databases/mssql)                                 | Yes                      | Yes           | Yes          | Yes (1.7+)             | password                     |
-| [MySQL/MariaDB](/vault/docs/secrets/databases/mysql-maria)                   | Yes                      | Yes           | Yes          | Yes (1.7+)             | password, gcp_iam            |
-| [Oracle](/vault/docs/secrets/databases/oracle)                               | Yes                      | Yes           | Yes          | Yes (1.7+)             | password                     |
-| [PostgreSQL](/vault/docs/secrets/databases/postgresql)                       | Yes                      | Yes           | Yes          | Yes (1.7+)             | password, gcp_iam            |
-| [Redis](/vault/docs/secrets/databases/redis)                                 | Yes                      | Yes           | Yes          | No                     | password                     |
-| [Redis ElastiCache](/vault/docs/secrets/databases/rediselasticache)          | No                       | No            | Yes          | No                     | password                     |
-| [Redshift](/vault/docs/secrets/databases/redshift)                           | Yes                      | Yes           | Yes          | Yes (1.8+)             | password                     |
-| [Snowflake](/vault/docs/secrets/databases/snowflake)                         | Yes                      | Yes           | Yes          | Yes (1.8+)             | password, rsa_private_key    |
-
-## Custom plugins
-
-This secrets engine allows custom database types to be run through the exposed
-plugin interface. Please see the [custom database plugin](/vault/docs/secrets/databases/custom)
-for more information.
-
-## Credential types
-
-Database systems support a variety of authentication methods and credential types.
-The database secrets engine supports management of credentials alternative to usernames
-and passwords. The [credential_type](/vault/api-docs/secret/databases#credential_type)
-and [credential_config](/vault/api-docs/secret/databases#credential_config) parameters
-of dynamic and static roles configure the credential that Vault will generate and
-make available to database plugins. See the documentation of individual database
-plugins for the credential types they support and usage examples.
-
-## Schedule-based static role rotation
-
-The database secrets engine supports configuring schedule-based automatic
-credential rotation for static roles with the
-[rotation_schedule](/vault/api-docs/secret/databases#rotation_schedule) field.
-For example:
-
-```shell-session
-$ vault write database/static-roles/my-role \
-    db_name=my-database \
-    username="vault" \
-    rotation_schedule="0 * * * SAT"
-```
-
-This configuration will set the role's credential rotation to occur on Saturday
-at 00:00.
-
-Additionally, this schedule-based approach allows for optionally configuring a
-[rotation_window](/vault/api-docs/secret/databases#rotation_window) in which
-the automatic rotation is allowed to occur. For example:
-
-```shell-session
-$ vault write database/static-roles/my-role \
-    db_name=my-database \
-    username="vault" \
-    rotation_window="1h" \
-    rotation_schedule="0 * * * SAT"
-```
-
-This configuration will set rotations to occur on Saturday at 00:00. The 1
-hour `rotation_window` will prevent the rotation from occuring after 01:00. If
-the static role's credential is not rotated during this window, due to a failure
-or otherwise, it will not be rotated until the next scheduled rotation.
-
-!> The `rotation_period` and `rotation_schedule` fields are
-mutually exclusive. One of them must be set but not both.
-
-## Password generation
-
-Passwords are generated via [Password Policies](/vault/docs/concepts/password-policies).
-Databases can optionally set a password policy for use across all roles or at the
-individual role level for that database. For example, each time you call
-`vault write database/config/my-database` you can specify a password policy for all
-roles using `my-database`. Each database has a default password policy defined as:
-20 characters with at least 1 uppercase character, at least 1 lowercase character,
-at least 1 number, and at least 1 dash character.
-
-The default password generation can be represented as the following password policy:
-
-```hcl
-length = 20
-
-rule "charset" {
-	charset = "abcdefghijklmnopqrstuvwxyz"
-	min-chars = 1
-}
-rule "charset" {
-	charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-	min-chars = 1
-}
-rule "charset" {
-	charset = "0123456789"
-	min-chars = 1
-}
-rule "charset" {
-	charset = "-"
-	min-chars = 1
-}
-```
-
-## Disable character escaping
-
-As of Vault 1.10, you can now specify the option `disable_escaping` with a value of `true ` in
-some secrets engines to prevent Vault from escaping special characters in the username and password
-fields. This is necessary for some alternate connection string formats, such as ADO with MSSQL or Azure
-SQL. See the [databases secrets engine API docs](/vault/api-docs/secret/databases#common-fields) and reference
-individual plugin documentation to determine support for this parameter.
-
-For example, when the password contains URL-escaped characters like `#` or `%` they will
-remain as so instead of becoming `%23` and `%25` respectively.
-
-```shell-session
-$ vault write database/config/my-mssql-database \
-plugin_name="mssql-database-plugin" \
-connection_url='server=localhost;port=1433;user id={{username}};password={{password}};database=mydb;' \
-username="root" \
-password='your#StrongPassword%' \
-disable_escaping="true"
-```
-
-## Unsupported databases
-
-### AWS DynamoDB
-
-Amazon Web Services (AWS) DynamoDB is a fully managed, serverless, key-value NoSQL database service. While
-DynamoDB is not supported by the database secrets engine, you can use the [AWS secrets engine](/vault/docs/secrets/aws)
-to provision dynamic credentials capable of accessing DynamoDB.
-
-1. Verify you have the AWS secrets engine enabled and configured.
-
-1. Create a role with the necessary permissions for your users to access DynamoDB. For example:
-
-   ```shell-session
-   $ vault write aws/roles/aws-dynamodb-read \
-           credential_type=iam_user \
-           policy_document=-<<EOF
-   {
-   	"Version": "2012-10-17",
-   	"Statement": [
-   		{
-   			"Effect": "Allow",
-   			"Action": [
-   				"dynamodb:DescribeTable",
-   				"dynamodb:GetItem",
-   				"dynamodb:GetRecords"
-   			],
-   			"Resource": "arn:aws:dynamodb:us-east-1:1234567891:table/example-table"
-   		},
-   		{
-   			"Effect": "Allow",
-   			"Action": "dynamodb:ListTables",
-   			"Resource": "*"
-   		}
-   	]
-   }
-   EOF
-   ```
-
-1. Generate dynamic credentials for DynamoDB using the `aws-dynamodb-read` role:
-
-   ```shell-session
-   $ vault read aws/creds/aws-dynamodb-read
-   Key                Value
-   ---                -----
-   lease_id           aws/creds/my-role/kbSnl9WSDzOXQerd8GiVh75N.DACNl
-   lease_duration     1h
-   lease_renewable    true
-   access_key         AKALMNOP123456
-   secret_key         xY4XhS3AsM3s+R33tCaybsT2XI6BVL+vF+khbbYD
-   security_token     <nil>
-   ```
-
-1. Use the dynamic credentials generated by Vault to access DynamoDB. For example, to connect with the
-   the [AWS CLI](https://docs.aws.amazon.com/cli/latest/reference/dynamodb/).
-
-   ```shell-session
-   $ aws dynamodb list-tables --region us-east-1
-   {
-       "TableNames": [
-           "example-table"
-       ]
-   }
-   ```
-
-## Tutorial
-
-Refer to the following step-by-step tutorials for more information:
-
-- [Secrets as a Service: Dynamic Secrets](/vault/tutorials/db-credentials/database-secrets)
-- [Database Root Credential Rotation](/vault/tutorials/db-credentials/database-root-rotation)
-- [Database Static Roles and Credential Rotation](/vault/tutorials/db-credentials/database-creds-rotation)
-
-## API
-
-The database secrets engine has a full HTTP API. Please see the [Database secret
-secrets engine API](/vault/api-docs/secret/databases) for more details.
diff --git a/website/content/docs/secrets/databases/influxdb.mdx b/website/content/docs/secrets/databases/influxdb.mdx
deleted file mode 100644
index 5ad22123859..00000000000
--- a/website/content/docs/secrets/databases/influxdb.mdx
+++ /dev/null
@@ -1,88 +0,0 @@
----
-layout: docs
-page_title: InfluxDB - Database - Secrets Engines
-description: |-
-  InfluxDB is one of the supported plugins for the database secrets engine.
-  This plugin generates database credentials dynamically based on configured
-  roles for the InfluxDB database.
----
-
-# InfluxDB database secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
-InfluxDB is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-the InfluxDB database.
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-## Capabilities
-
-| Plugin Name                | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| -------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `influxdb-database-plugin` | Yes                      | Yes           | Yes (1.6+)   | Yes (1.8+)             |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```text
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information:
-
-    ```text
-    $ vault write database/config/my-influxdb-database \
-        plugin_name="influxdb-database-plugin" \
-        host=127.0.0.1 \
-        username=vaultuser \
-        password=vaultpass \
-        allowed_roles=my-role
-    ```
-
-1.  Configure a role that maps a name in Vault to an SQL statement to execute to
-    create the database credential:
-
-    ```text
-    $ vault write database/roles/my-role \
-        db_name=my-influxdb-database \
-        creation_statements="CREATE USER \"{{username}}\" WITH PASSWORD '{{password}}'; \
-              GRANT ALL ON \"vault\" TO \"{{username}}\";" \
-        default_ttl="1h" \
-        max_ttl="24h"
-    Success! Data written to: database/roles/my-role
-    ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault read database/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    password           ux-TAAKTSZex6jgXhe67
-    username           v_vaultuser_my_role_7XjvivMy80m7qQughmbk_1602541922
-    ```
-
-## API
-
-The full list of configurable options can be seen in the [InfluxDB database
-plugin API](/vault/api-docs/secret/databases/influxdb) page.
-
-For more information on the database secrets engine's HTTP API please see the [Database secret
-secrets engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/mongodb.mdx b/website/content/docs/secrets/databases/mongodb.mdx
deleted file mode 100644
index f69d337fdbc..00000000000
--- a/website/content/docs/secrets/databases/mongodb.mdx
+++ /dev/null
@@ -1,115 +0,0 @@
----
-layout: docs
-page_title: MongoDB - Database - Secrets Engines
-description: |-
-  MongoDB is one of the supported plugins for the database secrets engine. This
-  plugin generates database credentials dynamically based on configured roles
-  for the MongoDB database.
----
-
-# MongoDB database secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
-MongoDB is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-the MongoDB database and also supports
-[Static Roles](/vault/docs/secrets/databases#static-roles).
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-## Capabilities
-
-| Plugin Name               | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| ------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `mongodb-database-plugin` | Yes                      | Yes           | Yes          | Yes (1.7+)             |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```text
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information:
-
-    ```text
-    $ vault write database/config/my-mongodb-database \
-        plugin_name=mongodb-database-plugin \
-        allowed_roles="my-role" \
-        connection_url="mongodb://{{username}}:{{password}}@mongodb.acme.com:27017/admin?tls=true" \
-        username="vaultuser" \
-        password="vaultpass!"
-    ```
-
-1.  Configure a role that maps a name in Vault to a MongoDB command that executes and
-    creates the database credential:
-
-    ```text
-    $ vault write database/roles/my-role \
-        db_name=my-mongodb-database \
-        creation_statements='{ "db": "admin", "roles": [{ "role": "readWrite" }, {"role": "read", "db": "foo"}] }' \
-        default_ttl="1h" \
-        max_ttl="24h"
-    Success! Data written to: database/roles/my-role
-    ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault read database/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    password           LEm-lcDJ2k0Hi05FvizN
-    username           v-vaultuser-my-role-ItceCZHlp0YGn90Puy9Z-1602542024
-    ```
-
-## Client x509 certificate authentication
-
-This plugin supports using MongoDB's [x509 Client-side Certificate Authentication](https://docs.mongodb.com/manual/core/security-x.509/)
-
-To use this authentication mechanism, configure the plugin:
-
-```shell-session
-$ vault write database/config/my-mongodb-database \
-    plugin_name=mongodb-database-plugin \
-    allowed_roles="my-role" \
-    connection_url="mongodb://@mongodb.acme.com:27017/admin" \
-    tls_certificate_key=@/path/to/client.pem \
-    tls_ca=@/path/to/client.ca
-```
-
-Note: `tls_certificate_key` and `tls_ca` map to [`tlsCertificateKeyFile`](https://docs.mongodb.com/manual/reference/program/mongo/#cmdoption-mongo-tlscertificatekeyfile)
-and [`tlsCAFile`](https://docs.mongodb.com/manual/reference/program/mongo/#cmdoption-mongo-tlscafile) configuration options
-from MongoDB with the exception that the Vault parameters are the contents of those files, not filenames. As such,
-the two options are independent of each other. See the [MongoDB Configuration Options](https://docs.mongodb.com/manual/reference/program/mongo/)
-for more information.
-
-## Tutorial
-
-Refer to [Database Secrets Engine with
-MongoDB](/vault/tutorials/db-credentials/database-mongodb) for a
-step-by-step tutorial.
-
-## API
-
-The full list of configurable options can be seen in the [MongoDB database
-plugin API](/vault/api-docs/secret/databases/mongodb) page.
-
-For more information on the database secrets engine's HTTP API please see the
-[Database secrets engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/mongodbatlas.mdx b/website/content/docs/secrets/databases/mongodbatlas.mdx
deleted file mode 100644
index 29b5dac99e8..00000000000
--- a/website/content/docs/secrets/databases/mongodbatlas.mdx
+++ /dev/null
@@ -1,144 +0,0 @@
----
-layout: docs
-page_title: MongoDB Atlas- Database - Secrets Engines
-description: |-
-  MongoDB Atlas is one of the supported plugins for the database secrets engine. This
-  plugin generates database credentials dynamically based on configured roles
-  for MongoDB Atlas databases.
----
-
-# MongoDB atlas database secrets engine
-
-MongoDB Atlas is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-MongoDB Atlas databases. It cannot support rotating the root user's credentials because
-it uses a public and private key pair to authenticate.
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-<Note>
-  The information below relates to the MongoDB Altas <b>database plugin</b> for the Vault database secrets engine.
-  Refer to the <a href="vault/docs/secrets/mongodbatlas">MongoDB Atlas secrets engine</a>
-  for information about using the MongoDB Atlas secrets engine for the Vault.
-</Note>
-## Capabilities
-
-| Plugin Name                    | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization | Credential Types             |
-| ------------------------------ | ------------------------ | ------------- | ------------ | ---------------------- | ---------------------------- |
-| `mongodbatlas-database-plugin` | No                       | Yes           | Yes          | Yes (1.8+)             | password, client_certificate |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```shell-session
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information:
-
-    ```shell-session
-    $ vault write database/config/my-mongodbatlas-database \
-        plugin_name=mongodbatlas-database-plugin \
-        allowed_roles="*" \
-        public_key="jmskfortvf" \
-        private_key="ea6acbc7-8a30-4a3f-812e-6f869c08bcd1" \
-        project_id="4f96cad208574fd14aa8dda3a"
-    ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permissions, it can generate credentials.
-
-#### Password credentials
-
-1.  Configure a role that maps a name in Vault to a MongoDB Atlas command that executes and
-    creates the database user credential:
-
-    ```shell-session
-    $ vault write database/roles/my-password-role \
-        db_name=my-mongodbatlas-database \
-        creation_statements='{"database_name": "admin","roles": [{"databaseName":"admin","roleName":"atlasAdmin"}]}' \
-        default_ttl="1h" \
-        max_ttl="24h"
-    Success! Data written to: database/roles/my-password-role
-    ```
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```shell-session
-    $ vault read database/creds/my-password-role
-        Key                Value
-        ---                -----
-        lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-        lease_duration     1h
-        lease_renewable    true
-        password           FBYwnnh-fwc0quxtKf11
-        username           v-my-password-role-DKbQEg6uRn
-    ```
-
-#### Client certificate credentials
-
-1.  Configure a role that maps a name in Vault to a MongoDB Atlas command that executes and
-    creates the X509 type database user credential:
-
-    ```shell-session
-    $ vault write database/roles/my-dynamic-certificate-role \
-      db_name=my-mongodbatlas-database \
-      creation_statements='{"database_name": "$external", "x509Type": "CUSTOMER", "roles": [{"databaseName":"<db_name>","roleName":"readWrite"}]}' \
-      default_ttl="1h" \
-      max_ttl="24h" \
-      credential_type="client_certificate" \
-      credential_config=ca_cert="$(cat path/to/ca_cert.pem)" \
-      credential_config=ca_private_key="$(cat path/to/private_key.pem)" \
-      credential_config=key_type="rsa" \
-      credential_config=key_bits=2048 \
-      credential_config=signature_bits=256 \
-      credential_config=common_name_template="{{.DisplayName}}_{{.RoleName}}_{{unix_time}}"
-    Success! Data written to: database/roles/my-dynamic-certificate-role
-    ```
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-of the role:
-
-    ```shell-session
-    $ vault read database/creds/my-dynamic-certificate-role
-      Key                 Value
-      ---                 -----
-      request_id          b6556b2d-c379-5a92-465d-6597c506c821
-      lease_id            database/creds/my-dynamic-certificate-role/AZ5tao6NjLJctx7fm1bujKEL
-      lease_duration      1h
-      lease_renewable     true
-      client_certificate  -----BEGIN CERTIFICATE-----
-                          ...
-                          -----END CERTIFICATE-----
-      private_key         -----BEGIN PRIVATE KEY-----
-                          ...
-                          -----END PRIVATE KEY-----
-      private_key_type    rsa
-      username            CN=token_my-dynamic-certificate-role_1677262121
-    ```
-
-## Client certificate authentication
-
-MongoDB Atlas supports [X.509 client certificate based authentication](https://www.mongodb.com/docs/manual/tutorial/configure-x509-client-authentication/)
-for enhanced authentication security as an alternative to username and password authentication.
-The MongoDB Atlas database plugin can be used to manage client certificate credentials for
-MongoDB Atlas users by using `client_certificate` [credential_type](/vault/api-docs/secret/databases#credential_type).
-
-See the [usage](/vault/docs/secrets/databases/mongodbatlas#usage) section for examples using dynamic roles.
-
-## API
-
-The full list of configurable options can be seen in the [MongoDB Atlas Database
-Plugin HTTP API](/vault/api-docs/secret/databases/mongodbatlas) page.
-
-For more information on the database secrets engine's HTTP API please see the
-[Database Secrets Engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/mssql.mdx b/website/content/docs/secrets/databases/mssql.mdx
deleted file mode 100644
index adc005492e8..00000000000
--- a/website/content/docs/secrets/databases/mssql.mdx
+++ /dev/null
@@ -1,195 +0,0 @@
----
-layout: docs
-page_title: MSSQL - Database - Secrets Engines
-description: |-
-
-  MSSQL is one of the supported plugins for the database secrets engine. This
-  plugin generates database credentials dynamically based on configured roles
-  for the MSSQL database.
----
-
-# MSSQL database secrets engine
-
-MSSQL is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-the MSSQL database.
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-The following privileges are needed by the plugin for minimum functionality. Additional privileges may be needed 
-depending on the SQL configured on the database roles. 
-
-```sql
--- Create Login
-CREATE LOGIN vault_login WITH PASSWORD = '<password>';
-
--- Create User
-CREATE user vault_user for login vault_login;
-
--- Grant Permissions
-GRANT ALTER ANY LOGIN TO "vault_user";
-GRANT ALTER ANY USER TO "vault_user";
-GRANT ALTER ANY CONNECTION TO "vault_login";
-GRANT CONTROL ON SCHEMA::<schema_name> TO "vault_user";
-EXEC sp_addrolemember "db_accessadmin", "vault_user";
-```
-
-## Capabilities
-
-| Plugin Name             | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| ----------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `mssql-database-plugin` | Yes                      | Yes           | Yes          | Yes (1.7+)             |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```text
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information:
-
-    ```text
-    $ vault write database/config/my-mssql-database \
-        plugin_name=mssql-database-plugin \
-        connection_url='sqlserver://{{username}}:{{password}}@localhost:1433' \
-        allowed_roles="my-role" \
-        username="vaultuser" \
-        password="yourStrong(!)Password"
-    ```
-
-    ~> Note: The example above demonstrates a connection with SQL server user named `vaultuser`, although the user `vaultuser` might be Windows Authentication user part of Active Directory domain, for example: `DOMAIN\vaultuser`.
-
-    In this case, we've configured Vault with the user "vaultuser" and password
-    "yourStrong(!)Password", connecting to an instance at "localhost" on port 1433. It is
-    not necessary that Vault has the vaultuser login, but the user must have privileges
-    to create logins and manage processes. The fixed server roles
-    `securityadmin` and `processadmin` are examples of built-in roles that grant
-    these permissions. The user also must have privileges to create database
-    users and grant permissions in the databases that Vault manages. The fixed
-    database roles `db_accessadmin` and `db_securityadmin` are examples or
-    built-in roles that grant these permissions.
-
-1.  Configure a role that maps a name in Vault to an SQL statement to execute to
-    create the database credential:
-
-    ```text
-    $ vault write database/roles/my-role \
-        db_name=my-mssql-database \
-        creation_statements="CREATE LOGIN [{{name}}] WITH PASSWORD = '{{password}}';\
-            CREATE USER [{{name}}] FOR LOGIN [{{name}}];\
-            GRANT SELECT ON SCHEMA::dbo TO [{{name}}];" \
-        default_ttl="1h" \
-        max_ttl="24h"
-    Success! Data written to: database/roles/my-role
-    ```
-
-~> **Be aware!** If no `revocation_statement` is supplied,
-vault will execute the default revocation procedure.
-In larger databases, this might cause connection timeouts.
-Please specify a revocation statement in such a scenario.
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault read database/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    password           wJKpk9kg-T1Ma7qQfS8y
-    username           v-vaultuser-my-role-r7kCtKGGr3eYQP1OGR6G-1602542258
-    ```
-
-## Example for Azure SQL database
-
-Here is a complete example using Azure SQL Database. Note that databases in Azure SQL Database are [contained databases](https://docs.microsoft.com/en-us/sql/relational-databases/databases/contained-databases) and that we do not create a login for the user; instead, we associate the password directly with the user itself. Also note that you will need a separate connection and role for each Azure SQL database for which you want to generate dynamic credentials. You can use a single database backend mount for all these databases or use a separate mount for each of them. In this example, we use a custom path for the database backend.
-
-<Note>
-  Azure SQL databases may use different authentication mechanism that are configured on the SQL server. Vault only supports SQL authentication. Azure AD authentication is not supported.
-</Note>
-
-First, we mount a database backend at the azuresql path with `vault secrets enable -path=azuresql database`. Then we configure a connection called "testvault" to connect to a database called "test-vault", using "azuresql" at the beginning of our path:
-
-    ~> Note: If you are using a windows vault client with cmd.exe, change the single quotes to double quotes in the connection string.  Windows cmd.exe does not interpret single quotes as a continous string
-    
-```shell-session
-$ vault write azuresql/config/testvault \
-    plugin_name=mssql-database-plugin \
-    connection_url='server=hashisqlserver.database.windows.net;port=1433;user id=admin;password=pAssw0rd;database=test-vault;app name=vault;' \
-    allowed_roles="test"
-```
-
-Now we add a role called "test" for use with the "testvault" connection:
-
-```shell-session
-$ vault write azuresql/roles/test \
-    db_name=testvault \
-    creation_statements="CREATE USER [{{name}}] WITH PASSWORD = '{{password}}';" \
-    revocation_statements="DROP USER IF EXISTS [{{name}}]" \
-    default_ttl="1h" \
-    max_ttl="24h"
-```
-
-We can now use this role to dynamically generate credentials for the Azure SQL database, test-vault:
-
-```shell-session
-$ vault read azuresql/creds/test
-Key            	Value
----            	-----
-lease_id       	azuresql/creds/test/2e5b1e0b-a081-c7e1-5622-39f58e79a719
-lease_duration 	1h0m0s
-lease_renewable	true
-password       	cZ-BJy-SqO5tKwazAuUP
-username       	v-token-test-tr2t4x9pxvq1z8878s9s-1513446795
-```
-
-When we no longer need the backend, we can unmount it with `vault unmount azuresql`. Now, you can use the MSSQL Database Plugin with your Azure SQL databases.
-
-## Amazon RDS
-
-The MSSQL plugin supports databases running on [Amazon RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_SQLServer.html),
-but there are differences that need to be accommodated. A key limitation is that Amazon RDS doesn't support
-the "sysadmin" role, which is used by default during Vault's revocation process for MSSQL. The workaround
-is to add custom revocation statements to roles, for example:
-
-```shell
-vault write database/roles/my-role revocation_statements="\
-   USE my_database \
-   IF EXISTS \
-     (SELECT name \
-      FROM sys.database_principals \
-      WHERE name = N'{{name}}') \
-   BEGIN \
-     DROP USER [{{name}}] \
-   END \
-
-   IF EXISTS \
-     (SELECT name \
-      FROM master.sys.server_principals \
-      WHERE name = N'{{name}}') \
-   BEGIN \
-     DROP LOGIN [{{name}}] \
-   END"
-```
-
-## API
-
-The full list of configurable options can be seen in the [MSSQL database
-plugin API](/vault/api-docs/secret/databases/mssql) page.
-
-For more information on the database secrets engine's HTTP API please see the
-[Database secrets engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/mysql-maria.mdx b/website/content/docs/secrets/databases/mysql-maria.mdx
deleted file mode 100644
index 02c29d0b9c6..00000000000
--- a/website/content/docs/secrets/databases/mysql-maria.mdx
+++ /dev/null
@@ -1,243 +0,0 @@
----
-layout: docs
-page_title: MySQL/MariaDB - Database - Secrets Engines
-description: |-
-  MySQL is one of the supported plugins for the database secrets engine. This
-  plugin generates database credentials dynamically based on configured roles
-  for the MySQL database.
----
-
-# MySQL/MariaDB database secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
-MySQL is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-the MySQL database, and also supports [Static
-Roles](/vault/docs/secrets/databases#static-roles).
-
-This plugin has a few different instances built into vault, each instance is for
-a slightly different MySQL driver. The only difference between these plugins is
-the length of usernames generated by the plugin as different versions of mysql
-accept different lengths. The available plugins are:
-
-- mysql-database-plugin
-- mysql-aurora-database-plugin
-- mysql-rds-database-plugin
-- mysql-legacy-database-plugin
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-## Capabilities
-
-| Plugin Name                                                    | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| -------------------------------------------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| Depends (see: [above](#mysql-mariadb-database-secrets-engine)) | Yes                      | Yes           | Yes          | Yes (1.7+)             |
-
-## Setup
-
-1. Enable the database secrets engine if it is not already enabled:
-
-   ```text
-   $ vault secrets enable database
-   Success! Enabled the database secrets engine at: database/
-   ```
-
-   By default, the secrets engine will enable at the name of the engine. To
-   enable the secrets engine at a different path, use the `-path` argument.
-
-1. Configure Vault with the proper plugin and connection information:
-
-   ```text
-   $ vault write database/config/my-mysql-database \
-       plugin_name=mysql-database-plugin \
-       connection_url="{{username}}:{{password}}@tcp(127.0.0.1:3306)/" \
-       allowed_roles="my-role" \
-       username="vaultuser" \
-       password="vaultpass"
-   ```
-
-1. Configure a role that maps a name in Vault to an SQL statement to execute to
-   create the database credential:
-
-   ```text
-   $ vault write database/roles/my-role \
-       db_name=my-mysql-database \
-       creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';GRANT SELECT ON *.* TO '{{name}}'@'%';" \
-       default_ttl="1h" \
-       max_ttl="24h"
-   Success! Data written to: database/roles/my-role
-   ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1. Generate a new credential by reading from the `/creds` endpoint with the name
-   of the role:
-
-   ```text
-   $ vault read database/creds/my-role
-   Key                Value
-   ---                -----
-   lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-   lease_duration     1h
-   lease_renewable    true
-   password           yY-57n3X5UQhxnmFRP3f
-   username           v_vaultuser_my-role_crBWVqVh2Hc1
-   ```
-
-## Client x509 certificate authentication
-
-This plugin supports using MySQL's [x509 Client-side Certificate Authentication](https://dev.mysql.com/doc/refman/8.0/en/using-encrypted-connections.html#using-encrypted-connections-client-side-configuration)
-
-To use this authentication mechanism, configure the plugin:
-
-```shell-session
-$ vault write database/config/my-mysql-database \
-    plugin_name=mysql-database-plugin \
-    allowed_roles="my-role" \
-    connection_url="user:password@tcp(localhost:3306)/test" \
-    tls_certificate_key=@/path/to/client.pem \
-    tls_ca=@/path/to/client.ca
-```
-
-Note: `tls_certificate_key` and `tls_ca` map to [`ssl-cert (combined with ssl-key)`](https://dev.mysql.com/doc/refman/8.0/en/connection-options.html#option_general_ssl-cert)
-and [`ssl-ca`](https://dev.mysql.com/doc/refman/8.0/en/connection-options.html#option_general_ssl-ca) configuration options
-from MySQL with the exception that the Vault parameters are the contents of those files, not filenames. As such,
-the two options are independent of each other. See the [MySQL Connection Options](https://dev.mysql.com/doc/refman/8.0/en/connection-options.html)
-for more information.
-
-## Examples
-
-### Using wildcards in grant statements
-
-MySQL supports using wildcards in grant statements. These are sometimes needed
-by applications which expect access to a large number of databases inside MySQL.
-This can be realized by using a wildcard in the grant statement. For example if
-you want the user created by Vault to have access to all databases starting with
-`fooapp_` you could use the following creation statement:
-
-```text
-CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'; GRANT SELECT ON `fooapp\_%`.* TO '{{name}}'@'%';
-```
-
-MySQL expects the part in which the wildcards are to be placed inside backticks.
-If you want to add this creation statement to Vault via the Vault CLI you cannot
-simply paste the above statement on the CLI because the shell will interpret the
-text between the backticks as something that must be executed. The easiest way to
-get around this is to encode the creation statement as Base64 and feed this to Vault.
-For example:
-
-```shell-session
-$ vault write database/roles/my-role \
-    db_name=mysql \
-    creation_statements="Q1JFQVRFIFVTRVIgJ3t7bmFtZX19J0AnJScgSURFTlRJRklFRCBCWSAne3twYXNzd29yZH19JzsgR1JBTlQgU0VMRUNUIE9OIGBmb29hcHBcXyVgLiogVE8gJ3t7bmFtZX19J0AnJSc7" \
-    default_ttl="1h" \
-    max_ttl="24h"
-```
-
-### Rotating root credentials in MySQL 5.6
-
-The default root rotation setup for MySQL uses the `ALTER USER` syntax present
-in MySQL 5.7 and up. For MySQL 5.6, the [root rotation
-statements](/vault/api-docs/secret/databases#root_rotation_statements)
-must be configured to use the old `SET PASSWORD` syntax. For example:
-
-```shell-session
-$ vault write database/config/my-mysql-database \
-    plugin_name=mysql-database-plugin \
-    connection_url="{{username}}:{{password}}@tcp(127.0.0.1:3306)/" \
-    root_rotation_statements="SET PASSWORD = PASSWORD('{{password}}')" \
-    allowed_roles="my-role" \
-    username="root" \
-    password="mysql"
-```
-
-For a guide in root credential rotation, see [Database Root Credential
-Rotation](/vault/tutorials/db-credentials/database-root-rotation).
-
-## API
-
-The full list of configurable options can be seen in the [MySQL database plugin
-API](/vault/api-docs/secret/databases/mysql-maria) page.
-
-For more information on the database secrets engine's HTTP API please see the
-[Database secrets engine API](/vault/api-docs/secret/databases) page.
-
-## Authenticating to Cloud DBs via IAM
-
-### Google Cloud
-
-Aside from IAM roles denoted by [Google's CloudSQL documentation](https://cloud.google.com/sql/docs/postgres/add-manage-iam-users#creating-a-database-user),
-the following SQL privileges are needed by the service account's DB user for minimum functionality with Vault.
-Additional privileges may be needed depending on the SQL configured on the database roles.
-
-```sql
--- Enable service account to create users within DB
-GRANT SELECT, CREATE, CREATE USER ON <database>.<object> TO "test-user"@"%" WITH GRANT OPTION;
-```
-
-### Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```shell-session
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information. Here you can explicitly enable GCP IAM authentication
-    and use [Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc#how-to) to authenticate.
-
-    ~> **Note**: For Google Cloud IAM, the Protocol is `cloudsql-mysql` instead of `tcp`.
-
-    ```shell-session
-    $ vault write database/config/my-mysql-database \
-        plugin_name="mysql-database-plugin" \
-        allowed_roles="my-role" \
-        connection_url="user@cloudsql-mysql(project:region:instance)/mysql" \
-        auth_type="gcp_iam"
-    ```
-
-    You can also configure the connection and authenticate by directly passing in the service account credentials
-    as an encoded JSON string:
-
-    ```shell-session
-    $ vault write database/config/my-mysql-database \
-        plugin_name="mysql-database-plugin" \
-        allowed_roles="my-role" \
-        connection_url="user@cloudsql-mysql(project:region:instance)/mysql" \
-        auth_type="gcp_iam" \
-        service_account_json="@my_credentials.json"
-    ```
-
-1.  Configure a new role in Vault but override the default revocation statements
-    so Vault will drop the user instead:
-
-    ```shell-session
-       $ vault write database/roles/my-role \
-           db_name=my-mysql-database \
-           creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';GRANT SELECT ON *.* TO '{{name}}'@'%';" \
-           revocation_statements="DROP USER '{{name}}'@'%';" \
-           default_ttl="1h" \
-           max_ttl="24h"
-    ```
-
-1.  When you finish configuring the new role, generate credentials as before:
-
-    ```shell-session
-       $ vault read database/creds/my-role
-       Key                Value
-       ---                -----
-       lease_id           database/creds/my-role/2f6b629f-7ah2-7b19-24b9-ad879a8d4bf2
-       lease_duration     1h
-       lease_renewable    true
-       password           vY-57n3X5UQhxnmGTK7g
-       username           v_vaultuser_my-role_frBYNfYh3Kw3
-    ```
diff --git a/website/content/docs/secrets/databases/oracle.mdx b/website/content/docs/secrets/databases/oracle.mdx
deleted file mode 100644
index 8479d4bd688..00000000000
--- a/website/content/docs/secrets/databases/oracle.mdx
+++ /dev/null
@@ -1,384 +0,0 @@
----
-layout: docs
-page_title: Oracle - database - secrets engines
-description: |-
-  Oracle is one of the supported plugins for the database secrets engine. This
-  plugin generates database credentials dynamically based on configured roles
-  for the Oracle database.
----
-
-# Oracle database secrets engine
-
--> The Oracle database plugin is now available for use with the database secrets engine for HCP Vault on AWS.
-   The plugin configuration (including installation of the Oracle Instant Client library) is managed
-   by HCP. Refer to the HCP Vault tab for more information.
-
-This secrets engine is a part of the database secrets engine. If you have not read the
-[database backend](/vault/docs/secrets/databases) page, please do so now as it explains how to set up the database backend and
-gives an overview of how the engine functions.
-
-Oracle is one of the supported plugins for the database secrets engine. It is capable of dynamically generating
-credentials based on configured roles for Oracle databases. It also supports [static roles](/vault/docs/secrets/databases#static-roles).
-
-## Capabilities
-
-<Tabs>
-<Tab heading="Vault" group="vault">
-
-~> The Oracle database plugin is not bundled in the core Vault code tree and can be
-found at its own git repository here:
-[hashicorp/vault-plugin-database-oracle](https://github.com/hashicorp/vault-plugin-database-oracle)
-
-~> This plugin is not compatible with Alpine Linux out of the box.
-
-| Plugin Name                                                          | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| -------------------------------------------------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| Customizable (see: [Custom Plugins](/vault/docs/secrets/databases/custom)) | Yes                      | Yes           | Yes          | Yes (1.7+)             |
-
-</Tab>
-<Tab heading="HCP Vault" group="hcp">
-
-~> The Oracle Database Plugin is managed by the HCP platform. No extra installation steps are required for HCP Vault.
-
-| Plugin Name                                                          | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| -------------------------------------------------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `vault-plugin-database-oracle`                                       | Yes                      | Yes           | Yes          | Yes                    |
-
-</Tab>
-</Tabs>
-
-## Setup
-
-<Tabs>
-<Tab heading="Vault" group="vault">
-
-The Oracle database plugin is not bundled in the core Vault code tree and can be
-found at its own git repository here:
-[hashicorp/vault-plugin-database-oracle](https://github.com/hashicorp/vault-plugin-database-oracle)
-
-For linux/amd64, pre-built binaries can be found at [the releases page](https://releases.hashicorp.com/vault-plugin-database-oracle)
-
-Before running the plugin you will need to have the Oracle Instant Client
-library installed. These can be downloaded from Oracle. The libraries will need to
-be placed in the default library search path or defined in the ld.so.conf configuration files.
-
-The following privileges are needed by the plugin for minimum functionality. Additional privileges may be needed 
-depending on the SQL configured on the database roles. 
-
-```sql
-GRANT CREATE USER to vault WITH ADMIN OPTION;
-GRANT ALTER USER to vault WITH ADMIN OPTION;
-GRANT DROP USER to vault WITH ADMIN OPTION;
-GRANT CONNECT to vault WITH ADMIN OPTION;
-GRANT CREATE SESSION to vault WITH ADMIN OPTION;
-GRANT SELECT on gv$session to vault;
-GRANT SELECT on v_$sql to vault;
-GRANT ALTER SYSTEM to vault WITH ADMIN OPTION;
-```
-
-~> Vault needs `ALTER SYSTEM` to terminate user sessions when revoking users. This may be 
-substituted with a stored procedure and granted to the Vault administrator user.
-
-If you are running Vault with [mlock enabled](/vault/docs/configuration#disable_mlock),
-you will need to enable ipc_lock capabilities for the plugin binary.
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```shell-session
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Download and register the plugin:
-
-    ```shell-session
-    $ vault write sys/plugins/catalog/database/oracle-database-plugin \
-        sha256="..." \
-        command=vault-plugin-database-oracle
-    ```
-
-1.  Configure Vault with the proper plugin and connection information:
-
-    ```shell-session
-    $ vault write database/config/my-oracle-database \
-        plugin_name=oracle-database-plugin \
-        connection_url="{{username}}/{{password}}@localhost:1521/OraDoc.localhost" \
-        allowed_roles="my-role" \
-        username="VAULT_SUPER_USER" \
-        password="myreallysecurepassword"
-    ```
-
-   If Oracle uses SSL, see the [connecting using SSL](/vault/docs/secrets/databases/oracle#connect-using-ssl) example.
-
-   If the version of Oracle you are using has a container database, you will need to connect to one of the
-   pluggable databases rather than the container database in the `connection_url` field.
-
-1. It is highly recommended that you immediately rotate the "root" user's password, see
-   [Rotate Root Credentials](/vault/api-docs/secret/databases#rotate-root-credentials) for more details.
-   This will ensure that only Vault is able to access the "root" user that Vault uses to
-   manipulate dynamic & static credentials.
-
-   !> **Use caution:** the root user's password will not be accessible once rotated so it is highly
-   recommended that you create a user for Vault to use rather than using the actual root user.
-
-1. Configure a role that maps a name in Vault to an SQL statement to execute to
-   create the database credential:
-
-   ```shell-session
-   $ vault write database/roles/my-role \
-       db_name=my-oracle-database \
-       creation_statements='CREATE USER {{username}} IDENTIFIED BY "{{password}}"; GRANT CONNECT TO {{username}}; GRANT CREATE SESSION TO {{username}};' \
-       default_ttl="1h" \
-       max_ttl="24h"
-   ```
-
-   Note: The `creation_statements` may be specified in a file and interpreted by the Vault CLI using the `@` symbol:
-
-   ```shell-session
-   $ vault write database/roles/my-role \
-       creation_statements=@creation_statements.sql \
-       ...
-   ```
-
-   See the [Commands](/vault/docs/commands#files) docs for more details.
-
-### Connect using SSL
-
-If the Oracle server Vault is trying to connect to uses an SSL listener, the database
-plugin will require extra configuration using the `connection_url` parameter:
-
-```shell-session
-vault write database/config/oracle \
-  plugin_name=vault-plugin-database-oracle \
-  connection_url='{{username}}/{{password}}@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=<host>)(PORT=<port>))(CONNECT_DATA=(SERVICE_NAME=<service_name>))(SECURITY=(SSL_SERVER_CERT_DN="<cert_dn>")(MY_WALLET_DIRECTORY=<path_to_wallet>)))' \
-  allowed_roles="my-role" \
-  username="admin" \
-  password="password"
-```
-
-For example, the SSL server certificate distinguished name and path to the Oracle Wallet
-to use for connection and verification could be configured using:
-
-```shell-session
-vault write database/config/oracle \
-  plugin_name=vault-plugin-database-oracle \
-  connection_url='{{username}}/{{password}}@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=hashicorp.com)(PORT=1523))(CONNECT_DATA=(SERVICE_NAME=ORCL))(SECURITY=(SSL_SERVER_CERT_DN="CN=hashicorp.com,OU=TestCA,O=HashiCorp=com")(MY_WALLET_DIRECTORY=/etc/oracle/wallets)))' \
-  allowed_roles="my-role" \
-  username="admin" \
-  password="password"
-```
-
-#### Wallet permissions
-
-~> **Note**: The wallets used when connecting via SSL should be available on every Vault
-server when using high availability clusters.
-
-The wallet used by Vault should be in a well known location with the proper filesystem permissions. For example, if Vault is running as the `vault` user,
-the wallet directory may be setup as follows:
-
-```shell-session
-mkdir -p /etc/vault/wallets
-cp cwallet.sso /etc/vault/wallets/cwallet.sso
-chown -R vault:vault /etc/vault
-chmod 600 /etc/vault/wallets/cwallet.sso
-```
-
-### Using TNS names
-
-~> **Note**: The `tnsnames.ora` file and environment variable used when connecting via SSL should
-be available on every Vault server when using high availability clusters.
-
-Vault can optionally use TNS names in the connection string when connecting to Oracle databases using a `tnsnames.ora` file. An example
-of a `tnsnames.ora` file may look like the following:
-
-```shell-session
-AWSEAST=
-(DESCRIPTION =
-  (ADDRESS = (PROTOCOL = TCPS)(HOST = hashicorp.us-east-1.rds.amazonaws.com)(PORT = 1523))
-  (CONNECT_DATA =
-    (SERVER = DEDICATED)
-    (SID = ORCL)
-  )
-  (SECURITY =
-      (SSL_SERVER_CERT_DN = "CN=hashicorp.rds.amazonaws.com/OU=RDS/O=Amazon.com/L=Seattle/ST=Washington/C=US")
-      (MY_WALLET_DIRECTORY = /etc/oracle/wallet/east)
-  )
-)
-
-AWSWEST=
-(DESCRIPTION =
-  (ADDRESS = (PROTOCOL = TCPS)(HOST = hashicorp.us-west-1.rds.amazonaws.com)(PORT = 1523))
-  (CONNECT_DATA =
-    (SERVER = DEDICATED)
-    (SID = ORCL)
-  )
-  (SECURITY =
-      (SSL_SERVER_CERT_DN = "CN=hashicorp.rds.amazonaws.com/OU=RDS/O=Amazon.com/L=Seattle/ST=Washington/C=US")
-      (MY_WALLET_DIRECTORY = /etc/oracle/wallet/west)
-  )
-)
-```
-
-To configure Vault to use TNS names, set the following environment variable on the Vault server:
-
-```shell-session
-TNS_ADMIN=/path/to/tnsnames/directory
-```
-
-~> **Note**: If Vault returns a "could not open file" error, double check that
-the `TNS_ADMIN` environment variable is available to the Vault server.
-
-Use the alias in the `connection_url` parameter on the database configuration:
-
-```
-vault write database/config/oracle-east \
-    plugin_name=vault-plugin-database-oracle \
-    connection_url="{{username}}/{{password}}@AWSEAST" \
-    allowed_roles="my-role" \
-    username="VAULT_SUPER_USER" \
-    password="myreallysecurepassword"
-
-vault write database/config/oracle-west \
-    plugin_name=vault-plugin-database-oracle \
-    connection_url="{{username}}/{{password}}@AWSWEST" \
-    allowed_roles="my-role" \
-    username="VAULT_SUPER_USER" \
-    password="myreallysecurepassword"
-```
-
-</Tab>
-<Tab heading="HCP Vault" group="hcp">
-
-1. Enable the database secrets engine if it is not already enabled:
-
-    ```shell-session
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1. Configure Vault with the proper plugin and connection information. The `plugin-name` must be set to
-   `vault-plugin-database-oracle`.
-
-   ~> **Note:** Replace `your-oracle-host` in the `connection_url` parameter with the hostname of your Oracle server.
-
-    ```shell-session
-    $ vault write database/config/my-oracle-database \
-        plugin_name=vault-plugin-database-oracle \
-        connection_url="{{username}}/{{password}}@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=your-oracle-host)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" \
-        allowed_roles="my-role" \
-        username="VAULT_SUPER_USER" \
-        password="myreallysecurepassword"
-    ```
-
-   HCP Vault currently supports SSL connections for Oracle on Amazon Web Services (AWS) Relational Database Service (RDS).
-   If Oracle is deployed on AWS RDS, and uses SSL, see the [connecting with HCP Vault using SSL](#connect-with-hcp-vault-using-ssl) example.
-
-   If the version of Oracle you are using has a container database, you will need to connect to one of the
-   pluggable databases rather than the container database in the `connection_url` field.
-
-1. It is highly recommended that you immediately rotate the "root" user's password, see
-   [Rotate Root Credentials](/vault/api-docs/secret/databases#rotate-root-credentials) for more details.
-   This will ensure that only Vault is able to access the "root" user that Vault uses to
-   manipulate dynamic & static credentials.
-
-   !> **Use caution:** the "root" user's password will not be accessible once rotated so it is highly
-   recommended that you create a user for Vault to use rather than the actual `root` user.
-
-1. Configure a role that maps a name in Vault to a SQL statement to execute and
-   create the database credential:
-
-   ```shell-session
-   $ vault write database/roles/my-role \
-       db_name=my-oracle-database \
-       creation_statements='CREATE USER {{username}} IDENTIFIED BY "{{password}}"; GRANT CONNECT TO {{username}}; GRANT CREATE SESSION TO {{username}};' \
-       default_ttl="1h" \
-       max_ttl="24h"
-   ```
-
-   Note: The `creation_statements` may be specified in a file and interpreted by the Vault CLI using the `@` symbol:
-
-   ```shell-session
-   $ vault write database/roles/my-role \
-       creation_statements=@creation_statements.sql \
-       ...
-   ```
-
-   See the [Commands](/vault/docs/commands#files) docs for more details.
-
-### Connect with HCP Vault using SSL
-
-Before using SSL with Oracle RDS, you must configure a option group with SSL and set the following:
-
-- `SQLNET.SSL_VERSION` to `1.2`
-- `SQLNET.CIPHER_SUITE` to one of `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, or `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`
-
-If the AWS RDS Oracle instance Vault is trying to connect to uses an SSL listener, the database
-plugin will require extra configuration using the `connection_url` parameter:
-
-```shell-session
-$ vault write database/config/oracle \
-  plugin_name=vault-plugin-database-oracle \
-  connection_url='{{username}}/{{password}}@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=<host>)(PORT=<port>))(CONNECT_DATA=(SERVICE_NAME=<service_name>))(SECURITY=(SSL_SERVER_CERT_DN="<cert_dn>")(MY_WALLET_DIRECTORY=<path_to_wallet>)))' \
-  allowed_roles="my-role" \
-  username="VAULT_SUPER_USER" \
-  password="myreallysecurepassword"
-```
-
-For example, the SSL server certificate distinguished name for AWS RDS and path to the Oracle Wallet
-to use for connection and verification could be configured using:
-
-- Wallet location and permissions are managed by the HCP platform. The wallet is available at `/etc/vault.d/plugin/oracle/ssl_wallet`.
-- The distinguished name for the current AWS RDS CA is in the format `SECURITY=(SSL_SERVER_CERT_DN="C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=your-rds-endpoint-url")`.
-- A listener on port `2484` is enabled by adding `SSL` to a RDS option group and applying the option group with SSL to your Oracle RDS instance.
-- Replace `your-rds-endpoint-url` with the endpoint for your RDS instance in the `HOST` and `DN` parameters.
-
--> **Note:** For more information on using SSL/TLS with AWS RDS, review the [Using SSL/TLS to encrypt a connetion to a DB instance](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html) AWS documentation.
-
-```shell-session
-$ vault write database/config/my-oracle-database \
-  plugin_name=vault-plugin-database-oracle \
-  connection_url="{{username}}/{{password}}@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=your-rds-endpoint-url)(PORT=2484))(CONNECT_DATA=(SERVICE_NAME=ORCL))(SECURITY=(SSL_SERVER_CERT_DN="C=US,ST=Washington,L=Seattle,O=Amazon.com,OU=RDS,CN=your-rds-endpoint-url")(MY_WALLET_DIRECTORY=/etc/vault.d/plugin/oracle/ssl_wallet)))" \
-  allowed_roles="my-role" \
-  username="admin" \
-  password="password"
-```
-
-~> **Using TNS names:** `tnsnames.ora` configuration is not currently available with HCP Vault.
-
-</Tab>
-</Tabs>
-
-## Usage
-
-### Dynamic credentials
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault read database/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    password           yRUSyd-vPYDg5NkU9kDg
-    username           V_VAULTUSE_MY_ROLE_SJJUK3Q8W3BKAYAN8S62_1602543009
-    ```
-
-## API
-
-The full list of configurable options can be seen in the [Oracle database plugin
-API](/vault/api-docs/secret/databases/oracle) page.
-
-For more information on the database secrets engine's HTTP API please see the
-[Database secrets engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/postgresql.mdx b/website/content/docs/secrets/databases/postgresql.mdx
deleted file mode 100644
index 70186f5c034..00000000000
--- a/website/content/docs/secrets/databases/postgresql.mdx
+++ /dev/null
@@ -1,147 +0,0 @@
----
-layout: docs
-page_title: PostgreSQL - Database - Secrets Engines
-description: |-
-  PostgreSQL is one of the supported plugins for the database secrets engine.
-  This plugin generates database credentials dynamically based on configured
-  roles for the PostgreSQL database.
----
-
-# PostgreSQL database secrets engine
-
-PostgreSQL is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-the PostgreSQL database, and also supports [Static
-Roles](/vault/docs/secrets/databases#static-roles).
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-The PostgreSQL secrets engine uses [pgx][pgxlib], the same database library as the
-[PostgreSQL storage backend](/vault/docs/configuration/storage/postgresql). Connection string
-options, including SSL options, can be found in the [pgx][pgxlib] and
-[PostgreSQL connection string][pg_conn_docs] documentation.
-
-## Capabilities
-
-| Plugin Name                  | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| ---------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `postgresql-database-plugin` | Yes                      | Yes           | Yes          | Yes (1.7+)             |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```shell-session
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information:
-
-    ```shell-session
-    $ vault write database/config/my-postgresql-database \
-        plugin_name="postgresql-database-plugin" \
-        allowed_roles="my-role" \
-        connection_url="postgresql://{{username}}:{{password}}@localhost:5432/database-name" \
-        username="vaultuser" \
-        password="vaultpass" \
-        password_authentication="scram-sha-256"
-    ```
-
-1.  Configure a role that maps a name in Vault to an SQL statement to execute to
-    create the database credential:
-
-    ```shell-session
-    $ vault write database/roles/my-role \
-        db_name="my-postgresql-database" \
-        creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
-            GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
-        default_ttl="1h" \
-        max_ttl="24h"
-    Success! Data written to: database/roles/my-role
-    ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```shell-session
-    $ vault read database/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    password           SsnoaA-8Tv4t34f41baD
-    username           v-vaultuse-my-role-x
-    ```
-
-## API
-
-The full list of configurable options can be seen in the [PostgreSQL database
-plugin API](/vault/api-docs/secret/databases/postgresql) page.
-
-For more information on the database secrets engine's HTTP API please see the
-[Database secrets engine API](/vault/api-docs/secret/databases) page.
-
-[pgxlib]: https://pkg.go.dev/github.com/jackc/pgx/stdlib
-[pg_conn_docs]: https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING
-
-## Authenticating to Cloud DBs via IAM
-
-### Google Cloud
-
-Aside from IAM roles denoted by [Google's CloudSQL documentation](https://cloud.google.com/sql/docs/postgres/add-manage-iam-users#creating-a-database-user),
-the following SQL privileges are needed by the service account's DB user for minimum functionality with Vault.
-Additional privileges may be needed depending on the SQL configured on the database roles.
-
-```sql
--- Enable service account to create roles within DB
-ALTER USER "<YOUR DB USERNAME>" WITH CREATEROLE;
-```
-
-### Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```shell-session
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information. Here you can explicitly enable GCP IAM authentication
-    and use [Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc#how-to) to authenticate:
-
-    ```shell-session
-    $ vault write database/config/my-postgresql-database \
-        plugin_name="postgresql-database-plugin" \
-        allowed_roles="my-role" \
-        connection_url="host=project:us-west1:mydb user=test-user@project.iam dbname=postgres sslmode=disable" \
-        auth_type="gcp_iam"
-    ```
-
-    You can also configure the connection and authenticate by directly passing in the service account credentials
-    as an encoded JSON string:
-
-    ```shell-session
-    $ vault write database/config/my-postgresql-database \
-        plugin_name="postgresql-database-plugin" \
-        allowed_roles="my-role" \
-        connection_url="host=project:region:instance user=test-user@project.iam dbname=postgres sslmode=disable" \
-        auth_type="gcp_iam" \
-        service_account_json="@my_credentials.json"
-    ```
-
-Once the connection has been configured and IAM authentication is complete, the steps to set up a role and generate
-credentials are the same as the ones listed above.
diff --git a/website/content/docs/secrets/databases/redis.mdx b/website/content/docs/secrets/databases/redis.mdx
deleted file mode 100644
index 90ccd58d425..00000000000
--- a/website/content/docs/secrets/databases/redis.mdx
+++ /dev/null
@@ -1,126 +0,0 @@
----
-layout: docs
-page_title: Redis - Database - Secrets Engines
-description: |-
-  Redis is one of the supported plugins for the database secrets engine.
-  This plugin generates database credentials dynamically based on configured
-  roles for the Redis database, and also supports [Static Roles](/vault/docs/secrets/databases#static-roles).
----
-
-# Redis database secrets engine
-
-Redis is one of the supported plugins for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-the Redis database.
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-## Capabilities
-
-| Plugin Name                 | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| --------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `redis-database-plugin`     | Yes                      | Yes           | Yes          | No                     |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```shell-session
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection configuration:
-
-    ```shell-session
-    $ vault write database/config/my-redis-database \
-      plugin_name="redis-database-plugin" \
-      host="localhost" \
-      port=6379 \
-      tls=true \
-      ca_cert="$CACERT" \
-      username="user" \
-      password="pass" \
-      allowed_roles="my-*-role"
-    ```
-
-1.  You should consider rotating the admin password. Note that if you do, the
-    new password will never be made available through Vault, so you should
-    create a Vault-specific database admin user for this.
-
-    ```shell-session
-    vault write -force database/rotate-root/my-redis-database
-    ```
-
-## Usage
-
-After the secrets engine is configured, write dynamic and static roles
-to Vault to enable generating credentials.
-
-### Dynamic roles
-
-1.  Configure a dynamic role that maps a name in Vault to a JSON string
-    containing the Redis ACL rules, which are either documented [here](https://redis.io/commands/acl-cat) or in the output
-    of the `ACL CAT` Redis command.
-
-    ```shell-session
-    $ vault write database/roles/my-dynamic-role \
-        db_name="my-redis-database" \
-        creation_statements='["+@admin"]' \
-        default_ttl="5m" \
-        max_ttl="1h"
-    Success! Data written to: database/roles/my-dynamic-role
-    ```
-
-    Note that if a creation_statement is not provided the user account will
-    default to a read only user, `'["~*", "+@read"]'` that can read any key.
-
-1.  Generate a new set of credentials by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```shell-session
-    $ vault read database/creds/my-dynamic-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-dynamic-role/OxCTXJcxQ2F4lReWPjbezSnA
-    lease_duration     5m
-    lease_renewable    true
-    password           dACqHsav6-attdv1glGZ
-    username           V_TOKEN_MY-DYNAMIC-ROLE_YASUQUF3GVVD0ZWTEMK4_1608481717
-    ```
-
-### Static roles
-
-1.  Configure a static role that maps a name in Vault to an existing Redis
-    user.
-
-    ```shell-session
-    $ vault write database/static-roles/my-static-role \
-        db_name="my-redis-database" \
-        username="my-existing-redis-user" \
-        rotation_period=5m
-    Success! Data written to: database/static-roles/my-static-role
-    ```
-
-1.  Retrieve the credentials from the `/static-creds` endpoint:
-
-    ```shell-session
-    $ vault read database/static-creds/my-static-role
-    Key                    Value
-    ---                    -----
-    last_vault_rotation    2020-12-20T10:39:49.647822-06:00
-    password               ylKNgqa3NPVAioBf-0S5
-    rotation_period        5m
-    ttl                    4m39s
-    username               my-existing-redis-user
-    ```
-
-## API
-
-The full list of configurable options can be seen in the [Redis Database Plugin API](/vault/api-docs/secret/databases/redis) page.
-
-For more information on the database secrets engine's HTTP API please see the [Database Secrets Engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/rediselasticache.mdx b/website/content/docs/secrets/databases/rediselasticache.mdx
deleted file mode 100644
index b8f624b7656..00000000000
--- a/website/content/docs/secrets/databases/rediselasticache.mdx
+++ /dev/null
@@ -1,111 +0,0 @@
----
-layout: docs
-page_title: Redis ElastiCache - Database - Secrets Engines
-description: |-
-  Redis ElastiCache is one of the supported plugins for the database secrets engine.
-  This plugin generates static credentials for existing managed roles.
----
-
-# Redis ElastiCache database secrets engine
-
-Redis ElastiCache is one of the supported plugins for the database secrets engine.
-This plugin generates static credentials for existing managed roles.
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-## Capabilities
-
-| Plugin Name                             | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| --------------------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `redis-elasticache-database-plugin`     | No                       | No            | Yes          | No                     |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-  ```shell-session
-  $ vault secrets enable database
-  Success! Enabled the database secrets engine at: database/
-  ```
-
-  By default, the secrets engine will enable at the name of the engine. To
-  enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection configuration:
-
-  ```shell-session
-  $ vault write database/config/my-redis-elasticache-cluster \
-    plugin_name="redis-elasticache-database-plugin" \
-    url="primary-endpoint.my-cluster.xxx.yyy.cache.amazonaws.com:6379" \
-    access_key_id="AKI***" \
-    secret_access_key="ktriNYvULAWLzUmTGb***" \
-    region=us-east-1 \
-    allowed_roles="*"
-  ```
-
-~> **Note**: The `access_key_id`, `secret_access_key` and `region` parameters are optional. If omitted, authentication falls back
-on the AWS credentials provider chain.
-
-~> **Deprecated**: The `username` & `password` parameters are deprecated but supported for backward compatibility. They are replaced
-by the equivalent `access_key_id` and `secret_access_key` parameters respectively.
-
-The Redis ElastiCache secrets engine must use AWS credentials that have sufficient permissions to manage ElastiCache users.
-This IAM policy sample can be used as an example. Note that &lt;region&gt; and &lt;account-id&gt;
-must correspond to your own environment.
-
-  ```json
-  {
-    "Version": "2012-10-17",
-    "Statement": [
-      {
-        "Sid": "",
-        "Effect": "Allow",
-        "Action": [
-          "elasticache:ModifyUser",
-          "elasticache:DescribeUsers"
-        ],
-        "Resource": "arn:aws:elasticache:<region>:<account-id>:user:*"
-      }
-    ]
-  }
-  ```
-
-## Usage
-
-After the secrets engine is configured, write static roles to enable generating credentials.
-
-### Static roles
-
-1.  Configure a static role that maps a name in Vault to an existing Redis ElastiCache user.
-
-  ```shell-session
-  $ vault write database/static-roles/my-static-role \
-      db_name="my-redis-elasticache-cluster" \
-      username="my-existing-redis-user" \
-      rotation_period=5m
-  Success! Data written to: database/static-roles/my-static-role
-  ```
-
-1.  Retrieve the credentials from the `/static-creds` endpoint:
-
-  ```shell-session
-  $ vault read database/static-creds/my-static-role
-  Key                    Value
-  ---                    -----
-  last_vault_rotation    2022-09-14T11:45:57.24715105-04:00
-  password               GKdS6qY-UtVAMpcD9iuu
-  rotation_period        5m
-  ttl                    4m48s
-  username               my-existing-redis-user
-  ```
-
-~> **Note**: New passwords may take up-to a couple of minutes before ElastiCache has the chance to complete their configuration.
-  It is recommended to use a retry strategy when establishing new Redis ElastiCache connections. This may prevent errors when
-  trying to use a password that isn't yet live on the targeted ElastiCache cluster.
-
-## API
-
-The full list of configurable options can be seen in the [Redis ElastiCache Database Plugin API](/vault/api-docs/secret/databases/rediselasticache) page.
-
-For more information on the database secrets engine's HTTP API please see the [Database Secrets Engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/redshift.mdx b/website/content/docs/secrets/databases/redshift.mdx
deleted file mode 100644
index 1dab02ad79e..00000000000
--- a/website/content/docs/secrets/databases/redshift.mdx
+++ /dev/null
@@ -1,87 +0,0 @@
----
-layout: docs
-page_title: Redshift - Database - Secrets Engines
-description: |-
-  Redshift is a supported plugin for the database secrets engine.
-  This plugin generates database credentials dynamically based on configured
-  roles for the AWS Redshift database service.
----
-
-# Redshift database secrets engine
-
-Redshift is a supported plugin for the database secrets engine. This
-plugin generates database credentials dynamically based on configured roles for
-the AWS Redshift database service, and also supports [Static
-Roles](/vault/docs/secrets/databases#static-roles).
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-## Capabilities
-
-| Plugin Name                | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
-| -------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
-| `redshift-database-plugin` | Yes                      | Yes           | Yes          | Yes (1.8+)             |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```text
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information to access your Redshift database:
-
-    ```text
-    $ vault write database/config/my-redshift-database \
-        plugin_name=redshift-database-plugin \
-        allowed_roles="my-role" \
-        connection_url="postgresql://{{username}}:{{password}}@localhost:5432/<optional: db-name>" \
-        username="vaultuser" \
-        password="vaultpass"
-    ```
-
-1.  Configure a role that maps a name in Vault to a SQL statement to execute which
-    creates the database credential:
-
-    ```text
-    $ vault write database/roles/my-role \
-        db_name=my-redshift-database \
-        creation_statements="CREATE USER \"{{name}}\" WITH PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
-            GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
-        default_ttl="1h" \
-        max_ttl="24h"
-    Success! Data written to: database/roles/my-role
-    ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault read database/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    password           FFdcFM1vSFc-9sVhyTPY
-    username           v-vaultuse-my-role-zi0460sr1hwm98qugxu8-1602542706
-    ```
-
-## API
-
-The full list of configurable options can be seen in the [Redshift database
-plugin API](/vault/api-docs/secret/databases/redshift) page.
-
-For more information on the database secrets engine's HTTP API please see the
-[Database secrets engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/databases/snowflake.mdx b/website/content/docs/secrets/databases/snowflake.mdx
deleted file mode 100644
index bddbee64989..00000000000
--- a/website/content/docs/secrets/databases/snowflake.mdx
+++ /dev/null
@@ -1,225 +0,0 @@
----
-layout: docs
-page_title: Snowflake - Database - Secrets Engines
-description: |-
-  Snowflake is one of the supported plugins for the database secrets engine.
-  This plugin generates database credentials dynamically based on configured
-  roles for Snowflake hosted databases.
----
-
-# Snowflake database secrets engine
-
-Snowflake is one of the supported plugins for the database secrets engine. This plugin
-generates database credentials dynamically based on configured roles for Snowflake-hosted
-databases and supports [Static Roles](/vault/docs/secrets/databases#static-roles).
-
-See the [database secrets engine](/vault/docs/secrets/databases) docs for
-more information about setting up the database secrets engine.
-
-The Snowflake database secrets engine uses
-[gosnowflake](https://pkg.go.dev/github.com/snowflakedb/gosnowflake).
-
-## Capabilities
-
-| Plugin Name                 | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization | Credential Types          |
-| --------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |---------------------------|
-| `snowflake-database-plugin` | Yes                      | Yes           | Yes          | Yes (1.8+)             | password, rsa_private_key |
-
-## Setup
-
-1.  Enable the database secrets engine if it is not already enabled:
-
-    ```shell-session
-    $ vault secrets enable database
-    Success! Enabled the database secrets engine at: database/
-    ```
-
-    By default, the secrets engine will enable at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure Vault with the proper plugin and connection information:
-
-    ```shell-session
-    $ vault write database/config/my-snowflake-database \
-        plugin_name=snowflake-database-plugin \
-        allowed_roles="my-role" \
-        connection_url="{{username}}:{{password}}@ecxxxx.west-us-1.azure/db_name" \
-        username="vaultuser" \
-        password="vaultpass"
-    ```
-
-    A properly formatted data source name (DSN) needs to be provided during configuration of the
-    database. This DSN is typically formatted with the following options:
-
-    ```shell-session
-    {{username}}:{{password}}@account/db_name
-    ```
-
-    `{{username}}` and `{{password}}` will typically be used as is during configuration. The
-    special formatting is replaced by the username and password options passed to the configuration
-    for initial connection.
-
-    `account` is your Snowflake account identifier. You can find out more about this value by reading
-    the `server` section of
-    [this document](https://docs.snowflake.com/en/user-guide/odbc-parameters.html#connection-parameters).
-
-    `db_name` is the name of a database in your Snowflake instance.
-
-    ~> **Note:** The user being utilized should have `ACCOUNT_ADMIN` privileges, and should be different
-    from the root user you were provided when making your Snowflake account. This allows you to rotate
-    the root credentials and still be able to access your account.
-
-## Usage
-
-After the secrets engine is configured, configure dynamic and static roles to
-enable generating credentials.
-
-### Dynamic roles
-
-#### Password credentials
-
-1.  Configure a role that creates new Snowflake users with password credentials:
-
-    ```shell-session
-    $ vault write database/roles/my-password-role \
-        db_name=my-snowflake-database \
-        creation_statements="CREATE USER {{name}} PASSWORD = '{{password}}'
-            DAYS_TO_EXPIRY = {{expiration}} DEFAULT_ROLE=myrole;
-            GRANT ROLE myrole TO USER {{name}};" \
-        default_ttl="1h" \
-        max_ttl="24h"
-    Success! Data written to: database/roles/my-password-role
-    ```
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```shell-session
-    $ vault read database/creds/my-password-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-password-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    password           SsnoaA-8Tv4t34f41baD
-    username           v_root_my_password_role_fU0jqEy4wMNoAY2h60yd_1610561532
-    ```
-
-#### Key pair credentials
-
-1. Configure a role that creates new Snowflake users with key pair credentials:
-
-    ```shell-session
-    $ vault write database/roles/my-keypair-role \
-        db_name=my-snowflake-database \
-        creation_statements="CREATE USER {{name}} RSA_PUBLIC_KEY='{{public_key}}'
-          DAYS_TO_EXPIRY = {{expiration}} DEFAULT_ROLE=myrole;
-          GRANT ROLE myrole TO USER {{name}};" \
-        credential_type="rsa_private_key" \
-        credential_config=key_bits=2048 \
-        default_ttl="1h" \
-        max_ttl="24h"
-    Success! Data written to: database/roles/my-keypair-role
-    ```
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```shell-session
-    $ vault read database/creds/my-keypair-role
-    Key                Value
-    ---                -----
-    lease_id           database/creds/my-keypair-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
-    lease_duration     1h
-    lease_renewable    true
-    rsa_private_key    -----BEGIN PRIVATE KEY-----
-                       ...
-                       -----END PRIVATE KEY-----
-    username           v_token_my_keypair_role_n20WjS9U3LWTlBWn4Wbh_1654718170
-    ```
-
-    You can directly use the PEM-encoded `rsa_private_key` value to establish a connection
-    to Snowflake. See [connection options](https://docs.snowflake.com/en/user-guide/key-pair-auth.html#step-6-configure-the-snowflake-client-to-use-key-pair-authentication)
-    for a list of clients and instructions for establishing a connection using key pair
-    authentication.
-
-### Static roles
-
-#### Password credentials
-
-1. Configure a static role that rotates the password credential for an existing Snowflake user.
-
-    ```shell-session
-    $ vault write database/static-roles/my-password-role \
-        db_name=my-snowflake-database \
-        username="snowflake_existing_user" \
-        rotation_period="24h" \
-        rotation_statements="ALTER USER {{name}} SET PASSWORD = '{{password}}'"
-    Success! Data written to: database/static-roles/my-password-role
-    ```
-
-1.  Retrieve the current password credential from the `/static-creds` endpoint:
-
-    ```shell-session
-    $ vault read database/static-creds/my-password-role
-    Key                    Value
-    ---                    -----
-    last_vault_rotation    2020-08-07T16:50:48.393354+01:00
-    password               Z4-KH8F-VK5VJc0hSkXQ
-    rotation_period        24h
-    ttl                    23h59m39s
-    username               my-existing-couchbase-user
-    ```
-
-#### Key pair credentials
-
-1. Configure a static role that rotates the key pair credential for an existing Snowflake user:
-
-    ```shell-session
-    $ vault write database/static-roles/my-keypair-role \
-        db_name=my-snowflake-database \
-        username="snowflake_existing_user" \
-        rotation_period="24h" \
-        rotation_statements="ALTER USER {{name}} SET RSA_PUBLIC_KEY='{{public_key}}'" \
-        credential_type="rsa_private_key" \
-        credential_config=key_bits=2048
-    Success! Data written to: database/static-roles/my-keypair-role
-    ```
-
-1.  Retrieve the current key pair credential from the `/static-creds` endpoint:
-
-    ```shell-session
-    $ vault read database/static-creds/my-keypair-role
-    Key                    Value
-    ---                    -----
-    last_vault_rotation    2022-06-08T13:13:02.355928-07:00
-    rotation_period        24h
-    rsa_private_key        -----BEGIN PRIVATE KEY-----
-                           ...
-                           -----END PRIVATE KEY-----
-    ttl                    23h59m55s
-    username               snowflake_existing_user
-    ```
-
-    You can directly use the PEM-encoded `rsa_private_key` value to establish a connection
-    to Snowflake. See [connection options](https://docs.snowflake.com/en/user-guide/key-pair-auth.html#step-6-configure-the-snowflake-client-to-use-key-pair-authentication)
-    for a list of clients and instructions for establishing a connection using key pair
-    authentication.
-
-## Key pair authentication
-
-Snowflake supports using [key pair authentication](https://docs.snowflake.com/en/user-guide/key-pair-auth.html)
-for enhanced authentication security as an alternative to username and password authentication.
-The Snowflake database plugin can be used to manage key pair credentials for Snowflake users
-by using the `rsa_private_key` [credential_type](/vault/api-docs/secret/databases#credential_type).
-
-See the [usage](/vault/docs/secrets/databases/snowflake#usage) section for examples using both
-dynamic and static roles.
-
-## API
-
-The full list of configurable options can be seen in the [Snowflake database
-plugin API](/vault/api-docs/secret/databases/snowflake) page.
-
-For more information on the database secrets engine's HTTP API please see the
-[Database secrets engine API](/vault/api-docs/secret/databases) page.
diff --git a/website/content/docs/secrets/gcp.mdx b/website/content/docs/secrets/gcp.mdx
deleted file mode 100644
index 739c325514b..00000000000
--- a/website/content/docs/secrets/gcp.mdx
+++ /dev/null
@@ -1,726 +0,0 @@
----
-layout: docs
-page_title: Google Cloud - Secrets Engines
-description: |-
-  The Google Cloud secrets engine for Vault dynamically generates Google Cloud
-  service account keys and OAuth tokens based on IAM policies.
----
-
-# Google Cloud secrets engine
-
-The Google Cloud Vault secrets engine dynamically generates Google Cloud service
-account keys and OAuth tokens based on IAM policies. This enables users to gain
-access to Google Cloud resources without needing to create or manage a dedicated
-service account.
-
-The benefits of using this secrets engine to manage Google Cloud IAM service accounts are:
-
-- **Automatic cleanup of GCP IAM service account keys** - each Service Account
-  key is associated with a Vault lease. When the lease expires (either during
-  normal revocation or through early revocation), the service account key is
-  automatically revoked.
-
-- **Quick, short-term access** - users do not need to create new GCP Service
-  Accounts for short-term or one-off access (such as batch jobs or quick
-  introspection).
-
-- **Multi-cloud and hybrid cloud applications** - users authenticate to Vault
-  using a central identity service (such as LDAP) and generate GCP credentials
-  without the need to create or manage a new Service Account for that user.
-
-~> **NOTE: Deprecation of `access_token` Leases**: In previous versions of this secrets engine
-(released with Vault <= 0.11.1), a lease was generated with access tokens. If you're using
-an old version of the plugin, please upgrade. Read more in the
-[upgrade guide](#deprecation-of-access-token-leases)
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1.  Enable the Google Cloud secrets engine:
-
-    ```shell-session
-    $ vault secrets enable gcp
-    Success! Enabled the gcp secrets engine at: gcp/
-    ```
-
-    By default, the secrets engine will mount at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure the secrets engine with account credentials, or leave blank or unwritten
-    to use Application Default Credentials.
-
-    ```shell-session
-    $ vault write gcp/config credentials=@my-credentials.json
-    Success! Data written to: gcp/config
-    ```
-
-    If you are running Vault from inside [Google Compute Engine][gce] or [Google
-    Kubernetes Engine][gke], the instance or pod service account can be used in
-    place of specifying the credentials JSON file.
-    For more information on authentication, see the [authentication section](#authentication) below.
-
-1. Configure rolesets or static accounts. See the relevant sections below.
-
-## Rolesets
-
-A roleset consists of a Vault managed GCP Service account along with a set of IAM bindings
-defined for that service account. The name of the service account is generated based on the time
-of creation or update. You should not depend on the name of the service account being
-fixed and should manage all IAM bindings for the service account through the `bindings` parameter
-when creating or updating the roleset.
-
-For more information on the differences between rolesets and static accounts, see the
-[things to note](#things-to-note) section below.
-
-### Roleset policy considerations
-
-Starting with Vault 1.8.0, existing permissive policies containing globs 
-for the GCP Secrets Engine may grant additional privileges due to the introduction 
-of `/gcp/roleset/:roleset/token` and `/gcp/roleset/:roleset/key` endpoints.
-
-The following policy grants a user the ability to read all rolesets, but would 
-also allow them to generate tokens and keys. This type of policy is not recommended:
-
-```hcl
-# DO NOT USE
-path "/gcp/roleset/*" {
-    capabilities = ["read"]
-}
-```
-
-The following example demonstrates how a wildcard can instead be used in a roleset policy to 
-adhere to the principle of least privilege:
-
-```hcl
-path "/gcp/roleset/+" {
-    capabilities = ["read"]
-}
-```
-
-For more more information on policy syntax, see the 
-[policy documentation](/vault/docs/concepts/policies#policy-syntax).
-
-### Examples
-
-To configure a roleset that generates OAuth2 access tokens (preferred):
-
-```shell-session
-$ vault write gcp/roleset/my-token-roleset \
-    project="my-project-id" \
-    secret_type="access_token"  \
-    token_scopes="https://www.googleapis.com/auth/cloud-platform" \
-    bindings=-<<EOF
-      resource "//cloudresourcemanager.googleapis.com/projects/my-project-id" {
-        roles = ["roles/viewer"]
-      }
-    EOF
-```
-
-To configure a roleset that generates GCP Service Account keys:
-
-```shell-session
-$ vault write gcp/roleset/my-key-roleset \
-    project="my-project" \
-    secret_type="service_account_key"  \
-    bindings=-<<EOF
-      resource "//cloudresourcemanager.googleapis.com/projects/my-project" {
-        roles = ["roles/viewer"]
-      }
-    EOF
-```
-
-Alternatively, provide a file for the `bindings` argument like so:
-
-```shell-session
-$ vault write gcp/roleset/my-roleset
-    bindings=@mybindings.hcl
-    ...
-```
-
-For more information on role bindings and sample role bindings, please see
-the [bindings](#bindings) section below.
-
-For more information on the differences between OAuth2 access tokens and
-Service Account keys, see the [things to note](#things-to-note) section
-below.
-
-For more information on creating and managing rolesets, see the
-[GCP secrets engine API docs][api] docs.
-
-## Static accounts
-
-Static accounts are GCP service accounts that are created outside of Vault and then provided to
-Vault to generate access tokens or keys. You can also use Vault to optionally manage IAM bindings
-for the service account.
-
-For more information on the differences between rolesets and static accounts, see the
-[things to note](#things-to-note) section below.
-
-### Examples
-
-Before configuring a static account, you need to create a
-[Google Cloud Service Account][service-accounts]. Take note of the email address of the service
-account you have created. Service account emails are of the format
-`<service-account-id>@<project-id>.iam.gserviceaccount.com`.
-
-To configure a static account that generates OAuth2 access tokens (preferred):
-
-```shell-session
-$ vault write gcp/static-account/my-token-account \
-    service_account_email="account@my-project.iam.gserviceaccount.com" \
-    secret_type="access_token"  \
-    token_scopes="https://www.googleapis.com/auth/cloud-platform" \
-    bindings=-<<EOF
-      resource "//cloudresourcemanager.googleapis.com/projects/my-project" {
-        roles = ["roles/viewer"]
-      }
-    EOF
-```
-
-To configure a static account that generates GCP Service Account keys:
-
-```shell-session
-$ vault write gcp/static-account/my-key-account \
-    service_account_email="account@my-project.iam.gserviceaccount.com" \
-    secret_type="service_account_key"  \
-    bindings=-<<EOF
-      resource "//cloudresourcemanager.googleapis.com/projects/my-project" {
-        roles = ["roles/viewer"]
-      }
-    EOF
-```
-
-Alternatively, provide a file for the `bindings` argument like so:
-
-```shell-session
-$ vault write gcp/static-account/my-account
-    bindings=@mybindings.hcl
-    ...
-```
-
-For more information on role bindings and sample role bindings, please see
-the [bindings](#bindings) section below.
-
-For more information on the differences between OAuth2 access tokens and
-Service Account keys, see the [things to note](#things-to-note) section
-below.
-
-For more information on creating and managing static accounts, see the
-[GCP secrets engine API docs][api] docs.
-
-## Impersonated accounts
-
-Impersonated accounts are a way to generate an OAuth2 [access token](/vault/docs/secrets/gcp#access-tokens) that is granted
-the permissions and accesses of another given service account. These access
-tokens do not have the same 10-key limit as service account keys do, yet they
-retain their short-lived nature. By default, their TTL in GCP is 1 hour, but
-this may be configured to be up to 12 hours as explained in Google's 
-[short-lived credentials documentation](https://cloud.google.com/iam/docs/create-short-lived-credentials-delegated#sa-credentials-oauth).
-
-For more information regarding service account impersonation in GCP, consider starting
-with their documentation [available here](https://cloud.google.com/iam/docs/impersonating-service-accounts).
-
-### Examples
-
-To configure a Vault role that impersonates the administrator on the Google
-Cloud project with the cloud platform and compute scopes:
-
-```shell-session
-$ vault write gcp/impersonated-account/my-token-impersonate \
-    service_account_email="projectAdmin@my-project.iam.gserviceaccount.com" \
-    token_scopes="https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/compute" \
-    ttl="6h"
-```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials. Depending on how the Vault role
-was configured, you can generate OAuth2 tokens or service account keys.
-
-### Access tokens
-
-To generate OAuth2 [access tokens](https://cloud.google.com/docs/authentication/token-types#access),
-read from the [`gcp/.../token`](/vault/api-docs/secret/gcp#generate-secret-iam-service-account-creds-oauth2-access-token)
-API. If using a roleset or static account, it must have been created with a
-[`secret_type`](/vault/api-docs/secret/gcp#secret_type) of `access_token`. Impersonated accounts will
-generate OAuth2 tokens by default.
-
-**Roleset:**
-```shell-session
-$ vault read gcp/roleset/my-token-roleset/token
-
-Key                Value
----                -----
-expires_at_seconds    1537402548
-token                 ya29.c.ElodBmNPwHUNY5gcBpnXcE4ywG4w1k...
-token_ttl             3599
-```
-
-**Static account:**
-```shell-session
-$ vault read gcp/static-account/my-token-account/token
-
-Key                Value
----                -----
-expires_at_seconds    1672231587
-token                 ya29.c.b0Aa9VdykAdYoW9S1ImtPZykF_oTi9...
-token_ttl             3599
-```
-
-**Impersonated account:**
-```shell-session
-$ vault read gcp/impersonated-account/my-token-impersonate/token
-
-Key                Value
----                -----
-expires_at_seconds    1671667844
-token                 ya29.c.b0AT7lpjBRmO7ghBEyMV18evd016hq...
-token_ttl             59m59s
-```
-
-This endpoint generates a non-renewable, non-revocable static OAuth2 access token
-with a max lifetime of one hour, where `token_ttl` is given in seconds and the
-`expires_at_seconds` is the expiry time for the token, given as a Unix timestamp.
-The `token` value then can be used as a HTTP Authorization Bearer token in requests
-to GCP APIs:
-
-```shell-session
-$ curl -H "Authorization: Bearer ya29.c.ElodBmNPwHUNY5gcBpnXcE4ywG4w1k..."
-```
-
-### Service account keys
-
-To generate service account keys, read from `gcp/.../key`. Vault returns the service
-account key data as a base64-encoded string in the `private_key_data` field. This can
-be read by decoding it using `base64 --decode "ewogICJ0e..."` or another base64 tool of
-your choice. The roleset or static account must have been created as type `service_account_key`:
-
-```shell-session
-$ vault read gcp/roleset/my-key-roleset/key
-
-Key                 Value
----                 -----
-lease_id            gcp/key/my-key-roleset/ce563a99-5e55-389b...
-lease_duration      30m
-lease_renewable     true
-key_algorithm       KEY_ALG_RSA_2048
-key_type            TYPE_GOOGLE_CREDENTIALS_FILE
-private_key_data    ewogICJ0eXBlIjogInNlcnZpY2VfYWNjb3VudCIsC...
-```
-
-This endpoint generates a new [GCP IAM service account key][iam-keys] associated
-with the role's Service Account. When the lease expires (or is revoked
-early), the Service Account key will be deleted.
-
-**There is a default limit of 10 keys per Service Account.** For more
-information on this limit and recommended mitigation, please see the [things to
-note](#things-to-note) section below.
-
-## Bindings
-
-Roleset or static account bindings define a list of resources and the associated IAM roles on that
-resource. Bindings are used as the `binding` argument when creating or
-updating a roleset or static account and are specified in the following format using HCL:
-
-```hcl
-resource NAME {
-  roles = [ROLE, [ROLE...]]
-}
-```
-
-For example:
-
-```hcl
-resource "buckets/my-bucket" {
-  roles = [
-    "roles/storage.objectAdmin",
-    "roles/storage.legacyBucketReader",
-  ]
-}
-
-# At instance level, using self-link
-resource "https://www.googleapis.com/compute/v1/projects/my-project/zone/my-zone/instances/my-instance" {
-  roles = [
-    "roles/compute.instanceAdmin.v1"
-  ]
-}
-
-# At project level
-resource "//cloudresourcemanager.googleapis.com/projects/my-project" {
-  roles = [
-    "roles/compute.instanceAdmin.v1",
-    "roles/iam.serviceAccountUser",  # required if managing instances that run as service accounts
-  ]
-}
-
-# At folder level
-resource "//cloudresourcemanager.googleapis.com/folders/123456" {
-  roles = [
-    "roles/compute.viewer",
-    "roles/deploymentmanager.viewer",
-  ]
-}
-
-```
-
-The top-level `resource` block defines the resource or resource path for which
-IAM policy information will be bound. The resource path may be specified in a
-few different formats:
-
-- **Project-level self-link** - a URI with scheme and host, generally
-  corresponding to the `self_link` attribute of a resource in GCP. This must
-  include the resource nested in the parent project.
-
-  ```text
-  # compute alpha zone
-  https://www.googleapis.com/compute/alpha/projects/my-project/zones/us-central1-c
-  ```
-
-- **Full resource name** - a schema-less URI consisting of a DNS-compatible API
-  service name and resource path. See the [full resource name API
-  documentation][resource-name-full] for more information.
-
-  ```text
-  # Compute snapshot
-  //compute.googleapis.com/project/my-project/snapshots/my-compute-snapshot
-
-  # Pubsub snapshot
-  //pubsub.googleapis.com/project/my-project/snapshots/my-pubsub-snapshot
-
-  # BigQuery dataset
-  //bigquery.googleapis.com/projects/my-project/datasets/mydataset
-
-  # Resource manager
-  //cloudresourcemanager.googleapis.com/projects/my-project"
-  ```
-
-- **Relative resource name** - A path-noscheme URI path, usually as accepted by
-  the API. Use this if the version or service are apparent from the resource
-  type. Please see the [relative resource name API
-  documentation][resource-name-relative] for more information.
-
-  ```text
-  # Storage bucket objects
-  buckets/my-bucket
-  buckets/my-bucket/objects/my-object
-
-  # PubSub topics
-  projects/my-project/topics/my-pubsub-topic
-  ```
-
-The nested `roles` attribute is an array of strings names of [GCP IAM
-roles][iam-roles]. The roles may be specified in the following formats:
-
-- **Global role name** - these are global roles built into Google Cloud. For the
-  full list of available roles, please see the [list of predefined GCP
-  roles][predefined-roles].
-
-  ```text
-  roles/viewer
-  roles/bigquery.user
-  roles/billing.admin
-  ```
-
-- **Organization-level custom role** - these are roles that are created at the
-  organization level by organization owners.
-
-  ```text
-  organizations/my-organization/roles/my-custom-role
-  ```
-
-  For more information, please see the documentation on [GCP custom
-  roles][custom-roles].
-
-- **Project-level custom role** - these are roles that are created at a
-  per-project level by project owners.
-
-  ```text
-  projects/my-project/roles/my-custom-role
-  ```
-
-  For more information, please see the documentation on [GCP custom
-  roles][custom-roles].
-
-## Authentication
-
-The Google Cloud Vault secrets backend uses the official Google Cloud Golang
-SDK. This means it supports the common ways of [providing credentials to Google
-Cloud][cloud-creds]. In addition to specifying `credentials` directly via Vault
-configuration, you can also get configuration from the following values **on the
-Vault server**:
-
-1. The `GOOGLE_APPLICATION_CREDENTIALS` environment variable. This is specified
-   as the **path** to a Google Cloud credentials file, typically for a service
-   account. If this environment variable is present, the resulting credentials are
-   used. If the credentials are invalid, an error is returned.
-
-1. The identity of a Google Cloud [workload][workloads-ids]. When Vault server is running
-   on a Google workload like [Google Compute Engine][gce] or [Google Kubernetes Engine][gke],
-   identity associated with the workload is automatically used. To configure Google Compute
-   Engine with an identity, see [attached service accounts][attached-service-accounts]. To
-   configure Google Kubernetes Engine with an identity, see [GKE workload identity][gke-workload-ids].
-
-For more information on service accounts, please see the [Google Cloud Service
-Accounts documentation][service-accounts].
-
-To use this secrets engine, the service account must have the following
-minimum scope(s):
-
-```text
-https://www.googleapis.com/auth/cloud-platform
-```
-
-### Required permissions
-
-The credentials given to Vault must have the following permissions when using rolesets at the
-project level:
-
-```text
-# Service account + key admin
-iam.serviceAccounts.create
-iam.serviceAccounts.delete
-iam.serviceAccounts.get
-iam.serviceAccounts.list
-iam.serviceAccounts.update
-iam.serviceAccountKeys.create
-iam.serviceAccountKeys.delete
-iam.serviceAccountKeys.get
-iam.serviceAccountKeys.list
-```
-
-When using static accounts or impersonated accounts, Vault must have the following permissions
-at the service account level:
-
-```text
-# For `access_token` secrets and impersonated accounts
-iam.serviceAccounts.getAccessToken
-
-# For `service_account_keys` secrets
-iam.serviceAccountKeys.create
-iam.serviceAccountKeys.delete
-iam.serviceAccountKeys.get
-iam.serviceAccountKeys.list
-```
-
-When using rolesets or static accounts with bindings, Vault must have the following permissions:
-
-```text
-# IAM policy changes
-<service>.<resource>.getIamPolicy
-<service>.<resource>.setIamPolicy
-```
-
-where `<service>` and `<resource>` correspond to permissions which will be
-granted, for example:
-
-```text
-# Projects
-resourcemanager.projects.getIamPolicy
-resourcemanager.projects.setIamPolicy
-
-# All compute
-compute.*.getIamPolicy
-compute.*.setIamPolicy
-
-# BigQuery datasets
-bigquery.datasets.get
-bigquery.datasets.update
-```
-
-You can either:
-
-- Create a [custom role][custom-roles] using these permissions, and assign this
-  role at a project-level
-
-- Assign the set of roles required to get resource-specific
-  `getIamPolicy/setIamPolicy` permissions. At a minimum you will need to assign
-  `roles/iam.serviceAccountAdmin` and `roles/iam.serviceAccountKeyAdmin` so
-  Vault can manage service accounts and keys.
-
-- Notice that BigQuery requires different permissions than other resource. This is
-  because BigQuery currently uses legacy ACL instead of traditional IAM permissions.
-  This means to update access on the dataset, Vault must be able to update the dataset's
-  metadata.
-
-### Root credential rotation
-
-If the mount is configured with credentials directly, the credential's key may be
-rotated to a Vault-generated value that is not accessible by the operator. For more
-details on this operation, please see the
-[Root Credential Rotation](/vault/api-docs/secret/gcp#rotate-root-credentials) API docs.
-
-## Things to note
-
-### Rolesets vs. static accounts
-
-Advantages of rolesets:
-
-- Service accounts and IAM bindings are fully managed by Vault
-
-Disadvantages of rolesets:
-
-- Cannot easily decouple IAM bindings from the ones managed in Vault
-- Vault requires permissions to manage IAM bindings and service accounts
-
-Advantages of static accounts:
-
-- Can manage IAM bindings independently from the ones managed in Vault
-- Vault does not require permissions to IAM bindings and service accounts and only permissions
-  related to the keys of the service account
-
-Disadvantages of static accounts:
-
-- Self management of service accounts is necessary.
-
-### Access tokens vs. service account keys
-
-Advantages of `access_tokens`:
-
-- Can generate infinite number of tokens per roleset
-
-Disadvantages of `access_tokens`:
-
-- Cannot be used with some client libraries or tools
-- Have a static life-time of 1 hr that cannot be modified, revoked, or extended.
-
-Advantages of `service_account_keys`:
-
-- Controllable life-time through Vault, allowing for longer access
-- Can be used by all normal GCP tooling
-
-Disadvantages of `service_account_keys`:
-
-- Infinite lifetime in GCP (i.e. if they are not managed properly, leaked keys can live forever)
-- Limited to 10 per roleset/service account.
-
-When generating OAuth access tokens, Vault will still
-generate a dedicated service account and key. This private key is stored in Vault
-and is never accessible to other users, and the underlying key can
-be rotated. See the [GCP API documentation][api] for more information on
-rotation.
-
-### Service accounts are tied to rolesets
-
-Service Accounts are created when the roleset is created (or updated) rather
-than each time a secret is generated. This may be different from how other
-secrets engines behave, but it is for good reasons:
-
-- IAM Service Account creation and permission propagation can take up to 60
-  seconds to complete. By creating the Service Account in advance, we speed up
-  the timeliness of future operations and reduce the flakiness of automated
-  workflows.
-
-- Each GCP project has a limit on the number of IAM Service Accounts. You can
-  [request additional quota][quotas]. The quota increase is processed by humans,
-  so it is best to request this additional quota in advance. This limit is
-  currently 100, **including system-managed Service Accounts**. If Service
-  Accounts were created per secret, this quota limit would reduce the number of
-  secrets that can be generated.
-
-### Service account keys quota limits
-
-GCP IAM has a hard limit (currently 10) on the number of Service Account keys.
-Attempts to generate more keys will result in an error. If you find yourself
-running into this limit, consider the following:
-
-- Have shorter TTLs or revoke access earlier. If you are not using past Service
-  Account keys, consider rotating and freeing quota earlier.
-
-- Create additional rolesets which share the same set of permissions. Additional
-  rolesets can be created with the same set of permissions. This will create a
-  new service account and increases the number of keys you can create.
-
-- Where possible, use OAuth2 access tokens instead of Service Account keys.
-
-### Resources in IAM bindings must exist at roleset or static account creation
-
-Because the bindings for the Service Account are set during roleset/static account creation,
-resources that do not exist will fail the `getIamPolicy` API call.
-
-### Roleset creation may partially fail
-
-Every Service Account creation, key creation, and IAM policy change is a GCP API
-call per resource. If an API call to one of these resources fails, the roleset
-creation fails and Vault will attempt to rollback.
-
-These rollbacks are API calls, so they may also fail. The secrets engine uses a
-WAL to ensure that unused bindings are cleaned up. In the case of quota limits,
-you may need to clean these up manually.
-
-### Do not modify vault-owned IAM accounts
-
-While Vault will initially create and assign permissions to IAM service
-accounts, it is possible that an external user deletes or modifies this service
-account. These changes are difficult to detect, and it is best to prevent this
-type of modification through IAM permissions.
-
-Vault roleset Service Accounts will have emails in the format:
-
-```
-vault<roleset-prefix>-<creation-unix-timestamp>@...
-```
-
-Communicate with your teams (or use IAM permissions) to not modify these
-resources.
-
-## Help &amp; support
-
-The Google Cloud Vault secrets engine is written as an external Vault plugin and
-thus exists outside the main Vault repository. It is automatically bundled with
-Vault releases, but the code is managed separately.
-
-Please report issues, add feature requests, and submit contributions to the
-[vault-plugin-secrets-gcp repo on GitHub][repo].
-
-## API
-
-The GCP secrets engine has a full HTTP API. Please see the [GCP secrets engine API docs][api]
-for more details.
-
-[api]: /vault/api-docs/secret/gcp
-[cloud-creds]: https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application
-[custom-roles]: https://cloud.google.com/iam/docs/creating-custom-roles
-[gce]: https://cloud.google.com/compute/
-[gke]: https://cloud.google.com/kubernetes-engine/
-[iam-keys]: https://cloud.google.com/iam/docs/service-accounts#service_account_keys
-[iam-roles]: https://cloud.google.com/iam/docs/understanding-roles
-[predefined-roles]: https://cloud.google.com/iam/docs/understanding-roles#predefined_roles
-[repo]: https://github.com/hashicorp/vault-plugin-secrets-gcp
-[resource-name-full]: https://cloud.google.com/apis/design/resource_names#full_resource_name
-[resource-name-relative]: https://cloud.google.com/apis/design/resource_names#relative_resource_name
-[quotas]: https://cloud.google.com/compute/quotas
-[service-accounts]: https://cloud.google.com/compute/docs/access/service-accounts
-[workloads-ids]: https://cloud.google.com/iam/docs/workload-identities
-[attached-service-accounts]: https://cloud.google.com/iam/docs/workload-identities#attached-service-accounts
-[gke-workload-ids]: https://cloud.google.com/iam/docs/workload-identities#kubernetes-workload-identity
-
-## Upgrade guides
-
-### Deprecation of access token leases
-
-~> **NOTE**: This deprecation only affects access tokens. There is no change to the `service_account_key` secret type.
-
-Previous versions of this secrets engine (Vault <= 0.11.1) created a lease for
-each access token secret. We have removed them after discovering that these
-tokens, specifically Google OAuth2 tokens for IAM service accounts, are
-non-revocable and have a static 60 minute lifetime. To match the current
-limitations of the GCP APIs, the secrets engine will no longer allow for
-revocation or manage the token TTL - more specifically, **the access_token
-response will no longer include `lease_id` or other lease information**. This
-change does not reflect any change to the actual underlying OAuth tokens or GCP
-service accounts.
-
-To upgrade:
-
-- Remove references from `lease_id`, `lease_duration` or other `lease_*`
-  attributes when reading responses for the access tokens secrets endpoint (i.e.
-  from `gcp/token/$roleset`). See the [documentation for access
-  tokens](#access-tokens) to see the new format for the response.
-
-- Be aware of leftover leases from previous versions. While these old leases
-  will still be revocable, they will not actually invalidate their associated
-  access token, and that token will still be useable for up to one hour.
diff --git a/website/content/docs/secrets/gcpkms.mdx b/website/content/docs/secrets/gcpkms.mdx
deleted file mode 100644
index 6d8a3342b40..00000000000
--- a/website/content/docs/secrets/gcpkms.mdx
+++ /dev/null
@@ -1,447 +0,0 @@
----
-layout: docs
-page_title: Google Cloud KMS - Secrets Engines
-description: |-
-  The Google Cloud KMS secrets engine for Vault interfaces with Google Cloud
-  KMS for encryption/decryption of data and KMS key management through Vault.
----
-
-# Google Cloud KMS secrets engine
-
-The Google Cloud KMS Vault secrets engine provides encryption and key management
-via [Google Cloud KMS][kms]. It supports management of keys, including creation,
-rotation, and revocation, as well as encrypting and decrypting data with managed
-keys. This enables management of KMS keys through Vault's policies and IAM
-system.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the Google Cloud KMS secrets engine:
-
-   ```text
-   $ vault secrets enable gcpkms
-   Success! Enabled the gcpkms secrets engine at: gcpkms/
-   ```
-
-   By default, the secrets engine will mount at the name of the engine. To
-   enable the secrets engine at a different path, use the `-path` argument.
-
-1. Configure the secrets engine with account credentials and/or scopes:
-
-   ```text
-   $ vault write gcpkms/config \
-       credentials=@my-credentials.json
-   Success! Data written to: gcpkms/config
-   ```
-
-   If you are running Vault from inside [Google Compute Engine][gce] or [Google
-   Kubernetes Engine][gke], the instance or pod service account can be used in
-   place of specifying the credentials JSON file. For more information on
-   authentication, see the [authentication section](#authentication) below.
-
-1. Create a Google Cloud KMS key:
-
-   ```text
-   $ vault write gcpkms/keys/my-key \
-     key_ring=projects/my-project/locations/my-location/keyRings/my-keyring \
-     rotation_period=72h
-   ```
-
-   The `key_ring` parameter is specified in the following format:
-
-   ```text
-   projects/<project>/locations/<location>/keyRings/<keyring>
-   ```
-
-   where:
-
-   - `<project>` - the name of the GCP project (e.g. "my-project")
-   - `<location>` - the location of the KMS key ring (e.g. "us-east1", "global")
-   - `<keyring>` - the name of the KMS key ring (e.g. "my-keyring")
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can be used to encrypt, decrypt, and manage keys. The
-following sections describe the different ways in which keys can be managed.
-
-### Symmetric Encryption/Decryption
-
-This section describes using a Cloud KMS key for symmetric
-encryption/decryption. This is one of the most common types of encryption.
-Google Cloud manages the key ring which is used to encrypt and decrypt data.
-
-<table>
-  <thead>
-    <tr>
-      <th>Purpose</th>
-      <th>Supported Algorithms</th>
-    </tr>
-    <tr>
-      <td valign="top">
-        <code>encrypt_decrypt</code>
-      </td>
-      <td valign="top">
-        <code>symmetric_encryption</code>
-      </td>
-    </tr>
-  </thead>
-</table>
-
-1.  Create or use an existing key eligible for symmetric encryption/decryption:
-
-    ```text
-    $ vault write gcpkms/keys/my-key \
-        key_ring=projects/.../my-keyring \
-        purpose=encrypt_decrypt \
-        algorithm=symmetric_encryption
-    ```
-
-1.  Encrypt plaintext data using the `/encrypt` endpoint with a named key:
-
-    ```text
-    $ vault write gcpkms/encrypt/my-key plaintext="hello world"
-    Key            Value
-    ---            -----
-    ciphertext     CiQAuMv0lTiKjrF43Lgr4...
-    key_version    1
-    ```
-
-    Unlike Vault's transit backend, plaintext data does not need to be base64
-    encoded. The endpoint will automatically convert data.
-
-    Note that Vault is not _storing_ this data. The caller is responsible for
-    storing the resulting ciphertext.
-
-1.  Decrypt ciphertext using the `/decrypt` endpoint with a named key:
-
-    ```text
-    $ vault write gcpkms/decrypt/my-key ciphertext=CiQAuMv0lTiKjrF43Lgr4...
-    Key          Value
-    ---          -----
-    plaintext    hello world
-    ```
-
-    For easier scripting, it is also possible to extract the plaintext directly:
-
-    ```text
-    $ vault write -field=plaintext gcpkms/decrypt/my-key ciphertext=CiQAuMv0lTiKjrF43Lgr4...
-    hello world
-    ```
-
-1.  Rotate the underlying encryption key. This will generate a new crypto key
-    version on Google Cloud KMS and set that version as the active key.
-
-    ```text
-    $ vault write -f gcpkms/keys/rotate/my-key
-    WARNING! The following warnings were returned from Vault:
-
-      * The crypto key version was rotated successfully, but it can take up to 2
-      hours for the new crypto key version to become the primary. In practice, it
-      is usually much shorter. Be sure to issue a read operation and verify the
-      key version if you require new data to be encrypted with this key.
-
-    Key            Value
-    ---            -----
-    key_version    2
-    ```
-
-    As the message says, rotation is not immediate. Depending on a number of
-    factors, the propagation of the new key can take quite some time. If you
-    have a need to immediately encrypt data with this new key, query the API to
-    wait for the key to become the primary. Alternatively, you can specify the
-    `key_version` parameter to lock to the exact key for use with encryption.
-
-1.  Re-encrypt already-encrypted ciphertext to be encrypted with a new version of
-    the crypto key. Vault will decrypt the value using the appropriate key in the
-    keyring and then encrypt the resulting plaintext with the newest key in the
-    keyring.
-
-    ```text
-    $ vault write gcpkms/reencrypt/my-key ciphertext=CiQAuMv0lTiKjrF43Lgr4...
-    Key            Value
-    ---            -----
-    ciphertext     CiQAuMv0lZTTozQA/ElqM...
-    key_version    2
-    ```
-
-    This process **does not** reveal the plaintext data. As such, a Vault policy
-    could grant an untrusted process the ability to re-encrypt ciphertext data,
-    since the process would not be able to get access to the plaintext data.
-
-1.  Trim old key versions by deleting Cloud KMS crypto key versions that are
-    older than the `min_version` allowed on the key.
-
-    ```text
-    $ vault write gcpkms/keys/config/my-key min_version=10
-    ```
-
-    Then delete all keys older than version 10. This will make it impossible to
-    encrypt, decrypt, or sign values with the older key by conventional means.
-
-    ```text
-    $ vault write -f gcpkms/keys/trim/my-key
-    ```
-
-1.  Delete the key to delete all key versions and Vault's record of the key.
-
-    ```text
-    $ vault delete gcpkms/keys/my-key
-    ```
-
-    This will make it impossible to encrypt, decrypt, or sign values by
-    conventional means.
-
-### Asymmetric decryption
-
-This section describes using a Cloud KMS key for asymmetric decryption. In this
-model Google Cloud manages the key ring and exposes the public key via an API
-endpoint. The public key is used to encrypt data offline and produce ciphertext.
-When the plaintext is desired, the user submits the ciphertext to Cloud KMS
-which decrypts the value using the corresponding private key.
-
-<table>
-  <thead>
-    <tr>
-      <th>Purpose</th>
-      <th>Supported Algorithms</th>
-    </tr>
-    <tr>
-      <td valign="top">
-        <code>asymmetric_decrypt</code>
-      </td>
-      <td valign="top">
-        <code>rsa_decrypt_oaep_2048_sha256</code>
-        <br />
-        <code>rsa_decrypt_oaep_3072_sha256</code>
-        <br />
-        <code>rsa_decrypt_oaep_4096_sha256</code>
-      </td>
-    </tr>
-  </thead>
-</table>
-
-1.  Create or use an existing key eligible for symmetric encryption/decryption:
-
-    ```text
-    $ vault write gcpkms/keys/my-key \
-        key_ring=projects/.../my-keyring \
-        purpose=asymmetric_decrypt \
-        algorithm=rsa_decrypt_oaep_4096_sha256
-    ```
-
-1.  Retrieve the public key from Cloud KMS:
-
-    ```text
-    $ gcloud kms keys versions get-public-key <crypto-key-version> \
-        --location <location> \
-        --keyring <key-ring> \
-        --key <key> \
-        --output-file ~/mykey.pub
-    ```
-
-1.  Encrypt plaintext data with the public key. Note this varies widely between
-    programming languages. The following example uses OpenSSL, but you can use your
-    language's built-ins as well.
-
-    ```text
-    $ openssl pkeyutl -in ~/my-secret-file \
-        -encrypt -pubin \
-        -inkey ~/mykey.pub \
-        -pkeyopt rsa_padding_mode:oaep \
-        -pkeyopt rsa_oaep_md:sha256 \
-        -pkeyopt rsa_mgf1_md:sha256
-    ```
-
-    Note that this encryption happens offline (meaning outside of Vault), and
-    the encryption is happening with a _public_ key. Only Cloud KMS has the
-    corresponding _private_ key.
-
-1.  Decrypt ciphertext using the `/decrypt` endpoint with a named key:
-
-    ```text
-    $ vault write gcpkms/decrypt/my-key key_version=1 ciphertext=CiQAuMv0lTiKjrF43Lgr4...
-    Key          Value
-    ---          -----
-    plaintext    hello world
-    ```
-
-### Asymmetric signing
-
-This section describes using a Cloud KMS key for asymmetric signing. In this
-model Google Cloud manages the key ring and exposes the public key via an API
-endpoint. A message or digest is signed with the corresponding private key, and
-can be verified by anyone with the corresponding public key.
-
-<table>
-  <thead>
-    <tr>
-      <th>Purpose</th>
-      <th>Supported Algorithms</th>
-    </tr>
-    <tr>
-      <td valign="top">
-        <code>asymmetric_sign</code>
-      </td>
-      <td valign="top">
-        <code>rsa_sign_pss_2048_sha256</code>
-        <br />
-        <code>rsa_sign_pss_3072_sha256</code>
-        <br />
-        <code>rsa_sign_pss_4096_sha256</code>
-        <br />
-        <code>rsa_sign_pkcs1_2048_sha256</code>
-        <br />
-        <code>rsa_sign_pkcs1_3072_sha256</code>
-        <br />
-        <code>rsa_sign_pkcs1_4096_sha256</code>
-        <br />
-        <code>ec_sign_p256_sha256</code>
-        <br />
-        <code>ec_sign_p384_sha384</code>
-      </td>
-    </tr>
-  </thead>
-</table>
-
-1.  Create or use an existing key eligible for symmetric encryption/decryption:
-
-    ```text
-    $ vault write gcpkms/keys/my-key \
-        key_ring=projects/.../my-keyring \
-        purpose=asymmetric_sign \
-        algorithm=ec_sign_p384_sha384
-    ```
-
-1.  Calculate the base64-encoded binary digest. Use the hashing algorithm that
-    corresponds to they key type:
-
-    ```text
-    $ export DIGEST=$(openssl dgst -sha384 -binary /my/file | base64)
-    ```
-
-    Ask Cloud KMS to sign the digest:
-
-    ```text
-    $ vault write gcpkms/sign/my-key key_version=1 digest=$DIGEST
-    Key          Value
-    ---          -----
-    signature    MGYCMQDbOS2462SKMsGdh2GQ...
-    ```
-
-1.  Verify the signature of the digest:
-
-    ```text
-    $ vault write gcpkms/verify/my-key key_version=1 digest=$DIGEST signature=$SIGNATURE
-    Key      Value
-    ---      -----
-    valid    true
-    ```
-
-    Note: it is also possible to verify this signature without Vault. Download
-    the public key from Cloud KMS, and use a tool like OpenSSL or your
-    programming language primitives to verify the signature.
-
-## Authentication
-
-The Google Cloud KMS Vault secrets backend uses the official Google Cloud Golang
-SDK. This means it supports the common ways of [providing credentials to Google
-Cloud][cloud-creds]. In addition to specifying `credentials` directly via Vault
-configuration, you can also get configuration from the following values **on the
-Vault server**:
-
-1. The environment variables `GOOGLE_APPLICATION_CREDENTIALS`. This is specified
-   as the **path** to a Google Cloud credentials file, typically for a service
-   account. If this environment variable is present, the resulting credentials are
-   used. If the credentials are invalid, an error is returned.
-
-1. Default instance credentials. When no environment variable is present, the
-   default service account credentials are used. This is useful when running Vault
-   on [Google Compute Engine][gce] or [Google Kubernetes Engine][gke]
-
-For more information on service accounts, please see the [Google Cloud Service
-Accounts documentation][service-accounts].
-
-To use this secrets engine, the service account must have the following
-minimum scope(s):
-
-```text
-https://www.googleapis.com/auth/kms
-```
-
-### Required permissions
-
-The credentials given to Vault must have the following role:
-
-```text
-roles/cloudkms.admin
-```
-
-If Vault will not be creating keys, you can reduce the permissions. For example,
-to create keys out of band and have Vault manage the encryption/decryption, you
-only need the following permissions:
-
-```text
-roles/cloudkms.cryptoKeyEncrypterDecrypter
-```
-
-To sign and verify, you only need the following permissions:
-
-```text
-roles/cloudkms.signerVerifier
-```
-
-For more information, please see the [Google Cloud KMS IAM documentation][kms-iam].
-
-## FAQ
-
-**How is this different than Vault's transit secrets engine?**<br />
-Vault's [transit][vault-transit] secrets engine uses in-memory keys to
-encrypt/decrypt keys. In general it will be faster and more performant. However,
-users who need physical, off-site, or out-of-band key management can use the
-[Google Cloud KMS][kms] secrets engine to get those benefits while leveraging
-Vault's policy and identity system.
-
-**Can Vault use an existing KMS key?**<br />
-You can use the `/register` endpoint to configure Vault to talk to an existing
-Google Cloud KMS key. As long as the IAM permissions are correct, Vault will be
-able to encrypt/decrypt data and rotate the key. See the [api][api] for more
-information.
-
-**Can this be used with a hardware key like an HSM?**<br />
-Yes! You can set `protection_level` to "hsm" when creating a key, or use an
-existing Cloud KMS key that is backed by an HSM.
-
-**How much does this cost?**<br />
-The plugin is free and open source. KMS costs vary by key type and the number of
-operations. Please see the [Cloud KMS pricing page][kms-pricing] for more
-details.
-
-## Help &amp; support
-
-The Google Cloud KMS Vault secrets engine is written as an external Vault
-plugin. The code lives outside the main Vault repository. It is automatically
-bundled with Vault releases, but the code is managed separately.
-
-Please report issues, add feature requests, and submit contributions to the
-[vault-plugin-secrets-gcpkms repo on GitHub][repo].
-
-## API
-
-The Google Cloud KMS secrets engine has a full HTTP API. Please see the
-[Google Cloud KMS secrets engine API docs][api] for more details.
-
-[api]: /vault/api-docs/secret/gcpkms
-[cloud-creds]: https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application
-[gce]: https://cloud.google.com/compute/
-[gke]: https://cloud.google.com/kubernetes-engine/
-[kms]: https://cloud.google.com/kms
-[kms-iam]: https://cloud.google.com/kms/docs/reference/permissions-and-roles
-[kms-pricing]: https://cloud.google.com/kms/pricing
-[repo]: https://github.com/hashicorp/vault-plugin-secrets-gcpkms
-[service-accounts]: https://cloud.google.com/compute/docs/access/service-accounts
-[vault-transit]: /vault/docs/secrets/transit
diff --git a/website/content/docs/secrets/identity/identity-token.mdx b/website/content/docs/secrets/identity/identity-token.mdx
deleted file mode 100644
index 8e14200e71d..00000000000
--- a/website/content/docs/secrets/identity/identity-token.mdx
+++ /dev/null
@@ -1,196 +0,0 @@
----
-layout: docs
-page_title: Identity Tokens
-description: Details and best practices for identity tokens.
----
-
-# Identity tokens
-
-## Introduction
-
-Identity information is used throughout Vault, but it can also be exported for
-use by other applications. An authorized user/application can request a token
-that encapsulates identity information for their associated entity. These
-tokens are signed JWTs following the [OIDC ID
-token](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) structure.
-The public keys used to authenticate the tokens are published by Vault on an
-unauthenticated endpoint following OIDC discovery and JWKS conventions, which
-should be directly usable by JWT/OIDC libraries. An introspection endpoint is
-also provided by Vault for token verification.
-
-### Roles and keys
-
-OIDC-compliant ID tokens are generated against a role which allows configuration
-of token claims via a templating system, token ttl, and a way to specify which
-"key" will be used to sign the token. The role template is an optional parameter
-to customize the token contents and is described in the next section. Token TTL
-controls the expiration time of the token, after which verification libraries will
-consider the token invalid. All roles have an associated `client_id` that will be
-added to the token's `aud` parameter. JWT/OIDC libraries will usually require this
-value. The parameter may be set by the operator to a chosen value, or a
-Vault-generated value will be used if left unconfigured.
-
-A role's `key` parameter links a role to an existing named key (multiple roles
-may refer to the same key). It is not possible to generate an unsigned ID token.
-
-A named key is a public/private key pair generated by Vault. The private key is
-used to sign the identity tokens, and the public key is used by clients to
-verify the signature. Keys are regularly rotated, whereby a new key pair is
-generated and the previous _public_ key is retained for a limited time for
-verification purposes.
-
-A named key's configuration specifies a rotation period, a verification ttl,
-signing algorithm and allowed client IDs. Rotation period specifies the
-frequency at which a new signing key is generated and the private portion of the
-previous signing key is deleted. Verification ttl is the time a public key is
-retained for verification after being rotated. By default, keys are rotated
-every 24 hours, and continue to be available for verification for 24 hours after
-their rotation.
-
-A key's list of allowed client IDs limits which roles may reference the key. The
-parameter may be set to `*` to allow all roles. The validity evaluation is made
-when a token is requested, not during configuration.
-
-### Token contents and templates
-
-Identity tokens will always contain, at a minimum, the claims required by OIDC:
-
-- `iss` - Issuer URL
-- `sub` - Requester's entity ID
-- `aud` - `client_id` for the role
-- `iat` - Time of issue
-- `exp` - Expiration time for the token
-
-In addition, the operator may configure per-role templates that allow a variety
-of other entity information to be added to the token. The templates are
-structured as JSON with replaceable parameters. The parameter syntax is the same
-as that used for [ACL Path Templating](/vault/docs/concepts/policies).
-
-For example:
-
-```jsx
-{
-  "color": {{identity.entity.metadata.color}},
-  "userinfo": {
-     "username": {{identity.entity.aliases.usermap_123.metadata.username}},
-     "groups": {{identity.entity.groups.names}}
-  },
-  "nbf": {{time.now}}
-}
-```
-
-When a token is requested, the resulting template might be populated as:
-
-```json
-{
-  "color": "green",
-  "userinfo": {
-     "username": "bob",
-     "groups": ["web", "engr", "default"]
-  },
-  "nbf": 1561411915
-}
-```
-
-which would be merged with the base OIDC claims into the final token:
-
-```json
-{
-  "iss": "https://10.1.1.45:8200/v1/identity/oidc",
-  "sub": "a2cd63d3-5364-406f-980e-8d71bb0692f5",
-  "aud": "SxSouteCYPBoaTFy94hFghmekos",
-  "iat": 1561411915,
-  "exp": 1561412215,
-  "color": "green",
-  "userinfo": {
-    "username": "bob",
-    "groups": ["web", "engr", "default"]
-  },
-  "nbf": 1561411915
-}
-```
-
-Note how the template is merged, with top level template keys becoming top level
-token keys. For this reason, templates may not contain top level keys that
-overwrite the standard OIDC claims.
-
-Template parameters that are not present for an entity, such as a metadata that
-isn't present, or an alias accessor which doesn't exist, are simply empty
-strings or objects, depending on the data type.
-
-Templates are configured on the role and may be optionally encoded as base64.
-
-The full list of template parameters is shown below:
-
-| Name                                                                             | Description                                                                             |
-| :------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------- |
-| `identity.entity.id`                                                             | The entity's ID                                                                         |
-| `identity.entity.name`                                                           | The entity's name                                                                       |
-| `identity.entity.groups.ids`                                                     | The IDs of the groups the entity is a member of                                         |
-| `identity.entity.groups.names`                                                   | The names of the groups the entity is a member of                                       |
-| `identity.entity.metadata`                                                       | Metadata associated with the entity                                                     |
-| `identity.entity.metadata.<metadata key>`                                        | Metadata associated with the entity for the given key                                   |
-| `identity.entity.aliases.<mount accessor>.id`                                    | Entity alias ID for the given mount                                                     |
-| `identity.entity.aliases.<mount accessor>.name`                                  | Entity alias name for the given mount                                                   |
-| `identity.entity.aliases.<mount accessor>.metadata`                              | Metadata associated with the alias for the given mount                                  |
-| `identity.entity.aliases.<mount accessor>.metadata.<metadata key>`               | Metadata associated with the alias for the given mount and metadata key                 |
-| `identity.entity.aliases.<mount accessor>.custom_metadata`                       | Custom metadata associated with the alias for the given mount                           |
-| `identity.entity.aliases.<mount accessor>.custom_metadata.<custom_metadata key>` | Custom metadata associated with the alias for the given mount and custom metadata key   |
-| `time.now`                                                                       | Current time as integral seconds since the Epoch                                        |
-| `time.now.plus.<duration>`                                                       | Current time plus a [duration format string](/vault/docs/concepts/duration-format)                 |
-| `time.now.minus.<duration>`                                                      | Current time minus a [duration format string](/vault/docs/concepts/duration-format)                |
-
-### Token generation
-
-An authenticated client may request a token using the [token generation
-endpoint](/vault/api-docs/secret/identity/tokens#generate-a-signed-id-token). The token
-will be generated per the requested role's specifications, for the requester's
-entity. It is not possible to generate tokens for an arbitrary entity.
-
-### Verifying authenticity of ID tokens generated by Vault
-
-An identity token may be verified by the client party using the public keys
-published by Vault, or via a Vault-provided introspection endpoint.
-
-Vault will serve standard "[.well-known](https://tools.ietf.org/html/rfc5785)"
-endpoints that allow easy integration with OIDC verification libraries.
-Configuring the libraries will typically involve providing an issuer URL and
-client ID. The library will then handle key requests and can validate the
-signature and claims requirements on tokens. This approach has the advantage of
-only requiring _access_ to Vault, not _authorization_, as the .well-known
-endpoints are unauthenticated.
-
-Alternatively, the token may be sent to Vault for verification via an
-[introspection endpoint](/vault/api-docs/secret/identity/tokens#introspect-a-signed-id-token).
-The response will indicate whether the token is "active" or not, as well as any
-errors that occurred during validation. Beyond simply allowing the client to
-delegate verification to Vault, using this endpoint incorporates the additional
-check of whether the entity is still active or not, which is something that
-cannot be determined from the token alone. Unlike the .well-known endpoint, accessing the
-introspection endpoint does require a valid Vault token and sufficient
-authorization.
-
-### Issuer considerations
-
-The identity token system has one configurable parameter: issuer. The issuer
-`iss` claim is particularly important for proper validation of the token by
-clients, and special consideration should be given when using Identity Tokens
-with [performance replication](/vault/docs/enterprise/replication).
-Consumers of the token will request public keys from Vault using the issuer URL,
-so it must be network reachable. Furthermore, the returned set of keys will include
-an issuer that must match the request.
-
-By default Vault will set the issuer to the Vault instance's
-[`api_addr`](/vault/docs/configuration#api_addr). This means that tokens
-issued in a given cluster should be validated within that same cluster.
-Alternatively, the [`issuer`](/vault/api-docs/secret/identity/tokens#issuer) parameter
-may be configured explicitly. This address must point to the identity/oidc path
-for the Vault instance (e.g.
-`https://vault-1.example.com:8200/v1/identity/oidc`) and should be
-reachable by any client trying to validate identity tokens.
-
-## API
-
-The Identity secrets engine has a full HTTP API. Please see the
-[Identity secrets engine API](/vault/api-docs/secret/identity) for more
-details.
diff --git a/website/content/docs/secrets/identity/index.mdx b/website/content/docs/secrets/identity/index.mdx
deleted file mode 100644
index adad33220de..00000000000
--- a/website/content/docs/secrets/identity/index.mdx
+++ /dev/null
@@ -1,50 +0,0 @@
----
-layout: docs
-page_title: Identity - Secrets Engines
-description: The Identity secrets engine for Vault manages client identities.
----
-
-# Identity secrets engine
-
-Name: `identity`
-
-The Identity secrets engine is the identity management solution for Vault. It
-internally maintains the clients who are recognized by Vault. Each client is
-internally termed as an `Entity`. An entity can have multiple `Aliases`. For
-example, a single user who has accounts in both GitHub and LDAP, can be mapped
-to a single entity in Vault that has 2 aliases, one of type GitHub and one of
-type LDAP. When a client authenticates successfully via any of the credential backends
-(except the Token backend), Vault creates a new entity and attaches a new
-alias to it, if a corresponding entity doesn't already exist. The entity identifier will
-be tied to the authenticated token. When such tokens are put to use, their
-entity identifiers are audit logged, marking a trail of actions performed by
-specific users.
-
-Identity store allows operators to **manage** the entities in Vault. Entities
-can be created and aliases can be tied to entities, via the ACL'd API. There
-can be policies set on the entities which adds capabilities to the tokens that
-are tied to entity identifiers. The capabilities granted to tokens via the
-entities are **an addition** to the existing capabilities of the token and
-**not** a replacement. The capabilities of the token that get inherited from
-entities are computed dynamically at request time. This provides flexibility in
-controlling the access of tokens that are already issued.
-
-~> **NOTE:** This secrets engine will be mounted by default. This secrets engine
-cannot be disabled or moved. For more conceptual overview on identity, refer to
-the [Identity](/vault/docs/concepts/identity) documentation.
-
-The Vault Identity secrets engine supports several different features. Each
-one is individually documented on its own page.
-
-- [Identity tokens](/vault/docs/secrets/identity/identity-token)
-- [OIDC Identity Provider](/vault/docs/secrets/identity/oidc-provider)
-
-## API
-
-The Identity secrets engine has a full HTTP API. Please see the
-[Identity secrets engine API](/vault/api-docs/secret/identity) for more
-details.
-
-Additionally, Vault can be configured as an OIDC identity provider. Please see
-the [OIDC identity provider API](/vault/api-docs/secret/identity/oidc-provider) for
-more details.
diff --git a/website/content/docs/secrets/identity/oidc-provider.mdx b/website/content/docs/secrets/identity/oidc-provider.mdx
deleted file mode 100644
index 01445d70b27..00000000000
--- a/website/content/docs/secrets/identity/oidc-provider.mdx
+++ /dev/null
@@ -1,177 +0,0 @@
----
-layout: docs
-page_title: OIDC Identity Provider
-description: >-
-  Setup and configuration for Vault as an OpenID Connect (OIDC) identity provider.
----
-
-# OIDC identity provider
-
-Vault is an OpenID Connect ([OIDC](https://openid.net/specs/openid-connect-core-1_0.html))
-identity provider. This enables client applications that speak the OIDC protocol to leverage
-Vault's source of [identity](/vault/docs/concepts/identity) and wide range of [authentication methods](/vault/docs/auth)
-when authenticating end-users. Client applications can configure their authentication logic
-to talk to Vault. Once enabled, Vault will act as the bridge to other identity providers via
-its existing authentication methods. Client applications can also obtain identity information
-for their end-users by leveraging custom templating of Vault identity information.
-
-\-> **Note**: For more detailed information on the configuration resources and OIDC endpoints,
-please visit the [OIDC provider](/vault/docs/concepts/oidc-provider) concepts page.
-
-## Setup
-
-The Vault OIDC provider system is built on top of the identity secrets engine.
-This secrets engine is mounted by default and cannot be disabled or moved.
-
-Each Vault namespace has a default OIDC [provider](/vault/docs/concepts/oidc-provider#oidc-providers)
-and [key](/vault/docs/concepts/oidc-provider#keys). This built-in configuration enables client
-applications to begin using Vault as a source of identity with minimal configuration. For
-details on the built-in configuration and advanced options, see the [OIDC provider](/vault/docs/concepts/oidc-provider)
-concepts page.
-
-The following steps show a minimal configuration that allows a client application to use
-Vault as an OIDC provider.
-
-1. Enable a Vault auth method:
-
-   ```text
-   $ vault auth enable userpass
-   Success! Enabled userpass auth method at: userpass/
-   ```
-
-Any Vault auth method may be used within the OIDC flow. For simplicity, enable the
-`userpass` auth method.
-
-2. Create a user:
-
-   ```text
-   $ vault write auth/userpass/users/end-user password="securepassword"
-   Success! Data written to: auth/userpass/users/end-user
-   ```
-
-   This user will authenticate to Vault through a client application, otherwise known as
-   an OIDC [relying party](https://openid.net/specs/openid-connect-core-1_0.html#Terminology).
-
-2. Create a client application:
-
-   ```text
-   $ vault write identity/oidc/client/my-webapp \
-     redirect_uris="https://localhost:9702/auth/oidc-callback" \
-     assignments="allow_all"
-   Success! Data written to: identity/oidc/client/my-webapp
-   ```
-
-   This operation creates a client application which can be used to configure an OIDC
-   relying party. See the [client applications](/vault/docs/concepts/oidc-provider#client-applications)
-   section for details on different client types, including `confidential` and `public` clients.
-
-   The `assignments` parameter limits the Vault entities and groups that are allowed to
-   authenticate through the client application. By default, no Vault entities are allowed.
-   To allow all Vault entities to authenticate, the built-in [allow_all](/vault/docs/concepts/oidc-provider#assignments)
-   assignment is provided.
-
-2. Read client credentials:
-
-   ```text
-   $ vault read identity/oidc/client/my-webapp
-
-   Key                 Value
-   ---                 -----
-   access_token_ttl    24h
-   assignments         [allow_all]
-   client_id           GSDTnn3KaOrLpNlVGlYLS9TVsZgOTweO
-   client_secret       hvo_secret_gBKHcTP58C4aq7FqPWsuqKgpiiegd7ahpifGae9WGkHRCwFEJTZA9KGdNVpzE0r8
-   client_type         confidential
-   id_token_ttl        24h
-   key                 default
-   redirect_uris       [https://localhost:9702/auth/oidc-callback]
-   ```
-
-   The `client_id` and `client_secret` are the client application's credentials. These
-   values are typically required when configuring an OIDC relying party.
-
-2. Read OIDC discovery configuration:
-
-   ```text
-   $ curl -s http://127.0.0.1:8200/v1/identity/oidc/provider/default/.well-known/openid-configuration
-   {
-     "issuer": "http://127.0.0.1:8200/v1/identity/oidc/provider/default",
-     "jwks_uri": "http://127.0.0.1:8200/v1/identity/oidc/provider/default/.well-known/keys",
-     "authorization_endpoint": "http://127.0.0.1:8200/ui/vault/identity/oidc/provider/default/authorize",
-     "token_endpoint": "http://127.0.0.1:8200/v1/identity/oidc/provider/default/token",
-     "userinfo_endpoint": "http://127.0.0.1:8200/v1/identity/oidc/provider/default/userinfo",
-     "request_parameter_supported": false,
-     "request_uri_parameter_supported": false,
-     "id_token_signing_alg_values_supported": [
-       "RS256",
-       "RS384",
-       "RS512",
-       "ES256",
-       "ES384",
-       "ES512",
-       "EdDSA"
-     ],
-     "response_types_supported": [
-       "code"
-     ],
-     "scopes_supported": [
-       "openid"
-     ],
-     "subject_types_supported": [
-       "public"
-     ],
-     "grant_types_supported": [
-       "authorization_code"
-     ],
-     "token_endpoint_auth_methods_supported": [
-       "none",
-       "client_secret_basic",
-       "client_secret_post"
-     ],
-     "code_challenge_methods_supported": [
-       "plain",
-       "S256"
-     ]
-   }
-   ```
-
-   Each Vault OIDC provider publishes [discovery metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
-   The `issuer` value is typically required when configuring an OIDC relying party.
-
-## Usage
-
-After configuring a Vault auth method and client application, the following details can
-be used to configure an OIDC relying party to delegate end-user authentication to Vault.
-
-- `client_id` - The ID of the client application
-- `client_secret` - The secret of the client application
-- `issuer` - The issuer of the Vault OIDC provider
-
-A number of HashiCorp products provide OIDC authentication methods. This means that they
-can leverage Vault as a source of identity using the OIDC protocol. See the following links
-for details on configuring OIDC authentication for other HashiCorp products:
-
-- [Boundary](/boundary/tutorials/access-management/oidc-auth)
-- [Consul](/consul/docs/security/acl/auth-methods/oidc)
-- [Waypoint](/waypoint/docs/server/auth/oidc)
-- [Nomad](/nomad/tutorials/single-sign-on/sso-oidc-vault)
-
-Otherwise, refer to the documentation of the specific OIDC relying party for usage details.
-
-## Supported flows
-
-The Vault OIDC provider feature currently supports the following authentication flow:
-
-- [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth).
-
-## Tutorial
-
-Refer to the [Vault as an OIDC Identity Provider](/vault/tutorials/auth-methods/oidc-identity-provider)
-tutorial to learn how to configure a HashiCorp [Boundary](https://www.boundaryproject.io/)
-to leverage Vault as a source of identity using the OIDC protocol.
-
-## API
-
-The Vault OIDC provider feature has a full HTTP API. Please see the
-[OIDC identity provider API](/vault/api-docs/secret/identity/oidc-provider) for more
-details.
diff --git a/website/content/docs/secrets/index.mdx b/website/content/docs/secrets/index.mdx
deleted file mode 100644
index 14f218365f5..00000000000
--- a/website/content/docs/secrets/index.mdx
+++ /dev/null
@@ -1,75 +0,0 @@
----
-layout: docs
-page_title: Secrets Engines
-description: Secrets engines are mountable engines that store or generate secrets in Vault.
----
-
-# Secrets engines
-
-Secrets engines are components which store, generate, or encrypt data. Secrets
-engines are incredibly flexible, so it is easiest to think about them in terms
-of their function. Secrets engines are provided some set of data, they take some
-action on that data, and they return a result.
-
-Some secrets engines simply store and read data - like encrypted
-Redis/Memcached. Other secrets engines connect to other services and generate
-dynamic credentials on demand. Other secrets engines provide encryption as a
-service, totp generation, certificates, and much more.
-
-Secrets engines are enabled at a **path** in Vault. When a request comes to
-Vault, the router automatically routes anything with the route prefix to the
-secrets engine. In this way, each secrets engine defines its own paths and
-properties. To the user, secrets engines behave similar to a virtual filesystem,
-supporting operations like read, write, and delete.
-
-## Secrets engines lifecycle
-
-Most secrets engines can be enabled, disabled, tuned, and moved via the CLI or
-API. 
-
-- [Enable](/vault/docs/commands/secrets/enable) - This enables a secrets engine at
-  a given path. With a few exceptions, secrets engines can be enabled at multiple
-  paths. Each secrets engine is isolated to its path. By default, they are
-  enabled at their "type" (e.g. "aws" enables at `aws/`).
-
-  !> **Case-sensitive:** The path where you enable secrets engines is case-sensitive. For
-  example, the KV secrets engine enabled at `kv/` and `KV/` are treated as two
-  distinct instances of KV secrets engine.
-
-- [Disable](/vault/docs/commands/secrets/disable) - This disables an existing
-  secrets engine. When a secrets engine is disabled, all of its secrets are
-  revoked (if they support it), and all the data stored for that engine in
-  the physical storage layer is deleted.
-
-- [Move](/vault/docs/commands/secrets/move) - This moves the path for an existing
-  secrets engine. This process revokes all secrets, since secret leases are tied
-  to the path where they were created. The configuration data stored for the engine
-  persists through the move.
-
-- [Tune](/vault/docs/commands/secrets/tune) - This tunes global configuration for
-  the secrets engine such as the TTLs.
-
-Once a secrets engine is enabled, you can interact with it directly at its path
-according to its own API. Use `vault path-help` to determine the paths it
-responds to.
-
-Note that mount points cannot conflict with each other in Vault. There are
-two broad implications of this fact. The first is that you cannot have
-a mount which is prefixed with an existing mount. The second is that you
-cannot create a mount point that is named as a prefix of an existing mount.
-As an example, the mounts `foo/bar` and `foo/baz` can peacefully coexist
-with each other whereas `foo` and `foo/baz` cannot
-
-## Barrier view
-
-Secrets engines receive a _barrier view_ to the configured Vault physical
-storage. This is a lot like a [chroot](https://en.wikipedia.org/wiki/Chroot).
-
-When a secrets engine is enabled, a random UUID is generated. This becomes the
-data root for that engine. Whenever that engine writes to the physical storage
-layer, it is prefixed with that UUID folder. Since the Vault storage layer
-doesn't support relative access (such as `../`), this makes it impossible for an
-enabled secrets engine to access other data.
-
-This is an important security feature in Vault - even a malicious engine
-cannot access the data from any other engine.
diff --git a/website/content/docs/secrets/key-management/awskms.mdx b/website/content/docs/secrets/key-management/awskms.mdx
deleted file mode 100644
index 8cf557c5c1c..00000000000
--- a/website/content/docs/secrets/key-management/awskms.mdx
+++ /dev/null
@@ -1,84 +0,0 @@
----
-layout: docs
-page_title: AWS KMS - Key Management - Secrets Engines
-description: AWS KMS is a supported KMS provider of the Key Management secrets engine.
----
-
-# AWS KMS
-
--> **Note**: This secret engine requires [Vault Enterprise](https://www.hashicorp.com/products/vault/)
-with the Advanced Data Protection Module.
-
-The Key Management secrets engine supports lifecycle management of keys in [AWS KMS](https://aws.amazon.com/kms/)
-regions. This is accomplished by configuring a KMS provider resource with the `awskms` provider and
-other provider-specific parameter values.
-
-The following sections describe how to properly configure the secrets engine to enable
-the functionality.
-
-## Authentication
-
-The Key Management secrets engine must be configured with credentials that have sufficient
-permissions to manage keys in an AWS KMS region. The authentication parameters are described
-in the [credentials](/vault/api-docs/secret/key-management/awskms#credentials) section of the API
-documentation. The authentication parameters will be set with the following order of
-precedence:
-
-1. [KMS provider credentials](/vault/api-docs/secret/key-management/awskms#credentials)
-2. Environment variables
-3. Shared credentials file
-4. IAM role for AWS EC2 or ECS task
-
-The IAM principal associated with the provided credentials must have the following minimum
-[AWS KMS permissions](https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html):
-
-- `kms:CreateKey`
-- `kms:GetParametersForImport`
-- `kms:ImportKeyMaterial`
-- `kms:EnableKey`
-- `kms:DisableKey`
-- `kms:ScheduleKeyDeletion`
-- `kms:CreateAlias`
-- `kms:UpdateAlias`
-- `kms:DeleteAlias`
-- `kms:ListAliases`
-- `kms:TagResource`
-
-## Configuration
-
-The following is an example of how to configure the KMS provider resource using the Vault CLI:
-
-```text
-$ vault write keymgmt/kms/example-kms \
-    provider="awskms" \
-    key_collection="us-west-1" \
-    credentials=access_key="ASIADJO3WTX6WPLJM42V" \
-    credentials=secret_key="bCiYmNroLxLmPNQ47VIvjlm8mQu5oktZcQdq195w"
-```
-
-Refer to the AWS KMS [API documentation](/vault/api-docs/secret/key-management/awskms)
-for a detailed description of individual configuration parameters.
-
-## Key transfer specification
-
-Keys are securely transferred from the secrets engine to AWS KMS regions in accordance
-with the AWS KMS [Bring Your Own Key](https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html)
-specification.
-
-## Key rotation
-
-AWS KMS keys with imported key material are not eligible for
-[automatic key rotation](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html)
-within AWS KMS. As such, key rotations performed by the secrets engine use the
-[manual key rotation](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html#rotate-keys-manually)
-process. Applications should refer to the [alias](https://docs.aws.amazon.com/kms/latest/developerguide/kms-alias.html)
-associated with imported keys. Aliases will always have the form: `hashicorp/<key_name>-<unix_timestamp>`.
-
-## Key purpose compatability
-
-The following table defines which key [purposes](/vault/api-docs/secret/key-management#purpose) can be used
-for each key type supported by AWS KMS.
-
-| Key Type       | Purpose                 |
-| -------------- | ----------------------- |
-| `aes256-gcm96` | `encrypt` and `decrypt` |
diff --git a/website/content/docs/secrets/key-management/azurekeyvault.mdx b/website/content/docs/secrets/key-management/azurekeyvault.mdx
deleted file mode 100644
index 60b596a0e49..00000000000
--- a/website/content/docs/secrets/key-management/azurekeyvault.mdx
+++ /dev/null
@@ -1,107 +0,0 @@
----
-layout: docs
-page_title: Azure Key Vault - Key Management - Secrets Engines
-description: Azure Key Vault is a supported KMS provider of the Key Management secrets engine.
----
-
-# Azure key Vault
-
-The Key Management secrets engine supports lifecycle management of keys in named
-[Azure Key Vault](https://docs.microsoft.com/en-us/azure/key-vault/) instances.
-This is accomplished by configuring a KMS provider resource with the `azurekeyvault`
-provider and other provider-specific parameter values.
-
-The following sections describe how to properly configure the secrets engine to enable
-the functionality.
-
-## Authentication
-
-The Key Management secrets engine must be configured with credentials that have sufficient
-permissions to manage keys in an Azure Key Vault instance. The authentication parameters are
-described in the [credentials](/vault/api-docs/secret/key-management/azurekeyvault#credentials) section
-of the API documentation. The authentication parameters will be set with the following order
-of precedence:
-
-1. Environment variables
-2. [KMS provider credentials](/vault/api-docs/secret/key-management/azurekeyvault#credentials)
-3. [Managed Service Identity (MSI)](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/overview)
-
-If the client ID or secret are not provided and Vault is running on an Azure VM, Vault will attempt
-to use MSI to access Azure. Note that when MSI is used, the tenant ID must still be explicitly provided
-by the configuration or environment variable.
-
-An Azure Key Vault [access policy](https://docs.microsoft.com/en-us/azure/key-vault/general/assign-access-policy-portal)
-determines whether a given service principal, namely an application or user group, can perform certain
-operations on a Key Vault instance. The service principal associated with the provided credentials must
-have an access policy on the Key Vault instance with the following minimum key permissions:
-
-- `create`
-- `delete`
-- `get`
-- `import`
-- `update`
-
-## Configuration
-
-The following is an example of how to configure the KMS provider resource using the Vault CLI:
-
-```text
-$ vault write keymgmt/kms/example-kms \
-    provider="azurekeyvault" \
-    key_collection="keyvault-name" \
-    credentials=client_id="a0454cd1-e28e-405e-bc50-7477fa8a00b7" \
-    credentials=client_secret="eR%HizuCVEpAKgeaUEx" \
-    credentials=tenant_id="cd4bf224-d114-4f96-9bbc-b8f45751c43f"
-```
-
-Refer to the Azure Key Vault [API documentation](/vault/api-docs/secret/key-management/azurekeyvault)
-for a detailed description of individual configuration parameters.
-
-## Key transfer specification
-
-Keys are securely transferred from the secrets engine to Azure key vault instances in accordance
-with the Azure [Bring Your Own Key](https://docs.microsoft.com/en-us/azure/key-vault/keys/byok-specification)
-specification.
-
-## Key purpose compatibility
-
-The following table defines which key [purposes](/vault/api-docs/secret/key-management#purpose) can be used
-for each key type supported by GCP Cloud KMS.
-
-| Key Type       | Purpose                                                 |
-| -------------- | ------------------------------------------------------- |
-| `rsa-2048`     | [All purposes](/vault/api-docs/secret/key-management#purpose) |
-| `rsa-3072`     | [All purposes](/vault/api-docs/secret/key-management#purpose) |
-| `rsa-4096`     | [All purposes](/vault/api-docs/secret/key-management#purpose) |
-
-## Azure private link
-
-The secrets engine can be configured to communicate with Azure Key Vault instances
-using [Azure Private Endpoints](https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview).
-Follow the guide at [Integrate Key Vault with Azure Private Link](https://docs.microsoft.com/en-us/azure/key-vault/general/private-link-service?tabs=portal)
-to set up a Private Endpoint for your target Key Vault instance in Azure. The Private Endpoint must
-be network reachable by Vault. This means Vault needs to be running in the same virtual network or
-a peered virtual network to properly resolve the Key Vault domain name to the Private Endpoint IP
-address.
-
-The Private Endpoint configuration relies on a correct [Azure Private DNS](https://docs.microsoft.com/en-us/azure/dns/private-dns-overview)
-integration. From the host that Vault is running on, follow the steps in
-[Validate that the private link connection works](https://docs.microsoft.com/en-us/azure/key-vault/general/private-link-service?tabs=portal#validate-that-the-private-link-connection-works)
-to ensure that the Key Vault domain name resolves to the Private Endpoint IP address you've configured.
-
-```
-$ nslookup <keyvault-name>.vault.azure.net
-
-Non-authoritative answer:
-Name:
-Address:  10.0.2.5 (private IP address)
-Aliases:  <keyvault-name>.vault.azure.net
-          <keyvault-name>.privatelink.vaultcore.azure.net
-```
-
-The secrets engine doesn't require special configuration to communicate with a Key Vault instance
-over an Azure Private Endpoint. For example, the given [KMS configuration](/vault/docs/secrets/key-management/azurekeyvault#configuration)
-will result in the secrets engine resolving a Key Vault domain name of `keyvault-name.vault.azure.net`
-to the Private Endpoint IP address. Note that it's possible to change the Key Vault DNS suffix using the
-[environment](/vault/api-docs/secret/key-management/azurekeyvault#environment)
-configuration parameter or `AZURE_ENVIRONMENT` environment variable.
diff --git a/website/content/docs/secrets/key-management/gcpkms.mdx b/website/content/docs/secrets/key-management/gcpkms.mdx
deleted file mode 100644
index 7e358cc31f7..00000000000
--- a/website/content/docs/secrets/key-management/gcpkms.mdx
+++ /dev/null
@@ -1,73 +0,0 @@
----
-layout: docs
-page_title: GCP Cloud KMS - Key Management - Secrets Engines
-description: GCP Cloud KMS is a supported KMS provider of the Key Management secrets engine.
----
-
-# GCP Cloud KMS
-
-The Key Management secrets engine supports lifecycle management of keys in GCP Cloud KMS
-[key rings](https://cloud.google.com/kms/docs/resource-hierarchy#key_rings). This is accomplished
-by configuring a KMS provider resource with the `gcpckms` provider and other provider-specific
-parameter values.
-
-The following sections describe how to properly configure the secrets engine to enable
-the functionality.
-
-## Authentication
-
-The Key Management secrets engine must be configured with credentials that have sufficient
-permissions to manage keys in an existing GCP Cloud KMS [key ring](https://cloud.google.com/kms/docs/resource-hierarchy#key_rings).
-The authentication parameters are described in the [credentials](/vault/api-docs/secret/key-management/gcpkms#credentials)
-section of the API documentation. The authentication parameters will be set with the following order
-of precedence:
-
-1. `GOOGLE_CREDENTIALS` environment variable
-2. [KMS provider credentials](/vault/api-docs/secret/key-management/gcpkms#credentials) parameter
-3. [Application default credentials](https://cloud.google.com/docs/authentication/production)
-
-The service account must be authorized with the following minimum
-[IAM permissions](https://cloud.google.com/kms/docs/reference/permissions-and-roles) on the
-target [key ring](https://cloud.google.com/kms/docs/resource-hierarchy#key_rings) resource:
-
-- `cloudkms.cryptoKeys.create`
-- `cloudkms.cryptoKeys.update`
-- `cloudkms.importJobs.create`
-- `cloudkms.importJobs.get`
-- `cloudkms.cryptoKeyVersions.list`
-- `cloudkms.cryptoKeyVersions.destroy`
-- `cloudkms.cryptoKeyVersions.update`
-- `cloudkms.cryptoKeyVersions.create`
-
-## Configuration
-
-The following is an example of how to configure the KMS provider resource using the Vault CLI:
-
-```text
-$ vault write keymgmt/kms/example-kms \
-    provider="gcpckms" \
-    key_collection="projects/<project-id>/locations/<location>/keyRings/<keyring>" \
-    credentials=service_account_file="/path/to/service_account/credentials.json"
-```
-
-Refer to the GCP Cloud KMS [API documentation](/vault/api-docs/secret/key-management/gcpkms)
-for a detailed description of individual configuration parameters.
-
-## Key transfer specification
-
-Keys are securely transferred from the secrets engine to GCP Cloud KMS in accordance
-with the [key import](https://cloud.google.com/kms/docs/key-import) specification.
-
-## Key purpose compatability
-
-The following table defines which key [purposes](/vault/api-docs/secret/key-management#purpose) can be used
-for each key type supported by GCP Cloud KMS.
-
-| Key Type       | Purpose                 |
-| -------------- | ----------------------- |
-| `aes256-gcm96` | `encrypt` and `decrypt` |
-| `rsa-2048`     | `decrypt` or `sign`     |
-| `rsa-3072`     | `decrypt` or `sign`     |
-| `rsa-4096`     | `decrypt` or `sign`     |
-| `ecdsa-p256`   | `sign`                  |
-| `ecdsa-p384`   | `sign`                  |
diff --git a/website/content/docs/secrets/key-management/index.mdx b/website/content/docs/secrets/key-management/index.mdx
deleted file mode 100644
index 5e81a225cf2..00000000000
--- a/website/content/docs/secrets/key-management/index.mdx
+++ /dev/null
@@ -1,177 +0,0 @@
----
-layout: docs
-page_title: Key Management - Secrets Engines
-description: >-
-  The Key Management secrets engine provides a consistent workflow for distribution and lifecycle
-  management of cryptographic keys in various key management service (KMS) providers.
----
-
-# Key management secrets engine
-
--> **Note**: This secrets engine requires [Vault
-Enterprise](https://www.hashicorp.com/products/vault/) (1.6.0+) with the Advanced Data
-Protection KMSE Module.
-
-The Key Management secrets engine provides a consistent workflow for distribution and lifecycle
-management of cryptographic keys in various key management service (KMS) providers. It allows
-organizations to maintain centralized control of their keys in Vault while still taking advantage
-of cryptographic capabilities native to the KMS providers.
-
-The secrets engine generates and owns original copies of key material. When an operator decides
-to distribute and manage the lifecycle of a key in one of the [supported KMS providers](#kms-providers),
-a copy of the key material is distributed. This provides additional durability and disaster
-recovery means for the complete lifecycle of the key in the KMS provider.
-
-Key material will always be securely transferred in accordance with the
-[key import specification](#kms-providers) of the supported KMS providers.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the Key Management secrets engine:
-
-   ```text
-   $ vault secrets enable keymgmt
-   Success! Enabled the keymgmt secrets engine at: keymgmt/
-   ```
-
-   By default, the secrets engine will mount at the name of the engine. To enable
-   the secrets engine at a different path, use the `-path` argument.
-
-## Usage
-
-After the secrets engine is mounted and a user/machine has a Vault token with
-the proper permission, it can use this secrets engine to generate, distribute, and
-manage the lifecycle of cryptographic keys in [supported KMS providers](#kms-providers).
-
-1. Create a named cryptographic key of a specified type:
-
-   ```text
-   $ vault write -f keymgmt/key/example-key type="rsa-2048"
-   Success! Data written to: keymgmt/key/example-key
-   ```
-
-   Keys created by the secrets engine are considered general-purpose until
-   they're distributed to a KMS provider.
-
-1. Configure a KMS provider:
-
-   ```text
-   $ vault write keymgmt/kms/example-kms \
-       provider="azurekeyvault" \
-       key_collection="keyvault-name" \
-       credentials=client_id="a0454cd1-e28e-405e-bc50-7477fa8a00b7" \
-       credentials=client_secret="eR%HizuCVEpAKgeaUEx" \
-       credentials=tenant_id="cd4bf224-d114-4f96-9bbc-b8f45751c43f"
-   ```
-
-   Conceptually, a KMS provider resource represents a destination for keys to be distributed to
-   and subsequently managed in. It is configured using a generic set of parameters. The values
-   supplied to the generic set of parameters will differ depending on the specified `provider`.
-
-   This operation creates a KMS provider that represents a named Azure Key Vault instance.
-   This is accomplished by specifying the `azurekeyvault` provider along with other provider-specific
-   parameter values. For details on how to configure each supported KMS provider, see the
-   [KMS Providers](#kms-providers) section.
-
-1. Distribute a key to a KMS provider:
-
-   ```text
-   $ vault write keymgmt/kms/example-kms/key/example-key \
-       purpose="encrypt,decrypt" \
-       protection="hsm"
-   ```
-
-   This operation distributes a **copy** of the named key to the KMS provider with a specific
-   `purpose` and `protection`. The `purpose` defines the set of cryptographic capabilities
-   that the key will have in the KMS provider. The `protection` defines where cryptographic
-   operations are performed with the key in the KMS provider. See the API documentation for a list of
-   supported [purpose](/vault/api-docs/secret/key-management#purpose) and [protection](/vault/api-docs/secret/key-management#protection)
-   values.
-
-   ~> **Note:** The amount of time it takes to distribute a key to a KMS provider is proportional to the
-   number of versions that the key has. If a timeout occurs when distributing a key to a KMS
-   provider, you may need to increase the [VAULT_CLIENT_TIMEOUT](/vault/docs/commands#vault_client_timeout).
-
-1. Rotate a key:
-
-   ```text
-   $ vault write -f keymgmt/key/example-key/rotate
-   ```
-
-   Rotating a key creates a new key version that contains new key material. The key will be rotated
-   in both Vault and the KMS provider that the key has been distributed to. The new key version
-   will be enabled and set as the current version for cryptographic operations in the KMS provider.
-
-1. Enable or disable key versions:
-
-   ```text
-   $ vault write keymgmt/key/example-key min_enabled_version=2
-   ```
-
-   The `min_enabled_version` of a key can be updated in order to enable or disable sequences of
-   key versions. All versions of the key less than the `min_enabled_version` will be disabled for
-   cryptographic operations in the KMS provider that the key has been distributed to. Setting a
-   `min_enabled_version` of `0` means that all key versions will be enabled.
-
-1. Remove a key from a KMS provider:
-
-   ```text
-   $ vault delete keymgmt/kms/example-kms/key/example-key
-   ```
-
-   This operation results in the key being deleted from the KMS provider. The key will still exist
-   in the secrets engine and can be redistributed to a KMS provider at a later time.
-
-   To permanently delete the key from the secrets engine, the [delete key](/vault/api-docs/secret/key-management#delete-key)
-   API may be invoked.
-
-## Key types
-
-The Key Management secrets engine supports generation of the following key types:
-
-- `aes256-gcm96` - AES-GCM with a 256-bit AES key and a 96-bit nonce (symmetric)
-- `rsa-2048` - RSA with bit size of 2048 (asymmetric)
-- `rsa-3072` - RSA with bit size of 3072 (asymmetric)
-- `rsa-4096` - RSA with bit size of 4096 (asymmetric)
-- `ecdsa-p256` - ECDSA using the P-256 elliptic curve (asymmetric)
-- `ecdsa-p384` - ECDSA using the P-384 elliptic curve (asymmetric)
-- `ecdsa-p521` - ECDSA using the P-521 elliptic curve (asymmetric)
-
-## KMS providers
-
-The Key Management secrets engine supports lifecycle management of keys in the following
-KMS providers:
-
-- [Azure Key Vault](/vault/docs/secrets/key-management/azurekeyvault)
-- [AWS KMS](/vault/docs/secrets/key-management/awskms)
-- [GCP Cloud KMS](/vault/docs/secrets/key-management/gcpkms)
-
-Refer to the provider-specific documentation for details on how to properly configure each provider.
-
-## Compatibility
-
-The following table defines which key types are compatible with each KMS provider.
-
-| Key Type       | Azure Key Vault | AWS KMS | GCP Cloud KMS |
-| -------------- | --------------- | ------- | ------------- |
-| `aes256-gcm96` | No              | **Yes** | **Yes**       |
-| `rsa-2048`     | **Yes**         | No      | **Yes**       |
-| `rsa-3072`     | **Yes**         | No      | **Yes**       |
-| `rsa-4096`     | **Yes**         | No      | **Yes**       |
-| `ecdsa-p256`   | No              | No      | **Yes**       |
-| `ecdsa-p384`   | No              | No      | **Yes**       |
-| `ecdsa-p521`   | No              | No      | No            |
-
-## Tutorial
-
-Refer to the [Key Management Secrets Engine](/vault/tutorials/key-management) tutorial series to learn how to use the key management secrets engine for Azure and GCP.
-
-## API
-
-The Key Management secrets engine has a full HTTP API. Please see the
-[Key Management Secrets Engine API](/vault/api-docs/secret/key-management) for more
-details.
diff --git a/website/content/docs/secrets/kmip-profiles.mdx b/website/content/docs/secrets/kmip-profiles.mdx
deleted file mode 100644
index 8be5555e5b8..00000000000
--- a/website/content/docs/secrets/kmip-profiles.mdx
+++ /dev/null
@@ -1,338 +0,0 @@
----
-layout: docs
-page_title: KMIP - Profiles Support
-description: |-
-  The KMIP profiles define the use of KMIP objects, attributes, operations, message elements
-  and authentication methods within specific contexts of KMIP server and client interaction.
-  These profiles define a set of normative constraints for employing KMIP within a particular
-  environment or context of use.
----
-
-# KMIP profiles version 1.4
-
-This document specifies conformance clauses in accordance with the OASIS TC Process ([TC-PROC section 2.18 paragraph 8a][tc-proc-2.18] )
-for the KMIP Specification ([KMIP-SPEC 12.1 and 12.2][kmip-spec]) for a KMIP server or KMIP client through profiles that define the
-use of KMIP objects, attributes, operations, message elements and authentication methods within specific contexts of
-KMIP server and client interaction.
-
-Vault implements version 1.4 of the following Key Management Interoperability Protocol Profiles:
-
-## [Baseline server][baseline-server]
-  1. Supports the following objects:
-
-    | Object                                                                  | Supported |
-    | ----------------------------------------------------------------------- | :-------: |
-    | Attribute [KMIP-SPEC 2.1.1][kmip-spec-2.1.1]                            | ✅        |
-    | Credential [KMIP-SPEC 2.1.2][kmip-spec-2.1.2]                           | ✅        |
-    | Key Block [KMIP-SPEC 2.1.3][kmip-spec-2.1.3]                            | ✅        |
-    | Key Value [KMIP-SPEC 2.1.4][kmip-spec-2.1.4]                            | ✅        |
-    | Template-Attribute Structure [KMIP-SPEC 2.1.8][kmip-spec-2.1.8]         | ✅        |
-    | Extension Information [KMIP-SPEC 2.1.9][kmip-spec-2.1.9]                | ✅        |
-    | Profile Information [KMIP-SPEC 2.1.19][kmip-spec-2.1.19]                | ✅        |
-    | Validation Information [KMIP-SPEC 2.1.20][kmip-spec-2.1.20]             | ✅        |
-    | Capability Information [KMIP-SPEC 2.1.21][kmip-spec-2.1.21]             | ✅        |
-
-  2. Supports the following subsets of attributes:
-
-    | Attribute                                                              | Supported | Notes  |
-    | -----------------------------------------------------------------------| :-------: | :----: |
-    | Unique Identifier [KMIP-SPEC 3.1][kmip-spec-3.1]                       | ✅        |        |
-    | Name [KMIP-SPEC 3.2][kmip-spec-3.2]                                    | ✅        |        |
-    | Object Type [KMIP-SPEC 3.3][kmip-spec-3.3]                             | ✅        |        |
-    | Cryptographic Algorithm [KMIP-SPEC 3.4][kmip-spec-3.4]                 | ✅        |        |
-    | Cryptographic Length [KMIP-SPEC 3.5][kmip-spec-3.5]                    | ✅        |        |
-    | Cryptographic Parameters [KMIP-SPEC 3.6][kmip-spec-3.6]                | ✅        |        |
-    | Digest [KMIP-SPEC 3.17][kmip-spec-3.17]                                | ✅        |        |
-    | Cryptographic Usage Mask [KMIP-SPEC 3.19][kmip-spec-3.19]              | ✅        |        |
-    | State [KMIP-SPEC 3.22][kmip-spec-3.22]                                 | ✅        |        |
-    | Initial Date [KMIP-SPEC 3.23][kmip-spec-3.23]                          | ✅        |        |
-    | Process Start Date [KMIP-SPEC 3.25][kmip-spec-3.25]                    | ✅        | Vault 1.11 |
-    | Protect Stop Date [KMIP-SPEC 3.26][kmip-spec-3.26]                     | ✅        | Vault 1.11 |
-    | Activation Date [KMIP-SPEC 3.24][kmip-spec-3.24]                       | ✅        |        |
-    | Deactivation Date [KMIP-SPEC 3.27][kmip-spec-3.27]                     | ✅        |        |
-    | Compromise Occurrence Date [KMIP-SPEC 3.29][kmip-spec-3.29]            | ✅        |        |
-    | Compromise Date [KMIP-SPEC 3.30][kmip-spec-3.30]                       | ✅        |        |
-    | Revocation Reason [KMIP-SPEC 3.31][kmip-spec-3.31]                     | ✅        |        |
-    | Object Group [KMIP-SPEC 3.33][kmip-spec-3.33]                          | ✅        |        |
-    | Fresh [KMIP-SPEC 3.34][kmip-spec-3.34]                                 | ✅        |        |
-    | Link [KMIP-SPEC 3.35][kmip-spec-3.35]                                  | ✅        |        |
-    | Last Change Date [KMIP-SPEC 3.38][kmip-spec-3.38]                      | ✅        |        |
-    | Alternative Name [KMIP-SPEC 3.40][kmip-spec-3.40]                      | ✅        | Vault 1.12 |
-    | Key Value Present [KMIP-SPEC 3.41][kmip-spec-3.41]                     | ✅        | Vault 1.12 |
-    | Key Value Location [KMIP-SPEC 3.42][kmip-spec-3.42]                    | 🔴        |        |
-    | Original Creation Date [KMIP-SPEC 3.43][kmip-spec-3.43]                | ✅        |        |
-    | Random Number Generator [KMIP-SPEC 3.44][kmip-spec-3.44]               | ✅        |        |
-    | Description [KMIP-SPEC 3.46][kmip-spec-3.46]                           | ✅        |        |
-    | Comment [KMIP-SPEC 3.47][kmip-spec-3.47]                               | ✅        |        |
-    | Sensitive [KMIP-SPEC 3.48][kmip-spec-3.48]                             | ✅        |        |
-    | Always Sensitive [KMIP-SPEC 3.49][kmip-spec-3.49]                      | ✅        |        |
-    | Extractable [KMIP-SPEC 3.50][kmip-spec-3.50]                           | ✅        |        |
-    | Never Extractable [KMIP-SPEC 3.51][kmip-spec-3.51]                     | ✅        |        |
-
-  3. Supports the following client-to-server operations:
-
-    | Operation                                             | Supported | Notes |
-    | ------------------------------------------------------| :--------:|:-----:|
-    | Locate [KMIP-SPEC 4.9][kmip-spec-4.9]                 | ✅        | Vault version 1.11 supports attributes Activation Date, Application Specific Information, Cryptographic Algorithm, Cryptographic Length, Name, Object Type, Original Creation Date, and State. <br/> Vault version 1.12 supports all profile attributes except for Key Value Location.      |
-    | Check [KMIP-SPEC 4.10][kmip-spec-4.10]                | 🔴        |        |
-    | Get [KMIP-SPEC 4.11][kmip-spec-4.11]                  | ✅        |        |
-    | Get Attributes [KMIP-SPEC 4.12][kmip-spec-4.12]       | ✅        |        |
-    | Get Attribute List [KMIP-SPEC 4.13][kmip-spec-4.13]   | ✅        |        |
-    | Add Attribute [KMIP-SPEC 4.14][kmip-spec-4.14]        | ✅        |        |
-    | Modify Attribute [KMIP-SPEC 4.15][kmip-spec-4.15]     | ✅        | Vault 1.12 |
-    | Delete Attribute [KMIP-SPEC 4.16][kmip-spec-4.16]     | ✅        | Vault 1.12 |
-    | Activate [KMIP-SPEC 4.19][kmip-spec-4.19]             | ✅        |        |
-    | Revoke [KMIP-SPEC 4.20][kmip-spec-4.20]               | ✅        |        |
-    | Destroy [KMIP-SPEC 4.21][kmip-spec-4.21]              | ✅        |        |
-    | Query [KMIP-SPEC 4.25][kmip-spec-4.25]                | ✅        | Vault 1.11 |
-    | Discover Versions [KMIP-SPEC 4.26][kmip-spec-4.26]    | ✅        |        |
-
-  4.Supports the following message contents:
-
-    | Message Content                                                  | Supported |
-    | -----------------------------------------------------------------| :--------:|
-    | Protocol Version [KMIP-SPEC 6.1][kmip-spec-6.1]                  | ✅        |
-    | Operation [KMIP-SPEC 6.2][kmip-spec-6.2]                         | ✅        |
-    | Maximum Response Size [KMIP-SPEC 6.3][kmip-spec-6.3]             | ✅        |
-    | Unique Batch Item ID [KMIP-SPEC 6.4][kmip-spec-6.4]              | ✅        |
-    | Time Stamp [KMIP-SPEC 6.5][kmip-spec-6.5]                        | ✅        |
-    | Asynchronous Indicator [KMIP-SPEC 6.7][kmip-spec-6.7]            | ✅        |
-    | Result Status [KMIP-SPEC 6.9][kmip-spec-6.9]                     | ✅        |
-    | Result Reason [KMIP-SPEC 6.10][kmip-spec-6.10]                   | ✅        |
-    | Batch Order Option [KMIP-SPEC 6.12][kmip-spec-6.12]              | ✅        |
-    | Batch Error Continuation Option [KMIP-SPEC 6.13][kmip-spec-6.13] | ✅        |
-    | Batch Count [KMIP-SPEC 6.14][kmip-spec-6.14]                     | ✅        |
-    | Batch Item [KMIP-SPEC 6.15][kmip-spec-6.15]                      | ✅        |
-    | Attestation Capable Indicator [KMIP-SPEC 6.17][kmip-spec-6.17]   | ✅        |
-    | Client Correlation Value [KMIP-SPEC 6.18][kmip-spec-6.18]        | ✅        |
-    | Server Correlation Value [KMIP-SPEC 6.19][kmip-spec-6.19]        | ✅        |
-    | Message Extension [KMIP-SPEC 6.16][kmip-spec-6.16]               | ✅        |
-
-  5. Supports the ID Placeholder [KMIP-SPEC 4][kmip-spec-4]
-  6. Supports Message Format [KMIP-SPEC 7][kmip-spec-7]
-  7. Supports Authentication [KMIP-SPEC 8][kmip-spec-8]
-  8. Supports the TTLV encoding [KMIP-SPEC 9.1][kmip-spec-9.1]
-  9. Supports the transport requirements [KMIP-SPEC 10][kmip-spec-10]
-  10. Supports Error Handling [KMIP-SPEC 11][kmip-spec-11] for any supported object, attribute, or operation
-  11. Optionally supports any clause within [KMIP-SPEC][kmip-spec] that is not listed above
-  12. Optionally supports extensions outside the scope of this standard (e.g., vendor extensions, conformance clauses) that do not contradict any KMIP requirements - We do not have any extensions
-
-## [Symmetric key lifecycle server][lifecycle-server]
-
-  1. SHALL conform to the [Baseline Server][baseline-server]
-  2. Supports the following objects:
-
-    | Object                                                                 | Supported |
-    | -----------------------------------------------------------------------| :----- --:|
-    | Symmetric Key [KMIP-SPEC 2.2.2][kmip-spec-2.2.2]                       | ✅        |
-    | Key Format Type [KMIP-SPEC 9.1.3.2.3][kmip-spec-9.1.3.2.3]             | ✅        |
-
-  3. Supports the following subsets of attributes:
-
-    | Attribute                                                              | Supported | Notes |
-    | -----------------------------------------------------------------------| :-------: | :---: |
-    | Cryptographic Algorithm [KMIP-SPEC 3.4][kmip-spec-3.4]                 | ✅        |       |
-    | Object Type [KMIP-SPEC 3.3][kmip-spec-3.3]                             | ✅        |       |
-    | Process Start Date [KMIP-SPEC 3.25][kmip-spec-3.25]                    | ✅        | Vault 1.11 |
-    | Protect Stop Date [KMIP-SPEC 3.26][kmip-spec-3.26]                     | ✅        | Vault 1.11 |
-
-  4. Supports the following client-to-server operations:
-
-    | Operation                                             | Supported |
-    | ------------------------------------------------------| :--------:|
-    | Create [KMIP-SPEC 4.1][kmip-spec-4.1]                 | ✅        |
-
-  5. Supports the following message encoding:
-
-    | Message Encoding                                                                     | Supported | Notes |
-    | -------------------------------------------------------------------------------------| :--------:|:-----:|
-    | Cryptographic Algorithm [KMIP-SPEC 9.1.3.2.13][kmip-spec-9.1.3.2.13] with values:    |           |       |
-    | i. 3DES                                                                              | ✅        | Vault 1.12 |
-    | ii. AES                                                                              | ✅        |        |
-    | Object Type [KMIP-SPEC 9.1.3.2.12][kmip-spec-9.1.3.2.12] with value:                 |           |        |
-    | i. Symmetric Key                                                                     | ✅        |        |
-    | Key Format Type [KMIP-SPEC 9.1.3.2.3][kmip-spec-9.1.3.2.3] with value:               |           |        |
-    | i. Raw                                                                               | ✅        |        |
-    | ii. Transparent Symmetric Key                                                        | 🔴        |        |
-
-  6. MAY support any clause within [KMIP-SPEC][kmip-spec] provided it does not conflict with any other clause within the section [Symmetric Key Lifecycle Server][lifecycle-server]
-  7. MAY support extensions outside the scope of this standard (e.g., vendor extensions, conformance clauses) that do not contradict any KMIP requirements.
-
-## [Basic cryptographic server][basic-cryptographic-server]
-
-  1. SHALL conform to the [Baseline Server][baseline-server]
-  2. Supports the following client-to-server operations:
-
-    | Operation                                             | Supported | Notes   |
-    | ------------------------------------------------------| :--------:| --------|
-    | Encrypt [KMIP-SPEC 4.29][kmip-spec-4.29]              | ✅        | Vault 1.11 <br/> Supported for AES, unsupported for 3DES: <br/><br/> Supported Block Cipher Modes: <br/> <ol> <li> GCM </li> <li> CBC </li> <li> CFB </li> <li> CTR </li> <li> ECB </li> <li> OFB </li> </ol> <br/> Stream operations are supported except for GCM block cipher mode. <br/><br/> Supported padding methods: <br/> <ol> <li> None </li> <li> PKCS5 </li> </ol>  |
-    | Decypt [KMIP-SPEC 4.30][kmip-spec-4.30]               | ✅        | Vault 1.11 <br/> Supported for AES, unsupported for 3DES: <br/><br/> Supported Block Cipher Modes: <br/> <ol> <li> GCM </li> <li> CBC </li> <li> CFB </li> <li> CTR </li> <li> ECB </li> <li> OFB </li> </ol> <br/> Stream operations are supported except for GCM block cipher mode. <br/><br/> Supported padding methods: <br/> <ol> <li> None </li> <li> PKCS5 </li> </ol>  |  |
-
-  3. MAY support any clause within [KMIP-SPEC][kmip-spec] provided it does not conflict with any other clause within the section [Basic Cryptographic Server][basic-cryptographic-server]
-  4. MAY support extensions outside the scope of this standard (e.g., vendor extensions, conformance clauses) that do not contradict any KMIP requirements.
-
-## [Asymmetric key lifecycle server][asymmetric-key-lifecycle-server]
-
-  1. SHALL conform to the [Baseline Server][baseline-server]
-
-  2. Supports the following objects:
-
-    | Object                                                                 | Supported |
-    | -----------------------------------------------------------------------| :----- --:|
-    | Symmetric Key [KMIP-SPEC 2.2.2][kmip-spec-2.2.2]                       | ✅        |
-    | Key Format Type [KMIP-SPEC 9.1.3.2.3][kmip-spec-9.1.3.2.3]             | ✅        |
-
-  3. Supports the following objects:
-
-    | Object                                                              | Supported | Notes |
-    | --------------------------------------------------------------------| :-------: | :---: |
-    | Public Key [KMIP-SPEC 2.2.3][kmip-spec-2.2.3]                       | ✅        |  Vault 1.13 |
-    | Private Key [KMIP-SPEC 2.2.4][kmip-spec-2.2.4]                      | ✅        |  Vault 1.13 |
-    | Process Start Date [KMIP-SPEC 3.25][kmip-spec-3.25]                 | ✅        |  Vault 1.11 |
-    | Key Format Type [KMIP-SPEC 9.1.3.2.3][kmip-spec-9.1.3.2.3]          | ✅        |        |
-
-  4. Supports the following attributes:
-
-    | Attribute                                                              | Supported | Notes |
-    | -----------------------------------------------------------------------| :-------: | :---: |
-    | Cryptographic Algorithm [KMIP-SPEC 3.4][kmip-spec-3.4]                 | ✅        |       |
-    | Object Type [KMIP-SPEC 3.3][kmip-spec-3.3]                             | ✅        |       |
-    | Process Start Date [KMIP-SPEC 3.25][kmip-spec-3.25]                    | ✅        | Vault 1.11 |
-    | Protect Stop Date [KMIP-SPEC 3.26][kmip-spec-3.26]                     | ✅        | Vault 1.11 |
-
-  5. Supports the following message encoding:
-
-    | Message Encoding                                                                     | Supported | Notes |
-    | -------------------------------------------------------------------------------------| :--------:|:-----:|
-    | Cryptographic Algorithm [KMIP-SPEC 9.1.3.2.13][kmip-spec-9.1.3.2.13] with values:    |           |       |
-    | i. RSA                                                                               | ✅        | Vault 1.13 |
-    | Object Type [KMIP-SPEC 9.1.3.2.12][kmip-spec-9.1.3.2.12] with value:                 |           |        |
-    | i. Public	 Key                                                                       | ✅        | Vault 1.13 |
-    | ii. Private	 Key                                                                     | ✅        | Vault 1.13 |
-    | Key Format Type [KMIP-SPEC 9.1.3.2.3][kmip-spec-9.1.3.2.3] with value:               |           |        |
-    | i. PKCS#1                                                                            | ✅        | Vault 1.13 <br/> Supported for Private and Public Keys|
-    | ii. PKCS#8                                                                           | ✅        | Vault 1.13 <br/> Supported for Private Key|
-    | iii. Transparent RSA Public Key                                                      | ✅        | Vault 1.13 |
-    | iv. Transparent RSA Private Key                                                      | ✅        | Vault 1.13 |
-    | v. X.509                                                                             | ✅        | Vault 1.13 <br/> Supported for Public Key|
-
-  6. MAY support any clause within [KMIP-SPEC][kmip-spec] provided it does not conflict with any other clause within the section [Symmetric Key Lifecycle Server][lifecycle-server]
-  7. MAY support extensions outside the scope of this standard (e.g., vendor extensions, conformance clauses) that do not contradict any KMIP requirements.
-
-## [Advanced cryptographic server][advanced-cryptographic-server]
-  1. SHALL conform to the [Baseline Server][baseline-server]
-  2. Supports the following client-to-server operations:
-
-    | Operation                                             | Supported | Notes   |
-    | ------------------------------------------------------| :--------:| --------|
-    | Encrypt [KMIP-SPEC 4.29][kmip-spec-4.29]              | ✅        | Vault 1.11 <br/> [See Basic Cryptographic Server](#basic-cryptographic-server) <br/><br/> Vault 1.13 <br/> Supported for RSA Asymmetric Keys: <br/><br/> Supported padding methods: <br/> <ol> <li> OAEP </li> <li> PKCS1v15 </li> </ol> <br/> Streaming operations are not supported. |
-    | Decypt [KMIP-SPEC 4.30][kmip-spec-4.30]               | ✅        | Vault 1.11 <br/> [See Basic Cryptographic Server](#basic-cryptographic-server) <br/><br/> Vault 1.13 <br/> Supported for RSA Asymmetric Keys: <br/><br/> Supported padding methods: <br/> <ol> <li> OAEP </li> <li> PKCS1v15 </li> </ol> <br/> Streaming operations are not supported. |
-    | Sign [KMIP-SPEC 4.31][kmip-spec-4.31]                 | ✅        | Vault 1.13 <br/> Supported for RSA Asymmetric Keys: <br/><br/> Supported padding methods: <br/> <ol> <li> PSS </li> <li> PKCS1v15 </li> </ol> <br/><br/> The supported hashing algorithms with PSS are: <br/> <ol> <li> SHA224 </li> <li> SHA256 </li> <li> SHA384 </li> <li> SHA512 </li> <li> RIPEMD160 </li> <li> SHA512_224 </li> <li> SHA512_256 </li> <li> SHA3_224 </li> <li> SHA3_256 </li> <li> SHA3_384 </li> <li> SHA3_512 </li> </ol> <br/> The supported hashing algorithms with PKCS1v15 are: <br/> <ol> <li> SHA224 </li> <li> SHA256 </li> <li> SHA384 </li> <li> SHA512 </li> <li> RIPEMD160 </li> </ol> <br/> Streaming operations are supported.|
-    | Signature Verify [KMIP-SPEC 4.32][kmip-spec-4.32]     | ✅        | Vault 1.13 <br/> Supported for RSA Asymmetric Keys: <br/><br/> Supported padding methods: <br/> <ol> <li> PSS </li> <li> PKCS1v15 </li> </ol> <br/><br/> The supported hashing algorithms with PSS are: <br/> <ol> <li> SHA224 </li> <li> SHA256 </li> <li> SHA384 </li> <li> SHA512 </li> <li> RIPEMD160 </li> <li> SHA512_224 </li> <li> SHA512_256 </li> <li> SHA3_224 </li> <li> SHA3_256 </li> <li> SHA3_384 </li> <li> SHA3_512 </li> </ol> <br/> The supported hashing algorithms with PKCS1v15 are: <br/> <ol> <li> SHA224 </li> <li> SHA256 </li> <li> SHA384 </li> <li> SHA512 </li> <li> RIPEMD160 </li> </ol> <br/> Streaming operations are supported.|
-    | MAC [KMIP-SPEC 4.33][kmip-spec-4.33]                  | ✅        | Vault 1.13 <br/> Supported for RSA Asymmetric Keys: <br/><br/> The supported hashing algorithms are: <br/> <ol> <li> SHA224 </li> <li> SHA256 </li> <li> SHA384 </li> <li> SHA512 </li> <li> RIPEMD160 </li> <li> SHA512_224 </li> <li> SHA512_256 </li> <li> SHA3_256 </li> <li> SHA3_384 </li> <li> SHA3_512 </li> </ol> <br/> The follwing hashing algorithms are not supported: <br/> <ol> <li> MD4 </li> <li> MD5 </li> <li> SHA1 </li> </ol> <br/> Streaming operations are supported.|
-    | MAC Verify [KMIP-SPEC 4.34][kmip-spec-4.34]           | ✅        | Vault 1.13 <br/> Supported for RSA Asymmetric Keys: <br/><br/> The supported hashing algorithms are: <br/> <ol> <li> SHA224 </li> <li> SHA256 </li> <li> SHA384 </li> <li> SHA512 </li> <li> RIPEMD160 </li> <li> SHA512_224 </li> <li> SHA512_256 </li> <li> SHA3_256 </li> <li> SHA3_384 </li> <li> SHA3_512 </li> </ol> <br/> The follwing hashing algorithms are not supported: <br/> <ol> <li> MD4 </li> <li> MD5 </li> <li> SHA1 </li> </ol> <br/> Streaming operations are supported.|
-    | RNG Retrieve [KMIP-SPEC 4.35][kmip-spec-4.35]         | ✅        | Vault 1.13 |
-    | RNG Seed [KMIP-SPEC 4.36][kmip-spec-4.36]             | ✅        | Vault 1.13 |
-  3. MAY support any clause within [KMIP-SPEC][kmip-spec] provided it does not conflict with any other clause within the section [Basic Cryptographic Server][basic-cryptographic-server]
-  4. MAY support extensions outside the scope of this standard (e.g., vendor extensions, conformance clauses) that do not contradict any KMIP requirements.
-
-
-[kmip-spec-2.1.1]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660735
-  [kmip-spec-2.1.2]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660736
-  [kmip-spec-2.1.3]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660737
-  [kmip-spec-2.1.4]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660738
-  [kmip-spec-2.1.8]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660757
-  [kmip-spec-2.1.9]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660758
-  [kmip-spec-2.1.19]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660768
-  [kmip-spec-2.1.20]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660769
-  [kmip-spec-2.1.21]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660770
-  [kmip-spec-2.2.3]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660776
-  [kmip-spec-2.2.4]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660777
-  [kmip-spec-3.1]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660784
-  [kmip-spec-3.2]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660785
-  [kmip-spec-3.3]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660786
-  [kmip-spec-3.4]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660787
-  [kmip-spec-3.5]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660788
-  [kmip-spec-3.6]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660789
-  [kmip-spec-3.17]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660800
-  [kmip-spec-3.19]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660807
-  [kmip-spec-3.22]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660810
-  [kmip-spec-3.23]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660811
-  [kmip-spec-3.25]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660813
-  [kmip-spec-3.26]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660814
-  [kmip-spec-3.24]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660812
-  [kmip-spec-3.27]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660815
-  [kmip-spec-3.29]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660817
-  [kmip-spec-3.30]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660818
-  [kmip-spec-3.31]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660819
-  [kmip-spec-3.33]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660821
-  [kmip-spec-3.34]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660822
-  [kmip-spec-3.35]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660823
-  [kmip-spec-3.38]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660826
-  [kmip-spec-3.40]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660828
-  [kmip-spec-3.41]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660829
-  [kmip-spec-3.42]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660830
-  [kmip-spec-3.43]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660831
-  [kmip-spec-3.44]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660832
-  [kmip-spec-3.46]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660834
-  [kmip-spec-3.47]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660835
-  [kmip-spec-3.48]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660836
-  [kmip-spec-3.49]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660837
-  [kmip-spec-3.50]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660838
-  [kmip-spec-3.51]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660839
-  [kmip-spec-4.9]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660849
-  [kmip-spec-4.10]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660850
-  [kmip-spec-4.11]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660851
-  [kmip-spec-4.12]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660852
-  [kmip-spec-4.13]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660853
-  [kmip-spec-4.14]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660854
-  [kmip-spec-4.15]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660855
-  [kmip-spec-4.16]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660856
-  [kmip-spec-4.19]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660859
-  [kmip-spec-4.20]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660860
-  [kmip-spec-4.21]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660861
-  [kmip-spec-4.25]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660865
-  [kmip-spec-4.26]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660866
-  [kmip-spec-4.29]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660869
-  [kmip-spec-4.30]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660870
-  [kmip-spec-4.31]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660871
-  [kmip-spec-4.32]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660872
-  [kmip-spec-4.33]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660873
-  [kmip-spec-4.34]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660874
-  [kmip-spec-4.35]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660875
-  [kmip-spec-4.36]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660876
-  [kmip-spec-6.1]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660887
-  [kmip-spec-6.2]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660888
-  [kmip-spec-6.3]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660889
-  [kmip-spec-6.4]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660890
-  [kmip-spec-6.5]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660891
-  [kmip-spec-6.7]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660893
-  [kmip-spec-6.9]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660895
-  [kmip-spec-6.10]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660896
-  [kmip-spec-6.12]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660898
-  [kmip-spec-6.13]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660899
-  [kmip-spec-6.14]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660900
-  [kmip-spec-6.15]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660901
-  [kmip-spec-6.17]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660903
-  [kmip-spec-6.18]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660904
-  [kmip-spec-6.19]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660905
-  [kmip-spec-6.16]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660902
-  [kmip-spec-4]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660840
-  [kmip-spec-7]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660906
-  [kmip-spec-8]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660909
-  [kmip-spec-9.1]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660911
-  [kmip-spec-10]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660973
-  [kmip-spec-11]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660974
-  [kmip-spec]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html
-  [kmip-spec-2.2.2]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660775
-  [kmip-spec-9.1.3.2.3]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660923
-  [kmip-spec-4.1]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660841
-  [kmip-spec-9.1.3.2.13]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660933
-  [kmip-spec-9.1.3.2.12]: https://docs.oasis-open.org/kmip/spec/v1.4/errata01/os/kmip-spec-v1.4-errata01-os-redlined.html#_Toc490660932
-  [baseline-server]: http://docs.oasis-open.org/kmip/profiles/v1.4/os/kmip-profiles-v1.4-os.html#_Toc491431430
-  [lifecycle-server]: http://docs.oasis-open.org/kmip/profiles/v1.4/os/kmip-profiles-v1.4-os.html#_Toc491431487
-  [basic-cryptographic-server]: http://docs.oasis-open.org/kmip/profiles/v1.4/os/kmip-profiles-v1.4-os.html#_Toc491431527
-  [asymmetric-key-lifecycle-server]: http://docs.oasis-open.org/kmip/profiles/v1.4/os/kmip-profiles-v1.4-os.html#_Toc491431516
-  [advanced-cryptographic-server]: http://docs.oasis-open.org/kmip/profiles/v1.4/os/kmip-profiles-v1.4-os.html#_Toc491431528
-  [tc-proc-2.18]: https://www.oasis-open.org/policies-guidelines/tc-process-2017-05-26/technical-committee-tc-process-27-july-2011/#specQuality
-
diff --git a/website/content/docs/secrets/kmip.mdx b/website/content/docs/secrets/kmip.mdx
deleted file mode 100644
index d1ce62b3870..00000000000
--- a/website/content/docs/secrets/kmip.mdx
+++ /dev/null
@@ -1,288 +0,0 @@
----
-layout: docs
-page_title: KMIP - Secrets Engines
-description: |-
-  The KMIP secrets engine allows Vault to act as a KMIP server provider and
-  handle the lifecycle of its KMIP managed objects.
----
-
-# KMIP secrets engine
-
--> **Note**: This secret engine requires [Vault Enterprise](https://www.hashicorp.com/products/vault/)
-with the Advanced Data Protection Module.
-
-The KMIP secrets engine allows Vault to act as a [Key Management
-Interoperability Protocol][kmip-spec] (KMIP) server provider and handle
-the lifecycle of its KMIP managed objects. KMIP is a standardized protocol that allows
-services and applications to perform cryptographic operations without having to
-manage cryptographic material, otherwise known as managed objects, by delegating
-its storage and lifecycle to a key management server.
-
-Vault's KMIP secrets engine listens on a separate port from the standard Vault listener. Each Vault server in a Vault cluster configured with a KMIP secrets engine uses the same listener configuration. The KMIP listener defaults to port 5696 and is configurable to alternative ports, for example, if there are multiple KMIP secrets engine mounts configured.  KMIP clients connect and authenticate to this KMIP secrets engine listener port using generated TLS certificates. KMIP clients may connect directly to any of the Vault servers on the configured KMIP port. A layer 4 tcp load balancer may be used in front of the Vault server's KMIP ports. The load balancer should support long-lived connections and it may use a round robin routing algorithm as Vault servers will forward to the primary Vault server, if necessary.
-
-## KMIP conformance
-
-Vault implements version 1.4 of the following Key Management Interoperability Protocol Profiles:
-
-  * [Baseline Server][baseline-server]
-    * Supports all profile attributes except for *Key Value Location*.
-    * Supports all profile operations except for *Check*.
-    * Operation *Locate* supports all profile attributes except for *Key Value Location*.
-
-  * [Symmetric Key Lifecycle Server][lifecycle-server]
-    * Supports cryptographic algorithm *AES* (*3DES* is not supported).
-    * Only the *Raw* key format type is supported. (*Transparent Symmetric Key* is not supported).
-
-  * [Basic Cryptographic Server][basic-cryptographic-server]
-    * Supports block cipher modes *CBC*, *CFB*, *CTR*, *ECB*, *GCM*, and *OFB*.
-    * On multi-part (streaming) operations, block cipher mode *GCM* is not supported.
-    * The supported padding methods are *None* and *PKCS5*.
-
-  * [Asymmetric Key Lifecycle Server][asymmetric-key-lifecycle-server]
-    * Supports *Public Key* and *Private Key* objects.
-    * Supports *RSA* cryptographic algorithm
-    * Supports *PKCS#1*, *PKCS#8*, *X.509*, *Transparent RSA Public Key* and *Transparent RSA Private Key* key format types.
-
-  * [Advanced Cryptographic Server][advanced-cryptographic-server]
-    * Supports *Encrypt*, *Decrypt*, *Sign*, *Signature Verify*, *MAC*, *MAC Verify*, *RNG Retrieve*, and *RNG Seed* client-to-server operations.
-    * The supported hashing algorithms for Sign and Signature Verify operations are *SHA224*, *SHA256*, *SHA384*, *SHA512*, *RIPEMD160*, *SHA512_224*, *SHA512_256*, *SHA3_224*, *SHA3_256*, *SHA3_384*, and *SHA3_512* for *PSS* padding method, and algorithms *SHA224*, *SHA256*, *SHA384*, *SHA512*, and *RIPEMD160* for *PKCS1v15* padding method.
-    * The supported hashing algorithms for MAC and MAC Verify operations are *SHA224*, *SHA256*, *SHA384*, *SHA512*, *RIPEMD160*, *SHA512_224*, *SHA512_256*, *SHA3_224*, *SHA3_256*, *SHA3_384*, and *SHA3_512* (*MD4*, *MD5*, and *SHA1* are not supoorted).
-
-Refer to [KMIP - Profiles Support](/vault/docs/secrets/kmip-profiles) page for more details.
-
-[baseline-server]: http://docs.oasis-open.org/kmip/profiles/v1.4/os/kmip-profiles-v1.4-os.html#_Toc491431430
-[lifecycle-server]: http://docs.oasis-open.org/kmip/profiles/v1.4/os/kmip-profiles-v1.4-os.html#_Toc491431487
-[basic-cryptographic-server]: http://docs.oasis-open.org/kmip/profiles/v1.4/os/kmip-profiles-v1.4-os.html#_Toc491431527
-[asymmetric-key-lifecycle-server]: http://docs.oasis-open.org/kmip/profiles/v1.4/os/kmip-profiles-v1.4-os.html#_Toc491431516
-[advanced-cryptographic-server]: http://docs.oasis-open.org/kmip/profiles/v1.4/os/kmip-profiles-v1.4-os.html#_Toc491431528
-
-## Setup
-
-The KMIP secrets engine must be configured before it can start accepting KMIP
-requests.
-
-1.  Enable the KMIP secrets engine
-
-    ```text
-    $ vault secrets enable kmip
-    Success! Enabled the kmip secrets engine at: kmip/
-    ```
-
-1.  Configure the secrets engine with the desired listener addresses to use and
-    TLS parameters, or leave unwritten to use default values
-
-    ```text
-    $ vault write kmip/config listen_addrs=0.0.0.0:5696
-    ```
-
-## Usage
-
-### Scopes and roles
-
-The KMIP secrets engine uses the concept of scopes to partition KMIP managed
-object storage into multiple named buckets. Within a scope, roles can be created
-which dictate the set of allowed operations that the particular role can perform.
-TLS client certificates can be generated for a role, which services and applications
-can then use when sending KMIP requests against Vault's KMIP secret engine.
-
-In order to generate client certificates for KMIP clients to interact with Vault's
-KMIP server, we must first create a scope and role and specify the desired set of
-allowed operations for it.
-
-1.  Create a scope:
-
-    ```text
-    $ vault write -f kmip/scope/my-service
-    Success! Data written to: kmip/scope/my-service
-    ```
-
-1.  Create a role within the scope, specifying the set of operations to allow or
-    deny.
-
-    ```text
-    $ vault write kmip/scope/my-service/role/admin operation_all=true
-      Success! Data written to: kmip/scope/my-service/role/admin
-    ```
-
-### Supported KMIP operations
-
-The KMIP secrets engine currently supports the following set of operations:
-
-```text
-operation_activate
-operation_add_attribute
-operation_create
-operation_create_keypair
-operation_decrypt
-operation_delete_attribute
-operation_destroy
-operation_discover_versions
-operation_encrypt
-operation_get
-operation_get_attribute_list
-operation_get_attributes
-operation_import
-operation_locate
-operation_mac
-operation_mac_verify
-operation_modify_attribute
-operation_query
-operation_register
-operation_rekey
-operation_rekey_keypair
-operation_revoke
-operation_sign
-operation_signature_verify
-operation_rng_seed
-operation_rng_retrieve
-```
-
-Additionally, there are two pseudo-operations that can be used to allow or deny
-all operation capabilities to a role. These operations are mutually exclusive to
-all other operations. That is, if it's provided during role creation or update,
-no other operations can be provided. Similarly, if an existing role contains a
-pseudo-operation, and it is then updated with a set supported operation, it will
-be overwritten with the newly set of provided operations.
-
-Pseudo-operations:
-
-```text
-operation_all
-operation_none
-```
-
-### Client certificate generation
-
-Once a scope and role has been created, client certificates can be generated for
-that role. The client certificate can then be provided to applications and
-services that support KMIP to establish communication with Vault's KMIP server.
-Scope and role identifiers are embedded in the certificate,
-which will be used when evaluating permissions during a KMIP request.
-
-1.  Generate a client certificate. This returns the CA Chain, the certificate,
-    and the private key.
-
-    ```text
-    $ vault write -f kmip/scope/my-service/role/admin/credential/generate
-      Key              Value
-      ---              -----
-      ca_chain         [-----BEGIN CERTIFICATE-----
-      MIICNTCCAZigAwIBAgIUKqNFb3Zy+8ypIhTDs/2/8f/xEI8wCgYIKoZIzj0EAwIw
-      HTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE4MjQyN1oX
-      DTI5MDYyMTE4MjQ1N1owKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWlu
-      dGVybWVkaWF0ZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAbniGNXHOiPvSb0I
-      fbc1B9QkOmdT2Ecx2WaQPLISplmO0Jm0u0z11CGuf3Igby7unnCNvCuCXrKJFCsQ
-      8JGhwknNAG3eesSZxG4tklA6FMZjE9ETUtYfjH7Z4vuJSw/fxOeey7fhrqAzhV3P
-      GRkvA9EQUHJOeV4rEpiINP/fneHNfsn1o2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYD
-      VR0TAQH/BAgwBgEB/wIBCTAdBgNVHQ4EFgQUR0o0v4rPiBU9RwQfEUucx3JwbPAw
-      HwYDVR0jBBgwFoAUMhORultSN+ABogxQdkt7KChD0wQwCgYIKoZIzj0EAwIDgYoA
-      MIGGAkF1IvkIaXNkVfe+q0V78CnX0XIJuvmPpgjN8AQzqLci8txikd9gF1zt8fFQ
-      gIKERm2QPrshSV9srHDB0YnThRKuiQJBNcDjCfYOzqKlBHifT4WT4OX1U6nP/Y2b
-      imGaLJK9VIwfcJOpVCFGp7Xi8QGV6rJIFiQAqzqCy69vcU6nVMsvens=
-      -----END CERTIFICATE----- -----BEGIN CERTIFICATE-----
-      MIICKjCCAYugAwIBAgIUerDfApmkq0VYychkhlxEnBlIDUcwCgYIKoZIzj0EAwIw
-      HTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE4MjQyNloX
-      DTI5MDYyMTE4MjQ1NlowHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MIGb
-      MBAGByqGSM49AgEGBSuBBAAjA4GGAAQBA466Axrrz+HWanNe35gPVvB7OE7TWZcc
-      QZw1QSMQ+QIQMu5NcdfvZfh68exhe1FiJezKB+zeoJWp1Q/kqhyh7fsAFUuIcJDO
-      okZYPTmjPh3h5IZLPg5r7Pw1j99rLHhc/EXF9wYVy2UeH/2IqGJ+cncmVgqczlG8
-      m36g9OXd6hkofhCjZjBkMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/
-      AgEKMB0GA1UdDgQWBBQyE5G6W1I34AGiDFB2S3soKEPTBDAfBgNVHSMEGDAWgBQy
-      E5G6W1I34AGiDFB2S3soKEPTBDAKBggqhkjOPQQDAgOBjAAwgYgCQgGtPVCtgDc1
-      0SrTsVpEtUMYQKbOWnTKNHZ9h5jSna8n9aY+70Ai3U57q3FL95iIhZRW79PRpp65
-      d6tWqY51o2hHpwJCAK+eE7xpdnqh5H8TqAXKVuSoC0WEsovYCD03c8Ih3jWcZn6N
-      kbz2kXPcAk+dE6ncnwhwqNQgsJQGgQzJroH+Zzvb
-      -----END CERTIFICATE-----]
-      certificate      -----BEGIN CERTIFICATE-----
-      MIICOzCCAZygAwIBAgIUN5V7bLAGu8QIUFxlIugg8fBb+eYwCgYIKoZIzj0EAwIw
-      KjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTAeFw0x
-      OTA2MjQxODQ3MTdaFw0xOTA2MjUxODQ3NDdaMCAxDjAMBgNVBAsTBWNqVVNJMQ4w
-      DAYDVQQDEwVkdjRZbTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEANVsHV8CHYpW
-      CBKbYVEx/sLphk67SdWxbII4Sc9Rj1KymApD4gPmS+rw0FDMZGFbn1sAfpqMBqMj
-      ylv72o9izbYSALHnYT+AaE0NFn4eGWZ2G0p56cVmfXm3ZI959E+3gvZK6X5Jnzm4
-      FKXTDKGA4pocYec/rnYJ5X8sbAJKHvk1OeO+o2cwZTAOBgNVHQ8BAf8EBAMCA6gw
-      EwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFBEIsBo3HiBIg2l2psaQoYkT
-      D1RNMB8GA1UdIwQYMBaAFEdKNL+Kz4gVPUcEHxFLnMdycGzwMAoGCCqGSM49BAMC
-      A4GMADCBiAJCAc8DV23DJsHV4fdmbmssu0eDIgNH+PrRKdYgqiHptbuVjF2qbILp
-      Z34dJRVN+R9B+RprZXkYiv7gJ/47KSUKzRZpAkIByMjZqLtcypamJM/t+/O1BSst
-      CWcblb45FIxAmO4hE00Q5wnwXNxNnDHXWiuGdSNmIBjpb9nM5wehQlbkx7HzvPk=
-      -----END CERTIFICATE-----
-      private_key      -----BEGIN EC PRIVATE KEY-----
-      MIHcAgEBBEIB9Nn7M28VUVW6g5IlOTS3bHIZYM/zqVy+PvYQxn2lFbg1YrQzfd7h
-      sdtCjet0lc7pvtoOwd1dFiATOGg98OVN7MegBwYFK4EEACOhgYkDgYYABADVbB1f
-      Ah2KVggSm2FRMf7C6YZOu0nVsWyCOEnPUY9SspgKQ+ID5kvq8NBQzGRhW59bAH6a
-      jAajI8pb+9qPYs22EgCx52E/gGhNDRZ+HhlmdhtKeenFZn15t2SPefRPt4L2Sul+
-      SZ85uBSl0wyhgOKaHGHnP652CeV/LGwCSh75NTnjvg==
-      -----END EC PRIVATE KEY-----
-      serial_number    317328055225536560033788492808123425026102524390
-    ```
-
-### Client certificate signing
-
-As an alternative to the above section on generating client certificates,
-the KMIP secrets engine supports signing of Certificate Signing Requests
-(CSRs). Normally the above generation process is simpler, but some KMIP
-clients prefer (or only support) retaining the private key associated
-with their client certificate.
-
-1. In this workflow the first step is KMIP-client dependent: use the KMIP
-   client's UI or CLI to create a client certificate CSR in PEM format.
-
-2. Sign the client certificate. This returns the CA Chain and the certificate,
-   but not the private key, which never leaves the KMIP client.
-
-   ```text
-   $ vault write kmip/scope/my-service/role/admin/credential/sign csr="$(cat my-csr.pem)"
-     Key              Value
-     ---              -----
-     ca_chain         [-----BEGIN CERTIFICATE-----
-     MIICNTCCAZigAwIBAgIUKqNFb3Zy+8ypIhTDs/2/8f/xEI8wCgYIKoZIzj0EAwIw
-     HTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE4MjQyN1oX
-     DTI5MDYyMTE4MjQ1N1owKjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWlu
-     dGVybWVkaWF0ZTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEAbniGNXHOiPvSb0I
-     fbc1B9QkOmdT2Ecx2WaQPLISplmO0Jm0u0z11CGuf3Igby7unnCNvCuCXrKJFCsQ
-     8JGhwknNAG3eesSZxG4tklA6FMZjE9ETUtYfjH7Z4vuJSw/fxOeey7fhrqAzhV3P
-     GRkvA9EQUHJOeV4rEpiINP/fneHNfsn1o2YwZDAOBgNVHQ8BAf8EBAMCAQYwEgYD
-     VR0TAQH/BAgwBgEB/wIBCTAdBgNVHQ4EFgQUR0o0v4rPiBU9RwQfEUucx3JwbPAw
-     HwYDVR0jBBgwFoAUMhORultSN+ABogxQdkt7KChD0wQwCgYIKoZIzj0EAwIDgYoA
-     MIGGAkF1IvkIaXNkVfe+q0V78CnX0XIJuvmPpgjN8AQzqLci8txikd9gF1zt8fFQ
-     gIKERm2QPrshSV9srHDB0YnThRKuiQJBNcDjCfYOzqKlBHifT4WT4OX1U6nP/Y2b
-     imGaLJK9VIwfcJOpVCFGp7Xi8QGV6rJIFiQAqzqCy69vcU6nVMsvens=
-     -----END CERTIFICATE----- -----BEGIN CERTIFICATE-----
-     MIICKjCCAYugAwIBAgIUerDfApmkq0VYychkhlxEnBlIDUcwCgYIKoZIzj0EAwIw
-     HTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MB4XDTE5MDYyNDE4MjQyNloX
-     DTI5MDYyMTE4MjQ1NlowHTEbMBkGA1UEAxMSdmF1bHQta21pcC1kZWZhdWx0MIGb
-     MBAGByqGSM49AgEGBSuBBAAjA4GGAAQBA466Axrrz+HWanNe35gPVvB7OE7TWZcc
-     QZw1QSMQ+QIQMu5NcdfvZfh68exhe1FiJezKB+zeoJWp1Q/kqhyh7fsAFUuIcJDO
-     okZYPTmjPh3h5IZLPg5r7Pw1j99rLHhc/EXF9wYVy2UeH/2IqGJ+cncmVgqczlG8
-     m36g9OXd6hkofhCjZjBkMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/
-     AgEKMB0GA1UdDgQWBBQyE5G6W1I34AGiDFB2S3soKEPTBDAfBgNVHSMEGDAWgBQy
-     E5G6W1I34AGiDFB2S3soKEPTBDAKBggqhkjOPQQDAgOBjAAwgYgCQgGtPVCtgDc1
-     0SrTsVpEtUMYQKbOWnTKNHZ9h5jSna8n9aY+70Ai3U57q3FL95iIhZRW79PRpp65
-     d6tWqY51o2hHpwJCAK+eE7xpdnqh5H8TqAXKVuSoC0WEsovYCD03c8Ih3jWcZn6N
-     kbz2kXPcAk+dE6ncnwhwqNQgsJQGgQzJroH+Zzvb
-     -----END CERTIFICATE-----]
-     certificate      -----BEGIN CERTIFICATE-----
-     MIICOzCCAZygAwIBAgIUN5V7bLAGu8QIUFxlIugg8fBb+eYwCgYIKoZIzj0EAwIw
-     KjEoMCYGA1UEAxMfdmF1bHQta21pcC1kZWZhdWx0LWludGVybWVkaWF0ZTAeFw0x
-     OTA2MjQxODQ3MTdaFw0xOTA2MjUxODQ3NDdaMCAxDjAMBgNVBAsTBWNqVVNJMQ4w
-     DAYDVQQDEwVkdjRZbTCBmzAQBgcqhkjOPQIBBgUrgQQAIwOBhgAEANVsHV8CHYpW
-     CBKbYVEx/sLphk67SdWxbII4Sc9Rj1KymApD4gPmS+rw0FDMZGFbn1sAfpqMBqMj
-     ylv72o9izbYSALHnYT+AaE0NFn4eGWZ2G0p56cVmfXm3ZI959E+3gvZK6X5Jnzm4
-     FKXTDKGA4pocYec/rnYJ5X8sbAJKHvk1OeO+o2cwZTAOBgNVHQ8BAf8EBAMCA6gw
-     EwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0OBBYEFBEIsBo3HiBIg2l2psaQoYkT
-     D1RNMB8GA1UdIwQYMBaAFEdKNL+Kz4gVPUcEHxFLnMdycGzwMAoGCCqGSM49BAMC
-     A4GMADCBiAJCAc8DV23DJsHV4fdmbmssu0eDIgNH+PrRKdYgqiHptbuVjF2qbILp
-     Z34dJRVN+R9B+RprZXkYiv7gJ/47KSUKzRZpAkIByMjZqLtcypamJM/t+/O1BSst
-     CWcblb45FIxAmO4hE00Q5wnwXNxNnDHXWiuGdSNmIBjpb9nM5wehQlbkx7HzvPk=
-     -----END CERTIFICATE-----
-     serial_number    317328055225536560033788492808123425026102524390
-   ```
-
-## Tutorial
-
-Refer to the [KMIP Secrets Engine](/vault/tutorials/adp/kmip-engine)
-guide for a step-by-step tutorial.
-
-[kmip-spec]: http://docs.oasis-open.org/kmip/spec/v1.4/kmip-spec-v1.4.html
-[kmip-ops]: http://docs.oasis-open.org/kmip/spec/v1.4/os/kmip-spec-v1.4-os.html#_Toc490660840
diff --git a/website/content/docs/secrets/kubernetes.mdx b/website/content/docs/secrets/kubernetes.mdx
deleted file mode 100644
index 63d7680eeee..00000000000
--- a/website/content/docs/secrets/kubernetes.mdx
+++ /dev/null
@@ -1,407 +0,0 @@
----
-layout: docs
-page_title: Kubernetes - Secrets Engines
-description: >-
-  The Kubernetes secrets engine for Vault generates Kubernetes service account
-  tokens, service accounts, role bindings, and roles dynamically.
----
-
-# Kubernetes secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
-The Kubernetes Secrets Engine for Vault generates Kubernetes service account tokens, and
-optionally service accounts, role bindings, and roles. The created service account tokens have
-a configurable TTL and any objects created are automatically deleted when the Vault lease expires.
-
-For each lease, Vault will create a service account token attached to the
-defined service account. The service account token is returned to the caller.
-
-To learn more about service accounts in Kubernetes, visit the
-[Kubernetes service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/)
-and [Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)
-documentation.
-
-~> **Note:** We do not recommend using tokens created by the Kubernetes Secrets Engine to
-   authenticate with the [Vault Kubernetes Auth Method](/vault/docs/auth/kubernetes). This will
-   generate many unique identities in Vault that will be hard to manage.
-
-## Setup
-
-The Kubernetes Secrets Engine must be configured in advance before it
-can perform its functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1. By default, Vault will connect to Kubernetes using its own service account.
-   If using the [standard Helm chart](https://github.com/hashicorp/vault-helm), this service account
-   is created automatically by default and named after the Helm release (often `vault`, but this can be
-   configured via the Helm value `server.serviceAccount.name`).
-
-   It's necessary to ensure that the service account Vault uses will have permissions to manage
-   service account tokens, and optionally manage service accounts, roles, and role bindings. These
-   permissions can be managed using a Kubernetes role or cluster role. The role is attached to the
-   Vault service account with a role binding or cluster role binding.
-
-   For example, a minimal cluster role to create service account tokens is:
-   ```yaml
-   apiVersion: rbac.authorization.k8s.io/v1
-   kind: ClusterRole
-   metadata:
-     name: k8s-minimal-secrets-abilities
-   rules:
-   - apiGroups: [""]
-     resources: ["serviceaccounts/token"]
-     verbs: ["create"]
-   ```
-
-   Similarly, you can create a more permissive cluster role with full permissions to manage tokens,
-   service accounts, bindings, and roles.
-
-   ```yaml
-   apiVersion: rbac.authorization.k8s.io/v1
-   kind: ClusterRole
-   metadata:
-     name: k8s-full-secrets-abilities
-   rules:
-   - apiGroups: [""]
-     resources: ["serviceaccounts", "serviceaccounts/token"]
-     verbs: ["create", "update", "delete"]
-   - apiGroups: ["rbac.authorization.k8s.io"]
-     resources: ["rolebindings", "clusterrolebindings"]
-     verbs: ["create", "update", "delete"]
-   - apiGroups: ["rbac.authorization.k8s.io"]
-     resources: ["roles", "clusterroles"]
-     verbs: ["bind", "escalate", "create", "update", "delete"]
-   ```
-
-   Create this role in Kubernetes (e.g., with `kubectl apply -f`).
-
-   Moreover, if you want to use label selection to configure the namespaces on which a role can act,
-   you will need to grant Vault permissions to read namespaces.
-
-   ```yaml
-   apiVersion: rbac.authorization.k8s.io/v1
-   kind: ClusterRole
-   metadata:
-     name: k8s-full-secrets-abilities-with-labels
-   rules:
-   - apiGroups: [""]
-     resources: ["namespaces"]
-     verbs: ["get"]
-   - apiGroups: [""]
-     resources: ["serviceaccounts", "serviceaccounts/token"]
-     verbs: ["create", "update", "delete"]
-   - apiGroups: ["rbac.authorization.k8s.io"]
-     resources: ["rolebindings", "clusterrolebindings"]
-     verbs: ["create", "update", "delete"]
-   - apiGroups: ["rbac.authorization.k8s.io"]
-     resources: ["roles", "clusterroles"]
-     verbs: ["bind", "escalate", "create", "update", "delete"]
-   ```
-
-   ~> **Note:** Getting the right permissions for Vault will require some trial and error most
-      likely since Kubernetes has strict protections against privilege escalation. You can read more
-      in the
-      [Kubernetes RBAC documentation](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping).
-
-   ~> **Note:** Protect the Vault service account, especially if you use broader permissions for it,
-      as it is essentially a cluster administrator account.
-
-1. Create a role binding to bind the role to Vault's service account and grant Vault permission
-   to manage tokens.
-
-   ```yaml
-   apiVersion: rbac.authorization.k8s.io/v1
-   kind: ClusterRoleBinding
-   metadata:
-     name: vault-token-creator-binding
-   roleRef:
-     apiGroup: rbac.authorization.k8s.io
-     kind: ClusterRole
-     name: k8s-minimal-secrets-abilities
-   subjects:
-   - kind: ServiceAccount
-     name: vault
-     namespace: vault
-   ```
-
-   For more information on Kubernetes roles, service accounts, bindings, and tokens, visit the
-   [Kubernetes RBAC documentation](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).
-
-1. If Vault will not be automatically managing roles or service accounts (see
-   [Automatically Managing Roles and Service Accounts](#automatically-managing-roles-and-service-accounts)),
-   then you will need to set up a service account that Vault will issue tokens for.
-
-   ~> **Note**: It is highly recommended that the service account that Vault issues tokens for
-      is **NOT** the same service account that Vault itself uses.
-
-   The examples we will use will under the namespace `test`, which you can create if it does not
-   already exist.
-
-   ```shell-session
-   $ kubectl create namespace test
-   namespace/test created
-   ```
-
-   Here is a simple set up of a service account, role, and role binding in the Kubernetes `test`
-   namespace with basic permissions we will use for this document:
-   ```yaml
-   apiVersion: v1
-   kind: ServiceAccount
-   metadata:
-     name: test-service-account-with-generated-token
-     namespace: test
-   ---
-   apiVersion: rbac.authorization.k8s.io/v1
-   kind: Role
-   metadata:
-     name: test-role-list-pods
-     namespace: test
-   rules:
-   - apiGroups: [""]
-     resources: ["pods"]
-     verbs: ["list"]
-   ---
-   apiVersion: rbac.authorization.k8s.io/v1
-   kind: RoleBinding
-   metadata:
-     name: test-role-abilities
-     namespace: test
-   roleRef:
-     apiGroup: rbac.authorization.k8s.io
-     kind: Role
-     name: test-role-list-pods
-   subjects:
-   - kind: ServiceAccount
-     name: test-service-account-with-generated-token
-     namespace: test
-   ```
-
-   You can create these objects with `kubectl apply -f`.
-
-1. Enable the Kubernetes Secrets Engine:
-
-   ```shell-session
-   $ vault secrets enable kubernetes
-   Success! Enabled the kubernetes Secrets Engine at: kubernetes/
-   ```
-
-   By default, the secrets engine will mount at the same name as the engine, i.e.,
-   `kubernetes/` here. This can be changed by passing the `-path` argument when enabling.
-
-1. Configure the mount point. An empty config is allowed.
-
-   ```shell-session
-   $ vault write -f kubernetes/config
-   ```
-
-   Configuration options are available as specified in the
-   [API docs](/vault/api-docs/secret/kubernetes).
-
-1. You can now configure Kubernetes Secrets Engine to create a Vault role (**not** the same as a
-   Kubernetes role) that can generate service account tokens for the given service account:
-
-   ```shell-session
-   $ vault write kubernetes/roles/my-role \
-       allowed_kubernetes_namespaces="*" \
-       service_account_name="test-service-account-with-generated-token" \
-       token_default_ttl="10m"
-   ```
-
-## Generating credentials
-
-After a user has authenticated to Vault and has sufficient permissions, a write to the
-`creds` endpoint for the Vault role will generate and return a new service account token.
-
-```shell-session
-$ vault write kubernetes/creds/my-role \
-    kubernetes_namespace=test
-
-Key                        Value
-–--                        -----
-lease_id                   kubernetes/creds/my-role/31d771a6-...
-lease_duration             10m0s
-lease_renwable             false
-service_account_name       test-service-account-with-generated-token
-service_account_namespace  test
-service_account_token      eyJHbGci0iJSUzI1NiIsImtpZCI6ImlrUEE...
-```
-
-You can use the service account token above (`eyJHbG...`) with any Kubernetes API request that
-its service account is authorized for (through role bindings).
-
-```shell-session
-$ curl -sk $(kubectl config view --minify -o 'jsonpath={.clusters[].cluster.server}')/api/v1/namespaces/test/pods \
-    --header "Authorization: Bearer eyJHbGci0iJSUzI1Ni..."
-{
-  "kind": "PodList",
-  "apiVersion": "v1",
-  "metadata": {
-    "resourceVersion": "1624"
-  },
-  "items": []
-}
-```
-
-When the lease expires, you can verify that the token has been revoked.
-```shell-session
-$ curl -sk $(kubectl config view --minify -o 'jsonpath={.clusters[].cluster.server}')/api/v1/namespaces/test/pods \
-    --header "Authorization: Bearer eyJHbGci0iJSUzI1Ni..."
-{
-  "kind": "Status",
-  "apiVersion": "v1",
-  "metadata": {},
-  "status": "Failure",
-  "message": "Unauthorized",
-  "reason": "Unauthorized",
-  "code": 401
-}
-```
-
-## TTL
-
-Kubernetes service account tokens have a time-to-live (TTL). When a token expires it is
-automatically revoked.
-
-You can set a default (`token_default_ttl`) and a maximum TTL (`token_max_ttl`) when
-creating or tuning the Vault role.
-
-```shell-session
-$ vault write kubernetes/roles/my-role \
-    allowed_kubernetes_namespaces="*" \
-    service_account_name="new-service-account-with-generated-token" \
-    token_default_ttl="10m" \
-    token_max_ttl="2h"
-```
-
-You can also set a TTL (`ttl`) when you generate the token from the credentials endpoint.
-The TTL of the token will be given the default if not specified (and cannot exceed the
-maximum TTL of the role, if present).
-
-```shell-session
-$ vault write kubernetes/creds/my-role \
-    kubernetes_namespace=test \
-    ttl=20m
-
-Key                        Value
-–--                        -----
-lease_id                   kubernetes/creds/my-role/31d771a6-...
-lease_duration             20m0s
-lease_renwable             false
-service_account_name       new-service-account-with-generated-token
-service_account_namespace  test
-service_account_token      eyJHbGci0iJSUzI1NiIsImtpZCI6ImlrUEE...
-```
-
-
-You can verify the token's TTL by decoding the JWT token and extracting the `iat`
-(issued at) and `exp` (expiration time) claims.
-
-```shell-session
-$ echo 'eyJhbGc...' | cut -d'.' -f2 | base64 -d  | jq -r '.iat,.exp|todate'
-2022-05-20T17:14:50Z
-2022-05-20T17:34:50Z
-```
-
-## Audiences
-
-Kubernetes service account tokens have audiences.
-
-You can set default audiences (`token_default_audiences`) when creating or tuning the Vault role.
-The Kubernetes cluster default audiences for service account tokens will be used if not specified.
-
-```shell-session
-$ vault write kubernetes/roles/my-role \
-    allowed_kubernetes_namespaces="*" \
-    service_account_name="new-service-account-with-generated-token" \
-    token_default_audiences="custom-audience"
-```
-
-You can also set audiences (`audiences`) when you generate the token from the credentials endpoint.
-The audiences of the token will be given the default audiences if not specified.
-
-```shell-session
-$ vault write kubernetes/creds/my-role \
-    kubernetes_namespace=test \
-    audiences="another-custom-audience"
-
-Key                        Value
-–--                        -----
-lease_id                   kubernetes/creds/my-role/SriWQf0bPZ...
-lease_duration             768h
-lease_renwable             false
-service_account_name       new-service-account-with-generated-token
-service_account_namespace  test
-service_account_token      eyJHbGci0iJSUzI1NiIsImtpZCI6ImlrUEE...
-```
-
-You can verify the token's audiences by decoding the JWT.
-
-```shell-session
-$ echo 'eyJhbGc...' | cut -d'.' -f2 | base64 -d
-{"aud":["another-custom-audience"]...
-```
-
-## Automatically managing roles and service accounts
-
-When configuring the Vault role, you can pass in parameters to specify that you want to
-automatically generate the Kubernetes service account and role binding,
-and optionally generate the Kubernetes role itself.
-
-If you want to configure the Vault role to use a pre-existing Kubernetes role, but generate
-the service account and role binding automatically, you can set the `kubernetes_role_name`
-parameter.
-
-```shell-session
-$ vault write kubernetes/roles/auto-managed-sa-role \
-    allowed_kubernetes_namespaces="test" \
-    kubernetes_role_name="test-role-list-pods"
-```
-
-~> **Note**: Vault's service account will also need access to the resources it is granting
-access to. This can be done for the examples above with `kubectl -n test create rolebinding --role test-role-list-pods --serviceaccount=vault:vault vault-test-role-abilities`.
-This is how Kubernetes prevents privilege escalation.
-You can read more in the
-[Kubernetes RBAC documentation](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping).
-
-You can then get credentials with the automatically generated service account.
-```shell-session
-$ vault write kubernetes/creds/auto-managed-sa-role \
-    kubernetes_namespace=test
-Key                          Value
----                          -----
-lease_id                     kubernetes/creds/auto-managed-sa-role/cujRLYjKZUMQk6dkHBGGWm67
-lease_duration               768h
-lease_renewable              false
-service_account_name         v-token-auto-man-1653001548-5z6hrgsxnmzncxejztml4arz
-service_account_namespace    test
-service_account_token        eyJHbGci0iJSUzI1Ni...
-```
-
-Furthermore, Vault can also automatically create the role in addition to the service account and
-role binding by specifying the `generated_role_rules` parameter, which accepts a set of JSON or YAML
-rules for the generated role.
-
-```shell-session
-$ vault write kubernetes/roles/auto-managed-sa-and-role \
-    allowed_kubernetes_namespaces="test" \
-    generated_role_rules='{"rules":[{"apiGroups":[""],"resources":["pods"],"verbs":["list"]}]}'
-```
-You can then get credentials in the same way as before.
-```shell-session
-$ vault write kubernetes/creds/auto-managed-sa-and-role \
-    kubernetes_namespace=test
-Key                          Value
----                          -----
-lease_id                     kubernetes/creds/auto-managed-sa-and-role/pehLtegoTP8vCkcaQozUqOHf
-lease_duration               768h
-lease_renewable              false
-service_account_name         v-token-auto-man-1653002096-4imxf3ytjh5hbyro9s1oqdo3
-service_account_namespace    test
-service_account_token        eyJHbGci0iJSUzI1Ni...
-```
-
-## API
-
-The Kubernetes Secrets Engine has a full HTTP API. Please see the
-[Kubernetes Secrets Engine API docs](/vault/api-docs/secret/kubernetes) for more details.
diff --git a/website/content/docs/secrets/kv/index.mdx b/website/content/docs/secrets/kv/index.mdx
deleted file mode 100644
index de7130efaed..00000000000
--- a/website/content/docs/secrets/kv/index.mdx
+++ /dev/null
@@ -1,42 +0,0 @@
----
-layout: docs
-page_title: KV - Secrets Engines
-description: The KV secrets engine can store arbitrary secrets.
----
-
-# KV secrets engine
-
-The `kv` secrets engine is a generic Key-Value store used to store arbitrary
-secrets within the configured physical storage for Vault. This backend can be
-run in one of two modes; either it can be configured to store a single value
-for a key or, versioning can be enabled and a configurable number of versions
-for each key will be stored.
-
-## KV version 1
-
-When running the `kv` secrets backend non-versioned, only the most recently
-written value for a key will be preserved. The benefits of non-versioned `kv`
-is a reduced storage size for each key since no additional metadata or history
-is stored. Additionally, requests going to a backend configured this way will be
-more performant because for any given request there will be fewer storage calls
-and no locking.
-
-More information about running in this mode can be found in the [KV version 1
-Docs](/vault/docs/secrets/kv/kv-v1)
-
-## KV version 2
-
-When running v2 of the `kv` backend a key can retain a configurable number of
-versions. This defaults to 10 versions. The older versions' metadata and data
-can be retrieved. Additionally, Check-and-Set operations can be used to avoid
-overwriting data unintentionally.
-
-When a version is deleted the underlying data is not removed, rather it is
-marked as deleted. Deleted versions can be undeleted. To permanently remove a
-version's data the destroy command or API endpoint can be used. Additionally all
-versions and metadata for a key can be deleted by deleting on the metadata
-command or API endpoint. Each of these operations can be ACL'ed differently,
-restricting who has permissions to soft delete, undelete, or fully remove data.
-
-More information about running in this mode can be found in the [KV version 2
-Docs](/vault/docs/secrets/kv/kv-v2)
diff --git a/website/content/docs/secrets/kv/kv-v1.mdx b/website/content/docs/secrets/kv/kv-v1.mdx
deleted file mode 100644
index 2a37300d8af..00000000000
--- a/website/content/docs/secrets/kv/kv-v1.mdx
+++ /dev/null
@@ -1,150 +0,0 @@
----
-layout: docs
-page_title: KV - Secrets Engines
-description: The KV secrets engine can store arbitrary secrets.
----
-
-# KV secrets engine - version 1
-
-The `kv` secrets engine is used to store arbitrary secrets within the
-configured physical storage for Vault.
-
-Writing to a key in the `kv` backend will replace the old value; sub-fields are
-not merged together.
-
-Key names must always be strings. If you write non-string values directly via
-the CLI, they will be converted into strings. However, you can preserve
-non-string values by writing the key/value pairs to Vault from a JSON file or
-using the HTTP API.
-
-This secrets engine honors the distinction between the `create` and `update`
-capabilities inside ACL policies.
-
-~> **Note**: Path and key names are _not_ obfuscated or encrypted; only the
-values set on keys are. You should not store sensitive information as part of a
-secret's path.
-
-## Setup
-
-To enable a version 1 kv store:
-
-```shell-session
-$ vault secrets enable -version=1 kv
-```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials. The `kv` secrets engine
-allows for writing keys with arbitrary values.
-
-1. Write arbitrary data:
-
-   ```shell-session
-   $ vault kv put kv/my-secret my-value=s3cr3t
-   Success! Data written to: kv/my-secret
-   ```
-
-1. Read arbitrary data:
-
-   ```shell-session
-   $ vault kv get kv/my-secret
-   Key                 Value
-   ---                 -----
-   my-value            s3cr3t
-   ```
-
-1. List the keys:
-
-   ```shell-session
-   $ vault kv list kv/
-   Keys
-   ----
-   my-secret
-   ```
-
-1. Delete a key:
-
-   ```shell-session
-   $ vault kv delete kv/my-secret
-   Success! Data deleted (if it existed) at: kv/my-secret
-   ```
-
-You can also use [Vault's password policy](/vault/docs/concepts/password-policies) feature to generate arbitrary values.
-
-1. Write a password policy:
-
-   ```shell-session
-   $ vault write sys/policies/password/example policy=-<<EOF
-
-     length=20
-
-     rule "charset" {
-       charset = "abcdefghij0123456789"
-       min-chars = 1
-     }
-
-     rule "charset" {
-       charset = "!@#$%^&*STUVWXYZ"
-       min-chars = 1
-     }
-
-   EOF
-   ```
-
-1. Write data using the `example` policy:
-
-   ```shell-session
-   $ vault kv put kv/my-generated-secret \
-       password=$(vault read -field password sys/policies/password/example/generate)
-   ```
-
-1. Read the generated data:
-
-   ```shell-session
-   $ vault kv get kv/my-generated-secret
-   ====== Data ======
-   Key         Value
-   ---         -----
-   password    ^dajd609Xf8Zhac$dW24
-   ```
-
-## TTLs
-
-Unlike other secrets engines, the KV secrets engine does not enforce TTLs
-for expiration. Instead, the `lease_duration` is a hint for how often consumers
-should check back for a new value.
-
-If provided a key of `ttl`, the KV secrets engine will utilize this value
-as the lease duration:
-
-```shell-session
-$ vault kv put kv/my-secret ttl=30m my-value=s3cr3t
-Success! Data written to: kv/my-secret
-```
-
-Even with a `ttl` set, the secrets engine _never_ removes data on its own. The
-`ttl` key is merely advisory.
-
-When reading a value with a `ttl`, both the `ttl` key _and_ the refresh interval
-will reflect the value:
-
-```shell-session
-$ vault kv get kv/my-secret
-Key                 Value
----                 -----
-my-value            s3cr3t
-ttl                 30m
-```
-
-## Tutorial
-
-Refer to the [Static Secrets: Key Value Secrets
-Engine](/vault/tutorials/secrets-management/static-secrets)
-tutorial to learn how to set up a uniform workflow to securely store sensitive information.
-
-## API
-
-The KV secrets engine has a full HTTP API. Please see the
-[KV secrets engine API](/vault/api-docs/secret/kv/kv-v1) for more
-details.
diff --git a/website/content/docs/secrets/kv/kv-v2.mdx b/website/content/docs/secrets/kv/kv-v2.mdx
deleted file mode 100644
index 3c182ecf732..00000000000
--- a/website/content/docs/secrets/kv/kv-v2.mdx
+++ /dev/null
@@ -1,630 +0,0 @@
----
-layout: docs
-page_title: KV - Secrets Engines
-description: The KV secrets engine can store arbitrary secrets.
----
-
-# KV secrets engine - version 2
-
-The `kv` secrets engine is used to store arbitrary secrets within the
-configured physical storage for Vault.
-
-Key names must always be strings. If you write non-string values directly via
-the CLI, they will be converted into strings. However, you can preserve
-non-string values by writing the key/value pairs to Vault from a JSON file or
-using the HTTP API.
-
-This secrets engine honors the distinction between the `create` and `update`
-capabilities inside ACL policies. The `patch` capability is also supported
-which is used to represent partial updates whereas the `update` capability
-represents full overwrites.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-A v2 `kv` secrets engine can be enabled by:
-
-```shell-session
-$ vault secrets enable -version=2 kv
-```
-
-Or, you can pass `kv-v2` as the secrets engine type:
-
-```shell-session
-$ vault secrets enable kv-v2
-```
-
-Additionally, when running a dev-mode server, the v2 `kv` secrets engine is enabled by default at the
-path `secret/` (for non-dev servers, it is currently v1). It can be disabled, moved, or enabled multiple times at
-different paths. Each instance of the KV secrets engine is isolated and unique.
-
-## Upgrading from version 1
-
-An existing version 1 kv store can be upgraded to a version 2 kv store via the CLI or API, as shown below. This will start an upgrade process to upgrade the existing key/value data to a versioned format. The mount will be inaccessible during this process. This process could take a long time, so plan accordingly.
-
-Once upgraded to version 2, the former paths at which the data was accessible will no longer suffice. You will need to adjust user policies to add access to the version 2 paths as detailed in the [ACL Rules section below](/vault/docs/secrets/kv/kv-v2#acl-rules). Similarly, users/applications will need to update the paths at which they interact with the kv data once it has been upgraded to version 2.
-
-An existing version 1 kv can be upgraded to a version 2 KV store with the CLI command:
-
-```shell-session
-$ vault kv enable-versioning secret/
-Success! Tuned the secrets engine at: secret/
-```
-
-or via the API:
-
-```shell-session
-$ cat payload.json
-{
-  "options": {
-      "version": "2"
-  }
-}
-```
-
-```shell-session
-$ curl \
-    --header "X-Vault-Token: ..." \
-    --request POST \
-    --data @payload.json \
-    http://127.0.0.1:8200/v1/sys/mounts/secret/tune
-```
-
-## ACL rules
-
-The version 2 kv store uses a prefixed API, which is different from the
-version 1 API. Before upgrading from a version 1 kv the ACL rules
-should be changed. Also different paths in the version 2 API can be ACL'ed
-differently.
-
-Writing and reading versions are prefixed with the `data/` path. This policy
-that worked for the version 1 kv:
-
-```plaintext
-path "secret/dev/team-1/*" {
-  capabilities = ["create", "update", "read"]
-}
-```
-
-Should be changed to:
-
-```plaintext
-path "secret/data/dev/team-1/*" {
-  capabilities = ["create", "update", "read"]
-}
-```
-
-There are different levels of data deletion for this backend. To grant a policy
-the permissions to delete the latest version of a key:
-
-```plaintext
-path "secret/data/dev/team-1/*" {
-  capabilities = ["delete"]
-}
-```
-
-To allow the policy to delete any version of a key:
-
-```plaintext
-path "secret/delete/dev/team-1/*" {
-  capabilities = ["update"]
-}
-```
-
-To allow a policy to undelete data:
-
-```plaintext
-path "secret/undelete/dev/team-1/*" {
-  capabilities = ["update"]
-}
-```
-
-To allow a policy to destroy versions:
-
-```plaintext
-path "secret/destroy/dev/team-1/*" {
-  capabilities = ["update"]
-}
-```
-
-To allow a policy to list keys:
-
-```plaintext
-path "secret/metadata/dev/team-1/*" {
-  capabilities = ["list"]
-}
-```
-
-To allow a policy to view metadata for each version:
-
-```plaintext
-path "secret/metadata/dev/team-1/*" {
-  capabilities = ["read"]
-}
-```
-
-To allow a policy to permanently remove all versions and metadata for a key:
-
-```plaintext
-path "secret/metadata/dev/team-1/*" {
-  capabilities = ["delete"]
-}
-```
-
-The `allowed_parameters`, `denied_parameters`, and `required_parameters` fields are
-not supported for policies used with the version 2 kv store. See the [Policies Concepts](/vault/docs/concepts/policies)
-for a description of these parameters.
-
-See the [API Specification](/vault/api-docs/secret/kv/kv-v2) for more
-information.
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials. The `kv` secrets engine
-allows for writing keys with arbitrary values.
-
-The path-like KV-v1 syntax for referencing a secret (`secret/foo`) can still
-be used in KV-v2, but we recommend using the `-mount=secret` flag syntax to
-avoid mistaking it for the actual path to the secret (`secret/data/foo` is the
-real path).
-
-### Writing/Reading arbitrary data
-
-1. Write arbitrary data:
-
-   ```shell-session
-   $ vault kv put -mount=secret my-secret foo=a bar=b
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:20:22.985303Z
-   custom_metadata  <nil>
-   deletion_time    n/a
-   destroyed        false
-   version          1
-   ```
-
-1. Read arbitrary data:
-
-   ```shell-session
-   $ vault kv get -mount=secret my-secret
-   ====== Metadata ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:20:22.985303Z
-   custom_metadata  <nil>
-   deletion_time    n/a
-   destroyed        false
-   version          1
-
-   ====== Data ======
-   Key         Value
-   ---         -----
-   foo         a
-   bar         b
-   ```
-
-1. Write another version, the previous version will still be accessible. The
-   `-cas` flag can optionally be passed to perform a check-and-set operation. If
-   not set the write will be allowed. In order for a write to be successful, `cas` must be set to
-  the current version of the secret. If set to 0 a write will only be allowed if
-  the key doesn’t exist as unset keys do not have any version information. Also
-  remember that soft deletes do not remove any underlying version data from storage.
-  In order to write to a soft deleted key, the cas parameter must match the key's
-  current version.
-
-   ```shell-session
-   $ vault kv put -mount=secret -cas=1 my-secret foo=aa bar=bb
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:22:23.369372Z
-   custom_metadata  <nil>
-   deletion_time    n/a
-   destroyed        false
-   version          2
-   ```
-
-1. Reading now will return the newest version of the data:
-
-   ```shell-session
-   $ vault kv get -mount=secret my-secret
-   ====== Metadata ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:22:23.369372Z
-   custom_metadata  <nil>
-   deletion_time    n/a
-   destroyed        false
-   version          2
-
-   ====== Data ======
-   Key         Value
-   ---         -----
-   foo         aa
-   bar         bb
-   ```
-
-1. Partial updates can be accomplished using the `vault kv patch` command. A
-   command will initially attempt an HTTP `PATCH` request which requires the
-   `patch` ACL capability. The `PATCH` request will fail if the token used
-   is associated with a policy that does not contain the `patch` capability. In
-   this case the command will perform a read, local update, and subsequent write
-   which require both the `read` and `update` ACL capabilities.
-
-   The `-cas` flag can optionally be passed to perform a check-and-set operation.
-   It will only be used in the case of the initial `PATCH` request. The
-   read-then-write flow will use the `version` value from the secret returned by
-   the read to perform a check-and-set operation in the subsequent write.
-
-   ```shell-session
-   $ vault kv patch -mount=secret -cas=2 my-secret bar=bbb
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:23:49.199802Z
-   custom_metadata  <nil>
-   deletion_time    n/a
-   destroyed        false
-   version          3
-   ```
-
-1. The `vault kv patch` command also supports a `-method` flag which can be
-   used to specify HTTP `PATCH` or read-then-write. The supported values are
-   `patch` and `rw` for HTTP `PATCH` and read-then-write, respectively.
-
-   Perform a patch using the `patch` method:
-
-   ```shell-session
-   $ vault kv patch -mount=secret -method=patch -cas=2 my-secret bar=bbb
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:23:49.199802Z
-   custom_metadata  <nil>
-   deletion_time    n/a
-   destroyed        false
-   version          3
-   ```
-
-   Perform a patch using the read-then-write method:
-
-   ```shell-session
-   $ vault kv patch -mount=secret -method=rw my-secret bar=bbb
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:23:49.199802Z
-   custom_metadata  <nil>
-   deletion_time    n/a
-   destroyed        false
-   version          3
-   ```
-
-2. Reading after a patch will return the newest version of the data in which
-   only the specified fields were updated:
-
-   ```shell-session
-   $ vault kv get -mount=secret my-secret
-   ====== Metadata ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:23:49.199802Z
-   custom_metadata  <nil>
-   deletion_time    n/a
-   destroyed        false
-   version          3
-
-   ====== Data ======
-   Key         Value
-   ---         -----
-   foo         aa
-   bar         bbb
-   ```
-
-3. Previous versions can be accessed with the `-version` flag:
-
-   ```shell-session
-   $ vault kv get -mount=secret -version=1 my-secret
-   ====== Metadata ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:20:22.985303Z
-   custom_metadata  <nil>
-   deletion_time    n/a
-   destroyed        false
-   version          1
-
-   ====== Data ======
-   Key         Value
-   ---         -----
-   foo         a
-   bar         b
-   ```
-
-You can also use [Vault's password policy](/vault/docs/concepts/password-policies) feature to generate arbitrary values.
-
-1. Write a password policy:
-
-   ```shell-session
-   $ vault write sys/policies/password/example policy=-<<EOF
-
-     length=20
-
-     rule "charset" {
-       charset = "abcdefghij0123456789"
-       min-chars = 1
-     }
-
-     rule "charset" {
-       charset = "!@#$%^&*STUVWXYZ"
-       min-chars = 1
-     }
-
-   EOF
-   ```
-
-1. Write data using the `example` policy:
-
-   ```shell-session
-   $ vault kv put -mount=secret my-generated-secret \
-       password=$(vault read -field password sys/policies/password/example/generate)
-   ```
-
-   **Example output:**
-
-   <CodeBlockConfig hideClipboard>
-
-   ```plaintext
-   ========= Secret Path =========
-   secret/data/my-generated-secret
-
-   ======= Metadata =======
-   Key                Value
-   ---                -----
-   created_time       2023-05-10T14:32:32.37354939Z
-   custom_metadata    <nil>
-   deletion_time      n/a
-   destroyed          false
-   version            1
-   ```
-
-   </CodeBlockConfig>
-
-1. Read the generated data:
-
-   ```shell-session
-   $ vault kv get -mount=secret my-generated-secret
-   ========= Secret Path =========
-   secret/data/my-generated-secret
-
-   ======= Metadata =======
-   Key                Value
-   ---                -----
-   created_time       2023-05-10T14:32:32.37354939Z
-   custom_metadata    <nil>
-   deletion_time      n/a
-   destroyed          false
-   version            1
-
-   ====== Data ======
-   Key         Value
-   ---         -----
-   password    !hh&be1e4j16dVc0ggae
-   ```
-
-### Deleting and destroying data
-
-When deleting data the standard `vault kv delete` command will perform a
-soft delete. It will mark the version as deleted and populate a `deletion_time`
-timestamp. Soft deletes do not remove the underlying version data from storage,
-which allows the version to be undeleted. The `vault kv undelete` command
-handles undeleting versions.
-
-A version's data is permanently deleted only when the key has more versions than
-are allowed by the max-versions setting, or when using `vault kv destroy`. When
-the destroy command is used the underlying version data will be removed and the
-key metadata will be marked as destroyed. If a version is cleaned up by going
-over max-versions the version metadata will also be removed from the key.
-
-See the commands below for more information:
-
-1. The latest version of a key can be deleted with the delete command, this also
-   takes a `-versions` flag to delete prior versions:
-
-   ```shell-session
-   $ vault kv delete -mount=secret my-secret
-   Success! Data deleted (if it existed) at: secret/data/my-secret
-   ```
-
-1. Versions can be undeleted:
-
-   ```shell-session
-   $ vault kv undelete -mount=secret -versions=2 my-secret
-   Success! Data written to: secret/undelete/my-secret
-
-   $ vault kv get -mount=secret my-secret
-   ====== Metadata ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:23:21.834403Z
-   custom_metadata  <nil>
-   deletion_time    n/a
-   destroyed        false
-   version          2
-
-   ====== Data ======
-   Key         Value
-   ---         -----
-   my-value    short-lived-s3cr3t
-   ```
-
-1. Destroying a version permanently deletes the underlying data:
-
-   ```shell-session
-   $ vault kv destroy -mount=secret -versions=2 my-secret
-   Success! Data written to: secret/destroy/my-secret
-   ```
-
-### Key metadata
-
-All versions and key metadata can be tracked with the metadata command & API.
-Deleting the metadata key will cause all metadata and versions for that key to
-be permanently removed.
-
-See the commands below for more information:
-
-1. All metadata and versions for a key can be viewed:
-
-   ```shell-session
-   $ vault kv metadata get -mount=secret my-secret
-   ========== Metadata ==========
-   Key                     Value
-   ---                     -----
-   cas_required            false
-   created_time            2019-06-19T17:20:22.985303Z
-   current_version         2
-   custom_metadata         <nil>
-   delete_version_after    0s
-   max_versions            0
-   oldest_version          0
-   updated_time            2019-06-19T17:22:23.369372Z
-
-   ====== Version 1 ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:20:22.985303Z
-   deletion_time    n/a
-   destroyed        false
-
-   ====== Version 2 ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:22:23.369372Z
-   deletion_time    n/a
-   destroyed        true
-   ```
-
-1. The metadata settings for a key can be configured:
-
-   ```shell-session
-   $ vault kv metadata put -mount=secret -max-versions 2 -delete-version-after="3h25m19s" my-secret
-   Success! Data written to: secret/metadata/my-secret
-   ```
-
-   Delete-version-after settings will apply only to new versions. Max versions
-   changes will be applied on next write:
-
-   ```shell-session
-   $ vault kv put -mount=secret my-secret my-value=newer-s3cr3t
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:31:16.662563Z
-   custom_metadata  <nil>
-   deletion_time    2019-06-19T20:56:35.662563Z
-   destroyed        false
-   version          4
-   ```
-
-   Once a key has more versions than max versions the oldest versions
-   are cleaned up:
-
-   ```shell-session
-   $ vault kv metadata get -mount=secret my-secret
-   ========== Metadata ==========
-   Key                     Value
-   ---                     -----
-   cas_required            false
-   created_time            2019-06-19T17:20:22.985303Z
-   current_version         4
-   custom_metadata         <nil>
-   delete_version_after    3h25m19s
-   max_versions            2
-   oldest_version          3
-   updated_time            2019-06-19T17:31:16.662563Z
-
-   ====== Version 3 ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:23:21.834403Z
-   deletion_time    n/a
-   destroyed        true
-
-   ====== Version 4 ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:31:16.662563Z
-   deletion_time    2019-06-19T20:56:35.662563Z
-   destroyed        false
-   ```
-
-   A secret's key metadata can contain custom metadata used to describe the secret.
-   The data will be stored as string-to-string key-value pairs.
-   The `-custom-metadata` flag can be repeated to add multiple key-value pairs.
-
-   The `vault kv metadata put` command can be used to fully overwrite the value of `custom_metadata`:
-
-   ```shell-session
-   $ vault kv metadata put -mount=secret -custom-metadata=foo=abc -custom-metadata=bar=123 my-secret
-   Success! Data written to: secret/metadata/my-secret
-
-   $ vault kv get -mount=secret my-secret
-   ====== Metadata ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:22:23.369372Z
-   custom_metadata  map[bar:123 foo:abc]
-   deletion_time    n/a
-   destroyed        false
-   version          2
-
-   ====== Data ======
-   Key         Value
-   ---         -----
-   foo         aa
-   bar         bb
-   ```
-
-   The `vault kv metadata patch` command can be used to partially overwrite the value of `custom_metadata`.
-   The following invocation will update `custom_metadata` sub-field `foo` but leave `bar` untouched:
-
-   ```shell-session
-   $ vault kv metadata patch -mount=secret -custom-metadata=foo=def my-secret
-   Success! Data written to: secret/metadata/my-secret
-   ```
-
-   ```shell-session
-   $ vault kv get -mount=secret my-secret
-   ====== Metadata ======
-   Key              Value
-   ---              -----
-   created_time     2019-06-19T17:22:23.369372Z
-   custom_metadata  map[bar:123 foo:def]
-   deletion_time    n/a
-   destroyed        false
-   version          2
-
-   ====== Data ======
-   Key         Value
-   ---         -----
-   foo         aa
-   bar         bb
-   ```
-
-1. Permanently delete all metadata and versions for a key:
-
-   ```shell-session
-   $ vault kv metadata delete -mount=secret my-secret
-   Success! Data deleted (if it existed) at: secret/metadata/my-secret
-   ```
-
-## Tutorial
-
-Refer to the [Versioned Key Value Secrets
-Engine](/vault/tutorials/secrets-management/versioned-kv)
-tutorial to learn how to use KV secrets engine v2 to version or roll back secrets.
-
-## API
-
-The KV secrets engine has a full HTTP API. Please see the
-[KV secrets engine API](/vault/api-docs/secret/kv/kv-v2) for more
-details.
diff --git a/website/content/docs/secrets/ldap.mdx b/website/content/docs/secrets/ldap.mdx
deleted file mode 100644
index c4551ff6e06..00000000000
--- a/website/content/docs/secrets/ldap.mdx
+++ /dev/null
@@ -1,474 +0,0 @@
----
-layout: docs
-page_title: LDAP - Secrets Engine
-description: >-
-  The LDAP secret engine manages LDAP entry passwords.
----
-
-# LDAP secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
-The LDAP secrets engine provides management of LDAP credentials as well as dynamic
-creation of credentials. It supports integration with implementations of the LDAP
-v3 protocol, including OpenLDAP, Active Directory, and IBM Resource Access Control
-Facility (RACF).
-
-The secrets engine has three primary features:
-- [Static Credentials](/vault/docs/secrets/ldap#static-credentials)
-- [Dynamic Credentials](/vault/docs/secrets/ldap#dynamic-credentials)
-- [Service Account Check-Out](/vault/docs/secrets/ldap#service-account-check-out)
-
-## Setup
-
-1. Enable the LDAP secret engine:
-
-   ```sh
-   $ vault secrets enable ldap
-   ```
-
-   By default, the secrets engine will mount at the name of the engine. To
-   enable the secrets engine at a different path, use the `-path` argument.
-
-2. Configure the credentials that Vault uses to communicate with LDAP
-   to generate passwords:
-
-   ```sh
-   $ vault write ldap/config \
-       binddn=$USERNAME \
-       bindpass=$PASSWORD \
-       url=ldaps://138.91.247.105
-   ```
-
-   Note: it's recommended a dedicated entry management account be created specifically for Vault.
-
-3. Rotate the root password so only Vault knows the credentials:
-
-   ```sh
-   $ vault write -f ldap/rotate-root
-   ```
-
-   Note: it's not possible to retrieve the generated password once rotated by Vault.
-   It's recommended a dedicated entry management account be created specifically for Vault.
-
-### Schemas
-
-The LDAP Secret Engine supports three different schemas:
-
-- `openldap` (default)
-- `racf`
-- `ad`
-
-#### OpenLDAP
-
-By default, the LDAP Secret Engine assumes the entry password is stored in `userPassword`.
-There are many object classes that provide `userPassword` including for example:
-
-- `organization`
-- `organizationalUnit`
-- `organizationalRole`
-- `inetOrgPerson`
-- `person`
-- `posixAccount`
-
-#### Resource access control facility (RACF)
-
-For managing IBM's Resource Access Control Facility (RACF) security system, the secret
-engine must be configured to use the schema `racf`.
-
-Generated passwords must be 8 characters or less to support RACF. The length of the
-password can be configured using a [password policy](/vault/docs/concepts/password-policies):
-
-```bash
-$ vault write ldap/config \
-	binddn=$USERNAME \
-	bindpass=$PASSWORD \
-	url=ldaps://138.91.247.105 \
-	schema=racf \
-	password_policy=racf_password_policy
-```
-
-#### Active directory (AD)
-
-For managing Active Directory instances, the secret engine must be configured to use the
-schema `ad`.
-
-```bash
-$ vault write ldap/config \
-	binddn=$USERNAME \
-	bindpass=$PASSWORD \
-	url=ldaps://138.91.247.105 \
-	schema=ad
-```
-
-## Static credentials
-
-### Setup
-
-1. Configure a static role that maps a name in Vault to an entry in LDAP.
-   Password rotation settings will be managed by this role.
-
-   ```sh
-   $ vault write ldap/static-role/hashicorp \
-       dn='uid=hashicorp,ou=users,dc=hashicorp,dc=com' \
-       username='hashicorp' \
-       rotation_period="24h"
-   ```
-
-2. Request credentials for the "hashicorp" role:
-
-   ```sh
-   $ vault read ldap/static-cred/hashicorp
-   ```
-
-### Password rotation
-
-Passwords can be managed in two ways:
-
-- automatic time based rotation
-- manual rotation
-
-### Auto password rotation
-
-Passwords will automatically be rotated based on the `rotation_period` configured
-in the static role (minimum of 5 seconds). When requesting credentials for a static
-role, the response will include the time before the next rotation (`ttl`).
-
-Auto-rotation is currently only supported for static roles. The `binddn` account used
-by Vault should be rotated using the `rotate-root` endpoint to generate a password
-only Vault will know.
-
-### Manual rotation
-
-Static roles can be manually rotated using the `rotate-role` endpoint. When manually
-rotated the rotation period will start over.
-
-### Deleting static roles
-
-Passwords are not rotated upon deletion of a static role. The password should be manually
-rotated prior to deleting the role or revoking access to the static role.
-
-## Dynamic credentials
-
-### Setup
-
-Dynamic credentials can be configured by calling the `/role/:role_name` endpoint:
-
-```bash
-$ vault write ldap/role/dynamic-role \
-  creation_ldif=@/path/to/creation.ldif \
-  deletion_ldif=@/path/to/deletion.ldif \
-  rollback_ldif=@/path/to/rollback.ldif \
-  default_ttl=1h \
-  max_ttl=24h
-```
-
--> Note: The `rollback_ldif` argument is optional, but recommended. The statements within `rollback_ldif` will be
-executed if the creation fails for any reason. This ensures any entities are removed in the event of a failure.
-
-To generate credentials:
-
-```bash
-$ vault read ldap/creds/dynamic-role
-Key                    Value
----                    -----
-lease_id               ldap/creds/dynamic-role/HFgd6uKaDomVMvJpYbn9q4q5
-lease_duration         1h
-lease_renewable        true
-distinguished_names    [cn=v_token_dynamic-role_FfH2i1c4dO_1611952635,ou=users,dc=learn,dc=example]
-password               xWMjkIFMerYttEbzfnBVZvhRQGmhpAA0yeTya8fdmDB3LXDzGrjNEPV2bCPE9CW6
-username               v_token_testrole_FfH2i1c4dO_1611952635
-```
-
-The `distinguished_names` field is an array of DNs that are created from the `creation_ldif` statements. If more than
-one LDIF entry is included, the DN from each statement will be included in this field. Each entry in this field
-corresponds to a single LDIF statement. No de-duplication occurs and order is maintained.
-
-### LDIF entries
-
-User account management is provided through LDIF entries. The LDIF entries may be a base64-encoded version of the
-LDIF string. The string will be parsed and validated to ensure that it adheres to LDIF syntax. A good reference
-for proper LDIF syntax can be found [here](https://ldap.com/ldif-the-ldap-data-interchange-format/).
-
-Some important things to remember when crafting your LDIF entries:
-
-- There should not be any trailing spaces on any line, including empty lines
-- Each `modify` block needs to be preceded with an empty line
-- Multiple modifications for a `dn` can be defined in a single `modify` block. Each modification needs to close
-  with a single dash (`-`)
-
-### Active directory (AD)
-
-For Active Directory, there are a few additional details that are important to remember:
-
-To create a user programmatically in AD, you first `add` a user object and then `modify` that user to provide a
-password and enable the account.
-
-- Passwords in AD are set using the `unicodePwd` field. This must be proceeded by two (2) colons (`::`).
-- When setting a password programmatically in AD, the following criteria must be met:
-
-  - The password must be enclosed in double quotes (`" "`)
-  - The password must be in [`UTF16LE` format](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/6e803168-f140-4d23-b2d3-c3a8ab5917d2)
-  - The password must be `base64`-encoded
-  - Additional details can be found [here](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/set-user-password-with-ldifde)
-
-- Once a user's password has been set, it can be enabled. AD uses the `userAccountControl` field for this purpose:
-  - To enable the account, set `userAccountControl` to `512`
-  - You will likely also want to disable AD's password expiration for this dynamic user account. The
-    `userAccountControl` value for this is: `65536`
-  - `userAccountControl` flags are cumulative, so to set both of the above two flags, add up the two values
-    (`512 + 65536 = 66048`): set `userAccountControl` to `66048`
-  - See [here](https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties#property-flag-descriptions)
-    for details on `userAccountControl` flags
-
-`sAMAccountName` is a common field when working with AD users. It is used to provide compatibility with legacy
-Windows NT systems and has a limit of 20 characters. Keep this in mind when defining your `username_template`.
-See [here](https://docs.microsoft.com/en-us/windows/win32/adschema/a-samaccountname) for additional details.
-
-Since the default `username_template` is longer than 20 characters which follows the template of `v_{{.DisplayName}}_{{.RoleName}}_{{random 10}}_{{unix_time}}`, we recommend customising the `username_template` on the role configuration to generate accounts with names less than 20 characters. Please refer to the [username templating document](/vault/docs/concepts/username-templating) for more information.
-
-With regard to adding dynamic users to groups, AD doesn't let you directly modify a user's `memberOf` attribute.
-The `member` attribute of a group and `memberOf` attribute of a user are
-[linked attributes](https://docs.microsoft.com/en-us/windows/win32/ad/linked-attributes). Linked attributes are
-forward link/back link pairs, with the forward link able to be modified. In the case of AD group membership, the
-group's `member` attribute is the forward link. In order to add a newly-created dynamic user to a group, we also
-need to issue a `modify` request to the desired group and update the group membership with the new user.
-
-#### Active directory LDIF example
-
-The various `*_ldif` parameters are templates that use the [go template](https://golang.org/pkg/text/template/)
-language. A complete LDIF example for creating an Active Directory user account is provided here for reference:
-
-```ldif
-dn: CN={{.Username}},OU=HashiVault,DC=adtesting,DC=lab
-changetype: add
-objectClass: top
-objectClass: person
-objectClass: organizationalPerson
-objectClass: user
-userPrincipalName: {{.Username}}@adtesting.lab
-sAMAccountName: {{.Username}}
-
-dn: CN={{.Username}},OU=HashiVault,DC=adtesting,DC=lab
-changetype: modify
-replace: unicodePwd
-unicodePwd::{{ printf "%q" .Password | utf16le | base64 }}
--
-replace: userAccountControl
-userAccountControl: 66048
--
-
-dn: CN=test-group,OU=HashiVault,DC=adtesting,DC=lab
-changetype: modify
-add: member
-member: CN={{.Username}},OU=HashiVault,DC=adtesting,DC=lab
--
-```
-
-## Service account Check-Out
-
-Service account check-out provides a library of service accounts that can be checked out
-by a person or by machines. Vault will automatically rotate the password each time a
-service account is checked in. Service accounts can be voluntarily checked in, or Vault
-will check them in when their lending period (or, "ttl", in Vault's language) ends.
-
-The service account check-out functionality works with various [schemas](/vault/api-docs/secret/ldap#schema),
-including OpenLDAP, Active Directory, and RACF. In the following usage example, the secrets
-engine is configured to manage a library of service accounts in an Active Directory instance.
-
-First we'll need to enable the LDAP secrets engine and tell it how to securely connect
-to an AD server.
-
-```shell-session
-$ vault secrets enable ldap
-Success! Enabled the ad secrets engine at: ldap/
-
-$ vault write ldap/config \
-    binddn=$USERNAME \
-    bindpass=$PASSWORD \
-    url=ldaps://138.91.247.105 \
-    userdn='dc=example,dc=com'
-```
-
-Our next step is to designate a set of service accounts for check-out.
-
-```shell-session
-$ vault write ldap/library/accounting-team \
-    service_account_names=fizz@example.com,buzz@example.com \
-    ttl=10h \
-    max_ttl=20h \
-    disable_check_in_enforcement=false
-```
-
-In this example, the service account names of `fizz@example.com` and `buzz@example.com` have
-already been created on the remote AD server. They've been set aside solely for Vault to handle.
-The `ttl` is how long each check-out will last before Vault checks in a service account,
-rotating its password during check-in. The `max_ttl` is the maximum amount of time it can live
-if it's renewed. These default to `24h`, and both use [duration format strings](/vault/docs/concepts/duration-format).
-Also by default, a service account must be checked in by the same Vault entity or client token that
-checked it out. However, if this behavior causes problems, set `disable_check_in_enforcement=true`.
-
-When a library of service accounts has been created, view their status at any time to see if they're
-available or checked out.
-
-```shell-session
-$ vault read ldap/library/accounting-team/status
-Key                 Value
----                 -----
-buzz@example.com    map[available:true]
-fizz@example.com    map[available:true]
-```
-
-To check out any service account that's available, simply execute:
-
-```shell-session
-$ vault write -f ldap/library/accounting-team/check-out
-Key                     Value
----                     -----
-lease_id                ldap/library/accounting-team/check-out/EpuS8cX7uEsDzOwW9kkKOyGW
-lease_duration          10h
-lease_renewable         true
-password                ?@09AZKh03hBORZPJcTDgLfntlHqxLy29tcQjPVThzuwWAx/Twx4a2ZcRQRqrZ1w
-service_account_name    fizz@example.com
-```
-
-If the default `ttl` for the check-out is higher than needed, set the check-out to last
-for a shorter time by using:
-
-```shell-session
-$ vault write ldap/library/accounting-team/check-out ttl=30m
-Key                     Value
----                     -----
-lease_id                ldap/library/accounting-team/check-out/gMonJ2jB6kYs6d3Vw37WFDCY
-lease_duration          30m
-lease_renewable         true
-password                ?@09AZerLLuJfEMbRqP+3yfQYDSq6laP48TCJRBJaJu/kDKLsq9WxL9szVAvL/E1
-service_account_name    buzz@example.com
-```
-
-This can be a nice way to say, "Although I _can_ have a check-out for 24 hours, if I
-haven't checked it in after 30 minutes, I forgot or I'm a dead instance, so you can just
-check it back in."
-
-If no service accounts are available for check-out, Vault will return a 400 Bad Request.
-
-```shell-session
-$ vault write -f ldap/library/accounting-team/check-out
-Error writing data to ldap/library/accounting-team/check-out: Error making API request.
-
-URL: POST http://localhost:8200/v1/ldap/library/accounting-team/check-out
-Code: 400. Errors:
-
-* No service accounts available for check-out.
-```
-
-To extend a check-out, renew its lease.
-
-```shell-session
-$ vault lease renew ldap/library/accounting-team/check-out/0C2wmeaDmsToVFc0zDiX9cMq
-Key                Value
----                -----
-lease_id           ldap/library/accounting-team/check-out/0C2wmeaDmsToVFc0zDiX9cMq
-lease_duration     10h
-lease_renewable    true
-```
-
-Renewing a check-out means its current password will live longer, since passwords are rotated
-anytime a password is _checked in_ either by a caller, or by Vault because the check-out `ttl`
-ends.
-
-To check a service account back in for others to use, call:
-
-```shell-session
-$ vault write -f ldap/library/accounting-team/check-in
-Key          Value
----          -----
-check_ins    [fizz@example.com]
-```
-
-Most of the time this will just work, but if multiple service accounts are checked out by the same
-caller, Vault will need to know which one(s) to check in.
-
-```shell-session
-$ vault write ldap/library/accounting-team/check-in service_account_names=fizz@example.com
-Key          Value
----          -----
-check_ins    [fizz@example.com]
-```
-
-To perform a check-in, Vault verifies that the caller _should_ be able to check in a given service account.
-To do this, Vault looks for either the same [entity ID](/vault/tutorials/auth-methods/identity)
-used to check out the service account, or the same client token.
-
-If a caller is unable to check in a service account, or simply doesn't try,
-Vault will check it back in automatically when the `ttl` expires. However, if that is too long,
-service accounts can be forcibly checked in by a highly privileged user through:
-
-```shell-session
-$ vault write -f ldap/library/manage/accounting-team/check-in
-Key          Value
----          -----
-check_ins    [fizz@example.com]
-```
-
-Or, alternatively, revoking the secret's lease has the same effect.
-
-```shell-session
-$ vault lease revoke ldap/library/accounting-team/check-out/PvBVG0m7pEg2940Cb3Jw3KpJ
-All revocation operations queued successfully!
-```
-
-## Password generation
-
-This engine previously allowed configuration of the length of the password that is generated
-when rotating credentials. This mechanism was deprecated in Vault 1.5 in favor of
-[password policies](/vault/docs/concepts/password-policies). This means the `length` field should
-no longer be used. The following password policy can be used to mirror the same behavior
-that the `length` field provides:
-
-```hcl
-length=<length>
-rule "charset" {
-  charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
-}
-```
-
-## LDAP password policy
-
-The LDAP secret engine does not hash or encrypt passwords prior to modifying
-values in LDAP. This behavior can cause plaintext passwords to be stored in LDAP.
-
-To avoid having plaintext passwords stored, the LDAP server should be configured
-with an LDAP password policy (ppolicy, not to be confused with a Vault password
-policy). A ppolicy can enforce rules such as hashing plaintext passwords by default.
-
-The following is an example of an LDAP password policy to enforce hashing on the
-data information tree (DIT) `dc=hashicorp,dc=com`:
-
-```
-dn: cn=module{0},cn=config
-changetype: modify
-add: olcModuleLoad
-olcModuleLoad: ppolicy
-
-dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config
-changetype: add
-objectClass: olcPPolicyConfig
-objectClass: olcOverlayConfig
-olcOverlay: {2}ppolicy
-olcPPolicyDefault: cn=default,ou=pwpolicies,dc=hashicorp,dc=com
-olcPPolicyForwardUpdates: FALSE
-olcPPolicyHashCleartext: TRUE
-olcPPolicyUseLockout: TRUE
-```
-
-## Tutorial
-
-Refer to the [LDAP Secrets Engine](/vault/tutorials/secrets-management/openldap)
-tutorial to learn how to configure and use the LDAP secrets engine.
-
-
-## API
-
-The LDAP secrets engine has a full HTTP API. Please see the [LDAP secrets engine API docs](/vault/api-docs/secret/ldap)
-for more details.
diff --git a/website/content/docs/secrets/mongodbatlas.mdx b/website/content/docs/secrets/mongodbatlas.mdx
deleted file mode 100644
index 72cfab38c97..00000000000
--- a/website/content/docs/secrets/mongodbatlas.mdx
+++ /dev/null
@@ -1,200 +0,0 @@
----
-layout: docs
-page_title: MongoDB Atlas - Secrets Engines
-description: |-
-  The MongoDB Atlas Secrets Engine for Vault generates MongoDB Atlas
-  Programmatic API Keys dynamically.
----
-
-# MongoDB atlas secrets engine
-
-The MongoDB Atlas Secrets Engine generates Programmatic API keys. The created MongoDB Atlas secrets are
-time-based and are automatically revoked when the Vault lease expires, unless renewed.
-
-Vault will create a Programmatic API key for each lease that provide appropriate access to the defined MongoDB Atlas
-project or organization with appropriate role(s). The MongoDB Atlas Programmatic API Key Public and
-Private Keys are returned to the caller. To learn more about Programmatic API Keys visit the
-[Programmatic API Keys Doc](https://docs.atlas.mongodb.com/reference/api-docs/apiKeys/).
-
-  <Note>
-
-  The information below relates to the **MongoDB Altas secrets engine**. Refer to the
-  [MongoDB Atlas **database** secrets engine](/vault/docs/secrets/databases/mongodbatlas)
-  for information about using the MongoDB Atlas database plugin for the Vault
-  database secrets engine.
-
-  </Note>
-
-## Setup
-
-Most Secrets Engines must be configured in advance before they can perform their functions. These
-steps are usually completed by an operator or configuration management tool.
-
-1. Enable the MongoDB Atlas Secrets Engine:
-
-   ```bash
-   $ vault secrets enable mongodbatlas
-   Success! Enabled the mongodbatlas Secrets Engine at: mongodbatlas/
-   ```
-
-   By default, the Secrets Engine will mount at the name of the engine. To
-   enable the Secrets Engine at a different path, use the `-path` argument.
-
-1. It's necessary to generate and configure a MongoDB Atlas Programmatic API Key for your organization
-   or project that has sufficient permissions to allow Vault to create other Programmatic API Keys.
-
-   In order to grant Vault programmatic access to an organization or project using only the
-   [API](https://docs.atlas.mongodb.com/api-docs/) you need to create a MongoDB Atlas Programmatic API
-   Key with the appropriate roles if you have not already done so. A Programmatic API Key consists
-   of a public and private key, so ensure you have both. Regarding roles, the Organization Owner and
-   Project Owner roles should be sufficient for most needs, however be sure to check what each role
-   grants in the [MongoDB Atlas Programmatic API Key User Roles documentation](https://docs.atlas.mongodb.com/reference/user-roles/).
-   It is recommended to set an IP Network Access list when creating the key.
-
-   For more detailed instructions on how to create a Programmatic API Key in the Atlas UI, including
-   available roles, visit the [Programmatic API Key documentation](https://docs.atlas.mongodb.com/configure-api-access/#programmatic-api-keys).
-
-1. Once you have a MongoDB Atlas Programmatic Key pair, as created in the previous step, Vault can now
-   be configured to use it with MongoDB Atlas:
-
-   ```bash
-   $ vault write mongodbatlas/config \
-       public_key=yhltsvan \
-       private_key=2c130c23-e6b6-4da8-a93f-a8bf33218830
-   ```
-
-   Internally, Vault will connect to MongoDB Atlas using these credentials. As such,
-   these credentials must be a superset of any policies which might be granted
-   on API Keys.
-
-~> **Note:** It is highly recommended to _not_ use your MongoDB Atlas root account credentials.
-Generate a dedicated Programmatic API key with appropriate roles instead.
-
-## Programmatic API keys
-
-Programmatic API Key credential types use a Vault role to generate a Programmatic API Key at
-either the MongoDB Atlas Organization or Project level with the designated role(s) for programmatic access.
-
-Programmatic API Keys:
-
-- Have two parts, a public key and a private key
-- Cannot be used to log into Atlas through the user interface
-- Must be granted appropriate roles to complete required tasks
-- Must belong to one organization, but may be granted access to any number of
-  projects in that organization.
-- May have an IP Network Access list configured and some capabilities may require a
-  Network Access list to be configured (these are noted in the MongoDB Atlas API
-  documentation).
-
-Create a Vault role for a MongoDB Atlas Programmatic API Key by mapping appropriate arguments to the
-organization or project designated:
-
-- Organization API Key: Set `organization_id` argument with the appropriate
-  [Organization Level Roles](https://docs.atlas.mongodb.com/reference/user-roles/#organization-roles).
-- Project API Key: Set `project_id` with the appropriate [Project Level Roles](https://docs.atlas.mongodb.com/reference/user-roles/#project-roles).
-
-~> **Note:** Programmatic API keys can belong to only one Organization but can belong to one or more Projects.
-
-Examples:
-
-```shell-session
-$ vault write mongodbatlas/roles/test \
-    organization_id=5b23ff2f96e82130d0aaec13 \
-    roles=ORG_MEMBER
-```
-
-```shell-session
-$ vault write mongodbatlas/roles/test \
-    project_id=5cf5a45a9ccf6400e60981b6 \
-    roles=GROUP_DATA_ACCESS_READ_ONLY
-```
-
-## Programmatic API key network access list
-
-~> **Note:** MongoDB Atlas has deprecated whitelists, and the API will be disabled in June 2021. It is replaced by a
-similar access list API which is live now. If you specify CIDR blocks or IP addresses to allow, you need to run **Vault
-1.6.3 or greater** to avoid interruption. See [MongoDB Atlas documentation](https://docs.atlas.mongodb.com/reference/api-docs/access-lists/)
-for further details.
-
-Programmatic API Key access can and should be limited with a IP Network Access list. In the following example both a CIDR
-block and IP address are added to the IP Network Access list for Keys generated with this Vault role:
-
-```bash
-  $ vault write atlas/roles/test \
-      project_id=5cf5a45a9ccf6400e60981b6 \
-      roles=GROUP_CLUSTER_MANAGER \
-      cidr_blocks=192.168.1.3/32 \
-      ip_addresses=192.168.1.3
-```
-
-Verify the created Programmatic API Key Vault role has the added CIDR block and IP address by running:
-
-```bash
-  $ vault read atlas/roles/test
-
-    Key                       Value
-    ---                       -----
-    cidr_blocks               [192.168.1.3/32]
-    ip_addresses              [192.168.1.3]
-    max_ttl                   1h
-    organization_id           n/a
-    roles                     [GROUP_CLUSTER_MANAGER]
-    project_id                5cf5a45a9ccf6400e60981b6
-    roles                     n/a
-    ttl                       30m
-```
-
-## TTL and max TTL
-
-Programmatic API Keys Vault have a time-to-live (TTL) and maximum time-to-live (Max TTL).
-When a credential expires it's automatically revoked. You can set the TTL and Max TTL for each role
-or by tuning the secrets engine's configuration.
-
-The following creates a Vault role "test" for a Project level Programmatic API key with a 2 hour time-to-live and a
-max time-to-live of 5 hours.
-
-```shell-session
-$ vault write mongodbatlas/roles/test \
-    project_id=5cf5a45a9ccf6400e60981b6 \
-    roles=GROUP_DATA_ACCESS_READ_ONLY \
-    ttl=2h \
-    max_ttl=5h
-```
-
-You can verify the role that you have created with:
-
-```shell-session
-$ vault read mongodbatlas/roles/test
-
-    Key                       Value
-    ---                       -----
-    organization_id           5b71ff2f96e82120d0aaec14
-    roles                     [GROUP_DATA_ACCESS_READ_ONLY]
-    project_id                5cf5a45a9ccf6400e60981b6
-    roles                     n/a
-    ttl                       2h0m0s
-    max_ttl                   5h0m0s
-```
-
-## Generating credentials
-
-After a user has authenticated to Vault has has sufficient permissions, a read request to the
-`creds` endpoint for the role will generate and return new Programmatic API Keys:
-
-```shell-session
-$ vault read mongodbatlas/creds/test
-
-    Key                Value
-    ---                -----
-    lease_id           mongodbatlas/creds/test/0fLBv1c2YDzPlJB1PwsRRKHR
-    lease_duration     2h
-    lease_renewable    true
-    description        vault-test-1563980947-1318
-    private_key        905ae89e-6ee8-40rd-ab12-613t8e3fe836
-    public_key         klpruxce
-```
-
-## API
-
-The MongoDB Atlas secrets engine has a full HTTP API. Please see the
-[MongoDB Atlas secrets engine API docs](/vault/api-docs/secret/mongodbatlas) for more details.
diff --git a/website/content/docs/secrets/nomad.mdx b/website/content/docs/secrets/nomad.mdx
deleted file mode 100644
index e5bf452bcb9..00000000000
--- a/website/content/docs/secrets/nomad.mdx
+++ /dev/null
@@ -1,123 +0,0 @@
----
-layout: docs
-page_title: Nomad Secrets Engine
-description: The Nomad secrets engine for Vault generates tokens for Nomad dynamically.
----
-
-# Nomad secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
-Name: `Nomad`
-
-Nomad is a simple, flexible scheduler and workload orchestrator. The Nomad secrets engine for Vault generates [Nomad](https://www.nomadproject.io/)
-ACL tokens dynamically based on pre-existing Nomad ACL policies.
-
-This page will show a quick start for this secrets engine. For detailed documentation
-on every path, use `vault path-help` after mounting the secrets engine.
-
-~> **Version information** ACLs are only available on Nomad 0.7.0 and above.
-
-## Quick start
-
-The first step to using the Vault secrets engine is to enable it.
-
-```shell-session
-$ vault secrets enable nomad
-Successfully mounted 'nomad' at 'nomad'!
-```
-
-Optionally, we can configure the lease settings for credentials generated
-by Vault. This is done by writing to the `config/lease` key:
-
-```shell-session
-$ vault write nomad/config/lease ttl=3600 max_ttl=86400
-Success! Data written to: nomad/config/lease
-```
-
-For a quick start, you can use the SecretID token provided by the [Nomad ACL bootstrap
-process](/nomad/tutorials/access-control#generate-the-initial-token), although this
-is discouraged for production deployments.
-
-```shell-session
-$ nomad acl bootstrap
-Accessor ID  = 95a0ee55-eaa6-2c0a-a900-ed94c156754e
-Secret ID    = c25b6ca0-ea4e-000f-807a-fd03fcab6e3c
-Name         = Bootstrap Token
-Type         = management
-Global       = true
-Policies     = n/a
-Create Time  = 2017-09-20 19:40:36.527512364 +0000 UTC
-Create Index = 7
-Modify Index = 7
-```
-
-The suggested pattern is to generate a token specifically for Vault, following the
-[Nomad ACL guide](/nomad/tutorials/access-control)
-
-Next, we must configure Vault to know how to contact Nomad.
-This is done by writing the access information:
-
-```shell-session
-$ vault write nomad/config/access \
-    address=http://127.0.0.1:4646 \
-    token=adf4238a-882b-9ddc-4a9d-5b6758e4159e
-Success! Data written to: nomad/config/access
-```
-
-In this case, we've configured Vault to connect to Nomad
-on the default port with the loopback address. We've also provided
-an ACL token to use with the `token` parameter. Vault must have a management
-type token so that it can create and revoke ACL tokens.
-
-The next step is to configure a role. A role is a logical name that maps
-to a set of policy names used to generate those credentials. For example, let's create
-a "monitoring" role that maps to a "readonly" policy:
-
-```shell-session
-$ vault write nomad/role/monitoring policies=readonly
-Success! Data written to: nomad/role/monitoring
-```
-
-The secrets engine expects either a single or a comma separated list of policy names.
-
-To generate a new Nomad ACL token, we simply read from that role:
-
-```shell-session
-$ vault read nomad/creds/monitoring
-Key              Value
----              -----
-lease_id         nomad/creds/monitoring/78ec3ef3-c806-1022-4aa8-1dbae39c760c
-lease_duration   768h0m0s
-lease_renewable  true
-accessor_id      a715994d-f5fd-1194-73df-ae9dad616307
-secret_id        b31fb56c-0936-5428-8c5f-ed010431aba9
-```
-
-Here we can see that Vault has generated a new Nomad ACL token for us.
-We can test this token out, by reading it in Nomad (by it's accessor):
-
-```shell-session
-$ nomad acl token info a715994d-f5fd-1194-73df-ae9dad616307
-Accessor ID  = a715994d-f5fd-1194-73df-ae9dad616307
-Secret ID    = b31fb56c-0936-5428-8c5f-ed010431aba9
-Name         = Vault example root 1505945527022465593
-Type         = client
-Global       = false
-Policies     = [readonly]
-Create Time  = 2017-09-20 22:12:07.023455379 +0000 UTC
-Create Index = 138
-Modify Index = 138
-```
-
-## Tutorial
-
-Refer to [Generate Nomad Tokens with HashiCorp
-Vault](/nomad/tutorials/integrate-vault/vault-nomad-secrets) for a
-step-by-step tutorial.
-
-## API
-
-The Nomad secrets engine has a full HTTP API. Please see the
-[Nomad Secrets Engine API](/vault/api-docs/secret/nomad) for more
-details.
diff --git a/website/content/docs/secrets/pki/cieps.mdx b/website/content/docs/secrets/pki/cieps.mdx
deleted file mode 100644
index d3685dc64a8..00000000000
--- a/website/content/docs/secrets/pki/cieps.mdx
+++ /dev/null
@@ -1,314 +0,0 @@
----
-layout: docs
-page_title: Certificate Issuance External Policy (CIEPS) | PKI - Secrets Engines
-description: An overview of the Certificate Issuance External Policy (CIEPS) protocol
----
-
-# PKI secrets engine - Certificate Issuance External Policy Service (CIEPS) <EnterpriseAlert inline="true" />
-
-This document covers high-level architecture and service APIs used by the
-Vault PKI Secrets Engine when communicating with the Certificate Issuance
-External Policy Service (CIEPS) <EnterpriseAlert inline="true" />.
-
-## What is Certificate Issuance External Policy Service (CIEPS)?
-
-Hashicorp Vault's PKI Secrets Engine has a mechanism for issuing leaf
-certificates with arbitrary structure: [`/pki/sign-verbatim`](/vault/api-docs/secret/pki#sign-verbatim).
-This requires an organization to run an application/user-accessible service
-for authenticating, authorizing, and validating certificate issuance requests
-(potentially handling key pair generation as well), before asking PKI to sign
-the resulting CSR and leaf certificate with its own highly-privileged Vault
-token. If any attribute is missing from the original requester's CSR, the
-original service must reject the request as `sign-verbatim` does not give the
-controlling service the ability to modify the request.
-
-The Certificate Issuance External Policy Service (CIEPS) <EnterpriseAlert inline="true" />
-protocol solves this by placing the validation and certificate templating
-gated behind the PKI, solving:
-
- 1. **Auditing**, so the original requester is still identified and both the
-    original request and subsequent response are tracked.
- 2. **Central access**, so applications only need to use a new URL for
-    requesting certificates.
- 3. **Certificate modification**, so customization of the requester's
-    submission can be exposed to this external service.
- 4. **External validation**, when compared to the Role-based system, as the
-    CIEPS implementation can reach out to customer-defined external systems
-    for validation.
-
-Either of these two mechanisms allow an organization to leverage the Vault
-PKI Secrets Engine to build their own flexible issuance control architecture,
-leveraging Vault as a PKI-as-a-Service platform. However, CIEPS grants far
-greater control to the organization than the `sign-verbatim` approach.
-
-### Custom policy with `sign-verbatim`
-
-With `sign-verbatim`, the policy validation service must sit in front of
-Vault, processing requests from the user (which cannot use Vault
-authentication and needs to authenticate themselves separately to this
-service). This RA service then handles its own authentication to Vault,
-which provides the signing capabilities via the PKI plugin.
-
-When the application retains control over its own key material by providing
-a CSR, the policy service cannot modify the requested CSR and thus cannot
-modify the resulting certificate. It can only approve or deny requests
-without allowing operators to hide implementation details from calling
-applications. This is because PKI's `sign-verbatim` endpoint lacks the
-ability for the Vault API caller (in this case, the fronting policy service)
-to modify the certificate independent of the provided CSR.
-
-If, however, the policy service can control key material (and this is an
-acceptable risk to the organization), the policy service could modify requests
-on behalf of the calling application. However, this still requires the
-external application to know how to authenticate to this external policy
-service.
-
-Additionally, to ensure compatibility with Vault, this policy service (and its
-developers) would need to add support for the ACME protocol. For any new
-protocols Vault supports in the future, this service would also need to
-implement support to retain compatibility.
-
-### Custom policy with Certificate Issuance External Policy Service (CIEPS)
-
-With CIEPS, users still authenticate to Vault and use the normal request
-workflow to sign and issue certificates, including via ACME. However,
-Vault's PKI Engine reaches out to the configured CIEPS implementation to
-validate and template the requested certificate, transparently from the
-calling application.
-
-Notably, the application can opt to either retain full control over its key
-material or delegate key creation to the trusted Vault service, with no impact
-on the functionality CIEPS can provide. The CIEPS service can be scoped to
-respond to requests from either a single PKI mount or multiple, getting
-information about the requesting user and the Vault PKI instance from the
-CIEPS messages.
-
-Because the CIEPS service only needs knowledge of validating requests and
-templating the final certificate structure, its developers need only be
-concerned with the business policy logic and not broader PKI concerns (such
-as generating key material or re-implementing support for other issuance
-protocols).
-
-## Certificate Issuance External Policy Service (CIEPS) webhook format
-
-The CIEPS protocol is a REST-based, optionally mTLS protected webhook. The
-external service configuration specifies the single URL that Vault will POST
-the formatted CIEPS request to. When the CIEPS service is unavailable (either
-due to misconfiguration or outage), Vault will reject the request and it is
-up to the client to retry the request at a later time.
-
-For convenience, Go versions of these structs are available [from the Vault
-SDK](https://github.com/hashicorp/vault/blob/main/sdk/helper/certutil/cieps.go).
-
-### Vault to CIEPS request format
-
-This document outlines CIEPS request/response version 1.
-
-Using the `application/json` content type, Vault will post the following
-request body as a JSON object:
-
- - `request_version` `(int: 1)` - The version of the CIEPS request sent by
-   Vault; a compatible response format is expected.
-
- - `request_uuid` `(string)` - A random UUID which serves to identify this
-   request. This value must be sent in the response.
-
- - `synchronous` `(bool: true)` - A boolean indicating whether the request is
-   synchronous or not. Presently set to true; no asynchronous response is
-   understood.
-
- - `user_request_key_values` `(map[string]interface{})` - The unvalidated
-   request parameters sent by the user. It is up to the CIEPS service to
-   validate these prior to using them. The following fields may be present,
-   including any other fields submitted by the user:
-
-   - `csr` `(string)` - A PEM format CSR submitted either by the client (
-     in the case of `/sign` or ACME requests) or on the client's behalf
-     (in the case of `/issue` requests, where key material is generated
-     by Vault).
-
- - `identity_request_key_values` `(map[string]interface{})` - Values related
-   to the user's identity. When the request type is ACME, this value is not
-   populated. These are:
-
-   - `entity_id` `(string)` - The entity identifier from the request after
-     authentication.
-
-   - `entity` `(map[string]interface{})` - The entire resolved `logical.Entity`
-     of the user after authentication; subject to change by the
-     `entity_jmsepath` parameter in the configuration.
-
-   - `groups` `([]map[string]interface{})` - The set of resolved
-     `logical.Groups` of the user after authentication; subject to change by
-     the `group_jmsepath` parameter in the configuration.
-
-   ~> **Note**: in the event that the direct token backend or a root token is
-      used, entity information may not exist. In either case,
-      `identity_request_key_values` will be omitted.
-
- - `acme_request_key_values` `(map[string]interface{})` - Values related to
-   ACME authorizations challenges attached to the finished order. Only present
-   when the request type is ACME. These are:
-
-   - `authorizations` `(map[string]interface{})` - Authorizations and
-     challenges solved by the client to move this order to the finalization
-     state.
-
-   - `account` `(map[string]interface{})` - Information related to the ACME
-     account issuing the request. These are:
-
-     - `id` `(string)` - The UUID of the ACME account.
-
-     - `directory` `(string)` - The path to the ACME directory requested by
-       this account.
-
-     - `contact` `([]string)` - Unverified contact information submitted by
-       the requesting ACME account on creation.
-
-     - `created_date` `(string: RFC 3999 format)` - Timestamp when the account
-       was created.
-
-     - `eab` `(map[string]interface{}, optional)` - When present, the details
-       of the EAB used to authorize this account via Vault authentication. If
-       not present, this ACME account was created without EAB bindings.
-
-       - `key_id` `(string)` - Identifier of the EAB binding used by this
-         account.
-
-       - `key_type` `(string)` - Key type of the EAB binding used by this
-         account.
-
-       - `created_date` `(string: RFC 3999 format)` - Timestamp when the
-         account was created.
-
- - `vault_request_values` `(map[string]interface{})` - Request value validated
-   or created by Vault. These have higher trust than the unvalidated
-   `user_request_key_values`. These are:
-
-   - `policy_name` `(string: "")` - The optional policy name specified by the
-     requester. When the issuance mode is not ACME (or if it was ACME and EAB
-     was enforced), this has been validated by Vault's ACL system.
-
-   - `mount` `(string)` - The request's mount path as known by the PKI plugin.
-
-   - `namespace` `(string)` - The request's namespace the mount path exists
-     within as known by the PKI plugin.
-
-   - `vault_is_performance_standby` `(bool)` - Asserted when this requesting
-     node is a standby node. When the service indicates storage is required in
-     its response, Vault will forward the user's HTTP request up to an active
-     node, requiring it to re-submit the CIEPS request. In this case, if the
-     service knows it must always store certificates and sees a request from
-     a standby node, it can skip policy and template evaluation or cache the
-     results for a second pass.
-
-   - `vault_is_performance_secondary` `(bool)` - Asserted when this requesting
-      node is from a performance secondary versus the primary cluster.
-
-   - `issuance_mode` `(string: "sign", "issue", "ica", or "acme")` - The type
-     of the request: whether a REST call to `/external-policy/sign(/:policy)`,
-     to `/external-policy/issue(/:policy)`, `/external-policy/sign-intermediate(/:policy)`,
-     or an ACME request, respectively.
-
-   - `vault_generated_private_key` `(bool)` - Whether or not Vault generated
-     the key material behind this request. Set to true when
-     `issuance_mode="issue"` only presently.
-
-   - `requested_issuer_name` `(string)` - Name of the user's requested issuer;
-     can be changed by modifying the response `issuer_ref` value.
-
-   - `requested_issuer_id` `(string)` - UUID of the user's requested issuer;
-     can be changed by modifying the response `issuer_ref` value.
-
-   - `requested_issuer_cert` `(string)` - PEM format certificate of the user's
-     requested issuer; can be changed by modifying the response `issuer_ref`
-     value.
-
-   - `requested_issuance_config` `(map[string]interface{})` - Configuration
-     used for leaf certificate issuance. These are:
-
-     - `aia_values` `(map[string]interface{})` - AIA values (CA, CRL, and
-       OCSP) for the suggested issuer. These may differ from the actual values
-       used for issuance of this request if `issuer_ref` is set on the response.
-
-     - `leaf_not_after_behavior` `(string: "err", "truncate", or "permit")` - leaf
-       validity period behavior for the suggested issuer.
-
-     - `mount_default_ttl` `(string)` - Suggested default TTL set on mount tuning.
-
-     - `mount_max_ttl` `(string)` - Suggested maximum TTL set on the mount tuning.
-
-### CIEPS to Vault response format
-
-The CIEPS engine must reply to this POST response with a `200 OK` status,
-regardless of whether a certificate should be issued or not. Redirects will
-not be followed by Vault; any proxy or load balancing functionality should be
-strictly transparent to the caller. Any verbatim message returned by a non-200
-status code will not be returned, either in Vault server logs or to the user.
-
-In the response to the above request, only one of the `certificate` or `error`
-fields should be specified. In the event both `certificate` and `error` are
-present, the `error` will be appended to the returned `warnings` and the
-`certificate` will be issued.
-
-Using the `application/json` content type, the server should reply with the
-following JSON object:
-
- - `request_uuid` `(string)` - The random UUID which the server used to
-   identify this request.
-
- - `error` `(string, optional)` - The error message to be returned to the
-   user about why their request failed. Only one of the `error` or
-   `certificate` response parameters should be specified.
-
- - `warnings` `([]string, optional)` - Optional warnings to be returned to the user
-   about minor issues with their request.
-
- - `certificate` `(string, optional)` - A PEM format certificate to be signed
-   by the Vault service. Only one of the `error` or `certificate` response
-   parameters should be specified.
-
- - `issuer_ref` `(string)` - The issuer reference to use to sign this request.
-   If the user's issuer choice (in `requested_issuer_id`) is OK, this must
-   be set in this field.
-
- - `store_certificate` `(bool: false)` - Whether or not to store the signed
-   certificate.
-
- - `generate_lease` `(bool: false)` - Whether or not Vault should generate an
-   associated lease for the certificate. Note that to generate a lease,
-   `store_certificate` also needs to be set to `true`, otherwise no lease
-   will be generated.
-
-The certificate's signature will be ignored and replaced by a signature created
-by the specified issuer. If a signature algorithm compatible with this issuer
-is specified on the certificate, it will be preserved; otherwise, the default
-signature algorithm for this issuer's key type will be used.
-
-The certificate's AIA information will be replaced by the information from the
-specified issuer, if present, else the global AIA URLs will be set, replacing
-the AIA URIs and CRL distribution point extensions. Additionally, the
-Authority Key Identifier extension will be replaced by the issuer's Subject
-Key Identifier extension value as mandated by RFC 5280.
-
-## Tutorial
-
-Refer to the following tutorials for PKI secrets engine usage examples:
-
-- [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
-- [Build Certificate Authority (CA) in Vault with an offline Root](/vault/tutorials/secrets-management/pki-engine-external-ca)
-- [Enable ACME with PKI secrets engine](/vault/tutorials/secrets-management/pki-acme-caddy)
-- [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
-- [PKI Unified CRL and OCSP With Cross Cluster
-  Revocation](/vault/tutorials/secrets-management/pki-unified-crl-ocsp-cross-cluster)
-- [Configure Vault as a Certificate Manager in Kubernetes with
-  Helm](/vault/tutorials/kubernetes/kubernetes-cert-manager)
-- [Generate mTLS Certificates for Nomad using
-  Vault](/vault/tutorials/secrets-management/vault-pki-nomad)
-
-
-## API
-
-The PKI secrets engine has a full HTTP API. Please see the
-[PKI secrets engine API](/vault/api-docs/secret/pki) for more
-details.
diff --git a/website/content/docs/secrets/pki/considerations.mdx b/website/content/docs/secrets/pki/considerations.mdx
deleted file mode 100644
index 5227765d0c9..00000000000
--- a/website/content/docs/secrets/pki/considerations.mdx
+++ /dev/null
@@ -1,1018 +0,0 @@
----
-layout: docs
-page_title: 'PKI - Secrets Engines: Considerations'
-description: The PKI secrets engine for Vault generates TLS certificates.
----
-
-# PKI secrets engine - considerations
-
-To successfully deploy this secrets engine, there are a number of important
-considerations to be aware of, as well as some preparatory steps that should be
-undertaken. You should read all of these _before_ using this secrets engine or
-generating the CA to use with this secrets engine.
-
-## Table of contents
-
- - [Be Careful with Root CAs](#be-careful-with-root-cas)
-   - [Managed Keys](#managed-keys)
- - [One CA Certificate, One Secrets Engine](#one-ca-certificate-one-secrets-engine)
-   - [Always Configure a Default Issuer](#always-configure-a-default-issuer)
- - [Key Types Matter](#key-types-matter)
-   - [Cluster Performance and Key Types](#cluster-performance-and-key-types)
- - [Use a CA Hierarchy](#use-a-ca-hierarchy)
-   - [Cross-Signed Intermediates](#cross-signed-intermediates)
- - [Cluster URLs are Important](#cluster-urls-are-important)
- - [Automate Rotation with ACME](#automate-rotation-with-acme)
-   - [ACME Stores Certificates](#acme-stores-certificates)
-   - [ACME Role Restrictions Require EAB](#acme-role-restrictions-require-eab)
-   - [ACME and the Public Internet](#acme-and-the-public-internet)
-   - [ACME Errors are in Server Logs](#acme-errors-are-in-server-logs)
-   - [ACME Security Considerations](#acme-security-considerations)
-   - [ACME and Client Counting](#acme-and-client-counting)
- - [Keep Certificate Lifetimes Short, For CRL's Sake](#keep-certificate-lifetimes-short-for-crls-sake)
-   - [NotAfter Behavior on Leaf Certificates](#notafter-behavior-on-leaf-certificates)
-   - [Cluster Performance and Quantity of Leaf Certificates](#cluster-performance-and-quantity-of-leaf-certificates)
- - [You must configure issuing/CRL/OCSP information _in advance_](#you-must-configure-issuingcrlocsp-information-_in-advance_)
- - [Distribution of CRLs and OCSP](#distribution-of-crls-ocsp)
- - [Automate CRL Building and Tidying](#automate-crl-building-and-tidying)
- - [Spectrum of Revocation Support](#spectrum-of-revocation-support)
-   - [What Are Cross-Cluster CRLs?](#what-are-cross-cluster-crls)
- - [Issuer Subjects and CRLs](#issuer-subjects-and-crls)
- - [Automate Leaf Certificate Renewal](#automate-leaf-certificate-renewal)
- - [Safe Minimums](#safe-minimums)
- - [Token Lifetimes and Revocation](#token-lifetimes-and-revocation)
- - [Safe Usage of Roles](#safe-usage-of-roles)
- - [Telemetry](#telemetry)
- - [Auditing](#auditing)
- - [Role-Based Access](#role-based-access)
- - [Replicated DataSets](#replicated-datasets)
- - [Cluster Scalability](#cluster-scalability)
- - [PSS Support](#pss-support)
- - [Issuer Storage Migration Issues](#issuer-storage-migration-issues)
-
-## Be careful with root CAs
-
-Vault storage is secure, but not as secure as a piece of paper in a bank vault.
-It is, after all, networked software. If your root CA is hosted outside of
-Vault, don't put it in Vault as well; instead, issue a shorter-lived
-intermediate CA certificate and put this into Vault. This aligns with industry
-best practices.
-
-Since 0.4, the secrets engine supports generating self-signed root CAs and
-creating and signing CSRs for intermediate CAs. In each instance, for security
-reasons, the private key can _only_ be exported at generation time, and the
-ability to do so is part of the command path (so it can be put into ACL
-policies).
-
-If you plan on using intermediate CAs with Vault, it is suggested that you let
-Vault create CSRs and do not export the private key, then sign those with your
-root CA (which may be a second mount of the `pki` secrets engine).
-
-### Managed keys
-
-Since 1.10, Vault Enterprise can access private key material in a
-[_managed key_](/vault/docs/enterprise/managed-keys).  In this case, Vault never sees the
-private key, and the external KMS or HSM performs certificate signing operations.
-Managed keys are configured by selecting the `kms` type when generating a root
-or intermediate.
-
-## One CA certificate, one secrets engine
-
-Since Vault 1.11.0, the PKI Secrets Engine supports multiple issuers in a single
-mount. However, in order to simplify the configuration, it is _strongly_
-recommended that operators limit a mount to a single issuer. If you want to issue
-certificates from multiple disparate CAs, mount the PKI secrets engine at multiple
-mount points with separate CA certificates in each.
-
-The rationale for separating mounts is to simplify permissions management:
-very few individuals need access to perform operations with the root, but
-many need access to create leaves. The operations on a root should generally
-be limited to issuing and revoking intermediate CAs, which is a highly
-privileged operation; it becomes much easier to audit these operations when
-they're in a separate mount than if they're mixed in with day-to-day leaf
-issuance.
-
-A common pattern is to have one mount act as your root CA and to use this CA
-only to sign intermediate CA CSRs from other PKI secrets engines.
-
-To keep old CAs active, there's two approaches to achieving rotation:
-
- 1. Use multiple secrets engines. This allows a fresh start, preserving the
-    old issuer and CRL. Vault ACL policy can be updated to deny new issuance
-    under the old mount point and roles can be re-evaluated before being
-    imported into the new mount point.
- 2. Use multiple issuers in the same mount point. The usage of the old issuer
-    can be restricted to CRL signing, and existing roles and ACL policy can be
-    kept as-is. This allows cross-signing within the same mount, and consumers
-    of the mount won't have to update their configuration. Once the transitional
-    period for this rotation has completed and all past issued certificate have
-    expired, it is encouraged to fully remove the old issuer and any unnecessary
-    cross-signed issuers from the mount point.
-
-Another suggested use case for multiple issuers in the same mount is splitting
-issuance by TTL lifetime. For short-lived certificates, an intermediate
-stored in Vault will often out-perform a HSM-backed intermediate. For
-longer-lived certificates, however, it is often important to have the
-intermediate key material secured throughout the lifetime of the end-entity
-certificate. This means that two intermediates in the same mount -- one backed
-by the HSM and one backed by Vault -- can satisfy both use cases. Operators
-can make roles setting maximum TTLs for each issuer and consumers of the
-mount can decide which to use.
-
-### Always configure a default issuer
-
-For backwards compatibility, [the default issuer](/vault/api-docs/secret/pki#read-issuers-configuration)
-is used to service PKI endpoints without an explicit issuer (either via path
-selection or role-based selection). When certificates are revoked and their
-issuer is no longer part of this PKI mount, Vault places them on the default
-issuer's CRL. This means maintaining a default issuer is important for both
-backwards compatibility for issuing certificates and for ensuring revoked
-certificates land on a CRL.
-
-## Key types matter
-
-Certain key types have impacts on performance. Signing certificates from a RSA
-key will be slower than issuing from an ECDSA or Ed25519 key. Key generation
-(using `/issue/:role` endpoints) using RSA keys will also be slow: RSA key
-generation involves finding suitable random primes, whereas Ed25519 keys can
-be random data. As the number of bits goes up (RSA 2048 -> 4096 or ECDSA
-P-256 -> P-521), signature times also increases.
-
-This matters in both directions: not only is issuance more expensive,
-but validation of the corresponding signature (in say, TLS handshakes) will
-also be more expensive. Careful consideration of both issuer and issued key
-types can have meaningful impacts on performance of not only Vault, but
-systems using these certificates.
-
-### Cluster performance and key type
-
-The [benchmark-vault](https://github.com/hashicorp/vault-benchmark) project
-can be used to measure the performance of a Vault PKI instance. In general,
-some considerations to be aware of:
-
- - RSA key generation is much slower and highly variable than EC key
-   generation. If performance and throughput are a necessity, consider using
-   EC keys (including NIST P-curves and Ed25519) instead of RSA.
-
- - Key signing requests (via `/pki/sign`) will be faster than (`/pki/issue`),
-   especially for RSA keys: this removes the necessity for Vault to generate
-   key material and can sign the key material provided by the client. This
-   signing step is common between both endpoints, so key generation is pure
-   overhead if the client has a sufficiently secure source of entropy.
-
- - The CA's key type matters as well: using a RSA CA will result in a RSA
-   signature and takes longer than a ECDSA or Ed25519 CA.
-
- - Storage is an important factor: with [BYOC Revocation](/vault/api-docs/secret/pki#revoke-certificate),
-   using `no_store=true` still gives you the ability to revoke certificates
-   and audit logs can be used to track issuance. Clusters using a remote
-   storage (like Consul) over a slow network and using `no_store=false` will
-   result in additional latency on issuance. Adding leases for every issued
-   certificate compounds the problem.
-
-    - Storing too many certificates results in longer `LIST /pki/certs` time,
-      including the time to tidy the instance. As such, for large scale
-      deployments (>= 250k active certificates) it is recommended to use audit
-      logs to track certificates outside of Vault.
-
-As a general comparison on unspecified hardware, using `benchmark-vault` for
-`30s` on a local, single node, raft-backed Vault instance:
-
-  - Vault can issue 300k certificates using EC P-256 for CA & leaf keys and
-    without storage.
-
-    - But switching to storing these leaves drops that number to 65k, and only
-      20k with leases.
-
- - Using large, expensive RSA-4096 bit keys, Vault can only issue 160 leaves,
-   regardless of whether or not storage or leases were used. The 95% key
-   generation time is above 10s.
-
-    - In comparison, using P-521 keys, Vault can issue closer to 30k leaves
-      without leases and 18k with leases.
-
-These numbers are for example only, to represent the impact different key types
-can have on PKI cluster performance.
-
-The use of ACME adds additional latency into these numbers, both because
-certificates need to be stored and because challenge validation needs to
-be performed.
-
-## Use a CA hierarchy
-
-It is generally recommended to use a hierarchical CA setup, with a root
-certificate which issues one or more intermediates (based on usage), which
-in turn issue the leaf certificates.
-
-This allows stronger storage or policy guarantees around [protection of the
-root CA](#be-careful-with-root-cas), while letting Vault manage the
-intermediate CAs and issuance of leaves. Different intermediates might be
-issued for different usage, such as VPN signing, Email signing, or testing
-versus production TLS services. This helps to keep CRLs limited to specific
-purposes: for example, VPN services don't care about the revoked set of
-email signing certificates if they're using separate certificates and
-different intermediates, and thus don't need both CRL contents. Additionally,
-this allows higher risk intermediates (such as those issuing longer-lived
-email signing certificates) to have HSM-backing without impacting the
-performance of easier-to-rotate intermediates and certificates (such as
-TLS intermediates).
-
-Vault supports the use of both the [`allowed_domains` parameter on
-Roles](/vault/api-docs/secret/pki#allowed_domains) and the [`permitted_dns_domains`
-parameter to set the Name Constraints extension](/vault/api-docs/secret/pki#permitted_dns_domains)
-on root and intermediate generation. This allows for several layers of
-separation of concerns between TLS-based services.
-
-### Cross-Signed intermediates
-
-When cross-signing intermediates from two separate roots, two separate
-intermediate issuers will exist within the Vault PKI mount. In order to
-correctly serve the cross-signed chain on issuance requests, the
-`manual_chain` override is required on either or both intermediates. This
-can be constructed in the following order:
-
- - this issuer (`self`)
- - this root
- - the other copy of this intermediate
- - the other root
-
-All requests to this issuer for signing will now present the full cross-signed
-chain.
-
-## Cluster URLs are important
-
-In Vault 1.13, support for [templated AIA
-URLs](/vault/api-docs/secret/pki#enable_aia_url_templating-1)
-was added. With the [per-cluster URL
-configuration](/vault/api-docs/secret/pki#set-cluster-configuration) pointing
-to this Performance Replication cluster, AIA information will point to the
-cluster that issued this certificate automatically.
-
-In Vault 1.14, with ACME support, the same configuration is used for allowing
-ACME clients to discover the URL of this cluster.
-
-~> **Warning**: It is important to ensure that this configuration is
-   up to date and maintained correctly, always pointing to the node's
-   PR cluster address (which may be a Load Balanced or a DNS Round-Robbin
-   address). If this configuration is not set on every Performance Replication
-   cluster, certificate issuance (via REST and/or via ACME) will fail.
-
-## Automate rotation with ACME
-
-In Vault 1.14, support for the [Automatic Certificate Management Environment
-(ACME)](https://datatracker.ietf.org/doc/html/rfc8555) protocol has been
-added to the PKI Engine. This is a standardized way to handle validation,
-issuance, rotation, and revocation of server certificates.
-
-Many ecosystems, from web servers like Caddy, Nginx, and Apache, to
-orchestration environments like Kubernetes (via cert-manager) natively
-support issuance via the ACME protocol. For deployments without native
-support, stand-alone tools like certbot support fetching and renewing
-certificates on behalf of consumers. Vault's PKI Engine only includes server
-support for ACME; no client functionality has been included.
-
-~> Note: Vault's PKI ACME server caps the certificate's validity at 90 days
-   maximum, regardless of role and/or global limits. Shorter validity
-   durations can be set via limiting the role's TTL to be under 90 days.
-   Aligning with Let's Encrypt, we do not support the optional `NotBefore`
-   and `NotAfter` order request parameters.
-
-### ACME stores certificates
-
-Because ACME requires stored certificates in order to function, the notes
-[below about automating tidy](#automate-crl-building-and-tidying) are
-especially important for the long-term health of the PKI cluster. ACME also
-introduces additional resource types (accounts, orders, authorizations, and
-challenges) that must be tidied via [the `tidy_acme=true`
-option](/vault/api-docs/secret/pki#tidy). Orders, authorizations, and
-challenges are [cleaned up based on the
-`safety_buffer`](/vault/api-docs/secret/pki#safety_buffer)
-parameter, but accounts can live longer past their last issued certificate
-by controlling the [`acme_account_safety_buffer`
-parameter](/vault/api-docs/secret/pki#acme_account_safety_buffer).
-
-As a consequence of the above, and like the discussions in the [Cluster
-Scalability](#cluster-scalability) section, because these roles have
-`no_store=false` set, ACME can only issue certificates on the active nodes
-of PR clusters; standby nodes, if contacted, will transparently forward
-all requests to the active node.
-
-### ACME role restrictions require EAB
-
-Because ACME by default has no external authorization engine and is
-unauthenticated from a Vault perspective, the use of roles with ACME
-in the default configuration are of limited value as any ACME client
-can request certificates under any role by proving possession of the
-requested certificate identifiers.
-
-To solve this issue, there are two possible approaches:
-
- 1. Use a restrictive [`allowed_roles`, `allowed_issuers`, and
-    `default_directory_policy` ACME
-    configuration](/vault/api-docs/secret/pki#set-acme-configuration)
-    to let only a single role and issuer be used. This prevents user
-    choice, allowing some global restrictions to be placed on issuance
-    and avoids requiring ACME clients to have (at initial setup) access
-    to a Vault token other mechanism for acquiring a Vault EAB ACME token.
- 2. Use a more permissive [configuration with
-    `eab_policy=always-required`](/vault/api-docs/secret/pki#eab_policy)
-    to allow more roles and users to select the roles, but bind ACME clients
-    to a Vault token which can be suitably ACL'd to particular sets of
-    approved ACME directories.
-
-The choice of approach depends on the policies of the organization wishing
-to use ACME.
-
-Another consequence of the Vault unauthenticated nature of ACME requests
-are that role templating, based on entity information, cannot be used as
-there is no token and thus no entity associated with the request, even when
-EAB binding is used.
-
-### ACME and the public internet
-
-Using ACME is possible over the public internet; public CAs like Let's Encrypt
-offer this as a service. Similarly, organizations running internal PKI
-infrastructure might wish to issue server certificates to pieces of
-infrastructure outside of their internal network boundaries, from a publicly
-accessible Vault instance. By default, without enforcing a restrictive
-`eab_policy`, this results in a complicated threat model: _any_ external
-client which can prove possession of a domain can issue a certificate under
-this CA, which might be considered more trusted by this organization.
-
-As such, we strongly recommend publicly facing Vault instances (such as HCP
-Vault) enforce that PKI mount operators have required a [restrictive
-`eab_policy=always-required` configuration](/vault/api-docs/secret/pki#eab_policy).
-System administrators of Vault instances can enforce this by [setting the
-`VAULT_DISABLE_PUBLIC_ACME=true` environment
-variable](/vault/api-docs/secret/pki#acme-external-account-bindings).
-
-### ACME errors are in server logs
-
-Because the ACME client is not necessarily trusted (as account registration
-may not be tied to a valid Vault token when EAB is not used), many error
-messages end up in the Vault server logs out of security necessity. When
-troubleshooting issues with clients requesting certificates, first check
-the client's logs, if any, (e.g., certbot will state the log location on
-errors), and then correlate with Vault server logs to identify the failure
-reason.
-
-### ACME security considerations
-
-ACME allows any client to use Vault to make some sort of external call;
-while the design of ACME attempts to minimize this scope and will prohibit
-issuance if incorrect servers are contacted, it cannot account for all
-possible remote server implementations. Vault's ACME server makes three
-types of requests:
-
- 1. DNS requests for `_acme-challenge.<domain>`, which should be least
-    invasive and most safe.
- 2. TLS ALPN requests for the `acme-tls/1` protocol, which should be
-    safely handled by the TLS before any application code is invoked.
- 3. HTTP requests to `http://<domain>/.well-known/acme-challenge/<token>`,
-    which could be problematic based on server design; if all requests,
-    regardless of path, are treated the same and assumed to be trusted,
-    this could result in Vault being used to make (invalid) requests.
-    Ideally, any such server implementations should be updated to ignore
-    such ACME validation requests or to block access originating from Vault
-    to this service.
-
-In all cases, no information about the response presented by the remote
-server is returned to the ACME client.
-
-When running Vault on multiple networks, note that Vault's ACME server
-places no restrictions on requesting client/destination identifier
-validations paths; a client could use a HTTP challenge to force Vault to
-reach out to a server on a network it could otherwise not access.
-
-### ACME and client counting
-
-In Vault 1.14, ACME contributes differently to usage metrics than other
-interactions with the PKI Secrets Engine. Due to its use of unauthenticated
-requests (which do not generate Vault tokens), it would not be counted in
-the traditional [activity log APIs](/vault/api-docs/system/internal-counters#activity-export).
-Instead, certificates issued via ACME will be counted via their unique
-certificate identifiers (the combination of CN, DNS SANs, and IP SANs).
-These will create a stable identifier that will be consistent across
-renewals, other ACME clients, mounts, and namespaces, contributing to
-the activity log presently as a non-entity token attributed to the first
-mount which created that request.
-
-## Keep certificate lifetimes short, for CRL's sake
-
-This secrets engine aligns with Vault's philosophy of short-lived secrets. As
-such it is not expected that CRLs will grow large; the only place a private key
-is ever returned is to the requesting client (this secrets engine does _not_
-store generated private keys, except for CA certificates). In most cases, if the
-key is lost, the certificate can simply be ignored, as it will expire shortly.
-
-If a certificate must truly be revoked, the normal Vault revocation function can
-be used, and any revocation action will cause the CRL to be regenerated. When
-the CRL is regenerated, any expired certificates are removed from the CRL (and
-any revoked, expired certificate are removed from secrets engine storage). This
-is an expensive operation! Due to the structure of the CRL standard, Vault must
-read **all** revoked certificates into memory in order to rebuild the CRL and
-clients must fetch the regenerated CRL.
-
-This secrets engine does not support multiple CRL endpoints with sliding date
-windows; often such mechanisms will have the transition point a few days apart,
-but this gets into the expected realm of the actual certificate validity periods
-issued from this secrets engine. A good rule of thumb for this secrets engine
-would be to simply not issue certificates with a validity period greater than
-your maximum comfortable CRL lifetime. Alternately, you can control CRL caching
-behavior on the client to ensure that checks happen more often.
-
-Often multiple endpoints are used in case a single CRL endpoint is down so that
-clients don't have to figure out what to do with a lack of response. Run Vault
-in HA mode, and the CRL endpoint should be available even if a particular node
-is down.
-
-~> Note: Since Vault 1.11.0, with multiple issuers in the same mount point,
-   different issuers may have different CRLs (depending on subject and key
-   material). This means that Vault may need to regenerate multiple CRLs.
-   This is again a rationale for keeping TTLs short and avoiding revocation
-   if possible.
-
-~> Note: Since Vault 1.12.0, we support two complementary revocation
-   mechanisms: Delta CRLs, which allow for rebuilds of smaller, incremental
-   additions to the last complete CRL, and OCSP, which allows responding to
-   revocation status requests for individual certificates. When coupled with
-   the new CRL auto-rebuild functionality, this means that the revoking step
-   isn't as costly (as the CRL isn't always rebuilt on each revocation),
-   outside of storage considerations. However, while the rebuild operation
-   still can be expensive with lots of certificates, it will be done on a
-   schedule rather than on demand.
-
-### NotAfter behavior on leaf certificates
-
-In Vault 1.11.0, the PKI Secrets Engine has introduced a new
-`leaf_not_after_behavior` [parameter on
-issuers](/vault/api-docs/secret/pki#leaf_not_after_behavior).
-This allows modification of the issuance behavior: should Vault `err`,
-preventing issuance of a longer-lived leaf cert than issuer, silently
-`truncate` to that of the issuer's `NotAfter` value, or `permit` longer
-expirations.
-
-It is strongly suggested to use `err` or `truncate` for intermediates;
-`permit` is only useful for root certificates, as intermediate's NotAfter
-expiration are checked when validating presented chains.
-
-In combination with a cascading expiration with longer lived roots (perhaps
-on the range of 2-10 years), shorter lived intermediates (perhaps on the
-range of 6 months to 2 years), and short-lived leaf certificates (on the
-range of 30 to 90 days), and the [rotation strategies discussed in other
-sections](/vault/docs/secrets/pki/rotation-primitives), this should keep the
-CRLs adequately small.
-
-### Cluster performance and quantity of leaf certificates
-
-As mentioned above, keeping TTLs short (or using `no_store=true`) and avoiding
-leases is important for a healthy cluster. However it is important to note
-this is a scale problem: 10-1000 long-lived, stored certificates are probably
-fine, but 50k-100k become a problem and 500k+ stored, unexpired certificates
-can negatively impact even large Vault clusters--even with short TTLs!
-
-However, once these certificates are expired, a [tidy operation](/vault/api-docs/secret/pki#tidy)
-will clean up CRLs and Vault cluster storage.
-
-Note that organizational risk assessments for certificate compromise might
-mean certain certificate types should always be issued with `no_store=false`;
-even short-lived broad wildcard certificates (say, `*.example.com`) might be
-important enough to have precise control over revocation. However, an internal
-service with a well-scoped certificate (say, `service.example.com`) might be
-of low enough risk to issue a 90-day TTL with `no_store=true`, preventing
-the need for revocation in the unlikely case of compromise.
-
-Having a shorter TTL decreases the likelihood of needing to revoke a cert
-(but cannot prevent it entirely) and decrease the impact of any such
-compromise.
-
-~> Note: As of Vault 1.12, the PKI Secret Engine's [Bring-Your-Own-Cert
-    (BYOC)](/vault/api-docs/secret/pki#revoke-certificate)
-   functionality allows revocation of certificates not previously stored
-   (e.g., issued via a role with `no_store=true`). This means that setting
-   `no_store=true` _is now_ safe to be used globally, regardless of importance
-   of issued certificates (and their likelihood for revocation).
-
-## You must configure issuing/CRL/OCSP information _in advance_
-
-This secrets engine serves CRLs from a predictable location, but it is not
-possible for the secrets engine to know where it is running. Therefore, you must
-configure desired URLs for the issuing certificate, CRL distribution points, and
-OCSP servers manually using the `config/urls` endpoint. It is supported to have
-more than one of each of these by passing in the multiple URLs as a
-comma-separated string parameter.
-
-~> Note: when using Vault Enterprise's Performance Replication features with a
-   PKI Secrets Engine mount, each cluster will have its own CRL; this means
-   each cluster's unique CRL address should be included in the [AIA
-   information](https://datatracker.ietf.org/doc/html/rfc5280#section-5.2.7)
-   field separately, or the CRLs should be consolidated and served outside of
-   Vault.
-
-~> Note: When using multiple issuers in the same mount, it is suggested to use
-   the per-issuer AIA fields rather than the global (`/config/urls`) variant.
-   This is for correctness: these fields are used for chain building and
-   automatic CRL detection in certain applications. If they point to the wrong
-   issuer's information, these applications may break.
-
-## Distribution of CRLs and OCSP
-
-Both CRLs and OCSP allow interrogating revocation status of certificates. Both
-of these methods include internal security and authenticity (both CRLs and
-OCSP responses are signed by the issuing CA within Vault). This means both are
-fine to distribute over non-secure and non-authenticated channels, such as
-HTTP.
-
-## Automate CRL building and tidying
-
-Since Vault 1.12, the PKI Secrets Engine supports automated CRL rebuilding
-(including optional Delta CRLs which can be built more frequently than
-complete CRLs) via the `/config/crl` endpoint. Additionally, tidying of
-revoked and expired certificates can be configured automatically via the
-`/config/auto-tidy` endpoint. Both of these should be enabled to ensure
-compatibility with the wider PKIX ecosystem and performance of the cluster.
-
-## Spectrum of revocation support
-
-Starting with Vault 1.13, the PKI secrets engine has the ability to support a
-spectrum of cluster sizes and certificate revocation quantities.
-
-For users with few revocations or who want a unified view and have the
-inter-cluster bandwidth to support it, we recommend turning on auto
-rebuilding of CRLs, cross-cluster revocation queues, and cross-cluster CRLs.
-This allows all consumers of the CRLs to have the most accurate picture of
-revocations, regardless of which cluster they talk to.
-
-If the unified CRL becomes too big for the underlying storage mechanism or
-for a single host to build, we recommend relying on OCSP instead of CRLs.
-These have much smaller storage entries, and the CRL `disabled` flag is
-independent of `unified_crls`, allowing unified OCSP to remain.
-
-However, when cross-cluster traffic becomes too high (or if CRLs are still
-necessary in addition to OCSP), we recommend sharding the CRL between
-different clusters. This has been the default behavior of Vault, but with
-the introduction of per-cluster, templated AIA information, the leaf
-certificate's Authority Information Access (AIA) info will point directly
-to the cluster which issued it, allowing the correct CRL for this cert to
-be identified by the application. This more correctly mimics the behavior
-of [Let's Encrypt's CRL sharding](https://letsencrypt.org/2022/09/07/new-life-for-crls.html).
-
-This sharding behavior can also be used for OCSP, if the cross-cluster
-traffic for revocation entries becomes too high.
-
-For users who wish to manage revocation manually, using the audit logs to
-track certificate issuance would allow an external system to identify which
-certificates were issued. These can be manually tracked for revocation, and
-a [custom CRL can be built](/vault/api-docs/secret/pki#combine-crls-from-the-same-issuer)
-using externally tracked revocations. This would allow usage of roles set to
-`no_store=true`, so Vault is strictly used as an issuing authority and isn't
-storing any certificates, issued or revoked. For the highest of revocation
-volumes, this could be the best option.
-
-Notably, this last approach can either be used for the creation of externally
-stored unified or sharded CRLs. If a single external unified CRL becomes
-unreasonably large, each cluster's certificates could have AIA info point
-to an externally stored and maintained, sharded CRL. However,
-Vault has no mechanism to sign OCSP requests at this time.
-
-### What are Cross-Cluster CRLs?
-
-Vault Enterprise supports a clustering mode called [Performance
-Replication](/vault/docs/enterprise/replication#performance-replication). In
-a replicated PKI Secrets Engine mount, issuer and role information is synced
-between the Performance Primary and all Performance Secondary clusters.
-However, each Performance Secondary cluster has its own local storage of
-issued certificates and revocations which is not synced. In Vault versions
-before 1.13, this meant that each of these clusters had its own CRL and
-OCSP data, and any revocation requests needed to be processed on the
-cluster that issued it (or BYOC used).
-
-Starting with Vault 1.13, we've added [two
-features](/vault/api-docs/secret/pki#read-crl-configuration) to Vault
-Enterprise to help manage this setup more correctly and easily: revocation
-request queues (`cross_cluster_revocation=true` in `config/crl`) and unified
-revocation entries (`unified_crl=true` in `config/crl`).
-
-The former allows operators (revoking by serial number) to request a
-certificate be revoked regardless of which cluster it was issued on. For
-example, if a request goes into the Performance Primary, but it didn't
-issue the certificate, it'll write a cross-cluster revocation request,
-and mark the results as pending. If another cluster already has this
-certificate in storage, it will revoke it and confirm the revocation back
-to the main cluster. An operator can [list pending
-revocations](/vault/api-docs/secret/pki#list-revocation-requests) to see
-the status of these requests. To clean up invalid requests (e.g., if the
-cluster which had that certificate disappeared, if that certificate was
-issued with `no_store=true` on the role, or if it was an invalid serial
-number), an operator can [use tidy](/vault/api-docs/secret/pki#tidy) with
-`tidy_revocation_queue=true`, optionally shortening
-`revocation_queue_safety_buffer` to remove them quicker.
-
-The latter allows all clusters to have a unified view of revocations,
-that is, to have access to a list of revocations performed by other clusters.
-While the configuration parameter includes `crl` in the description, this
-applies to [both CRLs](/vault/api-docs/secret/pki#read-issuer-crl) and the
-[OCSP responder](/vault/api-docs/secret/pki#ocsp-request). When this
-revocation replication occurs, if any cluster considers a cert revoked when
-another doesn't (e.g., via BYOC revocation of a `no_store=false` certificate),
-all clusters will now consider it revoked assuming it hasn't expired. Notably,
-the active node of the primary cluster will be used to rebuild the CRL; as
-this can grow large if many clusters have lots of revoked certs, an operator
-might need to disable CRL building (`disabled=true` in `config/crl`) or
-increase the [storage size](/vault/docs/configuration/storage/raft#max_entry_size).
-
-As an aside, all new cross-cluster writes (from Performance Secondary up to
-the Performance Primary) are performed synchronously. This gives the caller
-confidence that the request actually went through, at the expense of incurring
-a bit higher overhead for revoking certificates. When a node loses its GRPC
-connection (e.g., during leadership election or being otherwise unable to
-contact the active primary), errors will occur though the local portion of the
-write (if any) will still succeed. For cross-cluster revocation requests, due
-to there being no local write, this means that the operation will need to be
-retried, but in the event of an issue writing a cross-cluster revocation entry
-when the cert existed locally, the revocation will eventually be synced across
-clusters when the connection comes back.
-
-## Issuer subjects and CRLs
-
-As noted on several [GitHub issues](https://github.com/hashicorp/vault/issues/10176),
-Go's x509 library has an opinionated parsing and structuring mechanism for
-certificate's Subjects. Issuers created within Vault are fine, but when using
-externally created CA certificates, these may not be parsed
-correctly throughout all parts of the PKI. In particular, CRLs embed a
-(modified) copy of the issuer name. This can be avoided by using OCSP to
-track revocation, but note that performance characteristics are different
-between OCSP and CRLs.
-
-~> Note: As of Go 1.20 and Vault 1.13, Go correctly formats the CRL's issuer
-   name and this notice [does not apply](https://github.com/golang/go/commit/a367981b4c8e3ae955eca9cc597d9622201155f3).
-
-## Automate leaf certificate renewal
-
-To manage certificates for services at scale, it is best to automate the
-certificate renewal as much as possible. Vault Agent [has support for
-automatically renewing requested certificates](/vault/docs/agent-and-proxy/agent/template#certificates)
-based on the `validTo` field. Other solutions might involve using
-[cert-manager](https://cert-manager.io/) in Kubernetes or OpenShift, backed
-by the Vault CA.
-
-## Safe minimums
-
-Since its inception, this secrets engine has enforced SHA256 for signature
-hashes rather than SHA1. As of 0.5.1, a minimum of 2048 bits for RSA keys is
-also enforced. Software that can handle SHA256 signatures should also be able to
-handle 2048-bit keys, and 1024-bit keys are considered unsafe and are disallowed
-in the Internet PKI.
-
-## Token lifetimes and revocation
-
-When a token expires, it revokes all leases associated with it. This means that
-long-lived CA certs need correspondingly long-lived tokens, something that is
-easy to forget. Starting with 0.6, root and intermediate CA certs no longer have
-associated leases, to prevent unintended revocation when not using a token with
-a long enough lifetime. To revoke these certificates, use the `pki/revoke`
-endpoint.
-
-## Safe usage of roles
-
-The Vault PKI Secrets Engine supports many options to limit issuance via
-[Roles](/vault/api-docs/secret/pki#create-update-role).
-Careful consideration of construction is necessary to ensure that more
-permissions are not given than necessary. Additionally, roles should generally
-do _one_ thing; multiple roles should be preferable over having too permissive
-roles that allow arbitrary issuance (e.g., `allow_any_name` should generally
-be used sparingly, if at all).
-
- - `allow_any_name` should generally be set to `false`; this is the default.
- - `allow_localhost` should generally be set to `false` for production
-   services, unless listening on `localhost` is expected.
- - Unless necessary, `allow_wildcard_certificates` should generally be set to
-   `false`. This is **not** the default due to backwards compatibility
-   concerns.
-   - This is especially necessary when `allow_subdomains` or `allow_glob_domains`
-     are enabled.
- - `enforce_hostnames` should generally be enabled for TLS services; this is
-   the default.
- - `allow_ip_sans` should generally be set to `false` (but defaults to `true`),
-   unless IP address certificates are explicitly required.
- - When using short TTLs (< 30 days) or with high issuance volume, it is
-   generally recommend to set `no_store` to `true` (defaults to `false`).
-   This prevents revocation but allows higher throughput as Vault no longer
-   needs to store every issued certificate. This is discussed more in the
-   [Replicated Datasets](#replicated-datasets) section below.
- - Do not use roles with root certificates (`issuer_ref`). Root certificates
-   should generally only issue intermediates (see the section on [CA hierarchy
-   above](#use-a-ca-hierarchy)), which doesn't rely on roles.
- - Limit `key_usage` and `ext_key_usage`; don't attempt to allow all usages
-   for all purposes. Generally the default values are useful for client and
-   server TLS authentication.
-
-## Telemetry
-
-Beyond Vault's default telemetry around request processing, PKI exposes count and
-duration metrics for the issue, sign, sign-verbatim, and revoke calls. The
-metrics keys take the form `mount-path,operation,[failure]` with labels for
-namespace and role name.
-
-Note that these metrics are per-node and thus would need to be aggregated across
-nodes and clusters.
-
-## Auditing
-
-Because Vault HMACs audit string keys by default, it is necessary to tune
-PKI secrets mounts to get an accurate view of issuance that is occurring under
-this mount.
-
-~> Note: Depending on usage of Vault, CRLs (and rarely, CA chains) can grow to
-   be rather large. We don't recommend un-HMACing the `crl` field for this
-   reason, but note that the recommendations below suggest to un-HMAC the
-   `certificate` response parameter, which the CRL can be served in via
-   the `/pki/cert/crl` API endpoint. Additionally, the `http_raw_body` can
-   be used to return CRL both in PEM and raw binary DER form, so it is
-   suggested not to un-HMAC that field to not corrupt the log format.<br /><br />
-   If this is done with only a [syslog](/vault/docs/audit/syslog) audit device,
-   Vault can deny requests (with an opaque `500 Internal Error` message)
-   after the action has been performed on the server, because it was
-   unable to log the message.<br /><br />
-   The suggested workaround is to either leave the `certificate` and `crl`
-   response fields HMACed and/or to also enable the [`file`](/vault/docs/audit/file)
-   audit log type.
-
-Some suggested keys to un-HMAC for requests are as follows:
-
- - `csr` - the requested CSR to sign,
- - `certificate` - the requested self-signed certificate to re-sign or
-   when importing issuers,
- - Various issuance-related overriding parameters, such as:
-   - `issuer_ref` - the issuer requested to sign this certificate,
-   - `common_name` - the requested common name,
-   - `alt_names` - alternative requested DNS-type SANs for this certificate,
-   - `other_sans` - other (non-DNS, non-Email, non-IP, non-URI) requested SANs for this certificate,
-   - `ip_sans` - requested IP-type SANs for this certificate,
-   - `uri_sans` - requested URI-type SANs for this certificate,
-   - `ttl` - requested expiration date of this certificate,
-   - `not_after` - requested expiration date of this certificate,
-   - `serial_number` - the subject's requested serial number,
-   - `key_type` - the requested key type,
-   - `private_key_format` - the requested key format which is also
-     used for the public certificate format as well,
- - Various role- or issuer-related generation parameters, such as:
-   - `managed_key_name` - when creating an issuer, the requested managed
-     key name,
-   - `managed_key_id` -  when creating an issuer, the requested managed
-     key identifier,
-   - `ou` - the subject's organizational unit,
-   - `organization` - the subject's organization,
-   - `country` - the subject's country code,
-   - `locality` - the subject's locality,
-   - `province` - the subject's province,
-   - `street_address` - the subject's street address,
-   - `postal_code` - the subject's postal code,
-   - `permitted_dns_domains` - permitted DNS domains,
-   - `policy_identifiers` - the requested policy identifiers when creating a role, and
-   - `ext_key_usage_oids` - the extended key usage OIDs for the requested certificate.
-
-Some suggested keys to un-HMAC for responses are as follows:
-
- - `certificate` - the certificate that was issued,
- - `issuing_ca` - the certificate of the CA which issued the requested
-   certificate,
- - `serial_number` - the serial number of the certificate that was issued,
- - `error` - to show errors associated with the request, and
- - `ca_chain` - optional due to noise; the full CA chain of the issuer of
-   the requested certificate.
-
-~> Note: These list of parameters to un-HMAC are provided as a suggestion and
-   may not be exhaustive.
-
-The following keys are suggested **NOT** to un-HMAC, due to their sensitive
-nature:
-
- - `private_key` - this response parameter contains the private keys
-   generated by Vault during issuance, and
- - `pem_bundle` this request parameter is only used on the issuer-import
-   paths and may contain sensitive private key material.
-
-## Role-Based access
-
-Vault supports [path-based ACL Policies](/vault/tutorials/getting-started/getting-started-policies)
-for limiting access to various paths within Vault.
-
-The following is a condensed example reference of ACLing the PKI Secrets
-Engine. These are just a suggestion; other personas and policy approaches
-may also be valid.
-
-We suggest the following personas:
-
- - *Operator*;  a privileged user who manages the health of the PKI
-   subsystem; manages issuers and key material.
- - *Agent*; a semi-privileged user that manages roles and handles
-   revocation on behalf of an operator; may also handle delegated
-   issuance. This may also be called an *administrator* or *role
-   manager*.
- - *Advanced*; potentially a power-user or service that has access to
-   additional issuance APIs.
- - *Requester*; a low-level user or service that simply requests certificates.
- - *Unauthed*; any arbitrary user or service that lacks a Vault token.
-
-For these personas, we suggest the following ACLs, in condensed, tabular form:
-
-| Path | Operations | Operator | Agent | Advanced | Requester | Unauthed |
-| :--- | :--------- | :------- | :---- | :------- | :-------- | :------- |
-| `/ca(/pem)?` | Read | Yes | Yes | Yes | Yes | Yes |
-| `/ca_chain` | Read | Yes | Yes | Yes | Yes | Yes |
-| `/crl(/pem)?` | Read | Yes | Yes | Yes | Yes | Yes |
-| `/crl/delta(/pem)?` | Read | Yes | Yes | Yes | Yes | Yes |
-| `/cert/:serial(/raw(/pem)?)?` | Read | Yes | Yes | Yes | Yes | Yes |
-| `/issuers` | List | Yes | Yes | Yes | Yes | Yes |
-| `/issuer/:issuer_ref/(json¦der¦pem)` | Read | Yes | Yes | Yes | Yes | Yes |
-| `/issuer/:issuer_ref/crl(/der¦/pem)?` | Read | Yes | Yes | Yes | Yes | Yes |
-| `/issuer/:issuer_ref/crl/delta(/der¦/pem)?` | Read | Yes | Yes | Yes | Yes | Yes |
-| `/ocsp/<request>` | Read | Yes | Yes | Yes | Yes | Yes |
-| `/ocsp` | Write | Yes | Yes | Yes | Yes | Yes |
-| `/certs` | List | Yes | Yes | Yes | Yes | |
-| `/revoke-with-key` | Write | Yes | Yes | Yes | Yes | |
-| `/roles` | List | Yes | Yes | Yes | Yes | |
-| `/roles/:role` | Read | Yes | Yes | Yes | Yes | |
-| `/(issue¦sign)/:role` | Write | Yes | Yes | Yes | Yes | |
-| `/issuer/:issuer_ref/(issue¦sign)/:role` | Write | Yes | Yes | Yes | | |
-| `/config/auto-tidy` | Read | Yes | Yes |  |  |  |
-| `/config/ca` | Read | Yes | Yes |  |  |  |
-| `/config/crl` | Read | Yes | Yes |  |  |  |
-| `/config/issuers` | Read | Yes | Yes |  |  |  |
-| `/crl/rotate` | Read | Yes | Yes | | | |
-| `/crl/rotate-delta` | Read | Yes | Yes | | | |
-| `/roles/:role` | Write | Yes | Yes | | | |
-| `/issuer/:issuer_ref` | Read | Yes | Yes | | | |
-| `/sign-verbatim(/:role)?` | Write | Yes | Yes | | | |
-| `/issuer/:issuer_ref/sign-verbatim(/:role)?` | Write | Yes | Yes | | | |
-| `/revoke` | Write | Yes | Yes | | | |
-| `/tidy` | Write | Yes | Yes | | | |
-| `/tidy-cancel` | Write | Yes | Yes | | | |
-| `/tidy-status` | Read | Yes | Yes | | | |
-| `/config/auto-tidy` | Write | Yes | |  |  |  |
-| `/config/ca` | Write | Yes | |  |  |  |
-| `/config/crl` | Write | Yes | |  |  |  |
-| `/config/issuers` | Write | Yes | |  |  |  |
-| `/config/keys` | Read, Write | Yes | |  |  |  |
-| `/config/urls` | Read, Write | Yes | |  |  |  |
-| `/issuer/:issuer_ref` | Write | Yes | | | | |
-| `/issuer/:issuer_ref/revoke` | Write | Yes | | | | |
-| `/issuer/:issuer_ref/sign-intermediate` | Write | Yes | | | | |
-| `/issuer/issuer_ref/sign-self-issued` | Write | Yes | | | | |
-| `/issuers/generate/+/+` | Write | Yes | | | | |
-| `/issuers/import/+` | Write | Yes | | | | |
-| `/intermediate/generate/+` | Write | Yes | | | | |
-| `/intermediate/cross-sign` | Write | Yes | | | | |
-| `/intermediate/set-signed` | Write | Yes | | | | |
-| `/keys` | List | Yes | | | | |
-| `/key/:key_ref` | Read, Write | Yes | | | | |
-| `/keys/generate/+` | Write | Yes | | | | |
-| `/keys/import` | Write | Yes | | | | |
-| `/root/generate/+` | Write | Yes | | | | |
-| `/root/sign-intermediate` | Write | Yes | | | | |
-| `/root/sign-self-issued` | Write | Yes | | | | |
-| `/root/rotate/+` | Write | Yes | | | | |
-| `/root/replace` | Write | Yes | | | | |
-
-~> Note: With managed keys, operators might need access to [read the mount
-   point's tunable data](/vault/api-docs/system/mounts) (Read on `/sys/mounts`) and
-   may need access [to use or manage managed keys](/vault/api-docs/system/managed-keys).
-
-## Replicated DataSets
-
-When operating with [Performance Secondary](/vault/docs/enterprise/replication#architecture)
-clusters, certain data-sets are maintained across all clusters, while others for performance
-and scalability reasons are kept within a given cluster.
-
-The following table breaks down by data type what data sets will cross the cluster boundaries.
-For data-types that do not cross a cluster boundary, read requests for that data will need to be
-sent to the appropriate cluster that the data was generated on.
-
-| Data Set                 | Replicated Across Clusters |
-|--------------------------|----------------------------|
-| Issuers & Keys           | Yes                        |
-| Roles                    | Yes                        |
-| CRL Config               | Yes                        |
-| URL Config               | Yes                        |
-| Issuer Config            | Yes                        |
-| Key Config               | Yes                        |
-| CRL                      | No                         |
-| Revoked Certificates     | No                         |
-| Leaf/Issued Certificates | No                         |
-
-The main effect is that within the PKI secrets engine leaf certificates
-issued with `no_store` set to `false` are stored local to the cluster that issued them.
-This allows for both primary and [Performance Secondary](/vault/docs/enterprise/replication#architecture)
-clusters' active node to issue certificates for greater scalability. As a
-result, these certificates and any revocations are visible only on the issuing
-cluster. This additionally means each cluster has its own set of CRLs, distinct
-from other clusters. These CRLs should either be unified into a single CRL for
-distribution from a single URI, or server operators should know to fetch all
-CRLs from all clusters.
-
-## Cluster scalability
-
-Most non-introspection operations in the PKI secrets engine require a write to
-storage, and so are forwarded to the cluster's active node for execution.
-This table outlines which operations can be executed on performance standby nodes
-and thus scale horizontally across all nodes within a cluster.
-
-| Path                          | Operations           |
-|-------------------------------|----------------------|
-| ca[/pem]                      | Read                 |
-| cert/<em>serial-number</em>   | Read                 |
-| cert/ca_chain                 | Read                 |
-| config/crl                    | Read                 |
-| certs                         | List                 |
-| ca_chain                      | Read                 |
-| crl[/pem]                     | Read                 |
-| issue                         | Update <sup>\*</sup> |
-| revoke/<em>serial-number</em> | Read                 |
-| sign                          | Update <sup>\*</sup> |
-| sign-verbatim                 | Update <sup>\*</sup> |
-
-\* Only if the corresponding role has `no_store` set to true and `generate_lease`
-set to false. If `generate_lease` is true the lease creation will be forwarded to
-the active node; if `no_store` is false the entire request will be forwarded to
-the active node.
-
-## PSS support
-
-Go lacks support for PSS certificates, keys, and CSRs using the `rsaPSS` OID
-(`1.2.840.113549.1.1.10`). It requires all RSA certificates, keys, and CSRs
-to use the alternative `rsaEncryption` OID (`1.2.840.113549.1.1.1`).
-
-When using OpenSSL to generate CAs or CSRs from PKCS8-encoded PSS keys, the
-resulting CAs and CSRs will have the `rsaPSS` OID. Go and Vault will reject
-them. Instead, use OpenSSL to generate or convert to a PKCS#1v1.5 private
-key file and use this to generate the CSR. Vault will, depending on the role
-and the signing mechanism, still use a PSS signature despite the
-`rsaEncryption` OID on the request as the SubjectPublicKeyInfo and
-SignatureAlgorithm fields are orthogonal. When creating an external CA and
-importing it into Vault, ensure that the `rsaEncryption` OID is present on
-the SubjectPublicKeyInfo field even if the SignatureAlgorithm is PSS-based.
-
-These certificates generated by Go (with `rsaEncryption` OID but PSS-based
-signatures) are otherwise compatible with the fully PSS-based certificates.
-OpenSSL and NSS support parsing and verifying chains using this type of
-certificate. Note that some TLS implementations may not support these types
-of certificates if they do not support `rsa_pss_rsae_*` signature schemes.
-Additionally, some implementations allow rsaPSS OID certificates to contain
-restrictions on signature parameters allowed by this certificate, but Go and
-Vault do not support adding such restrictions.
-
-At this time Go lacks support for signing CSRs with the PSS signature
-algorithm. If using a managed key that requires a RSA PSS algorithm (such as GCP or
-a PKCS#11 HSM) as a backing for an intermediate CA key, attempting to generate
-a CSR (via `pki/intermediate/generate/kms`) will fail signature verification.
-In this case, the CSR will need to be generated outside of Vault and the
-signed final certificate can be imported into the mount.
-
-Go additionally lacks support for creating OCSP responses with the PSS
-signature algorithm. Vault will automatically downgrade issuers with
-PSS-based revocation signature algorithms to PKCS#1v1.5, but note that
-certain KMS devices (like HSMs and GCP) may not support this with the
-same key. As a result, the OCSP responder may fail to sign responses,
-returning an internal error.
-
-## Issuer storage migration issues
-
-When Vault migrates to the new multi-issuer storage layout on releases prior
-to 1.11.6, 1.12.2, and 1.13, and storage write errors occur during the mount
-initialization and storage migration process, the default issuer _may_ not
-have the correct `ca_chain` value and may only have the self-reference. These
-write errors most commonly manifest in logs as a message like
-`failed to persist issuer ... chain to disk: <cause>` and indicate that Vault
-was not stable at the time of migration. Note that this only occurs when more
-than one issuer exists within the mount (such as an intermediate with root).
-
-To fix this manually (until a new version of Vault automatically rebuilds the
-issuer chain), a rebuild of the chains can be performed:
-
-```
-curl -X PATCH -H "Content-Type: application/merge-patch+json" -H "X-Vault-Request: true" -H "X-Vault-Token: $(vault print token)" -d '{"manual_chain":"self"}' https://.../issuer/default
-curl -X PATCH -H "Content-Type: application/merge-patch+json" -H "X-Vault-Request: true" -H "X-Vault-Token: $(vault print token)" -d '{"manual_chain":""}' https://.../issuer/default
-```
-
-This temporarily sets the manual chain on the default issuer to a self-chain
-only, before reverting it back to automatic chain building. This triggers a
-refresh of the `ca_chain` field on the issuer, and can be verified with:
-
-```
-vault read pki/issuer/default
-```
-
-## Tutorial
-
-Refer to the [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
-guide for a step-by-step tutorial.
-
-Have a look at the [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
-for more about how to use externally managed keys with PKI.
-
-## API
-
-The PKI secrets engine has a full HTTP API. Please see the
-[PKI secrets engine API](/vault/api-docs/secret/pki) for more
-details.
diff --git a/website/content/docs/secrets/pki/index.mdx b/website/content/docs/secrets/pki/index.mdx
deleted file mode 100644
index 9ef5fbe844d..00000000000
--- a/website/content/docs/secrets/pki/index.mdx
+++ /dev/null
@@ -1,73 +0,0 @@
----
-layout: docs
-page_title: PKI - Secrets Engines
-description: The PKI secrets engine for Vault generates TLS certificates.
----
-
-# PKI secrets engine
-
-@include 'x509-sha1-deprecation.mdx'
-
--> **Vault as Consul CA provider:** If you are using Vault 1.11.0+ as a Connect CA, run a Consul version which includes the fix for [GH-15525](https://github.com/hashicorp/consul/pull/15525). Refer to this [Knowledge Base article](https://support.hashicorp.com/hc/en-us/articles/11308460105491) for more details.
-
-The PKI secrets engine generates dynamic X.509 certificates. With this secrets
-engine, services can get certificates without going through the usual manual
-process of generating a private key and CSR, submitting to a CA, and waiting for
-a verification and signing process to complete. Vault's built-in authentication
-and authorization mechanisms provide the verification functionality.
-
-By keeping TTLs relatively short, revocations are less likely to be needed,
-keeping CRLs short and helping the secrets engine scale to large workloads. This
-in turn allows each instance of a running application to have a unique
-certificate, eliminating sharing and the accompanying pain of revocation and
-rollover.
-
-In addition, by allowing revocation to mostly be forgone, this secrets engine
-allows for ephemeral certificates. Certificates can be fetched and stored in
-memory upon application startup and discarded upon shutdown, without ever being
-written to disk.
-
-## Table of contents
-
-The PKI Secrets Engine documentation is split into the following pieces:
-
- - [Overview](/vault/docs/secrets/pki) - this document.
- - [Setup and Usage](/vault/docs/secrets/pki/setup) - a brief description of setting
-   up and using the PKI Secrets Engine to issue certificates.
- - [Quick Start - Root CA Setup](/vault/docs/secrets/pki/quick-start-root-ca) - A
-   quick start guide for setting up a root CA.
- - [Quick Start - Intermediate CA Setup](/vault/docs/secrets/pki/quick-start-intermediate-ca) - A
-   quick start guide for setting up an intermediate CA.
- - [Considerations](/vault/docs/secrets/pki/considerations) - A list of helpful
-   considerations to keep in mind when using and operating the PKI Secrets
-   Engine.
- - [Troubleshooting ACME](/vault/docs/secrets/pki/troubleshooting-acme) - A list of
-   advice for troubleshooting failures with ACME issuance and Vault PKI.
- - [Rotation Primitives](/vault/docs/secrets/pki/rotation-primitives) - A document
-   which explains different types of certificates used to achieve rotation.
- - [CIEPS Protocol <EnterpriseAlert inline="true" />](/vault/docs/secrets/pki/cieps) - A
-   document which explains the Certificate Issuance External Policy Service (CIEPS)
-   protocol (request and response structure), along with an overview of the difference
-   between it and `/pki/sign-verbatim`.
-
-## Tutorial
-
-Refer to the following tutorials for PKI secrets engine usage examples:
-
-- [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
-- [Build Certificate Authority (CA) in Vault with an offline Root](/vault/tutorials/secrets-management/pki-engine-external-ca)
-- [Enable ACME with PKI secrets engine](/vault/tutorials/secrets-management/pki-acme-caddy)
-- [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
-- [PKI Unified CRL and OCSP With Cross Cluster
-  Revocation](/vault/tutorials/secrets-management/pki-unified-crl-ocsp-cross-cluster)
-- [Configure Vault as a Certificate Manager in Kubernetes with
-  Helm](/vault/tutorials/kubernetes/kubernetes-cert-manager)
-- [Generate mTLS Certificates for Nomad using
-  Vault](/vault/tutorials/secrets-management/vault-pki-nomad)
-
-
-## API
-
-The PKI secrets engine has a full HTTP API. Please see the
-[PKI secrets engine API](/vault/api-docs/secret/pki) for more
-details.
diff --git a/website/content/docs/secrets/pki/quick-start-intermediate-ca.mdx b/website/content/docs/secrets/pki/quick-start-intermediate-ca.mdx
deleted file mode 100644
index b9930229cd0..00000000000
--- a/website/content/docs/secrets/pki/quick-start-intermediate-ca.mdx
+++ /dev/null
@@ -1,272 +0,0 @@
----
-layout: docs
-page_title: 'PKI - Secrets Engines: Quick Start: Intermediate CA Setup'
-description: The PKI secrets engine for Vault generates TLS certificates.
----
-
-# PKI secrets engine - quick start - intermediate CA setup
-
-In the [first Quick Start guide](/vault/docs/secrets/pki/quick-start-root-ca),
-certificates were issued directly from the root certificate authority.
-As described in the example, this is not a recommended practice. This guide
-builds on the previous guide's root certificate authority and creates an
-intermediate authority using the root authority to sign the intermediate's
-certificate.
-
-#### Mount the backend
-
-To add another certificate authority to our Vault instance, we have to mount it
-at a different path.
-
-```shell-session
-$ vault secrets enable -path=pki_int pki
-Successfully mounted 'pki' at 'pki_int'!
-```
-
-#### Configure an intermediate CA
-
-```shell-session
-$ vault secrets tune -max-lease-ttl=43800h pki_int
-Successfully tuned mount 'pki_int'!
-```
-
-That sets the maximum TTL for secrets issued from the mount to 5 years. This
-value should be less than or equal to the root certificate authority.
-
-Now, we generate our intermediate certificate signing request:
-
-```shell-session
-$ vault write pki_int/intermediate/generate/internal common_name="myvault.com Intermediate Authority" ttl=43800h
-Key Value
-csr -----BEGIN CERTIFICATE REQUEST-----
-MIICsjCCAZoCAQAwLTErMCkGA1UEAxMibXl2YXVsdC5jb20gSW50ZXJtZWRpYXRl
-IEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJU1Qh8l
-BW16WHAu34Fy92FnSy4219WVlKw1xwpKxjd95xH6WcxXozOs6oHFQ9c592bz51F8
-KK3FFJYraUrGONI5Cz9qHbzC1mFCmjnXVXCoeNKIzEBG0Y+ehH7MQ1SvDCyvaJPX
-ItFXaGf6zENiGsApw3Y3lFr0MjPzZDBH1p4Nq3aA6L2BaxvO5vczdQl5tE2ud/zs
-GIdCWnl1ThDEeiX1Ppduos/dx3gaZa9ly3iCuDMKIL9yK5XTBTgKB6ALPApekLQB
-kcUFbOuMzjrDSBe9ytu65yICYp26iAPPA8aKTj5cUgscgzEvQS66rSAVG/unrWxb
-wbl8b7eQztCmp60CAwEAAaBAMD4GCSqGSIb3DQEJDjExMC8wLQYDVR0RBCYwJIIi
-bXl2YXVsdC5jb20gSW50ZXJtZWRpYXRlIEF1dGhvcml0eTANBgkqhkiG9w0BAQsF
-AAOCAQEAZA9A1QvTdAd45+Ay55FmKNWnis1zLjbmWNJURUoDei6i6SCJg0YGX1cZ
-WkD0ibxPYihSsKRaIUwC2bE8cxZM57OSs7ISUmyPQAT2IHTHvuGK72qlFRBlFOzg
-SHEG7gfyKdrALphyF8wM3u4gXhcnY3CdltjabL3YakZqd3Ey4870/0XXeo5c4k7w
-/+n9M4xED4TnXYCGfLAlu5WWKSeCvu9mHXnJcLo1MiYjX7KGey/xYYbfxHSPm4ul
-tI6Vf59zDRscfNmq37fERD3TiKP0QZNGTSRvnrxrx2RUQGXFywM8l4doG8nS5BxU
-2jP20cdv0lJFvHr9663/8B/+F5L6Yw==
------END CERTIFICATE REQUEST-----
-```
-
-Take the signing request from the intermediate authority and sign it using
-another certificate authority, in this case the root certificate authority
-generated in the first example.
-
-```shell-session
-$ vault write pki/root/sign-intermediate csr=@pki_int.csr format=pem_bundle ttl=43800h
-Key             Value
-certificate     -----BEGIN CERTIFICATE-----
-MIIDZTCCAk2gAwIBAgIUENxQD7KIJi1zE/jEiYqAG1VC4NwwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLbXl2YXVsdC5jb20wHhcNMTcxMTI4MTcwNzIzWhcNMjIx
-MTI3MTcwNzUzWjAtMSswKQYDVQQDEyJteXZhdWx0LmNvbSBJbnRlcm1lZGlhdGUg
-QXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5seNV4Yd
-uCMX0POUUuSzCBiR3Cyf9b9tGsCX7UfvZmjPs+Fl/X+Ovq6UtHM9RuTGlyfFrCWy
-pflO7mc0H8PBzlvhv1WQet5aRyUOXkG6iYmooG9iobIY8z/TZCaCF605pgygfOaS
-DIlwOdJkfiXxGpQ00pfIwe/Y2OK2I5e36u0E2EA6kXvcfexLjQGFPbod+H0R29Ro
-/GwOJ6MpSHqB77mF025x1y08EtqT1z1kFCiDzFSkzNZEZYWljhDS6ZRY9ctzKufm
-5CkUwmvCVRI2CivDJvmfhXyv0DRoq4IhYdJHo179RSObq3BY9f9LQ0balNLiM0Ft
-O8f0urTqUAbySwIDAQABo4GTMIGQMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
-BTADAQH/MB0GA1UdDgQWBBSQgTfcMrKYzyckP6t/0iVQkl0ZBDAfBgNVHSMEGDAW
-gBRccsCARqs3wQDjW7JMNXS6pWlFSDAtBgNVHREEJjAkgiJteXZhdWx0LmNvbSBJ
-bnRlcm1lZGlhdGUgQXV0aG9yaXR5MA0GCSqGSIb3DQEBCwUAA4IBAQABNg2HxccY
-DwRpsJ+sxA0BgDyF+tYtOlXViVNv6Z+nOU0nNhQSCjfzjYWmBg25nfKaFhQSC3b7
-fIW+e7it/FLVrCgaqdysoxljqhR0gXMAy8S/ubmskPWjJiKauJB5bfB59Uf2GP6j
-zimZDu6WjWvvgkKcJqJEbOOS9DWBvCTdmmml1NMXZtcytpod2Y7mxninqNRx3qpx
-Pst4vgAbyM/3zLSzkyUD+MXIyRXwxktFlyEYBHvMd9OoHzLO6WLxk22FyQQ+w4by
-NfXJY4r5pj6a4lJ6pPuqyfBhidYMTdY3AI7w/QRGk4qQv1iDmnZspk2AxdbR5Lwe
-YmChIML/f++S
------END CERTIFICATE-----
-expiration      1669568873
-issuing_ca      -----BEGIN CERTIFICATE-----
-MIIDNTCCAh2gAwIBAgIUdR44qhhyh3CZjnCtflGKQlTI8NswDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLbXl2YXVsdC5jb20wHhcNMTcxMTI4MTYxODA2WhcNMjcx
-MTI2MTYxODM1WjAWMRQwEgYDVQQDEwtteXZhdWx0LmNvbTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBANTPnQ2CUkuLrYT4V6/IIK/gWFZXFG4lWTmgM5Zh
-PDquMhLEikZCbZKbupouBI8MOr5i8tycENaTnSs9dBwVEOWAHbLkliVgvCKgLi0F
-PfPM87FnBoKVctO2ip8AdmYcAt/wc096dWBG6eKLVP5xsAe7NcYDtF/inHgEZ22q
-ZjGVEyC6WntIASgULoHGgHakPp1AHLhGm8nL5YbusWY7RgZIlNeGWLVoneG0pxdV
-7W1SPO67dsQyq58mTxMIGVUj5YE1q7/C6OhCTnAHc+sRm0oUehPfO8kY4NHpCJGv
-nDRdJi6k6ewk94c0KK2tUUM/TN6ZSRfx6ccgfPH8zNcVPVcCAwEAAaN7MHkwDgYD
-VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFFxywIBGqzfB
-AONbskw1dLqlaUVIMB8GA1UdIwQYMBaAFFxywIBGqzfBAONbskw1dLqlaUVIMBYG
-A1UdEQQPMA2CC215dmF1bHQuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBgvsgpBuVR
-iKVdXXpFyoQLImuoaHZgaj5tuUDqnMoxOA1XWW6SVlZmGfDQ7+u5NBkp2cGSDRGm
-ARHJTeURvdZIwdFdGkNqfAZjutRjjQOnXgS65ujZd7AnlZq1v0ZOZqVVk9YEOhOe
-Rh2MjnHGNuiLBib1YNQHNuRef1mPwIE2Gm/Tz/z3JPHtkKNIKbn60zHrIIM/OT2Z
-HYjcMUcqXtKGYfNjVspJm3lSDUoyJdaq80Afmy2Ez1Vt9crGG3Dj8mgs59lEhEyo
-MDVhOP116M5HJfQlRPVd29qS8pFrjBvXKjJSnJNG1UFdrWBJRJ3QrBxUQALKrJlR
-g5lvTeymHjS/
------END CERTIFICATE-----
-serial_number   10:dc:50:0f:b2:88:26:2d:73:13:f8:c4:89:8a:80:1b:55:42:e0:dc
-```
-
-Now set the intermediate certificate authorities signing certificate to the
-root-signed certificate.
-
-```shell-session
-$ vault write pki_int/intermediate/set-signed certificate=@signed_certificate.pem
-Success! Data written to: pki_int/intermediate/set-signed
-```
-
-The intermediate certificate authority is now configured and ready to issue
-certificates.
-
-#### Set URL configuration
-
-Generated certificates can have the CRL location and the location of the
-issuing certificate encoded. These values must be set manually, but can be
-changed at any time.
-
-```shell-session
-$ vault write pki_int/config/urls issuing_certificates="http://127.0.0.1:8200/v1/pki_int/ca" crl_distribution_points="http://127.0.0.1:8200/v1/pki_int/crl"
-Success! Data written to: pki_int/ca/urls
-```
-
-#### Configure a role
-
-The next step is to configure a role. A role is a logical name that maps to a
-policy used to generate those credentials. For example, let's create an
-"example-dot-com" role:
-
-```shell-session
-$ vault write pki_int/roles/example-dot-com \
-    allowed_domains=example.com \
-    allow_subdomains=true max_ttl=72h
-Success! Data written to: pki_int/roles/example-dot-com
-```
-
-#### Issue certificates
-
-By writing to the `roles/example-dot-com` path we are defining the
-`example-dot-com` role. To generate a new certificate, we simply write
-to the `issue` endpoint with that role name: Vault is now configured to create
-and manage certificates!
-
-```shell-session
-$ vault write pki_int/issue/example-dot-com \
-    common_name=blah.example.com
-Key                 Value
----                 -----
-certificate         -----BEGIN CERTIFICATE-----
-MIIDbDCCAlSgAwIBAgIUPiAyxq+nIE6xlWf7hrzLkPQxtvMwDQYJKoZIhvcNAQEL
-BQAwMzExMC8GA1UEAxMoVmF1bHQgVGVzdGluZyBJbnRlcm1lZGlhdGUgU3ViIEF1
-dGhvcml0eTAeFw0xNjA5MjcwMDA5MTNaFw0xNjA5MjcwMTA5NDNaMBsxGTAXBgNV
-BAMTEGJsYWguZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDJAYB04IVdmSC/TimaA6BbXlvgBTZHL5wBUTmO4iHhenL0eDEXVe2Fd7Yq
-75LiBJmcC96hKbqh5rwS8KwN9ElZI52/mSMC+IvoNlYHAf7shwfsjrVx3q7/bTFg
-lz6wECn1ugysxynmMvgQD/pliRkxTQ7RMh4Qlh75YG3R9BHy9ZddklZp0aNaitts
-0uufHnN1UER/wxBCZdWTUu34KDL9I6yE7Br0slKKHPdEsGlFcMkbZhvjslZ7DGvO
-974S0qtOdKiawJZbpNPg0foGZ3AxesDUlkHmmgzUNes/sjknDYTHEfeXM6Uap0j6
-XvyhCxqdeahb/Vtibg0z9I0IusJbAgMBAAGjgY8wgYwwDgYDVR0PAQH/BAQDAgOo
-MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQU/5oy0rL7
-TT0wX7KZK7qcXqgayNwwHwYDVR0jBBgwFoAUgM37P8oXmA972ztLfw+b1eIY5now
-GwYDVR0RBBQwEoIQYmxhaC5leGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEA
-CT2vI6/taeLTw6ZulUhLXEXYXWZu1gF8n2COjZzbZXmHxQAoZ3GtnSNwacPHAyIj
-f3cA9Moo552y39LUtWk+wgFtQokWGK7LXglLaveNUBowOHq/xk0waiIinJcgTG53
-Z/qnbJnTjAOG7JwVJplWUIiS1avCksrHt7heE2EGRGJALqyLZ119+PW6ogtCLUv1
-X8RCTw/UkIF/LT+sLF0bXWy4Hn38Gjwj1MVv1l76cEGOVSHyrYkN+6AMnAP58L5+
-IWE9tN3oac4x7jhbuNpfxazIJ8Q6l/Up5U5Evfbh6N1DI0/gFCP20fMBkHwkuLfZ
-2ekZoSeCgFRDlHGkr7Vv9w==
------END CERTIFICATE-----
-issuing_ca          -----BEGIN CERTIFICATE-----
-MIIDijCCAnKgAwIBAgIUB28DoGwgGFKL7fbOu9S4FalHLn0wDQYJKoZIhvcNAQEL
-BQAwLzEtMCsGA1UEAxMkVmF1bHQgVGVzdGluZyBJbnRlcm1lZGlhdGUgQXV0aG9y
-aXR5MB4XDTE2MDkyNzAwMDgyMVoXDTI2MDkxNjE2MDg1MVowMzExMC8GA1UEAxMo
-VmF1bHQgVGVzdGluZyBJbnRlcm1lZGlhdGUgU3ViIEF1dGhvcml0eTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAOSCiSij4wy1wiMwvZt+rtU3IaO6ZTn9
-LfIPuGsR5/QSJk37pCZQco1LgoE/rTl+/xu3bDovyHDmgObghC6rzVOX2Tpi7kD+
-DOZpqxOsaS8ebYgxB/XJTSxyEJuSAcpSNLqqAiZivuQXdaD0N7H3Or0awwmKE9mD
-I0g8CF4fPDmuuOG0ASn9fMqXVVt5tXtEqZ9yJYfNOXx3FOPjRVOZf+kvSc31wCKe
-i/KmR0AQOmToKMzq988nLqFPTi9KZB8sEU20cGFeTQFol+m3FTcIru94EPD+nLUn
-xtlLELVspYb/PP3VpvRj9b+DY8FGJ5nfSJl7Rkje+CD4VxJpSadin3kCAwEAAaOB
-mTCBljAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
-gM37P8oXmA972ztLfw+b1eIY5nowHwYDVR0jBBgwFoAUj4YAIxRwrBy0QMRKLnD0
-kVidIuYwMwYDVR0RBCwwKoIoVmF1bHQgVGVzdGluZyBJbnRlcm1lZGlhdGUgU3Vi
-IEF1dGhvcml0eTANBgkqhkiG9w0BAQsFAAOCAQEAA4buJuPNJvA1kiATLw1dVU2J
-HPubk2Kp26Mg+GwLn7Vz45Ub133JCYfF3/zXLFZZ5Yub9gWTtjScrvNfQTAbNGdQ
-BdnUlMmIRmfB7bfckhryR2R9byumeHATgNKZF7h8liNHI7X8tTzZGs6wPdXOLlzR
-TlM3m1RNK8pbSPOkfPb06w9cBRlD8OAbNtJmuypXA6tYyiiMYBhP0QLAO3i4m1ns
-aAjAgEjtkB1rQxW5DxoTArZ0asiIdmIcIGmsVxfDQIjFlRxAkafMs74v+5U5gbBX
-wsOledU0fLl8KLq8W3OXqJwhGLK65fscrP0/omPAcFgzXf+L4VUADM4XhW6Xyg==
------END CERTIFICATE-----
-ca_chain            [-----BEGIN CERTIFICATE-----
-MIIDijCCAnKgAwIBAgIUB28DoGwgGFKL7fbOu9S4FalHLn0wDQYJKoZIhvcNAQEL
-BQAwLzEtMCsGA1UEAxMkVmF1bHQgVGVzdGluZyBJbnRlcm1lZGlhdGUgQXV0aG9y
-aXR5MB4XDTE2MDkyNzAwMDgyMVoXDTI2MDkxNjE2MDg1MVowMzExMC8GA1UEAxMo
-VmF1bHQgVGVzdGluZyBJbnRlcm1lZGlhdGUgU3ViIEF1dGhvcml0eTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAOSCiSij4wy1wiMwvZt+rtU3IaO6ZTn9
-LfIPuGsR5/QSJk37pCZQco1LgoE/rTl+/xu3bDovyHDmgObghC6rzVOX2Tpi7kD+
-DOZpqxOsaS8ebYgxB/XJTSxyEJuSAcpSNLqqAiZivuQXdaD0N7H3Or0awwmKE9mD
-I0g8CF4fPDmuuOG0ASn9fMqXVVt5tXtEqZ9yJYfNOXx3FOPjRVOZf+kvSc31wCKe
-i/KmR0AQOmToKMzq988nLqFPTi9KZB8sEU20cGFeTQFol+m3FTcIru94EPD+nLUn
-xtlLELVspYb/PP3VpvRj9b+DY8FGJ5nfSJl7Rkje+CD4VxJpSadin3kCAwEAAaOB
-mTCBljAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU
-gM37P8oXmA972ztLfw+b1eIY5nowHwYDVR0jBBgwFoAUj4YAIxRwrBy0QMRKLnD0
-kVidIuYwMwYDVR0RBCwwKoIoVmF1bHQgVGVzdGluZyBJbnRlcm1lZGlhdGUgU3Vi
-IEF1dGhvcml0eTANBgkqhkiG9w0BAQsFAAOCAQEAA4buJuPNJvA1kiATLw1dVU2J
-HPubk2Kp26Mg+GwLn7Vz45Ub133JCYfF3/zXLFZZ5Yub9gWTtjScrvNfQTAbNGdQ
-BdnUlMmIRmfB7bfckhryR2R9byumeHATgNKZF7h8liNHI7X8tTzZGs6wPdXOLlzR
-TlM3m1RNK8pbSPOkfPb06w9cBRlD8OAbNtJmuypXA6tYyiiMYBhP0QLAO3i4m1ns
-aAjAgEjtkB1rQxW5DxoTArZ0asiIdmIcIGmsVxfDQIjFlRxAkafMs74v+5U5gbBX
-wsOledU0fLl8KLq8W3OXqJwhGLK65fscrP0/omPAcFgzXf+L4VUADM4XhW6Xyg==
------END CERTIFICATE-----]
-private_key         -----BEGIN RSA PRIVATE KEY-----
-MIIEpgIBAAKCAQEAyQGAdOCFXZkgv04pmgOgW15b4AU2Ry+cAVE5juIh4Xpy9Hgx
-F1XthXe2Ku+S4gSZnAveoSm6oea8EvCsDfRJWSOdv5kjAviL6DZWBwH+7IcH7I61
-cd6u/20xYJc+sBAp9boMrMcp5jL4EA/6ZYkZMU0O0TIeEJYe+WBt0fQR8vWXXZJW
-adGjWorbbNLrnx5zdVBEf8MQQmXVk1Lt+Cgy/SOshOwa9LJSihz3RLBpRXDJG2Yb
-47JWewxrzve+EtKrTnSomsCWW6TT4NH6BmdwMXrA1JZB5poM1DXrP7I5Jw2ExxH3
-lzOlGqdI+l78oQsanXmoW/1bYm4NM/SNCLrCWwIDAQABAoIBAQCCbHMJY1Wl8eIJ
-v5HG2WuHXaaHqVoavo2fXTDXwWryfx1v+zz/Q0YnQBH3shPAi/OQCTOfpw/uVWTb
-dUZul3+wUyfcVmUdXGCLgBY53dWna8Z8e+zHwhISsqtDXV/TpelUBDCNO324XIIR
-Cg0TLO4nyzQ+ESLo6D+Y2DTp8lBjMEkmKTd8CLXR2ycEoVykN98qPZm8keiLGO91
-I8K7aRd8uOyQ6HUfJRlzFHSuwaLReErxGTEPI4t/wVqh2nP2gGBsn3apiJ0ul6Jz
-NlYO5PqiwpeDk4ibhQBpicnm1jnEcynH/WtGuKgMNB0M4SBRBsEguO7WoKx3o+qZ
-iVIaPWDhAoGBAO05UBvyJpAcz/ZNQlaF0EAOhoxNQ3h6+6ZYUE52PgZ/DHftyJPI
-Y+JJNclY91wn91Yk3ROrDi8gqhzA+2Lelxo1kuZDu+m+bpzhVUdJia7tZDNzRIhI
-24eP2GdochooOZ0qjvrik4kuX43amBhQ4RHsBjmX5CnUlL5ZULs8v2xnAoGBANjq
-VLAwiIIqJZEC6BuBvVYKaRWkBCAXvQ3j/OqxHRYu3P68PZ58Q7HrhrCuyQHTph2v
-fzfmEMPbSCrFIrrMRmjUG8wopL7GjZjFl8HOBHFwzFiz+CT5DEC+IJIRkp4HM8F/
-PAzjB2wCdRdSjLTD5ph0/xQIg5xfln7D+wqU0QHtAoGBAKkLF0/ivaIiNftw0J3x
-WxXag/yErlizYpIGCqvuzII6lLr9YdoViT/eJYrmb9Zm0HS9biCu2zuwDijRSBIL
-RieyF40opUaKoi3+0JMtDwTtO2MCd8qaCH3QfkgqAG0tTuj1Q8/6F2JA/myKYamq
-MMhhpYny9+7rAlemM8ZJIqtvAoGBAKOI3zpKDNCdd98A4v7B7H2usZUIJ7gOTZDo
-XqiNyRENWb2PK6GNq/e6SrxvuclvyKA+zFnXULJoYtsj7tAH69lieGaOCc5uoRgZ
-eBU7/euMj/McE6vEO3GgJawaJYCQi3uJMjvA+bp7i81+hehOfU5ZfmmbFaZSBoMh
-u+U5Vu3tAoGBANnBIbHfD3E7rqnqdpH1oRRHLA1VdghzEKgyUTPHNDzPJG87RY3c
-rRqeXepblud3qFjD60xS9BzcBijOvZ4+KHk6VIMpkyqoeNVFCJbBVCw+JGMp88+v
-e9t+2iwryh5+rnq+pg6anmgwHldptJc1XEFZA2UUQ89RP7kOGQF6IkIS
------END RSA PRIVATE KEY-----
-private_key_type    rsa
-serial_number       3e:20:32:c6:af:a7:20:4e:b1:95:67:fb:86:bc:cb:90:f4:31:b6:f3
-```
-
-Vault has now generated a new set of credentials using the `example-dot-com`
-role configuration. Here we see the dynamically generated private key and
-certificate. The issuing CA certificate and CA trust chain are returned as well.
-The CA Chain returns all the intermediate authorities in the trust chain. The root
-authority is not included since that will usually be trusted by the underlying
-OS.
-
-## Tutorial
-
-Refer to the [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
-guide for a step-by-step tutorial.
-
-Have a look at the [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
-for more about how to use externally managed keys with PKI.
-
-## API
-
-The PKI secrets engine has a full HTTP API. Please see the
-[PKI secrets engine API](/vault/api-docs/secret/pki) for more
-details.
diff --git a/website/content/docs/secrets/pki/quick-start-root-ca.mdx b/website/content/docs/secrets/pki/quick-start-root-ca.mdx
deleted file mode 100644
index ac17d1be5a6..00000000000
--- a/website/content/docs/secrets/pki/quick-start-root-ca.mdx
+++ /dev/null
@@ -1,229 +0,0 @@
----
-layout: docs
-page_title: 'PKI - Secrets Engines: Quick Start: Root CA Setup'
-description: The PKI secrets engine for Vault generates TLS certificates.
----
-
-# PKI secrets engine - quick start - root CA setup
-
-This document provides a brief overview of setting up a Vault PKI Secrets
-Engine with a Root CA certificate.
-
-#### Mount the backend
-
-The first step to using the PKI backend is to mount it. Unlike the `kv`
-backend, the `pki` backend is not mounted by default.
-
-```shell-session
-$ vault secrets enable pki
-Successfully mounted 'pki' at 'pki'!
-```
-
-#### Configure a CA certificate
-
-Next, Vault must be configured with a CA certificate and associated private
-key. We'll take advantage of the backend's self-signed root generation support,
-but Vault also supports generating an intermediate CA (with a CSR for signing)
-or setting a PEM-encoded certificate and private key bundle directly into the
-backend.
-
-Generally you'll want a root certificate to only be used to sign CA
-intermediate certificates, but for this example we'll proceed as if you will
-issue certificates directly from the root. As it's a root, we'll want to set a
-long maximum life time for the certificate; since it honors the maximum mount
-TTL, first we adjust that:
-
-```shell-session
-$ vault secrets tune -max-lease-ttl=87600h pki
-Successfully tuned mount 'pki'!
-```
-
-That sets the maximum TTL for secrets issued from the mount to 10 years. (Note
-that roles can further restrict the maximum TTL.)
-
-Now, we generate our root certificate:
-
-```shell-session
-$ vault write pki/root/generate/internal common_name=myvault.com ttl=87600h
-Key             Value
----             -----
-certificate     -----BEGIN CERTIFICATE-----
-MIIDNTCCAh2gAwIBAgIUJqrw/9EDZbp4DExaLjh0vSAHyBgwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLbXl2YXVsdC5jb20wHhcNMTcxMjA4MTkyMzIwWhcNMjcx
-MjA2MTkyMzQ5WjAWMRQwEgYDVQQDEwtteXZhdWx0LmNvbTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAKY/vJ6sRFym+yFYUneoVtDmOCaDKAQiGzQw0IXL
-wgMBBb82iKpYj5aQjXZGIl+VkVnCi+M2AQ/iYXWZf1kTAdle4A6OC4+VefSIa2b4
-eB7R8aiGTce62jB95+s5/YgrfIqk6igfpCSXYLE8ubNDA2/+cqvjhku1UzlvKBX2
-hIlgWkKlrsnybHN+B/3Usw9Km/87rzoDR3OMxLV55YPHiq6+olIfSSwKAPjH8LZm
-uM1ITLG3WQUl8ARF17Dj+wOKqbUG38PduVwKL5+qPksrvNwlmCP7Kmjncc6xnYp6
-5lfr7V4DC/UezrJYCIb0g/SvtxoN1OuqmmvSTKiEE7hVOAcCAwEAAaN7MHkwDgYD
-VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFECKdYM4gDbM
-kxRZA2wR4f/yNhQUMB8GA1UdIwQYMBaAFECKdYM4gDbMkxRZA2wR4f/yNhQUMBYG
-A1UdEQQPMA2CC215dmF1bHQuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQCCJKZPcjjn
-7mvD2+sr6lx4DW/vJwVSW8eTuLtOLNu6/aFhcgTY/OOB8q4n6iHuLrEt8/RV7RJI
-obRx74SfK9BcOLt4+DHGnFXqu2FNVnhDMOKarj41yGyXlJaQRUPYf6WJJLF+ZphN
-nNsZqHJHBfZtpJpE5Vywx3pah08B5yZHk1ItRPEz7EY3uwBI/CJoBb+P5Ahk6krc
-LZ62kFwstkVuFp43o3K7cRNexCIsZGx2tsyZ0nyqDUFsBr66xwUfn3C+/1CDc9YL
-zjq+8nI2ooIrj4ZKZCOm2fKd1KeGN/CZD7Ob6uNhXrd0Tjwv00a7nffvYQkl/1V5
-BT55jevSPVVu
------END CERTIFICATE-----
-expiration      1828121029
-issuing_ca      -----BEGIN CERTIFICATE-----
-MIIDNTCCAh2gAwIBAgIUJqrw/9EDZbp4DExaLjh0vSAHyBgwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLbXl2YXVsdC5jb20wHhcNMTcxMjA4MTkyMzIwWhcNMjcx
-MjA2MTkyMzQ5WjAWMRQwEgYDVQQDEwtteXZhdWx0LmNvbTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAKY/vJ6sRFym+yFYUneoVtDmOCaDKAQiGzQw0IXL
-wgMBBb82iKpYj5aQjXZGIl+VkVnCi+M2AQ/iYXWZf1kTAdle4A6OC4+VefSIa2b4
-eB7R8aiGTce62jB95+s5/YgrfIqk6igfpCSXYLE8ubNDA2/+cqvjhku1UzlvKBX2
-hIlgWkKlrsnybHN+B/3Usw9Km/87rzoDR3OMxLV55YPHiq6+olIfSSwKAPjH8LZm
-uM1ITLG3WQUl8ARF17Dj+wOKqbUG38PduVwKL5+qPksrvNwlmCP7Kmjncc6xnYp6
-5lfr7V4DC/UezrJYCIb0g/SvtxoN1OuqmmvSTKiEE7hVOAcCAwEAAaN7MHkwDgYD
-VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFECKdYM4gDbM
-kxRZA2wR4f/yNhQUMB8GA1UdIwQYMBaAFECKdYM4gDbMkxRZA2wR4f/yNhQUMBYG
-A1UdEQQPMA2CC215dmF1bHQuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQCCJKZPcjjn
-7mvD2+sr6lx4DW/vJwVSW8eTuLtOLNu6/aFhcgTY/OOB8q4n6iHuLrEt8/RV7RJI
-obRx74SfK9BcOLt4+DHGnFXqu2FNVnhDMOKarj41yGyXlJaQRUPYf6WJJLF+ZphN
-nNsZqHJHBfZtpJpE5Vywx3pah08B5yZHk1ItRPEz7EY3uwBI/CJoBb+P5Ahk6krc
-LZ62kFwstkVuFp43o3K7cRNexCIsZGx2tsyZ0nyqDUFsBr66xwUfn3C+/1CDc9YL
-zjq+8nI2ooIrj4ZKZCOm2fKd1KeGN/CZD7Ob6uNhXrd0Tjwv00a7nffvYQkl/1V5
-BT55jevSPVVu
------END CERTIFICATE-----
-serial_number   26:aa:f0:ff:d1:03:65:ba:78:0c:4c:5a:2e:38:74:bd:20:07:c8:18
-```
-
-The returned certificate is purely informational; it and its private key are
-safely stored in the backend mount.
-
-#### Set URL configuration
-
-Generated certificates can have the CRL location and the location of the
-issuing certificate encoded. These values must be set manually and typically to FQDN associated to the Vault server, but can be changed at any time.
-
-```shell-session
-$ vault write pki/config/urls issuing_certificates="http://vault.example.com:8200/v1/pki/ca" crl_distribution_points="http://vault.example.com:8200/v1/pki/crl"
-Success! Data written to: pki/ca/urls
-```
-
-#### Configure a role
-
-The next step is to configure a role. A role is a logical name that maps to a
-policy used to generate those credentials. For example, let's create an
-"example-dot-com" role:
-
-```shell-session
-$ vault write pki/roles/example-dot-com \
-    allowed_domains=example.com \
-    allow_subdomains=true max_ttl=72h
-Success! Data written to: pki/roles/example-dot-com
-```
-
-#### Issue certificates
-
-By writing to the `roles/example-dot-com` path we are defining the
-`example-dot-com` role. To generate a new certificate, we simply write
-to the `issue` endpoint with that role name: Vault is now configured to create
-and manage certificates!
-
-```shell-session
-$ vault write pki/issue/example-dot-com \
-    common_name=blah.example.com
-Key                 Value
----                 -----
-certificate         -----BEGIN CERTIFICATE-----
-MIIDvzCCAqegAwIBAgIUWQuvpMpA2ym36EoiYyf3Os5UeIowDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLbXl2YXVsdC5jb20wHhcNMTcxMjA4MTkyNDA1WhcNMTcx
-MjExMTkyNDM1WjAbMRkwFwYDVQQDExBibGFoLmV4YW1wbGUuY29tMIIBIjANBgkq
-hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1CU93lVgcLXGPxRGTRT3GM5wqytCo7Z6
-gjfoHyKoPCAqjRdjsYgp1FMvumNQKjUat5KTtr2fypbOnAURDCh4bN/omcj7eAqt
-ldJ8mf8CtKUaaJ1kp3R6RRFY/u96BnmKUG8G7oDeEDsKlXuEuRcNbGlGF8DaM/O1
-HFa57cM/8yFB26Nj5wBoG5Om6ee5+W+14Qee8AB6OJbsf883Z+zvhJTaB0QM4ZUq
-uAMoMVEutWhdI5EFm5OjtMeMu2U+iJl2XqqgQ/JmLRjRdMn1qd9TzTaVSnjoZ97s
-jHK444Px1m45einLqKUJ+Ia2ljXYkkItJj9Ut6ZSAP9fHlAtX84W3QIDAQABo4H/
-MIH8MA4GA1UdDwEB/wQEAwIDqDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH
-AwIwHQYDVR0OBBYEFH/YdObW6T94U0zuU5hBfTfU5pt1MB8GA1UdIwQYMBaAFECK
-dYM4gDbMkxRZA2wR4f/yNhQUMDsGCCsGAQUFBwEBBC8wLTArBggrBgEFBQcwAoYf
-aHR0cDovLzEyNy4wLjAuMTo4MjAwL3YxL3BraS9jYTAbBgNVHREEFDASghBibGFo
-LmV4YW1wbGUuY29tMDEGA1UdHwQqMCgwJqAkoCKGIGh0dHA6Ly8xMjcuMC4wLjE6
-ODIwMC92MS9wa2kvY3JsMA0GCSqGSIb3DQEBCwUAA4IBAQCDXbHV68VayweB2tkb
-KDdCaveaTULjCeJUnm9UT/6C0YqC/RxTAjdKFrilK49elOA3rAtEL6dmsDP2yH25
-ptqi2iU+y99HhZgu0zkS/p8elYN3+l+0O7pOxayYXBkFf5t0TlEWSTb7cW+Etz/c
-MvSqx6vVvspSjB0PsA3eBq0caZnUJv2u/TEiUe7PPY0UmrZxp/R/P/kE54yI3nWN
-4Cwto6yUwScOPbVR1d3hE2KU2toiVkEoOk17UyXWTokbG8rG0KLj99zu7my+Fyre
-sjV5nWGDSMZODEsGxHOC+JgNAC1z3n14/InFNOsHICnA5AnJzQdSQQjvcZHN2NyW
-+t4f
------END CERTIFICATE-----
-issuing_ca          -----BEGIN CERTIFICATE-----
-MIIDNTCCAh2gAwIBAgIUJqrw/9EDZbp4DExaLjh0vSAHyBgwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAxMLbXl2YXVsdC5jb20wHhcNMTcxMjA4MTkyMzIwWhcNMjcx
-MjA2MTkyMzQ5WjAWMRQwEgYDVQQDEwtteXZhdWx0LmNvbTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBAKY/vJ6sRFym+yFYUneoVtDmOCaDKAQiGzQw0IXL
-wgMBBb82iKpYj5aQjXZGIl+VkVnCi+M2AQ/iYXWZf1kTAdle4A6OC4+VefSIa2b4
-eB7R8aiGTce62jB95+s5/YgrfIqk6igfpCSXYLE8ubNDA2/+cqvjhku1UzlvKBX2
-hIlgWkKlrsnybHN+B/3Usw9Km/87rzoDR3OMxLV55YPHiq6+olIfSSwKAPjH8LZm
-uM1ITLG3WQUl8ARF17Dj+wOKqbUG38PduVwKL5+qPksrvNwlmCP7Kmjncc6xnYp6
-5lfr7V4DC/UezrJYCIb0g/SvtxoN1OuqmmvSTKiEE7hVOAcCAwEAAaN7MHkwDgYD
-VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFECKdYM4gDbM
-kxRZA2wR4f/yNhQUMB8GA1UdIwQYMBaAFECKdYM4gDbMkxRZA2wR4f/yNhQUMBYG
-A1UdEQQPMA2CC215dmF1bHQuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQCCJKZPcjjn
-7mvD2+sr6lx4DW/vJwVSW8eTuLtOLNu6/aFhcgTY/OOB8q4n6iHuLrEt8/RV7RJI
-obRx74SfK9BcOLt4+DHGnFXqu2FNVnhDMOKarj41yGyXlJaQRUPYf6WJJLF+ZphN
-nNsZqHJHBfZtpJpE5Vywx3pah08B5yZHk1ItRPEz7EY3uwBI/CJoBb+P5Ahk6krc
-LZ62kFwstkVuFp43o3K7cRNexCIsZGx2tsyZ0nyqDUFsBr66xwUfn3C+/1CDc9YL
-zjq+8nI2ooIrj4ZKZCOm2fKd1KeGN/CZD7Ob6uNhXrd0Tjwv00a7nffvYQkl/1V5
-BT55jevSPVVu
------END CERTIFICATE-----
-private_key         -----BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEA1CU93lVgcLXGPxRGTRT3GM5wqytCo7Z6gjfoHyKoPCAqjRdj
-sYgp1FMvumNQKjUat5KTtr2fypbOnAURDCh4bN/omcj7eAqtldJ8mf8CtKUaaJ1k
-p3R6RRFY/u96BnmKUG8G7oDeEDsKlXuEuRcNbGlGF8DaM/O1HFa57cM/8yFB26Nj
-5wBoG5Om6ee5+W+14Qee8AB6OJbsf883Z+zvhJTaB0QM4ZUquAMoMVEutWhdI5EF
-m5OjtMeMu2U+iJl2XqqgQ/JmLRjRdMn1qd9TzTaVSnjoZ97sjHK444Px1m45einL
-qKUJ+Ia2ljXYkkItJj9Ut6ZSAP9fHlAtX84W3QIDAQABAoIBAQCf5YIANfF+gkNt
-/+YM6yRi+hZJrU2I/1zPETxPW1vaFZR8y4hEoxCEDD8JCRm+9k+w1TWoorvxgkEv
-r1HuDALYbNtwLd/71nCHYCKyH1b2uQpyl07qOAyASlb9r5oVjz4E6eobkd3N9fJA
-QN0EdK+VarN968mLJsD3Hxb8chGdObBCQ+LO+zdqQLaz+JwhfnK98rm6huQtYK3w
-ccd0OwoVmtZz2eJl11TJkB9fi4WqJyxl4wST7QC80LstB1deR78oDmN5WUKU12+G
-4Mrgc1hRwUSm18HTTgAhaA4A3rjPyirBohb5Sf+jJxusnnay7tvWeMnIiRI9mqCE
-dr3tLrcxAoGBAPL+jHVUF6sxBqm6RTe8Ewg/8RrGmd69oB71QlVUrLYyC96E2s56
-19dcyt5U2z+F0u9wlwR1rMb2BJIXbxlNk+i87IHmpOjCMS38SPZYWLHKj02eGfvA
-MjKKqEjNY/md9eVAVZIWSEy63c4UcBK1qUH3/5PNlyjk53gCOI/4OXX/AoGBAN+A
-Alyd6A/pyHWq8WMyAlV18LnzX8XktJ07xrNmjbPGD5sEHp+Q9V33NitOZpu3bQL+
-gCNmcrodrbr9LBV83bkAOVJrf82SPaBesV+ATY7ZiWpqvHTmcoS7nglM2XTr+uWR
-Y9JGdpCE9U5QwTc6qfcn7Eqj7yNvvHMrT+1SHwsjAoGBALQyQEbhzYuOF7rV/26N
-ci+z+0A39vNO++b5Se+tk0apZlPlgb2NK3LxxR+LHevFed9GRzdvbGk/F7Se3CyP
-cxgswdazC6fwGjhX1mOYsG1oIU0V6X7f0FnaqWETrwf1M9yGEO78xzDfgozIazP0
-s0fQeR9KXsZcuaotO3TIRxRRAoGAMFIDsLRvDKm1rkL0B0czm/hwwDMu/KDyr5/R
-2M2OS1TB4PjmCgeUFOmyq3A63OWuStxtJboribOK8Qd1dXvWj/3NZtVY/z/j1P1E
-Ceq6We0MOZa0Ae4kyi+p/kbAKPgv+VwSoc6cKailRHZPH7quLoJSIt0IgbfRnXC6
-ygtcLNMCgYBwiPw2mTYvXDrAcO17NhK/r7IL7BEdFdx/w8vNJQp+Ub4OO3Iw6ARI
-vXxu6A+Qp50jra3UUtnI+hIirMS+XEeWqJghK1js3ZR6wA/ZkYZw5X1RYuPexb/4
-6befxmnEuGSbsgvGqYYTf5Z0vgsw4tAHfNS7TqSulYH06CjeG1F8DQ==
------END RSA PRIVATE KEY-----
-private_key_type    rsa
-serial_number       59:0b:af:a4:ca:40:db:29:b7:e8:4a:22:63:27:f7:3a:ce:54:78:8a
-```
-
-Vault has now generated a new set of credentials using the `example-dot-com`
-role configuration. Here we see the dynamically generated private key and
-certificate.
-
-Using ACLs, it is possible to restrict using the pki backend such that trusted
-operators can manage the role definitions, and both users and applications are
-restricted in the credentials they are allowed to read.
-
-If you get stuck at any time, simply run `vault path-help pki` or with a
-subpath for interactive help output.
-
-## Tutorial
-
-Refer to the [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
-guide for a step-by-step tutorial.
-
-Have a look at the [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
-for more about how to use externally managed keys with PKI.
-
-## API
-
-The PKI secrets engine has a full HTTP API. Please see the
-[PKI secrets engine API](/vault/api-docs/secret/pki) for more
-details.
diff --git a/website/content/docs/secrets/pki/rotation-primitives.mdx b/website/content/docs/secrets/pki/rotation-primitives.mdx
deleted file mode 100644
index 5217c31bac6..00000000000
--- a/website/content/docs/secrets/pki/rotation-primitives.mdx
+++ /dev/null
@@ -1,498 +0,0 @@
----
-layout: docs
-page_title: 'PKI - Secrets Engine: Rotation Primitives'
-description: The PKI secrets engine for Vault generates TLS certificates.
----
-
-# PKI secrets engine - rotation primitives
-
-Since Vault 1.11.0, Vault's PKI Secrets Engine supports multiple issuers in a
-single mount point. By using the certificate types below, rotation can be
-accomplished in various situations involving both root and intermediate CAs
-managed by Vault.
-
-## X.509 certificate fields
-
-X.509 is a complex specification; modern implementations tend to refer to
-[RFC 5280](https://datatracker.ietf.org/doc/html/rfc5280) for specific
-details. For validation of certificates, both RFC 5280 and the TLS
-validation [RFC 6125](https://datatracker.ietf.org/doc/html/rfc6125) are
-important for understanding how to achieve rotation.
-
-The following is a simplification of these standards for the purpose of
-this document.
-
-Every X.509 certificate begins with an asymmetric key pair, using an algorithm
-like RSA or ECDSA. This key pair is used to create a Certificate Signing
-Request (CSR), which contains a set of fields the requester would like in the
-final certificate (but, it is up to the Certificate Authority (CA) to decide what
-fields to take from the CSR and which to override). The CSR also contains the
-public key of the pair, which is signed by the private key of the key pair to
-prove possession. Usually, the requester would ask for attributes in the
-Subject field of the CSR or in the Subject Alternative Name extension CSR to
-be respected in the final certificate. It is up to the CA if these values are
-trusted or not. When approved by the issuing authority (which may be backed by
-this asymmetric key itself in the case of a root self-signed certificate), the
-authority attaches the Subject of _its_ certificate to the issued certificate in
-the Issuer field, assigns a unique serial number to the issued certificate, and
-signs the set of fields with its private key, thus creating the certificate.
-
-There are some important restrictions here:
-
- - One certificate can only have one Issuer, but this issuer is identified by
-   the Subject on the issuing certificate and its public key.
- - One key pair can be used for multiple certificates, but one certificate can
-   only have one backing key material.
-
-The following fields on the final certificate are relevant to rotation:
-
- - The backing [public](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.7)
-   and private key material (Subject Public Key Info).
-   - Note that the private key is not included in the certificate but is
-     uniquely determined by the public key material.
- - The [Subject](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6) of the certificate.
-   - This identifies the entity to which the certificate was issued. While the
-     SAN values (in the [Subject Alternative Name](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6)
-     extension) is useful when validating TLS Server certificates against the
-     negotiated hostname and URI, it isn't generally relevant for the purposes
-     of validating intermediate certificate chains or in rotation.
- - The [Validity](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5)
-   period of this certificate.
-   - Notably, RFC 5280 does not place any requirements around the issued
-     certificate's validity period relative to the validity period of the
-     issuing certificate. However, it [does state](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.5)
-     that certificates ought to be revoked if their status cannot be maintained
-     up to their notAfter date. This is why Vault 1.11's `/pki/issuer/:issuer_ref`
-     configuration endpoint maintains the `leaf_not_after_behavior` per-issuer
-     rather than per-role.
-   - Additionally, some browsers will place ultimate trust in the certificates
-     in their trust stores, even when these certificates are expired.
-     - Note that this only applies to certificates in the trust store; validity
-       periods will still be enforced for certificates not in the store (such
-       as intermediates).
- - The [Issuer](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.4) and
-   [signatureValue](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.1.3)
-   of this certificate.
-   - In the issued certificate's Issuer field, the issuing certificate places
-     its own Subject value. This allows the issuer to be identified later
-     (without having to try signature validation against every known local
-     certificate), when validating the presented certificate and chain.
-   - The signature over the entire certificate (by the issuer's private key)
-     is then placed in the signatureValue field.
- - The optional [Authority Key Identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1)
-   field.
-   - This field can contain either (or both) of two values:
-     - The hash of the issuer's public key. This extension is set and this
-       value is filled in by Vault.
-     - The Issuer's Subject and Serial Number. This value is not set by Vault.
-   - The latter is a dangerous restriction for the purposes of rotation: it
-     prevents cross-signing and reissuance as the new issuing certificates
-     (while having the same backing key material) will have different serial
-     numbers. See the [Limitations of Primitives](#limitations-of-primitives)
-     section below for more information on this restriction.
- - The [Serial Number](https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.2)
-   of this certificate.
-   - This field is unique to a specific issuer; when a certificate is
-     reissued by its parent authority, it will always have a different serial
-     number field.
- - The [CRL distribution](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.13)
-   point field.
-   - This is a field detailing where a CRL is expected to exist for this
-     certificate and under which CRL issuers (defaulting to the issuing
-     certificate itself) the CRL is expected to be signed by. This is mostly
-     informational and for server software like nginx, Vault's Cert Auth method,
-     and Apache, CRLs are provided to the server, rather than having the
-     server fetch CRLs for certificates automatically.
-   - Note that root certificates (in browsers trust stores) are generally not
-     considered revocable. However, if an intermediate is revoked by serial,
-     it will appear on its parent's CRL, and may prevent rotation from
-     happening.
-
-## X.509 rotation primitives
-
-Rotation (from an organizational standpoint) can only safely happen with
-certain intermediate X.509 certificates being issued. To distinguish the two
-types of certificates used to achieve rotation, this document notates them
-as _primitives_.
-
-Rotation of an end-entity certificate is trivial from an X.509 trust chain
-perspective; this process happens every day and should only depend on what is
-in the trust store and not the end-entity certificate itself. In Vault, the
-requester would hit the various issuance endpoints (`/pki/issue/:name` or
-`/pki/sign/:name` -- or use the unsafe `/pki/sign-verbatim`) and swap out the
-old certificate with the new certificate and reload the configuration or
-restart the service. Other parts of the organizations might use
-[ACME](https://datatracker.ietf.org/doc/html/rfc8555) for certificate issuance
-and rotation, especially if the service is public-facing (and thus needs to
-be issued by a Public CA). Given it was signed by a trusted root, any devices
-connecting to the service would not know the difference.
-
-Rotation of intermediate certificates is almost as easy. Assuming a decent
-operational setup (wherein during end-entity issuance, the full certificate
-chain is updated in the service's configuration), this should be as easy as
-creating a new intermediate CA, signing it against the root CA, and then
-beginning issuance against the new intermediate certificate. In Vault, if
-the intermediate is generated in an existing mount path (or is moved into
-such), the requesting entity shouldn't care much. Under ACME, Let's Encrypt
-has successfully rotated intermediates to present a cross-signed chain
-([for older Android devices](https://letsencrypt.org/2020/12/21/extending-android-compatibility.html)).
-Assuming the old intermediate's parent(s) are still valid and trusted,
-certificates issued under old intermediates should continue to validate.
-
-The hard part of rotation--calling for the use of these primitives--is
-rotating root certificates. These live in every device's trust store and
-are hard to update from an organization-wide operational perspective.
-Unless the organization can swap out roots almost instantaneously and
-simultaneously (e.g., via an agent) with no missed devices, this process
-will likely span months.
-
-To make this process lower risk, there are various primitive certificate
-types that use the [above certificate fields](#x-509-certificate-fields).
-Key to their success is the following note:
-
-~> Note: While certificates are added to the trust store, it is ultimately
-   the associated key material that determines trust: two issuer certificates
-   with the same subject but different public keys cannot validate the same
-   leaf certificate; only if the keys are the same can this occur.
-
-### Cross-Signed primitive
-
-This is the most common type of rotation primitive. A common CSR is signed by
-two CAs, resulting in two certificates. These certificates must have the same
-Subject (but may have different Issuers and will have different Serial Numbers)
-and the same backing key material, to allow certificates they sign to be
-trusted by either variant.
-
-Note that, due to restrictions in how end-entity certificates are used and
-validated (services and validation libraries expect only one), cross-signing
-most typically only applies to intermediate.
-
-#### A note on Cross-Signed roots
-
-Technically, cross-signing can occur between two roots, allowing trust bundles
-with either root to validate certs issued through the other. However, this
-process creates a certificate that is effectively an intermediate (as it is
-no longer self-signed) and usually must be served alongside the trust chain.
-Given this restriction, it's preferable to instead cross-sign the top-level
-intermediates under the root unless strictly necessary when the old root
-certificate has been used to directly issue leaf certificates.
-
-So, the rest of this process flow assumes an intermediate is being
-cross-signed as this is more common.
-
-##### Process flow
-
-```
-        -------------------
-       | generate key pair | -------------> ...
-        -------------------                 ...
-           |            |                   ...
- --------------        --------------       ...
-| generate CSR |      | generate CSR |      ...
- --------------        --------------       ...
-         |                   |              ...
-    -----------         -----------         ...
-   | signed by |       | signed by |        ...
-   | root A    |       | root B    |        ...
-    -----------         -----------         ...
-```
-
-Here, a key pair was generated at some point in time. Two CSRs are created and
-sent to two different root authorities (Root A and Root B). These result in two
-separate certificates (potentially with different validity periods) with the
-same Subject and same backing key material.
-
-Note that this cross-signing need not happen simultaneously; there could be a
-gap of several years between the first and second certificate. Additionally,
-there's no limit on the number of cross-signed "duplicate" (used loosely--with
-the same subject and key material) certificates: this could be cross-signed
-by many different root certificates if necessary and desired.
-
-##### Certificate hierarchy
-
-```
- --------                                            --------
-| root A |                                          | root B |
- --------                                            --------
-   |                                                      |
- ----------------                            ----------------
-| intermediate C |  <- same key material -> | intermediate D |
- ----------------              |             ----------------
-                               |
-                      -------------------
-                     | leaf certificates |
-                      -------------------
-```
-
-The above process results in two trust paths: either of root A or root B (or
-both) could exist in the client's trust stores and the leaf certificate would
-validate correctly. Because the same key material is used for both intermediate
-certificates (C and D), the issued leaf certificate's signature field would
-be the same regardless of which intermediate was contacted.
-
-Cross-signing is thus a unifying primitive; two separate trust paths now join
-into a single one, by having leaf certificate's issuer field to point to two
-separate paths (via duplication of the certificate in the chain) and would be
-conditionally validated based on which root is present in the trust store.
-
-This construct is documented and used in several places:
-
- - https://letsencrypt.org/certificates/
- - https://scotthelme.co.uk/cross-signing-alternate-trust-paths-how-they-work/
- - https://security.stackexchange.com/questions/14043/what-is-the-use-of-cross-signing-certificates-in-x-509
-
-#### Execution in Vault
-
-To create a cross-signed certificate in Vault, use the [`/intermediate/cross-sign`
-endpoint](/vault/api-docs/secret/pki#generate-intermediate-csr). Here, when creating
-a cross-signature to all `cert B` to be validated by `cert A`, provide the values
-(`key_ref`, all Subject parts, &c) for `cert B` during intermediate generation.
-Then sign this CSR (using the [`/issuer/:issuer_ref/sign-intermediate`
-endpoint](/vault/api-docs/secret/pki#sign-intermediate)) with `cert A`'s reference
-and provide necessary values from `cert B` (e.g., Subject parts). `cert A` may
-live outside Vault. Finally, import the cross-signed certificate into Vault
-[using the `/issuers/import/cert` endpoint](/vault/api-docs/secret/pki#import-ca-certificates-and-keys).
-
-If this process succeeded, and both `cert A` and `cert B` and their key
-material lives in Vault, the newly imported cross-signed certificate
-will have a `ca_chain` response field [during read](/vault/api-docs/secret/pki#read-issuer)
-containing `cert A`, and `cert B`'s `ca_chain` will contain the cross-signed
-cert and its `ca_chain` value.
-
-~> Note: Regardless of issuer type, is important to provide all relevant
-   parameters as they were originally; Vault does not infer e.g., the Subject
-   name parameters from the existing issuer; it merely reuses the same key
-   material.
-
-##### Notes on `manual_chain`
-
-If an intermediate is cross-signed and imported into the same mount as its
-pair, Vault will not detect the cross-signed pairs during automatic chain
-building. As a result, leaf issuance will have a chain that only includes
-one of these pairs of chains. This is because the leaf issuance's `ca_chain`
-parameter copies the value from signing issuer directly, rather than computing
-its own copy of the chain.
-
-To fix this, update the `manual_chain` field on the [issuers](/vault/api-docs/secret/pki#update-issuer)
-to include the chains of both pairs. For instance, given `intA` signed by
-`rootA` and `intB` signed by `rootB` as its cross-signed version, one
-could do the following:
-
-```
-$ vault patch pki/issuer/intA manual_chain=self,rootA,intB,rootB
-$ vault patch pki/issuer/intB manual_chain=self,rootB,intA,rootA
-```
-
-This will ensure that issuance with either copy of the intermediate reports
-the full cross-signed chain when signing leaf certs.
-
-### Reissuance primitive
-
-The second most common type of rotation primitive. In this scheme, the existing
-key material is used to generate a new certificate, usually at a much later
-point in time from the existing issuance.
-
-While similar to the cross-signed primitive, this one differs in that usually
-the reissuance happens after the original certificate expires or is close to
-expiration and is reissued by the original root CA. In the event of a
-self-signed certificate (e.g., a root certificate), this parent certificate
-would be itself. In both cases, this changes the contents of the certificate
-(due to the new serial number) but allows all existing leaf signatures to
-still validate.
-
-Unlike the cross-signed primitive, this primitive type can be used on all
-types of certificates (including leaves, intermediates, and roots).
-
-#### Process flow
-
-```
-          -------------------
-         | generate key pair | ---------------> ...
-          -------------------                   ...
-           |              |                     ...
- --------------           --------------        ...
-| generate CSR |   <->   | generate CSR |       ...
- --------------           --------------        ...
-         |                    |                 ...
- ------------------      ------------------     ...
-| signed by issuer | -> | signed by issuer | -> ...
- ------------------      ------------------     ...
-```
-
-In this process flow, a single key pair is generated at some point in time
-and stored. The CSR (with same requested fields) is generated from this
-common key material and signed by the same issuer at multiple points in
-time, preserving all critical fields (Subject, Issuer, &c). While there is
-strictly no limit on the number of times a key can be reissued, at some point
-safety would dictate the key material should be rotated instead of being
-continually reissued.
-
-#### Certificate hierarchy
-
-```
-                          ------
-              -----------| root |-------------
-             /            ------              \
-             |                                |
- ---------------                           ---------------
-| original cert | <- same key material -> | reissued cert |
- ---------------              |            ---------------
-                              |
-                      -------------------
-                     | leaf certificates |
-                      -------------------
-```
-
-Note that while this again results in two trust paths, depending on which
-intermediate certificate is presented and is still valid, only a root need be
-trusted. When a reissued certificate is a root certificate, the issuance link is
-simply self-loop. But, in this case, note that both certificates are
-(technically) valid issuers of each other. This means it should be possible to
-provide a reissued root certificate in the TLS certificate chain and have it
-chain back to an existing root certificate in a trust store.
-
-This primitive type is thus an incrementing primitive; the life cycle of an
-existing key is extended into the future by issuing a new certificate with the
-same key material from the existing authority.
-
-#### Execution in Vault
-
-To create a reissued root certificate in Vault, use [`/issuers/generate/root/existing`
-endpoint](/vault/api-docs/secret/pki#generate-root). This allows the generation of a new
-root certificate with the existing key material (via the `key_ref` request parameter).
-If this process succeeded, when [reading the issuer](/vault/api-docs/secret/pki#read-issuer)
-(via `GET /issuer/:issuer_ref`), both issuers (old and reissued) will appear in
-each others' `ca_chain` response field (unless prevented so by a `manual_chain`
-value).
-
-To create a reissued intermediate certificate in Vault, this is a three step
-process:
-
- 1. Use the [`/issuers/generate/intermediate/existing`
-    endpoint](/vault/api-docs/secret/pki#generate-intermediate-csr)
-    to generate a new CSR with the existing key material with the `key_ref`
-    request parameter.
- 2. Sign this CSR via the same signing process under the same issuer. This
-    step is specific to the parent CA, which may or may not be Vault.
- 3. Finally, use the [`/intermediate/set-signed` endpoint](/vault/api-docs/secret/pki#import-ca-certificates-and-keys)
-    to import the signed certificate from step 2.
-
-If the process to reissue an intermediate certificate succeeded, when
-[reading the issuer](/vault/api-docs/secret/pki#read-issuer) (via
-`GET /issuer/:issuer_ref`), both issuers (old and reissued) will have
-the same `ca_chain` response field, except for the first entry (unless
-prevented so by a `manual_chain` value).
-
-~> Note: Regardless of issuer type, is important to provide all relevant
-   parameters as they were originally; Vault does not infer e.g., the Subject
-   name parameters from the existing issuer; it merely reuses the same key
-   material.
-
-### Temporal primitives
-
-We can use the above primitive types to rotate roots and intermediates to new
-keys and extend their lifetimes. This time-based rotation is what ultimately
-allows us to rotate root certificates.
-
-There's two main variants of this: a **forward** primitive, wherein an old
-certificate is used to bless new key material, and a **backwards** primitive,
-wherein a new certificate is used to bless old key material. Both of these
-primitives are independently used by Let's Encrypt in the aforementioned
-chain of trust document:
-
- - The link from DST Root CA X3 to ISRG Root X1 is an example of a forward
-   primitive.
- - The link from ISRG Root X1 to R3 (which was originally signed by DST Root
-   CA X3) is an example of a backwards primitive.
-
-For most organizations with a hierarchical structured CA setup, cross-signing
-all intermediates with both the new and old root CAs is sufficient for root
-rotation.
-
-However, for organizations which have directly issued leaf certificates from a
-root, the old root will need to be reissued under the new root (with shorter
-duration) to allow these certificates to continue to validate. This combines
-both of the above primitives (cross-signing and reissuance) into a single
-backwards primitive step. In the future, these organizations should probably
-move to a more standard, hierarchical setup.
-
-### Limitations of primitives
-
-The certificate's [Authority Key Identifier](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1)
-extension field may contain either or both of the issuer's keyIdentifier
-(a hash of the public key) or both the issuer's Subject and Serial Number
-fields. Generating certificates with the latter enabled (luckily not possible
-in Vault, especially so since Vault uses strictly random serial numbers)
-prevents building a proper cross-signed chain without re-issuing the same
-serial number, which will not work with most browsers' trust stores and
-validation engines, due to [caching of
-certificates](https://support.mozilla.org/en-US/kb/Certificate-contains-the-same-serial-number-as-another-certificate)
-used in successful validations. In the strictest sense, when using a
-cross-signing primitive (from a different CA), the intermediate could be reissued
-with the same serial number, assuming no previous certificate was issued by that
-CA with that serial. This does not work when using a reissuance primitive as these
-are technically the same authority and thus this authority must issue
-certificates with unique serial numbers.
-
-## Suggested root rotation procedure
-
-The following is a suggested process for achieving root rotation easily and
-without (outage) impact to the broader organization, assuming [best
-practices](/vault/docs/secrets/pki/considerations#use-a-ca-hierarchy) are
-being followed. Some adaption will be necessary.
-
-Note that this process takes time. How much time is dependent on the
-automation level and operational awareness of the organization.
-
-1. [Generate](/vault/api-docs/secret/pki#generate-root) the new root
-   certificate. For clarity, it is suggested to use a new common name
-   to distinguish it from the old root certificate. Key material need
-   not be the same.
-
-2. [Cross-sign](#cross-signed-primitive) all existing intermediates.
-   It is important to update the manual chain on the issuers as discussed
-   in that section, as we assume servers are configured to combine the
-   `certificate` field with the `ca_chain` field on renewal and issuance,
-   thus getting the cross-signed intermediates.
-
-3. Encourage rotation to pickup the new cross-signed intermediates. With
-   short-lived certificates, this should [happen
-   automatically](/vault/docs/secrets/pki/considerations#automate-leaf-certificate-renewal).
-   However, for some long-lived certs, it is suggested to rotate them
-   manually and proactively. This step takes time, and depends on the
-   types of certificates issued (e.g., server certs, code signing, or client
-   auth).
-
-4. Once _all_ chains have been updated, new systems can be brought online
-   with only the new root certificate, and connect to all existing systems.
-
-5. Existing systems can now be migrated with a one-shot root switch: the
-   new root can be added and the old root can be removed at the same time.
-   Assuming the above step 3 can be achieved in a reasonable amount of time,
-   this decreases the time it takes to move the majority of systems over to
-   fully using the new root and no longer trusting the old root. This step
-   also takes time, depending on how quickly the organization can migrate
-   roots and ensure all such systems are migrated. If some systems are
-   offline and only infrequently online (or, if they have hard-coded
-   certificate stores and need to reach obsolescence first), the organization
-   might not be ready to move on to future steps.
-
-6. At this point, since all systems now use the new root, it is safe to remove
-   or archive the old root and intermediates, updating the manual chain to
-   point strictly to the new intermediate+root.
-
-At this point, rotation is fully completed.
-
-## Tutorial
-
-Refer to the [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
-guide for a step-by-step tutorial.
-
-Have a look at the [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
-for more about how to use externally managed keys with PKI.
-
-## API
-
-The PKI secrets engine has a full HTTP API. Please see the
-[PKI secrets engine API](/vault/api-docs/secret/pki) for more
-details.
diff --git a/website/content/docs/secrets/pki/setup.mdx b/website/content/docs/secrets/pki/setup.mdx
deleted file mode 100644
index ef0a560012b..00000000000
--- a/website/content/docs/secrets/pki/setup.mdx
+++ /dev/null
@@ -1,120 +0,0 @@
----
-layout: docs
-page_title: 'PKI - Secrets Engines: Setup and Usage'
-description: The PKI secrets engine for Vault generates TLS certificates.
----
-
-# PKI secrets engine - setup and usage
-
-This document provides a brief overview of the setup and usage of the PKI
-Secrets Engine.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the PKI secrets engine:
-
-   ```text
-   $ vault secrets enable pki
-   Success! Enabled the pki secrets engine at: pki/
-   ```
-
-   By default, the secrets engine will mount at the name of the engine. To
-   enable the secrets engine at a different path, use the `-path` argument.
-
-1. Increase the TTL by tuning the secrets engine. The default value of 30 days may be too short, so increase it to 1 year:
-
-   ```text
-   $ vault secrets tune -max-lease-ttl=8760h pki
-   Success! Tuned the secrets engine at: pki/
-   ```
-
-   Note that individual roles can restrict this value to be shorter on a
-   per-certificate basis. This just configures the global maximum for this
-   secrets engine.
-
-1. Configure a CA certificate and private key. Vault can accept an existing key
-   pair, or it can generate its own self-signed root. In general, we recommend
-   maintaining your root CA outside of Vault and providing Vault a signed
-   intermediate CA.
-
-   ```text
-   $ vault write pki/root/generate/internal \
-       common_name=my-website.com \
-       ttl=8760h
-
-   Key              Value
-   ---              -----
-   certificate      -----BEGIN CERTIFICATE-----...
-   expiration       1536807433
-   issuing_ca       -----BEGIN CERTIFICATE-----...
-   serial_number    7c:f1:fb:2c:6e:4d:99:0e:82:1b:08:0a:81:ed:61:3e:1d:fa:f5:29
-   ```
-
-   The returned certificate is purely informative. The private key is safely
-   stored internally in Vault.
-
-1. Update the CRL location and issuing certificates. These values can be updated
-   in the future.
-
-   ```text
-   $ vault write pki/config/urls \
-       issuing_certificates="http://127.0.0.1:8200/v1/pki/ca" \
-       crl_distribution_points="http://127.0.0.1:8200/v1/pki/crl"
-   Success! Data written to: pki/config/urls
-   ```
-
-1. Configure a role that maps a name in Vault to a procedure for generating a
-   certificate. When users or machines generate credentials, they are generated
-   against this role:
-
-   ```text
-   $ vault write pki/roles/example-dot-com \
-       allowed_domains=my-website.com \
-       allow_subdomains=true \
-       max_ttl=72h
-   Success! Data written to: pki/roles/example-dot-com
-   ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by writing to the `/issue` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault write pki/issue/example-dot-com \
-        common_name=www.my-website.com
-
-    Key                 Value
-    ---                 -----
-    certificate         -----BEGIN CERTIFICATE-----...
-    issuing_ca          -----BEGIN CERTIFICATE-----...
-    private_key         -----BEGIN RSA PRIVATE KEY-----...
-    private_key_type    rsa
-    serial_number       1d:2e:c6:06:45:18:60:0e:23:d6:c5:17:43:c0:fe:46:ed:d1:50:be
-    ```
-
-    The output will include a dynamically generated private key and certificate
-    which corresponds to the given role and expires in 72h (as dictated by our
-    role definition). The issuing CA and trust chain is also returned for
-    automation simplicity.
-
-## Tutorial
-
-Refer to the [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
-guide for a step-by-step tutorial.
-
-Have a look at the [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
-for more about how to use externally managed keys with PKI.
-
-## API
-
-The PKI secrets engine has a full HTTP API. Please see the
-[PKI secrets engine API](/vault/api-docs/secret/pki) for more
-details.
diff --git a/website/content/docs/secrets/pki/troubleshooting-acme.mdx b/website/content/docs/secrets/pki/troubleshooting-acme.mdx
deleted file mode 100644
index 759dd8abcda..00000000000
--- a/website/content/docs/secrets/pki/troubleshooting-acme.mdx
+++ /dev/null
@@ -1,201 +0,0 @@
----
-layout: docs
-page_title: 'PKI - Secrets Engine: Troubleshooting ACME'
-description: Troubleshoot problems with ACME clients and Vault PKI Secrets Engine's ACME server.
----
-
-# Troubleshoot PKI Secrets Engine and ACME
-
-Solve common problems related to ACME client integration with Vault PKI
-Secrets Engine's ACME server.
-
-## Error: ACME feature requires local cluster 'path' field configuration to be set
-
-If ACME works on some nodes of a Vault Enterprise cluster but not on
-others, it likely means that the cluster address has not been set.
-
-### Symptoms
-
-When a Vault client reads the ACME config (`/config/acme`) on a
-Performance Secondary nodes or when an ACME client attempts to connect to a
-directory on this node, it will error with:
-
-> ACME feature requires local cluster 'path' field configuration to be set
-
-### Cause
-
-In most cases, cluster path errors mean that the required cluster address is
-not set in your cluster configuration parameter.
-
-### Resolution
-
-For each Performance Replication cluster, read the value of `/config/cluster`
-and ensure the `path` field is set. When it is missing, update the URL to
-point to this mount's path on a TLS-enabled address for this PR cluster; this
-domain may be a load balanced or a DNS round robin address. For example:
-
-```
-$ vault write pki/config/cluster path=https://cluster-b.vault.example.com/v1/pki
-```
-
-Once this is done, re-read the ACME configuration and make sure no warnings
-appear:
-
-```
-$ vault read pki/config/acme
-```
-
-## Error: Unable to register an account with the ACME server
-
-### Symptoms
-
-When registering a new account without an [External Account Binding
-(EAB)](/vault/api-docs/secret/pki#acme-external-account-bindings), the
-Vault Server rejects the request with a response like:
-
-> Unable to register an account with ACME server
-
-with further information provided in the debug logs (in the case of
-`certbot`):
-
-> Server requires external account binding.
-
-or, if the client incorrectly contacted the server, an error like:
-
-> The request must include a value for the 'externalAccountBinding' field
-
-In either case, a new account needs to be created with an EAB token created
-by Vault.
-
-### Cause
-
-If a server has been updated to require `eab_policy=always-required` in the
-[ACME configuration](/vault/api-docs/secret/pki#set-acme-configuration),
-new account registration (and reuse of existing accounts will fail).
-
-### Resolution
-
-Using a Vault token, [fetch a new external account
-binding](/vault/api-docs/secret/pki#get-acme-eab-binding-token) for
-the [desired directory](/vault/api-docs/v1.14.x/secret/pki#acme-directories):
-
-```
-$ vault write -f pki/roles/my-role-name/acme/new-eab
-...
-directory roles/my-role-name/acme/directory
-id        bc8088d9-3816-5177-ae8e-d8393265f7dd
-key       MHcCAQE... additional data elided ...
-...
-```
-
-Then pass this new EAB token into the ACME client. For example, with
-`certbot`:
-
-```
-$ certbot [... additional parameters ...] \
-    --server https://cluster-b.vault.example.com/v1/pki/roles/my-role-name/acme/directory \
-    --eab-kid bc8088d9-3816-5177-ae8e-d8393265f7dd \
-    --eab-hmac-key MHcCAQE... additional data elided ...
-```
-
-Ensure that the ACME directory passed to the ACME client matches that
-fetched from the Vault.
-
-## Error: Failed to verify eab
-
-### Symptoms
-
-When initializing a new account against this Vault server, the ACME client
-might error with a message like:
-
-> The client lacks sufficient authorization :: failed to verify eab
-
-This is caused by requesting an EAB from a directory not matching the
-one the client used.
-
-### Cause
-
-If an EAB account token is incorrectly used with the wrong directory, the
-ACME server will reject the request with an error about insufficient
-permissions.
-
-### Resolution
-
-Ensure the requested EAB token matches the directory. For a given directory
-at `/some/path/acme/directory`, fetch EAB tokens from
-`/some/path/amce/new-eab`. The remaining resolution steps are the same as
-for [debugging account registration
-failures](#debugging-account-registration-failures).
-
-## Error: ACME validation failed for `{challenge_id}`
-
-### Symptoms
-
-When viewing the Vault server logs or attempting to fetch a certificate via
-an ACME client, an error like:
-
-> ACME validation failed for a465a798-4400-6c17-6735-e1b38c23de38-tls-alpn-01: ...
-
-indicates that the server was unable to validate this challenge accepted
-by the client.
-
-### Cause
-
-Vault can not verify the server's identity through the client's requested
-[challenge type](/vault/api-docs/secret/pki#acme-challenge-types) (`dns-01`,
-`http-01`, or `tls-alpn-01`). Vault will not issue the certificate requested
-by the client.
-
-### Resolution
-
-Ensure that DNS is configured correctly from the Vault server's perspective,
-including setting [any custom DNS resolver](/vault/api-docs/secret/pki#dns_resolver).
-
-Ensure that any firewalls are set up to allow Vault to talk to the relevant
-systems (the DNS server in the case of `dns-01`, port 80 on the target
-machine for `http-01`, or port 443 on the target machine for `tls-alpn-01`
-challenges).
-
-## Error: The client lacks sufficient authorization: account in status: revoked
-
-### Symptoms
-
-When attempting to renew a certificate, the ACME client reports an error:
-
-> The client lacks sufficient authorization: account in status: revoked
-
-### Cause
-
-If you run a [manual tidy](/vault/api-docs/secret/pki#tidy_acme) or have
-[auto-tidy](/vault/api-docs/secret/pki#configure-automatic-tidy) enabled
-with `tidy_acme=true, Vault will periodically remove stale ACME accounts.
-
-Connections from clients using removed accounts will be rejected.
-
-### Resolution
-
-Refer to the ACME client's documentation for removing cached local
-configuration and setup a new account, specifying any EABs as required.
-
-## Get help
-
-Please provide the following information when contacting Hashicorp Support
-or filing a GitHub issue to help with our investigation and reproducibility:
-
- - ACME client name and version
- - ACME client logs and/or output
- - Vault server **DEBUG** level logs
-
-## Tutorial
-
-Refer to the [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
-guide for a step-by-step tutorial.
-
-Have a look at the [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
-for more about how to use externally managed keys with PKI.
-
-## API
-
-The PKI secrets engine has a full HTTP API. Please see the
-[PKI secrets engine API](/vault/api-docs/secret/pki) for more
-details.
diff --git a/website/content/docs/secrets/rabbitmq.mdx b/website/content/docs/secrets/rabbitmq.mdx
deleted file mode 100644
index 65d7418621f..00000000000
--- a/website/content/docs/secrets/rabbitmq.mdx
+++ /dev/null
@@ -1,101 +0,0 @@
----
-layout: docs
-page_title: RabbitMQ - Secrets Engines
-description: >-
-  The RabbitMQ secrets engine for Vault generates user credentials to access
-  RabbitMQ.
----
-
-# RabbitMQ secrets engine
-
-The RabbitMQ secrets engine generates user credentials dynamically based on
-configured permissions and virtual hosts. This means that services that need to
-access a virtual host no longer need to hardcode credentials.
-
-With every service accessing the messaging queue with unique credentials,
-auditing is much easier when questionable data access is discovered. Easily
-track issues down to a specific instance of a service based on the RabbitMQ
-username.
-
-Vault makes use both of its own internal revocation system as well as the
-deleting RabbitMQ users when creating RabbitMQ users to ensure that users become
-invalid within a reasonable time of the lease expiring.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1.  Enable the RabbitMQ secrets engine:
-
-    ```text
-    $ vault secrets enable rabbitmq
-    Success! Enabled the rabbitmq secrets engine at: rabbitmq/
-    ```
-
-    By default, the secrets engine will mount at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure the credentials that Vault uses to communicate with RabbitMQ to
-    generate credentials:
-
-    ```text
-    $ vault write rabbitmq/config/connection \
-        connection_uri="http://localhost:15672" \
-        username="admin" \
-        password="password"
-    Success! Data written to: rabbitmq/config/connection
-    ```
-
-    It is important that the Vault user have the administrator privilege to
-    manager users.
-
-1.  Configure a role that maps a name in Vault to virtual host permissions:
-
-    ```text
-    $ vault write rabbitmq/roles/my-role \
-        vhosts='{"/":{"write": ".*", "read": ".*"}}'
-    Success! Data written to: rabbitmq/roles/my-role
-    ```
-
-    By writing to the `roles/my-role` path we are defining the `my-role` role.
-    This role will be created by evaluating the given `vhosts`, `vhost_topics`
-    and `tags` statements. By default, no tags, no virtual hosts or topic
-    permissions are assigned to a role. If no topic permissions are defined
-    and the default authorisation backend is used, publishing to a topic
-    exchange or consuming from a topic is always authorised. You can read
-    more about [RabbitMQ management tags][rmq-perms]
-    and [RabbitMQ topic authorization][rmq-topics].
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new credential by reading from the `/creds` endpoint with the name
-    of the role:
-
-    ```text
-    $ vault read rabbitmq/creds/my-role
-    Key                Value
-    ---                -----
-    lease_id           rabbitmq/creds/my-role/I39Hu8XXOombof4wiK5bKMn9
-    lease_duration     768h
-    lease_renewable    true
-    password           3yNDBikgQvrkx2VA2zhq5IdSM7IWk1RyMYJr
-    username           root-39669250-3894-8032-c420-3d58483ebfc4
-    ```
-
-    Using ACLs, it is possible to restrict using the rabbitmq secrets engine
-    such that trusted operators can manage the role definitions, and both users
-    and applications are restricted in the credentials they are allowed to read.
-
-## API
-
-The RabbitMQ secrets engine has a full HTTP API. Please see the
-[RabbitMQ secrets engine API](/vault/api-docs/secret/rabbitmq) for more
-details.
-
-[rmq-perms]: https://www.rabbitmq.com/management.html#permissions
-[rmq-topics]: https://www.rabbitmq.com/access-control.html#topic-authorisation
diff --git a/website/content/docs/secrets/ssh/index.mdx b/website/content/docs/secrets/ssh/index.mdx
deleted file mode 100644
index c9fb4d26335..00000000000
--- a/website/content/docs/secrets/ssh/index.mdx
+++ /dev/null
@@ -1,36 +0,0 @@
----
-layout: docs
-page_title: SSH - Secrets Engines
-description: |-
-  The Vault SSH secrets engine provides secure authentication and authorization
-  for access to machines via the SSH protocol. There are two modes to the Vault
-  SSH secrets engine including signed SSH certificates and one-time passwords.
----
-
-# SSH secrets engine
-
-Name: `ssh`
-
-The Vault SSH secrets engine provides secure authentication and authorization
-for access to machines via the SSH protocol. The Vault SSH secrets engine helps
-manage access to machine infrastructure, providing several ways to issue SSH
-credentials.
-
-The Vault SSH secrets engine supports the following modes. Each mode is
-individually documented on its own page.
-
-- [Signed SSH Certificates](/vault/docs/secrets/ssh/signed-ssh-certificates)
-- [One-time SSH Passwords](/vault/docs/secrets/ssh/one-time-ssh-passwords)
-
-All guides assume a basic familiarity with the SSH protocol.
-
-## Removal of dynamic keys feature
-
-Per [Vault 1.12's deprecation notice page](/vault/docs/v1.12.x/deprecation),
-the dynamic keys functionality of this engine has been removed in Vault 1.13.
-
-## API
-
-The SSH secrets engine has a full HTTP API. Please see the
-[SSH secrets engine API](/vault/api-docs/secret/ssh) for more
-details.
diff --git a/website/content/docs/secrets/ssh/one-time-ssh-passwords.mdx b/website/content/docs/secrets/ssh/one-time-ssh-passwords.mdx
deleted file mode 100644
index 8d2ac5831fe..00000000000
--- a/website/content/docs/secrets/ssh/one-time-ssh-passwords.mdx
+++ /dev/null
@@ -1,120 +0,0 @@
----
-layout: docs
-page_title: One-Time SSH Passwords (OTP) - SSH - Secrets Engines
-description: |-
-  The One-Time SSH Password (OTP) SSH secrets engine type allows a Vault server
-  to issue a One-Time Password every time a client wants to SSH into a remote
-  host using a helper command on the remote host to perform verification.
----
-
-# One-Time SSH passwords
-
-The One-Time SSH Password (OTP) SSH secrets engine type allows a Vault server to
-issue a One-Time Password every time a client wants to SSH into a remote host
-using a helper command on the remote host to perform verification.
-
-An authenticated client requests credentials from the Vault server and, if
-authorized, is issued an OTP. When the client establishes an SSH connection to
-the desired remote host, the OTP used during SSH authentication is received by
-the Vault helper, which then validates the OTP with the Vault server. The Vault
-server then deletes this OTP, ensuring that it is only used once.
-
-Since the Vault server is contacted during SSH connection establishment, every
-login attempt and the correlating Vault lease information is logged to the audit
-secrets engine.
-
-See [Vault-SSH-Helper](https://github.com/hashicorp/vault-ssh-helper) for
-details on the helper.
-
-This page will show a quick start for this secrets engine. For detailed
-documentation on every path, use `vault path-help` after mounting the secrets
-engine.
-
-### Drawbacks
-
-The main concern with the OTP secrets engine type is the remote host's
-connection to Vault; if compromised, an attacker could spoof the Vault server
-returning a successful request. This risk can be mitigated by using TLS for the
-connection to Vault and checking certificate validity; future enhancements to
-this secrets engine may allow for extra security on top of what TLS provides.
-
-### Mount the secrets engine
-
-```shell-session
-$ vault secrets enable ssh
-Successfully mounted 'ssh' at 'ssh'!
-```
-
-### Create a role
-
-Create a role with the `key_type` parameter set to `otp`. All of the machines
-represented by the role's CIDR list should have helper properly installed and
-configured.
-
-```shell-session
-$ vault write ssh/roles/otp_key_role \
-    key_type=otp \
-    default_user=username \
-    cidr_list=x.x.x.x/y,m.m.m.m/n
-Success! Data written to: ssh/roles/otp_key_role
-```
-
-### Create a credential
-
-Create an OTP credential for an IP of the remote host that belongs to
-`otp_key_role`.
-
-```shell-session
-$ vault write ssh/creds/otp_key_role ip=x.x.x.x
-Key            	Value
-lease_id       	ssh/creds/otp_key_role/73bbf513-9606-4bec-816c-5a2f009765a5
-lease_duration 	600
-lease_renewable	false
-port           	22
-username       	username
-ip             	x.x.x.x
-key            	2f7e25a2-24c9-4b7b-0d35-27d5e5203a5c
-key_type       	otp
-```
-
-### Establish an SSH session
-
-```shell-session
-$ ssh username@x.x.x.x
-Password: <Enter OTP>
-username@x.x.x.x:~$
-```
-
-### Automate it!
-
-A single CLI command can be used to create a new OTP and invoke SSH with the
-correct parameters to connect to the host.
-
-```shell-session
-$ vault ssh -role otp_key_role -mode otp username@x.x.x.x
-OTP for the session is `b4d47e1b-4879-5f4e-ce5c-7988d7986f37`
-[Note: Install `sshpass` to automate typing in OTP]
-Password: <Enter OTP>
-```
-
-The OTP will be entered automatically using `sshpass` if it is installed.
-
-```shell-session
-$ vault ssh -role otp_key_role -mode otp -strict-host-key-checking=no username@x.x.x.x
-username@<IP of remote host>:~$
-```
-
-Note: `sshpass` cannot handle host key checking. Host key checking can be
-disabled by setting `-strict-host-key-checking=no`.
-
-## Tutorial
-
-Refer to the [SSH Secrets Engine: One-Time SSH
-Password](/vault/tutorials/secrets-management/ssh-otp) tutorial
-to learn how to use the Vault SSH secrets engine to secure authentication and authorization for access to machines.
-
-## API
-
-The SSH secrets engine has a full HTTP API. Please see the
-[SSH secrets engine API](/vault/api-docs/secret/ssh) for more
-details.
diff --git a/website/content/docs/secrets/ssh/signed-ssh-certificates.mdx b/website/content/docs/secrets/ssh/signed-ssh-certificates.mdx
deleted file mode 100644
index a46f0c27c65..00000000000
--- a/website/content/docs/secrets/ssh/signed-ssh-certificates.mdx
+++ /dev/null
@@ -1,543 +0,0 @@
----
-layout: docs
-page_title: Signed SSH Certificates - SSH - Secrets Engines
-description: >-
-  The signed SSH certificates is the simplest and most powerful in terms of
-
-  setup complexity and in terms of being platform agnostic. When using this
-
-  type, an SSH CA signing key is generated or configured at the secrets engine's
-  mount.
-
-  This key will be used to sign other SSH keys.
----
-
-# Signed SSH certificates
-
-The signed SSH certificates is the simplest and most powerful in terms of setup
-complexity and in terms of being platform agnostic. By leveraging Vault's
-powerful CA capabilities and functionality built into OpenSSH, clients can SSH
-into target hosts using their own local SSH keys.
-
-In this section, the term "**client**" refers to the person or machine
-performing the SSH operation. The "**host**" refers to the target machine. If
-this is confusing, substitute "client" with "user".
-
-This page will show a quick start for this secrets engine. For detailed documentation
-on every path, use `vault path-help` after mounting the secrets engine.
-
-## Client key signing
-
-Before a client can request their SSH key be signed, the Vault SSH secrets engine must
-be configured. Usually a Vault administrator or security team performs these
-steps. It is also possible to automate these actions using a configuration
-management tool like Chef, Puppet, Ansible, or Salt.
-
-### Signing key &amp; role configuration
-
-The following steps are performed in advance by a Vault administrator, security
-team, or configuration management tooling.
-
-1.  Mount the secrets engine. Like all secrets engines in Vault, the SSH secrets engine
-    must be mounted before use.
-
-    ```text
-    $ vault secrets enable -path=ssh-client-signer ssh
-    Successfully mounted 'ssh' at 'ssh-client-signer'!
-    ```
-
-    This enables the SSH secrets engine at the path "ssh-client-signer". It is
-    possible to mount the same secrets engine multiple times using different
-    `-path` arguments. The name "ssh-client-signer" is not special - it can be
-    any name, but this documentation will assume "ssh-client-signer".
-
-1.  Configure Vault with a CA for signing client keys using the `/config/ca`
-    endpoint. If you do not have an internal CA, Vault can generate a keypair for
-    you.
-
-    ```text
-    $ vault write ssh-client-signer/config/ca generate_signing_key=true
-    Key             Value
-    ---             -----
-    public_key      ssh-rsa AAAAB3NzaC1yc2EA...
-    ```
-
-    If you already have a keypair, specify the public and private key parts as
-    part of the payload:
-
-    ```text
-    $ vault write ssh-client-signer/config/ca \
-        private_key="..." \
-        public_key="..."
-    ```
-
-    Regardless of whether it is generated or uploaded, the client signer public
-    key is accessible via the API at the `/public_key` endpoint or the CLI (see next step).
-
-1.  Add the public key to all target host's SSH configuration. This process can
-    be manual or automated using a configuration management tool. The public key is
-    accessible via the API and does not require authentication.
-
-    ```text
-    $ curl -o /etc/ssh/trusted-user-ca-keys.pem http://127.0.0.1:8200/v1/ssh-client-signer/public_key
-    ```
-
-    ```text
-    $ vault read -field=public_key ssh-client-signer/config/ca > /etc/ssh/trusted-user-ca-keys.pem
-    ```
-
-    Add the path where the public key contents are stored to the SSH
-    configuration file as the `TrustedUserCAKeys` option.
-
-    ```text
-    # /etc/ssh/sshd_config
-    # ...
-    TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem
-    ```
-
-    Restart the SSH service to pick up the changes.
-
-1.  Create a named Vault role for signing client keys.
-
-    ~> **IMPORTANT NOTE:** Prior to Vault-1.9, if `"allowed_extensions"` is either empty or not specified in the role,
-    Vault will assume permissive defaults: any user assigned to the role may specify any arbitrary
-    extension values as part of the certificate request to the Vault server.
-    This may have significant impact on third-party systems that rely on an `extensions` field for security-critical information.
-    In those cases, consider using a template to specify default extensions, and explicitly setting
-    `"allowed_extensions"` to an arbitrary, non-empty string if the field is empty or not set.
-
-    Because of the way some SSH certificate features are implemented, options
-    are passed as a map. The following example adds the `permit-pty` extension
-    to the certificate, and allows the user to specify their own values for `permit-pty` and `permit-port-forwarding`
-    when requesting the certificate.
-
-    ```text
-    $ vault write ssh-client-signer/roles/my-role -<<"EOH"
-    {
-      "algorithm_signer": "rsa-sha2-256",
-      "allow_user_certificates": true,
-      "allowed_users": "*",
-      "allowed_extensions": "permit-pty,permit-port-forwarding",
-      "default_extensions": {
-        "permit-pty": ""
-      },
-      "key_type": "ca",
-      "default_user": "ubuntu",
-      "ttl": "30m0s"
-    }
-    EOH
-    ```
-
-### Client SSH authentication
-
-The following steps are performed by the client (user) that wants to
-authenticate to machines managed by Vault. These commands are usually run from
-the client's local workstation.
-
-1.  Locate or generate the SSH public key. Usually this is `~/.ssh/id_rsa.pub`.
-    If you do not have an SSH keypair, generate one:
-
-    ```text
-    $ ssh-keygen -t rsa -C "user@example.com"
-    ```
-
-1.  Ask Vault to sign your **public key**. This file usually ends in `.pub` and
-    the contents begin with `ssh-rsa ...`.
-
-    ```text
-    $ vault write ssh-client-signer/sign/my-role \
-        public_key=@$HOME/.ssh/id_rsa.pub
-
-    Key             Value
-    ---             -----
-    serial_number   c73f26d2340276aa
-    signed_key      ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1...
-    ```
-
-    The result will include the serial and the signed key. This signed key is
-    another public key.
-
-    To customize the signing options, use a JSON payload:
-
-    ```text
-    $ vault write ssh-client-signer/sign/my-role -<<"EOH"
-    {
-      "public_key": "ssh-rsa AAA...",
-      "valid_principals": "my-user",
-      "key_id": "custom-prefix",
-      "extensions": {
-        "permit-pty": "",
-        "permit-port-forwarding": ""
-      }
-    }
-    EOH
-    ```
-
-1.  Save the resulting signed, public key to disk. Limit permissions as needed.
-
-    ```text
-    $ vault write -field=signed_key ssh-client-signer/sign/my-role \
-        public_key=@$HOME/.ssh/id_rsa.pub > signed-cert.pub
-    ```
-
-    If you are saving the certificate directly beside your SSH keypair, suffix
-    the name with `-cert.pub` (`~/.ssh/id_rsa-cert.pub`). With this naming
-    scheme, OpenSSH will automatically use it during authentication.
-
-1.  (Optional) View enabled extensions, principals, and metadata of the signed
-    key.
-
-    ```text
-    $ ssh-keygen -Lf ~/.ssh/signed-cert.pub
-    ```
-
-1.  SSH into the host machine using the signed key. You must supply both the
-    signed public key from Vault **and** the corresponding private key as
-    authentication to the SSH call.
-
-    ```text
-    $ ssh -i signed-cert.pub -i ~/.ssh/id_rsa username@10.0.23.5
-    ```
-
-## Host key signing
-
-For an added layer of security, we recommend enabling host key signing. This is
-used in conjunction with client key signing to provide an additional integrity
-layer. When enabled, the SSH agent will verify the target host is valid and
-trusted before attempting to SSH. This will reduce the probability of a user
-accidentally SSHing into an unmanaged or malicious machine.
-
-### Signing key configuration
-
-1.  Mount the secrets engine. For the most security, mount at a different path from the
-    client signer.
-
-    ```text
-    $ vault secrets enable -path=ssh-host-signer ssh
-    Successfully mounted 'ssh' at 'ssh-host-signer'!
-    ```
-
-1.  Configure Vault with a CA for signing host keys using the `/config/ca`
-    endpoint. If you do not have an internal CA, Vault can generate a keypair for
-    you.
-
-    ```text
-    $ vault write ssh-host-signer/config/ca generate_signing_key=true
-    Key             Value
-    ---             -----
-    public_key      ssh-rsa AAAAB3NzaC1yc2EA...
-    ```
-
-    If you already have a keypair, specify the public and private key parts as
-    part of the payload:
-
-    ```text
-    $ vault write ssh-host-signer/config/ca \
-        private_key="..." \
-        public_key="..."
-    ```
-
-    Regardless of whether it is generated or uploaded, the host signer public
-    key is accessible via the API at the `/public_key` endpoint.
-
-1.  Extend host key certificate TTLs.
-
-    ```text
-    $ vault secrets tune -max-lease-ttl=87600h ssh-host-signer
-    ```
-
-1.  Create a role for signing host keys. Be sure to fill in the list of allowed
-    domains, set `allow_bare_domains`, or both.
-
-    ```text
-    $ vault write ssh-host-signer/roles/hostrole \
-        key_type=ca \
-        algorithm_signer=rsa-sha2-256 \
-        ttl=87600h \
-        allow_host_certificates=true \
-        allowed_domains="localdomain,example.com" \
-        allow_subdomains=true
-    ```
-
-1.  Sign the host's SSH public key.
-
-    ```text
-    $ vault write ssh-host-signer/sign/hostrole \
-        cert_type=host \
-        public_key=@/etc/ssh/ssh_host_rsa_key.pub
-    Key             Value
-    ---             -----
-    serial_number   3746eb17371540d9
-    signed_key      ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1y...
-    ```
-
-1.  Set the resulting signed certificate as `HostCertificate` in the SSH
-    configuration on the host machine.
-
-    ```text
-    $ vault write -field=signed_key ssh-host-signer/sign/hostrole \
-        cert_type=host \
-        public_key=@/etc/ssh/ssh_host_rsa_key.pub > /etc/ssh/ssh_host_rsa_key-cert.pub
-    ```
-
-    Set permissions on the certificate to be `0640`:
-
-    ```text
-    $ chmod 0640 /etc/ssh/ssh_host_rsa_key-cert.pub
-    ```
-
-    Add host key and host certificate to the SSH configuration file.
-
-    ```text
-    # /etc/ssh/sshd_config
-    # ...
-
-    # For client keys
-    TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem
-
-    # For host keys
-    HostKey /etc/ssh/ssh_host_rsa_key
-    HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
-    ```
-
-    Restart the SSH service to pick up the changes.
-
-### Client-Side host verification
-
-1.  Retrieve the host signing CA public key to validate the host signature of
-    target machines.
-
-    ```text
-    $ curl http://127.0.0.1:8200/v1/ssh-host-signer/public_key
-    ```
-
-    ```text
-    $ vault read -field=public_key ssh-host-signer/config/ca
-    ```
-
-1.  Add the resulting public key to the `known_hosts` file with authority.
-
-    ```text
-    # ~/.ssh/known_hosts
-    @cert-authority *.example.com ssh-rsa AAAAB3NzaC1yc2EAAA...
-    ```
-
-1.  SSH into target machines as usual.
-
-## Troubleshooting
-
-When initially configuring this type of key signing, enable `VERBOSE` SSH
-logging to help annotate any errors in the log.
-
-```text
-# /etc/ssh/sshd_config
-# ...
-LogLevel VERBOSE
-```
-
-Restart SSH after making these changes.
-
-By default, SSH logs to `/var/log/auth.log`, but so do many other things. To
-extract just the SSH logs, use the following:
-
-```shell-session
-$ tail -f /var/log/auth.log | grep --line-buffered "sshd"
-```
-
-If you are unable to make a connection to the host, the SSH server logs may
-provide guidance and insights.
-
-### Name is not a listed principal
-
-If the `auth.log` displays the following messages:
-
-```text
-# /var/log/auth.log
-key_cert_check_authority: invalid certificate
-Certificate invalid: name is not a listed principal
-```
-
-The certificate does not permit the username as a listed principal for
-authenticating to the system. This is most likely due to an OpenSSH bug (see
-[known issues](#known-issues) for more information). This bug does not respect
-the `allowed_users` option value of "\*". Here are ways to work around this
-issue:
-
-1.  Set `default_user` in the role. If you are always authenticating as the same
-    user, set the `default_user` in the role to the username you are SSHing into the
-    target machine:
-
-    ```text
-    $ vault write ssh/roles/my-role -<<"EOH"
-    {
-      "default_user": "YOUR_USER",
-      // ...
-    }
-    EOH
-    ```
-
-1.  Set `valid_principals` during signing. In situations where multiple users may
-    be authenticating to SSH via Vault, set the list of valid principles during key
-    signing to include the current username:
-
-    ```text
-    $ vault write ssh-client-signer/sign/my-role -<<"EOH"
-    {
-      "valid_principals": "my-user"
-      // ...
-    }
-    EOH
-    ```
-
-### No prompt after login
-
-If you do not see a prompt after authenticating to the host machine, the signed
-certificate may not have the `permit-pty` extension. There are two ways to add
-this extension to the signed certificate.
-
-- As part of the role creation
-
-  ```text
-  $ vault write ssh-client-signer/roles/my-role -<<"EOH"
-  {
-    "default_extensions": {
-      "permit-pty": ""
-    }
-    // ...
-  }
-  EOH
-  ```
-
-- As part of the signing operation itself:
-
-  ```text
-  $ vault write ssh-client-signer/sign/my-role -<<"EOH"
-  {
-    "extensions": {
-      "permit-pty": ""
-    }
-    // ...
-  }
-  EOH
-  ```
-
-### No port forwarding
-
-If port forwarding from the guest to the host is not working, the signed
-certificate may not have the `permit-port-forwarding` extension. Add the
-extension as part of the role creation or signing process to enable port
-forwarding. See [no prompt after login](#no-prompt-after-login) for examples.
-
-```json
-{
-  "default_extensions": {
-    "permit-port-forwarding": ""
-  }
-}
-```
-
-### No x11 forwarding
-
-If X11 forwarding from the guest to the host is not working, the signed
-certificate may not have the `permit-X11-forwarding` extension. Add the
-extension as part of the role creation or signing process to enable X11
-forwarding. See [no prompt after login](#no-prompt-after-login) for examples.
-
-```json
-{
-  "default_extensions": {
-    "permit-X11-forwarding": ""
-  }
-}
-```
-
-### No agent forwarding
-
-If agent forwarding from the guest to the host is not working, the signed
-certificate may not have the `permit-agent-forwarding` extension. Add the
-extension as part of the role creation or signing process to enable agent
-forwarding. See [no prompt after login](#no-prompt-after-login) for examples.
-
-```json
-{
-  "default_extensions": {
-    "permit-agent-forwarding": ""
-  }
-}
-```
-
-### Key comments
-There are additional steps needed to preserve [comment attributes](https://www.rfc-editor.org/rfc/rfc4716#section-3.3.2)
-in keys which ought to be considered if they are required. Private and public 
-key may have comments applied to them and for example where `ssh-keygen` is used 
-with its `-C` parameter - similar to:
-
-```shell-session
-ssh-keygen -C "...Comments" -N "" -t rsa -b 4096 -f host-ca
-```
-
-Adapted key values containing comments must be provided with the key related 
-parameters as per the Vault CLI and API steps demonstrated below. 
-
-```shell-extension
-# Using CLI:
-vault secrets enable -path=hosts-ca ssh
-KEY_PRI=$(cat ~/.ssh/id_rsa | sed -z 's/\n/\\n/g')
-KEY_PUB=$(cat ~/.ssh/id_rsa.pub | sed -z 's/\n/\\n/g')
-# Create / update keypair in Vault
-vault write ssh-client-signer/config/ca \
-  generate_signing_key=false \
-  private_key="${KEY_PRI}" \
-  public_key="${KEY_PUB}"
-```
-
-```shell-extension
-# Using API:
-curl -X POST -H "X-Vault-Token: ..." -d '{"type":"ssh"}' http://127.0.0.1:8200/v1/sys/mounts/hosts-ca
-KEY_PRI=$(cat ~/.ssh/id_rsa | sed -z 's/\n/\\n/g')
-KEY_PUB=$(cat ~/.ssh/id_rsa.pub | sed -z 's/\n/\\n/g')
-tee payload.json <<EOF
-{
-  "generate_signing_key" : false,
-  "private_key"          : "${KEY_PRI}",
-  "public_key"           : "${KEY_PUB}"
-}
-EOF
-# Create / update keypair in Vault
-curl -X POST -H "X-Vault-Token: ..." -d @payload.json http://127.0.0.1:8200/v1/hosts-ca/config/ca
-```
-
-~> **IMPORTANT:** Do NOT add a private key password since Vault can't decrypt it.
-Destroy the keypair and `payload.json` from your hosts immediately after they have been confirmed as successfully uploaded.
-
-### Known issues
-- On SELinux-enforcing systems, you may need to adjust related types so that the
-  SSH daemon is able to read it. For example, adjust the signed host certificate
-  to be an `sshd_key_t` type.
-
-- On some versions of SSH, you may get the following error:
-
-  ```text
-  no separate private key for certificate
-  ```
-
-  This is a bug introduced in OpenSSH version 7.2 and fixed in 7.5. See
-  [OpenSSH bug 2617](https://bugzilla.mindrot.org/show_bug.cgi?id=2617) for
-  details.
-
-- On some versions of SSH, you may get the following error on target host:
-
-  ```text
-  userauth_pubkey: certificate signature algorithm ssh-rsa: signature algorithm not supported [preauth]
-  ```
-  Fix is to add below line to /etc/ssh/sshd_config
-  ```text
-  CASignatureAlgorithms ^ssh-rsa
-  ```
-  The ssh-rsa algorithm is no longer supported in [OpenSSH 8.2](https://www.openssh.com/txt/release-8.2)
-
-## API
-
-The SSH secrets engine has a full HTTP API. Please see the
-[SSH secrets engine API](/vault/api-docs/secret/ssh) for more
-details.
diff --git a/website/content/docs/secrets/terraform.mdx b/website/content/docs/secrets/terraform.mdx
deleted file mode 100644
index a61af98cc02..00000000000
--- a/website/content/docs/secrets/terraform.mdx
+++ /dev/null
@@ -1,171 +0,0 @@
----
-layout: docs
-page_title: Terraform Cloud Secret Backend
-description: The Terraform Cloud secret backend for Vault generates tokens for Terraform Cloud dynamically.
----
-
-# Terraform Cloud secret backend
-
-Name: `Terraform Cloud`
-
-The Terraform Cloud secret backend for Vault generates
-[Terraform Cloud](https://cloud.hashicorp.com/products/terraform)
-API tokens dynamically for Organizations, Teams, and Users.
-
-This page will show a quick start for this backend. For detailed documentation
-on every path, use `vault path-help` after mounting the backend.
-
-~> **Terraform Enterprise Support:** this secret engine supports both Terraform
-Cloud ([app.terraform.io](https://app.terraform.io/session)) as well as on-prem
-Terraform Enterprise. Any version requirements will be documented alongside the
-features that require them, if any.
-
-## Quick start
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1.  Enable the Terraform Cloud secrets engine:
-
-    ```shell-session
-    $ vault secrets enable terraform
-    Success! Enabled the terraform cloud secrets engine at: terraform/
-    ```
-
-    By default, the secrets engine will mount at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-2.  Configure Vault to connect and authenticate to Terraform Cloud:
-
-    ```shell-session
-    $ vault write terraform/config \
-        token=Vhz7652ba4c-0f6e-8e75-5724-5e083d72cfe4
-    Success! Data written to: terraform/config
-    ```
-
-    See [Terraform Cloud's documentation on API
-    tokens](/terraform/cloud-docs/users-teams-organizations/api-tokens)
-    to determine the appropriate API token for use with the secret engine. In
-    order to perform all operations, a User API token is recommended.
-
-3.  Configure a role that maps a name in Vault to a Terraform Cloud User. At
-    this time the Terraform Cloud API does not allow dynamic user generation. As
-    a result this secret engine creates dynamic API tokens for an existing user,
-    and manages the lifecycle of that API token. You will need to know the User
-    ID in order to generate User API tokens for that user. You can use the
-    Terraform Cloud [Account
-    API](/terraform/cloud-docs/api-docs/account) to find the
-    desired User ID.
-
-    ```shell-session
-    $ vault write terraform/role/my-role user_id=user-12345abcde
-    Success! Data written to: terraform/role/my-role
-    ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-Generate a new credential by reading from the `/creds` endpoint with the name
-of the role:
-
-```shell-session
-$ vault read terraform/creds/my-role
-Key                Value
----                -----
-lease_id           terraform/creds/my-user/A_LEASE_ID_PdvmJjACTtKrY2I
-lease_duration     180s
-lease_renewable    true
-token              TJFDSIFDSKFEKZX.FKFKA.akjlfdiouajlkdakadfiowe
-token_id           at-123acbdfask
-```
-
-## Organization, team, and user roles
-
-Terraform Cloud supports three distinct types of API tokens; Organizations,
-Teams, and Users. Each token type has distinct access levels and generation
-workflows. A given Vault role can manage any one of the three types at a time,
-however there are important differences to be aware of.
-
-### Organization and team roles
-
-The Terraform Cloud API limits both Organization and Team roles to **one active
-token at any given time**. Generating a new Organization or Team API token by
-reading the credentials in Vault or otherwise generating them on
-[app.terraform.io](https://app.terraform.io/session) will effectively revoke **any**
-existing API token for that Organization or Team.
-
-Due to this behavior, Organization and Team API tokens created by Vault will be
-stored and returned on future requests, until the credentials get rotated. This
-is to prevent unintentional revocation of tokens that are currently in-use.
-
-Below is an example of creating a Vault role to manage an Organization
-API token and rotating the token:
-
-```shell-session
-$ vault write terraform/role/testing organization="${TF_ORGANIZATION}"
-Success! Data written to: terraform/role/testing
-
-$ vault write -f terraform/rotate-role/testing
-Success! Data written to: terraform/rotate-role/testing
-```
-
-The API token is retrieved by reading the credentials for the role:
-
-```
-$ vault read terraform/creds/testing
-
-Key             Value
----             -----
-organization    hashicorp-vault-testing
-role            testing
-token           <example token>
-token_id        at-fqvtdTQ5kQWcjUfG
-```
-
-### User roles
-
-Traditionally, Vault secret engines create dynamic users and dynamic credentials
-along with them. At the time of writing, the Terraform Cloud API does not allow
-for creating dynamic users. Instead, the Terraform Cloud secret engine creates
-dynamic User API tokens by configuring a Vault role to manage an existing
-Terraform Cloud user. The lifecycle of these tokens is managed by Vault and
-will auto expire according to the configured TTL and max TTL of the Vault
-role.
-
-Below is an example of creating a Vault role to manage manage User API tokens:
-
-```shell-session
-$ vault write terraform/role/user-testing user_id="${TF_USER_ID}"
-Success! Data written to: terraform/role/user-testing
-```
-
-The API token is retrieved by reading the credentials for the role:
-
-```
-$ vault read terraform/creds/user-testing
-
-Key             Value
----             -----
-role            user-testing
-token           <example token>
-token_id        at-fqvtdTQ5kQWcjUfG
-```
-
-Please see the [Terraform Cloud API
-Token documentation for more
-information](/terraform/cloud-docs/users-teams-organizations/api-tokens).
-
-## Tutorial
-
-Refer to [Terraform Cloud Secrets
-Engine](/vault/tutorials/secrets-management/terraform-secrets-engine)
-for a step-by-step tutorial.
-
-## API
-
-The Terraform Cloud secrets engine has a full HTTP API. Please see the
-[Terraform Cloud secrets engine API](/vault/api-docs/secret/terraform) for more
-details.
diff --git a/website/content/docs/secrets/totp.mdx b/website/content/docs/secrets/totp.mdx
deleted file mode 100644
index 4bec57a1d35..00000000000
--- a/website/content/docs/secrets/totp.mdx
+++ /dev/null
@@ -1,124 +0,0 @@
----
-layout: docs
-page_title: TOTP - Secrets Engines
-description: The TOTP secrets engine for Vault generates time-based one-time use passwords.
----
-
-# TOTP secrets engine
-
-The TOTP secrets engine generates time-based credentials according to the TOTP
-standard. The secrets engine can also be used to generate a new key and validate
-passwords generated by that key.
-
-The TOTP secrets engine can act as both a generator (like Google Authenticator)
-and a provider (like the Google.com sign in service).
-
-## As a generator
-
-The TOTP secrets engine can act as a TOTP code generator. In this mode, it can
-replace traditional TOTP generators like Google Authenticator. It provides an
-added layer of security since the ability to generate codes is guarded by
-policies and the entire process is audited.
-
-### Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1.  Enable the TOTP secrets engine:
-
-    ```text
-    $ vault secrets enable totp
-    Success! Enabled the totp secrets engine at: totp/
-    ```
-
-    By default, the secrets engine will mount at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Configure a named key. The name of this key will be a human identifier as to
-    its purpose.
-
-    ```text
-    $ vault write totp/keys/my-key \
-        url="otpauth://totp/Vault:test@test.com?secret=Y64VEVMBTSXCYIWRSHRNDZW62MPGVU2G&issuer=Vault"
-    Success! Data written to: totp/keys/my-key
-    ```
-
-    The `url` corresponds to the secret key or value from the barcode provided
-    by the third-party service.
-
-### Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can generate credentials.
-
-1.  Generate a new time-based OTP by reading from the `/code` endpoint with the
-    name of the key:
-
-    ```text
-    $ vault read totp/code/my-key
-    Key     Value
-    ---     -----
-    code    260610
-    ```
-
-    Using ACLs, it is possible to restrict using the TOTP secrets engine such
-    that trusted operators can manage the key definitions, and both users and
-    applications are restricted in the credentials they are allowed to read.
-
-## As a provider
-
-The TOTP secrets engine can also act as a TOTP provider. In this mode, it can be
-used to generate new keys and validate passwords generated using those keys.
-
-### Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1.  Enable the TOTP secrets engine:
-
-    ```text
-    $ vault secrets enable totp
-    Success! Enabled the totp secrets engine at: totp/
-    ```
-
-    By default, the secrets engine will mount at the name of the engine. To
-    enable the secrets engine at a different path, use the `-path` argument.
-
-1.  Create a named key, using the `generate` option. This tells Vault to be the
-    provider:
-
-    ```text
-    $ vault write totp/keys/my-user \
-        generate=true \
-        issuer=Vault \
-        account_name=user@test.com
-
-    Key        Value
-    ---        -----
-    barcode    iVBORw0KGgoAAAANSUhEUgAAAMgAAADIEAAAAADYoy0BA...
-    url        otpauth://totp/Vault:user@test.com?algorithm=SHA1&digits=6&issuer=Vault&period=30&secret=V7MBSK324I7KF6KVW34NDFH2GYHIF6JY
-    ```
-
-    The response includes a base64-encoded barcode and OTP url. Both are
-    equivalent. Give these to the user who is authenticating with TOTP.
-
-### Usage
-
-1. As a user, validate a TOTP code generated by a third-party app:
-
-   ```text
-   $ vault write totp/code/my-user code=886531
-   Key      Value
-   ---      -----
-   valid    true
-   ```
-
-## API
-
-The TOTP secrets engine has a full HTTP API. Please see the
-[TOTP secrets engine API](/vault/api-docs/secret/totp) for more
-details.
diff --git a/website/content/docs/secrets/transform/ff3-tweak-details.mdx b/website/content/docs/secrets/transform/ff3-tweak-details.mdx
deleted file mode 100644
index bc8d5061923..00000000000
--- a/website/content/docs/secrets/transform/ff3-tweak-details.mdx
+++ /dev/null
@@ -1,83 +0,0 @@
----
-layout: docs
-page_title: FF3-1 Tweak Usage Documentation
-description: |-
-  Details and best practices for FF3-1 transform usage. 
----
-# FF3-1 tweak usage documentation
-
-## Introduction 
-
-The Vault Transform Secrets Engine uses the FF3-1 algorithm for FPE 
-(format preserving encryption) transformations. The key benefit of format
-preserving encryption schemes is that it allows for the secure encryption 
-of plaintexts over small domain spaces [1]. However, this comes with 
-the introduction of a parameter called the tweak, which is supplied to the 
-FF3-1 algorithm. Up until recently, the formal definitions of security in FPE 
-schemes have assumed that an attacker only has access to one tweak when probing 
-the codebook for a particular key. However, following the work of Bellare, this 
-notion was changed to assume that an attacker could control multiple tweaks when 
-generating a codebook and trying to create a nontrivial distinguisher for FF3-1. 
-
-This page will detail some best practices when using tweaks.
-
-Note that this guidance only holds when the tweak source selected when using the Vault
-FF3-1 transform is `supplied` or `internal`. 
-
-## FF3-1 best practices:
-
-Vault recommends the following practices when utilizing tweaks with the FF3-1 
-transform.
-
-* Encryption should be as restricted as possible via ACLs. 
-* Tweaks are not user controlled, but are randomly chosen and treated as 
-sensitive (if not secret). 
-* Tweaks make use of the max length allowed for the bytestring,
-and have high entropy (as uniformly variable as possible over the max tweak 
-domain space and differing with each encryption). Tweaks should utilize the
-full domain space.
-* Care should be taken to ensure that the same tweak is not used to encrypt
-two of the same values that correspond to different underlying entities.
-
-The following section aims to give some broad motivation for these recommendations. 
-For details, please see the Further Resources section at the bottom of the page.
-
-## FF3-1 tweak usage
-
-FF3-1 is a tweakable encryption scheme that was created to solve the problem of
-encrypting on small domains. Tweaks were introduced to synthetically increase the
-domain space. With the introduction of tweaks, an attacker must now have the
-correct encryption of the plaintext and the correct tweak in order to backtrack 
-via a codebook from an encryption to a plaintext. 
-
-However, this can be risky when the number of tweaks used in FF3-1 setups
-is too small or is chosen on a restricted domain, or when it is user-generated and 
-access control on encrypting is too broad. In the former case, a codebook can still
-be easily created if the tweaks are known (since tweak values are not necessarily
-secret [3]). In the latter case, an attacker who gains access to encrypting data
-(ie, has chosen-plaintext strength) can manipulate the tweaks to essentially bypass
-that synthetic extension of the domain space. 
-
-Another observation to note about FF3-1 is that encrypting the same plaintext 
-with the same key and tweak is deterministic, so two plaintexts that happen to
-coincide will lead to two ciphertexts that coincide. 
-Thus, no matching plaintexts for different objects should be stored with the same
-tweaks. For example, if the ciphertexts corresponding to the last four digits
-of phone numbers are stored, then there may be plaintext collisions, and these
-collision values should not be encrypted with the same tweak [3, Appendix C].
-
-As a third observation, FF3-1 splits tweaks in half and uses half a tweak in each round function.
-Therefore, ideally, randomly chosen tweaks should have high entropy within each half of the tweak.
-In the worst case scenario, creating many encryptions with tweaks with the same right or left half 
-will lead to more biased encryptions (where the distinction between the corresponding
-encryptions rely solely on the randomness of the abelian summation operator).
-In practice, using randomly chosen tweaks will be enough -- however, it is important
-to avoid using an algorithm to generate tweaks that yields similarity between two
-halves of tweaks [4]. 
-
-## Further resources:
-
-* 1: https://eprint.iacr.org/2020/1311.pdf
-* 2: https://csrc.nist.gov/news/2017/recent-cryptanalysis-of-ff3 
-* 3: https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-38g.pdf 
-* 4: https://img.chainnews.com/paper/568b1f587c93f63832f083dd449107c2.pdf 
diff --git a/website/content/docs/secrets/transform/index.mdx b/website/content/docs/secrets/transform/index.mdx
deleted file mode 100644
index 382999c4941..00000000000
--- a/website/content/docs/secrets/transform/index.mdx
+++ /dev/null
@@ -1,417 +0,0 @@
----
-layout: docs
-page_title: Transform - Secrets Engines
-description: >-
-  The Transform secrets engine for Vault performs secure data transformation.
----
-
-# Transform secrets engine
-
--> **Note**: This secret engine requires [Vault
-Enterprise](https://www.hashicorp.com/products/vault/) with the Advanced Data
-Protection Transform Module.
-
-The Transform secrets engine handles secure data transformation and tokenization
-against provided input value. Transformation methods may encompass NIST vetted
-cryptographic standards such as [format-preserving encryption
-(FPE)](https://en.wikipedia.org/wiki/Format-preserving_encryption) via
-[FF3-1](https://csrc.nist.gov/publications/detail/sp/800-38g/rev-1/draft), but
-can also be pseudonymous transformations of the data through other means, such
-as masking.
-
-The secret engine currently supports `fpe`, `masking`, and `tokenization` as
-data transformation types.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the Transform secrets engine:
-
-   ```text
-   $ vault secrets enable transform
-   Success! Enabled the transform secrets engine at: transform/
-   ```
-
-   By default, the secrets engine will mount at the name of the engine. To enable
-   the secrets engine at a different path, use the -path argument.
-
-1. Create a named role:
-
-   ```text
-   $ vault write transform/role/payments transformations=ccn-fpe
-   Success! Data written to: transform/role/payments
-   ```
-
-1. Create a transformation:
-
-   ```text
-   $ vault write transform/transformation/ccn-fpe \
-     type=fpe \
-     template=ccn \
-     tweak_source=internal \
-     allowed_roles=payments
-   Success! Data written to: transform/transformation/ccn-fpe
-   ```
-
-1. Optionally, create a template:
-
-   ```text
-   $ vault write transform/template/ccn \
-     type=regex \
-     pattern='(\d{4})[- ](\d{4})[- ](\d{4})[- ](\d{4})' \
-     encode_format='$1-$2-$3-$4' \
-     decode_formats=last-four='$4' \
-     alphabet=numerics
-   Success! Data written to: transform/template/ccn
-   ```
-
-1. Optionally, create an alphabet:
-
-   ```text
-   $ vault write transform/alphabet/numerics \
-       alphabet="0123456789"
-   Success! Data written to: transform/alphabet/numerics
-   ```
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can use this secrets engine to encode and decode input
-values.
-
-1. Encode some input value using the `/encode` endpoint with a named role:
-
-   ```text
-   $ vault write transform/encode/payments value=1111-2222-3333-4444
-   Key              Value
-   ---              -----
-   encoded_value    9300-3376-4943-8903
-   ```
-
-   A transformation must be provided if the role contains more than one
-   transformation. A tweak must be provided if the tweak source for the
-   transformation is "supplied".
-
-1. Decode some input value using the `/decode` endpoint with a named role:
-
-   ```text
-   $ vault write transform/decode/payments value=9300-3376-4943-8903
-   Key              Value
-   ---              -----
-   decoded_value    1111-2222-3333-4444
-   ```
-
-   A transformation must be provided if the role contains more than one
-   transformation. A tweak must be provided if the tweak source for the
-   transformation is "supplied" or "generated".
-
-1. Decode some input value using the `/decode` endpoint with a named role and decode format:
-
-   ```text
-   $ vault write transform/decode/payments/last-four value=9300-3376-4943-8903
-   Key              Value
-   ---              -----
-   decoded_value    4444
-   ```
-
-   A transformation must be provided if the role contains more than one
-   transformation. A tweak must be provided if the tweak source for the
-   transformation is "supplied" or "generated". A decode format can optionally
-   be provided. If one isn't provided, the decoded output will be formatted to
-   match the template's pattern as in the previous example.
-
-## Roles, transformations, templates, and alphabets
-
-The Transform secrets engine contains several types of resources that
-encapsulate different aspects of the information required in order to perform
-data transformation.
-
-- **Roles** are the basic high-level construct that holds the set of
-  transformation that it is allowed to performed. The role name is provided when
-  performing encode and decode operations.
-
-- **Transformations** hold information about a particular transformation. It
-  contains information about the type of transformation that we want to perform,
-  the template that it should use for value detection, and other
-  transformation-specific values such as the tweak source or the masking character
-  to use.
-
-- **Templates** allow us to determine what and how to capture the value that we
-  want to transform.
-
-- **Alphabets** provide the set of valid UTF-8 character contained within both
-  the input and transformed value on FPE transformations.
-
-## Transformations
-
-### Format preserving encryption
-
-Format Preserving Encryption (FPE) performs cryptographically secure
-transformation via FF3-1 to encode input values while maintaining its data
-format and length.
-
-#### Tweak and tweak source
-
-FF3-1 uses a non-confidential parameter called the tweak along with the
-ciphertext when performing encryption and decryption operations. The tweak
-is precisely a 7-byte value. The secret engine consumes a base64 encoded string
-of this value for its encode and decode operation whenever this input is
-required.
-
-In order to simplify the flow of encoding and decoding operations, transformation
-creation can take care of generating and associating a tweak value. This allows
-applications to provide a single value without having the need to generate or
-store any other metadata.
-
-In cases where more granularity is required, a tweak value can be generated by
-Vault and returned, or it may be independently generated and provided.
-
-In summary, there are three ways in which the tweak value may be sourced:
-
-- `supplied`: This is the default behavior for FPE transformations. The tweak
-  value must be generated externally, and supplied into the on encode and decode
-  operations.
-- `generated`: The secret engine will take care of generating the tweak value
-  on encode operations and return this back as part of the response along
-  with the encoded value. It is up to the application to store this value
-  so that it can be provided back when decoding the encoded value.
-- `internal`: The secret engine will generate an internal tweak value per
-  transformation. This value is not returned on encode or decode operations
-  since it gets re-used for all encode and decode operations for the
-  transformation. Depending on the uniqueness of the dataset, this mode may
-  introduce higher risks, but provides the most convenience since the value does
-  not need to be stored separately. This mode should only be used if the values
-  being encoded are sufficiently unique.
-
-Your team and organization should weigh the trade-offs when it comes to
-choosing the proper tweak source to use. For `supplied` and `internal`
-sourcing, please see [FF3-1 Tweak Usage Details](/vault/docs/secrets/transform/ff3-tweak-details)
-
-#### Input limits
-
-FF3-1 specifies both minimum and maximum limits on the length of an input.
-These limits are driven by the security goals, making sure that for a given
-alphabet the input size does not leave the input guessable by brute force.
-
-Given an alphabet of length A, an input length L is valid if:
-
-- L >= 2,
-- A<sup>L</sup> >= 1,000,000
-- and L <= 2 \* floor(log<sub>A</sub>(2<sup>96</sup>)).
-
-As a concrete example, for handling credit card numbers, A is 10, L is 16, so
-valid input lengths would be between 6 and 56 characters. This is because
-10<sup>6</sup>=1,000,000 (already greater than 2), and 2 \* floor(log<sub>10</sub>(2<sup>96</sup>)) = 56.
-
-Of course, in the case of credit card numbers valid input would always be
-between 12 and 19 decimal digits.
-
-#### Output limitations
-
-After transformation and formatting by the template, the value is an encrypted
-version of the input with the format preserved. However, the value itself may
-be _invalid_ with respect to other standards. For example the output credit card
-number may not validate (it likely won't create a valid check digit).
-
-So one must consider when the outputs are stored whether validation in storage
-may reject them.
-
-### Masking
-
-Masking performs replacement of matched characters on the input value with a
-desired character. This form of transformation is non-reversible and thus does
-not support retrieving the original value back using the decode operation.
-
-### Tokenization
-
-[Tokenization](/vault/docs/secrets/transform/tokenization) exchanges a
-sensitive value for an unrelated value called a _token_. The original sensitive
-value cannot be recovered from a token alone, they are irreversible.
-
-#### Inputs
-
-Tokenization inputs are not processed by templates or alphabets, as they do not
-preserve any of the contents or format of the input.
-
-#### Outputs
-
-Tokenization is not format preserving. The token output is a Base58 encoded
-string value of unrelated length, and is not rendered by a template.
-
-The decoded value is returned verbatim as it was before encoding.
-
-#### Metadata
-
-As tokenization isn't format preserving and is stateful, the input values can be
-any length, subject to other limits in Vault's request processing. In addition,
-non-sensitive _metadata_ can be encoded alongside the value, and retrieved either
-with or independently of the original value.
-
-#### Operations
-
-In addition to encode and decode, as tokenization is stateful, it provides two
-additional operations:
-
-- Retrieve metadata given a token.
-- Check whether an input value has a valid, unexpired token.
-- For some configurations, retrieve a previously encoded token for a plaintext
-  input.
-
-#### Stores
-
-Tokenization is stateful. Tokenized state can be stored internally (the
-default) or in an external store. Currently only PostgreSQL, MySQL, and MSSQL are supported
-for external storage.
-
-#### Mapping modes
-
-[Tokenization](/vault/docs/secrets/transform/tokenization) stores the results of an encode operation
-in storage using a cryptographic construct that enhances the safety of its values.
-In the `default` mapping mode, the token itself is transformed via a one way
-function involving the transform key and elements of the token. As Vault does
-not store the token, the values in Vault storage themselves cannot be used to
-retrieve original input.
-
-A second mapping mode, `exportable` is provided for cases where
-operators may need to recover the full set of decoded inputs in an emergency via
-the export operation. It is strongly recommended that one use the `default` mode if
-possible, as it is resistant to more types of attack.
-
-#### Convergent tokenization
-
-~> **Note:** Convergent tokenization is not supported for transformations with
-imported keys.
-
-In addition, tokenization transformations may be configured as *convergent*, meaning
-that tokenizing a plaintext and expiration more than once results in the
-same token value.  Enabling convergence has performance and security
-[considerations](/vault/docs/secrets/transform/tokenization#convergence).
-
-## Deletion behavior
-
-The deletion of resources, aside from roles, is guarded by checking whether any
-other related resources are currently using it in order to avoid accidental data
-loss of any encoded value that may depend on these bits of information to
-decode and reconstruct the original value. Role deletion can be safely done
-since the information related to the transformation itself is contained within
-transformation object and its related resources.
-
-The following rules applies when it comes to deleting a resource:
-
-- A transformation cannot be deleted if it's in use by a role.
-- A template or store cannot be deleted if it's in use by a transformation.
-- An alphabet cannot be deleted if it's in use by a template.
-
-## Provided builtin resources
-
-The secret engine provides a set of builtin templates and alphabets that are
-considered common. Builtin templates cannot be deleted, and the prefix
-"builtin/" on template and alphabet names is a reserved keyword.
-
-### Templates
-
-The following builtin templates are available for use in the secret engine:
-
-- builtin/creditcardnumber
-- builtin/socialsecuritynumber
-
-Note that these templates only check for the matching pattern(s), and not the
-validity of the value itself. For instance, the builtin credit card number
-template can determine whether the provided value is in the format of commonly
-issued credit cards, but not whether the credit card is a valid number from a
-particular issuer.
-
-Templates currently only accept regular expressions as the matching pattern
-type. It uses Go's standard library for the regexp engine, which supports
-[the RE2 syntax](https://github.com/google/re2/wiki/Syntax).
-
-**Note**: The `builtin/any` template is only valid and is the default for the tokenization
-transform.
-
-### Alphabets
-
-The following builtin alphabets are available for use in the secret engine:
-
-- builtin/numeric
-- builtin/alphalower
-- builtin/alphaupper
-- builtin/alphanumericlower
-- builtin/alphanumericupper
-- builtin/alphanumeric
-
-Custom alphabets must contain between 2 and 65536 unique characters.
-
-### Stores
-
-The following builtin store is available (and is the default) for tokenization
-transformations:
-
-- builtin/internal
-
-## Tutorial
-
-Refer to the [Transform Secrets Engine](/vault/tutorials/adp/transform) tutorial to learn how to use the Transform secrets engine to handle secure data transmission and tokenization against provided secrets.
-
-## Bring your own key (BYOK)
-
-~> **Note:** Key import functionality supports cases where there is a need to bring
-in an existing key from an HSM or other outside systems. It is more secure to
-have Transform generate and manage a key within Vault.
-
-First, the wrapping key needs to be read from the transform secrets engine:
-
-```text
-$ vault read transform/wrapping_key
-```
-
-The wrapping key will be a 4096-bit RSA public key.
-
-Then, the wrapping key is used to create the ciphertext input for the `import` endpoint,
-as described below. The target key refers to the key being imported.
-
-### HSM
-
-If the key is being imported from an HSM that supports PKCS#11, there are
-two possible scenarios:
-
-- If the HSM supports the CKM_RSA_AES_KEY_WRAP mechanism, it can be used to wrap the
-target key using the wrapping key.
-
-- Otherwise, two mechanisms can be combined to wrap the target key. First, a 256-bit AES key is
-generated and then used to wrap the target key using the CKM_AES_KEY_WRAP_KWP mechanism.
-Then the AES key should be wrapped under the wrapping key using the CKM_RSA_PKCS_OAEP mechanism
-using MGF1 and either SHA-1, SHA-224, SHA-256, SHA-384, or SHA-512.
-
-The ciphertext is constructed by appending the wrapped target key to the wrapped AES key.
-
-The ciphertext bytes should be base64-encoded.
-
-### Manual process
-
-If the target key is not stored in an HSM or KMS, the following steps can be used to construct
-the ciphertext for the input of the `import` endpoint:
-
-1. Generate an ephemeral 256-bit AES key.
-
-2. Wrap the target key using the ephemeral AES key with AES-KWP.
-
-3. Wrap the AES key under the Vault wrapping key using RSAES-OAEP with MGF1 and
-either SHA-1, SHA-224, SHA-256, SHA-384, or SHA-512.
-
-4. Delete the ephemeral AES key.
-
-5. Append the wrapped target key to the wrapped AES key.
-
-6. Base64 encode the result.
-
-For more details on the key wrapping process, see the [key wrapping guide](/vault/docs/secrets/transit/key-wrapping-guide)
-(be sure to use the transform wrapping key when wrapping a key for import into the transform secrets engine).
-
-## API
-
-The Transform secrets engine has a full HTTP API. Please see the
-[Transform secrets engine API](/vault/api-docs/secret/transform) for more
-details.
diff --git a/website/content/docs/secrets/transform/tokenization.mdx b/website/content/docs/secrets/transform/tokenization.mdx
deleted file mode 100644
index 89417c2f2cb..00000000000
--- a/website/content/docs/secrets/transform/tokenization.mdx
+++ /dev/null
@@ -1,201 +0,0 @@
----
-layout: docs
-page_title: Transform - Secrets Engines - Tokenization
-description: >-
-  More information on the Tokenization transform.
----
-
-# Tokenization transform
-
-Not to be confused with Vault tokens, Tokenization exchanges a
-sensitive value for an unrelated value called a _token_. The original sensitive
-value cannot be recovered from a token alone, they are irreversible. Instead,
-unlike format preserving encryption, tokenization is stateful. To decode the
-original value, the token must be submitted to Vault where it is
-retrieved from a cryptographic mapping in storage.
-
-## Operation
-
-On encode, Vault generates a random, signed token and stores a mapping of a
-version of that token to encrypted versions of the plaintext and metadata, as
-well as a fingerprint of the original plaintext which facilitates the `tokenized`
-endpoint that lets one query whether a plaintext exists in the system.
-
-Depending on the mapping mode, the plaintext may be decoded only with possession
-of the distributed token, or may be recoverable in the export operation. See
-[Security Considerations](#security-considerations) for more.
-
-### Convergence
-
-By default, tokenization produces a unique token for every encode operation. 
-This makes the resulting token fully independent of its plaintext and expiration. 
-Sometimes, though, it may be beneficial if the tokenization of a plaintext/expiration
-pair tokenizes consistently to the same value.  For example if one wants to 
-do a statistical analysis of the tokens as they relate to some other field
-in a database (without decoding the token), or if one needed to tokenize
-in two different systems but be able relate the results.  In this case,
-one can create a tokenization transformation that is *convergent*.  
-
-When enabled at transformation creation time, Vault alters the calculation so that
-encoding a plaintext and expiration tokenizes to the same value every time, and
-storage keeps only a single entry of that token.  Like the exportable mapping
-mode, convergence should only be enabled if needed.  Convergent tokenization
-has a small performance penalty in external stores and a larger one in the
-built in store due to the need to avoid duplicate entries and to update
-metadata when convergently encoding.  It is recommended that if one has some
-use cases that require convergence and some that do not, one should create two
-different tokenization transforms with convergence enabled on only one. 
-
-### Token lookup
-
-Some use cases may want to lookup the value of a token given its plaintext.  Ordinarily
-this is contrary to the nature of tokenization where we want to prevent the ability
-of an attacker to determine that a token corresponds to a plaintext value (a known
-plaintext attack).  But for use cases that require it, the 
-[token lookup](/vault/api-docs/secret/transform#token-lookup)
-operation is supported, but only in some configurations of the tokenization
-transformation.  Token lookup is supported when convergence is enabled, or
-if the mapping mode is exportable *and* the storage backend is external.
-
-## Performance considerations
-
-### Builtin (Internal) store
-
-As tokenization is stateful, the encode operation necessarily writes values to
-storage. By default, that storage is the Vault backend store itself. This
-differs from some secret engines in that the encode and decode operations require
-an access of storage per operation. Other engines use storage for configuration
-but can process operations largely without accessing any storage.
-
-Since these operations involve writes to storage, and therefore must be performed
-on primary nodes, the scalability of the encode operation is limited by the
-primary's storage performance.
-
-Additionally, using internal storage, since writes must be performed on primary
-nodes, the scalability of the encode operation will be limited by the performance
-of the primary and its storage subsystem. All other operations can be performed
-on secondaries.
-
-Finally, due to replication, writes to the primary may take some time to reach
-secondaries, so other read operations like decode or metadata may not succeed on
-the secondaries until this happens. In other words, tokenization is eventually
-consistent.
-
-### External storage
-
-All nodes (except DRs) can participate in all operations using external storage,
-but one must take care to monitor and scale the external storage for the level of
-traffic experienced. The storage schema is simple however and well known approaches
-should be effective.
-
-## Security considerations
-
-The goal of Tokenization is to let end users' devices store the token rather than
-their sensitive values (such as credit card numbers) and still participate in
-transactions where the token is a stand-in for the sensitive value. For this reason
-the token Vault generates is completely unrelated (e.g. irreversible) to the
-sensitive value.
-
-Furthermore, the Tokenization transform is designed to resist a number of attacks
-on the values produced during encode. In particular it is designed so that
-attackers cannot recover plaintext even if they steal the tokenization values
-from Vault itself. In the default mapping mode,
-even stealing the underlying transform key does not allow them to recover
-the plaintext without also possessing the encoded token. An attacker must have
-gotten access to all values in the construct.
-
-In the `exportable` mapping mode however, the plaintext values are encrypted
-in a way that can be decrypted within Vault. If the attacker possesses the
-transform key and the tokenization mapping values, the plaintext can be
-recovered. This mode is available for the case where operators prioritize the
-ability to export all of the plaintext values in an emergency, via the
-`export-decoded` operation.
-
-### Metadata
-
-Since tokenization isn't format preserving and requires storage, one can associate
-arbitrary metadata with a token. Metadata is considered less sensitive than the
-original plaintext value. As it has it's own retrieval endpoint, operators can
-configure policies that may allow access to the metadata of a token but not
-its decoded value to enable workflows that operate just on the metadata.
-
-## TTLs and tidying
-
-By default, tokens are long lived, and the storage for them will be maintained
-indefinitely. Where there is a concept of time-to-live, it is strongly encouraged
-that the tokens be generated with a TTL. For example, as credit cards
-have an expiration date, it is recommended that tokenizing a credit card
-primary account number (PAN) be done with a TTL that corresponds to the time
-after which the PAN is invalid.
-
-This allows such values to be _tidied_ and removed from storage once expired.
-Tokens themselves encode the expiration time, so decode and other operations
-can immediately reject the operation when presented with an expired token.
-
-## Storage
-
-### External SQL stores
-
-Currently the PostgreSQL, MySQL, and MSSQL relational databases are supported as
-external storage backends for tokenization.
-The [Schema Endpoint](/vault/api-docs/secret/transform#create-update-store-schema)
-may be used to initialize and upgrade the necessary database tables. Vault uses
-a schema versioning table to determine if it needs to create or modify the
-tables when using that endpoint. If you make changes to those tables yourself,
-the automatic schema management may become out of sync and may fail in the future.
-
-External stores may often be preferred due to their ability to achieve a much
-higher scale of performance, especially when used with batch operations.
-
-### Snapshot/Restore
-
-Snapshot allows one to iteratively retrieve the tokenization state, for
-backup or migration purposes. The resulting data can be fed to the restore
-endpoint of the same or a different tokenization store. Note that the state
-is only useable by the tokenization transform that created it, as state is
-encrypted via keys in that configured transform.
-
-### Export decoded
-
-For stores configured with the `exportable` mapping mode, the export decoded
-endpoint allows operators to retrieve the _decoded_ contents of tokenization
-state, which includes tokens and their decoded, sensitive values. The
-`exportable` mode is only recommended if this use case is required, as the default
-cannot be decoded by attackers even if they gain access to Vault's storage and
-keys.
-
-### Migration
-
-Tokenization stores are configured separately from the tokenization transform,
-and the transform can point to multiple stores. The primary use case for this
-one-to-many relationship is to facilitate migration between two tokenization
-stores.
-
-When multiple stores are configured, Vault writes new tokenization state to all
-configured stores, and reads from each store in the order they were configured.
-Thus, one can use multiple configured stores along with the snapshot/restore
-functionality to perform a zero-downtime migration to a new store:
-
-1. Configure the new tokenization store in the API.
-1. Modify the existing tokenization transform to use both the existing and new
-   store.
-1. Snapshot the old store.
-1. Restore the snapshot to the new store.
-1. Perform any desired validations.
-1. Modify the tokenization transform to use only the new store.
-
-## Key management
-
-Tokenization supports key rotation. Keys are tied to transforms, so key
-names are the same as the name of the corresponding tokenization transform.
-Keys can be rotated to a new version, with backward compatibility for
-decoding. Encoding is always performed with the newest key version. Keys versions
-can be tidied as well. Keys may also be rotated automatically on a user-defined
-time interval, specified by the `auto_rotate_field` of the key config. For more
-information, see the [transform api docs](/vault/api-docs/secret/transform).
-
-## Tutorial
-
-Refer to [Tokenize Data with Transform Secrets
-Engine](/vault/tutorials/adp/tokenization) for a
-step-by-step tutorial.
diff --git a/website/content/docs/secrets/transit/index.mdx b/website/content/docs/secrets/transit/index.mdx
deleted file mode 100644
index 3dfdd46402e..00000000000
--- a/website/content/docs/secrets/transit/index.mdx
+++ /dev/null
@@ -1,327 +0,0 @@
----
-layout: docs
-page_title: Transit - Secrets Engines
-description: >-
-  The transit secrets engine for Vault encrypts/decrypts data in-transit. It
-  doesn't store any secrets.
----
-
-# Transit secrets engine
-
-The transit secrets engine handles cryptographic functions on data in-transit.
-Vault doesn't store the data sent to the secrets engine. It can also be viewed
-as "cryptography as a service" or "encryption as a service". The transit secrets
-engine can also sign and verify data; generate hashes and HMACs of data; and act
-as a source of random bytes.
-
-The primary use case for `transit` is to encrypt data from applications while
-still storing that encrypted data in some primary data store. This relieves the
-burden of proper encryption/decryption from application developers and pushes
-the burden onto the operators of Vault.
-
-Key derivation is supported, which allows the same key to be used for multiple
-purposes by deriving a new key based on a user-supplied context value. In this
-mode, convergent encryption can optionally be supported, which allows the same
-input values to produce the same ciphertext.
-
-Datakey generation allows processes to request a high-entropy key of a given
-bit length be returned to them, encrypted with the named key. Normally this will
-also return the key in plaintext to allow for immediate use, but this can be
-disabled to accommodate auditing requirements.
-
-## Working set management
-
-The Transit engine supports versioning of keys. Key versions that are earlier
-than a key's specified `min_decryption_version` gets archived, and the rest of
-the key versions belong to the working set. This is a performance consideration
-to keep key loading fast, as well as a security consideration: by disallowing
-decryption of old versions of keys, found ciphertext corresponding to obsolete
-(but sensitive) data can not be decrypted by most users, but in an emergency
-the `min_decryption_version` can be moved back to allow for legitimate
-decryption.
-
-Currently this archive is stored in a single storage entry. With some storage
-backends, notably those using Raft or Paxos for HA capabilities, frequent
-rotation may lead to a storage entry size for the archive that is larger than
-the storage backend can handle. For frequent rotation needs, using named keys
-that correspond to time bounds (e.g. five-minute periods floored to the closest
-multiple of five) may provide a good alternative, allowing for several keys to
-be live at once and a deterministic way to decide which key to use at any given
-time.
-
-## NIST rotation guidance
-
-Periodic rotation of the encryption keys is recommended, even in the absence of
-compromise. For AES-GCM keys, rotation should occur before approximately 2<sup>32</sup>
-encryptions have been performed by a key version, following the guidelines of NIST
-publication 800-38D. It is recommended that operators estimate the
-encryption rate of a key and use that to determine a frequency of rotation
-that prevents the guidance limits from being reached. For example, if one determines
-that the estimated rate is 40 million operations per day, then rotating a key every
-three months is sufficient.
-
-## Key types
-
-As of now, the transit secrets engine supports the following key types (all key
-types also generate separate HMAC keys):
-
-- `aes128-gcm96`: AES-GCM with a 128-bit AES key and a 96-bit nonce; supports
-  encryption, decryption, key derivation, and convergent encryption
-- `aes256-gcm96`: AES-GCM with a 256-bit AES key and a 96-bit nonce; supports
-  encryption, decryption, key derivation, and convergent encryption (default)
-- `chacha20-poly1305`: ChaCha20-Poly1305 with a 256-bit key; supports
-  encryption, decryption, key derivation, and convergent encryption
-- `ed25519`: Ed25519; supports signing, signature verification, and key
-  derivation
-- `ecdsa-p256`: ECDSA using curve P-256; supports signing and signature
-  verification
-- `ecdsa-p384`: ECDSA using curve P-384; supports signing and signature
-  verification
-- `ecdsa-p521`: ECDSA using curve P-521; supports signing and signature
-  verification
-- `rsa-2048`: 2048-bit RSA key; supports encryption, decryption, signing, and
-  signature verification
-- `rsa-3072`: 3072-bit RSA key; supports encryption, decryption, signing, and
-  signature verification
-- `rsa-4096`: 4096-bit RSA key; supports encryption, decryption, signing, and
-  signature verification
-- `hmac`: HMAC; supporting HMAC generation and verification.
-- `managed_key`: Managed key; supports a variety of operations depending on the
-  backing key management solution. See [Managed Keys](/vault/docs/enterprise/managed-keys)
-  for more information.
-
-~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
-and thus should not be used: `chacha20-poly1305` and `ed25519`.
-
-~> **Note**: All key types support HMAC operations through the use of a second randomly
-generated key created key creation time or rotation. The HMAC key type only
-supports HMAC, and behaves identically to other algorithms with
-respect to the HMAC operations but supports key import. By default,
-the HMAC key type uses a 256-bit key.
-
-RSA operations use one of the following methods:
-
- - OAEP (encrypt, decrypt), with SHA-256 hash function and MGF,
- - PSS (sign, verify), with configurable hash function also used for MGF, and
- - PKCS#1v1.5: (sign, verify), with configurable hash function.
-
-## Convergent encryption
-
-Convergent encryption is a mode where the same set of plaintext+context always
-result in the same ciphertext. It does this by deriving a key using a key
-derivation function but also by deterministically deriving a nonce. Because
-these properties differ for any combination of plaintext and ciphertext over a
-keyspace the size of 2^256, the risk of nonce reuse is near zero.
-
-This has many practical uses. One common usage mode is to allow values to be stored
-encrypted in a database, but with limited lookup/query support, so that rows
-with the same value for a specific field can be returned from a query.
-
-To accommodate for any needed upgrades to the algorithm, different versions of
-convergent encryption have historically been supported:
-
-- Version 1 required the client to provide their own nonce, which is highly
-  flexible but if done incorrectly can be dangerous. This was only in Vault
-  0.6.1, and keys using this version cannot be upgraded.
-- Version 2 used an algorithmic approach to deriving the parameters. However,
-  the algorithm used was susceptible to offline plaintext-confirmation attacks,
-  which could allow attackers to brute force decryption if the plaintext size
-  was small. Keys using version 2 can be upgraded by simply performing a rotate
-  operation to a new key version; existing values can then be rewrapped against
-  the new key version and will use the version 3 algorithm.
-- Version 3 uses a different algorithm designed to be resistant to offline
-  plaintext-confirmation attacks. It is similar to AES-SIV in that it uses a
-  PRF to generate the nonce from the plaintext.
-
-## Setup
-
-Most secrets engines must be configured in advance before they can perform their
-functions. These steps are usually completed by an operator or configuration
-management tool.
-
-1. Enable the Transit secrets engine:
-
-   ```text
-   $ vault secrets enable transit
-   Success! Enabled the transit secrets engine at: transit/
-   ```
-
-   By default, the secrets engine will mount at the name of the engine. To
-   enable the secrets engine at a different path, use the `-path` argument.
-
-1. Create a named encryption key:
-
-   ```text
-   $ vault write -f transit/keys/my-key
-   Success! Data written to: transit/keys/my-key
-   ```
-
-   Usually each application has its own encryption key.
-
-## Usage
-
-After the secrets engine is configured and a user/machine has a Vault token with
-the proper permission, it can use this secrets engine.
-
-1.  Encrypt some plaintext data using the `/encrypt` endpoint with a named key:
-
-    **NOTE:** All plaintext data **must be base64-encoded**. The reason for this
-    requirement is that Vault does not require that the plaintext is "text". It
-    could be a binary file such as a PDF or image. The easiest safe transport
-    mechanism for this data as part of a JSON payload is to base64-encode it.
-
-    ```text
-    $ vault write transit/encrypt/my-key plaintext=$(echo "my secret data" | base64)
-
-    Key           Value
-    ---           -----
-    ciphertext    vault:v1:8SDd3WHDOjf7mq69CyCqYjBXAiQQAVZRkFM13ok481zoCmHnSeDX9vyf7w==
-    ```
-
-    The returned ciphertext starts with `vault:v1:`. The first prefix (`vault`)
-    identifies that it has been wrapped by Vault. The `v1` indicates the key
-    version 1 was used to encrypt the plaintext; therefore, when you rotate
-    keys, Vault knows which version to use for decryption. The rest is a base64
-    concatenation of the initialization vector (IV) and ciphertext.
-
-    Note that Vault does not _store_ any of this data. The caller is responsible
-    for storing the encrypted ciphertext. When the caller wants the plaintext,
-    it must provide the ciphertext back to Vault to decrypt the value.
-
-    !> Vault HTTP API imposes a maximum request size of 32MB to prevent a denial
-    of service attack. This can be tuned per [`listener`
-    block](/vault/docs/configuration/listener/tcp) in the Vault server
-    configuration.
-
-1.  Decrypt a piece of data using the `/decrypt` endpoint with a named key:
-
-    ```text
-    $ vault write transit/decrypt/my-key ciphertext=vault:v1:8SDd3WHDOjf7mq69CyCqYjBXAiQQAVZRkFM13ok481zoCmHnSeDX9vyf7w==
-
-    Key          Value
-    ---          -----
-    plaintext    bXkgc2VjcmV0IGRhdGEK
-    ```
-
-    The resulting data is base64-encoded (see the note above for details on
-    why). Decode it to get the raw plaintext:
-
-    ```text
-    $ base64 --decode <<< "bXkgc2VjcmV0IGRhdGEK"
-    my secret data
-    ```
-
-    It is also possible to script this decryption using some clever shell
-    scripting in one command:
-
-    ```text
-    $ vault write -field=plaintext transit/decrypt/my-key ciphertext=... | base64 --decode
-    my secret data
-    ```
-
-    Using ACLs, it is possible to restrict using the transit secrets engine such
-    that trusted operators can manage the named keys, and applications can only
-    encrypt or decrypt using the named keys they need access to.
-
-1.  Rotate the underlying encryption key. This will generate a new encryption key
-    and add it to the keyring for the named key:
-
-    ```text
-    $ vault write -f transit/keys/my-key/rotate
-    Success! Data written to: transit/keys/my-key/rotate
-    ```
-
-    Future encryptions will use this new key. Old data can still be decrypted
-    due to the use of a key ring.
-
-1.  Upgrade already-encrypted data to a new key. Vault will decrypt the value
-    using the appropriate key in the keyring and then encrypt the resulting
-    plaintext with the newest key in the keyring.
-
-    ```text
-    $ vault write transit/rewrap/my-key ciphertext=vault:v1:8SDd3WHDOjf7mq69CyCqYjBXAiQQAVZRkFM13ok481zoCmHnSeDX9vyf7w==
-
-    Key           Value
-    ---           -----
-    ciphertext    vault:v2:0VHTTBb2EyyNYHsa3XiXsvXOQSLKulH+NqS4eRZdtc2TwQCxqJ7PUipvqQ==
-    ```
-
-    This process **does not** reveal the plaintext data. As such, a Vault policy
-    could grant almost an untrusted process the ability to "rewrap" encrypted
-    data, since the process would not be able to get access to the plaintext
-    data.
-
-## Bring your own key (BYOK)
-
-~> **Note:** Key import functionality supports cases in which there is a need to bring
-in an existing key from an HSM or other outside system. It is more secure to
-have Transit generate and manage a key within Vault.
-
-First, the wrapping key needs to be read from transit:
-
-```text
-$ vault read transit/wrapping_key
-```
-
-The wrapping key will be a 4096-bit RSA public key.
-
-Then the wrapping key is used to create the ciphertext input for the `import` endpoint,
-as described below. In the below, the target key refers to the key being imported.
-
-### HSM
-
-If the key is being imported from an HSM that supports PKCS#11, there are
-two possible scenarios:
-
-- If the HSM supports the CKM_RSA_AES_KEY_WRAP mechanism, that can be used to wrap the
-  target key using the wrapping key.
-
-- Otherwise, two mechanisms can be combined to wrap the target key. First, a 256-bit AES key should
-  be generated and then used to wrap the target key using the CKM_AES_KEY_WRAP_KWP mechanism.
-  Then the AES key should be wrapped under the wrapping key using the CKM_RSA_PKCS_OAEP mechanism
-  using MGF1 and either SHA-1, SHA-224, SHA-256, SHA-384, or SHA-512.
-
-The ciphertext is constructed by appending the wrapped target key to the wrapped AES key.
-
-The ciphertext bytes should be base64-encoded.
-
-### Manual process
-
-If the target key is not stored in an HSM or KMS, the following steps can be used to construct
-the ciphertext for the input of the `import` endpoint:
-
-- Generate an ephemeral 256-bit AES key.
-
-- Wrap the target key using the ephemeral AES key with AES-KWP.
-
-~> Note: When wrapping a symmetric key (such as an AES or ChaCha20 key), wrap
-   the raw bytes of the key. For instance, with an AES 128-bit key, this'll be
-   a byte array 16 characters in length that will directly be wrapped without
-   base64 or other encodings.<br /><br />When wrapping an asymmetric key
-   (such as a RSA or ECDSA key), wrap the **PKCS8** encoded format of this
-   key, in raw DER/binary form. Do not apply PEM encoding to this blob prior
-   to encryption and do not base64 encode it.
-
-- Wrap the AES key under the Vault wrapping key using RSAES-OAEP with MGF1 and
-  either SHA-1, SHA-224, SHA-256, SHA-384, or SHA-512.
-
-- Delete the ephemeral AES key.
-
-- Append the wrapped target key to the wrapped AES key.
-
-- Base64 encode the result.
-
-For more details about wrapping the key for import into transit, see the
-[key wrapping guide](/vault/docs/secrets/transit/key-wrapping-guide).
-
-## Tutorial
-
-Refer to the [Encryption as a Service: Transit Secrets
-Engine](/vault/tutorials/encryption-as-a-service/eaas-transit)
-tutorial to learn how to use the transit secrets engine to handle cryptographic functions on data in-transit.
-
-## API
-
-The Transit secrets engine has a full HTTP API. Please see the
-[Transit secrets engine API](/vault/api-docs/secret/transit) for more
-details.
diff --git a/website/content/docs/secrets/transit/key-wrapping-guide.mdx b/website/content/docs/secrets/transit/key-wrapping-guide.mdx
deleted file mode 100644
index 5ee584d492b..00000000000
--- a/website/content/docs/secrets/transit/key-wrapping-guide.mdx
+++ /dev/null
@@ -1,165 +0,0 @@
----
-layout: docs
-page_title: Key Wrapping for Transit Key Import - Transit - Secrets Engines
-description: |-
-  Details about wrapping keys for import into the transit secrets engine.
----
-
-# Key wrapping for transit key import
-
-The "bring your own key" (BYOK) functionality for the transit
-secrets engine allows users to import keys that were generated
-outside of Vault into the transit secrets engine.
-
-This document describes the process for wrapping an externally-generated
-key (the target key) for import into Vault. It describes the processes
-for importing a software-stored key using Golang and for importing a key
-that is stored in an HSM.
-
-### Mount the secrets engine
-
-```shell-session
-$ vault secrets enable transit
-Success! Enabled the transit secrets engine at: transit/
-```
-
-### Retrieve the transit wrapping key
-
-```shell-session
-$ vault read transit/wrapping_key
-```
-
-This returns a 4096-bit RSA key.
-
-The steps after this depend on whether the key is stored using
-a software solution or in an HSM.
-
-### Software example (Go)
-
-This example assumes that the key is stored in software using the
-variable name `key`. It demonstrates how to wrap the target key using
-Golang crypto libraries.
-
-Once you have the wrapping key, you can parse it using the `encoding/pem`
-and `crypto/x509` libraries (the example code below assumes that the wrapping
-key has been written to a variable called `wrappingKeyString`):
-
-```
-keyBlock, _ := pem.Decode([]byte(wrappingKeyString))
-parsedKey, err := x509.ParsePKIXPublicKey(keyBlock.Bytes)
-if err != nil {
-    return err
-}
-```
-
-Then generate an ephemeral AES key for wrapping the target key.
-This example uses Golang's `crypto/rand` library for generating the key:
-
-```
-ephemeralAESKey := make([]byte, 32)
-_, err := rand.Read(ephemeralAESKey)
-if err != nil {
-        return err
-}
-```
-
-~> **NOTE**: Be sure to securely delete the ephemeral AES key once it
-has been used!
-
-Google's [tink library](https://pkg.go.dev/github.com/google/tink/go@v1.6.1/kwp/subtle)
-provides a function for performing the key wrap operation:
-
-```
-wrapKWP, err := subtle.NewKWP(aesKey)
-if err != nil {
-        return err
-}
-wrappedTargetKey, err := wrapKWP.Wrap(key)
-if err != nil {
-        return err
-}
-```
-
-Then encrypt the ephemeral AES key using the transit wrapping key:
-
-```
-wrappedAESKey, err := rsa.EncryptOAEP(
-        sha256.New(),
-        rand.Reader,
-        wrappingKey,
-        ephemeralAESKey,
-        []byte{},
-)
-if err != nil {
-        return err
-}
-```
-
-Note that though this example uses SHA256, Vault also supports the use of
-SHA1, SHA384, or SHA512. The hash function that was used at this step will
-need to be provided as a parameter when importing the key.
-
-Finally, concatenate the wrapped keys into a single byte string.
-The leftmost 4096 bits of the string should be the wrapped AES key, and
-the remaining bits should be the wrapped target key. Then the resulting
-bytes should be base64-encoded.
-
-```
-combinedCiphertext := append(wrappedAESKey, wrappedTargetKey...)
-base64Ciphertext := base64.StdEncoding.EncodeToString(combinedCiphertext)
-```
-
-This is the ciphertext that should be provided to Vault when importing a
-key into the transit secrets engine.
-
-```shell-session
-$ vault write transit/keys/test-key/import ciphertext=$CIPHERTEXT hash_function=SHA256 type=$KEY_TYPE
-```
-
-
-### AWS CloudHSM example
-
-This example demonstrates how to import a key into the transit secrets engine from
-an AWS CloudHSM cluster. The process and mechanisms used will apply to importing
-a key from an HSM in general, but the details will differ between HSMs.
-
-For information on creating and communicating with an AWS CloudHSM cluster, see
-the [Getting Started guide in the AWS CloudHSM documentation](https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started.html).
-
-Communication with the HSM uses AWS's `key_mgmt_util` tool. For help setting that
-up, see the [Getting Started page for key_mgmt_util](https://docs.aws.amazon.com/cloudhsm/latest/userguide/key_mgmt_util-getting-started.html).
-
-The first step is writing the transit wrapping key to the HSM. This involves
-creating a new RSA public key object with the key returned by transit's
-`wrapping_key` endpoint.
-
-```shell-session
-$ importPubKey -f wrapping_key.pem -l "vault-transit-wrapping-key"
-```
-
-This will create the public key in the HSM with all of the necessary permissions.
-If you're using a different tool, make sure that the usage for the wrapping key
-includes the attribute `CKA_WRAP`.
-
-The next step is wrapping the target key using the wrapping key. If the
-ID of the target key is `1` and the wrapping key is `2`, the command looks like this:
-
-```shell-session
-$ wrapKey -noheader -k 1 -w 2 -t 3 -m 7 -out ciphertext.key
-```
-
-The `-m 7` flag specifies the mechanism to use for the key wrapping. For AWS CloudHSM,
-7 corresponds to the PKCS11 mechanism `CKM_AES_RSA_KEY_WRAP` ([see the AWS documentation for details](https://docs.aws.amazon.com/cloudhsm/latest/userguide/key_mgmt_util-wrapKey.html)).
-The `-t 3` flag specifies `SHA256` as the hash function. The result is written to a
-file called `ciphertext.key`. The `noheader` flag ensures that the ciphertext does
-not include an AWS-specific header.
-
-The output from this is a binary file, which needs to be base64-encoded when it
-is provided to Vault.
-
-```shell-session
-$ export CIPHERTEXT=$(base64 ciphertext.key)
-$ vault write transit/keys/test-key/import ciphertext=$CIPHERTEXT hash_function=SHA256 type=$KEY_TYPE
-```
-
-Once the key has been imported, it can be used like any other transit key.
diff --git a/website/content/docs/secrets/venafi.mdx b/website/content/docs/secrets/venafi.mdx
deleted file mode 100644
index b123bc14bf8..00000000000
--- a/website/content/docs/secrets/venafi.mdx
+++ /dev/null
@@ -1,371 +0,0 @@
----
-layout: docs
-page_title: Venafi - Secrets Engines
-description: The Venafi integrated secrets engine for Vault.
----
-
-# Venafi secrets engine for HashiCorp Vault
-
-The Venafi Machine Identity Secrets Engine provides applications with the
-ability to dynamically generate SSL/TLS certificates that serve as machine
-identities. Using
-[Venafi Trust Protection Platform](https://www.venafi.com/platform/trust-protection-platform)
-or [Venafi Cloud](https://www.venafi.com/venaficloud) assures compliance
-with enterprise policy and consistency with industry standard trust protection.
-Designed for high performance with the same interface as the built-in PKI
-secrets engine, services can get certificates without manually generating a
-private key and CSR, submitting to a certificate authority, and waiting for a
-verification and signing process to complete. Venafi's certificate authority
-integrations and policy controls, combined with Vault's built-in authentication
-and authorization mechanisms, provide the verification functionality.
-
-Like the built-in PKI secrets engine, short-lived certificates for ephemeral
-workloads are the primary focus of the Venafi secrets engine. As such,
-revocation is not currently supported.
-
-The Venafi secrets engine makes use of HashiCorp Vault's
-[plugin system](/vault/docs/plugins)
-and Venafi's [VCert Client SDK](https://github.com/Venafi/vcert). If you have
-questions about the Venafi secrets engine, have an issue to report, or have
-developed improvements that you want to contribute, visit the
-[GitHub](https://github.com/Venafi/vault-pki-backend-venafi) repository.
-
-## Considerations
-
-To successfully deploy this secrets engine, there are some important
-considerations. Before using Venafi secrets engine, you should read every
-consideration.
-
-### Venafi trust protection platform requirements
-
-Your certificate authority (CA) must be able to issue a certificate in
-under one minute. Microsoft Active Directory Certificate Services (ADCS) is a
-popular choice. Other CA choices may have slightly different
-requirements.
-
-Within Trust Protection Platform, configure these settings. For more
-information see the _Venafi Administration Guide_.
-
-- A user account that has an authentication token for the "Venafi Secrets
-  Engine for HashiCorp Vault" (ID "hashicorp-vault-by-venafi") API Application
-  as of 20.1 (or scope "certificate:manage" for 19.2 through 19.4) or has been
-  granted WebSDK Access (deprecated)
-- A Policy folder where the user has the following permissions: View, Read,
-  Write, Create.
-- Enterprise compliant policies applied to the folder including:
-
-  - Subject DN values for Organizational Unit (OU), Organization (O),
-    City/Locality (L), State/Province (ST) and Country (C).
-  - CA Template that Trust Protection Platform will use to enroll general
-    certificate requests.
-  - Management Type not locked or locked to 'Enrollment'.
-  - Certificate Signing Request (CSR) Generation unlocked or not locked to
-    'Service Generated CSR'.
-  - Generate Key/CSR on Application not locked or locked to 'No'.
-  - (Recommended) Disable Automatic Renewal set to 'Yes'.
-  - (Recommended) Key Bit Strength set to 2048 or higher.
-  - (Recommended) Domain Whitelisting policy appropriately assigned.
-
-  **NOTE**: If you are using Microsoft ACDS, the CRL distribution point and
-  Authority Information Access (AIA) URIs must start with an HTTP URI
-  (non-default configuration). If an LDAP URI appears first in the X509v3
-  extensions, some applications will fail, such as NGINX ingress controllers.
-  These applications aren't able to retrieve CRL and OCSP information.
-
-#### Trust between Vault and trust protection platform
-
-The Trust Protection Platform REST API (WebSDK) must be secured with a
-certificate. Generally, the certificate is issued by a CA that is not publicly
-trusted so establishing trust is a critical part of your setup.
-
-Two methods can be used to establish trust. Both require the trust anchor
-(root CA certificate) of the WebSDK certificate. If you have administrative
-access, you can import the root certificate into the trust store for your
-operating system. If you don't have administrative access, or prefer not to
-make changes to your system configuration, save the root certificate to a file
-in PEM format (e.g. /opt/venafi/bundle.pem) and reference it using the
-`trust_bundle_file` parameter whenever you create or update a PKI role in your
-Vault.
-
-### Venafi Cloud requirements
-
-If you are using Venafi Cloud, be sure to set up an issuing template, project,
-and any other dependencies that appear in the Venafi Cloud documentation.
-
-- Set up an issuing template to link Venafi Cloud to your CA. To learn more,
-  search for "Issuing Templates" in the
-  [Venafi Cloud Help system](https://docs.venafi.cloud/help/Default.htm).
-- Create a project and zone that identifies the template and other information.
-  To learn more, search for "Projects" in the
-  [Venafi Cloud Help system](https://docs.venafi.cloud/help/Default.htm).
-
-## Setup
-
-<Tabs>
-<Tab heading="Vault" group="vault">
-
-Before certificates can be issued, you must complete these steps to configure the
-Venafi secrets engine:
-
-1. Create the [directory](/vault/docs/plugins/plugin-architecture#plugin-directory)
-   where your Vault server will look for plugins (e.g. /etc/vault/vault_plugins).
-   The directory must not be a symbolic link. On macOS, for example, /etc is a
-   link to /private/etc. To avoid errors, choose an alternative directory such
-   as /private/etc/vault/vault_plugins.
-
-1. Download the latest `vault-pki-backend-venafi`
-   [release package](https://github.com/Venafi/vault-pki-backend-venafi/releases/latest)
-   for your operating system. Unzip the binary to the plugin directory. Note
-   that the URL for the zip file, referenced below, changes as new versions of the
-   plugin are released. Replace the version (0.12.0) of the release in the command below to
-   download the desired version.
-
-   ```shell-session
-   $ wget https://github.com/Venafi/vault-pki-backend-venafi/releases/download/v0.12.0/venafi-pki-backend_v0.12.0_darwin.zip
-   $ unzip venafi-pki-backend_v0.12.0_darwin.zip
-   $ mv venafi-pki-backend /etc/vault/vault_plugins
-   ```
-
-1. Update the Vault [server configuration](/vault/docs/configuration/)
-   to specify the plugin directory:
-
-   ```shell-session
-   $ plugin_directory = "/etc/vault/vault_plugins"
-   ```
-
-1. Start your Vault using the [server command](/vault/docs/commands/server).
-
-1. Get the SHA-256 checksum of the `venafi-pki-backend` plugin binary:
-
-   ```shell-session
-   $ SHA256=$(sha256sum /etc/vault/vault_plugins/venafi-pki-backend| cut -d' ' -f1)
-   ```
-
-1. Register the `venafi-pki-backend` plugin in the Vault
-   [system catalog](/vault/docs/plugins/plugin-architecture#plugin-catalog):
-
-   ```shell-session
-   $ vault write sys/plugins/catalog/secret/venafi-pki-backend \
-   sha_256="${SHA256}" command="venafi-pki-backend"
-   ```
-
-1. Enable the Venafi secrets engine:
-
-   ```shell-session
-   $ vault secrets enable -path=venafi-pki -plugin-name=venafi-pki-backend plugin
-   ```
-
-1. Configure a Venafi secret that maps a name in Vault to connection and authentication
-   settings for enrolling certificates using Venafi. The zone is a policy folder for Trust
-   Protection Platform or a DevOps project zone for Venafi Cloud.
-
-   Obtain the `access_token` and `refresh_token` for Trust Protection Platform using the
-   [VCert CLI](https://github.com/Venafi/vcert/blob/master/README-CLI-PLATFORM.md#obtaining-an-authorization-token)
-   (`getcred` action with `--client-id "hashicorp-vault-by-venafi"` and
-   `--scope "certificate:manage"`) or the Platform's Authorize REST API method.
-
-   To see all options available for venafi secrets, use
-   `vault path-help venafi-pki/venafi/:name` after creating the secret.
-
-   **Trust Protection Platform**:
-
-   ```shell-session
-   $ vault write venafi-pki/venafi/tpp \
-       url="https://tpp.venafi.example" \
-       access_token="tn1PwE1QTZorXmvnTowSyA==" \
-       refresh_token="MGxV7DzNnclQi9CkJMCXCg==" \
-       zone="DevOps\\HashiCorp Vault" \
-       trust_bundle_file="/path-to/bundle.pem"
-   ```
-
-   **Venafi Cloud**:
-
-   ```shell-session
-   $ vault write venafi-pki/venafi/cloud \
-       apikey="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
-       zone="zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
-   ```
-
-1. Lastly, configure a [role](/vault/docs/secrets/pki)
-   that maps a name in Vault to a Venafi secret for enrollment. To see all
-   options available for roles, including `ttl`, `max_ttl` and `issuer_hint`
-   (for validity), use `vault path-help venafi-pki/roles/:name` after
-   creating the role.
-
-   **Trust Protection Platform**:
-
-   ```shell-session
-   $ vault write venafi-pki/roles/tpp \
-       venafi_secret=tpp \
-       store_by=serial store_pkey=true \
-       allowed_domains=example.com \
-       allow_subdomains=true
-   ```
-
-   **Venafi Cloud**:
-
-   ```shell-session
-   $ vault write venafi-pki/roles/cloud \
-       venafi_secret=cloud \
-       store_by=serial store_pkey=true \
-       allowed_domains=example.com \
-       allow_subdomains=true
-   ```
-
-</Tab>
-<Tab heading="HCP Vault" group="hcp">
-
-~> The Venafi Secrets Engine on HCP Vault currently supports Venafi Cloud or Trust Protection Platform instances secured using a certificate from a publicly trusted CA.
-Support for uploading a certificate signed by a private CA using trust_bundle_file parameter is not available on HCP Vault and requires running a self-managed Vault to use.
-
-Before certificates can be issued, you must complete these steps to configure the Venafi secrets engine:
-
-1. Navigate to your HCP Vault cluster's [Integrations](/hcp/docs/vault/integrations#hashicorp-partner-plugins) page within the HCP portal
-to add the Venafi secrets engine to your cluster.
-
-1. After the Venafi plugin has been successfully added to your cluster, you can use the Vault CLI to configure the Venafi secrets engine 
-for use.
-
-1. Enable the Venafi secrets engine:
-
-   ```shell-session
-   $ vault secrets enable -path=venafi-pki -plugin-name=venafi-pki-backend plugin
-   ```
-
-   Configure a Venafi secret that maps a name in Vault to connection and authentication
-   settings for enrolling certificates using Venafi. The zone is a DevOps project zone for Venafi Cloud.
-
-   To see all options available for venafi secrets, use
-   `vault path-help venafi-pki/venafi/:name` after creating the secret.
-
-   **Venafi Cloud**:
-
-   ```shell-session
-   $ vault write venafi-pki/venafi/cloud \
-       apikey="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
-       zone="zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz"
-   ```
-
-1. Lastly, configure a [role](/vault/docs/secrets/pki)
-   that maps a name in Vault to a Venafi secret for enrollment. To see all
-   options available for roles, including `ttl`, `max_ttl` and `issuer_hint`
-   (for validity), use `vault path-help venafi-pki/roles/:name` after
-   creating the role.
-
-   **Venafi Cloud**:
-
-   ```shell-session
-   $ vault write venafi-pki/roles/cloud \
-       venafi_secret=cloud \
-       store_by=serial store_pkey=true \
-       allowed_domains=example.com \
-       allow_subdomains=true
-   ```
-
-</Tab>
-</Tabs>
-
-## Usage
-
-After the Venafi secrets engine is configured and a user/machine has a Vault
-token with the proper permission, it can enroll certificates using Venafi.
-To see all of the options available when requesting a certificate, including
-`ttl` (for validity), `key_password`, and `custom_fields`, use
-`vault path-help venafi-pki/issue/:role-name` and
-`vault path-help venafi-pki/sign/:role-name`.
-
-1. Generate a certificate by writing to the `/issue` endpoint with the name of
-   the role:
-
-   **Trust Protection Platform**:
-
-   ```shell-session
-   $ vault write venafi-pki/issue/tpp common_name="common-name.example.com" \
-       alt_names="dns-san-1.example.com,dns-san-2.example.com"
-   ```
-   **Example output:** 
-
-   ```text
-   Key                  Value
-   ---                  -----
-   lease_id             venafi-pki/issue/tpp/oLih42SCFzyjntxGc00vqmWH
-   lease_duration       719h49m55s
-   lease_renewable      false
-   certificate          -----BEGIN CERTIFICATE-----
-   certificate_chain    -----BEGIN CERTIFICATE-----
-   common_name          common-name.example.com
-   private_key          -----BEGIN RSA PRIVATE KEY-----
-   serial_number        1d:bc:a8:3c:00:00:00:05:5c:e8
-   ```
-
-   **Venafi Cloud**:
-
-   ```shell-session
-   $ vault write venafi-pki/issue/cloud common_name="common-name.example.com" \
-       alt_names="dns-san-1.example.com,dns-san-2.example.com"
-   ```
-
-   **Example output:** 
-
-   ```text
-   Key                  Value
-   ---                  -----
-   lease_id             venafi-pki/issue/cloud/1WCNvXKiwboWfRRfjzlPAwEi
-   lease_duration       167h59m58s
-   lease_renewable      false
-   certificate          -----BEGIN CERTIFICATE-----
-   certificate_chain    -----BEGIN CERTIFICATE-----
-   common_name          common-name.example.com
-   private_key          -----BEGIN RSA PRIVATE KEY-----
-   serial_number        17:47:8b:13:90:b8:3d:87:b0:dc:b6:9e:00:2b:87:02:c9:d3:1e:8a
-   ```
-
-1. Or sign a CSR from a file by writing to the `/sign` endpoint with the name of
-   the role:
-
-   **Trust Protection Platform**:
-
-   ```shell-session
-   $ vault write venafi-pki/sign/tpp csr=@example.req
-   ```
-
-   **Example output:** 
-
-   ```text
-   Key                  Value
-   ---                  -----
-   lease_id             venafi-pki/sign/tpp/tQq3QNY45e4sJMqTTI9DXEGK
-   lease_duration       719h49m57s
-   lease_renewable      false
-   certificate          -----BEGIN CERTIFICATE-----
-   certificate_chain    -----BEGIN CERTIFICATE-----
-   common_name          common-name.example.com
-   serial_number        1d:c4:07:9a:00:00:00:05:5c:ea
-   ```
-
-   **Venafi Cloud**:
-
-   ```shell-session
-   $ vault write venafi-pki/sign/cloud csr=@example.req
-   ```
-
-   **Example output:** 
-
-   ```text
-   Key                  Value
-   ---                  -----
-   lease_id             venafi-pki/sign/cloud/fF44FdMAjuCdC29w3Ff81hes
-   lease_duration       167h59m58s
-   lease_renewable      false
-   certificate          -----BEGIN CERTIFICATE-----
-   certificate_chain    -----BEGIN CERTIFICATE-----
-   common_name          common-name.example.com
-   serial_number        76:55:e2:14:de:c8:3f:e1:64:4a:fa:37:d4:6e:f5:ef:5e:4c:16:5b
-   ```
-
-## API
-
-Venafi Machine Identity Secrets Engine uses the same
-[Vault API](/vault/api-docs/secret/pki)
-as the built-in PKI secrets engine. Some methods, such as those for
-managing certificate authorities, do not apply.
diff --git a/website/content/docs/sync/awssm.mdx b/website/content/docs/sync/awssm.mdx
deleted file mode 100644
index 10902e22514..00000000000
--- a/website/content/docs/sync/awssm.mdx
+++ /dev/null
@@ -1,147 +0,0 @@
----
-layout: docs
-page_title: AWS Secrets Manager - Secrets Sync Destination
-description: The AWS Secrets Manager destination syncs secrets from Vault to AWS.
----
-
-# AWS Secrets Manager
-
-The AWS Secrets Manager destination enables Vault to sync and unsync secrets of your choosing into
-an external AWS account. When configured, Vault will actively maintain the state of each externally-synced
-secret in near-realtime. This includes sending new secrets, updating existing secret values, and removing
-secrets when they either get dissociated from the destination or deleted from Vault. This enables the
-ability to keep control of all your secrets localized while leveraging the benefits of the AWS Secrets Manager.
-
-Prerequisites:
-* Ability to read or create KVv2 secrets
-* Ability to create AWS IAM user and access keys with access to the Secrets Manager
-* Ability to create sync destinations and associations on your Vault server
-
-## Setup
-
-1. Navigate to the [AWS Identity and Access Management (IAM) console](https://us-east-1.console.aws.amazon.com/iamv2/home#/home)
-  to configure a IAM user with access to the Secrets Manager. The following is an example policy outlining the required
-  permissions to use secrets syncing.
-
-  ```json
-  {
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-          "Effect": "Allow",
-          "Action": [
-            "secretsmanager:Create*",
-            "secretsmanager:Update*",
-            "secretsmanager:Delete*",
-            "secretsmanager:TagResource"
-          ],
-          "Resource": "arn:aws:secretsmanager:*:*:secret:vault*"
-        }
-    ]
-  }
-  ```
-
-1.	Configure a sync destination with the IAM user credentials created in the previous step.
-
-	```shell-session
-	$ vault write sys/sync/destinations/aws-sm/my-awssm-1 \
-		  access_key_id="$ACCESS_KEY_ID" \
-		  secret_access_key="$SECRET_ACCESS_KEY" \
-		  region='us-east-1'
-	```
-
-	**Output:**
-
-	<CodeBlockConfig hideClipboard>
-
-	```plaintext
-	Key                   Value
-	---                   -----
-	connection_details    map[access_key_id:***** region:us-east-1 secret_access_key:*****]
-	name                  my-awssm-1
-	type                  aws-sm
-	```
-
-	</CodeBlockConfig>
-
-## Usage
-
-1.	If you do not already have a KVv2 secret to sync, mount a new KVv2 secrets engine.
-
-	```shell-session
-	$ vault secrets enable -path=my-kv kv-v2
-	```
-
-	**Output:**
-
-	<CodeBlockConfig hideClipboard>
-
-	```plaintext
-	Success! Enabled the kv-v2 secrets engine at: my-kv/
-	```
-
-	</CodeBlockConfig>
-
-1. Create secrets you wish to sync with a target AWS Secrets Manager.
-
-	```shell-session
-	$ vault kv put -mount=my-kv my-secret foo='bar'
-	```
-
-	**Output:**
-
-	<CodeBlockConfig hideClipboard>
-
-	```plaintext
-	==== Secret Path ====
-	my-kv/data/my-secret
-
-	======= Metadata =======
-	Key                Value
-	---                -----
-	created_time       2023-09-19T13:17:23.395109Z
-	custom_metadata    <nil>
-	deletion_time      n/a
-	destroyed          false
-	version            1
-	```
-
-	</CodeBlockConfig>
-
-1.	Create an association between the destination and a secret to synchronize.
-
-	```shell-session
-	$ vault write sys/sync/destinations/aws-sm/my-awssm-1/associations/set \
-		mount='my-kv' \
-		secret_name='my-secret'
-	```
-
-	**Output:**
-
-	<CodeBlockConfig hideClipboard>
-
-	```plaintext
-	Key                   Value
-	---                   -----
-	associated_secrets    map[kv_37993f8a/my-secret:map[accessor:kv_37993f8a secret_name:my-secret sync_status:SYNCED updated_at:2023-09-19T13:17:35.085581-05:00]]
-	store_name            aws1
-	store_type            aws-sm
-	```
-
-	</CodeBlockConfig>
-
-1. Navigate to the [Secrets Manager](https://console.aws.amazon.com/secretsmanager/) in the AWS console
-	to confirm your secret was successfully synced.
-
-Moving forward, any modification on the Vault secret will be propagated to its AWS Secrets Manager
-counterpart. Creating a new secret version in Vault will update the one in AWS to the new version. Deleting either
-the secret or the association in Vault will delete the secret in your AWS account as well.
-
-## Tutorial
-
-Refer to the [Vault Enterprise Secrets Sync tutorial](/vault/tutorials/enterprise/secrets-sync)
-to learn how to configure the secrets sync between Vault and AWS Secrets Manager.
-
-## API
-
-Please see the [secrets sync API](/vault/api-docs/system/secrets-sync) for more details.
diff --git a/website/content/docs/sync/azurekv.mdx b/website/content/docs/sync/azurekv.mdx
deleted file mode 100644
index 329efc50a50..00000000000
--- a/website/content/docs/sync/azurekv.mdx
+++ /dev/null
@@ -1,172 +0,0 @@
----
-layout: docs
-page_title: Azure Key Vault - Secrets Sync Destination
-description: The Azure Key Vault destination syncs secrets from Vault to Azure.
----
-
-# Azure Key Vault
-
-The Azure Key Vault destination enables Vault to sync and unsync secrets of your choosing into
-an external Azure account. When configured, Vault will actively maintain the state of each externally-synced
-secret in realtime. This includes sending new secrets, updating existing secret values, and removing
-secrets when they either get dissociated from the destination or deleted from Vault.
-
-Prerequisites:
-* Ability to read or create KVv2 secrets
-* Ability to create Azure AD user credentials with access to an Azure Key Vault
-* Ability to create sync destinations and associations on your Vault server
-
-## Setup
-
-1. If you do not already have an Azure Key Vault instance, navigate to the Azure Portal to create a new
-  [Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/quick-create-portal).
-
-1. A service principal with a client id and client secret will be needed to configure Azure Key Vault as a
-  sync destination. This [guide](https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal)
-  will walk you through creating the service principal.
-
-1. Once the service principal is created, the next step is to
-  [grant the service principal](https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli)
-  access to Azure Key Vault. To quickly get started, we recommend using the "Key Vault Secrets Officer" built-in role,
-  which gives sufficient access to manage secrets. For more information, see the [Permissions](#permissions) section.
-
-
-1. Configure a sync destination with the service principal credentials and Key Vault URI created in the previous steps.
-
-  ```shell-session
-  $ vault write sys/sync/destinations/azure-kv/my-azure-1 \
-      key_vault_uri="$KEY_VAULT_URI" \
-      client_id="$CLIENT_ID" \
-      client_secret="$CLIENT_SECRET" \
-      tenant_id="$TENANT_ID"
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Key                   Value
-  ---                   -----
-  connection_details    map[client_id:123 client_secret:***** key_vault_uri:***** tenant_id:123]
-  name                  my-azure-1
-  type                  azure-kv
-  ```
-
-  </CodeBlockConfig>
-
-## Usage
-
-1. If you do not already have a KVv2 secret to sync, mount a new KVv2 secrets engine.
-
-  ```shell-session
-  $ vault secrets enable -path='my-kv' kv-v2
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Success! Enabled the kv-v2 secrets engine at: my-kv/
-  ```
-
-  </CodeBlockConfig>
-
-1. Create secrets you wish to sync with a target Azure Key Vault.
-
-  ```shell-session
-  $ vault kv put -mount='my-kv' my-secret foo='bar'
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  ==== Secret Path ====
-  my-kv/data/my-secret
-
-  ======= Metadata =======
-  Key                Value
-  ---                -----
-  created_time       2023-09-19T13:17:23.395109Z
-  custom_metadata    <nil>
-  deletion_time      n/a
-  destroyed          false
-  version            1
-  ```
-
-  </CodeBlockConfig>
-
-1. Create an association between the destination and a secret to synchronize.
-
-  ```shell-session
-  $ vault write sys/sync/destinations/azure-kv/my-azure-1/associations/set \
-      mount='my-kv' \
-      secret_name='my-secret'
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Key                   Value
-  ---                   -----
-  associated_secrets    map[kv_7532a8b4/my-secret:map[accessor:kv_7532a8b4 secret_name:my-secret sync_status:SYNCED updated_at:2023-09-21T13:53:24.839885-07:00]]
-  store_name            my-azure-1
-  store_type            azure-kv
-  ```
-
-  </CodeBlockConfig>
-
-1. Navigate to [Azure Key Vault](https://portal.azure.com/#view/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
-  in the Azure portal to confirm your secret was successfully created.
-
-Moving forward, any modification on the Vault secret will be propagated in near real time to its Azure Key Vault
-counterpart. Creating a new secret version in Vault will create a new version in Azure Key Vault. Deleting the secret
-or the association in Vault will delete the secret in your Azure Key Vault as well.
-
-
-## Permissions
-
-For a more minimal set of permissions, you can create a
-[custom role](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles#steps-to-create-a-custom-role)
-using the following JSON role definition. Be sure to replace the subscription id placeholder.
-
-```json
-{
-  "properties": {
-    "roleName": "Key Vault Secrets Reader Writer",
-    "description": "Custom role for reading and updating Azure Key Vault secrets.",
-    "permissions": [
-      {
-        "actions": [
-          "Microsoft.KeyVault/vaults/secrets/read",
-          "Microsoft.KeyVault/vaults/secrets/write"
-        ],
-        "notActions": [],
-        "dataActions": [
-          "Microsoft.KeyVault/vaults/secrets/delete",
-          "Microsoft.KeyVault/vaults/secrets/backup/action",
-          "Microsoft.KeyVault/vaults/secrets/purge/action",
-          "Microsoft.KeyVault/vaults/secrets/recover/action",
-          "Microsoft.KeyVault/vaults/secrets/restore/action",
-          "Microsoft.KeyVault/vaults/secrets/readMetadata/action",
-          "Microsoft.KeyVault/vaults/secrets/getSecret/action",
-          "Microsoft.KeyVault/vaults/secrets/setSecret/action"
-        ],
-        "notDataActions": []
-      }
-    ],
-    "assignableScopes": [
-      "/subscriptions/{subscriptionId}/"
-    ]
-  }
-}
-```
-
-## API
-
-Please see the [secrets sync API](/vault/api-docs/system/secrets-sync) for more details.
diff --git a/website/content/docs/sync/gcpsm.mdx b/website/content/docs/sync/gcpsm.mdx
deleted file mode 100644
index 589bbcf8bed..00000000000
--- a/website/content/docs/sync/gcpsm.mdx
+++ /dev/null
@@ -1,269 +0,0 @@
----
-layout: docs
-page_title: Google Cloud Platform Secret Manager - Secrets Sync Destination
-description: The Google Cloud Platform Secret Manager destination syncs secrets from Vault to GCP.
----
-
-# Google Cloud Platform Secret Manager
-
-The Google Cloud Platform (GCP) Secret Manager sync destination allows Vault to safely synchronize secrets to your GCP projects.
-This is a low footprint option that enables your applications to benefit from Vault-managed secrets without requiring them
-to connect directly with Vault. This guide walks you through the configuration process.
-
-Prerequisites:
-* Ability to read or create KVv2 secrets
-* Ability to create GCP Service Account credentials with access to the Secret Manager
-* Ability to create sync destinations and associations on your Vault server
-
-## Setup
-
-1. If you do not already have a Service Account, navigate to the IAM & Admin page in the Google Cloud console to
-  [create a new Service Account](https://cloud.google.com/iam/docs/service-accounts-create) with the
-  [necessary permissions](/vault/docs/sync/gcpsm#permissions). [Instructions](/vault/docs/sync/gcpsm#provision-service-account)
-  to provision this Service Account via Terraform can be found below.
-
-1. Configure a sync destination with the Service Account JSON credentials created in the previous step. See docs for
-  [alternative ways](/vault/docs/secrets/gcp#authentication) to pass in the `credentials` parameter.
-
-  ```shell-session
-  $ vault write sys/sync/destinations/gcp-sm/my-dest \
-      credentials='@path/to/credentials.json'
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Key                   Value
-  ---                   -----
-  connection_details    map[credentials:*****]
-  name                  my-dest
-  type                  gcp-sm
-  ```
-
-  </CodeBlockConfig>
-
-## Usage
-
-1. If you do not already have a KVv2 secret to sync, mount a new KVv2 secrets engine.
-
-  ```shell-session
-  $ vault secrets enable -path=my-kv kv-v2
-  ```
-
-  **Output**:
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Success! Enabled the kv-v2 secrets engine at: my-kv/
-  ```
-
-  </CodeBlockConfig>
-
-1. Create secrets you wish to sync with a target GCP Secret Manager.
-
-  ```shell-session
-  $ vault kv put -mount=my-kv my-secret foo='bar'
-  ```
-
-  **Output**:
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  ==== Secret Path ====
-  my-kv/data/my-secret
-
-  ======= Metadata =======
-  Key                Value
-  ---                -----
-  created_time       <timestamp>
-  custom_metadata    <nil>
-  deletion_time      n/a
-  destroyed          false
-  version            1
-  ```
-
-  </CodeBlockConfig>
-
-1. Create an association between the destination and a secret to synchronize.
-
-  ```shell-session
-  $ vault write sys/sync/destinations/gcp-sm/my-dest/associations/set \
-      mount='my-kv' \
-      secret_name='my-secret'
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Key                   Value
-  ---                   -----
-  associated_secrets    map[kv_1234/my-secret:map[accessor:kv_1234 secret_name:my-secret sync_status:SYNCED updated_at:<timestamp>]]
-  store_name            my-dest
-  store_type            gcp-sm
-  ```
-
-  </CodeBlockConfig>
-
-1. Navigate to the [Secret Manager](https://console.cloud.google.com/security/secret-manager) in the Google Cloud console
-  to confirm your secret was successfully created in your GCP project.
-
-Moving forward, any modification on the Vault secret will be propagated in near real time to its GCP Secret Manager
-counterpart. Creating a new secret version in Vault will create a new version in GCP Secret Manager. Deleting the secret
-or the association in Vault will delete the secret in your GCP project as well.
-
-## Permissions
-
-The credentials given to Vault must have the following permissions to synchronize secrets:
-
-```shell-session
-secretmanager.secrets.create
-secretmanager.secrets.delete
-secretmanager.secrets.get
-secretmanager.secrets.list
-secretmanager.secrets.update
-secretmanager.versions.access
-secretmanager.versions.add
-secretmanager.versions.destroy
-secretmanager.versions.get
-secretmanager.versions.list
-```
-
-## Provision service account
-
-Vault needs to be configured with credentials to establish a trust relationship with your GCP project so it can manage
-Secret Manager secrets on your behalf. The IAM & Admin page in the Google Cloud console can be used to
-[create a new Service Account](https://cloud.google.com/iam/docs/service-accounts-create) with access to the Secret Manager.
-
-You can equally use the [Terraform Google provider](https://registry.terraform.io/providers/hashicorp/google/latest/docs#authentication-and-configuration)
-to provision a GCP Service Account with the appropriate policies.
-
-1. Copy-paste this HCL snippet into a `secrets-sync-setup.tf` file.
-
-  ```hcl
-  provider "google" {
-      // See https://registry.terraform.io/providers/hashicorp/google/latest/docs#authentication-and-configuration to setup the Google Provider
-      // for options on how to configure this provider. The following parameters or environment
-      // variables are typically used.
-
-      // Parameters
-      // region = "" (Optional)
-      // project = ""
-      // credentials = ""
-
-      // Environment Variables
-      // GOOGLE_REGION (optional)
-      // GOOGLE_PROJECT
-      // GOOGLE_CREDENTIALS	(The path to a service account key file with the
-      //				        "Service Account Admin", "Service Account Key
-      //					    Admin", and "Security Admin" roles attached)
-  }
-
-  data "google_client_config" "config" {}
-
-  resource "google_service_account" "vault_secrets_sync_account" {
-    account_id  = "gcp-sm-vault-secrets-sync"
-    description = "service account for Vault Secrets Sync feature"
-  }
-
-  // Production environments should use a more restricted role.
-  // The built-in secret manager admin role is used as an example for simplicity.
-  data "google_iam_policy" "vault_secrets_sync_iam_policy" {
-    binding {
-      role = "roles/secretmanager.admin"
-      members = [
-        google_service_account.vault_secrets_sync_account.email,
-      ]
-    }
-  }
-
-  resource "google_project_iam_member" "vault_secrets_sync_iam_member" {
-    project = data.google_client_config.config.project
-    role    = "roles/secretmanager.admin"
-    member  = google_service_account.vault_secrets_sync_account.member
-  }
-
-  resource "google_service_account_key" "vault_secrets_sync_account_key" {
-    service_account_id = google_service_account.vault_secrets_sync_account.name
-    public_key_type    = "TYPE_X509_PEM_FILE"
-  }
-
-  resource "local_file" "vault_secrets_sync_credentials_file" {
-    content  = base64decode(google_service_account_key.vault_secrets_sync_account_key.private_key)
-    filename = "gcp-sm-sync-service-account-credentials.json"
-  }
-
-  output "vault_secrets_sync_credentials_file_path" {
-    value = abspath("${path.module}/${local_file.sync_service_account_credentials_file.filename}")
-  }
-  ```
-
-1. Execute a plan to validate the Terraform Google provider is properly configured.
-
-  ```shell-session
-  $ terraform init && terraform plan
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  (...)
-  Plan: 4 to add, 0 to change, 0 to destroy.
-  ```
-
-  </CodeBlockConfig>
-
-1. Execute an apply to provision the Service Account.
-
-  ```shell-session
-  $ terraform apply
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  (...)
-  Apply complete! Resources: 4 added, 0 changed, 0 destroyed.
-
-  Outputs:
-
-  sync_service_account_credentials_file = "/path/to/credentials/file/gcp-sm-sync-service-account-credentials.json"
-  ```
-
-  </CodeBlockConfig>
-
-The generated Service Account credentials file can then be used to configure the Vault GCP Secret Manager destination
-following the [setup](/vault/docs/sync/gcpsm#setup) steps.
-
-## Targeting specific GCP projects
-
-By default, the target GCP project to sync secrets with is derived from the service 
-account JSON [credentials](/vault/api-docs/system/secrets-sync#credentials) or application 
-default credentials for a particular GCP sync destination. This means secrets will be synced
-within the parent project of the configured service account.
-
-In some cases, it's desirable to use a single service account or [workload identity](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances)
-to sync secrets with any number of GCP projects within an organization. To achieve this, 
-you can set the `project_id` parameter to the target project to sync secrets with:
-
-```shell-session
-  $ vault write sys/sync/destinations/gcp-sm/my-dest \
-      project_id='target-project-id'
-```
-
-This overrides the project ID derived from the service account JSON credentials or application
-default credentials. The service account must be [authorized](https://cloud.google.com/iam/docs/service-account-overview#locations)
-to perform Secret Manager actions in the target project.
-
-## API
-
-Please see the [secrets sync API](/vault/api-docs/system/secrets-sync) for more details.
diff --git a/website/content/docs/sync/github.mdx b/website/content/docs/sync/github.mdx
deleted file mode 100644
index 78c6f80b666..00000000000
--- a/website/content/docs/sync/github.mdx
+++ /dev/null
@@ -1,243 +0,0 @@
----
-layout: docs
-page_title: GitHub - Secrets Sync Destination
-description: The GitHub destination syncs secrets from Vault to GitHub.
----
-
-# GitHub repository secrets
-
-The GitHub repository sync destination allows Vault to safely synchronize secrets as GitHub repository action secrets.
-This is a low footprint option that enables your applications to benefit from Vault-managed secrets without requiring them
-to connect directly with Vault. This guide walks you through the configuration process.
-
-Prerequisites:
-* Ability to read or create KVv2 secrets
-* Ability to create GitHub fine-grained or personal tokens (or a GitHub application) with access to modify repository secrets
-* Ability to create sync destinations and associations on your Vault server
-
-## Setup
-
-1. To get started with syncing Vault secrets to your GitHub repository, you will need a configured [GitHub application](#github-application) or an
-  [access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)
-  which has access to the repository you want to manage secrets for and write permissions on the repository's actions secrets.
-  In the list of GitHub permissions, this is simply called "Secrets". Choosing this will automatically include read-only Metadata.
-
-<Warning title="Pitfalls of using an access token">
-  Access tokens are tied to a user account and can be revoked at any time, causing disruptions to the sync process.
-  GitHub applications are long-lived and do not expire. Using a GitHub application for authentication is preferred over using a personal access token.
-</Warning>
-
-
-If you decide to go with an access token, here's how you can configure a sync destination:
-
-  ```shell-session
-  $ vault write sys/sync/destinations/gh/my-dest \
-      access_token="$ACCESS_TOKEN" \
-      repository_owner="$OWNER" \
-      repository_name="$NAME"
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Key                   Value
-  ---                   -----
-  connection_details    map[access_token:***** repository_owner:<owner> repository_name:<name>]
-  name                  my-dest
-  type                  gh
-  ```
-
-  </CodeBlockConfig>
-
-## Usage
-
-1. If you do not already have a KVv2 secret to sync, mount a new KVv2 secrets engine.
-
-  ```shell-session
-  $ vault secrets enable -path=my-kv kv-v2
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```
-  Success! Enabled the kv-v2 secrets engine at: my-kv/
-  ```
-
-  </CodeBlockConfig>
-
-1. Create secrets you wish to sync with a target GitHub repository for Actions.
-
-  ```shell-session
-  $ vault kv put -mount='my-kv' my-secret foo='bar'
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  ==== Secret Path ====
-  my-kv/data/my-secret
-
-  ======= Metadata =======
-  Key                Value
-  ---                -----
-  created_time       <timestamp>
-  custom_metadata    <nil>
-  deletion_time      n/a
-  destroyed          false
-  version            1
-  ```
-
-  </CodeBlockConfig>
-
-1. Create an association between the destination and a secret to synchronize.
-
-  ```shell-session
-  $ vault write sys/sync/destinations/gh/my-dest/associations/set \
-      mount=my-kv \
-      secret_name=my-secret
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Key                   Value
-  ---                   -----
-  associated_secrets    map[kv_1234/my-secret:map[accessor:kv_1234 secret_name:my-secret sync_status:SYNCED updated_at:<timestamp>>]]
-  store_name            my-dest
-  store_type            gh
-  ```
-
-  </CodeBlockConfig>
-
-1. Navigate to your GitHub repository settings to confirm your secret was successfully created.
-
-Moving forward, any modification on the Vault secret will be propagated in near real time to its GitHub repository secrets
-counterpart. Creating a new secret version in Vault will create a new version in GitHub. Deleting the secret
-or the association in Vault will delete the secret in GitHub as well.
-
-## Security
-
-<Note>
-
-GitHub only supports single value secrets, so KVv2 secrets from Vault will be stored as a JSON string.
-In the example above, the value for secret "my-secret" will be synced to GitHub as the JSON string `{"foo":"bar"}` if the
-destination is configured to use the `secret-path` [granularity level](/vault/docs/sync#granularity).
-
-</Note>
-
-If using the secret-path granularity, it is strongly advised to mask individual values for each sub-key to prevent the
-unintended disclosure of secrets in any GitHub Action outputs. The following snippet illustrates how to mask each secret values:
-
-  ```yaml
-  name: Mask synced secret values
-
-  on:
-    workflow_dispatch
-
-  jobs:
-    synced-secret-examples:
-      runs-on: ubuntu-latest
-      steps:
-        - name: ✓ Mask synced secret values
-          run: |
-            for v in $(echo '${{ secrets.VAULT_KV_1234_MY_SECRET }}' | jq -r '.[]'); do
-              echo "::add-mask::$v"
-            done
-  ```
-
-If the GitHub destination uses the default `secret-key` granularity, the values are masked by GitHub automatically.
-
-## GitHub application
-
-Instead of authenticating with a personal access token, you can choose to
-authenticate with a
-[custom GitHub application](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app).
-
-Start by following the GitHub instructions for
-[installing a GitHub app](https://docs.github.com/en/apps/using-github-apps/installing-your-own-github-app).
-to install your GitHub application on a specified repository and note the
-assigned installation ID.
-
-<Tip title="Your installation ID is in the app URL">
-
-  You can find your assigned installation ID in the URL path parameter:
-  `https://github.com/settings/installations/<INSTALLATION_ID>`
-
-</Tip>
-
-Then add your GitHub application to your Vault instance.
-
-To use your GitHub application with Vault:
-
-- the application must have permission to read and write secrets.
-- you must generate a private key for the application on GitHub.
-- the application must be installed on the repository you want to sync secrets with.
-- you must know the application ID assigned by GitHub.
-- you must know the installation ID assigned by GitHub.
-
-Callback, redirect URLs, and webhooks are not required at this time.
-
-To configure the application in Vault, use `vault write` with the
-`sys/sync/github-apps` endpoint to assign a unique name and set the relevant
-information:
-
-<CodeBlockConfig hideClipboard>
-
-```shell-session
-$ vault write sys/sync/github-apps/<APP_NAME> \
-  app_id=<APP_ID> \
-  private_key=<PATH_TO_PRIVATE_KEY>
-
-Key            Value
----            -----
-app_id         <app-id>
-fingerprint    <fingerprint>
-name           <app-name>
-private_key    *****
-```
-</CodeBlockConfig>
-
-<Tip title="Fingerprint verification">
-
-Vault returns the fingerprint of the private_key provided to ensure that the
-correct private key was configured and that it was not tampered with along the way.
-You can compare the fingerprint to the one provided by GitHub.
-For more information, see [Verifying private keys](https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/managing-private-keys-for-github-apps#verifying-private-keys).
-
-</Tip>
-
-
-Next, use `vault write` with the `sys/sync/destinations/gh` endpoint to
-configure a GitHub destination that references your new GitHub application:
-
-<CodeBlockConfig hideClipboard>
-
-```shell-session
-$ vault write sys/sync/destinations/gh/<DESTINATION_NAME> \
-installation_id=<INSTALLATION_ID>                         \
-repository_owner=<GITHUB_USER>                            \
-repository_name=<MY_REPO_NAME>                            \
-app_name=<APP_NAME>
-
-Key                   Value
----                   -----
-connection_details    map[app_config:map[app_name:<app-name>] installation_id:<installation-id> repository_name:<repo-name> repository_owner:<repo-owner>]
-name                  my-dest
-options               map[custom_tags:map[] granularity_level:secret-key secret_name_template:VAULT_{{ .MountAccessor | uppercase }}_{{ .SecretPath | uppercase }}_{{ .SecretKey | uppercase }}]
-type                  gh
-```
-</CodeBlockConfig>
-
-You can now [use your GitHub application to sync secrets with your GitHub repository](#usage).
-
-## API
-
-Please see the [secrets sync API](/vault/api-docs/system/secrets-sync) for more details.
diff --git a/website/content/docs/sync/index.mdx b/website/content/docs/sync/index.mdx
deleted file mode 100644
index 070edd0294b..00000000000
--- a/website/content/docs/sync/index.mdx
+++ /dev/null
@@ -1,288 +0,0 @@
----
-layout: docs
-page_title: Secrets sync
-description: Secrets sync allows you to safely sync Vault-managed secrets with external destinations.
----
-
-
-# Secrets sync
-
-<EnterpriseAlert product="vault" />
-
-@include 'alerts/beta.mdx'
-
-In certain circumstances, fetching secrets directly from Vault is impossible or impractical. To help with this challenge,
-Vault can maintain a one-way sync for KVv2 secrets into various destinations that are easier to access for some clients.
-With this, Vault remains the system of records but can cache a subset of secrets on various external systems acting as
-trusted last-mile delivery systems.
-
-A secret that is associated from a Vault KVv2 Secrets Engine into an external destination is actively managed by a continuous
-process. If the secret value is updated in Vault, the secret is updated in the destination as well. If the secret is deleted
-from Vault, it is deleted on the external system as well. This process is asynchronous and event-based. Vault propagates
-modifications into the proper destinations automatically in a handful of seconds.
-
-## Destinations
-
-Secrets can be synced into various external systems, called destinations. The supported destinations are:
-* [AWS Secrets Manager](/vault/docs/sync/awssm)
-* [Azure Key Vault](/vault/docs/sync/azurekv)
-* [GCP Secret Manager](/vault/docs/sync/gcpsm)
-* [GitHub Repository Actions](/vault/docs/sync/github)
-* [Vercel Projects](/vault/docs/sync/vercelproject)
-
-## Associations
-
-Syncing a secret into one of the external systems is done by creating a connection between it and a destination, which is
-called an association. These associations are created via Vault's API by adding a KVv2 secret target to one of the configured
-destinations. Each association keeps track of that secret's current sync status, the timestamp of its last status change, and
-the error code of the last sync or unsync operation if it failed. Each destination can have any number of secret associations.
-
-## Sync statuses
-
-There are several sync statuses which relay information about the outcome of the latest sync
-operation to have occurred on that secret. The status information is stored inside each
-association object returned by the endpoint and, upon failure, includes an error code describing the cause of the failure.
-
-| Status                   | Description                                                                                     |
-|:-------------------------|:------------------------------------------------------------------------------------------------|
-| `UNKNOWN`                | Vault is unable to determine the current state of the secret in regard to the external service. |
-| `PENDING`                | An operation is queued for that secret and has not been processed yet.                          |
-| `SYNCED`                 | The sync operation was successful and sent the secret to the external destination.              |
-| `UNSYNCED`               | The unsync operation was successful and removed the secret from the external destination.       |
-| `INTERNAL_VAULT_ERROR`   | The operation failed due to an issue internal to Vault.                                         |
-| `CLIENT_SIDE_ERROR`      | The operation failed due to a configuration error such as invalid privileges.                   |
-| `EXTERNAL_SERVICE_ERROR` | The operation failed due to an issue with the external service such as a temporary downtime.    |
-
-## Name template
-
-By default, the name of synced secrets follows this format: `vault/<accessor>/<secret-path>`. The casing and delimiters
-may change according to the valid character set of each destination type. This pattern was chosen to prevent accidental
-name collisions and to clearly identify where the secret is coming from.
-
-Every destination allows you to customize this name pattern by configuring a `secret_name_template` field to best suit
-individual use cases. The templates use a subset of the go-template syntax for extra flexibility.
-
-The following placeholders are available:
-
-| Placeholder         | Description                                                                                                 |
-|:--------------------|:------------------------------------------------------------------------------------------------------------|
-| `DestinationType`   | The type of the destination, e.g. "aws-sm"                                                                  |
-| `DestinationName`   | The name of the destination                                                                                 |
-| `NamespacePath`     | The full namespace path where the secret being synced is located                                            |
-| `NamespaceBaseName` | The segment following the last `/` character from the full path                                             |
-| `NamespaceID`       | The internal unique ID identifying the namespace, e.g. `RQegM`                                              |
-| `MountPath`         | The full mount path where the secret being synced is located                                                |
-| `MountBaseName`     | The segment following the last `/` character from the full path                                             |
-| `MountAccessor`     | The internal unique ID identifying the mount, e.g. `kv_1234`                                                |
-| `SecretPath`        | The full secret path                                                                                        |
-| `SecretBaseName`    | The segment following the last `/` character from the full path                                             |
-| `SecretKey`         | The individual secret key being synced, only available if the destination uses the `secret-key` granularity |
-
-Let's assume we want to sync the following secret:
-
-  <CodeBlockConfig hideClipboard>
-
-    $ VAULT_NAMESPACE=ns1/ns2 vault kv get -mount=path/to/kv1 path/to/secret1
-
-    ========== Secret Path ==========
-    path/to/kv1/data/path/to/secret1
-
-    ======= Metadata =======
-    (...)
-
-    === Data ===
-    Key    Value
-    ---    -----
-    foo    bar
-
-  </CodeBlockConfig>
-
-Let's look at some name template examples and the resulting secret name at the sync destination.
-
-| Name template                            | Result                 |
-|:-----------------------------------------|:-----------------------|
-| prefix-{{ .SecretPath }}                 | prefix-path/to/secret1 |
-| {{ .SecretBaseName \| uppercase }}       | SECRET1                |
-| {{ .MountAccessor }}_{{ .SecretKey }}    | kv_1234_foo            |
-| {{ .SecretPath \| replace \"/\" \"_\" }} | path_to_secret1        |
-
-Name templates can be updated. The new template is only effective for new secrets associated with the destination and does
-not affect the secrets synced with the previous template. It is possible to update an association to force a recreate operation.
-The secret synced with the old template will be deleted and a new secret using the new template version will be synced.
-
-## Granularity
-
-Vault KV-v2 secrets are multi-value and their data is represented in JSON. Multi-value secrets are useful to bundle closely
-related information together like a username & password pair. However, most secret management systems only support single-value
-entries. Secrets sync allows you to choose the granularity that best suits your use case for each destination by specifying a `granularity`
-field.
-
-The `secret-path` granularity syncs the entire JSON content of the Vault secret as a single entry at the destination. If
-the destination does not support multi-value secret the JSON is encoded as a single-value JSON-string.
-
-The `secret-key` granularity syncs each Vault key-value pair as a distinct entry at the destination. If the value itself is a list or map
-it is encoded as a JSON blob.
-
-Granularity can be updated. The new granularity only affects secrets newly associated with the destination and does
-not modify the previously synced secrets. It is possible to update an association to force a recreate operation.
-The secret synced with the old granularity will be deleted and new secrets will be synced according to the new granularity.
-
-## Security
-
-### Vault access requirements
-
-Vault verifies the client has read access on the secret before syncing it with any destination. This additional check is
-there to prevent users from maliciously or unintentionally leveraging elevated permissions on an external system to access
-secrets they normally wouldn't be able to.
-
-Let's assume we have a secret located at `path/to/data/secret1` and a user with write access to the sync feature,
-but no read access to that secret. This scenario is equivalent to this ACL policy:
-
-  <CodeBlockConfig hideClipboard>
-
-    # Allow full access to the sync feature
-    path "sys/sync/*" {
-      capabilities = ["read", "list", "create", "update", "delete"]
-    }
-
-    # Allow read access to the secret mount path/to
-    path "path/to/*" {
-      capabilities = ["read"]
-    }
-
-    # Deny access to a specific secret
-    path "path/to/data/my-secret-1" {
-      capabilities = ["deny"]
-    }
-
-  </CodeBlockConfig>
-
-If a client with this policy tries to read this secret they will receive an unauthorized error:
-
-  <CodeBlockConfig hideClipboard>
-
-    $ vault kv get -mount=path/to my-secret-1
-
-    Error reading path/to/data/my-secret-1: Error making API request.
-
-    URL: GET http://127.0.0.1:8200/v1/path/to/data/my-secret-1
-    Code: 403. Errors:
-
-    * 1 error occurred:
-      * permission denied
-
-  </CodeBlockConfig>
-
-Likewise, if the client tries to sync this secret to any destination they will receive a similar unauthorized error:
-
-  <CodeBlockConfig hideClipboard>
-
-    $ vault write sys/sync/destinations/$TYPE/$NAME/associations/set \
-    mount="path/to" \
-    secret_name="my-secret-1"
-
-    Error writing data to sys/sync/destinations/$TYPE/$NAME/associations/set: Error making API request.
-
-    URL: PUT http://127.0.0.1:8200/v1/sys/sync/destinations/$TYPE/$NAME/associations/set
-    Code: 403. Errors:
-
-    * permission denied to read the content of the secret my-secret-1 in mount path/to
-
-  </CodeBlockConfig>
-
-This read access verification is only done when creating or updating an association. Once the association is created, revoking
-read access to the policy that was used to sync the secret has no effect.
-
-Vault does not control the permissions at the destination. It is the responsibility of the operator to configure proper
-read access on the external system so synced secrets are not accessed unintentionally.
-
-### Collisions and overwrites
-
-Secrets Sync operates with a last-write-wins strategy. If a secret with the same name already exists at the destination,
-Vault overwrites it when syncing a secret. There are also no automatic mechanisms to prevent a principal with sufficient
-privileges at the destination from overwriting a secret synced by Vault.
-
-To prevent Vault from accidentally overwriting existing secrets, it is recommended to use either the name pattern or
-built-in tag as an extra policy condition on the role used to configure a Vault sync destination. For example, the
-following AWS IAM policy prevents Vault from being able to modify secrets that were not created by a sync operation:
-
-  <CodeBlockConfig hideClipboard>
-
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Effect": "Allow",
-          "Action": [
-            "secretsmanager:*",
-          ],
-          "Resource": "*",
-          "Condition": {
-            "StringEquals": {
-              "secretsmanager:ResourceTag/hashicorp:vault": "" # This tag is automatically added by Vault on every synced secrets
-            }
-          }
-        }
-      ]
-    }
-
-  </CodeBlockConfig>
-
-Likewise, is it recommended to add a negative condition on other policies not used by Vault that grant write access to
-secrets to prevent out-of-band overwrites:
-
-  <CodeBlockConfig hideClipboard>
-
-    {
-      "Version": "2012-10-17",
-      "Statement": [
-        {
-          "Effect": "Deny",
-          "Action": [
-            "secretsmanager:*"
-          ],
-          "Resource": "*",
-          "Condition": {
-            "StringNotEquals": {
-              "secretsmanager:ResourceTag/hashicorp:vault": "" # This tag is automatically added by Vault on every synced secrets
-            }
-          }
-        }
-      ]
-    }
-
-  </CodeBlockConfig>
-
-  <Note>
-  Wildcards are used in the example above for brevity, but it is recommended to use the least privilege principle and restrict
-  the actions and resources to the minimum requirements for each use case.
-  </Note>
-
-This policy condition strategy is also applicable to most other destination types. Please refer to the specific destination's
-access management documentation for more details.
-
-
-## Reconciliation
-
-Vault Secrets Sync is designed to automatically recover from transient failures
-in two ways: operation retries and reconciliation scans.
-
-Operation retries happen when a sync operation fails. Vault automatically
-retries the operation with exponential backoff. Operation retries help in
-situations where your network becomes unreliable or overwhelmed.
-
-Reconciliation scans happen periodically in a background thread. Vault scans all
-secrets currently managed by the sync system to identify and update out-of-date
-secrets, and to ensure that any configured destinations are up-to-date.
-Reconciliation scans help in situations where there are external service downtimes
-that are outside of your control and provide a way to automatically recover and self-heal.
-
-Operation retries and reconciliation scans are both enabled by default.
-
-Note that reconciliation process do not protect from out-of-band updates
-that occur directly in the external service. The secrets sync system is designed to be
-one-way and does not support bidirectional sync at this time.
-
-## API
-
-Please see the [secrets sync API](/vault/api-docs/system/secrets-sync) for more details.
diff --git a/website/content/docs/sync/vercelproject.mdx b/website/content/docs/sync/vercelproject.mdx
deleted file mode 100644
index c7fb61340f6..00000000000
--- a/website/content/docs/sync/vercelproject.mdx
+++ /dev/null
@@ -1,132 +0,0 @@
----
-layout: docs
-page_title: Vercel Project - Secrets Sync Destination
-description: The Vercel Project destination syncs secrets from Vault to Vercel.
----
-
-# Vercel Project environment variables
-
-The Vercel Project sync destination allows Vault to safely synchronize secrets as Vercel environment variables.
-This is a low footprint option that enables your applications to benefit from Vault-managed secrets without requiring them
-to connect directly with Vault. This guide walks you through the configuration process.
-
-Prerequisites:
-* Ability to read or create KVv2 secrets
-* Ability to create Vercel tokens with access to modify project environment variables
-* Ability to create sync destinations and associations on your Vault server
-
-## Setup
-
-1. If you do not already have a Vercel token, navigate [your account settings](https://vercel.com/account/tokens) to
-   generate credentials with the necessary permissions to manage your project's environment variables.
-
-1. Next you need to locate your project ID. It can be found under the `Settings` tab in your project's overview page.
-
-1. Configure a sync destination with the access token and project ID obtained in the previous steps.
-
-  ```shell-session
-  $ vault write sys/sync/destinations/vercel-project/my-dest \
-      access_token="$TOKEN" \
-      project_id="$PROJECT_ID" \
-      deployment_environments=development \
-      deployment_environments=preview \
-      deployment_environments=production
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Key                   Value
-  ---                   -----
-  connection_details    map[access_token:***** deployment_environments:[development preview production] project_id:<project-id>]
-  name                  my-dest
-  type                  vercel-project
-  ```
-
-  </CodeBlockConfig>
-
-## Usage
-
-1. If you do not already have a KVv2 secret to sync, mount a new KVv2 secrets engine.
-
-  ```shell-session
-  $ vault secrets enable -path='my-kv' kv-v2
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Success! Enabled the kv-v2 secrets engine at: my-kv/
-  ```
-
-  </CodeBlockConfig>
-
-1. Create secrets you wish to sync with a target Vercel project.
-
-  ```shell-session
-  $ vault kv put -mount='my-kv' my-secret foo='bar'
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  ==== Secret Path ====
-  my-kv/data/my-secret
-
-  ======= Metadata =======
-  Key                Value
-  ---                -----
-  created_time       <timestamp>
-  custom_metadata    <nil>
-  deletion_time      n/a
-  destroyed          false
-  version            1
-  ```
-
-  </CodeBlockConfig>
-
-1. Create an association between the destination and a secret to synchronize.
-
-  ```shell-session
-  $ vault write sys/sync/destinations/vercel-project/my-dest/associations/set \
-    mount='my-kv' \
-    secret_name='my-secret'
-  ```
-
-  **Output:**
-
-  <CodeBlockConfig hideClipboard>
-
-  ```plaintext
-  Key                   Value
-  ---                   -----
-  associated_secrets    map[kv_1234/my-secret:map[accessor:kv_1234 secret_name:my-secret sync_status:SYNCED updated_at:<timestamp>]]
-  store_name            my-dest
-  store_type            vercel-project
-  ```
-
-  </CodeBlockConfig>
-
-1. Navigate to your project's settings under the `Environment Variables` section to confirm your secret was successfully
-  created in your Vercel project.
-
-Moving forward, any modification on the Vault secret will be propagated in near real time to its Vercel environment variable
-counterpart. Creating a new secret version in Vault will overwrite the value in your Vercel Project. Deleting the secret
-or the association in Vault will delete the secret on Vercel as well.
-
-<Note>
-
-Vercel Project environment variables only support single value secrets, so KVv2 secrets from Vault will be stored as a JSON string.
-In the example above, the value for secret "my-secret" will be synced to Vercel as the JSON string `{"foo":"bar"}`.
-
-</Note>
-
-## API
-
-Please see the [secrets sync API](/vault/api-docs/system/secrets-sync) for more details.
diff --git a/website/content/docs/ui/custom-messages.mdx b/website/content/docs/ui/custom-messages.mdx
deleted file mode 100644
index 58fe467975f..00000000000
--- a/website/content/docs/ui/custom-messages.mdx
+++ /dev/null
@@ -1,151 +0,0 @@
----
-layout: docs
-page_title: Manage custom messages
-description: >-
-  Use custom messages in the Vault UI to share system-wide alerts.
----
-
-# Manage custom messages in the Vault UI
-
-@include 'alerts/enterprise-only.mdx'
-
-Use custom banners and modals in the Vault UI to share system-wide alerts for all Vault UI users.
-
-<Tip title="Best practices for UI messages">
-
-1. **Messages are sticky**. Users can only dismiss messages **temporarily**.
-   The message reappears if the user refreshes their browser window or logs out
-   of the current session.
-
-1. **Messages are intrusive**. Limit the number of active messages to minimize
-   the intrusion on users and reduce the chances that they will dismiss the
-   message without reading it.
-
-1. **Messages are inheritable**. Child namespaces inherit all messages created
-   on the parent namespace. Take advantage of inheritance to reach the greatest
-   number of users with the smallest number of messages.
-
-1. **Delete old messages**. Vault supports a maximum of 100 messages per namespace at a
-   time. Practice good message hygiene by regularly deleting expired and outdated
-   messages.
-
-</Tip>
-
-## Before you start
-
-- **You must have Vault Enterprise 1.16.0 or higher installed.**
-- **You must have the appropriate permissions**:
-  - You must have `list` permission for the `sys/config/ui/custom-messages` endpoint.
-  - To **create messages**, you must have `read` permission for the `sys/config/ui/custom-messages/:id` endpoint and `create` permission for the `sys/config/ui/custom-messages` endpoint.
-  - To **edit messages**, you must have `read` and `update` permission for the `sys/config/ui/custom-messages/:id` endpoint.
-  - To **delete messages**, `delete` permission for the `sys/config/ui/custom-messages/:id` endpoint.
-
-## Add a custom message
-
-1. Navigate to the **Settings** section in the Vault UI sidebar and select **Custom
-   Messages**.
-
-1. On the **Custom messages** page, select whether you want the message
-   to appear on the Vault UI login page or after a user logs in.
-
-1. Select the **+ Create message** button in the toolbar to open the **Create message** form.
-
-1. On the **Create message** form:
-
-   - Select the locations where your message should appear.
-   - Select the message type.
-   - Provide a title and the message text. For important messages, we recommend
-     keeping the text short and including a link to more information rather
-     than writing a longer message that users may not take the time to read.
-   - Set a start time when your message will publish. By default, messages
-     publish at midnight in your local timezone.
-   - Set an optional end time for the message. By default, messages do not
-     expire.
-
-1. Click **Preview** to see how your message will appear to users.
-
-1. Click **Create message** to save your new message.
-
-## Create messages for a specific namespace
-
-Child [namespaces](/vault/docs/enterprise/namespaces) inherit all messages
-created on the parent namespace. For example, if your cluster has the following
-namespace hierarchy:
-
-<CodeBlockConfig hideClipboard>
-
-```plaintext
-─ admin
-    ├── finance
-    └── marketing
-        ├── digital-marketing
-        └── events
-```
-
-</CodeBlockConfig>
-
-Custom messages created on the `admin` namespace apply to all child namespaces:
-`fiance`, `marketing`, `marketing/digital-marketing` and `marketing/events`.
-
-To create a custom message that only targets the marketing team you,
-must log into the `marketing` namespace before creating your message.
-
-To create a message under a specific namespace:
-
-1. On your Vault login page, enter the namespace you want to target in
-   the **Namespace** text field.
-1. Select an appropriate authentication method and log in.
-
-1. Select **Custom Messages**.
-
-1. Select the **+ Create message** button in the toolbar to open and fill out
-   the **Create message** form.
-1. Click **Preview** to see how your message will appear to users.
-
-1. Click **Create message** to save your new message.
-
-Your new message only appears when a user logs into the targeted
-namespace or one of its child namespaces. You can verify that your
-message has the correct behavior by logging into an admin or parent
-namespace. The message should only appear when you switch to the
-targeted namespace.
-
-![namespace picker to change namespaces](/img/ui-custom-msg.png)
-
-## Edit a custom message
-
-You can open the edit screen for a custom message in two places from the **Custom messages** page.
-
-**From the additional options menu for the message**:
-
-1. Find the custom message you want to edit.
-1. Click the additional option button (three dots).
-1. Select **Edit** from the dropdown menu to bring up the edit page.
-
-**From the message details page**:
-
-1. Find the custom message you want to edit.
-1. Select the message to open the message details page.
-1. Click the **Edit message** button to bring up the edit page.
-   After clicking **Edit message** in either of the options, fill in the information that you would like to edit for the custom message.
-
-## Delete a custom message
-
-<Warning title="Message deletion is permanent">
-  Deleted messages cannot be recovered. If you delete a message by mistake, you
-  will have to recreate it.
-</Warning>
-
-You can delete a custom message in two places from the **Custom messages** page.
-
-**From the additional options menu for the message**:
-
-1. Find the custom message you want to delete.
-1. Click the additional option button (three dots).
-1. Select **Delete** from the dropdown menu to bring up the delete confirmation modal.
-
-**From the message details page**:
-
-1. Find the custom message you want to delete.
-1. Select the message to open the message details page.
-1. Click the **Delete message** button to bring up the delete confirmation modal.
diff --git a/website/content/docs/ui/index.mdx b/website/content/docs/ui/index.mdx
deleted file mode 100644
index b1506cbda76..00000000000
--- a/website/content/docs/ui/index.mdx
+++ /dev/null
@@ -1,52 +0,0 @@
----
-layout: docs
-page_title: Vault UI
-description: Interact with Vault using the UI.
----
-
-# Vault UI
-
-Vault features a web-based user interface (UI) that enables you to unseal,
-authenticate, manage policies and secrets engines.
-
-## Server configuration
-
-To activate the UI, define the [`ui` stanza](/vault/docs/configuration/ui)
-option in the Vault server configuration. The UI runs on the same port as the
-Vault listener. As such, you must configure at least one `listener` stanza in
-order to access the UI.
-
-For example, the following configuration block enables the UI at
-`https://10.0.1.35:8200/ui` for any machine on the same subnet as long as there
-are no network firewalls in place that explicitly block communication:
-
-<CodeBlockConfig hideClipboard>
-
-```hcl
-ui = true
-listener "tcp" {
-  address = "10.0.1.35:8200"
-  # If bound to localhost, the Vault UI is only
-  # accessible from the local machine!
-  # address = "127.0.0.1:8200"
-}
-# ...
-```
-
-</CodeBlockConfig>
-
-The Vault UI is also accessible at any DNS entry that resolves to the configured
-IP address. For example, if you use Consul, you could configure a Consul service
-address for the Vault UI as `https://vault.service.consul:8200/ui`.
-
-<Note title="UI enabled in dev mode by default">
-
-When you start the Vault server in dev mode, Vault UI is automatically enabled
-at `http://127.0.0.1:8200/ui` and ready to use.
-
-</Note>
-
-## Tutorial
-
-Refer to the [UI quick start](/vault/tutorials/getting-started-ui) tutorials to
-get familiar with Vault UI.
diff --git a/website/content/docs/upgrading/index.mdx b/website/content/docs/upgrading/index.mdx
deleted file mode 100644
index 8bb12e54908..00000000000
--- a/website/content/docs/upgrading/index.mdx
+++ /dev/null
@@ -1,128 +0,0 @@
----
-layout: docs
-page_title: Upgrading Vault - Guides
-description: |-
-  These are general upgrade instructions for Vault for both non-HA and HA
-  setups. Please ensure that you also read the version-specific upgrade notes.
----
-
-# Upgrading Vault
-
-These are general upgrade instructions for Vault for both non-HA and HA setups.
-_Please ensure that you also read any version-specific upgrade notes which can be
-found in the sidebar._
-
-!> **Important:** Always back up your data before upgrading! Vault does not
-make backward-compatibility guarantees for its data store. Simply replacing the
-newly-installed Vault binary with the previous version will not cleanly
-downgrade Vault, as upgrades may perform changes to the underlying data
-structure that make the data incompatible with a downgrade. If you need to roll
-back to a previous version of Vault, you should roll back your data store as
-well.
-
-Vault upgrades are designed such that large jumps (ie 1.3.10 -> 1.7.x) are
-supported. The upgrade notes for each intervening version must be reviewed. The
-upgrade notes may describe additional steps or configuration to update before,
-during, or after the upgrade.
-
-@include 'versions.mdx'
-
-## Integrated storage autopilot
-
-Vault 1.11 introduced [automated
-upgrades](/vault/docs/concepts/integrated-storage/autopilot#automated-upgrades) as
-part of the Integrated Storage Autopilot feature. If your Vault environment is
-configured to use Integrated Storage, consider leveraging this new feature to
-upgrade your Vault environment.
-
--> **Tutorial:** Refer to the [Automate Upgrades with Vault
- Enterprise](/vault/tutorials/raft/raft-upgrade-automation)
- tutorial for more details.
-
-## Agent
-
-The Vault Agent is an API client of the Vault Server. Vault APIs are almost
-always backwards compatible. When they are not, this is called out in the
-upgrade guide for the new Vault version, and there is a lengthy deprecation
-period. The Vault Agent version can lag behind the Vault Server version, though
-we recommend keeping all Vault instances up to date with the most recent minor Vault version
-to the extent possible.
-
-## Testing the upgrade
-
-It's always a good idea to try to ensure that the upgrade will be successful in
-your environment. The ideal way to do this is to take a snapshot of your data
-and load it into a test cluster. However, if you are issuing secrets to third
-party resources (cloud credentials, database credentials, etc.) ensure that you
-do not allow external network connectivity during testing, in case credentials
-expire. This prevents the test cluster from trying to revoke these resources
-along with the non-test cluster.
-
-## Upgrading from Community to Enterprise editions
-
-Upgrading to Vault Enterprise installations follow the same steps as Community edition upgrades except that the Vault Enterprise binary is to be used and the license file [applied](/vault/api-docs/system/license#install-license), when applicable. The Enterprise binary and license file can be obtained through your HashiCorp sales team.
-
-## Non-HA installations
-
-Upgrading non-HA installations of Vault is as simple as replacing the Vault
-binary with the new version and restarting Vault. Any upgrade tasks that can be
-performed for you will be taken care of when Vault is unsealed.
-
-Always use `SIGINT` or `SIGTERM` to properly shut down Vault.
-
-Be sure to also read and follow any instructions in the version-specific
-upgrade notes.
-
-## HA installations
-
-The recommended upgrade procedure depends on the version of Vault you're currently on and the storage backend of Vault. If you're currently running on Vault 1.11 or later with Integrated Storage and you have Autopilot enabled, you should let Autopilot do the upgrade for you, as that's easier and
-less prone to human error. Please refer to our [automated
-upgrades](/vault/docs/concepts/integrated-storage/autopilot#automated-upgrades) documentation for information on this feature and our
-[Automate Upgrades with Vault
-Enterprise](/vault/tutorials/raft/raft-upgrade-automation)
-tutorial for more details.
-
-If you're currently on a version of Vault before 1.11, or you've chosen to opt-out the Autopilot automated upgrade features when running Vault after 1.11 with Integrated Storage, or if you are running Vault with other storage backend such as Consul. Please refer to our [Vault HA upgrades Pre 1.11/Without Autopilot Upgrade Automation](/vault/docs/upgrading/vault-ha-upgrade) documentation for more details. Please note that this upgrade procedure also applies if you are upgrading Vault from pre 1.11 to post 1.11.
-
-## Enterprise replication installations
-
-<Note>
-
-Prior to any upgrade, be sure to also read and follow any instructions in the
-version-specific upgrade notes which are found in the navigation menu for this
-documentation.
-
-</Note>
-
-Upgrading Vault Enterprise clusters which participate in [Enterprise
-Replication](/vault/docs/enterprise/replication) requires the following basic
-order of operations:
-
-- **Upgrade the replication secondary instances first** using appropriate
-  guidance from the previous sections
-- Verify functionality of each secondary instance after upgrading
-- When satisfied with functionality of upgraded secondary instances, upgrade
-  the primary instance
-
-<Note>
-
-It is not safe to replicate from a newer version of Vault to an older version.
-When upgrading replicated clusters, ensure that upstream clusters are always on
-older versions of Vault than downstream clusters.
-
-</Note>
-
-Here is an example of upgrading four Vault replicated Vault clusters:
-
-![Upgrading multiple replicated clusters](/img/vault-replication-upgrade.png)
-
-In the above scenario, the ideal upgrade procedure would be as follows,
-verifying functionality after each cluster upgrade.
-
-1. Upgrade Clusters B and D. These clusters have no downstream clusters, so they
-   should be upgraded first, but the ordering of B vs D does not matter.
-2. Upgrade Cluster C, which now has an upgraded downstream cluster (Cluster D).
-   Because Cluster C is a cluster, it should also use the HA upgrade process.
-3. Finally, upgrade Cluster A. All clusters downstream of A will already be
-   upgraded. It should be upgraded last, as it is a Performance Primary and a DR
-   Primary.
diff --git a/website/content/docs/upgrading/plugins.mdx b/website/content/docs/upgrading/plugins.mdx
deleted file mode 100644
index 2ce54280db8..00000000000
--- a/website/content/docs/upgrading/plugins.mdx
+++ /dev/null
@@ -1,189 +0,0 @@
----
-layout: docs
-page_title: Upgrading Plugins - Guides
-description: These are general upgrade instructions for Vault plugins.
----
-
-# Upgrading Vault plugins
-
-## Plugin upgrade procedure
-
-The following procedures detail steps for upgrading a plugin that has been mounted
-at a path on a running server. The steps are the same whether the plugin being
-upgraded is built-in or external.
-
-~> [Plugin versioning](/vault/docs/plugins#plugin-versioning) was introduced
-  with Vault 1.12.0, so if your Vault server is on 1.11.x or earlier, see the
-  [1.11.x version of this page](/vault/docs/v1.11.x/upgrading/plugins)
-  for plugin upgrade instructions.
-
-### Upgrading auth and secrets plugins
-
-The process is nearly identical for auth and secret plugins. If you are upgrading
-an auth plugin, just replace all usages of `secrets` or `secret` with `auth`.
-
-1. [Register][plugin_registration] the first version of your plugin to the catalog.
-   Skip this step if your initial plugin is built-in or already registered.
-
-    ```shell-session
-    $ vault plugin register \
-        -sha256=<SHA256 Hex value of the plugin binary> \
-        secret \
-        my-secret-plugin
-    ```
-
-1. [Mount][plugin_management] the plugin. Skip this step if your initial plugin
-   is already mounted.
-
-    ```shell-session
-    $ vault secrets enable my-secret-plugin
-    ```
-
-1. Register a second version of your plugin. You **must** use the same plugin
-   type and name (the last two arguments) as the plugin being upgraded. This is
-   true regardless of whether the plugin being upgraded is built-in or external.
-
-    ```shell-session
-    $ vault plugin register \
-        -sha256=<SHA256 Hex value of the plugin binary> \
-        -command=my-secret-plugin-1.0.1 \
-        -version=v1.0.1 \
-        secret \
-        my-secret-plugin
-    ```
-
-1. Tune the existing mount to configure it to use the newly registered version.
-
-   ```shell-session
-   $ vault secrets tune -plugin-version=v1.0.1 my-secret-plugin
-   ```
-
-1. If you wish, you can check the updated configuration. Notice the "Version" is
-   now different from the "Running Version".
-
-   ```shell-session
-   $ vault secrets list -detailed
-   ```
-
-1. Finally, trigger a [plugin reload](/vault/docs/commands/plugin/reload) to reload all
-   mounted backends using that plugin or a subset of the mounts using that plugin
-   with either the `plugin` or `mounts` flag respectively.
-
-    ```shell-session
-    $ vault plugin reload -plugin my-secret-plugin
-    ```
-
-Until the last step, the mount will still run the first version of `my-secret-plugin`. When
-the reload is triggered, Vault will kill `my-secret-plugin`’s process and start the
-new plugin process for `my-secret-plugin` version 1.0.1. The "Running Version" should also
-now match the "Version" when you run `vault secrets list -detailed`.
-
--> **Important:** Plugin reload of a new plugin binary must be
-performed on each Vault instance. Performing a plugin upgrade on a single
-instance or through a load balancer can result in mismatched
-plugin binaries within a cluster. On a replicated cluster this may be accomplished
-by setting the 'scope' parameter of the reload to 'global'.
-
-### Upgrading database plugins
-
-1. [Register][plugin_registration] the first version of your plugin to the catalog.
-   Skip this step if your initial plugin is built-in or already registered.
-
-    ```shell-session
-    $ vault plugin register
-        -sha256=<SHA256 Hex value of the plugin binary> \
-        database \
-        my-db-plugin
-    ```
-
-1. [Mount][plugin_management] the plugin. Skip this step if your initial plugin
-   is already mounted.
-
-    ```shell-session
-    $ vault secrets enable database
-    $ vault write database/config/my-db \
-        plugin_name=my-db-plugin \
-        # ...
-    ```
-
-1. Register a second version of your plugin. You **must** use the same plugin
-   type and name (the last two arguments) as the plugin being upgraded. This is
-   true regardless of whether the plugin being upgraded is built-in or external.
-
-    ```shell-session
-    $ vault plugin register \
-        -sha256=<SHA256 Hex value of the plugin binary> \
-        -command=my-db-plugin-1.0.1 \
-        -version=v1.0.1 \
-        database \
-        my-db-plugin
-    ```
-
-1. Update the database config with the new version. The database secrets
-   engine will immediately reload the plugin, using the new version. Any omitted
-   config parameters will not be updated.
-
-    ```shell-session
-    $ vault write database/config/my-db \
-        plugin_version=v1.0.1
-    ```
-
-Until the last step, the mount will still run the first version of `my-db-plugin`. When
-the reload is triggered, Vault will kill `my-db-plugin`’s process and start the
-new plugin process for `my-db-plugin` version 1.0.1.
-
-### Downgrading plugins
-
-Plugin downgrades follow the same procedure as upgrades. You can use the Vault
-plugin list command to check what plugin versions are available to downgrade to:
-
-```shell-session
-$ vault plugin list secret
-Name                Version
-----                -------
-ad                  v0.14.0+builtin
-alicloud            v0.13.0+builtin
-aws                 v1.12.0+builtin.vault
-azure               v0.14.0+builtin
-cassandra           v1.12.0+builtin.vault
-consul              v1.12.0+builtin.vault
-gcp                 v0.14.0+builtin
-gcpkms              v0.13.0+builtin
-kv                  v0.13.3+builtin
-ldap                v1.12.0+builtin.vault
-mongodb             v1.12.0+builtin.vault
-mongodbatlas        v0.8.0+builtin
-mssql               v1.12.0+builtin.vault
-mysql               v1.12.0+builtin.vault
-nomad               v1.12.0+builtin.vault
-openldap            v0.9.0+builtin
-pki                 v1.12.0+builtin.vault
-postgresql          v1.12.0+builtin.vault
-rabbitmq            v1.12.0+builtin.vault
-ssh                 v1.12.0+builtin.vault
-terraform           v0.6.0+builtin
-totp                v1.12.0+builtin.vault
-transit             v1.12.0+builtin.vault
-```
-
-### Additional upgrade notes
-
-* As mentioned earlier, disabling existing mounts will wipe the existing data.
-* Overwriting an existing version in the catalog will affect all uses of that
-  plugin version. So if you have 5 different Azure Secrets mounts using v1.0.0,
-  they'll all start using the new binary if you overwrite it. We recommend
-  treating plugin versions in the catalog as immutable, much like version control
-  tags.
-* Each plugin has its own data within Vault storage. While it is rare for HashiCorp
-  maintained plugins to update their storage schema, it is up to plugin authors
-  to manage schema upgrades and downgrades. Check the plugin release notes for
-  any unsupported upgrade or downgrade transitions, especially before moving to
-  a new major version or downgrading.
-* Existing Vault [leases](/vault/docs/concepts/lease) and [tokens](/vault/docs/concepts/tokens)
-  are generally unaffected by plugin upgrades and reloads. This is because the lifecycle
-  of leases and tokens is handled by core systems within Vault. The plugin itself only
-  handles renewal and revocation of them when it’s requested by those core systems.
-
-[plugin_reload_api]: /vault/api-docs/system/plugins-reload
-[plugin_registration]: /vault/docs/plugins/plugin-architecture#plugin-registration
-[plugin_management]: /vault/docs/plugins/plugin-management#enabling-disabling-external-plugins
diff --git a/website/content/docs/upgrading/upgrade-to-0.10.0.mdx b/website/content/docs/upgrading/upgrade-to-0.10.0.mdx
deleted file mode 100644
index 5ed33f7bb16..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.10.0.mdx
+++ /dev/null
@@ -1,161 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.10.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.10.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.10.0 compared to 0.9.0. Please read it carefully.
-
-## Changes since 0.9.6
-
-### Database plugin compatibility
-
-The database plugin interface was enhanced to support some additional
-functionality related to root credential rotation and supporting templated
-URL strings. The changes were made in a backwards-compatible way and all
-builtin plugins were updated with the new features. Custom plugins not built
-into Vault will need to be upgraded to support templated URL strings and
-root rotation. Additionally, the Initialize method was deprecated in favor
-of a new Init method that supports configuration modifications that occur in
-the plugin back to the primary data store.
-
-### Removal of returned secret information
-
-For a long time Vault has returned configuration given to various secret
-engines and auth methods with secret values (such as secret API keys or
-passwords) still intact, and with a warning to the user on write that anyone
-with read access could see the secret. This was mostly done to make it easy for
-tools like Terraform to judge whether state had drifted. However, it also feels
-quite un-Vault-y to do this and we've never felt very comfortable doing so. In
-0.10 we have gone through and removed this behavior from the various backends;
-fields which contained secret values are simply no longer returned on read. We
-are working with the Terraform team to make changes to their provider to
-accommodate this as best as possible, and users of other tools may have to make
-adjustments, but in the end we felt that the ends did not justify the means and
-we needed to prioritize security over operational convenience.
-
-### LDAP auth method case sensitivity
-
-We now treat usernames and groups configured locally for policy assignment in a
-case insensitive fashion by default. Existing configurations will continue to
-work as they do now; however, the next time a configuration is written
-`case_sensitive_names` will need to be explicitly set to `true`.
-
-### TTL handling moved to core
-
-All lease TTL handling has been centralized within the core of Vault to ensure
-consistency across all backends. Since this was previously delegated to
-individual backends, there may be some slight differences in TTLs generated
-from some backends.
-
-### Default `secret/` mount is deprecated
-
-In 0.12 we will stop mounting `secret/` by default at initialization time (it
-will still be available in `dev` mode).
-
-## Full list since 0.9.0
-
-### Change to AWS role output
-
-The AWS authentication backend now allows binds for inputs as either a
-comma-delimited string or a string array. However, to keep consistency with
-input and output, when reading a role the binds will now be returned as string
-arrays rather than strings.
-
-### Change to AWS IAM auth ARN prefix matching
-
-In order to prefix-match IAM role and instance profile ARNs in AWS auth
-backend, you now must explicitly opt-in by adding a `*` to the end of the ARN.
-Existing configurations will be upgraded automatically, but when writing a new
-role configuration the updated behavior will be used.
-
-### Backwards compatible CLI changes
-
-This upgrade guide is typically reserved for breaking changes, however it
-is worth calling out that the CLI interface to Vault has been completely
-revamped while maintaining backwards compatibility. This could lead to
-potential confusion while browsing the latest version of the Vault
-documentation on vaultproject.io.
-
-All previous CLI commands should continue to work and are backwards
-compatible in almost all cases.
-
-Documentation for previous versions of Vault can be accessed using
-the GitHub interface by browsing tags (eg [0.9.1 website tree](https://github.com/hashicorp/vault/tree/v0.9.1/website)) or by
-[building the Vault website locally](https://github.com/hashicorp/vault/tree/v0.9.1/website#running-the-site-locally).
-
-### `sys/health` DR secondary reporting
-
-The `replication_dr_secondary` bool returned by `sys/health` could be
-misleading since it would be `false` both when a cluster was not a DR secondary
-but also when the node is a standby in the cluster and has not yet fully
-received state from the active node. This could cause health checks on LBs to
-decide that the node was acceptable for traffic even though DR secondaries
-cannot handle normal Vault traffic. (In other words, the bool could only convey
-"yes" or "no" but not "not sure yet".) This has been replaced by
-`replication_dr_mode` and `replication_perf_mode` which are string values that
-convey the current state of the node; a value of `disabled` indicates that
-replication is disabled or the state is still being discovered. As a result, an
-LB check can positively verify that the node is both not `disabled` and is not
-a DR secondary, and avoid sending traffic to it if either is true.
-
-### PKI secret backend roles parameter types
-
-For `ou` and `organization` in role definitions in the PKI secret backend,
-input can now be a comma-separated string or an array of strings. Reading a
-role will now return arrays for these parameters.
-
-### Plugin API changes
-
-The plugin API has been updated to utilize golang's context.Context package.
-Many function signatures now accept a context object as the first parameter.
-Existing plugins will need to pull in the latest Vault code and update their
-function signatures to begin using context and the new gRPC transport.
-
-### AppRole case sensitivity
-
-In prior versions of Vault, `list` operations against AppRole roles would
-require preserving case in the role name, even though most other operations
-within AppRole are case-insensitive with respect to the role name. This has
-been fixed; existing roles will behave as they have in the past, but new roles
-will act case-insensitively in these cases.
-
-### Token auth backend roles parameter types
-
-For `allowed_policies` and `disallowed_policies` in role definitions in the
-token auth backend, input can now be a comma-separated string or an array of
-strings. Reading a role will now return arrays for these parameters.
-
-### Transit key exporting
-
-You can now mark a key in the `transit` backend as `exportable` at any time,
-rather than just at creation time; however, once this value is set, it still
-cannot be unset.
-
-### PKI secret backend roles parameter types
-
-For `allowed_domains` and `key_usage` in role definitions in the PKI secret
-backend, input can now be a comma-separated string or an array of strings.
-Reading a role will now return arrays for these parameters.
-
-### SSH dynamic keys method defaults to 2048-bit keys
-
-When using the dynamic key method in the SSH backend, the default is now to use
-2048-bit keys if no specific key bit size is specified.
-
-### Consul secret backend lease handling
-
-The `consul` secret backend can now accept both strings and integer numbers of
-seconds for its lease value. The value returned on a role read will be an
-integer number of seconds instead of a human-friendly string.
-
-### Unprintable characters not allowed in API paths
-
-Unprintable characters are no longer allowed in names in the API (paths and
-path parameters), with an extra restriction on whitespace characters. Allowed
-characters are those that are considered printable by Unicode plus spaces.
diff --git a/website/content/docs/upgrading/upgrade-to-0.10.2.mdx b/website/content/docs/upgrading/upgrade-to-0.10.2.mdx
deleted file mode 100644
index 8b84ac7ccf8..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.10.2.mdx
+++ /dev/null
@@ -1,26 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.10.2 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.10.2. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.10.2 compared to 0.10.1. Please read it carefully.
-
-### Convergent encryption version 3
-
-If you are using `transit`'s convergent encryption feature, which prior to this
-release was at version 2, we recommend
-[rotating](/vault/api-docs/secret/transit#rotate-key)
-your encryption key (the new key will use version 3) and
-[rewrapping](/vault/api-docs/secret/transit#rewrap-data)
-your data to mitigate the chance of offline plaintext-confirmation attacks.
-
-### PKI duration return types
-
-The PKI backend now returns durations (e.g. when reading a role) as an integer
-number of seconds instead of a Go-style string.
diff --git a/website/content/docs/upgrading/upgrade-to-0.10.4.mdx b/website/content/docs/upgrading/upgrade-to-0.10.4.mdx
deleted file mode 100644
index c4d7fa32fec..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.10.4.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.10.4 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.10.4. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.10.4 compared to 0.10.3. Please read it carefully.
-
-### Revocations of dynamic secrets leases now asynchronous
-
-Dynamic secret lease revocation are now queued/asynchronous rather
-than synchronous. This allows Vault to take responsibility for revocation
-even if the initial attempt fails. The previous synchronous behavior can be
-attained via the `-sync` CLI flag or `sync` API parameter. When in
-synchronous mode, if the operation results in failure it is up to the user
-to retry.
-
-### CLI retries
-
-The CLI will no longer retry commands on 5xx errors. This was a
-source of confusion to users as to why Vault would "hang" before returning a
-5xx error. The Go API client still defaults to two retries.
-
-### Identity entity alias metadata
-
-You can no longer manually set metadata on
-entity aliases. All alias data (except the canonical entity ID it refers to)
-is intended to be managed by the plugin providing the alias information, so
-allowing it to be set manually didn't make sense.
diff --git a/website/content/docs/upgrading/upgrade-to-0.11.0.mdx b/website/content/docs/upgrading/upgrade-to-0.11.0.mdx
deleted file mode 100644
index 0bb0e4880f4..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.11.0.mdx
+++ /dev/null
@@ -1,147 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.11.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.11.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.11.0 compared to 0.10.0. Please read it carefully.
-
-## Known issues
-
-### Nomad integration
-
-Users that integrate Vault with Nomad should hold off on upgrading. A modification to
-Vault's API is causing a runtime issue with the Nomad to Vault integration.
-
-### Minified JSON policies
-
-Users that generate policies in minfied JSON may cause a parsing errors due to
-a regression in the policy parser when it encounters repeating brackets. Although
-HCL is the official language for policies in Vault, HCL is JSON compatible and JSON
-should work in place of HCL. To work around this error, pretty print the JSON policies
-or add spaces between repeating brackets. This regression will be addressed in
-a future release.
-
-### Common mount prefixes
-
-Before running the upgrade, users should run `vault secrets list` and `vault auth list`
-to check their mount table to ensure that mounts do not have common prefix "folders".
-For example, if there is a mount with path `team1/` and a mount with path `team1/secrets`,
-Vault will fail to unseal. Before upgrade, these mounts must be remounted at a path that
-does not share a common prefix.
-
-## Changes since 0.10.4
-
-### Request timeouts
-
-A default request timeout of 90s is now enforced. This setting can be
-overwritten in the config file. If you anticipate requests taking longer than
-90s this setting should be configured before upgrading.
-
-### `sys/` top level injection
-
-For the last two years for backwards compatibility data for various `sys/`
-routes has been injected into both the Secret's Data map and into the top level
-of the JSON response object. However, this has some subtle issues that pop up
-from time to time and is becoming increasingly complicated to maintain, so it's
-finally being removed.
-
-### Path fallback for list operations
-
-For a very long time Vault has automatically adjusted `list` operations to
-always end in a `/`, as list operations operates on prefixes, so all list
-operations by definition end with `/`. This was done server-side so affects all
-clients. However, this has also led to a lot of confusion for users writing
-policies that assume that the path that they use in the CLI is the path used
-internally. Starting in 0.11, ACL policies gain a new fallback rule for
-listing: they will use a matching path ending in `/` if available, but if not
-found, they will look for the same path without a trailing `/`. This allows
-putting `list` capabilities in the same path block as most other capabilities
-for that path, while not providing any extra access if `list` wasn't actually
-provided there.
-
-### Performance standbys on by default
-
-If your flavor/license of Vault Enterprise supports Performance Standbys, they
-are on by default. You can disable this behavior per-node with the
-`disable_performance_standby` configuration flag.
-
-### AWS secret engine roles
-
-Roles in the AWS Secret Engine were previously ambiguous. For example, if the
-`arn` parameter had been specified, that could have been interpreted as the ARN
-of an AWS IAM policy to attach to an IAM user or it could have been the ARN of
-an AWS role to assume. Now, types are explicit, both in terms of what
-credential type is being requested (e.g., an IAM User or an Assumed Role?) as
-well as the parameters being sent to vault (e.g., the IAM policy document
-attached to an IAM user or used during a GetFederationToken call). All
-credential retrieval remains backwards compatible as does updating role data.
-However, the data returned when reading role data is now different and
-breaking, so anything which reads role data out of Vault will need to be
-updated to handle the new role data format.
-
-While creating/updating roles remains backwards compatible, the old parameters
-are now considered deprecated. You should use the new parameters as documented
-in the API docs.
-
-As part of this, the `/aws/creds/` and `/aws/sts/` endpoints have been merged,
-with the behavior only differing as specified below. The `/aws/sts/` endpoint
-is considered deprecated and should only be used when needing backwards
-compatibility.
-
-All roles will be automatically updated to the new role format when accessed.
-However, due to the way role data was previously being stored in Vault, it's
-possible that invalid data was stored that both make the upgrade impossible as
-well as would have made the role unable to retrieve credentials. In this
-situation, the previous role data is returned in an `invalid_data` key so you
-can inspect what used to be in the role and correct the role data if desired.
-One consequence of the prior AWS role storage format is that a single Vault
-role could have led to two different AWS credential types being retrieved when
-a `policy` parameter was stored. In this case, these legacy roles will be
-allowed to retrieve both IAM User and Federation Token credentials, with the
-credential type depending on the path used to access it (IAM User if accessed
-via the `/aws/creds/<role_name>` endpoint and Federation Token if accessed via
-the `/aws/sts/<role_name>` endpoint).
-
-## Full list since 0.10.0
-
-### Revocations of dynamic secrets leases now asynchronous
-
-Dynamic secret lease revocation are now queued/asynchronous rather
-than synchronous. This allows Vault to take responsibility for revocation
-even if the initial attempt fails. The previous synchronous behavior can be
-attained via the `-sync` CLI flag or `sync` API parameter. When in
-synchronous mode, if the operation results in failure it is up to the user
-to retry.
-
-### CLI retries
-
-The CLI will no longer retry commands on 5xx errors. This was a
-source of confusion to users as to why Vault would "hang" before returning a
-5xx error. The Go API client still defaults to two retries.
-
-### Identity entity alias metadata
-
-You can no longer manually set metadata on
-entity aliases. All alias data (except the canonical entity ID it refers to)
-is intended to be managed by the plugin providing the alias information, so
-allowing it to be set manually didn't make sense.
-
-### Convergent encryption version 3
-
-If you are using `transit`'s convergent encryption feature, which prior to this
-release was at version 2, we recommend
-[rotating](/vault/api-docs/secret/transit#rotate-key)
-your encryption key (the new key will use version 3) and
-[rewrapping](/vault/api-docs/secret/transit#rewrap-data)
-your data to mitigate the chance of offline plaintext-confirmation attacks.
-
-### PKI duration return types
-
-The PKI backend now returns durations (e.g. when reading a role) as an integer
-number of seconds instead of a Go-style string.
diff --git a/website/content/docs/upgrading/upgrade-to-0.11.2.mdx b/website/content/docs/upgrading/upgrade-to-0.11.2.mdx
deleted file mode 100644
index dd79e97f0e1..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.11.2.mdx
+++ /dev/null
@@ -1,23 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.11.2 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.11.2. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.11.2 compared to 0.11.1. Please read it carefully.
-
-### `sys/seal-status` behavior change
-
-The `sys/seal-status` endpoint now includes an initialized boolean in the
-output. If Vault is not initialized, it will return a 200 with this value
-set false instead of a 400
-
-### Mount config passthrough headers
-
-The mount config option for `passthrough_request_headers` will now deny
-certain headers from being provided to backends based on a global denylist.
diff --git a/website/content/docs/upgrading/upgrade-to-0.11.6.mdx b/website/content/docs/upgrading/upgrade-to-0.11.6.mdx
deleted file mode 100644
index 8e8c9227978..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.11.6.mdx
+++ /dev/null
@@ -1,19 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.11.6 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.11.6. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.11.6 compared to 0.11.5. Please read it carefully.
-
-### Database secret engine role reads
-
-On role read, empty statements will be returned as empty
-slices instead of potentially being returned as JSON null values. This makes it
-more in line with other parts of Vault and makes it easier for statically typed
-languages to interpret the values.
diff --git a/website/content/docs/upgrading/upgrade-to-0.5.0.mdx b/website/content/docs/upgrading/upgrade-to-0.5.0.mdx
deleted file mode 100644
index f1c236d48f5..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.5.0.mdx
+++ /dev/null
@@ -1,141 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.5.0 - Guides
-description: |-
-  This page contains the full list of breaking changes for Vault 0.5, including
-  actions you must take to facilitate a smooth upgrade path.
----
-
-# Overview
-
-This page contains the list of breaking changes for Vault 0.5. Please read it
-carefully.
-
-Please note that these are changes to Vault itself. Client libraries maintained
-by HashiCorp have been updated with support for these changes, but if you are
-using community-supported libraries, you should ensure that they are ready for
-Vault 0.5 before upgrading.
-
-## Rekey requires nonce
-
-Vault now generates a nonce when a rekey operation is started in order to
-ensure that the operation cannot be hijacked. The nonce is output when the
-rekey operation is started and when rekey status is requested.
-
-The nonce must be provided as part of the request parameters when providing an
-unseal key. The nonce can be communicated from the request initiator to unseal
-key holders via side channels; the unseal key holders can then verify the nonce
-(by providing it) when they submit their unseal key.
-
-As a convenience, if using the CLI interactively to provide the unseal key, the
-nonce will be displayed for verification but the user will not be required to
-manually re-type it.
-
-## `TTL` field in token lookup
-
-Previously, the `ttl` field returned when calling `lookup` or `lookup-self` on
-the token auth method displayed the TTL set at token creation. It
-now displays the time remaining (in seconds) for the token's validity period.
-The original behavior has been moved to a field named `creation_ttl`.
-
-## Grace periods removed
-
-Vault no longer uses grace periods internally for leases or token TTLs.
-Previously these were set by backends and could differ greatly from one backend
-to another, causing confusion. TTLs (the `lease_duration` field for a lease,
-or, for a token lookup, the `ttl`) are now exact.
-
-## `token-renew` CLI command
-
-If the token given for renewal is the same as the token in use by the client,
-the `renew-self` endpoint will be used in the API rather than the `renew`
-endpoint. Since the `default` policy contains `auth/token/renew-self` this
-makes it much more likely that the request will succeed rather than somewhat
-confusingly failing due to a lack of permissions on `auth/token/renew`.
-
-## `status` CLI command
-
-The `status` CLI command now returns an exit code of `0` for an unsealed Vault
-(as before), `2` for a sealed Vault, and `1` for an error. This keeps error
-return codes consistent across commands.
-
-## Transit upsertion behavior uses capabilities
-
-Previously, attempting to encrypt with a key that did not exist would create a
-key with default values. This was convenient but ultimately allowed a client to
-potentially escape an ACL policy restriction, albeit without any dangerous
-access. Now that Vault supports more granular capabilities in policies,
-upsertion behavior is controlled by whether the client has the `create`
-capability for the request (upsertion is allowed) or only the `update`
-capability (upsertion is denied).
-
-## etcd physical backend uses `sync`
-
-The `etcd` physical backend now supports `sync` functionality and it is turned
-on by default, which maps to the upstream library's default. It can be
-disabled; see the configuration page for information.
-
-## S3 physical backend prefers environment variables
-
-The `s3` physical backend now prefers environment variables over configuration
-file variables. This matches the behavior of the rest of the backends and of
-Vault generally.
-
-## Lease default and renewal handling
-
-All backends now honor system and mount-specific default and maximum lease
-times, except when specifically overridden by backend configuration or role
-parameters, or when doing so would not make sense (e.g. AWS STS tokens cannot
-have a lifetime of greater than 1 hour).
-
-This allows for a _much_ more uniform approach to managing leases on both the
-operational side and the user side, and removes much ambiguity and uncertainty
-resulting from backend-hardcoded limits.
-
-However, also this means that the leases generated by the backends may return
-significantly different TTLs in 0.5 than in previous versions, unless they have
-been preconfigured. You can use the `mount-tune` CLI command or the
-`/sys/mounts/<mount point>/tune` endpoint to adjust default and max TTL
-behavior for any mount. This is supported in 0.4, so you can perform this
-tuning before upgrading.
-
-The following list details the ways in which lease handling has changed
-per-backend. In all cases the "mount TTL" means the mount-specific value for
-default or max TTL; however, if no value is set on a given mount, the system
-default/max values are used. This lists only the changes; any lease-issuing
-or renew function not listed here behaves the same as in 0.4.
-
-(As a refresher: the default TTL is the amount of time that the initial
-lease/token is valid for before it must be renewed; the maximum TTL is the
-amount of time a lease or token is valid for before it can no longer be renewed
-and must be reissued. A mount can be more restrictive with its maximum TTL, but
-cannot be less restrictive than the mount's maximum TTL.)
-
-#### Credential (Auth) backends
-
-- `github` – The renewal function now uses the backend's configured maximum
-  TTL, if set; otherwise, the mount maximum TTL is used.
-- `ldap` – The renewal function now uses the mount default TTL instead of always
-  using one hour.
-- `token` – Tokens can no longer be renewed forever; instead, they now honor the
-  mount default/max TTL.
-- `userpass` – The renew function now uses the backend's configured maximum TTL,
-  if set; otherwise the mount maximum TTL is used.
-
-#### Secrets engines
-
-- `aws` – New IAM roles no longer always have a default TTL of one hour, instead
-  honoring the configured default if available and the mount default TTL if not
-  (renewal always used the configured values if available). STS tokens return a
-  TTL corresponding to the lifetime of the token in AWS and cannot be renewed.
-- `cassandra` – `lease_grace_period` has been removed since Vault no longer uses
-  grace periods.
-- `consul` – The mount default TTL is now used as the default TTL if there is no
-  backend configuration parameter. Renewal now uses the mount default and
-  maximum TTLs.
-- `mysql` – The mount default TTL is now used as the default TTL if there is no
-  backend configuration parameter.
-- `postgresql` – The mount default TTL is now used as the default TTL if there
-  is no backend configuration parameter. In addition, there is no longer any
-  grace period with the time configured for password expiration within Postgres
-  itself.
diff --git a/website/content/docs/upgrading/upgrade-to-0.5.1.mdx b/website/content/docs/upgrading/upgrade-to-0.5.1.mdx
deleted file mode 100644
index 9259d080ddf..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.5.1.mdx
+++ /dev/null
@@ -1,59 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.5.1 - Guides
-description: |-
-  This page contains the list of breaking changes for Vault 0.5.1. Please read
-  it carefully.
----
-
-# Overview
-
-This page contains the list of breaking changes for Vault 0.5.1. Please read it
-carefully.
-
-## PKI backend disallows RSA keys < 2048 bits
-
-The PKI backend now refuses to issue a certificate, sign a CSR, or save a role
-that specifies an RSA key of less than 2048 bits. Smaller keys are considered
-unsafe and are disallowed in the Internet PKI. Although this may require
-updating your roles, we do not expect any other breaks from this; since its
-inception the PKI backend has mandated SHA256 hashes for its signatures, and
-software able to handle these certificates should be able to handle
-certificates with >= 2048-bit RSA keys as well.
-
-## PKI backend does not automatically delete expired certificates
-
-The PKI backend now does not automatically delete expired certificates,
-including from the CRL. Doing so could lead to a situation where a time
-mismatch between the Vault server and clients could result in a certificate
-that would not be considered expired by a client being removed from the CRL.
-
-Vault strives for determinism and putting the operator in control, so expunging
-expired certificates has been moved to a new function at `pki/tidy`. You can
-flexibly determine whether to tidy up from the revocation list, the general
-certificate storage, or both. In addition, you can specify a safety buffer
-(defaulting to 72 hours) to ensure that any time discrepancies between your
-hosts is accounted for.
-
-## Cert auth method performs client checking during renewals
-
-The `cert` backend now performs a variant of channel binding at renewal time
-for increased security. In order to not overly burden clients, a notion of
-identity is used, as follows:
-
-- At both login and renewal time, the validity of the presented client
-  certificate is checked
-- At login time, the key ID of both the client certificate and its issuing
-  certificate are stored
-- At renewal time, the key ID of both the client certificate and its issuing
-  certificate must match those stored at login time
-
-Matching on the key ID rather than the serial number allows tokens to be
-renewed even if the CA or the client certificate used are rotated; so long as
-the same key was used to generate the certificate (via a CSR) and sign the
-certificate, renewal is allowed. As Vault encourages short-lived secrets,
-including client certificates (for instance, those issued by the `pki`
-backend), this is a useful approach compared to strict issuer/serial number
-checking.
-
-You can use the new `cert/config` endpoint to disable this behavior.
diff --git a/website/content/docs/upgrading/upgrade-to-0.6.0.mdx b/website/content/docs/upgrading/upgrade-to-0.6.0.mdx
deleted file mode 100644
index 02626b998d7..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.6.0.mdx
+++ /dev/null
@@ -1,54 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.6.0 - Guides
-description: |-
-  This page contains the list of breaking changes for Vault 0.6. Please read it
-  carefully.
----
-
-# Overview
-
-This page contains the list of breaking changes for Vault 0.6 compared to the
-previous release. Please read it carefully.
-
-## PKI backend does not issue leases for CA certificates
-
-When a token expires, it revokes all leases associated with it. This means that
-long-lived CA certs need correspondingly long-lived tokens, something that is
-easy to forget, resulting in an unintended revocation of the CA certificate
-when the token expires. To prevent this, root and intermediate CA certs no
-longer have associated leases. To revoke these certificates, use the
-`pki/revoke` endpoint.
-
-CA certificates that have already been issued and acquired leases will report
-to the lease manager that revocation was successful, but will not actually be
-revoked and placed onto the CRL.
-
-## The `auth/token/revoke-prefix` endpoint has been removed
-
-As part of addressing a minor security issue, this endpoint has been removed in
-favor of using `sys/revoke-prefix` for prefix-based revocation of both tokens
-and secrets leases.
-
-## Go API uses `json.Number` for decoding
-
-When using the Go API, it now calls `UseNumber()` on the decoder object. As a
-result, rather than always decode as a `float64`, numbers are returned as a
-`json.Number`, where they can be converted, with proper error checking, to
-`int64`, `float64`, or simply used as a `string` value. This fixes some display
-errors where numbers were being decoded as `float64` and printed in scientific
-notation.
-
-## List operations return `404` on no keys found
-
-Previously, list operations on an endpoint with no keys found would return an
-empty response object. Now, a `404` will be returned instead.
-
-## Consul TTL checks automatically registered
-
-If using the Consul HA storage backend, Vault will now automatically register
-itself as the `vault` service and perform its own health checks/lifecycle
-status management. This behavior can be adjusted or turned off in Vault's
-configuration; see the
-[documentation](/vault/docs/configuration/storage/consul#check_timeout)
-for details.
diff --git a/website/content/docs/upgrading/upgrade-to-0.6.1.mdx b/website/content/docs/upgrading/upgrade-to-0.6.1.mdx
deleted file mode 100644
index 5af3b025448..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.6.1.mdx
+++ /dev/null
@@ -1,103 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.6.1 - Guides
-description: |-
-  This page contains the list of breaking changes for Vault 0.6.1. Please read
-  it carefully.
----
-
-# Overview
-
-This page contains the list of breaking changes for Vault 0.6.1. Please read it
-carefully.
-
-## Standby nodes must be 0.6.1 as well
-
-Once an active node is running 0.6.1, only standby nodes running 0.6.1+ will be
-able to form an HA cluster. If following our [general upgrade
-instructions](/vault/docs/upgrading) this will
-not be an issue.
-
-## Health endpoint status code changes
-
-Prior to 0.6.1, the health endpoint would return a `500` (Internal Server
-Error) for both a sealed and uninitialized state. In both states this was
-confusing, since it was hard to tell, based on the status code, an actual
-internal error from Vault from a Vault that was simply uninitialized or sealed,
-not to mention differentiating between those two states.
-
-In 0.6.1, a sealed Vault will return a `503` (Service Unavailable) status code.
-As before, this can be adjusted with the `sealedcode` query parameter. An
-uninitialized Vault will return a `501` (Not Implemented) status code. This can
-be adjusted with the `uninitcode` query parameter.
-
-This removes ambiguity/confusion and falls more in line with the intention of
-each status code (including `500`).
-
-## Root token creation restrictions
-
-Root tokens (tokens with the `root` policy) can no longer be created except by
-another root token or the
-[`generate-root`](/vault/api-docs/system/generate-root)
-endpoint or CLI command.
-
-## PKI backend certificates will contain default key usages
-
-Issued certificates from the `pki` backend against roles created or modified
-after upgrading will contain a set of default key usages. This increases
-compatibility with some software that requires strict adherence to RFCs, such
-as OpenVPN.
-
-This behavior is fully adjustable; see the [PKI backend
-documentation](/vault/docs/secrets/pki) for
-details.
-
-## DynamoDB does not support HA by default
-
-If using DynamoDB and want to use HA support, you will need to explicitly
-enable it in Vault's configuration; see the
-[documentation](/vault/docs/configuration#ha_storage)
-for details.
-
-If you are already using DynamoDB in an HA fashion and wish to keep doing so,
-it is _very important_ that you set this option **before** upgrading your Vault
-instances. Without doing so, each Vault instance will believe that it is
-standalone and there could be consistency issues.
-
-## LDAP auth method forgets bind password and insecure TLS settings
-
-Due to a bug, these two settings are forgotten if they have been configured in
-the LDAP backend prior to 0.6.1. If you are using these settings with LDAP,
-please be sure to re-submit your LDAP configuration to Vault after the upgrade,
-so ensure that you have a valid token to do so before upgrading if you are
-relying on LDAP authentication for permissions to modify the backend itself.
-
-## LDAP auth method does not search `memberOf`
-
-The LDAP backend went from a model where all permutations of storing and
-filtering groups were tried in all cases to one where specific filters are
-defined by the administrator. This vastly increases overall directory
-compatibility, especially with Active Directory when using nested groups, but
-unfortunately has the side effect that `memberOf` is no longer searched for by
-default, which is a breaking change for many existing setups.
-
-`Scenario 2` in the [updated
-documentation](/vault/docs/auth/ldap) shows an
-example of configuring the backend to query `memberOf`. It is recommended that
-a test Vault server be set up and that successful authentication can be
-performed using the new configuration before upgrading a primary or production
-Vault instance.
-
-In addition, if LDAP is relied upon for authentication, operators should ensure
-that they have valid tokens with policies allowing modification of LDAP
-parameters before upgrading, so that once an upgrade is performed, the new
-configuration can be specified successfully.
-
-## App-ID is deprecated
-
-With the addition of the new [AppRole
-backend](/vault/docs/auth/approle), App-ID is
-deprecated. There are no current plans to remove it, but we encourage using
-AppRole whenever possible, as it offers enhanced functionality and can
-accommodate many more types of authentication paradigms. App-ID will receive
-security-related fixes only.
diff --git a/website/content/docs/upgrading/upgrade-to-0.6.2.mdx b/website/content/docs/upgrading/upgrade-to-0.6.2.mdx
deleted file mode 100644
index fa669d48c9c..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.6.2.mdx
+++ /dev/null
@@ -1,75 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.6.2 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.6.2. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.6.2. Please read it carefully.
-
-## Request forwarding on by default
-
-In 0.6.1 this feature was in beta and required opting-in, but is now enabled by
-default. This can be disabled via the `"disable_clustering"` parameter in
-Vault's [config](/vault/docs/configuration), or
-per-request with the `X-Vault-No-Request-Forwarding` header.
-
-## AppRole role constraints
-
-Creating or updating a role now requires at least one constraint to be enabled,
-whereas previously it was sufficient to require only the role ID by itself.
-Currently there are two constraints: `bind_secret_id` and `bound_cidr_list`.
-`bind_secret_id` is enabled by default. Roles which were previously using only
-the role ID for authentication will continue to work but will require a
-constraint to be specified if updated.
-
-## Convergent encryption v2
-
-New keys in `transit` using convergent mode will use a new nonce derivation
-mechanism rather than require the user to supply a nonce. While not explicitly
-increasing security, it minimizes the likelihood that a user will use the mode
-improperly and impact the security of their keys. Keys in convergent mode that
-were created in 0.6.1 will continue to work with the same mechanism
-(user-supplied nonce).
-
-## `etcd` HA off by default
-
-Following in the footsteps of `dynamodb`, the `etcd` storage backend now
-requires that `ha_enabled` be explicitly specified in the configuration file.
-The backend currently has known broken HA behavior, so this flag discourages
-use by default without explicitly enabling it. If you are using this
-functionality, when upgrading, you should set `ha_enabled` to `"true"` _before_
-starting the new versions of Vault.
-
-## Reading wrapped responses from `cubbyhole/response` is deprecated
-
-The `sys/wrapping/unwrap` endpoint should be used instead as it provides
-additional security, auditing, and other benefits. The ability to read directly
-will be removed in a future release.
-
-## Default/Max Lease/Token TTLs now 32 days
-
-In previous versions of Vault the default was 30 days, but changing it to 32
-days allows some operations (e.g. reauthenticating, renewing, etc.) to be
-performed via a monthly cron job.
-
-## AppRole secret ID endpoints changed
-
-Secret ID and Secret ID accessors are no longer part of request URLs. The `GET`
-and `DELETE` operations are now moved to new endpoints (`/lookup` and
-`/destroy`) which consumes the input from the body via `POST` (or `PUT`) and
-not the URL.
-
-## Behavior change for `bound_iam_role_arn` in AWS-EC2 backend
-
-In prior versions a bug caused the `bound_iam_role_arn` value in the `aws-ec2`
-auth method to actually use the instance profile ARN. This has been
-corrected, but as a result there is a behavior change. To match using the
-instance profile ARN, a new parameter `bound_iam_instance_profile_arn` has been
-added. Existing roles will automatically transfer the value over to the correct
-parameter, but the next time the role is updated, the new meanings will take
-effect.
diff --git a/website/content/docs/upgrading/upgrade-to-0.6.3.mdx b/website/content/docs/upgrading/upgrade-to-0.6.3.mdx
deleted file mode 100644
index 63ce624e338..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.6.3.mdx
+++ /dev/null
@@ -1,35 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.6.3 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.6.3. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.6.3. Please read it carefully.
-
-## LDAP null binds disabled by default
-
-When using the LDAP auth method, `deny_null_bind` has a default value of
-`true`, preventing a successful user authentication when an empty password
-is provided. If you utilize passwordless LDAP binds, `deny_null_bind` must
-be set to `false`. Upgrades will keep previous behavior until the LDAP
-configuration information is rewritten, at which point the new behavior
-will be utilized.
-
-## Request size limitation
-
-A maximum request size of 32MB is imposed to prevent a denial of service attack
-with arbitrarily large requests.
-
-## Any audit device successfully activated allows active duty
-
-Previously, when a new Vault node was taking over service in an HA cluster, all
-audit devices were required to be active successfully to take over active
-duty. This behavior now matches the behavior of the audit logging system
-itself: at least one audit device must successfully be activated. The server
-log contains an error when this occurs. This helps keep a Vault HA cluster
-working when there is a misconfiguration on a standby node.
diff --git a/website/content/docs/upgrading/upgrade-to-0.6.4.mdx b/website/content/docs/upgrading/upgrade-to-0.6.4.mdx
deleted file mode 100644
index 4421aa44e02..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.6.4.mdx
+++ /dev/null
@@ -1,83 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.6.4 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.6.4. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.6.4. Please read it carefully.
-
-Note: both of these are security sensitive changes.
-
-## Changes to `default` policy addition rules for `auth/token/create`
-
-An issue was reported indicating that in some cases, the stated behavior of the
-`default` policy being added to tokens unless specifically requested could lead
-to a privilege escalation scenario if the parent token did not itself have the
-`default` policy. In most cases (e.g. using the default `default` policy) the
-escalated privileges are unlikely to be dangerous, but this behavior is
-undesired.
-
-As such, we have modified the rules around `default` in a few ways when
-creating tokens using this endpoint:
-
-1. If a token creation request does not specify desired policies, the parent's
-   policies will be used (as normal) but `default` will not be automatically
-   added, so the child token will only have `default` if the parent does
-2. If a token creation request specifies desired policies, `default` will be
-   added automatically if and only if the parent token has `default`
-3. If the parent token has `sudo` capability on the token creation endpoint,
-   `default` is always added; since `sudo` capability on this endpoint allows
-   adding any policy, this is not privilege escalation with respect to the
-   parent token-holder
-4. When using token store roles, `default` is always added to the list of child
-   token policies unless `default` is contained in `disallowed_policies`
-
-**Regardless of provenance**, if a token being created has the `default` policy
-and `no_default_policy` has been set `true` for the request, the `default`
-policy will be stripped from the final set of policies.
-
-## Many users should run `auth/token/tidy`
-
-While investigating a report of accessor entries not being removed correctly
-from Vault's data store, a security issue was discovered: if limited use-count
-tokens are being used and expire due to the use-count dropping to zero (rather
-than due to the token's TTL expiring or the token being explicitly revoked),
-several pieces of Vault's token revocation logic would not be properly run.
-This included cleaning up the associated accessor entry from the data store,
-but more importantly, included the logic used to immediately expire leases
-associated with the token.
-
-These leases would not live forever; they would still be expired when their TTL
-ran out. This limits the severity of this issue, but it is still a potentially
-serious bug depending on each particular operational scenario.
-
-To mitigate this issue we have taken the following steps:
-
-1. Updated the token revocation logic to be more resilient to failures that can
-   happen as it performs its various steps; the revocation will now properly
-   only be considered successful if no error has occurred. In addition, the
-   token entry will remain in the data store (but _not_ be usable for
-   performing Vault functions) until all aspects of revocation report success,
-   allowing future revocation requests to succeed if the underlying cause of the
-   failure has been addressed.
-
-2. Added a function `auth/token/tidy` that can both clean up the leaked
-   accessor entries and expire the leases associated with those accessors'
-   tokens.
-
-In most cases, running `auth/token/tidy` should expire all outstanding
-leases that were generated by these revoked limited-use-count tokens.
-
-If you are both using limited-use-count tokens _and_ you are using them to
-issue leased secrets, you should consider upgrading to 0.6.4 and running the
-`auth/token/tidy` endpoint immediately. Please note that running this function
-involves a lot of requests to the data store, so plan load accordingly.
-
-Note: response wrapping tokens do not allow generating leases but have still
-been subject to leaking the accessor entries, so if you have been a heavy user
-of response wrapping you should still consider running the tidy function.
diff --git a/website/content/docs/upgrading/upgrade-to-0.7.0.mdx b/website/content/docs/upgrading/upgrade-to-0.7.0.mdx
deleted file mode 100644
index f26fc33b375..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.7.0.mdx
+++ /dev/null
@@ -1,45 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.7.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.7.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.7.0 compared to the most recent release. Please read it carefully.
-
-## Rename of `backend` config key to `storage`
-
-When configuring Vault, the `backend` key previously used to configure
-storage has now been renamed to `storage`. Vault will alias the old key to the
-new path, though users are encouraged to update their configuration to ensure
-minimal disruption in the future when the alias is removed.
-
-## List operations always use trailing slash
-
-Any list operation, whether via the `GET` or `LIST` HTTP verb, will now
-internally canonicalize the path to have a trailing slash. This makes policy
-writing more predictable, as it means clients will no longer work or fail
-based on which client they're using or which HTTP verb they're using. However,
-it also means that policies allowing `list` capability must be carefully
-checked to ensure that they contain a trailing slash; some policies may need
-to be split into multiple stanzas to accommodate.
-
-## PKI defaults to unleased certificates
-
-When issuing certificates from the PKI backend, by default, no leases will be
-issued. If you want to manually revoke a certificate, its serial number can be
-used with the `pki/revoke` endpoint. Issuing leases is still possible by
-enabling the `generate_lease` toggle in PKI role entries (this will default to
-`true` for upgrades, to keep existing behavior), which will allow using lease
-IDs to revoke certificates. For installations issuing large numbers of
-certificates (tens to hundreds of thousands, or millions), this will
-significantly improve Vault startup time since leases associated with these
-certificates will not have to be loaded; however note that it also means that
-revocation of a token used to issue certificates will no longer add these
-certificates to a CRL. If this behavior is desired or needed, consider keeping
-leases enabled and ensuring lifetimes are reasonable, and issue long-lived
-certificates via a different role with leases disabled.
diff --git a/website/content/docs/upgrading/upgrade-to-0.8.0.mdx b/website/content/docs/upgrading/upgrade-to-0.8.0.mdx
deleted file mode 100644
index 2ceee82a847..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.8.0.mdx
+++ /dev/null
@@ -1,52 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.8.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.8.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.8.0 compared to the most recent release. Please read it carefully.
-
-## Enterprise upgrade procedure
-
-If you are upgrading from Vault Enterprise, you should take one of the
-following upgrade paths. Please note that reindexing stops the ability of the
-node to process requests while the indexing is happening. As a result, you may
-want to plan the upgrade for a time when either no writes to the primary are
-expected and secondaries can handle traffic (if using replication), or when
-there is a maintenance window.
-
-There are two reindex processes that need to happen during the upgrade, for two
-different indexes. One will happen automatically when the cluster is upgraded
-to 0.8.0. _This happens even if you are not currently using replication._ The
-other can be done in one of a few ways, as follows.
-
-### If not using replication
-
-If not using replication, no further action needs to be taken.
-
-### If using replication
-
-#### Option 1: reindex the primary, then upgrade secondaries
-
-The first option is to issue a write to [`sys/replication/reindex`][reindex] on the
-primary (it is not necessary on the secondaries). When the reindex on the
-primary is finished, upgrade the secondaries, then upgrade the primary.
-
-#### Option 2: upgrade all nodes simultaneously
-
-The second option is to upgrade all nodes to 0.8.0 at the same time. This
-removes the need to perform an explicit reindex but may equate to more down
-time since secondaries will not be able to service requests while the primary
-is performing an explicit reindex.
-
-## `sys/revoke-force` requires `sudo` capability
-
-This path was meant to require `sudo` capability but was not implemented this
-way. It now requires `sudo` capability to run.
-
-[reindex]: /vault/api-docs/system/replication#reindex-replication
diff --git a/website/content/docs/upgrading/upgrade-to-0.9.0.mdx b/website/content/docs/upgrading/upgrade-to-0.9.0.mdx
deleted file mode 100644
index e2b7a6fca37..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.9.0.mdx
+++ /dev/null
@@ -1,121 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.9.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.9.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.9.0 compared to the most recent release. Please read it carefully.
-
-### PKI root generation (Since 0.8.1)
-
-Calling [`pki/root/generate`][generate-root] when a CA cert/key already exists will now return a
-`204` instead of overwriting an existing root. If you want to recreate the
-root, first run a delete operation on `pki/root` (requires `sudo` capability),
-then generate it again.
-
-### Token period in AWS IAM auth (Since 0.8.2)
-
-In prior versions of Vault, if authenticating via AWS IAM and requesting a
-periodic token, the period was not properly respected. This could lead to
-tokens expiring unexpectedly, or a token lifetime being longer than expected.
-Upon token renewal with Vault 0.8.2 the period will be properly enforced.
-
-### SSH CLI parameters (Since 0.8.2)
-
-`vault ssh` users should supply `-mode` and `-role` to reduce the number of API
-calls. A future version of Vault will mark these optional values are required.
-Failure to supply `-mode` or `-role` will result in a warning.
-
-### Vault plugin init (Since 0.8.2)
-
-Vault plugins will first briefly run a restricted version of the plugin to
-fetch metadata, and then lazy-load the plugin on first request to prevent
-crash/deadlock of Vault during the unseal process. Plugins will need to be
-built with the latest changes in order for them to run properly.
-
-### Policy input format standardization (Since 0.8.3)
-
-For all built-in authentication backends, policies can now be specified as a
-comma-delimited string or an array if using JSON as API input; on read,
-policies will be returned as an array; and the `default` policy will not be
-forcefully added to policies saved in configurations. Please note that the
-`default` policy will continue to be added to generated tokens, however, rather
-than backends adding `default` to the given set of input policies (in some
-cases, and not in others), the stored set will reflect the user-specified set.
-
-### PKI `sign-self-issued` modifies `Issuer` in generated certificates (Since 0.8.3)
-
-In 0.8.2 the endpoint would not modify the Issuer in the generated certificate,
-leaving the output self-issued. Although theoretically valid, in practice
-crypto stacks were unhappy validating paths containing such certs. As a result,
-`sign-self-issued` now encodes the signing CA's Subject DN into the Issuer DN
-of the generated certificate.
-
-### `sys/raw` requires enabling (Since 0.8.3)
-
-While the `sys/raw` endpoint can be extremely useful in break-glass or support
-scenarios, it is also extremely dangerous. As of now, a configuration file
-option `raw_storage_endpoint` must be set in order to enable this API endpoint.
-Once set, the available functionality has been enhanced slightly; it now
-supports listing and decrypting most of Vault's core data structures, except
-for the encryption keyring itself.
-
-### `generic` is now `kv` (Since 0.8.3)
-
-To better reflect its actual use, the `generic` backend is now `kv`. Using
-`generic` will still work for backwards compatibility.
-
-### HSM users need to specify new config options (In 0.9)
-
-When using Vault with an HSM, a new parameter is required: `hmac_key_label`.
-This performs a similar function to `key_label` but for the HMAC key Vault will
-use. Vault will generate a suitable key if this value is specified and
-`generate_key` is set true. See [the seal configuration page][pkcs11-seal] for
-more information.
-
-### API HTTP client behavior (In 0.9)
-
-When calling `NewClient` the API no longer modifies the provided
-client/transport. In particular this means it will no longer enable redirection
-limiting and HTTP/2 support on custom clients. It is suggested that if you want
-to make changes to an HTTP client that you use one created by `DefaultConfig`
-as a starting point.
-
-### AWS EC2 client nonce behavior (In 0.9)
-
-The client nonce generated by the backend that gets returned along with the
-authentication response will be audited in plaintext. If this is undesired, the
-clients can choose to supply a custom nonce to the login endpoint. The custom
-nonce set by the client will from now on, not be returned back with the
-authentication response, and hence not audit logged.
-
-### AWS auth role options (In 0.9)
-
-The API will now error when trying to create or update a role with the
-mutually-exclusive options `disallow_reauthentication` and
-`allow_instance_migration`.
-
-### SSH CA role read changes (In 0.9)
-
-When reading back a role from the `ssh` backend, the TTL/max TTL values will
-now be an integer number of seconds rather than a string. This better matches
-the API elsewhere in Vault.
-
-### SSH role list changes (In 0.9)
-
-When listing roles from the `ssh` backend via the API, the response data will
-additionally return a `key_info` map that will contain a map of each key with a
-corresponding object containing the `key_type`.
-
-### More granularity in audit logs (In 0.9)
-
-Audit request and response entries are still in RFC3339 format but now have a
-granularity of nanoseconds.
-
-[generate-root]: /vault/api-docs/secret/pki#generate-root
-[pkcs11-seal]: /vault/docs/configuration/seal/pkcs11
diff --git a/website/content/docs/upgrading/upgrade-to-0.9.1.mdx b/website/content/docs/upgrading/upgrade-to-0.9.1.mdx
deleted file mode 100644
index 1a2df1af12e..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.9.1.mdx
+++ /dev/null
@@ -1,55 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.9.1 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.9.1. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.9.1 compared to 0.9.0. Please read it carefully.
-
-### AppRole case sensitivity
-
-In prior versions of Vault, `list` operations against AppRole roles would
-require preserving case in the role name, even though most other operations
-within AppRole are case-insensitive with respect to the role name. This has
-been fixed; existing roles will behave as they have in the past, but new roles
-will act case-insensitively in these cases.
-
-### Token auth backend roles parameter types
-
-For `allowed_policies` and `disallowed_policies` in role definitions in the
-token auth backend, input can now be a comma-separated string or an array of
-strings. Reading a role will now return arrays for these parameters.
-
-### Transit key exporting
-
-You can now mark a key in the `transit` backend as `exportable` at any time,
-rather than just at creation time; however, once this value is set, it still
-cannot be unset.
-
-### PKI secret backend roles parameter types
-
-For `allowed_domains` and `key_usage` in role definitions in the PKI secret
-backend, input can now be a comma-separated string or an array of strings.
-Reading a role will now return arrays for these parameters.
-
-### SSH dynamic keys method defaults to 2048-bit keys
-
-When using the dynamic key method in the SSH backend, the default is now to use
-2048-bit keys if no specific key bit size is specified.
-
-### Consul secret backend lease handling
-
-The `consul` secret backend can now accept both strings and integer numbers of
-seconds for its lease value. The value returned on a role read will be an
-integer number of seconds instead of a human-friendly string.
-
-### Unprintable characters not allowed in API paths
-
-Unprintable characters are no longer allowed in names in the API (paths and
-path parameters), with an extra restriction on whitespace characters. Allowed
-characters are those that are considered printable by Unicode plus spaces.
diff --git a/website/content/docs/upgrading/upgrade-to-0.9.2.mdx b/website/content/docs/upgrading/upgrade-to-0.9.2.mdx
deleted file mode 100644
index 3bfd242e0d5..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.9.2.mdx
+++ /dev/null
@@ -1,55 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.9.2 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.9.2. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.9.2 compared to 0.9.1. Please read it carefully.
-
-### Backwards compatible CLI changes
-
-This upgrade guide is typically reserved for breaking changes, however it
-is worth calling out that the CLI interface to Vault has been completely
-revamped while maintaining backwards compatibility. This could lead to
-potential confusion while browsing the latest version of the Vault
-documentation on vaultproject.io.
-
-All previous CLI commands should continue to work and are backwards
-compatible in almost all cases.
-
-Documentation for previous versions of Vault can be accessed using
-the GitHub interface by browsing tags (eg [0.9.1 website tree](https://github.com/hashicorp/vault/tree/v0.9.1/website)) or by
-[building the Vault website locally](https://github.com/hashicorp/vault/tree/v0.9.1/website#running-the-site-locally).
-
-### `sys/health` DR secondary reporting
-
-The `replication_dr_secondary` bool returned by `sys/health` could be
-misleading since it would be `false` both when a cluster was not a DR secondary
-but also when the node is a standby in the cluster and has not yet fully
-received state from the active node. This could cause health checks on LBs to
-decide that the node was acceptable for traffic even though DR secondaries
-cannot handle normal Vault traffic. (In other words, the bool could only convey
-"yes" or "no" but not "not sure yet".) This has been replaced by
-`replication_dr_mode` and `replication_perf_mode` which are string values that
-convey the current state of the node; a value of `disabled` indicates that
-replication is disabled or the state is still being discovered. As a result, an
-LB check can positively verify that the node is both not `disabled` and is not
-a DR secondary, and avoid sending traffic to it if either is true.
-
-### PKI secret backend roles parameter types
-
-For `ou` and `organization` in role definitions in the PKI secret backend,
-input can now be a comma-separated string or an array of strings. Reading a
-role will now return arrays for these parameters.
-
-### Plugin API changes
-
-The plugin API has been updated to utilize golang's context.Context package.
-Many function signatures now accept a context object as the first parameter.
-Existing plugins will need to pull in the latest Vault code and update their
-function signatures to begin using context and the new gRPC transport.
diff --git a/website/content/docs/upgrading/upgrade-to-0.9.3.mdx b/website/content/docs/upgrading/upgrade-to-0.9.3.mdx
deleted file mode 100644
index b929e013f27..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.9.3.mdx
+++ /dev/null
@@ -1,15 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.9.3 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.9.3. Please read it carefully.
----
-
-# Overview
-
-Due to a rapid release following 0.9.2, there are no version-specific upgrade
-instructions although any upgrade notices for 0.9.2 apply if you are coming
-from a previous version.
-
-Please see the [0.9.2 upgrade guide](/vault/docs/upgrading/upgrade-to-0.9.2) for notes on upgrading to 0.9.3.
diff --git a/website/content/docs/upgrading/upgrade-to-0.9.6.mdx b/website/content/docs/upgrading/upgrade-to-0.9.6.mdx
deleted file mode 100644
index 22df2d7e750..00000000000
--- a/website/content/docs/upgrading/upgrade-to-0.9.6.mdx
+++ /dev/null
@@ -1,26 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 0.9.6 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 0.9.6. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.9.6 compared to 0.9.5. Please read it carefully.
-
-### Change to AWS role output
-
-The AWS authentication backend now allows binds for inputs as either a
-comma-delimited string or a string array. However, to keep consistency with
-input and output, when reading a role the binds will now be returned as string
-arrays rather than strings.
-
-### Change to AWS IAM auth ARN prefix matching
-
-In order to prefix-match IAM role and instance profile ARNs in AWS auth
-backend, you now must explicitly opt-in by adding a `*` to the end of the ARN.
-Existing configurations will be upgraded automatically, but when writing a new
-role configuration the updated behavior will be used.
diff --git a/website/content/docs/upgrading/upgrade-to-1.0.0.mdx b/website/content/docs/upgrading/upgrade-to-1.0.0.mdx
deleted file mode 100644
index 7def400dd09..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.0.0.mdx
+++ /dev/null
@@ -1,48 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.0.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.0.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 0.11.5 compared to 1.0.0. Please read it carefully.
-
-## Token format change
-
-Tokens are now prefixed by a designation to indicate what type of token they are. Service tokens start with s. and batch tokens start with b.. Existing tokens will still work (they are all of service type and will be considered as such). Prefixing allows us to be more efficient when consuming a token, which keeps the critical path of requests faster.
-
-## Key encoding enforcement
-
-Vault will no longer accept updates when the storage key has invalid UTF-8 character encoding.
-
-## Upsert in mount tuning endpoints
-
-Mount/Auth tuning the options map on backends will now upsert any provided values, and keep any of the existing values in place if not provided. The options map itself cannot be unset once it's set, but the keypairs within the map can be unset if an empty value is provided, with the exception of the version keypair which is handled differently for KVv2 purposes.
-
-## Agent reauthentication
-
-Agent no longer automatically reauthenticates when new credentials are detected. It's not strictly necessary and in some cases was causing reauthentication much more often than intended.
-
-## HSM key regeneration removed
-
-Vault no longer supports destroying and regenerating encryption keys on an HSM; it only supports creating them. Although this has never been a source of a customer incident, it is simply a code path that is too trivial to activate, especially by mistyping regenerate_key instead of generate_key.
-
-## Seal upgrade before migration
-
-When upgrading from Vault 0.8.x, the seal type in the barrier config storage entry will be upgraded from "hsm-auto" to "awskms" or "pkcs11" upon unseal if using AWSKMS or HSM seals. If performing seal migration, the barrier config should first be upgraded prior to starting migration.
-
-## Pooled API client
-
-The Go API client now uses a connection-pooling HTTP client by default. For CLI operations this makes no difference but it should provide significant performance benefits for those writing custom clients using the Go API library. As before, this can be changed to any custom HTTP client by the caller.
-
-## Plugin catalog changes
-
-Builtin Secret Engines and Auth Methods are integrated deeper into the plugin system. The plugin catalog can now override builtin plugins with custom versions of the same name. Additionally the plugin system now requires a plugin type field when configuring plugins, this can be "auth", "database", or "secret".
-
-## Removed endpoints
-
-Paths within auth/token that allow specifying a token or accessor in the URL have been removed. These have been deprecated since March 2016 and undocumented, but were retained for backwards compatibility. They shouldn't be used due to the possibility of those paths being logged, so at this point they are simply being removed.
diff --git a/website/content/docs/upgrading/upgrade-to-1.1.0.mdx b/website/content/docs/upgrading/upgrade-to-1.1.0.mdx
deleted file mode 100644
index 2231a83bc25..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.1.0.mdx
+++ /dev/null
@@ -1,46 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.1.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.1.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.0.3 compared to 1.1.0. Please read it carefully.
-
-## JWT backend changes
-
-Specifying the group claims parameter has changed to use a standards based lookup. The groups_claim_delimiter_pattern
-has been removed and if the groups claim is not at the top level, it can now be specified as a JSONPointer.
-
-Additionally, roles now have a "role type" parameter with a default type of "oidc". To configure new JWT roles, a role
-type of "jwt" must be explicitly specified.
-
-## Deprecated CLI commands removed
-
-CLI commands deprecated in 0.9.2 are now removed. Please see the CLI help output for updated commands.
-
-## Additional changes
-
-- Vault no longer automatically mounts a k/v backend at the "secret/" path when initializing Vault.
-- Vault's cluster port will now be opened on HA standby nodes.
-- Vault no longer supports running netRPC plugins. These were deprecated in favor of gRPC based plugins and any plugin built since 0.9.4 defaults to gRPC. Older plugins may need to be recompiled against the latest Vault dependencies.
-
-## Known issues
-
--> **NOTE:** This is a known issue applicable to _Vault Enterprise_.
-
-During upgrades to 1.1.0, 1.1.1 or 1.1.2, Vault replication secondaries may
-require an automatically-triggered reindex, either if upgrading from a pre-0.8
-version of Vault or if a previously-issued reindex operation has failed in the
-past. In these reindex scenarios, the secondary cluster will perform a complete
-WAL replay, which can take a long time and is a partially blocking operation.
-
-This is fixed in [Vault
-1.1.3](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#113-june-5th-2019),
-and we recommend upgrading to Vault 1.1.3+ rather than any prior 1.1.x version.
-We also strongly recommend upgrading your Vault cluster to 1.1.3 if you are
-running Vault Enterprise 1.1.0, 1.1.1 or 1.1.2.
diff --git a/website/content/docs/upgrading/upgrade-to-1.1.1.mdx b/website/content/docs/upgrading/upgrade-to-1.1.1.mdx
deleted file mode 100644
index 21acde16b8a..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.1.1.mdx
+++ /dev/null
@@ -1,68 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.1.1 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.1.1. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.1.0 compared to 1.1.1. Please read it carefully.
-
-## Known issues
-
-### Issue with some KVv2 mounts
-
-There is a known issue that could cause the upgrade to 1.1.1 to fail under
-certain circumstances. This issue occurs when a KV version 2 mount exists but
-contains no data. This will be fixed in 1.1.2. Additionally a work around does
-exist: prior to upgrading ensure all KV v2 mounts have at least one key written
-to it.
-
-### Change in LDAP group CN handling
-
-A bug fix to allow group CNs to be found from an LDAP server in lowercase `cn`
-as well as uppercase `CN` had an unintended consequence. If prior to that a
-group used `cn`, as in `cn=foo,ou=bar` then the group that would need to be put
-into place in the LDAP plugin to match against policies is `cn=foo,ou=bar`
-since the CN would not be correctly found. After the change, the CN was
-correctly found, but this would result in the group name being parsed as `foo`
-and would not match groups using the full DN. In 1.1.5+, there is a boolean
-config setting `use_pre111_group_cn_behavior` to allow reverting to the old
-matching behavior; we also attempt to upgrade exiting configs to have that
-defaulted to true.
-
-### Long WAL replay
-
--> **NOTE:** This is a known issue applicable to _Vault Enterprise_.
-
-During upgrades to 1.1.0, 1.1.1 or 1.1.2, Vault replication secondaries may
-require an automatically-triggered reindex, either if upgrading from a pre-0.8
-version of Vault or if a previously-issued reindex operation has failed in the
-past. In these reindex scenarios, the secondary cluster will perform a complete
-WAL replay, which can take a long time and is a partially blocking operation.
-
-This is fixed in [Vault
-1.1.3](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#113-june-5th-2019),
-and we recommend upgrading to Vault 1.1.3+ rather than any prior 1.1.x version.
-We also strongly recommend upgrading your Vault cluster to 1.1.3 if you are
-running Vault Enterprise 1.1.0, 1.1.1 or 1.1.2.
-
-## JWT/OIDC plugin
-
-Logins of role_type "oidc" via the /login path are no longer allowed.
-
-## ACL wildcards
-
-New ordering defines which policy wins when there are multiple inexact matches
-and at least one path contains `+`. `+*` is now illegal in policy paths. The
-previous behavior simply selected any matching segment-wildcard path that
-matched.
-
-## Replication
-
-Due to technical limitations, mounting and unmounting was not previously
-possible from a performance secondary. These have been resolved, and these
-operations may now be run from a performance secondary.
diff --git a/website/content/docs/upgrading/upgrade-to-1.1.2.mdx b/website/content/docs/upgrading/upgrade-to-1.1.2.mdx
deleted file mode 100644
index 18f32c5a407..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.1.2.mdx
+++ /dev/null
@@ -1,28 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.1.2 - Guides
-description: |-
-  This page explains a known issue upgrading to Vault 1.1.2 for Enterprise
-  users.  Please read it carefully.
----
-
-# Overview
-
-This page explains a known issue upgrading to Vault 1.1.2 for Enterprise users.
-Please read it carefully.
-
-## Known issues
-
--> **NOTE:** This is a known issue applicable to _Vault Enterprise_.
-
-During upgrades to 1.1.0, 1.1.1 or 1.1.2, Vault replication secondaries may
-require an automatically-triggered reindex, either if upgrading from a pre-0.8
-version of Vault or if a previously-issued reindex operation has failed in the
-past. In these reindex scenarios, the secondary cluster will perform a complete
-WAL replay, which can take a long time and is a partially blocking operation.
-
-This is fixed in [Vault
-1.1.3](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#113-june-5th-2019),
-and we recommend upgrading to Vault 1.1.3+ rather than any prior 1.1.x version.
-We also strongly recommend upgrading your Vault cluster to 1.1.3 if you are
-running Vault Enterprise 1.1.0, 1.1.1 or 1.1.2.
diff --git a/website/content/docs/upgrading/upgrade-to-1.10.x.mdx b/website/content/docs/upgrading/upgrade-to-1.10.x.mdx
deleted file mode 100644
index 09bf2c60c8b..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.10.x.mdx
+++ /dev/null
@@ -1,144 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.10.x - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.10.x. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.10.x compared to 1.9. Please read it carefully.
-
-## SSH secrets engine
-
-The new default value of `algorithm_signer` for SSH CA roles has been changed
-to `rsa-sha2-256` from `ssh-rsa`. Existing roles will be migrated to
-explicitly specify the `algorithm_signer=ssh-rsa` for RSA keys if they used
-the implicit (empty) default, but newly created roles will use the new default
-value (preferring a literal `default` which presently uses `rsa-sha2-256`).
-
-## Etcd v2 API no longer supported
-
-Support for the Etcd v2 API is removed in Vault 1.10. The Etcd v2 API
-was deprecated with the release of [Etcd v3.5](https://etcd.io/blog/2021/announcing-etcd-3.5/),
-and will be decommissioned in a forthcoming Etcd release.
-
-Users of the `etcd` storage backend with the etcdv2 API that are
-upgrading to Vault 1.10 should [migrate](/vault/docs/commands/operator/migrate)
-Vault storage to an Etcd v3 cluster prior to upgrading to Vault 1.10.
-All storage migrations should have
-[backups](/vault/docs/concepts/storage#backing-up-vault-s-persisted-data)
-taken prior to migration.
-
-## OTP generation process
-
-Customers passing in OTPs during the process of generating root tokens must modify
-the OTP generation to include an additional 2 characters before upgrading so that the
-OTP can be xor-ed with the encoded root token. This change was implemented as a result
-of the change in the prefix from hvs. to s. for service tokens.
-
-## New error response for requests to perf standbys lagging behind active node
-
-The introduction of [Server Side Consistent Tokens](/vault/docs/faq/ssct) means that
-when issuing a request to a perf standby right after having obtained a token (e.g.
-via login), if the token and its lease haven't yet been replicated to the perf
-standby, an HTTP 412 error will be returned.  Before 1.10.0 this typically would've
-resulted in a 400, 403, or 50x response.
-
-## Token format change
-
-Token prefixes were updated to be more easily identifiable.
-
-- Service tokens previously started with s. now start with hvs.
-- Batch tokens previously started with b. now start with hvb.
-- Recovery tokens previously started with r. now start with hvr.
-
-Additionally, non-root service tokens are now longer than before. Previously, service tokens
-were 26 characters; they now have a minimum of 95 characters. However, existing tokens will
-still work.
-
-Refer to the [Server Side Consistent Token FAQ](/vault/docs/faq/ssct) for details.
-
-## OIDC provider built-in resources
-
-In Vault 1.9, the [OIDC identity provider](/vault/docs/secrets/identity/oidc-provider) feature
-was released as a tech preview. In Vault 1.10, built-in resources were introduced to the
-OIDC provider system to reduce configuration steps and enhance usability.
-
-The following built-in resources are included in each Vault namespace starting with Vault
-1.10:
-
- - A `default` OIDC provider that's usable by all client applications
- - A `default` key for signing and verification of ID tokens
- - An `allow_all` assignment which authorizes all Vault entities to authenticate via a
-   client application
-
-If you created an [OIDC provider](/vault/api-docs/secret/identity/oidc-provider#create-or-update-a-provider)
-with the name `default`, [key](/vault/api-docs/secret/identity/tokens#create-a-named-key) with the
-name `default`, or [assignment](/vault/api-docs/secret/identity/oidc-provider#create-or-update-an-assignment)
-with the name `allow_all` using the Vault 1.9 tech preview, the installation of these built-in
-resources will be skipped. We _strongly recommend_ that you delete any existing resources
-that have naming collisions before upgrading to Vault 1.10. Failing to delete resources with
-naming collisions could result unexpected default behavior. Additionally, we recommend reading
-the corresponding details in the OIDC provider [concepts](/vault/docs/concepts/oidc-provider) document
-to understand how the built-in resources are used in the system.
-
-## Known issues
-
-@include 'raft-retry-join-failure.mdx'
-
-@include 'raft-panic-old-tls-key.mdx'
-
-@include 'tokenization-rotation-persistence.mdx'
-
-### Errors returned by perf standbys lagging behind active node with consul storage
-
-The introduction of [Server Side Consistent Tokens](/vault/docs/faq/ssct) means that
-when issuing a request to a perf standby right after having obtained a token (e.g.
-via login), if the token and its lease haven't yet been replicated to the perf
-standby, an HTTP 412 error will be returned.  Before 1.10.0 this wouldn't have
-resulted in the client seeing errors with Consul storage.
-
-### Single Vault follower restart causes election even with established quorum
-
-We now support Server Side Consistent Tokens (See [Replication](/vault/docs/configuration/replication) and [Vault Eventual Consistency](/vault/docs/enterprise/consistency)), which introduces a new token format that can only be used on nodes of 1.10 or higher version. This new format is enabled by default upon upgrading to the new version. Old format tokens can be read by Vault 1.10, but the new format Vault 1.10 tokens cannot be read by older Vault versions.
-
-For more details, see the [Server Side Consistent Tokens FAQ](/vault/docs/faq/ssct).
-
-Since service tokens are always created on the leader, as long as the leader is not upgraded before performance standbys, service tokens will be of the old format and still be usable during the upgrade process. However, the usual upgrade process we recommend can't be relied upon to always upgrade the leader last. Due to this known [issue](https://github.com/hashicorp/vault/issues/14153), a Vault cluster using Integrated Storage may result in a leader not being upgraded last, and this can trigger a re-election. This re-election can cause the upgraded node to become the leader, resulting in the newly created tokens on the leader to be unusable on nodes that have not yet been upgraded. Note that this issue does not impact Vault Community Edition users.
-
-We will have a fix for this issue in Vault 1.10.3. Until this issue is fixed, you may be at risk of having performance standbys unable to service requests until all nodes are upgraded. We recommended that you plan for a maintenance window to upgrade.
-
-### Limited policy shows unhelpful message in UI after mounting a secret engine
-
-When a user has a policy that allows creating a secret engine but not reading it, after successful creation, the user sees a message n is undefined instead of a permissions error. We will have a fix for this issue in an upcoming minor release.
-
-### Adding/Modifying Duo MFA method for enterprise MFA triggers a panic error
-
-When adding or modifying a Duo MFA method for step-up Enterprise MFA using the `sys/mfa/method/duo` endpoint, a panic gets triggered due to a missing schema field. We will have a fix for this in Vault 1.10.1. Until this issue is fixed, avoid making any changes to your Duo configuration if you are upgrading Vault to v1.10.0.
-
-### Sign in to UI using OIDC auth method results in an error
-
-Signing in to the Vault UI using an OIDC auth mount listed in the "tabs" of the form will result
-in the following error: "Authentication failed: role with oidc role_type is not allowed".
-The auth mounts listed in the "tabs" of the form are those that have [listing_visibility](/vault/api-docs/system/auth#listing_visibility-1)
-set to `unauth`.
-
-There is a workaround for this error that will allow you to sign in to Vault using the OIDC
-auth method. Select the "Other" tab instead of selecting the specific OIDC auth mount tab.
-From there, select "OIDC" from the "Method" select box and proceed to sign in to Vault.
-
-### Login MFA not enforced after restart
-
-A serious bug was identified in the Login MFA feature introduced in 1.10.0:
-[#15108](https://github.com/hashicorp/vault/issues/15108).
-Upon restart, Vault is not populating its in-memory MFA data structures based
-on what is found in storage. Although Vault is persisting to storage MFA methods
-and login enforcement configs populated via /identity/mfa, they will effectively
-disappear after the process is restarted.
-
-We plan to issue a new 1.10.3 release to address this soon. We recommend delaying
-any rollouts of Login MFA until that release.
-
diff --git a/website/content/docs/upgrading/upgrade-to-1.11.x.mdx b/website/content/docs/upgrading/upgrade-to-1.11.x.mdx
deleted file mode 100644
index 54d775ec70b..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.11.x.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.11.x - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.11.x. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.11.x compared to 1.10. Please read it carefully.
-
-## Elasticsearch database secrets engine
-
-The Elaticsearch Database Secrets Engine now uses the new `/_security` base API
-path instead of `/_xpack/security` when managing Elasticsearch. If users are on
-an Elasticsearch version prior to 6, they will need to switch back to the old
-API path by setting the [bool config option](/vault/api-docs/secret/databases/elasticdb#use_old_xpack)
-`use_old_xpack=true`.
-
-## Changes
-
-@include 'pgx-params.mdx'
-
-## Known issues
-
-@include 'raft-retry-join-failure.mdx'
-
-@include 'tokenization-rotation-persistence.mdx'
-
-### LDAP pagination issue
-
-There was a regression introduced in 1.11.10 relating to LDAP maximum page sizes, resulting in
-an error `no LDAP groups found in groupDN [...] only policies from locally-defined groups available`.  The issue
-occurs when upgrading Vault with an instance that has an existing LDAP Auth configuration.
-
-As a workaround, disable paged searching using the following:
-```shell-session
-vault write auth/ldap/config max_page_size=-1
-```
-
-#### Impacted versions
-
-Affects Vault 1.11.10.
-
-@include 'pki-double-migration-bug.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.12.x.mdx b/website/content/docs/upgrading/upgrade-to-1.12.x.mdx
deleted file mode 100644
index 76027e5b1a4..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.12.x.mdx
+++ /dev/null
@@ -1,217 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.12.x - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.12.x. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.12.x compared to 1.11. Please read it carefully.
-
-## Changes
-
-### Supported storage backends
-
-Vault Enterprise will now perform a supported storage check at startup. There is no impact on Vault Community Edition users.
-
-@include 'ent-supported-storage.mdx'
-
-@include 'consul-dataplane-upgrade-note.mdx'
-
-### External plugin loading
-
-Vault 1.12.0 introduced a change to how external plugins are loaded. Prior to
-Vault 1.12.0 plugins were lazy loaded on startup. This means that plugin
-processes were killed after a successful mount and then respawned when a
-request is routed to them. Vault 1.12.0 introduced auto mutual TLS for
-secrets/auth plugins so we do not lazy load them on startup anymore.
-
-## Known issues
-
-### Pinning to builtin plugin versions may cause failure on upgrade
-
-1.12.0 introduced plugin versions, and with it, the ability to explicitly specify
-the builtin version of a plugin when mounting an auth, database or secrets plugin.
-For example, `vault auth enable -plugin-version=v1.12.0+builtin.vault approle`. If
-there are any mounts where the _builtin_ version was explicitly specified in this way,
-Vault may fail to start on upgrading to 1.12.1 due to the specified version no
-longer being available.
-
-To check whether a mount path is affected, read the tune information, or the
-database config. The affected plugins are `snowflake-database-plugin@v0.6.0+builtin`
-and any plugins with `+builtin.vault` metadata in their version.
-
-In this example, the first two mounts are affected because `plugin_version` is
-explicitly set and is one of the affected versions. The third mount is not
-affected because it only has `+builtin` metadata, and is not the Snowflake
-database plugin. All mounts where the version is omitted, or the plugin is
-external (regardless of whether the version is specified) are unaffected.
-
--> **NOTE:** Make sure you use Vault CLI 1.12.0 or later to check mounts.
-
-```shell-session
-$ vault read sys/auth/approle/tune
-Key                  Value
----                  -----
-...
-plugin_version       v1.12.0+builtin.vault
-
-$ vault read database/config/snowflake
-Key                                   Value
----                                   -----
-...
-plugin_name                           snowflake-database-plugin
-plugin_version                        v0.6.0+builtin
-
-$ vault read sys/auth/kubernetes/tune
-Key                  Value
----                  -----
-...
-plugin_version       v0.14.0+builtin
-```
-
-As it is not currently possible to unset the plugin version, there are 3 possible
-remediations if you have any affected mounts:
-
-* Upgrade Vault directly to 1.12.2 once released
-* Upgrade to an external version of the plugin before upgrading to 1.12.1;
-  * Using the [tune API](/vault/api-docs/system/auth#tune-auth-method) for auth methods
-  * Using the [tune API](/vault/api-docs/system/mounts#tune-mount-configuration) for secrets plugins
-  * Or using the [configure connection](/vault/api-docs/secret/databases#configure-connection)
-    API for database plugins
-* Unmount and remount the path without a version specified before upgrading to 1.12.1.
-  **Note:** This will delete all data and leases associated with the mount.
-
-The bug was introduced by commit
-https://github.com/hashicorp/vault/commit/c36330f4c713b886a8a23c08cbbd862a7c530fc8.
-
-#### Impacted versions
-
-Affects upgrading from 1.12.0 to 1.12.1. All other upgrade paths are unaffected.
-1.12.2 will introduce a fix that enables upgrades from affected deployments of
-1.12.0.
-
-### Mounts associated with deprecated builtin plugins will result in core shutdown on upgrade
-
-As of 1.12.0 Standalone (logical) DB Engines and the AppId Auth Method have been
-marked with the `Pending Removal` status. Any attempt to unseal Vault with
-mounts backed by one of these builtin plugins will result in an immediate
-shutdown of the Vault core.
-
--> **NOTE** In the event that an external plugin with the same name and type as
-a deprecated builtin is deregistered, any subsequent unseal of Vault will also
-result in a core shutdown.
-
-```shell-session
-$ vault plugin register -sha256=c805cf3b69f704dfcd5176ef1c7599f88adbfd7374e9c76da7f24a32a97abfe1 auth app-id
-Success! Registered plugin: app-id
-$ vault auth enable -plugin-name=app-id plugin
-Success! Enabled app-id auth method at: app-id/
-$ vault auth list -detailed
-app-id/    app-id    auth_app-id_3a8f2e24    system         system     default-service    replicated     false        false                      map[]      n/a                        0018263c-0d64-7a70-fd5c-50e05c5f5dc3    n/a        n/a                      c805cf3b69f704dfcd5176ef1c7599f88adbfd7374e9c76da7f24a32a97abfe1    n/a
-$ vault plugin deregister auth app-id
-Success! Deregistered plugin (if it was registered): app-id
-$ vault plugin list -detailed | grep "app-id"
-app-id                               auth        v1.12.0+builtin.vault                                 pending removal
-```
-
-The remediation for affected mounts is to set the
-[VAULT_ALLOW_PENDING_REMOVAL_MOUNTS](/vault/docs/commands/server#vault_allow_pending_removal_mounts)
-environment variable and replace any `Pending Removal` feature with the
-[preferred alternative
-feature](/vault/docs/deprecation/faq#q-what-should-i-do-if-i-use-mount-filters-appid-or-any-of-the-standalone-db-engines).
-
-For more information on the phases of deprecation, see the [Deprecation Notices
-FAQ](/vault/docs/deprecation/faq#q-what-are-the-phases-of-deprecation).
-
-#### Impacted versions
-
-Affects upgrading from any version of Vault to 1.12.x. All other upgrade paths
-are unaffected.
-
-### `vault plugin list` fails when audit logging is enabled
-
-If audit logging is enabled, Vault will fail to audit the response from any
-calls to the [`GET /v1/sys/plugins/catalog`](/vault/api-docs/system/plugins-catalog#list-plugins)
-endpoint, which causes the whole request to fail and return a 500 internal
-server error. From the CLI, this looks like the following:
-
-```shell-session
-$ vault plugin list
-Error listing available plugins: data from server response is empty
-```
-
-It will produce errors in Vault Server's logs such as:
-
-```text
-2022-11-30T20:04:22.397Z [ERROR] audit: panic during logging: request_path=sys/plugins/catalog error="reflect: reflect.Value.Set using value obtained using unexported field"
-2022-11-30T20:04:22.398Z [ERROR] core: failed to audit response: request_path=sys/plugins/catalog
-  error=
-  | 1 error occurred:
-  | 	* panic generating audit log
-  |
-```
-
-As a workaround, [listing plugins by type](/vault/api-docs/system/plugins-catalog#list-plugins-1)
-will succeed:
-
-* `vault list sys/plugins/catalog/auth`
-* `vault list sys/plugins/catalog/database`
-* `vault list sys/plugins/catalog/secret`
-
-The bug was introduced by commit
-https://github.com/hashicorp/vault/commit/76165052e54f884ed0aa2caa496083dc84ad1c19.
-
-#### Impacted versions
-
-Affects versions 1.12.0, 1.12.1, and 1.12.2. A fix will be released in 1.12.3.
-
-### PKI OCSP GET requests return malformed request responses
-
-If an OCSP GET request contains a '+' character, a malformed request response will be
-returned instead of properly processing the request due to a double decoding issue within the
-handler.
-
-As a workaround, OCSP POST requests can be used which are unaffected.
-
-#### Impacted versions
-
-Affects version 1.12.3. A fix will be released in 1.12.4.
-
-@include 'tokenization-rotation-persistence.mdx'
-
-@include 'ocsp-redirect.mdx'
-
-### LDAP pagination issue
-
-There was a regression introduced in 1.12.6 relating to LDAP maximum page sizes, resulting in
-an error `no LDAP groups found in groupDN [...] only policies from locally-defined groups available`.  The issue
-occurs when upgrading Vault with an instance that has an existing LDAP Auth configuration.
-
-As a workaround, disable paged searching using the following:
-```shell-session
-vault write auth/ldap/config max_page_size=-1
-```
-
-#### Impacted versions
-
-Affects Vault 1.12.6.
-
-### Slow startup time when storing PKI certificates
-
-There was a regression introduced in 1.12.0 where Vault is slow to start because the 
-PKI secret engine performs a list operation on the stored certificates. If a large number 
-of certificates are stored this can cause long start times on active and standby nodes.
-
-There is currently no workaround for this other than limiting the number of certificates stored
-in Vault via the [PKI tidy](/vault/api-docs/secret/pki#tidy) or using `no_store`
-flag for [PKI roles](/vault/api-docs/secret/pki#createupdate-role).
-
-#### Impacted versions
-
-Affects Vault 1.12.0+
-
-@include 'pki-double-migration-bug.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.13.x.mdx b/website/content/docs/upgrading/upgrade-to-1.13.x.mdx
deleted file mode 100644
index 2865555d3aa..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.13.x.mdx
+++ /dev/null
@@ -1,198 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.13.x - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.13.x. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.13.x compared to 1.12. Please read it carefully.
-
-## Changes
-
-@include 'consul-dataplane-upgrade-note.mdx'
-
-### Undo logs
-
-Vault 1.13 introduced changes to add extra resiliency to log shipping with undo logs. These logs can help prevent several Merkle syncs from occurring due to rapid key changes in the primary Merkle tree as the secondary tries to synchronize. For integrated storage users, Vault needs to be upgraded to 1.13 will enable this feature by default. For Consul storage users, Consul also needs to be upgraded to 1.14 to use this feature.
-
-### User lockout
-
-As of version 1.13, Vault will stop trying to validate user credentials if the
-user submits multiple invalid credentials in quick succession. During lockout,
-Vault ignores requests from the barred user rather than responding with a
-permission denied error.
-
-User lockout is enabled by default with a lockout threshold of 5 attempt, a
-lockout duration of 15 minutes, and a counter reset window of 15 minutes.
-
-For more information, refer to the [User lockout](/vault/docs/concepts/user-lockout)
-overview.
-
-### Active directory secrets engine deprecation
-
-The Active Directory (AD) secrets engine has been deprecated as of the Vault 1.13 release.
-We will continue to support the AD secrets engine in maintenance mode for six major Vault
-releases. Maintenance mode means that we will fix bugs and security issues but will not add
-new features. For additional information, see the [deprecation table](/vault/docs/deprecation)
-and [migration guide](/vault/docs/secrets/ad/migration-guide).
-
-### AliCloud auth role parameter
-
-The AliCloud auth plugin will now require the `role` parameter on login. This
-has always been documented as a required field but the requirement will now be
-enforced.
-
-### Mounts associated with removed builtin plugins will result in core shutdown on upgrade
-
-As of 1.13.0 Standalone (logical) DB Engines and the AppId Auth Method have been
-marked with the `Removed` status. Any attempt to unseal Vault with
-mounts backed by one of these builtin plugins will result in an immediate
-shutdown of the Vault core.
-
--> **NOTE** In the event that an external plugin with the same name and type as
-a deprecated builtin is deregistered, any subsequent unseal will continue to
-unseal with an unusable auth backend, and a corresponding ERROR log.
-
-```shell-session
-$ vault plugin register -sha256=c805cf3b69f704dfcd5176ef1c7599f88adbfd7374e9c76da7f24a32a97abfe1 auth app-id
-Success! Registered plugin: app-id
-$ vault auth enable -plugin-name=app-id plugin
-Success! Enabled app-id auth method at: app-id/
-$ vault auth list -detailed | grep "app-id"
-app-id/    app-id    auth_app-id_3a8f2e24    system         system     default-service    replicated     false        false                      map[]      n/a                        0018263c-0d64-7a70-fd5c-50e05c5f5dc3    n/a        n/a                      c805cf3b69f704dfcd5176ef1c7599f88adbfd7374e9c76da7f24a32a97abfe1    n/a
-$ vault plugin deregister auth app-id
-Success! Deregistered plugin (if it was registered): app-id
-$ vault plugin list -detailed | grep "app-id"
-app-id                               auth        v1.13.0+builtin.vault                                 removed
-$ curl --header "X-Vault-Token: $VAULT_TOKEN" --request POST http://127.0.0.2:8200/v1/sys/seal
-$ vault operator unseal <key1>
-...
-$ vault operator unseal <key2>
-...
-$ vault operator unseal <key3>
-...
-$ grep "app-id" /path/to/vault.log
-[ERROR] core: skipping deprecated auth entry: name=app-id path=app-id/ error="mount entry associated with removed builtin"
-[ERROR] core: skipping initialization for nil auth backend: path=app-id/ type=app-id version="v1.13.0+builtin.vault"
-```
-
-The remediation for affected mounts is to downgrade to the previously-used version of Vault
-environment variable and replace any `Removed` feature with the
-[preferred alternative
-feature](/vault/docs/deprecation/faq#q-what-should-i-do-if-i-use-mount-filters-appid-or-any-of-the-standalone-db-engines).
-
-For more information on the phases of deprecation, see the [Deprecation Notices
-FAQ](/vault/docs/deprecation/faq#q-what-are-the-phases-of-deprecation).
-
-#### Impacted versions
-
-Affects upgrading from any version of Vault to 1.13.x. All other upgrade paths
-are unaffected.
-
-### Application of Sentinel Role Governing Policies (RGPs) via identity groups
-
-@include 'application-of-sentinel-rgps-via-identity-groups.mdx'
-
-## Known issues
-
-@include 'tokenization-rotation-persistence.mdx'
-
-@include 'ocsp-redirect.mdx'
-
-### PKI revocation request forwarding
-
-If a revocation request comes in to a standby or performance secondary node,
-for a certificate that is present locally, the request will not be correctly
-forwarded to the active node of this cluster.
-
-As a workaround, submit revocation requests to the active node only.
-
-### STS credentials do not return a lease_duration
-Vault 1.13.0 introduced a change to the AWS Secrets Engine such that it no longer creates leases for STS credentials due
-to the fact that they cannot be revoked or renewed. As part of this change, a bug was introduced which causes `lease_duration`
-to always return zero. This prevents the Vault Agent from refreshing STS credentials and may introduce undesired behaviour
-for anything which relies on a non-zero `lease_duration`.
-
-For applications that can control what value to look for, the `ttl` value in the response can be used to know when to
-request STS credentials next.
-
-An additional workaround for users rendering STS credentials via the Vault Agent is to set the
-`static-secret-render-interval` for a template using the credentials. Setting this configuration to 15 minutes
-accommodates the default minimum duration of an STS token and overrides the default render interval of 5 minutes.
-
-#### Impacted versions
-
-Affects Vault 1.13.0 only.
-
-### LDAP pagination issue
-
-There was a regression introduced in 1.13.2 relating to LDAP maximum page sizes, resulting in
-an error `no LDAP groups found in groupDN [...] only policies from locally-defined groups available`.  The issue
-occurs when upgrading Vault with an instance that has an existing LDAP Auth configuration.
-
-As a workaround, disable paged searching using the following:
-```shell-session
-vault write auth/ldap/config max_page_size=-1
-```
-
-#### Impacted versions
-
-Affects Vault 1.13.2.
-
-### PKI Cross-Cluster revocation requests and unified CRL/OCSP
-
-When revoking certificates on a cluster that doesn't own the
-certificate, writing the revocation request will fail with
-a message like `error persisting cross-cluster revocation request`.
-Similar errors will appear in the log for failure to write
-unified CRL and unified delta CRL WAL entries.
-
-As a workaround, submit revocation requests to the cluster which
-issued the certificate, or use BYOC revocation. Use cluster-local
-OCSP and CRLs until this is resolved.
-
-#### Impacted versions
-
-Affects Vault 1.13.0 to 1.13.2. Fixed in 1.13.3.
-
-On upgrade, all local revocations will be synchronized between
-clusters; revocation requests are not persisted when failing to
-write cross-cluster.
-
-### Slow startup time when storing PKI certificates
-
-There was a regression introduced in 1.13.0 where Vault is slow to start because the
-PKI secret engine performs a list operation on the stored certificates. If a large number
-of certificates are stored this can cause long start times on active and standby nodes.
-
-There is currently no workaround for this other than limiting the number of certificates stored
-in Vault via the [PKI tidy](/vault/api-docs/secret/pki#tidy) or using `no_store`
-flag for [PKI roles](/vault/api-docs/secret/pki#createupdate-role).
-
-#### Impacted versions
-
-Affects Vault 1.13.0+
-
-@include 'perf-standby-token-create-forwarding-failure.mdx'
-
-@include 'known-issues/update-primary-data-loss.mdx'
-
-@include 'pki-double-migration-bug.mdx'
-
-@include 'known-issues/update-primary-addrs-panic.mdx'
-
-@include 'known-issues/transit-managed-keys-panics.mdx'
-
-@include 'known-issues/internal-error-namespace-missing-policy.mdx'
-
-@include 'known-issues/ephemeral-loggers-memory-leak.mdx'
-
-@include 'known-issues/sublogger-levels-unchanged-on-reload.mdx'
-
-@include 'known-issues/expiration-metrics-fatal-error.mdx'
-
-@include 'known-issues/perf-secondary-many-mounts-deadlock.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.14.x.mdx b/website/content/docs/upgrading/upgrade-to-1.14.x.mdx
deleted file mode 100644
index 8baf08cb3e4..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.14.x.mdx
+++ /dev/null
@@ -1,66 +0,0 @@
----
-layout: docs
-page_title: Upgrade to Vault 1.14.x
-description: |-
-  Deprecations, important or breaking changes, and remediation recommendations
-  for anyone upgrading to 1.14.x from Vault 1.13.x.
----
-
-# Upgrade to Vault 1.14.x
-
-The Vault 1.14.x upgrade guide contains information on deprecations, important
-or breaking changes, and remediation recommendations for anyone upgrading from
-Vault 1.13. **Please read carefully**.
-
-## Feature deprecations and EOL
-
-### Duplicative Docker images
-
-As of Vault 1.14 we will no longer update the the `vault` Docker image.
-Only the [Verified Publisher](https://hub.docker.com/r/hashicorp/vault)
-`hashicorp/vault` image will be updated on DockerHub.
-
-Users of [Official Images](https://hub.docker.com/_/vault) need to use
-`docker pull hashicorp/vault:<version>` instead of `docker pull vault:<version>`
-to get newer versions of Vault in Docker images. Currently, HashiCorp publishes
-and updates identical Docker images of Vault as Verified Publisher and
-Official images separately.
-
-## Important changes
-
-`vault.raft_storage.bolt.write.time` has been corrected from a summary to a counter to more accurately reflect that it
-is measuring cumulative time writing, and not the distribution of individual write times.
-
-### Application of Sentinel Role Governing Policies (RGPs) via identity groups
-
-@include 'application-of-sentinel-rgps-via-identity-groups.mdx'
-
-## Known issues and workarounds
-
-@include 'known-issues/ui-pki-control-groups.mdx'
-
-@include 'known-issues/update-primary-data-loss.mdx'
-
-@include 'known-issues/update-primary-addrs-panic.mdx'
-
-@include 'known-issues/ui-safari-login-screen.mdx'
-
-@include 'known-issues/aws-static-roles.mdx'
-
-@include 'known-issues/transit-managed-keys-panics.mdx'
-
-@include 'known-issues/transit-managed-keys-sign-fails.mdx'
-
-@include 'known-issues/ui-collapsed-navbar.mdx'
-
-@include 'known-issues/user-lockout-logging.mdx'
-
-@include 'known-issues/internal-error-namespace-missing-policy.mdx'
-
-@include 'known-issues/ephemeral-loggers-memory-leak.mdx'
-
-@include 'known-issues/sublogger-levels-unchanged-on-reload.mdx'
-
-@include 'known-issues/expiration-metrics-fatal-error.mdx'
-
-@include 'known-issues/perf-secondary-many-mounts-deadlock.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.15.x.mdx b/website/content/docs/upgrading/upgrade-to-1.15.x.mdx
deleted file mode 100644
index fe82968af31..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.15.x.mdx
+++ /dev/null
@@ -1,76 +0,0 @@
----
-layout: docs
-page_title: Upgrade to Vault 1.15.x - Guides
-description: |-
-  Deprecations, important or breaking changes, and remediation recommendations
-  for anyone upgrading to 1.15.x from Vault 1.14.x.
----
-
-# Overview
-
-The Vault 1.15.x upgrade guide contains information on deprecations, important
-or breaking changes, and remediation recommendations for anyone upgrading from
-Vault 1.14. **Please read carefully**.
-
-## Consul service registration
-
-As of version 1.15, `service_tags` supplied to Vault for the purpose of [Consul
-service registration](/vault/docs/configuration/service-registration/consul#service_tags)
-will be **case-sensitive**.
-
-In previous versions of Vault tags were converted to lowercase which led to issues,
-for example when tags contained Traefik rules which use case-sensitive method names
-such as `Host()`.
-
-If you previously used Consul service registration tags ignoring case, or relied
-on the lowercase tags created by Vault, then this change may cause unexpected behavior.
-
-Please audit your Consul storage stanza to ensure that you either:
-
-* Manually convert your `service_tags` to lowercase if required
-* Ensure that any system that relies on the tags is aware of the new case-preserving behavior
-
-## Rollback metrics
-
-Vault no longer measures and reports the metrics `vault.rollback.attempts.{MOUNTPOINT}` and `vault.route.rollback.{MOUNTPOINT}` by default. The new default metrics are `vault.rollback.attempts`
-and `vault.route.rollback`, which **do not** contain the mount point in the metric name.
-
-To continue measuring `vault.rollback.attempts.{MOUNTPOINT}` and
-`vault.route.rollback.{MOUNTPOINT}`, you must explicitly enable mount-specific
-metrics in the `telemetry` stanza of your Vault configuration with the
-[`add_mount_point_rollback_metrics`](/vault/docs/configuration/telemetry#add_mount_point_rollback_metrics)
-option.
-
-## Application of Sentinel Role Governing Policies (RGPs) via identity groups
-
-@include 'application-of-sentinel-rgps-via-identity-groups.mdx'
-
-## Known issues and workarounds
-
-@include 'known-issues/transit-managed-keys-panics.mdx'
-
-@include 'known-issues/transit-managed-keys-sign-fails.mdx'
-
-@include 'known-issues/aws-auth-panics.mdx'
-
-@include 'known-issues/ui-collapsed-navbar.mdx'
-
-@include 'known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx'
-
-@include 'known-issues/internal-error-namespace-missing-policy.mdx'
-
-@include 'known-issues/ephemeral-loggers-memory-leak.mdx'
-
-@include 'known-issues/sublogger-levels-unchanged-on-reload.mdx'
-
-@include 'known-issues/kv2-url-change.mdx'
-
-@include 'known-issues/expiration-metrics-fatal-error.mdx'
-
-@include 'known-issues/1_15_audit-use-of-log-raw-applies-to-all-devices.mdx'
-
-@include 'known-issues/1_15_openldap-rotate-credentials.mdx'
-
-@include 'known-issues/perf-secondary-many-mounts-deadlock.mdx'
-
-@include 'known-issues/1_15-audit-panic-handling-with-eventlogger.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.16.x.mdx b/website/content/docs/upgrading/upgrade-to-1.16.x.mdx
deleted file mode 100644
index d072465f8e9..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.16.x.mdx
+++ /dev/null
@@ -1,46 +0,0 @@
----
-layout: docs
-page_title: Upgrade to Vault 1.16.x - Guides
-description: |-
-  Deprecations, important or breaking changes, and remediation recommendations
-  for anyone upgrading to 1.16.x from Vault 1.15.x.
----
-
-# Overview
-
-The Vault 1.16.x upgrade guide contains information on deprecations, important
-or breaking changes, and remediation recommendations for anyone upgrading from
-Vault 1.15. **Please read carefully**.
-
-## Plugin environment variables
-
-Starting in 1.16.0, plugin-specific environment variables take precedence when
-they conflict with the main Vault process' environment.
-
-For example, if an external plugin is registered with `SOURCE=child` in the
-[env](/vault/api-docs/system/plugins-catalog#env) parameter, but the main Vault
-process has `SOURCE=parent` in its environment, versions prior to 1.16.0 will
-start the plugin process with `SOURCE=parent`. 1.16.0+ will start the plugin
-process with `SOURCE=child`.
-
-For any users relying on the old behavior, you can opt out of this change by setting
-`VAULT_PLUGIN_USE_LEGACY_ENV_LAYERING=true` for the main Vault process. If this
-flag is detected, Vault will continue to prioritize Vault process environment
-variables when there is a conflict. Additionally, during unseal Vault will enumerate
-all plugins in the catalog and print a warning for any plugins whose environment
-conflicts with the main process. If the flag is set and you see an informational
-log that there are no conflicts, the flag can safely be removed.
-
-Note that containerized plugins do not inherit any environment variables from
-the main Vault process, so are unaffected. Builtin plugins and external plugins
-that do not specify additional environment variables are also unaffected.
-
-See [plugin management](/vault/docs/plugins/plugin-management) for more details
-on plugin environment variables.
-
-## Known issues and workarounds
-
-@include 'known-issues/1_16-default-policy-needs-to-be-updated.mdx'
-
-@include 'known-issues/1_16-default-lcq-pre-1_9-upgrade.mdx'
-
diff --git a/website/content/docs/upgrading/upgrade-to-1.2.0.mdx b/website/content/docs/upgrading/upgrade-to-1.2.0.mdx
deleted file mode 100644
index 5a641852f10..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.2.0.mdx
+++ /dev/null
@@ -1,119 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.2.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.2.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.2.0 compared to 1.1.0. Please read it carefully.
-
-## Known issues
-
-### AppRole upgrade issue
-
-Due to a bug, on upgrade AppRole roles cannot be read properly. If using AppRole, do not upgrade until this issue is fixed in 1.2.1.
-
-## Changes/Deprecations
-
-### Path character handling
-
-Due to underlying changes in Go's runtime past version 1.11.5, Vault is now
-stricter about what characters it will accept in path names. Whereas before it
-would filter out unprintable characters (and this could be turned off), control
-characters and other invalid characters are now rejected within Go's HTTP
-library before the request is passed to Vault, and this cannot be disabled. To
-continue using these (e.g. for already-written paths), they must be properly
-percent-encoded (e.g. `\r` becomes `%0D`, `\x00` becomes `%00`, and so on).
-
-### AWSKMS seal region
-
-The user-configured regions on the AWSKMS seal stanza will now be preferred
-over regions set in the enclosing environment.
-
-### Audit logging of empty values
-
-All values in audit logs now are omitted if they are empty. This helps reduce
-the size of audit log entries by not reproducing keys in each entry that
-commonly don't contain any value, which can help in cases where audit log
-entries are above the maximum UDP packet size and others.
-
-### Rollback logging
-
-Rollback will no longer display log messages when it runs; it will only display
-messages if an error occurs.
-
-### Database plugins
-
-Database plugins now default to 4 max open connections rather than 2. This
-should be safe in nearly all cases and fixes some issues where a single
-operation could fail with the default configuration because it needed three
-connections just for that operation. However, this could result in an increase
-in held open file descriptors for each database configuration, so ensure that
-there is sufficient overhead.
-
-### AppRole various changes
-
-- AppRole uses new, common token fields for values that overlap with other auth
-  methods. `period` and `policies` will continue to work, with priority being
-  given to the `token_` prefixed versions of these fields, but the values for
-  those will only be returned on read if they were set initially.
-- `default` is no longer automatically added to policies after submission. It
-  was a no-op anyways since Vault's core would always add it, and changing this
-  behavior allows AppRole to support the new `token_no_default_policy`
-  parameter
-- The long-deprecated `bound_cidr_list` is no longer returned when reading a
-  role.
-
-### Token store roles changes
-
-Token store roles use new, common token fields for the values that overlap with
-other auth backends. `period`, `explicit_max_ttl`, and `bound_cidrs` will
-continue to work, with priority being given to the `token_` prefixed versions
-of those parameters. They will also be returned when doing a read on the role
-if they were used to provide values initially; however, in Vault 1.4 if
-`period` or `explicit_max_ttl` is zero they will no longer be returned.
-(`explicit_max_ttl` was already not returned if empty.)
-
-### Go API/SDK changes
-
-Vault now uses Go's official dependency management system, Go Modules, to
-manage dependencies. As a result to both reduce transitive dependencies for API
-library users and plugin authors, and to work around various conflicts, we have
-moved various helpers around, mostly under an `sdk/` submodule. A couple of
-functions have also moved from plugin helper code to the `api/` submodule. If
-you are a plugin author, take a look at some of our official plugins and the
-paths they are importing for guidance.
-
-### Change in LDAP group CN handling
-
-A bug fix put in place in Vault 1.1.1 to allow group CNs to be found from an
-LDAP server in lowercase `cn` as well as uppercase `CN` had an unintended
-consequence. If prior to that a group used `cn`, as in `cn=foo,ou=bar` then the
-group that would need to be put into place in the LDAP plugin to match against
-policies is `cn=foo,ou=bar` since the CN would not be correctly found. After
-the change, the CN was correctly found, but this would result in the group name
-being parsed as `foo` and would not match groups using the full DN. In 1.1.5+,
-there is a boolean config setting `use_pre111_group_cn_behavior` to allow
-reverting to the old matching behavior; we also attempt to upgrade exiting
-configs to have that defaulted to true.
-
-### JWT/OIDC plugin
-
-Logins of role_type "oidc" via the /login path are no longer allowed.
-
-### ACL wildcards
-
-New ordering put into place in Vault 1.1.1 defines which policy wins when there
-are multiple inexact matches and at least one path contains `+`. `+*` is now
-illegal in policy paths. The previous behavior simply selected any matching
-segment-wildcard path that matched.
-
-### Replication
-
-Due to technical limitations, mounting and unmounting was not previously
-possible from a performance secondary. These have been resolved, and these
-operations may now be run from a performance secondary.
diff --git a/website/content/docs/upgrading/upgrade-to-1.2.1.mdx b/website/content/docs/upgrading/upgrade-to-1.2.1.mdx
deleted file mode 100644
index aba0db599bc..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.2.1.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.2.1 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.2.1. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.2.1 compared to 1.2.0. Please read it carefully.
-
-## Known issues
-
-### AppRole upgrade issue
-
-Vault 1.2.1 contains a known issue where an existing AppRole role
-may not be read or updated under a specific scenario. The role in
-question needs to have been created before Vault 1.0.0, and then updated
-between 1.0.0 and 1.1.5. If using AppRole, do not upgrade to until
-his issue is fixed in 1.2.2.
diff --git a/website/content/docs/upgrading/upgrade-to-1.2.4.mdx b/website/content/docs/upgrading/upgrade-to-1.2.4.mdx
deleted file mode 100644
index 5b09b112d7b..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.2.4.mdx
+++ /dev/null
@@ -1,41 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.2.4 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.2.4. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.2.4 compared to 1.2.3. Please read it carefully.
-
-## Detached leases from tokens in non-root namespaces
-
-In a non-root namespace, revocation of a token scoped to a non-root namespace
-did not trigger the expected revocation of dynamic secret leases associated with
-that token. As a result, dynamic secret leases in non-root namespaces may
-outlive the token that created them. This vulnerability, CVE-2019-18616, affects
-Vault Enterprise 0.11.0 and newer.
-
-## Mount filtering in disaster recovery secondary clusters
-
-Disaster Recovery secondary clusters did not delete already-replicated data
-after a mount filter has been created on an upstream Performance secondary
-cluster. As a result, encrypted secrets may remain replicated on a Disaster
-Recovery secondary cluster after application of a mount filter excluding those
-secrets from replication. This vulnerability, CVE-2019-18617, affects Vault
-Enterprise 0.8 and newer.
-
-## Golang crypto/dsa CVE
-
-Update version of Go to 1.12.12 to fix Go bug golang.org/issue/34960 which
-corresponds to CVE-2019-17596.
-
-## AWS region detection in agent and CLI
-
-If a custom sts_endpoint is configured, Vault Agent and the CLI should provide
-the corresponding region via the region parameter (which already existed as a
-CLI parameter, and has now been added to Agent). The automatic region detection
-added to the CLI and Agent in 1.2 has been removed.
diff --git a/website/content/docs/upgrading/upgrade-to-1.2.5.mdx b/website/content/docs/upgrading/upgrade-to-1.2.5.mdx
deleted file mode 100644
index 6022aa3807b..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.2.5.mdx
+++ /dev/null
@@ -1,20 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.2.5 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.2.5. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.2.5 compared to 1.2.4. Please read it carefully.
-
-## Known issues
-
-Due to the known issues, we recommend skipping 1.2.5 and upgrading directly to 1.2.6.
-
-@include 'builds-without-ui.mdx'
-
-@include 'aws-invalid-header.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.2.6.mdx b/website/content/docs/upgrading/upgrade-to-1.2.6.mdx
deleted file mode 100644
index c30960b7271..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.2.6.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.2.6 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.2.6. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.2.6 compared to 1.2.4. Please read it carefully.
-
-## Known issues
-
-@include 'aws-invalid-header.mdx'
-
-@include 'enterprise-licenses.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.2.7.mdx b/website/content/docs/upgrading/upgrade-to-1.2.7.mdx
deleted file mode 100644
index 9cc4b50cb87..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.2.7.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.2.7 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.2.7. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.2.7 compared to 1.2.6. Please read it carefully.
-
-@include 'aws-invalid-header-fix.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.3.0.mdx b/website/content/docs/upgrading/upgrade-to-1.3.0.mdx
deleted file mode 100644
index 28dd8e549d9..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.3.0.mdx
+++ /dev/null
@@ -1,57 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.3.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.3.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.3.0 compared to 1.2.4. Please read it carefully.
-
-## Secondary cluster activation
-
-There has been a change to the way that activating performance and DR secondary
-clusters works when using public keys for encryption of the parameters rather
-than a wrapping token. This flow was experimental and never documented. It is
-now officially supported and documented but is not backwards compatible with
-older Vault releases.
-
-## Cluster cipher suites
-
-On its cluster port, Vault will no longer advertise the full TLS 1.2 cipher
-suite list by default. Although this port is only used for Vault-to-Vault
-communication and would always pick a strong cipher, it could cause false flags
-on port scanners and other security utilities that assumed insecure ciphers were
-being used. The previous behavior can be achieved by setting the value of the
-(undocumented) cluster_cipher_suites config flag to tls12.
-
-## API/Agent renewal behavior
-
-The API now allows multiple options for how it deals with renewals. The legacy
-behavior in the Agent/API is for the renewer (now called the lifetime watcher)
-to exit on a renew error, leading to a reauthentication. The new default
-behavior is for the lifetime watcher to ignore 5XX errors and simply retry as
-scheduled, using the existing lease duration. It is also possible, within
-custom code, to disable renewals entirely, which allows the lifetime watcher to
-simply return when it believes it is time for your code to renew or
-reauthenticate.
-
-## Filtered mount replication deprecation
-
-As of 1.3.0, paths that were once filtered with
-[Filtered Mount Replication](/vault/api-docs/system/replication/replication-performance#create-mounts-filter-deprecated)
-are migrated to use
-[Filtered Paths Replication](/vault/api-docs/system/replication/replication-performance#create-paths-filter).
-The APIs are very similar, but as of 1.3.0, we have marked the mount filter API as
-deprecated and recommend migrating to the path filter API, as the mount filter
-API will be removed in a future version of Vault.
-
-In versions of Vault prior to 1.3.0, mount filters could be used to allow
-only specified mounts to replicate to secondary nodes via an allowlist
-(referred to as a whitelist in the original documentation of the feature). After
-upgrade to 1.3.0 and later, if allowlist/whitelist mount filters were enabled
-on a secondary node, namespaces and their default mounts will also stop
-replicating to that secondary node.
diff --git a/website/content/docs/upgrading/upgrade-to-1.3.10.mdx b/website/content/docs/upgrading/upgrade-to-1.3.10.mdx
deleted file mode 100644
index 03017895207..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.3.10.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.3.10 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.3.10. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.3.10 compared to 1.3.9. Please read it carefully.
-
-@include 'aws-invalid-header-fix.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.3.2.mdx b/website/content/docs/upgrading/upgrade-to-1.3.2.mdx
deleted file mode 100644
index 61abfd78cc6..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.3.2.mdx
+++ /dev/null
@@ -1,16 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.3.2 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.3.2. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.3.0 compared to 1.3.2. Please read it carefully.
-
-@include 'aws-auth-metadata-issue.mdx'
-
-@include 'aws-sts-issue.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.3.3.mdx b/website/content/docs/upgrading/upgrade-to-1.3.3.mdx
deleted file mode 100644
index 7f65c0e5499..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.3.3.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.3.3 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.3.3. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.3.2 compared to 1.3.3. Please read it carefully.
-
-@include 'aws-auth-metadata-issue.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.3.4.mdx b/website/content/docs/upgrading/upgrade-to-1.3.4.mdx
deleted file mode 100644
index 8d0fd6acd55..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.3.4.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.3.4 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.3.4. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.3.3 compared to 1.3.4. Please read it carefully.
-
-@include 'aws-auth-metadata-issue.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.3.5.mdx b/website/content/docs/upgrading/upgrade-to-1.3.5.mdx
deleted file mode 100644
index 3422171b5a8..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.3.5.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.3.5 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.3.5. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.3.5 compared to 1.3.4. Please read it carefully.
-
-## AWS auth metadata
-
-The metadata handling for AWS Auth logins has changed:
-
-The default set of metadata fields has been changed to `account_id` and `auth_type`. If your
-application relies on fields that were removed, they may be added back via the AWS Auth identity
-configuration endpoint (see example below).
-
-## Known issues
-
-The AWS metadata changes have caused an issue preventing renewal of tokens issued via AWS Auth.
-This has been fixed in Vault 1.3.6. The issue may be addressed in Vault 1.3.5 by configuring the
-required metadata explicitly:
-
-```
-vault write auth/aws/config/identity \
-  ec2_metadata=account_id,auth_type,instance_id,region \
-  iam_metadata=account_id,auth_type,client_user_id,canonical_arn,inferred_entity_id,inferred_aws_region
-```
diff --git a/website/content/docs/upgrading/upgrade-to-1.3.8.mdx b/website/content/docs/upgrading/upgrade-to-1.3.8.mdx
deleted file mode 100644
index 8d65543946c..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.3.8.mdx
+++ /dev/null
@@ -1,20 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.3.8 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.3.8. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.3.8 compared to 1.3.7. Please read it carefully.
-
-## Known issues
-
-Due to the known issues, we recommend skipping 1.3.8 and upgrading directly to 1.3.9.
-
-@include 'builds-without-ui.mdx'
-
-@include 'aws-invalid-header.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.3.9.mdx b/website/content/docs/upgrading/upgrade-to-1.3.9.mdx
deleted file mode 100644
index d361c93b16c..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.3.9.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.3.9 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.3.9. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.3.9 compared to 1.3.7. Please read it carefully.
-
-## Known issues
-
-@include 'aws-invalid-header.mdx'
-
-@include 'enterprise-licenses.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.4.0.mdx b/website/content/docs/upgrading/upgrade-to-1.4.0.mdx
deleted file mode 100644
index ebaf36f6886..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.4.0.mdx
+++ /dev/null
@@ -1,26 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.4.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.4.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.3.X compared to 1.4.0. Please read it carefully.
-
-## Known issues
-
-@include 'primary-cluster-addr-change.mdx'
-
-@include 'aws-auth-metadata-issue.mdx'
-
-@include 'aws-sts-issue.mdx'
-
-@include 'ldap-upndomain-issue.mdx'
-
-@include 'okta-group-pagination.mdx'
-
-@include 'aws-imds-timeout-upgrade.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.4.1.mdx b/website/content/docs/upgrading/upgrade-to-1.4.1.mdx
deleted file mode 100644
index 83373628272..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.4.1.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.4.1 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.4.1. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.4.1 compared to 1.4.0. Please read it carefully.
-
-## AWS auth metadata
-
-The metadata handling for AWS Auth logins has changed:
-
-The default set of metadata fields has been changed to `account_id` and `auth_type`. If your
-application relies on fields that were removed, they may be added back via the AWS Auth identity
-configuration endpoint (see example below).
-
-## Known issues
-
-The AWS metadata changes have caused an issue preventing renewal of tokens issued via AWS Auth.
-This has been fixed in Vault 1.4.2. The issue may be addressed in Vault 1.4.1 by configuring the
-required metadata explicitly:
-
-```
-vault write auth/aws/config/identity \
-  ec2_metadata=account_id,auth_type,instance_id,region \
-  iam_metadata=account_id,auth_type,client_user_id,canonical_arn,inferred_entity_id,inferred_aws_region
-```
-
-@include 'ldap-upndomain-issue.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.4.4.mdx b/website/content/docs/upgrading/upgrade-to-1.4.4.mdx
deleted file mode 100644
index d8b4544bc73..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.4.4.mdx
+++ /dev/null
@@ -1,20 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.4.4 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.4.4. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.4.4 compared to 1.4.3. Please read it carefully.
-
-## Known issues
-
-Due to the known issues, we recommend skipping 1.4.4 and upgrading directly to 1.4.5.
-
-@include 'builds-without-ui.mdx'
-
-@include 'aws-invalid-header.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.4.5.mdx b/website/content/docs/upgrading/upgrade-to-1.4.5.mdx
deleted file mode 100644
index 9141c0be12a..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.4.5.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.4.5 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.4.5. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.4.5 compared to 1.4.3. Please read it carefully.
-
-## Known issues
-
-@include 'aws-invalid-header.mdx'
-
-@include 'enterprise-licenses.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.4.6.mdx b/website/content/docs/upgrading/upgrade-to-1.4.6.mdx
deleted file mode 100644
index 828b984082f..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.4.6.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.4.6 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.4.6. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.4.6 compared to 1.4.5. Please read it carefully.
-
-@include 'aws-invalid-header-fix.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.5.0.mdx b/website/content/docs/upgrading/upgrade-to-1.5.0.mdx
deleted file mode 100644
index 302c6fd86b8..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.5.0.mdx
+++ /dev/null
@@ -1,93 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.5.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.5.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.5.0 compared to 1.4.1. Please read it carefully.
-
-## Google Cloud storage `credentials_file` removed
-
-The deprecated `credentials_file` config option has been removed. The `GOOGLE_APPLICATION_CREDENTIALS`
-environment variable or default credentials may be used instead. See
-[GCS Authentication](/vault/docs/configuration/storage/google-cloud-storage#gcs-authentication)
-for details on supported options.
-
-## Raft configuration
-
-A new Raft configuration value, `max_entry_size`, has been introduced. This value
-limits the size in bytes for a Raft KV entry. It applies to both put operations and
-transactions. Any put or transaction operation exceeding this configuration value
-will cause the respective operation to fail. The default value for this
-configuration is 1MiB.
-
-In addition, a new metric has been introduced, `vault.raft-storage.entry_size`,
-that allows for operators to sample the entry size, view the average, and adjust
-the configuration value as necessary. For additional details, please see
-[Raft configuration](/vault/docs/configuration/storage/raft).
-
-## Enabling telemetry on 32-bit systems will cause Vault to crash.
-
-A workaround for this issue is to disable collection of usage gauges in
-the [telemetry](/vault/docs/configuration/telemetry) stanza of the configuration.
-
-```
-telemetry {
-  ...
-  usage_gauge_period = "none"
-}
-```
-
-This will suppress the metrics `vault.identity.entity.count`,
-`vault.identity.entity.alias.count`, `vault.token.count`, `vault.token.count.by_auth`,
-`vault.token.count.by_policy`, `vault.token.count.by_ttl` and `vault.secret.kv.count`
-that were introduced in version 1.5.0, but all other Vault telemetry will remain available.
-
-## Zero-length keys in key-value stores will cause Vault to crash.
-
-A key-value data store might have a zero-length key, created before the request handling was
-modified to make this operation impossible. The metrics collection process crashes if it encounters
-this while counting the number of KV secrets.
-
-A workaround for this issue is to disable collection of usage gauges in
-the [telemetry](/vault/docs/configuration/telemetry) stanza of the configuration.
-
-```
-telemetry {
-  ...
-  usage_gauge_period = "none"
-}
-```
-
-This will disable all the metrics listed in the previous section. Or, set the environment value
-`VAULT_DISABLE_KV_GAUGE`, which will disable only `vault.secret.kv.count`.
-
-## Non-string values in seal config prevent startup
-
-Any values in the [Seal configuration stanza](/vault/docs/configuration/seal)
-that are not quoted strings yield a parse error of the form:
-
-```
-error loading "/etc/vault.d/config_seal.hcl": error parsing 'seal': seal.pkcs11: unable to parse 'purpose' in kms type "pkcs11": value could not be parsed as string
-```
-
-The error is not actually with the `purpose` field, but rather with other config fields such as:
-
-```
- mechanism = 0x1082
-```
-
-The workaround is to quote the strings in question, as in:
-
-```
- mechanism = "0x1082"
-```
-
-@include 'okta-group-pagination.mdx'
-
-@include 'aws-imds-timeout-upgrade.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.5.1.mdx b/website/content/docs/upgrading/upgrade-to-1.5.1.mdx
deleted file mode 100644
index 41d798e5697..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.5.1.mdx
+++ /dev/null
@@ -1,20 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.5.1 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.5.1. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.5.1 compared to 1.5.0. Please read it carefully.
-
-## Known issues
-
-Due to the known issues, we recommend skipping 1.5.1 and upgrading directly to 1.5.2.
-
-@include 'builds-without-ui.mdx'
-
-@include 'aws-invalid-header.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.5.2.mdx b/website/content/docs/upgrading/upgrade-to-1.5.2.mdx
deleted file mode 100644
index 610dad7db91..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.5.2.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.5.2 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.5.2. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.5.2 compared to 1.5.0. Please read it carefully.
-
-## Known issues
-
-@include 'aws-invalid-header.mdx'
-
-@include 'enterprise-licenses.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.5.3.mdx b/website/content/docs/upgrading/upgrade-to-1.5.3.mdx
deleted file mode 100644
index e83947be7c8..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.5.3.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.5.3 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.5.3. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.5.3 compared to 1.5.2. Please read it carefully.
-
-@include 'aws-invalid-header-fix.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.6.0.mdx b/website/content/docs/upgrading/upgrade-to-1.6.0.mdx
deleted file mode 100644
index 7e61b57b209..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.6.0.mdx
+++ /dev/null
@@ -1,54 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.6.0 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.6.0. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.6.0 compared to 1.5. Please read it carefully.
-
-## Go version
-
-Vault 1.6.0 is built with Go 1.15. Please review the [Go Release
-Notes](https://golang.org/doc/go1.15) for full details. A few items of
-particular note:
-
-- Go 1.15 has dropped support for 32-bit binaries on macOS, iOS, iPadOS,
-  watchOS, and tvOS, and Vault is no longer issuing darwin_386 binaries
-- Go 1.15 no longer treats the `CommonName` field on X.509 certificates as a
-  host name. X.509 certificates should be validated and potentially regenerated
-  before upgrading if they do not have Subject Alternative Names.
-
-## Transform secrets engine storage upgrade
-
-The Transform Secrets Engine (Enterprise only) will automatically upgrade the
-storage of its configuration in order to accommodate the new transformation
-type oriented configuration API. Secondaries will receive the
-modifications via replication.
-
-## Database engine interface upgrade
-
-The Database Engine has changed the underlying interface between Vault and each database
-implementation. This change allows use of [password policies](/vault/docs/concepts/password-policies)
-within the Database engine. The API for the Database Engine has not changed, only the underlying
-interface between Vault and the database plugins. All built-in database plugins (as well as the
-[Oracle](https://github.com/hashicorp/vault-plugin-database-oracle) plugin) have been upgraded to
-the new interface so no user actions are needed. Vault will continue to recognize existing custom
-database plugins but the old interface should be considered deprecated and may be removed in a
-future release. See our [upgrade guide for custom databases](/vault/docs/secrets/databases/custom) for
-more information on upgrading custom database plugins.
-
-@include 'alpine-314.mdx'
-
-## Known issues
-
-Due to the known issue, Transform Secrets Engine users are recommended to upgrade to version 1.6.4.
-Due to the known issue, Lease Count Quota users with DR Secondaries are recommended to upgrade to version 1.6.6.
-
-@include 'transform-upgrade.mdx'
-
-@include 'lease-count-quota-upgrade.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.6.1.mdx b/website/content/docs/upgrading/upgrade-to-1.6.1.mdx
deleted file mode 100644
index 8328952a216..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.6.1.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.6.1 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.6.1. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.6.1 compared to 1.6.0. Please read it carefully.
-
-## Known issues
-
-Due to the known issue, Transform Secrets Engine users are recommended to upgrade to version 1.6.4.
-
-@include 'transform-upgrade.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.6.2.mdx b/website/content/docs/upgrading/upgrade-to-1.6.2.mdx
deleted file mode 100644
index 86db3336317..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.6.2.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.6.2 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.6.2. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.6.2 compared to 1.6.1. Please read it carefully.
-
-## Known issues
-
-Due to the known issue, Transform Secrets Engine users are recommended to upgrade to version 1.6.4.
-
-@include 'transform-upgrade.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.6.3.mdx b/website/content/docs/upgrading/upgrade-to-1.6.3.mdx
deleted file mode 100644
index 671bf52a9ab..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.6.3.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.6.3 - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.6.3. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.6.3 compared to 1.6.2. Please read it carefully.
-
-## Known issues
-
-Due to the known issue, Transform Secrets Engine users are recommended to upgrade to version 1.6.4.
-
-@include 'transform-upgrade.mdx'
diff --git a/website/content/docs/upgrading/upgrade-to-1.7.x.mdx b/website/content/docs/upgrading/upgrade-to-1.7.x.mdx
deleted file mode 100644
index a5e9407c28f..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.7.x.mdx
+++ /dev/null
@@ -1,59 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.7.x - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.7.x. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.7.x compared to 1.6. Please read it carefully.
-
-## Go version
-
-Vault 1.7.8 and higher are built with Go 1.16. Please review the [Go Release
-Notes](https://golang.org/doc/go1.16) for full details. Vault 1.7.0-1.7.7 are
-built with Go 1.15.
-
-## Barrier key Auto-Rotation
-
-If your Vault installation is at least a year old, the barrier key will be
-automatically rotated once, and then subsequently will be rotated per the
-settings in the new `sys/rotate/config` endpoint. This is a precaution to
-ensure the number of encryptions performed by the barrier key is fewer than that
-recommended by
-[NIST SP 800-38D](https://csrc.nist.gov/publications/detail/sp/800-38d/final).
-
-## AWS auth endpoint changes and deprecations
-
-AWS Auth concepts and endpoints that use the "whitelist" and "blacklist" terms
-have been updated to more inclusive language (e.g. `/auth/aws/identity-whitelist` has been
-updated to`/auth/aws/identity-accesslist`). The old and new endpoints are aliases,
-sharing the same underlying data. The legacy endpoint names are considered **deprecated**
-and will be removed in a future release (not before Vault 1.9). The complete list of
-endpoint changes is available in the [AWS Auth API docs](/vault/api-docs/auth/aws#deprecations-effective-in-vault-1-7).
-
-@include 'alpine-314.mdx'
-
-@include 'entity-alias-mapping.mdx'
-
-## Known issues
-
-Due to the known issue, Transform Secrets Engine users are recommended to upgrade to version 1.7.0.
-Due to the known issue, Lease Count Quota users with DR Secondaries are recommended to upgrade to version 1.7.4.
-
-### Autopilot
-
-- Autopilot is not currently supported on DR Secondary clusters, or in
-  Integrated Storage's HA-only mode.
-- If the IP address in the raft peer list is different from the configured
-  cluster address, autopilot may be unable to determine the leader node. If
-  affected, you should disabled autopilot by setting the
-  `VAULT_RAFT_AUTOPILOT_DISABLE` environment variable to 1.
-
-@include 'transform-upgrade.mdx'
-
-@include 'lease-count-quota-upgrade.mdx'
-
diff --git a/website/content/docs/upgrading/upgrade-to-1.8.x.mdx b/website/content/docs/upgrading/upgrade-to-1.8.x.mdx
deleted file mode 100644
index cafc0a54711..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.8.x.mdx
+++ /dev/null
@@ -1,71 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.8.x - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.8.x. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.8.x compared to 1.7. Please read it carefully.
-
-## License enhancements
-
-Licenses and EULA enhancements have been introduced in the Vault 1.8 release.
-These changes are important for Enterprise customers to review. They do not affect
-Vault Community Edition users. Please see the [License](/vault/docs/enterprise/license) documentation for more details.
-
-## Deprecations
-
-The following API endpoints have been deprecated and will be removed in a future release:
-
-* `sys/license` to manage licenses in storage; it is recommended to use
-   [License Autoloading](/vault/docs/enterprise/license/autoloading) instead.
-
-* `/gcp/token/:roleset` and `/gcp/key/:roleset` paths for generating secrets for rolesets
-  in GCP Secrets. Use `/gcp/roleset/:roleset/token` and `/gcp/roleset/:roleset/key` instead.
-
--> **Note:** Policies containing globs should be avoided when giving users read access
-to `/gcp/roleset` to avoid giving users permissions to generate tokens.
-
-## Go version
-
-Vault 1.8.0 is built with Go 1.16. Please review the [Go Release
-Notes](https://golang.org/doc/go1.16) for full details. Of particular note:
-
-- Go 1.16 has added support for darwin/arm64. Vault binaries for this platform are
-  now available supporting the Apple M1 CPU.
-
-@include 'alpine-314.mdx'
-
-@include 'entity-alias-mapping.mdx'
-
-@include 'pki-forwarding-bug.mdx'
-
-## Known issues
-
-@include 'raft-panic-old-tls-key.mdx'
-
-### MSSQL integrations
-
-MSSQL integrations (storage and secrets engine) will crash with a "panic: not implemented" error ([#12830](https://github.com/hashicorp/vault/issues/12830)). This affects Vault versions
-  1.8.0 and up. It will be fixed in the next minor update.
-
-### Vault enterprise binaries
-
-Vault Enterprise binaries for `arm64` architectures will crash immediately when using production-ready storage backends.  This issue is addressed in Vault 1.8.1.
-
-### AWS auth
-
-AWS Auth using the [EC2 method](/vault/docs/auth/aws#ec2-auth-method) fails with the error `failed to verify the signature`. This effects 1.8.0 and 1.8.1 and there is not a workaround. The issue was fixed in Vault 1.8.2.
-
-### Configuration files in RedHat packages
-
-Configuration files in RedHat packages for Vault were not properly flagged as config files for `fpm`, causing user-edited files on disk to be replaced with
-the defaults when a new package was installed. This [issue](https://github.com/hashicorp/vault/issues/12275) affects RedHat packages for Vault 1.8.0 and the 1.8.1-0 package, and is fixed in 1.8.1-1 and up.
-
-### Introduction of rolesets
-
-The introduction of `/gcp/roleset/:roleset/token` and `/gcp/roleset/:roleset/key` could inadvertently give users the ability to generate tokens and key if globs are used in policies. To avoid issues like this, globs should be avoided in policies to help adhere to the principle of least privilege. See the [roleset documentation](/vault/docs/secrets/gcp#rolesets) for more information.
diff --git a/website/content/docs/upgrading/upgrade-to-1.9.x.mdx b/website/content/docs/upgrading/upgrade-to-1.9.x.mdx
deleted file mode 100644
index 9d3a1f8d2d0..00000000000
--- a/website/content/docs/upgrading/upgrade-to-1.9.x.mdx
+++ /dev/null
@@ -1,127 +0,0 @@
----
-layout: docs
-page_title: Upgrading to Vault 1.9.x - Guides
-description: |-
-  This page contains the list of deprecations and important or breaking changes
-  for Vault 1.9.x. Please read it carefully.
----
-
-# Overview
-
-This page contains the list of deprecations and important or breaking changes
-for Vault 1.9.x compared to 1.8. Please read it carefully.
-
-## OIDC provider
-
-Vault 1.9.0 introduced the ability for Vault to be an OpenID Connect (OIDC) identity
-provider. To support the feature, Vault's [default policy](/vault/docs/concepts/policies#default-policy)
-was modified to include an ACL rule for its Authorization Endpoint. Due to the handling
-of Vault's default policy during upgrades, existing deployments of Vault that are upgraded
-to 1.9.0 will not have this required ACL rule.
-
-If you're upgrading to 1.9.0 and want to use the new OIDC provider feature, the following
-ACL rule must be added to the default policy **or** a policy associated with the Vault
-[Auth Method](/vault/docs/auth) used to authenticate end-users during
-the OIDC flow.
-
-```hcl
-# Allow a token to make requests to the authorization endpoint for OIDC providers.
-path "identity/oidc/provider/+/authorize" {
-  capabilities = ["read", "update"]
-}
-```
-
-## Identity tokens
-
-The Identity secrets engine has changed the procedure for creating Identity
-token roles. When creating a role, the key parameter is required and the key
-must exist. Previously, it was possible to create a role and assign it a named
-key that did not yet exist despite the documentation stating otherwise.
-
-All calls to [create or update a role](/vault/api-docs/secret/identity/tokens#create-or-update-a-role)
-must be checked to ensure that roles are not being created or updated with
-non-existent keys.
-
-## SSH role parameter `allowed_extensions` behavior change
-
-Prior versions of Vault allowed clients to specify any extension when requesting
-SSH certificate [signing requests](/vault/api-docs/secret/ssh#sign-ssh-key)
-if their role had an `allowed_extensions` set to `""` or was missing.
-
-Now, Vault will reject a client request that specifies extensions if the role
-parameter `allowed_extensions` is empty or missing from the role they are
-associated with.
-
-To re-enable the old behavior, update the roles with a value
-of `"*"` to the `allowed_extensions` parameter allowing any/all extensions to be
-specified by clients.
-
-@include 'entity-alias-mapping.mdx'
-
-## Deprecations
-
-### HTTP request counter deprecation
-
-In Vault 1.9, the internal HTTP Request count
-[API](/vault/api-docs/v1.8.x/system/internal-counters#http-requests)
-will be removed from the product. Calls to the endpoint will result in a 404
-error with a message stating that `functionality on this path has been removed`.
-
-Vault does not make backwards compatible guarantees on internal APIs (those
-prefaced with `sys/internal`). They are subject to change and may disappear
-without notice.
-
-### Etcd v2
-
-Support for Etcd v2 will be removed from Vault in Vault 1.10 (not this Vault
-release, but the next one). The Etcd v2 API
-was deprecated with the release of [Etcd
-v3.5](https://etcd.io/blog/2021/announcing-etcd-3.5/), and will be
-decommissioned in the Etcd v3.6 release.
-
-Users upgrading to Vault 1.9 and planning to eventually upgrade to Vault 1.10
-should prepare to [migrate](/vault/docs/commands/operator/migrate) Vault storage to
-an Etcd v3 cluster prior to upgrading to Vault 1.10. All storage migrations
-should have [backups](/vault/docs/concepts/storage#backing-up-vault-s-persisted-data)
-taken prior to migration.
-
-## TLS cipher suites changes
-
-In Vault 1.9, due to changes in Go 1.17, the `tls_prefer_server_cipher_suites`
-TCP configuration parameter has been deprecated and its value will be ignored.
-
-Additionally, Go has begun doing automated cipher suite ordering and no longer
-respects the order of suites given in `tls_cipher_suites`.
-
-See [this blog post](https://go.dev/blog/tls-cipher-suites) for more information.
-
-@include 'pki-forwarding-bug.mdx'
-
-
-## Known issues
-
-@include 'raft-panic-old-tls-key.mdx'
-
-### Identity token backend key rotations
-
-Existing Vault installations that use the [Identity Token
-backend](/vault/api-docs/secret/identity/tokens) and have [named
-keys](/vault/api-docs/secret/identity/tokens#create-a-named-key) generated will
-encounter a panic when any of those existing keys pass their
-`rotation_period`. This issue affects Vault 1.9.0, and is fixed in Vault 1.9.1.
-Users should upgrade directly to 1.9.1 or above in order to avoid this panic.
-
-If a panic is encountered after an upgrade to Vault 1.9.0, the named key will be
-corrupted on storage and become unusable. In this case, the key will need to be
-deleted and re-created. A fix to fully mitigate this panic will be addressed on
-Vault 1.9.3.
-
-### Activity log Non-Entity tokens
-
-When upgrading Vault from 1.8 (or earlier) to 1.9 (or later), client counts of [non-entity tokens](/vault/docs/concepts/client-count#non-entity-tokens) will only include the tokens used after the upgrade.
-
-Starting in Vault 1.9, the activity log records and de-duplicates non-entity tokens by using the namespace and token's policies to generate a unique identifier. Because Vault did not create identifiers for these tokens before 1.9, the activity log cannot know whether this token has been seen pre-1.9. To prevent inaccurate and inflated counts, the activity log will ignore any counts of non-entity tokens that were created before the upgrade and only the non-entity tokens from versions 1.9 and later will be counted.
-
-Before upgrading, you should [query Vault usage metrics](/vault/tutorials/monitoring/usage-metrics#querying-usage-metrics) and report the usage data for billing purposes.
-
-See the client count [overview](/vault/docs/concepts/client-count) and [FAQ](/vault/docs/concepts/client-count/faq) for more information.
diff --git a/website/content/docs/upgrading/vault-ha-upgrade.mdx b/website/content/docs/upgrading/vault-ha-upgrade.mdx
deleted file mode 100644
index 91828fca8ee..00000000000
--- a/website/content/docs/upgrading/vault-ha-upgrade.mdx
+++ /dev/null
@@ -1,100 +0,0 @@
----
-layout: docs
-page_title: Vault HA upgrades without Autopilot Upgrade Automation (Pre 1.11)
-description: |-
-  Upgrade instructions for Vault HA Pre 1.11 or Vault without autopilot upgrade automation being enabled. Be sure to read the Upgrading-Vault Guides as well.
----
-
-# Vault HA upgrades without autopilot upgrade automation (Pre 1.11)
-
-This is our recommended upgrade procedure if **one** of the following applies:
-
-- Running Vault version earlier than 1.11
-- Opt-out the [Autopilot automated upgrade](/vault/docs/concepts/integrated-storage/autopilot#automated-upgrade) features with Vault 1.11 or later
-- Running Vault with external storage backend such as Consul
-
-You should consider how to apply the steps described in this document to your
-particular setup since HA setups can differ on whether a load balancer is in
-use, what addresses clients are being given to connect to Vault (standby +
-leader, leader-only, or discovered via service discovery), etc.
-
-If you are running on Vault 1.11+ with Integrated Storage and wish to enable the
-Autopilot upgrade automation features, read to the [automated
-upgrades](/vault/docs/concepts/integrated-storage/autopilot#automated-upgrades)
-documentation for details and the [Automate Upgrades with Vault
-Enterprise](/vault/tutorials/raft/raft-upgrade-automation) tutorial for
-additional guidance.
-
-
-## HA installations
-
-Regardless of the method you use, do not fail over from a newer version of Vault
-to an older version. Our suggested procedure is designed to prevent this.
-
-Please note that Vault does not support true zero-downtime upgrades, but with
-proper upgrade procedure the downtime should be very short (a few hundred
-milliseconds to a second depending on how the speed of access to the storage
-backend).
-
-<Warning title="Important">
-
-If you are currently running on Vault 1.11+ with Integrated Storage and have
-chosen to opt-out the Autopilot automated upgrade features, please disable the
-default automated upgrade migrations feature of the Vault. To disable this
-feature, follow the [Automate Upgrades with Vault Enterprise Autopilot
-configuration](/vault/tutorials/raft/raft-upgrade-automation#autopilot-configuration)
-tutorial for more details. Without disabling this feature, you may run into Lost
-Quorum issue as described in the [Quorum lost while upgrading the vault from
-1.11.0 to later version of
-it](https://support.hashicorp.com/hc/en-us/articles/7122445204755-Quorum-lost-while-upgrading-the-vault-from-1-11-0-to-later-version-of-it)
-article.
-
-</Warning>
-
-Perform these steps on each standby:
-
-1. Properly shut down Vault on the standby node via `SIGINT` or `SIGTERM`
-2. Replace the Vault binary with the new version; ensure that `mlock()`
-   capability is added to the new binary with
-   [setcap](/vault/docs/configuration#disable_mlock)
-3. Start the standby node
-4. Unseal the standby node
-5. Verify `vault status` shows correct Version and HA Mode is `standby`
-6. Review the node's logs to ensure successful startup and unseal
-
-At this point all standby nodes are upgraded and ready to take over. The
-upgrade will not complete until one of the upgraded standby nodes takes over
-active duty.
-
-To complete the cluster upgrade:
-
-1. Properly shut down the remaining (active) node
-
-   <Note>
-
-   It is important that you shut the node down properly.
-   This will perform a step-down and release the HA lock, allowing a standby
-   node to take over with a very short delay.
-   If you kill Vault without letting it release the lock, a standby node will
-   not be able to take over until the lock's timeout period has expired. This
-   is backend-specific but could be ten seconds or more.
-
-   </Note>
-
-2. Replace the Vault binary with the new version; ensure that `mlock()`
-   capability is added to the new binary with
-   [setcap](/vault/docs/configuration#disable_mlock)
-3. Start the node
-4. Unseal the node
-5. Verify `vault status` shows correct Version and HA Mode is `standby`
-6. Review the node's logs to ensure successful startup and unseal
-
-Internal upgrade tasks will happen after one of the upgraded standby nodes
-takes over active duty.
-
-Be sure to also read and follow any instructions in the version-specific
-upgrade notes.
-
-## Enterprise replication installations
-
-See the main [upgrading](/vault/docs/upgrading#enterprise-replication-installations) page.
diff --git a/website/content/docs/use-cases.mdx b/website/content/docs/use-cases.mdx
deleted file mode 100644
index 6eabb9f1467..00000000000
--- a/website/content/docs/use-cases.mdx
+++ /dev/null
@@ -1,63 +0,0 @@
----
-layout: docs
-page_title: Use Cases
-description: >-
-  This page lists some concrete use cases for Vault, but the possible use cases
-  are much broader than what we cover.
----
-
-# Use cases
-
-[HashiCorp Vault](/vault/docs/what-is-vault) is an identity-based secrets and encryption management system. Vault validates and authorizes clients (users, machines, apps) before providing them access to secrets or stored sensitive data.
-
-This page describes common Vault use cases and provides related resources that can be used to create Vault configurations and workflows. Please note that not all use cases may be listed.
-
-## General secret storage
-
-As workloads become more and more ephemeral and short-lived, having long-lived static credentials pose a big security threat vector. What if credentials are accidentally leaked, or an employee leaves with their post it notes that contain the AWS access key, or someone checks their S3 access token into a public GH repo?
-With Vault, you can generate short-lived, just-in-time credentials that are automatically revoked when their time expires. This means users and security teams do not have to worry about manually revoking or changing these credentials.
-
-### Static secrets
-
-Credentials can be long-lived and static, where they don't change or are changed infrequently. Vault can store these secrets behind its cryptographic barrier, and clients can request them to use in their applications.
-
-- Refer to the [Versioned Key/Vault Secrets Engine](/vault/tutorials/secrets-management/versioned-kv) tutorial and learn how a versioned key-value secrets engine protects your static secrets.
-
-### Dynamic secrets
-
-The key value with secrets storage is the ability to dynamically generate credentials. These credentials are created when clients need them. Vault can also manage the lifecycle of these credentials, including but not limited to, deleting them after a defined period of time.
-
-- Refer to the [Dynamic Secrets: Database Secrets Engine](/vault/tutorials/db-credentials/database-secrets) tutorial and learn how Vault can dynamically manage your database credentials.
-
-In addition to database credential management, Vault can manage your Active Directory accounts, SSH keys, PKI certificates and more. Visit the [Secrets Management](/vault/tutorials/secrets-management) tutorial series to learn more about secrets management using Vault.
-
-## Data encryption
-
-Many organizations seek solutions to encrypt/decrypt application data within a cloud or multi-datacenter environment; deploying cryptography and maintaining a complex key management infrastructure can be expensive and challenging to develop. Vault provides [encryption as a service](/vault/docs/secrets/transit) with centralized key management to simplify encrypting data in transit and stored across clouds and datacenters. Vault can encrypt/decrypt data stored elsewhere, essentially allowing applications to encrypt their data while storing it in the primary data store. Vault's security team manages and maintains the responsibility of the data encryption within the Vault environment, allowing developers to focus solely on encrypting/decrypting data as needed.
-
-### Resources
-
-- Try our [Encryption as a Service: Transit Secrets Engine](/vault/tutorials/encryption-as-a-service) to learn the essential workings of the Transit secrets engine handles cryptographic functions on data in-transit.
-
-- For more advanced data protection, refer to the [Advanced Data Protection](/vault/tutorials/adp) tutorial series. Vault's Transform secrets engine handles secure data transformation and tokenization against provided input value.
-
-
-## Identity-Based access
-
-Organizations need a way to manage identity sprawl with the proliferation of different clouds, services, and systems- all with their identity providers. The risk of compromising an organization's security infrastructure increases as organizations are forced to manage multiple identity management systems as they try to implement solutions to unify a single logical identity across numerous cloud platforms. Different platforms support different methods and constructs for identity, making it difficult to recognize a user or identity across multiple forms of credentials. Vault solves this challenge by using a unified ACL system to broker access to systems and secrets and merges identities across providers. With [identity-based access](/vault/docs/secrets/identity), organizations can leverage any trusted resource identity to regulate and manage system and application access, and authentication across various clouds, systems, and endpoints.
-
-### Resources
-
-- Try our [Identity: Entities and Groups](/vault/tutorials/auth-methods/identity) tutorial to learn how Vault's unified identity system works.
-
-- Follow the [Policies](/vault/tutorials/policies) tutorial series to learn how Vault enforces role-based access control (RBAC) across multiple cloud environments.
-
-## Key management
-
-Working with cloud providers requires that you use their security features, which involve encryption keys issued and stored by the provider in its own key management system (KMS). You may also have a requirement to maintain root of trust and control of the encryption key lifecycle, both within and outside of the cloud. The [Vault Key Management Secrets Engine](/vault/docs/secrets/key-management) provides a consistent workflow for distribution and lifecycle management of cloud provider keys, allowing organizations to maintain centralized control of their keys in Vault while leveraging the cryptographic capabilities native to the KMS providers.
-
-### Resources
-
-- Try our [Key Management Secrets Engine with Azure Key Vault](/vault/tutorials/adp/key-management-secrets-engine-azure-key-vault) to enable management of the Key Vault key with the Key Management secrets engine.
-
-- Try our [Key Management Secrets Engine with GCP Cloud KMS](/vault/tutorials/adp/key-management-secrets-engine-gcp-cloud-kms) to enable management of the Key Value key with the Key Management secrets engine.
diff --git a/website/content/docs/what-is-vault.mdx b/website/content/docs/what-is-vault.mdx
deleted file mode 100644
index cd618325205..00000000000
--- a/website/content/docs/what-is-vault.mdx
+++ /dev/null
@@ -1,102 +0,0 @@
----
-layout: docs
-page_title: Introduction
-description: >-
-  Welcome to the intro guide to Vault! This guide is the best place to start
-  with Vault. We cover what Vault is, what problems it can solve, how it
-  compares to existing software, and contains a quick start for using Vault.
----
-
-# What is Vault?
-
-HashiCorp Vault is an identity-based secrets and encryption management system. A _secret_ is anything that you want to tightly control access to, such as API encryption keys, passwords, and certificates. Vault provides encryption services that are gated by authentication and authorization methods. Using Vault’s UI, CLI, or HTTP API, access to secrets and other sensitive data can be securely stored and managed, tightly controlled (restricted), and auditable.
-
-If you are already familiar with the basics of Vault, the
-[documentation](/vault/docs) provides a better reference guide for all
-available features as well as internals.
-
-## What is Vault?
-
-HashiCorp Vault is an identity-based secrets and encryption management system.
-It provides encryption services that are gated by authentication and authorization 
-methods to ensure secure, auditable and restricted access to _secrets_. 
-It is used to secure, store and protect secrets and other sensitive data using a UI, CLI, or HTTP API.
-
-A secret is anything that you
-want to tightly control access to, such as tokens, API keys, passwords, encryption keys or certificates.
-Vault provides a unified interface to any secret, while providing tight access
-control and recording a detailed audit log.
-
-API keys for external services, credentials for service-oriented architecture
-communication, etc. It can be difficult to understand who is accessing which secrets, especially since this can be platform-specific. Adding on key rolling, secure storage, and
-detailed audit logs is almost impossible without a custom solution. This is
-where Vault steps in.
-
-Vault validates and authorizes clients (users, machines, apps) before providing them access to secrets or stored sensitive data.
-
-![How Vault Works](/img/how-vault-works.png)
-
-### How does Vault work?
-
-Vault works primarily with tokens and a token is associated to the client's policy. Each policy is path-based and policy rules constrains the actions and accessibility to the paths for each client. With Vault, you can create tokens manually and assign them to your clients, or the clients can log in and obtain a token. The illustration below displays Vault's core workflow.
-
-![Vault Workflow](/img/vault-workflow-diagram1.png)
-
- The core Vault workflow consists of four stages:
-
-* **Authenticate:** Authentication in Vault is the process by which a client supplies information that Vault uses to determine if they are who they say they are. Once the client is authenticated against an auth method, a token is generated and associated to a policy.
-* **Validation:** Vault validates the client against third-party trusted sources, such as Github, LDAP, AppRole, and more.
-* **Authorize**: A client is matched against the Vault security policy.  This policy is a set of rules defining which API endpoints a client has access to with its Vault token. Policies provide a declarative way to grant or forbid access to certain paths and operations in Vault.
-* **Access**: Vault grants access to secrets, keys, and encryption capabilities by issuing a token based on policies associated with the client’s identity. The client can then use their Vault token for future operations.
-
-### Why Vault?
-
-Most enterprises today have credentials sprawled across their organizations. Passwords, API keys, and credentials are stored in plain text, app source code, config files, and other locations. Because these credentials live everywhere, the sprawl can make it difficult and daunting to really know who has access and authorization to what. Having credentials in plain text also increases the potential for malicious attacks, both by internal and external attackers.
-
-Vault was designed with these challenges in mind. Vault takes all of these credentials and centralizes them so that they are defined in one location, which reduces unwanted exposure to credentials. But Vault takes it a few steps further by making sure users, apps, and systems are authenticated and explicitly authorized to access resources, while also providing an audit trail that captures and preserves a history of clients' actions.
-
-The key features of Vault are:
-
-- **Secure Secret Storage**: Arbitrary key/value secrets can be stored
-  in Vault. Vault encrypts these secrets prior to writing them to persistent
-  storage, so gaining access to the raw storage isn't enough to access
-  your secrets. Vault can write to disk, [Consul](https://www.consul.io/),
-  and more.
-
-- **Dynamic Secrets**: Vault can generate secrets on-demand for some
-  systems, such as AWS or SQL databases. For example, when an application
-  needs to access an S3 bucket, it asks Vault for credentials, and Vault
-  will generate an AWS keypair with valid permissions on demand. After
-  creating these dynamic secrets, Vault will also automatically revoke them
-  after the lease is up.
-
-- **Data Encryption**: Vault can encrypt and decrypt data without storing
-  it. This allows security teams to define encryption parameters and
-  developers to store encrypted data in a location such as a SQL database
-  without having to design their own encryption methods.
-
-- **Leasing and Renewal**: All secrets in Vault have a _lease_ associated
-  with them. At the end of the lease, Vault will automatically revoke that
-  secret. Clients are able to renew leases via built-in renew APIs.
-
-- **Revocation**: Vault has built-in support for secret revocation. Vault
-  can revoke not only single secrets, but a tree of secrets, for example
-  all secrets read by a specific user, or all secrets of a particular type.
-  Revocation assists in key rolling as well as locking down systems in the
-  case of an intrusion.
-
--> **Tip**: Learn more about Vault [use cases](/vault/docs/use-cases).
-
-### What is HCP Vault?
-
-HashiCorp Cloud Platform (HCP) Vault is a hosted version of Vault, which is operated by HashiCorp to allow organizations to get up and running quickly. HCP Vault uses the same binary as self-hosted Vault, which means you will have a consistent user experience. You can use the same Vault clients to communicate with HCP Vault as you use to communicate with a self-hosted Vault. Refer to the [HCP Vault](/hcp/docs/vault) documentation to learn more.
-
--> **Hands On:** Try the [Get started](/vault/tutorials/cloud) tutorials to set up a managed Vault cluster.
-
-### Community
-
-We welcome questions, suggestions, and contributions from the community.
-
-* Ask questions in [HashiCorp Discuss](https://discuss.hashicorp.com/c/vault/30).
-* Read our [contributing guide](https://github.com/hashicorp/vault/blob/main/CONTRIBUTING.md).
-* [Submit an issue](https://github.com/hashicorp/vault/issues/new/choose) for bugs and feature requests.
diff --git a/website/content/partials/ad-secrets-deprecation.mdx b/website/content/partials/ad-secrets-deprecation.mdx
deleted file mode 100644
index 85732c38350..00000000000
--- a/website/content/partials/ad-secrets-deprecation.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-~> **Note**: The Active Directory (AD) secrets engine has been deprecated as of the Vault
-1.13 release. We will continue to support the AD secrets engine in maintenance mode for
-six major Vault releases. Maintenance mode means that we will fix bugs and security issues
-but will not add new features. For additional information, see the [deprecation table](/vault/docs/deprecation)
-and [migration guide](/vault/docs/secrets/ad/migration-guide).
diff --git a/website/content/partials/alerts/auditor-deprecated.mdx b/website/content/partials/alerts/auditor-deprecated.mdx
deleted file mode 100644
index 17efb708a4a..00000000000
--- a/website/content/partials/alerts/auditor-deprecated.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-<Warning heading="Vault auditor tool deprecated as of March 2022">
-  You can still download the Vault auditor, but we no longer actively support
-  the tool. We strongly encourage <a href="/vault/docs/upgrading">upgrading</a> to
-  an actively supported version of Vault. 
-</Warning>
\ No newline at end of file
diff --git a/website/content/partials/alerts/beta.mdx b/website/content/partials/alerts/beta.mdx
deleted file mode 100644
index 9075f50bca9..00000000000
--- a/website/content/partials/alerts/beta.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
-<Note title="Beta feature">
-
-  Beta functionality is stable but possibly incomplete and subject to change.
-  **We strongly discourage using beta features in production deployments of Vault**
-
-</Note>
\ No newline at end of file
diff --git a/website/content/partials/alerts/enterprise-and-hcp-use.mdx b/website/content/partials/alerts/enterprise-and-hcp-use.mdx
deleted file mode 100644
index 29dc239a7b9..00000000000
--- a/website/content/partials/alerts/enterprise-and-hcp-use.mdx
+++ /dev/null
@@ -1,12 +0,0 @@
-<EnterpriseAlert product="vault">
-  
-  Requires a <a href="https://www.hashicorp.com/products/vault/pricing">
-    Vault Enterprise
-  </a> license to <b>configure</b>.
-  <br /><br />
-  Requires a <a href="https://www.hashicorp.com/products/vault/pricing">
-    Vault Enterprise
-  </a> license or <a href="/hcp/docs/vault/tiers-and-features">
-    HCP Vault
-  </a> cluster to <b>use</b>. 
-</EnterpriseAlert>
\ No newline at end of file
diff --git a/website/content/partials/alerts/enterprise-and-hcp.mdx b/website/content/partials/alerts/enterprise-and-hcp.mdx
deleted file mode 100644
index 78374554d92..00000000000
--- a/website/content/partials/alerts/enterprise-and-hcp.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-<EnterpriseAlert product="vault">
-  <a href="https://www.hashicorp.com/products/vault/pricing">
-    Vault Enterprise
-  </a> license or <a href="/hcp/docs/vault/tiers-and-features">
-    HCP Vault
-  </a> cluster required. 
-</EnterpriseAlert>
\ No newline at end of file
diff --git a/website/content/partials/alerts/enterprise-only.mdx b/website/content/partials/alerts/enterprise-only.mdx
deleted file mode 100644
index 4553be74c6b..00000000000
--- a/website/content/partials/alerts/enterprise-only.mdx
+++ /dev/null
@@ -1,4 +0,0 @@
-<EnterpriseAlert product="vault">
-  <a href="https://www.hashicorp.com/products/vault/pricing">Vault Enterprise</a>
-  &nbsp; license required
-</EnterpriseAlert>
\ No newline at end of file
diff --git a/website/content/partials/alerts/rc-alert.mdx b/website/content/partials/alerts/rc-alert.mdx
deleted file mode 100644
index cac2771c437..00000000000
--- a/website/content/partials/alerts/rc-alert.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-<Warning title="YOU ARE READING PREVEIW CONTENT FOR A FUTURE VERSION OF VAULT">
-
-The information you are reading is subject to change and should not be
-referenced as official guidance until the associated release is generally
-available.
-
-</Warning>
\ No newline at end of file
diff --git a/website/content/partials/alerts/restricted-admin.mdx b/website/content/partials/alerts/restricted-admin.mdx
deleted file mode 100644
index 38dd3c05367..00000000000
--- a/website/content/partials/alerts/restricted-admin.mdx
+++ /dev/null
@@ -1,3 +0,0 @@
-<Note title="Restricted endpoint">
-  The API path can only be called from the root or administrative namespace.
-</Note>
diff --git a/website/content/partials/alerts/restricted-root.mdx b/website/content/partials/alerts/restricted-root.mdx
deleted file mode 100644
index 82980023420..00000000000
--- a/website/content/partials/alerts/restricted-root.mdx
+++ /dev/null
@@ -1,3 +0,0 @@
-<Note title="Restricted endpoint">
-  The API path can only be called from the root namespace.
-</Note>
diff --git a/website/content/partials/alpine-314.mdx b/website/content/partials/alpine-314.mdx
deleted file mode 100644
index e2c1f87ad90..00000000000
--- a/website/content/partials/alpine-314.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-## Alpine 3.14
-
-Docker images for Vault 1.6.6+, 1.7.4+, and 1.8.2+ are built with Alpine 3.14,
-due to a security issue in Alpine 3.13 (CVE-2021-36159).
-Some users on older versions of Docker may run into issues with these images.
-See the following for more details:
-
-- https://wiki.alpinelinux.org/wiki/Release_Notes_for_Alpine_3.14.0#faccessat2
-- https://about.gitlab.com/blog/2021/08/26/its-time-to-upgrade-docker-engine/
diff --git a/website/content/partials/api/restricted-endpoints.mdx b/website/content/partials/api/restricted-endpoints.mdx
deleted file mode 100644
index 1e94d400a8f..00000000000
--- a/website/content/partials/api/restricted-endpoints.mdx
+++ /dev/null
@@ -1,63 +0,0 @@
-<a id="privileged-endpoints" />
-
-<Note>
-  The CLI commands associated with restricted API paths are also restricted.
-</Note>
-
-API path                                    | Root | Admin
-------------------------------------------- | ---- | -----
-`sys/audit`                                 | YES  | NO
-`sys/audit-hash`                            | YES  | YES
-`sys/config/auditing/*`                     | YES  | NO
-`sys/config/cors`                           | YES  | NO
-`sys/config/group-policy-application`       | YES  | NO
-`sys/config/reload`                         | YES  | NO
-`sys/config/state`                          | YES  | NO
-`sys/config/ui`                             | YES  | NO
-`sys/decode-token`                          | YES  | NO
-`sys/experiments`                           | YES  | NO
-`sys/generate-recovery-token`               | YES  | NO
-`sys/generate-root`                         | YES  | NO
-`sys/health`                                | YES  | NO
-`sys/host-info`                             | YES  | NO
-`sys/in-flight-req`                         | YES  | NO
-`sys/init`                                  | YES  | NO
-`sys/internal/counters/activity`            | YES  | NO
-`sys/internal/counters/activity/export`     | YES  | NO
-`sys/internal/counters/activity/monthly`    | YES  | NO
-`sys/internal/counters/config`              | YES  | NO
-`sys/internal/inspect/router/*`             | YES  | NO
-`sys/key-status`                            | YES  | NO
-`sys/loggers`                               | YES  | NO
-`sys/managed-keys/*`                        | YES  | NO
-`sys/metrics`                               | YES  | NO
-`sys/mfa/method/*`                          | YES  | NO
-`sys/monitor`                               | YES  | YES
-`sys/pprof/*`                               | YES  | NO
-`sys/quotas/config`                         | YES  | YES
-`sys/quotas/lease-count`                    | YES  | YES
-`sys/quotas/rate-limit`                     | YES  | YES
-`sys/raw`                                   | YES  | NO
-`sys/rekey/*`                               | YES  | NO
-`sys/rekey-recovery-key`                    | YES  | NO
-`/sys/replication/dr/primary/*`             | YES  | NO
-`/sys/replication/dr/secondary/*`           | YES  | NO
-`/sys/replication/performance/primary/*`    | YES  | NO
-`/sys/replication/performance/secondary/*`  | YES  | NO
-`sys/replication/recover`                   | YES  | NO
-`sys/replication/reindex`                   | YES  | NO
-`sys/replication/status`                    | YES  | NO
-`sys/replication/merkle-check`              | YES  | NO
-`sys/rotate/config`                         | YES  | NO
-`sys/rotate`                                | YES  | NO
-`sys/seal`                                  | YES  | NO
-`sys/sealwrap/rewrap`                       | YES  | NO
-`sys/step-down`                             | YES  | NO
-`sys/storage`                               | YES  | NO
-`sys/unseal`                                | YES  | NO
-
-Privileged CLI commands without public API endpoints:
-
-CLI command             | Root | Admin
------------------------ | ---- | -----
-`vault plugin runtime`  | YES  | NO
diff --git a/website/content/partials/application-of-sentinel-rgps-via-identity-groups.mdx b/website/content/partials/application-of-sentinel-rgps-via-identity-groups.mdx
deleted file mode 100644
index 881c03d52fe..00000000000
--- a/website/content/partials/application-of-sentinel-rgps-via-identity-groups.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-As of versions `1.15.0`, `1.14.4`, and `1.13.8`, [the Sentinel RGPSs derived from membership in identity groups apply
-only to entities in the same and child namespaces, relative to the identity group](/vault/docs/enterprise/sentinel#rgps-and-namespaces).
-
-Also, the [`group_policy_application_mode`](/vault/api-docs/system/config-group-policy-application) only applies to
-to ACL policies. Vault Sentinel Role Governing Policies (RGPs) are not affected by group policy application mode.
diff --git a/website/content/partials/audit-options-common.mdx b/website/content/partials/audit-options-common.mdx
deleted file mode 100644
index 119b0c43b3d..00000000000
--- a/website/content/partials/audit-options-common.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
-- `elide_list_responses` `(bool: false)` - See [Eliding list response
-bodies](/vault/docs/audit#eliding-list-response-bodies).
-
-- `fallback` `(bool: false)` - Indicates whether the audit device is the
-fallback for filtering purposes. **Vault only supports one fallback audit
-device at a time**.
-
-- `filter` `(string: "")` - Sets an optional string used to filter the audit
-entries logged by the audit device.  See the [filtering](/vault/docs/concepts/filtering/audit)
-section of the auditing overview for more information.
-
-- `format` `(string: "json")` - Allows selecting the output format. Valid values
-are `"json"` and `"jsonx"`, which formats the normal log entries as XML.
-
-- `hmac_accessor` `(bool: true)` - If enabled, enables the hashing of token
-accessor.
-
-- `log_raw` `(bool: false)` - If enabled, logs the security sensitive
-information without hashing, in the raw format.
-
-- `prefix` `(string: "")` - A customizable string prefix to write before the
-actual log line.
diff --git a/website/content/partials/authn-names.mdx b/website/content/partials/authn-names.mdx
deleted file mode 100644
index 43e589b93c7..00000000000
--- a/website/content/partials/authn-names.mdx
+++ /dev/null
@@ -1,24 +0,0 @@
-In addition to custom authentication methods configured with secure plugins,
-Vault supports many standardized authentication methods by default.
-
-| AuthN method                                                            | Unique ID                                    | Configured with  |
-|-------------------------------------------------------------------------|----------------------------------------------|------------------|
-| [AliCloud](/vault/docs/auth/alicloud)                                   | Principal ID                                 | Not configurable |
-| [AppRole](/vault/api-docs/auth/approle#create-update-approle)           | Role ID                                      | Not configurable |
-| [AWS IAM](/vault/docs/auth/aws#iam-auth-method)                         | Role ID (default), IAM unique ID, Full ARN   | `iam_alias`      |
-| [AWS EC2](/vault/docs/auth/aws#ec2-auth-method)                         | Role ID (default), EC2 instance ID, AMI ID   | `ec2_alias`      |
-| [Azure](/vault/api-docs/auth/azure#create-role)                         | Subject (from JWT claim)                     | Not configurable |
-| [Cloud Foundry](/vault/docs/auth/cf)                                    | App ID                                       | Not configurable |
-| [GitHub](/vault/docs/auth/github)                                       | User login name associated with token        | Not configurable |
-| [Google Cloud](/vault/api-docs/auth/gcp#create-role)                    | Role ID (default), Service account unique ID | `iam_alias`      |
-| [JWT/OIDC](/vault/api-docs/auth/jwt#create-role)                        | The presented claims (no default value)      | `user_claim`     |
-| [Kerberos](/vault/docs/auth/kerberos)                                   | Username                                     | Not configurable |
-| [Kubernetes](/vault/api-docs/auth/kubernetes#create-role)               | Service account UID                          | Not configurable |
-| [LDAP](/vault/docs/auth/ldap)                                           | Username                                     | Not configurable |
-| [OCI](/vault/api-docs/auth/oci#create-role)                             | Rolename                                     | Not configurable |
-| [Okta](/vault/api-docs/auth/okta#register-user)                         | Username                                     | Not configurable |
-| [RADIUS](/vault/docs/auth/radius)                                       | Username                                     | Not configurable |
-| [SAML](/vault/docs/auth/saml)                                           | Assertion Subject                            | Not configurable |
-| [TLS Certificate](/vault/api-docs/auth/cert#create-ca-certificate-role) | Subject CommonName                           | Not configurable |
-| [Token](/vault/docs/auth/token)                                         | `entity_alias`                               | Not configurable |
-| [Username/Password](/vault/api-docs/auth/userpass#create-update-user)   | Username                                     | Not configurable |
diff --git a/website/content/partials/aws-auth-metadata-fix.mdx b/website/content/partials/aws-auth-metadata-fix.mdx
deleted file mode 100644
index 9035bb37e73..00000000000
--- a/website/content/partials/aws-auth-metadata-fix.mdx
+++ /dev/null
@@ -1,35 +0,0 @@
-## The AWS auth engine
-
-Users of the AWS Auth Engine may notice less metadata in their audit logs
-and associated with the aliases generated by logging in. This is because
-we corrected a regression where more metadata had been added by default,
-causing a performance impact for some users at scale.
-
-Now, in the `/auth/aws/config/identity` endpoint, we have added the following fields:
-
-- `iam_metadata` `(string: "default")` - The metadata to include on the token
-  returned by the `login` endpoint. This metadata will be added to both audit logs,
-  and on the `iam_alias`. By default, it includes `account_id` and `auth_type`.
-  Additionally, `canonical_arn`, `client_arn`, `client_user_id`, `inferred_aws_region`,
-  `inferred_entity_id`, and `inferred_entity_type` are available. To include no metadata,
-  set to `""` via the CLI or `[]` via the API. To use only particular fields, select
-  the explicit fields. To restore to defaults, send only a field of `default`.
-  **Only select fields that will have a low rate of change** for your `iam_alias` because
-  each change triggers a storage write and can have a performance impact at scale.
-- `ec2_metadata` `(string: "default")` - The metadata to include on the token
-  returned by the `login` endpoint. This metadata will be added to both audit logs,
-  and on the `ec2_alias`. By default, it includes `account_id` and `auth_type`.
-  Additionally, `ami_id`, `instance_id`, and `region`, are available. To include no metadata,
-  set to `""` via the CLI or `[]` via the API. To use only particular fields, select
-  the explicit fields. To restore to defaults, send only a field of `default`.
-  **Only select fields that will have a low rate of change** for your `ec2_alias` because
-  each change triggers a storage write and can have a performance impact at scale.
-
-At the `/auth/aws/config/identity` endpoint, if the `iam_alias` and `ec2_alias` are unset,
-the `role_id` used for login is the default alias used for auth metadata. Thus, the defaults
-selected for the `iam_metadata` and `ec2_metadata` are fields that would have a low rate of
-change for _those_ aliases.
-
-This was selected because it will cover _most_ use cases. However, the AWS Auth Engine
-has many use cases, so please do configure the aliases and metadata that makes sense for
-your organization.
diff --git a/website/content/partials/aws-auth-metadata-issue.mdx b/website/content/partials/aws-auth-metadata-issue.mdx
deleted file mode 100644
index b97d9134f07..00000000000
--- a/website/content/partials/aws-auth-metadata-issue.mdx
+++ /dev/null
@@ -1,51 +0,0 @@
-## The AWS auth engine
-
-Users of the AWS Auth Engine should be cautious with this upgrade, because in
-1.3.2 we began adding metadata to tokens issued with this method. While the
-metadata does help with tying tokens to a particular person or machine, it
-also can also take a performance toll.
-
-Whether there's a performance toll depends on if and how you've configured the
-`auth/aws/config/identity` endpoint. To determine if you could be effected:
-
-- Read your identity configuration: `$ vault read auth/aws/config/identity`
-- Determine what Vault is using for identity (`role_id` if unconfigured)
-- Determine what role type(s) you're using (`iam` and/or `ec2`)
-- Consider the rate of change of the metadata fields for each role type
-
-Metadata fields for `iam` roles:
-
-- `client_arn`
-- `canonical_arn`
-- `client_user_id`
-- `auth_type`
-- `inferred_entity_type`
-- `inferred_entity_id`
-- `inferred_aws_region`
-- `account_id`
-
-Metadata fields for `ec2` roles:
-
-- `instance_id`
-- `region`
-- `account_id`
-- `ami_id`
-
-For example, if you use `role_id` for identity and only `iam` roles, and
-_many_ machines use the same role, you would conclude that the `client_arn`
-for the machines logging in would have a high rate of change, and so you'd
-see a new storage write each time a new machine logged in under that role.
-
-If you use `role_id` for identity and only `iam` roles, and
-and only _one_ long-lived machine used the role, you would conclude that the
-`client_arn` for the machines logging in would have a low rate of change.
-Unless you added the optional "role-session" to its ARN, in which case you
-could still have a higher rate of change.
-
-However, if you had configured identity to use an `iam_alias` of the `full_arn`,
-or an `ec2_alias` of `instance_id`, you would be likely to see a lower rate of
-change for all fields.
-
-For users seeing a performance issue, we recommend implementing one of the
-aliases above, or waiting until a patch is released providing greater
-flexibility around whether to use this functionality.
diff --git a/website/content/partials/aws-imds-timeout-upgrade.mdx b/website/content/partials/aws-imds-timeout-upgrade.mdx
deleted file mode 100644
index 77aac7c06ff..00000000000
--- a/website/content/partials/aws-imds-timeout-upgrade.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-## AWS instance metadata timeout
-
-In 1.4.0 Vault started using an updated AWS Go SDK which had support for v2 of
-the [EC2 instance metadata service][aws-ec2-imdsv2]. However, due to the way the
-SDK was configured in Vault, there can be a delay of around 2 minutes when Vault
-relies on the instance metadata service for credentials. A fix that reduces the
-delay went into 1.5.5: [#10133](https://github.com/hashicorp/vault/pull/10133).
-
-[aws-ec2-imdsv2]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
diff --git a/website/content/partials/aws-imds-timeout.mdx b/website/content/partials/aws-imds-timeout.mdx
deleted file mode 100644
index f4d3bb1f97d..00000000000
--- a/website/content/partials/aws-imds-timeout.mdx
+++ /dev/null
@@ -1,24 +0,0 @@
-~> Affects Vault 1.4 and later
-
-Anytime Vault uses the [instance metadata service][aws-ec2-mds] on an EC2
-instance, such as for getting credentials from the instance profile, there may
-be a delay with the introduction of [v2 of the instance metadata service
-(IMDSv2)][aws-ec2-imdsv2]. The AWS SDK used by Vault first attempts to connect
-to IMDSv2, and if that times out, it falls back to v1. In Vault 1.4, this
-timeout can take up to 2 minutes. In Vault 1.5.5 and later, it can take up to 2
-seconds with this fix: [#10133](https://github.com/hashicorp/vault/pull/10133).
-
-The timeout occurs in situations where there is a proxy between Vault and
-IMDSv2, and the instance hop limit is set to less than the number of "hops"
-between Vault and IMDSv2. For example, if Vault is running in docker on an EC2
-instance with the instance hop limit set to 1, the AWS SDK client will attempt
-to connect to IMDSv2, timeout, and fall back to IMDSv1 because of the extra
-network hop between docker and IMDS.
-
-To avoid the timeout behavior, the hop limit may be [adjusted on the underlying
-EC2 instances][aws-ec2-imdsv2-config]. With the docker example, setting the hop
-limit to 2 will allow the AWS SDK in Vault to connect to IMDSv2 without delay.
-
-[aws-ec2-mds]: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
-[aws-ec2-imdsv2]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
-[aws-ec2-imdsv2-config]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html#configuring-instance-metadata-options
diff --git a/website/content/partials/aws-invalid-header-fix.mdx b/website/content/partials/aws-invalid-header-fix.mdx
deleted file mode 100644
index 88352c8e1b0..00000000000
--- a/website/content/partials/aws-invalid-header-fix.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-## AWS IAM authentication fixed
-
-The security updates added in Vault 1.5.1, 1.4.4, 1.3.8, and 1.2.5 included additional header
-checking during AWS IAM authentication that caused issues for some users. A workaround was
-subsequently provided by setting `allowed_sts_header_values`.
-
-The underlying issue has been corrected in 1.5.3, 1.4.6, 1.3.10 and 1.2.7, and setting
-`allowed_sts_header_values` is no longer needed. If that parameter has been set, it will not conflict
-with the fixed versions. It may be unset when convenient, or simply left as is.
diff --git a/website/content/partials/aws-invalid-header.mdx b/website/content/partials/aws-invalid-header.mdx
deleted file mode 100644
index 9e2f5aa789d..00000000000
--- a/website/content/partials/aws-invalid-header.mdx
+++ /dev/null
@@ -1,25 +0,0 @@
-### AWS IAM authentication
-
-The security updates added in Vault 1.5.1, 1.4.4, 1.3.8, and 1.2.5 include additional header checking
-during AWS IAM authentication. The default list of allowed headers doesn't include some that are
-commonly present, which may result in a login error of the form:
-
-```
-Cannot login using AWS-IAM: invalid request header: X-Amz-Security-Token
-```
-
-This issue affects 1.5.2, 1.4.5, 1.3.9, and 1.2.6 as well. It has been corrected in 1.5.3, 1.4.6,
-1.3.10 and 1.2.7. The affected released versions can work around the issue by manually configuring
-the allowed header list, including all needed headers. A recommended configuration is shown below:
-
-```
-vault write auth/aws/config/client \
-   allowed_sts_header_values="Content-Type" \
-   allowed_sts_header_values="Content-Length" \
-   allowed_sts_header_values="User-Agent" \
-   allowed_sts_header_values="X-Amz-Date" \
-   allowed_sts_header_values="Authorization" \
-   allowed_sts_header_values="X-Amz-Security-Token" \
-   allowed_sts_header_values="Host" \
-   allowed_sts_header_values="X-Vault-Aws-Iam-Server-Id"
-```
diff --git a/website/content/partials/aws-sha1-deprecation.mdx b/website/content/partials/aws-sha1-deprecation.mdx
deleted file mode 100644
index fb05450db63..00000000000
--- a/website/content/partials/aws-sha1-deprecation.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-~> **Note**: Starting in Vault 1.12, only the `pkcs7` login flow with the AWS
-   [`/rsa2048` signature endpoint](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-rsa2048.html)
-   credentials will work by default due to the deprecation of SHA-1-based signatures.
-   Please see [the deprecation FAQ](/vault/docs/deprecation/faq#q-what-is-the-impact-of-removing-support-for-x-509-certificates-with-signatures-that-use-sha-1)
-   for more details and a workaround.
diff --git a/website/content/partials/aws-sts-issue.mdx b/website/content/partials/aws-sts-issue.mdx
deleted file mode 100644
index 196d9dd5ca1..00000000000
--- a/website/content/partials/aws-sts-issue.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-## The AWS STS region selection
-
-The AWS Client used in Vault was updated for improved STS performance in
-1.3.2 and 1.4.0 [#8161](https://github.com/hashicorp/vault/pull/8161),
-however this introduced a side effect of limiting the regions being selected for validation
-and a greater possibility of encountering an "invalid security token" error.
-
-Users of the AWS auth engine should upgrade to 1.4.1 release instead,
-where this side effect was fixed in [#8679](https://github.com/hashicorp/vault/pull/8679).
diff --git a/website/content/partials/builds-without-ui.mdx b/website/content/partials/builds-without-ui.mdx
deleted file mode 100644
index 3b5c0434d2e..00000000000
--- a/website/content/partials/builds-without-ui.mdx
+++ /dev/null
@@ -1,4 +0,0 @@
-### Core binaries lacking Vault UI
-
-Core binaries of Vault 1.5.1, 1.4.4, 1.3.8, and 1.2.5 were built without the
-Vault UI. Enterprise binaries are not affected.
diff --git a/website/content/partials/consul-dataplane-compat.mdx b/website/content/partials/consul-dataplane-compat.mdx
deleted file mode 100644
index e9a71997e84..00000000000
--- a/website/content/partials/consul-dataplane-compat.mdx
+++ /dev/null
@@ -1 +0,0 @@
-~> **Compatibility information:** As of Consul 1.14.0, Consul on Kubernetes uses [Consul Dataplane](/consul/docs/connect/dataplane) by default instead of client agents. Vault does not currently support Consul Dataplane. Please follow the Consul 1.14.0 [upgrade guide](/consul/docs/k8s/upgrade#upgrading-to-consul-dataplane) to ensure that your Consul on Kubernetes deployment continues to use client agents.
diff --git a/website/content/partials/consul-dataplane-upgrade-note.mdx b/website/content/partials/consul-dataplane-upgrade-note.mdx
deleted file mode 100644
index 5fb5d332b45..00000000000
--- a/website/content/partials/consul-dataplane-upgrade-note.mdx
+++ /dev/null
@@ -1,2 +0,0 @@
-### Consul dataplane compatibility
-If you are using Consul on Kubernetes, please be aware that upgrading to Consul 1.14.0 will impact Consul [secrets](/vault/docs/secrets/consul), [storage](/vault/docs/configuration/storage/consul), and [service registration](/vault/docs/configuration/service-registration/consul). As of Consul 1.14.0, Consul on Kubernetes uses [Consul Dataplane](/consul/docs/connect/dataplane) by default instead of client agents. Vault does not currently support Consul Dataplane. Please follow the Consul 1.14.0 [upgrade guide](/consul/docs/k8s/upgrade#upgrading-to-consul-dataplane) to ensure that your Consul on Kubernetes deployment continues to use client agents.
diff --git a/website/content/partials/content-footer-title.mdx b/website/content/partials/content-footer-title.mdx
deleted file mode 100644
index 3d6620a1a90..00000000000
--- a/website/content/partials/content-footer-title.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-<br />
-<table style={{borderTop: "1px dashed var(--token-color-vault-foreground)"}}><tbody><tr>
-<th style={{textAlign: "left", fontSize: "var(--token-typography-display-300-font-size)"}}>
-  <br />
-  Continue reading...
-</th>
-</tr></tbody></table>
\ No newline at end of file
diff --git a/website/content/partials/db-secrets-credential-types.mdx b/website/content/partials/db-secrets-credential-types.mdx
deleted file mode 100644
index 9caffe89e05..00000000000
--- a/website/content/partials/db-secrets-credential-types.mdx
+++ /dev/null
@@ -1,33 +0,0 @@
-- `credential_type` `(string: "password")` – Specifies the type of credential that
-  will be generated for the role. Options include: `password`, `rsa_private_key`, `client_certificate`.
-  See the plugin's API page for credential types supported by individual databases.
-
-- `credential_config` `(map<string|string>: <optional>)` – Specifies the configuration
-  for the given `credential_type`.
-
-  The following options are available for each `credential_type` value:
-
-  - `password`
-    - `password_policy` `(string: <optional>)` - The [policy](/vault/docs/concepts/password-policies)
-      used for password generation. If not provided, defaults to the password policy of the
-      database [configuration](/vault/api-docs/secret/databases#password_policy).
-
-  - `rsa_private_key`
-    - `key_bits` `(int: 2048)` - The bit size of the RSA key to generate. Options include:
-      `2048`, `3072`, `4096`.
-    - `format` `(string: "pkcs8")` - The output format of the generated private key
-      credential. The private key will be returned from the API in PEM encoding. Options
-      include: `pkcs8`.
-
-  - `client_certificate`
-    - `common_name_template` `(string: "")` - A [username template](/vault/docs/concepts/username-templating)
-       to be used for the client certificate common name.
-    - `ca_cert` `(string: "")` - The PEM-encoded CA certificate.
-    - `ca_private_key` `(string: "")` - The PEM-encoded private key for the given `ca_cert`.
-    - `key_type` `(string: <required>)` - Specifies the desired key type. Options include:
-      `rsa`, `ed25519`, `ec`.
-    - `key_bits` `(int: 2048)` - Number of bits to use for the generated keys. Options include:
-      `2048` (default), `3072`, `4096`; with `key_type=ec`, allowed values are: `224`, `256` (default),
-      `384`, `521`; ignored with `key_type=ed25519`.
-    - `signature_bits` `(int: 256)` - The number of bits to use in the signature algorithm. Options include:
-      `256` (default), `384`, `512`.
diff --git a/website/content/partials/ent-supported-storage.mdx b/website/content/partials/ent-supported-storage.mdx
deleted file mode 100644
index aa6fd898f38..00000000000
--- a/website/content/partials/ent-supported-storage.mdx
+++ /dev/null
@@ -1,4 +0,0 @@
-For enterprise customers, HashiCorp provides official support for Vault's Integrated Storage and Consul as storage backends. Vault Enterprise customers are strongly
-recommended to use these supported storage backends for best outcomes. Version 1.12.0 of Vault Enterprise will not start if configured to use a storage backend
-other than Integrated Storage or Consul. This was meant to protect against issues caused by using unsupported backends that do not support transactional storage.
-Version 1.12.2 modified this behavior to instead log a warning when unsupported storage backends are used, while ensuring that Vault will start.
diff --git a/website/content/partials/enterprise-licenses.mdx b/website/content/partials/enterprise-licenses.mdx
deleted file mode 100644
index b4ab6a9b185..00000000000
--- a/website/content/partials/enterprise-licenses.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
-### Enterprise licenses
-
-In versions 1.2.6, 1.3.9, 1.4.5, and 1.5.2, the enterprise licenses were not incorporated correctly
-into the build and we have issued patch releases (x.y.z.1) for enterprise customers containing the
-proper license. As the previous builds were both not working and causing confusion, we have removed
-the binaries.
diff --git a/website/content/partials/entity-alias-mapping.mdx b/website/content/partials/entity-alias-mapping.mdx
deleted file mode 100644
index 650a8fe234e..00000000000
--- a/website/content/partials/entity-alias-mapping.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-## Entity alias mapping
-
-Previously, an entity in Vault could be mapped to multiple entity aliases on the same authentication backend. This
-led to a potential security vulnerability (CVE-2021-43998), as ACL policies templated with alias information would match the first
-alias created. Thus, tokens created from all aliases of the entity, will have access to the paths containing alias 
-metadata of the first alias due to templated policies being incorrectly applied. As a result, the mapping behavior was updated 
-such that an entity can only have one alias per authentication backend. This change exists in Vault 1.9.0+, 1.8.5+ and 1.7.6+.
\ No newline at end of file
diff --git a/website/content/partials/faq/client-count/computing-clients.mdx b/website/content/partials/faq/client-count/computing-clients.mdx
deleted file mode 100644
index c5b267e95b1..00000000000
--- a/website/content/partials/faq/client-count/computing-clients.mdx
+++ /dev/null
@@ -1,90 +0,0 @@
-### Can I compute clients for Vault versions before v1.6? ((#before-1-6))
-
-@include 'alerts/auditor-deprecated.mdx'
-
-**Yes**.
-
-Use the [Vault auditor tool](/vault/tutorials/monitoring/usage-metrics#vault-auditor-tool)
-to compute and display client count data for Vault v1.3 &ndash; v1.5 using the
-client compute logic available in Vault 1.7. Auditor use with Vault versions
-older than 1.3 is untested.
-
-### Can I compute KMIP clients for Vault? ((#kmip))
-
-**No**.
-
-Currently, KMIP clients are not available via the usage metrics UI or client
-count API.
-
-### Can I get monthly changes for Vault versions older than v1.10? ((#month-to-month))
-
-**Yes, for Vault v1.8 &ndash; v1.10.**
-
-To calculate client counts for a given month, you must perform a series of
-billing period updates in the UI and manual calculations:
-
-Month     | Billing period in UI     | Result       | Computation
---------- | ------------------------ | ------------ | -----------
-January   | January                  | `JAN`        | None
-February  | January &nbsp; February  | `JAN_FEB`    | `FEB = JAN_FEB - JAN` 
-March     | January &nbsp; February  | `JAN_MAR`    | `MAR = JAN_MAR - JAN_FEB` 
-April     | January &nbsp; February  | `JAN_APR`    | `APR = JAN_APR - JAN_MAR` 
-May       | January &nbsp; February  | `JAN_MAY`    | `MAY = JAN_MAY - JAN_APR` 
-June      | January &nbsp; February  | `JAN_JUN`    | `JUN = JAN_JUN - JAN_MAY` 
-July      | January &nbsp; February  | `JAN_JUL`    | `JUL = JAN_JUL - JAN_JUN` 
-August    | January &nbsp; February  | `JAN_AUG`    | `AUG = JAN_AUG - JAN_JUL` 
-September | January &nbsp; September | `JAN_SEP`    | `SEP = JAN_SEP - JAN_AUG` 
-October   | January &nbsp; February  | `JAN_OCT`    | `OCT = JAN_OCT - JAN_SEP` 
-November  | January &nbsp; February  | `JAN_NOV`    | `NOV = JAN_NOV - JAN_OCT` 
-December  | January &nbsp; February  | `JAN_DEV`    | `DEC = JAN_DEC - JAN_NOV` 
-
-### Do child namespaces create duplication in the client count? ((#namespace-dupes))
-
-**Maybe**.
-
-Tokens created in a parent namespace are recognized as the same client when used
-in a child namespace. But, tokens created **across** a parent/child namespace
-boundary may be counted as multiple clients. See the
-[clients and entities](/vault/docs/concepts/client-count) overview for more
-details.
-
-### Does the Nomad-Vault integration affect client counts? ((#nomad))
-
-**Maybe**.
-
-[Nomad Vault integration](/nomad/docs/integrations/vault-integration#token-role-based-integration)
-uses token roles where a single token role creates tokens for many Nomad jobs.
-Unless you have configured explicit identity aliases for your Nomad tokens,
-Vault will record every running instance of a Nomad job as a unique client.
-
-### Are batch tokens counted differently than service tokens? ((#batch-tokens))
-
-**No**.
-
-Batch token clients are counted like service token clients. The batch token is
-mapped to either to the associated active entity or an artificial entity that
-Vault creates by combining the assigned namespace and policy. See the
-[clients and entities](/vault/docs/concepts/client-count) overview for more
-details.
-
-### Do custom user filters affect client counts? ((#custom-filters))
-
-**Yes**.
-
-Custom [user filters](/vault/api-docs/auth/ldap#userfilter) can change the way
-that entity aliases are mapped, which can affect the client count computation.
-
-Consult the [clients and entities](/vault/docs/concepts/client-count) overview
-for more information about how Vault determines entity assignments.
-
-### Does mount migration affect client counts? ((#mount-migration))
-
-**Maybe**.
-
-If you are using Vault 1.10+:
-
-- Migrating mounts **across** namespace will create duplication in the client count.
-- Migrating mounts **within** a namespace will not affect client count.
-
-If you are using an older version of Vault, migrating mounts will always create 
-duplication in the client count.
diff --git a/website/content/partials/faq/client-count/definitions.mdx b/website/content/partials/faq/client-count/definitions.mdx
deleted file mode 100644
index bd575aa179e..00000000000
--- a/website/content/partials/faq/client-count/definitions.mdx
+++ /dev/null
@@ -1,28 +0,0 @@
-### What is a client? ((#what-is-a-client))
-
-Any unique application, service, or user that authenticates to a HashiCorp
-Vault cluster. The client count metric is a combination of entity clients and 
-non-entity clients.
-
-For billing and consumption, only clients that are active during the billing
-period count toward total usage. Clients are only counted once within a billing
-period, regardless of how many times that client is active and when that client
-authenticates to a cluster, it has unlimited access to that cluster for the
-remainder of the billing period.
-
-| Installation type | Billing period
-| ----------------- | ---------------
-| HCP               | monthly
-| Self-managed      | annually
-
-Consult the [clients and entities](/vault/docs/concepts/client-count) overview
-for more information on client definitions.
-
-### What is the difference between an entity client, non-entity client, and certificate client? ((#eclient-vs-neclient))
-
-- **Entity clients** map to an active identity.
-- **Non-entity clients** map to an active non-entity token.
-- **Certificate clients** map to an active ACME PKI certificate.
-
-Consult the [clients and entities](/vault/docs/concepts/client-count) overview
-for more information about how Vault determines entity assignments.
\ No newline at end of file
diff --git a/website/content/partials/faq/client-count/tools.mdx b/website/content/partials/faq/client-count/tools.mdx
deleted file mode 100644
index 789e41e228a..00000000000
--- a/website/content/partials/faq/client-count/tools.mdx
+++ /dev/null
@@ -1,21 +0,0 @@
-### What is the Vault auditor? ((##vault-auditor))
-
-@include 'alerts/auditor-deprecated.mdx'
-
-The [Vault auditor tool](/vault/tutorials/monitoring/usage-metrics#vault-auditor-tool)
-lets customers running Vault v1.3 &ndash; v1.5 compute and display client
-count data using the client compute logic available in Vault 1.7. Auditor use
-with Vault versions older than 1.3 is untested.
-
-The auditor may report that your audit logs are unreadable of the logs are too
-large or you are running an older version than Vault 1.6.
-
-
-### Are there any known client count issues in the auditor tool? ((#auditor-ki))
-
-**Yes**.
-
-The Vault auditor only includes the computation logic improvements from Vault
-v1.6 &ndash; v1.7. Running the auditor on Vault v1.8+ will result in
-discrepancies when comparing the result to data available through the 
-Vault UI or API.
diff --git a/website/content/partials/faq/client-count/upgrading.mdx b/website/content/partials/faq/client-count/upgrading.mdx
deleted file mode 100644
index 7e96480c5af..00000000000
--- a/website/content/partials/faq/client-count/upgrading.mdx
+++ /dev/null
@@ -1,79 +0,0 @@
-### How has client count changed across different Vault versions? ((#logic-improvements))
-
-Client counts have been available via the usage metrics UI since Vault 1.6. We
-have made continual improvements to the Vault client count computation logic
-provided in the Vault UI and API. 
-
-| Version | Interface | Accuracy improvement
-| :-----: | --------- | --------------------
-| 1.6     | N/A       | Introduced client counts as a metric
-| 1.8     | All       | Eliminated wrapped tokens and control groups and counts active identity entities at usage instead of create time
-| 1.9     | All       | Improved non-entity token tracking and local auth mount computation logic
-| 1.10    | API       | Supported data export for unique clients contributing to the client count aggregate for a selected billing period
-| 1.10    | UI        | Displayed clients per auth mount within a namespace
-| 1.11    | API       | Supported unique client export for selected billing periods
-| 1.11    | UI        | Displayed month over month calculations for client count
-
-The latest GA version of the Vault binary always contains the most updated
-version of the client count computation logic.
-
-### How has the usage metric UI changed across different Vault versions? ((#ui-improvements))
-
-| Version | UI improvement
-| :-----: | -----------------------------
-| 1.9     | The dashboard added the ability to export client count data for all namespaces and tabs for **Current month** and **Monthly history** that list the top ten namespaces by client count
-| 1.10    | Added attribution of clients per authN mount to the **Current month** and **Monthly history** tabs
-| 1.11    | Added the ability to view changes in client counts month over month, the running client total, and new monthly clients.
-
-### Are there any known client count issues in the UI/API? ((#uiapi-ki))
-
-**Yes**.
-
-| Version | Client count issue
-| :-----: | -----------------------------
-| 1.9     | Billing period cannot be computed for start and end dates that fall in the middle of a month
-| 1.10    | KMIP clients are not provided.
-| 1.10    | Data on the **Current month** tab does not take the billing period into account.
-
-### What happens to client count when I upgrade? ((#what-happens-at-upgrade))
-
-**Vault will only reflect the number of active unique clients since the upgrade**.
-
-We recommend upgrading **before** your next billing period begins so that the
-usage metrics UI correctly reflects all clients for the current billing period.
-
-<Warning heading="Time your upgrade appropriately">
-  If your billing period falls on either side of a Vault upgrade, the compute
-  logic may be different across the billing period, which will change client
-  count results and create noisy data.
-</Warning>
-
-<Tabs>
-  <Tab heading="Upgrading from Vault 1.8">
-    Vault 1.9 introduced changes to non-entity token and local auth mount logic
-    for client counting that affects anyone upgrading from v1.8 to a newer
-    version:
-    <ul>
-      <li>
-        Any <b>non-entity tokens</b> created before the upgrade will receive an
-        artificial client ID the next time the token authenticates to Vault. As
-        result, the token will be counted as a new client, but will not be
-        recounted on subsequent connections.
-      </li>
-      <li>
-        Any <b>local auth mounts</b> created before the upgrade will continue to
-        count as a unique client, but new mounts created after the upgrade will
-        receive an artificial client ID to avoid duplication in the client count.
-      </li>
-    </ul>
-  </Tab>
-
-  <Tab heading="Upgrading from Vault 1.6">
-    As of v1.7, Vault forbids users from creating two aliases from the same authN
-    mount under a single entity. Additionally, Vault 1.9 forbids mapping multiple
-    service accounts under different namespaces to a single entity.
-
-    Each unique combination of authN mount, namespace, and alias, will be counted
-    as a distinct client.
-  </Tab>
-</Tabs>
\ No newline at end of file
diff --git a/website/content/partials/faq/client-count/usage.mdx b/website/content/partials/faq/client-count/usage.mdx
deleted file mode 100644
index c0dd80396d7..00000000000
--- a/website/content/partials/faq/client-count/usage.mdx
+++ /dev/null
@@ -1,71 +0,0 @@
-### Can I view the list of unique client IDs that contributed to my client count aggregate? ((#view-data))
-
-**Yes, if you are using Vault 1.11 or later**.
-
-As of Vault 1.11, you can export the list of unique
-clients that contributed to your client count for a given billing period with
-the
-[activity export API endpoint](/vault/api-docs/system/internal-counters#activity-export).
-
-### Is clientID viewable in the audit logs for non-entity tokens? ((#clientid-in-logs))
-
-**Yes, for Vault v1.9+**.
-
-As of Vault v1.9, audit logs include a field called `clientID` that records the
-active or computed entity ID of the associated token.
-
-### Can I skip client computation for a period of time during the billing period? ((#skip-computation))
-
-**Yes, but the data may be inaccurate**.
-
-Breaking up the data will likely result in client duplication. For example,
-assume your billing period runs from January 1st to December 31st, and you break
-the computation into two periods to exclude the month of April:
-
-- Period<sub>1</sub> runs from January 1st to March 31st
-- Period<sub>2</sub> runs from June 1st to December 31st
-
-Vault treats the two requests independently so January 1st and June 1st are both
-used as a fresh start to re-count unique clients. Any client that was active
-during both periods will appear in both result sets, even though Vault will only
-counted that client **once** for the actual billing period.
-
-### Are there conditions that will cause me to lose client data? ((#lost-data))
-
-**Yes**.
-
-The Vault activity log handles client computation. The standby nodes track and
-accumulate activity log data then transmit updates to the active node over gRPC
-whenever the log grows by 8KB or 10 minutes has elapsed, whichever happens
-first.
-
-If a node goes down during the accumulation phase you will lose the
-untransmitted data in addition to any client count data that would have been
-collected during the outage.
-
-### What happens if a portion of the data is missing for my billing period? ((#missing-data))
-
-**Vault only returns the most recent contiguous set of data**.
-
-For example, assume your billing period runs from January 1st to December 31st
-but you disabled tracking for the month of April. Vault will look for the
-largest, contiguous window of time where data is available, May through December,
-and compute results for that period of time. May 2021 through December 2021.
-
-### Can I disable client counting? ((#disable-client-count))
-
-**Yes**.
-
-You can use the Vault API to
-[update the client count configuration](/vault/api-docs/system/internal-counters#update-the-client-count-configuration)
-and disable the tracking parameter. If you disable client counting in the middle
-of a month, Vault will discard any data currently recorded for the month. Data
-for previous months is preserved.
-
-### Can I configure Vault to log the client count data? ((#log-client-count))
-
-**Yes**.
-
-You can use the Vault API to
-[update the client count configuration](/vault/api-docs/system/internal-counters#update-the-client-count-configuration)
-and specify your preferred retention period. 
diff --git a/website/content/partials/helm/install.mdx b/website/content/partials/helm/install.mdx
deleted file mode 100644
index 43ccbcc56c5..00000000000
--- a/website/content/partials/helm/install.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
-```sh
-# List the available releases
-$ helm search repo hashicorp/vault -l
-NAME           	CHART VERSION	APP VERSION	DESCRIPTION
-hashicorp/vault	0.27.0       	1.15.2     	Official HashiCorp Vault Chart
-hashicorp/vault	0.26.1       	1.15.1     	Official HashiCorp Vault Chart
-hashicorp/vault	0.26.0       	1.15.1     	Official HashiCorp Vault Chart
-hashicorp/vault	0.25.0       	1.14.0     	Official HashiCorp Vault Chart
-hashicorp/vault	0.24.0       	1.13.1     	Official HashiCorp Vault Chart
-hashicorp/vault	0.23.0       	1.12.1     	Official HashiCorp Vault Chart
-hashicorp/vault	0.22.1       	1.12.0     	Official HashiCorp Vault Chart
-hashicorp/vault	0.22.0       	1.11.3     	Official HashiCorp Vault Chart
-...
-
-# Install version 0.27.0
-$ helm install vault hashicorp/vault --version 0.27.0
-```
diff --git a/website/content/partials/helm/repo.mdx b/website/content/partials/helm/repo.mdx
deleted file mode 100644
index 9f3796c45c3..00000000000
--- a/website/content/partials/helm/repo.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-```shell-session
-$ helm repo add hashicorp https://helm.releases.hashicorp.com
-"hashicorp" has been added to your repositories
-
-$ helm search repo hashicorp/vault
-NAME           	CHART VERSION	APP VERSION	DESCRIPTION
-hashicorp/vault	0.27.0       	1.15.2     	Official HashiCorp Vault Chart
-```
diff --git a/website/content/partials/helm/version.mdx b/website/content/partials/helm/version.mdx
deleted file mode 100644
index a7563abbdd5..00000000000
--- a/website/content/partials/helm/version.mdx
+++ /dev/null
@@ -1 +0,0 @@
-~> **Important Note:** This chart is not compatible with Helm 2. Please use Helm 3.6+ with this chart.
diff --git a/website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx b/website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx
deleted file mode 100644
index 4ee0c7aef16..00000000000
--- a/website/content/partials/known-issues/1_15-audit-file-sighup-does-not-trigger-reload.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
-### File audit devices do not honor SIGHUP signal to reload
-
-#### Affected versions
-
-- 1.15.0
-
-#### Issue
-
-The new underlying event framework for auditing causes Vault to continue using
-audit log files instead of reopening the file paths even when you send
-[`SIGHUP`](/vault/docs/audit/file#log-file-rotation) after log rotation. The
-issue impacts any Vault cluster with `file` audit devices enabled.
-
-Not honoring the `SIGHUP` signal has two key consequences when moving or
-deleting audit files.
-
-If you **move or rename your audit log file** locally, Vault continues to log
-data to the original file. For example, if you archive a file locally:
-
-```shell-session
-$ mv /var/log/vault/audit.log /var/log/vault/archive/audit.log.bak
-```
-
-Vault continues to write data to `/var/log/vault/archive/audit.log.bak`
-instead of logging audit entries to a newly created file at
-`/var/log/vault/audit.log`.
-
-If you **delete your audit log file**, the OS unlinks the file from the
-directory structure, but Vault still has the file open. Vault continues to write
-data to the deleted file, which continues to consume disk space as it grows.
-When Vault is sealed or restarted, the OS deletes the previously unlinked file,
-and you will lose all data logged to the audit file after it was tagged for
-deletion.
-
-The issue with `file` audit devices not honoring `SIGHUP` signals is fixed as a
-patch release in Vault `1.15.1`.
-
-#### Workaround
-
-Set the `VAULT_AUDIT_DISABLE_EVENTLOGGER` environment variable to `true` to
-disable the new underlying event framework and restart Vault:
-
-```shell-session
-$ export VAULT_AUDIT_DISABLE_EVENTLOGGER=true
-```
-
-On startup, Vault reverts to the audit behavior used in `1.14.x`.
diff --git a/website/content/partials/known-issues/1_15-audit-panic-handling-with-eventlogger.mdx b/website/content/partials/known-issues/1_15-audit-panic-handling-with-eventlogger.mdx
deleted file mode 100644
index 9456d20f219..00000000000
--- a/website/content/partials/known-issues/1_15-audit-panic-handling-with-eventlogger.mdx
+++ /dev/null
@@ -1,24 +0,0 @@
-### Audit fails to recover from panics when formatting audit entries
-
-#### Affected versions
-
-- 1.15.0 - 1.15.5
-
-#### Issue
-
-Due to an issue in the new event framework, Vault tries to resolve panics that
-occur when formatting audit entries. Vault cannot resolve the panic correctly,
-which results in the server terminating unexpectedly.
-
-The panic issue was resolved in `1.15.6`.
-
-#### Workaround
-
-Set the `VAULT_AUDIT_DISABLE_EVENTLOGGER` environment variable to `true` to
-disable the new underlying event framework and restart Vault:
-
-```shell-session
-$ export VAULT_AUDIT_DISABLE_EVENTLOGGER=true
-```
-
-On startup, Vault reverts to the audit behavior used in `1.14.x`.
diff --git a/website/content/partials/known-issues/1_15_audit-use-of-log-raw-applies-to-all-devices.mdx b/website/content/partials/known-issues/1_15_audit-use-of-log-raw-applies-to-all-devices.mdx
deleted file mode 100644
index 0c4b04bf66e..00000000000
--- a/website/content/partials/known-issues/1_15_audit-use-of-log-raw-applies-to-all-devices.mdx
+++ /dev/null
@@ -1,51 +0,0 @@
-### Audit devices could log raw data despite configuration
-
-#### Affected versions
-
-- 1.15.0 - 1.15.4
-
-#### Issue
-
-Enabling an audit device which specifies the [`log_raw`](/vault/docs/audit#log_raw) option
-could lead to raw data being logged to other audit devices, regardless of whether they
-are configured to use `log_raw`.
-
-The issue with raw data potentially appearing in logs where HMAC data as expected,
-is fixed as a patch release in Vault `1.15.5`.
-
-#### Workaround
-
-Do not enable any audit devices in Vault that use `log_raw`. If any audit devices
-are currently enabled with `log_raw` set to `true` they should be [disabled](/vault/docs/commands/audit/disable).
-
-To view the options for audit devices via the CLI, use the `--detailed` flag for the
-`vault audit list` command:
-
-```shell-session
-$ vault audit list --detailed
-```
-
-The output will resemble the following, with `log_raw` shown under `Options` on
-any device which has it enabled:
-
-**Example output:** 
-
-<CodeBlockConfig hideClipboard>
-
-```shell-session
-Path      Type    Description    Replication    Options
-----      ----    -----------    -----------    -------
-file1/    file    n/a            replicated     file_path=/var/log/vault/log1.json
-file2/    file    n/a            replicated     file_path=/var/log/vault/log2.json log_raw=true
-```
-
-</CodeBlockConfig>
-
-Disable any device with the `log_raw` option set to `true` using the command
-`vault audit disable {path}` (`file2` in the above output):
-
-```shell-session
-$ vault audit disable file2
-```
-
-See also: [Disable audit via API](/vault/api-docs/system/audit#disable-audit-device).
diff --git a/website/content/partials/known-issues/1_15_openldap-rotate-credentials.mdx b/website/content/partials/known-issues/1_15_openldap-rotate-credentials.mdx
deleted file mode 100644
index 047d25c8664..00000000000
--- a/website/content/partials/known-issues/1_15_openldap-rotate-credentials.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
-### Unable to rotate ldap credentials
-
-#### Affected versions
-
-- 1.15.5
-
-#### Issue
-Depending on their LDAP configuration, some customers may encounter an error when attempting to rotate ldap credentials.
-Static roles and root credentials are affected by this bug.
-See this [issue](https://github.com/hashicorp/vault/issues/25249) for more details.
-
-#### Workaround
-
-There is no workaround. Please update to Vault 1.15.6 or later.
diff --git a/website/content/partials/known-issues/1_16-default-lcq-pre-1_9-upgrade.mdx b/website/content/partials/known-issues/1_16-default-lcq-pre-1_9-upgrade.mdx
deleted file mode 100644
index ff8e519ea67..00000000000
--- a/website/content/partials/known-issues/1_16-default-lcq-pre-1_9-upgrade.mdx
+++ /dev/null
@@ -1,47 +0,0 @@
-### Default lease count quota enabled when upgrading from Vault versions before 1.9
-
-#### Affected versions
-
-- 1.16+
-
-#### Issue
-
-Vault began tracking version history as of version 1.9. As of version 1.16, new
-Vault installs automatically enable a lease count quota by consulting the
-version history. If the version history is empty on upgrade, Vault treats the
-upgrade as a new install and automatically enables a default lease count quota.
-
-Before you upgrade Vault from a version prior to 1.9 to versions 1.16+,
-you should check the current number of unexpired leases via the
-[`vault.expire.num_leases`](/vault/docs/internals/telemetry#token-identity-and-lease-metrics)
-metric.
-
-If the number of unexpired leases is below the [default lease count
-quota](/vault/docs/enterprise/lease-count-quotas#default-lease-count-quota),
-value of 300000 no extra steps are required.
-
-If the number of unexpired leases is greater than the default threshold of
-300000, there is a two step workaround to safely upgrade without the default
-lease count quota:
-
-1. Upgrade to any Vault version prior to 1.16 (between 1.9 and 1.15) to populate the
-   version store.
-2. Upgrade to Vault version 1.16+.
-
-You can review, modify, and delete the global default quota at any point with
-the
-[`/sys/quotas/lease-count/default`](/vault/api-docs/system/lease-count-quotas)
-endpoint:
-
-```shell-session
-$ vault read sys/quotas/lease-count/default
-$ vault delete sys/quotas/lease-count/default
-$ vault write sys/quotas/lease-count/default max_leases=<# of max leases>
-```
-
-Refer to [Protecting Vault with Resource
-Quotas](/vault/tutorials/operations/resource-quotas) for a step-by-step tutorial
-on quota tuning.
-
-Refer to [Lease Explosions](/vault/docs/concepts/lease-explosions) for more
-information on lease management.
diff --git a/website/content/partials/known-issues/1_16-default-policy-needs-to-be-updated.mdx b/website/content/partials/known-issues/1_16-default-policy-needs-to-be-updated.mdx
deleted file mode 100644
index 6601ee10a5c..00000000000
--- a/website/content/partials/known-issues/1_16-default-policy-needs-to-be-updated.mdx
+++ /dev/null
@@ -1,45 +0,0 @@
-### Existing clusters do not show the current Vault version in UI by default
-
-#### Affected versions
-
-- 1.16+
-
-#### Issue
-
-Previous versions of the Vault UI fetched version information from
-un-authenticated endpoints like `sys/health` and `sys/seal-status`. Since
-introducing the `redact_version` TCP listener parameter, version information may
-no longer be available under some configurations. As a result, the Vault UI now
-uses a new, **authenticated** endpoint (`sys/internal/ui/version`) to fetch
-version information.
-
-By default, all **new** Vault servers created with v1.16+ include the following rule, in the 
-automatically-generated policy:
-
-```
-# Allow a token to look up the Vault version. This path is not subject to
-# redaction like the unauthenticated endpoints that provide the Vault version.
-path "sys/internal/ui/version" {
-    capabilities = ["read"]
-}
-```
-
-However, the default policy for **existing** Vault servers does not update
-automatically during the upgrade. You must updated the policy manually in order
-for the Vault version to be displayed in the Vault UI.
-
-No other functionality in the Vault UI is affected be this issue.
-
-You can use the Vault CLI to update the **default** policy and allow the Vault IU to query the Vault server for version information:
-
-```shell-session
-$ vault policy read default | cat - <<< '
-# Allow a token to look up the Vault version. This path is not subject to
-# redaction like the unauthenticated endpoints that provide the Vault version.
-path "sys/internal/ui/version" {
-    capabilities = ["read"]
-}
-' > default-policy.hcl
-$ vault policy write default ./default-policy.hcl
-```
-
diff --git a/website/content/partials/known-issues/aws-auth-panics.mdx b/website/content/partials/known-issues/aws-auth-panics.mdx
deleted file mode 100644
index d758253a155..00000000000
--- a/website/content/partials/known-issues/aws-auth-panics.mdx
+++ /dev/null
@@ -1,18 +0,0 @@
-### Panic in AWS auth method during IAM-based login
-
-#### Affected versions
-
-- 1.15.0
-
-#### Issue
-
-A panic can occur in the AWS auth method during [IAM-based](/vault/docs/auth/aws#iam-auth-method)
-login when a [client config](/vault/api-docs/auth/aws#configure-client) does not exist.
-
-#### Workaround
-
-The panic can be avoided by writing an empty [client config](/vault/api-docs/auth/aws#configure-client):
-
-```shell-session
-vault write -f auth/aws/config/client
-```
diff --git a/website/content/partials/known-issues/aws-static-roles.mdx b/website/content/partials/known-issues/aws-static-roles.mdx
deleted file mode 100644
index 75122d43c5b..00000000000
--- a/website/content/partials/known-issues/aws-static-roles.mdx
+++ /dev/null
@@ -1,16 +0,0 @@
-### AWS static roles ignore changes to rotation period ((#aws-static-role-rotation))
-
-#### Affected versions
-
-- 1.14.0+
-
-#### Issue
-
-AWS static roles currently ignore configuration changes made to the key rotation
-period. As a result, Vault will continue to use whatever rotation period was set
-when the roles were originally created.
-
-#### Workaround
-
-Delete and recreate any static role objects that should use the new rotation
-period.
diff --git a/website/content/partials/known-issues/ephemeral-loggers-memory-leak.mdx b/website/content/partials/known-issues/ephemeral-loggers-memory-leak.mdx
deleted file mode 100644
index c45281560b0..00000000000
--- a/website/content/partials/known-issues/ephemeral-loggers-memory-leak.mdx
+++ /dev/null
@@ -1,20 +0,0 @@
-### Vault is storing references to ephemeral sub-loggers leading to unbounded memory consumption
-
-#### Affected versions
-
-This memory consumption bug affects Vault Community and Enterprise versions:
-
-- 1.13.7 - 1.13.9
-- 1.14.3 - 1.14.5
-- 1.15.0 - 1.15.1
-
-This change that introduced this bug has been reverted as of 1.13.10, 1.14.6, and 1.15.2
-
-#### Issue
-Vault is unexpectedly storing references to ephemeral sub-loggers which prevents them from being cleaned up, leading to
-unbound memory consumption for loggers. This came about from a change to address a previously known issue around
-[sub-logger levels not being adjusted on reload](#sublogger-levels-unchanged-on-reload).
-This impacts many areas of Vault, but primarily logins in Enterprise.
-
-#### Workaround
-There is no workaround.
diff --git a/website/content/partials/known-issues/expiration-metrics-fatal-error.mdx b/website/content/partials/known-issues/expiration-metrics-fatal-error.mdx
deleted file mode 100644
index 2a539756f2e..00000000000
--- a/website/content/partials/known-issues/expiration-metrics-fatal-error.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
-### Fatal error during expiration metrics gathering causing Vault crash
-
-#### Affected versions
-
-This issue affects Vault Community and Enterprise versions:
-- 1.13.9
-- 1.14.5
-- 1.15.1
-
-A fix has been issued in Vault 1.13.10, 1.14.6, and 1.15.2.
-
-#### Issue
-
-A recent change to Vault to improve state change speed (e.g. becoming active or standby) introduced a concurrency issue
-which can lead to a concurrent iteration and write on a map, causing a fatal error and crashing Vault. This error occurs
-when gathering lease and token metrics from the expiration manager. These metrics originate from the active node in a HA
-cluster, as such a standby node will take over active duties and the cluster will remain functional should the original
-active node encounter this bug. The new active node will be vulnerable to the same bug, but may not encounter it immediately.
-
-There is no workaround.
-
-
diff --git a/website/content/partials/known-issues/internal-error-namespace-missing-policy.mdx b/website/content/partials/known-issues/internal-error-namespace-missing-policy.mdx
deleted file mode 100644
index 683bff84467..00000000000
--- a/website/content/partials/known-issues/internal-error-namespace-missing-policy.mdx
+++ /dev/null
@@ -1,143 +0,0 @@
-### Internal error when vault policy in namespace does not exist
-If a user is a member of a group that gets a policy from a
-namespace other than the one they’re trying to log into,
-and that policy doesn’t exist, Vault returns an internal error.
-This impacts all auth methods.
-
-#### Affected versions
-- 1.13.8 and 1.13.9
-- 1.14.4 and 1.14.5
-- 1.15.0 and 1.15.1
-
-A fix has been released in Vault 1.13.10, 1.14.6, and 1.15.2.
-
-### Workaround
-
-During authentication, Vault derives inherited policies based on the groups an
-entity belongs to. Vault returns an internal error when attaching the derived
-policy to a token when:
-
-1. the token belongs to a different namespace than the one handling
-   authentication, and
-2. the derived policy does not exist under the namespace.
-
-
-You can resolve the error by adding the policy to the relevant namespace or
-deleting the group policy mapping that uses the derived policy.
-
-As an example, consider the following userpass auth method failure. The error is
-due to the fact that Vault expects a group policy under the namespace that does
-not exist.
-
-<CodeBlockConfig hideClipboard>
-
-```shell-session
-# Failed login
-$ vault login -method=userpass username=user1 password=123
-Error authenticating: Error making API request.
-
-URL: PUT http://127.0.0.1:8200/v1/auth/userpass/login/user1
-Code: 500. Errors:
-
-* internal error
-```
-
-</CodeBlockConfig>
-
-To confirm the problem is a missing policy, start by identifying the relevant
-entity and group IDs:
-
-<CodeBlockConfig hideClipboard>
-
-```shell-session
-$ vault read -format=json identity/entity/name/user1 | \
-  jq '{"entity_id": .data.id, "group_ids": .data.group_ids} '
-{
-  "entity_id": "420c82de-57c3-df2e-2ef6-0690073b1636",
-  "group_ids": [
-    "6cb152b7-955d-272b-4dcf-a2ed668ca1ea"
-  ]
-}
-```
-
-</CodeBlockConfig>
-
-Use the group ID to fetch the relevant policies for the group under the `ns1`
-namespace:
-
-<CodeBlockConfig hideClipboard>
-
-```shell-session
-$ vault read -format=json -namespace=ns1 \
-  identity/group/id/6cb152b7-955d-272b-4dcf-a2ed668ca1ea | \
-  jq '.data.policies'
-[
-  "group_policy"
-]
-```
-
-</CodeBlockConfig>
-
-Now that we know Vault is looking for a policy called `group_policy`, we can
-check whether that policy exists under the `ns1` namespace:
-
-<CodeBlockConfig hideClipboard>
-
-```shell-session
-$ vault policy list -namespace=ns1
-default
-```
-
-</CodeBlockConfig>
-
-The only policy in the `ns1` namespace is `default`, which confirms that the
-missing policy (`group_policy`) is causing the error.
-
-
-To fix the problem, we can either remove the missing policy from the
-`6cb152b7-955d-272b-4dcf-a2ed668ca1ea` group or create the missing policy under
-the `ns1` namespace.
-
-<Tabs>
-
-<Tab heading="Remove the group policy">
-
-To remove `group_policy` from group ID `6cb152b7-955d-272b-4dcf-a2ed668ca1ea`,
-use the `vault write` command to set the applicable policies to just include
-`default`:
-
-```shell-session
-$ vault write                                             \
-  -namespace=ns1                                          \
-  identity/group/id/6cb152b7-955d-272b-4dcf-a2ed668ca1ea  \
-  name="test"                                             \
-  policies="default"
-```
-
-</Tab>
-
-<Tab heading="Add the policy to ns1">
-
-To create the missing policy, use `vault policy write` and define the
-appropriate capabilities:
-
-```shell-session
-$ vault policy write -namespace=ns1 group_policy - << EOF
-    path "secret/data/*" {
-	    capabilities = ["create", "update"]
-    }
-EOF
-```
-
-</Tab>
-</Tabs>
-
-Verify the fix by re-running the login command:
-
-<CodeBlockConfig hideClipboard>
-
-```shell-session
-$ vault login -method=userpass username=user1 password=123
-```
-
-</CodeBlockConfig>
diff --git a/website/content/partials/known-issues/kv2-url-change.mdx b/website/content/partials/known-issues/kv2-url-change.mdx
deleted file mode 100644
index e6b7a930d0b..00000000000
--- a/website/content/partials/known-issues/kv2-url-change.mdx
+++ /dev/null
@@ -1,24 +0,0 @@
-### URL change for KV v2 secrets engine ((#kv2-url-change))
-
-#### Affected versions
-
-1.15.0+
-
-#### Issue
-
-Recent improvements to the Vault UI updated the URL structure of the KV v2 secrets engine that affect existing URLs.
-
-Previously, URLs for KV v2 used the pattern:
-`ui/vault/secrets/hma/show/${secretPath}`. With the recent refactor, KV v2 URLs
-now use the following pattern:
-`ui/vault/secrets/hma/kv/${encodedUriComponent(secretPath)}/details`.
-
-Opening older URLs now result in 404 errors.
-
-#### Workaround
-
-Currently, no workaround exists.
-
-Improvements that include automatic redirects for older URLs are planned for
-1.15.4.
-
diff --git a/website/content/partials/known-issues/perf-secondary-many-mounts-deadlock.mdx b/website/content/partials/known-issues/perf-secondary-many-mounts-deadlock.mdx
deleted file mode 100644
index 113b3b3a573..00000000000
--- a/website/content/partials/known-issues/perf-secondary-many-mounts-deadlock.mdx
+++ /dev/null
@@ -1,34 +0,0 @@
-### Deadlock can occur on performance secondary clusters with many mounts
-
-#### Affected versions
-
-- 1.15.0 - 1.15.5
-- 1.14.5 - 1.14.9
-- 1.13.9 - 1.13.13
-
-#### Issue
-
-Vault 1.15.0, 1.14.5, and 1.13.9 introduced a worker pool to schedule periodic
-rollback operations on all mounts. This worker pool defaulted to using 256
-workers. The worker pool introduced a risk of deadlocking on the active node of
-**performance secondary clusters**, leaving that cluster unable to service any
-requests.
-
-The conditions required to cause the deadlock on the performance secondary:
-
-- Performance replication is enabled
-- The performance primary cluster has more than 256 non-local mounts. The more
-mounts the cluster has, the more likely the deadlock becomes
-- One of the following occurs:
-  - A replicated mount is unmounted or remounted OR
-  - A replicated namespace is deleted OR
-  - Replication paths filters are used to filter at least one mount or namespace
-
-#### Workaround
-
-Set the `VAULT_ROLLBACK_WORKERS` environment variable to a number larger than
-the number of mounts in your Vault cluster and restart Vault:
-
-```shell-session
-$ export VAULT_ROLLBACK_WORKERS=1000
-```
diff --git a/website/content/partials/known-issues/sublogger-levels-unchanged-on-reload.mdx b/website/content/partials/known-issues/sublogger-levels-unchanged-on-reload.mdx
deleted file mode 100644
index 33c72e2b7e9..00000000000
--- a/website/content/partials/known-issues/sublogger-levels-unchanged-on-reload.mdx
+++ /dev/null
@@ -1,32 +0,0 @@
-### Sublogger levels not adjusted on reload ((#sublogger-levels-unchanged-on-reload))
-
-#### Affected versions
-
-This issue affects all Vault Community and Vault Enterprise versions.
-
-#### Issue
-
-Vault does not honor a modified `log_level` configuration for certain subsystem
-loggers on SIGHUP.
-
-The issue is known to specifically affect `resolver.watcher` and
-`replication.index.*` subloggers.
-
-After modifying the `log_level` and issuing a reload (SIGHUP), some loggers are
-updated to reflect the new configuration, while some subsystem logger levels
-remain unchanged.
-
-For example, after starting a server with `log_level: "trace"` and modifying it
-to `log_level: "info"` the following lines appear after reload:
-
-```
-[TRACE] resolver.watcher: dr mode doesn't have failover support, returning
-...
-[DEBUG] replication.index.perf: saved checkpoint: num_dirty=5
-[DEBUG] replication.index.local: saved checkpoint: num_dirty=0
-[DEBUG] replication.index.periodic: starting WAL GC: from=2531280 to=2531280 last=2531536
-```
-
-#### Workaround
-
-The workaround is to restart the Vault server.
diff --git a/website/content/partials/known-issues/transit-managed-keys-panics.mdx b/website/content/partials/known-issues/transit-managed-keys-panics.mdx
deleted file mode 100644
index 7cea98da8b7..00000000000
--- a/website/content/partials/known-issues/transit-managed-keys-panics.mdx
+++ /dev/null
@@ -1,23 +0,0 @@
-### Transit Encryption with Cloud KMS managed keys causes a panic
-
-#### Affected versions
-
-- 1.13.1+ up to 1.13.8 inclusively
-- 1.14.0+ up to 1.14.4 inclusively
-- 1.15.0
-
-#### Issue
-
-Vault panics when it receives a Transit encryption API call that is backed by a Cloud KMS managed key (Azure, GCP, AWS).
-
-<Note>
-The issue does not affect encryption and decryption with the following key types:
-
-- PKCS#11 managed keys
-- Transit native keys
-
-</Note>
-
-#### Workaround
-
-None at this time
diff --git a/website/content/partials/known-issues/transit-managed-keys-sign-fails.mdx b/website/content/partials/known-issues/transit-managed-keys-sign-fails.mdx
deleted file mode 100644
index 69e0bf2711b..00000000000
--- a/website/content/partials/known-issues/transit-managed-keys-sign-fails.mdx
+++ /dev/null
@@ -1,23 +0,0 @@
-### Transit Sign API calls with managed keys fail
-
-#### Affected versions
-
-- 1.14.0+ up to 1.14.4 inclusively
-- 1.15.0
-
-#### Issue
-
-Vault responds to Transit sign API calls with the following error when the request uses a managed key:
-
-`requested version for signing does not contain a private part`
-
-<Note>
-The issue does not affect signing with the following key types:
-
-- Transit native keys
-
-</Note>
-
-#### Workaround
-
-None at this time
diff --git a/website/content/partials/known-issues/ui-collapsed-navbar.mdx b/website/content/partials/known-issues/ui-collapsed-navbar.mdx
deleted file mode 100644
index 08d28f137d4..00000000000
--- a/website/content/partials/known-issues/ui-collapsed-navbar.mdx
+++ /dev/null
@@ -1,16 +0,0 @@
-### Collapsed navbar does not allow you to click inside the console or namespace picker
-
-#### Affected versions
-
-The UI issue affects Vault versions 1.14.0+ and 1.15.0+.
-A fix is expected for Vault 1.16.0.
-
-#### Issue
-
-The Vauil UI currently uses a version of HDS that does not allow users to click
-within collapsed elements. In particular, the dev console or namespace picker
-become inaccessible when viewing the components in smaller viewports.
-
-#### Workaround
-
-Expand the width of the screen until you deactivate the collapsed view. Once the full navbar is displayed, click the desired components.
\ No newline at end of file
diff --git a/website/content/partials/known-issues/ui-pki-control-groups.mdx b/website/content/partials/known-issues/ui-pki-control-groups.mdx
deleted file mode 100644
index fbdbf6358ce..00000000000
--- a/website/content/partials/known-issues/ui-pki-control-groups.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
-### Users limited by control groups can only access issuer detail from PKI overview page ((#ui-pki-control-groups))
-
-#### Affected versions
-
-- Vault 1.14.x
-
-#### Issue
-
-Vault UI users who require control group approval to read issuer details are
-directed to the Control Group Access page when they try to view issuer details
-from links on the Issuer list page.
-
-#### Workaround
-
-Vault UI users constrained by control groups should select issuers from the
-**PKI overview** page to view detailed information instead of the
-**Issuers list** page.
\ No newline at end of file
diff --git a/website/content/partials/known-issues/ui-safari-login-screen.mdx b/website/content/partials/known-issues/ui-safari-login-screen.mdx
deleted file mode 100644
index 37373b62049..00000000000
--- a/website/content/partials/known-issues/ui-safari-login-screen.mdx
+++ /dev/null
@@ -1,13 +0,0 @@
-### Safari login screen appears broken on the UI
-
-#### Affected versions
-
-- 1.14.0
-
-#### Issue
-
-The login screen on Safari appears to be broken, presenting as a blank white screen.
-
-#### Workaround
-
-Scroll down to find the login section.
\ No newline at end of file
diff --git a/website/content/partials/known-issues/update-primary-addrs-panic.mdx b/website/content/partials/known-issues/update-primary-addrs-panic.mdx
deleted file mode 100644
index d7e63828e84..00000000000
--- a/website/content/partials/known-issues/update-primary-addrs-panic.mdx
+++ /dev/null
@@ -1,16 +0,0 @@
-### Using 'update_primary_addrs' on a demoted cluster causes Vault to panic ((#update-primary-addrs-panic))
-
-#### Affected versions
-
-- 1.13.3, 1.13.4 & 1.14.0
-
-#### Issue
-
-If the [`update_primary_addrs`](/vault/api-docs/system/replication/replication-performance#update_primary_addrs)
-parameter is used on a recently demoted cluster, Vault will panic due to no longer 
-having information about the primary cluster.
-
-#### Workaround
-
-Instead of using `update_primary_addrs` on the recently demoted cluster, instead provide an 
-[activation token](/vault/api-docs/system/replication/replication-performance#token-1).
\ No newline at end of file
diff --git a/website/content/partials/known-issues/update-primary-data-loss.mdx b/website/content/partials/known-issues/update-primary-data-loss.mdx
deleted file mode 100644
index 955b798ccdf..00000000000
--- a/website/content/partials/known-issues/update-primary-data-loss.mdx
+++ /dev/null
@@ -1,57 +0,0 @@
-### API calls to update-primary may lead to data loss ((#update-primary-data-loss))
-
-#### Affected versions
-
-All versions of Vault before 1.14.1, 1.13.5, 1.12.9, and 1.11.12.
-
-#### Issue
-
-The [update-primary](/vault/api-docs/system/replication/replication-performance#update-performance-secondary-s-primary)
-endpoint temporarily removes all mount entries except for those that are managed
-automatically by vault (e.g. identity mounts). In certain situations, a race
-condition between mount table truncation replication repairs may lead to data
-loss when updating secondary replication clusters.
-
-Situations where the race condition may occur:
-
-- **When the cluster has local data (e.g., PKI certificates, app role secret IDs)
-  in shared mounts**.
-  Calling `update-primary` on a performance secondary with local data in shared
-  mounts may corrupt the merkle tree on the secondary. The secondary still
-  contains all the previously stored data, but the corruption means that
-  downstream secondaries will not receive the shared data and will interpret the
-  update as a request to delete the information. If the downstream secondary is
-  promoted before the merkle tree is repaired, the newly promoted secondary will
-  not contain the expected local data. The missing data may be unrecoverable if
-  the original secondary is is lost or destroyed.
-- **When the cluster has an `Allow` paths defined.**
-  As of Vault 1.0.3.1, startup, unseal, and calling `update-primary` all trigger a
-  background job that looks at the current mount data and removes invalid entries
-  based on path filters. When a secondary has `Allow` path filters, the cleanup
-  code may misfire in the windown of time after update-primary truncats the mount
-  tables but before the mount tables are rewritten by replication. The cleanup
-  code deletes data associated with the missing mount entries but does not modify
-  the merkle tree. Because the merkle tree remains unchanged, replication will not
-  know that the data is missing and needs to be repaired.
-
-#### Workaround 1: PR secondary with local data in shared mounts
-
-Watch for `cleaning key in merkle tree` in the TRACE log immediately after an
-update-primary call on a PR secondary to indicate the merkle tree may be
-corrupt. Repair the merkle tree by issuing a
-[replication reindex request](/vault/api-docs/system/replication#reindex-replication)
-to the PR secondary.
-
-If TRACE logs are no longer available, we recommend pre-emptively reindexing the
-PR secondary as a precaution.
-
-#### Workaround 2: PR secondary with "Allow" path filters
-
-Watch for `deleted mistakenly stored mount entry from backend` in the INFO log.
-Reindex the performance secondary to update the merkle tree with the missing
-data and allow replication to disseminate the changes. **You will not be able to
-recover local data on shared mounts (e.g., PKI certificates)**.
-
-If INFO logs are no longer available, query the shared mount in question to
-confirm whether your role and configuration data are present on the primary but
-missing from the secondary.
diff --git a/website/content/partials/known-issues/user-lockout-logging.mdx b/website/content/partials/known-issues/user-lockout-logging.mdx
deleted file mode 100644
index 62d601c4318..00000000000
--- a/website/content/partials/known-issues/user-lockout-logging.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### User lockout potential double logging
-
-#### Affected versions
-
-- 1.14.5
-
-#### Issue
-
-A logging enhancement released before we intended in 1.14.5. In some cases, additional logging does not trigger or generate double logs. 
\ No newline at end of file
diff --git a/website/content/partials/kubernetes-supported-versions.mdx b/website/content/partials/kubernetes-supported-versions.mdx
deleted file mode 100644
index 40fdd80defb..00000000000
--- a/website/content/partials/kubernetes-supported-versions.mdx
+++ /dev/null
@@ -1,13 +0,0 @@
-## Supported kubernetes versions
-
-The following [Kubernetes minor releases][k8s-releases] are currently supported.
-The latest version is tested against each Kubernetes version. It may work with
-other versions of Kubernetes, but those are not supported.
-
-* 1.28
-* 1.27
-* 1.26
-* 1.25
-* 1.24
-
-[k8s-releases]: https://kubernetes.io/releases/
diff --git a/website/content/partials/ldap-auth-userfilter-warning.mdx b/website/content/partials/ldap-auth-userfilter-warning.mdx
deleted file mode 100644
index bfb46fca858..00000000000
--- a/website/content/partials/ldap-auth-userfilter-warning.mdx
+++ /dev/null
@@ -1,4 +0,0 @@
-~> When specifying a `userfilter`, either the templated value `{{.UserAttr}}` or
-the literal value that matches `userattr` should be present in the filter to
-ensure that the search returns a unique result that takes `userattr` into
-consideration for entity alias mapping purposes and avoid possible collisions on login.
diff --git a/website/content/partials/ldap-upndomain-issue.mdx b/website/content/partials/ldap-upndomain-issue.mdx
deleted file mode 100644
index df32e084103..00000000000
--- a/website/content/partials/ldap-upndomain-issue.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
-## LDAP auth engine and upndomain
-
-Users of the LDAP auth engine with the `upndomain` configuration setting populated
-should hold off on upgrading to 1.4.x for now. We are investigating a regression
-introduced by [#8333](https://github.com/hashicorp/vault/pull/8333). There is
-no Github issue for this bug yet.
diff --git a/website/content/partials/lease-count-quota-upgrade.mdx b/website/content/partials/lease-count-quota-upgrade.mdx
deleted file mode 100644
index 81a529efec9..00000000000
--- a/website/content/partials/lease-count-quota-upgrade.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### Lease count quota invalidations on DR secondaries fixed
-
-Lease count quota invalidation causes DR Secondaries to panic and experience
-a hard shutdown. This issue exists prior to Vault 1.6.6 and 1.7.4. It is
-fixed in Vault 1.6.6, 1.7.4, and 1.8.0.
diff --git a/website/content/partials/namespace-limits.mdx b/website/content/partials/namespace-limits.mdx
deleted file mode 100644
index 98d4f1abda0..00000000000
--- a/website/content/partials/namespace-limits.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
-The entire list of namespaces must fit in a single storage
-entry. However, the effective limit is generally much smaller because each
-namespace must have at least two secret engine mounts (for `sys` and `identity`),
-one local secret engine (`cubbyhole`) and one auth engine mount (`token`).
-
-|                                                                              | Consul default (512 KiB) | Integrated storage default (1 MiB) |
-| ---------------------------------------------------------------------------- | ------------------------ | ---------------------------------- |
-| Maximum number of namespaces                                                 | ~3500                    | ~7000                              |
-| Maximum number of namespaces with one additional secret engine per namespace | ~2300                    | ~4600                              |
-| Maximum nesting depth for namespaces                                         | ~160                     | ~220                               |
-
-The maximum nesting depth calculation assumes a cost of 40 bytes per namespace
-path element. 160 nested paths = 160 namespaces ranging from 40 bytes to
-6400 bytes.
-
-You can monitor the number of namespaces by querying
-[`sys/namespaces`](/vault/api-docs/system/namespaces).
-
-To estimate the number of namespaces that can be created, divide the mount
-point limit by the larger of the number of auth mounts per namespace
-(including `ns_token`) and the number of secret mounts per namespace
-(including `identity` and `sys`.)
diff --git a/website/content/partials/ocsp-redirect.mdx b/website/content/partials/ocsp-redirect.mdx
deleted file mode 100644
index a41c3562edf..00000000000
--- a/website/content/partials/ocsp-redirect.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
-### PKI OCSP GET requests can return HTTP redirect responses
-
-If a base64 encoded OCSP request contains consecutive '/' characters, the GET request
-will return a 301 permanent redirect response. If the redirection is followed, the
-request will not decode as it will not be a properly base64 encoded request.
-
-As a workaround, OCSP POST requests can be used which are unaffected.
-
-#### Impacted versions
-
-Affects all current versions of 1.12.x and 1.13.x
diff --git a/website/content/partials/okta-group-pagination.mdx b/website/content/partials/okta-group-pagination.mdx
deleted file mode 100644
index 4a74af24d28..00000000000
--- a/website/content/partials/okta-group-pagination.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-## Okta auth with > 200 groups
-
-In 1.4.0 Vault started using the official Okta Go client library. Unlike
-the previous Okta library it used, the official library doesn't automatically
-handle pagination when there are more than 200 groups listed. If a user
-associated with more than 200 Okta groups logs in, only 200 of them will be
-seen by Vault. The fix is [#9580](https://github.com/hashicorp/vault/pull/9580)
-and will eventually appear in 1.4.x and 1.5.x point releases.
diff --git a/website/content/partials/perf-standby-token-create-forwarding-failure.mdx b/website/content/partials/perf-standby-token-create-forwarding-failure.mdx
deleted file mode 100644
index b36f861f33d..00000000000
--- a/website/content/partials/perf-standby-token-create-forwarding-failure.mdx
+++ /dev/null
@@ -1,19 +0,0 @@
-### Token creation with a new entity alias could silently fail
-
-A regression caused token creation requests under specific circumstances to be
-forwarded from perf standbys (Enterprise only) to the active node incorrectly.
-They would appear to succeed, however no lease was created. The token would then
-be revoked on first use causing a 403 error.
-
-This only happened when all of the following conditions were met:
- - the token is being created against a role
- - the request specifies an entity alias which has never been used before with
-   the same role (for example for a brand new role or a unique alias)
- - the request happens to be made to a perf standby rather than the active node
-
-Retrying token creation after the affected token is rejected would work since
-the entity alias has already been created.
-
-#### Affected versions
-
-Affects Vault 1.13.0 to 1.13.3. Fixed in 1.13.4.
diff --git a/website/content/partials/pgx-params.mdx b/website/content/partials/pgx-params.mdx
deleted file mode 100644
index 544820a52da..00000000000
--- a/website/content/partials/pgx-params.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### Postgres library change
-
-Vault 1.11+ uses pgx instead of lib/pq for Postgres connections. If you are
-using parameters like `fallback_application_name` that pgx does not support, you
-may need to update your `connection_url` before upgrading to Vault 1.11+.
diff --git a/website/content/partials/pki-double-migration-bug.mdx b/website/content/partials/pki-double-migration-bug.mdx
deleted file mode 100644
index e1ff94c6376..00000000000
--- a/website/content/partials/pki-double-migration-bug.mdx
+++ /dev/null
@@ -1,30 +0,0 @@
-### PKI storage migration revives deleted issuers
-
-Vault 1.11 introduced Storage v1, a new storage layout that supported
-multiple issuers within a single mount. Bug fixes in Vault 1.11.6, 1.12.2,
-and 1.13.0 corrected a write-ordering issue that lead to invalid CA chains.
-Specifically, incorrectly ordered writes could fail due to load, resulting
-in the mount being re-migrated next time it was loaded or silently
-truncating CA chains. This collection of bug fixes introduced Storage v2.
-
-#### Affected versions
-
-Vault may incorrectly re-migrated legacy issuers created before Vault 1.11 that
-were migrated to Storage v1 and deleted before upgrading to a Vault version with
-Storage v2.
-
-The migration fails when Vault finds managed keys associated with the legacy
-issuers that were removed from the managed key repository prior to the upgrade.
-
-The migration error appears in Vault logs as:
-
-> Error during migration of PKI mount:
->   failed to lookup public key from managed key:
->     no managed key found with uuid
-
-<Note>
-Issuers created in Vault 1.11+ and direct upgrades to a Storage v2 layout are
-not affected.
-</Note>
-
-The Storage v1 upgrade bug was fixed in Vault 1.14.1, 1.13.5, and 1.12.9.
diff --git a/website/content/partials/pki-forwarding-bug.mdx b/website/content/partials/pki-forwarding-bug.mdx
deleted file mode 100644
index c48a6d8e926..00000000000
--- a/website/content/partials/pki-forwarding-bug.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-## PKI certificate generation forwarding regression
-
-A bug introduced in Vault 1.8 causes certificate generation requests to the PKI secrets engine made on a performance
-secondary node to be forwarded to the cluster's primary node. The resulting certificates are stored on the primary node, 
-and thus visible to list and read certificate requests only on the primary node rather than the secondary node as 
-intended.  Furthermore, if a certificate is subsequently revoked on a performance secondary node, the secondary's 
-certificate revocation list is updated, rather than the primary's where the certificate is stored.  This bug is fixed 
-in Vault 1.8.8 and 1.9.3.  
-Certificates issued after the fix are correctly stored locally to the performance secondary.
-
diff --git a/website/content/partials/plugin-file-permissions-check.mdx b/website/content/partials/plugin-file-permissions-check.mdx
deleted file mode 100644
index 92dcdbe3db4..00000000000
--- a/website/content/partials/plugin-file-permissions-check.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-Enabling the file permissions check via the environment variable `VAULT_ENABLE_FILE_PERMISSIONS_CHECK` 
-allows Vault to check if the config directory and files are owned by the user running Vault. 
-It also checks if there are no write or execute permissions for group or others. 
-Vault allows operators to specify the user and permissions of the plugin directory and binaries 
-using parameters `plugin_file_uid` and `plugin_file_permissions` in config if an operator needs those to be different. This check is disabled by default.
\ No newline at end of file
diff --git a/website/content/partials/plugin-versioning.mdx b/website/content/partials/plugin-versioning.mdx
deleted file mode 100644
index 5859fcf5f50..00000000000
--- a/website/content/partials/plugin-versioning.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
-Plugins can optionally self-report their own semantic version. For plugins that
-do so, Vault will automatically populate the plugin's version in the catalog
-without requiring the user to provide it. If users do provide a version during
-registration, Vault will error if the version provided does not match what the
-plugin reports. Plugins that report a non-empty version _must_ report a valid
-[Semantic Version](https://semver.org/) with a leading 'v' added or registration
-will fail, e.g. `v1.0.0` or `v2.3.2-beta`.
-
-Plugins that want to opt into this behavior can implement the version interface.
-However, it is not a prerequisite; users can still provide a version during
-registration if the plugin does not implement the version interface.
-
-To implement the version interface, plugins should first upgrade the Vault SDK
-package to at least v0.6.0.
\ No newline at end of file
diff --git a/website/content/partials/primary-cluster-addr-change.mdx b/website/content/partials/primary-cluster-addr-change.mdx
deleted file mode 100644
index ef9c34e80bc..00000000000
--- a/website/content/partials/primary-cluster-addr-change.mdx
+++ /dev/null
@@ -1,16 +0,0 @@
-### Primary cluster address change
-
-In Vault 1.4.0-1.4.3, a secondary cluster with a single `primary_cluster_addr`
-configured will obtain the address of the active node in the primary cluster
-via replication heartbeats from the primary cluster.
-
-If the `api_addr` and `cluster_addr` in the heartbeats from the primary
-cluster are not reachable from the secondary cluster, replication will not
-work. This situation can arise if, for example, `primary_cluster_addr`
-corresponds to a load balancer accessible from the secondary cluster, but the
-`api_addr` and `cluster_addr` on the primary cluster are only accessible
-from the primary cluster.
-
-In Vault 1.4.4, we will use the `primary_cluster_addr` if it has been set,
-instead of relying on the heartbeat information, but it's possible to
-encounter this issue in Vault 1.4.0-1.4.3.
diff --git a/website/content/partials/raft-large-snapshots.mdx b/website/content/partials/raft-large-snapshots.mdx
deleted file mode 100644
index ccacecf5d63..00000000000
--- a/website/content/partials/raft-large-snapshots.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
-### Large raft snapshots
-
-Taking and restoring Raft snapshots can exceed Vault's default and recommended
-timeout settings. The
-[`VAULT_CLIENT_TIMEOUT`](/vault/docs/commands#vault_client_timeout) environment variable can
-be used to allow for more time to take or restore a snapshot.
diff --git a/website/content/partials/raft-panic-old-tls-key.mdx b/website/content/partials/raft-panic-old-tls-key.mdx
deleted file mode 100644
index 43f8160978f..00000000000
--- a/website/content/partials/raft-panic-old-tls-key.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
-### Integrated storage panic related to old TLS key
-
-Raft in Vault uses its own set of TLS certificates, independent of those that the user
-controls to protect the API port and those used for replication and clustering. These
-certs get rotated daily, but to ensure that nodes which were down or behind on Raft log
-replication don't lose the ability to speak with other nodes, the newly generated daily
-TLS cert only starts being used once we see that all nodes have received it.
-
-A recent security audit related change results in this rotation code [getting a
-panic](https://github.com/hashicorp/vault/issues/15147) when the current cert is
-more than 24h old.  This can happen if the cluster as a whole is down for a day
-or more. It can also happen if a single node is unreachable 24h, or sufficiently
-backlogged in applying raft logs that it's more than a day behind.
-
-Impacted versions: 1.10.1, 1.9.5, 1.8.10.  Versions prior to these are unaffected.
-
-New releases addressing this panic are coming soon.
diff --git a/website/content/partials/raft-retry-join-failure.mdx b/website/content/partials/raft-retry-join-failure.mdx
deleted file mode 100644
index cb87e79c636..00000000000
--- a/website/content/partials/raft-retry-join-failure.mdx
+++ /dev/null
@@ -1,24 +0,0 @@
-### Cluster initialization hangs with `retry_join`
-
-The
-[`retry_join`](/vault/docs/concepts/integrated-storage/index#retry_join-configuration)
-feature no longer successfully attempts to rejoin the raft cluster every 2
-seconds following a join failure.
-
-The error occurs when attempting to initialize non-leader nodes with a
-[`retry_join` stanza](/vault/docs/configuration/storage/raft/#retry_join-stanza). This
-affects multi-node raft clusters on [impacted versions](#impacted-versions).
-
-The bug was introduced by commit
-https://github.com/hashicorp/vault/commit/cc6409222ce246ed72d067debe6ffeb8f62f9dad
-and first reported in https://github.com/hashicorp/vault/issues/16486.
-
-#### Impacted versions
-
-Affects versions 1.11.1, 1.11.2, 1.10.5, and 1.10.6.  Versions prior to these
-are unaffected.
-
-NOTE: This error does not extend to version 1.9.8+, which is slightly different
-in this portion of the code and does not exhibit the same behavior.
-
-New releases addressing this bug are coming soon.
diff --git a/website/content/partials/release-notes/deprecation-note.mdx b/website/content/partials/release-notes/deprecation-note.mdx
deleted file mode 100644
index 1c222d194b5..00000000000
--- a/website/content/partials/release-notes/deprecation-note.mdx
+++ /dev/null
@@ -1,4 +0,0 @@
-Please refer to the [Deprecation Plans and Notice](/vault/docs/deprecation) page
-for up-to-date information on feature deprecations and plans or the [Feature
-Deprecation FAQ](/vault/docs/deprecation/faq) for general questions about
-our deprecation process.
\ No newline at end of file
diff --git a/website/content/partials/release-notes/intro.mdx b/website/content/partials/release-notes/intro.mdx
deleted file mode 100644
index 54bd81c8abb..00000000000
--- a/website/content/partials/release-notes/intro.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-Release notes provide an at-a-glance summary of key updates to new versions of
-Vault. For a comprehensive list of product updates, improvements, and bug fixes
-refer to the [changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md)
-included with the Vault code on GitHub.
-
-We encourage you to
-[upgrade to the latest release of Vault](/vault/docs/upgrading)
-to take advantage of continuing improvements, critical fixes, and new features.
\ No newline at end of file
diff --git a/website/content/partials/storage-entry-size.mdx b/website/content/partials/storage-entry-size.mdx
deleted file mode 100644
index 1c50da082f7..00000000000
--- a/website/content/partials/storage-entry-size.mdx
+++ /dev/null
@@ -1,20 +0,0 @@
-The maximum size of an object written to a storage backend is determined
-by that backend.
-
-The default entry size limit for the integrated storage backend, is 1 MiB. You
-can configure the allowable entry size with the `max_entry_size` parameter in
-your the [storage stanza](/vault/docs/configuration/storage/raft#max_entry_size).
-Vault automatically chunks any storage entry that is larger than 512 KiB but
-smaller than `max_entry_size` into smaller pieces before writing the entry to Raft.
-
-For Vault deployments using the Consul storage backend, the default entry size
-limit is 512 KiB. The default size is enforced by Consul rather than Vault. You
-can configure the entry size limit with the 
-[`kv_max_value_size`](/consul/docs/agent/config/config-files#kv_max_value_size)
-Consul parameter.
-
-However, Consul **does not** chunk storage entries the way Vault does. Consul
-stores the entry as a single, large write. Even small changes may result in
-large read-modify-write cycles for storage entries, which can degrade Vault
-performance. Larger writes may also destabilize your Consul cluster by delaying
-heartbeats, which can lead to cluster leadership instability.
diff --git a/website/content/partials/telemetry-metrics/database/close.mdx b/website/content/partials/telemetry-metrics/database/close.mdx
deleted file mode 100644
index e3e9d39998e..00000000000
--- a/website/content/partials/telemetry-metrics/database/close.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.Close ((#database-close))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to close a database secret engine (across all database secrets engines)
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/close/error.mdx b/website/content/partials/telemetry-metrics/database/close/error.mdx
deleted file mode 100644
index 162559a068d..00000000000
--- a/website/content/partials/telemetry-metrics/database/close/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.Close.error ((#database-close-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of errors encountered across all database secrets engines while closing database connections
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/createuser.mdx b/website/content/partials/telemetry-metrics/database/createuser.mdx
deleted file mode 100644
index f671886e004..00000000000
--- a/website/content/partials/telemetry-metrics/database/createuser.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.CreateUser ((#database-createuser))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to create a user across all database secrets engines
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/createuser/error.mdx b/website/content/partials/telemetry-metrics/database/createuser/error.mdx
deleted file mode 100644
index 7eb001ba834..00000000000
--- a/website/content/partials/telemetry-metrics/database/createuser/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.CreateUser.error ((#database-createuser-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of errors encountered across all database secrets engines while creating users
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/initialize.mdx b/website/content/partials/telemetry-metrics/database/initialize.mdx
deleted file mode 100644
index 3665b101818..00000000000
--- a/website/content/partials/telemetry-metrics/database/initialize.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.Initialize ((#database-initialize))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to initialize a database secret engine (across all database secrets engines)
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/initialize/error.mdx b/website/content/partials/telemetry-metrics/database/initialize/error.mdx
deleted file mode 100644
index be3160b414b..00000000000
--- a/website/content/partials/telemetry-metrics/database/initialize/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.Initialize.error ((#database-initialize-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of errors encountered across all database secrets engines while initializing the database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/name/close.mdx b/website/content/partials/telemetry-metrics/database/name/close.mdx
deleted file mode 100644
index b5d94a51132..00000000000
--- a/website/content/partials/telemetry-metrics/database/name/close.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.{NAME}.Close ((#database-name-close))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to close the database secrets engine {NAME}
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/name/close/error.mdx b/website/content/partials/telemetry-metrics/database/name/close/error.mdx
deleted file mode 100644
index 7bda23cb141..00000000000
--- a/website/content/partials/telemetry-metrics/database/name/close/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.{NAME}.Close.error ((#database-name-close-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of errors encountered for the named database secrets engines while closing database connections
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/name/createuser.mdx b/website/content/partials/telemetry-metrics/database/name/createuser.mdx
deleted file mode 100644
index fcd29466542..00000000000
--- a/website/content/partials/telemetry-metrics/database/name/createuser.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.{NAME}.CreateUser ((#database-name-createuser))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to create a user for the named database secrets engine
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/name/createuser/error.mdx b/website/content/partials/telemetry-metrics/database/name/createuser/error.mdx
deleted file mode 100644
index 94d87811da3..00000000000
--- a/website/content/partials/telemetry-metrics/database/name/createuser/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.{NAME}.CreateUser.error ((#database-name-createuser-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of errors encountered for the named database secrets engines while creating users
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/name/initialize.mdx b/website/content/partials/telemetry-metrics/database/name/initialize.mdx
deleted file mode 100644
index 9655c144080..00000000000
--- a/website/content/partials/telemetry-metrics/database/name/initialize.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.{NAME}.Initialize ((#database-name-initialize))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to initialize a database secret engine for the named database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/name/initialize/error.mdx b/website/content/partials/telemetry-metrics/database/name/initialize/error.mdx
deleted file mode 100644
index c77259f0e94..00000000000
--- a/website/content/partials/telemetry-metrics/database/name/initialize/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.{NAME}.Initialize.error ((#database-name-initialize-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of errors encountered for the named database secrets engines while initializing the database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/name/renewuser.mdx b/website/content/partials/telemetry-metrics/database/name/renewuser.mdx
deleted file mode 100644
index a7b61a19a82..00000000000
--- a/website/content/partials/telemetry-metrics/database/name/renewuser.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.{NAME}.RenewUser ((#database-name-renewuser))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to renew a user for the named database secrets engine
diff --git a/website/content/partials/telemetry-metrics/database/name/renewuser/error.mdx b/website/content/partials/telemetry-metrics/database/name/renewuser/error.mdx
deleted file mode 100644
index f7a0840c8de..00000000000
--- a/website/content/partials/telemetry-metrics/database/name/renewuser/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.{NAME}.RenewUser.error ((#database-name-renewuser-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of errors encountered for the named database secrets engines while renewing users
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/name/revokeuser.mdx b/website/content/partials/telemetry-metrics/database/name/revokeuser.mdx
deleted file mode 100644
index 40e1584e963..00000000000
--- a/website/content/partials/telemetry-metrics/database/name/revokeuser.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.{NAME}.RevokeUser ((#database-name-revokeuser))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to revoke a user for the named database secrets engine
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/name/revokeuser/error.mdx b/website/content/partials/telemetry-metrics/database/name/revokeuser/error.mdx
deleted file mode 100644
index 1871cd0c238..00000000000
--- a/website/content/partials/telemetry-metrics/database/name/revokeuser/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.{NAME}.RevokeUser.error ((#database-name-revokeuser-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of errors encountered for the named database secrets engines while revoking users
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/renewuser.mdx b/website/content/partials/telemetry-metrics/database/renewuser.mdx
deleted file mode 100644
index 2f11cfb4ce0..00000000000
--- a/website/content/partials/telemetry-metrics/database/renewuser.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.RenewUser ((#database-renewuser))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to renew a user across all database secrets engines
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/renewuser/error.mdx b/website/content/partials/telemetry-metrics/database/renewuser/error.mdx
deleted file mode 100644
index b3a663377a5..00000000000
--- a/website/content/partials/telemetry-metrics/database/renewuser/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.RenewUser.error ((#database-renewuser-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of errors encountered across all database secrets engines while renewing users
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/revokeuser.mdx b/website/content/partials/telemetry-metrics/database/revokeuser.mdx
deleted file mode 100644
index 6e1b2f62a83..00000000000
--- a/website/content/partials/telemetry-metrics/database/revokeuser.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.RevokeUser ((#database-revokeuser))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to revoke a user across all database secrets engines
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/database/revokeuser/error.mdx b/website/content/partials/telemetry-metrics/database/revokeuser/error.mdx
deleted file mode 100644
index 94efce5b04e..00000000000
--- a/website/content/partials/telemetry-metrics/database/revokeuser/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### database.RevokeUser.error ((#database-revokeuser-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of errors encountered across all database secrets engines while revoking users
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/device-intro.mdx b/website/content/partials/telemetry-metrics/device-intro.mdx
deleted file mode 100644
index f7a6c0f7d0e..00000000000
--- a/website/content/partials/telemetry-metrics/device-intro.mdx
+++ /dev/null
@@ -1,3 +0,0 @@
-Device-specific metrics for each enabled audit device. For example, if you
-enable a file audit device, the related metrics are:
-`vault.audit.file.log_request` and `vault.audit.file.log_response`.
diff --git a/website/content/partials/telemetry-metrics/quota-intro.mdx b/website/content/partials/telemetry-metrics/quota-intro.mdx
deleted file mode 100644
index d3d4161c119..00000000000
--- a/website/content/partials/telemetry-metrics/quota-intro.mdx
+++ /dev/null
@@ -1,2 +0,0 @@
-Quota metrics relate to rate limit and lease count quotas. Each metric comes
-with a `name` label that identifies the specific quota.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/raft-autopilot-note.mdx b/website/content/partials/telemetry-metrics/raft-autopilot-note.mdx
deleted file mode 100644
index 817fab29f0c..00000000000
--- a/website/content/partials/telemetry-metrics/raft-autopilot-note.mdx
+++ /dev/null
@@ -1,4 +0,0 @@
-<Note heading="Metrics only apply to the active node">
-  Autopilot only runs on the active node, so autopilot metrics are only
-  captured for the current active node.
-</Note>
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/raft-leadership-intro.mdx b/website/content/partials/telemetry-metrics/raft-leadership-intro.mdx
deleted file mode 100644
index 367faed6809..00000000000
--- a/website/content/partials/telemetry-metrics/raft-leadership-intro.mdx
+++ /dev/null
@@ -1,2 +0,0 @@
-Leadership change metrics indicate the overall performance of the integrated
-storage on raft servers and the network connection between raft nodes.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/replication-note.mdx b/website/content/partials/telemetry-metrics/replication-note.mdx
deleted file mode 100644
index fadf089d2fd..00000000000
--- a/website/content/partials/telemetry-metrics/replication-note.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-<Note heading="Some metrics only available when replication is unhealthy">
-
-  The following metrics only appear in telemetry results when replication is
-  in an unhealthy state:
-
-  - `replication.fetchRemoteKeys`
-  - `replication.merkleDiff`
-  - `replication.merkleSync`
-
-</Note>
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/rollback-intro.mdx b/website/content/partials/telemetry-metrics/rollback-intro.mdx
deleted file mode 100644
index 4f0fc5fccdd..00000000000
--- a/website/content/partials/telemetry-metrics/rollback-intro.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-By default, Vault does not separate rollback metrics by mountpoint. To enable
-explictly named metrics for mountpoints, enable the
-[`add_mount_point_rollback_metrics`](/vault/docs/configuration/telemetry#add_mount_point_rollback_metrics)
-option in your `telemetry` configuration stanza.
-
-If you enable named metrics for mountpoints, the metric name converts forward
-slashes (`/`) in mount names to dashes (`-`). For example, if you have the
-`auth/token` backend configured and mountpoint names enabled for telemetry,
-the corresponding mount point metric string is `auth-token`.
diff --git a/website/content/partials/telemetry-metrics/route-intro.mdx b/website/content/partials/telemetry-metrics/route-intro.mdx
deleted file mode 100644
index 643b653914a..00000000000
--- a/website/content/partials/telemetry-metrics/route-intro.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-Mount-specific route metrics for each configured mount point. Metric names
-convert forward slashes (`/`) in mount names to dashes (`-`). For example, if
-you have the `auth/token` backend configured, the corresponding mount point
-metric string is `auth-token`
-
-By default, Vault does not separate rollback metrics by mountpoint. To enable
-explictly named metrics for mountpoints, enable the
-[`add_mount_point_rollback_metrics`](/vault/docs/configuration/telemetry#add_mount_point_rollback_metrics)
-option in your `telemetry` configuration stanza.
diff --git a/website/content/partials/telemetry-metrics/runtime-note.mdx b/website/content/partials/telemetry-metrics/runtime-note.mdx
deleted file mode 100644
index f0e424e4156..00000000000
--- a/website/content/partials/telemetry-metrics/runtime-note.mdx
+++ /dev/null
@@ -1,2 +0,0 @@
-Runtime metrics relate specifically to the **Go runtime** for your Vault
-instance.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_current_entry.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_current_entry.mdx
deleted file mode 100644
index e74b93b192c..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_current_entry.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.cert_store_current_entry ((#secrets-pki-tidy-cert_store_current_entry))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Index of the certificate store entry currently being verified by the tidy operation
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_deleted_count.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_deleted_count.mdx
deleted file mode 100644
index 91a6c80768e..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_deleted_count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.cert_store_deleted_count ((#secrets-pki-tidy-cert_store_deleted_count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of entries deleted from the certificate store
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_total_entries.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_total_entries.mdx
deleted file mode 100644
index 65f3a8b23aa..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_total_entries.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.cert_store_total_entries ((#secrets-pki-tidy-cert_store_total_entries))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of entries in the certificate store to verify during the tidy operation
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_total_entries_remaining.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_total_entries_remaining.mdx
deleted file mode 100644
index c76243a944b..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/cert_store_total_entries_remaining.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.cert_store_total_entries_remaining ((#secrets-pki-tidy-cert_store_total_entries_remaining))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of entries in the certificate store checked, but not removed, during the tidy operation
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/duration.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/duration.mdx
deleted file mode 100644
index b09b56520c9..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/duration.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.duration ((#secrets-pki-tidy-duration))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete the PKI tidy operation
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/failure.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/failure.mdx
deleted file mode 100644
index caf9565cb21..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/failure.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.failure ((#secrets-pki-tidy-failure))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of times the PKI tidy operation failed to finish due to errors
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_current_entry.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_current_entry.mdx
deleted file mode 100644
index 89879932771..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_current_entry.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.revoked_cert_current_entry ((#secrets-pki-tidy-revoked_cert_current_entry))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Index of the revoked certificate store entry currently being verified by the tidy operation
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_deleted_count.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_deleted_count.mdx
deleted file mode 100644
index f3d4618f4e4..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_deleted_count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.revoked_cert_deleted_count ((#secrets-pki-tidy-revoked_cert_deleted_count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of entries deleted from the certificate store for revoked certificates
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries.mdx
deleted file mode 100644
index 0869a8e9f83..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.revoked_cert_total_entries ((#secrets-pki-tidy-revoked_cert_total_entries))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of revoked certificate entries in the certificate store to be verified during the tidy operation
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_fixed_issuers.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_fixed_issuers.mdx
deleted file mode 100644
index 9f3f0b50a5d..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_fixed_issuers.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.revoked_cert_total_entries_fixed_issuers ((#secrets-pki-tidy-revoked_cert_total_entries_fixed_issuers))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of entries in the certificate store found to have incorrect issuer information that were fixed during the tidy operation
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_incorrect_issuers.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_incorrect_issuers.mdx
deleted file mode 100644
index 7e6c6c2d5d0..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_incorrect_issuers.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.revoked_cert_total_entries_incorrect_issuers ((#secrets-pki-tidy-revoked_cert_total_entries_incorrect_issuers))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Total number of entries in the certificate store found to have incorrect issuer information
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_remaining.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_remaining.mdx
deleted file mode 100644
index 725fb011b95..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/revoked_cert_total_entries_remaining.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.revoked_cert_total_entries_remaining ((#secrets-pki-tidy-revoked_cert_total_entries_remaining))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of revoked certificates in the certificate store checked, but not removed, during the tidy operation
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/start_time_epoch.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/start_time_epoch.mdx
deleted file mode 100644
index 7a0e269e140..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/start_time_epoch.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### secrets.pki.tidy.start_time_epoch ((#secrets-pki-tidy-start_time_epoch))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | seconds | Epoch time (seconds since 1970-01-01) when the PKI tidy operation began
-
-The start time metric reports a value of `0` if the PKI tidy operation is not
-currently active.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secrets/pki/tidy/success.mdx b/website/content/partials/telemetry-metrics/secrets/pki/tidy/success.mdx
deleted file mode 100644
index 37869dc4b44..00000000000
--- a/website/content/partials/telemetry-metrics/secrets/pki/tidy/success.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### secrets.pki.tidy.success ((#secrets-pki-tidy-success))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of times the PKI tidy operation completed successfully
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/secretsdb-intro.mdx b/website/content/partials/telemetry-metrics/secretsdb-intro.mdx
deleted file mode 100644
index abd14fc8dcc..00000000000
--- a/website/content/partials/telemetry-metrics/secretsdb-intro.mdx
+++ /dev/null
@@ -1,4 +0,0 @@
-Metrics related to your configured **secrets engines**, including
-database-specific metrics for each named secrets engine. For example, if you
-enable a PostgreSQL secrets engine called `postgresql-prod`, the related
-`CreateUser.error` metric is `database.postgresql-prod.CreateUser.error`.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/audit/device/log_request.mdx b/website/content/partials/telemetry-metrics/vault/audit/device/log_request.mdx
deleted file mode 100644
index 6504f5fdf63..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/device/log_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.audit.{DEVICE}.log_request ((#vault-audit-device-log_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete all audit log requests across the device
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/audit/device/log_request_failure.mdx b/website/content/partials/telemetry-metrics/vault/audit/device/log_request_failure.mdx
deleted file mode 100644
index 4108c541e71..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/device/log_request_failure.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.audit.{DEVICE}.log_request_failure ((#vault-audit-device-log_request_failure))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of audit log request failures
diff --git a/website/content/partials/telemetry-metrics/vault/audit/device/log_response.mdx b/website/content/partials/telemetry-metrics/vault/audit/device/log_response.mdx
deleted file mode 100644
index 72cda1276da..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/device/log_response.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.audit.{DEVICE}.log_response ((#vault-audit-device-log_response))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete all audit log responses across the device
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/audit/device/log_response_failure.mdx b/website/content/partials/telemetry-metrics/vault/audit/device/log_response_failure.mdx
deleted file mode 100644
index a39b7b24b86..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/device/log_response_failure.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.audit.{DEVICE}.log_response_failure ((#vault-audit-device-log_response_failure))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of audit log request failures
diff --git a/website/content/partials/telemetry-metrics/vault/audit/fallback_miss.mdx b/website/content/partials/telemetry-metrics/vault/audit/fallback_miss.mdx
deleted file mode 100644
index ad1d252e17d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/fallback_miss.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.audit.fallback.miss ((#vault-audit-fallback_miss))
-
-| Metric type | Value  | Description                                                                            |
-|-------------|--------|----------------------------------------------------------------------------------------|
-| counter     | number | Number of times Vault filtered out an audit entry such that no devices were written to |
diff --git a/website/content/partials/telemetry-metrics/vault/audit/fallback_success.mdx b/website/content/partials/telemetry-metrics/vault/audit/fallback_success.mdx
deleted file mode 100644
index 948496df303..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/fallback_success.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.audit.fallback.success ((#vault-audit-fallback_failure))
-
-| Metric type | Value  | Description                                              |
-|-------------|--------|----------------------------------------------------------|
-| counter     | number | Number of times the fallback audit device was written to |
diff --git a/website/content/partials/telemetry-metrics/vault/audit/log_request.mdx b/website/content/partials/telemetry-metrics/vault/audit/log_request.mdx
deleted file mode 100644
index 67083b3827b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/log_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.audit.log_request ((#vault-audit-log_request))
-
-| Metric type | Value | Description                                                                   |
-|-------------|-------|-------------------------------------------------------------------------------|
-| summary     | ms    | Time required to complete all audit log requests across all audit log devices |
diff --git a/website/content/partials/telemetry-metrics/vault/audit/log_request_failure.mdx b/website/content/partials/telemetry-metrics/vault/audit/log_request_failure.mdx
deleted file mode 100644
index da280c70fe7..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/log_request_failure.mdx
+++ /dev/null
@@ -1,15 +0,0 @@
-### vault.audit.log_request_failure ((#vault-audit-log_request_failure))
-
-| Metric type | Value  | Description                                             |
-|-------------|--------|---------------------------------------------------------|
-| counter     | number | Number of audit log request failures across all devices |
-
-The number of request failures is a **crucial metric**.
-
-A non-zero value for `vault.audit.log_request_failure` indicates that all your
-configured audit devices failed to log a request (or response). If Vault cannot
-properly audit a request, or the response to a request, the original request
-will fail.
-
-Refer to the Vault logs and any device-specific metrics to troubleshoot the
-failing audit log device.
diff --git a/website/content/partials/telemetry-metrics/vault/audit/log_response.mdx b/website/content/partials/telemetry-metrics/vault/audit/log_response.mdx
deleted file mode 100644
index d1e8cd729ad..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/log_response.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.audit.log_response ((#vault-audit-log_response))
-
-| Metric type | Value | Description                                                                |
-|-------------|-------|----------------------------------------------------------------------------|
-| summary     | ms    | Time required to complete audit log responses across all audit log devices |
diff --git a/website/content/partials/telemetry-metrics/vault/audit/log_response_failure.mdx b/website/content/partials/telemetry-metrics/vault/audit/log_response_failure.mdx
deleted file mode 100644
index 3d74a243d58..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/log_response_failure.mdx
+++ /dev/null
@@ -1,15 +0,0 @@
-### vault.audit.log_response_failure ((#vault-audit-log_response_failure))
-
-| Metric type | Value  | Description                                             |
-|-------------|--------|---------------------------------------------------------|
-| counter     | number | Number of audit log request failures across all devices |
-
-The number of request failures is a **crucial metric**.
-
-A non-zero value for `vault.audit.log_response_failure` indicates that one of
-the configured audit log devices failed to respond to Vault. If Vault cannot
-properly audit a request, or the response to a request, the original request
-will fail.
-
-Refer to the device-specific metrics and logs to troubleshoot the failing audit
-log device.
diff --git a/website/content/partials/telemetry-metrics/vault/audit/sink_failure.mdx b/website/content/partials/telemetry-metrics/vault/audit/sink_failure.mdx
deleted file mode 100644
index 30215b4c2f9..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/sink_failure.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.audit.sink.failure ((#vault-audit-sink_failure))
-
-| Metric type | Value  | Description                                                        |
-|-------------|--------|--------------------------------------------------------------------|
-| counter     | number | Number of times an audit device encountered an error while writing |
diff --git a/website/content/partials/telemetry-metrics/vault/audit/sink_success.mdx b/website/content/partials/telemetry-metrics/vault/audit/sink_success.mdx
deleted file mode 100644
index e41a21ccdb8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/audit/sink_success.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.audit.sink.success ((#vault-audit-sink_success))
-
-| Metric type | Value  | Description                                                 |
-|-------------|--------|-------------------------------------------------------------|
-| counter     | number | Number of times an audit device was written to successfully |
diff --git a/website/content/partials/telemetry-metrics/vault/autopilot/failure_tolerance.mdx b/website/content/partials/telemetry-metrics/vault/autopilot/failure_tolerance.mdx
deleted file mode 100644
index 6583419c572..00000000000
--- a/website/content/partials/telemetry-metrics/vault/autopilot/failure_tolerance.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-### vault.autopilot.failure_tolerance ((#vault-autopilot-failure_tolerance))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | nodes | The number of healthy nodes in excess of quorum
-
-The failure tolerance indicates how many currently healthy nodes can fail without losing quorum. 
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/autopilot/healthy.mdx b/website/content/partials/telemetry-metrics/vault/autopilot/healthy.mdx
deleted file mode 100644
index fc0be2169c2..00000000000
--- a/website/content/partials/telemetry-metrics/vault/autopilot/healthy.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### vault.autopilot.healthy ((#vault-autopilot-healthy))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | boolean | Indicates whether all nodes are healthy
-
-- A value of `1` on the gauge means that Autopilot deems all nodes healthy.
-- A value of `0` on the gauge means that Autopilot deems at least 1 node
-  unhealthy.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/autopilot/node/healthy.mdx b/website/content/partials/telemetry-metrics/vault/autopilot/node/healthy.mdx
deleted file mode 100644
index 4609f967c5f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/autopilot/node/healthy.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-### vault.autopilot.node.healthy ((#vault-autopilot-node-healthy))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | boolean | Indicates whether the active node is healthy
-
-- A value of `1` on the gauge means that Autopilot deems the node indicated by
-  `node_id` is healthy.
-- A value of `0` on the gauge means that Autopilot cannot communicate with the
-  node indicated by `node_id`, or deems the node unhealthy.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/autosnapshots/last/success/time.mdx b/website/content/partials/telemetry-metrics/vault/autosnapshots/last/success/time.mdx
deleted file mode 100644
index eac11442a5d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/autosnapshots/last/success/time.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.autosnapshots.last.success.time ((#vault-autosnapshots-last-success-time))
-
-Metric type | Value     | Description
------------ | --------- | -----------
-gauge       | timestamp | Epoch time (seconds since 1970-01-01) of the last successful snapshot save
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/autosnapshots/percent/maxspace/used.mdx b/website/content/partials/telemetry-metrics/vault/autosnapshots/percent/maxspace/used.mdx
deleted file mode 100644
index 6ee513f54b1..00000000000
--- a/website/content/partials/telemetry-metrics/vault/autosnapshots/percent/maxspace/used.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-### vault.autosnapshots.percent.maxspace.used ((#vault-autosnapshots-percent-maxspace-used))
-
-Metric type | Value      | Description
------------ | ---------- | -----------
-gauge       | percentage | The percentage of space currently used on local storage (disk) by saved snapshots
-
-Vault only populates the `vault.autosnapshots.percent.maxspace.used` metric when
-the storage type for autosnapshot is `local`. The percentage of used space is
-relative to the maximum allocated space for snapshots, not the total available
-space on local storage.
diff --git a/website/content/partials/telemetry-metrics/vault/autosnapshots/rotate/duration.mdx b/website/content/partials/telemetry-metrics/vault/autosnapshots/rotate/duration.mdx
deleted file mode 100644
index 285d94b2e48..00000000000
--- a/website/content/partials/telemetry-metrics/vault/autosnapshots/rotate/duration.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### vault.autosnapshots.rotate.duration ((#vault-autosnapshots-rotate-duration))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | The time taken to rotate out the snapshot indicated by `snapshot_config_name`
-
-Vault deletes snapshots to adhere to the configured retention period. The
-rotation metric specifically measures the time taken to delete the snapshot once
-the retention period expires.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/autosnapshots/save/duration.mdx b/website/content/partials/telemetry-metrics/vault/autosnapshots/save/duration.mdx
deleted file mode 100644
index 71987cb77ae..00000000000
--- a/website/content/partials/telemetry-metrics/vault/autosnapshots/save/duration.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.autosnapshots.save.duration ((#vault-autosnapshots-save-duration))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | The time taken to save the snapshot indicated by `snapshot_config_name`
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/autosnapshots/save/errors.mdx b/website/content/partials/telemetry-metrics/vault/autosnapshots/save/errors.mdx
deleted file mode 100644
index e64e0a7e3bb..00000000000
--- a/website/content/partials/telemetry-metrics/vault/autosnapshots/save/errors.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.autosnapshots.save.errors ((#vault-autosnapshots-save-errors))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | The number of errors encountered while trying to save the snapshot indicated by `snapshot_config_name`
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/autosnapshots/snapshot/size.mdx b/website/content/partials/telemetry-metrics/vault/autosnapshots/snapshot/size.mdx
deleted file mode 100644
index c3411e2a79d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/autosnapshots/snapshot/size.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.autosnapshots.snapshot.size ((#vault-autosnapshots-snapshot-size))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | bytes | The current size of the snapshot indicated by `snapshot_config_name`
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/autosnapshots/total/snapshot/size.mdx b/website/content/partials/telemetry-metrics/vault/autosnapshots/total/snapshot/size.mdx
deleted file mode 100644
index 23fed0ad9d7..00000000000
--- a/website/content/partials/telemetry-metrics/vault/autosnapshots/total/snapshot/size.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.autosnapshots.total.snapshot.size ((#vault-autosnapshots-total-snapshot-size))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | bytes | The space currently used on local storage (disk) by saved snapshots
-
-Vault only populates the `vault.autosnapshots.total.snapshot.size` metric when
-the storage type for autosnapshot is `local`.  
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/azure/delete.mdx b/website/content/partials/telemetry-metrics/vault/azure/delete.mdx
deleted file mode 100644
index 68edda3bebd..00000000000
--- a/website/content/partials/telemetry-metrics/vault/azure/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.azure.delete ((#vault-azure-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the Azure storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/azure/get.mdx b/website/content/partials/telemetry-metrics/vault/azure/get.mdx
deleted file mode 100644
index e9ea4e90c56..00000000000
--- a/website/content/partials/telemetry-metrics/vault/azure/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.azure.get ((#vault-azure-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the Azure storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/azure/list.mdx b/website/content/partials/telemetry-metrics/vault/azure/list.mdx
deleted file mode 100644
index 5374c794d2c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/azure/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.azure.list ((#vault-azure-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the Azure storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/azure/put.mdx b/website/content/partials/telemetry-metrics/vault/azure/put.mdx
deleted file mode 100644
index e14b582b6e9..00000000000
--- a/website/content/partials/telemetry-metrics/vault/azure/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.azure.put ((#vault-azure-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the Azure storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/barrier/delete.mdx b/website/content/partials/telemetry-metrics/vault/barrier/delete.mdx
deleted file mode 100644
index f41c9da1fa6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/barrier/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.barrier.delete ((#vault-barrier-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation at the barrier
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/barrier/get.mdx b/website/content/partials/telemetry-metrics/vault/barrier/get.mdx
deleted file mode 100644
index 3984980bcdb..00000000000
--- a/website/content/partials/telemetry-metrics/vault/barrier/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.barrier.get ((#vault-barrier-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation at the barrier
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/barrier/list.mdx b/website/content/partials/telemetry-metrics/vault/barrier/list.mdx
deleted file mode 100644
index 830fa5ea535..00000000000
--- a/website/content/partials/telemetry-metrics/vault/barrier/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.barrier.list ((#vault-barrier-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation at the barrier
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/barrier/put.mdx b/website/content/partials/telemetry-metrics/vault/barrier/put.mdx
deleted file mode 100644
index a24b4db693a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/barrier/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.barrier.put ((#vault-barrier-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation at the barrier
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cache/delete.mdx b/website/content/partials/telemetry-metrics/vault/cache/delete.mdx
deleted file mode 100644
index d6ec30596ac..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cache/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cache.delete ((#vault-cache-delete))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of deletes from the LRU cache
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cache/hit.mdx b/website/content/partials/telemetry-metrics/vault/cache/hit.mdx
deleted file mode 100644
index 345fc4c5dd3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cache/hit.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cache.hit ((#vault-cache-hit))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of hits against the LRU cache that avoided a read from configured storage
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cache/miss.mdx b/website/content/partials/telemetry-metrics/vault/cache/miss.mdx
deleted file mode 100644
index b3ef801fed1..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cache/miss.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cache.miss ((#vault-cache-miss))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of misses against the LRU cache that required a read from configured storage
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cache/write.mdx b/website/content/partials/telemetry-metrics/vault/cache/write.mdx
deleted file mode 100644
index f1eeacb84e1..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cache/write.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cache.write ((#vault-cache-write))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of writes to the LRU cache
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cassandra/delete.mdx b/website/content/partials/telemetry-metrics/vault/cassandra/delete.mdx
deleted file mode 100644
index 225ecfd0501..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cassandra/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cassandra.delete ((#vault-cassandra-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the Cassandra storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cassandra/get.mdx b/website/content/partials/telemetry-metrics/vault/cassandra/get.mdx
deleted file mode 100644
index 052975782a2..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cassandra/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cassandra.get ((#vault-cassandra-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the Cassandra storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cassandra/list.mdx b/website/content/partials/telemetry-metrics/vault/cassandra/list.mdx
deleted file mode 100644
index 6b0b3753b22..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cassandra/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cassandra.list ((#vault-cassandra-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the Cassandra storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cassandra/put.mdx b/website/content/partials/telemetry-metrics/vault/cassandra/put.mdx
deleted file mode 100644
index f7d1d1cfc72..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cassandra/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cassandra.put ((#vault-cassandra-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the Cassandra storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cockroachdb/delete.mdx b/website/content/partials/telemetry-metrics/vault/cockroachdb/delete.mdx
deleted file mode 100644
index 91c6c35f151..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cockroachdb/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cockroachdb.delete ((#vault-cockroachdb-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the CockroachDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cockroachdb/get.mdx b/website/content/partials/telemetry-metrics/vault/cockroachdb/get.mdx
deleted file mode 100644
index f47e6a7ac81..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cockroachdb/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cockroachdb.get ((#vault-cockroachdb-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the CockroachDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cockroachdb/list.mdx b/website/content/partials/telemetry-metrics/vault/cockroachdb/list.mdx
deleted file mode 100644
index a440adacbd5..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cockroachdb/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cockroachdb.list ((#vault-cockroachdb-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the CockroachDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/cockroachdb/put.mdx b/website/content/partials/telemetry-metrics/vault/cockroachdb/put.mdx
deleted file mode 100644
index 6143ee2ff4c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/cockroachdb/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.cockroachdb.put ((#vault-cockroachdb-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the CockroachDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/consul/delete.mdx b/website/content/partials/telemetry-metrics/vault/consul/delete.mdx
deleted file mode 100644
index 6970aa51fb5..00000000000
--- a/website/content/partials/telemetry-metrics/vault/consul/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.consul.delete ((#vault-consul-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the Consul storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/consul/get.mdx b/website/content/partials/telemetry-metrics/vault/consul/get.mdx
deleted file mode 100644
index cec03a7af51..00000000000
--- a/website/content/partials/telemetry-metrics/vault/consul/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.consul.get ((#vault-consul-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the Consul storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/consul/list.mdx b/website/content/partials/telemetry-metrics/vault/consul/list.mdx
deleted file mode 100644
index 453c2afdd31..00000000000
--- a/website/content/partials/telemetry-metrics/vault/consul/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.consul.list ((#vault-consul-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the Consul storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/consul/put.mdx b/website/content/partials/telemetry-metrics/vault/consul/put.mdx
deleted file mode 100644
index 4dcc92a447b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/consul/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.consul.put ((#vault-consul-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the Consul storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/consul/transaction.mdx b/website/content/partials/telemetry-metrics/vault/consul/transaction.mdx
deleted file mode 100644
index 77004d1c5bd..00000000000
--- a/website/content/partials/telemetry-metrics/vault/consul/transaction.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.consul.transaction ((#vault-consul-transaction))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a transactional operation against the Consul storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/active.mdx b/website/content/partials/telemetry-metrics/vault/core/active.mdx
deleted file mode 100644
index 982a3866d2a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/active.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.core.active ((#vault-core-active))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | boolean | Indicates whether the Vault node is active
-
-- A value of `1` indicates that the node is active.
-- A value of `0` indicates that the node is in standby.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/activity/fragment_size.mdx b/website/content/partials/telemetry-metrics/vault/core/activity/fragment_size.mdx
deleted file mode 100644
index 96bb977accc..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/activity/fragment_size.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.core.activity.fragment_size ((#vault-core-activity-fragment_size))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of `type` objects observed by the local node
-
-The fragment size metric includes labels to indicate if the objects counted were
-entities or tokens.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/activity/segment_write.mdx b/website/content/partials/telemetry-metrics/vault/core/activity/segment_write.mdx
deleted file mode 100644
index b3ae3bb080b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/activity/segment_write.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.activity.segment_write ((#vault-core-activity-segment_write))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to write activity log segments to storage
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/check_token.mdx b/website/content/partials/telemetry-metrics/vault/core/check_token.mdx
deleted file mode 100644
index 0cb5129b491..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/check_token.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.check_token ((#vault-core-check_token))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a token check
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/fetch_acl_and_token.mdx b/website/content/partials/telemetry-metrics/vault/core/fetch_acl_and_token.mdx
deleted file mode 100644
index 548aa535b7e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/fetch_acl_and_token.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.fetch_acl_and_token ((#vault-core-fetch_acl_and_token))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to fetch ACL and token entries
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/handle_login_request.mdx b/website/content/partials/telemetry-metrics/vault/core/handle_login_request.mdx
deleted file mode 100644
index b03718b05f2..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/handle_login_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.handle_login_request ((#vault-core-handle_login_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a login request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/handle_request.mdx b/website/content/partials/telemetry-metrics/vault/core/handle_request.mdx
deleted file mode 100644
index c39260d9d27..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/handle_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.handle_request ((#vault-core-handle_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a non-login request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/in_flight_requests.mdx b/website/content/partials/telemetry-metrics/vault/core/in_flight_requests.mdx
deleted file mode 100644
index 75f3ee4d357..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/in_flight_requests.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.in_flight_requests ((#vault-core-in_flight_requests))
-
-Metric type | Value    | Description
------------ | -------- | -----------
-gauge       | requests | Number of requests currently in progress
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/leadership_lost.mdx b/website/content/partials/telemetry-metrics/vault/core/leadership_lost.mdx
deleted file mode 100644
index 665816e57ac..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/leadership_lost.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### vault.core.leadership_lost ((#vault-core-leadership_lost))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Total time that a high-availability cluster node last maintained leadership
-
-Leadership time updates occur whenever leadership changes. Frequent updates to
-`vault.core.leadership_lost` with low leadership times indicates flapping as
-leader status rotates between nodes.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/leadership_setup_failed.mdx b/website/content/partials/telemetry-metrics/vault/core/leadership_setup_failed.mdx
deleted file mode 100644
index 7ceefd09f04..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/leadership_setup_failed.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-### vault.core.leadership_setup_failed ((#vault-core-leadership_setup_failed))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken by the most recent leadership setup failure
-
-Setup failure time is an important health metric for your high-availability
-Vault installation. We strongly recommend that you closely monitor
-`vault.core.leadership_setup_failed` and set alerts that keep you informed of
-the overall cluster leadership status.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/license/expiration_time_epoch.mdx b/website/content/partials/telemetry-metrics/vault/core/license/expiration_time_epoch.mdx
deleted file mode 100644
index 9db83135575..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/license/expiration_time_epoch.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.license.expiration_time_epoch ((#vault-core-license-expiration_time_epoch))
-
-Metric type | Value     | Description
------------ | --------- | -----------
-gauge       | timestamp | Epoch time (seconds since 1970-01-01) at which the license will expire
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/locked_users.mdx b/website/content/partials/telemetry-metrics/vault/core/locked_users.mdx
deleted file mode 100644
index 5d267d83222..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/locked_users.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-### vault.core.locked_users ((#vault-core-locked_users))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | users | The number of users currently locked out of Vault
-
-The number of locked users refreshes every 15 minutes.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/mount_table/num_entries.mdx b/website/content/partials/telemetry-metrics/vault/core/mount_table/num_entries.mdx
deleted file mode 100644
index 95260b84ce6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/mount_table/num_entries.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### vault.core.mount_table.num_entries ((#vault-core-mount_table-num_entries))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | objects | Number of mounts in the given mount table
-
-Mountpoint count metrics include labels to indicate whether the relevant table
-is an authentication table or a logical table and whether the table is
-replicated or local.
diff --git a/website/content/partials/telemetry-metrics/vault/core/mount_table/size.mdx b/website/content/partials/telemetry-metrics/vault/core/mount_table/size.mdx
deleted file mode 100644
index eabd0a7b7dd..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/mount_table/size.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### vault.core.mount_table.size ((#vault-core-mount_table-size))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | bytes | The current size of the relevant mount table.
-
-Table size metrics include labels to indicate whether the relevant table is an
-authentication table or a logical table and whether the table is replicated or
-local.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/performance_standby.mdx b/website/content/partials/telemetry-metrics/vault/core/performance_standby.mdx
deleted file mode 100644
index ea4f6563162..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/performance_standby.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### vault.core.performance_standby ((#vault-core-performance_standby))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | boolean | Indicates whether the reporting node is a performance standby
-
-
-- A value of `1` indicates the node **is** a performance standby
-- A value of `0` indicates the node **is not** a performance standby
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/post_unseal.mdx b/website/content/partials/telemetry-metrics/vault/core/post_unseal.mdx
deleted file mode 100644
index e67b7960e28..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/post_unseal.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.post_unseal ((#vault-core-post_unseal))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete post-unseal operations
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/pre_seal.mdx b/website/content/partials/telemetry-metrics/vault/core/pre_seal.mdx
deleted file mode 100644
index bb3e983df79..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/pre_seal.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.pre_seal ((#vault-core-pre_seal))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete pre-seal operations
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/replication/build_progress.mdx b/website/content/partials/telemetry-metrics/vault/core/replication/build_progress.mdx
deleted file mode 100644
index 44a00a2b956..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/replication/build_progress.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.replication.build_progress ((#vault-core-replication-build_progress))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | keys    | Number of keys that have been inserted into the new tree
diff --git a/website/content/partials/telemetry-metrics/vault/core/replication/build_total.mdx b/website/content/partials/telemetry-metrics/vault/core/replication/build_total.mdx
deleted file mode 100644
index f6d10a27307..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/replication/build_total.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.replication.build_total ((#vault-core-replication-build_total))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | keys    | Total number of keys that have to be inserted into the new tree
diff --git a/website/content/partials/telemetry-metrics/vault/core/replication/dr/primary.mdx b/website/content/partials/telemetry-metrics/vault/core/replication/dr/primary.mdx
deleted file mode 100644
index 2a278543a34..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/replication/dr/primary.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.core.replication.dr.primary ((#vault-core-replication-dr-primary))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | boolean | Indicates whether the Vault node is a disaster recovery primary
-
-- A value of `1` indicates that the node **is** a disaster recovery primary.
-- A value of `0` indicates that the node **is not** a disaster recovery primary.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/replication/dr/secondary.mdx b/website/content/partials/telemetry-metrics/vault/core/replication/dr/secondary.mdx
deleted file mode 100644
index fc7ccf4b631..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/replication/dr/secondary.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.core.replication.dr.secondary ((#vault-core-replication-dr-secondary))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | boolean | Indicates whether the Vault node is a disaster recovery secondary
-
-- A value of `1` indicates that the node **is** a disaster recovery secondary.
-- A value of `0` indicates that the node **is not** a disaster recovery secondary.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/replication/performance/primary.mdx b/website/content/partials/telemetry-metrics/vault/core/replication/performance/primary.mdx
deleted file mode 100644
index 417cdc74a1c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/replication/performance/primary.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.core.replication.performance.primary ((#vault-core-replication-performance-primary))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | boolean | Indicates whether the Vault node is a performance primary
-
-- A value of `1` indicates that the node **is** a performance primary.
-- A value of `0` indicates that the node **is not** a performance primary.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/replication/performance/secondary.mdx b/website/content/partials/telemetry-metrics/vault/core/replication/performance/secondary.mdx
deleted file mode 100644
index 9430574b7ef..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/replication/performance/secondary.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.core.replication.performance.secondary ((#vault-core-replication-performance-secondary))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | boolean | Indicates whether the Vault node is a performance secondary
-
-- A value of `1` indicates that the node **is** a performance secondary.
-- A value of `0` indicates that the node **is not** a performance secondary.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/replication/reindex_stage.mdx b/website/content/partials/telemetry-metrics/vault/core/replication/reindex_stage.mdx
deleted file mode 100644
index 315ff5a3f70..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/replication/reindex_stage.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
-### vault.core.replication.reindex_stage ((#vault-core-replication-reindex_stage))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | stage   | Current stage of the reindexing process
-
-- A value of `4` indicates the reindex process is committing any differences between the newly created tree and the old tree.
-- A value of `3` indicates the reindex process is replaying WALs to ensure no updates were missed while scanning and building.
-- A value of `2` indicates the reindex process is currently building a new merkle tree based of the values for the keys obtained in the scanning stage.
-- A value of `1` indicates the reindex process is currently creating a list of all known storage keys.
-- A value of `0` indicates that a reindex is not in progress.
diff --git a/website/content/partials/telemetry-metrics/vault/core/replication/write_undo_logs.mdx b/website/content/partials/telemetry-metrics/vault/core/replication/write_undo_logs.mdx
deleted file mode 100644
index 0208c34185a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/replication/write_undo_logs.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.core.replication.write_undo_logs ((#vault-core-replication-write_undo_logs))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | boolean | Indicates whether undo logs are enabled
-
-- A value of `1` indicates that Vault **is** generating undo logs. 
-- A value of `0` indicates that Vault **is not** generating undo logs.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/seal.mdx b/website/content/partials/telemetry-metrics/vault/core/seal.mdx
deleted file mode 100644
index 625d91c7def..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/seal.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.seal ((#vault-core-seal))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete seal operations
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/seal_decrypt.mdx b/website/content/partials/telemetry-metrics/vault/core/seal_decrypt.mdx
deleted file mode 100644
index 540c5cad13c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/seal_decrypt.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
-### vault.core.seal.decrypt ((#vault-core-seal))
-
-Metric type | Value  | Description
------------ | ------ | -----------
-counter     | number | The number of times a seal-wrapped value has been decrypted
-
-### vault.core.seal.decrypt.time ((#vault-core-seal))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | The time taken to seal decrypt a seal-wrapped value.
diff --git a/website/content/partials/telemetry-metrics/vault/core/seal_encrypt.mdx b/website/content/partials/telemetry-metrics/vault/core/seal_encrypt.mdx
deleted file mode 100644
index f1bdce02d44..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/seal_encrypt.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
-### vault.core.seal.encrypt ((#vault-core-seal))
-
-Metric type | Value  | Description
------------ | ------ | -----------
-counter     | number | The number of times a seal-wrapped value has been encrypted
-
-### vault.core.seal.encrypt.time ((#vault-core-seal))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | The time taken to seal encrypt a seal-wrapped value.
diff --git a/website/content/partials/telemetry-metrics/vault/core/seal_internal.mdx b/website/content/partials/telemetry-metrics/vault/core/seal_internal.mdx
deleted file mode 100644
index b56e47b801b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/seal_internal.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.seal-internal ((#vault-core-seal_internal))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete internal Vault seal operations
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/seal_unreachable.mdx b/website/content/partials/telemetry-metrics/vault/core/seal_unreachable.mdx
deleted file mode 100644
index 20a1f4881c3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/seal_unreachable.mdx
+++ /dev/null
@@ -1,6 +0,0 @@
-### vault.core.seal.unreachable.time ((#vault-core-seal))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | The total time a seal has been unreachable by health check.
-
diff --git a/website/content/partials/telemetry-metrics/vault/core/seal_with_request.mdx b/website/content/partials/telemetry-metrics/vault/core/seal_with_request.mdx
deleted file mode 100644
index c7aec3dccb5..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/seal_with_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.seal-with-request ((#vault-core-seal_with_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete seal operations that were triggered by explicit request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/step_down.mdx b/website/content/partials/telemetry-metrics/vault/core/step_down.mdx
deleted file mode 100644
index 3f4bf7d45d5..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/step_down.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.step_down ((#vault-core-step_down))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to step down cluster leadership
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/unseal.mdx b/website/content/partials/telemetry-metrics/vault/core/unseal.mdx
deleted file mode 100644
index 74a4aeb9623..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/unseal.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.core.unseal ((#vault-core-unseal))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete unseal operations
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/core/unsealed.mdx b/website/content/partials/telemetry-metrics/vault/core/unsealed.mdx
deleted file mode 100644
index b89881b766c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/core/unsealed.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-### vault.core.unsealed ((#vault-core-unsealed))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | boolean | Indicates whether Vault is currently unsealed
-
-- A value of `1` indicates Vault is currently **unsealed** and clients **can**
-  read secrets.
-- A value of `0` indicates Vault is currently **sealed** and clients **cannot**
-  read secrets.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/couchdb/delete.mdx b/website/content/partials/telemetry-metrics/vault/couchdb/delete.mdx
deleted file mode 100644
index 69b79117444..00000000000
--- a/website/content/partials/telemetry-metrics/vault/couchdb/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.couchdb.delete ((#vault-couchdb-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the CouchDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/couchdb/get.mdx b/website/content/partials/telemetry-metrics/vault/couchdb/get.mdx
deleted file mode 100644
index d365ae356a8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/couchdb/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.couchdb.get ((#vault-couchdb-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the CouchDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/couchdb/list.mdx b/website/content/partials/telemetry-metrics/vault/couchdb/list.mdx
deleted file mode 100644
index 4008909570d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/couchdb/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.couchdb.list ((#vault-couchdb-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the CouchDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/couchdb/put.mdx b/website/content/partials/telemetry-metrics/vault/couchdb/put.mdx
deleted file mode 100644
index b3343404545..00000000000
--- a/website/content/partials/telemetry-metrics/vault/couchdb/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.couchdb.put ((#vault-couchdb-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the CouchDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/dynamodb/delete.mdx b/website/content/partials/telemetry-metrics/vault/dynamodb/delete.mdx
deleted file mode 100644
index 75ebca602ca..00000000000
--- a/website/content/partials/telemetry-metrics/vault/dynamodb/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.dynamodb.delete ((#vault-dynamodb-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the DynamoDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/dynamodb/get.mdx b/website/content/partials/telemetry-metrics/vault/dynamodb/get.mdx
deleted file mode 100644
index b74b98b762a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/dynamodb/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.dynamodb.get ((#vault-dynamodb-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the DynamoDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/dynamodb/list.mdx b/website/content/partials/telemetry-metrics/vault/dynamodb/list.mdx
deleted file mode 100644
index 0de5b39a7c2..00000000000
--- a/website/content/partials/telemetry-metrics/vault/dynamodb/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.dynamodb.list ((#vault-dynamodb-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the DynamoDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/dynamodb/put.mdx b/website/content/partials/telemetry-metrics/vault/dynamodb/put.mdx
deleted file mode 100644
index 9e33d809c2f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/dynamodb/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.dynamodb.put ((#vault-dynamodb-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the DynamoDB storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/etcd/delete.mdx b/website/content/partials/telemetry-metrics/vault/etcd/delete.mdx
deleted file mode 100644
index d507f3e1b14..00000000000
--- a/website/content/partials/telemetry-metrics/vault/etcd/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.etcd.delete ((#vault-etcd-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the etcd storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/etcd/get.mdx b/website/content/partials/telemetry-metrics/vault/etcd/get.mdx
deleted file mode 100644
index 7ee846cefc8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/etcd/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.etcd.get ((#vault-etcd-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the etcd storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/etcd/list.mdx b/website/content/partials/telemetry-metrics/vault/etcd/list.mdx
deleted file mode 100644
index 956b8368345..00000000000
--- a/website/content/partials/telemetry-metrics/vault/etcd/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.etcd.list ((#vault-etcd-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the etcd storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/etcd/put.mdx b/website/content/partials/telemetry-metrics/vault/etcd/put.mdx
deleted file mode 100644
index 31a5f6fcb06..00000000000
--- a/website/content/partials/telemetry-metrics/vault/etcd/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.etcd.put ((#vault-etcd-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the etcd storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/fetch_lease_times.mdx b/website/content/partials/telemetry-metrics/vault/expire/fetch_lease_times.mdx
deleted file mode 100644
index 85fec28fc26..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/fetch_lease_times.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.fetch-lease-times ((#vault-expire-fetch_lease_times))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to retrieve lease times
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/fetch_lease_times_by_token.mdx b/website/content/partials/telemetry-metrics/vault/expire/fetch_lease_times_by_token.mdx
deleted file mode 100644
index 184df6770c3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/fetch_lease_times_by_token.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.fetch-lease-times-by-token ((#vault-expire-fetch_lease_times_by_token))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to retrieve lease times by token
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/job_manager/queue_length.mdx b/website/content/partials/telemetry-metrics/vault/expire/job_manager/queue_length.mdx
deleted file mode 100644
index ffa5c4a00b8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/job_manager/queue_length.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.expire.job_manager.queue_length ((#vault-expire-job_manager-queue_length))
-
-Metric type | Value  | Description
------------ | ------ | -----------
-summary     | leases | The total number of pending revocation jobs by `queue_id`
-
-The queue ID in the `queue_id` label indicates the mount accessor associated
-with the expiring lease. For example, the secrets engine or authentication method.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/job_manager/total_jobs.mdx b/website/content/partials/telemetry-metrics/vault/expire/job_manager/total_jobs.mdx
deleted file mode 100644
index 06051efdf2a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/job_manager/total_jobs.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.job_manager.total_jobs ((#vault-expire-job_manager-total_jobs))
-
-Metric type | Value  | Description
------------ | ------ | -----------
-summary     | leases | The total number of pending revocation jobs
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/lease_expiration.mdx b/website/content/partials/telemetry-metrics/vault/expire/lease_expiration.mdx
deleted file mode 100644
index d4671039cbd..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/lease_expiration.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.lease_expiration ((#vault-expire-lease_expiration))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | The number of lease expirations to date
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/lease_expiration/error.mdx b/website/content/partials/telemetry-metrics/vault/expire/lease_expiration/error.mdx
deleted file mode 100644
index d08f382baa8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/lease_expiration/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.lease_expiration.error ((#vault-expire-lease_expiration-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | The total number of lease expiration errors
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/lease_expiration/time_in_queue.mdx b/website/content/partials/telemetry-metrics/vault/expire/lease_expiration/time_in_queue.mdx
deleted file mode 100644
index 4499a044930..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/lease_expiration/time_in_queue.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.lease_expiration.time_in_queue ((#vault-expire-lease_expiration-time_in_queue))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken for a lease to get to the front of the revoke queue
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/leases/by_expiration.mdx b/website/content/partials/telemetry-metrics/vault/expire/leases/by_expiration.mdx
deleted file mode 100644
index 53706620911..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/leases/by_expiration.mdx
+++ /dev/null
@@ -1,15 +0,0 @@
-### vault.expire.leases.by_expiration ((#vault-expire-leases-by_expiration))
-
-Metric type | Value  | Description
------------ | ------ | -----------
-gauge       | leases | The number of leases set to expire, grouped by the configured interval
-
-The relevant time intervals are defined in the telemetry stanza for your
-Vault server configuration with the following parameters:
-
-- `lease_metrics_epsilon`: 1 hour (default)
-- `num_lease_metrics_buckets`:  168 hours (default)
-- `add_lease_metrics_namespace_labels`: false (default)
-
-Vault reports the number of leases due to expire every `lease_metrics_epsilon`
-interval in the time period `current_time + num_lease_metrics_buckets`.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/num_irrevocable_leases.mdx b/website/content/partials/telemetry-metrics/vault/expire/num_irrevocable_leases.mdx
deleted file mode 100644
index 979f2909ff6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/num_irrevocable_leases.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.num_irrevocable_leases ((#vault-expire-num_irrevocable_leases))
-
-Metric type | Value  | Description
------------ | ------ | -----------
-gauge       | leases | The number of leases that cannot be automatically revoked
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/num_leases.mdx b/website/content/partials/telemetry-metrics/vault/expire/num_leases.mdx
deleted file mode 100644
index 49faec3220c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/num_leases.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.num_leases ((#vault-expire-num_leases))
-
-Metric type | Value  | Description
------------ | ------ | -----------
-gauge       | leases | The total number of leases eligible for eventual expiry
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/register.mdx b/website/content/partials/telemetry-metrics/vault/expire/register.mdx
deleted file mode 100644
index 64aba27b351..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/register.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.register ((#vault-expire-register))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken for register operations
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/register_auth.mdx b/website/content/partials/telemetry-metrics/vault/expire/register_auth.mdx
deleted file mode 100644
index d15a32e937e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/register_auth.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.register-auth ((#vault-expire-register_auth))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to register leases associated with new service tokens
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/renew.mdx b/website/content/partials/telemetry-metrics/vault/expire/renew.mdx
deleted file mode 100644
index ce0ed440847..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/renew.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.renew ((#vault-expire-renew))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to renew a lease
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/renew_token.mdx b/website/content/partials/telemetry-metrics/vault/expire/renew_token.mdx
deleted file mode 100644
index 0b90c35c333..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/renew_token.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.renew-token ((#vault-expire-renew_token))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to renew a token
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/revoke.mdx b/website/content/partials/telemetry-metrics/vault/expire/revoke.mdx
deleted file mode 100644
index 6fe0579a5dd..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/revoke.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.revoke ((#vault-expire-revoke))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to revoke a token
diff --git a/website/content/partials/telemetry-metrics/vault/expire/revoke_by_token.mdx b/website/content/partials/telemetry-metrics/vault/expire/revoke_by_token.mdx
deleted file mode 100644
index 9e1ca80423b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/revoke_by_token.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.revoke-by-token ((#vault-expire-revoke_by_token))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to revoke all secrets issued with a given token
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/revoke_force.mdx b/website/content/partials/telemetry-metrics/vault/expire/revoke_force.mdx
deleted file mode 100644
index 906286a020b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/revoke_force.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.revoke-force ((#vault-expire-revoke_force))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to forcibly revoke a token
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/expire/revoke_prefix.mdx b/website/content/partials/telemetry-metrics/vault/expire/revoke_prefix.mdx
deleted file mode 100644
index 89bc534bfd4..00000000000
--- a/website/content/partials/telemetry-metrics/vault/expire/revoke_prefix.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.expire.revoke-prefix ((#vault-expire-revoke_prefix))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to revoke all tokens on a prefix
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/gcs/delete.mdx b/website/content/partials/telemetry-metrics/vault/gcs/delete.mdx
deleted file mode 100644
index 8d123ea2f05..00000000000
--- a/website/content/partials/telemetry-metrics/vault/gcs/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.gcs.delete ((#vault-gcs-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the Google Cloud Storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/gcs/get.mdx b/website/content/partials/telemetry-metrics/vault/gcs/get.mdx
deleted file mode 100644
index 87addebb200..00000000000
--- a/website/content/partials/telemetry-metrics/vault/gcs/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.gcs.get ((#vault-gcs-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the Google Cloud Storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/gcs/list.mdx b/website/content/partials/telemetry-metrics/vault/gcs/list.mdx
deleted file mode 100644
index 7c92e5b5474..00000000000
--- a/website/content/partials/telemetry-metrics/vault/gcs/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.gcs.list ((#vault-gcs-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the Google Cloud Storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/gcs/lock/lock.mdx b/website/content/partials/telemetry-metrics/vault/gcs/lock/lock.mdx
deleted file mode 100644
index ccee8eb79bf..00000000000
--- a/website/content/partials/telemetry-metrics/vault/gcs/lock/lock.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.gcs.lock.lock ((#vault-gcs-lock-lock))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LOCK` operation against the Google Cloud Storage backend in high-availability mode
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/gcs/lock/unlock.mdx b/website/content/partials/telemetry-metrics/vault/gcs/lock/unlock.mdx
deleted file mode 100644
index b1488f76094..00000000000
--- a/website/content/partials/telemetry-metrics/vault/gcs/lock/unlock.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.gcs.lock.unlock ((#vault-gcs-lock-unlock))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete an `UNLOCK` operation against the Google Cloud Storage backend in high-availability mode
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/gcs/lock/value.mdx b/website/content/partials/telemetry-metrics/vault/gcs/lock/value.mdx
deleted file mode 100644
index b5dd33150c2..00000000000
--- a/website/content/partials/telemetry-metrics/vault/gcs/lock/value.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.gcs.lock.value ((#vault-gcs-lock-value))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `VALUE` operation against the Google Cloud Storage backend in high-availability mode
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/gcs/put.mdx b/website/content/partials/telemetry-metrics/vault/gcs/put.mdx
deleted file mode 100644
index d47fec7436d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/gcs/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.gcs.put ((#vault-gcs-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the Google Cloud Storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/ha/rpc/client/echo.mdx b/website/content/partials/telemetry-metrics/vault/ha/rpc/client/echo.mdx
deleted file mode 100644
index 180d3d36684..00000000000
--- a/website/content/partials/telemetry-metrics/vault/ha/rpc/client/echo.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.ha.rpc.client.echo ((#vault-ha-rpc-client-echo))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to send an echo request from a standby to the active node (also emitted by perf standbys)
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/ha/rpc/client/echo/errors.mdx b/website/content/partials/telemetry-metrics/vault/ha/rpc/client/echo/errors.mdx
deleted file mode 100644
index 663495485a0..00000000000
--- a/website/content/partials/telemetry-metrics/vault/ha/rpc/client/echo/errors.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.ha.rpc.client.echo.errors ((#vault-ha-rpc-client-echo-errors))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of standby echo request failures (also emitted by perf standbys)
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/ha/rpc/client/forward.mdx b/website/content/partials/telemetry-metrics/vault/ha/rpc/client/forward.mdx
deleted file mode 100644
index 3ecc4b54e0e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/ha/rpc/client/forward.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.ha.rpc.client.forward ((#vault-ha-rpc-client-forward))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time taken to forward a request from a standby to the active node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/ha/rpc/client/forward/errors.mdx b/website/content/partials/telemetry-metrics/vault/ha/rpc/client/forward/errors.mdx
deleted file mode 100644
index d70d2b66ff4..00000000000
--- a/website/content/partials/telemetry-metrics/vault/ha/rpc/client/forward/errors.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.ha.rpc.client.forward.errors ((#vault-ha-rpc-client-forward-errors))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of standby request forwarding failures
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/identity/entity/active/monthly.mdx b/website/content/partials/telemetry-metrics/vault/identity/entity/active/monthly.mdx
deleted file mode 100644
index f635152be1e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/identity/entity/active/monthly.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.identity.entity.active.monthly ((#vault-identity-entity-active-monthly))
-
-Metric type | Value    | Description
------------ | -------- | -----------
-gauge       | entities | The number of distinct entities (per namespace) that created a token during the past month
-
-Vault reports `vault.identity.entity.active.monthly` at the start of each month
-when client counting is enabled.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/identity/entity/active/partial_month.mdx b/website/content/partials/telemetry-metrics/vault/identity/entity/active/partial_month.mdx
deleted file mode 100644
index 38ef1261ca0..00000000000
--- a/website/content/partials/telemetry-metrics/vault/identity/entity/active/partial_month.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.identity.entity.active.partial_month ((#vault-identity-entity-active-partial_month))
-
-Metric type | Value    | Description
------------ | -------- | -----------
-gauge       | entities | The number of distinct entities (per namespace) that created a token during the current month
-
-Vault reports `vault.identity.entity.active.partial_month` periodically during
-the month when client counting is enabled.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/identity/entity/active/reporting_period.mdx b/website/content/partials/telemetry-metrics/vault/identity/entity/active/reporting_period.mdx
deleted file mode 100644
index 7ba234c3f53..00000000000
--- a/website/content/partials/telemetry-metrics/vault/identity/entity/active/reporting_period.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.identity.entity.active.reporting_period ((#vault-identity-entity-active-reporting_period))
-
-Metric type | Value    | Description
------------ | -------- | -----------
-gauge       | entities | The number of distinct entities (per namespace) that created a token during the configured reporting period
-
-Vault reports `vault.identity.entity.active.reporting_period` at the start of
-each month when client counting is enabled.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/identity/entity/alias/count.mdx b/website/content/partials/telemetry-metrics/vault/identity/entity/alias/count.mdx
deleted file mode 100644
index 51c02787e56..00000000000
--- a/website/content/partials/telemetry-metrics/vault/identity/entity/alias/count.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-### vault.identity.entity.alias.count ((#vault-identity-entity-alias-count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | aliases | The number of identity entities aliases (per authN mount) currently stored in Vault
-
-Vault updates the alias count every `usage_gauge_period` interval.
diff --git a/website/content/partials/telemetry-metrics/vault/identity/entity/count.mdx b/website/content/partials/telemetry-metrics/vault/identity/entity/count.mdx
deleted file mode 100644
index 439ef4ad1e8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/identity/entity/count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.identity.entity.count ((#vault-identity-entity-count))
-
-Metric type | Value    | Description
------------ | -------- | -----------
-gauge       | entities | The number of identity entity aliases (per namespace) currently stored in Vault
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/identity/entity/creation.mdx b/website/content/partials/telemetry-metrics/vault/identity/entity/creation.mdx
deleted file mode 100644
index a8eb5099063..00000000000
--- a/website/content/partials/telemetry-metrics/vault/identity/entity/creation.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.identity.entity.creation ((#vault-identity-entity-creation))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | The number of identity entities created per namespace
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/identity/num_entities.mdx b/website/content/partials/telemetry-metrics/vault/identity/num_entities.mdx
deleted file mode 100644
index 0e04a862dcc..00000000000
--- a/website/content/partials/telemetry-metrics/vault/identity/num_entities.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.identity.num_entities ((#vault-identity-num_entities))
-
-Metric type | Value    | Description
------------ | -------- | -----------
-gauge       | entities | The total number of identity entities currently stored in Vault
diff --git a/website/content/partials/telemetry-metrics/vault/identity/upsert_entity_txn.mdx b/website/content/partials/telemetry-metrics/vault/identity/upsert_entity_txn.mdx
deleted file mode 100644
index 7649262602b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/identity/upsert_entity_txn.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.identity.upsert_entity_txn ((#vault-identity-upsert_entity_txn))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to upsert an entity to the in-memory database and, on the active node, persist the data to storage
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/identity/upsert_group_txn.mdx b/website/content/partials/telemetry-metrics/vault/identity/upsert_group_txn.mdx
deleted file mode 100644
index c9fcba22f8c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/identity/upsert_group_txn.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.identity.upsert_group_txn ((#vault-identity-upsert_group_txn))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to upsert group membership to the in-memory database and, on the active node, persist the data to storage
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/logshipper/buffer/length.mdx b/website/content/partials/telemetry-metrics/vault/logshipper/buffer/length.mdx
deleted file mode 100644
index 21d53621a0c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/logshipper/buffer/length.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.logshipper.buffer.length ((#vault-logshipper-buffer-length))
-
-Metric type | Value          | Description
------------ | -------------- | -----------
-gauge       | buffer entries | Current length of the log shipper buffer
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/logshipper/buffer/max_length.mdx b/website/content/partials/telemetry-metrics/vault/logshipper/buffer/max_length.mdx
deleted file mode 100644
index e11b90b03e4..00000000000
--- a/website/content/partials/telemetry-metrics/vault/logshipper/buffer/max_length.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.logshipper.buffer.max_length ((#vault-logshipper-buffer-max_length))
-
-Metric type | Value          | Description
------------ | -------------- | -----------
-gauge       | buffer entries | Maximum length of the log shipper buffer seen to date
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/logshipper/buffer/max_size.mdx b/website/content/partials/telemetry-metrics/vault/logshipper/buffer/max_size.mdx
deleted file mode 100644
index 2250069dc94..00000000000
--- a/website/content/partials/telemetry-metrics/vault/logshipper/buffer/max_size.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.logshipper.buffer.max_size ((#vault-logshipper-buffer-max_size))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | bytes | Maximum allowable size of the log shipper buffer
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/logshipper/buffer/size.mdx b/website/content/partials/telemetry-metrics/vault/logshipper/buffer/size.mdx
deleted file mode 100644
index 9581a0bb508..00000000000
--- a/website/content/partials/telemetry-metrics/vault/logshipper/buffer/size.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.logshipper.buffer.size ((#vault-logshipper-buffer-size))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | bytes | Current size of the log shipper buffer
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/logshipper/streamwals/guard_found.mdx b/website/content/partials/telemetry-metrics/vault/logshipper/streamwals/guard_found.mdx
deleted file mode 100644
index d4a92efc12d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/logshipper/streamwals/guard_found.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.logshipper.streamWALs.guard_found ((#vault-logshipper-streamwals-guard_found))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of times Vault began streaming WAL entires and found a starting index in the merkle tree
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/logshipper/streamwals/missing_guard.mdx b/website/content/partials/telemetry-metrics/vault/logshipper/streamwals/missing_guard.mdx
deleted file mode 100644
index e07ee008fa0..00000000000
--- a/website/content/partials/telemetry-metrics/vault/logshipper/streamwals/missing_guard.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.logshipper.streamWALs.missing_guard ((#vault-logshipper-streamwals-missing_guard))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of times Vault began streaming WAL entires without finding a starting index in the Merkle tree
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/logshipper/streamwals/scanned_entries.mdx b/website/content/partials/telemetry-metrics/vault/logshipper/streamwals/scanned_entries.mdx
deleted file mode 100644
index 701aed98506..00000000000
--- a/website/content/partials/telemetry-metrics/vault/logshipper/streamwals/scanned_entries.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.logshipper.streamWALs.scanned_entries ((#vault-logshipper-streamwals-scanned_entries))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-summary     | entries | Number of entries scanned in the buffer before Vault found the correct entry
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/merkle/flushdirty.mdx b/website/content/partials/telemetry-metrics/vault/merkle/flushdirty.mdx
deleted file mode 100644
index 3b19b69fff6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/merkle/flushdirty.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.merkle.flushDirty ((#vault-merkle-flushdirty))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | The average time required to flush dirty pages to storage
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/merkle/flushdirty/num_pages.mdx b/website/content/partials/telemetry-metrics/vault/merkle/flushdirty/num_pages.mdx
deleted file mode 100644
index 2b12f1867b5..00000000000
--- a/website/content/partials/telemetry-metrics/vault/merkle/flushdirty/num_pages.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.merkle.flushDirty.num_pages ((#vault-merkle-flushdirty-num_pages))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | pages | Number of pages flushed
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/merkle/flushdirty/outstanding_pages.mdx b/website/content/partials/telemetry-metrics/vault/merkle/flushdirty/outstanding_pages.mdx
deleted file mode 100644
index 02049d666dd..00000000000
--- a/website/content/partials/telemetry-metrics/vault/merkle/flushdirty/outstanding_pages.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.merkle.flushDirty.outstanding_pages ((#vault-merkle-flushdirty-outstanding_pages))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | pages | Number of dirty pages waiting to be flushed
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/merkle/savecheckpoint.mdx b/website/content/partials/telemetry-metrics/vault/merkle/savecheckpoint.mdx
deleted file mode 100644
index 2c747952830..00000000000
--- a/website/content/partials/telemetry-metrics/vault/merkle/savecheckpoint.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.merkle.saveCheckpoint ((#vault-merkle-savecheckpoint))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | The average time required to save a checkpoint
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/merkle/savecheckpoint/num_dirty.mdx b/website/content/partials/telemetry-metrics/vault/merkle/savecheckpoint/num_dirty.mdx
deleted file mode 100644
index 073d17dcec1..00000000000
--- a/website/content/partials/telemetry-metrics/vault/merkle/savecheckpoint/num_dirty.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.merkle.saveCheckpoint.num_dirty ((#vault-merkle-savecheckpoint-num_dirty))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | pages | Number of dirty pages at checkpoint
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/metrics/collection.mdx b/website/content/partials/telemetry-metrics/vault/metrics/collection.mdx
deleted file mode 100644
index 0c7d4003cf4..00000000000
--- a/website/content/partials/telemetry-metrics/vault/metrics/collection.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.metrics.collection ((#vault-metrics-collection))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | The average time required (per gauge type) to collect usage data
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/metrics/collection/error.mdx b/website/content/partials/telemetry-metrics/vault/metrics/collection/error.mdx
deleted file mode 100644
index 2529ee94bbb..00000000000
--- a/website/content/partials/telemetry-metrics/vault/metrics/collection/error.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.metrics.collection.error ((#vault-metrics-collection-error))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | The total number of errors (per gauge type) that Vault encountered while collecting usage data
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/metrics/collection/interval.mdx b/website/content/partials/telemetry-metrics/vault/metrics/collection/interval.mdx
deleted file mode 100644
index 9a70e8f3c0d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/metrics/collection/interval.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.metrics.collection.interval ((#vault-metrics-collection-interval))
-
-Metric type | Units         | Description
------------ | ------------- | -----------
-summary     | time duration | The current value of `usage_gauge_period`
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/mssql/delete.mdx b/website/content/partials/telemetry-metrics/vault/mssql/delete.mdx
deleted file mode 100644
index c012c285b5e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/mssql/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.mssql.delete ((#vault-mssql-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the Microsoft SQL Server storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/mssql/get.mdx b/website/content/partials/telemetry-metrics/vault/mssql/get.mdx
deleted file mode 100644
index f52ac86e66f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/mssql/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.mssql.get ((#vault-mssql-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the Microsoft SQL Server storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/mssql/list.mdx b/website/content/partials/telemetry-metrics/vault/mssql/list.mdx
deleted file mode 100644
index 18fab3fdcb3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/mssql/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.mssql.list ((#vault-mssql-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the Microsoft SQL Server storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/mssql/put.mdx b/website/content/partials/telemetry-metrics/vault/mssql/put.mdx
deleted file mode 100644
index 0b446b21c77..00000000000
--- a/website/content/partials/telemetry-metrics/vault/mssql/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.mssql.put ((#vault-mssql-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the Microsoft SQL Server storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/mysql/delete.mdx b/website/content/partials/telemetry-metrics/vault/mysql/delete.mdx
deleted file mode 100644
index 9855b56bd4a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/mysql/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.mysql.delete ((#vault-mysql-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the MySQL storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/mysql/get.mdx b/website/content/partials/telemetry-metrics/vault/mysql/get.mdx
deleted file mode 100644
index 95d5da625b8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/mysql/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.mysql.get ((#vault-mysql-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the MySQL storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/mysql/list.mdx b/website/content/partials/telemetry-metrics/vault/mysql/list.mdx
deleted file mode 100644
index 8961647fc15..00000000000
--- a/website/content/partials/telemetry-metrics/vault/mysql/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.mysql.list ((#vault-mysql-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the MySQL storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/mysql/put.mdx b/website/content/partials/telemetry-metrics/vault/mysql/put.mdx
deleted file mode 100644
index c2d1854c4fe..00000000000
--- a/website/content/partials/telemetry-metrics/vault/mysql/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.mysql.put ((#vault-mysql-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the MySQL storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/policy/delete_policy.mdx b/website/content/partials/telemetry-metrics/vault/policy/delete_policy.mdx
deleted file mode 100644
index 95363fcbb90..00000000000
--- a/website/content/partials/telemetry-metrics/vault/policy/delete_policy.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.policy.delete_policy ((#vault-policy-delete_policy))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to delete a policy
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/policy/get_policy.mdx b/website/content/partials/telemetry-metrics/vault/policy/get_policy.mdx
deleted file mode 100644
index cdfbbc1a2f8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/policy/get_policy.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.policy.get_policy ((#vault-policy-get_policy))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to read a policy
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/policy/list_policies.mdx b/website/content/partials/telemetry-metrics/vault/policy/list_policies.mdx
deleted file mode 100644
index 05a97e5ce36..00000000000
--- a/website/content/partials/telemetry-metrics/vault/policy/list_policies.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.policy.list_policies ((#vault-policy-list_policies))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to list all policies
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/policy/set_policy.mdx b/website/content/partials/telemetry-metrics/vault/policy/set_policy.mdx
deleted file mode 100644
index 9b92b926372..00000000000
--- a/website/content/partials/telemetry-metrics/vault/policy/set_policy.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.policy.set_policy ((#vault-policy-set_policy))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to set a policy
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/postgres/delete.mdx b/website/content/partials/telemetry-metrics/vault/postgres/delete.mdx
deleted file mode 100644
index 89ee21a1a52..00000000000
--- a/website/content/partials/telemetry-metrics/vault/postgres/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.postgres.delete ((#vault-postgres-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the PostgeSQL storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/postgres/get.mdx b/website/content/partials/telemetry-metrics/vault/postgres/get.mdx
deleted file mode 100644
index d5e539be53c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/postgres/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.postgres.get ((#vault-postgres-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the PostgeSQL storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/postgres/list.mdx b/website/content/partials/telemetry-metrics/vault/postgres/list.mdx
deleted file mode 100644
index 1d4d003fa1a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/postgres/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.postgres.list ((#vault-postgres-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the PostgeSQL storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/postgres/put.mdx b/website/content/partials/telemetry-metrics/vault/postgres/put.mdx
deleted file mode 100644
index 7e60bfadba0..00000000000
--- a/website/content/partials/telemetry-metrics/vault/postgres/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.postgres.put ((#vault-postgres-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the PostgeSQL storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/quota/lease_count/counter.mdx b/website/content/partials/telemetry-metrics/vault/quota/lease_count/counter.mdx
deleted file mode 100644
index c9662c6233b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/quota/lease_count/counter.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
-### vault.quota.lease_count.counter ((#vault-quota-lease_count-counter))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | lease | Total number of leases associated with the named quota rule
-
-The number of leases reported is specific to the quota rule listed in the `name`
-label, not the number of leases in general. For example, if the named rule
-allows for 50 leases max and there are currently 40 leases in the scope of that
-quota rule, the value of `vault.quota.lease_count.counter` is 40 even if there
-are 1000 other leases that are unscoped or in the scope of other quota rules.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/quota/lease_count/max.mdx b/website/content/partials/telemetry-metrics/vault/quota/lease_count/max.mdx
deleted file mode 100644
index 4c56717c321..00000000000
--- a/website/content/partials/telemetry-metrics/vault/quota/lease_count/max.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.quota.lease_count.max ((#vault-quota-lease_count-max))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | lease | Maximum number of leases allowed by the named quota rule
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/quota/lease_count/violation.mdx b/website/content/partials/telemetry-metrics/vault/quota/lease_count/violation.mdx
deleted file mode 100644
index 29c771de79b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/quota/lease_count/violation.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.quota.lease_count.violation ((#vault-quota-lease_count-violation))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of requests rejected due to exceeding the named lease count quota
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/quota/rate_limit/violation.mdx b/website/content/partials/telemetry-metrics/vault/quota/rate_limit/violation.mdx
deleted file mode 100644
index 624b82d9de0..00000000000
--- a/website/content/partials/telemetry-metrics/vault/quota/rate_limit/violation.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.quota.rate_limit.violation ((#vault-quota-rate_limit-violation))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of requests rejected due to exceeding the named rate limit quota rule
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft-storage/delete.mdx b/website/content/partials/telemetry-metrics/vault/raft-storage/delete.mdx
deleted file mode 100644
index 902fefb5b9e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft-storage/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft-storage.delete ((#vault-raft_storage-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to insert log entry to delete path
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft-storage/entry_size.mdx b/website/content/partials/telemetry-metrics/vault/raft-storage/entry_size.mdx
deleted file mode 100644
index a3ce1e79ae8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft-storage/entry_size.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft-storage.entry_size ((#vault-raft_storage-entry_size))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | bytes | The total size of a raft entry during log application
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft-storage/get.mdx b/website/content/partials/telemetry-metrics/vault/raft-storage/get.mdx
deleted file mode 100644
index 7aeeb0aab85..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft-storage/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft-storage.get ((#vault-raft_storage-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to retrieve a value for the given path from the finite state machine
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft-storage/list.mdx b/website/content/partials/telemetry-metrics/vault/raft-storage/list.mdx
deleted file mode 100644
index 1909d25b834..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft-storage/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft-storage.list ((#vault-raft_storage-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to list all entries under the prefix from the finite state machine
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft-storage/put.mdx b/website/content/partials/telemetry-metrics/vault/raft-storage/put.mdx
deleted file mode 100644
index 013e4af683b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft-storage/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft-storage.put ((#vault-raft_storage-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to insert a log entry to the persist path
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft-storage/transaction.mdx b/website/content/partials/telemetry-metrics/vault/raft-storage/transaction.mdx
deleted file mode 100644
index 35d5926dfd3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft-storage/transaction.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft-storage.transaction ((#vault-raft_storage-transaction))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to insert operations into a single log
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/apply.mdx b/website/content/partials/telemetry-metrics/vault/raft/apply.mdx
deleted file mode 100644
index 976b0f910f6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/apply.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.raft.apply ((#vault-raft-apply))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of transactions in the configured interval
-
-The `vault.raft.apply` metric is generally a good indicator of the write load
-on your raft internal storage.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/barrier.mdx b/website/content/partials/telemetry-metrics/vault/raft/barrier.mdx
deleted file mode 100644
index 05ef62b5fcf..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/barrier.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### vault.raft.barrier ((#vault-raft-barrier))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of times the node started the barrier
-
-A node starts the barrier by issuing a blocking call when it wants to ensure
-that all pending operations that need to be applied to the finite state machine
-are properly queued.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/candidate/electself.mdx b/website/content/partials/telemetry-metrics/vault/raft/candidate/electself.mdx
deleted file mode 100644
index c3902cfa6e4..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/candidate/electself.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.candidate.electSelf ((#vault-raft-candidate-electself))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required for a node to send a vote request to a peer
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/commitnumlogs.mdx b/website/content/partials/telemetry-metrics/vault/raft/commitnumlogs.mdx
deleted file mode 100644
index 3a63bc5260a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/commitnumlogs.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.commitNumLogs ((#vault-raft-commitnumlogs))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of logs processed for application to the finite state machine in a single batch
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/committime.mdx b/website/content/partials/telemetry-metrics/vault/raft/committime.mdx
deleted file mode 100644
index 97703eed15a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/committime.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.commitTime ((#vault-raft-committime))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to commit a new entry to the raft log on the leader node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/compactlogs.mdx b/website/content/partials/telemetry-metrics/vault/raft/compactlogs.mdx
deleted file mode 100644
index 40d34a04573..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/compactlogs.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.compactLogs ((#vault-raft-compactlogs))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to trim unnecessary logs
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/fsm/apply.mdx b/website/content/partials/telemetry-metrics/vault/raft/fsm/apply.mdx
deleted file mode 100644
index 78cacb3c852..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/fsm/apply.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.fsm.apply ((#vault-raft-fsm-apply))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-summary     | number  | Number of logs committed by the finite state machine since the last interval
diff --git a/website/content/partials/telemetry-metrics/vault/raft/fsm/applybatch.mdx b/website/content/partials/telemetry-metrics/vault/raft/fsm/applybatch.mdx
deleted file mode 100644
index c2171db4b59..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/fsm/applybatch.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.fsm.applyBatch ((#vault-raft-fsm-applybatch))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required by the finite state machine to apply the most recent batch of logs
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/fsm/applybatchnum.mdx b/website/content/partials/telemetry-metrics/vault/raft/fsm/applybatchnum.mdx
deleted file mode 100644
index 282665746dc..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/fsm/applybatchnum.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.fsm.applyBatchNum ((#vault-raft-fsm-applybatchnum))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of logs applied in the most recent batch
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/fsm/enqueue.mdx b/website/content/partials/telemetry-metrics/vault/raft/fsm/enqueue.mdx
deleted file mode 100644
index 9e40a0aec30..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/fsm/enqueue.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.fsm.enqueue ((#vault-raft-fsm-enqueue))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to queue up a batch of logs for the finite state machine to apply
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/fsm/restore.mdx b/website/content/partials/telemetry-metrics/vault/raft/fsm/restore.mdx
deleted file mode 100644
index e8552e42c2e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/fsm/restore.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.fsm.restore ((#vault-raft-fsm-restore))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required by the finite state machine to complete a restore operation from a snapshot
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/fsm/snapshot.mdx b/website/content/partials/telemetry-metrics/vault/raft/fsm/snapshot.mdx
deleted file mode 100644
index 0bc1d3bd94b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/fsm/snapshot.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.fsm.snapshot ((#vault-raft-fsm-snapshot))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required by the finite state machine to record state information for the current snapshot
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/fsm/store_config.mdx b/website/content/partials/telemetry-metrics/vault/raft/fsm/store_config.mdx
deleted file mode 100644
index 1f10be0f073..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/fsm/store_config.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.fsm.store_config ((#vault-raft-fsm-store_config))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to store the most recent raft configuration
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/get.mdx b/website/content/partials/telemetry-metrics/vault/raft/get.mdx
deleted file mode 100644
index b92212501b3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.get ((#vault-raft-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to retrieve an entry from underlying storage
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/leader/dispatchlog.mdx b/website/content/partials/telemetry-metrics/vault/raft/leader/dispatchlog.mdx
deleted file mode 100644
index 06eef49b121..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/leader/dispatchlog.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.leader.dispatchLog ((#vault-raft-leader-dispatchlog))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required for the leader node to write a log entry to disk
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/leader/dispatchnumlogs.mdx b/website/content/partials/telemetry-metrics/vault/raft/leader/dispatchnumlogs.mdx
deleted file mode 100644
index d60a47da553..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/leader/dispatchnumlogs.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.leader.dispatchNumLogs ((#vault-raft-leader-dispatchnumlogs))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of logs committed to disk in the most recent batch
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/leader/lastcontact.mdx b/website/content/partials/telemetry-metrics/vault/raft/leader/lastcontact.mdx
deleted file mode 100644
index 7cf793311b9..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/leader/lastcontact.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.leader.lastContact ((#vault-raft-leader-lastcontact))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time since the leader was last able to contact the follower nodes when checking its leader lease
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/list.mdx b/website/content/partials/telemetry-metrics/vault/raft/list.mdx
deleted file mode 100644
index 28d13333107..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.list ((#vault-raft-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to retrieve a list of keys from underlying storage
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/peers.mdx b/website/content/partials/telemetry-metrics/vault/raft/peers.mdx
deleted file mode 100644
index 1e68005323a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/peers.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.peers ((#vault-raft-peers))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-guage       | number  | The number of peers in the raft cluster configuration
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/replication/appendentries/log.mdx b/website/content/partials/telemetry-metrics/vault/raft/replication/appendentries/log.mdx
deleted file mode 100644
index 1b31d5ee4f8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/replication/appendentries/log.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.replication.appendEntries.log ((#vault-raft-replication-appendentries-log))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-summary     | number  | Number of logs replicated to a node to establish parity with leader logs 
diff --git a/website/content/partials/telemetry-metrics/vault/raft/replication/appendentries/rpc.mdx b/website/content/partials/telemetry-metrics/vault/raft/replication/appendentries/rpc.mdx
deleted file mode 100644
index 9e4cdb4b4fd..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/replication/appendentries/rpc.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.replication.appendEntries.rpc ((#vault-raft-replication-appendentries-rpc))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to replicate leader node log entries to all follower nodes with `appendEntries`
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/replication/heartbeat.mdx b/website/content/partials/telemetry-metrics/vault/raft/replication/heartbeat.mdx
deleted file mode 100644
index 9e24bc2134f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/replication/heartbeat.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.replication.heartbeat ((#vault-raft-replication-heartbeat))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to invoke `appendEntries` on a peer so the peer does not time out
diff --git a/website/content/partials/telemetry-metrics/vault/raft/replication/installsnapshot.mdx b/website/content/partials/telemetry-metrics/vault/raft/replication/installsnapshot.mdx
deleted file mode 100644
index 266d97702c6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/replication/installsnapshot.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.raft.replication.installSnapshot ((#vault-raft-replication-installsnapshot))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to process an `installSnapshot` RPC call
-
-Only nodes currently in the `follower` state report
-`vault.raft.replication.installSnapshot` metrics.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/restore.mdx b/website/content/partials/telemetry-metrics/vault/raft/restore.mdx
deleted file mode 100644
index 32dda607a73..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/restore.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.raft.restore ((#vault-raft-restore))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of times that the node performed a restore operation
-
-In the context of raft storage, a restore operation refers to the process where
-raft consumes an external snapshot to restore its state.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/restoreusersnapshot.mdx b/website/content/partials/telemetry-metrics/vault/raft/restoreusersnapshot.mdx
deleted file mode 100644
index 877cf6f563d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/restoreusersnapshot.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.restoreUserSnapshot ((#vault-raft-restoreusersnapshot))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to restore the finite state machine from a user snapshot
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/rpc/appendentries.mdx b/website/content/partials/telemetry-metrics/vault/raft/rpc/appendentries.mdx
deleted file mode 100644
index 85b0ad1bc9d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/rpc/appendentries.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.rpc.appendEntries ((#vault-raft-rpc-appendentries))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to process a remote `appendEntries` call from a node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/rpc/appendentries/processlogs.mdx b/website/content/partials/telemetry-metrics/vault/raft/rpc/appendentries/processlogs.mdx
deleted file mode 100644
index 4a7bdc7d465..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/rpc/appendentries/processlogs.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.rpc.appendEntries.processLogs ((#vault-raft-rpc-appendentries-processlogs))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to completely process the outstanding logs for the given node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/rpc/appendentries/storelogs.mdx b/website/content/partials/telemetry-metrics/vault/raft/rpc/appendentries/storelogs.mdx
deleted file mode 100644
index 2f63636a7a5..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/rpc/appendentries/storelogs.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.rpc.appendEntries.storeLogs ((#vault-raft-rpc-appendentries-storelogs))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to record any outstanding logs since the last request to append entries for the given node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/rpc/installsnapshot.mdx b/website/content/partials/telemetry-metrics/vault/raft/rpc/installsnapshot.mdx
deleted file mode 100644
index dc10012051f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/rpc/installsnapshot.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.raft.rpc.installSnapshot ((#vault-raft-rpc-installsnapshot))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to process an `installSnapshot` RPC call
-
-Only nodes currently in the `follower` state report
-`vault.raft.rpc.installSnapshot` metrics.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/rpc/processheartbeat.mdx b/website/content/partials/telemetry-metrics/vault/raft/rpc/processheartbeat.mdx
deleted file mode 100644
index f25dc18afa6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/rpc/processheartbeat.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.rpc.processHeartbeat ((#vault-raft-rpc-processheartbeat))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to process a heartbeat request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/rpc/requestvote.mdx b/website/content/partials/telemetry-metrics/vault/raft/rpc/requestvote.mdx
deleted file mode 100644
index bacf6f0c943..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/rpc/requestvote.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.rpc.requestVote ((#vault-raft-rpc-requestvote))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `requestVote` call
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/snapshot/create.mdx b/website/content/partials/telemetry-metrics/vault/raft/snapshot/create.mdx
deleted file mode 100644
index 012867461cc..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/snapshot/create.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.snapshot.create ((#vault-raft-snapshot-create))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to capture a new snapshot
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/snapshot/persist.mdx b/website/content/partials/telemetry-metrics/vault/raft/snapshot/persist.mdx
deleted file mode 100644
index bcf6cf7e229..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/snapshot/persist.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.snapshot.persist ((#vault-raft-snapshot-persist))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Time required to record snapshot meta information to disk while taking snapshots
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/snapshot/takesnapshot.mdx b/website/content/partials/telemetry-metrics/vault/raft/snapshot/takesnapshot.mdx
deleted file mode 100644
index bf29604b4f6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/snapshot/takesnapshot.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.raft.snapshot.takeSnapshot ((#vault-raft-snapshot-takesnapshot))
-
-Metric type | Value | Description
------------ | ----- | -----------
-timer       | ms    | Total time required to create and persist the current snapshot
-
-In most cases, `vault.raft.snapshot.takeSnapshot` is approximately equal to
-`vault.raft.snapshot.create +  vault.raft.snapshot.persist`.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/state/candidate.mdx b/website/content/partials/telemetry-metrics/vault/raft/state/candidate.mdx
deleted file mode 100644
index 6a981667295..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/state/candidate.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.state.candidate ((#vault-raft-state-candidate))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of times the raft server initiated an election
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/state/follower.mdx b/website/content/partials/telemetry-metrics/vault/raft/state/follower.mdx
deleted file mode 100644
index 50a6595e4f6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/state/follower.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-### vault.raft.state.follower ((#vault-raft-state-follower))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-summary     | number  | Number of times in the configured interval that the raft server became a follower
-
-Nodes transition to `follower` state under the following conditions:
-
-- when the node joins the cluster
-- when a leader is elected, but the node was not elected leader
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft/state/leader.mdx b/website/content/partials/telemetry-metrics/vault/raft/state/leader.mdx
deleted file mode 100644
index 4ea5f945f54..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/state/leader.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.state.leader ((#vault-raft-state-leader))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of times the raft server became a leader
diff --git a/website/content/partials/telemetry-metrics/vault/raft/transition/heartbeat_timeout.mdx b/website/content/partials/telemetry-metrics/vault/raft/transition/heartbeat_timeout.mdx
deleted file mode 100644
index 06309c70078..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/transition/heartbeat_timeout.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.transition.heartbeat_timeout ((#vault-raft-transition-heartbeat_timeout))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-summary     | number  | Number of times that the node transitioned to `candidate` state after not receiving a heartbeat message from the last known leader
diff --git a/website/content/partials/telemetry-metrics/vault/raft/transition/leader_lease_timeout.mdx b/website/content/partials/telemetry-metrics/vault/raft/transition/leader_lease_timeout.mdx
deleted file mode 100644
index ff48baa5759..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/transition/leader_lease_timeout.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.transition.leader_lease_timeout ((#vault-raft-transition-leader_lease_timeout))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | The number of times the leader could not contact a quorum of nodes and therefore stepped down
diff --git a/website/content/partials/telemetry-metrics/vault/raft/verify_leader.mdx b/website/content/partials/telemetry-metrics/vault/raft/verify_leader.mdx
deleted file mode 100644
index f0bb1748961..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft/verify_leader.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft.verify_leader ((#vault-raft-verify_leader))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of times in the configured interval that the node confirmed it is still the leader
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/cursor/count.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/cursor/count.mdx
deleted file mode 100644
index 4576eb835c0..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/cursor/count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.cursor.count ((#vault-raft_storage-bolt-cursor-count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of cursors created in the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/allocated_bytes.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/allocated_bytes.mdx
deleted file mode 100644
index 293c4783a48..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/allocated_bytes.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.freelist.allocated_bytes ((#vault-raft_storage-bolt-freelist-allocated_bytes))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | bytes | Total space allocated for the freelist for the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/free_pages.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/free_pages.mdx
deleted file mode 100644
index f075a4b8ecf..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/free_pages.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.freelist.free_pages ((#vault-raft_storage-bolt-freelist-free_pages))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of free pages in the freelist for the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/pending_pages.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/pending_pages.mdx
deleted file mode 100644
index 252b944301b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/pending_pages.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.freelist.pending_pages ((#vault-raft_storage-bolt-freelist-pending_pages))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of pending pages in the freelist for the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/used_bytes.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/used_bytes.mdx
deleted file mode 100644
index 257a90c59f9..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/freelist/used_bytes.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.freelist.used_bytes ((#vault-raft_storage-bolt-freelist-used_bytes))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | bytes | Total space used by the freelist for the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/node/count.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/node/count.mdx
deleted file mode 100644
index 70ca6b4131a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/node/count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.node.count ((#vault-raft_storage-bolt-node-count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of node allocations for the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/node/dereferences.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/node/dereferences.mdx
deleted file mode 100644
index a6ffa46bf10..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/node/dereferences.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.node.dereferences ((#vault-raft_storage-bolt-node-dereferences))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Total number of node dereferences by the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/page/bytes_allocated.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/page/bytes_allocated.mdx
deleted file mode 100644
index cb113094dc1..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/page/bytes_allocated.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.page.bytes_allocated ((#vault-raft_storage-bolt-page-bytes_allocated))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | bytes | Total space allocated to the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/page/count.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/page/count.mdx
deleted file mode 100644
index b946afb99a4..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/page/count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.page.count ((#vault-raft_storage-bolt-page-count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of page allocations in the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/rebalance/count.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/rebalance/count.mdx
deleted file mode 100644
index 9768358455e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/rebalance/count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.rebalance.count ((#vault-raft_storage-bolt-rebalance-count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of node rebalances performed by the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/rebalance/time.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/rebalance/time.mdx
deleted file mode 100644
index df71744a346..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/rebalance/time.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.rebalance.time ((#vault-raft_storage-bolt-rebalance-time))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required by the Bolt database to rebalance nodes
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/spill/count.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/spill/count.mdx
deleted file mode 100644
index a80e6da5406..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/spill/count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.spill.count ((#vault-raft_storage-bolt-spill-count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of nodes spilled by the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/spill/time.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/spill/time.mdx
deleted file mode 100644
index 1c7d8adefc7..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/spill/time.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.spill.time ((#vault-raft_storage-bolt-spill-time))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Total time spent spilling by the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/split/count.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/split/count.mdx
deleted file mode 100644
index 2098239b749..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/split/count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.split.count ((#vault-raft_storage-bolt-split-count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of nodes split by the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/transaction/currently_open_read_transactions.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/transaction/currently_open_read_transactions.mdx
deleted file mode 100644
index e951b520c35..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/transaction/currently_open_read_transactions.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.transaction.currently_open_read_transactions ((#vault-raft_storage-bolt-transaction-currently_open_read_transactions))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of in-process read transactions for the Bolt DB
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/transaction/started_read_transactions.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/transaction/started_read_transactions.mdx
deleted file mode 100644
index 8771dba5874..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/transaction/started_read_transactions.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.transaction.started_read_transactions ((#vault-raft_storage-bolt-transaction-started_read_transactions))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of read transactions started by the Bolt DB
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/write/count.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/write/count.mdx
deleted file mode 100644
index 542234d1837..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/write/count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.write.count ((#vault-raft_storage-bolt-write-count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of writes performed by the Bolt database
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/write/time.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/write/time.mdx
deleted file mode 100644
index b2c24579718..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/bolt/write/time.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.bolt.write.time ((#vault-raft_storage-bolt-write-time))
-
-Metric type | Value | Description
------------ | ----- | -----------
-counter     | ms    | Total cumulative time the Bolt database has spent writing to disk.
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/follower/applied_index_delta.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/follower/applied_index_delta.mdx
deleted file mode 100644
index 95a6c7d2e00..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/follower/applied_index_delta.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.follower.applied_index_delta ((#vault-raft_storage-follower-applied_index_delta))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | The difference between the index applied by the leader and the index applied by the follower as reported by echoes
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/follower/last_heartbeat_ms.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/follower/last_heartbeat_ms.mdx
deleted file mode 100644
index 03b74039d77..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/follower/last_heartbeat_ms.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.follower.last_heartbeat_ms ((#vault-raft_storage-follower-last_heartbeat_ms))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | ms    | Time since the follower last received a heartbeat request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/stats/applied_index.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/stats/applied_index.mdx
deleted file mode 100644
index 68bb4d2e74d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/stats/applied_index.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.stats.applied_index ((#vault-raft_storage-stats-applied_index))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Highest index of raft log last applied to the finite state machine or added to `fsm_pending queue`
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/stats/commit_index.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/stats/commit_index.mdx
deleted file mode 100644
index d07b7ca8f2e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/stats/commit_index.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.stats.commit_index ((#vault-raft_storage-stats-commit_index))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Index of the last raft log committed to disk on the node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/raft_storage/stats/fsm_pending.mdx b/website/content/partials/telemetry-metrics/vault/raft_storage/stats/fsm_pending.mdx
deleted file mode 100644
index 61cc3b07570..00000000000
--- a/website/content/partials/telemetry-metrics/vault/raft_storage/stats/fsm_pending.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.raft_storage.stats.fsm_pending ((#vault-raft_storage-stats-fsm_pending))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of raft logs queued by the node for the finite state machine to apply
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/fetchremotekeys.mdx b/website/content/partials/telemetry-metrics/vault/replication/fetchremotekeys.mdx
deleted file mode 100644
index b1384d03cdf..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/fetchremotekeys.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.fetchRemoteKeys ((#vault-replication-fetchremotekeys))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to fetch keys from a remote cluster participating in replication before Merkle tree delta generation occurs
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/fsm/last_remote_wal.mdx b/website/content/partials/telemetry-metrics/vault/replication/fsm/last_remote_wal.mdx
deleted file mode 100644
index 40c5834c747..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/fsm/last_remote_wal.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-### vault.replication.fsm.last_remote_wal ((#vault-replication-fsm-last_remote_wal))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Index of the last remote write-ahead log.
-
-
-<Note>
-  Standby nodes do not emit `last_remote_wal` details.
-</Note>
diff --git a/website/content/partials/telemetry-metrics/vault/replication/fsm/last_upstream_remote_wal.mdx b/website/content/partials/telemetry-metrics/vault/replication/fsm/last_upstream_remote_wal.mdx
deleted file mode 100644
index 859a83cbb20..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/fsm/last_upstream_remote_wal.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.fsm.last_upstream_remote_wal ((#vault-replication-fsm-last_upstream_remote_wal))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Index of the last remote WAL segment received from the upstream cluster by the local cluster leader.
diff --git a/website/content/partials/telemetry-metrics/vault/replication/merkle/commit_index.mdx b/website/content/partials/telemetry-metrics/vault/replication/merkle/commit_index.mdx
deleted file mode 100644
index 80aec39406f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/merkle/commit_index.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.merkle.commit_index ((#vault-replication-merkle-commit_index))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Index of the last commit to the Merkle tree
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/merklediff.mdx b/website/content/partials/telemetry-metrics/vault/replication/merklediff.mdx
deleted file mode 100644
index e9e73565c0e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/merklediff.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.merkleDiff ((#vault-replication-merklediff))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to perform a Merkle tree delta comparison among the clusters participating in replication
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/merklesync.mdx b/website/content/partials/telemetry-metrics/vault/replication/merklesync.mdx
deleted file mode 100644
index 75a6653af51..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/merklesync.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.merkleSync ((#vault-replication-merklesync))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to perform a Merkle tree synchronization with the most recent delta generated by the clusters participating in replication
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/conflicting_pages.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/conflicting_pages.mdx
deleted file mode 100644
index a6b2fe502f8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/conflicting_pages.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.conflicting_pages ((#vault-replication-rpc-client-conflicting_pages))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a conflicting pages request for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/create_token_register_auth_lease.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/create_token_register_auth_lease.mdx
deleted file mode 100644
index 21f0a4eb4dc..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/create_token_register_auth_lease.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.create_token_register_auth_lease ((#vault-replication-rpc-client-create_token_register_auth_lease))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a register authentication token request for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/fetch_keys.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/fetch_keys.mdx
deleted file mode 100644
index 73798c8afa6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/fetch_keys.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.fetch_keys ((#vault-replication-rpc-client-fetch_keys))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a fetch keys request for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/forward.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/forward.mdx
deleted file mode 100644
index 5fbe6c1717d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/forward.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.forward ((#vault-replication-rpc-client-forward))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a forward request for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/guard_hash.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/guard_hash.mdx
deleted file mode 100644
index cd01efb8bdd..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/guard_hash.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.guard_hash ((#vault-replication-rpc-client-guard_hash))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a guard hash request for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/persist_alias.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/persist_alias.mdx
deleted file mode 100644
index b664ef46b6f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/persist_alias.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.persist_alias ((#vault-replication-rpc-client-persist_alias))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to persist an alias for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/register_auth.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/register_auth.mdx
deleted file mode 100644
index 5402aa9c0aa..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/register_auth.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.register_auth ((#vault-replication-rpc-client-register_auth))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a register authentication request for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/register_lease.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/register_lease.mdx
deleted file mode 100644
index ff8e1960040..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/register_lease.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.register_lease ((#vault-replication-rpc-client-register_lease))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to register a lease for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/save_mfa_response_auth.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/save_mfa_response_auth.mdx
deleted file mode 100644
index 1a0909ded99..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/save_mfa_response_auth.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.save_mfa_response_auth ((#vault-replication-rpc-client-save_mfa_response_auth))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required by the client to save the MFA authentication response
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/stream_wals.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/stream_wals.mdx
deleted file mode 100644
index 10627a162fe..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/stream_wals.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.stream_wals ((#vault-replication-rpc-client-stream_wals))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to stream write-ahead logs for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/sub_page_hashes.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/sub_page_hashes.mdx
deleted file mode 100644
index e259e79050a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/sub_page_hashes.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.sub_page_hashes ((#vault-replication-rpc-client-sub_page_hashes))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a sub-page hash request for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/sync_counter.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/sync_counter.mdx
deleted file mode 100644
index 4dc56c3badd..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/sync_counter.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.sync_counter ((#vault-replication-rpc-client-sync_counter))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a counter sync request for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/upsert_group.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/upsert_group.mdx
deleted file mode 100644
index f9bdd501568..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/upsert_group.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.upsert_group ((#vault-replication-rpc-client-upsert_group))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a group upsert request for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/wrap_in_cubbyhole.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/client/wrap_in_cubbyhole.mdx
deleted file mode 100644
index d9aa00ee35e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/client/wrap_in_cubbyhole.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.client.wrap_in_cubbyhole ((#vault-replication-rpc-client-wrap_in_cubbyhole))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a cubbyhole wrap request for the client
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/dr/server/echo.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/dr/server/echo.mdx
deleted file mode 100644
index c838270b77c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/dr/server/echo.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.dr.server.echo ((#vault-replication-rpc-dr-server-echo))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete an echo request for disaster recovery
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/dr/server/fetch_keys_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/dr/server/fetch_keys_request.mdx
deleted file mode 100644
index a18099a50b4..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/dr/server/fetch_keys_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.dr.server.fetch_keys_request ((#vault-replication-rpc-dr-server-fetch_keys_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a fetch keys request for disaster recovery
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/auth_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/auth_request.mdx
deleted file mode 100644
index ebd17ea6f30..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/auth_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.auth_request ((#vault-replication-rpc-server-auth_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete an authentication request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/bootstrap_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/bootstrap_request.mdx
deleted file mode 100644
index 9c860fbc9a0..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/bootstrap_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.bootstrap_request ((#vault-replication-rpc-server-bootstrap_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a bootstrap request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/conflicting_pages_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/conflicting_pages_request.mdx
deleted file mode 100644
index d0c1314138c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/conflicting_pages_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.conflicting_pages_request ((#vault-replication-rpc-server-conflicting_pages_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a conflicting pages request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/echo.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/echo.mdx
deleted file mode 100644
index 313a354ba41..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/echo.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.echo ((#vault-replication-rpc-server-echo))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete an echo operation
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/forwarding_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/forwarding_request.mdx
deleted file mode 100644
index 3b1678a45e3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/forwarding_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.forwarding_request ((#vault-replication-rpc-server-forwarding_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a forwarding request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/guard_hash_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/guard_hash_request.mdx
deleted file mode 100644
index df02ca5ae99..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/guard_hash_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.guard_hash_request ((#vault-replication-rpc-server-guard_hash_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a guard hash request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/persist_alias_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/persist_alias_request.mdx
deleted file mode 100644
index 76b0dbbc7fc..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/persist_alias_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.persist_alias_request ((#vault-replication-rpc-server-persist_alias_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a request to persist an alias
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/persist_persona_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/persist_persona_request.mdx
deleted file mode 100644
index 1fc53335386..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/persist_persona_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.persist_persona_request ((#vault-replication-rpc-server-persist_persona_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a request to persist an alias
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/save_mfa_response_auth.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/save_mfa_response_auth.mdx
deleted file mode 100644
index de24b6707c3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/save_mfa_response_auth.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.save_mfa_response_auth ((#vault-replication-rpc-server-save_mfa_response_auth))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to save a MFA authentication response
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/stream_wals_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/stream_wals_request.mdx
deleted file mode 100644
index 6146b8021e6..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/stream_wals_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.stream_wals_request ((#vault-replication-rpc-server-stream_wals_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a request to stream write-ahead logs
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/sub_page_hashes_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/sub_page_hashes_request.mdx
deleted file mode 100644
index 7fb9e70ba65..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/sub_page_hashes_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.sub_page_hashes_request ((#vault-replication-rpc-server-sub_page_hashes_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a sub-page hashes request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/sync_counter_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/sync_counter_request.mdx
deleted file mode 100644
index cd37869d1fc..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/sync_counter_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.sync_counter_request ((#vault-replication-rpc-server-sync_counter_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a counter sync request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/upsert_group_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/server/upsert_group_request.mdx
deleted file mode 100644
index 7bc5001c7cc..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/server/upsert_group_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.server.upsert_group_request ((#vault-replication-rpc-server-upsert_group_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a group upsert request
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/create_token_register_auth_lease_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/create_token_register_auth_lease_request.mdx
deleted file mode 100644
index df9b75c121d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/create_token_register_auth_lease_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.standby.server.create_token_register_auth_lease_request ((#vault-replication-rpc-standby-server-create_token_register_auth_lease_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to service a create token request from a standby node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/echo.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/echo.mdx
deleted file mode 100644
index e07d8c04acb..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/echo.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.standby.server.echo ((#vault-replication-rpc-standby-server-echo))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to service an echo request from a standby node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/register_auth_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/register_auth_request.mdx
deleted file mode 100644
index 787e59ec628..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/register_auth_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.standby.server.register_auth_request ((#vault-replication-rpc-standby-server-register_auth_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to service a register auth request from a standby node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/register_lease_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/register_lease_request.mdx
deleted file mode 100644
index 7d9aff4a586..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/register_lease_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.standby.server.register_lease_request ((#vault-replication-rpc-standby-server-register_lease_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to service a register lease request from a standby node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/wrap_token_request.mdx b/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/wrap_token_request.mdx
deleted file mode 100644
index 2c170dd8bde..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/rpc/standby/server/wrap_token_request.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.rpc.standby.server.wrap_token_request ((#vault-replication-rpc-standby-server-wrap_token_request))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to service a wrap token request from a standby node
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/wal/gc.mdx b/website/content/partials/telemetry-metrics/vault/replication/wal/gc.mdx
deleted file mode 100644
index 35c2059f508..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/wal/gc.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.wal.gc ((#vault-replication-wal-gc))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete one run of the WAL garbage collection process
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/wal/last_dr_wal.mdx b/website/content/partials/telemetry-metrics/vault/replication/wal/last_dr_wal.mdx
deleted file mode 100644
index 890abc476a3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/wal/last_dr_wal.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.wal.last_dr_wal ((#vault-replication-wal-last_dr_wal))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Index of the last write-ahead log for disaster recovery.  Note that this is emitted by all Vault Enterprise clusters, regardless of cluster type.
diff --git a/website/content/partials/telemetry-metrics/vault/replication/wal/last_performance_wal.mdx b/website/content/partials/telemetry-metrics/vault/replication/wal/last_performance_wal.mdx
deleted file mode 100644
index a642c754310..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/wal/last_performance_wal.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.wal.last_performance_wal ((#vault-replication-wal-last_performance_wal))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Index of the last write-ahead log for performance
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/replication/wal/last_wal.mdx b/website/content/partials/telemetry-metrics/vault/replication/wal/last_wal.mdx
deleted file mode 100644
index 8a775a53b6e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/replication/wal/last_wal.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.replication.wal.last_wal ((#vault-replication-wal-last_wal))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Index of the last write-ahead log
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/rollback/attempt.mdx b/website/content/partials/telemetry-metrics/vault/rollback/attempt.mdx
deleted file mode 100644
index 680f2bf1820..00000000000
--- a/website/content/partials/telemetry-metrics/vault/rollback/attempt.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.rollback.attempt ((#vault-rollback-attempt))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to perform a rollback operation
diff --git a/website/content/partials/telemetry-metrics/vault/rollback/attempt/mountpoint.mdx b/website/content/partials/telemetry-metrics/vault/rollback/attempt/mountpoint.mdx
deleted file mode 100644
index 781b2f42adc..00000000000
--- a/website/content/partials/telemetry-metrics/vault/rollback/attempt/mountpoint.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.rollback.attempt.{MOUNTPOINT} ((#vault-rollback-attempt-mountpoint))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to perform a rollback operation on the given mount point
diff --git a/website/content/partials/telemetry-metrics/vault/rollback/inflight.mdx b/website/content/partials/telemetry-metrics/vault/rollback/inflight.mdx
deleted file mode 100644
index 832cb308882..00000000000
--- a/website/content/partials/telemetry-metrics/vault/rollback/inflight.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.rollback.inflight ((#vault-rollback-inflight))
-
-Metric type | Value  | Description
------------ | ------ | -----------
-gauge       | number | Number of rollback operations inflight
diff --git a/website/content/partials/telemetry-metrics/vault/rollback/queued.mdx b/website/content/partials/telemetry-metrics/vault/rollback/queued.mdx
deleted file mode 100644
index e8a7d099f4a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/rollback/queued.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.rollback.queued ((#vault-rollback-queued))
-
-Metric type | Value  | Description
------------ | ------ | -----------
-guage       | number | The number of rollback operations waiting to be started
diff --git a/website/content/partials/telemetry-metrics/vault/rollback/waiting.mdx b/website/content/partials/telemetry-metrics/vault/rollback/waiting.mdx
deleted file mode 100644
index 2fb0e2eab04..00000000000
--- a/website/content/partials/telemetry-metrics/vault/rollback/waiting.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.rollback.waiting ((#vault-rollback-waiting))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time between queueing a rollback operation and the operation starting
diff --git a/website/content/partials/telemetry-metrics/vault/route/create/mountpoint.mdx b/website/content/partials/telemetry-metrics/vault/route/create/mountpoint.mdx
deleted file mode 100644
index 5352774c625..00000000000
--- a/website/content/partials/telemetry-metrics/vault/route/create/mountpoint.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.route.create.{MOUNTPOINT} ((#vault-route-create-mountpoint))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to send a create request to the backend and for the backend to complete the operation for the given mount point
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/route/delete/mountpoint.mdx b/website/content/partials/telemetry-metrics/vault/route/delete/mountpoint.mdx
deleted file mode 100644
index e9bacdcea1c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/route/delete/mountpoint.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.route.delete.{MOUNTPOINT} ((#vault-route-delete-mountpoint))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to send a delete request to the backend and for the backend to complete the operation for the given mount point
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/route/list/mountpoint.mdx b/website/content/partials/telemetry-metrics/vault/route/list/mountpoint.mdx
deleted file mode 100644
index 6af8f2fd07e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/route/list/mountpoint.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.route.list.{MOUNTPOINT} ((#vault-route-list-mountpoint))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to send a list request to the backend and for the backend to complete the operation for the given mount point
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/route/read/mountpoint.mdx b/website/content/partials/telemetry-metrics/vault/route/read/mountpoint.mdx
deleted file mode 100644
index 9acf65dc22b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/route/read/mountpoint.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.route.read.{MOUNTPOINT} ((#vault-route-read-mountpoint))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to send a read request to the backend and for the backend to complete the operation for the given mount point
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/route/rollback.mdx b/website/content/partials/telemetry-metrics/vault/route/rollback.mdx
deleted file mode 100644
index 96e93a52500..00000000000
--- a/website/content/partials/telemetry-metrics/vault/route/rollback.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.route.rollback ((#vault-route-rollback))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to send a rollback request to the backend and for the backend to complete the operation
-
-Vault automatically schedules and performs mount point rollback operations to
-clean up partial errors.
diff --git a/website/content/partials/telemetry-metrics/vault/route/rollback/mountpoint.mdx b/website/content/partials/telemetry-metrics/vault/route/rollback/mountpoint.mdx
deleted file mode 100644
index 3e0af86355f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/route/rollback/mountpoint.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.route.rollback.{MOUNTPOINT} ((#vault-route-rollback-mountpoint))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to send a rollback request to the backend and for the backend to complete the operation for the given mount point
-
-Vault automatically schedules and performs mount point rollback operations to
-clean up partial errors.
diff --git a/website/content/partials/telemetry-metrics/vault/runtime/alloc_bytes.mdx b/website/content/partials/telemetry-metrics/vault/runtime/alloc_bytes.mdx
deleted file mode 100644
index 021ca1bb47d..00000000000
--- a/website/content/partials/telemetry-metrics/vault/runtime/alloc_bytes.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.runtime.alloc_bytes ((#vault-runtime-alloc_bytes))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | bytes | Space currently allocated to Vault processes
-
-The number of allocated bytes may peak from time to time, but should 
-always return to a steady state value in a health Vault installation.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/runtime/free_count.mdx b/website/content/partials/telemetry-metrics/vault/runtime/free_count.mdx
deleted file mode 100644
index dac376559b8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/runtime/free_count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.runtime.free_count ((#vault-runtime-free_count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of freed objects
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/runtime/gc_pause_ns.mdx b/website/content/partials/telemetry-metrics/vault/runtime/gc_pause_ns.mdx
deleted file mode 100644
index 1b1949db599..00000000000
--- a/website/content/partials/telemetry-metrics/vault/runtime/gc_pause_ns.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.runtime.gc_pause_ns ((#vault-runtime-gc_pause_ns))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ns    | Time required to complete the last garbage collection run
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/runtime/heap_objects.mdx b/website/content/partials/telemetry-metrics/vault/runtime/heap_objects.mdx
deleted file mode 100644
index 74d40f1eb7a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/runtime/heap_objects.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### vault.runtime.heap_objects ((#vault-runtime-heap_objects))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Total number of objects on the heap in memory
-
-The `vault.runtime.heap_objects` metric is a good memory pressure indicator. We
-recommend monitoring `vault.runtime.heap_objects` to establish an accurate
-baseline and thresholds for alerting on the health of your Vault installation.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/runtime/malloc_count.mdx b/website/content/partials/telemetry-metrics/vault/runtime/malloc_count.mdx
deleted file mode 100644
index b5e723d047e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/runtime/malloc_count.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.runtime.malloc_count ((#vault-runtime-malloc_count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Total number of allocated heap objects in memory
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/runtime/num_goroutines.mdx b/website/content/partials/telemetry-metrics/vault/runtime/num_goroutines.mdx
deleted file mode 100644
index 6386fe74533..00000000000
--- a/website/content/partials/telemetry-metrics/vault/runtime/num_goroutines.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### vault.runtime.num_goroutines ((#vault-runtime-num_goroutines))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Total number of Go routines running in memory
-
-The `vault.runtime.num_goroutines` metric is a good system load indicator. We
-recommend monitoring `vault.runtime.num_goroutines` to establish an accurate
-baseline and thresholds for alerting on the health of your Vault installation.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/runtime/sys_bytes.mdx b/website/content/partials/telemetry-metrics/vault/runtime/sys_bytes.mdx
deleted file mode 100644
index 3919c23e49f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/runtime/sys_bytes.mdx
+++ /dev/null
@@ -1,9 +0,0 @@
-### vault.runtime.sys_bytes ((#vault-runtime-sys_bytes))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Total number of bytes allocated to Vault
-
-The total number of allocated system bytes includes space currently used by the
-heap plus space that has been reclaimed by, but not returned to, the operating
-system.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/runtime/total_gc_pause_ns.mdx b/website/content/partials/telemetry-metrics/vault/runtime/total_gc_pause_ns.mdx
deleted file mode 100644
index 1811ab7a29c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/runtime/total_gc_pause_ns.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.runtime.total_gc_pause_ns ((#vault-runtime-total_gc_pause_ns))
-
-Metric type | Value | Description
------------ | ----- | -----------
-gauge       | ns    | The total garbage collector pause time since Vault was last started
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/runtime/total_gc_runs.mdx b/website/content/partials/telemetry-metrics/vault/runtime/total_gc_runs.mdx
deleted file mode 100644
index f2c9666ebb8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/runtime/total_gc_runs.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.runtime.total_gc_runs ((#vault-runtime-total_gc_runs))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | The total number of garbage collection runs since Vault was last started
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/s3/delete.mdx b/website/content/partials/telemetry-metrics/vault/s3/delete.mdx
deleted file mode 100644
index a6dc92668de..00000000000
--- a/website/content/partials/telemetry-metrics/vault/s3/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.s3.delete ((#vault-s3-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the Amazon S3 storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/s3/get.mdx b/website/content/partials/telemetry-metrics/vault/s3/get.mdx
deleted file mode 100644
index 77c744e7ec7..00000000000
--- a/website/content/partials/telemetry-metrics/vault/s3/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.s3.get ((#vault-s3-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the Amazon S3 storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/s3/list.mdx b/website/content/partials/telemetry-metrics/vault/s3/list.mdx
deleted file mode 100644
index c3be684f616..00000000000
--- a/website/content/partials/telemetry-metrics/vault/s3/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.s3.list ((#vault-s3-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the Amazon S3 storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/s3/put.mdx b/website/content/partials/telemetry-metrics/vault/s3/put.mdx
deleted file mode 100644
index 7ad1f3d4359..00000000000
--- a/website/content/partials/telemetry-metrics/vault/s3/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.s3.put ((#vault-s3-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the Amazon S3 storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/secret/kv/count.mdx b/website/content/partials/telemetry-metrics/vault/secret/kv/count.mdx
deleted file mode 100644
index 226f964ff95..00000000000
--- a/website/content/partials/telemetry-metrics/vault/secret/kv/count.mdx
+++ /dev/null
@@ -1,7 +0,0 @@
-### vault.secret.kv.count ((#vault-secret-kv-count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of entries in each key-value secrets engines
-
-Vault organizes the key-value pair count by cluster, namespace, and mount point.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/secret/lease/creation.mdx b/website/content/partials/telemetry-metrics/vault/secret/lease/creation.mdx
deleted file mode 100644
index 3649d0c0b02..00000000000
--- a/website/content/partials/telemetry-metrics/vault/secret/lease/creation.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.secret.lease.creation ((#vault-secret-lease-creation))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of leases created by secrets engines
-
-Vault organizes the lease count by cluster, namespace, secret engine, mount
-point, and time to live (TTL).
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/secrets-sync/associations.mdx b/website/content/partials/telemetry-metrics/vault/secrets-sync/associations.mdx
deleted file mode 100644
index 3fd3585dc6b..00000000000
--- a/website/content/partials/telemetry-metrics/vault/secrets-sync/associations.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.secrets-sync.associations.count ((#vault-secrets-sync-associations))
-
-Metric type | Value    | Description
------------ | -------- | -----------
-gauge       | number   | Total number of associations across all namespaces for each destination type
diff --git a/website/content/partials/telemetry-metrics/vault/secrets-sync/destinations.mdx b/website/content/partials/telemetry-metrics/vault/secrets-sync/destinations.mdx
deleted file mode 100644
index 8fb7028beff..00000000000
--- a/website/content/partials/telemetry-metrics/vault/secrets-sync/destinations.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.secrets-sync.destinations.count ((#vault-secrets-sync-destinations))
-
-Metric type | Value    | Description
------------ | -------- | -----------
-gauge       | number   | Total number of destinations across all namespaces for each destination type
diff --git a/website/content/partials/telemetry-metrics/vault/spanner/delete.mdx b/website/content/partials/telemetry-metrics/vault/spanner/delete.mdx
deleted file mode 100644
index 5e527bd15a3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/spanner/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.spanner.delete ((#vault-spanner-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the Google Cloud Spanner storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/spanner/get.mdx b/website/content/partials/telemetry-metrics/vault/spanner/get.mdx
deleted file mode 100644
index 8effeb187f9..00000000000
--- a/website/content/partials/telemetry-metrics/vault/spanner/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.spanner.get ((#vault-spanner-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the Google Cloud Spanner storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/spanner/list.mdx b/website/content/partials/telemetry-metrics/vault/spanner/list.mdx
deleted file mode 100644
index 5b5fbd0aa1c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/spanner/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.spanner.list ((#vault-spanner-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the Google Cloud Spanner storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/spanner/lock/lock.mdx b/website/content/partials/telemetry-metrics/vault/spanner/lock/lock.mdx
deleted file mode 100644
index 81294f166db..00000000000
--- a/website/content/partials/telemetry-metrics/vault/spanner/lock/lock.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.spanner.lock.lock ((#vault-spanner-lock-lock))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LOCK` operation against the Google Cloud Spanner storage backend in high-availability mode
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/spanner/lock/unlock.mdx b/website/content/partials/telemetry-metrics/vault/spanner/lock/unlock.mdx
deleted file mode 100644
index 6e8534e77aa..00000000000
--- a/website/content/partials/telemetry-metrics/vault/spanner/lock/unlock.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.spanner.lock.unlock ((#vault-spanner-lock-unlock))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `UNLOCK` operation against the Google Cloud Spanner storage backend in high-availability mode
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/spanner/lock/value.mdx b/website/content/partials/telemetry-metrics/vault/spanner/lock/value.mdx
deleted file mode 100644
index 5fd7e086aea..00000000000
--- a/website/content/partials/telemetry-metrics/vault/spanner/lock/value.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.spanner.lock.value ((#vault-spanner-lock-value))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `VALUE` operation against the Google Cloud Spanner storage backend in high-availability mode
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/spanner/put.mdx b/website/content/partials/telemetry-metrics/vault/spanner/put.mdx
deleted file mode 100644
index 6473540c42c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/spanner/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.spanner.put ((#vault-spanner-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the Google Cloud Spanner storage backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/swift/delete.mdx b/website/content/partials/telemetry-metrics/vault/swift/delete.mdx
deleted file mode 100644
index 542c2115494..00000000000
--- a/website/content/partials/telemetry-metrics/vault/swift/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.swift.delete ((#vault-swift-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the OpenStack Swift backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/swift/get.mdx b/website/content/partials/telemetry-metrics/vault/swift/get.mdx
deleted file mode 100644
index 1593db71ab4..00000000000
--- a/website/content/partials/telemetry-metrics/vault/swift/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.swift.get ((#vault-swift-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the OpenStack Swift backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/swift/list.mdx b/website/content/partials/telemetry-metrics/vault/swift/list.mdx
deleted file mode 100644
index 9cd9e063ec3..00000000000
--- a/website/content/partials/telemetry-metrics/vault/swift/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.swift.list ((#vault-swift-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the OpenStack Swift backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/swift/put.mdx b/website/content/partials/telemetry-metrics/vault/swift/put.mdx
deleted file mode 100644
index 6a86ee58e2c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/swift/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.swift.put ((#vault-swift-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the OpenStack Swift backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/count.mdx b/website/content/partials/telemetry-metrics/vault/token/count.mdx
deleted file mode 100644
index a5a0e6c104c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/count.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.token.count ((#vault-token-count))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of un-expired and un-revoked tokens available for use in the token store
-
-Vault updates the token count every 10 minutes organizes the result by cluster
-and namespace.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/count/by_auth.mdx b/website/content/partials/telemetry-metrics/vault/token/count/by_auth.mdx
deleted file mode 100644
index 5e418cf5f7c..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/count/by_auth.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.token.count.by_auth ((#vault-token-count-by_auth))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Total number of service tokens created by a particular auth method
-
-Vault organizes the token count by cluster, namespace, and authentication
-method.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/count/by_policy.mdx b/website/content/partials/telemetry-metrics/vault/token/count/by_policy.mdx
deleted file mode 100644
index 0d8abce2124..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/count/by_policy.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.token.count.by_policy ((#vault-token-count-by_policy))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Total number of service tokens with a particular policy attached
-
-Vault organizes the token count by cluster, namespace, and policy. Tokens with
-more than one policy attached appear in the gauge for each associated policy.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/count/by_ttl.mdx b/website/content/partials/telemetry-metrics/vault/token/count/by_ttl.mdx
deleted file mode 100644
index c42426efd0f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/count/by_ttl.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.token.count.by_ttl ((#vault-token-count-by_ttl))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Total number of service tokens assigned a particular time to live (TTL)
-
-Vault organizes the token count by cluster, namespace, and the TTL
-range assigned at creation.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/create.mdx b/website/content/partials/telemetry-metrics/vault/token/create.mdx
deleted file mode 100644
index e76ef222285..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/create.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.token.create ((#vault-token-create))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to create a token in Vault
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/create_root.mdx b/website/content/partials/telemetry-metrics/vault/token/create_root.mdx
deleted file mode 100644
index ab75bcab55f..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/create_root.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
-### vault.token.create_root ((#vault-token-create_root))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of root tokens created
-
-The `vault.token.create_root` counts the total number of root tokens created
-over time, not the number of root tokens currently in use. As a result, the
-value of `vault.token.create_root` does not decrease when a root token is
-revoked.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/createaccessor.mdx b/website/content/partials/telemetry-metrics/vault/token/createaccessor.mdx
deleted file mode 100644
index ceef939e86e..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/createaccessor.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.token.createAccessor ((#vault-token-createaccessor))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to create a token accessor in Vault
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/creation.mdx b/website/content/partials/telemetry-metrics/vault/token/creation.mdx
deleted file mode 100644
index 4abeaa87366..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/creation.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### vault.token.creation ((#vault-token-creation))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-counter     | number  | Number of service or batch tokens created
-
-Vault organizes the creation count by cluster, namespace, authentication method,
-mount point, time to live (TTL), and token type.
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/lookup.mdx b/website/content/partials/telemetry-metrics/vault/token/lookup.mdx
deleted file mode 100644
index 6376d42e1f8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/lookup.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.token.lookup ((#vault-token-lookup))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to look up a token in Vault
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/revoke.mdx b/website/content/partials/telemetry-metrics/vault/token/revoke.mdx
deleted file mode 100644
index 1560291b8d8..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/revoke.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.token.revoke ((#vault-token-revoke))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to revoke a token in Vault
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/revoke_tree.mdx b/website/content/partials/telemetry-metrics/vault/token/revoke_tree.mdx
deleted file mode 100644
index 56e4004b9d9..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/revoke_tree.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.token.revoke-tree ((#vault-token-revoke_tree))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to fully revoke a token tree in Vault
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/token/store.mdx b/website/content/partials/telemetry-metrics/vault/token/store.mdx
deleted file mode 100644
index e9f2d117797..00000000000
--- a/website/content/partials/telemetry-metrics/vault/token/store.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.token.store ((#vault-token-store))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to store an updated token entry without writing to the secondary index
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/wal/deletewals.mdx b/website/content/partials/telemetry-metrics/vault/wal/deletewals.mdx
deleted file mode 100644
index 051c4ce96f4..00000000000
--- a/website/content/partials/telemetry-metrics/vault/wal/deletewals.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.wal.deleteWALs ((#vault-wal-deletewals))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to fully delete a write-ahead log
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/wal/flushready.mdx b/website/content/partials/telemetry-metrics/vault/wal/flushready.mdx
deleted file mode 100644
index 8cfe11e2d85..00000000000
--- a/website/content/partials/telemetry-metrics/vault/wal/flushready.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.wal.flushReady ((#vault-wal-flushready))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to fully flush a write-ahead log that is ready for storage
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/wal/flushready/queue_len.mdx b/website/content/partials/telemetry-metrics/vault/wal/flushready/queue_len.mdx
deleted file mode 100644
index e4243cbd994..00000000000
--- a/website/content/partials/telemetry-metrics/vault/wal/flushready/queue_len.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.wal.flushReady.queue_len ((#vault-wal-flushready-queue_len))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-summary     | number  | Current size of the write queue in the WAL system
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/wal/gc/deleted.mdx b/website/content/partials/telemetry-metrics/vault/wal/gc/deleted.mdx
deleted file mode 100644
index 2ced6a3c739..00000000000
--- a/website/content/partials/telemetry-metrics/vault/wal/gc/deleted.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.wal.gc.deleted ((#vault-wal-gc-deleted))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Number of write-ahead logs deleted during garbage collection
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/wal/gc/total.mdx b/website/content/partials/telemetry-metrics/vault/wal/gc/total.mdx
deleted file mode 100644
index 64265f0a12a..00000000000
--- a/website/content/partials/telemetry-metrics/vault/wal/gc/total.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.wal.gc.total ((#vault-wal-gc-total))
-
-Metric type | Value   | Description
------------ | ------- | -----------
-gauge       | number  | Total number of write-ahead logs currently on disk
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/wal/loadwal.mdx b/website/content/partials/telemetry-metrics/vault/wal/loadwal.mdx
deleted file mode 100644
index d036ab87b63..00000000000
--- a/website/content/partials/telemetry-metrics/vault/wal/loadwal.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.wal.loadWAL ((#vault-wal-loadwal))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to load a write-ahead log
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/wal/persistwals.mdx b/website/content/partials/telemetry-metrics/vault/wal/persistwals.mdx
deleted file mode 100644
index 1f8b6370821..00000000000
--- a/website/content/partials/telemetry-metrics/vault/wal/persistwals.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.wal.persistWALs ((#vault-wal-persistwals))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to persist a write-ahead log
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/zookeeper/delete.mdx b/website/content/partials/telemetry-metrics/vault/zookeeper/delete.mdx
deleted file mode 100644
index f346dc62c30..00000000000
--- a/website/content/partials/telemetry-metrics/vault/zookeeper/delete.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.zookeeper.delete ((#vault-zookeeper-delete))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `DELETE` operation against the ZooKeeper backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/zookeeper/get.mdx b/website/content/partials/telemetry-metrics/vault/zookeeper/get.mdx
deleted file mode 100644
index 0d8997a3c65..00000000000
--- a/website/content/partials/telemetry-metrics/vault/zookeeper/get.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.zookeeper.get ((#vault-zookeeper-get))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `GET` operation against the ZooKeeper backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/zookeeper/list.mdx b/website/content/partials/telemetry-metrics/vault/zookeeper/list.mdx
deleted file mode 100644
index 8a09a0f9910..00000000000
--- a/website/content/partials/telemetry-metrics/vault/zookeeper/list.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.zookeeper.list ((#vault-zookeeper-list))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `LIST` operation against the ZooKeeper backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry-metrics/vault/zookeeper/put.mdx b/website/content/partials/telemetry-metrics/vault/zookeeper/put.mdx
deleted file mode 100644
index 326eac18cec..00000000000
--- a/website/content/partials/telemetry-metrics/vault/zookeeper/put.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-### vault.zookeeper.put ((#vault-zookeeper-put))
-
-Metric type | Value | Description
------------ | ----- | -----------
-summary     | ms    | Time required to complete a `PUT` operation against the ZooKeeper backend
\ No newline at end of file
diff --git a/website/content/partials/telemetry/supported-aggregation-agents.mdx b/website/content/partials/telemetry/supported-aggregation-agents.mdx
deleted file mode 100644
index 47e1e04a87d..00000000000
--- a/website/content/partials/telemetry/supported-aggregation-agents.mdx
+++ /dev/null
@@ -1,11 +0,0 @@
-Vault uses the `go-metrics` package to export telemetry and supports the
-following aggregation agents for time-series monitoring:
-
-Config prefix | Name                                                             | Company
-------------- | ---------------------------------------------------------------- | -------
-`circonus`    | [Circonus](https://www.circonus.com)                             | Circonus
-`dogstatsd`   | [DogStatsD](https://docs.datadoghq.com/developers/dogstatsd)     | Datadog
-`prometheus`  | [Prometheus](https://prometheus.io)                              | Prometheus / Open source
-`stackdriver` | [Cloud Operations](https://cloud.google.com/products/operations) | Google
-`statsd`      | [Statsd](https://github.com/statsd/statsd/wiki)                  | Open source
-`statsite`    | [Statsite](https://github.com/statsite/statsite)                 | Open source
diff --git a/website/content/partials/tokenfields.mdx b/website/content/partials/tokenfields.mdx
deleted file mode 100644
index 43308afcf23..00000000000
--- a/website/content/partials/tokenfields.mdx
+++ /dev/null
@@ -1,15 +0,0 @@
-- `token_ttl` `(integer: 0 or string: "")` - The incremental lifetime for
-  generated tokens. This current value of this will be referenced at renewal
-  time.
-- `token_max_ttl` `(integer: 0 or string: "")` - The maximum lifetime for
-  generated tokens. This current value of this will be referenced at renewal
-  time.
-- `token_policies` `(array: [] or comma-delimited string: "")` - List of
-  token policies to encode onto generated tokens. Depending on the auth method, this
-  list may be supplemented by user/group/other values.
-- `policies` `(array: [] or comma-delimited string: "")` - DEPRECATED: Please
-  use the `token_policies` parameter instead. List of token policies to encode
-  onto generated tokens. Depending on the auth method, this list may be
-  supplemented by user/group/other values.
-
-@include 'tokenstorefields.mdx'
diff --git a/website/content/partials/tokenization-rotation-persistence.mdx b/website/content/partials/tokenization-rotation-persistence.mdx
deleted file mode 100644
index 7cd971a2ee1..00000000000
--- a/website/content/partials/tokenization-rotation-persistence.mdx
+++ /dev/null
@@ -1,14 +0,0 @@
-### Rotation configuration persistence issue could lose transform tokenization key versions
-
-A rotation performed manually or via automatic time based rotation after
-restarting or leader change of Vault, where configuration of rotation was
-changed since the initial configuration of the tokenization transform can
-result in the loss of intermediate key versions.  Tokenized values from
-these versions would not be decodeable.  It is recommended that customers
-who have enabled automatic rotation disable it, and other customers avoid
-key rotation until the upcoming fix.
-
-#### Affected versions
-
-This issue affects Vault Enterprise with ADP versions 1.10.x and higher.  A
-fix will be released in Vault 1.11.9, 1.12.5, and 1.13.1.
diff --git a/website/content/partials/tokenstorefields.mdx b/website/content/partials/tokenstorefields.mdx
deleted file mode 100644
index d84a94df25d..00000000000
--- a/website/content/partials/tokenstorefields.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
-- `token_bound_cidrs` `(array: [] or comma-delimited string: "")` - List of
-  CIDR blocks; if set, specifies blocks of IP addresses which can authenticate
-  successfully, and ties the resulting token to these blocks as well.
-- `token_explicit_max_ttl` `(integer: 0 or string: "")` - If set, will encode
-  an [explicit max
-  TTL](/vault/docs/concepts/tokens#token-time-to-live-periodic-tokens-and-explicit-max-ttls)
-  onto the token. This is a hard cap even if `token_ttl` and `token_max_ttl`
-  would otherwise allow a renewal.
-- `token_no_default_policy` `(bool: false)` - If set, the `default` policy will
-  not be set on generated tokens; otherwise it will be added to the policies set
-  in `token_policies`.
-- `token_num_uses` `(integer: 0)` - The maximum number of times a generated
-  token may be used (within its lifetime); 0 means unlimited.
-  If you require the token to have the ability to create child tokens,
-  you will need to set this value to 0.
-- `token_period` `(integer: 0 or string: "")` - The maximum allowed [period](/vault/docs/concepts/tokens#token-time-to-live-periodic-tokens-and-explicit-max-ttls) value when a periodic token is requested from this role.
-- `token_type` `(string: "")` - The type of token that should be generated. Can
-  be `service`, `batch`, or `default` to use the mount's tuned default (which
-  unless changed will be `service` tokens). For token store roles, there are two
-  additional possibilities: `default-service` and `default-batch` which specify
-  the type to return unless the client requests a different type at generation
-  time.
diff --git a/website/content/partials/transform-upgrade.mdx b/website/content/partials/transform-upgrade.mdx
deleted file mode 100644
index fc08e551b28..00000000000
--- a/website/content/partials/transform-upgrade.mdx
+++ /dev/null
@@ -1,8 +0,0 @@
-### Transform storage upgrades fixed
-
-The Transform Secrets Engine storage upgrade introduced in 1.6.0 introduced
-malformed configuration for transformations configured earlier than 1.6.0,
-resulting in an error using these transformations if Vault is restarted
-after the upgrade.  This issue exists on Vault 1.6.0 through 1.6.3, and is fixed
-in Vault 1.6.4 and 1.7.0. Transformations configured on 1.6.0 or higher are 
-unaffected.
diff --git a/website/content/partials/ui-pki-control-groups-known-issue.mdx b/website/content/partials/ui-pki-control-groups-known-issue.mdx
deleted file mode 100644
index ed7b03ab1a5..00000000000
--- a/website/content/partials/ui-pki-control-groups-known-issue.mdx
+++ /dev/null
@@ -1,17 +0,0 @@
-### Users limited by control groups can only access issuer detail from PKI overview page ((#ui-pki-control-groups))
-
-#### Affected versions
-
-- Vault 1.14.x
-
-#### Issue
-
-Vault UI users who require control group approval to read issuer details are
-directed to the Control Group Access page when they try to view issuer details
-from links on the Issuer list page.
-
-#### Workaround
-
-Vault UI users constrained by control groups should select issuers from the
-**PKI overview** page to view detailed information instead of the
-**Issuers list** page.
diff --git a/website/content/partials/ui-safari-login-screen.mdx b/website/content/partials/ui-safari-login-screen.mdx
deleted file mode 100644
index 37373b62049..00000000000
--- a/website/content/partials/ui-safari-login-screen.mdx
+++ /dev/null
@@ -1,13 +0,0 @@
-### Safari login screen appears broken on the UI
-
-#### Affected versions
-
-- 1.14.0
-
-#### Issue
-
-The login screen on Safari appears to be broken, presenting as a blank white screen.
-
-#### Workaround
-
-Scroll down to find the login section.
\ No newline at end of file
diff --git a/website/content/partials/user-lockout.mdx b/website/content/partials/user-lockout.mdx
deleted file mode 100644
index 288cb7e1ec8..00000000000
--- a/website/content/partials/user-lockout.mdx
+++ /dev/null
@@ -1,22 +0,0 @@
-If a user provides bad credentials several times in quick succession,
-Vault will stop trying to validate their credentials for a while, instead returning immediately
-with a permission denied error. We call this behavior "user lockout". The time for which
-a user will be locked out is called “lockout duration”. The user will be able to login after the lockout
-duration has passed. The number of failed login attempts after which the user is locked out is called
-“lockout threshold”. The lockout threshold counter is reset to zero after a few minutes without login attempts,
-or upon a successful login attempt. The duration after which the counter will be reset to zero
-after no login attempts is called "lockout counter reset". This can defeat both automated and targeted requests
-i.e, user-based password guessing attacks as well as automated attacks.
-
-The user lockout feature is enabled by default. The default values for "lockout threshold" is 5 attempts,
-"lockout duration" is 15 minutes, "lockout counter reset" is 15 minutes.
-
-The user lockout feature can be disabled as follows:
-- It can be disabled globally using environment variable `VAULT_DISABLE_USER_LOCKOUT`.
-- It can be disabled for all supported auth methods (ldap, userpass and approle) or a specific supported auth method using the `disable_lockout`
-  parameter within `user_lockout` stanza in configuration file.
-  Please see [user lockout configuration](/vault/docs/configuration/user-lockout#user_lockout-stanza) for more details.
-- It can be disabled for a specific auth mount using "auth tune". Please see [auth tune command](/vault/docs/commands/auth/tune)
-  or [auth tune api](/vault/api-docs/system/auth#tune-auth-method) for more details.
-
-~> **NOTE**: This feature is available from Vault version 1.13 and is only supported by the userpass, ldap, and approle auth methods.
\ No newline at end of file
diff --git a/website/content/partials/versions.mdx b/website/content/partials/versions.mdx
deleted file mode 100644
index 438b064a62f..00000000000
--- a/website/content/partials/versions.mdx
+++ /dev/null
@@ -1,20 +0,0 @@
-## Vault version guidance
-
-HashiCorp regularly releases new versions of Vault in the form of "major" and "minor" releases.
-Vault typically uses version numbers in the form of X.Y.Z, and very rarely the form X.Y.Z.A.
-
-Vault version numbers do not conform to [semver](https://semver.org/).
-Vault major releases are identified by a change in the second (Y) digit.
-Vault minor releases are identified by a change in the third (Z) digit.
-Vault denotes a release with Enterprise only changes using the fourth (A) digit.
-HashiCorp's Support and End-of-Life
-[policy](https://support.hashicorp.com/hc/en-us/articles/360021185113-Support-Period-and-End-of-Life-EOL-Policy)
-covers versioning in more detail.
-
-HashiCorp does not require upgrading to each major (Y digit) Vault release immediately when it becomes available.
-HashiCorp does strongly encourage upgrading Vault to the latest minor (Z digit) patch in a supported major release.
-
-To be notified of new Vault releases, users can subscribe to our [Discuss Forum](https://discuss.hashicorp.com/)
-using the [vault-release-ce-ent](https://discuss.hashicorp.com/tag/vault-release-ce-ent) tag.
-New security bulletins are also available on Discuss via the
-[security-vault](https://discuss.hashicorp.com/tag/security-vault) tag.
diff --git a/website/content/partials/vso/blurb-api-reference.mdx b/website/content/partials/vso/blurb-api-reference.mdx
deleted file mode 100644
index 9724fae9595..00000000000
--- a/website/content/partials/vso/blurb-api-reference.mdx
+++ /dev/null
@@ -1,2 +0,0 @@
-For more details on any of the custom resources mentioned here, please see the
-[api-reference](/vault/docs/platform/k8s/vso/api-reference).
diff --git a/website/content/partials/x509-sha1-deprecation.mdx b/website/content/partials/x509-sha1-deprecation.mdx
deleted file mode 100644
index ff030daa418..00000000000
--- a/website/content/partials/x509-sha1-deprecation.mdx
+++ /dev/null
@@ -1,5 +0,0 @@
-~> **Note**: This engine can use external X.509 certificates as part of TLS or signature validation.
-   Verifying signatures against X.509 certificates that use SHA-1 is deprecated and is no longer
-   usable without a workaround starting in Vault 1.12. See the
-   [deprecation FAQ](/vault/docs/deprecation/faq#q-what-is-the-impact-of-removing-support-for-x-509-certificates-with-signatures-that-use-sha-1)
-   for more information.
\ No newline at end of file
diff --git a/website/data/api-docs-nav-data.json b/website/data/api-docs-nav-data.json
deleted file mode 100644
index e0e3626d0b7..00000000000
--- a/website/data/api-docs-nav-data.json
+++ /dev/null
@@ -1,777 +0,0 @@
-[
-  {
-    "title": "Client Libraries",
-    "path": "libraries"
-  },
-  {
-    "title": "Related Tools",
-    "path": "relatedtools"
-  },
-  {
-    "divider": true
-  },
-  {
-    "title": "Secrets Engines",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "secret"
-      },
-      {
-        "title": "Active Directory",
-        "path": "secret/ad"
-      },
-      {
-        "title": "AliCloud",
-        "path": "secret/alicloud"
-      },
-      {
-        "title": "AWS",
-        "path": "secret/aws"
-      },
-      {
-        "title": "Azure",
-        "path": "secret/azure"
-      },
-      {
-        "title": "Cassandra",
-        "path": "secret/cassandra",
-        "hidden": true
-      },
-      {
-        "title": "Consul",
-        "path": "secret/consul"
-      },
-      {
-        "title": "Cubbyhole",
-        "path": "secret/cubbyhole"
-      },
-      {
-        "title": "Databases",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secret/databases"
-          },
-          {
-            "title": "Cassandra",
-            "path": "secret/databases/cassandra"
-          },
-          {
-            "title": "Couchbase",
-            "path": "secret/databases/couchbase"
-          },
-          {
-            "title": "Elasticsearch",
-            "path": "secret/databases/elasticdb"
-          },
-          {
-            "title": "Influxdb",
-            "path": "secret/databases/influxdb"
-          },
-          {
-            "title": "HanaDB",
-            "path": "secret/databases/hanadb"
-          },
-          {
-            "title": "MongoDB",
-            "path": "secret/databases/mongodb"
-          },
-          {
-            "title": "MongoDB Atlas",
-            "path": "secret/databases/mongodbatlas"
-          },
-          {
-            "title": "MSSQL",
-            "path": "secret/databases/mssql"
-          },
-          {
-            "title": "MySQL/MariaDB",
-            "path": "secret/databases/mysql-maria"
-          },
-          {
-            "title": "Oracle",
-            "path": "secret/databases/oracle"
-          },
-          {
-            "title": "PostgreSQL",
-            "path": "secret/databases/postgresql"
-          },
-          {
-            "title": "Redis",
-            "path": "secret/databases/redis"
-          },
-          {
-            "title": "Redis ElastiCache",
-            "path": "secret/databases/rediselasticache"
-          },
-          {
-            "title": "Redshift",
-            "path": "secret/databases/redshift"
-          },
-          {
-            "title": "Snowflake",
-            "path": "secret/databases/snowflake"
-          }
-        ]
-      },
-      {
-        "title": "Google Cloud",
-        "path": "secret/gcp"
-      },
-      {
-        "title": "Google Cloud KMS",
-        "path": "secret/gcpkms"
-      },
-      {
-        "title": "Identity",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secret/identity"
-          },
-          {
-            "title": "Entity",
-            "path": "secret/identity/entity"
-          },
-          {
-            "title": "Entity Alias",
-            "path": "secret/identity/entity-alias"
-          },
-          {
-            "title": "Group",
-            "path": "secret/identity/group"
-          },
-          {
-            "title": "Group Alias",
-            "path": "secret/identity/group-alias"
-          },
-          {
-            "title": "Identity Tokens",
-            "path": "secret/identity/tokens"
-          },
-          {
-            "title": "Lookup",
-            "path": "secret/identity/lookup"
-          },
-          {
-            "title": "OIDC Provider",
-            "path": "secret/identity/oidc-provider"
-          },
-          {
-            "title": "MFA",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "secret/identity/mfa"
-              },
-              {
-                "title": "Duo",
-                "path": "secret/identity/mfa/duo"
-              },
-              {
-                "title": "Okta",
-                "path": "secret/identity/mfa/okta"
-              },
-              {
-                "title": "PingID",
-                "path": "secret/identity/mfa/pingid"
-              },
-              {
-                "title": "TOTP",
-                "path": "secret/identity/mfa/totp"
-              },
-              {
-                "title": "Login Enforcement",
-                "path": "secret/identity/mfa/login-enforcement"
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "title": "Key Management",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        },
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secret/key-management"
-          },
-          {
-            "title": "Azure Key Vault",
-            "path": "secret/key-management/azurekeyvault"
-          },
-          {
-            "title": "AWS KMS",
-            "path": "secret/key-management/awskms"
-          },
-          {
-            "title": "GCP Cloud KMS",
-            "path": "secret/key-management/gcpkms"
-          }
-        ]
-      },
-      {
-        "title": "Key Value",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secret/kv"
-          },
-          {
-            "title": "KV version 1",
-            "path": "secret/kv/kv-v1"
-          },
-          {
-            "title": "KV version 2",
-            "path": "secret/kv/kv-v2"
-          }
-        ]
-      },
-      {
-        "title": "KMIP",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        },
-        "path": "secret/kmip"
-      },
-      {
-        "title": "Kubernetes",
-        "path": "secret/kubernetes"
-      },
-      {
-        "title": "MongoDB Atlas",
-        "path": "secret/mongodbatlas"
-      },
-      {
-        "title": "Nomad",
-        "path": "secret/nomad"
-      },
-      {
-        "title": "LDAP",
-        "path": "secret/ldap"
-      },
-      {
-        "title": "PKI",
-        "path": "secret/pki"
-      },
-      {
-        "title": "RabbitMQ",
-        "path": "secret/rabbitmq"
-      },
-      {
-        "title": "SSH",
-        "path": "secret/ssh"
-      },
-      {
-        "title": "Terraform Cloud",
-        "path": "secret/terraform"
-      },
-      {
-        "title": "TOTP",
-        "path": "secret/totp"
-      },
-      {
-        "title": "Transform",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        },
-        "path": "secret/transform"
-      },
-      {
-        "title": "Transit",
-        "path": "secret/transit"
-      }
-    ]
-  },
-  {
-    "title": "Auth Methods",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "auth"
-      },
-      {
-        "title": "AliCloud",
-        "path": "auth/alicloud"
-      },
-      {
-        "title": "AppRole",
-        "path": "auth/approle"
-      },
-      {
-        "title": "AWS",
-        "path": "auth/aws"
-      },
-      {
-        "title": "Azure",
-        "path": "auth/azure"
-      },
-      {
-        "title": "Cloud Foundry",
-        "path": "auth/cf"
-      },
-      {
-        "title": "GitHub",
-        "path": "auth/github"
-      },
-      {
-        "title": "Google Cloud",
-        "path": "auth/gcp"
-      },
-      {
-        "title": "JWT/OIDC",
-        "path": "auth/jwt"
-      },
-      {
-        "title": "Kerberos",
-        "path": "auth/kerberos"
-      },
-      {
-        "title": "Kubernetes",
-        "path": "auth/kubernetes"
-      },
-      {
-        "title": "LDAP",
-        "path": "auth/ldap"
-      },
-      {
-        "title": "OCI",
-        "path": "auth/oci"
-      },
-      {
-        "title": "Okta",
-        "path": "auth/okta"
-      },
-      {
-        "title": "RADIUS",
-        "path": "auth/radius"
-      },
-      {
-        "title": "SAML",
-        "path": "auth/saml",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        }
-      },
-      {
-        "title": "TLS Certificates",
-        "path": "auth/cert"
-      },
-      {
-        "title": "Tokens",
-        "path": "auth/token"
-      },
-      {
-        "title": "Username & Password",
-        "path": "auth/userpass"
-      }
-    ]
-  },
-  {
-    "title": "System Backend",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "system"
-      },
-      {
-        "title": "<code>/sys/audit</code>",
-        "path": "system/audit"
-      },
-      {
-        "title": "<code>/sys/audit-hash</code>",
-        "path": "system/audit-hash"
-      },
-      {
-        "title": "<code>/sys/auth</code>",
-        "path": "system/auth"
-      },
-      {
-        "title": "<code>/sys/capabilities</code>",
-        "path": "system/capabilities"
-      },
-      {
-        "title": "<code>/sys/capabilities-accessor</code>",
-        "path": "system/capabilities-accessor"
-      },
-      {
-        "title": "<code>/sys/capabilities-self</code>",
-        "path": "system/capabilities-self"
-      },
-      {
-        "title": "<code>/sys/config/auditing</code>",
-        "path": "system/config-auditing"
-      },
-      {
-        "title": "<code>/sys/config/control-group</code>",
-        "path": "system/config-control-group"
-      },
-      {
-        "title": "<code>/sys/config/cors</code>",
-        "path": "system/config-cors"
-      },
-      {
-        "title": "<code>/sys/config/group-policy-application</code>",
-        "path": "system/config-group-policy-application",
-        "badge": {
-          "text": "ENT",
-          "type": "outlined",
-          "color": "neutral"
-        }
-      },
-      {
-        "title": "<code>/sys/config/reload</code>",
-        "path": "system/config-reload"
-      },
-      {
-        "title": "<code>/sys/config/state</code>",
-        "path": "system/config-state"
-      },
-      {
-        "title": "<code>/sys/config/ui/custom-messages</code>",
-        "path": "system/config-ui-custom-messages"
-      },
-      {
-        "title": "<code>/sys/config/ui/headers</code>",
-        "path": "system/config-ui-headers"
-      },
-      {
-        "title": "<code>/sys/control-group</code>",
-        "path": "system/control-group"
-      },
-      {
-        "title": "<code>/sys/decode-token</code>",
-        "path": "system/decode-token"
-      },
-      {
-        "title": "<code>/sys/experiments</code>",
-        "path": "system/experiments"
-      },
-      {
-        "title": "<code>/sys/generate-recovery-token</code>",
-        "path": "system/generate-recovery-token"
-      },
-      {
-        "title": "<code>/sys/generate-root</code>",
-        "path": "system/generate-root"
-      },
-      {
-        "title": "<code>/sys/health</code>",
-        "path": "system/health"
-      },
-      {
-        "title": "<code>/sys/host-info</code>",
-        "path": "system/host-info"
-      },
-      {
-        "title": "<code>/sys/in-flight-req</code>",
-        "path": "system/in-flight-req"
-      },
-      {
-        "title": "<code>/sys/init</code>",
-        "path": "system/init"
-      },
-      {
-        "title": "<code>/sys/internal/counters</code>",
-        "path": "system/internal-counters"
-      },
-      {
-        "title": "<code>/sys/internal/inspect</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "system/inspect"
-          },
-          {
-            "title": "<code>/sys/internal/inspect/router</code>",
-            "path": "system/inspect/router"
-          }
-        ]
-      },
-      {
-        "title": "<code>/sys/internal/specs/openapi</code>",
-        "path": "system/internal-specs-openapi"
-      },
-      {
-        "title": "<code>/sys/internal/ui/authenticated-messages</code>",
-        "path": "system/internal-ui-authenticated-messages"
-      },
-      {
-        "title": "<code>/sys/internal/ui/feature-flags</code>",
-        "path": "system/internal-ui-feature"
-      },
-      {
-        "title": "<code>/sys/internal/ui/mounts</code>",
-        "path": "system/internal-ui-mounts"
-      },
-      {
-        "title": "<code>/sys/internal/ui/namespaces</code>",
-        "path": "system/internal-ui-namespaces"
-      },
-      {
-        "title": "<code>/sys/internal/ui/resultant-acl</code>",
-        "path": "system/internal-ui-resultant-acl"
-      },
-      {
-        "title": "<code>/sys/internal/ui/unauthenticated-messages</code>",
-        "path": "system/internal-ui-unauthenticated-messages"
-      },
-      {
-        "title": "<code>/sys/internal/ui/version</code>",
-        "path": "system/internal-ui-version"
-      },
-      {
-        "title": "<code>/sys/key-status</code>",
-        "path": "system/key-status"
-      },
-      {
-        "title": "<code>/sys/ha-status</code>",
-        "path": "system/ha-status"
-      },
-      {
-        "title": "<code>/sys/leader</code>",
-        "path": "system/leader"
-      },
-      {
-        "title": "<code>/sys/leases</code>",
-        "path": "system/leases"
-      },
-      {
-        "title": "<code>/sys/license/status</code>",
-        "path": "system/license"
-      },
-      {
-        "title": "<code>/sys/locked-users</code>",
-        "path": "system/user-lockout"
-      },
-      {
-        "title": "<code>/sys/loggers</code>",
-        "path": "system/loggers"
-      },
-      {
-        "title": "<code>/sys/managed-keys</code>",
-        "path": "system/managed-keys",
-        "badge": {
-          "text": "ENT",
-          "type": "outlined",
-          "color": "neutral"
-        }
-      },
-      {
-        "title": "<code>/sys/metrics</code>",
-        "path": "system/metrics"
-      },
-      {
-        "title": "<code>/sys/mfa</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "system/mfa"
-          },
-          {
-            "title": "<code>/sys/mfa/method/duo</code>",
-            "path": "system/mfa/duo"
-          },
-          {
-            "title": "<code>/sys/mfa/method/okta</code>",
-            "path": "system/mfa/okta"
-          },
-          {
-            "title": "<code>/sys/mfa/method/pingid</code>",
-            "path": "system/mfa/pingid"
-          },
-          {
-            "title": "<code>/sys/mfa/method/totp</code>",
-            "path": "system/mfa/totp"
-          },
-          {
-            "title": "<code>/sys/mfa/validate</code>",
-            "path": "system/mfa/validate"
-          }
-        ]
-      },
-      {
-        "title": "<code>/sys/monitor</code>",
-        "path": "system/monitor"
-      },
-      {
-        "title": "<code>/sys/mounts</code>",
-        "path": "system/mounts"
-      },
-      {
-        "title": "<code>/sys/namespaces</code>",
-        "path": "system/namespaces"
-      },
-      {
-        "title": "<code>/sys/plugins/reload</code>",
-        "path": "system/plugins-reload"
-      },
-      {
-        "title": "<code>/sys/plugins/catalog</code>",
-        "path": "system/plugins-catalog"
-      },
-      {
-        "title": "<code>/sys/plugins/runtimes/catalog</code>",
-        "path": "system/plugins-runtimes-catalog"
-      },
-      {
-        "title": "<code>/sys/policy</code>",
-        "path": "system/policy"
-      },
-      {
-        "title": "<code>/sys/policies</code>",
-        "path": "system/policies"
-      },
-      {
-        "title": "<code>/sys/policies/password</code>",
-        "path": "system/policies-password"
-      },
-      {
-        "title": "<code>/sys/pprof</code>",
-        "path": "system/pprof"
-      },
-      {
-        "title": "<code>/sys/quotas/config</code>",
-        "path": "system/quotas-config"
-      },
-      {
-        "title": "<code>/sys/quotas/rate-limit</code>",
-        "path": "system/rate-limit-quotas"
-      },
-      {
-        "title": "<code>/sys/quotas/lease-count</code>",
-        "path": "system/lease-count-quotas"
-      },
-      {
-        "title": "<code>/sys/raw</code>",
-        "path": "system/raw"
-      },
-      {
-        "title": "<code>/sys/rekey</code>",
-        "path": "system/rekey"
-      },
-      {
-        "title": "<code>/sys/rekey-recovery-key</code>",
-        "path": "system/rekey-recovery-key"
-      },
-      {
-        "title": "<code>/sys/remount</code>",
-        "path": "system/remount"
-      },
-      {
-        "title": "<code>/sys/replication</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "system/replication"
-          },
-          {
-            "title": "<code>/sys/replication/performance</code>",
-            "path": "system/replication/replication-performance"
-          },
-          {
-            "title": "<code>/sys/replication/dr</code>",
-            "path": "system/replication/replication-dr"
-          }
-        ]
-      },
-      {
-        "title": "<code>/sys/rotate</code>",
-        "path": "system/rotate"
-      },
-      {
-        "title": "<code>/sys/rotate/config</code>",
-        "path": "system/rotate-config"
-      },
-      {
-        "title": "<code>/sys/seal</code>",
-        "path": "system/seal"
-      },
-      {
-        "title": "<code>/sys/seal-status</code>",
-        "path": "system/seal-status"
-      },
-      {
-        "title": "<code>/sys/seal-backend-status</code>",
-        "path": "system/seal-backend-status"
-      },
-      {
-        "title": "<code>/sys/sealwrap/rewrap</code>",
-        "path": "system/sealwrap-rewrap"
-      },
-      {
-        "title": "<code>/sys/step-down</code>",
-        "path": "system/step-down"
-      },
-      {
-        "title": "<code>/sys/storage </code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "system/storage"
-          },
-          {
-            "title": "<code>/sys/storage/raft</code>",
-            "path": "system/storage/raft"
-          },
-          {
-            "title": "<code>/sys/storage/raft/autopilot</code>",
-            "path": "system/storage/raftautopilot"
-          },
-          {
-            "title": "<code>/sys/storage/raft/snapshot-auto</code>",
-            "path": "system/storage/raftautosnapshots"
-          }
-        ]
-      },
-      {
-        "title": "<code>/sys/sync</code>",
-        "path": "system/secrets-sync",
-        "badge": {
-          "text": "ENT",
-          "type": "outlined",
-          "color": "neutral"
-        }
-      },
-      {
-        "title": "<code>/sys/tools</code>",
-        "path": "system/tools"
-      },
-      {
-        "title": "<code>/sys/unseal</code>",
-        "path": "system/unseal"
-      },
-      {
-        "title": "<code>/sys/version-history</code>",
-        "path": "system/version-history"
-      },
-      {
-        "title": "<code>/sys/wrapping/lookup</code>",
-        "path": "system/wrapping-lookup"
-      },
-      {
-        "title": "<code>/sys/wrapping/rewrap</code>",
-        "path": "system/wrapping-rewrap"
-      },
-      {
-        "title": "<code>/sys/wrapping/unwrap</code>",
-        "path": "system/wrapping-unwrap"
-      },
-      {
-        "title": "<code>/sys/wrapping/wrap</code>",
-        "path": "system/wrapping-wrap"
-      }
-    ]
-  }
-]
diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json
deleted file mode 100644
index 5390f0b6047..00000000000
--- a/website/data/docs-nav-data.json
+++ /dev/null
@@ -1,2761 +0,0 @@
-[
-  {
-    "title": "What is Vault?",
-    "path": "what-is-vault"
-  },
-  {
-    "title": "Use Cases",
-    "path": "use-cases"
-  },
-  {
-    "title": "Get Started",
-    "routes": [
-      {
-        "title": "CLI Quick Start",
-        "href": "https://learn.hashicorp.com/collections/vault/getting-started"
-      },
-      {
-        "title": "HCP Quick Start",
-        "href": "https://learn.hashicorp.com/collections/vault/cloud"
-      },
-      {
-        "title": "Developer Quick Start",
-        "path": "get-started/developer-qs"
-      }
-    ]
-  },
-
-  {
-    "divider": true
-  },
-  {
-    "title": "Browser Support",
-    "path": "browser-support"
-  },
-
-  {
-    "title": "Installing Vault",
-    "path": "install"
-  },
-  {
-    "title": "Internals",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "internals"
-      },
-      {
-        "title": "Architecture",
-        "path": "internals/architecture"
-      },
-      {
-        "title": "High Availability",
-        "path": "internals/high-availability"
-      },
-      {
-        "title": "Integrated Storage",
-        "path": "internals/integrated-storage"
-      },
-      {
-        "title": "Security Model",
-        "path": "internals/security"
-      },
-
-      {
-        "title": "Telemetry",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "internals/telemetry"
-          },
-          {
-            "title": "Enable telemetry gathering",
-            "path": "internals/telemetry/enable-telemetry"
-          },
-          {
-            "title": "Metric reference",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "internals/telemetry/metrics"
-              },
-              {
-                "title": "Core system metrics",
-                "path": "internals/telemetry/metrics/core-system"
-              },
-              {
-                "title": "Audit log metrics",
-                "path": "internals/telemetry/metrics/audit"
-              },
-              {
-                "title": "Authentication metrics",
-                "path": "internals/telemetry/metrics/authn"
-              },
-              {
-                "title": "Auto-snapshot metrics",
-                "path": "internals/telemetry/metrics/autosnap"
-              },
-              {
-                "title": "Availability metrics",
-                "path": "internals/telemetry/metrics/availability"
-              },
-              {
-                "title": "Database metrics",
-                "path": "internals/telemetry/metrics/database"
-              },
-              {
-                "title": "Policy metrics",
-                "path": "internals/telemetry/metrics/policy"
-              },
-              {
-                "title": "Raft metrics",
-                "path": "internals/telemetry/metrics/raft"
-              },
-              {
-                "title": "Secrets Sync metrics",
-                "path": "internals/telemetry/metrics/secrets-sync"
-              },
-              {
-                "title": "Secrets metrics",
-                "path": "internals/telemetry/metrics/secrets"
-              },
-              {
-                "title": "Storage plugin metrics",
-                "path": "internals/telemetry/metrics/storage"
-              },
-              {
-                "title": "Full metrics list",
-                "path": "internals/telemetry/metrics/all"
-              }
-            ]
-          }
-        ]
-      },
-
-      {
-        "title": "Token Authentication",
-        "path": "internals/token"
-      },
-      {
-        "title": "Key Rotation",
-        "path": "internals/rotation"
-      },
-      {
-        "title": "Replication",
-        "path": "internals/replication"
-      },
-      {
-        "title": "Limits and Maximums",
-        "path": "internals/limits"
-      }
-    ]
-  },
-  {
-    "title": "Concepts",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "concepts"
-      },
-      {
-        "title": "'Dev' Server",
-        "path": "concepts/dev-server"
-      },
-      {
-        "title": "Seal/Unseal",
-        "path": "concepts/seal"
-      },
-      {
-        "title": "Namespace API Lock",
-        "path": "concepts/namespace-api-lock"
-      },
-      {
-        "title": "Lease, Renew, and Revoke",
-        "path": "concepts/lease"
-      },
-      {
-        "title": "Lease Explosions",
-        "path": "concepts/lease-explosions"
-      },
-      {
-        "title": "Lease count quota exceeded",
-        "path": "concepts/lease-count-quota-exceeded"
-      },
-      {
-        "title": "Authentication",
-        "path": "concepts/auth"
-      },
-      {
-        "title": "Tokens",
-        "path": "concepts/tokens"
-      },
-      {
-        "title": "Identity",
-        "path": "concepts/identity"
-      },
-      {
-        "title": "OIDC Provider",
-        "path": "concepts/oidc-provider"
-      },
-      {
-        "title": "Response Wrapping",
-        "path": "concepts/response-wrapping"
-      },
-      {
-        "title": "Policies",
-        "path": "concepts/policies"
-      },
-      {
-        "title": "Password Policies",
-        "path": "concepts/password-policies"
-      },
-      {
-        "title": "Username Templating",
-        "path": "concepts/username-templating"
-      },
-      {
-        "title": "High Availability",
-        "path": "concepts/ha"
-      },
-      {
-        "title": "Storage",
-        "path": "concepts/storage"
-      },
-      {
-        "title": "Integrated Storage",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "concepts/integrated-storage"
-          },
-          {
-            "title": "Autopilot",
-            "path": "concepts/integrated-storage/autopilot"
-          }
-        ]
-      },
-      {
-        "title": "PGP, GnuPG, and Keybase",
-        "path": "concepts/pgp-gpg-keybase"
-      },
-      {
-        "title": "Recovery Mode",
-        "path": "concepts/recovery-mode"
-      },
-      {
-        "title": "Resource Quotas",
-        "path": "concepts/resource-quotas"
-      },
-      {
-        "title": "Client count",
-        "routes": [
-          {
-            "title": "Clients and entities",
-            "path": "concepts/client-count"
-          },
-          {
-            "title": "Client count calculation",
-            "path": "concepts/client-count/counting"
-          },
-          {
-            "title": "FAQ",
-            "path": "concepts/client-count/faq"
-          }
-        ]
-      },
-      {
-        "title": "Transform",
-        "path": "concepts/transform"
-      },
-      {
-        "title": "Mount Migration",
-        "path": "concepts/mount-migration"
-      },
-      {
-        "title": "Duration String Format",
-        "path": "concepts/duration-format"
-      },
-      {
-        "title": "User Lockout",
-        "path": "concepts/user-lockout"
-      },
-      {
-        "title": "Events",
-        "path": "concepts/events",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "highlight"
-        }
-      },
-      {
-        "title": "Filtering",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "concepts/filtering"
-          },
-          {
-            "title": "Audit Filtering",
-            "path": "concepts/filtering/audit"
-          }
-        ]
-      }
-    ]
-  },
-  {
-    "title": "Configuration",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "configuration"
-      },
-      {
-        "title": "<code>listener</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "configuration/listener"
-          },
-          {
-            "title": "TCP",
-            "path": "configuration/listener/tcp"
-          },
-          {
-            "title": "Unix",
-            "path": "configuration/listener/unix"
-          }
-        ]
-      },
-      {
-        "title": "<code>replication</code>",
-        "path": "configuration/replication"
-      },
-      {
-        "title": "<code>seal</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "configuration/seal"
-          },
-          {
-            "title": "High Availability",
-            "badge": {
-              "text": "ENTERPRISE",
-              "type": "outlined",
-              "color": "highlight"
-            },
-            "path": "configuration/seal/seal-ha"
-          },
-          {
-            "title": "AliCloud KMS",
-            "path": "configuration/seal/alicloudkms"
-          },
-          {
-            "title": "AWS KMS",
-            "path": "configuration/seal/awskms"
-          },
-          {
-            "title": "Azure Key Vault",
-            "path": "configuration/seal/azurekeyvault"
-          },
-          {
-            "title": "GCP Cloud KMS",
-            "path": "configuration/seal/gcpckms"
-          },
-          {
-            "title": "OCI KMS",
-            "path": "configuration/seal/ocikms"
-          },
-          {
-            "title": "HSM PKCS11",
-            "badge": {
-              "text": "ENTERPRISE",
-              "type": "outlined",
-              "color": "neutral"
-            },
-            "path": "configuration/seal/pkcs11"
-          },
-          {
-            "title": "Vault Transit",
-            "path": "configuration/seal/transit"
-          }
-        ]
-      },
-      {
-        "title": "<code>sentinel</code>",
-        "path": "configuration/sentinel"
-      },
-      {
-        "title": "<code>service_registration</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "configuration/service-registration"
-          },
-          {
-            "title": "Consul",
-            "path": "configuration/service-registration/consul"
-          },
-          {
-            "title": "Kubernetes",
-            "path": "configuration/service-registration/kubernetes"
-          }
-        ]
-      },
-      {
-        "title": "<code>storage</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "configuration/storage"
-          },
-          {
-            "title": "Aerospike",
-            "path": "configuration/storage/aerospike"
-          },
-          {
-            "title": "Alicloud OSS",
-            "path": "configuration/storage/alicloudoss"
-          },
-          {
-            "title": "Azure",
-            "path": "configuration/storage/azure"
-          },
-          {
-            "title": "Cassandra",
-            "path": "configuration/storage/cassandra"
-          },
-          {
-            "title": "CockroachDB",
-            "path": "configuration/storage/cockroachdb"
-          },
-          {
-            "title": "Consul",
-            "path": "configuration/storage/consul"
-          },
-          {
-            "title": "CouchDB",
-            "path": "configuration/storage/couchdb"
-          },
-          {
-            "title": "DynamoDB",
-            "path": "configuration/storage/dynamodb"
-          },
-          {
-            "title": "Etcd",
-            "path": "configuration/storage/etcd"
-          },
-          {
-            "title": "Filesystem",
-            "path": "configuration/storage/filesystem"
-          },
-          {
-            "title": "FoundationDB",
-            "path": "configuration/storage/foundationdb"
-          },
-          {
-            "title": "Google Cloud Spanner",
-            "path": "configuration/storage/google-cloud-spanner"
-          },
-          {
-            "title": "Google Cloud Storage",
-            "path": "configuration/storage/google-cloud-storage"
-          },
-          {
-            "title": "In-Memory",
-            "path": "configuration/storage/in-memory"
-          },
-          {
-            "title": "Manta",
-            "path": "configuration/storage/manta"
-          },
-          {
-            "title": "MSSQL",
-            "path": "configuration/storage/mssql"
-          },
-          {
-            "title": "MySQL",
-            "path": "configuration/storage/mysql"
-          },
-          {
-            "title": "OCI Object Storage",
-            "path": "configuration/storage/oci-object-storage"
-          },
-          {
-            "title": "PostgreSQL",
-            "path": "configuration/storage/postgresql"
-          },
-          {
-            "title": "Integrated Storage (Raft)",
-            "path": "configuration/storage/raft"
-          },
-          {
-            "title": "S3",
-            "path": "configuration/storage/s3"
-          },
-          {
-            "title": "Swift",
-            "path": "configuration/storage/swift"
-          },
-          {
-            "title": "Zookeeper",
-            "path": "configuration/storage/zookeeper"
-          }
-        ]
-      },
-      {
-        "title": "<code>telemetry</code>",
-        "path": "configuration/telemetry"
-      },
-      {
-        "title": "<code>ui</code>",
-        "path": "configuration/ui"
-      },
-      {
-        "title": "<code>user_lockout</code>",
-        "path": "configuration/user-lockout"
-      },
-      {
-        "title": "<code>Log Completed Requests</code>",
-        "path": "configuration/log-requests-level"
-      },
-      {
-        "title": "<code>Entropy Augmentation</code>",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        },
-        "path": "configuration/entropy-augmentation"
-      },
-      {
-        "title": "<code>kms_library</code>",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        },
-        "path": "configuration/kms-library"
-      }
-    ]
-  },
-  {
-    "title": "Commands (CLI)",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "commands"
-      },
-      {
-        "title": "Web REPL",
-        "path": "commands/web"
-      },
-      {
-        "title": "<code>agent</code>",
-        "path": "commands/agent"
-      },
-      {
-        "title": "<code>audit</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/audit"
-          },
-          {
-            "title": "<code>disable</code>",
-            "path": "commands/audit/disable"
-          },
-          {
-            "title": "<code>enable</code>",
-            "path": "commands/audit/enable"
-          },
-          {
-            "title": "<code>list</code>",
-            "path": "commands/audit/list"
-          }
-        ]
-      },
-      {
-        "title": "<code>auth</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/auth"
-          },
-          {
-            "title": "<code>disable</code>",
-            "path": "commands/auth/disable"
-          },
-          {
-            "title": "<code>enable</code>",
-            "path": "commands/auth/enable"
-          },
-          {
-            "title": "<code>help</code>",
-            "path": "commands/auth/help"
-          },
-          {
-            "title": "<code>list</code>",
-            "path": "commands/auth/list"
-          },
-          {
-            "title": "<code>move</code>",
-            "path": "commands/auth/move"
-          },
-          {
-            "title": "<code>tune</code>",
-            "path": "commands/auth/tune"
-          }
-        ]
-      },
-      {
-        "title": "<code>debug</code>",
-        "path": "commands/debug"
-      },
-      {
-        "title": "<code>delete</code>",
-        "path": "commands/delete"
-      },
-      {
-        "title": "<code>events</code>",
-        "path": "commands/events"
-      },
-      {
-        "title": "<code>hcp</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/hcp"
-          },
-          {
-            "title": "<code>connect</code>",
-            "path": "commands/hcp/connect"
-          },
-          {
-            "title": "<code>disconnect</code>",
-            "path": "commands/hcp/disconnect"
-          }
-        ]
-      },
-      {
-        "title": "<code>kv</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/kv"
-          },
-          {
-            "title": "<code>delete</code>",
-            "path": "commands/kv/delete"
-          },
-          {
-            "title": "<code>destroy</code>",
-            "path": "commands/kv/destroy"
-          },
-          {
-            "title": "<code>enable-versioning</code>",
-            "path": "commands/kv/enable-versioning"
-          },
-          {
-            "title": "<code>get</code>",
-            "path": "commands/kv/get"
-          },
-          {
-            "title": "<code>list</code>",
-            "path": "commands/kv/list"
-          },
-          {
-            "title": "<code>metadata</code>",
-            "path": "commands/kv/metadata"
-          },
-          {
-            "title": "<code>patch</code>",
-            "path": "commands/kv/patch"
-          },
-          {
-            "title": "<code>put</code>",
-            "path": "commands/kv/put"
-          },
-          {
-            "title": "<code>rollback</code>",
-            "path": "commands/kv/rollback"
-          },
-          {
-            "title": "<code>undelete</code>",
-            "path": "commands/kv/undelete"
-          }
-        ]
-      },
-      {
-        "title": "<code>lease</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/lease"
-          },
-          {
-            "title": "<code>lookup</code>",
-            "path": "commands/lease/lookup"
-          },
-          {
-            "title": "<code>renew</code>",
-            "path": "commands/lease/renew"
-          },
-          {
-            "title": "<code>revoke</code>",
-            "path": "commands/lease/revoke"
-          }
-        ]
-      },
-      {
-        "title": "<code>license</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/license"
-          },
-          {
-            "title": "<code>get</code>",
-            "path": "commands/license/get"
-          },
-          {
-            "title": "<code>inspect</code>",
-            "path": "commands/license/inspect"
-          }
-        ]
-      },
-      {
-        "title": "<code>list</code>",
-        "path": "commands/list"
-      },
-      {
-        "title": "<code>login</code>",
-        "path": "commands/login"
-      },
-      {
-        "title": "<code>monitor</code>",
-        "path": "commands/monitor"
-      },
-      {
-        "title": "<code>namespace</code>",
-        "path": "commands/namespace"
-      },
-      {
-        "title": "<code>operator</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/operator"
-          },
-          {
-            "title": "<code>diagnose</code>",
-            "path": "commands/operator/diagnose"
-          },
-          {
-            "title": "<code>generate-root</code>",
-            "path": "commands/operator/generate-root"
-          },
-          {
-            "title": "<code>init</code>",
-            "path": "commands/operator/init"
-          },
-          {
-            "title": "<code>key-status</code>",
-            "path": "commands/operator/key-status"
-          },
-          {
-            "title": "<code>members</code>",
-            "path": "commands/operator/members"
-          },
-          {
-            "title": "<code>migrate</code>",
-            "path": "commands/operator/migrate"
-          },
-          {
-            "title": "<code>raft</code>",
-            "path": "commands/operator/raft"
-          },
-          {
-            "title": "<code>rekey</code>",
-            "path": "commands/operator/rekey"
-          },
-          {
-            "title": "<code>rotate</code>",
-            "path": "commands/operator/rotate"
-          },
-          {
-            "title": "<code>seal</code>",
-            "path": "commands/operator/seal"
-          },
-          {
-            "title": "<code>step-down</code>",
-            "path": "commands/operator/step-down"
-          },
-          {
-            "title": "<code>unseal</code>",
-            "path": "commands/operator/unseal"
-          },
-          {
-            "title": "<code>usage</code>",
-            "path": "commands/operator/usage"
-          },
-          {
-            "title": "<code>utilization</code>",
-            "path": "commands/operator/utilization"
-          }
-        ]
-      },
-      {
-        "title": "<code>patch</code>",
-        "path": "commands/patch"
-      },
-      {
-        "title": "<code>path-help</code>",
-        "path": "commands/path-help"
-      },
-      {
-        "title": "<code>pki</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/pki"
-          },
-          {
-            "title": "<code>health-check</code>",
-            "path": "commands/pki/health-check"
-          },
-          {
-            "title": "<code>verify-sign</code>",
-            "path": "commands/pki/verify-sign"
-          },
-          {
-            "title": "<code>list-intermediates</code>",
-            "path": "commands/pki/list-intermediates"
-          },
-          {
-            "title": "<code>issue</code>",
-            "path": "commands/pki/issue"
-          },
-          {
-            "title": "<code>reissue</code>",
-            "path": "commands/pki/reissue"
-          }
-        ]
-      },
-      {
-        "title": "<code>plugin</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/plugin"
-          },
-          {
-            "title": "<code>deregister</code>",
-            "path": "commands/plugin/deregister"
-          },
-          {
-            "title": "<code>info</code>",
-            "path": "commands/plugin/info"
-          },
-          {
-            "title": "<code>list</code>",
-            "path": "commands/plugin/list"
-          },
-          {
-            "title": "<code>register</code>",
-            "path": "commands/plugin/register"
-          },
-          {
-            "title": "<code>reload</code>",
-            "path": "commands/plugin/reload"
-          },
-          {
-            "title": "<code>runtime</code>",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "commands/plugin/runtime"
-              },
-              {
-                "title": "<code>deregister</code>",
-                "path": "commands/plugin/runtime/deregister"
-              },
-              {
-                "title": "<code>info</code>",
-                "path": "commands/plugin/runtime/info"
-              },
-              {
-                "title": "<code>list</code>",
-                "path": "commands/plugin/runtime/list"
-              },
-              {
-                "title": "<code>register</code>",
-                "path": "commands/plugin/runtime/register"
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "title": "<code>policy</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/policy"
-          },
-          {
-            "title": "<code>delete</code>",
-            "path": "commands/policy/delete"
-          },
-          {
-            "title": "<code>fmt</code>",
-            "path": "commands/policy/fmt"
-          },
-          {
-            "title": "<code>list</code>",
-            "path": "commands/policy/list"
-          },
-          {
-            "title": "<code>read</code>",
-            "path": "commands/policy/read"
-          },
-          {
-            "title": "<code>write</code>",
-            "path": "commands/policy/write"
-          }
-        ]
-      },
-      {
-        "title": "<code>print</code>",
-        "path": "commands/print"
-      },
-      {
-        "title": "<code>proxy</code>",
-        "path": "commands/proxy"
-      },
-      {
-        "title": "<code>read</code>",
-        "path": "commands/read"
-      },
-      {
-        "title": "<code>secrets</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/secrets"
-          },
-          {
-            "title": "<code>disable</code>",
-            "path": "commands/secrets/disable"
-          },
-          {
-            "title": "<code>enable</code>",
-            "path": "commands/secrets/enable"
-          },
-          {
-            "title": "<code>list</code>",
-            "path": "commands/secrets/list"
-          },
-          {
-            "title": "<code>move</code>",
-            "path": "commands/secrets/move"
-          },
-          {
-            "title": "<code>tune</code>",
-            "path": "commands/secrets/tune"
-          }
-        ]
-      },
-      {
-        "title": "<code>server</code>",
-        "path": "commands/server"
-      },
-      {
-        "title": "<code>ssh</code>",
-        "path": "commands/ssh"
-      },
-      {
-        "title": "<code>status</code>",
-        "path": "commands/status"
-      },
-      {
-        "title": "<code>token</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/token"
-          },
-          {
-            "title": "<code>capabilities</code>",
-            "path": "commands/token/capabilities"
-          },
-          {
-            "title": "<code>create</code>",
-            "path": "commands/token/create"
-          },
-          {
-            "title": "<code>lookup</code>",
-            "path": "commands/token/lookup"
-          },
-          {
-            "title": "<code>renew</code>",
-            "path": "commands/token/renew"
-          },
-          {
-            "title": "<code>revoke</code>",
-            "path": "commands/token/revoke"
-          }
-        ]
-      },
-      {
-        "title": "<code>transit</code>",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "commands/transit"
-          },
-          {
-            "title": "<code>import</code> and <code>import-version</code>",
-            "path": "commands/transit/import"
-          }
-        ]
-      },
-      {
-        "title": "<code>unwrap</code>",
-        "path": "commands/unwrap"
-      },
-      {
-        "title": "<code>version</code>",
-        "path": "commands/version"
-      },
-      {
-        "title": "<code>version-history</code>",
-        "path": "commands/version-history"
-      },
-      {
-        "title": "<code>write</code>",
-        "path": "commands/write"
-      },
-      {
-        "title": "Token Helpers",
-        "path": "commands/token-helper"
-      }
-    ]
-  },
-  {
-    "title": "Vault UI",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "ui"
-      },
-      {
-        "title": "Custom Messages",
-        "path": "ui/custom-messages",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        }
-      }
-    ]
-  },
-  {
-    "title": "Vault Agent and Vault Proxy",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "agent-and-proxy"
-      },
-      {
-        "title": "Auto-Auth",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "agent-and-proxy/autoauth"
-          },
-          {
-            "title": "Methods",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "agent-and-proxy/autoauth/methods"
-              },
-              {
-                "title": "AliCloud",
-                "path": "agent-and-proxy/autoauth/methods/alicloud"
-              },
-              {
-                "title": "AppRole",
-                "path": "agent-and-proxy/autoauth/methods/approle"
-              },
-              {
-                "title": "AWS",
-                "path": "agent-and-proxy/autoauth/methods/aws"
-              },
-              {
-                "title": "Azure",
-                "path": "agent-and-proxy/autoauth/methods/azure"
-              },
-              {
-                "title": "Cert",
-                "path": "agent-and-proxy/autoauth/methods/cert"
-              },
-              {
-                "title": "CF",
-                "path": "agent-and-proxy/autoauth/methods/cf"
-              },
-              {
-                "title": "GCP",
-                "path": "agent-and-proxy/autoauth/methods/gcp"
-              },
-              {
-                "title": "JWT",
-                "path": "agent-and-proxy/autoauth/methods/jwt"
-              },
-              {
-                "title": "LDAP",
-                "path": "agent-and-proxy/autoauth/methods/ldap"
-              },
-              {
-                "title": "Kerberos",
-                "path": "agent-and-proxy/autoauth/methods/kerberos"
-              },
-              {
-                "title": "Kubernetes",
-                "path": "agent-and-proxy/autoauth/methods/kubernetes"
-              },
-              {
-                "title": "Oracle Cloud Infrastructure",
-                "path": "agent-and-proxy/autoauth/methods/oci"
-              },
-              {
-                "title": "Token File",
-                "path": "agent-and-proxy/autoauth/methods/token_file"
-              }
-            ]
-          },
-          {
-            "title": "Sinks",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "agent-and-proxy/autoauth/sinks"
-              },
-              {
-                "title": "File",
-                "path": "agent-and-proxy/autoauth/sinks/file"
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "title": "Vault Proxy",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "agent-and-proxy/proxy"
-          },
-          {
-            "title": "API Proxy",
-            "path": "agent-and-proxy/proxy/apiproxy"
-          },
-          {
-            "title": "Caching",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "agent-and-proxy/proxy/caching"
-              },
-              {
-                "title": "Static Secret Caching",
-                "path": "agent-and-proxy/proxy/caching/static-secret-caching"
-              },
-              {
-                "title": "Persistent Caching",
-                "routes": [
-                  {
-                    "title": "Overview",
-                    "path": "agent-and-proxy/proxy/caching/persistent-caches"
-                  },
-                  {
-                    "title": "Kubernetes",
-                    "path": "agent-and-proxy/proxy/caching/persistent-caches/kubernetes"
-                  }
-                ]
-              }
-            ]
-          },
-          {
-            "title": "Version compatibility",
-            "path": "agent-and-proxy/proxy/versions"
-          }
-        ]
-      },
-      {
-        "title": "Vault Agent",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "agent-and-proxy/agent"
-          },
-          {
-            "title": "API Proxy",
-            "path": "agent-and-proxy/agent/apiproxy"
-          },
-          {
-            "title": "Caching",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "agent-and-proxy/agent/caching"
-              },
-              {
-                "title": "Persistent Caching",
-                "routes": [
-                  {
-                    "title": "Overview",
-                    "path": "agent-and-proxy/agent/caching/persistent-caches"
-                  },
-                  {
-                    "title": "Kubernetes",
-                    "path": "agent-and-proxy/agent/caching/persistent-caches/kubernetes"
-                  }
-                ]
-              }
-            ]
-          },
-          {
-            "title": "generate-config",
-            "path": "agent-and-proxy/agent/generate-config"
-          },
-          {
-            "title": "Process Supervisor Mode",
-            "path": "agent-and-proxy/agent/process-supervisor"
-          },
-          {
-            "title": "Templates",
-            "path": "agent-and-proxy/agent/template"
-          },
-          {
-            "title": "Windows service",
-            "path": "agent-and-proxy/agent/winsvc"
-          },
-          {
-            "title": "Version compatibility",
-            "path": "agent-and-proxy/agent/versions"
-          }
-        ]
-      }
-    ]
-  },
-  {
-    "divider": true
-  },
-  {
-    "title": "Secrets Engines",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "secrets"
-      },
-      {
-        "title": "Active Directory",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secrets/ad"
-          },
-          {
-            "title": "Migration Guide",
-            "path": "secrets/ad/migration-guide"
-          }
-        ]
-      },
-      {
-        "title": "AliCloud",
-        "path": "secrets/alicloud"
-      },
-      {
-        "title": "AWS",
-        "path": "secrets/aws"
-      },
-      {
-        "title": "Azure",
-        "path": "secrets/azure"
-      },
-      {
-        "title": "Consul",
-        "path": "secrets/consul"
-      },
-      {
-        "title": "Cubbyhole",
-        "path": "secrets/cubbyhole"
-      },
-      {
-        "title": "Databases",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secrets/databases"
-          },
-          {
-            "title": "Cassandra",
-            "path": "secrets/databases/cassandra"
-          },
-          {
-            "title": "Couchbase",
-            "path": "secrets/databases/couchbase"
-          },
-          {
-            "title": "Elasticsearch",
-            "path": "secrets/databases/elasticdb"
-          },
-          {
-            "title": "HanaDB",
-            "path": "secrets/databases/hanadb"
-          },
-          {
-            "title": "IBM Db2",
-            "path": "secrets/databases/db2"
-          },
-          {
-            "title": "InfluxDB",
-            "path": "secrets/databases/influxdb"
-          },
-          {
-            "title": "MongoDB",
-            "path": "secrets/databases/mongodb"
-          },
-          {
-            "title": "MongoDB Atlas",
-            "path": "secrets/databases/mongodbatlas"
-          },
-          {
-            "title": "MSSQL",
-            "path": "secrets/databases/mssql"
-          },
-          {
-            "title": "MySQL/MariaDB",
-            "path": "secrets/databases/mysql-maria"
-          },
-          {
-            "title": "Oracle",
-            "path": "secrets/databases/oracle"
-          },
-          {
-            "title": "PostgreSQL",
-            "path": "secrets/databases/postgresql"
-          },
-          {
-            "title": "Redis",
-            "path": "secrets/databases/redis"
-          },
-          {
-            "title": "Redis ElastiCache",
-            "path": "secrets/databases/rediselasticache"
-          },
-          {
-            "title": "Redshift",
-            "path": "secrets/databases/redshift"
-          },
-          {
-            "title": "Snowflake",
-            "path": "secrets/databases/snowflake"
-          },
-          {
-            "title": "Custom",
-            "path": "secrets/databases/custom"
-          }
-        ]
-      },
-      {
-        "title": "Google Cloud",
-        "path": "secrets/gcp"
-      },
-      {
-        "title": "Google Cloud KMS",
-        "path": "secrets/gcpkms"
-      },
-      {
-        "title": "Identity",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secrets/identity"
-          },
-          {
-            "title": "Identity Tokens",
-            "path": "secrets/identity/identity-token"
-          },
-          {
-            "title": "OIDC Identity Provider",
-            "path": "secrets/identity/oidc-provider"
-          }
-        ]
-      },
-      {
-        "title": "Key Management",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        },
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secrets/key-management"
-          },
-          {
-            "title": "Azure Key Vault",
-            "path": "secrets/key-management/azurekeyvault"
-          },
-          {
-            "title": "AWS KMS",
-            "path": "secrets/key-management/awskms"
-          },
-          {
-            "title": "GCP Cloud KMS",
-            "path": "secrets/key-management/gcpkms"
-          }
-        ]
-      },
-      {
-        "title": "Key Value",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secrets/kv"
-          },
-          {
-            "title": "KV version  1",
-            "path": "secrets/kv/kv-v1"
-          },
-          {
-            "title": "KV version  2",
-            "path": "secrets/kv/kv-v2"
-          }
-        ]
-      },
-      {
-        "title": "KMIP",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        },
-        "path": "secrets/kmip"
-      },
-      {
-        "title": "KMIP - Profile Support",
-        "path": "secrets/kmip-profiles",
-        "hidden": true
-      },
-      {
-        "title": "Kubernetes",
-        "path": "secrets/kubernetes"
-      },
-      {
-        "title": "MongoDB Atlas",
-        "path": "secrets/mongodbatlas"
-      },
-      {
-        "title": "Nomad",
-        "path": "secrets/nomad"
-      },
-      {
-        "title": "LDAP",
-        "path": "secrets/ldap"
-      },
-      {
-        "title": "PKI (Certificates)",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secrets/pki"
-          },
-          {
-            "title": "Setup and Usage",
-            "path": "secrets/pki/setup"
-          },
-          {
-            "title": "Quick Start - Root CA Setup",
-            "path": "secrets/pki/quick-start-root-ca"
-          },
-          {
-            "title": "Quick Start - Intermediate CA Setup",
-            "path": "secrets/pki/quick-start-intermediate-ca"
-          },
-          {
-            "title": "Considerations",
-            "path": "secrets/pki/considerations"
-          },
-          {
-            "title": "Troubleshooting ACME integration",
-            "path": "secrets/pki/troubleshooting-acme"
-          },
-
-          {
-            "title": "Rotation Primitives",
-            "path": "secrets/pki/rotation-primitives"
-          },
-          {
-            "title": "Certificate Issuance External Policy Service (CIEPS)",
-            "badge": {
-              "text": "ENTERPRISE",
-              "type": "outlined",
-              "color": "neutral"
-            },
-            "path": "secrets/pki/cieps"
-          }
-        ]
-      },
-      {
-        "title": "RabbitMQ",
-        "path": "secrets/rabbitmq"
-      },
-      {
-        "title": "SSH",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secrets/ssh"
-          },
-          {
-            "title": "Signed Certificates",
-            "path": "secrets/ssh/signed-ssh-certificates"
-          },
-          {
-            "title": "SSH OTP",
-            "path": "secrets/ssh/one-time-ssh-passwords"
-          }
-        ]
-      },
-      {
-        "title": "Terraform Cloud",
-        "path": "secrets/terraform"
-      },
-      {
-        "title": "TOTP",
-        "path": "secrets/totp"
-      },
-      {
-        "title": "Transform",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        },
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secrets/transform"
-          },
-          {
-            "title": "FF3-1 Tweak Usage",
-            "path": "secrets/transform/ff3-tweak-details"
-          },
-          {
-            "title": "Tokenization Transform",
-            "badge": {
-              "text": "ENTERPRISE",
-              "type": "outlined",
-              "color": "neutral"
-            },
-            "path": "secrets/transform/tokenization"
-          }
-        ]
-      },
-      {
-        "title": "Transit",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "secrets/transit"
-          },
-          {
-            "title": "Import Key Wrapping Guide",
-            "path": "secrets/transit/key-wrapping-guide"
-          }
-        ]
-      },
-      {
-        "title": "Venafi (Certificates)",
-        "path": "secrets/venafi"
-      }
-    ]
-  },
-  {
-    "title": "Secrets Sync",
-    "badge": {
-      "text": "ENTERPRISE",
-      "type": "outlined",
-      "color": "neutral"
-    },
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "sync",
-        "badge": {
-          "text": "BETA",
-          "type": "outlined",
-          "color": "highlight"
-        }
-      },
-      {
-        "title": "AWS Secrets Manager",
-        "path": "sync/awssm"
-      },
-      {
-        "title": "Azure Key Vault",
-        "path": "sync/azurekv"
-      },
-      {
-        "title": "GCP Secret Manager",
-        "path": "sync/gcpsm"
-      },
-      {
-        "title": "GitHub",
-        "path": "sync/github"
-      },
-      {
-        "title": "Vercel Project",
-        "path": "sync/vercelproject"
-      }
-    ]
-  },
-  {
-    "title": "Auth Methods",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "auth"
-      },
-      {
-        "title": "AppRole",
-        "path": "auth/approle"
-      },
-      {
-        "title": "AliCloud",
-        "path": "auth/alicloud"
-      },
-      {
-        "title": "AWS",
-        "path": "auth/aws"
-      },
-      {
-        "title": "Azure",
-        "path": "auth/azure"
-      },
-      {
-        "title": "Cloud Foundry",
-        "path": "auth/cf"
-      },
-      {
-        "title": "GitHub",
-        "path": "auth/github"
-      },
-      {
-        "title": "Google Cloud",
-        "path": "auth/gcp"
-      },
-      {
-        "title": "JWT/OIDC",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "auth/jwt"
-          },
-          {
-            "title": "OIDC Providers",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "auth/jwt/oidc-providers"
-              },
-              {
-                "title": "ADFS",
-                "path": "auth/jwt/oidc-providers/adfs"
-              },
-              {
-                "title": "Auth0",
-                "path": "auth/jwt/oidc-providers/auth0"
-              },
-              {
-                "title": "Azure AD",
-                "path": "auth/jwt/oidc-providers/azuread"
-              },
-              {
-                "title": "Forgerock",
-                "path": "auth/jwt/oidc-providers/forgerock"
-              },
-              {
-                "title": "Gitlab",
-                "path": "auth/jwt/oidc-providers/gitlab"
-              },
-              {
-                "title": "Google",
-                "path": "auth/jwt/oidc-providers/google"
-              },
-              {
-                "title": "Keycloak",
-                "path": "auth/jwt/oidc-providers/keycloak"
-              },
-              {
-                "title": "Kubernetes",
-                "path": "auth/jwt/oidc-providers/kubernetes"
-              },
-              {
-                "title": "Okta",
-                "path": "auth/jwt/oidc-providers/okta"
-              },
-              {
-                "title": "SecureAuth",
-                "path": "auth/jwt/oidc-providers/secureauth"
-              },
-              {
-                "title": "IBM ISAM",
-                "path": "auth/jwt/oidc-providers/ibmisam"
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "title": "Kerberos",
-        "path": "auth/kerberos"
-      },
-      {
-        "title": "Kubernetes",
-        "path": "auth/kubernetes"
-      },
-      {
-        "title": "LDAP",
-        "path": "auth/ldap"
-      },
-      {
-        "title": "Login MFA",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "auth/login-mfa"
-          },
-          {
-            "title": "FAQ",
-            "path": "auth/login-mfa/faq"
-          }
-        ]
-      },
-      {
-        "title": "Oracle Cloud Infrastructure",
-        "path": "auth/oci"
-      },
-      {
-        "title": "Okta",
-        "path": "auth/okta"
-      },
-      {
-        "title": "RADIUS",
-        "path": "auth/radius"
-      },
-      {
-        "title": "SAML",
-        "path": "auth/saml",
-        "badge": {
-          "text": "ENTERPRISE",
-          "type": "outlined",
-          "color": "neutral"
-        }
-      },
-      {
-        "title": "TLS Certificates",
-        "path": "auth/cert"
-      },
-      {
-        "title": "Tokens",
-        "path": "auth/token"
-      },
-      {
-        "title": "Username and Password",
-        "path": "auth/userpass"
-      },
-      {
-        "divider": true
-      }
-    ]
-  },
-  {
-    "title": "Audit Devices",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "audit"
-      },
-      {
-        "title": "File",
-        "path": "audit/file"
-      },
-      {
-        "title": "Syslog",
-        "path": "audit/syslog"
-      },
-      {
-        "title": "Socket",
-        "path": "audit/socket"
-      }
-    ]
-  },
-  {
-    "title": "Plugins",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "plugins"
-      },
-      {
-        "title": "Plugin Architecture",
-        "path": "plugins/plugin-architecture"
-      },
-      {
-        "title": "Plugin Development",
-        "path": "plugins/plugin-development"
-      },
-      {
-        "title": "Plugin Management",
-        "path": "plugins/plugin-management"
-      },
-      {
-        "title": "Containerized plugins",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "plugins/containerized-plugins",
-            "badge": {
-              "text": "BETA",
-              "type": "outlined",
-              "color": "highlight"
-            }
-          },
-          {
-            "title": "Add a containerized plugin",
-            "path": "plugins/containerized-plugins/add-a-containerized-plugin",
-            "badge": {
-              "text": "BETA",
-              "type": "outlined",
-              "color": "highlight"
-            }
-          }
-        ]
-      },
-      {
-        "title": "Integrations Library",
-        "href": "/vault/integrations"
-      }
-    ]
-  },
-  {
-    "title": "Vault Integration Program",
-    "path": "partnerships"
-  },
-  {
-    "title": "Vault Interoperability Matrix",
-    "path": "interoperability-matrix"
-  },
-  {
-    "title": "Troubleshoot",
-    "href": "https://learn.hashicorp.com/tutorials/vault/troubleshooting-vault"
-  },
-  {
-    "divider": true
-  },
-  {
-    "title": "Platforms",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "platform"
-      },
-      {
-        "title": "AWS",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "platform/aws"
-          },
-          {
-            "title": "Vault Lambda Extension",
-            "path": "platform/aws/lambda-extension"
-          },
-          {
-            "title": "Running Vault",
-            "path": "platform/aws/run"
-          }
-        ]
-      },
-      {
-        "title": "GitHub",
-        "routes": [
-          {
-            "title": "GitHub Actions",
-            "path": "platform/github-actions"
-          }
-        ]
-      },
-      {
-        "title": "Kubernetes",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "platform/k8s"
-          },
-          {
-            "title": "Agent Injector vs. Vault CSI Provider",
-            "path": "platform/k8s/injector-csi"
-          },
-
-          {
-            "title": "Helm Chart",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "platform/k8s/helm"
-              },
-              {
-                "title": "Running Vault",
-                "path": "platform/k8s/helm/run"
-              },
-              {
-                "title": "Enterprise Licensing",
-                "path": "platform/k8s/helm/enterprise"
-              },
-              {
-                "title": "Running Vault on OpenShift",
-                "path": "platform/k8s/helm/openshift"
-              },
-              {
-                "title": "Configuration",
-                "path": "platform/k8s/helm/configuration"
-              },
-              {
-                "title": "Terraform",
-                "path": "platform/k8s/helm/terraform"
-              },
-              {
-                "title": "Examples",
-                "routes": [
-                  {
-                    "title": "Overview",
-                    "path": "platform/k8s/helm/examples"
-                  },
-                  {
-                    "title": "Development",
-                    "path": "platform/k8s/helm/examples/development"
-                  },
-                  {
-                    "title": "Standalone with Load Balanced UI",
-                    "path": "platform/k8s/helm/examples/standalone-load-balanced-ui"
-                  },
-                  {
-                    "title": "Standalone with TLS",
-                    "path": "platform/k8s/helm/examples/standalone-tls"
-                  },
-                  {
-                    "title": "Standalone with Audit Storage",
-                    "path": "platform/k8s/helm/examples/standalone-audit"
-                  },
-                  {
-                    "title": "External Vault",
-                    "path": "platform/k8s/helm/examples/external"
-                  },
-                  {
-                    "title": "Using Kubernetes Auth Method",
-                    "path": "platform/k8s/helm/examples/kubernetes-auth"
-                  },
-                  {
-                    "title": "HA Cluster with Consul",
-                    "path": "platform/k8s/helm/examples/ha-with-consul"
-                  },
-                  {
-                    "title": "HA Cluster with Raft",
-                    "path": "platform/k8s/helm/examples/ha-with-raft"
-                  },
-                  {
-                    "title": "HA Cluster with Raft and TLS",
-                    "path": "platform/k8s/helm/examples/ha-tls"
-                  },
-                  {
-                    "title": "HA Enterprise Cluster with Raft",
-                    "path": "platform/k8s/helm/examples/enterprise-with-raft"
-                  },
-                  {
-                    "title": "HA Enterprise DR Clusters with Raft",
-                    "path": "platform/k8s/helm/examples/enterprise-dr-with-raft"
-                  },
-                  {
-                    "title": "HA Enterprise Performance Clusters with Raft",
-                    "path": "platform/k8s/helm/examples/enterprise-perf-with-raft"
-                  },
-                  {
-                    "title": "Vault Agent Injector TLS Configuration",
-                    "path": "platform/k8s/helm/examples/injector-tls"
-                  },
-                  {
-                    "title": "Vault Agent Injector TLS with Cert-Manager",
-                    "path": "platform/k8s/helm/examples/injector-tls-cert-manager"
-                  }
-                ]
-              }
-            ]
-          },
-          {
-            "title": "Agent Injector",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "platform/k8s/injector"
-              },
-              {
-                "title": "Annotations",
-                "path": "platform/k8s/injector/annotations"
-              },
-              {
-                "title": "Installation",
-                "path": "platform/k8s/injector/installation"
-              },
-              {
-                "title": "Examples",
-                "path": "platform/k8s/injector/examples"
-              }
-            ]
-          },
-          {
-            "title": "Vault CSI Provider",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "platform/k8s/csi"
-              },
-              {
-                "title": "Installation",
-                "path": "platform/k8s/csi/installation"
-              },
-              {
-                "title": "Configurations",
-                "path": "platform/k8s/csi/configurations"
-              },
-              {
-                "title": "Examples",
-                "path": "platform/k8s/csi/examples"
-              }
-            ]
-          },
-          {
-            "title": "Vault Secrets Operator",
-            "routes": [
-              {
-                "title": "Overview",
-                "path": "platform/k8s/vso"
-              },
-              {
-                "title": "Installation",
-                "path": "platform/k8s/vso/installation"
-              },
-              {
-                "title": "Secret Sources",
-                "routes": [
-                  {
-                    "title": "Overview",
-                    "path": "platform/k8s/vso/sources"
-                  },
-                  {
-                    "title": "Vault",
-                    "routes": [
-                      {
-                        "title": "Overview",
-                        "path": "platform/k8s/vso/sources/vault"
-                      },
-                      {
-                        "title": "Auth Methods",
-                        "routes": [
-                          {
-                            "title": "AWS",
-                            "path": "platform/k8s/vso/sources/vault/auth/aws"
-                          },
-                          {
-                            "title": "GCP",
-                            "path": "platform/k8s/vso/sources/vault/auth/gcp"
-                          }
-                        ]
-                      }
-                    ]
-                  },
-                  {
-                    "title": "HCP Vault Secrets",
-                    "path": "platform/k8s/vso/sources/hvs"
-                  }
-                ]
-              },
-              {
-                "title": "Secret Data Transformation",
-                "path": "platform/k8s/vso/secret-transformation"
-              },
-              {
-                "title": "Helm Chart",
-                "path": "platform/k8s/vso/helm"
-              },
-              {
-                "title": "Examples",
-                "path": "platform/k8s/vso/examples"
-              },
-              {
-                "title": "Telemetry",
-                "path": "platform/k8s/vso/telemetry"
-              },
-              {
-                "title": "API Reference",
-                "path": "platform/k8s/vso/api-reference"
-              },
-              {
-                "title": "OpenShift",
-                "path": "platform/k8s/vso/openshift"
-              }
-            ]
-          }
-        ]
-      },
-      {
-        "title": "Microsoft SQL Server EKM provider",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "platform/mssql"
-          },
-          {
-            "title": "Installation",
-            "path": "platform/mssql/installation"
-          },
-          {
-            "title": "Configuration",
-            "path": "platform/mssql/configuration"
-          },
-          {
-            "title": "Upgrading",
-            "path": "platform/mssql/upgrading"
-          },
-          {
-            "title": "Troubleshooting",
-            "path": "platform/mssql/troubleshooting"
-          },
-          {
-            "title": "Release Notes",
-            "path": "platform/mssql/changelog"
-          }
-        ]
-      },
-      {
-        "title": "ServiceNow",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "platform/servicenow"
-          },
-          {
-            "title": "Installation",
-            "path": "platform/servicenow/installation"
-          },
-          {
-            "title": "Configuration",
-            "path": "platform/servicenow/configuration"
-          },
-          {
-            "title": "Troubleshooting",
-            "path": "platform/servicenow/troubleshooting"
-          }
-        ]
-      }
-    ]
-  },
-  {
-    "divider": true
-  },
-  {
-    "title": "Upgrade Guides",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "upgrading"
-      },
-      {
-        "title": "Upgrade Vault HA installations",
-        "path": "upgrading/vault-ha-upgrade"
-      },
-      {
-        "title": "Upgrade Plugins",
-        "path": "upgrading/plugins"
-      },
-      {
-        "title": "Upgrade to 1.16.x",
-        "path": "upgrading/upgrade-to-1.16.x"
-      },
-      {
-        "title": "Upgrade to 1.15.x",
-        "path": "upgrading/upgrade-to-1.15.x"
-      },
-      {
-        "title": "Upgrade to 1.14.x",
-        "path": "upgrading/upgrade-to-1.14.x"
-      },
-      {
-        "title": "Upgrade to 1.13.x",
-        "path": "upgrading/upgrade-to-1.13.x"
-      },
-      {
-        "title": "Upgrade to 1.12.x",
-        "path": "upgrading/upgrade-to-1.12.x"
-      },
-      {
-        "title": "Upgrade to 1.11.x",
-        "path": "upgrading/upgrade-to-1.11.x"
-      },
-      {
-        "title": "Upgrade to 1.10.x",
-        "path": "upgrading/upgrade-to-1.10.x"
-      },
-      {
-        "title": "Upgrade to 1.9.x",
-        "path": "upgrading/upgrade-to-1.9.x"
-      },
-      {
-        "title": "Upgrade to 1.8.x",
-        "path": "upgrading/upgrade-to-1.8.x"
-      },
-      {
-        "title": "Upgrade to 1.7.x",
-        "path": "upgrading/upgrade-to-1.7.x"
-      },
-      {
-        "title": "Upgrade to 1.6.3",
-        "path": "upgrading/upgrade-to-1.6.3"
-      },
-      {
-        "title": "Upgrade to 1.6.2",
-        "path": "upgrading/upgrade-to-1.6.2"
-      },
-      {
-        "title": "Upgrade to 1.6.1",
-        "path": "upgrading/upgrade-to-1.6.1"
-      },
-      {
-        "title": "Upgrade to 1.6.0",
-        "path": "upgrading/upgrade-to-1.6.0"
-      },
-      {
-        "title": "Upgrade to 1.5.3",
-        "path": "upgrading/upgrade-to-1.5.3"
-      },
-      {
-        "title": "Upgrade to 1.5.2",
-        "path": "upgrading/upgrade-to-1.5.2"
-      },
-      {
-        "title": "Upgrade to 1.5.1",
-        "path": "upgrading/upgrade-to-1.5.1"
-      },
-      {
-        "title": "Upgrade to 1.5.0",
-        "path": "upgrading/upgrade-to-1.5.0"
-      },
-      {
-        "title": "Upgrade to 1.4.6",
-        "path": "upgrading/upgrade-to-1.4.6"
-      },
-      {
-        "title": "Upgrade to 1.4.5",
-        "path": "upgrading/upgrade-to-1.4.5"
-      },
-      {
-        "title": "Upgrade to 1.4.4",
-        "path": "upgrading/upgrade-to-1.4.4"
-      },
-      {
-        "title": "Upgrade to 1.4.1",
-        "path": "upgrading/upgrade-to-1.4.1"
-      },
-      {
-        "title": "Upgrade to 1.4.0",
-        "path": "upgrading/upgrade-to-1.4.0"
-      },
-      {
-        "title": "Upgrade to 1.3.10",
-        "path": "upgrading/upgrade-to-1.3.10"
-      },
-      {
-        "title": "Upgrade to 1.3.9",
-        "path": "upgrading/upgrade-to-1.3.9"
-      },
-      {
-        "title": "Upgrade to 1.3.8",
-        "path": "upgrading/upgrade-to-1.3.8"
-      },
-      {
-        "title": "Upgrade to 1.3.5",
-        "path": "upgrading/upgrade-to-1.3.5"
-      },
-      {
-        "title": "Upgrade to 1.3.4",
-        "path": "upgrading/upgrade-to-1.3.4"
-      },
-      {
-        "title": "Upgrade to 1.3.3",
-        "path": "upgrading/upgrade-to-1.3.3"
-      },
-      {
-        "title": "Upgrade to 1.3.2",
-        "path": "upgrading/upgrade-to-1.3.2"
-      },
-      {
-        "title": "Upgrade to 1.3.0",
-        "path": "upgrading/upgrade-to-1.3.0"
-      },
-      {
-        "title": "Upgrade to 1.2.7",
-        "path": "upgrading/upgrade-to-1.2.7"
-      },
-      {
-        "title": "Upgrade to 1.2.6",
-        "path": "upgrading/upgrade-to-1.2.6"
-      },
-      {
-        "title": "Upgrade to 1.2.5",
-        "path": "upgrading/upgrade-to-1.2.5"
-      },
-      {
-        "title": "Upgrade to 1.2.4",
-        "path": "upgrading/upgrade-to-1.2.4"
-      },
-      {
-        "title": "Upgrade to 1.2.1",
-        "path": "upgrading/upgrade-to-1.2.1"
-      },
-      {
-        "title": "Upgrade to 1.2.0",
-        "path": "upgrading/upgrade-to-1.2.0"
-      },
-      {
-        "title": "Upgrade to 1.1.2",
-        "path": "upgrading/upgrade-to-1.1.2"
-      },
-      {
-        "title": "Upgrade to 1.1.1",
-        "path": "upgrading/upgrade-to-1.1.1"
-      },
-      {
-        "title": "Upgrade to 1.1.0",
-        "path": "upgrading/upgrade-to-1.1.0"
-      },
-      {
-        "title": "Upgrade to 1.0.0",
-        "path": "upgrading/upgrade-to-1.0.0"
-      },
-      {
-        "title": "Upgrade to 0.11.6",
-        "path": "upgrading/upgrade-to-0.11.6"
-      },
-      {
-        "title": "Upgrade to 0.11.2",
-        "path": "upgrading/upgrade-to-0.11.2"
-      },
-      {
-        "title": "Upgrade to 0.11.0",
-        "path": "upgrading/upgrade-to-0.11.0"
-      },
-      {
-        "title": "Upgrade to 0.10.4",
-        "path": "upgrading/upgrade-to-0.10.4"
-      },
-      {
-        "title": "Upgrade to 0.10.2",
-        "path": "upgrading/upgrade-to-0.10.2"
-      },
-      {
-        "title": "Upgrade to 0.10.0",
-        "path": "upgrading/upgrade-to-0.10.0"
-      },
-      {
-        "title": "Upgrade to 0.9.6",
-        "path": "upgrading/upgrade-to-0.9.6"
-      },
-      {
-        "title": "Upgrade to 0.9.3",
-        "path": "upgrading/upgrade-to-0.9.3"
-      },
-      {
-        "title": "Upgrade to 0.9.2",
-        "path": "upgrading/upgrade-to-0.9.2"
-      },
-      {
-        "title": "Upgrade to 0.9.1",
-        "path": "upgrading/upgrade-to-0.9.1"
-      },
-      {
-        "title": "Upgrade to 0.9.0",
-        "path": "upgrading/upgrade-to-0.9.0"
-      },
-      {
-        "title": "Upgrade to 0.8.0",
-        "path": "upgrading/upgrade-to-0.8.0"
-      },
-      {
-        "title": "Upgrade to 0.7.0",
-        "path": "upgrading/upgrade-to-0.7.0"
-      },
-      {
-        "title": "Upgrade to 0.6.4",
-        "path": "upgrading/upgrade-to-0.6.4"
-      },
-      {
-        "title": "Upgrade to 0.6.3",
-        "path": "upgrading/upgrade-to-0.6.3"
-      },
-      {
-        "title": "Upgrade to 0.6.2",
-        "path": "upgrading/upgrade-to-0.6.2"
-      },
-      {
-        "title": "Upgrade to 0.6.1",
-        "path": "upgrading/upgrade-to-0.6.1"
-      },
-      {
-        "title": "Upgrade to 0.6.0",
-        "path": "upgrading/upgrade-to-0.6.0"
-      },
-      {
-        "title": "Upgrade to 0.5.1",
-        "path": "upgrading/upgrade-to-0.5.1"
-      },
-      {
-        "title": "Upgrade to 0.5.0",
-        "path": "upgrading/upgrade-to-0.5.0"
-      }
-    ]
-  },
-  {
-    "divider": true
-  },
-  {
-    "title": "Release Notes",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "release-notes"
-      },
-      {
-        "title": "1.16.0",
-        "path": "release-notes/1.16.0"
-      },
-      {
-        "title": "1.15.0",
-        "path": "release-notes/1.15.0"
-      },
-      {
-        "title": "1.14.0",
-        "path": "release-notes/1.14.0"
-      },
-      {
-        "title": "1.13.0",
-        "path": "release-notes/1.13.0"
-      },
-      {
-        "title": "1.12.0",
-        "path": "release-notes/1.12.0"
-      },
-      {
-        "title": "1.11.0",
-        "path": "release-notes/1.11.0"
-      },
-      {
-        "title": "1.10.0",
-        "path": "release-notes/1.10.0"
-      },
-      {
-        "title": "1.9.0",
-        "path": "release-notes/1.9.0"
-      },
-      {
-        "title": "1.8.0",
-        "path": "release-notes/1.8.0"
-      },
-      {
-        "title": "1.7.0",
-        "path": "release-notes/1.7.0"
-      },
-      {
-        "title": "1.6.0",
-        "path": "release-notes/1.6.0"
-      },
-      {
-        "title": "1.5.0",
-        "path": "release-notes/1.5.0"
-      }
-    ]
-  },
-  {
-    "divider": true
-  },
-  {
-    "title": "Deprecation Notices",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "deprecation"
-      },
-      {
-        "title": "FAQ",
-        "path": "deprecation/faq"
-      }
-    ]
-  },
-  {
-    "divider": true
-  },
-  {
-    "title": "FAQ",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "faq"
-      },
-      {
-        "title": "Feature Deprecation Notice and Plans",
-        "href": "https://developer.hashicorp.com/vault/docs/deprecation/faq"
-      },
-      {
-        "title": "License",
-        "href": "https://developer.hashicorp.com/vault/docs/enterprise/license/faq"
-      },
-      {
-        "title": "Client Count",
-        "href": "https://developer.hashicorp.com/vault/docs/concepts/client-count/faq"
-      },
-      {
-        "title": "Login MFA",
-        "href": "https://developer.hashicorp.com/vault/docs/auth/login-mfa/faq"
-      },
-      {
-        "title": "Server Side Consistent Token",
-        "path": "faq/ssct"
-      }
-    ]
-  },
-  {
-    "divider": true
-  },
-  {
-    "title": "Glossary",
-    "path": "glossary"
-  },
-  {
-    "divider": true
-  },
-  {
-    "title": "Vault Enterprise",
-    "routes": [
-      {
-        "title": "Overview",
-        "path": "enterprise"
-      },
-      {
-        "title": "License",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "enterprise/license"
-          },
-          {
-            "title": "Autoloading",
-            "path": "enterprise/license/autoloading"
-          },
-          {
-            "title": "Automated license utilization reporting",
-            "path": "enterprise/license/utilization-reporting"
-          },
-          {
-            "title": "Manual license utilization reporting",
-            "path": "enterprise/license/manual-reporting"
-          },
-          {
-            "title": "FAQ",
-            "path": "enterprise/license/faq"
-          }
-        ]
-      },
-
-      {
-        "title": "Replication",
-        "path": "enterprise/replication"
-      },
-
-      {
-        "title": "HSM Support",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "enterprise/hsm"
-          },
-          {
-            "title": "Behavioral Changes",
-            "path": "enterprise/hsm/behavior"
-          },
-          {
-            "title": "Security",
-            "path": "enterprise/hsm/security"
-          }
-        ]
-      },
-      {
-        "title": "PKCS11 Provider",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "enterprise/pkcs11-provider"
-          },
-          {
-            "title": "AWS KMS XKS",
-            "path": "enterprise/pkcs11-provider/aws-xks"
-          },
-          {
-            "title": "Oracle TDE",
-            "path": "enterprise/pkcs11-provider/oracle-tde"
-          }
-        ]
-      },
-      {
-        "title": "Automated Integrated Storage Snapshots",
-        "path": "enterprise/automated-integrated-storage-snapshots"
-      },
-      {
-        "title": "Automated Upgrades",
-        "path": "enterprise/automated-upgrades"
-      },
-      {
-        "title": "Redundancy Zones",
-        "path": "enterprise/redundancy-zones"
-      },
-      {
-        "title": "Lease Count Quotas",
-        "path": "enterprise/lease-count-quotas"
-      },
-      {
-        "title": "Entropy Augmentation",
-        "path": "enterprise/entropy-augmentation"
-      },
-      {
-        "title": "FIPS",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "enterprise/fips"
-          },
-          {
-            "title": "FIPS 140-2 Inside Vault",
-            "path": "enterprise/fips/fips1402"
-          },
-          {
-            "title": "Seal Wrap for FIPS 140-2",
-            "path": "enterprise/fips/sealwrap"
-          }
-        ]
-      },
-      {
-        "title": "Seal Wrap",
-        "path": "enterprise/sealwrap"
-      },
-      {
-        "title": "Namespaces",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "enterprise/namespaces"
-          },
-          {
-            "title": "Create an administrative namespace",
-            "path": "enterprise/namespaces/create-admin-namespace"
-          },
-          {
-            "title": "Run Vault with many namespaces",
-            "path": "enterprise/namespaces/namespace-limits",
-            "badge": {
-              "text": "ENTERPRISE",
-              "type": "outlined",
-              "color": "neutral"
-            }
-          }
-        ]
-      },
-      {
-        "title": "Performance Standbys",
-        "path": "enterprise/performance-standby"
-      },
-      {
-        "title": "Eventual Consistency",
-        "path": "enterprise/consistency"
-      },
-      {
-        "title": "Control Groups",
-        "path": "enterprise/control-groups"
-      },
-      {
-        "title": "Managed Keys",
-        "path": "enterprise/managed-keys"
-      },
-      {
-        "title": "MFA",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "enterprise/mfa"
-          },
-          {
-            "title": "Duo MFA",
-            "path": "enterprise/mfa/mfa-duo"
-          },
-          {
-            "title": "Okta MFA",
-            "path": "enterprise/mfa/mfa-okta"
-          },
-          {
-            "title": "PingID MFA",
-            "path": "enterprise/mfa/mfa-pingid"
-          },
-          {
-            "title": "TOTP MFA",
-            "path": "enterprise/mfa/mfa-totp"
-          }
-        ]
-      },
-      {
-        "title": "Sentinel",
-        "routes": [
-          {
-            "title": "Overview",
-            "path": "enterprise/sentinel"
-          },
-          {
-            "title": "Examples",
-            "path": "enterprise/sentinel/examples"
-          },
-          {
-            "title": "Properties",
-            "path": "enterprise/sentinel/properties"
-          }
-        ]
-      },
-      {
-        "title": "HCP Vault",
-        "href": "https://cloud.hashicorp.com/docs/vault"
-      }
-    ]
-  }
-]
diff --git a/website/package-lock.json b/website/package-lock.json
deleted file mode 100644
index d0ff17cd190..00000000000
--- a/website/package-lock.json
+++ /dev/null
@@ -1,23470 +0,0 @@
-{
-  "name": "vault-docs",
-  "version": "1.0.0",
-  "lockfileVersion": 2,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "vault-docs",
-      "version": "1.0.0",
-      "hasInstallScript": true,
-      "devDependencies": {
-        "@hashicorp/platform-cli": "^2.6.0",
-        "@hashicorp/platform-content-conformance": "^0.0.9",
-        "dart-linkcheck": "2.0.15",
-        "next": "^14.0.4",
-        "prettier": "2.2.1",
-        "simple-git-hooks": "^2.6.1"
-      },
-      "engines": {
-        "node": ">=18.17.0 <= 20.x",
-        "npm": ">=9.8.0"
-      }
-    },
-    "node_modules/@babel/code-frame": {
-      "version": "7.22.13",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.22.13.tgz",
-      "integrity": "sha512-XktuhWlJ5g+3TJXc5upd9Ks1HutSArik6jf2eAjYFyIOf4ej3RN+184cZbzDvbPnuTJIUhPKKJE3cIsYTiAT3w==",
-      "dev": true,
-      "dependencies": {
-        "@babel/highlight": "^7.22.13",
-        "chalk": "^2.4.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/code-frame/node_modules/ansi-styles": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-      "dev": true,
-      "dependencies": {
-        "color-convert": "^1.9.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/code-frame/node_modules/chalk": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^3.2.1",
-        "escape-string-regexp": "^1.0.5",
-        "supports-color": "^5.3.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/code-frame/node_modules/color-convert": {
-      "version": "1.9.3",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-      "dev": true,
-      "dependencies": {
-        "color-name": "1.1.3"
-      }
-    },
-    "node_modules/@babel/code-frame/node_modules/color-name": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
-      "dev": true
-    },
-    "node_modules/@babel/code-frame/node_modules/has-flag": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/code-frame/node_modules/supports-color": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-      "dev": true,
-      "dependencies": {
-        "has-flag": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/compat-data": {
-      "version": "7.15.0",
-      "integrity": "sha512-0NqAC1IJE0S0+lL1SWFMxMkz1pKCNCjI4tr2Zx4LJSXxCLAdr6KyArnY+sno5m3yH9g737ygOyPABDsnXkpxiA==",
-      "dev": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/core": {
-      "version": "7.15.8",
-      "integrity": "sha512-3UG9dsxvYBMYwRv+gS41WKHno4K60/9GPy1CJaH6xy3Elq8CTtvtjT5R5jmNhXfCYLX2mTw+7/aq5ak/gOE0og==",
-      "dev": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.15.8",
-        "@babel/generator": "^7.15.8",
-        "@babel/helper-compilation-targets": "^7.15.4",
-        "@babel/helper-module-transforms": "^7.15.8",
-        "@babel/helpers": "^7.15.4",
-        "@babel/parser": "^7.15.8",
-        "@babel/template": "^7.15.4",
-        "@babel/traverse": "^7.15.4",
-        "@babel/types": "^7.15.6",
-        "convert-source-map": "^1.7.0",
-        "debug": "^4.1.0",
-        "gensync": "^1.0.0-beta.2",
-        "json5": "^2.1.2",
-        "semver": "^6.3.0",
-        "source-map": "^0.5.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/babel"
-      }
-    },
-    "node_modules/@babel/core/node_modules/semver": {
-      "version": "6.3.0",
-      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-      "dev": true,
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/@babel/generator": {
-      "version": "7.23.0",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.23.0.tgz",
-      "integrity": "sha512-lN85QRR+5IbYrMWM6Y4pE/noaQtg4pNiqeNGX60eqOfo6gtEj6uw/JagelB8vVztSd7R6M5n1+PQkDbHbBRU4g==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.23.0",
-        "@jridgewell/gen-mapping": "^0.3.2",
-        "@jridgewell/trace-mapping": "^0.3.17",
-        "jsesc": "^2.5.1"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.15.4",
-      "integrity": "sha512-rMWPCirulnPSe4d+gwdWXLfAXTTBj8M3guAf5xFQJ0nvFY7tfNAFnWdqaHegHlgDZOCT4qvhF3BYlSJag8yhqQ==",
-      "dev": true,
-      "dependencies": {
-        "@babel/compat-data": "^7.15.0",
-        "@babel/helper-validator-option": "^7.14.5",
-        "browserslist": "^4.16.6",
-        "semver": "^6.3.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
-      "version": "6.3.0",
-      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-      "dev": true,
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/@babel/helper-environment-visitor": {
-      "version": "7.22.20",
-      "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.22.20.tgz",
-      "integrity": "sha512-zfedSIzFhat/gFhWfHtgWvlec0nqB9YEIVrpuwjruLlXfUSnA8cJB0miHKwqDnQ7d32aKo2xt88/xZptwxbfhA==",
-      "dev": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-function-name": {
-      "version": "7.23.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.23.0.tgz",
-      "integrity": "sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw==",
-      "dev": true,
-      "dependencies": {
-        "@babel/template": "^7.22.15",
-        "@babel/types": "^7.23.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-hoist-variables": {
-      "version": "7.22.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.22.5.tgz",
-      "integrity": "sha512-wGjk9QZVzvknA6yKIUURb8zY3grXCcOZt+/7Wcy8O2uctxhplmUPkOdlgoNhmdVee2c92JXbf1xpMtVNbfoxRw==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.22.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-member-expression-to-functions": {
-      "version": "7.15.4",
-      "integrity": "sha512-cokOMkxC/BTyNP1AlY25HuBWM32iCEsLPI4BHDpJCHHm1FU2E7dKWWIXJgQgSFiu4lp8q3bL1BIKwqkSUviqtA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.15.4"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-module-imports": {
-      "version": "7.15.4",
-      "integrity": "sha512-jeAHZbzUwdW/xHgHQ3QmWR4Jg6j15q4w/gCfwZvtqOxoo5DKtLHk8Bsf4c5RZRC7NmLEs+ohkdq8jFefuvIxAA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.15.4"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-module-transforms": {
-      "version": "7.15.8",
-      "integrity": "sha512-DfAfA6PfpG8t4S6npwzLvTUpp0sS7JrcuaMiy1Y5645laRJIp/LiLGIBbQKaXSInK8tiGNI7FL7L8UvB8gdUZg==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-module-imports": "^7.15.4",
-        "@babel/helper-replace-supers": "^7.15.4",
-        "@babel/helper-simple-access": "^7.15.4",
-        "@babel/helper-split-export-declaration": "^7.15.4",
-        "@babel/helper-validator-identifier": "^7.15.7",
-        "@babel/template": "^7.15.4",
-        "@babel/traverse": "^7.15.4",
-        "@babel/types": "^7.15.6"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-optimise-call-expression": {
-      "version": "7.15.4",
-      "integrity": "sha512-E/z9rfbAOt1vDW1DR7k4SzhzotVV5+qMciWV6LaG1g4jeFrkDlJedjtV4h0i4Q/ITnUu+Pk08M7fczsB9GXBDw==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.15.4"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-plugin-utils": {
-      "version": "7.20.2",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.20.2.tgz",
-      "integrity": "sha512-8RvlJG2mj4huQ4pZ+rU9lqKi9ZKiRmuvGuM2HlWmkmgOhbs6zEAw6IEiJ5cQqGbDzGZOhwuOQNtZMi/ENLjZoQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-replace-supers": {
-      "version": "7.15.4",
-      "integrity": "sha512-/ztT6khaXF37MS47fufrKvIsiQkx1LBRvSJNzRqmbyeZnTwU9qBxXYLaaT/6KaxfKhjs2Wy8kG8ZdsFUuWBjzw==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-member-expression-to-functions": "^7.15.4",
-        "@babel/helper-optimise-call-expression": "^7.15.4",
-        "@babel/traverse": "^7.15.4",
-        "@babel/types": "^7.15.4"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-simple-access": {
-      "version": "7.15.4",
-      "integrity": "sha512-UzazrDoIVOZZcTeHHEPYrr1MvTR/K+wgLg6MY6e1CJyaRhbibftF6fR2KU2sFRtI/nERUZR9fBd6aKgBlIBaPg==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.15.4"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-split-export-declaration": {
-      "version": "7.22.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.22.6.tgz",
-      "integrity": "sha512-AsUnxuLhRYsisFiaJwvp1QF+I3KjD5FOxut14q/GzovUe6orHLesW2C7d754kRm53h5gqrz6sFl6sxc4BVtE/g==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.22.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-string-parser": {
-      "version": "7.22.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.22.5.tgz",
-      "integrity": "sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==",
-      "dev": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.22.20",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.20.tgz",
-      "integrity": "sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==",
-      "dev": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helper-validator-option": {
-      "version": "7.14.5",
-      "integrity": "sha512-OX8D5eeX4XwcroVW45NMvoYaIuFI+GQpA2a8Gi+X/U/cDUIRsV37qQfF905F0htTRCREQIB4KqPeaveRJUl3Ow==",
-      "dev": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/helpers": {
-      "version": "7.15.4",
-      "integrity": "sha512-V45u6dqEJ3w2rlryYYXf6i9rQ5YMNu4FLS6ngs8ikblhu2VdR1AqAd6aJjBzmf2Qzh6KOLqKHxEN9+TFbAkAVQ==",
-      "dev": true,
-      "dependencies": {
-        "@babel/template": "^7.15.4",
-        "@babel/traverse": "^7.15.4",
-        "@babel/types": "^7.15.4"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/highlight": {
-      "version": "7.22.20",
-      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.22.20.tgz",
-      "integrity": "sha512-dkdMCN3py0+ksCgYmGG8jKeGA/8Tk+gJwSYYlFGxG5lmhfKNoAy004YpLxpS1W2J8m/EK2Ew+yOs9pVRwO89mg==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.22.20",
-        "chalk": "^2.4.2",
-        "js-tokens": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/ansi-styles": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-      "dev": true,
-      "dependencies": {
-        "color-convert": "^1.9.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/chalk": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^3.2.1",
-        "escape-string-regexp": "^1.0.5",
-        "supports-color": "^5.3.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/color-convert": {
-      "version": "1.9.3",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-      "dev": true,
-      "dependencies": {
-        "color-name": "1.1.3"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/color-name": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
-      "dev": true
-    },
-    "node_modules/@babel/highlight/node_modules/has-flag": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/highlight/node_modules/supports-color": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-      "dev": true,
-      "dependencies": {
-        "has-flag": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/@babel/parser": {
-      "version": "7.23.0",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.23.0.tgz",
-      "integrity": "sha512-vvPKKdMemU85V9WE/l5wZEmImpCtLqbnTvqDS2U1fJ96KrxoW7KrXhNsNCblQlg8Ck4b85yxdTyelsMUgFUXiw==",
-      "dev": true,
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-proposal-object-rest-spread": {
-      "version": "7.12.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.12.1.tgz",
-      "integrity": "sha512-s6SowJIjzlhx8o7lsFx5zmY4At6CTtDvgNQDdPzkBQucle58A6b/TTeEBYtyDgmcXjUTM+vE8YOGHZzzbc/ioA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.10.4",
-        "@babel/plugin-syntax-object-rest-spread": "^7.8.0",
-        "@babel/plugin-transform-parameters": "^7.12.1"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-async-generators": {
-      "version": "7.8.4",
-      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-bigint": {
-      "version": "7.8.3",
-      "integrity": "sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-class-properties": {
-      "version": "7.12.13",
-      "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.12.13"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-import-meta": {
-      "version": "7.10.4",
-      "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.10.4"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-json-strings": {
-      "version": "7.8.3",
-      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-jsx": {
-      "version": "7.12.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.12.1.tgz",
-      "integrity": "sha512-1yRi7yAtB0ETgxdY9ti/p2TivUxJkTdhu/ZbF9MshVGqOx1TdB3b7xCXs49Fupgg50N45KcAsRP/ZqWjs9SRjg==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.10.4"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-logical-assignment-operators": {
-      "version": "7.10.4",
-      "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.10.4"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-nullish-coalescing-operator": {
-      "version": "7.8.3",
-      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-numeric-separator": {
-      "version": "7.10.4",
-      "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.10.4"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-object-rest-spread": {
-      "version": "7.8.3",
-      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-optional-catch-binding": {
-      "version": "7.8.3",
-      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-optional-chaining": {
-      "version": "7.8.3",
-      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-top-level-await": {
-      "version": "7.14.5",
-      "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.14.5"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/plugin-transform-parameters": {
-      "version": "7.20.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.20.7.tgz",
-      "integrity": "sha512-WiWBIkeHKVOSYPO0pWkxGPfKeWrCJyD3NJ53+Lrp/QMSZbsVPovrVl2aWZ19D/LTVnaDv5Ap7GJ/B2CTOZdrfA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.20.2"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0-0"
-      }
-    },
-    "node_modules/@babel/runtime": {
-      "version": "7.20.7",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.20.7.tgz",
-      "integrity": "sha512-UF0tvkUtxwAgZ5W/KrkHf0Rn0fdnLDU9ScxBrEVNUprE/MzirjK4MJUX1/BVDv00Sv8cljtukVK1aky++X1SjQ==",
-      "dev": true,
-      "dependencies": {
-        "regenerator-runtime": "^0.13.11"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/template": {
-      "version": "7.22.15",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.22.15.tgz",
-      "integrity": "sha512-QPErUVm4uyJa60rkI73qneDacvdvzxshT3kksGqlGWYdOTIUOwJ7RDUL8sGqslY1uXWSL6xMFKEXDS3ox2uF0w==",
-      "dev": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.22.13",
-        "@babel/parser": "^7.22.15",
-        "@babel/types": "^7.22.15"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/traverse": {
-      "version": "7.23.2",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.23.2.tgz",
-      "integrity": "sha512-azpe59SQ48qG6nu2CzcMLbxUudtN+dOM9kDbUqGq3HXUJRlo7i8fvPoxQUzYgLZ4cMVmuZgm8vvBpNeRhd6XSw==",
-      "dev": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.22.13",
-        "@babel/generator": "^7.23.0",
-        "@babel/helper-environment-visitor": "^7.22.20",
-        "@babel/helper-function-name": "^7.23.0",
-        "@babel/helper-hoist-variables": "^7.22.5",
-        "@babel/helper-split-export-declaration": "^7.22.6",
-        "@babel/parser": "^7.23.0",
-        "@babel/types": "^7.23.0",
-        "debug": "^4.1.0",
-        "globals": "^11.1.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/types": {
-      "version": "7.23.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.23.0.tgz",
-      "integrity": "sha512-0oIyUfKoI3mSqMvsxBdclDwxXKXAUA8v/apZbc+iSyARYou1o8ZGDxbUYyLFoW2arqS2jDGqJuZvv1d/io1axg==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-string-parser": "^7.22.5",
-        "@babel/helper-validator-identifier": "^7.22.20",
-        "to-fast-properties": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@bcoe/v8-coverage": {
-      "version": "0.2.3",
-      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/@cnakazawa/watch": {
-      "version": "1.0.4",
-      "integrity": "sha512-v9kIhKwjeZThiWrLmj0y17CWoyddASLj9O2yvbZkbvw/N3rWOYy9zkV66ursAoVr0mV15bL8g0c4QZUE6cdDoQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "exec-sh": "^0.3.2",
-        "minimist": "^1.2.0"
-      },
-      "bin": {
-        "watch": "cli.js"
-      },
-      "engines": {
-        "node": ">=0.1.95"
-      }
-    },
-    "node_modules/@eslint/eslintrc": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-1.4.1.tgz",
-      "integrity": "sha512-XXrH9Uarn0stsyldqDYq8r++mROmWRI1xKMXa640Bb//SY1+ECYX6VzT6Lcx5frD0V30XieqJ0oX9I2Xj5aoMA==",
-      "dev": true,
-      "dependencies": {
-        "ajv": "^6.12.4",
-        "debug": "^4.3.2",
-        "espree": "^9.4.0",
-        "globals": "^13.19.0",
-        "ignore": "^5.2.0",
-        "import-fresh": "^3.2.1",
-        "js-yaml": "^4.1.0",
-        "minimatch": "^3.1.2",
-        "strip-json-comments": "^3.1.1"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/@eslint/eslintrc/node_modules/globals": {
-      "version": "13.19.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-13.19.0.tgz",
-      "integrity": "sha512-dkQ957uSRWHw7CFXLUtUHQI3g3aWApYhfNR2O6jn/907riyTYKVBmxYVROkBcY614FSSeSJh7Xm7SrUWCxvJMQ==",
-      "dev": true,
-      "dependencies": {
-        "type-fest": "^0.20.2"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@eslint/eslintrc/node_modules/type-fest": {
-      "version": "0.20.2",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
-      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@hashicorp/platform-cli": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/@hashicorp/platform-cli/-/platform-cli-2.6.0.tgz",
-      "integrity": "sha512-nMO7Uiy/A5CT/BCE9RyQt6/Uci7bxwTesxCNWkXlciyqlIrz9WmBa9hr710IiMoDzrzQ1tL6AgFIeTbXs4RTqA==",
-      "dev": true,
-      "dependencies": {
-        "@hashicorp/platform-cms": "0.3.0",
-        "@typescript-eslint/eslint-plugin": "^5.48.0",
-        "@typescript-eslint/parser": "^5.48.0",
-        "chalk": "4.1.0",
-        "commander": "7.2.0",
-        "ejs": "3.1.5",
-        "eslint": "^8.31.0",
-        "eslint-config-next": "^13.1.1",
-        "eslint-config-prettier": "^8.6.0",
-        "eslint-plugin-jsx-a11y": "^6.6.1",
-        "eslint-plugin-prettier": "^4.2.1",
-        "fs-extra": "9.0.1",
-        "globby": "11.0.1",
-        "inquirer": "7.3.3",
-        "lint-staged": "11.1.2",
-        "open": "7.3.0",
-        "prettier": "2.5.1",
-        "readdirp": "3.5.0",
-        "signale": "1.4.0",
-        "slugify": "1.4.6",
-        "stylelint": "13.8.0",
-        "stylelint-config-css-modules": "2.2.0",
-        "stylelint-config-prettier": "8.0.2",
-        "stylelint-config-standard": "20.0.0",
-        "stylelint-media-use-custom-media": "2.0.0",
-        "stylelint-order": "4.1.0",
-        "stylelint-use-nesting": "3.0.0",
-        "stylelint-value-no-unknown-custom-properties": "3.0.0",
-        "ts-jest": "^26.4.4"
-      },
-      "bin": {
-        "next-hashicorp": "next-hashicorp"
-      }
-    },
-    "node_modules/@hashicorp/platform-cli/node_modules/prettier": {
-      "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.5.1.tgz",
-      "integrity": "sha512-vBZcPRUR5MZJwoyi3ZoyQlc1rXeEck8KgeC9AwwOn+exuxLxq5toTRDTSaVrXHxelDMHy9zlicw8u66yxoSUFg==",
-      "dev": true,
-      "bin": {
-        "prettier": "bin-prettier.js"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/@hashicorp/platform-cms": {
-      "version": "0.3.0",
-      "integrity": "sha512-sRX9A+kDEZvfZy8PvGFbEaHjn5G1mEsHwTri1vDnrmKG8apE+ELlug83b0iEkD5wIJi9OqaewMIb0NrLxg9s5A==",
-      "dev": true,
-      "dependencies": {
-        "rivet-graphql": "0.3.1"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance": {
-      "version": "0.0.9",
-      "resolved": "https://registry.npmjs.org/@hashicorp/platform-content-conformance/-/platform-content-conformance-0.0.9.tgz",
-      "integrity": "sha512-kotY/4M/0YjiUGPgXv9vbWMiZJV5N5tlXTN3e+VzTQlQfbEXP1xYDcs6pNMtxbxCwfS29pkNRIWAsnGVIbBISw==",
-      "dev": true,
-      "dependencies": {
-        "find-up": "^6.3.0",
-        "flat": "^5.0.2",
-        "globby": "^13.1.2",
-        "mdast-util-to-string": "^3.1.0",
-        "remark": "12.0.1",
-        "remark-mdx": "^1.6.22",
-        "unified-lint-rule": "^2.1.1",
-        "unist-util-stringify-position": "^3.0.2",
-        "unist-util-visit": "^4.1.1",
-        "vfile": "^5.3.6",
-        "vfile-matter": "^4.0.0",
-        "vfile-reporter": "^7.0.4",
-        "vfile-reporter-json": "^3.2.0",
-        "vfile-statistics": "^2.0.0",
-        "yaml": "^2.1.3",
-        "yargs": "^17.4.1",
-        "zod": "^3.19.1"
-      },
-      "bin": {
-        "hc-content": "dist/cli.js"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/cliui": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
-      "dev": true,
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.1",
-        "wrap-ansi": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/find-up": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-6.3.0.tgz",
-      "integrity": "sha512-v2ZsoEuVHYy8ZIlYqwPe/39Cy+cFDzp4dXPaxNvkEuouymu+2Jbz0PxpKarJHYJTmv2HWT3O382qY8l4jMWthw==",
-      "dev": true,
-      "dependencies": {
-        "locate-path": "^7.1.0",
-        "path-exists": "^5.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/globby": {
-      "version": "13.1.3",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-13.1.3.tgz",
-      "integrity": "sha512-8krCNHXvlCgHDpegPzleMq07yMYTO2sXKASmZmquEYWEmCx6J5UTRbp5RwMJkTJGtcQ44YpiUYUiN0b9mzy8Bw==",
-      "dev": true,
-      "dependencies": {
-        "dir-glob": "^3.0.1",
-        "fast-glob": "^3.2.11",
-        "ignore": "^5.2.0",
-        "merge2": "^1.4.1",
-        "slash": "^4.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/locate-path": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-7.2.0.tgz",
-      "integrity": "sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==",
-      "dev": true,
-      "dependencies": {
-        "p-locate": "^6.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/mdast-util-to-string": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-3.1.1.tgz",
-      "integrity": "sha512-tGvhT94e+cVnQt8JWE9/b3cUQZWS732TJxXHktvP+BYo62PpYD53Ls/6cC60rW21dW+txxiM4zMdc6abASvZKA==",
-      "dev": true,
-      "dependencies": {
-        "@types/mdast": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/p-limit": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-4.0.0.tgz",
-      "integrity": "sha512-5b0R4txpzjPWVw/cXXUResoD4hb6U/x9BH08L7nw+GN1sezDzPdxeRvpc9c433fZhBan/wusjbCsqwqm4EIBIQ==",
-      "dev": true,
-      "dependencies": {
-        "yocto-queue": "^1.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/p-locate": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-6.0.0.tgz",
-      "integrity": "sha512-wPrq66Llhl7/4AGC6I+cqxT07LhXvWL08LNXz1fENOw0Ap4sRZZ/gZpTTJ5jpurzzzfS2W/Ge9BY3LgLjCShcw==",
-      "dev": true,
-      "dependencies": {
-        "p-limit": "^4.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/path-exists": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-5.0.0.tgz",
-      "integrity": "sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==",
-      "dev": true,
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/remark": {
-      "version": "12.0.1",
-      "resolved": "https://registry.npmjs.org/remark/-/remark-12.0.1.tgz",
-      "integrity": "sha512-gS7HDonkdIaHmmP/+shCPejCEEW+liMp/t/QwmF0Xt47Rpuhl32lLtDV1uKWvGoq+kxr5jSgg5oAIpGuyULjUw==",
-      "dev": true,
-      "dependencies": {
-        "remark-parse": "^8.0.0",
-        "remark-stringify": "^8.0.0",
-        "unified": "^9.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/remark-stringify": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/remark-stringify/-/remark-stringify-8.1.1.tgz",
-      "integrity": "sha512-q4EyPZT3PcA3Eq7vPpT6bIdokXzFGp9i85igjmhRyXWmPs0Y6/d2FYwUNotKAWyLch7g0ASZJn/KHHcHZQ163A==",
-      "dev": true,
-      "dependencies": {
-        "ccount": "^1.0.0",
-        "is-alphanumeric": "^1.0.0",
-        "is-decimal": "^1.0.0",
-        "is-whitespace-character": "^1.0.0",
-        "longest-streak": "^2.0.1",
-        "markdown-escapes": "^1.0.0",
-        "markdown-table": "^2.0.0",
-        "mdast-util-compact": "^2.0.0",
-        "parse-entities": "^2.0.0",
-        "repeat-string": "^1.5.4",
-        "state-toggle": "^1.0.0",
-        "stringify-entities": "^3.0.0",
-        "unherit": "^1.0.4",
-        "xtend": "^4.0.1"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/slash": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
-      "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
-      "dev": true,
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/unist-util-stringify-position": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-      "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/vfile": {
-      "version": "5.3.7",
-      "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-      "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "is-buffer": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/vfile-message": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-      "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/y18n": {
-      "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/yaml": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.1.tgz",
-      "integrity": "sha512-e0WHiYql7+9wr4cWMx3TVQrNwejKaEe7/rHNmQmqRjazfOP5W8PB6Jpebb5o6fIapbz9o9+2ipcaTM2ZwDI6lw==",
-      "dev": true,
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/yargs": {
-      "version": "17.7.1",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.1.tgz",
-      "integrity": "sha512-cwiTb08Xuv5fqF4AovYacTFNxk62th7LKJ6BL9IGUpTJrWoU7/7WdQGTP2SjKf1dUNBGzDd28p/Yfs/GI6JrLw==",
-      "dev": true,
-      "dependencies": {
-        "cliui": "^8.0.1",
-        "escalade": "^3.1.1",
-        "get-caller-file": "^2.0.5",
-        "require-directory": "^2.1.1",
-        "string-width": "^4.2.3",
-        "y18n": "^5.0.5",
-        "yargs-parser": "^21.1.1"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/yargs-parser": {
-      "version": "21.1.1",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
-      "dev": true,
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@hashicorp/platform-content-conformance/node_modules/yocto-queue": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.0.0.tgz",
-      "integrity": "sha512-9bnSc/HEW2uRy67wc+T8UwauLuPJVn28jb+GtJY16iiKWyvmYJRXVT4UamsAEGQfPohgr2q4Tq0sQbQlxTfi1g==",
-      "dev": true,
-      "engines": {
-        "node": ">=12.20"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@humanwhocodes/config-array": {
-      "version": "0.11.8",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.8.tgz",
-      "integrity": "sha512-UybHIJzJnR5Qc/MsD9Kr+RpO2h+/P1GhOwdiLPXK5TWk5sgTdu88bTD9UP+CKbPPh5Rni1u0GjAdYQLemG8g+g==",
-      "dev": true,
-      "dependencies": {
-        "@humanwhocodes/object-schema": "^1.2.1",
-        "debug": "^4.1.1",
-        "minimatch": "^3.0.5"
-      },
-      "engines": {
-        "node": ">=10.10.0"
-      }
-    },
-    "node_modules/@humanwhocodes/module-importer": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
-      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
-      "dev": true,
-      "engines": {
-        "node": ">=12.22"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
-      }
-    },
-    "node_modules/@humanwhocodes/object-schema": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-1.2.1.tgz",
-      "integrity": "sha512-ZnQMnLV4e7hDlUvw8H+U8ASL02SS2Gn6+9Ac3wGGLIe7+je2AeAOxPY+izIPJDfFDb7eDjev0Us8MO1iFRN8hA==",
-      "dev": true
-    },
-    "node_modules/@istanbuljs/load-nyc-config": {
-      "version": "1.1.0",
-      "integrity": "sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "camelcase": "^5.3.1",
-        "find-up": "^4.1.0",
-        "get-package-type": "^0.1.0",
-        "js-yaml": "^3.13.1",
-        "resolve-from": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/argparse": {
-      "version": "1.0.10",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "sprintf-js": "~1.0.2"
-      }
-    },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/find-up": {
-      "version": "4.1.0",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "locate-path": "^5.0.0",
-        "path-exists": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
-      "version": "3.14.1",
-      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "argparse": "^1.0.7",
-        "esprima": "^4.0.0"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/locate-path": {
-      "version": "5.0.0",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-locate": "^4.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/p-limit": {
-      "version": "2.3.0",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-try": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/p-locate": {
-      "version": "4.1.0",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-limit": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/path-exists": {
-      "version": "4.0.0",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/resolve-from": {
-      "version": "5.0.0",
-      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@istanbuljs/schema": {
-      "version": "0.1.3",
-      "integrity": "sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/@jest/console": {
-      "version": "26.6.2",
-      "integrity": "sha512-IY1R2i2aLsLr7Id3S6p2BA82GNWryt4oSvEXLAKc+L2zdi89dSkE8xC1C+0kpATG4JhBJREnQOH7/zmccM2B0g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "chalk": "^4.0.0",
-        "jest-message-util": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "slash": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/@jest/core": {
-      "version": "26.6.3",
-      "integrity": "sha512-xvV1kKbhfUqFVuZ8Cyo+JPpipAHHAV3kcDBftiduK8EICXmTFddryy3P7NfZt8Pv37rA9nEJBKCCkglCPt/Xjw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/console": "^26.6.2",
-        "@jest/reporters": "^26.6.2",
-        "@jest/test-result": "^26.6.2",
-        "@jest/transform": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "ansi-escapes": "^4.2.1",
-        "chalk": "^4.0.0",
-        "exit": "^0.1.2",
-        "graceful-fs": "^4.2.4",
-        "jest-changed-files": "^26.6.2",
-        "jest-config": "^26.6.3",
-        "jest-haste-map": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-regex-util": "^26.0.0",
-        "jest-resolve": "^26.6.2",
-        "jest-resolve-dependencies": "^26.6.3",
-        "jest-runner": "^26.6.3",
-        "jest-runtime": "^26.6.3",
-        "jest-snapshot": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jest-validate": "^26.6.2",
-        "jest-watcher": "^26.6.2",
-        "micromatch": "^4.0.2",
-        "p-each-series": "^2.1.0",
-        "rimraf": "^3.0.0",
-        "slash": "^3.0.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/@jest/environment": {
-      "version": "26.6.2",
-      "integrity": "sha512-nFy+fHl28zUrRsCeMB61VDThV1pVTtlEokBRgqPrcT1JNq4yRNIyTHfyht6PqtUvY9IsuLGTrbG8kPXjSZIZwA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/fake-timers": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "jest-mock": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/@jest/fake-timers": {
-      "version": "26.6.2",
-      "integrity": "sha512-14Uleatt7jdzefLPYM3KLcnUl1ZNikaKq34enpb5XG9i81JpppDb5muZvonvKyrl7ftEHkKS5L5/eB/kxJ+bvA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "@sinonjs/fake-timers": "^6.0.1",
-        "@types/node": "*",
-        "jest-message-util": "^26.6.2",
-        "jest-mock": "^26.6.2",
-        "jest-util": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/@jest/globals": {
-      "version": "26.6.2",
-      "integrity": "sha512-85Ltnm7HlB/KesBUuALwQ68YTU72w9H2xW9FjZ1eL1U3lhtefjjl5c2MiUbpXt/i6LaPRvoOFJ22yCBSfQ0JIA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/environment": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "expect": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/@jest/reporters": {
-      "version": "26.6.2",
-      "integrity": "sha512-h2bW53APG4HvkOnVMo8q3QXa6pcaNt1HkwVsOPMBV6LD/q9oSpxNSYZQYkAnjdMjrJ86UuYeLo+aEZClV6opnw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@bcoe/v8-coverage": "^0.2.3",
-        "@jest/console": "^26.6.2",
-        "@jest/test-result": "^26.6.2",
-        "@jest/transform": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "chalk": "^4.0.0",
-        "collect-v8-coverage": "^1.0.0",
-        "exit": "^0.1.2",
-        "glob": "^7.1.2",
-        "graceful-fs": "^4.2.4",
-        "istanbul-lib-coverage": "^3.0.0",
-        "istanbul-lib-instrument": "^4.0.3",
-        "istanbul-lib-report": "^3.0.0",
-        "istanbul-lib-source-maps": "^4.0.0",
-        "istanbul-reports": "^3.0.2",
-        "jest-haste-map": "^26.6.2",
-        "jest-resolve": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jest-worker": "^26.6.2",
-        "slash": "^3.0.0",
-        "source-map": "^0.6.0",
-        "string-length": "^4.0.1",
-        "terminal-link": "^2.0.0",
-        "v8-to-istanbul": "^7.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      },
-      "optionalDependencies": {
-        "node-notifier": "^8.0.0"
-      }
-    },
-    "node_modules/@jest/reporters/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/@jest/source-map": {
-      "version": "26.6.2",
-      "integrity": "sha512-YwYcCwAnNmOVsZ8mr3GfnzdXDAl4LaenZP5z+G0c8bzC9/dugL8zRmxZzdoTl4IaS3CryS1uWnROLPFmb6lVvA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "callsites": "^3.0.0",
-        "graceful-fs": "^4.2.4",
-        "source-map": "^0.6.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/@jest/source-map/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/@jest/test-result": {
-      "version": "26.6.2",
-      "integrity": "sha512-5O7H5c/7YlojphYNrK02LlDIV2GNPYisKwHm2QTKjNZeEzezCbwYs9swJySv2UfPMyZ0VdsmMv7jIlD/IKYQpQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/console": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/istanbul-lib-coverage": "^2.0.0",
-        "collect-v8-coverage": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/@jest/test-sequencer": {
-      "version": "26.6.3",
-      "integrity": "sha512-YHlVIjP5nfEyjlrSr8t/YdNfU/1XEt7c5b4OxcXCjyRhjzLYu/rO69/WHPuYcbCWkz8kAeZVZp2N2+IOLLEPGw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/test-result": "^26.6.2",
-        "graceful-fs": "^4.2.4",
-        "jest-haste-map": "^26.6.2",
-        "jest-runner": "^26.6.3",
-        "jest-runtime": "^26.6.3"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/@jest/transform": {
-      "version": "26.6.2",
-      "integrity": "sha512-E9JjhUgNzvuQ+vVAL21vlyfy12gP0GhazGgJC4h6qUt1jSdUXGWJ1wfu/X7Sd8etSgxV4ovT1pb9v5D6QW4XgA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/core": "^7.1.0",
-        "@jest/types": "^26.6.2",
-        "babel-plugin-istanbul": "^6.0.0",
-        "chalk": "^4.0.0",
-        "convert-source-map": "^1.4.0",
-        "fast-json-stable-stringify": "^2.0.0",
-        "graceful-fs": "^4.2.4",
-        "jest-haste-map": "^26.6.2",
-        "jest-regex-util": "^26.0.0",
-        "jest-util": "^26.6.2",
-        "micromatch": "^4.0.2",
-        "pirates": "^4.0.1",
-        "slash": "^3.0.0",
-        "source-map": "^0.6.1",
-        "write-file-atomic": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/@jest/transform/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/@jest/types": {
-      "version": "26.6.2",
-      "integrity": "sha512-fC6QCp7Sc5sX6g8Tvbmj4XUTbyrik0akgRy03yjXbQaBWWNWGE7SGtJk98m0N8nzegD/7SggrUlivxo5ax4KWQ==",
-      "dev": true,
-      "dependencies": {
-        "@types/istanbul-lib-coverage": "^2.0.0",
-        "@types/istanbul-reports": "^3.0.0",
-        "@types/node": "*",
-        "@types/yargs": "^15.0.0",
-        "chalk": "^4.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.3.tgz",
-      "integrity": "sha512-HLhSWOLRi875zjjMG/r+Nv0oCW8umGb0BgEhyX3dDX3egwZtB8PqLnjz3yedt8R5StBrzcg4aBpnh8UA9D1BoQ==",
-      "dev": true,
-      "dependencies": {
-        "@jridgewell/set-array": "^1.0.1",
-        "@jridgewell/sourcemap-codec": "^1.4.10",
-        "@jridgewell/trace-mapping": "^0.3.9"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.1.tgz",
-      "integrity": "sha512-dSYZh7HhCDtCKm4QakX0xFpsRDqjjtZf/kjI/v3T3Nwt5r8/qz/M19F9ySyOqU94SXBmeG9ttTul+YnR4LOxFA==",
-      "dev": true,
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@jridgewell/set-array": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
-      "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
-      "dev": true,
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.4.15",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.15.tgz",
-      "integrity": "sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg==",
-      "dev": true
-    },
-    "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.20",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.20.tgz",
-      "integrity": "sha512-R8LcPeWZol2zR8mmH3JeKQ6QRCFb7XgUhV9ZlGhHLGyg4wpPiPZNQOOWhFZhxKw8u//yTbNGI42Bx/3paXEQ+Q==",
-      "dev": true,
-      "dependencies": {
-        "@jridgewell/resolve-uri": "^3.1.0",
-        "@jridgewell/sourcemap-codec": "^1.4.14"
-      }
-    },
-    "node_modules/@mdx-js/util": {
-      "version": "1.6.22",
-      "resolved": "https://registry.npmjs.org/@mdx-js/util/-/util-1.6.22.tgz",
-      "integrity": "sha512-H1rQc1ZOHANWBvPcW+JpGwr+juXSxM8Q8YCkm3GhZd8REu1fHR3z99CErO1p9pkcfcxZnMdIZdIsXkOHY0NilA==",
-      "dev": true,
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/@next/env": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-14.0.4.tgz",
-      "integrity": "sha512-irQnbMLbUNQpP1wcE5NstJtbuA/69kRfzBrpAD7Gsn8zm/CY6YQYc3HQBz8QPxwISG26tIm5afvvVbu508oBeQ==",
-      "dev": true
-    },
-    "node_modules/@next/eslint-plugin-next": {
-      "version": "13.1.2",
-      "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-13.1.2.tgz",
-      "integrity": "sha512-WGaNVvIYphdriesP6r7jq/8l7u38tzotnVQuxc1RYKLqYYApSsrebti3OCPoT3Gx0pw2smPIFHH98RzcsgW5GQ==",
-      "dev": true,
-      "dependencies": {
-        "glob": "7.1.7"
-      }
-    },
-    "node_modules/@next/eslint-plugin-next/node_modules/glob": {
-      "version": "7.1.7",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.7.tgz",
-      "integrity": "sha512-OvD9ENzPLbegENnYP5UUfJIirTg4+XwMWGaQfQTY0JenxNvvIKP3U3/tAQSPIu/lHxXYSZmpXlUHeqAIdKzBLQ==",
-      "dev": true,
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.0.4",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/@next/swc-darwin-arm64": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-14.0.4.tgz",
-      "integrity": "sha512-mF05E/5uPthWzyYDyptcwHptucf/jj09i2SXBPwNzbgBNc+XnwzrL0U6BmPjQeOL+FiB+iG1gwBeq7mlDjSRPg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-darwin-x64": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-14.0.4.tgz",
-      "integrity": "sha512-IZQ3C7Bx0k2rYtrZZxKKiusMTM9WWcK5ajyhOZkYYTCc8xytmwSzR1skU7qLgVT/EY9xtXDG0WhY6fyujnI3rw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-linux-arm64-gnu": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-14.0.4.tgz",
-      "integrity": "sha512-VwwZKrBQo/MGb1VOrxJ6LrKvbpo7UbROuyMRvQKTFKhNaXjUmKTu7wxVkIuCARAfiI8JpaWAnKR+D6tzpCcM4w==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-linux-arm64-musl": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-14.0.4.tgz",
-      "integrity": "sha512-8QftwPEW37XxXoAwsn+nXlodKWHfpMaSvt81W43Wh8dv0gkheD+30ezWMcFGHLI71KiWmHK5PSQbTQGUiidvLQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-linux-x64-gnu": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-14.0.4.tgz",
-      "integrity": "sha512-/s/Pme3VKfZAfISlYVq2hzFS8AcAIOTnoKupc/j4WlvF6GQ0VouS2Q2KEgPuO1eMBwakWPB1aYFIA4VNVh667A==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-linux-x64-musl": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-14.0.4.tgz",
-      "integrity": "sha512-m8z/6Fyal4L9Bnlxde5g2Mfa1Z7dasMQyhEhskDATpqr+Y0mjOBZcXQ7G5U+vgL22cI4T7MfvgtrM2jdopqWaw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-win32-arm64-msvc": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-14.0.4.tgz",
-      "integrity": "sha512-7Wv4PRiWIAWbm5XrGz3D8HUkCVDMMz9igffZG4NB1p4u1KoItwx9qjATHz88kwCEal/HXmbShucaslXCQXUM5w==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-win32-ia32-msvc": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-ia32-msvc/-/swc-win32-ia32-msvc-14.0.4.tgz",
-      "integrity": "sha512-zLeNEAPULsl0phfGb4kdzF/cAVIfaC7hY+kt0/d+y9mzcZHsMS3hAS829WbJ31DkSlVKQeHEjZHIdhN+Pg7Gyg==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@next/swc-win32-x64-msvc": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-14.0.4.tgz",
-      "integrity": "sha512-yEh2+R8qDlDCjxVpzOTEpBLQTEFAcP2A8fUFLaWNap9GitYKkKv1//y2S6XY6zsR4rCOPRpU7plYDR+az2n30A==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/@nodelib/fs.scandir": {
-      "version": "2.1.5",
-      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
-      "dev": true,
-      "dependencies": {
-        "@nodelib/fs.stat": "2.0.5",
-        "run-parallel": "^1.1.9"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/@nodelib/fs.stat": {
-      "version": "2.0.5",
-      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
-      "dev": true,
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/@nodelib/fs.walk": {
-      "version": "1.2.8",
-      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
-      "dev": true,
-      "dependencies": {
-        "@nodelib/fs.scandir": "2.1.5",
-        "fastq": "^1.6.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/@pkgr/utils": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/@pkgr/utils/-/utils-2.3.1.tgz",
-      "integrity": "sha512-wfzX8kc1PMyUILA+1Z/EqoE4UCXGy0iRGMhPwdfae1+f0OXlLqCk+By+aMzgJBzR9AzS4CDizioG6Ss1gvAFJw==",
-      "dev": true,
-      "dependencies": {
-        "cross-spawn": "^7.0.3",
-        "is-glob": "^4.0.3",
-        "open": "^8.4.0",
-        "picocolors": "^1.0.0",
-        "tiny-glob": "^0.2.9",
-        "tslib": "^2.4.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/unts"
-      }
-    },
-    "node_modules/@pkgr/utils/node_modules/open": {
-      "version": "8.4.0",
-      "resolved": "https://registry.npmjs.org/open/-/open-8.4.0.tgz",
-      "integrity": "sha512-XgFPPM+B28FtCCgSb9I+s9szOC1vZRSwgWsRUA5ylIxRTgKozqjOCrVOqGsYABPYK5qnfqClxZTFBa8PKt2v6Q==",
-      "dev": true,
-      "dependencies": {
-        "define-lazy-prop": "^2.0.0",
-        "is-docker": "^2.1.1",
-        "is-wsl": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@pkgr/utils/node_modules/picocolors": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
-      "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==",
-      "dev": true
-    },
-    "node_modules/@rushstack/eslint-patch": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@rushstack/eslint-patch/-/eslint-patch-1.2.0.tgz",
-      "integrity": "sha512-sXo/qW2/pAcmT43VoRKOJbDOfV3cYpq3szSVfIThQXNt+E4DfKj361vaAt3c88U5tPUxzEswam7GW48PJqtKAg==",
-      "dev": true
-    },
-    "node_modules/@sinonjs/commons": {
-      "version": "1.8.3",
-      "integrity": "sha512-xkNcLAn/wZaX14RPlwizcKicDk9G3F8m2nU3L7Ukm5zBgTwiT0wsoFAHx9Jq56fJA1z/7uKGtCRu16sOUCLIHQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "type-detect": "4.0.8"
-      }
-    },
-    "node_modules/@sinonjs/fake-timers": {
-      "version": "6.0.1",
-      "integrity": "sha512-MZPUxrmFubI36XS1DI3qmI0YdN1gks62JtFZvxR67ljjSNCeK6U08Zx4msEWOXuofgqUt6zPHSi1H9fbjR/NRA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@sinonjs/commons": "^1.7.0"
-      }
-    },
-    "node_modules/@stylelint/postcss-css-in-js": {
-      "version": "0.37.2",
-      "integrity": "sha512-nEhsFoJurt8oUmieT8qy4nk81WRHmJynmVwn/Vts08PL9fhgIsMhk1GId5yAN643OzqEEb5S/6At2TZW7pqPDA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/core": ">=7.9.0"
-      },
-      "peerDependencies": {
-        "postcss": ">=7.0.0",
-        "postcss-syntax": ">=0.36.2"
-      }
-    },
-    "node_modules/@stylelint/postcss-markdown": {
-      "version": "0.36.2",
-      "integrity": "sha512-2kGbqUVJUGE8dM+bMzXG/PYUWKkjLIkRLWNh39OaADkiabDRdw8ATFCgbMz5xdIcvwspPAluSL7uY+ZiTWdWmQ==",
-      "deprecated": "Use the original unforked package instead: postcss-markdown",
-      "dev": true,
-      "dependencies": {
-        "remark": "^13.0.0",
-        "unist-util-find-all-after": "^3.0.2"
-      },
-      "peerDependencies": {
-        "postcss": ">=7.0.0",
-        "postcss-syntax": ">=0.36.2"
-      }
-    },
-    "node_modules/@swc/helpers": {
-      "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.2.tgz",
-      "integrity": "sha512-E4KcWTpoLHqwPHLxidpOqQbcrZVgi0rsmmZXUle1jXmJfuIf/UWpczUJ7MZZ5tlxytgJXyp0w4PGkkeLiuIdZw==",
-      "dev": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tootallnate/once": {
-      "version": "1.1.2",
-      "integrity": "sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/@types/babel__core": {
-      "version": "7.1.16",
-      "integrity": "sha512-EAEHtisTMM+KaKwfWdC3oyllIqswlznXCIVCt7/oRNrh+DhgT4UEBNC/jlADNjvw7UnfbcdkGQcPVZ1xYiLcrQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/parser": "^7.1.0",
-        "@babel/types": "^7.0.0",
-        "@types/babel__generator": "*",
-        "@types/babel__template": "*",
-        "@types/babel__traverse": "*"
-      }
-    },
-    "node_modules/@types/babel__generator": {
-      "version": "7.6.3",
-      "integrity": "sha512-/GWCmzJWqV7diQW54smJZzWbSFf4QYtF71WCKhcx6Ru/tFyQIY2eiiITcCAeuPbNSvT9YCGkVMqqvSk2Z0mXiA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/types": "^7.0.0"
-      }
-    },
-    "node_modules/@types/babel__template": {
-      "version": "7.4.1",
-      "integrity": "sha512-azBFKemX6kMg5Io+/rdGT0dkGreboUVR0Cdm3fz9QJWpaQGJRQXl7C+6hOTCZcMll7KFyEQpgbYI2lHdsS4U7g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/parser": "^7.1.0",
-        "@babel/types": "^7.0.0"
-      }
-    },
-    "node_modules/@types/babel__traverse": {
-      "version": "7.14.2",
-      "integrity": "sha512-K2waXdXBi2302XUdcHcR1jCeU0LL4TD9HRs/gk0N2Xvrht+G/BfJa4QObBQZfhMdxiCpV3COl5Nfq4uKTeTnJA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/types": "^7.3.0"
-      }
-    },
-    "node_modules/@types/graceful-fs": {
-      "version": "4.1.5",
-      "integrity": "sha512-anKkLmZZ+xm4p8JWBf4hElkM4XR+EZeA2M9BAkkTldmcyDY4mbdIJnRghDJH3Ov5ooY7/UAoENtmdMSkaAd7Cw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
-    "node_modules/@types/istanbul-lib-coverage": {
-      "version": "2.0.3",
-      "integrity": "sha512-sz7iLqvVUg1gIedBOvlkxPlc8/uVzyS5OwGz1cKjXzkl3FpL3al0crU8YGU1WoHkxn0Wxbw5tyi6hvzJKNzFsw==",
-      "dev": true
-    },
-    "node_modules/@types/istanbul-lib-report": {
-      "version": "3.0.0",
-      "integrity": "sha512-plGgXAPfVKFoYfa9NpYDAkseG+g6Jr294RqeqcqDixSbU34MZVJRi/P+7Y8GDpzkEwLaGZZOpKIEmeVZNtKsrg==",
-      "dev": true,
-      "dependencies": {
-        "@types/istanbul-lib-coverage": "*"
-      }
-    },
-    "node_modules/@types/istanbul-reports": {
-      "version": "3.0.1",
-      "integrity": "sha512-c3mAZEuK0lvBp8tmuL74XRKn1+y2dcwOUpH7x4WrF6gk1GIgiluDRgMYQtw2OFcBvAJWlt6ASU3tSqxp0Uu0Aw==",
-      "dev": true,
-      "dependencies": {
-        "@types/istanbul-lib-report": "*"
-      }
-    },
-    "node_modules/@types/json-schema": {
-      "version": "7.0.11",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.11.tgz",
-      "integrity": "sha512-wOuvG1SN4Us4rez+tylwwwCV1psiNVOkJeM3AUWUNWg/jDQY2+HE/444y5gc+jBmRqASOm2Oeh5c1axHobwRKQ==",
-      "dev": true
-    },
-    "node_modules/@types/json5": {
-      "version": "0.0.29",
-      "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
-      "integrity": "sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==",
-      "dev": true
-    },
-    "node_modules/@types/mdast": {
-      "version": "3.0.10",
-      "integrity": "sha512-W864tg/Osz1+9f4lrGTZpCSO5/z4608eUp19tbozkq2HJK6i3z1kT0H9tlADXuYIb1YYOBByU4Jsqkk75q48qA==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "*"
-      }
-    },
-    "node_modules/@types/minimist": {
-      "version": "1.2.2",
-      "integrity": "sha512-jhuKLIRrhvCPLqwPcx6INqmKeiA5EWrsCOPhrlFSrbrmU4ZMPjj5Ul/oLCMDO98XRUIwVm78xICz4EPCektzeQ==",
-      "dev": true
-    },
-    "node_modules/@types/node": {
-      "version": "16.10.3",
-      "integrity": "sha512-ho3Ruq+fFnBrZhUYI46n/bV2GjwzSkwuT4dTf0GkuNFmnb8nq4ny2z9JEVemFi6bdEJanHLlYfy9c6FN9B9McQ==",
-      "dev": true
-    },
-    "node_modules/@types/normalize-package-data": {
-      "version": "2.4.1",
-      "integrity": "sha512-Gj7cI7z+98M282Tqmp2K5EIsoouUEzbBJhQQzDE3jSIRk6r9gsz0oUokqIUR4u1R3dMHo0pDHM7sNOHyhulypw==",
-      "dev": true
-    },
-    "node_modules/@types/parse-json": {
-      "version": "4.0.0",
-      "integrity": "sha512-//oorEZjL6sbPcKUaCdIGlIUeH26mgzimjBB77G6XRgnDl/L5wOnpyBGRe/Mmf5CVW3PwEBE1NjiMZ/ssFh4wA==",
-      "dev": true
-    },
-    "node_modules/@types/prettier": {
-      "version": "2.4.1",
-      "integrity": "sha512-Fo79ojj3vdEZOHg3wR9ksAMRz4P3S5fDB5e/YWZiFnyFQI1WY2Vftu9XoXVVtJfxB7Bpce/QTqWSSntkz2Znrw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/@types/semver": {
-      "version": "7.3.13",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.3.13.tgz",
-      "integrity": "sha512-21cFJr9z3g5dW8B0CVI9g2O9beqaThGQ6ZFBqHfwhzLDKUxaqTIy3vnfah/UPkfOiF2pLq+tGz+W8RyCskuslw==",
-      "dev": true
-    },
-    "node_modules/@types/stack-utils": {
-      "version": "2.0.1",
-      "integrity": "sha512-Hl219/BT5fLAaz6NDkSuhzasy49dwQS/DSdu4MdggFB8zcXv7vflBI3xp7FEmkmdDkBUI2bPUNeMttp2knYdxw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/@types/supports-color": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/@types/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-dPWnWsf+kzIG140B8z2w3fr5D03TLWbOAFQl45xUpI3vcizeXriNR5VYkWZ+WTMsUHqZ9Xlt3hrxGNANFyNQfw==",
-      "dev": true
-    },
-    "node_modules/@types/unist": {
-      "version": "2.0.6",
-      "integrity": "sha512-PBjIUxZHOuj0R15/xuwJYjFi+KZdNFrehocChv4g5hu6aFroHue8m0lBP0POdK2nKzbw0cgV1mws8+V/JAcEkQ==",
-      "dev": true
-    },
-    "node_modules/@types/yargs": {
-      "version": "15.0.14",
-      "integrity": "sha512-yEJzHoxf6SyQGhBhIYGXQDSCkJjB6HohDShto7m8vaKg9Yp0Yn8+71J9eakh2bnPg6BfsH9PRMhiRTZnd4eXGQ==",
-      "dev": true,
-      "dependencies": {
-        "@types/yargs-parser": "*"
-      }
-    },
-    "node_modules/@types/yargs-parser": {
-      "version": "20.2.1",
-      "integrity": "sha512-7tFImggNeNBVMsn0vLrpn1H1uPrUBdnARPTpZoitY37ZrdJREzf7I16tMrlK3hen349gr1NYh8CmZQa7CTG6Aw==",
-      "dev": true
-    },
-    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-5.48.1.tgz",
-      "integrity": "sha512-9nY5K1Rp2ppmpb9s9S2aBiF3xo5uExCehMDmYmmFqqyxgenbHJ3qbarcLt4ITgaD6r/2ypdlcFRdcuVPnks+fQ==",
-      "dev": true,
-      "dependencies": {
-        "@typescript-eslint/scope-manager": "5.48.1",
-        "@typescript-eslint/type-utils": "5.48.1",
-        "@typescript-eslint/utils": "5.48.1",
-        "debug": "^4.3.4",
-        "ignore": "^5.2.0",
-        "natural-compare-lite": "^1.4.0",
-        "regexpp": "^3.2.0",
-        "semver": "^7.3.7",
-        "tsutils": "^3.21.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "@typescript-eslint/parser": "^5.0.0",
-        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/semver": {
-      "version": "7.3.8",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
-      "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
-      "dev": true,
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@typescript-eslint/parser": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.48.1.tgz",
-      "integrity": "sha512-4yg+FJR/V1M9Xoq56SF9Iygqm+r5LMXvheo6DQ7/yUWynQ4YfCRnsKuRgqH4EQ5Ya76rVwlEpw4Xu+TgWQUcdA==",
-      "dev": true,
-      "dependencies": {
-        "@typescript-eslint/scope-manager": "5.48.1",
-        "@typescript-eslint/types": "5.48.1",
-        "@typescript-eslint/typescript-estree": "5.48.1",
-        "debug": "^4.3.4"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-5.48.1.tgz",
-      "integrity": "sha512-S035ueRrbxRMKvSTv9vJKIWgr86BD8s3RqoRZmsSh/s8HhIs90g6UlK8ZabUSjUZQkhVxt7nmZ63VJ9dcZhtDQ==",
-      "dev": true,
-      "dependencies": {
-        "@typescript-eslint/types": "5.48.1",
-        "@typescript-eslint/visitor-keys": "5.48.1"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      }
-    },
-    "node_modules/@typescript-eslint/type-utils": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-5.48.1.tgz",
-      "integrity": "sha512-Hyr8HU8Alcuva1ppmqSYtM/Gp0q4JOp1F+/JH5D1IZm/bUBrV0edoewQZiEc1r6I8L4JL21broddxK8HAcZiqQ==",
-      "dev": true,
-      "dependencies": {
-        "@typescript-eslint/typescript-estree": "5.48.1",
-        "@typescript-eslint/utils": "5.48.1",
-        "debug": "^4.3.4",
-        "tsutils": "^3.21.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "*"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@typescript-eslint/types": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-5.48.1.tgz",
-      "integrity": "sha512-xHyDLU6MSuEEdIlzrrAerCGS3T7AA/L8Hggd0RCYBi0w3JMvGYxlLlXHeg50JI9Tfg5MrtsfuNxbS/3zF1/ATg==",
-      "dev": true,
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      }
-    },
-    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-5.48.1.tgz",
-      "integrity": "sha512-Hut+Osk5FYr+sgFh8J/FHjqX6HFcDzTlWLrFqGoK5kVUN3VBHF/QzZmAsIXCQ8T/W9nQNBTqalxi1P3LSqWnRA==",
-      "dev": true,
-      "dependencies": {
-        "@typescript-eslint/types": "5.48.1",
-        "@typescript-eslint/visitor-keys": "5.48.1",
-        "debug": "^4.3.4",
-        "globby": "^11.1.0",
-        "is-glob": "^4.0.3",
-        "semver": "^7.3.7",
-        "tsutils": "^3.21.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/globby": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-11.1.0.tgz",
-      "integrity": "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==",
-      "dev": true,
-      "dependencies": {
-        "array-union": "^2.1.0",
-        "dir-glob": "^3.0.1",
-        "fast-glob": "^3.2.9",
-        "ignore": "^5.2.0",
-        "merge2": "^1.4.1",
-        "slash": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/semver": {
-      "version": "7.3.8",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
-      "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
-      "dev": true,
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@typescript-eslint/utils": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-5.48.1.tgz",
-      "integrity": "sha512-SmQuSrCGUOdmGMwivW14Z0Lj8dxG1mOFZ7soeJ0TQZEJcs3n5Ndgkg0A4bcMFzBELqLJ6GTHnEU+iIoaD6hFGA==",
-      "dev": true,
-      "dependencies": {
-        "@types/json-schema": "^7.0.9",
-        "@types/semver": "^7.3.12",
-        "@typescript-eslint/scope-manager": "5.48.1",
-        "@typescript-eslint/types": "5.48.1",
-        "@typescript-eslint/typescript-estree": "5.48.1",
-        "eslint-scope": "^5.1.1",
-        "eslint-utils": "^3.0.0",
-        "semver": "^7.3.7"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
-      }
-    },
-    "node_modules/@typescript-eslint/utils/node_modules/semver": {
-      "version": "7.3.8",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
-      "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
-      "dev": true,
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-5.48.1.tgz",
-      "integrity": "sha512-Ns0XBwmfuX7ZknznfXozgnydyR8F6ev/KEGePP4i74uL3ArsKbEhJ7raeKr1JSa997DBDwol/4a0Y+At82c9dA==",
-      "dev": true,
-      "dependencies": {
-        "@typescript-eslint/types": "5.48.1",
-        "eslint-visitor-keys": "^3.3.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      }
-    },
-    "node_modules/abab": {
-      "version": "2.0.5",
-      "integrity": "sha512-9IK9EadsbHo6jLWIpxpR6pL0sazTXV6+SQv25ZB+F7Bj9mJNaOc4nCRabwd5M/JwmUa8idz6Eci6eKfJryPs6Q==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/acorn": {
-      "version": "7.4.1",
-      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
-      "dev": true,
-      "peer": true,
-      "bin": {
-        "acorn": "bin/acorn"
-      },
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/acorn-globals": {
-      "version": "6.0.0",
-      "integrity": "sha512-ZQl7LOWaF5ePqqcX4hLuv/bLXYQNfNWw2c0/yX/TsPRKamzHcTGQnlCjHT3TsmkOUVEPS3crCxiPfdzE/Trlhg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "acorn": "^7.1.1",
-        "acorn-walk": "^7.1.1"
-      }
-    },
-    "node_modules/acorn-jsx": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
-      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
-      "dev": true,
-      "peerDependencies": {
-        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
-      }
-    },
-    "node_modules/acorn-walk": {
-      "version": "7.2.0",
-      "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/agent-base": {
-      "version": "6.0.2",
-      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 6.0.0"
-      }
-    },
-    "node_modules/aggregate-error": {
-      "version": "3.1.0",
-      "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==",
-      "dev": true,
-      "dependencies": {
-        "clean-stack": "^2.0.0",
-        "indent-string": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
-      "dev": true,
-      "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/ansi-colors": {
-      "version": "4.1.1",
-      "integrity": "sha512-JoX0apGbHaUJBNl6yF+p6JAFYZ666/hhCGKN5t9QFjbJQKUU/g8MNbFDbvfrgKXvI1QpZplPOnwIo99lX/AAmA==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/ansi-escapes": {
-      "version": "4.3.2",
-      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
-      "dev": true,
-      "dependencies": {
-        "type-fest": "^0.21.3"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "dev": true,
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/anymatch": {
-      "version": "3.1.2",
-      "integrity": "sha512-P43ePfOAIupkguHUycrc4qJ9kz8ZiuOUijaETwX7THt0Y/GNK7v0aa8rY816xWjZ7rJdA5XdMcpVFTKMq+RvWg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "normalize-path": "^3.0.0",
-        "picomatch": "^2.0.4"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/argparse": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-      "dev": true
-    },
-    "node_modules/aria-query": {
-      "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.1.3.tgz",
-      "integrity": "sha512-R5iJ5lkuHybztUfuOAznmboyjWq8O6sqNqtK7CLOqdydi54VNbORp49mb14KbWgG1QD3JFO9hJdZ+y4KutfdOQ==",
-      "dev": true,
-      "dependencies": {
-        "deep-equal": "^2.0.5"
-      }
-    },
-    "node_modules/arr-diff": {
-      "version": "4.0.0",
-      "integrity": "sha1-1kYQdP6/7HHn4VI1dhoyml3HxSA=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/arr-flatten": {
-      "version": "1.1.0",
-      "integrity": "sha512-L3hKV5R/p5o81R7O02IGnwpDmkp6E982XhtbuwSe3O4qOtMMMtodicASA1Cny2U+aCXcNpml+m4dPsvsJ3jatg==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/arr-union": {
-      "version": "3.1.0",
-      "integrity": "sha1-45sJrqne+Gao8gbiiK9jkZuuOcQ=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/array-includes": {
-      "version": "3.1.6",
-      "resolved": "https://registry.npmjs.org/array-includes/-/array-includes-3.1.6.tgz",
-      "integrity": "sha512-sgTbLvL6cNnw24FnbaDyjmvddQ2ML8arZsgaJhoABMoplz/4QRhtrYS+alr1BUM1Bwp6dhx8vVCBSLG+StwOFw==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "get-intrinsic": "^1.1.3",
-        "is-string": "^1.0.7"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/array-union": {
-      "version": "2.1.0",
-      "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/array-unique": {
-      "version": "0.3.2",
-      "integrity": "sha1-qJS3XUvE9s1nnvMkSp/Y9Gri1Cg=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/array.prototype.flat": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/array.prototype.flat/-/array.prototype.flat-1.3.1.tgz",
-      "integrity": "sha512-roTU0KWIOmJ4DRLmwKd19Otg0/mT3qPNt0Qb3GWW8iObuZXxrjB/pzn0R3hqpRSWg4HCwqx+0vwOnWnvlOyeIA==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "es-shim-unscopables": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/array.prototype.flatmap": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/array.prototype.flatmap/-/array.prototype.flatmap-1.3.1.tgz",
-      "integrity": "sha512-8UGn9O1FDVvMNB0UlLv4voxRMze7+FpHyF5mSMRjWHUMlpoDViniy05870VlxhfgTnLbpuwTzvD76MTtWxB/mQ==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "es-shim-unscopables": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/array.prototype.tosorted": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/array.prototype.tosorted/-/array.prototype.tosorted-1.1.1.tgz",
-      "integrity": "sha512-pZYPXPRl2PqWcsUs6LOMn+1f1532nEoPTYowBtqLwAW+W8vSVhkIGnmOX1t/UQjD6YGI0vcD2B1U7ZFGQH9jnQ==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "es-shim-unscopables": "^1.0.0",
-        "get-intrinsic": "^1.1.3"
-      }
-    },
-    "node_modules/arrify": {
-      "version": "1.0.1",
-      "integrity": "sha1-iYUI2iIm84DfkEcoRWhJwVAaSw0=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/assign-symbols": {
-      "version": "1.0.0",
-      "integrity": "sha1-WWZ/QfrdTyDMvCu5a41Pf3jsA2c=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/ast-types-flow": {
-      "version": "0.0.7",
-      "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.7.tgz",
-      "integrity": "sha512-eBvWn1lvIApYMhzQMsu9ciLfkBY499mFZlNqG+/9WR7PVlroQw0vG30cOQQbaKz3sCEc44TAOu2ykzqXSNnwag==",
-      "dev": true
-    },
-    "node_modules/astral-regex": {
-      "version": "2.0.0",
-      "integrity": "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/async": {
-      "version": "0.9.2",
-      "integrity": "sha1-rqdNXmHB+JlhO/ZL2mbUx48v0X0=",
-      "dev": true
-    },
-    "node_modules/asynckit": {
-      "version": "0.4.0",
-      "integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k=",
-      "dev": true
-    },
-    "node_modules/at-least-node": {
-      "version": "1.0.0",
-      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
-      "dev": true,
-      "engines": {
-        "node": ">= 4.0.0"
-      }
-    },
-    "node_modules/atob": {
-      "version": "2.1.2",
-      "integrity": "sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg==",
-      "dev": true,
-      "peer": true,
-      "bin": {
-        "atob": "bin/atob.js"
-      },
-      "engines": {
-        "node": ">= 4.5.0"
-      }
-    },
-    "node_modules/autoprefixer": {
-      "version": "9.8.8",
-      "integrity": "sha512-eM9d/swFopRt5gdJ7jrpCwgvEMIayITpojhkkSMRsFHYuH5bkSQ4p/9qTEHtmNudUZh22Tehu7I6CxAW0IXTKA==",
-      "dev": true,
-      "dependencies": {
-        "browserslist": "^4.12.0",
-        "caniuse-lite": "^1.0.30001109",
-        "normalize-range": "^0.1.2",
-        "num2fraction": "^1.2.2",
-        "picocolors": "^0.2.1",
-        "postcss": "^7.0.32",
-        "postcss-value-parser": "^4.1.0"
-      },
-      "bin": {
-        "autoprefixer": "bin/autoprefixer"
-      },
-      "funding": {
-        "type": "tidelift",
-        "url": "https://tidelift.com/funding/github/npm/autoprefixer"
-      }
-    },
-    "node_modules/autoprefixer/node_modules/postcss": {
-      "version": "7.0.39",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-      "dev": true,
-      "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      }
-    },
-    "node_modules/autoprefixer/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/available-typed-arrays": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.5.tgz",
-      "integrity": "sha512-DMD0KiN46eipeziST1LPP/STfDU0sufISXmjSgvVsoU2tqxctQeASejWcfNtxYKqETM1UxQ8sp2OrSBWpHY6sw==",
-      "dev": true,
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/axe-core": {
-      "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.6.2.tgz",
-      "integrity": "sha512-b1WlTV8+XKLj9gZy2DZXgQiyDp9xkkoe2a6U6UbYccScq2wgH/YwCeI2/Jq2mgo0HzQxqJOjWZBLeA/mqsk5Mg==",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/axobject-query": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-3.1.1.tgz",
-      "integrity": "sha512-goKlv8DZrK9hUh975fnHzhNIO4jUnFCfv/dszV5VwUGDFjI6vQ2VwoyjYjYNEbBE8AH87TduWP5uyDR1D+Iteg==",
-      "dev": true,
-      "dependencies": {
-        "deep-equal": "^2.0.5"
-      }
-    },
-    "node_modules/babel-jest": {
-      "version": "26.6.3",
-      "integrity": "sha512-pl4Q+GAVOHwvjrck6jKjvmGhnO3jHX/xuB9d27f+EJZ/6k+6nMuPjorrYp7s++bKKdANwzElBWnLWaObvTnaZA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/transform": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/babel__core": "^7.1.7",
-        "babel-plugin-istanbul": "^6.0.0",
-        "babel-preset-jest": "^26.6.2",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "slash": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/babel-plugin-istanbul": {
-      "version": "6.0.0",
-      "integrity": "sha512-AF55rZXpe7trmEylbaE1Gv54wn6rwU03aptvRoVIGP8YykoSxqdVLV1TfwflBCE/QtHmqtP8SWlTENqbK8GCSQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.0.0",
-        "@istanbuljs/load-nyc-config": "^1.0.0",
-        "@istanbuljs/schema": "^0.1.2",
-        "istanbul-lib-instrument": "^4.0.0",
-        "test-exclude": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/babel-plugin-jest-hoist": {
-      "version": "26.6.2",
-      "integrity": "sha512-PO9t0697lNTmcEHH69mdtYiOIkkOlj9fySqfO3K1eCcdISevLAE0xY59VLLUj0SoiPiTX/JU2CYFpILydUa5Lw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/template": "^7.3.3",
-        "@babel/types": "^7.3.3",
-        "@types/babel__core": "^7.0.0",
-        "@types/babel__traverse": "^7.0.6"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/babel-preset-current-node-syntax": {
-      "version": "1.0.1",
-      "integrity": "sha512-M7LQ0bxarkxQoN+vz5aJPsLBn77n8QgTFmo8WK0/44auK2xlCXrYcUxHFxgU7qW5Yzw/CjmLRK2uJzaCd7LvqQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/plugin-syntax-async-generators": "^7.8.4",
-        "@babel/plugin-syntax-bigint": "^7.8.3",
-        "@babel/plugin-syntax-class-properties": "^7.8.3",
-        "@babel/plugin-syntax-import-meta": "^7.8.3",
-        "@babel/plugin-syntax-json-strings": "^7.8.3",
-        "@babel/plugin-syntax-logical-assignment-operators": "^7.8.3",
-        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
-        "@babel/plugin-syntax-numeric-separator": "^7.8.3",
-        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
-        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
-        "@babel/plugin-syntax-optional-chaining": "^7.8.3",
-        "@babel/plugin-syntax-top-level-await": "^7.8.3"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/babel-preset-jest": {
-      "version": "26.6.2",
-      "integrity": "sha512-YvdtlVm9t3k777c5NPQIv6cxFFFapys25HiUmuSgHwIZhfifweR5c5Sf5nwE3MAbfu327CYSvps8Yx6ANLyleQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "babel-plugin-jest-hoist": "^26.6.2",
-        "babel-preset-current-node-syntax": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      },
-      "peerDependencies": {
-        "@babel/core": "^7.0.0"
-      }
-    },
-    "node_modules/bail": {
-      "version": "1.0.5",
-      "integrity": "sha512-xFbRxM1tahm08yHBP16MMjVUAvDaBMD38zsM9EMAUN61omwLmKlOpB/Zku5QkjZ8TZ4vn53pj+t518cH0S03RQ==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true
-    },
-    "node_modules/base": {
-      "version": "0.11.2",
-      "integrity": "sha512-5T6P4xPgpp0YDFvSWwEZ4NoE3aM4QBQXDzmVbraCkFj8zHM+mba8SyqB5DbZWyR7mYHo6Y7BdQo3MoA4m0TeQg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "cache-base": "^1.0.1",
-        "class-utils": "^0.3.5",
-        "component-emitter": "^1.2.1",
-        "define-property": "^1.0.0",
-        "isobject": "^3.0.1",
-        "mixin-deep": "^1.2.0",
-        "pascalcase": "^0.1.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/base/node_modules/define-property": {
-      "version": "1.0.0",
-      "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-descriptor": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
-      "dev": true,
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "node_modules/braces": {
-      "version": "3.0.2",
-      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
-      "dev": true,
-      "dependencies": {
-        "fill-range": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/browser-process-hrtime": {
-      "version": "1.0.0",
-      "integrity": "sha512-9o5UecI3GhkpM6DrXr69PblIuWxPKk9Y0jHBRhdocZ2y7YECBFCsHm79Pr3OyR2AvjhDkabFJaDJMYRazHgsow==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/browserslist": {
-      "version": "4.17.3",
-      "integrity": "sha512-59IqHJV5VGdcJZ+GZ2hU5n4Kv3YiASzW6Xk5g9tf5a/MAzGeFwgGWU39fVzNIOVcgB3+Gp+kiQu0HEfTVU/3VQ==",
-      "dev": true,
-      "dependencies": {
-        "caniuse-lite": "^1.0.30001264",
-        "electron-to-chromium": "^1.3.857",
-        "escalade": "^3.1.1",
-        "node-releases": "^1.1.77",
-        "picocolors": "^0.2.1"
-      },
-      "bin": {
-        "browserslist": "cli.js"
-      },
-      "engines": {
-        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/browserslist"
-      }
-    },
-    "node_modules/bs-logger": {
-      "version": "0.2.6",
-      "integrity": "sha512-pd8DCoxmbgc7hyPKOvxtqNcjYoOsABPQdcCUjGp3d42VR2CX1ORhk2A87oqqu5R1kk+76nsxZupkmyd+MVtCog==",
-      "dev": true,
-      "dependencies": {
-        "fast-json-stable-stringify": "2.x"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/bser": {
-      "version": "2.1.1",
-      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "node-int64": "^0.4.0"
-      }
-    },
-    "node_modules/buffer-from": {
-      "version": "1.1.2",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
-      "dev": true
-    },
-    "node_modules/busboy": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/busboy/-/busboy-1.6.0.tgz",
-      "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==",
-      "dev": true,
-      "dependencies": {
-        "streamsearch": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=10.16.0"
-      }
-    },
-    "node_modules/cache-base": {
-      "version": "1.0.1",
-      "integrity": "sha512-AKcdTnFSWATd5/GCPRxr2ChwIJ85CeyrEyjRHlKxQ56d4XJMGym0uAiKn0xbLOGOl3+yRpOTi484dVCEc5AUzQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "collection-visit": "^1.0.0",
-        "component-emitter": "^1.2.1",
-        "get-value": "^2.0.6",
-        "has-value": "^1.0.0",
-        "isobject": "^3.0.1",
-        "set-value": "^2.0.0",
-        "to-object-path": "^0.3.0",
-        "union-value": "^1.0.0",
-        "unset-value": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/call-bind": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.2.tgz",
-      "integrity": "sha512-7O+FbCihrB5WGbFYesctwmTKae6rOiIzmz1icreWJ+0aA7LJfuqhEso2T9ncpcFtzMQtzXf2QGGueWJGTYsqrA==",
-      "dev": true,
-      "dependencies": {
-        "function-bind": "^1.1.1",
-        "get-intrinsic": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/callsites": {
-      "version": "3.1.0",
-      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/camelcase": {
-      "version": "5.3.1",
-      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/caniuse-lite": {
-      "version": "1.0.30001416",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001416.tgz",
-      "integrity": "sha512-06wzzdAkCPZO+Qm4e/eNghZBDfVNDsCgw33T27OwBH9unE9S478OYw//Q2L7Npf/zBzs7rjZOszIFQkwQKAEqA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/browserslist"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
-        }
-      ]
-    },
-    "node_modules/capture-exit": {
-      "version": "2.0.0",
-      "integrity": "sha512-PiT/hQmTonHhl/HFGN+Lx3JJUznrVYJ3+AQsnthneZbvW7x+f08Tk7yLJTLEOUvBTbduLeeBkxEaYXUOUrRq6g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "rsvp": "^4.8.4"
-      },
-      "engines": {
-        "node": "6.* || 8.* || >= 10.*"
-      }
-    },
-    "node_modules/ccount": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/ccount/-/ccount-1.1.0.tgz",
-      "integrity": "sha512-vlNK021QdI7PNeiUh/lKkC/mNHHfV0m/Ad5JoI0TYtlBnJAslM/JIkm/tGC88bkLIwO6OQ5uV6ztS6kVAtCDlg==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/chalk": {
-      "version": "4.1.0",
-      "integrity": "sha512-qwx12AxXe2Q5xQ43Ac//I6v5aXTipYrSESdOgzrN+9XjgEpyjpKuvSGaN4qE93f7TQTlerQQ8S+EQ0EyDoVL1A==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/char-regex": {
-      "version": "1.0.2",
-      "integrity": "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/character-entities": {
-      "version": "1.2.4",
-      "integrity": "sha512-iBMyeEHxfVnIakwOuDXpVkc54HijNgCyQB2w0VfGQThle6NXn50zU6V/u+LDhxHcDUPojn6Kpga3PTAD8W1bQw==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/character-entities-html4": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-1.1.4.tgz",
-      "integrity": "sha512-HRcDxZuZqMx3/a+qrzxdBKBPUpxWEq9xw2OPZ3a/174ihfrQKVsFhqtthBInFy1zZ9GgZyFXOatNujm8M+El3g==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/character-entities-legacy": {
-      "version": "1.1.4",
-      "integrity": "sha512-3Xnr+7ZFS1uxeiUDvV02wQ+QDbc55o97tIV5zHScSPJpcLm/r0DFPcoY3tYRp+VZukxuMeKgXYmsXQHO05zQeA==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/character-reference-invalid": {
-      "version": "1.1.4",
-      "integrity": "sha512-mKKUkUbhPpQlCOfIuZkvSEgktjPFIsZKRRbC6KWVEMvlzblj3i3asQv5ODsrwt0N3pHAEvjP8KTQPHkp0+6jOg==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/chardet": {
-      "version": "0.7.0",
-      "integrity": "sha512-mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==",
-      "dev": true
-    },
-    "node_modules/ci-info": {
-      "version": "2.0.0",
-      "integrity": "sha512-5tK7EtrZ0N+OLFMthtqOj4fI2Jeb88C4CAZPu25LDVUgXJ0A3Js4PMGqrn0JU1W0Mh1/Z8wZzYPxqUrXeBboCQ==",
-      "dev": true
-    },
-    "node_modules/cjs-module-lexer": {
-      "version": "0.6.0",
-      "integrity": "sha512-uc2Vix1frTfnuzxxu1Hp4ktSvM3QaI4oXl4ZUqL1wjTu/BGki9TrCWoqLTg/drR1KwAEarXuRFCG2Svr1GxPFw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/class-utils": {
-      "version": "0.3.6",
-      "integrity": "sha512-qOhPa/Fj7s6TY8H8esGu5QNpMMQxz79h+urzrNYN6mn+9BnxlDGf5QZ+XeCDsxSjPqsSR56XOZOJmpeurnLMeg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "arr-union": "^3.1.0",
-        "define-property": "^0.2.5",
-        "isobject": "^3.0.0",
-        "static-extend": "^0.1.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/class-utils/node_modules/define-property": {
-      "version": "0.2.5",
-      "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-descriptor": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/class-utils/node_modules/is-accessor-descriptor": {
-      "version": "0.1.6",
-      "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/class-utils/node_modules/is-accessor-descriptor/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/class-utils/node_modules/is-buffer": {
-      "version": "1.1.6",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/class-utils/node_modules/is-data-descriptor": {
-      "version": "0.1.4",
-      "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/class-utils/node_modules/is-data-descriptor/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/class-utils/node_modules/is-descriptor": {
-      "version": "0.1.6",
-      "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-accessor-descriptor": "^0.1.6",
-        "is-data-descriptor": "^0.1.4",
-        "kind-of": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/class-utils/node_modules/kind-of": {
-      "version": "5.1.0",
-      "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/clean-stack": {
-      "version": "2.2.0",
-      "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/cli-cursor": {
-      "version": "3.1.0",
-      "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==",
-      "dev": true,
-      "dependencies": {
-        "restore-cursor": "^3.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cli-truncate": {
-      "version": "2.1.0",
-      "integrity": "sha512-n8fOixwDD6b/ObinzTrp1ZKFzbgvKZvuz/TvejnLn1aQfC6r52XEx85FmuC+3HI+JM7coBRXUvNqEU2PHVrHpg==",
-      "dev": true,
-      "dependencies": {
-        "slice-ansi": "^3.0.0",
-        "string-width": "^4.2.0"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/cli-width": {
-      "version": "3.0.0",
-      "integrity": "sha512-FxqpkPPwu1HjuN93Omfm4h8uIanXofW0RxVEW3k5RKx+mJJYSthzNhp32Kzxxy3YAEZ/Dc/EWN1vZRY0+kOhbw==",
-      "dev": true,
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/client-only": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
-      "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==",
-      "dev": true
-    },
-    "node_modules/cliui": {
-      "version": "6.0.0",
-      "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.0",
-        "wrap-ansi": "^6.2.0"
-      }
-    },
-    "node_modules/cliui/node_modules/wrap-ansi": {
-      "version": "6.2.0",
-      "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/clone-regexp": {
-      "version": "2.2.0",
-      "integrity": "sha512-beMpP7BOtTipFuW8hrJvREQ2DrRu3BE7by0ZpibtfBA+qfHYvMGTc2Yb1JMYPKg/JUw0CHYvpg796aNTSW9z7Q==",
-      "dev": true,
-      "dependencies": {
-        "is-regexp": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/clone-regexp/node_modules/is-regexp": {
-      "version": "2.1.0",
-      "integrity": "sha512-OZ4IlER3zmRIoB9AqNhEggVxqIH4ofDns5nRrPS6yQxXE1TPCUpFznBfRQmQa8uC+pXqjMnukiJBxCisIxiLGA==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/co": {
-      "version": "4.6.0",
-      "integrity": "sha1-bqa989hTrlTMuOR7+gvz+QMfsYQ=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "iojs": ">= 1.0.0",
-        "node": ">= 0.12.0"
-      }
-    },
-    "node_modules/collapse-white-space": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/collapse-white-space/-/collapse-white-space-1.0.6.tgz",
-      "integrity": "sha512-jEovNnrhMuqyCcjfEJA56v0Xq8SkIoPKDyaHahwo3POf4qcSXqMYuwNcOTzp74vTsR9Tn08z4MxWqAhcekogkQ==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/collect-v8-coverage": {
-      "version": "1.0.1",
-      "integrity": "sha512-iBPtljfCNcTKNAto0KEtDfZ3qzjJvqE3aTGZsbhjSBlorqpXJlaWWtPO35D+ZImoC3KWejX64o+yPGxhWSTzfg==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/collection-visit": {
-      "version": "1.0.0",
-      "integrity": "sha1-S8A3PBZLwykbTTaMgpzxqApZ3KA=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "map-visit": "^1.0.0",
-        "object-visit": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "dev": true,
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "dev": true
-    },
-    "node_modules/colorette": {
-      "version": "1.4.0",
-      "integrity": "sha512-Y2oEozpomLn7Q3HFP7dpww7AtMJplbM9lGZP6RDfHqmbeRjiwRg4n6VM6j4KLmRke85uWEI7JqF17f3pqdRA0g==",
-      "dev": true
-    },
-    "node_modules/combined-stream": {
-      "version": "1.0.8",
-      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
-      "dev": true,
-      "dependencies": {
-        "delayed-stream": "~1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/commander": {
-      "version": "7.2.0",
-      "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==",
-      "dev": true,
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/component-emitter": {
-      "version": "1.3.0",
-      "integrity": "sha512-Rd3se6QB+sO1TwqZjscQrurpEPIfO0/yYnSin6Q/rD3mOutHvUrCAhJub3r90uNb+SESBuE0QYoB90YdfatsRg==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=",
-      "dev": true
-    },
-    "node_modules/convert-source-map": {
-      "version": "1.8.0",
-      "integrity": "sha512-+OQdjP49zViI/6i7nIJpA8rAl4sV/JdPfU9nZs3VqOwGIgizICvuN2ru6fMd+4llL0tar18UYJXfZ/TWtmhUjA==",
-      "dev": true,
-      "dependencies": {
-        "safe-buffer": "~5.1.1"
-      }
-    },
-    "node_modules/copy-descriptor": {
-      "version": "0.1.1",
-      "integrity": "sha1-Z29us8OZl8LuGsOpJP1hJHSPV40=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/cosmiconfig": {
-      "version": "7.0.1",
-      "integrity": "sha512-a1YWNUV2HwGimB7dU2s1wUMurNKjpx60HxBB6xUM8Re+2s1g1IIfJvFR0/iCF+XHdE0GMTKTuLR32UQff4TEyQ==",
-      "dev": true,
-      "dependencies": {
-        "@types/parse-json": "^4.0.0",
-        "import-fresh": "^3.2.1",
-        "parse-json": "^5.0.0",
-        "path-type": "^4.0.0",
-        "yaml": "^1.10.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/cross-fetch": {
-      "version": "3.1.4",
-      "integrity": "sha512-1eAtFWdIubi6T4XPy6ei9iUFoKpUkIF971QLN8lIvvvwueI65+Nw5haMNKUwfJxabqlIIDODJKGrQ66gxC0PbQ==",
-      "dev": true,
-      "dependencies": {
-        "node-fetch": "2.6.1"
-      }
-    },
-    "node_modules/cross-fetch/node_modules/node-fetch": {
-      "version": "2.6.1",
-      "integrity": "sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==",
-      "dev": true,
-      "engines": {
-        "node": "4.x || >=6.0.0"
-      }
-    },
-    "node_modules/cross-spawn": {
-      "version": "7.0.3",
-      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
-      "dev": true,
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/cssesc": {
-      "version": "3.0.0",
-      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
-      "dev": true,
-      "bin": {
-        "cssesc": "bin/cssesc"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/cssom": {
-      "version": "0.4.4",
-      "integrity": "sha512-p3pvU7r1MyyqbTk+WbNJIgJjG2VmTIaB10rI93LzVPrmDJKkzKYMtxxyAvQXR/NS6otuzveI7+7BBq3SjBS2mw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/cssstyle": {
-      "version": "2.3.0",
-      "integrity": "sha512-AZL67abkUzIuvcHqk7c09cezpGNcxUxU4Ioi/05xHk4DQeTkWmGYftIE6ctU6AEt+Gn4n1lDStOtj7FKycP71A==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "cssom": "~0.3.6"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cssstyle/node_modules/cssom": {
-      "version": "0.3.8",
-      "integrity": "sha512-b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/damerau-levenshtein": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/damerau-levenshtein/-/damerau-levenshtein-1.0.8.tgz",
-      "integrity": "sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==",
-      "dev": true
-    },
-    "node_modules/dart-linkcheck": {
-      "version": "2.0.15",
-      "integrity": "sha512-ZMvxkAyEpBTvBFk+DPjcK0ObNy8GM4gmrGG1qIu0EXb/zj25vjRWNnhLHKZw4JlOLo02oWlwDeqo98GuBlJcIg==",
-      "dev": true,
-      "bin": {
-        "linkcheck": "bin/linkcheck",
-        "linkcheck-linux": "bin/linkcheck-linux",
-        "linkcheck-win": "bin/linkcheck-win"
-      }
-    },
-    "node_modules/data-urls": {
-      "version": "2.0.0",
-      "integrity": "sha512-X5eWTSXO/BJmpdIKCRuKUgSCgAN0OwliVK3yPKbwIWU1Tdw5BRajxlzMidvh+gwko9AfQ9zIj52pzF91Q3YAvQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "abab": "^2.0.3",
-        "whatwg-mimetype": "^2.3.0",
-        "whatwg-url": "^8.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/debug": {
-      "version": "4.3.4",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
-      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
-      "dev": true,
-      "dependencies": {
-        "ms": "2.1.2"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/decamelize": {
-      "version": "1.2.0",
-      "integrity": "sha1-9lNNFRSCabIDUue+4m9QH5oZEpA=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/decamelize-keys": {
-      "version": "1.1.0",
-      "integrity": "sha1-0XGoeTMlKAfrPLYdwcFEXQeN8tk=",
-      "dev": true,
-      "dependencies": {
-        "decamelize": "^1.1.0",
-        "map-obj": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/decimal.js": {
-      "version": "10.3.1",
-      "integrity": "sha512-V0pfhfr8suzyPGOx3nmq4aHqabehUZn6Ch9kyFpV79TGDTWFmHqUqXdabR7QHqxzrYolF4+tVmJhUG4OURg5dQ==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/decode-uri-component": {
-      "version": "0.2.0",
-      "integrity": "sha1-6zkTMzRYd1y4TNGh+uBiEGu4dUU=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10"
-      }
-    },
-    "node_modules/deep-equal": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/deep-equal/-/deep-equal-2.2.0.tgz",
-      "integrity": "sha512-RdpzE0Hv4lhowpIUKKMJfeH6C1pXdtT1/it80ubgWqwI3qpuxUBpC1S4hnHg+zjnuOoDkzUtUCEEkG+XG5l3Mw==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "es-get-iterator": "^1.1.2",
-        "get-intrinsic": "^1.1.3",
-        "is-arguments": "^1.1.1",
-        "is-array-buffer": "^3.0.1",
-        "is-date-object": "^1.0.5",
-        "is-regex": "^1.1.4",
-        "is-shared-array-buffer": "^1.0.2",
-        "isarray": "^2.0.5",
-        "object-is": "^1.1.5",
-        "object-keys": "^1.1.1",
-        "object.assign": "^4.1.4",
-        "regexp.prototype.flags": "^1.4.3",
-        "side-channel": "^1.0.4",
-        "which-boxed-primitive": "^1.0.2",
-        "which-collection": "^1.0.1",
-        "which-typed-array": "^1.1.9"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/deep-equal/node_modules/isarray": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
-      "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
-      "dev": true
-    },
-    "node_modules/deep-is": {
-      "version": "0.1.4",
-      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
-      "dev": true
-    },
-    "node_modules/define-lazy-prop": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-2.0.0.tgz",
-      "integrity": "sha512-Ds09qNh8yw3khSjiJjiUInaGX9xlqZDY7JVryGxdxV7NPeuqQfplOpQ66yJFZut3jLa5zOwkXw1g9EI2uKh4Og==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/define-properties": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.1.4.tgz",
-      "integrity": "sha512-uckOqKcfaVvtBdsVkdPv3XjveQJsNQqmhXgRi8uhvWWuPYZCNlzT8qAyblUgNoXdHdjMTzAqeGjAoli8f+bzPA==",
-      "dev": true,
-      "dependencies": {
-        "has-property-descriptors": "^1.0.0",
-        "object-keys": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/define-property": {
-      "version": "2.0.2",
-      "integrity": "sha512-jwK2UV4cnPpbcG7+VRARKTZPUWowwXA8bzH5NP6ud0oeAxyYPuGZUAC7hMugpCdz4BeSZl2Dl9k66CHJ/46ZYQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-descriptor": "^1.0.2",
-        "isobject": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/delayed-stream": {
-      "version": "1.0.0",
-      "integrity": "sha1-3zrhmayt+31ECqrgsp4icrJOxhk=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/detect-newline": {
-      "version": "3.1.0",
-      "integrity": "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/diff-sequences": {
-      "version": "26.6.2",
-      "integrity": "sha512-Mv/TDa3nZ9sbc5soK+OoA74BsS3mL37yixCvUAQkiuA4Wz6YtwP/K47n2rv2ovzHZvoiQeA5FTQOschKkEwB0Q==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/dir-glob": {
-      "version": "3.0.1",
-      "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
-      "dev": true,
-      "dependencies": {
-        "path-type": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/doctrine": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
-      "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
-      "dev": true,
-      "dependencies": {
-        "esutils": "^2.0.2"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/dom-serializer": {
-      "version": "0.2.2",
-      "integrity": "sha512-2/xPb3ORsQ42nHYiSunXkDjPLBaEj/xTwUO4B7XCZQTRk7EBtTOPaygh10YAAh2OI1Qrp6NWfpAhzswj0ydt9g==",
-      "dev": true,
-      "dependencies": {
-        "domelementtype": "^2.0.1",
-        "entities": "^2.0.0"
-      }
-    },
-    "node_modules/dom-serializer/node_modules/domelementtype": {
-      "version": "2.2.0",
-      "integrity": "sha512-DtBMo82pv1dFtUmHyr48beiuq792Sxohr+8Hm9zoxklYPfa6n0Z3Byjj2IV7bmr2IyqClnqEQhfgHJJ5QF0R5A==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fb55"
-        }
-      ]
-    },
-    "node_modules/dom-serializer/node_modules/entities": {
-      "version": "2.2.0",
-      "integrity": "sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/fb55/entities?sponsor=1"
-      }
-    },
-    "node_modules/domelementtype": {
-      "version": "1.3.1",
-      "integrity": "sha512-BSKB+TSpMpFI/HOxCNr1O8aMOTZ8hT3pM3GQ0w/mWRmkhEDSFJkkyzz4XQsBV44BChwGkrDfMyjVD0eA2aFV3w==",
-      "dev": true
-    },
-    "node_modules/domexception": {
-      "version": "2.0.1",
-      "integrity": "sha512-yxJ2mFy/sibVQlu5qHjOkf9J3K6zgmCxgJ94u2EdvDOV09H+32LtRswEcUsmUWN72pVLOEnTSRaIVVzVQgS0dg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "webidl-conversions": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/domexception/node_modules/webidl-conversions": {
-      "version": "5.0.0",
-      "integrity": "sha512-VlZwKPCkYKxQgeSbH5EyngOmRp7Ww7I9rQLERETtf5ofd9pGeswWiOtogpEO850jziPRarreGxn5QIiTqpb2wA==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/domhandler": {
-      "version": "2.4.2",
-      "integrity": "sha512-JiK04h0Ht5u/80fdLMCEmV4zkNh2BcoMFBmZ/91WtYZ8qVXSKjiw7fXMgFPnHcSZgOo3XdinHvmnDUeMf5R4wA==",
-      "dev": true,
-      "dependencies": {
-        "domelementtype": "1"
-      }
-    },
-    "node_modules/domutils": {
-      "version": "1.7.0",
-      "integrity": "sha512-Lgd2XcJ/NjEw+7tFvfKxOzCYKZsdct5lczQ2ZaQY8Djz7pfAD3Gbp8ySJWtreII/vDlMVmxwa6pHmdxIYgttDg==",
-      "dev": true,
-      "dependencies": {
-        "dom-serializer": "0",
-        "domelementtype": "1"
-      }
-    },
-    "node_modules/eastasianwidth": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
-      "dev": true
-    },
-    "node_modules/ejs": {
-      "version": "3.1.5",
-      "integrity": "sha512-dldq3ZfFtgVTJMLjOe+/3sROTzALlL9E34V4/sDtUd/KlBSS0s6U1/+WPE1B4sj9CXHJpL1M6rhNJnc9Wbal9w==",
-      "dev": true,
-      "dependencies": {
-        "jake": "^10.6.1"
-      },
-      "bin": {
-        "ejs": "bin/cli.js"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/electron-to-chromium": {
-      "version": "1.3.865",
-      "integrity": "sha512-okGcCKfihgGlaROMFNPQ6eaU3bk9Xa68rLYSnVD2PyIqM5B/vyQoXCpB3p1HI3AXio097ROVBlSO4JZVilUWuA==",
-      "dev": true
-    },
-    "node_modules/emittery": {
-      "version": "0.7.2",
-      "integrity": "sha512-A8OG5SR/ij3SsJdWDJdkkSYUjQdCUx6APQXem0SaEePBSRg4eymGYwBkKo1Y6DU+af/Jn2dBQqDBvjnr9Vi8nQ==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sindresorhus/emittery?sponsor=1"
-      }
-    },
-    "node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
-      "dev": true
-    },
-    "node_modules/end-of-stream": {
-      "version": "1.4.4",
-      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "once": "^1.4.0"
-      }
-    },
-    "node_modules/enhanced-resolve": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.12.0.tgz",
-      "integrity": "sha512-QHTXI/sZQmko1cbDoNAa3mJ5qhWUUNAq3vR0/YiD379fWQrcfuoX1+HW2S0MTt7XmoPLapdaDKUtelUSPic7hQ==",
-      "dev": true,
-      "dependencies": {
-        "graceful-fs": "^4.2.4",
-        "tapable": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/enquirer": {
-      "version": "2.3.6",
-      "integrity": "sha512-yjNnPr315/FjS4zIsUxYguYUPP2e1NK4d7E7ZOLiyYCcbFBiTMyID+2wvm2w6+pZ/odMA7cRkjhsPbltwBOrLg==",
-      "dev": true,
-      "dependencies": {
-        "ansi-colors": "^4.1.1"
-      },
-      "engines": {
-        "node": ">=8.6"
-      }
-    },
-    "node_modules/entities": {
-      "version": "1.1.2",
-      "integrity": "sha512-f2LZMYl1Fzu7YSBKg+RoROelpOaNrcGmE9AZubeDfrCEia483oW4MI4VyFd5VNHIgQ/7qm1I0wUHK1eJnn2y2w==",
-      "dev": true
-    },
-    "node_modules/error-ex": {
-      "version": "1.3.2",
-      "integrity": "sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==",
-      "dev": true,
-      "dependencies": {
-        "is-arrayish": "^0.2.1"
-      }
-    },
-    "node_modules/es-abstract": {
-      "version": "1.21.1",
-      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.21.1.tgz",
-      "integrity": "sha512-QudMsPOz86xYz/1dG1OuGBKOELjCh99IIWHLzy5znUB6j8xG2yMA7bfTV86VSqKF+Y/H08vQPR+9jyXpuC6hfg==",
-      "dev": true,
-      "dependencies": {
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "es-set-tostringtag": "^2.0.1",
-        "es-to-primitive": "^1.2.1",
-        "function-bind": "^1.1.1",
-        "function.prototype.name": "^1.1.5",
-        "get-intrinsic": "^1.1.3",
-        "get-symbol-description": "^1.0.0",
-        "globalthis": "^1.0.3",
-        "gopd": "^1.0.1",
-        "has": "^1.0.3",
-        "has-property-descriptors": "^1.0.0",
-        "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3",
-        "internal-slot": "^1.0.4",
-        "is-array-buffer": "^3.0.1",
-        "is-callable": "^1.2.7",
-        "is-negative-zero": "^2.0.2",
-        "is-regex": "^1.1.4",
-        "is-shared-array-buffer": "^1.0.2",
-        "is-string": "^1.0.7",
-        "is-typed-array": "^1.1.10",
-        "is-weakref": "^1.0.2",
-        "object-inspect": "^1.12.2",
-        "object-keys": "^1.1.1",
-        "object.assign": "^4.1.4",
-        "regexp.prototype.flags": "^1.4.3",
-        "safe-regex-test": "^1.0.0",
-        "string.prototype.trimend": "^1.0.6",
-        "string.prototype.trimstart": "^1.0.6",
-        "typed-array-length": "^1.0.4",
-        "unbox-primitive": "^1.0.2",
-        "which-typed-array": "^1.1.9"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/es-get-iterator": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/es-get-iterator/-/es-get-iterator-1.1.3.tgz",
-      "integrity": "sha512-sPZmqHBe6JIiTfN5q2pEi//TwxmAFHwj/XEuYjTuse78i8KxaqMTTzxPoFKuzRpDpTJ+0NAbpfenkmH2rePtuw==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.3",
-        "has-symbols": "^1.0.3",
-        "is-arguments": "^1.1.1",
-        "is-map": "^2.0.2",
-        "is-set": "^2.0.2",
-        "is-string": "^1.0.7",
-        "isarray": "^2.0.5",
-        "stop-iteration-iterator": "^1.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/es-get-iterator/node_modules/isarray": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
-      "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
-      "dev": true
-    },
-    "node_modules/es-set-tostringtag": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.0.1.tgz",
-      "integrity": "sha512-g3OMbtlwY3QewlqAiMLI47KywjWZoEytKr8pf6iTC8uJq5bIAH52Z9pnQ8pVL6whrCto53JZDuUIsifGeLorTg==",
-      "dev": true,
-      "dependencies": {
-        "get-intrinsic": "^1.1.3",
-        "has": "^1.0.3",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/es-shim-unscopables": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/es-shim-unscopables/-/es-shim-unscopables-1.0.0.tgz",
-      "integrity": "sha512-Jm6GPcCdC30eMLbZ2x8z2WuRwAws3zTBBKuusffYVUrNj/GVSUAZ+xKMaUpfNDR5IbyNA5LJbaecoUVbmUcB1w==",
-      "dev": true,
-      "dependencies": {
-        "has": "^1.0.3"
-      }
-    },
-    "node_modules/es-to-primitive": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.2.1.tgz",
-      "integrity": "sha512-QCOllgZJtaUo9miYBcLChTUaHNjJF3PYs1VidD7AwiEj1kYxKeQTctLAezAOH5ZKRH0g2IgPn6KwB4IT8iRpvA==",
-      "dev": true,
-      "dependencies": {
-        "is-callable": "^1.1.4",
-        "is-date-object": "^1.0.1",
-        "is-symbol": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/escalade": {
-      "version": "3.1.1",
-      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/escape-string-regexp": {
-      "version": "1.0.5",
-      "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
-    "node_modules/escodegen": {
-      "version": "2.0.0",
-      "integrity": "sha512-mmHKys/C8BFUGI+MAWNcSYoORYLMdPzjrknd2Vc+bUsjN5bXcr8EhrNB+UTqfL1y3I9c4fw2ihgtMPQLBRiQxw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "esprima": "^4.0.1",
-        "estraverse": "^5.2.0",
-        "esutils": "^2.0.2",
-        "optionator": "^0.8.1"
-      },
-      "bin": {
-        "escodegen": "bin/escodegen.js",
-        "esgenerate": "bin/esgenerate.js"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "optionalDependencies": {
-        "source-map": "~0.6.1"
-      }
-    },
-    "node_modules/escodegen/node_modules/levn": {
-      "version": "0.3.0",
-      "integrity": "sha1-OwmSTt+fCDwEkP3UwLxEIeBHZO4=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "prelude-ls": "~1.1.2",
-        "type-check": "~0.3.2"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/escodegen/node_modules/optionator": {
-      "version": "0.8.3",
-      "integrity": "sha512-+IW9pACdk3XWmmTXG8m3upGUJst5XRGzxMRjXzAuJ1XnIFNvfhjjIuYkDvysnPQ7qzqVzLt78BCruntqRhWQbA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "deep-is": "~0.1.3",
-        "fast-levenshtein": "~2.0.6",
-        "levn": "~0.3.0",
-        "prelude-ls": "~1.1.2",
-        "type-check": "~0.3.2",
-        "word-wrap": "~1.2.3"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/escodegen/node_modules/prelude-ls": {
-      "version": "1.1.2",
-      "integrity": "sha1-IZMqVJ9eUv/ZqCf1cOBL5iqX2lQ=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/escodegen/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "optional": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/escodegen/node_modules/type-check": {
-      "version": "0.3.2",
-      "integrity": "sha1-WITKtRLPHTVeP7eE8wgEsrUg23I=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "prelude-ls": "~1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/eslint": {
-      "version": "8.31.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.31.0.tgz",
-      "integrity": "sha512-0tQQEVdmPZ1UtUKXjX7EMm9BlgJ08G90IhWh0PKDCb3ZLsgAOHI8fYSIzYVZej92zsgq+ft0FGsxhJ3xo2tbuA==",
-      "dev": true,
-      "dependencies": {
-        "@eslint/eslintrc": "^1.4.1",
-        "@humanwhocodes/config-array": "^0.11.8",
-        "@humanwhocodes/module-importer": "^1.0.1",
-        "@nodelib/fs.walk": "^1.2.8",
-        "ajv": "^6.10.0",
-        "chalk": "^4.0.0",
-        "cross-spawn": "^7.0.2",
-        "debug": "^4.3.2",
-        "doctrine": "^3.0.0",
-        "escape-string-regexp": "^4.0.0",
-        "eslint-scope": "^7.1.1",
-        "eslint-utils": "^3.0.0",
-        "eslint-visitor-keys": "^3.3.0",
-        "espree": "^9.4.0",
-        "esquery": "^1.4.0",
-        "esutils": "^2.0.2",
-        "fast-deep-equal": "^3.1.3",
-        "file-entry-cache": "^6.0.1",
-        "find-up": "^5.0.0",
-        "glob-parent": "^6.0.2",
-        "globals": "^13.19.0",
-        "grapheme-splitter": "^1.0.4",
-        "ignore": "^5.2.0",
-        "import-fresh": "^3.0.0",
-        "imurmurhash": "^0.1.4",
-        "is-glob": "^4.0.0",
-        "is-path-inside": "^3.0.3",
-        "js-sdsl": "^4.1.4",
-        "js-yaml": "^4.1.0",
-        "json-stable-stringify-without-jsonify": "^1.0.1",
-        "levn": "^0.4.1",
-        "lodash.merge": "^4.6.2",
-        "minimatch": "^3.1.2",
-        "natural-compare": "^1.4.0",
-        "optionator": "^0.9.1",
-        "regexpp": "^3.2.0",
-        "strip-ansi": "^6.0.1",
-        "strip-json-comments": "^3.1.0",
-        "text-table": "^0.2.0"
-      },
-      "bin": {
-        "eslint": "bin/eslint.js"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/eslint-config-next": {
-      "version": "13.1.2",
-      "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-13.1.2.tgz",
-      "integrity": "sha512-zdRAQOr8v69ZwJRtBrGqAqm160ONqKxU/pV1FB1KlgfyqveGsLZmlQ7l31otwtw763901J7xdiTVkj2y3YxXZA==",
-      "dev": true,
-      "dependencies": {
-        "@next/eslint-plugin-next": "13.1.2",
-        "@rushstack/eslint-patch": "^1.1.3",
-        "@typescript-eslint/parser": "^5.42.0",
-        "eslint-import-resolver-node": "^0.3.6",
-        "eslint-import-resolver-typescript": "^3.5.2",
-        "eslint-plugin-import": "^2.26.0",
-        "eslint-plugin-jsx-a11y": "^6.5.1",
-        "eslint-plugin-react": "^7.31.7",
-        "eslint-plugin-react-hooks": "^4.5.0"
-      },
-      "peerDependencies": {
-        "eslint": "^7.23.0 || ^8.0.0",
-        "typescript": ">=3.3.1"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/eslint-config-prettier": {
-      "version": "8.6.0",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.6.0.tgz",
-      "integrity": "sha512-bAF0eLpLVqP5oEVUFKpMA+NnRFICwn9X8B5jrR9FcqnYBuPbqWEjTEspPWMj5ye6czoSLDweCzSo3Ko7gGrZaA==",
-      "dev": true,
-      "bin": {
-        "eslint-config-prettier": "bin/cli.js"
-      },
-      "peerDependencies": {
-        "eslint": ">=7.0.0"
-      }
-    },
-    "node_modules/eslint-import-resolver-node": {
-      "version": "0.3.7",
-      "resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.7.tgz",
-      "integrity": "sha512-gozW2blMLJCeFpBwugLTGyvVjNoeo1knonXAcatC6bjPBZitotxdWf7Gimr25N4c0AAOo4eOUfaG82IJPDpqCA==",
-      "dev": true,
-      "dependencies": {
-        "debug": "^3.2.7",
-        "is-core-module": "^2.11.0",
-        "resolve": "^1.22.1"
-      }
-    },
-    "node_modules/eslint-import-resolver-node/node_modules/debug": {
-      "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
-      "dev": true,
-      "dependencies": {
-        "ms": "^2.1.1"
-      }
-    },
-    "node_modules/eslint-import-resolver-node/node_modules/resolve": {
-      "version": "1.22.1",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.1.tgz",
-      "integrity": "sha512-nBpuuYuY5jFsli/JIs1oldw6fOQCBioohqWZg/2hiaOybXOft4lonv85uDOKXdf8rhyK159cxU5cDcK/NKk8zw==",
-      "dev": true,
-      "dependencies": {
-        "is-core-module": "^2.9.0",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
-      },
-      "bin": {
-        "resolve": "bin/resolve"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/eslint-import-resolver-typescript": {
-      "version": "3.5.3",
-      "resolved": "https://registry.npmjs.org/eslint-import-resolver-typescript/-/eslint-import-resolver-typescript-3.5.3.tgz",
-      "integrity": "sha512-njRcKYBc3isE42LaTcJNVANR3R99H9bAxBDMNDr2W7yq5gYPxbU3MkdhsQukxZ/Xg9C2vcyLlDsbKfRDg0QvCQ==",
-      "dev": true,
-      "dependencies": {
-        "debug": "^4.3.4",
-        "enhanced-resolve": "^5.10.0",
-        "get-tsconfig": "^4.2.0",
-        "globby": "^13.1.2",
-        "is-core-module": "^2.10.0",
-        "is-glob": "^4.0.3",
-        "synckit": "^0.8.4"
-      },
-      "engines": {
-        "node": "^14.18.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/unts/projects/eslint-import-resolver-ts"
-      },
-      "peerDependencies": {
-        "eslint": "*",
-        "eslint-plugin-import": "*"
-      }
-    },
-    "node_modules/eslint-import-resolver-typescript/node_modules/globby": {
-      "version": "13.1.3",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-13.1.3.tgz",
-      "integrity": "sha512-8krCNHXvlCgHDpegPzleMq07yMYTO2sXKASmZmquEYWEmCx6J5UTRbp5RwMJkTJGtcQ44YpiUYUiN0b9mzy8Bw==",
-      "dev": true,
-      "dependencies": {
-        "dir-glob": "^3.0.1",
-        "fast-glob": "^3.2.11",
-        "ignore": "^5.2.0",
-        "merge2": "^1.4.1",
-        "slash": "^4.0.0"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint-import-resolver-typescript/node_modules/slash": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
-      "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
-      "dev": true,
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint-module-utils": {
-      "version": "2.7.4",
-      "resolved": "https://registry.npmjs.org/eslint-module-utils/-/eslint-module-utils-2.7.4.tgz",
-      "integrity": "sha512-j4GT+rqzCoRKHwURX7pddtIPGySnX9Si/cgMI5ztrcqOPtk5dDEeZ34CQVPphnqkJytlc97Vuk05Um2mJ3gEQA==",
-      "dev": true,
-      "dependencies": {
-        "debug": "^3.2.7"
-      },
-      "engines": {
-        "node": ">=4"
-      },
-      "peerDependenciesMeta": {
-        "eslint": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/eslint-module-utils/node_modules/debug": {
-      "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
-      "dev": true,
-      "dependencies": {
-        "ms": "^2.1.1"
-      }
-    },
-    "node_modules/eslint-plugin-import": {
-      "version": "2.27.4",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.27.4.tgz",
-      "integrity": "sha512-Z1jVt1EGKia1X9CnBCkpAOhWy8FgQ7OmJ/IblEkT82yrFU/xJaxwujaTzLWqigewwynRQ9mmHfX9MtAfhxm0sA==",
-      "dev": true,
-      "dependencies": {
-        "array-includes": "^3.1.6",
-        "array.prototype.flat": "^1.3.1",
-        "array.prototype.flatmap": "^1.3.0",
-        "debug": "^3.2.7",
-        "doctrine": "^2.1.0",
-        "eslint-import-resolver-node": "^0.3.7",
-        "eslint-module-utils": "^2.7.4",
-        "has": "^1.0.3",
-        "is-core-module": "^2.11.0",
-        "is-glob": "^4.0.3",
-        "minimatch": "^3.1.2",
-        "object.values": "^1.1.6",
-        "resolve": "^1.22.1",
-        "semver": "^6.3.0",
-        "tsconfig-paths": "^3.14.1"
-      },
-      "engines": {
-        "node": ">=4"
-      },
-      "peerDependencies": {
-        "eslint": "^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8"
-      }
-    },
-    "node_modules/eslint-plugin-import/node_modules/debug": {
-      "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
-      "dev": true,
-      "dependencies": {
-        "ms": "^2.1.1"
-      }
-    },
-    "node_modules/eslint-plugin-import/node_modules/doctrine": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz",
-      "integrity": "sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==",
-      "dev": true,
-      "dependencies": {
-        "esutils": "^2.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/eslint-plugin-import/node_modules/resolve": {
-      "version": "1.22.1",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.1.tgz",
-      "integrity": "sha512-nBpuuYuY5jFsli/JIs1oldw6fOQCBioohqWZg/2hiaOybXOft4lonv85uDOKXdf8rhyK159cxU5cDcK/NKk8zw==",
-      "dev": true,
-      "dependencies": {
-        "is-core-module": "^2.9.0",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
-      },
-      "bin": {
-        "resolve": "bin/resolve"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/eslint-plugin-import/node_modules/semver": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-      "dev": true,
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/eslint-plugin-jsx-a11y": {
-      "version": "6.7.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsx-a11y/-/eslint-plugin-jsx-a11y-6.7.1.tgz",
-      "integrity": "sha512-63Bog4iIethyo8smBklORknVjB0T2dwB8Mr/hIC+fBS0uyHdYYpzM/Ed+YC8VxTjlXHEWFOdmgwcDn1U2L9VCA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/runtime": "^7.20.7",
-        "aria-query": "^5.1.3",
-        "array-includes": "^3.1.6",
-        "array.prototype.flatmap": "^1.3.1",
-        "ast-types-flow": "^0.0.7",
-        "axe-core": "^4.6.2",
-        "axobject-query": "^3.1.1",
-        "damerau-levenshtein": "^1.0.8",
-        "emoji-regex": "^9.2.2",
-        "has": "^1.0.3",
-        "jsx-ast-utils": "^3.3.3",
-        "language-tags": "=1.0.5",
-        "minimatch": "^3.1.2",
-        "object.entries": "^1.1.6",
-        "object.fromentries": "^2.0.6",
-        "semver": "^6.3.0"
-      },
-      "engines": {
-        "node": ">=4.0"
-      },
-      "peerDependencies": {
-        "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8"
-      }
-    },
-    "node_modules/eslint-plugin-jsx-a11y/node_modules/semver": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-      "dev": true,
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/eslint-plugin-prettier": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-4.2.1.tgz",
-      "integrity": "sha512-f/0rXLXUt0oFYs8ra4w49wYZBG5GKZpAYsJSm6rnYL5uVDjd+zowwMwVZHnAjf4edNrKpCDYfXDgmRE/Ak7QyQ==",
-      "dev": true,
-      "dependencies": {
-        "prettier-linter-helpers": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      },
-      "peerDependencies": {
-        "eslint": ">=7.28.0",
-        "prettier": ">=2.0.0"
-      },
-      "peerDependenciesMeta": {
-        "eslint-config-prettier": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/eslint-plugin-react": {
-      "version": "7.32.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.32.0.tgz",
-      "integrity": "sha512-vSBi1+SrPiLZCGvxpiZIa28fMEUaMjXtCplrvxcIxGzmFiYdsXQDwInEjuv5/i/2CTTxbkS87tE8lsQ0Qxinbw==",
-      "dev": true,
-      "dependencies": {
-        "array-includes": "^3.1.6",
-        "array.prototype.flatmap": "^1.3.1",
-        "array.prototype.tosorted": "^1.1.1",
-        "doctrine": "^2.1.0",
-        "estraverse": "^5.3.0",
-        "jsx-ast-utils": "^2.4.1 || ^3.0.0",
-        "minimatch": "^3.1.2",
-        "object.entries": "^1.1.6",
-        "object.fromentries": "^2.0.6",
-        "object.hasown": "^1.1.2",
-        "object.values": "^1.1.6",
-        "prop-types": "^15.8.1",
-        "resolve": "^2.0.0-next.4",
-        "semver": "^6.3.0",
-        "string.prototype.matchall": "^4.0.8"
-      },
-      "engines": {
-        "node": ">=4"
-      },
-      "peerDependencies": {
-        "eslint": "^3 || ^4 || ^5 || ^6 || ^7 || ^8"
-      }
-    },
-    "node_modules/eslint-plugin-react-hooks": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-4.6.0.tgz",
-      "integrity": "sha512-oFc7Itz9Qxh2x4gNHStv3BqJq54ExXmfC+a1NjAta66IAN87Wu0R/QArgIS9qKzX3dXKPI9H5crl9QchNMY9+g==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "peerDependencies": {
-        "eslint": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0"
-      }
-    },
-    "node_modules/eslint-plugin-react/node_modules/doctrine": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz",
-      "integrity": "sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==",
-      "dev": true,
-      "dependencies": {
-        "esutils": "^2.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/eslint-plugin-react/node_modules/estraverse": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
-      "dev": true,
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/eslint-plugin-react/node_modules/resolve": {
-      "version": "2.0.0-next.4",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-2.0.0-next.4.tgz",
-      "integrity": "sha512-iMDbmAWtfU+MHpxt/I5iWI7cY6YVEZUQ3MBgPQ++XD1PELuJHIl82xBmObyP2KyQmkNB2dsqF7seoQQiAn5yDQ==",
-      "dev": true,
-      "dependencies": {
-        "is-core-module": "^2.9.0",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
-      },
-      "bin": {
-        "resolve": "bin/resolve"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/eslint-plugin-react/node_modules/semver": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-      "dev": true,
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/eslint-scope": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
-      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
-      "dev": true,
-      "dependencies": {
-        "esrecurse": "^4.3.0",
-        "estraverse": "^4.1.1"
-      },
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/eslint-scope/node_modules/estraverse": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
-      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
-      "dev": true,
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/eslint-utils": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-3.0.0.tgz",
-      "integrity": "sha512-uuQC43IGctw68pJA1RgbQS8/NP7rch6Cwd4j3ZBtgo4/8Flj4eGE7ZYSZRN3iq5pVUv6GPdW5Z1RFleo84uLDA==",
-      "dev": true,
-      "dependencies": {
-        "eslint-visitor-keys": "^2.0.0"
-      },
-      "engines": {
-        "node": "^10.0.0 || ^12.0.0 || >= 14.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/mysticatea"
-      },
-      "peerDependencies": {
-        "eslint": ">=5"
-      }
-    },
-    "node_modules/eslint-utils/node_modules/eslint-visitor-keys": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
-      "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/eslint-visitor-keys": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.3.0.tgz",
-      "integrity": "sha512-mQ+suqKJVyeuwGYHAdjMFqjCyfl8+Ldnxuyp3ldiMBFKkvytrXUZWaiPCEav8qDHKty44bD+qV1IP4T+w+xXRA==",
-      "dev": true,
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      }
-    },
-    "node_modules/eslint/node_modules/escape-string-regexp": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
-      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint/node_modules/eslint-scope": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.1.tgz",
-      "integrity": "sha512-QKQM/UXpIiHcLqJ5AOyIW7XZmzjkzQXYE54n1++wb0u9V/abW3l9uQnxX8Z5Xd18xyKIMTUAyQ0k1e8pz6LUrw==",
-      "dev": true,
-      "dependencies": {
-        "esrecurse": "^4.3.0",
-        "estraverse": "^5.2.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      }
-    },
-    "node_modules/eslint/node_modules/find-up": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
-      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
-      "dev": true,
-      "dependencies": {
-        "locate-path": "^6.0.0",
-        "path-exists": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint/node_modules/glob-parent": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
-      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
-      "dev": true,
-      "dependencies": {
-        "is-glob": "^4.0.3"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/eslint/node_modules/globals": {
-      "version": "13.19.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-13.19.0.tgz",
-      "integrity": "sha512-dkQ957uSRWHw7CFXLUtUHQI3g3aWApYhfNR2O6jn/907riyTYKVBmxYVROkBcY614FSSeSJh7Xm7SrUWCxvJMQ==",
-      "dev": true,
-      "dependencies": {
-        "type-fest": "^0.20.2"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint/node_modules/locate-path": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
-      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
-      "dev": true,
-      "dependencies": {
-        "p-locate": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint/node_modules/p-locate": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
-      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
-      "dev": true,
-      "dependencies": {
-        "p-limit": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/eslint/node_modules/path-exists": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/eslint/node_modules/type-fest": {
-      "version": "0.20.2",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
-      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/espree": {
-      "version": "9.4.1",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-9.4.1.tgz",
-      "integrity": "sha512-XwctdmTO6SIvCzd9810yyNzIrOrqNYV9Koizx4C/mRhf9uq0o4yHoCEU/670pOxOL/MSraektvSAji79kX90Vg==",
-      "dev": true,
-      "dependencies": {
-        "acorn": "^8.8.0",
-        "acorn-jsx": "^5.3.2",
-        "eslint-visitor-keys": "^3.3.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      }
-    },
-    "node_modules/espree/node_modules/acorn": {
-      "version": "8.8.1",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.8.1.tgz",
-      "integrity": "sha512-7zFpHzhnqYKrkYdUjF1HI1bzd0VygEGX8lFk4k5zVMqHEoES+P+7TKI+EvLO9WVMJ8eekdO0aDEK044xTXwPPA==",
-      "dev": true,
-      "bin": {
-        "acorn": "bin/acorn"
-      },
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/esprima": {
-      "version": "4.0.1",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
-      "dev": true,
-      "peer": true,
-      "bin": {
-        "esparse": "bin/esparse.js",
-        "esvalidate": "bin/esvalidate.js"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/esquery": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.4.0.tgz",
-      "integrity": "sha512-cCDispWt5vHHtwMY2YrAQ4ibFkAL8RbH5YGBnZBc90MolvvfkkQcJro/aZiAQUlQ3qgrYS6D6v8Gc5G5CQsc9w==",
-      "dev": true,
-      "dependencies": {
-        "estraverse": "^5.1.0"
-      },
-      "engines": {
-        "node": ">=0.10"
-      }
-    },
-    "node_modules/esrecurse": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
-      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
-      "dev": true,
-      "dependencies": {
-        "estraverse": "^5.2.0"
-      },
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/estraverse": {
-      "version": "5.2.0",
-      "integrity": "sha512-BxbNGGNm0RyRYvUdHpIwv9IWzeM9XClbOxwoATuFdOE7ZE6wHL+HQ5T8hoPM+zHvmKzzsEqhgy0GrQ5X13afiQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/esutils": {
-      "version": "2.0.3",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/exec-sh": {
-      "version": "0.3.6",
-      "integrity": "sha512-nQn+hI3yp+oD0huYhKwvYI32+JFeq+XkNcD1GAo3Y/MjxsfVGmrrzrnzjWiNY6f+pUCP440fThsFh5gZrRAU/w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/execa": {
-      "version": "4.1.0",
-      "integrity": "sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "cross-spawn": "^7.0.0",
-        "get-stream": "^5.0.0",
-        "human-signals": "^1.1.1",
-        "is-stream": "^2.0.0",
-        "merge-stream": "^2.0.0",
-        "npm-run-path": "^4.0.0",
-        "onetime": "^5.1.0",
-        "signal-exit": "^3.0.2",
-        "strip-final-newline": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sindresorhus/execa?sponsor=1"
-      }
-    },
-    "node_modules/execall": {
-      "version": "2.0.0",
-      "integrity": "sha512-0FU2hZ5Hh6iQnarpRtQurM/aAvp3RIbfvgLHrcqJYzhXyV2KFruhuChf9NC6waAhiUR7FFtlugkI4p7f2Fqlow==",
-      "dev": true,
-      "dependencies": {
-        "clone-regexp": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/exit": {
-      "version": "0.1.2",
-      "integrity": "sha1-BjJjj42HfMghB9MKD/8aF8uhzQw=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/expand-brackets": {
-      "version": "2.1.4",
-      "integrity": "sha1-t3c14xXOMPa27/D4OwQVGiJEliI=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "debug": "^2.3.3",
-        "define-property": "^0.2.5",
-        "extend-shallow": "^2.0.1",
-        "posix-character-classes": "^0.1.0",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/expand-brackets/node_modules/debug": {
-      "version": "2.6.9",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "ms": "2.0.0"
-      }
-    },
-    "node_modules/expand-brackets/node_modules/define-property": {
-      "version": "0.2.5",
-      "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-descriptor": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/expand-brackets/node_modules/is-accessor-descriptor": {
-      "version": "0.1.6",
-      "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/expand-brackets/node_modules/is-accessor-descriptor/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/expand-brackets/node_modules/is-buffer": {
-      "version": "1.1.6",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/expand-brackets/node_modules/is-data-descriptor": {
-      "version": "0.1.4",
-      "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/expand-brackets/node_modules/is-data-descriptor/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/expand-brackets/node_modules/is-descriptor": {
-      "version": "0.1.6",
-      "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-accessor-descriptor": "^0.1.6",
-        "is-data-descriptor": "^0.1.4",
-        "kind-of": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/expand-brackets/node_modules/kind-of": {
-      "version": "5.1.0",
-      "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/expand-brackets/node_modules/ms": {
-      "version": "2.0.0",
-      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/expect": {
-      "version": "26.6.2",
-      "integrity": "sha512-9/hlOBkQl2l/PLHJx6JjoDF6xPKcJEsUlWKb23rKE7KzeDqUZKXKNMW27KIue5JMdBV9HgmoJPcc8HtO85t9IA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "ansi-styles": "^4.0.0",
-        "jest-get-type": "^26.3.0",
-        "jest-matcher-utils": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-regex-util": "^26.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/extend": {
-      "version": "3.0.2",
-      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
-      "dev": true
-    },
-    "node_modules/extend-shallow": {
-      "version": "2.0.1",
-      "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-extendable": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/external-editor": {
-      "version": "3.1.0",
-      "integrity": "sha512-hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==",
-      "dev": true,
-      "dependencies": {
-        "chardet": "^0.7.0",
-        "iconv-lite": "^0.4.24",
-        "tmp": "^0.0.33"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/extglob": {
-      "version": "2.0.4",
-      "integrity": "sha512-Nmb6QXkELsuBr24CJSkilo6UHHgbekK5UiZgfE6UHD3Eb27YC6oD+bhcT+tJ6cl8dmsgdQxnWlcry8ksBIBLpw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "array-unique": "^0.3.2",
-        "define-property": "^1.0.0",
-        "expand-brackets": "^2.1.4",
-        "extend-shallow": "^2.0.1",
-        "fragment-cache": "^0.2.1",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/extglob/node_modules/define-property": {
-      "version": "1.0.0",
-      "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-descriptor": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/extract-files": {
-      "version": "9.0.0",
-      "integrity": "sha512-CvdFfHkC95B4bBBk36hcEmvdR2awOdhhVUYH6S/zrVj3477zven/fJMYg7121h4T1xHZC+tetUpubpAhxwI7hQ==",
-      "dev": true,
-      "engines": {
-        "node": "^10.17.0 || ^12.0.0 || >= 13.7.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jaydenseric"
-      }
-    },
-    "node_modules/fast-deep-equal": {
-      "version": "3.1.3",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "dev": true
-    },
-    "node_modules/fast-diff": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/fast-diff/-/fast-diff-1.2.0.tgz",
-      "integrity": "sha512-xJuoT5+L99XlZ8twedaRf6Ax2TgQVxvgZOYoPKqZufmJib0tL2tegPBOZb1pVNgIhlqDlA0eO0c3wBvQcmzx4w==",
-      "dev": true
-    },
-    "node_modules/fast-glob": {
-      "version": "3.2.12",
-      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.2.12.tgz",
-      "integrity": "sha512-DVj4CQIYYow0BlaelwK1pHl5n5cRSJfM60UA0zK891sVInoPri2Ekj7+e1CT3/3qxXenpI+nBBmQAcJPJgaj4w==",
-      "dev": true,
-      "dependencies": {
-        "@nodelib/fs.stat": "^2.0.2",
-        "@nodelib/fs.walk": "^1.2.3",
-        "glob-parent": "^5.1.2",
-        "merge2": "^1.3.0",
-        "micromatch": "^4.0.4"
-      },
-      "engines": {
-        "node": ">=8.6.0"
-      }
-    },
-    "node_modules/fast-json-stable-stringify": {
-      "version": "2.1.0",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
-      "dev": true
-    },
-    "node_modules/fast-levenshtein": {
-      "version": "2.0.6",
-      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
-      "dev": true
-    },
-    "node_modules/fastest-levenshtein": {
-      "version": "1.0.12",
-      "integrity": "sha512-On2N+BpYJ15xIC974QNVuYGMOlEVt4s0EOI3wwMqOmK1fdDY+FN/zltPV8vosq4ad4c/gJ1KHScUn/6AWIgiow==",
-      "dev": true
-    },
-    "node_modules/fastq": {
-      "version": "1.13.0",
-      "integrity": "sha512-YpkpUnK8od0o1hmeSc7UUs/eB/vIPWJYjKck2QKIzAf71Vm1AAQ3EbuZB3g2JIy+pg+ERD0vqI79KyZiB2e2Nw==",
-      "dev": true,
-      "dependencies": {
-        "reusify": "^1.0.4"
-      }
-    },
-    "node_modules/fb-watchman": {
-      "version": "2.0.1",
-      "integrity": "sha512-DkPJKQeY6kKwmuMretBhr7G6Vodr7bFwDYTXIkfG1gjvNpaxBTQV3PbXg6bR1c1UP4jPOX0jHUbbHANL9vRjVg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "bser": "2.1.1"
-      }
-    },
-    "node_modules/figures": {
-      "version": "3.2.0",
-      "integrity": "sha512-yaduQFRKLXYOGgEn6AZau90j3ggSOyiqXU0F9JZfeXYhNa+Jk4X+s45A2zg5jns87GAFa34BBm2kXw4XpNcbdg==",
-      "dev": true,
-      "dependencies": {
-        "escape-string-regexp": "^1.0.5"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/file-entry-cache": {
-      "version": "6.0.1",
-      "integrity": "sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==",
-      "dev": true,
-      "dependencies": {
-        "flat-cache": "^3.0.4"
-      },
-      "engines": {
-        "node": "^10.12.0 || >=12.0.0"
-      }
-    },
-    "node_modules/filelist": {
-      "version": "1.0.2",
-      "integrity": "sha512-z7O0IS8Plc39rTCq6i6iHxk43duYOn8uFJiWSewIq0Bww1RNybVHSCjahmcC87ZqAm4OTvFzlzeGu3XAzG1ctQ==",
-      "dev": true,
-      "dependencies": {
-        "minimatch": "^3.0.4"
-      }
-    },
-    "node_modules/fill-range": {
-      "version": "7.0.1",
-      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
-      "dev": true,
-      "dependencies": {
-        "to-regex-range": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/find-up": {
-      "version": "2.1.0",
-      "integrity": "sha1-RdG35QbHF93UgndaK3eSCjwMV6c=",
-      "dev": true,
-      "dependencies": {
-        "locate-path": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/flat": {
-      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/flat/-/flat-5.0.2.tgz",
-      "integrity": "sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==",
-      "dev": true,
-      "bin": {
-        "flat": "cli.js"
-      }
-    },
-    "node_modules/flat-cache": {
-      "version": "3.0.4",
-      "integrity": "sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==",
-      "dev": true,
-      "dependencies": {
-        "flatted": "^3.1.0",
-        "rimraf": "^3.0.2"
-      },
-      "engines": {
-        "node": "^10.12.0 || >=12.0.0"
-      }
-    },
-    "node_modules/flatted": {
-      "version": "3.2.2",
-      "integrity": "sha512-JaTY/wtrcSyvXJl4IMFHPKyFur1sE9AUqc0QnhOaJ0CxHtAoIV8pYDzeEfAaNEtGkOfq4gr3LBFmdXW5mOQFnA==",
-      "dev": true
-    },
-    "node_modules/for-each": {
-      "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/for-each/-/for-each-0.3.3.tgz",
-      "integrity": "sha512-jqYfLp7mo9vIyQf8ykW2v7A+2N4QjeCeI5+Dz9XraiO1ign81wjiH7Fb9vSOWvQfNtmSa4H2RoQTrrXivdUZmw==",
-      "dev": true,
-      "dependencies": {
-        "is-callable": "^1.1.3"
-      }
-    },
-    "node_modules/for-in": {
-      "version": "1.0.2",
-      "integrity": "sha1-gQaNKVqBQuwKxybG4iAMMPttXoA=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/form-data": {
-      "version": "3.0.1",
-      "integrity": "sha512-RHkBKtLWUVwd7SqRIvCZMEvAMoGUp0XU+seQiZejj0COz3RI3hWP4sCv3gZWWLjJTd7rGwcsF5eKZGii0r/hbg==",
-      "dev": true,
-      "dependencies": {
-        "asynckit": "^0.4.0",
-        "combined-stream": "^1.0.8",
-        "mime-types": "^2.1.12"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/fragment-cache": {
-      "version": "0.2.1",
-      "integrity": "sha1-QpD60n8T6Jvn8zeZxrxaCr//DRk=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "map-cache": "^0.2.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/fs-extra": {
-      "version": "9.0.1",
-      "integrity": "sha512-h2iAoN838FqAFJY2/qVpzFXy+EBxfVE220PalAqQLDVsFOHLJrZvut5puAbCdNv6WJk+B8ihI+k0c7JK5erwqQ==",
-      "dev": true,
-      "dependencies": {
-        "at-least-node": "^1.0.0",
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
-      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8=",
-      "dev": true
-    },
-    "node_modules/fsevents": {
-      "version": "2.3.2",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
-      "hasInstallScript": true,
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "peer": true,
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
-    "node_modules/function-bind": {
-      "version": "1.1.1",
-      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A==",
-      "dev": true
-    },
-    "node_modules/function.prototype.name": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/function.prototype.name/-/function.prototype.name-1.1.5.tgz",
-      "integrity": "sha512-uN7m/BzVKQnCUF/iW8jYea67v++2u7m5UgENbHRtdDVclOUP+FMPlCNdmk0h/ysGyo2tavMJEDqJAkJdRa1vMA==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.3",
-        "es-abstract": "^1.19.0",
-        "functions-have-names": "^1.2.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/functions-have-names": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/functions-have-names/-/functions-have-names-1.2.3.tgz",
-      "integrity": "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/gensync": {
-      "version": "1.0.0-beta.2",
-      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
-      "dev": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/get-caller-file": {
-      "version": "2.0.5",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
-      "dev": true,
-      "engines": {
-        "node": "6.* || 8.* || >= 10.*"
-      }
-    },
-    "node_modules/get-intrinsic": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.1.3.tgz",
-      "integrity": "sha512-QJVz1Tj7MS099PevUG5jvnt9tSkXN8K14dxQlikJuPt4uD9hHAHjLyLBiLR5zELelBdD9QNRAXZzsJx0WaDL9A==",
-      "dev": true,
-      "dependencies": {
-        "function-bind": "^1.1.1",
-        "has": "^1.0.3",
-        "has-symbols": "^1.0.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-own-enumerable-property-symbols": {
-      "version": "3.0.2",
-      "integrity": "sha512-I0UBV/XOz1XkIJHEUDMZAbzCThU/H8DxmSfmdGcKPnVhu2VfFqr34jr9777IyaTYvxjedWhqVIilEDsCdP5G6g==",
-      "dev": true
-    },
-    "node_modules/get-package-type": {
-      "version": "0.1.0",
-      "integrity": "sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/get-stream": {
-      "version": "5.2.0",
-      "integrity": "sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "pump": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/get-symbol-description": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/get-symbol-description/-/get-symbol-description-1.0.0.tgz",
-      "integrity": "sha512-2EmdH1YvIQiZpltCNgkuiUnyukzxM/R6NDJX31Ke3BG1Nq5b0S2PhX59UKi9vZpPDQVdqn+1IcaAwnzTT5vCjw==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/get-tsconfig": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.3.0.tgz",
-      "integrity": "sha512-YCcF28IqSay3fqpIu5y3Krg/utCBHBeoflkZyHj/QcqI2nrLPC3ZegS9CmIo+hJb8K7aiGsuUl7PwWVjNG2HQQ==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
-      }
-    },
-    "node_modules/get-value": {
-      "version": "2.0.6",
-      "integrity": "sha1-3BXKHGcjh8p2vTesCjlbogQqLCg=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/glob": {
-      "version": "7.2.0",
-      "integrity": "sha512-lmLf6gtyrPq8tTjSmrO94wBeQbFR3HbLHbuyD69wuyQkImp2hWqMGB47OX65FBkPffO641IP9jWa1z4ivqG26Q==",
-      "dev": true,
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.0.4",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/glob-parent": {
-      "version": "5.1.2",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
-      "dev": true,
-      "dependencies": {
-        "is-glob": "^4.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/glob-to-regexp": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/glob-to-regexp/-/glob-to-regexp-0.4.1.tgz",
-      "integrity": "sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==",
-      "dev": true
-    },
-    "node_modules/global-modules": {
-      "version": "2.0.0",
-      "integrity": "sha512-NGbfmJBp9x8IxyJSd1P+otYK8vonoJactOogrVfFRIAEY1ukil8RSKDz2Yo7wh1oihl51l/r6W4epkeKJHqL8A==",
-      "dev": true,
-      "dependencies": {
-        "global-prefix": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/global-prefix": {
-      "version": "3.0.0",
-      "integrity": "sha512-awConJSVCHVGND6x3tmMaKcQvwXLhjdkmomy2W+Goaui8YPgYgXJZewhg3fWC+DlfqqQuWg8AwqjGTD2nAPVWg==",
-      "dev": true,
-      "dependencies": {
-        "ini": "^1.3.5",
-        "kind-of": "^6.0.2",
-        "which": "^1.3.1"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/global-prefix/node_modules/which": {
-      "version": "1.3.1",
-      "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
-      "dev": true,
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "which": "bin/which"
-      }
-    },
-    "node_modules/globals": {
-      "version": "11.12.0",
-      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/globalthis": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.3.tgz",
-      "integrity": "sha512-sFdI5LyBiNTHjRd7cGPWapiHWMOXKyuBNX/cWJ3NfzrZQVa8GI/8cofCl74AOVqq9W5kNmguTIzJ/1s2gyI9wA==",
-      "dev": true,
-      "dependencies": {
-        "define-properties": "^1.1.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/globalyzer": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/globalyzer/-/globalyzer-0.1.0.tgz",
-      "integrity": "sha512-40oNTM9UfG6aBmuKxk/giHn5nQ8RVz/SS4Ir6zgzOv9/qC3kKZ9v4etGTcJbEl/NyVQH7FGU7d+X1egr57Md2Q==",
-      "dev": true
-    },
-    "node_modules/globby": {
-      "version": "11.0.1",
-      "integrity": "sha512-iH9RmgwCmUJHi2z5o2l3eTtGBtXek1OYlHrbcxOYugyHLmAsZrPj43OtHThd62Buh/Vv6VyCBD2bdyWcGNQqoQ==",
-      "dev": true,
-      "dependencies": {
-        "array-union": "^2.1.0",
-        "dir-glob": "^3.0.1",
-        "fast-glob": "^3.1.1",
-        "ignore": "^5.1.4",
-        "merge2": "^1.3.0",
-        "slash": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/globjoin": {
-      "version": "0.1.4",
-      "integrity": "sha1-L0SUrIkZ43Z8XLtpHp9GMyQoXUM=",
-      "dev": true
-    },
-    "node_modules/globrex": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/globrex/-/globrex-0.1.2.tgz",
-      "integrity": "sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg==",
-      "dev": true
-    },
-    "node_modules/gonzales-pe": {
-      "version": "4.3.0",
-      "integrity": "sha512-otgSPpUmdWJ43VXyiNgEYE4luzHCL2pz4wQ0OnDluC6Eg4Ko3Vexy/SrSynglw/eR+OhkzmqFCZa/OFa/RgAOQ==",
-      "dev": true,
-      "dependencies": {
-        "minimist": "^1.2.5"
-      },
-      "bin": {
-        "gonzales": "bin/gonzales.js"
-      },
-      "engines": {
-        "node": ">=0.6.0"
-      }
-    },
-    "node_modules/gopd": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.0.1.tgz",
-      "integrity": "sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==",
-      "dev": true,
-      "dependencies": {
-        "get-intrinsic": "^1.1.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/graceful-fs": {
-      "version": "4.2.11",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
-      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
-      "dev": true
-    },
-    "node_modules/grapheme-splitter": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/grapheme-splitter/-/grapheme-splitter-1.0.4.tgz",
-      "integrity": "sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==",
-      "dev": true
-    },
-    "node_modules/graphql": {
-      "version": "15.6.1",
-      "integrity": "sha512-3i5lu0z6dRvJ48QP9kFxBkJ7h4Kso7PS8eahyTFz5Jm6CvQfLtNIE8LX9N6JLnXTuwR+sIYnXzaWp6anOg0QQw==",
-      "dev": true,
-      "engines": {
-        "node": ">= 10.x"
-      }
-    },
-    "node_modules/graphql-request": {
-      "version": "3.5.0",
-      "integrity": "sha512-Io89QpfU4rqiMbqM/KwMBzKaDLOppi8FU8sEccCE4JqCgz95W9Q8bvxQ4NfPALLSMvg9nafgg8AkYRmgKSlukA==",
-      "dev": true,
-      "dependencies": {
-        "cross-fetch": "^3.0.6",
-        "extract-files": "^9.0.0",
-        "form-data": "^3.0.0"
-      },
-      "peerDependencies": {
-        "graphql": "14.x || 15.x"
-      }
-    },
-    "node_modules/growly": {
-      "version": "1.3.0",
-      "integrity": "sha1-8QdIy+dq+WS3yWyTxrzCivEgwIE=",
-      "dev": true,
-      "optional": true,
-      "peer": true
-    },
-    "node_modules/hard-rejection": {
-      "version": "2.1.0",
-      "integrity": "sha512-VIZB+ibDhx7ObhAe7OVtoEbuP4h/MuOTHJ+J8h/eBXotJYl0fBgR72xDFCKgIh22OJZIOVNxBMWuhAr10r8HdA==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/has": {
-      "version": "1.0.3",
-      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
-      "dev": true,
-      "dependencies": {
-        "function-bind": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4.0"
-      }
-    },
-    "node_modules/has-bigints": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.0.2.tgz",
-      "integrity": "sha512-tSvCKtBr9lkF0Ex0aQiP9N+OpV4zi2r/Nee5VkRDbaqv35RLYMzbwQfFSZZH0kR+Rd6302UJZ2p/bJCEoR3VoQ==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-flag": {
-      "version": "4.0.0",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/has-property-descriptors": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.0.tgz",
-      "integrity": "sha512-62DVLZGoiEBDHQyqG4w9xCuZ7eJEwNmJRWw2VY84Oedb7WFcA27fiEVe8oUQx9hAUJ4ekurquucTGwsyO1XGdQ==",
-      "dev": true,
-      "dependencies": {
-        "get-intrinsic": "^1.1.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.1.tgz",
-      "integrity": "sha512-7qE+iP+O+bgF9clE5+UoBFzE65mlBiVj3tKCrlNQ0Ogwm0BjpT/gK4SlLYDMybDh5I3TCTKnPPa0oMG7JDYrhg==",
-      "dev": true,
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-symbols": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz",
-      "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==",
-      "dev": true,
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-tostringtag": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.0.tgz",
-      "integrity": "sha512-kFjcSNhnlGV1kyoGk7OXKSawH5JOb/LzUc5w9B02hOTO0dfFRjbHQKvg1d6cf3HbeUmtU9VbbV3qzZ2Teh97WQ==",
-      "dev": true,
-      "dependencies": {
-        "has-symbols": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/has-value": {
-      "version": "1.0.0",
-      "integrity": "sha1-GLKB2lhbHFxR3vJMkw7SmgvmsXc=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "get-value": "^2.0.6",
-        "has-values": "^1.0.0",
-        "isobject": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/has-values": {
-      "version": "1.0.0",
-      "integrity": "sha1-lbC2P+whRmGab+V/51Yo1aOe/k8=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-number": "^3.0.0",
-        "kind-of": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/has-values/node_modules/is-buffer": {
-      "version": "1.1.6",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/has-values/node_modules/is-number": {
-      "version": "3.0.0",
-      "integrity": "sha1-JP1iAaR4LPUFYcgQJ2r8fRLXEZU=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/has-values/node_modules/is-number/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/has-values/node_modules/kind-of": {
-      "version": "4.0.0",
-      "integrity": "sha1-IIE989cSkosgc3hpGkUGb65y3Vc=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/hosted-git-info": {
-      "version": "2.8.9",
-      "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/html-encoding-sniffer": {
-      "version": "2.0.1",
-      "integrity": "sha512-D5JbOMBIR/TVZkubHT+OyT2705QvogUW4IBn6nHd756OwieSF9aDYFj4dv6HHEVGYbHaLETa3WggZYWWMyy3ZQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "whatwg-encoding": "^1.0.5"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/html-escaper": {
-      "version": "2.0.2",
-      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/html-tags": {
-      "version": "3.1.0",
-      "integrity": "sha512-1qYz89hW3lFDEazhjW0yVAV87lw8lVkrJocr72XmBkMKsoSVJCQx3W8BXsC7hO2qAt8BoVjYjtAcZ9perqGnNg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/htmlparser2": {
-      "version": "3.10.1",
-      "integrity": "sha512-IgieNijUMbkDovyoKObU1DUhm1iwNYE/fuifEoEHfd1oZKZDaONBSkal7Y01shxsM49R4XaMdGez3WnF9UfiCQ==",
-      "dev": true,
-      "dependencies": {
-        "domelementtype": "^1.3.1",
-        "domhandler": "^2.3.0",
-        "domutils": "^1.5.1",
-        "entities": "^1.1.1",
-        "inherits": "^2.0.1",
-        "readable-stream": "^3.1.1"
-      }
-    },
-    "node_modules/http-proxy-agent": {
-      "version": "4.0.1",
-      "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@tootallnate/once": "1",
-        "agent-base": "6",
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/https-proxy-agent": {
-      "version": "5.0.0",
-      "integrity": "sha512-EkYm5BcKUGiduxzSt3Eppko+PiNWNEpa4ySk9vTC6wDsQJW9rHSa+UhGNJoRYp7bz6Ht1eaRIa6QaJqO5rCFbA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "agent-base": "6",
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/human-signals": {
-      "version": "1.1.1",
-      "integrity": "sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8.12.0"
-      }
-    },
-    "node_modules/iconv-lite": {
-      "version": "0.4.24",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
-      "dev": true,
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/ignore": {
-      "version": "5.2.4",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.2.4.tgz",
-      "integrity": "sha512-MAb38BcSbH0eHNBxn7ql2NH/kX33OkB3lZ1BNdh7ENeRChHTYsTvWrMubiIAMNS2llXEEgZ1MUOBtXChP3kaFQ==",
-      "dev": true,
-      "engines": {
-        "node": ">= 4"
-      }
-    },
-    "node_modules/import-fresh": {
-      "version": "3.3.0",
-      "integrity": "sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==",
-      "dev": true,
-      "dependencies": {
-        "parent-module": "^1.0.0",
-        "resolve-from": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/import-local": {
-      "version": "3.0.3",
-      "integrity": "sha512-bE9iaUY3CXH8Cwfan/abDKAxe1KGT9kyGsBPqf6DMK/z0a2OzAsrukeYNgIH6cH5Xr452jb1TUL8rSfCLjZ9uA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "pkg-dir": "^4.2.0",
-        "resolve-cwd": "^3.0.0"
-      },
-      "bin": {
-        "import-local-fixture": "fixtures/cli.js"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/import-local/node_modules/find-up": {
-      "version": "4.1.0",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "locate-path": "^5.0.0",
-        "path-exists": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/import-local/node_modules/locate-path": {
-      "version": "5.0.0",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-locate": "^4.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/import-local/node_modules/p-limit": {
-      "version": "2.3.0",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-try": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/import-local/node_modules/p-locate": {
-      "version": "4.1.0",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-limit": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/import-local/node_modules/path-exists": {
-      "version": "4.0.0",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/import-local/node_modules/pkg-dir": {
-      "version": "4.2.0",
-      "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "find-up": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/imurmurhash": {
-      "version": "0.1.4",
-      "integrity": "sha1-khi5srkoojixPcT7a21XbyMUU+o=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.8.19"
-      }
-    },
-    "node_modules/indent-string": {
-      "version": "4.0.0",
-      "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
-      "dev": true,
-      "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true
-    },
-    "node_modules/ini": {
-      "version": "1.3.8",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
-      "dev": true
-    },
-    "node_modules/inquirer": {
-      "version": "7.3.3",
-      "resolved": "https://registry.npmjs.org/inquirer/-/inquirer-7.3.3.tgz",
-      "integrity": "sha512-JG3eIAj5V9CwcGvuOmoo6LB9kbAYT8HXffUl6memuszlwDC/qvFAJw49XJ5NROSFNPxp3iQg1GqkFhaY/CR0IA==",
-      "dev": true,
-      "dependencies": {
-        "ansi-escapes": "^4.2.1",
-        "chalk": "^4.1.0",
-        "cli-cursor": "^3.1.0",
-        "cli-width": "^3.0.0",
-        "external-editor": "^3.0.3",
-        "figures": "^3.0.0",
-        "lodash": "^4.17.19",
-        "mute-stream": "0.0.8",
-        "run-async": "^2.4.0",
-        "rxjs": "^6.6.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0",
-        "through": "^2.3.6"
-      },
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/internal-slot": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.0.4.tgz",
-      "integrity": "sha512-tA8URYccNzMo94s5MQZgH8NB/XTa6HsOo0MLfXTKKEnHVVdegzaQoFZ7Jp44bdvLvY2waT5dc+j5ICEswhi7UQ==",
-      "dev": true,
-      "dependencies": {
-        "get-intrinsic": "^1.1.3",
-        "has": "^1.0.3",
-        "side-channel": "^1.0.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/ip-regex": {
-      "version": "4.3.0",
-      "integrity": "sha512-B9ZWJxHHOHUhUjCPrMpLD4xEq35bUTClHM1S6CBU5ixQnkZmwipwgc96vAd7AAGM9TGHvJR+Uss+/Ak6UphK+Q==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-accessor-descriptor": {
-      "version": "1.0.0",
-      "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-alphabetical": {
-      "version": "1.0.4",
-      "integrity": "sha512-DwzsA04LQ10FHTZuL0/grVDk4rFoVH1pjAToYwBrHSxcrBIGQuXrQMtD5U1b0U2XVgKZCTLLP8u2Qxqhy3l2Vg==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/is-alphanumeric": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-alphanumeric/-/is-alphanumeric-1.0.0.tgz",
-      "integrity": "sha512-ZmRL7++ZkcMOfDuWZuMJyIVLr2keE1o/DeNWh1EmgqGhUcV+9BIVsx0BcSBOHTZqzjs4+dISzr2KAeBEWGgXeA==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-alphanumerical": {
-      "version": "1.0.4",
-      "integrity": "sha512-UzoZUr+XfVz3t3v4KyGEniVL9BDRoQtY7tOyrRybkVNjDFWyo1yhXNGrrBTQxp3ib9BLAWs7k2YKBQsFRkZG9A==",
-      "dev": true,
-      "dependencies": {
-        "is-alphabetical": "^1.0.0",
-        "is-decimal": "^1.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/is-arguments": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-arguments/-/is-arguments-1.1.1.tgz",
-      "integrity": "sha512-8Q7EARjzEnKpt/PCD7e1cgUS0a6X8u5tdSiMqXhojOdoV9TsMsiO+9VLC5vAmO8N7/GmXn7yjR8qnA6bVAEzfA==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-array-buffer": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.1.tgz",
-      "integrity": "sha512-ASfLknmY8Xa2XtB4wmbz13Wu202baeA18cJBCeCy0wXUHZF0IPyVEXqKEcd+t2fNSLLL1vC6k7lxZEojNbISXQ==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.3",
-        "is-typed-array": "^1.1.10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-arrayish": {
-      "version": "0.2.1",
-      "integrity": "sha1-d8mYQFJ6qOyxqLppe4BkWnqSap0=",
-      "dev": true
-    },
-    "node_modules/is-bigint": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-bigint/-/is-bigint-1.0.4.tgz",
-      "integrity": "sha512-zB9CruMamjym81i2JZ3UMn54PKGsQzsJeo6xvN3HJJ4CAsQNB6iRutp2To77OfCNuoxspsIhzaPoO1zyCEhFOg==",
-      "dev": true,
-      "dependencies": {
-        "has-bigints": "^1.0.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-boolean-object": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.1.2.tgz",
-      "integrity": "sha512-gDYaKHJmnj4aWxyj6YHyXVpdQawtVLHU5cb+eztPGczf6cjuTdwve5ZIEfgXqH4e57An1D1AKf8CZ3kYrQRqYA==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-buffer": {
-      "version": "2.0.5",
-      "integrity": "sha512-i2R6zNFDwgEHJyQUtJEk0XFi1i0dPFn/oqjK3/vPCcDeJvW5NQ83V8QbicfF1SupOaB0h8ntgBC2YiE7dfyctQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/is-callable": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.7.tgz",
-      "integrity": "sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==",
-      "dev": true,
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-ci": {
-      "version": "2.0.0",
-      "integrity": "sha512-YfJT7rkpQB0updsdHLGWrvhBJfcfzNNawYDNIyQXJz0IViGf75O8EBPKSdvw2rF+LGCsX4FZ8tcr3b19LcZq4w==",
-      "dev": true,
-      "dependencies": {
-        "ci-info": "^2.0.0"
-      },
-      "bin": {
-        "is-ci": "bin.js"
-      }
-    },
-    "node_modules/is-core-module": {
-      "version": "2.11.0",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.11.0.tgz",
-      "integrity": "sha512-RRjxlvLDkD1YJwDbroBHMb+cukurkDWNyHx7D3oNB5x9rb5ogcksMC5wHCadcXoo67gVr/+3GFySh3134zi6rw==",
-      "dev": true,
-      "dependencies": {
-        "has": "^1.0.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-data-descriptor": {
-      "version": "1.0.0",
-      "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-date-object": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.0.5.tgz",
-      "integrity": "sha512-9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ==",
-      "dev": true,
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-decimal": {
-      "version": "1.0.4",
-      "integrity": "sha512-RGdriMmQQvZ2aqaQq3awNA6dCGtKpiDFcOzrTWrDAT2MiWrKQVPmxLGHl7Y2nNu6led0kEyoX0enY0qXYsv9zw==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/is-descriptor": {
-      "version": "1.0.2",
-      "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-accessor-descriptor": "^1.0.0",
-        "is-data-descriptor": "^1.0.0",
-        "kind-of": "^6.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-docker": {
-      "version": "2.2.1",
-      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
-      "dev": true,
-      "bin": {
-        "is-docker": "cli.js"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/is-extendable": {
-      "version": "0.1.1",
-      "integrity": "sha1-YrEQ4omkcUGOPsNqYX1HLjAd/Ik=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-extglob": {
-      "version": "2.1.1",
-      "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-generator-fn": {
-      "version": "2.1.0",
-      "integrity": "sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/is-glob": {
-      "version": "4.0.3",
-      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
-      "dev": true,
-      "dependencies": {
-        "is-extglob": "^2.1.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-hexadecimal": {
-      "version": "1.0.4",
-      "integrity": "sha512-gyPJuv83bHMpocVYoqof5VDiZveEoGoFL8m3BXNb2VW8Xs+rz9kqO8LOQ5DH6EsuvilT1ApazU0pyl+ytbPtlw==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/is-map": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-map/-/is-map-2.0.2.tgz",
-      "integrity": "sha512-cOZFQQozTha1f4MxLFzlgKYPTyj26picdZTx82hbc/Xf4K/tZOOXSCkMvU4pKioRXGDLJRn0GM7Upe7kR721yg==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-negative-zero": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.2.tgz",
-      "integrity": "sha512-dqJvarLawXsFbNDeJW7zAz8ItJ9cd28YufuuFzh0G8pNHjJMnY08Dv7sYX2uF5UpQOwieAeOExEYAWWfu7ZZUA==",
-      "dev": true,
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-number": {
-      "version": "7.0.0",
-      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.12.0"
-      }
-    },
-    "node_modules/is-number-object": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/is-number-object/-/is-number-object-1.0.7.tgz",
-      "integrity": "sha512-k1U0IRzLMo7ZlYIfzRu23Oh6MiIFasgpb9X76eqfFZAqwH44UI4KTBvBYIZ1dSL9ZzChTB9ShHfLkR4pdW5krQ==",
-      "dev": true,
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-obj": {
-      "version": "1.0.1",
-      "integrity": "sha1-PkcprB9f3gJc19g6iW2rn09n2w8=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-path-inside": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/is-path-inside/-/is-path-inside-3.0.3.tgz",
-      "integrity": "sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-plain-obj": {
-      "version": "1.1.0",
-      "integrity": "sha1-caUMhCnfync8kqOQpKA7OfzVHT4=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-plain-object": {
-      "version": "2.0.4",
-      "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "isobject": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-potential-custom-element-name": {
-      "version": "1.0.1",
-      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/is-regex": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
-      "integrity": "sha512-kvRdxDsxZjhzUX07ZnLydzS1TU/TJlTUHHY4YLL87e37oUA49DfkLqgy+VjFocowy29cKvcSiu+kIv728jTTVg==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-regexp": {
-      "version": "1.0.0",
-      "integrity": "sha1-/S2INUXEa6xaYz57mgnof6LLUGk=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-set": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-set/-/is-set-2.0.2.tgz",
-      "integrity": "sha512-+2cnTEZeY5z/iXGbLhPrOAaK/Mau5k5eXq9j14CpRTftq0pAJu2MwVRSZhyZWBzx3o6X795Lz6Bpb6R0GKf37g==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-shared-array-buffer": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-shared-array-buffer/-/is-shared-array-buffer-1.0.2.tgz",
-      "integrity": "sha512-sqN2UDu1/0y6uvXyStCOzyhAjCSlHceFoMKJW8W9EU9cvic/QdsZ0kEU93HEy3IUEFZIiH/3w+AH/UQbPHNdhA==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-stream": {
-      "version": "2.0.1",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/is-string": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/is-string/-/is-string-1.0.7.tgz",
-      "integrity": "sha512-tE2UXzivje6ofPW7l23cjDOMa09gb7xlAqG6jG5ej6uPV32TlWP3NKPigtaGeHNu9fohccRYvIiZMfOOnOYUtg==",
-      "dev": true,
-      "dependencies": {
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-symbol": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-symbol/-/is-symbol-1.0.4.tgz",
-      "integrity": "sha512-C/CPBqKWnvdcxqIARxyOh4v1UUEOCHpgDa0WYgpKDFMszcrPcffg5uhwSgPCLD2WWxmq6isisz87tzT01tuGhg==",
-      "dev": true,
-      "dependencies": {
-        "has-symbols": "^1.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-typed-array": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/is-typed-array/-/is-typed-array-1.1.10.tgz",
-      "integrity": "sha512-PJqgEHiWZvMpaFZ3uTc8kHPM4+4ADTlDniuQL7cU/UDA0Ql7F70yGfHph3cLNe+c9toaigv+DFzTJKhc2CtO6A==",
-      "dev": true,
-      "dependencies": {
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "gopd": "^1.0.1",
-        "has-tostringtag": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-typedarray": {
-      "version": "1.0.0",
-      "integrity": "sha1-5HnICFjfDBsR3dppQPlgEfzaSpo=",
-      "dev": true
-    },
-    "node_modules/is-unicode-supported": {
-      "version": "0.1.0",
-      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/is-url-superb": {
-      "version": "3.0.0",
-      "integrity": "sha512-3faQP+wHCGDQT1qReM5zCPx2mxoal6DzbzquFlCYJLWyy4WPTved33ea2xFbX37z4NoriEwZGIYhFtx8RUB5wQ==",
-      "dev": true,
-      "dependencies": {
-        "url-regex": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-weakmap": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-weakmap/-/is-weakmap-2.0.1.tgz",
-      "integrity": "sha512-NSBR4kH5oVj1Uwvv970ruUkCV7O1mzgVFO4/rev2cLRda9Tm9HrL70ZPut4rOHgY0FNrUu9BCbXA2sdQ+x0chA==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-weakref": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.0.2.tgz",
-      "integrity": "sha512-qctsuLZmIQ0+vSSMfoVvyFe2+GSEvnmZ2ezTup1SBse9+twCCeial6EEi3Nc2KFcf6+qz2FBPnjXsk8xhKSaPQ==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-weakset": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-weakset/-/is-weakset-2.0.2.tgz",
-      "integrity": "sha512-t2yVvttHkQktwnNNmBQ98AhENLdPUTDTE21uPqAQ0ARwQfGeQKRVS0NNurH7bTf7RrvcVn1OOge45CnBeHCSmg==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-whitespace-character": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-whitespace-character/-/is-whitespace-character-1.0.4.tgz",
-      "integrity": "sha512-SDweEzfIZM0SJV0EUga669UTKlmL0Pq8Lno0QDQsPnvECB3IM2aP0gdx5TrU0A01MAPfViaZiI2V1QMZLaKK5w==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/is-windows": {
-      "version": "1.0.2",
-      "integrity": "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/is-word-character": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-word-character/-/is-word-character-1.0.4.tgz",
-      "integrity": "sha512-5SMO8RVennx3nZrqtKwCGyyetPE9VDba5ugvKLaD4KopPG5kR4mQ7tNt/r7feL5yt5h3lpuBbIUmCOG2eSzXHA==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/is-wsl": {
-      "version": "2.2.0",
-      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
-      "dev": true,
-      "dependencies": {
-        "is-docker": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/isarray": {
-      "version": "1.0.0",
-      "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE=",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=",
-      "dev": true
-    },
-    "node_modules/isobject": {
-      "version": "3.0.1",
-      "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/istanbul-lib-coverage": {
-      "version": "3.0.2",
-      "integrity": "sha512-o5+eTUYzCJ11/+JhW5/FUCdfsdoYVdQ/8I/OveE2XsjehYn5DdeSnNQAbjYaO8gQ6hvGTN6GM6ddQqpTVG5j8g==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/istanbul-lib-instrument": {
-      "version": "4.0.3",
-      "integrity": "sha512-BXgQl9kf4WTCPCCpmFGoJkz/+uhvm7h7PFKUYxh7qarQd3ER33vHG//qaE8eN25l07YqZPpHXU9I09l/RD5aGQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/core": "^7.7.5",
-        "@istanbuljs/schema": "^0.1.2",
-        "istanbul-lib-coverage": "^3.0.0",
-        "semver": "^6.3.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/istanbul-lib-instrument/node_modules/semver": {
-      "version": "6.3.0",
-      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-      "dev": true,
-      "peer": true,
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/istanbul-lib-report": {
-      "version": "3.0.0",
-      "integrity": "sha512-wcdi+uAKzfiGT2abPpKZ0hSU1rGQjUQnLvtY5MpQ7QCTahD3VODhcu4wcfY1YtkGaDD5yuydOLINXsfbus9ROw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "istanbul-lib-coverage": "^3.0.0",
-        "make-dir": "^3.0.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/istanbul-lib-report/node_modules/make-dir": {
-      "version": "3.1.0",
-      "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "semver": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/istanbul-lib-report/node_modules/semver": {
-      "version": "6.3.0",
-      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-      "dev": true,
-      "peer": true,
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
-    "node_modules/istanbul-lib-source-maps": {
-      "version": "4.0.0",
-      "integrity": "sha512-c16LpFRkR8vQXyHZ5nLpY35JZtzj1PQY1iZmesUbf1FZHbIupcWfjgOXBY9YHkLEQ6puz1u4Dgj6qmU/DisrZg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "debug": "^4.1.1",
-        "istanbul-lib-coverage": "^3.0.0",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/istanbul-lib-source-maps/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/istanbul-reports": {
-      "version": "3.0.3",
-      "integrity": "sha512-0i77ZFLsb9U3DHi22WzmIngVzfoyxxbQcZRqlF3KoKmCJGq9nhFHoGi8FqBztN2rE8w6hURnZghetn0xpkVb6A==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "html-escaper": "^2.0.0",
-        "istanbul-lib-report": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/jake": {
-      "version": "10.8.2",
-      "integrity": "sha512-eLpKyrfG3mzvGE2Du8VoPbeSkRry093+tyNjdYaBbJS9v17knImYGNXQCUV0gLxQtF82m3E8iRb/wdSQZLoq7A==",
-      "dev": true,
-      "dependencies": {
-        "async": "0.9.x",
-        "chalk": "^2.4.2",
-        "filelist": "^1.0.1",
-        "minimatch": "^3.0.4"
-      },
-      "bin": {
-        "jake": "bin/cli.js"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/jake/node_modules/ansi-styles": {
-      "version": "3.2.1",
-      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-      "dev": true,
-      "dependencies": {
-        "color-convert": "^1.9.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/jake/node_modules/chalk": {
-      "version": "2.4.2",
-      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^3.2.1",
-        "escape-string-regexp": "^1.0.5",
-        "supports-color": "^5.3.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/jake/node_modules/color-convert": {
-      "version": "1.9.3",
-      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-      "dev": true,
-      "dependencies": {
-        "color-name": "1.1.3"
-      }
-    },
-    "node_modules/jake/node_modules/color-name": {
-      "version": "1.1.3",
-      "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU=",
-      "dev": true
-    },
-    "node_modules/jake/node_modules/has-flag": {
-      "version": "3.0.0",
-      "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0=",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/jake/node_modules/supports-color": {
-      "version": "5.5.0",
-      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-      "dev": true,
-      "dependencies": {
-        "has-flag": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/jest": {
-      "version": "26.6.3",
-      "integrity": "sha512-lGS5PXGAzR4RF7V5+XObhqz2KZIDUA1yD0DG6pBVmy10eh0ZIXQImRuzocsI/N2XZ1GrLFwTS27In2i2jlpq1Q==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/core": "^26.6.3",
-        "import-local": "^3.0.2",
-        "jest-cli": "^26.6.3"
-      },
-      "bin": {
-        "jest": "bin/jest.js"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-changed-files": {
-      "version": "26.6.2",
-      "integrity": "sha512-fDS7szLcY9sCtIip8Fjry9oGf3I2ht/QT21bAHm5Dmf0mD4X3ReNUf17y+bO6fR8WgbIZTlbyG1ak/53cbRzKQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "execa": "^4.0.0",
-        "throat": "^5.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-cli": {
-      "version": "26.6.3",
-      "integrity": "sha512-GF9noBSa9t08pSyl3CY4frMrqp+aQXFGFkf5hEPbh/pIUFYWMK6ZLTfbmadxJVcJrdRoChlWQsA2VkJcDFK8hg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/core": "^26.6.3",
-        "@jest/test-result": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "chalk": "^4.0.0",
-        "exit": "^0.1.2",
-        "graceful-fs": "^4.2.4",
-        "import-local": "^3.0.2",
-        "is-ci": "^2.0.0",
-        "jest-config": "^26.6.3",
-        "jest-util": "^26.6.2",
-        "jest-validate": "^26.6.2",
-        "prompts": "^2.0.1",
-        "yargs": "^15.4.1"
-      },
-      "bin": {
-        "jest": "bin/jest.js"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-config": {
-      "version": "26.6.3",
-      "integrity": "sha512-t5qdIj/bCj2j7NFVHb2nFB4aUdfucDn3JRKgrZnplb8nieAirAzRSHP8uDEd+qV6ygzg9Pz4YG7UTJf94LPSyg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/core": "^7.1.0",
-        "@jest/test-sequencer": "^26.6.3",
-        "@jest/types": "^26.6.2",
-        "babel-jest": "^26.6.3",
-        "chalk": "^4.0.0",
-        "deepmerge": "^4.2.2",
-        "glob": "^7.1.1",
-        "graceful-fs": "^4.2.4",
-        "jest-environment-jsdom": "^26.6.2",
-        "jest-environment-node": "^26.6.2",
-        "jest-get-type": "^26.3.0",
-        "jest-jasmine2": "^26.6.3",
-        "jest-regex-util": "^26.0.0",
-        "jest-resolve": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jest-validate": "^26.6.2",
-        "micromatch": "^4.0.2",
-        "pretty-format": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      },
-      "peerDependencies": {
-        "ts-node": ">=9.0.0"
-      },
-      "peerDependenciesMeta": {
-        "ts-node": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/jest-config/node_modules/deepmerge": {
-      "version": "4.2.2",
-      "integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/jest-diff": {
-      "version": "26.6.2",
-      "integrity": "sha512-6m+9Z3Gv9wN0WFVasqjCL/06+EFCMTqDEUl/b87HYK2rAPTyfz4ZIuSlPhY51PIQRWx5TaxeF1qmXKe9gfN3sA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "chalk": "^4.0.0",
-        "diff-sequences": "^26.6.2",
-        "jest-get-type": "^26.3.0",
-        "pretty-format": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-docblock": {
-      "version": "26.0.0",
-      "integrity": "sha512-RDZ4Iz3QbtRWycd8bUEPxQsTlYazfYn/h5R65Fc6gOfwozFhoImx+affzky/FFBuqISPTqjXomoIGJVKBWoo0w==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "detect-newline": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-each": {
-      "version": "26.6.2",
-      "integrity": "sha512-Mer/f0KaATbjl8MCJ+0GEpNdqmnVmDYqCTJYTvoo7rqmRiDllmp2AYN+06F93nXcY3ur9ShIjS+CO/uD+BbH4A==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "chalk": "^4.0.0",
-        "jest-get-type": "^26.3.0",
-        "jest-util": "^26.6.2",
-        "pretty-format": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-environment-jsdom": {
-      "version": "26.6.2",
-      "integrity": "sha512-jgPqCruTlt3Kwqg5/WVFyHIOJHsiAvhcp2qiR2QQstuG9yWox5+iHpU3ZrcBxW14T4fe5Z68jAfLRh7joCSP2Q==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/environment": "^26.6.2",
-        "@jest/fake-timers": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "jest-mock": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jsdom": "^16.4.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-environment-node": {
-      "version": "26.6.2",
-      "integrity": "sha512-zhtMio3Exty18dy8ee8eJ9kjnRyZC1N4C1Nt/VShN1apyXc8rWGtJ9lI7vqiWcyyXS4BVSEn9lxAM2D+07/Tag==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/environment": "^26.6.2",
-        "@jest/fake-timers": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "jest-mock": "^26.6.2",
-        "jest-util": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-get-type": {
-      "version": "26.3.0",
-      "integrity": "sha512-TpfaviN1R2pQWkIihlfEanwOXK0zcxrKEE4MlU6Tn7keoXdN6/3gK/xl0yEh8DOunn5pOVGKf8hB4R9gVh04ig==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-haste-map": {
-      "version": "26.6.2",
-      "integrity": "sha512-easWIJXIw71B2RdR8kgqpjQrbMRWQBgiBwXYEhtGUTaX+doCjBheluShdDMeR8IMfJiTqH4+zfhtg29apJf/8w==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "@types/graceful-fs": "^4.1.2",
-        "@types/node": "*",
-        "anymatch": "^3.0.3",
-        "fb-watchman": "^2.0.0",
-        "graceful-fs": "^4.2.4",
-        "jest-regex-util": "^26.0.0",
-        "jest-serializer": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jest-worker": "^26.6.2",
-        "micromatch": "^4.0.2",
-        "sane": "^4.0.3",
-        "walker": "^1.0.7"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      },
-      "optionalDependencies": {
-        "fsevents": "^2.1.2"
-      }
-    },
-    "node_modules/jest-jasmine2": {
-      "version": "26.6.3",
-      "integrity": "sha512-kPKUrQtc8aYwBV7CqBg5pu+tmYXlvFlSFYn18ev4gPFtrRzB15N2gW/Roew3187q2w2eHuu0MU9TJz6w0/nPEg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/traverse": "^7.1.0",
-        "@jest/environment": "^26.6.2",
-        "@jest/source-map": "^26.6.2",
-        "@jest/test-result": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "chalk": "^4.0.0",
-        "co": "^4.6.0",
-        "expect": "^26.6.2",
-        "is-generator-fn": "^2.0.0",
-        "jest-each": "^26.6.2",
-        "jest-matcher-utils": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-runtime": "^26.6.3",
-        "jest-snapshot": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "pretty-format": "^26.6.2",
-        "throat": "^5.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-leak-detector": {
-      "version": "26.6.2",
-      "integrity": "sha512-i4xlXpsVSMeKvg2cEKdfhh0H39qlJlP5Ex1yQxwF9ubahboQYMgTtz5oML35AVA3B4Eu+YsmwaiKVev9KCvLxg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "jest-get-type": "^26.3.0",
-        "pretty-format": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-matcher-utils": {
-      "version": "26.6.2",
-      "integrity": "sha512-llnc8vQgYcNqDrqRDXWwMr9i7rS5XFiCwvh6DTP7Jqa2mqpcCBBlpCbn+trkG0KNhPu/h8rzyBkriOtBstvWhw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "chalk": "^4.0.0",
-        "jest-diff": "^26.6.2",
-        "jest-get-type": "^26.3.0",
-        "pretty-format": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-message-util": {
-      "version": "26.6.2",
-      "integrity": "sha512-rGiLePzQ3AzwUshu2+Rn+UMFk0pHN58sOG+IaJbk5Jxuqo3NYO1U2/MIR4S1sKgsoYSXSzdtSa0TgrmtUwEbmA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.0.0",
-        "@jest/types": "^26.6.2",
-        "@types/stack-utils": "^2.0.0",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "micromatch": "^4.0.2",
-        "pretty-format": "^26.6.2",
-        "slash": "^3.0.0",
-        "stack-utils": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-mock": {
-      "version": "26.6.2",
-      "integrity": "sha512-YyFjePHHp1LzpzYcmgqkJ0nm0gg/lJx2aZFzFy1S6eUqNjXsOqTK10zNRff2dNfssgokjkG65OlWNcIlgd3zew==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "@types/node": "*"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-pnp-resolver": {
-      "version": "1.2.2",
-      "integrity": "sha512-olV41bKSMm8BdnuMsewT4jqlZ8+3TCARAXjZGT9jcoSnrfUnRCqnMoF9XEeoWjbzObpqF9dRhHQj0Xb9QdF6/w==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=6"
-      },
-      "peerDependencies": {
-        "jest-resolve": "*"
-      },
-      "peerDependenciesMeta": {
-        "jest-resolve": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/jest-regex-util": {
-      "version": "26.0.0",
-      "integrity": "sha512-Gv3ZIs/nA48/Zvjrl34bf+oD76JHiGDUxNOVgUjh3j890sblXryjY4rss71fPtD/njchl6PSE2hIhvyWa1eT0A==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-resolve": {
-      "version": "26.6.2",
-      "integrity": "sha512-sOxsZOq25mT1wRsfHcbtkInS+Ek7Q8jCHUB0ZUTP0tc/c41QHriU/NunqMfCUWsL4H3MHpvQD4QR9kSYhS7UvQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "jest-pnp-resolver": "^1.2.2",
-        "jest-util": "^26.6.2",
-        "read-pkg-up": "^7.0.1",
-        "resolve": "^1.18.1",
-        "slash": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-resolve-dependencies": {
-      "version": "26.6.3",
-      "integrity": "sha512-pVwUjJkxbhe4RY8QEWzN3vns2kqyuldKpxlxJlzEYfKSvY6/bMvxoFrYYzUO1Gx28yKWN37qyV7rIoIp2h8fTg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "jest-regex-util": "^26.0.0",
-        "jest-snapshot": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-resolve/node_modules/find-up": {
-      "version": "4.1.0",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "locate-path": "^5.0.0",
-        "path-exists": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/jest-resolve/node_modules/locate-path": {
-      "version": "5.0.0",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-locate": "^4.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/jest-resolve/node_modules/p-limit": {
-      "version": "2.3.0",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-try": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/jest-resolve/node_modules/p-locate": {
-      "version": "4.1.0",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-limit": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/jest-resolve/node_modules/path-exists": {
-      "version": "4.0.0",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/jest-resolve/node_modules/read-pkg": {
-      "version": "5.2.0",
-      "integrity": "sha512-Ug69mNOpfvKDAc2Q8DRpMjjzdtrnv9HcSMX+4VsZxD1aZ6ZzrIE7rlzXBtWTyhULSMKg076AW6WR5iZpD0JiOg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@types/normalize-package-data": "^2.4.0",
-        "normalize-package-data": "^2.5.0",
-        "parse-json": "^5.0.0",
-        "type-fest": "^0.6.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/jest-resolve/node_modules/read-pkg-up": {
-      "version": "7.0.1",
-      "integrity": "sha512-zK0TB7Xd6JpCLmlLmufqykGE+/TlOePD6qKClNW7hHDKFh/J7/7gCWGR7joEQEW1bKq3a3yUZSObOoWLFQ4ohg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "find-up": "^4.1.0",
-        "read-pkg": "^5.2.0",
-        "type-fest": "^0.8.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/jest-resolve/node_modules/read-pkg/node_modules/type-fest": {
-      "version": "0.6.0",
-      "integrity": "sha512-q+MB8nYR1KDLrgr4G5yemftpMC7/QLqVndBmEEdqzmNj5dcFOO4Oo8qlwZE3ULT3+Zim1F8Kq4cBnikNhlCMlg==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/jest-resolve/node_modules/type-fest": {
-      "version": "0.8.1",
-      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/jest-runner": {
-      "version": "26.6.3",
-      "integrity": "sha512-atgKpRHnaA2OvByG/HpGA4g6CSPS/1LK0jK3gATJAoptC1ojltpmVlYC3TYgdmGp+GLuhzpH30Gvs36szSL2JQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/console": "^26.6.2",
-        "@jest/environment": "^26.6.2",
-        "@jest/test-result": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "chalk": "^4.0.0",
-        "emittery": "^0.7.1",
-        "exit": "^0.1.2",
-        "graceful-fs": "^4.2.4",
-        "jest-config": "^26.6.3",
-        "jest-docblock": "^26.0.0",
-        "jest-haste-map": "^26.6.2",
-        "jest-leak-detector": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-resolve": "^26.6.2",
-        "jest-runtime": "^26.6.3",
-        "jest-util": "^26.6.2",
-        "jest-worker": "^26.6.2",
-        "source-map-support": "^0.5.6",
-        "throat": "^5.0.0"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-runtime": {
-      "version": "26.6.3",
-      "integrity": "sha512-lrzyR3N8sacTAMeonbqpnSka1dHNux2uk0qqDXVkMv2c/A3wYnvQ4EXuI013Y6+gSKSCxdaczvf4HF0mVXHRdw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/console": "^26.6.2",
-        "@jest/environment": "^26.6.2",
-        "@jest/fake-timers": "^26.6.2",
-        "@jest/globals": "^26.6.2",
-        "@jest/source-map": "^26.6.2",
-        "@jest/test-result": "^26.6.2",
-        "@jest/transform": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/yargs": "^15.0.0",
-        "chalk": "^4.0.0",
-        "cjs-module-lexer": "^0.6.0",
-        "collect-v8-coverage": "^1.0.0",
-        "exit": "^0.1.2",
-        "glob": "^7.1.3",
-        "graceful-fs": "^4.2.4",
-        "jest-config": "^26.6.3",
-        "jest-haste-map": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-mock": "^26.6.2",
-        "jest-regex-util": "^26.0.0",
-        "jest-resolve": "^26.6.2",
-        "jest-snapshot": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jest-validate": "^26.6.2",
-        "slash": "^3.0.0",
-        "strip-bom": "^4.0.0",
-        "yargs": "^15.4.1"
-      },
-      "bin": {
-        "jest-runtime": "bin/jest-runtime.js"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-serializer": {
-      "version": "26.6.2",
-      "integrity": "sha512-S5wqyz0DXnNJPd/xfIzZ5Xnp1HrJWBczg8mMfMpN78OJ5eDxXyf+Ygld9wX1DnUWbIbhM1YDY95NjR4CBXkb2g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@types/node": "*",
-        "graceful-fs": "^4.2.4"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-snapshot": {
-      "version": "26.6.2",
-      "integrity": "sha512-OLhxz05EzUtsAmOMzuupt1lHYXCNib0ECyuZ/PZOx9TrZcC8vL0x+DUG3TL+GLX3yHG45e6YGjIm0XwDc3q3og==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/types": "^7.0.0",
-        "@jest/types": "^26.6.2",
-        "@types/babel__traverse": "^7.0.4",
-        "@types/prettier": "^2.0.0",
-        "chalk": "^4.0.0",
-        "expect": "^26.6.2",
-        "graceful-fs": "^4.2.4",
-        "jest-diff": "^26.6.2",
-        "jest-get-type": "^26.3.0",
-        "jest-haste-map": "^26.6.2",
-        "jest-matcher-utils": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-resolve": "^26.6.2",
-        "natural-compare": "^1.4.0",
-        "pretty-format": "^26.6.2",
-        "semver": "^7.3.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-util": {
-      "version": "26.6.2",
-      "integrity": "sha512-MDW0fKfsn0OI7MS7Euz6h8HNDXVQ0gaM9uW6RjfDmd1DAFcaxX9OqIakHIqhbnmF08Cf2DLDG+ulq8YQQ0Lp0Q==",
-      "dev": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "is-ci": "^2.0.0",
-        "micromatch": "^4.0.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-validate": {
-      "version": "26.6.2",
-      "integrity": "sha512-NEYZ9Aeyj0i5rQqbq+tpIOom0YS1u2MVu6+euBsvpgIme+FOfRmoC4R5p0JiAUpaFvFy24xgrpMknarR/93XjQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "camelcase": "^6.0.0",
-        "chalk": "^4.0.0",
-        "jest-get-type": "^26.3.0",
-        "leven": "^3.1.0",
-        "pretty-format": "^26.6.2"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-validate/node_modules/camelcase": {
-      "version": "6.2.0",
-      "integrity": "sha512-c7wVvbw3f37nuobQNtgsgG9POC9qMbNuMQmTCqZv23b6MIz0fcYpBiOlv9gEN/hdLdnZTDQhg6e9Dq5M1vKvfg==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/jest-watcher": {
-      "version": "26.6.2",
-      "integrity": "sha512-WKJob0P/Em2csiVthsI68p6aGKTIcsfjH9Gsx1f0A3Italz43e3ho0geSAVsmj09RWOELP1AZ/DXyJgOgDKxXQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/test-result": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "ansi-escapes": "^4.2.1",
-        "chalk": "^4.0.0",
-        "jest-util": "^26.6.2",
-        "string-length": "^4.0.1"
-      },
-      "engines": {
-        "node": ">= 10.14.2"
-      }
-    },
-    "node_modules/jest-worker": {
-      "version": "26.6.2",
-      "integrity": "sha512-KWYVV1c4i+jbMpaBC+U++4Va0cp8OisU185o73T1vo99hqi7w8tSJfUXYswwqqrjzwxa6KpRK54WhPvwf5w6PQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@types/node": "*",
-        "merge-stream": "^2.0.0",
-        "supports-color": "^7.0.0"
-      },
-      "engines": {
-        "node": ">= 10.13.0"
-      }
-    },
-    "node_modules/js-sdsl": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-sdsl/-/js-sdsl-4.2.0.tgz",
-      "integrity": "sha512-dyBIzQBDkCqCu+0upx25Y2jGdbTGxE9fshMsCdK0ViOongpV+n5tXRcZY9v7CaVQ79AGS9KA1KHtojxiM7aXSQ==",
-      "dev": true,
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/js-sdsl"
-      }
-    },
-    "node_modules/js-tokens": {
-      "version": "4.0.0",
-      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
-      "dev": true
-    },
-    "node_modules/js-yaml": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
-      "dev": true,
-      "dependencies": {
-        "argparse": "^2.0.1"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
-    "node_modules/jsdom": {
-      "version": "16.7.0",
-      "integrity": "sha512-u9Smc2G1USStM+s/x1ru5Sxrl6mPYCbByG1U/hUmqaVsm4tbNyS7CicOSRyuGQYZhTu0h84qkZZQ/I+dzizSVw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "abab": "^2.0.5",
-        "acorn": "^8.2.4",
-        "acorn-globals": "^6.0.0",
-        "cssom": "^0.4.4",
-        "cssstyle": "^2.3.0",
-        "data-urls": "^2.0.0",
-        "decimal.js": "^10.2.1",
-        "domexception": "^2.0.1",
-        "escodegen": "^2.0.0",
-        "form-data": "^3.0.0",
-        "html-encoding-sniffer": "^2.0.1",
-        "http-proxy-agent": "^4.0.1",
-        "https-proxy-agent": "^5.0.0",
-        "is-potential-custom-element-name": "^1.0.1",
-        "nwsapi": "^2.2.0",
-        "parse5": "6.0.1",
-        "saxes": "^5.0.1",
-        "symbol-tree": "^3.2.4",
-        "tough-cookie": "^4.0.0",
-        "w3c-hr-time": "^1.0.2",
-        "w3c-xmlserializer": "^2.0.0",
-        "webidl-conversions": "^6.1.0",
-        "whatwg-encoding": "^1.0.5",
-        "whatwg-mimetype": "^2.3.0",
-        "whatwg-url": "^8.5.0",
-        "ws": "^7.4.6",
-        "xml-name-validator": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "peerDependencies": {
-        "canvas": "^2.5.0"
-      },
-      "peerDependenciesMeta": {
-        "canvas": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/jsdom/node_modules/acorn": {
-      "version": "8.5.0",
-      "integrity": "sha512-yXbYeFy+jUuYd3/CDcg2NkIYE991XYX/bje7LmjJigUciaeO1JR4XxXgCIV1/Zc/dRuFEyw1L0pbA+qynJkW5Q==",
-      "dev": true,
-      "peer": true,
-      "bin": {
-        "acorn": "bin/acorn"
-      },
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/jsesc": {
-      "version": "2.5.2",
-      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
-      "dev": true,
-      "bin": {
-        "jsesc": "bin/jsesc"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/json-parse-better-errors": {
-      "version": "1.0.2",
-      "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==",
-      "dev": true
-    },
-    "node_modules/json-parse-even-better-errors": {
-      "version": "2.3.1",
-      "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
-      "dev": true
-    },
-    "node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
-      "dev": true
-    },
-    "node_modules/json-stable-stringify-without-jsonify": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
-      "dev": true
-    },
-    "node_modules/json5": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
-      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
-      "dev": true,
-      "bin": {
-        "json5": "lib/cli.js"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/jsonfile": {
-      "version": "6.1.0",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
-      "dev": true,
-      "dependencies": {
-        "universalify": "^2.0.0"
-      },
-      "optionalDependencies": {
-        "graceful-fs": "^4.1.6"
-      }
-    },
-    "node_modules/jsonfile/node_modules/universalify": {
-      "version": "2.0.0",
-      "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==",
-      "dev": true,
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
-    "node_modules/jsx-ast-utils": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/jsx-ast-utils/-/jsx-ast-utils-3.3.3.tgz",
-      "integrity": "sha512-fYQHZTZ8jSfmWZ0iyzfwiU4WDX4HpHbMCZ3gPlWYiCl3BoeOTsqKBqnTVfH2rYT7eP5c3sVbeSPHnnJOaTrWiw==",
-      "dev": true,
-      "dependencies": {
-        "array-includes": "^3.1.5",
-        "object.assign": "^4.1.3"
-      },
-      "engines": {
-        "node": ">=4.0"
-      }
-    },
-    "node_modules/kind-of": {
-      "version": "6.0.3",
-      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/kleur": {
-      "version": "3.0.3",
-      "integrity": "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/known-css-properties": {
-      "version": "0.20.0",
-      "integrity": "sha512-URvsjaA9ypfreqJ2/ylDr5MUERhJZ+DhguoWRr2xgS5C7aGCalXo+ewL+GixgKBfhT2vuL02nbIgNGqVWgTOYw==",
-      "dev": true
-    },
-    "node_modules/language-subtag-registry": {
-      "version": "0.3.22",
-      "resolved": "https://registry.npmjs.org/language-subtag-registry/-/language-subtag-registry-0.3.22.tgz",
-      "integrity": "sha512-tN0MCzyWnoz/4nHS6uxdlFWoUZT7ABptwKPQ52Ea7URk6vll88bWBVhodtnlfEuCcKWNGoc+uGbw1cwa9IKh/w==",
-      "dev": true
-    },
-    "node_modules/language-tags": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/language-tags/-/language-tags-1.0.5.tgz",
-      "integrity": "sha512-qJhlO9cGXi6hBGKoxEG/sKZDAHD5Hnu9Hs4WbOY3pCWXDhw0N8x1NenNzm2EnNLkLkk7J2SdxAkDSbb6ftT+UQ==",
-      "dev": true,
-      "dependencies": {
-        "language-subtag-registry": "~0.3.2"
-      }
-    },
-    "node_modules/leven": {
-      "version": "3.1.0",
-      "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/levn": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
-      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
-      "dev": true,
-      "dependencies": {
-        "prelude-ls": "^1.2.1",
-        "type-check": "~0.4.0"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/lines-and-columns": {
-      "version": "1.1.6",
-      "integrity": "sha1-HADHQ7QzzQpOgHWPe2SldEDZ/wA=",
-      "dev": true
-    },
-    "node_modules/lint-staged": {
-      "version": "11.1.2",
-      "integrity": "sha512-6lYpNoA9wGqkL6Hew/4n1H6lRqF3qCsujVT0Oq5Z4hiSAM7S6NksPJ3gnr7A7R52xCtiZMcEUNNQ6d6X5Bvh9w==",
-      "dev": true,
-      "dependencies": {
-        "chalk": "^4.1.1",
-        "cli-truncate": "^2.1.0",
-        "commander": "^7.2.0",
-        "cosmiconfig": "^7.0.0",
-        "debug": "^4.3.1",
-        "enquirer": "^2.3.6",
-        "execa": "^5.0.0",
-        "listr2": "^3.8.2",
-        "log-symbols": "^4.1.0",
-        "micromatch": "^4.0.4",
-        "normalize-path": "^3.0.0",
-        "please-upgrade-node": "^3.2.0",
-        "string-argv": "0.3.1",
-        "stringify-object": "^3.3.0"
-      },
-      "bin": {
-        "lint-staged": "bin/lint-staged.js"
-      },
-      "funding": {
-        "url": "https://opencollective.com/lint-staged"
-      }
-    },
-    "node_modules/lint-staged/node_modules/chalk": {
-      "version": "4.1.2",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/lint-staged/node_modules/execa": {
-      "version": "5.1.1",
-      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
-      "dev": true,
-      "dependencies": {
-        "cross-spawn": "^7.0.3",
-        "get-stream": "^6.0.0",
-        "human-signals": "^2.1.0",
-        "is-stream": "^2.0.0",
-        "merge-stream": "^2.0.0",
-        "npm-run-path": "^4.0.1",
-        "onetime": "^5.1.2",
-        "signal-exit": "^3.0.3",
-        "strip-final-newline": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sindresorhus/execa?sponsor=1"
-      }
-    },
-    "node_modules/lint-staged/node_modules/get-stream": {
-      "version": "6.0.1",
-      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/lint-staged/node_modules/human-signals": {
-      "version": "2.1.0",
-      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
-      "dev": true,
-      "engines": {
-        "node": ">=10.17.0"
-      }
-    },
-    "node_modules/listr2": {
-      "version": "3.12.2",
-      "integrity": "sha512-64xC2CJ/As/xgVI3wbhlPWVPx0wfTqbUAkpb7bjDi0thSWMqrf07UFhrfsGoo8YSXmF049Rp9C0cjLC8rZxK9A==",
-      "dev": true,
-      "dependencies": {
-        "cli-truncate": "^2.1.0",
-        "colorette": "^1.4.0",
-        "log-update": "^4.0.0",
-        "p-map": "^4.0.0",
-        "rxjs": "^6.6.7",
-        "through": "^2.3.8",
-        "wrap-ansi": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "peerDependencies": {
-        "enquirer": ">= 2.3.0 < 3"
-      }
-    },
-    "node_modules/load-json-file": {
-      "version": "4.0.0",
-      "integrity": "sha1-L19Fq5HjMhYjT9U62rZo607AmTs=",
-      "dev": true,
-      "dependencies": {
-        "graceful-fs": "^4.1.2",
-        "parse-json": "^4.0.0",
-        "pify": "^3.0.0",
-        "strip-bom": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/load-json-file/node_modules/parse-json": {
-      "version": "4.0.0",
-      "integrity": "sha1-vjX1Qlvh9/bHRxhPmKeIy5lHfuA=",
-      "dev": true,
-      "dependencies": {
-        "error-ex": "^1.3.1",
-        "json-parse-better-errors": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/load-json-file/node_modules/pify": {
-      "version": "3.0.0",
-      "integrity": "sha1-5aSs0sEB/fPZpNB/DbxNtJ3SgXY=",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/load-json-file/node_modules/strip-bom": {
-      "version": "3.0.0",
-      "integrity": "sha1-IzTBjpx1n3vdVv3vfprj1YjmjtM=",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/locate-path": {
-      "version": "2.0.0",
-      "integrity": "sha1-K1aLJl7slExtnA3pw9u7ygNUzY4=",
-      "dev": true,
-      "dependencies": {
-        "p-locate": "^2.0.0",
-        "path-exists": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/lodash": {
-      "version": "4.17.21",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "dev": true
-    },
-    "node_modules/lodash.clonedeep": {
-      "version": "4.5.0",
-      "integrity": "sha1-4j8/nE+Pvd6HJSnBBxhXoIblzO8=",
-      "dev": true
-    },
-    "node_modules/lodash.merge": {
-      "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
-      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
-      "dev": true
-    },
-    "node_modules/lodash.truncate": {
-      "version": "4.4.2",
-      "integrity": "sha1-WjUNoLERO4N+z//VgSy+WNbq4ZM=",
-      "dev": true
-    },
-    "node_modules/log-symbols": {
-      "version": "4.1.0",
-      "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==",
-      "dev": true,
-      "dependencies": {
-        "chalk": "^4.1.0",
-        "is-unicode-supported": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/log-update": {
-      "version": "4.0.0",
-      "integrity": "sha512-9fkkDevMefjg0mmzWFBW8YkFP91OrizzkW3diF7CpG+S2EYdy4+TVfGwz1zeF8x7hCx1ovSPTOE9Ngib74qqUg==",
-      "dev": true,
-      "dependencies": {
-        "ansi-escapes": "^4.3.0",
-        "cli-cursor": "^3.1.0",
-        "slice-ansi": "^4.0.0",
-        "wrap-ansi": "^6.2.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/log-update/node_modules/slice-ansi": {
-      "version": "4.0.0",
-      "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "astral-regex": "^2.0.0",
-        "is-fullwidth-code-point": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/slice-ansi?sponsor=1"
-      }
-    },
-    "node_modules/log-update/node_modules/wrap-ansi": {
-      "version": "6.2.0",
-      "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/longest-streak": {
-      "version": "2.0.4",
-      "integrity": "sha512-vM6rUVCVUJJt33bnmHiZEvr7wPT78ztX7rojL+LW51bHtLh6HTjx84LA5W4+oa6aKEJA7jJu5LR6vQRBpA5DVg==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/loose-envify": {
-      "version": "1.4.0",
-      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
-      "dev": true,
-      "dependencies": {
-        "js-tokens": "^3.0.0 || ^4.0.0"
-      },
-      "bin": {
-        "loose-envify": "cli.js"
-      }
-    },
-    "node_modules/lru-cache": {
-      "version": "6.0.0",
-      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
-      "dev": true,
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/make-error": {
-      "version": "1.3.6",
-      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
-      "dev": true
-    },
-    "node_modules/makeerror": {
-      "version": "1.0.11",
-      "integrity": "sha1-4BpckQnyr3lmDk6LlYd5AYT1qWw=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "tmpl": "1.0.x"
-      }
-    },
-    "node_modules/map-cache": {
-      "version": "0.2.2",
-      "integrity": "sha1-wyq9C9ZSXZsFFkW7TyasXcmKDb8=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/map-obj": {
-      "version": "1.0.1",
-      "integrity": "sha1-2TPOuSBdgr3PSIb2dCvcK03qFG0=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/map-visit": {
-      "version": "1.0.0",
-      "integrity": "sha1-7Nyo8TFE5mDxtb1B8S80edmN+48=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "object-visit": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/markdown-escapes": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/markdown-escapes/-/markdown-escapes-1.0.4.tgz",
-      "integrity": "sha512-8z4efJYk43E0upd0NbVXwgSTQs6cT3T06etieCMEg7dRbzCbxUCK/GHlX8mhHRDcp+OLlHkPKsvqQTCvsRl2cg==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/markdown-table": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/markdown-table/-/markdown-table-2.0.0.tgz",
-      "integrity": "sha512-Ezda85ToJUBhM6WGaG6veasyym+Tbs3cMAw/ZhOPqXiYsr0jgocBV3j3nx+4lk47plLlIqjwuTm/ywVI+zjJ/A==",
-      "dev": true,
-      "dependencies": {
-        "repeat-string": "^1.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/mathml-tag-names": {
-      "version": "2.1.3",
-      "integrity": "sha512-APMBEanjybaPzUrfqU0IMU5I0AswKMH7k8OTLs0vvV4KZpExkTkY87nR/zpbuTPj+gARop7aGUbl11pnDfW6xg==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/mdast-util-compact": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/mdast-util-compact/-/mdast-util-compact-2.0.1.tgz",
-      "integrity": "sha512-7GlnT24gEwDrdAwEHrU4Vv5lLWrEer4KOkAiKT9nYstsTad7Oc1TwqT2zIMKRdZF7cTuaf+GA1E4Kv7jJh8mPA==",
-      "dev": true,
-      "dependencies": {
-        "unist-util-visit": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/mdast-util-compact/node_modules/unist-util-visit": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-2.0.3.tgz",
-      "integrity": "sha512-iJ4/RczbJMkD0712mGktuGpm/U4By4FfDonL7N/9tATGIF4imikjOuagyMY53tnZq3NP6BcmlrHhEKAfGWjh7Q==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-is": "^4.0.0",
-        "unist-util-visit-parents": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/mdast-util-compact/node_modules/unist-util-visit-parents": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-3.1.1.tgz",
-      "integrity": "sha512-1KROIZWo6bcMrZEwiH2UrXDyalAa0uqzWCxCJj6lPOvTve2WkfgCytoDTPaMnodXh1WrXOq0haVYHj99ynJlsg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-is": "^4.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/mdast-util-from-markdown": {
-      "version": "0.8.5",
-      "integrity": "sha512-2hkTXtYYnr+NubD/g6KGBS/0mFmBcifAsI0yIWRiRo0PjVs6SSOSOdtzbp6kSGnShDN6G5aWZpKQ2lWRy27mWQ==",
-      "dev": true,
-      "dependencies": {
-        "@types/mdast": "^3.0.0",
-        "mdast-util-to-string": "^2.0.0",
-        "micromark": "~2.11.0",
-        "parse-entities": "^2.0.0",
-        "unist-util-stringify-position": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/mdast-util-to-markdown": {
-      "version": "0.6.5",
-      "integrity": "sha512-XeV9sDE7ZlOQvs45C9UKMtfTcctcaj/pGwH8YLbMHoMOXNNCn2LsqVQOqrF1+/NU8lKDAqozme9SCXWyo9oAcQ==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "longest-streak": "^2.0.0",
-        "mdast-util-to-string": "^2.0.0",
-        "parse-entities": "^2.0.0",
-        "repeat-string": "^1.0.0",
-        "zwitch": "^1.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/mdast-util-to-string": {
-      "version": "2.0.0",
-      "integrity": "sha512-AW4DRS3QbBayY/jJmD8437V1Gombjf8RSOUCMFBuo5iHi58AGEgVCKQ+ezHkZZDpAQS75hcBMpLqjpJTjtUL7w==",
-      "dev": true,
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/merge-stream": {
-      "version": "2.0.0",
-      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
-      "dev": true
-    },
-    "node_modules/merge2": {
-      "version": "1.4.1",
-      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
-      "dev": true,
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/micromark": {
-      "version": "2.11.4",
-      "integrity": "sha512-+WoovN/ppKolQOFIAajxi7Lu9kInbPxFuTBVEavFcL8eAfVstoc5MocPmqBeAdBOJV00uaVjegzH4+MA0DN/uA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "GitHub Sponsors",
-          "url": "https://github.com/sponsors/unifiedjs"
-        },
-        {
-          "type": "OpenCollective",
-          "url": "https://opencollective.com/unified"
-        }
-      ],
-      "dependencies": {
-        "debug": "^4.0.0",
-        "parse-entities": "^2.0.0"
-      }
-    },
-    "node_modules/micromatch": {
-      "version": "4.0.4",
-      "integrity": "sha512-pRmzw/XUcwXGpD9aI9q/0XOwLNygjETJ8y0ao0wdqprrzDa4YnxLcz7fQRZr8voh8V10kGhABbNcHVk5wHgWwg==",
-      "dev": true,
-      "dependencies": {
-        "braces": "^3.0.1",
-        "picomatch": "^2.2.3"
-      },
-      "engines": {
-        "node": ">=8.6"
-      }
-    },
-    "node_modules/mime-db": {
-      "version": "1.50.0",
-      "integrity": "sha512-9tMZCDlYHqeERXEHO9f/hKfNXhre5dK2eE/krIvUjZbS2KPcqGDfNShIWS1uW9XOTKQKqK6qbeOci18rbfW77A==",
-      "dev": true,
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/mime-types": {
-      "version": "2.1.33",
-      "integrity": "sha512-plLElXp7pRDd0bNZHw+nMd52vRYjLwQjygaNg7ddJ2uJtTlmnTCjWuPKxVu6//AdaRuME84SvLW91sIkBqGT0g==",
-      "dev": true,
-      "dependencies": {
-        "mime-db": "1.50.0"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/mimic-fn": {
-      "version": "2.1.0",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/min-indent": {
-      "version": "1.0.1",
-      "integrity": "sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "dev": true,
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/minimist": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.7.tgz",
-      "integrity": "sha512-bzfL1YUZsP41gmu/qjrEk0Q6i2ix/cVeAhbCbqH9u3zYutS1cLg00qhrD0M2MVdCcx4Sc0UpP2eBWo9rotpq6g==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/minimist-options": {
-      "version": "4.1.0",
-      "integrity": "sha512-Q4r8ghd80yhO/0j1O3B2BjweX3fiHg9cdOwjJd2J76Q135c+NDxGCqdYKQ1SKBuFfgWbAUzBfvYjPUEeNgqN1A==",
-      "dev": true,
-      "dependencies": {
-        "arrify": "^1.0.1",
-        "is-plain-obj": "^1.1.0",
-        "kind-of": "^6.0.3"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/mixin-deep": {
-      "version": "1.3.2",
-      "integrity": "sha512-WRoDn//mXBiJ1H40rqa3vH0toePwSsGb45iInWlTySa+Uu4k3tYUSxa2v1KqAiLtvlrSzaExqS1gtk96A9zvEA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "for-in": "^1.0.2",
-        "is-extendable": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/mixin-deep/node_modules/is-extendable": {
-      "version": "1.0.1",
-      "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-plain-object": "^2.0.4"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/ms": {
-      "version": "2.1.2",
-      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
-      "dev": true
-    },
-    "node_modules/mute-stream": {
-      "version": "0.0.8",
-      "integrity": "sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==",
-      "dev": true
-    },
-    "node_modules/nanoid": {
-      "version": "3.3.7",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.7.tgz",
-      "integrity": "sha512-eSRppjcPIatRIMC1U6UngP8XFcz8MQWGQdt1MTBQ7NaAmvXDfvNxbvWV3x2y6CdEUciCSsDHDQZbhYaB8QEo2g==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "bin": {
-        "nanoid": "bin/nanoid.cjs"
-      },
-      "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
-      }
-    },
-    "node_modules/nanomatch": {
-      "version": "1.2.13",
-      "integrity": "sha512-fpoe2T0RbHwBTBUOftAfBPaDEi06ufaUai0mE6Yn1kacc3SnTErfb/h+X94VXzI64rKFHYImXSvdwGGCmwOqCA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "arr-diff": "^4.0.0",
-        "array-unique": "^0.3.2",
-        "define-property": "^2.0.2",
-        "extend-shallow": "^3.0.2",
-        "fragment-cache": "^0.2.1",
-        "is-windows": "^1.0.2",
-        "kind-of": "^6.0.2",
-        "object.pick": "^1.3.0",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/nanomatch/node_modules/extend-shallow": {
-      "version": "3.0.2",
-      "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "assign-symbols": "^1.0.0",
-        "is-extendable": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/nanomatch/node_modules/is-extendable": {
-      "version": "1.0.1",
-      "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-plain-object": "^2.0.4"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/natural-compare": {
-      "version": "1.4.0",
-      "integrity": "sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=",
-      "dev": true
-    },
-    "node_modules/natural-compare-lite": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare-lite/-/natural-compare-lite-1.4.0.tgz",
-      "integrity": "sha512-Tj+HTDSJJKaZnfiuw+iaF9skdPpTo2GtEly5JHnWV/hfv2Qj/9RKsGISQtLh2ox3l5EAGw487hnBee0sIJ6v2g==",
-      "dev": true
-    },
-    "node_modules/next": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/next/-/next-14.0.4.tgz",
-      "integrity": "sha512-qbwypnM7327SadwFtxXnQdGiKpkuhaRLE2uq62/nRul9cj9KhQ5LhHmlziTNqUidZotw/Q1I9OjirBROdUJNgA==",
-      "dev": true,
-      "dependencies": {
-        "@next/env": "14.0.4",
-        "@swc/helpers": "0.5.2",
-        "busboy": "1.6.0",
-        "caniuse-lite": "^1.0.30001406",
-        "graceful-fs": "^4.2.11",
-        "postcss": "8.4.31",
-        "styled-jsx": "5.1.1",
-        "watchpack": "2.4.0"
-      },
-      "bin": {
-        "next": "dist/bin/next"
-      },
-      "engines": {
-        "node": ">=18.17.0"
-      },
-      "optionalDependencies": {
-        "@next/swc-darwin-arm64": "14.0.4",
-        "@next/swc-darwin-x64": "14.0.4",
-        "@next/swc-linux-arm64-gnu": "14.0.4",
-        "@next/swc-linux-arm64-musl": "14.0.4",
-        "@next/swc-linux-x64-gnu": "14.0.4",
-        "@next/swc-linux-x64-musl": "14.0.4",
-        "@next/swc-win32-arm64-msvc": "14.0.4",
-        "@next/swc-win32-ia32-msvc": "14.0.4",
-        "@next/swc-win32-x64-msvc": "14.0.4"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.1.0",
-        "react": "^18.2.0",
-        "react-dom": "^18.2.0",
-        "sass": "^1.3.0"
-      },
-      "peerDependenciesMeta": {
-        "@opentelemetry/api": {
-          "optional": true
-        },
-        "sass": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/nice-try": {
-      "version": "1.0.5",
-      "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/node-int64": {
-      "version": "0.4.0",
-      "integrity": "sha1-h6kGXNs1XTGC2PlM4RGIuCXGijs=",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/node-modules-regexp": {
-      "version": "1.0.0",
-      "integrity": "sha1-jZ2+KJZKSsVxLpExZCEHxx6Q7EA=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/node-notifier": {
-      "version": "8.0.2",
-      "integrity": "sha512-oJP/9NAdd9+x2Q+rfphB2RJCHjod70RcRLjosiPMMu5gjIfwVnOUGq2nbTjTUbmy0DJ/tFIVT30+Qe3nzl4TJg==",
-      "dev": true,
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "growly": "^1.3.0",
-        "is-wsl": "^2.2.0",
-        "semver": "^7.3.2",
-        "shellwords": "^0.1.1",
-        "uuid": "^8.3.0",
-        "which": "^2.0.2"
-      }
-    },
-    "node_modules/node-releases": {
-      "version": "1.1.77",
-      "integrity": "sha512-rB1DUFUNAN4Gn9keO2K1efO35IDK7yKHCdCaIMvFO7yUYmmZYeDjnGKle26G4rwj+LKRQpjyUUvMkPglwGCYNQ==",
-      "dev": true
-    },
-    "node_modules/normalize-package-data": {
-      "version": "2.5.0",
-      "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "hosted-git-info": "^2.1.4",
-        "resolve": "^1.10.0",
-        "semver": "2 || 3 || 4 || 5",
-        "validate-npm-package-license": "^3.0.1"
-      }
-    },
-    "node_modules/normalize-package-data/node_modules/semver": {
-      "version": "5.7.1",
-      "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-      "dev": true,
-      "peer": true,
-      "bin": {
-        "semver": "bin/semver"
-      }
-    },
-    "node_modules/normalize-path": {
-      "version": "3.0.0",
-      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/normalize-range": {
-      "version": "0.1.2",
-      "integrity": "sha1-LRDAa9/TEuqXd2laTShDlFa3WUI=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/normalize-selector": {
-      "version": "0.2.0",
-      "integrity": "sha1-0LFF62kRicY6eNIB3E/bEpPvDAM=",
-      "dev": true
-    },
-    "node_modules/npm-run-path": {
-      "version": "4.0.1",
-      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
-      "dev": true,
-      "dependencies": {
-        "path-key": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/num2fraction": {
-      "version": "1.2.2",
-      "integrity": "sha1-b2gragJ6Tp3fpFZM0lidHU5mnt4=",
-      "dev": true
-    },
-    "node_modules/nwsapi": {
-      "version": "2.2.0",
-      "integrity": "sha512-h2AatdwYH+JHiZpv7pt/gSX1XoRGb7L/qSIeuqA6GwYoF9w1vP1cw42TO0aI2pNyshRK5893hNSl+1//vHK7hQ==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/object-assign": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-copy": {
-      "version": "0.1.0",
-      "integrity": "sha1-fn2Fi3gb18mRpBupde04EnVOmYw=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "copy-descriptor": "^0.1.0",
-        "define-property": "^0.2.5",
-        "kind-of": "^3.0.3"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-copy/node_modules/define-property": {
-      "version": "0.2.5",
-      "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-descriptor": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-copy/node_modules/is-accessor-descriptor": {
-      "version": "0.1.6",
-      "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-copy/node_modules/is-buffer": {
-      "version": "1.1.6",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/object-copy/node_modules/is-data-descriptor": {
-      "version": "0.1.4",
-      "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-copy/node_modules/is-descriptor": {
-      "version": "0.1.6",
-      "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-accessor-descriptor": "^0.1.6",
-        "is-data-descriptor": "^0.1.4",
-        "kind-of": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-copy/node_modules/is-descriptor/node_modules/kind-of": {
-      "version": "5.1.0",
-      "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-copy/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-inspect": {
-      "version": "1.12.3",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.3.tgz",
-      "integrity": "sha512-geUvdk7c+eizMNUDkRpW1wJwgfOiOeHbxBR/hLXK1aT6zmVSO0jsQcs7fj6MGw89jC/cjGfLcNOrtMYtGqm81g==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object-is": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/object-is/-/object-is-1.1.5.tgz",
-      "integrity": "sha512-3cyDsyHgtmi7I7DfSSI2LDp6SK2lwvtbg0p0R1e0RvTqF5ceGx+K2dfSjm1bKDMVCFEDAQvy+o8c6a7VujOddw==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object-keys": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
-      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
-      "dev": true,
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/object-visit": {
-      "version": "1.0.1",
-      "integrity": "sha1-95xEk68MU3e1n+OdOV5BBC3QRbs=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "isobject": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object.assign": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.4.tgz",
-      "integrity": "sha512-1mxKf0e58bvyjSCtKYY4sRe9itRk3PJpquJOjeIkz885CczcI4IvJJDLPS72oowuSh+pBxUFROpX+TU++hxhZQ==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "has-symbols": "^1.0.3",
-        "object-keys": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object.entries": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/object.entries/-/object.entries-1.1.6.tgz",
-      "integrity": "sha512-leTPzo4Zvg3pmbQ3rDK69Rl8GQvIqMWubrkxONG9/ojtFE2rD9fjMKfSI5BxW3osRH1m6VdzmqK8oAY9aT4x5w==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/object.fromentries": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/object.fromentries/-/object.fromentries-2.0.6.tgz",
-      "integrity": "sha512-VciD13dswC4j1Xt5394WR4MzmAQmlgN72phd/riNp9vtD7tp4QQWJ0R4wvclXcafgcYK8veHRed2W6XeGBvcfg==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object.hasown": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/object.hasown/-/object.hasown-1.1.2.tgz",
-      "integrity": "sha512-B5UIT3J1W+WuWIU55h0mjlwaqxiE5vYENJXIXZ4VFe05pNYrkKuK0U/6aFcb0pKywYJh7IhfoqUfKVmrJJHZHw==",
-      "dev": true,
-      "dependencies": {
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/object.pick": {
-      "version": "1.3.0",
-      "integrity": "sha1-h6EKxMFpS9Lhy/U1kaZhQftd10c=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "isobject": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object.values": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/object.values/-/object.values-1.1.6.tgz",
-      "integrity": "sha512-FVVTkD1vENCsAcwNs9k6jea2uHC/X0+JcjG8YA60FN5CMaJmG95wT9jek/xX9nornqGRrBkKtzuAu2wuHpKqvw==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
-      "dev": true,
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
-    "node_modules/onetime": {
-      "version": "5.1.2",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
-      "dev": true,
-      "dependencies": {
-        "mimic-fn": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/open": {
-      "version": "7.3.0",
-      "integrity": "sha512-mgLwQIx2F/ye9SmbrUkurZCnkoXyXyu9EbHtJZrICjVAJfyMArdHp3KkixGdZx1ZHFPNIwl0DDM1dFFqXbTLZw==",
-      "dev": true,
-      "dependencies": {
-        "is-docker": "^2.0.0",
-        "is-wsl": "^2.1.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/optionator": {
-      "version": "0.9.1",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.1.tgz",
-      "integrity": "sha512-74RlY5FCnhq4jRxVUPKDaRwrVNXMqsGsiW6AJw4XK8hmtm10wC0ypZBLw5IIp85NZMr91+qd1RvvENwg7jjRFw==",
-      "dev": true,
-      "dependencies": {
-        "deep-is": "^0.1.3",
-        "fast-levenshtein": "^2.0.6",
-        "levn": "^0.4.1",
-        "prelude-ls": "^1.2.1",
-        "type-check": "^0.4.0",
-        "word-wrap": "^1.2.3"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/os-tmpdir": {
-      "version": "1.0.2",
-      "integrity": "sha1-u+Z0BseaqFxc/sdm/lc0VV36EnQ=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/p-each-series": {
-      "version": "2.2.0",
-      "integrity": "sha512-ycIL2+1V32th+8scbpTvyHNaHe02z0sjgh91XXjAk+ZeXoPN4Z46DVUnzdso0aX4KckKw0FNNFHdjZ2UsZvxiA==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-finally": {
-      "version": "1.0.0",
-      "integrity": "sha1-P7z7FbiZpEEjs0ttzBi3JDNqLK4=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/p-limit": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
-      "dev": true,
-      "dependencies": {
-        "yocto-queue": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-locate": {
-      "version": "2.0.0",
-      "integrity": "sha1-IKAQOyIqcMj9OcwuWAaA893l7EM=",
-      "dev": true,
-      "dependencies": {
-        "p-limit": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/p-locate/node_modules/p-limit": {
-      "version": "1.3.0",
-      "integrity": "sha512-vvcXsLAJ9Dr5rQOPk7toZQZJApBl2K4J6dANSsEuh6QI41JYcsS/qhTGa9ErIUUgK3WNQoJYvylxvjqmiqEA9Q==",
-      "dev": true,
-      "dependencies": {
-        "p-try": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/p-locate/node_modules/p-try": {
-      "version": "1.0.0",
-      "integrity": "sha1-y8ec26+P1CKOE/Yh8rGiN8GyB7M=",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/p-map": {
-      "version": "4.0.0",
-      "integrity": "sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==",
-      "dev": true,
-      "dependencies": {
-        "aggregate-error": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-try": {
-      "version": "2.2.0",
-      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/parent-module": {
-      "version": "1.0.1",
-      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
-      "dev": true,
-      "dependencies": {
-        "callsites": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/parse-entities": {
-      "version": "2.0.0",
-      "integrity": "sha512-kkywGpCcRYhqQIchaWqZ875wzpS/bMKhz5HnN3p7wveJTkTtyAB/AlnS0f8DFSqYW1T82t6yEAkEcB+A1I3MbQ==",
-      "dev": true,
-      "dependencies": {
-        "character-entities": "^1.0.0",
-        "character-entities-legacy": "^1.0.0",
-        "character-reference-invalid": "^1.0.0",
-        "is-alphanumerical": "^1.0.0",
-        "is-decimal": "^1.0.0",
-        "is-hexadecimal": "^1.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/parse-json": {
-      "version": "5.2.0",
-      "integrity": "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==",
-      "dev": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.0.0",
-        "error-ex": "^1.3.1",
-        "json-parse-even-better-errors": "^2.3.0",
-        "lines-and-columns": "^1.1.6"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/parse5": {
-      "version": "6.0.1",
-      "integrity": "sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/pascalcase": {
-      "version": "0.1.1",
-      "integrity": "sha1-s2PlXoAGym/iF4TS2yK9FdeRfxQ=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/path-exists": {
-      "version": "3.0.0",
-      "integrity": "sha1-zg6+ql94yxiSXqfYENe1mwEP1RU=",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/path-parse": {
-      "version": "1.0.7",
-      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
-      "dev": true
-    },
-    "node_modules/path-type": {
-      "version": "4.0.0",
-      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/picocolors": {
-      "version": "0.2.1",
-      "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==",
-      "dev": true
-    },
-    "node_modules/picomatch": {
-      "version": "2.3.0",
-      "integrity": "sha512-lY1Q/PiJGC2zOv/z391WOTD+Z02bCgsFfvxoXXf6h7kv9o+WmsmzYqrAwY63sNgOxE4xEdq0WyUnXfKeBrSvYw==",
-      "dev": true,
-      "engines": {
-        "node": ">=8.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
-      }
-    },
-    "node_modules/pirates": {
-      "version": "4.0.1",
-      "integrity": "sha512-WuNqLTbMI3tmfef2TKxlQmAiLHKtFhlsCZnPIpuv2Ow0RDVO8lfy1Opf4NUzlMXLjPl+Men7AuVdX6TA+s+uGA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "node-modules-regexp": "^1.0.0"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/pkg-conf": {
-      "version": "2.1.0",
-      "integrity": "sha1-ISZRTKbyq/69FoWW3xi6V4Z/AFg=",
-      "dev": true,
-      "dependencies": {
-        "find-up": "^2.0.0",
-        "load-json-file": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/please-upgrade-node": {
-      "version": "3.2.0",
-      "integrity": "sha512-gQR3WpIgNIKwBMVLkpMUeR3e1/E1y42bqDQZfql+kDeXd8COYfM8PQA4X6y7a8u9Ua9FHmsrrmirW2vHs45hWg==",
-      "dev": true,
-      "dependencies": {
-        "semver-compare": "^1.0.0"
-      }
-    },
-    "node_modules/posix-character-classes": {
-      "version": "0.1.1",
-      "integrity": "sha1-AerA/jta9xoqbAL+q7jB/vfgDqs=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/postcss": {
-      "version": "8.4.31",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz",
-      "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "dependencies": {
-        "nanoid": "^3.3.6",
-        "picocolors": "^1.0.0",
-        "source-map-js": "^1.0.2"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      }
-    },
-    "node_modules/postcss-html": {
-      "version": "0.36.0",
-      "integrity": "sha512-HeiOxGcuwID0AFsNAL0ox3mW6MHH5cstWN1Z3Y+n6H+g12ih7LHdYxWwEA/QmrebctLjo79xz9ouK3MroHwOJw==",
-      "dev": true,
-      "dependencies": {
-        "htmlparser2": "^3.10.0"
-      },
-      "peerDependencies": {
-        "postcss": ">=5.0.0",
-        "postcss-syntax": ">=0.36.0"
-      }
-    },
-    "node_modules/postcss-less": {
-      "version": "3.1.4",
-      "integrity": "sha512-7TvleQWNM2QLcHqvudt3VYjULVB49uiW6XzEUFmvwHzvsOEF5MwBrIXZDJQvJNFGjJQTzSzZnDoCJ8h/ljyGXA==",
-      "dev": true,
-      "dependencies": {
-        "postcss": "^7.0.14"
-      },
-      "engines": {
-        "node": ">=6.14.4"
-      }
-    },
-    "node_modules/postcss-less/node_modules/postcss": {
-      "version": "7.0.39",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-      "dev": true,
-      "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      }
-    },
-    "node_modules/postcss-less/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/postcss-media-query-parser": {
-      "version": "0.2.3",
-      "integrity": "sha1-J7Ocb02U+Bsac7j3Y1HGCeXO8kQ=",
-      "dev": true
-    },
-    "node_modules/postcss-resolve-nested-selector": {
-      "version": "0.1.1",
-      "integrity": "sha1-Kcy8fDfe36wwTp//C/FZaz9qDk4=",
-      "dev": true
-    },
-    "node_modules/postcss-safe-parser": {
-      "version": "4.0.2",
-      "integrity": "sha512-Uw6ekxSWNLCPesSv/cmqf2bY/77z11O7jZGPax3ycZMFU/oi2DMH9i89AdHc1tRwFg/arFoEwX0IS3LCUxJh1g==",
-      "dev": true,
-      "dependencies": {
-        "postcss": "^7.0.26"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/postcss-safe-parser/node_modules/postcss": {
-      "version": "7.0.39",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-      "dev": true,
-      "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      }
-    },
-    "node_modules/postcss-safe-parser/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/postcss-sass": {
-      "version": "0.4.4",
-      "integrity": "sha512-BYxnVYx4mQooOhr+zer0qWbSPYnarAy8ZT7hAQtbxtgVf8gy+LSLT/hHGe35h14/pZDTw1DsxdbrwxBN++H+fg==",
-      "dev": true,
-      "dependencies": {
-        "gonzales-pe": "^4.3.0",
-        "postcss": "^7.0.21"
-      }
-    },
-    "node_modules/postcss-sass/node_modules/postcss": {
-      "version": "7.0.39",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-      "dev": true,
-      "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      }
-    },
-    "node_modules/postcss-sass/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/postcss-scss": {
-      "version": "2.1.1",
-      "integrity": "sha512-jQmGnj0hSGLd9RscFw9LyuSVAa5Bl1/KBPqG1NQw9w8ND55nY4ZEsdlVuYJvLPpV+y0nwTV5v/4rHPzZRihQbA==",
-      "dev": true,
-      "dependencies": {
-        "postcss": "^7.0.6"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/postcss-scss/node_modules/postcss": {
-      "version": "7.0.39",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-      "dev": true,
-      "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      }
-    },
-    "node_modules/postcss-scss/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/postcss-selector-parser": {
-      "version": "6.0.6",
-      "integrity": "sha512-9LXrvaaX3+mcv5xkg5kFwqSzSH1JIObIx51PrndZwlmznwXRfxMddDvo9gve3gVR8ZTKgoFDdWkbRFmEhT4PMg==",
-      "dev": true,
-      "dependencies": {
-        "cssesc": "^3.0.0",
-        "util-deprecate": "^1.0.2"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/postcss-sorting": {
-      "version": "5.0.1",
-      "integrity": "sha512-Y9fUFkIhfrm6i0Ta3n+89j56EFqaNRdUKqXyRp6kvTcSXnmgEjaVowCXH+JBe9+YKWqd4nc28r2sgwnzJalccA==",
-      "dev": true,
-      "dependencies": {
-        "lodash": "^4.17.14",
-        "postcss": "^7.0.17"
-      },
-      "engines": {
-        "node": ">=8.7.0"
-      }
-    },
-    "node_modules/postcss-sorting/node_modules/postcss": {
-      "version": "7.0.39",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-      "dev": true,
-      "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      }
-    },
-    "node_modules/postcss-sorting/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/postcss-syntax": {
-      "version": "0.36.2",
-      "integrity": "sha512-nBRg/i7E3SOHWxF3PpF5WnJM/jQ1YpY9000OaVXlAQj6Zp/kIqJxEDWIZ67tAd7NLuk7zqN4yqe9nc0oNAOs1w==",
-      "dev": true,
-      "peerDependencies": {
-        "postcss": ">=5.0.0"
-      }
-    },
-    "node_modules/postcss-value-parser": {
-      "version": "4.1.0",
-      "integrity": "sha512-97DXOFbQJhk71ne5/Mt6cOu6yxsSfM0QGQyl0L25Gca4yGWEGJaig7l7gbCX623VqTBNGLRLaVUCnNkcedlRSQ==",
-      "dev": true
-    },
-    "node_modules/postcss-values-parser": {
-      "version": "3.2.1",
-      "integrity": "sha512-SQ7/88VE9LhJh9gc27/hqnSU/aZaREVJcRVccXBmajgP2RkjdJzNyH/a9GCVMI5nsRhT0jC5HpUMwfkz81DVVg==",
-      "dev": true,
-      "dependencies": {
-        "color-name": "^1.1.4",
-        "is-url-superb": "^3.0.0",
-        "postcss": "^7.0.5",
-        "url-regex": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=6.14.4"
-      }
-    },
-    "node_modules/postcss-values-parser/node_modules/postcss": {
-      "version": "7.0.39",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-      "dev": true,
-      "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      }
-    },
-    "node_modules/postcss-values-parser/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/postcss/node_modules/picocolors": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
-      "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==",
-      "dev": true
-    },
-    "node_modules/prelude-ls": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
-      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
-      "dev": true,
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/prettier": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.2.1.tgz",
-      "integrity": "sha512-PqyhM2yCjg/oKkFPtTGUojv7gnZAoG80ttl45O6x2Ug/rMJw4wcc9k6aaf2hibP7BGVCCM33gZoGjyvt9mm16Q==",
-      "dev": true,
-      "bin": {
-        "prettier": "bin-prettier.js"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/prettier-linter-helpers": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/prettier-linter-helpers/-/prettier-linter-helpers-1.0.0.tgz",
-      "integrity": "sha512-GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==",
-      "dev": true,
-      "dependencies": {
-        "fast-diff": "^1.1.2"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/pretty-format": {
-      "version": "26.6.2",
-      "integrity": "sha512-7AeGuCYNGmycyQbCqd/3PWH4eOoX/OiCa0uphp57NVTeAGdJGaAliecxwBDHYQCIvrW7aDBZCYeNTP/WX69mkg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@jest/types": "^26.6.2",
-        "ansi-regex": "^5.0.0",
-        "ansi-styles": "^4.0.0",
-        "react-is": "^17.0.1"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/pretty-format/node_modules/react-is": {
-      "version": "17.0.2",
-      "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/prompts": {
-      "version": "2.4.2",
-      "integrity": "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kleur": "^3.0.3",
-        "sisteransi": "^1.0.5"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/prop-types": {
-      "version": "15.8.1",
-      "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz",
-      "integrity": "sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==",
-      "dev": true,
-      "dependencies": {
-        "loose-envify": "^1.4.0",
-        "object-assign": "^4.1.1",
-        "react-is": "^16.13.1"
-      }
-    },
-    "node_modules/psl": {
-      "version": "1.8.0",
-      "integrity": "sha512-RIdOzyoavK+hA18OGGWDqUTsCLhtA7IcZ/6NCs4fFJaHBDab+pDDmDIByWFRQJq2Cd7r1OoQxBGKOaztq+hjIQ==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/pump": {
-      "version": "3.0.0",
-      "integrity": "sha512-LwZy+p3SFs1Pytd/jYct4wpv49HiYCqd9Rlc5ZVdk0V+8Yzv6jR5Blk3TRmPL1ft69TxP0IMZGJ+WPFU2BFhww==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "end-of-stream": "^1.1.0",
-        "once": "^1.3.1"
-      }
-    },
-    "node_modules/querystringify": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz",
-      "integrity": "sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/queue-microtask": {
-      "version": "1.2.3",
-      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ]
-    },
-    "node_modules/quick-lru": {
-      "version": "4.0.1",
-      "integrity": "sha512-ARhCpm70fzdcvNQfPoy49IaanKkTlRWF2JMzqhcJbhSFRZv7nPTvZJdcY7301IPmvW+/p0RgIWnQDLJxifsQ7g==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/react": {
-      "version": "18.2.0",
-      "resolved": "https://registry.npmjs.org/react/-/react-18.2.0.tgz",
-      "integrity": "sha512-/3IjMdb2L9QbBdWiW5e3P2/npwMBaU9mHCSCUzNln0ZCYbcfTsGbTJrU/kGemdH2IWmB2ioZ+zkxtmq6g09fGQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "loose-envify": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/react-dom": {
-      "version": "18.2.0",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.2.0.tgz",
-      "integrity": "sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "loose-envify": "^1.1.0",
-        "scheduler": "^0.23.0"
-      },
-      "peerDependencies": {
-        "react": "^18.2.0"
-      }
-    },
-    "node_modules/react-is": {
-      "version": "16.13.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
-      "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==",
-      "dev": true
-    },
-    "node_modules/readable-stream": {
-      "version": "3.6.0",
-      "integrity": "sha512-BViHy7LKeTz4oNnkcLJ+lVSL6vpiFeX6/d3oSH8zCW7UxP2onchk+vTGB143xuFjHS3deTgkKoXXymXqymiIdA==",
-      "dev": true,
-      "dependencies": {
-        "inherits": "^2.0.3",
-        "string_decoder": "^1.1.1",
-        "util-deprecate": "^1.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/readdirp": {
-      "version": "3.5.0",
-      "integrity": "sha512-cMhu7c/8rdhkHXWsY+osBhfSy0JikwpHK/5+imo+LpeasTF8ouErHrlYkwT0++njiyuDvc7OFY5T3ukvZ8qmFQ==",
-      "dev": true,
-      "dependencies": {
-        "picomatch": "^2.2.1"
-      },
-      "engines": {
-        "node": ">=8.10.0"
-      }
-    },
-    "node_modules/regenerator-runtime": {
-      "version": "0.13.11",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
-      "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==",
-      "dev": true
-    },
-    "node_modules/regex-not": {
-      "version": "1.0.2",
-      "integrity": "sha512-J6SDjUgDxQj5NusnOtdFxDwN/+HWykR8GELwctJ7mdqhcyy1xEc4SRFHUXvxTp661YaVKAjfRLZ9cCqS6tn32A==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "extend-shallow": "^3.0.2",
-        "safe-regex": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/regex-not/node_modules/extend-shallow": {
-      "version": "3.0.2",
-      "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "assign-symbols": "^1.0.0",
-        "is-extendable": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/regex-not/node_modules/is-extendable": {
-      "version": "1.0.1",
-      "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-plain-object": "^2.0.4"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/regexp.prototype.flags": {
-      "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.4.3.tgz",
-      "integrity": "sha512-fjggEOO3slI6Wvgjwflkc4NFRCTZAu5CnNfBd5qOMYhWdn67nJBBu34/TkD++eeFmd8C9r9jfXJ27+nSiRkSUA==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.3",
-        "functions-have-names": "^1.2.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/regexpp": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/regexpp/-/regexpp-3.2.0.tgz",
-      "integrity": "sha512-pq2bWo9mVD43nbts2wGv17XLiNLya+GklZ8kaDLV2Z08gDCsGpnKn9BFMepvWuHCbyVvY7J5o5+BVvoQbmlJLg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/mysticatea"
-      }
-    },
-    "node_modules/remark": {
-      "version": "13.0.0",
-      "integrity": "sha512-HDz1+IKGtOyWN+QgBiAT0kn+2s6ovOxHyPAFGKVE81VSzJ+mq7RwHFledEvB5F1p4iJvOah/LOKdFuzvRnNLCA==",
-      "dev": true,
-      "dependencies": {
-        "remark-parse": "^9.0.0",
-        "remark-stringify": "^9.0.0",
-        "unified": "^9.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/remark-mdx": {
-      "version": "1.6.22",
-      "resolved": "https://registry.npmjs.org/remark-mdx/-/remark-mdx-1.6.22.tgz",
-      "integrity": "sha512-phMHBJgeV76uyFkH4rvzCftLfKCr2RZuF+/gmVcaKrpsihyzmhXjA0BEMDaPTXG5y8qZOKPVo83NAOX01LPnOQ==",
-      "dev": true,
-      "dependencies": {
-        "@babel/core": "7.12.9",
-        "@babel/helper-plugin-utils": "7.10.4",
-        "@babel/plugin-proposal-object-rest-spread": "7.12.1",
-        "@babel/plugin-syntax-jsx": "7.12.1",
-        "@mdx-js/util": "1.6.22",
-        "is-alphabetical": "1.0.4",
-        "remark-parse": "8.0.3",
-        "unified": "9.2.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/remark-mdx/node_modules/@babel/core": {
-      "version": "7.12.9",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.12.9.tgz",
-      "integrity": "sha512-gTXYh3M5wb7FRXQy+FErKFAv90BnlOuNn1QkCK2lREoPAjrQCO49+HVSrFoe5uakFAF5eenS75KbO2vQiLrTMQ==",
-      "dev": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.10.4",
-        "@babel/generator": "^7.12.5",
-        "@babel/helper-module-transforms": "^7.12.1",
-        "@babel/helpers": "^7.12.5",
-        "@babel/parser": "^7.12.7",
-        "@babel/template": "^7.12.7",
-        "@babel/traverse": "^7.12.9",
-        "@babel/types": "^7.12.7",
-        "convert-source-map": "^1.7.0",
-        "debug": "^4.1.0",
-        "gensync": "^1.0.0-beta.1",
-        "json5": "^2.1.2",
-        "lodash": "^4.17.19",
-        "resolve": "^1.3.2",
-        "semver": "^5.4.1",
-        "source-map": "^0.5.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/babel"
-      }
-    },
-    "node_modules/remark-mdx/node_modules/@babel/helper-plugin-utils": {
-      "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.10.4.tgz",
-      "integrity": "sha512-O4KCvQA6lLiMU9l2eawBPMf1xPP8xPfB3iEQw150hOVTqj/rfXz0ThTb4HEzqQfs2Bmo5Ay8BzxfzVtBrr9dVg==",
-      "dev": true
-    },
-    "node_modules/remark-mdx/node_modules/semver": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-      "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-      "dev": true,
-      "bin": {
-        "semver": "bin/semver"
-      }
-    },
-    "node_modules/remark-parse": {
-      "version": "8.0.3",
-      "resolved": "https://registry.npmjs.org/remark-parse/-/remark-parse-8.0.3.tgz",
-      "integrity": "sha512-E1K9+QLGgggHxCQtLt++uXltxEprmWzNfg+MxpfHsZlrddKzZ/hZyWHDbK3/Ap8HJQqYJRXP+jHczdL6q6i85Q==",
-      "dev": true,
-      "dependencies": {
-        "ccount": "^1.0.0",
-        "collapse-white-space": "^1.0.2",
-        "is-alphabetical": "^1.0.0",
-        "is-decimal": "^1.0.0",
-        "is-whitespace-character": "^1.0.0",
-        "is-word-character": "^1.0.0",
-        "markdown-escapes": "^1.0.0",
-        "parse-entities": "^2.0.0",
-        "repeat-string": "^1.5.4",
-        "state-toggle": "^1.0.0",
-        "trim": "0.0.1",
-        "trim-trailing-lines": "^1.0.0",
-        "unherit": "^1.0.4",
-        "unist-util-remove-position": "^2.0.0",
-        "vfile-location": "^3.0.0",
-        "xtend": "^4.0.1"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/remark-stringify": {
-      "version": "9.0.1",
-      "integrity": "sha512-mWmNg3ZtESvZS8fv5PTvaPckdL4iNlCHTt8/e/8oN08nArHRHjNZMKzA/YW3+p7/lYqIw4nx1XsjCBo/AxNChg==",
-      "dev": true,
-      "dependencies": {
-        "mdast-util-to-markdown": "^0.6.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/remark/node_modules/remark-parse": {
-      "version": "9.0.0",
-      "integrity": "sha512-geKatMwSzEXKHuzBNU1z676sGcDcFoChMK38TgdHJNAYfFtsfHDQG7MoJAjs6sgYMqyLduCYWDIWZIxiPeafEw==",
-      "dev": true,
-      "dependencies": {
-        "mdast-util-from-markdown": "^0.8.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/remove-trailing-separator": {
-      "version": "1.1.0",
-      "integrity": "sha1-wkvOKig62tW8P1jg1IJJuSN52O8=",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/repeat-element": {
-      "version": "1.1.4",
-      "integrity": "sha512-LFiNfRcSu7KK3evMyYOuCzv3L10TW7yC1G2/+StMjK8Y6Vqd2MG7r/Qjw4ghtuCOjFvlnms/iMmLqpvW/ES/WQ==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/repeat-string": {
-      "version": "1.6.1",
-      "integrity": "sha1-jcrkcOHIirwtYA//Sndihtp15jc=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10"
-      }
-    },
-    "node_modules/require-directory": {
-      "version": "2.1.1",
-      "integrity": "sha1-jGStX9MNqxyXbiNE/+f3kqam30I=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/require-main-filename": {
-      "version": "2.0.0",
-      "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/requires-port": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
-      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/resolve": {
-      "version": "1.20.0",
-      "integrity": "sha512-wENBPt4ySzg4ybFQW2TT1zMQucPK95HSh/nq2CFTZVOGut2+pQvSsgtda4d26YrYcr067wjbmzOG8byDPBX63A==",
-      "dev": true,
-      "dependencies": {
-        "is-core-module": "^2.2.0",
-        "path-parse": "^1.0.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/resolve-cwd": {
-      "version": "3.0.0",
-      "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "resolve-from": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/resolve-cwd/node_modules/resolve-from": {
-      "version": "5.0.0",
-      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/resolve-from": {
-      "version": "4.0.0",
-      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/resolve-url": {
-      "version": "0.2.1",
-      "integrity": "sha1-LGN/53yJOv0qZj/iGqkIAGjiBSo=",
-      "deprecated": "https://github.com/lydell/resolve-url#deprecated",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/restore-cursor": {
-      "version": "3.1.0",
-      "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==",
-      "dev": true,
-      "dependencies": {
-        "onetime": "^5.1.0",
-        "signal-exit": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/ret": {
-      "version": "0.1.15",
-      "integrity": "sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.12"
-      }
-    },
-    "node_modules/reusify": {
-      "version": "1.0.4",
-      "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==",
-      "dev": true,
-      "engines": {
-        "iojs": ">=1.0.0",
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/rimraf": {
-      "version": "3.0.2",
-      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
-      "dev": true,
-      "dependencies": {
-        "glob": "^7.1.3"
-      },
-      "bin": {
-        "rimraf": "bin.js"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/rivet-graphql": {
-      "version": "0.3.1",
-      "integrity": "sha512-HEov02XhZ6H1jOME+mO8CZwliu/UtgZSHixYUwvQ7HSx3gk8EOVaQY5c3zscOYjZECvP8cR4+1Ob3KHWJRWEMw==",
-      "dev": true,
-      "dependencies": {
-        "graphql": "^15.3.0",
-        "graphql-request": "^3.0.0"
-      }
-    },
-    "node_modules/rsvp": {
-      "version": "4.8.5",
-      "integrity": "sha512-nfMOlASu9OnRJo1mbEk2cz0D56a1MBNrJ7orjRZQG10XDyuvwksKbuXNp6qa+kbn839HwjwhBzhFmdsaEAfauA==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": "6.* || >= 7.*"
-      }
-    },
-    "node_modules/run-async": {
-      "version": "2.4.1",
-      "integrity": "sha512-tvVnVv01b8c1RrA6Ep7JkStj85Guv/YrMcwqYQnwjsAS2cTmmPGBBjAjpCW7RrSodNSoE2/qg9O4bceNvUuDgQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.12.0"
-      }
-    },
-    "node_modules/run-parallel": {
-      "version": "1.2.0",
-      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "dependencies": {
-        "queue-microtask": "^1.2.2"
-      }
-    },
-    "node_modules/rxjs": {
-      "version": "6.6.7",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.6.7.tgz",
-      "integrity": "sha512-hTdwr+7yYNIT5n4AMYp85KA6yw2Va0FLa3Rguvbpa4W3I5xynaBZo41cM3XM+4Q6fRMj3sBYIR1VAmZMXYJvRQ==",
-      "dev": true,
-      "dependencies": {
-        "tslib": "^1.9.0"
-      },
-      "engines": {
-        "npm": ">=2.0.0"
-      }
-    },
-    "node_modules/rxjs/node_modules/tslib": {
-      "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
-      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
-      "dev": true
-    },
-    "node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "dev": true
-    },
-    "node_modules/safe-regex": {
-      "version": "1.1.0",
-      "integrity": "sha1-QKNmnzsHfR6UPURinhV91IAjvy4=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "ret": "~0.1.10"
-      }
-    },
-    "node_modules/safe-regex-test": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/safe-regex-test/-/safe-regex-test-1.0.0.tgz",
-      "integrity": "sha512-JBUUzyOgEwXQY1NuPtvcj/qcBDbDmEvWufhlnXZIm75DEHp+afM1r1ujJpJsV/gSM4t59tpDyPi1sd6ZaPFfsA==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.3",
-        "is-regex": "^1.1.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/safer-buffer": {
-      "version": "2.1.2",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "dev": true
-    },
-    "node_modules/sane": {
-      "version": "4.1.0",
-      "integrity": "sha512-hhbzAgTIX8O7SHfp2c8/kREfEn4qO/9q8C9beyY6+tvZ87EpoZ3i1RIEvp27YBswnNbY9mWd6paKVmKbAgLfZA==",
-      "deprecated": "some dependency vulnerabilities fixed, support for node < 10 dropped, and newer ECMAScript syntax/features added",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@cnakazawa/watch": "^1.0.3",
-        "anymatch": "^2.0.0",
-        "capture-exit": "^2.0.0",
-        "exec-sh": "^0.3.2",
-        "execa": "^1.0.0",
-        "fb-watchman": "^2.0.0",
-        "micromatch": "^3.1.4",
-        "minimist": "^1.1.1",
-        "walker": "~1.0.5"
-      },
-      "bin": {
-        "sane": "src/cli.js"
-      },
-      "engines": {
-        "node": "6.* || 8.* || >= 10.*"
-      }
-    },
-    "node_modules/sane/node_modules/anymatch": {
-      "version": "2.0.0",
-      "integrity": "sha512-5teOsQWABXHHBFP9y3skS5P3d/WfWXpv3FUpy+LorMrNYaT9pI4oLMQX7jzQ2KklNpGpWHzdCXTDT2Y3XGlZBw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "micromatch": "^3.1.4",
-        "normalize-path": "^2.1.1"
-      }
-    },
-    "node_modules/sane/node_modules/braces": {
-      "version": "2.3.2",
-      "integrity": "sha512-aNdbnj9P8PjdXU4ybaWLK2IF3jc/EoDYbC7AazW6to3TRsfXxscC9UXOB5iDiEQrkyIbWp2SLQda4+QAa7nc3w==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "arr-flatten": "^1.1.0",
-        "array-unique": "^0.3.2",
-        "extend-shallow": "^2.0.1",
-        "fill-range": "^4.0.0",
-        "isobject": "^3.0.1",
-        "repeat-element": "^1.1.2",
-        "snapdragon": "^0.8.1",
-        "snapdragon-node": "^2.0.1",
-        "split-string": "^3.0.2",
-        "to-regex": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/cross-spawn": {
-      "version": "6.0.5",
-      "integrity": "sha512-eTVLrBSt7fjbDygz805pMnstIs2VTBNkRm0qxZd+M7A5XDdxVRWO5MxGBXZhjY4cqLYLdtrGqRf8mBPmzwSpWQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "nice-try": "^1.0.4",
-        "path-key": "^2.0.1",
-        "semver": "^5.5.0",
-        "shebang-command": "^1.2.0",
-        "which": "^1.2.9"
-      },
-      "engines": {
-        "node": ">=4.8"
-      }
-    },
-    "node_modules/sane/node_modules/execa": {
-      "version": "1.0.0",
-      "integrity": "sha512-adbxcyWV46qiHyvSp50TKt05tB4tK3HcmF7/nxfAdhnox83seTDbwnaqKO4sXRy7roHAIFqJP/Rw/AuEbX61LA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "cross-spawn": "^6.0.0",
-        "get-stream": "^4.0.0",
-        "is-stream": "^1.1.0",
-        "npm-run-path": "^2.0.0",
-        "p-finally": "^1.0.0",
-        "signal-exit": "^3.0.0",
-        "strip-eof": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/sane/node_modules/fill-range": {
-      "version": "4.0.0",
-      "integrity": "sha1-1USBHUKPmOsGpj3EAtJAPDKMOPc=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "extend-shallow": "^2.0.1",
-        "is-number": "^3.0.0",
-        "repeat-string": "^1.6.1",
-        "to-regex-range": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/get-stream": {
-      "version": "4.1.0",
-      "integrity": "sha512-GMat4EJ5161kIy2HevLlr4luNjBgvmj413KaQA7jt4V8B4RDsfpHk7WQ9GVqfYyyx8OS/L66Kox+rJRNklLK7w==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "pump": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/sane/node_modules/is-buffer": {
-      "version": "1.1.6",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/sane/node_modules/is-extendable": {
-      "version": "1.0.1",
-      "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-plain-object": "^2.0.4"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/is-number": {
-      "version": "3.0.0",
-      "integrity": "sha1-JP1iAaR4LPUFYcgQJ2r8fRLXEZU=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/is-number/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/is-stream": {
-      "version": "1.1.0",
-      "integrity": "sha1-EtSj3U5o4Lec6428hBc66A2RykQ=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/micromatch": {
-      "version": "3.1.10",
-      "integrity": "sha512-MWikgl9n9M3w+bpsY3He8L+w9eF9338xRl8IAO5viDizwSzziFEyUzo2xrrloB64ADbTf8uA8vRqqttDTOmccg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "arr-diff": "^4.0.0",
-        "array-unique": "^0.3.2",
-        "braces": "^2.3.1",
-        "define-property": "^2.0.2",
-        "extend-shallow": "^3.0.2",
-        "extglob": "^2.0.4",
-        "fragment-cache": "^0.2.1",
-        "kind-of": "^6.0.2",
-        "nanomatch": "^1.2.9",
-        "object.pick": "^1.3.0",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/micromatch/node_modules/extend-shallow": {
-      "version": "3.0.2",
-      "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "assign-symbols": "^1.0.0",
-        "is-extendable": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/normalize-path": {
-      "version": "2.1.1",
-      "integrity": "sha1-GrKLVW4Zg2Oowab35vogE3/mrtk=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "remove-trailing-separator": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/npm-run-path": {
-      "version": "2.0.2",
-      "integrity": "sha1-NakjLfo11wZ7TLLd8jV7GHFTbF8=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "path-key": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/sane/node_modules/path-key": {
-      "version": "2.0.1",
-      "integrity": "sha1-QRyttXTFoUDTpLGRDUDYDMn0C0A=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/sane/node_modules/semver": {
-      "version": "5.7.1",
-      "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-      "dev": true,
-      "peer": true,
-      "bin": {
-        "semver": "bin/semver"
-      }
-    },
-    "node_modules/sane/node_modules/shebang-command": {
-      "version": "1.2.0",
-      "integrity": "sha1-RKrGW2lbAzmJaMOfNj/uXer98eo=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "shebang-regex": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/shebang-regex": {
-      "version": "1.0.0",
-      "integrity": "sha1-2kL0l0DAtC2yypcoVxyxkMmO/qM=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/to-regex-range": {
-      "version": "2.1.1",
-      "integrity": "sha1-fIDBe53+vlmeJzZ+DU3VWQFB2zg=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-number": "^3.0.0",
-        "repeat-string": "^1.6.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sane/node_modules/which": {
-      "version": "1.3.1",
-      "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "which": "bin/which"
-      }
-    },
-    "node_modules/saxes": {
-      "version": "5.0.1",
-      "integrity": "sha512-5LBh1Tls8c9xgGjw3QrMwETmTMVk0oFgvrFSvWx62llR2hcEInrKNZ2GZCCuuy2lvWrdl5jhbpeqc5hRYKFOcw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "xmlchars": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/scheduler": {
-      "version": "0.23.0",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.0.tgz",
-      "integrity": "sha512-CtuThmgHNg7zIZWAXi3AsyIzA3n4xx7aNyjwC2VJldO2LMVDhFK+63xGqq6CsJH4rTAt6/M+N4GhZiDYPx9eUw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "loose-envify": "^1.1.0"
-      }
-    },
-    "node_modules/semver": {
-      "version": "7.3.5",
-      "integrity": "sha512-PoeGJYh8HK4BTO/a9Tf6ZG3veo/A7ZVsYrSA6J8ny9nb3B1VrpkuN+z9OE5wfE5p6H4LchYZsegiQgbJD94ZFQ==",
-      "dev": true,
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/semver-compare": {
-      "version": "1.0.0",
-      "integrity": "sha1-De4hahyUGrN+nvsXiPavxf9VN/w=",
-      "dev": true
-    },
-    "node_modules/set-blocking": {
-      "version": "2.0.0",
-      "integrity": "sha1-BF+XgtARrppoA93TgrJDkrPYkPc=",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/set-value": {
-      "version": "2.0.1",
-      "integrity": "sha512-JxHc1weCN68wRY0fhCoXpyK55m/XPHafOmK4UWD7m2CI14GMcFypt4w/0+NV5f/ZMby2F6S2wwA7fgynh9gWSw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "extend-shallow": "^2.0.1",
-        "is-extendable": "^0.1.1",
-        "is-plain-object": "^2.0.3",
-        "split-string": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "dev": true,
-      "dependencies": {
-        "shebang-regex": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shellwords": {
-      "version": "0.1.1",
-      "integrity": "sha512-vFwSUfQvqybiICwZY5+DAWIPLKsWO31Q91JSKl3UYv+K5c2QRPzn0qzec6QPu1Qc9eHYItiP3NdJqNVqetYAww==",
-      "dev": true,
-      "optional": true,
-      "peer": true
-    },
-    "node_modules/side-channel": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
-      "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.0",
-        "get-intrinsic": "^1.0.2",
-        "object-inspect": "^1.9.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/signal-exit": {
-      "version": "3.0.5",
-      "integrity": "sha512-KWcOiKeQj6ZyXx7zq4YxSMgHRlod4czeBQZrPb8OKcohcqAXShm7E20kEMle9WBt26hFcAf0qLOcp5zmY7kOqQ==",
-      "dev": true
-    },
-    "node_modules/signale": {
-      "version": "1.4.0",
-      "integrity": "sha512-iuh+gPf28RkltuJC7W5MRi6XAjTDCAPC/prJUpQoG4vIP3MJZ+GTydVnodXA7pwvTKb2cA0m9OFZW/cdWy/I/w==",
-      "dev": true,
-      "dependencies": {
-        "chalk": "^2.3.2",
-        "figures": "^2.0.0",
-        "pkg-conf": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/signale/node_modules/ansi-styles": {
-      "version": "3.2.1",
-      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-      "dev": true,
-      "dependencies": {
-        "color-convert": "^1.9.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/signale/node_modules/chalk": {
-      "version": "2.4.2",
-      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^3.2.1",
-        "escape-string-regexp": "^1.0.5",
-        "supports-color": "^5.3.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/signale/node_modules/color-convert": {
-      "version": "1.9.3",
-      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-      "dev": true,
-      "dependencies": {
-        "color-name": "1.1.3"
-      }
-    },
-    "node_modules/signale/node_modules/color-name": {
-      "version": "1.1.3",
-      "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU=",
-      "dev": true
-    },
-    "node_modules/signale/node_modules/figures": {
-      "version": "2.0.0",
-      "integrity": "sha1-OrGi0qYsi/tDGgyUy3l6L84nyWI=",
-      "dev": true,
-      "dependencies": {
-        "escape-string-regexp": "^1.0.5"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/signale/node_modules/has-flag": {
-      "version": "3.0.0",
-      "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0=",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/signale/node_modules/supports-color": {
-      "version": "5.5.0",
-      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-      "dev": true,
-      "dependencies": {
-        "has-flag": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/simple-git-hooks": {
-      "version": "2.6.1",
-      "integrity": "sha512-nvqaNfgvcjN3cGSYJSdjwB+tP8YKRCyvuUvQ24luIjIpGhUCPpZDTJ+p+hcJiwc0lZlTCl0NayfBVDoIMG7Jpg==",
-      "dev": true,
-      "hasInstallScript": true,
-      "bin": {
-        "simple-git-hooks": "cli.js"
-      }
-    },
-    "node_modules/sisteransi": {
-      "version": "1.0.5",
-      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/slash": {
-      "version": "3.0.0",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/slice-ansi": {
-      "version": "3.0.0",
-      "integrity": "sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "astral-regex": "^2.0.0",
-        "is-fullwidth-code-point": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/slugify": {
-      "version": "1.4.6",
-      "integrity": "sha512-ZdJIgv9gdrYwhXqxsH9pv7nXxjUEyQ6nqhngRxoAAOlmMGA28FDq5O4/5US4G2/Nod7d1ovNcgURQJ7kHq50KQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/snapdragon": {
-      "version": "0.8.2",
-      "integrity": "sha512-FtyOnWN/wCHTVXOMwvSv26d+ko5vWlIDD6zoUJ7LW8vh+ZBC8QdljveRP+crNrtBwioEUWy/4dMtbBjA4ioNlg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "base": "^0.11.1",
-        "debug": "^2.2.0",
-        "define-property": "^0.2.5",
-        "extend-shallow": "^2.0.1",
-        "map-cache": "^0.2.2",
-        "source-map": "^0.5.6",
-        "source-map-resolve": "^0.5.0",
-        "use": "^3.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon-node": {
-      "version": "2.1.1",
-      "integrity": "sha512-O27l4xaMYt/RSQ5TR3vpWCAB5Kb/czIcqUFOM/C4fYcLnbZUc1PkjTAMjof2pBWaSTwOUd6qUHcFGVGj7aIwnw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "define-property": "^1.0.0",
-        "isobject": "^3.0.0",
-        "snapdragon-util": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon-node/node_modules/define-property": {
-      "version": "1.0.0",
-      "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-descriptor": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon-util": {
-      "version": "3.0.1",
-      "integrity": "sha512-mbKkMdQKsjX4BAL4bRYTj21edOf8cN7XHdYUJEe+Zn99hVEYcMvKPct1IqNe7+AZPirn8BCDOQBHQZknqmKlZQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.2.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon-util/node_modules/is-buffer": {
-      "version": "1.1.6",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/snapdragon-util/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon/node_modules/debug": {
-      "version": "2.6.9",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "ms": "2.0.0"
-      }
-    },
-    "node_modules/snapdragon/node_modules/define-property": {
-      "version": "0.2.5",
-      "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-descriptor": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon/node_modules/is-accessor-descriptor": {
-      "version": "0.1.6",
-      "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon/node_modules/is-accessor-descriptor/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon/node_modules/is-buffer": {
-      "version": "1.1.6",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/snapdragon/node_modules/is-data-descriptor": {
-      "version": "0.1.4",
-      "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon/node_modules/is-data-descriptor/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon/node_modules/is-descriptor": {
-      "version": "0.1.6",
-      "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-accessor-descriptor": "^0.1.6",
-        "is-data-descriptor": "^0.1.4",
-        "kind-of": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon/node_modules/kind-of": {
-      "version": "5.1.0",
-      "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/snapdragon/node_modules/ms": {
-      "version": "2.0.0",
-      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/source-map": {
-      "version": "0.5.7",
-      "integrity": "sha1-igOdLRAh0i0eoUyA2OpGi6LvP8w=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/source-map-js": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.0.2.tgz",
-      "integrity": "sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/source-map-resolve": {
-      "version": "0.5.3",
-      "integrity": "sha512-Htz+RnsXWk5+P2slx5Jh3Q66vhQj1Cllm0zvnaY98+NFx+Dv2CF/f5O/t8x+KaNdrdIAsruNzoh/KpialbqAnw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "atob": "^2.1.2",
-        "decode-uri-component": "^0.2.0",
-        "resolve-url": "^0.2.1",
-        "source-map-url": "^0.4.0",
-        "urix": "^0.1.0"
-      }
-    },
-    "node_modules/source-map-support": {
-      "version": "0.5.20",
-      "integrity": "sha512-n1lZZ8Ve4ksRqizaBQgxXDgKwttHDhyfQjA6YZZn8+AroHbsIz+JjwxQDxbp+7y5OYCI8t1Yk7etjD9CRd2hIw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "buffer-from": "^1.0.0",
-        "source-map": "^0.6.0"
-      }
-    },
-    "node_modules/source-map-support/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/source-map-url": {
-      "version": "0.4.1",
-      "integrity": "sha512-cPiFOTLUKvJFIg4SKVScy4ilPPW6rFgMgfuZJPNoDuMs3nC1HbMUycBoJw77xFIp6z1UJQJOfx6C9GMH80DiTw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/spdx-correct": {
-      "version": "3.1.1",
-      "integrity": "sha512-cOYcUWwhCuHCXi49RhFRCyJEK3iPj1Ziz9DpViV3tbZOwXD49QzIN3MpOLJNxh2qwq2lJJZaKMVw9qNi4jTC0w==",
-      "dev": true,
-      "dependencies": {
-        "spdx-expression-parse": "^3.0.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "node_modules/spdx-exceptions": {
-      "version": "2.3.0",
-      "integrity": "sha512-/tTrYOC7PPI1nUAgx34hUpqXuyJG+DTHJTnIULG4rDygi4xu/tfgmq1e1cIRwRzwZgo4NLySi+ricLkZkw4i5A==",
-      "dev": true
-    },
-    "node_modules/spdx-expression-parse": {
-      "version": "3.0.1",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
-      "dev": true,
-      "dependencies": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "node_modules/spdx-license-ids": {
-      "version": "3.0.10",
-      "integrity": "sha512-oie3/+gKf7QtpitB0LYLETe+k8SifzsX4KixvpOsbI6S0kRiRQ5MKOio8eMSAKQ17N06+wdEOXRiId+zOxo0hA==",
-      "dev": true
-    },
-    "node_modules/specificity": {
-      "version": "0.4.1",
-      "integrity": "sha512-1klA3Gi5PD1Wv9Q0wUoOQN1IWAuPu0D1U03ThXTr0cJ20+/iq2tHSDnK7Kk/0LXJ1ztUB2/1Os0wKmfyNgUQfg==",
-      "dev": true,
-      "bin": {
-        "specificity": "bin/specificity"
-      }
-    },
-    "node_modules/split-string": {
-      "version": "3.1.0",
-      "integrity": "sha512-NzNVhJDYpwceVVii8/Hu6DKfD2G+NrQHlS/V/qgv763EYudVwEcMQNxd2lh+0VrUByXN/oJkl5grOhYWvQUYiw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "extend-shallow": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/split-string/node_modules/extend-shallow": {
-      "version": "3.0.2",
-      "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "assign-symbols": "^1.0.0",
-        "is-extendable": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/split-string/node_modules/is-extendable": {
-      "version": "1.0.1",
-      "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-plain-object": "^2.0.4"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/sprintf-js": {
-      "version": "1.0.3",
-      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw=",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/stack-utils": {
-      "version": "2.0.5",
-      "integrity": "sha512-xrQcmYhOsn/1kX+Vraq+7j4oE2j/6BFscZ0etmYg81xuM8Gq0022Pxb8+IqgOFUIaxHs0KaSb7T1+OegiNrNFA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "escape-string-regexp": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/stack-utils/node_modules/escape-string-regexp": {
-      "version": "2.0.0",
-      "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/state-toggle": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/state-toggle/-/state-toggle-1.0.3.tgz",
-      "integrity": "sha512-d/5Z4/2iiCnHw6Xzghyhb+GcmF89bxwgXG60wjIiZaxnymbyOmI8Hk4VqHXiVVp6u2ysaskFfXg3ekCj4WNftQ==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/static-extend": {
-      "version": "0.1.2",
-      "integrity": "sha1-YICcOcv/VTNyJv1eC1IPNB8ftcY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "define-property": "^0.2.5",
-        "object-copy": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/static-extend/node_modules/define-property": {
-      "version": "0.2.5",
-      "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-descriptor": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/static-extend/node_modules/is-accessor-descriptor": {
-      "version": "0.1.6",
-      "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/static-extend/node_modules/is-accessor-descriptor/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/static-extend/node_modules/is-buffer": {
-      "version": "1.1.6",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/static-extend/node_modules/is-data-descriptor": {
-      "version": "0.1.4",
-      "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/static-extend/node_modules/is-data-descriptor/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/static-extend/node_modules/is-descriptor": {
-      "version": "0.1.6",
-      "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-accessor-descriptor": "^0.1.6",
-        "is-data-descriptor": "^0.1.4",
-        "kind-of": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/static-extend/node_modules/kind-of": {
-      "version": "5.1.0",
-      "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/stop-iteration-iterator": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/stop-iteration-iterator/-/stop-iteration-iterator-1.0.0.tgz",
-      "integrity": "sha512-iCGQj+0l0HOdZ2AEeBADlsRC+vsnDsZsbdSiH1yNSjcfKM7fdpCMfqAL/dwF5BLiw/XhRft/Wax6zQbhq2BcjQ==",
-      "dev": true,
-      "dependencies": {
-        "internal-slot": "^1.0.4"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      }
-    },
-    "node_modules/streamsearch": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz",
-      "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==",
-      "dev": true,
-      "engines": {
-        "node": ">=10.0.0"
-      }
-    },
-    "node_modules/string_decoder": {
-      "version": "1.3.0",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
-      "dev": true,
-      "dependencies": {
-        "safe-buffer": "~5.2.0"
-      }
-    },
-    "node_modules/string_decoder/node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ]
-    },
-    "node_modules/string-argv": {
-      "version": "0.3.1",
-      "integrity": "sha512-a1uQGz7IyVy9YwhqjZIZu1c8JO8dNIe20xBmSS6qu9kv++k3JGzCVmprbNN5Kn+BgzD5E7YYwg1CcjuJMRNsvg==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.6.19"
-      }
-    },
-    "node_modules/string-length": {
-      "version": "4.0.2",
-      "integrity": "sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "char-regex": "^1.0.2",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/string-width": {
-      "version": "4.2.3",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/string-width/node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "dev": true
-    },
-    "node_modules/string.prototype.matchall": {
-      "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/string.prototype.matchall/-/string.prototype.matchall-4.0.8.tgz",
-      "integrity": "sha512-6zOCOcJ+RJAQshcTvXPHoxoQGONa3e/Lqx90wUA+wEzX78sg5Bo+1tQo4N0pohS0erG9qtCqJDjNCQBjeWVxyg==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "get-intrinsic": "^1.1.3",
-        "has-symbols": "^1.0.3",
-        "internal-slot": "^1.0.3",
-        "regexp.prototype.flags": "^1.4.3",
-        "side-channel": "^1.0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/string.prototype.trimend": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.6.tgz",
-      "integrity": "sha512-JySq+4mrPf9EsDBEDYMOb/lM7XQLulwg5R/m1r0PXEFqrV0qHvl58sdTilSXtKOflCsK2E8jxf+GKC0T07RWwQ==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/string.prototype.trimstart": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.6.tgz",
-      "integrity": "sha512-omqjMDaY92pbn5HOX7f9IccLA+U1tA9GvtU4JrodiXFfYB7jPzzHpRzpglLAjtUV6bB557zwClJezTqnAiYnQA==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/stringify-entities": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-3.1.0.tgz",
-      "integrity": "sha512-3FP+jGMmMV/ffZs86MoghGqAoqXAdxLrJP4GUdrDN1aIScYih5tuIO3eF4To5AJZ79KDZ8Fpdy7QJnK8SsL1Vg==",
-      "dev": true,
-      "dependencies": {
-        "character-entities-html4": "^1.0.0",
-        "character-entities-legacy": "^1.0.0",
-        "xtend": "^4.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/stringify-object": {
-      "version": "3.3.0",
-      "integrity": "sha512-rHqiFh1elqCQ9WPLIC8I0Q/g/wj5J1eMkyoiD6eoQApWHP0FtlK7rqnhmabL5VUY9JQCcqwwvlOaSuutekgyrw==",
-      "dev": true,
-      "dependencies": {
-        "get-own-enumerable-property-symbols": "^3.0.0",
-        "is-obj": "^1.0.1",
-        "is-regexp": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-bom": {
-      "version": "4.0.0",
-      "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-eof": {
-      "version": "1.0.0",
-      "integrity": "sha1-u0P/VZim6wXYm1n80SnJgzE2Br8=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/strip-final-newline": {
-      "version": "2.0.0",
-      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/strip-json-comments": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
-      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/style-search": {
-      "version": "0.1.0",
-      "integrity": "sha1-eVjHk+R+MuB9K1yv5cC/jhLneQI=",
-      "dev": true
-    },
-    "node_modules/styled-jsx": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.1.tgz",
-      "integrity": "sha512-pW7uC1l4mBZ8ugbiZrcIsiIvVx1UmTfw7UkC3Um2tmfUq9Bhk8IiyEIPl6F8agHgjzku6j0xQEZbfA5uSgSaCw==",
-      "dev": true,
-      "dependencies": {
-        "client-only": "0.0.1"
-      },
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "peerDependencies": {
-        "react": ">= 16.8.0 || 17.x.x || ^18.0.0-0"
-      },
-      "peerDependenciesMeta": {
-        "@babel/core": {
-          "optional": true
-        },
-        "babel-plugin-macros": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/stylelint": {
-      "version": "13.8.0",
-      "integrity": "sha512-iHH3dv3UI23SLDrH4zMQDjLT9/dDIz/IpoFeuNxZmEx86KtfpjDOscxLTFioQyv+2vQjPlRZnK0UoJtfxLICXQ==",
-      "dev": true,
-      "dependencies": {
-        "@stylelint/postcss-css-in-js": "^0.37.2",
-        "@stylelint/postcss-markdown": "^0.36.2",
-        "autoprefixer": "^9.8.6",
-        "balanced-match": "^1.0.0",
-        "chalk": "^4.1.0",
-        "cosmiconfig": "^7.0.0",
-        "debug": "^4.2.0",
-        "execall": "^2.0.0",
-        "fast-glob": "^3.2.4",
-        "fastest-levenshtein": "^1.0.12",
-        "file-entry-cache": "^6.0.0",
-        "get-stdin": "^8.0.0",
-        "global-modules": "^2.0.0",
-        "globby": "^11.0.1",
-        "globjoin": "^0.1.4",
-        "html-tags": "^3.1.0",
-        "ignore": "^5.1.8",
-        "import-lazy": "^4.0.0",
-        "imurmurhash": "^0.1.4",
-        "known-css-properties": "^0.20.0",
-        "lodash": "^4.17.20",
-        "log-symbols": "^4.0.0",
-        "mathml-tag-names": "^2.1.3",
-        "meow": "^8.0.0",
-        "micromatch": "^4.0.2",
-        "normalize-selector": "^0.2.0",
-        "postcss": "^7.0.35",
-        "postcss-html": "^0.36.0",
-        "postcss-less": "^3.1.4",
-        "postcss-media-query-parser": "^0.2.3",
-        "postcss-resolve-nested-selector": "^0.1.1",
-        "postcss-safe-parser": "^4.0.2",
-        "postcss-sass": "^0.4.4",
-        "postcss-scss": "^2.1.1",
-        "postcss-selector-parser": "^6.0.4",
-        "postcss-syntax": "^0.36.2",
-        "postcss-value-parser": "^4.1.0",
-        "resolve-from": "^5.0.0",
-        "slash": "^3.0.0",
-        "specificity": "^0.4.1",
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.0",
-        "style-search": "^0.1.0",
-        "sugarss": "^2.0.0",
-        "svg-tags": "^1.0.0",
-        "table": "^6.0.3",
-        "v8-compile-cache": "^2.2.0",
-        "write-file-atomic": "^3.0.3"
-      },
-      "bin": {
-        "stylelint": "bin/stylelint.js"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/stylelint"
-      }
-    },
-    "node_modules/stylelint-config-css-modules": {
-      "version": "2.2.0",
-      "integrity": "sha512-+zjcDbot+zbuxy1UA31k4G2lUG+nHUwnLyii3uT2F09B8kT2YrT9LZYNfMtAWlDidrxr7sFd5HX9EqPHGU3WKA==",
-      "dev": true,
-      "peerDependencies": {
-        "stylelint": "11.x - 13.x"
-      }
-    },
-    "node_modules/stylelint-config-prettier": {
-      "version": "8.0.2",
-      "integrity": "sha512-TN1l93iVTXpF9NJstlvP7nOu9zY2k+mN0NSFQ/VEGz15ZIP9ohdDZTtCWHs5LjctAhSAzaILULGbgiM0ItId3A==",
-      "dev": true,
-      "bin": {
-        "stylelint-config-prettier": "bin/check.js",
-        "stylelint-config-prettier-check": "bin/check.js"
-      },
-      "engines": {
-        "node": ">= 10",
-        "npm": ">= 5"
-      },
-      "peerDependencies": {
-        "stylelint": ">=11.0.0"
-      }
-    },
-    "node_modules/stylelint-config-recommended": {
-      "version": "3.0.0",
-      "integrity": "sha512-F6yTRuc06xr1h5Qw/ykb2LuFynJ2IxkKfCMf+1xqPffkxh0S09Zc902XCffcsw/XMFq/OzQ1w54fLIDtmRNHnQ==",
-      "dev": true,
-      "peerDependencies": {
-        "stylelint": ">=10.1.0"
-      }
-    },
-    "node_modules/stylelint-config-standard": {
-      "version": "20.0.0",
-      "integrity": "sha512-IB2iFdzOTA/zS4jSVav6z+wGtin08qfj+YyExHB3LF9lnouQht//YyB0KZq9gGz5HNPkddHOzcY8HsUey6ZUlA==",
-      "dev": true,
-      "dependencies": {
-        "stylelint-config-recommended": "^3.0.0"
-      },
-      "peerDependencies": {
-        "stylelint": ">=10.1.0"
-      }
-    },
-    "node_modules/stylelint-media-use-custom-media": {
-      "version": "2.0.0",
-      "integrity": "sha512-G7Hwma8HIMFJOChqrX9ie8hAGbtEMUbEjuiaR3olHIXjloDWqYlFHIJKsCyyckigkm+4LtCwtZDQASrVY4pRBg==",
-      "dev": true,
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "peerDependencies": {
-        "stylelint": "10 - 13"
-      }
-    },
-    "node_modules/stylelint-order": {
-      "version": "4.1.0",
-      "integrity": "sha512-sVTikaDvMqg2aJjh4r48jsdfmqLT+nqB1MOsaBnvM3OwLx4S+WXcsxsgk5w18h/OZoxZCxuyXMh61iBHcj9Qiw==",
-      "dev": true,
-      "dependencies": {
-        "lodash": "^4.17.15",
-        "postcss": "^7.0.31",
-        "postcss-sorting": "^5.0.1"
-      },
-      "peerDependencies": {
-        "stylelint": "^10.0.1 || ^11.0.0 || ^12.0.0 || ^13.0.0"
-      }
-    },
-    "node_modules/stylelint-order/node_modules/postcss": {
-      "version": "7.0.39",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-      "dev": true,
-      "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      }
-    },
-    "node_modules/stylelint-order/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/stylelint-use-nesting": {
-      "version": "3.0.0",
-      "integrity": "sha512-BMzhXWbK5DdAYtZMQULn7VmWZXpy8Rwlx2PgeNYqKInQrKTJWM/TFKPScc+xvsGUc/6JPiUDeQQij9gFnOo8Kg==",
-      "dev": true,
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "peerDependencies": {
-        "stylelint": "10 - 13"
-      }
-    },
-    "node_modules/stylelint-value-no-unknown-custom-properties": {
-      "version": "3.0.0",
-      "integrity": "sha512-8WoOnZ4ELTxA1cDbhwolIVOutxHwbjpXmd0lL0Li3Iye078jSnEb1KO6pJ/ig5oDVGRApFeA25Fyy4qqmqwGgg==",
-      "dev": true,
-      "dependencies": {
-        "postcss-values-parser": "^3.2.1"
-      },
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "peerDependencies": {
-        "stylelint": "10 - 13"
-      }
-    },
-    "node_modules/stylelint/node_modules/camelcase-keys": {
-      "version": "6.2.2",
-      "integrity": "sha512-YrwaA0vEKazPBkn0ipTiMpSajYDSe+KjQfrjhcBMxJt/znbvlHd8Pw/Vamaz5EB4Wfhs3SUR3Z9mwRu/P3s3Yg==",
-      "dev": true,
-      "dependencies": {
-        "camelcase": "^5.3.1",
-        "map-obj": "^4.0.0",
-        "quick-lru": "^4.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/stylelint/node_modules/find-up": {
-      "version": "4.1.0",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-      "dev": true,
-      "dependencies": {
-        "locate-path": "^5.0.0",
-        "path-exists": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/get-stdin": {
-      "version": "8.0.0",
-      "integrity": "sha512-sY22aA6xchAzprjyqmSEQv4UbAAzRN0L2dQB0NlN5acTTK9Don6nhoc3eAbUnpZiCANAMfd/+40kVdKfFygohg==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/stylelint/node_modules/hosted-git-info": {
-      "version": "4.0.2",
-      "integrity": "sha512-c9OGXbZ3guC/xOlCg1Ci/VgWlwsqDv1yMQL1CWqXDL0hDjXuNcq0zuR4xqPSuasI3kqFDhqSyTjREz5gzq0fXg==",
-      "dev": true,
-      "dependencies": {
-        "lru-cache": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/stylelint/node_modules/import-lazy": {
-      "version": "4.0.0",
-      "integrity": "sha512-rKtvo6a868b5Hu3heneU+L4yEQ4jYKLtjpnPeUdK7h0yzXGmyBTypknlkCvHFBqfX9YlorEiMM6Dnq/5atfHkw==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/locate-path": {
-      "version": "5.0.0",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-      "dev": true,
-      "dependencies": {
-        "p-locate": "^4.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/map-obj": {
-      "version": "4.3.0",
-      "integrity": "sha512-hdN1wVrZbb29eBGiGjJbeP8JbKjq1urkHJ/LIP/NY48MZ1QVXUsQBV1G1zvYFHn1XE06cwjBsOI2K3Ulnj1YXQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/stylelint/node_modules/meow": {
-      "version": "8.1.2",
-      "integrity": "sha512-r85E3NdZ+mpYk1C6RjPFEMSE+s1iZMuHtsHAqY0DT3jZczl0diWUZ8g6oU7h0M9cD2EL+PzaYghhCLzR0ZNn5Q==",
-      "dev": true,
-      "dependencies": {
-        "@types/minimist": "^1.2.0",
-        "camelcase-keys": "^6.2.2",
-        "decamelize-keys": "^1.1.0",
-        "hard-rejection": "^2.1.0",
-        "minimist-options": "4.1.0",
-        "normalize-package-data": "^3.0.0",
-        "read-pkg-up": "^7.0.1",
-        "redent": "^3.0.0",
-        "trim-newlines": "^3.0.0",
-        "type-fest": "^0.18.0",
-        "yargs-parser": "^20.2.3"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/stylelint/node_modules/normalize-package-data": {
-      "version": "3.0.3",
-      "integrity": "sha512-p2W1sgqij3zMMyRC067Dg16bfzVH+w7hyegmpIvZ4JNjqtGOVAIvLmjBx3yP7YTe9vKJgkoNOPjwQGogDoMXFA==",
-      "dev": true,
-      "dependencies": {
-        "hosted-git-info": "^4.0.1",
-        "is-core-module": "^2.5.0",
-        "semver": "^7.3.4",
-        "validate-npm-package-license": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/stylelint/node_modules/p-limit": {
-      "version": "2.3.0",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-      "dev": true,
-      "dependencies": {
-        "p-try": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/stylelint/node_modules/p-locate": {
-      "version": "4.1.0",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-      "dev": true,
-      "dependencies": {
-        "p-limit": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/path-exists": {
-      "version": "4.0.0",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/postcss": {
-      "version": "7.0.39",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-      "dev": true,
-      "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      }
-    },
-    "node_modules/stylelint/node_modules/read-pkg": {
-      "version": "5.2.0",
-      "integrity": "sha512-Ug69mNOpfvKDAc2Q8DRpMjjzdtrnv9HcSMX+4VsZxD1aZ6ZzrIE7rlzXBtWTyhULSMKg076AW6WR5iZpD0JiOg==",
-      "dev": true,
-      "dependencies": {
-        "@types/normalize-package-data": "^2.4.0",
-        "normalize-package-data": "^2.5.0",
-        "parse-json": "^5.0.0",
-        "type-fest": "^0.6.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/read-pkg-up": {
-      "version": "7.0.1",
-      "integrity": "sha512-zK0TB7Xd6JpCLmlLmufqykGE+/TlOePD6qKClNW7hHDKFh/J7/7gCWGR7joEQEW1bKq3a3yUZSObOoWLFQ4ohg==",
-      "dev": true,
-      "dependencies": {
-        "find-up": "^4.1.0",
-        "read-pkg": "^5.2.0",
-        "type-fest": "^0.8.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/stylelint/node_modules/read-pkg-up/node_modules/type-fest": {
-      "version": "0.8.1",
-      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/read-pkg/node_modules/hosted-git-info": {
-      "version": "2.8.9",
-      "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==",
-      "dev": true
-    },
-    "node_modules/stylelint/node_modules/read-pkg/node_modules/normalize-package-data": {
-      "version": "2.5.0",
-      "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
-      "dev": true,
-      "dependencies": {
-        "hosted-git-info": "^2.1.4",
-        "resolve": "^1.10.0",
-        "semver": "2 || 3 || 4 || 5",
-        "validate-npm-package-license": "^3.0.1"
-      }
-    },
-    "node_modules/stylelint/node_modules/read-pkg/node_modules/semver": {
-      "version": "5.7.1",
-      "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-      "dev": true,
-      "bin": {
-        "semver": "bin/semver"
-      }
-    },
-    "node_modules/stylelint/node_modules/read-pkg/node_modules/type-fest": {
-      "version": "0.6.0",
-      "integrity": "sha512-q+MB8nYR1KDLrgr4G5yemftpMC7/QLqVndBmEEdqzmNj5dcFOO4Oo8qlwZE3ULT3+Zim1F8Kq4cBnikNhlCMlg==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/redent": {
-      "version": "3.0.0",
-      "integrity": "sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==",
-      "dev": true,
-      "dependencies": {
-        "indent-string": "^4.0.0",
-        "strip-indent": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/resolve-from": {
-      "version": "5.0.0",
-      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/stylelint/node_modules/strip-indent": {
-      "version": "3.0.0",
-      "integrity": "sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==",
-      "dev": true,
-      "dependencies": {
-        "min-indent": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/trim-newlines": {
-      "version": "3.0.1",
-      "integrity": "sha512-c1PTsA3tYrIsLGkJkzHF+w9F2EyxfXGo4UyJc4pFL++FMjnq0HJS69T3M7d//gKrFKwy429bouPescbjecU+Zw==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/stylelint/node_modules/type-fest": {
-      "version": "0.18.1",
-      "integrity": "sha512-OIAYXk8+ISY+qTOwkHtKqzAuxchoMiD9Udx+FSGQDuiRR+PJKJHc2NJAXlbhkGwTt/4/nKZxELY1w3ReWOL8mw==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/sugarss": {
-      "version": "2.0.0",
-      "integrity": "sha512-WfxjozUk0UVA4jm+U1d736AUpzSrNsQcIbyOkoE364GrtWmIrFdk5lksEupgWMD4VaT/0kVx1dobpiDumSgmJQ==",
-      "dev": true,
-      "dependencies": {
-        "postcss": "^7.0.2"
-      }
-    },
-    "node_modules/sugarss/node_modules/postcss": {
-      "version": "7.0.39",
-      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-      "dev": true,
-      "dependencies": {
-        "picocolors": "^0.2.1",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      }
-    },
-    "node_modules/sugarss/node_modules/source-map": {
-      "version": "0.6.1",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/supports-color": {
-      "version": "7.2.0",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "dev": true,
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/supports-hyperlinks": {
-      "version": "2.2.0",
-      "integrity": "sha512-6sXEzV5+I5j8Bmq9/vUphGRM/RJNT9SCURJLjwfOg51heRtguGWDzcaBlgAzKhQa0EVNpPEKzQuBwZ8S8WaCeQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "has-flag": "^4.0.0",
-        "supports-color": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/supports-preserve-symlinks-flag": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
-      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
-      "dev": true,
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/svg-tags": {
-      "version": "1.0.0",
-      "integrity": "sha1-WPcc7jvVGbWdSyqEO2x95krAR2Q=",
-      "dev": true
-    },
-    "node_modules/symbol-tree": {
-      "version": "3.2.4",
-      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/synckit": {
-      "version": "0.8.4",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.8.4.tgz",
-      "integrity": "sha512-Dn2ZkzMdSX827QbowGbU/4yjWuvNaCoScLLoMo/yKbu+P4GBR6cRGKZH27k6a9bRzdqcyd1DE96pQtQ6uNkmyw==",
-      "dev": true,
-      "dependencies": {
-        "@pkgr/utils": "^2.3.1",
-        "tslib": "^2.4.0"
-      },
-      "engines": {
-        "node": "^14.18.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/unts"
-      }
-    },
-    "node_modules/table": {
-      "version": "6.7.2",
-      "integrity": "sha512-UFZK67uvyNivLeQbVtkiUs8Uuuxv24aSL4/Vil2PJVtMgU8Lx0CYkP12uCGa3kjyQzOSgV1+z9Wkb82fCGsO0g==",
-      "dev": true,
-      "dependencies": {
-        "ajv": "^8.0.1",
-        "lodash.clonedeep": "^4.5.0",
-        "lodash.truncate": "^4.4.2",
-        "slice-ansi": "^4.0.0",
-        "string-width": "^4.2.3",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=10.0.0"
-      }
-    },
-    "node_modules/table/node_modules/ajv": {
-      "version": "8.6.3",
-      "integrity": "sha512-SMJOdDP6LqTkD0Uq8qLi+gMwSt0imXLSV080qFVwJCpH9U6Mb+SUGHAXM0KNbcBPguytWyvFxcHgMLe2D2XSpw==",
-      "dev": true,
-      "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2",
-        "uri-js": "^4.2.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/table/node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "dev": true
-    },
-    "node_modules/table/node_modules/slice-ansi": {
-      "version": "4.0.0",
-      "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "astral-regex": "^2.0.0",
-        "is-fullwidth-code-point": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/slice-ansi?sponsor=1"
-      }
-    },
-    "node_modules/tapable": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.2.1.tgz",
-      "integrity": "sha512-GNzQvQTOIP6RyTfE2Qxb8ZVlNmw0n88vp1szwWRimP02mnTsx3Wtn5qRdqY9w2XduFNUgvOwhNnQsjwCp+kqaQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/terminal-link": {
-      "version": "2.1.1",
-      "integrity": "sha512-un0FmiRUQNr5PJqy9kP7c40F5BOfpGlYTrxonDChEZB7pzZxRNp/bt+ymiy9/npwXya9KH99nJ/GXFIiUkYGFQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "ansi-escapes": "^4.2.1",
-        "supports-hyperlinks": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/test-exclude": {
-      "version": "6.0.0",
-      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@istanbuljs/schema": "^0.1.2",
-        "glob": "^7.1.4",
-        "minimatch": "^3.0.4"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/text-table": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
-      "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==",
-      "dev": true
-    },
-    "node_modules/throat": {
-      "version": "5.0.0",
-      "integrity": "sha512-fcwX4mndzpLQKBS1DVYhGAcYaYt7vsHNIvQV+WXMvnow5cgjPphq5CaayLaGsjRdSCKZFNGt7/GYAuXaNOiYCA==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/through": {
-      "version": "2.3.8",
-      "integrity": "sha1-DdTJ/6q8NXlgsbckEV1+Doai4fU=",
-      "dev": true
-    },
-    "node_modules/tiny-glob": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/tiny-glob/-/tiny-glob-0.2.9.tgz",
-      "integrity": "sha512-g/55ssRPUjShh+xkfx9UPDXqhckHEsHr4Vd9zX55oSdGZc/MD0m3sferOkwWtp98bv+kcVfEHtRJgBVJzelrzg==",
-      "dev": true,
-      "dependencies": {
-        "globalyzer": "0.1.0",
-        "globrex": "^0.1.2"
-      }
-    },
-    "node_modules/tlds": {
-      "version": "1.224.0",
-      "integrity": "sha512-Jgdc8SEijbDFUsmCn6Wk/f7E6jBLFZOG3U1xK0amGSfEH55Xx97ItUS/d2NngsuApjn11UeWCWj8Um3VRhseZQ==",
-      "dev": true,
-      "bin": {
-        "tlds": "bin.js"
-      }
-    },
-    "node_modules/tmp": {
-      "version": "0.0.33",
-      "integrity": "sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==",
-      "dev": true,
-      "dependencies": {
-        "os-tmpdir": "~1.0.2"
-      },
-      "engines": {
-        "node": ">=0.6.0"
-      }
-    },
-    "node_modules/tmpl": {
-      "version": "1.0.5",
-      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/to-fast-properties": {
-      "version": "2.0.0",
-      "integrity": "sha1-3F5pjL0HkmW8c+A3doGk5Og/YW4=",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/to-object-path": {
-      "version": "0.3.0",
-      "integrity": "sha1-KXWIt7Dn4KwI4E5nL4XB9JmeF68=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "kind-of": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/to-object-path/node_modules/is-buffer": {
-      "version": "1.1.6",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/to-object-path/node_modules/kind-of": {
-      "version": "3.2.2",
-      "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-buffer": "^1.1.5"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/to-regex": {
-      "version": "3.0.2",
-      "integrity": "sha512-FWtleNAtZ/Ki2qtqej2CXTOayOH9bHDQF+Q48VpWyDXjbYxA4Yz8iDB31zXOBUlOHHKidDbqGVrTUvQMPmBGBw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "define-property": "^2.0.2",
-        "extend-shallow": "^3.0.2",
-        "regex-not": "^1.0.2",
-        "safe-regex": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/to-regex-range": {
-      "version": "5.0.1",
-      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
-      "dev": true,
-      "dependencies": {
-        "is-number": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=8.0"
-      }
-    },
-    "node_modules/to-regex/node_modules/extend-shallow": {
-      "version": "3.0.2",
-      "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "assign-symbols": "^1.0.0",
-        "is-extendable": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/to-regex/node_modules/is-extendable": {
-      "version": "1.0.1",
-      "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "is-plain-object": "^2.0.4"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/tough-cookie": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.3.tgz",
-      "integrity": "sha512-aX/y5pVRkfRnfmuX+OdbSdXvPe6ieKX/G2s7e98f4poJHnqH3281gDPm/metm6E/WRamfx7WC4HUqkWHfQHprw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "psl": "^1.1.33",
-        "punycode": "^2.1.1",
-        "universalify": "^0.2.0",
-        "url-parse": "^1.5.3"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/tough-cookie/node_modules/punycode": {
-      "version": "2.1.1",
-      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/tough-cookie/node_modules/universalify": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.2.0.tgz",
-      "integrity": "sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 4.0.0"
-      }
-    },
-    "node_modules/tr46": {
-      "version": "2.1.0",
-      "integrity": "sha512-15Ih7phfcdP5YxqiB+iDtLoaTz4Nd35+IiAv0kQ5FNKHzXgdWqPoTIqEDDJmXceQt4JZk6lVPT8lnDlPpGDppw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "punycode": "^2.1.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/tr46/node_modules/punycode": {
-      "version": "2.1.1",
-      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/trim": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/trim/-/trim-0.0.1.tgz",
-      "integrity": "sha512-YzQV+TZg4AxpKxaTHK3c3D+kRDCGVEE7LemdlQZoQXn0iennk10RsIoY6ikzAqJTc9Xjl9C1/waHom/J86ziAQ==",
-      "dev": true
-    },
-    "node_modules/trim-trailing-lines": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/trim-trailing-lines/-/trim-trailing-lines-1.1.4.tgz",
-      "integrity": "sha512-rjUWSqnfTNrjbB9NQWfPMH/xRK1deHeGsHoVfpxJ++XeYXE0d6B1En37AHfw3jtfTU7dzMzZL2jjpe8Qb5gLIQ==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/trough": {
-      "version": "1.0.5",
-      "integrity": "sha512-rvuRbTarPXmMb79SmzEp8aqXNKcK+y0XaB298IXueQ8I2PsrATcPBCSPyK/dDNa2iWOhKlfNnOjdAOTBU/nkFA==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/ts-jest": {
-      "version": "26.5.6",
-      "integrity": "sha512-rua+rCP8DxpA8b4DQD/6X2HQS8Zy/xzViVYfEs2OQu68tkCuKLV0Md8pmX55+W24uRIyAsf/BajRfxOs+R2MKA==",
-      "dev": true,
-      "dependencies": {
-        "bs-logger": "0.x",
-        "buffer-from": "1.x",
-        "fast-json-stable-stringify": "2.x",
-        "jest-util": "^26.1.0",
-        "json5": "2.x",
-        "lodash": "4.x",
-        "make-error": "1.x",
-        "mkdirp": "1.x",
-        "semver": "7.x",
-        "yargs-parser": "20.x"
-      },
-      "bin": {
-        "ts-jest": "cli.js"
-      },
-      "engines": {
-        "node": ">= 10"
-      },
-      "peerDependencies": {
-        "jest": ">=26 <27",
-        "typescript": ">=3.8 <5.0"
-      }
-    },
-    "node_modules/ts-jest/node_modules/mkdirp": {
-      "version": "1.0.4",
-      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
-      "dev": true,
-      "bin": {
-        "mkdirp": "bin/cmd.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/tsconfig-paths": {
-      "version": "3.14.1",
-      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.14.1.tgz",
-      "integrity": "sha512-fxDhWnFSLt3VuTwtvJt5fpwxBHg5AdKWMsgcPOOIilyjymcYVZoCQF8fvFRezCNfblEXmi+PcM1eYHeOAgXCOQ==",
-      "dev": true,
-      "dependencies": {
-        "@types/json5": "^0.0.29",
-        "json5": "^1.0.1",
-        "minimist": "^1.2.6",
-        "strip-bom": "^3.0.0"
-      }
-    },
-    "node_modules/tsconfig-paths/node_modules/json5": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
-      "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
-      "dev": true,
-      "dependencies": {
-        "minimist": "^1.2.0"
-      },
-      "bin": {
-        "json5": "lib/cli.js"
-      }
-    },
-    "node_modules/tsconfig-paths/node_modules/strip-bom": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
-      "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/tslib": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.4.0.tgz",
-      "integrity": "sha512-d6xOpEDfsi2CZVlPQzGeux8XMwLT9hssAsaPYExaQMuYskwb+x1x7J371tWlbBdWHroy99KnVB6qIkUbs5X3UQ==",
-      "dev": true
-    },
-    "node_modules/tsutils": {
-      "version": "3.21.0",
-      "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-3.21.0.tgz",
-      "integrity": "sha512-mHKK3iUXL+3UF6xL5k0PEhKRUBKPBCv/+RkEOpjRWxxx27KKRBmmA60A9pgOUvMi8GKhRMPEmjBRPzs2W7O1OA==",
-      "dev": true,
-      "dependencies": {
-        "tslib": "^1.8.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      },
-      "peerDependencies": {
-        "typescript": ">=2.8.0 || >= 3.2.0-dev || >= 3.3.0-dev || >= 3.4.0-dev || >= 3.5.0-dev || >= 3.6.0-dev || >= 3.6.0-beta || >= 3.7.0-dev || >= 3.7.0-beta"
-      }
-    },
-    "node_modules/tsutils/node_modules/tslib": {
-      "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
-      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
-      "dev": true
-    },
-    "node_modules/type-check": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
-      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
-      "dev": true,
-      "dependencies": {
-        "prelude-ls": "^1.2.1"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/type-detect": {
-      "version": "4.0.8",
-      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/type-fest": {
-      "version": "0.21.3",
-      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/typed-array-length": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/typed-array-length/-/typed-array-length-1.0.4.tgz",
-      "integrity": "sha512-KjZypGq+I/H7HI5HlOoGHkWUUGq+Q0TPhQurLbyrVrvnKTBgzLhIJ7j6J/XTQOi0d1RjyZ0wdas8bKs2p0x3Ng==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "is-typed-array": "^1.1.9"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/typedarray-to-buffer": {
-      "version": "3.1.5",
-      "integrity": "sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==",
-      "dev": true,
-      "dependencies": {
-        "is-typedarray": "^1.0.0"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "4.4.3",
-      "integrity": "sha512-4xfscpisVgqqDfPaJo5vkd+Qd/ItkoagnHpufr+i2QCHBsNYp+G7UAoyFl8aPtx879u38wPV65rZ8qbGZijalA==",
-      "dev": true,
-      "peer": true,
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=4.2.0"
-      }
-    },
-    "node_modules/unbox-primitive": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.0.2.tgz",
-      "integrity": "sha512-61pPlCD9h51VoreyJ0BReideM3MDKMKnh6+V9L08331ipq6Q8OFXZYiqP6n/tbHx4s5I9uRhcye6BrbkizkBDw==",
-      "dev": true,
-      "dependencies": {
-        "call-bind": "^1.0.2",
-        "has-bigints": "^1.0.2",
-        "has-symbols": "^1.0.3",
-        "which-boxed-primitive": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/unherit": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/unherit/-/unherit-1.1.3.tgz",
-      "integrity": "sha512-Ft16BJcnapDKp0+J/rqFC3Rrk6Y/Ng4nzsC028k2jdDII/rdZ7Wd3pPT/6+vIIxRagwRc9K0IUX0Ra4fKvw+WQ==",
-      "dev": true,
-      "dependencies": {
-        "inherits": "^2.0.0",
-        "xtend": "^4.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/unified": {
-      "version": "9.2.0",
-      "integrity": "sha512-vx2Z0vY+a3YoTj8+pttM3tiJHCwY5UFbYdiWrwBEbHmK8pvsPj2rtAX2BFfgXen8T39CJWblWRDT4L5WGXtDdg==",
-      "dev": true,
-      "dependencies": {
-        "bail": "^1.0.0",
-        "extend": "^3.0.0",
-        "is-buffer": "^2.0.0",
-        "is-plain-obj": "^2.0.0",
-        "trough": "^1.0.0",
-        "vfile": "^4.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unified-lint-rule": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/unified-lint-rule/-/unified-lint-rule-2.1.1.tgz",
-      "integrity": "sha512-vsLHyLZFstqtGse2gvrGwasOmH8M2y+r2kQMoDSWzSqUkQx2MjHjvZuGSv5FUaiv4RQO1bHRajy7lSGp7XWq5A==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "trough": "^2.0.0",
-        "unified": "^10.0.0",
-        "vfile": "^5.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unified-lint-rule/node_modules/bail": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz",
-      "integrity": "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/unified-lint-rule/node_modules/is-plain-obj": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
-      "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
-      "dev": true,
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/unified-lint-rule/node_modules/trough": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/trough/-/trough-2.1.0.tgz",
-      "integrity": "sha512-AqTiAOLcj85xS7vQ8QkAV41hPDIJ71XJB4RCUrzo/1GM2CQwhkJGaf9Hgr7BOugMRpgGUrqRg/DrBDl4H40+8g==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    },
-    "node_modules/unified-lint-rule/node_modules/unified": {
-      "version": "10.1.2",
-      "resolved": "https://registry.npmjs.org/unified/-/unified-10.1.2.tgz",
-      "integrity": "sha512-pUSWAi/RAnVy1Pif2kAoeWNBa3JVrx0MId2LASj8G+7AiHWoKZNTomq6LG326T68U7/e263X6fTdcXIy7XnF7Q==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "bail": "^2.0.0",
-        "extend": "^3.0.0",
-        "is-buffer": "^2.0.0",
-        "is-plain-obj": "^4.0.0",
-        "trough": "^2.0.0",
-        "vfile": "^5.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unified-lint-rule/node_modules/unist-util-stringify-position": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-      "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unified-lint-rule/node_modules/vfile": {
-      "version": "5.3.7",
-      "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-      "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "is-buffer": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unified-lint-rule/node_modules/vfile-message": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-      "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unified/node_modules/is-plain-obj": {
-      "version": "2.1.0",
-      "integrity": "sha512-YWnfyRwxL/+SsrWYfOpUtz5b3YD+nyfkHvjbcanzk8zgyO4ASD67uVMRt8k5bM4lLMDnXfriRhOpemw+NfT1eA==",
-      "dev": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/union-value": {
-      "version": "1.0.1",
-      "integrity": "sha512-tJfXmxMeWYnczCVs7XAEvIV7ieppALdyepWMkHkwciRpZraG/xwT+s2JN8+pr1+8jCRf80FFzvr+MpQeeoF4Xg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "arr-union": "^3.1.0",
-        "get-value": "^2.0.6",
-        "is-extendable": "^0.1.1",
-        "set-value": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/unist-util-find-all-after": {
-      "version": "3.0.2",
-      "integrity": "sha512-xaTC/AGZ0rIM2gM28YVRAFPIZpzbpDtU3dRmp7EXlNVA8ziQc4hY3H7BHXM1J49nEmiqc3svnqMReW+PGqbZKQ==",
-      "dev": true,
-      "dependencies": {
-        "unist-util-is": "^4.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-is": {
-      "version": "4.1.0",
-      "integrity": "sha512-ZOQSsnce92GrxSqlnEEseX0gi7GH9zTJZ0p9dtu87WRb/37mMPO2Ilx1s/t9vBHrFhbgweUwb+t7cIn5dxPhZg==",
-      "dev": true,
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-remove-position": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/unist-util-remove-position/-/unist-util-remove-position-2.0.1.tgz",
-      "integrity": "sha512-fDZsLYIe2uT+oGFnuZmy73K6ZxOPG/Qcm+w7jbEjaFcJgbQ6cqjs/eSPzXhsmGpAsWPkqZM9pYjww5QTn3LHMA==",
-      "dev": true,
-      "dependencies": {
-        "unist-util-visit": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-remove-position/node_modules/unist-util-visit": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-2.0.3.tgz",
-      "integrity": "sha512-iJ4/RczbJMkD0712mGktuGpm/U4By4FfDonL7N/9tATGIF4imikjOuagyMY53tnZq3NP6BcmlrHhEKAfGWjh7Q==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-is": "^4.0.0",
-        "unist-util-visit-parents": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-remove-position/node_modules/unist-util-visit-parents": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-3.1.1.tgz",
-      "integrity": "sha512-1KROIZWo6bcMrZEwiH2UrXDyalAa0uqzWCxCJj6lPOvTve2WkfgCytoDTPaMnodXh1WrXOq0haVYHj99ynJlsg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-is": "^4.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-stringify-position": {
-      "version": "2.0.3",
-      "integrity": "sha512-3faScn5I+hy9VleOq/qNbAd6pAx7iH5jYBMS9I1HgQVijz/4mv5Bvw5iw1sC/90CODiKo81G/ps8AJrISn687g==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.2"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-visit": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-4.1.2.tgz",
-      "integrity": "sha512-MSd8OUGISqHdVvfY9TPhyK2VdUrPgxkUtWSuMHF6XAAFuL4LokseigBnZtPnJMu+FbynTkFNnFlyjxpVKujMRg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-is": "^5.0.0",
-        "unist-util-visit-parents": "^5.1.1"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-visit-parents": {
-      "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-5.1.3.tgz",
-      "integrity": "sha512-x6+y8g7wWMyQhL1iZfhIPhDAs7Xwbn9nRosDXl7qoPTSCy0yNxnKc+hWokFifWQIDGi154rdUqKvbCa4+1kLhg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-is": "^5.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-visit-parents/node_modules/unist-util-is": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-5.2.0.tgz",
-      "integrity": "sha512-Glt17jWwZeyqrFqOK0pF1Ded5U3yzJnFr8CG1GMjCWTp9zDo2p+cmD6pWbZU8AgM5WU3IzRv6+rBwhzsGh6hBQ==",
-      "dev": true,
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/unist-util-visit/node_modules/unist-util-is": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-5.2.0.tgz",
-      "integrity": "sha512-Glt17jWwZeyqrFqOK0pF1Ded5U3yzJnFr8CG1GMjCWTp9zDo2p+cmD6pWbZU8AgM5WU3IzRv6+rBwhzsGh6hBQ==",
-      "dev": true,
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/universalify": {
-      "version": "1.0.0",
-      "integrity": "sha512-rb6X1W158d7pRQBg5gkR8uPaSfiids68LTJQYOtEUhoJUWBdaQHsuT/EUduxXYxcrt4r5PJ4fuHW1MHT6p0qug==",
-      "dev": true,
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
-    "node_modules/unset-value": {
-      "version": "1.0.0",
-      "integrity": "sha1-g3aHP30jNRef+x5vw6jtDfyKtVk=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "has-value": "^0.3.1",
-        "isobject": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/unset-value/node_modules/has-value": {
-      "version": "0.3.1",
-      "integrity": "sha1-ex9YutpiyoJ+wKIHgCVlSEWZXh8=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "get-value": "^2.0.3",
-        "has-values": "^0.1.4",
-        "isobject": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/unset-value/node_modules/has-value/node_modules/isobject": {
-      "version": "2.1.0",
-      "integrity": "sha1-8GVWEJaj8dou9GJy+BXIQNh+DIk=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "isarray": "1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/unset-value/node_modules/has-values": {
-      "version": "0.1.4",
-      "integrity": "sha1-bWHeldkd/Km5oCCJrThL/49it3E=",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/uri-js": {
-      "version": "4.4.1",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
-      "dev": true,
-      "dependencies": {
-        "punycode": "^2.1.0"
-      }
-    },
-    "node_modules/uri-js/node_modules/punycode": {
-      "version": "2.1.1",
-      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/urix": {
-      "version": "0.1.0",
-      "integrity": "sha1-2pN/emLiH+wf0Y1Js1wpNQZ6bHI=",
-      "deprecated": "Please see https://github.com/lydell/urix#deprecated",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/url-parse": {
-      "version": "1.5.10",
-      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
-      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "querystringify": "^2.1.1",
-        "requires-port": "^1.0.0"
-      }
-    },
-    "node_modules/url-regex": {
-      "version": "5.0.0",
-      "integrity": "sha512-O08GjTiAFNsSlrUWfqF1jH0H1W3m35ZyadHrGv5krdnmPPoxP27oDTqux/579PtaroiSGm5yma6KT1mHFH6Y/g==",
-      "dev": true,
-      "dependencies": {
-        "ip-regex": "^4.1.0",
-        "tlds": "^1.203.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/use": {
-      "version": "3.1.1",
-      "integrity": "sha512-cwESVXlO3url9YWlFW/TA9cshCEhtu7IKJ/p5soJ/gGpj7vbvFrAY/eIioQ6Dw23KjZhYgiIo8HOs1nQ2vr/oQ==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/util-deprecate": {
-      "version": "1.0.2",
-      "integrity": "sha1-RQ1Nyfpw3nMnYvvS1KKJgUGaDM8=",
-      "dev": true
-    },
-    "node_modules/uuid": {
-      "version": "8.3.2",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "dev": true,
-      "optional": true,
-      "peer": true,
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
-    "node_modules/v8-compile-cache": {
-      "version": "2.3.0",
-      "integrity": "sha512-l8lCEmLcLYZh4nbunNZvQCJc5pv7+RCwa8q/LdUx8u7lsWvPDKmpodJAJNwkAhJC//dFY48KuIEmjtd4RViDrA==",
-      "dev": true
-    },
-    "node_modules/v8-to-istanbul": {
-      "version": "7.1.2",
-      "integrity": "sha512-TxNb7YEUwkLXCQYeudi6lgQ/SZrzNO4kMdlqVxaZPUIUjCv6iSSypUQX70kNBSERpQ8fk48+d61FXk+tgqcWow==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "@types/istanbul-lib-coverage": "^2.0.1",
-        "convert-source-map": "^1.6.0",
-        "source-map": "^0.7.3"
-      },
-      "engines": {
-        "node": ">=10.10.0"
-      }
-    },
-    "node_modules/v8-to-istanbul/node_modules/source-map": {
-      "version": "0.7.3",
-      "integrity": "sha512-CkCj6giN3S+n9qrYiBTX5gystlENnRW5jZeNLHpe6aue+SrHcG5VYwujhW9s4dY31mEGsxBDrHR6oI69fTXsaQ==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/validate-npm-package-license": {
-      "version": "3.0.4",
-      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
-      "dev": true,
-      "dependencies": {
-        "spdx-correct": "^3.0.0",
-        "spdx-expression-parse": "^3.0.0"
-      }
-    },
-    "node_modules/vfile": {
-      "version": "4.2.1",
-      "integrity": "sha512-O6AE4OskCG5S1emQ/4gl8zK586RqA3srz3nfK/Viy0UPToBc5Trp9BVFb1u0CjsKrAWwnpr4ifM/KBXPWwJbCA==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "is-buffer": "^2.0.0",
-        "unist-util-stringify-position": "^2.0.0",
-        "vfile-message": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-location": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/vfile-location/-/vfile-location-3.2.0.tgz",
-      "integrity": "sha512-aLEIZKv/oxuCDZ8lkJGhuhztf/BW4M+iHdCwglA/eWc+vtuRFJj8EtgceYFX4LRjOhCAAiNHsKGssC6onJ+jbA==",
-      "dev": true,
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-matter": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/vfile-matter/-/vfile-matter-4.0.1.tgz",
-      "integrity": "sha512-ZeACdaxCOxhePpoLO4A5y/VgI9EuWBXu+sUk65aQ7lXBZDFg7X0tuOzigLJUtsQzazFt6K2m9SdlDxZdfL5vVg==",
-      "dev": true,
-      "dependencies": {
-        "is-buffer": "^2.0.0",
-        "vfile": "^5.0.0",
-        "yaml": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-matter/node_modules/unist-util-stringify-position": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-      "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-matter/node_modules/vfile": {
-      "version": "5.3.7",
-      "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-      "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "is-buffer": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-matter/node_modules/vfile-message": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-      "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-matter/node_modules/yaml": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.1.tgz",
-      "integrity": "sha512-e0WHiYql7+9wr4cWMx3TVQrNwejKaEe7/rHNmQmqRjazfOP5W8PB6Jpebb5o6fIapbz9o9+2ipcaTM2ZwDI6lw==",
-      "dev": true,
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/vfile-message": {
-      "version": "2.0.4",
-      "integrity": "sha512-DjssxRGkMvifUOJre00juHoP9DPWuzjxKuMDrhNbk2TdaYYBNMStsNhEOt3idrtI12VQYM/1+iM0KOzXi4pxwQ==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-stringify-position": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-reporter": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/vfile-reporter/-/vfile-reporter-7.0.5.tgz",
-      "integrity": "sha512-NdWWXkv6gcd7AZMvDomlQbK3MqFWL1RlGzMn++/O2TI+68+nqxCPTvLugdOtfSzXmjh+xUyhp07HhlrbJjT+mw==",
-      "dev": true,
-      "dependencies": {
-        "@types/supports-color": "^8.0.0",
-        "string-width": "^5.0.0",
-        "supports-color": "^9.0.0",
-        "unist-util-stringify-position": "^3.0.0",
-        "vfile": "^5.0.0",
-        "vfile-message": "^3.0.0",
-        "vfile-sort": "^3.0.0",
-        "vfile-statistics": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-reporter-json": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/vfile-reporter-json/-/vfile-reporter-json-3.3.0.tgz",
-      "integrity": "sha512-/zgRtjxQ2UGJn+HViiZ7+nIXtUzkkXFQum3BmaS/bSyr10P0X41ETRqqwMJ95RtbKUah3m7pKb6oS1eZeXXHzQ==",
-      "dev": true,
-      "dependencies": {
-        "vfile": "^5.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-reporter-json/node_modules/unist-util-stringify-position": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-      "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-reporter-json/node_modules/vfile": {
-      "version": "5.3.7",
-      "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-      "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "is-buffer": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-reporter-json/node_modules/vfile-message": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-      "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-reporter/node_modules/ansi-regex": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.1.tgz",
-      "integrity": "sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA==",
-      "dev": true,
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
-      }
-    },
-    "node_modules/vfile-reporter/node_modules/string-width": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
-      "dev": true,
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/vfile-reporter/node_modules/strip-ansi": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.0.1.tgz",
-      "integrity": "sha512-cXNxvT8dFNRVfhVME3JAe98mkXDYN2O1l7jmcwMnOslDeESg1rF/OZMtK0nRAhiari1unG5cD4jG3rapUAkLbw==",
-      "dev": true,
-      "dependencies": {
-        "ansi-regex": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
-      }
-    },
-    "node_modules/vfile-reporter/node_modules/supports-color": {
-      "version": "9.3.1",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-9.3.1.tgz",
-      "integrity": "sha512-knBY82pjmnIzK3NifMo3RxEIRD9E0kIzV4BKcyTZ9+9kWgLMxd4PrsTSMoFQUabgRBbF8KOLRDCyKgNV+iK44Q==",
-      "dev": true,
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/supports-color?sponsor=1"
-      }
-    },
-    "node_modules/vfile-reporter/node_modules/unist-util-stringify-position": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-      "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-reporter/node_modules/vfile": {
-      "version": "5.3.7",
-      "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-      "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "is-buffer": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-reporter/node_modules/vfile-message": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-      "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-sort": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/vfile-sort/-/vfile-sort-3.0.1.tgz",
-      "integrity": "sha512-1os1733XY6y0D5x0ugqSeaVJm9lYgj0j5qdcZQFyxlZOSy1jYarL77lLyb5gK4Wqr1d5OxmuyflSO3zKyFnTFw==",
-      "dev": true,
-      "dependencies": {
-        "vfile": "^5.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-sort/node_modules/unist-util-stringify-position": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-      "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-sort/node_modules/vfile": {
-      "version": "5.3.7",
-      "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-      "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "is-buffer": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-sort/node_modules/vfile-message": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-      "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-statistics": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/vfile-statistics/-/vfile-statistics-2.0.1.tgz",
-      "integrity": "sha512-W6dkECZmP32EG/l+dp2jCLdYzmnDBIw6jwiLZSER81oR5AHRcVqL+k3Z+pfH1R73le6ayDkJRMk0sutj1bMVeg==",
-      "dev": true,
-      "dependencies": {
-        "vfile": "^5.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-statistics/node_modules/unist-util-stringify-position": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-      "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-statistics/node_modules/vfile": {
-      "version": "5.3.7",
-      "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-      "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "is-buffer": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/vfile-statistics/node_modules/vfile-message": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-      "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-      "dev": true,
-      "dependencies": {
-        "@types/unist": "^2.0.0",
-        "unist-util-stringify-position": "^3.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/unified"
-      }
-    },
-    "node_modules/w3c-hr-time": {
-      "version": "1.0.2",
-      "integrity": "sha512-z8P5DvDNjKDoFIHK7q8r8lackT6l+jo/Ye3HOle7l9nICP9lf1Ci25fy9vHd0JOWewkIFzXIEig3TdKT7JQ5fQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "browser-process-hrtime": "^1.0.0"
-      }
-    },
-    "node_modules/w3c-xmlserializer": {
-      "version": "2.0.0",
-      "integrity": "sha512-4tzD0mF8iSiMiNs30BiLO3EpfGLZUT2MSX/G+o7ZywDzliWQ3OPtTZ0PTC3B3ca1UAf4cJMHB+2Bf56EriJuRA==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "xml-name-validator": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/walker": {
-      "version": "1.0.7",
-      "integrity": "sha1-L3+bj9ENZ3JisYqITijRlhjgKPs=",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "makeerror": "1.0.x"
-      }
-    },
-    "node_modules/watchpack": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.0.tgz",
-      "integrity": "sha512-Lcvm7MGST/4fup+ifyKi2hjyIAwcdI4HRgtvTpIUxBRhB+RFtUh8XtDOxUfctVCnhVi+QQj49i91OyvzkJl6cg==",
-      "dev": true,
-      "dependencies": {
-        "glob-to-regexp": "^0.4.1",
-        "graceful-fs": "^4.1.2"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/webidl-conversions": {
-      "version": "6.1.0",
-      "integrity": "sha512-qBIvFLGiBpLjfwmYAaHPXsn+ho5xZnGvyGvsarywGNc8VyQJUMHJ8OBKGGrPER0okBeMDaan4mNBlgBROxuI8w==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=10.4"
-      }
-    },
-    "node_modules/whatwg-encoding": {
-      "version": "1.0.5",
-      "integrity": "sha512-b5lim54JOPN9HtzvK9HFXvBma/rnfFeqsic0hSpjtDbVxR3dJKLc+KB4V6GgiGOvl7CY/KNh8rxSo9DKQrnUEw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "iconv-lite": "0.4.24"
-      }
-    },
-    "node_modules/whatwg-mimetype": {
-      "version": "2.3.0",
-      "integrity": "sha512-M4yMwr6mAnQz76TbJm914+gPpB/nCwvZbJU28cUD6dR004SAxDLOOSUaB1JDRqLtaOV/vi0IC5lEAGFgrjGv/g==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/whatwg-url": {
-      "version": "8.7.0",
-      "integrity": "sha512-gAojqb/m9Q8a5IV96E3fHJM70AzCkgt4uXYX2O7EmuyOnLrViCQlsEBmF9UQIu3/aeAIp2U17rtbpZWNntQqdg==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "lodash": "^4.7.0",
-        "tr46": "^2.1.0",
-        "webidl-conversions": "^6.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/which": {
-      "version": "2.0.2",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "dev": true,
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/which-boxed-primitive": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/which-boxed-primitive/-/which-boxed-primitive-1.0.2.tgz",
-      "integrity": "sha512-bwZdv0AKLpplFY2KZRX6TvyuN7ojjr7lwkg6ml0roIy9YeuSr7JS372qlNW18UQYzgYK9ziGcerWqZOmEn9VNg==",
-      "dev": true,
-      "dependencies": {
-        "is-bigint": "^1.0.1",
-        "is-boolean-object": "^1.1.0",
-        "is-number-object": "^1.0.4",
-        "is-string": "^1.0.5",
-        "is-symbol": "^1.0.3"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/which-collection": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/which-collection/-/which-collection-1.0.1.tgz",
-      "integrity": "sha512-W8xeTUwaln8i3K/cY1nGXzdnVZlidBcagyNFtBdD5kxnb4TvGKR7FfSIS3mYpwWS1QUCutfKz8IY8RjftB0+1A==",
-      "dev": true,
-      "dependencies": {
-        "is-map": "^2.0.1",
-        "is-set": "^2.0.1",
-        "is-weakmap": "^2.0.1",
-        "is-weakset": "^2.0.1"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/which-module": {
-      "version": "2.0.0",
-      "integrity": "sha1-2e8H3Od7mQK4o6j6SzHD4/fm6Ho=",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/which-typed-array": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.9.tgz",
-      "integrity": "sha512-w9c4xkx6mPidwp7180ckYWfMmvxpjlZuIudNtDf4N/tTAUB8VJbX25qZoAsrtGuYNnGw3pa0AXgbGKRB8/EceA==",
-      "dev": true,
-      "dependencies": {
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "gopd": "^1.0.1",
-        "has-tostringtag": "^1.0.0",
-        "is-typed-array": "^1.1.10"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/word-wrap": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.4.tgz",
-      "integrity": "sha512-2V81OA4ugVo5pRo46hAoD2ivUJx8jXmWXfUkY4KFNw0hEptvN0QfH3K4nHiwzGeKl5rFKedV48QVoqYavy4YpA==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/wrap-ansi": {
-      "version": "7.0.0",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "dev": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
-      "dev": true
-    },
-    "node_modules/write-file-atomic": {
-      "version": "3.0.3",
-      "integrity": "sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==",
-      "dev": true,
-      "dependencies": {
-        "imurmurhash": "^0.1.4",
-        "is-typedarray": "^1.0.0",
-        "signal-exit": "^3.0.2",
-        "typedarray-to-buffer": "^3.1.5"
-      }
-    },
-    "node_modules/ws": {
-      "version": "7.5.5",
-      "integrity": "sha512-BAkMFcAzl8as1G/hArkxOxq3G7pjUqQ3gzYbLL0/5zNkph70e+lCoxBGnm6AW1+/aiNeV4fnKqZ8m4GZewmH2w==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8.3.0"
-      },
-      "peerDependencies": {
-        "bufferutil": "^4.0.1",
-        "utf-8-validate": "^5.0.2"
-      },
-      "peerDependenciesMeta": {
-        "bufferutil": {
-          "optional": true
-        },
-        "utf-8-validate": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/xml-name-validator": {
-      "version": "3.0.0",
-      "integrity": "sha512-A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/xmlchars": {
-      "version": "2.2.0",
-      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/xtend": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
-      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.4"
-      }
-    },
-    "node_modules/y18n": {
-      "version": "4.0.3",
-      "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==",
-      "dev": true,
-      "peer": true
-    },
-    "node_modules/yallist": {
-      "version": "4.0.0",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
-      "dev": true
-    },
-    "node_modules/yaml": {
-      "version": "1.10.2",
-      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
-      "dev": true,
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/yargs": {
-      "version": "15.4.1",
-      "integrity": "sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "cliui": "^6.0.0",
-        "decamelize": "^1.2.0",
-        "find-up": "^4.1.0",
-        "get-caller-file": "^2.0.1",
-        "require-directory": "^2.1.1",
-        "require-main-filename": "^2.0.0",
-        "set-blocking": "^2.0.0",
-        "string-width": "^4.2.0",
-        "which-module": "^2.0.0",
-        "y18n": "^4.0.0",
-        "yargs-parser": "^18.1.2"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs-parser": {
-      "version": "20.2.9",
-      "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/yargs/node_modules/find-up": {
-      "version": "4.1.0",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "locate-path": "^5.0.0",
-        "path-exists": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/locate-path": {
-      "version": "5.0.0",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-locate": "^4.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/p-limit": {
-      "version": "2.3.0",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-try": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/yargs/node_modules/p-locate": {
-      "version": "4.1.0",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "p-limit": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/path-exists": {
-      "version": "4.0.0",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true,
-      "peer": true,
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/yargs-parser": {
-      "version": "18.1.3",
-      "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==",
-      "dev": true,
-      "peer": true,
-      "dependencies": {
-        "camelcase": "^5.0.0",
-        "decamelize": "^1.2.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/yocto-queue": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
-      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
-      "dev": true,
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/zod": {
-      "version": "3.20.6",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.20.6.tgz",
-      "integrity": "sha512-oyu0m54SGCtzh6EClBVqDDlAYRz4jrVtKwQ7ZnsEmMI9HnzuZFj8QFwAY1M5uniIYACdGvv0PBWPF2kO0aNofA==",
-      "dev": true,
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    },
-    "node_modules/zwitch": {
-      "version": "1.0.5",
-      "integrity": "sha512-V50KMwwzqJV0NpZIZFwfOD5/lyny3WlSzRiXgA0G7VUnRlqttta1L6UQIHzd6EuBY/cHGfwTIck7w1yH6Q5zUw==",
-      "dev": true,
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
-      }
-    }
-  },
-  "dependencies": {
-    "@babel/code-frame": {
-      "version": "7.22.13",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.22.13.tgz",
-      "integrity": "sha512-XktuhWlJ5g+3TJXc5upd9Ks1HutSArik6jf2eAjYFyIOf4ej3RN+184cZbzDvbPnuTJIUhPKKJE3cIsYTiAT3w==",
-      "dev": true,
-      "requires": {
-        "@babel/highlight": "^7.22.13",
-        "chalk": "^2.4.2"
-      },
-      "dependencies": {
-        "ansi-styles": {
-          "version": "3.2.1",
-          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-          "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-          "dev": true,
-          "requires": {
-            "color-convert": "^1.9.0"
-          }
-        },
-        "chalk": {
-          "version": "2.4.2",
-          "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-          "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^3.2.1",
-            "escape-string-regexp": "^1.0.5",
-            "supports-color": "^5.3.0"
-          }
-        },
-        "color-convert": {
-          "version": "1.9.3",
-          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-          "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-          "dev": true,
-          "requires": {
-            "color-name": "1.1.3"
-          }
-        },
-        "color-name": {
-          "version": "1.1.3",
-          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-          "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
-          "dev": true
-        },
-        "has-flag": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-          "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
-          "dev": true
-        },
-        "supports-color": {
-          "version": "5.5.0",
-          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-          "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-          "dev": true,
-          "requires": {
-            "has-flag": "^3.0.0"
-          }
-        }
-      }
-    },
-    "@babel/compat-data": {
-      "version": "7.15.0",
-      "integrity": "sha512-0NqAC1IJE0S0+lL1SWFMxMkz1pKCNCjI4tr2Zx4LJSXxCLAdr6KyArnY+sno5m3yH9g737ygOyPABDsnXkpxiA==",
-      "dev": true
-    },
-    "@babel/core": {
-      "version": "7.15.8",
-      "integrity": "sha512-3UG9dsxvYBMYwRv+gS41WKHno4K60/9GPy1CJaH6xy3Elq8CTtvtjT5R5jmNhXfCYLX2mTw+7/aq5ak/gOE0og==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.15.8",
-        "@babel/generator": "^7.15.8",
-        "@babel/helper-compilation-targets": "^7.15.4",
-        "@babel/helper-module-transforms": "^7.15.8",
-        "@babel/helpers": "^7.15.4",
-        "@babel/parser": "^7.15.8",
-        "@babel/template": "^7.15.4",
-        "@babel/traverse": "^7.15.4",
-        "@babel/types": "^7.15.6",
-        "convert-source-map": "^1.7.0",
-        "debug": "^4.1.0",
-        "gensync": "^1.0.0-beta.2",
-        "json5": "^2.1.2",
-        "semver": "^6.3.0",
-        "source-map": "^0.5.0"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "6.3.0",
-          "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-          "dev": true
-        }
-      }
-    },
-    "@babel/generator": {
-      "version": "7.23.0",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.23.0.tgz",
-      "integrity": "sha512-lN85QRR+5IbYrMWM6Y4pE/noaQtg4pNiqeNGX60eqOfo6gtEj6uw/JagelB8vVztSd7R6M5n1+PQkDbHbBRU4g==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.23.0",
-        "@jridgewell/gen-mapping": "^0.3.2",
-        "@jridgewell/trace-mapping": "^0.3.17",
-        "jsesc": "^2.5.1"
-      }
-    },
-    "@babel/helper-compilation-targets": {
-      "version": "7.15.4",
-      "integrity": "sha512-rMWPCirulnPSe4d+gwdWXLfAXTTBj8M3guAf5xFQJ0nvFY7tfNAFnWdqaHegHlgDZOCT4qvhF3BYlSJag8yhqQ==",
-      "dev": true,
-      "requires": {
-        "@babel/compat-data": "^7.15.0",
-        "@babel/helper-validator-option": "^7.14.5",
-        "browserslist": "^4.16.6",
-        "semver": "^6.3.0"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "6.3.0",
-          "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-          "dev": true
-        }
-      }
-    },
-    "@babel/helper-environment-visitor": {
-      "version": "7.22.20",
-      "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.22.20.tgz",
-      "integrity": "sha512-zfedSIzFhat/gFhWfHtgWvlec0nqB9YEIVrpuwjruLlXfUSnA8cJB0miHKwqDnQ7d32aKo2xt88/xZptwxbfhA==",
-      "dev": true
-    },
-    "@babel/helper-function-name": {
-      "version": "7.23.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.23.0.tgz",
-      "integrity": "sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw==",
-      "dev": true,
-      "requires": {
-        "@babel/template": "^7.22.15",
-        "@babel/types": "^7.23.0"
-      }
-    },
-    "@babel/helper-hoist-variables": {
-      "version": "7.22.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.22.5.tgz",
-      "integrity": "sha512-wGjk9QZVzvknA6yKIUURb8zY3grXCcOZt+/7Wcy8O2uctxhplmUPkOdlgoNhmdVee2c92JXbf1xpMtVNbfoxRw==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.22.5"
-      }
-    },
-    "@babel/helper-member-expression-to-functions": {
-      "version": "7.15.4",
-      "integrity": "sha512-cokOMkxC/BTyNP1AlY25HuBWM32iCEsLPI4BHDpJCHHm1FU2E7dKWWIXJgQgSFiu4lp8q3bL1BIKwqkSUviqtA==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.15.4"
-      }
-    },
-    "@babel/helper-module-imports": {
-      "version": "7.15.4",
-      "integrity": "sha512-jeAHZbzUwdW/xHgHQ3QmWR4Jg6j15q4w/gCfwZvtqOxoo5DKtLHk8Bsf4c5RZRC7NmLEs+ohkdq8jFefuvIxAA==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.15.4"
-      }
-    },
-    "@babel/helper-module-transforms": {
-      "version": "7.15.8",
-      "integrity": "sha512-DfAfA6PfpG8t4S6npwzLvTUpp0sS7JrcuaMiy1Y5645laRJIp/LiLGIBbQKaXSInK8tiGNI7FL7L8UvB8gdUZg==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-module-imports": "^7.15.4",
-        "@babel/helper-replace-supers": "^7.15.4",
-        "@babel/helper-simple-access": "^7.15.4",
-        "@babel/helper-split-export-declaration": "^7.15.4",
-        "@babel/helper-validator-identifier": "^7.15.7",
-        "@babel/template": "^7.15.4",
-        "@babel/traverse": "^7.15.4",
-        "@babel/types": "^7.15.6"
-      }
-    },
-    "@babel/helper-optimise-call-expression": {
-      "version": "7.15.4",
-      "integrity": "sha512-E/z9rfbAOt1vDW1DR7k4SzhzotVV5+qMciWV6LaG1g4jeFrkDlJedjtV4h0i4Q/ITnUu+Pk08M7fczsB9GXBDw==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.15.4"
-      }
-    },
-    "@babel/helper-plugin-utils": {
-      "version": "7.20.2",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.20.2.tgz",
-      "integrity": "sha512-8RvlJG2mj4huQ4pZ+rU9lqKi9ZKiRmuvGuM2HlWmkmgOhbs6zEAw6IEiJ5cQqGbDzGZOhwuOQNtZMi/ENLjZoQ==",
-      "dev": true
-    },
-    "@babel/helper-replace-supers": {
-      "version": "7.15.4",
-      "integrity": "sha512-/ztT6khaXF37MS47fufrKvIsiQkx1LBRvSJNzRqmbyeZnTwU9qBxXYLaaT/6KaxfKhjs2Wy8kG8ZdsFUuWBjzw==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-member-expression-to-functions": "^7.15.4",
-        "@babel/helper-optimise-call-expression": "^7.15.4",
-        "@babel/traverse": "^7.15.4",
-        "@babel/types": "^7.15.4"
-      }
-    },
-    "@babel/helper-simple-access": {
-      "version": "7.15.4",
-      "integrity": "sha512-UzazrDoIVOZZcTeHHEPYrr1MvTR/K+wgLg6MY6e1CJyaRhbibftF6fR2KU2sFRtI/nERUZR9fBd6aKgBlIBaPg==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.15.4"
-      }
-    },
-    "@babel/helper-split-export-declaration": {
-      "version": "7.22.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.22.6.tgz",
-      "integrity": "sha512-AsUnxuLhRYsisFiaJwvp1QF+I3KjD5FOxut14q/GzovUe6orHLesW2C7d754kRm53h5gqrz6sFl6sxc4BVtE/g==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.22.5"
-      }
-    },
-    "@babel/helper-string-parser": {
-      "version": "7.22.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.22.5.tgz",
-      "integrity": "sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==",
-      "dev": true
-    },
-    "@babel/helper-validator-identifier": {
-      "version": "7.22.20",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.20.tgz",
-      "integrity": "sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==",
-      "dev": true
-    },
-    "@babel/helper-validator-option": {
-      "version": "7.14.5",
-      "integrity": "sha512-OX8D5eeX4XwcroVW45NMvoYaIuFI+GQpA2a8Gi+X/U/cDUIRsV37qQfF905F0htTRCREQIB4KqPeaveRJUl3Ow==",
-      "dev": true
-    },
-    "@babel/helpers": {
-      "version": "7.15.4",
-      "integrity": "sha512-V45u6dqEJ3w2rlryYYXf6i9rQ5YMNu4FLS6ngs8ikblhu2VdR1AqAd6aJjBzmf2Qzh6KOLqKHxEN9+TFbAkAVQ==",
-      "dev": true,
-      "requires": {
-        "@babel/template": "^7.15.4",
-        "@babel/traverse": "^7.15.4",
-        "@babel/types": "^7.15.4"
-      }
-    },
-    "@babel/highlight": {
-      "version": "7.22.20",
-      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.22.20.tgz",
-      "integrity": "sha512-dkdMCN3py0+ksCgYmGG8jKeGA/8Tk+gJwSYYlFGxG5lmhfKNoAy004YpLxpS1W2J8m/EK2Ew+yOs9pVRwO89mg==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-validator-identifier": "^7.22.20",
-        "chalk": "^2.4.2",
-        "js-tokens": "^4.0.0"
-      },
-      "dependencies": {
-        "ansi-styles": {
-          "version": "3.2.1",
-          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-          "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-          "dev": true,
-          "requires": {
-            "color-convert": "^1.9.0"
-          }
-        },
-        "chalk": {
-          "version": "2.4.2",
-          "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-          "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^3.2.1",
-            "escape-string-regexp": "^1.0.5",
-            "supports-color": "^5.3.0"
-          }
-        },
-        "color-convert": {
-          "version": "1.9.3",
-          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-          "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-          "dev": true,
-          "requires": {
-            "color-name": "1.1.3"
-          }
-        },
-        "color-name": {
-          "version": "1.1.3",
-          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-          "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
-          "dev": true
-        },
-        "has-flag": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-          "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
-          "dev": true
-        },
-        "supports-color": {
-          "version": "5.5.0",
-          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-          "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-          "dev": true,
-          "requires": {
-            "has-flag": "^3.0.0"
-          }
-        }
-      }
-    },
-    "@babel/parser": {
-      "version": "7.23.0",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.23.0.tgz",
-      "integrity": "sha512-vvPKKdMemU85V9WE/l5wZEmImpCtLqbnTvqDS2U1fJ96KrxoW7KrXhNsNCblQlg8Ck4b85yxdTyelsMUgFUXiw==",
-      "dev": true
-    },
-    "@babel/plugin-proposal-object-rest-spread": {
-      "version": "7.12.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.12.1.tgz",
-      "integrity": "sha512-s6SowJIjzlhx8o7lsFx5zmY4At6CTtDvgNQDdPzkBQucle58A6b/TTeEBYtyDgmcXjUTM+vE8YOGHZzzbc/ioA==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.10.4",
-        "@babel/plugin-syntax-object-rest-spread": "^7.8.0",
-        "@babel/plugin-transform-parameters": "^7.12.1"
-      }
-    },
-    "@babel/plugin-syntax-async-generators": {
-      "version": "7.8.4",
-      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-bigint": {
-      "version": "7.8.3",
-      "integrity": "sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-class-properties": {
-      "version": "7.12.13",
-      "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.12.13"
-      }
-    },
-    "@babel/plugin-syntax-import-meta": {
-      "version": "7.10.4",
-      "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.10.4"
-      }
-    },
-    "@babel/plugin-syntax-json-strings": {
-      "version": "7.8.3",
-      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-jsx": {
-      "version": "7.12.1",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.12.1.tgz",
-      "integrity": "sha512-1yRi7yAtB0ETgxdY9ti/p2TivUxJkTdhu/ZbF9MshVGqOx1TdB3b7xCXs49Fupgg50N45KcAsRP/ZqWjs9SRjg==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.10.4"
-      }
-    },
-    "@babel/plugin-syntax-logical-assignment-operators": {
-      "version": "7.10.4",
-      "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.10.4"
-      }
-    },
-    "@babel/plugin-syntax-nullish-coalescing-operator": {
-      "version": "7.8.3",
-      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-numeric-separator": {
-      "version": "7.10.4",
-      "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.10.4"
-      }
-    },
-    "@babel/plugin-syntax-object-rest-spread": {
-      "version": "7.8.3",
-      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-optional-catch-binding": {
-      "version": "7.8.3",
-      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-optional-chaining": {
-      "version": "7.8.3",
-      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-top-level-await": {
-      "version": "7.14.5",
-      "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.14.5"
-      }
-    },
-    "@babel/plugin-transform-parameters": {
-      "version": "7.20.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.20.7.tgz",
-      "integrity": "sha512-WiWBIkeHKVOSYPO0pWkxGPfKeWrCJyD3NJ53+Lrp/QMSZbsVPovrVl2aWZ19D/LTVnaDv5Ap7GJ/B2CTOZdrfA==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.20.2"
-      }
-    },
-    "@babel/runtime": {
-      "version": "7.20.7",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.20.7.tgz",
-      "integrity": "sha512-UF0tvkUtxwAgZ5W/KrkHf0Rn0fdnLDU9ScxBrEVNUprE/MzirjK4MJUX1/BVDv00Sv8cljtukVK1aky++X1SjQ==",
-      "dev": true,
-      "requires": {
-        "regenerator-runtime": "^0.13.11"
-      }
-    },
-    "@babel/template": {
-      "version": "7.22.15",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.22.15.tgz",
-      "integrity": "sha512-QPErUVm4uyJa60rkI73qneDacvdvzxshT3kksGqlGWYdOTIUOwJ7RDUL8sGqslY1uXWSL6xMFKEXDS3ox2uF0w==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.22.13",
-        "@babel/parser": "^7.22.15",
-        "@babel/types": "^7.22.15"
-      }
-    },
-    "@babel/traverse": {
-      "version": "7.23.2",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.23.2.tgz",
-      "integrity": "sha512-azpe59SQ48qG6nu2CzcMLbxUudtN+dOM9kDbUqGq3HXUJRlo7i8fvPoxQUzYgLZ4cMVmuZgm8vvBpNeRhd6XSw==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.22.13",
-        "@babel/generator": "^7.23.0",
-        "@babel/helper-environment-visitor": "^7.22.20",
-        "@babel/helper-function-name": "^7.23.0",
-        "@babel/helper-hoist-variables": "^7.22.5",
-        "@babel/helper-split-export-declaration": "^7.22.6",
-        "@babel/parser": "^7.23.0",
-        "@babel/types": "^7.23.0",
-        "debug": "^4.1.0",
-        "globals": "^11.1.0"
-      }
-    },
-    "@babel/types": {
-      "version": "7.23.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.23.0.tgz",
-      "integrity": "sha512-0oIyUfKoI3mSqMvsxBdclDwxXKXAUA8v/apZbc+iSyARYou1o8ZGDxbUYyLFoW2arqS2jDGqJuZvv1d/io1axg==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-string-parser": "^7.22.5",
-        "@babel/helper-validator-identifier": "^7.22.20",
-        "to-fast-properties": "^2.0.0"
-      }
-    },
-    "@bcoe/v8-coverage": {
-      "version": "0.2.3",
-      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
-      "dev": true,
-      "peer": true
-    },
-    "@cnakazawa/watch": {
-      "version": "1.0.4",
-      "integrity": "sha512-v9kIhKwjeZThiWrLmj0y17CWoyddASLj9O2yvbZkbvw/N3rWOYy9zkV66ursAoVr0mV15bL8g0c4QZUE6cdDoQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "exec-sh": "^0.3.2",
-        "minimist": "^1.2.0"
-      }
-    },
-    "@eslint/eslintrc": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-1.4.1.tgz",
-      "integrity": "sha512-XXrH9Uarn0stsyldqDYq8r++mROmWRI1xKMXa640Bb//SY1+ECYX6VzT6Lcx5frD0V30XieqJ0oX9I2Xj5aoMA==",
-      "dev": true,
-      "requires": {
-        "ajv": "^6.12.4",
-        "debug": "^4.3.2",
-        "espree": "^9.4.0",
-        "globals": "^13.19.0",
-        "ignore": "^5.2.0",
-        "import-fresh": "^3.2.1",
-        "js-yaml": "^4.1.0",
-        "minimatch": "^3.1.2",
-        "strip-json-comments": "^3.1.1"
-      },
-      "dependencies": {
-        "globals": {
-          "version": "13.19.0",
-          "resolved": "https://registry.npmjs.org/globals/-/globals-13.19.0.tgz",
-          "integrity": "sha512-dkQ957uSRWHw7CFXLUtUHQI3g3aWApYhfNR2O6jn/907riyTYKVBmxYVROkBcY614FSSeSJh7Xm7SrUWCxvJMQ==",
-          "dev": true,
-          "requires": {
-            "type-fest": "^0.20.2"
-          }
-        },
-        "type-fest": {
-          "version": "0.20.2",
-          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
-          "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
-          "dev": true
-        }
-      }
-    },
-    "@hashicorp/platform-cli": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/@hashicorp/platform-cli/-/platform-cli-2.6.0.tgz",
-      "integrity": "sha512-nMO7Uiy/A5CT/BCE9RyQt6/Uci7bxwTesxCNWkXlciyqlIrz9WmBa9hr710IiMoDzrzQ1tL6AgFIeTbXs4RTqA==",
-      "dev": true,
-      "requires": {
-        "@hashicorp/platform-cms": "0.3.0",
-        "@typescript-eslint/eslint-plugin": "^5.48.0",
-        "@typescript-eslint/parser": "^5.48.0",
-        "chalk": "4.1.0",
-        "commander": "7.2.0",
-        "ejs": "3.1.5",
-        "eslint": "^8.31.0",
-        "eslint-config-next": "^13.1.1",
-        "eslint-config-prettier": "^8.6.0",
-        "eslint-plugin-jsx-a11y": "^6.6.1",
-        "eslint-plugin-prettier": "^4.2.1",
-        "fs-extra": "9.0.1",
-        "globby": "11.0.1",
-        "inquirer": "7.3.3",
-        "lint-staged": "11.1.2",
-        "open": "7.3.0",
-        "prettier": "2.5.1",
-        "readdirp": "3.5.0",
-        "signale": "1.4.0",
-        "slugify": "1.4.6",
-        "stylelint": "13.8.0",
-        "stylelint-config-css-modules": "2.2.0",
-        "stylelint-config-prettier": "8.0.2",
-        "stylelint-config-standard": "20.0.0",
-        "stylelint-media-use-custom-media": "2.0.0",
-        "stylelint-order": "4.1.0",
-        "stylelint-use-nesting": "3.0.0",
-        "stylelint-value-no-unknown-custom-properties": "3.0.0",
-        "ts-jest": "^26.4.4"
-      },
-      "dependencies": {
-        "prettier": {
-          "version": "2.5.1",
-          "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.5.1.tgz",
-          "integrity": "sha512-vBZcPRUR5MZJwoyi3ZoyQlc1rXeEck8KgeC9AwwOn+exuxLxq5toTRDTSaVrXHxelDMHy9zlicw8u66yxoSUFg==",
-          "dev": true
-        }
-      }
-    },
-    "@hashicorp/platform-cms": {
-      "version": "0.3.0",
-      "integrity": "sha512-sRX9A+kDEZvfZy8PvGFbEaHjn5G1mEsHwTri1vDnrmKG8apE+ELlug83b0iEkD5wIJi9OqaewMIb0NrLxg9s5A==",
-      "dev": true,
-      "requires": {
-        "rivet-graphql": "0.3.1"
-      }
-    },
-    "@hashicorp/platform-content-conformance": {
-      "version": "0.0.9",
-      "resolved": "https://registry.npmjs.org/@hashicorp/platform-content-conformance/-/platform-content-conformance-0.0.9.tgz",
-      "integrity": "sha512-kotY/4M/0YjiUGPgXv9vbWMiZJV5N5tlXTN3e+VzTQlQfbEXP1xYDcs6pNMtxbxCwfS29pkNRIWAsnGVIbBISw==",
-      "dev": true,
-      "requires": {
-        "find-up": "^6.3.0",
-        "flat": "^5.0.2",
-        "globby": "^13.1.2",
-        "mdast-util-to-string": "^3.1.0",
-        "remark": "12.0.1",
-        "remark-mdx": "^1.6.22",
-        "unified-lint-rule": "^2.1.1",
-        "unist-util-stringify-position": "^3.0.2",
-        "unist-util-visit": "^4.1.1",
-        "vfile": "^5.3.6",
-        "vfile-matter": "^4.0.0",
-        "vfile-reporter": "^7.0.4",
-        "vfile-reporter-json": "^3.2.0",
-        "vfile-statistics": "^2.0.0",
-        "yaml": "^2.1.3",
-        "yargs": "^17.4.1",
-        "zod": "^3.19.1"
-      },
-      "dependencies": {
-        "cliui": {
-          "version": "8.0.1",
-          "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
-          "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
-          "dev": true,
-          "requires": {
-            "string-width": "^4.2.0",
-            "strip-ansi": "^6.0.1",
-            "wrap-ansi": "^7.0.0"
-          }
-        },
-        "find-up": {
-          "version": "6.3.0",
-          "resolved": "https://registry.npmjs.org/find-up/-/find-up-6.3.0.tgz",
-          "integrity": "sha512-v2ZsoEuVHYy8ZIlYqwPe/39Cy+cFDzp4dXPaxNvkEuouymu+2Jbz0PxpKarJHYJTmv2HWT3O382qY8l4jMWthw==",
-          "dev": true,
-          "requires": {
-            "locate-path": "^7.1.0",
-            "path-exists": "^5.0.0"
-          }
-        },
-        "globby": {
-          "version": "13.1.3",
-          "resolved": "https://registry.npmjs.org/globby/-/globby-13.1.3.tgz",
-          "integrity": "sha512-8krCNHXvlCgHDpegPzleMq07yMYTO2sXKASmZmquEYWEmCx6J5UTRbp5RwMJkTJGtcQ44YpiUYUiN0b9mzy8Bw==",
-          "dev": true,
-          "requires": {
-            "dir-glob": "^3.0.1",
-            "fast-glob": "^3.2.11",
-            "ignore": "^5.2.0",
-            "merge2": "^1.4.1",
-            "slash": "^4.0.0"
-          }
-        },
-        "locate-path": {
-          "version": "7.2.0",
-          "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-7.2.0.tgz",
-          "integrity": "sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==",
-          "dev": true,
-          "requires": {
-            "p-locate": "^6.0.0"
-          }
-        },
-        "mdast-util-to-string": {
-          "version": "3.1.1",
-          "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-3.1.1.tgz",
-          "integrity": "sha512-tGvhT94e+cVnQt8JWE9/b3cUQZWS732TJxXHktvP+BYo62PpYD53Ls/6cC60rW21dW+txxiM4zMdc6abASvZKA==",
-          "dev": true,
-          "requires": {
-            "@types/mdast": "^3.0.0"
-          }
-        },
-        "p-limit": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-4.0.0.tgz",
-          "integrity": "sha512-5b0R4txpzjPWVw/cXXUResoD4hb6U/x9BH08L7nw+GN1sezDzPdxeRvpc9c433fZhBan/wusjbCsqwqm4EIBIQ==",
-          "dev": true,
-          "requires": {
-            "yocto-queue": "^1.0.0"
-          }
-        },
-        "p-locate": {
-          "version": "6.0.0",
-          "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-6.0.0.tgz",
-          "integrity": "sha512-wPrq66Llhl7/4AGC6I+cqxT07LhXvWL08LNXz1fENOw0Ap4sRZZ/gZpTTJ5jpurzzzfS2W/Ge9BY3LgLjCShcw==",
-          "dev": true,
-          "requires": {
-            "p-limit": "^4.0.0"
-          }
-        },
-        "path-exists": {
-          "version": "5.0.0",
-          "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-5.0.0.tgz",
-          "integrity": "sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==",
-          "dev": true
-        },
-        "remark": {
-          "version": "12.0.1",
-          "resolved": "https://registry.npmjs.org/remark/-/remark-12.0.1.tgz",
-          "integrity": "sha512-gS7HDonkdIaHmmP/+shCPejCEEW+liMp/t/QwmF0Xt47Rpuhl32lLtDV1uKWvGoq+kxr5jSgg5oAIpGuyULjUw==",
-          "dev": true,
-          "requires": {
-            "remark-parse": "^8.0.0",
-            "remark-stringify": "^8.0.0",
-            "unified": "^9.0.0"
-          }
-        },
-        "remark-stringify": {
-          "version": "8.1.1",
-          "resolved": "https://registry.npmjs.org/remark-stringify/-/remark-stringify-8.1.1.tgz",
-          "integrity": "sha512-q4EyPZT3PcA3Eq7vPpT6bIdokXzFGp9i85igjmhRyXWmPs0Y6/d2FYwUNotKAWyLch7g0ASZJn/KHHcHZQ163A==",
-          "dev": true,
-          "requires": {
-            "ccount": "^1.0.0",
-            "is-alphanumeric": "^1.0.0",
-            "is-decimal": "^1.0.0",
-            "is-whitespace-character": "^1.0.0",
-            "longest-streak": "^2.0.1",
-            "markdown-escapes": "^1.0.0",
-            "markdown-table": "^2.0.0",
-            "mdast-util-compact": "^2.0.0",
-            "parse-entities": "^2.0.0",
-            "repeat-string": "^1.5.4",
-            "state-toggle": "^1.0.0",
-            "stringify-entities": "^3.0.0",
-            "unherit": "^1.0.4",
-            "xtend": "^4.0.1"
-          }
-        },
-        "slash": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
-          "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
-          "dev": true
-        },
-        "unist-util-stringify-position": {
-          "version": "3.0.3",
-          "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-          "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0"
-          }
-        },
-        "vfile": {
-          "version": "5.3.7",
-          "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-          "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "is-buffer": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0",
-            "vfile-message": "^3.0.0"
-          }
-        },
-        "vfile-message": {
-          "version": "3.1.4",
-          "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-          "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0"
-          }
-        },
-        "y18n": {
-          "version": "5.0.8",
-          "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-          "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
-          "dev": true
-        },
-        "yaml": {
-          "version": "2.2.1",
-          "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.1.tgz",
-          "integrity": "sha512-e0WHiYql7+9wr4cWMx3TVQrNwejKaEe7/rHNmQmqRjazfOP5W8PB6Jpebb5o6fIapbz9o9+2ipcaTM2ZwDI6lw==",
-          "dev": true
-        },
-        "yargs": {
-          "version": "17.7.1",
-          "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.1.tgz",
-          "integrity": "sha512-cwiTb08Xuv5fqF4AovYacTFNxk62th7LKJ6BL9IGUpTJrWoU7/7WdQGTP2SjKf1dUNBGzDd28p/Yfs/GI6JrLw==",
-          "dev": true,
-          "requires": {
-            "cliui": "^8.0.1",
-            "escalade": "^3.1.1",
-            "get-caller-file": "^2.0.5",
-            "require-directory": "^2.1.1",
-            "string-width": "^4.2.3",
-            "y18n": "^5.0.5",
-            "yargs-parser": "^21.1.1"
-          }
-        },
-        "yargs-parser": {
-          "version": "21.1.1",
-          "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
-          "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
-          "dev": true
-        },
-        "yocto-queue": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.0.0.tgz",
-          "integrity": "sha512-9bnSc/HEW2uRy67wc+T8UwauLuPJVn28jb+GtJY16iiKWyvmYJRXVT4UamsAEGQfPohgr2q4Tq0sQbQlxTfi1g==",
-          "dev": true
-        }
-      }
-    },
-    "@humanwhocodes/config-array": {
-      "version": "0.11.8",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.8.tgz",
-      "integrity": "sha512-UybHIJzJnR5Qc/MsD9Kr+RpO2h+/P1GhOwdiLPXK5TWk5sgTdu88bTD9UP+CKbPPh5Rni1u0GjAdYQLemG8g+g==",
-      "dev": true,
-      "requires": {
-        "@humanwhocodes/object-schema": "^1.2.1",
-        "debug": "^4.1.1",
-        "minimatch": "^3.0.5"
-      }
-    },
-    "@humanwhocodes/module-importer": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
-      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
-      "dev": true
-    },
-    "@humanwhocodes/object-schema": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-1.2.1.tgz",
-      "integrity": "sha512-ZnQMnLV4e7hDlUvw8H+U8ASL02SS2Gn6+9Ac3wGGLIe7+je2AeAOxPY+izIPJDfFDb7eDjev0Us8MO1iFRN8hA==",
-      "dev": true
-    },
-    "@istanbuljs/load-nyc-config": {
-      "version": "1.1.0",
-      "integrity": "sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "camelcase": "^5.3.1",
-        "find-up": "^4.1.0",
-        "get-package-type": "^0.1.0",
-        "js-yaml": "^3.13.1",
-        "resolve-from": "^5.0.0"
-      },
-      "dependencies": {
-        "argparse": {
-          "version": "1.0.10",
-          "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "sprintf-js": "~1.0.2"
-          }
-        },
-        "find-up": {
-          "version": "4.1.0",
-          "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "locate-path": "^5.0.0",
-            "path-exists": "^4.0.0"
-          }
-        },
-        "js-yaml": {
-          "version": "3.14.1",
-          "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "argparse": "^1.0.7",
-            "esprima": "^4.0.0"
-          }
-        },
-        "locate-path": {
-          "version": "5.0.0",
-          "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-locate": "^4.1.0"
-          }
-        },
-        "p-limit": {
-          "version": "2.3.0",
-          "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-try": "^2.0.0"
-          }
-        },
-        "p-locate": {
-          "version": "4.1.0",
-          "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-limit": "^2.2.0"
-          }
-        },
-        "path-exists": {
-          "version": "4.0.0",
-          "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-          "dev": true,
-          "peer": true
-        },
-        "resolve-from": {
-          "version": "5.0.0",
-          "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "@istanbuljs/schema": {
-      "version": "0.1.3",
-      "integrity": "sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==",
-      "dev": true,
-      "peer": true
-    },
-    "@jest/console": {
-      "version": "26.6.2",
-      "integrity": "sha512-IY1R2i2aLsLr7Id3S6p2BA82GNWryt4oSvEXLAKc+L2zdi89dSkE8xC1C+0kpATG4JhBJREnQOH7/zmccM2B0g==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "chalk": "^4.0.0",
-        "jest-message-util": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "slash": "^3.0.0"
-      }
-    },
-    "@jest/core": {
-      "version": "26.6.3",
-      "integrity": "sha512-xvV1kKbhfUqFVuZ8Cyo+JPpipAHHAV3kcDBftiduK8EICXmTFddryy3P7NfZt8Pv37rA9nEJBKCCkglCPt/Xjw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/console": "^26.6.2",
-        "@jest/reporters": "^26.6.2",
-        "@jest/test-result": "^26.6.2",
-        "@jest/transform": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "ansi-escapes": "^4.2.1",
-        "chalk": "^4.0.0",
-        "exit": "^0.1.2",
-        "graceful-fs": "^4.2.4",
-        "jest-changed-files": "^26.6.2",
-        "jest-config": "^26.6.3",
-        "jest-haste-map": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-regex-util": "^26.0.0",
-        "jest-resolve": "^26.6.2",
-        "jest-resolve-dependencies": "^26.6.3",
-        "jest-runner": "^26.6.3",
-        "jest-runtime": "^26.6.3",
-        "jest-snapshot": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jest-validate": "^26.6.2",
-        "jest-watcher": "^26.6.2",
-        "micromatch": "^4.0.2",
-        "p-each-series": "^2.1.0",
-        "rimraf": "^3.0.0",
-        "slash": "^3.0.0",
-        "strip-ansi": "^6.0.0"
-      }
-    },
-    "@jest/environment": {
-      "version": "26.6.2",
-      "integrity": "sha512-nFy+fHl28zUrRsCeMB61VDThV1pVTtlEokBRgqPrcT1JNq4yRNIyTHfyht6PqtUvY9IsuLGTrbG8kPXjSZIZwA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/fake-timers": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "jest-mock": "^26.6.2"
-      }
-    },
-    "@jest/fake-timers": {
-      "version": "26.6.2",
-      "integrity": "sha512-14Uleatt7jdzefLPYM3KLcnUl1ZNikaKq34enpb5XG9i81JpppDb5muZvonvKyrl7ftEHkKS5L5/eB/kxJ+bvA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "@sinonjs/fake-timers": "^6.0.1",
-        "@types/node": "*",
-        "jest-message-util": "^26.6.2",
-        "jest-mock": "^26.6.2",
-        "jest-util": "^26.6.2"
-      }
-    },
-    "@jest/globals": {
-      "version": "26.6.2",
-      "integrity": "sha512-85Ltnm7HlB/KesBUuALwQ68YTU72w9H2xW9FjZ1eL1U3lhtefjjl5c2MiUbpXt/i6LaPRvoOFJ22yCBSfQ0JIA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/environment": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "expect": "^26.6.2"
-      }
-    },
-    "@jest/reporters": {
-      "version": "26.6.2",
-      "integrity": "sha512-h2bW53APG4HvkOnVMo8q3QXa6pcaNt1HkwVsOPMBV6LD/q9oSpxNSYZQYkAnjdMjrJ86UuYeLo+aEZClV6opnw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@bcoe/v8-coverage": "^0.2.3",
-        "@jest/console": "^26.6.2",
-        "@jest/test-result": "^26.6.2",
-        "@jest/transform": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "chalk": "^4.0.0",
-        "collect-v8-coverage": "^1.0.0",
-        "exit": "^0.1.2",
-        "glob": "^7.1.2",
-        "graceful-fs": "^4.2.4",
-        "istanbul-lib-coverage": "^3.0.0",
-        "istanbul-lib-instrument": "^4.0.3",
-        "istanbul-lib-report": "^3.0.0",
-        "istanbul-lib-source-maps": "^4.0.0",
-        "istanbul-reports": "^3.0.2",
-        "jest-haste-map": "^26.6.2",
-        "jest-resolve": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jest-worker": "^26.6.2",
-        "node-notifier": "^8.0.0",
-        "slash": "^3.0.0",
-        "source-map": "^0.6.0",
-        "string-length": "^4.0.1",
-        "terminal-link": "^2.0.0",
-        "v8-to-istanbul": "^7.0.0"
-      },
-      "dependencies": {
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "@jest/source-map": {
-      "version": "26.6.2",
-      "integrity": "sha512-YwYcCwAnNmOVsZ8mr3GfnzdXDAl4LaenZP5z+G0c8bzC9/dugL8zRmxZzdoTl4IaS3CryS1uWnROLPFmb6lVvA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "callsites": "^3.0.0",
-        "graceful-fs": "^4.2.4",
-        "source-map": "^0.6.0"
-      },
-      "dependencies": {
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "@jest/test-result": {
-      "version": "26.6.2",
-      "integrity": "sha512-5O7H5c/7YlojphYNrK02LlDIV2GNPYisKwHm2QTKjNZeEzezCbwYs9swJySv2UfPMyZ0VdsmMv7jIlD/IKYQpQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/console": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/istanbul-lib-coverage": "^2.0.0",
-        "collect-v8-coverage": "^1.0.0"
-      }
-    },
-    "@jest/test-sequencer": {
-      "version": "26.6.3",
-      "integrity": "sha512-YHlVIjP5nfEyjlrSr8t/YdNfU/1XEt7c5b4OxcXCjyRhjzLYu/rO69/WHPuYcbCWkz8kAeZVZp2N2+IOLLEPGw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/test-result": "^26.6.2",
-        "graceful-fs": "^4.2.4",
-        "jest-haste-map": "^26.6.2",
-        "jest-runner": "^26.6.3",
-        "jest-runtime": "^26.6.3"
-      }
-    },
-    "@jest/transform": {
-      "version": "26.6.2",
-      "integrity": "sha512-E9JjhUgNzvuQ+vVAL21vlyfy12gP0GhazGgJC4h6qUt1jSdUXGWJ1wfu/X7Sd8etSgxV4ovT1pb9v5D6QW4XgA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/core": "^7.1.0",
-        "@jest/types": "^26.6.2",
-        "babel-plugin-istanbul": "^6.0.0",
-        "chalk": "^4.0.0",
-        "convert-source-map": "^1.4.0",
-        "fast-json-stable-stringify": "^2.0.0",
-        "graceful-fs": "^4.2.4",
-        "jest-haste-map": "^26.6.2",
-        "jest-regex-util": "^26.0.0",
-        "jest-util": "^26.6.2",
-        "micromatch": "^4.0.2",
-        "pirates": "^4.0.1",
-        "slash": "^3.0.0",
-        "source-map": "^0.6.1",
-        "write-file-atomic": "^3.0.0"
-      },
-      "dependencies": {
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "@jest/types": {
-      "version": "26.6.2",
-      "integrity": "sha512-fC6QCp7Sc5sX6g8Tvbmj4XUTbyrik0akgRy03yjXbQaBWWNWGE7SGtJk98m0N8nzegD/7SggrUlivxo5ax4KWQ==",
-      "dev": true,
-      "requires": {
-        "@types/istanbul-lib-coverage": "^2.0.0",
-        "@types/istanbul-reports": "^3.0.0",
-        "@types/node": "*",
-        "@types/yargs": "^15.0.0",
-        "chalk": "^4.0.0"
-      }
-    },
-    "@jridgewell/gen-mapping": {
-      "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.3.tgz",
-      "integrity": "sha512-HLhSWOLRi875zjjMG/r+Nv0oCW8umGb0BgEhyX3dDX3egwZtB8PqLnjz3yedt8R5StBrzcg4aBpnh8UA9D1BoQ==",
-      "dev": true,
-      "requires": {
-        "@jridgewell/set-array": "^1.0.1",
-        "@jridgewell/sourcemap-codec": "^1.4.10",
-        "@jridgewell/trace-mapping": "^0.3.9"
-      }
-    },
-    "@jridgewell/resolve-uri": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.1.tgz",
-      "integrity": "sha512-dSYZh7HhCDtCKm4QakX0xFpsRDqjjtZf/kjI/v3T3Nwt5r8/qz/M19F9ySyOqU94SXBmeG9ttTul+YnR4LOxFA==",
-      "dev": true
-    },
-    "@jridgewell/set-array": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
-      "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
-      "dev": true
-    },
-    "@jridgewell/sourcemap-codec": {
-      "version": "1.4.15",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.15.tgz",
-      "integrity": "sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg==",
-      "dev": true
-    },
-    "@jridgewell/trace-mapping": {
-      "version": "0.3.20",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.20.tgz",
-      "integrity": "sha512-R8LcPeWZol2zR8mmH3JeKQ6QRCFb7XgUhV9ZlGhHLGyg4wpPiPZNQOOWhFZhxKw8u//yTbNGI42Bx/3paXEQ+Q==",
-      "dev": true,
-      "requires": {
-        "@jridgewell/resolve-uri": "^3.1.0",
-        "@jridgewell/sourcemap-codec": "^1.4.14"
-      }
-    },
-    "@mdx-js/util": {
-      "version": "1.6.22",
-      "resolved": "https://registry.npmjs.org/@mdx-js/util/-/util-1.6.22.tgz",
-      "integrity": "sha512-H1rQc1ZOHANWBvPcW+JpGwr+juXSxM8Q8YCkm3GhZd8REu1fHR3z99CErO1p9pkcfcxZnMdIZdIsXkOHY0NilA==",
-      "dev": true
-    },
-    "@next/env": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/env/-/env-14.0.4.tgz",
-      "integrity": "sha512-irQnbMLbUNQpP1wcE5NstJtbuA/69kRfzBrpAD7Gsn8zm/CY6YQYc3HQBz8QPxwISG26tIm5afvvVbu508oBeQ==",
-      "dev": true
-    },
-    "@next/eslint-plugin-next": {
-      "version": "13.1.2",
-      "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-13.1.2.tgz",
-      "integrity": "sha512-WGaNVvIYphdriesP6r7jq/8l7u38tzotnVQuxc1RYKLqYYApSsrebti3OCPoT3Gx0pw2smPIFHH98RzcsgW5GQ==",
-      "dev": true,
-      "requires": {
-        "glob": "7.1.7"
-      },
-      "dependencies": {
-        "glob": {
-          "version": "7.1.7",
-          "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.7.tgz",
-          "integrity": "sha512-OvD9ENzPLbegENnYP5UUfJIirTg4+XwMWGaQfQTY0JenxNvvIKP3U3/tAQSPIu/lHxXYSZmpXlUHeqAIdKzBLQ==",
-          "dev": true,
-          "requires": {
-            "fs.realpath": "^1.0.0",
-            "inflight": "^1.0.4",
-            "inherits": "2",
-            "minimatch": "^3.0.4",
-            "once": "^1.3.0",
-            "path-is-absolute": "^1.0.0"
-          }
-        }
-      }
-    },
-    "@next/swc-darwin-arm64": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-14.0.4.tgz",
-      "integrity": "sha512-mF05E/5uPthWzyYDyptcwHptucf/jj09i2SXBPwNzbgBNc+XnwzrL0U6BmPjQeOL+FiB+iG1gwBeq7mlDjSRPg==",
-      "dev": true,
-      "optional": true
-    },
-    "@next/swc-darwin-x64": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-14.0.4.tgz",
-      "integrity": "sha512-IZQ3C7Bx0k2rYtrZZxKKiusMTM9WWcK5ajyhOZkYYTCc8xytmwSzR1skU7qLgVT/EY9xtXDG0WhY6fyujnI3rw==",
-      "dev": true,
-      "optional": true
-    },
-    "@next/swc-linux-arm64-gnu": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-14.0.4.tgz",
-      "integrity": "sha512-VwwZKrBQo/MGb1VOrxJ6LrKvbpo7UbROuyMRvQKTFKhNaXjUmKTu7wxVkIuCARAfiI8JpaWAnKR+D6tzpCcM4w==",
-      "dev": true,
-      "optional": true
-    },
-    "@next/swc-linux-arm64-musl": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-14.0.4.tgz",
-      "integrity": "sha512-8QftwPEW37XxXoAwsn+nXlodKWHfpMaSvt81W43Wh8dv0gkheD+30ezWMcFGHLI71KiWmHK5PSQbTQGUiidvLQ==",
-      "dev": true,
-      "optional": true
-    },
-    "@next/swc-linux-x64-gnu": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-14.0.4.tgz",
-      "integrity": "sha512-/s/Pme3VKfZAfISlYVq2hzFS8AcAIOTnoKupc/j4WlvF6GQ0VouS2Q2KEgPuO1eMBwakWPB1aYFIA4VNVh667A==",
-      "dev": true,
-      "optional": true
-    },
-    "@next/swc-linux-x64-musl": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-14.0.4.tgz",
-      "integrity": "sha512-m8z/6Fyal4L9Bnlxde5g2Mfa1Z7dasMQyhEhskDATpqr+Y0mjOBZcXQ7G5U+vgL22cI4T7MfvgtrM2jdopqWaw==",
-      "dev": true,
-      "optional": true
-    },
-    "@next/swc-win32-arm64-msvc": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-14.0.4.tgz",
-      "integrity": "sha512-7Wv4PRiWIAWbm5XrGz3D8HUkCVDMMz9igffZG4NB1p4u1KoItwx9qjATHz88kwCEal/HXmbShucaslXCQXUM5w==",
-      "dev": true,
-      "optional": true
-    },
-    "@next/swc-win32-ia32-msvc": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-ia32-msvc/-/swc-win32-ia32-msvc-14.0.4.tgz",
-      "integrity": "sha512-zLeNEAPULsl0phfGb4kdzF/cAVIfaC7hY+kt0/d+y9mzcZHsMS3hAS829WbJ31DkSlVKQeHEjZHIdhN+Pg7Gyg==",
-      "dev": true,
-      "optional": true
-    },
-    "@next/swc-win32-x64-msvc": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-14.0.4.tgz",
-      "integrity": "sha512-yEh2+R8qDlDCjxVpzOTEpBLQTEFAcP2A8fUFLaWNap9GitYKkKv1//y2S6XY6zsR4rCOPRpU7plYDR+az2n30A==",
-      "dev": true,
-      "optional": true
-    },
-    "@nodelib/fs.scandir": {
-      "version": "2.1.5",
-      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
-      "dev": true,
-      "requires": {
-        "@nodelib/fs.stat": "2.0.5",
-        "run-parallel": "^1.1.9"
-      }
-    },
-    "@nodelib/fs.stat": {
-      "version": "2.0.5",
-      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
-      "dev": true
-    },
-    "@nodelib/fs.walk": {
-      "version": "1.2.8",
-      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
-      "dev": true,
-      "requires": {
-        "@nodelib/fs.scandir": "2.1.5",
-        "fastq": "^1.6.0"
-      }
-    },
-    "@pkgr/utils": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/@pkgr/utils/-/utils-2.3.1.tgz",
-      "integrity": "sha512-wfzX8kc1PMyUILA+1Z/EqoE4UCXGy0iRGMhPwdfae1+f0OXlLqCk+By+aMzgJBzR9AzS4CDizioG6Ss1gvAFJw==",
-      "dev": true,
-      "requires": {
-        "cross-spawn": "^7.0.3",
-        "is-glob": "^4.0.3",
-        "open": "^8.4.0",
-        "picocolors": "^1.0.0",
-        "tiny-glob": "^0.2.9",
-        "tslib": "^2.4.0"
-      },
-      "dependencies": {
-        "open": {
-          "version": "8.4.0",
-          "resolved": "https://registry.npmjs.org/open/-/open-8.4.0.tgz",
-          "integrity": "sha512-XgFPPM+B28FtCCgSb9I+s9szOC1vZRSwgWsRUA5ylIxRTgKozqjOCrVOqGsYABPYK5qnfqClxZTFBa8PKt2v6Q==",
-          "dev": true,
-          "requires": {
-            "define-lazy-prop": "^2.0.0",
-            "is-docker": "^2.1.1",
-            "is-wsl": "^2.2.0"
-          }
-        },
-        "picocolors": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
-          "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==",
-          "dev": true
-        }
-      }
-    },
-    "@rushstack/eslint-patch": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@rushstack/eslint-patch/-/eslint-patch-1.2.0.tgz",
-      "integrity": "sha512-sXo/qW2/pAcmT43VoRKOJbDOfV3cYpq3szSVfIThQXNt+E4DfKj361vaAt3c88U5tPUxzEswam7GW48PJqtKAg==",
-      "dev": true
-    },
-    "@sinonjs/commons": {
-      "version": "1.8.3",
-      "integrity": "sha512-xkNcLAn/wZaX14RPlwizcKicDk9G3F8m2nU3L7Ukm5zBgTwiT0wsoFAHx9Jq56fJA1z/7uKGtCRu16sOUCLIHQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "type-detect": "4.0.8"
-      }
-    },
-    "@sinonjs/fake-timers": {
-      "version": "6.0.1",
-      "integrity": "sha512-MZPUxrmFubI36XS1DI3qmI0YdN1gks62JtFZvxR67ljjSNCeK6U08Zx4msEWOXuofgqUt6zPHSi1H9fbjR/NRA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@sinonjs/commons": "^1.7.0"
-      }
-    },
-    "@stylelint/postcss-css-in-js": {
-      "version": "0.37.2",
-      "integrity": "sha512-nEhsFoJurt8oUmieT8qy4nk81WRHmJynmVwn/Vts08PL9fhgIsMhk1GId5yAN643OzqEEb5S/6At2TZW7pqPDA==",
-      "dev": true,
-      "requires": {
-        "@babel/core": ">=7.9.0"
-      }
-    },
-    "@stylelint/postcss-markdown": {
-      "version": "0.36.2",
-      "integrity": "sha512-2kGbqUVJUGE8dM+bMzXG/PYUWKkjLIkRLWNh39OaADkiabDRdw8ATFCgbMz5xdIcvwspPAluSL7uY+ZiTWdWmQ==",
-      "dev": true,
-      "requires": {
-        "remark": "^13.0.0",
-        "unist-util-find-all-after": "^3.0.2"
-      }
-    },
-    "@swc/helpers": {
-      "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.2.tgz",
-      "integrity": "sha512-E4KcWTpoLHqwPHLxidpOqQbcrZVgi0rsmmZXUle1jXmJfuIf/UWpczUJ7MZZ5tlxytgJXyp0w4PGkkeLiuIdZw==",
-      "dev": true,
-      "requires": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "@tootallnate/once": {
-      "version": "1.1.2",
-      "integrity": "sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==",
-      "dev": true,
-      "peer": true
-    },
-    "@types/babel__core": {
-      "version": "7.1.16",
-      "integrity": "sha512-EAEHtisTMM+KaKwfWdC3oyllIqswlznXCIVCt7/oRNrh+DhgT4UEBNC/jlADNjvw7UnfbcdkGQcPVZ1xYiLcrQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/parser": "^7.1.0",
-        "@babel/types": "^7.0.0",
-        "@types/babel__generator": "*",
-        "@types/babel__template": "*",
-        "@types/babel__traverse": "*"
-      }
-    },
-    "@types/babel__generator": {
-      "version": "7.6.3",
-      "integrity": "sha512-/GWCmzJWqV7diQW54smJZzWbSFf4QYtF71WCKhcx6Ru/tFyQIY2eiiITcCAeuPbNSvT9YCGkVMqqvSk2Z0mXiA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/types": "^7.0.0"
-      }
-    },
-    "@types/babel__template": {
-      "version": "7.4.1",
-      "integrity": "sha512-azBFKemX6kMg5Io+/rdGT0dkGreboUVR0Cdm3fz9QJWpaQGJRQXl7C+6hOTCZcMll7KFyEQpgbYI2lHdsS4U7g==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/parser": "^7.1.0",
-        "@babel/types": "^7.0.0"
-      }
-    },
-    "@types/babel__traverse": {
-      "version": "7.14.2",
-      "integrity": "sha512-K2waXdXBi2302XUdcHcR1jCeU0LL4TD9HRs/gk0N2Xvrht+G/BfJa4QObBQZfhMdxiCpV3COl5Nfq4uKTeTnJA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/types": "^7.3.0"
-      }
-    },
-    "@types/graceful-fs": {
-      "version": "4.1.5",
-      "integrity": "sha512-anKkLmZZ+xm4p8JWBf4hElkM4XR+EZeA2M9BAkkTldmcyDY4mbdIJnRghDJH3Ov5ooY7/UAoENtmdMSkaAd7Cw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@types/node": "*"
-      }
-    },
-    "@types/istanbul-lib-coverage": {
-      "version": "2.0.3",
-      "integrity": "sha512-sz7iLqvVUg1gIedBOvlkxPlc8/uVzyS5OwGz1cKjXzkl3FpL3al0crU8YGU1WoHkxn0Wxbw5tyi6hvzJKNzFsw==",
-      "dev": true
-    },
-    "@types/istanbul-lib-report": {
-      "version": "3.0.0",
-      "integrity": "sha512-plGgXAPfVKFoYfa9NpYDAkseG+g6Jr294RqeqcqDixSbU34MZVJRi/P+7Y8GDpzkEwLaGZZOpKIEmeVZNtKsrg==",
-      "dev": true,
-      "requires": {
-        "@types/istanbul-lib-coverage": "*"
-      }
-    },
-    "@types/istanbul-reports": {
-      "version": "3.0.1",
-      "integrity": "sha512-c3mAZEuK0lvBp8tmuL74XRKn1+y2dcwOUpH7x4WrF6gk1GIgiluDRgMYQtw2OFcBvAJWlt6ASU3tSqxp0Uu0Aw==",
-      "dev": true,
-      "requires": {
-        "@types/istanbul-lib-report": "*"
-      }
-    },
-    "@types/json-schema": {
-      "version": "7.0.11",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.11.tgz",
-      "integrity": "sha512-wOuvG1SN4Us4rez+tylwwwCV1psiNVOkJeM3AUWUNWg/jDQY2+HE/444y5gc+jBmRqASOm2Oeh5c1axHobwRKQ==",
-      "dev": true
-    },
-    "@types/json5": {
-      "version": "0.0.29",
-      "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
-      "integrity": "sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==",
-      "dev": true
-    },
-    "@types/mdast": {
-      "version": "3.0.10",
-      "integrity": "sha512-W864tg/Osz1+9f4lrGTZpCSO5/z4608eUp19tbozkq2HJK6i3z1kT0H9tlADXuYIb1YYOBByU4Jsqkk75q48qA==",
-      "dev": true,
-      "requires": {
-        "@types/unist": "*"
-      }
-    },
-    "@types/minimist": {
-      "version": "1.2.2",
-      "integrity": "sha512-jhuKLIRrhvCPLqwPcx6INqmKeiA5EWrsCOPhrlFSrbrmU4ZMPjj5Ul/oLCMDO98XRUIwVm78xICz4EPCektzeQ==",
-      "dev": true
-    },
-    "@types/node": {
-      "version": "16.10.3",
-      "integrity": "sha512-ho3Ruq+fFnBrZhUYI46n/bV2GjwzSkwuT4dTf0GkuNFmnb8nq4ny2z9JEVemFi6bdEJanHLlYfy9c6FN9B9McQ==",
-      "dev": true
-    },
-    "@types/normalize-package-data": {
-      "version": "2.4.1",
-      "integrity": "sha512-Gj7cI7z+98M282Tqmp2K5EIsoouUEzbBJhQQzDE3jSIRk6r9gsz0oUokqIUR4u1R3dMHo0pDHM7sNOHyhulypw==",
-      "dev": true
-    },
-    "@types/parse-json": {
-      "version": "4.0.0",
-      "integrity": "sha512-//oorEZjL6sbPcKUaCdIGlIUeH26mgzimjBB77G6XRgnDl/L5wOnpyBGRe/Mmf5CVW3PwEBE1NjiMZ/ssFh4wA==",
-      "dev": true
-    },
-    "@types/prettier": {
-      "version": "2.4.1",
-      "integrity": "sha512-Fo79ojj3vdEZOHg3wR9ksAMRz4P3S5fDB5e/YWZiFnyFQI1WY2Vftu9XoXVVtJfxB7Bpce/QTqWSSntkz2Znrw==",
-      "dev": true,
-      "peer": true
-    },
-    "@types/semver": {
-      "version": "7.3.13",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.3.13.tgz",
-      "integrity": "sha512-21cFJr9z3g5dW8B0CVI9g2O9beqaThGQ6ZFBqHfwhzLDKUxaqTIy3vnfah/UPkfOiF2pLq+tGz+W8RyCskuslw==",
-      "dev": true
-    },
-    "@types/stack-utils": {
-      "version": "2.0.1",
-      "integrity": "sha512-Hl219/BT5fLAaz6NDkSuhzasy49dwQS/DSdu4MdggFB8zcXv7vflBI3xp7FEmkmdDkBUI2bPUNeMttp2knYdxw==",
-      "dev": true,
-      "peer": true
-    },
-    "@types/supports-color": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/@types/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-dPWnWsf+kzIG140B8z2w3fr5D03TLWbOAFQl45xUpI3vcizeXriNR5VYkWZ+WTMsUHqZ9Xlt3hrxGNANFyNQfw==",
-      "dev": true
-    },
-    "@types/unist": {
-      "version": "2.0.6",
-      "integrity": "sha512-PBjIUxZHOuj0R15/xuwJYjFi+KZdNFrehocChv4g5hu6aFroHue8m0lBP0POdK2nKzbw0cgV1mws8+V/JAcEkQ==",
-      "dev": true
-    },
-    "@types/yargs": {
-      "version": "15.0.14",
-      "integrity": "sha512-yEJzHoxf6SyQGhBhIYGXQDSCkJjB6HohDShto7m8vaKg9Yp0Yn8+71J9eakh2bnPg6BfsH9PRMhiRTZnd4eXGQ==",
-      "dev": true,
-      "requires": {
-        "@types/yargs-parser": "*"
-      }
-    },
-    "@types/yargs-parser": {
-      "version": "20.2.1",
-      "integrity": "sha512-7tFImggNeNBVMsn0vLrpn1H1uPrUBdnARPTpZoitY37ZrdJREzf7I16tMrlK3hen349gr1NYh8CmZQa7CTG6Aw==",
-      "dev": true
-    },
-    "@typescript-eslint/eslint-plugin": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-5.48.1.tgz",
-      "integrity": "sha512-9nY5K1Rp2ppmpb9s9S2aBiF3xo5uExCehMDmYmmFqqyxgenbHJ3qbarcLt4ITgaD6r/2ypdlcFRdcuVPnks+fQ==",
-      "dev": true,
-      "requires": {
-        "@typescript-eslint/scope-manager": "5.48.1",
-        "@typescript-eslint/type-utils": "5.48.1",
-        "@typescript-eslint/utils": "5.48.1",
-        "debug": "^4.3.4",
-        "ignore": "^5.2.0",
-        "natural-compare-lite": "^1.4.0",
-        "regexpp": "^3.2.0",
-        "semver": "^7.3.7",
-        "tsutils": "^3.21.0"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "7.3.8",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
-          "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
-          "dev": true,
-          "requires": {
-            "lru-cache": "^6.0.0"
-          }
-        }
-      }
-    },
-    "@typescript-eslint/parser": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.48.1.tgz",
-      "integrity": "sha512-4yg+FJR/V1M9Xoq56SF9Iygqm+r5LMXvheo6DQ7/yUWynQ4YfCRnsKuRgqH4EQ5Ya76rVwlEpw4Xu+TgWQUcdA==",
-      "dev": true,
-      "requires": {
-        "@typescript-eslint/scope-manager": "5.48.1",
-        "@typescript-eslint/types": "5.48.1",
-        "@typescript-eslint/typescript-estree": "5.48.1",
-        "debug": "^4.3.4"
-      }
-    },
-    "@typescript-eslint/scope-manager": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-5.48.1.tgz",
-      "integrity": "sha512-S035ueRrbxRMKvSTv9vJKIWgr86BD8s3RqoRZmsSh/s8HhIs90g6UlK8ZabUSjUZQkhVxt7nmZ63VJ9dcZhtDQ==",
-      "dev": true,
-      "requires": {
-        "@typescript-eslint/types": "5.48.1",
-        "@typescript-eslint/visitor-keys": "5.48.1"
-      }
-    },
-    "@typescript-eslint/type-utils": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-5.48.1.tgz",
-      "integrity": "sha512-Hyr8HU8Alcuva1ppmqSYtM/Gp0q4JOp1F+/JH5D1IZm/bUBrV0edoewQZiEc1r6I8L4JL21broddxK8HAcZiqQ==",
-      "dev": true,
-      "requires": {
-        "@typescript-eslint/typescript-estree": "5.48.1",
-        "@typescript-eslint/utils": "5.48.1",
-        "debug": "^4.3.4",
-        "tsutils": "^3.21.0"
-      }
-    },
-    "@typescript-eslint/types": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-5.48.1.tgz",
-      "integrity": "sha512-xHyDLU6MSuEEdIlzrrAerCGS3T7AA/L8Hggd0RCYBi0w3JMvGYxlLlXHeg50JI9Tfg5MrtsfuNxbS/3zF1/ATg==",
-      "dev": true
-    },
-    "@typescript-eslint/typescript-estree": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-5.48.1.tgz",
-      "integrity": "sha512-Hut+Osk5FYr+sgFh8J/FHjqX6HFcDzTlWLrFqGoK5kVUN3VBHF/QzZmAsIXCQ8T/W9nQNBTqalxi1P3LSqWnRA==",
-      "dev": true,
-      "requires": {
-        "@typescript-eslint/types": "5.48.1",
-        "@typescript-eslint/visitor-keys": "5.48.1",
-        "debug": "^4.3.4",
-        "globby": "^11.1.0",
-        "is-glob": "^4.0.3",
-        "semver": "^7.3.7",
-        "tsutils": "^3.21.0"
-      },
-      "dependencies": {
-        "globby": {
-          "version": "11.1.0",
-          "resolved": "https://registry.npmjs.org/globby/-/globby-11.1.0.tgz",
-          "integrity": "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==",
-          "dev": true,
-          "requires": {
-            "array-union": "^2.1.0",
-            "dir-glob": "^3.0.1",
-            "fast-glob": "^3.2.9",
-            "ignore": "^5.2.0",
-            "merge2": "^1.4.1",
-            "slash": "^3.0.0"
-          }
-        },
-        "semver": {
-          "version": "7.3.8",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
-          "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
-          "dev": true,
-          "requires": {
-            "lru-cache": "^6.0.0"
-          }
-        }
-      }
-    },
-    "@typescript-eslint/utils": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-5.48.1.tgz",
-      "integrity": "sha512-SmQuSrCGUOdmGMwivW14Z0Lj8dxG1mOFZ7soeJ0TQZEJcs3n5Ndgkg0A4bcMFzBELqLJ6GTHnEU+iIoaD6hFGA==",
-      "dev": true,
-      "requires": {
-        "@types/json-schema": "^7.0.9",
-        "@types/semver": "^7.3.12",
-        "@typescript-eslint/scope-manager": "5.48.1",
-        "@typescript-eslint/types": "5.48.1",
-        "@typescript-eslint/typescript-estree": "5.48.1",
-        "eslint-scope": "^5.1.1",
-        "eslint-utils": "^3.0.0",
-        "semver": "^7.3.7"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "7.3.8",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.8.tgz",
-          "integrity": "sha512-NB1ctGL5rlHrPJtFDVIVzTyQylMLu9N9VICA6HSFJo8MCGVTMW6gfpicwKmmK/dAjTOrqu5l63JJOpDSrAis3A==",
-          "dev": true,
-          "requires": {
-            "lru-cache": "^6.0.0"
-          }
-        }
-      }
-    },
-    "@typescript-eslint/visitor-keys": {
-      "version": "5.48.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-5.48.1.tgz",
-      "integrity": "sha512-Ns0XBwmfuX7ZknznfXozgnydyR8F6ev/KEGePP4i74uL3ArsKbEhJ7raeKr1JSa997DBDwol/4a0Y+At82c9dA==",
-      "dev": true,
-      "requires": {
-        "@typescript-eslint/types": "5.48.1",
-        "eslint-visitor-keys": "^3.3.0"
-      }
-    },
-    "abab": {
-      "version": "2.0.5",
-      "integrity": "sha512-9IK9EadsbHo6jLWIpxpR6pL0sazTXV6+SQv25ZB+F7Bj9mJNaOc4nCRabwd5M/JwmUa8idz6Eci6eKfJryPs6Q==",
-      "dev": true,
-      "peer": true
-    },
-    "acorn": {
-      "version": "7.4.1",
-      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
-      "dev": true,
-      "peer": true
-    },
-    "acorn-globals": {
-      "version": "6.0.0",
-      "integrity": "sha512-ZQl7LOWaF5ePqqcX4hLuv/bLXYQNfNWw2c0/yX/TsPRKamzHcTGQnlCjHT3TsmkOUVEPS3crCxiPfdzE/Trlhg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "acorn": "^7.1.1",
-        "acorn-walk": "^7.1.1"
-      }
-    },
-    "acorn-jsx": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
-      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
-      "dev": true,
-      "requires": {}
-    },
-    "acorn-walk": {
-      "version": "7.2.0",
-      "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA==",
-      "dev": true,
-      "peer": true
-    },
-    "agent-base": {
-      "version": "6.0.2",
-      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "debug": "4"
-      }
-    },
-    "aggregate-error": {
-      "version": "3.1.0",
-      "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==",
-      "dev": true,
-      "requires": {
-        "clean-stack": "^2.0.0",
-        "indent-string": "^4.0.0"
-      }
-    },
-    "ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
-      "dev": true,
-      "requires": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
-      }
-    },
-    "ansi-colors": {
-      "version": "4.1.1",
-      "integrity": "sha512-JoX0apGbHaUJBNl6yF+p6JAFYZ666/hhCGKN5t9QFjbJQKUU/g8MNbFDbvfrgKXvI1QpZplPOnwIo99lX/AAmA==",
-      "dev": true
-    },
-    "ansi-escapes": {
-      "version": "4.3.2",
-      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
-      "dev": true,
-      "requires": {
-        "type-fest": "^0.21.3"
-      }
-    },
-    "ansi-regex": {
-      "version": "5.0.1",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true
-    },
-    "ansi-styles": {
-      "version": "4.3.0",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "dev": true,
-      "requires": {
-        "color-convert": "^2.0.1"
-      }
-    },
-    "anymatch": {
-      "version": "3.1.2",
-      "integrity": "sha512-P43ePfOAIupkguHUycrc4qJ9kz8ZiuOUijaETwX7THt0Y/GNK7v0aa8rY816xWjZ7rJdA5XdMcpVFTKMq+RvWg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "normalize-path": "^3.0.0",
-        "picomatch": "^2.0.4"
-      }
-    },
-    "argparse": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
-      "dev": true
-    },
-    "aria-query": {
-      "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.1.3.tgz",
-      "integrity": "sha512-R5iJ5lkuHybztUfuOAznmboyjWq8O6sqNqtK7CLOqdydi54VNbORp49mb14KbWgG1QD3JFO9hJdZ+y4KutfdOQ==",
-      "dev": true,
-      "requires": {
-        "deep-equal": "^2.0.5"
-      }
-    },
-    "arr-diff": {
-      "version": "4.0.0",
-      "integrity": "sha1-1kYQdP6/7HHn4VI1dhoyml3HxSA=",
-      "dev": true,
-      "peer": true
-    },
-    "arr-flatten": {
-      "version": "1.1.0",
-      "integrity": "sha512-L3hKV5R/p5o81R7O02IGnwpDmkp6E982XhtbuwSe3O4qOtMMMtodicASA1Cny2U+aCXcNpml+m4dPsvsJ3jatg==",
-      "dev": true,
-      "peer": true
-    },
-    "arr-union": {
-      "version": "3.1.0",
-      "integrity": "sha1-45sJrqne+Gao8gbiiK9jkZuuOcQ=",
-      "dev": true,
-      "peer": true
-    },
-    "array-includes": {
-      "version": "3.1.6",
-      "resolved": "https://registry.npmjs.org/array-includes/-/array-includes-3.1.6.tgz",
-      "integrity": "sha512-sgTbLvL6cNnw24FnbaDyjmvddQ2ML8arZsgaJhoABMoplz/4QRhtrYS+alr1BUM1Bwp6dhx8vVCBSLG+StwOFw==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "get-intrinsic": "^1.1.3",
-        "is-string": "^1.0.7"
-      }
-    },
-    "array-union": {
-      "version": "2.1.0",
-      "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==",
-      "dev": true
-    },
-    "array-unique": {
-      "version": "0.3.2",
-      "integrity": "sha1-qJS3XUvE9s1nnvMkSp/Y9Gri1Cg=",
-      "dev": true,
-      "peer": true
-    },
-    "array.prototype.flat": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/array.prototype.flat/-/array.prototype.flat-1.3.1.tgz",
-      "integrity": "sha512-roTU0KWIOmJ4DRLmwKd19Otg0/mT3qPNt0Qb3GWW8iObuZXxrjB/pzn0R3hqpRSWg4HCwqx+0vwOnWnvlOyeIA==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "es-shim-unscopables": "^1.0.0"
-      }
-    },
-    "array.prototype.flatmap": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/array.prototype.flatmap/-/array.prototype.flatmap-1.3.1.tgz",
-      "integrity": "sha512-8UGn9O1FDVvMNB0UlLv4voxRMze7+FpHyF5mSMRjWHUMlpoDViniy05870VlxhfgTnLbpuwTzvD76MTtWxB/mQ==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "es-shim-unscopables": "^1.0.0"
-      }
-    },
-    "array.prototype.tosorted": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/array.prototype.tosorted/-/array.prototype.tosorted-1.1.1.tgz",
-      "integrity": "sha512-pZYPXPRl2PqWcsUs6LOMn+1f1532nEoPTYowBtqLwAW+W8vSVhkIGnmOX1t/UQjD6YGI0vcD2B1U7ZFGQH9jnQ==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "es-shim-unscopables": "^1.0.0",
-        "get-intrinsic": "^1.1.3"
-      }
-    },
-    "arrify": {
-      "version": "1.0.1",
-      "integrity": "sha1-iYUI2iIm84DfkEcoRWhJwVAaSw0=",
-      "dev": true
-    },
-    "assign-symbols": {
-      "version": "1.0.0",
-      "integrity": "sha1-WWZ/QfrdTyDMvCu5a41Pf3jsA2c=",
-      "dev": true,
-      "peer": true
-    },
-    "ast-types-flow": {
-      "version": "0.0.7",
-      "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.7.tgz",
-      "integrity": "sha512-eBvWn1lvIApYMhzQMsu9ciLfkBY499mFZlNqG+/9WR7PVlroQw0vG30cOQQbaKz3sCEc44TAOu2ykzqXSNnwag==",
-      "dev": true
-    },
-    "astral-regex": {
-      "version": "2.0.0",
-      "integrity": "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==",
-      "dev": true
-    },
-    "async": {
-      "version": "0.9.2",
-      "integrity": "sha1-rqdNXmHB+JlhO/ZL2mbUx48v0X0=",
-      "dev": true
-    },
-    "asynckit": {
-      "version": "0.4.0",
-      "integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k=",
-      "dev": true
-    },
-    "at-least-node": {
-      "version": "1.0.0",
-      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
-      "dev": true
-    },
-    "atob": {
-      "version": "2.1.2",
-      "integrity": "sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg==",
-      "dev": true,
-      "peer": true
-    },
-    "autoprefixer": {
-      "version": "9.8.8",
-      "integrity": "sha512-eM9d/swFopRt5gdJ7jrpCwgvEMIayITpojhkkSMRsFHYuH5bkSQ4p/9qTEHtmNudUZh22Tehu7I6CxAW0IXTKA==",
-      "dev": true,
-      "requires": {
-        "browserslist": "^4.12.0",
-        "caniuse-lite": "^1.0.30001109",
-        "normalize-range": "^0.1.2",
-        "num2fraction": "^1.2.2",
-        "picocolors": "^0.2.1",
-        "postcss": "^7.0.32",
-        "postcss-value-parser": "^4.1.0"
-      },
-      "dependencies": {
-        "postcss": {
-          "version": "7.0.39",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-          "dev": true,
-          "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
-          }
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true
-        }
-      }
-    },
-    "available-typed-arrays": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.5.tgz",
-      "integrity": "sha512-DMD0KiN46eipeziST1LPP/STfDU0sufISXmjSgvVsoU2tqxctQeASejWcfNtxYKqETM1UxQ8sp2OrSBWpHY6sw==",
-      "dev": true
-    },
-    "axe-core": {
-      "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.6.2.tgz",
-      "integrity": "sha512-b1WlTV8+XKLj9gZy2DZXgQiyDp9xkkoe2a6U6UbYccScq2wgH/YwCeI2/Jq2mgo0HzQxqJOjWZBLeA/mqsk5Mg==",
-      "dev": true
-    },
-    "axobject-query": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-3.1.1.tgz",
-      "integrity": "sha512-goKlv8DZrK9hUh975fnHzhNIO4jUnFCfv/dszV5VwUGDFjI6vQ2VwoyjYjYNEbBE8AH87TduWP5uyDR1D+Iteg==",
-      "dev": true,
-      "requires": {
-        "deep-equal": "^2.0.5"
-      }
-    },
-    "babel-jest": {
-      "version": "26.6.3",
-      "integrity": "sha512-pl4Q+GAVOHwvjrck6jKjvmGhnO3jHX/xuB9d27f+EJZ/6k+6nMuPjorrYp7s++bKKdANwzElBWnLWaObvTnaZA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/transform": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/babel__core": "^7.1.7",
-        "babel-plugin-istanbul": "^6.0.0",
-        "babel-preset-jest": "^26.6.2",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "slash": "^3.0.0"
-      }
-    },
-    "babel-plugin-istanbul": {
-      "version": "6.0.0",
-      "integrity": "sha512-AF55rZXpe7trmEylbaE1Gv54wn6rwU03aptvRoVIGP8YykoSxqdVLV1TfwflBCE/QtHmqtP8SWlTENqbK8GCSQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.0.0",
-        "@istanbuljs/load-nyc-config": "^1.0.0",
-        "@istanbuljs/schema": "^0.1.2",
-        "istanbul-lib-instrument": "^4.0.0",
-        "test-exclude": "^6.0.0"
-      }
-    },
-    "babel-plugin-jest-hoist": {
-      "version": "26.6.2",
-      "integrity": "sha512-PO9t0697lNTmcEHH69mdtYiOIkkOlj9fySqfO3K1eCcdISevLAE0xY59VLLUj0SoiPiTX/JU2CYFpILydUa5Lw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/template": "^7.3.3",
-        "@babel/types": "^7.3.3",
-        "@types/babel__core": "^7.0.0",
-        "@types/babel__traverse": "^7.0.6"
-      }
-    },
-    "babel-preset-current-node-syntax": {
-      "version": "1.0.1",
-      "integrity": "sha512-M7LQ0bxarkxQoN+vz5aJPsLBn77n8QgTFmo8WK0/44auK2xlCXrYcUxHFxgU7qW5Yzw/CjmLRK2uJzaCd7LvqQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/plugin-syntax-async-generators": "^7.8.4",
-        "@babel/plugin-syntax-bigint": "^7.8.3",
-        "@babel/plugin-syntax-class-properties": "^7.8.3",
-        "@babel/plugin-syntax-import-meta": "^7.8.3",
-        "@babel/plugin-syntax-json-strings": "^7.8.3",
-        "@babel/plugin-syntax-logical-assignment-operators": "^7.8.3",
-        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
-        "@babel/plugin-syntax-numeric-separator": "^7.8.3",
-        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
-        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
-        "@babel/plugin-syntax-optional-chaining": "^7.8.3",
-        "@babel/plugin-syntax-top-level-await": "^7.8.3"
-      }
-    },
-    "babel-preset-jest": {
-      "version": "26.6.2",
-      "integrity": "sha512-YvdtlVm9t3k777c5NPQIv6cxFFFapys25HiUmuSgHwIZhfifweR5c5Sf5nwE3MAbfu327CYSvps8Yx6ANLyleQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "babel-plugin-jest-hoist": "^26.6.2",
-        "babel-preset-current-node-syntax": "^1.0.0"
-      }
-    },
-    "bail": {
-      "version": "1.0.5",
-      "integrity": "sha512-xFbRxM1tahm08yHBP16MMjVUAvDaBMD38zsM9EMAUN61omwLmKlOpB/Zku5QkjZ8TZ4vn53pj+t518cH0S03RQ==",
-      "dev": true
-    },
-    "balanced-match": {
-      "version": "1.0.2",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true
-    },
-    "base": {
-      "version": "0.11.2",
-      "integrity": "sha512-5T6P4xPgpp0YDFvSWwEZ4NoE3aM4QBQXDzmVbraCkFj8zHM+mba8SyqB5DbZWyR7mYHo6Y7BdQo3MoA4m0TeQg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "cache-base": "^1.0.1",
-        "class-utils": "^0.3.5",
-        "component-emitter": "^1.2.1",
-        "define-property": "^1.0.0",
-        "isobject": "^3.0.1",
-        "mixin-deep": "^1.2.0",
-        "pascalcase": "^0.1.1"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "1.0.0",
-          "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-descriptor": "^1.0.0"
-          }
-        }
-      }
-    },
-    "brace-expansion": {
-      "version": "1.1.11",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
-      "dev": true,
-      "requires": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "braces": {
-      "version": "3.0.2",
-      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
-      "dev": true,
-      "requires": {
-        "fill-range": "^7.0.1"
-      }
-    },
-    "browser-process-hrtime": {
-      "version": "1.0.0",
-      "integrity": "sha512-9o5UecI3GhkpM6DrXr69PblIuWxPKk9Y0jHBRhdocZ2y7YECBFCsHm79Pr3OyR2AvjhDkabFJaDJMYRazHgsow==",
-      "dev": true,
-      "peer": true
-    },
-    "browserslist": {
-      "version": "4.17.3",
-      "integrity": "sha512-59IqHJV5VGdcJZ+GZ2hU5n4Kv3YiASzW6Xk5g9tf5a/MAzGeFwgGWU39fVzNIOVcgB3+Gp+kiQu0HEfTVU/3VQ==",
-      "dev": true,
-      "requires": {
-        "caniuse-lite": "^1.0.30001264",
-        "electron-to-chromium": "^1.3.857",
-        "escalade": "^3.1.1",
-        "node-releases": "^1.1.77",
-        "picocolors": "^0.2.1"
-      }
-    },
-    "bs-logger": {
-      "version": "0.2.6",
-      "integrity": "sha512-pd8DCoxmbgc7hyPKOvxtqNcjYoOsABPQdcCUjGp3d42VR2CX1ORhk2A87oqqu5R1kk+76nsxZupkmyd+MVtCog==",
-      "dev": true,
-      "requires": {
-        "fast-json-stable-stringify": "2.x"
-      }
-    },
-    "bser": {
-      "version": "2.1.1",
-      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "node-int64": "^0.4.0"
-      }
-    },
-    "buffer-from": {
-      "version": "1.1.2",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
-      "dev": true
-    },
-    "busboy": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/busboy/-/busboy-1.6.0.tgz",
-      "integrity": "sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==",
-      "dev": true,
-      "requires": {
-        "streamsearch": "^1.1.0"
-      }
-    },
-    "cache-base": {
-      "version": "1.0.1",
-      "integrity": "sha512-AKcdTnFSWATd5/GCPRxr2ChwIJ85CeyrEyjRHlKxQ56d4XJMGym0uAiKn0xbLOGOl3+yRpOTi484dVCEc5AUzQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "collection-visit": "^1.0.0",
-        "component-emitter": "^1.2.1",
-        "get-value": "^2.0.6",
-        "has-value": "^1.0.0",
-        "isobject": "^3.0.1",
-        "set-value": "^2.0.0",
-        "to-object-path": "^0.3.0",
-        "union-value": "^1.0.0",
-        "unset-value": "^1.0.0"
-      }
-    },
-    "call-bind": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.2.tgz",
-      "integrity": "sha512-7O+FbCihrB5WGbFYesctwmTKae6rOiIzmz1icreWJ+0aA7LJfuqhEso2T9ncpcFtzMQtzXf2QGGueWJGTYsqrA==",
-      "dev": true,
-      "requires": {
-        "function-bind": "^1.1.1",
-        "get-intrinsic": "^1.0.2"
-      }
-    },
-    "callsites": {
-      "version": "3.1.0",
-      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
-      "dev": true
-    },
-    "camelcase": {
-      "version": "5.3.1",
-      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
-      "dev": true
-    },
-    "caniuse-lite": {
-      "version": "1.0.30001416",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001416.tgz",
-      "integrity": "sha512-06wzzdAkCPZO+Qm4e/eNghZBDfVNDsCgw33T27OwBH9unE9S478OYw//Q2L7Npf/zBzs7rjZOszIFQkwQKAEqA==",
-      "dev": true
-    },
-    "capture-exit": {
-      "version": "2.0.0",
-      "integrity": "sha512-PiT/hQmTonHhl/HFGN+Lx3JJUznrVYJ3+AQsnthneZbvW7x+f08Tk7yLJTLEOUvBTbduLeeBkxEaYXUOUrRq6g==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "rsvp": "^4.8.4"
-      }
-    },
-    "ccount": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/ccount/-/ccount-1.1.0.tgz",
-      "integrity": "sha512-vlNK021QdI7PNeiUh/lKkC/mNHHfV0m/Ad5JoI0TYtlBnJAslM/JIkm/tGC88bkLIwO6OQ5uV6ztS6kVAtCDlg==",
-      "dev": true
-    },
-    "chalk": {
-      "version": "4.1.0",
-      "integrity": "sha512-qwx12AxXe2Q5xQ43Ac//I6v5aXTipYrSESdOgzrN+9XjgEpyjpKuvSGaN4qE93f7TQTlerQQ8S+EQ0EyDoVL1A==",
-      "dev": true,
-      "requires": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      }
-    },
-    "char-regex": {
-      "version": "1.0.2",
-      "integrity": "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==",
-      "dev": true,
-      "peer": true
-    },
-    "character-entities": {
-      "version": "1.2.4",
-      "integrity": "sha512-iBMyeEHxfVnIakwOuDXpVkc54HijNgCyQB2w0VfGQThle6NXn50zU6V/u+LDhxHcDUPojn6Kpga3PTAD8W1bQw==",
-      "dev": true
-    },
-    "character-entities-html4": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-1.1.4.tgz",
-      "integrity": "sha512-HRcDxZuZqMx3/a+qrzxdBKBPUpxWEq9xw2OPZ3a/174ihfrQKVsFhqtthBInFy1zZ9GgZyFXOatNujm8M+El3g==",
-      "dev": true
-    },
-    "character-entities-legacy": {
-      "version": "1.1.4",
-      "integrity": "sha512-3Xnr+7ZFS1uxeiUDvV02wQ+QDbc55o97tIV5zHScSPJpcLm/r0DFPcoY3tYRp+VZukxuMeKgXYmsXQHO05zQeA==",
-      "dev": true
-    },
-    "character-reference-invalid": {
-      "version": "1.1.4",
-      "integrity": "sha512-mKKUkUbhPpQlCOfIuZkvSEgktjPFIsZKRRbC6KWVEMvlzblj3i3asQv5ODsrwt0N3pHAEvjP8KTQPHkp0+6jOg==",
-      "dev": true
-    },
-    "chardet": {
-      "version": "0.7.0",
-      "integrity": "sha512-mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==",
-      "dev": true
-    },
-    "ci-info": {
-      "version": "2.0.0",
-      "integrity": "sha512-5tK7EtrZ0N+OLFMthtqOj4fI2Jeb88C4CAZPu25LDVUgXJ0A3Js4PMGqrn0JU1W0Mh1/Z8wZzYPxqUrXeBboCQ==",
-      "dev": true
-    },
-    "cjs-module-lexer": {
-      "version": "0.6.0",
-      "integrity": "sha512-uc2Vix1frTfnuzxxu1Hp4ktSvM3QaI4oXl4ZUqL1wjTu/BGki9TrCWoqLTg/drR1KwAEarXuRFCG2Svr1GxPFw==",
-      "dev": true,
-      "peer": true
-    },
-    "class-utils": {
-      "version": "0.3.6",
-      "integrity": "sha512-qOhPa/Fj7s6TY8H8esGu5QNpMMQxz79h+urzrNYN6mn+9BnxlDGf5QZ+XeCDsxSjPqsSR56XOZOJmpeurnLMeg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "arr-union": "^3.1.0",
-        "define-property": "^0.2.5",
-        "isobject": "^3.0.0",
-        "static-extend": "^0.1.1"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "0.2.5",
-          "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-descriptor": "^0.1.0"
-          }
-        },
-        "is-accessor-descriptor": {
-          "version": "0.1.6",
-          "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "is-buffer": {
-          "version": "1.1.6",
-          "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-          "dev": true,
-          "peer": true
-        },
-        "is-data-descriptor": {
-          "version": "0.1.4",
-          "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "is-descriptor": {
-          "version": "0.1.6",
-          "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-accessor-descriptor": "^0.1.6",
-            "is-data-descriptor": "^0.1.4",
-            "kind-of": "^5.0.0"
-          }
-        },
-        "kind-of": {
-          "version": "5.1.0",
-          "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "clean-stack": {
-      "version": "2.2.0",
-      "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==",
-      "dev": true
-    },
-    "cli-cursor": {
-      "version": "3.1.0",
-      "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==",
-      "dev": true,
-      "requires": {
-        "restore-cursor": "^3.1.0"
-      }
-    },
-    "cli-truncate": {
-      "version": "2.1.0",
-      "integrity": "sha512-n8fOixwDD6b/ObinzTrp1ZKFzbgvKZvuz/TvejnLn1aQfC6r52XEx85FmuC+3HI+JM7coBRXUvNqEU2PHVrHpg==",
-      "dev": true,
-      "requires": {
-        "slice-ansi": "^3.0.0",
-        "string-width": "^4.2.0"
-      }
-    },
-    "cli-width": {
-      "version": "3.0.0",
-      "integrity": "sha512-FxqpkPPwu1HjuN93Omfm4h8uIanXofW0RxVEW3k5RKx+mJJYSthzNhp32Kzxxy3YAEZ/Dc/EWN1vZRY0+kOhbw==",
-      "dev": true
-    },
-    "client-only": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
-      "integrity": "sha512-IV3Ou0jSMzZrd3pZ48nLkT9DA7Ag1pnPzaiQhpW7c3RbcqqzvzzVu+L8gfqMp/8IM2MQtSiqaCxrrcfu8I8rMA==",
-      "dev": true
-    },
-    "cliui": {
-      "version": "6.0.0",
-      "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.0",
-        "wrap-ansi": "^6.2.0"
-      },
-      "dependencies": {
-        "wrap-ansi": {
-          "version": "6.2.0",
-          "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "ansi-styles": "^4.0.0",
-            "string-width": "^4.1.0",
-            "strip-ansi": "^6.0.0"
-          }
-        }
-      }
-    },
-    "clone-regexp": {
-      "version": "2.2.0",
-      "integrity": "sha512-beMpP7BOtTipFuW8hrJvREQ2DrRu3BE7by0ZpibtfBA+qfHYvMGTc2Yb1JMYPKg/JUw0CHYvpg796aNTSW9z7Q==",
-      "dev": true,
-      "requires": {
-        "is-regexp": "^2.0.0"
-      },
-      "dependencies": {
-        "is-regexp": {
-          "version": "2.1.0",
-          "integrity": "sha512-OZ4IlER3zmRIoB9AqNhEggVxqIH4ofDns5nRrPS6yQxXE1TPCUpFznBfRQmQa8uC+pXqjMnukiJBxCisIxiLGA==",
-          "dev": true
-        }
-      }
-    },
-    "co": {
-      "version": "4.6.0",
-      "integrity": "sha1-bqa989hTrlTMuOR7+gvz+QMfsYQ=",
-      "dev": true,
-      "peer": true
-    },
-    "collapse-white-space": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/collapse-white-space/-/collapse-white-space-1.0.6.tgz",
-      "integrity": "sha512-jEovNnrhMuqyCcjfEJA56v0Xq8SkIoPKDyaHahwo3POf4qcSXqMYuwNcOTzp74vTsR9Tn08z4MxWqAhcekogkQ==",
-      "dev": true
-    },
-    "collect-v8-coverage": {
-      "version": "1.0.1",
-      "integrity": "sha512-iBPtljfCNcTKNAto0KEtDfZ3qzjJvqE3aTGZsbhjSBlorqpXJlaWWtPO35D+ZImoC3KWejX64o+yPGxhWSTzfg==",
-      "dev": true,
-      "peer": true
-    },
-    "collection-visit": {
-      "version": "1.0.0",
-      "integrity": "sha1-S8A3PBZLwykbTTaMgpzxqApZ3KA=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "map-visit": "^1.0.0",
-        "object-visit": "^1.0.0"
-      }
-    },
-    "color-convert": {
-      "version": "2.0.1",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "dev": true,
-      "requires": {
-        "color-name": "~1.1.4"
-      }
-    },
-    "color-name": {
-      "version": "1.1.4",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "dev": true
-    },
-    "colorette": {
-      "version": "1.4.0",
-      "integrity": "sha512-Y2oEozpomLn7Q3HFP7dpww7AtMJplbM9lGZP6RDfHqmbeRjiwRg4n6VM6j4KLmRke85uWEI7JqF17f3pqdRA0g==",
-      "dev": true
-    },
-    "combined-stream": {
-      "version": "1.0.8",
-      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
-      "dev": true,
-      "requires": {
-        "delayed-stream": "~1.0.0"
-      }
-    },
-    "commander": {
-      "version": "7.2.0",
-      "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==",
-      "dev": true
-    },
-    "component-emitter": {
-      "version": "1.3.0",
-      "integrity": "sha512-Rd3se6QB+sO1TwqZjscQrurpEPIfO0/yYnSin6Q/rD3mOutHvUrCAhJub3r90uNb+SESBuE0QYoB90YdfatsRg==",
-      "dev": true,
-      "peer": true
-    },
-    "concat-map": {
-      "version": "0.0.1",
-      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=",
-      "dev": true
-    },
-    "convert-source-map": {
-      "version": "1.8.0",
-      "integrity": "sha512-+OQdjP49zViI/6i7nIJpA8rAl4sV/JdPfU9nZs3VqOwGIgizICvuN2ru6fMd+4llL0tar18UYJXfZ/TWtmhUjA==",
-      "dev": true,
-      "requires": {
-        "safe-buffer": "~5.1.1"
-      }
-    },
-    "copy-descriptor": {
-      "version": "0.1.1",
-      "integrity": "sha1-Z29us8OZl8LuGsOpJP1hJHSPV40=",
-      "dev": true,
-      "peer": true
-    },
-    "cosmiconfig": {
-      "version": "7.0.1",
-      "integrity": "sha512-a1YWNUV2HwGimB7dU2s1wUMurNKjpx60HxBB6xUM8Re+2s1g1IIfJvFR0/iCF+XHdE0GMTKTuLR32UQff4TEyQ==",
-      "dev": true,
-      "requires": {
-        "@types/parse-json": "^4.0.0",
-        "import-fresh": "^3.2.1",
-        "parse-json": "^5.0.0",
-        "path-type": "^4.0.0",
-        "yaml": "^1.10.0"
-      }
-    },
-    "cross-fetch": {
-      "version": "3.1.4",
-      "integrity": "sha512-1eAtFWdIubi6T4XPy6ei9iUFoKpUkIF971QLN8lIvvvwueI65+Nw5haMNKUwfJxabqlIIDODJKGrQ66gxC0PbQ==",
-      "dev": true,
-      "requires": {
-        "node-fetch": "2.6.1"
-      },
-      "dependencies": {
-        "node-fetch": {
-          "version": "2.6.1",
-          "integrity": "sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==",
-          "dev": true
-        }
-      }
-    },
-    "cross-spawn": {
-      "version": "7.0.3",
-      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
-      "dev": true,
-      "requires": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      }
-    },
-    "cssesc": {
-      "version": "3.0.0",
-      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
-      "dev": true
-    },
-    "cssom": {
-      "version": "0.4.4",
-      "integrity": "sha512-p3pvU7r1MyyqbTk+WbNJIgJjG2VmTIaB10rI93LzVPrmDJKkzKYMtxxyAvQXR/NS6otuzveI7+7BBq3SjBS2mw==",
-      "dev": true,
-      "peer": true
-    },
-    "cssstyle": {
-      "version": "2.3.0",
-      "integrity": "sha512-AZL67abkUzIuvcHqk7c09cezpGNcxUxU4Ioi/05xHk4DQeTkWmGYftIE6ctU6AEt+Gn4n1lDStOtj7FKycP71A==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "cssom": "~0.3.6"
-      },
-      "dependencies": {
-        "cssom": {
-          "version": "0.3.8",
-          "integrity": "sha512-b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "damerau-levenshtein": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/damerau-levenshtein/-/damerau-levenshtein-1.0.8.tgz",
-      "integrity": "sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==",
-      "dev": true
-    },
-    "dart-linkcheck": {
-      "version": "2.0.15",
-      "integrity": "sha512-ZMvxkAyEpBTvBFk+DPjcK0ObNy8GM4gmrGG1qIu0EXb/zj25vjRWNnhLHKZw4JlOLo02oWlwDeqo98GuBlJcIg==",
-      "dev": true
-    },
-    "data-urls": {
-      "version": "2.0.0",
-      "integrity": "sha512-X5eWTSXO/BJmpdIKCRuKUgSCgAN0OwliVK3yPKbwIWU1Tdw5BRajxlzMidvh+gwko9AfQ9zIj52pzF91Q3YAvQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "abab": "^2.0.3",
-        "whatwg-mimetype": "^2.3.0",
-        "whatwg-url": "^8.0.0"
-      }
-    },
-    "debug": {
-      "version": "4.3.4",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
-      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
-      "dev": true,
-      "requires": {
-        "ms": "2.1.2"
-      }
-    },
-    "decamelize": {
-      "version": "1.2.0",
-      "integrity": "sha1-9lNNFRSCabIDUue+4m9QH5oZEpA=",
-      "dev": true
-    },
-    "decamelize-keys": {
-      "version": "1.1.0",
-      "integrity": "sha1-0XGoeTMlKAfrPLYdwcFEXQeN8tk=",
-      "dev": true,
-      "requires": {
-        "decamelize": "^1.1.0",
-        "map-obj": "^1.0.0"
-      }
-    },
-    "decimal.js": {
-      "version": "10.3.1",
-      "integrity": "sha512-V0pfhfr8suzyPGOx3nmq4aHqabehUZn6Ch9kyFpV79TGDTWFmHqUqXdabR7QHqxzrYolF4+tVmJhUG4OURg5dQ==",
-      "dev": true,
-      "peer": true
-    },
-    "decode-uri-component": {
-      "version": "0.2.0",
-      "integrity": "sha1-6zkTMzRYd1y4TNGh+uBiEGu4dUU=",
-      "dev": true,
-      "peer": true
-    },
-    "deep-equal": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/deep-equal/-/deep-equal-2.2.0.tgz",
-      "integrity": "sha512-RdpzE0Hv4lhowpIUKKMJfeH6C1pXdtT1/it80ubgWqwI3qpuxUBpC1S4hnHg+zjnuOoDkzUtUCEEkG+XG5l3Mw==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "es-get-iterator": "^1.1.2",
-        "get-intrinsic": "^1.1.3",
-        "is-arguments": "^1.1.1",
-        "is-array-buffer": "^3.0.1",
-        "is-date-object": "^1.0.5",
-        "is-regex": "^1.1.4",
-        "is-shared-array-buffer": "^1.0.2",
-        "isarray": "^2.0.5",
-        "object-is": "^1.1.5",
-        "object-keys": "^1.1.1",
-        "object.assign": "^4.1.4",
-        "regexp.prototype.flags": "^1.4.3",
-        "side-channel": "^1.0.4",
-        "which-boxed-primitive": "^1.0.2",
-        "which-collection": "^1.0.1",
-        "which-typed-array": "^1.1.9"
-      },
-      "dependencies": {
-        "isarray": {
-          "version": "2.0.5",
-          "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
-          "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
-          "dev": true
-        }
-      }
-    },
-    "deep-is": {
-      "version": "0.1.4",
-      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
-      "dev": true
-    },
-    "define-lazy-prop": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-2.0.0.tgz",
-      "integrity": "sha512-Ds09qNh8yw3khSjiJjiUInaGX9xlqZDY7JVryGxdxV7NPeuqQfplOpQ66yJFZut3jLa5zOwkXw1g9EI2uKh4Og==",
-      "dev": true
-    },
-    "define-properties": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.1.4.tgz",
-      "integrity": "sha512-uckOqKcfaVvtBdsVkdPv3XjveQJsNQqmhXgRi8uhvWWuPYZCNlzT8qAyblUgNoXdHdjMTzAqeGjAoli8f+bzPA==",
-      "dev": true,
-      "requires": {
-        "has-property-descriptors": "^1.0.0",
-        "object-keys": "^1.1.1"
-      }
-    },
-    "define-property": {
-      "version": "2.0.2",
-      "integrity": "sha512-jwK2UV4cnPpbcG7+VRARKTZPUWowwXA8bzH5NP6ud0oeAxyYPuGZUAC7hMugpCdz4BeSZl2Dl9k66CHJ/46ZYQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "is-descriptor": "^1.0.2",
-        "isobject": "^3.0.1"
-      }
-    },
-    "delayed-stream": {
-      "version": "1.0.0",
-      "integrity": "sha1-3zrhmayt+31ECqrgsp4icrJOxhk=",
-      "dev": true
-    },
-    "detect-newline": {
-      "version": "3.1.0",
-      "integrity": "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==",
-      "dev": true,
-      "peer": true
-    },
-    "diff-sequences": {
-      "version": "26.6.2",
-      "integrity": "sha512-Mv/TDa3nZ9sbc5soK+OoA74BsS3mL37yixCvUAQkiuA4Wz6YtwP/K47n2rv2ovzHZvoiQeA5FTQOschKkEwB0Q==",
-      "dev": true,
-      "peer": true
-    },
-    "dir-glob": {
-      "version": "3.0.1",
-      "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
-      "dev": true,
-      "requires": {
-        "path-type": "^4.0.0"
-      }
-    },
-    "doctrine": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
-      "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
-      "dev": true,
-      "requires": {
-        "esutils": "^2.0.2"
-      }
-    },
-    "dom-serializer": {
-      "version": "0.2.2",
-      "integrity": "sha512-2/xPb3ORsQ42nHYiSunXkDjPLBaEj/xTwUO4B7XCZQTRk7EBtTOPaygh10YAAh2OI1Qrp6NWfpAhzswj0ydt9g==",
-      "dev": true,
-      "requires": {
-        "domelementtype": "^2.0.1",
-        "entities": "^2.0.0"
-      },
-      "dependencies": {
-        "domelementtype": {
-          "version": "2.2.0",
-          "integrity": "sha512-DtBMo82pv1dFtUmHyr48beiuq792Sxohr+8Hm9zoxklYPfa6n0Z3Byjj2IV7bmr2IyqClnqEQhfgHJJ5QF0R5A==",
-          "dev": true
-        },
-        "entities": {
-          "version": "2.2.0",
-          "integrity": "sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==",
-          "dev": true
-        }
-      }
-    },
-    "domelementtype": {
-      "version": "1.3.1",
-      "integrity": "sha512-BSKB+TSpMpFI/HOxCNr1O8aMOTZ8hT3pM3GQ0w/mWRmkhEDSFJkkyzz4XQsBV44BChwGkrDfMyjVD0eA2aFV3w==",
-      "dev": true
-    },
-    "domexception": {
-      "version": "2.0.1",
-      "integrity": "sha512-yxJ2mFy/sibVQlu5qHjOkf9J3K6zgmCxgJ94u2EdvDOV09H+32LtRswEcUsmUWN72pVLOEnTSRaIVVzVQgS0dg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "webidl-conversions": "^5.0.0"
-      },
-      "dependencies": {
-        "webidl-conversions": {
-          "version": "5.0.0",
-          "integrity": "sha512-VlZwKPCkYKxQgeSbH5EyngOmRp7Ww7I9rQLERETtf5ofd9pGeswWiOtogpEO850jziPRarreGxn5QIiTqpb2wA==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "domhandler": {
-      "version": "2.4.2",
-      "integrity": "sha512-JiK04h0Ht5u/80fdLMCEmV4zkNh2BcoMFBmZ/91WtYZ8qVXSKjiw7fXMgFPnHcSZgOo3XdinHvmnDUeMf5R4wA==",
-      "dev": true,
-      "requires": {
-        "domelementtype": "1"
-      }
-    },
-    "domutils": {
-      "version": "1.7.0",
-      "integrity": "sha512-Lgd2XcJ/NjEw+7tFvfKxOzCYKZsdct5lczQ2ZaQY8Djz7pfAD3Gbp8ySJWtreII/vDlMVmxwa6pHmdxIYgttDg==",
-      "dev": true,
-      "requires": {
-        "dom-serializer": "0",
-        "domelementtype": "1"
-      }
-    },
-    "eastasianwidth": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
-      "dev": true
-    },
-    "ejs": {
-      "version": "3.1.5",
-      "integrity": "sha512-dldq3ZfFtgVTJMLjOe+/3sROTzALlL9E34V4/sDtUd/KlBSS0s6U1/+WPE1B4sj9CXHJpL1M6rhNJnc9Wbal9w==",
-      "dev": true,
-      "requires": {
-        "jake": "^10.6.1"
-      }
-    },
-    "electron-to-chromium": {
-      "version": "1.3.865",
-      "integrity": "sha512-okGcCKfihgGlaROMFNPQ6eaU3bk9Xa68rLYSnVD2PyIqM5B/vyQoXCpB3p1HI3AXio097ROVBlSO4JZVilUWuA==",
-      "dev": true
-    },
-    "emittery": {
-      "version": "0.7.2",
-      "integrity": "sha512-A8OG5SR/ij3SsJdWDJdkkSYUjQdCUx6APQXem0SaEePBSRg4eymGYwBkKo1Y6DU+af/Jn2dBQqDBvjnr9Vi8nQ==",
-      "dev": true,
-      "peer": true
-    },
-    "emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
-      "dev": true
-    },
-    "end-of-stream": {
-      "version": "1.4.4",
-      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "once": "^1.4.0"
-      }
-    },
-    "enhanced-resolve": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.12.0.tgz",
-      "integrity": "sha512-QHTXI/sZQmko1cbDoNAa3mJ5qhWUUNAq3vR0/YiD379fWQrcfuoX1+HW2S0MTt7XmoPLapdaDKUtelUSPic7hQ==",
-      "dev": true,
-      "requires": {
-        "graceful-fs": "^4.2.4",
-        "tapable": "^2.2.0"
-      }
-    },
-    "enquirer": {
-      "version": "2.3.6",
-      "integrity": "sha512-yjNnPr315/FjS4zIsUxYguYUPP2e1NK4d7E7ZOLiyYCcbFBiTMyID+2wvm2w6+pZ/odMA7cRkjhsPbltwBOrLg==",
-      "dev": true,
-      "requires": {
-        "ansi-colors": "^4.1.1"
-      }
-    },
-    "entities": {
-      "version": "1.1.2",
-      "integrity": "sha512-f2LZMYl1Fzu7YSBKg+RoROelpOaNrcGmE9AZubeDfrCEia483oW4MI4VyFd5VNHIgQ/7qm1I0wUHK1eJnn2y2w==",
-      "dev": true
-    },
-    "error-ex": {
-      "version": "1.3.2",
-      "integrity": "sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==",
-      "dev": true,
-      "requires": {
-        "is-arrayish": "^0.2.1"
-      }
-    },
-    "es-abstract": {
-      "version": "1.21.1",
-      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.21.1.tgz",
-      "integrity": "sha512-QudMsPOz86xYz/1dG1OuGBKOELjCh99IIWHLzy5znUB6j8xG2yMA7bfTV86VSqKF+Y/H08vQPR+9jyXpuC6hfg==",
-      "dev": true,
-      "requires": {
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "es-set-tostringtag": "^2.0.1",
-        "es-to-primitive": "^1.2.1",
-        "function-bind": "^1.1.1",
-        "function.prototype.name": "^1.1.5",
-        "get-intrinsic": "^1.1.3",
-        "get-symbol-description": "^1.0.0",
-        "globalthis": "^1.0.3",
-        "gopd": "^1.0.1",
-        "has": "^1.0.3",
-        "has-property-descriptors": "^1.0.0",
-        "has-proto": "^1.0.1",
-        "has-symbols": "^1.0.3",
-        "internal-slot": "^1.0.4",
-        "is-array-buffer": "^3.0.1",
-        "is-callable": "^1.2.7",
-        "is-negative-zero": "^2.0.2",
-        "is-regex": "^1.1.4",
-        "is-shared-array-buffer": "^1.0.2",
-        "is-string": "^1.0.7",
-        "is-typed-array": "^1.1.10",
-        "is-weakref": "^1.0.2",
-        "object-inspect": "^1.12.2",
-        "object-keys": "^1.1.1",
-        "object.assign": "^4.1.4",
-        "regexp.prototype.flags": "^1.4.3",
-        "safe-regex-test": "^1.0.0",
-        "string.prototype.trimend": "^1.0.6",
-        "string.prototype.trimstart": "^1.0.6",
-        "typed-array-length": "^1.0.4",
-        "unbox-primitive": "^1.0.2",
-        "which-typed-array": "^1.1.9"
-      }
-    },
-    "es-get-iterator": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/es-get-iterator/-/es-get-iterator-1.1.3.tgz",
-      "integrity": "sha512-sPZmqHBe6JIiTfN5q2pEi//TwxmAFHwj/XEuYjTuse78i8KxaqMTTzxPoFKuzRpDpTJ+0NAbpfenkmH2rePtuw==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.3",
-        "has-symbols": "^1.0.3",
-        "is-arguments": "^1.1.1",
-        "is-map": "^2.0.2",
-        "is-set": "^2.0.2",
-        "is-string": "^1.0.7",
-        "isarray": "^2.0.5",
-        "stop-iteration-iterator": "^1.0.0"
-      },
-      "dependencies": {
-        "isarray": {
-          "version": "2.0.5",
-          "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
-          "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
-          "dev": true
-        }
-      }
-    },
-    "es-set-tostringtag": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.0.1.tgz",
-      "integrity": "sha512-g3OMbtlwY3QewlqAiMLI47KywjWZoEytKr8pf6iTC8uJq5bIAH52Z9pnQ8pVL6whrCto53JZDuUIsifGeLorTg==",
-      "dev": true,
-      "requires": {
-        "get-intrinsic": "^1.1.3",
-        "has": "^1.0.3",
-        "has-tostringtag": "^1.0.0"
-      }
-    },
-    "es-shim-unscopables": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/es-shim-unscopables/-/es-shim-unscopables-1.0.0.tgz",
-      "integrity": "sha512-Jm6GPcCdC30eMLbZ2x8z2WuRwAws3zTBBKuusffYVUrNj/GVSUAZ+xKMaUpfNDR5IbyNA5LJbaecoUVbmUcB1w==",
-      "dev": true,
-      "requires": {
-        "has": "^1.0.3"
-      }
-    },
-    "es-to-primitive": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.2.1.tgz",
-      "integrity": "sha512-QCOllgZJtaUo9miYBcLChTUaHNjJF3PYs1VidD7AwiEj1kYxKeQTctLAezAOH5ZKRH0g2IgPn6KwB4IT8iRpvA==",
-      "dev": true,
-      "requires": {
-        "is-callable": "^1.1.4",
-        "is-date-object": "^1.0.1",
-        "is-symbol": "^1.0.2"
-      }
-    },
-    "escalade": {
-      "version": "3.1.1",
-      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
-      "dev": true
-    },
-    "escape-string-regexp": {
-      "version": "1.0.5",
-      "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ=",
-      "dev": true
-    },
-    "escodegen": {
-      "version": "2.0.0",
-      "integrity": "sha512-mmHKys/C8BFUGI+MAWNcSYoORYLMdPzjrknd2Vc+bUsjN5bXcr8EhrNB+UTqfL1y3I9c4fw2ihgtMPQLBRiQxw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "esprima": "^4.0.1",
-        "estraverse": "^5.2.0",
-        "esutils": "^2.0.2",
-        "optionator": "^0.8.1",
-        "source-map": "~0.6.1"
-      },
-      "dependencies": {
-        "levn": {
-          "version": "0.3.0",
-          "integrity": "sha1-OwmSTt+fCDwEkP3UwLxEIeBHZO4=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "prelude-ls": "~1.1.2",
-            "type-check": "~0.3.2"
-          }
-        },
-        "optionator": {
-          "version": "0.8.3",
-          "integrity": "sha512-+IW9pACdk3XWmmTXG8m3upGUJst5XRGzxMRjXzAuJ1XnIFNvfhjjIuYkDvysnPQ7qzqVzLt78BCruntqRhWQbA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "deep-is": "~0.1.3",
-            "fast-levenshtein": "~2.0.6",
-            "levn": "~0.3.0",
-            "prelude-ls": "~1.1.2",
-            "type-check": "~0.3.2",
-            "word-wrap": "~1.2.3"
-          }
-        },
-        "prelude-ls": {
-          "version": "1.1.2",
-          "integrity": "sha1-IZMqVJ9eUv/ZqCf1cOBL5iqX2lQ=",
-          "dev": true,
-          "peer": true
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true,
-          "optional": true,
-          "peer": true
-        },
-        "type-check": {
-          "version": "0.3.2",
-          "integrity": "sha1-WITKtRLPHTVeP7eE8wgEsrUg23I=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "prelude-ls": "~1.1.2"
-          }
-        }
-      }
-    },
-    "eslint": {
-      "version": "8.31.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.31.0.tgz",
-      "integrity": "sha512-0tQQEVdmPZ1UtUKXjX7EMm9BlgJ08G90IhWh0PKDCb3ZLsgAOHI8fYSIzYVZej92zsgq+ft0FGsxhJ3xo2tbuA==",
-      "dev": true,
-      "requires": {
-        "@eslint/eslintrc": "^1.4.1",
-        "@humanwhocodes/config-array": "^0.11.8",
-        "@humanwhocodes/module-importer": "^1.0.1",
-        "@nodelib/fs.walk": "^1.2.8",
-        "ajv": "^6.10.0",
-        "chalk": "^4.0.0",
-        "cross-spawn": "^7.0.2",
-        "debug": "^4.3.2",
-        "doctrine": "^3.0.0",
-        "escape-string-regexp": "^4.0.0",
-        "eslint-scope": "^7.1.1",
-        "eslint-utils": "^3.0.0",
-        "eslint-visitor-keys": "^3.3.0",
-        "espree": "^9.4.0",
-        "esquery": "^1.4.0",
-        "esutils": "^2.0.2",
-        "fast-deep-equal": "^3.1.3",
-        "file-entry-cache": "^6.0.1",
-        "find-up": "^5.0.0",
-        "glob-parent": "^6.0.2",
-        "globals": "^13.19.0",
-        "grapheme-splitter": "^1.0.4",
-        "ignore": "^5.2.0",
-        "import-fresh": "^3.0.0",
-        "imurmurhash": "^0.1.4",
-        "is-glob": "^4.0.0",
-        "is-path-inside": "^3.0.3",
-        "js-sdsl": "^4.1.4",
-        "js-yaml": "^4.1.0",
-        "json-stable-stringify-without-jsonify": "^1.0.1",
-        "levn": "^0.4.1",
-        "lodash.merge": "^4.6.2",
-        "minimatch": "^3.1.2",
-        "natural-compare": "^1.4.0",
-        "optionator": "^0.9.1",
-        "regexpp": "^3.2.0",
-        "strip-ansi": "^6.0.1",
-        "strip-json-comments": "^3.1.0",
-        "text-table": "^0.2.0"
-      },
-      "dependencies": {
-        "escape-string-regexp": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
-          "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
-          "dev": true
-        },
-        "eslint-scope": {
-          "version": "7.1.1",
-          "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.1.tgz",
-          "integrity": "sha512-QKQM/UXpIiHcLqJ5AOyIW7XZmzjkzQXYE54n1++wb0u9V/abW3l9uQnxX8Z5Xd18xyKIMTUAyQ0k1e8pz6LUrw==",
-          "dev": true,
-          "requires": {
-            "esrecurse": "^4.3.0",
-            "estraverse": "^5.2.0"
-          }
-        },
-        "find-up": {
-          "version": "5.0.0",
-          "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
-          "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
-          "dev": true,
-          "requires": {
-            "locate-path": "^6.0.0",
-            "path-exists": "^4.0.0"
-          }
-        },
-        "glob-parent": {
-          "version": "6.0.2",
-          "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
-          "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
-          "dev": true,
-          "requires": {
-            "is-glob": "^4.0.3"
-          }
-        },
-        "globals": {
-          "version": "13.19.0",
-          "resolved": "https://registry.npmjs.org/globals/-/globals-13.19.0.tgz",
-          "integrity": "sha512-dkQ957uSRWHw7CFXLUtUHQI3g3aWApYhfNR2O6jn/907riyTYKVBmxYVROkBcY614FSSeSJh7Xm7SrUWCxvJMQ==",
-          "dev": true,
-          "requires": {
-            "type-fest": "^0.20.2"
-          }
-        },
-        "locate-path": {
-          "version": "6.0.0",
-          "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
-          "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
-          "dev": true,
-          "requires": {
-            "p-locate": "^5.0.0"
-          }
-        },
-        "p-locate": {
-          "version": "5.0.0",
-          "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
-          "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
-          "dev": true,
-          "requires": {
-            "p-limit": "^3.0.2"
-          }
-        },
-        "path-exists": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-          "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-          "dev": true
-        },
-        "type-fest": {
-          "version": "0.20.2",
-          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
-          "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
-          "dev": true
-        }
-      }
-    },
-    "eslint-config-next": {
-      "version": "13.1.2",
-      "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-13.1.2.tgz",
-      "integrity": "sha512-zdRAQOr8v69ZwJRtBrGqAqm160ONqKxU/pV1FB1KlgfyqveGsLZmlQ7l31otwtw763901J7xdiTVkj2y3YxXZA==",
-      "dev": true,
-      "requires": {
-        "@next/eslint-plugin-next": "13.1.2",
-        "@rushstack/eslint-patch": "^1.1.3",
-        "@typescript-eslint/parser": "^5.42.0",
-        "eslint-import-resolver-node": "^0.3.6",
-        "eslint-import-resolver-typescript": "^3.5.2",
-        "eslint-plugin-import": "^2.26.0",
-        "eslint-plugin-jsx-a11y": "^6.5.1",
-        "eslint-plugin-react": "^7.31.7",
-        "eslint-plugin-react-hooks": "^4.5.0"
-      }
-    },
-    "eslint-config-prettier": {
-      "version": "8.6.0",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-8.6.0.tgz",
-      "integrity": "sha512-bAF0eLpLVqP5oEVUFKpMA+NnRFICwn9X8B5jrR9FcqnYBuPbqWEjTEspPWMj5ye6czoSLDweCzSo3Ko7gGrZaA==",
-      "dev": true,
-      "requires": {}
-    },
-    "eslint-import-resolver-node": {
-      "version": "0.3.7",
-      "resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.7.tgz",
-      "integrity": "sha512-gozW2blMLJCeFpBwugLTGyvVjNoeo1knonXAcatC6bjPBZitotxdWf7Gimr25N4c0AAOo4eOUfaG82IJPDpqCA==",
-      "dev": true,
-      "requires": {
-        "debug": "^3.2.7",
-        "is-core-module": "^2.11.0",
-        "resolve": "^1.22.1"
-      },
-      "dependencies": {
-        "debug": {
-          "version": "3.2.7",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-          "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
-          "dev": true,
-          "requires": {
-            "ms": "^2.1.1"
-          }
-        },
-        "resolve": {
-          "version": "1.22.1",
-          "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.1.tgz",
-          "integrity": "sha512-nBpuuYuY5jFsli/JIs1oldw6fOQCBioohqWZg/2hiaOybXOft4lonv85uDOKXdf8rhyK159cxU5cDcK/NKk8zw==",
-          "dev": true,
-          "requires": {
-            "is-core-module": "^2.9.0",
-            "path-parse": "^1.0.7",
-            "supports-preserve-symlinks-flag": "^1.0.0"
-          }
-        }
-      }
-    },
-    "eslint-import-resolver-typescript": {
-      "version": "3.5.3",
-      "resolved": "https://registry.npmjs.org/eslint-import-resolver-typescript/-/eslint-import-resolver-typescript-3.5.3.tgz",
-      "integrity": "sha512-njRcKYBc3isE42LaTcJNVANR3R99H9bAxBDMNDr2W7yq5gYPxbU3MkdhsQukxZ/Xg9C2vcyLlDsbKfRDg0QvCQ==",
-      "dev": true,
-      "requires": {
-        "debug": "^4.3.4",
-        "enhanced-resolve": "^5.10.0",
-        "get-tsconfig": "^4.2.0",
-        "globby": "^13.1.2",
-        "is-core-module": "^2.10.0",
-        "is-glob": "^4.0.3",
-        "synckit": "^0.8.4"
-      },
-      "dependencies": {
-        "globby": {
-          "version": "13.1.3",
-          "resolved": "https://registry.npmjs.org/globby/-/globby-13.1.3.tgz",
-          "integrity": "sha512-8krCNHXvlCgHDpegPzleMq07yMYTO2sXKASmZmquEYWEmCx6J5UTRbp5RwMJkTJGtcQ44YpiUYUiN0b9mzy8Bw==",
-          "dev": true,
-          "requires": {
-            "dir-glob": "^3.0.1",
-            "fast-glob": "^3.2.11",
-            "ignore": "^5.2.0",
-            "merge2": "^1.4.1",
-            "slash": "^4.0.0"
-          }
-        },
-        "slash": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
-          "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
-          "dev": true
-        }
-      }
-    },
-    "eslint-module-utils": {
-      "version": "2.7.4",
-      "resolved": "https://registry.npmjs.org/eslint-module-utils/-/eslint-module-utils-2.7.4.tgz",
-      "integrity": "sha512-j4GT+rqzCoRKHwURX7pddtIPGySnX9Si/cgMI5ztrcqOPtk5dDEeZ34CQVPphnqkJytlc97Vuk05Um2mJ3gEQA==",
-      "dev": true,
-      "requires": {
-        "debug": "^3.2.7"
-      },
-      "dependencies": {
-        "debug": {
-          "version": "3.2.7",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-          "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
-          "dev": true,
-          "requires": {
-            "ms": "^2.1.1"
-          }
-        }
-      }
-    },
-    "eslint-plugin-import": {
-      "version": "2.27.4",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.27.4.tgz",
-      "integrity": "sha512-Z1jVt1EGKia1X9CnBCkpAOhWy8FgQ7OmJ/IblEkT82yrFU/xJaxwujaTzLWqigewwynRQ9mmHfX9MtAfhxm0sA==",
-      "dev": true,
-      "requires": {
-        "array-includes": "^3.1.6",
-        "array.prototype.flat": "^1.3.1",
-        "array.prototype.flatmap": "^1.3.0",
-        "debug": "^3.2.7",
-        "doctrine": "^2.1.0",
-        "eslint-import-resolver-node": "^0.3.7",
-        "eslint-module-utils": "^2.7.4",
-        "has": "^1.0.3",
-        "is-core-module": "^2.11.0",
-        "is-glob": "^4.0.3",
-        "minimatch": "^3.1.2",
-        "object.values": "^1.1.6",
-        "resolve": "^1.22.1",
-        "semver": "^6.3.0",
-        "tsconfig-paths": "^3.14.1"
-      },
-      "dependencies": {
-        "debug": {
-          "version": "3.2.7",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-          "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
-          "dev": true,
-          "requires": {
-            "ms": "^2.1.1"
-          }
-        },
-        "doctrine": {
-          "version": "2.1.0",
-          "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz",
-          "integrity": "sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==",
-          "dev": true,
-          "requires": {
-            "esutils": "^2.0.2"
-          }
-        },
-        "resolve": {
-          "version": "1.22.1",
-          "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.1.tgz",
-          "integrity": "sha512-nBpuuYuY5jFsli/JIs1oldw6fOQCBioohqWZg/2hiaOybXOft4lonv85uDOKXdf8rhyK159cxU5cDcK/NKk8zw==",
-          "dev": true,
-          "requires": {
-            "is-core-module": "^2.9.0",
-            "path-parse": "^1.0.7",
-            "supports-preserve-symlinks-flag": "^1.0.0"
-          }
-        },
-        "semver": {
-          "version": "6.3.0",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-          "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-          "dev": true
-        }
-      }
-    },
-    "eslint-plugin-jsx-a11y": {
-      "version": "6.7.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsx-a11y/-/eslint-plugin-jsx-a11y-6.7.1.tgz",
-      "integrity": "sha512-63Bog4iIethyo8smBklORknVjB0T2dwB8Mr/hIC+fBS0uyHdYYpzM/Ed+YC8VxTjlXHEWFOdmgwcDn1U2L9VCA==",
-      "dev": true,
-      "requires": {
-        "@babel/runtime": "^7.20.7",
-        "aria-query": "^5.1.3",
-        "array-includes": "^3.1.6",
-        "array.prototype.flatmap": "^1.3.1",
-        "ast-types-flow": "^0.0.7",
-        "axe-core": "^4.6.2",
-        "axobject-query": "^3.1.1",
-        "damerau-levenshtein": "^1.0.8",
-        "emoji-regex": "^9.2.2",
-        "has": "^1.0.3",
-        "jsx-ast-utils": "^3.3.3",
-        "language-tags": "=1.0.5",
-        "minimatch": "^3.1.2",
-        "object.entries": "^1.1.6",
-        "object.fromentries": "^2.0.6",
-        "semver": "^6.3.0"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "6.3.0",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-          "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-          "dev": true
-        }
-      }
-    },
-    "eslint-plugin-prettier": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-4.2.1.tgz",
-      "integrity": "sha512-f/0rXLXUt0oFYs8ra4w49wYZBG5GKZpAYsJSm6rnYL5uVDjd+zowwMwVZHnAjf4edNrKpCDYfXDgmRE/Ak7QyQ==",
-      "dev": true,
-      "requires": {
-        "prettier-linter-helpers": "^1.0.0"
-      }
-    },
-    "eslint-plugin-react": {
-      "version": "7.32.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.32.0.tgz",
-      "integrity": "sha512-vSBi1+SrPiLZCGvxpiZIa28fMEUaMjXtCplrvxcIxGzmFiYdsXQDwInEjuv5/i/2CTTxbkS87tE8lsQ0Qxinbw==",
-      "dev": true,
-      "requires": {
-        "array-includes": "^3.1.6",
-        "array.prototype.flatmap": "^1.3.1",
-        "array.prototype.tosorted": "^1.1.1",
-        "doctrine": "^2.1.0",
-        "estraverse": "^5.3.0",
-        "jsx-ast-utils": "^2.4.1 || ^3.0.0",
-        "minimatch": "^3.1.2",
-        "object.entries": "^1.1.6",
-        "object.fromentries": "^2.0.6",
-        "object.hasown": "^1.1.2",
-        "object.values": "^1.1.6",
-        "prop-types": "^15.8.1",
-        "resolve": "^2.0.0-next.4",
-        "semver": "^6.3.0",
-        "string.prototype.matchall": "^4.0.8"
-      },
-      "dependencies": {
-        "doctrine": {
-          "version": "2.1.0",
-          "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz",
-          "integrity": "sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==",
-          "dev": true,
-          "requires": {
-            "esutils": "^2.0.2"
-          }
-        },
-        "estraverse": {
-          "version": "5.3.0",
-          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
-          "dev": true
-        },
-        "resolve": {
-          "version": "2.0.0-next.4",
-          "resolved": "https://registry.npmjs.org/resolve/-/resolve-2.0.0-next.4.tgz",
-          "integrity": "sha512-iMDbmAWtfU+MHpxt/I5iWI7cY6YVEZUQ3MBgPQ++XD1PELuJHIl82xBmObyP2KyQmkNB2dsqF7seoQQiAn5yDQ==",
-          "dev": true,
-          "requires": {
-            "is-core-module": "^2.9.0",
-            "path-parse": "^1.0.7",
-            "supports-preserve-symlinks-flag": "^1.0.0"
-          }
-        },
-        "semver": {
-          "version": "6.3.0",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-          "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-          "dev": true
-        }
-      }
-    },
-    "eslint-plugin-react-hooks": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-4.6.0.tgz",
-      "integrity": "sha512-oFc7Itz9Qxh2x4gNHStv3BqJq54ExXmfC+a1NjAta66IAN87Wu0R/QArgIS9qKzX3dXKPI9H5crl9QchNMY9+g==",
-      "dev": true,
-      "requires": {}
-    },
-    "eslint-scope": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
-      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
-      "dev": true,
-      "requires": {
-        "esrecurse": "^4.3.0",
-        "estraverse": "^4.1.1"
-      },
-      "dependencies": {
-        "estraverse": {
-          "version": "4.3.0",
-          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
-          "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
-          "dev": true
-        }
-      }
-    },
-    "eslint-utils": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-3.0.0.tgz",
-      "integrity": "sha512-uuQC43IGctw68pJA1RgbQS8/NP7rch6Cwd4j3ZBtgo4/8Flj4eGE7ZYSZRN3iq5pVUv6GPdW5Z1RFleo84uLDA==",
-      "dev": true,
-      "requires": {
-        "eslint-visitor-keys": "^2.0.0"
-      },
-      "dependencies": {
-        "eslint-visitor-keys": {
-          "version": "2.1.0",
-          "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
-          "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
-          "dev": true
-        }
-      }
-    },
-    "eslint-visitor-keys": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.3.0.tgz",
-      "integrity": "sha512-mQ+suqKJVyeuwGYHAdjMFqjCyfl8+Ldnxuyp3ldiMBFKkvytrXUZWaiPCEav8qDHKty44bD+qV1IP4T+w+xXRA==",
-      "dev": true
-    },
-    "espree": {
-      "version": "9.4.1",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-9.4.1.tgz",
-      "integrity": "sha512-XwctdmTO6SIvCzd9810yyNzIrOrqNYV9Koizx4C/mRhf9uq0o4yHoCEU/670pOxOL/MSraektvSAji79kX90Vg==",
-      "dev": true,
-      "requires": {
-        "acorn": "^8.8.0",
-        "acorn-jsx": "^5.3.2",
-        "eslint-visitor-keys": "^3.3.0"
-      },
-      "dependencies": {
-        "acorn": {
-          "version": "8.8.1",
-          "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.8.1.tgz",
-          "integrity": "sha512-7zFpHzhnqYKrkYdUjF1HI1bzd0VygEGX8lFk4k5zVMqHEoES+P+7TKI+EvLO9WVMJ8eekdO0aDEK044xTXwPPA==",
-          "dev": true
-        }
-      }
-    },
-    "esprima": {
-      "version": "4.0.1",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
-      "dev": true,
-      "peer": true
-    },
-    "esquery": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.4.0.tgz",
-      "integrity": "sha512-cCDispWt5vHHtwMY2YrAQ4ibFkAL8RbH5YGBnZBc90MolvvfkkQcJro/aZiAQUlQ3qgrYS6D6v8Gc5G5CQsc9w==",
-      "dev": true,
-      "requires": {
-        "estraverse": "^5.1.0"
-      }
-    },
-    "esrecurse": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
-      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
-      "dev": true,
-      "requires": {
-        "estraverse": "^5.2.0"
-      }
-    },
-    "estraverse": {
-      "version": "5.2.0",
-      "integrity": "sha512-BxbNGGNm0RyRYvUdHpIwv9IWzeM9XClbOxwoATuFdOE7ZE6wHL+HQ5T8hoPM+zHvmKzzsEqhgy0GrQ5X13afiQ==",
-      "dev": true
-    },
-    "esutils": {
-      "version": "2.0.3",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
-      "dev": true
-    },
-    "exec-sh": {
-      "version": "0.3.6",
-      "integrity": "sha512-nQn+hI3yp+oD0huYhKwvYI32+JFeq+XkNcD1GAo3Y/MjxsfVGmrrzrnzjWiNY6f+pUCP440fThsFh5gZrRAU/w==",
-      "dev": true,
-      "peer": true
-    },
-    "execa": {
-      "version": "4.1.0",
-      "integrity": "sha512-j5W0//W7f8UxAn8hXVnwG8tLwdiUy4FJLcSupCg6maBYZDpyBvTApK7KyuI4bKj8KOh1r2YH+6ucuYtJv1bTZA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "cross-spawn": "^7.0.0",
-        "get-stream": "^5.0.0",
-        "human-signals": "^1.1.1",
-        "is-stream": "^2.0.0",
-        "merge-stream": "^2.0.0",
-        "npm-run-path": "^4.0.0",
-        "onetime": "^5.1.0",
-        "signal-exit": "^3.0.2",
-        "strip-final-newline": "^2.0.0"
-      }
-    },
-    "execall": {
-      "version": "2.0.0",
-      "integrity": "sha512-0FU2hZ5Hh6iQnarpRtQurM/aAvp3RIbfvgLHrcqJYzhXyV2KFruhuChf9NC6waAhiUR7FFtlugkI4p7f2Fqlow==",
-      "dev": true,
-      "requires": {
-        "clone-regexp": "^2.1.0"
-      }
-    },
-    "exit": {
-      "version": "0.1.2",
-      "integrity": "sha1-BjJjj42HfMghB9MKD/8aF8uhzQw=",
-      "dev": true,
-      "peer": true
-    },
-    "expand-brackets": {
-      "version": "2.1.4",
-      "integrity": "sha1-t3c14xXOMPa27/D4OwQVGiJEliI=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "debug": "^2.3.3",
-        "define-property": "^0.2.5",
-        "extend-shallow": "^2.0.1",
-        "posix-character-classes": "^0.1.0",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
-      },
-      "dependencies": {
-        "debug": {
-          "version": "2.6.9",
-          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "ms": "2.0.0"
-          }
-        },
-        "define-property": {
-          "version": "0.2.5",
-          "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-descriptor": "^0.1.0"
-          }
-        },
-        "is-accessor-descriptor": {
-          "version": "0.1.6",
-          "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "is-buffer": {
-          "version": "1.1.6",
-          "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-          "dev": true,
-          "peer": true
-        },
-        "is-data-descriptor": {
-          "version": "0.1.4",
-          "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "is-descriptor": {
-          "version": "0.1.6",
-          "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-accessor-descriptor": "^0.1.6",
-            "is-data-descriptor": "^0.1.4",
-            "kind-of": "^5.0.0"
-          }
-        },
-        "kind-of": {
-          "version": "5.1.0",
-          "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-          "dev": true,
-          "peer": true
-        },
-        "ms": {
-          "version": "2.0.0",
-          "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "expect": {
-      "version": "26.6.2",
-      "integrity": "sha512-9/hlOBkQl2l/PLHJx6JjoDF6xPKcJEsUlWKb23rKE7KzeDqUZKXKNMW27KIue5JMdBV9HgmoJPcc8HtO85t9IA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "ansi-styles": "^4.0.0",
-        "jest-get-type": "^26.3.0",
-        "jest-matcher-utils": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-regex-util": "^26.0.0"
-      }
-    },
-    "extend": {
-      "version": "3.0.2",
-      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
-      "dev": true
-    },
-    "extend-shallow": {
-      "version": "2.0.1",
-      "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "is-extendable": "^0.1.0"
-      }
-    },
-    "external-editor": {
-      "version": "3.1.0",
-      "integrity": "sha512-hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==",
-      "dev": true,
-      "requires": {
-        "chardet": "^0.7.0",
-        "iconv-lite": "^0.4.24",
-        "tmp": "^0.0.33"
-      }
-    },
-    "extglob": {
-      "version": "2.0.4",
-      "integrity": "sha512-Nmb6QXkELsuBr24CJSkilo6UHHgbekK5UiZgfE6UHD3Eb27YC6oD+bhcT+tJ6cl8dmsgdQxnWlcry8ksBIBLpw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "array-unique": "^0.3.2",
-        "define-property": "^1.0.0",
-        "expand-brackets": "^2.1.4",
-        "extend-shallow": "^2.0.1",
-        "fragment-cache": "^0.2.1",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "1.0.0",
-          "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-descriptor": "^1.0.0"
-          }
-        }
-      }
-    },
-    "extract-files": {
-      "version": "9.0.0",
-      "integrity": "sha512-CvdFfHkC95B4bBBk36hcEmvdR2awOdhhVUYH6S/zrVj3477zven/fJMYg7121h4T1xHZC+tetUpubpAhxwI7hQ==",
-      "dev": true
-    },
-    "fast-deep-equal": {
-      "version": "3.1.3",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
-      "dev": true
-    },
-    "fast-diff": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/fast-diff/-/fast-diff-1.2.0.tgz",
-      "integrity": "sha512-xJuoT5+L99XlZ8twedaRf6Ax2TgQVxvgZOYoPKqZufmJib0tL2tegPBOZb1pVNgIhlqDlA0eO0c3wBvQcmzx4w==",
-      "dev": true
-    },
-    "fast-glob": {
-      "version": "3.2.12",
-      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.2.12.tgz",
-      "integrity": "sha512-DVj4CQIYYow0BlaelwK1pHl5n5cRSJfM60UA0zK891sVInoPri2Ekj7+e1CT3/3qxXenpI+nBBmQAcJPJgaj4w==",
-      "dev": true,
-      "requires": {
-        "@nodelib/fs.stat": "^2.0.2",
-        "@nodelib/fs.walk": "^1.2.3",
-        "glob-parent": "^5.1.2",
-        "merge2": "^1.3.0",
-        "micromatch": "^4.0.4"
-      }
-    },
-    "fast-json-stable-stringify": {
-      "version": "2.1.0",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
-      "dev": true
-    },
-    "fast-levenshtein": {
-      "version": "2.0.6",
-      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
-      "dev": true
-    },
-    "fastest-levenshtein": {
-      "version": "1.0.12",
-      "integrity": "sha512-On2N+BpYJ15xIC974QNVuYGMOlEVt4s0EOI3wwMqOmK1fdDY+FN/zltPV8vosq4ad4c/gJ1KHScUn/6AWIgiow==",
-      "dev": true
-    },
-    "fastq": {
-      "version": "1.13.0",
-      "integrity": "sha512-YpkpUnK8od0o1hmeSc7UUs/eB/vIPWJYjKck2QKIzAf71Vm1AAQ3EbuZB3g2JIy+pg+ERD0vqI79KyZiB2e2Nw==",
-      "dev": true,
-      "requires": {
-        "reusify": "^1.0.4"
-      }
-    },
-    "fb-watchman": {
-      "version": "2.0.1",
-      "integrity": "sha512-DkPJKQeY6kKwmuMretBhr7G6Vodr7bFwDYTXIkfG1gjvNpaxBTQV3PbXg6bR1c1UP4jPOX0jHUbbHANL9vRjVg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "bser": "2.1.1"
-      }
-    },
-    "figures": {
-      "version": "3.2.0",
-      "integrity": "sha512-yaduQFRKLXYOGgEn6AZau90j3ggSOyiqXU0F9JZfeXYhNa+Jk4X+s45A2zg5jns87GAFa34BBm2kXw4XpNcbdg==",
-      "dev": true,
-      "requires": {
-        "escape-string-regexp": "^1.0.5"
-      }
-    },
-    "file-entry-cache": {
-      "version": "6.0.1",
-      "integrity": "sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==",
-      "dev": true,
-      "requires": {
-        "flat-cache": "^3.0.4"
-      }
-    },
-    "filelist": {
-      "version": "1.0.2",
-      "integrity": "sha512-z7O0IS8Plc39rTCq6i6iHxk43duYOn8uFJiWSewIq0Bww1RNybVHSCjahmcC87ZqAm4OTvFzlzeGu3XAzG1ctQ==",
-      "dev": true,
-      "requires": {
-        "minimatch": "^3.0.4"
-      }
-    },
-    "fill-range": {
-      "version": "7.0.1",
-      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
-      "dev": true,
-      "requires": {
-        "to-regex-range": "^5.0.1"
-      }
-    },
-    "find-up": {
-      "version": "2.1.0",
-      "integrity": "sha1-RdG35QbHF93UgndaK3eSCjwMV6c=",
-      "dev": true,
-      "requires": {
-        "locate-path": "^2.0.0"
-      }
-    },
-    "flat": {
-      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/flat/-/flat-5.0.2.tgz",
-      "integrity": "sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==",
-      "dev": true
-    },
-    "flat-cache": {
-      "version": "3.0.4",
-      "integrity": "sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==",
-      "dev": true,
-      "requires": {
-        "flatted": "^3.1.0",
-        "rimraf": "^3.0.2"
-      }
-    },
-    "flatted": {
-      "version": "3.2.2",
-      "integrity": "sha512-JaTY/wtrcSyvXJl4IMFHPKyFur1sE9AUqc0QnhOaJ0CxHtAoIV8pYDzeEfAaNEtGkOfq4gr3LBFmdXW5mOQFnA==",
-      "dev": true
-    },
-    "for-each": {
-      "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/for-each/-/for-each-0.3.3.tgz",
-      "integrity": "sha512-jqYfLp7mo9vIyQf8ykW2v7A+2N4QjeCeI5+Dz9XraiO1ign81wjiH7Fb9vSOWvQfNtmSa4H2RoQTrrXivdUZmw==",
-      "dev": true,
-      "requires": {
-        "is-callable": "^1.1.3"
-      }
-    },
-    "for-in": {
-      "version": "1.0.2",
-      "integrity": "sha1-gQaNKVqBQuwKxybG4iAMMPttXoA=",
-      "dev": true,
-      "peer": true
-    },
-    "form-data": {
-      "version": "3.0.1",
-      "integrity": "sha512-RHkBKtLWUVwd7SqRIvCZMEvAMoGUp0XU+seQiZejj0COz3RI3hWP4sCv3gZWWLjJTd7rGwcsF5eKZGii0r/hbg==",
-      "dev": true,
-      "requires": {
-        "asynckit": "^0.4.0",
-        "combined-stream": "^1.0.8",
-        "mime-types": "^2.1.12"
-      }
-    },
-    "fragment-cache": {
-      "version": "0.2.1",
-      "integrity": "sha1-QpD60n8T6Jvn8zeZxrxaCr//DRk=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "map-cache": "^0.2.2"
-      }
-    },
-    "fs-extra": {
-      "version": "9.0.1",
-      "integrity": "sha512-h2iAoN838FqAFJY2/qVpzFXy+EBxfVE220PalAqQLDVsFOHLJrZvut5puAbCdNv6WJk+B8ihI+k0c7JK5erwqQ==",
-      "dev": true,
-      "requires": {
-        "at-least-node": "^1.0.0",
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^1.0.0"
-      }
-    },
-    "fs.realpath": {
-      "version": "1.0.0",
-      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8=",
-      "dev": true
-    },
-    "fsevents": {
-      "version": "2.3.2",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
-      "optional": true,
-      "peer": true
-    },
-    "function-bind": {
-      "version": "1.1.1",
-      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A==",
-      "dev": true
-    },
-    "function.prototype.name": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/function.prototype.name/-/function.prototype.name-1.1.5.tgz",
-      "integrity": "sha512-uN7m/BzVKQnCUF/iW8jYea67v++2u7m5UgENbHRtdDVclOUP+FMPlCNdmk0h/ysGyo2tavMJEDqJAkJdRa1vMA==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.3",
-        "es-abstract": "^1.19.0",
-        "functions-have-names": "^1.2.2"
-      }
-    },
-    "functions-have-names": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/functions-have-names/-/functions-have-names-1.2.3.tgz",
-      "integrity": "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==",
-      "dev": true
-    },
-    "gensync": {
-      "version": "1.0.0-beta.2",
-      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
-      "dev": true
-    },
-    "get-caller-file": {
-      "version": "2.0.5",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
-      "dev": true
-    },
-    "get-intrinsic": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.1.3.tgz",
-      "integrity": "sha512-QJVz1Tj7MS099PevUG5jvnt9tSkXN8K14dxQlikJuPt4uD9hHAHjLyLBiLR5zELelBdD9QNRAXZzsJx0WaDL9A==",
-      "dev": true,
-      "requires": {
-        "function-bind": "^1.1.1",
-        "has": "^1.0.3",
-        "has-symbols": "^1.0.3"
-      }
-    },
-    "get-own-enumerable-property-symbols": {
-      "version": "3.0.2",
-      "integrity": "sha512-I0UBV/XOz1XkIJHEUDMZAbzCThU/H8DxmSfmdGcKPnVhu2VfFqr34jr9777IyaTYvxjedWhqVIilEDsCdP5G6g==",
-      "dev": true
-    },
-    "get-package-type": {
-      "version": "0.1.0",
-      "integrity": "sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==",
-      "dev": true,
-      "peer": true
-    },
-    "get-stream": {
-      "version": "5.2.0",
-      "integrity": "sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "pump": "^3.0.0"
-      }
-    },
-    "get-symbol-description": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/get-symbol-description/-/get-symbol-description-1.0.0.tgz",
-      "integrity": "sha512-2EmdH1YvIQiZpltCNgkuiUnyukzxM/R6NDJX31Ke3BG1Nq5b0S2PhX59UKi9vZpPDQVdqn+1IcaAwnzTT5vCjw==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.1"
-      }
-    },
-    "get-tsconfig": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.3.0.tgz",
-      "integrity": "sha512-YCcF28IqSay3fqpIu5y3Krg/utCBHBeoflkZyHj/QcqI2nrLPC3ZegS9CmIo+hJb8K7aiGsuUl7PwWVjNG2HQQ==",
-      "dev": true
-    },
-    "get-value": {
-      "version": "2.0.6",
-      "integrity": "sha1-3BXKHGcjh8p2vTesCjlbogQqLCg=",
-      "dev": true,
-      "peer": true
-    },
-    "glob": {
-      "version": "7.2.0",
-      "integrity": "sha512-lmLf6gtyrPq8tTjSmrO94wBeQbFR3HbLHbuyD69wuyQkImp2hWqMGB47OX65FBkPffO641IP9jWa1z4ivqG26Q==",
-      "dev": true,
-      "requires": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.0.4",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      }
-    },
-    "glob-parent": {
-      "version": "5.1.2",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
-      "dev": true,
-      "requires": {
-        "is-glob": "^4.0.1"
-      }
-    },
-    "glob-to-regexp": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/glob-to-regexp/-/glob-to-regexp-0.4.1.tgz",
-      "integrity": "sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==",
-      "dev": true
-    },
-    "global-modules": {
-      "version": "2.0.0",
-      "integrity": "sha512-NGbfmJBp9x8IxyJSd1P+otYK8vonoJactOogrVfFRIAEY1ukil8RSKDz2Yo7wh1oihl51l/r6W4epkeKJHqL8A==",
-      "dev": true,
-      "requires": {
-        "global-prefix": "^3.0.0"
-      }
-    },
-    "global-prefix": {
-      "version": "3.0.0",
-      "integrity": "sha512-awConJSVCHVGND6x3tmMaKcQvwXLhjdkmomy2W+Goaui8YPgYgXJZewhg3fWC+DlfqqQuWg8AwqjGTD2nAPVWg==",
-      "dev": true,
-      "requires": {
-        "ini": "^1.3.5",
-        "kind-of": "^6.0.2",
-        "which": "^1.3.1"
-      },
-      "dependencies": {
-        "which": {
-          "version": "1.3.1",
-          "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
-          "dev": true,
-          "requires": {
-            "isexe": "^2.0.0"
-          }
-        }
-      }
-    },
-    "globals": {
-      "version": "11.12.0",
-      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
-      "dev": true
-    },
-    "globalthis": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.3.tgz",
-      "integrity": "sha512-sFdI5LyBiNTHjRd7cGPWapiHWMOXKyuBNX/cWJ3NfzrZQVa8GI/8cofCl74AOVqq9W5kNmguTIzJ/1s2gyI9wA==",
-      "dev": true,
-      "requires": {
-        "define-properties": "^1.1.3"
-      }
-    },
-    "globalyzer": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/globalyzer/-/globalyzer-0.1.0.tgz",
-      "integrity": "sha512-40oNTM9UfG6aBmuKxk/giHn5nQ8RVz/SS4Ir6zgzOv9/qC3kKZ9v4etGTcJbEl/NyVQH7FGU7d+X1egr57Md2Q==",
-      "dev": true
-    },
-    "globby": {
-      "version": "11.0.1",
-      "integrity": "sha512-iH9RmgwCmUJHi2z5o2l3eTtGBtXek1OYlHrbcxOYugyHLmAsZrPj43OtHThd62Buh/Vv6VyCBD2bdyWcGNQqoQ==",
-      "dev": true,
-      "requires": {
-        "array-union": "^2.1.0",
-        "dir-glob": "^3.0.1",
-        "fast-glob": "^3.1.1",
-        "ignore": "^5.1.4",
-        "merge2": "^1.3.0",
-        "slash": "^3.0.0"
-      }
-    },
-    "globjoin": {
-      "version": "0.1.4",
-      "integrity": "sha1-L0SUrIkZ43Z8XLtpHp9GMyQoXUM=",
-      "dev": true
-    },
-    "globrex": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/globrex/-/globrex-0.1.2.tgz",
-      "integrity": "sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg==",
-      "dev": true
-    },
-    "gonzales-pe": {
-      "version": "4.3.0",
-      "integrity": "sha512-otgSPpUmdWJ43VXyiNgEYE4luzHCL2pz4wQ0OnDluC6Eg4Ko3Vexy/SrSynglw/eR+OhkzmqFCZa/OFa/RgAOQ==",
-      "dev": true,
-      "requires": {
-        "minimist": "^1.2.5"
-      }
-    },
-    "gopd": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.0.1.tgz",
-      "integrity": "sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==",
-      "dev": true,
-      "requires": {
-        "get-intrinsic": "^1.1.3"
-      }
-    },
-    "graceful-fs": {
-      "version": "4.2.11",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
-      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
-      "dev": true
-    },
-    "grapheme-splitter": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/grapheme-splitter/-/grapheme-splitter-1.0.4.tgz",
-      "integrity": "sha512-bzh50DW9kTPM00T8y4o8vQg89Di9oLJVLW/KaOGIXJWP/iqCN6WKYkbNOF04vFLJhwcpYUh9ydh/+5vpOqV4YQ==",
-      "dev": true
-    },
-    "graphql": {
-      "version": "15.6.1",
-      "integrity": "sha512-3i5lu0z6dRvJ48QP9kFxBkJ7h4Kso7PS8eahyTFz5Jm6CvQfLtNIE8LX9N6JLnXTuwR+sIYnXzaWp6anOg0QQw==",
-      "dev": true
-    },
-    "graphql-request": {
-      "version": "3.5.0",
-      "integrity": "sha512-Io89QpfU4rqiMbqM/KwMBzKaDLOppi8FU8sEccCE4JqCgz95W9Q8bvxQ4NfPALLSMvg9nafgg8AkYRmgKSlukA==",
-      "dev": true,
-      "requires": {
-        "cross-fetch": "^3.0.6",
-        "extract-files": "^9.0.0",
-        "form-data": "^3.0.0"
-      }
-    },
-    "growly": {
-      "version": "1.3.0",
-      "integrity": "sha1-8QdIy+dq+WS3yWyTxrzCivEgwIE=",
-      "dev": true,
-      "optional": true,
-      "peer": true
-    },
-    "hard-rejection": {
-      "version": "2.1.0",
-      "integrity": "sha512-VIZB+ibDhx7ObhAe7OVtoEbuP4h/MuOTHJ+J8h/eBXotJYl0fBgR72xDFCKgIh22OJZIOVNxBMWuhAr10r8HdA==",
-      "dev": true
-    },
-    "has": {
-      "version": "1.0.3",
-      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
-      "dev": true,
-      "requires": {
-        "function-bind": "^1.1.1"
-      }
-    },
-    "has-bigints": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.0.2.tgz",
-      "integrity": "sha512-tSvCKtBr9lkF0Ex0aQiP9N+OpV4zi2r/Nee5VkRDbaqv35RLYMzbwQfFSZZH0kR+Rd6302UJZ2p/bJCEoR3VoQ==",
-      "dev": true
-    },
-    "has-flag": {
-      "version": "4.0.0",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "dev": true
-    },
-    "has-property-descriptors": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.0.tgz",
-      "integrity": "sha512-62DVLZGoiEBDHQyqG4w9xCuZ7eJEwNmJRWw2VY84Oedb7WFcA27fiEVe8oUQx9hAUJ4ekurquucTGwsyO1XGdQ==",
-      "dev": true,
-      "requires": {
-        "get-intrinsic": "^1.1.1"
-      }
-    },
-    "has-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.0.1.tgz",
-      "integrity": "sha512-7qE+iP+O+bgF9clE5+UoBFzE65mlBiVj3tKCrlNQ0Ogwm0BjpT/gK4SlLYDMybDh5I3TCTKnPPa0oMG7JDYrhg==",
-      "dev": true
-    },
-    "has-symbols": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz",
-      "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==",
-      "dev": true
-    },
-    "has-tostringtag": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.0.tgz",
-      "integrity": "sha512-kFjcSNhnlGV1kyoGk7OXKSawH5JOb/LzUc5w9B02hOTO0dfFRjbHQKvg1d6cf3HbeUmtU9VbbV3qzZ2Teh97WQ==",
-      "dev": true,
-      "requires": {
-        "has-symbols": "^1.0.2"
-      }
-    },
-    "has-value": {
-      "version": "1.0.0",
-      "integrity": "sha1-GLKB2lhbHFxR3vJMkw7SmgvmsXc=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "get-value": "^2.0.6",
-        "has-values": "^1.0.0",
-        "isobject": "^3.0.0"
-      }
-    },
-    "has-values": {
-      "version": "1.0.0",
-      "integrity": "sha1-lbC2P+whRmGab+V/51Yo1aOe/k8=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "is-number": "^3.0.0",
-        "kind-of": "^4.0.0"
-      },
-      "dependencies": {
-        "is-buffer": {
-          "version": "1.1.6",
-          "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-          "dev": true,
-          "peer": true
-        },
-        "is-number": {
-          "version": "3.0.0",
-          "integrity": "sha1-JP1iAaR4LPUFYcgQJ2r8fRLXEZU=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "kind-of": {
-          "version": "4.0.0",
-          "integrity": "sha1-IIE989cSkosgc3hpGkUGb65y3Vc=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
-    },
-    "hosted-git-info": {
-      "version": "2.8.9",
-      "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==",
-      "dev": true,
-      "peer": true
-    },
-    "html-encoding-sniffer": {
-      "version": "2.0.1",
-      "integrity": "sha512-D5JbOMBIR/TVZkubHT+OyT2705QvogUW4IBn6nHd756OwieSF9aDYFj4dv6HHEVGYbHaLETa3WggZYWWMyy3ZQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "whatwg-encoding": "^1.0.5"
-      }
-    },
-    "html-escaper": {
-      "version": "2.0.2",
-      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
-      "dev": true,
-      "peer": true
-    },
-    "html-tags": {
-      "version": "3.1.0",
-      "integrity": "sha512-1qYz89hW3lFDEazhjW0yVAV87lw8lVkrJocr72XmBkMKsoSVJCQx3W8BXsC7hO2qAt8BoVjYjtAcZ9perqGnNg==",
-      "dev": true
-    },
-    "htmlparser2": {
-      "version": "3.10.1",
-      "integrity": "sha512-IgieNijUMbkDovyoKObU1DUhm1iwNYE/fuifEoEHfd1oZKZDaONBSkal7Y01shxsM49R4XaMdGez3WnF9UfiCQ==",
-      "dev": true,
-      "requires": {
-        "domelementtype": "^1.3.1",
-        "domhandler": "^2.3.0",
-        "domutils": "^1.5.1",
-        "entities": "^1.1.1",
-        "inherits": "^2.0.1",
-        "readable-stream": "^3.1.1"
-      }
-    },
-    "http-proxy-agent": {
-      "version": "4.0.1",
-      "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@tootallnate/once": "1",
-        "agent-base": "6",
-        "debug": "4"
-      }
-    },
-    "https-proxy-agent": {
-      "version": "5.0.0",
-      "integrity": "sha512-EkYm5BcKUGiduxzSt3Eppko+PiNWNEpa4ySk9vTC6wDsQJW9rHSa+UhGNJoRYp7bz6Ht1eaRIa6QaJqO5rCFbA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "agent-base": "6",
-        "debug": "4"
-      }
-    },
-    "human-signals": {
-      "version": "1.1.1",
-      "integrity": "sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==",
-      "dev": true,
-      "peer": true
-    },
-    "iconv-lite": {
-      "version": "0.4.24",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
-      "dev": true,
-      "requires": {
-        "safer-buffer": ">= 2.1.2 < 3"
-      }
-    },
-    "ignore": {
-      "version": "5.2.4",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.2.4.tgz",
-      "integrity": "sha512-MAb38BcSbH0eHNBxn7ql2NH/kX33OkB3lZ1BNdh7ENeRChHTYsTvWrMubiIAMNS2llXEEgZ1MUOBtXChP3kaFQ==",
-      "dev": true
-    },
-    "import-fresh": {
-      "version": "3.3.0",
-      "integrity": "sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==",
-      "dev": true,
-      "requires": {
-        "parent-module": "^1.0.0",
-        "resolve-from": "^4.0.0"
-      }
-    },
-    "import-local": {
-      "version": "3.0.3",
-      "integrity": "sha512-bE9iaUY3CXH8Cwfan/abDKAxe1KGT9kyGsBPqf6DMK/z0a2OzAsrukeYNgIH6cH5Xr452jb1TUL8rSfCLjZ9uA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "pkg-dir": "^4.2.0",
-        "resolve-cwd": "^3.0.0"
-      },
-      "dependencies": {
-        "find-up": {
-          "version": "4.1.0",
-          "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "locate-path": "^5.0.0",
-            "path-exists": "^4.0.0"
-          }
-        },
-        "locate-path": {
-          "version": "5.0.0",
-          "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-locate": "^4.1.0"
-          }
-        },
-        "p-limit": {
-          "version": "2.3.0",
-          "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-try": "^2.0.0"
-          }
-        },
-        "p-locate": {
-          "version": "4.1.0",
-          "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-limit": "^2.2.0"
-          }
-        },
-        "path-exists": {
-          "version": "4.0.0",
-          "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-          "dev": true,
-          "peer": true
-        },
-        "pkg-dir": {
-          "version": "4.2.0",
-          "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "find-up": "^4.0.0"
-          }
-        }
-      }
-    },
-    "imurmurhash": {
-      "version": "0.1.4",
-      "integrity": "sha1-khi5srkoojixPcT7a21XbyMUU+o=",
-      "dev": true
-    },
-    "indent-string": {
-      "version": "4.0.0",
-      "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
-      "dev": true
-    },
-    "inflight": {
-      "version": "1.0.6",
-      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
-      "dev": true,
-      "requires": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "inherits": {
-      "version": "2.0.4",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true
-    },
-    "ini": {
-      "version": "1.3.8",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
-      "dev": true
-    },
-    "inquirer": {
-      "version": "7.3.3",
-      "resolved": "https://registry.npmjs.org/inquirer/-/inquirer-7.3.3.tgz",
-      "integrity": "sha512-JG3eIAj5V9CwcGvuOmoo6LB9kbAYT8HXffUl6memuszlwDC/qvFAJw49XJ5NROSFNPxp3iQg1GqkFhaY/CR0IA==",
-      "dev": true,
-      "requires": {
-        "ansi-escapes": "^4.2.1",
-        "chalk": "^4.1.0",
-        "cli-cursor": "^3.1.0",
-        "cli-width": "^3.0.0",
-        "external-editor": "^3.0.3",
-        "figures": "^3.0.0",
-        "lodash": "^4.17.19",
-        "mute-stream": "0.0.8",
-        "run-async": "^2.4.0",
-        "rxjs": "^6.6.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0",
-        "through": "^2.3.6"
-      }
-    },
-    "internal-slot": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.0.4.tgz",
-      "integrity": "sha512-tA8URYccNzMo94s5MQZgH8NB/XTa6HsOo0MLfXTKKEnHVVdegzaQoFZ7Jp44bdvLvY2waT5dc+j5ICEswhi7UQ==",
-      "dev": true,
-      "requires": {
-        "get-intrinsic": "^1.1.3",
-        "has": "^1.0.3",
-        "side-channel": "^1.0.4"
-      }
-    },
-    "ip-regex": {
-      "version": "4.3.0",
-      "integrity": "sha512-B9ZWJxHHOHUhUjCPrMpLD4xEq35bUTClHM1S6CBU5ixQnkZmwipwgc96vAd7AAGM9TGHvJR+Uss+/Ak6UphK+Q==",
-      "dev": true
-    },
-    "is-accessor-descriptor": {
-      "version": "1.0.0",
-      "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "kind-of": "^6.0.0"
-      }
-    },
-    "is-alphabetical": {
-      "version": "1.0.4",
-      "integrity": "sha512-DwzsA04LQ10FHTZuL0/grVDk4rFoVH1pjAToYwBrHSxcrBIGQuXrQMtD5U1b0U2XVgKZCTLLP8u2Qxqhy3l2Vg==",
-      "dev": true
-    },
-    "is-alphanumeric": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-alphanumeric/-/is-alphanumeric-1.0.0.tgz",
-      "integrity": "sha512-ZmRL7++ZkcMOfDuWZuMJyIVLr2keE1o/DeNWh1EmgqGhUcV+9BIVsx0BcSBOHTZqzjs4+dISzr2KAeBEWGgXeA==",
-      "dev": true
-    },
-    "is-alphanumerical": {
-      "version": "1.0.4",
-      "integrity": "sha512-UzoZUr+XfVz3t3v4KyGEniVL9BDRoQtY7tOyrRybkVNjDFWyo1yhXNGrrBTQxp3ib9BLAWs7k2YKBQsFRkZG9A==",
-      "dev": true,
-      "requires": {
-        "is-alphabetical": "^1.0.0",
-        "is-decimal": "^1.0.0"
-      }
-    },
-    "is-arguments": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-arguments/-/is-arguments-1.1.1.tgz",
-      "integrity": "sha512-8Q7EARjzEnKpt/PCD7e1cgUS0a6X8u5tdSiMqXhojOdoV9TsMsiO+9VLC5vAmO8N7/GmXn7yjR8qnA6bVAEzfA==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      }
-    },
-    "is-array-buffer": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.1.tgz",
-      "integrity": "sha512-ASfLknmY8Xa2XtB4wmbz13Wu202baeA18cJBCeCy0wXUHZF0IPyVEXqKEcd+t2fNSLLL1vC6k7lxZEojNbISXQ==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.3",
-        "is-typed-array": "^1.1.10"
-      }
-    },
-    "is-arrayish": {
-      "version": "0.2.1",
-      "integrity": "sha1-d8mYQFJ6qOyxqLppe4BkWnqSap0=",
-      "dev": true
-    },
-    "is-bigint": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-bigint/-/is-bigint-1.0.4.tgz",
-      "integrity": "sha512-zB9CruMamjym81i2JZ3UMn54PKGsQzsJeo6xvN3HJJ4CAsQNB6iRutp2To77OfCNuoxspsIhzaPoO1zyCEhFOg==",
-      "dev": true,
-      "requires": {
-        "has-bigints": "^1.0.1"
-      }
-    },
-    "is-boolean-object": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.1.2.tgz",
-      "integrity": "sha512-gDYaKHJmnj4aWxyj6YHyXVpdQawtVLHU5cb+eztPGczf6cjuTdwve5ZIEfgXqH4e57An1D1AKf8CZ3kYrQRqYA==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      }
-    },
-    "is-buffer": {
-      "version": "2.0.5",
-      "integrity": "sha512-i2R6zNFDwgEHJyQUtJEk0XFi1i0dPFn/oqjK3/vPCcDeJvW5NQ83V8QbicfF1SupOaB0h8ntgBC2YiE7dfyctQ==",
-      "dev": true
-    },
-    "is-callable": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.7.tgz",
-      "integrity": "sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==",
-      "dev": true
-    },
-    "is-ci": {
-      "version": "2.0.0",
-      "integrity": "sha512-YfJT7rkpQB0updsdHLGWrvhBJfcfzNNawYDNIyQXJz0IViGf75O8EBPKSdvw2rF+LGCsX4FZ8tcr3b19LcZq4w==",
-      "dev": true,
-      "requires": {
-        "ci-info": "^2.0.0"
-      }
-    },
-    "is-core-module": {
-      "version": "2.11.0",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.11.0.tgz",
-      "integrity": "sha512-RRjxlvLDkD1YJwDbroBHMb+cukurkDWNyHx7D3oNB5x9rb5ogcksMC5wHCadcXoo67gVr/+3GFySh3134zi6rw==",
-      "dev": true,
-      "requires": {
-        "has": "^1.0.3"
-      }
-    },
-    "is-data-descriptor": {
-      "version": "1.0.0",
-      "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "kind-of": "^6.0.0"
-      }
-    },
-    "is-date-object": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.0.5.tgz",
-      "integrity": "sha512-9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ==",
-      "dev": true,
-      "requires": {
-        "has-tostringtag": "^1.0.0"
-      }
-    },
-    "is-decimal": {
-      "version": "1.0.4",
-      "integrity": "sha512-RGdriMmQQvZ2aqaQq3awNA6dCGtKpiDFcOzrTWrDAT2MiWrKQVPmxLGHl7Y2nNu6led0kEyoX0enY0qXYsv9zw==",
-      "dev": true
-    },
-    "is-descriptor": {
-      "version": "1.0.2",
-      "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "is-accessor-descriptor": "^1.0.0",
-        "is-data-descriptor": "^1.0.0",
-        "kind-of": "^6.0.2"
-      }
-    },
-    "is-docker": {
-      "version": "2.2.1",
-      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
-      "dev": true
-    },
-    "is-extendable": {
-      "version": "0.1.1",
-      "integrity": "sha1-YrEQ4omkcUGOPsNqYX1HLjAd/Ik=",
-      "dev": true,
-      "peer": true
-    },
-    "is-extglob": {
-      "version": "2.1.1",
-      "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=",
-      "dev": true
-    },
-    "is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "dev": true
-    },
-    "is-generator-fn": {
-      "version": "2.1.0",
-      "integrity": "sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==",
-      "dev": true,
-      "peer": true
-    },
-    "is-glob": {
-      "version": "4.0.3",
-      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
-      "dev": true,
-      "requires": {
-        "is-extglob": "^2.1.1"
-      }
-    },
-    "is-hexadecimal": {
-      "version": "1.0.4",
-      "integrity": "sha512-gyPJuv83bHMpocVYoqof5VDiZveEoGoFL8m3BXNb2VW8Xs+rz9kqO8LOQ5DH6EsuvilT1ApazU0pyl+ytbPtlw==",
-      "dev": true
-    },
-    "is-map": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-map/-/is-map-2.0.2.tgz",
-      "integrity": "sha512-cOZFQQozTha1f4MxLFzlgKYPTyj26picdZTx82hbc/Xf4K/tZOOXSCkMvU4pKioRXGDLJRn0GM7Upe7kR721yg==",
-      "dev": true
-    },
-    "is-negative-zero": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.2.tgz",
-      "integrity": "sha512-dqJvarLawXsFbNDeJW7zAz8ItJ9cd28YufuuFzh0G8pNHjJMnY08Dv7sYX2uF5UpQOwieAeOExEYAWWfu7ZZUA==",
-      "dev": true
-    },
-    "is-number": {
-      "version": "7.0.0",
-      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
-      "dev": true
-    },
-    "is-number-object": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/is-number-object/-/is-number-object-1.0.7.tgz",
-      "integrity": "sha512-k1U0IRzLMo7ZlYIfzRu23Oh6MiIFasgpb9X76eqfFZAqwH44UI4KTBvBYIZ1dSL9ZzChTB9ShHfLkR4pdW5krQ==",
-      "dev": true,
-      "requires": {
-        "has-tostringtag": "^1.0.0"
-      }
-    },
-    "is-obj": {
-      "version": "1.0.1",
-      "integrity": "sha1-PkcprB9f3gJc19g6iW2rn09n2w8=",
-      "dev": true
-    },
-    "is-path-inside": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/is-path-inside/-/is-path-inside-3.0.3.tgz",
-      "integrity": "sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==",
-      "dev": true
-    },
-    "is-plain-obj": {
-      "version": "1.1.0",
-      "integrity": "sha1-caUMhCnfync8kqOQpKA7OfzVHT4=",
-      "dev": true
-    },
-    "is-plain-object": {
-      "version": "2.0.4",
-      "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "isobject": "^3.0.1"
-      }
-    },
-    "is-potential-custom-element-name": {
-      "version": "1.0.1",
-      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
-      "dev": true,
-      "peer": true
-    },
-    "is-regex": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
-      "integrity": "sha512-kvRdxDsxZjhzUX07ZnLydzS1TU/TJlTUHHY4YLL87e37oUA49DfkLqgy+VjFocowy29cKvcSiu+kIv728jTTVg==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "has-tostringtag": "^1.0.0"
-      }
-    },
-    "is-regexp": {
-      "version": "1.0.0",
-      "integrity": "sha1-/S2INUXEa6xaYz57mgnof6LLUGk=",
-      "dev": true
-    },
-    "is-set": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-set/-/is-set-2.0.2.tgz",
-      "integrity": "sha512-+2cnTEZeY5z/iXGbLhPrOAaK/Mau5k5eXq9j14CpRTftq0pAJu2MwVRSZhyZWBzx3o6X795Lz6Bpb6R0GKf37g==",
-      "dev": true
-    },
-    "is-shared-array-buffer": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-shared-array-buffer/-/is-shared-array-buffer-1.0.2.tgz",
-      "integrity": "sha512-sqN2UDu1/0y6uvXyStCOzyhAjCSlHceFoMKJW8W9EU9cvic/QdsZ0kEU93HEy3IUEFZIiH/3w+AH/UQbPHNdhA==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2"
-      }
-    },
-    "is-stream": {
-      "version": "2.0.1",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
-      "dev": true
-    },
-    "is-string": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/is-string/-/is-string-1.0.7.tgz",
-      "integrity": "sha512-tE2UXzivje6ofPW7l23cjDOMa09gb7xlAqG6jG5ej6uPV32TlWP3NKPigtaGeHNu9fohccRYvIiZMfOOnOYUtg==",
-      "dev": true,
-      "requires": {
-        "has-tostringtag": "^1.0.0"
-      }
-    },
-    "is-symbol": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-symbol/-/is-symbol-1.0.4.tgz",
-      "integrity": "sha512-C/CPBqKWnvdcxqIARxyOh4v1UUEOCHpgDa0WYgpKDFMszcrPcffg5uhwSgPCLD2WWxmq6isisz87tzT01tuGhg==",
-      "dev": true,
-      "requires": {
-        "has-symbols": "^1.0.2"
-      }
-    },
-    "is-typed-array": {
-      "version": "1.1.10",
-      "resolved": "https://registry.npmjs.org/is-typed-array/-/is-typed-array-1.1.10.tgz",
-      "integrity": "sha512-PJqgEHiWZvMpaFZ3uTc8kHPM4+4ADTlDniuQL7cU/UDA0Ql7F70yGfHph3cLNe+c9toaigv+DFzTJKhc2CtO6A==",
-      "dev": true,
-      "requires": {
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "gopd": "^1.0.1",
-        "has-tostringtag": "^1.0.0"
-      }
-    },
-    "is-typedarray": {
-      "version": "1.0.0",
-      "integrity": "sha1-5HnICFjfDBsR3dppQPlgEfzaSpo=",
-      "dev": true
-    },
-    "is-unicode-supported": {
-      "version": "0.1.0",
-      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
-      "dev": true
-    },
-    "is-url-superb": {
-      "version": "3.0.0",
-      "integrity": "sha512-3faQP+wHCGDQT1qReM5zCPx2mxoal6DzbzquFlCYJLWyy4WPTved33ea2xFbX37z4NoriEwZGIYhFtx8RUB5wQ==",
-      "dev": true,
-      "requires": {
-        "url-regex": "^5.0.0"
-      }
-    },
-    "is-weakmap": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-weakmap/-/is-weakmap-2.0.1.tgz",
-      "integrity": "sha512-NSBR4kH5oVj1Uwvv970ruUkCV7O1mzgVFO4/rev2cLRda9Tm9HrL70ZPut4rOHgY0FNrUu9BCbXA2sdQ+x0chA==",
-      "dev": true
-    },
-    "is-weakref": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.0.2.tgz",
-      "integrity": "sha512-qctsuLZmIQ0+vSSMfoVvyFe2+GSEvnmZ2ezTup1SBse9+twCCeial6EEi3Nc2KFcf6+qz2FBPnjXsk8xhKSaPQ==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2"
-      }
-    },
-    "is-weakset": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-weakset/-/is-weakset-2.0.2.tgz",
-      "integrity": "sha512-t2yVvttHkQktwnNNmBQ98AhENLdPUTDTE21uPqAQ0ARwQfGeQKRVS0NNurH7bTf7RrvcVn1OOge45CnBeHCSmg==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.1"
-      }
-    },
-    "is-whitespace-character": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-whitespace-character/-/is-whitespace-character-1.0.4.tgz",
-      "integrity": "sha512-SDweEzfIZM0SJV0EUga669UTKlmL0Pq8Lno0QDQsPnvECB3IM2aP0gdx5TrU0A01MAPfViaZiI2V1QMZLaKK5w==",
-      "dev": true
-    },
-    "is-windows": {
-      "version": "1.0.2",
-      "integrity": "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==",
-      "dev": true,
-      "peer": true
-    },
-    "is-word-character": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-word-character/-/is-word-character-1.0.4.tgz",
-      "integrity": "sha512-5SMO8RVennx3nZrqtKwCGyyetPE9VDba5ugvKLaD4KopPG5kR4mQ7tNt/r7feL5yt5h3lpuBbIUmCOG2eSzXHA==",
-      "dev": true
-    },
-    "is-wsl": {
-      "version": "2.2.0",
-      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
-      "dev": true,
-      "requires": {
-        "is-docker": "^2.0.0"
-      }
-    },
-    "isarray": {
-      "version": "1.0.0",
-      "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE=",
-      "dev": true,
-      "peer": true
-    },
-    "isexe": {
-      "version": "2.0.0",
-      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=",
-      "dev": true
-    },
-    "isobject": {
-      "version": "3.0.1",
-      "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-      "dev": true,
-      "peer": true
-    },
-    "istanbul-lib-coverage": {
-      "version": "3.0.2",
-      "integrity": "sha512-o5+eTUYzCJ11/+JhW5/FUCdfsdoYVdQ/8I/OveE2XsjehYn5DdeSnNQAbjYaO8gQ6hvGTN6GM6ddQqpTVG5j8g==",
-      "dev": true,
-      "peer": true
-    },
-    "istanbul-lib-instrument": {
-      "version": "4.0.3",
-      "integrity": "sha512-BXgQl9kf4WTCPCCpmFGoJkz/+uhvm7h7PFKUYxh7qarQd3ER33vHG//qaE8eN25l07YqZPpHXU9I09l/RD5aGQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/core": "^7.7.5",
-        "@istanbuljs/schema": "^0.1.2",
-        "istanbul-lib-coverage": "^3.0.0",
-        "semver": "^6.3.0"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "6.3.0",
-          "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "istanbul-lib-report": {
-      "version": "3.0.0",
-      "integrity": "sha512-wcdi+uAKzfiGT2abPpKZ0hSU1rGQjUQnLvtY5MpQ7QCTahD3VODhcu4wcfY1YtkGaDD5yuydOLINXsfbus9ROw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "istanbul-lib-coverage": "^3.0.0",
-        "make-dir": "^3.0.0",
-        "supports-color": "^7.1.0"
-      },
-      "dependencies": {
-        "make-dir": {
-          "version": "3.1.0",
-          "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "semver": "^6.0.0"
-          }
-        },
-        "semver": {
-          "version": "6.3.0",
-          "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "istanbul-lib-source-maps": {
-      "version": "4.0.0",
-      "integrity": "sha512-c16LpFRkR8vQXyHZ5nLpY35JZtzj1PQY1iZmesUbf1FZHbIupcWfjgOXBY9YHkLEQ6puz1u4Dgj6qmU/DisrZg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "debug": "^4.1.1",
-        "istanbul-lib-coverage": "^3.0.0",
-        "source-map": "^0.6.1"
-      },
-      "dependencies": {
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "istanbul-reports": {
-      "version": "3.0.3",
-      "integrity": "sha512-0i77ZFLsb9U3DHi22WzmIngVzfoyxxbQcZRqlF3KoKmCJGq9nhFHoGi8FqBztN2rE8w6hURnZghetn0xpkVb6A==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "html-escaper": "^2.0.0",
-        "istanbul-lib-report": "^3.0.0"
-      }
-    },
-    "jake": {
-      "version": "10.8.2",
-      "integrity": "sha512-eLpKyrfG3mzvGE2Du8VoPbeSkRry093+tyNjdYaBbJS9v17knImYGNXQCUV0gLxQtF82m3E8iRb/wdSQZLoq7A==",
-      "dev": true,
-      "requires": {
-        "async": "0.9.x",
-        "chalk": "^2.4.2",
-        "filelist": "^1.0.1",
-        "minimatch": "^3.0.4"
-      },
-      "dependencies": {
-        "ansi-styles": {
-          "version": "3.2.1",
-          "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-          "dev": true,
-          "requires": {
-            "color-convert": "^1.9.0"
-          }
-        },
-        "chalk": {
-          "version": "2.4.2",
-          "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^3.2.1",
-            "escape-string-regexp": "^1.0.5",
-            "supports-color": "^5.3.0"
-          }
-        },
-        "color-convert": {
-          "version": "1.9.3",
-          "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-          "dev": true,
-          "requires": {
-            "color-name": "1.1.3"
-          }
-        },
-        "color-name": {
-          "version": "1.1.3",
-          "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU=",
-          "dev": true
-        },
-        "has-flag": {
-          "version": "3.0.0",
-          "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0=",
-          "dev": true
-        },
-        "supports-color": {
-          "version": "5.5.0",
-          "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-          "dev": true,
-          "requires": {
-            "has-flag": "^3.0.0"
-          }
-        }
-      }
-    },
-    "jest": {
-      "version": "26.6.3",
-      "integrity": "sha512-lGS5PXGAzR4RF7V5+XObhqz2KZIDUA1yD0DG6pBVmy10eh0ZIXQImRuzocsI/N2XZ1GrLFwTS27In2i2jlpq1Q==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/core": "^26.6.3",
-        "import-local": "^3.0.2",
-        "jest-cli": "^26.6.3"
-      }
-    },
-    "jest-changed-files": {
-      "version": "26.6.2",
-      "integrity": "sha512-fDS7szLcY9sCtIip8Fjry9oGf3I2ht/QT21bAHm5Dmf0mD4X3ReNUf17y+bO6fR8WgbIZTlbyG1ak/53cbRzKQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "execa": "^4.0.0",
-        "throat": "^5.0.0"
-      }
-    },
-    "jest-cli": {
-      "version": "26.6.3",
-      "integrity": "sha512-GF9noBSa9t08pSyl3CY4frMrqp+aQXFGFkf5hEPbh/pIUFYWMK6ZLTfbmadxJVcJrdRoChlWQsA2VkJcDFK8hg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/core": "^26.6.3",
-        "@jest/test-result": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "chalk": "^4.0.0",
-        "exit": "^0.1.2",
-        "graceful-fs": "^4.2.4",
-        "import-local": "^3.0.2",
-        "is-ci": "^2.0.0",
-        "jest-config": "^26.6.3",
-        "jest-util": "^26.6.2",
-        "jest-validate": "^26.6.2",
-        "prompts": "^2.0.1",
-        "yargs": "^15.4.1"
-      }
-    },
-    "jest-config": {
-      "version": "26.6.3",
-      "integrity": "sha512-t5qdIj/bCj2j7NFVHb2nFB4aUdfucDn3JRKgrZnplb8nieAirAzRSHP8uDEd+qV6ygzg9Pz4YG7UTJf94LPSyg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/core": "^7.1.0",
-        "@jest/test-sequencer": "^26.6.3",
-        "@jest/types": "^26.6.2",
-        "babel-jest": "^26.6.3",
-        "chalk": "^4.0.0",
-        "deepmerge": "^4.2.2",
-        "glob": "^7.1.1",
-        "graceful-fs": "^4.2.4",
-        "jest-environment-jsdom": "^26.6.2",
-        "jest-environment-node": "^26.6.2",
-        "jest-get-type": "^26.3.0",
-        "jest-jasmine2": "^26.6.3",
-        "jest-regex-util": "^26.0.0",
-        "jest-resolve": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jest-validate": "^26.6.2",
-        "micromatch": "^4.0.2",
-        "pretty-format": "^26.6.2"
-      },
-      "dependencies": {
-        "deepmerge": {
-          "version": "4.2.2",
-          "integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "jest-diff": {
-      "version": "26.6.2",
-      "integrity": "sha512-6m+9Z3Gv9wN0WFVasqjCL/06+EFCMTqDEUl/b87HYK2rAPTyfz4ZIuSlPhY51PIQRWx5TaxeF1qmXKe9gfN3sA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "chalk": "^4.0.0",
-        "diff-sequences": "^26.6.2",
-        "jest-get-type": "^26.3.0",
-        "pretty-format": "^26.6.2"
-      }
-    },
-    "jest-docblock": {
-      "version": "26.0.0",
-      "integrity": "sha512-RDZ4Iz3QbtRWycd8bUEPxQsTlYazfYn/h5R65Fc6gOfwozFhoImx+affzky/FFBuqISPTqjXomoIGJVKBWoo0w==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "detect-newline": "^3.0.0"
-      }
-    },
-    "jest-each": {
-      "version": "26.6.2",
-      "integrity": "sha512-Mer/f0KaATbjl8MCJ+0GEpNdqmnVmDYqCTJYTvoo7rqmRiDllmp2AYN+06F93nXcY3ur9ShIjS+CO/uD+BbH4A==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "chalk": "^4.0.0",
-        "jest-get-type": "^26.3.0",
-        "jest-util": "^26.6.2",
-        "pretty-format": "^26.6.2"
-      }
-    },
-    "jest-environment-jsdom": {
-      "version": "26.6.2",
-      "integrity": "sha512-jgPqCruTlt3Kwqg5/WVFyHIOJHsiAvhcp2qiR2QQstuG9yWox5+iHpU3ZrcBxW14T4fe5Z68jAfLRh7joCSP2Q==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/environment": "^26.6.2",
-        "@jest/fake-timers": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "jest-mock": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jsdom": "^16.4.0"
-      }
-    },
-    "jest-environment-node": {
-      "version": "26.6.2",
-      "integrity": "sha512-zhtMio3Exty18dy8ee8eJ9kjnRyZC1N4C1Nt/VShN1apyXc8rWGtJ9lI7vqiWcyyXS4BVSEn9lxAM2D+07/Tag==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/environment": "^26.6.2",
-        "@jest/fake-timers": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "jest-mock": "^26.6.2",
-        "jest-util": "^26.6.2"
-      }
-    },
-    "jest-get-type": {
-      "version": "26.3.0",
-      "integrity": "sha512-TpfaviN1R2pQWkIihlfEanwOXK0zcxrKEE4MlU6Tn7keoXdN6/3gK/xl0yEh8DOunn5pOVGKf8hB4R9gVh04ig==",
-      "dev": true,
-      "peer": true
-    },
-    "jest-haste-map": {
-      "version": "26.6.2",
-      "integrity": "sha512-easWIJXIw71B2RdR8kgqpjQrbMRWQBgiBwXYEhtGUTaX+doCjBheluShdDMeR8IMfJiTqH4+zfhtg29apJf/8w==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "@types/graceful-fs": "^4.1.2",
-        "@types/node": "*",
-        "anymatch": "^3.0.3",
-        "fb-watchman": "^2.0.0",
-        "fsevents": "^2.1.2",
-        "graceful-fs": "^4.2.4",
-        "jest-regex-util": "^26.0.0",
-        "jest-serializer": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jest-worker": "^26.6.2",
-        "micromatch": "^4.0.2",
-        "sane": "^4.0.3",
-        "walker": "^1.0.7"
-      }
-    },
-    "jest-jasmine2": {
-      "version": "26.6.3",
-      "integrity": "sha512-kPKUrQtc8aYwBV7CqBg5pu+tmYXlvFlSFYn18ev4gPFtrRzB15N2gW/Roew3187q2w2eHuu0MU9TJz6w0/nPEg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/traverse": "^7.1.0",
-        "@jest/environment": "^26.6.2",
-        "@jest/source-map": "^26.6.2",
-        "@jest/test-result": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "chalk": "^4.0.0",
-        "co": "^4.6.0",
-        "expect": "^26.6.2",
-        "is-generator-fn": "^2.0.0",
-        "jest-each": "^26.6.2",
-        "jest-matcher-utils": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-runtime": "^26.6.3",
-        "jest-snapshot": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "pretty-format": "^26.6.2",
-        "throat": "^5.0.0"
-      }
-    },
-    "jest-leak-detector": {
-      "version": "26.6.2",
-      "integrity": "sha512-i4xlXpsVSMeKvg2cEKdfhh0H39qlJlP5Ex1yQxwF9ubahboQYMgTtz5oML35AVA3B4Eu+YsmwaiKVev9KCvLxg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "jest-get-type": "^26.3.0",
-        "pretty-format": "^26.6.2"
-      }
-    },
-    "jest-matcher-utils": {
-      "version": "26.6.2",
-      "integrity": "sha512-llnc8vQgYcNqDrqRDXWwMr9i7rS5XFiCwvh6DTP7Jqa2mqpcCBBlpCbn+trkG0KNhPu/h8rzyBkriOtBstvWhw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "chalk": "^4.0.0",
-        "jest-diff": "^26.6.2",
-        "jest-get-type": "^26.3.0",
-        "pretty-format": "^26.6.2"
-      }
-    },
-    "jest-message-util": {
-      "version": "26.6.2",
-      "integrity": "sha512-rGiLePzQ3AzwUshu2+Rn+UMFk0pHN58sOG+IaJbk5Jxuqo3NYO1U2/MIR4S1sKgsoYSXSzdtSa0TgrmtUwEbmA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/code-frame": "^7.0.0",
-        "@jest/types": "^26.6.2",
-        "@types/stack-utils": "^2.0.0",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "micromatch": "^4.0.2",
-        "pretty-format": "^26.6.2",
-        "slash": "^3.0.0",
-        "stack-utils": "^2.0.2"
-      }
-    },
-    "jest-mock": {
-      "version": "26.6.2",
-      "integrity": "sha512-YyFjePHHp1LzpzYcmgqkJ0nm0gg/lJx2aZFzFy1S6eUqNjXsOqTK10zNRff2dNfssgokjkG65OlWNcIlgd3zew==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "@types/node": "*"
-      }
-    },
-    "jest-pnp-resolver": {
-      "version": "1.2.2",
-      "integrity": "sha512-olV41bKSMm8BdnuMsewT4jqlZ8+3TCARAXjZGT9jcoSnrfUnRCqnMoF9XEeoWjbzObpqF9dRhHQj0Xb9QdF6/w==",
-      "dev": true,
-      "peer": true,
-      "requires": {}
-    },
-    "jest-regex-util": {
-      "version": "26.0.0",
-      "integrity": "sha512-Gv3ZIs/nA48/Zvjrl34bf+oD76JHiGDUxNOVgUjh3j890sblXryjY4rss71fPtD/njchl6PSE2hIhvyWa1eT0A==",
-      "dev": true,
-      "peer": true
-    },
-    "jest-resolve": {
-      "version": "26.6.2",
-      "integrity": "sha512-sOxsZOq25mT1wRsfHcbtkInS+Ek7Q8jCHUB0ZUTP0tc/c41QHriU/NunqMfCUWsL4H3MHpvQD4QR9kSYhS7UvQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "jest-pnp-resolver": "^1.2.2",
-        "jest-util": "^26.6.2",
-        "read-pkg-up": "^7.0.1",
-        "resolve": "^1.18.1",
-        "slash": "^3.0.0"
-      },
-      "dependencies": {
-        "find-up": {
-          "version": "4.1.0",
-          "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "locate-path": "^5.0.0",
-            "path-exists": "^4.0.0"
-          }
-        },
-        "locate-path": {
-          "version": "5.0.0",
-          "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-locate": "^4.1.0"
-          }
-        },
-        "p-limit": {
-          "version": "2.3.0",
-          "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-try": "^2.0.0"
-          }
-        },
-        "p-locate": {
-          "version": "4.1.0",
-          "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-limit": "^2.2.0"
-          }
-        },
-        "path-exists": {
-          "version": "4.0.0",
-          "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-          "dev": true,
-          "peer": true
-        },
-        "read-pkg": {
-          "version": "5.2.0",
-          "integrity": "sha512-Ug69mNOpfvKDAc2Q8DRpMjjzdtrnv9HcSMX+4VsZxD1aZ6ZzrIE7rlzXBtWTyhULSMKg076AW6WR5iZpD0JiOg==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "@types/normalize-package-data": "^2.4.0",
-            "normalize-package-data": "^2.5.0",
-            "parse-json": "^5.0.0",
-            "type-fest": "^0.6.0"
-          },
-          "dependencies": {
-            "type-fest": {
-              "version": "0.6.0",
-              "integrity": "sha512-q+MB8nYR1KDLrgr4G5yemftpMC7/QLqVndBmEEdqzmNj5dcFOO4Oo8qlwZE3ULT3+Zim1F8Kq4cBnikNhlCMlg==",
-              "dev": true,
-              "peer": true
-            }
-          }
-        },
-        "read-pkg-up": {
-          "version": "7.0.1",
-          "integrity": "sha512-zK0TB7Xd6JpCLmlLmufqykGE+/TlOePD6qKClNW7hHDKFh/J7/7gCWGR7joEQEW1bKq3a3yUZSObOoWLFQ4ohg==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "find-up": "^4.1.0",
-            "read-pkg": "^5.2.0",
-            "type-fest": "^0.8.1"
-          }
-        },
-        "type-fest": {
-          "version": "0.8.1",
-          "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "jest-resolve-dependencies": {
-      "version": "26.6.3",
-      "integrity": "sha512-pVwUjJkxbhe4RY8QEWzN3vns2kqyuldKpxlxJlzEYfKSvY6/bMvxoFrYYzUO1Gx28yKWN37qyV7rIoIp2h8fTg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "jest-regex-util": "^26.0.0",
-        "jest-snapshot": "^26.6.2"
-      }
-    },
-    "jest-runner": {
-      "version": "26.6.3",
-      "integrity": "sha512-atgKpRHnaA2OvByG/HpGA4g6CSPS/1LK0jK3gATJAoptC1ojltpmVlYC3TYgdmGp+GLuhzpH30Gvs36szSL2JQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/console": "^26.6.2",
-        "@jest/environment": "^26.6.2",
-        "@jest/test-result": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "chalk": "^4.0.0",
-        "emittery": "^0.7.1",
-        "exit": "^0.1.2",
-        "graceful-fs": "^4.2.4",
-        "jest-config": "^26.6.3",
-        "jest-docblock": "^26.0.0",
-        "jest-haste-map": "^26.6.2",
-        "jest-leak-detector": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-resolve": "^26.6.2",
-        "jest-runtime": "^26.6.3",
-        "jest-util": "^26.6.2",
-        "jest-worker": "^26.6.2",
-        "source-map-support": "^0.5.6",
-        "throat": "^5.0.0"
-      }
-    },
-    "jest-runtime": {
-      "version": "26.6.3",
-      "integrity": "sha512-lrzyR3N8sacTAMeonbqpnSka1dHNux2uk0qqDXVkMv2c/A3wYnvQ4EXuI013Y6+gSKSCxdaczvf4HF0mVXHRdw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/console": "^26.6.2",
-        "@jest/environment": "^26.6.2",
-        "@jest/fake-timers": "^26.6.2",
-        "@jest/globals": "^26.6.2",
-        "@jest/source-map": "^26.6.2",
-        "@jest/test-result": "^26.6.2",
-        "@jest/transform": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/yargs": "^15.0.0",
-        "chalk": "^4.0.0",
-        "cjs-module-lexer": "^0.6.0",
-        "collect-v8-coverage": "^1.0.0",
-        "exit": "^0.1.2",
-        "glob": "^7.1.3",
-        "graceful-fs": "^4.2.4",
-        "jest-config": "^26.6.3",
-        "jest-haste-map": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-mock": "^26.6.2",
-        "jest-regex-util": "^26.0.0",
-        "jest-resolve": "^26.6.2",
-        "jest-snapshot": "^26.6.2",
-        "jest-util": "^26.6.2",
-        "jest-validate": "^26.6.2",
-        "slash": "^3.0.0",
-        "strip-bom": "^4.0.0",
-        "yargs": "^15.4.1"
-      }
-    },
-    "jest-serializer": {
-      "version": "26.6.2",
-      "integrity": "sha512-S5wqyz0DXnNJPd/xfIzZ5Xnp1HrJWBczg8mMfMpN78OJ5eDxXyf+Ygld9wX1DnUWbIbhM1YDY95NjR4CBXkb2g==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@types/node": "*",
-        "graceful-fs": "^4.2.4"
-      }
-    },
-    "jest-snapshot": {
-      "version": "26.6.2",
-      "integrity": "sha512-OLhxz05EzUtsAmOMzuupt1lHYXCNib0ECyuZ/PZOx9TrZcC8vL0x+DUG3TL+GLX3yHG45e6YGjIm0XwDc3q3og==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@babel/types": "^7.0.0",
-        "@jest/types": "^26.6.2",
-        "@types/babel__traverse": "^7.0.4",
-        "@types/prettier": "^2.0.0",
-        "chalk": "^4.0.0",
-        "expect": "^26.6.2",
-        "graceful-fs": "^4.2.4",
-        "jest-diff": "^26.6.2",
-        "jest-get-type": "^26.3.0",
-        "jest-haste-map": "^26.6.2",
-        "jest-matcher-utils": "^26.6.2",
-        "jest-message-util": "^26.6.2",
-        "jest-resolve": "^26.6.2",
-        "natural-compare": "^1.4.0",
-        "pretty-format": "^26.6.2",
-        "semver": "^7.3.2"
-      }
-    },
-    "jest-util": {
-      "version": "26.6.2",
-      "integrity": "sha512-MDW0fKfsn0OI7MS7Euz6h8HNDXVQ0gaM9uW6RjfDmd1DAFcaxX9OqIakHIqhbnmF08Cf2DLDG+ulq8YQQ0Lp0Q==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "is-ci": "^2.0.0",
-        "micromatch": "^4.0.2"
-      }
-    },
-    "jest-validate": {
-      "version": "26.6.2",
-      "integrity": "sha512-NEYZ9Aeyj0i5rQqbq+tpIOom0YS1u2MVu6+euBsvpgIme+FOfRmoC4R5p0JiAUpaFvFy24xgrpMknarR/93XjQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "camelcase": "^6.0.0",
-        "chalk": "^4.0.0",
-        "jest-get-type": "^26.3.0",
-        "leven": "^3.1.0",
-        "pretty-format": "^26.6.2"
-      },
-      "dependencies": {
-        "camelcase": {
-          "version": "6.2.0",
-          "integrity": "sha512-c7wVvbw3f37nuobQNtgsgG9POC9qMbNuMQmTCqZv23b6MIz0fcYpBiOlv9gEN/hdLdnZTDQhg6e9Dq5M1vKvfg==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "jest-watcher": {
-      "version": "26.6.2",
-      "integrity": "sha512-WKJob0P/Em2csiVthsI68p6aGKTIcsfjH9Gsx1f0A3Italz43e3ho0geSAVsmj09RWOELP1AZ/DXyJgOgDKxXQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/test-result": "^26.6.2",
-        "@jest/types": "^26.6.2",
-        "@types/node": "*",
-        "ansi-escapes": "^4.2.1",
-        "chalk": "^4.0.0",
-        "jest-util": "^26.6.2",
-        "string-length": "^4.0.1"
-      }
-    },
-    "jest-worker": {
-      "version": "26.6.2",
-      "integrity": "sha512-KWYVV1c4i+jbMpaBC+U++4Va0cp8OisU185o73T1vo99hqi7w8tSJfUXYswwqqrjzwxa6KpRK54WhPvwf5w6PQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@types/node": "*",
-        "merge-stream": "^2.0.0",
-        "supports-color": "^7.0.0"
-      }
-    },
-    "js-sdsl": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-sdsl/-/js-sdsl-4.2.0.tgz",
-      "integrity": "sha512-dyBIzQBDkCqCu+0upx25Y2jGdbTGxE9fshMsCdK0ViOongpV+n5tXRcZY9v7CaVQ79AGS9KA1KHtojxiM7aXSQ==",
-      "dev": true
-    },
-    "js-tokens": {
-      "version": "4.0.0",
-      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
-      "dev": true
-    },
-    "js-yaml": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
-      "dev": true,
-      "requires": {
-        "argparse": "^2.0.1"
-      }
-    },
-    "jsdom": {
-      "version": "16.7.0",
-      "integrity": "sha512-u9Smc2G1USStM+s/x1ru5Sxrl6mPYCbByG1U/hUmqaVsm4tbNyS7CicOSRyuGQYZhTu0h84qkZZQ/I+dzizSVw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "abab": "^2.0.5",
-        "acorn": "^8.2.4",
-        "acorn-globals": "^6.0.0",
-        "cssom": "^0.4.4",
-        "cssstyle": "^2.3.0",
-        "data-urls": "^2.0.0",
-        "decimal.js": "^10.2.1",
-        "domexception": "^2.0.1",
-        "escodegen": "^2.0.0",
-        "form-data": "^3.0.0",
-        "html-encoding-sniffer": "^2.0.1",
-        "http-proxy-agent": "^4.0.1",
-        "https-proxy-agent": "^5.0.0",
-        "is-potential-custom-element-name": "^1.0.1",
-        "nwsapi": "^2.2.0",
-        "parse5": "6.0.1",
-        "saxes": "^5.0.1",
-        "symbol-tree": "^3.2.4",
-        "tough-cookie": "^4.0.0",
-        "w3c-hr-time": "^1.0.2",
-        "w3c-xmlserializer": "^2.0.0",
-        "webidl-conversions": "^6.1.0",
-        "whatwg-encoding": "^1.0.5",
-        "whatwg-mimetype": "^2.3.0",
-        "whatwg-url": "^8.5.0",
-        "ws": "^7.4.6",
-        "xml-name-validator": "^3.0.0"
-      },
-      "dependencies": {
-        "acorn": {
-          "version": "8.5.0",
-          "integrity": "sha512-yXbYeFy+jUuYd3/CDcg2NkIYE991XYX/bje7LmjJigUciaeO1JR4XxXgCIV1/Zc/dRuFEyw1L0pbA+qynJkW5Q==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "jsesc": {
-      "version": "2.5.2",
-      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
-      "dev": true
-    },
-    "json-parse-better-errors": {
-      "version": "1.0.2",
-      "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==",
-      "dev": true
-    },
-    "json-parse-even-better-errors": {
-      "version": "2.3.1",
-      "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
-      "dev": true
-    },
-    "json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
-      "dev": true
-    },
-    "json-stable-stringify-without-jsonify": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
-      "dev": true
-    },
-    "json5": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
-      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
-      "dev": true
-    },
-    "jsonfile": {
-      "version": "6.1.0",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
-      "dev": true,
-      "requires": {
-        "graceful-fs": "^4.1.6",
-        "universalify": "^2.0.0"
-      },
-      "dependencies": {
-        "universalify": {
-          "version": "2.0.0",
-          "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==",
-          "dev": true
-        }
-      }
-    },
-    "jsx-ast-utils": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/jsx-ast-utils/-/jsx-ast-utils-3.3.3.tgz",
-      "integrity": "sha512-fYQHZTZ8jSfmWZ0iyzfwiU4WDX4HpHbMCZ3gPlWYiCl3BoeOTsqKBqnTVfH2rYT7eP5c3sVbeSPHnnJOaTrWiw==",
-      "dev": true,
-      "requires": {
-        "array-includes": "^3.1.5",
-        "object.assign": "^4.1.3"
-      }
-    },
-    "kind-of": {
-      "version": "6.0.3",
-      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==",
-      "dev": true
-    },
-    "kleur": {
-      "version": "3.0.3",
-      "integrity": "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==",
-      "dev": true,
-      "peer": true
-    },
-    "known-css-properties": {
-      "version": "0.20.0",
-      "integrity": "sha512-URvsjaA9ypfreqJ2/ylDr5MUERhJZ+DhguoWRr2xgS5C7aGCalXo+ewL+GixgKBfhT2vuL02nbIgNGqVWgTOYw==",
-      "dev": true
-    },
-    "language-subtag-registry": {
-      "version": "0.3.22",
-      "resolved": "https://registry.npmjs.org/language-subtag-registry/-/language-subtag-registry-0.3.22.tgz",
-      "integrity": "sha512-tN0MCzyWnoz/4nHS6uxdlFWoUZT7ABptwKPQ52Ea7URk6vll88bWBVhodtnlfEuCcKWNGoc+uGbw1cwa9IKh/w==",
-      "dev": true
-    },
-    "language-tags": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/language-tags/-/language-tags-1.0.5.tgz",
-      "integrity": "sha512-qJhlO9cGXi6hBGKoxEG/sKZDAHD5Hnu9Hs4WbOY3pCWXDhw0N8x1NenNzm2EnNLkLkk7J2SdxAkDSbb6ftT+UQ==",
-      "dev": true,
-      "requires": {
-        "language-subtag-registry": "~0.3.2"
-      }
-    },
-    "leven": {
-      "version": "3.1.0",
-      "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==",
-      "dev": true,
-      "peer": true
-    },
-    "levn": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
-      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
-      "dev": true,
-      "requires": {
-        "prelude-ls": "^1.2.1",
-        "type-check": "~0.4.0"
-      }
-    },
-    "lines-and-columns": {
-      "version": "1.1.6",
-      "integrity": "sha1-HADHQ7QzzQpOgHWPe2SldEDZ/wA=",
-      "dev": true
-    },
-    "lint-staged": {
-      "version": "11.1.2",
-      "integrity": "sha512-6lYpNoA9wGqkL6Hew/4n1H6lRqF3qCsujVT0Oq5Z4hiSAM7S6NksPJ3gnr7A7R52xCtiZMcEUNNQ6d6X5Bvh9w==",
-      "dev": true,
-      "requires": {
-        "chalk": "^4.1.1",
-        "cli-truncate": "^2.1.0",
-        "commander": "^7.2.0",
-        "cosmiconfig": "^7.0.0",
-        "debug": "^4.3.1",
-        "enquirer": "^2.3.6",
-        "execa": "^5.0.0",
-        "listr2": "^3.8.2",
-        "log-symbols": "^4.1.0",
-        "micromatch": "^4.0.4",
-        "normalize-path": "^3.0.0",
-        "please-upgrade-node": "^3.2.0",
-        "string-argv": "0.3.1",
-        "stringify-object": "^3.3.0"
-      },
-      "dependencies": {
-        "chalk": {
-          "version": "4.1.2",
-          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^4.1.0",
-            "supports-color": "^7.1.0"
-          }
-        },
-        "execa": {
-          "version": "5.1.1",
-          "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
-          "dev": true,
-          "requires": {
-            "cross-spawn": "^7.0.3",
-            "get-stream": "^6.0.0",
-            "human-signals": "^2.1.0",
-            "is-stream": "^2.0.0",
-            "merge-stream": "^2.0.0",
-            "npm-run-path": "^4.0.1",
-            "onetime": "^5.1.2",
-            "signal-exit": "^3.0.3",
-            "strip-final-newline": "^2.0.0"
-          }
-        },
-        "get-stream": {
-          "version": "6.0.1",
-          "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
-          "dev": true
-        },
-        "human-signals": {
-          "version": "2.1.0",
-          "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
-          "dev": true
-        }
-      }
-    },
-    "listr2": {
-      "version": "3.12.2",
-      "integrity": "sha512-64xC2CJ/As/xgVI3wbhlPWVPx0wfTqbUAkpb7bjDi0thSWMqrf07UFhrfsGoo8YSXmF049Rp9C0cjLC8rZxK9A==",
-      "dev": true,
-      "requires": {
-        "cli-truncate": "^2.1.0",
-        "colorette": "^1.4.0",
-        "log-update": "^4.0.0",
-        "p-map": "^4.0.0",
-        "rxjs": "^6.6.7",
-        "through": "^2.3.8",
-        "wrap-ansi": "^7.0.0"
-      }
-    },
-    "load-json-file": {
-      "version": "4.0.0",
-      "integrity": "sha1-L19Fq5HjMhYjT9U62rZo607AmTs=",
-      "dev": true,
-      "requires": {
-        "graceful-fs": "^4.1.2",
-        "parse-json": "^4.0.0",
-        "pify": "^3.0.0",
-        "strip-bom": "^3.0.0"
-      },
-      "dependencies": {
-        "parse-json": {
-          "version": "4.0.0",
-          "integrity": "sha1-vjX1Qlvh9/bHRxhPmKeIy5lHfuA=",
-          "dev": true,
-          "requires": {
-            "error-ex": "^1.3.1",
-            "json-parse-better-errors": "^1.0.1"
-          }
-        },
-        "pify": {
-          "version": "3.0.0",
-          "integrity": "sha1-5aSs0sEB/fPZpNB/DbxNtJ3SgXY=",
-          "dev": true
-        },
-        "strip-bom": {
-          "version": "3.0.0",
-          "integrity": "sha1-IzTBjpx1n3vdVv3vfprj1YjmjtM=",
-          "dev": true
-        }
-      }
-    },
-    "locate-path": {
-      "version": "2.0.0",
-      "integrity": "sha1-K1aLJl7slExtnA3pw9u7ygNUzY4=",
-      "dev": true,
-      "requires": {
-        "p-locate": "^2.0.0",
-        "path-exists": "^3.0.0"
-      }
-    },
-    "lodash": {
-      "version": "4.17.21",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "dev": true
-    },
-    "lodash.clonedeep": {
-      "version": "4.5.0",
-      "integrity": "sha1-4j8/nE+Pvd6HJSnBBxhXoIblzO8=",
-      "dev": true
-    },
-    "lodash.merge": {
-      "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
-      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
-      "dev": true
-    },
-    "lodash.truncate": {
-      "version": "4.4.2",
-      "integrity": "sha1-WjUNoLERO4N+z//VgSy+WNbq4ZM=",
-      "dev": true
-    },
-    "log-symbols": {
-      "version": "4.1.0",
-      "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==",
-      "dev": true,
-      "requires": {
-        "chalk": "^4.1.0",
-        "is-unicode-supported": "^0.1.0"
-      }
-    },
-    "log-update": {
-      "version": "4.0.0",
-      "integrity": "sha512-9fkkDevMefjg0mmzWFBW8YkFP91OrizzkW3diF7CpG+S2EYdy4+TVfGwz1zeF8x7hCx1ovSPTOE9Ngib74qqUg==",
-      "dev": true,
-      "requires": {
-        "ansi-escapes": "^4.3.0",
-        "cli-cursor": "^3.1.0",
-        "slice-ansi": "^4.0.0",
-        "wrap-ansi": "^6.2.0"
-      },
-      "dependencies": {
-        "slice-ansi": {
-          "version": "4.0.0",
-          "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^4.0.0",
-            "astral-regex": "^2.0.0",
-            "is-fullwidth-code-point": "^3.0.0"
-          }
-        },
-        "wrap-ansi": {
-          "version": "6.2.0",
-          "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^4.0.0",
-            "string-width": "^4.1.0",
-            "strip-ansi": "^6.0.0"
-          }
-        }
-      }
-    },
-    "longest-streak": {
-      "version": "2.0.4",
-      "integrity": "sha512-vM6rUVCVUJJt33bnmHiZEvr7wPT78ztX7rojL+LW51bHtLh6HTjx84LA5W4+oa6aKEJA7jJu5LR6vQRBpA5DVg==",
-      "dev": true
-    },
-    "loose-envify": {
-      "version": "1.4.0",
-      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
-      "dev": true,
-      "requires": {
-        "js-tokens": "^3.0.0 || ^4.0.0"
-      }
-    },
-    "lru-cache": {
-      "version": "6.0.0",
-      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
-      "dev": true,
-      "requires": {
-        "yallist": "^4.0.0"
-      }
-    },
-    "make-error": {
-      "version": "1.3.6",
-      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
-      "dev": true
-    },
-    "makeerror": {
-      "version": "1.0.11",
-      "integrity": "sha1-4BpckQnyr3lmDk6LlYd5AYT1qWw=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "tmpl": "1.0.x"
-      }
-    },
-    "map-cache": {
-      "version": "0.2.2",
-      "integrity": "sha1-wyq9C9ZSXZsFFkW7TyasXcmKDb8=",
-      "dev": true,
-      "peer": true
-    },
-    "map-obj": {
-      "version": "1.0.1",
-      "integrity": "sha1-2TPOuSBdgr3PSIb2dCvcK03qFG0=",
-      "dev": true
-    },
-    "map-visit": {
-      "version": "1.0.0",
-      "integrity": "sha1-7Nyo8TFE5mDxtb1B8S80edmN+48=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "object-visit": "^1.0.0"
-      }
-    },
-    "markdown-escapes": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/markdown-escapes/-/markdown-escapes-1.0.4.tgz",
-      "integrity": "sha512-8z4efJYk43E0upd0NbVXwgSTQs6cT3T06etieCMEg7dRbzCbxUCK/GHlX8mhHRDcp+OLlHkPKsvqQTCvsRl2cg==",
-      "dev": true
-    },
-    "markdown-table": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/markdown-table/-/markdown-table-2.0.0.tgz",
-      "integrity": "sha512-Ezda85ToJUBhM6WGaG6veasyym+Tbs3cMAw/ZhOPqXiYsr0jgocBV3j3nx+4lk47plLlIqjwuTm/ywVI+zjJ/A==",
-      "dev": true,
-      "requires": {
-        "repeat-string": "^1.0.0"
-      }
-    },
-    "mathml-tag-names": {
-      "version": "2.1.3",
-      "integrity": "sha512-APMBEanjybaPzUrfqU0IMU5I0AswKMH7k8OTLs0vvV4KZpExkTkY87nR/zpbuTPj+gARop7aGUbl11pnDfW6xg==",
-      "dev": true
-    },
-    "mdast-util-compact": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/mdast-util-compact/-/mdast-util-compact-2.0.1.tgz",
-      "integrity": "sha512-7GlnT24gEwDrdAwEHrU4Vv5lLWrEer4KOkAiKT9nYstsTad7Oc1TwqT2zIMKRdZF7cTuaf+GA1E4Kv7jJh8mPA==",
-      "dev": true,
-      "requires": {
-        "unist-util-visit": "^2.0.0"
-      },
-      "dependencies": {
-        "unist-util-visit": {
-          "version": "2.0.3",
-          "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-2.0.3.tgz",
-          "integrity": "sha512-iJ4/RczbJMkD0712mGktuGpm/U4By4FfDonL7N/9tATGIF4imikjOuagyMY53tnZq3NP6BcmlrHhEKAfGWjh7Q==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-is": "^4.0.0",
-            "unist-util-visit-parents": "^3.0.0"
-          }
-        },
-        "unist-util-visit-parents": {
-          "version": "3.1.1",
-          "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-3.1.1.tgz",
-          "integrity": "sha512-1KROIZWo6bcMrZEwiH2UrXDyalAa0uqzWCxCJj6lPOvTve2WkfgCytoDTPaMnodXh1WrXOq0haVYHj99ynJlsg==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-is": "^4.0.0"
-          }
-        }
-      }
-    },
-    "mdast-util-from-markdown": {
-      "version": "0.8.5",
-      "integrity": "sha512-2hkTXtYYnr+NubD/g6KGBS/0mFmBcifAsI0yIWRiRo0PjVs6SSOSOdtzbp6kSGnShDN6G5aWZpKQ2lWRy27mWQ==",
-      "dev": true,
-      "requires": {
-        "@types/mdast": "^3.0.0",
-        "mdast-util-to-string": "^2.0.0",
-        "micromark": "~2.11.0",
-        "parse-entities": "^2.0.0",
-        "unist-util-stringify-position": "^2.0.0"
-      }
-    },
-    "mdast-util-to-markdown": {
-      "version": "0.6.5",
-      "integrity": "sha512-XeV9sDE7ZlOQvs45C9UKMtfTcctcaj/pGwH8YLbMHoMOXNNCn2LsqVQOqrF1+/NU8lKDAqozme9SCXWyo9oAcQ==",
-      "dev": true,
-      "requires": {
-        "@types/unist": "^2.0.0",
-        "longest-streak": "^2.0.0",
-        "mdast-util-to-string": "^2.0.0",
-        "parse-entities": "^2.0.0",
-        "repeat-string": "^1.0.0",
-        "zwitch": "^1.0.0"
-      }
-    },
-    "mdast-util-to-string": {
-      "version": "2.0.0",
-      "integrity": "sha512-AW4DRS3QbBayY/jJmD8437V1Gombjf8RSOUCMFBuo5iHi58AGEgVCKQ+ezHkZZDpAQS75hcBMpLqjpJTjtUL7w==",
-      "dev": true
-    },
-    "merge-stream": {
-      "version": "2.0.0",
-      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
-      "dev": true
-    },
-    "merge2": {
-      "version": "1.4.1",
-      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
-      "dev": true
-    },
-    "micromark": {
-      "version": "2.11.4",
-      "integrity": "sha512-+WoovN/ppKolQOFIAajxi7Lu9kInbPxFuTBVEavFcL8eAfVstoc5MocPmqBeAdBOJV00uaVjegzH4+MA0DN/uA==",
-      "dev": true,
-      "requires": {
-        "debug": "^4.0.0",
-        "parse-entities": "^2.0.0"
-      }
-    },
-    "micromatch": {
-      "version": "4.0.4",
-      "integrity": "sha512-pRmzw/XUcwXGpD9aI9q/0XOwLNygjETJ8y0ao0wdqprrzDa4YnxLcz7fQRZr8voh8V10kGhABbNcHVk5wHgWwg==",
-      "dev": true,
-      "requires": {
-        "braces": "^3.0.1",
-        "picomatch": "^2.2.3"
-      }
-    },
-    "mime-db": {
-      "version": "1.50.0",
-      "integrity": "sha512-9tMZCDlYHqeERXEHO9f/hKfNXhre5dK2eE/krIvUjZbS2KPcqGDfNShIWS1uW9XOTKQKqK6qbeOci18rbfW77A==",
-      "dev": true
-    },
-    "mime-types": {
-      "version": "2.1.33",
-      "integrity": "sha512-plLElXp7pRDd0bNZHw+nMd52vRYjLwQjygaNg7ddJ2uJtTlmnTCjWuPKxVu6//AdaRuME84SvLW91sIkBqGT0g==",
-      "dev": true,
-      "requires": {
-        "mime-db": "1.50.0"
-      }
-    },
-    "mimic-fn": {
-      "version": "2.1.0",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
-      "dev": true
-    },
-    "min-indent": {
-      "version": "1.0.1",
-      "integrity": "sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==",
-      "dev": true
-    },
-    "minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "dev": true,
-      "requires": {
-        "brace-expansion": "^1.1.7"
-      }
-    },
-    "minimist": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.7.tgz",
-      "integrity": "sha512-bzfL1YUZsP41gmu/qjrEk0Q6i2ix/cVeAhbCbqH9u3zYutS1cLg00qhrD0M2MVdCcx4Sc0UpP2eBWo9rotpq6g==",
-      "dev": true
-    },
-    "minimist-options": {
-      "version": "4.1.0",
-      "integrity": "sha512-Q4r8ghd80yhO/0j1O3B2BjweX3fiHg9cdOwjJd2J76Q135c+NDxGCqdYKQ1SKBuFfgWbAUzBfvYjPUEeNgqN1A==",
-      "dev": true,
-      "requires": {
-        "arrify": "^1.0.1",
-        "is-plain-obj": "^1.1.0",
-        "kind-of": "^6.0.3"
-      }
-    },
-    "mixin-deep": {
-      "version": "1.3.2",
-      "integrity": "sha512-WRoDn//mXBiJ1H40rqa3vH0toePwSsGb45iInWlTySa+Uu4k3tYUSxa2v1KqAiLtvlrSzaExqS1gtk96A9zvEA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "for-in": "^1.0.2",
-        "is-extendable": "^1.0.1"
-      },
-      "dependencies": {
-        "is-extendable": {
-          "version": "1.0.1",
-          "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-plain-object": "^2.0.4"
-          }
-        }
-      }
-    },
-    "ms": {
-      "version": "2.1.2",
-      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
-      "dev": true
-    },
-    "mute-stream": {
-      "version": "0.0.8",
-      "integrity": "sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==",
-      "dev": true
-    },
-    "nanoid": {
-      "version": "3.3.7",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.7.tgz",
-      "integrity": "sha512-eSRppjcPIatRIMC1U6UngP8XFcz8MQWGQdt1MTBQ7NaAmvXDfvNxbvWV3x2y6CdEUciCSsDHDQZbhYaB8QEo2g==",
-      "dev": true
-    },
-    "nanomatch": {
-      "version": "1.2.13",
-      "integrity": "sha512-fpoe2T0RbHwBTBUOftAfBPaDEi06ufaUai0mE6Yn1kacc3SnTErfb/h+X94VXzI64rKFHYImXSvdwGGCmwOqCA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "arr-diff": "^4.0.0",
-        "array-unique": "^0.3.2",
-        "define-property": "^2.0.2",
-        "extend-shallow": "^3.0.2",
-        "fragment-cache": "^0.2.1",
-        "is-windows": "^1.0.2",
-        "kind-of": "^6.0.2",
-        "object.pick": "^1.3.0",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
-      },
-      "dependencies": {
-        "extend-shallow": {
-          "version": "3.0.2",
-          "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "assign-symbols": "^1.0.0",
-            "is-extendable": "^1.0.1"
-          }
-        },
-        "is-extendable": {
-          "version": "1.0.1",
-          "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-plain-object": "^2.0.4"
-          }
-        }
-      }
-    },
-    "natural-compare": {
-      "version": "1.4.0",
-      "integrity": "sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=",
-      "dev": true
-    },
-    "natural-compare-lite": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare-lite/-/natural-compare-lite-1.4.0.tgz",
-      "integrity": "sha512-Tj+HTDSJJKaZnfiuw+iaF9skdPpTo2GtEly5JHnWV/hfv2Qj/9RKsGISQtLh2ox3l5EAGw487hnBee0sIJ6v2g==",
-      "dev": true
-    },
-    "next": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/next/-/next-14.0.4.tgz",
-      "integrity": "sha512-qbwypnM7327SadwFtxXnQdGiKpkuhaRLE2uq62/nRul9cj9KhQ5LhHmlziTNqUidZotw/Q1I9OjirBROdUJNgA==",
-      "dev": true,
-      "requires": {
-        "@next/env": "14.0.4",
-        "@next/swc-darwin-arm64": "14.0.4",
-        "@next/swc-darwin-x64": "14.0.4",
-        "@next/swc-linux-arm64-gnu": "14.0.4",
-        "@next/swc-linux-arm64-musl": "14.0.4",
-        "@next/swc-linux-x64-gnu": "14.0.4",
-        "@next/swc-linux-x64-musl": "14.0.4",
-        "@next/swc-win32-arm64-msvc": "14.0.4",
-        "@next/swc-win32-ia32-msvc": "14.0.4",
-        "@next/swc-win32-x64-msvc": "14.0.4",
-        "@swc/helpers": "0.5.2",
-        "busboy": "1.6.0",
-        "caniuse-lite": "^1.0.30001406",
-        "graceful-fs": "^4.2.11",
-        "postcss": "8.4.31",
-        "styled-jsx": "5.1.1",
-        "watchpack": "2.4.0"
-      }
-    },
-    "nice-try": {
-      "version": "1.0.5",
-      "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==",
-      "dev": true,
-      "peer": true
-    },
-    "node-int64": {
-      "version": "0.4.0",
-      "integrity": "sha1-h6kGXNs1XTGC2PlM4RGIuCXGijs=",
-      "dev": true,
-      "peer": true
-    },
-    "node-modules-regexp": {
-      "version": "1.0.0",
-      "integrity": "sha1-jZ2+KJZKSsVxLpExZCEHxx6Q7EA=",
-      "dev": true,
-      "peer": true
-    },
-    "node-notifier": {
-      "version": "8.0.2",
-      "integrity": "sha512-oJP/9NAdd9+x2Q+rfphB2RJCHjod70RcRLjosiPMMu5gjIfwVnOUGq2nbTjTUbmy0DJ/tFIVT30+Qe3nzl4TJg==",
-      "dev": true,
-      "optional": true,
-      "peer": true,
-      "requires": {
-        "growly": "^1.3.0",
-        "is-wsl": "^2.2.0",
-        "semver": "^7.3.2",
-        "shellwords": "^0.1.1",
-        "uuid": "^8.3.0",
-        "which": "^2.0.2"
-      }
-    },
-    "node-releases": {
-      "version": "1.1.77",
-      "integrity": "sha512-rB1DUFUNAN4Gn9keO2K1efO35IDK7yKHCdCaIMvFO7yUYmmZYeDjnGKle26G4rwj+LKRQpjyUUvMkPglwGCYNQ==",
-      "dev": true
-    },
-    "normalize-package-data": {
-      "version": "2.5.0",
-      "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "hosted-git-info": "^2.1.4",
-        "resolve": "^1.10.0",
-        "semver": "2 || 3 || 4 || 5",
-        "validate-npm-package-license": "^3.0.1"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "5.7.1",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "normalize-path": {
-      "version": "3.0.0",
-      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
-      "dev": true
-    },
-    "normalize-range": {
-      "version": "0.1.2",
-      "integrity": "sha1-LRDAa9/TEuqXd2laTShDlFa3WUI=",
-      "dev": true
-    },
-    "normalize-selector": {
-      "version": "0.2.0",
-      "integrity": "sha1-0LFF62kRicY6eNIB3E/bEpPvDAM=",
-      "dev": true
-    },
-    "npm-run-path": {
-      "version": "4.0.1",
-      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
-      "dev": true,
-      "requires": {
-        "path-key": "^3.0.0"
-      }
-    },
-    "num2fraction": {
-      "version": "1.2.2",
-      "integrity": "sha1-b2gragJ6Tp3fpFZM0lidHU5mnt4=",
-      "dev": true
-    },
-    "nwsapi": {
-      "version": "2.2.0",
-      "integrity": "sha512-h2AatdwYH+JHiZpv7pt/gSX1XoRGb7L/qSIeuqA6GwYoF9w1vP1cw42TO0aI2pNyshRK5893hNSl+1//vHK7hQ==",
-      "dev": true,
-      "peer": true
-    },
-    "object-assign": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
-      "dev": true
-    },
-    "object-copy": {
-      "version": "0.1.0",
-      "integrity": "sha1-fn2Fi3gb18mRpBupde04EnVOmYw=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "copy-descriptor": "^0.1.0",
-        "define-property": "^0.2.5",
-        "kind-of": "^3.0.3"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "0.2.5",
-          "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-descriptor": "^0.1.0"
-          }
-        },
-        "is-accessor-descriptor": {
-          "version": "0.1.6",
-          "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          }
-        },
-        "is-buffer": {
-          "version": "1.1.6",
-          "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-          "dev": true,
-          "peer": true
-        },
-        "is-data-descriptor": {
-          "version": "0.1.4",
-          "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          }
-        },
-        "is-descriptor": {
-          "version": "0.1.6",
-          "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-accessor-descriptor": "^0.1.6",
-            "is-data-descriptor": "^0.1.4",
-            "kind-of": "^5.0.0"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "5.1.0",
-              "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-              "dev": true,
-              "peer": true
-            }
-          }
-        },
-        "kind-of": {
-          "version": "3.2.2",
-          "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
-    },
-    "object-inspect": {
-      "version": "1.12.3",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.3.tgz",
-      "integrity": "sha512-geUvdk7c+eizMNUDkRpW1wJwgfOiOeHbxBR/hLXK1aT6zmVSO0jsQcs7fj6MGw89jC/cjGfLcNOrtMYtGqm81g==",
-      "dev": true
-    },
-    "object-is": {
-      "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/object-is/-/object-is-1.1.5.tgz",
-      "integrity": "sha512-3cyDsyHgtmi7I7DfSSI2LDp6SK2lwvtbg0p0R1e0RvTqF5ceGx+K2dfSjm1bKDMVCFEDAQvy+o8c6a7VujOddw==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.3"
-      }
-    },
-    "object-keys": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
-      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
-      "dev": true
-    },
-    "object-visit": {
-      "version": "1.0.1",
-      "integrity": "sha1-95xEk68MU3e1n+OdOV5BBC3QRbs=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "isobject": "^3.0.0"
-      }
-    },
-    "object.assign": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.4.tgz",
-      "integrity": "sha512-1mxKf0e58bvyjSCtKYY4sRe9itRk3PJpquJOjeIkz885CczcI4IvJJDLPS72oowuSh+pBxUFROpX+TU++hxhZQ==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "has-symbols": "^1.0.3",
-        "object-keys": "^1.1.1"
-      }
-    },
-    "object.entries": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/object.entries/-/object.entries-1.1.6.tgz",
-      "integrity": "sha512-leTPzo4Zvg3pmbQ3rDK69Rl8GQvIqMWubrkxONG9/ojtFE2rD9fjMKfSI5BxW3osRH1m6VdzmqK8oAY9aT4x5w==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      }
-    },
-    "object.fromentries": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/object.fromentries/-/object.fromentries-2.0.6.tgz",
-      "integrity": "sha512-VciD13dswC4j1Xt5394WR4MzmAQmlgN72phd/riNp9vtD7tp4QQWJ0R4wvclXcafgcYK8veHRed2W6XeGBvcfg==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      }
-    },
-    "object.hasown": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/object.hasown/-/object.hasown-1.1.2.tgz",
-      "integrity": "sha512-B5UIT3J1W+WuWIU55h0mjlwaqxiE5vYENJXIXZ4VFe05pNYrkKuK0U/6aFcb0pKywYJh7IhfoqUfKVmrJJHZHw==",
-      "dev": true,
-      "requires": {
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      }
-    },
-    "object.pick": {
-      "version": "1.3.0",
-      "integrity": "sha1-h6EKxMFpS9Lhy/U1kaZhQftd10c=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "isobject": "^3.0.1"
-      }
-    },
-    "object.values": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/object.values/-/object.values-1.1.6.tgz",
-      "integrity": "sha512-FVVTkD1vENCsAcwNs9k6jea2uHC/X0+JcjG8YA60FN5CMaJmG95wT9jek/xX9nornqGRrBkKtzuAu2wuHpKqvw==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      }
-    },
-    "once": {
-      "version": "1.4.0",
-      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
-      "dev": true,
-      "requires": {
-        "wrappy": "1"
-      }
-    },
-    "onetime": {
-      "version": "5.1.2",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
-      "dev": true,
-      "requires": {
-        "mimic-fn": "^2.1.0"
-      }
-    },
-    "open": {
-      "version": "7.3.0",
-      "integrity": "sha512-mgLwQIx2F/ye9SmbrUkurZCnkoXyXyu9EbHtJZrICjVAJfyMArdHp3KkixGdZx1ZHFPNIwl0DDM1dFFqXbTLZw==",
-      "dev": true,
-      "requires": {
-        "is-docker": "^2.0.0",
-        "is-wsl": "^2.1.1"
-      }
-    },
-    "optionator": {
-      "version": "0.9.1",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.1.tgz",
-      "integrity": "sha512-74RlY5FCnhq4jRxVUPKDaRwrVNXMqsGsiW6AJw4XK8hmtm10wC0ypZBLw5IIp85NZMr91+qd1RvvENwg7jjRFw==",
-      "dev": true,
-      "requires": {
-        "deep-is": "^0.1.3",
-        "fast-levenshtein": "^2.0.6",
-        "levn": "^0.4.1",
-        "prelude-ls": "^1.2.1",
-        "type-check": "^0.4.0",
-        "word-wrap": "^1.2.3"
-      }
-    },
-    "os-tmpdir": {
-      "version": "1.0.2",
-      "integrity": "sha1-u+Z0BseaqFxc/sdm/lc0VV36EnQ=",
-      "dev": true
-    },
-    "p-each-series": {
-      "version": "2.2.0",
-      "integrity": "sha512-ycIL2+1V32th+8scbpTvyHNaHe02z0sjgh91XXjAk+ZeXoPN4Z46DVUnzdso0aX4KckKw0FNNFHdjZ2UsZvxiA==",
-      "dev": true,
-      "peer": true
-    },
-    "p-finally": {
-      "version": "1.0.0",
-      "integrity": "sha1-P7z7FbiZpEEjs0ttzBi3JDNqLK4=",
-      "dev": true,
-      "peer": true
-    },
-    "p-limit": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
-      "dev": true,
-      "requires": {
-        "yocto-queue": "^0.1.0"
-      }
-    },
-    "p-locate": {
-      "version": "2.0.0",
-      "integrity": "sha1-IKAQOyIqcMj9OcwuWAaA893l7EM=",
-      "dev": true,
-      "requires": {
-        "p-limit": "^1.1.0"
-      },
-      "dependencies": {
-        "p-limit": {
-          "version": "1.3.0",
-          "integrity": "sha512-vvcXsLAJ9Dr5rQOPk7toZQZJApBl2K4J6dANSsEuh6QI41JYcsS/qhTGa9ErIUUgK3WNQoJYvylxvjqmiqEA9Q==",
-          "dev": true,
-          "requires": {
-            "p-try": "^1.0.0"
-          }
-        },
-        "p-try": {
-          "version": "1.0.0",
-          "integrity": "sha1-y8ec26+P1CKOE/Yh8rGiN8GyB7M=",
-          "dev": true
-        }
-      }
-    },
-    "p-map": {
-      "version": "4.0.0",
-      "integrity": "sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==",
-      "dev": true,
-      "requires": {
-        "aggregate-error": "^3.0.0"
-      }
-    },
-    "p-try": {
-      "version": "2.2.0",
-      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
-      "dev": true
-    },
-    "parent-module": {
-      "version": "1.0.1",
-      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
-      "dev": true,
-      "requires": {
-        "callsites": "^3.0.0"
-      }
-    },
-    "parse-entities": {
-      "version": "2.0.0",
-      "integrity": "sha512-kkywGpCcRYhqQIchaWqZ875wzpS/bMKhz5HnN3p7wveJTkTtyAB/AlnS0f8DFSqYW1T82t6yEAkEcB+A1I3MbQ==",
-      "dev": true,
-      "requires": {
-        "character-entities": "^1.0.0",
-        "character-entities-legacy": "^1.0.0",
-        "character-reference-invalid": "^1.0.0",
-        "is-alphanumerical": "^1.0.0",
-        "is-decimal": "^1.0.0",
-        "is-hexadecimal": "^1.0.0"
-      }
-    },
-    "parse-json": {
-      "version": "5.2.0",
-      "integrity": "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.0.0",
-        "error-ex": "^1.3.1",
-        "json-parse-even-better-errors": "^2.3.0",
-        "lines-and-columns": "^1.1.6"
-      }
-    },
-    "parse5": {
-      "version": "6.0.1",
-      "integrity": "sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw==",
-      "dev": true,
-      "peer": true
-    },
-    "pascalcase": {
-      "version": "0.1.1",
-      "integrity": "sha1-s2PlXoAGym/iF4TS2yK9FdeRfxQ=",
-      "dev": true,
-      "peer": true
-    },
-    "path-exists": {
-      "version": "3.0.0",
-      "integrity": "sha1-zg6+ql94yxiSXqfYENe1mwEP1RU=",
-      "dev": true
-    },
-    "path-is-absolute": {
-      "version": "1.0.1",
-      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=",
-      "dev": true
-    },
-    "path-key": {
-      "version": "3.1.1",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "dev": true
-    },
-    "path-parse": {
-      "version": "1.0.7",
-      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
-      "dev": true
-    },
-    "path-type": {
-      "version": "4.0.0",
-      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
-      "dev": true
-    },
-    "picocolors": {
-      "version": "0.2.1",
-      "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==",
-      "dev": true
-    },
-    "picomatch": {
-      "version": "2.3.0",
-      "integrity": "sha512-lY1Q/PiJGC2zOv/z391WOTD+Z02bCgsFfvxoXXf6h7kv9o+WmsmzYqrAwY63sNgOxE4xEdq0WyUnXfKeBrSvYw==",
-      "dev": true
-    },
-    "pirates": {
-      "version": "4.0.1",
-      "integrity": "sha512-WuNqLTbMI3tmfef2TKxlQmAiLHKtFhlsCZnPIpuv2Ow0RDVO8lfy1Opf4NUzlMXLjPl+Men7AuVdX6TA+s+uGA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "node-modules-regexp": "^1.0.0"
-      }
-    },
-    "pkg-conf": {
-      "version": "2.1.0",
-      "integrity": "sha1-ISZRTKbyq/69FoWW3xi6V4Z/AFg=",
-      "dev": true,
-      "requires": {
-        "find-up": "^2.0.0",
-        "load-json-file": "^4.0.0"
-      }
-    },
-    "please-upgrade-node": {
-      "version": "3.2.0",
-      "integrity": "sha512-gQR3WpIgNIKwBMVLkpMUeR3e1/E1y42bqDQZfql+kDeXd8COYfM8PQA4X6y7a8u9Ua9FHmsrrmirW2vHs45hWg==",
-      "dev": true,
-      "requires": {
-        "semver-compare": "^1.0.0"
-      }
-    },
-    "posix-character-classes": {
-      "version": "0.1.1",
-      "integrity": "sha1-AerA/jta9xoqbAL+q7jB/vfgDqs=",
-      "dev": true,
-      "peer": true
-    },
-    "postcss": {
-      "version": "8.4.31",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz",
-      "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==",
-      "dev": true,
-      "requires": {
-        "nanoid": "^3.3.6",
-        "picocolors": "^1.0.0",
-        "source-map-js": "^1.0.2"
-      },
-      "dependencies": {
-        "picocolors": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
-          "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==",
-          "dev": true
-        }
-      }
-    },
-    "postcss-html": {
-      "version": "0.36.0",
-      "integrity": "sha512-HeiOxGcuwID0AFsNAL0ox3mW6MHH5cstWN1Z3Y+n6H+g12ih7LHdYxWwEA/QmrebctLjo79xz9ouK3MroHwOJw==",
-      "dev": true,
-      "requires": {
-        "htmlparser2": "^3.10.0"
-      }
-    },
-    "postcss-less": {
-      "version": "3.1.4",
-      "integrity": "sha512-7TvleQWNM2QLcHqvudt3VYjULVB49uiW6XzEUFmvwHzvsOEF5MwBrIXZDJQvJNFGjJQTzSzZnDoCJ8h/ljyGXA==",
-      "dev": true,
-      "requires": {
-        "postcss": "^7.0.14"
-      },
-      "dependencies": {
-        "postcss": {
-          "version": "7.0.39",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-          "dev": true,
-          "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
-          }
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true
-        }
-      }
-    },
-    "postcss-media-query-parser": {
-      "version": "0.2.3",
-      "integrity": "sha1-J7Ocb02U+Bsac7j3Y1HGCeXO8kQ=",
-      "dev": true
-    },
-    "postcss-resolve-nested-selector": {
-      "version": "0.1.1",
-      "integrity": "sha1-Kcy8fDfe36wwTp//C/FZaz9qDk4=",
-      "dev": true
-    },
-    "postcss-safe-parser": {
-      "version": "4.0.2",
-      "integrity": "sha512-Uw6ekxSWNLCPesSv/cmqf2bY/77z11O7jZGPax3ycZMFU/oi2DMH9i89AdHc1tRwFg/arFoEwX0IS3LCUxJh1g==",
-      "dev": true,
-      "requires": {
-        "postcss": "^7.0.26"
-      },
-      "dependencies": {
-        "postcss": {
-          "version": "7.0.39",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-          "dev": true,
-          "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
-          }
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true
-        }
-      }
-    },
-    "postcss-sass": {
-      "version": "0.4.4",
-      "integrity": "sha512-BYxnVYx4mQooOhr+zer0qWbSPYnarAy8ZT7hAQtbxtgVf8gy+LSLT/hHGe35h14/pZDTw1DsxdbrwxBN++H+fg==",
-      "dev": true,
-      "requires": {
-        "gonzales-pe": "^4.3.0",
-        "postcss": "^7.0.21"
-      },
-      "dependencies": {
-        "postcss": {
-          "version": "7.0.39",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-          "dev": true,
-          "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
-          }
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true
-        }
-      }
-    },
-    "postcss-scss": {
-      "version": "2.1.1",
-      "integrity": "sha512-jQmGnj0hSGLd9RscFw9LyuSVAa5Bl1/KBPqG1NQw9w8ND55nY4ZEsdlVuYJvLPpV+y0nwTV5v/4rHPzZRihQbA==",
-      "dev": true,
-      "requires": {
-        "postcss": "^7.0.6"
-      },
-      "dependencies": {
-        "postcss": {
-          "version": "7.0.39",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-          "dev": true,
-          "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
-          }
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true
-        }
-      }
-    },
-    "postcss-selector-parser": {
-      "version": "6.0.6",
-      "integrity": "sha512-9LXrvaaX3+mcv5xkg5kFwqSzSH1JIObIx51PrndZwlmznwXRfxMddDvo9gve3gVR8ZTKgoFDdWkbRFmEhT4PMg==",
-      "dev": true,
-      "requires": {
-        "cssesc": "^3.0.0",
-        "util-deprecate": "^1.0.2"
-      }
-    },
-    "postcss-sorting": {
-      "version": "5.0.1",
-      "integrity": "sha512-Y9fUFkIhfrm6i0Ta3n+89j56EFqaNRdUKqXyRp6kvTcSXnmgEjaVowCXH+JBe9+YKWqd4nc28r2sgwnzJalccA==",
-      "dev": true,
-      "requires": {
-        "lodash": "^4.17.14",
-        "postcss": "^7.0.17"
-      },
-      "dependencies": {
-        "postcss": {
-          "version": "7.0.39",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-          "dev": true,
-          "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
-          }
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true
-        }
-      }
-    },
-    "postcss-syntax": {
-      "version": "0.36.2",
-      "integrity": "sha512-nBRg/i7E3SOHWxF3PpF5WnJM/jQ1YpY9000OaVXlAQj6Zp/kIqJxEDWIZ67tAd7NLuk7zqN4yqe9nc0oNAOs1w==",
-      "dev": true,
-      "requires": {}
-    },
-    "postcss-value-parser": {
-      "version": "4.1.0",
-      "integrity": "sha512-97DXOFbQJhk71ne5/Mt6cOu6yxsSfM0QGQyl0L25Gca4yGWEGJaig7l7gbCX623VqTBNGLRLaVUCnNkcedlRSQ==",
-      "dev": true
-    },
-    "postcss-values-parser": {
-      "version": "3.2.1",
-      "integrity": "sha512-SQ7/88VE9LhJh9gc27/hqnSU/aZaREVJcRVccXBmajgP2RkjdJzNyH/a9GCVMI5nsRhT0jC5HpUMwfkz81DVVg==",
-      "dev": true,
-      "requires": {
-        "color-name": "^1.1.4",
-        "is-url-superb": "^3.0.0",
-        "postcss": "^7.0.5",
-        "url-regex": "^5.0.0"
-      },
-      "dependencies": {
-        "postcss": {
-          "version": "7.0.39",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-          "dev": true,
-          "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
-          }
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true
-        }
-      }
-    },
-    "prelude-ls": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
-      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
-      "dev": true
-    },
-    "prettier": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.2.1.tgz",
-      "integrity": "sha512-PqyhM2yCjg/oKkFPtTGUojv7gnZAoG80ttl45O6x2Ug/rMJw4wcc9k6aaf2hibP7BGVCCM33gZoGjyvt9mm16Q==",
-      "dev": true
-    },
-    "prettier-linter-helpers": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/prettier-linter-helpers/-/prettier-linter-helpers-1.0.0.tgz",
-      "integrity": "sha512-GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==",
-      "dev": true,
-      "requires": {
-        "fast-diff": "^1.1.2"
-      }
-    },
-    "pretty-format": {
-      "version": "26.6.2",
-      "integrity": "sha512-7AeGuCYNGmycyQbCqd/3PWH4eOoX/OiCa0uphp57NVTeAGdJGaAliecxwBDHYQCIvrW7aDBZCYeNTP/WX69mkg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@jest/types": "^26.6.2",
-        "ansi-regex": "^5.0.0",
-        "ansi-styles": "^4.0.0",
-        "react-is": "^17.0.1"
-      },
-      "dependencies": {
-        "react-is": {
-          "version": "17.0.2",
-          "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "prompts": {
-      "version": "2.4.2",
-      "integrity": "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "kleur": "^3.0.3",
-        "sisteransi": "^1.0.5"
-      }
-    },
-    "prop-types": {
-      "version": "15.8.1",
-      "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz",
-      "integrity": "sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==",
-      "dev": true,
-      "requires": {
-        "loose-envify": "^1.4.0",
-        "object-assign": "^4.1.1",
-        "react-is": "^16.13.1"
-      }
-    },
-    "psl": {
-      "version": "1.8.0",
-      "integrity": "sha512-RIdOzyoavK+hA18OGGWDqUTsCLhtA7IcZ/6NCs4fFJaHBDab+pDDmDIByWFRQJq2Cd7r1OoQxBGKOaztq+hjIQ==",
-      "dev": true,
-      "peer": true
-    },
-    "pump": {
-      "version": "3.0.0",
-      "integrity": "sha512-LwZy+p3SFs1Pytd/jYct4wpv49HiYCqd9Rlc5ZVdk0V+8Yzv6jR5Blk3TRmPL1ft69TxP0IMZGJ+WPFU2BFhww==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "end-of-stream": "^1.1.0",
-        "once": "^1.3.1"
-      }
-    },
-    "querystringify": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz",
-      "integrity": "sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==",
-      "dev": true,
-      "peer": true
-    },
-    "queue-microtask": {
-      "version": "1.2.3",
-      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
-      "dev": true
-    },
-    "quick-lru": {
-      "version": "4.0.1",
-      "integrity": "sha512-ARhCpm70fzdcvNQfPoy49IaanKkTlRWF2JMzqhcJbhSFRZv7nPTvZJdcY7301IPmvW+/p0RgIWnQDLJxifsQ7g==",
-      "dev": true
-    },
-    "react": {
-      "version": "18.2.0",
-      "resolved": "https://registry.npmjs.org/react/-/react-18.2.0.tgz",
-      "integrity": "sha512-/3IjMdb2L9QbBdWiW5e3P2/npwMBaU9mHCSCUzNln0ZCYbcfTsGbTJrU/kGemdH2IWmB2ioZ+zkxtmq6g09fGQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "loose-envify": "^1.1.0"
-      }
-    },
-    "react-dom": {
-      "version": "18.2.0",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.2.0.tgz",
-      "integrity": "sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "loose-envify": "^1.1.0",
-        "scheduler": "^0.23.0"
-      }
-    },
-    "react-is": {
-      "version": "16.13.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
-      "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==",
-      "dev": true
-    },
-    "readable-stream": {
-      "version": "3.6.0",
-      "integrity": "sha512-BViHy7LKeTz4oNnkcLJ+lVSL6vpiFeX6/d3oSH8zCW7UxP2onchk+vTGB143xuFjHS3deTgkKoXXymXqymiIdA==",
-      "dev": true,
-      "requires": {
-        "inherits": "^2.0.3",
-        "string_decoder": "^1.1.1",
-        "util-deprecate": "^1.0.1"
-      }
-    },
-    "readdirp": {
-      "version": "3.5.0",
-      "integrity": "sha512-cMhu7c/8rdhkHXWsY+osBhfSy0JikwpHK/5+imo+LpeasTF8ouErHrlYkwT0++njiyuDvc7OFY5T3ukvZ8qmFQ==",
-      "dev": true,
-      "requires": {
-        "picomatch": "^2.2.1"
-      }
-    },
-    "regenerator-runtime": {
-      "version": "0.13.11",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
-      "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==",
-      "dev": true
-    },
-    "regex-not": {
-      "version": "1.0.2",
-      "integrity": "sha512-J6SDjUgDxQj5NusnOtdFxDwN/+HWykR8GELwctJ7mdqhcyy1xEc4SRFHUXvxTp661YaVKAjfRLZ9cCqS6tn32A==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "extend-shallow": "^3.0.2",
-        "safe-regex": "^1.1.0"
-      },
-      "dependencies": {
-        "extend-shallow": {
-          "version": "3.0.2",
-          "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "assign-symbols": "^1.0.0",
-            "is-extendable": "^1.0.1"
-          }
-        },
-        "is-extendable": {
-          "version": "1.0.1",
-          "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-plain-object": "^2.0.4"
-          }
-        }
-      }
-    },
-    "regexp.prototype.flags": {
-      "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.4.3.tgz",
-      "integrity": "sha512-fjggEOO3slI6Wvgjwflkc4NFRCTZAu5CnNfBd5qOMYhWdn67nJBBu34/TkD++eeFmd8C9r9jfXJ27+nSiRkSUA==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.3",
-        "functions-have-names": "^1.2.2"
-      }
-    },
-    "regexpp": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/regexpp/-/regexpp-3.2.0.tgz",
-      "integrity": "sha512-pq2bWo9mVD43nbts2wGv17XLiNLya+GklZ8kaDLV2Z08gDCsGpnKn9BFMepvWuHCbyVvY7J5o5+BVvoQbmlJLg==",
-      "dev": true
-    },
-    "remark": {
-      "version": "13.0.0",
-      "integrity": "sha512-HDz1+IKGtOyWN+QgBiAT0kn+2s6ovOxHyPAFGKVE81VSzJ+mq7RwHFledEvB5F1p4iJvOah/LOKdFuzvRnNLCA==",
-      "dev": true,
-      "requires": {
-        "remark-parse": "^9.0.0",
-        "remark-stringify": "^9.0.0",
-        "unified": "^9.1.0"
-      },
-      "dependencies": {
-        "remark-parse": {
-          "version": "9.0.0",
-          "integrity": "sha512-geKatMwSzEXKHuzBNU1z676sGcDcFoChMK38TgdHJNAYfFtsfHDQG7MoJAjs6sgYMqyLduCYWDIWZIxiPeafEw==",
-          "dev": true,
-          "requires": {
-            "mdast-util-from-markdown": "^0.8.0"
-          }
-        }
-      }
-    },
-    "remark-mdx": {
-      "version": "1.6.22",
-      "resolved": "https://registry.npmjs.org/remark-mdx/-/remark-mdx-1.6.22.tgz",
-      "integrity": "sha512-phMHBJgeV76uyFkH4rvzCftLfKCr2RZuF+/gmVcaKrpsihyzmhXjA0BEMDaPTXG5y8qZOKPVo83NAOX01LPnOQ==",
-      "dev": true,
-      "requires": {
-        "@babel/core": "7.12.9",
-        "@babel/helper-plugin-utils": "7.10.4",
-        "@babel/plugin-proposal-object-rest-spread": "7.12.1",
-        "@babel/plugin-syntax-jsx": "7.12.1",
-        "@mdx-js/util": "1.6.22",
-        "is-alphabetical": "1.0.4",
-        "remark-parse": "8.0.3",
-        "unified": "9.2.0"
-      },
-      "dependencies": {
-        "@babel/core": {
-          "version": "7.12.9",
-          "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.12.9.tgz",
-          "integrity": "sha512-gTXYh3M5wb7FRXQy+FErKFAv90BnlOuNn1QkCK2lREoPAjrQCO49+HVSrFoe5uakFAF5eenS75KbO2vQiLrTMQ==",
-          "dev": true,
-          "requires": {
-            "@babel/code-frame": "^7.10.4",
-            "@babel/generator": "^7.12.5",
-            "@babel/helper-module-transforms": "^7.12.1",
-            "@babel/helpers": "^7.12.5",
-            "@babel/parser": "^7.12.7",
-            "@babel/template": "^7.12.7",
-            "@babel/traverse": "^7.12.9",
-            "@babel/types": "^7.12.7",
-            "convert-source-map": "^1.7.0",
-            "debug": "^4.1.0",
-            "gensync": "^1.0.0-beta.1",
-            "json5": "^2.1.2",
-            "lodash": "^4.17.19",
-            "resolve": "^1.3.2",
-            "semver": "^5.4.1",
-            "source-map": "^0.5.0"
-          }
-        },
-        "@babel/helper-plugin-utils": {
-          "version": "7.10.4",
-          "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.10.4.tgz",
-          "integrity": "sha512-O4KCvQA6lLiMU9l2eawBPMf1xPP8xPfB3iEQw150hOVTqj/rfXz0ThTb4HEzqQfs2Bmo5Ay8BzxfzVtBrr9dVg==",
-          "dev": true
-        },
-        "semver": {
-          "version": "5.7.1",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-          "dev": true
-        }
-      }
-    },
-    "remark-parse": {
-      "version": "8.0.3",
-      "resolved": "https://registry.npmjs.org/remark-parse/-/remark-parse-8.0.3.tgz",
-      "integrity": "sha512-E1K9+QLGgggHxCQtLt++uXltxEprmWzNfg+MxpfHsZlrddKzZ/hZyWHDbK3/Ap8HJQqYJRXP+jHczdL6q6i85Q==",
-      "dev": true,
-      "requires": {
-        "ccount": "^1.0.0",
-        "collapse-white-space": "^1.0.2",
-        "is-alphabetical": "^1.0.0",
-        "is-decimal": "^1.0.0",
-        "is-whitespace-character": "^1.0.0",
-        "is-word-character": "^1.0.0",
-        "markdown-escapes": "^1.0.0",
-        "parse-entities": "^2.0.0",
-        "repeat-string": "^1.5.4",
-        "state-toggle": "^1.0.0",
-        "trim": "0.0.1",
-        "trim-trailing-lines": "^1.0.0",
-        "unherit": "^1.0.4",
-        "unist-util-remove-position": "^2.0.0",
-        "vfile-location": "^3.0.0",
-        "xtend": "^4.0.1"
-      }
-    },
-    "remark-stringify": {
-      "version": "9.0.1",
-      "integrity": "sha512-mWmNg3ZtESvZS8fv5PTvaPckdL4iNlCHTt8/e/8oN08nArHRHjNZMKzA/YW3+p7/lYqIw4nx1XsjCBo/AxNChg==",
-      "dev": true,
-      "requires": {
-        "mdast-util-to-markdown": "^0.6.0"
-      }
-    },
-    "remove-trailing-separator": {
-      "version": "1.1.0",
-      "integrity": "sha1-wkvOKig62tW8P1jg1IJJuSN52O8=",
-      "dev": true,
-      "peer": true
-    },
-    "repeat-element": {
-      "version": "1.1.4",
-      "integrity": "sha512-LFiNfRcSu7KK3evMyYOuCzv3L10TW7yC1G2/+StMjK8Y6Vqd2MG7r/Qjw4ghtuCOjFvlnms/iMmLqpvW/ES/WQ==",
-      "dev": true,
-      "peer": true
-    },
-    "repeat-string": {
-      "version": "1.6.1",
-      "integrity": "sha1-jcrkcOHIirwtYA//Sndihtp15jc=",
-      "dev": true
-    },
-    "require-directory": {
-      "version": "2.1.1",
-      "integrity": "sha1-jGStX9MNqxyXbiNE/+f3kqam30I=",
-      "dev": true
-    },
-    "require-from-string": {
-      "version": "2.0.2",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
-      "dev": true
-    },
-    "require-main-filename": {
-      "version": "2.0.0",
-      "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==",
-      "dev": true,
-      "peer": true
-    },
-    "requires-port": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
-      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
-      "dev": true,
-      "peer": true
-    },
-    "resolve": {
-      "version": "1.20.0",
-      "integrity": "sha512-wENBPt4ySzg4ybFQW2TT1zMQucPK95HSh/nq2CFTZVOGut2+pQvSsgtda4d26YrYcr067wjbmzOG8byDPBX63A==",
-      "dev": true,
-      "requires": {
-        "is-core-module": "^2.2.0",
-        "path-parse": "^1.0.6"
-      }
-    },
-    "resolve-cwd": {
-      "version": "3.0.0",
-      "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "resolve-from": "^5.0.0"
-      },
-      "dependencies": {
-        "resolve-from": {
-          "version": "5.0.0",
-          "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "resolve-from": {
-      "version": "4.0.0",
-      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
-      "dev": true
-    },
-    "resolve-url": {
-      "version": "0.2.1",
-      "integrity": "sha1-LGN/53yJOv0qZj/iGqkIAGjiBSo=",
-      "dev": true,
-      "peer": true
-    },
-    "restore-cursor": {
-      "version": "3.1.0",
-      "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==",
-      "dev": true,
-      "requires": {
-        "onetime": "^5.1.0",
-        "signal-exit": "^3.0.2"
-      }
-    },
-    "ret": {
-      "version": "0.1.15",
-      "integrity": "sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==",
-      "dev": true,
-      "peer": true
-    },
-    "reusify": {
-      "version": "1.0.4",
-      "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==",
-      "dev": true
-    },
-    "rimraf": {
-      "version": "3.0.2",
-      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
-      "dev": true,
-      "requires": {
-        "glob": "^7.1.3"
-      }
-    },
-    "rivet-graphql": {
-      "version": "0.3.1",
-      "integrity": "sha512-HEov02XhZ6H1jOME+mO8CZwliu/UtgZSHixYUwvQ7HSx3gk8EOVaQY5c3zscOYjZECvP8cR4+1Ob3KHWJRWEMw==",
-      "dev": true,
-      "requires": {
-        "graphql": "^15.3.0",
-        "graphql-request": "^3.0.0"
-      }
-    },
-    "rsvp": {
-      "version": "4.8.5",
-      "integrity": "sha512-nfMOlASu9OnRJo1mbEk2cz0D56a1MBNrJ7orjRZQG10XDyuvwksKbuXNp6qa+kbn839HwjwhBzhFmdsaEAfauA==",
-      "dev": true,
-      "peer": true
-    },
-    "run-async": {
-      "version": "2.4.1",
-      "integrity": "sha512-tvVnVv01b8c1RrA6Ep7JkStj85Guv/YrMcwqYQnwjsAS2cTmmPGBBjAjpCW7RrSodNSoE2/qg9O4bceNvUuDgQ==",
-      "dev": true
-    },
-    "run-parallel": {
-      "version": "1.2.0",
-      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
-      "dev": true,
-      "requires": {
-        "queue-microtask": "^1.2.2"
-      }
-    },
-    "rxjs": {
-      "version": "6.6.7",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.6.7.tgz",
-      "integrity": "sha512-hTdwr+7yYNIT5n4AMYp85KA6yw2Va0FLa3Rguvbpa4W3I5xynaBZo41cM3XM+4Q6fRMj3sBYIR1VAmZMXYJvRQ==",
-      "dev": true,
-      "requires": {
-        "tslib": "^1.9.0"
-      },
-      "dependencies": {
-        "tslib": {
-          "version": "1.14.1",
-          "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
-          "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
-          "dev": true
-        }
-      }
-    },
-    "safe-buffer": {
-      "version": "5.1.2",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "dev": true
-    },
-    "safe-regex": {
-      "version": "1.1.0",
-      "integrity": "sha1-QKNmnzsHfR6UPURinhV91IAjvy4=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "ret": "~0.1.10"
-      }
-    },
-    "safe-regex-test": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/safe-regex-test/-/safe-regex-test-1.0.0.tgz",
-      "integrity": "sha512-JBUUzyOgEwXQY1NuPtvcj/qcBDbDmEvWufhlnXZIm75DEHp+afM1r1ujJpJsV/gSM4t59tpDyPi1sd6ZaPFfsA==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "get-intrinsic": "^1.1.3",
-        "is-regex": "^1.1.4"
-      }
-    },
-    "safer-buffer": {
-      "version": "2.1.2",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "dev": true
-    },
-    "sane": {
-      "version": "4.1.0",
-      "integrity": "sha512-hhbzAgTIX8O7SHfp2c8/kREfEn4qO/9q8C9beyY6+tvZ87EpoZ3i1RIEvp27YBswnNbY9mWd6paKVmKbAgLfZA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@cnakazawa/watch": "^1.0.3",
-        "anymatch": "^2.0.0",
-        "capture-exit": "^2.0.0",
-        "exec-sh": "^0.3.2",
-        "execa": "^1.0.0",
-        "fb-watchman": "^2.0.0",
-        "micromatch": "^3.1.4",
-        "minimist": "^1.1.1",
-        "walker": "~1.0.5"
-      },
-      "dependencies": {
-        "anymatch": {
-          "version": "2.0.0",
-          "integrity": "sha512-5teOsQWABXHHBFP9y3skS5P3d/WfWXpv3FUpy+LorMrNYaT9pI4oLMQX7jzQ2KklNpGpWHzdCXTDT2Y3XGlZBw==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "micromatch": "^3.1.4",
-            "normalize-path": "^2.1.1"
-          }
-        },
-        "braces": {
-          "version": "2.3.2",
-          "integrity": "sha512-aNdbnj9P8PjdXU4ybaWLK2IF3jc/EoDYbC7AazW6to3TRsfXxscC9UXOB5iDiEQrkyIbWp2SLQda4+QAa7nc3w==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "arr-flatten": "^1.1.0",
-            "array-unique": "^0.3.2",
-            "extend-shallow": "^2.0.1",
-            "fill-range": "^4.0.0",
-            "isobject": "^3.0.1",
-            "repeat-element": "^1.1.2",
-            "snapdragon": "^0.8.1",
-            "snapdragon-node": "^2.0.1",
-            "split-string": "^3.0.2",
-            "to-regex": "^3.0.1"
-          }
-        },
-        "cross-spawn": {
-          "version": "6.0.5",
-          "integrity": "sha512-eTVLrBSt7fjbDygz805pMnstIs2VTBNkRm0qxZd+M7A5XDdxVRWO5MxGBXZhjY4cqLYLdtrGqRf8mBPmzwSpWQ==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "nice-try": "^1.0.4",
-            "path-key": "^2.0.1",
-            "semver": "^5.5.0",
-            "shebang-command": "^1.2.0",
-            "which": "^1.2.9"
-          }
-        },
-        "execa": {
-          "version": "1.0.0",
-          "integrity": "sha512-adbxcyWV46qiHyvSp50TKt05tB4tK3HcmF7/nxfAdhnox83seTDbwnaqKO4sXRy7roHAIFqJP/Rw/AuEbX61LA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "cross-spawn": "^6.0.0",
-            "get-stream": "^4.0.0",
-            "is-stream": "^1.1.0",
-            "npm-run-path": "^2.0.0",
-            "p-finally": "^1.0.0",
-            "signal-exit": "^3.0.0",
-            "strip-eof": "^1.0.0"
-          }
-        },
-        "fill-range": {
-          "version": "4.0.0",
-          "integrity": "sha1-1USBHUKPmOsGpj3EAtJAPDKMOPc=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "extend-shallow": "^2.0.1",
-            "is-number": "^3.0.0",
-            "repeat-string": "^1.6.1",
-            "to-regex-range": "^2.1.0"
-          }
-        },
-        "get-stream": {
-          "version": "4.1.0",
-          "integrity": "sha512-GMat4EJ5161kIy2HevLlr4luNjBgvmj413KaQA7jt4V8B4RDsfpHk7WQ9GVqfYyyx8OS/L66Kox+rJRNklLK7w==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "pump": "^3.0.0"
-          }
-        },
-        "is-buffer": {
-          "version": "1.1.6",
-          "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-          "dev": true,
-          "peer": true
-        },
-        "is-extendable": {
-          "version": "1.0.1",
-          "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-plain-object": "^2.0.4"
-          }
-        },
-        "is-number": {
-          "version": "3.0.0",
-          "integrity": "sha1-JP1iAaR4LPUFYcgQJ2r8fRLXEZU=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "is-stream": {
-          "version": "1.1.0",
-          "integrity": "sha1-EtSj3U5o4Lec6428hBc66A2RykQ=",
-          "dev": true,
-          "peer": true
-        },
-        "micromatch": {
-          "version": "3.1.10",
-          "integrity": "sha512-MWikgl9n9M3w+bpsY3He8L+w9eF9338xRl8IAO5viDizwSzziFEyUzo2xrrloB64ADbTf8uA8vRqqttDTOmccg==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "arr-diff": "^4.0.0",
-            "array-unique": "^0.3.2",
-            "braces": "^2.3.1",
-            "define-property": "^2.0.2",
-            "extend-shallow": "^3.0.2",
-            "extglob": "^2.0.4",
-            "fragment-cache": "^0.2.1",
-            "kind-of": "^6.0.2",
-            "nanomatch": "^1.2.9",
-            "object.pick": "^1.3.0",
-            "regex-not": "^1.0.0",
-            "snapdragon": "^0.8.1",
-            "to-regex": "^3.0.2"
-          },
-          "dependencies": {
-            "extend-shallow": {
-              "version": "3.0.2",
-              "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "assign-symbols": "^1.0.0",
-                "is-extendable": "^1.0.1"
-              }
-            }
-          }
-        },
-        "normalize-path": {
-          "version": "2.1.1",
-          "integrity": "sha1-GrKLVW4Zg2Oowab35vogE3/mrtk=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "remove-trailing-separator": "^1.0.1"
-          }
-        },
-        "npm-run-path": {
-          "version": "2.0.2",
-          "integrity": "sha1-NakjLfo11wZ7TLLd8jV7GHFTbF8=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "path-key": "^2.0.0"
-          }
-        },
-        "path-key": {
-          "version": "2.0.1",
-          "integrity": "sha1-QRyttXTFoUDTpLGRDUDYDMn0C0A=",
-          "dev": true,
-          "peer": true
-        },
-        "semver": {
-          "version": "5.7.1",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-          "dev": true,
-          "peer": true
-        },
-        "shebang-command": {
-          "version": "1.2.0",
-          "integrity": "sha1-RKrGW2lbAzmJaMOfNj/uXer98eo=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "shebang-regex": "^1.0.0"
-          }
-        },
-        "shebang-regex": {
-          "version": "1.0.0",
-          "integrity": "sha1-2kL0l0DAtC2yypcoVxyxkMmO/qM=",
-          "dev": true,
-          "peer": true
-        },
-        "to-regex-range": {
-          "version": "2.1.1",
-          "integrity": "sha1-fIDBe53+vlmeJzZ+DU3VWQFB2zg=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-number": "^3.0.0",
-            "repeat-string": "^1.6.1"
-          }
-        },
-        "which": {
-          "version": "1.3.1",
-          "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "isexe": "^2.0.0"
-          }
-        }
-      }
-    },
-    "saxes": {
-      "version": "5.0.1",
-      "integrity": "sha512-5LBh1Tls8c9xgGjw3QrMwETmTMVk0oFgvrFSvWx62llR2hcEInrKNZ2GZCCuuy2lvWrdl5jhbpeqc5hRYKFOcw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "xmlchars": "^2.2.0"
-      }
-    },
-    "scheduler": {
-      "version": "0.23.0",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.0.tgz",
-      "integrity": "sha512-CtuThmgHNg7zIZWAXi3AsyIzA3n4xx7aNyjwC2VJldO2LMVDhFK+63xGqq6CsJH4rTAt6/M+N4GhZiDYPx9eUw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "loose-envify": "^1.1.0"
-      }
-    },
-    "semver": {
-      "version": "7.3.5",
-      "integrity": "sha512-PoeGJYh8HK4BTO/a9Tf6ZG3veo/A7ZVsYrSA6J8ny9nb3B1VrpkuN+z9OE5wfE5p6H4LchYZsegiQgbJD94ZFQ==",
-      "dev": true,
-      "requires": {
-        "lru-cache": "^6.0.0"
-      }
-    },
-    "semver-compare": {
-      "version": "1.0.0",
-      "integrity": "sha1-De4hahyUGrN+nvsXiPavxf9VN/w=",
-      "dev": true
-    },
-    "set-blocking": {
-      "version": "2.0.0",
-      "integrity": "sha1-BF+XgtARrppoA93TgrJDkrPYkPc=",
-      "dev": true,
-      "peer": true
-    },
-    "set-value": {
-      "version": "2.0.1",
-      "integrity": "sha512-JxHc1weCN68wRY0fhCoXpyK55m/XPHafOmK4UWD7m2CI14GMcFypt4w/0+NV5f/ZMby2F6S2wwA7fgynh9gWSw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "extend-shallow": "^2.0.1",
-        "is-extendable": "^0.1.1",
-        "is-plain-object": "^2.0.3",
-        "split-string": "^3.0.1"
-      }
-    },
-    "shebang-command": {
-      "version": "2.0.0",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "dev": true,
-      "requires": {
-        "shebang-regex": "^3.0.0"
-      }
-    },
-    "shebang-regex": {
-      "version": "3.0.0",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "dev": true
-    },
-    "shellwords": {
-      "version": "0.1.1",
-      "integrity": "sha512-vFwSUfQvqybiICwZY5+DAWIPLKsWO31Q91JSKl3UYv+K5c2QRPzn0qzec6QPu1Qc9eHYItiP3NdJqNVqetYAww==",
-      "dev": true,
-      "optional": true,
-      "peer": true
-    },
-    "side-channel": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
-      "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.0",
-        "get-intrinsic": "^1.0.2",
-        "object-inspect": "^1.9.0"
-      }
-    },
-    "signal-exit": {
-      "version": "3.0.5",
-      "integrity": "sha512-KWcOiKeQj6ZyXx7zq4YxSMgHRlod4czeBQZrPb8OKcohcqAXShm7E20kEMle9WBt26hFcAf0qLOcp5zmY7kOqQ==",
-      "dev": true
-    },
-    "signale": {
-      "version": "1.4.0",
-      "integrity": "sha512-iuh+gPf28RkltuJC7W5MRi6XAjTDCAPC/prJUpQoG4vIP3MJZ+GTydVnodXA7pwvTKb2cA0m9OFZW/cdWy/I/w==",
-      "dev": true,
-      "requires": {
-        "chalk": "^2.3.2",
-        "figures": "^2.0.0",
-        "pkg-conf": "^2.1.0"
-      },
-      "dependencies": {
-        "ansi-styles": {
-          "version": "3.2.1",
-          "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-          "dev": true,
-          "requires": {
-            "color-convert": "^1.9.0"
-          }
-        },
-        "chalk": {
-          "version": "2.4.2",
-          "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^3.2.1",
-            "escape-string-regexp": "^1.0.5",
-            "supports-color": "^5.3.0"
-          }
-        },
-        "color-convert": {
-          "version": "1.9.3",
-          "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-          "dev": true,
-          "requires": {
-            "color-name": "1.1.3"
-          }
-        },
-        "color-name": {
-          "version": "1.1.3",
-          "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU=",
-          "dev": true
-        },
-        "figures": {
-          "version": "2.0.0",
-          "integrity": "sha1-OrGi0qYsi/tDGgyUy3l6L84nyWI=",
-          "dev": true,
-          "requires": {
-            "escape-string-regexp": "^1.0.5"
-          }
-        },
-        "has-flag": {
-          "version": "3.0.0",
-          "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0=",
-          "dev": true
-        },
-        "supports-color": {
-          "version": "5.5.0",
-          "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-          "dev": true,
-          "requires": {
-            "has-flag": "^3.0.0"
-          }
-        }
-      }
-    },
-    "simple-git-hooks": {
-      "version": "2.6.1",
-      "integrity": "sha512-nvqaNfgvcjN3cGSYJSdjwB+tP8YKRCyvuUvQ24luIjIpGhUCPpZDTJ+p+hcJiwc0lZlTCl0NayfBVDoIMG7Jpg==",
-      "dev": true
-    },
-    "sisteransi": {
-      "version": "1.0.5",
-      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
-      "dev": true,
-      "peer": true
-    },
-    "slash": {
-      "version": "3.0.0",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
-      "dev": true
-    },
-    "slice-ansi": {
-      "version": "3.0.0",
-      "integrity": "sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==",
-      "dev": true,
-      "requires": {
-        "ansi-styles": "^4.0.0",
-        "astral-regex": "^2.0.0",
-        "is-fullwidth-code-point": "^3.0.0"
-      }
-    },
-    "slugify": {
-      "version": "1.4.6",
-      "integrity": "sha512-ZdJIgv9gdrYwhXqxsH9pv7nXxjUEyQ6nqhngRxoAAOlmMGA28FDq5O4/5US4G2/Nod7d1ovNcgURQJ7kHq50KQ==",
-      "dev": true
-    },
-    "snapdragon": {
-      "version": "0.8.2",
-      "integrity": "sha512-FtyOnWN/wCHTVXOMwvSv26d+ko5vWlIDD6zoUJ7LW8vh+ZBC8QdljveRP+crNrtBwioEUWy/4dMtbBjA4ioNlg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "base": "^0.11.1",
-        "debug": "^2.2.0",
-        "define-property": "^0.2.5",
-        "extend-shallow": "^2.0.1",
-        "map-cache": "^0.2.2",
-        "source-map": "^0.5.6",
-        "source-map-resolve": "^0.5.0",
-        "use": "^3.1.0"
-      },
-      "dependencies": {
-        "debug": {
-          "version": "2.6.9",
-          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "ms": "2.0.0"
-          }
-        },
-        "define-property": {
-          "version": "0.2.5",
-          "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-descriptor": "^0.1.0"
-          }
-        },
-        "is-accessor-descriptor": {
-          "version": "0.1.6",
-          "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "is-buffer": {
-          "version": "1.1.6",
-          "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-          "dev": true,
-          "peer": true
-        },
-        "is-data-descriptor": {
-          "version": "0.1.4",
-          "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "is-descriptor": {
-          "version": "0.1.6",
-          "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-accessor-descriptor": "^0.1.6",
-            "is-data-descriptor": "^0.1.4",
-            "kind-of": "^5.0.0"
-          }
-        },
-        "kind-of": {
-          "version": "5.1.0",
-          "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-          "dev": true,
-          "peer": true
-        },
-        "ms": {
-          "version": "2.0.0",
-          "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "snapdragon-node": {
-      "version": "2.1.1",
-      "integrity": "sha512-O27l4xaMYt/RSQ5TR3vpWCAB5Kb/czIcqUFOM/C4fYcLnbZUc1PkjTAMjof2pBWaSTwOUd6qUHcFGVGj7aIwnw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "define-property": "^1.0.0",
-        "isobject": "^3.0.0",
-        "snapdragon-util": "^3.0.1"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "1.0.0",
-          "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-descriptor": "^1.0.0"
-          }
-        }
-      }
-    },
-    "snapdragon-util": {
-      "version": "3.0.1",
-      "integrity": "sha512-mbKkMdQKsjX4BAL4bRYTj21edOf8cN7XHdYUJEe+Zn99hVEYcMvKPct1IqNe7+AZPirn8BCDOQBHQZknqmKlZQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "kind-of": "^3.2.0"
-      },
-      "dependencies": {
-        "is-buffer": {
-          "version": "1.1.6",
-          "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-          "dev": true,
-          "peer": true
-        },
-        "kind-of": {
-          "version": "3.2.2",
-          "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
-    },
-    "source-map": {
-      "version": "0.5.7",
-      "integrity": "sha1-igOdLRAh0i0eoUyA2OpGi6LvP8w=",
-      "dev": true
-    },
-    "source-map-js": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.0.2.tgz",
-      "integrity": "sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw==",
-      "dev": true
-    },
-    "source-map-resolve": {
-      "version": "0.5.3",
-      "integrity": "sha512-Htz+RnsXWk5+P2slx5Jh3Q66vhQj1Cllm0zvnaY98+NFx+Dv2CF/f5O/t8x+KaNdrdIAsruNzoh/KpialbqAnw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "atob": "^2.1.2",
-        "decode-uri-component": "^0.2.0",
-        "resolve-url": "^0.2.1",
-        "source-map-url": "^0.4.0",
-        "urix": "^0.1.0"
-      }
-    },
-    "source-map-support": {
-      "version": "0.5.20",
-      "integrity": "sha512-n1lZZ8Ve4ksRqizaBQgxXDgKwttHDhyfQjA6YZZn8+AroHbsIz+JjwxQDxbp+7y5OYCI8t1Yk7etjD9CRd2hIw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "buffer-from": "^1.0.0",
-        "source-map": "^0.6.0"
-      },
-      "dependencies": {
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "source-map-url": {
-      "version": "0.4.1",
-      "integrity": "sha512-cPiFOTLUKvJFIg4SKVScy4ilPPW6rFgMgfuZJPNoDuMs3nC1HbMUycBoJw77xFIp6z1UJQJOfx6C9GMH80DiTw==",
-      "dev": true,
-      "peer": true
-    },
-    "spdx-correct": {
-      "version": "3.1.1",
-      "integrity": "sha512-cOYcUWwhCuHCXi49RhFRCyJEK3iPj1Ziz9DpViV3tbZOwXD49QzIN3MpOLJNxh2qwq2lJJZaKMVw9qNi4jTC0w==",
-      "dev": true,
-      "requires": {
-        "spdx-expression-parse": "^3.0.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "spdx-exceptions": {
-      "version": "2.3.0",
-      "integrity": "sha512-/tTrYOC7PPI1nUAgx34hUpqXuyJG+DTHJTnIULG4rDygi4xu/tfgmq1e1cIRwRzwZgo4NLySi+ricLkZkw4i5A==",
-      "dev": true
-    },
-    "spdx-expression-parse": {
-      "version": "3.0.1",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
-      "dev": true,
-      "requires": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "spdx-license-ids": {
-      "version": "3.0.10",
-      "integrity": "sha512-oie3/+gKf7QtpitB0LYLETe+k8SifzsX4KixvpOsbI6S0kRiRQ5MKOio8eMSAKQ17N06+wdEOXRiId+zOxo0hA==",
-      "dev": true
-    },
-    "specificity": {
-      "version": "0.4.1",
-      "integrity": "sha512-1klA3Gi5PD1Wv9Q0wUoOQN1IWAuPu0D1U03ThXTr0cJ20+/iq2tHSDnK7Kk/0LXJ1ztUB2/1Os0wKmfyNgUQfg==",
-      "dev": true
-    },
-    "split-string": {
-      "version": "3.1.0",
-      "integrity": "sha512-NzNVhJDYpwceVVii8/Hu6DKfD2G+NrQHlS/V/qgv763EYudVwEcMQNxd2lh+0VrUByXN/oJkl5grOhYWvQUYiw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "extend-shallow": "^3.0.0"
-      },
-      "dependencies": {
-        "extend-shallow": {
-          "version": "3.0.2",
-          "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "assign-symbols": "^1.0.0",
-            "is-extendable": "^1.0.1"
-          }
-        },
-        "is-extendable": {
-          "version": "1.0.1",
-          "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-plain-object": "^2.0.4"
-          }
-        }
-      }
-    },
-    "sprintf-js": {
-      "version": "1.0.3",
-      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw=",
-      "dev": true,
-      "peer": true
-    },
-    "stack-utils": {
-      "version": "2.0.5",
-      "integrity": "sha512-xrQcmYhOsn/1kX+Vraq+7j4oE2j/6BFscZ0etmYg81xuM8Gq0022Pxb8+IqgOFUIaxHs0KaSb7T1+OegiNrNFA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "escape-string-regexp": "^2.0.0"
-      },
-      "dependencies": {
-        "escape-string-regexp": {
-          "version": "2.0.0",
-          "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "state-toggle": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/state-toggle/-/state-toggle-1.0.3.tgz",
-      "integrity": "sha512-d/5Z4/2iiCnHw6Xzghyhb+GcmF89bxwgXG60wjIiZaxnymbyOmI8Hk4VqHXiVVp6u2ysaskFfXg3ekCj4WNftQ==",
-      "dev": true
-    },
-    "static-extend": {
-      "version": "0.1.2",
-      "integrity": "sha1-YICcOcv/VTNyJv1eC1IPNB8ftcY=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "define-property": "^0.2.5",
-        "object-copy": "^0.1.0"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "0.2.5",
-          "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-descriptor": "^0.1.0"
-          }
-        },
-        "is-accessor-descriptor": {
-          "version": "0.1.6",
-          "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "is-buffer": {
-          "version": "1.1.6",
-          "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-          "dev": true,
-          "peer": true
-        },
-        "is-data-descriptor": {
-          "version": "0.1.4",
-          "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "is-descriptor": {
-          "version": "0.1.6",
-          "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-accessor-descriptor": "^0.1.6",
-            "is-data-descriptor": "^0.1.4",
-            "kind-of": "^5.0.0"
-          }
-        },
-        "kind-of": {
-          "version": "5.1.0",
-          "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "stop-iteration-iterator": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/stop-iteration-iterator/-/stop-iteration-iterator-1.0.0.tgz",
-      "integrity": "sha512-iCGQj+0l0HOdZ2AEeBADlsRC+vsnDsZsbdSiH1yNSjcfKM7fdpCMfqAL/dwF5BLiw/XhRft/Wax6zQbhq2BcjQ==",
-      "dev": true,
-      "requires": {
-        "internal-slot": "^1.0.4"
-      }
-    },
-    "streamsearch": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/streamsearch/-/streamsearch-1.1.0.tgz",
-      "integrity": "sha512-Mcc5wHehp9aXz1ax6bZUyY5afg9u2rv5cqQI3mRrYkGC8rW2hM02jWuwjtL++LS5qinSyhj2QfLyNsuc+VsExg==",
-      "dev": true
-    },
-    "string_decoder": {
-      "version": "1.3.0",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
-      "dev": true,
-      "requires": {
-        "safe-buffer": "~5.2.0"
-      },
-      "dependencies": {
-        "safe-buffer": {
-          "version": "5.2.1",
-          "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-          "dev": true
-        }
-      }
-    },
-    "string-argv": {
-      "version": "0.3.1",
-      "integrity": "sha512-a1uQGz7IyVy9YwhqjZIZu1c8JO8dNIe20xBmSS6qu9kv++k3JGzCVmprbNN5Kn+BgzD5E7YYwg1CcjuJMRNsvg==",
-      "dev": true
-    },
-    "string-length": {
-      "version": "4.0.2",
-      "integrity": "sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "char-regex": "^1.0.2",
-        "strip-ansi": "^6.0.0"
-      }
-    },
-    "string-width": {
-      "version": "4.2.3",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "requires": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "dependencies": {
-        "emoji-regex": {
-          "version": "8.0.0",
-          "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-          "dev": true
-        }
-      }
-    },
-    "string.prototype.matchall": {
-      "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/string.prototype.matchall/-/string.prototype.matchall-4.0.8.tgz",
-      "integrity": "sha512-6zOCOcJ+RJAQshcTvXPHoxoQGONa3e/Lqx90wUA+wEzX78sg5Bo+1tQo4N0pohS0erG9qtCqJDjNCQBjeWVxyg==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4",
-        "get-intrinsic": "^1.1.3",
-        "has-symbols": "^1.0.3",
-        "internal-slot": "^1.0.3",
-        "regexp.prototype.flags": "^1.4.3",
-        "side-channel": "^1.0.4"
-      }
-    },
-    "string.prototype.trimend": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.6.tgz",
-      "integrity": "sha512-JySq+4mrPf9EsDBEDYMOb/lM7XQLulwg5R/m1r0PXEFqrV0qHvl58sdTilSXtKOflCsK2E8jxf+GKC0T07RWwQ==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      }
-    },
-    "string.prototype.trimstart": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.6.tgz",
-      "integrity": "sha512-omqjMDaY92pbn5HOX7f9IccLA+U1tA9GvtU4JrodiXFfYB7jPzzHpRzpglLAjtUV6bB557zwClJezTqnAiYnQA==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "define-properties": "^1.1.4",
-        "es-abstract": "^1.20.4"
-      }
-    },
-    "stringify-entities": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-3.1.0.tgz",
-      "integrity": "sha512-3FP+jGMmMV/ffZs86MoghGqAoqXAdxLrJP4GUdrDN1aIScYih5tuIO3eF4To5AJZ79KDZ8Fpdy7QJnK8SsL1Vg==",
-      "dev": true,
-      "requires": {
-        "character-entities-html4": "^1.0.0",
-        "character-entities-legacy": "^1.0.0",
-        "xtend": "^4.0.0"
-      }
-    },
-    "stringify-object": {
-      "version": "3.3.0",
-      "integrity": "sha512-rHqiFh1elqCQ9WPLIC8I0Q/g/wj5J1eMkyoiD6eoQApWHP0FtlK7rqnhmabL5VUY9JQCcqwwvlOaSuutekgyrw==",
-      "dev": true,
-      "requires": {
-        "get-own-enumerable-property-symbols": "^3.0.0",
-        "is-obj": "^1.0.1",
-        "is-regexp": "^1.0.0"
-      }
-    },
-    "strip-ansi": {
-      "version": "6.0.1",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "requires": {
-        "ansi-regex": "^5.0.1"
-      }
-    },
-    "strip-bom": {
-      "version": "4.0.0",
-      "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==",
-      "dev": true,
-      "peer": true
-    },
-    "strip-eof": {
-      "version": "1.0.0",
-      "integrity": "sha1-u0P/VZim6wXYm1n80SnJgzE2Br8=",
-      "dev": true,
-      "peer": true
-    },
-    "strip-final-newline": {
-      "version": "2.0.0",
-      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
-      "dev": true
-    },
-    "strip-json-comments": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
-      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
-      "dev": true
-    },
-    "style-search": {
-      "version": "0.1.0",
-      "integrity": "sha1-eVjHk+R+MuB9K1yv5cC/jhLneQI=",
-      "dev": true
-    },
-    "styled-jsx": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.1.tgz",
-      "integrity": "sha512-pW7uC1l4mBZ8ugbiZrcIsiIvVx1UmTfw7UkC3Um2tmfUq9Bhk8IiyEIPl6F8agHgjzku6j0xQEZbfA5uSgSaCw==",
-      "dev": true,
-      "requires": {
-        "client-only": "0.0.1"
-      }
-    },
-    "stylelint": {
-      "version": "13.8.0",
-      "integrity": "sha512-iHH3dv3UI23SLDrH4zMQDjLT9/dDIz/IpoFeuNxZmEx86KtfpjDOscxLTFioQyv+2vQjPlRZnK0UoJtfxLICXQ==",
-      "dev": true,
-      "requires": {
-        "@stylelint/postcss-css-in-js": "^0.37.2",
-        "@stylelint/postcss-markdown": "^0.36.2",
-        "autoprefixer": "^9.8.6",
-        "balanced-match": "^1.0.0",
-        "chalk": "^4.1.0",
-        "cosmiconfig": "^7.0.0",
-        "debug": "^4.2.0",
-        "execall": "^2.0.0",
-        "fast-glob": "^3.2.4",
-        "fastest-levenshtein": "^1.0.12",
-        "file-entry-cache": "^6.0.0",
-        "get-stdin": "^8.0.0",
-        "global-modules": "^2.0.0",
-        "globby": "^11.0.1",
-        "globjoin": "^0.1.4",
-        "html-tags": "^3.1.0",
-        "ignore": "^5.1.8",
-        "import-lazy": "^4.0.0",
-        "imurmurhash": "^0.1.4",
-        "known-css-properties": "^0.20.0",
-        "lodash": "^4.17.20",
-        "log-symbols": "^4.0.0",
-        "mathml-tag-names": "^2.1.3",
-        "meow": "^8.0.0",
-        "micromatch": "^4.0.2",
-        "normalize-selector": "^0.2.0",
-        "postcss": "^7.0.35",
-        "postcss-html": "^0.36.0",
-        "postcss-less": "^3.1.4",
-        "postcss-media-query-parser": "^0.2.3",
-        "postcss-resolve-nested-selector": "^0.1.1",
-        "postcss-safe-parser": "^4.0.2",
-        "postcss-sass": "^0.4.4",
-        "postcss-scss": "^2.1.1",
-        "postcss-selector-parser": "^6.0.4",
-        "postcss-syntax": "^0.36.2",
-        "postcss-value-parser": "^4.1.0",
-        "resolve-from": "^5.0.0",
-        "slash": "^3.0.0",
-        "specificity": "^0.4.1",
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.0",
-        "style-search": "^0.1.0",
-        "sugarss": "^2.0.0",
-        "svg-tags": "^1.0.0",
-        "table": "^6.0.3",
-        "v8-compile-cache": "^2.2.0",
-        "write-file-atomic": "^3.0.3"
-      },
-      "dependencies": {
-        "camelcase-keys": {
-          "version": "6.2.2",
-          "integrity": "sha512-YrwaA0vEKazPBkn0ipTiMpSajYDSe+KjQfrjhcBMxJt/znbvlHd8Pw/Vamaz5EB4Wfhs3SUR3Z9mwRu/P3s3Yg==",
-          "dev": true,
-          "requires": {
-            "camelcase": "^5.3.1",
-            "map-obj": "^4.0.0",
-            "quick-lru": "^4.0.1"
-          }
-        },
-        "find-up": {
-          "version": "4.1.0",
-          "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-          "dev": true,
-          "requires": {
-            "locate-path": "^5.0.0",
-            "path-exists": "^4.0.0"
-          }
-        },
-        "get-stdin": {
-          "version": "8.0.0",
-          "integrity": "sha512-sY22aA6xchAzprjyqmSEQv4UbAAzRN0L2dQB0NlN5acTTK9Don6nhoc3eAbUnpZiCANAMfd/+40kVdKfFygohg==",
-          "dev": true
-        },
-        "hosted-git-info": {
-          "version": "4.0.2",
-          "integrity": "sha512-c9OGXbZ3guC/xOlCg1Ci/VgWlwsqDv1yMQL1CWqXDL0hDjXuNcq0zuR4xqPSuasI3kqFDhqSyTjREz5gzq0fXg==",
-          "dev": true,
-          "requires": {
-            "lru-cache": "^6.0.0"
-          }
-        },
-        "import-lazy": {
-          "version": "4.0.0",
-          "integrity": "sha512-rKtvo6a868b5Hu3heneU+L4yEQ4jYKLtjpnPeUdK7h0yzXGmyBTypknlkCvHFBqfX9YlorEiMM6Dnq/5atfHkw==",
-          "dev": true
-        },
-        "locate-path": {
-          "version": "5.0.0",
-          "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-          "dev": true,
-          "requires": {
-            "p-locate": "^4.1.0"
-          }
-        },
-        "map-obj": {
-          "version": "4.3.0",
-          "integrity": "sha512-hdN1wVrZbb29eBGiGjJbeP8JbKjq1urkHJ/LIP/NY48MZ1QVXUsQBV1G1zvYFHn1XE06cwjBsOI2K3Ulnj1YXQ==",
-          "dev": true
-        },
-        "meow": {
-          "version": "8.1.2",
-          "integrity": "sha512-r85E3NdZ+mpYk1C6RjPFEMSE+s1iZMuHtsHAqY0DT3jZczl0diWUZ8g6oU7h0M9cD2EL+PzaYghhCLzR0ZNn5Q==",
-          "dev": true,
-          "requires": {
-            "@types/minimist": "^1.2.0",
-            "camelcase-keys": "^6.2.2",
-            "decamelize-keys": "^1.1.0",
-            "hard-rejection": "^2.1.0",
-            "minimist-options": "4.1.0",
-            "normalize-package-data": "^3.0.0",
-            "read-pkg-up": "^7.0.1",
-            "redent": "^3.0.0",
-            "trim-newlines": "^3.0.0",
-            "type-fest": "^0.18.0",
-            "yargs-parser": "^20.2.3"
-          }
-        },
-        "normalize-package-data": {
-          "version": "3.0.3",
-          "integrity": "sha512-p2W1sgqij3zMMyRC067Dg16bfzVH+w7hyegmpIvZ4JNjqtGOVAIvLmjBx3yP7YTe9vKJgkoNOPjwQGogDoMXFA==",
-          "dev": true,
-          "requires": {
-            "hosted-git-info": "^4.0.1",
-            "is-core-module": "^2.5.0",
-            "semver": "^7.3.4",
-            "validate-npm-package-license": "^3.0.1"
-          }
-        },
-        "p-limit": {
-          "version": "2.3.0",
-          "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-          "dev": true,
-          "requires": {
-            "p-try": "^2.0.0"
-          }
-        },
-        "p-locate": {
-          "version": "4.1.0",
-          "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-          "dev": true,
-          "requires": {
-            "p-limit": "^2.2.0"
-          }
-        },
-        "path-exists": {
-          "version": "4.0.0",
-          "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-          "dev": true
-        },
-        "postcss": {
-          "version": "7.0.39",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-          "dev": true,
-          "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
-          }
-        },
-        "read-pkg": {
-          "version": "5.2.0",
-          "integrity": "sha512-Ug69mNOpfvKDAc2Q8DRpMjjzdtrnv9HcSMX+4VsZxD1aZ6ZzrIE7rlzXBtWTyhULSMKg076AW6WR5iZpD0JiOg==",
-          "dev": true,
-          "requires": {
-            "@types/normalize-package-data": "^2.4.0",
-            "normalize-package-data": "^2.5.0",
-            "parse-json": "^5.0.0",
-            "type-fest": "^0.6.0"
-          },
-          "dependencies": {
-            "hosted-git-info": {
-              "version": "2.8.9",
-              "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==",
-              "dev": true
-            },
-            "normalize-package-data": {
-              "version": "2.5.0",
-              "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
-              "dev": true,
-              "requires": {
-                "hosted-git-info": "^2.1.4",
-                "resolve": "^1.10.0",
-                "semver": "2 || 3 || 4 || 5",
-                "validate-npm-package-license": "^3.0.1"
-              }
-            },
-            "semver": {
-              "version": "5.7.1",
-              "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-              "dev": true
-            },
-            "type-fest": {
-              "version": "0.6.0",
-              "integrity": "sha512-q+MB8nYR1KDLrgr4G5yemftpMC7/QLqVndBmEEdqzmNj5dcFOO4Oo8qlwZE3ULT3+Zim1F8Kq4cBnikNhlCMlg==",
-              "dev": true
-            }
-          }
-        },
-        "read-pkg-up": {
-          "version": "7.0.1",
-          "integrity": "sha512-zK0TB7Xd6JpCLmlLmufqykGE+/TlOePD6qKClNW7hHDKFh/J7/7gCWGR7joEQEW1bKq3a3yUZSObOoWLFQ4ohg==",
-          "dev": true,
-          "requires": {
-            "find-up": "^4.1.0",
-            "read-pkg": "^5.2.0",
-            "type-fest": "^0.8.1"
-          },
-          "dependencies": {
-            "type-fest": {
-              "version": "0.8.1",
-              "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
-              "dev": true
-            }
-          }
-        },
-        "redent": {
-          "version": "3.0.0",
-          "integrity": "sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==",
-          "dev": true,
-          "requires": {
-            "indent-string": "^4.0.0",
-            "strip-indent": "^3.0.0"
-          }
-        },
-        "resolve-from": {
-          "version": "5.0.0",
-          "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
-          "dev": true
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true
-        },
-        "strip-indent": {
-          "version": "3.0.0",
-          "integrity": "sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==",
-          "dev": true,
-          "requires": {
-            "min-indent": "^1.0.0"
-          }
-        },
-        "trim-newlines": {
-          "version": "3.0.1",
-          "integrity": "sha512-c1PTsA3tYrIsLGkJkzHF+w9F2EyxfXGo4UyJc4pFL++FMjnq0HJS69T3M7d//gKrFKwy429bouPescbjecU+Zw==",
-          "dev": true
-        },
-        "type-fest": {
-          "version": "0.18.1",
-          "integrity": "sha512-OIAYXk8+ISY+qTOwkHtKqzAuxchoMiD9Udx+FSGQDuiRR+PJKJHc2NJAXlbhkGwTt/4/nKZxELY1w3ReWOL8mw==",
-          "dev": true
-        }
-      }
-    },
-    "stylelint-config-css-modules": {
-      "version": "2.2.0",
-      "integrity": "sha512-+zjcDbot+zbuxy1UA31k4G2lUG+nHUwnLyii3uT2F09B8kT2YrT9LZYNfMtAWlDidrxr7sFd5HX9EqPHGU3WKA==",
-      "dev": true,
-      "requires": {}
-    },
-    "stylelint-config-prettier": {
-      "version": "8.0.2",
-      "integrity": "sha512-TN1l93iVTXpF9NJstlvP7nOu9zY2k+mN0NSFQ/VEGz15ZIP9ohdDZTtCWHs5LjctAhSAzaILULGbgiM0ItId3A==",
-      "dev": true,
-      "requires": {}
-    },
-    "stylelint-config-recommended": {
-      "version": "3.0.0",
-      "integrity": "sha512-F6yTRuc06xr1h5Qw/ykb2LuFynJ2IxkKfCMf+1xqPffkxh0S09Zc902XCffcsw/XMFq/OzQ1w54fLIDtmRNHnQ==",
-      "dev": true,
-      "requires": {}
-    },
-    "stylelint-config-standard": {
-      "version": "20.0.0",
-      "integrity": "sha512-IB2iFdzOTA/zS4jSVav6z+wGtin08qfj+YyExHB3LF9lnouQht//YyB0KZq9gGz5HNPkddHOzcY8HsUey6ZUlA==",
-      "dev": true,
-      "requires": {
-        "stylelint-config-recommended": "^3.0.0"
-      }
-    },
-    "stylelint-media-use-custom-media": {
-      "version": "2.0.0",
-      "integrity": "sha512-G7Hwma8HIMFJOChqrX9ie8hAGbtEMUbEjuiaR3olHIXjloDWqYlFHIJKsCyyckigkm+4LtCwtZDQASrVY4pRBg==",
-      "dev": true,
-      "requires": {}
-    },
-    "stylelint-order": {
-      "version": "4.1.0",
-      "integrity": "sha512-sVTikaDvMqg2aJjh4r48jsdfmqLT+nqB1MOsaBnvM3OwLx4S+WXcsxsgk5w18h/OZoxZCxuyXMh61iBHcj9Qiw==",
-      "dev": true,
-      "requires": {
-        "lodash": "^4.17.15",
-        "postcss": "^7.0.31",
-        "postcss-sorting": "^5.0.1"
-      },
-      "dependencies": {
-        "postcss": {
-          "version": "7.0.39",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-          "dev": true,
-          "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
-          }
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true
-        }
-      }
-    },
-    "stylelint-use-nesting": {
-      "version": "3.0.0",
-      "integrity": "sha512-BMzhXWbK5DdAYtZMQULn7VmWZXpy8Rwlx2PgeNYqKInQrKTJWM/TFKPScc+xvsGUc/6JPiUDeQQij9gFnOo8Kg==",
-      "dev": true,
-      "requires": {}
-    },
-    "stylelint-value-no-unknown-custom-properties": {
-      "version": "3.0.0",
-      "integrity": "sha512-8WoOnZ4ELTxA1cDbhwolIVOutxHwbjpXmd0lL0Li3Iye078jSnEb1KO6pJ/ig5oDVGRApFeA25Fyy4qqmqwGgg==",
-      "dev": true,
-      "requires": {
-        "postcss-values-parser": "^3.2.1"
-      }
-    },
-    "sugarss": {
-      "version": "2.0.0",
-      "integrity": "sha512-WfxjozUk0UVA4jm+U1d736AUpzSrNsQcIbyOkoE364GrtWmIrFdk5lksEupgWMD4VaT/0kVx1dobpiDumSgmJQ==",
-      "dev": true,
-      "requires": {
-        "postcss": "^7.0.2"
-      },
-      "dependencies": {
-        "postcss": {
-          "version": "7.0.39",
-          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
-          "dev": true,
-          "requires": {
-            "picocolors": "^0.2.1",
-            "source-map": "^0.6.1"
-          }
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-          "dev": true
-        }
-      }
-    },
-    "supports-color": {
-      "version": "7.2.0",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "dev": true,
-      "requires": {
-        "has-flag": "^4.0.0"
-      }
-    },
-    "supports-hyperlinks": {
-      "version": "2.2.0",
-      "integrity": "sha512-6sXEzV5+I5j8Bmq9/vUphGRM/RJNT9SCURJLjwfOg51heRtguGWDzcaBlgAzKhQa0EVNpPEKzQuBwZ8S8WaCeQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "has-flag": "^4.0.0",
-        "supports-color": "^7.0.0"
-      }
-    },
-    "supports-preserve-symlinks-flag": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
-      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
-      "dev": true
-    },
-    "svg-tags": {
-      "version": "1.0.0",
-      "integrity": "sha1-WPcc7jvVGbWdSyqEO2x95krAR2Q=",
-      "dev": true
-    },
-    "symbol-tree": {
-      "version": "3.2.4",
-      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
-      "dev": true,
-      "peer": true
-    },
-    "synckit": {
-      "version": "0.8.4",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.8.4.tgz",
-      "integrity": "sha512-Dn2ZkzMdSX827QbowGbU/4yjWuvNaCoScLLoMo/yKbu+P4GBR6cRGKZH27k6a9bRzdqcyd1DE96pQtQ6uNkmyw==",
-      "dev": true,
-      "requires": {
-        "@pkgr/utils": "^2.3.1",
-        "tslib": "^2.4.0"
-      }
-    },
-    "table": {
-      "version": "6.7.2",
-      "integrity": "sha512-UFZK67uvyNivLeQbVtkiUs8Uuuxv24aSL4/Vil2PJVtMgU8Lx0CYkP12uCGa3kjyQzOSgV1+z9Wkb82fCGsO0g==",
-      "dev": true,
-      "requires": {
-        "ajv": "^8.0.1",
-        "lodash.clonedeep": "^4.5.0",
-        "lodash.truncate": "^4.4.2",
-        "slice-ansi": "^4.0.0",
-        "string-width": "^4.2.3",
-        "strip-ansi": "^6.0.1"
-      },
-      "dependencies": {
-        "ajv": {
-          "version": "8.6.3",
-          "integrity": "sha512-SMJOdDP6LqTkD0Uq8qLi+gMwSt0imXLSV080qFVwJCpH9U6Mb+SUGHAXM0KNbcBPguytWyvFxcHgMLe2D2XSpw==",
-          "dev": true,
-          "requires": {
-            "fast-deep-equal": "^3.1.1",
-            "json-schema-traverse": "^1.0.0",
-            "require-from-string": "^2.0.2",
-            "uri-js": "^4.2.2"
-          }
-        },
-        "json-schema-traverse": {
-          "version": "1.0.0",
-          "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-          "dev": true
-        },
-        "slice-ansi": {
-          "version": "4.0.0",
-          "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^4.0.0",
-            "astral-regex": "^2.0.0",
-            "is-fullwidth-code-point": "^3.0.0"
-          }
-        }
-      }
-    },
-    "tapable": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.2.1.tgz",
-      "integrity": "sha512-GNzQvQTOIP6RyTfE2Qxb8ZVlNmw0n88vp1szwWRimP02mnTsx3Wtn5qRdqY9w2XduFNUgvOwhNnQsjwCp+kqaQ==",
-      "dev": true
-    },
-    "terminal-link": {
-      "version": "2.1.1",
-      "integrity": "sha512-un0FmiRUQNr5PJqy9kP7c40F5BOfpGlYTrxonDChEZB7pzZxRNp/bt+ymiy9/npwXya9KH99nJ/GXFIiUkYGFQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "ansi-escapes": "^4.2.1",
-        "supports-hyperlinks": "^2.0.0"
-      }
-    },
-    "test-exclude": {
-      "version": "6.0.0",
-      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@istanbuljs/schema": "^0.1.2",
-        "glob": "^7.1.4",
-        "minimatch": "^3.0.4"
-      }
-    },
-    "text-table": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
-      "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==",
-      "dev": true
-    },
-    "throat": {
-      "version": "5.0.0",
-      "integrity": "sha512-fcwX4mndzpLQKBS1DVYhGAcYaYt7vsHNIvQV+WXMvnow5cgjPphq5CaayLaGsjRdSCKZFNGt7/GYAuXaNOiYCA==",
-      "dev": true,
-      "peer": true
-    },
-    "through": {
-      "version": "2.3.8",
-      "integrity": "sha1-DdTJ/6q8NXlgsbckEV1+Doai4fU=",
-      "dev": true
-    },
-    "tiny-glob": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/tiny-glob/-/tiny-glob-0.2.9.tgz",
-      "integrity": "sha512-g/55ssRPUjShh+xkfx9UPDXqhckHEsHr4Vd9zX55oSdGZc/MD0m3sferOkwWtp98bv+kcVfEHtRJgBVJzelrzg==",
-      "dev": true,
-      "requires": {
-        "globalyzer": "0.1.0",
-        "globrex": "^0.1.2"
-      }
-    },
-    "tlds": {
-      "version": "1.224.0",
-      "integrity": "sha512-Jgdc8SEijbDFUsmCn6Wk/f7E6jBLFZOG3U1xK0amGSfEH55Xx97ItUS/d2NngsuApjn11UeWCWj8Um3VRhseZQ==",
-      "dev": true
-    },
-    "tmp": {
-      "version": "0.0.33",
-      "integrity": "sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==",
-      "dev": true,
-      "requires": {
-        "os-tmpdir": "~1.0.2"
-      }
-    },
-    "tmpl": {
-      "version": "1.0.5",
-      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
-      "dev": true,
-      "peer": true
-    },
-    "to-fast-properties": {
-      "version": "2.0.0",
-      "integrity": "sha1-3F5pjL0HkmW8c+A3doGk5Og/YW4=",
-      "dev": true
-    },
-    "to-object-path": {
-      "version": "0.3.0",
-      "integrity": "sha1-KXWIt7Dn4KwI4E5nL4XB9JmeF68=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "kind-of": "^3.0.2"
-      },
-      "dependencies": {
-        "is-buffer": {
-          "version": "1.1.6",
-          "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-          "dev": true,
-          "peer": true
-        },
-        "kind-of": {
-          "version": "3.2.2",
-          "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
-    },
-    "to-regex": {
-      "version": "3.0.2",
-      "integrity": "sha512-FWtleNAtZ/Ki2qtqej2CXTOayOH9bHDQF+Q48VpWyDXjbYxA4Yz8iDB31zXOBUlOHHKidDbqGVrTUvQMPmBGBw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "define-property": "^2.0.2",
-        "extend-shallow": "^3.0.2",
-        "regex-not": "^1.0.2",
-        "safe-regex": "^1.1.0"
-      },
-      "dependencies": {
-        "extend-shallow": {
-          "version": "3.0.2",
-          "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "assign-symbols": "^1.0.0",
-            "is-extendable": "^1.0.1"
-          }
-        },
-        "is-extendable": {
-          "version": "1.0.1",
-          "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "is-plain-object": "^2.0.4"
-          }
-        }
-      }
-    },
-    "to-regex-range": {
-      "version": "5.0.1",
-      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
-      "dev": true,
-      "requires": {
-        "is-number": "^7.0.0"
-      }
-    },
-    "tough-cookie": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.3.tgz",
-      "integrity": "sha512-aX/y5pVRkfRnfmuX+OdbSdXvPe6ieKX/G2s7e98f4poJHnqH3281gDPm/metm6E/WRamfx7WC4HUqkWHfQHprw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "psl": "^1.1.33",
-        "punycode": "^2.1.1",
-        "universalify": "^0.2.0",
-        "url-parse": "^1.5.3"
-      },
-      "dependencies": {
-        "punycode": {
-          "version": "2.1.1",
-          "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
-          "dev": true,
-          "peer": true
-        },
-        "universalify": {
-          "version": "0.2.0",
-          "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.2.0.tgz",
-          "integrity": "sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "tr46": {
-      "version": "2.1.0",
-      "integrity": "sha512-15Ih7phfcdP5YxqiB+iDtLoaTz4Nd35+IiAv0kQ5FNKHzXgdWqPoTIqEDDJmXceQt4JZk6lVPT8lnDlPpGDppw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "punycode": "^2.1.1"
-      },
-      "dependencies": {
-        "punycode": {
-          "version": "2.1.1",
-          "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "trim": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/trim/-/trim-0.0.1.tgz",
-      "integrity": "sha512-YzQV+TZg4AxpKxaTHK3c3D+kRDCGVEE7LemdlQZoQXn0iennk10RsIoY6ikzAqJTc9Xjl9C1/waHom/J86ziAQ==",
-      "dev": true
-    },
-    "trim-trailing-lines": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/trim-trailing-lines/-/trim-trailing-lines-1.1.4.tgz",
-      "integrity": "sha512-rjUWSqnfTNrjbB9NQWfPMH/xRK1deHeGsHoVfpxJ++XeYXE0d6B1En37AHfw3jtfTU7dzMzZL2jjpe8Qb5gLIQ==",
-      "dev": true
-    },
-    "trough": {
-      "version": "1.0.5",
-      "integrity": "sha512-rvuRbTarPXmMb79SmzEp8aqXNKcK+y0XaB298IXueQ8I2PsrATcPBCSPyK/dDNa2iWOhKlfNnOjdAOTBU/nkFA==",
-      "dev": true
-    },
-    "ts-jest": {
-      "version": "26.5.6",
-      "integrity": "sha512-rua+rCP8DxpA8b4DQD/6X2HQS8Zy/xzViVYfEs2OQu68tkCuKLV0Md8pmX55+W24uRIyAsf/BajRfxOs+R2MKA==",
-      "dev": true,
-      "requires": {
-        "bs-logger": "0.x",
-        "buffer-from": "1.x",
-        "fast-json-stable-stringify": "2.x",
-        "jest-util": "^26.1.0",
-        "json5": "2.x",
-        "lodash": "4.x",
-        "make-error": "1.x",
-        "mkdirp": "1.x",
-        "semver": "7.x",
-        "yargs-parser": "20.x"
-      },
-      "dependencies": {
-        "mkdirp": {
-          "version": "1.0.4",
-          "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
-          "dev": true
-        }
-      }
-    },
-    "tsconfig-paths": {
-      "version": "3.14.1",
-      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.14.1.tgz",
-      "integrity": "sha512-fxDhWnFSLt3VuTwtvJt5fpwxBHg5AdKWMsgcPOOIilyjymcYVZoCQF8fvFRezCNfblEXmi+PcM1eYHeOAgXCOQ==",
-      "dev": true,
-      "requires": {
-        "@types/json5": "^0.0.29",
-        "json5": "^1.0.1",
-        "minimist": "^1.2.6",
-        "strip-bom": "^3.0.0"
-      },
-      "dependencies": {
-        "json5": {
-          "version": "1.0.2",
-          "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
-          "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
-          "dev": true,
-          "requires": {
-            "minimist": "^1.2.0"
-          }
-        },
-        "strip-bom": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
-          "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
-          "dev": true
-        }
-      }
-    },
-    "tslib": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.4.0.tgz",
-      "integrity": "sha512-d6xOpEDfsi2CZVlPQzGeux8XMwLT9hssAsaPYExaQMuYskwb+x1x7J371tWlbBdWHroy99KnVB6qIkUbs5X3UQ==",
-      "dev": true
-    },
-    "tsutils": {
-      "version": "3.21.0",
-      "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-3.21.0.tgz",
-      "integrity": "sha512-mHKK3iUXL+3UF6xL5k0PEhKRUBKPBCv/+RkEOpjRWxxx27KKRBmmA60A9pgOUvMi8GKhRMPEmjBRPzs2W7O1OA==",
-      "dev": true,
-      "requires": {
-        "tslib": "^1.8.1"
-      },
-      "dependencies": {
-        "tslib": {
-          "version": "1.14.1",
-          "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
-          "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
-          "dev": true
-        }
-      }
-    },
-    "type-check": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
-      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
-      "dev": true,
-      "requires": {
-        "prelude-ls": "^1.2.1"
-      }
-    },
-    "type-detect": {
-      "version": "4.0.8",
-      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
-      "dev": true,
-      "peer": true
-    },
-    "type-fest": {
-      "version": "0.21.3",
-      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
-      "dev": true
-    },
-    "typed-array-length": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/typed-array-length/-/typed-array-length-1.0.4.tgz",
-      "integrity": "sha512-KjZypGq+I/H7HI5HlOoGHkWUUGq+Q0TPhQurLbyrVrvnKTBgzLhIJ7j6J/XTQOi0d1RjyZ0wdas8bKs2p0x3Ng==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "is-typed-array": "^1.1.9"
-      }
-    },
-    "typedarray-to-buffer": {
-      "version": "3.1.5",
-      "integrity": "sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==",
-      "dev": true,
-      "requires": {
-        "is-typedarray": "^1.0.0"
-      }
-    },
-    "typescript": {
-      "version": "4.4.3",
-      "integrity": "sha512-4xfscpisVgqqDfPaJo5vkd+Qd/ItkoagnHpufr+i2QCHBsNYp+G7UAoyFl8aPtx879u38wPV65rZ8qbGZijalA==",
-      "dev": true,
-      "peer": true
-    },
-    "unbox-primitive": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.0.2.tgz",
-      "integrity": "sha512-61pPlCD9h51VoreyJ0BReideM3MDKMKnh6+V9L08331ipq6Q8OFXZYiqP6n/tbHx4s5I9uRhcye6BrbkizkBDw==",
-      "dev": true,
-      "requires": {
-        "call-bind": "^1.0.2",
-        "has-bigints": "^1.0.2",
-        "has-symbols": "^1.0.3",
-        "which-boxed-primitive": "^1.0.2"
-      }
-    },
-    "unherit": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/unherit/-/unherit-1.1.3.tgz",
-      "integrity": "sha512-Ft16BJcnapDKp0+J/rqFC3Rrk6Y/Ng4nzsC028k2jdDII/rdZ7Wd3pPT/6+vIIxRagwRc9K0IUX0Ra4fKvw+WQ==",
-      "dev": true,
-      "requires": {
-        "inherits": "^2.0.0",
-        "xtend": "^4.0.0"
-      }
-    },
-    "unified": {
-      "version": "9.2.0",
-      "integrity": "sha512-vx2Z0vY+a3YoTj8+pttM3tiJHCwY5UFbYdiWrwBEbHmK8pvsPj2rtAX2BFfgXen8T39CJWblWRDT4L5WGXtDdg==",
-      "dev": true,
-      "requires": {
-        "bail": "^1.0.0",
-        "extend": "^3.0.0",
-        "is-buffer": "^2.0.0",
-        "is-plain-obj": "^2.0.0",
-        "trough": "^1.0.0",
-        "vfile": "^4.0.0"
-      },
-      "dependencies": {
-        "is-plain-obj": {
-          "version": "2.1.0",
-          "integrity": "sha512-YWnfyRwxL/+SsrWYfOpUtz5b3YD+nyfkHvjbcanzk8zgyO4ASD67uVMRt8k5bM4lLMDnXfriRhOpemw+NfT1eA==",
-          "dev": true
-        }
-      }
-    },
-    "unified-lint-rule": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/unified-lint-rule/-/unified-lint-rule-2.1.1.tgz",
-      "integrity": "sha512-vsLHyLZFstqtGse2gvrGwasOmH8M2y+r2kQMoDSWzSqUkQx2MjHjvZuGSv5FUaiv4RQO1bHRajy7lSGp7XWq5A==",
-      "dev": true,
-      "requires": {
-        "@types/unist": "^2.0.0",
-        "trough": "^2.0.0",
-        "unified": "^10.0.0",
-        "vfile": "^5.0.0"
-      },
-      "dependencies": {
-        "bail": {
-          "version": "2.0.2",
-          "resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz",
-          "integrity": "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==",
-          "dev": true
-        },
-        "is-plain-obj": {
-          "version": "4.1.0",
-          "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
-          "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
-          "dev": true
-        },
-        "trough": {
-          "version": "2.1.0",
-          "resolved": "https://registry.npmjs.org/trough/-/trough-2.1.0.tgz",
-          "integrity": "sha512-AqTiAOLcj85xS7vQ8QkAV41hPDIJ71XJB4RCUrzo/1GM2CQwhkJGaf9Hgr7BOugMRpgGUrqRg/DrBDl4H40+8g==",
-          "dev": true
-        },
-        "unified": {
-          "version": "10.1.2",
-          "resolved": "https://registry.npmjs.org/unified/-/unified-10.1.2.tgz",
-          "integrity": "sha512-pUSWAi/RAnVy1Pif2kAoeWNBa3JVrx0MId2LASj8G+7AiHWoKZNTomq6LG326T68U7/e263X6fTdcXIy7XnF7Q==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "bail": "^2.0.0",
-            "extend": "^3.0.0",
-            "is-buffer": "^2.0.0",
-            "is-plain-obj": "^4.0.0",
-            "trough": "^2.0.0",
-            "vfile": "^5.0.0"
-          }
-        },
-        "unist-util-stringify-position": {
-          "version": "3.0.3",
-          "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-          "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0"
-          }
-        },
-        "vfile": {
-          "version": "5.3.7",
-          "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-          "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "is-buffer": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0",
-            "vfile-message": "^3.0.0"
-          }
-        },
-        "vfile-message": {
-          "version": "3.1.4",
-          "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-          "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0"
-          }
-        }
-      }
-    },
-    "union-value": {
-      "version": "1.0.1",
-      "integrity": "sha512-tJfXmxMeWYnczCVs7XAEvIV7ieppALdyepWMkHkwciRpZraG/xwT+s2JN8+pr1+8jCRf80FFzvr+MpQeeoF4Xg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "arr-union": "^3.1.0",
-        "get-value": "^2.0.6",
-        "is-extendable": "^0.1.1",
-        "set-value": "^2.0.1"
-      }
-    },
-    "unist-util-find-all-after": {
-      "version": "3.0.2",
-      "integrity": "sha512-xaTC/AGZ0rIM2gM28YVRAFPIZpzbpDtU3dRmp7EXlNVA8ziQc4hY3H7BHXM1J49nEmiqc3svnqMReW+PGqbZKQ==",
-      "dev": true,
-      "requires": {
-        "unist-util-is": "^4.0.0"
-      }
-    },
-    "unist-util-is": {
-      "version": "4.1.0",
-      "integrity": "sha512-ZOQSsnce92GrxSqlnEEseX0gi7GH9zTJZ0p9dtu87WRb/37mMPO2Ilx1s/t9vBHrFhbgweUwb+t7cIn5dxPhZg==",
-      "dev": true
-    },
-    "unist-util-remove-position": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/unist-util-remove-position/-/unist-util-remove-position-2.0.1.tgz",
-      "integrity": "sha512-fDZsLYIe2uT+oGFnuZmy73K6ZxOPG/Qcm+w7jbEjaFcJgbQ6cqjs/eSPzXhsmGpAsWPkqZM9pYjww5QTn3LHMA==",
-      "dev": true,
-      "requires": {
-        "unist-util-visit": "^2.0.0"
-      },
-      "dependencies": {
-        "unist-util-visit": {
-          "version": "2.0.3",
-          "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-2.0.3.tgz",
-          "integrity": "sha512-iJ4/RczbJMkD0712mGktuGpm/U4By4FfDonL7N/9tATGIF4imikjOuagyMY53tnZq3NP6BcmlrHhEKAfGWjh7Q==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-is": "^4.0.0",
-            "unist-util-visit-parents": "^3.0.0"
-          }
-        },
-        "unist-util-visit-parents": {
-          "version": "3.1.1",
-          "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-3.1.1.tgz",
-          "integrity": "sha512-1KROIZWo6bcMrZEwiH2UrXDyalAa0uqzWCxCJj6lPOvTve2WkfgCytoDTPaMnodXh1WrXOq0haVYHj99ynJlsg==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-is": "^4.0.0"
-          }
-        }
-      }
-    },
-    "unist-util-stringify-position": {
-      "version": "2.0.3",
-      "integrity": "sha512-3faScn5I+hy9VleOq/qNbAd6pAx7iH5jYBMS9I1HgQVijz/4mv5Bvw5iw1sC/90CODiKo81G/ps8AJrISn687g==",
-      "dev": true,
-      "requires": {
-        "@types/unist": "^2.0.2"
-      }
-    },
-    "unist-util-visit": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-4.1.2.tgz",
-      "integrity": "sha512-MSd8OUGISqHdVvfY9TPhyK2VdUrPgxkUtWSuMHF6XAAFuL4LokseigBnZtPnJMu+FbynTkFNnFlyjxpVKujMRg==",
-      "dev": true,
-      "requires": {
-        "@types/unist": "^2.0.0",
-        "unist-util-is": "^5.0.0",
-        "unist-util-visit-parents": "^5.1.1"
-      },
-      "dependencies": {
-        "unist-util-is": {
-          "version": "5.2.0",
-          "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-5.2.0.tgz",
-          "integrity": "sha512-Glt17jWwZeyqrFqOK0pF1Ded5U3yzJnFr8CG1GMjCWTp9zDo2p+cmD6pWbZU8AgM5WU3IzRv6+rBwhzsGh6hBQ==",
-          "dev": true
-        }
-      }
-    },
-    "unist-util-visit-parents": {
-      "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-5.1.3.tgz",
-      "integrity": "sha512-x6+y8g7wWMyQhL1iZfhIPhDAs7Xwbn9nRosDXl7qoPTSCy0yNxnKc+hWokFifWQIDGi154rdUqKvbCa4+1kLhg==",
-      "dev": true,
-      "requires": {
-        "@types/unist": "^2.0.0",
-        "unist-util-is": "^5.0.0"
-      },
-      "dependencies": {
-        "unist-util-is": {
-          "version": "5.2.0",
-          "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-5.2.0.tgz",
-          "integrity": "sha512-Glt17jWwZeyqrFqOK0pF1Ded5U3yzJnFr8CG1GMjCWTp9zDo2p+cmD6pWbZU8AgM5WU3IzRv6+rBwhzsGh6hBQ==",
-          "dev": true
-        }
-      }
-    },
-    "universalify": {
-      "version": "1.0.0",
-      "integrity": "sha512-rb6X1W158d7pRQBg5gkR8uPaSfiids68LTJQYOtEUhoJUWBdaQHsuT/EUduxXYxcrt4r5PJ4fuHW1MHT6p0qug==",
-      "dev": true
-    },
-    "unset-value": {
-      "version": "1.0.0",
-      "integrity": "sha1-g3aHP30jNRef+x5vw6jtDfyKtVk=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "has-value": "^0.3.1",
-        "isobject": "^3.0.0"
-      },
-      "dependencies": {
-        "has-value": {
-          "version": "0.3.1",
-          "integrity": "sha1-ex9YutpiyoJ+wKIHgCVlSEWZXh8=",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "get-value": "^2.0.3",
-            "has-values": "^0.1.4",
-            "isobject": "^2.0.0"
-          },
-          "dependencies": {
-            "isobject": {
-              "version": "2.1.0",
-              "integrity": "sha1-8GVWEJaj8dou9GJy+BXIQNh+DIk=",
-              "dev": true,
-              "peer": true,
-              "requires": {
-                "isarray": "1.0.0"
-              }
-            }
-          }
-        },
-        "has-values": {
-          "version": "0.1.4",
-          "integrity": "sha1-bWHeldkd/Km5oCCJrThL/49it3E=",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "uri-js": {
-      "version": "4.4.1",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
-      "dev": true,
-      "requires": {
-        "punycode": "^2.1.0"
-      },
-      "dependencies": {
-        "punycode": {
-          "version": "2.1.1",
-          "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
-          "dev": true
-        }
-      }
-    },
-    "urix": {
-      "version": "0.1.0",
-      "integrity": "sha1-2pN/emLiH+wf0Y1Js1wpNQZ6bHI=",
-      "dev": true,
-      "peer": true
-    },
-    "url-parse": {
-      "version": "1.5.10",
-      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
-      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "querystringify": "^2.1.1",
-        "requires-port": "^1.0.0"
-      }
-    },
-    "url-regex": {
-      "version": "5.0.0",
-      "integrity": "sha512-O08GjTiAFNsSlrUWfqF1jH0H1W3m35ZyadHrGv5krdnmPPoxP27oDTqux/579PtaroiSGm5yma6KT1mHFH6Y/g==",
-      "dev": true,
-      "requires": {
-        "ip-regex": "^4.1.0",
-        "tlds": "^1.203.0"
-      }
-    },
-    "use": {
-      "version": "3.1.1",
-      "integrity": "sha512-cwESVXlO3url9YWlFW/TA9cshCEhtu7IKJ/p5soJ/gGpj7vbvFrAY/eIioQ6Dw23KjZhYgiIo8HOs1nQ2vr/oQ==",
-      "dev": true,
-      "peer": true
-    },
-    "util-deprecate": {
-      "version": "1.0.2",
-      "integrity": "sha1-RQ1Nyfpw3nMnYvvS1KKJgUGaDM8=",
-      "dev": true
-    },
-    "uuid": {
-      "version": "8.3.2",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "dev": true,
-      "optional": true,
-      "peer": true
-    },
-    "v8-compile-cache": {
-      "version": "2.3.0",
-      "integrity": "sha512-l8lCEmLcLYZh4nbunNZvQCJc5pv7+RCwa8q/LdUx8u7lsWvPDKmpodJAJNwkAhJC//dFY48KuIEmjtd4RViDrA==",
-      "dev": true
-    },
-    "v8-to-istanbul": {
-      "version": "7.1.2",
-      "integrity": "sha512-TxNb7YEUwkLXCQYeudi6lgQ/SZrzNO4kMdlqVxaZPUIUjCv6iSSypUQX70kNBSERpQ8fk48+d61FXk+tgqcWow==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "@types/istanbul-lib-coverage": "^2.0.1",
-        "convert-source-map": "^1.6.0",
-        "source-map": "^0.7.3"
-      },
-      "dependencies": {
-        "source-map": {
-          "version": "0.7.3",
-          "integrity": "sha512-CkCj6giN3S+n9qrYiBTX5gystlENnRW5jZeNLHpe6aue+SrHcG5VYwujhW9s4dY31mEGsxBDrHR6oI69fTXsaQ==",
-          "dev": true,
-          "peer": true
-        }
-      }
-    },
-    "validate-npm-package-license": {
-      "version": "3.0.4",
-      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
-      "dev": true,
-      "requires": {
-        "spdx-correct": "^3.0.0",
-        "spdx-expression-parse": "^3.0.0"
-      }
-    },
-    "vfile": {
-      "version": "4.2.1",
-      "integrity": "sha512-O6AE4OskCG5S1emQ/4gl8zK586RqA3srz3nfK/Viy0UPToBc5Trp9BVFb1u0CjsKrAWwnpr4ifM/KBXPWwJbCA==",
-      "dev": true,
-      "requires": {
-        "@types/unist": "^2.0.0",
-        "is-buffer": "^2.0.0",
-        "unist-util-stringify-position": "^2.0.0",
-        "vfile-message": "^2.0.0"
-      }
-    },
-    "vfile-location": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/vfile-location/-/vfile-location-3.2.0.tgz",
-      "integrity": "sha512-aLEIZKv/oxuCDZ8lkJGhuhztf/BW4M+iHdCwglA/eWc+vtuRFJj8EtgceYFX4LRjOhCAAiNHsKGssC6onJ+jbA==",
-      "dev": true
-    },
-    "vfile-matter": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/vfile-matter/-/vfile-matter-4.0.1.tgz",
-      "integrity": "sha512-ZeACdaxCOxhePpoLO4A5y/VgI9EuWBXu+sUk65aQ7lXBZDFg7X0tuOzigLJUtsQzazFt6K2m9SdlDxZdfL5vVg==",
-      "dev": true,
-      "requires": {
-        "is-buffer": "^2.0.0",
-        "vfile": "^5.0.0",
-        "yaml": "^2.0.0"
-      },
-      "dependencies": {
-        "unist-util-stringify-position": {
-          "version": "3.0.3",
-          "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-          "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0"
-          }
-        },
-        "vfile": {
-          "version": "5.3.7",
-          "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-          "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "is-buffer": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0",
-            "vfile-message": "^3.0.0"
-          }
-        },
-        "vfile-message": {
-          "version": "3.1.4",
-          "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-          "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0"
-          }
-        },
-        "yaml": {
-          "version": "2.2.1",
-          "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.1.tgz",
-          "integrity": "sha512-e0WHiYql7+9wr4cWMx3TVQrNwejKaEe7/rHNmQmqRjazfOP5W8PB6Jpebb5o6fIapbz9o9+2ipcaTM2ZwDI6lw==",
-          "dev": true
-        }
-      }
-    },
-    "vfile-message": {
-      "version": "2.0.4",
-      "integrity": "sha512-DjssxRGkMvifUOJre00juHoP9DPWuzjxKuMDrhNbk2TdaYYBNMStsNhEOt3idrtI12VQYM/1+iM0KOzXi4pxwQ==",
-      "dev": true,
-      "requires": {
-        "@types/unist": "^2.0.0",
-        "unist-util-stringify-position": "^2.0.0"
-      }
-    },
-    "vfile-reporter": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/vfile-reporter/-/vfile-reporter-7.0.5.tgz",
-      "integrity": "sha512-NdWWXkv6gcd7AZMvDomlQbK3MqFWL1RlGzMn++/O2TI+68+nqxCPTvLugdOtfSzXmjh+xUyhp07HhlrbJjT+mw==",
-      "dev": true,
-      "requires": {
-        "@types/supports-color": "^8.0.0",
-        "string-width": "^5.0.0",
-        "supports-color": "^9.0.0",
-        "unist-util-stringify-position": "^3.0.0",
-        "vfile": "^5.0.0",
-        "vfile-message": "^3.0.0",
-        "vfile-sort": "^3.0.0",
-        "vfile-statistics": "^2.0.0"
-      },
-      "dependencies": {
-        "ansi-regex": {
-          "version": "6.0.1",
-          "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.1.tgz",
-          "integrity": "sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA==",
-          "dev": true
-        },
-        "string-width": {
-          "version": "5.1.2",
-          "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-          "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
-          "dev": true,
-          "requires": {
-            "eastasianwidth": "^0.2.0",
-            "emoji-regex": "^9.2.2",
-            "strip-ansi": "^7.0.1"
-          }
-        },
-        "strip-ansi": {
-          "version": "7.0.1",
-          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.0.1.tgz",
-          "integrity": "sha512-cXNxvT8dFNRVfhVME3JAe98mkXDYN2O1l7jmcwMnOslDeESg1rF/OZMtK0nRAhiari1unG5cD4jG3rapUAkLbw==",
-          "dev": true,
-          "requires": {
-            "ansi-regex": "^6.0.1"
-          }
-        },
-        "supports-color": {
-          "version": "9.3.1",
-          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-9.3.1.tgz",
-          "integrity": "sha512-knBY82pjmnIzK3NifMo3RxEIRD9E0kIzV4BKcyTZ9+9kWgLMxd4PrsTSMoFQUabgRBbF8KOLRDCyKgNV+iK44Q==",
-          "dev": true
-        },
-        "unist-util-stringify-position": {
-          "version": "3.0.3",
-          "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-          "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0"
-          }
-        },
-        "vfile": {
-          "version": "5.3.7",
-          "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-          "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "is-buffer": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0",
-            "vfile-message": "^3.0.0"
-          }
-        },
-        "vfile-message": {
-          "version": "3.1.4",
-          "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-          "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0"
-          }
-        }
-      }
-    },
-    "vfile-reporter-json": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/vfile-reporter-json/-/vfile-reporter-json-3.3.0.tgz",
-      "integrity": "sha512-/zgRtjxQ2UGJn+HViiZ7+nIXtUzkkXFQum3BmaS/bSyr10P0X41ETRqqwMJ95RtbKUah3m7pKb6oS1eZeXXHzQ==",
-      "dev": true,
-      "requires": {
-        "vfile": "^5.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "dependencies": {
-        "unist-util-stringify-position": {
-          "version": "3.0.3",
-          "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-          "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0"
-          }
-        },
-        "vfile": {
-          "version": "5.3.7",
-          "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-          "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "is-buffer": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0",
-            "vfile-message": "^3.0.0"
-          }
-        },
-        "vfile-message": {
-          "version": "3.1.4",
-          "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-          "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0"
-          }
-        }
-      }
-    },
-    "vfile-sort": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/vfile-sort/-/vfile-sort-3.0.1.tgz",
-      "integrity": "sha512-1os1733XY6y0D5x0ugqSeaVJm9lYgj0j5qdcZQFyxlZOSy1jYarL77lLyb5gK4Wqr1d5OxmuyflSO3zKyFnTFw==",
-      "dev": true,
-      "requires": {
-        "vfile": "^5.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "dependencies": {
-        "unist-util-stringify-position": {
-          "version": "3.0.3",
-          "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-          "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0"
-          }
-        },
-        "vfile": {
-          "version": "5.3.7",
-          "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-          "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "is-buffer": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0",
-            "vfile-message": "^3.0.0"
-          }
-        },
-        "vfile-message": {
-          "version": "3.1.4",
-          "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-          "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0"
-          }
-        }
-      }
-    },
-    "vfile-statistics": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/vfile-statistics/-/vfile-statistics-2.0.1.tgz",
-      "integrity": "sha512-W6dkECZmP32EG/l+dp2jCLdYzmnDBIw6jwiLZSER81oR5AHRcVqL+k3Z+pfH1R73le6ayDkJRMk0sutj1bMVeg==",
-      "dev": true,
-      "requires": {
-        "vfile": "^5.0.0",
-        "vfile-message": "^3.0.0"
-      },
-      "dependencies": {
-        "unist-util-stringify-position": {
-          "version": "3.0.3",
-          "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-3.0.3.tgz",
-          "integrity": "sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0"
-          }
-        },
-        "vfile": {
-          "version": "5.3.7",
-          "resolved": "https://registry.npmjs.org/vfile/-/vfile-5.3.7.tgz",
-          "integrity": "sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "is-buffer": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0",
-            "vfile-message": "^3.0.0"
-          }
-        },
-        "vfile-message": {
-          "version": "3.1.4",
-          "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-3.1.4.tgz",
-          "integrity": "sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==",
-          "dev": true,
-          "requires": {
-            "@types/unist": "^2.0.0",
-            "unist-util-stringify-position": "^3.0.0"
-          }
-        }
-      }
-    },
-    "w3c-hr-time": {
-      "version": "1.0.2",
-      "integrity": "sha512-z8P5DvDNjKDoFIHK7q8r8lackT6l+jo/Ye3HOle7l9nICP9lf1Ci25fy9vHd0JOWewkIFzXIEig3TdKT7JQ5fQ==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "browser-process-hrtime": "^1.0.0"
-      }
-    },
-    "w3c-xmlserializer": {
-      "version": "2.0.0",
-      "integrity": "sha512-4tzD0mF8iSiMiNs30BiLO3EpfGLZUT2MSX/G+o7ZywDzliWQ3OPtTZ0PTC3B3ca1UAf4cJMHB+2Bf56EriJuRA==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "xml-name-validator": "^3.0.0"
-      }
-    },
-    "walker": {
-      "version": "1.0.7",
-      "integrity": "sha1-L3+bj9ENZ3JisYqITijRlhjgKPs=",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "makeerror": "1.0.x"
-      }
-    },
-    "watchpack": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.0.tgz",
-      "integrity": "sha512-Lcvm7MGST/4fup+ifyKi2hjyIAwcdI4HRgtvTpIUxBRhB+RFtUh8XtDOxUfctVCnhVi+QQj49i91OyvzkJl6cg==",
-      "dev": true,
-      "requires": {
-        "glob-to-regexp": "^0.4.1",
-        "graceful-fs": "^4.1.2"
-      }
-    },
-    "webidl-conversions": {
-      "version": "6.1.0",
-      "integrity": "sha512-qBIvFLGiBpLjfwmYAaHPXsn+ho5xZnGvyGvsarywGNc8VyQJUMHJ8OBKGGrPER0okBeMDaan4mNBlgBROxuI8w==",
-      "dev": true,
-      "peer": true
-    },
-    "whatwg-encoding": {
-      "version": "1.0.5",
-      "integrity": "sha512-b5lim54JOPN9HtzvK9HFXvBma/rnfFeqsic0hSpjtDbVxR3dJKLc+KB4V6GgiGOvl7CY/KNh8rxSo9DKQrnUEw==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "iconv-lite": "0.4.24"
-      }
-    },
-    "whatwg-mimetype": {
-      "version": "2.3.0",
-      "integrity": "sha512-M4yMwr6mAnQz76TbJm914+gPpB/nCwvZbJU28cUD6dR004SAxDLOOSUaB1JDRqLtaOV/vi0IC5lEAGFgrjGv/g==",
-      "dev": true,
-      "peer": true
-    },
-    "whatwg-url": {
-      "version": "8.7.0",
-      "integrity": "sha512-gAojqb/m9Q8a5IV96E3fHJM70AzCkgt4uXYX2O7EmuyOnLrViCQlsEBmF9UQIu3/aeAIp2U17rtbpZWNntQqdg==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "lodash": "^4.7.0",
-        "tr46": "^2.1.0",
-        "webidl-conversions": "^6.1.0"
-      }
-    },
-    "which": {
-      "version": "2.0.2",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "dev": true,
-      "requires": {
-        "isexe": "^2.0.0"
-      }
-    },
-    "which-boxed-primitive": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/which-boxed-primitive/-/which-boxed-primitive-1.0.2.tgz",
-      "integrity": "sha512-bwZdv0AKLpplFY2KZRX6TvyuN7ojjr7lwkg6ml0roIy9YeuSr7JS372qlNW18UQYzgYK9ziGcerWqZOmEn9VNg==",
-      "dev": true,
-      "requires": {
-        "is-bigint": "^1.0.1",
-        "is-boolean-object": "^1.1.0",
-        "is-number-object": "^1.0.4",
-        "is-string": "^1.0.5",
-        "is-symbol": "^1.0.3"
-      }
-    },
-    "which-collection": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/which-collection/-/which-collection-1.0.1.tgz",
-      "integrity": "sha512-W8xeTUwaln8i3K/cY1nGXzdnVZlidBcagyNFtBdD5kxnb4TvGKR7FfSIS3mYpwWS1QUCutfKz8IY8RjftB0+1A==",
-      "dev": true,
-      "requires": {
-        "is-map": "^2.0.1",
-        "is-set": "^2.0.1",
-        "is-weakmap": "^2.0.1",
-        "is-weakset": "^2.0.1"
-      }
-    },
-    "which-module": {
-      "version": "2.0.0",
-      "integrity": "sha1-2e8H3Od7mQK4o6j6SzHD4/fm6Ho=",
-      "dev": true,
-      "peer": true
-    },
-    "which-typed-array": {
-      "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.9.tgz",
-      "integrity": "sha512-w9c4xkx6mPidwp7180ckYWfMmvxpjlZuIudNtDf4N/tTAUB8VJbX25qZoAsrtGuYNnGw3pa0AXgbGKRB8/EceA==",
-      "dev": true,
-      "requires": {
-        "available-typed-arrays": "^1.0.5",
-        "call-bind": "^1.0.2",
-        "for-each": "^0.3.3",
-        "gopd": "^1.0.1",
-        "has-tostringtag": "^1.0.0",
-        "is-typed-array": "^1.1.10"
-      }
-    },
-    "word-wrap": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.4.tgz",
-      "integrity": "sha512-2V81OA4ugVo5pRo46hAoD2ivUJx8jXmWXfUkY4KFNw0hEptvN0QfH3K4nHiwzGeKl5rFKedV48QVoqYavy4YpA==",
-      "dev": true
-    },
-    "wrap-ansi": {
-      "version": "7.0.0",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "dev": true,
-      "requires": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      }
-    },
-    "wrappy": {
-      "version": "1.0.2",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
-      "dev": true
-    },
-    "write-file-atomic": {
-      "version": "3.0.3",
-      "integrity": "sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==",
-      "dev": true,
-      "requires": {
-        "imurmurhash": "^0.1.4",
-        "is-typedarray": "^1.0.0",
-        "signal-exit": "^3.0.2",
-        "typedarray-to-buffer": "^3.1.5"
-      }
-    },
-    "ws": {
-      "version": "7.5.5",
-      "integrity": "sha512-BAkMFcAzl8as1G/hArkxOxq3G7pjUqQ3gzYbLL0/5zNkph70e+lCoxBGnm6AW1+/aiNeV4fnKqZ8m4GZewmH2w==",
-      "dev": true,
-      "peer": true,
-      "requires": {}
-    },
-    "xml-name-validator": {
-      "version": "3.0.0",
-      "integrity": "sha512-A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==",
-      "dev": true,
-      "peer": true
-    },
-    "xmlchars": {
-      "version": "2.2.0",
-      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
-      "dev": true,
-      "peer": true
-    },
-    "xtend": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
-      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
-      "dev": true
-    },
-    "y18n": {
-      "version": "4.0.3",
-      "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==",
-      "dev": true,
-      "peer": true
-    },
-    "yallist": {
-      "version": "4.0.0",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
-      "dev": true
-    },
-    "yaml": {
-      "version": "1.10.2",
-      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
-      "dev": true
-    },
-    "yargs": {
-      "version": "15.4.1",
-      "integrity": "sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==",
-      "dev": true,
-      "peer": true,
-      "requires": {
-        "cliui": "^6.0.0",
-        "decamelize": "^1.2.0",
-        "find-up": "^4.1.0",
-        "get-caller-file": "^2.0.1",
-        "require-directory": "^2.1.1",
-        "require-main-filename": "^2.0.0",
-        "set-blocking": "^2.0.0",
-        "string-width": "^4.2.0",
-        "which-module": "^2.0.0",
-        "y18n": "^4.0.0",
-        "yargs-parser": "^18.1.2"
-      },
-      "dependencies": {
-        "find-up": {
-          "version": "4.1.0",
-          "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "locate-path": "^5.0.0",
-            "path-exists": "^4.0.0"
-          }
-        },
-        "locate-path": {
-          "version": "5.0.0",
-          "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-locate": "^4.1.0"
-          }
-        },
-        "p-limit": {
-          "version": "2.3.0",
-          "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-try": "^2.0.0"
-          }
-        },
-        "p-locate": {
-          "version": "4.1.0",
-          "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "p-limit": "^2.2.0"
-          }
-        },
-        "path-exists": {
-          "version": "4.0.0",
-          "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-          "dev": true,
-          "peer": true
-        },
-        "yargs-parser": {
-          "version": "18.1.3",
-          "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==",
-          "dev": true,
-          "peer": true,
-          "requires": {
-            "camelcase": "^5.0.0",
-            "decamelize": "^1.2.0"
-          }
-        }
-      }
-    },
-    "yargs-parser": {
-      "version": "20.2.9",
-      "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==",
-      "dev": true
-    },
-    "yocto-queue": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
-      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
-      "dev": true
-    },
-    "zod": {
-      "version": "3.20.6",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.20.6.tgz",
-      "integrity": "sha512-oyu0m54SGCtzh6EClBVqDDlAYRz4jrVtKwQ7ZnsEmMI9HnzuZFj8QFwAY1M5uniIYACdGvv0PBWPF2kO0aNofA==",
-      "dev": true
-    },
-    "zwitch": {
-      "version": "1.0.5",
-      "integrity": "sha512-V50KMwwzqJV0NpZIZFwfOD5/lyny3WlSzRiXgA0G7VUnRlqttta1L6UQIHzd6EuBY/cHGfwTIck7w1yH6Q5zUw==",
-      "dev": true
-    }
-  }
-}
diff --git a/website/package.json b/website/package.json
deleted file mode 100644
index 27c3fa3696f..00000000000
--- a/website/package.json
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "name": "vault-docs",
-  "description": "HashiCorp Vault documentation website",
-  "version": "1.0.0",
-  "author": "HashiCorp",
-  "devDependencies": {
-    "@hashicorp/platform-cli": "^2.6.0",
-    "@hashicorp/platform-content-conformance": "^0.0.9",
-    "dart-linkcheck": "2.0.15",
-    "next": "^14.0.4",
-    "prettier": "2.2.1",
-    "simple-git-hooks": "^2.6.1"
-  },
-  "engines": {
-    "npm": ">=9.6.7",
-    "node": ">=18.17.0 <= 20.x"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/hashicorp/vault",
-    "directory": "website"
-  },
-  "scripts": {
-    "build": "./scripts/website-build.sh",
-    "format": "next-hashicorp format",
-    "generate:component": "next-hashicorp generate component",
-    "generate:readme": "next-hashicorp markdown-blocks README.md",
-    "linkcheck": "linkcheck https://www.vaultproject.io",
-    "lint": "next-hashicorp lint",
-    "postinstall": "simple-git-hooks",
-    "start": "./scripts/website-start.sh",
-    "content-check": "hc-content --config base-docs"
-  },
-  "simple-git-hooks": {
-    "pre-commit": "cd website && ./node_modules/.bin/next-hashicorp precommit"
-  }
-}
diff --git a/website/prettier.config.js b/website/prettier.config.js
deleted file mode 100644
index eaf13ff18c9..00000000000
--- a/website/prettier.config.js
+++ /dev/null
@@ -1,9 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-module.exports = {
-  ...require('@hashicorp/platform-cli/config/prettier.config')
-  /* Specify overrides here */
-}
diff --git a/website/public/docs/enterprise/sealwrap/Vault_Compliance_Letter_signed.pdf b/website/public/docs/enterprise/sealwrap/Vault_Compliance_Letter_signed.pdf
deleted file mode 100755
index a2061dbd612..00000000000
Binary files a/website/public/docs/enterprise/sealwrap/Vault_Compliance_Letter_signed.pdf and /dev/null differ
diff --git a/website/public/files/press-kit.zip b/website/public/files/press-kit.zip
deleted file mode 100644
index f38b1e76cd6..00000000000
Binary files a/website/public/files/press-kit.zip and /dev/null differ
diff --git a/website/public/ie-custom-properties.js b/website/public/ie-custom-properties.js
deleted file mode 100644
index 227315dd060..00000000000
--- a/website/public/ie-custom-properties.js
+++ /dev/null
@@ -1,636 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-/*! ie11CustomProperties.js v2.6.0 | MIT License | https://git.io/fjXMN */
-// c1.onElement helper
-!(function() {
-  'use strict'
-
-  if (!Element.prototype.matches)
-    Element.prototype.matches = Element.prototype.msMatchesSelector
-
-  var w = window
-  if (!w.c1) w.c1 = {}
-  var listeners = [],
-    root = document,
-    Observer
-
-  c1.onElement = function(selector, options /*, disconnectedCallback*/) {
-    if (typeof options === 'function') {
-      options = { parsed: options }
-    }
-    var listener = {
-      selector: selector,
-      immediate: options.immediate,
-      //disconnectedCallback: disconnectedCallback,
-      elements: new WeakMap()
-    }
-
-    if (options.parsed) {
-      listener.parsed = function(el) {
-        requestAnimationFrame(function() {
-          options.parsed(el)
-        })
-      }
-    }
-
-    var els = root.querySelectorAll(listener.selector),
-      i = 0,
-      el
-    while ((el = els[i++])) {
-      listener.elements.set(el, true)
-      listener.parsed && listener.parsed.call(el, el)
-      listener.immediate && listener.immediate.call(el, el)
-    }
-
-    listeners.push(listener)
-    if (!Observer) {
-      Observer = new MutationObserver(checkMutations)
-      Observer.observe(root, {
-        childList: true,
-        subtree: true
-      })
-    }
-    checkListener(listener)
-  }
-  function checkListener(listener, target) {
-    var i = 0,
-      el,
-      els = []
-    target && target.matches(listener.selector) && els.push(target)
-    if (loaded) {
-      // ok? check inside node on innerHTML - only when loaded
-      Array.prototype.push.apply(
-        els,
-        (target || root).querySelectorAll(listener.selector)
-      )
-    }
-    while ((el = els[i++])) {
-      if (listener.elements.has(el)) continue
-      listener.elements.set(el, true)
-      //listener.connectedCallback.call(el, el);
-      listener.parsed && listener.parsed.call(el, el)
-      listener.immediate && listener.immediate.call(el, el)
-    }
-  }
-  function checkListeners(inside) {
-    var i = 0,
-      listener
-    while ((listener = listeners[i++])) checkListener(listener, inside)
-  }
-  function checkMutations(mutations) {
-    var j = 0,
-      i,
-      mutation,
-      nodes,
-      target
-    while ((mutation = mutations[j++])) {
-      ;(nodes = mutation.addedNodes), (i = 0)
-      while ((target = nodes[i++]))
-        target.nodeType === 1 && checkListeners(target)
-    }
-  }
-
-  var loaded = false
-  document.addEventListener('DOMContentLoaded', function() {
-    loaded = true
-  })
-
-  // svg polyfills
-  function copyProperty(prop, from, to) {
-    var desc = Object.getOwnPropertyDescriptor(from, prop)
-    Object.defineProperty(to, prop, desc)
-  }
-  if (!('classList' in Element.prototype)) {
-    copyProperty('classList', HTMLElement.prototype, Element.prototype)
-  }
-  if (!('innerHTML' in Element.prototype)) {
-    copyProperty('innerHTML', HTMLElement.prototype, Element.prototype)
-  }
-  if (!('sheet' in SVGStyleElement.prototype)) {
-    Object.defineProperty(SVGStyleElement.prototype, 'sheet', {
-      get: function() {
-        var all = document.styleSheets
-        for (var i = 0, sheet; (sheet = all[i++]); ) {
-          if (sheet.ownerNode === this) return sheet
-        }
-      }
-    })
-  }
-  // if ('children' in HTMLElement.prototype && !('children' in Element.prototype)) {
-  // 	copyProperty('children', HTMLElement.prototype, Element.prototype);
-  // }
-  // if ('contains' in HTMLElement.prototype && !('contains' in Element.prototype)) {
-  // 	copyProperty('contains', HTMLElement.prototype, Element.prototype);
-  // }
-  // if ('getElementsByClassName' in HTMLElement.prototype && !('getElementsByClassName' in Element.prototype)) {
-  // 	copyProperty('getElementsByClassName', HTMLElement.prototype, Element.prototype);
-  // }
-})()
-
-// main logic
-!(function() {
-  'use strict'
-  var testEl = document.createElement('i')
-  testEl.style.setProperty('--x', 'y')
-  if (testEl.style.getPropertyValue('--x') === 'y' || !testEl.msMatchesSelector)
-    return
-
-  // cached regexps, better performance
-  const regFindSetters = /([\s{;])(--([A-Za-z0-9-_]+\s*:[^;!}{]+)(!important)?)(?=\s*([;}]|$))/g
-  const regFindGetters = /([{;]\s*)([A-Za-z0-9-_]+\s*:[^;}{]*var\([^!;}{]+)(!important)?(?=\s*([;}$]|$))/g
-  const regRuleIEGetters = /-ieVar-([^:]+):/g
-  const regRuleIESetters = /-ie-([^};]+)/g
-  const regHasVar = /var\(/
-  const regPseudos = /:(hover|active|focus|target|:before|:after)/
-
-  c1.onElement('link[rel="stylesheet"]', {
-    immediate: function(el) {
-      fetchCss(el.href, function(css) {
-        var newCss = rewriteCss(css)
-        if (css === newCss) return
-        newCss = relToAbs(el.href, newCss)
-        el.disabled = true
-        var style = document.createElement('style')
-        el.parentNode.insertBefore(style, el)
-        activateStyleElement(style, newCss)
-      })
-    }
-  })
-  c1.onElement('style', {
-    immediate: function(el) {
-      if (el.hasAttribute('ie-polyfilled')) return
-      if (el.ieCP_elementSheet) return
-      var css = el.innerHTML
-      var newCss = rewriteCss(css)
-      if (css === newCss) return
-      activateStyleElement(el, newCss)
-    }
-  })
-  c1.onElement('[ie-style]', {
-    immediate: function(el) {
-      var newCss = rewriteCss('{' + el.getAttribute('ie-style')).substr(1)
-      el.style.cssText += ';' + newCss
-      var found = parseRewrittenStyle(el.style)
-      if (found.getters) addGetterElement(el, found.getters, '%styleAttr')
-      if (found.setters) addSetterElement(el, found.setters)
-    }
-  })
-
-  function relToAbs(base, css) {
-    return css.replace(/url\(([^)]+)\)/g, function($0, $1) {
-      $1 = $1.trim().replace(/(^['"]|['"]$)/g, '')
-      if ($1.match(/^([a-z]+:|\/)/)) return $0
-      base = base.replace(/\?.*/, '')
-      return 'url(' + base + './../' + $1 + ')'
-    })
-  }
-
-  // ie has a bug, where unknown properties at pseudo-selectors are computed at the element
-  // #el::after { -content:'x'; } => getComputedStyle(el)['-content'] == 'x'
-  // should we add something like -ieVar-pseudo_after-content:'x'?
-  function rewriteCss(css) {
-    /* uncomment if spec finished and needed by someone
-  css = css.replace(/@property ([^{]+){([^}]+)}/, function($0, prop, body){
-    prop = prop.trim();
-    const declaration = {name:prop};
-    body.split(';').forEach(function(pair){
-      const x = pair.split(':');
-      if (x[1]) declaration[ x[0].trim() ] = x[1];
-    });
-    declaration['inherits'] = declaration['inherits'].trim()==='true' ? true : false;
-    declaration['initialValue'] = declaration['initial-value'];
-    CSS.registerProperty(declaration)
-    return '/*\n @property ... removed \n*'+'/';
-  });
-  */
-
-    css = css.replace(regFindSetters, function($0, $1, $2, $3, important) {
-      return $1 + '-ie-' + (important ? '❗' : '') + $3
-    }) // !imporant
-    return css.replace(regFindGetters, function($0, $1, $2, important) {
-      return $1 + '-ieVar-' + (important ? '❗' : '') + $2 + '; ' + $2
-    }) // keep the original, so chaining works "--x:var(--y)"
-  }
-
-  // beta
-  //const styles_of_getter_properties = {};
-
-  function parseRewrittenStyle(style) {
-    // less memory then parameter cssText?
-    // beta
-    //style['z-index']; // can access unknown properties in stylesheets only if accessed a dashed known property
-    const cssText = style.cssText
-    var matchesGetters = cssText.match(regRuleIEGetters),
-      j,
-      match
-    if (matchesGetters) {
-      var getters = [] // eg. [border,color]
-      for (j = 0; (match = matchesGetters[j++]); ) {
-        let propName = match.slice(7, -1)
-        if (propName[0] === '❗') propName = propName.substr(1)
-        getters.push(propName)
-        // beta
-        //if (!styles_of_getter_properties[propName]) styles_of_getter_properties[propName] = [];
-        //styles_of_getter_properties[propName].push(style);
-      }
-    }
-    var matchesSetters = cssText.match(regRuleIESetters)
-    if (matchesSetters) {
-      var setters = {} // eg. [--color:#fff, --padding:10px];
-      for (j = 0; (match = matchesSetters[j++]); ) {
-        let x = match.substr(4).split(':')
-        let propName = x[0]
-        let propValue = x[1]
-        if (propName[0] === '❗') propName = propName.substr(1)
-        setters[propName] = propValue
-      }
-    }
-    return { getters: getters, setters: setters }
-  }
-  function activateStyleElement(style, css) {
-    style.innerHTML = css
-    style.setAttribute('ie-polyfilled', true)
-    var rules = style.sheet.rules,
-      i = 0,
-      rule // cssRules = CSSRuleList, rules = MSCSSRuleList
-    while ((rule = rules[i++])) {
-      const found = parseRewrittenStyle(rule.style)
-      if (found.getters) addGettersSelector(rule.selectorText, found.getters)
-      if (found.setters) addSettersSelector(rule.selectorText, found.setters)
-
-      // mediaQueries: redraw the hole document
-      // better add events for each element?
-      const media =
-        rule.parentRule &&
-        rule.parentRule.media &&
-        rule.parentRule.media.mediaText
-      if (media && (found.getters || found.setters)) {
-        matchMedia(media).addListener(function() {
-          drawTree(document.documentElement)
-        })
-      }
-    }
-  }
-
-  function addGettersSelector(selector, properties) {
-    selectorAddPseudoListeners(selector)
-    c1.onElement(unPseudo(selector), function(el) {
-      addGetterElement(el, properties, selector)
-      drawElement(el)
-    })
-  }
-  function addGetterElement(el, properties, selector) {
-    var i = 0,
-      prop,
-      j
-    const selectors = selector.split(',') // split grouped selectors
-    el.setAttribute('iecp-needed', true)
-    if (!el.ieCPSelectors) el.ieCPSelectors = {}
-    while ((prop = properties[i++])) {
-      for (j = 0; (selector = selectors[j++]); ) {
-        const parts = selector.trim().split('::')
-        if (!el.ieCPSelectors[prop]) el.ieCPSelectors[prop] = []
-        el.ieCPSelectors[prop].push({
-          selector: parts[0],
-          pseudo: parts[1] ? '::' + parts[1] : ''
-        })
-      }
-    }
-  }
-  function addSettersSelector(selector, propVals) {
-    selectorAddPseudoListeners(selector)
-    c1.onElement(unPseudo(selector), function(el) {
-      addSetterElement(el, propVals)
-    })
-  }
-  function addSetterElement(el, propVals) {
-    if (!el.ieCP_setters) el.ieCP_setters = {}
-    for (var prop in propVals) {
-      // eg. {foo:#fff, bar:baz}
-      el.ieCP_setters['--' + prop] = 1
-    }
-    drawTree(el)
-  }
-
-  // beta
-  // function redrawStyleSheets() {
-  // 	for (var prop in styles_of_getter_properties) {
-  // 		let styles = styles_of_getter_properties[prop];
-  // 		for (var i=0, style; style=styles[i++];) {
-  // 			if (style.owningElement) continue;
-  // 			var value = style['-ieVar-'+prop];
-  // 			if (!value) continue;
-  // 			var value = styleComputeValueWidthVars(getComputedStyle(document.documentElement), value);
-  // 			style[prop] = value;
-  // 		}
-  // 	}
-  // }
-  // setTimeout(redrawStyleSheets,1000);
-  //setTimeout(redrawStyleSheets,2000);
-
-  const pseudos = {
-    hover: {
-      on: 'mouseenter',
-      off: 'mouseleave'
-    },
-    focus: {
-      on: 'focusin',
-      off: 'focusout'
-    },
-    active: {
-      on: 'CSSActivate',
-      off: 'CSSDeactivate'
-    }
-  }
-  function selectorAddPseudoListeners(selector) {
-    // ie11 has the strange behavoir, that groups of selectors are individual rules, but starting with the full selector:
-    // td, th, button { color:red } results in this rules:
-    // "td, th, button" | "th, th" | "th"
-    selector = selector.split(',')[0]
-    for (var pseudo in pseudos) {
-      var parts = selector.split(':' + pseudo)
-      if (parts.length > 1) {
-        var ending = parts[1].match(/^[^\s]*/) // ending elementpart of selector (used for not(:active))
-        let selector = unPseudo(parts[0] + ending)
-        const listeners = pseudos[pseudo]
-        c1.onElement(selector, function(el) {
-          el.addEventListener(listeners.on, drawTreeEvent)
-          el.addEventListener(listeners.off, drawTreeEvent)
-        })
-      }
-    }
-  }
-  let CSSActive = null
-  document.addEventListener('mousedown', function(e) {
-    setTimeout(function() {
-      if (e.target === document.activeElement) {
-        var evt = document.createEvent('Event')
-        evt.initEvent('CSSActivate', true, true)
-        CSSActive = e.target
-        CSSActive.dispatchEvent(evt)
-      }
-    })
-  })
-  document.addEventListener('mouseup', function() {
-    if (CSSActive) {
-      var evt = document.createEvent('Event')
-      evt.initEvent('CSSDeactivate', true, true)
-      CSSActive.dispatchEvent(evt)
-      CSSActive = null
-    }
-  })
-
-  function unPseudo(selector) {
-    return selector.replace(regPseudos, '').replace(':not()', '')
-  }
-
-  var uniqueCounter = 0
-
-  function _drawElement(el) {
-    // beta
-    // if (el === document.documentElement) redrawStyleSheets();
-
-    if (!el.ieCP_unique) {
-      // use el.uniqueNumber? but needs class for the css-selector => test performance
-      el.ieCP_unique = ++uniqueCounter
-      el.classList.add('iecp-u' + el.ieCP_unique)
-    }
-    var style = getComputedStyle(el)
-    if (el.ieCP_sheet)
-      while (el.ieCP_sheet.rules[0]) el.ieCP_sheet.deleteRule(0)
-    for (var prop in el.ieCPSelectors) {
-      var important = style['-ieVar-❗' + prop]
-      let valueWithVar = important || style['-ieVar-' + prop]
-      if (!valueWithVar) continue // todo, what if '0'
-
-      var value = styleComputeValueWidthVars(style, valueWithVar)
-
-      // beta
-      // var details = {};
-      // details.onpropertyneeded = function(prop){ prop = '-ie-'+prop.substr(2); !done[prop] && drawProp(prop); }
-      // var value = styleComputeValueWidthVars(style, valueWithVar, details);
-      // if (details.allByRoot !== false) continue; // dont have to draw root-properties
-
-      if (important) value += ' !important'
-      for (var i = 0, item; (item = el.ieCPSelectors[prop][i++]); ) {
-        // todo: split and use requestAnimationFrame?
-        if (item.selector === '%styleAttr') {
-          el.style[prop] = value
-        } else {
-          //let selector = item.selector.replace(/>? \.[^ ]+/, ' ', item.selector); // todo: try to equalize specificity
-          let selector = item.selector
-          elementStyleSheet(el).insertRule(
-            selector +
-              '.iecp-u' +
-              el.ieCP_unique +
-              item.pseudo +
-              ' {' +
-              prop +
-              ':' +
-              value +
-              '}',
-            0
-          ) // faster then innerHTML
-        }
-      }
-    }
-  }
-  function elementStyleSheet(el) {
-    if (!el.ieCP_sheet) {
-      var tag = document.createElement('style')
-      tag.ieCP_elementSheet = 1
-      //el.appendChild(tag); // yes! self-closing tags can have style as children, but - if i set innerHTML, the stylesheet is lost
-      document.head.appendChild(tag)
-      el.ieCP_sheet = tag.sheet
-    }
-    return el.ieCP_sheet
-  }
-  function drawTree(target) {
-    if (!target) return
-    var els = target.querySelectorAll('[iecp-needed]')
-    if (target.hasAttribute && target.hasAttribute('iecp-needed'))
-      drawElement(target) // self
-    for (var i = 0, el; (el = els[i++]); ) drawElement(el) // tree
-  }
-  // draw queue
-  let drawQueue = {}
-  let collecting = false
-  let drawing = false
-  function drawElement(el) {
-    drawQueue[el.uniqueNumber] = el
-    if (collecting) return
-    collecting = true
-    requestAnimationFrame(function() {
-      collecting = false
-      drawing = true
-      for (var nr in drawQueue) _drawElement(drawQueue[nr])
-      requestAnimationFrame(function() {
-        // mutationObserver will trigger delayed
-        drawing = false
-      })
-      drawQueue = {}
-    })
-  }
-
-  function drawTreeEvent(e) {
-    drawTree(e.target)
-  }
-
-  const regValueGetters = /var\(([^),]+)(\,(.+))?\)/g
-  function styleComputeValueWidthVars(style, valueWithVar, details) {
-    return valueWithVar.replace(regValueGetters, function(
-      full,
-      variable,
-      x,
-      fallback
-    ) {
-      variable = variable.trim()
-      // beta if (details && details.onpropertyneeded) details.onpropertyneeded(variable)  // draw depending CPs first while drawing the element
-      var pValue = style.getPropertyValue(variable)
-      if (details && style.lastPropertyServedBy !== document.documentElement)
-        details.allByRoot = false
-      if (pValue === '' && fallback !== undefined) pValue = fallback.trim() // fallback
-      return pValue
-    })
-  }
-
-  // mutation listener
-  var observer = new MutationObserver(function(mutations) {
-    if (drawing) return
-    for (var i = 0, mutation; (mutation = mutations[i++]); ) {
-      if (mutation.attributeName === 'ie-polyfilled') continue
-      if (mutation.attributeName === 'iecp-needed') continue
-      // recheck all selectors if it targets new elements?
-      drawTree(mutation.target)
-    }
-  })
-  setTimeout(function() {
-    observer.observe(document, { attributes: true, subtree: true })
-  })
-
-  // :target listener
-  var oldHash = location.hash
-  addEventListener('hashchange', function(e) {
-    var newEl = document.getElementById(location.hash.substr(1))
-    if (newEl) {
-      var oldEl = document.getElementById(oldHash.substr(1))
-      drawTree(newEl)
-      drawTree(oldEl)
-    } else {
-      drawTree(document)
-    }
-    oldHash = location.hash
-  })
-
-  // add owningElement to Element.style
-  var descriptor = Object.getOwnPropertyDescriptor(
-    HTMLElement.prototype,
-    'style'
-  )
-  var styleGetter = descriptor.get
-  descriptor.get = function() {
-    const style = styleGetter.call(this)
-    style.owningElement = this
-    return style
-  }
-  Object.defineProperty(HTMLElement.prototype, 'style', descriptor)
-
-  // add computedFor to computed style-objects
-  var originalGetComputed = getComputedStyle
-  window.getComputedStyle = function(el) {
-    var style = originalGetComputed.apply(this, arguments)
-    style.computedFor = el
-    //style.pseudoElt = pseudoElt; //not needed at the moment
-    return style
-  }
-
-  // getPropertyValue / setProperty hooks
-  const StyleProto = CSSStyleDeclaration.prototype
-
-  const oldGetP = StyleProto.getPropertyValue
-  StyleProto.getPropertyValue = function(property) {
-    this.lastPropertyServedBy = false
-    if (property[0] !== '-' || property[1] !== '-')
-      return oldGetP.apply(this, arguments)
-    const undashed = property.substr(2)
-    const ieProperty = '-ie-' + undashed
-    const iePropertyImportant = '-ie-❗' + undashed
-    let value = this[iePropertyImportant] || this[ieProperty]
-    if (this.computedFor) {
-      // computedStyle
-      if (value !== undefined) {
-        if (regHasVar.test(value)) {
-          value = styleComputeValueWidthVars(this, value)
-        }
-        this.lastPropertyServedBy = this.computedFor
-      } else {
-        if (!register[property] || register[property].inherits) {
-          // inherited
-          //let el = this.pseudoElt ? this.computedFor : this.computedFor.parentNode;
-          let el = this.computedFor.parentNode
-          while (el.nodeType === 1) {
-            // how slower would it be to getComputedStyle for every element, not just with defined ieCP_setters
-            if (el.ieCP_setters && el.ieCP_setters[property]) {
-              // i could make
-              // value = el.nodeType ? getComputedStyle(this.computedFor.parentNode).getPropertyValue(property)
-              // but i fear performance, stupid?
-              var style = getComputedStyle(el)
-              var tmpVal = style[iePropertyImportant] || style[ieProperty]
-              if (tmpVal !== undefined) {
-                value = tmpVal
-                if (regHasVar.test(value)) {
-                  // calculated style from current element not from the element the value was inherited from! (style, value)
-                  value = styleComputeValueWidthVars(this, value)
-                }
-                this.lastPropertyServedBy = el
-                break
-              }
-            }
-            el = el.parentNode
-          }
-        }
-      }
-    }
-    if (value === undefined && register[property])
-      value = register[property].initialValue
-    if (value === undefined) value = ''
-    return value
-  }
-
-  const oldSetP = StyleProto.setProperty
-  StyleProto.setProperty = function(property, value, prio) {
-    if (property[0] !== '-' || property[1] !== '-')
-      return oldSetP.apply(this, arguments)
-    if (this.owningElement) {
-      const el = this.owningElement
-      if (!el.ieCP_setters) el.ieCP_setters = {}
-      el.ieCP_setters[property] = 1
-      drawTree(el)
-    }
-    property = '-ie-' + (prio === 'important' ? '❗' : '') + property.substr(2)
-    this.cssText += '; ' + property + ':' + value + ';'
-    //this[property] = value;
-  }
-
-  if (!window.CSS) window.CSS = {}
-  const register = {}
-  CSS.registerProperty = function(options) {
-    register[options.name] = options
-  }
-
-  // utils
-  function fetchCss(url, callback) {
-    var request = new XMLHttpRequest()
-    request.open('GET', url)
-    request.overrideMimeType('text/css')
-    request.onload = function() {
-      if (request.status >= 200 && request.status < 400) {
-        callback(request.responseText)
-      }
-    }
-    request.send()
-  }
-})()
diff --git a/website/public/img/HCPV_badge.png b/website/public/img/HCPV_badge.png
deleted file mode 100644
index e01cbfedd82..00000000000
Binary files a/website/public/img/HCPV_badge.png and /dev/null differ
diff --git a/website/public/img/VaultEnterprise_badge.png b/website/public/img/VaultEnterprise_badge.png
deleted file mode 100644
index b3cf4e72092..00000000000
Binary files a/website/public/img/VaultEnterprise_badge.png and /dev/null differ
diff --git a/website/public/img/adfs-oidc-ldapgroupoption.png b/website/public/img/adfs-oidc-ldapgroupoption.png
deleted file mode 100644
index 7f7cea73883..00000000000
Binary files a/website/public/img/adfs-oidc-ldapgroupoption.png and /dev/null differ
diff --git a/website/public/img/atlas_workflow.png b/website/public/img/atlas_workflow.png
deleted file mode 100644
index 144e2cedc8d..00000000000
Binary files a/website/public/img/atlas_workflow.png and /dev/null differ
diff --git a/website/public/img/autopilot-automated-upgrade.png b/website/public/img/autopilot-automated-upgrade.png
deleted file mode 100644
index fe2d464f8aa..00000000000
Binary files a/website/public/img/autopilot-automated-upgrade.png and /dev/null differ
diff --git a/website/public/img/bg-icons.png b/website/public/img/bg-icons.png
deleted file mode 100644
index 37904c00b0e..00000000000
Binary files a/website/public/img/bg-icons.png and /dev/null differ
diff --git a/website/public/img/bg-icons@2x.png b/website/public/img/bg-icons@2x.png
deleted file mode 100644
index bc947c608fc..00000000000
Binary files a/website/public/img/bg-icons@2x.png and /dev/null differ
diff --git a/website/public/img/client-counts.jpg b/website/public/img/client-counts.jpg
deleted file mode 100644
index 6c92cfaa4a1..00000000000
Binary files a/website/public/img/client-counts.jpg and /dev/null differ
diff --git a/website/public/img/comparison-table.png b/website/public/img/comparison-table.png
deleted file mode 100644
index ec4ca839db4..00000000000
Binary files a/website/public/img/comparison-table.png and /dev/null differ
diff --git a/website/public/img/consul-arch.png b/website/public/img/consul-arch.png
deleted file mode 100644
index 281b03dee5f..00000000000
Binary files a/website/public/img/consul-arch.png and /dev/null differ
diff --git a/website/public/img/consul-sessions.png b/website/public/img/consul-sessions.png
deleted file mode 100644
index c7b1bd10caa..00000000000
Binary files a/website/public/img/consul-sessions.png and /dev/null differ
diff --git a/website/public/img/consul_web_ui.png b/website/public/img/consul_web_ui.png
deleted file mode 100644
index 087d9031f6a..00000000000
Binary files a/website/public/img/consul_web_ui.png and /dev/null differ
diff --git a/website/public/img/diagram-policy-evaluation-workflow_dark.png b/website/public/img/diagram-policy-evaluation-workflow_dark.png
deleted file mode 100644
index b4f56c6107e..00000000000
Binary files a/website/public/img/diagram-policy-evaluation-workflow_dark.png and /dev/null differ
diff --git a/website/public/img/diagram-policy-evaluation-workflow_light.png b/website/public/img/diagram-policy-evaluation-workflow_light.png
deleted file mode 100644
index 8fccbfdbc91..00000000000
Binary files a/website/public/img/diagram-policy-evaluation-workflow_light.png and /dev/null differ
diff --git a/website/public/img/diagram-rgp-namespace-post-115_dark.png b/website/public/img/diagram-rgp-namespace-post-115_dark.png
deleted file mode 100644
index e20f8ed99d6..00000000000
Binary files a/website/public/img/diagram-rgp-namespace-post-115_dark.png and /dev/null differ
diff --git a/website/public/img/diagram-rgp-namespace-post-115_light.png b/website/public/img/diagram-rgp-namespace-post-115_light.png
deleted file mode 100644
index 631c97fd41f..00000000000
Binary files a/website/public/img/diagram-rgp-namespace-post-115_light.png and /dev/null differ
diff --git a/website/public/img/diagram-rgp-namespace-pre-115_dark.png b/website/public/img/diagram-rgp-namespace-pre-115_dark.png
deleted file mode 100644
index ef2475ad4b6..00000000000
Binary files a/website/public/img/diagram-rgp-namespace-pre-115_dark.png and /dev/null differ
diff --git a/website/public/img/diagram-rgp-namespace-pre-115_light.png b/website/public/img/diagram-rgp-namespace-pre-115_light.png
deleted file mode 100644
index 9593b4f0657..00000000000
Binary files a/website/public/img/diagram-rgp-namespace-pre-115_light.png and /dev/null differ
diff --git a/website/public/img/diagram-vault-agent.png b/website/public/img/diagram-vault-agent.png
deleted file mode 100644
index 4c95ee4fa4d..00000000000
Binary files a/website/public/img/diagram-vault-agent.png and /dev/null differ
diff --git a/website/public/img/docs-sidebar-chevron-active.svg b/website/public/img/docs-sidebar-chevron-active.svg
deleted file mode 100644
index 11694b610aa..00000000000
--- a/website/public/img/docs-sidebar-chevron-active.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="8" height="5" xmlns="http://www.w3.org/2000/svg"><path d="M7.429.9a.5.5 0 1 0-.707-.707L4.075 2.84 1.43.194A.5.5 0 1 0 .722.9l3 3a.5.5 0 0 0 .707 0l3-3z" fill="var(--brand, #2e71e5)" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/docs-sidebar-chevron.svg b/website/public/img/docs-sidebar-chevron.svg
deleted file mode 100644
index 6fa9224a912..00000000000
--- a/website/public/img/docs-sidebar-chevron.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="5" height="8" xmlns="http://www.w3.org/2000/svg"><path d="M1.429.194A.5.5 0 1 0 .722.9l2.646 2.647L.722 6.194a.5.5 0 1 0 .707.707l3-3a.5.5 0 0 0 0-.708l-3-3z" fill="var(--gray-3, #727274)" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/download.svg b/website/public/img/download.svg
deleted file mode 100644
index 7eb656831a3..00000000000
--- a/website/public/img/download.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 28 28"><path d="M28 0H0v28h28V0zM13.8 22.9L7 17.3l2-2.4 3.2 2.6V7h3.2v10.5l3.2-2.6 2 2.4-6.8 5.6z"/></svg>
\ No newline at end of file
diff --git a/website/public/img/fastly.svg b/website/public/img/fastly.svg
deleted file mode 100644
index 9fbed41f49e..00000000000
--- a/website/public/img/fastly.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 199" preserveAspectRatio="xMidYMid"><path fill="#D52F2F" d="M348.444 20.348v133.588h40.127v-20.41h-13.258V0l-26.87.003.002 20.345zM0 133.525h13.64v-64.45H0V51.35l13.64-2.243V31.165C13.64 9.432 18.37 0 46.088 0c5.986 0 13.08.884 19.293 2.003L61.7 23.85c-4.208-.666-6.294-.785-8.953-.785-9.765 0-12.234.975-12.234 10.515v15.527h20.275v19.968H40.51v64.45h13.5v20.408L0 153.938v-20.413zm334.776-6.45c-4.203.887-7.88.78-10.54.845-11.052.272-10.097-3.362-10.097-13.785v-45.06h21.04V49.107h-21.04V0h-26.873v119.707c0 23.502 5.8 34.23 31.08 34.23 5.985 0 14.212-1.54 20.424-2.87l-3.994-23.992zM253.724 69.04v-3.576c-8.13-1.483-16.2-1.504-20.58-1.504-12.505 0-14.03 6.63-14.03 10.225 0 5.086 1.736 7.835 15.282 10.797 19.802 4.446 39.69 9.084 39.69 33.638 0 23.286-11.984 35.316-37.21 35.316-16.88 0-33.26-3.624-45.756-6.795v-20.065h20.348l-.012 3.565c8.756 1.69 17.938 1.522 22.73 1.522 13.34 0 15.497-7.17 15.497-10.984 0-5.29-3.825-7.832-16.328-10.368-23.555-4.024-42.25-12.067-42.25-35.994 0-22.648 15.148-31.532 40.374-31.532 17.09 0 30.084 2.65 42.587 5.823V69.04h-20.343zm-136.12 57.974v-3.16h-3.22v3.15c-14.42-.84-25.957-12.426-26.71-26.87h3.2v-3.22H87.69c.856-14.345 12.344-25.82 26.694-26.658v3.166h3.22v-3.175c14.144.756 25.538 11.85 26.77 25.865v.923h-3.226v3.22h3.226v.88c-1.225 14.02-12.62 25.123-26.77 25.88zm53.65.06l-.018-83.616h-26.87V51.3a54.923 54.923 0 0 0-18.27-6.912h.152V35.11h3.28v-6.824H102.47v6.824h3.278v9.28h.186c-25.7 4.73-45.175 27.235-45.175 54.303 0 30.505 24.728 55.234 55.232 55.234a54.974 54.974 0 0 0 28.46-7.892l4.84 7.902h28.383v-26.86h-6.423zm285.324-77.967H512v19.95h-13.25l-33.987 83.62c-9.74 23.488-25.742 45.596-50.107 45.596-5.993 0-13.97-.664-19.5-1.993l2.43-24.388c3.55.664 8.2 1.1 10.64 1.1 11.3 0 24.044-7 28.032-19.192l-34.44-84.744h-13.247v-19.95h55.45v19.95h-13.244l19.51 48 19.51-48h-13.218v-19.95zm-326.48 37.57l-2.046-2.046-10.385 9.05a4.93 4.93 0 0 0-1.67-.294c-2.803 0-5.07 2.335-5.07 5.212 0 2.882 2.267 5.216 5.07 5.216 2.8 0 5.074-2.334 5.074-5.216 0-.546-.08-1.072-.233-1.568l9.26-10.354"/></svg>
\ No newline at end of file
diff --git a/website/public/img/fastly_logo.png b/website/public/img/fastly_logo.png
deleted file mode 100644
index de82b3c0d00..00000000000
Binary files a/website/public/img/fastly_logo.png and /dev/null differ
diff --git a/website/public/img/favicons/android-chrome-192x192.png b/website/public/img/favicons/android-chrome-192x192.png
deleted file mode 100644
index 1101b5146f0..00000000000
Binary files a/website/public/img/favicons/android-chrome-192x192.png and /dev/null differ
diff --git a/website/public/img/favicons/android-chrome-512x512.png b/website/public/img/favicons/android-chrome-512x512.png
deleted file mode 100644
index c4188389f98..00000000000
Binary files a/website/public/img/favicons/android-chrome-512x512.png and /dev/null differ
diff --git a/website/public/img/favicons/apple-touch-icon.png b/website/public/img/favicons/apple-touch-icon.png
deleted file mode 100644
index 37fc4db8714..00000000000
Binary files a/website/public/img/favicons/apple-touch-icon.png and /dev/null differ
diff --git a/website/public/img/favicons/favicon-16x16.png b/website/public/img/favicons/favicon-16x16.png
deleted file mode 100644
index e47f72b630e..00000000000
Binary files a/website/public/img/favicons/favicon-16x16.png and /dev/null differ
diff --git a/website/public/img/favicons/favicon-32x32.png b/website/public/img/favicons/favicon-32x32.png
deleted file mode 100644
index 5b2ce7ec674..00000000000
Binary files a/website/public/img/favicons/favicon-32x32.png and /dev/null differ
diff --git a/website/public/img/favicons/favicon.ico b/website/public/img/favicons/favicon.ico
deleted file mode 100644
index f8fcb4732c5..00000000000
Binary files a/website/public/img/favicons/favicon.ico and /dev/null differ
diff --git a/website/public/img/favicons/mstile-150x150.png b/website/public/img/favicons/mstile-150x150.png
deleted file mode 100644
index 0044ae4a37b..00000000000
Binary files a/website/public/img/favicons/mstile-150x150.png and /dev/null differ
diff --git a/website/public/img/favicons/safari-pinned-tab.svg b/website/public/img/favicons/safari-pinned-tab.svg
deleted file mode 100644
index e3805a6f864..00000000000
--- a/website/public/img/favicons/safari-pinned-tab.svg
+++ /dev/null
@@ -1,23 +0,0 @@
-<?xml version="1.0" standalone="no"?>
-<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN"
- "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
-<svg version="1.0" xmlns="http://www.w3.org/2000/svg"
- width="16.000000pt" height="16.000000pt" viewBox="0 0 16.000000 16.000000"
- preserveAspectRatio="xMidYMid meet">
-<metadata>
-Created by potrace 1.11, written by Peter Selinger 2001-2013
-</metadata>
-<g transform="translate(0.000000,16.000000) scale(0.003125,-0.003125)"
-fill="#000000" stroke="none">
-<path d="M2 5111 c10 -30 2544 -5110 2548 -5111 4 0 2559 5083 2568 5110 3 7
--857 10 -2558 10 -1549 0 -2560 -4 -2558 -9z m2258 -1166 l0 -145 -145 0 -145
-0 0 145 0 145 145 0 145 0 0 -145z m450 0 l0 -145 -150 0 -150 0 0 145 0 145
-150 0 150 0 0 -145z m440 0 l0 -145 -145 0 -145 0 0 145 0 145 145 0 145 0 0
--145z m-890 -450 l0 -145 -145 0 -145 0 0 145 0 145 145 0 145 0 0 -145z m450
-0 l0 -145 -150 0 -150 0 0 145 0 145 150 0 150 0 0 -145z m440 0 l0 -145 -145
-0 -145 0 0 145 0 145 145 0 145 0 0 -145z m-890 -440 l0 -145 -145 0 -145 0 0
-145 0 145 145 0 145 0 0 -145z m450 0 l0 -145 -150 0 -150 0 0 145 0 145 150
-0 150 0 0 -145z m450 0 l0 -145 -150 0 -150 0 0 145 0 145 150 0 150 0 0 -145z
-m-450 -450 l0 -145 -150 0 -150 0 0 145 0 145 150 0 150 0 0 -145z"/>
-</g>
-</svg>
diff --git a/website/public/img/feather/check-circle.svg b/website/public/img/feather/check-circle.svg
deleted file mode 100644
index 2e46b8a4873..00000000000
--- a/website/public/img/feather/check-circle.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="#fff" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-check-circle"><path d="M22 11.07V12a10 10 0 1 1-5.93-9.14"/><path d="M23 3L12 14l-3-3"/></svg>
\ No newline at end of file
diff --git a/website/public/img/feather/icon_chevron-up.svg b/website/public/img/feather/icon_chevron-up.svg
deleted file mode 100644
index eccabe8fb06..00000000000
--- a/website/public/img/feather/icon_chevron-up.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
-  <polyline points="18 15 12 9 6 15"/>
-</svg>
\ No newline at end of file
diff --git a/website/public/img/feather/icon_link.svg b/website/public/img/feather/icon_link.svg
deleted file mode 100644
index 9c4fa84e2bf..00000000000
--- a/website/public/img/feather/icon_link.svg
+++ /dev/null
@@ -1,4 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24">
-  <path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71" fill="none" stroke="#D0D2D5" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2"/>
-  <path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71" fill="none" stroke="#D0D2D5" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2"/>
-</svg>
\ No newline at end of file
diff --git a/website/public/img/feather/icon_list-menu.svg b/website/public/img/feather/icon_list-menu.svg
deleted file mode 100644
index 380a10b6d9a..00000000000
--- a/website/public/img/feather/icon_list-menu.svg
+++ /dev/null
@@ -1,15 +0,0 @@
-<svg viewBox="0 0 23 16" >
-  <g id="✓--Sentinel-Docs-Page" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
-    <g id="Sentinal-Docs---320" transform="translate(-149.000000, -179.000000)">
-      <g id="Jump-Links-Mobile" transform="translate(0.000000, 156.000000)">
-        <g id="Group-2" transform="translate(149.708333, 23.000000)">
-          <rect id="Rectangle" fill="#000000" x="0" y="0" width="6" height="2"></rect>
-          <rect id="Rectangle" fill="#000000" x="0" y="6" width="10" height="2"></rect>
-          <rect id="Rectangle" fill="#000000" x="0" y="12" width="10" height="2"></rect>
-          <path d="M10,1 L13,1 C15.2787612,1 17,2.790861 17,5 L17,12" id="Rectangle-4" stroke="#000000" stroke-width="2" stroke-linecap="square"></path>
-          <polyline id="Triangle" stroke="#000000" stroke-width="1.75" stroke-linecap="square" points="20.25 11 17 14.25 17 14.25 13.75 11"></polyline>
-        </g>
-      </g>
-    </g>
-  </g>
-</svg>
\ No newline at end of file
diff --git a/website/public/img/feature-config.svg b/website/public/img/feature-config.svg
deleted file mode 100644
index 216afac0e04..00000000000
--- a/website/public/img/feature-config.svg
+++ /dev/null
@@ -1,17 +0,0 @@
-<svg viewBox="0 0 130 170" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
-  <defs>
-    <rect id="path-1" x="0" y="0" width="130" height="170" rx="7"></rect>
-    <mask id="mask-2" maskContentUnits="userSpaceOnUse" maskUnits="objectBoundingBox" x="0" y="0" width="130" height="170" fill="white">
-      <use xlink:href="#path-1"></use>
-    </mask>
-  </defs>
-  <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
-    <g id="Group">
-      <use id="Rectangle-4" stroke="#FFFFFF" mask="url(#mask-2)" stroke-width="10" xlink:href="#path-1"></use>
-      <rect id="Rectangle" fill="#FFFFFF" x="22" y="22" width="85" height="8"></rect>
-      <rect id="Rectangle" fill="#FFFFFF" x="22" y="39" width="85" height="8"></rect>
-      <rect id="Rectangle" fill="#FFFFFF" x="22" y="56" width="85" height="8"></rect>
-      <rect id="Rectangle" fill="#FFFFFF" x="22" y="73" width="85" height="8"></rect>
-    </g>
-  </g>
-</svg>
diff --git a/website/public/img/feature-discovery.svg b/website/public/img/feature-discovery.svg
deleted file mode 100644
index a663eaebe66..00000000000
--- a/website/public/img/feature-discovery.svg
+++ /dev/null
@@ -1,9 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 62 60">
-  <g fill="none" fill-rule="evenodd">
-    <path stroke="#FFF" stroke-width=".5" d="M58.898 35.016h-8.53l-7.978-5L50.516 25h8.19l.192 10.017zm-8.526.03l4.31 9.086-4.31-9.087zm.144-10.07l4.167-9.26-4.167 9.26zm4.175-9.26l4.087 9.347-4.084-9.348zm-.074 28.22l4.373-8.778-4.374 8.778zm-12.28-13.884h-12.23 12.23z" opacity=".7"/>
-    <g fill="#FFF">
-      <path d="M29.9 36.3c-3.6 0-6.4-2.8-6.4-6.4 0-3.6 2.8-6.4 6.4-6.4 3.6 0 6.4 2.8 6.4 6.4 0 3.6-2.8 6.4-6.4 6.4m12.5-3.4c-1.6 0-3-1.3-3-3 0-1.6 1.3-3 3-3 1.6 0 3 1.3 3 3s-1.4 3-3 3m10.8 2.8c-.4 1.6-2 2.5-3.6 2.1-1.6-.4-2.5-2-2.1-3.6.4-1.6 2-2.5 3.6-2.1 1.5.4 2.5 1.8 2.2 3.4 0 0 0 .1-.1.2m-2.1-7.6c-1.6.4-3.2-.6-3.6-2.2-.4-1.6.6-3.2 2.2-3.6 1.6-.4 3.2.6 3.6 2.2.1.4.1.8 0 1.2-.1 1.1-.9 2.1-2.2 2.4m10.6 7.2c-.3 1.6-1.8 2.7-3.4 2.4-1.6-.3-2.7-1.8-2.4-3.4.3-1.6 1.8-2.7 3.4-2.4 1.5.3 2.6 1.7 2.5 3.2-.1.1-.1.1-.1.2m-2.4-7.4c-1.6.3-3.1-.8-3.4-2.4-.3-1.6.8-3.1 2.4-3.4 1.6-.3 3.1.8 3.4 2.4 0 .3.1.5 0 .8-.1 1.3-1.1 2.4-2.4 2.6m-6.1 18.8c-1.4-.8-1.9-2.6-1.1-4 .8-1.4 2.6-1.9 4-1.1 1 .6 1.6 1.7 1.5 2.8-.1.4-.2.8-.4 1.2-.8 1.4-2.6 1.9-4 1.1zm2.9-28.3c-1.4.8-3.2.3-4-1.1-.8-1.4-.3-3.2 1.1-4 1.4-.8 3.2-.3 4 1.1.3.6.4 1.1.4 1.7-.1.9-.6 1.8-1.5 2.3"/>
-      <path fill-rule="nonzero" d="M30 59.8c-8 0-15.4-3.1-21.1-8.7C3.4 45.4.3 37.9.3 30 .3 22 3.4 14.6 9 8.9 14.6 3.3 22.1.2 30 .2c6.6 0 12.9 2.1 18.1 6.1l-3.7 4.8C40.2 7.9 35.2 6.2 30 6.2c-6.3 0-12.3 2.5-16.8 7S6.3 23.6 6.3 30c0 6.3 2.5 12.3 7 16.8s10.4 6.9 16.8 6.9c5.3 0 10.3-1.7 14.4-4.9l3.6 4.8c-5.2 4-11.5 6.2-18.1 6.2z"/>
-    </g>
-  </g>
-</svg>
diff --git a/website/public/img/feature-health.svg b/website/public/img/feature-health.svg
deleted file mode 100644
index 16a4864a151..00000000000
--- a/website/public/img/feature-health.svg
+++ /dev/null
@@ -1,24 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 124 178" xmlns:xlink="http://www.w3.org/1999/xlink">
-  <defs>
-    <rect id="a" width="81" height="156" x="21" y="11" rx="4"/>
-    <mask id="b" width="81" height="156" x="0" y="0" fill="#fff">
-      <use xlink:href="#a"/>
-    </mask>
-  </defs>
-  <g fill="none" fill-rule="evenodd">
-    <g fill="#FFF" opacity=".33">
-      <path d="M60.844 45.78c-2.15 0-3.82-1.68-3.82-3.84s1.67-3.84 3.82-3.84c2.148 0 3.82 1.68 3.82 3.84s-1.672 3.84-3.82 3.84m7.46-2.04c-.956 0-1.79-.78-1.79-1.8 0-.96.775-1.8 1.79-1.8.954 0 1.79.78 1.79 1.8s-.836 1.8-1.79 1.8m6.444 1.68c-.238.96-1.193 1.5-2.148 1.26-.955-.24-1.492-1.2-1.253-2.16.238-.96 1.193-1.5 2.148-1.26.895.24 1.492 1.08 1.313 2.04 0 0 0 .06-.06.12m-1.253-4.56c-.955.24-1.91-.36-2.148-1.32-.24-.96.358-1.92 1.313-2.16.955-.24 1.91.36 2.148 1.32.06.24.06.48 0 .72-.06.66-.537 1.26-1.313 1.44m6.326 4.32c-.17.96-1.07 1.62-2.02 1.44-.953-.18-1.61-1.08-1.43-2.04.18-.96 1.075-1.62 2.03-1.44.895.18 1.55 1.02 1.49 1.92-.06.06-.06.06-.06.12m-1.43-4.44c-.955.18-1.85-.48-2.03-1.44-.18-.96.478-1.86 1.433-2.04.955-.18 1.85.48 2.03 1.44 0 .18.06.3 0 .48-.06.78-.657 1.44-1.433 1.56m-3.65 11.28c-.835-.48-1.133-1.56-.656-2.4.477-.84 1.552-1.14 2.387-.66.6.36.96 1.02.9 1.68-.06.24-.12.48-.24.72-.474.84-1.55 1.14-2.384.66zm1.73-16.98c-.834.48-1.91.18-2.386-.66-.477-.84-.18-1.92.656-2.4.836-.48 1.91-.18 2.387.66.18.36.24.66.24 1.02-.06.54-.36 1.08-.896 1.38"/>
-      <path fill-rule="nonzero" d="M60.903 59.88c-4.774 0-9.19-1.86-12.592-5.22-3.28-3.42-5.13-7.92-5.13-12.66 0-4.8 1.85-9.24 5.19-12.66 3.35-3.36 7.82-5.22 12.54-5.22 3.94 0 7.7 1.26 10.8 3.66l-2.21 2.88c-2.503-1.92-5.49-2.94-8.59-2.94-3.76 0-7.34 1.5-10.026 4.2S46.76 38.16 46.76 42c0 3.78 1.493 7.38 4.178 10.08 2.686 2.7 6.207 4.14 10.026 4.14 3.163 0 6.147-1.02 8.593-2.94l2.15 2.88c-3.105 2.4-6.865 3.72-10.804 3.72z"/>
-    </g>
-    <g fill="#FFF" opacity=".66">
-      <path d="M60.844 92.78c-2.15 0-3.82-1.68-3.82-3.84s1.67-3.84 3.82-3.84c2.148 0 3.82 1.68 3.82 3.84s-1.672 3.84-3.82 3.84m7.46-2.04c-.956 0-1.79-.78-1.79-1.8 0-.96.775-1.8 1.79-1.8.954 0 1.79.78 1.79 1.8s-.836 1.8-1.79 1.8m6.444 1.68c-.238.96-1.193 1.5-2.148 1.26-.955-.24-1.492-1.2-1.253-2.16.238-.96 1.193-1.5 2.148-1.26.895.24 1.492 1.08 1.313 2.04 0 0 0 .06-.06.12m-1.253-4.56c-.955.24-1.91-.36-2.148-1.32-.24-.96.358-1.92 1.313-2.16.955-.24 1.91.36 2.148 1.32.06.24.06.48 0 .72-.06.66-.537 1.26-1.313 1.44m6.326 4.32c-.17.96-1.07 1.62-2.02 1.44-.953-.18-1.61-1.08-1.43-2.04.18-.96 1.075-1.62 2.03-1.44.895.18 1.55 1.02 1.49 1.92-.06.06-.06.06-.06.12m-1.43-4.44c-.955.18-1.85-.48-2.03-1.44-.18-.96.478-1.86 1.433-2.04.955-.18 1.85.48 2.03 1.44 0 .18.06.3 0 .48-.06.78-.657 1.44-1.433 1.56m-3.65 11.28c-.835-.48-1.133-1.56-.656-2.4.477-.84 1.552-1.14 2.387-.66.6.36.96 1.02.9 1.68-.06.24-.12.48-.24.72-.474.84-1.55 1.14-2.384.66zm1.73-16.98c-.834.48-1.91.18-2.386-.66-.477-.84-.18-1.92.656-2.4.836-.48 1.91-.18 2.387.66.18.36.24.66.24 1.02-.06.54-.36 1.08-.896 1.38"/>
-      <path fill-rule="nonzero" d="M60.903 106.88c-4.774 0-9.19-1.86-12.592-5.22-3.28-3.42-5.13-7.92-5.13-12.66 0-4.8 1.85-9.24 5.19-12.66 3.35-3.36 7.82-5.22 12.54-5.22 3.94 0 7.7 1.26 10.8 3.66l-2.21 2.88c-2.503-1.92-5.49-2.94-8.59-2.94-3.76 0-7.34 1.5-10.026 4.2S46.76 85.16 46.76 89c0 3.78 1.493 7.38 4.178 10.08 2.686 2.7 6.207 4.14 10.026 4.14 3.163 0 6.147-1.02 8.593-2.94l2.15 2.88c-3.105 2.4-6.865 3.72-10.804 3.72z"/>
-    </g>
-    <g fill="#FFF">
-      <path d="M60.844 139.78c-2.15 0-3.82-1.68-3.82-3.84s1.67-3.84 3.82-3.84c2.148 0 3.82 1.68 3.82 3.84s-1.672 3.84-3.82 3.84m7.46-2.04c-.956 0-1.79-.78-1.79-1.8 0-.96.775-1.8 1.79-1.8.954 0 1.79.78 1.79 1.8s-.836 1.8-1.79 1.8m6.444 1.68c-.238.96-1.193 1.5-2.148 1.26-.955-.24-1.492-1.2-1.253-2.16.238-.96 1.193-1.5 2.148-1.26.895.24 1.492 1.08 1.313 2.04 0 0 0 .06-.06.12m-1.253-4.56c-.955.24-1.91-.36-2.148-1.32-.24-.96.358-1.92 1.313-2.16.955-.24 1.91.36 2.148 1.32.06.24.06.48 0 .72-.06.66-.537 1.26-1.313 1.44m6.326 4.32c-.17.96-1.07 1.62-2.02 1.44-.953-.18-1.61-1.08-1.43-2.04.18-.96 1.075-1.62 2.03-1.44.895.18 1.55 1.02 1.49 1.92-.06.06-.06.06-.06.12m-1.43-4.44c-.955.18-1.85-.48-2.03-1.44-.18-.96.478-1.86 1.433-2.04.955-.18 1.85.48 2.03 1.44 0 .18.06.3 0 .48-.06.78-.657 1.44-1.433 1.56m-3.643 11.28c-.834-.48-1.132-1.56-.655-2.4.475-.84 1.55-1.14 2.385-.66.596.36.954 1.02.894 1.68-.06.24-.12.48-.24.72-.48.84-1.55 1.14-2.39.66zm1.73-16.98c-.833.48-1.91.18-2.385-.66-.48-.84-.18-1.92.654-2.4.837-.48 1.91-.18 2.388.66.18.36.24.66.24 1.02-.06.54-.36 1.08-.895 1.38"/>
-      <path fill-rule="nonzero" d="M60.903 153.88c-4.774 0-9.19-1.86-12.592-5.22-3.28-3.42-5.13-7.92-5.13-12.66 0-4.8 1.85-9.24 5.19-12.66 3.35-3.36 7.82-5.22 12.54-5.22 3.94 0 7.7 1.26 10.8 3.66l-2.21 2.88c-2.502-1.92-5.49-2.94-8.59-2.94-3.76 0-7.34 1.5-10.025 4.2s-4.12 6.24-4.12 10.08c0 3.78 1.494 7.38 4.18 10.08 2.685 2.7 6.206 4.14 10.025 4.14 3.162 0 6.146-1.02 8.592-2.94l2.15 2.88c-3.104 2.4-6.864 3.72-10.803 3.72z"/>
-    </g>
-    <use stroke="#FFF" stroke-width="6" mask="url(#b)" xlink:href="#a"/>
-    <path fill="#FFF" d="M48 11.31h27.14S74.545 0 61.95 0C49.352 0 48 11.31 48 11.31zM46 167h31v11H46zM21.454 56.943h-7.842V42.476S.516 30.036.352 29.216c-.165-.82.084-1.182.45-1.548C1.17 27.3 2.05 27 2.567 27h18.887v29.943zm0 47h-7.842V89.476S.516 77.036.352 76.216c-.165-.82.084-1.182.45-1.548C1.17 74.3 2.05 74 2.567 74h18.887v29.943zm0 47h-7.842v-14.467S.516 124.036.352 123.216c-.165-.82.084-1.182.45-1.548C1.17 121.3 2.05 121 2.567 121h18.887v29.943zm80.046 0h7.84v-14.467s13.098-12.44 13.262-13.26c.164-.82-.084-1.182-.45-1.548-.367-.367-1.248-.668-1.765-.668H101.5v29.943zm0-47h7.84V89.476s13.098-12.44 13.262-13.26c.164-.82-.084-1.182-.45-1.548-.367-.367-1.248-.668-1.765-.668H101.5v29.943zm0-47h7.84V42.476s13.098-12.44 13.262-13.26c.164-.82-.084-1.182-.45-1.548-.367-.367-1.248-.668-1.765-.668H101.5v29.943z"/>
-  </g>
-</svg>
diff --git a/website/public/img/feature-multi.svg b/website/public/img/feature-multi.svg
deleted file mode 100644
index 96376e2e937..00000000000
--- a/website/public/img/feature-multi.svg
+++ /dev/null
@@ -1,15 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 192">
-  <g fill="#FFF" fill-rule="evenodd">
-    <g fill-rule="nonzero">
-      <path fill-opacity=".7" d="M168.764 26.55c-2.578 0-4.664-2.086-4.664-4.664 0-2.577 2.086-4.663 4.664-4.663 2.577 0 4.663 2.086 4.663 4.663 0 2.578-2.086 4.664-4.663 4.664"/>
-      <path d="M177.845 24.055c-1.186 0-2.168-.94-2.168-2.17 0-1.185.94-2.167 2.168-2.167 1.187 0 2.17.94 2.17 2.168 0 1.187-.983 2.17-2.17 2.17m7.855 2.004c-.286 1.145-1.473 1.84-2.618 1.554-1.146-.287-1.84-1.473-1.555-2.62.287-1.144 1.473-1.84 2.618-1.553 1.105.29 1.8 1.35 1.596 2.46 0 .08 0 .13-.04.17m-1.51-5.52c-1.14.29-2.33-.45-2.57-1.59-.24-1.14.45-2.33 1.6-2.57 1.15-.29 2.33.45 2.58 1.596.04.286.09.573.04.86-.12.82-.73 1.515-1.63 1.72m7.65 5.32c-.2 1.184-1.31 1.96-2.49 1.76-1.186-.21-1.964-1.31-1.76-2.5.204-1.185 1.31-1.96 2.495-1.76 1.107.207 1.884 1.19 1.8 2.293 0 .04-.04.12-.04.202m-1.76-5.4c-1.185.2-2.29-.616-2.453-1.76-.205-1.19.61-2.29 1.76-2.456 1.185-.206 2.29.613 2.45 1.76.04.203.04.37.04.57-.08.9-.814 1.72-1.8 1.88m-1.47 12.846c-.612 1.022-1.88 1.39-2.944.82-1.022-.615-1.39-1.88-.82-2.947.617-1.02 1.885-1.39 2.948-.82.74.41 1.15 1.23 1.068 2.048 0 .33-.08.62-.244.9m-.776-19.8c-1.02.578-2.33.21-2.943-.813-.573-1.024-.205-2.333.818-2.947 1.024-.57 2.333-.2 2.946.82.25.41.33.82.25 1.23-.04.736-.45 1.39-1.06 1.72"/>
-      <path d="M168.845 43.568c-5.81 0-11.21-2.25-15.3-6.34-4.09-4.092-6.34-9.533-6.34-15.3 0-5.77 2.25-11.21 6.34-15.3 4.09-4.092 9.532-6.342 15.3-6.342 4.787 0 9.328 1.555 13.132 4.46l-2.66 3.436c-3.026-2.332-6.667-3.56-10.472-3.56-4.622 0-8.96 1.8-12.23 5.073-3.274 3.273-5.033 7.61-5.033 12.232 0 4.623 1.8 8.96 5.073 12.232 3.272 3.27 7.61 5.03 12.23 5.03 3.847 0 7.447-1.23 10.474-3.56l2.65 3.43c-3.85 2.98-8.39 4.5-13.18 4.5z"/>
-    </g>
-    <path d="M73.995 168.437C75.93 163.844 77 158.797 77 153.5c0-21.263-17.237-38.5-38.5-38.5-4.044 0-7.943.624-11.605 1.78C24.365 108.805 23 100.312 23 91.5 23 45.384 60.384 8 106.5 8S190 45.384 190 91.5 152.616 175 106.5 175c-11.53 0-22.514-2.337-32.505-6.563zm10.14-17.49l.093.002c.802 0 1.996-.02 3.53-.11 2.357-.14 4.953-.39 7.738-.79l-.712-4.95c-2.64.38-5.095.62-7.313.75-1.41.08-2.5.1-3.19.1h-.04l-.09 4.99zm17.923-2.065c3.646-.776 7.29-1.765 10.89-2.988l-1.608-4.734c-3.41 1.158-6.863 2.095-10.324 2.832l1.042 4.89zm17.15-5.378c3.503-1.493 6.88-3.208 10.11-5.158l-2.584-4.28c-3.024 1.826-6.194 3.435-9.487 4.838l1.96 4.6zm15.697-8.882c3.072-2.257 5.95-4.745 8.618-7.474l-3.575-3.495c-2.475 2.532-5.148 4.842-8.003 6.94l2.96 4.03zm13.106-12.546c1.24-1.55 2.42-3.162 3.54-4.838 1-1.496 1.95-3.01 2.86-4.554l-4.3-2.546c-.87 1.47-1.77 2.91-2.71 4.332-1.03 1.553-2.12 3.047-3.27 4.484l3.906 3.122zm9.6-15.232c1.69-3.313 3.23-6.733 4.62-10.248l-4.65-1.835c-1.33 3.37-2.8 6.65-4.41 9.81l4.46 2.28zm6.89-16.49c1.19-3.53 2.22-7.124 3.12-10.763l-4.85-1.19c-.86 3.51-1.86 6.97-3 10.37l4.74 1.59zm4.55-17.208c.74-3.7 1.33-7.388 1.79-11.037l-4.96-.62c-.44 3.53-1.01 7.09-1.73 10.68l4.91.97zm2.47-17.636c.34-4.14.49-7.9.49-11.19l-5-.002c0 3.158-.14 6.785-.46 10.783l4.99.41z"/>
-    <g fill-rule="nonzero">
-      <path fill-opacity=".7" d="M33.8 151.182c0-3.437 2.782-6.218 6.218-6.218 3.437 0 6.218 2.78 6.218 6.218 0 3.436-2.78 6.218-6.218 6.218-3.436 0-6.218-2.782-6.218-6.218z"/>
-      <path d="M52.127 154.073c-1.582 0-2.89-1.255-2.89-2.89 0-1.583 1.254-2.892 2.89-2.892 1.582 0 2.89 1.26 2.89 2.9 0 1.58-1.308 2.89-2.89 2.89m10.473 2.67c-.382 1.53-1.964 2.46-3.49 2.08-1.528-.38-2.455-1.96-2.074-3.49.382-1.53 1.964-2.45 3.49-2.07 1.474.38 2.4 1.8 2.13 3.27 0 .11 0 .17-.056.22m-2.018-7.36c-1.527.38-3.11-.6-3.437-2.124-.327-1.53.6-3.11 2.128-3.44 1.527-.384 3.11.6 3.436 2.125.05.383.1.765.05 1.147-.17 1.1-.98 2.02-2.18 2.3m10.2 7.09c-.28 1.583-1.75 2.62-3.33 2.346-1.58-.27-2.62-1.742-2.35-3.324.27-1.58 1.74-2.617 3.32-2.345 1.47.27 2.51 1.58 2.4 3.054 0 .054-.06.163-.06.272m-2.35-7.2c-1.58.27-3.055-.82-3.273-2.345-.27-1.58.82-3.053 2.347-3.27 1.58-.274 3.054.817 3.27 2.344.056.275.056.49.056.766-.11 1.2-1.09 2.29-2.4 2.51m-1.945 17.1c-.82 1.363-2.51 1.854-3.93 1.09-1.36-.818-1.852-2.51-1.09-3.927.82-1.365 2.51-1.856 3.93-1.09.98.543 1.526 1.634 1.417 2.725 0 .43-.11.81-.327 1.2M65.437 140c-1.364.764-3.11.273-3.928-1.09-.77-1.365-.28-3.11 1.09-3.928 1.36-.764 3.11-.273 3.92 1.09.33.546.43 1.092.33 1.637-.06.98-.6 1.85-1.42 2.29"/>
-      <path d="M40.127 180.09c-7.745 0-14.945-3-20.4-8.454-5.454-5.454-8.454-12.71-8.454-20.4 0-7.69 3-14.945 8.454-20.4 5.455-5.454 12.71-8.454 20.4-8.454 6.382 0 12.437 2.073 17.51 5.945l-3.546 4.582c-4.03-3.11-8.89-4.75-13.96-4.75-6.16 0-11.94 2.4-16.31 6.76-4.36 4.36-6.71 10.14-6.71 16.31 0 6.16 2.4 11.94 6.77 16.31 4.37 4.36 10.15 6.71 16.31 6.71 5.13 0 9.93-1.64 13.96-4.75l3.55 4.58c-5.12 3.98-11.18 6-17.56 6z"/>
-    </g>
-  </g>
-</svg>
diff --git a/website/public/img/graphic-audit.png b/website/public/img/graphic-audit.png
deleted file mode 100644
index 2c4171815fc..00000000000
Binary files a/website/public/img/graphic-audit.png and /dev/null differ
diff --git a/website/public/img/graphic-audit@2x.png b/website/public/img/graphic-audit@2x.png
deleted file mode 100644
index 7e3834fc0d4..00000000000
Binary files a/website/public/img/graphic-audit@2x.png and /dev/null differ
diff --git a/website/public/img/graphic-crud.png b/website/public/img/graphic-crud.png
deleted file mode 100644
index 03175672768..00000000000
Binary files a/website/public/img/graphic-crud.png and /dev/null differ
diff --git a/website/public/img/graphic-crud@2x.png b/website/public/img/graphic-crud@2x.png
deleted file mode 100644
index 567d2f5d8f6..00000000000
Binary files a/website/public/img/graphic-crud@2x.png and /dev/null differ
diff --git a/website/public/img/graphic-key.png b/website/public/img/graphic-key.png
deleted file mode 100644
index 869c5aed063..00000000000
Binary files a/website/public/img/graphic-key.png and /dev/null differ
diff --git a/website/public/img/graphic-key@2x.png b/website/public/img/graphic-key@2x.png
deleted file mode 100644
index 970203a068b..00000000000
Binary files a/website/public/img/graphic-key@2x.png and /dev/null differ
diff --git a/website/public/img/green-check.svg b/website/public/img/green-check.svg
deleted file mode 100644
index ffc89f76923..00000000000
--- a/website/public/img/green-check.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="18" height="13" viewBox="0 0 18 13" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><title>a</title><defs><path d="M6 10.586L1.707 6.293A1 1 0 1 0 .293 7.707l5 5a.997.997 0 0 0 1.414 0l11-11A1 1 0 0 0 16.293.293L6 10.586z" id="a"/></defs><use fill="var(--nomad, #60dea9)" xlink:href="#a" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/hashicorp-logos/consul-white.svg b/website/public/img/hashicorp-logos/consul-white.svg
deleted file mode 100644
index 20defb4e9bf..00000000000
--- a/website/public/img/hashicorp-logos/consul-white.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Consul Logo White</title><path d="M10.96 14.346a2.368 2.368 0 0 1-2.378-2.368A2.367 2.367 0 0 1 10.95 9.6a2.367 2.367 0 0 1 2.377 2.368 2.364 2.364 0 0 1-2.368 2.378zm4.618-1.279a1.091 1.091 0 0 1-1.095-1.094c0-.607.488-1.094 1.095-1.094.606 0 1.094.487 1.094 1.094 0 .607-.488 1.094-1.094 1.094zm4.004 1.032a1.093 1.093 0 1 1-.791-1.328c.557.147.91.684.813 1.242-.012.027-.012.053-.022.086zm-.776-2.82a1.093 1.093 0 0 1-1.316-.817 1.093 1.093 0 1 1 2.13-.499c.027.147.037.292.01.429-.06.427-.374.79-.824.887zm3.893 2.698a1.087 1.087 0 0 1-1.267.889 1.087 1.087 0 0 1-.888-1.268 1.088 1.088 0 0 1 1.267-.888 1.1 1.1 0 0 1 .91 1.17c-.01.032-.022.059-.022.097zm-.89-2.745a1.093 1.093 0 1 1 .9-1.257c.01.098.022.184.01.282-.038.476-.411.899-.91.975zm-.764 6.536a1.093 1.093 0 0 1-1.495.411 1.093 1.093 0 0 1-.411-1.494 1.093 1.093 0 0 1 2.042.634.987.987 0 0 1-.136.449zM20.651 7.71a1.107 1.107 0 0 1-1.496-.417 1.108 1.108 0 0 1 .417-1.495 1.107 1.107 0 0 1 1.496.417c.12.206.157.417.135.634a1.097 1.097 0 0 1-.552.861zM11 23a10.928 10.928 0 0 1-7.783-3.218A10.96 10.96 0 0 1 0 12a10.93 10.93 0 0 1 3.217-7.782A10.964 10.964 0 0 1 11 1c2.441 0 4.751.781 6.68 2.26l-1.344 1.754A8.702 8.702 0 0 0 11 3.21 8.767 8.767 0 0 0 4.777 5.78 8.738 8.738 0 0 0 2.21 12a8.76 8.76 0 0 0 2.571 6.221A8.73 8.73 0 0 0 11 20.791a8.707 8.707 0 0 0 5.337-1.806l1.342 1.756A10.904 10.904 0 0 1 11 23z" fill="#FFF" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/hashicorp-logos/h-logo.svg b/website/public/img/hashicorp-logos/h-logo.svg
deleted file mode 100644
index 367f586f95b..00000000000
--- a/website/public/img/hashicorp-logos/h-logo.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="44" height="47" viewBox="0 0 44 47" xmlns="http://www.w3.org/2000/svg"><title>Group</title><g fill="#FFF" fill-rule="evenodd"><path d="M18.329 0L0 10.685v25.664l6.886 4.018V14.702L18.33 8.027z"/><path d="M25.646 0v20.44h-7.318v-7.63l-6.885 4.018v26.186l6.885 4.028V26.661h7.318v7.579l6.885-4.019V4.018z"/><path d="M25.646 47.05l18.328-10.685V10.701l-6.886-4.018v25.665l-11.442 6.675z"/></g></svg>
\ No newline at end of file
diff --git a/website/public/img/hashicorp-logos/hashicorp-logo.svg b/website/public/img/hashicorp-logos/hashicorp-logo.svg
deleted file mode 100644
index 5acfdb95c58..00000000000
--- a/website/public/img/hashicorp-logos/hashicorp-logo.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="160" height="38" viewBox="0 0 160 38" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><title>HashiCorp Logo</title><defs><path id="a" d="M0 37.602h159.65V.354H0z"/></defs><g fill="none" fill-rule="evenodd"><path fill="#FFF" d="M54.377 29.315v-8.571h-7.534v8.571H43V9h3.843v8.358h7.534V9h3.844v20.315z"/><g><path d="M68.673 23.644h-2.745c-1.22 0-1.556.335-1.556 1.464 0 1.037.335 1.495 1.495 1.495 1.098 0 2.104-.366 2.806-.763v-2.196zm3.721 5.612h-3.05l-.274-1.006a8.121 8.121 0 0 1-4.423 1.311c-2.715 0-3.874-1.86-3.874-4.422 0-3.02 1.311-4.18 4.331-4.18h3.569v-1.555c0-1.647-.458-2.227-2.837-2.227-1.342 0-2.806.183-4.118.458l-.457-2.837c1.403-.427 3.446-.702 5.094-.702 4.667 0 6.04 1.647 6.04 5.369v9.791zM79.593 29.561c-1.586 0-3.752-.366-5.124-.854l.518-2.836c1.25.366 2.898.64 4.423.64 1.647 0 1.891-.366 1.891-1.495 0-.914-.183-1.372-2.593-1.952-3.63-.884-4.056-1.8-4.056-4.667 0-2.989 1.311-4.3 5.551-4.3 1.373 0 3.172.182 4.453.518l-.365 2.959c-1.129-.214-2.929-.427-4.088-.427-1.616 0-1.891.366-1.891 1.28 0 1.19.091 1.282 2.104 1.8 4.149 1.099 4.546 1.648 4.546 4.698 0 2.867-.885 4.636-5.369 4.636M96.034 29.256v-10.37c0-.794-.335-1.19-1.19-1.19-.914 0-2.53.55-3.873 1.25v10.31h-3.722V8.331l3.722-.518v7.717c1.647-.854 3.843-1.434 5.43-1.434 2.47 0 3.355 1.74 3.355 4.393v10.767h-3.722z" fill="#FFF"/><mask id="b" fill="#fff"><use xlink:href="#a"/></mask><path d="M102.501 29.256h3.721V14.401h-3.72v14.855zm0-16.96h3.721v-4.3h-3.72v4.3zM108.815 14.523c0-3.721 2.166-5.887 7.23-5.887 1.89 0 3.842.244 5.52.672l-.427 3.324c-1.647-.305-3.569-.519-4.972-.519-2.654 0-3.507.916-3.507 3.082v7.808c0 2.166.853 3.081 3.507 3.081 1.403 0 3.325-.214 4.972-.519l.427 3.325c-1.678.428-3.63.671-5.52.671-5.064 0-7.23-2.165-7.23-5.886v-9.152zM129.191 17.269c-1.982 0-2.745.884-2.745 2.562v3.996c0 1.677.763 2.562 2.745 2.562 1.983 0 2.745-.885 2.745-2.562v-3.996c0-1.678-.762-2.562-2.745-2.562m0 12.292c-5.093 0-6.466-2.806-6.466-5.856v-3.752c0-3.05 1.373-5.857 6.466-5.857 5.094 0 6.467 2.807 6.467 5.857v3.752c0 3.05-1.373 5.856-6.467 5.856M145.541 17.513c-1.433.64-2.593 1.311-3.935 2.166v9.577h-3.721V14.401h3.142l.244 1.648c.823-.55 2.592-1.586 3.904-1.953l.366 3.417zM150.775 25.993c.976.213 2.226.396 3.294.396 1.342 0 1.86-.64 1.86-1.983V19.16c0-1.22-.457-1.891-1.83-1.891-1.22 0-2.531.61-3.324 1.342v7.382zm8.876-1.678c0 3.294-1.464 5.246-4.911 5.246-1.311 0-2.806-.183-3.965-.427v6.131l-3.722.52V14.4h2.96l.365 1.251c1.312-.946 2.837-1.556 4.698-1.556 2.989 0 4.575 1.77 4.575 5.156v5.063zM14.945.354L.282 8.813V29.13l5.509 3.18V11.994l9.154-5.284z" fill="#FFF" mask="url(#b)"/><path fill="#FFF" mask="url(#b)" d="M20.798.354v16.181h-5.853v-6.039l-5.51 3.18v20.732l5.51 3.188V21.461h5.853v6l5.509-3.182V3.535z"/><path fill="#FFF" mask="url(#b)" d="M20.798 37.602l14.663-8.459V8.825l-5.51-3.18v20.317l-9.153 5.285z"/></g></g></svg>
\ No newline at end of file
diff --git a/website/public/img/hashicorp-logos/nomad-white.svg b/website/public/img/hashicorp-logos/nomad-white.svg
deleted file mode 100644
index b97dc55e7ad..00000000000
--- a/website/public/img/hashicorp-logos/nomad-white.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Nomad Logo White</title><path d="M11.5 13.607l1.937 1.2 2.772-1.6V5.214L12.9 7.201v4.002L9.448 9.278l-1.303.793-1.194.735v7.997l3.15-1.998v-3.997l1.4.799zm0 10.392L1 18V6.018L11.413 0 22 6v12l-10.445 6-.055-.001z" fill="#FFF" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/hashicorp-logos/terraform-white.svg b/website/public/img/hashicorp-logos/terraform-white.svg
deleted file mode 100644
index d91912a3431..00000000000
--- a/website/public/img/hashicorp-logos/terraform-white.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Terraform Logo White</title><path d="M9.128 4.14l6.425 3.71v7.418L9.128 11.56V4.14zm7.129 3.71l6.425-3.71v7.42l-6.425 3.709V7.85zM2 0l6.425 3.71v7.418L2 7.418V0zm7.129 19.79v-7.418l6.423 3.71V23.5L9.13 19.79z" fill="#FFF" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/hashicorp-logos/vault-white.svg b/website/public/img/hashicorp-logos/vault-white.svg
deleted file mode 100644
index e8f3f4ff8eb..00000000000
--- a/website/public/img/hashicorp-logos/vault-white.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Vault Logo White</title><path d="M1 1l10.692 21.462L22.462 1H1zm11.964 5.55h1.244V5.308h-1.244v1.244zm-1.855 0h1.243V5.308H11.11v1.244zm-1.866 0h1.244V5.308H9.243v1.244zm3.721 1.867h1.244V7.174h-1.244v1.243zm-1.855 0h1.243V7.174H11.11v1.243zm-1.866 0h1.244V7.174H9.243v1.243zm3.732 1.867h1.243V9.04h-1.243v1.244zm-1.866 0h1.243V9.04H11.11v1.244zm-1.866 0h1.244V9.04H9.243v1.244zm1.866 1.866h1.243v-1.244H11.11v1.244z" fill="#FFF" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/hero.png b/website/public/img/hero.png
deleted file mode 100644
index 8110b89e99d..00000000000
Binary files a/website/public/img/hero.png and /dev/null differ
diff --git a/website/public/img/hero@2x.png b/website/public/img/hero@2x.png
deleted file mode 100644
index 05578d59945..00000000000
Binary files a/website/public/img/hero@2x.png and /dev/null differ
diff --git a/website/public/img/home-hero-pattern.svg b/website/public/img/home-hero-pattern.svg
deleted file mode 100644
index 7132c9f0556..00000000000
--- a/website/public/img/home-hero-pattern.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="685" height="394" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M83.334.306c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.369.014.539-.039a.926.926 0 0 0 .418-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.272-.49a1.115 1.115 0 0 0-.66-.204Zm75.999 0c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.928.928 0 0 0 .419-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm-88.666 0c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.297.163.477.19.181.026.369.013.54-.04a.925.925 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204ZM58 .306c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.926.926 0 0 0 .418-.256.577.577 0 0 0 .157-.385.544.544 0 0 0-.07-.266.72.72 0 0 0-.203-.225 1 1 0 0 0-.302-.15A1.215 1.215 0 0 0 58 .306Zm38 0c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49A1.115 1.115 0 0 0 96 .305Zm12.667 0c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.924.924 0 0 0 .418-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.717.717 0 0 0-.202-.225.997.997 0 0 0-.303-.15 1.21 1.21 0 0 0-.356-.053Zm12.666 0c-.184 0-.364.04-.517.117a.787.787 0 0 0-.344.311.529.529 0 0 0-.052.401.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.93.93 0 0 0 .418-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm25.334 0c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.054.401.666.666 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.927.927 0 0 0 .419-.256.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204ZM134 .306c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.053.401.661.661 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.924.924 0 0 0 .418-.256.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49A1.116 1.116 0 0 0 134 .305Zm88.667 0c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.924.924 0 0 0 .418-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.717.717 0 0 0-.202-.225.997.997 0 0 0-.303-.15 1.21 1.21 0 0 0-.356-.053ZM7.333.306c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.539-.04a.926.926 0 0 0 .418-.256A.577.577 0 0 0 8.266 1a.544.544 0 0 0-.071-.266.72.72 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.215 1.215 0 0 0-.357-.053ZM20 .306c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.18.026.368.013.539-.04a.927.927 0 0 0 .418-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49A1.115 1.115 0 0 0 20 .305Zm177.334 0c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.098.296.164.477.19.181.027.369.014.539-.039a.924.924 0 0 0 .418-.256.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm12.666 0c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.924.924 0 0 0 .418-.256.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49A1.112 1.112 0 0 0 210 .305Zm-25.333 0c-.185 0-.365.04-.518.117a.792.792 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.927.927 0 0 0 .419-.256.579.579 0 0 0 .157-.385c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm-152 0c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.532.532 0 0 0-.054.401.664.664 0 0 0 .256.355c.13.098.296.164.477.19.18.027.368.014.538-.039a.926.926 0 0 0 .419-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm12.666 0c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.538-.04a.926.926 0 0 0 .419-.256.577.577 0 0 0 .157-.385.545.545 0 0 0-.071-.266.721.721 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.215 1.215 0 0 0-.357-.053ZM172 .306c-.184 0-.365.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.924.924 0 0 0 .418-.256.574.574 0 0 0 .157-.385.553.553 0 0 0-.07-.266.72.72 0 0 0-.203-.225.991.991 0 0 0-.302-.15A1.218 1.218 0 0 0 172 .306Zm0 196c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-25.333 0c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-12.667 0c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm25.333 0c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm38.001 0c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm-12.667 0c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-152 0c-.184 0-.365.041-.518.117a.783.783 0 0 0-.343.311.531.531 0 0 0-.054.401.661.661 0 0 0 .256.355c.13.098.296.164.477.19.18.027.368.014.538-.039a.915.915 0 0 0 .419-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm177.333 0c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm-164.667 0c-.184 0-.364.041-.518.117a.788.788 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.538-.04a.923.923 0 0 0 .419-.256.576.576 0 0 0 .157-.385.546.546 0 0 0-.071-.266.718.718 0 0 0-.202-.225.99.99 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm-38 0c-.184 0-.364.041-.517.117a.788.788 0 0 0-.344.311.532.532 0 0 0-.053.401.665.665 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.539-.04a.923.923 0 0 0 .418-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.071-.266.718.718 0 0 0-.202-.225.99.99 0 0 0-.303-.15 1.212 1.212 0 0 0-.357-.053Zm50.667 0c-.184 0-.364.041-.518.117a.788.788 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.923.923 0 0 0 .418-.256.576.576 0 0 0 .157-.385.546.546 0 0 0-.07-.266.719.719 0 0 0-.203-.225.99.99 0 0 0-.302-.15 1.213 1.213 0 0 0-.357-.053Zm-38 0c-.184 0-.364.041-.518.117a.783.783 0 0 0-.343.311.531.531 0 0 0-.053.401.661.661 0 0 0 .255.355c.13.098.296.164.477.19.18.027.368.014.539-.039a.915.915 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm88.667 0c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm12.666 0c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.53.53 0 0 0-.052.401.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm101.334 0c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-139.333 0c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.531.531 0 0 0-.053.401.661.661 0 0 0 .255.355c.13.098.296.164.477.19.181.027.369.014.539-.039a.915.915 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.272-.491a1.115 1.115 0 0 0-.66-.203Zm-12.667 0c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.531.531 0 0 0-.053.401.661.661 0 0 0 .255.355c.13.098.297.164.477.19.181.027.369.014.54-.039a.914.914 0 0 0 .418-.256.575.575 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.115 1.115 0 0 0-.66-.203Zm25.333 0c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.531.531 0 0 0-.053.401.661.661 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.915.915 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203ZM229 9.861c.184 0 .365-.04.518-.117a.792.792 0 0 0 .344-.312.534.534 0 0 0 .053-.4.666.666 0 0 0-.255-.356 1.067 1.067 0 0 0-.478-.19 1.23 1.23 0 0 0-.538.04.927.927 0 0 0-.419.255.579.579 0 0 0-.157.386c0 .184.098.36.273.49.175.13.412.204.659.204Zm0 80.278c-.184 0-.365.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.386.553.553 0 0 0-.07-.265.722.722 0 0 0-.203-.226.994.994 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm0 49c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 49c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-81.666c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm0-49c-.184 0-.365.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.013.538-.04a.923.923 0 0 0 .418-.255.574.574 0 0 0 .157-.385.552.552 0 0 0-.07-.266.72.72 0 0 0-.203-.225.991.991 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm0 65.333c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 49c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-147c-.184 0-.365.04-.518.117a.784.784 0 0 0-.343.312.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.929.929 0 0 0 .419-.255.573.573 0 0 0 .156-.386.552.552 0 0 0-.07-.266.722.722 0 0 0-.203-.225.991.991 0 0 0-.302-.15 1.218 1.218 0 0 0-.357-.053Zm0 16.333c-.184 0-.365.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.386.553.553 0 0 0-.07-.265.722.722 0 0 0-.203-.226.994.994 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm0 32.667c-.184 0-.365.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.924.924 0 0 0 .418-.256.574.574 0 0 0 .157-.385.553.553 0 0 0-.07-.266.722.722 0 0 0-.203-.225.994.994 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm0 81.667c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052ZM70.667 65.639c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.54-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204ZM77 171.806c-.184 0-.364.041-.518.117a.783.783 0 0 0-.343.311.531.531 0 0 0-.053.401.661.661 0 0 0 .255.355c.13.098.296.164.477.19.18.027.368.014.538-.039a.914.914 0 0 0 .419-.256.575.575 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0-16.333a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.343.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.039a.932.932 0 0 0 .419-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0 32.666c-.184 0-.364.041-.518.117a.784.784 0 0 0-.343.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.04a.921.921 0 0 0 .419-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm-6.333-171.5c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.54-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm152 32.667c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.312.53.53 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.539-.04a.925.925 0 0 0 .418-.255.542.542 0 0 0 .086-.651.718.718 0 0 0-.202-.226.997.997 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm-152-16.333c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.164.477.19.181.027.369.013.54-.04a.926.926 0 0 0 .418-.255.576.576 0 0 0 .157-.385c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm0 16.333c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.925.925 0 0 0 .419-.255.577.577 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204ZM83.334 163.64c-.185 0-.365.041-.518.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.04a.922.922 0 0 0 .418-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.272-.49a1.115 1.115 0 0 0-.66-.204Zm139.333-98c-.185 0-.365.041-.518.117a.784.784 0 0 0-.343.312.529.529 0 0 0-.053.4.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.718.718 0 0 0-.202-.226 1 1 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053ZM77 41.14c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-16.333c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.114 1.114 0 0 0-.659-.204Zm0-16.333c-.184 0-.365.04-.518.116a.786.786 0 0 0-.343.312.531.531 0 0 0-.054.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.491A1.115 1.115 0 0 0 77 8.473Zm-6.333 73.5c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.54-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.385c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm12.667 98a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.272-.491a1.115 1.115 0 0 0-.66-.203ZM77 57.473c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.576.576 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0 49a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.343.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.039a.932.932 0 0 0 .419-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.783.783 0 0 0-.343.311.531.531 0 0 0-.053.401.667.667 0 0 0 .255.356c.13.097.296.163.477.19.18.026.368.013.538-.04a.914.914 0 0 0 .419-.256.575.575 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0-49c-.184 0-.364.04-.518.117a.785.785 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.18.027.368.014.538-.039a.926.926 0 0 0 .419-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0 65.333c-.184 0-.364.041-.518.117a.784.784 0 0 0-.343.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.04a.921.921 0 0 0 .419-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-49c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm-12.667 98c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.531.531 0 0 0-.053.401.666.666 0 0 0 .256.355c.13.097.296.163.477.19.18.027.368.013.538-.04a.921.921 0 0 0 .419-.255.541.541 0 0 0 .086-.651.72.72 0 0 0-.202-.226 1.013 1.013 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm158.334-171.5c-.185 0-.365.041-.518.117a.784.784 0 0 0-.343.312.529.529 0 0 0-.053.4.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.717.717 0 0 0-.202-.226.997.997 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053ZM64.333 106.473c-.184 0-.364.04-.517.117a.782.782 0 0 0-.344.311.531.531 0 0 0-.053.401.661.661 0 0 0 .256.355c.13.097.296.163.477.19.18.027.368.013.538-.039a.932.932 0 0 0 .419-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.071-.266.717.717 0 0 0-.202-.225.992.992 0 0 0-.303-.151 1.18 1.18 0 0 0-.357-.052Zm0 49c-.184 0-.364.04-.517.117a.782.782 0 0 0-.344.311.531.531 0 0 0-.053.401.661.661 0 0 0 .256.355c.13.097.296.163.477.19.18.027.368.013.538-.039a.932.932 0 0 0 .419-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.071-.266.717.717 0 0 0-.202-.225.992.992 0 0 0-.303-.151 1.18 1.18 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.517.117a.788.788 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.538-.04a.923.923 0 0 0 .419-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.071-.266.717.717 0 0 0-.202-.225.99.99 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm0-32.667c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.531.531 0 0 0-.053.401.666.666 0 0 0 .256.355c.13.097.296.163.477.19.18.027.368.013.538-.04a.921.921 0 0 0 .419-.255.541.541 0 0 0 .086-.651.72.72 0 0 0-.202-.226 1.013 1.013 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.517.117a.788.788 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.538-.04a.923.923 0 0 0 .419-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.071-.266.717.717 0 0 0-.202-.225.99.99 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm19 24.5c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.531.531 0 0 0-.053.401.668.668 0 0 0 .255.356c.13.097.296.163.477.189.181.027.369.014.539-.039a.915.915 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.272-.491a1.115 1.115 0 0 0-.66-.203ZM58 81.973c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.164.478.19.18.027.368.013.538-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.385.543.543 0 0 0-.07-.266.719.719 0 0 0-.203-.225 1 1 0 0 0-.302-.15 1.219 1.219 0 0 0-.357-.053Zm50.667 49c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.995.995 0 0 0-.302-.151 1.187 1.187 0 0 0-.357-.052ZM58 16.639c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386.544.544 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1 1 0 0 0-.302-.15 1.219 1.219 0 0 0-.357-.053Zm0 16.334c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.297.164.478.19.18.027.368.013.538-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.385.544.544 0 0 0-.07-.266.719.719 0 0 0-.203-.225 1 1 0 0 0-.302-.15 1.219 1.219 0 0 0-.357-.053Zm0 16.333c-.184 0-.364.04-.518.117a.785.785 0 0 0-.343.312.531.531 0 0 0-.053.4.665.665 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.927.927 0 0 0 .419-.255.577.577 0 0 0 .156-.386.543.543 0 0 0-.07-.266.72.72 0 0 0-.203-.225 1 1 0 0 0-.302-.15 1.218 1.218 0 0 0-.357-.053Zm6.333-24.5c-.184 0-.364.04-.517.117a.785.785 0 0 0-.344.312.531.531 0 0 0-.053.4.665.665 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.386.543.543 0 0 0-.071-.266.72.72 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.215 1.215 0 0 0-.357-.053Zm158.334 8.167c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.311.529.529 0 0 0-.053.401.66.66 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.013.539-.04a.923.923 0 0 0 .418-.255.578.578 0 0 0 .157-.385.543.543 0 0 0-.071-.266.716.716 0 0 0-.202-.225.997.997 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm-152 147a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.115 1.115 0 0 0-.66-.203Zm0-32.667c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.532.532 0 0 0-.053.401.667.667 0 0 0 .255.356c.13.097.297.163.477.189.181.027.369.014.54-.039a.914.914 0 0 0 .418-.256.575.575 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.115 1.115 0 0 0-.66-.203Zm0 16.333c-.185 0-.365.041-.518.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.54-.04a.921.921 0 0 0 .418-.255.576.576 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm0-32.666a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.115 1.115 0 0 0-.66-.203Zm0-16.334c-.185 0-.365.041-.518.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.54-.04a.921.921 0 0 0 .418-.255.576.576 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm-6.334-24.5c-.184 0-.364.041-.517.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386.544.544 0 0 0-.071-.265.72.72 0 0 0-.202-.226 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.665.665 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.538-.04a.926.926 0 0 0 .419-.256.577.577 0 0 0 .157-.385.544.544 0 0 0-.071-.266.72.72 0 0 0-.202-.225 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.098.296.164.477.19.18.027.368.013.538-.04a.925.925 0 0 0 .419-.255.577.577 0 0 0 .157-.385.543.543 0 0 0-.071-.266.719.719 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm0-49c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.297.164.478.19.18.027.368.013.538-.04a.927.927 0 0 0 .419-.255.577.577 0 0 0 .157-.385.544.544 0 0 0-.071-.266.72.72 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm6.334 89.833c-.185 0-.365.04-.518.117a.785.785 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.297.164.477.19.181.027.369.014.54-.039a.926.926 0 0 0 .418-.256.577.577 0 0 0 .157-.385c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm-12.667 0c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.665.665 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.926.926 0 0 0 .418-.256.577.577 0 0 0 .157-.385.544.544 0 0 0-.07-.266.72.72 0 0 0-.203-.225 1.002 1.002 0 0 0-.302-.15 1.219 1.219 0 0 0-.357-.053Zm6.333-57.167c-.184 0-.364.041-.517.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386.544.544 0 0 0-.071-.265.72.72 0 0 0-.202-.226 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053ZM96 130.973a1.161 1.161 0 0 0-.517.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm126.667-16.334c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053ZM96 16.639c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.663.663 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm6.333 171.5c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052ZM96 81.973c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0 32.666c-.184 0-.364.041-.517.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.922.922 0 0 0 .418-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-16.333c-.184 0-.364.04-.517.117a.785.785 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.927.927 0 0 0 .418-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-32.667c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-16.333c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.539-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm6.333 89.833c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM96 32.973c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm126.667 98c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.175 1.175 0 0 0-.356-.052ZM102.333 24.806c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.662.662 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.93.93 0 0 0 .418-.255.579.579 0 0 0 .157-.386.542.542 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.008 1.008 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.097.297.164.477.19.181.027.369.013.539-.04a.924.924 0 0 0 .418-.255.575.575 0 0 0 .158-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm6.334 171.5c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.995.995 0 0 0-.302-.151 1.187 1.187 0 0 0-.357-.052Zm0-16.334c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0-16.333c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-6.334-40.833c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0-65.334c-.184 0-.364.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.73.73 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0 49c-.184 0-.364.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.73.73 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0 32.667c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-65.333c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.013.538-.04a.927.927 0 0 0 .419-.255.578.578 0 0 0 .157-.385.542.542 0 0 0-.071-.266.728.728 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0 16.333c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.928.928 0 0 0 .419-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053ZM96 147.306c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.532.532 0 0 0-.053.401.667.667 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.915.915 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm126.667-65.333c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.311.529.529 0 0 0-.053.401.66.66 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.04a.923.923 0 0 0 .418-.255.579.579 0 0 0 .157-.385.542.542 0 0 0-.071-.266.716.716 0 0 0-.202-.225.997.997 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm-139.333-49c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.164.477.19.181.027.369.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.272-.49a1.115 1.115 0 0 0-.66-.204Zm6.333 155.166c-.184 0-.365.041-.518.117a.784.784 0 0 0-.343.312.53.53 0 0 0-.054.401.665.665 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.921.921 0 0 0 .419-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm-6.333-171.5c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.027.369.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.272-.49a1.115 1.115 0 0 0-.66-.204Zm6.333 155.167c-.184 0-.365.041-.518.117a.783.783 0 0 0-.343.311.531.531 0 0 0-.054.401.662.662 0 0 0 .255.355c.13.098.297.164.478.19.18.027.368.014.538-.039a.914.914 0 0 0 .419-.256.575.575 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0-16.333a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.343.312.53.53 0 0 0-.054.401.665.665 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.54-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm-6.333-89.834c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.532.532 0 0 0-.053.402.664.664 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.272-.49a1.115 1.115 0 0 0-.66-.204Zm0 32.667c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.369.014.539-.039a.926.926 0 0 0 .418-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.272-.49a1.115 1.115 0 0 0-.66-.204Zm0 16.333c-.185 0-.365.041-.518.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.04a.922.922 0 0 0 .418-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.272-.49a1.115 1.115 0 0 0-.66-.204Zm0-65.333c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.663.663 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.54-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.099-.36-.274-.49a1.115 1.115 0 0 0-.658-.204Zm0 32.667c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.027.369.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.272-.49a1.115 1.115 0 0 0-.66-.204Zm6.333 57.166c-.184 0-.365.041-.518.117a.784.784 0 0 0-.343.312.53.53 0 0 0-.054.401.665.665 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.921.921 0 0 0 .419-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204ZM96 179.973a1.161 1.161 0 0 0-.517.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm-6.333-171.5c-.184 0-.365.04-.518.116a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.54-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0 16.333c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.663.663 0 0 0 .255.356c.13.097.296.163.477.19.18.026.368.013.539-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.114 1.114 0 0 0-.659-.204Zm133 73.5c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.311.529.529 0 0 0-.053.401.661.661 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.924.924 0 0 0 .418-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.718.718 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm-133 24.5c-.184 0-.365.041-.518.117a.783.783 0 0 0-.343.311.531.531 0 0 0-.054.401.668.668 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.914.914 0 0 0 .419-.256.575.575 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm-6.333 8.167a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.272-.491a1.115 1.115 0 0 0-.66-.203ZM96 163.639c-.184 0-.364.041-.517.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.922.922 0 0 0 .418-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm-6.333-57.166a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.343.312.53.53 0 0 0-.054.401.665.665 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.54-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0-16.334c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.054.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-16.333c-.184 0-.365.04-.518.117a.785.785 0 0 0-.343.311.532.532 0 0 0-.054.401.664.664 0 0 0 .255.355c.13.098.297.164.478.19.18.027.368.014.538-.039a.926.926 0 0 0 .419-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-32.667c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.054.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0 16.334c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.054.4.664.664 0 0 0 .255.356c.13.097.297.164.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.576.576 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204ZM58 65.639c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386.544.544 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.002 1.002 0 0 0-.302-.15 1.219 1.219 0 0 0-.357-.053ZM20 49.306c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-16.333c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm6.334 138.833c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.531.531 0 0 0-.053.401.668.668 0 0 0 .255.356c.13.097.297.163.477.189.181.027.369.014.539-.039a.915.915 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.658-.203ZM20 81.973c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-65.334c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.663.663 0 0 0 .255.356c.13.097.296.163.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm6.334 171.5c-.185 0-.365.041-.518.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.922.922 0 0 0 .418-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.658-.204ZM20 65.639c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.18.027.368.013.538-.04a.927.927 0 0 0 .419-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0 32.667c-.184 0-.364.04-.518.117a.785.785 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.18.027.368.014.538-.039a.927.927 0 0 0 .419-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0 49c-.184 0-.364.041-.518.117a.783.783 0 0 0-.343.311.532.532 0 0 0-.053.401.667.667 0 0 0 .255.356c.13.097.296.163.477.189.18.027.368.014.538-.039a.915.915 0 0 0 .419-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.784.784 0 0 0-.343.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.04a.922.922 0 0 0 .419-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-49c-.184 0-.364.041-.518.117a.784.784 0 0 0-.343.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.04a.922.922 0 0 0 .419-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0 16.334a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.343.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.039a.932.932 0 0 0 .419-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm6.334-57.167c-.185 0-.365.04-.518.117a.785.785 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.297.164.477.19.181.027.369.014.539-.039a.927.927 0 0 0 .418-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.658-.204Zm0-49c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.663.663 0 0 0 .255.356c.13.097.297.163.477.19.181.026.369.013.54-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .156-.386c0-.184-.098-.36-.273-.49a1.114 1.114 0 0 0-.658-.204Zm0 16.333c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.658-.204Zm0 16.334c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.164.477.19.181.027.369.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.658-.204Zm0-49c-.185 0-.365.04-.518.116a.786.786 0 0 0-.344.312.532.532 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.18.027.368.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.658-.204Zm0 147a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.658-.203Zm6.333 24.5a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.343.312.53.53 0 0 0-.054.401.665.665 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.54-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm-12.667 0a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.343.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.039a.932.932 0 0 0 .419-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm6.334-57.167c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.531.531 0 0 0-.053.401.668.668 0 0 0 .255.356c.13.097.297.163.477.19.181.026.369.013.539-.04a.915.915 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.658-.203Zm0 16.333c-.185 0-.365.041-.518.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.922.922 0 0 0 .418-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.658-.204Zm0-32.666a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.658-.203Zm6.333 57.166c-.184 0-.365.041-.518.117a.784.784 0 0 0-.343.312.53.53 0 0 0-.054.401.665.665 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.922.922 0 0 0 .419-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm-6.333-73.5c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.658-.204Zm-19-8.166c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.164.477.19.18.027.368.013.539-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.385.543.543 0 0 0-.071-.266.72.72 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm0 16.333c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.665.665 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.539-.04a.926.926 0 0 0 .418-.256.577.577 0 0 0 .157-.385.544.544 0 0 0-.071-.266.722.722 0 0 0-.202-.225 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm0-32.667c-.185 0-.365.041-.518.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.027.368.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386.544.544 0 0 0-.071-.265.722.722 0 0 0-.202-.226 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm0-49c-.185 0-.365.041-.518.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.027.368.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386.544.544 0 0 0-.071-.265.72.72 0 0 0-.202-.226 1 1 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm0 32.667c-.185 0-.365.04-.518.117a.785.785 0 0 0-.344.312.531.531 0 0 0-.052.4.665.665 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386.543.543 0 0 0-.071-.266.722.722 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm0-16.333c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.098.296.164.477.19.18.027.368.013.539-.04a.925.925 0 0 0 .418-.255.576.576 0 0 0 .157-.385.544.544 0 0 0-.071-.266.72.72 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053ZM58 114.639c-.184 0-.364.041-.518.117a.79.79 0 0 0-.343.312.531.531 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.921.921 0 0 0 .418-.255.541.541 0 0 0 .086-.651.72.72 0 0 0-.202-.226 1.013 1.013 0 0 0-.302-.15 1.213 1.213 0 0 0-.357-.053Zm-50.667 49c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.531.531 0 0 0-.053.401.666.666 0 0 0 .256.355c.13.097.296.163.477.19.18.027.368.013.539-.04a.921.921 0 0 0 .418-.255.541.541 0 0 0 .086-.651.72.72 0 0 0-.202-.226 1.013 1.013 0 0 0-.303-.15 1.212 1.212 0 0 0-.357-.053Zm0-49c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.531.531 0 0 0-.053.401.666.666 0 0 0 .256.355c.13.097.296.163.477.19.18.027.368.013.539-.04a.921.921 0 0 0 .418-.255.541.541 0 0 0 .086-.651.72.72 0 0 0-.202-.226 1.013 1.013 0 0 0-.303-.15 1.212 1.212 0 0 0-.357-.053Zm0 16.334c-.184 0-.364.04-.517.117a.782.782 0 0 0-.344.311.531.531 0 0 0-.053.401.662.662 0 0 0 .256.355c.13.097.296.163.477.19.18.027.368.013.538-.039a.932.932 0 0 0 .419-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.071-.266.718.718 0 0 0-.202-.225.992.992 0 0 0-.303-.151 1.18 1.18 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.517.117a.788.788 0 0 0-.344.311.532.532 0 0 0-.053.401.665.665 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.539-.04a.923.923 0 0 0 .418-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.071-.266.718.718 0 0 0-.202-.225.99.99 0 0 0-.303-.15 1.212 1.212 0 0 0-.357-.053Zm6.334-73.5c-.185 0-.365.04-.518.117a.785.785 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.297.164.478.19.18.027.368.014.538-.039a.926.926 0 0 0 .418-.256.577.577 0 0 0 .158-.385c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm0 114.333c-.185 0-.365.041-.518.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.921.921 0 0 0 .418-.255.576.576 0 0 0 .158-.386c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm0-130.666c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.164.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .418-.255.576.576 0 0 0 .158-.385c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm0-32.667c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.925.925 0 0 0 .419-.255.577.577 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.114 1.114 0 0 0-.66-.204Zm0 16.333c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .158-.386c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm0 49c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .158-.386c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm0-81.666c-.185 0-.365.04-.518.116a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .158-.385c0-.184-.099-.36-.273-.491a1.115 1.115 0 0 0-.66-.203Zm0 147a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.115 1.115 0 0 0-.66-.203Zm0-49a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.115 1.115 0 0 0-.66-.203Zm0 65.333c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.531.531 0 0 0-.053.401.667.667 0 0 0 .255.356c.13.097.297.163.478.189.18.027.368.014.538-.039a.914.914 0 0 0 .418-.256.575.575 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.115 1.115 0 0 0-.66-.203Zm0-32.667c-.185 0-.365.041-.518.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.921.921 0 0 0 .418-.255.576.576 0 0 0 .158-.386c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.66-.204Zm0-16.333c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.531.531 0 0 0-.053.401.667.667 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.914.914 0 0 0 .418-.256.575.575 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.115 1.115 0 0 0-.66-.203Zm-6.334 57.167c-.184 0-.364.04-.517.117a.782.782 0 0 0-.344.311.531.531 0 0 0-.053.401.662.662 0 0 0 .256.355c.13.097.296.163.477.19.18.027.368.013.538-.039a.932.932 0 0 0 .419-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.071-.266.718.718 0 0 0-.202-.225.992.992 0 0 0-.303-.151 1.18 1.18 0 0 0-.357-.052Zm44.334 8.166c-.185 0-.365.041-.518.117a.79.79 0 0 0-.343.312.531.531 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.921.921 0 0 0 .418-.255.541.541 0 0 0 .086-.651.72.72 0 0 0-.202-.226 1.013 1.013 0 0 0-.303-.15 1.213 1.213 0 0 0-.356-.053Zm-6.334-171.5c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386.545.545 0 0 0-.071-.265.722.722 0 0 0-.202-.226 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm6.334 155.167c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.923.923 0 0 0 .418-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.07-.266.717.717 0 0 0-.203-.225.99.99 0 0 0-.303-.15 1.213 1.213 0 0 0-.356-.053Zm0-16.333c-.185 0-.365.04-.518.117a.782.782 0 0 0-.343.311.531.531 0 0 0-.053.401.663.663 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.039a.932.932 0 0 0 .419-.256.576.576 0 0 0 .157-.385.546.546 0 0 0-.07-.266.72.72 0 0 0-.203-.225.991.991 0 0 0-.303-.151 1.18 1.18 0 0 0-.356-.052Zm0-16.334c-.185 0-.365.041-.518.117a.79.79 0 0 0-.343.312.531.531 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.921.921 0 0 0 .418-.255.541.541 0 0 0 .086-.651.72.72 0 0 0-.202-.226 1.013 1.013 0 0 0-.303-.15 1.213 1.213 0 0 0-.356-.053ZM45.333 32.973c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.098.296.164.477.19.18.027.368.013.538-.04a.925.925 0 0 0 .419-.255.577.577 0 0 0 .157-.385.545.545 0 0 0-.071-.266.72.72 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm0 32.666c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386.545.545 0 0 0-.071-.265.722.722 0 0 0-.202-.226 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm0 49c-.184 0-.364.041-.518.117a.79.79 0 0 0-.343.312.531.531 0 0 0-.053.401.666.666 0 0 0 .256.355c.13.097.296.163.477.19.18.027.368.013.538-.04a.921.921 0 0 0 .419-.255.542.542 0 0 0 .086-.651.722.722 0 0 0-.202-.226 1.013 1.013 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm0-65.333c-.184 0-.364.04-.518.117a.785.785 0 0 0-.343.312.531.531 0 0 0-.053.4.665.665 0 0 0 .256.356c.13.097.296.163.477.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386.543.543 0 0 0-.071-.266.72.72 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.218 1.218 0 0 0-.357-.053Zm0 49c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.665.665 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.538-.04a.926.926 0 0 0 .419-.256.577.577 0 0 0 .157-.385.545.545 0 0 0-.071-.266.722.722 0 0 0-.202-.225 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm6.334 24.5c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.923.923 0 0 0 .418-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.07-.266.717.717 0 0 0-.203-.225.99.99 0 0 0-.303-.15 1.213 1.213 0 0 0-.356-.053Zm-6.334-40.833c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.164.477.19.18.027.368.013.538-.04a.925.925 0 0 0 .419-.255.577.577 0 0 0 .157-.385.544.544 0 0 0-.071-.266.72.72 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.219 1.219 0 0 0-.357-.053Zm6.334-40.834c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386.544.544 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.356-.053ZM58 163.64c-.184 0-.364.041-.518.117a.79.79 0 0 0-.343.312.531.531 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.921.921 0 0 0 .418-.255.541.541 0 0 0 .086-.651.72.72 0 0 0-.202-.226 1.013 1.013 0 0 0-.302-.15 1.213 1.213 0 0 0-.357-.053Zm0 16.334c-.184 0-.364.04-.518.117a.782.782 0 0 0-.343.311.531.531 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385.546.546 0 0 0-.07-.266.72.72 0 0 0-.203-.225.991.991 0 0 0-.302-.151 1.18 1.18 0 0 0-.357-.052Zm0-32.667c-.184 0-.364.041-.518.117a.788.788 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.923.923 0 0 0 .418-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.07-.266.717.717 0 0 0-.203-.225.99.99 0 0 0-.302-.15 1.213 1.213 0 0 0-.357-.053ZM51.667 8.473c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.531.531 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.297.164.478.19.18.027.368.013.538-.04a.927.927 0 0 0 .419-.255.577.577 0 0 0 .157-.385.545.545 0 0 0-.07-.266.723.723 0 0 0-.203-.225 1 1 0 0 0-.303-.15 1.215 1.215 0 0 0-.356-.053ZM58 130.973c-.184 0-.364.04-.518.117a.782.782 0 0 0-.343.311.531.531 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385.546.546 0 0 0-.07-.266.72.72 0 0 0-.203-.225.991.991 0 0 0-.302-.151 1.18 1.18 0 0 0-.357-.052Zm-6.333-24.5c-.185 0-.365.04-.518.117a.782.782 0 0 0-.343.311.531.531 0 0 0-.053.401.663.663 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.538-.039a.932.932 0 0 0 .419-.256.576.576 0 0 0 .157-.385.546.546 0 0 0-.07-.266.72.72 0 0 0-.203-.225.991.991 0 0 0-.303-.151 1.18 1.18 0 0 0-.356-.052Zm0-16.334c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386.544.544 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.356-.053Zm0-65.333c-.185 0-.365.04-.518.117a.785.785 0 0 0-.343.312.531.531 0 0 0-.053.4.665.665 0 0 0 .255.356c.13.097.296.163.477.19.181.026.369.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.386.543.543 0 0 0-.07-.266.72.72 0 0 0-.203-.225 1 1 0 0 0-.303-.15 1.215 1.215 0 0 0-.356-.053Zm0 49c-.185 0-.365.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.665.665 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.926.926 0 0 0 .418-.256.577.577 0 0 0 .157-.385.544.544 0 0 0-.07-.266.72.72 0 0 0-.203-.225 1.002 1.002 0 0 0-.303-.15 1.219 1.219 0 0 0-.356-.053Zm0-16.333c-.185 0-.365.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.385.543.543 0 0 0-.07-.266.719.719 0 0 0-.203-.225 1 1 0 0 0-.303-.15 1.219 1.219 0 0 0-.356-.053Zm-6.334 73.5c-.184 0-.364.04-.518.117a.782.782 0 0 0-.343.311.531.531 0 0 0-.053.401.663.663 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .158-.385.546.546 0 0 0-.071-.266.72.72 0 0 0-.202-.225.992.992 0 0 0-.303-.151 1.18 1.18 0 0 0-.357-.052Zm-12.666-16.334c-.184 0-.365.041-.518.117a.784.784 0 0 0-.343.312.53.53 0 0 0-.054.401.665.665 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.922.922 0 0 0 .419-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm12.666 32.667c-.184 0-.364.041-.518.117a.788.788 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .256.356c.13.097.296.163.477.19.18.026.368.013.538-.04a.923.923 0 0 0 .419-.256.576.576 0 0 0 .157-.385.546.546 0 0 0-.071-.266.719.719 0 0 0-.202-.225.99.99 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm-12.666-98c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.18.027.368.013.539-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-32.667c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.054.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204ZM39 171.806c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.531.531 0 0 0-.053.401.661.661 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.915.915 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.517.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.922.922 0 0 0 .418-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm-6.333-40.833c-.184 0-.365.041-.518.117a.783.783 0 0 0-.343.311.531.531 0 0 0-.054.401.662.662 0 0 0 .255.355c.13.098.297.164.478.19.18.027.368.014.538-.039a.915.915 0 0 0 .419-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203ZM39 155.473a1.161 1.161 0 0 0-.517.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm-6.333-24.5a1.161 1.161 0 0 0-.518.116.79.79 0 0 0-.343.312.53.53 0 0 0-.054.401.665.665 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.54-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0-32.667c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.532.532 0 0 0-.054.401.664.664 0 0 0 .255.355c.13.098.297.164.478.19.18.027.368.014.538-.039a.926.926 0 0 0 .419-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-32.667c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.532.532 0 0 0-.054.402.664.664 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.927.927 0 0 0 .419-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0 16.334c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.054.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.927.927 0 0 0 .419-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-49c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.054.4.664.664 0 0 0 .255.356c.13.097.297.164.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204ZM39 139.139c-.184 0-.364.041-.517.117a.784.784 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.922.922 0 0 0 .418-.255.576.576 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-114.333c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.663.663 0 0 0 .255.356c.13.097.297.163.477.19.181.026.369.013.539-.04a.925.925 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm6.333 155.166a1.176 1.176 0 0 0-.518.118.782.782 0 0 0-.343.311.531.531 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .158-.385.545.545 0 0 0-.071-.266.718.718 0 0 0-.202-.225.992.992 0 0 0-.303-.151 1.213 1.213 0 0 0-.357-.053ZM39 41.139c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm6.333 122.5c-.184 0-.364.041-.518.117a.79.79 0 0 0-.343.312.531.531 0 0 0-.053.401.666.666 0 0 0 .256.355c.13.097.296.163.477.19.18.027.368.013.538-.04a.921.921 0 0 0 .419-.255.542.542 0 0 0 .086-.651.722.722 0 0 0-.202-.226 1.013 1.013 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053ZM39 8.473c-.184 0-.364.04-.518.116a.786.786 0 0 0-.343.312.532.532 0 0 0-.053.4.665.665 0 0 0 .255.356c.13.097.296.163.477.19.18.027.368.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.491A1.115 1.115 0 0 0 39 8.473Zm0 98a1.161 1.161 0 0 0-.517.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.665.665 0 0 0 .255.355c.13.097.296.163.477.19.18.027.368.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.531.531 0 0 0-.053.401.667.667 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.915.915 0 0 0 .418-.256.576.576 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.115 1.115 0 0 0-.659-.203Zm0-49c-.184 0-.364.04-.517.117a.785.785 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.927.927 0 0 0 .418-.256.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0-16.333c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm0 32.666c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.927.927 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm158.334 24.5c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm-19.001-57.166c-.184 0-.364.04-.517.117a.787.787 0 0 0-.344.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.355c.13.098.296.164.477.19.181.027.368.013.538-.04a.927.927 0 0 0 .419-.255.578.578 0 0 0 .157-.385.542.542 0 0 0-.071-.266.728.728 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0 49c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0 32.666c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-49c-.184 0-.364.04-.517.117a.787.787 0 0 0-.344.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.538-.04a.928.928 0 0 0 .419-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0 16.333c-.184 0-.364.041-.517.117a.787.787 0 0 0-.344.312.534.534 0 0 0-.053.4.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.73.73 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0 65.334c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052ZM172 32.973c-.184 0-.365.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.013.538-.04a.923.923 0 0 0 .418-.255.574.574 0 0 0 .157-.385.552.552 0 0 0-.07-.266.72.72 0 0 0-.203-.225.991.991 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm6.333 138.833c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM172 16.639c-.184 0-.365.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.386.553.553 0 0 0-.07-.265.72.72 0 0 0-.203-.226.991.991 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm44.333 106.167c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-31.666-73.5c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.927.927 0 0 0 .419-.255.579.579 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm-6.334-8.167c-.184 0-.364.041-.517.117a.787.787 0 0 0-.344.312.534.534 0 0 0-.053.4.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.73.73 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm6.334 106.167c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.014.538-.039a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.333a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.185 0-.365.04-.518.117a.792.792 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.014.538-.039a.933.933 0 0 0 .419-.256.579.579 0 0 0 .157-.385c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0 16.333c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-49c-.185 0-.365.04-.518.117a.791.791 0 0 0-.344.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.934.934 0 0 0 .419-.255.579.579 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0 16.334c-.185 0-.365.04-.518.117a.791.791 0 0 0-.344.311.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.934.934 0 0 0 .419-.255.579.579 0 0 0 .157-.385c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204ZM172 49.306c-.184 0-.365.04-.518.117a.784.784 0 0 0-.343.312.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.929.929 0 0 0 .419-.255.573.573 0 0 0 .156-.386.552.552 0 0 0-.07-.266.722.722 0 0 0-.203-.225.991.991 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm6.333-40.833c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm0 16.333c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.312.529.529 0 0 0-.052.4.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.925.925 0 0 0 .418-.255.579.579 0 0 0 .157-.386.542.542 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.008 1.008 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm38 114.333c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-31.666 40.834a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-76-65.334c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm69.666 73.5c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-12.666-65.333c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0 16.333c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm6.333-73.5c-.184 0-.365.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.386.553.553 0 0 0-.07-.265.722.722 0 0 0-.203-.226.994.994 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm-6.333 40.834c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.175 1.175 0 0 0-.356-.052Zm0-16.334c-.185 0-.365.041-.518.117a.783.783 0 0 0-.343.312.529.529 0 0 0-.053.4.661.661 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.718.718 0 0 0-.202-.226 1 1 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm0-16.333c-.185 0-.365.04-.518.117a.783.783 0 0 0-.343.311.529.529 0 0 0-.053.401.661.661 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.924.924 0 0 0 .418-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.718.718 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.211 1.211 0 0 0-.356-.053Zm0 98c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-6.334-122.5c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.93.93 0 0 0 .418-.255.579.579 0 0 0 .157-.386.542.542 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.008 1.008 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.013.538-.04a.927.927 0 0 0 .419-.255.578.578 0 0 0 .157-.385.543.543 0 0 0-.071-.266.728.728 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm6.334 155.166c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-6.334-171.5c-.184 0-.364.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.73.73 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm57 73.5c-.184 0-.364.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.73.73 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm-50.666 65.334c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.175 1.175 0 0 0-.356-.052Zm6.333 8.166c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-49c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 32.667c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-16.333c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm0-32.667c-.184 0-.365.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.924.924 0 0 0 .418-.256.574.574 0 0 0 .157-.385.553.553 0 0 0-.07-.266.722.722 0 0 0-.203-.225.994.994 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm0-16.333c-.184 0-.365.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.04a.923.923 0 0 0 .418-.255.574.574 0 0 0 .157-.385.552.552 0 0 0-.07-.266.72.72 0 0 0-.203-.225.991.991 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm-6.333-57.167c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.312.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.297.163.477.19.181.026.369.013.539-.04a.925.925 0 0 0 .418-.255.542.542 0 0 0 .086-.651.718.718 0 0 0-.202-.226.997.997 0 0 0-.303-.15 1.211 1.211 0 0 0-.356-.053Zm0 16.333c-.185 0-.365.041-.518.117a.784.784 0 0 0-.343.312.529.529 0 0 0-.053.4.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.718.718 0 0 0-.202-.226 1 1 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm0 16.334c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.311.529.529 0 0 0-.053.401.66.66 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.013.539-.04a.923.923 0 0 0 .418-.255.578.578 0 0 0 .157-.385.542.542 0 0 0-.071-.266.716.716 0 0 0-.202-.225.997.997 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm6.333 122.5c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm-6.333-171.5c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.355c.13.097.296.164.477.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.718.718 0 0 0-.202-.225.997.997 0 0 0-.303-.15 1.211 1.211 0 0 0-.356-.053Zm50.666 98c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm-12.666 0a1.162 1.162 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-44.334-40.834c-.184 0-.364.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.73.73 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm44.334 73.5c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-16.333c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.67.67 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.312.53.53 0 0 0-.054.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0-49c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.312.53.53 0 0 0-.054.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm-6.333-8.166c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.164.477.19.181.027.369.013.539-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.658-.204Zm6.333 40.833c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.054.401.666.666 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.928.928 0 0 0 .419-.256.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm12.666 114.333c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-12.666-32.666a1.162 1.162 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.333-138.834c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.369.013.539-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm6.333 155.167c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-130.666c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.054.4.666.666 0 0 0 .255.356c.131.097.297.164.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm6.333 24.5c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.311.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0 16.333c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.924.924 0 0 0 .418-.256.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm-6.333-73.5c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.054.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.929.929 0 0 0 .418-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204ZM210 65.64c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.312.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0 65.334a1.165 1.165 0 0 0-.518.116.793.793 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-81.667c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.369.013.539-.04a.923.923 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.114 1.114 0 0 0-.659-.204Zm0 65.333c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204ZM203.667 8.473c-.184 0-.365.04-.518.116a.792.792 0 0 0-.344.312.534.534 0 0 0-.053.4.667.667 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.539-.04a.933.933 0 0 0 .419-.255.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204ZM210 16.639c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.312.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0 163.334a1.165 1.165 0 0 0-.518.116.793.793 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-32.667c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm-12.666 16.334a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.272-.491a1.116 1.116 0 0 0-.659-.203ZM191 90.139c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.312.529.529 0 0 0-.053.4.661.661 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0 16.334a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-65.333c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0 16.333c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.053.401.661.661 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.925.925 0 0 0 .418-.256.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0 65.333c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0 32.667c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.333-155.167c-.185 0-.365.04-.518.117a.791.791 0 0 0-.344.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.933.933 0 0 0 .419-.255.579.579 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm31.666 138.834c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm-25.333 0a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 32.666c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-147c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.312.529.529 0 0 0-.053.4.661.661 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm6.334 40.834c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.369.013.539-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm12.666-49c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm-12.666 65.333c-.185 0-.365.04-.518.117a.787.787 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.098.296.164.477.19.181.027.369.014.539-.039a.924.924 0 0 0 .418-.256.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm0-49c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.918.918 0 0 0 .418-.255.57.57 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm0 81.666c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.118 1.118 0 0 0-.658-.204Zm0-65.333c-.185 0-.365.04-.518.117a.787.787 0 0 0-.344.311.534.534 0 0 0-.053.402.667.667 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm-12.667-32.666c-.185 0-.365.04-.518.117a.791.791 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.04a.933.933 0 0 0 .419-.255.579.579 0 0 0 .157-.385c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204ZM191 8.473c-.184 0-.365.04-.518.116a.783.783 0 0 0-.343.312.53.53 0 0 0-.054.4.667.667 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.927.927 0 0 0 .419-.255.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.491a1.116 1.116 0 0 0-.659-.203Zm25.333 163.333c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM191 24.806c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.923.923 0 0 0 .418-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.115 1.115 0 0 0-.659-.204Zm6.334 138.833c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0-16.333c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm-12.667 16.333c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm-57 8.167c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.014.538-.039a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-81.666a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 49a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm31.666-73.5c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.097.297.164.478.19.181.027.368.013.538-.04a.927.927 0 0 0 .419-.255.579.579 0 0 0 .157-.385.542.542 0 0 0-.071-.266.728.728 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm-31.666 57.166c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm95 40.834c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.175 1.175 0 0 0-.356-.052ZM121.333 65.639c-.184 0-.364.041-.517.117a.787.787 0 0 0-.344.312.529.529 0 0 0-.052.4.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.93.93 0 0 0 .418-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.73.73 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0 16.334c-.184 0-.364.04-.517.117a.787.787 0 0 0-.344.311.529.529 0 0 0-.052.401.656.656 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.04a.929.929 0 0 0 .418-.255.579.579 0 0 0 .157-.385.542.542 0 0 0-.071-.266.728.728 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0-32.667c-.184 0-.364.04-.517.117a.786.786 0 0 0-.344.312.533.533 0 0 0-.052.4.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.579.579 0 0 0 .157-.386.542.542 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.008 1.008 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.04-.517.117a.787.787 0 0 0-.344.311.529.529 0 0 0-.052.401.656.656 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.013.539-.04a.929.929 0 0 0 .418-.255.578.578 0 0 0 .157-.385.543.543 0 0 0-.071-.266.728.728 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0 65.333c-.184 0-.364.04-.517.117a.787.787 0 0 0-.344.311.529.529 0 0 0-.052.401.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.93.93 0 0 0 .418-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm0-81.667c-.184 0-.364.041-.517.117a.787.787 0 0 0-.344.312.529.529 0 0 0-.052.4.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.93.93 0 0 0 .418-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.729.729 0 0 0-.202-.226 1.009 1.009 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm12.667 147c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-65.333c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.053.401.661.661 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.925.925 0 0 0 .418-.256.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0 49c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.333-57.167c-.185 0-.365.04-.518.117a.791.791 0 0 0-.344.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.934.934 0 0 0 .419-.255.579.579 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm88.666-81.666c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.097.297.164.477.19.181.027.369.013.539-.04a.924.924 0 0 0 .418-.255.575.575 0 0 0 .158-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.009 1.009 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053ZM134 130.973a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.334c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204ZM127.667 8.473c-.185 0-.365.04-.518.116a.786.786 0 0 0-.344.312.534.534 0 0 0-.053.4.667.667 0 0 0 .255.356c.13.097.296.163.477.19.181.027.369.013.539-.04a.924.924 0 0 0 .418-.255.575.575 0 0 0 .158-.385c0-.184-.099-.36-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 49c-.185 0-.365.04-.518.117a.791.791 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.04a.933.933 0 0 0 .419-.255.579.579 0 0 0 .157-.385c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0 16.333c-.185 0-.365.04-.518.117a.791.791 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.014.538-.039a.934.934 0 0 0 .419-.256.579.579 0 0 0 .157-.385c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0-32.667c-.185 0-.365.04-.518.117a.791.791 0 0 0-.344.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.934.934 0 0 0 .419-.255.579.579 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0-16.333c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.927.927 0 0 0 .419-.255.579.579 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.115 1.115 0 0 0-.659-.204ZM134 179.973a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-19 8.166c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm107.667-40.833c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053ZM115 171.806c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-32.667c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-6.333-122.5c-.185 0-.365.041-.518.117a.784.784 0 0 0-.343.312.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.718.718 0 0 0-.202-.226 1 1 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053ZM115 155.473c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm-6.333-57.167c-.185 0-.365.04-.518.117a.783.783 0 0 0-.343.311.529.529 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.924.924 0 0 0 .418-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.718.718 0 0 0-.202-.225 1 1 0 0 0-.303-.15 1.211 1.211 0 0 0-.356-.053Zm6.333 24.5c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-6.333-40.833c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.311.529.529 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.717.717 0 0 0-.202-.225.997.997 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm0-32.667c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.312.53.53 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.539-.04a.925.925 0 0 0 .418-.255.542.542 0 0 0 .086-.651.718.718 0 0 0-.202-.226.997.997 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm0 16.333c-.185 0-.365.041-.518.117a.784.784 0 0 0-.343.312.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.718.718 0 0 0-.202-.226 1 1 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm0-32.666c-.185 0-.365.04-.518.117a.784.784 0 0 0-.343.311.529.529 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.579.579 0 0 0 .157-.385.542.542 0 0 0-.071-.266.716.716 0 0 0-.202-.225.997.997 0 0 0-.303-.15 1.214 1.214 0 0 0-.356-.053Zm12.666 81.666c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.529.529 0 0 0-.052.401.657.657 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 65.334c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0-16.334c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.529.529 0 0 0-.052.401.657.657 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM115 8.473c-.184 0-.365.04-.518.117a.784.784 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.097.296.164.477.19.181.027.369.013.539-.04a.924.924 0 0 0 .418-.255.542.542 0 0 0 .087-.651.721.721 0 0 0-.203-.225.992.992 0 0 0-.302-.15 1.218 1.218 0 0 0-.357-.053Zm107.667 155.166c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-101.334-32.666c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.53.53 0 0 0-.052.401.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM115 106.473c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm0-16.334c-.184 0-.365.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.924.924 0 0 0 .418-.255.542.542 0 0 0 .087-.651.722.722 0 0 0-.203-.226.994.994 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm0-16.333c-.184 0-.365.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.924.924 0 0 0 .418-.256.542.542 0 0 0 .087-.651.722.722 0 0 0-.203-.225.994.994 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm0-32.667c-.184 0-.365.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.924.924 0 0 0 .418-.255.542.542 0 0 0 .087-.651.722.722 0 0 0-.203-.226.994.994 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm0 16.334c-.184 0-.365.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.013.538-.04a.923.923 0 0 0 .418-.255.574.574 0 0 0 .157-.385.541.541 0 0 0-.07-.266.72.72 0 0 0-.203-.225.991.991 0 0 0-.302-.15 1.221 1.221 0 0 0-.357-.053Zm0-32.667c-.184 0-.365.04-.518.117a.784.784 0 0 0-.343.312.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.929.929 0 0 0 .419-.255.573.573 0 0 0 .156-.386.552.552 0 0 0-.07-.266.722.722 0 0 0-.203-.225.991.991 0 0 0-.302-.15 1.218 1.218 0 0 0-.357-.053Zm12.667 98c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.014.538-.039a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203ZM153 139.139c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0 49c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0-16.333c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-16.333a1.165 1.165 0 0 0-.518.116.793.793 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-32.667c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-16.333a1.165 1.165 0 0 0-.518.116.793.793 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm63.333-49c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm-69.666-8.167c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.054.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.923.923 0 0 0 .418-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204ZM153 90.14c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.312.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm-6.333-24.5c-.184 0-.365.04-.518.117a.784.784 0 0 0-.343.311.53.53 0 0 0-.054.402.666.666 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0-32.666c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.054.4.666.666 0 0 0 .255.356c.131.097.297.164.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0-16.334c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.312.53.53 0 0 0-.054.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm12.666 114.334c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 16.333c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-12.666-81.666c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.054.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm12.666 32.666c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 65.334c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0-81.667c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.928.928 0 0 0 .419-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.01 1.01 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053ZM153 8.473c-.184 0-.364.04-.518.116a.783.783 0 0 0-.343.312.53.53 0 0 0-.053.4.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0 49c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.311.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.164.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0-16.334c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.312.529.529 0 0 0-.053.4.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0 32.667c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.923.923 0 0 0 .418-.256.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0-49c-.184 0-.364.04-.518.117a.789.789 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.369.013.539-.04a.923.923 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm63.333 49c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.928.928 0 0 0 .419-.256.579.579 0 0 0 .157-.385.543.543 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.01 1.01 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053Zm-75.999 0c-.185 0-.365.04-.518.117a.787.787 0 0 0-.344.311.534.534 0 0 0-.053.401.667.667 0 0 0 .255.355c.13.098.297.164.477.19.181.027.369.014.539-.039a.924.924 0 0 0 .418-.256.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm0 65.333c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0 16.334a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0 16.333c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.297.164.477.19.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0-65.333a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0 81.666c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0-98c-.185 0-.365.04-.518.117a.787.787 0 0 0-.344.311.534.534 0 0 0-.053.402.666.666 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.925.925 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm0 32.667c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.297.164.477.19.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203ZM134 49.306c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.923.923 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0 16.333c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.312.529.529 0 0 0-.053.4.661.661 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm82.333-40.833c-.184 0-.364.04-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.93.93 0 0 0 .418-.255.579.579 0 0 0 .157-.386.542.542 0 0 0-.071-.266.73.73 0 0 0-.202-.225 1.008 1.008 0 0 0-.303-.15 1.213 1.213 0 0 0-.357-.053ZM134 16.64c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.312.529.529 0 0 0-.053.4.661.661 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.579.579 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm0 16.334c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.311.529.529 0 0 0-.053.4.66.66 0 0 0 .255.356c.13.097.296.164.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm6.334-8.167c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.927.927 0 0 0 .419-.255.573.573 0 0 0 .156-.386c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm6.333 155.166c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.312.533.533 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.124 1.124 0 0 0-.659-.204Zm0-49c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.312.533.533 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.124 1.124 0 0 0-.659-.204Zm0 32.667c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-16.333c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204ZM134 81.973c-.184 0-.364.04-.518.117a.783.783 0 0 0-.343.311.529.529 0 0 0-.053.4.661.661 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204Zm6.334-73.5c-.185 0-.365.04-.518.116a.786.786 0 0 0-.344.312.53.53 0 0 0-.053.4.661.661 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.491a1.111 1.111 0 0 0-.658-.204Zm75.999 32.666c-.184 0-.364.041-.518.117a.79.79 0 0 0-.343.312.534.534 0 0 0-.053.4.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.928.928 0 0 0 .419-.255.579.579 0 0 0 .157-.386.543.543 0 0 0-.071-.265.73.73 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.216 1.216 0 0 0-.357-.053Zm-75.999 0c-.185 0-.365.04-.518.117a.787.787 0 0 0-.344.312.534.534 0 0 0-.053.4.667.667 0 0 0 .255.356c.13.097.297.163.477.19.181.027.369.013.539-.04a.924.924 0 0 0 .418-.255.574.574 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm0 16.334c-.185 0-.365.04-.518.117a.786.786 0 0 0-.344.31.534.534 0 0 0-.053.402.666.666 0 0 0 .255.355c.13.097.297.164.477.19.181.027.369.013.539-.04a.925.925 0 0 0 .418-.255.574.574 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.11 1.11 0 0 0-.658-.204Zm6.333 40.833c-.184 0-.365.04-.518.117a.783.783 0 0 0-.343.311.53.53 0 0 0-.054.401.667.667 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.927.927 0 0 0 .419-.256.579.579 0 0 0 .157-.385c0-.184-.098-.36-.273-.49a1.116 1.116 0 0 0-.659-.204ZM1 155.473c-.184 0-.365.04-.518.117a.782.782 0 0 0-.343.311.531.531 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.07-.266.718.718 0 0 0-.203-.225.992.992 0 0 0-.302-.151 1.18 1.18 0 0 0-.357-.052Zm0-16.334c-.184 0-.365.041-.518.117a.79.79 0 0 0-.343.312.531.531 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.921.921 0 0 0 .418-.255.541.541 0 0 0 .086-.651.72.72 0 0 0-.202-.226 1.013 1.013 0 0 0-.302-.15 1.212 1.212 0 0 0-.357-.053Zm0 49c-.184 0-.365.041-.518.117a.79.79 0 0 0-.343.312.531.531 0 0 0-.053.401.666.666 0 0 0 .255.355c.13.097.297.163.478.19.18.027.368.013.538-.04a.921.921 0 0 0 .418-.255.541.541 0 0 0 .086-.651.72.72 0 0 0-.202-.226 1.013 1.013 0 0 0-.302-.15 1.212 1.212 0 0 0-.357-.053Zm0-16.333c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.923.923 0 0 0 .418-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.07-.266.718.718 0 0 0-.203-.225.99.99 0 0 0-.302-.15 1.212 1.212 0 0 0-.357-.053Zm0-49c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.311.532.532 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.923.923 0 0 0 .418-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.07-.266.718.718 0 0 0-.203-.225.99.99 0 0 0-.302-.15 1.212 1.212 0 0 0-.357-.053Zm0-81.667c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386.544.544 0 0 0-.07-.265.722.722 0 0 0-.203-.226 1.002 1.002 0 0 0-.302-.15A1.219 1.219 0 0 0 1 41.139Zm0 65.334c-.184 0-.365.04-.518.117a.782.782 0 0 0-.343.311.531.531 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.932.932 0 0 0 .418-.256.576.576 0 0 0 .157-.385.545.545 0 0 0-.07-.266.718.718 0 0 0-.203-.225.992.992 0 0 0-.302-.151 1.18 1.18 0 0 0-.357-.052Zm0-81.667c-.184 0-.365.04-.518.117a.785.785 0 0 0-.343.312.531.531 0 0 0-.053.4.665.665 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.926.926 0 0 0 .419-.255.577.577 0 0 0 .156-.386.544.544 0 0 0-.07-.266.722.722 0 0 0-.203-.225 1 1 0 0 0-.302-.15A1.215 1.215 0 0 0 1 24.806ZM1 8.473c-.184 0-.365.04-.518.117A.786.786 0 0 0 .14 8.9a.531.531 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.369.013.539-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.385.544.544 0 0 0-.07-.266.721.721 0 0 0-.203-.225 1 1 0 0 0-.302-.15A1.216 1.216 0 0 0 1 8.472Zm0 49c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.297.164.478.19.18.027.368.013.538-.04a.925.925 0 0 0 .418-.255.576.576 0 0 0 .157-.385.543.543 0 0 0-.07-.266.72.72 0 0 0-.203-.225 1 1 0 0 0-.302-.15A1.219 1.219 0 0 0 1 57.472Zm0 32.666c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.312.531.531 0 0 0-.053.4.664.664 0 0 0 .255.356c.13.097.297.163.478.19.18.027.368.013.538-.04a.926.926 0 0 0 .418-.255.577.577 0 0 0 .157-.386.544.544 0 0 0-.07-.265.722.722 0 0 0-.203-.226 1.002 1.002 0 0 0-.302-.15A1.219 1.219 0 0 0 1 90.139Zm0-16.333c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.531.531 0 0 0-.053.401.665.665 0 0 0 .255.356c.13.097.297.163.478.19.18.026.368.013.538-.04a.926.926 0 0 0 .418-.256.577.577 0 0 0 .157-.385.544.544 0 0 0-.07-.266.722.722 0 0 0-.203-.225 1.002 1.002 0 0 0-.302-.15A1.219 1.219 0 0 0 1 73.806ZM538.334 196.306c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.297.163.477.189.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm75.999 0c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-88.666 0c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.014.538-.039a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-12.667 0c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm38 0c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm12.667 0c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm12.666 0c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.53.53 0 0 0-.052.401.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm25.334 0c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-12.667 0c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm88.667 0c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-215.334 0c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.052.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm12.667 0c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm177.334 0c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm12.666 0c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm-25.333 0c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-152 0c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm12.666 0c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm126.667 0c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 196c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-25.333 0c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-12.667 0c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm25.333 0c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm38.001 0c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm-12.667 0c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-152 0c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm177.333 0c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm-164.667 0c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-38 0c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.052.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm50.667 0c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-38 0c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm88.667 0c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm12.666 0c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.53.53 0 0 0-.052.401.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm101.334 0c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-139.333 0c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.297.164.477.19.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm-12.667 0c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm25.333 0c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm133-186.445c.184 0 .365-.041.518-.117a.79.79 0 0 0 .344-.312.533.533 0 0 0 .053-.401.668.668 0 0 0-.255-.355 1.07 1.07 0 0 0-.478-.19 1.235 1.235 0 0 0-.538.039.933.933 0 0 0-.419.256.578.578 0 0 0-.157.386c0 .184.098.36.273.49.175.13.412.204.659.204Zm0 80.278c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 49c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 49c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-81.666c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm0-49c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.248 1.248 0 0 0-.357-.052Zm0 65.333c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 49c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-147c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.916.916 0 0 0 .419-.256.572.572 0 0 0 .156-.385.554.554 0 0 0-.07-.266.729.729 0 0 0-.203-.225 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 16.333c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 32.667c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 81.667c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm-158.333-89.834c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204ZM532 367.806c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.333a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 32.666c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm-6.333-171.5c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm152 32.667c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385.544.544 0 0 0-.071-.266.725.725 0 0 0-.202-.225 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-152-16.333c-.185 0-.365.04-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.185 0-.365.041-.518.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.582.582 0 0 0 .157-.386c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm12.667 114.333c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm139.333-98c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053ZM532 237.139c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-16.333c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.333a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.53.53 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.333 73.5c-.185 0-.365.04-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm12.667 98a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203ZM532 253.473c-.184 0-.364.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 49a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-49c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 65.333c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-49c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm-12.667 98c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm158.334-171.5c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-158.334 89.834c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0 49c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.052.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-32.667c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.052.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm19.001 24.5c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.297.163.477.189.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203ZM513 277.973c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.248 1.248 0 0 0-.357-.052Zm50.667 49c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.995.995 0 0 0-.302-.151 1.187 1.187 0 0 0-.357-.052ZM513 212.639c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 16.334c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.248 1.248 0 0 0-.357-.052Zm0 16.333c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.916.916 0 0 0 .419-.256.572.572 0 0 0 .156-.385.554.554 0 0 0-.07-.266.729.729 0 0 0-.203-.225 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm6.333-24.5c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.738.738 0 0 0-.202-.225 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm158.334 8.167c-.185 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.241 1.241 0 0 0-.356-.052Zm-152 147a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.014.538-.039a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-32.666a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.334c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm-6.334-24.5c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.052.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.052.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm0-49c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm6.334 89.833c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-12.667 0c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm6.333-57.167c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM551 326.973a1.165 1.165 0 0 0-.518.116.793.793 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm126.667-16.334c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-126.667-98c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm6.333 171.5c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm-6.333-73.5c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0 32.666c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0-16.333c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-32.667c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0-16.333c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm6.333 89.833c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM551 228.973c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm126.667 98c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.175 1.175 0 0 0-.356-.052ZM557.333 220.806c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.918.918 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.738.738 0 0 0-.202-.225 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.164.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm6.334 171.5c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.995.995 0 0 0-.302-.151 1.187 1.187 0 0 0-.357-.052Zm0-16.334c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0-16.333c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-6.334-40.833c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0-65.334c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 49c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 32.667c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-65.333c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-6.333 73.5c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm126.667-65.333c-.185 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.241 1.241 0 0 0-.356-.052Zm-139.333-49c-.185 0-.365.04-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.164.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm6.333 155.166c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm-6.333-171.5c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm6.333 155.167c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.333a1.162 1.162 0 0 0-.518.116.788.788 0 0 0-.343.312.533.533 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.333-89.834c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0 32.667c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.297.163.477.189.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0 16.333c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0-65.333c-.185 0-.365.041-.518.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.923.923 0 0 0 .419-.255.576.576 0 0 0 .156-.386c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0 32.667c-.185 0-.365.04-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.164.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm6.333 57.166c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204ZM551 375.973a1.165 1.165 0 0 0-.518.116.793.793 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm-6.333-171.5a1.162 1.162 0 0 0-.518.116.796.796 0 0 0-.344.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.054.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.582.582 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm133 73.5c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-133 24.5c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.67.67 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.333 8.167a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.272-.491a1.116 1.116 0 0 0-.659-.203ZM551 359.639c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm-6.333-57.166a1.162 1.162 0 0 0-.518.116.788.788 0 0 0-.343.312.533.533 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.334c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-16.333c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.67.67 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0 16.334c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203ZM513 261.639c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-38-16.333c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.333c-.184 0-.364.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm6.334 138.833c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.297.163.477.189.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203ZM475 277.973c-.184 0-.364.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-65.334c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm6.334 171.5c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204ZM475 261.639c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0 32.667c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 49c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-49c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0 16.334a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm6.334-57.167c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.297.163.477.19.181.026.369.013.539-.04a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0-49c-.185 0-.365.041-.518.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.923.923 0 0 0 .419-.255.576.576 0 0 0 .156-.386c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0 16.333c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0 16.334c-.185 0-.365.04-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.164.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0-49a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.272-.491a1.116 1.116 0 0 0-.659-.203Zm0 147a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.272-.491a1.116 1.116 0 0 0-.659-.203Zm6.333 24.5a1.162 1.162 0 0 0-.518.116.788.788 0 0 0-.343.312.533.533 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-12.667 0a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm6.334-57.167c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.297.163.477.19.181.026.369.013.539-.04a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0 16.333c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0-32.666a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.272-.491a1.116 1.116 0 0 0-.659-.203Zm6.333 57.166c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm-6.333-73.5c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm-19.001-8.166c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.052.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.052.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-32.667c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-49c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 32.667c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.738.738 0 0 0-.202-.225 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.052.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052ZM513 310.639c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-50.667 49c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-49c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 16.334c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.052.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm6.334-73.5c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 114.333c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-130.666c-.185 0-.365.04-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.185 0-.365.041-.518.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.582.582 0 0 0 .157-.386c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0 49c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-81.666a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 147a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-49a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 65.333c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.014.538-.039a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-16.333c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.334 57.167c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm44.334 8.166c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-6.334-171.5c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm6.334 155.167c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0-16.333c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.995.995 0 0 0-.302-.151 1.187 1.187 0 0 0-.357-.052Zm0-16.334c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-6.334-106.166c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm0 32.666c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 49c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-65.333c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.918.918 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.738.738 0 0 0-.202-.225 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 49c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm6.334 24.5c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-6.334-40.833c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm6.334-40.834c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm6.333 122.5c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 16.334c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm0-32.667c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-6.333-138.833c-.185 0-.365.04-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.164.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.995.995 0 0 0-.302-.151 1.187 1.187 0 0 0-.357-.052Zm6.333 122.5c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm-6.333-24.5c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.995.995 0 0 0-.302-.151 1.187 1.187 0 0 0-.357-.052Zm0-16.334c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0-65.333c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385.544.544 0 0 0-.071-.266.725.725 0 0 0-.202-.225 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0 49c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0-16.333c-.185 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.241 1.241 0 0 0-.356-.052Zm-6.334 73.5c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm-12.666-16.334c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm12.666 32.667c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-12.666-98c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.054.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.582.582 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204ZM494 367.806c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm-6.333-40.833c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm6.333 8.167a1.157 1.157 0 0 0-.517.116.79.79 0 0 0-.344.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm-6.333-24.5a1.162 1.162 0 0 0-.518.116.788.788 0 0 0-.343.312.533.533 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0 16.334c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-49c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203ZM494 335.139c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0-114.333c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm6.333 155.166a1.18 1.18 0 0 0-.518.118.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.21 1.21 0 0 0-.357-.053ZM494 237.139c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm6.333 122.5c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM494 204.473a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.657.657 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0 98a1.157 1.157 0 0 0-.517.116.79.79 0 0 0-.344.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-49c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-16.333c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0 32.666c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm158.334 24.5c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm-19.001-57.166c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.667.667 0 0 0 .256.356c.13.097.296.163.477.189.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm0 49c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0 32.666c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-49c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 16.333c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 65.334c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052ZM627 228.973c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.248 1.248 0 0 0-.357-.052Zm6.333 138.833c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM627 212.639c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm44.333 106.167c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-31.666-73.5c-.185 0-.365.041-.518.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.582.582 0 0 0 .157-.386c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.334-8.167c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm6.334 106.167c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.014.538-.039a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.333a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.014.538-.039a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-49c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0 16.334c-.185 0-.365.04-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203ZM627 245.306c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.916.916 0 0 0 .419-.256.572.572 0 0 0 .156-.385.554.554 0 0 0-.07-.266.729.729 0 0 0-.203-.225 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm6.333-40.833c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.529.529 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.738.738 0 0 0-.202-.225 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm38 114.333c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-31.666 40.834a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-76-65.334c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm69.666 73.5c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-12.666-65.333c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0 16.333c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm6.333-73.5c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-6.333 40.834c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.175 1.175 0 0 0-.356-.052Zm0-16.334c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0-16.333c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0 98c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-6.334-122.5c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.918.918 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.738.738 0 0 0-.202-.225 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm6.334 155.166c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-6.334-171.5c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm57 73.5c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-50.666 65.334c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.175 1.175 0 0 0-.356-.052Zm6.333 8.166c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-49c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.55.55 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 32.667c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-16.333c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm0-32.667c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-16.333c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.248 1.248 0 0 0-.357-.052Zm-6.333-57.167c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385.544.544 0 0 0-.071-.266.725.725 0 0 0-.202-.225 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0 16.333c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0 16.334c-.185 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.241 1.241 0 0 0-.356-.052Zm6.333 122.5c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385.554.554 0 0 0-.07-.266.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm-6.333-171.5c-.185 0-.365.04-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.164.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.175 1.175 0 0 0-.356-.052Zm50.666 98c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm-12.666 0a1.162 1.162 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-44.334-40.834c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm44.334 73.5c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-16.333c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.67.67 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-49c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm-6.333-8.166c-.185 0-.365.04-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm6.333 40.833c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.67.67 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm12.666 114.333c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-12.666-32.666a1.162 1.162 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.333-138.834c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm6.333 155.167c-.184 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-130.666c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm6.333 24.5c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm-6.333-73.5c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.054.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.582.582 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203ZM665 261.639c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0 65.334a1.165 1.165 0 0 0-.518.116.793.793 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-81.667c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.114 1.114 0 0 0-.659-.203Zm0 65.333c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm-6.333-106.166a1.162 1.162 0 0 0-.518.116.796.796 0 0 0-.344.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm6.333 8.166c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0 163.334a1.165 1.165 0 0 0-.518.116.793.793 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-32.667c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm-12.666 16.334a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.272-.491a1.116 1.116 0 0 0-.659-.203ZM646 286.139c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0 16.334a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-65.333c-.184 0-.364.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 65.333c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0 32.667c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.333-155.167c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm31.666 138.834c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm-25.333 0a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 32.666c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-147c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm6.334 40.834c-.185 0-.365.04-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm12.666-49c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm-12.666 65.333c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0-49c-.185 0-.365.041-.518.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.915.915 0 0 0 .418-.255.572.572 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0 81.666c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.118 1.118 0 0 0-.658-.204Zm0-65.333c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm-12.667-32.666c-.185 0-.365.04-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm6.333-24.5a1.162 1.162 0 0 0-.518.116.788.788 0 0 0-.343.312.53.53 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm25.333 163.333c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-25.333-147c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.582.582 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm6.334 138.833c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0-16.333c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm-12.667 16.333c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm-57 8.167c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.014.538-.039a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-81.666a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 49a1.159 1.159 0 0 0-.518.116.796.796 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm31.666-73.5c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm-31.666 57.166c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm95 40.834c-.185 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.175 1.175 0 0 0-.356-.052ZM576.333 261.639c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.529.529 0 0 0-.052.401.657.657 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 16.334c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.53.53 0 0 0-.052.401.66.66 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm0-32.667c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.052.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.738.738 0 0 0-.202-.225 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-16.333c-.184 0-.364.041-.517.117a.783.783 0 0 0-.344.311.53.53 0 0 0-.052.401.66.66 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.013.539-.039a.935.935 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm0 65.333c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.53.53 0 0 0-.052.401.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0-81.667c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.529.529 0 0 0-.052.401.657.657 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm12.667 147c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-65.333c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 49c-.184 0-.364.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-6.333-57.167c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm88.666-81.666c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.164.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052ZM589 326.973a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.334c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm-6.333-106.166a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 49c-.185 0-.365.04-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.18.027.368.013.538-.039a.939.939 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.929.929 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.099-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-16.333c-.185 0-.365.041-.518.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.582.582 0 0 0 .157-.386c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203ZM589 375.973a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm-19 8.166c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm107.667-40.833c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053ZM570 367.806c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-32.667c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-6.333-122.5c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053ZM570 351.473c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm-6.333-57.167c-.185 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.921.921 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.987.987 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm6.333 24.5c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm-6.333-40.833c-.185 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.241 1.241 0 0 0-.356-.052Zm0-32.667c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385.544.544 0 0 0-.071-.266.725.725 0 0 0-.202-.225 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0 16.333c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm0-32.666c-.185 0-.365.041-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.714.714 0 0 0-.202-.225.989.989 0 0 0-.303-.151 1.241 1.241 0 0 0-.356-.052Zm12.666 81.666c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.529.529 0 0 0-.052.401.657.657 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 65.334c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0-16.334c-.184 0-.364.041-.517.117a.79.79 0 0 0-.344.312.529.529 0 0 0-.052.401.657.657 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.925.925 0 0 0 .418-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM570 204.473c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm107.667 155.166c-.185 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.54.54 0 0 0 .086-.651.717.717 0 0 0-.202-.226 1.01 1.01 0 0 0-.303-.15 1.208 1.208 0 0 0-.356-.053Zm-101.334-32.666c-.184 0-.364.04-.517.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.66.66 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.517.117a.789.789 0 0 0-.344.311.53.53 0 0 0-.052.401.656.656 0 0 0 .255.356c.13.097.296.163.477.19.181.026.368.013.539-.04a.927.927 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM570 302.473c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm0-16.334c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-16.333c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-32.667c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 16.334c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.248 1.248 0 0 0-.357-.052Zm0-32.667c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.916.916 0 0 0 .419-.256.572.572 0 0 0 .156-.385.554.554 0 0 0-.07-.266.729.729 0 0 0-.203-.225 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm12.667 98c-.185 0-.365.041-.518.117a.788.788 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.18.027.368.014.538-.039a.922.922 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.099-.361-.273-.491a1.116 1.116 0 0 0-.659-.203ZM608 335.139c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0 49c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0-16.333c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-16.333a1.165 1.165 0 0 0-.518.116.793.793 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-32.667c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.296.164.477.19.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-16.333a1.165 1.165 0 0 0-.518.116.793.793 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm63.333-49c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.243 1.243 0 0 0-.357-.052Zm-69.666-8.167c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.054.401.663.663 0 0 0 .256.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.582.582 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203ZM608 286.139c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm-6.333-24.5c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-32.666c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-16.334c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm12.666 114.334c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0 16.333c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 16.333c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-12.666-81.666c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.097.297.164.478.19.181.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm12.666 32.666c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm0 65.334c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.574.574 0 0 0 .158-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225 1 1 0 0 0-.303-.151 1.177 1.177 0 0 0-.357-.052Zm0-81.667c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM608 204.473a1.165 1.165 0 0 0-.518.116.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.657.657 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0 49c-.184 0-.364.04-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-16.334c-.184 0-.364.041-.518.117a.787.787 0 0 0-.343.312.529.529 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.112 1.112 0 0 0-.659-.204Zm0 32.667c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.296.163.477.189.181.027.368.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm0-49c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.53.53 0 0 0-.053.401.666.666 0 0 0 .255.356c.13.097.296.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.112 1.112 0 0 0-.659-.203Zm63.333 49c-.184 0-.364.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.181.026.368.013.538-.04a.925.925 0 0 0 .419-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.727.727 0 0 0-.202-.225.998.998 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-75.999 0c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.13.097.297.163.477.189.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0 65.333c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0 16.334a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0 16.333c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.297.164.477.19.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0-65.333a1.159 1.159 0 0 0-.518.116.79.79 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm0 81.666c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0-98c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0 32.667c-.185 0-.365.041-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.098.297.164.477.19.181.027.369.014.539-.039a.913.913 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm-6.334-73.5c-.184 0-.364.041-.518.117a.786.786 0 0 0-.343.311.53.53 0 0 0-.053.401.66.66 0 0 0 .255.356c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.577.577 0 0 0 .157-.386c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0 16.333c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm82.333-40.833c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.664.664 0 0 0 .256.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.918.918 0 0 0 .418-.256.578.578 0 0 0 .157-.385.544.544 0 0 0-.071-.266.738.738 0 0 0-.202-.225 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053ZM589 212.639c-.184 0-.364.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.04a.92.92 0 0 0 .418-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0 16.334c-.184 0-.364.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm6.334-8.167c-.185 0-.365.041-.518.117a.789.789 0 0 0-.344.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.027.368.013.538-.04a.923.923 0 0 0 .419-.255.576.576 0 0 0 .156-.386c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm6.333 155.166c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.312.533.533 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.124 1.124 0 0 0-.659-.204Zm0-49c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.312.533.533 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.039a.933.933 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.124 1.124 0 0 0-.659-.204Zm0 32.667c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204Zm0-16.333c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm0-32.667c-.184 0-.365.041-.518.117a.782.782 0 0 0-.343.312.529.529 0 0 0-.054.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.578.578 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.117 1.117 0 0 0-.659-.204ZM589 277.973c-.184 0-.364.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.659.659 0 0 0 .255.355c.13.097.296.164.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203Zm6.334-73.501c-.185 0-.365.041-.518.117a.79.79 0 0 0-.344.312.53.53 0 0 0-.053.401.662.662 0 0 0 .255.355c.13.097.296.163.477.19.181.027.368.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.118 1.118 0 0 0-.658-.204Zm75.999 32.667c-.184 0-.364.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.923.923 0 0 0 .419-.255.54.54 0 0 0 .086-.651.73.73 0 0 0-.202-.226 1.022 1.022 0 0 0-.303-.15 1.21 1.21 0 0 0-.357-.053Zm-75.999 0c-.185 0-.365.041-.518.117a.785.785 0 0 0-.344.312.533.533 0 0 0-.053.401.668.668 0 0 0 .255.355c.13.097.297.163.477.19.181.027.369.013.539-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386c0-.184-.098-.36-.273-.49a1.111 1.111 0 0 0-.658-.204Zm0 16.334c-.185 0-.365.04-.518.117a.783.783 0 0 0-.344.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.297.164.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.573.573 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.11 1.11 0 0 0-.658-.203Zm6.333 40.833c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.054.401.664.664 0 0 0 .255.355c.131.098.297.164.478.19.181.027.368.014.538-.039a.916.916 0 0 0 .419-.256.578.578 0 0 0 .157-.385c0-.184-.098-.361-.273-.491a1.116 1.116 0 0 0-.659-.203ZM456 351.473c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm0-16.334c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 49c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-16.333c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-49c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-81.667c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0 65.334c-.184 0-.365.04-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.664.664 0 0 0 .255.355c.131.097.297.163.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm0-81.667c-.184 0-.365.041-.518.117a.788.788 0 0 0-.343.312.53.53 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.181.027.368.013.538-.04a.916.916 0 0 0 .419-.256.572.572 0 0 0 .156-.385.543.543 0 0 0-.07-.266.729.729 0 0 0-.203-.225 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-16.333c-.184 0-.365.04-.518.117a.78.78 0 0 0-.343.311.53.53 0 0 0-.053.401.664.664 0 0 0 .255.355c.13.097.296.164.477.19.181.027.369.013.539-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.182 1.182 0 0 0-.357-.052Zm0 49c-.184 0-.365.041-.518.117a.786.786 0 0 0-.343.311.534.534 0 0 0-.053.401.67.67 0 0 0 .255.356c.131.097.297.163.478.189.18.027.368.013.538-.039a.93.93 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.983.983 0 0 0-.302-.151 1.248 1.248 0 0 0-.357-.052Zm0 32.666c-.184 0-.365.041-.518.117a.793.793 0 0 0-.343.312.534.534 0 0 0-.053.401.668.668 0 0 0 .255.355c.131.097.297.163.478.19.18.027.368.013.538-.04a.92.92 0 0 0 .418-.255.573.573 0 0 0 .157-.386.539.539 0 0 0-.07-.265.72.72 0 0 0-.203-.226 1.004 1.004 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Zm0-16.333c-.184 0-.365.041-.518.117a.792.792 0 0 0-.343.311.534.534 0 0 0-.053.401.666.666 0 0 0 .255.356c.131.097.297.163.478.19.18.026.368.013.538-.04a.921.921 0 0 0 .418-.256.543.543 0 0 0 .087-.651.718.718 0 0 0-.203-.225.982.982 0 0 0-.302-.15 1.215 1.215 0 0 0-.357-.053Z" fill="#BFBFC0"/><path d="M575.53 295.347a.551.551 0 0 1 0-.694L651.261 197h2.142l-75.996 98 75.945 97.925.051.075h-2.142l-75.706-97.625-.025-.028Zm12.672 0a.97.97 0 0 1-.088-.159l-.013-.029v-.028l-.012-.047v-.028c0-.009-.013-.028-.013-.075 0-.019 0-.028.013-.056 0-.038.012-.066.025-.103a.317.317 0 0 0 .038-.094.583.583 0 0 0 .037-.075L663.921 197h2.141l-75.995 97.991 75.945 97.934.05.075h-2.154l-75.706-97.616v-.037Zm-25.344-.009a.637.637 0 0 1-.114-.272.483.483 0 0 1 .088-.366l75.769-97.7h2.142l-75.996 97.991 75.946 97.934.05.075h-2.142l-75.668-97.587-.075-.075Zm38.004 0a.706.706 0 0 1-.114-.272.479.479 0 0 1 .089-.366l75.756-97.7h2.141l-75.995 97.991 75.945 97.934.05.075h-2.154l-75.668-97.587-.05-.075Zm-50.664-.685L625.929 197h2.142l-75.996 98 75.945 97.925.051.075h-2.142l-75.731-97.653a.55.55 0 0 1 0-.694Zm-12.672 0L613.257 197h2.141l-75.995 98 75.945 97.925.05.075h-2.141l-75.731-97.653a.55.55 0 0 1 0-.694ZM602.739 197 456.164 386.004l-.164.206v-2.776L600.585 197h2.154Zm-12.672 0L456.164 369.668l-.164.206v-2.767L587.912 197h2.155Zm-12.66 0L456.164 353.331l-.164.206v-2.766L575.253 197h2.154Zm-12.672 0L456.164 337.004l-.164.216v-2.776L562.581 197h2.154Zm-25.332 0-83.239 107.34-.164.216v-2.776L537.249 197h2.154Zm12.672 0-95.911 123.668-.164.206v-2.776L549.921 197h2.154ZM531.202 90.485c.164-.216.479-.347.806-.347.164 0 .315.028.466.093.152.066.265.16.353.263l82.534 106.431.05.075h-2.154L531.996 92.22l-75.832 97.784-.164.216v-2.767l75.177-96.921.025-.047Z" fill="#000"/><path d="M531.353 57.671a1.31 1.31 0 0 1 .189-.112c.151-.066.303-.094.454-.094.164 0 .327.037.466.094l.088.037v.01c.113.065.202.14.265.224L640.68 196.925l.05.075h-2.154L532.008 59.547l-75.844 97.793-.164.207v-2.776l75.202-96.96a.68.68 0 0 1 .151-.14Z" fill="#000"/><path d="M531.202 74.148c.164-.215.479-.347.806-.347.164 0 .315.028.466.094.152.066.265.16.353.263l95.193 122.767.051.075h-2.142L531.996 75.883l-75.832 97.784-.164.216v-2.776l75.177-96.921.025-.038Z" fill="#000"/><path d="M531.202 25.148c.164-.215.479-.347.806-.347.164 0 .315.028.466.094.152.066.265.16.353.263l133.198 171.767.05.075h-2.142L531.996 26.883l-75.832 97.784-.164.216v-2.776l75.177-96.921.025-.038Z" fill="#000"/><path d="M531.177 41.41h.088l.013-.01.012-.037.076-.028a.511.511 0 0 1 .088-.057c.025-.009.051-.028.088-.047a.54.54 0 0 1 .114-.037.648.648 0 0 1 .226-.047c.051-.01.089-.01.126-.01.063 0 .126.01.177.02.025 0 .063.009.113.018l.101.028c.025.01.05.01.075.028l.089.038c.05.019.075.047.1.066l.126.075v.037c.013.019.038.038.051.056l120.525 155.422.05.075h-2.154L531.996 43.22l-75.832 97.784-.164.206v-2.776l75.177-96.921v-.103Zm.428-.038s0-.01 0 0Z" fill="#000"/><path d="M676.593 197 531.996 10.556l-75.832 97.784-.164.216V105.771l71.159-91.754 4.005-5.168.026-.037c.163-.216.478-.347.806-.347.164 0 .315.028.466.094.151.065.264.16.353.262l145.869 188.095.051.075h-2.142V197ZM234.258 1 229 7.785v2.768L236.405 1h-2.147Zm65.485 0h-2.148L229 89.458v2.758L299.688 1.07l.055-.071Zm-12.671 0h-2.147L229 73.126v2.763l58.017-74.818.055-.071Zm-12.663 0h-2.147L229 56.79v2.762l45.354-58.481.055-.071Zm-27.481 0L229 24.126v2.758L249.075 1h-2.147Zm12.664 0L229 40.458v2.763L261.739 1h-2.147Z" fill="#000"/><path d="M419.805 139.487a.863.863 0 0 0-.339-.252 1.207 1.207 0 0 0-.935.001.88.88 0 0 0-.349.266L373.601 197h2.148l43.254-55.78L457 190.215v-2.772l-37.169-47.918-.026-.038Zm-.802-79.935L457 108.547v-2.772l-37.169-47.919-.026-.038a.858.858 0 0 0-.34-.251 1.217 1.217 0 0 0-.935.001.888.888 0 0 0-.348.265L310.32 196.93l-.055.07h2.147L419.003 59.552Zm.802 14.602a.857.857 0 0 0-.34-.25 1.217 1.217 0 0 0-.935.001.888.888 0 0 0-.348.264L322.933 197h2.148l93.922-121.112L457 124.883v-2.772l-37.169-47.918-.026-.039Zm-.802 15.984c-.164 0-.325.031-.468.091a.773.773 0 0 0-.31.231l-82.566 106.47-.054.07h2.147l81.251-104.78L457 141.215v-2.767l-37.195-47.966a.858.858 0 0 0-.34-.251 1.183 1.183 0 0 0-.462-.093Zm0 16.336c-.164 0-.326.032-.469.092a.764.764 0 0 0-.307.23l-69.898 90.134-.054.07h2.147l68.581-88.448L457 157.547v-2.767l-37.195-47.962a.857.857 0 0 0-.34-.251 1.198 1.198 0 0 0-.462-.093Zm.773 16.652a.417.417 0 0 0-.113-.103 1.045 1.045 0 0 0-.197-.116.45.45 0 0 0-.112-.039.758.758 0 0 0-.224-.047 1.104 1.104 0 0 0-.587.078l-.089.041-.002.003a.403.403 0 0 0-.1.069c-.013.01-.026.02-.051.042a.17.17 0 0 0-.066.061.569.569 0 0 0-.06.07L360.938 197h2.147l55.918-72.116 37.997 49v-2.772l-37.206-47.969-.018-.017Zm-.454-.114h-.001l.002-.004-.001.004Zm.074.03-.001-.001.002-.002-.001.003Z" fill="#000"/><g clip-path="url(#clip0_3054_23848)"><path d="M122.416 197 229 59.562v-2.768l-.164.211L120.268 197h2.148Zm25.333 0L229 92.225v-2.767l-.164.21L145.601 197h2.148Zm-37.997 0L229 43.225v-2.767l-.164.21L107.605 197h2.147Zm25.334 0L229 75.893v-2.767l-.164.211L132.937 197h2.149Zm-38.004 0L229 26.893v-2.767l-.164.211L94.935 197h2.147Zm-12.663 0L229 10.557V7.789l-.164.211L82.271 197h2.148Z" fill="#000"/></g><g clip-path="url(#clip1_3054_23848)" fill="#000"><path d="M380.798 286.485c-.164-.216-.479-.347-.806-.347-.164 0-.315.028-.466.094a.949.949 0 0 0-.353.262l-82.521 106.431-.05.075h2.154l81.261-104.78 75.832 97.784.164.206v-2.766l-75.177-96.922-.038-.037Z"/><path d="M380.647 253.671a1.31 1.31 0 0 0-.189-.112 1.117 1.117 0 0 0-.454-.094c-.163 0-.327.037-.466.094l-.088.037v.009a.864.864 0 0 0-.264.226L271.32 392.925l-.05.075h2.154l106.58-137.453 75.845 97.793.164.207v-2.776l-75.202-96.959a1.463 1.463 0 0 0-.164-.141Z"/><path d="M380.798 270.148c-.164-.215-.479-.347-.806-.347-.164 0-.315.028-.466.094a.959.959 0 0 0-.353.263L283.98 392.925l-.051.075h2.142l93.933-121.117 75.832 97.794.164.206v-2.776l-75.177-96.921-.025-.038Z"/><path d="M380.798 221.148c-.164-.215-.479-.347-.806-.347-.164 0-.315.028-.466.094a.95.95 0 0 0-.353.263L245.988 392.925l-.05.075h2.141l131.925-170.117 75.832 97.784.164.207v-2.776l-75.177-96.922-.025-.028Z"/><path d="M380.823 237.41h-.088l-.013-.01-.012-.037-.076-.028c-.025-.019-.05-.038-.088-.057-.025-.009-.05-.028-.088-.046a.519.519 0 0 0-.113-.038.663.663 0 0 0-.227-.047c-.051-.009-.088-.009-.126-.009-.063 0-.126.009-.177.018-.025 0-.063.01-.113.019l-.101.028c-.025.01-.05.01-.075.029l-.088.037c-.051.019-.076.047-.101.066l-.126.075v.037c-.013.019-.038.038-.051.056L258.635 392.925l-.05.075h2.154l119.265-153.78 75.832 97.784.164.206v-2.776l-75.177-96.921v-.103Zm-.428-.038s0-.009 0 0Z"/><path d="m235.407 393 144.597-186.444 75.832 97.794.164.206V301.771l-71.159-91.754-4.005-5.168-.025-.037c-.164-.216-.479-.347-.807-.347-.163 0-.315.028-.466.094a.953.953 0 0 0-.352.262l-145.87 188.104-.063.075h2.154Z"/></g><path d="M228 301.782v2.768L159.406 393h-2.146l70.576-91.007.164-.211Zm0 81.667L220.592 393h2.147l5.261-6.783v-2.768Zm-.164-65.123L169.926 393h2.147L228 320.883v-2.768l-.164.211Zm0 16.334L182.592 393h2.146L228 337.217v-2.768l-.164.211Zm0 32.666L207.925 393h2.148L228 369.884v-2.769l-.164.211Zm0-16.333L195.259 393h2.146L228 353.55v-2.768l-.164.211Z" fill="#000"/><path d="M0 369.884v-2.768L131.927 197h2.146L.164 369.673l-.164.211Zm.164 16.122L146.74 197h-2.146L0 383.449v2.768l.164-.211Zm0-49L108.741 197h-2.147L0 334.45v2.767l.164-.211Zm0 16.333L121.408 197h-2.147L0 350.783v2.767l.164-.211Zm0-32.666L96.074 197h-2.146L0 318.116v2.768l.164-.211Zm0-16.333L83.41 197h-2.147L0 301.783v2.768l.164-.211ZM0 288.218v-2.768L68.594 197h2.147L.164 288.007l-.164.211Zm0-81.667L7.408 197H5.26L0 203.783v2.768Zm.164 65.122L58.074 197h-2.147L0 269.117v2.767l.164-.211Zm0-16.333L45.408 197h-2.146L0 252.783v2.768l.164-.211Zm0-32.667L20.074 197h-2.147L0 220.116v2.768l.164-.211Zm0 16.334L32.742 197h-2.147L0 236.45v2.768l.164-.211Z" fill="#fff"/><defs><clipPath id="clip0_3054_23848"><path fill="#fff" transform="translate(1 1)" d="M0 0h228v196H0z"/></clipPath><clipPath id="clip1_3054_23848"><path fill="#fff" transform="translate(228 197)" d="M0 0h228v196H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/website/public/img/homepage/callouts/encryption.png b/website/public/img/homepage/callouts/encryption.png
deleted file mode 100644
index 14710577d4a..00000000000
Binary files a/website/public/img/homepage/callouts/encryption.png and /dev/null differ
diff --git a/website/public/img/homepage/callouts/identity.png b/website/public/img/homepage/callouts/identity.png
deleted file mode 100644
index d96e8b2353e..00000000000
Binary files a/website/public/img/homepage/callouts/identity.png and /dev/null differ
diff --git a/website/public/img/homepage/callouts/secrets.png b/website/public/img/homepage/callouts/secrets.png
deleted file mode 100644
index 58872944354..00000000000
Binary files a/website/public/img/homepage/callouts/secrets.png and /dev/null differ
diff --git a/website/public/img/how-vault-works.png b/website/public/img/how-vault-works.png
deleted file mode 100644
index 22ad39a6255..00000000000
Binary files a/website/public/img/how-vault-works.png and /dev/null differ
diff --git a/website/public/img/icon-terminal.png b/website/public/img/icon-terminal.png
deleted file mode 100644
index 5ba169d4a9c..00000000000
Binary files a/website/public/img/icon-terminal.png and /dev/null differ
diff --git a/website/public/img/icon-terminal@2x.png b/website/public/img/icon-terminal@2x.png
deleted file mode 100644
index 159d7cb452a..00000000000
Binary files a/website/public/img/icon-terminal@2x.png and /dev/null differ
diff --git a/website/public/img/icons/alert-check.svg b/website/public/img/icons/alert-check.svg
deleted file mode 100644
index 9045132d92f..00000000000
--- a/website/public/img/icons/alert-check.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg fill="none" height="16" viewBox="0 0 18 16" width="18" xmlns="http://www.w3.org/2000/svg"><path d="m17.7979 13.7532-7.5085-13.008778c-.57343-.992563-2.00314-.992563-2.57656 0l-7.51108 13.008778c-.573424.9925.143998 2.232 1.28827 2.232h15.01957c1.1469 0 1.8617-1.2395 1.2883-2.232z" fill="#ffd4d6"/><g fill="#000"><path d="m9.00033 14.1022c.61287 0 1.10967-.4968 1.10967-1.1097s-.4968-1.1097-1.10967-1.1097-1.10971.4968-1.10971 1.1097.49684 1.1097 1.10971 1.1097z"/><path d="m8.83877 4.11523h.32233c.51801 0 .9347.43053.9163.94855l-.16115 4.82099c-.01612.49503-.42363.88873-.91632.88873-.49499 0-.90019-.3914-.91631-.88873l-.16116-4.82099c-.01842-.52032.3983-.94855.91631-.94855z"/></g></svg>
\ No newline at end of file
diff --git a/website/public/img/icons/alert-icon.svg b/website/public/img/icons/alert-icon.svg
deleted file mode 100644
index 072e687cde2..00000000000
--- a/website/public/img/icons/alert-icon.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M12 22c5.523 0 10-4.477 10-10S17.523 2 12 2 2 6.477 2 12s4.477 10 10 10z" fill="#fff" stroke="#E80134"/><path d="M12 8v4" stroke="#E80134"/><circle cx="12" cy="16" r="1" fill="#E80134"/></svg>
\ No newline at end of file
diff --git a/website/public/img/icons/alert-triangle.svg b/website/public/img/icons/alert-triangle.svg
deleted file mode 100644
index 6eb8da0b62d..00000000000
--- a/website/public/img/icons/alert-triangle.svg
+++ /dev/null
@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" fill="none" viewBox="0 0 20 20">
-    <path fill-rule="evenodd" stroke="var(--gray-5, #dbdbdc)" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M8.575 4.04838L1.51667 15.8317C1.22054 16.3445 1.21877 16.976 1.51202 17.4905C1.80528 18.005 2.34951 18.3252 2.94167 18.3317H17.0583C17.6505 18.3252 18.1947 18.005 18.488 17.4905C18.7812 16.976 18.7795 16.3445 18.4833 15.8317L11.425 4.04838C11.1229 3.55028 10.5826 3.24609 10 3.24609C9.41743 3.24609 8.87714 3.55028 8.575 4.04838Z" clip-rule="evenodd"/>
-    <path stroke="#E80134" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M10 8.33203V11.6654"/>
-    <ellipse cx="10" cy="15.0013" fill="#E80134" rx="0.833333" ry="0.833334"/>
-</svg>
diff --git a/website/public/img/icons/alert.svg b/website/public/img/icons/alert.svg
deleted file mode 100644
index b2de9cbdd33..00000000000
--- a/website/public/img/icons/alert.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg fill="none" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg"><circle cx="12" cy="12" fill="#ffd4d6" r="12"/><g fill="#000"><path d="m12 18.5c.8284 0 1.5-.6716 1.5-1.5s-.6716-1.5-1.5-1.5-1.5.6716-1.5 1.5.6716 1.5 1.5 1.5z"/><path d="m11.7824 5h.4356c.7002 0 1.2635.58195 1.2386 1.28216l-.2178 6.51664c-.0218.669-.5726 1.2012-1.2386 1.2012-.6691 0-1.2168-.529-1.2386-1.2012l-.2178-6.51664c-.0249-.70332.5383-1.28216 1.2386-1.28216z"/></g></svg>
\ No newline at end of file
diff --git a/website/public/img/icons/check-circle.svg b/website/public/img/icons/check-circle.svg
deleted file mode 100644
index 831133b177a..00000000000
--- a/website/public/img/icons/check-circle.svg
+++ /dev/null
@@ -1,4 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" fill="none" viewBox="0 0 18 18">
-    <path stroke="var(--gray-5, #dbdbdc)" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M15.75 9.05327V9.75077C15.7481 13.0723 13.5617 15.9969 10.3765 16.9387C7.19129 17.8805 3.76603 16.615 1.9582 13.8286C0.150369 11.0421 0.390629 7.3985 2.54869 4.87357C4.70674 2.34865 8.26852 1.54391 11.3025 2.89577"/>
-    <path stroke="var(--brand, #2e71e5)" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M16.5 3L8.25 11.25L6 9"/>
-</svg>
diff --git a/website/public/img/icons/check-icon.svg b/website/public/img/icons/check-icon.svg
deleted file mode 100644
index 98e39a99d3f..00000000000
--- a/website/public/img/icons/check-icon.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M12 23C5.925 23 1 18.075 1 12S5.925 1 12 1s11 4.925 11 11-4.925 11-11 11z" fill="#000" stroke="#000"/><path d="M16.666 9.082l-6.416 6.417-2.917-2.917" stroke="#fff"/></svg>
\ No newline at end of file
diff --git a/website/public/img/icons/check-square-vault.svg b/website/public/img/icons/check-square-vault.svg
deleted file mode 100644
index 7af19633b2a..00000000000
--- a/website/public/img/icons/check-square-vault.svg
+++ /dev/null
@@ -1,4 +0,0 @@
-<svg width="18" height="18" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<rect width="24" height="24" fill="#fff9cf"/>
-<path d="M17.3334 8.66666L10 16L6.66669 12.6667" stroke="black" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>
diff --git a/website/public/img/icons/check.svg b/website/public/img/icons/check.svg
deleted file mode 100644
index 74ad0bff44b..00000000000
--- a/website/public/img/icons/check.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg fill="none" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg"><circle cx="12" cy="12" fill="#000" r="12"/><path d="m16.6654 9.08398-6.4167 6.41672-2.91667-2.9167" stroke="#fff" stroke-linecap="round" stroke-linejoin="round" stroke-width="2"/></svg>
\ No newline at end of file
diff --git a/website/public/img/icons/close-icon.svg b/website/public/img/icons/close-icon.svg
deleted file mode 100644
index 91f0779ec96..00000000000
--- a/website/public/img/icons/close-icon.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><title>Group 4</title><path d="M1.778 1.778l12.541 12.541m-.097-12.541L1.681 14.319" stroke="#FFF" stroke-width="2" fill="none" stroke-linecap="square"/></svg>
\ No newline at end of file
diff --git a/website/public/img/icons/icon_archlinux.svg b/website/public/img/icons/icon_archlinux.svg
deleted file mode 100644
index 6249f965785..00000000000
--- a/website/public/img/icons/icon_archlinux.svg
+++ /dev/null
@@ -1,13 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 65 65">
-  <defs>
-    <linearGradient id="a" x1="54.638%" x2="28.129%" y1="32.594%" y2="72.266%">
-      <stop stop-color="#FFF" stop-opacity="0" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity=".275" offset="100%"/>
-    </linearGradient>
-  </defs>
-  <g fill="none">
-    <path fill="#1793D1" d="M32.253.21c-2.85 6.984-4.58 11.56-7.75 18.336 1.944 2.06 4.334 4.453 8.21 7.164-4.167-1.715-7.008-3.432-9.132-5.22C19.53 28.96 13.16 41.023.26 64.21c10.14-5.854 18.002-9.466 25.328-10.844-.313-1.35-.48-2.82-.468-4.344l.008-.32c.16-6.498 3.542-11.495 7.547-11.156 4.004.34 7.12 5.884 6.96 12.383-.03 1.22-.172 2.4-.413 3.49 7.246 1.42 15.033 5.01 25.04 10.79-1.975-3.64-3.74-6.91-5.424-10.03-2.648-2.057-5.41-4.728-11.046-7.62 3.874 1.005 6.65 2.17 8.812 3.47C39.496 18.2 38.114 13.97 32.25.21z"/>
-    <path fill="#FFF" fill-opacity=".166" d="M50.266 38.25C36.394 19.42 33.18 4.246 32.364.623c7.4 17.067 7.35 17.277 17.902 37.625z"/>
-    <path fill="url(#a)" d="M32.378.46c-.36.884-.7 1.747-1.032 2.562-.364.895-.718 1.757-1.062 2.594-.344.838-.693 1.63-1.03 2.438-.34.806-.655 1.604-1 2.406-.347.802-.727 1.613-1.095 2.437-.37.825-.76 1.658-1.16 2.532-.41.87-.83 1.8-1.28 2.75-.06.12-.13.27-.19.4 1.94 2.05 4.33 4.422 8.182 7.12-4.166-1.716-7-3.433-9.124-5.22-.11.226-.198.425-.31.656-.42.87-.87 1.733-1.345 2.69-.11.223-.194.426-.31.655-.5 1.006-1.026 2.045-1.594 3.158-.113.22-.228.4-.344.624-.344.665-1.44 2.77-2.56 4.905-.658 1.245-1.17 2.27-1.91 3.653-.208.4-.638 1.195-.75 1.406 8.126-4.573 16.892-11.216 32.814-5.53-.796-1.51-1.56-2.92-2.25-4.25-.687-1.333-1.31-2.57-1.905-3.75-.595-1.18-1.144-2.29-1.658-3.345-.512-1.054-.988-2.05-1.436-3-.45-.954-.885-1.87-1.28-2.75-.4-.88-.77-1.73-1.126-2.563-.36-.83-.695-1.655-1.03-2.47-.338-.81-.674-1.59-1-2.402-.144-.358-.265-.736-.408-1.096C34.302 5 33.43 2.936 32.378.46z"/>
-  </g>
-</svg>
diff --git a/website/public/img/icons/icon_centos.svg b/website/public/img/icons/icon_centos.svg
deleted file mode 100644
index 2c5aa0dd371..00000000000
--- a/website/public/img/icons/icon_centos.svg
+++ /dev/null
@@ -1,15 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 171 171">
-  <g fill="none" fill-rule="evenodd">
-    <path fill="#932279" d="M72.064 79.272l6.17 6.133-6.17 6.134H28.64v20.435L2.155 85.405 28.64 59.28v19.99h43.424"/>
-    <path fill="#EFA724" d="M91.728 72.064l-6.134 6.17-6.133-6.17V28.638H59.026l26.57-26.483 26.125 26.483H91.73v43.426"/>
-    <path fill="#262577" d="M98.936 91.728l-6.17-6.134 6.17-6.133h43.425V59.026l26.486 26.57-26.483 26.125V91.73H98.937"/>
-    <path fill="#9CCD2A" d="M79.272 98.936l6.133-6.17 6.134 6.17v43.425h20.435l-26.572 26.486-26.123-26.483h19.99V98.937"/>
-    <g fill-rule="nonzero" stroke="#FFF" stroke-width="3.769">
-      <path fill="#9CCD2A" d="M27.082 27.082h52.765v52.765H27.082z"/>
-      <path fill="#932279" d="M91.153 27.082h52.765v52.765H91.153z"/>
-      <path fill="#EFA724" d="M91.153 91.153h52.765v52.765H91.153z"/>
-      <path fill="#262577" d="M27.082 91.153h52.765v52.765H27.082z"/>
-    </g>
-    <path stroke="#FFF" stroke-width="3.769" d="M2.884 85.5l37.31-37.31 37.31 37.31-37.31 37.31zM48.19 40.195L85.5 2.885l37.31 37.31-37.31 37.31zM93.495 85.5l37.31-37.31 37.31 37.31-37.31 37.31zM48.19 130.805l37.31-37.31 37.31 37.31-37.31 37.31z"/>
-  </g>
-</svg>
diff --git a/website/public/img/icons/icon_darwin.svg b/website/public/img/icons/icon_darwin.svg
deleted file mode 100644
index bbdb31f5f08..00000000000
--- a/website/public/img/icons/icon_darwin.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 150">
-  <path fill="#000" fill-rule="nonzero" d="M124.47 116.895c-2.268 5.24-4.954 10.064-8.065 14.5-4.24 6.045-7.712 10.23-10.388 12.554-4.148 3.814-8.593 5.768-13.352 5.88-3.416 0-7.536-.973-12.333-2.946-4.81-1.963-9.234-2.935-13.277-2.935-4.24 0-8.79.97-13.653 2.934-4.872 1.973-8.797 3-11.798 3.102-4.564.195-9.113-1.815-13.653-6.037-2.897-2.528-6.522-6.862-10.865-13-4.66-6.556-8.49-14.157-11.49-22.824C2.38 98.766.77 89.7.77 80.926c0-10.053 2.172-18.723 6.523-25.99 3.42-5.835 7.968-10.438 13.662-13.818 5.693-3.38 11.845-5.102 18.47-5.212 3.624 0 8.378 1.122 14.285 3.325 5.89 2.212 9.673 3.333 11.33 3.333 1.24 0 5.443-1.31 12.566-3.924 6.736-2.425 12.42-3.43 17.078-3.034 12.62 1.02 22.1 5.994 28.406 14.956-11.286 6.84-16.87 16.417-16.758 28.705.1 9.57 3.574 17.536 10.397 23.86 3.092 2.935 6.546 5.203 10.388 6.814-.833 2.418-1.713 4.732-2.648 6.955zM95.526 3c0 7.502-2.74 14.506-8.203 20.99-6.592 7.706-14.566 12.16-23.213 11.457-.11-.9-.174-1.847-.174-2.843 0-7.2 3.135-14.908 8.702-21.21 2.78-3.19 6.315-5.844 10.602-7.96C87.517 1.35 91.564.196 95.37 0c.11 1.002.156 2.005.156 3z"/>
-</svg>
diff --git a/website/public/img/icons/icon_debian.svg b/website/public/img/icons/icon_debian.svg
deleted file mode 100644
index 91b24617b8d..00000000000
--- a/website/public/img/icons/icon_debian.svg
+++ /dev/null
@@ -1,7 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 121 150">
-  <g fill="#A80030">
-    <path d="M71.917 78.85c-2.473.033.467 1.273 3.696 1.77.892-.696 1.7-1.4 2.422-2.086-2.01.493-4.057.504-6.118.315m13.273-3.31c1.472-2.04 2.545-4.26 2.924-6.56-.33 1.64-1.22 3.05-2.06 4.55-4.62 2.91-.434-1.73-.002-3.49-4.97 6.25-.682 3.75-.863 5.5m4.9-12.75c.29-4.46-.88-3.05-1.28-1.35.46.24.82 3.14 1.27 1.34M62.54 1.92c1.32.24 2.85.42 2.636.737 1.444-.32 1.77-.61-2.637-.74m2.63.73l-.94.19.87-.08.06-.114"/>
-    <path d="M106.328 64.48c.148 4-1.17 5.94-2.357 9.375l-2.13 1.068c-1.75 3.396.17 2.156-1.08 4.858-2.73 2.43-8.28 7.6-10.06 8.07-1.3-.03.88-1.53 1.17-2.12-3.65 2.51-2.93 3.77-8.52 5.3l-.16-.36c-13.8 6.49-32.95-6.37-32.7-23.9-.14 1.12-.41.84-.72 1.29-.71-9.02 4.17-18.084 12.4-21.784 8.05-3.98 17.488-2.346 23.25 3.026-3.164-4.146-9.47-8.543-16.94-8.132-7.313.118-14.16 4.768-16.443 9.816-3.75 2.36-4.19 9.093-5.82 10.33-2.2 16.143 4.13 23.12 14.84 31.33 1.69 1.14.473 1.31.7 2.17-3.56-1.67-6.817-4.18-9.497-7.26 1.42 2.08 2.953 4.108 4.94 5.698-3.36-1.14-7.84-8.13-9.15-8.416 5.78 10.35 23.46 18.154 32.72 14.28-4.284.16-9.726.09-14.54-1.69-2.02-1.04-4.77-3.194-4.28-3.6 12.636 4.72 25.69 3.58 36.622-5.19 2.78-2.163 5.82-5.85 6.7-5.9-1.324 1.99.224.957-.79 2.71 2.77-4.47-1.205-1.816 2.864-7.716l1.503 2.07c-.56-3.71 4.6-8.215 4.08-14.083 1.18-1.795 1.32 1.93.06 6.06 1.744-4.58.46-5.32.91-9.1.482 1.27 1.12 2.62 1.444 3.96-1.136-4.42 1.17-7.45 1.74-10.02-.565-.25-1.76 1.96-2.03-3.27.04-2.27.63-1.19.86-1.75-.447-.256-1.617-1.997-2.33-5.336.51-.787 1.38 2.03 2.08 2.15-.45-2.658-1.23-4.68-1.26-6.72-2.05-4.286-.73.57-2.39-1.84-2.185-6.81 1.81-1.58 2.08-4.674 3.31 4.79 5.19 12.22 6.06 15.3-.66-3.755-1.73-7.39-3.03-10.905 1 .427-1.62-7.72 1.3-2.322-3.11-11.5-13.352-22.24-22.78-27.28 1.154 1.057 2.61 2.38 2.087 2.59-4.69-2.79-3.864-3.01-4.535-4.19-3.82-1.55-4.07.127-6.6.005C79.4 4.56 78.013 4.965 71.39 2.573l.3 1.41c-4.77-1.59-5.557.61-10.71.01-.314-.24 1.65-.88 3.27-1.12-4.61.61-4.396-.91-8.907.17 1.12-.78 2.29-1.29 3.48-1.96-3.76.23-8.97 2.19-7.36.41-6.13 2.73-17.02 6.57-23.14 12.3l-.19-1.28c-2.8 3.36-12.21 10.04-12.96 14.397l-.75.176c-1.45 2.47-2.4 5.266-3.55 7.805-1.9 3.25-2.79 1.25-2.52 1.76-3.75 7.6-5.61 13.99-7.22 19.228 1.15 1.71.03 10.31.467 17.196-1.89 34 23.86 67.007 51.99 74.63 4.124 1.477 10.257 1.42 15.474 1.57-6.154-1.76-6.95-.93-12.946-3.02-4.324-2.036-5.27-4.36-8.335-7.02l1.21 2.142c-6.007-2.13-3.493-2.63-8.38-4.18l1.294-1.69c-1.95-.15-5.16-3.288-6.04-5.02l-2.13.08c-2.56-3.157-3.926-5.434-3.827-7.196l-.69 1.226c-.78-1.34-9.418-11.85-4.938-9.4-.83-.76-1.94-1.24-3.14-3.42l.918-1.04c-2.157-2.778-3.97-6.33-3.83-7.52 1.15 1.556 1.947 1.846 2.737 2.11-5.446-13.51-5.75-.743-9.876-13.75l.875-.07c-.67-1.01-1.076-2.1-1.615-3.18l.38-3.785C6.81 80 9.637 65.26 10.2 57.175c.39-3.29 3.27-6.79 5.46-12.275l-1.33-.23c2.55-4.45 14.568-17.878 20.13-17.187 2.7-3.387-.532-.013-1.06-.866 5.92-6.13 7.784-4.33 11.78-5.43 4.31-2.56-3.7.996-1.656-.98 7.45-1.902 5.28-4.325 15-5.29 1.02.58-2.38.9-3.237 1.66 6.204-3.04 19.64-2.35 28.37 1.682 10.125 4.73 21.503 18.72 21.95 31.883l.51.137c-.26 5.23.8 11.28-1.033 16.84l1.243-2.63"/>
-    <path d="M44.925 82.244l-.347 1.734c1.625 2.207 2.915 4.6 4.99 6.325-1.493-2.915-2.602-4.12-4.643-8.06m3.842-.15c-.86-.95-1.37-2.096-1.94-3.237.546 2.005 1.662 3.728 2.7 5.48l-.76-2.243m67.987-14.777l-.363.91c-.66 4.732-2.1 9.413-4.3 13.754 2.44-4.58 4.01-9.59 4.67-14.664M63.03.74C64.7.126 67.138.402 68.912 0 66.6.194 64.3.31 62.028.603l1 .136m-58.7 31.21c.386 3.56-2.683 4.95.68 2.6 1.803-4.07-.704-1.13-.68-2.6M.376 48.46c.775-2.377.915-3.805 1.21-5.182-2.14 2.738-.984 3.32-1.21 5.183"/>
-  </g>
-</svg>
diff --git a/website/public/img/icons/icon_freebsd.svg b/website/public/img/icons/icon_freebsd.svg
deleted file mode 100644
index 95ea3e7d7f3..00000000000
--- a/website/public/img/icons/icon_freebsd.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 153 150">
-  <g fill="#B5010F">
-    <path d="M150.43 3.04c8.04 8.038-14.25 43.364-18.017 47.134-3.768 3.762-13.34.3-21.376-7.738-8.04-8.036-11.504-17.61-7.735-21.377 3.766-3.77 39.09-26.06 47.128-18.02m-112.75 8.5C25.408 4.58 7.94-3.17 2.385 2.39c-5.63 5.627 2.4 23.486 9.44 35.783 6.262-10.89 15.17-20.055 25.857-26.63"/>
-    <path d="M138.17 47.402c1.13 3.834.926 7-.908 8.83-4.28 4.284-15.847-.276-26.274-10.2-.727-.65-1.45-1.328-2.158-2.04-3.77-3.77-6.704-7.785-8.58-11.482-3.652-6.55-4.566-12.337-1.805-15.097 1.504-1.503 3.91-1.913 6.846-1.384 1.92-1.22 4.18-2.56 6.66-3.95-10.08-5.25-21.54-8.22-33.69-8.22-40.31 0-72.99 32.67-72.99 72.982 0 40.305 32.68 72.982 72.99 72.982 40.31 0 72.99-32.68 72.99-72.985 0-13.017-3.416-25.224-9.384-35.807-1.29 2.354-2.544 4.51-3.69 6.36"/>
-  </g>
-</svg>
diff --git a/website/public/img/icons/icon_hashios.svg b/website/public/img/icons/icon_hashios.svg
deleted file mode 100644
index d8ce37254a4..00000000000
--- a/website/public/img/icons/icon_hashios.svg
+++ /dev/null
@@ -1,4 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 138 150">
-  <path d="M83.333 111.25l22.5-12.5V13.333L83.333 0v63.75h-28.75v-25l-22.916 12.5v85.417L54.583 150V86.25h28.75"/>
-  <path d="M116.667 19.167v86.666l-33.334 18.334V150l54.167-31.25v-87.5M54.583 0L0 31.25v87.5l21.25 12.083V44.167l33.333-18.334"/>
-</svg>
diff --git a/website/public/img/icons/icon_linux.svg b/website/public/img/icons/icon_linux.svg
deleted file mode 100644
index 47e73ce2ab9..00000000000
--- a/website/public/img/icons/icon_linux.svg
+++ /dev/null
@@ -1,112 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 544 664">
-  <defs>
-    <linearGradient id="a" x1="49.181%" x2="49.482%" y1="115.284%" y2="41.252%">
-      <stop stop-color="#FFEED7" offset="0%"/>
-      <stop stop-color="#BDBFC2" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="b" x1="47.425%" x2="41.754%" y1="2.019%" y2="90.126%">
-      <stop stop-color="#FFF" stop-opacity=".8" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="c" x1="46.201%" x2="49.215%" y1="87.917%" y2="9.628%">
-      <stop stop-color="#FFEED7" offset="0%"/>
-      <stop stop-color="#BDBFC2" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="d" x1="51.73%" x2="49.844%" y1="85.418%" y2="13.617%">
-      <stop stop-color="#FFEED7" offset="0%"/>
-      <stop stop-color="#BDBFC2" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="e" x1="46.558%" x2="41.366%" y1="2.882%" y2="93.366%">
-      <stop stop-color="#FFF" stop-opacity=".65" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="f" x1="70.346%" x2="64.553%" y1="5.94%" y2="94.063%">
-      <stop stop-color="#FFF" stop-opacity=".65" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="g" x1="50%" x2="50%" y1="89.843%" y2="40.625%">
-      <stop stop-color="#FFEED7" offset="0%"/>
-      <stop stop-color="#BDBFC2" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="h" x1="43.569%" x2="45.399%" y1="98.882%" y2="23.094%">
-      <stop stop-color="#FFEED7" offset="0%"/>
-      <stop stop-color="#BDBFC2" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="i" x1="50%" x2="50.4%" y1="13.171%" y2="94.634%">
-      <stop stop-color="#FFF" stop-opacity=".8" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="j" x1="50.8%" x2="51.6%" y1="37.436%" y2="92.821%">
-      <stop stop-color="#FFF" stop-opacity=".65" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="k" x1="50%" x2="50%" y1="2.344%" y2="81.25%">
-      <stop stop-color="#FFF" stop-opacity=".65" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="l" x1="57.152%" x2="57.142%" y1="2.344%" y2="71.875%">
-      <stop stop-color="#FFF" stop-opacity=".65" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="m" x1="60.793%" x2="46.264%" y1="51.06%" y2="100.24%">
-      <stop stop-color="#FFA63F" offset="0%"/>
-      <stop stop-color="#FF0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="n" x1="94.027%" x2="19.452%" y1="129.341%" y2="-67.53%">
-      <stop stop-color="#FFEED7" offset="0%"/>
-      <stop stop-color="#BDBFC2" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="o" x1="50.09%" x2="40.875%" y1="34.285%" y2="100.443%">
-      <stop stop-color="#FFA63F" offset="0%"/>
-      <stop stop-color="#FF0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="p" x1="-30.509%" x2="15.632%" y1="9.949%" y2="94.191%">
-      <stop stop-color="#FFF" stop-opacity=".65" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="q" x1="43.398%" x2="48.705%" y1="2.218%" y2="102.569%">
-      <stop stop-color="#FFF" stop-opacity=".65" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="r" x1="46.741%" x2="86.742%" y1="-3.616%" y2="75.858%">
-      <stop stop-color="#FFF" stop-opacity=".65" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="s" x1="50%" x2="50.826%" y1="17.631%" y2="99.339%">
-      <stop stop-color="#FFA63F" offset="0%"/>
-      <stop stop-color="#FF0" offset="100%"/>
-    </linearGradient>
-    <linearGradient id="t" x1="55.881%" x2="55.392%" y1="3.119%" y2="94.531%">
-      <stop stop-color="#FFF" stop-opacity=".65" offset="0%"/>
-      <stop stop-color="#FFF" stop-opacity="0" offset="100%"/>
-    </linearGradient>
-  </defs>
-  <g fill="none" fill-rule="evenodd">
-    <path fill="#000" fill-rule="nonzero" d="M111.235 528.542c-27.985-40.278-33.442-171.23 31.86-251.787 32.357-38.648 40.612-65.58 43.163-101.74 1.736-41.225-29.156-164.304 87.354-173.68C391.62-8.08 385.282 108.41 384.602 170.052c-.563 52.05 38.218 81.552 64.746 122.12 49.1 74.537 44.946 202.874-9.25 272.34-68.645 86.96-127.44 49.247-166.486 52.412-73.117 4.002-75.534 42.988-162.377-88.382z"/>
-    <path fill="url(#a)" fill-rule="nonzero" d="M443.264 299.383c-20.53 18.382-74.476 101.638 8.168 154.99 29.137 18.584-27.473 87.52-53.69 53.41-46.25-61.22-14.814-157.315 13.95-191.512 19.546-24.25 49.034-33.35 31.572-16.88z" transform="matrix(-1 0 0 1 843.1 6)"/>
-    <path fill="#000" fill-rule="nonzero" stroke="#000" stroke-width="1.566" d="M390.554 288.337c33.41 26.996 94.238 122.038 5.516 183.773-29.14 19.247 25.823 79.94 56.684 48.895 107.302-107.91-2.8-231.996-40.7-274.654-33.873-37.09-63.878 8.77-21.5 41.99z"/>
-    <path fill="url(#b)" fill-rule="nonzero" d="M338.348 63.578c0 20.035-14.11 38.547-37.016 48.565-22.906 10.017-51.127 10.017-74.033 0-22.91-10.018-37.02-28.53-37.02-48.565 0-30.97 33.14-56.077 74.03-56.077s74.03 25.11 74.03 56.08z" transform="rotate(2.1 245.8 181)"/>
-    <path fill="url(#c)" fill-rule="nonzero" d="M240.512 134.393c0 20.15-10.582 36.486-23.634 36.486-13.053 0-23.634-16.34-23.634-36.49 0-13.04 4.505-25.08 11.817-31.6 7.32-6.52 16.33-6.52 23.64 0 7.31 6.514 11.82 18.56 11.82 31.594z" transform="rotate(-3.4 231.7 62.9)"/>
-    <path fill="url(#d)" fill-rule="nonzero" d="M329.64 133.672c0 23.28-14.668 42.152-32.764 42.152-18.096 0-32.766-18.872-32.766-42.152 0-15.06 6.245-28.976 16.383-36.505 10.138-7.53 22.628-7.53 32.765 0 10.138 7.53 16.383 21.445 16.383 36.505z" transform="matrix(-1 0 0 1 595.6 -4.4)"/>
-    <path fill="#000" fill-rule="nonzero" d="M283.36 140.28c-.283 12.775 6.153 23.28 14.374 23.462 8.22.182 15.115-10.028 15.398-22.804.183-8.264-2.485-15.964-7-20.2-4.513-4.233-10.188-4.36-14.885-.328-4.697 4.03-7.704 11.604-7.887 19.87zm-52.122.493c1.223 10.556-2.603 19.67-8.545 20.36-5.94.687-11.75-7.312-12.97-17.868-.792-6.83.528-13.376 3.462-17.176 2.933-3.8 7.034-4.28 10.758-1.25 3.724 3.03 6.505 9.1 7.295 15.93z"/>
-    <path fill="url(#e)" fill-rule="nonzero" d="M299.932 133.182c0 7.16-3.9 12.966-8.713 12.966-4.82 0-8.72-5.805-8.72-12.966 0-4.632 1.66-8.912 4.354-11.23 2.696-2.315 6.017-2.315 8.713 0 2.695 2.318 4.356 6.598 4.356 11.23z" transform="matrix(-1 -.1 -.1 1 598.2 29.6)"/>
-    <path fill="url(#f)" fill-rule="nonzero" d="M222 135.095c0 6.003-2.91 10.87-6.497 10.87-3.59 0-6.498-4.867-6.498-10.87 0-3.884 1.24-7.473 3.25-9.415 2.01-1.942 4.486-1.942 6.497 0 2.01 1.942 3.25 5.53 3.25 9.415z" transform="rotate(-6.6 224.1 98.7)"/>
-    <path fill="url(#g)" fill-rule="nonzero" d="M150.83 356.05c16.046-36.377 50.144-100.28 50.87-149.696 0-39.303 117.724-48.69 127.172-9.448 9.447 39.242 33.426 98.104 48.687 126.445 15.26 28.34 59.76 118.37 12.35 196.94-42.7 69.558-172.16 124.58-241.26-9.444-23.26-46.51-19.11-104.143 2.18-154.786z" transform="translate(4.2 .7)"/>
-    <path fill="url(#h)" fill-rule="nonzero" d="M144.186 328.062c-15.698 24.774-49.48 90.528 16.917 133.288 71.517 45.48 64.774 126.777-21.753 80.923-79.135-41.52-31.84-179.96-6.286-211.943 16.875-22.484 41.67-49.674 11.122-2.268z" transform="rotate(-4.2 165.1 371.4)"/>
-    <path fill="#000" fill-rule="nonzero" stroke="#000" stroke-width="1.563" d="M152.295 300.345c-21.83 35.635-74.22 119.766-4.11 163.404 94.46 57.94 67.716 115.88-18.5 63.71C8.3 454.63 114.905 307.94 163.6 252.04c55.555-62.75 10.693 11.36-11.305 48.3z"/>
-    <path fill="url(#i)" fill-rule="nonzero" d="M360.848 369.86c0 39.713-38.115 91.3-103.552 90.837-67.485.558-96.29-51.124-96.29-90.837s44.766-71.943 99.922-71.943 99.92 32.23 99.92 71.943z" transform="translate(4.2 .7)"/>
-    <path fill="url(#j)" fill-rule="nonzero" d="M325.24 244.87c-.728 41.16-27.51 50.87-61.406 50.87s-58.5-6.077-61.406-50.87c0-28.08 27.51-44.328 61.406-44.328 33.895 0 61.405 16.25 61.405 44.33z" transform="translate(4.2 .7)"/>
-    <path fill="url(#k)" fill-rule="nonzero" d="M120.31 308.09c22.145-33.746 68.77-85.456 8.72 7.265-48.687 76.304-18.002 125.34-2.178 138.8 45.658 40.7 43.707 67.935 7.993 46.506-77.03-45.78-61.043-122.81-14.535-192.57z" transform="translate(4.2 .7)"/>
-    <path fill="url(#l)" fill-rule="nonzero" d="M440.78 321.895c-19.146-39.626-80.165-139.877 2.91-23.254 75.576 105.38 22.527 178.77 13.08 186.04-9.446 7.27-41.42 21.8-31.974-3.63 9.446-25.433 56.543-73.715 15.986-159.145z" transform="translate(4.2 .7)"/>
-    <path fill="url(#m)" fill-rule="nonzero" stroke="#E68C3F" stroke-width="7.813" d="M103.598 633.646C53.045 606.876-20.467 638.8 6.22 566.064c5.345-16.548-7.968-41.26.727-57.408 10.173-19.622 31.975-15.26 45.056-28.342C64.9 466.7 73.076 443.252 97.058 446.886c23.98 3.634 39.93 33.076 56.68 69.036 12.353 25.798 56.176 62.08 53.312 90.948-3.37 44.375-53.784 52.737-103.452 26.776z" transform="translate(4.2 .7)"/>
-    <path fill="url(#n)" fill-rule="nonzero" d="M471.962 442.628c-1.972 16.49-23.484 50.735-45.585 53.984-22.466 3.533-43.562-22.55-48.62-47.085-6.486-27.282 14.81-38.136 47.17-37.492 34.953 1.095 48.605 9.197 47.035 30.593z" transform="rotate(21.8 424.5 465.9)"/>
-    <path fill="url(#o)" fill-rule="nonzero" stroke="#E68C3F" stroke-width="7.816" d="M422.002 627.53c-51.36-29.677-124.144 7.05-96.017-69.88 5.886-16.44-8.197-42.208.447-58.46 10.115-19.748 32.065-14.674 45.07-27.84 12.823-13.7 23.398-35.058 47.24-31.4 23.84 3.657 37.254 31.047 53.906 67.238 12.282 25.963 53.954 61.606 51.107 90.66-3.35 44.66-53.096 57.202-101.753 29.682z" transform="matrix(-.9 .4 .4 .9 613 -118.3)"/>
-    <path fill="url(#p)" fill-rule="nonzero" d="M392.175 569.75c-87.022-60.14-47.576-74.215-37.052-85.16 10.377-11.39 18.934-29.147 38.228-26.107 19.3 3.04 30.15 25.813 43.63 55.9 9.94 21.586 43.305 51.164 41.358 75.373-2.63 28.354-48.463 5.74-86.154-20.005z" transform="matrix(-.9 .4 .4 .9 566.8 -119.7)"/>
-    <path fill="url(#q)" fill-rule="nonzero" d="M92.513 572.445c-87.02-60.142-47.062-76.947-34.138-85.01 15.486-10.4 15.244-32.246 34.538-29.206 19.292 3.04 30.9 27.3 44.374 57.39 9.94 21.58 43.304 51.16 41.357 75.37-2.63 28.35-48.44 7.19-86.13-18.55z" transform="rotate(1 67.3 776.8)"/>
-    <path fill="#000" fill-rule="nonzero" d="M471.258 462.296c-6.524 11.77-33.848 30.69-52.308 26.13-18.832-4.462-27.666-30.75-24.28-50.792 3.083-22.56 23.195-23.97 48.597-13.233 27.315 11.9 35.674 22.32 27.99 37.9z"/>
-    <path fill="url(#r)" fill-rule="nonzero" d="M448.335 444.335c-1.148 9.137-13.67 28.11-26.536 29.91-13.08 1.958-25.36-12.494-28.31-26.087-3.777-15.116 8.62-21.13 27.46-20.774 20.342.607 28.29 5.096 27.38 16.95z" transform="rotate(20.1 420.6 463.2)"/>
-    <path fill="url(#s)" fill-rule="nonzero" stroke="#E68C3F" stroke-width="4.688" d="M214.897 160.906c8.933-8.462 31.013-33.832 72.45-7.194 7.703 5.013 13.953 5.472 28.777 11.82 29.657 12.185 15.477 41.573-15.93 51.384-13.447 4.362-25.67 20.695-50.16 19.3-20.92-1.222-26.4-14.844-39.25-22.383-22.835-12.89-26.205-30.318-13.874-39.567 12.333-9.248 17.156-12.573 17.987-13.36z" transform="translate(4.2 .7)"/>
-    <path stroke="#E68C3F" stroke-width="3.125" d="M320.718 185.25c-12.354.727-39.242 27.615-67.583 27.615-28.34 0-45.055-26.16-49.415-26.16"/>
-    <path fill="url(#t)" fill-rule="nonzero" d="M228.98 158.587c4.49-4.033 18.644-15.1 37.416-3.77 3.955 2.244 8.04 4.685 14.113 8.02 12.03 6.998 6.07 17.083-8.35 23.464-6.54 2.68-17.327 8.59-25.538 8.18-9.125-.84-15.03-6.79-21.077-10.663-11.094-7.33-10.42-13.246-5.267-18.173 3.896-3.383 8.28-6.674 8.694-7.05z" transform="translate(4.2 .7)"/>
-  </g>
-</svg>
diff --git a/website/public/img/icons/icon_macosx.svg b/website/public/img/icons/icon_macosx.svg
deleted file mode 100644
index bbdb31f5f08..00000000000
--- a/website/public/img/icons/icon_macosx.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 150">
-  <path fill="#000" fill-rule="nonzero" d="M124.47 116.895c-2.268 5.24-4.954 10.064-8.065 14.5-4.24 6.045-7.712 10.23-10.388 12.554-4.148 3.814-8.593 5.768-13.352 5.88-3.416 0-7.536-.973-12.333-2.946-4.81-1.963-9.234-2.935-13.277-2.935-4.24 0-8.79.97-13.653 2.934-4.872 1.973-8.797 3-11.798 3.102-4.564.195-9.113-1.815-13.653-6.037-2.897-2.528-6.522-6.862-10.865-13-4.66-6.556-8.49-14.157-11.49-22.824C2.38 98.766.77 89.7.77 80.926c0-10.053 2.172-18.723 6.523-25.99 3.42-5.835 7.968-10.438 13.662-13.818 5.693-3.38 11.845-5.102 18.47-5.212 3.624 0 8.378 1.122 14.285 3.325 5.89 2.212 9.673 3.333 11.33 3.333 1.24 0 5.443-1.31 12.566-3.924 6.736-2.425 12.42-3.43 17.078-3.034 12.62 1.02 22.1 5.994 28.406 14.956-11.286 6.84-16.87 16.417-16.758 28.705.1 9.57 3.574 17.536 10.397 23.86 3.092 2.935 6.546 5.203 10.388 6.814-.833 2.418-1.713 4.732-2.648 6.955zM95.526 3c0 7.502-2.74 14.506-8.203 20.99-6.592 7.706-14.566 12.16-23.213 11.457-.11-.9-.174-1.847-.174-2.843 0-7.2 3.135-14.908 8.702-21.21 2.78-3.19 6.315-5.844 10.602-7.96C87.517 1.35 91.564.196 95.37 0c.11 1.002.156 2.005.156 3z"/>
-</svg>
diff --git a/website/public/img/icons/icon_netbsd.svg b/website/public/img/icons/icon_netbsd.svg
deleted file mode 100644
index 5b6c5b17e97..00000000000
--- a/website/public/img/icons/icon_netbsd.svg
+++ /dev/null
@@ -1,9 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 197 148">
-  <g fill="none">
-    <path fill="#777" d="M37.966 10.474s-.557-1.27-2.13-.42c-1.307.71-.627 2.02-.627 2.02L59.77 62.93h5.96L37.96 10.473m69.74 131.735l-18.58-35.112h-8.004l18.67 38.644s1.882 3.637 5.92 1.626c4.035-2.01 2.002-5.158 2.002-5.158"/>
-    <path fill="#F26711" d="M176.214 6.99c-23.294-10.944-44.37-5.717-67.94 1.187-23.73 6.948-44.838 10.708-68.55 1.238 2.583 4.518 3.876 6.777 6.46 11.292 2.374 4.153 4.75 8.305 7.124 12.456l6.46 11.29c18.88 5.224 34.514-1.55 51.29-9.76 20.147-9.853 38.344-18.717 61.362-13.58-19.453-9.536-37.087-7.172-57.426-1.77C134.907 9.42 153.654 1.7 176.214 6.99M38.274 88.16c0 3.81 0 7.498.12 9.433-.42.7-2.095 1.348-3.53 1.348-.06 0-2.036-2.98-4.85-6.38L16.19 75.8c-3.41-4.22-5.445-6.62-6.522-7.5-.3.584-.3 1.58-.3 3.75v11.37c0 4.742.24 9.14.9 10.72.537 1.23 1.913 1.58 3.47 1.87l1.675.23c.478.47.36 1.7 0 2.05-3.232-.114-5.625-.175-8.02-.175-2.213 0-4.427.06-6.7.176-.36-.35-.48-1.58 0-2.05l1.016-.17c1.61-.35 2.75-.7 3.29-1.93.59-1.58.83-5.97.83-10.72V68.53c0-3.22 0-4.157-.42-4.977-.41-.997-1.31-1.583-3.4-1.993l-1.68-.235c-.42-.47-.36-1.874.23-2.05 2.81.115 5.8.176 8.26.176 2.03 0 3.77-.05 5.03-.17.6 2.64 4.49 7.09 9.88 13.36l5.03 5.8c2.69 3.05 4.36 5.1 5.74 6.45.24-.58.24-1.58.24-2.63v-8.09c0-4.74-.24-9.14-.9-10.72-.54-1.23-1.86-1.58-3.47-1.87l-1.62-.23c-.48-.47-.36-1.7 0-2.05 3.23.12 5.56.18 8.02.18 2.21 0 4.37-.05 6.7-.17.36.36.48 1.58 0 2.05l-1.08.18c-1.56.36-2.69.71-3.23 1.94-.66 1.58-.9 5.98-.9 10.726v14"/>
-    <path fill="#F26711" d="M52.492 81.656c.84 0 1.795-.12 2.455-.527.3-.18.417-.77.417-1.35 0-1.94-1.136-3.23-3.17-3.23-2.515 0-4.67 2.34-4.67 4.22 0 .82.838.88 2.754.88h2.214zm-3.95 2.577c-1.375 0-1.495.117-1.495 1.054 0 4.396 2.873 8.672 8.438 8.672 1.676 0 3.95-.35 5.565-3.05.66-.12 1.557.35 1.557 1.34-2.454 4.98-6.882 6.68-10.474 6.68-8.08 0-12.447-5.57-12.447-11.96 0-7.39 5.446-13.13 12.926-13.13 6.224 0 9.575 3.92 9.575 8.43 0 1.11-.3 1.93-2.153 1.93h-11.49zm25.445-6.385c-.777 0-.837.057-.837 1.348v8.786c0 3.283 0 6.916 4.19 6.916.837 0 1.794-.41 2.513-.878.597.174.957.818.836 1.522-1.68 1.757-4.91 3.4-8.62 3.4-4.97 0-6.71-2.814-6.71-6.683V79.19c0-1.232-.06-1.348-1.14-1.348h-1.85c-.66-.24-.84-1.407-.36-1.82 1.85-.64 3.53-1.697 4.97-2.633 1.07-.76 2.57-1.99 4.42-4.58.42-.23 1.5-.17 1.79.29v4.4c0 1.11.06 1.17 1.13 1.17h5.32c.3.23.48.58.48 1.11 0 .64-.18 1.69-.78 2.05h-5.39"/>
-    <path fill="#777" d="M95.6 88.217c0 4.57.6 7.44 5.268 7.44 4.428 0 6.76-3.338 6.76-8.085 0-5.097-2.99-8.67-8.735-8.67-3.293 0-3.293.058-3.293 2.403v6.912zm0-13.534c0 1.524.06 1.64 3.172 1.64 5.147 0 7.062-3.22 7.062-6.737 0-5.097-3.232-7.617-7.362-7.617-2.81 0-2.872.47-2.872 3.04v9.66zM87.34 69c0-5.917-.12-6.56-2.632-6.855l-1.616-.236c-.54-.3-.66-2.05.24-2.11 4.548-.3 8.917-.53 14.902-.53 5.744 0 9.576.64 12.208 2.17 2.573 1.52 4.128 3.98 4.128 7.44 0 4.92-4.248 6.85-6.103 7.32-.6.11-1.198.35-1.198.64 0 .17.3.35.84.47 4.72.99 8.73 4.04 8.79 9.72.06 5.39-3.23 8.55-7 9.84-3.77 1.28-8.26 1.46-11.91 1.46-2.16 0-4.43-.24-6.17-.24-2.94 0-5.87.06-9.28.17-.48-.35-.48-1.88 0-2.05l1.73-.35c2.69-.53 3.05-.94 3.05-6.21V69zm42.617 30.056c-5.505 0-8.917-1.523-10.173-2.225-1.136-1.28-1.914-5.5-1.914-9.49.418-.76 1.795-.82 2.274-.17 1.196 3.81 5.205 9.2 10.293 9.2 4.427 0 6.464-2.99 6.464-5.92 0-4.74-4.54-7.55-8.14-9.31-4.3-2.11-8.97-5.62-9.03-11.42 0-6.62 5.21-11.19 13.89-11.19 1.98 0 4.43.24 6.83.94.78.23 1.32.35 2.04.47.48 1.29 1.08 4.46 1.08 8.38-.3.7-1.79.76-2.33.18-1.02-2.99-3.59-7.27-7.9-7.27-3.95 0-6.1 2.52-6.1 5.45 0 2.7 2.45 5.16 5.45 6.68l3.96 2.05c3.71 1.94 8.44 5.33 8.44 11.78 0 7.21-6.05 11.9-15.082 11.9"/>
-    <path fill="#777" d="M158.184 87.512c0 3.225.12 5.333 1.197 6.564 1.08 1.173 2.82 1.7 4.97 1.7 10.35 0 13.89-9.02 13.89-16.992 0-10.546-5.68-16.815-16.52-16.815-1.61 0-2.75.29-3.11.76-.36.46-.42 1.58-.42 3.39v21.39zm-8.557-18.572c0-5.565-.12-6.678-2.873-6.97l-1.136-.117c-.598-.293-.598-1.994.12-2.053 5.027-.292 9.694-.528 16.04-.528 4.906 0 9.812.473 13.942 1.935 7.84 2.753 12.148 9.667 12.148 16.99 0 7.852-3.83 14.18-10.71 17.52-4.07 1.993-8.98 2.752-15.143 2.752-2.81 0-5.806-.36-7.96-.36-2.873 0-5.925.06-9.335.17-.478-.35-.478-1.76 0-2.05l1.855-.3c2.693-.47 3.052-.88 3.052-6.27V68.94zm35.993-5.17c0-1.452.525-2.69 1.577-3.718 1.05-1.027 2.32-1.54 3.8-1.54 1.482 0 2.75.513 3.798 1.54 1.048 1.027 1.573 2.266 1.573 3.717 0 1.45-.525 2.69-1.573 3.72-1.05 1.03-2.316 1.54-3.797 1.54-1.482 0-2.75-.52-3.8-1.55-1.053-1.03-1.58-2.27-1.58-3.72zm9.867 0c0-1.216-.437-2.253-1.313-3.11-.876-.858-1.934-1.287-3.176-1.287-1.242 0-2.302.43-3.18 1.286-.88.85-1.318 1.89-1.318 3.11 0 1.21.44 2.25 1.318 3.11.878.86 1.938 1.29 3.18 1.29 1.242 0 2.3-.43 3.176-1.29.876-.86 1.313-1.9 1.313-3.12zm-2.82 3.165l-1.686-2.788h-.95v2.788h-.94v-6.468h1.7c1.59 0 2.39.597 2.39 1.79 0 .83-.43 1.417-1.28 1.76l1.81 2.918h-1.02zm-2.642-5.685v2.163c.08.01.285.014.618.014.613 0 1.026-.076 1.237-.23.212-.154.318-.448.318-.882 0-.715-.476-1.073-1.428-1.073h-.372l-.373.008z"/>
-  </g>
-</svg>
diff --git a/website/public/img/icons/icon_openbsd.svg b/website/public/img/icons/icon_openbsd.svg
deleted file mode 100644
index e24f73e68e0..00000000000
--- a/website/public/img/icons/icon_openbsd.svg
+++ /dev/null
@@ -1,742 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 174 150">
-  <defs>
-    <radialGradient id="a" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#EED26A" offset="73.1%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="b" r="71.529%" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="c" r="95.965%" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="d" r="76.495%" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="e" r="90.68%" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="f" cx="-142.012%" cy="157.813%" r="1292.725%" fx="-142.012%" fy="157.813%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="g" r="105.04%" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="h" r="90.477%" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="i" r="139.124%" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="j" r="107.054%" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="k" r="152.143%" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-    <radialGradient id="l" r="126.107%" fx="50%" fy="50%">
-      <stop stop-color="#FFF68E" offset="0%"/>
-      <stop stop-color="#FAEA82" offset="50%"/>
-      <stop stop-color="#D6AA4A" offset="100%"/>
-    </radialGradient>
-  </defs>
-  <g fill="none">
-    <path fill="#000" d="M99.18.888c-1.455 3.382-1.047 7.327-2.107 10.842-.245.81-1.045 3.256-2.216 3.087-2.394-.347-1.154-4.946-3.917-5.038l.867 6.72c-4.15.52-3.585-5.96-5.27-8.59-1.944-3.04-2.413 1.37-2.283 2.73.083.87.26 1.73.364 2.6.18 1.51.224 2.82.033 4.34-3.96-.05-2.51-5.27-5.42-6.07l.22 6.29c-4.4-.04-6.4-4.01-8.33-7.38-.8-1.41-1.88-4.12-3.81-3.26.91 3.91 3.04 7.65 3.26 11.71.06 1.05-.93 3.72-2.39 3.23-3.36-1.14-2.91-7.25-5.72-8.85-.57-.33-1.46-.04-2.08-.02 0 3.24 1.43 7.16 2.56 10.19.25.65.93 2.94-.49 2.9-2.54-.08-3.17-5-5.75-4.42.32 1.32 1.11 2.4 1.55 3.68.27.78.77 1.57.91 2.38.32 1.78-1.93 1.92-3.1 1.58-2.76-.81-4.75-3.07-6.72-5.05-.55-.55-1.99-2.48-2.9-1.6-1.01.97.98 2.68 1.54 3.33 1.69 1.95 3.52 4.23 4.32 6.72.35 1.07.42 2.59-.64 3.32-1.05.73-2.76-.59-3.61-1.15-2.6-1.71-5.18-4.7-8.46-4.77l-.76 1.95 2.09 2.82 5.4 6.07-6.29-2.6c.25 1.64 4.19 3.64 3.42 5.33-.46 1-2.74 1.02-3.64.89-3.2-.45-5.47-2.84-8.46-3.7-2.63-.75-2.14 1.29-.65 2.47.52.41 1.02.84 1.52 1.27.9.78 1.76 1.57 2.61 2.41 1.32 1.32 2.47 2.72 3.69 4.12l-6.29-.22v.43l6.08 2.82-1.08 4.34c-1.75-.01-3.18-.48-4.77-1.18-1.09-.47-2.23-1.26-3.47-1.17-1.48.1-2.36 1.45-1.37 2.71 1.49 1.89 4.46 2.97 6.36 4.44.72.56 1.77 1.52.95 2.48-1.61 1.89-5.98-.54-8.11.09v.43c1.98 1.15 6.04 1.81 7.2 3.94.91 1.66-1.67 5.44-3.51 5.29-1.63-.13-3.13-1.98-4.33-2.94-2.88-2.32-5.96-5.04-9.32-6.64-5.78-2.72-11.5 1.64-16.07 4.48.59 1.85 2.89-.12 4.34.21 1.95.44 3.43 2.26 4.68 3.7 6.04 6.95 11.09 14.83 13.35 23.85.6 2.37 1.61 5.21-.16 7.34-.47.57-1.18.64-1.71 1.11-.39.35-.37.85.17 1.02 1 .3 2.45-.16 3.42-.39 3.19-.77 6.82-2.49 8.27-5.61.9-1.95 1.22-5.73 3.45-6.51.5 2.08 2.84 4.84 2.61 6.94-.2 1.86-2.16 4.02-3.31 5.4-.41.49-1.39 1.56-.8 2.26.58.7 1.79-.81 2.15-1.15 1.65-1.56 5.24-4.01 6.22-.44.85 3.1-1.88 8.11-3.24 10.84-.38.76-2.13 3.13-1.44 3.98.78.97 2.43-1.57 2.78-2.03 1.37-1.79 6.15-7.09 8.7-5.19 3.1 2.33 2.03 3.99.86 7.14-.33.89-1.55 3.12-.72 3.96.81.82 1.86.07 2.28-.71.74-1.41 2.75-5.6 4.75-4.53 1.25.67 3.17 1.81 3.9 3.06 1.14 1.96.15 5.86-.16 7.99-.17 1.22-1.49 5.04-.4 5.93 1.01.81 1.82-1.64 2.13-2.25 1.07-2.12 2.3-4.3 3.89-6.07.57-.64 1.38-1.71 2.35-1.53 5.04.94-.11 5.96 1.96 8.52.42.51 1.55.48 2.16.59l2.6-6.72c1.33.51 3.27.69 4.25 1.78.82.92.98 2.47 1.22 3.64.66 3.27 1.03 6.44.61 9.76.41.3 1.06.99 1.62.63.7-.45.79-2.27 1.03-3.02.77-2.4 1.94-4.68 3.02-6.94.72-1.49 2.67-3.08 4.07-1.03 1.45 2.1.87 5.78 1.77 8.18 2.31-1.14 2.56-5.93 2.6-8.24l2.99.43 1.8 3.68 3.24 9.33c1.67-.65 1.14-3.87 1.33-5.42.26-2.11.74-6.34 2.29-7.91.62-.63 1.86-.68 2.67-.99.92 2.24 1.42 4.79 2.54 6.94.43.84 1.42 1.74 2.42 1.23.96-.49.92-1.61.8-2.53-.3-2.25-.81-4.46-.99-6.72 4.3-.31 6.82 3.17 9.53 6.07 1.046 1.12 1.955 2.6 3.49 3.03l-2.23-6.51-1.24-6.07c1.56-.65 4.86-3.84 6.51-3.38 2.45.69 4.32 7.52 7.36 5.91 1.3-.68.63-1.84.02-2.75-.91-1.35-3.63-4.59-3.34-6.29.22-1.25 2.33-2.72 3.55-2.7 2.81.04 7.7 2.18 9.33 4.44l1.95-.22c-.29-3.88-6.11-5.65-6.94-9.54-.08-.39-.07-.85.03-1.24.61-2.49 2.11-1.4 3.66-.73.48.21 1.54.75 1.94.15.44-.66-.34-1.527-.63-2.077-.58-1.12-1.12-2.42-.88-3.687 2.02.53 3.27 1.73 4.98 2.87.4.27 1.29.94 1.81.57.53-.4-.26-1.2-.51-1.49-.77-.89-3.11-3.03-2.88-4.32.15-.87 1.63-1.81 2.23-2.4 1.98-1.98 4.24-4 5.85-6.29h.22c3.83 4.47 15.836 1.33 14.31-5.42-.955.13-1.84.89-2.82.55-4.27-1.47-3.24-8.32-8.02-8.36-.35-4.46-2.14-8.92-4.306-12.8-.99-1.78-3.056-3.41-3.776-5.22-.4-1-.33-2.59-.38-3.67 2.503-.39 1.27-2.93.353-4.34-1.01-1.57-2.09-3.43-3.41-4.75-1.63-1.62-4.04-2.68-3.83-5.44.19-2.57 4.61-2.24 5.36-4.55-1.31.06-2.61.38-3.904.6-3.22.535-3.78-.55-2.27-3.42 1.31-2.504 3.408-4.41 5.25-6.5.59-.67 2.41-2.2 1.478-3.17-.78-.8-2.06.42-2.72.86-2.39 1.59-5.06 2.76-7.8 3.61-.82.253-3.22 1.194-3.5-.25-.37-1.955 3.33-2.32 2.84-4.515-1.48.35-4.39 2.69-5.81 1.6-1.71-1.3.8-4.63 1.07-6.16.27-1.55-.974-1.602-1.85-.632-.31.34-.59.71-.87 1.07-.49.62-.9 1.23-1.22 1.95-3.55-2.07 3.17-4.48 1.9-6.4-.45-.68-1.28 0-1.69.354-.84.735-4.01 4.39-4.7 1.71-.76-2.97.78-6.53 1.58-9.33.207-.73 1.15-2.7.23-3.223-1.33-.77-1.92 1.817-2.23 2.575-.96 2.335-2.55 4.36-4.42 6.036-.62.55-1.66 1.62-2.59 1.36-1.34-.37-1.35-4.09-1.3-5.23.02-.54.32-1.47-.21-1.87-.69-.51-1.05.52-1.15 1.01-.33 1.597-1.325 6.16-3.69 3.167-2.14-2.7 1.17-8.32-3.2-9.46l-2.38 7.59c-2.86-.62-2.225-4.71-1.52-6.94l-1.3-.43c-.21.89-.5 1.75-.806 2.61-1.156 3.24-2.7 3.87-3.89.22-.91-2.79-.587-5.81-1.04-8.68-.18-1.143-.287-2.303-1.42-2.82z"/>
-    <path fill="url(#a)" d="M98.793 6.87c-.128 6.195-2 10.837-8.89 10.842l2.384 9.76c-2.588-2.714-3.53-6.51-4.698-9.977-.75-2.2-1.69-4.412-2.03-6.722h-.22c.08 3.914.9 7.8.12 11.71-.44 2.15-1.65 3.82-2.29 5.855h-.22l1.3-9.542c-4.85.383-9.02 1.116-12.2-3.47-.69-.996-1.22-2.137-1.69-3.252h-.22c.54 3.628 3.77 7.862-.02 10.906-.58.465-1.25.75-1.93 1.02l3.43 5.197 1.99 2.61c-5.49-3.633-8.75-9.96-11.5-15.83h-.21c.7 4.67 3.53 8.893 4.24 13.662.24 1.65.89 4-.56 5.2l-1.73-8.24c-2.53 1.31-4.47 5.25-7.81 4.69-1.42-.24-2.57-1.39-3.91-1.88.62 1.98 2.36 3.86 1.37 6.07-.37.81-1.09 1.44-1.59 2.17l6.94 2.6c-1.27 1.51-3.91.32-5.43-.39-2.88-1.35-5.44-3.13-8.03-4.97-1.47-1.05-3.19-2.54-4.99-2.88 1.11 2.36 3.94 4.37 5.86 6.11 1.58 1.43 2.76 3.08 4.1 4.73 1.31 1.62 3.03 3.45 2.4 5.64-2.31-2.33-4.32-4.02-7.81-3.2-1.26.29-2.33 1.04-3.69 1-2.41-.06-4.74-1.29-6.94-2.14 1.28 2.73 4.65 4.21 5.36 7.37.53 2.32-1.14 5.28-1.45 7.59l7.37 1.08v.43c-6.32 1.67-10.78-1.8-16.7-2.82v.22c4 1.89 8.52 5.08 11.37 8.46 1.04 1.23 2.31 2.65 2.3 4.33-1.17-.95-3.37-3.41-4.99-3.16-1.29.19-1.72 1.63-1.89 2.72-.46 2.95-.5 6.12-.5 9.11-1.25-1.09-1.09-2.6-1.09-4.12-1.54 1.01-3.21 2.29-5.21 1.89-2.02-.41-4.03-2.89-5.43-4.28-2.76-2.74-5.81-5.44-9.76-5.98-2.06-.28-8.31.01-5.52 3.16.29.32.58.66.97.86 1.46.76 4.6-.21 6.28-.21v.21l-5.41 1.09c2.18 4.56 6.9.47 9.54 3.25-1.81-.54-4.91-.54-6.72 0l3.03 3.9 1.39 1.82 5.12.56v.21h-4.55c.27 2.38 3.03 1.73 4.77 1.51v.22l-3.69.65c.58 1.34 2 5.33 3.34 5.94 1.05.48 2.52-.45 3.39-.95-1.2 2.18-3.34 1.3-2.17 4.33L27 91.85c-.774.877-2.074 1.567-2.596 2.61-.61 1.206.41 3.39.86 4.55l3.47-2.6-3.31 3.71.27 3.88c2.904-1.21 5.26-3.36 6.5-6.29.513-1.22.57-2.74 1.18-3.88.45-.83 1.744-.69 2.005-1.59.5-1.72-.56-3.112.29-4.94h.21l.65 3.47c2.19-.61 3.49-4.06 4.12-6.07h.43c.6 2.787-1.92 4.59-2.82 6.94 1.53.358 4.28 1.1 4.12 3.04l-5.42-1.95 4.12 9.11h.22c1.98-3 3.9-7.77 6.72-9.98.98 3.2-2.43 5.8-3.69 8.458 1.86-.51 5.23-3.008 6.94-1.95-2.39.99-4.51 2.43-6.27 4.333-.58.63-1.63 1.68-1.62 2.6.01.94 1.17 2.08 1.69 2.82 1.89 2.68 4.18 5.49 7.06 7.16 1.17-2.24 2.17-4.48 2.79-6.94.28-1.13.23-2.65 1.33-3.25 1.06 5.98-3.22 12.58-4.56 18.22 4.08-3.45 6.54-9.04 11.71-11.27-.12 2.79-4.6 4.27-4.84 7.37-.08 1.09 1.27 1.66 2.02 2.18 2.1 1.46 3.88 3.08 6.29 4.05.87.35 1.68 1.09 2.49.25 1.46-1.52 1.59-4.49 1.35-6.47-.15-1.25-.67-3.16.28-4.12l1.51 8.89-.86 10.41h.21c2.03-5.15 3.82-10.75 7.81-14.74.02 2.72-3.05 6.54-4.12 9.11 4.06 1.9 8.83 3.05 13.22 3.9.34-2.72.24-5.35-.47-8.02-.32-1.2-1.37-2.79-.62-3.91 2.69 5.79 5.63 11.66 5.64 18.22h.21c0-3.97.69-8.03 1.47-11.92.14-.71.34-3.64 1.35-3.64 1.1 0 .67 1.75.56 2.34-.5 2.66-1.1 5.33-1.44 8.02l9.32-.23 3.24-.58-.09-3.31-4.46-7.81c1.7-.38 3.37 2.64 4.16 3.91 2.87 4.63 4.81 10.54 6.03 15.83h.22c-.57-7.16-2.43-13.78-1.52-21.03 2.11.85.98 6.19 1.24 8.24.09.66-.01 2.39.78 2.65.75.24 2.05-.4 2.75-.63 2.56-.83 4.94-2.03 7.38-3.14.93-.43 2.25-.95 2.31-2.13.23-4.18-3.52-5.37-6-7.59 2.19-.23 3.79 1.21 5.42 2.48 2.44 1.9 4.85 4.05 6.85 6.42 1.15 1.36 2 3.19 3.35 4.33-.75-2.33-2.53-4.51-3.64-6.72-2.14-4.27-3.79-8.91-4.39-13.66h.22l4.12 10.84c2.24-.76 4.06-3.42 5.5-5.2.65-.8 1.45-1.54 1.43-2.6 3.64-1.31-1.03-4.2-1.74-5.42 2.52-.38 4.79 2.06 7.15 2.6-1.05-2.26-2.89-5.21-2.38-7.81h.43l1.51 4.34c3.8-3.51 8.29-7.11 11.12-11.49 3.99-6.18 3.97-14 1.17-20.6-.77-1.81-1.5-4.37-2.84-5.82-1.92-2.07-3.58 1.41-3.82 3 .94.14 1.8.46 2.6 1 2.94 1.99 3.09 5.48 1.85 8.55-.52 1.3-1.49 2.46-1.59 3.9-.11 1.79.85 3.49 1.16 5.21.51 2.86-.89 5.9-2.94 7.79-1.9 1.76-4.57 2.73-7.16 2.34-1.2-.17-2.47-1.3-3.69-.85-1.9.71-2.28 3.59-3.47 5.04-.54-3.26 1.94-5.14 2.46-8.02.27-1.5-.83-3.99-1.3-5.42-.37-1.13-.94-4.33-2.67-3.68-1.12.42-1.68 1.69-2.33 2.6-1.55 2.14-2.95 4.76-5.7 5.42 1.01-2.6 3.74-4.78 5.27-7.153 3.03-4.713 6.25-12.68 2.23-17.78-1.21-1.535-3.15-2.62-4.9-3.44-2.41-1.13-5.05-1.486-7.59-2.2v-.43l3.04-.43-.65-4.77-1.95.65c.03-7.94 7.97-12.275 13.45-16.485l-1 2.82 2.7 4.12 5.47 8.45-2.17-.22c.42 3.103 1.16 6.013.07 9.11-.71 1.99-2.44 3.64-2.96 5.64-.27 1 .21 2.02.21 3.03 0 1.41-.49 2.76-.8 4.12 3.89-1.85 4.63-7.52 8.68-8.89-.33-1.92-1.14-3.66-1.28-5.64-.29-4.29.56-8.52-.11-12.8-.73-4.67-2.76-8.86-4.46-13.223l1.954.87c.45-3 2.92-4.62 4.554-6.94-2.503.91-6.36 4.02-9.11 2.38-1.89-1.13-2.58-3.62-4.55-4.55l-2.6 10.41h-.22c-1.14-4.81 1.317-9.36 2.39-13.88-3.31 2.67-5.61 6.04-10.19 6.72l6.29-4.57 1.44-2.11-1.88-1.62-4.77-3.4 2.17.43.87-6.94h-.213c-.49.86-1.076 1.65-1.754 2.38-.9.97-2.08 2.52-3.36 2.96-2.52.87-6.01-2.07-8.33-2.74v9.97c-2.22-.37-1.93-2.6-1.95-4.55-.05-4.28-.19-8.5 0-12.79h-.22c-.65 4.82-2.23 11.69-6.94 14.096 1.35-2.165 2.63-4.014 3.34-6.506.21-.73.83-1.99.05-2.57-2.19-1.643-5.54-.24-7.33-2.85-1.77-2.57-.61-5.84-1.7-8.46z" transform="translate(.604 .524)"/>
-    <path fill="#0F0D06" d="M86.17 11.947l.216.217-.217-.217zm-.218.65l.217.218-.22-.217z"/>
-    <path fill="#0E0B05" d="M111.975 13.465l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M98.313 13.9l.217.216-.217-.217z"/>
-    <path fill="#0D0B05" d="M111.758 14.333l.217.216-.217-.22z"/>
-    <path fill="#0F0D06" d="M98.096 14.55l.217.216-.217-.217z"/>
-    <path fill="#FFF" d="M62.314 16.284l.217.217-.21-.21z"/>
-    <path fill="#0F0D06" d="M97.012 16.284l.216.217-.216-.21zm-.217.217l.217.22-.217-.21zm4.987.22l.217.22-.22-.21zm-29.71.22l.218.22-.217-.21zm30.144 0l.217.22-.217-.21zm-39.25.22l.216.22-.217-.21zm10.625 0l.22.22-.21-.21zm29.06 0l.22.22-.21-.21z"/>
-    <path fill="#0F0E07" d="M74.24 17.802l.218.217-.217-.22zm19.52 0l.216.217-.217-.22z"/>
-    <path fill="#0D0B05" d="M128.022 17.802l.217.217-.22-.22z"/>
-    <path fill="#FFF" d="M127.878 18.164l.072.144-.072-.144z"/>
-    <path fill="#0F0D06" d="M62.965 18.236l.217.217-.217-.217zm44.456 0l.22.217-.21-.217z"/>
-    <path fill="#0F0E07" d="M72.507 19.103l.216.217-.216-.217z"/>
-    <path fill="#0E0B05" d="M127.59 19.103l.215.217-.216-.217z"/>
-    <path fill="#0F0E07" d="M64.05 21.055l.216.217-.217-.217zm1.083 0l.217.217-.217-.217zm.217.434l.217.21-.217-.22z"/>
-    <path fill="#000" d="M97.445 22.356l-3.47 15.614c2.673-1.63 3.238-7.567 3.47-10.41h.217c.465 2.5.69 5.006 1.707 7.374.4.938.84 2.187 1.98 2.17l-2.78-9.76-1.13-4.988z"/>
-    <path fill="#0F0E07" d="M89.638 22.573l.217.217-.217-.217zm-18.433.434l.217.217-.217-.217zm-1.084.867l.22.217-.21-.21zm-1.08.434l.22.217-.21-.217zm27.76.65l.22.217-.21-.216z"/>
-    <path fill="#000" d="M76.193 25.175c.046 5.545 2.788 10.593 1.735 16.265 1.04-.636 1.07-2.122 1.083-3.253.04-2.624-.42-5.196-.43-7.807h.22c.76 2.62 2.81 7.833 5.86 8.24-.36-1.408-1.52-2.474-2.29-3.686-1.71-2.692-3.39-8.124-6.16-9.76z"/>
-    <path fill="#0F0E07" d="M67.52 25.392l.216.217-.217-.22z"/>
-    <path fill="#0F0E08" d="M76.627 25.392l.217.217-.217-.22z"/>
-    <path fill="#0F0D06" d="M106.336 25.61l.217.216-.217-.217z"/>
-    <path fill="#0F0E07" d="M96.578 26.043l.217.217-.217-.217zm10.626 0l.217.217-.21-.217z"/>
-    <path fill="#0F0D06" d="M125.637 26.043l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M106.987 26.26l.217.217-.217-.217zm-1.3.217l.216.216-.217-.216zm1.083 0l.217.216-.217-.216z"/>
-    <path fill="#0F0E08" d="M77.494 26.693l.217.217-.21-.217zm14.313.217l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M126.938 26.91l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M105.686 27.344l.217.217-.217-.21z"/>
-    <path fill="#000" d="M120.65 27.56c-2.412 3.787-5.286 8.953-8.892 11.71v.218c2.734-.488 5.69-3.943 6.506-6.506h.216c-.03 3.858-1.805 7.948-.216 11.71h.216c1.154-3.903.553-8.508 1.547-12.577.31-1.276 1.46-3.403.622-4.554z"/>
-    <path fill="#0F0E07" d="M64.7 27.995l.217.216L64.7 28z"/>
-    <path fill="#0F0E08" d="M78.362 28.21l.217.218-.22-.217zm-11.927.435l.216.217-.21-.217zm-1.518.217l.216.217-.216-.22zm4.987 0l.217.217-.21-.22zm28.842 0l.217.217-.217-.22zm-1.734.434l.216.217-.216-.217z"/>
-    <path fill="#0F0D06" d="M120.65 29.296l.216.217-.217-.217z"/>
-    <path fill="#FFF" d="M133.877 29.513l.217.216-.217-.22zm-81.32.216l.216.21-.217-.22z"/>
-    <path fill="#0F0E08" d="M79.23 29.73l.216.216-.217-.217z"/>
-    <path fill="#0E0B05" d="M133.877 29.73l.217.216-.217-.217z"/>
-    <path fill="#0F0E07" d="M118.914 30.163l.217.217-.21-.217z"/>
-    <path fill="#0F0E08" d="M71.64 30.597l.216.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M112.408 30.597l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M73.59 31.03l.218.217-.217-.216z"/>
-    <path fill="#0F0E08" d="M73.808 31.247l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M118.047 31.247l.217.217-.217-.217z"/>
-    <path fill="#010101" d="M74.025 31.464l.216.217-.21-.21z"/>
-    <path fill="#0F0E07" d="M56.242 31.68l.217.218-.22-.217z"/>
-    <path fill="#0F0D06" d="M132.143 31.68l.216.218-.22-.217zm-.217.218l.217.217-.217-.217zm-90.647.434l.21.217-.22-.22z"/>
-    <path fill="#0F0E07" d="M53.857 32.332l.217.217-.217-.22z"/>
-    <path fill="#0E0D08" d="M79.663 32.55l.217.215-.217-.216z"/>
-    <path fill="#0F0E07" d="M118.48 32.765l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M128.89 32.765l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M131.058 32.765l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M118.264 32.982l.216.217-.216-.22z"/>
-    <path fill="#0E0D08" d="M77.71 33.85l.218.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M132.36 34.067l.216.216-.217-.216z"/>
-    <path fill="#0E0D08" d="M78.795 34.5l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M126.07 34.717l.217.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M82.265 34.934l.217.217-.217-.21z"/>
-    <path fill="#0F0D06" d="M136.263 35.368l.217.217-.217-.217z"/>
-    <path fill="#FFF" d="M147.973 35.368l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M82.7 35.585l.216.216-.217-.21z"/>
-    <path fill="#0F0E07" d="M116.53 35.585l.216.216-.217-.21z"/>
-    <path fill="#0E0B05" d="M147.973 35.585l.217.216-.217-.21z"/>
-    <path fill="#0D0B05" d="M147.106 35.8l.217.218-.217-.217zm.65 0l.217.218-.217-.217z"/>
-    <path fill="#0F0E07" d="M116.095 36.018l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M147.54 36.018l.216.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M81.615 36.235l.217.217-.217-.217z"/>
-    <path fill="#000" d="M106.336 36.235c-1.28 2.89-1.905 5.572-4.554 7.59v.434c1.904.5 3.23-1.89 3.687-3.47h.21c.19 1.45.36 4.48 1.95 4.98l-1.07-4.99-.24-4.56z"/>
-    <path fill="#0F0D06" d="M136.913 36.235l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M147.323 36.235l.216.217-.22-.217z"/>
-    <path fill="#000" d="M59.93 36.452c.467 5.334 7.642 8.94 6.72 14.746 1.155-.674.852-1.93.464-3.036-.8-2.285-2.14-4.285-3.065-6.505 2.07 1.894 5.14 4.035 8.02 2.82l-4.55-1.887-7.6-6.138z"/>
-    <path fill="#0E0B05" d="M147.106 36.452l.217.217-.217-.22z"/>
-    <path fill="#0D0B05" d="M146.89 36.67l.216.216-.217-.217z"/>
-    <path fill="#0F0D06" d="M133.227 36.886l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M144.937 36.886l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M146.672 36.886l.217.217-.22-.217z"/>
-    <path fill="#0E0D08" d="M82.265 37.103l.217.216-.217-.22z"/>
-    <path fill="#0F0E07" d="M115.228 37.103l.216.216-.216-.22z"/>
-    <path fill="#0D0B05" d="M146.455 37.103l.217.216-.217-.22z"/>
-    <path fill="#0F0E08" d="M59.93 37.32l.216.216-.217-.217zm55.08 0l.218.216-.217-.217z"/>
-    <path fill="#0E0B05" d="M146.238 37.32l.217.216-.217-.217z"/>
-    <path fill="#0F0E07" d="M61.447 37.536l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M146.02 37.536l.218.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M49.303 37.753l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M114.577 37.753l.217.217-.217-.217zm-.217.217l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M46.484 38.187l.217.217-.21-.217z"/>
-    <path fill="#0E0D08" d="M83.35 38.187l.216.217-.216-.217z"/>
-    <path fill="#000" d="M89.855 38.187c-.656 2.16-2.497 6.373-1.735 8.457h.434l1.518-5.204h.217c.53 1.963 1.09 4.94 3.47 5.204l-3.47-8.457h-.44z"/>
-    <path fill="#0F0E08" d="M46.7 38.404l.217.217-.216-.21z"/>
-    <path fill="#0D0B05" d="M145.154 38.404l.217.217-.21-.21z"/>
-    <path fill="#0F0E07" d="M46.917 38.62l.217.217-.217-.216z"/>
-    <path fill="#0F0E08" d="M53.857 38.62l.217.217-.217-.216zm58.55 0l.218.217-.217-.216z"/>
-    <path fill="#0F0E07" d="M47.134 38.837l.217.217-.21-.217z"/>
-    <path fill="#0F0E08" d="M51.038 38.837l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M105.252 38.837l.217.217-.22-.217zm1.3 0l.218.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M112.192 38.837l.216.217-.216-.217z"/>
-    <path fill="#0F0E07" d="M47.35 39.054l.218.217-.217-.21z"/>
-    <path fill="#0E0D08" d="M111.975 39.054l.217.217-.217-.21zm-48.36.434l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M117.613 39.488l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M61.447 40.14l.217.216-.217-.217zm43.155.216l.216.216-.216-.216z"/>
-    <path fill="#0F0E08" d="M54.507 40.572l.217.217-.217-.22zm-5.42.217l.216.21-.217-.22z"/>
-    <path fill="#0E0D08" d="M65.133 40.79l.217.216-.217-.217zm12.795 0l.217.216-.217-.217z"/>
-    <path fill="#0F0D06" d="M132.36 40.79l.216.216-.217-.217z"/>
-    <path fill="#0E0D08" d="M78.362 41.223l.217.217-.22-.217zm11.71.217l.217.217-.22-.217zm15.614 0l.217.217-.217-.217zm-42.72.867l.216.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M142.985 42.307l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M65.784 42.958l.217.217-.21-.217z"/>
-    <path fill="#0D0B05" d="M141.9 42.958l.218.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M63.615 43.175l.217.217-.217-.217zm40.12.217l.216.216-.21-.216z"/>
-    <path fill="#000" d="M75.326 43.608l1.084 9.108h.434l-.217-6.505c1.414.99 3.327 3.42 5.205 2.61-.725-.78-1.774-.92-2.602-1.59-1.346-1.09-2.056-3.46-3.904-3.61z"/>
-    <path fill="#0E0D08" d="M65.133 44.042l.217.217-.217-.22zm36.65.217l.216.21-.22-.22zm-37.3.21l.217.21-.217-.22zm23.42 0l.217.21-.216-.22z"/>
-    <path fill="#0F0E08" d="M118.047 44.476l.217.217-.217-.217zm.433 0l.217.217-.217-.217z"/>
-    <path fill="#000" d="M123.035 44.91c-2.288 2.293-4.2 3.87-7.374 4.77v.434c1.88.54 3.7-.502 5.21-1.518-.24 1.273-1.87 4.606-.65 5.422l2.08-6.29.74-2.818z"/>
-    <path fill="#0E0D08" d="M77.277 45.126l.217.217-.217-.217zm-24.72.217l.216.217-.217-.217zm34.913 0l.217.217-.217-.217zm20.168 0l.216.217-.216-.217z"/>
-    <path fill="#0F0D06" d="M122.384 45.343l.217.217-.21-.217z"/>
-    <path fill="#0F0E07" d="M37.81 45.777l.216.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M93.108 45.777l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M49.52 45.994l.217.217-.217-.21z"/>
-    <path fill="#0D0B05" d="M143.202 45.994l.217.217-.22-.21z"/>
-    <path fill="#0E0D08" d="M65.35 46.21l.217.218-.217-.217zm.868 0l.217.218-.217-.217zm22.336 0l.217.218-.21-.217zm-37.733.218l.22.216-.21-.216z"/>
-    <path fill="#0F0E08" d="M121.083 46.86l.217.218-.217-.217zm1.3.218l.218.217-.21-.217z"/>
-    <path fill="#0F0D06" d="M136.046 47.078l.217.217-.217-.217z"/>
-    <path fill="#010101" d="M37.16 47.295l.216.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M78.362 47.512l.217.217-.22-.22zm-11.494.217l.217.21-.217-.22zm13.012 0l.217.21-.217-.22z"/>
-    <path fill="#0F0E07" d="M37.81 47.946l.216.216-.217-.216z"/>
-    <path fill="#0F0E08" d="M119.565 47.946l.217.216-.217-.216z"/>
-    <path fill="#0E0D08" d="M79.23 48.162l.216.217-.217-.22zm2.385.217l.217.21-.217-.22z"/>
-    <path fill="#0F0E08" d="M120.432 48.596l.217.217-.22-.217z"/>
-    <path fill="#0E0D08" d="M80.314 48.813l.216.217-.216-.217zm.433.217l.217.217-.217-.217zm36.65 0l.216.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M131.275 49.03l.217.217-.217-.217zm-92.38.217l.215.217-.216-.217z"/>
-    <path fill="url(#b)" d="M124.816 58.48c4.962-1.194 10.387-1.9 15.397-.866-.746-2.59-2.68-4.72-4.396-6.723-.587-.68-1.334-1.95-2.328-2.02-1.18-.09-2.21 1.05-3.04 1.7-2.44 1.92-4.54 5.01-5.64 7.92z" transform="translate(.604 .524)"/>
-    <path fill="#0E0D08" d="M118.697 49.68l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M130.408 49.68l.217.217-.217-.217z"/>
-    <path fill="#000" d="M85.952 49.897l-1.3 6.723c1.087-.825 1.34-3.457 1.517-4.77l1.95 2.168c-.23-1.462-1.08-3.117-2.17-4.12z"/>
-    <path fill="#0E0D08" d="M115.66 50.114l.218.217-.217-.21z"/>
-    <path fill="#0F0E08" d="M120.432 50.114l.217.217-.22-.21zm14.963.217l.217.22-.217-.21z"/>
-    <path fill="#000" d="M107.204 50.548l-4.12 4.12 3.903-2.82.65 3.904c.76-1.11.36-4.157-.433-5.204zm-45.974.65v.217c1.828 1.845 3.332 4.385 4.473 6.723.628 1.287.45 2.706 1.816 3.47-.11-2.536-1.2-4.458-2.17-6.723 1.53.896 3.59 2.236 5.42 1.735v-.434c-2.46-1.094-4.37-2.024-6.51-3.728-.91-.726-1.85-1.665-3.04-1.26z"/>
-    <path fill="#0E0D08" d="M131.058 50.982l.217.216-.217-.216zm-44.022.433l.217.217-.217-.217zm-25.59.217l.218.217-.217-.22zm25.807.217l.217.21-.217-.22z"/>
-    <path fill="#0F0E08" d="M136.697 51.85l.216.216-.216-.217z"/>
-    <path fill="#0E0D08" d="M86.602 52.066l.217.217-.22-.217z"/>
-    <path fill="#0F0E08" d="M128.022 52.066l.217.217-.22-.217z"/>
-    <path fill="#0F0D06" d="M138.865 52.066l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M40.412 52.283l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M105.252 52.283l.217.217-.22-.217zm1.735 0l.217.217-.217-.217zm12.795 0l.217.217-.22-.217zm-55.516.217l.217.216-.217-.216zm21.686 0l.217.216-.22-.216z"/>
-    <path fill="#0F0D06" d="M145.37 52.5l.218.216-.217-.216z"/>
-    <path fill="#0F0E08" d="M129.107 52.716l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M105.47 52.933l.216.217-.217-.217z"/>
-    <path fill="#000" d="M46.7 53.15c.204 1.83 1.7 2.512 3.037 3.522 1.832 1.386 3.536 2.887 4.936 4.72.912 1.192 1.474 3.255 2.654 4.12-.254-3.19-2.135-6.942-5.205-8.242v-.216c3.12.605 6.23 1.765 9.325.433v-.433l-3.687-.146L46.7 53.15z"/>
-    <path fill="#0E0D08" d="M62.748 53.15l.217.217-.217-.217zm41.203.217l.22.217-.21-.217zm16.27 0l.22.217-.21-.217zm-54.65.217l.22.217-.21-.21zm38.17 0l.22.217-.21-.21z"/>
-    <path fill="#0F0D06" d="M139.95 53.584l.216.217-.217-.21z"/>
-    <path fill="#0F0E08" d="M126.504 53.8l.217.218-.21-.217z"/>
-    <path fill="url(#c)" d="M146.935 53.277l.434 5.204 4.77.66c-.8-2.1-3.08-5.03-5.21-5.85z" transform="translate(.604 .524)"/>
-    <path fill="#0E0D08" d="M88.12 54.018l.217.216-.217-.216z"/>
-    <path fill="#000" d="M95.06 54.018l-1.952 3.686 2.17-2.385 1.3 2.16"/>
-    <path fill="#0E0D08" d="M120 54.018l.215.216-.216-.216z"/>
-    <path fill="#0D0B05" d="M147.54 54.018l.216.216-.217-.216z"/>
-    <path fill="#0E0D08" d="M63.4 54.234l.215.217-.216-.21zm3.035 0l.216.217-.21-.21z"/>
-    <path fill="#0F0D06" d="M138.648 54.234l.217.217-.217-.21z"/>
-    <path fill="#0F0E08" d="M39.978 54.45l.217.218-.217-.217z"/>
-    <path fill="#0E0D08" d="M94.41 54.668l.216.217-.217-.217zm-26.89.217l.216.217-.217-.217zm-1.302.434l.217.21-.217-.22zm41.636 0l.217.21-.21-.22zm41.637 0l.22.21-.21-.22zm-54.21.21l.22.21-.21-.22zm54.43 0l.22.21-.21-.22zm-96.06.21l.22.21-.21-.22zm96.29 0l.22.21-.21-.22zm-101.05.22l.22.21-.22-.22zm47.28 0l.22.21-.21-.22z"/>
-    <path fill="#0F0E08" d="M39.544 56.403l.217.217-.21-.217z"/>
-    <path fill="#0E0D08" d="M49.52 56.403l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M126.72 56.403l.218.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M84.868 56.62l.216.217-.216-.217zm9.108.217l.216.217-.216-.217z"/>
-    <path fill="#0F0E08" d="M39.327 57.27l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M53.64 57.27l.217.217-.217-.217zm12.795 0l.216.217-.21-.217zm-1.085.217l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M126.07 57.487l.217.217-.216-.217z"/>
-    <path fill="#0F0E08" d="M135.395 57.487l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M139.3 57.704l.216.217-.217-.21z"/>
-    <path fill="#0E0D08" d="M51.688 58.138l.217.217-.217-.217zm14.096.217l.217.217-.21-.217z"/>
-    <path fill="#0D0B05" d="M152.31 58.788l.217.217-.217-.217z"/>
-    <path fill="#000" d="M115.878 59.222l-3.686 2.82 3.252-1.736-.433 2.603c.93-.65 1.27-2.67.87-3.69z"/>
-    <path fill="#FFF" d="M137.564 72.234c1.645-.784 2.432-2.658 2.877-4.338.55-2.066 1.26-7.516-1.36-8.543-1.44-.565-3.85.086-5.41.086-1.41 0-4.41-.22-5.5.83-1.01.97-.25 4.62.49 5.61.78 1.02 2.61 1.22 3.72 1.74 2.22 1.04 4 2.44 5.21 4.6z"/>
-    <path fill="#0F0D06" d="M143.636 59.44l.217.216-.217-.217z"/>
-    <path fill="#0D0B05" d="M151.443 59.44l.217.216-.217-.217zm1.3 0l-.216.433.217-.434z"/>
-    <path fill="#020202" d="M139.733 59.656l.216.217-.22-.217z"/>
-    <path fill="#FFF" d="M152.744 59.656l.217.217-.21-.217z"/>
-    <path fill="#0F0E08" d="M40.412 59.873l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M114.577 59.873l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M34.556 60.09l.217.216-.217-.216z"/>
-    <path fill="#0E0D08" d="M127.805 60.09l.217.216-.217-.216zm12.144 0l.21.216-.22-.216zm-72.65.216l.21.217-.22-.217zm47.92 0l.21.217-.22-.217z"/>
-    <path fill="#0F0E08" d="M35.858 60.523l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M113.493 60.523l.217.217-.217-.217z"/>
-    <path fill="#020202" d="M140.166 60.523l.217.217-.217-.217z"/>
-    <path fill="#FFF" d="M147.54 60.523v1.952c3.932-1.422 4.823 4.33.65 4.12l.867 4.988c2.906-1.356 4.245-7.895 1.858-10.34-.72-.738-2.4-.643-3.376-.72z"/>
-    <path fill="#0F0E07" d="M33.255 60.74l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M55.81 60.957l.215.217-.216-.217zm58.333 0l.217.217-.217-.217zm10.843 0l.217.217-.217-.217z"/>
-    <path fill="#020202" d="M140.383 60.957l.217.217-.217-.217zm10.41 0l.216.217-.22-.217z"/>
-    <path fill="#0F0E07" d="M33.906 61.174l.217.217-.217-.21z"/>
-    <path fill="#0E0D08" d="M124.553 61.174l.216.217-.22-.21zm-57.468.217l.217.22-.217-.21z"/>
-    <path fill="#000" d="M136.48 61.39c-.445.457-1.092.79-1.42 1.348-2.29 3.92 6.37 4.02 3.923-.217-.278-.48-.773-.79-1.202-1.13l-1.3.65v-.65z"/>
-    <path fill="#020202" d="M136.697 61.39v.218h.867"/>
-    <path fill="#010101" d="M140.6 61.39l.217.218-.217-.217z"/>
-    <path fill="#0F0E07" d="M34.556 61.608l.217.216-.217-.216z"/>
-    <path fill="#020202" d="M135.9 61.752l.074.145-.073-.145z"/>
-    <path fill="#010101" d="M136.19 61.68l.145.072-.144-.072zm.29.144v.217l1.084-.21h-1.084z"/>
-    <path fill="#020202" d="M137.998 61.608l.217.216-.217-.216z"/>
-    <path fill="#010101" d="M135.612 61.824l.217.217-.22-.21z"/>
-    <path fill="#050505" d="M138.43 61.824l.218.217-.217-.21z"/>
-    <path fill="#0F0E07" d="M35.207 62.04l.217.218-.217-.217z"/>
-    <path fill="#010101" d="M135.395 62.04l.217.218-.217-.217z"/>
-    <path fill="#020202" d="M148.19 62.04l.65.435v-.217"/>
-    <path fill="#050505" d="M148.407 62.04l.217.218-.217-.217z"/>
-    <path fill="#010101" d="M148.624 62.04l.217.218-.21-.217z"/>
-    <path fill="#020202" d="M149.057 62.04l.217.218-.217-.217z"/>
-    <path fill="#010101" d="M149.274 62.04l.217.218-.21-.217z"/>
-    <path fill="#0E0D08" d="M56.46 62.258l.216.217-.217-.217z"/>
-    <path fill="#000" d="M90.94 62.258c0 1.104-.213 2.224.867 2.82v-2.17l2.602.868-3.47-1.518z"/>
-    <path fill="#0E0D08" d="M91.373 62.258l.217.217-.217-.217z"/>
-    <path fill="#020202" d="M147.756 62.258l.217.217-.217-.217z"/>
-    <path fill="#010101" d="M147.973 62.258l.434.434v-.434h-.434zm1.084 0l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M92.024 62.475l.217.217-.21-.217z"/>
-    <path fill="#010101" d="M134.962 62.475l.217.217-.22-.217z"/>
-    <path fill="#0F0E08" d="M147.106 62.475l.217.217-.217-.217z"/>
-    <path fill="#050505" d="M147.323 62.475l.216.217-.22-.217z"/>
-    <path fill="#000" d="M104.168 65.294l1.084-1.952 1.3.868c-.952-2.55-2.37-.724-2.384 1.084z"/>
-    <path fill="#010101" d="M139.082 62.692l.217.217-.22-.22zm8.024 0l.217.217-.217-.22z"/>
-    <path fill="#000" d="M77.928 62.91c.383 1.4.984 2.594 2.17 3.468l-1.303-2.82 2.603.218c-.672-1.218-2.246-.867-3.47-.867z"/>
-    <path fill="#0E0D08" d="M80.964 62.91l.217.216-.21-.217zm10.843 0l.217.216-.217-.217z"/>
-    <path fill="#FFF" d="M146.89 62.91l.216.216-.217-.217z"/>
-    <path fill="#0F0E08" d="M36.725 63.126l.217.216-.217-.216z"/>
-    <path fill="#0E0D08" d="M105.903 63.126l.217.216-.217-.216z"/>
-    <path fill="#FFF" d="M146.672 63.126l.217.216-.22-.216z"/>
-    <path fill="#0E0D08" d="M92.674 63.342l.217.217-.21-.22z"/>
-    <path fill="#000" d="M66.868 64.21l3.036 3.686-1.735-3.036 2.6-.433-.22-.868"/>
-    <path fill="#0E0D08" d="M78.795 63.56l.217.216-.217-.217z"/>
-    <path fill="#050505" d="M139.3 63.56l.216.216-.217-.217z"/>
-    <path fill="#FFF" d="M146.455 63.56v.65h.217"/>
-    <path fill="#0E0D08" d="M78.145 63.776l.217.217-.217-.217z"/>
-    <path fill="#050505" d="M146.455 64.21l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M57.11 64.427l.217.217-.217-.217zm9.758 0l.217.217-.217-.217z"/>
-    <path fill="#FFF" d="M146.455 64.427v.65h.217"/>
-    <path fill="#010101" d="M138.937 64.788l.073.145-.073-.145zm12.072-.144l.21.216-.22-.216z"/>
-    <path fill="#0E0D08" d="M56.676 64.86l.217.217-.217-.217zm34.48 0l.217.217-.217-.217zm-52.046.217l.217.217-.217-.217zm39.685 0l.217.217-.217-.217z"/>
-    <path fill="#050505" d="M135.18 65.077l.215.217-.216-.217z"/>
-    <path fill="#0F0E08" d="M39.327 65.294l.217.217-.217-.21z"/>
-    <path fill="#FFF" d="M146.672 65.294l.217.217-.22-.21z"/>
-    <path fill="#010101" d="M138.215 65.51l.216.218-.21-.217z"/>
-    <path fill="#050505" d="M146.672 65.51l.217.218-.22-.217z"/>
-    <path fill="#020202" d="M136.046 65.728l.217.217-.217-.217z"/>
-    <path fill="#010101" d="M136.263 65.728l.217.217-.217-.217zm1.446.072l.14.073-.15-.073z"/>
-    <path fill="#FFF" d="M146.89 65.728l.216.217-.217-.217z"/>
-    <path fill="#010101" d="M150.43 65.873l.073.144-.072-.144z"/>
-    <path fill="#050505" d="M150.575 65.728l.217.217-.217-.217z"/>
-    <path fill="#010101" d="M39.978 65.945l.217.217-.217-.217z"/>
-    <path fill="#050505" d="M136.913 65.945l.217.217-.217-.217z"/>
-    <path fill="#FFF" d="M147.106 65.945l.217.217-.217-.217z"/>
-    <path fill="#010101" d="M128.673 66.162l.217.216-.217-.216z"/>
-    <path fill="#FFF" d="M147.323 66.162l.216.216-.22-.216z"/>
-    <path fill="#010101" d="M147.756 66.162l.217.216-.217-.216z"/>
-    <path fill="#000" d="M44.966 70.282v.434l6.29 2.168c-.13-1.648-2.26-2.14-3.688-2.385l4.337-3.91c-2.305-.27-5.07 2.54-6.94 3.68z"/>
-    <path fill="#050505" d="M147.54 66.378l.216.217-.217-.217z"/>
-    <path fill="#FFF" d="M147.756 66.378l.217.217-.217-.217z"/>
-    <path fill="#020202" d="M147.973 66.378l.217.217-.217-.217z"/>
-    <path fill="#010101" d="M148.84 66.378v.217h.65"/>
-    <path fill="#0F0E08" d="M40.628 66.595l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M140.6 66.595l.217.217-.217-.217zm8.24 0l.217.217-.216-.217z"/>
-    <path fill="#010101" d="M130.408 66.812l.217.217-.217-.22z"/>
-    <path fill="#000" d="M54.074 69.414v.434l4.77 1.714 2.82 1.973c-.31-2.303-2.753-2.69-4.337-3.904 2.014-.37 4.748-.41 5.638-2.6l-8.89 2.39z"/>
-    <path fill="#0E0D08" d="M126.287 67.246l.217.217-.217-.217z"/>
-    <path fill="#010101" d="M131.492 67.246l.217.217-.22-.217z"/>
-    <path fill="#0E0D08" d="M49.086 67.463l.217.217-.217-.217zm12.144.217l.217.216-.217-.216zm1.3 0l.218.216-.217-.216zm89.13 0l.217.216-.217-.216zm-109.947.216l.217.217-.217-.217z"/>
-    <path fill="#020202" d="M151.66 67.896l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M48.002 68.113l.217.217-.22-.217zm14.095 0l.217.217-.217-.217zm78.07.217l.216.217-.217-.217zm8.24 0l.217.217-.217-.217zm-101.056.217l.22.217-.21-.217z"/>
-    <path fill="#0F0D06" d="M142.335 68.547l.217.217-.217-.217zM18.51 68.98l.216.218-.217-.217z"/>
-    <path fill="#010101" d="M148.407 68.98l.217.218-.217-.217z"/>
-    <path fill="#0E0D08" d="M40.845 69.414l.217.217-.217-.21z"/>
-    <path fill="#000" d="M84.65 70.932l.65-1.518c-.922.148-1.648.86-.65 1.518z"/>
-    <path fill="#0E0D08" d="M45.833 69.63l.217.218-.217-.217z"/>
-    <path fill="#0F0D06" d="M19.81 69.848l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M132.793 69.848l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M57.76 70.065l.217.217-.217-.217z"/>
-    <path fill="#010101" d="M148.624 70.065l.217.217-.21-.217z"/>
-    <path fill="#0E0D08" d="M41.496 70.282l.217.217-.217-.22z"/>
-    <path fill="#0F0E07" d="M133.444 70.282l.217.217-.21-.22z"/>
-    <path fill="#0E0D08" d="M139.3 70.282l.216.217-.217-.22z"/>
-    <path fill="#0E0B05" d="M8.75 70.5l.217.216-.217-.217z"/>
-    <path fill="#0F0D06" d="M20.678 70.5l.216.216-.216-.217z"/>
-    <path fill="#0F0E08" d="M36.29 70.5l.218.216-.217-.217z"/>
-    <path fill="#020202" d="M150.36 70.5l.215.216-.216-.217z"/>
-    <path fill="#0E0D08" d="M59.278 70.716l.217.216-.217-.216z"/>
-    <path fill="#000" d="M92.458 70.716l-.217 1.518c.68-.397.8-.754.65-1.518h-.43z"/>
-    <path fill="#0E0D08" d="M92.89 70.716l.218.216-.217-.216z"/>
-    <path fill="#000" d="M101.566 72.234l.65-1.518c-.84.243-1.54.848-.65 1.518z"/>
-    <path fill="#010101" d="M139.082 70.716l.217.216-.22-.216z"/>
-    <path fill="#020202" d="M150.142 70.716l.217.216-.22-.216z"/>
-    <path fill="#0E0D08" d="M58.194 71.15l.217.216-.21-.217z"/>
-    <path fill="#010101" d="M136.913 71.15l.217.216-.217-.217z"/>
-    <path fill="#0F0E07" d="M141.25 71.15l.217.216-.216-.217z"/>
-    <path fill="#010101" d="M149.708 71.15l.217.216-.217-.217zm-.217.216l.22.217-.21-.217z"/>
-    <path fill="#0E0D08" d="M60.58 71.583l.216.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M22.196 71.8l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M137.347 71.8l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M13.304 72.017l.217.217-.21-.217z"/>
-    <path fill="#0E0D08" d="M92.674 72.017l.217.217-.21-.217zm8.458 0l.217.217-.22-.217z"/>
-    <path fill="#000" d="M108.07 73.535v.867l2.17-1.518"/>
-    <path fill="#0E0D08" d="M60.796 73.1l.217.218-.217-.217zm48.143 0l.21.218-.22-.217zm1.08 0l.21.218-.22-.217z"/>
-    <path fill="#000" d="M118.48 73.1v2.603c.815-.797.815-1.804 0-2.602z"/>
-    <path fill="#0F0D06" d="M147.323 73.1l.216.218-.22-.217z"/>
-    <path fill="#0D0B05" d="M156.214 73.1l.217.218-.21-.217z"/>
-    <path fill="#0E0D08" d="M108.722 73.318l.217.217-.22-.217zm1.084 0l.217.217-.217-.217zm8.458 0l.216.217-.216-.217z"/>
-    <path fill="#0F0E07" d="M139.95 73.318l.216.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M146.238 73.535l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M108.505 74.185l.217.217-.217-.217zm-31.01.217l.216.217-.21-.22z"/>
-    <path fill="#000" d="M75.76 77.438l2.602.65-1.444-1.39.793-2.08c-1.04.543-1.68 1.69-1.95 2.82z"/>
-    <path fill="#0E0D05" d="M147.54 74.62l.216.216-.217-.217z"/>
-    <path fill="url(#d)" d="M138.044 83.637v.217c5.457.69 7.914-1.92 11.927-4.988-.57 1.553-3.43 3.547-3.36 4.987.08 1.544 2.51 1.686 3.58 1.26 2.05-.812 3.35-3.076 3.79-5.163.93-4.333-4.76-7.88-8.32-5.114-3.05 2.37-4.4 6.42-7.61 8.8z" transform="translate(.604 .524)"/>
-    <path fill="#010101" d="M13.738 75.053l.217.217-.217-.217z"/>
-    <path fill="#000" d="M36.508 79.39c.28 1.618 1.885.75 3.036.67 1.654-.113 4.725.423 5.638 1.932l1.52-.217c-.39-2.454-3.928-2.45-5.857-2.602 1.42-1.435 3.454-1.863 3.904-4.12L36.5 79.39z"/>
-    <path fill="#0D0B05" d="M154.696 75.053l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M25.882 75.27l.217.217-.22-.217z"/>
-    <path fill="#0D0B05" d="M157.298 75.487l.217.216-.217-.216z"/>
-    <path fill="#0F0D06" d="M20.027 75.703l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M76.41 75.703l.217.217-.217-.217zm-33.396.217l.217.217-.21-.217zm33.613.217l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M27.4 76.57l.217.218-.217-.217z"/>
-    <path fill="#0E0D08" d="M42.146 76.57l.217.218-.217-.217zm1.735 0l.22.218-.21-.217z"/>
-    <path fill="#0E0B05" d="M14.172 76.788l.217.217-.22-.217z"/>
-    <path fill="#000" d="M86.602 76.788l-2.385 3.036 3.036 1.084-2.17-1.3c.453-.948 2.224-1.77 1.52-2.82z"/>
-    <path fill="#0E0D05" d="M154.045 76.788l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M33.038 77.005l.217.216-.217-.21z"/>
-    <path fill="#0E0D08" d="M41.496 77.005l.217.216-.217-.21zm34.047 0l.216.216-.22-.21z"/>
-    <path fill="#0F0E07" d="M28.268 77.22l.216.218-.216-.217zm4.337 0l.217.218-.217-.217z"/>
-    <path fill="#0E0D08" d="M43.014 77.438l.217.217-.21-.217zm24.505 0l.21.217-.22-.217z"/>
-    <path fill="#000" d="M67.736 77.438l-2.603 2.386c1.016.343 3.362 1.68 4.12.65l-2.818-1.084 1.3-1.952zm56.166 0l3.036 2.386v.433l-2.82 1.518c1.485-.12 2.75-.57 3.904-1.518-.843-1.428-2.49-2.505-4.12-2.82z"/>
-    <path fill="#0F0E07" d="M28.918 77.655l.217.217-.217-.217z"/>
-    <path fill="#010101" d="M154.48 77.655l.216.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M158.166 77.655l.216.217-.216-.217zm-143.127.217l.21.217-.22-.22z"/>
-    <path fill="#0E0D08" d="M85.3 77.872l.218.217-.217-.22zm1.086 0l.216.217-.216-.22zm38.817 0l.217.217-.217-.22z"/>
-    <path fill="#0E0D05" d="M144.07 77.872l.217.217-.217-.22zm10.41 0l.216.217-.217-.22z"/>
-    <path fill="#0E0D08" d="M66.65 78.09l.218.216-.217-.217zm.87 0l.216.216-.217-.217zm17.564 0l.217.216-.21-.217z"/>
-    <path fill="#0E0B05" d="M15.473 78.306l.217.217-.217-.217z"/>
-    <path fill="#000" d="M54.29 78.306c-1.312 2.943-3.334 5.34-5.638 7.586-1.322 1.29-3.383 2.49-3.903 4.34l9.54-2.024 4.98-1.01c-2.98-2.12-8.19.238-11.06 1.517 1.97-3.96 5.84-5.53 6.72-10.192l-.22-.217h-.44z"/>
-    <path fill="#0E0D08" d="M67.302 78.306l.217.217-.22-.217zm17.566 0l.216.217-.216-.217zm39.9 0l.218.217-.217-.217zm-83.49.217l.218.216-.217-.22z"/>
-    <path fill="#000" d="M93.976 80.474l1.3.217v-2.16c-.94.31-1.048 1.07-1.3 1.95z"/>
-    <path fill="#0F0E08" d="M38.243 78.74l.217.216-.217-.217z"/>
-    <path fill="#0E0D08" d="M125.42 78.74l.217.216-.217-.217zm-71.563.216l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M16.124 79.173l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M41.713 79.173l.217.217-.217-.217zm43.37.217l.218.217-.21-.217z"/>
-    <path fill="#010101" d="M154.696 79.39l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M127.59 79.607l.215.217-.216-.217z"/>
-    <path fill="#0F0E07" d="M141.467 79.607l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M67.52 79.824l.216.217-.217-.21z"/>
-    <path fill="#0F0D06" d="M149.708 79.824l.217.217-.217-.21z"/>
-    <path fill="#0E0D08" d="M66 80.04l.218.217L66 80.04zm27.976 0l.216.217-.216-.216z"/>
-    <path fill="#000" d="M104.168 80.04l.217 2.386c1.006-.533 1.663-1.277 1.95-2.385l-1.517 1.09-.65-1.08z"/>
-    <path fill="#0E0D08" d="M45.833 80.257l.217.217-.217-.217zm58.118 0l.22.217-.21-.217zm1.74 0l.22.217-.21-.217z"/>
-    <path fill="#0F0E08" d="M127.805 80.257l.217.217-.217-.217z"/>
-    <path fill="#0E0D05" d="M150.142 80.257l.217.217-.22-.217z"/>
-    <path fill="#0E0B05" d="M16.99 80.474l.218.217-.217-.21z"/>
-    <path fill="#0E0D08" d="M67.302 80.474l.217.217-.22-.21zm38.167 0l.21.217-.22-.21zm20.16.217l.21.22-.22-.21z"/>
-    <path fill="#0E0D05" d="M141.684 81.125l.217.217-.21-.217z"/>
-    <path fill="#010101" d="M154.262 81.125l.217.217-.22-.217z"/>
-    <path fill="#0D0B05" d="M159.25 81.342l.217.217-.217-.22z"/>
-    <path fill="#010101" d="M154.045 81.775l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M53.64 81.992l.217.217-.217-.22z"/>
-    <path fill="#0E0B05" d="M22.846 82.21l.217.216-.217-.217z"/>
-    <path fill="#020202" d="M146.89 82.426l.216.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M140.383 82.643l.217.217-.217-.217z"/>
-    <path fill="#0E0D05" d="M146.672 82.643l.217.217-.22-.217zm-6.506.217l.217.217-.217-.217z"/>
-    <path fill="#000" d="M73.59 84.595l.435-1.518c-.93.27-1.442.94-.434 1.518z"/>
-    <path fill="#0F0D06" d="M18.51 83.293l.216.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M72.94 83.293l.217.217-.217-.217zm-22.12.217l.218.217-.217-.217z"/>
-    <path fill="#0E0D05" d="M144.937 83.51l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M50.604 83.727l.217.217-.21-.217z"/>
-    <path fill="#010101" d="M152.96 83.727l.218.217-.217-.217zm-9.107.217l.217.217-.217-.21z"/>
-    <path fill="#0E0D05" d="M152.744 83.944l.217.217-.21-.21z"/>
-    <path fill="#000" d="M112.408 84.378l-.216 3.036-1.952-1.3c.204 1.314 1.123 1.94 2.385 2.167l.217-3.9h-.434z"/>
-    <path fill="#010101" d="M141.9 84.378v.217h.652"/>
-    <path fill="#000" d="M58.845 91.1c1.435-.06 6.433.13 7.156-.867l-4.77-.65 2.61-4.988c-1.58.493-4.28 4.975-4.98 6.505zm17.565 18.867c1.636-.937 3.765-3.73 4.554-5.422-1.736.52-2.495 2.222-3.687 3.47l-.65-4.554c5.072-.44 7.3-5.98 10.285-9.31 1.817-2.03 4.093-2.9 6.413-4.13-1.367-1.63-3.27.1-4.554 1.09-3.44 2.65-5.42 5.86-8.45 8.9l1.74-4.55h-.21c-.94 2.26-2.07 4.68-4.34 5.86l.87-3.03h-.22c-.91 2.18-1.94 3.25-4.33 3.25L76 96.55h-.22l-2.82 4.77-.87-.21 2.17-4.12h-.21c-1.1 1.752-2.25 4.25-4.55 3.684l1.954-3.685c-1.09.85-1.56 2.88-2.84 3.39-.587.23-1.69-.2-1.455-.97.3-1.01 1.96-2 2.61-2.86 2.22-2.92 4.02-7.67 7.32-9.46 2.7-1.47 6.8.39 9.75.35 1.69-.02 3.61-.6 4.12-2.39-1.38-.15-2.68.74-4.12.74-3.65 0-9.63-1.81-12.76.66-2.85 2.25-3.01 5.27-4.81 8.13-.88 1.4-2.42 2.34-3.69 3.35-.47.37-1.32.91-1.14 1.62.22.88 1.71 1.35 2.44 1.68 1.64.75 3.43 1.34 5.2 1.7.95.19 2.36.16 3.16.74 1.47 1.06.97 4.69 1.17 6.29z"/>
-    <path fill="#010101" d="M151.443 85.245l.217.217-.217-.217zm-3.687.217l.217.217-.217-.22zm3.036 0l.217.217-.22-.22z"/>
-    <path fill="#000" d="M35.858 85.68l-.217 1.3.87-1.3"/>
-    <path fill="#0E0D08" d="M87.036 85.68l.217.216-.217-.217z"/>
-    <path fill="#010101" d="M148.624 85.68l.217.216-.21-.217z"/>
-    <path fill="#0E0D08" d="M112.842 85.896l.217.217-.22-.217z"/>
-    <path fill="url(#e)" d="M147.803 91.444c-.498-1.47-.27-3.25-1.226-4.545-1.248-1.7-4.048-1.55-5.93-1.53-.65.01-1.734-.03-2.154.58-.502.73.41 2.53.608 3.31.82 3.25 1.55 7.73 4.37 9.91 1.86 1.43 5.59.49 7.13-1.04 2.47-2.45 3.14-8.16.63-10.8-3.1-3.27-3.05 2.54-3.42 4.09z" transform="translate(.604 .524)"/>
-    <path fill="#0F0D06" d="M20.244 86.113l.217.216-.21-.22z"/>
-    <path fill="#0E0D08" d="M74.24 86.113l.218.216-.217-.22z"/>
-    <path fill="#0F0E08" d="M40.628 86.33l.217.216-.217-.217z"/>
-    <path fill="#0E0D08" d="M48.002 86.33l.217.216-.22-.216zm14.963 0l.217.216-.217-.217z"/>
-    <path fill="#0F0E08" d="M36.29 86.546l.218.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M41.713 86.546l.217.217-.217-.217zm6.072 0l.217.217-.217-.217zm29.926 0l.22.217-.21-.217zm-30.14.217l.22.217-.21-.217z"/>
-    <path fill="#0F0E08" d="M36.074 86.98l.217.217-.21-.217z"/>
-    <path fill="#0E0D08" d="M61.664 86.98l.217.217-.21-.217zm11.71 0l.217.217-.21-.217z"/>
-    <path fill="#0E0B05" d="M88.77 86.98l.218.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M150.792 86.98l.217.217-.22-.217z"/>
-    <path fill="url(#f)" d="M161.248 86.673l-1.16 5.42-.82 2.81L160.814 96l-.433-1.952h.22c1.01 2.408 2.06 2.82 4.56 2.82l-1.52-3.254c1 1.15 1.36 2.777 3.04 3.036l-1.51-2.82c1.39 1.508 2.08 2.548 4.12 1.52v-.435c-3.61-1.72-3.94-7.5-8.02-8.24z" transform="translate(.604 .524)"/>
-    <path fill="#000" d="M127.155 88.932l.65-1.518c-.886.258-1.35.755-.65 1.518z"/>
-    <path fill="#0E0D08" d="M61.23 87.63l.217.217-.217-.216z"/>
-    <path fill="#0E0D05" d="M147.323 87.63l.216.217-.22-.216z"/>
-    <path fill="#0F0E08" d="M75.543 87.847l.216.217-.22-.217z"/>
-    <path fill="#010101" d="M139.082 87.847l.217.217-.22-.217z"/>
-    <path fill="#0D0B05" d="M159.467 87.847l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M54.29 88.064l.217.217-.216-.21z"/>
-    <path fill="#0F0E08" d="M75.326 88.064l.217.217-.217-.21zm-39.468.217l.216.22-.216-.21zm.867 0l.217.22-.217-.21zm38.384 0l.21.22-.22-.21z"/>
-    <path fill="#0E0D08" d="M61.447 88.498l.217.217-.217-.217zm10.41 0l.216.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M39.544 88.715l.217.217-.21-.217z"/>
-    <path fill="#0F0E07" d="M134.094 88.715l.217.217-.21-.217z"/>
-    <path fill="#010101" d="M148.407 88.715l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M39.327 89.15l.217.215-.217-.216z"/>
-    <path fill="#0F0E07" d="M74.458 89.15l.217.215-.217-.216z"/>
-    <path fill="#000" d="M97.88 89.15l2.384 2.6 1.085-2.6-1.09 1.733-2.39-1.734zm21.902 0l-.217 3.25-2.17-1.3c-.12 1.43 2.07 3.055 3.254 3.687l-.44-5.638h-.44z"/>
-    <path fill="#0E0D08" d="M59.712 89.582l.217.217-.22-.22zm3.687 0l.21.217-.22-.22zm-3.91.217l.21.21-.22-.22z"/>
-    <path fill="#0F0E07" d="M133.444 89.8l.217.216-.21-.217z"/>
-    <path fill="#0F0D06" d="M26.1 90.233l.216.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M39.76 90.45l.218.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M58.845 90.45l.216.217-.21-.217z"/>
-    <path fill="#0F0D06" d="M89.422 90.45l.216.217-.216-.217z"/>
-    <path fill="#0F0E07" d="M133.01 90.45l.217.217-.217-.217zm1.518.217l.217.216-.217-.216z"/>
-    <path fill="#0E0D08" d="M99.18 90.883l.217.217-.217-.217zm66.576 0l.216.217-.216-.217zm-95.2.217l.216.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M132.576 91.1l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M24.147 91.317l.217.217-.217-.217zm64.19 0l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M90.072 91.317l.217.217-.22-.217z"/>
-    <path fill="#0F0D06" d="M23.497 91.534l.217.217-.217-.21z"/>
-    <path fill="#0E0D08" d="M99.614 91.534l.217.217-.21-.21zm18.65 0l.216.217-.216-.21z"/>
-    <path fill="#0F0E07" d="M133.66 91.968l.217.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M88.554 92.4l.217.218-.21-.217z"/>
-    <path fill="#0F0D06" d="M23.497 92.618l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M140.383 92.618l.217.217-.217-.217zm-92.598.217l.217.217-.217-.217z"/>
-    <path fill="#000" d="M61.013 92.835c-.68 3.25-3 6.173-5.082 8.674-.99 1.19-2.51 2.39-2.94 3.9 3.6-1.04 7.64-4.69 11.5-4.34-.99-1.93-5.62.74-7.37 1.08 1.41-2.09 3.33-3.9 4.24-6.29.38-1 .62-2.35-.33-3.04z"/>
-    <path fill="#0F0E07" d="M72.073 92.835l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M86.17 92.835l.216.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M26.1 93.052l.216.217-.217-.22zm.866 0l.217.217-.217-.22z"/>
-    <path fill="#0E0D08" d="M60.796 93.27l.217.216-.217-.217z"/>
-    <path fill="#0F0E07" d="M130.84 93.27l.218.216-.217-.217z"/>
-    <path fill="#010101" d="M140.6 93.486l.217.217-.217-.217zm12.578.217l.217.216-.217-.22z"/>
-    <path fill="#0F0E08" d="M167.49 93.703l.217.216-.217-.22z"/>
-    <path fill="#0E0D08" d="M86.82 93.92l.216.216-.217-.217z"/>
-    <path fill="#0F0E08" d="M40.628 94.136l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M25.232 94.353l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M84.65 94.353l.218.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M25.015 94.57l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M120 94.57l.215.217-.216-.217z"/>
-    <path fill="#000" d="M109.372 98.04c-.917-.915-1.85-2.18-3.252-1.952l4.12 4.988 1.084-6.29c-1.652.262-1.572 1.902-1.952 3.254z"/>
-    <path fill="#0F0E07" d="M164.888 94.787l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M38.026 95.004l.217.217-.217-.21zm4.554 0l.217.217-.217-.21z"/>
-    <path fill="#000" d="M88.988 96.955l-.217-1.084h-.65l.22 2.82c1.27-.21 2.58-2.49 2.82-3.68l-2.17 1.95z"/>
-    <path fill="#010101" d="M152.96 95.004l.218.217-.217-.21z"/>
-    <path fill="#0E0D08" d="M46.267 95.22l.217.217-.217-.216zm37.733 0l.217.217L84 95.22zm1.735 0l.217.217-.217-.216zm25.59 0l.216.217-.21-.216z"/>
-    <path fill="#0F0E07" d="M131.275 95.22l.217.217-.217-.216z"/>
-    <path fill="#0D0B05" d="M169.876 95.437l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M68.17 95.654l.216.217-.217-.21z"/>
-    <path fill="#0E0B05" d="M159.684 95.654l.216.217-.216-.21z"/>
-    <path fill="#0E0D08" d="M48.002 95.87l.217.218-.22-.218zm11.71 0l.217.218-.22-.217z"/>
-    <path fill="#000" d="M76.05 96.016l.07.144-.07-.144z"/>
-    <path fill="#0F0E07" d="M130.408 96.088l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M154.48 96.088l.216.217-.217-.217zm6.722 0l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M61.013 96.305l.217.217-.217-.217zm14.746 0l.21.217-.22-.217zm-16.49.434l.21.21-.22-.22zm93.03 0l.21.21-.22-.22z"/>
-    <path fill="#0D0B05" d="M154.262 96.74l.217.215-.22-.216z"/>
-    <path fill="#0F0D06" d="M165.972 96.74l.217.215-.22-.216z"/>
-    <path fill="#000" d="M29.135 96.955l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M66.65 96.955l.218.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M128.673 96.955l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M28.7 97.172l.218.217-.217-.22zm.435 0l.217.217-.217-.22z"/>
-    <path fill="#0F0E08" d="M73.808 97.172l.217.217-.217-.22z"/>
-    <path fill="#0E0D08" d="M82.7 97.172l.216.217-.217-.22zm69.393 0l.217.217-.217-.22zm-42.72.434l.216.217-.22-.217zm32.962 0l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M32.822 97.823l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M82.048 98.04l.217.217-.217-.217zm28.192 0l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M46.484 98.257l.217.216-.21-.216z"/>
-    <path fill="#0E0B05" d="M70.12 98.257l.218.216-.217-.216z"/>
-    <path fill="#0E0D08" d="M72.94 98.257l.217.216-.217-.216z"/>
-    <path fill="#0F0E08" d="M74.892 98.257l.217.216-.22-.216z"/>
-    <path fill="#0E0D08" d="M83.566 98.257l.217.216-.217-.216z"/>
-    <path fill="#0D0B05" d="M155.13 98.257l.216.216-.216-.216z"/>
-    <path fill="#0E0D08" d="M64.7 98.473l.217.217-.217-.217zm13.228 0l.217.217-.217-.217z"/>
-    <path fill="#000" d="M97.012 98.473l-1.085 2.82h-.217l-1.734-2.386 1.518 4.988h.216c.577-1.45 2.62-4.115 1.302-5.422z"/>
-    <path fill="#0E0D08" d="M108.288 98.473l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M74.675 98.69l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M139.95 98.69l.216.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M67.085 98.907l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M96.578 98.907l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M39.978 99.124l.217.217-.217-.21z"/>
-    <path fill="#0F0E07" d="M74.025 99.124l.216.217-.21-.21z"/>
-    <path fill="#0E0D08" d="M77.928 99.124l.217.217-.217-.21zm1.952 0l.217.217-.217-.21z"/>
-    <path fill="#0F0D06" d="M27.183 99.34l.217.218-.217-.217z"/>
-    <path fill="#0E0D08" d="M80.314 99.34l.216.218-.216-.217zm63.322 0l.217.218-.217-.217zm-86.31.218l.217.217-.216-.217zm86.527 0l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M26.533 99.775l.217.216-.217-.21z"/>
-    <path fill="#0D0B05" d="M69.687 99.775l.217.216-.217-.21z"/>
-    <path fill="#0F0D06" d="M72.507 99.775l.216.216-.216-.21z"/>
-    <path fill="#0E0D08" d="M80.314 99.775l.216.216-.216-.21z"/>
-    <path fill="#000" d="M120.432 99.99l1.3 7.158c-1.38-1.208-5.644-6.772-7.372-4.77 3.99 1.27 5.652 5.93 9.108 8.023l-1.08-4.12-1.305-6.5-.65.22z"/>
-    <path fill="#0E0D08" d="M144.07 99.775l.217.216-.217-.21z"/>
-    <path fill="#010101" d="M148.19 99.99l.217.218-.217-.217z"/>
-    <path fill="#0E0B05" d="M153.612 99.99l.216.218-.216-.217z"/>
-    <path fill="#0D0B05" d="M25.882 100.208l.217.217-.22-.217z"/>
-    <path fill="#0F0E07" d="M31.52 100.208l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M58.194 100.208l.217.217-.21-.217z"/>
-    <path fill="#0D0B05" d="M68.82 100.208l.217.217-.217-.217zm.65 0l.217.217-.216-.217z"/>
-    <path fill="#0E0B05" d="M73.374 100.208l.217.217-.21-.217z"/>
-    <path fill="#010101" d="M145.154 100.208l.217.217-.21-.217z"/>
-    <path fill="#0D0B05" d="M153.395 100.208l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M56.676 100.425l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M68.386 100.425l.217.217-.217-.217zm3.036 0l.217.217-.22-.217z"/>
-    <path fill="#0F0E08" d="M42.797 100.642l.217.217-.217-.22z"/>
-    <path fill="#0F0E07" d="M78.145 100.86l.217.216-.217-.217z"/>
-    <path fill="#0F0D06" d="M30.87 101.076l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M72.723 101.076l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M77.71 101.076l.218.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M59.93 101.293l.216.216-.217-.22z"/>
-    <path fill="#0F0D06" d="M142.77 101.293l.215.216-.216-.22z"/>
-    <path fill="#0E0D08" d="M67.736 101.51l.217.216-.217-.217z"/>
-    <path fill="#000" d="M131.926 101.51c-1.098 2.688 1.582 5.573 2.602 8.023-2.82-1.453-5.323-3.875-8.674-3.903v.867c4.828.422 7.404 5.362 11.276 7.59-.036-4.042-3.505-8.69-4.77-12.578h-.434z"/>
-    <path fill="#0F0D06" d="M138.43 101.51l.218.216-.217-.217z"/>
-    <path fill="#0E0D08" d="M58.628 101.726l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M143.636 101.726l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M151.877 101.726l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M80.097 101.943l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M151.66 101.943l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M46.484 102.16l.217.217-.21-.217zm74.165 0l.21.217-.22-.217z"/>
-    <path fill="#0E0B05" d="M151.443 102.16l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M46.267 102.377l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M70.338 102.377l.217.217-.217-.217zm9.108 0l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M139.733 102.377l.216.217-.22-.217z"/>
-    <path fill="#0F0E08" d="M46.05 102.594l.217.217-.217-.21zm-.217.217l.217.22-.217-.21z"/>
-    <path fill="#0E0D08" d="M95.927 102.81l.217.217-.217-.216z"/>
-    <path fill="#0F0E08" d="M45.616 103.027l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M54.507 103.027l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M121.733 103.244l.217.217-.217-.21z"/>
-    <path fill="#0F0E07" d="M131.71 103.895l.216.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M44.75 104.112l.216.217-.217-.22z"/>
-    <path fill="#0E0D08" d="M55.592 104.112l.217.217-.22-.22zm-.434.217l.217.21-.217-.22z"/>
-    <path fill="#000" d="M87.904 104.762l-1.518.217c.51 1.21 1.414 2.19 1.838 3.47.47 1.4.165 3.35 1.63 4.12.68-1.53 2.35-4.01 1.953-5.64-1.232.6-1.816 1.92-1.952 3.25h-.217l-1.734-5.42z"/>
-    <path fill="#0F0E08" d="M44.098 104.98l.217.216-.217-.217z"/>
-    <path fill="#000" d="M67.736 104.98c0 4.255-.58 8.257-1.735 12.36 1.51.055 2.3-1.514 3.12-2.602 1.62-2.15 3.24-4.52 5.78-5.638v-.217c-2.57-.334-5.79 3.518-6.72 5.638h-.21c.77-2.95 1.45-6.64.22-9.54h-.43z"/>
-    <path fill="#0E0D08" d="M80.747 104.98l.217.216-.217-.217z"/>
-    <path fill="#0E0B05" d="M143.202 104.98l.217.216-.22-.217z"/>
-    <path fill="#0D0B05" d="M148.407 104.98l.217.216-.217-.217z"/>
-    <path fill="#000" d="M104.602 109.75l-4.988-3.47c.277.888.982 1.152 1.64 1.762 1.293 1.2 2.423 4.007 4.215 4.31l.43-7.156c-1.75.668-1.3 3.017-1.3 4.554z"/>
-    <path fill="#0F0E07" d="M132.36 105.196l.216.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M148.19 105.196l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M88.12 105.413l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M121.3 105.63l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M86.82 105.847l.216.216-.217-.216z"/>
-    <path fill="#0F0E08" d="M118.914 105.847l.217.216-.21-.216zm1.518.216l.217.217-.22-.217z"/>
-    <path fill="#0F0E07" d="M120.65 106.28l.216.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M79.23 106.497l.216.217-.217-.217zm21.25 0l.218.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M129.757 106.714l.217.217-.217-.21z"/>
-    <path fill="#0F0E07" d="M44.532 106.93l.217.218-.22-.217z"/>
-    <path fill="#0E0D08" d="M91.807 106.93l.217.218-.217-.217zm-13.228.435l.21.216-.22-.21z"/>
-    <path fill="#0F0E08" d="M120.215 107.365l.217.216-.217-.21z"/>
-    <path fill="#0F0D06" d="M134.528 107.365l.217.216-.217-.21z"/>
-    <path fill="#0E0B05" d="M144.937 107.365l.217.216-.217-.21z"/>
-    <path fill="#010101" d="M146.02 107.365l.218.216-.217-.21z"/>
-    <path fill="#0F0E07" d="M44.966 107.58l.216.218-.216-.217z"/>
-    <path fill="#0E0B05" d="M145.805 107.58l.216.218-.21-.217z"/>
-    <path fill="#0E0D08" d="M101.132 107.798l.217.217-.22-.217z"/>
-    <path fill="#0F0D06" d="M131.71 107.798l.216.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M145.588 107.798l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M55.592 108.232l.217.217-.22-.22zm32.528 0l.217.217-.217-.22zm13.88.434l.216.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M55.375 109.1l.217.216-.217-.216z"/>
-    <path fill="#0E0D08" d="M103.95 109.316l.218.217-.217-.217z"/>
-    <path fill="#000" d="M116.963 109.316c-1.53 2.712.7 8.298 1.084 11.277h-.217c-1.21-2.553-3.537-4.662-5.422-6.723-.265-.29-1.64-2.16-2.13-1.374-.512.82 1.998 2.767 2.47 3.326 1.732 2.054 3.297 4.377 4.61 6.723.758 1.355 1.42 3.168 2.857 3.903-1.085-5.594-2.803-11.404-2.82-17.132h-.432z"/>
-    <path fill="#0F0D06" d="M131.71 109.316l.216.217-.217-.217z"/>
-    <path fill="#010101" d="M72.507 109.533l.216.217-.216-.217z"/>
-    <path fill="#0E0D08" d="M73.59 109.533l.218.217-.217-.217zm15.832 0l.216.217-.216-.217z"/>
-    <path fill="#0F0E07" d="M122.384 109.533l.217.217-.21-.217z"/>
-    <path fill="#0F0E08" d="M116.53 109.75l.216.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M144.72 109.75l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M76.41 109.967l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M89.638 109.967l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M139.733 110.184l.216.217-.22-.21zm2.82 0l.216.217-.22-.21z"/>
-    <path fill="#0E0D08" d="M72.507 110.4l.216.218-.216-.217zm30.793 0l.217.218-.217-.217z"/>
-    <path fill="#0F0D06" d="M132.793 110.4l.217.218-.217-.217z"/>
-    <path fill="#0F0E08" d="M54.94 110.618l.218.216-.217-.216z"/>
-    <path fill="#0E0B05" d="M140.817 110.834l.217.217-.217-.21z"/>
-    <path fill="#0E0D08" d="M67.302 111.05l.217.218-.22-.217z"/>
-    <path fill="#0F0E07" d="M47.785 111.268l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M103.95 111.268l.218.217-.217-.217zm12.58 0l.216.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M144.72 111.268l.217.217-.217-.217z"/>
-    <path fill="url(#g)" d="M44.145 110.96l-2.386 6.724 4.98-3.47c-.09-1.676-1-2.776-2.6-3.253z" transform="translate(.604 .524)"/>
-    <path fill="#0E0D08" d="M71.205 111.702l.217.217-.217-.22zm33.18.217l.217.21-.217-.22z"/>
-    <path fill="#0F0E08" d="M54.074 112.786l.217.217-.21-.217z"/>
-    <path fill="#0F0D06" d="M135.395 112.786l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M111.54 113.003l.218.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M64.05 113.22l.216.217-.217-.217z"/>
-    <path fill="#000" d="M80.747 113.22l-.217.217c1.06 2.914 2.106 5.33 2.62 8.457.24 1.453.09 3.343 1.284 4.337 1.22-2.31 1.658-4.99 2.772-7.37.64-1.36 1.682-2.56 1.348-4.12-2.084 1.03-3.315 5.66-3.903 7.81-1.07-2.86-.74-7.85-3.9-9.32z"/>
-    <path fill="#0F0E08" d="M110.674 113.654l.216.216-.216-.216zm.216.216l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M67.953 114.087l.216.217-.22-.217z"/>
-    <path fill="#0F0E08" d="M111.107 114.087l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M50.82 114.304l.218.217-.217-.21z"/>
-    <path fill="#0F0E08" d="M55.375 114.304l.217.217-.217-.21z"/>
-    <path fill="#FFF" d="M67.953 114.304l.216.217-.22-.21z"/>
-    <path fill="#0F0E08" d="M111.324 114.304l.217.217-.21-.21z"/>
-    <path fill="#010101" d="M140.817 114.304l.217.217-.217-.21z"/>
-    <path fill="#0E0D08" d="M69.037 114.52l.217.218-.217-.217zm18.867.218l.216.217-.216-.217z"/>
-    <path fill="#0F0E07" d="M116.963 114.738l.216.217-.22-.217z"/>
-    <path fill="#0E0D08" d="M88.554 114.955l.217.217-.21-.217z"/>
-    <path fill="#0F0E08" d="M113.276 114.955l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M113.493 115.172l.217.216-.217-.216z"/>
-    <path fill="#0F0E07" d="M52.122 115.388l.217.217-.22-.217zm16.264 0l.217.217-.217-.217z"/>
-    <path fill="#000" d="M95.494 115.388c2.452 4.87 4.267 9.45 5.638 14.747 1.53-.858 1.32-2.37 1.302-3.904-.04-3.56 1.33-7.12 1.083-10.62-1.023.35-1.206 1.4-1.384 2.39-.428 2.37-.436 4.81-1 7.16-1.177-2.73-2.11-9.19-5.64-9.76z"/>
-    <path fill="#0E0D08" d="M96.144 115.388l.217.217-.21-.217z"/>
-    <path fill="#0F0D06" d="M130.84 115.388l.218.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M81.615 115.605l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M112.625 115.605l.217.217-.217-.217zm-57.684.217l.22.217-.21-.22z"/>
-    <path fill="#0E0D08" d="M71.422 115.822l.217.217-.22-.22z"/>
-    <path fill="#0F0E08" d="M102.65 115.822l.217.217-.217-.22z"/>
-    <path fill="#0F0D06" d="M139.733 115.822l.216.217-.22-.22z"/>
-    <path fill="#0D0B05" d="M44.75 116.04l.216.216-.217-.217z"/>
-    <path fill="#0F0E08" d="M102.433 116.256l.217.217-.217-.217zm-44.022.434l.22.216-.21-.216z"/>
-    <path fill="#0E0D08" d="M86.82 116.69l.216.216-.217-.216zm1.3 0l.217.216-.217-.216z"/>
-    <path fill="#0F0E07" d="M113.493 116.69l.217.216-.217-.216zm-55.3.216l.218.217-.21-.217z"/>
-    <path fill="#0F0D06" d="M131.492 116.906l.217.217-.22-.217z"/>
-    <path fill="#0D0B05" d="M138.865 116.906l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M57.977 117.123l.217.217-.217-.217z"/>
-    <path fill="#0E0D08" d="M87.904 117.123l.216.217-.216-.217z"/>
-    <path fill="#0F0E08" d="M97.662 117.123l.217.217-.22-.217z"/>
-    <path fill="url(#h)" d="M140.647 116.6l-1.518 2.602 4.77 2.168" transform="translate(.604 .524)"/>
-    <path fill="#0F0E07" d="M115.444 117.34l.217.217-.21-.217z"/>
-    <path fill="#0E0D08" d="M87.687 117.557l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M96.795 117.774l.217.217-.217-.21z"/>
-    <path fill="#0D0B05" d="M42.58 117.99l.217.218-.217-.217z"/>
-    <path fill="#0F0E08" d="M59.93 117.99l.216.218-.217-.217z"/>
-    <path fill="#FFF" d="M42.146 118.208l.217.216-.217-.216z"/>
-    <path fill="#0E0D08" d="M86.17 118.208l.216.216-.217-.216z"/>
-    <path fill="#0F0E08" d="M97.012 118.208l.216.216-.216-.216z"/>
-    <path fill="#0E0B05" d="M137.78 118.208l.218.216-.217-.216z"/>
-    <path fill="#0F0E08" d="M97.228 118.64l.217.218-.217-.217zm1.302 0l.216.218-.216-.217zm-1.085.435l.217.217-.217-.217zm1.3 0l.218.217-.217-.217zm-13.01.217l.217.217-.217-.22zm1.084 0l.21.217-.22-.22z"/>
-    <path fill="#0F0D06" d="M124.553 119.292l.216.217-.22-.22z"/>
-    <path fill="#0F0E08" d="M98.963 119.51l.217.216-.217-.217z"/>
-    <path fill="#010101" d="M139.95 119.726l.216.216-.217-.216z"/>
-    <path fill="#0F0E07" d="M55.375 119.942l.217.217-.217-.22z"/>
-    <path fill="#000" d="M79.88 120.16l.217.216-.217-.217z"/>
-    <path fill="#0F0E07" d="M115.878 120.16l.217.216-.217-.217z"/>
-    <path fill="#0F0E08" d="M85.3 120.376l.218.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M126.07 120.376l.217.217-.216-.217z"/>
-    <path fill="#0F0E07" d="M59.06 120.593l.218.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M80.314 120.593l.216.217-.216-.217z"/>
-    <path fill="#0F0D06" d="M126.938 121.027l.217.217-.217-.217zm-13.88.217l.218.216-.217-.216zm.435 0l.217.216-.217-.216z"/>
-    <path fill="#0F0E07" d="M54.074 121.46l.217.217-.21-.217z"/>
-    <path fill="#0F0E08" d="M84.868 121.46l.216.217-.216-.217z"/>
-    <path fill="#0F0E07" d="M116.746 121.46l.217.217-.217-.217zm-55.082.868l.217.217-.21-.217z"/>
-    <path fill="#0F0E08" d="M88.77 122.328l.218.217-.217-.217zm-35.564.217l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M119.348 122.545l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M100.264 122.762l.217.216-.21-.216zm-37.733.216l.22.217-.21-.217z"/>
-    <path fill="#0F0D06" d="M117.613 122.978l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M104.385 123.195l.217.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M62.965 123.412l.217.217-.217-.22z"/>
-    <path fill="#0E0B05" d="M129.974 123.63l.217.216-.21-.217z"/>
-    <path fill="#0F0E07" d="M52.34 123.846l.216.217-.217-.217z"/>
-    <path fill="#0F0E08" d="M83.35 123.846l.216.217-.216-.217z"/>
-    <path fill="#0F0E07" d="M96.578 123.846l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M130.19 123.846l.218.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M70.99 124.063l.215.217-.216-.217zm29.708.217l.217.216-.217-.216zm-36.215.216l.217.217-.217-.217zm42.504 0l.217.217-.217-.217zm-41.854.434l.217.217-.217-.217zm40.553.217l.217.217-.217-.217zm-29.276.217l.217.217-.217-.21zm31.228 0l.216.217-.216-.21zm-31.445.434l.217.216-.217-.216zm-8.89.216l.216.217-.22-.21zm2.818 0l.22.217-.21-.21zm37.95 0l.22.217-.21-.21zm-40.11.217l.22.22-.21-.21zm22.77.22l.22.22-.21-.21z"/>
-    <path fill="url(#i)" d="M62.36 126.358l-.433 6.722c1.906-2.035 5.084-6.313.434-6.722z" transform="translate(.604 .524)"/>
-    <path fill="#0F0E07" d="M77.277 126.882l.217.217-.217-.22z"/>
-    <path fill="#0E0B05" d="M126.07 127.75l.217.216-.216-.217z"/>
-    <path fill="#0D0B05" d="M134.745 127.75l.217.216-.217-.217z"/>
-    <path fill="#0F0E07" d="M102.65 127.966l.217.217-.217-.217z"/>
-    <path fill="#0E0B05" d="M125.203 128.183l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M91.59 128.617l.217.217-.217-.217zm9.108 0l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M123.685 128.834l.217.216-.217-.216z"/>
-    <path fill="#0F0E07" d="M102 129.484l.216.217-.217-.21z"/>
-    <path fill="#0F0D06" d="M108.288 129.484l.217.217-.217-.21z"/>
-    <path fill="#0E0B05" d="M122.384 129.484l.217.217-.21-.21z"/>
-    <path fill="#0F0E07" d="M76.844 129.7l.217.218-.21-.217zm24.938 0l.217.218-.22-.217z"/>
-    <path fill="#0E0B05" d="M121.95 129.7l.217.218-.217-.217z"/>
-    <path fill="#0F0E07" d="M96.795 130.135l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M108.505 130.135l.217.217-.217-.217zm1.735 0l.217.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M64.266 130.568l.217.217-.217-.217z"/>
-    <path fill="#0F0E07" d="M80.097 130.785l.217.217-.217-.217zm12.36.434l.217.21-.216-.22z"/>
-    <path fill="#0E0B05" d="M118.264 131.22l.216.216-.216-.217zm-.65.216l.216.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M136.697 131.653l.216.217-.216-.217zm.433 0l.217.217-.217-.217z"/>
-    <path fill="#0F0D06" d="M116.095 131.87l.217.216-.217-.216z"/>
-    <path fill="url(#j)" d="M119.61 132.864c.837 1.793 2.732 3.64 4.34 4.77l-1.953-6.072-2.386 1.302z" transform="translate(.604 .524)"/>
-    <path fill="#0F0D06" d="M111.107 132.303l.217.217-.217-.217zm-37.733.434l.217.217-.21-.217z"/>
-    <path fill="#0F0E07" d="M86.82 132.737l.216.217-.217-.217z"/>
-    <path fill="#0D0B05" d="M120.65 132.954l.216.217-.217-.21z"/>
-    <path fill="#0F0D06" d="M88.77 133.17l.218.218-.217-.217z"/>
-    <path fill="#0D0B05" d="M121.083 134.69l.217.216-.217-.217zm.217.216l.217.216-.217-.216z"/>
-    <path fill="url(#k)" d="M82.746 142.19h.216l1.952-6.94-2.468-.42-.134 1.937" transform="translate(.604 .524)"/>
-    <path fill="#0D0B05" d="M121.517 135.122l.216.217-.216-.22zm2.168.868l.217.217-.217-.217z"/>
-    <path fill="url(#l)" d="M100.745 136.55l2.385 6.94c.536-1.24 2.188-6.032 1.015-7.026-.907-.77-2.416-.174-3.4.086z" transform="translate(.604 .524)"/>
-    <path fill="#0D0B05" d="M101.782 136.857l.217.217-.22-.217z"/>
-    <path fill="#010101" d="M123.035 136.857l.216.217-.21-.217zm-10.193.868l.217.217-.22-.217z"/>
-    <path fill="#0D0B05" d="M124.12 137.942l.216.216-.217-.216zm-22.554.216l.216.217-.216-.217zm22.77 0l.433.434-.44-.434z"/>
-    <path fill="#FFF" d="M124.553 138.158l.216.217-.22-.217z"/>
-    <path fill="#0E0B05" d="M113.926 138.592l.217.217-.217-.22z"/>
-    <path fill="#0D0B05" d="M84.434 138.81l.217.216-.21-.217z"/>
-    <path fill="#FEF666" d="M148.727 85.808c-.858-.156-1.53-.795-1.53-1.454 0-.623.4-1.25 2.024-3.188 1.3-1.544 1.14-1.503-1.25.33-2.65 2.026-4.55 2.797-7.19 2.924-1.23.058-2.23.028-2.23-.07 0-.095.36-.478.81-.85.44-.373 1.93-2.18 3.3-4.02 2.51-3.356 3.74-4.493 5.35-4.966 2.55-.748 5.83 1.22 6.57 3.94.69 2.527-1.54 6.593-3.98 7.27-.52.147-1.01.25-1.08.233-.07-.018-.41-.086-.76-.15z"/>
-    <path fill="#FEF67A" d="M145.287 100.345c-.835-.23-1.91-1.102-2.69-2.18-.93-1.285-1.587-3.043-2.69-7.203-.483-1.822-.936-3.5-1.007-3.732-.356-1.162 2.178-1.754 5.277-1.23 2.438.41 3.335 1.23 3.772 3.442.16.836.33 1.635.37 1.775.03.14.21-.53.4-1.49.2-1.067.55-2.004.9-2.41l.57-.667.93.627c1.46.985 2.28 2.92 2.27 5.313-.02 3.388-1.42 6.028-3.77 7.134-1.17.547-3.44.872-4.34.62z"/>
-  </g>
-</svg>
diff --git a/website/public/img/icons/icon_rpm.svg b/website/public/img/icons/icon_rpm.svg
deleted file mode 100644
index 2c5aa0dd371..00000000000
--- a/website/public/img/icons/icon_rpm.svg
+++ /dev/null
@@ -1,15 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 171 171">
-  <g fill="none" fill-rule="evenodd">
-    <path fill="#932279" d="M72.064 79.272l6.17 6.133-6.17 6.134H28.64v20.435L2.155 85.405 28.64 59.28v19.99h43.424"/>
-    <path fill="#EFA724" d="M91.728 72.064l-6.134 6.17-6.133-6.17V28.638H59.026l26.57-26.483 26.125 26.483H91.73v43.426"/>
-    <path fill="#262577" d="M98.936 91.728l-6.17-6.134 6.17-6.133h43.425V59.026l26.486 26.57-26.483 26.125V91.73H98.937"/>
-    <path fill="#9CCD2A" d="M79.272 98.936l6.133-6.17 6.134 6.17v43.425h20.435l-26.572 26.486-26.123-26.483h19.99V98.937"/>
-    <g fill-rule="nonzero" stroke="#FFF" stroke-width="3.769">
-      <path fill="#9CCD2A" d="M27.082 27.082h52.765v52.765H27.082z"/>
-      <path fill="#932279" d="M91.153 27.082h52.765v52.765H91.153z"/>
-      <path fill="#EFA724" d="M91.153 91.153h52.765v52.765H91.153z"/>
-      <path fill="#262577" d="M27.082 91.153h52.765v52.765H27.082z"/>
-    </g>
-    <path stroke="#FFF" stroke-width="3.769" d="M2.884 85.5l37.31-37.31 37.31 37.31-37.31 37.31zM48.19 40.195L85.5 2.885l37.31 37.31-37.31 37.31zM93.495 85.5l37.31-37.31 37.31 37.31-37.31 37.31zM48.19 130.805l37.31-37.31 37.31 37.31-37.31 37.31z"/>
-  </g>
-</svg>
diff --git a/website/public/img/icons/icon_solaris.svg b/website/public/img/icons/icon_solaris.svg
deleted file mode 100644
index cb1a8be9956..00000000000
--- a/website/public/img/icons/icon_solaris.svg
+++ /dev/null
@@ -1,6 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 303 149">
-  <g fill="none">
-    <path fill="#5C809B" d="M236.57 147.025h11.295V91.222H236.57M17.44 148.03c-6.176 0-11.55-1.565-16.477-4.26l1.112-6.157c6.062 1.46 9.76 2.13 13.34 2.13 8.076 0 11.32-3.475 11.32-7.397 0-4.37-1.91-6.495-10.75-9.86C5.108 118.446 1.18 114.2 1.18 106.46c0-9.626 7.624-16.245 19.283-16.245 4.703 0 9.19.895 14.343 3.588l-1.345 6.162c-4.26-1.225-7.63-1.68-10.76-1.68-6.38 0-9.52 3.025-9.52 6.958 0 3.91 2.24 6.048 11.1 9.182 10.54 3.802 14.68 8.625 14.68 16.58 0 9.85-7.94 17.026-21.51 17.026M70.5 98.74c-7.845 0-12.665 5.61-12.665 19.04 0 16.48 4.25 21.748 12.99 21.748 7.73 0 12.66-5.597 12.66-19.16 0-16.358-4.36-21.622-12.986-21.622m-1.01 49.408c-14.47 0-23.54-7.51-23.54-27.907 0-20.5 10.08-30.136 25.88-30.136 14.34 0 23.54 7.51 23.54 27.68 0 20.63-10.21 30.37-25.89 30.37m59.79-9.01l1.22 6.67c-2.25 1.06-7.3 2-14.24 2-6.84 0-10.19-2.02-10.19-11.09v-45.9h11.54v41.42c0 6.53 1 7.36 4.04 7.52 1.13.06 7.63-.61 7.63-.61m40.61-18.22h-4.82c-13.01 0-16.25 4.26-16.25 10.09 0 5.38 3 8.74 8.62 8.74 3.92 0 8.3-2.02 12.45-5.59v-13.23zm2.45 26.11l-.9-6.05c-4.92 4.27-10.19 7.18-17.25 7.18-10.98 0-16.81-5.61-16.81-15.46 0-11.42 8.85-19.05 28.45-19.05h4.04v-5.04c0-6.71-3.48-9.96-11.55-9.96-5.83 0-11.78 1.56-16.36 3.25l-1.68-7.05c5.82-2.58 13-4.6 21.17-4.6 14.01 0 19.84 6.73 19.84 16.92v39.89h-8.97zm52.89-45.26c-2.13-.57-3.59-.79-4.71-.79-3.25 0-6.27 2.46-11.76 9.3v36.75h-11.54V91.22h9.54l1 9.416c6.04-7.844 9.85-10.424 13.89-10.424 1.45 0 3.13.34 4.93 1.235l-1.35 10.313m50.53 46.27c-6.16 0-11.54-1.565-16.46-4.26l1.11-6.157c6.06 1.46 9.74 2.13 13.34 2.13 8.07 0 11.32-3.475 11.32-7.397 0-4.37-1.91-6.495-10.75-9.86-10.88-4.04-14.8-8.285-14.8-16.025 0-9.62 7.61-16.24 19.27-16.24 4.7 0 9.18.9 14.33 3.59l-1.34 6.16c-4.26-1.22-7.63-1.68-10.76-1.68-6.39 0-9.52 3.03-9.52 6.96 0 3.91 2.23 6.05 11.08 9.18 10.53 3.8 14.68 8.63 14.68 16.58 0 9.85-7.96 17.03-21.52 17.03m26.77-51.6v-4.85h-1.17l-1.1 3.43-1.12-3.43h-1.19v4.85h.8v-3.82h.01l1.19 3.83h.55l1.21-3.82h.014v3.83h.78m-6.47 0V92.4h1.2v-.81H294v.81h1.22v4.04"/>
-    <path fill="#EE7314" d="M231.224 31.916c.17-.922 2.402-6.468 2.402-6.468 2.766-6.23 1.008-10.696 1.008-10.696C233.004 8.7 228.32 3.97 228.32 3.97c.228.168 1.652 3.956 1.652 3.956 3.282 9.065-5.518 14.267-5.518 14.267-2.267 1.497-5.97 5.065-5.97 5.065-5.19 5.074-3.622 11.294-3.622 11.294l.206.093c6.176 1.517 11.976 3.977 17.247 7.208-3.492-6.795-1.09-13.937-1.09-13.937m18.05 29.384c-.578-7.472 4.204-13.077 4.204-13.077.49-.798 4.62-5.102 4.62-5.102 4.89-4.75 4.94-9.55 4.94-9.55.75-6.22-1.84-12.35-1.84-12.35.14.24.05 4.29.05 4.29-.34 9.63-10.44 11.18-10.44 11.18-2.67.55-7.44 2.48-7.44 2.48-6.22 2.58-7.41 8.22-7.55 9.03 5.12 3.66 9.65 8.09 13.43 13.12m36.16-12.38c.04.29-1.56 4.01-1.56 4.01-3.89 8.82-13.84 6.49-13.84 6.49-2.68-.47-7.82-.46-7.82-.45-7.26.08-10.42 5.66-10.42 5.66l.38.93c3.16 5.06 5.59 10.6 7.17 16.49 2.15-7.36 8.87-10.9 8.87-10.9.75-.54 6.18-3.02 6.18-3.02 6.31-2.59 8.13-7.02 8.13-7.02 3-5.51 2.89-12.16 2.89-12.16m-75.17-11.25c-5.51-5.02-5.91-12.32-5.91-12.32-.21-.92-.18-6.88-.18-6.88.26-6.81-3.03-10.32-3.03-10.32-3.74-5.02-9.86-7.68-9.86-7.68.28.08 3.01 3.08 3.01 3.08 6.4 7.19.16 15.29.16 15.29-1.55 2.24-3.67 6.92-3.67 6.92-2.78 6.27.42 11.25.78 11.79 3.11-.46 6.32-.68 9.56-.65 3.11.03 6.16.29 9.12.78m-33.31-8.6c-.507-.78-2.73-6.32-2.73-6.32-2.288-6.42-6.63-8.45-6.63-8.45-5.37-3.26-12.02-3.46-12.02-3.46.29-.03 3.94 1.74 3.94 1.74 8.63 4.3 5.84 14.13 5.84 14.13-.61 2.65-.83 7.79-.83 7.79-.267 7.24 5.165 10.67 5.165 10.67l.26-.09c5.275-3.072 11.07-5.373 17.2-6.736-7.065-2.58-10.196-9.28-10.196-9.28M166 47.59c-7.48.19-12.84-4.85-12.84-4.85-.765-.533-4.866-4.864-4.866-4.864-4.507-5.12-9.31-5.39-9.31-5.39-6.18-1.05-12.42 1.22-12.42 1.22.245-.13 4.28.15 4.29.15 9.596.804 10.646 10.97 10.646 10.97.41 2.69 2.115 7.545 2.115 7.545 2.44 6.83 8.746 8.01 8.746 8.01l.13-.11c3.84-4.89 8.4-9.18 13.51-12.69m-29.97 16.87c-.91-.21-6.33-2.71-6.33-2.71-6.07-3.11-10.63-1.58-10.63-1.58-6.13 1.3-11.1 5.74-11.1 5.74.19-.21 4.05-1.44 4.05-1.44 9.22-2.8 13.95 6.26 13.95 6.26 1.38 2.34 4.76 6.23 4.76 6.22 4.79 5.45 11.1 4.21 11.1 4.21l.16-.31c1.72-5.95 4.34-11.52 7.67-16.58-6.84 2.88-13.61.2-13.61.2"/>
-  </g>
-</svg>
diff --git a/website/public/img/icons/icon_windows.svg b/website/public/img/icons/icon_windows.svg
deleted file mode 100644
index 5596f7f25ac..00000000000
--- a/website/public/img/icons/icon_windows.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 150 150">
-  <path fill="#009bef" fill-rule="nonzero" d="M0 21.387l61.34-8.39v59.075H0m68.73-60.24L150 0v71.575H68.73M0 78.322h61.34v59.246L0 129.008M68.73 79.11H150V150l-81.27-11.473"/>
-</svg>
diff --git a/website/public/img/integration-program-devprocess.png b/website/public/img/integration-program-devprocess.png
deleted file mode 100644
index 4336826c112..00000000000
Binary files a/website/public/img/integration-program-devprocess.png and /dev/null differ
diff --git a/website/public/img/integration-program-vaulteco.png b/website/public/img/integration-program-vaulteco.png
deleted file mode 100644
index 1258f9d58bf..00000000000
Binary files a/website/public/img/integration-program-vaulteco.png and /dev/null differ
diff --git a/website/public/img/k8s-auth-workflow.png b/website/public/img/k8s-auth-workflow.png
deleted file mode 100644
index e94d8515b69..00000000000
Binary files a/website/public/img/k8s-auth-workflow.png and /dev/null differ
diff --git a/website/public/img/layers.png b/website/public/img/layers.png
deleted file mode 100644
index 4b181d826cd..00000000000
Binary files a/website/public/img/layers.png and /dev/null differ
diff --git a/website/public/img/logo-hashicorp.svg b/website/public/img/logo-hashicorp.svg
deleted file mode 100644
index 971437fbc48..00000000000
--- a/website/public/img/logo-hashicorp.svg
+++ /dev/null
@@ -1,3 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 175.37 60.01">
-  <path class="text" fill="#000000" d="M84.54 7.86V4.63h-3v3.23h-1.46V.11h1.51v3.25h3V.11H86v7.75zm7 0h-1.2l-.11-.38a3.28 3.28 0 0 1-1.7.52C87.47 8 87 7.27 87 6.31c0-1.14.51-1.57 1.7-1.57h1.4v-.59c0-.62-.18-.84-1.11-.84a8.46 8.46 0 0 0-1.61.17l-.18-1.07a7.89 7.89 0 0 1 2-.26c1.83 0 2.37.62 2.37 2zm-1.43-2.11H89c-.48 0-.61.13-.61.55s.13.56.59.56a2.37 2.37 0 0 0 1.1-.29zM94.63 8a7.12 7.12 0 0 1-2-.32l.2-1.07a6.77 6.77 0 0 0 1.73.24c.65 0 .74-.14.74-.56s-.07-.52-1-.73c-1.42-.33-1.59-.68-1.59-1.76s.51-1.62 2.18-1.62a8 8 0 0 1 1.75.2l-.14 1.11a10.66 10.66 0 0 0-1.6-.16c-.63 0-.74.14-.74.48s0 .48.82.68c1.63.41 1.78.62 1.78 1.77S96.38 8 94.63 8zm6.68-.11V4c0-.3-.13-.45-.47-.45a4.14 4.14 0 0 0-1.52.45v3.86h-1.46V0l1.46.22v2.47a5.31 5.31 0 0 1 2.13-.54c1 0 1.32.65 1.32 1.65v4.06zM104 1.48V.11h1.46v1.37zm0 6.38V2.27h1.46v5.59zm2.62-5.54c0-1.4.85-2.22 2.83-2.22a9.37 9.37 0 0 1 2.16.25l-.17 1.25a12.21 12.21 0 0 0-1.95-.2c-1 0-1.37.34-1.37 1.16V5.5c0 .81.33 1.16 1.37 1.16a12.21 12.21 0 0 0 1.95-.2l.17 1.25a9.37 9.37 0 0 1-2.16.25c-2 0-2.83-.81-2.83-2.22zM114.83 8c-2 0-2.53-1.06-2.53-2.2V4.36c0-1.15.54-2.2 2.53-2.2s2.53 1.06 2.53 2.2v1.41c0 1.15-.54 2.23-2.53 2.23zm0-4.63c-.78 0-1.08.33-1.08 1v1.5c0 .63.3 1 1.08 1s1.08-.33 1.08-1V4.31c-.01-.63-.3-.96-1.08-.96zm6.64.09a11.57 11.57 0 0 0-1.54.81v3.6h-1.46v-5.6h1.23l.1.62a6.63 6.63 0 0 1 1.53-.73zM127.3 6a1.73 1.73 0 0 1-1.92 2 8.36 8.36 0 0 1-1.55-.16v2.26l-1.46.22v-8h1.16l.14.47a3.15 3.15 0 0 1 1.84-.59c1.17 0 1.79.67 1.79 1.94zm-3.48.63a6.72 6.72 0 0 0 1.29.15c.53 0 .73-.24.73-.75v-2c0-.46-.18-.71-.72-.71a2.11 2.11 0 0 0-1.3.51zM0 0l29.89 60L60 0zm33.45 12h3.48v3.48h-3.48zm-6.93 14H23v-3.51h3.48zm0-5.22H23v-3.51h3.48zm0-5.22H23v-3.51h3.48zm5.22 15.65h-3.48V27.7h3.48zm0-5.22h-3.48v-3.5h3.48zm0-5.22h-3.48v-3.5h3.48zm0-5.22h-3.48v-3.5h3.48zm1.71 1.74h3.48v3.48h-3.48zm0 8.7v-3.5H37V26zm68.38-11.89h6.29l-9.55 32h-8.93l-9.55-32h6.29l7.72 26.64zm23.76 31.97h-4.8l-.43-1.58a12.79 12.79 0 0 1-7 2.06c-4.27 0-6.1-2.93-6.1-7 0-4.75 2.06-6.58 6.82-6.58h5.62v-2.41c0-2.59-.72-3.5-4.46-3.5a32.66 32.66 0 0 0-6.48.72l-.72-4.46a30.5 30.5 0 0 1 8-1.1c7.35 0 9.5 2.59 9.5 8.45zm-5.86-8.83h-4.32c-1.92 0-2.45.53-2.45 2.3s.53 2.35 2.35 2.35a9.22 9.22 0 0 0 4.42-1.2zm15.08-14.55V39c0 1.25.53 1.87 1.87 1.87a16.15 16.15 0 0 0 6.1-2V22.69h5.86v23.38h-4.47l-.58-2a23.42 23.42 0 0 1-9.36 2.45c-3.89 0-5.28-2.74-5.28-6.91V22.69zm16.94 23.38V13.14l5.86-.82v33.75zm23.33-.43a16.24 16.24 0 0 1-5.14.91c-4.27 0-6.43-2-6.43-6.19v-13H160v-4.67h3.5v-5.81l5.86-.82v6.63h6l-.36 4.66h-5.62v12.24a1.84 1.84 0 0 0 2.11 2.06 11.27 11.27 0 0 0 2.93-.48z" data-name="Layer 2"/>
-</svg>
diff --git a/website/public/img/logo-text.svg b/website/public/img/logo-text.svg
deleted file mode 100644
index 5a4eccd1ae3..00000000000
--- a/website/public/img/logo-text.svg
+++ /dev/null
@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 122 42">
-  <path class="v" fill="#000000" d="M42 0L20.924 42 0 0"/>
-  <path class="squares" fill="#FFFFFF" d="M16.13 10.864h2.435V8.43H16.13m3.653 2.434h2.435V8.43h-2.435m3.63 2.434h2.436V8.43h-2.44m-7.29 6.086h2.43V12.08h-2.43m3.65 2.436h2.434V12.08h-2.43m3.63 2.436h2.435V12.08H23.4m-7.283 6.088h2.434v-2.434h-2.43m3.656 2.434h2.43v-2.434h-2.43m0 6.086h2.436v-2.434h-2.43m3.654-1.218h2.434v-2.434h-2.44"/>
-  <path class="text" fill="#000000" d="M63.75 28.392l5.233-18.037h4.257L66.772 32h-6.045L54.26 10.355h4.258l5.232 18.037zm21.767-6.825V32h-3.25l-.293-1.073c-1.43.943-3.12 1.398-4.712 1.398-2.893 0-4.128-1.983-4.128-4.713 0-3.217 1.398-4.452 4.615-4.452h3.8v-1.657c0-1.756-.49-2.373-3.025-2.373-1.43 0-2.99.195-4.388.488l-.49-3.023c1.496-.455 3.674-.747 5.43-.747 4.97 0 6.434 1.754 6.434 5.72zm-3.965 6.793v-2.34h-2.925c-1.3 0-1.658.358-1.658 1.56 0 1.105.353 1.593 1.59 1.593 1.17 0 2.24-.39 2.99-.813zm7.012-12.188v11.473c0 2.828.942 4.68 3.575 4.68 1.85 0 4.35-.683 6.332-1.658l.39 1.333h3.023V16.172H97.92v10.985c-1.43.748-3.152 1.333-4.127 1.333-.91 0-1.267-.422-1.267-1.267v-11.05H88.56zM109.388 32V9.152l-3.965.553V32h3.965zm11.497-3.315c-.683.195-1.398.325-1.983.325-1.04 0-1.43-.553-1.43-1.398v-8.287h3.803l.26-3.152h-4.063v-4.485l-3.965.552v3.932h-2.372v3.153h2.372v8.808c0 2.827 1.463 4.192 4.355 4.192 1.008 0 2.633-.26 3.478-.618l-.455-3.022z"/>
-</svg>
diff --git a/website/public/img/logo.svg b/website/public/img/logo.svg
deleted file mode 100644
index 6df7771249d..00000000000
--- a/website/public/img/logo.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg id="Layer_1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 33 36"><style>.st0{fill:#fff}</style><g id="logo_4_"><path class="st0" d="M20 26.7l5.4-3V3.2L20 0v15.3h-6.9v-6l-5.5 3v20.5l5.5 3.2V20.7H20z"/><path class="st0" d="M28 4.6v20.8l-8 4.4V36l13-7.5v-21zM13.1 0L0 7.5v21l5.1 2.9V10.6l8-4.4z"/></g></svg>
\ No newline at end of file
diff --git a/website/public/img/news/webinar-register-now.png b/website/public/img/news/webinar-register-now.png
deleted file mode 100644
index 7999c9fcb47..00000000000
Binary files a/website/public/img/news/webinar-register-now.png and /dev/null differ
diff --git a/website/public/img/oci/oci-role-based-authz.png b/website/public/img/oci/oci-role-based-authz.png
deleted file mode 100644
index 6206e0bbb7e..00000000000
Binary files a/website/public/img/oci/oci-role-based-authz.png and /dev/null differ
diff --git a/website/public/img/og-image.png b/website/public/img/og-image.png
deleted file mode 100644
index 8118598b5b5..00000000000
Binary files a/website/public/img/og-image.png and /dev/null differ
diff --git a/website/public/img/practice-pattern.svg b/website/public/img/practice-pattern.svg
deleted file mode 100644
index 8426d42fe21..00000000000
--- a/website/public/img/practice-pattern.svg
+++ /dev/null
@@ -1,39 +0,0 @@
-<svg width="456" height="589" viewBox="0 0 456 589" fill="none" xmlns="http://www.w3.org/2000/svg">
-<g opacity="0.7">
-<path d="M152.798 90.4851C152.634 90.2694 152.319 90.1381 151.992 90.1381C151.828 90.1381 151.677 90.1663 151.526 90.2319C151.374 90.2976 151.261 90.3913 151.173 90.4945L68.6519 196.925L68.589 197L70.743 197L152.004 92.22L227.836 190.004L228 190.22L228 187.454L152.823 90.532L152.798 90.4851Z" fill="#FFEC6E"/>
-<path d="M152.647 57.6715C152.596 57.634 152.533 57.5965 152.458 57.559C152.307 57.4933 152.155 57.4652 152.004 57.4652C151.84 57.4652 151.677 57.5027 151.538 57.559L151.45 57.5965L151.45 57.6059C151.337 57.6715 151.248 57.7466 151.185 57.831L43.32 196.925L43.257 197L45.4111 197L151.992 59.5471L227.836 157.341L228 157.547L228 154.771L152.798 57.8122C152.773 57.7747 152.722 57.7278 152.647 57.6715Z" fill="#FFEC6E"/>
-<path d="M152.798 74.1486C152.634 73.933 152.319 73.8017 151.992 73.8017C151.828 73.8017 151.677 73.8298 151.526 73.8954C151.374 73.9611 151.261 74.0549 151.173 74.158L55.9797 196.925L55.9293 197L58.0707 197L152.004 75.8836L227.836 173.668L228 173.884L228 171.108L152.823 74.1862L152.798 74.1486Z" fill="#FFEC6E"/>
-<path d="M152.798 25.1487C152.634 24.933 152.319 24.8017 151.992 24.8017C151.828 24.8017 151.677 24.8298 151.526 24.8954C151.374 24.9611 151.261 25.0549 151.173 25.158L17.9881 196.925L17.9251 197L20.0665 197L152.004 26.8836L227.836 124.668L228 124.884L228 122.108L152.823 25.1862L152.798 25.1487Z" fill="#FFEC6E"/>
-<path d="M152.823 41.4101L152.735 41.4101L152.722 41.4007L152.71 41.3632L152.634 41.3351C152.609 41.3163 152.584 41.2976 152.546 41.2788C152.521 41.2694 152.495 41.2507 152.458 41.2319C152.42 41.2131 152.382 41.2038 152.344 41.1944C152.269 41.1663 152.193 41.1475 152.118 41.1475C152.067 41.1381 152.029 41.1381 151.992 41.1381C151.929 41.1381 151.866 41.1475 151.815 41.1569C151.79 41.1569 151.752 41.1663 151.702 41.1756L151.601 41.2038C151.576 41.2131 151.551 41.2131 151.526 41.2319L151.437 41.2694C151.387 41.2882 151.362 41.3163 151.337 41.3351L151.211 41.4101L151.211 41.4476C151.198 41.4664 151.173 41.4851 151.16 41.5039L30.6478 196.925L30.5848 197L32.7388 197L152.004 43.22L227.836 141.004L228 141.211L228 138.435L152.823 41.5132L152.823 41.4101ZM152.395 41.3726C152.395 41.3726 152.395 41.3632 152.395 41.3726V41.3726Z" fill="#FFEC6E"/>
-<path d="M7.40688 197L152.004 10.5565L227.836 108.341L228 108.557L228 108.547L228 105.781L228 105.771L156.841 14.017L152.836 8.8497L152.81 8.8122C152.647 8.5965 152.332 8.46522 152.004 8.46522C151.84 8.46522 151.689 8.49334 151.538 8.55899C151.387 8.62463 151.274 8.71841 151.185 8.82157L5.31582 196.925L5.25284 197L7.40688 197Z" fill="#FFEC6E"/>
-<g clip-path="url(#clip0_2_43)">
-<path d="M81.3255 197.071L81.2708 197.001L83.4187 197.001L228 383.444L228 386.212L81.3255 197.071ZM144.601 197.001L146.748 197.001L228 301.775L228 304.543L144.656 197.071L144.601 197.001ZM106.604 197.001L108.752 197.001L228 350.775L228 353.543L106.659 197.071L106.604 197.001ZM93.9345 197.001L96.0818 197.001L228 367.107L228 369.875L93.9892 197.071L93.9345 197.001ZM119.268 197.001L121.415 197.001L228 334.439L228 337.207L119.322 197.071L119.268 197.001ZM131.937 197.001L134.085 197.001L228 318.107L228 320.875L131.992 197.071L131.937 197.001Z" fill="#FFEC6E"/>
-<path d="M222.742 197.001L228 203.785L228 206.553L220.595 197.001L222.742 197.001ZM157.257 197.001L159.405 197.001L228 285.459L228 288.217L157.312 197.071L157.257 197.001ZM169.928 197.001L172.075 197.001L228 269.127L228 271.89L169.983 197.071L169.928 197.001ZM182.591 197.001L184.738 197.001L228 252.79L228 255.553L182.646 197.071L182.591 197.001ZM210.072 197.001L228 220.127L228 222.885L207.925 197.001L210.072 197.001ZM197.408 197.001L228 236.459L228 239.222L195.261 197.001L197.408 197.001Z" fill="#FFEC6E"/>
-<path d="M37.1952 335.487C37.2769 335.383 37.3938 335.296 37.5344 335.236C37.675 335.175 37.8343 335.143 37.9966 335.143C38.1625 335.143 38.3256 335.176 38.4696 335.237C38.6147 335.301 38.7349 335.393 38.8184 335.502L83.3986 393.001L81.2514 393.001L37.9966 337.221L-3.37625e-05 386.216L-3.35201e-05 383.444L37.1693 335.525L37.1952 335.487ZM37.9966 255.553L-2.66228e-05 304.548L-2.63805e-05 301.776L37.1694 253.857L37.1952 253.819C37.2771 253.715 37.3941 253.628 37.5346 253.568C37.6752 253.507 37.8344 253.475 37.9966 253.475C38.1628 253.475 38.326 253.507 38.4702 253.569C38.6149 253.633 38.7348 253.725 38.8184 253.834L146.681 392.93L146.735 393.001L144.588 393.001L37.9966 255.553ZM37.1952 270.155C37.2771 270.051 37.3941 269.964 37.5346 269.904C37.6752 269.844 37.8344 269.812 37.9966 269.811C38.1627 269.811 38.326 269.844 38.4702 269.905C38.6149 269.97 38.7348 270.061 38.8184 270.17L134.067 393.001L131.919 393.001L37.9966 271.889L-2.8051e-05 320.884L-2.78086e-05 318.112L37.1693 270.194L37.1952 270.155ZM37.9966 286.138C38.1608 286.138 38.3223 286.17 38.4653 286.23C38.5941 286.285 38.7008 286.365 38.7747 286.461L121.341 392.93L121.395 393.001L119.248 393.001L37.9966 288.221L-2.94787e-05 337.216L-2.92368e-05 334.449L37.1952 286.482C37.2771 286.378 37.3941 286.292 37.5346 286.231C37.6752 286.171 37.8344 286.139 37.9966 286.138V286.138ZM37.9966 302.475C38.1613 302.475 38.3231 302.507 38.4665 302.567C38.5938 302.622 38.6994 302.701 38.7728 302.796L108.671 392.93L108.726 393.001L106.578 393.001L37.9966 304.553L-3.09065e-05 353.548L-3.06646e-05 350.781L37.1952 302.819C37.2771 302.714 37.3941 302.628 37.5346 302.568C37.6752 302.507 37.8344 302.475 37.9966 302.475V302.475ZM37.2241 319.126C37.2527 319.087 37.2909 319.053 37.3366 319.024C37.3703 318.999 37.4063 318.975 37.4443 318.953C37.4717 318.936 37.5019 318.92 37.5341 318.908C37.5682 318.89 37.6061 318.877 37.646 318.868C37.7157 318.842 37.7919 318.826 37.8699 318.822C37.9112 318.814 37.9539 318.81 37.9966 318.811C38.1584 318.808 38.318 318.839 38.4573 318.9L38.5459 318.94L38.5483 318.944C38.5863 318.963 38.6199 318.986 38.648 319.013C38.6609 319.022 38.6738 319.033 38.699 319.055C38.7279 319.071 38.7507 319.092 38.7648 319.116C38.7874 319.138 38.8076 319.161 38.8251 319.185L96.0624 393.001L93.9152 393.001L37.9966 320.885L-3.23348e-05 369.885L-3.20924e-05 367.112L37.2062 319.144L37.2241 319.126ZM37.6781 319.013L37.6795 319.013L37.6774 319.009L37.6781 319.013ZM37.6046 319.042L37.6055 319.042L37.6036 319.04L37.6046 319.042Z" fill="#FFEC6E"/>
-</g>
-<g clip-path="url(#clip1_2_43)">
-<path d="M37.1952 450.514C37.2769 450.619 37.3939 450.705 37.5344 450.766C37.675 450.826 37.8343 450.858 37.9967 450.859C38.1626 450.859 38.3256 450.826 38.4696 450.765C38.6148 450.7 38.735 450.609 38.8184 450.499L83.3987 393.001L81.2515 393.001L37.9967 448.781L1.46656e-05 399.786L1.44233e-05 402.558L37.1694 450.476L37.1952 450.514ZM37.9966 530.449L7.52598e-06 481.454L7.28363e-06 484.226L37.1694 532.145L37.1952 532.183C37.2771 532.287 37.3941 532.374 37.5347 532.434C37.6752 532.494 37.8344 532.526 37.9966 532.527C38.1628 532.527 38.326 532.494 38.4703 532.433C38.6149 532.368 38.7348 532.277 38.8184 532.168L146.681 393.071L146.735 393.001L144.588 393.001L37.9966 530.449ZM37.1952 515.847C37.2771 515.951 37.3941 516.037 37.5347 516.098C37.6752 516.158 37.8344 516.19 37.9966 516.19C38.1628 516.19 38.326 516.158 38.4703 516.097C38.6149 516.032 38.7348 515.941 38.8184 515.831L134.067 393.001L131.919 393.001L37.9966 514.113L8.95415e-06 465.118L8.7118e-06 467.89L37.1694 515.808L37.1952 515.847ZM37.9966 499.863C38.1609 499.863 38.3223 499.832 38.4653 499.772C38.5941 499.716 38.7008 499.637 38.7747 499.54L121.341 393.071L121.396 393.001L119.248 393.001L37.9966 497.781L1.03819e-05 448.786L1.014e-05 451.553L37.1952 499.519C37.2771 499.624 37.3941 499.71 37.5347 499.77C37.6752 499.831 37.8344 499.863 37.9966 499.863ZM37.9967 483.527C38.1613 483.527 38.3231 483.495 38.4665 483.435C38.5938 483.38 38.6995 483.301 38.7728 483.205L108.671 393.071L108.726 393.001L106.578 393.001L37.9967 481.449L1.18097e-05 432.454L1.15678e-05 435.221L37.1952 483.183C37.2771 483.287 37.3941 483.374 37.5347 483.434C37.6752 483.494 37.8344 483.526 37.9967 483.527V483.527ZM37.2241 466.875C37.2527 466.914 37.2909 466.949 37.3367 466.978C37.3704 467.003 37.4063 467.027 37.4443 467.049C37.4718 467.066 37.5019 467.081 37.5341 467.094C37.5683 467.111 37.6061 467.125 37.6461 467.133C37.7158 467.16 37.7919 467.175 37.87 467.18C37.9112 467.188 37.9539 467.192 37.9967 467.19C38.1584 467.194 38.3181 467.163 38.4573 467.102L38.5459 467.061L38.5484 467.058C38.5864 467.039 38.62 467.016 38.6481 466.989C38.661 466.979 38.6739 466.969 38.6991 466.947C38.728 466.931 38.7508 466.91 38.7649 466.885C38.7875 466.864 38.8077 466.841 38.8252 466.816L96.0624 393.001L93.9152 393.001L37.9967 465.117L1.32379e-05 416.117L1.29956e-05 418.889L37.2063 466.858L37.2241 466.875ZM37.6781 466.989L37.6795 466.989L37.6774 466.993L37.6781 466.989ZM37.6046 466.959L37.6055 466.96L37.6036 466.962L37.6046 466.959Z" fill="#FFEC6E"/>
-</g>
-<g clip-path="url(#clip2_2_43)">
-<path d="M265.195 138.486C265.277 138.382 265.394 138.295 265.534 138.235C265.675 138.175 265.834 138.143 265.997 138.142C266.163 138.142 266.326 138.175 266.47 138.236C266.615 138.301 266.735 138.392 266.818 138.502L311.399 196L309.251 196L265.997 140.22L228 189.215L228 186.443L265.169 138.524L265.195 138.486ZM265.997 58.5519L228 107.547L228 104.775L265.169 56.8563L265.195 56.8178C265.277 56.7136 265.394 56.6271 265.535 56.5668C265.675 56.5064 265.834 56.4745 265.997 56.474C266.163 56.4741 266.326 56.5065 266.47 56.5678C266.615 56.6325 266.735 56.7238 266.818 56.833L374.681 195.929L374.735 196L372.588 196L265.997 58.5519ZM265.195 73.1542C265.277 73.05 265.394 72.9634 265.535 72.9031C265.675 72.8428 265.834 72.8108 265.997 72.8103C266.163 72.8105 266.326 72.8428 266.47 72.9042C266.615 72.9689 266.735 73.0602 266.818 73.1693L362.067 196L359.919 196L265.997 74.8883L228 123.883L228 121.111L265.169 73.1926L265.195 73.1542ZM265.997 89.1375C266.161 89.1375 266.322 89.1691 266.465 89.2291C266.594 89.2845 266.701 89.3643 266.775 89.4604L349.341 195.929L349.395 196L347.248 196L265.997 91.2201L228 140.215L228 137.448L265.195 89.4814C265.277 89.3772 265.394 89.2906 265.535 89.2303C265.675 89.17 265.834 89.1381 265.997 89.1375V89.1375ZM265.997 105.474C266.161 105.474 266.323 105.506 266.466 105.566C266.594 105.621 266.699 105.7 266.773 105.795L336.671 195.929L336.726 196L334.578 196L265.997 107.552L228 156.547L228 153.78L265.195 105.818C265.277 105.714 265.394 105.627 265.535 105.567C265.675 105.506 265.834 105.474 265.997 105.474V105.474ZM265.224 122.125C265.253 122.086 265.291 122.052 265.337 122.023C265.37 121.998 265.406 121.974 265.444 121.952C265.472 121.935 265.502 121.919 265.534 121.907C265.568 121.889 265.606 121.876 265.646 121.868C265.716 121.841 265.792 121.825 265.87 121.821C265.911 121.813 265.954 121.809 265.997 121.81C266.158 121.807 266.318 121.838 266.457 121.899L266.546 121.939L266.548 121.943C266.586 121.962 266.62 121.985 266.648 122.012C266.661 122.021 266.674 122.032 266.699 122.054C266.728 122.07 266.751 122.091 266.765 122.115C266.787 122.137 266.808 122.16 266.825 122.184L324.062 196L321.915 196L265.997 123.884L228 172.884L228 170.112L265.206 122.143L265.224 122.125ZM265.678 122.012L265.679 122.012L265.677 122.008L265.678 122.012ZM265.605 122.042L265.606 122.041L265.604 122.039L265.605 122.042Z" fill="#FFEC6E"/>
-</g>
-<g clip-path="url(#clip3_2_43)">
-<path d="M374.675 196.071L374.729 196.001L372.581 196.001L228 382.444L228 385.212L374.675 196.071ZM311.399 196.001L309.252 196.001L228 300.775L228 303.543L311.344 196.071L311.399 196.001ZM349.396 196.001L347.248 196.001L228 349.775L228 352.543L349.341 196.071L349.396 196.001ZM362.066 196.001L359.918 196.001L228 366.107L228 368.875L362.011 196.071L362.066 196.001ZM336.733 196.001L334.585 196.001L228 333.439L228 336.207L336.678 196.071L336.733 196.001ZM324.063 196.001L321.915 196.001L228 317.107L228 319.875L324.008 196.071L324.063 196.001Z" fill="#FFEC6E"/>
-<path d="M418.805 334.487C418.723 334.383 418.606 334.296 418.466 334.236C418.325 334.176 418.166 334.143 418.003 334.143C417.837 334.143 417.674 334.176 417.53 334.237C417.385 334.302 417.265 334.393 417.182 334.503L372.601 392.001L374.749 392.001L418.003 336.221L456 385.216L456 382.444L418.831 334.525L418.805 334.487ZM418.003 254.553L456 303.548L456 300.776L418.831 252.857L418.805 252.819C418.723 252.715 418.606 252.628 418.465 252.568C418.325 252.507 418.166 252.475 418.003 252.475C417.837 252.475 417.674 252.507 417.53 252.569C417.385 252.633 417.265 252.725 417.182 252.834L309.319 391.93L309.265 392.001L311.412 392.001L418.003 254.553ZM418.805 269.155C418.723 269.051 418.606 268.964 418.465 268.904C418.325 268.844 418.166 268.812 418.003 268.811C417.837 268.811 417.674 268.844 417.53 268.905C417.385 268.97 417.265 269.061 417.182 269.17L321.933 392.001L324.081 392.001L418.003 270.889L456 319.884L456 317.112L418.831 269.194L418.805 269.155ZM418.003 285.138C417.839 285.138 417.678 285.17 417.535 285.23C417.406 285.285 417.299 285.365 417.225 285.461L334.659 391.93L334.604 392.001L336.752 392.001L418.003 287.221L456 336.216L456 333.449L418.805 285.482C418.723 285.378 418.606 285.292 418.465 285.231C418.325 285.171 418.166 285.139 418.003 285.138ZM418.003 301.475C417.839 301.475 417.677 301.507 417.534 301.567C417.406 301.622 417.301 301.701 417.227 301.796L347.329 391.93L347.274 392.001L349.422 392.001L418.003 303.553L456 352.548L456 349.781L418.805 301.819C418.723 301.715 418.606 301.628 418.465 301.568C418.325 301.507 418.166 301.475 418.003 301.475V301.475ZM418.776 318.126C418.747 318.087 418.709 318.053 418.663 318.024C418.63 317.999 418.594 317.975 418.556 317.953C418.528 317.936 418.498 317.92 418.466 317.908C418.432 317.89 418.394 317.877 418.354 317.868C418.284 317.842 418.208 317.826 418.13 317.822C418.089 317.814 418.046 317.81 418.003 317.811C417.842 317.808 417.682 317.839 417.543 317.9L417.454 317.94L417.452 317.944C417.414 317.963 417.38 317.986 417.352 318.013C417.339 318.022 417.326 318.033 417.301 318.055C417.272 318.071 417.249 318.092 417.235 318.116C417.212 318.138 417.192 318.161 417.175 318.185L359.938 392.001L362.085 392.001L418.003 319.885L456 368.885L456 366.112L418.794 318.144L418.776 318.126ZM418.322 318.013L418.321 318.013L418.323 318.009L418.322 318.013ZM418.395 318.042L418.394 318.042L418.396 318.04L418.395 318.042Z" fill="white"/>
-</g>
-</g>
-<defs>
-<clipPath id="clip0_2_43">
-<rect width="228" height="196" fill="white" transform="translate(228 393.001) rotate(-180)"/>
-</clipPath>
-<clipPath id="clip1_2_43">
-<rect width="228" height="196" fill="white" transform="translate(1.52588e-05 393.001)"/>
-</clipPath>
-<clipPath id="clip2_2_43">
-<rect width="228" height="196" fill="white" transform="translate(456 196) rotate(-180)"/>
-</clipPath>
-<clipPath id="clip3_2_43">
-<rect width="228" height="196" fill="white" transform="translate(456 392.001) rotate(-180)"/>
-</clipPath>
-</defs>
-</svg>
diff --git a/website/public/img/raft-join-detailed.png b/website/public/img/raft-join-detailed.png
deleted file mode 100644
index 5cfb38cd762..00000000000
Binary files a/website/public/img/raft-join-detailed.png and /dev/null differ
diff --git a/website/public/img/replication-overview.png b/website/public/img/replication-overview.png
deleted file mode 100644
index 32cdbfc1959..00000000000
Binary files a/website/public/img/replication-overview.png and /dev/null differ
diff --git a/website/public/img/servicenow-vault-credential-resolver-diagram.png b/website/public/img/servicenow-vault-credential-resolver-diagram.png
deleted file mode 100644
index f7abed45019..00000000000
Binary files a/website/public/img/servicenow-vault-credential-resolver-diagram.png and /dev/null differ
diff --git a/website/public/img/social/github.svg b/website/public/img/social/github.svg
deleted file mode 100644
index 3c14141cc20..00000000000
--- a/website/public/img/social/github.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="22" height="22" viewBox="0 0 22 22" xmlns="http://www.w3.org/2000/svg"><title>Octocat Copy 3</title><path d="M10.999 0C4.926 0 0 4.925 0 11c0 4.86 3.152 8.983 7.523 10.437.55.102.75-.238.75-.53 0-.26-.009-.952-.014-1.87-3.06.664-3.706-1.475-3.706-1.475-.5-1.27-1.221-1.61-1.221-1.61-.999-.681.075-.668.075-.668 1.105.078 1.685 1.134 1.685 1.134.981 1.68 2.575 1.195 3.202.914.1-.71.384-1.195.698-1.47-2.442-.278-5.01-1.222-5.01-5.437 0-1.2.428-2.183 1.132-2.952-.114-.278-.491-1.397.108-2.91 0 0 .923-.297 3.025 1.127A10.536 10.536 0 0 1 11 5.32c.935.004 1.876.125 2.754.37 2.1-1.424 3.022-1.128 3.022-1.128.6 1.514.223 2.633.11 2.911.705.769 1.13 1.751 1.13 2.952 0 4.226-2.572 5.156-5.022 5.428.395.34.747 1.01.747 2.037 0 1.47-.014 2.657-.014 3.017 0 .295.199.637.756.53C18.851 19.979 22 15.859 22 11c0-6.075-4.926-11-11.001-11" fill="#FFF" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/social/googleplus.svg b/website/public/img/social/googleplus.svg
deleted file mode 100644
index 3063de6db68..00000000000
--- a/website/public/img/social/googleplus.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="16" viewBox="0 0 24 16" xmlns="http://www.w3.org/2000/svg"><title>G+ Copy 3</title><path d="M.02 7.203C.086 3.297 3.696-.124 7.623.006c1.882-.087 3.65.728 5.091 1.872a27.061 27.061 0 0 1-1.932 1.991C9.05 2.68 6.586 2.338 4.853 3.713c-2.478 1.705-2.59 5.731-.207 7.567 2.318 2.092 6.7 1.053 7.34-2.15-1.451-.022-2.907 0-4.36-.048-.003-.861-.007-1.723-.003-2.585 2.427-.007 4.855-.01 7.286.008.145 2.027-.124 4.185-1.376 5.86-1.896 2.655-5.702 3.43-8.672 2.292-2.98-1.13-5.092-4.26-4.84-7.454m19.623-2.882h2.165c.004.721.007 1.445.015 2.165.724.008 1.452.008 2.176.015v2.154c-.724.007-1.448.011-2.176.018-.008.724-.011 1.445-.015 2.165H19.64c-.007-.72-.007-1.44-.014-2.161l-2.177-.022V6.501c.725-.007 1.449-.01 2.177-.015.003-.724.01-1.444.018-2.165" fill="#FFF" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/social/linkedin.svg b/website/public/img/social/linkedin.svg
deleted file mode 100644
index 4c48a7a5b99..00000000000
--- a/website/public/img/social/linkedin.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Path Copy 9</title><path d="M20.452 20.45h-3.56v-5.57c0-1.327-.022-3.036-1.85-3.036-1.851 0-2.134 1.448-2.134 2.941v5.665H9.352V8.997h3.413v1.566h.049c.474-.9 1.636-1.85 3.367-1.85 3.605 0 4.27 2.371 4.27 5.456v6.281zM5.339 7.433a2.063 2.063 0 1 1 0-4.13 2.065 2.065 0 0 1 0 4.13zM7.12 20.45H3.557V8.997H7.12V20.45zM23 0H1a1 1 0 0 0-1 1v22a1 1 0 0 0 1 1h22a1 1 0 0 0 1-1V1a1 1 0 0 0-1-1z" fill="#FFF" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/social/twitter.svg b/website/public/img/social/twitter.svg
deleted file mode 100644
index d18e17bca8c..00000000000
--- a/website/public/img/social/twitter.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="20" viewBox="0 0 24 20" xmlns="http://www.w3.org/2000/svg"><title>Path Copy 7</title><path d="M24 2.309a9.83 9.83 0 0 1-2.828.775A4.94 4.94 0 0 0 23.337.36a9.865 9.865 0 0 1-3.127 1.196 4.925 4.925 0 0 0-8.39 4.49A13.974 13.974 0 0 1 1.671.901a4.902 4.902 0 0 0-.667 2.476c0 1.708.869 3.216 2.191 4.099A4.936 4.936 0 0 1 .964 6.86v.061a4.926 4.926 0 0 0 3.95 4.828 4.964 4.964 0 0 1-2.224.085 4.93 4.93 0 0 0 4.6 3.42 9.886 9.886 0 0 1-6.115 2.107c-.398 0-.79-.023-1.175-.068a13.945 13.945 0 0 0 7.548 2.212c9.057 0 14.009-7.503 14.009-14.01 0-.213-.005-.425-.014-.636A10.012 10.012 0 0 0 24 2.309" fill="#FFF" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/social/youtube.svg b/website/public/img/social/youtube.svg
deleted file mode 100644
index ced3b3bd725..00000000000
--- a/website/public/img/social/youtube.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="24" height="17" viewBox="0 0 24 17" xmlns="http://www.w3.org/2000/svg"><title>Path Copy 8</title><path d="M9.522 11.553V4.81l6.484 3.383-6.484 3.36zM23.76 3.641s-.235-1.654-.954-2.382C21.893.303 20.87.3 20.401.243 17.043 0 12.005 0 12.005 0h-.01S6.957 0 3.599.243c-.47.055-1.492.06-2.406 1.016C.474 1.987.24 3.641.24 3.641S0 5.584 0 7.525v1.821c0 1.943.24 3.885.24 3.885s.234 1.654.953 2.382c.914.956 2.113.926 2.647 1.026 1.92.184 8.16.241 8.16.241s5.043-.007 8.401-.25c.47-.057 1.492-.061 2.405-1.017.72-.728.954-2.382.954-2.382s.24-1.942.24-3.885v-1.82c0-1.942-.24-3.885-.24-3.885z" fill="#FFF" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/website/public/img/transit-or-transform.png b/website/public/img/transit-or-transform.png
deleted file mode 100644
index 7d0c01a8dce..00000000000
Binary files a/website/public/img/transit-or-transform.png and /dev/null differ
diff --git a/website/public/img/ui-custom-msg.png b/website/public/img/ui-custom-msg.png
deleted file mode 100644
index 257230816b5..00000000000
Binary files a/website/public/img/ui-custom-msg.png and /dev/null differ
diff --git a/website/public/img/unseal.png b/website/public/img/unseal.png
deleted file mode 100644
index 209dd602da6..00000000000
Binary files a/website/public/img/unseal.png and /dev/null differ
diff --git a/website/public/img/use-cases/data-encryption/data-encryption-challenge.png b/website/public/img/use-cases/data-encryption/data-encryption-challenge.png
deleted file mode 100644
index 9afd533f9e2..00000000000
Binary files a/website/public/img/use-cases/data-encryption/data-encryption-challenge.png and /dev/null differ
diff --git a/website/public/img/use-cases/data-encryption/data-encryption-solution.png b/website/public/img/use-cases/data-encryption/data-encryption-solution.png
deleted file mode 100644
index b6f8fb7b7a2..00000000000
Binary files a/website/public/img/use-cases/data-encryption/data-encryption-solution.png and /dev/null differ
diff --git a/website/public/img/use-cases/data-encryption/encryption-features.png b/website/public/img/use-cases/data-encryption/encryption-features.png
deleted file mode 100644
index 2d77debd10b..00000000000
Binary files a/website/public/img/use-cases/data-encryption/encryption-features.png and /dev/null differ
diff --git a/website/public/img/use-cases/data-encryption/encryption-keyrolling@3x.png b/website/public/img/use-cases/data-encryption/encryption-keyrolling@3x.png
deleted file mode 100644
index b2111ab6afe..00000000000
Binary files a/website/public/img/use-cases/data-encryption/encryption-keyrolling@3x.png and /dev/null differ
diff --git a/website/public/img/use-cases/identity-based-access/admin.png b/website/public/img/use-cases/identity-based-access/admin.png
deleted file mode 100644
index 6d470b38f81..00000000000
Binary files a/website/public/img/use-cases/identity-based-access/admin.png and /dev/null differ
diff --git a/website/public/img/use-cases/identity-based-access/control-groups.png b/website/public/img/use-cases/identity-based-access/control-groups.png
deleted file mode 100644
index 256b214eaa1..00000000000
Binary files a/website/public/img/use-cases/identity-based-access/control-groups.png and /dev/null differ
diff --git a/website/public/img/use-cases/identity-based-access/entities.png b/website/public/img/use-cases/identity-based-access/entities.png
deleted file mode 100644
index 25acb2763f4..00000000000
Binary files a/website/public/img/use-cases/identity-based-access/entities.png and /dev/null differ
diff --git a/website/public/img/use-cases/identity-based-access/identity-based-access-challenge.png b/website/public/img/use-cases/identity-based-access/identity-based-access-challenge.png
deleted file mode 100644
index afbe577bf58..00000000000
Binary files a/website/public/img/use-cases/identity-based-access/identity-based-access-challenge.png and /dev/null differ
diff --git a/website/public/img/use-cases/identity-based-access/identity-based-access-solution.png b/website/public/img/use-cases/identity-based-access/identity-based-access-solution.png
deleted file mode 100644
index 4fdca313c1e..00000000000
Binary files a/website/public/img/use-cases/identity-based-access/identity-based-access-solution.png and /dev/null differ
diff --git a/website/public/img/use-cases/secrets-management/dynamic_secrets@3x.png b/website/public/img/use-cases/secrets-management/dynamic_secrets@3x.png
deleted file mode 100644
index 58fcde3c6ab..00000000000
Binary files a/website/public/img/use-cases/secrets-management/dynamic_secrets@3x.png and /dev/null differ
diff --git a/website/public/img/use-cases/secrets-management/secrets-mgmt-challenge.png b/website/public/img/use-cases/secrets-management/secrets-mgmt-challenge.png
deleted file mode 100644
index eb9b8f5b123..00000000000
Binary files a/website/public/img/use-cases/secrets-management/secrets-mgmt-challenge.png and /dev/null differ
diff --git a/website/public/img/use-cases/secrets-management/secrets-mgmt-solution.png b/website/public/img/use-cases/secrets-management/secrets-mgmt-solution.png
deleted file mode 100644
index 391610daa18..00000000000
Binary files a/website/public/img/use-cases/secrets-management/secrets-mgmt-solution.png and /dev/null differ
diff --git a/website/public/img/usecase-callout-pattern.svg b/website/public/img/usecase-callout-pattern.svg
deleted file mode 100644
index ce4c25de90a..00000000000
--- a/website/public/img/usecase-callout-pattern.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="164" height="384" fill="none" xmlns="http://www.w3.org/2000/svg"><g clip-path="url(#a)" fill="#000"><path d="M78.046 288.34a.702.702 0 0 0 0-.68L23.906 192h-1.532l54.33 96-54.294 95.927-.036.073h1.531l54.123-95.633.018-.027Zm-9.059 0c.027-.055.045-.101.063-.156l.009-.028v-.027l.009-.046v-.028c0-.009.009-.027.009-.073 0-.019 0-.028-.009-.056 0-.036-.009-.064-.018-.101a.362.362 0 0 1-.027-.091.667.667 0 0 1-.027-.074L14.855 192h-1.531l54.33 95.991-54.294 95.936-.036.073h1.54l54.123-95.623v-.037Zm18.12-.009a.776.776 0 0 0 .08-.267.607.607 0 0 0-.063-.358L32.956 192h-1.531l54.33 95.991-54.294 95.936-.036.073h1.53l54.097-95.596.054-.073Zm-27.17 0a.845.845 0 0 0 .08-.267.608.608 0 0 0-.063-.358L5.795 192h-1.53l54.33 95.991L4.3 383.927l-.036.073h1.54L59.9 288.404l.036-.073Zm36.22-.671L42.015 192h-1.53l54.33 96-54.295 95.927-.036.073h1.531l54.142-95.66a.702.702 0 0 0 0-.68Zm9.059 0L51.075 192h-1.531l54.33 96-54.294 95.927-.036.073h1.531l54.141-95.66a.703.703 0 0 0 0-.68ZM58.595 192l104.788 185.147.117.202v-2.719L60.135 192h-1.54Zm9.06 0 95.728 169.144.117.202v-2.71L69.194 192h-1.54Zm9.05 0 86.678 153.141.117.202v-2.71L78.245 192h-1.54Zm9.06 0 77.618 137.147.117.211v-2.719L87.304 192h-1.54Zm18.109 0 59.509 105.15.117.211v-2.719L105.414 192h-1.54Zm-9.06 0 68.569 121.144.117.202v-2.719L96.355 192h-1.54Z"/></g><g clip-path="url(#b)" fill="#000"><path d="M109.737 87.659a.663.663 0 0 0-.576-.34.636.636 0 0 0-.334.092.757.757 0 0 0-.252.257L49.58 191.927l-.036.073h1.54l58.095-102.642 54.213 95.789.117.202v-2.71l-53.745-94.944-.027-.036Z"/><path d="M109.629 55.515a.622.622 0 0 0-.459-.202.705.705 0 0 0-.334.091l-.063.037v.01a.722.722 0 0 0-.189.22L31.47 191.927l-.036.073h1.54L109.17 57.352l54.222 95.798.117.202v-2.719l-53.763-94.98a1.236 1.236 0 0 0-.117-.138Z"/><path d="M109.737 71.656a.663.663 0 0 0-.576-.34.636.636 0 0 0-.334.091.758.758 0 0 0-.252.258L40.521 191.927l-.037.073h1.532L109.17 73.355l54.213 95.798.117.202v-2.719l-53.745-94.944-.018-.036Z"/><path d="M109.737 23.655a.663.663 0 0 0-.576-.34.636.636 0 0 0-.334.092.758.758 0 0 0-.252.258L13.36 191.927l-.036.073h1.53L109.17 25.355l54.213 95.789.117.202v-2.719l-53.745-94.944-.018-.027Z"/><path d="M109.755 39.585h-.063l-.009-.01-.009-.036-.054-.027c-.018-.019-.036-.037-.063-.056-.018-.009-.036-.027-.063-.046-.027-.018-.054-.027-.081-.036a.36.36 0 0 0-.162-.046.335.335 0 0 0-.09-.01c-.045 0-.09.01-.126.019-.018 0-.045.01-.081.018l-.073.028c-.018.01-.036.01-.054.027l-.063.037c-.036.019-.054.046-.072.065l-.09.073v.037c-.009.018-.027.037-.036.055l-86.165 152.25-.036.073h1.54L109.17 41.358l54.213 95.789.117.202v-2.719l-53.745-94.944v-.1Zm-.306-.037s0-.009 0 0Z"/><path d="M5.795 192 109.17 9.361l54.213 95.798.117.202V102.633l-50.872-89.882-2.864-5.062-.018-.037a.663.663 0 0 0-.576-.34.636.636 0 0 0-.334.092.758.758 0 0 0-.252.258L4.3 191.927l-.045.073h1.54ZM.5 89.358v-2.71L49.535 0h1.531L.608 89.147l-.108.211Zm0-80.006L5.795 0h-1.53L.5 6.642v2.71Zm.117 63.8L42.016 0h-1.532L.5 70.645v2.71l.117-.202Zm0-16.002L32.965 0h-1.531L.5 54.642v2.71l.117-.202Zm0-31.997L14.855 0h-1.54L.5 22.645v2.71l.117-.202Zm0 15.994L23.905 0h-1.53L.5 38.648v2.71l.117-.211Z"/></g><defs><clipPath id="a"><path fill="#fff" transform="translate(.5 192)" d="M0 0h163v192H0z"/></clipPath><clipPath id="b"><path fill="#fff" transform="translate(.5)" d="M0 0h163v192H0z"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/website/public/img/usecase-hero-pattern.svg b/website/public/img/usecase-hero-pattern.svg
deleted file mode 100644
index feecda8c445..00000000000
--- a/website/public/img/usecase-hero-pattern.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg width="420" height="503" fill="none" xmlns="http://www.w3.org/2000/svg"><mask id="mask0_5_55" style="mask-type:alpha" maskUnits="userSpaceOnUse" x="0" y="0" width="420" height="503"><path fill="#C4C4C4" d="M0 0h420v503H0z"/></mask><g mask="url(#mask0_5_55)"><path d="M85.798 92.398c-.164-.218-.479-.35-.806-.35a1.13 1.13 0 0 0-.467.094.963.963 0 0 0-.352.265L1.639 199.924l-.05.076h2.154L85.004 94.15l75.832 98.783.164.218v-2.795l-75.177-97.91-.025-.048Z" fill="#000"/><path d="M85.647 59.25a1.243 1.243 0 0 0-.19-.114 1.114 1.114 0 0 0-.453-.095c-.164 0-.327.038-.466.095l-.088.038v.01a.867.867 0 0 0-.265.227L-23.68 199.923l-.05.076h2.154L84.992 61.144l75.844 98.792.164.208v-2.804L85.798 59.392a.674.674 0 0 0-.151-.143Z" fill="#000"/><path d="M85.798 75.895c-.164-.218-.479-.35-.806-.35a1.13 1.13 0 0 0-.467.094.964.964 0 0 0-.352.265l-95.193 124.02-.05.076h2.14L85.005 77.647l75.832 98.782.164.218v-2.804l-75.177-97.91-.025-.038Z" fill="#000"/><path d="M85.798 26.395c-.164-.218-.479-.35-.806-.35a1.13 1.13 0 0 0-.467.094.964.964 0 0 0-.352.265l-133.197 173.52-.05.076h2.14L85.004 28.147l75.832 98.782.164.218v-2.804l-75.177-97.91-.025-.038Z" fill="#000"/><path d="M85.823 42.822h-.088l-.013-.01-.012-.037-.076-.029c-.025-.019-.05-.038-.088-.056-.025-.01-.05-.029-.088-.048-.038-.019-.076-.028-.114-.038a.649.649 0 0 0-.226-.047c-.05-.01-.089-.01-.126-.01a.979.979 0 0 0-.177.02c-.025 0-.063.009-.113.018l-.1.029c-.026.01-.051.01-.077.028l-.088.038c-.05.019-.075.047-.1.066l-.126.076v.038c-.013.019-.038.038-.05.057L-36.366 199.924l-.05.076h2.154L85.004 44.65l75.832 98.783.164.208v-2.804l-75.177-97.91v-.105Zm-.428-.038s0-.01 0 0Z" fill="#000"/><path d="M-59.593 200 85.004 11.654l75.832 98.782.164.218V107.84L89.841 15.15l-4.005-5.22-.026-.038c-.163-.218-.478-.35-.806-.35a1.13 1.13 0 0 0-.466.094.964.964 0 0 0-.353.265l-145.87 190.014-.05.076h2.142V200Z" fill="#000"/><g clip-path="url(#clip0_5_55)"><path d="M41.47 297.652a.552.552 0 0 1 0 .694l-75.731 97.653h-2.142l75.996-98-75.945-97.925-.05-.075h2.14l75.707 97.625.025.028Zm-12.672 0a1 1 0 0 1 .088.159l.013.029v.028l.012.047v.028c0 .009.013.028.013.075 0 .019 0 .028-.013.056 0 .038-.012.066-.025.103a.318.318 0 0 0-.038.094c-.012.019-.025.047-.037.075l-75.732 97.653h-2.141l75.995-97.991-75.945-97.934-.05-.075h2.154l75.706 97.616v.037Zm25.344.009c.05.066.089.15.114.272a.48.48 0 0 1-.089.366l-75.768 97.7h-2.142l75.996-97.991-75.945-97.934-.051-.075h2.142l75.668 97.587.075.075Zm-38.004 0c.05.075.088.15.113.272a.48.48 0 0 1-.088.366l-75.756 97.7h-2.141l75.995-97.991-75.945-97.934-.05-.075h2.154l75.668 97.587.05.075Zm50.664.685-75.731 97.653h-2.142l75.996-98-75.945-97.925-.05-.075h2.14l75.732 97.653a.551.551 0 0 1 0 .694Zm12.672 0-75.73 97.653H1.601l75.995-98-75.945-97.925-.05-.075h2.141l75.731 97.653a.551.551 0 0 1 0 .694Z" fill="#BFBFC0"/><path d="m14.261 395.999 146.575-189.004.164-.206v2.776L16.415 395.999h-2.154Zm12.672 0 133.903-172.668.164-.206v2.767L29.088 395.999h-2.155Zm12.66 0 121.243-156.331.164-.206v2.766L41.747 395.999h-2.154Zm12.672 0 108.571-140.004.164-.216v2.776L54.42 395.999h-2.154Zm25.332 0 83.239-107.34.164-.216v2.776l-81.249 104.78h-2.154Zm-12.672 0 95.911-123.668.164-.215v2.776L67.079 395.999h-2.154Z" fill="#000"/></g><g clip-path="url(#clip1_5_55)" fill="#BFBFC0"><path d="m307.675 395.929.054.07h-2.148L161 209.556v-2.768l146.675 189.141Zm-63.276.07h-2.147L161 291.224v-2.768l83.344 107.473.055.07Zm37.997 0h-2.148L161 242.224v-2.768l121.341 156.473.055.07Zm12.67 0h-2.148L161 225.893v-2.768l134.011 172.804.055.07Zm-25.333 0h-2.148L161 258.561v-2.768l108.678 140.136.055.07Zm-12.67 0h-2.148L161 274.893v-2.768l96.008 123.804.055.07ZM166.258 395.999 161 389.215v-2.769l7.405 9.553h-2.147Zm65.485 0h-2.148L161 307.541v-2.758l70.688 91.146.055.07Zm-12.671 0h-2.147L161 323.873v-2.763l58.017 74.819.055.07Zm-12.663 0h-2.147L161 340.21v-2.763l45.354 58.482.055.07Zm-27.481 0L161 372.873v-2.758l20.075 25.884h-2.147Zm12.664 0L161 356.541v-2.763l32.739 42.221h-2.147Z"/></g><g clip-path="url(#clip2_5_55)" fill="#000"><path d="m242.261 395.999 146.575 190.933.164.208v-2.804L244.415 395.999h-2.154Zm12.672 0 133.903 174.429.164.209v-2.795L257.088 395.999h-2.155Zm12.66 0 121.243 157.926.164.209v-2.795l-119.253-155.34h-2.154Zm12.672 0 108.571 141.433.164.218v-2.805L282.419 395.999h-2.154Zm25.332 0 83.239 108.436.164.218v-2.805l-81.249-105.849h-2.154Zm-12.672 0 95.911 124.929.164.209v-2.804l-93.921-122.334h-2.154ZM161.164 487.932l70.579-91.933h-2.141l-68.589 89.356v2.795l.151-.218ZM161 402.848l5.266-6.849h2.141L161 405.643v-2.795Zm0 68.798v-2.794l55.929-72.853h2.142l-57.907 75.439-.164.208Zm0-16.503v-2.795l43.257-56.349h2.142l-45.248 58.936-.151.208Zm0-32.997v-2.794l17.925-23.353h2.154l-19.915 25.939-.164.208Zm0 16.504v-2.795l30.597-39.856h2.142l-32.575 42.433-.164.218ZM161 501.848v2.795l68.589 89.356h2.141l-70.579-91.933-.151-.218Zm0 82.507 7.407 9.644h-2.142L161 587.15v-2.795Zm.164-65.795 57.907 75.439h-2.142L161 521.146v-2.794l.164.208Zm0 16.503 45.247 58.936h-2.141l-43.257-56.349v-2.795l.151.208Zm0 32.997 19.915 25.939h-2.154L161 570.646v-2.794l.164.208Zm0-16.494 32.575 42.433h-2.142L161 554.143v-2.795l.164.218Z"/></g></g><defs><clipPath id="clip0_5_55"><path d="M161 205.999a6 6 0 0 0-6-6H-61a6 6 0 0 0-6 6v184a6 6 0 0 0 6 6h216a6 6 0 0 0 6-6v-184Z" fill="#fff"/></clipPath><clipPath id="clip1_5_55"><path d="M389 205.999a6 6 0 0 0-6-6H167a6 6 0 0 0-6 6v184a6 6 0 0 0 6 6h216a6 6 0 0 0 6-6v-184Z" fill="#fff"/></clipPath><clipPath id="clip2_5_55"><path d="M389 401.999a6 6 0 0 0-6-6H167a6 6 0 0 0-6 6v186a6 6 0 0 0 6 6h216a6 6 0 0 0 6-6v-186Z" fill="#fff"/></clipPath></defs></svg>
\ No newline at end of file
diff --git a/website/public/img/vault-acl-templating-2.png b/website/public/img/vault-acl-templating-2.png
deleted file mode 100644
index fab96bc6a7a..00000000000
Binary files a/website/public/img/vault-acl-templating-2.png and /dev/null differ
diff --git a/website/public/img/vault-acl-templating-3.png b/website/public/img/vault-acl-templating-3.png
deleted file mode 100644
index e8e11f51d34..00000000000
Binary files a/website/public/img/vault-acl-templating-3.png and /dev/null differ
diff --git a/website/public/img/vault-acl-templating.png b/website/public/img/vault-acl-templating.png
deleted file mode 100644
index 460b78822ed..00000000000
Binary files a/website/public/img/vault-acl-templating.png and /dev/null differ
diff --git a/website/public/img/vault-agent-workflow.png b/website/public/img/vault-agent-workflow.png
deleted file mode 100644
index 32e3967174c..00000000000
Binary files a/website/public/img/vault-agent-workflow.png and /dev/null differ
diff --git a/website/public/img/vault-approle-tf-chef-2.png b/website/public/img/vault-approle-tf-chef-2.png
deleted file mode 100644
index dd8c6bc501f..00000000000
Binary files a/website/public/img/vault-approle-tf-chef-2.png and /dev/null differ
diff --git a/website/public/img/vault-approle-tf-chef-3.png b/website/public/img/vault-approle-tf-chef-3.png
deleted file mode 100644
index c5f52261b12..00000000000
Binary files a/website/public/img/vault-approle-tf-chef-3.png and /dev/null differ
diff --git a/website/public/img/vault-approle-tf-chef.png b/website/public/img/vault-approle-tf-chef.png
deleted file mode 100644
index a8813b91ab1..00000000000
Binary files a/website/public/img/vault-approle-tf-chef.png and /dev/null differ
diff --git a/website/public/img/vault-approle-workflow.png b/website/public/img/vault-approle-workflow.png
deleted file mode 100644
index 5f1f0021687..00000000000
Binary files a/website/public/img/vault-approle-workflow.png and /dev/null differ
diff --git a/website/public/img/vault-approle-workflow2.png b/website/public/img/vault-approle-workflow2.png
deleted file mode 100644
index 5d8ece655a1..00000000000
Binary files a/website/public/img/vault-approle-workflow2.png and /dev/null differ
diff --git a/website/public/img/vault-approle-youtube.png b/website/public/img/vault-approle-youtube.png
deleted file mode 100644
index 366786cb93a..00000000000
Binary files a/website/public/img/vault-approle-youtube.png and /dev/null differ
diff --git a/website/public/img/vault-auth-method-2.png b/website/public/img/vault-auth-method-2.png
deleted file mode 100644
index afcb2529618..00000000000
Binary files a/website/public/img/vault-auth-method-2.png and /dev/null differ
diff --git a/website/public/img/vault-auth-method-3.png b/website/public/img/vault-auth-method-3.png
deleted file mode 100644
index 5f09f04a7eb..00000000000
Binary files a/website/public/img/vault-auth-method-3.png and /dev/null differ
diff --git a/website/public/img/vault-auth-method-4.png b/website/public/img/vault-auth-method-4.png
deleted file mode 100644
index 2cf82721a41..00000000000
Binary files a/website/public/img/vault-auth-method-4.png and /dev/null differ
diff --git a/website/public/img/vault-auth-method.png b/website/public/img/vault-auth-method.png
deleted file mode 100644
index f2e80372d8d..00000000000
Binary files a/website/public/img/vault-auth-method.png and /dev/null differ
diff --git a/website/public/img/vault-auth-workflow.svg b/website/public/img/vault-auth-workflow.svg
deleted file mode 100644
index 0cdd611f396..00000000000
--- a/website/public/img/vault-auth-workflow.svg
+++ /dev/null
@@ -1,45 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 669 497">
-  <g fill="none" fill-rule="evenodd">
-    <path fill="#000" fill-rule="nonzero" d="M311.695 294.833h5.472l-8.314 28.304h-7.782l-8.31-28.304h5.47l6.74 23.547m27.43 4.703h-4.18l-.37-1.347c-1.8 1.187-3.9 1.82-6.05 1.82-3.72 0-5.31-2.59-5.31-6.147 0-4.21 1.8-5.81 5.94-5.81h4.89v-2.17c0-2.29-.62-3.1-3.89-3.1-1.9.02-3.79.23-5.64.63l-.62-3.95c2.28-.64 4.63-.96 6.99-.97 6.4 0 8.28 2.29 8.28 7.47v13.57zm-5.1-7.803h-3.77c-1.67 0-2.14.47-2.14 2.035 0 1.563.47 2.075 2.05 2.075 1.35-.017 2.68-.384 3.85-1.064l.02-3.046zm13.12-12.845v14.422c0 1.105.47 1.657 1.64 1.657 1.87-.213 3.68-.804 5.32-1.738v-14.34h5.1v20.66h-3.89l-.5-1.792c-2.52 1.3-5.29 2.054-8.11 2.21-3.38 0-4.59-2.412-4.59-6.105v-14.98h5.06zm14.76 20.648v-29.1l5.1-.713v29.827m15.22-.445c-1.44.513-2.95.786-4.47.81-3.72 0-5.6-1.78-5.6-5.473v-11.52h-3.05v-4.05h3.06v-5.13l5.09-.73v5.86h5.22l-.32 4.04h-4.9v10.78c-.06.51.11 1.02.47 1.38.36.36.87.52 1.37.44.87-.03 1.72-.17 2.55-.42l.61 3.99zM283 174l51.32 103L386 174H283zm57.428 20.677h5.974v5.935h-5.974v-5.935zm-11.896 23.95h-5.974v-6.04h5.974v6.04zm0-8.954h-5.974v-6.04h5.974v6.04zm0-8.955h-5.974v-6.04h5.974v6.04zm9.022 26.798h-6.04v-5.974h6.04v5.974zm0-8.955h-6.04v-5.97h6.04v5.98zm0-8.95h-6.04v-5.97h6.04v5.98zm0-8.99h-6.04v-5.93h6.04v5.94zm2.94 2.98h5.975v5.98h-6.05l.06-5.97zm0 14.93v-5.93h5.975v5.98l-5.98-.04z"/>
-    <g fill="#000">
-      <g fill-rule="nonzero">
-        <path d="M616.97 98.466v4.257c0 5.17-12.29 10.743-30.47 10.743s-30.47-5.574-30.47-10.743v-4.257c-1.014-1.013-1.624-1.723-1.928-3.75H554v8.007c0 7.196 14.32 12.77 32.5 12.77s32.5-5.574 32.5-12.77v-8.007h-.102c-.304 2.027-.914 2.737-1.93 3.75z"/>
-        <path d="M616.97 82.25v4.257c0 5.17-12.29 10.743-30.47 10.743s-30.47-5.574-30.47-10.743V82.25c-1.014-1.014-1.624-1.723-1.928-3.75H554v8.007c0 7.196 14.32 12.77 32.5 12.77s32.5-5.574 32.5-12.77V78.5h-.102c-.304 2.027-.914 2.736-1.93 3.75z"/>
-        <path d="M616.97 66.034v4.257c0 5.17-12.29 10.75-30.47 10.75s-30.47-5.57-30.47-10.74v-4.26c-1.014-1.01-1.624-1.72-1.928-3.75H554v8.01c0 7.2 14.32 12.77 32.5 12.77S619 77.49 619 70.29v-8.006h-.102c-.304 2.027-.914 2.736-1.93 3.75z"/>
-        <path d="M586.5 67.15c-18.18 0-32.5-5.677-32.5-12.772 0-7.094 14.32-12.77 32.5-12.77S619 47.08 619 54.278c0 7.195-14.32 12.87-32.5 12.87zm0-23.616c-18.18 0-30.47 5.574-30.47 10.743 0 5.17 12.29 10.743 30.47 10.743s30.47-5.574 30.47-10.743c0-5.17-12.29-10.743-30.47-10.743z"/>
-      </g>
-      <path d="M566.66 130.68h-1.72V144h7.5v-1.54h-5.78v-11.78zm8.28 0h4.66c3.26 0 4.28 1.7 4.28 3.82v5.68c0 2.12-1.02 3.82-4.28 3.82h-4.66v-13.32zm1.72 1.54v10.24h2.88c2.02 0 2.62-.84 2.62-2.4v-5.44c0-1.56-.6-2.4-2.62-2.4h-2.88zm15.9-1.54l4.5 13.32h-1.74l-1.1-3.2h-5.66l-1.08 3.2h-1.74l4.5-13.32h2.32zm1.22 8.62l-2.38-7.38-2.38 7.38h4.76zm5.54 4.7v-13.32h4.82c2.86 0 3.86 1.24 3.86 3.28v1.98c0 2.06-1 3.3-3.86 3.3h-3.1V144h-1.72zm6.96-10.02c0-1.32-.56-1.76-2.2-1.76h-3.04v5.48h3.04c1.64 0 2.2-.46 2.2-1.76v-1.96z"/>
-    </g>
-    <g fill="#000">
-      <path d="M576.72 437.68v9.48c0 1.64-.9 2.5-3 2.5s-3-.86-3-2.5v-9.48H569v9.58c0 2.18 1.26 3.94 4.72 3.94s4.72-1.76 4.72-3.94v-9.58h-1.72zm10.98 10.7c0-1.94-.22-2.28-3.02-2.98-1.64-.4-1.66-.6-1.66-1.68 0-.88.2-1.22 1.64-1.22.8 0 1.88.12 2.7.28l.12-1.38c-.8-.22-1.82-.34-2.76-.34-2.56 0-3.36.82-3.36 2.62 0 2.02.22 2.52 2.64 3.12 1.96.48 2.04.6 2.04 1.64s-.26 1.32-1.8 1.32c-.84 0-1.94-.16-2.78-.4l-.22 1.32c.78.3 2.1.52 3.1.52 2.78 0 3.36-.92 3.36-2.82zm3.9-.78c0 1.54.42 2.16 2.32 2.16.96 0 2.02-.18 3.08-.46l.22 1.34c-.92.34-2.22.56-3.44.56-2.88 0-3.86-1.38-3.86-3.58v-2.92c0-2.02.92-3.64 3.82-3.64 2.88 0 3.66 1.66 3.66 3.68v2.04h-5.8v.82zm0-3.02v.8h4.18v-.8c0-1.36-.46-2.12-2.04-2.12s-2.14.76-2.14 2.12zm12.68-3.52c-.96.4-1.96 1-2.68 1.56l-.1-1.36h-1.46V451h1.68v-6.72c.8-.56 1.86-1.24 2.78-1.68l-.22-1.54z"/>
-      <g fill-rule="nonzero">
-        <path d="M601.854 385.5h-8.096c7.26-2.917 12.284-9.86 12.284-18.056 0-10.694-8.794-19.444-19.542-19.444-10.748 0-19.542 8.75-19.542 19.444 0 8.195 5.165 15.14 12.284 18.056h-8.096c-10.05 0-18.146 8.056-18.146 18.056V423h2.792v-19.444c0-8.473 6.84-15.278 15.354-15.278h30.708c8.515 0 15.354 6.805 15.354 15.278V423H620v-19.444c0-10-8.096-18.056-18.146-18.056zm-32.104-18.056c0-9.166 7.538-16.666 16.75-16.666s16.75 7.5 16.75 16.666c0 9.167-7.538 16.667-16.75 16.667s-16.75-7.5-16.75-16.66z"/>
-        <path d="M568.354 409.11h2.792V423h-2.792zm33.5 0h2.792V423h-2.792z"/>
-      </g>
-    </g>
-    <g fill="#000">
-      <path d="M42.22 451h2.32l4.4-13.32h-1.66l-3.9 11.82-3.9-11.82h-1.66l4.4 13.32zm15.58-6.78V451h-1.42l-.1-.72c-.86.6-1.98.92-3.16.92-1.82 0-2.58-1.08-2.58-2.8 0-2.02 1.02-2.74 2.98-2.74h2.6v-1.52c0-1.22-.54-1.64-2.12-1.64-.94 0-2.16.16-2.92.32l-.18-1.34c.92-.24 2.16-.42 3.2-.42 2.78 0 3.7 1.08 3.7 3.16zm-1.68 4.74v-1.9h-2.48c-1.04 0-1.42.32-1.42 1.3 0 1 .18 1.4 1.38 1.4.84 0 1.78-.32 2.52-.8zm4.54-7.7v7.46c0 1.5.56 2.48 2.12 2.48 1.16 0 2.84-.52 3.92-1.04l.16.84h1.36v-9.74h-1.68v7.36c-1.04.54-2.54.98-3.26.98-.62 0-.94-.26-.94-.9v-7.44h-1.68zM73.1 451v-13.96l-1.68.24V451h1.68zm8.06-1.46c-.62.16-1.1.24-1.56.24-.9 0-1-.36-1-1.08v-6.04h2.62l.14-1.4H78.6v-2.64l-1.68.24v2.4H75.2v1.4h1.72v6.32c0 1.62.78 2.22 2.42 2.22.72 0 1.44-.14 2.04-.36l-.22-1.3zm6.92 1.46v-13.32h4.82c2.86 0 3.86 1.24 3.86 3.28v1.98c0 2.06-1 3.3-3.86 3.3h-3.1V451h-1.72zm6.96-10.02c0-1.32-.56-1.76-2.2-1.76H89.8v5.48h3.04c1.64 0 2.2-.46 2.2-1.76v-1.96zm11.5 6.56c0 2.04-1.12 3.66-3.96 3.66s-3.96-1.62-3.96-3.66v-2.82c0-2.04 1.12-3.66 3.96-3.66s3.96 1.62 3.96 3.66v2.82zm-1.68-2.88c0-1.42-.76-2.14-2.28-2.14-1.52 0-2.28.72-2.28 2.14v2.94c0 1.42.76 2.14 2.28 2.14 1.52 0 2.28-.72 2.28-2.14v-2.94zm6.06 6.34v-13.96l-1.68.24V451h1.68zm4.88 0v-9.74h-1.68V451h1.68zm0-11.3v-2.42h-1.68v2.42h1.68zm6.48 11.5c.86 0 1.84-.14 2.34-.3l-.16-1.4c-.76.16-1.46.22-2.14.22-1.68 0-2.24-.48-2.24-2v-3.18c0-1.52.56-2 2.24-2 .68 0 1.38.06 2.14.22l.14-1.4c-.5-.16-1.46-.3-2.32-.3-3.04 0-3.88 1.3-3.88 3.54v3.06c0 2.24.76 3.54 3.88 3.54zm5.96 3.74h1.58l1.38-3.94 3.22-9.74h-1.66l-2.7 8.4-2.66-8.4h-1.66l3.16 9.74h.7l-1.36 3.94z"/>
-      <g fill-rule="nonzero">
-        <path d="M113 423H58v-70.11h12.132v1.632H59.618v66.848h51.764v-66.848h-10.514v-1.63H113"/>
-        <path d="M68.272 379.467l-2.265-3.913 1.375-.815 1.456 2.52 9.22-5.38.81 1.46M68.272 392.5l-2.265-3.912 1.375-.815 1.456 2.526 9.22-5.38.81 1.46m-10.596 19.16l-2.265-3.92 1.375-.81 1.456 2.52 9.22-5.38.81 1.46m16.985-43.78h-1.618v-5.22c0-.41-.323-.66-.647-.66H77.412c-.405 0-.647.33-.647.66v5.13h-1.618v-5.14c0-1.3 1.052-2.28 2.265-2.28h16.176c1.294 0 2.265 1.06 2.265 2.28v5.21zm-13.588 20.38h24.265v1.63H82.265zm0 13.04h24.265v1.63H82.265zm0 13.04h24.265v1.63H82.265z"/>
-      </g>
-    </g>
-    <path stroke="#575757" d="M344.5 343.5v53M535 396H344"/>
-    <path fill="#575757" d="M344.5 342l3.5 7h-7"/>
-    <path stroke="#575757" d="M324.5 343.5v53m0-.5H131"/>
-    <path fill="#575757" d="M324.5 342l3.5 7h-7"/>
-    <path fill="#FFF" d="M167 384h126v22H167z"/>
-    <path fill="#000" d="M179.912 393.54c0 .457-.128.83-.383 1.12-.26.29-.62.483-1.09.58v.04c.57.07 1 .253 1.27.546.27.293.41.677.41 1.153 0 .68-.24 1.2-.71 1.56s-1.15.55-2.02.55c-.38 0-.72-.03-1.04-.09-.32-.06-.62-.16-.92-.3v-.77c.3.15.63.27.98.35.35.08.68.12.99.12 1.23 0 1.85-.49 1.85-1.45 0-.87-.68-1.3-2.04-1.3h-.71v-.7h.71c.56 0 1-.13 1.32-.37.33-.25.49-.59.49-1.02 0-.35-.12-.62-.36-.82-.24-.2-.56-.3-.97-.3-.32 0-.61.04-.89.12-.28.08-.59.24-.95.47l-.41-.55c.29-.23.63-.42 1.01-.55.38-.13.783-.2 1.21-.2.69 0 1.23.16 1.612.47.38.32.57.75.57 1.3zm1.548 4.942c0-.218.05-.383.15-.495.098-.112.24-.17.426-.17.19 0 .336.058.442.17.106.112.16.277.16.495 0 .212-.055.375-.162.49-.108.113-.254.17-.44.17-.166 0-.303-.052-.412-.154-.11-.103-.164-.27-.164-.506zm9.985.518l-.888-2.27h-2.862l-.88 2.27h-.838l2.822-7.168h.69L192.3 399h-.86zm-1.147-3.018l-.83-2.21c-.108-.28-.218-.625-.332-1.032-.072.313-.174.656-.308 1.03l-.84 2.212h2.31zm4.595 2.447c.143 0 .28-.02.415-.04.133-.02.24-.05.317-.07v.62c-.088.04-.217.07-.388.1-.17.03-.325.04-.462.04-1.035 0-1.552-.55-1.552-1.64v-3.19h-.767v-.39l.767-.34.34-1.14h.47v1.24h1.553v.63h-1.553v3.15c0 .32.077.57.23.74.153.17.363.26.63.26zm3.53 0c.143 0 .28-.02.415-.04.133-.02.24-.05.317-.07v.62c-.088.04-.217.07-.388.1-.17.03-.325.04-.46.04-1.036 0-1.554-.55-1.554-1.64v-3.19h-.767v-.39l.767-.34.342-1.14h.468v1.24h1.553v.63h-1.553v3.15c0 .32.077.57.23.74.153.17.363.26.63.26zm5.093.57l-.162-.77h-.04c-.265.33-.532.56-.797.68s-.596.18-.994.18c-.53 0-.946-.14-1.247-.41-.3-.28-.452-.67-.452-1.17 0-1.08.864-1.65 2.593-1.7l.908-.03v-.33c0-.42-.09-.73-.27-.93-.18-.2-.47-.3-.867-.3-.446 0-.95.13-1.514.41l-.25-.62c.264-.15.553-.26.868-.34.314-.09.63-.13.944-.13.638 0 1.11.14 1.42.42.306.28.46.74.46 1.36V399h-.6zm-1.83-.57c.503 0 .9-.14 1.188-.42.288-.28.432-.67.432-1.16v-.49l-.81.03c-.645.02-1.11.12-1.395.3-.28.18-.42.45-.42.83 0 .29.09.51.27.67.18.15.43.23.75.23zm6.24.66c-.776 0-1.376-.24-1.8-.72-.425-.48-.638-1.15-.638-2.03 0-.9.216-1.59.647-2.08.432-.49 1.046-.73 1.844-.73.25 0 .51.02.77.08.25.05.46.12.6.19l-.25.68c-.18-.07-.38-.13-.59-.18-.21-.05-.4-.07-.56-.07-1.09 0-1.64.69-1.64 2.08 0 .66.13 1.16.4 1.51.26.35.66.53 1.18.53.44 0 .9-.1 1.37-.29v.72c-.36.18-.81.28-1.35.28zm6.283-.1v-3.47c0-.44-.1-.76-.3-.98-.2-.22-.51-.33-.93-.33-.57 0-.98.15-1.24.46-.26.3-.39.81-.39 1.5v2.8h-.81v-7.6h.81v2.3c0 .28-.01.51-.04.69h.05c.16-.26.38-.46.68-.61.29-.15.63-.22 1.01-.22.65 0 1.14.15 1.47.47.33.31.49.8.49 1.48v3.5h-.81zm6.8-.57c.14 0 .28-.02.41-.04.13-.02.24-.05.31-.07v.62c-.09.04-.22.08-.39.1-.17.03-.33.04-.46.04-1.04 0-1.56-.55-1.56-1.64v-3.19h-.77v-.39l.76-.34.34-1.14h.46v1.24h1.56v.63h-1.56v3.15c0 .32.08.57.23.74.15.17.36.26.63.26zm6.42-2.11c0 .87-.22 1.55-.66 2.04-.44.49-1.05.73-1.82.73-.48 0-.91-.12-1.28-.34-.37-.23-.66-.55-.86-.97-.2-.42-.3-.91-.3-1.48 0-.88.22-1.56.65-2.04.43-.49 1.04-.73 1.81-.73.75 0 1.34.25 1.78.74.44.49.66 1.17.66 2.02zm-4.08 0c0 .68.13 1.2.41 1.56.27.36.67.54 1.2.54.53 0 .93-.18 1.21-.54.27-.36.41-.88.41-1.57 0-.68-.14-1.2-.41-1.55-.28-.36-.69-.53-1.22-.53s-.93.17-1.2.52c-.27.35-.41.86-.41 1.55zm12.29-4.46h.89l-2.57 7.14h-.82l-2.56-7.14h.88l1.64 4.62c.19.53.34 1.04.45 1.55.11-.53.27-1.06.46-1.58l1.63-4.59zm5.04 7.14l-.16-.77h-.04c-.27.33-.54.56-.8.68-.27.12-.6.18-1 .18-.53 0-.95-.14-1.25-.41-.3-.28-.46-.67-.46-1.17 0-1.08.86-1.65 2.59-1.7l.9-.03v-.34c0-.42-.09-.73-.27-.93-.18-.2-.47-.3-.87-.3-.45 0-.95.13-1.51.41l-.25-.62c.26-.15.55-.26.87-.34.31-.08.63-.12.94-.12.64 0 1.11.14 1.42.42.3.28.46.74.46 1.36V399h-.6zm-1.83-.57c.5 0 .9-.14 1.19-.42.29-.28.43-.67.43-1.16v-.49l-.81.03c-.65.02-1.11.12-1.4.3-.29.18-.43.45-.43.83 0 .29.08.51.26.67.17.15.42.23.74.23zm4.86-4.79v3.47c0 .43.1.76.29.97.2.21.51.32.93.32.56 0 .97-.16 1.22-.46.26-.31.39-.81.39-1.5v-2.81h.81V399h-.67l-.12-.718h-.05c-.16.264-.4.466-.69.606-.29.14-.63.21-1.01.21-.65 0-1.14-.155-1.46-.464-.32-.31-.49-.804-.49-1.485v-3.51h.82zm6.19 5.35h-.81v-7.6h.81v7.6zm3.44-.57c.14 0 .28-.02.41-.04.14-.02.24-.05.32-.07v.62c-.09.04-.22.07-.39.1s-.32.04-.46.04c-1.03 0-1.55-.55-1.55-1.64v-3.19h-.77v-.39l.76-.34.34-1.14h.47v1.24h1.55v.63h-1.55v3.15c0 .32.08.57.23.74.15.18.36.26.63.26zm6.72.57h-.83v-6.4h-2.26v-.74h5.35v.74h-2.26v6.4zm7.83-2.68c0 .87-.22 1.55-.66 2.04-.44.49-1.05.73-1.82.73-.48 0-.91-.12-1.28-.34-.37-.23-.66-.55-.86-.97-.2-.42-.3-.92-.3-1.48 0-.88.21-1.56.65-2.04.43-.49 1.04-.73 1.81-.73.75 0 1.34.25 1.79.74.44.49.66 1.17.66 2.02zm-4.08 0c0 .68.13 1.2.41 1.56.27.36.67.53 1.2.53s.93-.18 1.21-.54c.27-.36.41-.88.41-1.57 0-.68-.14-1.2-.41-1.55-.28-.36-.68-.53-1.22-.53-.53 0-.93.17-1.2.52-.27.34-.41.86-.41 1.55zm6.3-.06c.14-.2.35-.46.63-.78l1.73-1.84h.96l-2.17 2.28 2.32 3.07h-.98l-1.89-2.53-.61.52V399h-.8v-7.598h.8v4.03c0 .178-.02.454-.04.83h.04zm6.7 2.83c-.79 0-1.42-.24-1.87-.73-.46-.48-.69-1.15-.69-2.01 0-.87.21-1.55.63-2.06.43-.51 1-.76 1.71-.76.67 0 1.2.22 1.59.66.39.44.58 1.02.58 1.75v.51h-3.69c.02.63.18 1.11.48 1.43.3.33.72.49 1.27.49.57 0 1.14-.12 1.71-.36v.72c-.29.13-.56.21-.82.27-.256.05-.565.08-.926.08zm-.22-4.87c-.43 0-.77.14-1.03.42-.25.28-.4.67-.45 1.16h2.8c0-.51-.11-.9-.34-1.17-.23-.27-.56-.41-.98-.41zm7.23 4.78v-3.47c0-.44-.1-.77-.3-.98-.2-.21-.51-.32-.93-.32-.56 0-.97.15-1.23.46-.26.3-.39.8-.39 1.5v2.8h-.82v-5.35h.66l.13.73h.04c.16-.26.4-.46.7-.61.29-.14.63-.21 1-.21.64 0 1.13.15 1.45.46.32.31.49.8.49 1.49v3.5h-.81z"/>
-    <path stroke="#575757" d="M586 223.5v105m.5-104.5H396"/>
-    <path fill="#575757" d="M586 330l3.5-7h-7"/>
-    <path fill="#FFF" d="M449 213h86v22h-86z"/>
-    <path fill="#000" d="M460.518 225.36h-1.06V227h-.776v-1.64h-3.472v-.71l3.39-4.828h.858v4.8h1.06v.737zm-1.836-.738v-2.373c0-.47.016-1 .048-1.58h-.04c-.155.31-.3.57-.438.77l-2.23 3.17h2.66zm2.778 1.86c0-.218.05-.383.15-.495.098-.112.24-.17.426-.17.19 0 .336.058.442.17.106.112.16.277.16.495 0 .212-.055.375-.162.49-.108.113-.254.17-.44.17-.166 0-.303-.052-.412-.154-.11-.103-.164-.27-.164-.506zm6.328-2.45V227h-.83v-7.14h1.958c.876 0 1.523.17 1.94.504.42.336.628.84.628 1.514 0 .944-.478 1.582-1.435 1.914l1.93 3.208H471l-1.73-2.97h-1.49zm0-.714h1.138c.586 0 1.015-.116 1.29-.35.272-.232.41-.58.41-1.046 0-.472-.14-.812-.418-1.02-.28-.21-.726-.313-1.34-.313h-1.08v2.72zm7.49 3.78c-.79 0-1.415-.24-1.872-.723-.458-.482-.686-1.15-.686-2.007 0-.862.212-1.548.637-2.055.425-.508.995-.762 1.71-.762.672 0 1.203.22 1.593.67.39.44.586 1.03.586 1.75v.52h-3.686c.016.63.175 1.11.476 1.43.3.33.725.49 1.272.49.576 0 1.145-.12 1.71-.36v.73c-.288.13-.56.22-.814.27-.256.06-.564.08-.926.08zm-.22-4.87c-.43 0-.772.14-1.027.42-.25.28-.4.67-.45 1.164h2.8c0-.512-.11-.903-.34-1.175-.23-.272-.55-.408-.97-.408zm5.298 4.2c.144 0 .282-.01.415-.03.14-.022.24-.044.32-.067v.62c-.09.05-.21.08-.39.11-.17.03-.32.04-.46.04-1.03 0-1.55-.54-1.55-1.63v-3.18h-.76v-.39l.77-.34.34-1.14h.47v1.24h1.56v.63h-1.56v3.15c0 .32.08.57.23.74.16.18.37.26.63.26zm2.564-4.78v3.472c0 .436.1.762.298.977.198.215.51.322.932.322.56 0 .97-.16 1.228-.46.26-.31.39-.81.39-1.5v-2.82h.81V227h-.67l-.117-.718h-.04c-.16.264-.39.466-.69.606-.29.14-.63.21-1.01.21-.65 0-1.14-.155-1.46-.464-.32-.31-.48-.804-.48-1.485v-3.51h.82zm7.817-.097c.238 0 .45.02.64.06l-.112.75c-.222-.04-.417-.07-.586-.07-.44 0-.81.18-1.12.53-.31.35-.46.79-.46 1.32V227h-.81v-5.352h.67l.09.992h.04c.19-.35.43-.617.71-.806.28-.19.59-.283.92-.283zm5.303 5.45v-3.46c0-.43-.1-.76-.298-.97-.198-.21-.51-.32-.932-.32-.56 0-.97.15-1.23.46-.26.31-.392.81-.392 1.5v2.8h-.81v-5.35h.66l.13.73h.04c.166-.26.4-.46.698-.61.3-.14.633-.21 1-.21.646 0 1.13.16 1.456.47.326.31.49.81.49 1.49V227h-.812zm7.393 0h-.83v-6.4h-2.26v-.74h5.35v.74h-2.26v6.4zm7.832-2.68c0 .88-.22 1.56-.66 2.05-.44.49-1.046.74-1.82.74-.48 0-.904-.11-1.275-.33-.37-.22-.658-.54-.86-.96-.2-.42-.302-.91-.302-1.47 0-.87.218-1.55.654-2.04.436-.48 1.042-.73 1.816-.73.75 0 1.344.25 1.785.75.44.5.662 1.17.662 2.02zm-4.077 0c0 .69.136 1.21.41 1.57.273.36.675.54 1.206.54.53 0 .933-.18 1.208-.53.275-.35.413-.88.413-1.56s-.138-1.2-.413-1.55c-.275-.35-.68-.53-1.218-.53-.53 0-.93.17-1.2.52-.27.35-.406.87-.406 1.56zm6.298-.06c.14-.19.354-.45.64-.78l1.728-1.83h.962l-2.168 2.28 2.32 3.07h-.982l-1.89-2.53-.61.53v2h-.8v-7.59h.8v4.03c0 .18-.013.46-.04.83h.04zm6.71 2.84c-.792 0-1.416-.24-1.873-.72-.458-.48-.686-1.15-.686-2 0-.86.212-1.55.637-2.05.425-.51.995-.76 1.71-.76.672 0 1.203.22 1.593.67.39.44.586 1.02.586 1.75v.52h-3.686c.016.63.175 1.11.476 1.43.3.33.725.49 1.272.49.576 0 1.145-.12 1.71-.36v.73c-.288.13-.56.21-.814.27-.25.06-.56.08-.92.08zm-.22-4.87c-.43 0-.773.14-1.028.42-.256.28-.406.67-.452 1.17h2.798c0-.51-.114-.9-.342-1.17-.228-.27-.553-.41-.976-.41zm7.23 4.77v-3.46c0-.43-.098-.76-.297-.97-.2-.21-.51-.32-.94-.32-.56 0-.97.15-1.23.46-.26.31-.39.81-.39 1.5v2.8h-.81v-5.35h.66l.13.73h.04c.16-.26.4-.46.7-.61.3-.14.63-.21 1-.21.64 0 1.13.16 1.45.47.32.31.49.81.49 1.49V227h-.81z"/>
-    <path fill="#FFF" d="M380 384h125v22H380z"/>
-    <path fill="#000" d="M390.49 399h-.79v-5.088c0-.423.013-.823.04-1.2-.07.067-.146.14-.23.214-.085.075-.472.392-1.162.952l-.43-.557 1.89-1.46h.683V399zm2.97-.518c0-.218.05-.383.15-.495.098-.112.24-.17.426-.17.19 0 .336.058.442.17.106.112.16.277.16.495 0 .212-.055.375-.162.49-.108.113-.254.17-.44.17-.166 0-.303-.052-.412-.154-.11-.103-.164-.27-.164-.506zm9.985.518l-.888-2.27h-2.862l-.88 2.27h-.838l2.822-7.168h.69L404.3 399h-.86zm-1.147-3.018l-.83-2.21c-.108-.28-.218-.625-.332-1.032-.072.313-.174.656-.308 1.03l-.84 2.212h2.31zm3.628-2.334v3.472c0 .436.1.762.298.977.198.215.51.322.932.322.56 0 .97-.16 1.228-.46.26-.31.388-.81.388-1.5v-2.82h.81V399h-.668l-.117-.718h-.044c-.166.264-.396.466-.69.606-.296.14-.632.21-1.01.21-.65 0-1.138-.155-1.462-.464-.32-.31-.48-.804-.48-1.485v-3.51h.82zm7.104 4.78c.144 0 .282-.01.415-.03.134-.022.24-.044.318-.067v.62c-.088.05-.218.08-.388.11s-.325.04-.462.04c-1.035 0-1.553-.54-1.553-1.63v-3.18h-.766v-.39l.766-.34.342-1.14h.47v1.24h1.552v.63h-1.553v3.15c0 .32.08.57.23.74.16.18.37.26.63.26zm5.464.572v-3.462c0-.436-.1-.762-.298-.976-.198-.215-.51-.323-.932-.323-.563 0-.974.15-1.233.45-.25.3-.38.81-.38 1.5v2.8h-.81v-7.6h.81v2.3c0 .28-.01.5-.04.69h.05c.16-.26.39-.46.68-.61.3-.15.63-.22 1.01-.22.66 0 1.15.15 1.47.46.33.31.49.8.49 1.48v3.5h-.81zm9.443 0l-.98-3.14c-.063-.192-.178-.628-.348-1.308h-.04c-.13.57-.25 1.01-.34 1.318l-1.02 3.13h-.94l-1.46-5.352h.85l.78 3.072c.18.703.28 1.176.31 1.42h.04c.03-.185.09-.425.17-.72.08-.294.15-.528.21-.7l.98-3.072h.88l.95 3.072c.18.56.3 1.03.37 1.41h.04c.01-.116.05-.297.1-.54.06-.245.39-1.56 1.02-3.942h.84L428.9 399h-.962zm4.22 0h-.81v-5.352h.81V399zm-.88-6.802c0-.185.046-.32.137-.407.09-.08.205-.13.342-.13.13 0 .242.05.337.14.094.09.14.23.14.41 0 .19-.046.32-.14.41-.095.09-.207.14-.337.14-.137 0-.25-.04-.342-.13-.09-.09-.137-.22-.137-.4zm4.327 6.23c.143 0 .28-.01.415-.03.13-.022.23-.044.31-.067v.62c-.09.05-.22.08-.39.11s-.33.04-.46.04c-1.04 0-1.55-.54-1.55-1.63v-3.18h-.77v-.39l.76-.34.34-1.14h.47v1.24h1.55v.63h-1.56v3.15c0 .32.08.57.23.74.15.18.36.26.63.26zm5.463.572v-3.462c0-.436-.1-.762-.297-.976-.2-.215-.51-.323-.933-.323-.563 0-.974.15-1.233.45-.26.3-.388.81-.388 1.5v2.8h-.81v-7.6h.81v2.3c0 .28-.013.5-.04.69h.05c.16-.26.386-.46.68-.61.295-.15.63-.22 1.01-.22.653 0 1.144.15 1.47.46.328.31.492.8.492 1.48v3.5h-.81zm5.196 0v-7.14h.83v6.388h3.15V399h-3.98zm10.888-3.638c0 1.18-.31 2.08-.95 2.703-.64.623-1.56.935-2.76.935h-1.98v-7.14h2.19c1.11 0 1.97.31 2.59.924.62.615.92 1.475.92 2.578zm-.87.03c0-.93-.23-1.633-.7-2.105-.46-.472-1.16-.708-2.08-.708h-1.2v5.7h1.01c.99 0 1.74-.25 2.23-.73.5-.49.75-1.21.75-2.16zm6.95 3.608l-.88-2.27h-2.86l-.87 2.27h-.84l2.82-7.168h.7l2.8 7.168h-.86zm-1.14-3.018l-.83-2.21c-.1-.28-.22-.625-.33-1.032-.07.313-.17.656-.3 1.03l-.84 2.212h2.31zm7.52-2.04c0 .722-.24 1.278-.74 1.667-.49.38-1.2.58-2.11.58h-.84V399h-.83v-7.14h1.86c1.79 0 2.68.695 2.68 2.08zm-3.69 1.537h.75c.74 0 1.27-.12 1.6-.36.33-.24.5-.62.5-1.15 0-.48-.15-.83-.46-1.06-.31-.23-.79-.35-1.44-.35h-.93v2.9zm10.85-2.98c-.78 0-1.4.26-1.86.78-.45.52-.68 1.23-.68 2.14 0 .93.22 1.65.66 2.16.44.51 1.06.76 1.87.76.5 0 1.07-.09 1.71-.27v.73c-.49.18-1.1.27-1.83.27-1.05 0-1.86-.32-2.43-.96-.57-.64-.85-1.55-.85-2.72 0-.74.14-1.38.42-1.94.27-.55.67-.98 1.19-1.28.52-.3 1.13-.45 1.83-.45.75 0 1.41.13 1.97.41l-.35.71c-.54-.26-1.08-.38-1.62-.38zm5.57 1.05c.24 0 .45.02.64.06l-.11.75c-.22-.05-.42-.08-.58-.08-.43 0-.8.17-1.11.52-.31.35-.46.79-.46 1.31V399h-.81v-5.352h.67l.09.992h.04c.2-.35.44-.617.72-.806.28-.19.59-.283.93-.283zm3.91 5.54c-.79 0-1.41-.24-1.87-.73-.45-.48-.68-1.15-.68-2.01 0-.86.22-1.55.64-2.06.43-.51 1-.76 1.72-.76.67 0 1.2.22 1.59.66.39.44.59 1.02.59 1.74v.51h-3.69c.02.63.18 1.1.48 1.43.3.32.73.49 1.27.49.58 0 1.15-.12 1.71-.37v.72c-.29.12-.56.21-.81.27-.25.05-.56.08-.92.08zm-.22-4.87c-.43 0-.77.14-1.03.42-.25.28-.4.67-.45 1.16h2.8c0-.51-.11-.91-.34-1.18-.23-.27-.55-.41-.97-.41zm7.21 4.05h-.04c-.37.54-.93.81-1.68.81-.7 0-1.24-.24-1.63-.72-.39-.48-.58-1.16-.58-2.04 0-.89.2-1.57.59-2.06.39-.49.94-.73 1.63-.73.73 0 1.29.26 1.67.79h.07l-.03-.39-.02-.38v-2.18h.81v7.6h-.66l-.1-.72zm-1.62.13c.56 0 .96-.15 1.21-.46.25-.3.37-.79.37-1.46v-.17c0-.76-.12-1.3-.37-1.63-.25-.33-.66-.49-1.21-.49-.47 0-.84.18-1.09.55-.25.37-.38.89-.38 1.56 0 .68.13 1.2.38 1.54.25.35.62.52 1.11.52zm7.56-.88c0 .5-.18.88-.55 1.15-.37.27-.89.4-1.56.4-.71 0-1.26-.12-1.66-.34V398c.26.13.53.23.83.305.3.074.58.112.85.112.43 0 .75-.07.98-.205.23-.134.34-.34.34-.617 0-.21-.09-.387-.27-.535-.18-.148-.53-.323-1.06-.525-.5-.186-.85-.35-1.06-.486-.21-.14-.36-.3-.47-.47-.1-.18-.15-.39-.15-.63 0-.44.18-.79.54-1.04.36-.26.84-.38 1.46-.38.58 0 1.14.11 1.69.35l-.29.66c-.53-.22-1.02-.34-1.46-.34-.38 0-.67.06-.87.18-.19.12-.29.28-.29.49 0 .14.04.26.11.36.07.1.19.19.36.29.17.09.48.22.94.39.64.23 1.07.46 1.29.7.22.23.33.53.33.88z"/>
-    <path fill="#575757" d="M130 396l7-3.5v7"/>
-    <path stroke="#575757" d="M334.5 78.5v78m-.5-78h201.5"/>
-    <path fill="#575757" d="M537 78.5l-7 3.5v-7"/>
-    <path fill="#FFF" d="M372 67h125v22H372z"/>
-    <path fill="#000" d="M384.18 82h-4.692v-.698l1.88-1.89c.573-.58.95-.993 1.133-1.24.19-.248.32-.488.41-.723.1-.24.14-.49.14-.76 0-.38-.11-.68-.34-.91-.23-.23-.55-.34-.96-.34-.29 0-.58.05-.84.14-.26.09-.56.27-.88.53l-.43-.55c.66-.55 1.38-.82 2.15-.82.67 0 1.2.17 1.58.51.38.34.57.8.57 1.38 0 .45-.12.9-.38 1.34-.25.44-.73 1-1.42 1.68l-1.56 1.53v.03h3.67V82zm1.28-.518c0-.218.05-.383.15-.495.098-.112.24-.17.426-.17.19 0 .336.058.442.17.106.112.16.277.16.495 0 .212-.055.375-.162.49-.108.113-.254.17-.44.17-.166 0-.303-.052-.412-.154-.11-.103-.164-.27-.164-.506zm9.575-6.62h.894L393.35 82h-.82l-2.558-7.14h.878l1.64 4.62c.19.53.34 1.047.45 1.548.118-.527.27-1.053.46-1.577l1.63-4.59zm4.014 7.236c-.8 0-1.42-.24-1.88-.723-.46-.482-.69-1.15-.69-2.007 0-.862.21-1.548.63-2.055.42-.508.99-.762 1.71-.762.67 0 1.2.22 1.59.67.39.44.58 1.03.58 1.75v.52h-3.69c.01.63.17 1.11.47 1.43.3.33.72.49 1.27.49.57 0 1.14-.12 1.71-.36v.73c-.29.13-.56.22-.82.27-.26.06-.57.08-.93.08zm-.22-4.87c-.43 0-.78.14-1.03.42-.26.28-.41.67-.45 1.164h2.79c0-.512-.12-.903-.34-1.175-.23-.272-.56-.408-.98-.408zm6.01-.677c.23 0 .45.02.64.06l-.12.75c-.22-.04-.42-.07-.59-.07-.44 0-.81.18-1.11.53-.31.35-.46.79-.46 1.32V82h-.82v-5.352h.67l.09.992h.04c.19-.35.43-.617.71-.806.28-.19.59-.283.92-.283zm2.45 5.45h-.81v-5.35h.81V82zm-.88-6.8c0-.18.04-.32.13-.4.09-.08.2-.13.34-.13.13 0 .24.05.34.14.09.09.14.23.14.41 0 .19-.05.32-.14.41-.1.09-.21.14-.34.14-.14 0-.25-.04-.34-.13-.1-.09-.14-.22-.14-.41zm5.01 2.08h-1.36V82h-.81v-4.722h-.96v-.366l.95-.293v-.3c0-1.32.57-1.97 1.72-1.97.28 0 .61.05.99.17l-.21.65c-.32-.11-.58-.16-.8-.16-.31 0-.53.1-.68.3-.15.2-.22.53-.22.98v.34h1.36v.63zm.12-.63h.87l1.17 3.05c.25.7.41 1.2.48 1.51h.04c.04-.16.13-.45.26-.85.13-.4.57-1.64 1.32-3.71h.87l-2.3 6.1c-.23.6-.49 1.03-.8 1.28-.31.25-.68.38-1.12.38-.25 0-.49-.02-.74-.08v-.65c.18.04.38.06.6.06.56 0 .96-.31 1.19-.94l.29-.76-2.16-5.38zm11.66-1.14c-.79 0-1.41.26-1.86.79-.46.52-.68 1.24-.68 2.15 0 .94.21 1.66.65 2.17.43.51 1.06.77 1.87.77.5 0 1.06-.09 1.7-.27v.73c-.5.19-1.11.28-1.83.28-1.06 0-1.87-.32-2.44-.95-.57-.64-.86-1.54-.86-2.72 0-.74.13-1.38.41-1.93.27-.55.67-.98 1.19-1.28.52-.3 1.13-.45 1.83-.45.75 0 1.41.14 1.97.41l-.35.71c-.54-.25-1.08-.38-1.62-.38zm5.57 1.05c.24 0 .45.02.64.06l-.11.75c-.23-.05-.42-.07-.59-.07-.44 0-.81.18-1.11.53-.31.36-.47.79-.47 1.32V82h-.81v-5.352h.67l.09.992h.04c.2-.35.44-.617.72-.806.28-.19.59-.283.92-.283zm3.9 5.55c-.79 0-1.42-.24-1.88-.72-.46-.48-.69-1.15-.69-2 0-.86.21-1.54.63-2.05.42-.51.99-.76 1.71-.76.67 0 1.2.22 1.59.66.39.44.58 1.02.58 1.75v.52h-3.69c.01.63.17 1.1.47 1.43.3.32.73.49 1.27.49.58 0 1.15-.12 1.71-.36v.73c-.29.13-.56.22-.81.27-.25.06-.56.08-.92.08zm-.22-4.87c-.43 0-.77.14-1.03.42-.26.28-.41.67-.46 1.17h2.79c0-.51-.11-.9-.34-1.17-.23-.27-.56-.41-.98-.41zm7.21 4.06h-.05c-.38.55-.93.82-1.68.82-.7 0-1.24-.24-1.63-.71-.39-.48-.59-1.16-.59-2.04 0-.88.19-1.57.58-2.05.39-.49.93-.73 1.63-.73.73 0 1.28.27 1.67.79h.06l-.04-.38-.02-.37v-2.18h.81V82h-.66l-.11-.718zm-1.63.14c.55 0 .95-.15 1.2-.45.25-.3.37-.78.37-1.45v-.17c0-.76-.13-1.3-.38-1.62-.25-.32-.66-.48-1.21-.48-.48 0-.84.19-1.09.56-.26.37-.38.89-.38 1.57s.12 1.2.37 1.55c.25.35.62.52 1.1.52zm7.56-.88c0 .5-.19.89-.56 1.16-.38.27-.9.41-1.57.41-.71 0-1.27-.11-1.66-.33v-.75c.25.13.53.23.83.31.29.08.58.11.85.11.42 0 .74-.07.97-.2.22-.13.34-.34.34-.62 0-.21-.09-.38-.27-.53-.18-.15-.54-.32-1.06-.52-.5-.18-.85-.35-1.06-.48-.21-.14-.36-.29-.47-.47-.1-.18-.15-.39-.15-.63 0-.44.18-.78.53-1.03.35-.25.84-.38 1.46-.38.58 0 1.14.12 1.69.35l-.29.66c-.54-.22-1.03-.33-1.46-.33-.39 0-.68.06-.87.18-.2.12-.29.29-.29.5 0 .148.03.27.11.37.07.1.19.2.35.29.16.09.47.22.93.398.63.23 1.06.465 1.29.7.22.234.33.53.33.883zM453.9 82l-.98-3.14c-.064-.19-.18-.627-.35-1.307h-.04c-.13.57-.242 1.01-.34 1.318L451.18 82h-.94l-1.46-5.35h.85l.79 3.07c.18.704.284 1.177.31 1.42h.04c.035-.184.093-.424.173-.72.08-.293.15-.527.207-.7l.982-3.07h.88l.956 3.07c.183.56.307 1.03.372 1.41h.04c.012-.115.047-.296.104-.54.057-.244.396-1.56 1.018-3.94h.84L454.864 82h-.962zm4.22 0h-.81v-5.35h.81V82zm-.88-6.8c0-.186.045-.32.136-.408.09-.086.204-.13.34-.13.13 0 .243.045.338.133.094.088.14.223.14.405 0 .183-.046.318-.14.408-.095.09-.207.134-.337.134-.136 0-.25-.045-.34-.134-.092-.09-.138-.225-.138-.408zm4.325 6.23c.144 0 .282-.01.415-.03.134-.023.24-.045.318-.068v.62c-.087.043-.217.078-.387.106-.17.028-.32.042-.46.042-1.03 0-1.55-.546-1.55-1.636V77.28h-.76v-.39l.77-.337.34-1.142h.47v1.24h1.55v.63h-1.55v3.15c0 .33.08.57.23.75.16.17.37.26.63.26zm5.464.57v-3.46c0-.437-.1-.763-.3-.977-.2-.215-.51-.323-.93-.323-.57 0-.98.152-1.24.458-.26.306-.39.808-.39 1.504V82h-.81v-7.598h.81v2.3c0 .277-.01.506-.04.69h.05c.16-.26.38-.46.68-.61.29-.147.63-.22 1.01-.22.65 0 1.14.154 1.47.465.32.31.49.805.49 1.482V82h-.81zm9.68 0l-.89-2.27h-2.86l-.88 2.27h-.84l2.82-7.167h.7L477.57 82h-.86zm-1.15-3.017l-.83-2.21c-.11-.28-.22-.625-.33-1.032-.07.32-.18.66-.31 1.03l-.84 2.22h2.31zm3.63-2.334v3.47c0 .43.1.76.3.97.2.21.51.32.93.32.56 0 .97-.16 1.23-.46.26-.31.39-.81.39-1.5v-2.81h.81V82h-.67l-.12-.718h-.05c-.17.264-.4.466-.69.606-.3.14-.63.21-1.01.21-.65 0-1.14-.155-1.46-.464-.33-.31-.49-.804-.49-1.485v-3.51h.82zm7.1 4.78c.14 0 .28-.01.41-.03.13-.03.24-.05.32-.07v.62c-.09.04-.22.08-.39.1-.17.03-.33.04-.46.04-1.04 0-1.56-.55-1.56-1.64v-3.18h-.77v-.39l.76-.34.34-1.15h.47v1.24h1.55v.63h-1.55v3.15c0 .32.07.57.23.74.15.17.36.26.63.26zm5.46.57v-3.46c0-.44-.1-.77-.3-.98-.2-.22-.51-.33-.94-.33-.57 0-.98.15-1.24.45-.26.3-.39.81-.39 1.5V82h-.81v-7.598h.81v2.3c0 .277-.02.506-.04.69h.05c.16-.26.38-.46.68-.61.29-.147.63-.22 1.01-.22.65 0 1.14.154 1.47.465.33.31.49.805.49 1.482V82h-.81z"/>
-  </g>
-</svg>
diff --git a/website/public/img/vault-auto-unseal.png b/website/public/img/vault-auto-unseal.png
deleted file mode 100644
index 0f3bb4f46b1..00000000000
Binary files a/website/public/img/vault-auto-unseal.png and /dev/null differ
diff --git a/website/public/img/vault-autounseal-2.png b/website/public/img/vault-autounseal-2.png
deleted file mode 100644
index f9eb1e6ec5f..00000000000
Binary files a/website/public/img/vault-autounseal-2.png and /dev/null differ
diff --git a/website/public/img/vault-autounseal-3.png b/website/public/img/vault-autounseal-3.png
deleted file mode 100644
index c8fc2e44b0d..00000000000
Binary files a/website/public/img/vault-autounseal-3.png and /dev/null differ
diff --git a/website/public/img/vault-autounseal-4.png b/website/public/img/vault-autounseal-4.png
deleted file mode 100644
index db58cbfc56b..00000000000
Binary files a/website/public/img/vault-autounseal-4.png and /dev/null differ
diff --git a/website/public/img/vault-autounseal-storage.png b/website/public/img/vault-autounseal-storage.png
deleted file mode 100644
index 9cbd530c1ff..00000000000
Binary files a/website/public/img/vault-autounseal-storage.png and /dev/null differ
diff --git a/website/public/img/vault-autounseal.png b/website/public/img/vault-autounseal.png
deleted file mode 100644
index 4a649af630c..00000000000
Binary files a/website/public/img/vault-autounseal.png and /dev/null differ
diff --git a/website/public/img/vault-aws-ec2-auth-flow.png b/website/public/img/vault-aws-ec2-auth-flow.png
deleted file mode 100644
index a98fb916ed6..00000000000
Binary files a/website/public/img/vault-aws-ec2-auth-flow.png and /dev/null differ
diff --git a/website/public/img/vault-csi-workflow.png b/website/public/img/vault-csi-workflow.png
deleted file mode 100644
index 749a406a998..00000000000
Binary files a/website/public/img/vault-csi-workflow.png and /dev/null differ
diff --git a/website/public/img/vault-ctrl-grp-1.png b/website/public/img/vault-ctrl-grp-1.png
deleted file mode 100644
index d4173ed4c6b..00000000000
Binary files a/website/public/img/vault-ctrl-grp-1.png and /dev/null differ
diff --git a/website/public/img/vault-ctrl-grp-2.png b/website/public/img/vault-ctrl-grp-2.png
deleted file mode 100644
index 883ba16a83a..00000000000
Binary files a/website/public/img/vault-ctrl-grp-2.png and /dev/null differ
diff --git a/website/public/img/vault-ctrl-grp-3.png b/website/public/img/vault-ctrl-grp-3.png
deleted file mode 100644
index 2d61b698bce..00000000000
Binary files a/website/public/img/vault-ctrl-grp-3.png and /dev/null differ
diff --git a/website/public/img/vault-ctrl-grp-4.png b/website/public/img/vault-ctrl-grp-4.png
deleted file mode 100644
index 0bcde5953e0..00000000000
Binary files a/website/public/img/vault-ctrl-grp-4.png and /dev/null differ
diff --git a/website/public/img/vault-ctrl-grp-5.png b/website/public/img/vault-ctrl-grp-5.png
deleted file mode 100644
index 052de99c3f7..00000000000
Binary files a/website/public/img/vault-ctrl-grp-5.png and /dev/null differ
diff --git a/website/public/img/vault-ctrl-grp-6.png b/website/public/img/vault-ctrl-grp-6.png
deleted file mode 100644
index 76c0ddccff7..00000000000
Binary files a/website/public/img/vault-ctrl-grp-6.png and /dev/null differ
diff --git a/website/public/img/vault-ctrl-grp-7.png b/website/public/img/vault-ctrl-grp-7.png
deleted file mode 100644
index d85b2992bac..00000000000
Binary files a/website/public/img/vault-ctrl-grp-7.png and /dev/null differ
diff --git a/website/public/img/vault-cubbyhole.png b/website/public/img/vault-cubbyhole.png
deleted file mode 100644
index fd216659d15..00000000000
Binary files a/website/public/img/vault-cubbyhole.png and /dev/null differ
diff --git a/website/public/img/vault-db-root-rotation.png b/website/public/img/vault-db-root-rotation.png
deleted file mode 100644
index a5783823484..00000000000
Binary files a/website/public/img/vault-db-root-rotation.png and /dev/null differ
diff --git a/website/public/img/vault-dr-0.png b/website/public/img/vault-dr-0.png
deleted file mode 100644
index c3d6d3aa923..00000000000
Binary files a/website/public/img/vault-dr-0.png and /dev/null differ
diff --git a/website/public/img/vault-dr-1.png b/website/public/img/vault-dr-1.png
deleted file mode 100644
index 6c1308572f7..00000000000
Binary files a/website/public/img/vault-dr-1.png and /dev/null differ
diff --git a/website/public/img/vault-dr-10.png b/website/public/img/vault-dr-10.png
deleted file mode 100644
index 598a057197e..00000000000
Binary files a/website/public/img/vault-dr-10.png and /dev/null differ
diff --git a/website/public/img/vault-dr-11.png b/website/public/img/vault-dr-11.png
deleted file mode 100644
index 10684057493..00000000000
Binary files a/website/public/img/vault-dr-11.png and /dev/null differ
diff --git a/website/public/img/vault-dr-12.png b/website/public/img/vault-dr-12.png
deleted file mode 100644
index bd338e07a12..00000000000
Binary files a/website/public/img/vault-dr-12.png and /dev/null differ
diff --git a/website/public/img/vault-dr-13.png b/website/public/img/vault-dr-13.png
deleted file mode 100644
index faeeb31d057..00000000000
Binary files a/website/public/img/vault-dr-13.png and /dev/null differ
diff --git a/website/public/img/vault-dr-2.png b/website/public/img/vault-dr-2.png
deleted file mode 100644
index f52ef772ece..00000000000
Binary files a/website/public/img/vault-dr-2.png and /dev/null differ
diff --git a/website/public/img/vault-dr-3.png b/website/public/img/vault-dr-3.png
deleted file mode 100644
index e9004301f87..00000000000
Binary files a/website/public/img/vault-dr-3.png and /dev/null differ
diff --git a/website/public/img/vault-dr-4.png b/website/public/img/vault-dr-4.png
deleted file mode 100644
index 4af7eedc8e7..00000000000
Binary files a/website/public/img/vault-dr-4.png and /dev/null differ
diff --git a/website/public/img/vault-dr-5.2.png b/website/public/img/vault-dr-5.2.png
deleted file mode 100644
index 497dcd2a1a3..00000000000
Binary files a/website/public/img/vault-dr-5.2.png and /dev/null differ
diff --git a/website/public/img/vault-dr-5.png b/website/public/img/vault-dr-5.png
deleted file mode 100644
index 33fb21681a9..00000000000
Binary files a/website/public/img/vault-dr-5.png and /dev/null differ
diff --git a/website/public/img/vault-dr-6.png b/website/public/img/vault-dr-6.png
deleted file mode 100644
index 8d83a06a648..00000000000
Binary files a/website/public/img/vault-dr-6.png and /dev/null differ
diff --git a/website/public/img/vault-dr-7.png b/website/public/img/vault-dr-7.png
deleted file mode 100644
index 962b42977c4..00000000000
Binary files a/website/public/img/vault-dr-7.png and /dev/null differ
diff --git a/website/public/img/vault-dr-8.png b/website/public/img/vault-dr-8.png
deleted file mode 100644
index f474f0c99df..00000000000
Binary files a/website/public/img/vault-dr-8.png and /dev/null differ
diff --git a/website/public/img/vault-dr-9-1.png b/website/public/img/vault-dr-9-1.png
deleted file mode 100644
index 37868892f22..00000000000
Binary files a/website/public/img/vault-dr-9-1.png and /dev/null differ
diff --git a/website/public/img/vault-dr-9.png b/website/public/img/vault-dr-9.png
deleted file mode 100644
index 3f3ed36ad0d..00000000000
Binary files a/website/public/img/vault-dr-9.png and /dev/null differ
diff --git a/website/public/img/vault-dynamic-secrets.png b/website/public/img/vault-dynamic-secrets.png
deleted file mode 100644
index 2e064fca194..00000000000
Binary files a/website/public/img/vault-dynamic-secrets.png and /dev/null differ
diff --git a/website/public/img/vault-eaas.png b/website/public/img/vault-eaas.png
deleted file mode 100644
index 74b2e6f93f3..00000000000
Binary files a/website/public/img/vault-eaas.png and /dev/null differ
diff --git a/website/public/img/vault-encryption.png b/website/public/img/vault-encryption.png
deleted file mode 100644
index fa91ece6260..00000000000
Binary files a/website/public/img/vault-encryption.png and /dev/null differ
diff --git a/website/public/img/vault-entity-1.png b/website/public/img/vault-entity-1.png
deleted file mode 100644
index 93118f26b94..00000000000
Binary files a/website/public/img/vault-entity-1.png and /dev/null differ
diff --git a/website/public/img/vault-entity-10.png b/website/public/img/vault-entity-10.png
deleted file mode 100644
index 82f159b2514..00000000000
Binary files a/website/public/img/vault-entity-10.png and /dev/null differ
diff --git a/website/public/img/vault-entity-2.png b/website/public/img/vault-entity-2.png
deleted file mode 100644
index 34094636943..00000000000
Binary files a/website/public/img/vault-entity-2.png and /dev/null differ
diff --git a/website/public/img/vault-entity-3.png b/website/public/img/vault-entity-3.png
deleted file mode 100644
index ed678b28d91..00000000000
Binary files a/website/public/img/vault-entity-3.png and /dev/null differ
diff --git a/website/public/img/vault-entity-4.png b/website/public/img/vault-entity-4.png
deleted file mode 100644
index 6548e10e68a..00000000000
Binary files a/website/public/img/vault-entity-4.png and /dev/null differ
diff --git a/website/public/img/vault-entity-5.png b/website/public/img/vault-entity-5.png
deleted file mode 100644
index 1a0d0ec9c48..00000000000
Binary files a/website/public/img/vault-entity-5.png and /dev/null differ
diff --git a/website/public/img/vault-entity-6.png b/website/public/img/vault-entity-6.png
deleted file mode 100644
index 3d4f03360bd..00000000000
Binary files a/website/public/img/vault-entity-6.png and /dev/null differ
diff --git a/website/public/img/vault-entity-7.png b/website/public/img/vault-entity-7.png
deleted file mode 100644
index 9672850e816..00000000000
Binary files a/website/public/img/vault-entity-7.png and /dev/null differ
diff --git a/website/public/img/vault-entity-9.png b/website/public/img/vault-entity-9.png
deleted file mode 100644
index a4f306c5d0a..00000000000
Binary files a/website/public/img/vault-entity-9.png and /dev/null differ
diff --git a/website/public/img/vault-gcp-gce-auth-workflow.svg b/website/public/img/vault-gcp-gce-auth-workflow.svg
deleted file mode 100644
index e994e3cecfb..00000000000
--- a/website/public/img/vault-gcp-gce-auth-workflow.svg
+++ /dev/null
@@ -1,38 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1183 790">
-  <defs>
-    <rect id="b" width="150" height="150" rx="2"/>
-    <filter id="a" width="112.7%" height="112.7%" x="-6.3%" y="-5.7%" filterUnits="objectBoundingBox">
-      <feOffset dy="1" in="SourceAlpha" result="shadowOffsetOuter1"/>
-      <feGaussianBlur in="shadowOffsetOuter1" result="shadowBlurOuter1" stdDeviation="3"/>
-      <feColorMatrix in="shadowBlurOuter1" values="0 0 0 0 0.37254902 0 0 0 0 0.388235294 0 0 0 0 0.407843137 0 0 0 0.5 0"/>
-    </filter>
-  </defs>
-  <g fill="none" fill-rule="evenodd">
-    <path fill="#3C4043" d="M53.592 216h-3.375v-25.594h3.375V216zm8.736-19.02l.106 2.391c1.453-1.828 3.351-2.742 5.695-2.742 4.02 0 6.047 2.267 6.082 6.803V216h-3.252v-12.586c-.012-1.371-.325-2.385-.94-3.041-.616-.656-1.574-.984-2.874-.984-1.055 0-1.98.28-2.778.843a5.73 5.73 0 0 0-1.863 2.215V216h-3.252v-19.02h3.076zm27.861 13.975c0-.879-.33-1.561-.993-2.048-.662-.486-1.816-.905-3.463-1.257-1.646-.351-2.953-.773-3.92-1.265-.966-.492-1.681-1.078-2.144-1.758-.463-.68-.694-1.488-.694-2.426 0-1.558.659-2.877 1.977-3.955 1.319-1.078 3.003-1.617 5.054-1.617 2.156 0 3.905.557 5.247 1.67s2.013 2.537 2.013 4.271h-3.27c0-.89-.378-1.658-1.134-2.302-.756-.645-1.708-.967-2.856-.967-1.184 0-2.11.258-2.777.773-.668.516-1.002 1.19-1.002 2.022 0 .785.31 1.377.931 1.775.621.399 1.743.78 3.366 1.143s2.939.797 3.947 1.3c1.008.504 1.755 1.11 2.24 1.82.487.709.73 1.573.73 2.593 0 1.699-.68 3.061-2.039 4.086-1.359 1.026-3.123 1.539-5.29 1.539-1.524 0-2.872-.27-4.044-.809-1.172-.54-2.089-1.292-2.75-2.259-.663-.967-.994-2.013-.994-3.138h3.252c.059 1.09.495 1.955 1.31 2.593.814.639 1.89.958 3.225.958 1.23 0 2.218-.249 2.962-.747.744-.498 1.116-1.163 1.116-1.995zm11.9-18.58v4.605h3.552v2.514h-3.551v11.795c0 .762.158 1.333.474 1.714.317.38.856.571 1.618.571.375 0 .89-.07 1.547-.21V216a9.428 9.428 0 0 1-2.497.352c-1.453 0-2.548-.44-3.287-1.319-.738-.879-1.107-2.127-1.107-3.744v-11.795h-3.463v-2.514h3.463v-4.605h3.252zM121.18 216c-.187-.375-.34-1.043-.456-2.004-1.512 1.57-3.317 2.356-5.414 2.356-1.875 0-3.413-.53-4.615-1.591-1.2-1.06-1.801-2.406-1.801-4.034 0-1.98.752-3.519 2.258-4.615 1.506-1.095 3.624-1.643 6.355-1.643h3.164v-1.494c0-1.137-.34-2.042-1.02-2.716-.68-.674-1.681-1.011-3.005-1.011-1.16 0-2.133.293-2.918.879-.786.586-1.178 1.295-1.178 2.127h-3.27c0-.95.337-1.866 1.011-2.751.674-.885 1.588-1.585 2.742-2.1 1.155-.516 2.423-.774 3.806-.774 2.191 0 3.908.548 5.15 1.643 1.242 1.096 1.887 2.605 1.934 4.527v8.754c0 1.746.223 3.134.668 4.166V216h-3.41zm-5.396-2.479c1.02 0 1.987-.263 2.9-.79.915-.528 1.577-1.213 1.987-2.057v-3.903h-2.549c-3.984 0-5.976 1.166-5.976 3.499 0 1.02.34 1.816 1.02 2.39.679.574 1.552.861 2.618.861zm16.313-16.54l.105 2.39c1.453-1.828 3.352-2.742 5.695-2.742 4.02 0 6.047 2.267 6.083 6.803V216h-3.252v-12.586c-.012-1.371-.326-2.385-.94-3.041-.616-.656-1.574-.984-2.875-.984-1.055 0-1.98.28-2.777.843a5.73 5.73 0 0 0-1.864 2.215V216h-3.251v-19.02h3.076zm24.416 16.716c1.16 0 2.174-.351 3.04-1.054.868-.704 1.348-1.582 1.442-2.637h3.076c-.058 1.09-.433 2.127-1.125 3.111-.691.985-1.614 1.77-2.768 2.356a7.988 7.988 0 0 1-3.665.879c-2.59 0-4.65-.865-6.179-2.593-1.53-1.729-2.294-4.093-2.294-7.093v-.545c0-1.851.34-3.498 1.02-4.94.68-1.44 1.655-2.56 2.926-3.357 1.272-.797 2.775-1.195 4.51-1.195 2.132 0 3.904.639 5.317 1.916 1.412 1.277 2.165 2.935 2.258 4.975h-3.076c-.094-1.23-.56-2.242-1.397-3.033-.838-.79-1.872-1.186-3.103-1.186-1.652 0-2.932.595-3.84 1.784-.909 1.19-1.363 2.91-1.363 5.16v.614c0 2.192.451 3.88 1.354 5.063.902 1.183 2.19 1.775 3.867 1.775zm19.107 2.655c-2.578 0-4.676-.847-6.293-2.54-1.617-1.694-2.426-3.958-2.426-6.794v-.598c0-1.887.36-3.571 1.081-5.054.721-1.482 1.729-2.642 3.024-3.48 1.295-.838 2.698-1.257 4.21-1.257 2.473 0 4.394.814 5.765 2.443 1.372 1.63 2.057 3.961 2.057 6.996v1.354h-12.885c.047 1.875.595 3.39 1.644 4.544 1.049 1.154 2.382 1.731 3.999 1.731 1.148 0 2.121-.234 2.918-.703a7.332 7.332 0 0 0 2.092-1.863l1.986 1.547c-1.594 2.449-3.984 3.674-7.172 3.674zm-.404-17.051c-1.313 0-2.414.477-3.305 1.432-.89.955-1.441 2.294-1.652 4.017h9.527v-.246c-.094-1.652-.539-2.933-1.336-3.84-.797-.91-1.875-1.363-3.234-1.363z"/>
-    <g fill-rule="nonzero">
-      <path fill="#4285F4" d="M1119.539 72.397L1085.53 13.25a14.948 14.948 0 0 0-12.75-7.603h-68.03A14.935 14.935 0 0 0 992 13.25l-34.022 58.991a14.845 14.845 0 0 0 0 14.793l34.01 59.483a15.22 15.22 0 0 0 12.75 7.875h68.03a15.168 15.168 0 0 0 12.762-7.836l34.009-59.147a15.168 15.168 0 0 0 0-15.012z"/>
-      <path fill="#000" d="M1071.086 55.224l-50.43-1.086-3.88 44.612 2.935 10.086 45.517 45.517h7.54a15.168 15.168 0 0 0 12.762-7.836l28.06-48.789-42.504-42.504z" opacity=".07"/>
-      <path fill="#FFF" d="M1038.759 40.858l-32.328 14.366V76.78c0 19.94 13.797 38.573 32.328 43.1 18.53-4.527 32.327-23.173 32.327-43.1V55.224l-32.327-14.366zm0 15.22c5.713 0 10.344 4.631 10.344 10.344 0 5.714-4.631 10.345-10.344 10.345-5.714 0-10.345-4.631-10.345-10.345 0-5.713 4.631-10.344 10.345-10.344zm19.396 42.775c0 .258-.076.51-.22.725-.232.349-.465.71-.724 1.047a36.039 36.039 0 0 1-18.452 13.228 36.039 36.039 0 0 1-18.453-13.163c-.259-.337-.491-.699-.724-1.048a1.293 1.293 0 0 1-.22-.724v-5.806c0-7.927 12.931-11.922 19.397-11.922 6.465 0 19.396 3.982 19.396 11.922v5.741z"/>
-    </g>
-    <path fill="#000" fill-rule="nonzero" d="M596.754 740.299h9.297l-14.126 48.09h-13.222l-14.119-48.09h9.294l11.451 40.007 11.425-40.007zm35.18 47.997h-7.102l-.629-2.288a18.661 18.661 0 0 1-10.279 3.092c-6.32 0-9.022-4.4-9.022-10.444 0-7.153 3.058-9.871 10.092-9.871h8.309v-3.687c0-3.891-1.054-5.267-6.61-5.267a47.72 47.72 0 0 0-9.582 1.07l-1.053-6.711a44.618 44.618 0 0 1 11.876-1.648c10.874 0 14.068 3.89 14.068 12.692v23.056l-.068.006zm-8.665-13.257h-6.406c-2.837 0-3.636.798-3.636 3.457 0 2.656.799 3.526 3.483 3.526a13.372 13.372 0 0 0 6.542-1.808l.034-5.175h-.017zm22.291-21.824v24.503c0 1.878.798 2.815 2.786 2.815a23.682 23.682 0 0 0 9.04-2.952v-24.364h8.664v35.101h-6.609l-.85-3.044a34.213 34.213 0 0 1-13.779 3.755c-5.742 0-7.798-4.098-7.798-10.373v-25.451h8.597l-.051.01zm25.078 35.081v-49.441l8.665-1.212v50.677l-8.665-.024zm34.524-.732a23.749 23.749 0 0 1-7.595 1.376c-6.32 0-9.514-3.024-9.514-9.298v-19.573h-5.182v-6.881h5.199v-8.716l8.648-1.24v9.956h8.869l-.544 6.864h-8.325v18.315a2.841 2.841 0 0 0 .798 2.345 2.687 2.687 0 0 0 2.328.747 16.99 16.99 0 0 0 4.332-.713l1.037 6.779-.051.04zM548 535l87.194 175L723 535H548zm97.572 35.13h10.15v10.085h-10.15V570.13zm-20.212 40.693h-10.15V600.56h10.15v10.263zm0-15.214h-10.15v-10.262h10.15v10.262zm0-15.214h-10.15v-10.262h10.15v10.262zm15.329 45.53h-10.262v-10.15h10.262v10.15zm0-15.215h-10.262v-10.143h10.262v10.16-.017zm0-15.206h-10.262v-10.143h10.262v10.16-.017zm0-15.274h-10.262v-10.075h10.262v10.092-.017zm4.995 5.063h10.152v10.16h-10.28l.102-10.143.026-.017zm0 25.366v-10.075h10.152v10.16l-10.16-.068.008-.017z"/>
-    <g fill-rule="nonzero">
-      <g transform="translate(41 5)">
-        <use fill="#000" filter="url(#a)" xlink:href="#b"/>
-        <use fill="#FFF" xlink:href="#b"/>
-      </g>
-      <path fill="#9AA0A6" d="M146.87 70.009a1.41 1.41 0 0 0 1.436-1.41v-2.302a1.41 1.41 0 0 0-1.41-1.409h-7.202v-6.75a1.578 1.578 0 0 0-1.565-1.565h-6.737V49.41a1.41 1.41 0 0 0-1.41-1.41h-2.3a1.41 1.41 0 0 0-1.359 1.41v7.202h-7.629V49.41a1.41 1.41 0 0 0-1.422-1.41h-2.276a1.41 1.41 0 0 0-1.41 1.41v7.202h-7.577V49.41a1.41 1.41 0 0 0-1.41-1.41h-2.302a1.41 1.41 0 0 0-1.409 1.41v7.202h-6.724c-.852 0-1.55.675-1.578 1.526v6.711H85.41A1.41 1.41 0 0 0 84 66.26v2.301a1.41 1.41 0 0 0 1.41 1.41h7.176v7.565H85.41A1.41 1.41 0 0 0 84 78.944v2.34a1.41 1.41 0 0 0 1.41 1.423h7.176v7.578H85.41A1.41 1.41 0 0 0 84 91.694v2.302a1.41 1.41 0 0 0 1.41 1.41h7.176v6.698a1.578 1.578 0 0 0 1.565 1.564h6.737v7.203c0 .778.631 1.41 1.41 1.41h2.301a1.41 1.41 0 0 0 1.41-1.41v-7.203h7.577v7.203c0 .778.631 1.41 1.41 1.41h2.276a1.41 1.41 0 0 0 1.41-1.41v-7.203h7.641v7.203c0 .778.631 1.41 1.41 1.41h2.302a1.41 1.41 0 0 0 1.409-1.41v-7.203h6.737a1.578 1.578 0 0 0 1.513-1.564v-6.712h7.177a1.41 1.41 0 0 0 1.435-1.41v-2.3a1.41 1.41 0 0 0-1.41-1.41h-7.202v-7.565h7.177a1.41 1.41 0 0 0 1.435-1.422v-2.29a1.41 1.41 0 0 0-1.435-1.46h-7.177v-7.526h7.177zm-12.478 28.448H97.875V61.888h36.517v36.569z"/>
-    </g>
-    <path stroke="#5F6368" stroke-linecap="square" stroke-width="5" d="M727.5 628.5h311"/>
-    <path fill="#5F6368" fill-rule="nonzero" d="M1042 422h-5V288h-12l14.5-29 14.5 29h-12v134zm0 62v147h-5V484h5zM119 422h-5V248h5v174zm0 62v147h-5V484h5zM514 631H119v-5h395v-12l29 14.5-29 14.5z"/>
-    <path fill="#3C4043" d="M12.647 464H.537v-1.688l6.398-7.11c.947-1.075 1.601-1.949 1.961-2.621.36-.673.54-1.37.54-2.089 0-.965-.292-1.756-.876-2.374-.584-.618-1.363-.927-2.336-.927-1.168 0-2.076.333-2.724.997-.647.664-.97 1.589-.97 2.774H.18c0-1.701.549-3.077 1.645-4.126 1.096-1.05 2.562-1.574 4.399-1.574 1.718 0 3.076.45 4.075 1.352.999.901 1.498 2.1 1.498 3.599 0 1.82-1.16 3.986-3.479 6.5l-4.95 5.37h9.28V464zm2.78-1.231c0-.407.121-.745.363-1.016.24-.27.603-.406 1.085-.406s.848.135 1.098.406c.25.27.375.61.375 1.016 0 .389-.125.715-.375.977s-.616.394-1.098.394c-.482 0-.844-.132-1.085-.394-.242-.262-.362-.588-.362-.977zm19.044-7.008c-2.09-.601-3.612-1.34-4.564-2.216-.952-.876-1.428-1.957-1.428-3.243 0-1.456.581-2.66 1.745-3.612 1.164-.952 2.677-1.428 4.539-1.428 1.27 0 2.401.245 3.396.736.994.49 1.764 1.168 2.31 2.031.546.864.82 1.807.82 2.831h-2.451c0-1.117-.356-1.995-1.067-2.634-.71-.639-1.713-.958-3.008-.958-1.202 0-2.14.264-2.812.793-.673.529-1.01 1.263-1.01 2.203 0 .753.32 1.39.959 1.91s1.726.997 3.263 1.429c1.536.431 2.738.907 3.605 1.428.868.52 1.51 1.128 1.93 1.822.419.694.628 1.51.628 2.45 0 1.498-.584 2.697-1.752 3.599-1.168.901-2.73 1.352-4.684 1.352a8.688 8.688 0 0 1-3.555-.73c-1.1-.487-1.949-1.153-2.545-2-.597-.846-.895-1.807-.895-2.881h2.45c0 1.117.412 2 1.238 2.647.825.647 1.927.97 3.307.97 1.286 0 2.272-.262 2.958-.786.685-.525 1.028-1.24 1.028-2.146 0-.905-.317-1.606-.952-2.1-.635-.496-1.786-.985-3.453-1.467zm15.31 8.493c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.781-3.65.52-1.07 1.249-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.164 1.764.99 1.177 1.486 2.861 1.486 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.758.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.108-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.151 1.768-2.878 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.743.345-2.386 1.035-.644.69-1.041 1.657-1.194 2.901h6.881v-.178c-.068-1.193-.39-2.118-.965-2.774-.575-.656-1.354-.984-2.336-.984zm10.588-1.675l.076 1.726c1.05-1.32 2.42-1.98 4.114-1.98 2.903 0 4.367 1.637 4.392 4.913V464h-2.348v-9.09c-.009-.99-.235-1.722-.68-2.196-.444-.474-1.136-.711-2.075-.711-.762 0-1.43.203-2.006.61a4.138 4.138 0 0 0-1.346 1.599V464h-2.349v-13.736h2.222zm11.553 6.754c0-2.108.5-3.803 1.498-5.085.999-1.282 2.306-1.923 3.923-1.923 1.608 0 2.882.55 3.821 1.65v-7.16h2.349V464h-2.159l-.114-1.473c-.94 1.151-2.247 1.727-3.923 1.727-1.59 0-2.888-.652-3.89-1.955-1.004-1.304-1.505-3.005-1.505-5.104v-.177zm2.349.266c0 1.557.321 2.776.964 3.656.644.88 1.532 1.32 2.666 1.32 1.49 0 2.578-.668 3.263-2.005v-6.31c-.702-1.295-1.781-1.942-3.237-1.942-1.151 0-2.048.444-2.692 1.333-.643.889-.964 2.205-.964 3.948zm25.136-1.523c-2.09-.601-3.612-1.34-4.564-2.216-.952-.876-1.428-1.957-1.428-3.243 0-1.456.582-2.66 1.746-3.612 1.163-.952 2.676-1.428 4.538-1.428 1.27 0 2.402.245 3.396.736.995.49 1.765 1.168 2.31 2.031.547.864.82 1.807.82 2.831h-2.45c0-1.117-.356-1.995-1.067-2.634-.71-.639-1.714-.958-3.009-.958-1.202 0-2.139.264-2.812.793s-1.01 1.263-1.01 2.203c0 .753.32 1.39.96 1.91.638.52 1.726.997 3.262 1.429 1.536.431 2.738.907 3.606 1.428.867.52 1.51 1.128 1.93 1.822.418.694.628 1.51.628 2.45 0 1.498-.584 2.697-1.752 3.599-1.168.901-2.73 1.352-4.685 1.352a8.688 8.688 0 0 1-3.555-.73c-1.1-.487-1.948-1.153-2.545-2-.597-.846-.895-1.807-.895-2.881h2.45c0 1.117.413 2 1.238 2.647.825.647 1.928.97 3.307.97 1.287 0 2.273-.262 2.958-.786.686-.525 1.029-1.24 1.029-2.146 0-.905-.318-1.606-.953-2.1-.634-.496-1.785-.985-3.453-1.467zM111.277 464h-2.348v-13.736h2.348V464zm-2.539-17.38c0-.38.117-.702.35-.965.232-.262.577-.393 1.034-.393.457 0 .804.13 1.041.393.237.263.356.584.356.965s-.119.698-.356.952-.584.381-1.04.381c-.458 0-.803-.127-1.036-.38-.232-.255-.349-.572-.349-.953zm5.739 10.398c0-2.142.495-3.845 1.485-5.11.99-1.266 2.302-1.898 3.935-1.898 1.676 0 2.984.592 3.923 1.777l.115-1.523h2.145v13.406c0 1.777-.527 3.178-1.58 4.202-1.054 1.024-2.47 1.536-4.247 1.536-.99 0-1.96-.211-2.907-.635-.948-.423-1.672-1.002-2.171-1.739l1.219-1.409c1.007 1.244 2.238 1.866 3.694 1.866 1.142 0 2.033-.321 2.672-.965.64-.643.959-1.548.959-2.716v-1.181c-.94 1.083-2.222 1.625-3.847 1.625-1.608 0-2.91-.648-3.904-1.942-.994-1.295-1.491-3.06-1.491-5.294zm2.36.266c0 1.549.318 2.766.953 3.65.635.885 1.523 1.327 2.666 1.327 1.481 0 2.569-.673 3.263-2.019v-6.271c-.72-1.312-1.799-1.968-3.238-1.968-1.142 0-2.035.444-2.678 1.333-.643.889-.965 2.205-.965 3.948zm15.007-7.02l.076 1.726c1.05-1.32 2.42-1.98 4.113-1.98 2.903 0 4.367 1.637 4.393 4.913V464h-2.349v-9.09c-.008-.99-.235-1.722-.68-2.196-.443-.474-1.135-.711-2.075-.711-.761 0-1.43.203-2.006.61a4.138 4.138 0 0 0-1.345 1.599V464h-2.349v-13.736h2.222zm17.824 13.99c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.78-3.65.521-1.07 1.25-1.908 2.184-2.514a5.49 5.49 0 0 1 3.041-.907c1.786 0 3.174.588 4.164 1.764.99 1.177 1.485 2.861 1.485 5.053v.978h-9.305c.034 1.354.43 2.448 1.187 3.281.757.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.107-.507a5.295 5.295 0 0 0 1.511-1.346l1.435 1.118c-1.151 1.768-2.878 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.744.345-2.387 1.035s-1.04 1.657-1.193 2.901h6.88v-.178c-.067-1.193-.389-2.118-.964-2.774-.576-.656-1.354-.984-2.336-.984zm7.795 5.079c0-2.108.5-3.803 1.498-5.085.999-1.282 2.306-1.923 3.923-1.923 1.608 0 2.882.55 3.821 1.65v-7.16h2.349V464h-2.158l-.115-1.473c-.94 1.151-2.247 1.727-3.923 1.727-1.59 0-2.888-.652-3.89-1.955-1.004-1.304-1.505-3.005-1.505-5.104v-.177zm2.349.266c0 1.557.321 2.776.964 3.656.644.88 1.532 1.32 2.666 1.32 1.49 0 2.578-.668 3.263-2.005v-6.31c-.702-1.295-1.781-1.942-3.237-1.942-1.151 0-2.048.444-2.692 1.333-.643.889-.964 2.205-.964 3.948zm27.434-11.768h2.45v13.088c0 1.77-.53 3.153-1.593 4.152-1.062.999-2.478 1.498-4.247 1.498-1.836 0-3.266-.47-4.29-1.41-1.025-.939-1.537-2.255-1.537-3.948h2.438c0 1.058.29 1.884.87 2.476.58.593 1.42.889 2.52.889 1.007 0 1.821-.318 2.443-.952.622-.635.938-1.524.946-2.666v-13.127zm10.588 12.657l.355 2.437.521-2.196 3.656-12.898h2.057l3.567 12.898.508 2.234.394-2.488 2.869-12.644h2.45L209.437 464h-2.221l-3.809-13.47-.292-1.409-.292 1.41L198.875 464h-2.222l-4.468-18.484h2.437l2.92 12.657zm32.03-10.652h-5.941V464h-2.425v-16.479h-5.929v-2.005h14.295v2.005z"/>
-    <g fill-rule="nonzero">
-      <path fill="#4285F4" d="M779.039 72.397L745.03 13.25a14.948 14.948 0 0 0-12.75-7.603h-68.03a14.935 14.935 0 0 0-12.75 7.603l-34.022 58.991a14.845 14.845 0 0 0 0 14.793l34.01 59.483a15.22 15.22 0 0 0 12.75 7.875h68.03a15.168 15.168 0 0 0 12.762-7.836l34.009-59.147a15.168 15.168 0 0 0 0-15.012z"/>
-      <path fill="#000" d="M769.276 104.336L713.31 48.358l-4.008 8.69-8.742-8.729-4.034 8.65-8.612-8.624-2.147 10.448-7.68 1.293-1.591 6.828-9.931 2.38 8.896 8.896-8.806 3.879 8.806 8.806-8.858 3.866 59.613 59.612h6.051a15.168 15.168 0 0 0 12.763-7.836l24.246-42.18z" opacity=".07"/>
-      <path fill="#FFF" d="M705.797 71.078h-14.754a1.578 1.578 0 0 0-1.565 1.564v14.755c0 .866.699 1.57 1.565 1.577h14.754a1.578 1.578 0 0 0 1.513-1.577V72.642a1.578 1.578 0 0 0-1.564-1.564"/>
-      <path fill="#FFF" d="M729.15 69.888a1.41 1.41 0 0 0 1.436-1.41v-2.301a1.41 1.41 0 0 0-1.41-1.41h-7.202v-6.75a1.578 1.578 0 0 0-1.565-1.564h-6.737v-7.164a1.41 1.41 0 0 0-1.41-1.41h-2.3a1.41 1.41 0 0 0-1.359 1.41v7.202h-7.629V49.29a1.41 1.41 0 0 0-1.422-1.41h-2.276a1.41 1.41 0 0 0-1.41 1.41v7.202h-7.577V49.29a1.41 1.41 0 0 0-1.41-1.41h-2.301a1.41 1.41 0 0 0-1.41 1.41v7.202h-6.724c-.852 0-1.55.675-1.578 1.526v6.711h-7.176a1.41 1.41 0 0 0-1.41 1.41v2.302a1.41 1.41 0 0 0 1.41 1.41h7.176v7.564h-7.176a1.41 1.41 0 0 0-1.41 1.41v2.34a1.41 1.41 0 0 0 1.41 1.422h7.176v7.578h-7.176a1.41 1.41 0 0 0-1.41 1.41v2.301a1.41 1.41 0 0 0 1.41 1.41h7.176v6.698a1.578 1.578 0 0 0 1.565 1.564h6.737v7.203c0 .778.631 1.41 1.41 1.41h2.301a1.41 1.41 0 0 0 1.41-1.41v-7.203h7.577v7.203c0 .778.631 1.41 1.41 1.41h2.276a1.41 1.41 0 0 0 1.41-1.41v-7.203h7.641v7.203c0 .778.631 1.41 1.41 1.41h2.302a1.41 1.41 0 0 0 1.41-1.41v-7.203h6.736a1.578 1.578 0 0 0 1.513-1.564v-6.711h7.177a1.41 1.41 0 0 0 1.435-1.41V91.56a1.41 1.41 0 0 0-1.41-1.41h-7.202v-7.564h7.177a1.41 1.41 0 0 0 1.435-1.422v-2.289a1.41 1.41 0 0 0-1.435-1.461h-7.177v-7.526h7.177zm-12.478 28.448h-36.517V61.767h36.517v36.57z"/>
-    </g>
-    <path fill="#3C4043" d="M647.205 206.824c-.316 2.707-1.315 4.796-2.997 6.267-1.682 1.47-3.917 2.206-6.706 2.206-3.023 0-5.446-1.084-7.269-3.252-1.822-2.168-2.733-5.068-2.733-8.701v-2.461c0-2.38.425-4.47 1.274-6.276.85-1.804 2.054-3.19 3.613-4.157 1.558-.967 3.363-1.45 5.414-1.45 2.719 0 4.898.759 6.539 2.276 1.64 1.518 2.596 3.619 2.865 6.302h-3.393c-.292-2.039-.928-3.515-1.907-4.43-.978-.914-2.346-1.37-4.104-1.37-2.156 0-3.847.796-5.072 2.39-1.224 1.594-1.836 3.861-1.836 6.803v2.478c0 2.778.58 4.987 1.74 6.627 1.16 1.64 2.783 2.461 4.869 2.461 1.875 0 3.313-.425 4.315-1.274 1.002-.85 1.667-2.33 1.995-4.439h3.393zm3.234-1.564c0-1.864.367-3.54 1.1-5.028.732-1.488 1.751-2.636 3.058-3.445 1.306-.808 2.798-1.213 4.473-1.213 2.59 0 4.685.897 6.284 2.69 1.6 1.793 2.4 4.177 2.4 7.154v.228c0 1.852-.355 3.513-1.064 4.984-.709 1.47-1.722 2.616-3.04 3.436-1.319.82-2.834 1.23-4.545 1.23-2.578 0-4.667-.896-6.266-2.689-1.6-1.793-2.4-4.166-2.4-7.119v-.228zm3.27.386c0 2.11.49 3.803 1.468 5.08.978 1.278 2.288 1.917 3.928 1.917 1.653 0 2.965-.648 3.938-1.943.973-1.295 1.459-3.108 1.459-5.44 0-2.086-.495-3.777-1.485-5.072-.99-1.294-2.306-1.942-3.947-1.942-1.605 0-2.9.639-3.884 1.916-.985 1.277-1.477 3.106-1.477 5.484zm21.182-9.72l.088 2.11c1.394-1.641 3.275-2.462 5.642-2.462 2.66 0 4.47 1.02 5.432 3.059a7.205 7.205 0 0 1 2.47-2.215c1.013-.563 2.211-.844 3.594-.844 4.172 0 6.293 2.21 6.363 6.627v12.744h-3.251v-12.55c0-1.36-.311-2.376-.932-3.05-.621-.674-1.664-1.011-3.129-1.011-1.207 0-2.209.36-3.006 1.081-.797.72-1.26 1.69-1.389 2.91v12.62h-3.27v-12.463c0-2.765-1.353-4.148-4.06-4.148-2.132 0-3.591.908-4.377 2.725v13.886h-3.252v-19.02h3.077zm44.56 9.72c0 2.895-.662 5.227-1.986 6.997-1.324 1.77-3.117 2.654-5.38 2.654-2.308 0-4.124-.733-5.448-2.197v9.158h-3.252v-26.332h2.97l.159 2.11c1.324-1.641 3.164-2.462 5.52-2.462 2.284 0 4.092.862 5.422 2.584 1.33 1.723 1.995 4.12 1.995 7.19v.298zm-3.252-.369c0-2.144-.457-3.838-1.37-5.08-.915-1.242-2.169-1.863-3.763-1.863-1.968 0-3.445.873-4.43 2.62v9.087c.973 1.734 2.462 2.602 4.466 2.602 1.558 0 2.797-.619 3.717-1.855.92-1.236 1.38-3.073 1.38-5.51zm19.125 7.787c-1.265 1.489-3.123 2.233-5.572 2.233-2.027 0-3.571-.589-4.632-1.767-1.06-1.177-1.597-2.92-1.608-5.23v-12.374h3.252v12.287c0 2.883 1.172 4.324 3.515 4.324 2.485 0 4.137-.926 4.957-2.777v-13.834h3.252v19.02h-3.093l-.07-1.882zm12.516-21.744v4.606h3.55v2.513h-3.55v11.795c0 .762.158 1.333.474 1.714.317.381.856.572 1.618.572.375 0 .89-.07 1.547-.211v2.636a9.428 9.428 0 0 1-2.497.352c-1.453 0-2.548-.44-3.287-1.318-.738-.88-1.107-2.127-1.107-3.745V198.44h-3.463v-2.513h3.463v-4.606h3.252zm15.24 23.977c-2.578 0-4.676-.847-6.293-2.54-1.617-1.694-2.426-3.958-2.426-6.794v-.598c0-1.886.36-3.571 1.081-5.053.721-1.483 1.729-2.643 3.024-3.48 1.295-.839 2.698-1.258 4.21-1.258 2.472 0 4.394.815 5.765 2.444 1.372 1.628 2.057 3.96 2.057 6.996v1.353h-12.885c.047 1.875.595 3.39 1.644 4.544 1.049 1.154 2.382 1.732 3.999 1.732 1.148 0 2.12-.235 2.918-.704a7.332 7.332 0 0 0 2.092-1.863l1.986 1.547c-1.594 2.45-3.984 3.674-7.172 3.674zm-.404-17.05c-1.313 0-2.414.477-3.305 1.432-.89.955-1.441 2.294-1.652 4.016h9.527v-.246c-.094-1.652-.539-2.932-1.336-3.84-.797-.909-1.875-1.363-3.234-1.363zM965.584 204.03c0 2.507-.422 4.696-1.266 6.565-.843 1.869-2.039 3.296-3.586 4.28-1.546.984-3.351 1.477-5.414 1.477-2.015 0-3.802-.496-5.361-1.486-1.559-.99-2.769-2.402-3.63-4.236-.861-1.834-1.304-3.958-1.327-6.372v-1.846c0-2.46.428-4.635 1.283-6.521.856-1.887 2.066-3.331 3.63-4.333 1.565-1.002 3.355-1.503 5.37-1.503 2.051 0 3.859.495 5.423 1.485 1.565.99 2.769 2.426 3.612 4.307.844 1.88 1.266 4.069 1.266 6.565v1.617zm-3.357-1.653c0-3.035-.61-5.364-1.829-6.987-1.218-1.623-2.923-2.435-5.115-2.435-2.133 0-3.811.812-5.036 2.435-1.225 1.623-1.854 3.876-1.89 6.758v1.881c0 2.942.619 5.253 1.855 6.935 1.236 1.682 2.938 2.522 5.106 2.522 2.18 0 3.868-.794 5.063-2.382 1.195-1.587 1.81-3.864 1.846-6.829v-1.898zm22.183 6.943h-10.722l-2.409 6.68h-3.48l9.773-25.594h2.953L990.316 216h-3.462l-2.444-6.68zm-9.703-2.777h8.701l-4.36-11.97-4.341 11.97zm30.094 7.576c-1.266 1.488-3.123 2.233-5.572 2.233-2.028 0-3.572-.59-4.632-1.767-1.06-1.178-1.597-2.92-1.609-5.23V196.98h3.252v12.288c0 2.882 1.172 4.324 3.516 4.324 2.484 0 4.137-.926 4.957-2.778V196.98h3.252V216h-3.094l-.07-1.88zm12.515-21.744v4.605h3.551v2.514h-3.55v11.795c0 .762.158 1.333.474 1.714.316.38.855.571 1.617.571.375 0 .89-.07 1.547-.21V216a9.428 9.428 0 0 1-2.496.352c-1.453 0-2.549-.44-3.287-1.319s-1.108-2.127-1.108-3.744v-11.795h-3.462v-2.514h3.462v-4.605h3.252zm10.6 6.908c1.441-1.77 3.316-2.654 5.625-2.654 4.02 0 6.047 2.267 6.082 6.803V216h-3.252v-12.586c-.012-1.371-.325-2.385-.94-3.041-.616-.656-1.574-.984-2.874-.984-1.055 0-1.98.28-2.778.843a5.73 5.73 0 0 0-1.863 2.215V216h-3.252v-27h3.252v10.283zM1069.84 216h-16.77v-2.338l8.86-9.844c1.312-1.488 2.217-2.698 2.716-3.63.498-.931.747-1.895.747-2.891 0-1.336-.405-2.432-1.213-3.287-.809-.856-1.887-1.283-3.235-1.283-1.617 0-2.874.46-3.77 1.38-.897.92-1.345 2.2-1.345 3.84h-3.252c0-2.355.759-4.26 2.276-5.713 1.518-1.453 3.548-2.18 6.091-2.18 2.38 0 4.26.625 5.643 1.873s2.074 2.909 2.074 4.983c0 2.52-1.605 5.52-4.816 9l-6.856 7.436h12.85V216zm27.334-6.68h-10.723l-2.408 6.68h-3.48l9.773-25.594h2.953L1103.08 216h-3.463l-2.443-6.68zm-9.703-2.777h8.7l-4.359-11.97-4.341 11.97zm22.43-.563V216h-3.376v-25.594h9.44c2.8 0 4.995.715 6.583 2.145 1.588 1.43 2.382 3.322 2.382 5.678 0 2.484-.777 4.397-2.33 5.739-1.552 1.342-3.776 2.012-6.67 2.012h-6.03zm0-2.76h6.064c1.805 0 3.187-.424 4.148-1.274.961-.85 1.442-2.077 1.442-3.682 0-1.524-.48-2.743-1.442-3.657-.96-.914-2.279-1.388-3.955-1.423h-6.258v10.037zm22.956 12.78h-3.375v-25.594h3.375V216z"/>
-    <path fill="#5F6368" fill-rule="nonzero" d="M295 85h-42v12l-29-14.5L253 68v12h42v5zm217 0v-5h50V68l29 14.5L562 97V85h-50z"/>
-    <path fill="#3C4043" d="M326.255 92h-2.361V76.347l-4.736 1.739v-2.133l6.729-2.526h.368V92zm7.173-1.231c0-.407.12-.745.362-1.016.24-.27.603-.406 1.085-.406s.848.135 1.098.406c.25.27.375.61.375 1.016 0 .389-.125.715-.375.977s-.616.394-1.098.394c-.482 0-.844-.132-1.085-.394-.242-.262-.362-.588-.362-.977zm20.376-6.247h-4.342V92h-2.45V73.516h6.119c2.082 0 3.684.474 4.805 1.421 1.121.948 1.682 2.328 1.682 4.14 0 1.15-.31 2.153-.933 3.008-.622.855-1.487 1.494-2.596 1.917l4.342 7.846V92h-2.616l-4.011-7.478zm-4.342-1.993h3.745c1.21 0 2.173-.313 2.888-.94.715-.625 1.073-1.463 1.073-2.513 0-1.142-.34-2.018-1.022-2.628-.681-.61-1.665-.918-2.952-.927h-3.732v7.008zm18.903 9.725c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.781-3.65.52-1.07 1.248-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.164 1.764.99 1.177 1.486 2.861 1.486 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.757.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.108-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.151 1.768-2.878 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.743.345-2.386 1.035-.644.69-1.041 1.657-1.194 2.901h6.881v-.178c-.068-1.193-.39-2.118-.965-2.774-.575-.656-1.354-.984-2.336-.984zm11.553-5.001v3.326h2.564v1.815h-2.564v8.519c0 .55.114.962.343 1.237.228.276.618.413 1.168.413.27 0 .643-.05 1.117-.152V92a6.809 6.809 0 0 1-1.803.254c-1.05 0-1.84-.317-2.374-.952-.533-.635-.8-1.536-.8-2.704v-8.519h-2.5v-1.815h2.5v-3.326h2.349zm11.946 5.433a7.038 7.038 0 0 0-1.155-.089c-1.54 0-2.586.656-3.136 1.968V92h-2.348V78.264h2.285l.038 1.587c.77-1.228 1.862-1.841 3.275-1.841.457 0 .804.059 1.041.177v2.184zM396.282 92h-2.348V78.264h2.348V92zm-2.539-17.38c0-.38.117-.702.35-.965.232-.262.577-.393 1.034-.393.457 0 .804.13 1.041.393.237.263.355.584.355.965s-.118.698-.355.952-.584.381-1.041.381c-.457 0-.802-.127-1.035-.38-.232-.255-.349-.572-.349-.953zm11.997 17.634c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.781-3.65.52-1.07 1.248-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.164 1.764.99 1.177 1.486 2.861 1.486 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.757.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.108-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.151 1.768-2.878 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.743.345-2.386 1.035-.644.69-1.041 1.657-1.194 2.901h6.881v-.178c-.068-1.193-.39-2.118-.965-2.774-.575-.656-1.354-.984-2.336-.984zm12.734 8.874l3.402-10.55h2.4L419.057 92h-1.79l-4.977-13.736h2.4l3.49 10.55zm13.596 3.44c-1.862 0-3.377-.61-4.545-1.834-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.781-3.65.52-1.07 1.249-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.164 1.764.99 1.177 1.486 2.861 1.486 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.758.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.108-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.151 1.768-2.878 2.653-5.18 2.653zm-.292-12.314c-.948 0-1.743.345-2.386 1.035-.644.69-1.041 1.657-1.194 2.901h6.881v-.178c-.068-1.193-.39-2.118-.965-2.774-.575-.656-1.354-.984-2.336-.984zm22.915-6.423h2.45v13.088c0 1.77-.53 3.153-1.593 4.152-1.062.999-2.477 1.498-4.246 1.498-1.837 0-3.267-.47-4.291-1.41-1.024-.939-1.536-2.255-1.536-3.948h2.437c0 1.058.29 1.884.87 2.476.58.593 1.42.889 2.52.889 1.007 0 1.821-.318 2.444-.952.622-.635.937-1.524.945-2.666V73.516zm10.588 12.657l.356 2.437.52-2.196 3.656-12.898h2.057l3.568 12.898.507 2.234.394-2.488 2.869-12.644h2.45L476.885 92h-2.222l-3.809-13.47-.291-1.409-.292 1.41L466.322 92h-2.221l-4.47-18.484h2.438l2.92 12.657zm32.03-10.652h-5.94V92h-2.426V75.521h-5.928v-2.005h14.295v2.005zM930.951 453.163h1.765c1.109-.017 1.98-.309 2.615-.876.635-.567.952-1.333.952-2.298 0-2.166-1.079-3.25-3.237-3.25-1.016 0-1.826.29-2.431.87-.605.58-.908 1.348-.908 2.304h-2.349c0-1.464.536-2.68 1.606-3.65 1.071-.969 2.431-1.453 4.082-1.453 1.743 0 3.11.46 4.1 1.383.99.923 1.486 2.205 1.486 3.847 0 .804-.26 1.583-.78 2.336-.521.753-1.23 1.316-2.127 1.688 1.015.322 1.8.855 2.355 1.6.554.745.831 1.655.831 2.73 0 1.658-.542 2.974-1.625 3.948-1.083.973-2.492 1.46-4.227 1.46-1.735 0-3.147-.47-4.234-1.41-1.088-.939-1.632-2.179-1.632-3.72h2.362c0 .974.317 1.753.952 2.337.635.584 1.485.876 2.552.876 1.134 0 2.001-.296 2.602-.889.601-.592.902-1.443.902-2.552 0-1.075-.33-1.9-.99-2.475-.66-.576-1.613-.872-2.857-.889h-1.765v-1.917zm11.477 9.153c0-.406.12-.744.362-1.015.24-.271.603-.406 1.085-.406s.848.135 1.098.406c.25.27.375.61.375 1.015 0 .39-.125.716-.375.978s-.616.394-1.098.394c-.482 0-.844-.132-1.085-.394-.242-.262-.362-.588-.362-.978zm19.716-2.005l5.28-15.248h2.667l-6.856 18.485h-2.158l-6.843-18.485h2.654l5.256 15.248zm15.196 3.49c-1.862 0-3.377-.61-4.545-1.834-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.78-3.65.521-1.07 1.25-1.909 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.787 0 3.175.588 4.165 1.764.99 1.177 1.485 2.86 1.485 5.053v.978h-9.305c.033 1.354.43 2.448 1.187 3.281.757.834 1.72 1.25 2.888 1.25.83 0 1.532-.169 2.107-.507a5.295 5.295 0 0 0 1.511-1.346l1.435 1.117c-1.152 1.77-2.878 2.654-5.18 2.654zm-.292-12.314c-.948 0-1.744.345-2.387 1.035s-1.04 1.657-1.193 2.9h6.88v-.177c-.067-1.193-.389-2.118-.964-2.774-.576-.656-1.354-.984-2.336-.984zm15.006.432a7.038 7.038 0 0 0-1.156-.089c-1.54 0-2.585.656-3.135 1.968v9.75h-2.349v-13.736h2.285l.038 1.586c.77-1.227 1.862-1.84 3.276-1.84.457 0 .804.059 1.04.177v2.184zm4.71 11.629h-2.349v-13.736h2.349v13.736zm-2.54-17.38c0-.38.117-.703.35-.965.232-.262.577-.393 1.034-.393.457 0 .804.13 1.041.393.237.262.356.584.356.965 0 .38-.119.698-.356.952s-.584.381-1.04.381c-.458 0-.803-.127-1.035-.38-.233-.255-.35-.572-.35-.953zm7.453 17.38v-11.921h-2.171v-1.815h2.17v-1.41c0-1.472.394-2.61 1.181-3.415.788-.804 1.9-1.206 3.34-1.206.541 0 1.078.072 1.612.216l-.127 1.904a6.745 6.745 0 0 0-1.27-.114c-.762 0-1.35.222-1.765.667-.414.444-.622 1.08-.622 1.91v1.448h2.933v1.815h-2.933v11.92h-2.348zm12.365-3.44l3.2-10.296h2.513l-5.523 15.856c-.854 2.285-2.213 3.428-4.075 3.428l-.444-.038-.876-.165v-1.905l.635.051c.795 0 1.415-.16 1.86-.482.444-.322.81-.91 1.098-1.765l.52-1.396-4.9-13.584h2.564l3.428 10.295zm17.05-3.796v7.236h-2.438v-18.485h6.818c2.022 0 3.607.517 4.754 1.55 1.147 1.032 1.72 2.399 1.72 4.1 0 1.794-.56 3.176-1.682 4.145-1.121.969-2.727 1.454-4.818 1.454h-4.354zm0-1.994h4.38c1.303 0 2.302-.306 2.996-.92.694-.614 1.04-1.5 1.04-2.66 0-1.1-.346-1.98-1.04-2.64-.694-.66-1.646-1.003-2.857-1.029h-4.52v7.25zm22.077 7.871c-.914 1.075-2.256 1.613-4.024 1.613-1.465 0-2.58-.426-3.346-1.276-.766-.85-1.153-2.11-1.161-3.777v-8.937h2.348v8.874c0 2.082.847 3.123 2.54 3.123 1.794 0 2.987-.669 3.58-2.006v-9.991h2.348v13.736h-2.234l-.051-1.359zm17.481-5.357c0 2.099-.482 3.785-1.447 5.06-.965 1.273-2.26 1.91-3.885 1.91-1.735 0-3.076-.614-4.024-1.841l-.114 1.587h-2.159v-19.5h2.35v7.274c.947-1.176 2.255-1.764 3.922-1.764 1.667 0 2.977.63 3.93 1.891.951 1.261 1.427 2.988 1.427 5.18v.203zm-2.348-.267c0-1.6-.31-2.835-.927-3.707-.618-.871-1.506-1.307-2.666-1.307-1.549 0-2.662.72-3.339 2.158v5.941c.72 1.44 1.84 2.159 3.364 2.159 1.126 0 2.002-.436 2.628-1.308.627-.872.94-2.184.94-3.936zm7.858 6.983h-2.348v-19.5h2.348v19.5zm6.31 0h-2.349v-13.736h2.349v13.736zm-2.54-17.38c0-.38.117-.703.35-.965.233-.262.577-.393 1.034-.393.457 0 .804.13 1.041.393.237.262.356.584.356.965 0 .38-.119.698-.356.952s-.584.381-1.04.381c-.458 0-.802-.127-1.035-.38-.233-.255-.35-.572-.35-.953zm11.807 15.717c.838 0 1.57-.254 2.197-.762.626-.508.973-1.143 1.04-1.904h2.222c-.042.787-.313 1.536-.812 2.247-.5.71-1.166 1.278-2 1.701a5.77 5.77 0 0 1-2.647.635c-1.87 0-3.358-.624-4.462-1.873-1.105-1.248-1.657-2.956-1.657-5.122v-.394c0-1.337.246-2.526.736-3.567.491-1.041 1.196-1.85 2.114-2.425.919-.576 2.004-.863 3.257-.863 1.54 0 2.82.46 3.84 1.383s1.564 2.12 1.631 3.593h-2.221c-.068-.888-.405-1.618-1.01-2.19-.605-.571-1.352-.857-2.24-.857-1.194 0-2.118.43-2.774 1.289-.656.859-.984 2.1-.984 3.726v.444c0 1.583.326 2.802.977 3.657.652.854 1.583 1.282 2.793 1.282zm28.501-4.202c-.228 1.955-.95 3.463-2.164 4.525-1.215 1.063-2.83 1.594-4.844 1.594-2.183 0-3.933-.783-5.249-2.349-1.316-1.566-1.974-3.66-1.974-6.284v-1.777c0-1.719.307-3.23.92-4.533.614-1.303 1.483-2.304 2.61-3.002 1.125-.698 2.428-1.047 3.91-1.047 1.963 0 3.537.548 4.722 1.644 1.185 1.096 1.875 2.613 2.07 4.55h-2.45c-.213-1.472-.672-2.538-1.378-3.198-.707-.66-1.695-.99-2.965-.99-1.557 0-2.778.575-3.662 1.726-.885 1.151-1.327 2.789-1.327 4.913v1.79c0 2.006.419 3.601 1.257 4.786.838 1.185 2.01 1.778 3.516 1.778 1.355 0 2.394-.307 3.117-.92.724-.614 1.204-1.683 1.441-3.206h2.45zm8.658 6.119c-1.861 0-3.376-.612-4.544-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.78-3.65.52-1.07 1.249-1.909 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.165 1.764.99 1.177 1.485 2.86 1.485 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.758.834 1.72 1.25 2.888 1.25.83 0 1.532-.169 2.108-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.117c-1.15 1.77-2.877 2.654-5.18 2.654zm-.292-12.315c-.947 0-1.743.345-2.386 1.035s-1.041 1.657-1.194 2.9h6.881v-.177c-.067-1.193-.389-2.118-.965-2.774-.575-.656-1.354-.984-2.336-.984zm15.006.432a7.038 7.038 0 0 0-1.155-.089c-1.54 0-2.586.656-3.136 1.968v9.75h-2.348v-13.736h2.285l.038 1.586c.77-1.227 1.862-1.84 3.275-1.84.457 0 .804.059 1.041.177v2.184zm5.98-5.434v3.327h2.564v1.815h-2.564v8.519c0 .55.114.962.343 1.237.228.275.617.413 1.168.413.27 0 .643-.05 1.117-.152v1.904a6.809 6.809 0 0 1-1.803.254c-1.05 0-1.84-.318-2.374-.952-.533-.635-.8-1.537-.8-2.704v-8.519h-2.5v-1.815h2.5v-3.327h2.349z"/>
-  </g>
-</svg>
diff --git a/website/public/img/vault-gcp-iam-auth-workflow.svg b/website/public/img/vault-gcp-iam-auth-workflow.svg
deleted file mode 100644
index a36c6e0a104..00000000000
--- a/website/public/img/vault-gcp-iam-auth-workflow.svg
+++ /dev/null
@@ -1,32 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 1182 790">
-  <defs>
-    <rect id="b" width="150" height="150" rx="2"/>
-    <filter id="a" width="112.7%" height="112.7%" x="-6.3%" y="-5.7%" filterUnits="objectBoundingBox">
-      <feOffset dy="1" in="SourceAlpha" result="shadowOffsetOuter1"/>
-      <feGaussianBlur in="shadowOffsetOuter1" result="shadowBlurOuter1" stdDeviation="3"/>
-      <feColorMatrix in="shadowBlurOuter1" values="0 0 0 0 0.37254902 0 0 0 0 0.388235294 0 0 0 0 0.407843137 0 0 0 0.5 0"/>
-    </filter>
-  </defs>
-  <g fill="none" fill-rule="evenodd">
-    <path fill="#3C4043" d="M91.797 207.879c-.317 2.707-1.316 4.796-2.997 6.267-1.682 1.47-3.917 2.206-6.706 2.206-3.024 0-5.447-1.084-7.269-3.252-1.822-2.168-2.733-5.069-2.733-8.702v-2.46c0-2.38.425-4.471 1.274-6.276.85-1.805 2.054-3.19 3.613-4.157 1.558-.967 3.363-1.45 5.414-1.45 2.718 0 4.898.758 6.539 2.276 1.64 1.518 2.595 3.618 2.865 6.302h-3.393c-.293-2.04-.928-3.516-1.907-4.43-.978-.914-2.347-1.371-4.104-1.371-2.157 0-3.847.797-5.072 2.39-1.224 1.594-1.837 3.862-1.837 6.803v2.479c0 2.777.58 4.986 1.74 6.627 1.16 1.64 2.784 2.46 4.87 2.46 1.875 0 3.313-.424 4.315-1.274 1.002-.85 1.667-2.329 1.995-4.438h3.393zM99.426 216h-3.252v-27h3.252v27zm8.736 0h-3.252v-19.02h3.252V216zm-3.516-24.064c0-.528.162-.973.484-1.336.322-.364.8-.545 1.433-.545.632 0 1.113.181 1.44.545.329.363.493.808.493 1.336 0 .527-.164.966-.492 1.318-.328.351-.809.527-1.442.527-.632 0-1.11-.176-1.432-.527-.322-.352-.484-.791-.484-1.318zm16.612 24.416c-2.578 0-4.676-.847-6.293-2.54-1.617-1.694-2.426-3.958-2.426-6.794v-.598c0-1.887.36-3.571 1.081-5.054.72-1.482 1.729-2.642 3.024-3.48 1.294-.838 2.698-1.257 4.21-1.257 2.472 0 4.394.814 5.765 2.443 1.371 1.63 2.057 3.961 2.057 6.996v1.354H115.79c.047 1.875.595 3.39 1.644 4.544 1.048 1.154 2.381 1.731 3.999 1.731 1.148 0 2.12-.234 2.918-.703a7.332 7.332 0 0 0 2.091-1.863l1.987 1.547c-1.594 2.449-3.985 3.674-7.172 3.674zm-.404-17.051c-1.313 0-2.415.477-3.305 1.432-.89.955-1.442 2.294-1.653 4.017h9.528v-.246c-.094-1.652-.54-2.933-1.336-3.84-.797-.91-1.875-1.363-3.234-1.363zm14.66-2.32l.105 2.39c1.453-1.828 3.352-2.742 5.695-2.742 4.02 0 6.047 2.267 6.082 6.803V216h-3.251v-12.586c-.012-1.371-.326-2.385-.94-3.041-.616-.656-1.574-.984-2.875-.984-1.055 0-1.98.28-2.777.843a5.73 5.73 0 0 0-1.864 2.215V216h-3.251v-19.02h3.076zm21.199-4.606v4.605h3.55v2.514h-3.55v11.795c0 .762.158 1.333.475 1.714.316.38.855.571 1.617.571.375 0 .89-.07 1.547-.21V216a9.428 9.428 0 0 1-2.497.352c-1.453 0-2.548-.44-3.287-1.319-.738-.879-1.107-2.127-1.107-3.744v-11.795h-3.463v-2.514h3.463v-4.605h3.252zM977.797 207.879c-.317 2.707-1.316 4.796-2.997 6.267-1.682 1.47-3.917 2.206-6.706 2.206-3.024 0-5.447-1.084-7.269-3.252-1.822-2.168-2.733-5.069-2.733-8.702v-2.46c0-2.38.425-4.471 1.274-6.276.85-1.805 2.054-3.19 3.613-4.157 1.558-.967 3.363-1.45 5.414-1.45 2.718 0 4.898.758 6.539 2.276 1.64 1.518 2.595 3.618 2.865 6.302h-3.393c-.293-2.04-.928-3.516-1.907-4.43-.978-.914-2.347-1.371-4.104-1.371-2.157 0-3.847.797-5.072 2.39-1.224 1.594-1.837 3.862-1.837 6.803v2.479c0 2.777.58 4.986 1.74 6.627 1.16 1.64 2.784 2.46 4.87 2.46 1.875 0 3.313-.424 4.315-1.274 1.002-.85 1.667-2.329 1.995-4.438h3.393zm7.629 8.121h-3.252v-27h3.252v27zm4.342-9.686c0-1.863.366-3.539 1.098-5.027.733-1.488 1.752-2.637 3.059-3.445 1.306-.809 2.798-1.213 4.473-1.213 2.59 0 4.685.896 6.285 2.69 1.6 1.792 2.399 4.177 2.399 7.154v.228c0 1.852-.354 3.513-1.063 4.984-.71 1.47-1.723 2.616-3.041 3.436-1.319.82-2.833 1.23-4.544 1.23-2.579 0-4.667-.896-6.267-2.689-1.6-1.793-2.4-4.166-2.4-7.119v-.229zm3.27.387c0 2.11.488 3.803 1.467 5.08.978 1.278 2.288 1.916 3.929 1.916 1.652 0 2.964-.647 3.937-1.942.973-1.295 1.46-3.109 1.46-5.44 0-2.086-.496-3.777-1.486-5.072s-2.306-1.942-3.947-1.942c-1.605 0-2.9.638-3.884 1.916-.985 1.277-1.477 3.105-1.477 5.484zm29.864 7.418c-1.265 1.488-3.123 2.233-5.572 2.233-2.027 0-3.571-.59-4.632-1.767-1.06-1.178-1.596-2.92-1.608-5.23V196.98h3.252v12.288c0 2.882 1.172 4.324 3.515 4.324 2.485 0 4.137-.926 4.957-2.778V196.98h3.252V216h-3.093l-.07-1.88zm7.313-7.787c0-2.918.691-5.265 2.074-7.04 1.383-1.775 3.193-2.663 5.432-2.663 2.226 0 3.99.762 5.29 2.285V189h3.253v27h-2.989l-.158-2.04c-1.3 1.595-3.111 2.392-5.431 2.392-2.204 0-4-.903-5.388-2.707-1.389-1.805-2.083-4.16-2.083-7.067v-.246zm3.252.37c0 2.155.445 3.843 1.336 5.062.89 1.218 2.12 1.828 3.691 1.828 2.063 0 3.569-.926 4.518-2.778v-8.736c-.973-1.793-2.467-2.69-4.483-2.69-1.593 0-2.836.616-3.726 1.846-.89 1.23-1.336 3.053-1.336 5.467zm30.885 9.298h-3.375v-25.594h3.375V216zm20.619-6.68h-10.723l-2.408 6.68h-3.48l9.773-25.594h2.953l9.791 25.594h-3.463l-2.443-6.68zm-9.703-2.777h8.7l-4.359-11.97-4.341 11.97zm23.414-16.137l8.367 20.883 8.367-20.883h4.377V216h-3.375v-9.967l.316-10.758-8.402 20.725h-2.584l-8.385-20.672.334 10.705V216h-3.375v-25.594h4.36z"/>
-    <g fill-rule="nonzero">
-      <path fill="#4285F4" d="M1119.539 72.397L1085.53 13.25a14.948 14.948 0 0 0-12.75-7.603h-68.03A14.935 14.935 0 0 0 992 13.25l-34.022 58.991a14.845 14.845 0 0 0 0 14.793l34.01 59.483a15.22 15.22 0 0 0 12.75 7.875h68.03a15.168 15.168 0 0 0 12.762-7.836l34.009-59.147a15.168 15.168 0 0 0 0-15.012z"/>
-      <path fill="#000" d="M1071.086 55.224l-50.43-1.086-3.88 44.612 2.935 10.086 45.517 45.517h7.54a15.168 15.168 0 0 0 12.762-7.836l28.06-48.789-42.504-42.504z" opacity=".07"/>
-      <path fill="#FFF" d="M1038.759 40.858l-32.328 14.366V76.78c0 19.94 13.797 38.573 32.328 43.1 18.53-4.527 32.327-23.173 32.327-43.1V55.224l-32.327-14.366zm0 15.22c5.713 0 10.344 4.631 10.344 10.344 0 5.714-4.631 10.345-10.344 10.345-5.714 0-10.345-4.631-10.345-10.345 0-5.713 4.631-10.344 10.345-10.344zm19.396 42.775c0 .258-.076.51-.22.725-.232.349-.465.71-.724 1.047a36.039 36.039 0 0 1-18.452 13.228 36.039 36.039 0 0 1-18.453-13.163c-.259-.337-.491-.699-.724-1.048a1.293 1.293 0 0 1-.22-.724v-5.806c0-7.927 12.931-11.922 19.397-11.922 6.465 0 19.396 3.982 19.396 11.922v5.741z"/>
-    </g>
-    <path fill="#000" fill-rule="nonzero" d="M596.754 740.299h9.297l-14.126 48.09h-13.222l-14.119-48.09h9.294l11.451 40.007 11.425-40.007zm35.18 47.997h-7.102l-.629-2.288a18.661 18.661 0 0 1-10.279 3.092c-6.32 0-9.022-4.4-9.022-10.444 0-7.153 3.058-9.871 10.092-9.871h8.309v-3.687c0-3.891-1.054-5.267-6.61-5.267a47.72 47.72 0 0 0-9.582 1.07l-1.053-6.711a44.618 44.618 0 0 1 11.876-1.648c10.874 0 14.068 3.89 14.068 12.692v23.056l-.068.006zm-8.665-13.257h-6.406c-2.837 0-3.636.798-3.636 3.457 0 2.656.799 3.526 3.483 3.526a13.372 13.372 0 0 0 6.542-1.808l.034-5.175h-.017zm22.291-21.824v24.503c0 1.878.798 2.815 2.786 2.815a23.682 23.682 0 0 0 9.04-2.952v-24.364h8.664v35.101h-6.609l-.85-3.044a34.213 34.213 0 0 1-13.779 3.755c-5.742 0-7.798-4.098-7.798-10.373v-25.451h8.597l-.051.01zm25.078 35.081v-49.441l8.665-1.212v50.677l-8.665-.024zm34.524-.732a23.749 23.749 0 0 1-7.595 1.376c-6.32 0-9.514-3.024-9.514-9.298v-19.573h-5.182v-6.881h5.199v-8.716l8.648-1.24v9.956h8.869l-.544 6.864h-8.325v18.315a2.841 2.841 0 0 0 .798 2.345 2.687 2.687 0 0 0 2.328.747 16.99 16.99 0 0 0 4.332-.713l1.037 6.779-.051.04zM548 535l87.194 175L723 535H548zm97.572 35.13h10.15v10.085h-10.15V570.13zm-20.212 40.693h-10.15V600.56h10.15v10.263zm0-15.214h-10.15v-10.262h10.15v10.262zm0-15.214h-10.15v-10.262h10.15v10.262zm15.329 45.53h-10.262v-10.15h10.262v10.15zm0-15.215h-10.262v-10.143h10.262v10.16-.017zm0-15.206h-10.262v-10.143h10.262v10.16-.017zm0-15.274h-10.262v-10.075h10.262v10.092-.017zm4.995 5.063h10.152v10.16h-10.28l.102-10.143.026-.017zm0 25.366v-10.075h10.152v10.16l-10.16-.068.008-.017z"/>
-    <g fill-rule="nonzero">
-      <g transform="translate(41 5)">
-        <use fill="#000" filter="url(#a)" xlink:href="#b"/>
-        <use fill="#FFF" xlink:href="#b"/>
-      </g>
-      <path fill="#9AA0A6" d="M95.418 75.588c-9.259 0-16.765-7.506-16.765-16.764 0-9.26 7.506-16.765 16.765-16.765s16.765 7.506 16.765 16.765c0 9.258-7.506 16.764-16.765 16.764zm42.353 0c-9.259 0-16.765-7.506-16.765-16.764 0-9.26 7.506-16.765 16.765-16.765s16.765 7.506 16.765 16.765c0 9.258-7.506 16.764-16.765 16.764zm-79.124 40.87v-16.161c6.602-9.804 18.77-14.706 36.507-14.706s29.906 4.902 36.508 14.706v16.16H58.647zm84.406.6c.022-10.111-.547-16.913-1.709-20.404-1.161-3.492-4.076-7.166-8.744-11.022 8.827-.005 16.767 1.004 23.818 3.027 7.052 2.023 13.235 5.99 18.547 11.9v16.499h-31.912z"/>
-    </g>
-    <path fill="#5F6368" fill-rule="nonzero" d="M413 82.75H261v12l-29-14.5 29-14.5v12h152v5zm324 0v-5h159v-12l29 14.5-29 14.5v-12H737z"/>
-    <path stroke="#5F6368" stroke-linecap="square" stroke-width="5" d="M727.5 628.5h311"/>
-    <path fill="#5F6368" fill-rule="nonzero" d="M1042 422h-5V288h-12l14.5-29 14.5 29h-12v134zm0 62v147h-5V484h5z"/>
-    <path fill="#3C4043" d="M449.255 89h-2.361V73.347l-4.736 1.739v-2.133l6.729-2.526h.368V89zm7.173-1.231c0-.407.12-.745.362-1.016.24-.27.603-.406 1.085-.406s.848.135 1.098.406c.25.27.375.61.375 1.016 0 .389-.125.715-.375.977s-.616.394-1.098.394c-.482 0-.844-.132-1.085-.394-.242-.262-.362-.588-.362-.977zm27.244-1.194c-.626.897-1.5 1.568-2.622 2.012-1.121.445-2.427.667-3.916.667-1.507 0-2.844-.353-4.012-1.06-1.168-.707-2.071-1.712-2.71-3.015-.64-1.304-.967-2.814-.984-4.533v-1.612c0-2.784.65-4.943 1.948-6.474 1.3-1.532 3.126-2.298 5.478-2.298 1.93 0 3.483.493 4.66 1.479 1.176.986 1.896 2.384 2.158 4.196h-2.438c-.457-2.446-1.912-3.67-4.367-3.67-1.633 0-2.871.574-3.713 1.72-.842 1.148-1.268 2.809-1.276 4.984v1.51c0 2.074.474 3.722 1.422 4.945.948 1.223 2.23 1.835 3.846 1.835.915 0 1.714-.102 2.4-.305.685-.203 1.252-.546 1.701-1.028v-4.152h-4.278v-1.98h6.703v6.78zm9.394 2.679c-1.862 0-3.377-.612-4.545-1.835-1.167-1.223-1.751-2.858-1.751-4.906v-.432c0-1.363.26-2.58.78-3.65.52-1.07 1.249-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.164 1.764.99 1.177 1.486 2.861 1.486 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.758.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.108-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.151 1.768-2.877 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.743.345-2.386 1.035-.644.69-1.041 1.657-1.194 2.901h6.881v-.178c-.068-1.193-.39-2.118-.965-2.774-.575-.656-1.354-.984-2.336-.984zm10.588-1.675l.076 1.726c1.05-1.32 2.421-1.98 4.114-1.98 2.903 0 4.367 1.637 4.392 4.913V89h-2.348v-9.09c-.009-.99-.235-1.722-.68-2.196-.444-.474-1.136-.711-2.075-.711-.762 0-1.43.203-2.006.61a4.138 4.138 0 0 0-1.346 1.599V89h-2.348V75.264h2.221zm17.825 13.99c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.78-3.65.52-1.07 1.249-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.165 1.764.99 1.177 1.485 2.861 1.485 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.758.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.108-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.15 1.768-2.877 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.744.345-2.387 1.035s-1.041 1.657-1.194 2.901h6.881v-.178c-.067-1.193-.389-2.118-.965-2.774-.575-.656-1.354-.984-2.335-.984zm15.005.432a7.038 7.038 0 0 0-1.155-.089c-1.54 0-2.585.656-3.136 1.968V89h-2.348V75.264h2.285l.038 1.587c.77-1.228 1.862-1.841 3.275-1.841.457 0 .804.059 1.041.177v2.184zM546.031 89c-.135-.27-.245-.753-.33-1.447-1.092 1.134-2.395 1.7-3.91 1.7-1.354 0-2.465-.382-3.333-1.148-.867-.766-1.3-1.737-1.3-2.914 0-1.43.543-2.54 1.63-3.332 1.088-.791 2.618-1.187 4.59-1.187h2.285v-1.08c0-.82-.245-1.474-.736-1.96-.491-.487-1.215-.73-2.171-.73-.838 0-1.54.211-2.108.634-.567.423-.85.935-.85 1.536h-2.361c0-.685.243-1.348.73-1.987.486-.639 1.146-1.144 1.98-1.517.834-.372 1.75-.558 2.749-.558 1.582 0 2.822.395 3.72 1.187.896.791 1.362 1.88 1.396 3.269v6.322c0 1.261.16 2.264.482 3.009V89h-2.463zm-3.897-1.79c.736 0 1.434-.19 2.095-.571.66-.381 1.138-.876 1.434-1.486v-2.818h-1.84c-2.878 0-4.317.842-4.317 2.526 0 .737.245 1.312.736 1.727.491.415 1.122.622 1.892.622zm12.746-15.272v3.326h2.564v1.815h-2.564v8.519c0 .55.114.962.343 1.237.228.276.617.413 1.168.413.27 0 .643-.05 1.117-.152V89a6.809 6.809 0 0 1-1.803.254c-1.05 0-1.84-.317-2.374-.952-.533-.635-.8-1.536-.8-2.704v-8.519h-2.5v-1.815h2.5v-3.326h2.349zm11.007 17.316c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.78-3.65.521-1.07 1.249-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.787 0 3.175.588 4.165 1.764.99 1.177 1.485 2.861 1.485 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.758.834 1.72 1.25 2.889 1.25.83 0 1.532-.168 2.107-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.15 1.768-2.877 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.744.345-2.387 1.035s-1.041 1.657-1.193 2.901h6.88v-.178c-.067-1.193-.389-2.118-.964-2.774-.576-.656-1.354-.984-2.336-.984zm20.617 3.822c-2.09-.601-3.612-1.34-4.564-2.216-.952-.876-1.428-1.957-1.428-3.243 0-1.456.582-2.66 1.745-3.612 1.164-.952 2.677-1.428 4.539-1.428 1.27 0 2.401.245 3.396.736.994.49 1.765 1.168 2.31 2.031.546.864.82 1.807.82 2.831h-2.45c0-1.117-.356-1.995-1.067-2.634-.711-.639-1.714-.958-3.01-.958-1.2 0-2.138.264-2.811.793s-1.01 1.263-1.01 2.203c0 .753.32 1.39.96 1.91.638.52 1.726.997 3.262 1.429 1.536.431 2.738.907 3.605 1.428.868.52 1.511 1.128 1.93 1.822.419.694.628 1.51.628 2.45 0 1.498-.584 2.697-1.752 3.599-1.168.901-2.73 1.352-4.684 1.352a8.688 8.688 0 0 1-3.555-.73c-1.1-.487-1.949-1.153-2.545-2-.597-.846-.895-1.807-.895-2.881h2.45c0 1.117.413 2 1.238 2.647.825.647 1.927.97 3.307.97 1.286 0 2.272-.262 2.958-.786.685-.525 1.028-1.24 1.028-2.146 0-.905-.317-1.606-.952-2.1-.635-.496-1.786-.985-3.453-1.467zM598.374 89h-2.349V75.264h2.349V89zm-2.539-17.38c0-.38.116-.702.35-.965.232-.262.577-.393 1.034-.393.457 0 .804.13 1.04.393.238.263.356.584.356.965s-.118.698-.355.952-.584.381-1.041.381c-.457 0-.802-.127-1.035-.38-.233-.255-.349-.572-.349-.953zm5.738 10.398c0-2.142.495-3.845 1.486-5.11.99-1.266 2.302-1.898 3.935-1.898 1.676 0 2.984.592 3.923 1.777l.114-1.523h2.146V88.67c0 1.777-.527 3.178-1.58 4.202-1.055 1.024-2.47 1.536-4.247 1.536-.99 0-1.96-.211-2.908-.635-.948-.423-1.671-1.002-2.17-1.739l1.218-1.409c1.007 1.244 2.239 1.866 3.695 1.866 1.142 0 2.033-.321 2.672-.965.639-.643.958-1.548.958-2.716v-1.181c-.939 1.083-2.221 1.625-3.846 1.625-1.608 0-2.91-.648-3.904-1.942-.995-1.295-1.492-3.06-1.492-5.294zm2.362.266c0 1.549.317 2.766.952 3.65.634.885 1.523 1.327 2.666 1.327 1.48 0 2.568-.673 3.262-2.019v-6.271c-.719-1.312-1.798-1.968-3.237-1.968-1.142 0-2.035.444-2.679 1.333-.643.889-.964 2.205-.964 3.948zm15.005-7.02l.077 1.726c1.05-1.32 2.42-1.98 4.113-1.98 2.903 0 4.367 1.637 4.392 4.913V89h-2.348v-9.09c-.009-.99-.235-1.722-.68-2.196-.444-.474-1.136-.711-2.075-.711-.762 0-1.43.203-2.006.61a4.138 4.138 0 0 0-1.346 1.599V89h-2.348V75.264h2.221zm17.825 13.99c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.78-3.65.521-1.07 1.249-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.165 1.764.99 1.177 1.485 2.861 1.485 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.758.834 1.72 1.25 2.889 1.25.829 0 1.531-.168 2.107-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.15 1.768-2.877 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.744.345-2.387 1.035s-1.041 1.657-1.193 2.901h6.88v-.178c-.067-1.193-.389-2.118-.964-2.774-.576-.656-1.355-.984-2.336-.984zm7.795 5.079c0-2.108.499-3.803 1.498-5.085.998-1.282 2.306-1.923 3.922-1.923 1.609 0 2.882.55 3.822 1.65V69.5h2.348V89H653.7l-.114-1.473c-.94 1.151-2.247 1.727-3.923 1.727-1.591 0-2.888-.652-3.891-1.955-1.003-1.304-1.504-3.005-1.504-5.104v-.177zm2.348.266c0 1.557.322 2.776.965 3.656.643.88 1.532 1.32 2.666 1.32 1.49 0 2.577-.668 3.263-2.005v-6.31c-.703-1.295-1.782-1.942-3.238-1.942-1.15 0-2.048.444-2.69 1.333-.644.889-.966 2.205-.966 3.948zm27.435-11.768h2.45v13.088c0 1.77-.531 3.153-1.593 4.152-1.062.999-2.478 1.498-4.247 1.498-1.836 0-3.267-.47-4.29-1.41-1.025-.939-1.537-2.255-1.537-3.948h2.437c0 1.058.29 1.884.87 2.476.58.593 1.42.889 2.52.889 1.007 0 1.822-.318 2.444-.952.622-.635.937-1.524.946-2.666V70.516zm10.588 12.657l.355 2.437.52-2.196 3.657-12.898h2.057l3.567 12.898.508 2.234.393-2.488 2.87-12.644h2.45L696.534 89h-2.221l-3.81-13.47-.291-1.409-.292 1.41L685.972 89h-2.222l-4.469-18.484h2.438l2.92 12.657zm32.03-10.652h-5.941V89h-2.425V72.521h-5.929v-2.005h14.295v2.005z"/>
-    <path fill="#5F6368" fill-rule="nonzero" d="M119 422h-5V248h5v174zm0 62v147h-5V484h5zM514 631H119v-5h395v-12l29 14.5-29 14.5z"/>
-    <path fill="#3C4043" d="M12.647 464H.537v-1.688l6.398-7.11c.947-1.075 1.601-1.949 1.961-2.621.36-.673.54-1.37.54-2.089 0-.965-.292-1.756-.876-2.374-.584-.618-1.363-.927-2.336-.927-1.168 0-2.076.333-2.724.997-.647.664-.97 1.589-.97 2.774H.18c0-1.701.549-3.077 1.645-4.126 1.096-1.05 2.562-1.574 4.399-1.574 1.718 0 3.076.45 4.075 1.352.999.901 1.498 2.1 1.498 3.599 0 1.82-1.16 3.986-3.479 6.5l-4.95 5.37h9.28V464zm2.78-1.231c0-.407.121-.745.363-1.016.24-.27.603-.406 1.085-.406s.848.135 1.098.406c.25.27.375.61.375 1.016 0 .389-.125.715-.375.977s-.616.394-1.098.394c-.482 0-.844-.132-1.085-.394-.242-.262-.362-.588-.362-.977zm19.044-7.008c-2.09-.601-3.612-1.34-4.564-2.216-.952-.876-1.428-1.957-1.428-3.243 0-1.456.581-2.66 1.745-3.612 1.164-.952 2.677-1.428 4.539-1.428 1.27 0 2.401.245 3.396.736.994.49 1.764 1.168 2.31 2.031.546.864.82 1.807.82 2.831h-2.451c0-1.117-.356-1.995-1.067-2.634-.71-.639-1.713-.958-3.008-.958-1.202 0-2.14.264-2.812.793-.673.529-1.01 1.263-1.01 2.203 0 .753.32 1.39.959 1.91s1.726.997 3.263 1.429c1.536.431 2.738.907 3.605 1.428.868.52 1.51 1.128 1.93 1.822.419.694.628 1.51.628 2.45 0 1.498-.584 2.697-1.752 3.599-1.168.901-2.73 1.352-4.684 1.352a8.688 8.688 0 0 1-3.555-.73c-1.1-.487-1.949-1.153-2.545-2-.597-.846-.895-1.807-.895-2.881h2.45c0 1.117.412 2 1.238 2.647.825.647 1.927.97 3.307.97 1.286 0 2.272-.262 2.958-.786.685-.525 1.028-1.24 1.028-2.146 0-.905-.317-1.606-.952-2.1-.635-.496-1.786-.985-3.453-1.467zm15.31 8.493c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.781-3.65.52-1.07 1.249-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.164 1.764.99 1.177 1.486 2.861 1.486 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.758.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.108-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.151 1.768-2.878 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.743.345-2.386 1.035-.644.69-1.041 1.657-1.194 2.901h6.881v-.178c-.068-1.193-.39-2.118-.965-2.774-.575-.656-1.354-.984-2.336-.984zm10.588-1.675l.076 1.726c1.05-1.32 2.42-1.98 4.114-1.98 2.903 0 4.367 1.637 4.392 4.913V464h-2.348v-9.09c-.009-.99-.235-1.722-.68-2.196-.444-.474-1.136-.711-2.075-.711-.762 0-1.43.203-2.006.61a4.138 4.138 0 0 0-1.346 1.599V464h-2.349v-13.736h2.222zm11.553 6.754c0-2.108.5-3.803 1.498-5.085.999-1.282 2.306-1.923 3.923-1.923 1.608 0 2.882.55 3.821 1.65v-7.16h2.349V464h-2.159l-.114-1.473c-.94 1.151-2.247 1.727-3.923 1.727-1.59 0-2.888-.652-3.89-1.955-1.004-1.304-1.505-3.005-1.505-5.104v-.177zm2.349.266c0 1.557.321 2.776.964 3.656.644.88 1.532 1.32 2.666 1.32 1.49 0 2.578-.668 3.263-2.005v-6.31c-.702-1.295-1.781-1.942-3.237-1.942-1.151 0-2.048.444-2.692 1.333-.643.889-.964 2.205-.964 3.948zm25.136-1.523c-2.09-.601-3.612-1.34-4.564-2.216-.952-.876-1.428-1.957-1.428-3.243 0-1.456.582-2.66 1.746-3.612 1.163-.952 2.676-1.428 4.538-1.428 1.27 0 2.402.245 3.396.736.995.49 1.765 1.168 2.31 2.031.547.864.82 1.807.82 2.831h-2.45c0-1.117-.356-1.995-1.067-2.634-.71-.639-1.714-.958-3.009-.958-1.202 0-2.139.264-2.812.793s-1.01 1.263-1.01 2.203c0 .753.32 1.39.96 1.91.638.52 1.726.997 3.262 1.429 1.536.431 2.738.907 3.606 1.428.867.52 1.51 1.128 1.93 1.822.418.694.628 1.51.628 2.45 0 1.498-.584 2.697-1.752 3.599-1.168.901-2.73 1.352-4.685 1.352a8.688 8.688 0 0 1-3.555-.73c-1.1-.487-1.948-1.153-2.545-2-.597-.846-.895-1.807-.895-2.881h2.45c0 1.117.413 2 1.238 2.647.825.647 1.928.97 3.307.97 1.287 0 2.273-.262 2.958-.786.686-.525 1.029-1.24 1.029-2.146 0-.905-.318-1.606-.953-2.1-.634-.496-1.785-.985-3.453-1.467zM111.277 464h-2.348v-13.736h2.348V464zm-2.539-17.38c0-.38.117-.702.35-.965.232-.262.577-.393 1.034-.393.457 0 .804.13 1.041.393.237.263.356.584.356.965s-.119.698-.356.952-.584.381-1.04.381c-.458 0-.803-.127-1.036-.38-.232-.255-.349-.572-.349-.953zm5.739 10.398c0-2.142.495-3.845 1.485-5.11.99-1.266 2.302-1.898 3.935-1.898 1.676 0 2.984.592 3.923 1.777l.115-1.523h2.145v13.406c0 1.777-.527 3.178-1.58 4.202-1.054 1.024-2.47 1.536-4.247 1.536-.99 0-1.96-.211-2.907-.635-.948-.423-1.672-1.002-2.171-1.739l1.219-1.409c1.007 1.244 2.238 1.866 3.694 1.866 1.142 0 2.033-.321 2.672-.965.64-.643.959-1.548.959-2.716v-1.181c-.94 1.083-2.222 1.625-3.847 1.625-1.608 0-2.91-.648-3.904-1.942-.994-1.295-1.491-3.06-1.491-5.294zm2.36.266c0 1.549.318 2.766.953 3.65.635.885 1.523 1.327 2.666 1.327 1.481 0 2.569-.673 3.263-2.019v-6.271c-.72-1.312-1.799-1.968-3.238-1.968-1.142 0-2.035.444-2.678 1.333-.643.889-.965 2.205-.965 3.948zm15.007-7.02l.076 1.726c1.05-1.32 2.42-1.98 4.113-1.98 2.903 0 4.367 1.637 4.393 4.913V464h-2.349v-9.09c-.008-.99-.235-1.722-.68-2.196-.443-.474-1.135-.711-2.075-.711-.761 0-1.43.203-2.006.61a4.138 4.138 0 0 0-1.345 1.599V464h-2.349v-13.736h2.222zm17.824 13.99c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.78-3.65.521-1.07 1.25-1.908 2.184-2.514a5.49 5.49 0 0 1 3.041-.907c1.786 0 3.174.588 4.164 1.764.99 1.177 1.485 2.861 1.485 5.053v.978h-9.305c.034 1.354.43 2.448 1.187 3.281.757.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.107-.507a5.295 5.295 0 0 0 1.511-1.346l1.435 1.118c-1.151 1.768-2.878 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.744.345-2.387 1.035s-1.04 1.657-1.193 2.901h6.88v-.178c-.067-1.193-.389-2.118-.964-2.774-.576-.656-1.354-.984-2.336-.984zm7.795 5.079c0-2.108.5-3.803 1.498-5.085.999-1.282 2.306-1.923 3.923-1.923 1.608 0 2.882.55 3.821 1.65v-7.16h2.349V464h-2.158l-.115-1.473c-.94 1.151-2.247 1.727-3.923 1.727-1.59 0-2.888-.652-3.89-1.955-1.004-1.304-1.505-3.005-1.505-5.104v-.177zm2.349.266c0 1.557.321 2.776.964 3.656.644.88 1.532 1.32 2.666 1.32 1.49 0 2.578-.668 3.263-2.005v-6.31c-.702-1.295-1.781-1.942-3.237-1.942-1.151 0-2.048.444-2.692 1.333-.643.889-.964 2.205-.964 3.948zm27.434-11.768h2.45v13.088c0 1.77-.53 3.153-1.593 4.152-1.062.999-2.478 1.498-4.247 1.498-1.836 0-3.266-.47-4.29-1.41-1.025-.939-1.537-2.255-1.537-3.948h2.438c0 1.058.29 1.884.87 2.476.58.593 1.42.889 2.52.889 1.007 0 1.821-.318 2.443-.952.622-.635.938-1.524.946-2.666v-13.127zm10.588 12.657l.355 2.437.521-2.196 3.656-12.898h2.057l3.567 12.898.508 2.234.394-2.488 2.869-12.644h2.45L209.437 464h-2.221l-3.809-13.47-.292-1.409-.292 1.41L198.875 464h-2.222l-4.468-18.484h2.437l2.92 12.657zm32.03-10.652h-5.941V464h-2.425v-16.479h-5.929v-2.005h14.295v2.005zM899.951 453.615h1.765c1.109-.017 1.98-.309 2.615-.876.635-.567.952-1.333.952-2.298 0-2.166-1.079-3.25-3.237-3.25-1.016 0-1.826.29-2.431.87-.605.58-.908 1.348-.908 2.304h-2.349c0-1.464.536-2.68 1.606-3.65 1.071-.969 2.431-1.453 4.082-1.453 1.743 0 3.11.461 4.1 1.384.99.922 1.486 2.204 1.486 3.846 0 .804-.26 1.583-.78 2.336-.521.753-1.23 1.316-2.127 1.689 1.015.321 1.8.854 2.355 1.6.554.744.831 1.654.831 2.729 0 1.659-.542 2.975-1.625 3.948-1.083.973-2.492 1.46-4.227 1.46-1.735 0-3.147-.47-4.234-1.41-1.088-.939-1.632-2.179-1.632-3.719h2.362c0 .973.317 1.752.952 2.336.635.584 1.485.876 2.552.876 1.134 0 2.001-.296 2.602-.889.601-.592.902-1.443.902-2.552 0-1.074-.33-1.9-.99-2.475-.66-.576-1.613-.872-2.857-.889h-1.765v-1.917zm11.477 9.154c0-.407.12-.745.362-1.016.24-.27.603-.406 1.085-.406s.848.135 1.098.406c.25.27.375.61.375 1.016 0 .389-.125.715-.375.977s-.616.394-1.098.394c-.482 0-.844-.132-1.085-.394-.242-.262-.362-.588-.362-.977zm19.716-2.006l5.28-15.247h2.667L932.235 464h-2.158l-6.843-18.484h2.654l5.256 15.247zm15.196 3.49c-1.862 0-3.377-.61-4.545-1.834-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.78-3.65.521-1.07 1.25-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.787 0 3.175.588 4.165 1.764.99 1.177 1.485 2.861 1.485 5.053v.978h-9.305c.033 1.354.43 2.448 1.187 3.281.757.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.107-.507a5.295 5.295 0 0 0 1.511-1.346l1.435 1.118c-1.152 1.768-2.878 2.653-5.18 2.653zm-.292-12.314c-.948 0-1.744.345-2.387 1.035s-1.04 1.657-1.193 2.901h6.88v-.178c-.067-1.193-.389-2.118-.964-2.774-.576-.656-1.354-.984-2.336-.984zm15.006.432a7.038 7.038 0 0 0-1.156-.089c-1.54 0-2.585.656-3.135 1.968V464h-2.349v-13.736h2.285l.038 1.587c.77-1.228 1.862-1.841 3.276-1.841.457 0 .804.059 1.04.178v2.183zm4.71 11.629h-2.349v-13.736h2.349V464zm-2.54-17.38c0-.38.117-.702.35-.965.232-.262.577-.393 1.034-.393.457 0 .804.13 1.041.393.237.263.356.584.356.965s-.119.698-.356.952-.584.381-1.04.381c-.458 0-.803-.127-1.035-.38-.233-.255-.35-.572-.35-.953zm7.453 17.38v-11.92h-2.171v-1.816h2.17v-1.41c0-1.472.394-2.61 1.181-3.415.788-.804 1.9-1.206 3.34-1.206.541 0 1.078.072 1.612.216l-.127 1.905a6.745 6.745 0 0 0-1.27-.115c-.762 0-1.35.222-1.765.667-.414.444-.622 1.081-.622 1.91v1.448h2.933v1.815h-2.933V464h-2.348zm12.365-3.44l3.2-10.296h2.513l-5.523 15.856c-.854 2.285-2.213 3.428-4.075 3.428l-.444-.038-.876-.165v-1.905l.635.051c.795 0 1.415-.16 1.86-.482.444-.322.81-.91 1.098-1.765l.52-1.396-4.9-13.584h2.564l3.428 10.296zm20.059-4.8c-2.09-.6-3.612-1.339-4.564-2.215-.953-.876-1.429-1.957-1.429-3.243 0-1.456.582-2.66 1.746-3.612 1.164-.952 2.677-1.428 4.539-1.428 1.27 0 2.401.245 3.396.736.994.49 1.764 1.168 2.31 2.031.546.864.819 1.807.819 2.831h-2.45c0-1.117-.356-1.995-1.067-2.634-.71-.639-1.713-.958-3.008-.958-1.202 0-2.14.264-2.812.793-.673.529-1.01 1.263-1.01 2.203 0 .753.32 1.39.959 1.91s1.726.997 3.262 1.429c1.537.431 2.738.907 3.606 1.428.867.52 1.51 1.128 1.93 1.822.419.694.628 1.51.628 2.45 0 1.498-.584 2.697-1.752 3.599-1.168.901-2.73 1.352-4.684 1.352a8.688 8.688 0 0 1-3.555-.73c-1.1-.487-1.949-1.153-2.546-2-.596-.846-.895-1.807-.895-2.881h2.45c0 1.117.413 2 1.238 2.647.826.647 1.928.97 3.308.97 1.286 0 2.272-.262 2.958-.786.685-.525 1.028-1.24 1.028-2.146 0-.905-.318-1.606-.952-2.1-.635-.496-1.786-.985-3.453-1.467zm15.31 8.494c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.781-3.65.52-1.07 1.248-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.164 1.764.99 1.177 1.486 2.861 1.486 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.757.834 1.72 1.25 2.888 1.25.83 0 1.532-.168 2.108-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.151 1.768-2.878 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.743.345-2.387 1.035-.643.69-1.04 1.657-1.193 2.901h6.88v-.178c-.067-1.193-.388-2.118-.964-2.774-.575-.656-1.354-.984-2.336-.984zm15.006.432a7.038 7.038 0 0 0-1.155-.089c-1.54 0-2.586.656-3.136 1.968V464h-2.349v-13.736h2.286l.038 1.587c.77-1.228 1.862-1.841 3.275-1.841.457 0 .804.059 1.041.178v2.183zm6.919 8.442l3.402-10.55h2.4L1040.92 464h-1.79l-4.977-13.736h2.4l3.49 10.55zm10.613 3.187h-2.348v-13.736h2.348V464zm-2.539-17.38c0-.38.117-.702.35-.965.232-.262.577-.393 1.034-.393.457 0 .804.13 1.041.393.237.263.355.584.355.965s-.118.698-.355.952-.584.381-1.041.381c-.457 0-.802-.127-1.035-.38-.232-.255-.349-.572-.349-.953zm11.807 15.717c.838 0 1.57-.254 2.196-.762.626-.508.973-1.142 1.041-1.904h2.222c-.043.787-.313 1.536-.813 2.247-.5.71-1.166 1.278-2 1.701a5.77 5.77 0 0 1-2.646.635c-1.87 0-3.358-.624-4.463-1.873-1.104-1.248-1.656-2.956-1.656-5.122v-.394c0-1.337.245-2.526.736-3.567.49-1.041 1.195-1.85 2.114-2.425.918-.575 2.004-.863 3.256-.863 1.54 0 2.82.461 3.84 1.384 1.02.922 1.564 2.12 1.632 3.592h-2.222c-.068-.888-.404-1.618-1.01-2.19-.604-.57-1.351-.857-2.24-.857-1.193 0-2.118.43-2.774 1.289-.656.86-.984 2.101-.984 3.726v.444c0 1.583.326 2.802.978 3.657.652.855 1.583 1.282 2.793 1.282zm13.8 1.917c-1.862 0-3.377-.612-4.545-1.835-1.168-1.223-1.752-2.858-1.752-4.906v-.432c0-1.363.26-2.58.78-3.65.521-1.07 1.249-1.908 2.184-2.514a5.49 5.49 0 0 1 3.04-.907c1.786 0 3.174.588 4.165 1.764.99 1.177 1.485 2.861 1.485 5.053v.978h-9.306c.034 1.354.43 2.448 1.187 3.281.758.834 1.72 1.25 2.889 1.25.829 0 1.531-.168 2.107-.507a5.295 5.295 0 0 0 1.51-1.346l1.435 1.118c-1.15 1.768-2.877 2.653-5.18 2.653zm-.292-12.315c-.948 0-1.744.345-2.387 1.035s-1.041 1.657-1.193 2.901h6.88v-.178c-.067-1.193-.389-2.118-.964-2.774-.576-.656-1.355-.984-2.336-.984zm25.378 7.237h-7.745l-1.739 4.824h-2.514l7.06-18.484h2.132l7.071 18.484h-2.5l-1.765-4.824zm-7.008-2.006h6.284l-3.149-8.646-3.135 8.646zm18.903 5.167c.838 0 1.57-.254 2.196-.762.627-.508.974-1.142 1.041-1.904h2.222c-.042.787-.313 1.536-.812 2.247-.5.71-1.166 1.278-2 1.701a5.77 5.77 0 0 1-2.647.635c-1.87 0-3.358-.624-4.462-1.873-1.105-1.248-1.657-2.956-1.657-5.122v-.394c0-1.337.245-2.526.736-3.567.491-1.041 1.196-1.85 2.114-2.425.918-.575 2.004-.863 3.256-.863 1.54 0 2.82.461 3.84 1.384 1.02.922 1.564 2.12 1.632 3.592h-2.222c-.067-.888-.404-1.618-1.009-2.19-.605-.57-1.352-.857-2.24-.857-1.194 0-2.119.43-2.775 1.289-.655.86-.983 2.101-.983 3.726v.444c0 1.583.325 2.802.977 3.657.652.855 1.583 1.282 2.793 1.282zm13.61 0c.837 0 1.57-.254 2.196-.762.626-.508.973-1.142 1.04-1.904h2.222c-.042.787-.313 1.536-.812 2.247-.5.71-1.166 1.278-2 1.701a5.77 5.77 0 0 1-2.647.635c-1.87 0-3.357-.624-4.462-1.873-1.104-1.248-1.657-2.956-1.657-5.122v-.394c0-1.337.246-2.526.737-3.567.49-1.041 1.195-1.85 2.113-2.425.919-.575 2.004-.863 3.257-.863 1.54 0 2.82.461 3.84 1.384 1.02.922 1.564 2.12 1.631 3.592h-2.221c-.068-.888-.404-1.618-1.01-2.19-.605-.57-1.352-.857-2.24-.857-1.194 0-2.118.43-2.774 1.289-.656.86-.984 2.101-.984 3.726v.444c0 1.583.326 2.802.977 3.657.652.855 1.583 1.282 2.793 1.282zm7.477-5.332c0-1.346.264-2.556.793-3.631.53-1.075 1.266-1.904 2.21-2.488.943-.584 2.02-.876 3.23-.876 1.87 0 3.384.647 4.539 1.942 1.155 1.295 1.733 3.017 1.733 5.167v.165c0 1.337-.256 2.537-.768 3.6-.512 1.061-1.244 1.889-2.197 2.481-.952.593-2.046.889-3.281.889-1.862 0-3.37-.648-4.526-1.942-1.155-1.295-1.733-3.01-1.733-5.142v-.165zm2.361.28c0 1.523.354 2.746 1.06 3.668.707.923 1.653 1.384 2.838 1.384 1.193 0 2.141-.468 2.844-1.403.702-.935 1.053-2.245 1.053-3.93 0-1.506-.357-2.726-1.073-3.662-.715-.935-1.665-1.403-2.85-1.403-1.16 0-2.094.462-2.805 1.384-.711.923-1.067 2.243-1.067 3.961zm21.57 5.357c-.914 1.074-2.256 1.612-4.025 1.612-1.464 0-2.579-.425-3.345-1.276-.766-.85-1.153-2.11-1.162-3.777v-8.937h2.349v8.874c0 2.082.846 3.123 2.54 3.123 1.793 0 2.987-.669 3.58-2.006v-9.991h2.348V464h-2.235l-.05-1.358zm8.074-12.378l.076 1.726c1.05-1.32 2.42-1.98 4.113-1.98 2.903 0 4.367 1.637 4.393 4.913V464h-2.349v-9.09c-.008-.99-.235-1.722-.679-2.196-.444-.474-1.136-.711-2.076-.711-.761 0-1.43.203-2.005.61a4.138 4.138 0 0 0-1.346 1.599V464h-2.349v-13.736h2.222zm15.31-3.327v3.327h2.565v1.815h-2.565v8.519c0 .55.115.962.343 1.237.229.276.618.413 1.168.413.271 0 .643-.05 1.117-.152V464a6.809 6.809 0 0 1-1.802.254c-1.05 0-1.841-.317-2.374-.952-.534-.635-.8-1.536-.8-2.704v-8.519h-2.501v-1.815h2.5v-3.327h2.35z"/>
-  </g>
-</svg>
diff --git a/website/public/img/vault-ha-consul-2.png b/website/public/img/vault-ha-consul-2.png
deleted file mode 100644
index 10ba99d3584..00000000000
Binary files a/website/public/img/vault-ha-consul-2.png and /dev/null differ
diff --git a/website/public/img/vault-ha-consul-3.png b/website/public/img/vault-ha-consul-3.png
deleted file mode 100644
index 9fad2c3915d..00000000000
Binary files a/website/public/img/vault-ha-consul-3.png and /dev/null differ
diff --git a/website/public/img/vault-ha-consul.png b/website/public/img/vault-ha-consul.png
deleted file mode 100644
index 77260deccdb..00000000000
Binary files a/website/public/img/vault-ha-consul.png and /dev/null differ
diff --git a/website/public/img/vault-hsm-autounseal.png b/website/public/img/vault-hsm-autounseal.png
deleted file mode 100644
index 30ea828ad71..00000000000
Binary files a/website/public/img/vault-hsm-autounseal.png and /dev/null differ
diff --git a/website/public/img/vault-identity-doc-1.png b/website/public/img/vault-identity-doc-1.png
deleted file mode 100644
index c5f75debbdd..00000000000
Binary files a/website/public/img/vault-identity-doc-1.png and /dev/null differ
diff --git a/website/public/img/vault-identity-doc-2.png b/website/public/img/vault-identity-doc-2.png
deleted file mode 100644
index 228a251f41e..00000000000
Binary files a/website/public/img/vault-identity-doc-2.png and /dev/null differ
diff --git a/website/public/img/vault-identity-doc-3.png b/website/public/img/vault-identity-doc-3.png
deleted file mode 100644
index 221fdb85f86..00000000000
Binary files a/website/public/img/vault-identity-doc-3.png and /dev/null differ
diff --git a/website/public/img/vault-identity-doc-4.png b/website/public/img/vault-identity-doc-4.png
deleted file mode 100644
index 4792922bf47..00000000000
Binary files a/website/public/img/vault-identity-doc-4.png and /dev/null differ
diff --git a/website/public/img/vault-identity-doc-5.png b/website/public/img/vault-identity-doc-5.png
deleted file mode 100644
index 63caf09af21..00000000000
Binary files a/website/public/img/vault-identity-doc-5.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-1.png b/website/public/img/vault-java-demo-1.png
deleted file mode 100644
index b3405f469d8..00000000000
Binary files a/website/public/img/vault-java-demo-1.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-10.png b/website/public/img/vault-java-demo-10.png
deleted file mode 100644
index e38a7747232..00000000000
Binary files a/website/public/img/vault-java-demo-10.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-11.png b/website/public/img/vault-java-demo-11.png
deleted file mode 100644
index 189fd0a0821..00000000000
Binary files a/website/public/img/vault-java-demo-11.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-2.png b/website/public/img/vault-java-demo-2.png
deleted file mode 100644
index 9af9c41304a..00000000000
Binary files a/website/public/img/vault-java-demo-2.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-3.png b/website/public/img/vault-java-demo-3.png
deleted file mode 100644
index ec7dc0edaa1..00000000000
Binary files a/website/public/img/vault-java-demo-3.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-4.png b/website/public/img/vault-java-demo-4.png
deleted file mode 100644
index ad59bbcdcb6..00000000000
Binary files a/website/public/img/vault-java-demo-4.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-5.png b/website/public/img/vault-java-demo-5.png
deleted file mode 100644
index 893eb0b6f64..00000000000
Binary files a/website/public/img/vault-java-demo-5.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-6.png b/website/public/img/vault-java-demo-6.png
deleted file mode 100644
index f2e8e9302c6..00000000000
Binary files a/website/public/img/vault-java-demo-6.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-7.png b/website/public/img/vault-java-demo-7.png
deleted file mode 100644
index dd6a4ff7289..00000000000
Binary files a/website/public/img/vault-java-demo-7.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-8.png b/website/public/img/vault-java-demo-8.png
deleted file mode 100644
index a367a2248c2..00000000000
Binary files a/website/public/img/vault-java-demo-8.png and /dev/null differ
diff --git a/website/public/img/vault-java-demo-9.png b/website/public/img/vault-java-demo-9.png
deleted file mode 100644
index 42d405c30dd..00000000000
Binary files a/website/public/img/vault-java-demo-9.png and /dev/null differ
diff --git a/website/public/img/vault-key-rotate.png b/website/public/img/vault-key-rotate.png
deleted file mode 100644
index 81479010f27..00000000000
Binary files a/website/public/img/vault-key-rotate.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-0.png b/website/public/img/vault-mount-filter-0.png
deleted file mode 100644
index bb3e7533408..00000000000
Binary files a/website/public/img/vault-mount-filter-0.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-10.png b/website/public/img/vault-mount-filter-10.png
deleted file mode 100644
index fec646c82b5..00000000000
Binary files a/website/public/img/vault-mount-filter-10.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-11.png b/website/public/img/vault-mount-filter-11.png
deleted file mode 100644
index 57254051589..00000000000
Binary files a/website/public/img/vault-mount-filter-11.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-12.png b/website/public/img/vault-mount-filter-12.png
deleted file mode 100644
index 43f32cc2b69..00000000000
Binary files a/website/public/img/vault-mount-filter-12.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-13.png b/website/public/img/vault-mount-filter-13.png
deleted file mode 100644
index a68e2c0e54e..00000000000
Binary files a/website/public/img/vault-mount-filter-13.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-2.png b/website/public/img/vault-mount-filter-2.png
deleted file mode 100644
index df218fffc2a..00000000000
Binary files a/website/public/img/vault-mount-filter-2.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-3.png b/website/public/img/vault-mount-filter-3.png
deleted file mode 100644
index 063d043da5c..00000000000
Binary files a/website/public/img/vault-mount-filter-3.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-4.png b/website/public/img/vault-mount-filter-4.png
deleted file mode 100644
index b85878b1d7b..00000000000
Binary files a/website/public/img/vault-mount-filter-4.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-5.png b/website/public/img/vault-mount-filter-5.png
deleted file mode 100644
index fa4a0b71139..00000000000
Binary files a/website/public/img/vault-mount-filter-5.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-6.png b/website/public/img/vault-mount-filter-6.png
deleted file mode 100644
index 4f8fcbafd99..00000000000
Binary files a/website/public/img/vault-mount-filter-6.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-7.png b/website/public/img/vault-mount-filter-7.png
deleted file mode 100644
index 90a4e871b0b..00000000000
Binary files a/website/public/img/vault-mount-filter-7.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-8.png b/website/public/img/vault-mount-filter-8.png
deleted file mode 100644
index 7417b3b1767..00000000000
Binary files a/website/public/img/vault-mount-filter-8.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter-9.png b/website/public/img/vault-mount-filter-9.png
deleted file mode 100644
index c1824d682c7..00000000000
Binary files a/website/public/img/vault-mount-filter-9.png and /dev/null differ
diff --git a/website/public/img/vault-mount-filter.png b/website/public/img/vault-mount-filter.png
deleted file mode 100644
index 662a0632431..00000000000
Binary files a/website/public/img/vault-mount-filter.png and /dev/null differ
diff --git a/website/public/img/vault-multi-tenant-1.png b/website/public/img/vault-multi-tenant-1.png
deleted file mode 100644
index 08a03b0e3e5..00000000000
Binary files a/website/public/img/vault-multi-tenant-1.png and /dev/null differ
diff --git a/website/public/img/vault-multi-tenant-2.png b/website/public/img/vault-multi-tenant-2.png
deleted file mode 100644
index ab900a9d271..00000000000
Binary files a/website/public/img/vault-multi-tenant-2.png and /dev/null differ
diff --git a/website/public/img/vault-multi-tenant-3.png b/website/public/img/vault-multi-tenant-3.png
deleted file mode 100644
index 8168ca86ac5..00000000000
Binary files a/website/public/img/vault-multi-tenant-3.png and /dev/null differ
diff --git a/website/public/img/vault-multi-tenant-4.png b/website/public/img/vault-multi-tenant-4.png
deleted file mode 100644
index a2a4bcddb9c..00000000000
Binary files a/website/public/img/vault-multi-tenant-4.png and /dev/null differ
diff --git a/website/public/img/vault-multi-tenant-5.png b/website/public/img/vault-multi-tenant-5.png
deleted file mode 100644
index 8ff0a76e661..00000000000
Binary files a/website/public/img/vault-multi-tenant-5.png and /dev/null differ
diff --git a/website/public/img/vault-multi-tenant-6.png b/website/public/img/vault-multi-tenant-6.png
deleted file mode 100644
index 7e118d5cf55..00000000000
Binary files a/website/public/img/vault-multi-tenant-6.png and /dev/null differ
diff --git a/website/public/img/vault-multi-tenant-7.png b/website/public/img/vault-multi-tenant-7.png
deleted file mode 100644
index a2a4bcddb9c..00000000000
Binary files a/website/public/img/vault-multi-tenant-7.png and /dev/null differ
diff --git a/website/public/img/vault-multi-tenant-8.png b/website/public/img/vault-multi-tenant-8.png
deleted file mode 100644
index 0b95c01e4c2..00000000000
Binary files a/website/public/img/vault-multi-tenant-8.png and /dev/null differ
diff --git a/website/public/img/vault-multi-tenant.png b/website/public/img/vault-multi-tenant.png
deleted file mode 100644
index e6f679cb4c6..00000000000
Binary files a/website/public/img/vault-multi-tenant.png and /dev/null differ
diff --git a/website/public/img/vault-password-policy-chance.svg b/website/public/img/vault-password-policy-chance.svg
deleted file mode 100644
index 6570e34f766..00000000000
--- a/website/public/img/vault-password-policy-chance.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg version="1.1" viewBox="0.0 0.0 757.0 468.0" fill="none" stroke="none" stroke-linecap="square" stroke-miterlimit="10" width="757" height="468" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg"><path fill="#ffffff" d="M0 0L757.0 0L757.0 468.0L0 468.0L0 0Z" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M106.5 70.5L106.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M210.5 70.5L210.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M315.5 70.5L315.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M419.5 70.5L419.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M524.5 70.5L524.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M629.5 70.5L629.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M733.5 70.5L733.5 392.5" fill-rule="nonzero"/><path stroke="#333333" stroke-width="1.0" stroke-linecap="butt" d="M85.5 392.5L733.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M85.5 311.5L733.5 311.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M85.5 231.5L733.5 231.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M85.5 150.5L733.5 150.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M85.5 70.5L733.5 70.5" fill-rule="nonzero"/><clipPath id="id_0"><path d="M85.4 70.0L733.6 70.0L733.6 392.6L85.4 392.6L85.4 70.0Z" clip-rule="nonzero"/></clipPath><path stroke="#4285f4" stroke-width="2.0" stroke-linecap="butt" clip-path="url(#id_0)" d="M85.4 228.8176L95.854836 208.90689L106.30968 191.52L116.76452 176.42986L127.21935 163.36752L137.6742 152.06392L148.12903 142.27042L158.58388 133.76714L169.03871 126.36464L179.49355 119.90208L189.94838 114.24402L200.40323 109.27682L210.85806 104.90512L221.3129 101.0488L231.76775 97.640236L242.22258 94.622154L252.67741 91.94577L263.13226 89.569336L273.5871 87.45691L284.04193 85.577446L294.49677 83.90395L304.9516 82.41292L315.40646 81.083725L325.8613 79.8983L336.31613 78.8407L346.77097 77.896866L357.2258 77.054344L367.68063 76.302124L378.1355 75.63041L388.59033 75.0305L399.04517 74.49467L409.5 74.01602L419.95483 73.58843L430.40967 73.20643L440.8645 72.865135L451.31937 72.560196L461.7742 72.287735L472.22903 72.04429L482.68387 71.82676L493.1387 71.63239L503.59354 71.4587L514.0484 71.303505L524.50323 71.16482L534.95807 71.04089L545.4129 70.93015L555.86774 70.83119L566.3226 70.74277L576.7774 70.66374L587.23224 70.59313L597.6871 70.53003L608.1419 70.47364L618.5968 70.423256L629.05164 70.37823L639.5065 70.33799L649.9613 70.30203L660.41614 70.269905L670.871 70.24119L681.3258 70.21553L691.78064 70.192604L702.2355 70.17211L712.6903 70.1538L723.14514 70.13744L733.6 70.12282" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M88.4 228.8176C88.4 230.47446 87.056854 231.8176 85.4 231.8176C83.74315 231.8176 82.4 230.47446 82.4 228.8176C82.4 227.16075 83.74315 225.8176 85.4 225.8176C87.056854 225.8176 88.4 227.16075 88.4 228.8176Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M98.854836 208.90689C98.854836 210.56375 97.511696 211.90689 95.854836 211.90689C94.19798 211.90689 92.854836 210.56375 92.854836 208.90689C92.854836 207.25005 94.19798 205.90689 95.854836 205.90689C97.511696 205.90689 98.854836 207.25005 98.854836 208.90689Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M109.30968 191.52C109.30968 193.17686 107.96653 194.52 106.30968 194.52C104.652824 194.52 103.30968 193.17686 103.30968 191.52C103.30968 189.86314 104.652824 188.52 106.30968 188.52C107.96653 188.52 109.30968 189.86314 109.30968 191.52Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M119.76452 176.42986C119.76452 178.08672 118.42137 179.42986 116.76452 179.42986C115.10766 179.42986 113.76452 178.08672 113.76452 176.42986C113.76452 174.773 115.10766 173.42986 116.76452 173.42986C118.42137 173.42986 119.76452 174.773 119.76452 176.42986Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M130.21936 163.36752C130.21936 165.02438 128.8762 166.36752 127.21935 166.36752C125.5625 166.36752 124.21935 165.02438 124.21935 163.36752C124.21935 161.71068 125.5625 160.36752 127.21935 160.36752C128.8762 160.36752 130.21936 161.71068 130.21936 163.36752Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M140.6742 152.06392C140.6742 153.72078 139.33105 155.06392 137.6742 155.06392C136.01733 155.06392 134.6742 153.72078 134.6742 152.06392C134.6742 150.40707 136.01733 149.06392 137.6742 149.06392C139.33105 149.06392 140.6742 150.40707 140.6742 152.06392Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M151.12903 142.27042C151.12903 143.92726 149.78589 145.27042 148.12903 145.27042C146.47218 145.27042 145.12903 143.92726 145.12903 142.27042C145.12903 140.61356 146.47218 139.27042 148.12903 139.27042C149.78589 139.27042 151.12903 140.61356 151.12903 142.27042Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M161.58388 133.76714C161.58388 135.424 160.24072 136.76714 158.58388 136.76714C156.92702 136.76714 155.58388 135.424 155.58388 133.76714C155.58388 132.11029 156.92702 130.76714 158.58388 130.76714C160.24072 130.76714 161.58388 132.11029 161.58388 133.76714Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M172.03871 126.36464C172.03871 128.0215 170.69556 129.36464 169.03871 129.36464C167.38185 129.36464 166.03871 128.0215 166.03871 126.36464C166.03871 124.70779 167.38185 123.36464 169.03871 123.36464C170.69556 123.36464 172.03871 124.70779 172.03871 126.36464Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M182.49355 119.90208C182.49355 121.55893 181.1504 122.90208 179.49355 122.90208C177.8367 122.90208 176.49355 121.55893 176.49355 119.90208C176.49355 118.245224 177.8367 116.90208 179.49355 116.90208C181.1504 116.90208 182.49355 118.245224 182.49355 119.90208Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M192.94838 114.24402C192.94838 115.90087 191.60524 117.24402 189.94838 117.24402C188.29153 117.24402 186.94838 115.90087 186.94838 114.24402C186.94838 112.587166 188.29153 111.24402 189.94838 111.24402C191.60524 111.24402 192.94838 112.587166 192.94838 114.24402Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M203.40323 109.27682C203.40323 110.93367 202.06007 112.27682 200.40323 112.27682C198.74637 112.27682 197.40323 110.93367 197.40323 109.27682C197.40323 107.61996 198.74637 106.27682 200.40323 106.27682C202.06007 106.27682 203.40323 107.61996 203.40323 109.27682Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M213.85806 104.90512C213.85806 106.56197 212.51492 107.90512 210.85806 107.90512C209.20122 107.90512 207.85806 106.56197 207.85806 104.90512C207.85806 103.24827 209.20122 101.90512 210.85806 101.90512C212.51492 101.90512 213.85806 103.24827 213.85806 104.90512Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M224.3129 101.0488C224.3129 102.70565 222.96976 104.0488 221.3129 104.0488C219.65605 104.0488 218.3129 102.70565 218.3129 101.0488C218.3129 99.391945 219.65605 98.0488 221.3129 98.0488C222.96976 98.0488 224.3129 99.391945 224.3129 101.0488Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M234.76775 97.640236C234.76775 99.2971 233.42459 100.640236 231.76775 100.640236C230.11089 100.640236 228.76775 99.2971 228.76775 97.640236C228.76775 95.98338 230.11089 94.640236 231.76775 94.640236C233.42459 94.640236 234.76775 95.98338 234.76775 97.640236Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M245.22258 94.622154C245.22258 96.27901 243.87944 97.622154 242.22258 97.622154C240.56572 97.622154 239.22258 96.27901 239.22258 94.622154C239.22258 92.9653 240.56572 91.622154 242.22258 91.622154C243.87944 91.622154 245.22258 92.9653 245.22258 94.622154Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M255.67741 91.94577C255.67741 93.60262 254.33427 94.94577 252.67741 94.94577C251.02057 94.94577 249.67741 93.60262 249.67741 91.94577C249.67741 90.28892 251.02057 88.94577 252.67741 88.94577C254.33427 88.94577 255.67741 90.28892 255.67741 91.94577Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M266.13226 89.569336C266.13226 91.22619 264.78912 92.569336 263.13226 92.569336C261.4754 92.569336 260.13226 91.22619 260.13226 89.569336C260.13226 87.912476 261.4754 86.569336 263.13226 86.569336C264.78912 86.569336 266.13226 87.912476 266.13226 89.569336Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M276.5871 87.45691C276.5871 89.11376 275.24396 90.45691 273.5871 90.45691C271.93024 90.45691 270.5871 89.11376 270.5871 87.45691C270.5871 85.80006 271.93024 84.45691 273.5871 84.45691C275.24396 84.45691 276.5871 85.80006 276.5871 87.45691Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M287.04193 85.577446C287.04193 87.2343 285.6988 88.577446 284.04193 88.577446C282.38507 88.577446 281.04193 87.2343 281.04193 85.577446C281.04193 83.92059 282.38507 82.577446 284.04193 82.577446C285.6988 82.577446 287.04193 83.92059 287.04193 85.577446Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M297.49677 83.90395C297.49677 85.560814 296.15363 86.90395 294.49677 86.90395C292.8399 86.90395 291.49677 85.560814 291.49677 83.90395C291.49677 82.2471 292.8399 80.90395 294.49677 80.90395C296.15363 80.90395 297.49677 82.2471 297.49677 83.90395Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M307.9516 82.41292C307.9516 84.06977 306.60846 85.41292 304.9516 85.41292C303.29477 85.41292 301.9516 84.06977 301.9516 82.41292C301.9516 80.756065 303.29477 79.41292 304.9516 79.41292C306.60846 79.41292 307.9516 80.756065 307.9516 82.41292Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M318.40646 81.083725C318.40646 82.74058 317.0633 84.083725 315.40646 84.083725C313.7496 84.083725 312.40646 82.74058 312.40646 81.083725C312.40646 79.42687 313.7496 78.083725 315.40646 78.083725C317.0633 78.083725 318.40646 79.42687 318.40646 81.083725Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M328.8613 79.8983C328.8613 81.55515 327.51816 82.8983 325.8613 82.8983C324.20444 82.8983 322.8613 81.55515 322.8613 79.8983C322.8613 78.24145 324.20444 76.8983 325.8613 76.8983C327.51816 76.8983 328.8613 78.24145 328.8613 79.8983Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M339.31613 78.8407C339.31613 80.49755 337.973 81.8407 336.31613 81.8407C334.65927 81.8407 333.31613 80.49755 333.31613 78.8407C333.31613 77.183846 334.65927 75.8407 336.31613 75.8407C337.973 75.8407 339.31613 77.183846 339.31613 78.8407Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M349.77097 77.896866C349.77097 79.55372 348.42783 80.896866 346.77097 80.896866C345.1141 80.896866 343.77097 79.55372 343.77097 77.896866C343.77097 76.240005 345.1141 74.896866 346.77097 74.896866C348.42783 74.896866 349.77097 76.240005 349.77097 77.896866Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M360.2258 77.054344C360.2258 78.711205 358.88266 80.054344 357.2258 80.054344C355.56894 80.054344 354.2258 78.711205 354.2258 77.054344C354.2258 75.39749 355.56894 74.054344 357.2258 74.054344C358.88266 74.054344 360.2258 75.39749 360.2258 77.054344Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M370.68063 76.302124C370.68063 77.95898 369.3375 79.302124 367.68063 79.302124C366.0238 79.302124 364.68063 77.95898 364.68063 76.302124C364.68063 74.64527 366.0238 73.302124 367.68063 73.302124C369.3375 73.302124 370.68063 74.64527 370.68063 76.302124Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M381.1355 75.63041C381.1355 77.28726 379.79233 78.63041 378.1355 78.63041C376.47864 78.63041 375.1355 77.28726 375.1355 75.63041C375.1355 73.97356 376.47864 72.63041 378.1355 72.63041C379.79233 72.63041 381.1355 73.97356 381.1355 75.63041Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M391.59033 75.0305C391.59033 76.687355 390.24716 78.0305 388.59033 78.0305C386.93347 78.0305 385.59033 76.687355 385.59033 75.0305C385.59033 73.37365 386.93347 72.0305 388.59033 72.0305C390.24716 72.0305 391.59033 73.37365 391.59033 75.0305Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M402.04517 74.49467C402.04517 76.15152 400.70203 77.49467 399.04517 77.49467C397.3883 77.49467 396.04517 76.15152 396.04517 74.49467C396.04517 72.837814 397.3883 71.49467 399.04517 71.49467C400.70203 71.49467 402.04517 72.837814 402.04517 74.49467Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M412.5 74.01602C412.5 75.672874 411.15686 77.01602 409.5 77.01602C407.84314 77.01602 406.5 75.672874 406.5 74.01602C406.5 72.35917 407.84314 71.01602 409.5 71.01602C411.15686 71.01602 412.5 72.35917 412.5 74.01602Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M422.95483 73.58843C422.95483 75.245285 421.6117 76.58843 419.95483 76.58843C418.29797 76.58843 416.95483 75.245285 416.95483 73.58843C416.95483 71.93158 418.29797 70.58843 419.95483 70.58843C421.6117 70.58843 422.95483 71.93158 422.95483 73.58843Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M433.40967 73.20643C433.40967 74.86328 432.06653 76.20643 430.40967 76.20643C428.75284 76.20643 427.40967 74.86328 427.40967 73.20643C427.40967 71.549576 428.75284 70.20643 430.40967 70.20643C432.06653 70.20643 433.40967 71.549576 433.40967 73.20643Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M443.8645 72.865135C443.8645 74.52199 442.52136 75.865135 440.8645 75.865135C439.20767 75.865135 437.8645 74.52199 437.8645 72.865135C437.8645 71.20828 439.20767 69.865135 440.8645 69.865135C442.52136 69.865135 443.8645 71.20828 443.8645 72.865135Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M454.31937 72.560196C454.31937 74.21705 452.9762 75.560196 451.31937 75.560196C449.6625 75.560196 448.31937 74.21705 448.31937 72.560196C448.31937 70.90334 449.6625 69.560196 451.31937 69.560196C452.9762 69.560196 454.31937 70.90334 454.31937 72.560196Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M464.7742 72.287735C464.7742 73.944595 463.43106 75.287735 461.7742 75.287735C460.11734 75.287735 458.7742 73.944595 458.7742 72.287735C458.7742 70.63088 460.11734 69.287735 461.7742 69.287735C463.43106 69.287735 464.7742 70.63088 464.7742 72.287735Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M475.22903 72.04429C475.22903 73.70115 473.8859 75.04429 472.22903 75.04429C470.57217 75.04429 469.22903 73.70115 469.22903 72.04429C469.22903 70.387436 470.57217 69.04429 472.22903 69.04429C473.8859 69.04429 475.22903 70.387436 475.22903 72.04429Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M485.68387 71.82676C485.68387 73.48362 484.34073 74.82676 482.68387 74.82676C481.027 74.82676 479.68387 73.48362 479.68387 71.82676C479.68387 70.16991 481.027 68.82676 482.68387 68.82676C484.34073 68.82676 485.68387 70.16991 485.68387 71.82676Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M496.1387 71.63239C496.1387 73.289246 494.79556 74.63239 493.1387 74.63239C491.48184 74.63239 490.1387 73.289246 490.1387 71.63239C490.1387 69.97553 491.48184 68.63239 493.1387 68.63239C494.79556 68.63239 496.1387 69.97553 496.1387 71.63239Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M506.59354 71.4587C506.59354 73.115555 505.2504 74.4587 503.59354 74.4587C501.9367 74.4587 500.59354 73.115555 500.59354 71.4587C500.59354 69.80185 501.9367 68.4587 503.59354 68.4587C505.2504 68.4587 506.59354 69.80185 506.59354 71.4587Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M517.0484 71.303505C517.0484 72.96036 515.70526 74.303505 514.0484 74.303505C512.39154 74.303505 511.0484 72.96036 511.0484 71.303505C511.0484 69.64665 512.39154 68.303505 514.0484 68.303505C515.70526 68.303505 517.0484 69.64665 517.0484 71.303505Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M527.50323 71.16482C527.50323 72.82167 526.1601 74.16482 524.50323 74.16482C522.8464 74.16482 521.50323 72.82167 521.50323 71.16482C521.50323 69.507965 522.8464 68.16482 524.50323 68.16482C526.1601 68.16482 527.50323 69.507965 527.50323 71.16482Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M537.95807 71.04089C537.95807 72.69775 536.6149 74.04089 534.95807 74.04089C533.3012 74.04089 531.95807 72.69775 531.95807 71.04089C531.95807 69.38404 533.3012 68.04089 534.95807 68.04089C536.6149 68.04089 537.95807 69.38404 537.95807 71.04089Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M548.4129 70.93015C548.4129 72.587006 547.06976 73.93015 545.4129 73.93015C543.75604 73.93015 542.4129 72.587006 542.4129 70.93015C542.4129 69.2733 543.75604 67.93015 545.4129 67.93015C547.06976 67.93015 548.4129 69.2733 548.4129 70.93015Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M558.86774 70.83119C558.86774 72.488045 557.5246 73.83119 555.86774 73.83119C554.2109 73.83119 552.86774 72.488045 552.86774 70.83119C552.86774 69.17434 554.2109 67.83119 555.86774 67.83119C557.5246 67.83119 558.86774 69.17434 558.86774 70.83119Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M569.3226 70.74277C569.3226 72.39962 567.97943 73.74277 566.3226 73.74277C564.6657 73.74277 563.3226 72.39962 563.3226 70.74277C563.3226 69.08591 564.6657 67.74277 566.3226 67.74277C567.97943 67.74277 569.3226 69.08591 569.3226 70.74277Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M579.7774 70.66374C579.7774 72.3206 578.43427 73.66374 576.7774 73.66374C575.12054 73.66374 573.7774 72.3206 573.7774 70.66374C573.7774 69.00689 575.12054 67.66374 576.7774 67.66374C578.43427 67.66374 579.7774 69.00689 579.7774 70.66374Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M590.23224 70.59313C590.23224 72.249985 588.8891 73.59313 587.23224 73.59313C585.5754 73.59313 584.23224 72.249985 584.23224 70.59313C584.23224 68.93628 585.5754 67.59313 587.23224 67.59313C588.8891 67.59313 590.23224 68.93628 590.23224 70.59313Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M600.6871 70.53003C600.6871 72.18688 599.34393 73.53003 597.6871 73.53003C596.0302 73.53003 594.6871 72.18688 594.6871 70.53003C594.6871 68.87318 596.0302 67.53003 597.6871 67.53003C599.34393 67.53003 600.6871 68.87318 600.6871 70.53003Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M611.1419 70.47364C611.1419 72.1305 609.79877 73.47364 608.1419 73.47364C606.4851 73.47364 605.1419 72.1305 605.1419 70.47364C605.1419 68.81679 606.4851 67.47364 608.1419 67.47364C609.79877 67.47364 611.1419 68.81679 611.1419 70.47364Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M621.5968 70.423256C621.5968 72.08011 620.2536 73.423256 618.5968 73.423256C616.93994 73.423256 615.5968 72.08011 615.5968 70.423256C615.5968 68.7664 616.93994 67.423256 618.5968 67.423256C620.2536 67.423256 621.5968 68.7664 621.5968 70.423256Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M632.05164 70.37823C632.05164 72.03508 630.7085 73.37823 629.05164 73.37823C627.3948 73.37823 626.05164 72.03508 626.05164 70.37823C626.05164 68.721375 627.3948 67.37823 629.05164 67.37823C630.7085 67.37823 632.05164 68.721375 632.05164 70.37823Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M642.5065 70.33799C642.5065 71.99484 641.1633 73.33799 639.5065 73.33799C637.8496 73.33799 636.5065 71.99484 636.5065 70.33799C636.5065 68.68114 637.8496 67.33799 639.5065 67.33799C641.1633 67.33799 642.5065 68.68114 642.5065 70.33799Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M652.9613 70.30203C652.9613 71.958885 651.61816 73.30203 649.9613 73.30203C648.30444 73.30203 646.9613 71.958885 646.9613 70.30203C646.9613 68.64518 648.30444 67.30203 649.9613 67.30203C651.61816 67.30203 652.9613 68.64518 652.9613 70.30203Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M663.41614 70.269905C663.41614 71.92676 662.073 73.269905 660.41614 73.269905C658.7593 73.269905 657.41614 71.92676 657.41614 70.269905C657.41614 68.613045 658.7593 67.269905 660.41614 67.269905C662.073 67.269905 663.41614 68.613045 663.41614 70.269905Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M673.871 70.24119C673.871 71.89804 672.52783 73.24119 670.871 73.24119C669.2141 73.24119 667.871 71.89804 667.871 70.24119C667.871 68.584335 669.2141 67.24119 670.871 67.24119C672.52783 67.24119 673.871 68.584335 673.871 70.24119Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M684.3258 70.21553C684.3258 71.87238 682.98267 73.21553 681.3258 73.21553C679.66895 73.21553 678.3258 71.87238 678.3258 70.21553C678.3258 68.55868 679.66895 67.21553 681.3258 67.21553C682.98267 67.21553 684.3258 68.55868 684.3258 70.21553Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M694.78064 70.192604C694.78064 71.84946 693.4375 73.192604 691.78064 73.192604C690.1238 73.192604 688.78064 71.84946 688.78064 70.192604C688.78064 68.53574 690.1238 67.192604 691.78064 67.192604C693.4375 67.192604 694.78064 68.53574 694.78064 70.192604Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M705.2355 70.17211C705.2355 71.828964 703.89233 73.17211 702.2355 73.17211C700.5786 73.17211 699.2355 71.828964 699.2355 70.17211C699.2355 68.51526 700.5786 67.17211 702.2355 67.17211C703.89233 67.17211 705.2355 68.51526 705.2355 70.17211Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M715.6903 70.1538C715.6903 71.81065 714.34717 73.1538 712.6903 73.1538C711.03345 73.1538 709.6903 71.81065 709.6903 70.1538C709.6903 68.49695 711.03345 67.1538 712.6903 67.1538C714.34717 67.1538 715.6903 68.49695 715.6903 70.1538Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M726.14514 70.13744C726.14514 71.7943 724.802 73.13744 723.14514 73.13744C721.4883 73.13744 720.14514 71.7943 720.14514 70.13744C720.14514 68.48058 721.4883 67.13744 723.14514 67.13744C724.802 67.13744 726.14514 68.48058 726.14514 70.13744Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M736.6 70.12282C736.6 71.77967 735.25684 73.12282 733.6 73.12282C731.9431 73.12282 730.6 71.77967 730.6 70.12282C730.6 68.465965 731.9431 67.12282 733.6 67.12282C735.25684 67.12282 736.6 68.465965 736.6 70.12282Z" fill-rule="nonzero"/><path fill="#000000" d="M362.92188 441.6L362.92188 433.00626L366.17188 433.00626Q367.01562 433.00626 367.46875 433.08438Q368.10938 433.19376 368.53125 433.49063Q368.96875 433.7875 369.21875 434.31876Q369.48438 434.85 369.48438 435.49063Q369.48438 436.58438 368.78125 437.35Q368.09375 438.1 366.26562 438.1L364.0625 438.1L364.0625 441.6L362.92188 441.6ZM364.0625 437.1L366.28125 437.1Q367.39062 437.1 367.84375 436.69376Q368.3125 436.27188 368.3125 435.52188Q368.3125 434.99063 368.03125 434.61563Q367.76562 434.225 367.32812 434.1Q367.03125 434.02188 366.26562 434.02188L364.0625 434.02188L364.0625 437.1ZM374.85938 440.83438Q374.26562 441.33438 373.71875 441.5375Q373.1875 441.74063 372.5625 441.74063Q371.53125 441.74063 370.98438 441.24063Q370.4375 440.74063 370.4375 439.95938Q370.4375 439.50626 370.64062 439.13126Q370.84375 438.74063 371.1875 438.52188Q371.53125 438.2875 371.95312 438.17813Q372.25 438.08438 372.89062 438.00626Q374.15625 437.86563 374.76562 437.64688Q374.76562 437.42813 374.76562 437.38126Q374.76562 436.725 374.46875 436.45938Q374.0625 436.11563 373.26562 436.11563Q372.53125 436.11563 372.17188 436.38126Q371.8125 436.63126 371.64062 437.2875L370.60938 437.14688Q370.75 436.49063 371.07812 436.08438Q371.40625 435.67813 372.01562 435.45938Q372.625 435.24063 373.42188 435.24063Q374.21875 435.24063 374.71875 435.42813Q375.21875 435.61563 375.45312 435.89688Q375.6875 436.17813 375.78125 436.61563Q375.82812 436.88126 375.82812 437.58438L375.82812 438.99063Q375.82812 440.45938 375.89062 440.85Q375.96875 441.24063 376.17188 441.6L375.0625 441.6Q374.90625 441.27188 374.85938 440.83438ZM374.76562 438.475Q374.1875 438.70938 373.04688 438.88126Q372.39062 438.975 372.125 439.1Q371.85938 439.20938 371.70312 439.42813Q371.5625 439.64688 371.5625 439.92813Q371.5625 440.35 371.875 440.63126Q372.20312 440.9125 372.8125 440.9125Q373.42188 440.9125 373.89062 440.64688Q374.375 440.38126 374.59375 439.9125Q374.76562 439.55313 374.76562 438.86563L374.76562 438.475ZM377.375 439.74063L378.40625 439.58438Q378.5 440.20938 378.89062 440.5375Q379.29688 440.86563 380.03125 440.86563Q380.75 440.86563 381.09375 440.58438Q381.45312 440.2875 381.45312 439.88126Q381.45312 439.52188 381.14062 439.31876Q380.92188 439.17813 380.0625 438.95938Q378.90625 438.6625 378.45312 438.45938Q378.01562 438.24063 377.78125 437.86563Q377.54688 437.49063 377.54688 437.02188Q377.54688 436.61563 377.73438 436.25626Q377.92188 435.89688 378.25 435.6625Q378.5 435.49063 378.92188 435.36563Q379.34375 435.24063 379.84375 435.24063Q380.5625 435.24063 381.10938 435.45938Q381.67188 435.6625 381.9375 436.02188Q382.20312 436.38126 382.29688 436.975L381.26562 437.11563Q381.20312 436.64688 380.85938 436.38126Q380.53125 436.1 379.90625 436.1Q379.1875 436.1 378.875 436.35Q378.5625 436.58438 378.5625 436.9125Q378.5625 437.11563 378.6875 437.27188Q378.82812 437.44376 379.09375 437.55313Q379.25 437.61563 380.03125 437.81876Q381.15625 438.13126 381.59375 438.31876Q382.03125 438.50626 382.28125 438.86563Q382.53125 439.225 382.53125 439.77188Q382.53125 440.30313 382.21875 440.77188Q381.92188 441.225 381.34375 441.49063Q380.76562 441.74063 380.03125 441.74063Q378.8125 441.74063 378.17188 441.24063Q377.54688 440.725 377.375 439.74063ZM383.375 439.74063L384.40625 439.58438Q384.5 440.20938 384.89062 440.5375Q385.29688 440.86563 386.03125 440.86563Q386.75 440.86563 387.09375 440.58438Q387.45312 440.2875 387.45312 439.88126Q387.45312 439.52188 387.14062 439.31876Q386.92188 439.17813 386.0625 438.95938Q384.90625 438.6625 384.45312 438.45938Q384.01562 438.24063 383.78125 437.86563Q383.54688 437.49063 383.54688 437.02188Q383.54688 436.61563 383.73438 436.25626Q383.92188 435.89688 384.25 435.6625Q384.5 435.49063 384.92188 435.36563Q385.34375 435.24063 385.84375 435.24063Q386.5625 435.24063 387.10938 435.45938Q387.67188 435.6625 387.9375 436.02188Q388.20312 436.38126 388.29688 436.975L387.26562 437.11563Q387.20312 436.64688 386.85938 436.38126Q386.53125 436.1 385.90625 436.1Q385.1875 436.1 384.875 436.35Q384.5625 436.58438 384.5625 436.9125Q384.5625 437.11563 384.6875 437.27188Q384.82812 437.44376 385.09375 437.55313Q385.25 437.61563 386.03125 437.81876Q387.15625 438.13126 387.59375 438.31876Q388.03125 438.50626 388.28125 438.86563Q388.53125 439.225 388.53125 439.77188Q388.53125 440.30313 388.21875 440.77188Q387.92188 441.225 387.34375 441.49063Q386.76562 441.74063 386.03125 441.74063Q384.8125 441.74063 384.17188 441.24063Q383.54688 440.725 383.375 439.74063ZM390.9375 441.6L389.03125 435.38126L390.125 435.38126L391.10938 438.975L391.48438 440.30313Q391.51562 440.20938 391.8125 439.02188L392.79688 435.38126L393.875 435.38126L394.8125 438.99063L395.125 440.17813L395.48438 438.975L396.54688 435.38126L397.57812 435.38126L395.625 441.6L394.53125 441.6L393.54688 437.86563L393.29688 436.81876L392.04688 441.6L390.9375 441.6ZM398.40625 438.49063Q398.40625 436.75626 399.35938 435.92813Q400.15625 435.24063 401.3125 435.24063Q402.59375 435.24063 403.40625 436.08438Q404.23438 436.9125 404.23438 438.39688Q404.23438 439.6 403.875 440.2875Q403.51562 440.975 402.8125 441.36563Q402.125 441.74063 401.3125 441.74063Q400.01562 441.74063 399.20312 440.9125Q398.40625 440.06876 398.40625 438.49063ZM399.48438 438.49063Q399.48438 439.67813 400.0 440.27188Q400.53125 440.86563 401.3125 440.86563Q402.10938 440.86563 402.625 440.27188Q403.14062 439.67813 403.14062 438.45938Q403.14062 437.30313 402.60938 436.70938Q402.09375 436.11563 401.3125 436.11563Q400.53125 436.11563 400.0 436.70938Q399.48438 437.2875 399.48438 438.49063ZM405.78125 441.6L405.78125 435.38126L406.73438 435.38126L406.73438 436.31876Q407.09375 435.6625 407.39062 435.45938Q407.70312 435.24063 408.07812 435.24063Q408.60938 435.24063 409.15625 435.56876L408.79688 436.55313Q408.40625 436.31876 408.03125 436.31876Q407.67188 436.31876 407.39062 436.5375Q407.125 436.74063 407.01562 437.11563Q406.82812 437.67813 406.82812 438.33438L406.82812 441.6L405.78125 441.6ZM413.82812 441.6L413.82812 440.81876Q413.23438 441.74063 412.09375 441.74063Q411.34375 441.74063 410.71875 441.33438Q410.09375 440.9125 409.75 440.17813Q409.40625 439.44376 409.40625 438.49063Q409.40625 437.56876 409.71875 436.80313Q410.03125 436.0375 410.65625 435.64688Q411.28125 435.24063 412.04688 435.24063Q412.60938 435.24063 413.04688 435.475Q413.48438 435.70938 413.76562 436.08438L413.76562 433.00626L414.8125 433.00626L414.8125 441.6L413.82812 441.6ZM410.5 438.49063Q410.5 439.69376 411.0 440.2875Q411.5 440.86563 412.1875 440.86563Q412.875 440.86563 413.35938 440.30313Q413.84375 439.74063 413.84375 438.58438Q413.84375 437.30313 413.34375 436.70938Q412.85938 436.11563 412.14062 436.11563Q411.4375 436.11563 410.96875 436.69376Q410.5 437.25626 410.5 438.49063ZM419.875 441.6L419.875 433.00626L421.01562 433.00626L421.01562 440.58438L425.25 440.58438L425.25 441.6L419.875 441.6ZM431.04688 439.6L432.14062 439.725Q431.89062 440.67813 431.1875 441.20938Q430.48438 441.74063 429.40625 441.74063Q428.04688 441.74063 427.23438 440.89688Q426.4375 440.05313 426.4375 438.5375Q426.4375 436.975 427.25 436.11563Q428.0625 435.24063 429.34375 435.24063Q430.59375 435.24063 431.375 436.08438Q432.17188 436.92813 432.17188 438.475Q432.17188 438.56876 432.17188 438.75626L427.53125 438.75626Q427.59375 439.7875 428.10938 440.33438Q428.625 440.86563 429.40625 440.86563Q429.98438 440.86563 430.39062 440.56876Q430.8125 440.25626 431.04688 439.6ZM427.59375 437.89688L431.0625 437.89688Q431.0 437.1 430.67188 436.70938Q430.15625 436.1 429.35938 436.1Q428.625 436.1 428.125 436.58438Q427.64062 437.06876 427.59375 437.89688ZM433.79688 441.6L433.79688 435.38126L434.73438 435.38126L434.73438 436.25626Q435.42188 435.24063 436.71875 435.24063Q437.28125 435.24063 437.75 435.44376Q438.23438 435.64688 438.46875 435.975Q438.70312 436.30313 438.79688 436.74063Q438.84375 437.0375 438.84375 437.77188L438.84375 441.6L437.79688 441.6L437.79688 437.81876Q437.79688 437.1625 437.67188 436.85Q437.54688 436.5375 437.23438 436.35Q436.92188 436.14688 436.5 436.14688Q435.82812 436.14688 435.32812 436.58438Q434.84375 437.00626 434.84375 438.19376L434.84375 441.6L433.79688 441.6ZM440.59375 442.11563L441.625 442.27188Q441.6875 442.74063 441.98438 442.95938Q442.375 443.25626 443.04688 443.25626Q443.78125 443.25626 444.17188 442.95938Q444.57812 442.6625 444.71875 442.14688Q444.8125 441.81876 444.79688 440.7875Q444.10938 441.6 443.07812 441.6Q441.79688 441.6 441.09375 440.67813Q440.39062 439.74063 440.39062 438.45938Q440.39062 437.56876 440.70312 436.81876Q441.03125 436.05313 441.64062 435.64688Q442.25 435.24063 443.07812 435.24063Q444.1875 435.24063 444.90625 436.13126L444.90625 435.38126L445.875 435.38126L445.875 440.75626Q445.875 442.20938 445.57812 442.81876Q445.28125 443.42813 444.64062 443.77188Q444.0 444.13126 443.0625 444.13126Q441.95312 444.13126 441.26562 443.63126Q440.57812 443.13126 440.59375 442.11563ZM441.46875 438.38126Q441.46875 439.6 441.95312 440.1625Q442.4375 440.725 443.17188 440.725Q443.90625 440.725 444.39062 440.1625Q444.89062 439.6 444.89062 438.4125Q444.89062 437.27188 444.375 436.69376Q443.875 436.11563 443.15625 436.11563Q442.45312 436.11563 441.95312 436.69376Q441.46875 437.25626 441.46875 438.38126ZM450.09375 440.6625L450.25 441.58438Q449.79688 441.67813 449.45312 441.67813Q448.875 441.67813 448.5625 441.50626Q448.25 441.31876 448.10938 441.02188Q447.98438 440.725 447.98438 439.77188L447.98438 436.19376L447.21875 436.19376L447.21875 435.38126L447.98438 435.38126L447.98438 433.83438L449.03125 433.20938L449.03125 435.38126L450.09375 435.38126L450.09375 436.19376L449.03125 436.19376L449.03125 439.83438Q449.03125 440.2875 449.07812 440.4125Q449.14062 440.5375 449.26562 440.61563Q449.39062 440.69376 449.625 440.69376Q449.8125 440.69376 450.09375 440.6625ZM450.79688 441.6L450.79688 433.00626L451.84375 433.00626L451.84375 436.08438Q452.57812 435.24063 453.70312 435.24063Q454.40625 435.24063 454.90625 435.52188Q455.42188 435.7875 455.64062 436.27188Q455.85938 436.74063 455.85938 437.6625L455.85938 441.6L454.8125 441.6L454.8125 437.6625Q454.8125 436.86563 454.46875 436.50626Q454.125 436.14688 453.5 436.14688Q453.03125 436.14688 452.60938 436.39688Q452.20312 436.63126 452.01562 437.05313Q451.84375 437.45938 451.84375 438.19376L451.84375 441.6L450.79688 441.6Z" fill-rule="nonzero"/><path fill="#000000" d="M34.400005 265.8781L25.806255 265.8781L25.806255 262.6281Q25.806255 261.78436 25.88438 261.33124Q25.993755 260.6906 26.29063 260.26874Q26.587505 259.83124 27.118755 259.58124Q27.650005 259.3156 28.29063 259.3156Q29.38438 259.3156 30.150005 260.01874Q30.900005 260.70624 30.900005 262.53436L30.900005 264.7375L34.400005 264.7375L34.400005 265.8781ZM29.900005 264.7375L29.900005 262.51874Q29.900005 261.40936 29.493755 260.95624Q29.07188 260.4875 28.32188 260.4875Q27.79063 260.4875 27.41563 260.76874Q27.025005 261.03436 26.900005 261.47186Q26.82188 261.76874 26.82188 262.53436L26.82188 264.7375L29.900005 264.7375ZM34.400005 258.01874L28.181255 258.01874L28.181255 257.0656L29.118755 257.0656Q28.462505 256.70624 28.25938 256.40936Q28.04063 256.09686 28.04063 255.72188Q28.04063 255.19063 28.368755 254.64375L29.35313 255.00313Q29.118755 255.39375 29.118755 255.76875Q29.118755 256.1281 29.337505 256.40936Q29.54063 256.675 29.91563 256.78436Q30.47813 256.97186 31.13438 256.97186L34.400005 256.97186L34.400005 258.01874ZM31.29063 254.39375Q29.556255 254.39375 28.72813 253.44063Q28.04063 252.64375 28.04063 251.4875Q28.04063 250.20625 28.88438 249.39375Q29.712505 248.56563 31.19688 248.56563Q32.400005 248.56563 33.087505 248.925Q33.775005 249.28438 34.16563 249.9875Q34.54063 250.675 34.54063 251.4875Q34.54063 252.78438 33.712505 253.59688Q32.868755 254.39375 31.29063 254.39375ZM31.29063 253.31563Q32.47813 253.31563 33.07188 252.8Q33.66563 252.26875 33.66563 251.4875Q33.66563 250.69063 33.07188 250.175Q32.47813 249.65938 31.25938 249.65938Q30.10313 249.65938 29.50938 250.19063Q28.91563 250.70625 28.91563 251.4875Q28.91563 252.26875 29.50938 252.8Q30.087505 253.31563 31.29063 253.31563ZM34.400005 246.03438L34.400005 247.01875L25.806255 247.01875L25.806255 245.95625L28.868755 245.95625Q28.04063 245.28438 28.04063 244.25313Q28.04063 243.675 28.275005 243.175Q28.493755 242.65938 28.91563 242.33125Q29.337505 241.9875 29.931255 241.8Q30.525005 241.6125 31.19688 241.6125Q32.79063 241.6125 33.66563 242.40938Q34.54063 243.20625 34.54063 244.3Q34.54063 245.40938 33.618755 246.03438L34.400005 246.03438ZM31.243755 246.05Q32.35313 246.05 32.85313 245.7375Q33.66563 245.2375 33.66563 244.39375Q33.66563 243.70625 33.07188 243.20625Q32.47813 242.69063 31.275005 242.69063Q30.056255 242.69063 29.47813 243.175Q28.900005 243.65938 28.900005 244.34688Q28.900005 245.03438 29.50938 245.55Q30.10313 246.05 31.243755 246.05ZM33.63438 235.94063Q34.13438 236.53438 34.337505 237.08125Q34.54063 237.6125 34.54063 238.2375Q34.54063 239.26875 34.04063 239.81563Q33.54063 240.3625 32.75938 240.3625Q32.306255 240.3625 31.931255 240.15938Q31.54063 239.95625 31.32188 239.6125Q31.087505 239.26875 30.97813 238.84688Q30.88438 238.55 30.806255 237.90938Q30.66563 236.64375 30.44688 236.03438Q30.22813 236.03438 30.181255 236.03438Q29.525005 236.03438 29.25938 236.33125Q28.91563 236.7375 28.91563 237.53438Q28.91563 238.26875 29.181255 238.62813Q29.431255 238.9875 30.087505 239.15938L29.94688 240.19063Q29.29063 240.05 28.88438 239.72188Q28.47813 239.39375 28.25938 238.78438Q28.04063 238.175 28.04063 237.37813Q28.04063 236.58125 28.22813 236.08125Q28.41563 235.58125 28.69688 235.34688Q28.97813 235.1125 29.41563 235.01875Q29.681255 234.97188 30.38438 234.97188L31.79063 234.97188Q33.25938 234.97188 33.650005 234.90938Q34.04063 234.83125 34.400005 234.62813L34.400005 235.7375Q34.07188 235.89375 33.63438 235.94063ZM31.275005 236.03438Q31.50938 236.6125 31.681255 237.75313Q31.775005 238.40938 31.900005 238.675Q32.00938 238.94063 32.22813 239.09688Q32.44688 239.2375 32.72813 239.2375Q33.150005 239.2375 33.431255 238.925Q33.712505 238.59688 33.712505 237.9875Q33.712505 237.37813 33.44688 236.90938Q33.181255 236.425 32.712505 236.20625Q32.35313 236.03438 31.66563 236.03438L31.275005 236.03438ZM34.400005 232.03438L34.400005 233.01875L25.806255 233.01875L25.806255 231.95625L28.868755 231.95625Q28.04063 231.28438 28.04063 230.25313Q28.04063 229.675 28.275005 229.175Q28.493755 228.65938 28.91563 228.33125Q29.337505 227.9875 29.931255 227.8Q30.525005 227.6125 31.19688 227.6125Q32.79063 227.6125 33.66563 228.40938Q34.54063 229.20625 34.54063 230.3Q34.54063 231.40938 33.618755 232.03438L34.400005 232.03438ZM31.243755 232.05Q32.35313 232.05 32.85313 231.7375Q33.66563 231.2375 33.66563 230.39375Q33.66563 229.70625 33.07188 229.20625Q32.47813 228.69063 31.275005 228.69063Q30.056255 228.69063 29.47813 229.175Q28.900005 229.65938 28.900005 230.34688Q28.900005 231.03438 29.50938 231.55Q30.10313 232.05 31.243755 232.05ZM27.025005 226.00313L25.806255 226.00313L25.806255 224.94063L27.025005 224.94063L27.025005 226.00313ZM34.400005 226.00313L28.181255 226.00313L28.181255 224.94063L34.400005 224.94063L34.400005 226.00313ZM34.400005 223.03438L25.806255 223.03438L25.806255 221.97188L34.400005 221.97188L34.400005 223.03438ZM27.025005 220.00313L25.806255 220.00313L25.806255 218.94063L27.025005 218.94063L27.025005 220.00313ZM34.400005 220.00313L28.181255 220.00313L28.181255 218.94063L34.400005 218.94063L34.400005 220.00313ZM33.462505 214.70625L34.38438 214.55Q34.47813 215.00313 34.47813 215.34688Q34.47813 215.925 34.306255 216.2375Q34.118755 216.55 33.82188 216.69063Q33.525005 216.81563 32.57188 216.81563L28.993755 216.81563L28.993755 217.58125L28.181255 217.58125L28.181255 216.81563L26.63438 216.81563L26.00938 215.76875L28.181255 215.76875L28.181255 214.70625L28.993755 214.70625L28.993755 215.76875L32.63438 215.76875Q33.087505 215.76875 33.212505 215.72188Q33.337505 215.65938 33.41563 215.53438Q33.493755 215.40938 33.493755 215.175Q33.493755 214.9875 33.462505 214.70625ZM36.79063 214.05L35.806255 214.175Q35.900005 213.83125 35.900005 213.56563Q35.900005 213.22188 35.775005 213.01875Q35.66563 212.8 35.462505 212.65938Q35.29063 212.56563 34.66563 212.33125Q34.587505 212.31563 34.41563 212.2375L28.181255 214.6125L28.181255 213.47188L31.775005 212.175Q32.462505 211.925 33.22813 211.72188Q32.493755 211.53438 31.806255 211.28438L28.181255 209.95625L28.181255 208.90938L34.50938 211.26875Q35.525005 211.65938 35.91563 211.8625Q36.44688 212.14375 36.681255 212.51875Q36.931255 212.87813 36.931255 213.37813Q36.931255 213.675 36.79063 214.05Z" fill-rule="nonzero"/><path fill="#000000" d="M55.9 392.36563Q55.9 390.83438 56.2125 389.9125Q56.525 388.975 57.134377 388.475Q57.759377 387.975 58.696877 387.975Q59.384377 387.975 59.9 388.25626Q60.43125 388.5375 60.775 389.06876Q61.11875 389.58438 61.30625 390.33438Q61.49375 391.08438 61.49375 392.36563Q61.49375 393.88126 61.18125 394.80313Q60.884377 395.725 60.259377 396.24063Q59.65 396.74063 58.696877 396.74063Q57.4625 396.74063 56.74375 395.85Q55.9 394.7875 55.9 392.36563ZM56.978127 392.36563Q56.978127 394.475 57.478127 395.17813Q57.978127 395.88126 58.696877 395.88126Q59.43125 395.88126 59.915627 395.17813Q60.415627 394.475 60.415627 392.36563Q60.415627 390.24063 59.915627 389.55313Q59.43125 388.85 58.68125 388.85Q57.9625 388.85 57.525 389.45938Q56.978127 390.24063 56.978127 392.36563ZM63.49375 396.6L63.49375 395.39688L64.69688 395.39688L64.69688 396.6L63.49375 396.6ZM65.9 392.36563Q65.9 390.83438 66.2125 389.9125Q66.525 388.975 67.13438 388.475Q67.75938 387.975 68.69688 387.975Q69.38438 387.975 69.9 388.25626Q70.43125 388.5375 70.775 389.06876Q71.11875 389.58438 71.30625 390.33438Q71.49375 391.08438 71.49375 392.36563Q71.49375 393.88126 71.18125 394.80313Q70.88438 395.725 70.25938 396.24063Q69.65 396.74063 68.69688 396.74063Q67.4625 396.74063 66.74375 395.85Q65.9 394.7875 65.9 392.36563ZM66.97813 392.36563Q66.97813 394.475 67.47813 395.17813Q67.97813 395.88126 68.69688 395.88126Q69.43125 395.88126 69.91563 395.17813Q70.41563 394.475 70.41563 392.36563Q70.41563 390.24063 69.91563 389.55313Q69.43125 388.85 68.68125 388.85Q67.9625 388.85 67.525 389.45938Q66.97813 390.24063 66.97813 392.36563ZM72.9 392.36563Q72.9 390.83438 73.2125 389.9125Q73.525 388.975 74.13438 388.475Q74.75938 387.975 75.69688 387.975Q76.38438 387.975 76.9 388.25626Q77.43125 388.5375 77.775 389.06876Q78.11875 389.58438 78.30625 390.33438Q78.49375 391.08438 78.49375 392.36563Q78.49375 393.88126 78.18125 394.80313Q77.88438 395.725 77.25938 396.24063Q76.65 396.74063 75.69688 396.74063Q74.4625 396.74063 73.74375 395.85Q72.9 394.7875 72.9 392.36563ZM73.97813 392.36563Q73.97813 394.475 74.47813 395.17813Q74.97813 395.88126 75.69688 395.88126Q76.43125 395.88126 76.91563 395.17813Q77.41563 394.475 77.41563 392.36563Q77.41563 390.24063 76.91563 389.55313Q76.43125 388.85 75.68125 388.85Q74.9625 388.85 74.525 389.45938Q73.97813 390.24063 73.97813 392.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M55.9 311.71564Q55.9 310.1844 56.2125 309.2625Q56.525 308.325 57.134377 307.825Q57.759377 307.325 58.696877 307.325Q59.384377 307.325 59.9 307.60626Q60.43125 307.8875 60.775 308.41876Q61.11875 308.9344 61.30625 309.6844Q61.49375 310.4344 61.49375 311.71564Q61.49375 313.23126 61.18125 314.15314Q60.884377 315.075 60.259377 315.59064Q59.65 316.09064 58.696877 316.09064Q57.4625 316.09064 56.74375 315.2Q55.9 314.1375 55.9 311.71564ZM56.978127 311.71564Q56.978127 313.825 57.478127 314.52814Q57.978127 315.23126 58.696877 315.23126Q59.43125 315.23126 59.915627 314.52814Q60.415627 313.825 60.415627 311.71564Q60.415627 309.59064 59.915627 308.90314Q59.43125 308.2 58.68125 308.2Q57.9625 308.2 57.525 308.8094Q56.978127 309.59064 56.978127 311.71564ZM63.49375 315.95L63.49375 314.7469L64.69688 314.7469L64.69688 315.95L63.49375 315.95ZM71.44688 314.9344L71.44688 315.95L65.75938 315.95Q65.75938 315.575 65.88438 315.21564Q66.10313 314.6375 66.57188 314.075Q67.05625 313.5125 67.9625 312.77814Q69.36875 311.6219 69.85313 310.95Q70.35313 310.27814 70.35313 309.6844Q70.35313 309.0594 69.9 308.6375Q69.44688 308.2 68.72813 308.2Q67.9625 308.2 67.50938 308.65314Q67.05625 309.10626 67.04063 309.91876L65.9625 309.8094Q66.07188 308.59064 66.79063 307.96564Q67.525 307.325 68.75938 307.325Q69.99375 307.325 70.7125 308.0125Q71.43125 308.7 71.43125 309.71564Q71.43125 310.23126 71.2125 310.73126Q71.00938 311.21564 70.50938 311.77814Q70.025 312.325 68.9 313.27814Q67.94688 314.075 67.66563 314.3719Q67.4 314.65314 67.22813 314.9344L71.44688 314.9344ZM72.9 313.7L74.00938 313.60626Q74.13438 314.41876 74.57188 314.825Q75.025 315.23126 75.66563 315.23126Q76.41563 315.23126 76.94688 314.65314Q77.47813 314.075 77.47813 313.1375Q77.47813 312.23126 76.9625 311.71564Q76.4625 311.1844 75.63438 311.1844Q75.13438 311.1844 74.7125 311.41876Q74.30625 311.65314 74.07188 312.0125L73.0875 311.8875L73.91563 307.48126L78.19688 307.48126L78.19688 308.48126L74.75938 308.48126L74.30625 310.79376Q75.07188 310.2469 75.91563 310.2469Q77.04063 310.2469 77.80625 311.02814Q78.5875 311.8094 78.5875 313.04376Q78.5875 314.2 77.91563 315.0594Q77.0875 316.09064 75.66563 316.09064Q74.49375 316.09064 73.74375 315.4344Q73.00938 314.77814 72.9 313.7Z" fill-rule="nonzero"/><path fill="#000000" d="M55.9 231.06563Q55.9 229.53438 56.2125 228.6125Q56.525 227.675 57.134377 227.175Q57.759377 226.675 58.696877 226.675Q59.384377 226.675 59.9 226.95625Q60.43125 227.2375 60.775 227.76875Q61.11875 228.28438 61.30625 229.03438Q61.49375 229.78438 61.49375 231.06563Q61.49375 232.58125 61.18125 233.50313Q60.884377 234.425 60.259377 234.94063Q59.65 235.44063 58.696877 235.44063Q57.4625 235.44063 56.74375 234.55Q55.9 233.4875 55.9 231.06563ZM56.978127 231.06563Q56.978127 233.175 57.478127 233.87813Q57.978127 234.58125 58.696877 234.58125Q59.43125 234.58125 59.915627 233.87813Q60.415627 233.175 60.415627 231.06563Q60.415627 228.94063 59.915627 228.25313Q59.43125 227.55 58.68125 227.55Q57.9625 227.55 57.525 228.15938Q56.978127 228.94063 56.978127 231.06563ZM63.49375 235.3L63.49375 234.09688L64.69688 234.09688L64.69688 235.3L63.49375 235.3ZM65.9 233.05L67.00938 232.95625Q67.13438 233.76875 67.57188 234.175Q68.025 234.58125 68.66563 234.58125Q69.41563 234.58125 69.94688 234.00313Q70.47813 233.425 70.47813 232.4875Q70.47813 231.58125 69.9625 231.06563Q69.4625 230.53438 68.63438 230.53438Q68.13438 230.53438 67.7125 230.76875Q67.30625 231.00313 67.07188 231.3625L66.0875 231.2375L66.91563 226.83125L71.19688 226.83125L71.19688 227.83125L67.75938 227.83125L67.30625 230.14375Q68.07188 229.59688 68.91563 229.59688Q70.04063 229.59688 70.80625 230.37813Q71.5875 231.15938 71.5875 232.39375Q71.5875 233.55 70.91563 234.40938Q70.0875 235.44063 68.66563 235.44063Q67.49375 235.44063 66.74375 234.78438Q66.00938 234.12813 65.9 233.05ZM72.9 231.06563Q72.9 229.53438 73.2125 228.6125Q73.525 227.675 74.13438 227.175Q74.75938 226.675 75.69688 226.675Q76.38438 226.675 76.9 226.95625Q77.43125 227.2375 77.775 227.76875Q78.11875 228.28438 78.30625 229.03438Q78.49375 229.78438 78.49375 231.06563Q78.49375 232.58125 78.18125 233.50313Q77.88438 234.425 77.25938 234.94063Q76.65 235.44063 75.69688 235.44063Q74.4625 235.44063 73.74375 234.55Q72.9 233.4875 72.9 231.06563ZM73.97813 231.06563Q73.97813 233.175 74.47813 233.87813Q74.97813 234.58125 75.69688 234.58125Q76.43125 234.58125 76.91563 233.87813Q77.41563 233.175 77.41563 231.06563Q77.41563 228.94063 76.91563 228.25313Q76.43125 227.55 75.68125 227.55Q74.9625 227.55 74.525 228.15938Q73.97813 228.94063 73.97813 231.06563Z" fill-rule="nonzero"/><path fill="#000000" d="M55.9 150.41562Q55.9 148.88437 56.2125 147.9625Q56.525 147.025 57.134377 146.525Q57.759377 146.025 58.696877 146.025Q59.384377 146.025 59.9 146.30624Q60.43125 146.5875 60.775 147.11874Q61.11875 147.63437 61.30625 148.38437Q61.49375 149.13437 61.49375 150.41562Q61.49375 151.93124 61.18125 152.85312Q60.884377 153.775 60.259377 154.29062Q59.65 154.79062 58.696877 154.79062Q57.4625 154.79062 56.74375 153.9Q55.9 152.8375 55.9 150.41562ZM56.978127 150.41562Q56.978127 152.525 57.478127 153.22812Q57.978127 153.93124 58.696877 153.93124Q59.43125 153.93124 59.915627 153.22812Q60.415627 152.525 60.415627 150.41562Q60.415627 148.29062 59.915627 147.60312Q59.43125 146.9 58.68125 146.9Q57.9625 146.9 57.525 147.50937Q56.978127 148.29062 56.978127 150.41562ZM63.49375 154.65L63.49375 153.44687L64.69688 153.44687L64.69688 154.65L63.49375 154.65ZM65.9625 147.18124L65.9625 146.16562L71.525 146.16562L71.525 146.99374Q70.7125 147.86874 69.9 149.32187Q69.10313 150.75937 68.66563 152.29062Q68.3375 153.36874 68.25938 154.65L67.16563 154.65Q67.18125 153.63437 67.55625 152.19687Q67.94688 150.75937 68.65 149.43124Q69.36875 148.10312 70.18125 147.18124L65.9625 147.18124ZM72.9 152.4L74.00938 152.30624Q74.13438 153.11874 74.57188 153.525Q75.025 153.93124 75.66563 153.93124Q76.41563 153.93124 76.94688 153.35312Q77.47813 152.775 77.47813 151.8375Q77.47813 150.93124 76.9625 150.41562Q76.4625 149.88437 75.63438 149.88437Q75.13438 149.88437 74.7125 150.11874Q74.30625 150.35312 74.07188 150.7125L73.0875 150.5875L73.91563 146.18124L78.19688 146.18124L78.19688 147.18124L74.75938 147.18124L74.30625 149.49374Q75.07188 148.94687 75.91563 148.94687Q77.04063 148.94687 77.80625 149.72812Q78.5875 150.50937 78.5875 151.74374Q78.5875 152.9 77.91563 153.75937Q77.0875 154.79062 75.66563 154.79062Q74.49375 154.79062 73.74375 154.13437Q73.00938 153.47812 72.9 152.4Z" fill-rule="nonzero"/><path fill="#000000" d="M59.86875 74.0L58.821877 74.0L58.821877 67.28125Q58.43125 67.640625 57.80625 68.015625Q57.196877 68.375 56.7125 68.546875L56.7125 67.53125Q57.5875 67.109375 58.24375 66.53125Q58.915627 65.9375 59.196877 65.375L59.86875 65.375L59.86875 74.0ZM63.49375 74.0L63.49375 72.796875L64.69688 72.796875L64.69688 74.0L63.49375 74.0ZM65.9 69.765625Q65.9 68.234375 66.2125 67.3125Q66.525 66.375 67.13438 65.875Q67.75938 65.375 68.69688 65.375Q69.38438 65.375 69.9 65.65625Q70.43125 65.9375 70.775 66.46875Q71.11875 66.984375 71.30625 67.734375Q71.49375 68.484375 71.49375 69.765625Q71.49375 71.28125 71.18125 72.203125Q70.88438 73.125 70.25938 73.640625Q69.65 74.140625 68.69688 74.140625Q67.4625 74.140625 66.74375 73.25Q65.9 72.1875 65.9 69.765625ZM66.97813 69.765625Q66.97813 71.875 67.47813 72.578125Q67.97813 73.28125 68.69688 73.28125Q69.43125 73.28125 69.91563 72.578125Q70.41563 71.875 70.41563 69.765625Q70.41563 67.640625 69.91563 66.953125Q69.43125 66.25 68.68125 66.25Q67.9625 66.25 67.525 66.859375Q66.97813 67.640625 66.97813 69.765625ZM72.9 69.765625Q72.9 68.234375 73.2125 67.3125Q73.525 66.375 74.13438 65.875Q74.75938 65.375 75.69688 65.375Q76.38438 65.375 76.9 65.65625Q77.43125 65.9375 77.775 66.46875Q78.11875 66.984375 78.30625 67.734375Q78.49375 68.484375 78.49375 69.765625Q78.49375 71.28125 78.18125 72.203125Q77.88438 73.125 77.25938 73.640625Q76.65 74.140625 75.69688 74.140625Q74.4625 74.140625 73.74375 73.25Q72.9 72.1875 72.9 69.765625ZM73.97813 69.765625Q73.97813 71.875 74.47813 72.578125Q74.97813 73.28125 75.69688 73.28125Q76.43125 73.28125 76.91563 72.578125Q77.41563 71.875 77.41563 69.765625Q77.41563 67.640625 76.91563 66.953125Q76.43125 66.25 75.68125 66.25Q74.9625 66.25 74.525 66.859375Q73.97813 67.640625 73.97813 69.765625Z" fill-rule="nonzero"/><path fill="#000000" d="M103.77843 409.6L102.73155 409.6L102.73155 402.88126Q102.34093 403.24063 101.71593 403.61563Q101.10655 403.975 100.62218 404.14688L100.62218 403.13126Q101.49718 402.70938 102.15343 402.13126Q102.8253 401.5375 103.10655 400.975L103.77843 400.975L103.77843 409.6ZM106.80968 405.36563Q106.80968 403.83438 107.12218 402.9125Q107.43468 401.975 108.04405 401.475Q108.66905 400.975 109.60655 400.975Q110.29405 400.975 110.80968 401.25626Q111.34093 401.5375 111.68468 402.06876Q112.02843 402.58438 112.21593 403.33438Q112.40343 404.08438 112.40343 405.36563Q112.40343 406.88126 112.09093 407.80313Q111.79405 408.725 111.16905 409.24063Q110.55968 409.74063 109.60655 409.74063Q108.37218 409.74063 107.65343 408.85Q106.80968 407.7875 106.80968 405.36563ZM107.8878 405.36563Q107.8878 407.475 108.3878 408.17813Q108.8878 408.88126 109.60655 408.88126Q110.34093 408.88126 110.8253 408.17813Q111.3253 407.475 111.3253 405.36563Q111.3253 403.24063 110.8253 402.55313Q110.34093 401.85 109.59093 401.85Q108.87218 401.85 108.43468 402.45938Q107.8878 403.24063 107.8878 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M209.90494 408.58438L209.90494 409.6L204.21744 409.6Q204.21744 409.225 204.34244 408.86563Q204.56119 408.2875 205.02994 407.725Q205.51431 407.1625 206.42056 406.42813Q207.82681 405.27188 208.31119 404.6Q208.81119 403.92813 208.81119 403.33438Q208.81119 402.70938 208.35806 402.2875Q207.90494 401.85 207.18619 401.85Q206.42056 401.85 205.96744 402.30313Q205.51431 402.75626 205.49869 403.56876L204.42056 403.45938Q204.52994 402.24063 205.24869 401.61563Q205.98306 400.975 207.21744 400.975Q208.45181 400.975 209.17056 401.6625Q209.88931 402.35 209.88931 403.36563Q209.88931 403.88126 209.67056 404.38126Q209.46744 404.86563 208.96744 405.42813Q208.48306 405.975 207.35806 406.92813Q206.40494 407.725 206.12369 408.02188Q205.85806 408.30313 205.68619 408.58438L209.90494 408.58438ZM211.35806 405.36563Q211.35806 403.83438 211.67056 402.9125Q211.98306 401.975 212.59244 401.475Q213.21744 400.975 214.15494 400.975Q214.84244 400.975 215.35806 401.25626Q215.88931 401.5375 216.23306 402.06876Q216.57681 402.58438 216.76431 403.33438Q216.95181 404.08438 216.95181 405.36563Q216.95181 406.88126 216.63931 407.80313Q216.34244 408.725 215.71744 409.24063Q215.10806 409.74063 214.15494 409.74063Q212.92056 409.74063 212.20181 408.85Q211.35806 407.7875 211.35806 405.36563ZM212.43619 405.36563Q212.43619 407.475 212.93619 408.17813Q213.43619 408.88126 214.15494 408.88126Q214.88931 408.88126 215.37369 408.17813Q215.87369 407.475 215.87369 405.36563Q215.87369 403.24063 215.37369 402.55313Q214.88931 401.85 214.13931 401.85Q213.42056 401.85 212.98306 402.45938Q212.43619 403.24063 212.43619 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M308.90646 407.33438L309.96896 407.19376Q310.14084 408.08438 310.57834 408.49063Q311.01584 408.88126 311.64084 408.88126Q312.39084 408.88126 312.90646 408.36563Q313.4221 407.85 313.4221 407.08438Q313.4221 406.36563 312.9377 405.89688Q312.46896 405.4125 311.7346 405.4125Q311.4377 405.4125 310.9846 405.5375L311.1096 404.6Q311.21896 404.61563 311.28146 404.61563Q311.95334 404.61563 312.4846 404.27188Q313.03146 403.9125 313.03146 403.17813Q313.03146 402.6 312.64084 402.225Q312.2502 401.83438 311.6252 401.83438Q311.01584 401.83438 310.59396 402.225Q310.1877 402.61563 310.07834 403.38126L309.01584 403.19376Q309.20334 402.14688 309.89084 401.56876Q310.57834 400.975 311.59396 400.975Q312.2971 400.975 312.89084 401.2875Q313.4846 401.58438 313.7971 402.1Q314.1096 402.61563 314.1096 403.20938Q314.1096 403.75626 313.8127 404.225Q313.51584 404.67813 312.9377 404.94376Q313.6877 405.11563 314.1096 405.67813Q314.53146 406.225 314.53146 407.06876Q314.53146 408.19376 313.70334 408.975Q312.89084 409.75626 311.64084 409.75626Q310.51584 409.75626 309.76584 409.08438Q309.01584 408.39688 308.90646 407.33438ZM315.90646 405.36563Q315.90646 403.83438 316.21896 402.9125Q316.53146 401.975 317.14084 401.475Q317.76584 400.975 318.70334 400.975Q319.39084 400.975 319.90646 401.25626Q320.4377 401.5375 320.78146 402.06876Q321.1252 402.58438 321.3127 403.33438Q321.5002 404.08438 321.5002 405.36563Q321.5002 406.88126 321.1877 407.80313Q320.89084 408.725 320.26584 409.24063Q319.65646 409.74063 318.70334 409.74063Q317.46896 409.74063 316.7502 408.85Q315.90646 407.7875 315.90646 405.36563ZM316.9846 405.36563Q316.9846 407.475 317.4846 408.17813Q317.9846 408.88126 318.70334 408.88126Q319.4377 408.88126 319.9221 408.17813Q320.4221 407.475 320.4221 405.36563Q320.4221 403.24063 319.9221 402.55313Q319.4377 401.85 318.6877 401.85Q317.96896 401.85 317.53146 402.45938Q316.9846 403.24063 316.9846 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M416.82983 409.6L416.82983 407.5375L413.11108 407.5375L413.11108 406.56876L417.03296 401.00626L417.89233 401.00626L417.89233 406.56876L419.04858 406.56876L419.04858 407.5375L417.89233 407.5375L417.89233 409.6L416.82983 409.6ZM416.82983 406.56876L416.82983 402.70938L414.14233 406.56876L416.82983 406.56876ZM420.45483 405.36563Q420.45483 403.83438 420.76733 402.9125Q421.07983 401.975 421.6892 401.475Q422.3142 400.975 423.2517 400.975Q423.9392 400.975 424.45483 401.25626Q424.98608 401.5375 425.32983 402.06876Q425.67358 402.58438 425.86108 403.33438Q426.04858 404.08438 426.04858 405.36563Q426.04858 406.88126 425.73608 407.80313Q425.4392 408.725 424.8142 409.24063Q424.20483 409.74063 423.2517 409.74063Q422.01733 409.74063 421.29858 408.85Q420.45483 407.7875 420.45483 405.36563ZM421.53296 405.36563Q421.53296 407.475 422.03296 408.17813Q422.53296 408.88126 423.2517 408.88126Q423.98608 408.88126 424.47046 408.17813Q424.97046 407.475 424.97046 405.36563Q424.97046 403.24063 424.47046 402.55313Q423.98608 401.85 423.23608 401.85Q422.51733 401.85 422.07983 402.45938Q421.53296 403.24063 421.53296 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M518.00323 407.35L519.1126 407.25626Q519.2376 408.06876 519.6751 408.475Q520.12823 408.88126 520.76886 408.88126Q521.51886 408.88126 522.0501 408.30313Q522.58136 407.725 522.58136 406.7875Q522.58136 405.88126 522.06573 405.36563Q521.56573 404.83438 520.7376 404.83438Q520.2376 404.83438 519.81573 405.06876Q519.4095 405.30313 519.1751 405.6625L518.19073 405.5375L519.01886 401.13126L523.3001 401.13126L523.3001 402.13126L519.8626 402.13126L519.4095 404.44376Q520.1751 403.89688 521.01886 403.89688Q522.14386 403.89688 522.9095 404.67813Q523.69073 405.45938 523.69073 406.69376Q523.69073 407.85 523.01886 408.70938Q522.19073 409.74063 520.76886 409.74063Q519.597 409.74063 518.847 409.08438Q518.1126 408.42813 518.00323 407.35ZM525.00323 405.36563Q525.00323 403.83438 525.31573 402.9125Q525.62823 401.975 526.2376 401.475Q526.8626 400.975 527.8001 400.975Q528.4876 400.975 529.00323 401.25626Q529.5345 401.5375 529.87823 402.06876Q530.222 402.58438 530.4095 403.33438Q530.597 404.08438 530.597 405.36563Q530.597 406.88126 530.2845 407.80313Q529.9876 408.725 529.3626 409.24063Q528.75323 409.74063 527.8001 409.74063Q526.56573 409.74063 525.847 408.85Q525.00323 407.7875 525.00323 405.36563ZM526.08136 405.36563Q526.08136 407.475 526.58136 408.17813Q527.08136 408.88126 527.8001 408.88126Q528.5345 408.88126 529.01886 408.17813Q529.51886 407.475 529.51886 405.36563Q529.51886 403.24063 529.01886 402.55313Q528.5345 401.85 527.7845 401.85Q527.06573 401.85 526.62823 402.45938Q526.08136 403.24063 526.08136 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M628.0204 403.11563L626.9735 403.19376Q626.8329 402.56876 626.5829 402.2875Q626.1454 401.83438 625.5204 401.83438Q625.0204 401.83438 624.62976 402.11563Q624.1454 402.49063 623.8485 403.19376Q623.56726 403.88126 623.55164 405.1625Q623.92664 404.58438 624.4735 404.30313Q625.036 404.02188 625.6454 404.02188Q626.69226 404.02188 627.42664 404.80313Q628.17664 405.58438 628.17664 406.80313Q628.17664 407.61563 627.81726 408.31876Q627.4735 409.00626 626.86414 409.38126Q626.25476 409.74063 625.48914 409.74063Q624.161 409.74063 623.3329 408.77188Q622.50476 407.80313 622.50476 405.58438Q622.50476 403.08438 623.42664 401.95938Q624.2235 400.975 625.5829 400.975Q626.5985 400.975 627.23914 401.55313Q627.8954 402.11563 628.0204 403.11563ZM623.7235 406.81876Q623.7235 407.36563 623.94226 407.86563Q624.17664 408.35 624.5829 408.61563Q625.00476 408.88126 625.4735 408.88126Q626.12976 408.88126 626.61414 408.35Q627.0985 407.80313 627.0985 406.88126Q627.0985 405.99063 626.61414 405.475Q626.1454 404.95938 625.42664 404.95938Q624.7079 404.95938 624.2079 405.475Q623.7235 405.99063 623.7235 406.81876ZM629.55164 405.36563Q629.55164 403.83438 629.86414 402.9125Q630.17664 401.975 630.786 401.475Q631.411 400.975 632.3485 400.975Q633.036 400.975 633.55164 401.25626Q634.0829 401.5375 634.42664 402.06876Q634.7704 402.58438 634.9579 403.33438Q635.1454 404.08438 635.1454 405.36563Q635.1454 406.88126 634.8329 407.80313Q634.536 408.725 633.911 409.24063Q633.30164 409.74063 632.3485 409.74063Q631.11414 409.74063 630.3954 408.85Q629.55164 407.7875 629.55164 405.36563ZM630.62976 405.36563Q630.62976 407.475 631.12976 408.17813Q631.62976 408.88126 632.3485 408.88126Q633.0829 408.88126 633.56726 408.17813Q634.06726 407.475 634.06726 405.36563Q634.06726 403.24063 633.56726 402.55313Q633.0829 401.85 632.3329 401.85Q631.61414 401.85 631.17664 402.45938Q630.62976 403.24063 630.62976 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M727.1625 402.13126L727.1625 401.11563L732.725 401.11563L732.725 401.94376Q731.9125 402.81876 731.1 404.27188Q730.3031 405.70938 729.8656 407.24063Q729.5375 408.31876 729.45935 409.6L728.3656 409.6Q728.3812 408.58438 728.7562 407.14688Q729.14685 405.70938 729.85 404.38126Q730.5687 403.05313 731.3812 402.13126L727.1625 402.13126ZM734.1 405.36563Q734.1 403.83438 734.4125 402.9125Q734.725 401.975 735.33435 401.475Q735.95935 400.975 736.89685 400.975Q737.58435 400.975 738.1 401.25626Q738.6312 401.5375 738.975 402.06876Q739.3187 402.58438 739.5062 403.33438Q739.6937 404.08438 739.6937 405.36563Q739.6937 406.88126 739.3812 407.80313Q739.08435 408.725 738.45935 409.24063Q737.85 409.74063 736.89685 409.74063Q735.6625 409.74063 734.9437 408.85Q734.1 407.7875 734.1 405.36563ZM735.1781 405.36563Q735.1781 407.475 735.6781 408.17813Q736.1781 408.88126 736.89685 408.88126Q737.6312 408.88126 738.1156 408.17813Q738.6156 407.475 738.6156 405.36563Q738.6156 403.24063 738.1156 402.55313Q737.6312 401.85 736.8812 401.85Q736.1625 401.85 735.725 402.45938Q735.1781 403.24063 735.1781 405.36563Z" fill-rule="nonzero"/><path fill="#757575" d="M24.946875 42.4L24.946875 28.087502L30.3375 28.087502Q31.775 28.087502 32.525 28.212502Q33.571877 28.400002 34.290627 28.900002Q35.009377 29.384377 35.43125 30.275002Q35.86875 31.165627 35.86875 32.228127Q35.86875 34.05625 34.696877 35.321877Q33.540627 36.571877 30.509375 36.571877L26.8375 36.571877L26.8375 42.4L24.946875 42.4ZM26.8375 34.884377L30.540625 34.884377Q32.36875 34.884377 33.134377 34.2125Q33.915627 33.525 33.915627 32.275Q33.915627 31.384377 33.4625 30.743752Q33.009377 30.103127 32.275 29.900002Q31.790625 29.775002 30.49375 29.775002L26.8375 29.775002L26.8375 34.884377ZM37.696877 42.4L37.696877 32.025L39.275 32.025L39.275 33.603127Q39.884377 32.49375 40.4 32.15Q40.915627 31.790627 41.525 31.790627Q42.415627 31.790627 43.3375 32.353127L42.728127 33.99375Q42.0875 33.603127 41.446877 33.603127Q40.86875 33.603127 40.4 33.9625Q39.946877 34.30625 39.74375 34.915627Q39.4625 35.853127 39.4625 36.9625L39.4625 42.4L37.696877 42.4ZM44.071877 37.2125Q44.071877 34.3375 45.665627 32.946877Q47.009377 31.790627 48.93125 31.790627Q51.071877 31.790627 52.415627 33.196877Q53.775 34.603127 53.775 37.071877Q53.775 39.071877 53.18125 40.228127Q52.5875 41.36875 51.43125 42.009377Q50.290627 42.634377 48.93125 42.634377Q46.74375 42.634377 45.4 41.24375Q44.071877 39.8375 44.071877 37.2125ZM45.86875 37.2125Q45.86875 39.2125 46.728127 40.196877Q47.603127 41.18125 48.93125 41.18125Q50.24375 41.18125 51.103127 40.196877Q51.978127 39.196877 51.978127 37.15Q51.978127 35.228127 51.103127 34.24375Q50.228127 33.24375 48.93125 33.24375Q47.603127 33.24375 46.728127 34.24375Q45.86875 35.228127 45.86875 37.2125ZM57.3375 42.4L55.7125 42.4L55.7125 28.087502L57.4625 28.087502L57.4625 33.196877Q58.5875 31.790627 60.30625 31.790627Q61.259377 31.790627 62.11875 32.18125Q62.978127 32.571877 63.525 33.275Q64.07188 33.9625 64.38438 34.946877Q64.69688 35.93125 64.69688 37.05625Q64.69688 39.728127 63.384377 41.18125Q62.071877 42.634377 60.228127 42.634377Q58.384377 42.634377 57.3375 41.103127L57.3375 42.4ZM57.321877 37.134377Q57.321877 38.99375 57.821877 39.8375Q58.665627 41.18125 60.071877 41.18125Q61.228127 41.18125 62.05625 40.18125Q62.9 39.18125 62.9 37.196877Q62.9 35.165627 62.0875 34.2125Q61.290627 33.24375 60.15 33.24375Q58.99375 33.24375 58.15 34.24375Q57.321877 35.24375 57.321877 37.134377ZM73.49375 41.11875Q72.50938 41.946877 71.60313 42.290627Q70.69688 42.634377 69.66563 42.634377Q67.9625 42.634377 67.04063 41.80625Q66.11875 40.9625 66.11875 39.665627Q66.11875 38.9 66.4625 38.275Q66.82188 37.65 67.38438 37.275Q67.94688 36.884377 68.65 36.68125Q69.16563 36.55625 70.2125 36.415627Q72.3375 36.165627 73.3375 35.821877Q73.35313 35.4625 73.35313 35.353127Q73.35313 34.290627 72.85313 33.8375Q72.18125 33.24375 70.85313 33.24375Q69.60313 33.24375 69.00938 33.68125Q68.43125 34.11875 68.15 35.228127L66.43125 34.99375Q66.66563 33.884377 67.19688 33.2125Q67.72813 32.525 68.74375 32.165627Q69.75938 31.790627 71.10313 31.790627Q72.43125 31.790627 73.25938 32.103127Q74.0875 32.415627 74.47813 32.9Q74.86875 33.36875 75.025 34.0875Q75.11875 34.540627 75.11875 35.7125L75.11875 38.05625Q75.11875 40.509377 75.22813 41.165627Q75.3375 41.80625 75.68125 42.4L73.8375 42.4Q73.57188 41.853127 73.49375 41.11875ZM73.3375 37.196877Q72.38438 37.5875 70.4625 37.853127Q69.38438 38.009377 68.93125 38.2125Q68.49375 38.4 68.24375 38.775Q67.99375 39.15 67.99375 39.61875Q67.99375 40.321877 68.525 40.790627Q69.05625 41.259377 70.0875 41.259377Q71.10313 41.259377 71.88438 40.821877Q72.68125 40.36875 73.05625 39.603127Q73.3375 38.99375 73.3375 37.8375L73.3375 37.196877ZM79.3375 42.4L77.7125 42.4L77.7125 28.087502L79.4625 28.087502L79.4625 33.196877Q80.5875 31.790627 82.30625 31.790627Q83.25938 31.790627 84.11875 32.18125Q84.97813 32.571877 85.525 33.275Q86.07188 33.9625 86.38438 34.946877Q86.69688 35.93125 86.69688 37.05625Q86.69688 39.728127 85.38438 41.18125Q84.07188 42.634377 82.22813 42.634377Q80.38438 42.634377 79.3375 41.103127L79.3375 42.4ZM79.32188 37.134377Q79.32188 38.99375 79.82188 39.8375Q80.66563 41.18125 82.07188 41.18125Q83.22813 41.18125 84.05625 40.18125Q84.9 39.18125 84.9 37.196877Q84.9 35.165627 84.0875 34.2125Q83.29063 33.24375 82.15 33.24375Q80.99375 33.24375 80.15 34.24375Q79.32188 35.24375 79.32188 37.134377ZM88.72813 30.103127L88.72813 28.087502L90.49375 28.087502L90.49375 30.103127L88.72813 30.103127ZM88.72813 42.4L88.72813 32.025L90.49375 32.025L90.49375 42.4L88.72813 42.4ZM92.68125 42.4L92.68125 28.087502L94.43125 28.087502L94.43125 42.4L92.68125 42.4ZM96.72813 30.103127L96.72813 28.087502L98.49375 28.087502L98.49375 30.103127L96.72813 30.103127ZM96.72813 42.4L96.72813 32.025L98.49375 32.025L98.49375 42.4L96.72813 42.4ZM104.55625 40.821877L104.80625 42.384377Q104.07188 42.540627 103.47813 42.540627Q102.525 42.540627 101.99375 42.24375Q101.47813 41.93125 101.25938 41.446877Q101.04063 40.946877 101.04063 39.36875L101.04063 33.4L99.75938 33.4L99.75938 32.025L101.04063 32.025L101.04063 29.462502L102.79063 28.400002L102.79063 32.025L104.55625 32.025L104.55625 33.4L102.79063 33.4L102.79063 39.4625Q102.79063 40.2125 102.88438 40.43125Q102.97813 40.634377 103.18125 40.775Q103.4 40.9 103.79063 40.9Q104.07188 40.9 104.55625 40.821877ZM106.63438 46.4L106.44688 44.74375Q107.025 44.9 107.44688 44.9Q108.04063 44.9 108.38438 44.696877Q108.74375 44.509377 108.9625 44.165627Q109.13438 43.9 109.50938 42.853127Q109.55625 42.696877 109.66563 42.415627L105.72813 32.025L107.61875 32.025L109.775 38.040627Q110.19688 39.18125 110.525 40.43125Q110.8375 39.228127 111.24375 38.071877L113.4625 32.025L115.22813 32.025L111.275 42.571877Q110.65 44.290627 110.29063 44.93125Q109.82188 45.80625 109.2125 46.196877Q108.61875 46.603127 107.775 46.603127Q107.25938 46.603127 106.63438 46.4ZM122.07188 37.2125Q122.07188 34.3375 123.66563 32.946877Q125.00938 31.790627 126.93125 31.790627Q129.07187 31.790627 130.41562 33.196877Q131.775 34.603127 131.775 37.071877Q131.775 39.071877 131.18124 40.228127Q130.5875 41.36875 129.43124 42.009377Q128.29062 42.634377 126.93125 42.634377Q124.74375 42.634377 123.4 41.24375Q122.07188 39.8375 122.07188 37.2125ZM123.86875 37.2125Q123.86875 39.2125 124.72813 40.196877Q125.60313 41.18125 126.93125 41.18125Q128.24374 41.18125 129.10312 40.196877Q129.97812 39.196877 129.97812 37.15Q129.97812 35.228127 129.10312 34.24375Q128.22812 33.24375 126.93125 33.24375Q125.60313 33.24375 124.72813 34.24375Q123.86875 35.228127 123.86875 37.2125ZM134.13437 42.4L134.13437 33.4L132.5875 33.4L132.5875 32.025L134.13437 32.025L134.13437 30.931252Q134.13437 29.884377 134.32187 29.368752Q134.57187 28.681252 135.2125 28.259377Q135.85312 27.837502 137.00937 27.837502Q137.75937 27.837502 138.65 28.009377L138.38437 29.540627Q137.8375 29.446877 137.35312 29.446877Q136.55624 29.446877 136.2125 29.790627Q135.88437 30.134377 135.88437 31.071877L135.88437 32.025L137.91562 32.025L137.91562 33.4L135.88437 33.4L135.88437 42.4L134.13437 42.4ZM152.49374 41.11875Q151.50937 41.946877 150.60312 42.290627Q149.69687 42.634377 148.66562 42.634377Q146.9625 42.634377 146.04062 41.80625Q145.11874 40.9625 145.11874 39.665627Q145.11874 38.9 145.4625 38.275Q145.82187 37.65 146.38437 37.275Q146.94687 36.884377 147.65 36.68125Q148.16562 36.55625 149.2125 36.415627Q151.3375 36.165627 152.3375 35.821877Q152.35312 35.4625 152.35312 35.353127Q152.35312 34.290627 151.85312 33.8375Q151.18124 33.24375 149.85312 33.24375Q148.60312 33.24375 148.00937 33.68125Q147.43124 34.11875 147.15 35.228127L145.43124 34.99375Q145.66562 33.884377 146.19687 33.2125Q146.72812 32.525 147.74374 32.165627Q148.75937 31.790627 150.10312 31.790627Q151.43124 31.790627 152.25937 32.103127Q153.0875 32.415627 153.47812 32.9Q153.86874 33.36875 154.025 34.0875Q154.11874 34.540627 154.11874 35.7125L154.11874 38.05625Q154.11874 40.509377 154.22812 41.165627Q154.3375 41.80625 154.68124 42.4L152.8375 42.4Q152.57187 41.853127 152.49374 41.11875ZM152.3375 37.196877Q151.38437 37.5875 149.4625 37.853127Q148.38437 38.009377 147.93124 38.2125Q147.49374 38.4 147.24374 38.775Q146.99374 39.15 146.99374 39.61875Q146.99374 40.321877 147.525 40.790627Q148.05624 41.259377 149.0875 41.259377Q150.10312 41.259377 150.88437 40.821877Q151.68124 40.36875 152.05624 39.603127Q152.3375 38.99375 152.3375 37.8375L152.3375 37.196877ZM173.16562 37.384377L175.05624 37.853127Q174.4625 40.196877 172.91562 41.43125Q171.36874 42.65 169.11874 42.65Q166.80624 42.65 165.35312 41.7125Q163.91562 40.759377 163.15 38.978127Q162.4 37.18125 162.4 35.134377Q162.4 32.9 163.24374 31.243752Q164.10312 29.571877 165.68124 28.712502Q167.25937 27.837502 169.15 27.837502Q171.30624 27.837502 172.75937 28.931252Q174.22812 30.025002 174.80624 32.009377L172.94687 32.446877Q172.44687 30.884377 171.49374 30.181252Q170.55624 29.462502 169.11874 29.462502Q167.4625 29.462502 166.35312 30.259377Q165.24374 31.040627 164.79062 32.384377Q164.35312 33.7125 164.35312 35.11875Q164.35312 36.946877 164.88437 38.321877Q165.41562 39.68125 166.54062 40.353127Q167.66562 41.025 168.9625 41.025Q170.55624 41.025 171.66562 40.103127Q172.775 39.18125 173.16562 37.384377ZM183.49374 41.11875Q182.50937 41.946877 181.60312 42.290627Q180.69687 42.634377 179.66562 42.634377Q177.9625 42.634377 177.04062 41.80625Q176.11874 40.9625 176.11874 39.665627Q176.11874 38.9 176.4625 38.275Q176.82187 37.65 177.38437 37.275Q177.94687 36.884377 178.65 36.68125Q179.16562 36.55625 180.2125 36.415627Q182.3375 36.165627 183.3375 35.821877Q183.35312 35.4625 183.35312 35.353127Q183.35312 34.290627 182.85312 33.8375Q182.18124 33.24375 180.85312 33.24375Q179.60312 33.24375 179.00937 33.68125Q178.43124 34.11875 178.15 35.228127L176.43124 34.99375Q176.66562 33.884377 177.19687 33.2125Q177.72812 32.525 178.74374 32.165627Q179.75937 31.790627 181.10312 31.790627Q182.43124 31.790627 183.25937 32.103127Q184.0875 32.415627 184.47812 32.9Q184.86874 33.36875 185.025 34.0875Q185.11874 34.540627 185.11874 35.7125L185.11874 38.05625Q185.11874 40.509377 185.22812 41.165627Q185.3375 41.80625 185.68124 42.4L183.8375 42.4Q183.57187 41.853127 183.49374 41.11875ZM183.3375 37.196877Q182.38437 37.5875 180.4625 37.853127Q179.38437 38.009377 178.93124 38.2125Q178.49374 38.4 178.24374 38.775Q177.99374 39.15 177.99374 39.61875Q177.99374 40.321877 178.525 40.790627Q179.05624 41.259377 180.0875 41.259377Q181.10312 41.259377 181.88437 40.821877Q182.68124 40.36875 183.05624 39.603127Q183.3375 38.99375 183.3375 37.8375L183.3375 37.196877ZM187.7125 42.4L187.7125 32.025L189.30624 32.025L189.30624 33.509377Q190.44687 31.790627 192.60312 31.790627Q193.54062 31.790627 194.32187 32.134377Q195.11874 32.4625 195.50937 33.009377Q195.9 33.55625 196.05624 34.30625Q196.15 34.80625 196.15 36.025L196.15 42.4L194.38437 42.4L194.38437 36.0875Q194.38437 35.009377 194.18124 34.478127Q193.97812 33.946877 193.44687 33.634377Q192.93124 33.321877 192.22812 33.321877Q191.10312 33.321877 190.29062 34.040627Q189.47812 34.74375 189.47812 36.728127L189.47812 42.4L187.7125 42.4ZM205.44687 42.4L205.44687 41.0875Q204.4625 42.634377 202.54062 42.634377Q201.30624 42.634377 200.25937 41.946877Q199.22812 41.259377 198.65 40.040627Q198.0875 38.821877 198.0875 37.228127Q198.0875 35.665627 198.60312 34.4Q199.11874 33.134377 200.15 32.4625Q201.19687 31.790627 202.4625 31.790627Q203.4 31.790627 204.13437 32.196877Q204.86874 32.5875 205.3375 33.2125L205.3375 28.087502L207.07187 28.087502L207.07187 42.4L205.44687 42.4ZM199.88437 37.228127Q199.88437 39.2125 200.72812 40.196877Q201.57187 41.18125 202.7125 41.18125Q203.86874 41.18125 204.66562 40.24375Q205.47812 39.30625 205.47812 37.36875Q205.47812 35.24375 204.65 34.24375Q203.8375 33.24375 202.63437 33.24375Q201.4625 33.24375 200.66562 34.2125Q199.88437 35.165627 199.88437 37.228127ZM209.72812 30.103127L209.72812 28.087502L211.49374 28.087502L211.49374 30.103127L209.72812 30.103127ZM209.72812 42.4L209.72812 32.025L211.49374 32.025L211.49374 42.4L209.72812 42.4ZM220.44687 42.4L220.44687 41.0875Q219.4625 42.634377 217.54062 42.634377Q216.30624 42.634377 215.25937 41.946877Q214.22812 41.259377 213.65 40.040627Q213.0875 38.821877 213.0875 37.228127Q213.0875 35.665627 213.60312 34.4Q214.11874 33.134377 215.15 32.4625Q216.19687 31.790627 217.4625 31.790627Q218.4 31.790627 219.13437 32.196877Q219.86874 32.5875 220.3375 33.2125L220.3375 28.087502L222.07187 28.087502L222.07187 42.4L220.44687 42.4ZM214.88437 37.228127Q214.88437 39.2125 215.72812 40.196877Q216.57187 41.18125 217.7125 41.18125Q218.86874 41.18125 219.66562 40.24375Q220.47812 39.30625 220.47812 37.36875Q220.47812 35.24375 219.65 34.24375Q218.8375 33.24375 217.63437 33.24375Q216.4625 33.24375 215.66562 34.2125Q214.88437 35.165627 214.88437 37.228127ZM231.49374 41.11875Q230.50937 41.946877 229.60312 42.290627Q228.69687 42.634377 227.66562 42.634377Q225.9625 42.634377 225.04062 41.80625Q224.11874 40.9625 224.11874 39.665627Q224.11874 38.9 224.4625 38.275Q224.82187 37.65 225.38437 37.275Q225.94687 36.884377 226.65 36.68125Q227.16562 36.55625 228.2125 36.415627Q230.3375 36.165627 231.3375 35.821877Q231.35312 35.4625 231.35312 35.353127Q231.35312 34.290627 230.85312 33.8375Q230.18124 33.24375 228.85312 33.24375Q227.60312 33.24375 227.00937 33.68125Q226.43124 34.11875 226.15 35.228127L224.43124 34.99375Q224.66562 33.884377 225.19687 33.2125Q225.72812 32.525 226.74374 32.165627Q227.75937 31.790627 229.10312 31.790627Q230.43124 31.790627 231.25937 32.103127Q232.0875 32.415627 232.47812 32.9Q232.86874 33.36875 233.025 34.0875Q233.11874 34.540627 233.11874 35.7125L233.11874 38.05625Q233.11874 40.509377 233.22812 41.165627Q233.3375 41.80625 233.68124 42.4L231.8375 42.4Q231.57187 41.853127 231.49374 41.11875ZM231.3375 37.196877Q230.38437 37.5875 228.4625 37.853127Q227.38437 38.009377 226.93124 38.2125Q226.49374 38.4 226.24374 38.775Q225.99374 39.15 225.99374 39.61875Q225.99374 40.321877 226.525 40.790627Q227.05624 41.259377 228.0875 41.259377Q229.10312 41.259377 229.88437 40.821877Q230.68124 40.36875 231.05624 39.603127Q231.3375 38.99375 231.3375 37.8375L231.3375 37.196877ZM239.55624 40.821877L239.80624 42.384377Q239.07187 42.540627 238.47812 42.540627Q237.525 42.540627 236.99374 42.24375Q236.47812 41.93125 236.25937 41.446877Q236.04062 40.946877 236.04062 39.36875L236.04062 33.4L234.75937 33.4L234.75937 32.025L236.04062 32.025L236.04062 29.462502L237.79062 28.400002L237.79062 32.025L239.55624 32.025L239.55624 33.4L237.79062 33.4L237.79062 39.4625Q237.79062 40.2125 237.88437 40.43125Q237.97812 40.634377 238.18124 40.775Q238.4 40.9 238.79062 40.9Q239.07187 40.9 239.55624 40.821877ZM248.82187 39.05625L250.63437 39.290627Q250.2125 40.86875 249.04062 41.759377Q247.88437 42.634377 246.07187 42.634377Q243.80624 42.634377 242.4625 41.24375Q241.13437 39.8375 241.13437 37.30625Q241.13437 34.68125 242.47812 33.24375Q243.82187 31.790627 245.97812 31.790627Q248.05624 31.790627 249.36874 33.2125Q250.69687 34.61875 250.69687 37.196877Q250.69687 37.353127 250.68124 37.665627L242.94687 37.665627Q243.04062 39.36875 243.91562 40.275Q244.79062 41.18125 246.0875 41.18125Q247.05624 41.18125 247.72812 40.68125Q248.41562 40.165627 248.82187 39.05625ZM243.04062 36.2125L248.8375 36.2125Q248.72812 34.915627 248.18124 34.259377Q247.3375 33.24375 245.99374 33.24375Q244.79062 33.24375 243.9625 34.05625Q243.13437 34.853127 243.04062 36.2125ZM258.94687 42.4L258.94687 28.087502L264.3375 28.087502Q265.775 28.087502 266.525 28.212502Q267.57187 28.400002 268.29062 28.900002Q269.00937 29.384377 269.43124 30.275002Q269.86874 31.165627 269.86874 32.228127Q269.86874 34.05625 268.69687 35.321877Q267.54062 36.571877 264.50937 36.571877L260.8375 36.571877L260.8375 42.4L258.94687 42.4ZM260.8375 34.884377L264.54062 34.884377Q266.36874 34.884377 267.13437 34.2125Q267.91562 33.525 267.91562 32.275Q267.91562 31.384377 267.4625 30.743752Q267.00937 30.103127 266.275 29.900002Q265.79062 29.775002 264.49374 29.775002L260.8375 29.775002L260.8375 34.884377ZM278.49374 41.11875Q277.50937 41.946877 276.60312 42.290627Q275.69687 42.634377 274.66562 42.634377Q272.9625 42.634377 272.04062 41.80625Q271.11874 40.9625 271.11874 39.665627Q271.11874 38.9 271.4625 38.275Q271.82187 37.65 272.38437 37.275Q272.94687 36.884377 273.65 36.68125Q274.16562 36.55625 275.2125 36.415627Q277.3375 36.165627 278.3375 35.821877Q278.35312 35.4625 278.35312 35.353127Q278.35312 34.290627 277.85312 33.8375Q277.18124 33.24375 275.85312 33.24375Q274.60312 33.24375 274.00937 33.68125Q273.43124 34.11875 273.15 35.228127L271.43124 34.99375Q271.66562 33.884377 272.19687 33.2125Q272.72812 32.525 273.74374 32.165627Q274.75937 31.790627 276.10312 31.790627Q277.43124 31.790627 278.25937 32.103127Q279.0875 32.415627 279.47812 32.9Q279.86874 33.36875 280.025 34.0875Q280.11874 34.540627 280.11874 35.7125L280.11874 38.05625Q280.11874 40.509377 280.22812 41.165627Q280.3375 41.80625 280.68124 42.4L278.8375 42.4Q278.57187 41.853127 278.49374 41.11875ZM278.3375 37.196877Q277.38437 37.5875 275.4625 37.853127Q274.38437 38.009377 273.93124 38.2125Q273.49374 38.4 273.24374 38.775Q272.99374 39.15 272.99374 39.61875Q272.99374 40.321877 273.525 40.790627Q274.05624 41.259377 275.0875 41.259377Q276.10312 41.259377 276.88437 40.821877Q277.68124 40.36875 278.05624 39.603127Q278.3375 38.99375 278.3375 37.8375L278.3375 37.196877ZM282.00937 39.30625L283.75937 39.025Q283.9 40.071877 284.57187 40.634377Q285.24374 41.18125 286.44687 41.18125Q287.65 41.18125 288.22812 40.696877Q288.82187 40.196877 288.82187 39.540627Q288.82187 38.946877 288.30624 38.603127Q287.94687 38.36875 286.50937 38.009377Q284.57187 37.509377 283.82187 37.165627Q283.0875 36.80625 282.69687 36.18125Q282.30624 35.540627 282.30624 34.775Q282.30624 34.0875 282.61874 33.49375Q282.94687 32.9 283.49374 32.509377Q283.9 32.2125 284.60312 32.009377Q285.32187 31.790627 286.13437 31.790627Q287.35312 31.790627 288.275 32.15Q289.19687 32.49375 289.63437 33.103127Q290.07187 33.696877 290.24374 34.696877L288.525 34.93125Q288.4 34.134377 287.8375 33.696877Q287.275 33.24375 286.25937 33.24375Q285.04062 33.24375 284.525 33.65Q284.00937 34.040627 284.00937 34.571877Q284.00937 34.915627 284.22812 35.196877Q284.43124 35.478127 284.9 35.665627Q285.16562 35.759377 286.44687 36.103127Q288.32187 36.603127 289.05624 36.93125Q289.79062 37.24375 290.2125 37.853127Q290.63437 38.446877 290.63437 39.353127Q290.63437 40.228127 290.11874 41.009377Q289.60312 41.790627 288.63437 42.2125Q287.66562 42.634377 286.44687 42.634377Q284.43124 42.634377 283.36874 41.790627Q282.30624 40.946877 282.00937 39.30625ZM292.00937 39.30625L293.75937 39.025Q293.9 40.071877 294.57187 40.634377Q295.24374 41.18125 296.44687 41.18125Q297.65 41.18125 298.22812 40.696877Q298.82187 40.196877 298.82187 39.540627Q298.82187 38.946877 298.30624 38.603127Q297.94687 38.36875 296.50937 38.009377Q294.57187 37.509377 293.82187 37.165627Q293.0875 36.80625 292.69687 36.18125Q292.30624 35.540627 292.30624 34.775Q292.30624 34.0875 292.61874 33.49375Q292.94687 32.9 293.49374 32.509377Q293.9 32.2125 294.60312 32.009377Q295.32187 31.790627 296.13437 31.790627Q297.35312 31.790627 298.275 32.15Q299.19687 32.49375 299.63437 33.103127Q300.07187 33.696877 300.24374 34.696877L298.525 34.93125Q298.4 34.134377 297.8375 33.696877Q297.275 33.24375 296.25937 33.24375Q295.04062 33.24375 294.525 33.65Q294.00937 34.040627 294.00937 34.571877Q294.00937 34.915627 294.22812 35.196877Q294.43124 35.478127 294.9 35.665627Q295.16562 35.759377 296.44687 36.103127Q298.32187 36.603127 299.05624 36.93125Q299.79062 37.24375 300.2125 37.853127Q300.63437 38.446877 300.63437 39.353127Q300.63437 40.228127 300.11874 41.009377Q299.60312 41.790627 298.63437 42.2125Q297.66562 42.634377 296.44687 42.634377Q294.43124 42.634377 293.36874 41.790627Q292.30624 40.946877 292.00937 39.30625ZM304.63437 42.4L301.4625 32.025L303.275 32.025L304.93124 38.009377L305.54062 40.24375Q305.5875 40.071877 306.07187 38.103127L307.72812 32.025L309.54062 32.025L311.0875 38.040627L311.60312 40.025L312.19687 38.025L313.97812 32.025L315.68124 32.025L312.44687 42.4L310.61874 42.4L308.9625 36.18125L308.57187 34.415627L306.4625 42.4L304.63437 42.4ZM316.07187 37.2125Q316.07187 34.3375 317.66562 32.946877Q319.00937 31.790627 320.93124 31.790627Q323.07187 31.790627 324.41562 33.196877Q325.775 34.603127 325.775 37.071877Q325.775 39.071877 325.18124 40.228127Q324.5875 41.36875 323.43124 42.009377Q322.29062 42.634377 320.93124 42.634377Q318.74374 42.634377 317.4 41.24375Q316.07187 39.8375 316.07187 37.2125ZM317.86874 37.2125Q317.86874 39.2125 318.72812 40.196877Q319.60312 41.18125 320.93124 41.18125Q322.24374 41.18125 323.10312 40.196877Q323.97812 39.196877 323.97812 37.15Q323.97812 35.228127 323.10312 34.24375Q322.22812 33.24375 320.93124 33.24375Q319.60312 33.24375 318.72812 34.24375Q317.86874 35.228127 317.86874 37.2125ZM327.69687 42.4L327.69687 32.025L329.275 32.025L329.275 33.603127Q329.88437 32.49375 330.4 32.15Q330.91562 31.790627 331.525 31.790627Q332.41562 31.790627 333.3375 32.353127L332.72812 33.99375Q332.0875 33.603127 331.44687 33.603127Q330.86874 33.603127 330.4 33.9625Q329.94687 34.30625 329.74374 34.915627Q329.4625 35.853127 329.4625 36.9625L329.4625 42.4L327.69687 42.4ZM341.44687 42.4L341.44687 41.0875Q340.4625 42.634377 338.54062 42.634377Q337.30624 42.634377 336.25937 41.946877Q335.22812 41.259377 334.65 40.040627Q334.0875 38.821877 334.0875 37.228127Q334.0875 35.665627 334.60312 34.4Q335.11874 33.134377 336.15 32.4625Q337.19687 31.790627 338.4625 31.790627Q339.4 31.790627 340.13437 32.196877Q340.86874 32.5875 341.3375 33.2125L341.3375 28.087502L343.07187 28.087502L343.07187 42.4L341.44687 42.4ZM335.88437 37.228127Q335.88437 39.2125 336.72812 40.196877Q337.57187 41.18125 338.7125 41.18125Q339.86874 41.18125 340.66562 40.24375Q341.47812 39.30625 341.47812 37.36875Q341.47812 35.24375 340.65 34.24375Q339.8375 33.24375 338.63437 33.24375Q337.4625 33.24375 336.66562 34.2125Q335.88437 35.165627 335.88437 37.228127ZM351.94687 42.4L351.94687 28.087502L357.3375 28.087502Q358.775 28.087502 359.525 28.212502Q360.57187 28.400002 361.29062 28.900002Q362.00937 29.384377 362.43124 30.275002Q362.86874 31.165627 362.86874 32.228127Q362.86874 34.05625 361.69687 35.321877Q360.54062 36.571877 357.50937 36.571877L353.8375 36.571877L353.8375 42.4L351.94687 42.4ZM353.8375 34.884377L357.54062 34.884377Q359.36874 34.884377 360.13437 34.2125Q360.91562 33.525 360.91562 32.275Q360.91562 31.384377 360.4625 30.743752Q360.00937 30.103127 359.275 29.900002Q358.79062 29.775002 357.49374 29.775002L353.8375 29.775002L353.8375 34.884377ZM371.49374 41.11875Q370.50937 41.946877 369.60312 42.290627Q368.69687 42.634377 367.66562 42.634377Q365.9625 42.634377 365.04062 41.80625Q364.11874 40.9625 364.11874 39.665627Q364.11874 38.9 364.4625 38.275Q364.82187 37.65 365.38437 37.275Q365.94687 36.884377 366.65 36.68125Q367.16562 36.55625 368.2125 36.415627Q370.3375 36.165627 371.3375 35.821877Q371.35312 35.4625 371.35312 35.353127Q371.35312 34.290627 370.85312 33.8375Q370.18124 33.24375 368.85312 33.24375Q367.60312 33.24375 367.00937 33.68125Q366.43124 34.11875 366.15 35.228127L364.43124 34.99375Q364.66562 33.884377 365.19687 33.2125Q365.72812 32.525 366.74374 32.165627Q367.75937 31.790627 369.10312 31.790627Q370.43124 31.790627 371.25937 32.103127Q372.0875 32.415627 372.47812 32.9Q372.86874 33.36875 373.025 34.0875Q373.11874 34.540627 373.11874 35.7125L373.11874 38.05625Q373.11874 40.509377 373.22812 41.165627Q373.3375 41.80625 373.68124 42.4L371.8375 42.4Q371.57187 41.853127 371.49374 41.11875ZM371.3375 37.196877Q370.38437 37.5875 368.4625 37.853127Q367.38437 38.009377 366.93124 38.2125Q366.49374 38.4 366.24374 38.775Q365.99374 39.15 365.99374 39.61875Q365.99374 40.321877 366.525 40.790627Q367.05624 41.259377 368.0875 41.259377Q369.10312 41.259377 369.88437 40.821877Q370.68124 40.36875 371.05624 39.603127Q371.3375 38.99375 371.3375 37.8375L371.3375 37.196877ZM375.00937 39.30625L376.75937 39.025Q376.9 40.071877 377.57187 40.634377Q378.24374 41.18125 379.44687 41.18125Q380.65 41.18125 381.22812 40.696877Q381.82187 40.196877 381.82187 39.540627Q381.82187 38.946877 381.30624 38.603127Q380.94687 38.36875 379.50937 38.009377Q377.57187 37.509377 376.82187 37.165627Q376.0875 36.80625 375.69687 36.18125Q375.30624 35.540627 375.30624 34.775Q375.30624 34.0875 375.61874 33.49375Q375.94687 32.9 376.49374 32.509377Q376.9 32.2125 377.60312 32.009377Q378.32187 31.790627 379.13437 31.790627Q380.35312 31.790627 381.275 32.15Q382.19687 32.49375 382.63437 33.103127Q383.07187 33.696877 383.24374 34.696877L381.525 34.93125Q381.4 34.134377 380.8375 33.696877Q380.275 33.24375 379.25937 33.24375Q378.04062 33.24375 377.525 33.65Q377.00937 34.040627 377.00937 34.571877Q377.00937 34.915627 377.22812 35.196877Q377.43124 35.478127 377.9 35.665627Q378.16562 35.759377 379.44687 36.103127Q381.32187 36.603127 382.05624 36.93125Q382.79062 37.24375 383.2125 37.853127Q383.63437 38.446877 383.63437 39.353127Q383.63437 40.228127 383.11874 41.009377Q382.60312 41.790627 381.63437 42.2125Q380.66562 42.634377 379.44687 42.634377Q377.43124 42.634377 376.36874 41.790627Q375.30624 40.946877 375.00937 39.30625ZM385.00937 39.30625L386.75937 39.025Q386.9 40.071877 387.57187 40.634377Q388.24374 41.18125 389.44687 41.18125Q390.65 41.18125 391.22812 40.696877Q391.82187 40.196877 391.82187 39.540627Q391.82187 38.946877 391.30624 38.603127Q390.94687 38.36875 389.50937 38.009377Q387.57187 37.509377 386.82187 37.165627Q386.0875 36.80625 385.69687 36.18125Q385.30624 35.540627 385.30624 34.775Q385.30624 34.0875 385.61874 33.49375Q385.94687 32.9 386.49374 32.509377Q386.9 32.2125 387.60312 32.009377Q388.32187 31.790627 389.13437 31.790627Q390.35312 31.790627 391.275 32.15Q392.19687 32.49375 392.63437 33.103127Q393.07187 33.696877 393.24374 34.696877L391.525 34.93125Q391.4 34.134377 390.8375 33.696877Q390.275 33.24375 389.25937 33.24375Q388.04062 33.24375 387.525 33.65Q387.00937 34.040627 387.00937 34.571877Q387.00937 34.915627 387.22812 35.196877Q387.43124 35.478127 387.9 35.665627Q388.16562 35.759377 389.44687 36.103127Q391.32187 36.603127 392.05624 36.93125Q392.79062 37.24375 393.2125 37.853127Q393.63437 38.446877 393.63437 39.353127Q393.63437 40.228127 393.11874 41.009377Q392.60312 41.790627 391.63437 42.2125Q390.66562 42.634377 389.44687 42.634377Q387.43124 42.634377 386.36874 41.790627Q385.30624 40.946877 385.00937 39.30625ZM395.72812 30.103127L395.72812 28.087502L397.49374 28.087502L397.49374 30.103127L395.72812 30.103127ZM395.72812 42.4L395.72812 32.025L397.49374 32.025L397.49374 42.4L395.72812 42.4ZM399.7125 42.4L399.7125 32.025L401.30624 32.025L401.30624 33.509377Q402.44687 31.790627 404.60312 31.790627Q405.54062 31.790627 406.32187 32.134377Q407.11874 32.4625 407.50937 33.009377Q407.9 33.55625 408.05624 34.30625Q408.15 34.80625 408.15 36.025L408.15 42.4L406.38437 42.4L406.38437 36.0875Q406.38437 35.009377 406.18124 34.478127Q405.97812 33.946877 405.44687 33.634377Q404.93124 33.321877 404.22812 33.321877Q403.10312 33.321877 402.29062 34.040627Q401.47812 34.74375 401.47812 36.728127L401.47812 42.4L399.7125 42.4ZM410.4 43.259377L412.10312 43.509377Q412.2125 44.30625 412.69687 44.665627Q413.35312 45.15 414.49374 45.15Q415.7125 45.15 416.36874 44.665627Q417.04062 44.18125 417.275 43.30625Q417.41562 42.759377 417.4 41.040627Q416.24374 42.4 414.525 42.4Q412.38437 42.4 411.2125 40.853127Q410.04062 39.30625 410.04062 37.15Q410.04062 35.665627 410.57187 34.415627Q411.11874 33.165627 412.13437 32.478127Q413.16562 31.790627 414.54062 31.790627Q416.36874 31.790627 417.57187 33.275L417.57187 32.025L419.18124 32.025L419.18124 40.99375Q419.18124 43.415627 418.68124 44.415627Q418.19687 45.43125 417.11874 46.009377Q416.05624 46.603127 414.49374 46.603127Q412.65 46.603127 411.49374 45.775Q410.35312 44.946877 410.4 43.259377ZM411.85312 37.025Q411.85312 39.071877 412.66562 40.009377Q413.47812 40.946877 414.69687 40.946877Q415.9 40.946877 416.7125 40.009377Q417.54062 39.071877 417.54062 37.0875Q417.54062 35.18125 416.69687 34.2125Q415.85312 33.24375 414.66562 33.24375Q413.49374 33.24375 412.66562 34.196877Q411.85312 35.15 411.85312 37.025ZM426.36874 42.4L431.86874 28.087502L433.91562 28.087502L439.775 42.4L437.61874 42.4L435.94687 38.05625L429.9625 38.05625L428.38437 42.4L426.36874 42.4ZM430.50937 36.525L435.35312 36.525L433.86874 32.55625Q433.18124 30.743752 432.85312 29.587502Q432.57187 30.962502 432.07187 32.321877L430.50937 36.525ZM440.68124 42.4L440.68124 28.087502L442.43124 28.087502L442.43124 42.4L440.68124 42.4ZM444.68124 42.4L444.68124 28.087502L446.43124 28.087502L446.43124 42.4L444.68124 42.4ZM454.97812 42.4L454.97812 28.087502L461.32187 28.087502Q463.22812 28.087502 464.22812 28.478127Q465.22812 28.853127 465.82187 29.837502Q466.41562 30.806252 466.41562 31.993752Q466.41562 33.509377 465.43124 34.55625Q464.44687 35.603127 462.38437 35.884377Q463.13437 36.24375 463.525 36.603127Q464.35312 37.353127 465.10312 38.509377L467.5875 42.4L465.2125 42.4L463.30624 39.415627Q462.47812 38.134377 461.94687 37.446877Q461.41562 36.759377 460.97812 36.49375Q460.55624 36.2125 460.11874 36.103127Q459.79062 36.040627 459.07187 36.040627L456.86874 36.040627L456.86874 42.4L454.97812 42.4ZM456.86874 34.4L460.94687 34.4Q462.24374 34.4 462.9625 34.134377Q463.69687 33.86875 464.07187 33.275Q464.4625 32.68125 464.4625 31.993752Q464.4625 30.978127 463.72812 30.321877Q462.99374 29.665627 461.4 29.665627L456.86874 29.665627L456.86874 34.4ZM475.50937 42.4L475.50937 40.86875Q474.30624 42.634377 472.22812 42.634377Q471.30624 42.634377 470.50937 42.290627Q469.7125 41.93125 469.32187 41.4Q468.94687 40.86875 468.79062 40.0875Q468.68124 39.571877 468.68124 38.446877L468.68124 32.025L470.43124 32.025L470.43124 37.775Q470.43124 39.15 470.54062 39.634377Q470.7125 40.321877 471.24374 40.728127Q471.79062 41.11875 472.57187 41.11875Q473.36874 41.11875 474.05624 40.7125Q474.75937 40.30625 475.04062 39.61875Q475.3375 38.915627 475.3375 37.5875L475.3375 32.025L477.0875 32.025L477.0875 42.4L475.50937 42.4ZM479.68124 42.4L479.68124 28.087502L481.43124 28.087502L481.43124 42.4L479.68124 42.4ZM490.82187 39.05625L492.63437 39.290627Q492.2125 40.86875 491.04062 41.759377Q489.88437 42.634377 488.07187 42.634377Q485.80624 42.634377 484.4625 41.24375Q483.13437 39.8375 483.13437 37.30625Q483.13437 34.68125 484.47812 33.24375Q485.82187 31.790627 487.97812 31.790627Q490.05624 31.790627 491.36874 33.2125Q492.69687 34.61875 492.69687 37.196877Q492.69687 37.353127 492.68124 37.665627L484.94687 37.665627Q485.04062 39.36875 485.91562 40.275Q486.79062 41.18125 488.0875 41.18125Q489.05624 41.18125 489.72812 40.68125Q490.41562 40.165627 490.82187 39.05625ZM485.04062 36.2125L490.8375 36.2125Q490.72812 34.915627 490.18124 34.259377Q489.3375 33.24375 487.99374 33.24375Q486.79062 33.24375 485.9625 34.05625Q485.13437 34.853127 485.04062 36.2125ZM494.00937 39.30625L495.75937 39.025Q495.9 40.071877 496.57187 40.634377Q497.24374 41.18125 498.44687 41.18125Q499.65 41.18125 500.22812 40.696877Q500.82187 40.196877 500.82187 39.540627Q500.82187 38.946877 500.30624 38.603127Q499.94687 38.36875 498.50937 38.009377Q496.57187 37.509377 495.82187 37.165627Q495.0875 36.80625 494.69687 36.18125Q494.30624 35.540627 494.30624 34.775Q494.30624 34.0875 494.61874 33.49375Q494.94687 32.9 495.49374 32.509377Q495.9 32.2125 496.60312 32.009377Q497.32187 31.790627 498.13437 31.790627Q499.35312 31.790627 500.275 32.15Q501.19687 32.49375 501.63437 33.103127Q502.07187 33.696877 502.24374 34.696877L500.525 34.93125Q500.4 34.134377 499.8375 33.696877Q499.275 33.24375 498.25937 33.24375Q497.04062 33.24375 496.525 33.65Q496.00937 34.040627 496.00937 34.571877Q496.00937 34.915627 496.22812 35.196877Q496.43124 35.478127 496.9 35.665627Q497.16562 35.759377 498.44687 36.103127Q500.32187 36.603127 501.05624 36.93125Q501.79062 37.24375 502.2125 37.853127Q502.63437 38.446877 502.63437 39.353127Q502.63437 40.228127 502.11874 41.009377Q501.60312 41.790627 500.63437 42.2125Q499.66562 42.634377 498.44687 42.634377Q496.43124 42.634377 495.36874 41.790627Q494.30624 40.946877 494.00937 39.30625Z" fill-rule="nonzero"/></svg>
\ No newline at end of file
diff --git a/website/public/img/vault-password-policy-flow.svg b/website/public/img/vault-password-policy-flow.svg
deleted file mode 100644
index 3c000b7112d..00000000000
--- a/website/public/img/vault-password-policy-flow.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg version="1.1" viewBox="0.0 0.0 728.485564304462 225.39107611548556" fill="none" stroke="none" stroke-linecap="square" stroke-miterlimit="10" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg"><clipPath id="p.0"><path d="m0 0l728.48553 0l0 225.39108l-728.48553 0l0 -225.39108z" clip-rule="nonzero"/></clipPath><g clip-path="url(#p.0)"><path fill="#000000" fill-opacity="0.0" d="m0 0l728.48553 0l0 225.39108l-728.48553 0z" fill-rule="evenodd"/><path fill="#ffffff" d="m8.0 72.231064l0 0c0 -2.6498566 2.1481361 -4.7979965 4.7979965 -4.7979965l53.774086 0c1.2725067 0 2.492897 0.5055084 3.3926926 1.405304c0.89980316 0.89979553 1.405304 2.1201859 1.405304 3.3926926l0 19.191414c0 2.6498566 -2.14814 4.7979965 -4.7979965 4.7979965l-53.774086 0c-2.6498604 0 -4.7979965 -2.14814 -4.7979965 -4.7979965z" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m8.0 72.231064l0 0c0 -2.6498566 2.1481361 -4.7979965 4.7979965 -4.7979965l53.774086 0c1.2725067 0 2.492897 0.5055084 3.3926926 1.405304c0.89980316 0.89979553 1.405304 2.1201859 1.405304 3.3926926l0 19.191414c0 2.6498566 -2.14814 4.7979965 -4.7979965 4.7979965l-53.774086 0c-2.6498604 0 -4.7979965 -2.14814 -4.7979965 -4.7979965z" fill-rule="evenodd"/><path fill="#000000" d="m26.205502 83.56427l1.203125 -0.109375q0.078125 0.71875 0.390625 1.1875q0.3125 0.453125 0.953125 0.734375q0.65625 0.28125 1.46875 0.28125q0.71875 0 1.265625 -0.21875q0.5625 -0.21875 0.828125 -0.578125q0.265625 -0.375 0.265625 -0.828125q0 -0.453125 -0.265625 -0.78125q-0.25 -0.328125 -0.84375 -0.5625q-0.390625 -0.15625 -1.703125 -0.46875q-1.3125 -0.3125 -1.84375 -0.59375q-0.671875 -0.359375 -1.015625 -0.890625q-0.328125 -0.53125 -0.328125 -1.1875q0 -0.71875 0.40625 -1.34375q0.40625 -0.625 1.1875 -0.953125q0.796875 -0.328125 1.765625 -0.328125q1.046875 0 1.859375 0.34375q0.8125 0.34375 1.25 1.015625q0.4375 0.65625 0.46875 1.484375l-1.203125 0.09375q-0.109375 -0.90625 -0.671875 -1.359375q-0.5625 -0.46875 -1.65625 -0.46875q-1.140625 0 -1.671875 0.421875q-0.515625 0.421875 -0.515625 1.015625q0 0.515625 0.359375 0.84375q0.375 0.328125 1.90625 0.6875q1.546875 0.34375 2.109375 0.59375q0.84375 0.390625 1.234375 0.984375q0.390625 0.578125 0.390625 1.359375q0 0.75 -0.4375 1.4375q-0.421875 0.671875 -1.25 1.046875q-0.8125 0.359375 -1.828125 0.359375q-1.296875 0 -2.171875 -0.375q-0.875 -0.375 -1.375 -1.125q-0.5 -0.765625 -0.53125 -1.71875zm11.733505 2.015625l0.171875 1.03125q-0.5 0.109375 -0.890625 0.109375q-0.640625 0 -1.0 -0.203125q-0.34375 -0.203125 -0.484375 -0.53125q-0.140625 -0.328125 -0.140625 -1.390625l0 -3.96875l-0.859375 0l0 -0.90625l0.859375 0l0 -1.71875l1.171875 -0.703125l0 2.421875l1.171875 0l0 0.90625l-1.171875 0l0 4.046875q0 0.5 0.046875 0.640625q0.0625 0.140625 0.203125 0.234375q0.140625 0.078125 0.40625 0.078125q0.203125 0 0.515625 -0.046875zm5.6561127 0.1875q-0.65625 0.5625 -1.265625 0.796875q-0.59375 0.21875 -1.28125 0.21875q-1.140625 0 -1.75 -0.546875q-0.609375 -0.5625 -0.609375 -1.4375q0 -0.5 0.21875 -0.921875q0.234375 -0.421875 0.609375 -0.671875q0.375 -0.25 0.84375 -0.390625q0.34375 -0.078125 1.046875 -0.171875q1.421875 -0.171875 2.09375 -0.40625q0 -0.234375 0 -0.296875q0 -0.71875 -0.328125 -1.015625q-0.453125 -0.390625 -1.34375 -0.390625q-0.8125 0 -1.21875 0.296875q-0.390625 0.28125 -0.578125 1.015625l-1.140625 -0.15625q0.15625 -0.734375 0.515625 -1.1875q0.359375 -0.453125 1.03125 -0.6875q0.671875 -0.25 1.5625 -0.25q0.890625 0 1.4375 0.203125q0.5625 0.203125 0.8125 0.53125q0.265625 0.3125 0.375 0.796875q0.046875 0.296875 0.046875 1.078125l0 1.5625q0 1.625 0.078125 2.0625q0.078125 0.4375 0.296875 0.828125l-1.21875 0q-0.1875 -0.359375 -0.234375 -0.859375zm-0.09375 -2.609375q-0.640625 0.265625 -1.921875 0.4375q-0.71875 0.109375 -1.015625 0.25q-0.296875 0.125 -0.46875 0.375q-0.15625 0.25 -0.15625 0.546875q0 0.46875 0.34375 0.78125q0.359375 0.3125 1.046875 0.3125q0.671875 0 1.203125 -0.296875q0.53125 -0.296875 0.78125 -0.8125q0.1875 -0.390625 0.1875 -1.171875l0 -0.421875zm2.9749756 3.46875l0 -6.90625l1.0625 0l0 1.046875q0.40625 -0.734375 0.734375 -0.96875q0.34375 -0.234375 0.765625 -0.234375q0.59375 0 1.203125 0.375l-0.40625 1.078125q-0.4375 -0.25 -0.859375 -0.25q-0.390625 0 -0.703125 0.234375q-0.296875 0.234375 -0.421875 0.640625q-0.203125 0.625 -0.203125 1.359375l0 3.625l-1.171875 0zm7.0164948 -1.046875l0.171875 1.03125q-0.5 0.109375 -0.890625 0.109375q-0.640625 0 -1.0 -0.203125q-0.34375 -0.203125 -0.484375 -0.53125q-0.140625 -0.328125 -0.140625 -1.390625l0 -3.96875l-0.859375 0l0 -0.90625l0.859375 0l0 -1.71875l1.171875 -0.703125l0 2.421875l1.171875 0l0 0.90625l-1.171875 0l0 4.046875q0 0.5 0.046875 0.640625q0.0625 0.140625 0.203125 0.234375q0.140625 0.078125 0.40625 0.078125q0.203125 0 0.515625 -0.046875z" fill-rule="nonzero"/><path fill="#ffffff" d="m263.76904 67.32823l0 0c0 -4.003784 3.245697 -7.2494926 7.249481 -7.2494926l136.43015 0c1.922699 0 3.766632 0.7637825 5.1261597 2.1233253c1.3595581 1.3595428 2.1233215 3.2034836 2.1233215 5.1261673l0 28.997086c0 4.0037766 -3.245697 7.249489 -7.249481 7.249489l-136.43015 0c-4.003784 0 -7.249481 -3.2457123 -7.249481 -7.249489z" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m263.76904 67.32823l0 0c0 -4.003784 3.245697 -7.2494926 7.249481 -7.2494926l136.43015 0c1.922699 0 3.766632 0.7637825 5.1261597 2.1233253c1.3595581 1.3595428 2.1233215 3.2034836 2.1233215 5.1261673l0 28.997086c0 4.0037766 -3.245697 7.249489 -7.249481 7.249489l-136.43015 0c-4.003784 0 -7.249481 -3.2457123 -7.249481 -7.249489z" fill-rule="evenodd"/><path fill="#000000" d="m286.19522 74.892395l0 -1.125l4.03125 -0.015625l0 3.546875q-0.921875 0.75 -1.921875 1.125q-0.984375 0.359375 -2.03125 0.359375q-1.40625 0 -2.5625 -0.59375q-1.140625 -0.609375 -1.734375 -1.734375q-0.578125 -1.140625 -0.578125 -2.546875q0 -1.40625 0.578125 -2.609375q0.59375 -1.203125 1.6875 -1.78125q1.09375 -0.59375 2.515625 -0.59375q1.03125 0 1.859375 0.34375q0.84375 0.328125 1.3125 0.9375q0.484375 0.59375 0.734375 1.546875l-1.140625 0.3125q-0.21875 -0.71875 -0.53125 -1.140625q-0.3125 -0.421875 -0.90625 -0.671875q-0.59375 -0.25 -1.3125 -0.25q-0.875 0 -1.515625 0.265625q-0.625 0.265625 -1.015625 0.703125q-0.375 0.421875 -0.59375 0.9375q-0.359375 0.875 -0.359375 1.921875q0 1.265625 0.4375 2.125q0.4375 0.859375 1.265625 1.28125q0.84375 0.421875 1.796875 0.421875q0.8125 0 1.59375 -0.3125q0.78125 -0.328125 1.1875 -0.6875l0 -1.765625l-2.796875 0zm10.47641 1.515625l1.203125 0.140625q-0.28125 1.0625 -1.0625 1.65625q-0.765625 0.578125 -1.96875 0.578125q-1.515625 0 -2.40625 -0.9375q-0.890625 -0.9375 -0.890625 -2.609375q0 -1.75 0.890625 -2.703125q0.90625 -0.96875 2.34375 -0.96875q1.390625 0 2.265625 0.9375q0.875 0.9375 0.875 2.65625q0 0.109375 0 0.3125l-5.15625 0q0.0625 1.140625 0.640625 1.75q0.578125 0.59375 1.4375 0.59375q0.65625 0 1.109375 -0.328125q0.453125 -0.34375 0.71875 -1.078125zm-3.84375 -1.90625l3.859375 0q-0.078125 -0.859375 -0.4375 -1.296875q-0.5625 -0.6875 -1.453125 -0.6875q-0.8125 0 -1.359375 0.546875q-0.546875 0.53125 -0.609375 1.4375zm6.5218506 4.125l0 -6.90625l1.0625 0l0 0.984375q0.75 -1.140625 2.1875 -1.140625q0.625 0 1.15625 0.21875q0.53125 0.21875 0.78125 0.59375q0.265625 0.359375 0.375 0.859375q0.0625 0.328125 0.0625 1.140625l0 4.25l-1.171875 0l0 -4.203125q0 -0.71875 -0.140625 -1.0625q-0.140625 -0.359375 -0.484375 -0.5625q-0.34375 -0.21875 -0.8125 -0.21875q-0.75 0 -1.296875 0.46875q-0.546875 0.46875 -0.546875 1.796875l0 3.78125l-1.171875 0zm12.146851 -2.21875l1.203125 0.140625q-0.28125 1.0625 -1.0625 1.65625q-0.765625 0.578125 -1.96875 0.578125q-1.515625 0 -2.40625 -0.9375q-0.890625 -0.9375 -0.890625 -2.609375q0 -1.75 0.890625 -2.703125q0.90625 -0.96875 2.34375 -0.96875q1.390625 0 2.265625 0.9375q0.875 0.9375 0.875 2.65625q0 0.109375 0 0.3125l-5.15625 0q0.0625 1.140625 0.640625 1.75q0.578125 0.59375 1.4375 0.59375q0.65625 0 1.109375 -0.328125q0.453125 -0.34375 0.71875 -1.078125zm-3.84375 -1.90625l3.859375 0q-0.078125 -0.859375 -0.4375 -1.296875q-0.5625 -0.6875 -1.453125 -0.6875q-0.8125 0 -1.359375 0.546875q-0.546875 0.53125 -0.609375 1.4375zm6.5062256 4.125l0 -6.90625l1.0625 0l0 1.046875q0.40625 -0.734375 0.734375 -0.96875q0.34375 -0.234375 0.765625 -0.234375q0.59375 0 1.203125 0.375l-0.40625 1.078125q-0.4375 -0.25 -0.859375 -0.25q-0.390625 0 -0.703125 0.234375q-0.296875 0.234375 -0.421875 0.640625q-0.203125 0.625 -0.203125 1.359375l0 3.625l-1.171875 0zm8.969635 -0.859375q-0.65625 0.5625 -1.265625 0.796875q-0.59375 0.21875 -1.28125 0.21875q-1.140625 0 -1.75 -0.546875q-0.609375 -0.5625 -0.609375 -1.4375q0 -0.5 0.21875 -0.921875q0.234375 -0.421875 0.609375 -0.671875q0.375 -0.25 0.84375 -0.390625q0.34375 -0.078125 1.046875 -0.171875q1.421875 -0.171875 2.09375 -0.40625q0 -0.234375 0 -0.296875q0 -0.71875 -0.328125 -1.015625q-0.453125 -0.390625 -1.34375 -0.390625q-0.8125 0 -1.21875 0.296875q-0.390625 0.28125 -0.578125 1.015625l-1.140625 -0.15625q0.15625 -0.734375 0.515625 -1.1875q0.359375 -0.453125 1.03125 -0.6875q0.671875 -0.25 1.5625 -0.25q0.890625 0 1.4375 0.203125q0.5625 0.203125 0.8125 0.53125q0.265625 0.3125 0.375 0.796875q0.046875 0.296875 0.046875 1.078125l0 1.5625q0 1.625 0.078125 2.0625q0.078125 0.4375 0.296875 0.828125l-1.21875 0q-0.1875 -0.359375 -0.234375 -0.859375zm-0.09375 -2.609375q-0.640625 0.265625 -1.921875 0.4375q-0.71875 0.109375 -1.015625 0.25q-0.296875 0.125 -0.46875 0.375q-0.15625 0.25 -0.15625 0.546875q0 0.46875 0.34375 0.78125q0.359375 0.3125 1.046875 0.3125q0.671875 0 1.203125 -0.296875q0.53125 -0.296875 0.78125 -0.8125q0.1875 -0.390625 0.1875 -1.171875l0 -0.421875zm5.5531006 2.421875l0.171875 1.03125q-0.5 0.109375 -0.890625 0.109375q-0.640625 0 -1.0 -0.203125q-0.34375 -0.203125 -0.484375 -0.53125q-0.140625 -0.328125 -0.140625 -1.390625l0 -3.96875l-0.859375 0l0 -0.90625l0.859375 0l0 -1.71875l1.171875 -0.703125l0 2.421875l1.171875 0l0 0.90625l-1.171875 0l0 4.046875q0 0.5 0.046875 0.640625q0.0625 0.140625 0.203125 0.234375q0.140625 0.078125 0.40625 0.078125q0.203125 0 0.515625 -0.046875zm5.8748474 -1.171875l1.203125 0.140625q-0.28125 1.0625 -1.0625 1.65625q-0.765625 0.578125 -1.96875 0.578125q-1.515625 0 -2.40625 -0.9375q-0.890625 -0.9375 -0.890625 -2.609375q0 -1.75 0.890625 -2.703125q0.90625 -0.96875 2.34375 -0.96875q1.390625 0 2.265625 0.9375q0.875 0.9375 0.875 2.65625q0 0.109375 0 0.3125l-5.15625 0q0.0625 1.140625 0.640625 1.75q0.578125 0.59375 1.4375 0.59375q0.65625 0 1.109375 -0.328125q0.453125 -0.34375 0.71875 -1.078125zm-3.84375 -1.90625l3.859375 0q-0.078125 -0.859375 -0.4375 -1.296875q-0.5625 -0.6875 -1.453125 -0.6875q-0.8125 0 -1.359375 0.546875q-0.546875 0.53125 -0.609375 1.4375zm14.7404785 1.59375l1.15625 0.15625q-0.1875 1.1875 -0.96875 1.859375q-0.78125 0.671875 -1.921875 0.671875q-1.40625 0 -2.28125 -0.921875q-0.859375 -0.9375 -0.859375 -2.65625q0 -1.125 0.375 -1.96875q0.375 -0.84375 1.125 -1.25q0.765625 -0.421875 1.65625 -0.421875q1.125 0 1.84375 0.578125q0.71875 0.5625 0.921875 1.609375l-1.140625 0.171875q-0.171875 -0.703125 -0.59375 -1.046875q-0.40625 -0.359375 -0.984375 -0.359375q-0.890625 0 -1.453125 0.640625q-0.546875 0.640625 -0.546875 2.0q0 1.40625 0.53125 2.03125q0.546875 0.625 1.40625 0.625q0.6875 0 1.140625 -0.421875q0.46875 -0.421875 0.59375 -1.296875zm6.6640625 1.671875q-0.65625 0.5625 -1.265625 0.796875q-0.59375 0.21875 -1.28125 0.21875q-1.140625 0 -1.75 -0.546875q-0.609375 -0.5625 -0.609375 -1.4375q0 -0.5 0.21875 -0.921875q0.234375 -0.421875 0.609375 -0.671875q0.375 -0.25 0.84375 -0.390625q0.34375 -0.078125 1.046875 -0.171875q1.421875 -0.171875 2.09375 -0.40625q0 -0.234375 0 -0.296875q0 -0.71875 -0.328125 -1.015625q-0.453125 -0.390625 -1.34375 -0.390625q-0.8125 0 -1.21875 0.296875q-0.390625 0.28125 -0.578125 1.015625l-1.140625 -0.15625q0.15625 -0.734375 0.515625 -1.1875q0.359375 -0.453125 1.03125 -0.6875q0.671875 -0.25 1.5625 -0.25q0.890625 0 1.4375 0.203125q0.5625 0.203125 0.8125 0.53125q0.265625 0.3125 0.375 0.796875q0.046875 0.296875 0.046875 1.078125l0 1.5625q0 1.625 0.078125 2.0625q0.078125 0.4375 0.296875 0.828125l-1.21875 0q-0.1875 -0.359375 -0.234375 -0.859375zm-0.09375 -2.609375q-0.640625 0.265625 -1.921875 0.4375q-0.71875 0.109375 -1.015625 0.25q-0.296875 0.125 -0.46875 0.375q-0.15625 0.25 -0.15625 0.546875q0 0.46875 0.34375 0.78125q0.359375 0.3125 1.046875 0.3125q0.671875 0 1.203125 -0.296875q0.53125 -0.296875 0.78125 -0.8125q0.1875 -0.390625 0.1875 -1.171875l0 -0.421875zm2.9906006 3.46875l0 -6.90625l1.0625 0l0 0.984375q0.75 -1.140625 2.1875 -1.140625q0.625 0 1.15625 0.21875q0.53125 0.21875 0.78125 0.59375q0.265625 0.359375 0.375 0.859375q0.0625 0.328125 0.0625 1.140625l0 4.25l-1.171875 0l0 -4.203125q0 -0.71875 -0.140625 -1.0625q-0.140625 -0.359375 -0.484375 -0.5625q-0.34375 -0.21875 -0.8125 -0.21875q-0.75 0 -1.296875 0.46875q-0.546875 0.46875 -0.546875 1.796875l0 3.78125l-1.171875 0zm11.896851 0l0 -0.875q-0.65625 1.03125 -1.9375 1.03125q-0.8125 0 -1.515625 -0.453125q-0.6875 -0.453125 -1.078125 -1.265625q-0.375 -0.828125 -0.375 -1.890625q0 -1.03125 0.34375 -1.875q0.34375 -0.84375 1.03125 -1.28125q0.703125 -0.453125 1.546875 -0.453125q0.625 0 1.109375 0.265625q0.5 0.25 0.796875 0.671875l0 -3.421875l1.171875 0l0 9.546875l-1.09375 0zm-3.703125 -3.453125q0 1.328125 0.5625 1.984375q0.5625 0.65625 1.328125 0.65625q0.765625 0 1.296875 -0.625q0.53125 -0.625 0.53125 -1.90625q0 -1.421875 -0.546875 -2.078125q-0.546875 -0.671875 -1.34375 -0.671875q-0.78125 0 -1.3125 0.640625q-0.515625 0.625 -0.515625 2.0zm6.6468506 -4.734375l0 -1.359375l1.171875 0l0 1.359375l-1.171875 0zm0 8.1875l0 -6.90625l1.171875 0l0 6.90625l-1.171875 0zm7.42984 0l0 -0.875q-0.65625 1.03125 -1.9375 1.03125q-0.8125 0 -1.515625 -0.453125q-0.6875 -0.453125 -1.078125 -1.265625q-0.375 -0.828125 -0.375 -1.890625q0 -1.03125 0.34375 -1.875q0.34375 -0.84375 1.03125 -1.28125q0.703125 -0.453125 1.546875 -0.453125q0.625 0 1.109375 0.265625q0.5 0.25 0.796875 0.671875l0 -3.421875l1.171875 0l0 9.546875l-1.09375 0zm-3.703125 -3.453125q0 1.328125 0.5625 1.984375q0.5625 0.65625 1.328125 0.65625q0.765625 0 1.296875 -0.625q0.53125 -0.625 0.53125 -1.90625q0 -1.421875 -0.546875 -2.078125q-0.546875 -0.671875 -1.34375 -0.671875q-0.78125 0 -1.3125 0.640625q-0.515625 0.625 -0.515625 2.0zm11.146851 2.59375q-0.65625 0.5625 -1.265625 0.796875q-0.59375 0.21875 -1.28125 0.21875q-1.140625 0 -1.75 -0.546875q-0.609375 -0.5625 -0.609375 -1.4375q0 -0.5 0.21875 -0.921875q0.234375 -0.421875 0.609375 -0.671875q0.375 -0.25 0.84375 -0.390625q0.34375 -0.078125 1.046875 -0.171875q1.421875 -0.171875 2.09375 -0.40625q0 -0.234375 0 -0.296875q0 -0.71875 -0.328125 -1.015625q-0.453125 -0.390625 -1.34375 -0.390625q-0.8125 0 -1.21875 0.296875q-0.390625 0.28125 -0.578125 1.015625l-1.140625 -0.15625q0.15625 -0.734375 0.515625 -1.1875q0.359375 -0.453125 1.03125 -0.6875q0.671875 -0.25 1.5625 -0.25q0.890625 0 1.4375 0.203125q0.5625 0.203125 0.8125 0.53125q0.265625 0.3125 0.375 0.796875q0.046875 0.296875 0.046875 1.078125l0 1.5625q0 1.625 0.078125 2.0625q0.078125 0.4375 0.296875 0.828125l-1.21875 0q-0.1875 -0.359375 -0.234375 -0.859375zm-0.09375 -2.609375q-0.640625 0.265625 -1.921875 0.4375q-0.71875 0.109375 -1.015625 0.25q-0.296875 0.125 -0.46875 0.375q-0.15625 0.25 -0.15625 0.546875q0 0.46875 0.34375 0.78125q0.359375 0.3125 1.046875 0.3125q0.671875 0 1.203125 -0.296875q0.53125 -0.296875 0.78125 -0.8125q0.1875 -0.390625 0.1875 -1.171875l0 -0.421875zm5.5531006 2.421875l0.171875 1.03125q-0.5 0.109375 -0.890625 0.109375q-0.640625 0 -1.0 -0.203125q-0.34375 -0.203125 -0.484375 -0.53125q-0.140625 -0.328125 -0.140625 -1.390625l0 -3.96875l-0.859375 0l0 -0.90625l0.859375 0l0 -1.71875l1.171875 -0.703125l0 2.421875l1.171875 0l0 0.90625l-1.171875 0l0 4.046875q0 0.5 0.046875 0.640625q0.0625 0.140625 0.203125 0.234375q0.140625 0.078125 0.40625 0.078125q0.203125 0 0.515625 -0.046875zm5.8748474 -1.171875l1.203125 0.140625q-0.28125 1.0625 -1.0625 1.65625q-0.765625 0.578125 -1.96875 0.578125q-1.515625 0 -2.40625 -0.9375q-0.890625 -0.9375 -0.890625 -2.609375q0 -1.75 0.890625 -2.703125q0.90625 -0.96875 2.34375 -0.96875q1.390625 0 2.265625 0.9375q0.875 0.9375 0.875 2.65625q0 0.109375 0 0.3125l-5.15625 0q0.0625 1.140625 0.640625 1.75q0.578125 0.59375 1.4375 0.59375q0.65625 0 1.109375 -0.328125q0.453125 -0.34375 0.71875 -1.078125zm-3.84375 -1.90625l3.859375 0q-0.078125 -0.859375 -0.4375 -1.296875q-0.5625 -0.6875 -1.453125 -0.6875q-0.8125 0 -1.359375 0.546875q-0.546875 0.53125 -0.609375 1.4375z" fill-rule="nonzero"/><path fill="#000000" d="m311.58783 97.28302l0 -9.5625l1.078125 0l0 0.890625q0.375 -0.53125 0.84375 -0.78125q0.484375 -0.265625 1.15625 -0.265625q0.875 0 1.546875 0.453125q0.6875 0.453125 1.03125 1.28125q0.34375 0.828125 0.34375 1.828125q0 1.046875 -0.375 1.90625q-0.375 0.84375 -1.109375 1.296875q-0.71875 0.453125 -1.53125 0.453125q-0.578125 0 -1.046875 -0.25q-0.46875 -0.25 -0.765625 -0.625l0 3.375l-1.171875 0zm1.0625 -6.078125q0 1.34375 0.53125 1.984375q0.546875 0.625 1.3125 0.625q0.78125 0 1.34375 -0.65625q0.5625 -0.65625 0.5625 -2.046875q0 -1.3125 -0.546875 -1.96875q-0.546875 -0.671875 -1.296875 -0.671875q-0.75 0 -1.328125 0.703125q-0.578125 0.703125 -0.578125 2.03125zm10.865601 2.5625q-0.65625 0.5625 -1.265625 0.796875q-0.59375 0.21875 -1.28125 0.21875q-1.140625 0 -1.75 -0.546875q-0.609375 -0.5625 -0.609375 -1.4375q0 -0.5 0.21875 -0.921875q0.234375 -0.421875 0.609375 -0.671875q0.375 -0.25 0.84375 -0.390625q0.34375 -0.078125 1.046875 -0.171875q1.421875 -0.171875 2.09375 -0.40625q0 -0.234375 0 -0.296875q0 -0.71875 -0.328125 -1.015625q-0.453125 -0.390625 -1.34375 -0.390625q-0.8125 0 -1.21875 0.296875q-0.390625 0.28125 -0.578125 1.015625l-1.140625 -0.15625q0.15625 -0.734375 0.515625 -1.1875q0.359375 -0.453125 1.03125 -0.6875q0.671875 -0.25 1.5625 -0.25q0.890625 0 1.4375 0.203125q0.5625 0.203125 0.8125 0.53125q0.265625 0.3125 0.375 0.796875q0.046875 0.296875 0.046875 1.078125l0 1.5625q0 1.625 0.078125 2.0625q0.078125 0.4375 0.296875 0.828125l-1.21875 0q-0.1875 -0.359375 -0.234375 -0.859375zm-0.09375 -2.609375q-0.640625 0.265625 -1.921875 0.4375q-0.71875 0.109375 -1.015625 0.25q-0.296875 0.125 -0.46875 0.375q-0.15625 0.25 -0.15625 0.546875q0 0.46875 0.34375 0.78125q0.359375 0.3125 1.046875 0.3125q0.671875 0 1.203125 -0.296875q0.53125 -0.296875 0.78125 -0.8125q0.1875 -0.390625 0.1875 -1.171875l0 -0.421875zm2.5218506 1.40625l1.15625 -0.1875q0.109375 0.703125 0.546875 1.078125q0.453125 0.359375 1.25 0.359375q0.8125 0 1.203125 -0.328125q0.390625 -0.328125 0.390625 -0.765625q0 -0.390625 -0.359375 -0.625q-0.234375 -0.15625 -1.1875 -0.390625q-1.296875 -0.328125 -1.796875 -0.5625q-0.484375 -0.25 -0.75 -0.65625q-0.25 -0.421875 -0.25 -0.9375q0 -0.453125 0.203125 -0.84375q0.21875 -0.40625 0.578125 -0.671875q0.28125 -0.1875 0.75 -0.328125q0.46875 -0.140625 1.015625 -0.140625q0.8125 0 1.421875 0.234375q0.609375 0.234375 0.90625 0.640625q0.296875 0.390625 0.40625 1.0625l-1.140625 0.15625q-0.078125 -0.53125 -0.453125 -0.828125q-0.375 -0.3125 -1.0625 -0.3125q-0.8125 0 -1.15625 0.265625q-0.34375 0.265625 -0.34375 0.625q0 0.234375 0.140625 0.421875q0.15625 0.1875 0.453125 0.3125q0.171875 0.0625 1.03125 0.296875q1.25 0.328125 1.734375 0.546875q0.5 0.203125 0.78125 0.609375q0.28125 0.40625 0.28125 1.0q0 0.59375 -0.34375 1.109375q-0.34375 0.515625 -1.0 0.796875q-0.640625 0.28125 -1.453125 0.28125q-1.34375 0 -2.046875 -0.5625q-0.703125 -0.5625 -0.90625 -1.65625zm6.6640625 0l1.15625 -0.1875q0.109375 0.703125 0.546875 1.078125q0.453125 0.359375 1.25 0.359375q0.8125 0 1.203125 -0.328125q0.390625 -0.328125 0.390625 -0.765625q0 -0.390625 -0.359375 -0.625q-0.234375 -0.15625 -1.1875 -0.390625q-1.296875 -0.328125 -1.796875 -0.5625q-0.484375 -0.25 -0.75 -0.65625q-0.25 -0.421875 -0.25 -0.9375q0 -0.453125 0.203125 -0.84375q0.21875 -0.40625 0.578125 -0.671875q0.28125 -0.1875 0.75 -0.328125q0.46875 -0.140625 1.015625 -0.140625q0.8125 0 1.421875 0.234375q0.609375 0.234375 0.90625 0.640625q0.296875 0.390625 0.40625 1.0625l-1.140625 0.15625q-0.078125 -0.53125 -0.453125 -0.828125q-0.375 -0.3125 -1.0625 -0.3125q-0.8125 0 -1.15625 0.265625q-0.34375 0.265625 -0.34375 0.625q0 0.234375 0.140625 0.421875q0.15625 0.1875 0.453125 0.3125q0.171875 0.0625 1.03125 0.296875q1.25 0.328125 1.734375 0.546875q0.5 0.203125 0.78125 0.609375q0.28125 0.40625 0.28125 1.0q0 0.59375 -0.34375 1.109375q-0.34375 0.515625 -1.0 0.796875q-0.640625 0.28125 -1.453125 0.28125q-1.34375 0 -2.046875 -0.5625q-0.703125 -0.5625 -0.90625 -1.65625zm8.4140625 2.0625l-2.125 -6.90625l1.21875 0l1.09375 3.984375l0.421875 1.484375q0.015625 -0.109375 0.359375 -1.421875l1.09375 -4.046875l1.203125 0l1.03125 4.0l0.34375 1.328125l0.40625 -1.34375l1.171875 -3.984375l1.140625 0l-2.15625 6.90625l-1.21875 0l-1.09375 -4.140625l-0.265625 -1.171875l-1.40625 5.3125l-1.21875 0zm7.9064026 -3.453125q0 -1.921875 1.078125 -2.84375q0.890625 -0.765625 2.171875 -0.765625q1.421875 0 2.328125 0.9375q0.90625 0.921875 0.90625 2.578125q0 1.328125 -0.40625 2.09375q-0.390625 0.765625 -1.15625 1.1875q-0.765625 0.421875 -1.671875 0.421875q-1.453125 0 -2.359375 -0.921875q-0.890625 -0.9375 -0.890625 -2.6875zm1.203125 0q0 1.328125 0.578125 1.984375q0.59375 0.65625 1.46875 0.65625q0.875 0 1.453125 -0.65625q0.578125 -0.671875 0.578125 -2.03125q0 -1.28125 -0.59375 -1.9375q-0.578125 -0.65625 -1.4375 -0.65625q-0.875 0 -1.46875 0.65625q-0.578125 0.65625 -0.578125 1.984375zm6.6312256 3.453125l0 -6.90625l1.0625 0l0 1.046875q0.40625 -0.734375 0.734375 -0.96875q0.34375 -0.234375 0.765625 -0.234375q0.59375 0 1.203125 0.375l-0.40625 1.078125q-0.4375 -0.25 -0.859375 -0.25q-0.390625 0 -0.703125 0.234375q-0.296875 0.234375 -0.421875 0.640625q-0.203125 0.625 -0.203125 1.359375l0 3.625l-1.171875 0zm8.9383545 0l0 -0.875q-0.65625 1.03125 -1.9375 1.03125q-0.8125 0 -1.515625 -0.453125q-0.6875 -0.453125 -1.078125 -1.265625q-0.375 -0.828125 -0.375 -1.890625q0 -1.03125 0.34375 -1.875q0.34375 -0.84375 1.03125 -1.28125q0.703125 -0.453125 1.546875 -0.453125q0.625 0 1.109375 0.265625q0.5 0.25 0.796875 0.671875l0 -3.421875l1.171875 0l0 9.546875l-1.09375 0zm-3.703125 -3.453125q0 1.328125 0.5625 1.984375q0.5625 0.65625 1.328125 0.65625q0.765625 0 1.296875 -0.625q0.53125 -0.625 0.53125 -1.90625q0 -1.421875 -0.546875 -2.078125q-0.546875 -0.671875 -1.34375 -0.671875q-0.78125 0 -1.3125 0.640625q-0.515625 0.625 -0.515625 2.0z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" d="m216.4042 81.82546l47.370087 0" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m216.4042 81.82546l41.370087 0" fill-rule="evenodd"/><path fill="#000000" stroke="#000000" stroke-width="1.0" stroke-linecap="butt" d="m257.7743 83.47719l4.538086 -1.6517258l-4.538086 -1.6517334z" fill-rule="evenodd"/><path fill="#000000" fill-opacity="0.0" d="m414.69815 81.826775l47.370087 0" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m414.69815 81.826775l41.370087 0" fill-rule="evenodd"/><path fill="#000000" stroke="#000000" stroke-width="1.0" stroke-linecap="butt" d="m456.06824 83.4785l4.5381165 -1.6517258l-4.5381165 -1.6517334z" fill-rule="evenodd"/><path fill="#ffffff" d="m462.063 81.83465l48.834656 -48.83465l48.834656 48.83465l-48.834656 48.83465z" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m462.063 81.83465l48.834656 -48.83465l48.834656 48.83465l-48.834656 48.83465z" fill-rule="evenodd"/><path fill="#000000" d="m488.59488 78.63464l0 -9.546875l3.59375 0q0.953125 0 1.453125 0.09375q0.703125 0.125 1.171875 0.453125q0.484375 0.328125 0.765625 0.921875q0.296875 0.59375 0.296875 1.296875q0 1.21875 -0.78125 2.0625q-0.765625 0.84375 -2.796875 0.84375l-2.4375 0l0 3.875l-1.265625 0zm1.265625 -5.0l2.453125 0q1.234375 0 1.75 -0.453125q0.515625 -0.46875 0.515625 -1.28125q0 -0.609375 -0.3125 -1.03125q-0.296875 -0.421875 -0.796875 -0.5625q-0.3125 -0.09375 -1.171875 -0.09375l-2.4375 0l0 3.421875zm11.9835205 4.140625q-0.65625 0.5625 -1.265625 0.796875q-0.59375 0.21875 -1.28125 0.21875q-1.140625 0 -1.75 -0.546875q-0.609375 -0.5625 -0.609375 -1.4375q0 -0.5 0.21875 -0.921875q0.234375 -0.421875 0.609375 -0.671875q0.375 -0.25 0.84375 -0.390625q0.34375 -0.078125 1.046875 -0.171875q1.421875 -0.171875 2.09375 -0.40625q0 -0.234375 0 -0.296875q0 -0.71875 -0.328125 -1.015625q-0.453125 -0.390625 -1.34375 -0.390625q-0.8125 0 -1.21875 0.296875q-0.390625 0.28125 -0.578125 1.015625l-1.140625 -0.15625q0.15625 -0.734375 0.515625 -1.1875q0.359375 -0.453125 1.03125 -0.6875q0.671875 -0.25 1.5625 -0.25q0.890625 0 1.4375 0.203125q0.5625 0.203125 0.8125 0.53125q0.265625 0.3125 0.375 0.796875q0.046875 0.296875 0.046875 1.078125l0 1.5625q0 1.625 0.078125 2.0625q0.078125 0.4375 0.296875 0.828125l-1.21875 0q-0.1875 -0.359375 -0.234375 -0.859375zm-0.09375 -2.609375q-0.640625 0.265625 -1.921875 0.4375q-0.71875 0.109375 -1.015625 0.25q-0.296875 0.125 -0.46875 0.375q-0.15625 0.25 -0.15625 0.546875q0 0.46875 0.34375 0.78125q0.359375 0.3125 1.046875 0.3125q0.671875 0 1.203125 -0.296875q0.53125 -0.296875 0.78125 -0.8125q0.1875 -0.390625 0.1875 -1.171875l0 -0.421875zm2.5218506 1.40625l1.15625 -0.1875q0.109375 0.703125 0.546875 1.078125q0.453125 0.359375 1.25 0.359375q0.8125 0 1.203125 -0.328125q0.390625 -0.328125 0.390625 -0.765625q0 -0.390625 -0.359375 -0.625q-0.234375 -0.15625 -1.1875 -0.390625q-1.296875 -0.328125 -1.796875 -0.5625q-0.484375 -0.25 -0.75 -0.65625q-0.25 -0.421875 -0.25 -0.9375q0 -0.453125 0.203125 -0.84375q0.21875 -0.40625 0.578125 -0.671875q0.28125 -0.1875 0.75 -0.328125q0.46875 -0.140625 1.015625 -0.140625q0.8125 0 1.421875 0.234375q0.609375 0.234375 0.90625 0.640625q0.296875 0.390625 0.40625 1.0625l-1.140625 0.15625q-0.078125 -0.53125 -0.453125 -0.828125q-0.375 -0.3125 -1.0625 -0.3125q-0.8125 0 -1.15625 0.265625q-0.34375 0.265625 -0.34375 0.625q0 0.234375 0.140625 0.421875q0.15625 0.1875 0.453125 0.3125q0.171875 0.0625 1.03125 0.296875q1.25 0.328125 1.734375 0.546875q0.5 0.203125 0.78125 0.609375q0.28125 0.40625 0.28125 1.0q0 0.59375 -0.34375 1.109375q-0.34375 0.515625 -1.0 0.796875q-0.640625 0.28125 -1.453125 0.28125q-1.34375 0 -2.046875 -0.5625q-0.703125 -0.5625 -0.90625 -1.65625zm6.6640625 0l1.1562195 -0.1875q0.109375 0.703125 0.546875 1.078125q0.453125 0.359375 1.25 0.359375q0.8125 0 1.203125 -0.328125q0.390625 -0.328125 0.390625 -0.765625q0 -0.390625 -0.359375 -0.625q-0.234375 -0.15625 -1.1875 -0.390625q-1.296875 -0.328125 -1.796875 -0.5625q-0.48434448 -0.25 -0.7499695 -0.65625q-0.25 -0.421875 -0.25 -0.9375q0 -0.453125 0.203125 -0.84375q0.21875 -0.40625 0.578125 -0.671875q0.28121948 -0.1875 0.7499695 -0.328125q0.46875 -0.140625 1.015625 -0.140625q0.8125 0 1.421875 0.234375q0.609375 0.234375 0.90625 0.640625q0.296875 0.390625 0.40625 1.0625l-1.140625 0.15625q-0.078125 -0.53125 -0.453125 -0.828125q-0.375 -0.3125 -1.0625 -0.3125q-0.8125 0 -1.15625 0.265625q-0.34375 0.265625 -0.34375 0.625q0 0.234375 0.140625 0.421875q0.15625 0.1875 0.453125 0.3125q0.171875 0.0625 1.03125 0.296875q1.25 0.328125 1.734375 0.546875q0.5 0.203125 0.78125 0.609375q0.28125 0.40625 0.28125 1.0q0 0.59375 -0.34375 1.109375q-0.34375 0.515625 -1.0 0.796875q-0.640625 0.28125 -1.453125 0.28125q-1.34375 0 -2.0468445 -0.5625q-0.703125 -0.5625 -0.90625 -1.65625zm15.35141 1.203125q-0.65625 0.5625 -1.265625 0.796875q-0.59375 0.21875 -1.28125 0.21875q-1.140625 0 -1.75 -0.546875q-0.609375 -0.5625 -0.609375 -1.4375q0 -0.5 0.21875 -0.921875q0.234375 -0.421875 0.609375 -0.671875q0.375 -0.25 0.84375 -0.390625q0.34375 -0.078125 1.046875 -0.171875q1.421875 -0.171875 2.09375 -0.40625q0 -0.234375 0 -0.296875q0 -0.71875 -0.328125 -1.015625q-0.453125 -0.390625 -1.34375 -0.390625q-0.8125 0 -1.21875 0.296875q-0.390625 0.28125 -0.578125 1.015625l-1.140625 -0.15625q0.15625 -0.734375 0.515625 -1.1875q0.359375 -0.453125 1.03125 -0.6875q0.671875 -0.25 1.5625 -0.25q0.890625 0 1.4375 0.203125q0.5625 0.203125 0.8125 0.53125q0.265625 0.3125 0.375 0.796875q0.046875 0.296875 0.046875 1.078125l0 1.5625q0 1.625 0.078125 2.0625q0.078125 0.4375 0.296875 0.828125l-1.21875 0q-0.1875 -0.359375 -0.234375 -0.859375zm-0.09375 -2.609375q-0.640625 0.265625 -1.921875 0.4375q-0.71875 0.109375 -1.015625 0.25q-0.296875 0.125 -0.46875 0.375q-0.15625 0.25 -0.15625 0.546875q0 0.46875 0.34375 0.78125q0.359375 0.3125 1.046875 0.3125q0.671875 0 1.203125 -0.296875q0.53125 -0.296875 0.78125 -0.8125q0.1875 -0.390625 0.1875 -1.171875l0 -0.421875zm2.9749756 3.46875l0 -9.546875l1.171875 0l0 9.546875l-1.171875 0zm2.9611206 0l0 -9.546875l1.171875 0l0 9.546875l-1.171875 0z" fill-rule="nonzero"/><path fill="#000000" d="m493.60654 94.63464l0 -6.90625l1.0625 0l0 1.046875q0.40625 -0.734375 0.734375 -0.96875q0.34375 -0.234375 0.765625 -0.234375q0.59375 0 1.203125 0.375l-0.40625 1.078125q-0.4375 -0.25 -0.859375 -0.25q-0.390625 0 -0.703125 0.234375q-0.296875 0.234375 -0.421875 0.640625q-0.203125 0.625 -0.203125 1.359375l0 3.625l-1.171875 0zm8.98526 0l0 -1.015625q-0.8125 1.171875 -2.1875 1.171875q-0.609375 0 -1.140625 -0.234375q-0.53125 -0.234375 -0.796875 -0.578125q-0.25 -0.359375 -0.359375 -0.875q-0.0625 -0.34375 -0.0625 -1.09375l0 -4.28125l1.171875 0l0 3.828125q0 0.921875 0.0625 1.234375q0.109375 0.46875 0.46875 0.734375q0.359375 0.25 0.890625 0.25q0.515625 0 0.984375 -0.265625q0.46875 -0.265625 0.65625 -0.734375q0.1875 -0.46875 0.1875 -1.34375l0 -3.703125l1.171875 0l0 6.90625l-1.046875 0zm2.8656006 0l0 -9.546875l1.171875 0l0 9.546875l-1.171875 0zm7.7110596 -2.21875l1.203125 0.140625q-0.28125 1.0625 -1.0625 1.65625q-0.765625 0.578125 -1.9687195 0.578125q-1.515625 0 -2.40625 -0.9375q-0.890625 -0.9375 -0.890625 -2.609375q0 -1.75 0.890625 -2.703125q0.90625 -0.96875 2.34375 -0.96875q1.3905945 0 2.2655945 0.9375q0.875 0.9375 0.875 2.65625q0 0.109375 0 0.3125l-5.1562195 0q0.0625 1.140625 0.640625 1.75q0.578125 0.59375 1.4375 0.59375q0.65625 0 1.1093445 -0.328125q0.453125 -0.34375 0.71875 -1.078125zm-3.8437195 -1.90625l3.8593445 0q-0.078125 -0.859375 -0.4375 -1.296875q-0.5625 -0.6875 -1.4530945 -0.6875q-0.8125 0 -1.359375 0.546875q-0.546875 0.53125 -0.609375 1.4375zm6.05307 2.0625l1.15625 -0.1875q0.109375 0.703125 0.546875 1.078125q0.453125 0.359375 1.25 0.359375q0.8125 0 1.203125 -0.328125q0.390625 -0.328125 0.390625 -0.765625q0 -0.390625 -0.359375 -0.625q-0.234375 -0.15625 -1.1875 -0.390625q-1.296875 -0.328125 -1.796875 -0.5625q-0.484375 -0.25 -0.75 -0.65625q-0.25 -0.421875 -0.25 -0.9375q0 -0.453125 0.203125 -0.84375q0.21875 -0.40625 0.578125 -0.671875q0.28125 -0.1875 0.75 -0.328125q0.46875 -0.140625 1.015625 -0.140625q0.8125 0 1.421875 0.234375q0.609375 0.234375 0.90625 0.640625q0.296875 0.390625 0.40625 1.0625l-1.140625 0.15625q-0.078125 -0.53125 -0.453125 -0.828125q-0.375 -0.3125 -1.0625 -0.3125q-0.8125 0 -1.15625 0.265625q-0.34375 0.265625 -0.34375 0.625q0 0.234375 0.140625 0.421875q0.15625 0.1875 0.453125 0.3125q0.171875 0.0625 1.03125 0.296875q1.25 0.328125 1.734375 0.546875q0.5 0.203125 0.78125 0.609375q0.28125 0.40625 0.28125 1.0q0 0.59375 -0.34375 1.109375q-0.34375 0.515625 -1.0 0.796875q-0.640625 0.28125 -1.453125 0.28125q-1.34375 0 -2.046875 -0.5625q-0.703125 -0.5625 -0.90625 -1.65625zm9.3359375 -0.28125q-0.015625 -0.234375 -0.015625 -0.359375q0 -0.6875 0.203125 -1.1875q0.140625 -0.375 0.453125 -0.765625q0.234375 -0.28125 0.84375 -0.8125q0.609375 -0.53125 0.78125 -0.84375q0.1875 -0.328125 0.1875 -0.703125q0 -0.6875 -0.53125 -1.203125q-0.53125 -0.515625 -1.296875 -0.515625q-0.75 0 -1.25 0.46875q-0.5 0.46875 -0.65625 1.453125l-1.21875 -0.140625q0.171875 -1.328125 0.96875 -2.03125q0.8125 -0.71875 2.125 -0.71875q1.40625 0 2.234375 0.765625q0.828125 0.75 0.828125 1.84375q0 0.625 -0.296875 1.15625q-0.28125 0.515625 -1.140625 1.265625q-0.5625 0.515625 -0.75 0.765625q-0.171875 0.234375 -0.265625 0.546875q-0.078125 0.3125 -0.078125 1.015625l-1.125 0zm-0.078125 2.34375l0 -1.328125l1.328125 0l0 1.328125l-1.328125 0z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" d="m510.89633 8.0l33.73227 0l0 18.078741l-33.73227 0z" fill-rule="evenodd"/><path fill="#000000" d="m520.2593 20.8l0 -9.546875l1.296875 0l5.015625 7.5l0 -7.5l1.203125 0l0 9.546875l-1.296875 0l-5.015625 -7.5l0 7.5l-1.203125 0zm9.047058 -3.453125q0 -1.921875 1.078125 -2.84375q0.890625 -0.765625 2.171875 -0.765625q1.421875 0 2.328125 0.9375q0.90625 0.921875 0.90625 2.578125q0 1.328125 -0.40625 2.09375q-0.390625 0.765625 -1.15625 1.1875q-0.765625 0.421875 -1.671875 0.421875q-1.453125 0 -2.359375 -0.921875q-0.890625 -0.9375 -0.890625 -2.6875zm1.203125 0q0 1.328125 0.578125 1.984375q0.59375 0.65625 1.46875 0.65625q0.875 0 1.453125 -0.65625q0.578125 -0.671875 0.578125 -2.03125q0 -1.28125 -0.59375 -1.9375q-0.578125 -0.65625 -1.4375 -0.65625q-0.875 0 -1.46875 0.65625q-0.578125 0.65625 -0.578125 1.984375z" fill-rule="nonzero"/><path fill="#ffffff" d="m118.73491 81.82546l48.83464 -48.83465l48.834656 48.83465l-48.834656 48.83465z" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m118.73491 81.82546l48.83464 -48.83465l48.834656 48.83465l-48.834656 48.83465z" fill-rule="evenodd"/><path fill="#000000" d="m152.75516 78.62546l0 -8.421875l-3.140625 0l0 -1.125l7.5625 0l0 1.125l-3.15625 0l0 8.421875l-1.265625 0zm5.0840607 -8.1875l0 -1.359375l1.171875 0l0 1.359375l-1.171875 0zm0 8.1875l0 -6.90625l1.171875 0l0 6.90625l-1.171875 0zm2.945465 0l0 -6.90625l1.046875 0l0 0.96875q0.328125 -0.515625 0.859375 -0.8125q0.546875 -0.3125 1.234375 -0.3125q0.78125 0 1.265625 0.3125q0.484375 0.3125 0.6875 0.890625q0.828125 -1.203125 2.140625 -1.203125q1.03125 0 1.578125 0.578125q0.5625 0.5625 0.5625 1.734375l0 4.75l-1.171875 0l0 -4.359375q0 -0.703125 -0.125 -1.0q-0.109375 -0.3125 -0.40625 -0.5q-0.296875 -0.1875 -0.703125 -0.1875q-0.71875 0 -1.203125 0.484375q-0.484375 0.484375 -0.484375 1.546875l0 4.015625l-1.171875 0l0 -4.484375q0 -0.78125 -0.296875 -1.171875q-0.28125 -0.390625 -0.921875 -0.390625q-0.5 0 -0.921875 0.265625q-0.421875 0.25 -0.609375 0.75q-0.1875 0.5 -0.1875 1.453125l0 3.578125l-1.171875 0zm15.836807 -2.21875l1.203125 0.140625q-0.28125 1.0625 -1.0625 1.65625q-0.765625 0.578125 -1.96875 0.578125q-1.515625 0 -2.40625 -0.9375q-0.890625 -0.9375 -0.890625 -2.609375q0 -1.75 0.890625 -2.703125q0.90625 -0.96875 2.34375 -0.96875q1.390625 0 2.265625 0.9375q0.875 0.9375 0.875 2.65625q0 0.109375 0 0.3125l-5.15625 0q0.0625 1.140625 0.640625 1.75q0.578125 0.59375 1.4375 0.59375q0.65625 0 1.109375 -0.328125q0.453125 -0.34375 0.71875 -1.078125zm-3.84375 -1.90625l3.859375 0q-0.078125 -0.859375 -0.4375 -1.296875q-0.5625 -0.6875 -1.453125 -0.6875q-0.8125 0 -1.359375 0.546875q-0.546875 0.53125 -0.609375 1.4375zm11.006226 4.125l0 -0.875q-0.65625 1.03125 -1.9375 1.03125q-0.8125 0 -1.515625 -0.453125q-0.6875 -0.453125 -1.078125 -1.265625q-0.375 -0.828125 -0.375 -1.890625q0 -1.03125 0.34375 -1.875q0.34375 -0.84375 1.03125 -1.28125q0.703125 -0.453125 1.546875 -0.453125q0.625 0 1.109375 0.265625q0.5 0.25 0.796875 0.671875l0 -3.421875l1.171875 0l0 9.546875l-1.09375 0zm-3.703125 -3.453125q0 1.328125 0.5625 1.984375q0.5625 0.65625 1.328125 0.65625q0.765625 0 1.296875 -0.625q0.53125 -0.625 0.53125 -1.90625q0 -1.421875 -0.546875 -2.078125q-0.546875 -0.671875 -1.34375 -0.671875q-0.78125 0 -1.3125 0.640625q-0.515625 0.625 -0.515625 2.0z" fill-rule="nonzero"/><path fill="#000000" d="m153.76268 89.98483q0 -2.375 1.28125 -3.71875q1.28125 -1.34375 3.296875 -1.34375q1.3125 0 2.375 0.625q1.0625 0.625 1.609375 1.765625q0.5625 1.125 0.5625 2.5625q0 1.4375 -0.59375 2.59375q-0.578125 1.140625 -1.65625 1.734375q-1.0625 0.578125 -2.3125 0.578125q-1.34375 0 -2.40625 -0.640625q-1.0625 -0.65625 -1.609375 -1.78125q-0.546875 -1.125 -0.546875 -2.375zm1.3125 0.015625q0 1.71875 0.921875 2.71875q0.921875 0.984375 2.328125 0.984375q1.421875 0 2.34375 -1.0q0.921875 -1.0 0.921875 -2.84375q0 -1.15625 -0.40625 -2.03125q-0.390625 -0.875 -1.15625 -1.34375q-0.75 -0.484375 -1.6875 -0.484375q-1.34375 0 -2.3125 0.921875q-0.953125 0.921875 -0.953125 3.078125zm13.820175 4.625l0 -1.015625q-0.8125 1.171875 -2.1875 1.171875q-0.609375 0 -1.140625 -0.234375q-0.53125 -0.234375 -0.796875 -0.578125q-0.25 -0.359375 -0.359375 -0.875q-0.0625 -0.34375 -0.0625 -1.09375l0 -4.28125l1.171875 0l0 3.828125q0 0.921875 0.0625 1.234375q0.109375 0.46875 0.46875 0.734375q0.359375 0.25 0.890625 0.25q0.515625 0 0.984375 -0.265625q0.46875 -0.265625 0.65625 -0.734375q0.1875 -0.46875 0.1875 -1.34375l0 -3.703125l1.171875 0l0 6.90625l-1.046875 0zm5.4437256 -1.046875l0.171875 1.03125q-0.5 0.109375 -0.890625 0.109375q-0.640625 0 -1.0 -0.203125q-0.34375 -0.203125 -0.484375 -0.53125q-0.140625 -0.328125 -0.140625 -1.390625l0 -3.96875l-0.859375 0l0 -0.90625l0.859375 0l0 -1.71875l1.171875 -0.703125l0 2.421875l1.171875 0l0 0.90625l-1.171875 0l0 4.046875q0 0.5 0.046875 0.640625q0.0625 0.140625 0.203125 0.234375q0.140625 0.078125 0.40625 0.078125q0.203125 0 0.515625 -0.046875zm3.3436127 -1.296875q-0.015625 -0.234375 -0.015625 -0.359375q0 -0.6875 0.203125 -1.1875q0.140625 -0.375 0.453125 -0.765625q0.234375 -0.28125 0.84375 -0.8125q0.609375 -0.53125 0.78125 -0.84375q0.1875 -0.328125 0.1875 -0.703125q0 -0.6875 -0.53125 -1.203125q-0.53125 -0.515625 -1.296875 -0.515625q-0.75 0 -1.25 0.46875q-0.5 0.46875 -0.65625 1.453125l-1.21875 -0.140625q0.171875 -1.328125 0.96875 -2.03125q0.8125 -0.71875 2.125 -0.71875q1.40625 0 2.234375 0.765625q0.828125 0.75 0.828125 1.84375q0 0.625 -0.296875 1.15625q-0.28125 0.515625 -1.140625 1.265625q-0.5625 0.515625 -0.75 0.765625q-0.171875 0.234375 -0.265625 0.546875q-0.078125 0.3125 -0.078125 1.015625l-1.125 0zm-0.078125 2.34375l0 -1.328125l1.328125 0l0 1.328125l-1.328125 0z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" d="m71.37008 81.826775l47.37008 0" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m71.37008 81.826775l41.37008 0" fill-rule="evenodd"/><path fill="#000000" stroke="#000000" stroke-width="1.0" stroke-linecap="butt" d="m112.74016 83.4785l4.5380936 -1.6517258l-4.5380936 -1.6517334z" fill-rule="evenodd"/><path fill="#000000" fill-opacity="0.0" d="m225.44077 63.74934l29.291351 0l0 18.07874l-29.291351 0z" fill-rule="evenodd"/><path fill="#000000" d="m232.58325 76.54934l0 -9.546875l1.296875 0l5.015625 7.5l0 -7.5l1.203125 0l0 9.546875l-1.296875 0l-5.015625 -7.5l0 7.5l-1.203125 0zm9.047028 -3.453125q0 -1.921875 1.078125 -2.84375q0.890625 -0.765625 2.171875 -0.765625q1.421875 0 2.328125 0.9375q0.90625 0.921875 0.90625 2.578125q0 1.328125 -0.40625 2.09375q-0.390625 0.765625 -1.15625 1.1875q-0.765625 0.421875 -1.671875 0.421875q-1.453125 0 -2.359375 -0.921875q-0.890625 -0.9375 -0.890625 -2.6875zm1.203125 0q0 1.328125 0.578125 1.984375q0.59375 0.65625 1.46875 0.65625q0.875 0 1.453125 -0.65625q0.578125 -0.671875 0.578125 -2.03125q0 -1.28125 -0.59375 -1.9375q-0.578125 -0.65625 -1.4375 -0.65625q-0.875 0 -1.46875 0.65625q-0.578125 0.65625 -0.578125 1.984375z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" d="m167.56955 130.66011l0 55.055115" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m167.56955 130.66011l0 49.055115" fill-rule="evenodd"/><path fill="#000000" stroke="#000000" stroke-width="1.0" stroke-linecap="butt" d="m165.91782 179.71523l1.6517334 4.538101l1.6517334 -4.538101z" fill-rule="evenodd"/><path fill="#ffffff" d="m622.0341 67.33677l0 0c0 -4.003784 3.2457275 -7.2494926 7.2495117 -7.2494926l83.17029 0c1.9226685 0 3.7666016 0.7637825 5.1261597 2.1233253c1.3595581 1.3595428 2.123352 3.2034836 2.123352 5.1261673l0 28.997086c0 4.0037766 -3.2457275 7.249489 -7.2495117 7.249489l-83.17029 0c-4.003784 0 -7.2495117 -3.2457123 -7.2495117 -7.249489z" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m622.0341 67.33677l0 0c0 -4.003784 3.2457275 -7.2494926 7.2495117 -7.2494926l83.17029 0c1.9226685 0 3.7666016 0.7637825 5.1261597 2.1233253c1.3595581 1.3595428 2.123352 3.2034836 2.123352 5.1261673l0 28.997086c0 4.0037766 -3.2457275 7.249489 -7.2495117 7.249489l-83.17029 0c-4.003784 0 -7.2495117 -3.2457123 -7.2495117 -7.249489z" fill-rule="evenodd"/><path fill="#000000" d="m660.0665 74.90093l0 -1.125l4.03125 -0.015625l0 3.546875q-0.921875 0.75 -1.921875 1.125q-0.984375 0.359375 -2.03125 0.359375q-1.40625 0 -2.5625 -0.59375q-1.140625 -0.609375 -1.734375 -1.734375q-0.578125 -1.140625 -0.578125 -2.546875q0 -1.40625 0.578125 -2.609375q0.59375 -1.203125 1.6875 -1.78125q1.09375 -0.59375 2.515625 -0.59375q1.03125 0 1.859375 0.34375q0.84375 0.328125 1.3125 0.9375q0.484375 0.59375 0.734375 1.546875l-1.140625 0.3125q-0.21875 -0.71875 -0.53125 -1.140625q-0.3125 -0.421875 -0.90625 -0.671875q-0.59375 -0.25 -1.3125 -0.25q-0.875 0 -1.515625 0.265625q-0.625 0.265625 -1.015625 0.703125q-0.375 0.421875 -0.59375 0.9375q-0.359375 0.875 -0.359375 1.921875q0 1.265625 0.4375 2.125q0.4375 0.859375 1.265625 1.28125q0.84375 0.421875 1.796875 0.421875q0.8125 0 1.59375 -0.3125q0.78125 -0.328125 1.1875 -0.6875l0 -1.765625l-2.796875 0zm5.3045654 0.28125q0 -1.921875 1.078125 -2.84375q0.890625 -0.765625 2.171875 -0.765625q1.421875 0 2.328125 0.9375q0.90625 0.921875 0.90625 2.578125q0 1.328125 -0.40625 2.09375q-0.390625 0.765625 -1.15625 1.1875q-0.765625 0.421875 -1.671875 0.421875q-1.453125 0 -2.359375 -0.921875q-0.890625 -0.9375 -0.890625 -2.6875zm1.203125 0q0 1.328125 0.578125 1.984375q0.59375 0.65625 1.46875 0.65625q0.875 0 1.453125 -0.65625q0.578125 -0.671875 0.578125 -2.03125q0 -1.28125 -0.59375 -1.9375q-0.578125 -0.65625 -1.4375 -0.65625q-0.875 0 -1.46875 0.65625q-0.578125 0.65625 -0.578125 1.984375zm6.2093506 0q0 -1.921875 1.078125 -2.84375q0.890625 -0.765625 2.171875 -0.765625q1.421875 0 2.328125 0.9375q0.90625 0.921875 0.90625 2.578125q0 1.328125 -0.40625 2.09375q-0.390625 0.765625 -1.15625 1.1875q-0.765625 0.421875 -1.671875 0.421875q-1.453125 0 -2.359375 -0.921875q-0.890625 -0.9375 -0.890625 -2.6875zm1.203125 0q0 1.328125 0.578125 1.984375q0.59375 0.65625 1.46875 0.65625q0.875 0 1.453125 -0.65625q0.578125 -0.671875 0.578125 -2.03125q0 -1.28125 -0.59375 -1.9375q-0.578125 -0.65625 -1.4375 -0.65625q-0.875 0 -1.46875 0.65625q-0.578125 0.65625 -0.578125 1.984375zm11.131226 3.453125l0 -0.875q-0.65625 1.03125 -1.9375 1.03125q-0.8125 0 -1.515625 -0.453125q-0.6875 -0.453125 -1.078125 -1.265625q-0.375 -0.828125 -0.375 -1.890625q0 -1.03125 0.34375 -1.875q0.34375 -0.84375 1.03125 -1.28125q0.703125 -0.453125 1.546875 -0.453125q0.625 0 1.109375 0.265625q0.5 0.25 0.796875 0.671875l0 -3.421875l1.171875 0l0 9.546875l-1.09375 0zm-3.703125 -3.453125q0 1.328125 0.5625 1.984375q0.5625 0.65625 1.328125 0.65625q0.765625 0 1.296875 -0.625q0.53125 -0.625 0.53125 -1.90625q0 -1.421875 -0.546875 -2.078125q-0.546875 -0.671875 -1.34375 -0.671875q-0.78125 0 -1.3125 0.640625q-0.515625 0.625 -0.515625 2.0z" fill-rule="nonzero"/><path fill="#000000" d="m642.6406 94.63531l0 -9.546875l3.59375 0q0.953125 0 1.453125 0.09375q0.703125 0.125 1.171875 0.453125q0.484375 0.328125 0.765625 0.921875q0.296875 0.59375 0.296875 1.296875q0 1.21875 -0.78125 2.0625q-0.765625 0.84375 -2.796875 0.84375l-2.4375 0l0 3.875l-1.265625 0zm1.265625 -5.0l2.453125 0q1.234375 0 1.75 -0.453125q0.515625 -0.46875 0.515625 -1.28125q0 -0.609375 -0.3125 -1.03125q-0.296875 -0.421875 -0.796875 -0.5625q-0.3125 -0.09375 -1.171875 -0.09375l-2.4375 0l0 3.421875zm11.983459 4.140625q-0.65625 0.5625 -1.265625 0.796875q-0.59375 0.21875 -1.28125 0.21875q-1.140625 0 -1.75 -0.546875q-0.609375 -0.5625 -0.609375 -1.4375q0 -0.5 0.21875 -0.921875q0.234375 -0.421875 0.609375 -0.671875q0.375 -0.25 0.84375 -0.390625q0.34375 -0.078125 1.046875 -0.171875q1.421875 -0.171875 2.09375 -0.40625q0 -0.234375 0 -0.296875q0 -0.71875 -0.328125 -1.015625q-0.453125 -0.390625 -1.34375 -0.390625q-0.8125 0 -1.21875 0.296875q-0.390625 0.28125 -0.578125 1.015625l-1.140625 -0.15625q0.15625 -0.734375 0.515625 -1.1875q0.359375 -0.453125 1.03125 -0.6875q0.671875 -0.25 1.5625 -0.25q0.890625 0 1.4375 0.203125q0.5625 0.203125 0.8125 0.53125q0.265625 0.3125 0.375 0.796875q0.046875 0.296875 0.046875 1.078125l0 1.5625q0 1.625 0.078125 2.0625q0.078125 0.4375 0.296875 0.828125l-1.21875 0q-0.1875 -0.359375 -0.234375 -0.859375zm-0.09375 -2.609375q-0.640625 0.265625 -1.921875 0.4375q-0.71875 0.109375 -1.015625 0.25q-0.296875 0.125 -0.46875 0.375q-0.15625 0.25 -0.15625 0.546875q0 0.46875 0.34375 0.78125q0.359375 0.3125 1.046875 0.3125q0.671875 0 1.203125 -0.296875q0.53125 -0.296875 0.78125 -0.8125q0.1875 -0.390625 0.1875 -1.171875l0 -0.421875zm2.5218506 1.40625l1.15625 -0.1875q0.109375 0.703125 0.546875 1.078125q0.453125 0.359375 1.25 0.359375q0.8125 0 1.203125 -0.328125q0.390625 -0.328125 0.390625 -0.765625q0 -0.390625 -0.359375 -0.625q-0.234375 -0.15625 -1.1875 -0.390625q-1.296875 -0.328125 -1.796875 -0.5625q-0.484375 -0.25 -0.75 -0.65625q-0.25 -0.421875 -0.25 -0.9375q0 -0.453125 0.203125 -0.84375q0.21875 -0.40625 0.578125 -0.671875q0.28125 -0.1875 0.75 -0.328125q0.46875 -0.140625 1.015625 -0.140625q0.8125 0 1.421875 0.234375q0.609375 0.234375 0.90625 0.640625q0.296875 0.390625 0.40625 1.0625l-1.140625 0.15625q-0.078125 -0.53125 -0.453125 -0.828125q-0.375 -0.3125 -1.0625 -0.3125q-0.8125 0 -1.15625 0.265625q-0.34375 0.265625 -0.34375 0.625q0 0.234375 0.140625 0.421875q0.15625 0.1875 0.453125 0.3125q0.171875 0.0625 1.03125 0.296875q1.25 0.328125 1.734375 0.546875q0.5 0.203125 0.78125 0.609375q0.28125 0.40625 0.28125 1.0q0 0.59375 -0.34375 1.109375q-0.34375 0.515625 -1.0 0.796875q-0.640625 0.28125 -1.453125 0.28125q-1.34375 0 -2.046875 -0.5625q-0.703125 -0.5625 -0.90625 -1.65625zm6.6640625 0l1.15625 -0.1875q0.109375 0.703125 0.546875 1.078125q0.453125 0.359375 1.25 0.359375q0.8125 0 1.203125 -0.328125q0.390625 -0.328125 0.390625 -0.765625q0 -0.390625 -0.359375 -0.625q-0.234375 -0.15625 -1.1875 -0.390625q-1.296875 -0.328125 -1.796875 -0.5625q-0.484375 -0.25 -0.75 -0.65625q-0.25 -0.421875 -0.25 -0.9375q0 -0.453125 0.203125 -0.84375q0.21875 -0.40625 0.578125 -0.671875q0.28125 -0.1875 0.75 -0.328125q0.46875 -0.140625 1.015625 -0.140625q0.8125 0 1.421875 0.234375q0.609375 0.234375 0.90625 0.640625q0.296875 0.390625 0.40625 1.0625l-1.140625 0.15625q-0.078125 -0.53125 -0.453125 -0.828125q-0.375 -0.3125 -1.0625 -0.3125q-0.8125 0 -1.15625 0.265625q-0.34375 0.265625 -0.34375 0.625q0 0.234375 0.140625 0.421875q0.15625 0.1875 0.453125 0.3125q0.171875 0.0625 1.03125 0.296875q1.25 0.328125 1.734375 0.546875q0.5 0.203125 0.78125 0.609375q0.28125 0.40625 0.28125 1.0q0 0.59375 -0.34375 1.109375q-0.34375 0.515625 -1.0 0.796875q-0.640625 0.28125 -1.453125 0.28125q-1.34375 0 -2.046875 -0.5625q-0.703125 -0.5625 -0.90625 -1.65625zm8.4140625 2.0625l-2.125 -6.90625l1.21875 0l1.09375 3.984375l0.421875 1.484375q0.015625 -0.109375 0.359375 -1.421875l1.09375 -4.046875l1.203125 0l1.03125 4.0l0.34375 1.328125l0.40625 -1.34375l1.171875 -3.984375l1.140625 0l-2.15625 6.90625l-1.21875 0l-1.09375 -4.140625l-0.265625 -1.171875l-1.40625 5.3125l-1.21875 0zm7.906433 -3.453125q0 -1.921875 1.078125 -2.84375q0.890625 -0.765625 2.171875 -0.765625q1.421875 0 2.328125 0.9375q0.90625 0.921875 0.90625 2.578125q0 1.328125 -0.40625 2.09375q-0.390625 0.765625 -1.15625 1.1875q-0.765625 0.421875 -1.671875 0.421875q-1.453125 0 -2.359375 -0.921875q-0.890625 -0.9375 -0.890625 -2.6875zm1.203125 0q0 1.328125 0.578125 1.984375q0.59375 0.65625 1.46875 0.65625q0.875 0 1.453125 -0.65625q0.578125 -0.671875 0.578125 -2.03125q0 -1.28125 -0.59375 -1.9375q-0.578125 -0.65625 -1.4375 -0.65625q-0.875 0 -1.46875 0.65625q-0.578125 0.65625 -0.578125 1.984375zm6.6312256 3.453125l0 -6.90625l1.0625 0l0 1.046875q0.40625 -0.734375 0.734375 -0.96875q0.34375 -0.234375 0.765625 -0.234375q0.59375 0 1.203125 0.375l-0.40625 1.078125q-0.4375 -0.25 -0.859375 -0.25q-0.390625 0 -0.703125 0.234375q-0.296875 0.234375 -0.421875 0.640625q-0.203125 0.625 -0.203125 1.359375l0 3.625l-1.171875 0zm8.9383545 0l0 -0.875q-0.65625 1.03125 -1.9375 1.03125q-0.8125 0 -1.515625 -0.453125q-0.6875 -0.453125 -1.078125 -1.265625q-0.375 -0.828125 -0.375 -1.890625q0 -1.03125 0.34375 -1.875q0.34375 -0.84375 1.03125 -1.28125q0.703125 -0.453125 1.546875 -0.453125q0.625 0 1.109375 0.265625q0.5 0.25 0.796875 0.671875l0 -3.421875l1.171875 0l0 9.546875l-1.09375 0zm-3.703125 -3.453125q0 1.328125 0.5625 1.984375q0.5625 0.65625 1.328125 0.65625q0.765625 0 1.296875 -0.625q0.53125 -0.625 0.53125 -1.90625q0 -1.421875 -0.546875 -2.078125q-0.546875 -0.671875 -1.34375 -0.671875q-0.78125 0 -1.3125 0.640625q-0.515625 0.625 -0.515625 2.0z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" d="m559.7323 81.83465l62.299194 0" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m559.7323 81.83465l56.299194 0" fill-rule="evenodd"/><path fill="#000000" stroke="#000000" stroke-width="1.0" stroke-linecap="butt" d="m616.0315 83.48638l4.538086 -1.6517334l-4.538086 -1.6517334z" fill-rule="evenodd"/><path fill="#000000" fill-opacity="0.0" d="m574.01575 63.748695l33.7323 0l0 18.078743l-33.7323 0z" fill-rule="evenodd"/><path fill="#000000" d="m583.7295 76.54869l0 -4.046875l-3.6875 -5.5l1.546875 0l1.875 2.875q0.515625 0.8125 0.96875 1.625q0.4375 -0.75 1.046875 -1.6875l1.84375 -2.8125l1.46875 0l-3.796875 5.5l0 4.046875l-1.265625 0zm9.5563965 -2.21875l1.203125 0.140625q-0.28125 1.0625 -1.0625 1.65625q-0.765625 0.578125 -1.96875 0.578125q-1.515625 0 -2.40625 -0.9375q-0.890625 -0.9375 -0.890625 -2.609375q0 -1.75 0.890625 -2.703125q0.90625 -0.96875 2.34375 -0.96875q1.390625 0 2.265625 0.9375q0.875 0.9375 0.875 2.65625q0 0.109375 0 0.3125l-5.15625 0q0.0625 1.140625 0.640625 1.75q0.578125 0.59375 1.4375 0.59375q0.65625 0 1.109375 -0.328125q0.453125 -0.34375 0.71875 -1.078125zm-3.84375 -1.90625l3.859375 0q-0.078125 -0.859375 -0.4375 -1.296875q-0.5625 -0.6875 -1.453125 -0.6875q-0.8125 0 -1.359375 0.546875q-0.546875 0.53125 -0.609375 1.4375zm6.0531006 2.0625l1.15625 -0.1875q0.109375 0.703125 0.546875 1.078125q0.453125 0.359375 1.25 0.359375q0.8125 0 1.203125 -0.328125q0.390625 -0.328125 0.390625 -0.765625q0 -0.390625 -0.359375 -0.625q-0.234375 -0.15625 -1.1875 -0.390625q-1.296875 -0.328125 -1.796875 -0.5625q-0.484375 -0.25 -0.75 -0.65625q-0.25 -0.421875 -0.25 -0.9375q0 -0.453125 0.203125 -0.84375q0.21875 -0.40625 0.578125 -0.671875q0.28125 -0.1875 0.75 -0.328125q0.46875 -0.140625 1.015625 -0.140625q0.8125 0 1.421875 0.234375q0.609375 0.234375 0.90625 0.640625q0.296875 0.390625 0.40625 1.0625l-1.140625 0.15625q-0.078125 -0.53125 -0.453125 -0.828125q-0.375 -0.3125 -1.0625 -0.3125q-0.8125 0 -1.15625 0.265625q-0.34375 0.265625 -0.34375 0.625q0 0.234375 0.140625 0.421875q0.15625 0.1875 0.453125 0.3125q0.171875 0.0625 1.03125 0.296875q1.25 0.328125 1.734375 0.546875q0.5 0.203125 0.78125 0.609375q0.28125 0.40625 0.28125 1.0q0 0.59375 -0.34375 1.109375q-0.34375 0.515625 -1.0 0.796875q-0.640625 0.28125 -1.453125 0.28125q-1.34375 0 -2.046875 -0.5625q-0.703125 -0.5625 -0.90625 -1.65625z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" d="m167.56955 149.14961l33.732285 0l0 18.078735l-33.732285 0z" fill-rule="evenodd"/><path fill="#000000" d="m177.28326 161.9496l0 -4.046875l-3.6875 -5.5l1.546875 0l1.875 2.875q0.515625 0.8125 0.96875 1.625q0.4375 -0.75 1.046875 -1.6875l1.84375 -2.8125l1.46875 0l-3.796875 5.5l0 4.046875l-1.265625 0zm9.556427 -2.21875l1.203125 0.140625q-0.28125 1.0625 -1.0625 1.65625q-0.765625 0.578125 -1.96875 0.578125q-1.515625 0 -2.40625 -0.9375q-0.890625 -0.9375 -0.890625 -2.609375q0 -1.75 0.890625 -2.703125q0.90625 -0.96875 2.34375 -0.96875q1.390625 0 2.265625 0.9375q0.875 0.9375 0.875 2.65625q0 0.109375 0 0.3125l-5.15625 0q0.0625 1.140625 0.640625 1.75q0.578125 0.59375 1.4375 0.59375q0.65625 0 1.109375 -0.328125q0.453125 -0.34375 0.71875 -1.078125zm-3.84375 -1.90625l3.859375 0q-0.078125 -0.859375 -0.4375 -1.296875q-0.5625 -0.6875 -1.453125 -0.6875q-0.8125 0 -1.359375 0.546875q-0.546875 0.53125 -0.609375 1.4375zm6.0531006 2.0625l1.15625 -0.1875q0.109375 0.703125 0.546875 1.078125q0.453125 0.359375 1.25 0.359375q0.8125 0 1.203125 -0.328125q0.390625 -0.328125 0.390625 -0.765625q0 -0.390625 -0.359375 -0.625q-0.234375 -0.15625 -1.1875 -0.390625q-1.296875 -0.328125 -1.796875 -0.5625q-0.484375 -0.25 -0.75 -0.65625q-0.25 -0.421875 -0.25 -0.9375q0 -0.453125 0.203125 -0.84375q0.21875 -0.40625 0.578125 -0.671875q0.28125 -0.1875 0.75 -0.328125q0.46875 -0.140625 1.015625 -0.140625q0.8125 0 1.421875 0.234375q0.609375 0.234375 0.90625 0.640625q0.296875 0.390625 0.40625 1.0625l-1.140625 0.15625q-0.078125 -0.53125 -0.453125 -0.828125q-0.375 -0.3125 -1.0625 -0.3125q-0.8125 0 -1.15625 0.265625q-0.34375 0.265625 -0.34375 0.625q0 0.234375 0.140625 0.421875q0.15625 0.1875 0.453125 0.3125q0.171875 0.0625 1.03125 0.296875q1.25 0.328125 1.734375 0.546875q0.5 0.203125 0.78125 0.609375q0.28125 0.40625 0.28125 1.0q0 0.59375 -0.34375 1.109375q-0.34375 0.515625 -1.0 0.796875q-0.640625 0.28125 -1.453125 0.28125q-1.34375 0 -2.046875 -0.5625q-0.703125 -0.5625 -0.90625 -1.65625z" fill-rule="nonzero"/><path fill="#ffffff" d="m135.88452 190.51453l0 0c0 -2.6498566 2.1481323 -4.797989 4.797989 -4.797989l53.774094 0c1.2725067 0 2.4928894 0.50549316 3.392685 1.405304c0.89979553 0.89979553 1.405304 2.1201782 1.405304 3.392685l0 19.191422c0 2.6498566 -2.1481323 4.797989 -4.797989 4.797989l-53.774094 0c-2.6498566 0 -4.797989 -2.1481323 -4.797989 -4.797989z" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m135.88452 190.51453l0 0c0 -2.6498566 2.1481323 -4.797989 4.797989 -4.797989l53.774094 0c1.2725067 0 2.4928894 0.50549316 3.392685 1.405304c0.89979553 0.89979553 1.405304 2.1201782 1.405304 3.392685l0 19.191422c0 2.6498566 -2.1481323 4.797989 -4.797989 4.797989l-53.774094 0c-2.6498566 0 -4.797989 -2.1481323 -4.797989 -4.797989z" fill-rule="evenodd"/><path fill="#000000" d="m153.80775 204.91023l0 -9.546875l6.90625 0l0 1.125l-5.640625 0l0 2.921875l5.28125 0l0 1.125l-5.28125 0l0 3.25l5.859375 0l0 1.125l-7.125 0zm8.702255 0l0 -6.90625l1.0625 0l0 1.046875q0.40625 -0.734375 0.734375 -0.96875q0.34375 -0.234375 0.765625 -0.234375q0.59375 0 1.203125 0.375l-0.40625 1.078125q-0.4375 -0.25 -0.859375 -0.25q-0.390625 0 -0.703125 0.234375q-0.296875 0.234375 -0.421875 0.640625q-0.203125 0.625 -0.203125 1.359375l0 3.625l-1.171875 0zm4.4383698 0l0 -6.90625l1.0625 0l0 1.046875q0.40625 -0.734375 0.734375 -0.96875q0.34375 -0.234375 0.765625 -0.234375q0.59375 0 1.203125 0.375l-0.40625 1.078125q-0.4375 -0.25 -0.859375 -0.25q-0.390625 0 -0.703125 0.234375q-0.296875 0.234375 -0.421875 0.640625q-0.203125 0.625 -0.203125 1.359375l0 3.625l-1.171875 0zm4.0164948 -3.453125q0 -1.921875 1.078125 -2.84375q0.890625 -0.765625 2.171875 -0.765625q1.421875 0 2.328125 0.9375q0.90625 0.921875 0.90625 2.578125q0 1.328125 -0.40625 2.09375q-0.390625 0.765625 -1.15625 1.1875q-0.765625 0.421875 -1.671875 0.421875q-1.453125 0 -2.359375 -0.921875q-0.890625 -0.9375 -0.890625 -2.6875zm1.203125 0q0 1.328125 0.578125 1.984375q0.59375 0.65625 1.46875 0.65625q0.875 0 1.453125 -0.65625q0.578125 -0.671875 0.578125 -2.03125q0 -1.28125 -0.59375 -1.9375q-0.578125 -0.65625 -1.4375 -0.65625q-0.875 0 -1.46875 0.65625q-0.578125 0.65625 -0.578125 1.984375zm6.6312256 3.453125l0 -6.90625l1.0625 0l0 1.046875q0.40625 -0.734375 0.734375 -0.96875q0.34375 -0.234375 0.765625 -0.234375q0.59375 0 1.203125 0.375l-0.40625 1.078125q-0.4375 -0.25 -0.859375 -0.25q-0.390625 0 -0.703125 0.234375q-0.296875 0.234375 -0.421875 0.640625q-0.203125 0.625 -0.203125 1.359375l0 3.625l-1.171875 0z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" d="m510.89764 33.0l0 -24.999922l-471.21262 0l0 59.425117" fill-rule="evenodd"/><path stroke="#000000" stroke-width="1.0" stroke-linejoin="round" stroke-linecap="butt" d="m510.89764 33.0l0 -24.999924l-471.21262 0l0 53.42512" fill-rule="evenodd"/><path fill="#000000" stroke="#000000" stroke-width="1.0" stroke-linecap="butt" d="m38.033306 61.425198l1.6517334 4.5380974l1.6517334 -4.5380974z" fill-rule="evenodd"/></g></svg>
\ No newline at end of file
diff --git a/website/public/img/vault-password-policy-performance.svg b/website/public/img/vault-password-policy-performance.svg
deleted file mode 100644
index 54ffb4210c9..00000000000
--- a/website/public/img/vault-password-policy-performance.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg version="1.1" viewBox="0.0 0.0 757.0 468.0" fill="none" stroke="none" stroke-linecap="square" stroke-miterlimit="10" width="757" height="468" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg"><path fill="#ffffff" d="M0 0L757.0 0L757.0 468.0L0 468.0L0 0Z" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M91.5 112.5L91.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M198.5 112.5L198.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M305.5 112.5L305.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M412.5 112.5L412.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M519.5 112.5L519.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M626.5 112.5L626.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M733.5 112.5L733.5 392.5" fill-rule="nonzero"/><path stroke="#333333" stroke-width="1.0" stroke-linecap="butt" d="M70.5 392.5L733.5 392.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M70.5 322.5L733.5 322.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M70.5 252.5L733.5 252.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M70.5 182.5L733.5 182.5" fill-rule="nonzero"/><path stroke="#cccccc" stroke-width="1.0" stroke-linecap="butt" d="M70.5 112.5L733.5 112.5" fill-rule="nonzero"/><clipPath id="id_0"><path d="M70.4 112.6L733.6 112.6L733.6 392.6L70.4 392.6L70.4 112.6Z" clip-rule="nonzero"/></clipPath><path stroke="#4285f4" stroke-width="2.0" stroke-linecap="butt" clip-path="url(#id_0)" d="M70.4 117.78L81.09677 165.38L91.79355 195.76L102.490326 212.98L113.187096 227.05L123.88387 238.25L134.58064 247.42L145.27742 254.28L155.9742 260.93L166.67097 263.1L177.36774 267.37L188.06451 270.17L198.76129 272.76L209.45807 274.09L220.15485 275.21L230.85161 275.7L241.54839 277.52L252.24516 272.76L262.94193 279.48L273.6387 279.13L284.33548 280.18L295.03226 276.75L305.72903 276.89L316.4258 277.52L327.1226 274.37L337.81937 276.33L348.51614 275.0L359.2129 273.67L369.90967 274.37L380.60645 274.23L391.30322 274.44L402.0 272.41L412.69678 273.11L423.39355 272.34L434.09033 271.71L444.7871 270.73L455.48386 269.96L466.18063 268.7L476.8774 270.52L487.5742 267.58L498.27097 262.96L508.96774 269.54L519.6645 266.95L530.36127 266.53L541.05804 264.43L551.7548 263.87L562.4516 262.12L573.1484 261.84L583.84515 257.22L594.54193 259.04L605.2387 258.06L615.9355 256.1L626.63226 255.26L637.32904 253.02L648.0258 253.09L658.7226 252.04L669.4194 250.29L680.11615 249.24L690.8129 247.35L701.5097 247.07L712.2065 245.81L722.9032 243.64L733.6 243.78" fill-rule="nonzero"/><path stroke="#ea4335" stroke-width="2.0" stroke-linecap="butt" clip-path="url(#id_0)" d="M70.4 296.21L81.09677 304.82L91.79355 310.07L102.490326 312.24L113.187096 314.06L123.88387 312.17L134.58064 314.13L145.27742 316.86L155.9742 315.88L166.67097 314.62L177.36774 314.2L188.06451 312.45L198.76129 313.99L209.45807 308.74L220.15485 306.08L230.85161 309.02L241.54839 307.62L252.24516 306.64L262.94193 298.94L273.6387 306.01L284.33548 305.38L295.03226 305.31L305.72903 302.65L316.4258 298.17L327.1226 295.09L337.81937 294.04L348.51614 295.93L359.2129 295.58L369.90967 294.81L380.60645 290.19L391.30322 288.44L402.0 287.32L412.69678 281.93L423.39355 287.25L434.09033 289.14L444.7871 286.69L455.48386 286.76L466.18063 287.25L476.8774 283.82L487.5742 280.18L498.27097 280.11L508.96774 281.44L519.6645 277.03L530.36127 276.75L541.05804 278.43L551.7548 277.87L562.4516 273.6L573.1484 270.87L583.84515 272.62L594.54193 271.71L605.2387 269.4L615.9355 268.21L626.63226 266.18L637.32904 265.83L648.0258 266.25L658.7226 264.92L669.4194 263.24L680.11615 261.7L690.8129 259.88L701.5097 255.54L712.2065 256.59L722.9032 251.27L733.6 247.98" fill-rule="nonzero"/><path stroke="#fbbc04" stroke-width="2.0" stroke-linecap="butt" clip-path="url(#id_0)" d="M70.4 315.95L81.09677 319.1L91.79355 322.32L102.490326 323.16L113.187096 322.32L123.88387 323.86L134.58064 323.51L145.27742 324.21L155.9742 322.53L166.67097 321.62L177.36774 322.46L188.06451 321.55L198.76129 320.15L209.45807 320.5L220.15485 320.64L230.85161 319.24L241.54839 317.28L252.24516 316.72L262.94193 316.23L273.6387 315.11L284.33548 314.34L295.03226 311.96L305.72903 312.31L316.4258 311.19L327.1226 307.13L337.81937 305.52L348.51614 304.54L359.2129 304.47L369.90967 303.28L380.60645 302.44L391.30322 301.39L402.0 300.06L412.69678 298.38L423.39355 297.68L434.09033 297.4L444.7871 295.23L455.48386 294.67L466.18063 289.42L476.8774 291.38L487.5742 290.68L498.27097 288.72L508.96774 285.99L519.6645 287.67L530.36127 286.34L541.05804 284.87L551.7548 282.98L562.4516 282.84L573.1484 280.81L583.84515 280.25L594.54193 278.43L605.2387 276.47L615.9355 276.12L626.63226 276.05L637.32904 274.58L648.0258 271.29L658.7226 271.99L669.4194 270.8L680.11615 268.91L690.8129 268.21L701.5097 266.11L712.2065 265.62L722.9032 262.75L733.6 261.91" fill-rule="nonzero"/><path stroke="#34a853" stroke-width="2.0" stroke-linecap="butt" clip-path="url(#id_0)" d="M70.4 358.86L81.09677 356.27L91.79355 355.92L102.490326 353.68L113.187096 352.14L123.88387 350.11L134.58064 350.04L145.27742 348.92L155.9742 345.91L166.67097 344.3L177.36774 344.51L188.06451 342.41L198.76129 343.04L209.45807 340.03L220.15485 338.84L230.85161 337.44L241.54839 338.28L252.24516 336.6L262.94193 336.39L273.6387 334.64L284.33548 331.49L295.03226 329.53L305.72903 330.65L316.4258 327.92L327.1226 325.4L337.81937 321.48L348.51614 322.25L359.2129 321.06L369.90967 318.19L380.60645 316.3L391.30322 314.2L402.0 315.6L412.69678 314.97L423.39355 314.83L434.09033 313.92L444.7871 312.94L455.48386 310.63L466.18063 309.93L476.8774 308.67L487.5742 307.34L498.27097 306.36L508.96774 304.68L519.6645 303.77L530.36127 302.58L541.05804 300.76L551.7548 299.99L562.4516 298.8L573.1484 298.66L583.84515 296.7L594.54193 295.3L605.2387 294.25L615.9355 292.99L626.63226 291.8L637.32904 289.63L648.0258 289.14L658.7226 288.09L669.4194 286.9L680.11615 284.66L690.8129 284.66L701.5097 284.1L712.2065 283.75L722.9032 282.28L733.6 279.48" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M73.4 117.78C73.4 119.43685 72.056854 120.78 70.4 120.78C68.74315 120.78 67.4 119.43685 67.4 117.78C67.4 116.123146 68.74315 114.78 70.4 114.78C72.056854 114.78 73.4 116.123146 73.4 117.78Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M84.09677 165.38C84.09677 167.03685 82.75363 168.38 81.09677 168.38C79.43992 168.38 78.09677 167.03685 78.09677 165.38C78.09677 163.72314 79.43992 162.38 81.09677 162.38C82.75363 162.38 84.09677 163.72314 84.09677 165.38Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M94.79355 195.76C94.79355 197.41685 93.4504 198.76 91.79355 198.76C90.136696 198.76 88.79355 197.41685 88.79355 195.76C88.79355 194.10315 90.136696 192.76 91.79355 192.76C93.4504 192.76 94.79355 194.10315 94.79355 195.76Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M105.490326 212.98C105.490326 214.63686 104.14718 215.98 102.490326 215.98C100.833466 215.98 99.490326 214.63686 99.490326 212.98C99.490326 211.32315 100.833466 209.98 102.490326 209.98C104.14718 209.98 105.490326 211.32315 105.490326 212.98Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M116.187096 227.05C116.187096 228.70685 114.84395 230.05 113.187096 230.05C111.53024 230.05 110.187096 228.70685 110.187096 227.05C110.187096 225.39314 111.53024 224.05 113.187096 224.05C114.84395 224.05 116.187096 225.39314 116.187096 227.05Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M126.88387 238.25C126.88387 239.90686 125.540726 241.25 123.88387 241.25C122.22702 241.25 120.88387 239.90686 120.88387 238.25C120.88387 236.59314 122.22702 235.25 123.88387 235.25C125.540726 235.25 126.88387 236.59314 126.88387 238.25Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M137.58064 247.42C137.58064 249.07686 136.2375 250.42 134.58064 250.42C132.9238 250.42 131.58064 249.07686 131.58064 247.42C131.58064 245.76315 132.9238 244.42 134.58064 244.42C136.2375 244.42 137.58064 245.76315 137.58064 247.42Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M148.27742 254.28C148.27742 255.93686 146.93428 257.28 145.27742 257.28C143.62056 257.28 142.27742 255.93686 142.27742 254.28C142.27742 252.62314 143.62056 251.28 145.27742 251.28C146.93428 251.28 148.27742 252.62314 148.27742 254.28Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M158.9742 260.93C158.9742 262.58685 157.63104 263.93 155.9742 263.93C154.31734 263.93 152.9742 262.58685 152.9742 260.93C152.9742 259.27313 154.31734 257.93 155.9742 257.93C157.63104 257.93 158.9742 259.27313 158.9742 260.93Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M169.67097 263.1C169.67097 264.75687 168.32782 266.1 166.67097 266.1C165.01411 266.1 163.67097 264.75687 163.67097 263.1C163.67097 261.44315 165.01411 260.1 166.67097 260.1C168.32782 260.1 169.67097 261.44315 169.67097 263.1Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M180.36774 267.37C180.36774 269.02686 179.0246 270.37 177.36774 270.37C175.71089 270.37 174.36774 269.02686 174.36774 267.37C174.36774 265.71313 175.71089 264.37 177.36774 264.37C179.0246 264.37 180.36774 265.71313 180.36774 267.37Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M191.06451 270.17C191.06451 271.82684 189.72137 273.17 188.06451 273.17C186.40767 273.17 185.06451 271.82684 185.06451 270.17C185.06451 268.51315 186.40767 267.17 188.06451 267.17C189.72137 267.17 191.06451 268.51315 191.06451 270.17Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M201.76129 272.76C201.76129 274.41684 200.41815 275.76 198.76129 275.76C197.10443 275.76 195.76129 274.41684 195.76129 272.76C195.76129 271.10315 197.10443 269.76 198.76129 269.76C200.41815 269.76 201.76129 271.10315 201.76129 272.76Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M212.45807 274.09C212.45807 275.74686 211.11491 277.09 209.45807 277.09C207.80121 277.09 206.45807 275.74686 206.45807 274.09C206.45807 272.43314 207.80121 271.09 209.45807 271.09C211.11491 271.09 212.45807 272.43314 212.45807 274.09Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M223.15485 275.21C223.15485 276.86685 221.81169 278.21 220.15485 278.21C218.49799 278.21 217.15485 276.86685 217.15485 275.21C217.15485 273.55313 218.49799 272.21 220.15485 272.21C221.81169 272.21 223.15485 273.55313 223.15485 275.21Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M233.85161 275.7C233.85161 277.35684 232.50847 278.7 230.85161 278.7C229.19476 278.7 227.85161 277.35684 227.85161 275.7C227.85161 274.04315 229.19476 272.7 230.85161 272.7C232.50847 272.7 233.85161 274.04315 233.85161 275.7Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M244.54839 277.52C244.54839 279.17685 243.20525 280.52 241.54839 280.52C239.89153 280.52 238.54839 279.17685 238.54839 277.52C238.54839 275.86316 239.89153 274.52 241.54839 274.52C243.20525 274.52 244.54839 275.86316 244.54839 277.52Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M255.24516 272.76C255.24516 274.41684 253.90201 275.76 252.24516 275.76C250.5883 275.76 249.24516 274.41684 249.24516 272.76C249.24516 271.10315 250.5883 269.76 252.24516 269.76C253.90201 269.76 255.24516 271.10315 255.24516 272.76Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M265.94193 279.48C265.94193 281.13684 264.5988 282.48 262.94193 282.48C261.2851 282.48 259.94193 281.13684 259.94193 279.48C259.94193 277.82315 261.2851 276.48 262.94193 276.48C264.5988 276.48 265.94193 277.82315 265.94193 279.48Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M276.6387 279.13C276.6387 280.78687 275.29556 282.13 273.6387 282.13C271.98184 282.13 270.6387 280.78687 270.6387 279.13C270.6387 277.47314 271.98184 276.13 273.6387 276.13C275.29556 276.13 276.6387 277.47314 276.6387 279.13Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M287.33548 280.18C287.33548 281.83685 285.99234 283.18 284.33548 283.18C282.67862 283.18 281.33548 281.83685 281.33548 280.18C281.33548 278.52313 282.67862 277.18 284.33548 277.18C285.99234 277.18 287.33548 278.52313 287.33548 280.18Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M298.03226 276.75C298.03226 278.40686 296.68912 279.75 295.03226 279.75C293.3754 279.75 292.03226 278.40686 292.03226 276.75C292.03226 275.09314 293.3754 273.75 295.03226 273.75C296.68912 273.75 298.03226 275.09314 298.03226 276.75Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M308.72903 276.89C308.72903 278.54684 307.3859 279.89 305.72903 279.89C304.07217 279.89 302.72903 278.54684 302.72903 276.89C302.72903 275.23315 304.07217 273.89 305.72903 273.89C307.3859 273.89 308.72903 275.23315 308.72903 276.89Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M319.4258 277.52C319.4258 279.17685 318.08267 280.52 316.4258 280.52C314.76895 280.52 313.4258 279.17685 313.4258 277.52C313.4258 275.86316 314.76895 274.52 316.4258 274.52C318.08267 274.52 319.4258 275.86316 319.4258 277.52Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M330.1226 274.37C330.1226 276.02686 328.77945 277.37 327.1226 277.37C325.46573 277.37 324.1226 276.02686 324.1226 274.37C324.1226 272.71313 325.46573 271.37 327.1226 271.37C328.77945 271.37 330.1226 272.71313 330.1226 274.37Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M340.81937 276.33C340.81937 277.98685 339.4762 279.33 337.81937 279.33C336.1625 279.33 334.81937 277.98685 334.81937 276.33C334.81937 274.67316 336.1625 273.33 337.81937 273.33C339.4762 273.33 340.81937 274.67316 340.81937 276.33Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M351.51614 275.0C351.51614 276.65686 350.17297 278.0 348.51614 278.0C346.85928 278.0 345.51614 276.65686 345.51614 275.0C345.51614 273.34314 346.85928 272.0 348.51614 272.0C350.17297 272.0 351.51614 273.34314 351.51614 275.0Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M362.2129 273.67C362.2129 275.32684 360.86975 276.67 359.2129 276.67C357.55606 276.67 356.2129 275.32684 356.2129 273.67C356.2129 272.01315 357.55606 270.67 359.2129 270.67C360.86975 270.67 362.2129 272.01315 362.2129 273.67Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M372.90967 274.37C372.90967 276.02686 371.56653 277.37 369.90967 277.37C368.25284 277.37 366.90967 276.02686 366.90967 274.37C366.90967 272.71313 368.25284 271.37 369.90967 271.37C371.56653 271.37 372.90967 272.71313 372.90967 274.37Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M383.60645 274.23C383.60645 275.88684 382.2633 277.23 380.60645 277.23C378.9496 277.23 377.60645 275.88684 377.60645 274.23C377.60645 272.57315 378.9496 271.23 380.60645 271.23C382.2633 271.23 383.60645 272.57315 383.60645 274.23Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M394.30322 274.44C394.30322 276.09686 392.96008 277.44 391.30322 277.44C389.64636 277.44 388.30322 276.09686 388.30322 274.44C388.30322 272.78314 389.64636 271.44 391.30322 271.44C392.96008 271.44 394.30322 272.78314 394.30322 274.44Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M405.0 272.41C405.0 274.06686 403.65686 275.41 402.0 275.41C400.34314 275.41 399.0 274.06686 399.0 272.41C399.0 270.75314 400.34314 269.41 402.0 269.41C403.65686 269.41 405.0 270.75314 405.0 272.41Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M415.69678 273.11C415.69678 274.76685 414.35364 276.11 412.69678 276.11C411.03992 276.11 409.69678 274.76685 409.69678 273.11C409.69678 271.45316 411.03992 270.11 412.69678 270.11C414.35364 270.11 415.69678 271.45316 415.69678 273.11Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M426.39355 272.34C426.39355 273.99686 425.0504 275.34 423.39355 275.34C421.7367 275.34 420.39355 273.99686 420.39355 272.34C420.39355 270.68314 421.7367 269.34 423.39355 269.34C425.0504 269.34 426.39355 270.68314 426.39355 272.34Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M437.09033 271.71C437.09033 273.36685 435.74716 274.71 434.09033 274.71C432.43347 274.71 431.09033 273.36685 431.09033 271.71C431.09033 270.05313 432.43347 268.71 434.09033 268.71C435.74716 268.71 437.09033 270.05313 437.09033 271.71Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M447.7871 270.73C447.7871 272.38684 446.44394 273.73 444.7871 273.73C443.13025 273.73 441.7871 272.38684 441.7871 270.73C441.7871 269.07315 443.13025 267.73 444.7871 267.73C446.44394 267.73 447.7871 269.07315 447.7871 270.73Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M458.48386 269.96C458.48386 271.61685 457.14072 272.96 455.48386 272.96C453.82703 272.96 452.48386 271.61685 452.48386 269.96C452.48386 268.30313 453.82703 266.96 455.48386 266.96C457.14072 266.96 458.48386 268.30313 458.48386 269.96Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M469.18063 268.7C469.18063 270.35684 467.8375 271.7 466.18063 271.7C464.5238 271.7 463.18063 270.35684 463.18063 268.7C463.18063 267.04315 464.5238 265.7 466.18063 265.7C467.8375 265.7 469.18063 267.04315 469.18063 268.7Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M479.8774 270.52C479.8774 272.17685 478.53427 273.52 476.8774 273.52C475.22055 273.52 473.8774 272.17685 473.8774 270.52C473.8774 268.86316 475.22055 267.52 476.8774 267.52C478.53427 267.52 479.8774 268.86316 479.8774 270.52Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M490.5742 267.58C490.5742 269.23685 489.23105 270.58 487.5742 270.58C485.91733 270.58 484.5742 269.23685 484.5742 267.58C484.5742 265.92316 485.91733 264.58 487.5742 264.58C489.23105 264.58 490.5742 265.92316 490.5742 267.58Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M501.27097 262.96C501.27097 264.61685 499.92783 265.96 498.27097 265.96C496.6141 265.96 495.27097 264.61685 495.27097 262.96C495.27097 261.30313 496.6141 259.96 498.27097 259.96C499.92783 259.96 501.27097 261.30313 501.27097 262.96Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M511.96774 269.54C511.96774 271.19687 510.6246 272.54 508.96774 272.54C507.31088 272.54 505.96774 271.19687 505.96774 269.54C505.96774 267.88315 507.31088 266.54 508.96774 266.54C510.6246 266.54 511.96774 267.88315 511.96774 269.54Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M522.6645 266.95C522.6645 268.60684 521.32135 269.95 519.6645 269.95C518.0077 269.95 516.6645 268.60684 516.6645 266.95C516.6645 265.29315 518.0077 263.95 519.6645 263.95C521.32135 263.95 522.6645 265.29315 522.6645 266.95Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M533.36127 266.53C533.36127 268.18686 532.0181 269.53 530.36127 269.53C528.7044 269.53 527.36127 268.18686 527.36127 266.53C527.36127 264.87314 528.7044 263.53 530.36127 263.53C532.0181 263.53 533.36127 264.87314 533.36127 266.53Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M544.05804 264.43C544.05804 266.08685 542.7149 267.43 541.05804 267.43C539.4012 267.43 538.05804 266.08685 538.05804 264.43C538.05804 262.77313 539.4012 261.43 541.05804 261.43C542.7149 261.43 544.05804 262.77313 544.05804 264.43Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M554.7548 263.87C554.7548 265.52686 553.4117 266.87 551.7548 266.87C550.09796 266.87 548.7548 265.52686 548.7548 263.87C548.7548 262.21313 550.09796 260.87 551.7548 260.87C553.4117 260.87 554.7548 262.21313 554.7548 263.87Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M565.4516 262.12C565.4516 263.77686 564.10846 265.12 562.4516 265.12C560.79474 265.12 559.4516 263.77686 559.4516 262.12C559.4516 260.46313 560.79474 259.12 562.4516 259.12C564.10846 259.12 565.4516 260.46313 565.4516 262.12Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M576.1484 261.84C576.1484 263.49686 574.80524 264.84 573.1484 264.84C571.4915 264.84 570.1484 263.49686 570.1484 261.84C570.1484 260.18314 571.4915 258.84 573.1484 258.84C574.80524 258.84 576.1484 260.18314 576.1484 261.84Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M586.84515 257.22C586.84515 258.87686 585.502 260.22 583.84515 260.22C582.1883 260.22 580.84515 258.87686 580.84515 257.22C580.84515 255.56314 582.1883 254.22 583.84515 254.22C585.502 254.22 586.84515 255.56314 586.84515 257.22Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M597.54193 259.04C597.54193 260.69687 596.1988 262.04 594.54193 262.04C592.8851 262.04 591.54193 260.69687 591.54193 259.04C591.54193 257.38315 592.8851 256.04 594.54193 256.04C596.1988 256.04 597.54193 257.38315 597.54193 259.04Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M608.2387 258.06C608.2387 259.71686 606.89557 261.06 605.2387 261.06C603.58185 261.06 602.2387 259.71686 602.2387 258.06C602.2387 256.40314 603.58185 255.06 605.2387 255.06C606.89557 255.06 608.2387 256.40314 608.2387 258.06Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M618.9355 256.1C618.9355 257.75687 617.59235 259.1 615.9355 259.1C614.2786 259.1 612.9355 257.75687 612.9355 256.1C612.9355 254.44315 614.2786 253.1 615.9355 253.1C617.59235 253.1 618.9355 254.44315 618.9355 256.1Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M629.63226 255.26C629.63226 256.91684 628.2891 258.26 626.63226 258.26C624.9754 258.26 623.63226 256.91684 623.63226 255.26C623.63226 253.60315 624.9754 252.26 626.63226 252.26C628.2891 252.26 629.63226 253.60315 629.63226 255.26Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M640.32904 253.02C640.32904 254.67685 638.9859 256.02 637.32904 256.02C635.6722 256.02 634.32904 254.67685 634.32904 253.02C634.32904 251.36314 635.6722 250.02 637.32904 250.02C638.9859 250.02 640.32904 251.36314 640.32904 253.02Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M651.0258 253.09C651.0258 254.74686 649.6827 256.09 648.0258 256.09C646.36896 256.09 645.0258 254.74686 645.0258 253.09C645.0258 251.43315 646.36896 250.09 648.0258 250.09C649.6827 250.09 651.0258 251.43315 651.0258 253.09Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M661.7226 252.04C661.7226 253.69685 660.37946 255.04 658.7226 255.04C657.06573 255.04 655.7226 253.69685 655.7226 252.04C655.7226 250.38315 657.06573 249.04 658.7226 249.04C660.37946 249.04 661.7226 250.38315 661.7226 252.04Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M672.4194 250.29C672.4194 251.94685 671.07623 253.29 669.4194 253.29C667.7625 253.29 666.4194 251.94685 666.4194 250.29C666.4194 248.63315 667.7625 247.29 669.4194 247.29C671.07623 247.29 672.4194 248.63315 672.4194 250.29Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M683.11615 249.24C683.11615 250.89685 681.773 252.24 680.11615 252.24C678.4593 252.24 677.11615 250.89685 677.11615 249.24C677.11615 247.58315 678.4593 246.24 680.11615 246.24C681.773 246.24 683.11615 247.58315 683.11615 249.24Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M693.8129 247.35C693.8129 249.00685 692.4698 250.35 690.8129 250.35C689.15607 250.35 687.8129 249.00685 687.8129 247.35C687.8129 245.69315 689.15607 244.35 690.8129 244.35C692.4698 244.35 693.8129 245.69315 693.8129 247.35Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M704.5097 247.07C704.5097 248.72685 703.1665 250.07 701.5097 250.07C699.85284 250.07 698.5097 248.72685 698.5097 247.07C698.5097 245.41315 699.85284 244.07 701.5097 244.07C703.1665 244.07 704.5097 245.41315 704.5097 247.07Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M715.2065 245.81C715.2065 247.46686 713.8633 248.81 712.2065 248.81C710.5496 248.81 709.2065 247.46686 709.2065 245.81C709.2065 244.15315 710.5496 242.81 712.2065 242.81C713.8633 242.81 715.2065 244.15315 715.2065 245.81Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M725.9032 243.64C725.9032 245.29686 724.56006 246.64 722.9032 246.64C721.2464 246.64 719.9032 245.29686 719.9032 243.64C719.9032 241.98314 721.2464 240.64 722.9032 240.64C724.56006 240.64 725.9032 241.98314 725.9032 243.64Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M736.6 243.78C736.6 245.43686 735.25684 246.78 733.6 246.78C731.9431 246.78 730.6 245.43686 730.6 243.78C730.6 242.12314 731.9431 240.78 733.6 240.78C735.25684 240.78 736.6 242.12314 736.6 243.78Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M73.4 296.21C73.4 297.86685 72.056854 299.21 70.4 299.21C68.74315 299.21 67.4 297.86685 67.4 296.21C67.4 294.55313 68.74315 293.21 70.4 293.21C72.056854 293.21 73.4 294.55313 73.4 296.21Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M84.09677 304.82C84.09677 306.47687 82.75363 307.82 81.09677 307.82C79.43992 307.82 78.09677 306.47687 78.09677 304.82C78.09677 303.16315 79.43992 301.82 81.09677 301.82C82.75363 301.82 84.09677 303.16315 84.09677 304.82Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M94.79355 310.07C94.79355 311.72687 93.4504 313.07 91.79355 313.07C90.136696 313.07 88.79355 311.72687 88.79355 310.07C88.79355 308.41315 90.136696 307.07 91.79355 307.07C93.4504 307.07 94.79355 308.41315 94.79355 310.07Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M105.490326 312.24C105.490326 313.89685 104.14718 315.24 102.490326 315.24C100.833466 315.24 99.490326 313.89685 99.490326 312.24C99.490326 310.58316 100.833466 309.24 102.490326 309.24C104.14718 309.24 105.490326 310.58316 105.490326 312.24Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M116.187096 314.06C116.187096 315.71686 114.84395 317.06 113.187096 317.06C111.53024 317.06 110.187096 315.71686 110.187096 314.06C110.187096 312.40314 111.53024 311.06 113.187096 311.06C114.84395 311.06 116.187096 312.40314 116.187096 314.06Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M126.88387 312.17C126.88387 313.82684 125.540726 315.17 123.88387 315.17C122.22702 315.17 120.88387 313.82684 120.88387 312.17C120.88387 310.51315 122.22702 309.17 123.88387 309.17C125.540726 309.17 126.88387 310.51315 126.88387 312.17Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M137.58064 314.13C137.58064 315.78687 136.2375 317.13 134.58064 317.13C132.9238 317.13 131.58064 315.78687 131.58064 314.13C131.58064 312.47314 132.9238 311.13 134.58064 311.13C136.2375 311.13 137.58064 312.47314 137.58064 314.13Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M148.27742 316.86C148.27742 318.51685 146.93428 319.86 145.27742 319.86C143.62056 319.86 142.27742 318.51685 142.27742 316.86C142.27742 315.20316 143.62056 313.86 145.27742 313.86C146.93428 313.86 148.27742 315.20316 148.27742 316.86Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M158.9742 315.88C158.9742 317.53687 157.63104 318.88 155.9742 318.88C154.31734 318.88 152.9742 317.53687 152.9742 315.88C152.9742 314.22314 154.31734 312.88 155.9742 312.88C157.63104 312.88 158.9742 314.22314 158.9742 315.88Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M169.67097 314.62C169.67097 316.27686 168.32782 317.62 166.67097 317.62C165.01411 317.62 163.67097 316.27686 163.67097 314.62C163.67097 312.96313 165.01411 311.62 166.67097 311.62C168.32782 311.62 169.67097 312.96313 169.67097 314.62Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M180.36774 314.2C180.36774 315.85684 179.0246 317.2 177.36774 317.2C175.71089 317.2 174.36774 315.85684 174.36774 314.2C174.36774 312.54315 175.71089 311.2 177.36774 311.2C179.0246 311.2 180.36774 312.54315 180.36774 314.2Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M191.06451 312.45C191.06451 314.10684 189.72137 315.45 188.06451 315.45C186.40767 315.45 185.06451 314.10684 185.06451 312.45C185.06451 310.79315 186.40767 309.45 188.06451 309.45C189.72137 309.45 191.06451 310.79315 191.06451 312.45Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M201.76129 313.99C201.76129 315.64685 200.41815 316.99 198.76129 316.99C197.10443 316.99 195.76129 315.64685 195.76129 313.99C195.76129 312.33316 197.10443 310.99 198.76129 310.99C200.41815 310.99 201.76129 312.33316 201.76129 313.99Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M212.45807 308.74C212.45807 310.39685 211.11491 311.74 209.45807 311.74C207.80121 311.74 206.45807 310.39685 206.45807 308.74C206.45807 307.08316 207.80121 305.74 209.45807 305.74C211.11491 305.74 212.45807 307.08316 212.45807 308.74Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M223.15485 306.08C223.15485 307.73685 221.81169 309.08 220.15485 309.08C218.49799 309.08 217.15485 307.73685 217.15485 306.08C217.15485 304.42316 218.49799 303.08 220.15485 303.08C221.81169 303.08 223.15485 304.42316 223.15485 306.08Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M233.85161 309.02C233.85161 310.67685 232.50847 312.02 230.85161 312.02C229.19476 312.02 227.85161 310.67685 227.85161 309.02C227.85161 307.36316 229.19476 306.02 230.85161 306.02C232.50847 306.02 233.85161 307.36316 233.85161 309.02Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M244.54839 307.62C244.54839 309.27686 243.20525 310.62 241.54839 310.62C239.89153 310.62 238.54839 309.27686 238.54839 307.62C238.54839 305.96313 239.89153 304.62 241.54839 304.62C243.20525 304.62 244.54839 305.96313 244.54839 307.62Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M255.24516 306.64C255.24516 308.29684 253.90201 309.64 252.24516 309.64C250.5883 309.64 249.24516 308.29684 249.24516 306.64C249.24516 304.98315 250.5883 303.64 252.24516 303.64C253.90201 303.64 255.24516 304.98315 255.24516 306.64Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M265.94193 298.94C265.94193 300.59686 264.5988 301.94 262.94193 301.94C261.2851 301.94 259.94193 300.59686 259.94193 298.94C259.94193 297.28314 261.2851 295.94 262.94193 295.94C264.5988 295.94 265.94193 297.28314 265.94193 298.94Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M276.6387 306.01C276.6387 307.66684 275.29556 309.01 273.6387 309.01C271.98184 309.01 270.6387 307.66684 270.6387 306.01C270.6387 304.35315 271.98184 303.01 273.6387 303.01C275.29556 303.01 276.6387 304.35315 276.6387 306.01Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M287.33548 305.38C287.33548 307.03687 285.99234 308.38 284.33548 308.38C282.67862 308.38 281.33548 307.03687 281.33548 305.38C281.33548 303.72314 282.67862 302.38 284.33548 302.38C285.99234 302.38 287.33548 303.72314 287.33548 305.38Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M298.03226 305.31C298.03226 306.96686 296.68912 308.31 295.03226 308.31C293.3754 308.31 292.03226 306.96686 292.03226 305.31C292.03226 303.65314 293.3754 302.31 295.03226 302.31C296.68912 302.31 298.03226 303.65314 298.03226 305.31Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M308.72903 302.65C308.72903 304.30685 307.3859 305.65 305.72903 305.65C304.07217 305.65 302.72903 304.30685 302.72903 302.65C302.72903 300.99313 304.07217 299.65 305.72903 299.65C307.3859 299.65 308.72903 300.99313 308.72903 302.65Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M319.4258 298.17C319.4258 299.82684 318.08267 301.17 316.4258 301.17C314.76895 301.17 313.4258 299.82684 313.4258 298.17C313.4258 296.51315 314.76895 295.17 316.4258 295.17C318.08267 295.17 319.4258 296.51315 319.4258 298.17Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M330.1226 295.09C330.1226 296.74686 328.77945 298.09 327.1226 298.09C325.46573 298.09 324.1226 296.74686 324.1226 295.09C324.1226 293.43314 325.46573 292.09 327.1226 292.09C328.77945 292.09 330.1226 293.43314 330.1226 295.09Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M340.81937 294.04C340.81937 295.69687 339.4762 297.04 337.81937 297.04C336.1625 297.04 334.81937 295.69687 334.81937 294.04C334.81937 292.38315 336.1625 291.04 337.81937 291.04C339.4762 291.04 340.81937 292.38315 340.81937 294.04Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M351.51614 295.93C351.51614 297.58685 350.17297 298.93 348.51614 298.93C346.85928 298.93 345.51614 297.58685 345.51614 295.93C345.51614 294.27313 346.85928 292.93 348.51614 292.93C350.17297 292.93 351.51614 294.27313 351.51614 295.93Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M362.2129 295.58C362.2129 297.23685 360.86975 298.58 359.2129 298.58C357.55606 298.58 356.2129 297.23685 356.2129 295.58C356.2129 293.92316 357.55606 292.58 359.2129 292.58C360.86975 292.58 362.2129 293.92316 362.2129 295.58Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M372.90967 294.81C372.90967 296.46686 371.56653 297.81 369.90967 297.81C368.25284 297.81 366.90967 296.46686 366.90967 294.81C366.90967 293.15314 368.25284 291.81 369.90967 291.81C371.56653 291.81 372.90967 293.15314 372.90967 294.81Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M383.60645 290.19C383.60645 291.84686 382.2633 293.19 380.60645 293.19C378.9496 293.19 377.60645 291.84686 377.60645 290.19C377.60645 288.53314 378.9496 287.19 380.60645 287.19C382.2633 287.19 383.60645 288.53314 383.60645 290.19Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M394.30322 288.44C394.30322 290.09686 392.96008 291.44 391.30322 291.44C389.64636 291.44 388.30322 290.09686 388.30322 288.44C388.30322 286.78314 389.64636 285.44 391.30322 285.44C392.96008 285.44 394.30322 286.78314 394.30322 288.44Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M405.0 287.32C405.0 288.97687 403.65686 290.32 402.0 290.32C400.34314 290.32 399.0 288.97687 399.0 287.32C399.0 285.66315 400.34314 284.32 402.0 284.32C403.65686 284.32 405.0 285.66315 405.0 287.32Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M415.69678 281.93C415.69678 283.58685 414.35364 284.93 412.69678 284.93C411.03992 284.93 409.69678 283.58685 409.69678 281.93C409.69678 280.27313 411.03992 278.93 412.69678 278.93C414.35364 278.93 415.69678 280.27313 415.69678 281.93Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M426.39355 287.25C426.39355 288.90686 425.0504 290.25 423.39355 290.25C421.7367 290.25 420.39355 288.90686 420.39355 287.25C420.39355 285.59314 421.7367 284.25 423.39355 284.25C425.0504 284.25 426.39355 285.59314 426.39355 287.25Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M437.09033 289.14C437.09033 290.79684 435.74716 292.14 434.09033 292.14C432.43347 292.14 431.09033 290.79684 431.09033 289.14C431.09033 287.48315 432.43347 286.14 434.09033 286.14C435.74716 286.14 437.09033 287.48315 437.09033 289.14Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M447.7871 286.69C447.7871 288.34686 446.44394 289.69 444.7871 289.69C443.13025 289.69 441.7871 288.34686 441.7871 286.69C441.7871 285.03314 443.13025 283.69 444.7871 283.69C446.44394 283.69 447.7871 285.03314 447.7871 286.69Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M458.48386 286.76C458.48386 288.41684 457.14072 289.76 455.48386 289.76C453.82703 289.76 452.48386 288.41684 452.48386 286.76C452.48386 285.10315 453.82703 283.76 455.48386 283.76C457.14072 283.76 458.48386 285.10315 458.48386 286.76Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M469.18063 287.25C469.18063 288.90686 467.8375 290.25 466.18063 290.25C464.5238 290.25 463.18063 288.90686 463.18063 287.25C463.18063 285.59314 464.5238 284.25 466.18063 284.25C467.8375 284.25 469.18063 285.59314 469.18063 287.25Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M479.8774 283.82C479.8774 285.47687 478.53427 286.82 476.8774 286.82C475.22055 286.82 473.8774 285.47687 473.8774 283.82C473.8774 282.16315 475.22055 280.82 476.8774 280.82C478.53427 280.82 479.8774 282.16315 479.8774 283.82Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M490.5742 280.18C490.5742 281.83685 489.23105 283.18 487.5742 283.18C485.91733 283.18 484.5742 281.83685 484.5742 280.18C484.5742 278.52313 485.91733 277.18 487.5742 277.18C489.23105 277.18 490.5742 278.52313 490.5742 280.18Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M501.27097 280.11C501.27097 281.76685 499.92783 283.11 498.27097 283.11C496.6141 283.11 495.27097 281.76685 495.27097 280.11C495.27097 278.45316 496.6141 277.11 498.27097 277.11C499.92783 277.11 501.27097 278.45316 501.27097 280.11Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M511.96774 281.44C511.96774 283.09686 510.6246 284.44 508.96774 284.44C507.31088 284.44 505.96774 283.09686 505.96774 281.44C505.96774 279.78314 507.31088 278.44 508.96774 278.44C510.6246 278.44 511.96774 279.78314 511.96774 281.44Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M522.6645 277.03C522.6645 278.68686 521.32135 280.03 519.6645 280.03C518.0077 280.03 516.6645 278.68686 516.6645 277.03C516.6645 275.37314 518.0077 274.03 519.6645 274.03C521.32135 274.03 522.6645 275.37314 522.6645 277.03Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M533.36127 276.75C533.36127 278.40686 532.0181 279.75 530.36127 279.75C528.7044 279.75 527.36127 278.40686 527.36127 276.75C527.36127 275.09314 528.7044 273.75 530.36127 273.75C532.0181 273.75 533.36127 275.09314 533.36127 276.75Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M544.05804 278.43C544.05804 280.08685 542.7149 281.43 541.05804 281.43C539.4012 281.43 538.05804 280.08685 538.05804 278.43C538.05804 276.77313 539.4012 275.43 541.05804 275.43C542.7149 275.43 544.05804 276.77313 544.05804 278.43Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M554.7548 277.87C554.7548 279.52686 553.4117 280.87 551.7548 280.87C550.09796 280.87 548.7548 279.52686 548.7548 277.87C548.7548 276.21313 550.09796 274.87 551.7548 274.87C553.4117 274.87 554.7548 276.21313 554.7548 277.87Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M565.4516 273.6C565.4516 275.25687 564.10846 276.6 562.4516 276.6C560.79474 276.6 559.4516 275.25687 559.4516 273.6C559.4516 271.94315 560.79474 270.6 562.4516 270.6C564.10846 270.6 565.4516 271.94315 565.4516 273.6Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M576.1484 270.87C576.1484 272.52686 574.80524 273.87 573.1484 273.87C571.4915 273.87 570.1484 272.52686 570.1484 270.87C570.1484 269.21313 571.4915 267.87 573.1484 267.87C574.80524 267.87 576.1484 269.21313 576.1484 270.87Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M586.84515 272.62C586.84515 274.27686 585.502 275.62 583.84515 275.62C582.1883 275.62 580.84515 274.27686 580.84515 272.62C580.84515 270.96313 582.1883 269.62 583.84515 269.62C585.502 269.62 586.84515 270.96313 586.84515 272.62Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M597.54193 271.71C597.54193 273.36685 596.1988 274.71 594.54193 274.71C592.8851 274.71 591.54193 273.36685 591.54193 271.71C591.54193 270.05313 592.8851 268.71 594.54193 268.71C596.1988 268.71 597.54193 270.05313 597.54193 271.71Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M608.2387 269.4C608.2387 271.05685 606.89557 272.4 605.2387 272.4C603.58185 272.4 602.2387 271.05685 602.2387 269.4C602.2387 267.74313 603.58185 266.4 605.2387 266.4C606.89557 266.4 608.2387 267.74313 608.2387 269.4Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M618.9355 268.21C618.9355 269.86685 617.59235 271.21 615.9355 271.21C614.2786 271.21 612.9355 269.86685 612.9355 268.21C612.9355 266.55313 614.2786 265.21 615.9355 265.21C617.59235 265.21 618.9355 266.55313 618.9355 268.21Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M629.63226 266.18C629.63226 267.83685 628.2891 269.18 626.63226 269.18C624.9754 269.18 623.63226 267.83685 623.63226 266.18C623.63226 264.52313 624.9754 263.18 626.63226 263.18C628.2891 263.18 629.63226 264.52313 629.63226 266.18Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M640.32904 265.83C640.32904 267.48685 638.9859 268.83 637.32904 268.83C635.6722 268.83 634.32904 267.48685 634.32904 265.83C634.32904 264.17316 635.6722 262.83 637.32904 262.83C638.9859 262.83 640.32904 264.17316 640.32904 265.83Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M651.0258 266.25C651.0258 267.90686 649.6827 269.25 648.0258 269.25C646.36896 269.25 645.0258 267.90686 645.0258 266.25C645.0258 264.59314 646.36896 263.25 648.0258 263.25C649.6827 263.25 651.0258 264.59314 651.0258 266.25Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M661.7226 264.92C661.7226 266.57684 660.37946 267.92 658.7226 267.92C657.06573 267.92 655.7226 266.57684 655.7226 264.92C655.7226 263.26315 657.06573 261.92 658.7226 261.92C660.37946 261.92 661.7226 263.26315 661.7226 264.92Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M672.4194 263.24C672.4194 264.89685 671.07623 266.24 669.4194 266.24C667.7625 266.24 666.4194 264.89685 666.4194 263.24C666.4194 261.58316 667.7625 260.24 669.4194 260.24C671.07623 260.24 672.4194 261.58316 672.4194 263.24Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M683.11615 261.7C683.11615 263.35684 681.773 264.7 680.11615 264.7C678.4593 264.7 677.11615 263.35684 677.11615 261.7C677.11615 260.04315 678.4593 258.7 680.11615 258.7C681.773 258.7 683.11615 260.04315 683.11615 261.7Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M693.8129 259.88C693.8129 261.53687 692.4698 262.88 690.8129 262.88C689.15607 262.88 687.8129 261.53687 687.8129 259.88C687.8129 258.22314 689.15607 256.88 690.8129 256.88C692.4698 256.88 693.8129 258.22314 693.8129 259.88Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M704.5097 255.54C704.5097 257.19687 703.1665 258.54 701.5097 258.54C699.85284 258.54 698.5097 257.19687 698.5097 255.54C698.5097 253.88315 699.85284 252.54 701.5097 252.54C703.1665 252.54 704.5097 253.88315 704.5097 255.54Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M715.2065 256.59C715.2065 258.24686 713.8633 259.59 712.2065 259.59C710.5496 259.59 709.2065 258.24686 709.2065 256.59C709.2065 254.93315 710.5496 253.59 712.2065 253.59C713.8633 253.59 715.2065 254.93315 715.2065 256.59Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M725.9032 251.27C725.9032 252.92685 724.56006 254.27 722.9032 254.27C721.2464 254.27 719.9032 252.92685 719.9032 251.27C719.9032 249.61314 721.2464 248.27 722.9032 248.27C724.56006 248.27 725.9032 249.61314 725.9032 251.27Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M736.6 247.98C736.6 249.63686 735.25684 250.98 733.6 250.98C731.9431 250.98 730.6 249.63686 730.6 247.98C730.6 246.32315 731.9431 244.98 733.6 244.98C735.25684 244.98 736.6 246.32315 736.6 247.98Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M73.4 315.95C73.4 317.60684 72.056854 318.95 70.4 318.95C68.74315 318.95 67.4 317.60684 67.4 315.95C67.4 314.29315 68.74315 312.95 70.4 312.95C72.056854 312.95 73.4 314.29315 73.4 315.95Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M84.09677 319.1C84.09677 320.75687 82.75363 322.1 81.09677 322.1C79.43992 322.1 78.09677 320.75687 78.09677 319.1C78.09677 317.44315 79.43992 316.1 81.09677 316.1C82.75363 316.1 84.09677 317.44315 84.09677 319.1Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M94.79355 322.32C94.79355 323.97687 93.4504 325.32 91.79355 325.32C90.136696 325.32 88.79355 323.97687 88.79355 322.32C88.79355 320.66315 90.136696 319.32 91.79355 319.32C93.4504 319.32 94.79355 320.66315 94.79355 322.32Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M105.490326 323.16C105.490326 324.81686 104.14718 326.16 102.490326 326.16C100.833466 326.16 99.490326 324.81686 99.490326 323.16C99.490326 321.50314 100.833466 320.16 102.490326 320.16C104.14718 320.16 105.490326 321.50314 105.490326 323.16Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M116.187096 322.32C116.187096 323.97687 114.84395 325.32 113.187096 325.32C111.53024 325.32 110.187096 323.97687 110.187096 322.32C110.187096 320.66315 111.53024 319.32 113.187096 319.32C114.84395 319.32 116.187096 320.66315 116.187096 322.32Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M126.88387 323.86C126.88387 325.51685 125.540726 326.86 123.88387 326.86C122.22702 326.86 120.88387 325.51685 120.88387 323.86C120.88387 322.20316 122.22702 320.86 123.88387 320.86C125.540726 320.86 126.88387 322.20316 126.88387 323.86Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M137.58064 323.51C137.58064 325.16684 136.2375 326.51 134.58064 326.51C132.9238 326.51 131.58064 325.16684 131.58064 323.51C131.58064 321.85315 132.9238 320.51 134.58064 320.51C136.2375 320.51 137.58064 321.85315 137.58064 323.51Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M148.27742 324.21C148.27742 325.86685 146.93428 327.21 145.27742 327.21C143.62056 327.21 142.27742 325.86685 142.27742 324.21C142.27742 322.55313 143.62056 321.21 145.27742 321.21C146.93428 321.21 148.27742 322.55313 148.27742 324.21Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M158.9742 322.53C158.9742 324.18686 157.63104 325.53 155.9742 325.53C154.31734 325.53 152.9742 324.18686 152.9742 322.53C152.9742 320.87314 154.31734 319.53 155.9742 319.53C157.63104 319.53 158.9742 320.87314 158.9742 322.53Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M169.67097 321.62C169.67097 323.27686 168.32782 324.62 166.67097 324.62C165.01411 324.62 163.67097 323.27686 163.67097 321.62C163.67097 319.96313 165.01411 318.62 166.67097 318.62C168.32782 318.62 169.67097 319.96313 169.67097 321.62Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M180.36774 322.46C180.36774 324.11685 179.0246 325.46 177.36774 325.46C175.71089 325.46 174.36774 324.11685 174.36774 322.46C174.36774 320.80313 175.71089 319.46 177.36774 319.46C179.0246 319.46 180.36774 320.80313 180.36774 322.46Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M191.06451 321.55C191.06451 323.20685 189.72137 324.55 188.06451 324.55C186.40767 324.55 185.06451 323.20685 185.06451 321.55C185.06451 319.89316 186.40767 318.55 188.06451 318.55C189.72137 318.55 191.06451 319.89316 191.06451 321.55Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M201.76129 320.15C201.76129 321.80685 200.41815 323.15 198.76129 323.15C197.10443 323.15 195.76129 321.80685 195.76129 320.15C195.76129 318.49313 197.10443 317.15 198.76129 317.15C200.41815 317.15 201.76129 318.49313 201.76129 320.15Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M212.45807 320.5C212.45807 322.15686 211.11491 323.5 209.45807 323.5C207.80121 323.5 206.45807 322.15686 206.45807 320.5C206.45807 318.84314 207.80121 317.5 209.45807 317.5C211.11491 317.5 212.45807 318.84314 212.45807 320.5Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M223.15485 320.64C223.15485 322.29684 221.81169 323.64 220.15485 323.64C218.49799 323.64 217.15485 322.29684 217.15485 320.64C217.15485 318.98315 218.49799 317.64 220.15485 317.64C221.81169 317.64 223.15485 318.98315 223.15485 320.64Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M233.85161 319.24C233.85161 320.89685 232.50847 322.24 230.85161 322.24C229.19476 322.24 227.85161 320.89685 227.85161 319.24C227.85161 317.58316 229.19476 316.24 230.85161 316.24C232.50847 316.24 233.85161 317.58316 233.85161 319.24Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M244.54839 317.28C244.54839 318.93686 243.20525 320.28 241.54839 320.28C239.89153 320.28 238.54839 318.93686 238.54839 317.28C238.54839 315.62314 239.89153 314.28 241.54839 314.28C243.20525 314.28 244.54839 315.62314 244.54839 317.28Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M255.24516 316.72C255.24516 318.37686 253.90201 319.72 252.24516 319.72C250.5883 319.72 249.24516 318.37686 249.24516 316.72C249.24516 315.06314 250.5883 313.72 252.24516 313.72C253.90201 313.72 255.24516 315.06314 255.24516 316.72Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M265.94193 316.23C265.94193 317.88684 264.5988 319.23 262.94193 319.23C261.2851 319.23 259.94193 317.88684 259.94193 316.23C259.94193 314.57315 261.2851 313.23 262.94193 313.23C264.5988 313.23 265.94193 314.57315 265.94193 316.23Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M276.6387 315.11C276.6387 316.76685 275.29556 318.11 273.6387 318.11C271.98184 318.11 270.6387 316.76685 270.6387 315.11C270.6387 313.45316 271.98184 312.11 273.6387 312.11C275.29556 312.11 276.6387 313.45316 276.6387 315.11Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M287.33548 314.34C287.33548 315.99686 285.99234 317.34 284.33548 317.34C282.67862 317.34 281.33548 315.99686 281.33548 314.34C281.33548 312.68314 282.67862 311.34 284.33548 311.34C285.99234 311.34 287.33548 312.68314 287.33548 314.34Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M298.03226 311.96C298.03226 313.61685 296.68912 314.96 295.03226 314.96C293.3754 314.96 292.03226 313.61685 292.03226 311.96C292.03226 310.30313 293.3754 308.96 295.03226 308.96C296.68912 308.96 298.03226 310.30313 298.03226 311.96Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M308.72903 312.31C308.72903 313.96686 307.3859 315.31 305.72903 315.31C304.07217 315.31 302.72903 313.96686 302.72903 312.31C302.72903 310.65314 304.07217 309.31 305.72903 309.31C307.3859 309.31 308.72903 310.65314 308.72903 312.31Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M319.4258 311.19C319.4258 312.84686 318.08267 314.19 316.4258 314.19C314.76895 314.19 313.4258 312.84686 313.4258 311.19C313.4258 309.53314 314.76895 308.19 316.4258 308.19C318.08267 308.19 319.4258 309.53314 319.4258 311.19Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M330.1226 307.13C330.1226 308.78687 328.77945 310.13 327.1226 310.13C325.46573 310.13 324.1226 308.78687 324.1226 307.13C324.1226 305.47314 325.46573 304.13 327.1226 304.13C328.77945 304.13 330.1226 305.47314 330.1226 307.13Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M340.81937 305.52C340.81937 307.17685 339.4762 308.52 337.81937 308.52C336.1625 308.52 334.81937 307.17685 334.81937 305.52C334.81937 303.86316 336.1625 302.52 337.81937 302.52C339.4762 302.52 340.81937 303.86316 340.81937 305.52Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M351.51614 304.54C351.51614 306.19687 350.17297 307.54 348.51614 307.54C346.85928 307.54 345.51614 306.19687 345.51614 304.54C345.51614 302.88315 346.85928 301.54 348.51614 301.54C350.17297 301.54 351.51614 302.88315 351.51614 304.54Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M362.2129 304.47C362.2129 306.12686 360.86975 307.47 359.2129 307.47C357.55606 307.47 356.2129 306.12686 356.2129 304.47C356.2129 302.81314 357.55606 301.47 359.2129 301.47C360.86975 301.47 362.2129 302.81314 362.2129 304.47Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M372.90967 303.28C372.90967 304.93686 371.56653 306.28 369.90967 306.28C368.25284 306.28 366.90967 304.93686 366.90967 303.28C366.90967 301.62314 368.25284 300.28 369.90967 300.28C371.56653 300.28 372.90967 301.62314 372.90967 303.28Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M383.60645 302.44C383.60645 304.09686 382.2633 305.44 380.60645 305.44C378.9496 305.44 377.60645 304.09686 377.60645 302.44C377.60645 300.78314 378.9496 299.44 380.60645 299.44C382.2633 299.44 383.60645 300.78314 383.60645 302.44Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M394.30322 301.39C394.30322 303.04684 392.96008 304.39 391.30322 304.39C389.64636 304.39 388.30322 303.04684 388.30322 301.39C388.30322 299.73315 389.64636 298.39 391.30322 298.39C392.96008 298.39 394.30322 299.73315 394.30322 301.39Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M405.0 300.06C405.0 301.71686 403.65686 303.06 402.0 303.06C400.34314 303.06 399.0 301.71686 399.0 300.06C399.0 298.40314 400.34314 297.06 402.0 297.06C403.65686 297.06 405.0 298.40314 405.0 300.06Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M415.69678 298.38C415.69678 300.03687 414.35364 301.38 412.69678 301.38C411.03992 301.38 409.69678 300.03687 409.69678 298.38C409.69678 296.72314 411.03992 295.38 412.69678 295.38C414.35364 295.38 415.69678 296.72314 415.69678 298.38Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M426.39355 297.68C426.39355 299.33685 425.0504 300.68 423.39355 300.68C421.7367 300.68 420.39355 299.33685 420.39355 297.68C420.39355 296.02313 421.7367 294.68 423.39355 294.68C425.0504 294.68 426.39355 296.02313 426.39355 297.68Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M437.09033 297.4C437.09033 299.05685 435.74716 300.4 434.09033 300.4C432.43347 300.4 431.09033 299.05685 431.09033 297.4C431.09033 295.74313 432.43347 294.4 434.09033 294.4C435.74716 294.4 437.09033 295.74313 437.09033 297.4Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M447.7871 295.23C447.7871 296.88684 446.44394 298.23 444.7871 298.23C443.13025 298.23 441.7871 296.88684 441.7871 295.23C441.7871 293.57315 443.13025 292.23 444.7871 292.23C446.44394 292.23 447.7871 293.57315 447.7871 295.23Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M458.48386 294.67C458.48386 296.32684 457.14072 297.67 455.48386 297.67C453.82703 297.67 452.48386 296.32684 452.48386 294.67C452.48386 293.01315 453.82703 291.67 455.48386 291.67C457.14072 291.67 458.48386 293.01315 458.48386 294.67Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M469.18063 289.42C469.18063 291.07684 467.8375 292.42 466.18063 292.42C464.5238 292.42 463.18063 291.07684 463.18063 289.42C463.18063 287.76315 464.5238 286.42 466.18063 286.42C467.8375 286.42 469.18063 287.76315 469.18063 289.42Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M479.8774 291.38C479.8774 293.03687 478.53427 294.38 476.8774 294.38C475.22055 294.38 473.8774 293.03687 473.8774 291.38C473.8774 289.72314 475.22055 288.38 476.8774 288.38C478.53427 288.38 479.8774 289.72314 479.8774 291.38Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M490.5742 290.68C490.5742 292.33685 489.23105 293.68 487.5742 293.68C485.91733 293.68 484.5742 292.33685 484.5742 290.68C484.5742 289.02313 485.91733 287.68 487.5742 287.68C489.23105 287.68 490.5742 289.02313 490.5742 290.68Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M501.27097 288.72C501.27097 290.37686 499.92783 291.72 498.27097 291.72C496.6141 291.72 495.27097 290.37686 495.27097 288.72C495.27097 287.06314 496.6141 285.72 498.27097 285.72C499.92783 285.72 501.27097 287.06314 501.27097 288.72Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M511.96774 285.99C511.96774 287.64685 510.6246 288.99 508.96774 288.99C507.31088 288.99 505.96774 287.64685 505.96774 285.99C505.96774 284.33316 507.31088 282.99 508.96774 282.99C510.6246 282.99 511.96774 284.33316 511.96774 285.99Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M522.6645 287.67C522.6645 289.32684 521.32135 290.67 519.6645 290.67C518.0077 290.67 516.6645 289.32684 516.6645 287.67C516.6645 286.01315 518.0077 284.67 519.6645 284.67C521.32135 284.67 522.6645 286.01315 522.6645 287.67Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M533.36127 286.34C533.36127 287.99686 532.0181 289.34 530.36127 289.34C528.7044 289.34 527.36127 287.99686 527.36127 286.34C527.36127 284.68314 528.7044 283.34 530.36127 283.34C532.0181 283.34 533.36127 284.68314 533.36127 286.34Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M544.05804 284.87C544.05804 286.52686 542.7149 287.87 541.05804 287.87C539.4012 287.87 538.05804 286.52686 538.05804 284.87C538.05804 283.21313 539.4012 281.87 541.05804 281.87C542.7149 281.87 544.05804 283.21313 544.05804 284.87Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M554.7548 282.98C554.7548 284.63684 553.4117 285.98 551.7548 285.98C550.09796 285.98 548.7548 284.63684 548.7548 282.98C548.7548 281.32315 550.09796 279.98 551.7548 279.98C553.4117 279.98 554.7548 281.32315 554.7548 282.98Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M565.4516 282.84C565.4516 284.49686 564.10846 285.84 562.4516 285.84C560.79474 285.84 559.4516 284.49686 559.4516 282.84C559.4516 281.18314 560.79474 279.84 562.4516 279.84C564.10846 279.84 565.4516 281.18314 565.4516 282.84Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M576.1484 280.81C576.1484 282.46686 574.80524 283.81 573.1484 283.81C571.4915 283.81 570.1484 282.46686 570.1484 280.81C570.1484 279.15314 571.4915 277.81 573.1484 277.81C574.80524 277.81 576.1484 279.15314 576.1484 280.81Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M586.84515 280.25C586.84515 281.90686 585.502 283.25 583.84515 283.25C582.1883 283.25 580.84515 281.90686 580.84515 280.25C580.84515 278.59314 582.1883 277.25 583.84515 277.25C585.502 277.25 586.84515 278.59314 586.84515 280.25Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M597.54193 278.43C597.54193 280.08685 596.1988 281.43 594.54193 281.43C592.8851 281.43 591.54193 280.08685 591.54193 278.43C591.54193 276.77313 592.8851 275.43 594.54193 275.43C596.1988 275.43 597.54193 276.77313 597.54193 278.43Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M608.2387 276.47C608.2387 278.12686 606.89557 279.47 605.2387 279.47C603.58185 279.47 602.2387 278.12686 602.2387 276.47C602.2387 274.81314 603.58185 273.47 605.2387 273.47C606.89557 273.47 608.2387 274.81314 608.2387 276.47Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M618.9355 276.12C618.9355 277.77686 617.59235 279.12 615.9355 279.12C614.2786 279.12 612.9355 277.77686 612.9355 276.12C612.9355 274.46313 614.2786 273.12 615.9355 273.12C617.59235 273.12 618.9355 274.46313 618.9355 276.12Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M629.63226 276.05C629.63226 277.70685 628.2891 279.05 626.63226 279.05C624.9754 279.05 623.63226 277.70685 623.63226 276.05C623.63226 274.39316 624.9754 273.05 626.63226 273.05C628.2891 273.05 629.63226 274.39316 629.63226 276.05Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M640.32904 274.58C640.32904 276.23685 638.9859 277.58 637.32904 277.58C635.6722 277.58 634.32904 276.23685 634.32904 274.58C634.32904 272.92316 635.6722 271.58 637.32904 271.58C638.9859 271.58 640.32904 272.92316 640.32904 274.58Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M651.0258 271.29C651.0258 272.94687 649.6827 274.29 648.0258 274.29C646.36896 274.29 645.0258 272.94687 645.0258 271.29C645.0258 269.63315 646.36896 268.29 648.0258 268.29C649.6827 268.29 651.0258 269.63315 651.0258 271.29Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M661.7226 271.99C661.7226 273.64685 660.37946 274.99 658.7226 274.99C657.06573 274.99 655.7226 273.64685 655.7226 271.99C655.7226 270.33316 657.06573 268.99 658.7226 268.99C660.37946 268.99 661.7226 270.33316 661.7226 271.99Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M672.4194 270.8C672.4194 272.45685 671.07623 273.8 669.4194 273.8C667.7625 273.8 666.4194 272.45685 666.4194 270.8C666.4194 269.14316 667.7625 267.8 669.4194 267.8C671.07623 267.8 672.4194 269.14316 672.4194 270.8Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M683.11615 268.91C683.11615 270.56686 681.773 271.91 680.11615 271.91C678.4593 271.91 677.11615 270.56686 677.11615 268.91C677.11615 267.25314 678.4593 265.91 680.11615 265.91C681.773 265.91 683.11615 267.25314 683.11615 268.91Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M693.8129 268.21C693.8129 269.86685 692.4698 271.21 690.8129 271.21C689.15607 271.21 687.8129 269.86685 687.8129 268.21C687.8129 266.55313 689.15607 265.21 690.8129 265.21C692.4698 265.21 693.8129 266.55313 693.8129 268.21Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M704.5097 266.11C704.5097 267.76685 703.1665 269.11 701.5097 269.11C699.85284 269.11 698.5097 267.76685 698.5097 266.11C698.5097 264.45316 699.85284 263.11 701.5097 263.11C703.1665 263.11 704.5097 264.45316 704.5097 266.11Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M715.2065 265.62C715.2065 267.27686 713.8633 268.62 712.2065 268.62C710.5496 268.62 709.2065 267.27686 709.2065 265.62C709.2065 263.96313 710.5496 262.62 712.2065 262.62C713.8633 262.62 715.2065 263.96313 715.2065 265.62Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M725.9032 262.75C725.9032 264.40686 724.56006 265.75 722.9032 265.75C721.2464 265.75 719.9032 264.40686 719.9032 262.75C719.9032 261.09314 721.2464 259.75 722.9032 259.75C724.56006 259.75 725.9032 261.09314 725.9032 262.75Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M736.6 261.91C736.6 263.56686 735.25684 264.91 733.6 264.91C731.9431 264.91 730.6 263.56686 730.6 261.91C730.6 260.25314 731.9431 258.91 733.6 258.91C735.25684 258.91 736.6 260.25314 736.6 261.91Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M73.4 358.86C73.4 360.51685 72.056854 361.86 70.4 361.86C68.74315 361.86 67.4 360.51685 67.4 358.86C67.4 357.20316 68.74315 355.86 70.4 355.86C72.056854 355.86 73.4 357.20316 73.4 358.86Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M84.09677 356.27C84.09677 357.92685 82.75363 359.27 81.09677 359.27C79.43992 359.27 78.09677 357.92685 78.09677 356.27C78.09677 354.61316 79.43992 353.27 81.09677 353.27C82.75363 353.27 84.09677 354.61316 84.09677 356.27Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M94.79355 355.92C94.79355 357.57684 93.4504 358.92 91.79355 358.92C90.136696 358.92 88.79355 357.57684 88.79355 355.92C88.79355 354.26315 90.136696 352.92 91.79355 352.92C93.4504 352.92 94.79355 354.26315 94.79355 355.92Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M105.490326 353.68C105.490326 355.33685 104.14718 356.68 102.490326 356.68C100.833466 356.68 99.490326 355.33685 99.490326 353.68C99.490326 352.02313 100.833466 350.68 102.490326 350.68C104.14718 350.68 105.490326 352.02313 105.490326 353.68Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M116.187096 352.14C116.187096 353.79684 114.84395 355.14 113.187096 355.14C111.53024 355.14 110.187096 353.79684 110.187096 352.14C110.187096 350.48315 111.53024 349.14 113.187096 349.14C114.84395 349.14 116.187096 350.48315 116.187096 352.14Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M126.88387 350.11C126.88387 351.76685 125.540726 353.11 123.88387 353.11C122.22702 353.11 120.88387 351.76685 120.88387 350.11C120.88387 348.45316 122.22702 347.11 123.88387 347.11C125.540726 347.11 126.88387 348.45316 126.88387 350.11Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M137.58064 350.04C137.58064 351.69687 136.2375 353.04 134.58064 353.04C132.9238 353.04 131.58064 351.69687 131.58064 350.04C131.58064 348.38315 132.9238 347.04 134.58064 347.04C136.2375 347.04 137.58064 348.38315 137.58064 350.04Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M148.27742 348.92C148.27742 350.57684 146.93428 351.92 145.27742 351.92C143.62056 351.92 142.27742 350.57684 142.27742 348.92C142.27742 347.26315 143.62056 345.92 145.27742 345.92C146.93428 345.92 148.27742 347.26315 148.27742 348.92Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M158.9742 345.91C158.9742 347.56686 157.63104 348.91 155.9742 348.91C154.31734 348.91 152.9742 347.56686 152.9742 345.91C152.9742 344.25314 154.31734 342.91 155.9742 342.91C157.63104 342.91 158.9742 344.25314 158.9742 345.91Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M169.67097 344.3C169.67097 345.95685 168.32782 347.3 166.67097 347.3C165.01411 347.3 163.67097 345.95685 163.67097 344.3C163.67097 342.64316 165.01411 341.3 166.67097 341.3C168.32782 341.3 169.67097 342.64316 169.67097 344.3Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M180.36774 344.51C180.36774 346.16684 179.0246 347.51 177.36774 347.51C175.71089 347.51 174.36774 346.16684 174.36774 344.51C174.36774 342.85315 175.71089 341.51 177.36774 341.51C179.0246 341.51 180.36774 342.85315 180.36774 344.51Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M191.06451 342.41C191.06451 344.06686 189.72137 345.41 188.06451 345.41C186.40767 345.41 185.06451 344.06686 185.06451 342.41C185.06451 340.75314 186.40767 339.41 188.06451 339.41C189.72137 339.41 191.06451 340.75314 191.06451 342.41Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M201.76129 343.04C201.76129 344.69687 200.41815 346.04 198.76129 346.04C197.10443 346.04 195.76129 344.69687 195.76129 343.04C195.76129 341.38315 197.10443 340.04 198.76129 340.04C200.41815 340.04 201.76129 341.38315 201.76129 343.04Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M212.45807 340.03C212.45807 341.68686 211.11491 343.03 209.45807 343.03C207.80121 343.03 206.45807 341.68686 206.45807 340.03C206.45807 338.37314 207.80121 337.03 209.45807 337.03C211.11491 337.03 212.45807 338.37314 212.45807 340.03Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M223.15485 338.84C223.15485 340.49686 221.81169 341.84 220.15485 341.84C218.49799 341.84 217.15485 340.49686 217.15485 338.84C217.15485 337.18314 218.49799 335.84 220.15485 335.84C221.81169 335.84 223.15485 337.18314 223.15485 338.84Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M233.85161 337.44C233.85161 339.09686 232.50847 340.44 230.85161 340.44C229.19476 340.44 227.85161 339.09686 227.85161 337.44C227.85161 335.78314 229.19476 334.44 230.85161 334.44C232.50847 334.44 233.85161 335.78314 233.85161 337.44Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M244.54839 338.28C244.54839 339.93686 243.20525 341.28 241.54839 341.28C239.89153 341.28 238.54839 339.93686 238.54839 338.28C238.54839 336.62314 239.89153 335.28 241.54839 335.28C243.20525 335.28 244.54839 336.62314 244.54839 338.28Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M255.24516 336.6C255.24516 338.25687 253.90201 339.6 252.24516 339.6C250.5883 339.6 249.24516 338.25687 249.24516 336.6C249.24516 334.94315 250.5883 333.6 252.24516 333.6C253.90201 333.6 255.24516 334.94315 255.24516 336.6Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M265.94193 336.39C265.94193 338.04684 264.5988 339.39 262.94193 339.39C261.2851 339.39 259.94193 338.04684 259.94193 336.39C259.94193 334.73315 261.2851 333.39 262.94193 333.39C264.5988 333.39 265.94193 334.73315 265.94193 336.39Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M276.6387 334.64C276.6387 336.29684 275.29556 337.64 273.6387 337.64C271.98184 337.64 270.6387 336.29684 270.6387 334.64C270.6387 332.98315 271.98184 331.64 273.6387 331.64C275.29556 331.64 276.6387 332.98315 276.6387 334.64Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M287.33548 331.49C287.33548 333.14685 285.99234 334.49 284.33548 334.49C282.67862 334.49 281.33548 333.14685 281.33548 331.49C281.33548 329.83316 282.67862 328.49 284.33548 328.49C285.99234 328.49 287.33548 329.83316 287.33548 331.49Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M298.03226 329.53C298.03226 331.18686 296.68912 332.53 295.03226 332.53C293.3754 332.53 292.03226 331.18686 292.03226 329.53C292.03226 327.87314 293.3754 326.53 295.03226 326.53C296.68912 326.53 298.03226 327.87314 298.03226 329.53Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M308.72903 330.65C308.72903 332.30685 307.3859 333.65 305.72903 333.65C304.07217 333.65 302.72903 332.30685 302.72903 330.65C302.72903 328.99313 304.07217 327.65 305.72903 327.65C307.3859 327.65 308.72903 328.99313 308.72903 330.65Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M319.4258 327.92C319.4258 329.57684 318.08267 330.92 316.4258 330.92C314.76895 330.92 313.4258 329.57684 313.4258 327.92C313.4258 326.26315 314.76895 324.92 316.4258 324.92C318.08267 324.92 319.4258 326.26315 319.4258 327.92Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M330.1226 325.4C330.1226 327.05685 328.77945 328.4 327.1226 328.4C325.46573 328.4 324.1226 327.05685 324.1226 325.4C324.1226 323.74313 325.46573 322.4 327.1226 322.4C328.77945 322.4 330.1226 323.74313 330.1226 325.4Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M340.81937 321.48C340.81937 323.13684 339.4762 324.48 337.81937 324.48C336.1625 324.48 334.81937 323.13684 334.81937 321.48C334.81937 319.82315 336.1625 318.48 337.81937 318.48C339.4762 318.48 340.81937 319.82315 340.81937 321.48Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M351.51614 322.25C351.51614 323.90686 350.17297 325.25 348.51614 325.25C346.85928 325.25 345.51614 323.90686 345.51614 322.25C345.51614 320.59314 346.85928 319.25 348.51614 319.25C350.17297 319.25 351.51614 320.59314 351.51614 322.25Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M362.2129 321.06C362.2129 322.71686 360.86975 324.06 359.2129 324.06C357.55606 324.06 356.2129 322.71686 356.2129 321.06C356.2129 319.40314 357.55606 318.06 359.2129 318.06C360.86975 318.06 362.2129 319.40314 362.2129 321.06Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M372.90967 318.19C372.90967 319.84686 371.56653 321.19 369.90967 321.19C368.25284 321.19 366.90967 319.84686 366.90967 318.19C366.90967 316.53314 368.25284 315.19 369.90967 315.19C371.56653 315.19 372.90967 316.53314 372.90967 318.19Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M383.60645 316.3C383.60645 317.95685 382.2633 319.3 380.60645 319.3C378.9496 319.3 377.60645 317.95685 377.60645 316.3C377.60645 314.64316 378.9496 313.3 380.60645 313.3C382.2633 313.3 383.60645 314.64316 383.60645 316.3Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M394.30322 314.2C394.30322 315.85684 392.96008 317.2 391.30322 317.2C389.64636 317.2 388.30322 315.85684 388.30322 314.2C388.30322 312.54315 389.64636 311.2 391.30322 311.2C392.96008 311.2 394.30322 312.54315 394.30322 314.2Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M405.0 315.6C405.0 317.25687 403.65686 318.6 402.0 318.6C400.34314 318.6 399.0 317.25687 399.0 315.6C399.0 313.94315 400.34314 312.6 402.0 312.6C403.65686 312.6 405.0 313.94315 405.0 315.6Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M415.69678 314.97C415.69678 316.62686 414.35364 317.97 412.69678 317.97C411.03992 317.97 409.69678 316.62686 409.69678 314.97C409.69678 313.31314 411.03992 311.97 412.69678 311.97C414.35364 311.97 415.69678 313.31314 415.69678 314.97Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M426.39355 314.83C426.39355 316.48685 425.0504 317.83 423.39355 317.83C421.7367 317.83 420.39355 316.48685 420.39355 314.83C420.39355 313.17316 421.7367 311.83 423.39355 311.83C425.0504 311.83 426.39355 313.17316 426.39355 314.83Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M437.09033 313.92C437.09033 315.57684 435.74716 316.92 434.09033 316.92C432.43347 316.92 431.09033 315.57684 431.09033 313.92C431.09033 312.26315 432.43347 310.92 434.09033 310.92C435.74716 310.92 437.09033 312.26315 437.09033 313.92Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M447.7871 312.94C447.7871 314.59686 446.44394 315.94 444.7871 315.94C443.13025 315.94 441.7871 314.59686 441.7871 312.94C441.7871 311.28314 443.13025 309.94 444.7871 309.94C446.44394 309.94 447.7871 311.28314 447.7871 312.94Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M458.48386 310.63C458.48386 312.28687 457.14072 313.63 455.48386 313.63C453.82703 313.63 452.48386 312.28687 452.48386 310.63C452.48386 308.97314 453.82703 307.63 455.48386 307.63C457.14072 307.63 458.48386 308.97314 458.48386 310.63Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M469.18063 309.93C469.18063 311.58685 467.8375 312.93 466.18063 312.93C464.5238 312.93 463.18063 311.58685 463.18063 309.93C463.18063 308.27313 464.5238 306.93 466.18063 306.93C467.8375 306.93 469.18063 308.27313 469.18063 309.93Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M479.8774 308.67C479.8774 310.32684 478.53427 311.67 476.8774 311.67C475.22055 311.67 473.8774 310.32684 473.8774 308.67C473.8774 307.01315 475.22055 305.67 476.8774 305.67C478.53427 305.67 479.8774 307.01315 479.8774 308.67Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M490.5742 307.34C490.5742 308.99686 489.23105 310.34 487.5742 310.34C485.91733 310.34 484.5742 308.99686 484.5742 307.34C484.5742 305.68314 485.91733 304.34 487.5742 304.34C489.23105 304.34 490.5742 305.68314 490.5742 307.34Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M501.27097 306.36C501.27097 308.01685 499.92783 309.36 498.27097 309.36C496.6141 309.36 495.27097 308.01685 495.27097 306.36C495.27097 304.70316 496.6141 303.36 498.27097 303.36C499.92783 303.36 501.27097 304.70316 501.27097 306.36Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M511.96774 304.68C511.96774 306.33685 510.6246 307.68 508.96774 307.68C507.31088 307.68 505.96774 306.33685 505.96774 304.68C505.96774 303.02313 507.31088 301.68 508.96774 301.68C510.6246 301.68 511.96774 303.02313 511.96774 304.68Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M522.6645 303.77C522.6645 305.42685 521.32135 306.77 519.6645 306.77C518.0077 306.77 516.6645 305.42685 516.6645 303.77C516.6645 302.11316 518.0077 300.77 519.6645 300.77C521.32135 300.77 522.6645 302.11316 522.6645 303.77Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M533.36127 302.58C533.36127 304.23685 532.0181 305.58 530.36127 305.58C528.7044 305.58 527.36127 304.23685 527.36127 302.58C527.36127 300.92316 528.7044 299.58 530.36127 299.58C532.0181 299.58 533.36127 300.92316 533.36127 302.58Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M544.05804 300.76C544.05804 302.41684 542.7149 303.76 541.05804 303.76C539.4012 303.76 538.05804 302.41684 538.05804 300.76C538.05804 299.10315 539.4012 297.76 541.05804 297.76C542.7149 297.76 544.05804 299.10315 544.05804 300.76Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M554.7548 299.99C554.7548 301.64685 553.4117 302.99 551.7548 302.99C550.09796 302.99 548.7548 301.64685 548.7548 299.99C548.7548 298.33316 550.09796 296.99 551.7548 296.99C553.4117 296.99 554.7548 298.33316 554.7548 299.99Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M565.4516 298.8C565.4516 300.45685 564.10846 301.8 562.4516 301.8C560.79474 301.8 559.4516 300.45685 559.4516 298.8C559.4516 297.14316 560.79474 295.8 562.4516 295.8C564.10846 295.8 565.4516 297.14316 565.4516 298.8Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M576.1484 298.66C576.1484 300.31686 574.80524 301.66 573.1484 301.66C571.4915 301.66 570.1484 300.31686 570.1484 298.66C570.1484 297.00314 571.4915 295.66 573.1484 295.66C574.80524 295.66 576.1484 297.00314 576.1484 298.66Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M586.84515 296.7C586.84515 298.35684 585.502 299.7 583.84515 299.7C582.1883 299.7 580.84515 298.35684 580.84515 296.7C580.84515 295.04315 582.1883 293.7 583.84515 293.7C585.502 293.7 586.84515 295.04315 586.84515 296.7Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M597.54193 295.3C597.54193 296.95685 596.1988 298.3 594.54193 298.3C592.8851 298.3 591.54193 296.95685 591.54193 295.3C591.54193 293.64316 592.8851 292.3 594.54193 292.3C596.1988 292.3 597.54193 293.64316 597.54193 295.3Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M608.2387 294.25C608.2387 295.90686 606.89557 297.25 605.2387 297.25C603.58185 297.25 602.2387 295.90686 602.2387 294.25C602.2387 292.59314 603.58185 291.25 605.2387 291.25C606.89557 291.25 608.2387 292.59314 608.2387 294.25Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M618.9355 292.99C618.9355 294.64685 617.59235 295.99 615.9355 295.99C614.2786 295.99 612.9355 294.64685 612.9355 292.99C612.9355 291.33316 614.2786 289.99 615.9355 289.99C617.59235 289.99 618.9355 291.33316 618.9355 292.99Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M629.63226 291.8C629.63226 293.45685 628.2891 294.8 626.63226 294.8C624.9754 294.8 623.63226 293.45685 623.63226 291.8C623.63226 290.14316 624.9754 288.8 626.63226 288.8C628.2891 288.8 629.63226 290.14316 629.63226 291.8Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M640.32904 289.63C640.32904 291.28687 638.9859 292.63 637.32904 292.63C635.6722 292.63 634.32904 291.28687 634.32904 289.63C634.32904 287.97314 635.6722 286.63 637.32904 286.63C638.9859 286.63 640.32904 287.97314 640.32904 289.63Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M651.0258 289.14C651.0258 290.79684 649.6827 292.14 648.0258 292.14C646.36896 292.14 645.0258 290.79684 645.0258 289.14C645.0258 287.48315 646.36896 286.14 648.0258 286.14C649.6827 286.14 651.0258 287.48315 651.0258 289.14Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M661.7226 288.09C661.7226 289.74686 660.37946 291.09 658.7226 291.09C657.06573 291.09 655.7226 289.74686 655.7226 288.09C655.7226 286.43314 657.06573 285.09 658.7226 285.09C660.37946 285.09 661.7226 286.43314 661.7226 288.09Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M672.4194 286.9C672.4194 288.55685 671.07623 289.9 669.4194 289.9C667.7625 289.9 666.4194 288.55685 666.4194 286.9C666.4194 285.24313 667.7625 283.9 669.4194 283.9C671.07623 283.9 672.4194 285.24313 672.4194 286.9Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M683.11615 284.66C683.11615 286.31686 681.773 287.66 680.11615 287.66C678.4593 287.66 677.11615 286.31686 677.11615 284.66C677.11615 283.00314 678.4593 281.66 680.11615 281.66C681.773 281.66 683.11615 283.00314 683.11615 284.66Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M693.8129 284.66C693.8129 286.31686 692.4698 287.66 690.8129 287.66C689.15607 287.66 687.8129 286.31686 687.8129 284.66C687.8129 283.00314 689.15607 281.66 690.8129 281.66C692.4698 281.66 693.8129 283.00314 693.8129 284.66Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M704.5097 284.1C704.5097 285.75687 703.1665 287.1 701.5097 287.1C699.85284 287.1 698.5097 285.75687 698.5097 284.1C698.5097 282.44315 699.85284 281.1 701.5097 281.1C703.1665 281.1 704.5097 282.44315 704.5097 284.1Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M715.2065 283.75C715.2065 285.40686 713.8633 286.75 712.2065 286.75C710.5496 286.75 709.2065 285.40686 709.2065 283.75C709.2065 282.09314 710.5496 280.75 712.2065 280.75C713.8633 280.75 715.2065 282.09314 715.2065 283.75Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M725.9032 282.28C725.9032 283.93686 724.56006 285.28 722.9032 285.28C721.2464 285.28 719.9032 283.93686 719.9032 282.28C719.9032 280.62314 721.2464 279.28 722.9032 279.28C724.56006 279.28 725.9032 280.62314 725.9032 282.28Z" fill-rule="nonzero"/><path fill="#000000" fill-opacity="0.0" clip-path="url(#id_0)" d="M736.6 279.48C736.6 281.13684 735.25684 282.48 733.6 282.48C731.9431 282.48 730.6 281.13684 730.6 279.48C730.6 277.82315 731.9431 276.48 733.6 276.48C735.25684 276.48 736.6 277.82315 736.6 279.48Z" fill-rule="nonzero"/><path fill="#000000" d="M355.42188 441.6L355.42188 433.00626L358.67188 433.00626Q359.51562 433.00626 359.96875 433.08438Q360.60938 433.19376 361.03125 433.49063Q361.46875 433.7875 361.71875 434.31876Q361.98438 434.85 361.98438 435.49063Q361.98438 436.58438 361.28125 437.35Q360.59375 438.1 358.76562 438.1L356.5625 438.1L356.5625 441.6L355.42188 441.6ZM356.5625 437.1L358.78125 437.1Q359.89062 437.1 360.34375 436.69376Q360.8125 436.27188 360.8125 435.52188Q360.8125 434.99063 360.53125 434.61563Q360.26562 434.225 359.82812 434.1Q359.53125 434.02188 358.76562 434.02188L356.5625 434.02188L356.5625 437.1ZM367.35938 440.83438Q366.76562 441.33438 366.21875 441.5375Q365.6875 441.74063 365.0625 441.74063Q364.03125 441.74063 363.48438 441.24063Q362.9375 440.74063 362.9375 439.95938Q362.9375 439.50626 363.14062 439.13126Q363.34375 438.74063 363.6875 438.52188Q364.03125 438.2875 364.45312 438.17813Q364.75 438.08438 365.39062 438.00626Q366.65625 437.86563 367.26562 437.64688Q367.26562 437.42813 367.26562 437.38126Q367.26562 436.725 366.96875 436.45938Q366.5625 436.11563 365.76562 436.11563Q365.03125 436.11563 364.67188 436.38126Q364.3125 436.63126 364.14062 437.2875L363.10938 437.14688Q363.25 436.49063 363.57812 436.08438Q363.90625 435.67813 364.51562 435.45938Q365.125 435.24063 365.92188 435.24063Q366.71875 435.24063 367.21875 435.42813Q367.71875 435.61563 367.95312 435.89688Q368.1875 436.17813 368.28125 436.61563Q368.32812 436.88126 368.32812 437.58438L368.32812 438.99063Q368.32812 440.45938 368.39062 440.85Q368.46875 441.24063 368.67188 441.6L367.5625 441.6Q367.40625 441.27188 367.35938 440.83438ZM367.26562 438.475Q366.6875 438.70938 365.54688 438.88126Q364.89062 438.975 364.625 439.1Q364.35938 439.20938 364.20312 439.42813Q364.0625 439.64688 364.0625 439.92813Q364.0625 440.35 364.375 440.63126Q364.70312 440.9125 365.3125 440.9125Q365.92188 440.9125 366.39062 440.64688Q366.875 440.38126 367.09375 439.9125Q367.26562 439.55313 367.26562 438.86563L367.26562 438.475ZM369.875 439.74063L370.90625 439.58438Q371.0 440.20938 371.39062 440.5375Q371.79688 440.86563 372.53125 440.86563Q373.25 440.86563 373.59375 440.58438Q373.95312 440.2875 373.95312 439.88126Q373.95312 439.52188 373.64062 439.31876Q373.42188 439.17813 372.5625 438.95938Q371.40625 438.6625 370.95312 438.45938Q370.51562 438.24063 370.28125 437.86563Q370.04688 437.49063 370.04688 437.02188Q370.04688 436.61563 370.23438 436.25626Q370.42188 435.89688 370.75 435.6625Q371.0 435.49063 371.42188 435.36563Q371.84375 435.24063 372.34375 435.24063Q373.0625 435.24063 373.60938 435.45938Q374.17188 435.6625 374.4375 436.02188Q374.70312 436.38126 374.79688 436.975L373.76562 437.11563Q373.70312 436.64688 373.35938 436.38126Q373.03125 436.1 372.40625 436.1Q371.6875 436.1 371.375 436.35Q371.0625 436.58438 371.0625 436.9125Q371.0625 437.11563 371.1875 437.27188Q371.32812 437.44376 371.59375 437.55313Q371.75 437.61563 372.53125 437.81876Q373.65625 438.13126 374.09375 438.31876Q374.53125 438.50626 374.78125 438.86563Q375.03125 439.225 375.03125 439.77188Q375.03125 440.30313 374.71875 440.77188Q374.42188 441.225 373.84375 441.49063Q373.26562 441.74063 372.53125 441.74063Q371.3125 441.74063 370.67188 441.24063Q370.04688 440.725 369.875 439.74063ZM375.875 439.74063L376.90625 439.58438Q377.0 440.20938 377.39062 440.5375Q377.79688 440.86563 378.53125 440.86563Q379.25 440.86563 379.59375 440.58438Q379.95312 440.2875 379.95312 439.88126Q379.95312 439.52188 379.64062 439.31876Q379.42188 439.17813 378.5625 438.95938Q377.40625 438.6625 376.95312 438.45938Q376.51562 438.24063 376.28125 437.86563Q376.04688 437.49063 376.04688 437.02188Q376.04688 436.61563 376.23438 436.25626Q376.42188 435.89688 376.75 435.6625Q377.0 435.49063 377.42188 435.36563Q377.84375 435.24063 378.34375 435.24063Q379.0625 435.24063 379.60938 435.45938Q380.17188 435.6625 380.4375 436.02188Q380.70312 436.38126 380.79688 436.975L379.76562 437.11563Q379.70312 436.64688 379.35938 436.38126Q379.03125 436.1 378.40625 436.1Q377.6875 436.1 377.375 436.35Q377.0625 436.58438 377.0625 436.9125Q377.0625 437.11563 377.1875 437.27188Q377.32812 437.44376 377.59375 437.55313Q377.75 437.61563 378.53125 437.81876Q379.65625 438.13126 380.09375 438.31876Q380.53125 438.50626 380.78125 438.86563Q381.03125 439.225 381.03125 439.77188Q381.03125 440.30313 380.71875 440.77188Q380.42188 441.225 379.84375 441.49063Q379.26562 441.74063 378.53125 441.74063Q377.3125 441.74063 376.67188 441.24063Q376.04688 440.725 375.875 439.74063ZM383.4375 441.6L381.53125 435.38126L382.625 435.38126L383.60938 438.975L383.98438 440.30313Q384.01562 440.20938 384.3125 439.02188L385.29688 435.38126L386.375 435.38126L387.3125 438.99063L387.625 440.17813L387.98438 438.975L389.04688 435.38126L390.07812 435.38126L388.125 441.6L387.03125 441.6L386.04688 437.86563L385.79688 436.81876L384.54688 441.6L383.4375 441.6ZM390.90625 438.49063Q390.90625 436.75626 391.85938 435.92813Q392.65625 435.24063 393.8125 435.24063Q395.09375 435.24063 395.90625 436.08438Q396.73438 436.9125 396.73438 438.39688Q396.73438 439.6 396.375 440.2875Q396.01562 440.975 395.3125 441.36563Q394.625 441.74063 393.8125 441.74063Q392.51562 441.74063 391.70312 440.9125Q390.90625 440.06876 390.90625 438.49063ZM391.98438 438.49063Q391.98438 439.67813 392.5 440.27188Q393.03125 440.86563 393.8125 440.86563Q394.60938 440.86563 395.125 440.27188Q395.64062 439.67813 395.64062 438.45938Q395.64062 437.30313 395.10938 436.70938Q394.59375 436.11563 393.8125 436.11563Q393.03125 436.11563 392.5 436.70938Q391.98438 437.2875 391.98438 438.49063ZM398.28125 441.6L398.28125 435.38126L399.23438 435.38126L399.23438 436.31876Q399.59375 435.6625 399.89062 435.45938Q400.20312 435.24063 400.57812 435.24063Q401.10938 435.24063 401.65625 435.56876L401.29688 436.55313Q400.90625 436.31876 400.53125 436.31876Q400.17188 436.31876 399.89062 436.5375Q399.625 436.74063 399.51562 437.11563Q399.32812 437.67813 399.32812 438.33438L399.32812 441.6L398.28125 441.6ZM406.32812 441.6L406.32812 440.81876Q405.73438 441.74063 404.59375 441.74063Q403.84375 441.74063 403.21875 441.33438Q402.59375 440.9125 402.25 440.17813Q401.90625 439.44376 401.90625 438.49063Q401.90625 437.56876 402.21875 436.80313Q402.53125 436.0375 403.15625 435.64688Q403.78125 435.24063 404.54688 435.24063Q405.10938 435.24063 405.54688 435.475Q405.98438 435.70938 406.26562 436.08438L406.26562 433.00626L407.3125 433.00626L407.3125 441.6L406.32812 441.6ZM403.0 438.49063Q403.0 439.69376 403.5 440.2875Q404.0 440.86563 404.6875 440.86563Q405.375 440.86563 405.85938 440.30313Q406.34375 439.74063 406.34375 438.58438Q406.34375 437.30313 405.84375 436.70938Q405.35938 436.11563 404.64062 436.11563Q403.9375 436.11563 403.46875 436.69376Q403.0 437.25626 403.0 438.49063ZM412.375 441.6L412.375 433.00626L413.51562 433.00626L413.51562 440.58438L417.75 440.58438L417.75 441.6L412.375 441.6ZM423.54688 439.6L424.64062 439.725Q424.39062 440.67813 423.6875 441.20938Q422.98438 441.74063 421.90625 441.74063Q420.54688 441.74063 419.73438 440.89688Q418.9375 440.05313 418.9375 438.5375Q418.9375 436.975 419.75 436.11563Q420.5625 435.24063 421.84375 435.24063Q423.09375 435.24063 423.875 436.08438Q424.67188 436.92813 424.67188 438.475Q424.67188 438.56876 424.67188 438.75626L420.03125 438.75626Q420.09375 439.7875 420.60938 440.33438Q421.125 440.86563 421.90625 440.86563Q422.48438 440.86563 422.89062 440.56876Q423.3125 440.25626 423.54688 439.6ZM420.09375 437.89688L423.5625 437.89688Q423.5 437.1 423.17188 436.70938Q422.65625 436.1 421.85938 436.1Q421.125 436.1 420.625 436.58438Q420.14062 437.06876 420.09375 437.89688ZM426.29688 441.6L426.29688 435.38126L427.23438 435.38126L427.23438 436.25626Q427.92188 435.24063 429.21875 435.24063Q429.78125 435.24063 430.25 435.44376Q430.73438 435.64688 430.96875 435.975Q431.20312 436.30313 431.29688 436.74063Q431.34375 437.0375 431.34375 437.77188L431.34375 441.6L430.29688 441.6L430.29688 437.81876Q430.29688 437.1625 430.17188 436.85Q430.04688 436.5375 429.73438 436.35Q429.42188 436.14688 429.0 436.14688Q428.32812 436.14688 427.82812 436.58438Q427.34375 437.00626 427.34375 438.19376L427.34375 441.6L426.29688 441.6ZM433.09375 442.11563L434.125 442.27188Q434.1875 442.74063 434.48438 442.95938Q434.875 443.25626 435.54688 443.25626Q436.28125 443.25626 436.67188 442.95938Q437.07812 442.6625 437.21875 442.14688Q437.3125 441.81876 437.29688 440.7875Q436.60938 441.6 435.57812 441.6Q434.29688 441.6 433.59375 440.67813Q432.89062 439.74063 432.89062 438.45938Q432.89062 437.56876 433.20312 436.81876Q433.53125 436.05313 434.14062 435.64688Q434.75 435.24063 435.57812 435.24063Q436.6875 435.24063 437.40625 436.13126L437.40625 435.38126L438.375 435.38126L438.375 440.75626Q438.375 442.20938 438.07812 442.81876Q437.78125 443.42813 437.14062 443.77188Q436.5 444.13126 435.5625 444.13126Q434.45312 444.13126 433.76562 443.63126Q433.07812 443.13126 433.09375 442.11563ZM433.96875 438.38126Q433.96875 439.6 434.45312 440.1625Q434.9375 440.725 435.67188 440.725Q436.40625 440.725 436.89062 440.1625Q437.39062 439.6 437.39062 438.4125Q437.39062 437.27188 436.875 436.69376Q436.375 436.11563 435.65625 436.11563Q434.95312 436.11563 434.45312 436.69376Q433.96875 437.25626 433.96875 438.38126ZM442.59375 440.6625L442.75 441.58438Q442.29688 441.67813 441.95312 441.67813Q441.375 441.67813 441.0625 441.50626Q440.75 441.31876 440.60938 441.02188Q440.48438 440.725 440.48438 439.77188L440.48438 436.19376L439.71875 436.19376L439.71875 435.38126L440.48438 435.38126L440.48438 433.83438L441.53125 433.20938L441.53125 435.38126L442.59375 435.38126L442.59375 436.19376L441.53125 436.19376L441.53125 439.83438Q441.53125 440.2875 441.57812 440.4125Q441.64062 440.5375 441.76562 440.61563Q441.89062 440.69376 442.125 440.69376Q442.3125 440.69376 442.59375 440.6625ZM443.29688 441.6L443.29688 433.00626L444.34375 433.00626L444.34375 436.08438Q445.07812 435.24063 446.20312 435.24063Q446.90625 435.24063 447.40625 435.52188Q447.92188 435.7875 448.14062 436.27188Q448.35938 436.74063 448.35938 437.6625L448.35938 441.6L447.3125 441.6L447.3125 437.6625Q447.3125 436.86563 446.96875 436.50626Q446.625 436.14688 446.0 436.14688Q445.53125 436.14688 445.10938 436.39688Q444.70312 436.63126 444.51562 437.05313Q444.34375 437.45938 444.34375 438.19376L444.34375 441.6L443.29688 441.6Z" fill-rule="nonzero"/><path fill="#000000" d="M34.400005 270.99063L26.82188 270.99063L26.82188 273.81876L25.806255 273.81876L25.806255 267.00626L26.82188 267.00626L26.82188 269.85L34.400005 269.85L34.400005 270.99063ZM27.025005 266.30313L25.806255 266.30313L25.806255 265.24063L27.025005 265.24063L27.025005 266.30313ZM34.400005 266.30313L28.181255 266.30313L28.181255 265.24063L34.400005 265.24063L34.400005 266.30313ZM34.400005 263.30313L28.181255 263.30313L28.181255 262.36563L29.056255 262.36563Q28.587505 262.06876 28.32188 261.58438Q28.04063 261.1 28.04063 260.475Q28.04063 259.7875 28.32188 259.35Q28.60313 258.89688 29.118755 258.725Q28.04063 257.975 28.04063 256.80313Q28.04063 255.86563 28.556255 255.38126Q29.056255 254.88126 30.13438 254.88126L34.400005 254.88126L34.400005 255.92813L30.47813 255.92813Q29.85313 255.92813 29.57188 256.0375Q29.29063 256.13126 29.118755 256.39688Q28.94688 256.6625 28.94688 257.0375Q28.94688 257.69376 29.38438 258.13126Q29.82188 258.55313 30.79063 258.55313L34.400005 258.55313L34.400005 259.61563L30.35313 259.61563Q29.650005 259.61563 29.306255 259.88126Q28.94688 260.13126 28.94688 260.70938Q28.94688 261.1625 29.181255 261.5375Q29.41563 261.9125 29.868755 262.08438Q30.32188 262.25626 31.16563 262.25626L34.400005 262.25626L34.400005 263.30313ZM32.400005 249.05313L32.525005 247.95938Q33.47813 248.20938 34.00938 248.9125Q34.54063 249.61563 34.54063 250.69376Q34.54063 252.05313 33.69688 252.86563Q32.85313 253.6625 31.337505 253.6625Q29.775005 253.6625 28.91563 252.85Q28.04063 252.0375 28.04063 250.75626Q28.04063 249.50626 28.88438 248.725Q29.72813 247.92813 31.275005 247.92813Q31.368755 247.92813 31.556255 247.92813L31.556255 252.56876Q32.587505 252.50626 33.13438 251.99063Q33.66563 251.475 33.66563 250.69376Q33.66563 250.11563 33.368755 249.70938Q33.056255 249.2875 32.400005 249.05313ZM30.69688 252.50626L30.69688 249.0375Q29.900005 249.1 29.50938 249.42813Q28.900005 249.94376 28.900005 250.74063Q28.900005 251.475 29.38438 251.975Q29.868755 252.45938 30.69688 252.50626Z" fill-rule="nonzero"/><path fill="#ffffff" d="M64.65 392.475Q64.65 391.725 64.80625 391.25626Q64.9625 390.7875 65.275 390.5375Q65.5875 390.2875 66.05625 390.2875Q66.4 390.2875 66.65 390.42813Q66.91563 390.56876 67.0875 390.83438Q67.25938 391.08438 67.35313 391.475Q67.44688 391.85 67.44688 392.475Q67.44688 393.24063 67.29063 393.70938Q67.13438 394.1625 66.82188 394.42813Q66.525 394.67813 66.05625 394.67813Q65.43125 394.67813 65.07188 394.225Q64.65 393.69376 64.65 392.475ZM65.19688 392.475Q65.19688 393.5375 65.43125 393.89688Q65.68125 394.24063 66.05625 394.24063Q66.41563 394.24063 66.66563 393.89688Q66.91563 393.5375 66.91563 392.475Q66.91563 391.42813 66.66563 391.08438Q66.41563 390.725 66.04063 390.725Q65.68125 390.725 65.4625 391.0375Q65.19688 391.42813 65.19688 392.475Z" fill-rule="nonzero"/><path fill="#ffffff" d="M57.634377 324.6L57.103127 324.6L57.103127 321.24063Q56.915627 321.42813 56.603127 321.61563Q56.30625 321.7875 56.05625 321.88126L56.05625 321.36563Q56.49375 321.1625 56.821877 320.86563Q57.165627 320.56876 57.290627 320.2875L57.634377 320.2875L57.634377 324.6ZM58.65 322.475Q58.65 321.725 58.80625 321.25626Q58.9625 320.7875 59.275 320.5375Q59.5875 320.2875 60.05625 320.2875Q60.4 320.2875 60.65 320.42813Q60.915627 320.56876 61.0875 320.83438Q61.259377 321.08438 61.353127 321.475Q61.446877 321.85 61.446877 322.475Q61.446877 323.24063 61.290627 323.70938Q61.134377 324.1625 60.821877 324.42813Q60.525 324.67813 60.05625 324.67813Q59.43125 324.67813 59.071877 324.225Q58.65 323.69376 58.65 322.475ZM59.196877 322.475Q59.196877 323.5375 59.43125 323.89688Q59.68125 324.24063 60.05625 324.24063Q60.415627 324.24063 60.665627 323.89688Q60.915627 323.5375 60.915627 322.475Q60.915627 321.42813 60.665627 321.08438Q60.415627 320.725 60.040627 320.725Q59.68125 320.725 59.4625 321.0375Q59.196877 321.42813 59.196877 322.475ZM61.65 322.475Q61.65 321.725 61.80625 321.25626Q61.9625 320.7875 62.275 320.5375Q62.5875 320.2875 63.05625 320.2875Q63.4 320.2875 63.65 320.42813Q63.915627 320.56876 64.0875 320.83438Q64.25938 321.08438 64.35313 321.475Q64.44688 321.85 64.44688 322.475Q64.44688 323.24063 64.29063 323.70938Q64.13438 324.1625 63.821877 324.42813Q63.525 324.67813 63.05625 324.67813Q62.43125 324.67813 62.071877 324.225Q61.65 323.69376 61.65 322.475ZM62.196877 322.475Q62.196877 323.5375 62.43125 323.89688Q62.68125 324.24063 63.05625 324.24063Q63.415627 324.24063 63.665627 323.89688Q63.915627 323.5375 63.915627 322.475Q63.915627 321.42813 63.665627 321.08438Q63.415627 320.725 63.040627 320.725Q62.68125 320.725 62.4625 321.0375Q62.196877 321.42813 62.196877 322.475ZM64.65 322.475Q64.65 321.725 64.80625 321.25626Q64.9625 320.7875 65.275 320.5375Q65.5875 320.2875 66.05625 320.2875Q66.4 320.2875 66.65 320.42813Q66.91563 320.56876 67.0875 320.83438Q67.25938 321.08438 67.35313 321.475Q67.44688 321.85 67.44688 322.475Q67.44688 323.24063 67.29063 323.70938Q67.13438 324.1625 66.82188 324.42813Q66.525 324.67813 66.05625 324.67813Q65.43125 324.67813 65.07188 324.225Q64.65 323.69376 64.65 322.475ZM65.19688 322.475Q65.19688 323.5375 65.43125 323.89688Q65.68125 324.24063 66.05625 324.24063Q66.41563 324.24063 66.66563 323.89688Q66.91563 323.5375 66.91563 322.475Q66.91563 321.42813 66.66563 321.08438Q66.41563 320.725 66.04063 320.725Q65.68125 320.725 65.4625 321.0375Q65.19688 321.42813 65.19688 322.475Z" fill-rule="nonzero"/><path fill="#ffffff" d="M58.415627 254.1L58.415627 254.6L55.5875 254.6Q55.571877 254.4125 55.65 254.24063Q55.759377 253.94376 55.99375 253.6625Q56.228127 253.38126 56.68125 253.00626Q57.384377 252.44376 57.61875 252.11563Q57.86875 251.77188 57.86875 251.475Q57.86875 251.14688 57.65 250.94376Q57.43125 250.725 57.071877 250.725Q56.68125 250.725 56.446877 250.95938Q56.228127 251.17813 56.228127 251.58438L55.68125 251.52188Q55.74375 250.92813 56.103127 250.61563Q56.4625 250.2875 57.071877 250.2875Q57.696877 250.2875 58.05625 250.63126Q58.415627 250.975 58.415627 251.475Q58.415627 251.74063 58.30625 251.99063Q58.196877 252.24063 57.946877 252.52188Q57.7125 252.7875 57.15 253.27188Q56.665627 253.6625 56.525 253.80313Q56.4 253.94376 56.321877 254.1L58.415627 254.1ZM58.65 252.475Q58.65 251.725 58.80625 251.25626Q58.9625 250.7875 59.275 250.5375Q59.5875 250.2875 60.05625 250.2875Q60.4 250.2875 60.65 250.42813Q60.915627 250.56876 61.0875 250.83438Q61.259377 251.08438 61.353127 251.475Q61.446877 251.85 61.446877 252.475Q61.446877 253.24063 61.290627 253.70938Q61.134377 254.1625 60.821877 254.42813Q60.525 254.67813 60.05625 254.67813Q59.43125 254.67813 59.071877 254.225Q58.65 253.69376 58.65 252.475ZM59.196877 252.475Q59.196877 253.5375 59.43125 253.89688Q59.68125 254.24063 60.05625 254.24063Q60.415627 254.24063 60.665627 253.89688Q60.915627 253.5375 60.915627 252.475Q60.915627 251.42813 60.665627 251.08438Q60.415627 250.725 60.040627 250.725Q59.68125 250.725 59.4625 251.0375Q59.196877 251.42813 59.196877 252.475ZM61.65 252.475Q61.65 251.725 61.80625 251.25626Q61.9625 250.7875 62.275 250.5375Q62.5875 250.2875 63.05625 250.2875Q63.4 250.2875 63.65 250.42813Q63.915627 250.56876 64.0875 250.83438Q64.25938 251.08438 64.35313 251.475Q64.44688 251.85 64.44688 252.475Q64.44688 253.24063 64.29063 253.70938Q64.13438 254.1625 63.821877 254.42813Q63.525 254.67813 63.05625 254.67813Q62.43125 254.67813 62.071877 254.225Q61.65 253.69376 61.65 252.475ZM62.196877 252.475Q62.196877 253.5375 62.43125 253.89688Q62.68125 254.24063 63.05625 254.24063Q63.415627 254.24063 63.665627 253.89688Q63.915627 253.5375 63.915627 252.475Q63.915627 251.42813 63.665627 251.08438Q63.415627 250.725 63.040627 250.725Q62.68125 250.725 62.4625 251.0375Q62.196877 251.42813 62.196877 252.475ZM64.65 252.475Q64.65 251.725 64.80625 251.25626Q64.9625 250.7875 65.275 250.5375Q65.5875 250.2875 66.05625 250.2875Q66.4 250.2875 66.65 250.42813Q66.91563 250.56876 67.0875 250.83438Q67.25938 251.08438 67.35313 251.475Q67.44688 251.85 67.44688 252.475Q67.44688 253.24063 67.29063 253.70938Q67.13438 254.1625 66.82188 254.42813Q66.525 254.67813 66.05625 254.67813Q65.43125 254.67813 65.07188 254.225Q64.65 253.69376 64.65 252.475ZM65.19688 252.475Q65.19688 253.5375 65.43125 253.89688Q65.68125 254.24063 66.05625 254.24063Q66.41563 254.24063 66.66563 253.89688Q66.91563 253.5375 66.91563 252.475Q66.91563 251.42813 66.66563 251.08438Q66.41563 250.725 66.04063 250.725Q65.68125 250.725 65.4625 251.0375Q65.19688 251.42813 65.19688 252.475Z" fill-rule="nonzero"/><path fill="#ffffff" d="M55.65 183.45938L56.18125 183.39688Q56.275 183.85 56.49375 184.05313Q56.7125 184.24063 57.025 184.24063Q57.4 184.24063 57.65 183.99063Q57.9 183.725 57.9 183.35Q57.9 182.975 57.665627 182.74063Q57.43125 182.50626 57.071877 182.50626Q56.915627 182.50626 56.696877 182.56876L56.74375 182.1Q56.80625 182.11563 56.8375 182.11563Q57.165627 182.11563 57.43125 181.94376Q57.7125 181.75626 57.7125 181.39688Q57.7125 181.1 57.509377 180.9125Q57.321877 180.725 57.009377 180.725Q56.696877 180.725 56.49375 180.9125Q56.290627 181.1 56.228127 181.49063L55.7125 181.39688Q55.80625 180.86563 56.15 180.58438Q56.49375 180.2875 56.99375 180.2875Q57.353127 180.2875 57.65 180.44376Q57.946877 180.58438 58.103127 180.85Q58.259377 181.11563 58.259377 181.39688Q58.259377 181.67813 58.103127 181.9125Q57.9625 182.13126 57.665627 182.27188Q58.040627 182.36563 58.24375 182.64688Q58.4625 182.9125 58.4625 183.33438Q58.4625 183.89688 58.05625 184.2875Q57.65 184.67813 57.025 184.67813Q56.446877 184.67813 56.071877 184.35Q55.7125 184.00626 55.65 183.45938ZM58.65 182.475Q58.65 181.725 58.80625 181.25626Q58.9625 180.7875 59.275 180.5375Q59.5875 180.2875 60.05625 180.2875Q60.4 180.2875 60.65 180.42813Q60.915627 180.56876 61.0875 180.83438Q61.259377 181.08438 61.353127 181.475Q61.446877 181.85 61.446877 182.475Q61.446877 183.24063 61.290627 183.70938Q61.134377 184.1625 60.821877 184.42813Q60.525 184.67813 60.05625 184.67813Q59.43125 184.67813 59.071877 184.225Q58.65 183.69376 58.65 182.475ZM59.196877 182.475Q59.196877 183.5375 59.43125 183.89688Q59.68125 184.24063 60.05625 184.24063Q60.415627 184.24063 60.665627 183.89688Q60.915627 183.5375 60.915627 182.475Q60.915627 181.42813 60.665627 181.08438Q60.415627 180.725 60.040627 180.725Q59.68125 180.725 59.4625 181.0375Q59.196877 181.42813 59.196877 182.475ZM61.65 182.475Q61.65 181.725 61.80625 181.25626Q61.9625 180.7875 62.275 180.5375Q62.5875 180.2875 63.05625 180.2875Q63.4 180.2875 63.65 180.42813Q63.915627 180.56876 64.0875 180.83438Q64.25938 181.08438 64.35313 181.475Q64.44688 181.85 64.44688 182.475Q64.44688 183.24063 64.29063 183.70938Q64.13438 184.1625 63.821877 184.42813Q63.525 184.67813 63.05625 184.67813Q62.43125 184.67813 62.071877 184.225Q61.65 183.69376 61.65 182.475ZM62.196877 182.475Q62.196877 183.5375 62.43125 183.89688Q62.68125 184.24063 63.05625 184.24063Q63.415627 184.24063 63.665627 183.89688Q63.915627 183.5375 63.915627 182.475Q63.915627 181.42813 63.665627 181.08438Q63.415627 180.725 63.040627 180.725Q62.68125 180.725 62.4625 181.0375Q62.196877 181.42813 62.196877 182.475ZM64.65 182.475Q64.65 181.725 64.80625 181.25626Q64.9625 180.7875 65.275 180.5375Q65.5875 180.2875 66.05625 180.2875Q66.4 180.2875 66.65 180.42813Q66.91563 180.56876 67.0875 180.83438Q67.25938 181.08438 67.35313 181.475Q67.44688 181.85 67.44688 182.475Q67.44688 183.24063 67.29063 183.70938Q67.13438 184.1625 66.82188 184.42813Q66.525 184.67813 66.05625 184.67813Q65.43125 184.67813 65.07188 184.225Q64.65 183.69376 64.65 182.475ZM65.19688 182.475Q65.19688 183.5375 65.43125 183.89688Q65.68125 184.24063 66.05625 184.24063Q66.41563 184.24063 66.66563 183.89688Q66.91563 183.5375 66.91563 182.475Q66.91563 181.42813 66.66563 181.08438Q66.41563 180.725 66.04063 180.725Q65.68125 180.725 65.4625 181.0375Q65.19688 181.42813 65.19688 182.475Z" fill-rule="nonzero"/><path fill="#ffffff" d="M57.3375 114.6L57.3375 113.56875L55.478127 113.56875L55.478127 113.08437L57.43125 110.30312L57.86875 110.30312L57.86875 113.08437L58.446877 113.08437L58.446877 113.56875L57.86875 113.56875L57.86875 114.6L57.3375 114.6ZM57.3375 113.08437L57.3375 111.14687L55.99375 113.08437L57.3375 113.08437ZM58.65 112.475Q58.65 111.725 58.80625 111.25625Q58.9625 110.7875 59.275 110.5375Q59.5875 110.2875 60.05625 110.2875Q60.4 110.2875 60.65 110.42812Q60.915627 110.56875 61.0875 110.83437Q61.259377 111.08437 61.353127 111.475Q61.446877 111.85 61.446877 112.475Q61.446877 113.24062 61.290627 113.70937Q61.134377 114.1625 60.821877 114.42812Q60.525 114.67812 60.05625 114.67812Q59.43125 114.67812 59.071877 114.225Q58.65 113.69375 58.65 112.475ZM59.196877 112.475Q59.196877 113.5375 59.43125 113.89687Q59.68125 114.24062 60.05625 114.24062Q60.415627 114.24062 60.665627 113.89687Q60.915627 113.5375 60.915627 112.475Q60.915627 111.42812 60.665627 111.08437Q60.415627 110.725 60.040627 110.725Q59.68125 110.725 59.4625 111.0375Q59.196877 111.42812 59.196877 112.475ZM61.65 112.475Q61.65 111.725 61.80625 111.25625Q61.9625 110.7875 62.275 110.5375Q62.5875 110.2875 63.05625 110.2875Q63.4 110.2875 63.65 110.42812Q63.915627 110.56875 64.0875 110.83437Q64.25938 111.08437 64.35313 111.475Q64.44688 111.85 64.44688 112.475Q64.44688 113.24062 64.29063 113.70937Q64.13438 114.1625 63.821877 114.42812Q63.525 114.67812 63.05625 114.67812Q62.43125 114.67812 62.071877 114.225Q61.65 113.69375 61.65 112.475ZM62.196877 112.475Q62.196877 113.5375 62.43125 113.89687Q62.68125 114.24062 63.05625 114.24062Q63.415627 114.24062 63.665627 113.89687Q63.915627 113.5375 63.915627 112.475Q63.915627 111.42812 63.665627 111.08437Q63.415627 110.725 63.040627 110.725Q62.68125 110.725 62.4625 111.0375Q62.196877 111.42812 62.196877 112.475ZM64.65 112.475Q64.65 111.725 64.80625 111.25625Q64.9625 110.7875 65.275 110.5375Q65.5875 110.2875 66.05625 110.2875Q66.4 110.2875 66.65 110.42812Q66.91563 110.56875 67.0875 110.83437Q67.25938 111.08437 67.35313 111.475Q67.44688 111.85 67.44688 112.475Q67.44688 113.24062 67.29063 113.70937Q67.13438 114.1625 66.82188 114.42812Q66.525 114.67812 66.05625 114.67812Q65.43125 114.67812 65.07188 114.225Q64.65 113.69375 64.65 112.475ZM65.19688 112.475Q65.19688 113.5375 65.43125 113.89687Q65.68125 114.24062 66.05625 114.24062Q66.41563 114.24062 66.66563 113.89687Q66.91563 113.5375 66.91563 112.475Q66.91563 111.42812 66.66563 111.08437Q66.41563 110.725 66.04063 110.725Q65.68125 110.725 65.4625 111.0375Q65.19688 111.42812 65.19688 112.475Z" fill-rule="nonzero"/><path fill="#000000" d="M89.2623 409.6L88.21542 409.6L88.21542 402.88126Q87.8248 403.24063 87.1998 403.61563Q86.59042 403.975 86.10605 404.14688L86.10605 403.13126Q86.98105 402.70938 87.6373 402.13126Q88.30917 401.5375 88.59042 400.975L89.2623 400.975L89.2623 409.6ZM92.29355 405.36563Q92.29355 403.83438 92.60605 402.9125Q92.91855 401.975 93.52792 401.475Q94.15292 400.975 95.09042 400.975Q95.77792 400.975 96.29355 401.25626Q96.8248 401.5375 97.16855 402.06876Q97.5123 402.58438 97.6998 403.33438Q97.8873 404.08438 97.8873 405.36563Q97.8873 406.88126 97.5748 407.80313Q97.27792 408.725 96.65292 409.24063Q96.04355 409.74063 95.09042 409.74063Q93.85605 409.74063 93.1373 408.85Q92.29355 407.7875 92.29355 405.36563ZM93.37167 405.36563Q93.37167 407.475 93.87167 408.17813Q94.37167 408.88126 95.09042 408.88126Q95.8248 408.88126 96.30917 408.17813Q96.80917 407.475 96.80917 405.36563Q96.80917 403.24063 96.30917 402.55313Q95.8248 401.85 95.0748 401.85Q94.35605 401.85 93.91855 402.45938Q93.37167 403.24063 93.37167 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M197.80817 408.58438L197.80817 409.6L192.12067 409.6Q192.12067 409.225 192.24567 408.86563Q192.46442 408.2875 192.93317 407.725Q193.41754 407.1625 194.32379 406.42813Q195.73004 405.27188 196.21442 404.6Q196.71442 403.92813 196.71442 403.33438Q196.71442 402.70938 196.26129 402.2875Q195.80817 401.85 195.08942 401.85Q194.32379 401.85 193.87067 402.30313Q193.41754 402.75626 193.40192 403.56876L192.32379 403.45938Q192.43317 402.24063 193.15192 401.61563Q193.88629 400.975 195.12067 400.975Q196.35504 400.975 197.07379 401.6625Q197.79254 402.35 197.79254 403.36563Q197.79254 403.88126 197.57379 404.38126Q197.37067 404.86563 196.87067 405.42813Q196.38629 405.975 195.26129 406.92813Q194.30817 407.725 194.02692 408.02188Q193.76129 408.30313 193.58942 408.58438L197.80817 408.58438ZM199.26129 405.36563Q199.26129 403.83438 199.57379 402.9125Q199.88629 401.975 200.49567 401.475Q201.12067 400.975 202.05817 400.975Q202.74567 400.975 203.26129 401.25626Q203.79254 401.5375 204.13629 402.06876Q204.48004 402.58438 204.66754 403.33438Q204.85504 404.08438 204.85504 405.36563Q204.85504 406.88126 204.54254 407.80313Q204.24567 408.725 203.62067 409.24063Q203.01129 409.74063 202.05817 409.74063Q200.82379 409.74063 200.10504 408.85Q199.26129 407.7875 199.26129 405.36563ZM200.33942 405.36563Q200.33942 407.475 200.83942 408.17813Q201.33942 408.88126 202.05817 408.88126Q202.79254 408.88126 203.27692 408.17813Q203.77692 407.475 203.77692 405.36563Q203.77692 403.24063 203.27692 402.55313Q202.79254 401.85 202.04254 401.85Q201.32379 401.85 200.88629 402.45938Q200.33942 403.24063 200.33942 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M299.22903 407.33438L300.29153 407.19376Q300.4634 408.08438 300.9009 408.49063Q301.3384 408.88126 301.9634 408.88126Q302.7134 408.88126 303.22903 408.36563Q303.74466 407.85 303.74466 407.08438Q303.74466 406.36563 303.26028 405.89688Q302.79153 405.4125 302.05716 405.4125Q301.76028 405.4125 301.30716 405.5375L301.43216 404.6Q301.54153 404.61563 301.60403 404.61563Q302.2759 404.61563 302.80716 404.27188Q303.35403 403.9125 303.35403 403.17813Q303.35403 402.6 302.9634 402.225Q302.57278 401.83438 301.94778 401.83438Q301.3384 401.83438 300.91653 402.225Q300.51028 402.61563 300.4009 403.38126L299.3384 403.19376Q299.5259 402.14688 300.2134 401.56876Q300.9009 400.975 301.91653 400.975Q302.61966 400.975 303.2134 401.2875Q303.80716 401.58438 304.11966 402.1Q304.43216 402.61563 304.43216 403.20938Q304.43216 403.75626 304.13528 404.225Q303.8384 404.67813 303.26028 404.94376Q304.01028 405.11563 304.43216 405.67813Q304.85403 406.225 304.85403 407.06876Q304.85403 408.19376 304.0259 408.975Q303.2134 409.75626 301.9634 409.75626Q300.8384 409.75626 300.0884 409.08438Q299.3384 408.39688 299.22903 407.33438ZM306.22903 405.36563Q306.22903 403.83438 306.54153 402.9125Q306.85403 401.975 307.4634 401.475Q308.0884 400.975 309.0259 400.975Q309.7134 400.975 310.22903 401.25626Q310.76028 401.5375 311.10403 402.06876Q311.44778 402.58438 311.63528 403.33438Q311.82278 404.08438 311.82278 405.36563Q311.82278 406.88126 311.51028 407.80313Q311.2134 408.725 310.5884 409.24063Q309.97903 409.74063 309.0259 409.74063Q307.79153 409.74063 307.07278 408.85Q306.22903 407.7875 306.22903 405.36563ZM307.30716 405.36563Q307.30716 407.475 307.80716 408.17813Q308.30716 408.88126 309.0259 408.88126Q309.76028 408.88126 310.24466 408.17813Q310.74466 407.475 310.74466 405.36563Q310.74466 403.24063 310.24466 402.55313Q309.76028 401.85 309.01028 401.85Q308.29153 401.85 307.85403 402.45938Q307.30716 403.24063 307.30716 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M409.57178 409.6L409.57178 407.5375L405.85303 407.5375L405.85303 406.56876L409.7749 401.00626L410.63428 401.00626L410.63428 406.56876L411.79053 406.56876L411.79053 407.5375L410.63428 407.5375L410.63428 409.6L409.57178 409.6ZM409.57178 406.56876L409.57178 402.70938L406.88428 406.56876L409.57178 406.56876ZM413.19678 405.36563Q413.19678 403.83438 413.50928 402.9125Q413.82178 401.975 414.43115 401.475Q415.05615 400.975 415.99365 400.975Q416.68115 400.975 417.19678 401.25626Q417.72803 401.5375 418.07178 402.06876Q418.41553 402.58438 418.60303 403.33438Q418.79053 404.08438 418.79053 405.36563Q418.79053 406.88126 418.47803 407.80313Q418.18115 408.725 417.55615 409.24063Q416.94678 409.74063 415.99365 409.74063Q414.75928 409.74063 414.04053 408.85Q413.19678 407.7875 413.19678 405.36563ZM414.2749 405.36563Q414.2749 407.475 414.7749 408.17813Q415.2749 408.88126 415.99365 408.88126Q416.72803 408.88126 417.2124 408.17813Q417.7124 407.475 417.7124 405.36563Q417.7124 403.24063 417.2124 402.55313Q416.72803 401.85 415.97803 401.85Q415.25928 401.85 414.82178 402.45938Q414.2749 403.24063 414.2749 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M513.1645 407.35L514.27386 407.25626Q514.39886 408.06876 514.83636 408.475Q515.2895 408.88126 515.9301 408.88126Q516.6801 408.88126 517.21136 408.30313Q517.7426 407.725 517.7426 406.7875Q517.7426 405.88126 517.227 405.36563Q516.727 404.83438 515.89886 404.83438Q515.39886 404.83438 514.977 405.06876Q514.57074 405.30313 514.33636 405.6625L513.352 405.5375L514.1801 401.13126L518.46136 401.13126L518.46136 402.13126L515.02386 402.13126L514.57074 404.44376Q515.33636 403.89688 516.1801 403.89688Q517.3051 403.89688 518.07074 404.67813Q518.852 405.45938 518.852 406.69376Q518.852 407.85 518.1801 408.70938Q517.352 409.74063 515.9301 409.74063Q514.75824 409.74063 514.00824 409.08438Q513.27386 408.42813 513.1645 407.35ZM520.1645 405.36563Q520.1645 403.83438 520.477 402.9125Q520.7895 401.975 521.39886 401.475Q522.02386 400.975 522.96136 400.975Q523.64886 400.975 524.1645 401.25626Q524.69574 401.5375 525.0395 402.06876Q525.38324 402.58438 525.57074 403.33438Q525.75824 404.08438 525.75824 405.36563Q525.75824 406.88126 525.44574 407.80313Q525.14886 408.725 524.52386 409.24063Q523.9145 409.74063 522.96136 409.74063Q521.727 409.74063 521.00824 408.85Q520.1645 407.7875 520.1645 405.36563ZM521.2426 405.36563Q521.2426 407.475 521.7426 408.17813Q522.2426 408.88126 522.96136 408.88126Q523.69574 408.88126 524.1801 408.17813Q524.6801 407.475 524.6801 405.36563Q524.6801 403.24063 524.1801 402.55313Q523.69574 401.85 522.94574 401.85Q522.227 401.85 521.7895 402.45938Q521.2426 403.24063 521.2426 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M625.601 403.11563L624.55414 403.19376Q624.4135 402.56876 624.1635 402.2875Q623.726 401.83438 623.101 401.83438Q622.601 401.83438 622.2104 402.11563Q621.726 402.49063 621.42914 403.19376Q621.1479 403.88126 621.13226 405.1625Q621.50726 404.58438 622.05414 404.30313Q622.61664 404.02188 623.226 404.02188Q624.2729 404.02188 625.00726 404.80313Q625.75726 405.58438 625.75726 406.80313Q625.75726 407.61563 625.3979 408.31876Q625.05414 409.00626 624.44476 409.38126Q623.8354 409.74063 623.06976 409.74063Q621.74164 409.74063 620.9135 408.77188Q620.0854 407.80313 620.0854 405.58438Q620.0854 403.08438 621.00726 401.95938Q621.80414 400.975 623.1635 400.975Q624.17914 400.975 624.81976 401.55313Q625.476 402.11563 625.601 403.11563ZM621.30414 406.81876Q621.30414 407.36563 621.5229 407.86563Q621.75726 408.35 622.1635 408.61563Q622.5854 408.88126 623.05414 408.88126Q623.7104 408.88126 624.19476 408.35Q624.67914 407.80313 624.67914 406.88126Q624.67914 405.99063 624.19476 405.475Q623.726 404.95938 623.00726 404.95938Q622.2885 404.95938 621.7885 405.475Q621.30414 405.99063 621.30414 406.81876ZM627.13226 405.36563Q627.13226 403.83438 627.44476 402.9125Q627.75726 401.975 628.36664 401.475Q628.99164 400.975 629.92914 400.975Q630.61664 400.975 631.13226 401.25626Q631.6635 401.5375 632.00726 402.06876Q632.351 402.58438 632.5385 403.33438Q632.726 404.08438 632.726 405.36563Q632.726 406.88126 632.4135 407.80313Q632.11664 408.725 631.49164 409.24063Q630.88226 409.74063 629.92914 409.74063Q628.69476 409.74063 627.976 408.85Q627.13226 407.7875 627.13226 405.36563ZM628.2104 405.36563Q628.2104 407.475 628.7104 408.17813Q629.2104 408.88126 629.92914 408.88126Q630.6635 408.88126 631.1479 408.17813Q631.6479 407.475 631.6479 405.36563Q631.6479 403.24063 631.1479 402.55313Q630.6635 401.85 629.9135 401.85Q629.19476 401.85 628.75726 402.45938Q628.2104 403.24063 628.2104 405.36563Z" fill-rule="nonzero"/><path fill="#000000" d="M727.1625 402.13126L727.1625 401.11563L732.725 401.11563L732.725 401.94376Q731.9125 402.81876 731.1 404.27188Q730.3031 405.70938 729.8656 407.24063Q729.5375 408.31876 729.45935 409.6L728.3656 409.6Q728.3812 408.58438 728.7562 407.14688Q729.14685 405.70938 729.85 404.38126Q730.5687 403.05313 731.3812 402.13126L727.1625 402.13126ZM734.1 405.36563Q734.1 403.83438 734.4125 402.9125Q734.725 401.975 735.33435 401.475Q735.95935 400.975 736.89685 400.975Q737.58435 400.975 738.1 401.25626Q738.6312 401.5375 738.975 402.06876Q739.3187 402.58438 739.5062 403.33438Q739.6937 404.08438 739.6937 405.36563Q739.6937 406.88126 739.3812 407.80313Q739.08435 408.725 738.45935 409.24063Q737.85 409.74063 736.89685 409.74063Q735.6625 409.74063 734.9437 408.85Q734.1 407.7875 734.1 405.36563ZM735.1781 405.36563Q735.1781 407.475 735.6781 408.17813Q736.1781 408.88126 736.89685 408.88126Q737.6312 408.88126 738.1156 408.17813Q738.6156 407.475 738.6156 405.36563Q738.6156 403.24063 738.1156 402.55313Q737.6312 401.85 736.8812 401.85Q736.1625 401.85 735.725 402.45938Q735.1781 403.24063 735.1781 405.36563Z" fill-rule="nonzero"/><path stroke="#4285f4" stroke-width="4.0" stroke-linecap="butt" d="M74.0 69.5L86.0 69.5" fill-rule="nonzero"/><path fill="#1a1a1a" d="M94.53125 69.171875Q94.53125 67.203125 95.578125 66.09375Q96.640625 64.984375 98.296875 64.984375Q99.390625 64.984375 100.265625 65.515625Q101.140625 66.03125 101.59375 66.96875Q102.0625 67.890625 102.0625 69.078125Q102.0625 70.265625 101.578125 71.21875Q101.09375 72.15625 100.203125 72.65625Q99.328125 73.140625 98.296875 73.140625Q97.1875 73.140625 96.3125 72.609375Q95.4375 72.0625 94.984375 71.140625Q94.53125 70.203125 94.53125 69.171875ZM95.609375 69.1875Q95.609375 70.609375 96.375 71.4375Q97.140625 72.25 98.296875 72.25Q99.46875 72.25 100.21875 71.421875Q100.984375 70.59375 100.984375 69.0625Q100.984375 68.109375 100.65625 67.390625Q100.34375 66.671875 99.71875 66.28125Q99.09375 65.890625 98.3125 65.890625Q97.203125 65.890625 96.40625 66.65625Q95.609375 67.40625 95.609375 69.1875ZM103.71875 73.0L103.71875 67.296875L104.59375 67.296875L104.59375 68.109375Q105.21875 67.171875 106.40625 67.171875Q106.921875 67.171875 107.359375 67.359375Q107.796875 67.53125 108.0 67.84375Q108.21875 68.140625 108.3125 68.546875Q108.359375 68.828125 108.359375 69.5L108.359375 73.0L107.390625 73.0L107.390625 69.53125Q107.390625 68.9375 107.28125 68.65625Q107.171875 68.359375 106.875 68.1875Q106.59375 68.0 106.203125 68.0Q105.59375 68.0 105.140625 68.390625Q104.6875 68.78125 104.6875 69.890625L104.6875 73.0L103.71875 73.0ZM113.625 71.15625L114.625 71.28125Q114.390625 72.15625 113.75 72.640625Q113.109375 73.125 112.125 73.125Q110.875 73.125 110.140625 72.359375Q109.40625 71.59375 109.40625 70.203125Q109.40625 68.75 110.140625 67.96875Q110.890625 67.171875 112.0625 67.171875Q113.21875 67.171875 113.9375 67.953125Q114.65625 68.71875 114.65625 70.140625Q114.65625 70.21875 114.65625 70.390625L110.40625 70.390625Q110.453125 71.328125 110.921875 71.828125Q111.40625 72.328125 112.125 72.328125Q112.65625 72.328125 113.03125 72.0625Q113.40625 71.78125 113.625 71.15625ZM110.453125 69.59375L113.640625 69.59375Q113.578125 68.875 113.28125 68.515625Q112.8125 67.96875 112.078125 67.96875Q111.40625 67.96875 110.953125 68.421875Q110.5 68.859375 110.453125 69.59375ZM122.625 71.15625L123.625 71.28125Q123.390625 72.15625 122.75 72.640625Q122.109375 73.125 121.125 73.125Q119.875 73.125 119.140625 72.359375Q118.40625 71.59375 118.40625 70.203125Q118.40625 68.75 119.140625 67.96875Q119.890625 67.171875 121.0625 67.171875Q122.21875 67.171875 122.9375 67.953125Q123.65625 68.71875 123.65625 70.140625Q123.65625 70.21875 123.65625 70.390625L119.40625 70.390625Q119.453125 71.328125 119.921875 71.828125Q120.40625 72.328125 121.125 72.328125Q121.65625 72.328125 122.03125 72.0625Q122.40625 71.78125 122.625 71.15625ZM119.453125 69.59375L122.640625 69.59375Q122.578125 68.875 122.28125 68.515625Q121.8125 67.96875 121.078125 67.96875Q120.40625 67.96875 119.953125 68.421875Q119.5 68.859375 119.453125 69.59375ZM128.45312 72.296875Q127.90625 72.75 127.40625 72.9375Q126.921875 73.125 126.34375 73.125Q125.40625 73.125 124.890625 72.671875Q124.390625 72.203125 124.390625 71.5Q124.390625 71.078125 124.578125 70.734375Q124.78125 70.390625 125.078125 70.1875Q125.390625 69.96875 125.78125 69.859375Q126.0625 69.78125 126.640625 69.71875Q127.8125 69.578125 128.35938 69.375Q128.375 69.1875 128.375 69.125Q128.375 68.53125 128.09375 68.296875Q127.734375 67.96875 127.0 67.96875Q126.3125 67.96875 125.984375 68.203125Q125.671875 68.4375 125.515625 69.046875L124.5625 68.921875Q124.6875 68.3125 124.984375 67.9375Q125.28125 67.5625 125.84375 67.375Q126.40625 67.171875 127.140625 67.171875Q127.875 67.171875 128.32812 67.34375Q128.78125 67.515625 128.98438 67.78125Q129.20312 68.03125 129.29688 68.421875Q129.34375 68.671875 129.34375 69.328125L129.34375 70.609375Q129.34375 71.953125 129.40625 72.3125Q129.46875 72.671875 129.65625 73.0L128.64062 73.0Q128.48438 72.703125 128.45312 72.296875ZM128.35938 70.140625Q127.84375 70.359375 126.78125 70.5Q126.1875 70.59375 125.9375 70.703125Q125.703125 70.796875 125.5625 71.015625Q125.421875 71.21875 125.421875 71.46875Q125.421875 71.859375 125.71875 72.125Q126.015625 72.375 126.578125 72.375Q127.140625 72.375 127.5625 72.125Q128.0 71.875 128.21875 71.453125Q128.35938 71.125 128.35938 70.484375L128.35938 70.140625ZM134.45312 70.90625L135.39062 71.03125Q135.25 72.015625 134.59375 72.578125Q133.95312 73.125 133.03125 73.125Q131.85938 73.125 131.14062 72.359375Q130.4375 71.59375 130.4375 70.171875Q130.4375 69.25 130.73438 68.5625Q131.04688 67.859375 131.67188 67.515625Q132.29688 67.171875 133.03125 67.171875Q133.95312 67.171875 134.54688 67.640625Q135.14062 68.109375 135.3125 68.96875L134.35938 69.109375Q134.23438 68.546875 133.89062 68.265625Q133.54688 67.96875 133.0625 67.96875Q132.34375 67.96875 131.875 68.5Q131.42188 69.015625 131.42188 70.140625Q131.42188 71.296875 131.85938 71.8125Q132.29688 72.328125 133.01562 72.328125Q133.57812 72.328125 133.95312 71.984375Q134.34375 71.640625 134.45312 70.90625ZM136.71875 73.0L136.71875 65.125L137.6875 65.125L137.6875 67.953125Q138.375 67.171875 139.40625 67.171875Q140.03125 67.171875 140.5 67.421875Q140.96875 67.671875 141.17188 68.109375Q141.375 68.546875 141.375 69.390625L141.375 73.0L140.40625 73.0L140.40625 69.390625Q140.40625 68.65625 140.09375 68.328125Q139.78125 68.0 139.20312 68.0Q138.76562 68.0 138.39062 68.21875Q138.01562 68.4375 137.84375 68.828125Q137.6875 69.203125 137.6875 69.875L137.6875 73.0L136.71875 73.0ZM143.0 68.390625L143.0 67.296875L144.09375 67.296875L144.09375 68.390625L143.0 68.390625ZM143.0 73.0L143.0 71.90625L144.09375 71.90625L144.09375 73.0L143.0 73.0ZM152.46875 73.0L152.46875 72.15625Q151.79688 73.125 150.65625 73.125Q150.15625 73.125 149.70312 72.9375Q149.26562 72.734375 149.04688 72.453125Q148.84375 72.15625 148.76562 71.734375Q148.70312 71.453125 148.70312 70.828125L148.70312 67.296875L149.67188 67.296875L149.67188 70.453125Q149.67188 71.21875 149.73438 71.484375Q149.82812 71.859375 150.10938 72.078125Q150.40625 72.296875 150.84375 72.296875Q151.28125 72.296875 151.65625 72.078125Q152.04688 71.84375 152.20312 71.46875Q152.35938 71.078125 152.35938 70.359375L152.35938 67.296875L153.32812 67.296875L153.32812 73.0L152.46875 73.0ZM154.71875 75.1875L154.71875 67.296875L155.60938 67.296875L155.60938 68.03125Q155.92188 67.609375 156.3125 67.390625Q156.70312 67.171875 157.26562 67.171875Q157.98438 67.171875 158.54688 67.546875Q159.10938 67.921875 159.39062 68.609375Q159.67188 69.28125 159.67188 70.109375Q159.67188 70.984375 159.35938 71.6875Q159.04688 72.375 158.4375 72.75Q157.84375 73.125 157.1875 73.125Q156.70312 73.125 156.3125 72.921875Q155.9375 72.71875 155.6875 72.40625L155.6875 75.1875L154.71875 75.1875ZM155.59375 70.1875Q155.59375 71.28125 156.04688 71.8125Q156.5 72.328125 157.125 72.328125Q157.76562 72.328125 158.21875 71.796875Q158.6875 71.25 158.6875 70.09375Q158.6875 69.015625 158.23438 68.46875Q157.79688 67.921875 157.17188 67.921875Q156.54688 67.921875 156.0625 68.5Q155.59375 69.078125 155.59375 70.1875ZM160.71875 75.1875L160.71875 67.296875L161.60938 67.296875L161.60938 68.03125Q161.92188 67.609375 162.3125 67.390625Q162.70312 67.171875 163.26562 67.171875Q163.98438 67.171875 164.54688 67.546875Q165.10938 67.921875 165.39062 68.609375Q165.67188 69.28125 165.67188 70.109375Q165.67188 70.984375 165.35938 71.6875Q165.04688 72.375 164.4375 72.75Q163.84375 73.125 163.1875 73.125Q162.70312 73.125 162.3125 72.921875Q161.9375 72.71875 161.6875 72.40625L161.6875 75.1875L160.71875 75.1875ZM161.59375 70.1875Q161.59375 71.28125 162.04688 71.8125Q162.5 72.328125 163.125 72.328125Q163.76562 72.328125 164.21875 71.796875Q164.6875 71.25 164.6875 70.09375Q164.6875 69.015625 164.23438 68.46875Q163.79688 67.921875 163.17188 67.921875Q162.54688 67.921875 162.0625 68.5Q161.59375 69.078125 161.59375 70.1875ZM170.625 71.15625L171.625 71.28125Q171.39062 72.15625 170.75 72.640625Q170.10938 73.125 169.125 73.125Q167.875 73.125 167.14062 72.359375Q166.40625 71.59375 166.40625 70.203125Q166.40625 68.75 167.14062 67.96875Q167.89062 67.171875 169.0625 67.171875Q170.21875 67.171875 170.9375 67.953125Q171.65625 68.71875 171.65625 70.140625Q171.65625 70.21875 171.65625 70.390625L167.40625 70.390625Q167.45312 71.328125 167.92188 71.828125Q168.40625 72.328125 169.125 72.328125Q169.65625 72.328125 170.03125 72.0625Q170.40625 71.78125 170.625 71.15625ZM167.45312 69.59375L170.64062 69.59375Q170.57812 68.875 170.28125 68.515625Q169.8125 67.96875 169.07812 67.96875Q168.40625 67.96875 167.95312 68.421875Q167.5 68.859375 167.45312 69.59375ZM172.71875 73.0L172.71875 67.296875L173.57812 67.296875L173.57812 68.15625Q173.92188 67.546875 174.20312 67.359375Q174.48438 67.171875 174.8125 67.171875Q175.3125 67.171875 175.8125 67.484375L175.48438 68.375Q175.125 68.171875 174.76562 68.171875Q174.45312 68.171875 174.20312 68.359375Q173.95312 68.546875 173.84375 68.890625Q173.6875 69.40625 173.6875 70.015625L173.6875 73.0L172.71875 73.0ZM180.45312 70.90625L181.39062 71.03125Q181.25 72.015625 180.59375 72.578125Q179.95312 73.125 179.03125 73.125Q177.85938 73.125 177.14062 72.359375Q176.4375 71.59375 176.4375 70.171875Q176.4375 69.25 176.73438 68.5625Q177.04688 67.859375 177.67188 67.515625Q178.29688 67.171875 179.03125 67.171875Q179.95312 67.171875 180.54688 67.640625Q181.14062 68.109375 181.3125 68.96875L180.35938 69.109375Q180.23438 68.546875 179.89062 68.265625Q179.54688 67.96875 179.0625 67.96875Q178.34375 67.96875 177.875 68.5Q177.42188 69.015625 177.42188 70.140625Q177.42188 71.296875 177.85938 71.8125Q178.29688 72.328125 179.01562 72.328125Q179.57812 72.328125 179.95312 71.984375Q180.34375 71.640625 180.45312 70.90625ZM186.45312 72.296875Q185.90625 72.75 185.40625 72.9375Q184.92188 73.125 184.34375 73.125Q183.40625 73.125 182.89062 72.671875Q182.39062 72.203125 182.39062 71.5Q182.39062 71.078125 182.57812 70.734375Q182.78125 70.390625 183.07812 70.1875Q183.39062 69.96875 183.78125 69.859375Q184.0625 69.78125 184.64062 69.71875Q185.8125 69.578125 186.35938 69.375Q186.375 69.1875 186.375 69.125Q186.375 68.53125 186.09375 68.296875Q185.73438 67.96875 185.0 67.96875Q184.3125 67.96875 183.98438 68.203125Q183.67188 68.4375 183.51562 69.046875L182.5625 68.921875Q182.6875 68.3125 182.98438 67.9375Q183.28125 67.5625 183.84375 67.375Q184.40625 67.171875 185.14062 67.171875Q185.875 67.171875 186.32812 67.34375Q186.78125 67.515625 186.98438 67.78125Q187.20312 68.03125 187.29688 68.421875Q187.34375 68.671875 187.34375 69.328125L187.34375 70.609375Q187.34375 71.953125 187.40625 72.3125Q187.46875 72.671875 187.65625 73.0L186.64062 73.0Q186.48438 72.703125 186.45312 72.296875ZM186.35938 70.140625Q185.84375 70.359375 184.78125 70.5Q184.1875 70.59375 183.9375 70.703125Q183.70312 70.796875 183.5625 71.015625Q183.42188 71.21875 183.42188 71.46875Q183.42188 71.859375 183.71875 72.125Q184.01562 72.375 184.57812 72.375Q185.14062 72.375 185.5625 72.125Q186.0 71.875 186.21875 71.453125Q186.35938 71.125 186.35938 70.484375L186.35938 70.140625ZM188.34375 71.296875L189.29688 71.140625Q189.375 71.71875 189.73438 72.03125Q190.10938 72.328125 190.76562 72.328125Q191.4375 72.328125 191.75 72.0625Q192.07812 71.796875 192.07812 71.421875Q192.07812 71.09375 191.79688 70.90625Q191.59375 70.78125 190.8125 70.578125Q189.75 70.3125 189.32812 70.125Q188.92188 69.921875 188.70312 69.578125Q188.5 69.234375 188.5 68.8125Q188.5 68.421875 188.67188 68.109375Q188.84375 67.78125 189.15625 67.5625Q189.375 67.390625 189.76562 67.28125Q190.15625 67.171875 190.59375 67.171875Q191.26562 67.171875 191.76562 67.359375Q192.28125 67.546875 192.51562 67.890625Q192.76562 68.21875 192.85938 68.765625L191.92188 68.890625Q191.84375 68.453125 191.53125 68.21875Q191.23438 67.96875 190.67188 67.96875Q190.0 67.96875 189.71875 68.1875Q189.4375 68.40625 189.4375 68.703125Q189.4375 68.890625 189.54688 69.03125Q189.67188 69.1875 189.92188 69.296875Q190.0625 69.34375 190.78125 69.546875Q191.79688 69.8125 192.20312 69.984375Q192.60938 70.15625 192.84375 70.5Q193.07812 70.828125 193.07812 71.328125Q193.07812 71.8125 192.79688 72.234375Q192.51562 72.65625 191.98438 72.890625Q191.45312 73.125 190.78125 73.125Q189.67188 73.125 189.07812 72.671875Q188.5 72.203125 188.34375 71.296875ZM198.625 71.15625L199.625 71.28125Q199.39062 72.15625 198.75 72.640625Q198.10938 73.125 197.125 73.125Q195.875 73.125 195.14062 72.359375Q194.40625 71.59375 194.40625 70.203125Q194.40625 68.75 195.14062 67.96875Q195.89062 67.171875 197.0625 67.171875Q198.21875 67.171875 198.9375 67.953125Q199.65625 68.71875 199.65625 70.140625Q199.65625 70.21875 199.65625 70.390625L195.40625 70.390625Q195.45312 71.328125 195.92188 71.828125Q196.40625 72.328125 197.125 72.328125Q197.65625 72.328125 198.03125 72.0625Q198.40625 71.78125 198.625 71.15625ZM195.45312 69.59375L198.64062 69.59375Q198.57812 68.875 198.28125 68.515625Q197.8125 67.96875 197.07812 67.96875Q196.40625 67.96875 195.95312 68.421875Q195.5 68.859375 195.45312 69.59375ZM200.98438 73.0L200.98438 71.90625L202.07812 71.90625L202.07812 73.0Q202.07812 73.609375 201.85938 73.984375Q201.65625 74.359375 201.1875 74.5625L200.90625 74.140625Q201.21875 74.015625 201.35938 73.75Q201.51562 73.484375 201.53125 73.0L200.98438 73.0ZM206.70312 73.0L206.70312 65.125L207.67188 65.125L207.67188 73.0L206.70312 73.0ZM208.35938 70.140625Q208.35938 68.5625 209.25 67.796875Q209.98438 67.171875 211.04688 67.171875Q212.21875 67.171875 212.95312 67.9375Q213.70312 68.703125 213.70312 70.0625Q213.70312 71.171875 213.375 71.8125Q213.04688 72.4375 212.40625 72.78125Q211.78125 73.125 211.04688 73.125Q209.84375 73.125 209.09375 72.359375Q208.35938 71.59375 208.35938 70.140625ZM209.35938 70.140625Q209.35938 71.25 209.82812 71.796875Q210.3125 72.328125 211.04688 72.328125Q211.76562 72.328125 212.23438 71.78125Q212.71875 71.234375 212.71875 70.109375Q212.71875 69.0625 212.23438 68.515625Q211.75 67.96875 211.04688 67.96875Q210.3125 67.96875 209.82812 68.515625Q209.35938 69.046875 209.35938 70.140625ZM215.78125 73.0L214.03125 67.296875L215.03125 67.296875L215.9375 70.59375L216.28125 71.8125Q216.29688 71.71875 216.57812 70.640625L217.48438 67.296875L218.46875 67.296875L219.32812 70.609375L219.60938 71.6875L219.9375 70.59375L220.92188 67.296875L221.85938 67.296875L220.07812 73.0L219.07812 73.0L218.15625 69.578125L217.9375 68.609375L216.78125 73.0L215.78125 73.0ZM226.625 71.15625L227.625 71.28125Q227.39062 72.15625 226.75 72.640625Q226.10938 73.125 225.125 73.125Q223.875 73.125 223.14062 72.359375Q222.40625 71.59375 222.40625 70.203125Q222.40625 68.75 223.14062 67.96875Q223.89062 67.171875 225.0625 67.171875Q226.21875 67.171875 226.9375 67.953125Q227.65625 68.71875 227.65625 70.140625Q227.65625 70.21875 227.65625 70.390625L223.40625 70.390625Q223.45312 71.328125 223.92188 71.828125Q224.40625 72.328125 225.125 72.328125Q225.65625 72.328125 226.03125 72.0625Q226.40625 71.78125 226.625 71.15625ZM223.45312 69.59375L226.64062 69.59375Q226.57812 68.875 226.28125 68.515625Q225.8125 67.96875 225.07812 67.96875Q224.40625 67.96875 223.95312 68.421875Q223.5 68.859375 223.45312 69.59375ZM228.71875 73.0L228.71875 67.296875L229.57812 67.296875L229.57812 68.15625Q229.92188 67.546875 230.20312 67.359375Q230.48438 67.171875 230.8125 67.171875Q231.3125 67.171875 231.8125 67.484375L231.48438 68.375Q231.125 68.171875 230.76562 68.171875Q230.45312 68.171875 230.20312 68.359375Q229.95312 68.546875 229.84375 68.890625Q229.6875 69.40625 229.6875 70.015625L229.6875 73.0L228.71875 73.0ZM236.45312 70.90625L237.39062 71.03125Q237.25 72.015625 236.59375 72.578125Q235.95312 73.125 235.03125 73.125Q233.85938 73.125 233.14062 72.359375Q232.4375 71.59375 232.4375 70.171875Q232.4375 69.25 232.73438 68.5625Q233.04688 67.859375 233.67188 67.515625Q234.29688 67.171875 235.03125 67.171875Q235.95312 67.171875 236.54688 67.640625Q237.14062 68.109375 237.3125 68.96875L236.35938 69.109375Q236.23438 68.546875 235.89062 68.265625Q235.54688 67.96875 235.0625 67.96875Q234.34375 67.96875 233.875 68.5Q233.42188 69.015625 233.42188 70.140625Q233.42188 71.296875 233.85938 71.8125Q234.29688 72.328125 235.01562 72.328125Q235.57812 72.328125 235.95312 71.984375Q236.34375 71.640625 236.45312 70.90625ZM242.45312 72.296875Q241.90625 72.75 241.40625 72.9375Q240.92188 73.125 240.34375 73.125Q239.40625 73.125 238.89062 72.671875Q238.39062 72.203125 238.39062 71.5Q238.39062 71.078125 238.57812 70.734375Q238.78125 70.390625 239.07812 70.1875Q239.39062 69.96875 239.78125 69.859375Q240.0625 69.78125 240.64062 69.71875Q241.8125 69.578125 242.35938 69.375Q242.375 69.1875 242.375 69.125Q242.375 68.53125 242.09375 68.296875Q241.73438 67.96875 241.0 67.96875Q240.3125 67.96875 239.98438 68.203125Q239.67188 68.4375 239.51562 69.046875L238.5625 68.921875Q238.6875 68.3125 238.98438 67.9375Q239.28125 67.5625 239.84375 67.375Q240.40625 67.171875 241.14062 67.171875Q241.875 67.171875 242.32812 67.34375Q242.78125 67.515625 242.98438 67.78125Q243.20312 68.03125 243.29688 68.421875Q243.34375 68.671875 243.34375 69.328125L243.34375 70.609375Q243.34375 71.953125 243.40625 72.3125Q243.46875 72.671875 243.65625 73.0L242.64062 73.0Q242.48438 72.703125 242.45312 72.296875ZM242.35938 70.140625Q241.84375 70.359375 240.78125 70.5Q240.1875 70.59375 239.9375 70.703125Q239.70312 70.796875 239.5625 71.015625Q239.42188 71.21875 239.42188 71.46875Q239.42188 71.859375 239.71875 72.125Q240.01562 72.375 240.57812 72.375Q241.14062 72.375 241.5625 72.125Q242.0 71.875 242.21875 71.453125Q242.35938 71.125 242.35938 70.484375L242.35938 70.140625ZM244.34375 71.296875L245.29688 71.140625Q245.375 71.71875 245.73438 72.03125Q246.10938 72.328125 246.76562 72.328125Q247.4375 72.328125 247.75 72.0625Q248.07812 71.796875 248.07812 71.421875Q248.07812 71.09375 247.79688 70.90625Q247.59375 70.78125 246.8125 70.578125Q245.75 70.3125 245.32812 70.125Q244.92188 69.921875 244.70312 69.578125Q244.5 69.234375 244.5 68.8125Q244.5 68.421875 244.67188 68.109375Q244.84375 67.78125 245.15625 67.5625Q245.375 67.390625 245.76562 67.28125Q246.15625 67.171875 246.59375 67.171875Q247.26562 67.171875 247.76562 67.359375Q248.28125 67.546875 248.51562 67.890625Q248.76562 68.21875 248.85938 68.765625L247.92188 68.890625Q247.84375 68.453125 247.53125 68.21875Q247.23438 67.96875 246.67188 67.96875Q246.0 67.96875 245.71875 68.1875Q245.4375 68.40625 245.4375 68.703125Q245.4375 68.890625 245.54688 69.03125Q245.67188 69.1875 245.92188 69.296875Q246.0625 69.34375 246.78125 69.546875Q247.79688 69.8125 248.20312 69.984375Q248.60938 70.15625 248.84375 70.5Q249.07812 70.828125 249.07812 71.328125Q249.07812 71.8125 248.79688 72.234375Q248.51562 72.65625 247.98438 72.890625Q247.45312 73.125 246.78125 73.125Q245.67188 73.125 245.07812 72.671875Q244.5 72.203125 244.34375 71.296875ZM254.625 71.15625L255.625 71.28125Q255.39062 72.15625 254.75 72.640625Q254.10938 73.125 253.125 73.125Q251.875 73.125 251.14062 72.359375Q250.40625 71.59375 250.40625 70.203125Q250.40625 68.75 251.14062 67.96875Q251.89062 67.171875 253.0625 67.171875Q254.21875 67.171875 254.9375 67.953125Q255.65625 68.71875 255.65625 70.140625Q255.65625 70.21875 255.65625 70.390625L251.40625 70.390625Q251.45312 71.328125 251.92188 71.828125Q252.40625 72.328125 253.125 72.328125Q253.65625 72.328125 254.03125 72.0625Q254.40625 71.78125 254.625 71.15625ZM251.45312 69.59375L254.64062 69.59375Q254.57812 68.875 254.28125 68.515625Q253.8125 67.96875 253.07812 67.96875Q252.40625 67.96875 251.95312 68.421875Q251.5 68.859375 251.45312 69.59375ZM256.98438 73.0L256.98438 71.90625L258.07812 71.90625L258.07812 73.0Q258.07812 73.609375 257.85938 73.984375Q257.65625 74.359375 257.1875 74.5625L256.90625 74.140625Q257.21875 74.015625 257.35938 73.75Q257.51562 73.484375 257.53125 73.0L256.98438 73.0ZM262.71875 73.0L262.71875 67.296875L263.59375 67.296875L263.59375 68.109375Q264.21875 67.171875 265.40625 67.171875Q265.92188 67.171875 266.35938 67.359375Q266.79688 67.53125 267.0 67.84375Q267.21875 68.140625 267.3125 68.546875Q267.35938 68.828125 267.35938 69.5L267.35938 73.0L266.39062 73.0L266.39062 69.53125Q266.39062 68.9375 266.28125 68.65625Q266.17188 68.359375 265.875 68.1875Q265.59375 68.0 265.20312 68.0Q264.59375 68.0 264.14062 68.390625Q263.6875 68.78125 263.6875 69.890625L263.6875 73.0L262.71875 73.0ZM272.46875 73.0L272.46875 72.15625Q271.79688 73.125 270.65625 73.125Q270.15625 73.125 269.70312 72.9375Q269.26562 72.734375 269.04688 72.453125Q268.84375 72.15625 268.76562 71.734375Q268.70312 71.453125 268.70312 70.828125L268.70312 67.296875L269.67188 67.296875L269.67188 70.453125Q269.67188 71.21875 269.73438 71.484375Q269.82812 71.859375 270.10938 72.078125Q270.40625 72.296875 270.84375 72.296875Q271.28125 72.296875 271.65625 72.078125Q272.04688 71.84375 272.20312 71.46875Q272.35938 71.078125 272.35938 70.359375L272.35938 67.296875L273.32812 67.296875L273.32812 73.0L272.46875 73.0ZM274.71875 73.0L274.71875 67.296875L275.59375 67.296875L275.59375 68.09375Q275.85938 67.671875 276.29688 67.421875Q276.75 67.171875 277.3125 67.171875Q277.95312 67.171875 278.35938 67.4375Q278.76562 67.6875 278.9375 68.171875Q279.60938 67.171875 280.6875 67.171875Q281.54688 67.171875 282.0 67.640625Q282.45312 68.109375 282.45312 69.078125L282.45312 73.0L281.5 73.0L281.5 69.40625Q281.5 68.828125 281.40625 68.578125Q281.3125 68.3125 281.0625 68.15625Q280.8125 68.0 280.48438 68.0Q279.875 68.0 279.46875 68.40625Q279.07812 68.8125 279.07812 69.6875L279.07812 73.0L278.10938 73.0L278.10938 69.296875Q278.10938 68.65625 277.875 68.328125Q277.64062 68.0 277.10938 68.0Q276.70312 68.0 276.34375 68.21875Q276.0 68.4375 275.84375 68.859375Q275.6875 69.265625 275.6875 70.046875L275.6875 73.0L274.71875 73.0ZM287.625 71.15625L288.625 71.28125Q288.39062 72.15625 287.75 72.640625Q287.10938 73.125 286.125 73.125Q284.875 73.125 284.14062 72.359375Q283.40625 71.59375 283.40625 70.203125Q283.40625 68.75 284.14062 67.96875Q284.89062 67.171875 286.0625 67.171875Q287.21875 67.171875 287.9375 67.953125Q288.65625 68.71875 288.65625 70.140625Q288.65625 70.21875 288.65625 70.390625L284.40625 70.390625Q284.45312 71.328125 284.92188 71.828125Q285.40625 72.328125 286.125 72.328125Q286.65625 72.328125 287.03125 72.0625Q287.40625 71.78125 287.625 71.15625ZM284.45312 69.59375L287.64062 69.59375Q287.57812 68.875 287.28125 68.515625Q286.8125 67.96875 286.07812 67.96875Q285.40625 67.96875 284.95312 68.421875Q284.5 68.859375 284.45312 69.59375ZM289.71875 73.0L289.71875 67.296875L290.57812 67.296875L290.57812 68.15625Q290.92188 67.546875 291.20312 67.359375Q291.48438 67.171875 291.8125 67.171875Q292.3125 67.171875 292.8125 67.484375L292.48438 68.375Q292.125 68.171875 291.76562 68.171875Q291.45312 68.171875 291.20312 68.359375Q290.95312 68.546875 290.84375 68.890625Q290.6875 69.40625 290.6875 70.015625L290.6875 73.0L289.71875 73.0ZM293.73438 66.234375L293.73438 65.125L294.70312 65.125L294.70312 66.234375L293.73438 66.234375ZM293.73438 73.0L293.73438 67.296875L294.70312 67.296875L294.70312 73.0L293.73438 73.0ZM299.45312 70.90625L300.39062 71.03125Q300.25 72.015625 299.59375 72.578125Q298.95312 73.125 298.03125 73.125Q296.85938 73.125 296.14062 72.359375Q295.4375 71.59375 295.4375 70.171875Q295.4375 69.25 295.73438 68.5625Q296.04688 67.859375 296.67188 67.515625Q297.29688 67.171875 298.03125 67.171875Q298.95312 67.171875 299.54688 67.640625Q300.14062 68.109375 300.3125 68.96875L299.35938 69.109375Q299.23438 68.546875 298.89062 68.265625Q298.54688 67.96875 298.0625 67.96875Q297.34375 67.96875 296.875 68.5Q296.42188 69.015625 296.42188 70.140625Q296.42188 71.296875 296.85938 71.8125Q297.29688 72.328125 298.01562 72.328125Q298.57812 72.328125 298.95312 71.984375Q299.34375 71.640625 299.45312 70.90625ZM301.98438 73.0L301.98438 71.90625L303.07812 71.90625L303.07812 73.0Q303.07812 73.609375 302.85938 73.984375Q302.65625 74.359375 302.1875 74.5625L301.90625 74.140625Q302.21875 74.015625 302.35938 73.75Q302.51562 73.484375 302.53125 73.0L301.98438 73.0ZM307.73438 67.90625L307.48438 66.4375L307.48438 65.125L308.57812 65.125L308.57812 66.4375L308.32812 67.90625L307.73438 67.90625ZM310.23438 71.046875L309.95312 66.875L309.95312 65.125L311.14062 65.125L311.14062 66.875L310.85938 71.046875L310.23438 71.046875ZM309.98438 73.0L309.98438 71.90625L311.09375 71.90625L311.09375 73.0L309.98438 73.0ZM318.23438 72.125Q317.89062 72.53125 317.45312 72.78125Q317.01562 73.015625 316.59375 73.015625Q316.10938 73.015625 315.65625 72.734375Q315.20312 72.453125 314.92188 71.875Q314.64062 71.296875 314.64062 70.609375Q314.64062 69.75 315.07812 68.890625Q315.51562 68.03125 316.15625 67.609375Q316.8125 67.171875 317.4375 67.171875Q317.89062 67.171875 318.3125 67.421875Q318.75 67.671875 319.04688 68.171875L319.23438 67.328125L320.20312 67.328125L319.42188 70.9375Q319.26562 71.6875 319.26562 71.765625Q319.26562 71.921875 319.375 72.03125Q319.48438 72.125 319.64062 72.125Q319.92188 72.125 320.39062 71.796875Q321.0 71.359375 321.35938 70.640625Q321.71875 69.921875 321.71875 69.15625Q321.71875 68.25 321.25 67.484375Q320.79688 66.703125 319.875 66.234375Q318.96875 65.765625 317.875 65.765625Q316.60938 65.765625 315.5625 66.359375Q314.53125 66.9375 313.95312 68.046875Q313.39062 69.140625 313.39062 70.390625Q313.39062 71.703125 313.95312 72.65625Q314.53125 73.609375 315.60938 74.0625Q316.70312 74.515625 318.01562 74.515625Q319.42188 74.515625 320.375 74.046875Q321.32812 73.578125 321.79688 72.890625L322.76562 72.890625Q322.5 73.46875 321.82812 74.046875Q321.15625 74.640625 320.23438 74.96875Q319.32812 75.3125 318.03125 75.3125Q316.84375 75.3125 315.82812 75.0Q314.82812 74.703125 314.10938 74.078125Q313.40625 73.46875 313.04688 72.671875Q312.59375 71.65625 312.59375 70.484375Q312.59375 69.171875 313.14062 67.984375Q313.78125 66.53125 314.98438 65.765625Q316.20312 64.984375 317.92188 64.984375Q319.25 64.984375 320.3125 65.53125Q321.375 66.078125 321.98438 67.15625Q322.5 68.078125 322.5 69.171875Q322.5 70.734375 321.40625 71.9375Q320.4375 73.015625 319.26562 73.015625Q318.90625 73.015625 318.67188 72.90625Q318.45312 72.796875 318.34375 72.59375Q318.26562 72.453125 318.23438 72.125ZM315.64062 70.671875Q315.64062 71.40625 315.98438 71.8125Q316.32812 72.21875 316.78125 72.21875Q317.09375 72.21875 317.42188 72.046875Q317.75 71.859375 318.04688 71.515625Q318.35938 71.15625 318.54688 70.609375Q318.75 70.0625 318.75 69.515625Q318.75 68.78125 318.375 68.390625Q318.01562 67.984375 317.5 67.984375Q317.15625 67.984375 316.84375 68.15625Q316.54688 68.328125 316.26562 68.71875Q315.98438 69.09375 315.8125 69.65625Q315.64062 70.203125 315.64062 70.671875ZM323.54688 73.140625L324.01562 70.84375L323.10938 70.84375L323.10938 70.046875L324.1875 70.046875L324.57812 68.09375L323.10938 68.09375L323.10938 67.296875L324.73438 67.296875L325.20312 64.984375L326.01562 64.984375L325.54688 67.296875L327.23438 67.296875L327.70312 64.984375L328.51562 64.984375L328.04688 67.296875L328.98438 67.296875L328.98438 68.09375L327.89062 68.09375L327.48438 70.046875L328.98438 70.046875L328.98438 70.84375L327.32812 70.84375L326.85938 73.140625L326.04688 73.140625L326.51562 70.84375L324.82812 70.84375L324.35938 73.140625L323.54688 73.140625ZM324.98438 70.046875L326.67188 70.046875L327.07812 68.09375L325.39062 68.09375L324.98438 70.046875ZM331.73438 74.140625L331.73438 73.171875Q331.01562 73.078125 330.5625 72.84375Q330.10938 72.609375 329.78125 72.09375Q329.45312 71.5625 329.39062 70.8125L330.35938 70.625Q330.48438 71.40625 330.76562 71.78125Q331.17188 72.296875 331.73438 72.34375L331.73438 69.265625Q331.14062 69.15625 330.51562 68.8125Q330.0625 68.546875 329.8125 68.09375Q329.5625 67.640625 329.5625 67.0625Q329.5625 66.03125 330.29688 65.390625Q330.78125 64.953125 331.73438 64.859375L331.73438 64.40625L332.3125 64.40625L332.3125 64.859375Q333.15625 64.9375 333.64062 65.359375Q334.28125 65.890625 334.40625 66.796875L333.40625 66.953125Q333.32812 66.375 333.04688 66.078125Q332.78125 65.78125 332.3125 65.671875L332.3125 68.46875Q333.04688 68.65625 333.28125 68.75Q333.73438 68.953125 334.01562 69.234375Q334.29688 69.515625 334.45312 69.90625Q334.60938 70.296875 334.60938 70.765625Q334.60938 71.765625 333.96875 72.4375Q333.32812 73.109375 332.3125 73.15625L332.3125 74.140625L331.73438 74.140625ZM331.73438 65.671875Q331.17188 65.75 330.84375 66.125Q330.53125 66.484375 330.53125 66.984375Q330.53125 67.484375 330.79688 67.8125Q331.07812 68.140625 331.73438 68.34375L331.73438 65.671875ZM332.3125 72.34375Q332.875 72.28125 333.23438 71.859375Q333.60938 71.4375 333.60938 70.828125Q333.60938 70.296875 333.34375 69.984375Q333.09375 69.65625 332.3125 69.40625L332.3125 72.34375ZM335.73438 67.90625L335.48438 66.4375L335.48438 65.125L336.57812 65.125L336.57812 66.4375L336.32812 67.90625L335.73438 67.90625Z" fill-rule="nonzero"/><path stroke="#ea4335" stroke-width="4.0" stroke-linecap="butt" d="M353.0 69.5L365.0 69.5" fill-rule="nonzero"/><path fill="#1a1a1a" d="M373.53125 69.171875Q373.53125 67.203125 374.57812 66.09375Q375.64062 64.984375 377.29688 64.984375Q378.39062 64.984375 379.26562 65.515625Q380.14062 66.03125 380.59375 66.96875Q381.0625 67.890625 381.0625 69.078125Q381.0625 70.265625 380.57812 71.21875Q380.09375 72.15625 379.20312 72.65625Q378.32812 73.140625 377.29688 73.140625Q376.1875 73.140625 375.3125 72.609375Q374.4375 72.0625 373.98438 71.140625Q373.53125 70.203125 373.53125 69.171875ZM374.60938 69.1875Q374.60938 70.609375 375.375 71.4375Q376.14062 72.25 377.29688 72.25Q378.46875 72.25 379.21875 71.421875Q379.98438 70.59375 379.98438 69.0625Q379.98438 68.109375 379.65625 67.390625Q379.34375 66.671875 378.71875 66.28125Q378.09375 65.890625 377.3125 65.890625Q376.20312 65.890625 375.40625 66.65625Q374.60938 67.40625 374.60938 69.1875ZM382.71875 73.0L382.71875 67.296875L383.59375 67.296875L383.59375 68.109375Q384.21875 67.171875 385.40625 67.171875Q385.92188 67.171875 386.35938 67.359375Q386.79688 67.53125 387.0 67.84375Q387.21875 68.140625 387.3125 68.546875Q387.35938 68.828125 387.35938 69.5L387.35938 73.0L386.39062 73.0L386.39062 69.53125Q386.39062 68.9375 386.28125 68.65625Q386.17188 68.359375 385.875 68.1875Q385.59375 68.0 385.20312 68.0Q384.59375 68.0 384.14062 68.390625Q383.6875 68.78125 383.6875 69.890625L383.6875 73.0L382.71875 73.0ZM392.625 71.15625L393.625 71.28125Q393.39062 72.15625 392.75 72.640625Q392.10938 73.125 391.125 73.125Q389.875 73.125 389.14062 72.359375Q388.40625 71.59375 388.40625 70.203125Q388.40625 68.75 389.14062 67.96875Q389.89062 67.171875 391.0625 67.171875Q392.21875 67.171875 392.9375 67.953125Q393.65625 68.71875 393.65625 70.140625Q393.65625 70.21875 393.65625 70.390625L389.40625 70.390625Q389.45312 71.328125 389.92188 71.828125Q390.40625 72.328125 391.125 72.328125Q391.65625 72.328125 392.03125 72.0625Q392.40625 71.78125 392.625 71.15625ZM389.45312 69.59375L392.64062 69.59375Q392.57812 68.875 392.28125 68.515625Q391.8125 67.96875 391.07812 67.96875Q390.40625 67.96875 389.95312 68.421875Q389.5 68.859375 389.45312 69.59375ZM401.625 71.15625L402.625 71.28125Q402.39062 72.15625 401.75 72.640625Q401.10938 73.125 400.125 73.125Q398.875 73.125 398.14062 72.359375Q397.40625 71.59375 397.40625 70.203125Q397.40625 68.75 398.14062 67.96875Q398.89062 67.171875 400.0625 67.171875Q401.21875 67.171875 401.9375 67.953125Q402.65625 68.71875 402.65625 70.140625Q402.65625 70.21875 402.65625 70.390625L398.40625 70.390625Q398.45312 71.328125 398.92188 71.828125Q399.40625 72.328125 400.125 72.328125Q400.65625 72.328125 401.03125 72.0625Q401.40625 71.78125 401.625 71.15625ZM398.45312 69.59375L401.64062 69.59375Q401.57812 68.875 401.28125 68.515625Q400.8125 67.96875 400.07812 67.96875Q399.40625 67.96875 398.95312 68.421875Q398.5 68.859375 398.45312 69.59375ZM407.45312 72.296875Q406.90625 72.75 406.40625 72.9375Q405.92188 73.125 405.34375 73.125Q404.40625 73.125 403.89062 72.671875Q403.39062 72.203125 403.39062 71.5Q403.39062 71.078125 403.57812 70.734375Q403.78125 70.390625 404.07812 70.1875Q404.39062 69.96875 404.78125 69.859375Q405.0625 69.78125 405.64062 69.71875Q406.8125 69.578125 407.35938 69.375Q407.375 69.1875 407.375 69.125Q407.375 68.53125 407.09375 68.296875Q406.73438 67.96875 406.0 67.96875Q405.3125 67.96875 404.98438 68.203125Q404.67188 68.4375 404.51562 69.046875L403.5625 68.921875Q403.6875 68.3125 403.98438 67.9375Q404.28125 67.5625 404.84375 67.375Q405.40625 67.171875 406.14062 67.171875Q406.875 67.171875 407.32812 67.34375Q407.78125 67.515625 407.98438 67.78125Q408.20312 68.03125 408.29688 68.421875Q408.34375 68.671875 408.34375 69.328125L408.34375 70.609375Q408.34375 71.953125 408.40625 72.3125Q408.46875 72.671875 408.65625 73.0L407.64062 73.0Q407.48438 72.703125 407.45312 72.296875ZM407.35938 70.140625Q406.84375 70.359375 405.78125 70.5Q405.1875 70.59375 404.9375 70.703125Q404.70312 70.796875 404.5625 71.015625Q404.42188 71.21875 404.42188 71.46875Q404.42188 71.859375 404.71875 72.125Q405.01562 72.375 405.57812 72.375Q406.14062 72.375 406.5625 72.125Q407.0 71.875 407.21875 71.453125Q407.35938 71.125 407.35938 70.484375L407.35938 70.140625ZM413.45312 70.90625L414.39062 71.03125Q414.25 72.015625 413.59375 72.578125Q412.95312 73.125 412.03125 73.125Q410.85938 73.125 410.14062 72.359375Q409.4375 71.59375 409.4375 70.171875Q409.4375 69.25 409.73438 68.5625Q410.04688 67.859375 410.67188 67.515625Q411.29688 67.171875 412.03125 67.171875Q412.95312 67.171875 413.54688 67.640625Q414.14062 68.109375 414.3125 68.96875L413.35938 69.109375Q413.23438 68.546875 412.89062 68.265625Q412.54688 67.96875 412.0625 67.96875Q411.34375 67.96875 410.875 68.5Q410.42188 69.015625 410.42188 70.140625Q410.42188 71.296875 410.85938 71.8125Q411.29688 72.328125 412.01562 72.328125Q412.57812 72.328125 412.95312 71.984375Q413.34375 71.640625 413.45312 70.90625ZM415.71875 73.0L415.71875 65.125L416.6875 65.125L416.6875 67.953125Q417.375 67.171875 418.40625 67.171875Q419.03125 67.171875 419.5 67.421875Q419.96875 67.671875 420.17188 68.109375Q420.375 68.546875 420.375 69.390625L420.375 73.0L419.40625 73.0L419.40625 69.390625Q419.40625 68.65625 419.09375 68.328125Q418.78125 68.0 418.20312 68.0Q417.76562 68.0 417.39062 68.21875Q417.01562 68.4375 416.84375 68.828125Q416.6875 69.203125 416.6875 69.875L416.6875 73.0L415.71875 73.0ZM422.0 68.390625L422.0 67.296875L423.09375 67.296875L423.09375 68.390625L422.0 68.390625ZM422.0 73.0L422.0 71.90625L423.09375 71.90625L423.09375 73.0L422.0 73.0ZM431.46875 73.0L431.46875 72.15625Q430.79688 73.125 429.65625 73.125Q429.15625 73.125 428.70312 72.9375Q428.26562 72.734375 428.04688 72.453125Q427.84375 72.15625 427.76562 71.734375Q427.70312 71.453125 427.70312 70.828125L427.70312 67.296875L428.67188 67.296875L428.67188 70.453125Q428.67188 71.21875 428.73438 71.484375Q428.82812 71.859375 429.10938 72.078125Q429.40625 72.296875 429.84375 72.296875Q430.28125 72.296875 430.65625 72.078125Q431.04688 71.84375 431.20312 71.46875Q431.35938 71.078125 431.35938 70.359375L431.35938 67.296875L432.32812 67.296875L432.32812 73.0L431.46875 73.0ZM433.71875 75.1875L433.71875 67.296875L434.60938 67.296875L434.60938 68.03125Q434.92188 67.609375 435.3125 67.390625Q435.70312 67.171875 436.26562 67.171875Q436.98438 67.171875 437.54688 67.546875Q438.10938 67.921875 438.39062 68.609375Q438.67188 69.28125 438.67188 70.109375Q438.67188 70.984375 438.35938 71.6875Q438.04688 72.375 437.4375 72.75Q436.84375 73.125 436.1875 73.125Q435.70312 73.125 435.3125 72.921875Q434.9375 72.71875 434.6875 72.40625L434.6875 75.1875L433.71875 75.1875ZM434.59375 70.1875Q434.59375 71.28125 435.04688 71.8125Q435.5 72.328125 436.125 72.328125Q436.76562 72.328125 437.21875 71.796875Q437.6875 71.25 437.6875 70.09375Q437.6875 69.015625 437.23438 68.46875Q436.79688 67.921875 436.17188 67.921875Q435.54688 67.921875 435.0625 68.5Q434.59375 69.078125 434.59375 70.1875ZM439.71875 75.1875L439.71875 67.296875L440.60938 67.296875L440.60938 68.03125Q440.92188 67.609375 441.3125 67.390625Q441.70312 67.171875 442.26562 67.171875Q442.98438 67.171875 443.54688 67.546875Q444.10938 67.921875 444.39062 68.609375Q444.67188 69.28125 444.67188 70.109375Q444.67188 70.984375 444.35938 71.6875Q444.04688 72.375 443.4375 72.75Q442.84375 73.125 442.1875 73.125Q441.70312 73.125 441.3125 72.921875Q440.9375 72.71875 440.6875 72.40625L440.6875 75.1875L439.71875 75.1875ZM440.59375 70.1875Q440.59375 71.28125 441.04688 71.8125Q441.5 72.328125 442.125 72.328125Q442.76562 72.328125 443.21875 71.796875Q443.6875 71.25 443.6875 70.09375Q443.6875 69.015625 443.23438 68.46875Q442.79688 67.921875 442.17188 67.921875Q441.54688 67.921875 441.0625 68.5Q440.59375 69.078125 440.59375 70.1875ZM449.625 71.15625L450.625 71.28125Q450.39062 72.15625 449.75 72.640625Q449.10938 73.125 448.125 73.125Q446.875 73.125 446.14062 72.359375Q445.40625 71.59375 445.40625 70.203125Q445.40625 68.75 446.14062 67.96875Q446.89062 67.171875 448.0625 67.171875Q449.21875 67.171875 449.9375 67.953125Q450.65625 68.71875 450.65625 70.140625Q450.65625 70.21875 450.65625 70.390625L446.40625 70.390625Q446.45312 71.328125 446.92188 71.828125Q447.40625 72.328125 448.125 72.328125Q448.65625 72.328125 449.03125 72.0625Q449.40625 71.78125 449.625 71.15625ZM446.45312 69.59375L449.64062 69.59375Q449.57812 68.875 449.28125 68.515625Q448.8125 67.96875 448.07812 67.96875Q447.40625 67.96875 446.95312 68.421875Q446.5 68.859375 446.45312 69.59375ZM451.71875 73.0L451.71875 67.296875L452.57812 67.296875L452.57812 68.15625Q452.92188 67.546875 453.20312 67.359375Q453.48438 67.171875 453.8125 67.171875Q454.3125 67.171875 454.8125 67.484375L454.48438 68.375Q454.125 68.171875 453.76562 68.171875Q453.45312 68.171875 453.20312 68.359375Q452.95312 68.546875 452.84375 68.890625Q452.6875 69.40625 452.6875 70.015625L452.6875 73.0L451.71875 73.0ZM459.45312 70.90625L460.39062 71.03125Q460.25 72.015625 459.59375 72.578125Q458.95312 73.125 458.03125 73.125Q456.85938 73.125 456.14062 72.359375Q455.4375 71.59375 455.4375 70.171875Q455.4375 69.25 455.73438 68.5625Q456.04688 67.859375 456.67188 67.515625Q457.29688 67.171875 458.03125 67.171875Q458.95312 67.171875 459.54688 67.640625Q460.14062 68.109375 460.3125 68.96875L459.35938 69.109375Q459.23438 68.546875 458.89062 68.265625Q458.54688 67.96875 458.0625 67.96875Q457.34375 67.96875 456.875 68.5Q456.42188 69.015625 456.42188 70.140625Q456.42188 71.296875 456.85938 71.8125Q457.29688 72.328125 458.01562 72.328125Q458.57812 72.328125 458.95312 71.984375Q459.34375 71.640625 459.45312 70.90625ZM465.45312 72.296875Q464.90625 72.75 464.40625 72.9375Q463.92188 73.125 463.34375 73.125Q462.40625 73.125 461.89062 72.671875Q461.39062 72.203125 461.39062 71.5Q461.39062 71.078125 461.57812 70.734375Q461.78125 70.390625 462.07812 70.1875Q462.39062 69.96875 462.78125 69.859375Q463.0625 69.78125 463.64062 69.71875Q464.8125 69.578125 465.35938 69.375Q465.375 69.1875 465.375 69.125Q465.375 68.53125 465.09375 68.296875Q464.73438 67.96875 464.0 67.96875Q463.3125 67.96875 462.98438 68.203125Q462.67188 68.4375 462.51562 69.046875L461.5625 68.921875Q461.6875 68.3125 461.98438 67.9375Q462.28125 67.5625 462.84375 67.375Q463.40625 67.171875 464.14062 67.171875Q464.875 67.171875 465.32812 67.34375Q465.78125 67.515625 465.98438 67.78125Q466.20312 68.03125 466.29688 68.421875Q466.34375 68.671875 466.34375 69.328125L466.34375 70.609375Q466.34375 71.953125 466.40625 72.3125Q466.46875 72.671875 466.65625 73.0L465.64062 73.0Q465.48438 72.703125 465.45312 72.296875ZM465.35938 70.140625Q464.84375 70.359375 463.78125 70.5Q463.1875 70.59375 462.9375 70.703125Q462.70312 70.796875 462.5625 71.015625Q462.42188 71.21875 462.42188 71.46875Q462.42188 71.859375 462.71875 72.125Q463.01562 72.375 463.57812 72.375Q464.14062 72.375 464.5625 72.125Q465.0 71.875 465.21875 71.453125Q465.35938 71.125 465.35938 70.484375L465.35938 70.140625ZM467.34375 71.296875L468.29688 71.140625Q468.375 71.71875 468.73438 72.03125Q469.10938 72.328125 469.76562 72.328125Q470.4375 72.328125 470.75 72.0625Q471.07812 71.796875 471.07812 71.421875Q471.07812 71.09375 470.79688 70.90625Q470.59375 70.78125 469.8125 70.578125Q468.75 70.3125 468.32812 70.125Q467.92188 69.921875 467.70312 69.578125Q467.5 69.234375 467.5 68.8125Q467.5 68.421875 467.67188 68.109375Q467.84375 67.78125 468.15625 67.5625Q468.375 67.390625 468.76562 67.28125Q469.15625 67.171875 469.59375 67.171875Q470.26562 67.171875 470.76562 67.359375Q471.28125 67.546875 471.51562 67.890625Q471.76562 68.21875 471.85938 68.765625L470.92188 68.890625Q470.84375 68.453125 470.53125 68.21875Q470.23438 67.96875 469.67188 67.96875Q469.0 67.96875 468.71875 68.1875Q468.4375 68.40625 468.4375 68.703125Q468.4375 68.890625 468.54688 69.03125Q468.67188 69.1875 468.92188 69.296875Q469.0625 69.34375 469.78125 69.546875Q470.79688 69.8125 471.20312 69.984375Q471.60938 70.15625 471.84375 70.5Q472.07812 70.828125 472.07812 71.328125Q472.07812 71.8125 471.79688 72.234375Q471.51562 72.65625 470.98438 72.890625Q470.45312 73.125 469.78125 73.125Q468.67188 73.125 468.07812 72.671875Q467.5 72.203125 467.34375 71.296875ZM477.625 71.15625L478.625 71.28125Q478.39062 72.15625 477.75 72.640625Q477.10938 73.125 476.125 73.125Q474.875 73.125 474.14062 72.359375Q473.40625 71.59375 473.40625 70.203125Q473.40625 68.75 474.14062 67.96875Q474.89062 67.171875 476.0625 67.171875Q477.21875 67.171875 477.9375 67.953125Q478.65625 68.71875 478.65625 70.140625Q478.65625 70.21875 478.65625 70.390625L474.40625 70.390625Q474.45312 71.328125 474.92188 71.828125Q475.40625 72.328125 476.125 72.328125Q476.65625 72.328125 477.03125 72.0625Q477.40625 71.78125 477.625 71.15625ZM474.45312 69.59375L477.64062 69.59375Q477.57812 68.875 477.28125 68.515625Q476.8125 67.96875 476.07812 67.96875Q475.40625 67.96875 474.95312 68.421875Q474.5 68.859375 474.45312 69.59375ZM479.98438 73.0L479.98438 71.90625L481.07812 71.90625L481.07812 73.0Q481.07812 73.609375 480.85938 73.984375Q480.65625 74.359375 480.1875 74.5625L479.90625 74.140625Q480.21875 74.015625 480.35938 73.75Q480.51562 73.484375 480.53125 73.0L479.98438 73.0ZM485.70312 73.0L485.70312 65.125L486.67188 65.125L486.67188 73.0L485.70312 73.0ZM487.35938 70.140625Q487.35938 68.5625 488.25 67.796875Q488.98438 67.171875 490.04688 67.171875Q491.21875 67.171875 491.95312 67.9375Q492.70312 68.703125 492.70312 70.0625Q492.70312 71.171875 492.375 71.8125Q492.04688 72.4375 491.40625 72.78125Q490.78125 73.125 490.04688 73.125Q488.84375 73.125 488.09375 72.359375Q487.35938 71.59375 487.35938 70.140625ZM488.35938 70.140625Q488.35938 71.25 488.82812 71.796875Q489.3125 72.328125 490.04688 72.328125Q490.76562 72.328125 491.23438 71.78125Q491.71875 71.234375 491.71875 70.109375Q491.71875 69.0625 491.23438 68.515625Q490.75 67.96875 490.04688 67.96875Q489.3125 67.96875 488.82812 68.515625Q488.35938 69.046875 488.35938 70.140625ZM494.78125 73.0L493.03125 67.296875L494.03125 67.296875L494.9375 70.59375L495.28125 71.8125Q495.29688 71.71875 495.57812 70.640625L496.48438 67.296875L497.46875 67.296875L498.32812 70.609375L498.60938 71.6875L498.9375 70.59375L499.92188 67.296875L500.85938 67.296875L499.07812 73.0L498.07812 73.0L497.15625 69.578125L496.9375 68.609375L495.78125 73.0L494.78125 73.0ZM505.625 71.15625L506.625 71.28125Q506.39062 72.15625 505.75 72.640625Q505.10938 73.125 504.125 73.125Q502.875 73.125 502.14062 72.359375Q501.40625 71.59375 501.40625 70.203125Q501.40625 68.75 502.14062 67.96875Q502.89062 67.171875 504.0625 67.171875Q505.21875 67.171875 505.9375 67.953125Q506.65625 68.71875 506.65625 70.140625Q506.65625 70.21875 506.65625 70.390625L502.40625 70.390625Q502.45312 71.328125 502.92188 71.828125Q503.40625 72.328125 504.125 72.328125Q504.65625 72.328125 505.03125 72.0625Q505.40625 71.78125 505.625 71.15625ZM502.45312 69.59375L505.64062 69.59375Q505.57812 68.875 505.28125 68.515625Q504.8125 67.96875 504.07812 67.96875Q503.40625 67.96875 502.95312 68.421875Q502.5 68.859375 502.45312 69.59375ZM507.71875 73.0L507.71875 67.296875L508.57812 67.296875L508.57812 68.15625Q508.92188 67.546875 509.20312 67.359375Q509.48438 67.171875 509.8125 67.171875Q510.3125 67.171875 510.8125 67.484375L510.48438 68.375Q510.125 68.171875 509.76562 68.171875Q509.45312 68.171875 509.20312 68.359375Q508.95312 68.546875 508.84375 68.890625Q508.6875 69.40625 508.6875 70.015625L508.6875 73.0L507.71875 73.0ZM515.4531 70.90625L516.3906 71.03125Q516.25 72.015625 515.59375 72.578125Q514.9531 73.125 514.03125 73.125Q512.8594 73.125 512.1406 72.359375Q511.4375 71.59375 511.4375 70.171875Q511.4375 69.25 511.73438 68.5625Q512.0469 67.859375 512.6719 67.515625Q513.2969 67.171875 514.03125 67.171875Q514.9531 67.171875 515.5469 67.640625Q516.1406 68.109375 516.3125 68.96875L515.3594 69.109375Q515.2344 68.546875 514.8906 68.265625Q514.5469 67.96875 514.0625 67.96875Q513.34375 67.96875 512.875 68.5Q512.4219 69.015625 512.4219 70.140625Q512.4219 71.296875 512.8594 71.8125Q513.2969 72.328125 514.0156 72.328125Q514.5781 72.328125 514.9531 71.984375Q515.34375 71.640625 515.4531 70.90625ZM521.4531 72.296875Q520.90625 72.75 520.40625 72.9375Q519.9219 73.125 519.34375 73.125Q518.40625 73.125 517.8906 72.671875Q517.3906 72.203125 517.3906 71.5Q517.3906 71.078125 517.5781 70.734375Q517.78125 70.390625 518.0781 70.1875Q518.3906 69.96875 518.78125 69.859375Q519.0625 69.78125 519.6406 69.71875Q520.8125 69.578125 521.3594 69.375Q521.375 69.1875 521.375 69.125Q521.375 68.53125 521.09375 68.296875Q520.7344 67.96875 520.0 67.96875Q519.3125 67.96875 518.9844 68.203125Q518.6719 68.4375 518.5156 69.046875L517.5625 68.921875Q517.6875 68.3125 517.9844 67.9375Q518.28125 67.5625 518.84375 67.375Q519.40625 67.171875 520.1406 67.171875Q520.875 67.171875 521.3281 67.34375Q521.78125 67.515625 521.9844 67.78125Q522.2031 68.03125 522.2969 68.421875Q522.34375 68.671875 522.34375 69.328125L522.34375 70.609375Q522.34375 71.953125 522.40625 72.3125Q522.46875 72.671875 522.65625 73.0L521.6406 73.0Q521.4844 72.703125 521.4531 72.296875ZM521.3594 70.140625Q520.84375 70.359375 519.78125 70.5Q519.1875 70.59375 518.9375 70.703125Q518.7031 70.796875 518.5625 71.015625Q518.4219 71.21875 518.4219 71.46875Q518.4219 71.859375 518.71875 72.125Q519.0156 72.375 519.5781 72.375Q520.1406 72.375 520.5625 72.125Q521.0 71.875 521.21875 71.453125Q521.3594 71.125 521.3594 70.484375L521.3594 70.140625ZM523.34375 71.296875L524.2969 71.140625Q524.375 71.71875 524.7344 72.03125Q525.1094 72.328125 525.7656 72.328125Q526.4375 72.328125 526.75 72.0625Q527.0781 71.796875 527.0781 71.421875Q527.0781 71.09375 526.7969 70.90625Q526.59375 70.78125 525.8125 70.578125Q524.75 70.3125 524.3281 70.125Q523.9219 69.921875 523.7031 69.578125Q523.5 69.234375 523.5 68.8125Q523.5 68.421875 523.6719 68.109375Q523.84375 67.78125 524.15625 67.5625Q524.375 67.390625 524.7656 67.28125Q525.15625 67.171875 525.59375 67.171875Q526.2656 67.171875 526.7656 67.359375Q527.28125 67.546875 527.5156 67.890625Q527.7656 68.21875 527.8594 68.765625L526.9219 68.890625Q526.84375 68.453125 526.53125 68.21875Q526.2344 67.96875 525.6719 67.96875Q525.0 67.96875 524.71875 68.1875Q524.4375 68.40625 524.4375 68.703125Q524.4375 68.890625 524.5469 69.03125Q524.6719 69.1875 524.9219 69.296875Q525.0625 69.34375 525.78125 69.546875Q526.7969 69.8125 527.2031 69.984375Q527.6094 70.15625 527.84375 70.5Q528.0781 70.828125 528.0781 71.328125Q528.0781 71.8125 527.7969 72.234375Q527.5156 72.65625 526.9844 72.890625Q526.4531 73.125 525.78125 73.125Q524.6719 73.125 524.0781 72.671875Q523.5 72.203125 523.34375 71.296875ZM533.625 71.15625L534.625 71.28125Q534.3906 72.15625 533.75 72.640625Q533.1094 73.125 532.125 73.125Q530.875 73.125 530.1406 72.359375Q529.40625 71.59375 529.40625 70.203125Q529.40625 68.75 530.1406 67.96875Q530.8906 67.171875 532.0625 67.171875Q533.21875 67.171875 533.9375 67.953125Q534.65625 68.71875 534.65625 70.140625Q534.65625 70.21875 534.65625 70.390625L530.40625 70.390625Q530.4531 71.328125 530.9219 71.828125Q531.40625 72.328125 532.125 72.328125Q532.65625 72.328125 533.03125 72.0625Q533.40625 71.78125 533.625 71.15625ZM530.4531 69.59375L533.6406 69.59375Q533.5781 68.875 533.28125 68.515625Q532.8125 67.96875 532.0781 67.96875Q531.40625 67.96875 530.9531 68.421875Q530.5 68.859375 530.4531 69.59375ZM535.9844 73.0L535.9844 71.90625L537.0781 71.90625L537.0781 73.0Q537.0781 73.609375 536.8594 73.984375Q536.65625 74.359375 536.1875 74.5625L535.90625 74.140625Q536.21875 74.015625 536.3594 73.75Q536.5156 73.484375 536.53125 73.0L535.9844 73.0ZM541.71875 73.0L541.71875 67.296875L542.59375 67.296875L542.59375 68.109375Q543.21875 67.171875 544.40625 67.171875Q544.9219 67.171875 545.3594 67.359375Q545.7969 67.53125 546.0 67.84375Q546.21875 68.140625 546.3125 68.546875Q546.3594 68.828125 546.3594 69.5L546.3594 73.0L545.3906 73.0L545.3906 69.53125Q545.3906 68.9375 545.28125 68.65625Q545.1719 68.359375 544.875 68.1875Q544.59375 68.0 544.2031 68.0Q543.59375 68.0 543.1406 68.390625Q542.6875 68.78125 542.6875 69.890625L542.6875 73.0L541.71875 73.0ZM551.46875 73.0L551.46875 72.15625Q550.7969 73.125 549.65625 73.125Q549.15625 73.125 548.7031 72.9375Q548.2656 72.734375 548.0469 72.453125Q547.84375 72.15625 547.7656 71.734375Q547.7031 71.453125 547.7031 70.828125L547.7031 67.296875L548.6719 67.296875L548.6719 70.453125Q548.6719 71.21875 548.7344 71.484375Q548.8281 71.859375 549.1094 72.078125Q549.40625 72.296875 549.84375 72.296875Q550.28125 72.296875 550.65625 72.078125Q551.0469 71.84375 551.2031 71.46875Q551.3594 71.078125 551.3594 70.359375L551.3594 67.296875L552.3281 67.296875L552.3281 73.0L551.46875 73.0ZM553.71875 73.0L553.71875 67.296875L554.59375 67.296875L554.59375 68.09375Q554.8594 67.671875 555.2969 67.421875Q555.75 67.171875 556.3125 67.171875Q556.9531 67.171875 557.3594 67.4375Q557.7656 67.6875 557.9375 68.171875Q558.6094 67.171875 559.6875 67.171875Q560.5469 67.171875 561.0 67.640625Q561.4531 68.109375 561.4531 69.078125L561.4531 73.0L560.5 73.0L560.5 69.40625Q560.5 68.828125 560.40625 68.578125Q560.3125 68.3125 560.0625 68.15625Q559.8125 68.0 559.4844 68.0Q558.875 68.0 558.46875 68.40625Q558.0781 68.8125 558.0781 69.6875L558.0781 73.0L557.1094 73.0L557.1094 69.296875Q557.1094 68.65625 556.875 68.328125Q556.6406 68.0 556.1094 68.0Q555.7031 68.0 555.34375 68.21875Q555.0 68.4375 554.84375 68.859375Q554.6875 69.265625 554.6875 70.046875L554.6875 73.0L553.71875 73.0ZM566.625 71.15625L567.625 71.28125Q567.3906 72.15625 566.75 72.640625Q566.1094 73.125 565.125 73.125Q563.875 73.125 563.1406 72.359375Q562.40625 71.59375 562.40625 70.203125Q562.40625 68.75 563.1406 67.96875Q563.8906 67.171875 565.0625 67.171875Q566.21875 67.171875 566.9375 67.953125Q567.65625 68.71875 567.65625 70.140625Q567.65625 70.21875 567.65625 70.390625L563.40625 70.390625Q563.4531 71.328125 563.9219 71.828125Q564.40625 72.328125 565.125 72.328125Q565.65625 72.328125 566.03125 72.0625Q566.40625 71.78125 566.625 71.15625ZM563.4531 69.59375L566.6406 69.59375Q566.5781 68.875 566.28125 68.515625Q565.8125 67.96875 565.0781 67.96875Q564.40625 67.96875 563.9531 68.421875Q563.5 68.859375 563.4531 69.59375ZM568.71875 73.0L568.71875 67.296875L569.5781 67.296875L569.5781 68.15625Q569.9219 67.546875 570.2031 67.359375Q570.4844 67.171875 570.8125 67.171875Q571.3125 67.171875 571.8125 67.484375L571.4844 68.375Q571.125 68.171875 570.7656 68.171875Q570.4531 68.171875 570.2031 68.359375Q569.9531 68.546875 569.84375 68.890625Q569.6875 69.40625 569.6875 70.015625L569.6875 73.0L568.71875 73.0ZM572.7344 66.234375L572.7344 65.125L573.7031 65.125L573.7031 66.234375L572.7344 66.234375ZM572.7344 73.0L572.7344 67.296875L573.7031 67.296875L573.7031 73.0L572.7344 73.0ZM578.4531 70.90625L579.3906 71.03125Q579.25 72.015625 578.59375 72.578125Q577.9531 73.125 577.03125 73.125Q575.8594 73.125 575.1406 72.359375Q574.4375 71.59375 574.4375 70.171875Q574.4375 69.25 574.7344 68.5625Q575.0469 67.859375 575.6719 67.515625Q576.2969 67.171875 577.03125 67.171875Q577.9531 67.171875 578.5469 67.640625Q579.1406 68.109375 579.3125 68.96875L578.3594 69.109375Q578.2344 68.546875 577.8906 68.265625Q577.5469 67.96875 577.0625 67.96875Q576.34375 67.96875 575.875 68.5Q575.4219 69.015625 575.4219 70.140625Q575.4219 71.296875 575.8594 71.8125Q576.2969 72.328125 577.0156 72.328125Q577.5781 72.328125 577.9531 71.984375Q578.34375 71.640625 578.4531 70.90625ZM580.9844 73.0L580.9844 71.90625L582.0781 71.90625L582.0781 73.0Q582.0781 73.609375 581.8594 73.984375Q581.65625 74.359375 581.1875 74.5625L580.90625 74.140625Q581.21875 74.015625 581.3594 73.75Q581.5156 73.484375 581.53125 73.0L580.9844 73.0ZM590.4531 72.296875Q589.90625 72.75 589.40625 72.9375Q588.9219 73.125 588.34375 73.125Q587.40625 73.125 586.8906 72.671875Q586.3906 72.203125 586.3906 71.5Q586.3906 71.078125 586.5781 70.734375Q586.78125 70.390625 587.0781 70.1875Q587.3906 69.96875 587.78125 69.859375Q588.0625 69.78125 588.6406 69.71875Q589.8125 69.578125 590.3594 69.375Q590.375 69.1875 590.375 69.125Q590.375 68.53125 590.09375 68.296875Q589.7344 67.96875 589.0 67.96875Q588.3125 67.96875 587.9844 68.203125Q587.6719 68.4375 587.5156 69.046875L586.5625 68.921875Q586.6875 68.3125 586.9844 67.9375Q587.28125 67.5625 587.84375 67.375Q588.40625 67.171875 589.1406 67.171875Q589.875 67.171875 590.3281 67.34375Q590.78125 67.515625 590.9844 67.78125Q591.2031 68.03125 591.2969 68.421875Q591.34375 68.671875 591.34375 69.328125L591.34375 70.609375Q591.34375 71.953125 591.40625 72.3125Q591.46875 72.671875 591.65625 73.0L590.6406 73.0Q590.4844 72.703125 590.4531 72.296875ZM590.3594 70.140625Q589.84375 70.359375 588.78125 70.5Q588.1875 70.59375 587.9375 70.703125Q587.7031 70.796875 587.5625 71.015625Q587.4219 71.21875 587.4219 71.46875Q587.4219 71.859375 587.71875 72.125Q588.0156 72.375 588.5781 72.375Q589.1406 72.375 589.5625 72.125Q590.0 71.875 590.21875 71.453125Q590.3594 71.125 590.3594 70.484375L590.3594 70.140625ZM592.7031 73.0L592.7031 65.125L593.6719 65.125L593.6719 73.0L592.7031 73.0ZM594.7031 73.0L594.7031 65.125L595.6719 65.125L595.6719 73.0L594.7031 73.0ZM598.9844 73.0L602.0156 65.125L603.125 65.125L606.3594 73.0L605.1719 73.0L604.25 70.609375L600.9531 70.609375L600.09375 73.0L598.9844 73.0ZM601.25 69.765625L603.9219 69.765625L603.1094 67.578125Q602.7344 66.59375 602.5469 65.953125Q602.3906 66.703125 602.125 67.453125L601.25 69.765625ZM606.5 70.46875L607.4844 70.390625Q607.5469 70.96875 607.7969 71.359375Q608.0625 71.734375 608.59375 71.96875Q609.125 72.203125 609.7969 72.203125Q610.40625 72.203125 610.8594 72.03125Q611.3125 71.84375 611.53125 71.546875Q611.7656 71.234375 611.7656 70.859375Q611.7656 70.484375 611.5469 70.21875Q611.3281 69.9375 610.8281 69.75Q610.5156 69.625 609.4219 69.375Q608.34375 69.109375 607.90625 68.875Q607.34375 68.578125 607.0625 68.140625Q606.7969 67.703125 606.7969 67.15625Q606.7969 66.5625 607.125 66.046875Q607.46875 65.53125 608.1094 65.265625Q608.7656 64.984375 609.5625 64.984375Q610.4375 64.984375 611.1094 65.28125Q611.78125 65.5625 612.1406 66.109375Q612.5 66.65625 612.53125 67.34375L611.53125 67.421875Q611.4531 66.671875 610.9844 66.296875Q610.5156 65.90625 609.6094 65.90625Q608.6719 65.90625 608.2344 66.265625Q607.7969 66.609375 607.7969 67.09375Q607.7969 67.515625 608.1094 67.796875Q608.40625 68.0625 609.6719 68.359375Q610.9531 68.640625 611.4219 68.859375Q612.1094 69.171875 612.4375 69.65625Q612.7656 70.140625 612.7656 70.78125Q612.7656 71.40625 612.40625 71.96875Q612.0469 72.515625 611.3594 72.828125Q610.6875 73.140625 609.84375 73.140625Q608.78125 73.140625 608.0625 72.828125Q607.34375 72.515625 606.9219 71.890625Q606.5156 71.265625 606.5 70.46875ZM619.46875 70.234375L620.5156 70.5Q620.1875 71.78125 619.3281 72.46875Q618.4844 73.140625 617.25 73.140625Q615.96875 73.140625 615.1719 72.625Q614.375 72.09375 613.9531 71.109375Q613.5469 70.125 613.5469 69.0Q613.5469 67.78125 614.0156 66.859375Q614.4844 65.9375 615.34375 65.46875Q616.21875 64.984375 617.2656 64.984375Q618.4531 64.984375 619.25 65.59375Q620.0625 66.1875 620.375 67.28125L619.34375 67.53125Q619.0781 66.671875 618.5469 66.28125Q618.03125 65.890625 617.25 65.890625Q616.3281 65.890625 615.71875 66.328125Q615.1094 66.75 614.8594 67.484375Q614.625 68.21875 614.625 69.0Q614.625 70.0 614.90625 70.75Q615.2031 71.5 615.8125 71.875Q616.4375 72.25 617.15625 72.25Q618.03125 72.25 618.6406 71.75Q619.25 71.234375 619.46875 70.234375ZM622.03125 73.0L622.03125 65.125L623.0625 65.125L623.0625 73.0L622.03125 73.0ZM625.03125 73.0L625.03125 65.125L626.0625 65.125L626.0625 73.0L625.03125 73.0ZM634.4531 70.90625L635.3906 71.03125Q635.25 72.015625 634.59375 72.578125Q633.9531 73.125 633.03125 73.125Q631.8594 73.125 631.1406 72.359375Q630.4375 71.59375 630.4375 70.171875Q630.4375 69.25 630.7344 68.5625Q631.0469 67.859375 631.6719 67.515625Q632.2969 67.171875 633.03125 67.171875Q633.9531 67.171875 634.5469 67.640625Q635.1406 68.109375 635.3125 68.96875L634.3594 69.109375Q634.2344 68.546875 633.8906 68.265625Q633.5469 67.96875 633.0625 67.96875Q632.34375 67.96875 631.875 68.5Q631.4219 69.015625 631.4219 70.140625Q631.4219 71.296875 631.8594 71.8125Q632.2969 72.328125 633.0156 72.328125Q633.5781 72.328125 633.9531 71.984375Q634.34375 71.640625 634.4531 70.90625ZM636.71875 73.0L636.71875 65.125L637.6875 65.125L637.6875 67.953125Q638.375 67.171875 639.40625 67.171875Q640.03125 67.171875 640.5 67.421875Q640.96875 67.671875 641.1719 68.109375Q641.375 68.546875 641.375 69.390625L641.375 73.0L640.40625 73.0L640.40625 69.390625Q640.40625 68.65625 640.09375 68.328125Q639.78125 68.0 639.2031 68.0Q638.7656 68.0 638.3906 68.21875Q638.0156 68.4375 637.84375 68.828125Q637.6875 69.203125 637.6875 69.875L637.6875 73.0L636.71875 73.0ZM646.4531 72.296875Q645.90625 72.75 645.40625 72.9375Q644.9219 73.125 644.34375 73.125Q643.40625 73.125 642.8906 72.671875Q642.3906 72.203125 642.3906 71.5Q642.3906 71.078125 642.5781 70.734375Q642.78125 70.390625 643.0781 70.1875Q643.3906 69.96875 643.78125 69.859375Q644.0625 69.78125 644.6406 69.71875Q645.8125 69.578125 646.3594 69.375Q646.375 69.1875 646.375 69.125Q646.375 68.53125 646.09375 68.296875Q645.7344 67.96875 645.0 67.96875Q644.3125 67.96875 643.9844 68.203125Q643.6719 68.4375 643.5156 69.046875L642.5625 68.921875Q642.6875 68.3125 642.9844 67.9375Q643.28125 67.5625 643.84375 67.375Q644.40625 67.171875 645.1406 67.171875Q645.875 67.171875 646.3281 67.34375Q646.78125 67.515625 646.9844 67.78125Q647.2031 68.03125 647.2969 68.421875Q647.34375 68.671875 647.34375 69.328125L647.34375 70.609375Q647.34375 71.953125 647.40625 72.3125Q647.46875 72.671875 647.65625 73.0L646.6406 73.0Q646.4844 72.703125 646.4531 72.296875ZM646.3594 70.140625Q645.84375 70.359375 644.78125 70.5Q644.1875 70.59375 643.9375 70.703125Q643.7031 70.796875 643.5625 71.015625Q643.4219 71.21875 643.4219 71.46875Q643.4219 71.859375 643.71875 72.125Q644.0156 72.375 644.5781 72.375Q645.1406 72.375 645.5625 72.125Q646.0 71.875 646.21875 71.453125Q646.3594 71.125 646.3594 70.484375L646.3594 70.140625ZM648.71875 73.0L648.71875 67.296875L649.5781 67.296875L649.5781 68.15625Q649.9219 67.546875 650.2031 67.359375Q650.4844 67.171875 650.8125 67.171875Q651.3125 67.171875 651.8125 67.484375L651.4844 68.375Q651.125 68.171875 650.7656 68.171875Q650.4531 68.171875 650.2031 68.359375Q649.9531 68.546875 649.84375 68.890625Q649.6875 69.40625 649.6875 70.015625L649.6875 73.0L648.71875 73.0ZM656.4531 72.296875Q655.90625 72.75 655.40625 72.9375Q654.9219 73.125 654.34375 73.125Q653.40625 73.125 652.8906 72.671875Q652.3906 72.203125 652.3906 71.5Q652.3906 71.078125 652.5781 70.734375Q652.78125 70.390625 653.0781 70.1875Q653.3906 69.96875 653.78125 69.859375Q654.0625 69.78125 654.6406 69.71875Q655.8125 69.578125 656.3594 69.375Q656.375 69.1875 656.375 69.125Q656.375 68.53125 656.09375 68.296875Q655.7344 67.96875 655.0 67.96875Q654.3125 67.96875 653.9844 68.203125Q653.6719 68.4375 653.5156 69.046875L652.5625 68.921875Q652.6875 68.3125 652.9844 67.9375Q653.28125 67.5625 653.84375 67.375Q654.40625 67.171875 655.1406 67.171875Q655.875 67.171875 656.3281 67.34375Q656.78125 67.515625 656.9844 67.78125Q657.2031 68.03125 657.2969 68.421875Q657.34375 68.671875 657.34375 69.328125L657.34375 70.609375Q657.34375 71.953125 657.40625 72.3125Q657.46875 72.671875 657.65625 73.0L656.6406 73.0Q656.4844 72.703125 656.4531 72.296875ZM656.3594 70.140625Q655.84375 70.359375 654.78125 70.5Q654.1875 70.59375 653.9375 70.703125Q653.7031 70.796875 653.5625 71.015625Q653.4219 71.21875 653.4219 71.46875Q653.4219 71.859375 653.71875 72.125Q654.0156 72.375 654.5781 72.375Q655.1406 72.375 655.5625 72.125Q656.0 71.875 656.21875 71.453125Q656.3594 71.125 656.3594 70.484375L656.3594 70.140625ZM662.4531 70.90625L663.3906 71.03125Q663.25 72.015625 662.59375 72.578125Q661.9531 73.125 661.03125 73.125Q659.8594 73.125 659.1406 72.359375Q658.4375 71.59375 658.4375 70.171875Q658.4375 69.25 658.7344 68.5625Q659.0469 67.859375 659.6719 67.515625Q660.2969 67.171875 661.03125 67.171875Q661.9531 67.171875 662.5469 67.640625Q663.1406 68.109375 663.3125 68.96875L662.3594 69.109375Q662.2344 68.546875 661.8906 68.265625Q661.5469 67.96875 661.0625 67.96875Q660.34375 67.96875 659.875 68.5Q659.4219 69.015625 659.4219 70.140625Q659.4219 71.296875 659.8594 71.8125Q660.2969 72.328125 661.0156 72.328125Q661.5781 72.328125 661.9531 71.984375Q662.34375 71.640625 662.4531 70.90625ZM666.84375 72.140625L666.96875 72.984375Q666.5625 73.078125 666.25 73.078125Q665.71875 73.078125 665.4219 72.90625Q665.1406 72.734375 665.0156 72.46875Q664.90625 72.203125 664.90625 71.328125L664.90625 68.046875L664.1875 68.046875L664.1875 67.296875L664.90625 67.296875L664.90625 65.890625L665.8594 65.296875L665.8594 67.296875L666.84375 67.296875L666.84375 68.046875L665.8594 68.046875L665.8594 71.390625Q665.8594 71.796875 665.90625 71.921875Q665.96875 72.03125 666.0781 72.109375Q666.2031 72.171875 666.40625 72.171875Q666.5781 72.171875 666.84375 72.140625ZM671.625 71.15625L672.625 71.28125Q672.3906 72.15625 671.75 72.640625Q671.1094 73.125 670.125 73.125Q668.875 73.125 668.1406 72.359375Q667.40625 71.59375 667.40625 70.203125Q667.40625 68.75 668.1406 67.96875Q668.8906 67.171875 670.0625 67.171875Q671.21875 67.171875 671.9375 67.953125Q672.65625 68.71875 672.65625 70.140625Q672.65625 70.21875 672.65625 70.390625L668.40625 70.390625Q668.4531 71.328125 668.9219 71.828125Q669.40625 72.328125 670.125 72.328125Q670.65625 72.328125 671.03125 72.0625Q671.40625 71.78125 671.625 71.15625ZM668.4531 69.59375L671.6406 69.59375Q671.5781 68.875 671.28125 68.515625Q670.8125 67.96875 670.0781 67.96875Q669.40625 67.96875 668.9531 68.421875Q668.5 68.859375 668.4531 69.59375ZM673.71875 73.0L673.71875 67.296875L674.5781 67.296875L674.5781 68.15625Q674.9219 67.546875 675.2031 67.359375Q675.4844 67.171875 675.8125 67.171875Q676.3125 67.171875 676.8125 67.484375L676.4844 68.375Q676.125 68.171875 675.7656 68.171875Q675.4531 68.171875 675.2031 68.359375Q674.9531 68.546875 674.84375 68.890625Q674.6875 69.40625 674.6875 70.015625L674.6875 73.0L673.71875 73.0ZM677.34375 71.296875L678.2969 71.140625Q678.375 71.71875 678.7344 72.03125Q679.1094 72.328125 679.7656 72.328125Q680.4375 72.328125 680.75 72.0625Q681.0781 71.796875 681.0781 71.421875Q681.0781 71.09375 680.7969 70.90625Q680.59375 70.78125 679.8125 70.578125Q678.75 70.3125 678.3281 70.125Q677.9219 69.921875 677.7031 69.578125Q677.5 69.234375 677.5 68.8125Q677.5 68.421875 677.6719 68.109375Q677.84375 67.78125 678.15625 67.5625Q678.375 67.390625 678.7656 67.28125Q679.15625 67.171875 679.59375 67.171875Q680.2656 67.171875 680.7656 67.359375Q681.28125 67.546875 681.5156 67.890625Q681.7656 68.21875 681.8594 68.765625L680.9219 68.890625Q680.84375 68.453125 680.53125 68.21875Q680.2344 67.96875 679.6719 67.96875Q679.0 67.96875 678.71875 68.1875Q678.4375 68.40625 678.4375 68.703125Q678.4375 68.890625 678.5469 69.03125Q678.6719 69.1875 678.9219 69.296875Q679.0625 69.34375 679.78125 69.546875Q680.7969 69.8125 681.2031 69.984375Q681.6094 70.15625 681.84375 70.5Q682.0781 70.828125 682.0781 71.328125Q682.0781 71.8125 681.7969 72.234375Q681.5156 72.65625 680.9844 72.890625Q680.4531 73.125 679.78125 73.125Q678.6719 73.125 678.0781 72.671875Q677.5 72.203125 677.34375 71.296875Z" fill-rule="nonzero"/><path stroke="#fbbc04" stroke-width="4.0" stroke-linecap="butt" d="M188.0 86.5L200.0 86.5" fill-rule="nonzero"/><path fill="#1a1a1a" d="M208.53125 86.171875Q208.53125 84.203125 209.57812 83.09375Q210.64062 81.984375 212.29688 81.984375Q213.39062 81.984375 214.26562 82.515625Q215.14062 83.03125 215.59375 83.96875Q216.0625 84.890625 216.0625 86.078125Q216.0625 87.265625 215.57812 88.21875Q215.09375 89.15625 214.20312 89.65625Q213.32812 90.140625 212.29688 90.140625Q211.1875 90.140625 210.3125 89.609375Q209.4375 89.0625 208.98438 88.140625Q208.53125 87.203125 208.53125 86.171875ZM209.60938 86.1875Q209.60938 87.609375 210.375 88.4375Q211.14062 89.25 212.29688 89.25Q213.46875 89.25 214.21875 88.421875Q214.98438 87.59375 214.98438 86.0625Q214.98438 85.109375 214.65625 84.390625Q214.34375 83.671875 213.71875 83.28125Q213.09375 82.890625 212.3125 82.890625Q211.20312 82.890625 210.40625 83.65625Q209.60938 84.40625 209.60938 86.1875ZM217.71875 90.0L217.71875 84.296875L218.59375 84.296875L218.59375 85.109375Q219.21875 84.171875 220.40625 84.171875Q220.92188 84.171875 221.35938 84.359375Q221.79688 84.53125 222.0 84.84375Q222.21875 85.140625 222.3125 85.546875Q222.35938 85.828125 222.35938 86.5L222.35938 90.0L221.39062 90.0L221.39062 86.53125Q221.39062 85.9375 221.28125 85.65625Q221.17188 85.359375 220.875 85.1875Q220.59375 85.0 220.20312 85.0Q219.59375 85.0 219.14062 85.390625Q218.6875 85.78125 218.6875 86.890625L218.6875 90.0L217.71875 90.0ZM227.625 88.15625L228.625 88.28125Q228.39062 89.15625 227.75 89.640625Q227.10938 90.125 226.125 90.125Q224.875 90.125 224.14062 89.359375Q223.40625 88.59375 223.40625 87.203125Q223.40625 85.75 224.14062 84.96875Q224.89062 84.171875 226.0625 84.171875Q227.21875 84.171875 227.9375 84.953125Q228.65625 85.71875 228.65625 87.140625Q228.65625 87.21875 228.65625 87.390625L224.40625 87.390625Q224.45312 88.328125 224.92188 88.828125Q225.40625 89.328125 226.125 89.328125Q226.65625 89.328125 227.03125 89.0625Q227.40625 88.78125 227.625 88.15625ZM224.45312 86.59375L227.64062 86.59375Q227.57812 85.875 227.28125 85.515625Q226.8125 84.96875 226.07812 84.96875Q225.40625 84.96875 224.95312 85.421875Q224.5 85.859375 224.45312 86.59375ZM236.625 88.15625L237.625 88.28125Q237.39062 89.15625 236.75 89.640625Q236.10938 90.125 235.125 90.125Q233.875 90.125 233.14062 89.359375Q232.40625 88.59375 232.40625 87.203125Q232.40625 85.75 233.14062 84.96875Q233.89062 84.171875 235.0625 84.171875Q236.21875 84.171875 236.9375 84.953125Q237.65625 85.71875 237.65625 87.140625Q237.65625 87.21875 237.65625 87.390625L233.40625 87.390625Q233.45312 88.328125 233.92188 88.828125Q234.40625 89.328125 235.125 89.328125Q235.65625 89.328125 236.03125 89.0625Q236.40625 88.78125 236.625 88.15625ZM233.45312 86.59375L236.64062 86.59375Q236.57812 85.875 236.28125 85.515625Q235.8125 84.96875 235.07812 84.96875Q234.40625 84.96875 233.95312 85.421875Q233.5 85.859375 233.45312 86.59375ZM242.45312 89.296875Q241.90625 89.75 241.40625 89.9375Q240.92188 90.125 240.34375 90.125Q239.40625 90.125 238.89062 89.671875Q238.39062 89.203125 238.39062 88.5Q238.39062 88.078125 238.57812 87.734375Q238.78125 87.390625 239.07812 87.1875Q239.39062 86.96875 239.78125 86.859375Q240.0625 86.78125 240.64062 86.71875Q241.8125 86.578125 242.35938 86.375Q242.375 86.1875 242.375 86.125Q242.375 85.53125 242.09375 85.296875Q241.73438 84.96875 241.0 84.96875Q240.3125 84.96875 239.98438 85.203125Q239.67188 85.4375 239.51562 86.046875L238.5625 85.921875Q238.6875 85.3125 238.98438 84.9375Q239.28125 84.5625 239.84375 84.375Q240.40625 84.171875 241.14062 84.171875Q241.875 84.171875 242.32812 84.34375Q242.78125 84.515625 242.98438 84.78125Q243.20312 85.03125 243.29688 85.421875Q243.34375 85.671875 243.34375 86.328125L243.34375 87.609375Q243.34375 88.953125 243.40625 89.3125Q243.46875 89.671875 243.65625 90.0L242.64062 90.0Q242.48438 89.703125 242.45312 89.296875ZM242.35938 87.140625Q241.84375 87.359375 240.78125 87.5Q240.1875 87.59375 239.9375 87.703125Q239.70312 87.796875 239.5625 88.015625Q239.42188 88.21875 239.42188 88.46875Q239.42188 88.859375 239.71875 89.125Q240.01562 89.375 240.57812 89.375Q241.14062 89.375 241.5625 89.125Q242.0 88.875 242.21875 88.453125Q242.35938 88.125 242.35938 87.484375L242.35938 87.140625ZM248.45312 87.90625L249.39062 88.03125Q249.25 89.015625 248.59375 89.578125Q247.95312 90.125 247.03125 90.125Q245.85938 90.125 245.14062 89.359375Q244.4375 88.59375 244.4375 87.171875Q244.4375 86.25 244.73438 85.5625Q245.04688 84.859375 245.67188 84.515625Q246.29688 84.171875 247.03125 84.171875Q247.95312 84.171875 248.54688 84.640625Q249.14062 85.109375 249.3125 85.96875L248.35938 86.109375Q248.23438 85.546875 247.89062 85.265625Q247.54688 84.96875 247.0625 84.96875Q246.34375 84.96875 245.875 85.5Q245.42188 86.015625 245.42188 87.140625Q245.42188 88.296875 245.85938 88.8125Q246.29688 89.328125 247.01562 89.328125Q247.57812 89.328125 247.95312 88.984375Q248.34375 88.640625 248.45312 87.90625ZM250.71875 90.0L250.71875 82.125L251.6875 82.125L251.6875 84.953125Q252.375 84.171875 253.40625 84.171875Q254.03125 84.171875 254.5 84.421875Q254.96875 84.671875 255.17188 85.109375Q255.375 85.546875 255.375 86.390625L255.375 90.0L254.40625 90.0L254.40625 86.390625Q254.40625 85.65625 254.09375 85.328125Q253.78125 85.0 253.20312 85.0Q252.76562 85.0 252.39062 85.21875Q252.01562 85.4375 251.84375 85.828125Q251.6875 86.203125 251.6875 86.875L251.6875 90.0L250.71875 90.0ZM257.0 85.390625L257.0 84.296875L258.09375 84.296875L258.09375 85.390625L257.0 85.390625ZM257.0 90.0L257.0 88.90625L258.09375 88.90625L258.09375 90.0L257.0 90.0ZM266.46875 90.0L266.46875 89.15625Q265.79688 90.125 264.65625 90.125Q264.15625 90.125 263.70312 89.9375Q263.26562 89.734375 263.04688 89.453125Q262.84375 89.15625 262.76562 88.734375Q262.70312 88.453125 262.70312 87.828125L262.70312 84.296875L263.67188 84.296875L263.67188 87.453125Q263.67188 88.21875 263.73438 88.484375Q263.82812 88.859375 264.10938 89.078125Q264.40625 89.296875 264.84375 89.296875Q265.28125 89.296875 265.65625 89.078125Q266.04688 88.84375 266.20312 88.46875Q266.35938 88.078125 266.35938 87.359375L266.35938 84.296875L267.32812 84.296875L267.32812 90.0L266.46875 90.0ZM268.71875 92.1875L268.71875 84.296875L269.60938 84.296875L269.60938 85.03125Q269.92188 84.609375 270.3125 84.390625Q270.70312 84.171875 271.26562 84.171875Q271.98438 84.171875 272.54688 84.546875Q273.10938 84.921875 273.39062 85.609375Q273.67188 86.28125 273.67188 87.109375Q273.67188 87.984375 273.35938 88.6875Q273.04688 89.375 272.4375 89.75Q271.84375 90.125 271.1875 90.125Q270.70312 90.125 270.3125 89.921875Q269.9375 89.71875 269.6875 89.40625L269.6875 92.1875L268.71875 92.1875ZM269.59375 87.1875Q269.59375 88.28125 270.04688 88.8125Q270.5 89.328125 271.125 89.328125Q271.76562 89.328125 272.21875 88.796875Q272.6875 88.25 272.6875 87.09375Q272.6875 86.015625 272.23438 85.46875Q271.79688 84.921875 271.17188 84.921875Q270.54688 84.921875 270.0625 85.5Q269.59375 86.078125 269.59375 87.1875ZM274.71875 92.1875L274.71875 84.296875L275.60938 84.296875L275.60938 85.03125Q275.92188 84.609375 276.3125 84.390625Q276.70312 84.171875 277.26562 84.171875Q277.98438 84.171875 278.54688 84.546875Q279.10938 84.921875 279.39062 85.609375Q279.67188 86.28125 279.67188 87.109375Q279.67188 87.984375 279.35938 88.6875Q279.04688 89.375 278.4375 89.75Q277.84375 90.125 277.1875 90.125Q276.70312 90.125 276.3125 89.921875Q275.9375 89.71875 275.6875 89.40625L275.6875 92.1875L274.71875 92.1875ZM275.59375 87.1875Q275.59375 88.28125 276.04688 88.8125Q276.5 89.328125 277.125 89.328125Q277.76562 89.328125 278.21875 88.796875Q278.6875 88.25 278.6875 87.09375Q278.6875 86.015625 278.23438 85.46875Q277.79688 84.921875 277.17188 84.921875Q276.54688 84.921875 276.0625 85.5Q275.59375 86.078125 275.59375 87.1875ZM284.625 88.15625L285.625 88.28125Q285.39062 89.15625 284.75 89.640625Q284.10938 90.125 283.125 90.125Q281.875 90.125 281.14062 89.359375Q280.40625 88.59375 280.40625 87.203125Q280.40625 85.75 281.14062 84.96875Q281.89062 84.171875 283.0625 84.171875Q284.21875 84.171875 284.9375 84.953125Q285.65625 85.71875 285.65625 87.140625Q285.65625 87.21875 285.65625 87.390625L281.40625 87.390625Q281.45312 88.328125 281.92188 88.828125Q282.40625 89.328125 283.125 89.328125Q283.65625 89.328125 284.03125 89.0625Q284.40625 88.78125 284.625 88.15625ZM281.45312 86.59375L284.64062 86.59375Q284.57812 85.875 284.28125 85.515625Q283.8125 84.96875 283.07812 84.96875Q282.40625 84.96875 281.95312 85.421875Q281.5 85.859375 281.45312 86.59375ZM286.71875 90.0L286.71875 84.296875L287.57812 84.296875L287.57812 85.15625Q287.92188 84.546875 288.20312 84.359375Q288.48438 84.171875 288.8125 84.171875Q289.3125 84.171875 289.8125 84.484375L289.48438 85.375Q289.125 85.171875 288.76562 85.171875Q288.45312 85.171875 288.20312 85.359375Q287.95312 85.546875 287.84375 85.890625Q287.6875 86.40625 287.6875 87.015625L287.6875 90.0L286.71875 90.0ZM294.45312 87.90625L295.39062 88.03125Q295.25 89.015625 294.59375 89.578125Q293.95312 90.125 293.03125 90.125Q291.85938 90.125 291.14062 89.359375Q290.4375 88.59375 290.4375 87.171875Q290.4375 86.25 290.73438 85.5625Q291.04688 84.859375 291.67188 84.515625Q292.29688 84.171875 293.03125 84.171875Q293.95312 84.171875 294.54688 84.640625Q295.14062 85.109375 295.3125 85.96875L294.35938 86.109375Q294.23438 85.546875 293.89062 85.265625Q293.54688 84.96875 293.0625 84.96875Q292.34375 84.96875 291.875 85.5Q291.42188 86.015625 291.42188 87.140625Q291.42188 88.296875 291.85938 88.8125Q292.29688 89.328125 293.01562 89.328125Q293.57812 89.328125 293.95312 88.984375Q294.34375 88.640625 294.45312 87.90625ZM300.45312 89.296875Q299.90625 89.75 299.40625 89.9375Q298.92188 90.125 298.34375 90.125Q297.40625 90.125 296.89062 89.671875Q296.39062 89.203125 296.39062 88.5Q296.39062 88.078125 296.57812 87.734375Q296.78125 87.390625 297.07812 87.1875Q297.39062 86.96875 297.78125 86.859375Q298.0625 86.78125 298.64062 86.71875Q299.8125 86.578125 300.35938 86.375Q300.375 86.1875 300.375 86.125Q300.375 85.53125 300.09375 85.296875Q299.73438 84.96875 299.0 84.96875Q298.3125 84.96875 297.98438 85.203125Q297.67188 85.4375 297.51562 86.046875L296.5625 85.921875Q296.6875 85.3125 296.98438 84.9375Q297.28125 84.5625 297.84375 84.375Q298.40625 84.171875 299.14062 84.171875Q299.875 84.171875 300.32812 84.34375Q300.78125 84.515625 300.98438 84.78125Q301.20312 85.03125 301.29688 85.421875Q301.34375 85.671875 301.34375 86.328125L301.34375 87.609375Q301.34375 88.953125 301.40625 89.3125Q301.46875 89.671875 301.65625 90.0L300.64062 90.0Q300.48438 89.703125 300.45312 89.296875ZM300.35938 87.140625Q299.84375 87.359375 298.78125 87.5Q298.1875 87.59375 297.9375 87.703125Q297.70312 87.796875 297.5625 88.015625Q297.42188 88.21875 297.42188 88.46875Q297.42188 88.859375 297.71875 89.125Q298.01562 89.375 298.57812 89.375Q299.14062 89.375 299.5625 89.125Q300.0 88.875 300.21875 88.453125Q300.35938 88.125 300.35938 87.484375L300.35938 87.140625ZM302.34375 88.296875L303.29688 88.140625Q303.375 88.71875 303.73438 89.03125Q304.10938 89.328125 304.76562 89.328125Q305.4375 89.328125 305.75 89.0625Q306.07812 88.796875 306.07812 88.421875Q306.07812 88.09375 305.79688 87.90625Q305.59375 87.78125 304.8125 87.578125Q303.75 87.3125 303.32812 87.125Q302.92188 86.921875 302.70312 86.578125Q302.5 86.234375 302.5 85.8125Q302.5 85.421875 302.67188 85.109375Q302.84375 84.78125 303.15625 84.5625Q303.375 84.390625 303.76562 84.28125Q304.15625 84.171875 304.59375 84.171875Q305.26562 84.171875 305.76562 84.359375Q306.28125 84.546875 306.51562 84.890625Q306.76562 85.21875 306.85938 85.765625L305.92188 85.890625Q305.84375 85.453125 305.53125 85.21875Q305.23438 84.96875 304.67188 84.96875Q304.0 84.96875 303.71875 85.1875Q303.4375 85.40625 303.4375 85.703125Q303.4375 85.890625 303.54688 86.03125Q303.67188 86.1875 303.92188 86.296875Q304.0625 86.34375 304.78125 86.546875Q305.79688 86.8125 306.20312 86.984375Q306.60938 87.15625 306.84375 87.5Q307.07812 87.828125 307.07812 88.328125Q307.07812 88.8125 306.79688 89.234375Q306.51562 89.65625 305.98438 89.890625Q305.45312 90.125 304.78125 90.125Q303.67188 90.125 303.07812 89.671875Q302.5 89.203125 302.34375 88.296875ZM312.625 88.15625L313.625 88.28125Q313.39062 89.15625 312.75 89.640625Q312.10938 90.125 311.125 90.125Q309.875 90.125 309.14062 89.359375Q308.40625 88.59375 308.40625 87.203125Q308.40625 85.75 309.14062 84.96875Q309.89062 84.171875 311.0625 84.171875Q312.21875 84.171875 312.9375 84.953125Q313.65625 85.71875 313.65625 87.140625Q313.65625 87.21875 313.65625 87.390625L309.40625 87.390625Q309.45312 88.328125 309.92188 88.828125Q310.40625 89.328125 311.125 89.328125Q311.65625 89.328125 312.03125 89.0625Q312.40625 88.78125 312.625 88.15625ZM309.45312 86.59375L312.64062 86.59375Q312.57812 85.875 312.28125 85.515625Q311.8125 84.96875 311.07812 84.96875Q310.40625 84.96875 309.95312 85.421875Q309.5 85.859375 309.45312 86.59375ZM314.98438 90.0L314.98438 88.90625L316.07812 88.90625L316.07812 90.0Q316.07812 90.609375 315.85938 90.984375Q315.65625 91.359375 315.1875 91.5625L314.90625 91.140625Q315.21875 91.015625 315.35938 90.75Q315.51562 90.484375 315.53125 90.0L314.98438 90.0ZM320.70312 90.0L320.70312 82.125L321.67188 82.125L321.67188 90.0L320.70312 90.0ZM322.35938 87.140625Q322.35938 85.5625 323.25 84.796875Q323.98438 84.171875 325.04688 84.171875Q326.21875 84.171875 326.95312 84.9375Q327.70312 85.703125 327.70312 87.0625Q327.70312 88.171875 327.375 88.8125Q327.04688 89.4375 326.40625 89.78125Q325.78125 90.125 325.04688 90.125Q323.84375 90.125 323.09375 89.359375Q322.35938 88.59375 322.35938 87.140625ZM323.35938 87.140625Q323.35938 88.25 323.82812 88.796875Q324.3125 89.328125 325.04688 89.328125Q325.76562 89.328125 326.23438 88.78125Q326.71875 88.234375 326.71875 87.109375Q326.71875 86.0625 326.23438 85.515625Q325.75 84.96875 325.04688 84.96875Q324.3125 84.96875 323.82812 85.515625Q323.35938 86.046875 323.35938 87.140625ZM329.78125 90.0L328.03125 84.296875L329.03125 84.296875L329.9375 87.59375L330.28125 88.8125Q330.29688 88.71875 330.57812 87.640625L331.48438 84.296875L332.46875 84.296875L333.32812 87.609375L333.60938 88.6875L333.9375 87.59375L334.92188 84.296875L335.85938 84.296875L334.07812 90.0L333.07812 90.0L332.15625 86.578125L331.9375 85.609375L330.78125 90.0L329.78125 90.0ZM340.625 88.15625L341.625 88.28125Q341.39062 89.15625 340.75 89.640625Q340.10938 90.125 339.125 90.125Q337.875 90.125 337.14062 89.359375Q336.40625 88.59375 336.40625 87.203125Q336.40625 85.75 337.14062 84.96875Q337.89062 84.171875 339.0625 84.171875Q340.21875 84.171875 340.9375 84.953125Q341.65625 85.71875 341.65625 87.140625Q341.65625 87.21875 341.65625 87.390625L337.40625 87.390625Q337.45312 88.328125 337.92188 88.828125Q338.40625 89.328125 339.125 89.328125Q339.65625 89.328125 340.03125 89.0625Q340.40625 88.78125 340.625 88.15625ZM337.45312 86.59375L340.64062 86.59375Q340.57812 85.875 340.28125 85.515625Q339.8125 84.96875 339.07812 84.96875Q338.40625 84.96875 337.95312 85.421875Q337.5 85.859375 337.45312 86.59375ZM342.71875 90.0L342.71875 84.296875L343.57812 84.296875L343.57812 85.15625Q343.92188 84.546875 344.20312 84.359375Q344.48438 84.171875 344.8125 84.171875Q345.3125 84.171875 345.8125 84.484375L345.48438 85.375Q345.125 85.171875 344.76562 85.171875Q344.45312 85.171875 344.20312 85.359375Q343.95312 85.546875 343.84375 85.890625Q343.6875 86.40625 343.6875 87.015625L343.6875 90.0L342.71875 90.0ZM350.45312 87.90625L351.39062 88.03125Q351.25 89.015625 350.59375 89.578125Q349.95312 90.125 349.03125 90.125Q347.85938 90.125 347.14062 89.359375Q346.4375 88.59375 346.4375 87.171875Q346.4375 86.25 346.73438 85.5625Q347.04688 84.859375 347.67188 84.515625Q348.29688 84.171875 349.03125 84.171875Q349.95312 84.171875 350.54688 84.640625Q351.14062 85.109375 351.3125 85.96875L350.35938 86.109375Q350.23438 85.546875 349.89062 85.265625Q349.54688 84.96875 349.0625 84.96875Q348.34375 84.96875 347.875 85.5Q347.42188 86.015625 347.42188 87.140625Q347.42188 88.296875 347.85938 88.8125Q348.29688 89.328125 349.01562 89.328125Q349.57812 89.328125 349.95312 88.984375Q350.34375 88.640625 350.45312 87.90625ZM356.45312 89.296875Q355.90625 89.75 355.40625 89.9375Q354.92188 90.125 354.34375 90.125Q353.40625 90.125 352.89062 89.671875Q352.39062 89.203125 352.39062 88.5Q352.39062 88.078125 352.57812 87.734375Q352.78125 87.390625 353.07812 87.1875Q353.39062 86.96875 353.78125 86.859375Q354.0625 86.78125 354.64062 86.71875Q355.8125 86.578125 356.35938 86.375Q356.375 86.1875 356.375 86.125Q356.375 85.53125 356.09375 85.296875Q355.73438 84.96875 355.0 84.96875Q354.3125 84.96875 353.98438 85.203125Q353.67188 85.4375 353.51562 86.046875L352.5625 85.921875Q352.6875 85.3125 352.98438 84.9375Q353.28125 84.5625 353.84375 84.375Q354.40625 84.171875 355.14062 84.171875Q355.875 84.171875 356.32812 84.34375Q356.78125 84.515625 356.98438 84.78125Q357.20312 85.03125 357.29688 85.421875Q357.34375 85.671875 357.34375 86.328125L357.34375 87.609375Q357.34375 88.953125 357.40625 89.3125Q357.46875 89.671875 357.65625 90.0L356.64062 90.0Q356.48438 89.703125 356.45312 89.296875ZM356.35938 87.140625Q355.84375 87.359375 354.78125 87.5Q354.1875 87.59375 353.9375 87.703125Q353.70312 87.796875 353.5625 88.015625Q353.42188 88.21875 353.42188 88.46875Q353.42188 88.859375 353.71875 89.125Q354.01562 89.375 354.57812 89.375Q355.14062 89.375 355.5625 89.125Q356.0 88.875 356.21875 88.453125Q356.35938 88.125 356.35938 87.484375L356.35938 87.140625ZM358.34375 88.296875L359.29688 88.140625Q359.375 88.71875 359.73438 89.03125Q360.10938 89.328125 360.76562 89.328125Q361.4375 89.328125 361.75 89.0625Q362.07812 88.796875 362.07812 88.421875Q362.07812 88.09375 361.79688 87.90625Q361.59375 87.78125 360.8125 87.578125Q359.75 87.3125 359.32812 87.125Q358.92188 86.921875 358.70312 86.578125Q358.5 86.234375 358.5 85.8125Q358.5 85.421875 358.67188 85.109375Q358.84375 84.78125 359.15625 84.5625Q359.375 84.390625 359.76562 84.28125Q360.15625 84.171875 360.59375 84.171875Q361.26562 84.171875 361.76562 84.359375Q362.28125 84.546875 362.51562 84.890625Q362.76562 85.21875 362.85938 85.765625L361.92188 85.890625Q361.84375 85.453125 361.53125 85.21875Q361.23438 84.96875 360.67188 84.96875Q360.0 84.96875 359.71875 85.1875Q359.4375 85.40625 359.4375 85.703125Q359.4375 85.890625 359.54688 86.03125Q359.67188 86.1875 359.92188 86.296875Q360.0625 86.34375 360.78125 86.546875Q361.79688 86.8125 362.20312 86.984375Q362.60938 87.15625 362.84375 87.5Q363.07812 87.828125 363.07812 88.328125Q363.07812 88.8125 362.79688 89.234375Q362.51562 89.65625 361.98438 89.890625Q361.45312 90.125 360.78125 90.125Q359.67188 90.125 359.07812 89.671875Q358.5 89.203125 358.34375 88.296875ZM368.625 88.15625L369.625 88.28125Q369.39062 89.15625 368.75 89.640625Q368.10938 90.125 367.125 90.125Q365.875 90.125 365.14062 89.359375Q364.40625 88.59375 364.40625 87.203125Q364.40625 85.75 365.14062 84.96875Q365.89062 84.171875 367.0625 84.171875Q368.21875 84.171875 368.9375 84.953125Q369.65625 85.71875 369.65625 87.140625Q369.65625 87.21875 369.65625 87.390625L365.40625 87.390625Q365.45312 88.328125 365.92188 88.828125Q366.40625 89.328125 367.125 89.328125Q367.65625 89.328125 368.03125 89.0625Q368.40625 88.78125 368.625 88.15625ZM365.45312 86.59375L368.64062 86.59375Q368.57812 85.875 368.28125 85.515625Q367.8125 84.96875 367.07812 84.96875Q366.40625 84.96875 365.95312 85.421875Q365.5 85.859375 365.45312 86.59375ZM370.98438 90.0L370.98438 88.90625L372.07812 88.90625L372.07812 90.0Q372.07812 90.609375 371.85938 90.984375Q371.65625 91.359375 371.1875 91.5625L370.90625 91.140625Q371.21875 91.015625 371.35938 90.75Q371.51562 90.484375 371.53125 90.0L370.98438 90.0ZM376.71875 90.0L376.71875 84.296875L377.59375 84.296875L377.59375 85.109375Q378.21875 84.171875 379.40625 84.171875Q379.92188 84.171875 380.35938 84.359375Q380.79688 84.53125 381.0 84.84375Q381.21875 85.140625 381.3125 85.546875Q381.35938 85.828125 381.35938 86.5L381.35938 90.0L380.39062 90.0L380.39062 86.53125Q380.39062 85.9375 380.28125 85.65625Q380.17188 85.359375 379.875 85.1875Q379.59375 85.0 379.20312 85.0Q378.59375 85.0 378.14062 85.390625Q377.6875 85.78125 377.6875 86.890625L377.6875 90.0L376.71875 90.0ZM386.46875 90.0L386.46875 89.15625Q385.79688 90.125 384.65625 90.125Q384.15625 90.125 383.70312 89.9375Q383.26562 89.734375 383.04688 89.453125Q382.84375 89.15625 382.76562 88.734375Q382.70312 88.453125 382.70312 87.828125L382.70312 84.296875L383.67188 84.296875L383.67188 87.453125Q383.67188 88.21875 383.73438 88.484375Q383.82812 88.859375 384.10938 89.078125Q384.40625 89.296875 384.84375 89.296875Q385.28125 89.296875 385.65625 89.078125Q386.04688 88.84375 386.20312 88.46875Q386.35938 88.078125 386.35938 87.359375L386.35938 84.296875L387.32812 84.296875L387.32812 90.0L386.46875 90.0ZM388.71875 90.0L388.71875 84.296875L389.59375 84.296875L389.59375 85.09375Q389.85938 84.671875 390.29688 84.421875Q390.75 84.171875 391.3125 84.171875Q391.95312 84.171875 392.35938 84.4375Q392.76562 84.6875 392.9375 85.171875Q393.60938 84.171875 394.6875 84.171875Q395.54688 84.171875 396.0 84.640625Q396.45312 85.109375 396.45312 86.078125L396.45312 90.0L395.5 90.0L395.5 86.40625Q395.5 85.828125 395.40625 85.578125Q395.3125 85.3125 395.0625 85.15625Q394.8125 85.0 394.48438 85.0Q393.875 85.0 393.46875 85.40625Q393.07812 85.8125 393.07812 86.6875L393.07812 90.0L392.10938 90.0L392.10938 86.296875Q392.10938 85.65625 391.875 85.328125Q391.64062 85.0 391.10938 85.0Q390.70312 85.0 390.34375 85.21875Q390.0 85.4375 389.84375 85.859375Q389.6875 86.265625 389.6875 87.046875L389.6875 90.0L388.71875 90.0ZM401.625 88.15625L402.625 88.28125Q402.39062 89.15625 401.75 89.640625Q401.10938 90.125 400.125 90.125Q398.875 90.125 398.14062 89.359375Q397.40625 88.59375 397.40625 87.203125Q397.40625 85.75 398.14062 84.96875Q398.89062 84.171875 400.0625 84.171875Q401.21875 84.171875 401.9375 84.953125Q402.65625 85.71875 402.65625 87.140625Q402.65625 87.21875 402.65625 87.390625L398.40625 87.390625Q398.45312 88.328125 398.92188 88.828125Q399.40625 89.328125 400.125 89.328125Q400.65625 89.328125 401.03125 89.0625Q401.40625 88.78125 401.625 88.15625ZM398.45312 86.59375L401.64062 86.59375Q401.57812 85.875 401.28125 85.515625Q400.8125 84.96875 400.07812 84.96875Q399.40625 84.96875 398.95312 85.421875Q398.5 85.859375 398.45312 86.59375ZM403.71875 90.0L403.71875 84.296875L404.57812 84.296875L404.57812 85.15625Q404.92188 84.546875 405.20312 84.359375Q405.48438 84.171875 405.8125 84.171875Q406.3125 84.171875 406.8125 84.484375L406.48438 85.375Q406.125 85.171875 405.76562 85.171875Q405.45312 85.171875 405.20312 85.359375Q404.95312 85.546875 404.84375 85.890625Q404.6875 86.40625 404.6875 87.015625L404.6875 90.0L403.71875 90.0ZM407.73438 83.234375L407.73438 82.125L408.70312 82.125L408.70312 83.234375L407.73438 83.234375ZM407.73438 90.0L407.73438 84.296875L408.70312 84.296875L408.70312 90.0L407.73438 90.0ZM413.45312 87.90625L414.39062 88.03125Q414.25 89.015625 413.59375 89.578125Q412.95312 90.125 412.03125 90.125Q410.85938 90.125 410.14062 89.359375Q409.4375 88.59375 409.4375 87.171875Q409.4375 86.25 409.73438 85.5625Q410.04688 84.859375 410.67188 84.515625Q411.29688 84.171875 412.03125 84.171875Q412.95312 84.171875 413.54688 84.640625Q414.14062 85.109375 414.3125 85.96875L413.35938 86.109375Q413.23438 85.546875 412.89062 85.265625Q412.54688 84.96875 412.0625 84.96875Q411.34375 84.96875 410.875 85.5Q410.42188 86.015625 410.42188 87.140625Q410.42188 88.296875 410.85938 88.8125Q411.29688 89.328125 412.01562 89.328125Q412.57812 89.328125 412.95312 88.984375Q413.34375 88.640625 413.45312 87.90625Z" fill-rule="nonzero"/><path stroke="#34a853" stroke-width="4.0" stroke-linecap="butt" d="M431.0 86.5L443.0 86.5" fill-rule="nonzero"/><path fill="#1a1a1a" d="M451.84375 90.0L451.84375 82.125L452.90625 82.125L457.04688 88.3125L457.04688 82.125L458.04688 82.125L458.04688 90.0L456.96875 90.0L452.84375 83.8125L452.84375 90.0L451.84375 90.0ZM459.35938 87.140625Q459.35938 85.5625 460.25 84.796875Q460.98438 84.171875 462.04688 84.171875Q463.21875 84.171875 463.95312 84.9375Q464.70312 85.703125 464.70312 87.0625Q464.70312 88.171875 464.375 88.8125Q464.04688 89.4375 463.40625 89.78125Q462.78125 90.125 462.04688 90.125Q460.84375 90.125 460.09375 89.359375Q459.35938 88.59375 459.35938 87.140625ZM460.35938 87.140625Q460.35938 88.25 460.82812 88.796875Q461.3125 89.328125 462.04688 89.328125Q462.76562 89.328125 463.23438 88.78125Q463.71875 88.234375 463.71875 87.109375Q463.71875 86.0625 463.23438 85.515625Q462.75 84.96875 462.04688 84.96875Q461.3125 84.96875 460.82812 85.515625Q460.35938 86.046875 460.35938 87.140625ZM468.8125 90.0L468.8125 82.125L470.39062 82.125L472.25 87.703125Q472.5 88.484375 472.625 88.859375Q472.76562 88.4375 473.04688 87.609375L474.92188 82.125L476.32812 82.125L476.32812 90.0L475.32812 90.0L475.32812 83.40625L473.03125 90.0L472.09375 90.0L469.82812 83.296875L469.82812 90.0L468.8125 90.0ZM477.73438 83.234375L477.73438 82.125L478.70312 82.125L478.70312 83.234375L477.73438 83.234375ZM477.73438 90.0L477.73438 84.296875L478.70312 84.296875L478.70312 90.0L477.73438 90.0ZM479.71875 90.0L479.71875 84.296875L480.59375 84.296875L480.59375 85.109375Q481.21875 84.171875 482.40625 84.171875Q482.92188 84.171875 483.35938 84.359375Q483.79688 84.53125 484.0 84.84375Q484.21875 85.140625 484.3125 85.546875Q484.35938 85.828125 484.35938 86.5L484.35938 90.0L483.39062 90.0L483.39062 86.53125Q483.39062 85.9375 483.28125 85.65625Q483.17188 85.359375 482.875 85.1875Q482.59375 85.0 482.20312 85.0Q481.59375 85.0 481.14062 85.390625Q480.6875 85.78125 480.6875 86.890625L480.6875 90.0L479.71875 90.0ZM485.73438 83.234375L485.73438 82.125L486.70312 82.125L486.70312 83.234375L485.73438 83.234375ZM485.73438 90.0L485.73438 84.296875L486.70312 84.296875L486.70312 90.0L485.73438 90.0ZM487.71875 90.0L487.71875 84.296875L488.59375 84.296875L488.59375 85.09375Q488.85938 84.671875 489.29688 84.421875Q489.75 84.171875 490.3125 84.171875Q490.95312 84.171875 491.35938 84.4375Q491.76562 84.6875 491.9375 85.171875Q492.60938 84.171875 493.6875 84.171875Q494.54688 84.171875 495.0 84.640625Q495.45312 85.109375 495.45312 86.078125L495.45312 90.0L494.5 90.0L494.5 86.40625Q494.5 85.828125 494.40625 85.578125Q494.3125 85.3125 494.0625 85.15625Q493.8125 85.0 493.48438 85.0Q492.875 85.0 492.46875 85.40625Q492.07812 85.8125 492.07812 86.6875L492.07812 90.0L491.10938 90.0L491.10938 86.296875Q491.10938 85.65625 490.875 85.328125Q490.64062 85.0 490.10938 85.0Q489.70312 85.0 489.34375 85.21875Q489.0 85.4375 488.84375 85.859375Q488.6875 86.265625 488.6875 87.046875L488.6875 90.0L487.71875 90.0ZM500.46875 90.0L500.46875 89.15625Q499.79688 90.125 498.65625 90.125Q498.15625 90.125 497.70312 89.9375Q497.26562 89.734375 497.04688 89.453125Q496.84375 89.15625 496.76562 88.734375Q496.70312 88.453125 496.70312 87.828125L496.70312 84.296875L497.67188 84.296875L497.67188 87.453125Q497.67188 88.21875 497.73438 88.484375Q497.82812 88.859375 498.10938 89.078125Q498.40625 89.296875 498.84375 89.296875Q499.28125 89.296875 499.65625 89.078125Q500.04688 88.84375 500.20312 88.46875Q500.35938 88.078125 500.35938 87.359375L500.35938 84.296875L501.32812 84.296875L501.32812 90.0L500.46875 90.0ZM502.71875 90.0L502.71875 84.296875L503.59375 84.296875L503.59375 85.09375Q503.85938 84.671875 504.29688 84.421875Q504.75 84.171875 505.3125 84.171875Q505.95312 84.171875 506.35938 84.4375Q506.76562 84.6875 506.9375 85.171875Q507.60938 84.171875 508.6875 84.171875Q509.54688 84.171875 510.0 84.640625Q510.45312 85.109375 510.45312 86.078125L510.45312 90.0L509.5 90.0L509.5 86.40625Q509.5 85.828125 509.40625 85.578125Q509.3125 85.3125 509.0625 85.15625Q508.8125 85.0 508.48438 85.0Q507.875 85.0 507.46875 85.40625Q507.07812 85.8125 507.07812 86.6875L507.07812 90.0L506.10938 90.0L506.10938 86.296875Q506.10938 85.65625 505.875 85.328125Q505.64062 85.0 505.10938 85.0Q504.70312 85.0 504.34375 85.21875Q504.0 85.4375 503.84375 85.859375Q503.6875 86.265625 503.6875 87.046875L503.6875 90.0L502.71875 90.0ZM520.46875 87.234375L521.5156 87.5Q521.1875 88.78125 520.3281 89.46875Q519.4844 90.140625 518.25 90.140625Q516.96875 90.140625 516.1719 89.625Q515.375 89.09375 514.9531 88.109375Q514.5469 87.125 514.5469 86.0Q514.5469 84.78125 515.0156 83.859375Q515.4844 82.9375 516.34375 82.46875Q517.21875 81.984375 518.2656 81.984375Q519.4531 81.984375 520.25 82.59375Q521.0625 83.1875 521.375 84.28125L520.34375 84.53125Q520.0781 83.671875 519.5469 83.28125Q519.03125 82.890625 518.25 82.890625Q517.3281 82.890625 516.71875 83.328125Q516.1094 83.75 515.8594 84.484375Q515.625 85.21875 515.625 86.0Q515.625 87.0 515.90625 87.75Q516.2031 88.5 516.8125 88.875Q517.4375 89.25 518.15625 89.25Q519.03125 89.25 519.6406 88.75Q520.25 88.234375 520.46875 87.234375ZM522.71875 90.0L522.71875 82.125L523.6875 82.125L523.6875 84.953125Q524.375 84.171875 525.40625 84.171875Q526.03125 84.171875 526.5 84.421875Q526.96875 84.671875 527.1719 85.109375Q527.375 85.546875 527.375 86.390625L527.375 90.0L526.40625 90.0L526.40625 86.390625Q526.40625 85.65625 526.09375 85.328125Q525.78125 85.0 525.2031 85.0Q524.7656 85.0 524.3906 85.21875Q524.0156 85.4375 523.84375 85.828125Q523.6875 86.203125 523.6875 86.875L523.6875 90.0L522.71875 90.0ZM532.4531 89.296875Q531.90625 89.75 531.40625 89.9375Q530.9219 90.125 530.34375 90.125Q529.40625 90.125 528.8906 89.671875Q528.3906 89.203125 528.3906 88.5Q528.3906 88.078125 528.5781 87.734375Q528.78125 87.390625 529.0781 87.1875Q529.3906 86.96875 529.78125 86.859375Q530.0625 86.78125 530.6406 86.71875Q531.8125 86.578125 532.3594 86.375Q532.375 86.1875 532.375 86.125Q532.375 85.53125 532.09375 85.296875Q531.7344 84.96875 531.0 84.96875Q530.3125 84.96875 529.9844 85.203125Q529.6719 85.4375 529.5156 86.046875L528.5625 85.921875Q528.6875 85.3125 528.9844 84.9375Q529.28125 84.5625 529.84375 84.375Q530.40625 84.171875 531.1406 84.171875Q531.875 84.171875 532.3281 84.34375Q532.78125 84.515625 532.9844 84.78125Q533.2031 85.03125 533.2969 85.421875Q533.34375 85.671875 533.34375 86.328125L533.34375 87.609375Q533.34375 88.953125 533.40625 89.3125Q533.46875 89.671875 533.65625 90.0L532.6406 90.0Q532.4844 89.703125 532.4531 89.296875ZM532.3594 87.140625Q531.84375 87.359375 530.78125 87.5Q530.1875 87.59375 529.9375 87.703125Q529.7031 87.796875 529.5625 88.015625Q529.4219 88.21875 529.4219 88.46875Q529.4219 88.859375 529.71875 89.125Q530.0156 89.375 530.5781 89.375Q531.1406 89.375 531.5625 89.125Q532.0 88.875 532.21875 88.453125Q532.3594 88.125 532.3594 87.484375L532.3594 87.140625ZM534.71875 90.0L534.71875 84.296875L535.5781 84.296875L535.5781 85.15625Q535.9219 84.546875 536.2031 84.359375Q536.4844 84.171875 536.8125 84.171875Q537.3125 84.171875 537.8125 84.484375L537.4844 85.375Q537.125 85.171875 536.7656 85.171875Q536.4531 85.171875 536.2031 85.359375Q535.9531 85.546875 535.84375 85.890625Q535.6875 86.40625 535.6875 87.015625L535.6875 90.0L534.71875 90.0ZM542.4531 89.296875Q541.90625 89.75 541.40625 89.9375Q540.9219 90.125 540.34375 90.125Q539.40625 90.125 538.8906 89.671875Q538.3906 89.203125 538.3906 88.5Q538.3906 88.078125 538.5781 87.734375Q538.78125 87.390625 539.0781 87.1875Q539.3906 86.96875 539.78125 86.859375Q540.0625 86.78125 540.6406 86.71875Q541.8125 86.578125 542.3594 86.375Q542.375 86.1875 542.375 86.125Q542.375 85.53125 542.09375 85.296875Q541.7344 84.96875 541.0 84.96875Q540.3125 84.96875 539.9844 85.203125Q539.6719 85.4375 539.5156 86.046875L538.5625 85.921875Q538.6875 85.3125 538.9844 84.9375Q539.28125 84.5625 539.84375 84.375Q540.40625 84.171875 541.1406 84.171875Q541.875 84.171875 542.3281 84.34375Q542.78125 84.515625 542.9844 84.78125Q543.2031 85.03125 543.2969 85.421875Q543.34375 85.671875 543.34375 86.328125L543.34375 87.609375Q543.34375 88.953125 543.40625 89.3125Q543.46875 89.671875 543.65625 90.0L542.6406 90.0Q542.4844 89.703125 542.4531 89.296875ZM542.3594 87.140625Q541.84375 87.359375 540.78125 87.5Q540.1875 87.59375 539.9375 87.703125Q539.7031 87.796875 539.5625 88.015625Q539.4219 88.21875 539.4219 88.46875Q539.4219 88.859375 539.71875 89.125Q540.0156 89.375 540.5781 89.375Q541.1406 89.375 541.5625 89.125Q542.0 88.875 542.21875 88.453125Q542.3594 88.125 542.3594 87.484375L542.3594 87.140625ZM548.4531 87.90625L549.3906 88.03125Q549.25 89.015625 548.59375 89.578125Q547.9531 90.125 547.03125 90.125Q545.8594 90.125 545.1406 89.359375Q544.4375 88.59375 544.4375 87.171875Q544.4375 86.25 544.7344 85.5625Q545.0469 84.859375 545.6719 84.515625Q546.2969 84.171875 547.03125 84.171875Q547.9531 84.171875 548.5469 84.640625Q549.1406 85.109375 549.3125 85.96875L548.3594 86.109375Q548.2344 85.546875 547.8906 85.265625Q547.5469 84.96875 547.0625 84.96875Q546.34375 84.96875 545.875 85.5Q545.4219 86.015625 545.4219 87.140625Q545.4219 88.296875 545.8594 88.8125Q546.2969 89.328125 547.0156 89.328125Q547.5781 89.328125 547.9531 88.984375Q548.34375 88.640625 548.4531 87.90625ZM552.84375 89.140625L552.96875 89.984375Q552.5625 90.078125 552.25 90.078125Q551.71875 90.078125 551.4219 89.90625Q551.1406 89.734375 551.0156 89.46875Q550.90625 89.203125 550.90625 88.328125L550.90625 85.046875L550.1875 85.046875L550.1875 84.296875L550.90625 84.296875L550.90625 82.890625L551.8594 82.296875L551.8594 84.296875L552.84375 84.296875L552.84375 85.046875L551.8594 85.046875L551.8594 88.390625Q551.8594 88.796875 551.90625 88.921875Q551.96875 89.03125 552.0781 89.109375Q552.2031 89.171875 552.40625 89.171875Q552.5781 89.171875 552.84375 89.140625ZM557.625 88.15625L558.625 88.28125Q558.3906 89.15625 557.75 89.640625Q557.1094 90.125 556.125 90.125Q554.875 90.125 554.1406 89.359375Q553.40625 88.59375 553.40625 87.203125Q553.40625 85.75 554.1406 84.96875Q554.8906 84.171875 556.0625 84.171875Q557.21875 84.171875 557.9375 84.953125Q558.65625 85.71875 558.65625 87.140625Q558.65625 87.21875 558.65625 87.390625L554.40625 87.390625Q554.4531 88.328125 554.9219 88.828125Q555.40625 89.328125 556.125 89.328125Q556.65625 89.328125 557.03125 89.0625Q557.40625 88.78125 557.625 88.15625ZM554.4531 86.59375L557.6406 86.59375Q557.5781 85.875 557.28125 85.515625Q556.8125 84.96875 556.0781 84.96875Q555.40625 84.96875 554.9531 85.421875Q554.5 85.859375 554.4531 86.59375ZM559.71875 90.0L559.71875 84.296875L560.5781 84.296875L560.5781 85.15625Q560.9219 84.546875 561.2031 84.359375Q561.4844 84.171875 561.8125 84.171875Q562.3125 84.171875 562.8125 84.484375L562.4844 85.375Q562.125 85.171875 561.7656 85.171875Q561.4531 85.171875 561.2031 85.359375Q560.9531 85.546875 560.84375 85.890625Q560.6875 86.40625 560.6875 87.015625L560.6875 90.0L559.71875 90.0ZM563.34375 88.296875L564.2969 88.140625Q564.375 88.71875 564.7344 89.03125Q565.1094 89.328125 565.7656 89.328125Q566.4375 89.328125 566.75 89.0625Q567.0781 88.796875 567.0781 88.421875Q567.0781 88.09375 566.7969 87.90625Q566.59375 87.78125 565.8125 87.578125Q564.75 87.3125 564.3281 87.125Q563.9219 86.921875 563.7031 86.578125Q563.5 86.234375 563.5 85.8125Q563.5 85.421875 563.6719 85.109375Q563.84375 84.78125 564.15625 84.5625Q564.375 84.390625 564.7656 84.28125Q565.15625 84.171875 565.59375 84.171875Q566.2656 84.171875 566.7656 84.359375Q567.28125 84.546875 567.5156 84.890625Q567.7656 85.21875 567.8594 85.765625L566.9219 85.890625Q566.84375 85.453125 566.53125 85.21875Q566.2344 84.96875 565.6719 84.96875Q565.0 84.96875 564.71875 85.1875Q564.4375 85.40625 564.4375 85.703125Q564.4375 85.890625 564.5469 86.03125Q564.6719 86.1875 564.9219 86.296875Q565.0625 86.34375 565.78125 86.546875Q566.7969 86.8125 567.2031 86.984375Q567.6094 87.15625 567.84375 87.5Q568.0781 87.828125 568.0781 88.328125Q568.0781 88.8125 567.7969 89.234375Q567.5156 89.65625 566.9844 89.890625Q566.4531 90.125 565.78125 90.125Q564.6719 90.125 564.0781 89.671875Q563.5 89.203125 563.34375 88.296875Z" fill-rule="nonzero"/><path fill="#757575" d="M24.946875 42.4L24.946875 28.087502L30.3375 28.087502Q31.775 28.087502 32.525 28.212502Q33.571877 28.400002 34.290627 28.900002Q35.009377 29.384377 35.43125 30.275002Q35.86875 31.165627 35.86875 32.228127Q35.86875 34.05625 34.696877 35.321877Q33.540627 36.571877 30.509375 36.571877L26.8375 36.571877L26.8375 42.4L24.946875 42.4ZM26.8375 34.884377L30.540625 34.884377Q32.36875 34.884377 33.134377 34.2125Q33.915627 33.525 33.915627 32.275Q33.915627 31.384377 33.4625 30.743752Q33.009377 30.103127 32.275 29.900002Q31.790625 29.775002 30.49375 29.775002L26.8375 29.775002L26.8375 34.884377ZM44.49375 41.11875Q43.509377 41.946877 42.603127 42.290627Q41.696877 42.634377 40.665627 42.634377Q38.9625 42.634377 38.040627 41.80625Q37.11875 40.9625 37.11875 39.665627Q37.11875 38.9 37.4625 38.275Q37.821877 37.65 38.384377 37.275Q38.946877 36.884377 39.65 36.68125Q40.165627 36.55625 41.2125 36.415627Q43.3375 36.165627 44.3375 35.821877Q44.353127 35.4625 44.353127 35.353127Q44.353127 34.290627 43.853127 33.8375Q43.18125 33.24375 41.853127 33.24375Q40.603127 33.24375 40.009377 33.68125Q39.43125 34.11875 39.15 35.228127L37.43125 34.99375Q37.665627 33.884377 38.196877 33.2125Q38.728127 32.525 39.74375 32.165627Q40.759377 31.790627 42.103127 31.790627Q43.43125 31.790627 44.259377 32.103127Q45.0875 32.415627 45.478127 32.9Q45.86875 33.36875 46.025 34.0875Q46.11875 34.540627 46.11875 35.7125L46.11875 38.05625Q46.11875 40.509377 46.228127 41.165627Q46.3375 41.80625 46.68125 42.4L44.8375 42.4Q44.571877 41.853127 44.49375 41.11875ZM44.3375 37.196877Q43.384377 37.5875 41.4625 37.853127Q40.384377 38.009377 39.93125 38.2125Q39.49375 38.4 39.24375 38.775Q38.99375 39.15 38.99375 39.61875Q38.99375 40.321877 39.525 40.790627Q40.05625 41.259377 41.0875 41.259377Q42.103127 41.259377 42.884377 40.821877Q43.68125 40.36875 44.05625 39.603127Q44.3375 38.99375 44.3375 37.8375L44.3375 37.196877ZM48.009377 39.30625L49.759377 39.025Q49.9 40.071877 50.571877 40.634377Q51.24375 41.18125 52.446877 41.18125Q53.65 41.18125 54.228127 40.696877Q54.821877 40.196877 54.821877 39.540627Q54.821877 38.946877 54.30625 38.603127Q53.946877 38.36875 52.509377 38.009377Q50.571877 37.509377 49.821877 37.165627Q49.0875 36.80625 48.696877 36.18125Q48.30625 35.540627 48.30625 34.775Q48.30625 34.0875 48.61875 33.49375Q48.946877 32.9 49.49375 32.509377Q49.9 32.2125 50.603127 32.009377Q51.321877 31.790627 52.134377 31.790627Q53.353127 31.790627 54.275 32.15Q55.196877 32.49375 55.634377 33.103127Q56.071877 33.696877 56.24375 34.696877L54.525 34.93125Q54.4 34.134377 53.8375 33.696877Q53.275 33.24375 52.259377 33.24375Q51.040627 33.24375 50.525 33.65Q50.009377 34.040627 50.009377 34.571877Q50.009377 34.915627 50.228127 35.196877Q50.43125 35.478127 50.9 35.665627Q51.165627 35.759377 52.446877 36.103127Q54.321877 36.603127 55.05625 36.93125Q55.790627 37.24375 56.2125 37.853127Q56.634377 38.446877 56.634377 39.353127Q56.634377 40.228127 56.11875 41.009377Q55.603127 41.790627 54.634377 42.2125Q53.665627 42.634377 52.446877 42.634377Q50.43125 42.634377 49.36875 41.790627Q48.30625 40.946877 48.009377 39.30625ZM58.009377 39.30625L59.759377 39.025Q59.9 40.071877 60.571877 40.634377Q61.24375 41.18125 62.446877 41.18125Q63.65 41.18125 64.22813 40.696877Q64.82188 40.196877 64.82188 39.540627Q64.82188 38.946877 64.30625 38.603127Q63.946877 38.36875 62.509377 38.009377Q60.571877 37.509377 59.821877 37.165627Q59.0875 36.80625 58.696877 36.18125Q58.30625 35.540627 58.30625 34.775Q58.30625 34.0875 58.61875 33.49375Q58.946877 32.9 59.49375 32.509377Q59.9 32.2125 60.603127 32.009377Q61.321877 31.790627 62.134377 31.790627Q63.353127 31.790627 64.275 32.15Q65.19688 32.49375 65.63438 33.103127Q66.07188 33.696877 66.24375 34.696877L64.525 34.93125Q64.4 34.134377 63.8375 33.696877Q63.275 33.24375 62.259377 33.24375Q61.040627 33.24375 60.525 33.65Q60.009377 34.040627 60.009377 34.571877Q60.009377 34.915627 60.228127 35.196877Q60.43125 35.478127 60.9 35.665627Q61.165627 35.759377 62.446877 36.103127Q64.32188 36.603127 65.05625 36.93125Q65.79063 37.24375 66.2125 37.853127Q66.63438 38.446877 66.63438 39.353127Q66.63438 40.228127 66.11875 41.009377Q65.60313 41.790627 64.63438 42.2125Q63.665627 42.634377 62.446877 42.634377Q60.43125 42.634377 59.36875 41.790627Q58.30625 40.946877 58.009377 39.30625ZM70.63438 42.4L67.4625 32.025L69.275 32.025L70.93125 38.009377L71.54063 40.24375Q71.5875 40.071877 72.07188 38.103127L73.72813 32.025L75.54063 32.025L77.0875 38.040627L77.60313 40.025L78.19688 38.025L79.97813 32.025L81.68125 32.025L78.44688 42.4L76.61875 42.4L74.9625 36.18125L74.57188 34.415627L72.4625 42.4L70.63438 42.4ZM82.07188 37.2125Q82.07188 34.3375 83.66563 32.946877Q85.00938 31.790627 86.93125 31.790627Q89.07188 31.790627 90.41563 33.196877Q91.775 34.603127 91.775 37.071877Q91.775 39.071877 91.18125 40.228127Q90.5875 41.36875 89.43125 42.009377Q88.29063 42.634377 86.93125 42.634377Q84.74375 42.634377 83.4 41.24375Q82.07188 39.8375 82.07188 37.2125ZM83.86875 37.2125Q83.86875 39.2125 84.72813 40.196877Q85.60313 41.18125 86.93125 41.18125Q88.24375 41.18125 89.10313 40.196877Q89.97813 39.196877 89.97813 37.15Q89.97813 35.228127 89.10313 34.24375Q88.22813 33.24375 86.93125 33.24375Q85.60313 33.24375 84.72813 34.24375Q83.86875 35.228127 83.86875 37.2125ZM93.69688 42.4L93.69688 32.025L95.275 32.025L95.275 33.603127Q95.88438 32.49375 96.4 32.15Q96.91563 31.790627 97.525 31.790627Q98.41563 31.790627 99.3375 32.353127L98.72813 33.99375Q98.0875 33.603127 97.44688 33.603127Q96.86875 33.603127 96.4 33.9625Q95.94688 34.30625 95.74375 34.915627Q95.4625 35.853127 95.4625 36.9625L95.4625 42.4L93.69688 42.4ZM107.44688 42.4L107.44688 41.0875Q106.4625 42.634377 104.54063 42.634377Q103.30625 42.634377 102.25938 41.946877Q101.22813 41.259377 100.65 40.040627Q100.0875 38.821877 100.0875 37.228127Q100.0875 35.665627 100.60313 34.4Q101.11875 33.134377 102.15 32.4625Q103.19688 31.790627 104.4625 31.790627Q105.4 31.790627 106.13438 32.196877Q106.86875 32.5875 107.3375 33.2125L107.3375 28.087502L109.07188 28.087502L109.07188 42.4L107.44688 42.4ZM101.88438 37.228127Q101.88438 39.2125 102.72813 40.196877Q103.57188 41.18125 104.7125 41.18125Q105.86875 41.18125 106.66563 40.24375Q107.47813 39.30625 107.47813 37.36875Q107.47813 35.24375 106.65 34.24375Q105.8375 33.24375 104.63438 33.24375Q103.4625 33.24375 102.66563 34.2125Q101.88438 35.165627 101.88438 37.228127ZM117.94688 42.4L117.94688 28.087502L123.3375 28.087502Q124.775 28.087502 125.525 28.212502Q126.57188 28.400002 127.29063 28.900002Q128.00937 29.384377 128.43124 30.275002Q128.86874 31.165627 128.86874 32.228127Q128.86874 34.05625 127.69688 35.321877Q126.54063 36.571877 123.50938 36.571877L119.8375 36.571877L119.8375 42.4L117.94688 42.4ZM119.8375 34.884377L123.54063 34.884377Q125.36875 34.884377 126.13438 34.2125Q126.91563 33.525 126.91563 32.275Q126.91563 31.384377 126.4625 30.743752Q126.00938 30.103127 125.275 29.900002Q124.79063 29.775002 123.49375 29.775002L119.8375 29.775002L119.8375 34.884377ZM130.07187 37.2125Q130.07187 34.3375 131.66562 32.946877Q133.00937 31.790627 134.93124 31.790627Q137.07187 31.790627 138.41562 33.196877Q139.775 34.603127 139.775 37.071877Q139.775 39.071877 139.18124 40.228127Q138.5875 41.36875 137.43124 42.009377Q136.29062 42.634377 134.93124 42.634377Q132.74374 42.634377 131.4 41.24375Q130.07187 39.8375 130.07187 37.2125ZM131.86874 37.2125Q131.86874 39.2125 132.72812 40.196877Q133.60312 41.18125 134.93124 41.18125Q136.24374 41.18125 137.10312 40.196877Q137.97812 39.196877 137.97812 37.15Q137.97812 35.228127 137.10312 34.24375Q136.22812 33.24375 134.93124 33.24375Q133.60312 33.24375 132.72812 34.24375Q131.86874 35.228127 131.86874 37.2125ZM141.68124 42.4L141.68124 28.087502L143.43124 28.087502L143.43124 42.4L141.68124 42.4ZM145.72812 30.103127L145.72812 28.087502L147.49374 28.087502L147.49374 30.103127L145.72812 30.103127ZM145.72812 42.4L145.72812 32.025L147.49374 32.025L147.49374 42.4L145.72812 42.4ZM156.49374 38.603127L158.2125 38.821877Q157.93124 40.61875 156.75937 41.634377Q155.60312 42.634377 153.9 42.634377Q151.775 42.634377 150.47812 41.24375Q149.18124 39.853127 149.18124 37.259377Q149.18124 35.571877 149.72812 34.321877Q150.29062 33.05625 151.43124 32.43125Q152.57187 31.790627 153.91562 31.790627Q155.60312 31.790627 156.66562 32.65Q157.74374 33.509377 158.05624 35.071877L156.3375 35.3375Q156.10312 34.290627 155.47812 33.775Q154.85312 33.24375 153.97812 33.24375Q152.65 33.24375 151.82187 34.196877Q150.99374 35.15 150.99374 37.196877Q150.99374 39.290627 151.79062 40.24375Q152.5875 41.18125 153.88437 41.18125Q154.91562 41.18125 155.60312 40.55625Q156.30624 39.915627 156.49374 38.603127ZM159.63437 46.4L159.44687 44.74375Q160.025 44.9 160.44687 44.9Q161.04062 44.9 161.38437 44.696877Q161.74374 44.509377 161.9625 44.165627Q162.13437 43.9 162.50937 42.853127Q162.55624 42.696877 162.66562 42.415627L158.72812 32.025L160.61874 32.025L162.775 38.040627Q163.19687 39.18125 163.525 40.43125Q163.8375 39.228127 164.24374 38.071877L166.4625 32.025L168.22812 32.025L164.275 42.571877Q163.65 44.290627 163.29062 44.93125Q162.82187 45.80625 162.2125 46.196877Q161.61874 46.603127 160.775 46.603127Q160.25937 46.603127 159.63437 46.4ZM175.94687 42.4L175.94687 28.087502L181.3375 28.087502Q182.775 28.087502 183.525 28.212502Q184.57187 28.400002 185.29062 28.900002Q186.00937 29.384377 186.43124 30.275002Q186.86874 31.165627 186.86874 32.228127Q186.86874 34.05625 185.69687 35.321877Q184.54062 36.571877 181.50937 36.571877L177.8375 36.571877L177.8375 42.4L175.94687 42.4ZM177.8375 34.884377L181.54062 34.884377Q183.36874 34.884377 184.13437 34.2125Q184.91562 33.525 184.91562 32.275Q184.91562 31.384377 184.4625 30.743752Q184.00937 30.103127 183.275 29.900002Q182.79062 29.775002 181.49374 29.775002L177.8375 29.775002L177.8375 34.884377ZM195.82187 39.05625L197.63437 39.290627Q197.2125 40.86875 196.04062 41.759377Q194.88437 42.634377 193.07187 42.634377Q190.80624 42.634377 189.4625 41.24375Q188.13437 39.8375 188.13437 37.30625Q188.13437 34.68125 189.47812 33.24375Q190.82187 31.790627 192.97812 31.790627Q195.05624 31.790627 196.36874 33.2125Q197.69687 34.61875 197.69687 37.196877Q197.69687 37.353127 197.68124 37.665627L189.94687 37.665627Q190.04062 39.36875 190.91562 40.275Q191.79062 41.18125 193.0875 41.18125Q194.05624 41.18125 194.72812 40.68125Q195.41562 40.165627 195.82187 39.05625ZM190.04062 36.2125L195.8375 36.2125Q195.72812 34.915627 195.18124 34.259377Q194.3375 33.24375 192.99374 33.24375Q191.79062 33.24375 190.9625 34.05625Q190.13437 34.853127 190.04062 36.2125ZM199.69687 42.4L199.69687 32.025L201.275 32.025L201.275 33.603127Q201.88437 32.49375 202.4 32.15Q202.91562 31.790627 203.525 31.790627Q204.41562 31.790627 205.3375 32.353127L204.72812 33.99375Q204.0875 33.603127 203.44687 33.603127Q202.86874 33.603127 202.4 33.9625Q201.94687 34.30625 201.74374 34.915627Q201.4625 35.853127 201.4625 36.9625L201.4625 42.4L199.69687 42.4ZM207.13437 42.4L207.13437 33.4L205.5875 33.4L205.5875 32.025L207.13437 32.025L207.13437 30.931252Q207.13437 29.884377 207.32187 29.368752Q207.57187 28.681252 208.2125 28.259377Q208.85312 27.837502 210.00937 27.837502Q210.75937 27.837502 211.65 28.009377L211.38437 29.540627Q210.8375 29.446877 210.35312 29.446877Q209.55624 29.446877 209.2125 29.790627Q208.88437 30.134377 208.88437 31.071877L208.88437 32.025L210.91562 32.025L210.91562 33.4L208.88437 33.4L208.88437 42.4L207.13437 42.4ZM212.07187 37.2125Q212.07187 34.3375 213.66562 32.946877Q215.00937 31.790627 216.93124 31.790627Q219.07187 31.790627 220.41562 33.196877Q221.775 34.603127 221.775 37.071877Q221.775 39.071877 221.18124 40.228127Q220.5875 41.36875 219.43124 42.009377Q218.29062 42.634377 216.93124 42.634377Q214.74374 42.634377 213.4 41.24375Q212.07187 39.8375 212.07187 37.2125ZM213.86874 37.2125Q213.86874 39.2125 214.72812 40.196877Q215.60312 41.18125 216.93124 41.18125Q218.24374 41.18125 219.10312 40.196877Q219.97812 39.196877 219.97812 37.15Q219.97812 35.228127 219.10312 34.24375Q218.22812 33.24375 216.93124 33.24375Q215.60312 33.24375 214.72812 34.24375Q213.86874 35.228127 213.86874 37.2125ZM223.69687 42.4L223.69687 32.025L225.275 32.025L225.275 33.603127Q225.88437 32.49375 226.4 32.15Q226.91562 31.790627 227.525 31.790627Q228.41562 31.790627 229.3375 32.353127L228.72812 33.99375Q228.0875 33.603127 227.44687 33.603127Q226.86874 33.603127 226.4 33.9625Q225.94687 34.30625 225.74374 34.915627Q225.4625 35.853127 225.4625 36.9625L225.4625 42.4L223.69687 42.4ZM230.7125 42.4L230.7125 32.025L232.29062 32.025L232.29062 33.478127Q232.775 32.728127 233.5875 32.259377Q234.4 31.790627 235.43124 31.790627Q236.5875 31.790627 237.32187 32.275Q238.05624 32.74375 238.36874 33.603127Q239.60312 31.790627 241.57187 31.790627Q243.11874 31.790627 243.94687 32.65Q244.775 33.509377 244.775 35.275L244.775 42.4L243.025 42.4L243.025 35.86875Q243.025 34.80625 242.85312 34.353127Q242.68124 33.884377 242.22812 33.603127Q241.79062 33.321877 241.18124 33.321877Q240.0875 33.321877 239.35312 34.05625Q238.63437 34.775 238.63437 36.36875L238.63437 42.4L236.88437 42.4L236.88437 35.665627Q236.88437 34.49375 236.44687 33.915627Q236.025 33.321877 235.04062 33.321877Q234.30624 33.321877 233.66562 33.7125Q233.04062 34.103127 232.75937 34.853127Q232.47812 35.603127 232.47812 37.025L232.47812 42.4L230.7125 42.4ZM254.49374 41.11875Q253.50937 41.946877 252.60312 42.290627Q251.69687 42.634377 250.66562 42.634377Q248.9625 42.634377 248.04062 41.80625Q247.11874 40.9625 247.11874 39.665627Q247.11874 38.9 247.4625 38.275Q247.82187 37.65 248.38437 37.275Q248.94687 36.884377 249.65 36.68125Q250.16562 36.55625 251.2125 36.415627Q253.3375 36.165627 254.3375 35.821877Q254.35312 35.4625 254.35312 35.353127Q254.35312 34.290627 253.85312 33.8375Q253.18124 33.24375 251.85312 33.24375Q250.60312 33.24375 250.00937 33.68125Q249.43124 34.11875 249.15 35.228127L247.43124 34.99375Q247.66562 33.884377 248.19687 33.2125Q248.72812 32.525 249.74374 32.165627Q250.75937 31.790627 252.10312 31.790627Q253.43124 31.790627 254.25937 32.103127Q255.0875 32.415627 255.47812 32.9Q255.86874 33.36875 256.025 34.0875Q256.11874 34.540627 256.11874 35.7125L256.11874 38.05625Q256.11874 40.509377 256.22812 41.165627Q256.3375 41.80625 256.68124 42.4L254.8375 42.4Q254.57187 41.853127 254.49374 41.11875ZM254.3375 37.196877Q253.38437 37.5875 251.4625 37.853127Q250.38437 38.009377 249.93124 38.2125Q249.49374 38.4 249.24374 38.775Q248.99374 39.15 248.99374 39.61875Q248.99374 40.321877 249.525 40.790627Q250.05624 41.259377 251.0875 41.259377Q252.10312 41.259377 252.88437 40.821877Q253.68124 40.36875 254.05624 39.603127Q254.3375 38.99375 254.3375 37.8375L254.3375 37.196877ZM258.7125 42.4L258.7125 32.025L260.30624 32.025L260.30624 33.509377Q261.44687 31.790627 263.60312 31.790627Q264.54062 31.790627 265.32187 32.134377Q266.11874 32.4625 266.50937 33.009377Q266.9 33.55625 267.05624 34.30625Q267.15 34.80625 267.15 36.025L267.15 42.4L265.38437 42.4L265.38437 36.0875Q265.38437 35.009377 265.18124 34.478127Q264.97812 33.946877 264.44687 33.634377Q263.93124 33.321877 263.22812 33.321877Q262.10312 33.321877 261.29062 34.040627Q260.47812 34.74375 260.47812 36.728127L260.47812 42.4L258.7125 42.4ZM276.49374 38.603127L278.2125 38.821877Q277.93124 40.61875 276.75937 41.634377Q275.60312 42.634377 273.9 42.634377Q271.775 42.634377 270.47812 41.24375Q269.18124 39.853127 269.18124 37.259377Q269.18124 35.571877 269.72812 34.321877Q270.29062 33.05625 271.43124 32.43125Q272.57187 31.790627 273.91562 31.790627Q275.60312 31.790627 276.66562 32.65Q277.74374 33.509377 278.05624 35.071877L276.3375 35.3375Q276.10312 34.290627 275.47812 33.775Q274.85312 33.24375 273.97812 33.24375Q272.65 33.24375 271.82187 34.196877Q270.99374 35.15 270.99374 37.196877Q270.99374 39.290627 271.79062 40.24375Q272.5875 41.18125 273.88437 41.18125Q274.91562 41.18125 275.60312 40.55625Q276.30624 39.915627 276.49374 38.603127ZM286.82187 39.05625L288.63437 39.290627Q288.2125 40.86875 287.04062 41.759377Q285.88437 42.634377 284.07187 42.634377Q281.80624 42.634377 280.4625 41.24375Q279.13437 39.8375 279.13437 37.30625Q279.13437 34.68125 280.47812 33.24375Q281.82187 31.790627 283.97812 31.790627Q286.05624 31.790627 287.36874 33.2125Q288.69687 34.61875 288.69687 37.196877Q288.69687 37.353127 288.68124 37.665627L280.94687 37.665627Q281.04062 39.36875 281.91562 40.275Q282.79062 41.18125 284.0875 41.18125Q285.05624 41.18125 285.72812 40.68125Q286.41562 40.165627 286.82187 39.05625ZM281.04062 36.2125L286.8375 36.2125Q286.72812 34.915627 286.18124 34.259377Q285.3375 33.24375 283.99374 33.24375Q282.79062 33.24375 281.9625 34.05625Q281.13437 34.853127 281.04062 36.2125Z" fill-rule="nonzero"/></svg>
\ No newline at end of file
diff --git a/website/public/img/vault-perf-standby-1.png b/website/public/img/vault-perf-standby-1.png
deleted file mode 100644
index ea74d794044..00000000000
Binary files a/website/public/img/vault-perf-standby-1.png and /dev/null differ
diff --git a/website/public/img/vault-perf-standby.png b/website/public/img/vault-perf-standby.png
deleted file mode 100644
index 07d4cf6d01f..00000000000
Binary files a/website/public/img/vault-perf-standby.png and /dev/null differ
diff --git a/website/public/img/vault-pki-1.png b/website/public/img/vault-pki-1.png
deleted file mode 100644
index ede5200d52f..00000000000
Binary files a/website/public/img/vault-pki-1.png and /dev/null differ
diff --git a/website/public/img/vault-pki-2.png b/website/public/img/vault-pki-2.png
deleted file mode 100644
index 4e980d2e847..00000000000
Binary files a/website/public/img/vault-pki-2.png and /dev/null differ
diff --git a/website/public/img/vault-pki-3.png b/website/public/img/vault-pki-3.png
deleted file mode 100644
index 04d1a256a24..00000000000
Binary files a/website/public/img/vault-pki-3.png and /dev/null differ
diff --git a/website/public/img/vault-pki-4.png b/website/public/img/vault-pki-4.png
deleted file mode 100644
index 8cfbf75dcd2..00000000000
Binary files a/website/public/img/vault-pki-4.png and /dev/null differ
diff --git a/website/public/img/vault-pki-demo-2.png b/website/public/img/vault-pki-demo-2.png
deleted file mode 100644
index a4139891c85..00000000000
Binary files a/website/public/img/vault-pki-demo-2.png and /dev/null differ
diff --git a/website/public/img/vault-pki-demo.png b/website/public/img/vault-pki-demo.png
deleted file mode 100644
index e030210b857..00000000000
Binary files a/website/public/img/vault-pki-demo.png and /dev/null differ
diff --git a/website/public/img/vault-policy-1.png b/website/public/img/vault-policy-1.png
deleted file mode 100644
index da30f72e1ea..00000000000
Binary files a/website/public/img/vault-policy-1.png and /dev/null differ
diff --git a/website/public/img/vault-policy-2.png b/website/public/img/vault-policy-2.png
deleted file mode 100644
index 875c9c7095d..00000000000
Binary files a/website/public/img/vault-policy-2.png and /dev/null differ
diff --git a/website/public/img/vault-policy-authoring-workflow.png b/website/public/img/vault-policy-authoring-workflow.png
deleted file mode 100644
index 45e0a76bf71..00000000000
Binary files a/website/public/img/vault-policy-authoring-workflow.png and /dev/null differ
diff --git a/website/public/img/vault-policy-workflow.svg b/website/public/img/vault-policy-workflow.svg
deleted file mode 100644
index 4aba65ef2ee..00000000000
--- a/website/public/img/vault-policy-workflow.svg
+++ /dev/null
@@ -1,41 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 669 497">
-  <g fill="none" fill-rule="evenodd">
-    <path fill="#000" fill-rule="nonzero" d="M311.695 294.833h5.472l-8.314 28.304h-7.782l-8.31-28.304h5.47l6.74 23.547m27.43 4.703h-4.18l-.37-1.347c-1.8 1.187-3.9 1.82-6.05 1.82-3.72 0-5.31-2.59-5.31-6.147 0-4.21 1.8-5.81 5.94-5.81h4.89v-2.17c0-2.29-.62-3.1-3.89-3.1-1.9.02-3.79.23-5.64.63l-.62-3.95c2.28-.64 4.63-.96 6.99-.97 6.4 0 8.28 2.29 8.28 7.47v13.57zm-5.1-7.803h-3.77c-1.67 0-2.14.47-2.14 2.035 0 1.563.47 2.075 2.05 2.075 1.35-.017 2.68-.384 3.85-1.064l.02-3.046zm13.12-12.845v14.422c0 1.105.47 1.657 1.64 1.657 1.87-.213 3.68-.804 5.32-1.738v-14.34h5.1v20.66h-3.89l-.5-1.792c-2.52 1.3-5.29 2.054-8.11 2.21-3.38 0-4.59-2.412-4.59-6.105v-14.98h5.06zm14.76 20.648v-29.1l5.1-.713v29.827m15.22-.445c-1.44.513-2.95.786-4.47.81-3.72 0-5.6-1.78-5.6-5.473v-11.52h-3.05v-4.05h3.06v-5.13l5.09-.73v5.86h5.22l-.32 4.04h-4.9v10.78c-.06.51.11 1.02.47 1.38.36.36.87.52 1.37.44.87-.03 1.72-.17 2.55-.42l.61 3.99zM283 174l51.32 103L386 174H283zm57.428 20.677h5.974v5.935h-5.974v-5.935zm-11.896 23.95h-5.974v-6.04h5.974v6.04zm0-8.954h-5.974v-6.04h5.974v6.04zm0-8.955h-5.974v-6.04h5.974v6.04zm9.022 26.798h-6.04v-5.974h6.04v5.974zm0-8.955h-6.04v-5.97h6.04v5.98zm0-8.95h-6.04v-5.97h6.04v5.98zm0-8.99h-6.04v-5.93h6.04v5.94zm2.94 2.98h5.975v5.98h-6.05l.06-5.97zm0 14.93v-5.93h5.975v5.98l-5.98-.04z"/>
-    <g fill="#000">
-      <g fill-rule="nonzero">
-        <path d="M616.97 98.466v4.257c0 5.17-12.29 10.743-30.47 10.743s-30.47-5.574-30.47-10.743v-4.257c-1.014-1.013-1.624-1.723-1.928-3.75H554v8.007c0 7.196 14.32 12.77 32.5 12.77s32.5-5.574 32.5-12.77v-8.007h-.102c-.304 2.027-.914 2.737-1.93 3.75z"/>
-        <path d="M616.97 82.25v4.257c0 5.17-12.29 10.743-30.47 10.743s-30.47-5.574-30.47-10.743V82.25c-1.014-1.014-1.624-1.723-1.928-3.75H554v8.007c0 7.196 14.32 12.77 32.5 12.77s32.5-5.574 32.5-12.77V78.5h-.102c-.304 2.027-.914 2.736-1.93 3.75z"/>
-        <path d="M616.97 66.034v4.257c0 5.17-12.29 10.75-30.47 10.75s-30.47-5.57-30.47-10.74v-4.26c-1.014-1.01-1.624-1.72-1.928-3.75H554v8.01c0 7.2 14.32 12.77 32.5 12.77S619 77.49 619 70.29v-8.006h-.102c-.304 2.027-.914 2.736-1.93 3.75z"/>
-        <path d="M586.5 67.15c-18.18 0-32.5-5.677-32.5-12.772 0-7.094 14.32-12.77 32.5-12.77S619 47.08 619 54.278c0 7.195-14.32 12.87-32.5 12.87zm0-23.616c-18.18 0-30.47 5.574-30.47 10.743 0 5.17 12.29 10.743 30.47 10.743s30.47-5.574 30.47-10.743c0-5.17-12.29-10.743-30.47-10.743z"/>
-      </g>
-      <path d="M566.66 130.68h-1.72V144h7.5v-1.54h-5.78v-11.78zm8.28 0h4.66c3.26 0 4.28 1.7 4.28 3.82v5.68c0 2.12-1.02 3.82-4.28 3.82h-4.66v-13.32zm1.72 1.54v10.24h2.88c2.02 0 2.62-.84 2.62-2.4v-5.44c0-1.56-.6-2.4-2.62-2.4h-2.88zm15.9-1.54l4.5 13.32h-1.74l-1.1-3.2h-5.66l-1.08 3.2h-1.74l4.5-13.32h2.32zm1.22 8.62l-2.38-7.38-2.38 7.38h4.76zm5.54 4.7v-13.32h4.82c2.86 0 3.86 1.24 3.86 3.28v1.98c0 2.06-1 3.3-3.86 3.3h-3.1V144h-1.72zm6.96-10.02c0-1.32-.56-1.76-2.2-1.76h-3.04v5.48h3.04c1.64 0 2.2-.46 2.2-1.76v-1.96z"/>
-    </g>
-    <g fill="#000">
-      <g fill-rule="nonzero">
-        <path d="M86 41.313l-32 18.67v37.11l23.415 13.595v-1.798L55.56 96.157V60.844L86 43.188l30.44 17.656v35.312L86 113.813v1.875l32-18.594V59.906"/>
-        <path d="M71.17 83.97c-2.34 0-4.292-1.954-4.292-4.298 0-2.344 1.95-4.297 4.293-4.297s4.3 1.953 4.3 4.297c0 2.344-1.95 4.297-4.29 4.297zm0-7.11c-1.482 0-2.73 1.25-2.73 2.734s1.248 2.734 2.73 2.734c1.484 0 2.732-1.25 2.732-2.734 0-1.485-1.248-2.735-2.73-2.735z"/>
-        <path d="M78.195 91.703h-1.56v-3.828c0-1.406-1.094-2.5-2.498-2.5h-6.01c-1.405 0-2.498 1.094-2.498 2.5v3.828h-1.57v-3.828c0-2.266 1.79-4.063 4.06-4.063h6.01c2.26 0 4.05 1.797 4.05 4.063v3.828zm22.635-7.733c-2.342 0-4.293-1.954-4.293-4.298 0-2.344 1.95-4.297 4.292-4.297 2.34 0 4.29 1.953 4.29 4.297 0 2.344-1.95 4.297-4.3 4.297zm0-7.11c-1.484 0-2.732 1.25-2.732 2.734s1.248 2.734 2.73 2.734c1.484 0 2.733-1.25 2.733-2.734 0-1.485-1.24-2.735-2.73-2.735z"/>
-        <path d="M107.854 91.703h-1.56v-3.828c0-1.406-1.094-2.5-2.5-2.5h-6.01c-1.404 0-2.496 1.094-2.496 2.5v3.828h-1.56v-3.828c0-2.266 1.794-4.063 4.057-4.063h6.01c2.264 0 4.06 1.797 4.06 4.063v3.828zM86 69.906c-2.34 0-4.293-1.953-4.293-4.297 0-2.35 1.952-4.3 4.293-4.3 2.34 0 4.293 1.95 4.293 4.29S88.34 69.9 86 69.9zm0-7.11c-1.483 0-2.732 1.25-2.732 2.735 0 1.49 1.25 2.74 2.732 2.74 1.483 0 2.732-1.25 2.732-2.73s-1.25-2.73-2.732-2.73z"/>
-        <path d="M93.024 77.64h-1.56v-3.828c0-1.406-1.093-2.5-2.498-2.5h-6.01c-1.405 0-2.497 1.094-2.497 2.5v3.83h-1.57v-3.83c0-2.265 1.79-4.062 4.05-4.062h6.01c2.26 0 4.06 1.797 4.06 4.063v3.828z"/>
-      </g>
-      <path d="M62.68 140.56c0-2.6-.18-3.12-3.72-4-2.64-.66-2.64-.74-2.64-2.58 0-1.54.4-1.98 2.58-1.98 1.1 0 2.36.14 3.42.38l.14-1.46c-1.06-.28-2.44-.44-3.6-.44-3.3 0-4.26 1.12-4.26 3.44 0 2.76.38 3.38 3.6 4.1 2.74.62 2.76.78 2.76 2.58 0 1.52-.44 2.08-2.58 2.08-1.22 0-2.5-.2-3.72-.58l-.28 1.4c1.14.46 2.68.7 3.96.7 3.66 0 4.34-1.32 4.34-3.64zm4.08.04c0 1.54.42 2.16 2.32 2.16.96 0 2.02-.18 3.08-.46l.22 1.34c-.92.34-2.22.56-3.44.56-2.88 0-3.86-1.38-3.86-3.58v-2.92c0-2.02.92-3.64 3.82-3.64 2.88 0 3.66 1.66 3.66 3.68v2.04h-5.8v.82zm0-3.02v.8h4.18v-.8c0-1.36-.46-2.12-2.04-2.12s-2.14.76-2.14 2.12zm11.72 6.62c.86 0 1.84-.14 2.34-.3l-.16-1.4c-.76.16-1.46.22-2.14.22-1.68 0-2.24-.48-2.24-2v-3.18c0-1.52.56-2 2.24-2 .68 0 1.38.06 2.14.22l.14-1.4c-.5-.16-1.46-.3-2.32-.3-3.04 0-3.88 1.3-3.88 3.54v3.06c0 2.24.76 3.54 3.88 3.54zm4.8-9.94v7.46c0 1.5.56 2.48 2.12 2.48 1.16 0 2.84-.52 3.92-1.04l.16.84h1.36v-9.74h-1.68v7.36c-1.04.54-2.54.98-3.26.98-.62 0-.94-.26-.94-.9v-7.44h-1.68zm15-.2c-.96.4-1.96 1-2.68 1.56l-.1-1.36h-1.46V144h1.68v-6.72c.8-.56 1.86-1.24 2.78-1.68l-.22-1.54zm3.6 9.94v-9.74h-1.68V144h1.68zm0-11.3v-2.42h-1.68v2.42h1.68zm8.06 9.84c-.62.16-1.1.24-1.56.24-.9 0-1-.36-1-1.08v-6.04H110l.14-1.4h-2.76v-2.64l-1.68.24v2.4h-1.72v1.4h1.72v6.32c0 1.62.78 2.22 2.42 2.22.72 0 1.44-.14 2.04-.36l-.22-1.3zm3.58 5.4h1.58l1.38-3.94 3.22-9.74h-1.66l-2.7 8.4-2.66-8.4h-1.66l3.16 9.74h.7l-1.36 3.94zM67.63 168h1.72v-11.78h3.98v-1.54h-9.68v1.54h3.98V168zm8.88-3.4c0 1.54.42 2.16 2.32 2.16.96 0 2.02-.18 3.08-.46l.22 1.34c-.92.34-2.22.56-3.44.56-2.88 0-3.86-1.38-3.86-3.58v-2.92c0-2.02.92-3.64 3.82-3.64 2.88 0 3.66 1.66 3.66 3.68v2.04h-5.8v.82zm0-3.02v.8h4.18v-.8c0-1.36-.46-2.12-2.04-2.12s-2.14.76-2.14 2.12zm15.34-.36V168h-1.42l-.1-.72c-.86.6-1.98.92-3.16.92-1.82 0-2.58-1.08-2.58-2.8 0-2.02 1.02-2.74 2.98-2.74h2.6v-1.52c0-1.22-.54-1.64-2.12-1.64-.94 0-2.16.16-2.92.32l-.18-1.34c.92-.24 2.16-.42 3.2-.42 2.78 0 3.7 1.08 3.7 3.16zm-1.68 4.74v-1.9h-2.48c-1.04 0-1.42.32-1.42 1.3 0 1 .18 1.4 1.38 1.4.84 0 1.78-.32 2.52-.8zm18.08 2.04v-7.46c0-1.5-.56-2.48-2.12-2.48-1.22 0-2.86.48-4.02 1.04-.28-.66-.86-1.04-1.86-1.04-1.16 0-2.84.52-3.92 1.04l-.16-.84h-1.36V168h1.68v-7.36c1.04-.54 2.54-.98 3.26-.98.62 0 .94.26.94.9V168h1.68v-7.36c1.04-.54 2.46-.98 3.26-.98.62 0 .94.26.94.9V168h1.68z"/>
-    </g>
-    <g fill="#000">
-      <path d="M42.22 451h2.32l4.4-13.32h-1.66l-3.9 11.82-3.9-11.82h-1.66l4.4 13.32zm15.58-6.78V451h-1.42l-.1-.72c-.86.6-1.98.92-3.16.92-1.82 0-2.58-1.08-2.58-2.8 0-2.02 1.02-2.74 2.98-2.74h2.6v-1.52c0-1.22-.54-1.64-2.12-1.64-.94 0-2.16.16-2.92.32l-.18-1.34c.92-.24 2.16-.42 3.2-.42 2.78 0 3.7 1.08 3.7 3.16zm-1.68 4.74v-1.9h-2.48c-1.04 0-1.42.32-1.42 1.3 0 1 .18 1.4 1.38 1.4.84 0 1.78-.32 2.52-.8zm4.54-7.7v7.46c0 1.5.56 2.48 2.12 2.48 1.16 0 2.84-.52 3.92-1.04l.16.84h1.36v-9.74h-1.68v7.36c-1.04.54-2.54.98-3.26.98-.62 0-.94-.26-.94-.9v-7.44h-1.68zM73.1 451v-13.96l-1.68.24V451h1.68zm8.06-1.46c-.62.16-1.1.24-1.56.24-.9 0-1-.36-1-1.08v-6.04h2.62l.14-1.4H78.6v-2.64l-1.68.24v2.4H75.2v1.4h1.72v6.32c0 1.62.78 2.22 2.42 2.22.72 0 1.44-.14 2.04-.36l-.22-1.3zm6.92 1.46v-13.32h4.82c2.86 0 3.86 1.24 3.86 3.28v1.98c0 2.06-1 3.3-3.86 3.3h-3.1V451h-1.72zm6.96-10.02c0-1.32-.56-1.76-2.2-1.76H89.8v5.48h3.04c1.64 0 2.2-.46 2.2-1.76v-1.96zm11.5 6.56c0 2.04-1.12 3.66-3.96 3.66s-3.96-1.62-3.96-3.66v-2.82c0-2.04 1.12-3.66 3.96-3.66s3.96 1.62 3.96 3.66v2.82zm-1.68-2.88c0-1.42-.76-2.14-2.28-2.14-1.52 0-2.28.72-2.28 2.14v2.94c0 1.42.76 2.14 2.28 2.14 1.52 0 2.28-.72 2.28-2.14v-2.94zm6.06 6.34v-13.96l-1.68.24V451h1.68zm4.88 0v-9.74h-1.68V451h1.68zm0-11.3v-2.42h-1.68v2.42h1.68zm6.48 11.5c.86 0 1.84-.14 2.34-.3l-.16-1.4c-.76.16-1.46.22-2.14.22-1.68 0-2.24-.48-2.24-2v-3.18c0-1.52.56-2 2.24-2 .68 0 1.38.06 2.14.22l.14-1.4c-.5-.16-1.46-.3-2.32-.3-3.04 0-3.88 1.3-3.88 3.54v3.06c0 2.24.76 3.54 3.88 3.54zm5.96 3.74h1.58l1.38-3.94 3.22-9.74h-1.66l-2.7 8.4-2.66-8.4h-1.66l3.16 9.74h.7l-1.36 3.94z"/>
-      <g fill-rule="nonzero">
-        <path d="M113 423H58v-70.11h12.132v1.632H59.618v66.848h51.764v-66.848h-10.514v-1.63H113"/>
-        <path d="M68.272 379.467l-2.265-3.913 1.375-.815 1.456 2.52 9.22-5.38.81 1.46M68.272 392.5l-2.265-3.912 1.375-.815 1.456 2.526 9.22-5.38.81 1.46m-10.596 19.16l-2.265-3.92 1.375-.81 1.456 2.52 9.22-5.38.81 1.46m16.985-43.78h-1.618v-5.22c0-.41-.323-.66-.647-.66H77.412c-.405 0-.647.33-.647.66v5.13h-1.618v-5.14c0-1.3 1.052-2.28 2.265-2.28h16.176c1.294 0 2.265 1.06 2.265 2.28v5.21zm-13.588 20.38h24.265v1.63H82.265zm0 13.04h24.265v1.63H82.265zm0 13.04h24.265v1.63H82.265z"/>
-      </g>
-    </g>
-    <path stroke="#575757" d="M86.5 187.5v141.014m248 14.986V377m251-213.5V397M335 376.5H130.5M586 396.514H130.5m12-318.014h393"/>
-    <path fill="#FFF" d="M246 66h178v22H246z"/>
-    <path fill="#000" d="M256.49 81h-.79v-5.088c0-.423.013-.823.04-1.2-.07.067-.146.14-.23.214-.085.075-.472.392-1.162.952l-.43-.557 1.89-1.46h.683V81zm2.97-.518c0-.218.05-.383.15-.495.098-.112.24-.17.426-.17.19 0 .336.058.442.17.106.112.16.277.16.495 0 .212-.055.375-.162.49-.108.113-.254.17-.44.17-.166 0-.303-.052-.412-.154-.11-.103-.164-.27-.164-.506zm8.555-5.98c-.785 0-1.404.26-1.858.783-.454.522-.68 1.237-.68 2.146 0 .94.217 1.66.655 2.17.438.51 1.062.77 1.873.77.498 0 1.066-.09 1.704-.26v.73c-.5.19-1.11.28-1.84.28-1.05 0-1.87-.32-2.44-.95-.57-.63-.86-1.54-.86-2.72 0-.73.13-1.38.41-1.93.27-.55.67-.98 1.19-1.28.52-.3 1.13-.45 1.83-.45.75 0 1.4.14 1.96.41l-.35.71c-.55-.25-1.09-.38-1.63-.38zm7.75 3.817c0 .87-.22 1.55-.66 2.04-.44.49-1.047.73-1.822.73-.478 0-.903-.12-1.274-.34-.38-.23-.66-.55-.86-.97-.21-.42-.31-.91-.31-1.48 0-.88.22-1.56.65-2.04.43-.49 1.04-.73 1.81-.73.75 0 1.34.25 1.78.74.44.49.66 1.17.66 2.02zm-4.078 0c0 .68.136 1.2.41 1.56.273.36.675.53 1.206.53.53 0 .933-.18 1.208-.54.28-.36.42-.88.42-1.57 0-.68-.14-1.2-.41-1.55-.27-.36-.68-.53-1.21-.53-.53 0-.93.17-1.2.52-.27.34-.4.86-.4 1.55zm9.16 2.68v-3.47c0-.44-.1-.77-.298-.98-.2-.22-.51-.33-.94-.33-.56 0-.97.15-1.23.45-.26.3-.39.8-.39 1.5V81h-.81v-5.352h.66l.13.733h.04c.16-.26.39-.46.69-.61.3-.14.63-.21 1-.21.64 0 1.13.16 1.45.47.32.31.48.81.48 1.49V81h-.81zm6.137 0v-3.47c0-.44-.1-.77-.297-.98-.2-.22-.51-.33-.933-.33-.56 0-.97.15-1.23.45-.26.3-.39.8-.39 1.5V81h-.812v-5.352h.66l.13.733h.04c.166-.26.4-.46.7-.61.298-.14.632-.21 1-.21.644 0 1.13.16 1.455.47.325.31.488.81.488 1.49V81h-.81zm4.737.09c-.79 0-1.41-.24-1.87-.73-.45-.48-.68-1.15-.68-2.01 0-.86.22-1.55.64-2.06.43-.51 1-.76 1.71-.76.67 0 1.21.22 1.6.66.39.44.59 1.02.59 1.74v.51h-3.68c.02.63.18 1.11.48 1.43.3.33.72.49 1.27.49.58 0 1.15-.12 1.71-.36v.72c-.29.13-.56.21-.81.27-.25.05-.56.08-.92.08zm-.22-4.87c-.43 0-.77.14-1.02.42-.25.28-.4.67-.45 1.16h2.8c0-.51-.11-.91-.34-1.18-.22-.27-.55-.41-.97-.41zm5.71 4.87c-.77 0-1.37-.24-1.8-.72-.42-.48-.63-1.15-.63-2.03 0-.9.22-1.59.65-2.08.43-.49 1.05-.73 1.85-.73.26 0 .52.02.77.08.26.05.46.12.61.19l-.25.68c-.17-.07-.37-.13-.58-.18-.21-.05-.4-.07-.56-.07-1.08 0-1.63.69-1.63 2.08 0 .66.14 1.16.4 1.51.27.35.66.53 1.18.53.45 0 .91-.1 1.38-.29v.72c-.36.18-.81.28-1.35.28zm4.35-.67c.15 0 .28-.01.42-.03.14-.02.24-.05.32-.07v.62c-.09.04-.21.07-.39.1-.17.03-.32.04-.46.04-1.03 0-1.55-.55-1.55-1.64v-3.18h-.76v-.39l.77-.34.34-1.14h.47v1.24h1.56v.63h-1.56v3.15c0 .32.08.57.23.74.15.17.36.26.63.26zm9.01.57l-.89-2.27h-2.86l-.88 2.27h-.84l2.83-7.17h.7l2.8 7.18h-.86zm-1.14-3.02l-.83-2.21c-.1-.28-.21-.63-.33-1.03-.07.31-.17.65-.31 1.03l-.84 2.21h2.31zm3.63-2.34v3.47c0 .43.1.76.3.97.2.21.51.32.93.32.56 0 .97-.16 1.23-.46.26-.31.39-.81.39-1.5v-2.8h.81V81h-.67l-.12-.718h-.04c-.16.264-.39.466-.69.606-.29.14-.63.21-1.01.21-.65 0-1.14-.155-1.46-.464-.32-.31-.48-.804-.48-1.485v-3.51h.82zm7.11 4.78c.15 0 .28-.01.42-.03.14-.02.24-.05.32-.07v.62c-.09.04-.22.08-.39.1-.17.03-.32.04-.46.04-1.03 0-1.55-.55-1.55-1.64v-3.18h-.76v-.39l.77-.34.34-1.14h.47v1.24h1.55v.63h-1.56v3.15c0 .32.08.57.23.74.15.17.36.26.63.26zm5.47.57v-3.46c0-.44-.1-.76-.3-.98-.2-.22-.51-.32-.93-.32-.56 0-.97.15-1.23.45-.26.31-.39.81-.39 1.51V81h-.81v-7.598h.81v2.3c0 .277-.01.506-.04.69h.05c.16-.26.39-.46.68-.61.3-.147.63-.22 1.01-.22.66 0 1.15.154 1.47.465.33.31.49.805.49 1.482V81h-.81zm4.74.09c-.79 0-1.41-.24-1.87-.73-.45-.48-.68-1.15-.68-2.01 0-.86.21-1.55.64-2.05.42-.51.99-.77 1.71-.77.67 0 1.2.22 1.59.66.39.44.59 1.02.59 1.74v.52h-3.68c.02.63.17 1.11.48 1.43.3.33.73.49 1.27.49.58 0 1.15-.12 1.71-.36v.72c-.29.12-.56.21-.81.27-.25.05-.56.08-.92.08zm-.22-4.87c-.43 0-.77.14-1.03.42-.25.28-.4.67-.45 1.16h2.8c0-.51-.11-.9-.34-1.18-.23-.27-.55-.41-.97-.41zm7.23 4.77v-3.46c0-.44-.1-.76-.29-.98-.2-.22-.51-.32-.93-.32-.56 0-.97.15-1.23.45-.26.3-.39.8-.39 1.5V81h-.81v-5.352h.66l.13.733h.04c.17-.26.4-.46.7-.61.3-.14.64-.21 1-.21.65 0 1.13.16 1.46.47.33.31.49.81.49 1.49V81h-.81zm4.21-.57c.15 0 .28-.02.42-.04.14-.02.24-.05.32-.07v.62c-.09.04-.22.07-.39.1s-.32.04-.46.04c-1.03 0-1.55-.55-1.55-1.64v-3.18h-.76v-.39l.76-.34.34-1.14h.47v1.24h1.55v.63h-1.55v3.15c0 .32.08.57.23.74.15.17.36.26.63.26zm2.62.57h-.81v-5.35h.81V81zm-.88-6.81c0-.19.05-.32.14-.41.09-.09.21-.13.34-.13.13 0 .25.04.34.13.1.08.14.22.14.4 0 .18-.04.32-.14.41-.09.09-.21.13-.34.13-.13 0-.25-.05-.34-.14-.09-.09-.13-.23-.13-.41zm4.74 6.9c-.77 0-1.37-.24-1.8-.72-.42-.48-.63-1.15-.63-2.03 0-.89.21-1.59.65-2.07.43-.49 1.05-.74 1.85-.74.26 0 .52.03.77.08.26.05.46.12.61.19l-.25.68c-.18-.07-.37-.13-.58-.18-.21-.05-.4-.07-.56-.07-1.09 0-1.63.69-1.63 2.08 0 .66.13 1.16.4 1.51.27.35.66.53 1.18.53.45 0 .9-.1 1.37-.29v.72c-.36.18-.81.28-1.35.28zm5.91-.1l-.16-.77h-.04c-.26.34-.53.56-.8.68-.26.12-.59.18-.99.18-.53 0-.94-.14-1.25-.41-.3-.27-.45-.66-.45-1.17 0-1.08.87-1.65 2.6-1.7l.91-.03v-.34c0-.42-.09-.73-.27-.93-.18-.2-.47-.3-.87-.3-.44 0-.95.14-1.51.41l-.25-.62c.27-.14.56-.26.87-.34.32-.08.63-.12.95-.12.64 0 1.11.14 1.42.42.31.28.46.74.46 1.36V81h-.6zm-1.83-.57c.51 0 .9-.14 1.19-.42.29-.28.43-.67.43-1.17v-.49l-.81.04c-.64.02-1.11.12-1.39.3-.28.18-.43.45-.43.83 0 .29.09.51.27.67.18.15.43.23.74.23zm5.83 0c.14 0 .28-.02.42-.04.14-.02.24-.04.32-.06v.62c-.09.04-.22.08-.39.1-.17.03-.32.04-.46.04-1.03 0-1.55-.55-1.55-1.64v-3.18h-.77v-.39l.77-.34.34-1.14h.47v1.24h1.55v.63h-1.56v3.15c0 .32.08.57.23.74.15.17.36.26.63.26zm2.61.57h-.81v-5.35h.81V81zm-.87-6.81c0-.19.04-.32.14-.41.09-.09.21-.13.34-.13.13 0 .25.04.34.13.09.09.14.22.14.4 0 .18-.05.31-.14.4-.09.09-.21.13-.34.13-.13 0-.25-.04-.34-.13-.09-.09-.13-.23-.13-.41zm7.22 4.12c0 .87-.22 1.55-.66 2.04-.44.49-1.04.73-1.82.73-.48 0-.9-.11-1.27-.33-.37-.23-.65-.55-.86-.97-.2-.42-.3-.92-.3-1.48 0-.88.22-1.56.66-2.04.43-.49 1.04-.73 1.81-.73.75 0 1.34.25 1.78.74.44.5.66 1.17.66 2.02zm-4.07 0c0 .68.13 1.21.41 1.56.27.35.67.53 1.2.53s.93-.18 1.21-.54c.27-.36.41-.88.41-1.57 0-.68-.14-1.2-.41-1.55-.27-.35-.68-.53-1.22-.53-.53 0-.93.17-1.2.52-.27.35-.4.86-.4 1.55zm9.16 2.68V77.5c0-.433-.1-.76-.3-.973-.2-.215-.51-.323-.93-.323-.56 0-.97.15-1.23.45-.26.306-.39.806-.39 1.5V81h-.81v-5.352h.66l.13.733h.04c.17-.26.4-.46.7-.61.3-.14.63-.21 1-.21.64 0 1.13.16 1.45.47.33.31.49.81.49 1.49V81H372zm5.19-7.14h2.01c.95 0 1.64.14 2.06.42.43.29.64.73.64 1.35 0 .42-.12.77-.35 1.04-.23.27-.58.45-1.03.53v.05c1.08.18 1.63.75 1.63 1.71 0 .64-.21 1.13-.64 1.49-.43.36-1.03.54-1.81.54h-2.49V73.8zm.83 3.06h1.37c.58 0 1-.09 1.26-.28.26-.19.39-.5.39-.93 0-.4-.14-.69-.43-.87-.28-.18-.74-.27-1.36-.27h-1.22v2.34zm0 .7v2.67h1.49c.57 0 1.01-.11 1.3-.34.29-.23.44-.58.44-1.05 0-.44-.15-.77-.45-.98-.3-.21-.75-.32-1.36-.32h-1.42zm8.82 3.38l-.16-.76h-.04c-.27.33-.53.56-.8.68s-.59.18-.99.18c-.53 0-.95-.14-1.25-.41-.3-.28-.45-.67-.45-1.17 0-1.08.86-1.65 2.59-1.7l.91-.03v-.33c0-.42-.09-.73-.27-.93-.19-.2-.47-.3-.87-.3-.45 0-.95.13-1.52.41l-.25-.62c.27-.15.56-.26.87-.34.32-.09.63-.13.95-.13.64 0 1.11.14 1.42.42.31.28.46.74.46 1.36V81h-.6zm-1.83-.57c.51 0 .9-.14 1.19-.42.29-.27.43-.66.43-1.16v-.48l-.81.03c-.65.02-1.11.12-1.39.3-.28.18-.42.45-.42.83 0 .29.09.52.27.67.18.15.43.23.75.23zm6.24.67c-.77 0-1.37-.24-1.8-.72-.42-.48-.64-1.15-.64-2.03 0-.9.22-1.59.65-2.08.43-.49 1.05-.73 1.85-.73.26 0 .52.03.77.08.26.05.46.12.61.19l-.25.69c-.18-.08-.37-.13-.59-.18-.21-.05-.4-.07-.56-.07-1.08 0-1.63.69-1.63 2.08 0 .65.14 1.16.4 1.51.27.35.66.52 1.18.52.45 0 .91-.1 1.37-.29v.72c-.35.18-.81.28-1.35.28zm3.42-2.84c.14-.2.36-.46.64-.78l1.73-1.83h.96l-2.17 2.28 2.32 3.07h-.98l-1.89-2.53-.61.52v2h-.8V73.4h.8v4.03c0 .177-.01.453-.04.83h.04zm6.71 2.84c-.79 0-1.41-.24-1.87-.72-.46-.48-.69-1.15-.69-2.01 0-.86.22-1.55.64-2.06.43-.51 1-.77 1.71-.77.67 0 1.2.22 1.59.66.4.44.59 1.02.59 1.74v.51h-3.68c.02.63.18 1.1.48 1.43.31.33.73.49 1.28.49.58 0 1.15-.12 1.71-.36v.72c-.29.12-.56.21-.81.27-.25.05-.56.08-.92.08zm-.22-4.87c-.43 0-.77.14-1.03.42-.25.28-.4.67-.45 1.16h2.8c0-.51-.11-.9-.34-1.18-.23-.28-.55-.41-.98-.41zm7.23 4.77V77.5c0-.433-.09-.76-.29-.973-.2-.215-.51-.323-.93-.323-.56 0-.97.15-1.23.455-.26.3-.39.8-.39 1.5V81h-.81v-5.352h.66l.13.733h.04c.17-.26.4-.46.7-.61.3-.14.64-.21 1-.21.65 0 1.13.16 1.46.47.33.31.49.81.49 1.49V81h-.81zm6.12-.72h-.04c-.38.54-.94.81-1.68.81-.7 0-1.25-.24-1.64-.71-.39-.48-.58-1.16-.58-2.04 0-.89.19-1.57.58-2.06.39-.49.94-.73 1.63-.73.73 0 1.29.26 1.67.79h.07l-.04-.38-.02-.38V73.4h.81V81h-.66l-.1-.718zm-1.62.13c.55 0 .96-.15 1.21-.46.25-.3.37-.79.37-1.46v-.17c0-.76-.12-1.3-.38-1.63-.25-.33-.65-.49-1.21-.49-.47 0-.84.18-1.09.55-.25.37-.38.89-.38 1.56 0 .68.13 1.2.38 1.54.25.35.62.52 1.11.52z"/>
-    <path fill="#FFF" d="M168 364h129v22H168z"/>
-    <path fill="#000" d="M180.912 373.54c0 .457-.128.83-.383 1.12-.26.29-.62.483-1.09.58v.04c.57.07 1 .253 1.27.546.27.293.41.677.41 1.153 0 .68-.24 1.2-.71 1.56s-1.15.55-2.02.55c-.38 0-.72-.03-1.04-.09-.32-.06-.62-.16-.92-.3v-.77c.3.15.63.27.98.35.35.08.68.12.99.12 1.23 0 1.85-.49 1.85-1.45 0-.87-.68-1.3-2.04-1.3h-.71v-.7h.71c.56 0 1-.13 1.32-.37.33-.25.49-.59.49-1.02 0-.35-.12-.62-.36-.82-.24-.2-.56-.3-.97-.3-.32 0-.61.04-.89.12-.28.08-.59.24-.95.47l-.41-.55c.29-.23.63-.42 1.01-.55.38-.13.78-.2 1.21-.2.69 0 1.23.16 1.61.47.38.32.57.75.57 1.3zm1.548 4.942c0-.218.05-.383.15-.495.098-.112.24-.17.426-.17.19 0 .336.058.442.17.106.112.16.277.16.495 0 .212-.055.375-.162.49-.108.113-.254.17-.44.17-.166 0-.303-.052-.412-.154-.11-.103-.164-.27-.164-.506zm10.89-6.62v4.618c0 .814-.247 1.454-.74 1.92-.49.465-1.166.698-2.025.698-.86 0-1.524-.235-1.995-.703-.47-.47-.705-1.114-.705-1.934v-4.6h.83v4.66c0 .6.163 1.06.488 1.38.326.32.804.48 1.436.48.6 0 1.06-.16 1.39-.48.32-.32.49-.78.49-1.38v-4.65h.83zm4.256 7.236c-.348 0-.666-.065-.954-.193-.288-.13-.53-.327-.725-.593h-.06c.04.312.06.608.06.888v2.202h-.81v-7.754h.658l.113.733h.04c.207-.29.45-.5.726-.63.277-.13.594-.19.952-.19.71 0 1.258.25 1.644.73.385.49.578 1.17.578 2.04 0 .88-.196 1.57-.588 2.05-.393.49-.937.73-1.634.73zm-.117-4.86c-.55 0-.95.153-1.19.455-.25.303-.37.785-.38 1.446v.18c0 .75.12 1.29.37 1.61.25.32.65.48 1.2.48.46 0 .82-.19 1.08-.57.26-.38.39-.89.39-1.55 0-.67-.13-1.18-.4-1.54-.26-.36-.63-.54-1.11-.54zm4.56 4.762h-.81v-7.598h.81V379zm6.33-2.68c0 .872-.22 1.553-.66 2.043-.44.49-1.05.735-1.82.735-.48 0-.91-.113-1.28-.337-.37-.22-.66-.54-.86-.96-.2-.42-.3-.91-.3-1.47 0-.87.22-1.55.65-2.04.43-.48 1.04-.73 1.81-.73.75 0 1.34.25 1.78.75.44.5.66 1.17.66 2.02zm-4.08 0c0 .683.13 1.204.41 1.562.27.358.67.537 1.2.537.53 0 .93-.18 1.21-.54.27-.36.41-.88.41-1.57 0-.68-.14-1.2-.42-1.55-.28-.36-.68-.53-1.22-.53-.53 0-.93.17-1.2.52-.27.34-.41.86-.41 1.55zm8.79 2.68l-.16-.762h-.04c-.27.336-.53.563-.8.68-.27.12-.6.18-1 .18-.53 0-.95-.137-1.25-.41-.3-.274-.45-.663-.45-1.167 0-1.08.86-1.64 2.59-1.7l.91-.02v-.33c0-.42-.09-.73-.27-.93-.18-.2-.47-.3-.87-.3-.45 0-.95.14-1.52.41l-.25-.62c.26-.14.55-.25.86-.33.31-.08.63-.12.94-.12.63 0 1.11.15 1.42.43.3.29.46.74.46 1.37V379h-.6zm-1.83-.57c.5 0 .9-.14 1.19-.416.29-.277.43-.664.43-1.162v-.484l-.81.034c-.65.023-1.11.123-1.4.3-.29.178-.43.454-.43.828 0 .293.09.516.26.67.17.152.42.23.74.23zm7.74-.148h-.05c-.38.544-.94.816-1.68.816-.7 0-1.25-.24-1.64-.718-.39-.48-.59-1.16-.59-2.04 0-.883.19-1.57.58-2.057.39-.488.94-.732 1.63-.732.73 0 1.29.27 1.67.8h.07l-.04-.38-.02-.37v-2.17h.81V379h-.66l-.11-.718zm-1.62.137c.55 0 .95-.16 1.2-.46.25-.3.37-.79.37-1.46v-.17c0-.76-.13-1.3-.38-1.63-.25-.33-.66-.49-1.21-.49-.48 0-.84.18-1.1.55-.25.37-.38.89-.38 1.56 0 .68.12 1.2.37 1.54.25.35.62.52 1.1.52zm11.35-4.48c0 .72-.25 1.28-.74 1.67-.5.38-1.2.58-2.12.58h-.84V379h-.83v-7.14h1.85c1.78 0 2.67.695 2.67 2.08zm-3.7 1.54h.75c.73 0 1.26-.12 1.59-.36.33-.24.49-.62.49-1.15 0-.48-.16-.83-.47-1.06-.31-.23-.79-.35-1.45-.35h-.93v2.9zm9.69.84c0 .87-.22 1.55-.66 2.04-.44.49-1.05.73-1.82.73-.48 0-.91-.12-1.28-.34-.37-.23-.66-.55-.86-.97-.2-.42-.31-.91-.31-1.48 0-.88.22-1.56.66-2.04.43-.49 1.04-.73 1.81-.73.75 0 1.34.25 1.78.74.44.49.66 1.17.66 2.02zm-4.08 0c0 .68.14 1.2.41 1.56.27.36.68.53 1.21.53s.93-.18 1.2-.54c.27-.36.41-.88.41-1.57 0-.68-.14-1.2-.41-1.55-.28-.36-.68-.53-1.22-.53-.53 0-.93.17-1.2.52-.27.34-.41.86-.41 1.55zm6.31 2.68h-.81v-7.6h.81v7.6zm2.53 0h-.81v-5.36h.81V379zm-.88-6.81c0-.19.05-.32.14-.41.09-.09.2-.13.34-.13.13 0 .24.04.33.13.09.08.14.22.14.4 0 .18-.05.32-.14.41-.1.09-.21.13-.34.13-.14 0-.25-.05-.34-.14-.09-.09-.14-.23-.14-.41zm4.74 6.9c-.78 0-1.38-.24-1.8-.72-.43-.48-.64-1.15-.64-2.03 0-.9.21-1.59.64-2.08.43-.49 1.04-.73 1.84-.73.26 0 .51.02.77.08.25.05.46.12.6.19l-.25.68c-.18-.07-.38-.13-.59-.18-.21-.05-.4-.07-.56-.07-1.09 0-1.63.69-1.63 2.08 0 .66.13 1.16.39 1.51.27.35.66.53 1.18.53.45 0 .9-.1 1.37-.29v.72c-.36.18-.81.28-1.35.28zm1.77-5.45h.87l1.17 3.05c.26.69.42 1.2.48 1.51h.04c.04-.17.13-.45.26-.86.14-.4.58-1.64 1.33-3.71h.87l-2.3 6.09c-.23.6-.49 1.03-.8 1.28-.3.25-.68.37-1.12.37-.25 0-.49-.03-.73-.08v-.65c.18.04.38.06.6.06.55 0 .95-.32 1.19-.94l.3-.76-2.16-5.39zm10.21 4.78c.14 0 .28-.01.41-.03.13-.02.24-.05.32-.07v.62c-.09.04-.22.07-.39.1s-.33.04-.46.04c-1.04 0-1.56-.55-1.56-1.64v-3.19h-.77v-.39l.76-.34.34-1.14h.47v1.24H256v.63h-1.55v3.15c0 .32.07.57.23.74.15.17.36.26.63.26zm6.42-2.11c0 .87-.22 1.55-.66 2.04-.44.49-1.05.73-1.82.73-.48 0-.91-.12-1.28-.34-.37-.23-.66-.55-.86-.97-.2-.42-.3-.92-.3-1.48 0-.87.22-1.55.65-2.04.43-.49 1.04-.73 1.81-.73.75 0 1.34.25 1.78.75.44.49.66 1.17.66 2.02zm-4.08 0c0 .68.13 1.2.41 1.56.27.36.67.53 1.2.53.53 0 .93-.18 1.2-.54.27-.36.41-.88.41-1.57 0-.68-.14-1.2-.42-1.55-.28-.36-.68-.53-1.22-.53-.53 0-.93.17-1.2.52-.27.34-.41.86-.41 1.55zm12.29-4.46h.89l-2.58 7.14h-.82l-2.56-7.14h.88l1.64 4.62c.19.53.34 1.04.45 1.54.12-.53.27-1.06.46-1.58l1.63-4.59zm5.04 7.14l-.16-.77h-.04c-.27.33-.54.56-.8.68-.27.12-.6.18-1 .18-.53 0-.95-.14-1.25-.41-.31-.28-.46-.67-.46-1.17 0-1.08.86-1.65 2.59-1.7l.9-.03v-.33c0-.42-.09-.73-.27-.93-.18-.2-.47-.3-.87-.3-.45 0-.95.13-1.52.41l-.25-.62c.26-.15.55-.26.87-.34.31-.08.63-.12.94-.12.63 0 1.11.14 1.41.42.31.28.46.74.46 1.36V379h-.6zm-1.83-.57c.5 0 .9-.14 1.19-.42.28-.28.43-.67.43-1.16v-.49l-.81.03c-.65.02-1.11.12-1.4.3-.29.18-.43.45-.43.83 0 .29.08.51.26.67.18.15.42.23.74.23zm4.86-4.79v3.47c0 .43.1.76.3.97.2.21.51.32.93.32.56 0 .97-.16 1.23-.46.26-.31.39-.81.39-1.5v-2.81h.81V379h-.67l-.12-.718h-.05c-.17.264-.4.466-.69.606-.3.14-.63.21-1.01.21-.65 0-1.14-.155-1.46-.464-.32-.31-.48-.804-.48-1.485v-3.51h.82zm6.19 5.35h-.81v-7.6h.81v7.6zm3.44-.57c.14 0 .28-.02.41-.04.13-.02.24-.05.31-.07v.62c-.09.04-.22.08-.39.1-.17.03-.33.04-.46.04-1.04 0-1.55-.55-1.55-1.64v-3.19h-.77v-.39l.76-.34.34-1.14h.47v1.24h1.55v.63h-1.55v3.15c0 .32.07.57.23.74.15.17.36.26.63.26z"/>
-    <path fill="#FFF" d="M30 249h113v22H30z"/>
-    <path fill="#000" d="M41.18 264h-4.69v-.698l1.88-1.89c.573-.58.95-.993 1.133-1.24.183-.248.32-.488.41-.723.092-.24.138-.49.138-.76 0-.38-.11-.68-.34-.91-.23-.23-.55-.34-.96-.34-.29 0-.58.05-.84.14-.26.09-.56.27-.88.53l-.43-.55c.66-.55 1.38-.82 2.15-.82.67 0 1.2.17 1.58.51.38.34.57.8.57 1.38 0 .45-.12.9-.38 1.34-.25.44-.73 1-1.42 1.68l-1.56 1.53v.03h3.67v.76zm1.28-.518c0-.218.05-.383.15-.495.098-.112.24-.17.426-.17.19 0 .336.058.442.17.106.112.16.277.16.495 0 .212-.055.375-.162.49-.108.113-.254.17-.44.17-.166 0-.303-.052-.412-.154-.11-.103-.164-.27-.164-.506zm9.985.518l-.888-2.27h-2.862l-.88 2.27h-.838l2.822-7.168h.69L53.3 264h-.86zm-1.147-3.018l-.83-2.21c-.108-.28-.218-.625-.332-1.032-.072.313-.174.656-.308 1.03l-.84 2.212h2.31zm3.628-2.334v3.472c0 .436.1.762.298.977.198.215.51.322.932.322.56 0 .97-.16 1.228-.46.26-.31.388-.81.388-1.5v-2.82h.81V264h-.668l-.117-.718h-.044c-.166.264-.396.466-.69.606-.296.14-.632.21-1.01.21-.65 0-1.138-.155-1.462-.464-.32-.31-.48-.804-.48-1.485v-3.51h.82zm7.104 4.78c.144 0 .282-.01.415-.03.134-.022.24-.044.318-.067v.62c-.088.05-.218.08-.388.11s-.325.04-.462.04c-1.035 0-1.553-.54-1.553-1.63v-3.18h-.766v-.39l.766-.34.342-1.14h.47v1.24h1.552v.63H61.17v3.15c0 .32.077.57.23.74.153.18.363.26.63.26zm5.464.572v-3.462c0-.436-.1-.762-.298-.976-.198-.215-.51-.323-.932-.323-.563 0-.974.15-1.233.45-.25.3-.38.81-.38 1.5v2.8h-.81v-7.6h.81v2.3c0 .28-.01.5-.04.69h.05c.16-.26.39-.46.68-.61.3-.15.63-.22 1.01-.22.66 0 1.15.15 1.47.46.33.31.49.8.49 1.48v3.5h-.81zm7.095-2.68c0 .872-.22 1.553-.66 2.043-.44.49-1.05.735-1.83.735-.48 0-.91-.113-1.28-.337-.37-.22-.66-.54-.86-.96-.2-.42-.3-.91-.3-1.47 0-.87.22-1.55.65-2.04.43-.48 1.04-.73 1.81-.73.75 0 1.34.25 1.78.75.44.5.66 1.17.66 2.02zm-4.08 0c0 .683.13 1.204.41 1.562.27.358.67.537 1.2.537.53 0 .93-.18 1.21-.54.27-.36.41-.88.41-1.57 0-.68-.14-1.2-.42-1.55-.28-.36-.68-.53-1.22-.53-.53 0-.93.17-1.2.52-.27.34-.41.86-.41 1.55zm7.94-2.77c.23 0 .45.02.64.06l-.12.75c-.23-.048-.42-.072-.59-.072-.44 0-.81.176-1.11.527-.31.352-.47.79-.47 1.314V264H76v-5.352h.67l.09.992h.04c.2-.35.44-.617.72-.806.28-.19.59-.283.923-.283zm8.43-1.69h.89L85.21 264h-.82l-2.56-7.14h.88l1.64 4.62c.188.53.338 1.047.45 1.548.116-.527.27-1.053.458-1.577l1.63-4.59zm5.05 7.14l-.16-.762h-.04c-.27.336-.54.563-.8.68-.27.12-.6.18-1 .18-.53 0-.95-.137-1.25-.41-.3-.274-.45-.663-.45-1.167 0-1.08.86-1.64 2.59-1.7l.91-.02v-.33c0-.42-.09-.73-.27-.93-.18-.2-.47-.3-.87-.3-.45 0-.95.14-1.52.41l-.25-.62c.26-.14.55-.25.86-.33.31-.08.63-.12.94-.12.64 0 1.11.15 1.42.43.3.29.46.74.46 1.37V264h-.6zm-1.83-.57c.5 0 .9-.14 1.19-.416.29-.277.43-.664.43-1.162v-.484l-.81.034c-.65.023-1.11.123-1.4.3-.29.178-.43.454-.43.828 0 .293.09.516.26.67.17.152.42.23.74.23zm4.86-4.782v3.472c0 .436.1.762.3.977.2.215.51.322.94.322.56 0 .97-.16 1.22-.46.26-.31.39-.81.39-1.5v-2.82h.81V264h-.67l-.12-.718h-.05c-.17.264-.4.466-.69.606-.3.14-.63.21-1.01.21-.65 0-1.14-.155-1.46-.464-.33-.31-.49-.804-.49-1.485v-3.51h.82zm6.19 5.352h-.81v-7.598h.81V264zm3.45-.57c.14 0 .28-.012.41-.033.13-.02.24-.043.31-.066v.62c-.08.05-.21.08-.38.11s-.33.04-.46.04c-1.04 0-1.55-.54-1.55-1.63v-3.18h-.77v-.39l.77-.34.34-1.14h.47v1.24h1.55v.63h-1.56v3.15c0 .32.07.57.23.74.15.18.36.26.63.26zm9.04-4.49c0 .724-.25 1.28-.74 1.67-.49.388-1.2.582-2.12.582h-.84V264h-.83v-7.14h1.85c1.78 0 2.67.695 2.67 2.08zm-3.7 1.54h.74c.73 0 1.27-.12 1.59-.357.33-.238.49-.618.49-1.143 0-.472-.16-.823-.46-1.054-.31-.23-.79-.347-1.45-.347h-.93v2.9zm9.68.84c0 .872-.22 1.553-.66 2.043-.44.49-1.05.735-1.82.735-.48 0-.91-.113-1.28-.337-.37-.22-.66-.54-.86-.96-.2-.42-.31-.91-.31-1.47 0-.87.22-1.55.66-2.04.44-.48 1.04-.73 1.82-.73.75 0 1.34.25 1.78.75.44.5.66 1.17.66 2.02zm-4.08 0c0 .683.14 1.204.41 1.562.28.358.68.537 1.21.537.53 0 .94-.18 1.21-.54.28-.36.42-.88.42-1.57 0-.68-.14-1.2-.42-1.55-.28-.36-.68-.53-1.22-.53-.53 0-.93.17-1.2.52-.27.34-.41.86-.41 1.55zm6.31 2.68h-.81v-7.598h.81V264zm2.53 0h-.81v-5.352h.81V264zm-.88-6.802c0-.185.05-.32.14-.407.09-.08.21-.13.34-.13.13 0 .25.05.34.14.1.09.14.23.14.41 0 .19-.05.32-.14.41-.09.09-.21.14-.34.14-.14 0-.25-.04-.35-.13-.09-.09-.14-.22-.14-.4zm4.74 6.9c-.77 0-1.37-.24-1.8-.716-.42-.477-.63-1.15-.63-2.024 0-.895.21-1.587.64-2.075.43-.488 1.04-.732 1.84-.732.26 0 .51.03.77.09s.46.12.61.2l-.25.69c-.18-.07-.37-.13-.59-.18-.21-.04-.4-.07-.56-.07-1.09 0-1.63.7-1.63 2.08 0 .66.13 1.16.4 1.52.26.35.65.53 1.18.53.44 0 .9-.09 1.37-.28v.72c-.36.19-.81.28-1.35.28zm1.77-5.45h.87l1.17 3.052c.26.697.42 1.2.48 1.51h.04c.04-.167.13-.45.27-.853.13-.402.58-1.638 1.33-3.71h.87l-2.3 6.095c-.23.602-.5 1.03-.8 1.282-.31.252-.68.378-1.12.378-.25 0-.49-.027-.73-.083v-.65c.18.04.38.06.6.06.56 0 .95-.32 1.19-.94l.29-.76-2.16-5.39z"/>
-    <path fill="#FFF" d="M367 384h186v22H367z"/>
-    <path fill="#000" d="M380.518 397.36h-1.06V399h-.776v-1.64h-3.472v-.71l3.39-4.828h.858v4.8h1.06v.737zm-1.836-.738v-2.373c0-.47.016-1 .048-1.58h-.04c-.155.31-.3.57-.438.77l-2.23 3.17h2.66zm2.778 1.86c0-.218.05-.383.15-.495.098-.112.24-.17.426-.17.19 0 .336.058.442.17.106.112.16.277.16.495 0 .212-.055.375-.162.49-.108.113-.254.17-.44.17-.166 0-.303-.052-.412-.154-.11-.103-.164-.27-.164-.506zm8.657.518l-2.422-6.328h-.04c.047.5.07 1.097.07 1.787V399h-.767v-7.14h1.25l2.26 5.89h.04l2.28-5.89h1.24V399h-.83v-4.6c0-.527.023-1.1.07-1.718h-.04L390.786 399h-.67zm9.038 0l-.16-.762h-.04c-.267.336-.533.563-.798.68-.266.12-.597.18-.994.18-.53 0-.946-.137-1.247-.41-.302-.274-.452-.663-.452-1.167 0-1.08.864-1.64 2.593-1.7l.908-.02v-.33c0-.42-.09-.73-.27-.93-.182-.2-.47-.3-.868-.3-.446 0-.95.14-1.514.41l-.25-.62c.265-.14.554-.25.868-.33.32-.08.63-.12.95-.12.64 0 1.11.15 1.42.43.31.29.46.74.46 1.37V399h-.6zm-1.83-.57c.504 0 .9-.14 1.188-.416.288-.277.432-.664.432-1.162v-.484l-.81.034c-.645.023-1.11.123-1.394.3-.28.178-.42.454-.42.828 0 .293.09.516.27.67.18.152.43.23.75.23zm6.59.668c-.347 0-.665-.065-.954-.193-.28-.13-.52-.327-.72-.593h-.06c.04.312.06.608.06.888v2.202h-.81v-7.754h.66l.11.733h.04c.21-.29.45-.5.73-.63.28-.13.6-.19.95-.19.71 0 1.26.25 1.65.73.39.49.58 1.17.58 2.04 0 .88-.19 1.57-.59 2.05-.39.49-.93.73-1.63.73zm-.116-4.86c-.55 0-.95.153-1.19.455-.25.303-.37.785-.38 1.446v.18c0 .75.12 1.29.37 1.61.25.32.65.48 1.2.48.46 0 .82-.19 1.08-.57.26-.38.39-.89.39-1.55 0-.67-.13-1.18-.39-1.54s-.63-.54-1.11-.54zM414.76 399l-.888-2.27h-2.86l-.88 2.27h-.84l2.822-7.168h.698L415.62 399h-.86zm-1.147-3.018l-.83-2.21c-.107-.28-.218-.625-.332-1.032-.07.313-.17.656-.3 1.03l-.84 2.212h2.31zm3.628-2.334v3.472c0 .436.1.762.3.977.2.215.51.322.94.322.56 0 .97-.16 1.23-.46.26-.31.39-.81.39-1.5v-2.82h.81V399h-.67l-.11-.718h-.04c-.16.264-.39.466-.69.606-.29.14-.63.21-1.01.21-.65 0-1.13-.155-1.46-.464-.32-.31-.48-.804-.48-1.485v-3.51h.82zm7.11 4.78c.15 0 .28-.01.42-.03.14-.022.24-.044.32-.067v.62c-.08.05-.21.08-.38.11s-.32.04-.46.04c-1.03 0-1.55-.54-1.55-1.63v-3.18h-.76v-.39l.77-.34.34-1.14h.47v1.24h1.56v.63h-1.55v3.15c0 .32.08.57.23.74.15.18.36.26.63.26zm5.47.572v-3.462c0-.436-.1-.762-.29-.976-.2-.215-.51-.323-.93-.323-.56 0-.97.15-1.23.45-.26.3-.39.81-.39 1.5v2.8h-.81v-7.6h.81v2.3c0 .28-.01.5-.04.69h.05c.16-.26.39-.46.68-.61.3-.15.64-.22 1.01-.22.66 0 1.15.15 1.47.46.33.31.5.8.5 1.48v3.5h-.81zm4.74.098c-.79 0-1.41-.24-1.87-.723-.45-.482-.68-1.15-.68-2.007 0-.862.22-1.548.64-2.055.43-.508 1-.762 1.71-.762.67 0 1.2.22 1.59.67.39.44.59 1.03.59 1.75v.52h-3.68c.02.63.17 1.11.48 1.43.3.33.73.49 1.27.49.58 0 1.15-.12 1.71-.36v.73c-.29.13-.56.22-.81.27-.25.06-.56.08-.92.08zm-.22-4.87c-.43 0-.77.14-1.03.42-.25.28-.4.67-.45 1.164h2.8c0-.512-.11-.903-.34-1.175-.23-.272-.55-.408-.98-.408zm7.23 4.772v-3.462c0-.436-.1-.762-.3-.976-.2-.215-.51-.323-.93-.323-.56 0-.97.15-1.23.45-.26.3-.39.8-.39 1.5V399h-.81v-5.352h.66l.13.733h.04c.17-.26.4-.46.7-.61.3-.14.64-.21 1-.21.65 0 1.13.16 1.46.47.33.31.49.81.49 1.49V399h-.81zm4.21-.57c.15 0 .28-.012.42-.033.14-.02.24-.043.32-.066v.62c-.09.05-.21.08-.39.11-.17.03-.32.04-.46.04-1.03 0-1.55-.54-1.55-1.63v-3.18h-.76v-.39l.77-.34.34-1.14h.47v1.24h1.56v.63h-1.55v3.15c0 .32.08.57.23.74.16.18.37.26.63.26zm2.61.57h-.81v-5.352h.81V399zm-.88-6.802c0-.185.05-.32.14-.407.09-.08.21-.13.34-.13.13 0 .24.05.34.14.1.09.14.23.14.41 0 .19-.04.32-.14.41-.09.09-.2.14-.33.14-.14 0-.25-.04-.34-.13-.09-.09-.13-.22-.13-.4zm4.74 6.9c-.77 0-1.37-.24-1.79-.716-.42-.477-.64-1.15-.64-2.024 0-.895.22-1.587.65-2.075.43-.488 1.05-.732 1.85-.732.26 0 .52.03.78.09s.46.12.6.2l-.25.69c-.18-.07-.37-.13-.58-.18-.21-.04-.4-.07-.56-.07-1.09 0-1.63.7-1.63 2.08 0 .66.14 1.16.4 1.52.27.35.66.53 1.18.53.45 0 .9-.09 1.37-.28v.72c-.36.19-.81.28-1.35.28zm5.92-.098l-.16-.762h-.04c-.26.336-.53.563-.79.68-.26.12-.59.18-.99.18-.53 0-.94-.137-1.24-.41-.3-.274-.45-.663-.45-1.167 0-1.08.87-1.64 2.6-1.7l.91-.02v-.33c0-.42-.09-.73-.27-.93-.18-.2-.47-.3-.86-.3-.45 0-.95.14-1.51.41l-.25-.62c.27-.14.56-.25.87-.33.32-.08.63-.12.95-.12.64 0 1.11.15 1.42.43.31.29.46.74.46 1.37V399h-.6zm-1.83-.57c.51 0 .9-.14 1.19-.416.29-.277.43-.664.43-1.162v-.484l-.81.034c-.64.023-1.11.123-1.39.3-.28.178-.43.454-.43.828 0 .293.09.516.27.67.18.152.43.23.75.23zm5.83 0c.15 0 .28-.012.42-.033.14-.02.24-.043.32-.066v.62c-.09.05-.22.08-.39.11s-.32.04-.46.04c-1.03 0-1.55-.54-1.55-1.63v-3.18h-.76v-.39l.77-.34.34-1.14h.47v1.24h1.56v.63h-1.56v3.15c0 .32.08.57.23.74.15.18.36.26.63.26zm2.62.57h-.81v-5.352h.81V399zm-.88-6.802c0-.185.05-.32.14-.407.09-.08.21-.13.34-.13.14 0 .25.05.34.14.1.09.14.23.14.41 0 .19-.04.32-.14.41-.09.09-.2.14-.33.14s-.25-.04-.34-.13c-.09-.09-.14-.22-.14-.4zm7.22 4.12c0 .874-.22 1.555-.66 2.045-.44.49-1.04.735-1.82.735-.48 0-.9-.113-1.27-.337-.37-.22-.66-.54-.86-.96-.2-.42-.3-.91-.3-1.47 0-.87.22-1.55.66-2.04.44-.48 1.04-.73 1.82-.73.75 0 1.35.25 1.79.75.44.5.66 1.17.66 2.02zm-4.07 0c0 .685.14 1.206.41 1.564.27.358.68.537 1.21.537.53 0 .94-.18 1.21-.54.28-.36.42-.88.42-1.57 0-.68-.13-1.2-.41-1.55-.27-.36-.68-.53-1.22-.53-.53 0-.93.17-1.2.52-.27.34-.4.86-.4 1.55zM476.2 399v-3.462c0-.436-.1-.762-.3-.976-.2-.215-.51-.323-.934-.323-.56 0-.97.15-1.23.45-.26.3-.39.8-.39 1.5V399h-.81v-5.352h.658l.133.733h.04c.163-.26.395-.46.695-.61.3-.14.635-.21 1-.21.647 0 1.13.16 1.458.47.325.31.487.81.487 1.49V399h-.81zm10.89-3.638c0 1.18-.32 2.08-.96 2.703-.64.623-1.56.935-2.76.935h-1.977v-7.14h2.19c1.11 0 1.972.31 2.59.924.612.615.92 1.475.92 2.578zm-.88.03c0-.93-.23-1.633-.7-2.105-.465-.472-1.16-.708-2.08-.708h-1.21v5.7h1.01c.99 0 1.735-.25 2.233-.73.5-.49.747-1.21.747-2.16zm5.64 3.608l-.16-.762h-.04c-.265.336-.53.563-.796.68-.266.12-.597.18-.994.18-.53 0-.95-.137-1.25-.41-.3-.274-.45-.663-.45-1.167 0-1.08.862-1.64 2.59-1.7l.91-.02v-.33c0-.42-.09-.73-.27-.93-.18-.2-.47-.3-.867-.3-.445 0-.95.14-1.513.41l-.25-.62c.266-.14.555-.25.87-.33.313-.08.63-.12.944-.12.64 0 1.11.15 1.42.43.31.29.465.74.465 1.37V399h-.6zm-1.83-.57c.506 0 .9-.14 1.19-.416.29-.277.43-.664.43-1.162v-.484l-.81.034c-.643.023-1.11.123-1.39.3-.287.178-.43.454-.43.828 0 .293.09.516.265.67.178.152.426.23.745.23zm5.83 0c.144 0 .283-.012.416-.033.134-.02.24-.043.317-.066v.62c-.09.05-.22.08-.39.11s-.325.04-.46.04c-1.037 0-1.555-.54-1.555-1.63v-3.18h-.764v-.39l.766-.34.344-1.14h.47v1.24h1.55v.63h-1.55v3.15c0 .32.077.57.23.74.154.18.364.26.63.26zm5.094.57l-.16-.762h-.04c-.267.336-.53.563-.8.68-.264.12-.595.18-.99.18-.53 0-.946-.137-1.247-.41-.3-.274-.45-.663-.45-1.167 0-1.08.864-1.64 2.592-1.7l.9-.02v-.33c0-.42-.09-.73-.27-.93-.18-.2-.47-.3-.87-.3-.45 0-.95.14-1.52.41l-.25-.62c.26-.14.55-.25.86-.33.31-.08.63-.12.94-.12.64 0 1.11.15 1.42.43.31.29.46.74.46 1.37V399h-.6zm-1.83-.57c.503 0 .9-.14 1.19-.416.29-.277.433-.664.433-1.162v-.484l-.81.034c-.645.023-1.11.123-1.395.3-.284.178-.426.454-.426.828 0 .293.09.516.267.67.18.152.428.23.747.23zm8.43 0c.142 0 .28-.012.414-.033.135-.02.24-.043.32-.066v.62c-.09.05-.218.08-.39.11-.17.03-.324.04-.46.04-1.036 0-1.553-.54-1.553-1.63v-3.18h-.76v-.39l.765-.34.34-1.14h.47v1.24h1.554v.63h-1.554v3.15c0 .32.078.57.23.74.154.18.364.26.63.26zm6.42-2.11c0 .872-.22 1.553-.66 2.043-.44.49-1.046.735-1.82.735-.48 0-.9-.113-1.275-.337-.38-.22-.66-.54-.86-.96-.21-.42-.31-.91-.31-1.47 0-.87.22-1.55.65-2.04.43-.48 1.04-.73 1.81-.73.75 0 1.34.25 1.78.75.44.5.66 1.17.66 2.02zm-4.078 0c0 .683.136 1.204.41 1.562.273.358.675.537 1.205.537s.94-.18 1.21-.54c.28-.36.42-.88.42-1.57 0-.68-.13-1.2-.41-1.55-.27-.36-.68-.53-1.21-.53-.53 0-.93.17-1.2.52-.27.34-.41.86-.41 1.55zm12.743-2.38c0 .724-.25 1.28-.74 1.67-.5.388-1.2.582-2.12.582h-.84V399h-.83v-7.14h1.85c1.78 0 2.67.695 2.67 2.08zm-3.7 1.54h.75c.74 0 1.27-.12 1.6-.357.33-.238.49-.618.49-1.143 0-.472-.15-.823-.46-1.054-.31-.23-.79-.347-1.45-.347h-.93v2.9zm9.69.84c0 .872-.22 1.553-.66 2.043-.44.49-1.05.735-1.82.735-.48 0-.9-.113-1.27-.337-.37-.22-.66-.54-.86-.96-.2-.42-.31-.91-.31-1.47 0-.87.22-1.55.65-2.04.43-.48 1.04-.73 1.81-.73.75 0 1.34.25 1.78.75.44.5.66 1.17.66 2.02zm-4.08 0c0 .683.14 1.204.41 1.562.27.358.67.537 1.2.537.53 0 .93-.18 1.21-.54.27-.36.41-.88.41-1.57 0-.68-.14-1.2-.41-1.55-.28-.36-.68-.53-1.22-.53-.53 0-.93.17-1.2.52-.27.34-.41.86-.41 1.55zm6.31 2.68h-.81v-7.598h.81V399zm2.53 0h-.81v-5.352h.81V399zm-.88-6.802c0-.185.05-.32.14-.407.09-.08.2-.13.34-.13.13 0 .24.05.34.14.09.09.14.23.14.41 0 .19-.05.32-.14.41-.1.09-.21.14-.34.14-.14 0-.25-.04-.34-.13-.09-.09-.14-.22-.14-.4zm4.74 6.9c-.78 0-1.38-.24-1.8-.716-.43-.477-.64-1.15-.64-2.024 0-.895.21-1.587.65-2.075.43-.488 1.04-.732 1.84-.732.26 0 .52.03.77.09s.46.12.6.2l-.25.69c-.18-.07-.37-.13-.59-.18-.21-.04-.4-.07-.56-.07-1.09 0-1.63.7-1.63 2.08 0 .66.13 1.16.4 1.52.26.35.66.53 1.18.53.44 0 .9-.09 1.37-.28v.72c-.36.19-.81.28-1.35.28zm1.77-5.45h.87l1.17 3.052c.26.697.42 1.2.48 1.51h.04c.04-.167.13-.45.26-.853.13-.402.58-1.638 1.32-3.71h.87l-2.3 6.095c-.23.602-.5 1.03-.8 1.282-.31.252-.68.378-1.12.378-.25 0-.49-.027-.73-.083v-.65c.18.04.38.06.6.06.55 0 .95-.32 1.19-.94l.29-.76-2.16-5.39z"/>
-    <path fill="#575757" d="M537 78.5l-7 3.5v-7M129 396.5l7-3.5v7m-49.5-70l-3.5-7h7m244.5 19l3.5 7h-7m254.5-187l3.5 7h-7"/>
-  </g>
-</svg>
diff --git a/website/public/img/vault-ref-arch-2.png b/website/public/img/vault-ref-arch-2.png
deleted file mode 100644
index f13e7c780c3..00000000000
Binary files a/website/public/img/vault-ref-arch-2.png and /dev/null differ
diff --git a/website/public/img/vault-ref-arch-3.png b/website/public/img/vault-ref-arch-3.png
deleted file mode 100644
index da593944e93..00000000000
Binary files a/website/public/img/vault-ref-arch-3.png and /dev/null differ
diff --git a/website/public/img/vault-ref-arch-4.png b/website/public/img/vault-ref-arch-4.png
deleted file mode 100644
index 2256939b7ad..00000000000
Binary files a/website/public/img/vault-ref-arch-4.png and /dev/null differ
diff --git a/website/public/img/vault-ref-arch-5.png b/website/public/img/vault-ref-arch-5.png
deleted file mode 100644
index 12df4170853..00000000000
Binary files a/website/public/img/vault-ref-arch-5.png and /dev/null differ
diff --git a/website/public/img/vault-ref-arch-6.png b/website/public/img/vault-ref-arch-6.png
deleted file mode 100644
index e6f6d1c1007..00000000000
Binary files a/website/public/img/vault-ref-arch-6.png and /dev/null differ
diff --git a/website/public/img/vault-ref-arch-7.png b/website/public/img/vault-ref-arch-7.png
deleted file mode 100644
index 3b4cf164533..00000000000
Binary files a/website/public/img/vault-ref-arch-7.png and /dev/null differ
diff --git a/website/public/img/vault-ref-arch-8.png b/website/public/img/vault-ref-arch-8.png
deleted file mode 100644
index 5bf036cecd1..00000000000
Binary files a/website/public/img/vault-ref-arch-8.png and /dev/null differ
diff --git a/website/public/img/vault-ref-arch-9.png b/website/public/img/vault-ref-arch-9.png
deleted file mode 100644
index 42057435e64..00000000000
Binary files a/website/public/img/vault-ref-arch-9.png and /dev/null differ
diff --git a/website/public/img/vault-ref-arch.png b/website/public/img/vault-ref-arch.png
deleted file mode 100644
index c33ad76272f..00000000000
Binary files a/website/public/img/vault-ref-arch.png and /dev/null differ
diff --git a/website/public/img/vault-rekey-vs-rotate.svg b/website/public/img/vault-rekey-vs-rotate.svg
deleted file mode 100644
index e3a7adec0c1..00000000000
--- a/website/public/img/vault-rekey-vs-rotate.svg
+++ /dev/null
@@ -1,45 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 669 497" xmlns:xlink="http://www.w3.org/1999/xlink">
-  <defs>
-    <path id="a" d="M0 0h411v463H0z"/>
-    <mask id="c" width="411" height="463" x="0" y="0" fill="#fff">
-      <use xlink:href="#a"/>
-    </mask>
-    <path id="b" d="M418 0h251v463H418z"/>
-    <mask id="d" width="251" height="463" x="0" y="0" fill="#fff">
-      <use xlink:href="#b"/>
-    </mask>
-  </defs>
-  <g fill="none" fill-rule="evenodd">
-    <g fill="#000" fill-rule="nonzero">
-      <path d="M93.835 51.16l-6.223-23.05-.212-.213-1.626 1.627 5.868 21L76.086 66.08l-21.213-5.655-5.728-21.142 15.557-15.557 13.435 3.536 1.626-1.625-15.627-4.172-17.183 17.182 4.172 15.627-32.88 32.88 15.627 4.173 27.082-27.082 15.698 4.1 17.183-17.182zm-60.6 37.973l-11.172-2.97L51.69 56.535l1.486 5.586 5.586 1.49-25.527 25.53z"/>
-      <path d="M76.51 37.373l1.415 1.414L64.49 52.222l-1.415-1.414zm3.536 7.777l1.414 1.415-9.192 9.192-1.414-1.414zM68.732 33.837l1.414 1.414-9.192 9.2-1.414-1.41z"/>
-    </g>
-    <g fill="#000" fill-rule="nonzero">
-      <path d="M93.835 138.16l-6.223-23.05-.212-.213-1.626 1.627 5.868 21-15.556 15.557-21.213-5.65-5.728-21.14 15.557-15.55 13.435 3.54 1.626-1.62-15.627-4.17-17.183 17.19 4.172 15.63-32.88 32.88 15.627 4.17 27.082-27.08 15.698 4.1 17.183-17.18zm-60.6 37.973l-11.172-2.97 29.628-29.628 1.49 5.586 5.59 1.49-25.53 25.53z"/>
-      <path d="M76.51 124.373l1.415 1.414-13.435 13.435-1.415-1.414zm3.536 7.777l1.414 1.415-9.192 9.192-1.414-1.414zm-11.314-11.313l1.414 1.414-9.192 9.2-1.414-1.41z"/>
-    </g>
-    <g fill="#000" fill-rule="nonzero">
-      <path d="M93.835 224.16l-6.223-23.05-.212-.213-1.626 1.627 5.868 21-15.556 15.557-21.213-5.65-5.728-21.14 15.557-15.55 13.435 3.54 1.626-1.62-15.627-4.17-17.183 17.19 4.172 15.63-32.88 32.88 15.627 4.17 27.082-27.08 15.698 4.1 17.183-17.18zm-60.6 37.973l-11.172-2.97 29.628-29.628 1.49 5.586 5.59 1.49-25.53 25.53z"/>
-      <path d="M76.51 210.373l1.415 1.414-13.435 13.435-1.415-1.414zm3.536 7.777l1.414 1.415-9.192 9.192-1.414-1.414zm-11.314-11.313l1.414 1.414-9.192 9.2-1.414-1.41z"/>
-    </g>
-    <g fill="#000" fill-rule="nonzero">
-      <path d="M93.835 311.16l-6.223-23.05-.212-.213-1.626 1.627 5.868 21-15.556 15.557-21.213-5.65-5.728-21.14 15.557-15.55 13.435 3.54 1.626-1.62-15.627-4.17-17.183 17.19 4.172 15.63-32.88 32.88 15.627 4.17 27.082-27.08 15.698 4.1 17.183-17.18zm-60.6 37.973l-11.172-2.97 29.628-29.628 1.49 5.586 5.59 1.49-25.53 25.53z"/>
-      <path d="M76.51 297.373l1.415 1.414-13.435 13.435-1.415-1.414zm3.536 7.777l1.414 1.415-9.192 9.192-1.414-1.414zm-11.314-11.313l1.414 1.414-9.192 9.2-1.414-1.41z"/>
-    </g>
-    <g fill="#000" fill-rule="nonzero">
-      <path d="M93.835 397.16l-6.223-23.05-.212-.213-1.626 1.627 5.868 21-15.556 15.557-21.213-5.65-5.728-21.14 15.557-15.55 13.435 3.54 1.626-1.62-15.627-4.17-17.183 17.19 4.172 15.63-32.88 32.88 15.627 4.17 27.082-27.08 15.698 4.1 17.183-17.18zm-60.6 37.973l-11.172-2.97 29.628-29.628 1.49 5.586 5.59 1.49-25.53 25.53z"/>
-      <path d="M76.51 383.373l1.415 1.414-13.435 13.435-1.415-1.414zm3.536 7.777l1.414 1.415-9.192 9.192-1.414-1.414zm-11.314-11.313l1.414 1.414-9.192 9.2-1.414-1.41z"/>
-    </g>
-    <g fill="#000" fill-rule="nonzero">
-      <path d="M363.073 205.532l-10.675-38.114-.354-.354-2.652 2.652 10.056 34.728-25.363 25.363-35.074-9.71-9.82-34.958 25.37-25.37 22.22 6.07 2.65-2.65-25.84-7.16-28.01 28.01 7.16 25.83-53.6 53.61 25.84 7.16 44.16-44.15 25.95 7.04 28.02-28.02zm-99.212 61.5l-18.47-5.098 48.31-48.306 2.55 9.236 9.24 2.55-41.62 41.62z"/>
-      <path d="M334.263 182.488l2.357 2.356-21.905 21.905-2.356-2.36zm5.97 12.887l2.357 2.356-14.988 14.99-2.356-2.35zm-18.856-18.857l2.357 2.357-14.988 14.988-2.357-2.357z"/>
-    </g>
-    <g fill="#000" fill-rule="nonzero">
-      <path d="M572.308 205.766l-10.676-38.114-.354-.354-2.652 2.652 10.056 34.728-25.363 25.363-35.08-9.71-9.83-34.95 25.36-25.36 22.21 6.07 2.65-2.65-25.84-7.16-28.02 28.02 7.16 25.84-53.61 53.61 25.84 7.16 44.15-44.15 25.95 7.05"/>
-      <path d="M543.497 182.72l2.357 2.358-21.905 21.905-2.36-2.357zm5.97 12.888l2.357 2.357-14.988 14.988-2.357-2.357zm-18.857-18.856l2.358 2.357-14.988 14.98-2.357-2.36z"/>
-    </g>
-    <path fill="#000" d="M114.92 224.624h125v2h-125zm-10.282-83l148.44 56.98-.718 1.868-148.44-56.98zM102.92 298.42l116.698-44.796.717 1.867-116.698 44.8zm5.148-239.797L276.814 176.78l-1.148 1.638L106.92 60.262zm-2.148 323.362l137.618-96.36 1.147 1.637-137.617 96.36zm252-153.36h102v2h-102zM524.102 264h-7.27v-12.85h7.27v1.776h-5.168v3.498h4.842v1.758h-4.842v4.034h5.168V264zm11.11 0h-2.075v-5.977c0-.75-.15-1.31-.453-1.678-.302-.37-.78-.554-1.437-.554-.873 0-1.512.26-1.916.78-.4.52-.6 1.38-.6 2.6V264h-2.06v-9.72h1.62l.29 1.274h.11c.3-.463.71-.82 1.25-1.073.54-.25 1.14-.37 1.8-.37 2.34 0 3.5 1.19 3.5 3.56V264zm6.793.176c-1.47 0-2.588-.43-3.353-1.288-.765-.858-1.147-2.09-1.147-3.696 0-1.634.4-2.89 1.2-3.77.8-.88 1.955-1.318 3.467-1.318 1.025 0 1.948.19 2.768.57l-.624 1.662c-.873-.34-1.593-.51-2.162-.51-1.68 0-2.522 1.116-2.522 3.35 0 1.09.21 1.907.628 2.455.42.55 1.033.83 1.842.83.92 0 1.79-.23 2.61-.68v1.8c-.37.22-.763.38-1.182.47-.42.1-.927.14-1.525.14zm9.923-10.072c.416 0 .76.03 1.028.087l-.202 1.93c-.293-.07-.598-.1-.914-.1-.826 0-1.496.27-2.008.81-.513.54-.77 1.24-.77 2.1V264h-2.065v-9.72h1.617l.273 1.713h.105c.322-.58.743-1.04 1.26-1.38.52-.34 1.078-.51 1.676-.51zm1.353.175h2.25l1.98 5.51c.3.78.5 1.52.6 2.21h.07c.06-.32.15-.72.29-1.18.14-.46.89-2.65 2.24-6.56h2.24l-4.16 11.01c-.75 2.02-2.01 3.03-3.78 3.03-.45 0-.9-.05-1.33-.15v-1.64c.31.07.67.1 1.06.1 1 0 1.7-.58 2.1-1.74l.36-.92-3.9-9.72zm16.06 9.89c-1.23 0-2.18-.45-2.86-1.33h-.12c.09.82.13 1.31.13 1.49v3.98h-2.06v-14.04h1.67c.05.18.15.61.29 1.3h.11c.65-.99 1.61-1.48 2.9-1.48 1.22 0 2.16.44 2.84 1.32.68.88 1.02 2.11 1.02 3.7s-.34 2.82-1.03 3.72c-.69.89-1.64 1.33-2.85 1.33zm-.5-8.39c-.82 0-1.42.24-1.79.72s-.56 1.25-.56 2.3v.31c0 1.18.19 2.04.56 2.57.38.53.99.79 1.84.79.72 0 1.27-.3 1.66-.88.39-.59.58-1.42.58-2.51 0-1.09-.19-1.92-.57-2.48-.38-.56-.95-.84-1.69-.84zm10.41 6.71c.51 0 1.01-.08 1.51-.24v1.55c-.23.1-.52.18-.88.25s-.73.1-1.12.1c-1.96 0-2.93-1.03-2.93-3.1v-5.24h-1.33v-.92l1.43-.76.71-2.06h1.28v2.16h2.77v1.56h-2.77V261c0 .495.13.863.38 1.1.25.24.58.357.98.357zm5.52 1.49h-2.07v-9.72h2.07V264zm-2.19-12.3c0-.37.1-.66.31-.86.21-.2.49-.3.87-.3.37 0 .65.1.85.3.21.2.31.48.31.85 0 .35-.1.63-.3.83-.2.2-.48.3-.84.3-.38 0-.66-.1-.87-.31-.2-.2-.3-.48-.3-.83zm13.77 7.41c0 1.59-.4 2.83-1.22 3.72-.81.89-1.94 1.33-3.4 1.33-.91 0-1.71-.21-2.41-.62-.69-.41-1.23-1-1.6-1.77-.37-.77-.56-1.66-.56-2.67 0-1.58.41-2.81 1.22-3.69.81-.89 1.95-1.33 3.42-1.33 1.41 0 2.52.452 3.34 1.36.82.91 1.23 2.13 1.23 3.66zm-7.07 0c0 2.24.83 3.37 2.49 3.37 1.65 0 2.47-1.12 2.47-3.37 0-2.22-.83-3.33-2.48-3.33-.87 0-1.49.29-1.88.86-.39.57-.58 1.4-.58 2.47zm18 4.88h-2.08V258c0-.75-.15-1.31-.45-1.68-.3-.37-.78-.552-1.43-.552-.87 0-1.51.26-1.91.776-.4.514-.6 1.38-.6 2.59V264h-2.06v-9.72h1.62l.29 1.274h.11c.29-.463.71-.82 1.25-1.073.54-.25 1.14-.37 1.79-.37 2.33 0 3.5 1.19 3.5 3.56V264zm17.58 0h-2.43l-4.03-5.82-1.24 1.01V264h-2.1v-12.85h2.1v6.135c.58-.703 1.15-1.38 1.72-2.03l3.47-4.105h2.39c-2.24 2.637-3.85 4.515-4.82 5.634l4.95 7.216zm5.72.17c-1.51 0-2.69-.44-3.54-1.33-.85-.88-1.28-2.1-1.28-3.64 0-1.59.4-2.84 1.19-3.75.79-.91 1.88-1.36 3.26-1.36 1.29 0 2.3.39 3.04 1.16.75.78 1.12 1.85 1.12 3.22v1.11h-6.48c.03.94.29 1.67.77 2.17.48.51 1.16.76 2.03.76.58 0 1.11-.057 1.61-.16.5-.11 1.03-.29 1.6-.54v1.68c-.5.24-1.01.41-1.53.502-.51.1-1.1.15-1.76.15zm-.37-8.51c-.65 0-1.18.21-1.58.62-.39.41-.63 1.02-.71 1.82h4.42c-.01-.81-.2-1.41-.58-1.83-.37-.42-.89-.62-1.54-.62zm5.03-1.39h2.25l1.98 5.51c.3.78.5 1.52.6 2.21h.07c.05-.32.15-.71.29-1.17.14-.46.89-2.64 2.23-6.55h2.24l-4.16 11.01c-.75 2.02-2.01 3.03-3.78 3.03-.45 0-.9-.05-1.33-.15v-1.63c.31.07.67.1 1.07.1.99 0 1.7-.58 2.1-1.73l.36-.92-3.9-9.72zM76.58 439h-2.44l-4.034-5.818-1.24 1.01V439h-2.1v-12.85h2.1v6.135c.575-.703 1.146-1.38 1.715-2.03l3.48-4.105h2.39c-2.24 2.637-3.85 4.515-4.82 5.634L76.58 439zm5.72.176c-1.51 0-2.69-.44-3.547-1.323-.85-.882-1.28-2.096-1.28-3.643 0-1.588.4-2.836 1.19-3.744.79-.908 1.88-1.362 3.26-1.362 1.29 0 2.3.39 3.04 1.168.75.78 1.12 1.852 1.12 3.217v1.11H79.6c.03.94.283 1.67.764 2.17.48.5 1.157.76 2.03.76.574 0 1.11-.06 1.604-.17.495-.11 1.027-.29 1.595-.54v1.68c-.504.24-1.013.41-1.53.51-.515.1-1.104.15-1.766.15zm-.38-8.508c-.66 0-1.187.208-1.58.624-.39.416-.63 1.022-.7 1.82h4.41c-.01-.803-.2-1.41-.58-1.824-.37-.413-.89-.62-1.54-.62zm5.023-1.39h2.25l1.98 5.512c.3.785.5 1.523.6 2.215h.07c.06-.322.15-.713.29-1.173.15-.46.89-2.644 2.24-6.553h2.23l-4.15 11.01c-.754 2.02-2.014 3.03-3.78 3.03-.454 0-.9-.05-1.33-.15v-1.64c.31.07.66.1 1.06.1.997 0 1.697-.58 2.1-1.73l.36-.92-3.9-9.72zm23.43 6.233c0 1.15-.41 2.04-1.235 2.69-.827.65-1.967.98-3.42.98-1.453 0-2.64-.22-3.568-.67v-1.98c.59.28 1.21.49 1.87.65.66.16 1.28.24 1.84.24.84 0 1.45-.15 1.84-.47.4-.31.6-.74.6-1.27 0-.48-.18-.88-.54-1.22-.36-.33-1.11-.73-2.25-1.19-1.17-.47-2-1.01-2.48-1.62-.48-.61-.72-1.34-.72-2.19 0-1.07.38-1.91 1.15-2.53.76-.61 1.783-.92 3.066-.92 1.23 0 2.456.27 3.675.81l-.67 1.72c-1.14-.48-2.16-.72-3.05-.72-.68 0-1.2.15-1.55.44-.35.3-.53.69-.53 1.18 0 .34.07.62.21.86.14.24.37.46.7.67.32.21.9.49 1.74.84.95.398 1.64.76 2.08 1.1.44.34.76.72.97 1.15.21.43.31.93.31 1.51zm10.82 3.49h-2.07v-5.97c0-.75-.15-1.31-.453-1.68-.3-.37-.78-.55-1.437-.55-.867 0-1.504.26-1.91.78-.4.52-.61 1.39-.61 2.61V439h-2.06v-13.676h2.07v3.472c0 .557-.03 1.15-.1 1.784h.13c.28-.47.675-.832 1.176-1.09.5-.258 1.08-.386 1.75-.386 2.35 0 3.53 1.186 3.53 3.56V439zm8.96 0l-.413-1.35h-.07c-.47.59-.94 1-1.416 1.21-.473.22-1.083.32-1.827.32-.955 0-1.7-.26-2.237-.77-.54-.51-.81-1.24-.81-2.19 0-1 .37-1.76 1.11-2.27s1.88-.79 3.4-.83l1.68-.05v-.52c0-.62-.15-1.08-.44-1.39-.29-.31-.74-.46-1.35-.46-.5 0-.977.07-1.43.22-.46.15-.9.32-1.32.52l-.67-1.48c.53-.27 1.104-.48 1.73-.63.627-.14 1.22-.21 1.775-.21 1.24 0 2.17.27 2.8.81.63.54.947 1.39.947 2.54V439h-1.48zm-3.076-1.4c.75 0 1.352-.21 1.806-.63.454-.42.68-1 .68-1.76v-.84l-1.247.06c-.973.04-1.68.2-2.123.49-.44.29-.66.74-.66 1.33 0 .44.13.77.386 1.01s.64.36 1.16.36zm12.366-8.49c.416 0 .76.03 1.03.09l-.2 1.93c-.29-.07-.6-.1-.91-.1-.82 0-1.49.27-2.01.81-.51.54-.77 1.24-.77 2.1V439h-2.06v-9.72h1.62l.28 1.713h.102c.323-.58.743-1.04 1.26-1.38.518-.34 1.076-.51 1.674-.51zm7.075 10.07c-1.513 0-2.695-.44-3.547-1.32-.85-.88-1.28-2.09-1.28-3.64 0-1.58.4-2.83 1.19-3.74.79-.91 1.87-1.36 3.26-1.36 1.28 0 2.29.39 3.04 1.17.74.78 1.11 1.85 1.11 3.22v1.12h-6.48c.03.95.28 1.67.76 2.18.48.51 1.16.76 2.03.76.57 0 1.11-.05 1.6-.16s1.03-.29 1.59-.54v1.68c-.5.24-1.01.41-1.53.51-.51.1-1.1.15-1.76.15zm-.38-8.51c-.655 0-1.18.21-1.576.63-.396.42-.63 1.02-.708 1.82h4.412c-.012-.8-.205-1.41-.58-1.82-.375-.41-.89-.62-1.547-.62zm13.035 5.57c0 .95-.343 1.68-1.035 2.19-.69.51-1.68.76-2.97.76-1.295 0-2.335-.2-3.12-.59v-1.78c1.142.53 2.205.79 3.19.79 1.27 0 1.907-.38 1.907-1.15 0-.24-.07-.45-.21-.61-.14-.17-.37-.34-.693-.51-.33-.18-.78-.38-1.35-.6-1.12-.43-1.88-.87-2.27-1.3-.4-.43-.6-1-.6-1.69 0-.83.33-1.48 1-1.94.67-.46 1.58-.69 2.74-.69 1.14 0 2.22.23 3.24.7l-.67 1.56c-1.05-.43-1.93-.65-2.648-.65-1.09 0-1.63.31-1.63.93 0 .31.14.57.424.78.282.21.902.5 1.86.87.8.31 1.383.59 1.75.85.36.26.63.56.81.9.17.34.26.74.26 1.21zM308.64 264l-3.728-10.73h-.07c.1 1.592.15 3.086.15 4.48V264h-1.908v-12.85h2.962l3.568 10.222h.053l3.674-10.222h2.98V264h-2.02v-6.354c0-.64.02-1.47.05-2.497.04-1.03.06-1.65.09-1.87h-.07L310.5 264h-1.855zm16.918 0l-.413-1.354h-.07c-.47.592-.94.995-1.416 1.21-.48.213-1.09.32-1.83.32-.96 0-1.7-.258-2.24-.774-.54-.515-.81-1.245-.81-2.188 0-1.002.37-1.758 1.11-2.268.74-.51 1.88-.788 3.4-.835l1.67-.05v-.52c0-.62-.15-1.08-.44-1.39-.29-.31-.74-.46-1.35-.46-.5 0-.98.07-1.44.22-.46.15-.9.32-1.32.52l-.67-1.48c.53-.27 1.1-.48 1.73-.63.63-.14 1.22-.21 1.78-.21 1.23 0 2.17.27 2.8.81.63.54.94 1.39.94 2.54V264h-1.48zm-3.077-1.406c.75 0 1.36-.21 1.81-.63.46-.418.68-1.005.68-1.76v-.845l-1.24.05c-.97.03-1.68.2-2.12.49-.44.29-.66.73-.66 1.33 0 .43.13.77.39 1 .26.23.65.35 1.16.35zm13.97-1.363c0 .95-.34 1.68-1.03 2.19s-1.68.76-2.97.76c-1.29 0-2.33-.19-3.12-.59v-1.78c1.15.53 2.21.79 3.19.79 1.27 0 1.91-.38 1.91-1.15 0-.24-.07-.45-.21-.61-.14-.16-.37-.33-.69-.51-.32-.17-.77-.37-1.34-.59-1.12-.43-1.87-.86-2.27-1.3-.39-.43-.59-.99-.59-1.69 0-.83.34-1.47 1.01-1.93.67-.46 1.59-.69 2.74-.69 1.14 0 2.23.23 3.24.7l-.67 1.56c-1.04-.43-1.93-.65-2.64-.65-1.09 0-1.63.31-1.63.93 0 .31.15.57.43.78.29.21.91.5 1.86.87.8.31 1.39.6 1.75.86.37.26.64.56.81.89.18.34.27.74.27 1.21zm5.86 1.28c.51 0 1.01-.08 1.51-.23v1.56c-.23.1-.52.19-.88.25-.36.07-.73.1-1.12.1-1.95 0-2.93-1.03-2.93-3.09v-5.24h-1.32v-.91l1.43-.75.71-2.06h1.28v2.17h2.77v1.57h-2.77v5.2c0 .5.13.87.38 1.11.25.24.58.36.98.36zm7.7 1.67c-1.51 0-2.69-.44-3.54-1.32-.85-.88-1.28-2.09-1.28-3.64 0-1.58.4-2.83 1.19-3.74.79-.91 1.88-1.36 3.26-1.36 1.29 0 2.3.39 3.04 1.17.75.78 1.12 1.85 1.12 3.22v1.12h-6.49c.03.95.29 1.67.77 2.18.48.51 1.16.76 2.03.76.58 0 1.11-.05 1.61-.16.49-.11 1.02-.29 1.59-.54v1.68c-.51.24-1.02.41-1.53.51-.52.1-1.11.15-1.77.15zm-.38-8.51c-.65 0-1.18.21-1.58.63-.39.42-.63 1.02-.7 1.82h4.41c-.01-.8-.2-1.41-.58-1.82-.37-.41-.89-.62-1.54-.62zm11.44-1.56c.42 0 .76.03 1.03.09l-.2 1.93c-.29-.07-.6-.1-.91-.1-.82 0-1.49.27-2.01.81-.51.54-.77 1.24-.77 2.1V264h-2.06v-9.72h1.62l.28 1.713h.11c.32-.58.75-1.04 1.26-1.38.52-.34 1.08-.51 1.68-.51zm17.52 9.89h-2.43l-4.03-5.81-1.24 1.01v4.8h-2.1v-12.85h2.1v6.14c.58-.7 1.15-1.38 1.72-2.03l3.47-4.1h2.39c-2.25 2.64-3.86 4.52-4.83 5.64l4.96 7.22zm5.73.18c-1.51 0-2.69-.44-3.54-1.32-.85-.88-1.28-2.09-1.28-3.64 0-1.58.4-2.83 1.19-3.74.79-.91 1.88-1.36 3.26-1.36 1.29 0 2.3.39 3.05 1.17.74.78 1.12 1.85 1.12 3.22v1.11h-6.48c.03.94.29 1.67.77 2.17.48.51 1.15.76 2.03.76.57 0 1.1-.05 1.6-.16.49-.11 1.02-.29 1.59-.54v1.68c-.5.24-1.01.41-1.53.51-.52.1-1.1.15-1.77.15zm-.38-8.51c-.65 0-1.18.21-1.58.63-.39.42-.63 1.02-.71 1.82h4.41c-.01-.8-.21-1.41-.58-1.82-.38-.41-.89-.62-1.55-.62zm5.03-1.39h2.25l1.98 5.51c.29.79.49 1.53.59 2.22h.07c.05-.32.15-.71.29-1.17.14-.46.88-2.64 2.23-6.55h2.23l-4.15 11.01c-.75 2.02-2.01 3.03-3.78 3.03-.45 0-.9-.05-1.33-.15v-1.64c.31.07.67.11 1.07.11 1 0 1.7-.58 2.1-1.73l.36-.91-3.9-9.72zM182.21 485.13h1.46c.977 0 1.686-.18 2.125-.54.44-.364.66-.903.66-1.618 0-.727-.24-1.25-.713-1.565-.475-.314-1.19-.472-2.145-.472h-1.38v4.2zm0 1.74V492h-2.1v-12.85h3.63c1.657 0 2.884.31 3.68.932.797.62 1.195 1.56 1.195 2.813 0 1.6-.84 2.74-2.5 3.418l3.63 5.687h-2.39l-3.08-5.133h-2.07zm13.43 5.31c-1.513 0-2.695-.44-3.548-1.32-.853-.882-1.28-2.096-1.28-3.643 0-1.586.395-2.834 1.186-3.742.79-.907 1.878-1.36 3.26-1.36 1.284 0 2.298.39 3.042 1.167.744.78 1.116 1.85 1.116 3.217v1.11h-6.47c.03.94.29 1.67.77 2.17.48.5 1.157.76 2.03.76.575 0 1.11-.06 1.605-.17.5-.11 1.03-.29 1.6-.54v1.68c-.5.24-1.01.41-1.53.51-.52.1-1.1.15-1.77.15zm-.38-8.51c-.656 0-1.182.21-1.58.63-.394.415-.63 1.02-.706 1.82h4.41c-.01-.804-.21-1.41-.58-1.825-.38-.414-.89-.62-1.55-.62zm8.5 3.2l1.168-1.46 2.935-3.13h2.38l-3.92 4.18 4.16 5.547h-2.43l-3.12-4.265-1.13.93V492h-2.046v-13.676h2.05v6.67l-.104 1.873h.05zm12.54 5.31c-1.51 0-2.693-.44-3.545-1.32-.86-.882-1.28-2.096-1.28-3.643 0-1.586.39-2.834 1.18-3.742.79-.907 1.88-1.36 3.26-1.36 1.28 0 2.3.39 3.04 1.167.74.78 1.113 1.85 1.113 3.217v1.11h-6.477c.03.94.29 1.67.77 2.17.48.5 1.16.76 2.03.76.58 0 1.11-.06 1.61-.17.5-.11 1.03-.29 1.6-.54v1.68c-.5.24-1.01.41-1.52.51-.51.1-1.1.15-1.76.15zm-.377-8.51c-.655 0-1.18.21-1.58.63-.4.415-.64 1.02-.71 1.82h4.41c-.01-.804-.21-1.41-.58-1.825-.38-.414-.89-.62-1.55-.62zm5.028-1.39h2.25l1.98 5.51c.3.79.5 1.53.6 2.22h.07c.06-.32.15-.712.29-1.172.14-.46.89-2.64 2.24-6.55h2.23l-4.15 11.01c-.75 2.02-2.01 3.04-3.78 3.04-.45 0-.9-.05-1.33-.15v-1.63c.31.07.67.105 1.07.105 1 0 1.7-.58 2.1-1.732l.36-.91-3.9-9.72zm305.62 2.85h1.46c.98 0 1.69-.18 2.13-.54.44-.364.66-.903.66-1.618 0-.727-.23-1.25-.71-1.565-.47-.314-1.19-.472-2.14-.472h-1.39v4.2zm0 1.74V492h-2.1v-12.85h3.63c1.66 0 2.89.31 3.69.932.8.62 1.2 1.56 1.2 2.813 0 1.6-.83 2.74-2.49 3.418l3.63 5.687h-2.39l-3.08-5.133h-2.07zm17.81.26c0 1.587-.4 2.826-1.22 3.717-.81.89-1.94 1.338-3.4 1.338-.91 0-1.71-.204-2.41-.614-.69-.41-1.23-.99-1.6-1.76s-.56-1.66-.56-2.67c0-1.57.41-2.8 1.22-3.69.81-.88 1.95-1.33 3.42-1.33 1.41 0 2.52.45 3.34 1.36.82.91 1.23 2.13 1.23 3.66zm-7.07 0c0 2.243.83 3.365 2.49 3.365 1.64 0 2.46-1.123 2.46-3.367 0-2.22-.82-3.33-2.48-3.33-.87 0-1.49.286-1.88.86-.38.575-.58 1.398-.58 2.47zm13.07 3.383c.5 0 1.01-.08 1.51-.237v1.55c-.23.1-.52.18-.88.25s-.73.1-1.12.1c-1.95 0-2.93-1.03-2.93-3.1v-5.237h-1.33v-.92l1.43-.76.71-2.06h1.28v2.16h2.77v1.56h-2.76v5.2c0 .5.13.86.37 1.1.25.24.58.35.98.35zm9.53 1.49l-.41-1.353h-.07c-.47.59-.94.994-1.41 1.21-.47.212-1.08.32-1.82.32-.95 0-1.7-.26-2.23-.775s-.8-1.245-.8-2.188c0-1.002.38-1.758 1.12-2.268.75-.51 1.88-.79 3.4-.84l1.68-.05v-.52c0-.62-.14-1.08-.43-1.39-.29-.31-.74-.46-1.35-.46-.5 0-.97.07-1.43.22-.46.15-.9.32-1.32.52l-.67-1.48c.53-.27 1.11-.48 1.73-.63.63-.14 1.22-.21 1.78-.21 1.24 0 2.17.27 2.8.81.63.54.94 1.39.94 2.54V492h-1.48zm-3.07-1.405c.75 0 1.35-.21 1.81-.63.46-.418.68-1.005.68-1.76v-.845l-1.24.05c-.97.03-1.68.2-2.12.49-.44.29-.66.73-.66 1.33 0 .43.13.77.39 1 .26.23.65.35 1.16.35zm11.06-.088c.51 0 1.01-.08 1.52-.238v1.55c-.23.1-.52.18-.88.25s-.73.1-1.12.1c-1.95 0-2.93-1.03-2.93-3.1v-5.24h-1.33v-.918l1.43-.758.71-2.058h1.28v2.162h2.77v1.562h-2.77v5.203c0 .5.13.866.38 1.103.25.24.58.357.98.357zm7.7 1.67c-1.51 0-2.69-.44-3.54-1.324-.85-.882-1.28-2.096-1.28-3.643 0-1.587.4-2.835 1.19-3.743.79-.908 1.88-1.362 3.26-1.362 1.29 0 2.3.39 3.05 1.168.75.78 1.12 1.852 1.12 3.217v1.11h-6.48c.03.94.28 1.67.76 2.17s1.16.76 2.03.76c.58 0 1.11-.06 1.61-.17.5-.107 1.03-.287 1.6-.54v1.68c-.5.24-1.01.41-1.53.51-.51.1-1.1.15-1.76.15zm-.38-8.51c-.65 0-1.18.208-1.57.624-.39.416-.63 1.022-.7 1.82h4.41c-.01-.803-.2-1.41-.58-1.824-.37-.414-.89-.62-1.54-.62z"/>
-    <use stroke="#000" stroke-width="4" mask="url(#c)" stroke-dasharray="5" xlink:href="#a"/>
-    <use stroke="#000" stroke-width="4" mask="url(#d)" stroke-dasharray="5" xlink:href="#b"/>
-  </g>
-</svg>
diff --git a/website/public/img/vault-replication-upgrade.png b/website/public/img/vault-replication-upgrade.png
deleted file mode 100644
index 9ec513ebde1..00000000000
Binary files a/website/public/img/vault-replication-upgrade.png and /dev/null differ
diff --git a/website/public/img/vault-seal-wrap-2.png b/website/public/img/vault-seal-wrap-2.png
deleted file mode 100644
index 88688790a95..00000000000
Binary files a/website/public/img/vault-seal-wrap-2.png and /dev/null differ
diff --git a/website/public/img/vault-seal-wrap-3.png b/website/public/img/vault-seal-wrap-3.png
deleted file mode 100644
index 3cf8de87785..00000000000
Binary files a/website/public/img/vault-seal-wrap-3.png and /dev/null differ
diff --git a/website/public/img/vault-seal-wrap-4.png b/website/public/img/vault-seal-wrap-4.png
deleted file mode 100644
index e1c7303c08b..00000000000
Binary files a/website/public/img/vault-seal-wrap-4.png and /dev/null differ
diff --git a/website/public/img/vault-seal-wrap-5.png b/website/public/img/vault-seal-wrap-5.png
deleted file mode 100644
index 8057509bda0..00000000000
Binary files a/website/public/img/vault-seal-wrap-5.png and /dev/null differ
diff --git a/website/public/img/vault-seal-wrap-6.png b/website/public/img/vault-seal-wrap-6.png
deleted file mode 100644
index 4e224c6234d..00000000000
Binary files a/website/public/img/vault-seal-wrap-6.png and /dev/null differ
diff --git a/website/public/img/vault-seal-wrap.png b/website/public/img/vault-seal-wrap.png
deleted file mode 100644
index a15fa42b110..00000000000
Binary files a/website/public/img/vault-seal-wrap.png and /dev/null differ
diff --git a/website/public/img/vault-secrets-enable.png b/website/public/img/vault-secrets-enable.png
deleted file mode 100644
index 28efb51502c..00000000000
Binary files a/website/public/img/vault-secrets-enable.png and /dev/null differ
diff --git a/website/public/img/vault-secure-intro-1.png b/website/public/img/vault-secure-intro-1.png
deleted file mode 100644
index fcc1a9db96d..00000000000
Binary files a/website/public/img/vault-secure-intro-1.png and /dev/null differ
diff --git a/website/public/img/vault-secure-intro-2.png b/website/public/img/vault-secure-intro-2.png
deleted file mode 100644
index 2050279533c..00000000000
Binary files a/website/public/img/vault-secure-intro-2.png and /dev/null differ
diff --git a/website/public/img/vault-secure-intro-3.png b/website/public/img/vault-secure-intro-3.png
deleted file mode 100644
index 98301980013..00000000000
Binary files a/website/public/img/vault-secure-intro-3.png and /dev/null differ
diff --git a/website/public/img/vault-secure-intro-4.png b/website/public/img/vault-secure-intro-4.png
deleted file mode 100644
index c638c114de4..00000000000
Binary files a/website/public/img/vault-secure-intro-4.png and /dev/null differ
diff --git a/website/public/img/vault-secure-intro-5.png b/website/public/img/vault-secure-intro-5.png
deleted file mode 100644
index 787e9e44d7a..00000000000
Binary files a/website/public/img/vault-secure-intro-5.png and /dev/null differ
diff --git a/website/public/img/vault-sentinel-1.png b/website/public/img/vault-sentinel-1.png
deleted file mode 100644
index d032d1de385..00000000000
Binary files a/website/public/img/vault-sentinel-1.png and /dev/null differ
diff --git a/website/public/img/vault-sentinel-2.png b/website/public/img/vault-sentinel-2.png
deleted file mode 100644
index ddf1a052bc3..00000000000
Binary files a/website/public/img/vault-sentinel-2.png and /dev/null differ
diff --git a/website/public/img/vault-shamir-seal.png b/website/public/img/vault-shamir-seal.png
deleted file mode 100644
index b42f9de4e59..00000000000
Binary files a/website/public/img/vault-shamir-seal.png and /dev/null differ
diff --git a/website/public/img/vault-shamir-secret-sharing.svg b/website/public/img/vault-shamir-secret-sharing.svg
deleted file mode 100644
index b23fc60c5c0..00000000000
--- a/website/public/img/vault-shamir-secret-sharing.svg
+++ /dev/null
@@ -1,33 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 631 436">
-  <g fill-rule="evenodd">
-    <g fill-rule="nonzero">
-      <path d="M79.835 38.16l-6.223-23.05-.212-.213-1.626 1.627 5.868 21L62.086 53.08l-21.213-5.655-5.728-21.142 15.557-15.557 13.435 3.536 1.626-1.625-15.627-4.172-17.183 17.182 4.172 15.627-32.88 32.88 15.627 4.173 27.082-27.082 15.698 4.1 17.183-17.182zm-60.6 37.973l-11.172-2.97L37.69 43.535l1.486 5.586 5.586 1.49-25.527 25.53z"/>
-      <path d="M62.51 24.373l1.415 1.414L50.49 39.222l-1.415-1.414zm3.536 7.777l1.414 1.415-9.192 9.192-1.414-1.414zM54.732 20.837l1.414 1.414-9.192 9.2-1.414-1.41z"/>
-    </g>
-    <g fill-rule="nonzero">
-      <path d="M79.835 125.16l-6.223-23.05-.212-.213-1.626 1.627 5.868 21-15.556 15.557-21.213-5.65-5.728-21.14 15.557-15.56 13.435 3.54 1.626-1.62-15.627-4.17-17.183 17.19 4.172 15.62-32.88 32.88 15.627 4.18 27.082-27.08 15.698 4.1 17.183-17.18zm-60.6 37.973l-11.172-2.97 29.628-29.628 1.49 5.586 5.59 1.49-25.53 25.53z"/>
-      <path d="M62.51 111.373l1.415 1.414-13.435 13.435-1.415-1.414zm3.536 7.777l1.414 1.415-9.192 9.192-1.414-1.414zm-11.314-11.313l1.414 1.414-9.192 9.2-1.414-1.41z"/>
-    </g>
-    <g fill-rule="nonzero">
-      <path d="M79.835 211.16l-6.223-23.05-.212-.213-1.626 1.627 5.868 21-15.556 15.557-21.213-5.65-5.728-21.14 15.557-15.55 13.435 3.54 1.626-1.62-15.627-4.17-17.183 17.19 4.172 15.63-32.88 32.88 15.627 4.17 27.082-27.08 15.698 4.1 17.183-17.18zm-60.6 37.973l-11.172-2.97 29.628-29.628 1.49 5.586 5.59 1.49-25.53 25.53z"/>
-      <path d="M62.51 197.373l1.415 1.414-13.435 13.435-1.415-1.414zm3.536 7.777l1.414 1.415-9.192 9.192-1.414-1.414zm-11.314-11.313l1.414 1.414-9.192 9.2-1.414-1.41z"/>
-    </g>
-    <g fill-rule="nonzero">
-      <path d="M79.835 298.16l-6.223-23.05-.212-.213-1.626 1.627 5.868 21-15.556 15.557-21.213-5.65-5.728-21.14 15.557-15.55 13.435 3.54 1.626-1.62-15.627-4.17-17.183 17.19 4.172 15.63-32.88 32.88 15.627 4.17 27.082-27.08 15.698 4.1 17.183-17.18zm-60.6 37.973l-11.172-2.97 29.628-29.628 1.49 5.586 5.59 1.49-25.53 25.53z"/>
-      <path d="M62.51 284.373l1.415 1.414-13.435 13.435-1.415-1.414zm3.536 7.777l1.414 1.415-9.192 9.192-1.414-1.414zm-11.314-11.313l1.414 1.414-9.192 9.2-1.414-1.41z"/>
-    </g>
-    <g fill-rule="nonzero">
-      <path d="M79.835 384.16l-6.223-23.05-.212-.213-1.626 1.627 5.868 21-15.556 15.557-21.213-5.65-5.728-21.14 15.557-15.55 13.435 3.54 1.626-1.62-15.627-4.17-17.183 17.19 4.172 15.63-32.88 32.88 15.627 4.17 27.082-27.08 15.698 4.1 17.183-17.18zm-60.6 37.973l-11.172-2.97 29.628-29.628 1.49 5.586 5.59 1.49-25.53 25.53z"/>
-      <path d="M62.51 370.373l1.415 1.414-13.435 13.435-1.415-1.414zm3.536 7.777l1.414 1.415-9.192 9.192-1.414-1.414zm-11.314-11.313l1.414 1.414-9.192 9.2-1.414-1.41z"/>
-    </g>
-    <g fill-rule="nonzero">
-      <path d="M349.073 192.532l-10.675-38.114-.354-.354-2.652 2.652 10.056 34.728-25.363 25.363-35.074-9.71-9.82-34.958 25.37-25.37 22.22 6.07 2.65-2.65-25.84-7.16-28.01 28.01 7.16 25.83-53.6 53.61 25.84 7.16 44.16-44.15 25.95 7.04 28.02-28.02zm-99.212 61.5l-18.47-5.098 48.31-48.306 2.55 9.236 9.24 2.55-41.62 41.62z"/>
-      <path d="M320.263 169.488l2.357 2.356-21.905 21.905-2.356-2.36zm5.97 12.887l2.357 2.356-14.988 14.99-2.356-2.35zm-18.856-18.857l2.357 2.357-14.988 14.988-2.357-2.357z"/>
-    </g>
-    <g fill-rule="nonzero">
-      <path d="M558.308 192.766l-10.676-38.114-.354-.354-2.652 2.652 10.056 34.728-25.363 25.363-35.08-9.71-9.83-34.95 25.36-25.36 22.21 6.07 2.65-2.65-25.84-7.16-28.02 28.02 7.16 25.84-53.61 53.61 25.84 7.16 44.15-44.15 25.95 7.05"/>
-      <path d="M529.497 169.72l2.357 2.358-21.905 21.905-2.36-2.357zm5.97 12.888l2.357 2.357-14.988 14.988-2.357-2.357zm-18.857-18.856l2.358 2.357-14.988 14.98-2.357-2.36z"/>
-    </g>
-    <path d="M100.92 211.624h125v2h-125zm-10.282-83l148.44 56.98-.718 1.868-148.44-56.98zM88.92 285.42l116.698-44.796.717 1.867-116.698 44.8zm5.148-239.797L262.814 163.78l-1.148 1.638L92.92 47.262zM91.92 368.985l137.618-96.36 1.147 1.637-137.617 96.36zm252-153.36h102v2h-102zM510.102 251h-7.27v-12.85h7.27v1.776h-5.168v3.498h4.842v1.758h-4.842v4.034h5.168V251zm11.11 0h-2.075v-5.977c0-.75-.15-1.31-.453-1.678-.302-.37-.78-.554-1.437-.554-.873 0-1.512.26-1.916.78-.4.52-.6 1.38-.6 2.6V251h-2.06v-9.72h1.62l.29 1.274h.11c.3-.463.71-.82 1.25-1.073.54-.25 1.14-.37 1.8-.37 2.34 0 3.5 1.19 3.5 3.56V251zm6.793.176c-1.47 0-2.588-.43-3.353-1.288-.765-.858-1.147-2.09-1.147-3.696 0-1.634.4-2.89 1.2-3.77.8-.88 1.955-1.318 3.467-1.318 1.025 0 1.948.19 2.768.57l-.624 1.662c-.873-.34-1.593-.51-2.162-.51-1.68 0-2.522 1.116-2.522 3.35 0 1.09.21 1.907.628 2.455.42.55 1.033.83 1.842.83.92 0 1.79-.23 2.61-.68v1.8c-.37.22-.763.38-1.182.47-.42.1-.927.14-1.525.14zm9.923-10.072c.416 0 .76.03 1.028.087l-.202 1.93c-.293-.07-.598-.1-.914-.1-.826 0-1.496.27-2.008.81-.513.54-.77 1.24-.77 2.1V251h-2.065v-9.72h1.617l.273 1.713h.105c.322-.58.743-1.04 1.26-1.38.52-.34 1.078-.51 1.676-.51zm1.353.175h2.25l1.98 5.51c.3.78.5 1.52.6 2.21h.07c.06-.32.15-.72.29-1.18.14-.46.89-2.65 2.24-6.56h2.24l-4.16 11.01c-.75 2.02-2.01 3.03-3.78 3.03-.45 0-.9-.05-1.33-.15v-1.64c.31.07.67.1 1.06.1 1 0 1.7-.58 2.1-1.74l.36-.92-3.9-9.72zm16.06 9.89c-1.23 0-2.18-.45-2.86-1.33h-.12c.09.82.13 1.31.13 1.49v3.98h-2.06v-14.04h1.67c.05.18.15.61.29 1.3h.11c.65-.99 1.61-1.48 2.9-1.48 1.22 0 2.16.44 2.84 1.32.68.88 1.02 2.11 1.02 3.7s-.34 2.82-1.03 3.72c-.69.89-1.64 1.33-2.85 1.33zm-.5-8.39c-.82 0-1.42.24-1.79.72s-.56 1.25-.56 2.3v.31c0 1.18.19 2.04.56 2.57.38.53.99.79 1.84.79.72 0 1.27-.3 1.66-.88.39-.59.58-1.42.58-2.51 0-1.09-.19-1.92-.57-2.48-.38-.56-.95-.84-1.69-.84zm10.41 6.71c.51 0 1.01-.08 1.51-.24v1.55c-.23.1-.52.18-.88.25s-.73.1-1.12.1c-1.96 0-2.93-1.03-2.93-3.1v-5.24h-1.33v-.92l1.43-.76.71-2.06h1.28v2.16h2.77v1.56h-2.77V248c0 .495.13.863.38 1.1.25.24.58.357.98.357zm5.52 1.49h-2.07v-9.72h2.07V251zm-2.19-12.3c0-.37.1-.66.31-.86.21-.2.49-.3.87-.3.37 0 .65.1.85.3.21.2.31.48.31.85 0 .35-.1.63-.3.83-.2.2-.48.3-.84.3-.38 0-.66-.1-.87-.31-.2-.2-.3-.48-.3-.83zm13.77 7.41c0 1.59-.4 2.83-1.22 3.72-.81.89-1.94 1.33-3.4 1.33-.91 0-1.71-.21-2.41-.62-.69-.41-1.23-1-1.6-1.77-.37-.77-.56-1.66-.56-2.67 0-1.58.41-2.81 1.22-3.69.81-.89 1.95-1.33 3.42-1.33 1.41 0 2.52.452 3.34 1.36.82.91 1.23 2.13 1.23 3.66zm-7.07 0c0 2.24.83 3.37 2.49 3.37 1.65 0 2.47-1.12 2.47-3.37 0-2.22-.83-3.33-2.48-3.33-.87 0-1.49.29-1.88.86-.39.57-.58 1.4-.58 2.47zm18 4.88h-2.08V245c0-.75-.15-1.31-.45-1.68-.3-.37-.78-.552-1.43-.552-.87 0-1.51.26-1.91.776-.4.514-.6 1.38-.6 2.59V251h-2.06v-9.72h1.62l.29 1.274h.11c.29-.463.71-.82 1.25-1.073.54-.25 1.14-.37 1.79-.37 2.33 0 3.5 1.19 3.5 3.56V251zm17.58 0h-2.43l-4.03-5.82-1.24 1.01V251h-2.1v-12.85h2.1v6.135c.58-.703 1.15-1.38 1.72-2.03l3.47-4.105h2.39c-2.24 2.637-3.85 4.515-4.82 5.634l4.95 7.216zm5.72.17c-1.51 0-2.69-.44-3.54-1.33-.85-.88-1.28-2.1-1.28-3.64 0-1.59.4-2.84 1.19-3.75.79-.91 1.88-1.36 3.26-1.36 1.29 0 2.3.39 3.04 1.16.75.78 1.12 1.85 1.12 3.22v1.11h-6.48c.03.94.29 1.67.77 2.17.48.51 1.16.76 2.03.76.58 0 1.11-.057 1.61-.16.5-.11 1.03-.29 1.6-.54v1.68c-.5.24-1.01.41-1.53.502-.51.1-1.1.15-1.76.15zm-.37-8.51c-.65 0-1.18.21-1.58.62-.39.41-.63 1.02-.71 1.82h4.42c-.01-.81-.2-1.41-.58-1.83-.37-.42-.89-.62-1.54-.62zm5.03-1.39h2.25l1.98 5.51c.3.78.5 1.52.6 2.21h.07c.05-.32.15-.71.29-1.17.14-.46.89-2.64 2.23-6.55h2.24l-4.16 11.01c-.75 2.02-2.01 3.03-3.78 3.03-.45 0-.9-.05-1.33-.15v-1.63c.31.07.67.1 1.07.1.99 0 1.7-.58 2.1-1.73l.36-.92-3.9-9.72zM62.58 426h-2.44l-4.034-5.818-1.24 1.01V426h-2.1v-12.85h2.1v6.135c.575-.703 1.146-1.38 1.715-2.03l3.48-4.105h2.39c-2.24 2.637-3.85 4.515-4.82 5.634L62.58 426zm5.72.176c-1.51 0-2.69-.44-3.547-1.323-.85-.882-1.28-2.096-1.28-3.643 0-1.588.4-2.836 1.19-3.744.79-.908 1.88-1.362 3.26-1.362 1.29 0 2.3.39 3.04 1.168.75.78 1.12 1.852 1.12 3.217v1.11H65.6c.03.94.283 1.67.764 2.17.48.5 1.157.76 2.03.76.574 0 1.11-.06 1.604-.17.495-.11 1.027-.29 1.595-.54v1.68c-.504.24-1.013.41-1.53.51-.515.1-1.104.15-1.766.15zm-.38-8.508c-.66 0-1.187.208-1.58.624-.39.416-.63 1.022-.7 1.82h4.41c-.01-.803-.2-1.41-.58-1.824-.37-.413-.89-.62-1.54-.62zm5.023-1.39h2.25l1.98 5.512c.3.785.5 1.523.6 2.215h.07c.06-.322.15-.713.29-1.173.15-.46.89-2.644 2.24-6.553h2.23l-4.15 11.01c-.754 2.02-2.014 3.03-3.78 3.03-.454 0-.9-.05-1.33-.15v-1.64c.31.07.66.1 1.06.1.997 0 1.697-.58 2.1-1.73l.36-.92-3.9-9.72zm23.43 6.233c0 1.15-.41 2.04-1.235 2.69-.827.65-1.967.98-3.42.98-1.453 0-2.64-.22-3.568-.67v-1.98c.59.28 1.21.49 1.87.65.66.16 1.28.24 1.84.24.84 0 1.45-.15 1.84-.47.4-.31.6-.74.6-1.27 0-.48-.18-.88-.54-1.22-.36-.33-1.11-.73-2.25-1.19-1.17-.47-2-1.01-2.48-1.62-.48-.61-.72-1.34-.72-2.19 0-1.07.38-1.91 1.15-2.53.76-.61 1.783-.92 3.066-.92 1.23 0 2.456.27 3.675.81l-.67 1.72c-1.14-.48-2.16-.72-3.05-.72-.68 0-1.2.15-1.55.44-.35.3-.53.69-.53 1.18 0 .34.07.62.21.86.14.24.37.46.7.67.32.21.9.49 1.74.84.95.398 1.64.76 2.08 1.1.44.34.76.72.97 1.15.21.43.31.93.31 1.51zm10.82 3.49h-2.07v-5.97c0-.75-.15-1.31-.453-1.68-.3-.37-.78-.55-1.437-.55-.867 0-1.504.26-1.91.78-.4.52-.61 1.39-.61 2.61V426h-2.06v-13.676h2.07v3.472c0 .557-.03 1.15-.1 1.784h.13c.28-.47.676-.832 1.18-1.09.5-.258 1.084-.386 1.752-.386 2.354 0 3.53 1.186 3.53 3.56V426zm8.96 0l-.413-1.35h-.07c-.47.59-.94 1-1.416 1.21-.473.22-1.083.32-1.827.32-.955 0-1.7-.26-2.237-.77-.54-.51-.81-1.24-.81-2.19 0-1 .37-1.76 1.11-2.27s1.88-.79 3.4-.83l1.68-.05v-.52c0-.62-.15-1.08-.44-1.39-.29-.31-.74-.46-1.35-.46-.5 0-.977.07-1.43.22-.46.15-.9.32-1.32.52l-.67-1.48c.53-.27 1.104-.48 1.73-.63.627-.14 1.22-.21 1.775-.21 1.24 0 2.17.27 2.8.81.63.54.947 1.39.947 2.54V426h-1.48zm-3.076-1.4c.75 0 1.352-.21 1.806-.63.454-.42.68-1 .68-1.76v-.84l-1.247.06c-.973.04-1.68.2-2.123.49-.44.29-.66.74-.66 1.33 0 .44.13.77.386 1.01s.64.36 1.16.36zm12.366-8.49c.416 0 .76.03 1.03.09l-.2 1.93c-.29-.07-.6-.1-.91-.1-.82 0-1.49.27-2.01.81-.51.54-.77 1.24-.77 2.1V426h-2.06v-9.72h1.62l.28 1.713h.102c.323-.58.743-1.04 1.26-1.38.518-.34 1.076-.51 1.674-.51zm7.075 10.07c-1.513 0-2.695-.44-3.547-1.32-.85-.88-1.28-2.09-1.28-3.64 0-1.58.4-2.83 1.19-3.74.79-.91 1.87-1.36 3.26-1.36 1.28 0 2.29.39 3.04 1.17.74.78 1.11 1.85 1.11 3.22v1.12h-6.48c.03.95.28 1.67.76 2.18.48.51 1.16.76 2.03.76.57 0 1.11-.05 1.6-.16s1.03-.29 1.59-.54v1.68c-.5.24-1.01.41-1.53.51-.51.1-1.1.15-1.76.15zm-.38-8.51c-.655 0-1.18.21-1.576.63-.396.42-.63 1.02-.708 1.82h4.412c-.012-.8-.205-1.41-.58-1.82-.375-.41-.89-.62-1.547-.62zm13.035 5.57c0 .95-.343 1.68-1.035 2.19-.69.51-1.68.76-2.97.76-1.295 0-2.335-.2-3.12-.59v-1.78c1.142.53 2.205.79 3.19.79 1.27 0 1.907-.38 1.907-1.15 0-.24-.07-.45-.21-.61-.14-.17-.37-.34-.693-.51-.33-.18-.78-.38-1.35-.6-1.12-.43-1.88-.87-2.27-1.3-.4-.43-.6-1-.6-1.69 0-.83.33-1.48 1-1.94.67-.46 1.58-.69 2.74-.69 1.14 0 2.22.23 3.24.7l-.67 1.56c-1.05-.43-1.93-.65-2.648-.65-1.09 0-1.63.31-1.63.93 0 .31.14.57.424.78.282.21.902.5 1.86.87.8.31 1.383.59 1.75.85.36.26.63.56.81.9.17.34.26.74.26 1.21zM294.64 251l-3.728-10.73h-.07c.1 1.592.15 3.086.15 4.48V251h-1.908v-12.85h2.962l3.568 10.222h.053l3.674-10.222h2.98V251h-2.02v-6.354c0-.64.02-1.47.05-2.497.04-1.03.06-1.65.09-1.87h-.07L296.5 251h-1.855zm16.918 0l-.413-1.354h-.07c-.47.592-.94.995-1.416 1.21-.48.213-1.09.32-1.83.32-.96 0-1.7-.258-2.24-.774-.54-.515-.81-1.245-.81-2.188 0-1.002.37-1.758 1.11-2.268.74-.51 1.88-.788 3.4-.835l1.67-.05v-.52c0-.62-.15-1.08-.44-1.39-.29-.31-.74-.46-1.35-.46-.5 0-.98.07-1.44.22-.46.15-.9.32-1.32.52l-.67-1.48c.53-.27 1.1-.48 1.73-.63.63-.14 1.22-.21 1.78-.21 1.23 0 2.17.27 2.8.81.63.54.94 1.39.94 2.54V251h-1.48zm-3.077-1.406c.75 0 1.36-.21 1.81-.63.46-.418.68-1.005.68-1.76v-.845l-1.24.05c-.97.03-1.68.2-2.12.49-.44.29-.66.73-.66 1.33 0 .43.13.77.39 1 .26.23.65.35 1.16.35zm13.97-1.363c0 .95-.34 1.68-1.03 2.19s-1.68.76-2.97.76c-1.29 0-2.33-.19-3.12-.59v-1.78c1.15.53 2.21.79 3.19.79 1.27 0 1.91-.38 1.91-1.15 0-.24-.07-.45-.21-.61-.14-.16-.37-.33-.69-.51-.32-.17-.77-.37-1.34-.59-1.12-.43-1.87-.86-2.27-1.3-.39-.43-.59-.99-.59-1.69 0-.83.34-1.47 1.01-1.93.67-.46 1.59-.69 2.74-.69 1.14 0 2.23.23 3.24.7l-.67 1.56c-1.04-.43-1.93-.65-2.64-.65-1.09 0-1.63.31-1.63.93 0 .31.15.57.43.78.29.21.91.5 1.86.87.8.31 1.39.6 1.75.86.37.26.64.56.81.89.18.34.27.74.27 1.21zm5.86 1.28c.51 0 1.01-.08 1.51-.23v1.56c-.23.1-.52.19-.88.25-.36.07-.73.1-1.12.1-1.95 0-2.93-1.03-2.93-3.09v-5.24h-1.32v-.91l1.43-.75.71-2.06h1.28v2.17h2.77v1.57h-2.77v5.2c0 .5.13.87.38 1.11.25.24.58.36.98.36zm7.7 1.67c-1.51 0-2.69-.44-3.54-1.32-.85-.88-1.28-2.09-1.28-3.64 0-1.58.4-2.83 1.19-3.74.79-.91 1.88-1.36 3.26-1.36 1.29 0 2.3.39 3.04 1.17.75.78 1.12 1.85 1.12 3.22v1.12h-6.49c.03.95.29 1.67.77 2.18.48.51 1.16.76 2.03.76.58 0 1.11-.05 1.61-.16.49-.11 1.02-.29 1.59-.54v1.68c-.51.24-1.02.41-1.53.51-.52.1-1.11.15-1.77.15zm-.38-8.51c-.65 0-1.18.21-1.58.63-.39.42-.63 1.02-.7 1.82h4.41c-.01-.8-.2-1.41-.58-1.82-.37-.41-.89-.62-1.54-.62zm11.44-1.56c.42 0 .76.03 1.03.09l-.2 1.93c-.29-.07-.6-.1-.91-.1-.82 0-1.49.27-2.01.81-.51.54-.77 1.24-.77 2.1V251h-2.06v-9.72h1.62l.28 1.713h.11c.32-.58.75-1.04 1.26-1.38.52-.34 1.08-.51 1.68-.51zm17.52 9.89h-2.43l-4.03-5.81-1.24 1.01v4.8h-2.1v-12.85h2.1v6.14c.58-.7 1.15-1.38 1.72-2.03l3.47-4.1h2.39c-2.25 2.64-3.86 4.52-4.83 5.64l4.96 7.22zm5.73.18c-1.51 0-2.69-.44-3.54-1.32-.85-.88-1.28-2.09-1.28-3.64 0-1.58.4-2.83 1.19-3.74.79-.91 1.88-1.36 3.26-1.36 1.29 0 2.3.39 3.05 1.17.74.78 1.12 1.85 1.12 3.22v1.11h-6.48c.03.94.29 1.67.77 2.17.48.51 1.15.76 2.03.76.57 0 1.1-.05 1.6-.16.49-.11 1.02-.29 1.59-.54v1.68c-.5.24-1.01.41-1.53.51-.52.1-1.1.15-1.77.15zm-.38-8.51c-.65 0-1.18.21-1.58.63-.39.42-.63 1.02-.71 1.82h4.41c-.01-.8-.21-1.41-.58-1.82-.38-.41-.89-.62-1.55-.62zm5.03-1.39h2.25l1.98 5.51c.29.79.49 1.53.59 2.22h.07c.05-.32.15-.71.29-1.17.14-.46.88-2.64 2.23-6.55h2.23l-4.15 11.01c-.75 2.02-2.01 3.03-3.78 3.03-.45 0-.9-.05-1.33-.15v-1.64c.31.07.67.11 1.07.11 1 0 1.7-.58 2.1-1.73l.36-.91-3.9-9.72z"/>
-  </g>
-</svg>
diff --git a/website/public/img/vault-shamir-storage.png b/website/public/img/vault-shamir-storage.png
deleted file mode 100644
index 9dce73df230..00000000000
Binary files a/website/public/img/vault-shamir-storage.png and /dev/null differ
diff --git a/website/public/img/vault-sidecar-inject-workflow.png b/website/public/img/vault-sidecar-inject-workflow.png
deleted file mode 100644
index 3749dd5ae46..00000000000
Binary files a/website/public/img/vault-sidecar-inject-workflow.png and /dev/null differ
diff --git a/website/public/img/vault-ssh-otp-1.png b/website/public/img/vault-ssh-otp-1.png
deleted file mode 100644
index f8bd33183d6..00000000000
Binary files a/website/public/img/vault-ssh-otp-1.png and /dev/null differ
diff --git a/website/public/img/vault-ssh-otp-2.png b/website/public/img/vault-ssh-otp-2.png
deleted file mode 100644
index 8a9717a03f1..00000000000
Binary files a/website/public/img/vault-ssh-otp-2.png and /dev/null differ
diff --git a/website/public/img/vault-static-secrets.png b/website/public/img/vault-static-secrets.png
deleted file mode 100644
index 6ad6fc2d2a6..00000000000
Binary files a/website/public/img/vault-static-secrets.png and /dev/null differ
diff --git a/website/public/img/vault-static-secrets2.png b/website/public/img/vault-static-secrets2.png
deleted file mode 100644
index 58781d4413c..00000000000
Binary files a/website/public/img/vault-static-secrets2.png and /dev/null differ
diff --git a/website/public/img/vault-transit-1.png b/website/public/img/vault-transit-1.png
deleted file mode 100644
index 307570fe8d4..00000000000
Binary files a/website/public/img/vault-transit-1.png and /dev/null differ
diff --git a/website/public/img/vault-transit-2.png b/website/public/img/vault-transit-2.png
deleted file mode 100644
index 467408d7c82..00000000000
Binary files a/website/public/img/vault-transit-2.png and /dev/null differ
diff --git a/website/public/img/vault-transit-3.png b/website/public/img/vault-transit-3.png
deleted file mode 100644
index 372b9d8687d..00000000000
Binary files a/website/public/img/vault-transit-3.png and /dev/null differ
diff --git a/website/public/img/vault-transit-4.png b/website/public/img/vault-transit-4.png
deleted file mode 100644
index 67e19dba660..00000000000
Binary files a/website/public/img/vault-transit-4.png and /dev/null differ
diff --git a/website/public/img/vault-transit-5.png b/website/public/img/vault-transit-5.png
deleted file mode 100644
index 2167783103a..00000000000
Binary files a/website/public/img/vault-transit-5.png and /dev/null differ
diff --git a/website/public/img/vault-usage-metrics-1-10.png b/website/public/img/vault-usage-metrics-1-10.png
deleted file mode 100644
index 2ba7802ed18..00000000000
Binary files a/website/public/img/vault-usage-metrics-1-10.png and /dev/null differ
diff --git a/website/public/img/vault-usage-metrics-1-11.png b/website/public/img/vault-usage-metrics-1-11.png
deleted file mode 100644
index 2dd8ce20e3b..00000000000
Binary files a/website/public/img/vault-usage-metrics-1-11.png and /dev/null differ
diff --git a/website/public/img/vault-versioned-kv-1.png b/website/public/img/vault-versioned-kv-1.png
deleted file mode 100644
index ff9a11d6f3c..00000000000
Binary files a/website/public/img/vault-versioned-kv-1.png and /dev/null differ
diff --git a/website/public/img/vault-versioned-kv-2.png b/website/public/img/vault-versioned-kv-2.png
deleted file mode 100644
index 2f7948cb69a..00000000000
Binary files a/website/public/img/vault-versioned-kv-2.png and /dev/null differ
diff --git a/website/public/img/vault-versioned-kv-3.png b/website/public/img/vault-versioned-kv-3.png
deleted file mode 100644
index 00bf85c2a29..00000000000
Binary files a/website/public/img/vault-versioned-kv-3.png and /dev/null differ
diff --git a/website/public/img/vault-versioned-kv-4.png b/website/public/img/vault-versioned-kv-4.png
deleted file mode 100644
index b7293f58058..00000000000
Binary files a/website/public/img/vault-versioned-kv-4.png and /dev/null differ
diff --git a/website/public/img/vault-versioned-kv-5.png b/website/public/img/vault-versioned-kv-5.png
deleted file mode 100644
index 5e6b5b24190..00000000000
Binary files a/website/public/img/vault-versioned-kv-5.png and /dev/null differ
diff --git a/website/public/img/vault-versioned-kv-6.png b/website/public/img/vault-versioned-kv-6.png
deleted file mode 100644
index 769de7cbe85..00000000000
Binary files a/website/public/img/vault-versioned-kv-6.png and /dev/null differ
diff --git a/website/public/img/vault-workflow-diagram.png b/website/public/img/vault-workflow-diagram.png
deleted file mode 100644
index 658231a0123..00000000000
Binary files a/website/public/img/vault-workflow-diagram.png and /dev/null differ
diff --git a/website/public/img/vault-workflow-diagram1.png b/website/public/img/vault-workflow-diagram1.png
deleted file mode 100644
index 5627d691ddb..00000000000
Binary files a/website/public/img/vault-workflow-diagram1.png and /dev/null differ
diff --git a/website/public/img/vault-workflow-diagram2.png b/website/public/img/vault-workflow-diagram2.png
deleted file mode 100644
index ae165243772..00000000000
Binary files a/website/public/img/vault-workflow-diagram2.png and /dev/null differ
diff --git a/website/public/img/vault_cluster.png b/website/public/img/vault_cluster.png
deleted file mode 100644
index 48e1fe2b9ad..00000000000
Binary files a/website/public/img/vault_cluster.png and /dev/null differ
diff --git a/website/redirects.js b/website/redirects.js
deleted file mode 100644
index 2fa7fb80f53..00000000000
--- a/website/redirects.js
+++ /dev/null
@@ -1,113 +0,0 @@
-/**
- * Copyright (c) HashiCorp, Inc.
- * SPDX-License-Identifier: BUSL-1.1
- */
-
-module.exports = [
-  // example redirect:
-  // {
-  //   source: '/vault/docs/some/path',
-  //   destination: '/vault/docs/some/other/path',
-  //   permanent: true,
-  // },
-  {
-    source: '/vault/docs/plugins/plugin-portal',
-    destination: '/vault/integrations',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/agent/autoauth',
-    destination: '/vault/docs/agent-and-proxy/autoauth',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/agent/autoauth/:slug',
-    destination: '/vault/docs/agent-and-proxy/autoauth/:slug',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/agent/template',
-    destination: '/vault/docs/agent-and-proxy/agent/template',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/agent/winsvc',
-    destination: '/vault/docs/agent-and-proxy/agent/winsvc',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/agent/versions',
-    destination: '/vault/docs/agent-and-proxy/agent/versions',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/agent/apiproxy',
-    destination: '/vault/docs/agent-and-proxy/agent/apiproxy',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/agent',
-    destination: '/vault/docs/agent-and-proxy/agent',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/agent/caching',
-    destination: '/vault/docs/agent-and-proxy/agent/caching',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/agent/caching/:slug',
-    destination: '/vault/docs/agent-and-proxy/agent/caching/:slug',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/:version(v1\.(?:4|5|6|7|8|9|10|11|12|13)\.x)/agent-and-proxy/agent',
-    destination: '/vault/docs/:version/agent/',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/:version(v1\.(?:4|5|6|7|8|9|10|11|12|13)\.x)/agent-and-proxy/agent/template',
-    destination: '/vault/docs/:version/agent/template',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/:version(v1\.(?:4|5|6|7|8|9|10|11|12|13)\.x)/agent-and-proxy/agent/caching',
-    destination: '/vault/docs/:version/agent/caching',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/:version(v1\.(?:4|5|6|7|8|9|10|11|12|13)\.x)/agent-and-proxy/autoauth/:slug*',
-    destination: '/vault/docs/:version/agent/autoauth/:slug',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/:version(v1\.(?:8|9|10|11|12|13)\.x)/agent-and-proxy/agent/caching/:slug*',
-    destination: '/vault/docs/:version/agent/caching/:slug',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/:version(v1\.(?:7|8|9|10|11|12|13)\.x)/agent-and-proxy/agent/winsvc',
-    destination: '/vault/docs/:version/agent/winsvc',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/:version(v1\.(?:8|9)\.x)/agent-and-proxy/agent/generate-config',
-    destination: '/vault/docs/:version/agent/template-config',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/v1.13.x/agent-and-proxy/agent/versions',
-    destination: '/vault/docs/v1.13.x/agent/versions',
-    permanent: true,
-  },
-  {
-    source: '/vault/docs/v1.13.x/agent-and-proxy/agent/apiproxy',
-    destination: '/vault/docs/v1.13.x/agent/apiproxy',
-    permanent: true,
-  },
-  {
-    source: '/vault/api-docs/system/plugins-reload-backend',
-    destination: '/vault/api-docs/system/plugins-reload',
-    permanent: true,
-  }
-]
diff --git a/website/scripts/should-build.sh b/website/scripts/should-build.sh
deleted file mode 100644
index 2d5021b1df3..00000000000
--- a/website/scripts/should-build.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-######################################################
-# NOTE: This file is managed by the Digital Team's   #
-# Terraform configuration @ hashicorp/mktg-terraform #
-######################################################
-
-# This is run during the website build step to determine if we should skip the build or not.
-# More information: https://vercel.com/docs/platform/projects#ignored-build-step
-
-if [[ "$VERCEL_GIT_COMMIT_REF" == "stable-website"  ]] ; then
-  # Proceed with the build if the branch is stable-website
-  echo "✅ - Build can proceed"
-  exit 1;
-else
-  # Check for differences in the website directory
-  git diff --quiet HEAD^ HEAD ./
-fi
diff --git a/website/scripts/website-build.sh b/website/scripts/website-build.sh
deleted file mode 100755
index 45a3307c170..00000000000
--- a/website/scripts/website-build.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-######################################################
-# NOTE: This file is managed by the Digital Team's   #
-# Terraform configuration @ hashicorp/mktg-terraform #
-######################################################
-
-# Repo which we are cloning and executing npm run build:deploy-preview within
-REPO_TO_CLONE=dev-portal
-# Set the subdirectory name for the base project
-PREVIEW_DIR=website-preview
-# The directory we want to clone the project into
-CLONE_DIR=website-preview
-# The product for which we are building the deploy preview
-PRODUCT=vault
-# Preview mode, controls the UI rendered (either the product site or developer). Can be `io` or `developer`
-PREVIEW_MODE=developer
-
-# Get the git branch of the commit that triggered the deploy preview
-# This will power remote image assets in local and deploy previews
-CURRENT_GIT_BRANCH=$VERCEL_GIT_COMMIT_REF
-
-# This is where content files live, relative to the website-preview dir. If omitted, "../content" will be used
-LOCAL_CONTENT_DIR=
-
-from_cache=false
-
-if [ -d "$PREVIEW_DIR" ]; then
-  echo "$PREVIEW_DIR found"
-  CLONE_DIR="$PREVIEW_DIR-tmp"
-  from_cache=true
-fi
-
-# Clone the base project, if needed
-echo "⏳ Cloning the $REPO_TO_CLONE repo, this might take a while..."
-git clone --depth=1 "https://github.com/hashicorp/$REPO_TO_CLONE.git" "$CLONE_DIR"
-
-if [ "$from_cache" = true ]; then
-  echo "Setting up $PREVIEW_DIR"
-  cp -R "./$CLONE_DIR/." "./$PREVIEW_DIR"
-fi
-
-# cd into the preview directory project
-cd "$PREVIEW_DIR"
-
-# Run the build:deploy-preview start script
-PREVIEW_FROM_REPO=$PRODUCT \
-IS_CONTENT_PREVIEW=true \
-PREVIEW_MODE=$PREVIEW_MODE \
-REPO=$PRODUCT \
-HASHI_ENV=project-preview \
-LOCAL_CONTENT_DIR=$LOCAL_CONTENT_DIR \
-CURRENT_GIT_BRANCH=$CURRENT_GIT_BRANCH \
-npm run build:deploy-preview
diff --git a/website/scripts/website-start.sh b/website/scripts/website-start.sh
deleted file mode 100755
index bd1738eea39..00000000000
--- a/website/scripts/website-start.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-######################################################
-# NOTE: This file is managed by the Digital Team's   #
-# Terraform configuration @ hashicorp/mktg-terraform #
-######################################################
-
-# Repo which we are cloning and executing npm run build:deploy-preview within
-REPO_TO_CLONE=dev-portal
-# Set the subdirectory name for the dev-portal app
-PREVIEW_DIR=website-preview
-# The product for which we are building the deploy preview
-PRODUCT=vault
-# Preview mode, controls the UI rendered (either the product site or developer). Can be `io` or `developer`
-PREVIEW_MODE=developer
-
-# Get the git branch of the commit that triggered the deploy preview
-# This will power remote image assets in local and deploy previews
-CURRENT_GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
-
-# This is where content files live, relative to the website-preview dir. If omitted, "../content" will be used
-LOCAL_CONTENT_DIR=
-
-should_pull=true
-
-# Clone the dev-portal project, if needed
-if [ ! -d "$PREVIEW_DIR" ]; then
-    echo "⏳ Cloning the $REPO_TO_CLONE repo, this might take a while..."
-    git clone --depth=1 https://github.com/hashicorp/$REPO_TO_CLONE.git "$PREVIEW_DIR"
-    should_pull=false
-fi
-
-cd "$PREVIEW_DIR"
-
-# If the directory already existed, pull to ensure the clone is fresh
-if [ "$should_pull" = true ]; then
-    git pull origin main
-fi
-
-# Run the dev-portal content-repo start script
-REPO=$PRODUCT \
-PREVIEW_FROM_REPO=$PRODUCT \
-LOCAL_CONTENT_DIR=$LOCAL_CONTENT_DIR \
-CURRENT_GIT_BRANCH=$CURRENT_GIT_BRANCH \
-PREVIEW_MODE=$PREVIEW_MODE \
-npm run start:local-preview
diff --git a/website/vercel.json b/website/vercel.json
deleted file mode 100644
index 0e6117e609c..00000000000
--- a/website/vercel.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "version": 2,
-  "public": true,
-  "github": {
-    "silent": true
-  }
-}